From fcb31c6d3833d57a212aae92e3aea3f09df53b10 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Fri, 15 Apr 2016 13:10:21 -0700 Subject: [PATCH 001/439] Adding Windows Defender Advanced Threat Protection --- windows/keep-secure/TOC.md | 9 + ...tion-windows-advanced-threat-protection.md | 49 +++++ ...ueue-windows-advanced-threat-protection.md | 64 ++++++ ...ints-windows-advanced-threat-protection.md | 98 ++++++++++ ...oard-windows-advanced-threat-protection.md | 87 +++++++++ ...ows-defender-advanced-threat-protection.md | 70 +++++++ ...ysis-windows-advanced-threat-protection.md | 99 ++++++++++ .../keep-secure/images/active-threat-icon.png | Bin 0 -> 3176 bytes windows/keep-secure/images/add-user.png | Bin 0 -> 3001 bytes windows/keep-secure/images/alert-icon.png | Bin 0 -> 1108 bytes windows/keep-secure/images/alertsq.png | Bin 0 -> 101134 bytes .../keep-secure/images/analysis-results.png | Bin 0 -> 296094 bytes windows/keep-secure/images/assign-users.png | Bin 0 -> 29294 bytes windows/keep-secure/images/atp.png | Bin 0 -> 42316 bytes .../images/azure-active-directory-list.png | Bin 0 -> 26652 bytes .../images/azure-active-directory.png | Bin 0 -> 8618 bytes windows/keep-secure/images/azure-browse.png | Bin 0 -> 39341 bytes .../images/azure-org-directory.png | Bin 0 -> 10882 bytes windows/keep-secure/images/azure-signout.png | Bin 0 -> 13267 bytes windows/keep-secure/images/changes-icon.png | Bin 0 -> 507 bytes windows/keep-secure/images/check-icon.png | Bin 0 -> 908 bytes windows/keep-secure/images/comments-icon.png | Bin 0 -> 448 bytes windows/keep-secure/images/comments.png | Bin 0 -> 24398 bytes .../images/confirm-user-access.png | Bin 0 -> 36712 bytes .../images/contoso-active-directory.png | Bin 0 -> 26652 bytes .../images/contoso-application.png | Bin 0 -> 14815 bytes windows/keep-secure/images/contoso-users.png | Bin 0 -> 30722 bytes windows/keep-secure/images/contoso.png | Bin 0 -> 30771 bytes windows/keep-secure/images/detection-icon.png | Bin 0 -> 3261 bytes windows/keep-secure/images/expand.png | Bin 0 -> 664 bytes windows/keep-secure/images/export-sccm.png | Bin 0 -> 33784 bytes .../images/machine-investigation.png | Bin 0 -> 126857 bytes .../images/machines-active-threats-tile.png | Bin 0 -> 18095 bytes .../keep-secure/images/machines-at-risk.png | Bin 0 -> 14658 bytes .../images/machines-reporting-tile.png | Bin 0 -> 14672 bytes windows/keep-secure/images/machines-view.png | Bin 0 -> 70885 bytes .../keep-secure/images/manage-alert-menu.png | Bin 0 -> 26924 bytes windows/keep-secure/images/menu-icon.png | Bin 0 -> 774 bytes .../images/not-remediated-icon.png | Bin 0 -> 4655 bytes windows/keep-secure/images/overview.png | Bin 0 -> 17148 bytes windows/keep-secure/images/portal.png | Bin 0 -> 563593 bytes .../keep-secure/images/remediated-icon.png | Bin 0 -> 1105 bytes windows/keep-secure/images/remove-menu.png | Bin 0 -> 3301 bytes windows/keep-secure/images/resolve-alert.png | Bin 0 -> 38547 bytes windows/keep-secure/images/rules-legend.png | Bin 0 -> 34867 bytes windows/keep-secure/images/run-as-admin.png | Bin 0 -> 29080 bytes .../keep-secure/images/sccm-deployment.png | Bin 0 -> 57015 bytes .../keep-secure/images/service-components.png | Bin 0 -> 95079 bytes windows/keep-secure/images/settings-icon.png | Bin 0 -> 690 bytes windows/keep-secure/images/settings.png | Bin 0 -> 628 bytes .../keep-secure/images/sort-order-icon.png | Bin 0 -> 487 bytes windows/keep-secure/images/status-tile.png | Bin 0 -> 10357 bytes windows/keep-secure/images/submit-file.png | Bin 0 -> 23858 bytes .../keep-secure/images/suppression-rules.png | Bin 0 -> 13041 bytes windows/keep-secure/images/timeline.png | Bin 0 -> 42949 bytes .../images/windows-atp-service-users.png | Bin 0 -> 29294 bytes .../images/windows-atp-service.png | Bin 0 -> 8898 bytes ...erts-windows-advanced-threat-protection.md | 183 ++++++++++++++++++ ...view-windows-advanced-threat-protection.md | 74 +++++++ ...erts-windows-advanced-threat-protection.md | 134 +++++++++++++ ...ows-defender-advanced-threat-protection.md | 73 +++++++ ...ding-windows-advanced-threat-protection.md | 95 +++++++++ ...gure-windows-advanced-threat-protection.md | 37 ++++ ...ows-defender-advanced-threat-protection.md | 64 ++++++ ...ding-windows-advanced-threat-protection.md | 119 ++++++++++++ ...ows-defender-advanced-threat-protection.md | 54 ++++++ ...ding-windows-advanced-threat-protection.md | 101 ++++++++++ ...ows-defender-advanced-threat-protection.md | 24 +++ ...ows-defender-advanced-threat-protection.md | 57 ++++++ ...ows-defender-advanced-threat-protection.md | 84 ++++++++ 70 files changed, 1575 insertions(+) create mode 100644 windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md create mode 100644 windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md create mode 100644 windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md create mode 100644 windows/keep-secure/dashboard-windows-advanced-threat-protection.md create mode 100644 windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md create mode 100644 windows/keep-secure/deep-analysis-windows-advanced-threat-protection.md create mode 100644 windows/keep-secure/images/active-threat-icon.png create mode 100644 windows/keep-secure/images/add-user.png create mode 100644 windows/keep-secure/images/alert-icon.png create mode 100644 windows/keep-secure/images/alertsq.png create mode 100644 windows/keep-secure/images/analysis-results.png create mode 100644 windows/keep-secure/images/assign-users.png create mode 100644 windows/keep-secure/images/atp.png create mode 100644 windows/keep-secure/images/azure-active-directory-list.png create mode 100644 windows/keep-secure/images/azure-active-directory.png create mode 100644 windows/keep-secure/images/azure-browse.png create mode 100644 windows/keep-secure/images/azure-org-directory.png create mode 100644 windows/keep-secure/images/azure-signout.png create mode 100644 windows/keep-secure/images/changes-icon.png create mode 100644 windows/keep-secure/images/check-icon.png create mode 100644 windows/keep-secure/images/comments-icon.png create mode 100644 windows/keep-secure/images/comments.png create mode 100644 windows/keep-secure/images/confirm-user-access.png create mode 100644 windows/keep-secure/images/contoso-active-directory.png create mode 100644 windows/keep-secure/images/contoso-application.png create mode 100644 windows/keep-secure/images/contoso-users.png create mode 100644 windows/keep-secure/images/contoso.png create mode 100644 windows/keep-secure/images/detection-icon.png create mode 100644 windows/keep-secure/images/expand.png create mode 100644 windows/keep-secure/images/export-sccm.png create mode 100644 windows/keep-secure/images/machine-investigation.png create mode 100644 windows/keep-secure/images/machines-active-threats-tile.png create mode 100644 windows/keep-secure/images/machines-at-risk.png create mode 100644 windows/keep-secure/images/machines-reporting-tile.png create mode 100644 windows/keep-secure/images/machines-view.png create mode 100644 windows/keep-secure/images/manage-alert-menu.png create mode 100644 windows/keep-secure/images/menu-icon.png create mode 100644 windows/keep-secure/images/not-remediated-icon.png create mode 100644 windows/keep-secure/images/overview.png create mode 100644 windows/keep-secure/images/portal.png create mode 100644 windows/keep-secure/images/remediated-icon.png create mode 100644 windows/keep-secure/images/remove-menu.png create mode 100644 windows/keep-secure/images/resolve-alert.png create mode 100644 windows/keep-secure/images/rules-legend.png create mode 100644 windows/keep-secure/images/run-as-admin.png create mode 100644 windows/keep-secure/images/sccm-deployment.png create mode 100644 windows/keep-secure/images/service-components.png create mode 100644 windows/keep-secure/images/settings-icon.png create mode 100644 windows/keep-secure/images/settings.png create mode 100644 windows/keep-secure/images/sort-order-icon.png create mode 100644 windows/keep-secure/images/status-tile.png create mode 100644 windows/keep-secure/images/submit-file.png create mode 100644 windows/keep-secure/images/suppression-rules.png create mode 100644 windows/keep-secure/images/timeline.png create mode 100644 windows/keep-secure/images/windows-atp-service-users.png create mode 100644 windows/keep-secure/images/windows-atp-service.png create mode 100644 windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md create mode 100644 windows/keep-secure/machines-view-windows-advanced-threat-protection.md create mode 100644 windows/keep-secure/manage-alerts-windows-advanced-threat-protection.md create mode 100644 windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md create mode 100644 windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md create mode 100644 windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md create mode 100644 windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md create mode 100644 windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md create mode 100644 windows/keep-secure/settings-windows-defender-advanced-threat-protection.md create mode 100644 windows/keep-secure/troubleshoot-onboarding-windows-advanced-threat-protection.md create mode 100644 windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md create mode 100644 windows/keep-secure/use-windows-defender-advanced-threat-protection.md create mode 100644 windows/keep-secure/windows-defender-advanced-threat-protection.md diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 05507c1d74..f6205dde4d 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -405,6 +405,15 @@ #### [Update and manage Windows Defender in Windows 10](get-started-with-windows-defender-for-windows-10.md) #### [Configure Windows Defender in Windows 10](configure-windows-defender-in-windows-10.md) #### [Troubleshoot Windows Defender in Windows 10](troubleshoot-windows-defender-in-windows-10.md) +### [Windows Defender Advanced Threat Protection](windows-defender-in-windows-10.md) +#### [Requirements for Windows Defender ATP](requirements-windows-defender-atp.md) +#### [Onboard and configure Windows Defender ATP](onboard-configure-windows-defender-atp.md) +#### [Windows Defender ATP data storage and privacy](data-storage-privacy-windows-defender-atp.md) +#### [Windows Defender ATP portal overview](portal-overview-windows-defender-atp.md) +#### [Windows Defender ATP icons](icons-windows-atp.md) +#### [Use Windows Defender ATP Portal](use-windows-defender-atp.md) +#### [Windows Defender ATP settings](settings-windows-defender-atp.md) +#### [Troubleshoot Windows Defender ATP](troubleshoot-windows-defender-atp.md) ## [Enterprise security guides](windows-10-enterprise-security-guides.md) ### [Control the health of Windows 10-based devices](protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md) ### [Device Guard deployment guide](device-guard-deployment-guide.md) diff --git a/windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md b/windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md new file mode 100644 index 0000000000..c5e38182d4 --- /dev/null +++ b/windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md @@ -0,0 +1,49 @@ +--- +title: Additional Windows Defender ATP configuration settings +description: Use the Group Policy Console to configure settings that enable sample sharing from your endpoints. These settings are used in the deep analysis feature. +keywords: configuration settings, Windows Defender ATP configuration settings, Windows Defender Advanced Threat Protection configuration settings, group policy Management Editor, computer configuration, policies, administrative templates, +search.product: eADQiWindows 10XVcnh +ms.prod: W10 +ms.mktglfcycl: +ms.sitesec: library +author: mjcaparas +--- + +# Additional Windows Defender ATP configuration settings + +**Applies to** + +- Windows 10 Insider Preview + +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + +You can use Group Policy (GP) to configure settings, such as settings for the sample sharing used in the deep analysis feature. + +## Configure sample collection settings with Group Policy +1. On your GP management machine, copy the following files from the + configuration package: + + a. Copy _AtpConfiguration.admx_ into _C:\\Windows\\PolicyDefinitions_ + + b. Copy _AtpConfiguration.adml_ into _C:\\Windows\\PolicyDefinitions\\en-US_ + +2. Open the [Group Policy Management Console](https://technet.microsoft.com/en-us/library/cc731212.aspx), right-click the GPO you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor**, go to **Computer configuration**. + +4. Click **Policies**, then **Administrative templates**. + +5. Click **Windows components** and then **Windows Advanced Threat Protection**. + +6. Choose to enable or disable sample sharing from your endpoints. + +## Configure sample collection settings with Configuration Manager + +TBA + + +## Related topics +- [Windows Defender ATP service onboarding](service-onboarding-windows-advanced-threat-protection.md) +- [Configure Windows Defender ATP endpoints (client onboarding)](configure-endpoints-windows-advanced-threat-protection.md) +- [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-advanced-threat-protection.md) +- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) diff --git a/windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md b/windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md new file mode 100644 index 0000000000..eff7474856 --- /dev/null +++ b/windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md @@ -0,0 +1,64 @@ +--- +title: View and organize the Windows Defender ATP Alerts queue +description: Learn about how the Windows Defender ATP alerts queue work, and how to sort and filter lists of alerts. +keywords: alerts, queues, alerts queue, sort, order, filter, manage alerts, new, in progress, resolved, newest, time in queue, severity, time period +search.product: eADQiWindows 10XVcnh +ms.prod: W10 +ms.mktglfcycl: +ms.sitesec: library +--- + +# View and organize the Windows Defender Advanced Threat Protection Alerts queue + +- Windows 10 Insider Preview + +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + +As a security operations team member, you can manage Windows Defender ATP alerts as part of your routine activities. Alerts will appear in the respective queues according to their current status. + +To see a list of alerts, click any of the queues under the **Alerts queue** option in the navigation pane. + +> **Note**  By default, the queues are sorted from newest to oldest. + +The following table and screenshot demonstrate the main areas of the **Alerts queue**. + +![Screenshot of the Dashboard showing the New Alerts list and navigation bar](images/alertsq.png) + +Highlighted area|Area name|Description +:---|:---|:--- +(1)|**Alerts queue**| Select to show **New**, **In Progress**, or **Resolved alerts** +(2)|Alerts|Each alert shows:Clicking an alert expands to display more information about the threat and brings you to the date in the timeline when the alert was detected. +(3)|Alerts sorting and filters | You can sort alerts by: You can also filter the displayed alerts by:See [Windows Defender ATP alerts](use-windows-defender-advanced-threat-protection.md#windows-defender-atp-alerts) for more details. + +##Sort and filter the Alerts queue +You can filter and sort (or "pivot") the Alerts queue to identify specific alerts based on certain criteria. +There are three mechanisms to pivot the queue against: + +1. Sort the queue by opening the drop-down menu in the **Sort by** field and choosing: + + - **Newest** - Sorts alerts by when the alert was last seen on an endpoint. + - **Time in queue** - Sorts alerts by the length of time an alert has been in the queue. + - **Severity** - Sorts alerts by their level of severity. + +2. Filter alerts by their **Severity** by opening the drop-down menu in the **Filter by** field and selecting one or more of the check boxes: + + - High (Red) - Threats often associated with APT. These alerts pose a high risk due to the severity of the damage they might inflict on endpoints. + - Medium (Orange) - Threats considered to be abnormal or suspicious in nature such as anomalous registry modifications and loading of executable files. + - Low (Yellow) - Threats associated with prevalent malware and hack-tools that pose a lower risk to endpoints. + +3. Limit the queue to see alerts from various set periods by clicking the drop-down menu in the date range field (by default, this is selected as **6 months**): + + - **1 day** + - **3 days** + - **7 days** + - **30 days** + - **6 months** + + > **Note**  You can change the sort order (for example, from most recent to least recent) by clicking the sort order icon ![the sort order icon looks like two arrows on top of each other](images/sort-order-icon.png) + +### Related topics + +- [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-advanced-threat-protection.md) +- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-advanced-threat-protection.md) +- [Submit files to the Windows Defender ATP Deep analysis feature](deep-analysis-windows-advanced-threat-protection.md) +- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-advanced-threat-protection.md) diff --git a/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md new file mode 100644 index 0000000000..521af51f10 --- /dev/null +++ b/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md @@ -0,0 +1,98 @@ +--- +title: Configure Windows Defender ATP endpoints (client onboarding) +description: Use Group Policy to deploy the configuration package or do manual registry changes on endpoints so that they are onboarded to the service. +keywords: configure endpoints, client onboarding, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints +search.product: eADQiWindows 10XVcnh +ms.prod: W10 +ms.mktglfcycl: +ms.sitesec: library +author: mjcaparas +--- + +# Configure Windows Defender ATP endpoints (client onboarding) + +- Windows 10 Insider Preview + +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + +You can use a Group Policy (GP) configuration package or an automated script to configure endpoints. You can deploy the GP configuration package or script with a GP update, or manually through the command line. + +## Configure with Group Policy +Using the GP configuration package ensures your endpoints will be correctly configured to report to the Windows Defender ATP service. + +> **Note**   To use GP updates to deploy the package, you must be on Windows Server 2008 R2 or later. The endpoints must be running Windows 10 TAP. + +1. Open the GP configuration package .zip file (*WindowsATPOnboardingPackage.zip*) that you downloaded during the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://seville.windows.com): + + a. Click **Client onboarding** on the **Navigation pane**. + + b. Select **GP**, click **Download package** and save the .zip file. + +2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the endpoints. You should have a folder called _*OptionalParamsPolicy*_ and the file _*WindowsATPOnboardingPackage.cmd*_. + +3. Open the [Group Policy Management Console](https://technet.microsoft.com/en-us/library/cc731212.aspx) (GPMC), right-click the Group Policy Object (GPO) you want to configure and click **Edit**. + +4. In the **Group Policy Management Editor***, go to **Computer configuration**, then **Preferences**, and then **Control panel settings**. + +5. Right-click **Scheduled tasks**, point to **New** and then click **Immediate task**. + +6. In the **Task** window that opens, go to the **General** tab. Choose the local SYSTEM user account under **Security options**. + +7. Select **Run whether user is logged on or not** and check the **Run with highest privileges** check box. + +8. Go to the **Actions** tab and click **New…** Ensure that **Start a program** is selected in the **Action** field. Enter the file name and location of the shared _*WindowsATPOnboardingPackage.cmd*_ file. + +9. Click **OK** and close any open GPMC windows. + +For additional settings, see the [Additional configuration settings section](additional-configuration-windows-advanced-threat-protection.md). + +## Configure with System Center Configuration Manager (SCCM) + +1. Open the SCCM configuration package .zip file (*WindowsATPOnboardingPackage.zip*) that you downloaded during the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://seville.windows.com): Naama: Confirm package name + + a. Click **Client onboarding** on the **Navigation pane**. + + b. Select **SCCM**, click **Download package** and save the .zip file. Iaan: Need to confirm the UI for this + +2. Copy the .zip file to a shared, read-only location that can be accessed by the network administrators who will be deploying the package. + +Iaan: Will confirm ui for this + +3. In the SCCM console, go to **Software Library**. +4. Under **Application Management**, right click **Packages** and select **Import**. +5. Click Browse and choose the package that was downloaded from the portal (zip file). +6. The package will appear under the Packages page. +7. Right click the Package and choose deploy. +8. Choose a predefined device collection to deploy the package to. + +Naama note: If it’s a package we create then we’ll set the necessary privileges, otherwise provide guidance (Omri: what is the necessary privileges?) + +## Configure endpoints manually with registry changes +You can also manually onboard individual endpoints to Windows Defender ATP. You might want to do this when first testing the service before you commit to onboarding all endpoints in your network. + +1. Extract the contents of the configuration package to a location on + the endpoint you want to onboard (for example, the Desktop). + +2. Open an elevated command line prompt on the endpoint and run the + script: + + a. Click **Start** and type **cmd**. + + b. Right-click Command prompt and select **Run as administrator**. + + ![Window Start menu pointing to Run as administrator](images/run-as-admin.png) + +3. Type the location of the script file. If you copied the file the + desktop, type: +```*%userprofile%\Desktop\WindowsATPOnboardingScript.sc*``` + +4. Press the **Enter ** key or click **OK**. + +See the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) topic for details on how you can manually validate that the endpoint is compliant and correctly reporting telemetry. + +## Related topics +- [Windows Defender ATP service onboarding](service-onboarding-windows-advanced-threat-protection.md) +- [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-advanced-threat-protection.md) +- [Additional Windows Defender ATP configuration settings](additional-configuration-windows-advanced-threat-protection.md) +- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) + diff --git a/windows/keep-secure/dashboard-windows-advanced-threat-protection.md b/windows/keep-secure/dashboard-windows-advanced-threat-protection.md new file mode 100644 index 0000000000..a28fd40d5a --- /dev/null +++ b/windows/keep-secure/dashboard-windows-advanced-threat-protection.md @@ -0,0 +1,87 @@ +--- +title: View the Windows Defender Advanced Threat Protection Dashboard +description: Use the Dashboard to identify machines at risk, keep track of the status of the service, and see statistics and information about machines and alerts. +keywords: dashboard, alerts, new, in progress, resolved, risk, machines at risk, infections, reporting, statistics, charts, graphs, health, active threats, threat category, categories, password stealer, ransomware, exploit, threat, low severity, active malware +search.product: eADQiWindows 10XVcnh +ms.prod: W10 +ms.mktglfcycl: +ms.sitesec: library +--- + +# View the Windows Defender Advanced Threat Protection Dashboard + +- Windows 10 Insider Preview + +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + +The **Dashboard** displays a snapshot of: + +- The latest active alerts on your network +- Top machines with active alerts +- Alert trends +- Alert mapping +- Machines reporting +- The overall status of Windows Defender ATP for the past 30 days + +You can explore and investigate alerts and machines to quickly determine if, where, and when suspicious activities occurred in your network to help you understand the context they appeared in. + +From the **Dashboard** you will see aggregated events to facilitate the identification of significant events or behaviors on a machine. You can also drill down into granular events and low-level indicators. + +## View ATP alerts +You can view the overall number of active ATP alerts from the last 30 days in your network from the **ATP alerts** tile. Alerts are grouped into **New** and **In progress**. + +![Click on each slice or severity to see a list of alerts from the past 30 days](images/atp.png) + +Each group is further sub-categorized into their corresponding alert severity levels. Click the number of alerts inside each alert ring to see a sorted view of that category's queue (**New** or **In progress**). + +See the [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-advanced-threat-protection.md) topic for more information. + +The **Latest ATP alerts** section includes the latest active alerts in your network. Each row includes an alert severity category and a short description of the alert. Click an alert to see its detailed view, or **Alerts queue** at the top of the list to go directly to the Alerts queue. See the [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-advanced-threat-protection.md) and [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-advanced-threat-protection.md) topics for more information. + +## View machines at risk +This tile shows you a list of machines with the highest number of active alerts. The total number of alerts for each machine is shown in a circle next to the machine name, and then further categorized by severity levels at the far end of the tile (hover over each severity bar to its label). + +![The Machines at risk tile shows a list of machines with the highest number of alerts, and a breakdown of the severity of the alerts](images/machines-at-risk.png) + +Click the name of the machine to see details about that machine. See the [Investigate Windows Defender ATP alerts](investigate-alerts-windows-advanced-threat-protection.md#investigate-a-machine) topic for more information. + +You can also click **Machines view** at the top of the tile to go directly to the **Machines view**, sorted by the number of active alerts. See the [Investigate machines in the Windows Defender Advanced Threat Protection Machines view](machines-view-windows-advanced-threat-protection.md) topic for more information. + +## Keep track of the overall status of your network +The **Status** tile informs you if the service is active and running and the specific number of machines (endpoints) reporting to Windows Defender ATP. + +![The Status tile shows an overall indicator of the service and the total number of machines reporting to the service](images/status-tile.png) + +## See total number of reporting machines +The **Machines reporting** tile shows a bar graph that represents the number of machines reporting alerts daily. Hover over individual bars on the graph to see the exact number of machines reporting in each day. + +![The Machines reporting tile shows the number of machines reporting each day for the past 30 days](images/machines-reporting-tile.png) + +## Investigate machines with active threats +The **Active malware** tile will only appear if your endpoints are using Windows Defender. + +Active malware is defined as threats that were actively executing at the time of detection. + +Hover over each bar to see the number of active detections (as **Threats**) and the number of endpoints with at least one active detection (as **Machines**) over the past 30 days. + +![The Machines with active threats tile shows the number of threats and machines for each threat category](images/machines-active-threats-tile.png) + +The chart is sorted into five categories: + +- **Password stealer** - threats that attempt to steal credentials. +- **Ransomware** - threats that prevent user access to a machine or its files and demand payment to restore access. +- **Exploit** - threats that use software vulnerabilities to infect machines. +- **Threat** - all other threats that don't fit into the **Password stealer**, **Ransomware**, or **Exploit** categories. This includes trojans, worms, backdoors, and viruses. +- **Low severity** - threats with a low severity, including adware and potentially unwanted software such as browser modifiers. + +Threats are considered "Active" if there is a very high probability that the malware was executing on your network, as opposed to statically located on-disk. + +Clicking on any one of these categories will navigate to the [Machines view](machines-view-windows-advanced-threat-protection.md), filtered by the appropriate category. This lets you see a detailed breakdown of which machines have active threats, and how many threats were detected per machine. + +> **Note**  The **Active malware** tile will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/en-us/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product. + +### Related topics +- [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-advanced-threat-protection.md) +- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-advanced-threat-protection.md) +- [Submit files to the Windows Defender ATP Deep analysis feature](deep-analysis-windows-advanced-threat-protection.md) +- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-advanced-threat-protection.md) \ No newline at end of file diff --git a/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md new file mode 100644 index 0000000000..3362a6187a --- /dev/null +++ b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md @@ -0,0 +1,70 @@ +--- +title: Windows Defender ATP data storage and privacy +description: Learn about how Windows Defender ATP handles privacy and data that it collects. +keywords: Windows Defender ATP data storage and privacy, storage, privacy +search.product: eADQiWindows 10XVcnh +ms.prod: W10 +ms.mktglfcycl: +ms.sitesec: library +author: DulceMV +--- + +# Windows Defender ATP data storage and privacy + +- Windows 10 Insider Preview + +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + +This section covers some of the most frequently asked questions regarding privacy and data handling for Windows Defender ATP. + +## What data does Windows Defender ATP collect? + +Microsoft will collect and store information from your configured endpoints in a database specific to the service for administration, tracking, and reporting purposes. + +Information collected includes code file data (such as file names, sizes, and hashes), process data (running processes, hashes), registry data, network connection data (host IPs and ports), and machine details (such as GUIDs, names, and the operating system version). + +Microsoft stores this data in a Microsoft Azure security-specific data store, and maintains it in accordance with Microsoft privacy practices and [Microsoft Trust Center policies](https://azure.microsoft.com/en-us/support/trust-center/43). + +Microsoft uses this data to: +- Proactively identify indicators of attack (IOAs) in your organization +- Generate alerts if a possible attack was detected +- Provide your security operations with a view into machines, files, and URLs related to threat signals from your network, enabling you to investigate and explore the presence of security threats on the network. + +We do not mine your data for advertising or for any other purpose other than providing you the service. + +## Do I have flexibility to select where to store my data? + +Yes. Data for this new service is stored in Microsoft Azure datacenters in the United States and European Union based on the geolocation properties you specify when you onboard to the service. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations in which your data will reside. Microsoft will not transfer the data from the specified geolocation except in specific circumstances during the TAP stage (see the question [Is there a difference between how you handle data for the TAP program and for General Availability?](Is-there-a-difference-between-how-Microsoft-handles-data-for-the-TAP-program-and-foR-General-Availability?). If you have concerns about storage of data in a particular country, please contact [winatp@microsoft.com](mailto:winatp@microsoft.com). + +## Is my data isolated from other customer data? +Yes. The new cloud service provides appropriate segregation at a number of levels, such as isolation of files, configurations, and telemetry data. Aside from data access authentication, simply keeping different data appropriately segregated provides well-recognized protection. + +## How do you prevent malicious insider activities and abuse of high privilege roles? + +Microsoft developers and administrators have, by design, been given sufficient privileges to carry out their assigned duties to operate and evolve the service. Microsoft deploys combinations of preventive, detective, and reactive controls including the following mechanisms to help protect against unauthorized developer and/or administrative activity: + +- Tight access control to sensitive data +- Combinations of controls that greatly enhance independent detection of malicious activity +- Multiple levels of monitoring, logging, and reporting + +Additionally, Microsoft conducts background verification checks of certain operations personnel, and limits access to applications, systems, and network infrastructure in proportion to the level of background verification. Operations personnel follow a formal process when they are required to access a customer’s account or related information in the performance of their duties. + +## Is data shared with other customers? +No. Customer data is isolated from other customers and is not shared. However, insights on the data resulting from Microsoft processing (for example, deep file analysis processing), and which don’t contain any customer specific data, might be shared with other customers. Each customer can only access data collected from its own organization and generic data that Microsoft provides. + +## How long will Microsoft store my data? What is Microsoft’s data retention policy? +Your data privacy is one of our key commitments for the cloud. For this service, at contract termination or expiration your data will be erased from Microsoft’s systems to make it unrecoverable after 90 days from contract termination or expiration. + +## Can you help us maintain regulatory compliance? +By providing customers with compliant, independently-verified services, Microsoft makes it easier for customers to achieve compliance for the infrastructure and applications they run, including this new Microsoft cloud service. +Microsoft provides customers with detailed information about our security and compliance programs, including audit reports and compliance packages, to help customers assess our services against their own legal and regulatory requirements. Windows Defender ATP has a roadmap for obtaining national, regional and industry-specific certifications, starting with ISO 27001.The service is designed, implemented and maintained according to the compliance and privacy principles of ISO 27001 as well as Microsoft’s compliance standards. + +## Is there a difference between how Microsoft handles data for the TAP program and for General Availability? +When you onboard your service during TAP, you will be asked to choose to store your data in either a European or US datacenter. Your data will not be copied or moved outside of the datacenter you choose, except in the following specific circumstance: + +1. You choose Europe as your datacenter, and +2. You [submit a file for deep analysis](deep-analysis-windows-advanced-threat-protection.md). + +In this circumstance, the submitted file will be sent to the US deep analysis laboratory. The results of the analysis will be stored in the European datacenter, and the file and data will be deleted from the US deep analysis laboratory and datacenter. + +This is a temporary measure as we work to integrate our deep analysis capabilities into the European datacenter. If you have any concerns or questions about submitting files for deep analysis and you are using a European datacenter, or if you’d like to be updated as to when the European deep analysis lab is online, email [winatp@microsoft.com](mailto:winatp@microsoft.com). diff --git a/windows/keep-secure/deep-analysis-windows-advanced-threat-protection.md b/windows/keep-secure/deep-analysis-windows-advanced-threat-protection.md new file mode 100644 index 0000000000..261556159e --- /dev/null +++ b/windows/keep-secure/deep-analysis-windows-advanced-threat-protection.md @@ -0,0 +1,99 @@ +--- +title: Submit files to the Windows Defender ATP Deep analysis feature +description: Submit a file to the deep analysis feature to see a detailed report on what the file does, associated artefacts, and changes it makes to machines. +keywords: analysis, deep analysis, analyze, submit, submission, file, malware, threats, infection, executable, report, troubleshoot, sample, sample collection, behaviors, .exe, .dll, .scr +search.product: eADQiWindows 10XVcnh +ms.prod: W10 +ms.mktglfcycl: +ms.sitesec: library +--- + +# Submit files to the Windows Defender ATP Deep analysis feature + +- Windows 10 Insider Preview + +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + +Cyber security investigations are typically triggered by an alert. Alerts are related to one or more observed files that are often new or unknown. Clicking a file takes you to the file view where you can see the file's metadata. To enrich the data relating to the file you can submit the file for deep analysis. + +The deep analysis feature executes a file in a secure, fully instrumented cloud environment. Deep analysis results show the file's activities, observed behaviors, and associated artifacts, such as dropped files, registry modifications, and communication with IPs. +Deep analysis currently supports extensive analysis of PE (portable executable) files (including .exe and .dll files). + +Deep analysis of a file takes several minutes. When the file analysis is complete, results are made available in the File view page, under a new **Deep analysis summary** section. The summary includes a list of observed *behaviors*, some of which can indicate malicious activity, and *observables*, including contacted IPs and files created on the disk. + +Results of deep analysis are matched against threat intelligence and any matches will generate appropriate alerts. + +## Submit files for analysis + +Use the deep analysis feature to investigate the details of any file, usually during an investigation of an alert or for any other reason where you suspect malicious behavior. This feature is available in the context of the file view. + +In the file's page, **Submit for deep analysis** is enabled when the file is available in the Windows Defender ATP backend sample collection or if it was observed on a Windows 10 machine that supports submitting to deep analysis. + +> **Note**  Only files from Windows 10 can be automatically collected. + +You can also manually submit a sample through the [Malware Protection Center Portal](https://www.microsoft.com/en-us/security/portal/submission/submit.aspx) if the file was not observed on a Windows 10 machine, and wait for **Submit for deep analysis** button to become available. + +> **Note**  Due to backend processing flows in the Malware Protection Center Portal, there could be up to 10 minutes of latency between file submission and availability of the deep analysis feature in Windows Defender ATP. + +When the sample is collected, Windows Defender ATP runs the file in is a secure environment and creates a detailed report of observed behaviors and associated artifacts, such as files dropped on machines, communication to IPs, and registry modifications. + +**Submit files for deep analysis:** + +1. Select the file you want to submit for deep analysis. You can select or search a file from any of the following views: + - Alerts - click the file links from the **Description** or **Details** in the Alert timeline + - **Machines View** - click the file links from the **Description** or **Details** in the **Machine in organization** section + - Search box - select **File** from the drop-down menu and enter the file name +2. In the **Deep analysis** section of the file view, click **Submit**. + +![You can only submit PE files in the file details seciton](images/submit-file.png) + +>**Note**  Only portable executable (PE) files are supported, including .exe and .dll files + +A progress bar is displayed and provides information on the different stages of the analysis. You can then view the report when the analysis is done. + +> **Note**  Depending on machine availability, sample collection time can vary. There is a 1-hour timeout for sample collection. The collection will fail and the operation will abort if there is no online Windows 10 machine reporting at that time. You can re-submit files for deep analysis to get fresh data on the file. + +## View deep analysis report + +View the deep analysis report that Windows Defender ATP provides to see the details of the deep analysis that was conducted on the file you submitted. This feature is available in the file view context. + +You can view the comprehensive report that provides details on: + +- Observed behaviors +- Associated artifacts + +The details provided can help you investigate if there are indications of a potential attack. + +**View deep analysis reports:** + +1. Select the file you submitted for deep analysis. +2. Click **See the report below**. Information on the analysis is displayed. + +![The deep analysis report shows detailed information across a number of categories](images/analysis-results.png) + +## Troubleshooting deep analysis + +If you encounter a problem when trying to submit a file, try each of the following troubleshooting steps. + +**Troubleshoot deep analysis:** + +1. Ensure the file is a PE. PE files typically have .exe or .dll extensions (executable programs or applications). +2. Ensure the service has access to the file, that it still exists, and has not been corrupted or modified. +3. You can wait a short while and try to submit the file again, in case the queue is full or there was a temporary connection or communication error. +4. Verify the policy setting enables sample collection and try to submit the file again: + 1. Change the following registry entry and values to change the policy on specific endpoints: + ``` +HKLM\SOFTWARE\Policies\Microsoft\Sense\AllowSampleCollection + Value = 0 - block sample collection + Value = 1 - allow sample collection +``` +6. Change the organizational unit through the GPO. See [Configure with Group Policy](additional-configuration-windows-advanced-threat-protection.md#configure-with-group-policy). +7. If these steps do not resolve the issue, contact [winatp@microsoft.com](mailto:winatp@microsoft.com). + +> **Note**  If the value *AllowSampleCollection* is not available, the client will allow sample collection by default. + +### Related topics +- [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-advanced-threat-protection.md) +- [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-advanced-threat-protection.md) +- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-advanced-threat-protection.md) +- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-advanced-threat-protection.md) diff --git a/windows/keep-secure/images/active-threat-icon.png b/windows/keep-secure/images/active-threat-icon.png new file mode 100644 index 0000000000000000000000000000000000000000..6eeaa57dcddaa1c2e6375b59faa2ccf322066f2c GIT binary patch literal 3176 zcmV-u443nXP)Px#1ZP1_K>z@;j|==^1poj532;bRa{vG#)c^n?)d2*Yw4DF|3;jt%K~zXfomUBP zmDLq~;?hjGT2M+G%aWIbSVW{+s9LL3XsOUvY&%mswpvFz>Nx74 zwGOrF*m1DnGPYJ25JhVQk^m+|6Ug@R^7enZ_rLwVbMK#onAG5z`~G*AbIv{cy*FV5 zBBSxM;HHd@N~MDBVoKvr1>x#di=#*x6DEMKR5at8mu;(S>+;DWfq4^^JQMBO)41k$ z%LAi`r8Q~UiHxr?Wr4_^?Z!exf+N5kl?ltQx~fQ0VQ-f_)4poil1PUba_ZvCr>d|N zM7k&99+=W53``^fs{r44M+bI`c%v8&M#5^?^wPFnCL)7g;C_})zKxrAf9MsuH*Brd z5i9`Urqo$_+LY>ccLmBE*jBgCgq_d5xG@wZDW;P^`^n0hIhD!ks$^x=yt&DW`IT3{ zv$IaYv@s`s=pD-yU$#)@?RNb@@Bv=jA$(eYEtGw55Qa9&54{p>*bi#}4>R-PNnS)5 zd%q8L8&f%H=m@LTzmV0ETFYeG7H(@9S82 z*|$TJdG^ii3hsf z%0BeM1_iTe!N8Ue{B~JIvMQOJdreh!Rdvn0>Wa#m8z3CQm3|Jf3u8=(C0r5s@N)RLhnfIwU3=2t#rKF~~xQY0bynaVwvOA-UKDfu^0^tzH!P z!W6kBivwYBE=X_R2Vs!jwV`b487H4NH49fDf3&iu832w8SDXnTw+EAks@U}Y%hTsC zMA0d>Z615^m1%l`W{=|ofDGavJ%l)tii0X*RS&fC+IO!1PUV8UO5ZrW^4RLmEPdE^Oj8>s&Ny7n0ix6;LWJ)254$6+@A^;?&vnUHnDApk5S)7+T$8Zver6122qQ-qg=%OLPsTtr}jAz1*1s2m(gG_G#8cyg|rM5(o%bY4`y;`4+8&JBPisT-rKp|iy}k^ zRqHd;K`=BIs!{CN`>(H_c1A15o{ceC8wi7NVM0NX0C$Q^vh3vK_4A(I_>N~oO2Fau z18}i+cL55EGR#mUqHNvv^~s8PnS9ffDPvj~X*3J~1db#QS0@W+Wh{B`;rfDXt|-4~ zb8||E-FL58@XTwqxS)hAb-ia)%muQ2B38(JqK99Nfvco`HfTSb7Gz#Yjg%Cb=Su*b>D9m z|M{;Qakj85hPZT)1x8|BsX9`kQvZGX#qTY-m1j^`ih@!$lRD??XXiqMp;o%&r5h)o zKdRY!m?e+@AhQ~wkD3b8bk3SKZtI@*LLt{v$oPePrl&h7mU6ydEEaQxtjcxV^Xui0 z|8q0SFVYkK>c>S2npQzabNzzkw`NygS5YyiqB2=kS&^)mlbl;Ir?Luz>gvjx0yxPOVogiBQU(IXm1BTj33k_f8f z()-09*0_VEin+u99HyIP7dPR;p52GBBo+e*C0IBvjuHBdapG{2T!3J?90CYm;fWuZ z2zNImu&~Gp9HR{zK94BQ0Db#7<8VfVJ5(Vo9I_~)E%$~@uyE`x2^6<7K+565A&O%4 zmGnd62Dnq=Er;j{B2;x0d{iiA32r|kW1mRFfJ3(m?4kLus zD);f)KdiXm>|-8Vd(WHizcFg^}x63Y9 z@e!Zny@NWzM;~Jpw<6tbGPRG~|FbcZFMagcjoqcZR&Cqgc%tmW)4%`IU%l6<)8ZcA zzLWTlVwJYmv`uz_<#>$swpbMT+DZ3k{lFj3SbKQ+28U&;(7or0HNT!P;mkG9Klib$ z@#M)hYP6S^KxF$>j4wX{JO0b# zw$``pr`Y@6eEsoBmt4AN=`Z&e6z(ZFfbmLWy^(v)z$Re317bzMuE+-t27r?>IiuGw1(x}tp2iR0gGXz!rN2&(RPUVZYsQ72U2`imWTgO@il z9K}ZN>aavVf#QGLL=Z2i;fB`2Rg;o)^};o6%+O7mInY18I=pWM4@)y>!aaCb`z z7g2^H-X38QciB|!`sw3OsGh%YM@ybpL)Z-G0SY6{jJKAkOnI;=yK!BiK>WzRNClG= zVclFdz4!Mk7hgE>%%@&@6-6ya)xA)a#2bZDKK00h53O9Wx@mtmrmznj;fDe5wBg?R z4_=;Hc1g_-eq7tqgLeaRinR&HhM>8-m&id;Xe-s!UJNYq}v=}0jr32L=*~vhKd9S1ciK8(*t+i{FN^y5{Dm|IC5m-@S_ep z4E;pnhy?!G9l>^loj7bnV#J6j39Kkqj@T+z6gbFuc$j6O84f=je-spX;0W;H#nFyn39JfR8d*$(N(!6F7sinI zhuMm#*yz~%L>O8UX>wghd2JYo1 zQ_!2QQ;^^f4;Y`XXEaCxt4O^eLkq61kWj3|u%de4f;W@q%^qU-o(fs3Z2Vh%`GZvC z#i9H`9vf|t*;QCfQ%_VD#2QsX)y6f8io$qYbUEF7GE-yA$Qs7Zx@|awf%`Ow!P-gi z1vSREz}1)*#RO`IQ3T(mi))15YAaKHoZPaVfqZ?|h;igYs{W!l=#M~$pt<#46iXX7 zLVO0r1aXUzoD$Yr7PGg9elv=>GxLOa9va$}uef O0000Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!~g&e!~vBn4jTXf3rl^x2q}cJv@5BgHpJ96_ARxMl!_W`ND1vK zN(iA~i9mR@1%Hr`u)F=<`@Q?k@tN7VckVrN&)k`F^2y0F&w0+vGtYTu=H9&wU;Fy( z1)&)5xu=@NC|zc19q_rkrv2Qz$M#*gcnQJ>M~}IB9HQyusna}!4Gz^R*f+JQd%rm- z(70HQl$}uSb6yNYPNDyFp)=rc=qp0_&ZnY~xHb*6!7>JYB@@|CL_HocH*>Ee|GZ=mD3PtO~D1~Iog zz_^X;I4<7`5w7Wtz)elz%AWdMNPhRHzo3QzZE(n5Y~_HwLr{|edo_DE3VPkV^@VFN z6S>{aix~mHF+5Z2c1QnRCvhTh;$R>f@8om4G8F4}YP8Ehbh|5Bk15l|w07e5{NYD< zL4shKI-$EeX!vNuVI$n4Co4ISZB;eFoukI|$M3 zobbufeW=vexO~_K#%&qHfX43QC%>aXttLLbXG6129^hTNbeq#K8&&gTfa^)pZF=Rd zlJ@9}ChGa&q!YI}Dcz^_fBdl#wH2K_y8+kD!2ySV?m?LQY@x0h*mzDzE zHeoLaGifA)VuNio-ig7^MGSTed>DG`;NS4k0ySjQ+6NX4KZ4nJ?0(7UJrX$B`t+8H zF;3zu*cUHd#}%I=d~d~?&;R?s=eO;o##j~y<{EqXSIzo0)T1x$HwIpa4`^Ap5@R{ -Hm zFu~>*qm2utbJ1oKze_{Cdu*RtPo6s6G_lv!>|kRSPQ)?!rJebTj)!RC;HX_=YA9n3 zH0EMp*7p0{Y%mB4gqyd%fWXnPV90O&;jLz4e3?tf=xGcsP9O5P8Do6p(cul zOWR-l)T1M1!dz@z4W_U5gGGVCj+BiU>>5#2u+7D`ILy3}42li5 zQTinYJ1;TVH6jMPM#NyZ*t%nse@KR4n)<`PK0Hy-pRq;AVDq1nWE5j>@EGh5Pn_hZ zXBHe9gW@=N=v{6ygE8|$$Y2}yk{Ek~$6zDCAD=umYu;jT?D#kijX|Lpufe11o;EgK zh?nsOi0-PjPf;FPvb@j1#&jqn&3_lO`6oX`y=>Kwjg1#V2HX7cIEk@0_ziZ(VbNeZ z&Zzp^_b*nfM?wa>>0?$g_6A?U=3EyqUB;E1GK(=Qj+-}caXPmyf{?*Bzc@=`>8>?hgUv9nZ=kDhn^DLx(Ld9&+gmPcq6dQ2ej9J^LxrH#;iCF{Q6B!=hj6~y34p} zl5rBh!A9Az>4mos9p1Kc53lFOtT>*1aXY5tzf@;!415tX*yi&FQEOYDy$2iRo%fFX zaP_*=XU;-4X2o&ucZbh^c7Y4P^=#MAe`ySSQQpgVTYODnJ^~11RsmwLYeWoojflan z5dnhDXCM6t@Pp=Wg!MB&0VRKC3xPicbbnb4+6J5B0}jp~7E;Nd3+nfTP@=$qtuo+@ z{8cYx_Xmf`1?PeuX-OEF12)HQ720r8F9geMo=td5XLv$gsG%8U<96FAcq&ojJYocP zM-ADHC1qMt05o=ISFlO%!8RIqM*`!l7y2D+xWwJsHrN1}=bmmuC&5N{%m~~I31`Qc z(9i~Y)NZiRs&I1l)L?VWE=YRB0V@@3o>{nLF5^rx0GWE!@E`UNcxrUjC7lGD9Wf3C zjK-6Qp*R{3F$DzJb7}y4op-K*W-`!L=njmJp|oQ-wF;D4n3mBy@d2$y)F{|UCZ>y< zvZ$Hjkg4Z2K&@`ArU9kcVD|wtZz{MLB2EgYUJ8d>t)FRkK@ypI^ znz0EQ38-UcM+Sx%>>4q6!8VuiLC1I(iFhFu&9O?kakTYc>K_~k2Czx?tx|E`Au85-#MpDa|K zS@RY@zF`xi{NTesGOdF`eG|L2ZM!XIw7mH8!XvL9ctihr{rg9bKEG|}+L7l_L#7g~ zura+Vz{_bCtcO>B49c7Yi!FTT9+0ynP8p1u3Aq1SEP+&WGxW`qiG_S}Ey z+DwUk=HKUJTz=xCcy9P5ic#hzxEC(mxGLLs{Q}B&-aFDdPAhKrYVh`757V`o68rG` zf0uFjsc&L4KRdy6VVF%*UVM4s1$v}%=guA6wDEb8uUkaHQz!)$GeQOU+1Sf;4at1Z zeG8NFYp?&-bSX3SO>9Q1lcFws2&b~g2XbFtc!3_7a{jXmTX&2u`u@sQYoD4ue|Xls z#rz+hSo;yOUCK;+6wghMDNTZV;lfRvT5$J9hMzh6 zDQf)@2*r$04enp`gB6cGi3hQ@BhLvOE`RjNISZE<yM4!0xeqdN-}!UI&f)COa8Rb~WY@9r=1p z2zrlRDqVQtvS$4=SSRPwq3fVlg_S@yFZGjNBk*mGlnD;?PCx-OOe8%IDd?oJqfUj; z)L5sM+JD@IVX2h0HsCG~j+oQpc6WP~jano&1Av-4(v1gqBx`C+EL~&C5V)Z!^NV8a z1`I;k?UhOwUbt|PoDqkZPTP^b0D1wz-Md;C1=w%|8e>?lpBl>A$AE*=m@{%5_XMI9 z<7i%?skPJ~n1yjwh$fvytGhg%5EN?M?rtw?%0u-NTl-0}yTd5E`x0?NI4J{cQ-&D^ z?ohyt1{8I4G27aZ*9!v^8v<%BfZNgCc67?sU?ZxRd}McMWG0P!9tg*TfT3uw**P-6 z2}JGAOLU^RRO$PSyD%(?E7973yF8s|VY*9SHsWXOFjT{fNNI_Q9R}}S=&?|D8)$fU zCAiPf0QVU{8HINw^lBYXKXXFQ!{mJl_c56P*8s9R6iU)Sa-=w7Vu!)I7bao&AT4ET zI!Q@m>3JxnX$9y=10A|e6mT8UWhK=hQYZtQ*ww&z*EMd!AfsBh%jp|(YC1`2QkRFU zar;#Q6W#ey_;iq(w=uE9GI)s{NySYVJcLU|f-(J&pUg&Cx?S}AtiH;2Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!vFvd!vV){sAK>D1L;XbK~zXf?Uu(* zBry<%_k|ESgAjr{5_b?tNN^#?6HmcgaNs}^oXDI(WFcMxA<_`Oncw4fyTkOb>`J@h zKeVcBSNO|iyMKLz5$L&Gj&ELneSIAr9i5$>HTwJe`}6bj%F2q--`?J&7~Mq{{pICF z3drlz)6;zMYILiBQvN)Irimjz5YR|4&Cv1j@!sAZ%*>EGJu@@Y(9p2Fyo_vDm}v@C zTU(3Znu2mt^N@K?rDKCa)e@8r*@>>1Lje#4epS)O$Hx&C78bCR^T6l9!GVPO`g#dw zZgX>UetsT7br6DhO-)VKLNIg0Xl`znY!SqZ;;VD%_+yr8I4Xc_Yb~T%QY@Mc)YQ~? zJq2Pc6@k?X(%RaJKvNVZ1B5J<7>gPk8+FvHtE)NVlarI2zs1ExEfYePY75eniZQ;n zx3{&&nRwD)oHlH{?Td2Nj z8yg!M*8+=>8D3dEHa2#2bQI;|!siCKa6y!h3*U?zmWJZyi}G>do2j8dl#h#;B(vau zHv2Mu;(af^5|8r?bhc3uqNjxgoDO?HEPjjM{r$a>iXa2s);5*GaDcMo;mGx(>&x;$ zmH=XZSIUleb92+u($dq@qrW`9JaAoIT^$`AmzS4{r-YPB!6-mtJhD?wfb7{MJaTUj z3=C*o4Ep-|$bdY&>UotA()cMmoASxY377ZC$Otlny3_{;2YD6G&d#jsXbcx=@$hI1 za&d8iU%Xq=02R8BHhK{X$x3&zP=cQjQ88p%GB2 zEe{K8NH@wgF`mkWz{cQ+O+tQncqmK;eaJHQl>j8v-rl~xzRsYI1i|bwixT{9Z*Or# zyo!nn-fSLhsPy*sl8S1zwY5c^;Y1{jkU_yZk22~>cC?=@2wqN4PbnJBnctRNZf$Li z4A?(a&jJ&&QEj3~i{}b=cX#m6N#I|BeS$Zfv`H=xyAiQSt0z#f>+5UE*x%pJ&t1lS zN9_C<4;W zP(wEiAq*YwwRG?Me%`;I@A$rNj>GMC&5B=KabD+ju6h4hUW)1{-BAh(3Mv`t`%ft- z4&o^&{^~k>2#)Ao6aNl>9kG&DLsL*t|3Loi3*w}vhl7;1GI9?nhxVVLpuDs(I8*)m z&;wQ5J9f6lC>x5@tOjW~blesW-8Vq%+n89{nxHHxXpdZChT}((|fc z+E8FC^8MiOVdSuiu8pOMr4dC1{e%}Bqx^HdosGT$1$poF?7yeoLs?iDSlUvoHUyW$ zu|vpd&rEF14JcCP+t?{6{-%(*f9IKF+MG6*5fTXK1_FA`0ptG z<<1hDbT@ffm^iUT>7vzmeSgEpilN1#K}&+%?M#1- zXV?ehqo7!PeE04vLDaw;>AKbXrJ&hr72o|+A2GwE-`^ttG3I2!|2da}Li}}t&_7>P z7->%Y_oT8+DL+O!LG#e>m6e_GQZ#7)g!W{Gh<2et*LZ*bQ=J_hj-@>Q0~D@p-aKU~ z=X6|K`*i=@$X1P@iT0TP%a_J1Lb3uAdAeQ7|1>>)x)-Cfw33q2)vH(A z3N89m%+JhHrX49y3~%&l5p>+~S>?OV4<0-)S(_*J;$5)v z(YL1C3jaF^i_14|JcZH0s%W;ekq#a_I32S)9dr8Jxnzd{Cn;7|)=bOF+rfVxK;hwS zvoRiGHuB^BW{CSnh@h-vU&%zc*~(aef+-v<+5T0pp&1fA@XzTKemlQH$~!(@;Ny2* znX)JPm6w;#;}*oV9Ef(C?J>IvF__KTY3G#{#2=84QxH@$UH}D2;e2zb@qe z&HYfYTK|0fSXfx5nnV}o7Iy}mCZiroOIwvRB>rOSQn9o(^U4!+W0z4EDZ^^?ZHR3Z zXw2^a=dw~}nCBYNA%?K(KIpbKJ=Gdd{aWK``@d^96g+@;;pF9QC6P+(W|K}bOHTEg zWe354SyI1zxntB6`Q*uy&oi^LL{k*ZR0OkKRJJuQie?;_`*&oP7ldsRzJLGT-U-k7b}`@;v@iG~XY4;`Ax!p%P&EOR58@?E?3h*`=vKSD|Y_0RPl^_%3` zXA=30nv9#H#q7mO>g($}Gc|;KE($+|aipcEqtk2FQl7*=d-^mE zmg!+!vO`2|V`EUKsgkLwDK0-IDvFpzinrtCuC!)i z2TaB1{bd$HL(i*aDuXo&;Cw%u*VfgU=J?2prFJ~g)6;vAqxwukgEPI;ROpKxm~mZQ z-3{89LPZOUOl;+{Nwv$J_SCerhiAPX96QIoV*l>X5-?o7b*rCb@z?(SAkHML6bM0X;{h;9B ztD>T~%GI8*^OMAzYZBXwujAt40)vB-e*OAoI4JvjS|Ofr>iEP&T7G^8$FT7SQ0 z)sG*JyfU?FWNNxsTprwk#QdTEOjyXt*0j} zjV2WpRU;donVFeYCPD~hS^l@%kCo|mB`vMYOZPmDr&_)|eE9I`)2IH2s4q^nW(!8i zX=+BoO7$j^#>QS`s^;AF=Qr!R26lK=L_}RiM&^T`-$D!erg`^QLme8eZ{Y%F4Q7O! zYdf3dc5sF>jEq^YUj2pgItRWV z;>}nedLcm#s-dU(FKSPnId_ip@4tuQdVBIs6eIFq%hto{+Ck)S$pp4Fi6B!7AL&%^fc|sHSkZsEtEyz4vT=1J$xV~WwtPYKYHZIQYy`D824?Xpz!dS z$KrXVrJ8DLYTU$^CON8+!PoiOsspV9KYwmDcWUeCc!mzk(MBt_i+cH3Sg@mlKJP#n zQhM^_OBkQgRbJjFNPL8q4hjuTfg@>gad&kv8;L4<%Le-o9dB70tzpP|%__sTQdgoWEX3%9UAIS+N!1=f9aLq0jQ&eQ#?})^x7cj8j-x z4Q6Ja$QnsiWGKqR$yvYsT2n`7(ER=3_*FYMH@sSQaY6Vu7(SS0Zu(MxzT2pub91tE;zDOsB}|3lRfnsQZv$MFKi*ilnFCy>~AtD$2s4?AlrHc8&KR?IOJE z*Z0rNxr%DQlZ1tPK3;;S`|k{SRF}Me|K2|#Q8px;_l1E$fhz65`SlKCLRfMPMt$GD zed;-SZ+|T>Yu$43xpCvhT$7B6NopmfkVBS2dS@D3_0azmEo~I$ysbUS(8x&Cbt<3X zQ|nEdrmS+=+MTt*Y){WaJ{S0^EitC1X%A&(8_{~2^>WQJ#>Oec;`Hon)M_N`=T#vg z!u&04$5w(#UqL}Zqjrd7U!e|TxJwjvwKvb8)Dq^?I5{YINMT?NHn&9p+-fFBMY|Pj zhTnSR{>H{eE!Y(kX8jAqglEs5b&RZCllkE5D~PRcXb5Ck&UsSE5B`q9V8VsbhTvJv zp~C1SCq{jJeO7^i0`mshhYxQMGBYzf+Y)6-P577?9j}_m&!4}5jTjgiMF_`%k=f05 z$w9>66J31k<;5u~+P6*ZBRN{*M_3%L6uYW}Gihgo$T0JblF7D+`VbXe!t!LZ=-8OZ zT@CW9H3KBU_w{vjbWGJSxj!q%?5JyDb;>cDOEpYNii)GFm=cEtZkdt>5|`UgnAYi& zC%-`az$NH8Iu=0~&9^71Bd%QOMT70*zI5r1|1(w9sWuGweFs1d(g0q=pWn3O3M(5M z#HPM^s=>m*x1T9yx-ugs8p7hil120B>FCnHv){gXlM)yAeGV_~xcD5-2ivLJ9yi!p zC4Kntp-taU%+MjjPi!@mh2z?_hAa|{;^2V;p%#V)1|~BdsrFkJ#9fO#sTq1la z%Cf=No*h+kg20QPCzfe^NlObvoJv(ym4AXZ z-noEI#SBTeXE>FA4i4)0ci!WLtGcC6wR_4+!UC&2!tbm+@g*^&v<;eE6X$QaIje zd7>xN1x*%X02*XbUTp+)+v@}stjh*1qE z`M9Q$(NVCXq`l4TJsW2W02IXS6DHdyZPwgq!1T33s`Q>nOTQzo-K{KjTINR$+%kCa zA~c4lm=Cv{t9nhuZ8N{!CThNG5q};qK==)V4*(jG(=yfal6ve28EWxyahD+tUV)r@ zDdfP~HMQLP-@bjDA!Nt2zu8z{8WphUpC3>B%429ibja4j+E3rWVGMnvv0< zTOrGQVSFa@tcs@fTgi{-b-VU6^6I^zqobQUCGDSY+ zF|A9NF4Z+ObRY@Z)L?RK>s{)b#WKfN8|+;p*E_Os9!E(7gUitbp)R3pcCtpBTPfJO8eE)?&66$_M9r zj~qY#?7@S#BO@boz9eM#R0;14sy|+!&N)CyIs1V#>#@0ch8B!z@K1E*(kyyBJUmP% z=A0k4C@&{xcjYZFdg75q_t)V#S?2Q&t8_78KDi8q<2Oys%t*mKP3W%Ryi-ht4r+ob zdWj~&XT7WR2xVZX06*`UoOBquK7U~TFqk9wj*UpQx>SUOds!D);?$HeGTW%8kGN)w zg@hQ0$-+%tfJgYTV>- zMIgWfjhBlMl<_B)CRxz;^@wZdzIaa*lyi}*sjA|DJia#Il07psGdCgu@Esr;Qss1} ztE8u-NGsf0dZU%mo+Out3%2OP60=FXMW=Lb-}Znt6fkPKh}2_{k}L~|D^AAF{h1bn z9aW6U?9IvPS@>0TEcSCkcG>1bI0NSP)Ydk?@)t}Bpkiuap|Xw}IY?^DigQ}btlhy< zu4jwqip$`yR@o{;Su(zL|gEMto`)^o@ zplj1@W|NgHOTWHG`55ucsi`UNw0oA@y7@a#9{49c3cH+2W|I4;Ju&YHNHtQM7M>5` zN4|ce$i}VkN0Gfsmgclo*+&}FCQB*xGS}i}0tafdGMHsq>J;;|*|tdU3XLQ>J2Oc_ zGa(t)GOKC0fJ?^C&W_qa<(aaw>3Cg`Kc-Aj!+Gy>LViBK%njKMX&uGK+_cZ9s1NVox4t<- z+b~&}lJc{(Ps8+)2jZMU{Z_BHx3^as_?oA7w-y|XYkt0mI5X`@Z`tzhBy$7PJ@^*N z$CLne1pvSek;3S?-XlkkwxubhH;n7o_;$kHAXSnvc!Tq7CbnT6Lf;)+e-#8R0ppgx zmzVrmW%JE@Za^^5ET1iPSx7y0A&R*|)qXWPv ze@xc0MaQxrH^0iw*-W#*Z`bP#&!3BXB9c%{rpo$ZJ=e{Pi}u%XU3#l^xqY4DD|k0V z*U%#d)03xoJfVhy@S6gNC0^nK*c=4twojMtH4Ky^;7?1Vnin93@J^yAghYTLpH|Sh z^Lp9`xU45PESex;Ms_**LO}>+PM^W^W^g$GLpR0TB}a-)n$ap*&B5mhmg?%^mEt}F z&3I?BO?Q?Fhp%kZ6YRj1jmrYT+_gV{KDM_ntgEkw0@xtrW-y)X@Ok_q8jX(X%EFG% zy&j%!PmbD^Zqsx+G1^2kN@(sHaR2zmw*7^@jZJQDUS4A~E0<4}=94GGR*kr=GD->x zk1P&;{%0^)t69+>Sz0)Lo3WpQepQ9{`sazbGbc{O7NaLc8u%WC-FT2^*qCd^%+6kO z&B&x)I+&i}#ZyH^q+WYZ%ifzQ1V}iq)bk5CQx@Tcp<$BN$k&3K{{H?V8PWETu0`cI zDgjvnJk;1)TM(M`p%ZwxHt1fyvBL^!DPGd&MuiqTF%#t5l7BFj~dG~+9*DJ{qJGEb;0AS&N)p7bKpvpERA^wS2kGu)y z(cw;A66q^OC%=0AS|h^&4;Cf1v(j!TisWme;Oj$FZD6;oGDs9gd~x0HqHr87yZqG8 z&&<>$YIqo8y3ww`WY9Y$B_d**Q}HDm6A=Q24d-#A8R_Zme9gDwfBuxlH92Nh5uRyk zYNlJPEes++U&MYcw3rB6-Vi;PRoxX_)1%y+%m>-T!OTq~Cnx79I2G_4DZRbwQKAm= zlTA?wOM!482O%l0_MsfiTyGoY6hCWsnO^Ur)v?IY+GJdl8Y@)=3qzn9eSSrugDwVB z2CPh@#92v{ai35?;d7Q4&GCmfa#I^4gvCn@I}Q+|+5Z zWSD&fb)A~zWhiNYM+q!1clWmYejF0Nq5mLKEyIZTW_cYBj23^*G#Pk?whMQyjlJ`_ zqow6JTcU;83l$ZW^pXHCY4|p@gH&ze1Q=%?k!t#{54iPu@@nGnf|@C%IMUUc?`iqAv4J2 zE9u}s7?)b^kGXHxWZ2~+Ke6~QimCfQd;GY?l)lE7ArHp}6iEtTFSos&wTaT)+#5v9 z7Ky76y*P9SR|C-1dFUmjExA(#>)c2NV^Gm{O5EsP-9pROoC3s(RAtvhZN}bZD5ry2 ziupDN6{=)wXMX>F7h!7>67DR-GdRLys0a|m9ud)}M~Ms8n{C^#_RvQlotBms$Pgpy*p~dYMF`oAKgNf?z3yyj zv62ZkP{rA226Jf`mg&Cn@-mz4%Jj#`zoRc_k@X!H`l#^(>TG`9?+1`d4$Q&i2&IbN zMveQnRAOS{^mKAe;TE%H$H&!!3#H4x0O=a`-S-g^Q^|^%nK1>w;}8(&%$y|wYoRUd zZq}7i%%XG7;u0HM^~J}X&r31$<$D<1m>q<$dloxjRa6Wj&yYF+02$mXU$5#Yg9N5j z%W?yqXf7vvmRr-9I=DCgP>84uLRSvyLFF5PomF}E%(ianm0@Fe=Zr%lumD&2`0})5 zF-51O(ESXkG**N!13EDI{NddE{Ad3BPy?a|Ae@nhy_mwsCB(NE@8Nt6su|{BPEm2# zHIIG!VSi&G>0P~k{V~9Ra6yZ3Z8x$K%Bw5mH6=~28;@XJ$N>P}fb4|=27rEn`^W8) zb@nirLyQ{funr|(CtS`StA201N#?v}4 zey)s-pTFbcV&`gM^`}oK7)0$GzF-UUp7MCY)1-Bfyjv=3 z??oH4)cP=PRa4@U9IoXnhbMCUi|m2R5M6l_NLPNZw=1Pk&T-JDo=dxYv_pDIgkGao z8Spv`=3=#BZ;rlKyM<3PQBt_8@IySSMcwjB|yGcMUr9MGtlrtb5>zXk&`%dl)kSA7Y=Qx% z00Uk%3d^LVtQ_3Vl3^`wA@MHX_7O086HKb3elKioZN2fz?d|Ol7-Az(Wj)-UEiI3I z7(@%Jx`_t;94#Gy2Tq?lrN>6rVt8;1!ad?xQ2s;miex)|4_L7uUs!g=dECKjWo;F! z(bhTPyB;lV=##*bU(YS#k%5Qbx$_d(;KJD z>_m91TsS`hz$aWZ%(9aoc%PN=KYLB}xlsAEz{0$j@;}TQ8Nm4r1Q$!HN5Wve%Ujt( zz>HjBWv!au(uAej5EcX49g0VJmy~1x_P{fJsqC)yp+^cAtg{UEtQ4$YkN!XySTG3~ zA>dgG%$R}X1wIC+8U(I#)}^+nwf0tpDXSFc_@Q&XE( z_9Ja>I)g2wIV=oVcCHEPF;8=)e*OCRss5{!;(f>K>*^YWC{^6$?4*F|R@-v`9|6-9 zpnMl0?pC7JbD$C-R3XeKCM2W)uZ{3l9!{`sy*P*LN}ei7e@^Hw!L0K%lvP!c1PLTZ zgqR8y0*w*w)eSlnR{z+l_s1OtPGxL>v3 ziTV(p5TJ9EGgNi8aWFy%L^jgDw9}y0)QeW|u8K=byNZ;n0F)mCwyiX4T;EsY$Ovp+ z0c0(&+4+~0jE@1qISl~HMk;q;+(QYz$x!$6yKUMolRrm9r0;C4)ejC14j;RR&Q1p8 z2kESjmF&Z02^^_@wU)N_{A$Iy=+Xsf^~Rd17uzI8JB}O)nKu;>*(%~&G;ooDMvJ_> zFGRf;1?mO`>H<*qG(xzC6lzGc)(_*oP)m5ZpAzv9`+EC@0n%f`MZFO#B_Iaw(Ib>1 z6o`EWiVy%BU-CsTx|r#^79@fv068ZK$+{IO0h^qf5Uh`&Y+yq2?Pis;LkxM(zkXT< zG)As^rZbqM0PrJdCn)0Pi$r~UGL^wz-8O+H8p`~{Dnlc-@(I9=-S)aQpOe{n zXg3v__l&HFP5{A228MbHIBUa&#XO^C$Yo8_xd4GnwDexo2Xl!y{Ys!_63-YJ(Su5> zsACmM(1uw@=(vPm*L@ZC#$Kq<_hys#5+vf;xt=`kOqWp~p&9qRHTQ_jVWK}I+MV@L zzmlbDdM))mIAIgqZ*O0M9^n?dISZlazC#Tz-YF)!+4cN9Z>D+YWf zZ?eA=-DL|A-fr{a3nL>97>ov+Y*?n7dj$5+;nX-B|F<;t5jIS z@JDE5d?1JdDj0>yMGg)3>BUxVz=>?w5 zNX&h=w9;YTq&>+=OfV@p*<}Gw*aQp87XdwkDlCqs`kEdV>B3%!85|6#;mR!=Q5Pg$ zH&fI{^(T(H;0mG!^K`If{+TM2IIQ>(D?q-Z$Bv3lA{vPKuFC)|DWVkq(O~@A z1n-C5O_wJX{R-4!5qOJp+?pv!+=s%fmOaMyyar`i6>+xu%!LaV5QZC}61%%qfyS9` z2;)PVp#VIJ8=?l5GEMwODMTIuNRM`&;ULcwZFYsAcLK%Ua*?JjI3qM&24>6>v$Evf zw?~-}Vny1Yd)XL8p?Q{;HXd4$4+W6HRXhOXr~=yv(I^f&p5fy(5T8~c_Fn<%fNmsr z#Tn@QbwEp_q3v%;8&M7p89=RFKi<=d%E{2i@})q1rL(t5P_9qYoTCxVVyi!P>{#O) z?EN-+V~6S?40^JOY{P;)$!c0wLBRp%$v^br560_jq!+PG35nY$QZDAQYP>k~&3?4e zsS*Mz!yz8FX{!AF`Uhr_^5p8(hky=-&ix}PS^o$vD=28L0=W>PgDF&y;X_ZSK?7rbQ3V_6`&M`L-dg61IT|0&XEj#qU`y-yk>E9r~(X<68aMeYy*Kp zU|`@F$?DI!9`-qy9cNN^PJHDW4m~NKsZ%~MeIukUVjV;nQlj#M=<4|Y=wqS=d-9CP zF?$;^{&bv7wr`px_B82*EIZ(66nApce>64vz_WD%-}OvKC;P{bANE87XkG$?f)YVB zlGaVkdz{V*4?ai7g;5NyO}I7MN^-3a1k;$u}cpDHB+ysVdm<>m%L+ z)PDp#vGp6<%gsvAkcS2?ClqzCIvWoP*7kM>_Y^HHvji=AJIsXxlK%Ug-Ub*VkWGm| zGEYal%p+Qev}iGxlFn)PjZ%}_WB!GD6KWY^ZK?l(2;P-a7oS{awgNSX0aD_*Y znp#Idk%JVOa6iU{kpC!&VznTifHorS-YVIfy64!R^`)R-@c7Ru6-J-_BbZq~EH2*zK_0Llm zFZ@?1^naySbb~Qe(vE-b8p{XQRxk@Mh$qj`+Od@WF|?LcSgxVZKcw8VKh6FXnDg8d zd+*OT6puojL@6jjlIrvY=-d|auC7m=k%_AjYI$J0FhK0PgpBBRgs{VWB=+8IQP`IX zeU`G9S?_7yMoEF53xEfn0U4&14EW@-{b6JFK%sqBPd@%wdn4*DmrDC*Mve@y5a)b; z{Nq?6$6&{L54`_JcVv4A_Bj6n^OBp&-1WDI)>iCq{<&=G)%l;NZbziuQjUL#6&og9 z|8uzILF<1-Q~wJS`bRL=Vhuz$fT%wc8Okj!y#@WHI|ycfd+eMo6oNBQ0(K?H1c3f+ zmbBP%7jFXb4{@JOJ~9QInv;tQ)@SbVzcag?3_v&L${$|MR@#vsA<03ma!&(msidu~ zO)2%R>Epi+=^<~>S7<>eYHyx*1XT%u3VA+E;>+vHm5IOIwrI?CrB!NX0FSF=kpW^f z3DQj#((3a!Y>v)^=ezK#Bcq(ZdgaPvz=*Q51E7ZK#iDdXrQXOML44CnW@fOwyeUf5 zNJyqlQ9&#bQbj801_r23z=gNHimirUfswG^{nx)MSV?u9*(>&kr|$pu^B4d)4Nut{ zFF+PiJ7oYGw#F=n%@q^BV8j-SZo+Voo~P`r`n9t}Xs?qlp5$gl-2ZmS4cn>5V%v+A z_N-4LJGaH5wXE$t&6-?G@)O^b7Im06UsHv9cx0K5{rn8ftlu+5#r6?rNW;A)cIj+# z;T?BA4?n$)3{2DC_oA?#(7Qy=*Gd>z5;_2+NJd5v^cSPaAPp4B=!13?e)0P;>h}xC z?fq>R@N0$No*>I(We8LubZ7{W-6P~&Aw8K5lsZ9&1^O-K$d=6AKmn0XG4y_SXDc1# zR+$#St`vZIDA&iFH>Vv$6a+oEh&PBQw3H!)D$vzPXAcnu&g0j#5gw#R4zMF430 zZA72{F`|+{DJHjPsM00R`dRw-3&QA$DaZkT0z-Zth(b)3MykT0a6&po$Ui~3r(R$h zRNMqwLji|*O~4CHE-&NSf16~pv+bK!xZKaShNt>V}E`f2Si-Gsog?+WK2vx(MV5d=`&7JI0IsC*%*Eff9{<*hf%G4(!r{`%N1goHX?a>gI9MiJ{lOhxF&d z|3&)XHcR)^v%C@Wk<@x;WfrFvToW9X5=eFv|-~HE=oHCL!?UBt!J|3^V=cgIy z`W1tzvN=%1dOF*CUq9^GtL`l=P5LK1xG=jy%AxbwX|y5@Mt_-eh{jKO{1bpFjGG>i zSLEf-XR}u zqcJl=-)3q(zkCx@T5N@;N9&sS?9)@C!n*m&*W{n{5Q08LuPj8*oxObyon>Bty+`pp z9=1sY3Fws-gLbeN%IQ)}Mt`v}8Q$WmCBMP4WD+%Fr_p?8to2iF zoNcgjiRoFm#X0-ghgxyw-dYhcn2#5G{4@EdWL5u-1mN1}wF3+)%`9@uy~iJx{$3fd z^B~7(11uB4mp;%5KF&K^YQ|QYH|V4+Y9A8DDj%L_kABH0{h>8*i8ow$j{&=;Wxev| z(7@`Ojho~zF8Q{*@!|gGWf!a|C`4{U#sPd`zP_>HBzge3`_!{r51pH1f-+_T?Cg)s zGvMlx3m$He#Ohp8vfi}|9p?r+TVG)dtX5CsN(Q5)bvlc9VDxpW*DK@igUH;93cLGz zBSb{~>LQMpTvDxa7d02+aqB#*bW!XJ)9#j3qpY0rhEaV4m*`Wc49PQ63dUoL^kO}D zMHkt+Gfs-38$~7@fk`>t+-B-oFS;dGu^RIkuJ0_i3aWesytwGK^UUH+ghM_aV1MO{W#{JmFy+0K8bp{^ZjSS!3zYF?Q0!J6U{8G}Jh4%no~9_TGJitlj&vlM<%f z>0H{G4V^Ke^$ML)1!iX2rn$xDD4Alx-DwB=`gl*OKo)dV`=HKam|Elbcnp_HMS)6K zy*|4{cA&}V+^If?Dr&xvX7$Car%66}qAL3c+KJlx2tVNw4-_^XV7u=-&1x5VyVR|R z779E4GlwDOTZ}(#X5I`=P1pF(O@JZC!85Mce;k|V?i?|4pZ!XT6Q&7$Kf0=?vDSCR zNslFHe-{4X87be0`T)aHJuK<_O2Nb)VQh?Js5gBsSmmOaF1C>w>~CN}1bJpE4KaQZ zL+Bw%?A7no)$XLve_)v4FI!R4c;+xs>baxuj@#+(x}vi^hbq7(^k=zxTSWddHV0DeC%6a6$l+#&JMw}znkG%#4_M=?xf=xP=%o;}R?!E#d?&;tD4GA{# z^Ew4!RQC8hi=b`7Nw2*=#(TuDW&7Dl_u@fwiBfkau$1AJ316bYj5RsPei_-}rGuI- zLEpF5OzfGEmHVDeEkFS}CxqQ|)UL(_VYKOv!jWCGkYY zey_A!U|^qx-iE!`i`QPwIJgj=c-x${(XlGhNG$gW47`txwJz5YK*Ez&utW60%52+-mz z9kes_u}tOFCFZ-z!17_!$HmOP;gIp6ojSh0w71|VmI*)*umjkd=YwY*wvMcc{7dc=)#~B;-QSPb7PZ1*m(o2-oIHyXCfIx zn-OiPSwi+ZdJHe$K51CeVJ52o?RerN`sBU!b+p(z3guj)L80}tIJfiPI+7yf1O%`1 zr$m$U zq(D@8Kt-Pd5tRQ=vP&76I$}_Ut-7|fk0L8J`JV;sZ)KA~RetYLSZa2hC?lw*K=Gq5XfWX0r~%?x*kw*0k$X zYUCCLvXWBrPl4(oyHD)DFVc+WzTDYz6#Y|i!5DiF{EsjH=UX=a0U;FYAL~mQ;DwQy zwDhcB0BnALre6F%13v!0D2$650(_F>=;Hf{1|qve6Y@0i-ctN!?yK)Q>Fu>TR{u;8 zU>_qJK1QKf;i-PE2>&7qGmF<9oskDW6l*dMEUR<-u6=ssqpZER&PcJCddjPJ7jP3kT~aW0un z@|$A&<#UPI?e4DI8xPh#Qi>d79*)A{p4D>52Et!vZIdYq3ycHQ|6nhzKq)c&p!2l# zjuVOc3}j-6)>^hB8#+4c0UEP|w-U;Cow}F=SZ>`{kf$fiY__xcEMags9+JbBUq{4D!q%@7Cg&XZD&oa-*)lp zrbP3mK5pfc6hSv)QBYfYazUNR4HkFrIZrP}-@vh0xBp@@ zhk1pmz;a7@0 z_ht?)ueUvApWR8^lXSCoY*72&cY6ftH43XcMm!g6QiJuN4g|}y2*`|aRZdV4=QPdp zP+v}e>4xm)#Hibr-xO?Zgxn1USe_kZnepMr%0Ks-Nb?E z=x{-kk6H5rjq{P^yUBj!-8Of{F*#lC0_&}xhj*4UB*Oi`6coRcJ{zLY6%1UgrBp0s ze*pUs7r-=p?G+2X?%ceuRdhWn4hx3C961H3y_3s(gE8qSyK+gc`PZT$1u`_#?MBVG zd~IWC9<6qK1ogb;L@Vawk9AnN#(2^`jVzY`abGI9FE%qeTS&#Si#_IyNxud2N=N09 zb7$V98;HQt$l63#Sfmnip9E~_Wej|kO&6ML)8G-yf+wZsZU(j&t*Jbded^7s0^7k+ zzUWcEWofD7&%atY%w2GYgEs%IQg*W~$FRlqE)DYLqY$0RKMq|{wRmOPZM`o*L}?4p zGX0FSW^W+TtN3W_IjLW9;<5S*i;4CR?=Q~TMl3XUayqZaddoZ0?~>n2gxP(IVlDLf z#i7W)T|F(1m~@nw3W{yNLX6nLV_JNTfJ)e2c82(Pi!4zY_8(aR;w^m;U^AwUv)md= z^NOyu!qu#T8PBxiq(mS50~or0hXGr`LxJWf@F@;(f@qf=H!lOp_W=+KF6!0t+=@-5 z#ps8uxXmWkkS7a7)jw`+p~*Atv+B!By$#7hk-0xC8RAtO6v20GAsBgmWBcuK;y3Ps z7YR+OeW00H{e05U6`ZoQ@!n=StY1Pk;{WJ~bL<{2v7iff&lGu*y$vPz93WKwZH zPu5vflrdHyI{3<$eB_-~_=wc8DzDwJl5whIs{shyy6b#?0-@?GNp=SPXY=glFZX;Dw-(bf_(DU*Y zC%$CSY7Lr^qsQYDtH1GTW%?YqRf?t_`49uNh{@_)&(&+!R_w3bu18XhYZPg)q-l3; z^y!B)2x6O=-m#f*9-p_I<1pVoM&QqsqK>s_4CTFd&x=|K+8Vfw!LWY!y&Xilh7baz z$G_KuLWIiCf1t47i=Vqg_`Xy7Y_Fy(XFdhxxSqZ~p5Y-5HJVSFUP*CvnW6a9dpo6O_2+?i;3R+Kq_N(c9f3Y*rN1z9s zdqNKj552wiP+tAh7cQjo>Q`Uk;%dw?e`sx;bD5brf-BKKIJnDvWT$|jtq9W3K5I1~ z!raz~{&aq5cn6}l$U44{B>hxQ&Igt(=+mcI&>KFGl$=RTj<#`bf@6*0#BBU(xRW*z zOGcI&@Mfk`x^kGGQA6l(i)6bSJm2ZGC~$Ql>x(t?c2A`&|$UR-FAXbbNeG38YXegJ9qAE&gC^n z76!z`44OyH0-Xh~z~RoQz$g(8OLU>MJyOVKOnQ8B64&Y5+6By+-BimZMA;8F+=MrE zPMv2#w(dK!mx2S6SiRq7=}>Aru+XN#0nGav0#ny1<;lik@S$ zK}I?Qgr{W;edK~!5=QSf!%4?SJoFYOD) zpweJT!%uzolSlqY`?nQ#{#fshDylr%!j9;$>#R(`YqsutvOzt% zZ7+%VTq(He>=!S_Hc;D!XW}h5fjGU?3^Krv(WJ^tBBGTA&Tu@m04n zAM|&)4LO%E9I)roAUt0wDnow2AbfKxHW-5eCG67&Zv#jPx zxOA3?!>Z_;%3{hzV~3}uE=~;Q_dClxf>8m`O#>Xx6CGI4FdZ)oG z8Du&f92^X}gT5ncxc!^k5uVh<FY0Mmq4hu_#_bwp$R9-yo1`<{EQb%iVgGcZ)0w#qIE=O1@9Y z&85;#?h(?D%=-#%?C6U)?Yb9?&mN-6gd=)6oeevKn} z1ZhQVYGy+T;^Dizc880qd=I~}z1+s&AZ;0lH#38W!1Cl6HiYU5r4$b%hDMJn{Q{B% z8J~hMKFAQwZ=r$I2?up8BjDw}2+NYxs^%i^b3Dr6e#IC_J7>AnUknr*yUq`kxw&{d z*p`?MGl-G9J!#c#jg}L)7&oTgD4!M#Ry^M|xtDUYpd1|3xSnvXAwdZ&4Zk(67Ud}3 z-!JLE>$+g)Jeh5TTx#f2h&Qru87mW;7Qq*+eSGMHUw<`fX?b)uziZ)nsm@l za*~5Yc=ht-yYQ0{$;z4P23bb^@3-Jb8g4R-*3uR>XIc}t_vVOhwi=yLLYpY{DcXvc zFW#~|y-~_?fVVbpJ5Dp;fyv{SO2SX$JmtMk{%Fo+Ru2q&aV!7boeLtNqC%e6uV`V^ z)502lTvy5{&}_-ie@uBHozr9JMt`igo)PiIr{$+VPt;O7osy0XqZBE2FLE)8iAS%D zgmed&#}t$Xvob{G*)@ry%JFLprI<0k{<38^HOe1mIZ>jk(bc|Kg)>y1z2}UL3YpWVPoH0w3WDdmKS67TF9}hO-=HuSR}4{_QWYHNZjX4EMAh2oNXXK9&~BbmIo+`PnAu47xQXSb2VURVa930exM(nKDw4P+r9s)~2e=9(nw2-7c!e?4zzndZMRyMMs2 z_@ivC^>GRZ6`l8)O-?t-xV@_;o2^e><_QEs$WBGwz<~C;t9Va$Yg=2~1t*ORUqFA2 zZl9Vb@4356mlD<5oNVl_!z| zt1^kJG%>`WrxYnF`k1zY;+@HL%8nvK5iOu}Q=k~SqVsj~4oiBy~71LJA=*NG3lYH&fkGt~?=N#86(Kq+j z>c1}cDOcKTyY8`j3eVF-Z4a(*>?%}eWRwf9aCG%QV^xeeT`#x09_=@_;Jks)D_S#R zGS&88nDKieT5eHQeJ(eAuz2ZhMiO`7YP5&@xOr*el8CCI)+=N=Y459Gqe`xkRSi!s z3T}xR&K6xf?o8X7pKI7i*Kglvaro`sr1oc^!i#e0HO%{_moo(D@Ea&?Kh=+a1uf== z6UZ>lcNCJ_4JMa&0r_*d_@29339o^)5{X*27nup zIo6_=6NtaI<8YtuZZ?7Qb=2h{aph=ypK18Si?#BYD&@(y+CveRVa%_Iri(XRCXQtk zr#?KylV?WsLgP?&48AYzNHEjhn0Id7=C|qQ<+>g)MyAN!(lMuXm8LRd z;m>4Ye7(hi3l}fmXF0|D2z7Zv=Ur#`V7h~q)rktLdmoCj>C->&uVAuKY%aOa=RD-@ zd=`3&1Eo9P7ATGj`MM@!1R)eex)MuA()@$lyROq9rhZ6B!$skF)%UQkT03Wi8zDB_ zgIJX7uuKTis3#8Q9?V%to!x+t)%8d}%CA>?~-P>*WQNR1Ld81iQ^Q_;K-Jm>yn#<3NCb3^3NU04r zykp#n`z$F|cDmOW&AoMMetPrq@<8*N`zv>%`yts$Ox2i1qOLP-c;J8wnTfsRFtbfN zLj?T&>=h-WBL#HanUKzZWitv#5-f!upb3w)^J5Ey;+cHS}E+3;YTs0dU`d&c_CKM<@oV23A=TL-7$s5<(R$F=colx*9k9(EmhRPejU@H9n?OR>V=L}pKg?cUj2ES@-{ zatYGS!0wR4dY605ThulDUkkg#o!sNX2&i0kwZK`o+VqN@3>hamzD3#!N4qNOQ8E z#R8bD^0zOYnAZ{3m>5-l9UGTyFAPEKYP*7}k(U3tH~A18!piRMn1N}%Rnfk@f9ch3 z!Da*-^Nus4NvsN$tDj1R%W%+WyGoB~n>XfG@EVylq&}a0^Yqp4#7>ow<}@Q+l7gR) zS_M4?w-ZWX*emp;+`9{kdC5X+$*KBKwyxKgZ_8Fv3TLV2`~?J$-*_K6|&yyhY1wY!4Z9JMSL0~>gi7|c4?r_$XQ%| zcbdI?dz>c+l#%Vz_lG1-9DZ(Wd>HXrQ24)uYW#Q7K;F@Lk=Nt@7by+iYp}JqkNfgv zpI`)4?Tb^?Ui(2Hdg~A+<*=>Du+>egksn7&H)qlvArgFrDm*v%4*w0M3Nm5;{{594 z@^!NRhqSkVt9tvsMX@kwR9a9#N~BvtY3WizN?KaFL69yvbPLEP6e*Do4Nu<>Yo zf8lWYH6O*Mi(rz2@7mg0$xUf>bz(Ad@;OuC^ukForc?#`i*GQfqk=rxGRA$cU>V^< zFNlTPVaQdB{0r^HyQ^c*j~YY>zIS2)t}foyv555O+AjsAEZ;gdQk(5p z0xtB}Z6s=M8*HCuDtj>hzSr@m-yFq*imynN_8sI5x^o!LkR zxGXEi*8i}#hL04_Qoelg0>%gmOFK7OM@PqSpZw&3=}d8x|M(%srvAZQ^tzs-xfSSk zU&RNOu^Z?dA^OiuHS`=7ve_H(sj7QDOD^fKh;=%C&c)FHp- zLX)2sy~>M5LBYBOnogVJ_<>iQZY+Vi9R{0r_m-@F5($9Jb zK&A|5I5@k=()1}K3qPvl`wtjY2IIHm!!U_~-mAN*-Oyu^KOU&^0~cKPyBnbhdAMoYv$|!`?=(XNgmbrBNU{Q-#C?Q?A;LRT{^icd_Z1n`=hk5%$THCN(KRp6 z&r4qlsgC4Sk%OkU6FS|QJNdl5N~CVR(o(t97F`>nkX=GZAa63`DmYe4zUktFL++!D z?Huc}N>7~`MH0Oug{x6pPQXC zTkk6?UBy%1epiKLhyoI{KelTW@53i!<2m8Q{W?@(>Ah6j_mjLhhnIkW;8_jDK0%pWi!*BHJtPIyolg zA+v#iC(pi!{weleDkcT)5w}uOg7YjNpZ0d70iWxx=^BF@l>&ekiif z8{el+LLmCK9GGHbgM#QH^Bm3+WZ*&SzL#*RC~GDzoUKjJRo(jg4dD>G4)4n5Ygap8 zqU;ur_x=5;=x;34`@4Ug?(b6$Q6_k@0ZsFUU`&IqI(LNK0oN^ZSn9jZa9h5j%p%af zJ5>a)=9oq48Fw#y9{P)n$ME~?84Wdc(w|J!iw_Sy>VjD={∋@AB_MuDgK&#&rz* z8~$_^wErHHIF~XL-69S~l=S5nUoF3Zb>lLE?3#_E3#$Y05hI5V*cl z1#8exi2;8dc`hyW>9pE0`ZEofm=T;}GXaY@#~trD_W_{0vbX z{)8TSt__=C6$D^V5${@k!Hm+Q5^e{Dum=gK zlVdKdqu&{Rx{T3JISu!oD*zz6U*3O>0A;kf3hj$cEfOKgN>K{R4uu6!XhEzKO?P|BpL4d(aues zYng)PhE38R7uUypS`5#Q{ z!9Q=L?Ei6bm+rp|(^|IQ)BEp7Zu|WX3x8jZd=elt)O8Xz4O!7ZW%x~|}k@fGdXV{pve?<=T zXXP6FkHj{t=)9?O`R~Jo8Rv_}yZ-(9@8_5>{`bH)Ba@+v#_$oReuEzQ zFuq%p=Yg)`vzxt^qCk()FlDPfzyWtJ{PMpSslNw|?*ag!B^b6Of|N3W+v52+7udgk zgX|-!V-75Xe2_q7O%s2)JY`Gb=jUf;VUfI;iT^AG2##s65V$X24YoT!pp!C1mWwAT zO$67bli9;w^Q?Fyuq}GA5l#YrS|u5ZQ78!@7Kw4L?DSj^Ntm*_Hi$r{PduqR@M{ZjgE*`V^6agIAI} z>Ga$MDQE5YF&?v#yhW}IdQ8l0HJF!~w|`F0X*PJ`>|8!2&~qN3#$;S!d5U5`zJr?3 zG`oY9D2Evy9-eeCus3;d9Ho$R0Rw{7!-o$Ma}`6@HCvK!7xEz*{IJ^GmJ2>^Abk}HM!+S0c=}9LdgS~8>hw&Rs>N(qTqq-thA1>6 zC+BLOnhd5}vlj_&Al&j<(M-Ik zv$l@gX*DTDAg{pFhw8mWn2BWDRy4W|id&ad@?x-;LzbG4qoj>g?(ASbaElw=Yq3OS!ds2gywueM#ide!(8pjHHu z%OI6wFNEFmbaiEgd}n1=jp-TJ+hK#VrFIK-!hZ9XdrjPkO05;Y6WC$-;GJk8HvaJZ;h;b z)$3uJ4LVX=FAs=pz1Z8(3-ifsoa*`ILQc9OiMPia$2oyMcoOXP_rCBp@AN$_EIv+s zB^dq5tdvp6IyN>IjiA?KxFxEt9>02re)$vlbL3R_6GF45wDN5D~a4olsy=ro3W6dFg=;b<|^f`%;fFfLYSg zC@~s^bfKws*0i&;Q<|30bw{bY9!gEH5TJA)^sItL(ES7!EN8c9PuUMQ za;i)^!;u0v(Acwk&aOzSAi$V{f+D7}=*^UV-EdXPwalFILuex+hqlAF5fQlHZ+9Jj zZG`^C&CN!uvvLM|X zTHA8znV7H{@ew^rN=hp7K0ga)!IU@bbtjspUtyNWIsO=L=dz#LuTj22@^eif0AQ-c zj3U%A3AcEPAm`?CpRjuk#399}? zz28DF3(5prE)>r{#?}%dNK4n&4~~^zy!g08nuD1&koF2DQ~!+guJ}!%TBZVpK_oJ( zwpQotyPeir>9D0PUUl$$Os+7JE8*h$rW}Od9%KdJ5%}~W#d7+C>*|C%-C^#w&eVg@q1QF6>{uV_Wrya5cxpTk(Dyi;$rg6f}SeO_nO_Y zF4#3gCBw|n`#);|?ayR#Wg5&d*{&?mt7wqiVHLNnB#ENFM1p&HC6WLPCK|viq4x+I z7nhnaxb;0kGnI^jV&Jm!g`GY8$d+F4#&8(+Pw0FU-*GQhp<_GWu^P;iO3%N~yzX>L zwge9>x{hRNT3c`~qj=OBe!=9?hNm?0e9u^ajlY zcg%^>5|Zxir*<`&QS}DhHR2#0CSh6rT6a%1h4a*_{+9v@)0jP7n$}l|;lps@paP9~ z<13EDnDA;790UrN-lQWZZ>{-~>1JPm1^Qo4yigz&-Ff_c*)=wi~odw#63`9n`H~mQOr0kgb)zIk5*2 z3zlGMT7W?nbdopfdZH+0mpQ_6cUCqwkRFKocb!HYNt79=ZBm_GGEchp1ce;*a&~g! zRX;zkR9iGys9GGR;-+6?u=kG^z$ky>_AC7`micf9EwC_ib8~N(HBOQADru#6n+`Qf z?xqbMFh5^O^r~J)mgdr!D{4QkwtfMNW@s~9`PpzcK8mgvXE2#$@?RL}d|VNo*ikQV zUKVVAxA6GxU2jvCcrimmXrE9V-`=f#G1z;_dmQHRHyp0kP#O;=Shso_n>TEjU@8{fnM^2f-Aj=ty4WXff_(sn)Wxyu9su zxa2?vY}n1+#igaFTH?Wp2VU`257m~#%X)<^dHxWsS7_$B-SkCrba2kDZ9ID!6(&yY zTAN&}%L) zz}Z2Z9WJN9Icb3fjXB1%`pAzhEXwtR+hI~NpJWWnM`7`pv)J?IeDnA&D^-bBx(sQo zF;`?1a6+km`;oGSge7Q3puZWY9!6WTmj$j-``+S*V)*KJyK ziIyVx>Q^fp5jtsRx*H|^zN(5$w-Ct|sZUGzL{;^sO5Uws*5x&%eG3U(%Y#J0;zorU zufN&EICCV*ncJy+pV_MMNg+}A6xaPpDmqDzGgfA9&)mw=GG>mjk{`lIjlO)g$~Im1 z%vLLwx+hBy%&nuuLu+SeUf?EE>eGa;=Jkeub|Xku$dO%-%G33@#4yxY)Z^q_seSG8 zMZ-Vb8Z8&UE=th3g_M8&YHr7#Pkge>Bb}{+;8$;Ed&#Z?8?$CjAe1a{cBsjpR{)W~{VG`VxMebH^pMY|tA6FD-HuX(V{=B%9lNI)QjlK0{p9|V1E zMWyTJqK=iIc5^q=%j7Q)r+UWjgau%{g_lMR?9y|EirXtOUgl|scO1KUviM{lo3mm zv_5DA5eGVkZ_tJ4P1MT-b4rW zAKhnWR-h$JfYGO?zr14+Vt1Xo;=Wh3#^+v%%te111mN@A2({hEY8^T>F0QH0r*d`pq-jvTM0=pSeE7B z2tc8kq6pdo58?D*3a6*1N#8G@x)Hwd*wf(P<1<+Ei3on zZ{Y;8%I3yyOP=VSrXEX1Pp5a@0$bKjdT$lcfMM2%t?CVeA^aUG`Fwwwm*7gY@+4hB zoQpc-eVKAQBYVmFp?&;sdRc2^kcDQwZ8s>My(1gm7Zvs$*pBV41rr=QC~u7KkY6c7 z9s!Ecp|J9yejOxJWXk;CUjR-8c8ft^XJP>6ix@uOpVfLGL;CHdr1uZP+Ok2n9Lz!c z%9Q!TPr@Hca&qW5P_LL(kZJ;_e$0cOw8@?AD_UDQX;OPQCU@@K36jhT$P)Aiu?T-j zY0r@)RTxt5Q8M>eNPqf0mBT327Wg&$d*p9}0ImskfC&N!FlX@#Aai(>9-H4@uhm*0 zmX2m}OS@w7WIiVy8Dlh*m9jQ3O^_apQ)2CWtP5M2*Jg@;a3)@8&oS>HuvMCVDrb)) z@)I4KIWoHSKz<^-T#K1-RaFu-NzKjeJ1mhbTx8_1&DLI+2e-T(Ya}UFGreBr;b>1! zPf*&QmT|JX2Ev5T8_`~DlY0lpYyO#m!za7>H^nL?__6lbnEkJP-90$Sf=Gs0+hmc^QtgUdxiN%>=TB~t~)Xa?zl##^)LO9 zt$q1Lk1qPDI5h#O%QIDRFpo?^9D!v5ZS>O*{jW3^26siF{12#o*vu|Q!3v)}z2)*W zd~&(Ou$Tlg_9=eVRbq2%{bCyk^YW(=l367ulCP#h2;OK#N$GjM%huBEEqWNCj6$VJ z)6z9_GVj8TC;}*j`NdakfcY+Bplc#@ zyrqn6`NEziV+f-k`B@TKN3msk~>Y@3TPy; zmKQn%IP6&Bu|VXEkGA@{?Dx&r8x*#eDcu$`u9JJR*PHY8oUZtp8YymQt;qd=6d*}^ z%*3@?YC5^YWC}tfXX?|$`L5JZutg$o=U@?z8plH31v#`Fr%yjJgLe9ov=blPj?u{#3T3T8?eSOq61L0p& zqg0mTdP`sk;Dq+XPaq#OH1A04v3~)XFly8cAAuygi+s7h4=@N``5;Rn`P9=qx4+OrC`v$f zfVWglQ7r+v(hR3yOcOY|7PkTt7)3TL{onx7*j!mucUad;>cJ>4%5VDkx`o6LbdtVn zIXZ~lL%Al!PMDOwQpw0W)`lodC!v*x{xs0 zw8qstFtY(#ceJVr#0l5Hq9=jZM)!>k5psAqG2UAALpZ^J6?0cZleGMtc6 zY6)Zk%VtlAAy>`>&Itel}zxm|$sr++3 z3KqtO;hr9!@82c4xVT!ADWhhbXvHHRu?r4-3e1KIm5Z#?UFqH3_Do%EaJ_8DKs%&#@ttbMMpSO?VU zAo*dhs)D!J-JhjopP)_p1iSSUPJQ$Va}gMak=$g0W7N}l8SZZ5f*VA(dKDe)t@-asBWyDp<1)u`jM+7~mA4aOPbO2+nTD}Px#>z-Ma#k=GYulqy! z(J-@R=B6GrZZdr#lNvv-yZXV~#;KZ(OT=zQ;PuzIu#<>LV|ZQ;@=fSlN^|a~UamRg zy|uDLM@ho897FOw-3XS6T>l2Ri8Uic>e3eVGU`e9ZVp?^IqhLoyF4dr!^g zW0Ys-!p`ka_NY@5w)Mmn2Z0^RK1QiwzJr+O>6}hsqE3C@M)E_& zuQs+*~heTbD$dy6h(ZRl8<`{+#LsuX)~i-ZMsEbxW*D~NYme%o-Vg)5SjML(nUj+ zV91k_hM?>vcl^Yrh_KlG*yPm1HVjPW( zt{t9v61%0|5pudnPUT6rQJqO46`9(w#F>7v0{;W?H^+^U7Z?~57As9}#Hgsh7z?d- z6vpo;yQd!4I=3!euwr%OekO}*u#p-hc`U9Ps;Ow4MA_6>Dw!mi^KMD2yh-fA10j5D z?Zr;LrTS+d>|Wk=I(e;wrqZIKxGjE8o*Zqh1?ogSvB9X=iJNnMvqXH8k%DjcW!p}I z{orjrVTTdhv-)YIvO4sWyQvd5IV&$sGf+c?WY=cP;aY`4??i8YmZr% zt9vwreA&grv#_zD>c{AJD16b+c%Ie!Zbqibqlg#}$&IGtan#V>wV&hGEq@-BzFwYDoHI2~+sl@%tvDsKof-ANpsG z!C>3dOxG(57W+cAmjZ>~+BZhS)xGTDo!>c8wbg5iKYGfuUSsS^TK_LK39GDOkNYh` zoAp5FwTDTQy9b`uAMj3yuHt$I!CN%-8q#liroZqygQ3B;kpJLDm%7Ks2IZk@=P`_= z3)mvqs-7*&|7r-b4ZK2EMe^Ee~&V^@2_wmPHa#$3}eP6=e%hC zLX5c4YOT<@QlEoqU0KuSsb;+ZM_lv2WbxC8C3%(-DV{O^X57*Ow4ViPHFWv2 zKo}m5Scq(V!HG4Y9p}9YED|lMMgv`(~Hz#=9%9~l>x*V_F|1{GXjyAgfRyx ztd~g7)rygAO$c=+Y6rW@k{qlABhf}s1l#lj~U4U;q z`LQbapzG$e;ux_+DjP~JJ6*xM3s9bI&a9o1mYKE()m~{(P&(XM^!6Jr3B7ZvnPacM zv`2twz&@eZZS(ka`?Sr@8vh@9oCMnd^v|$GQtR<(mE!~7Z+C$cwFRAOgo|dT!t#oA z#-3_BiWmw)BO8Z4*d__k*X=^s{P0I%v}&GOuMbpqY5T|pRrKaQ#nxj2f@g;_SI&Vo zSGTi0L0;|FANy>G=Iv&*QBg-0E!vnhExpif9S&>y4d~=KsCbATGMUs+hGC6c%G3Xc zn9Y___?wtr?o6yw7$E2LeE0bLthr*zk&glnqiEO?(I4iR6^J75NZf$lQvz&ED3>v? zuQJh5YfOxcm{(XeedWeNEw0EqJ0Bz*yeG?3Vt5O<0;FLW6-88`cf->rHh8fG77qfA zI2b3AWe;lDTod0wHM#xE&O=_X`b$Je8DF+?#i&Po-%&^2kvC+mt&u@;;0`g&ftNK-N)< zSXfy#Pfou7Bm&Zb-I2$iR1vz2@<0OY160%7{GQPS1WmvNF&>uN&9(nAKe&7HdKcFt z1Yj$Hu53gbx^o?L6f*)$KEH41^cLTz=MUWP%W;~Fj=^*Qu<<6Xl8x?Q@~#?FcI6Qv z@7y$^yl+{}(^Ci#{5hLX1qBa}ssYPk9bzK@4!Ebk-w@?W9o6d23hMJzg-Fw4Nx92c z!^nVsB1fmyLQo$quB`OeKtEKVHcQTR9>A#@!AVIhuO$w-A_12QI|hIo00cUPA^W9& z_V@;g@Mn_2S{K0x1OjoLA*xt(h0Mo9NPU`p(?FJ%5Up$|9Gp>CRE$JebMf+$|GZb$ zJ3M9E0Lq5793CT}Ztlf*kj9CnqKn7=V8g70NWOUxd$k|ss4)IW7ZI^Z10QV-0L`Pg zG2n4?-&{a_IoQlghq=NhoT~4@UoiswhRwxvnPNFCeOSLlKxu|uv|z`NX6ra`adFMv zsH(@T`yKfS#1(C}%ArRVjUfRRF!bfsO<)59tVX|1!CoYkuN5}{1sgU~($RT15!q}2 z1ijrOXaRH84Q@67`q{2}vD?txFS}*tiMMzCt4lX-=R|x~ItZ7eqakl>HpB50L-3iR zPQ6@DdUzQ^kD%;&D|$~p(z|s01f&W)>v0@}k5f%E2<~$6i*INKrGI+hwRWz~I=8v{ zD5uyO$^L275xbz49_ZT~*8;+gLiklgF6~FMdhrIgkhgZ-LF4RG{;|@Hl<#`AF^zc9 z^mAWOl*`K{-kzIsnk#Wl@LzvE(#1^6#BTKscp7c z=p_^?kh$M^CQ9(>V0Tu0514NBrsx_zCWxt!`qE-{pvX%SLu2wxge6|Xw|glw9u)j^OYe! zcf#EDJI(!{YB8NA&`UwD_kx+IUq2tzSUkxO`RaiT1?+Z6n$EYQ8Nk$GpG3e5$-aZI z#0NH+$=vz7*Q|!9M==NUf1*Zc^L$=k2zxnMM3e%{RyszP44wyV+jNB2(K-Y`>-#Cr zJB&+*jcBAZlwICD#=sLfVZ(S|TB>@6XGZ=S;91d(cb4MzmD)k#)LG+o{ZId)V@daV z|Dt0J14$(EB0j@P5s*r>i__k)xu^i4RB9hWOk$wU8e2vh9t0@>Q*fkYAWZD;?ahT3 zNz+9qp?b&1g&8GZ_qNu$Ok(Sf*y5o7p-L7u8)wh^YKSh(gPa8CynWc^RU$ z8>YckeZEN{_xbp_gU{-22|;JC^#9QUIIjvloVfaqn3;H7WRD+XG8+du`FXB%b0n&J z)>OWmszs;6bP679sJG)0*jMO^dDxHhdv?$gURP6BZ(P|U!_5Qa$;{kblqnVj;F4Tq zSKf*I`kAZ#f|f9<)&K@J~Q;q3R;jz6 z1fzcS_A2jIfGC4YXh}j}X3VtNivTwenr~ncy^q`ig=Abg)gy|CnzTxT7a?;YlJ7x} zG^|A9YiNQa42y7F8|ab9HBQ5G`1cfuBk8;of)41IJKfD`WEk^W!{*rut*orB z6kd_Z-oN-PG8w3OF5{4VKp0a~Q@6{iC}FFJ*}ZqtcpuhR47~T;YI6$;V&{NkWKD3g z%!FwP+!Qpsz66tB44>vu;;j7q8-N36QHGZR(N`02lU+c(J{Qw$H_Zl#F)NNGzhz86^w}7?r-H>r`y1|l_I_qAg$WSUs}pvujpbZ|(pNrHm=1eG zVAYYy9|+=4d9h&NiaR32sqLuL?h{_`d@YUUYZ0HTDJ3e&*<(>{2IK6Eyrs}r6MRu%Z<@0Un9{88i_l9 zJU}ZL?`31!h_gx5Heg};C8gCaFTmBm>7g7rDFB0Gs#3BxY+ySW4VHGW!nnJ`un4udmqj-Lc(X^Ra%!*MY`wC65qiU z`LcLzysys}LVJ$NffvO>t2>*-O%RHdeNg}_P-W>?kLnls|62p+vr}*^Y zZP~mR4Yqic@g1>9KVC?Ck~_`khhdc4$>0NQog+^dy^Y|9g-@4wRDIyyGRjj8JNRmt z%|7fzjwxT)Ys;t2WlI*>va?+F-m5%jCctX~xlua(2(?S=5Bbc(ol)5KcFqpiw@4WN z1A~KYo|zsuI)?kZ^A1ma1^oK!k9m`s>%9T&Dqx@)JN)sw)nBrzy23vwdmgBV2&gV5=fx zh?UOx17tN)GO^p9)nhEk8K8edFul=AHN{IkT$>0LM$k7sP3#{xC`Kz15;#q9K?r{X z1EdLg9yVW|*z{&R#-~vjh#)f1xlb5ebL&-RMtANvjworivZn;7l$~X-q)wAL$AUxE z?ktp{l$6v}K-8xg6f>%;Uqq}jJJj`Fo!M(4Ep>};Gmzs7FUfcUTUg$@|%KfavZIZY=Cv;=^glCpz8Ki&~cM`8B$Q*wVzZ z8=3Xr7_zOeQ#agoD+{(Gy74te^s*r8_*fY-NI%`_G9@!TW$$>e#hNp^4yZ>WF!A5W z5)?7;qzFW}-CFfTP|}Co;jOB!Hl~zQ<|(ZypX0K1sU5EofL4RMNIl5EfMlUds08h% z?_Pr(OFXC5D#1$os=N6Nn!3~80KGOSBTJCBklxe`KRb}mqCClb{rbc1+_M!|m^9Ui z$Q%YnDKRlWMDG(Jh1(yy%_}W=k`Yr~W>gew{68$eycM{Wc2pzP4cc(ubCkU=2|rDj zgye!Th`%*x-d;N+yHfGzRMBd1AylfaEibbiXtRp-zxmckT9zs^pp^pL*KU{>?m(YV z{3-J#Pg6fA0|;UbYxef{(K>jv;M-|+2sG@liJV7a%ohohT^z^E@~>JO12eB!;`=H5 z1_IUgcXww~rM^=;b~>2+%h^sJ5{664M=pR07%~nt&GYRwd;ZhY2gbJoI!!ohe-dO} z+1r_u_KA7~+AEL*Jb|7aA&H#Yg*5j~@U)tqeL8dN-b~*Awno4StSzRYGXU+j-eN`i z7i$*T^jV6_8(=urk!@#TFA>UN2V_O3Nbw56r&`Z#5r&Z5KF~{>U2K4is#5#&hcro$ zkg{PT!al@@O>DHltm1lgFD&=fjp?n5m)+)BDQV{TXnNQ6$&1oZ@vWkJr(ZyE3_4;~ zM$?>L!SIW0#5)%P=PaEA8!v#WG3kbwVl4)18GVYz0c!7)q6GD=8`Hr)UpnTP9+bai zbnGzGq?VA(&@Ray_u)%bK+6gW3-NRd)e$2~eyPBaHEaqmgXGC(6Rlwp8+kVU#3VD` zF=Il%bXW%WR-D~0rT!sU*ZMs>KSg~DOX?DjA+Okc$G%ksYa$3zIPi5@vOFsO!{Ao3 z<_me14u4|Kl5U~(oiML+<QvS#7s&97UX+LJ_zG0a$WNW9l@Qj-#UVBQAWwj=FOKx z2d`@8&)v?d6vux)(He~w68I(W{jY@tt?mj^{4gvfTTqYhzIQ#$=fezkkTt)fD%A}6 zTt9)CS`s8*C26tmb#Ep++9~Js>P6-)5QjE%Oh@54RgV?@f--gpwucLvfBIdUg&6b# z_XM|^ZbI>X#Yub3(&%^{+X1OY>I=7u7n|R|p|2)nS zHWi2_Kyx(}UG>zy;}`(nzTo2(WIP8-g9`bWi{Kg0>kI_m-59dTTa5U-l`o|FI0-9y z$kldZ*k|l2K}IG|#dF{K+CZr6UV!EYR)&G&=Twh5ZeT(QBQI>cHOcjjxoFO=l8ZRc z-`b%?jB!-Q`}G(S$-91moZIX@;VZsfSEtb4gLh2X>bAvIv28}%?F<)br>EYbu1?){ zXGqdgMDL&`G}C0G?w9&_=@>SsdV|^|{hU^AR+54T+>5$8I^kwqOdYhoUXnNz zP!O>eeGoS4h2+4zZ2n4J(PinifJO(jZj|Uw0IHP997_5?d1;uMO78l=T z;WshlsO0VpEZ96p7co24b#=PYR22w>WONCbnZ(4zYiA2TE-NnXwY`JUh{L<=U_Nf` z7!yJAMBSR7B|w`c5H`4+g5C2tgua0`z!o<7Rqn2aqRRdRpK)uKF|vsrtnQxvB=|KL*IooP;V{^GkVsRP69xnz zI2(tTW*2%FF1?f5fZzmk1=>mOpGr^@Kx^A!X8g|n{rD_UaHGM4+Dqx}Y2z51(T+sB z#^D8U{b}^lZ{J7 zJaF}UOjcgrbqH$z^0kWyl^EH}(jaBSb|Q@(h2(ym8$=7xFSK0?5MbvQXqy;MSQfcy zY$uS)v5j8nna~$(p4(k6Ed0S(Z zhe<8&(`#0LyTwQ4Vm+k$0MXiM`jce?Hn3}adt>E*8@SY>uB8LRNl_t?DkN$DLIpYq z0QY5) zjs?h{KLgPE-JVHt>U$ja9BG7i{^qyB?uVf2>wF?>}WyWQzTBYi91s zYuIH?qt8J^Q{81Y^lV48u-+X^U@kH3Wgg7NKZT&Clzrx%byW9ditNaHjjAudXO^SU zsbwCz9)o%b^W=OLPvz>+R43a)dk6Q1|JP4}z%g!@0b7=|v{7SR>2X^7RRMU^dl(HH zwU@@r%3Hhpu6lh;+~{iAXz9gMoNN}qA!2RyJ<@B$Z>&&fQ3t`Qx4Lu{O^;z?pe{{68hDxsJkTFJ%162@W#*@;~RSfe}R0z=yqxtk}`mR+^E+rJvuuSw|CK zL;ZLS#|{0P?i)Uy!;agW^#`~|LIl|Amu8D|s2+nbLVl7Q1D67Y4@dtPwr=OXV1B&4 zVyua#+;_hnYyrc10sHEYLD&0ELcT&aR6QOF;%ZE#Y3*D>L4uhuD_L6{3SLZSz*b?` zFj;oz3wI}$K{OREN&2PoTE*vJI+68sXlo?^^SHNzAJq-P;Bw|`81y`k#_O@VOQ!%7yq!p|R_22N=^ zP6f|;ZQSA8+sYX_)gnXx2+!wukAuN_Hh&(w<7U*agQl0~cc>($4_{l@Yp(bPA*lXC zTn{*4HrSFS7T3HD zS>madf=;-S@4l@xdvl#AJ>a$qlDXV)vzoH^1A%6pLq*w>^yfwg7Oyb!b)J zU%OMRKBeQ1g=VPNk$n}F^Ozs->hLfs;0%F+6zsSAQMqkLak}|-Ug-2BI4JB^yQg%l zRZaP$6{5drL3!@mH+PBP4k^uld+u(DzFu2%QuGYM}NTK z*;>1(c&YD}=(<^ z+n<*FLxTndwQ5UX)?T=~HShJywZksacXqM(=3({KGc`_m7-|@em0$KQY(*+~UBnpL z*?&`WGDcqKNxom>+2Al-ttV>;;)==nB=Sv#^Or|nQmfC-=X~>HCw%2bGgL z?x81PcqO#|5WLh(o!Fyyl7Cwe1pTNfU!amnTK`cVM^Y!UqAvBlgzuk2<7#_m>2~wq zmr*Bq{T~yqzuT4xdNmUEKGOV`e&eLe|E=BlH#NN|((s>d>Ha63+xM@Cm_lz9lW4Ku zoqyP7dA$GD&I}ZDE(fg%N&SYP_v?-)|D43lkpBZ}$^+`UQt+Ts6ma*z8kDPfu^=*0X6bj}<8!gO2p!%^b(Mmbxv!*I)F?E~iE7)BoF93Xmq{aRBNbE2PBU_^6=q_L=kkTO&<3pBb{FG#Y^~WBMzNW_KH<0me?!4S<*(j)<<2Ucou}MOr!RL%ljyO^npG@1)4K6iA7bve8v;++@rL*uJnng6jOR1sdxf zNZ5#85uJI@p<5eYPNAMN^|ri{YNoq$<2f>mL~rkjm4nSS96u!+SQy<2HmAUHRtbAe&W&!(hYkYW-F95tiZ*4B|n zDP??`i=gf^!OTWaIw!$yN0q#R6ybOixpLg=1Ty!@!sCMRpk4S3x*-r&QCw7jLuz{N zn`Win!1N2SnzY1+i*|IIIi@Oqdglmwau*(v8ezhuN4KJF03@Xn2H*i;_VF#Cya1Pi z_CJ**jG<2zng*NM%BTQVr!FWf_!F(%s1eQZ@epQhM0@8KT!QzyX4cfcw^sd+FUBg115?#G?3PW!m;z!5QqWN>2Z)BqWF(b{<@I@+3tQ zg>10bclhJGO6-dE;YGVd={nU;FQH=rwE9CO##pdJoFNr@OT5zSNc1xJSyr_TrOoQYwU zG!{Y^9{)JRpFk;J7hy_i&=cAc;1LoIAoj-5U)8a6^H|+=ezWa9%#MM#?k-Dt95{7z z`{0sI8t(b-M)d3RWA;!7X$9&LkqG(7$d~pTg(6koeS;68SUr8tYqm3A#bG7NGq~Lp z4Y~rM2gnQbe+xUet|5XZHsa?N90ZJAf4aHqWhg!7NEDojC-|c@8PN5xurM>Pj)fg# z*(E7SN%OC>HY|YPB{}KS$<7dSfP4cw?l}tK9l38JP5q!x1u!Vw{cin`W@_kNn01EH z&h!&n=;3O2Y`(?9qG6W{>WIZ>;qZByA%88w7r^;2*n}C|)Wd@Uxb=`ElRXCy4{e&v ziz9Y0MWK}y24a5x8i8nS@2r6!WuexWu7w@4Vj=L{tE?mi*y5RvNP1X!c-!?qfO#!0 zW{00&+S=NVyo5rqqvSTwmzJYnaWHzI@#g%h0#-D1h-tkI-Tzuvb{m=t$$2ajoXEOO z08DjoG2mk7wX-V zAk|*Qk2|3Qn?jt&bkJQYBI+1XMrk4k*{c8lf>VZPwi zZwH%05942M5U*@C>=+)7($u$%zfd*8& zsKrBLjq+8|#!b%ui@3KAt8(w&eE|h&1*8Q;6p*e-Nhks;-HkLzNC}9fK}xAemvl@( zx=UI@q$Q+7Lb~&e>3Y}uuHWAK?BChvk8`eTU2DNylNrzRjqx4hbKj$0kp6R_j6c=h zo8yVrnJ~^)`0JT$PWC481;&j;%TNVli?i|rR!z}Jy^1G$xNqgCQJa&>EkGq45A*6~ zGjOS`m>xN4;rhN_IDy^6+=0FEVn<%#phEmF3RraHnQp`6bw0^ptT`H}d zYT#R59WPSxL1{Q4OeC`ls)%@)T2?bkvxqA1l-$8%Lya=G6&LP@{RXM6uqMtQn!j;W zX6nMiuo@lU3SLfB7E`x2et)@CZ$P0^Oz!mh11(mhB_FHzdjaH8T2InLSupVe9%Dh+ z^AI_W`R3jWy}7|0xxs?mW@1kol}isahWQZ)%Zs)Sb}*wd@*zjs`Kre4@~*SQ`AODp z$CC}yz11a5#?rO7WwHihgF5!*<>j3snyQ+TBZ0z9p-3|;b?+T#5H`a6XShaaJ;P^Z z64FRVOUvJ_Tc|aFt<&h{RJNQm!b|uh$-*H)TPVv}wzTS&1v%{Fu!L__AJtP%+gEha z6^-(1%zo%#4qo~`GIAReEGJSnr9?<2DH=PpN_@dAgO{5lk$$i?C=qlhgFzZxxn-*F<38|w%TfgMPetT0@$Iv zZArJGKiI^h>rf?F}bXHxK#cTEnaSa_Hy$M#$uy#^i zpilLRUlxAk5zHv=gQRxesu(@3B$@n%Z+K}2Bb zK5E=%Mj6-?I7~f~gbpRw(H=?OQ)A?wg~S+wASp!vLOb-{X>u{H7DG9kvYU~{Z%tC} zUnTTMXv{*E9i*PI-+DJT3X(CE`KTgjav^v0eK4DxxH{?V zM>7kA0|qk5UoL%8mO41%E5cAeb;@}mKq93M;RWAJc+X;gnzl_qTHERwdiWdt-okaz zE!f1S-|&cAa1?^V^Xfz`bwgT38m>8%Y2dvbx!Cdxw_artQlRwCxdWkIg<2oyP1W{; zx0d#g5xY#`Uq7j_Jla%cS1q&*8(~3tU1)1Wbcj=hSS`PdaZWhG$DRxTmoiB2KaT1) zM?@Nc-v}U%RPPn9Dc&SDbCzRQ_0$4Z(H?B(2duXbYo>1ox{9?FzIufYDw>qaO6?(1 zWJn9z(*(3nL~4U>Pzn1~h*s*h2lcFyUnJ9kJ79a!xa1_$drwb1LY*|nUL`vpE!j#Fr~;-8xMrJBRHjEQvt0Ata()FLOG<)(C%$vXBHm9}R6NSDV2*F8fyk z?DTqZ0d7o3aWkSH;TH`-U_vb;kn5a5Vx-&;0?HtCHwz!rfbCtcSor?$FcikNO&chQ z|C4!lXGhHg3tU1_O9X*q^-p#2V~wQ&pa%Jn7z2XMZ+)`Y?l8=d%(HB%5*!_{rh9{T z{>F8fQuB*Y=0XIz_q5-6>mDwki2)2Zv!NrHPE zp-EL}-akvy_;G~rUO-zLaIw{#f;Q8++Sjhu;?Sqbz)P;?B5CMrlVpqMn~rX^!B+E~ z4I!7=@7Kw5e0+@91X2qB^5rH#8^7rC$3?s;lt}(`XzNqp$X9HS=rn-Hbmd*nIpA}k z^3LJ^eETXcGg(mVDK$#D|M0_AMec1ZN{Be=j-sgE zr#6@uM~K!-uRS!E0Mbyq9%iV#t}8IQex3yM6|qK)M?pA7y&MoOEYTVzbAvG$90;cx zUR`jVd;b6pElgx9;N&SIQer1xejrd)d0kDpR*l8dqZS#bmeIe&Bf!1YnaA?m}gy-zlt5=wo^P+GltzN6b1Lxj+*EKNib%35SM$iCbkC(3I7DJm((AO1f=XEXxr+;j?IwOzwcX#20YMJZbEd5}_ zX2_nB2`!{01#=2NJ@!LidX{IXjx7D-BI zRzBOn*Q=>j7LkfZMr^sNJ_p%4$mpjW8MqcluaN48&s|(14<8ILTpW|Jm4+*8M46pZ zrIWcMW-_?N86op*#$8>%kY2+g%h~M7lXjIS-1pa4G}HTvQTjSx7W$){Nf6}dv9M!> zXv~!BwDQNvGjuGkyzM>ZbzhK8|B!p*ofWAJb{0(3O8DO zRs+KzTTMbNX?V_#g_W$m5&S+r0S@7{zO=+`gK{)#Mffih=2cgZIi>rJGFlXCcl#7o z5!neR@W-!`on9M6Xn1>jtH*8TIKcc??UkdrlC>_uy_5vI0ofSHt0IRQa_~4$t206A zyeeu@;->Jk9fbIoV52Zwg5qV)8dY=02j5md0_p-_%X4+h3E_UCqd~(HOu*LPfD`I_ zcd}Y*l2jK_2z8ppxC@yy%(9*360YwY!fu>^H^k#Y4|-+DF3dku&9-CT`(;@1xULnDv%JXVLF%Rvr3&a9S)Prob=A~(Ti$z*qV5D_%{x+C+7M0=$y zu#wtrsY=YB^707aayXjMs#B2VlQ$babm|+N{{nZ?HW4ZXAoVvCR3c5dRs7|B+w7N( z4KCR3O+{b{f^$V|w|B;C^|MG$16xZ=_Q-ER)_Db^YMs;epWvjJ%gdgR~ zl}1fiOQ9`b*auwUm-=W)ZsY~?8&-(<&s8~)f$+Pq^6i@f$Vp`iTc3<%kKAo}m_}ZI z2?M?9Ahzr7I)p!Ke6#2kwl9oNo%yt#0=8$x|IiYbM6{p z--qNxa*SNgP`AIBT=5QGr%kV-^4LW%6t@>->-+*dW|>r@uv(J$J%lapTVUlT9Y9xN zMvk)`ILb&P;(8_Nbk)LPW9lBnxfkIy9jE*Qz!0ib?84>dRa%JHAuP}pIt;T}N!F0Prey?MFhK6$#^dlKDBE;*3e;(Gcp=D_Vz}v5<0>Ey; zYh|mGRX=TkqLvqKHjQ%)&4^Qoa1wqRE&Ul98;#|P>txfR#Ofi^tW<2jj-Nna*Oxvj zF$dl$P~gkpxY3;-gV1>F6L!AhVB_V1kG9bwuAfr4Q@1^;cw_XOk>AtlBymLp$N zGL!^-Ke#wE^FjC}bv7{Y64<$H$M-~Y8*1)p?Mz!%kZHVd(US&^aXn~R=Dr!ryg~OT zb>~|2Czt4qmC`wq6d1$(hMwP82LY_wMYz;d=$2KH;t?nlg0;1wk4E6S1rStbZF3o% z%?q{UCKv`6-O?=-^*-x_;0CFre)(aeeUp;FRlQU0)fHE%>Q9NBT-M0u7t6JL)+SO1 z%Y`7*@5iA%HSGdLbB01sT0X`?PX+h_to^J`FUYgiVonrS$5$#WI%2ZGGL}#Zi_>!Br#rKdAk1H=?_(5HwdUl$?2qePRvrts+DCBVS&LE9&>%|Q zl6q2j8bA)tsl$OHB5Y8UEIdbAt;!%RJ~A@0=n-Y92cYeKpxYI?msWMa9eYCjOCScp zLx#b)J_5TNVwxghYE0Kh=wZk@-go`0&B;OR%$!BrC3r{4K=}8kCQOYv78ez%STT`dmWG) zU1tJkXTQ25wp6|)3_lj0w{Bm(-y3&DA|qgf8mXg!0~C@umY!3^fI{^0W$ge(jiJt? z&?s!p0I?QhWd>YzTsy`?5{H#L6)ZXPG1`m6Y<4+PDa&H_t^`WvP_f|((9Gx=y|Nv6 zq`_V7-HEJc%ZpTZcfSM6i|Oc~Yshk$?P zE2>N@f}7to*JZC?DY*7hCjyeuA7zERb6r5Q-kR`+*`3}dXU*RSNrA8}#<@ON8muF2 zY@%3;Iq!t|O9oIJn3N%RphF{BvvHxN?g^l^kWu}*18bjrwc+k6dN>INB!luPh?a;r z44QMW?v>hxu=K(ekLonDidh1BdT5BTA1O{Js4w0%%A!26EdAd6Y3`FZ&D_QERWBbY z>lj2yj#{9?#Z6da0dA$#xJleA!g=JVl*F6bJ%dfZNH%%4SH5@$C#_XW9xaCEvx`bQ zo8GBpk(N=`gUR*c*t@Zhgjo|(liu;j`g^4)dnfk#goxRsI;o9@S=MRSx;e}1E4_Ob z9vFz@aeh46He7$^47#=9o1sz_C!Lw*#0{C8x_;E6s?UWJ&&wHp>~A4?17oi^6521f zCoU^=vGJV!3!gE{JR`J0HvtOecnhcF?G~#w~L8 zJ@mQ+4YkFs{A?xHX(PF7cWk5c^IlPJOzn+L?VS@C?@zo%#uKvXIQPe=hg^{$!+?GA z)!k24=RcnLM(AFJ)s6u2ruu_97lGlud;RVg7`50jOwG%kcds{Wq6;lnobHWn#`Jh# zL193?dnOvO&!|eIfyXH#l3GzW$G_fgSLG$j7)q0*d@$(Pw&#<5@L1L>zMEm7uou#1 zapSJH4I0307eTs$LqDh2U_&|Y0cK!IED>y;d&Cm$YQ5Fx*)H2PzI^mhBAV+mrr#~> zF(n&y^?g^F5&2rc9_wg_)-x}lG-|96VShiydH4RE*INf8T{L4P*v>Z1@S9o6vAV*g zweig#BI&_bB)%!+5WQpJR(%zSK}z3@T^xds^QUkn6eVO=N5Vz(xP#ojGh-{AuKc8> z^uU4NVDA_%x5IKf?coSj#l2@9)>ByB4%0)D8*rTsT~|kY3<6aj>`lRcZ_nPY*(hKX zV?geeKVIS&&2KfE?>tENK+kVQ#7@$Va#yaDMdQ0Zd2q$9wohOE0RA14NwOaq5!gDe3}7y*Y7L*1a@l-{>7Q)IDo6 z*@{mksej-0*-`i%wNQW*()RV(xj;q7(z}@=qQ(wApVB?Y>V*^dM6E&M;@872WP19G zCsdH{I?K)%*7p1s2w@U%EXc*z3$fl%sWWuz?(sUft9>AG)q8XCQh{x^%!@T=O#yVY zlR6~g#c}nz=u;}Oze|0nkK83-k@o8}VUCx=GcT)9xXvt`n)B@B<@8~w_<6>OLBLGo zYayo<1)8)WhLL0=mw#i={C=+R zB(#mrTl(#A=Zbjp=7api%m-0WUV+{ot=V{MUyzUhiu< zj8R8p(dAqbXo(kexd!iRMESn&!nswf&VUuLXmSJ zoYKzp#S+sw1scAmW}Jg|6VoPgcrsqO=DCgHRAhYxneGLFsVZa~>Xtn5J^5=MJ1mB_ zr4?AuvsMq)eB_+MGpKCa_yM!01%}0RGR-|x)jQk{tAZS-HvX1cimTl+y(hA^nc3;p zpHy5q=kY4mmKk&POEFNlhpoq2-22v0o_65DZ0l>`f8J2GtLCOlwIk07*6Mys@He-KDm=$UG=q3zy(oruzdmhr`rX7{rZW4Jb$D^NULYy#A~;i9}Xdt%Q{;~ zfr-9~E8Mf8zj0t~Az5CD)QRkU{-MVZo*+`fpw(+EdT#eX$)J3o@3n}4;}sa%K1c_G zL~jR*hBSBb`gN<^+HqSeDTRL*m0_ge`C96_+3o4SsSoqzItem})#1>kXDdLT?Pfww z!^P$+%1(eW_~dqb4mF>bI9cB{_Zjcs_p?kGR6IFlIu~H7=^XVZa=;b7K2S&`ems4l zs4M^UB;vsCd|rB-qQ+pm+Hj|xI?^b#PD3)w#6-$_tdZ_8as4a_JRuO@)Fy*aO9~UG z_Ki+n_|T{Y!s+QhXRQ!JblI;{@6+M)3zxjL<0GdC?3xE6JV2U5d~4Rd~pzT~tVLH7&R=QZJuS4dBhNw^}WN&fL++C7S~qr49XoH#tz z=v+`k$vpn0K@?-b7GAl!*!wGv3M!?S&$@2RPKx$h&HU#&w^MeMu-AS*U-|ums=}xh z$5pu4yVdBQV;7sg0iO-BVx}BfqkX9T;P1hMw%Gj~2O>auieX=}# zsDSbJQ(+Ui5Sy>}^hG?Rhv#xXshB+Y&mVpx`1NlP;LoG&+85a24J|IkNVV3xS7>tn z`(@fIFQWd>-`D^=J0795!}yQi0SLH@inadp^6+Y?IQ}1hWI=$+^8MqF{y%$>Cd};w zw10n=F3}MiGBhZTqI}i=w9;Bcd0P2jrt@o?MMncpQ%Ifxu4-|3(%DXC#X_vL6`9z7 zzRTRTxw_-ErqNPsWi~Qy@bFBRjfzZoc5>hlFX(^)gaA~h556jT@$BQ|y#{SC9C+ct z`t7+2*)=$s0F${@4a&(I@3XW$pccp<*S+-^5CfECaBr`1+J1nI-5i21h_j*Mpt$0u zoB_p(NRoRH#DIq`C?5LdmtPwi8)IA|yq2{*4h^7^>+0%SZ|5}o9}I;}G)IaTPb;o; zgn7c*>Pfv7X8zfLM_LF-qw0_KA?BHENDUKvI|hwF868l!@Ev9VRP?Q_StXLcdoZQ5 zNM>?Ib#`mVLtiqmLF;Epg%czka8cht#(!+yv0K;wR8ErpoHr24w&eKBu&<$>Eypd<#|WVpB+G|J3ZA<#j!xWmWFq>0K3KiX35)bioP_N!^eK<3t=$JQYj1*oTsU&Xat zc7jG3AfEnKarOfkm;%dwMo11$Y}J4lz6lunBT6R{gcfIe<1`1jP8^j_zj)eBA2zL{ zqYbfDW8V?rXlg;oeTix47MKi%79W?OUH7x@nNPo91~X>8;cM_{(89A4qJZ~=1HNX>B6HTy#5%X|GA{)tKF*?U`n+f0CgvOOCauZQj5WXECrr8oDqdwe#A`uZ>cy=mzJKYvL76xkz}o|EEY zcBh#D*#b(3lH`b7E|5wrT#M?&3~RekKBmt&jw5Sat2GFxz0SKyiikXrSb*z7JV&MId+J0%~Diu({SnI02Xhv+x^Geg#sXC^66l%BvXBHnLKcfa=^YRQe0-07MDO zHw)#w^7aW&!8{ELCA}c@*U5Y+1g%g2u_+VD1m}!Um16r5UPlbOlQ#bjPNvNzS*ZV7 zb7FGcetEvXYPaECEzT{Dqjw#381YE?K&?&uKa~6-^|YOk#*14&$=M0&jgGC{(kXrB ztMB9($v@sArFTQ+ws?3_4%tCYs!bXi9E|GK#1YPqgfff#9WD~qFTQdxc)@d_%NpcL zSB=PSz)Xgm38H+Dp_BoNU!Yg@vIB0zSQ3;^;P)yr1Wbz@qbivn3ky_@Agid&G=TFS z&VM2FFSRM4V4A22AE0N^Ob`we;O__ZWu6l#>dkjXMftwi`K1h2c52M%hK7cB8B*X3 zJ-7WL#vhtjF!Mn66c(5mJ9TDf;e?DAAUNTvmoOZTdet<|g>SOI_7i9Y(rvzBY+1X_ zky2}NlxY@p5MkFXGlb^4KTwarNgo~oZcITa6#AF9KY9hFu0wZF6NBP6oEsViKz@am zHA1GyW;ex@KMr7k*YHozViV*PTlh%;9Wckx33Da82(XKSAX@mkfb!7HKCG6|mBUp| zltXDf>Mwo(Ae!zMyz-fphaR+$+o276Q1*zW_la6K;rla{>@*yMG#D6GTdW=6f%{(x z0&rcP6Vf;oc0c^@@en!OuQNZy@sr-w)46Utfh9{)@bP4rcG`VM;@&d{;7IV}+`UhG z5oB^TVIE5tP8K7`Z;L1TbACRqIB{8=r$ZJ6x637?X0ST2Nc8OQcW4CEe<_?7|HSh3V z6Un3AR77mG>->=BnzsJfz(5*NMN6%Na6)WV-{fQ%>LwSoyf_k0_VyZZGvjmRf!_0i z11AA|Z=Vfr^|n1ljoGee2xqB}30co(Ds(b5b{`m!LuWd`IU1)67!^|ahnP>G{Lx=S z8YIPsKzv=7co>&gWwjT4VRTVj&q9OH>Zc0kL&pW!RiOv*je1DOLUG5uI9ZEL$B#)* zi$Yrj*P)WQQ3{L8QlI6b+`aqvFSNF`vHJ0fiG`Z-Xz#7@2rH5*qdye_7!Y7Sb(=O! zi7Wxf=di#b$?~8gENv6kHVdvCLnTCb5rDl2-GiJr7eBur{0zlkg*$ToO-9;fuk8hc z0RTfsgS_1QdBf84w5I8IWYfkU3jgpgDs`-ZWd2RB^7Hd=@1|p>ti3JLVCpw6q(D_^ zu_UBV1)WI)4=4sN80~&mpw%3!FObPh1kF0r!xJy>nE9fr#=9QPIbh=s3L4Ea+;qst z+Zb~vC`9FD5M!abXn+d|G-hK7GSEs+!aG@e6W&hiaXIX#Bjuh~A?;-mald-eE%()0 z=Uedm75y(rdIv4vbN+lz7y~b7EqPu^zMV>!!;~-e>u%9YCKZ>o;0h#)qhzVj10sYPFnQv1RN>nGeA;KVo- zp|?n+*p)%_`{0ZFF=DhAEO?6I|9~{mOd{h9Ha8d@LhWjuYBr-LWw<+`x)Jx&ar6oAp%)>YyFO*wf8KgJ1bRzy#p>VnniO zzg9WeBER>R&Q9EV%6H079fbN$|btgW0M!14# zjGQ#@y_8mZMvIK)P`PHN4)wWAs+~7}5 zr>=#)6bM6acySQB@}Xa>0MRDaEKcLL?j$I9IjNYFAOCy@F|?%AB*wG(Wr=UlAfP2k zVMdd2Xadkc>ZHeBgDZQgsIyJZO|qaz);CHS z(hRn&%^#(g*Np!FEA-)=-S3g%wR{@Mr{pn*>2u<0@5N{eF;Tpqal$YmnbmRTQm`^4?Rz|mk-&+ai zVa@&T@C4pY5mBqE7Ghh&B9q+6RPdV6Ql<8_`>2ReM5VO7K$Qk|IDjw7YX>-G{|8W@ zLe^V#FoW>F(FF|WUl3)H$o?BpSlK^D($=7T$6wnap=CjB<0K?_a660g0ld&{MYg6^ z$@W%@0uj6wleM!7W3R&=6&{|s0POfbF$($%glNFD@Fv)NU%X$TKymF_?hlRZ=+Z*B zVf>fQV-S9#95wP}@}jNuOWj&`ZP^BDexb&6X-SD%$=NLn#uVCs=N`|V@q%~%bfxhv zDJW%*JWIiC)!5a^6(%BkUmWbi%V2Ma!0ze3po21Ap;p({vyG`QvCXxxEVtBtrDm=>ekJ0v>APqW z^ZvWYpT+)1nP&5`uwPi6oyW|NYC*4Mj1%X6;@MeNaem8muN9fO&>G*3VmlqJ;3VqR z$$C1VEU-bcXHYEo7pa;fcr8$p@6EllHe0Z-^V=)p>ei&Z;>aBPjErKHe-a6u{eTesO(b+K z{zW7d;p_j0NO;J=qZu^u`;|<(#b;1g;@+3oQLl&CxKd3ApDM4}t~3}N9Hc)E4wI%H zTkLfKMxp(D$GKibH+_Me%hn{5cY`$2NkWj9WC@@c^lgh8HI|sSIB;MG)F-??J6G#E z9(DE4ddFw96EREZH_}*(b@d!wZ`V==G9w3NUu^K zpIYuSmgm1bH6d?rT0fn>e;;pcWGV&kThp36Yr5g7+E^w&TczTSqt9)H=j{%+yTrW@ zL`61ghUzP(zFDsn99;eOqW2hSaLNLWGkiXK?IICDZ%}c9)~B~kRu6v8J3flShM*?a zy17*j1tAhfVL#AsqF_zC5c9u515^R+h`CwOnYbmFFgh@6@MHZIa~SH`pC1|d z0^%vx;!ynR?TGmk$b`holc_tjGw14PHNSloI`LLX&QN|>{ylVsk*z;?yfi}c#^?`U z&_U2PP!i;3JMVUv-2^$`2+Q|sO!^?23-9pIJU_wlVtSs zc7l;l^N;F(TvbS__Z9rasM_`qKxP%XgKLLa6FOgh2lZaneMu`_z{C;AEGV1CKa>YR zjHR#E@v;Gm>-HR-G zv)DBRidMmfZ{;#Z=47c={oN8>ybuWX4S!ZSYn9v5z}XK}bb#)Inb@WBF;RwnHn(9$ z>E8x|*M_tz-qyXgm&zF8c2*At^+W%Xh{gClIaC&5FA=c2qORsUk3Ur*)R?MvOz=+4 z+hP4HAb{A3l)ZEC>>XA4(W<;a0t>3QAk?d+SRy`{84uCr4P1uWI5?G)5|Hgo2b>*9 z=okLqGBVpm7IQwvOP*pHg9b0pg|_0t>XMp!f*6N>s7lk7Q7$I;k6riOtS!%Pc1Cix ziVo++mz*TJ(!H3ETn8z~KKXP>b>y>XP>c@qd7yZ29(l>k_O7j#E*Z7bM&cA>*x6|= z=3I~#1#FJ0oVby*c=UY&hx8%X!ht+#_#i>`PEw;)CDmk{gjT;@>uoG4Kn${~c=OsI zN$@RAnQ62uv;6JZS@v*1K`_=-&fQG%8lNniviGX#fw;Ba8qR3hgx}R!l}H(o>WCyb z$hR01!2s`z9fsD|SlCCxXj+p|*&n?Tk(F+E_ng1O{>pdZlSHy%WudyNYPh8iAc6=Z z9PwYJ4NFcbKvRX6!$I8X`Ey10z^9OHU_4!ZrU8RprHC2w@U%jMEU={6l-p$g; zqpO8diwISk7mv)zFe!^kH|E&~UKc~H2-`WE-MSD4tr4?SYH0;PeEu)jw(vC^RL2#Q zHgj9Ck)J>FmYA?LWvyOhlc3tP6oIp!9cZe|F<}yZ&N;W|=m*cJ>?BwOVlAv7=7_bB z(l5;x3qn26Ej4JNSdqiMOp?WlAHuIr2KH>=#WS`ulJqx-kXA(jC?sI!JR*bFTUK^; z#3pIOGH2!zqc18oks_DLa@No9`xC-p2Gzer92l)oey?<`_C#e=Ofe3Fg*4%?b^8jN2G;pVCpZ? zOL|I&Pz9!EX|&7Lip{~50{)UA1qVszOo{v(Re+2p6uH^-jNXGQBO*m9eZ%~NI8ix^ z)yky;2v2~~icBylt`SO5u>6`@rFaE0%sChNr!(%yv$B2nZ8u$@9!J62LpjTye8g8k zi~%mJa-9mLSws*Yh8&pP!Uj!VXTe~R6?7HS)s2&@ruwY>v$!Ku*y#GqfMUw86;S;b ztd8sci(G)cHn{*uAjFL%W_QSoT@r6ReP>Ua+WM3qJ*_HIx$~jT>h0yi1J5c9r&~T~ zISOtiB_#kS$&bk}Ud1(n5tbo-1^dY;Ceq@vpeX%ytdJX`#vhB5WNs5eLPl!x87EKn|Ieyq&UW6!cWH_^__!KPH)e^f)WNGIQEoH=iB zmB83p6s;SpLStAff)p)e>^5oX(;OFGgW`gPaIk}Gig=om*I)kPkM^u7%OiKKQ0tMY zWcsmGN1+>8SE%N(N3<`J+^&Uj&TYrJX<7R(7Q&mqyD!=9+3q6cpuXo1>7}d^x_*!F z|1*+hmaDx>+o!YM!>W$t9yYysyl_!w6$x)pu=jpJ;2m;+ocp@lZNSO`Iy7>z4w3&C z7(x?mFu=Ysg7hcG6~{H61OkZ>a{9l3h{cP|e*qCM_C_omz~Eyl#v<`cYY4S9@q=#m z+Hx%0hG7ANFho+>tO+@1Yjfc&g~u*-otNUZdXLj?od=453S4WRw!eM_y8(5a@kEeo zRZ5}CQHGF2RL_$EeIle1uh!rQwHYP(ygR&~TZexU!-MRrP@7qlz8|OOl5E9lQKuEz z19|pZx=|vi1~LE`@a}Nw`h?qY`N7e`O7Bh*N82_h;p|cU#A9R@RHtxCb{O$qjTG$c z9eP08yT2?a4HFv>gW6-d=@kDz6{vU5Vqya)P^H~3zsu<-PTAIeh%J4VCH+#r5#hcu zF24GyMS#AU_}}VNn0clw@tVk&>tj`v?nz^IEUxFP{+It0hEFe%Ev%LNqi6+egNW4) zH-qCtR%L_otKR#yndlUF6PiLa6lX2gPbwYN2dBlL@ShpF+Ut?1Fn))1DWQ9VOc+Xu ziMu>E|M5!ieDBIj+AUfz`mRF7QpZIOdt!6VV)HaJ@xJHJzT3W{M><478b5vh#Txu@ zIz6HcDw_=RE!eL-)hbzLgkq|uG1;Sv;}cWK;hn2dg*lT zmh1);nq!qIEHL1beyX#zj43#Wsw%JI?Hm96HX~+3QtRDy*7o~P1!mGc?wKsH``9^~ z$o3%E1rIuBa$9N<_7@arM&9_lTttB$S0B4-(Ymih*e-p$f5I^y3)O!q7y$4L246QK zzXKbB@#{@TBbVtK0F`*@M6&fg)NpY41a3_GEUKz(_Cl#Y+jc6m%8=Xfk?}`y(L?V$ zH=2qhoV~Y(SbxSI3_rGQ%UBui^a$e7BwBpy3il$Y5$|$T#ATuF1D69bkE0?p)vAU5 zDE6lErt$%1segQ#Co$^1?#1g=C!TCR(*`Gf-`x(N$ll!=3Ag#+Otq(*`J1@5!|e&L zMW2Oo&dLPT-4HxGi9=(=oF@17x?8o4#whg*RfmR~*9bEQbwN=-0!9!a*4}dXe9aaA zvTeOQ1DV0R(^T7t2-Ko+pk%J*DQ`RX$*J2hqCc6ab6g>2YSTv{s?z@{+_v8=W^~ge zuJJu^|GoIR88989%di!j!EGacfiaFqJfDC&7T_+W^Xb+yl^AqPxBz)HUDhoy@p`O=cH zCcsPqHZ%NjaAI+9R@Rp3r6cq=_4pR6%8p?CrQ+iv$#B2+(=e0Y^LuZH zrX!*SUGzxS$m<+00}x>~!-SUv<9j3Zm3Owx0om*QFsw5(8Ipg_!!92@bB1>^ugibb zsBi(;fr6MyF0KRYgvjR}KdZkz#-)0C#>C12@(^O+c{Ty-LZMxJ^+>V-lD5#EgIKuU z^Nb$=Kyn3|N3Q=FFe{P%y~B+9O(L81d-T9TpfHAtonji&?R|iF;L=e7p%DPQnIC-V z#*i<^g)W1*Fa`1gSBPp6Vq7ujrAUn~H@&nnZ1m$y@d~=(aSu+f!=pH}MWu~@RNl8+ zf~D52F0N;s?^rsCeQeaVJ12vQpu(u4=-WH|w(seqQh-?GUKC3+aMzLzs|79N>4(`< zGo1Kp#!bS7;c}ZJ2vHJG*h;`jeJ~MST+zO2bjw5azr4lQ;PE&$R#$I!;x5-4vxZymHnv zd1dD0P%9Sd;sXzM-J8U#r5kmruPpz_B61vDu~?ys0OkpXfQx)p^Ep5{Gc1|+ix203 zOzWd7Qx=g9$AiV|AQlhQn!l*Iu@}#C_V=fR-R{|2%Sr(u)r)ptP<+t9dr`BxhVBY( zS8>#WV`BwYv*{jRctV%-RBtEbP!OQOv?oXo4MAgUv6!wOYwxKfg8TIvMgsI9UH>-M z*W)skr&)zq%%XM@D->XDy27DpTXlMVkH1v)@iQ3t9UgGX(P-W}Qhc(-uO7u~YINh` z8oWSZ~~Jglv&sKb-Z}w zxx9Shp_PCJjo0o*ZX49F{=NrfwDOwyWg=qivVSJSP(23jgim~R*FLX7b|J&x&jKzK ztAA_hbj^L;?E`6KM5IZxRGW{r{h8Q4@M0hUqYi0-NLG?J9NuEEJ=7Rz&!_O z*>=K3M~-*erYCm{<(o) zjLt|GxVxhNk4pe7Q<&x9f5lWJ$Zq`q1)=;uz+v>bCULI+eO=qf!@JGV(Lg_m)co8^ zs;Q^!@(pFP2EEY$2S$4da+Q8Q4OtP|wu1vfaC%t0bK580Sx!z4rNB~8s0N7(s-7(< z6@k*n_s0F$vfw|l)ITh=J2AZWTQjd=Fex^ygb0m-imFj`fBelQT30ksrXvFXq;LKV z@c38Fvkst6M|=5)Sb5j>4}L=lyUV;7{K~f6Q3Y*2)&F1|knORDv~o3YCE02iXkY~o z#fI)(KtoU@zKdrxl!u}E?PvC>=RVka;vyhXcrhhbLt> z)BexrbVK?2LB@pv5QMYoSCy>B&$fllHV2YG^hZHM)1v6L6>iybYdKBq9C#Wi6Qe=1 zgDbecbA?tN2JfJ?cA#WNL|HM7r)aKPB=0Q>{6_O)ZH2o5i{^ESfTR0|hK3gLXX{AD z#FmDjcpcC?jGo0qpCfy;IR2-NAopVL8LRge-&^|`WSw7W9;(7m^Q|pa;B)lP>unP) z8Rw$Pd&QI5{`IyxuSFTwr_SBy%h6s|1#vc?uar-R7stKk4IMV{rV&5e3@Zd&2SQUP z6d3jFVY1S9{9G$k3-n~AXa_++ZopZjV>n&qcFb^P*Yi9atT*8Pxt$RF7LI7(1aYV! zt&T$BwKGO+Tt<78la*ffEF$mae53gm$^Yh^4)m*l?+fnIY2Q(0;YpS3n_=_YFPdDy z+`j!82m<*Uf1}(w3PF5Ll&t;->c}<%uMQB%LOCfJnps1VxGWov2ha)Wn(CR`vFop$F2&IgHDtn5wj1QDdNolEt$xyxs?JOI? zPdWUn+>&sq9k{!JMw?}*68dagHog8bl^fi<@aA8Z9$qYgGZyTu;(m}D5;@&uZ%fkK zdhi3b{RV&6CP2aX&4jYZRQ>@$ z4$n06o`P9-T4|a3{|gZ0cCa}QC2%P(P;G@vJfIk*QUju2s@@LBS&3l3*MKAwmzWr# z;npeRMVHcCNv#yHFeC<(^_H40ayb5iwI|rbd;xt45LKOGpuCe-RJ;sYeZY7!ueE`^ z&NQi@uu%CdQ6?Rva%Oa(<@y4zZIZ6?Xo&N)TB~LlRGfeYfaq18N$H#O&MpNrXU{WK zFNv{sUiFt^U~Te0J9>mX3R-GwQ}8Bdu8*R*urXCvK3C{XAx7^lzOk^hp?EGvxnECL z{Lp{yX38l_RYbwRe|D5=&9Xg(Y;y=gPBU1qZErdcFRAkhWs@KNHF`~j%X?T;72C1S+HM8O#a zDsiovEDoDXel1*{{pF#@pK7f z$Q>O+0iZTxe+S}7#8CST7~T*rl}XpEK(ZW+mkN!V{BCFd)`MGRxm-wl+QC;#ufRpY z7AFVD1ghyl+rTV_^9Kn}La_8;TDSNgEIoiQiFFG2hpETv2$>%p)Xx*w9V_7@gZ2aq z9DSc$b7agLiocDLh8JC$Y%(d=^Q$$;ZM)DDHf zR~ap3>ri>zmUP_^42@j423JN>}Sx)S{J=(u+n zrMF4eO=g}4ZD{j)Pp^9gi0gQWabVf2&Z>BL^ggQDTKT$?D86&YqyIE8`zk}>OH{d{ z3(fPAf?b5oK&2{CLNROu(2xh^re1lpv72zi(?3^77Bj9JtNQ2TNJeg@{!j?B>%(7iN z2A}OZ#QCNgJi6X7#O$#v7IRAYWMvE%W`bGhu?|p}irf{;D`aO8So3fNUHZB^GzQ31 zD|Vb8rs=XXrHU;7>Vde3|VGlS63}B@Z<1<7BXIvQbO2;5_9Syih2G==z+0V zr)V+;oXw?H*Ji4P+f^@t9rEMfhFQ>#5t7WY1tFuXsRbd+MRgPKp}Rem`|~6HkE*dX z2ZS7IW3g~|eY)^7`vXDXbf|wi84NB53zxM$y^tfJi2G)*0L-TOOQZs=E1ID22Ld4Z4it!Y>)kH2V!HT4!8IJv1aPCWRv*hXq}EaH@Ze$mUr z5aW)&7gEbVi5eJ$ii~Mh6s1e~>8NqwxZ3GYhY~9BcPv)^EMUq+9Qg1&!mGZ%OVNxY z>OQO`36E;)zhx8Rh6r20RRueY0Tp~SKyJ-0K}7-jL_O+MfgxPTo426bY^ml4VHgx! zcx-w{)H?gyf4{BD4yG`CJ308x9?V^wy28Jvbwv%YlwQRKL>J#+y2dSYY4m#_o)1bpRKoFBdt{~Ko- zB-*aVmhp`0Z{EP7Zc`q!b>rR#;8FX%B9Ex;*Jv|UZx}5dUDAi-uC00Si#6Rn#DUjb z6eSL%s8U{DTDk`TwwXxE<>az^w&m5!7LzOqZXifDSAR+6ul1fQ!Yh(0iCME$Q4PoQ zB%)6|>DqsT8ffdwr~ENhdg?A!^V#I!*D-1S!IkvM#H048@<<3_ub*(%x2$ol`20R< z$*TW#RYBjLKA*psQ2c-8+R=<*WM)&=rSSVo_8Et7Y1XKN>c0S&$hsn_%*VfX-~e!& z3!0gA7xlo%1VJ_Iljg;Yo7JSiL?!k^f1SF)=6755yi|Zigp3w-CC-oEpF8C_gl22xV_;+g} z+u4RC(gir8XI_Xmj-_lU_mKUn_y*b0`6(`34s( zIoON04@ID1m|Q={a(;z^Rviw#!6&h}BR6!p2|D^<v zkE7tV*t#K<*7qr~SW_O#$?c~zBZMg^Q<$nMVW3;E&0I;H=JBSm2 zWjA;8_mumWoJQQM>g$v8<#W=Ci%HAWpu%vK+|JT<-eVCkAS3<^l)Pt5;%)qED$EdBLq2YDOR$_E?gZ}fMz5p3$ ziag(5=&o4FujT@uNOv3xck<&_FYnRXuX(J7=RYvFHr%}rzJGu1&R_BC^>%@K{}KU9 zlGX9mvjG`HI(Irc12?0X(mhl}Mwj{R!7wQN$fiivXNTJqjb;SuS+~`__=~+x-N3ma zJtHnj1$D;9Q)7L=8}zi-NF^^fj8@djlAS83h2`xBFuw7NyOSNqN=cxET%y1Q!aPmt z87wnbbFF-}>q0s<&Mnr@QpcFrJvQr`!iZ(GKKT9M;q$%t;3-BCd(J|c<@YEXhG7iE zQ@4YTsUhjiJVN=f0P<%TUHz6#84ayPo*kJ*e?!x+nf!IPW%Z(; za2~dC&M8kPkAPc!9i4e6_FXI@N&E5NE{c_&++kpWRQXMW_A+=>%-3YZrbmA@W#dHh zSJTH~^WC{d2xm1Efu5TyhZWgkVz_0P50*5U!S9H6P4%J7@1Yr7XKlWXYNo_THE1dd z1_6{C(2?uoJwI@d1DX+<0)5>zk~|g5T9GACAyPJiw?a9%nG{cMg1`cd85PCAvi)$Z zZ)hmvHc7I|g$JNy0RVZcIxmtR7C3H^Ku!h1x2z37@I%OrSLIMR>cSJlM-ZzHJ-za) zKsBFH+J>55T#stsgC{+75og>VfwN_JB}?n|6!!Nqx!>-yWkxHUk9y>Z{u~<%f=cZ) zxDvRYY__4Jg^8b4cznxRb4cDvmk(~0US7O#myt1mm2U8d`(+BK!$igQntR0&9k zS!G`>p5ULg;euRCIN$Vea- z5Nx(*2efCNYzF);$vfNM?Aq+k1LTp;h)Ts1occSM9wXO}sa-F>zhF0oN6NY(E>??w z?wIv5b{el4W%TjGB+LkmK8lB0F%Oxbzbr#aFr2~sYwm?%-;DV9an6)B8^U|DCE{Xq zWlPI!BYku3jp7j-u)P#oPm*B_g-uRZm%49>ueG%mSNKW-;i;o;-hBou^LLcRyBVBF zo^XKxqII(1Gn0Suv{=e1T_#(OaIwT?=`U2oQ{b;SyvBcvcj;UFoQ)`^PJ~ z14hms)r+$(EMuoU3xUQX;Br=j+YP2plMW84;$Lj&ZY%KRfQtvDS-x3In~*td%btof z${FPd5T-kp2!NGsWCt;H z-+}{hKsgmGbZ;dGY42{M`8*Wl1>@mN$t(dZxR^q)g>JOUVE;&=B%N!+djiIf;Pk&7}Rd@v5{1ZURMwr{X}Wt zV|hg3%aL<1cbP;)`&)Hpbs z&h-4jt_nyYQaKlSDIkt8DVjt*U_8F|_{O<60~X^_itS2Q|D<4gn2kXSN=oC>&yruC zH*JP7>ATnYz+{#7>Xq4{LZgy*b#qfki>L0bmY}nDyIJN@E@69Vh zHtT8ohL%_0dAC4;eF=Wz*Z{tB?YA8z#O$QUhdVSWujv z3NmHnWzbI10(BDk(eU=0NlT6*0=q?bZ7Uzhgh^|qp3n2H#jnehiq!O;xR-Oz+VaI=$8yWvsiUd`?M#@}}G zqD!VmzYh3ofQuo~ZIb+xI>`@DnOn!b7~Ty+YuOvp@4(Yn*m)0BcfT+7hRU27B8R|4 z2jP(~i{hd8?Hn1CSQROOMuqiz5650dme_+a#GQn*nRaXpIi^QhB!#@3->L1okAKkj zO7}7~Wrh>hR6thNxq)}%Ym{%l#1@hg_NAc%!E@#|8yj?_UEf^?vzA)dyqrI(k<~_z0)b`j%a32hk3r-7$umG|DdnX7 z<+Z$;7F$|cXy<5fS8~ovA<;DMPg|@pg!AG^R-bia(wu_Nj)WMy%Vk4(CqBn*-1B)Q zCz;T7f^NS$m;iWUhLbh#kUCmlJcs$_?6Bi_!->5ya>+W4T7nwr0(z@DS~tMH-wmC~G zUEYuW5|M^2@Ek}(_?}0j8VXjma&{6&t+|iP*h#I8I0<(y z&%4tboM`^_DB~)X;E1~FkdUX*)ltcBSvwx+4{-6` zqrU>2R1%et%f{PUdvQfyzhn*3musomG8Jv{;0P@L_z%R&-H#I5X^N`(UNhtStWFfA zr`MVKb4_TB&R|oq0#kM~V|)|;cE;ODSpqe%8~tNFNZlsE{xDaJAa$n9>nEA6x0m0P zV@yrRk9$!ZUB$KH&-uQ!UThdl)Z!M}D7GUs>AJl9XY3x{zTLgsMgFSXb%p%X{*cmz zkzbp3k}rd3e58=(G=o1`6P($#OVrN)BAeFuwPChmHx3tVJ@IZ?UM#qYJW(q1N4oGl z?e8Hw+x1yp_3KcL_tiHC6QKDhSjM0X(lKO8vynakc*zOLW@-GqROLKnr*e`QR zw&xpbisRdDjlHb3lLEtkOkp{p`9(yb2rIe2QnJ0$iQ@CLF&nptcisO;xjAE{vVlcO zup0>0o`vsH*GwFSEoCkb(3jID zzllp1Q~GE2q};ur*6p!VD92+zS?=k%9;Gyf@;Fo)73mF;IMYCreMq71ZOQvx#D4Nl zBv+N=W19tRtbAkVIKH8F!;F7_4<7m#8&s7v--yN+o}ELVM_V)15_J3R{plDy)z4vO zzdoig0<1R;42Exo-*#xc$wp`RdyMO4-_oP)3HZS4Jog(4&(?SgEUHvknKpRypf-Zi>(GS6ao-BmayF3H5@y4n}`Hm|g8~ zc-P0|>o@ja`w)-*xNIA1?{-dH;Gw7*Gd5~GOwmK}Rxo@{kC^(5fxICm+I!l{0iIoK z^F9}S=#uATAeLu!s36{L^Hj)qk!{Ab@P45vT90|idkLo!+b`iba87I&eJ^&VC+sTH z+htD;Hvv}*H+>SA02JFDXXoDm!O`|+c6GqzhNCQ`BTPE|vrXZabvma4(OORT73&7x z9d8#w>#4~{r9qTxDZD(c zvtHJFGKvb8MRjFbb#w^b_x4xlB%eI5I_yK$?+;l8&GGuSTF;eCu?2biBs(t)8)~1M zg5|1-S^QR=X1M-1lB-v2b60{x>C)cM?Ho-9C#?<-xQK8t_DTLNHv2EEt9YsP5+S7@ ze5m}dVi`VSYDGLsOb98<(EqjyGN`V|G&bjdR?~p@p~*1l+MkzowFuX`eYfC8Qt;AU zg47RYDH+_nhR;aknl{8SH~b;h;hLGSQ2sD|`2e@*i2SuFMHxM7FUiIez7QR5mW%%g zQ>>a!4~I$mYXT)nKIZs{cB3hBh*W4IOi}bR-tDPG2HBp^nNw3XYX;x;zZbgIQ2vRB zKnee~AHFLwwDxa1mve#Hb6zuLJ*B|jwF|Zjn zKgch?GG{{J+gd32x*8qrrpW4t`e&FQ{*@JY^VoTQniG`yxjxY+dU&>~GO^RGX5VM; z>ge`91Et?!2_|^EHPt0`r|ZT~yZskDxb7pXFy%e_miWbAO3euF2V7S{rpb%lUmE{? zvMBF-T!0`=|+Rnc7}yLtwNZ^#>OB? z-{eDAS_q|=gzc{Ygw{*_T)6GYN8j2GPsLb%6tzrT6HYe+VMA>cdA2!eFdE-pfdI*`mHL&)dFf637Hqs!ud0)OXwjfW7>4qV^3Bd7KD zMkH%r*&K$PV$h4+9qdP4ez4DquFH@Vqw%_qC|_-3TN&u|zNn$^HkDga9}CmdOc|u6 zuV~^}Ksw|)=^*q#^^hn+bqMRu66H|}HUT%nS}T6a>cg`OeQ1(j_2dk^k*nWAB!QFQ z0rKI%Za^k$%)EbH*vS~n0q+7Sf9OgNdl{w4&T@!D7Oj>*ZS>2&HT3Ls19`;qNZI-G z=T}Rf-^o33HwVi40^M0_0OMz7Wl6)?5Fl3~{vjc7F$h#!lGD?ho?`&|@91aO1mSX% zbaQwQ$iiPK0>>EuIfSX8Q)Ig;S}_Bf7jI`Q{QMcoED0bLVCFwW)S(y4qA%534{Q;4 z+zkxy)hC^U-@RkJM43`kbCuW(`KsQq1Aje4jA)h(6bx|Vkgqtkq6K=wU@sgW#snCX ztt3<3Df#!(&CShIo85T49U+cgf-h3PmAS9VQo_d1;abFFP}QNYTSOr=ANHXQLI7<6 z{=M|d&JRz|<;Vd_*V-Voq|=o{0;)*h@O5%wA@LDq=H|j#hPd2#L0xYWp)H{EGMbP2 zM(FD=zN9%Kx`{f}E$;2_*H}+Wdwp)GChd z|1B2ssUe*4Hy2=M7mZ|5hf}7tO^zE8=+^_G7(nskLq=@hLgSU49Xj3zh5!z9_S3?k zpbaiDVpc>ygWjW0?j`?8`3?-RfiNO$2GzQ1A&i+1SF25m0c4ii`mkS!BQa?eJm{-U-xXfU=dGe69QZ z%^4AJwJGzuP6%5k7=JM2j^@h;ToUT%Z_rt2iuswe_ciM_3(Y*;OBpdRU7-^icykp> zPXUWokd!%uK3L>Iic;vq8)jm+nxKD5TM@_#UqS2wswkk=@#V$pKzRAxCXu&FKeic0 z6BcaG5QkR8EP&Lw2HH`+TbJ?;)1?eBzY?B*bYbNX+81%ffNE!EXN#on$33!aGV<{` zq!q1~mND!5{yiFLU)O>sng7S<`>Q)OMJuA$rM%Jf*4B zy;mk#1E;m20yolj{)Tt03Kt4IvVq>kJN_9i)_-p+{X!cZASC8yweUX%IcdtfQ zJ6!Z^j6mI7E~S&pjuYRu%=7ra5p%V$kB?TLywyP#Fwndv1Cj|-;yjw=|aLA>lcOT8d{l&zsKdns!u zS%Tuh5`43VwR#{eZsXrNUArj@4TR|?ffyF& zYgbOcO;>$WX#k{**bldi4zC|^cy*Z_*a#5v!s{!6VOMcZanJb_u>KNhG%#7r`qL9? z*0A{j2|+HBy&im85QrT0yw61E7L(Qw7OXOql$4Y4M3x8eKEf6>boH3$IdWJH8+Q3( zC;`ixUdzeMkrJn=f1(i(F3fP^xm5{4|YQ(jklKA3U=+HCVYN&jtd~_Jhp#qi+*?7eeBoo+wntaWwmwd zkU)sgtQx=jWhdicBHS}XO|r*r+4ZM@u4C){?_Rr)7YU0e_cE7{j`HfIY<>N9=;7H~ zaz&0)m*0WS@}&s)>H%LBH3t0EqCPTWF4>*b_qnH^NbLYNZLG+jw*`V2f!YC1Oa!2I zNMViF-s$8sr*oerogfL4v`3 z&%o3TD4OwQmvVC!x-%C8-C3Pp_})s?;FE&%kH5YW3Ug6dXmlhy4$nKj7UP{YSb9)$ z7s8_!sT%H0L3S{>r}GcRxhJ75ZEa;4&k${Y7t{>4`0>&e-z6G$!TTUx--0Pr3fg3? zDZbj?b4Ox{^p2sNJKIp_NncuU6QfrU40hkC)eQOaSySR*MtB*de8cnSDjDQZ&T+xW_0|kX(u@^*gD-LOzUhVFi zVZiWGijh@Eu7?D)j5`YGq}mxS2+X%i$78I>*}E- z7kI7!$?lCQHZr-o`U*l>U!M~dXZuwL#muGXnQhEcV5^d)+F@64DHZhaEP-d&uQ~XU z8yHED7T%k(9HeigDe!3BAc0Cud6V>8gz1Uvd0q< z;${O`jm!&=IU;x?tZkg$0TWadT~z(x!2_tEa2!H;k0KF24(<6@QQ9wqNDQa$YkCd5 z-uAgF$7-PKb~e%r;X36+bQgM|Cn&7fVYNK&!{EKJ?)jWvLf<*`$DUGcb0x!kbx8a+ zc20t$_6!Y&J5?=T>*nanuvK~Xq>&$;*@sZrJ%((naKB6jR3rXc6A&JFGWVkDXkPDBXV0wjCnCoaD5YxI< z)zvL6E!5T3waIecMGjeC)dp^JdW^~VIqR+mRU@atp$?Q6DjL4R8ZJ!kwWbDBqSk|6 z6-kvkY5fmDXY)QN+$s2;bD`CmK*sJG5`< zLk3x%pv932evrd;kFV@0rg?!@HzXzUEUB#@LDp)OF|D?ifts2+-HT=@-xXCptaEhr z*hW0sIyeWcR)JQL z2_eS6Q+1yc3g8AluGzHeGBYVqAW~>O;q{4yKE&!(i7e|n6#Ck2OWW8ff$CvQDZrfz zOi|(5G})<#>8ZuV{24N8KoH&4c_LH|Vjb`aZhl(8m*?xdeC0~dVw?=_IU9(+9XKZ_ zKG!WIVthz2x&BabrWNOL5%0)URA@5= z`1xDjO~caD+OH>Rj~X(+8vBSP3<|~R0@w0RXWoBwI<)r*dr_yUkRZb2CQNL~@lRo;?>C6#6GC3R;@?Y~V3>hX*KU4Saz8_5TEm0(T)VKfh1c>3mS5yj6%0 zD6b((-LK1eshdOTbl41J))dHMFZubG$`~pnywz0XNjNCk(e?m#+-0l&{6^v_9Wr-B z9Z-phj;J7y8b8>elFVge#4q?%68s>f)O2?;ZH?yxY*3vUS;>kOpsJ>L3j?BR6&O#X} zTd(JYJ0w64Z+zH_ek_TKjlJwvGU2JJqT)xiO9B2hY?qNf@OSy{&nh!#t@j6KJFo7q z&8@PO8N4i{(q}aAUPy2`#aC|jnHVpx>&R5G73BQ z_Hs)xcPuyzFjvY(-Pyq5M8e8O_fMa5Oia8?ZRQ}w+CsPPFZJ}%qeqIRYQY_Jdm+|n{(_ieTEdM363@`x%A&C z74-Z8Vf;pn;=P;qeTBg@(a#DZ8;}GP7(H(TNxy@j!VtGa)#K|7g>2y90>d(0a=x`l z`Q{(WH*b(~AT9#!ud!dHLM{rjQf2QB*RJoQoOGtfx`q zFvh^>gy4~mKbs5-PXeX1c~6psy%cqqH>N#{n#-Rj{kt6)z*Yoj?E|aid4+EJgxA@z zGLegCx--{Ky}k=SiPRwJO#AYd3cI^5KP6t2=CB?9fhak`QHwaV+CH@>wDlCR`~%-S zTHlOCG7V>;%3{{OF80z3Ey1~^TwU+Il8-A{rSyGc*h5{9Qm7UU|-1RJdx$u9tkn- z~ytGPQKp z!rr+&#Y@`940@zgF=6j_^o8aZRF6m^vEaF)F!bL@5pyPwI!mEBy!oKpXa=%?D81RfM_hL5g z9qRQfnH4Y1&)D>YKqr{6Ey@axuy?%ow!=pqz^|@dmt38*iJ2>2W-06e3BqT$i#b+) zxrt8VkB3`q-&gzlm-pKrBbGZJb_WZwe*vtnIg(ZB2%=4cT^6grrr1xD;THVgs1B^V z(rHNZfVc+%PmeI&BZe2g5J1whRA>WaPPR!Do;&#(j*T7PN&fgNmK;w9yHPDs&Ac>= zaBAzaA&0*IpgQnfNay=>A&qg}i`#Mtq7eOe0U;r)HWz?zXs?_m^RpN3-Enbp0vL`K zxg5amp1MdQ{=$gp!-X9D4O^WBkgYIZfYRc)XT_A zSlraqBE%|4<0WX5BdNccJ&Y477dX!(tew2&B^(80 zgHMYJ+3Zql$oA`nElWvc*Mj;Q-)`;7#PSI52Eu#dRFu+=_)IKN5r;jNYh1T~ zyfs@2Ot@c8pjhr~ix2Qe)_(8n7_)4QC%0`-z5y7BBXQw`$ZWU;Kuz^ z9*~hKHvC`lqAqv;RYs=Rvx!?XmE^zgo1cpN--Qo<|BIAJ_w!w^xc`Th%MK_(a2)?H zdkZ89sIZ9YF}*N$4YVb{KNI$_{}&9LveySrT!Mkt_!5%%|KO~SjAae%4xKpok1H&u%#&M+iT|; zUxRlIKG{u{FqmD9e+24|(jY&6=Sq_wm4v^mSmN5&m>(4rn4{5$7~^6E?w2u_KH3*N z2a3m)T_FJ{wGQtB54>GAqg&>ADH^SGFamgV(I8TczSCp1e#to%jkZ%fG74ezUo{+e z6k!B_4Jd_RJ*GgT_uJ8GKd3gij9C`|8-0C!UGrdyA~46>d-g`DnA-)(?OwW~?+fGm z8e8^c)n;8p&eKeyhi%`HQ3R3ewEB(V2KdQpDK2mA2DM#MCjXcXd}%nz&~`Qvn=F@? zJKZGC90xQAXRhN8;3H%JDz>cW0_xy6k&pL8by|ZhJV0`_mgLG4_Y|1#)f_G_Uw z3Y0HYDV#fti+~{l@O7sOWS*f}0otOWu=gh%e5~Md#7tm|5A576Wct!v#dvtG5s&qN zGo11h1-K@54$d!=b~<2GwX4q4k(Hed>fR5)a2gOF#xsC08g_Wr=-WxtR>8I42|*`O z>2LL5*dgm`D__Ol&Y5>{UU*5N$Z)S#WXZ>SHkPSVl z_#Qm#oB!If&!9@W=l%eb_oKr1OKrsHqlRKMYsXC#3=B}Z=otAX?uWM()jzF2&i{** zoa1K8c?7ri=yt?iFE4RGmlVow#p-QTy*Hj~ocWP$O4H$_VSXC7Nlik8f@98*`^+<2 z!Bu`4&RE|#O=yt*5pxpLWW;kPq2pM==?yV@CB>!|IE?`V6e%Un&mZpaT+ty1GDm2L z?(OXr`*kg)=q`L1G;n(A8W?bqz5&pK*acq#RT=Q>jZZ4OtO~ZAaQs}|dc2>I4}?K*FzoP#r{VB1ek0IsORgRK)AyHfuTWArTZtyGLw~$L$^H8+$CVh0Tf{Ae~Uwg zO{D(Std%q1t!fm{IjRANEtmthww81aiv|FlvT;8LRaJ}kq#s&uz>Q3;Tc*6bLrWdh zsQmOPcnwCZT}JFwZd>3(8551KpD8)!Vm(|-q?`$a|y7=+%>z1 zjXQHT2Gj_J1qOTkq&Dp31n6`*SU)Icm^w!cn8vA?_T`&*&Yv?z9MhveIjNtWQ_HW7 z54nrAhG>w4!RT*lgl{R&Jade(0{wreT?5prTME6U4{tDK&|ot-%eqW^39D>IHCi4>bXV%v3_TI$BrA!fjnsFu!zFw&#w4w;tL!Wuz%F0Uh8Z9&{GlhQI z6TfXjZ|O_@N&kT?KoWHSgwRK@{sK*i_w?d{L?4MJ z9u-q?O?`AG$JYnw|Lj#jtxmsHf31|HYJ`*T^Zl&%aK4Ar9UOsaMw(x@+m@w*%3kKg zpYW*K+8$Tr_bv&6+Z#MkOdn*RuIJ=x0%i7SZOEAx4CK2(;k z7VK_D5K(-}_cg&j4{Oui_SWu&k*qN6&7V5j&(-*INF$}f{n)n$2mbX1WhC-s)lr-h z2AE|_<}YI2W2bh+ppYlXbY!~9&LE%@U3FnspOEUA2fM7N_edJ?x^R*Edv$y41NQlU zL94!*Ye=VnNhtGOIqp`Y-|Zd)t3{tM1X|)UOgwp*n39}PO4;JH8R&^We)Qz+2qxS1 zl+z}SQd%`1wTpXudcwDoRK*R?Hq>WaQkG>pE1a|l^6`IR@*q4wEbkIo(}%<&I;pMr z3oR%3;(yoU!P!JvMJ1Is`t+$&*UlW*#6S(jDssU5YTzO#&luETiRa-vS9tm4k5adn za=a+KPZ`)KLc{z-W*186=M6QuOqb!K?p%o!Vt>ll-5{M&9 zm-^&u%H|^w)?P~0@nbzOk$8}Egl3n&5QRMLV+hR>OKPH;If$5FB3sEYGBjkIX$XLh z5h%~<)*3BdYx*%Sa$&jCgtt&8Uirxrk~mxwTM4^=($eMf4fMjQMYbhHA|404l604E`R=b$BFGn-+?(9%!|6v6` z;2nU2?FhkGOe}eOkIcQB%Zb$Ur_=CJUUMDqsY3Xoy~iD$olFOebW68A_kISuaNpS! z)c4-Ms(>tuO}?t@LpY2urTKv?!}BdRt6@3AVuys)sEDD7-v+#(BDKYfs zBcB~ps1=bYU59qdUkF}k`>?i_@6gdz7Y7Gm==V^VRtL$5?3^49JZVzW;wKnBT0?s1 zVuw~wlfW!#o$GKL-nKB$iaPEa(npIatIl+Hcc-@cpF;z*uRunqt3v=~WV*mz`1v(# zrY#+T^jyyJYb|FKMq%RyI2V6PA6)>i5!lc>%$NuJ%mx?AI0PJIea>e<)T)m86G$?o z1zhTWC9<`(b#rV)&0vQ@uHN$>)P-JM&{(=)uTqxv)Tgtf7#J@LPB~6BIOq-lJsrCD zB~P<@s1E}i)-FMooJj_m3LL*#k^ki9znEl1YV8M`oUkO31`F> z84O7zMsP&F*IckF)D+_kM2Wfj@Z(1>x`#a|(vD?fydx-xyz?m`I=V&FZhyC@nW;+J z$1qQ_ydV|@sU?)?9Hyt9-!YLbz2kdvKnC=E*TtbM3nPj_mU2QeH8lgAn-BuQUBQFN zTvSaRg?1ge$tHulONztE;X@~AWVgfYX zt(hDWA7~JUz#v@D_GCy~k}3`t>A>_YbF#(y76(To%$#Ycs6J-94)2OZglAIZXVjj^ zJew2Swgw}}1(^v#YE){USaZQjg2m3dT_y%o1yz^+C_-EUR9%JwVwt&`Zf1i{Ga$zo zddnO@p!R{5R!lA)wH)2Ny!8dZzjN=$9eP4`p@>Dcj}7);y3EZPz{}9n(=+z7YPl(|Y*hQ}I$$nvIN0t* zdkbL2yR-35SA_Bp80klh!a_*KuFG*X(Am+N*>(Q$fq7;Evf?)9EN)`wMFbnEYCDmy zGzLoXu&=t$p)iqS^15w0$8((X$SlB60(?rxDqRV3M~|H~VP|9Gvz9}xJZrFIyhZlb z@>C6MtSMwZ(21$icGp1to{1V!Q#;8Hvjse(icwr&nkLx`2bPs`z=oh+M$}C1F-&M% zo$XJEjbOKxK(0#|+J7RVpj6wv2bm;@g7z-+;;~$j7w2x^w}7ezM=)ag7-<8%xx(;w zH$$(VZt9V{cYokg!71(D3;~fAZjns3&7?Q}<`TbL#a54AxVT6Qy-*zjpXOtxf%5@5l?`^r z>=(nP1RD1Fp!#ARYk!JptV{aBhr-Z)MCX`Z#?yJjd`MJ`fx)O*<;($v5i-R0QX4wZ zFrt7`QJz#h)Zx08?I6*aKI(ToGmtJnXDHhJSQ1dVy5}Yz*-*d*`D8C>U;~`eBd1A| zDlGCuF7|{NoDcW|i2*j_a|W?)}Qr=rGOJ)WcsYEqmze;^!#2GjwZN2hhqz2c4Tq15LaM+_{EW&deyFGc4m zC{m}s%XE5st)_Xl28sO&Ss-n>x~ghRy&DfX5@so6T#bvRx=Ki2r2?_y5(K_zOZ5GeZ9x`Pc5>-u3m+gQc}p<+32i^ zYtq9RcO|JpAJK+1|FEx^+?QYN-4IyNNY=>C0>V@}eK`)vmifNyan0k_Y%Zwt2s<_R z=EOpyAf?al^m!+FqAB2iEoMAh>DYsyY~MBx`pn(`QO$^X#|S=MjF*GkY(RdgW7kQv zAND8vQYEK^Q2-+{b8^CVL3xF}C_i|U^c7|lQ*NZxxx8fzwM;&SR12`gAu3TxuHy%c zc5ls|f2s;qL*fCu7X0%j1=BabENo2cmSm!oU@lJaghtCIpvwb4{<+JEBQhPXNP2rd zUalAqWJ6{NP21}3OE*wezubN)^t`u_;>E!D+LTp@Z9y`muhwp>HxYF;^M1&pTaO(! zPRh6&gbIDCwqDsWM~km5_!j@&LDiqY$i%w_T|=K);xVdzB6olnyovy) zdoTimRSj-{OkhJtAA*ge$|e;AM&I*0@qAz5bPQjZkHe0MOd7d#q=~%3(x+!D$XSLg z_&`c|{lOXX`nzDoGaRlWeo0VAc17FDDu?`=a zx)}U(7KAQQT3Y7ktbMJ0P-}}L+pL>gl9deZV${;pfK-u~$`&h2R>679$}gxB;+cMF zGA7?Zy$j?1C<7$yU|H?y_D%`XwLf4w8y*>HDdACawP=a&5@j29xN)n+l1|009V!x2 z#RRA9(iumQsY>3V(jHS{8zB3G0_(Mv!l%IN9(XA)G;MVU|xIeZsPRc&gKFd z14rklUnA(k4FJEn9TD5l{HH(i%UY*oNHCpH$KW3AI!lV1O}^hK{~ADQib=5@^c2F} zxsuQB0>1o}+QIK@3`Xl#g4d<>L@o6b_hcw~w`vc)Jogt2nzt}p;?Re86<}=QF}8~q z5@eVz>~hg(5-i|c{!+@91nTS}8Qd+h{4Nag$Mfe3MasESuXJXRk z{{Q5~iB}ar5of#J{i>Gi7iatzf}P^#``>_ShbqRJp#@l9O^*u~)+&SS?3=O5S0zYRS?*Ox_WyB$i;D7fW(3$2}mR0 zbzNSY*Sjs1^#6*(@1-YMND{h2#_ur@zOrwbBdt9MTic(TIX|1BD{jt|e19o9)~GSs zI3aY1yRvTmV*!>qN7?YJj70a70L%Sdr}=B@nI(gE7jR4wQups4b6)&@&A`gSqCQdF z1A&MWvJ<2{`V(Jku;wWz7t}t!w7A&Nksx}?KxHl?sCnWh7gtmWa9E%xngsD3<0V>Z zJCg0@V`IYs*;)EB!7Va8oalg zCJ%B}IXYt;aRU8@&F`;%2k}VYR`a70z}_-2AmD`c_fI6CW%MsN`rG&K{=o7?z^#)d7GTJiW>0F0Dx^yxTkK6-s_p~o73 z6Ij)Y14U+|o-;uk@GQyT4ckDZu@xSvJ>0D|hFjk5$&iR}Nj$XQRx+paq!?Wd`ZX08 zWR{)7$5MRoq2lM~SHR7B)9E?Q2UNnizd7u&&&HEl=j-O>=ixCyR|wL{Fh@g2CkV)c z!WH02l&y}nlZZR)Hfu{BXzGf0R{ z2{xGNJ$dpHetjnXLIphQ0^{b>!f!4vl!1;%-K6vFzJ=M@%xAu;;TAulZ$@dl%$MGQ zgb5ly?1za;dcvamgD~ho9Nb(Q5=t|E1Lv^{A3lON9njuly=37*{j6T=5I(W4)ZZ+5 zK=cRJR#cfK3~#P4!?t^0(`{gfuS-CLLio!2>Y;8&V*N4vt;9W6{1|efFYo>_-C(kh zb(2ZfFtmL1#p*?tsszfo0cGnX;tj$(igaro+zON7aRVPqPw~wMi7Mm6gZ=LX#^laR zgN?omVmt|9R5CIS&+r&8;$)hdfLmPrUO-xJ$jv$dKd=*^{Fx~|1y(Rg@C3=Id-s!x zXLJ2HoH1PAz7kXih^hXHoSU04jQ_hDkFB;HFo*p@I;vsdCBTZXkv;V(2Q*W2PJANs zleQi#Ci)^@qNi^Hz1H(P`WutJme4Z*Ycev#u6jk5C|UiKVm)xK9noz45C;lhyk zfqqcv`JQtx2X-8d^iA9;V20d&e^rzS3W8_NxQn$nOGeEa~UNbu%NE%`?E`u1d-2HaRyc7gTT8TP_3>A2_<&49DGy4 z|9N=W^Omc}#OiRri1o!f&V>WNB}9|Jx_eRd7kT_1-!EKn)EMf`=w}M_-Z2Kuy4c>T zB%Z`Kp3qgX#b*Se#6AWB$s})w z^H&I@sVON&(quI7^qS(WOF;3T1c)xN?_y~TJb75J2T#Lsr0Q!|7tcbB5>)L#wH3Oe zTACr06u$GGXRbdsL4>^&+_y_mV^D(&0eQ6!LcU3odp0N# z@sspr6>|YIR*Q)&TC6Jxl@SUt>r2u;e1`pzg*6533BX>I%Un0Kl=`g{(J>`S(qhVno?eRHWe5C8# z<+kd@b~x>Lr`YD#`krsAVcFTU+=pE>QJ;0Z&mL^dimsN}C>_!hLv1P-=ly$AjSzXQ z)ccMpoFY;LSRlfMs-!C5JOi62-uUtIAda$-yN-V_;u&%Dn?^1LZua!QJAF>bW>8f* zvIC+GQlC&Cg<)XwxP^lKp@k$xQ_@J^h<-jvEf)=*Kd=Fii@N*_$6gF+CfcX|U0e`x zRVV*$>C@<5M1x4Lh{~(9C1{4E zpbf@pHh*kU?-bhC7$RWS# zdjuhUx@@CzAwNud$dKFIm0BMHB$R#Ri>ha=c7lnn+5n_P>Dr%=SPcz9Ac+4S`yj_z z&m5)u3aVxnI3HKnJ2MTfU{VF>lRzyNW>(?)AC;$}9sj|D0*4tz+>8rk8nJ!XS(lu} zdMEybIR#*uqBlctK_8?5PjqzH4CpRj=B>8B$B}U3;GLqk|5G8O*vQDpS4!ugzXe@X zq+%PSQ)Y`3zLpf(d)6oALeRqt-AefSpas;+G;x?l(okW-}ZpqUtY(B132-t$V2YUM>Kuoe?R_u!C4!wS~EBOPwr$*R7 z9@1P$HSyrEgsr2wRg!MYc*=AJ+rGl3q5BShI44f)SZlq)B;47l?{HRK-x)*M6jso$ z?{P{=eB*+?$5M%w)nC~*snI7JCqpJn(?H7eMSQEUstZR=A@!-IRVrv7RI?+yKKLys zFYi9|{Ya-hZ3x!td6|3ZW{#80eI3Zq3`XVI1>_#+(If1o2EbdXRcslwiKnE9;eKhT z4C}`<=6Gi0rsgfnfWUW~38F4Wj*k4Smx zb;=a=Pv?zNw)vL_M2g%bW05p?!sZPzw;Uq40Eu&ncaFrvB>ndsym>ORm4ujK2pX}S z!;51DV2_>euriQ?%IMmJdtvI&asQNRTQtu1MCqKr6Y(RDM2pQ*$N0^gG51AXwr(x6 znJZfD&(kr})QE(7!u3t8K6y?O<_?L~g^x6~BWr4p9-WBf)C)|Li!uUo2*MZmNZ6T^974vj#0G%Lpcl; zQd>9qsLV443y>XH)5J8VYl* z2(FEWfcP%{M)T^wh%XGKg<%BB3U#Qczr=Yu;2_)_bZhxwZn5t3YF*v z9xy5$CFwC$<|0-1J8DTr08}4h1Aj;_X(O>P`ET%lfY2?8PP}o)^;gm~iy1i;J^x;= z%n(7|W4|;F*^#+G5#8R?>9Qkvw#yUb68USZ2=+{tJLCvqX_>M0VAecE$0K38Pm9LF zE?-h7s;4c61wVe@9{J(JxgDL9Qpt#(Yp2Tx8iWq`=c>eJ>XU@@C%mAXFRqJN@=RS!*XV*?1@(T z-K?~ytEO=|Jvmevs~Eny!$OzZdYgo;m&-l}WzLpa1*!f=mgWW3Z#bH~W$H?a?Q{C% zY{@P4D!VI~#(qHVau{XPlQ#v%gp;j#6ty?4Mo#to(5;FV(Xy`OuXx5`J$*Ze_uAu+ z=ea&?P>@%hX|=MV37=H>9?f|5zVjrD;?<$8V{2mW9reQGjQ0aCtnas*Tc08Cbo&)A z>6(al>sa2KWR(mhPP5fkCGWx?g(&#JRFJ{mcx=b0lf$n#$p|W&8ug6ZI~xm8cN5EO zG1~e*Ya;?W%YAg{$fe~PS+vIf^^CHz5YNf$t7SgBWf1c{O>lkEUqNMp|K#&n3)*4& zpT*~<^BfiVN=N#t%F8u{jw`2UWGuXD)gPv3Ogr+bL>srV&v3Zid}DI!F_#qX9iU^e0O0ZMs&Gah1i$cTzr)!B1g$2YXk}o>j^ZY7f zpg+B9%&mv*j5U{|qtVONYl>RBy6f>J=IEI$m5lNYS}C~-Ag@min4x;naFO}#-BqZ` zVWAv}IlkR+UTJpi(+>9o(KX$D__5BaYEF+0lN`wdbQP-Ss$7O*f~CkWtNdL^>lKdS z7JKZ<2?`)hOJG7jX72N^6m7{3vLua|mov#)s`)0%Zq_&BUIF~0hUKjw{Bo3%*Src7 z(`uHI*JBW@A9kBbpouVQ@_spz6|xV)f?A~k^D2oVPLJt57J0A|NX0kcWaGukU3}}({vgW_Mwg}l3W-Vd4WvL8r8?$b-yw%y>erNM6&Z%Mm1oDi;Cxj_NS0CRUe-Ux5K3cjj8etYy$CfD^a^kc0L~W(xo8vt@ZrrfC_77@X?hx-0Ac< z@Bj(NDF@Wc z8Dcs_yub9$&So3s8wKgbZe*lb>(?5XKO&o2o9C!ZilD29)9%Iy7n9tK8@0(D=f&u$Pp z*_D?pKx;G9gjZ`TQA9FMwT;t*78)9>Km+7`oSHrYgHXPxacL!8KYRrj7l zHk7~QK2}HK2J67Y+B)~==P&zPcrHj!!bdYy8EAgO2&A(<^Vcn>ds?IJ#qMft~J*dVAoWfy>Cv z!>z3YEy=poesryN;=wi=JumXf^Joo8-RsNiF@Dv=o7eYTx$kzki?@q0b-#6FG;qjW z?e+zSx}mPFWV{CH_qPn*<&hjauoOVwWCve(?d-GM7S!aV*>yJZr zwR(x}^S7{@0-~c^qaNtJ4THlH{kLAoVIUq}14>RW-}Bej9P7Wi06hoef;xj%va!O( z%DD9^IGk}vTb$jR_-ygK5+)pWF^RYqBDI1nWm7Fxs4od^QU7n4J`LlfUkIkX1<=SC4}ii;arm;>+^Zu$u>Dy zd;JBld)eomGVXrg+S0Zgf~Q1eiBIrJP0$FQ&x5utXNd2^U%6y6ji>h*=`IZUJ{8so zHnuBNhvloO^k&}(IfM}pwIVG(*KoG6q#%oH0vqr?CUx=gschLO=+7`WH;03$AtdBF zZiS>Z)KIw4XuBpBLcSGrCOhr=uEA9mX69A)ntD9DYHj7n%9@x->B0BIBP#@6LcyDRM_{ zr>lZNq>6J=&E{~rh@J@xauWYbJ}`6gnIam&m9iawE|H~fyI^;A(-l}2zP1&;JuCav0S2Hs zr7l1AkWxKK+N_rbC;JR4wbBCXA;d<8k50^2};ZS?`+x%B) z4i3wKjFo|mqCo!APdzsNxFE{(T!@W>*Kwk#11wXq0uj>!+6}S?Y;-k*WPHcd0xg#s zJ(#83m2{k{O=(#o-S{cYk?{AOv-|iKo4GX)i2Z8j?yKK_`=o+`!tAe+r#QRik9Ouq zXhk{bQO*qWdbb(4q~x#xjgry}Kc!l=y|B((O0gB>C zpDX%Ir_w`ayc@#AI5;>2MtxL~nMf#PoA@AW5!3~!IB0s>7wPKjw}&kZOCoNC+4c1y z7aZNl(_y(ByycrXtc|8#{i6fl!zCNf$<1T#l*|c-ay^!aoAf)jslhvY5`bi1M>AKm?tedseU8e#gdej*XqwID^}kzh4Dp~$FKWU!$=o2& z)%)tVt^c8)D{jw2OzpUA*o71jyg1&t zaTesb#CjJV=Kixza1qiobg0v?w;u|K>`nMu@3?`ssn5a!}zz zRe5!xcg+4EE6ueSGwN3?tIc!RdX4Pd)O4T`8yLO(*0b;uXy#|*OF}Pb&Y=jciP&Yw zpdW9!i4G!g-|bP*tlU9fkf?79f(2kOL4=uDE)myuxz@TV&;Ll=m8}oo z?|#}M=;da(7;5|1$L|+-y-I@%dJ90LS|b{P_7C;g)azmbl9^;tVb0t7AkPIi6TW=j zn_%0IN=n+r2ldZWzv``};vGP>hZWtwzpLVIuWIY0MqF4eEFVy>wd4=yU|DoT{QDpC z;P})+3@ICl_Ad5_yBx`_FTm2uy?P)HxbhZpYMw)sl7(eYxt3F7R*hR9a=Ex~k)S5Ehx$%zSbV)LdJNe(%< z>f53othz&a#ET9ms64j=@U_Q9X$84)p_+Dq`p5T02Mh9_GA$8+Xn76YT+;11jK@E5 zRGnJ}fi_c{gMXPmHMJW{DdA*+ydx(kXR6(O?^k2v&!<7VxoRsFe^{7@b_O$`$)e)7 zKLIzJuE|P3$b*}l8o_|zE4dEPCT3>(-qL|%W+S6WWCCf-pN-6=8E=u#yGQYV;%4xsLU zPmazlRC^l+3#A)W8>&IUq!y)3cqk$2H z6!z0@&k1ZsDD&K+z-m+F%vw-qmgu1Ri*)m6$mi~tMJ)9?r>^{{!pP>FE#-p!rFk2) zh#SsVP>+VQ3fw{$xll3Zd^Hz@$WZ=xjMAj(E8;X@i>KlTPCKaE!Hx>n#pVwD*4@uq)hB?f~1udNuL(-jaR+xge&8l2(lkqj(K6rb(akV|rK7 zgGZo%Xed`F`vt67um)Fz%CX1s?vy-t<1h#islH>bCBdpy55v~3XP8m-b#-B?mA!PV zt|hKA0#d z&j6|ZOD*5M`o+bd$*HNX5~xvhJ<$uE%*)FS&OuU9QQgvmZEaVe>(x%$8zYBDk9u6H z>IR4~2D|S&BQYv;|7a)}e*|kn%b8#}*`bfQO;{IR%z|lwQT~MT;3M$Wo8SBbW`nP< zue^$iq@;eTxi<>Nw%sQ0`ba61?p3MyE_dsrd*>q+E_`?q{!w?$L^e@k_v2O&D2`m< zmcF(kAF`&Hh`Rz!1ljY@Rf#J8qK=(qEsKNJAQB=kj=>=S(zgu&Y5$A9OOsG_0)!2m zv5{<|igAIMb+G5^tjMvnrP^h-R;@{FghO=bq}ceVoZYH`>S}X<>gscuSw?zE8*oRX zB8#Lb%;*FsNrY^5_4sV$9AkBA#maG^k0y+hTYaiB@7yqTBVh$bpg56ow^2C4zFv4` z!gSGcv2b~4L_KU$EO8@)chohO_AdJZgg2&{rszph(8E9fbhvxB-dAs**OWb8O`H$Bo8n9j2O z6NxxS2nC>=L#ARLTDQoY)%4d{fGY^QDvqT%_h=AzQdFWkDb2c`KJnrzw$g zpjb>!1?r_>zXIPaiTJCNZ|@~<&238A|43R|dV+8<>sq5;uS_2-flKUuJ3^|H%4qJ$Lqc{!7u9 zO5LIXkn+Q_r|HqdVU^8iNP3^Y8WS4_o3!Bm{pG^9ruqU)e1>BQPyjvL>A`;aI`#r{ z1+Xw?$j6&sy#GwKVh4$k#F;JkHT>_BSQ|^#Ks)^;Hg<|Qwgwq~nci4buai;Csra(p zpn6?ehDMUYk!~R3wm9KD_mLA10%^# zg>~>02lg-;^yRQONu=o$nQ?d`R6c>#hs_#ga%LA)O+D6rfExPY_rA&u7m3B1kPnHM zuLKYLB-2JIe#=taEEbJA79lY^rONjlO}+khK~~0WflQjU(_dRYr|MI+tj}h~Qtf^{ z3Dm%s+i9|K+x-W9(ySwT)o0Hq4v={xey!-7UF5FDNd{mqt~u+~E(*F2nXA1-Hc17ALqG3YLkI}XMcZM^fpTb_ z#j(tCESBP39S9A4z==>N^B43ZIlk=#XeDt=ocHfR`Vt(TV=iqum9N$e+V)`kEVXu! z?m^&G>^xhE!O)mW3deOn3=ULlU2bn8gJv`z@;b@wmnrTYArcenH0G!IODFjnvNC_RUXC z_e6*i_s3W^RqVGP2;H7LqLwZ!x0MvZXw}=)T<|^j>e=4t3jj!34XZY<4$?ig=0=MHgtxP0TTMf%nt!{zYO6b{ z%0A-qXh?B=`>!=u2ijC>!BoQ{E^zeoPgPuSO3?K8)!2^Nu6GuT-&CJdEVJrtW}plE z<{E=_{S~kRl7&A@CSX-FX9<%Ml(W!kt7-a!IjX3g9BE-&3)Lw_NAw{gS0=qKJ z%EL6*iZ0Z9X|op0d>&yKeC;1T{3BbYV>Y3?*aJofO?KaaC&{cKc290VDdSR%(XOOv zb}muVajXMeFoLCD?kgu)EAeI%y3Sl^^iL8yE8(?IIoi%);nf6F^JD8D7QB1CD zW)K6P+(kAV@RMt4_Jw2uc@qBD%B!!iHKwbknWY5pdQJ3Bd)M{r*Zt!T4jCPnk(E^&n{J_w18xm!;-{_mIl1@Ch9GDF zm}k5(JlYC5m}%}tU#&Ps=SsA2m_2x9`eJ1=);^(^=owgMbwjZJXqf9R>!xpmXliSd zmFcdUa5M6+s6vYqP5eV(r&}J#AS-RZ8x0x5J*8Z=S%~@|pdYsX0^tH|B(yW)kcUAr zjGHoT>3|-;88NzyTIx2KNt^=f4Q! z6`OkSio&+^%)IJ`{tY>e8hZNfHL1+xTHaoo(?H~22q!UFX8J@3-$6710nYpr6{V1N zne3Rji|k4pCkqYV@B<};f7kF_0qe2n((+h;AeqXxP6bibjblE!L*dt*`WZ@}X4Wy3IV zdo8zWjiuUt{O}qMy5r?#2>mLo2^h#h#ByPWl#2hWN#Wy;BhbIGMZV{}P%k5($};}( zV?!F{E~5UGC3(T{B) zOL63TMu*V5q7DedytVo;cEA9LeJ*qu2I{!OPA-)59%8-n(o*{YPyBX1NGxVNE=vPE zg(z0?dtH1$(1_D?ZwgS~XF^H|n|G;lQDyYIzj;{u8X6;uKh<2yL+-1d4CTw0gRoyU zAw1sFLb$0w!3KAW8&Uv;mDoZZbblX-ZVyI|pMq6%V ziob~GP-t3%C%?;=_CEQqGUxO?Icgk+oT3KjJd$B;?rd};2zd~CCl!;xP1s*G>Z!2m z_n_^0W|BRr*@Jj#z4&uyuZh?*GhcymPyE#jgk)1@k+D>4mlKQxd6Q~)v?zca>RPvb|e{YbfVCNy=8 zUCd5#^1CW}+GubxR#J7_eJ*ov} zZM9#_Px_|bB=li&9w>%w6*nbjo1Yqc{rPr*Qe&;5@i_|?VqcQDPN$jt2yVfS>F$ao*)(aI%Q+Tf_yzZG0VYxg|(w-i-;pypN%9`Cc(}$AA z76_`mktys-ms)I=B-=2qa@O>ry@J^YRlAHRVQu(jpmN!lwfm* zqkGGjv8pw*$pcBcM`Sh>z;K4lvKpUmbZk#MwHy-7;a9sXww=hg_(PxRi+-4Vuuv1- z_f4_el)9{lL%29_w9^3?2I>iZ-fi%>sIQrU+0-(cV8heC&t+ixQC!BU$APvf~}Y#uBVNEaog4&Kv?5&FwZ#WS*Qi{Z^L4d~2r!hnJ%Qcf%E#q&@ zm4lFyM6>vj0p+9GN4{|H_G z=g$4Vf{Xt?+eF)Z9rnIaKavR0P-oC4Sy!} zzXbfsD=A6X{dy-bs$;kG0=U-VHnsI3(d>8>oZnzodh`e){5IhH80dTLWQ|7-L3%S z2gx?FZ_r=D->NM2AmWB#oWDe;>S^uMO_6WwsQ3U6CoNL|Lcu75pI8zvkbt(h=B+7?$1I?@4<){pzhHT-x0HA>b9KCfe35nuDa$8f`8>a}Stzt?I7 z&Pp3_2IartoWRzgDo!B!Bjl}@!H`>`c;LlFrb7PxRMk^fj{(Akd;R_AsR}pcyiiTK zk2in5=00VvA+_s!z;aRF&ssiXv(|cCojG8?7y`K>Y)TOecvhL5bGj?|+d%>iy*B4V3AUf06(#(Jx}_LM+zBL- z{h_3^GIl zzZZVloKofFF%DPf}i-T8Mrbf8*YRhHz*4XXF8lV;xmO1uPF;ecQq5!gqWv9{&gMeo1D<^u&iE!>2u{+A=qBK5 zK*X7#p)amfoiLySfDs*$l=NSOodzoGrrNEotzRPQiQD%j;QV3*{J_CpqE(FNAwtt= zCxkoqGK|a2D>tEm;AP@(mMj1g&$AB@W8nB8fv_>-tq6nr1JjCFZO!YFgINkhz+VuR z0iTHc16{ezp-MpdA&&?`S-^5&$x;JLVJ@ z08oc4-z>CrXH7!`Bp4UjVYK;o%Bi{)FLIDzg`*3yy#wdYb5Bp{Qald=D%1=yJb(;k(Pu^?@bUFwy5 zL0wh#7*yikNHhLx2j6qcB2yK1Fu2ggdi(e`KrrT z_Qvic;~!FqI3OwzQ1It#&W3#T12020OXSA#qUmFs4wO6=WnDQx=KVtVNVa9sRmdyB zaRAte7oCA5PJ@QN$I$J3;3Dilc5MWs&as5G!)bwzc!btW0PzfSo7 z4ndz*7-$^4*ei+BwbXQOVihD_59wdfVg{MaK$Zw-j*f*>N(g<;qvZ-jhp^a{nd5z) zpqN&jKl8izljxI`2Kj3FjwUPk`)IX4Q)}o39+`c&6z@T*ung(OzG1aWh=*1BQ)d@k}FzicMWzjPe3AMC^jv%GGJ2GikBm#G+A=8k9Q zNAV~HS4+*`pd&y5oj3AlPeH#^qJK3Q23U(Nzqv~tPDP=xpw~RACYu=TCsTBRu;r8uT=D~}|FB9=tJgdjDPLdMKf>i;sH=UMRfH0l%Or-dM zhKu)88#a#hV_GOMphdJ?xuO@P!uctApVZU*!SI5)B3m@WQSQ=a8R(hf7#eB~TOfc4 zQ$9jPM7I=Jup86uPaK7<6yWe|FsyQNa++5L%s3JB{8#+TN=v^cNB98^sdc#h&P9C) zHnhcGk$Pmt3vQ0Nny?>{G$GkTgkrK0NNaAY@055{cYr_I0Ky75F6;`yA!ucJoQiL| z@;Vp}`7^jHOwdQ-)rmb5r$Bn#=YNe;SAl}Is`Y3Y2SP+btfX5rdvGW{F(5d2(C752 z;e9iG;kGRSNB0(}^GpkD9Rd`i_arc!a;G0Zx>bDVf(VwyZTQzCDu%GC?oj?e3bH7lnO}H84%&cYc0lUJ;$=^v2ma-i_q&s;&<~6kcg{~OL6Cr zWIo2sD(~C2S=DdiS@kJlSZU4fRi z*%d+HJKo|b1YBuCryGD;5akdEfUD|gm~h`ku5z?jm1QsQDvlqz9RwBrg%MdJA67Z!_{xOWJOHbnTT}+D`oP&!!qulAeeoA z`x%w7!1+O2j$|T;7gWti-H-E(-KBO7gWSXH&$W11Ny z#aLu?qq>8tVDbUw|06Yf25PLa-GI6i_OpUZET%kAKD7-uILYEV$J`Ksf}}zE%iN4` zOKok$Xmmw|EuxP57C#8l@+tj6Lsg2&(hC5hfDD9CS%Uhcwab$yU(ZyZo(MZInuMX3 z3>$4y9o`D&34LCL_i*o__LGX(1cP8n(V7L_qkco3@TytK-^eB|YW@iCkT_r!H+UEX zN-)WrYr&;v9nz!+b1i&Hr`(o*v{KygbGt=_edzIi2*05s&k*YO>YZqy6yhj+gbkg(I#yU9bFrk+DK?*Zs$=Tf+37O} zGP$Q+PH1Xq$RM$@vNIYCY>D^Liy9{C{oUb;1tn?wht#~=L+XA*+AC+I`MlkZtGJk^ zz1}F|;Vvt#_RD@o2R=%fb&-$UJ+|QHlu_*)asYKbeBdJUn!+mVF`{n(>iv(9w#Q`E zc!9~kL)x=5$?K4|rnKzdZ6GZ9qUzcK4FNE$Ikjq`%~8Nm{5z^S{tZDjN6LSrnx#~I z-sjmABCu=3fs8Sm8-IhE_rUmWK1~9+#j+jD&lmj{u2xwV)t{J#4y7OnSzKIn*(Lk_aIo*v`(dnEzoOi*VkBd#$TXf{X=mars@ zXJU~R#@4u*EK>#huSXJ(B)lI8CP(Z^hA{|H{P&zMJq;&=!2KK^)s9t`RSoHoQ>5(p zro8Cv?fvEF*{Ygl`2L{zFPBo%V?c%ae+$tpfcmwA5pyaL6*)9Sj^>Kj^?l{Bq5@vp z#FygYItupqvsruoJKWvPd#Jp`x3=fNfaY!1_r9&B_py-a&~lAT{|35u4E5gYl3_-s zx!|H3I|j+=M{<>|JA*rh9!~jJ^w`^kflUN0V7`uaVAqz*z-;RiUMB?BQ+wUV+_S<4 z^|M{eTtQUAPB9D9)*g>BRd~D-js!rWc4BE)WB0^uJ5%z( zXCWWvSzKHkB8 zJ>5Vk%&FH6d)8xltrK_OIic%G=qN_n!YNp5`P;&k;O`~_3+M&xkB6iSqjVDs=6kUw z3(Yy^W=KGS`1l5DnOs5NZ&}HW3aEsxMWiLJEq`}Spq4fvf)R=D%Eyg0+}iK_0G~kS zS8&3xbh1O(Wc_idQykf`Un!*n(ieLU>B-;f}NqO!1b0YYnjme2lR6Vz9-I z1x!A;;c*SdF6)*$D6L|JD#9A86II!}&)foRC$`1&v}mA4ZVE1Bb6lg-iIkSxe~X{% zhPbuW!g7EEW@7rA^h+Fv$-YY|6h;ZVNoXZh8DiDD&yATf({Ykc&d!OAJh{qVq)Tao zr6|JNl_&h}z)5e^{9t@%=%LTP-RmScadu?mpH7F!I2Q1%IHE;4qyh zT_~4&oKqDm4A54C9WNC@S>dmM8RAm)U|!?>YRp*ycTVF3lyH{6EE#Mo(l9Re!aQuq z&n(_H%7Q3HEv@?Hh@zoYn>UD}gKMgyi9hrE=+y?Q*Vu1}KDP96e>e0%np6~!RWIO3 zjkXy2W{#T5)$ekvHyhFSbefCooEZlFa<7AI97-elXn{kk&uckH>+;Hx3-;n;A`^h51wv&MscMJEziF=;W{b#9X@1 zxL`BKk9W13I5h<6^v*{znJ{`ED|wVdZS@M?YEINWdJZ&X$` zn_Dc@aHeL2rxvQ``rHsbCmJ3pdR z*F?h?y88ZBOw<1QC;0kb;NJg9?D#(iOs|9L2-NH~2{|kuA7EPL;3Kj4m0QakgNK?2 zDx`V4c^+QSKD>9EO_$n64$E%Dvgh{=EewTwhCHnAi$*Ma4^+7(;t2#C0L*UWhFTBQ z+&BRz(_U`-!2#?R~ zXj@LgaAODt#nN^1Wllr0I=#sIHM{-_lSfr zPf1N=X#VJ25DJB=mF5Zuavj_k|8(t+7JLF2AON#9)7+W3o zqxlF7Igy4x+S-7Jjxg@45so?ixVRFl-soH|=d9(7pq0HY;^ML6O90FPKbTNQ!hwx> z`uO#Kg1x_sj4IG3j15f0Fv_Kvti?t96XuxEEQaqfuzu44k;2QX5+Fc}#RmQdz4D+W zo&Bgb4d^bQ+^jU6J;ZVs;sM^wH+K2RbT!dm`2m8#9GaWc5IA!8(F2>-6Rf?_A03%m zAdl1xSP74~&SWqcnCS|@T*1S=Quh98wD;`jl>v-r#`JJK(YF>XAI`>#X_0%Thp}2g zwg8tOi3nvoEzUE@m6j$pN^8y&vs;GjivJhdW&v0yKw~%j)v0LX$waBk`CLvOkz7ip z*EwIr_eqLAwe#Dh0184dJj8q{E{BmI{$1^MLl3QPFQ;e~g+!$8^-_^@v-UV^7V`Cz z%;(KtXF*GpZFqEI&KL+rct4~`h|(E!ehaXCgOs(70xH?O#Ig*@b%k@&{cgt3b%pZ- zJNV4Hd|mAalnqNj>cc$^W_Y@KdcET5!_0#@&?jl<@L6&Vfs0s=#7~MP#V5~ji zUYQzAkkZ>8_6fo#Jp?%SOtfnDui}rsfB+(p0RZr178;`H`cLql^~G;!)&kK-{NTu}f;@VXM(Zv?fN9T=SBB33v0t%;X$ixkP9C3Gu4YgmnCawI zgGS?g&UO_2XJygxAg=z8vgq&MG0t>l#_f%IN{_B5 zlkwx*dmnJ(0h$T<=eG_T!N5h-4#OS~brMz6{(gahw676>f3JqXbVk4(JbBGHaEF?E z3amB%tc3PZ>kr6=NwZYUD>+tnpxiGMD2^31lB!nlA+1E8l6 zJ&e391#J=|T61AF*ly(H_;@UF6itcHV`(TzBKZ0IC|X`=Er(ilWhIQF;5%!UUE%Mj zv}DcrVm41fRy4VVUIz9^hPrJWRw}I*7tUmt)E2WD2I+RDA@=UDCESa)XEdWWDDinu z521|5rBgbtLfi@E-neqsEImy;MR_tn+!x_6r-X+u!VjE9rP%@))}>8gWQLm zM5Z~9vcq3#x)z^rROSvEYi>DBP7&Dw0{%(Cm$u`_bIa3Mj_h!>(^Dy@;SSb`wc>UY zcIr}t1@}hgnOh*vP1x=S^Hu2t9b5~;!^st=V;!q zshPt`um#=Gyl0Egl8Pe>h6c>TMA#7^o`Z{T+Myc*75yG_3EdR5it*EQAZUU`ry``@35@9CC>baeY+L`Nb1 zOpQBJ+a4Wt?$t~uGQok813Jh7AX9)wX?@W1cI3g@a#zs0$htWI zl^k(>wP1b^&XwPOb!x#bZj_ud`iqm~SQ>(UX}gNj?Z6&`nr}vmN6p2E8O~2T=7zSH zOk$%i+mu=_zOBUoAP(=QKJ}zX6Vet@;Uxr69E#0_(abAS@n6DSFzN(p1C@yB}R2 zFEp3FdP+DzL@`==r=c-723p2a5(=OrlWq#ds;E1EC&0oIyS7Y}n>cs78RVjD#?Cvg zQ&5xGl(cWam+Q2I-o0xcQ35MA+`MASSt`@mUwQ6sGOZd*lves&!Mmf!{rgmiqr9Mo zx!L4heAq{Xw**gkfJEzTK=|+YBd@*M?!&d7)mNGska-?BQv|@IYO&6TI^KcWuom#+ z9}Lty zpHfe*_zXqIz~NfOE>Pb{U)yjLbE~6h8o(NzGyoC+LJ9kp37d40X}1Cu&PBrfMm5;s z=LyvmyxanVU?#Lr*Ko(ZdW6LlnOoAkZmjPXC+Oxj)-YoH32~|_u89~y4)2uKGV-&o zp#j%;9?1>6c&`b#!TAZZC51FrE&~4x^s=5YL*6 z;lBp0kVSR*>yVXvf1^o6C;njiP{_A6by7(pkrLWcCW;N3^H(D* zS+Fj`EoTj<7~)oOIfCp_F%jxud8y+3Bk5ojWrT0wPn zb&W_9eF~{)XCri0AfByCj>(ytSYU&a7aZX+_-bhGnK1C#sYOGW$I5AK5JkG+PK2AY z7)mbpm}{h#V{UWL~t(axQR8^YO+dRuZ z*I&sH5Z57H+We`*2V#Zn)v>~wixrA#fMJ9kuO*g^nO3jd9RjkZ7}TbHT#TH;F8Gs0!G)sz%ht+V{rxbazJoRIoTx(B-6tV#MQ-pXlSmr zOdw&)bda{x3f=ROhdSowe4rUQ)Nds~nNv&V>&5yiKBQaT;#dlGEX6Ycd;&nL48_V! zimdX4jr2a5d_C=irI!UIMY4FXB^*vvU`NCEAsonBzpZk2F4-AK~vo3Z%zdU^^8l46Hk!ZQ)e#l8WzB zmJEOrFpmifGGd9Kdt_vh0Z1Cn@{&SS8_iR8^ZN)GgRaTyp+93VRPJ$d`5TpM74N>y zfN9_}1bPSEb`;3^q0;q-eW#CKN?DPb?wIr&gwGgwjnd7zVd!(?#@myG?5SV1!w-gZ zTMUuVEb<9Z6iQ-GYQsEpmHmJNf^4dG?7g+Qd7hB*F)4|MQ(uc;k^;cwqvx1Q50>i2 z>*(cGD(h?y%SJ>+#KY*xOf*4#r}2=ieG+cab2~3rWN`&PP1CdFAt`V#p9qK9+n(Gj(_L`J7lJI%^j?O+2Z9|DbJLOw30%HY%8ZMc zrDOrxH1DLJTHjE+sF)ZeQ@5_1h3;{F&q6@oNO%b%3`9``{C}NBYEnz&fNhnf`}@xD zP09t7GuSO099yqk(LQU8=z!X{vXMHRig}yVC5frGaUMZ&@lbC-MC9DPfp3!#iSuTM z63RpsIM}|)${KlLdl@V=moT3cPo6A$Ul4Wb{lb{l9Ft&P20 zsIkz8QBtU|1ToRfA$>hP3)Y^wK&;`>9-Gwa+$;B0K-B?brjF8`S5hE44f^66S9ot5 zWFu|1S||~|HXg9i-opCA4SFGeM}nycUu8M-#CXj(qWid>@gb*zy(QzD`cYx%bFWGd zvd<&1%q7tvZ64uMpS=cvBmp7#X>n(QTJ9DLoyJRc&x=_?eg!WU$X+qv_u#2wBU!RC z6a+nZZj=0Cmd84Xlgxq$mp;|hVUPv;KoxQA+A5p)8*#CZ>cJn457*BAvMV3^vC{*< zS&&_wR=)>KjV~Tos1`oQ)*2uQ*6WYUFQ%ZOJT`>@Z44U%pBYqwT?r{?QAYOWiXz6P;?ateP2!TE~7jU2G-&#b4;2Yl~)>p6Dt z=2ZOv&5>}U-%VqvDXTRKbpqY~k0IU(8;g_%dPE|r#K=wYre& z*uch;&x`07TmEsuM%&PR-y`J2RzQt6$nodP5oo5zp^fF_zA$tq+i`P)ep9@QxWbx>ieJr@9Cw9tXc5p0qNZA z@&Y_*&3dX?=RwJK?>5Rr5(A<_qdLj+Sqj;=O2Q0dMV^WOg=}lE3W=w+ZG(dJTY5N2 zBpSQoABz_}0W~jRuqeGafY-M?y4MGP?M}cwh*~w&<3M~4@bhbm)nw+0bpRH`TrxD@ zQZecmlT`;RInySsDUfaS&Ut6`C8BJ<2qg*>RYvTZ=d5M%OXblCv60^sFPXIHl4 zwXq<`zK^Hh&*M`43#CO2*W8sa_6Oj=I%VcPoMmvm;Lox7rVU*sir@VUgW}z}T)_*~ z0T?buiqsD$**(y=oDTJ!+0ZFP=_nuEjqwVnSzb;vwRqO~;kP%)n;kV%%{xW|Zer^{ zg?>(3Ob`C_Xyp%6UTkIJtIiQfF}0o&nwRx{v9lwRSPef*wAx z%5319(@%zI2Iq-~4RBoKp3vF)|(f{;Ia|g!M7OPZZLigj-Xfj9==M^-oN?DH@HuGVfksP(sEq7XAvlgzA1@84s)| zR6%%au*@tCBr*u~tPA+Phv1xnx|Jm~Y?s|16P#lRwG2DuX7ZysoN56VNf_sGQ_MBU zNPyV`S%}_>5U}pR+1SknlN(2fNWfmsK&hfqSDZDvt+Yo=78V^`Rt3~nz-xS(TtIAu zKTc{awHK6d;sWDCzwTia2TE`>cht*?xq7_)ZqgaSTe7@2S9Hg1MnirlrnL*dm;ZFk z#Vq-gCtp#n^BNn&#{Xe_4kSnh!{a8B*LHp~zPgcF>H9IgpxGMx$egRn#Wc6^R<7t? zhXC;ohQnH6au_u1kb`^`Nyv0vONcNJlzMaNy6PKH_Vc!1Tl|_pD-#eg z&Kn{1`4&ZEENGpz6oR6BDT;ZyuCS?-WvTTO0gtiv#iT?s5U4;Fl7Esgol4@KE+|T6 z#Uo|27C*v=cMIBgDZIzz%z6$G1L-x}!8$fyz!Y+nM`r7%kW1$>KzsMBrdL6@5 zzosyUmj?&{MEiiag`2T83)|tsFC{6`(ynGpD;%YdM?zR8*bmZ8kY5J}RcZ7r8L#XQ z)56RpxTxnsyze&0)`rT>4*bK91z=!L%aRYJ?@||NL(f>wDC%XA^#Z4Ak8J zmuyA;D-gIj|F=M5{cn2|4vv0~e>**}NLjZM$+1(b_;-sEiPCYFNIGK=;xV#6ZF>Fm zy&MlTZvFe0WICSc7CPg4)Rwv&DC)KTs@H{su%50zYTUqCS^f7B{(i+;xwvUi-BktT zRDZwnKRBiQ&p&B(EnxZ#a=!M@uuP4ncMusVzgf375$gJF&T?<(x{ST~&vg$M`}6C% g_|k*x-_gG%rfKC!?x$PE$TwcOps!tg&i=uF1KrJ5GXMYp literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/analysis-results.png b/windows/keep-secure/images/analysis-results.png new file mode 100644 index 0000000000000000000000000000000000000000..4d2afd09eb5e3fa248de269e6425b9aefb12dab4 GIT binary patch literal 296094 zcmYhCWl$W?7p~FZ8rB`o2I-J zRLvC0G2{TwTJnn|6jXg8%9|NH}(z(U~Oir(ln}G#g=%hmKHvcL#Xt0l$>!}^9bx)Hhr8Tv*upBo!pMjeJ zr=A_P#$7K9dM5BN!HMD@S#$??uA1JUk}h_W?oRJpt1x!s&M4+nq*b63_~o=Vw%CR% z+Zj};!`z8rbDzO#u=D=4-W)zF*I2XIA<+swT*^lIuQ{BRpQ%ErYMxMfq&s_&$lx(; zscXmK-JFI1Nrb-`87ErPdC4q8$M#)=dYX)adR3~iA4aH0o%7Fxn+hq?YXg~e5yMIe zMel-IWG^ouiS2N|6l}spge~TT+={!Ciu1kM2&PyY~`!KfMc$~i( ze`d_yR32x;IDM+Rv-4HHu=ADGQ2$u~emfk`V6~eq9-7SI@AJFtdc>62==r#>1;1~C zMF~*p=;=cX($mv3Gb5MwbDX;M+g$ep-oQMQn_tF@( zA~49=5c{*at$SrUwvu;zP8X})4yT%b%zsiTpBFSAjKYjAx<5sgE7=&D0rh0LKAQ-$ ziQ1rjDEAEHAdfoHS%Y7DrRS#v9&q%M-a689B2ges<>_P@j~mEhAo+_cno_93(%X)J zNYRp#I?~lcgiWTsws=iLs~8h0$wES}5VA9k2ea=`kl}_Q?eunkl-omU`w=Nw4z}%0 z2j}~J)FK$xrt03j-xXh$73#Ip>wAFQeDoRQLMX8-xfw1wuev1lUt=r6=UXDT5BBl) z_wn31Sw`4fHNLYjF|+ui;@}vt>iT+v+&Tj96=RdW20h>l5ys0IGB=5m2%(A;hJ=LF zdh}nBlizF~zP<;*?ZD#7Q5?JtKo9m_UIQ?#x|y~1Jv)5wPlmGWTWuFAaT`KEWiV!u z3VY(nVwquD{3GlfDhA6a!QcVfQj_gJbiLXU)nK5*!THIJRittNZtdu z-Vy(}P6XeugKt)>3;L!_8m%Um>n+5ewqRRJlKOC<5}17{3!x{;5#fZ~k2qX*20z|k zL%pA_%ozTBii(QT5vclIKD=QrqW&*DL;;YK>QNHw z?H-vd`XL#{Ku6MlQ@MhT*3DR987$pf&S-ZOsiz671QEizl*gt@t4`etrMrs?)OOXH?zl! z_3^Q>Wg@Y1z0k^LU%njcd3Vg)_FZ7EG4zgqz&Y*4Lvv=Ojj#KuC#Th|i-^(J(h;{{ zqZn*|=sz(ndPwyOW;yKkwTP)8ljwmhB+MKF*Rfe8zXbfxd?uxl#1nDoq)N8)Ff1o2=0*x;>~GC?9{2ZQn+F zFe&^%_-D$o>y_7j^(E&oYeZs><|QbDnr=!81k&Mhp5zT3Bn`2SCIX6{ZBSLjfAf&j z>hm{f@|h1wC+0gBOB3_a?4IRxotvPvC{JJY|7^`_415nFpz=+~2l?-vO-YvzB}F{< zml-^-(6&&;K29u5P+Qls7&m&4t~zKPvTk~AmFg`h(Kg%|W+%7!?|Y^09v2-r)b3c$ z>iH(I#2p)!HN(WRf0{8iGQlzjraSXL|_nTiEFp+(h&_3SI;Yb8Y`U zFj%MU>PY5R+Pq>?sxlrV1v3m+A^O9Z7=bM2_HX8!1))k{Jx0n9Nkk13b2~1y&7~?t z_^{^jYhoffsTBwXkyOod2d?`IU#`go4~K5w_W_Wf(78!_>%3Ar2=%SX{>UrvRcud4larv|K*Sn@S?%h~k1W*Msv zxi6Y7lbbx2pi3sX9Z$~sEa-MTpChVQ;4Mq&RZjnjj#B?76b#3AvPKEES*_!AG;yB0 zYujwG4}AA@bd2`y8}sl&9&b=qA@_S(*uvWF>^mA|CY~o-*0zizp3eauRn2ove5P%+m>pq z>fK{$Xgy>xf`wM2;PdNu=ZI$;-MRM-C5reSi6f<*Ej`#O_Wdj^x)IO3S8n-CgF`|3 zQ_w`kXrptut5XopPf_)bfZ-2P1T_izH(?+-H;U`CXMW$YG}94=4G~w!+Y{mKBZ;Wn zzUoJEqn@ha1c9ixalNbzQu2@b1q)o53dCQOSGY>&FkBw5C4a6)@WWZ^y^WOMQley` zRU8R}VNzj7U1Im1KLHI8*+jJ5Te2>`4v%1y%a~A!^aGsm-l*wRxxHcJfZ{SEdxUOV zhmR-x&bJBvv3h@QVk;CVqRS0T^2rc&tNuju5D470+r zw0w!J;F0KfVRXaJ?D?+17#(#vwJa{ngSBqh`R}|!fuogp4#H|VqT-n7)Th$JYW$8H zKKBu<>I*e)k4?!Ih94A;8sYl4_)hE1OUwxGMI6Y6wcEhfb79kp^|C)BsHAMD8~h2~ zEEO)G4!G6B9Juzw{w*ZJF0&_fK0$M$IJAQk!}2L4q16LKgi-wI9&^VsQL--o z*>o-`sLU6)ib&cJ6%or`?us)J&_-01ba3%(%BWIdKR-qia-u8u^=~2p>ZW1uD39V_ zojZUi0ab|HF|eMnG_C{}hvHwku;MV3hZ%Et|T@s99tnduNFHh7(5s`Rgx$y7Qr>4ifIGo-Z(HF z?4DzY#CejGP@>M)QjVqM>z1`pt|sUE3YHI-9l1fTw!O5}Dm)3LZ(3 zP>EaaK9~HrbkY|MxO*m`&piU+&UGJ3bjX0e#ZW@|HDKIafHwfH#V6R4WB z@j~X#a*~Th_U4ftHV#2IrD_yiM*;zR`<}aGM(V%7(+%LvS;(pL!HI*DI>_S*XTAM1 z;(50j>rCM3D01Jmp*mz+RR3*=1C$)!RzR@ zIjnB>IPvyUUV=IE5BeWd#5$NPL+G)8fo+j%`af1!r90me!v=jgv(_ae*+X2^6XtNy zi53fxP-sH-r^b*XM}N(b22SJiHuxsV7x{W@fd+P&TcS<)e{`81+h!8jtX4`}N$USz z-^F<|^1T-i+&?JnqXxO3vB6uUTC);}nc1oqnT?EG@6t`WN6m>U0t$}qEbl+FK_$Vod!J=Z=t|j6LfBSXrTjcO}ZOEE!GbpspXMoQ};+sv7 zl;?(B{j8YN^%yTPaCg>%jMICuc%m}}Mb9byXC4{t8InwjRwVR_?3Hw}_YfUUgUJa8 zt=y{DIqBlavmG$6q5a3O@d)r@X7UWv=YcdV#lWb0jmly(I8-A`5GB*=B>x|?;N)5I zuSxx*D<-^h#LDA0rWHmqt(XN z5_HC$B&o^O`@2s^(PLMKU-BiQ*R7oybe&2EPd@9kj}Mfw!{cT9pZ&u(%88gAJg2vO zC>$mH9=e)op!L6tybI=MKfQrggCP4y(VFf9(M;- zKGfZjA9kgbN&0jJz&`FwA=#LixULk= z2CdBY%RZ2m;*;03D!(CpdnO4xVx<#ghqBbD{3it2dU>Dz9U<{sqgnZMEgG5FwqDP( zbU<{yUQckI&%>#p=~V}L01+ik?edl4daYVskI&6nvzK^z`q~d(`>K|j-aK(%w`hjfLf#BZP-_n2g(EfhGKcsz0l~K`~*r2cizg*%U$MtUA zztYNT|~_45MIxUE?0}H+I5;liW#ej& z^p6!SNoo;i0+*ac#Scn}`Hv{J(@F?X1~EAW{EsFq-=CPy(8VE1vk;G5vc-M0UBu~b7WHHD+h+3i9X#rI&aW?Y3rse7#<{d($a7SbsrteF>qHIymc| zQgy8mcyku9_}6rP?9**PTULX)`ezx72f(;S2?OXKWSVzl#taWCn9<^cvQ9$G!j!v9 z%@8fZF1LMvM_DUghpe+Gd|xJ65)Q*4`+))_%BpWL#kk2MYN(sBxY9of5}u?qOu{R^ zB|u0;P_$wEs+io`of8JGPh5;b+ztS4M)Br0XdU0w;WepcxD<+vWHsxZ^MsA#)mq`Z zYbOaH?DpQ?nAURddnqBOOU6KXx?m>|1r@SYd2ZK_m91L*RI(batk-F~yoaUhxUu?2 zdKkUyrT0DuXugmTO7BS~Bepj&^)O6Bt>bi(G>-ej!QUpQISu}k*4 zNXLQ{@8fh|5E8R<^}nySyJ1+RTPueWyESzLiX8y@E81$ynTS?84;g-LR%1GGAV+Re z&aP|ZQ*a_P(RuJu{^@N)!32trJ^Yw;zz_Z!JsJDA#YdWtGm6iXk+YnHtv>n++Nj}^ zm=H$nQsQ$_1vq+?GQ6FhHdcv)US{I$bVUsXvVzL2pmD!ZBLlGRn57zY7d)R7-xw!a z!y-&*lt(s+t`GGcFHp6At(qS=&!4YS>O8k&*O`6Tc5c!oYr+2m z_64j!v-9|hE6dme;l9}9mypZzZhWSK<9@YxufAXVvp6ySA;HQbV<1y*}S|mYZ z+OK~5Xht5OQ~RoG5hID+rA7Zj#CQKR^*Ek&tO*>@Pzg?eT`1dSyMK}$K^l`ZlV zMDcRwLdD-mG>|dTXl@7zdPFkH_5q0f)9^NhwxE11)*@dAjACn1*GgXZ+HE_VM;5e^ z!`phO^2{`wfzuMe9e>aB7YMiv=`$^ni~o2#6n{Ji;cK7~^L6^%pI8_8^Es}yc6N5g z;&JfC4QDrYz32WN)n_?tf{k6Ql+8wfD*NXj+XZp0TJ&8{WS=(CO4s30%JDNI z$2Byq6%=`hDowBd00TMdYx3tm)5KNoQ|4vK(qZq`aRNKzo36ym4J)|?F3IL@PD;Nw zUOj5we%Lxgqkv5ji(S8FnJY-<70H@m|DL&mu=|akcTkT}hv($EXW+|md0AQ6$XRC3 z8*O`7zNl~a>qW=a9t6QMDPoKC0XKZ?`ooaK-?lLzER@e-_3i=W)bp@vw;v-Q8utl< zjD)`^hu^6`e6`Juo`?WrZQr$?aRI`DulKec3xvJUNnd+|VY#`vV`E~ZilXGw0+rgn zS#x~*CjadMtkUhxAeF+m{w=?#Tkxfy5ambn{O!YXtk#3|hx66FZ%U}!DJt7+as8Nu zh=^yWmh%#*=|?DN5Lm06$rdFGr7}`iLH@Rd5KRqF&TFe0J&k9^Vm6w()Bpq{#%Jg>H^aq^mbDIBM z=&ZXkB60qm6<~rfcr1wZlTIoir>SbHuv32M@zegB|BWDa`Z%!|J1}e4Qqr-8Qyi2V z$PN5ccc-DDX~V+A2RDE_3|LHc^Vw&R>v1L4a<+UI_>_Q*=G3^d)v8~u8^$>?(h!&Y zY5VDy!64OIl^(kQv}cDXW}*1M1mUtP-6UiS+}%(LKGR+(1{M|;83IR?EI?ObWOydK zNev3N295@iK>C$q($M|s5+OPA$|ij8@Kr?TS1HUfD;}a`y&cSv&7v(=|#A&g%EWG!uNd~9cu=*pAx}OiE(kLPtU~sj=7?~o{-Ve;sAPh-2{Kgi@#uL zyPqvXh<-+j;0D_LQx_kmj8{pc!G~5^Q{ZptJg!FS;PZ>gn z8AM4?%@u&=?1Ub{BI#sU@9+}$JR?}`mQN&$`qt)3yOHj=-cIS@>G=Rr88k%pqCkvV zzbJ5xOUjfprBbvON|P0$dhwM1*%IYrHIj)K!a2ipijna|4K*0x4Z&`s|b(^CgBL6>uo@XYWhl;_^Z^}yk#8;^G4Xg#brY2OLo-Y9KmYPnn}8+JhmD9;CY^*XWU`XxSD`QR+cqt-vWh!^Ht&ZUGvcqsQE&daIszeGsSo z(GrnF;Ej>v^J5$`c?fuht3oRDDy^vHsEW2d^pgCen{FNzb`h$fFt+QaZMCDyR!NFa zFqx0`0IL-(RcbW0*8%bQ;YHYS7i>LvG%|>Gun~zhpi*!365ywD4xh1!>&62IQRmXf z!ahi@A`$g^<_`p1T1k!;CR=R!9d^BZ`SuH)RM2Cw)4YV$a-@RSzzdB)=p>Y#xMaKB zv7`MarfQC2@LF4AJ|c3+H*|3Cftxt5&BpRlQre45sLl44?S14$peorzmu5 z7=o(tw=T=eV`eX87qyXXZoSC(f?&b^ngQz=7ROG8C_y*g#(x)XBeSRIuAMa6$LV{3 zN2qr=DR_E0oaBAC?$x*6SZlhgFT@=*Dkw ztAso*Y#W8uaz);2!4H?=va~=qWQbC8DgK;jx8$@;+ctR6A}q4W=djYIoM<&^F#S{X z@zDufq<@h?X&5up>=W7TzMCHE+^?JqT~$iC z^*2mRO6d&Q2PRXgM-}Cl)DeE{WK9&i6ibM$d-#`&s99n@BrLTk3bSl2$4$4O(a$r) z-3<;4yiyD*A+~?8xzPu8cm7$y<&#s@-)ySuI0DAHPz>(` zy~4Xgb}i*5F0@KY-_9yy&KoeU|O&vQ5*W zk)bA+fA0HJHMP?Nsq8J$S0LcISnF$VJ*h87IT|tSlGDKs@4HsSgQ6-ZaEB$gV~>&= zO?7+jURYVr!TEK-e?Ed##6xV_bUkoS`;g4PUSttjB2zq)_!cOxE!y#9jHq-w?cFPB(j*m*sN4HxE~ z?~{v0@>9kqDLh+eWvDiu3Vr{QcU6t1Bo@u$Y0A-W6@vRQ2|GVD>kl_5^v3@e%mdS2 zj0&G45+gEuKNpfSVM-4kX?98qp-2#DL8XEc4FKLz@bkavNBP^6bk(CtXs-zS_ysJN z$pvO$<*`Y~BLbx+@`FIN!J!;50rALnMwIpzh&<8+Z1m>Iq{T^?5-f8K+J87?@oII{ zlc|5DS?2dHqQFl<(PgAV@O`wr4WMOiO2`xS8AIavXD6A}rJe{ARvDX+Rt0u65m{WM zlDTSdKQZkN=D-Vi;CQU|xJF4tWRScjWDyFWb^ql)`$383^icG80FX7kHj9!GH-@d< zV5s1uR1wEukKp+JbB!y)whFWNPwxpDlH{D-R?^*UDv2iIK;UnqI>5UG1l2EW-K`8# zq}Z?eBPu53^>{*HlNyDtji&=Bkfq{>ijHnQ;p&~4a0sU`Z~|}U2w0!=+kjFMjTW5> z7eexpoBFby$IQN)xhpO;Aos~*Ux@~!Bx?co&eEw+B79jb2LX-3U+uBFB+-bFRi-AW zQb%!vfQccLtTpP0+h^D)$Qa=a;uDfy`b|zCPiXQVxAEu-A&GvZVv~4OImk$VvAPcb zaQJoO0N`pjE>Hk4SO8D?X>0qHHm~DK59TF@)fQiIyINHyb5&)chLZfL0*t9`_n)l%6Uqt`^o)$Z5T z>Ob%Ds%NW#ts0HG=(SFd!PHj=N~E4NG6?|OnYrO9lfH@K!SBlCVnUddIbLV=zIzd0 z3?h;AyR8O}QS|WG44OTb#Hy4fDlhzB2Bdks!yb%$O3_JITD?zyG#(yi5-i!TtyX*W zpc!}>_vFPhI{(PBXPO&(n=ts_YpFOUP96Ty>%+rtC`Qio7IL!1T=*zE5v0gkI zN+?dC5+ z6)je`!`d`r)~JT7in++r8Z~*FV@hCuXPWO3lc9vAH5GbmO4@%ePEryiw}qd;8DzMT zB~VI&Tam=R;dOB}`92d7Xro6?Z6=etoCu{erEVeJm9xC+t9+2$M!bcUsC zU*tMEY&0cAFZ(GYh2wiqSUa5X z354#+pfUvNHaWUQA&ttb}W1Q9+13gI3Alm>;Nu@@gL}lbG9% zHHWdPt5PL*iL`Mt^Nfs}DjXv9h#I7c5HSmR#vM$;t3*B*>-@^$UJ@y=#XToJp&cMC zn9pMS?}|dDWPqd=(|!8FjM*#gj@wDl80{!b5x#5;%?Vfg1@;H~uoj%}$TZo=>hZmq zRCGkm+7+3}1g-Y+RPXf|l!afj-My;d30lg7Xv)12^R}4<9govOz~Y*0BYriJ!1sxQ zO)y~nuY-Zt8L*@Di}0h@+3eCWisw0Z?_S^FS^nwBb${`f=+3H$q1#ZF>RYl zAg37I&S~bcL?@GnZM5$>5*7{(Mle@r!-Vk#LjBZTDJ!*>ss^{UB4LR)3iLx~ylm$QGr9@x%V z^o&cTkPcM&oQQqb(+h)HQCg0@r(oHf-isUoMI)OIc+=jXQ%_J{%u+GOb2;#W16A8S z{=PEWd0AJ&EwiluldG%PI5!#O{>R@KGWR4F`3x7$=RA9u6vDlqahA?WGBS0*}MO1T7P^^e)!M*ih~EJXJL$e_Qs>XpBnBv6(b-Vp3+y zev*tYGNm5=a-7OFND05>xC;IL*?Q8X!E^qJvGHyD2;vzyU@=Uvb4;E+xnVV~M-Nw2 zCFOIxQCU+psr$!R6>hnhao*l!yLo@~8|5~m7E5~dPB0c#*UM33C4OS9P>yYL3gYT% z9O!Ug_@teyGmjsYKqS7fgR}X16zi8tj8P{Ok7v6t{4*b)tgnr`6~{9xeDre=DgMtv zm=c6v)NoNlq~YS?7Td@<56B?sgGUN)9pf3WdX4 zH@oND?fstQoI+CQ$$NykSL9_JMhH9tI3@E=_;=b_cs{%n=p1%ezXwmE^}Dbjz@6br z&8Yi4iR!N6d+jIMGToj&LRZGYoub;`@|1M+%^y;!nM{3k`}2nC3=tXCo55dcWSrm} zB#g5`XE78Vpl7;RdD(b%*R+*w>Lb{pRueR{;&W zWUYF<#~?0Pm6Y^(O3mgoBoTIP(3L%GUAJQBZn}&hWaX<7tq2Wc61Te$N)QJhN&w3U z`3=9F{RCe7g6e{5R@RS0JbB={xNx-w(sq4$NTk|`wEj5vMek)npUT6bh1$q~qP#FI z^*X^6l$&n+G>>1DyZQ0Vj;A5XB5<{}Je?_E%mcaUl^7(uREG%J-jFuH^7X3rc zRfbNeS6-Yhh-;EHmB!TNNHR^jpmu2f7+{VcpPVFDOQMDsO}t*fXm0Q3p|e@qwHKq9G*ao;4~?ZgCE20;}=1eY2?)o>A`M02Hha#WfBD*)7; ziid&5K_cYAyD6c^JT7%NeDva1)SonP9jD>1S0G^nP|LbgB3$#ja&F?kUk=5}F%WUS zbAP$2*MA;@$hn{fEiW|+t{*RFAB>?!<`e`Aj#julcIz$&owQ!Av08F*9%HsG+*}s7 z(J&aIXu!GuT^X|bB)7&puBCy_QE^pqbP5xINppI%lSLo>OjSd%pEanSENY5vE+@&_ z^t!fHHFy+H)uyjI?q~aqP4`NLJM1PEPb5}s(D}y}DQY89=Hs0!jXJEvTwq6wx6s_a zT6V7uYFZp>_@W361A~0meW;ttrB`9kO$6ra;p17bu3IdZL4BaJ9)=ex8Oi(WoY72A z<+?0Y!7eQn(MFj}^Ut&1K6S{TQi>zUg9z9Zln81@x!uk#hou2#UkrLIhc8NoNgDzW zw@Z8z@{Tx7x1wX0h+1qLy)QqqV|6{xb6oe<;IBZBXFB#C@Vs+wy<5bP(7}^m|GRl1 z>|%S;Sr!_RD1CFw@2DRh#9xtJmPM;XcRAXeRzUyvI_#QZDvw@b>1L3C#8*%$rkX4V zldUDH%&|u%3X_ITulLKNSVh(uAt@z96a0>6Pxam!y+S(ZP_M%wIBkq zJzlQ*vr8d_xJZp~jHGz9TwnC2TiEym?W8=6h*t!T>ET?Bj1EYGv1{}j2jHP$HvX48 zj7i~SfH>cAbnDJG8L#?42K7JlCjV`|9QplYI` zWR6q{Ant5koU*rw`EfPBxY{!9wrx=*ZNwRqQD+fRKGnJ#D;XV0}<;S(NZfDICg&cMfmsJ*8DGCU+4@?8RbGjoj6-BD=PS&^5BKn4| z9x*oR*{_+ooW62g8jv3VT-47~s*hf`o9`&wt0<1kw!!6I?@%?rnHY^W`9KIu2@BlQW*xQ}X; zMJV5(v}J!QCw0VGwVt%r&;$z3=VI0LG;e9daZYpRbaKETwrgilU0p=&#dO204G;D_ z*1`^y7Cqbr=dS77&DV^KT}ec7`Xkl~peuyM{pOpQw*?%rVnE2^F?@+HA9?JM82Ih> z_Hg>~bcvmv9V1tPrnoYz7fUe(GlDj9z^rF;8qZS_F{-$N0ohzy$c!QwYPZRDA%@l( z2fvq>0ClW^WN9G!bGfw~uKfq3TfT2YEc-nW_wJXUJPTuc=Gh8uo&0sTnfmrb~Gcq)R8uKx+vFnbHSK9-_@x;R)%b96uJf3G?;l$qWwA>L8 z&`BhoN)p9FXkc;$Tzvj&JKjzNNpcu@hC`R&_ex9(#GNcw6C=Vw_S1;LPa9}alKJcA zSCLY`xP^s@H=toS08HhdBVL};A(GH^%9ulb+e)igmg(R9A|lK%efeHU>jnB|mI2S5 z6>A3?hke73e8J)xt9e%Yb{vdh{^qCZ|c?bxL8nav_$N{WuoDes+2LQs4%j zId#qp;7{0BqLK2=Mc(zJ4N*gX%<(=*RGO$qkc6#fqgQ1o8!~x)V*a)dGQPzpNO8$~ z1mV0p2jN9*gBkXB9_P5K22Iw7FyUvVCQJM+m)GQwKdH+`g061@6+R^gSjy`Yyo6g!pO;Rv7Y<=d`b&rP< zgiUU4&Q@93AWw)0mle>W8N@t)J74he@9>tgHyR>gbS4obLCPxzH-G}`o!+09zU1(2 zPkv`-ssT)|7{ur$vx@I#bk!i%EwI^Gv_MU@xgCDj|71NFg_YEoW6zbn+>ZNe2{EIZUk}=R}y{{|CIk>qL>N(VbcfZ zXK-_4dj`{*JoWW5Z(h2*1wIJ9Vf$7`PS`YB(;viy$6%fdHVdX^t0juqwizC}$;Aw8~NK6!&Dd%g(s9J@OA6CSFD zzZEnwKmM54aLWmV68(qXR^+;)oz3&~U`F5<6&4_}^|o31U4$C7U4yGAjv_jW zL7{E3@z_hC)Wz9Z1g*CZW5}-_Dp@)Oj{I34`ZIwFD<+~DMZ#>fXY;NId6l4xPc-5I zGAMzV6$X{VF;6m1j+*-f;rSt00*V_ClTIA7Hy7^qb4J`~<52VyD>a`M41KpdhB=IV zA8ar{+YdSs>uF|M;94~jX?O@T>TnzpXrIb1JS?k`29OKrA%`9;#%r}4k4J1YT=t=% zmZ_JL%F@Zz;p>({5@nfK3`ojNPcquAOv3cpp&zUB+ZD?GG)N^l4;vzq7W6e6(mE0B zlG3Q8Jr6znJm51AcJU?I`*(qoNRUYJwQ&Q-#>byOES_wtkdDt&Jxqi|(2_}@|8{@4 z#c;yp=%}Ky@+(Ao`>!V94<|J>EU>`uX7neoUE$%){x}LA%h5{X;V^mNTM7C5(PIzT zUr}+C9Q-u=xZ#TdJu;ocU)$O$z{`uftx+P^_5Sc*Tt+~zwYtDgV2Hn6?F_}vxV^vJ zLn@BmUzU0zt_4UEAR*VE5fc;ha(@~b29fyw;+mJpC+2fn{Efn*meDwyFUQC#Gypm_ zJFdSxoP)>`4^I}VA~DE6-R_O1#^SMtsIL8eL@93KFm-o^D2x>z5J_=ve*X3G5@V8q z-kg%#d8>DSJTtV-d7+PJS?NebyWTrjB`&+o8|#-Hx&x_s`XpxO#G`Et&o6O%ueS1M9_ zYc#wTvl1VCQCKZDYCrV8l&wsj{BJH#r*yo{6 z9{`yYdfr)4xXtaxwSK9X0V!H$JixB_^s2e}!lG*jW_yt7G^4VzO1GMe02MEG{~Wk! z+~Ii+k!oGt+~nhl?hkUDF4jBnxxg>AU}SIS)utaM49Fn8X-IOxk7;%K|8DHlIvHs( z$Q-%WO|gX~C}3>+WQV(EKJwe9TY{zgknGMm2V?!c0m<|?^cnIfAApII9JQ(x;<;@k zfM=403_?HrwO8E*>XlBd1ehURv%aw}Xy4qM0HK~H%V#>(<~AeCjKGH5AR*ADefmGN_aZ{J(Nkd9D>edBf!lZYbt^3crqAp z?ln?2NC(qqiGJk5$Vn@QJV_Qhf2c{dLTgo;LbazGpr0+xQV(EpgnyZxtuu}e4K1M} zTR$)>u3IKV(d(--3xh&^jg4TvpI#4t#UN|;n~V@eNR;ELcA3{L@H3ufWe5xa&o2eM zPPN4@;X_>gu9F9wUAG^HCVcku-Jt4;kYY`{%WlR?|EuGs?AwoN@%Pg+?^xx@2aVLj zD9)Q7U36J8cSoXIf#3piey0Ua%sHzm{kLs;6aV$XmHc;k-RgC1L#sB|_lN(C64L?K zFLStddVe;qUd6kBj-V+qM(JG1Z@^dE@xH$6ue+Uj0Zv?hLIW04`WRq2V{u%fw)Dm# zLU(0lXnP*h5h~9xD<&`?)COVNtX7J;rJXh5vQp>6H2L1wA(Yn(3%b4amuR&Iqc_V1fM)3}L8?@;q# z#OkFCU-eXO7^j4~p{u2mSNtEbPil&mOf_I@XdNdh#-VPL>wwslXuiLolAL5v8wXC5 z*jQQj?p+OJCriOWSi3T!jd_$xcE=!NWU_Ly4u@~(#K9!n3Pb9t=MLTA&aQG0Ni9=; z(`2K|2BmyX%PDe4f4aVQ{g<$nsxUxl??O&CUO6yuY)kiC7(;>h#k=bhe(m~NyPZj5 z>E55WoqT@;{XAF6Xx2YJIMx*#@jXs6ZE<0Wu^S<&B-P5KJKz7~#z8V6Ay1%6ZHq)gBJ`2IFB@uEz>zrj` zG43t`Z)wQ#B@)ceRDacJ*iLcTVBGb<;B?D51Xy10Ify~!L>hN|MYp;|^<+$``_Ln` zagAujHkvLeGGDE{r|+j_f+C6U;7ZTOK^U$IrnkP0PQmj39TXb68!q)+X(aoiy6Xo+ ziHm?Rj1o2W-`K=9{~W68G;$LE6|P-o7!p4>6nhW96AwTG(h#Y`KVRkW)3t}wr$`cB zZnmLD+9qFakbN;si=~2 zIo{lIyBA6GMXay4KU;UYI!mlxLF~0%=|)f2_?u1kkdoEEteTMt`Hjxc zKjT3;%@<$QZN0&}?c{+E_dAw$5N7=La-M6@HdN=Ch+P9JJcc+LH@c>wN+5>I7yZB;oDIc>DOe$%Bii~xvxZE8UtKos%-J!&ZMp#8rr1^4i3$j%HwN)tpo z9i{tQfCUOU60ynCM44lgMRK!CRskK!5^_k9OB~p&*y#}Rhx%arX1tvXlQYwnG+XoA zg*oX*5Vy%z0L@rVSd`8jfw+s4AJrcu>mS-NG1M16+Wqg{qoEp#4kXc|om0wBL$jfp^Wsw{u&(m_?!=;zxI-aATm zgJ_*Wql}7_*ik>=KMnU%TKpjsH_r~5J@*=eaQt#Iaj)vYRRuMQzb%_6OpNv3So>(U za+#1?yc(+1aW=T3>IupnqsvS&Y%Y6pF`7QcMx@uoJmzLV66xRriP(7tHG-NULtU$i zak%5w5+YCLx2_SCef>^bEvw+!5*afQhPnNmHbi1lF@`j%Z@-O#oIRuA+d@OHmKog! zDab)hX8K`PF>(Z=N`=`ShpzwvX<>!TB|f zQznuXxxZKq!Ad~4{pv3*StcfhJBO(BZ+RtryQ3fxQd`sB`2%(>^Y3eS-u8EFklY#O z_aqy-wDB~*gl4d6sFb}DIx2A)aD2ss$7*nyPDKbrp;I$4bx|;#(ywzp8c{qKeslrA zi1pwheqQdazg>DD6Grh}ZrG*JJQs9sSl$Xt2539H{ef5Jx9`Z)<8wW0(mJeh+6aJx zp`SAB3SizmMyuKEwB9IQ&SUrxQ8YZg`5$&JT+RHk|N%39GUo zc(1x!p0NPeBPVnR&X7*vne(v@Pw9NSEU4~BI627ctb8mHzv<$ z$61dNji-VrR*%;&<_b|MFgZ3_=2H}$J_BVnrZtKj0I8RsjVEZfP$E~@nK0XaRi>Z& zb)BM&LbC>mjPf~xrM{t2o~7^trBw0@HPqcE$*S`4)2M5?)Swh)zR@rp%wU{zzxKCE zd5iQa{U5^KGODWX4f~}_x=}imPU(^k>5^_xy1N^s1*97!rMows57OP;DII6}KVQxn z;~nGu;0I-|z1@qs=Dg!~U3Xv<>Z&0SQ8(^O-VyGQSk^dw-xhYcpHH6w- zXt0lH+FBMDni`Hg$UZ>czN8m#df%g$oegP&u`I<(HENZ1t|H^-4OuCtm=630iQa|sQj$AB#{NyYNHCW-Jk?8whE(vA<|wlc8lqQU;I z42>Ucdg0n;VMAkxI6ZcAHny}~jvt4UCaQa!k;!M@56cHyFrdY93!%!SQmCTNwDX_-CYqN4A=oOpE;$;2)AZx1nSikS72McMMjn(UtyZaad0jp~QjF@S~;^T?dd5dFuTIJe8s zmFBy-goEg2gq#k1{@Vl`?1Hk_-G3SV)RvmIy6XAiJAIF0*AY#sslKvkwOyW4eef}& z3^Q?sbQ(X;#&%l&$(1^5{yf`Mu>ULb@lCX=Um~2b>DX?j0vkC({v5|ue4G4UR-pzr z>BNi4S3|;m=yi+Z`N|KC38QkUYk= zP;+8N+pahv;Tbf#+y4&w^UCJugNs_6<9gp_Qv`$i&DLKqR7V_T;}^%xwGg zaaP#ouBtlW;@Td5Z}1?JtMV|O^Q-@Hr%@XY_0%j`R_j4iye|WEkYeHOkFA3ZnMDEO z(D0t3ltRr24nr(aU)0B}oYg$SJ$1e=6bjwn#+s-&QC@`o2cUPs!1P@fGlZ>o=L04b zStC*{XK53mp)+FFz_(CVoIh@lVYwL+6b4ZaaRYeO>$TnvA%(m?@eO(pn|Qt9Xy}uo zsHG{aKd7L5OT=#AN6>hp&@5fJs&}s4dZ-N($DXyWASf8P6 z4`$xsKf%qO{H!yM9Q;T%97!>OQ{$nAH4gdB7d$wJ`ivotQ5U|b3*LWJG1yWBVd%7|8kzDZ)RZ~Zd=so0`TvY5TQ9LO<@5`%XO zN5r7gAmWlxTR}sX!R642O6c*cLp{;1@NebNg^A$=;0~WRzxGnHLsc8 zF-yEUU%TC&Xbo%t<}as3-wdE=kjoB<({{K!E(F$1VL>~*oAB43Z-io7i_s( zJ2Y{1FLFLX6XLqNRbiuj`_%spGr=Rob2rJDXx>&>&)?(4`D?{#iOM*a@+I@PQ&wwU zNmS+#CT?<%5;0kxve-ir$9=jB%lE0Lh7#N*EM6Lu{g4aC4VlUft>y2^N=J?R)Dq!C zCoE3VK*)HeV(kBqx=1b#ZoBnZ;h1CZu$>kthzI21>L|VYmExJrf?JNu+-c-og(3+r zWc%m806@s|M^BmeO7X!16F>Xa{^F9sp|2SpO|r12xr-B~i9P-8R=+ zoiksJ*kvl-6`XJ;{aP(l3;9K7VqS}fYxvJP4M%l8<%JUGK2vQwLnB|_ zHCQI7niKQ;n75L)12Gr*O+t%-L6c{`{G1Sex;4Sz;*a+>f8?mm6lT{S`&%$FMeU zwO-{gMF7al8M?5q%mCA!Qi$3B;0eJ}uXlou(olFrEvf>Mt?ODH7GQ>!+V;-t%S8S=hq3JxB2WQr__IX1M9-ydVACFC4Dk5bYQe2vPb8=ZSNsb>=9)CV;7d| z$cx@l74R)7V_%+}Q4t3sk!x{F)cuXLcZvtdCYf$zj)!E(3pUr+-8byroI9m38a>1* zNh)?Cw8De7%*2@r2IlQB8p%8Q^@mjdy$W){^LS!(rI2cya09nLEYNM86!Y6Ff`YP4 zxl;BiI4X^OeEm`&8~R@L3r&vfW-%S`K+EbcD_P*99WFGv&f@Zsy}r=H!nVq^A%?M7 z-iDHh!sS$}1Yay%3caZ%Gt}Clg^?678*M@bIVDcOi%FQ&njMA+r)1(Ez2Y6DV7kr5 zm)1DZ+kemMx;tq&{7kXXXma{ZkIf5o!P$_JRHcUFhs{s8PMH3($_{ED62QJ7Z~85s zu_I+cYCfX+BV#oU8hVU&$cJ`}apt=N3bY^nT=THTDa_MEEA-~O<}A-UbhToL&khVp z)k@jfp<}D86%P#_4=el)1Ed+Pi``}l3){#|Pie#q22Wxs3ml1JQSyAaXbbmPRY%#a zv1dKpk;+p3nx>w{aJKg%4#f4?ii^8Uwtc5_l5%PJ*=yKp$f*KfOOWwtLt%n(-<_nq zHQgZ~`cH#G0_rLclCwcJAn1tZngUB)XhrK ze+CNgxKJ+97Yyi2BhmE?>}RXiGdvy(DSfWIN8ew#SJZrZ=G zI%e@elE&iWsU;gqnm?$Vj9NiF=X z$oI*$c9CC$^o9ZhO#QFM>4O3x0Nju>2u8_)noh-t-}2ZrGs#hVoeb*urFj5~c5RpL zj$C9k*HoHS9zNZp!dL^4i_HMiAfll7ZZ)z4FP9lCQxhSXi(!#UVr*&<@RGPITag8- zKsni3Rz3VhF5iIv>*7W3uplt1&`>3t#=D{Fglc$LA;P=v+nXP?S_Q!|-slaExYS@f zM2&l#smWK%g`8IQ7M+Jid=M9W;vw$1G;YG<8&Zt&q}3F4{qHRQm%R9Jm&Ya4Z zs?pz*h!UL=5?A!Kk7KrSM#WJw;r<53Nf4vzn_!mhBqwJc)4;DT!mq7~yjT%@6U^Wo zz&2x56)POhzZNEc*CygQ%euG%A@0AdN#cPmHg7iN>{6w#VTi~;8CU%^(th2RZ;5VD z!s(83bn~qNfVf5o===lXK6@J+-?T^j+1B(sP5d4PBM@5mRb@(M7!V@n$QWuT6d@i# zX{zW9Y}nJZIPCsY1S*u*(z;>AT-K|k5`{kBb=aECklyM25JO4L_#qX6P9#XgF8u~N zzh^HNo4^xC(H?U7*SWTe#qYn+~b4%1+W^mq@fGBM%L}Vs2k#)&zyrRTOilQr=ypP-)xz6Po>48u zlvcPZGao+^537E2u2DoqFnK$@jwM3+RMvP!VR#8Adn^>0)4e-l%5JoEzap_%9G#4+ zVx!;cb7|#%eRhTJ`K|n;`J(r;okd-;3q2dJ)5f}V%RJ5f3$Egv@OSKXd;1BQ_KiMV`+ zM+F>th&sEAx({WS|S8b4#+~vwi)a*astQ z`yl-CIO7=j85|c3l`@3 zHvyWcL&@d3{HELUF)N;&c2h>f$06yr#GxWtakxZU-04SvD8H7G*ta zl&{oT{|)W=@E=|(akyTq%~@zBB04F*Sxu|!DgV5k(&E8qqDRGy?0WYk$iZWc!__^* zZ1G4IWxKZw1D2+iyDnsz*zV2&jdlm>SD{A#s7|l z9c3fLC+bByKVUL&E!djwmTPxf92b;4Pleg8I@#X^mw<4>a-#Yj3W%skR@S26KVL{E z+s*TN4apjix0vm{{Ik;0Y`wo6JD!fmiOFh3vH9C!!)tZ%z1+A5gj@i*ZuS|c2-j%KBm=z5c{?{r>AtSO)m@5VSYp!Mhr zabrJNR+*cSXh*+TnVP*sv}Dqp9rOrF5=exUQ&(SLXs zac%Pm&`rF>pX=F?{UIFbMa2z3ESx9j0U=f6I``SQT%;LPQ+X$)>%V#0ywdXWU0FR> zTM$_~QAV7mx|E_i_I`p(e%lL{de!y1vR2K1wco&BJL1gzije}G{v&~p2OC^uGy4>p zsOqKby$5EwO*GTkYBHQv9-_(l>u4I<1iy*sn{1Ga6%=Wzd9ZgF{xyIEpkhy#IMUr1 zuE$M`o4mjB8}^B-Wp}*QMKPfS4{2B9AA>nWEVBePHql{Sp@c6N#c6uzsqn%|hjHXk zY}5gS>7!JJ*MkU+rdY5drf{4d3#TPC|gI9 z-Q%I$@9|(<=;4VWT}O_DPvts{&-viRV#RaL&J3N1O*`7M>3PO(watFVQ>6N0e#nWd z==>!tn}pYQ_e*8xOupNzO1{m~e?CXtHh#A(*-xjLZi@O%KXuGa%9L)^V?oae8}yu> zm0R%XL#4e#h@i=y38`i@EfbcFd$-lPz92)7W=R-wBK*69W8#-<&VqOz&44YMdQQl!*pMrSlOqf|?6+EpoEmZcGY~$z?|0 z%0r=XsNJQ+RnT^v%#xm{M%Ew;9x@}D%PdoNQ2y*DC?RB0fc8e9tRMZ=>3{)*5dy8N zGGFuqlvJwD_75V7QW<9LPA2)A0WjXAklk3|J2e}}SnKhY%kIt8bFr-$n>5t&e<_`~ zTz*uo=Vg*i6sp#)V(JRj2d?@<0b5_!9=As_jHx{1s#VSZlE$sp`aRS&e?~+jVSw8Y z%;x;`z7lZ4C3_-{B^i{(A*>fz+%1 z3M^7b`xF7a1KsJT`xuf)?(k-x68UOmWrLJ!(vNrRC6SGnBW)sMxqcVuFzpEF4AqZq z^n%Nm8Ub{l_JxRRKdj$aX^03qapJHyNxT-k2Br~aiZs!BAbc=RBD{bzKA$I1DITT3 z*9ifs()6hqw&{inu`DwTZ2Np2eBir#}J#R?1y20wZVy#Snzv=Ed^qo z`lbEYdxDC^DDPVm;jgzPMa*k*L~Op0$)p%^EZmkPT4B-mcI_!AloGUxJ7(A*q{UbC zMT>p0kpKSUdP3E(y=k)D(|D8)i%xX;<$PB#jKlH!^II8G_8PC(#6&EU#{$#+fnqRqYtZ;)j zW&IaRcJllwU*q=;XimLqh>2O=XBCf8Ws0d89PT)zV>=;?xS=d#xb5pFs>gtSAbLzP zRErnJTF0`ki>G(`T=ID_Y19qzzw1u59|S?SQ2;Op`h5Q{s*ne`6rPPLA+ln&lG0(A zT%~Y$9*52AK&9yZdkmpFsHdTX50!eY4XQ;7RFYBdk0*_Ol~ce|^k-Tc-?u+GG@pNZ zUr$IGcwh9rvumpc)YCsU4$*e8Y>H)Pi)n(#lF1&1-!QNs>g19Ed$j~ zt9wu~pb@>De3wz98Z+rr|8N_7Jyvu*>e0e7b6D{1K(Mrjz=fe;`hAk753?2rPa=CO zD*9cxOPF+k{I%r%e_Y81CVQrDGlagzY3_V0S&Gf-W0ovmjVs1}YmfZE>#g?EaS{w} zGG}l8Sv%T9`;oE;jo#z0=I6Ab6QKBU^2e{SknDWJCT8%1QGQHMb}}?tg%eGA z?sOYDpjcfA*zb&TXwHGi&v}~1vsb-&%&8XC-~@byZQoIw%CdTPrj>tc50B#1S z=t~6sk^oiJzXf=x+#GVG2HDLfpAbG<+Y_?43k0i20neJ0>t1{m`&stm+rRDtJGXAg zPXJCzTC)cW!{d)&dNQ>IP^!1OoxQ9FVHj2u76(BLJu+TYc{Le5;lz__v5}s7*CyFg z|3})j~38@P{aANg#@t%kN;4CYY_Q$JuBplh5UFs%RWIicA5g zinZrcH*ULC(=8`i+3#85IkAMCmbjyj35r4x9*iXfCjgO^Q}Osd-2r+FOA`P~fE?5) z*9^#l7le6$DS#nsY;puQMoR@geLy;fLDItB@SG6^Axa<0gq`u}`d|tnXajI%>xeJ` zfRZ*fH}B@W+s}`+e}1|eAJ5ygva9VSL8e39xrKoU1%@Z0<^BGm+eM z_WyU|Lg~vl)Y-f5czGG)l9J#@zP`C+wN}#28hi2)BCC)~(R=n4Zh?g(%uQc^0ejDQ z@~{ml!YIsnqlooMw8N%yqwUHMvsC$AmxQ^Lk{(W|gour|2H8O#JyPMfSW!e@-Vto| zMoiTfplr3-p3Pt%Az3QK(vL?>F(~f*ywN?#8WWBV;1+5FdjoRt!MPLB8yu$U)^^MiWDM2fo`$7&J(9!vQOj(q}ca<3C?U5|% zeaK(lowy~8mc-u$m#XF>)!u7n*5&aX^r;)#!(iWAAWLr-5xmb)nbt#PE=kCG7DgbB zU42$Q5lm-cVlvy{fnXSwIdgt!Fiw^}C(r6H4*>M$=TSuF&JyXFi!En2;!ddxYP?BF z=}%;Po!PE?UKXjhTb0hEtlWBu6pUmU-m z@OrVVu!&TOcKZ0}C?h?68lMY2{b&mt=A)S2)A%L%E)pC}@f(s!5x`CRQ`?$p-M9-N z)fPoC5*px2=xzmTI%CSgUguXDH6H_DZSIi-Q6Ymg)-d3jX4aq^fT?We85+N}@%&tj z+K*}AHlE1@+|L2yh#AtDNyM>w(il;{P$fdAC zD}KG)9vVyIH0i7p>E7Jj1VrV__6K2)t!VC=+S)g7-WaX^gQsh%7OWXG$_Iys1F6}4 zs0o5_iV$)1&0AMu=Inq`_f9$7!`)VFqurV>*dXRVM3Gf~gh3C>2k863!GSak2QwWV zq!mq&)zSXk7~}0nq;^>Aca2r>ZQDN-B=a5mqlngTj~8&L$V`jJ22K~fJvA~RgsEp@ zmNJInq~>H@w`JfV3EUn+8_{Hw`X4ZHqrR$YT^C=FI~wzK70=kVtZ z*#L)@1@`>208j#NVVn}Io%ZIX&!!{ILBH|-_zZ)7ev?8Tf5ozO=wV{BZSH-tLeqYx z?}E^|@%~wB5yh{W=N8Yv{)G$4Zj}ASHx)5dPfLf_()uc*%q=d|tmgdg zVk`AS4-aEhQNJyge<`pc%2VxP8bKhw_P$Hs9aCS;em?TMy)G<{q0u#qLkMT}{aGP?&+bt{ z+UvN#pvxqx3xc_yaQ(U$?D%UVr16M)Z(3%keCqbb;Feb^0i%AJ$h?H3`-MBm_VwgE z@9b}@wvDg~K-$2bmr#Hth@BQJ)*Sp~GyJzxX2_lE4%+j(^Oo>6|F2f=x;+om^trIT zFicZR%KivdraVGaX4&qvh`2M1(F)+1zp#!7Yv^CNK%qGfvo2hj7XKQ&S+--ap94(iQk-Q)^K{(y!{eD@oN5DTK>o|<^ zIh*J*l0-sc_c-I}E*rn>@5z=G#y^?Hg-js>!Yz_Qn@~G5*^Nd2$c9Y-5198n`&a;zon(e z^%0Q3aseisI+**jmw39}pB(5_?S_&;nDi1LZ3u`@!b?ll z{z+wv#Y|7%jYm_xV2xBI4{cscG-K4f28i&Xcx49%wi-#O;JiG3*i0dx#SQyU6nW&M zc}h|4jqo(Z=)FZoZrB&^5~ z-v${h8mST`62TuhMN;H;Dc9L;#C8;+F}1diQ>Z2-tbszyyI@N>M2bHjnA) zX)tSG%cT=I9Ra}Gh!q|l{-5`kfLsO8Yp|vVz#{ry4t)SYp#(k{MnL9$E&{d>3j6&( zxqh#=eqnUJAcv7g=fB@!@w;zbdq!7Qf;X~fHs}zrp05I6Jd;7k6Nsj&Om(qBm|=Sx zp!8duOMt-0=kZ3ueXRp{@|W{~!3y1&?>Nj+VQBGW!@qC2K3pGEDPH4-n+XE*&w+SL z@L_}KF5)suA%Hi}8xMqVTTUZg9y|Yuii%oo_o8A!+QNr%$1Q$S8oG)W8l4sx8)&mw z7jXjHhvyPNc*$qK4#ktfBZwWs$;2RCF;p-}fG#d`MpJYRDGF>IhQWBd=KxQZ2i&px z2;mdDydvgs8xWVI6%;xEI6v-tQ_E>JYv`|6V~VV=JNOC?o`B{ou+jC*vG`s@u08E? z|MU5}_-O(sHg8#<*XjSfy|ZJp+UBvib^zD_NDTlK<*F17nn*R>z8Qm)vl-R zZy!&A_<-#7g6#F*KECJovIoAM5-PR0UqIV`S%Q(9M5v*_7S9EIdm!?u5_6Utv;q-o zcp9(M``*dPNy9kW?FgI?_>7vY9+%rKE=PHde84#>ipb26?8=|o6Y*NLmrSs%>I;uDDZT~8L_%Ld2BLc*fHbPD8^YPo@!J$J*`moj(GU$E9bkD5WY z?Gpx#>GjLw*}#s`4Wqpyc$pEBoozfW(0mrQZ+rvB_*j z1g&9_xEsEgsT0qD_<1Na%M+>u(86N>ZSZjNbRdX{Nwq zMnWZsK*2D|B^(sIQ8AX=4X&kCqVWjtgJnc6wLiK~ucQZP!y zZ-&%;2`eJ3Kh!%H-maY!Hvhj80owmh&G3Kw3#cSK&6Ir^h$2eJ$|9W}FEeeG6)Anm zC+K`hX#KZT@dD;oe~6?1D?VTXg~C^J^9G=nT89MvOO3!Y?FSM!AX_Q?_3P!-t<&rI z@0{QBkpbAMOoo2Y;71mM1nZwv3IUa{3d}75LwK6ND%+v|mo0Yx>9G;gDe}8d_6r#M z{KI*p8$RmfUxbC)p;c?HrKJT_G%}Ks2oHgId6d`a|JDk<)=w<+xBo8Q{CBa!_q?jL zydcAyrkY;q?uN*orPwg6u77$ymbZd||I>Kjk^dhw9^i|3QP0rbt^9wa78y0WiGO#l z9XW~s%?+Hy(lP5J*}8VO*4-nF;wkGyJM}dG}urQg=^k+?W6I-7GPgNK+{zw ze0{h(LKzeiV$m!cjQ8VhR*&C6Vc+HmeogN}Qm}`sG9C zojgFfUoT!?MsgA%Tm6cp{I-*eF6nzLn%XLsw)4dct3F{^F&2v{)d>&OXm<GCK&83uFo1vu9?5&GMkUO0;u->)A8}mUvIpp1h)+jpcLa7 z!S8KajG?}6=!K1M|K#0A2~d1~ZY3MjX?r?*dGY(Zzp_U4uy#LX@LnOc-SnO>zYmOz z@w=WV`m0gCS|C}s>Z9tP{j^v4j@zd8w(G)-VGb`@tHONw{+Vp`v2yK6Xl+xTjDxe> z;`frvO2gGB{oIQ$m9M1kpxqEn2*yYt_}wq2gZ{(oTMDq+@mJ?52`mvDWoA}KDyalr!AZvc}tvWJA3zhvj&Nnws9x=w`*#=^AX&QxOY zyqeo#BIg#(zo(?4u5Nwir9tP{yP--d8-_rj1wzL-Od2Ns`a4FNu@19wa6VQAX&F479csU4TRAp`ouwL1!~0 zD5QJ5JYyNnf-)&8g-jHzXD^MyIvhaDc zq6f~mukLo(`~s_0dXCCoetHOUA-lmgdtREKw(!)>*(t7MQiif7BS{WG7{yP<3(JAs zsH+sE|I^J-2*9To`4uK`-t2wsq7OwG&7x#@KFS=aBwGH#PgpBcs&%g8BN9BKE7VH- zmeo0mMJ~f}e*ed@5Z)Y{>Yg;#*tR-U!DX@baQKCJ>?WEeI-My_P}Zl>%6RN_f>OR4 zqIEQ^d@1}O)9V5)z$09T5R3NiL`Fbw;^z06a}&QyiWALuTDkE-`jn)OR3%Kwp3Va1 z!T37%;kKJ?`Yr9byIl0zfJrw*A+rpr60DB3+)c0Bh5Qmf*^3xMhvvo>b;Jvm(}64J zHA@xGGGwsvgdg$aZ@0rZ3X>0iWrzUJbzLx>8>wM;j*u_>dU7_d-}+a5>SqV7#maAj z3gA@yu%qL54o3+_^Vm8*3Kc(&9WwE!*Pj_D2l*gkytXM%DIRj4F6W=^k~{+Al#>md zy|>(Uf_4{|iif^}tUj9h)dyt=^5eQ~FSBH;VK3O}WxiKj9aXa(d;aP=H|*)-&T$OB zHHYT*D>PC&1HF)o;dQ$E8{Wd%+PPCOY9a`#mNx3?Z(2jGmp1@-3eetx_A~HFnXPbg z%O8W^1^ZTo&vPl`y*nuilf`ZY#|OPanra zOw;J7pT8FcJfBeW)#qETlyYaDeODgNc^Hii_X@j>MHMvb?^{_keC3FVD^at4j3x6H z9AoR0tn8uv^!iVM=Ka7R=n1t@qqXQ6&O4mL5&xSc(<2s$t+cx zP6~P_nTvq`E<#q?*q26y{`dD08KsykYl1W_SyEzsb?Qfo;`cEjj;W8HQs^;XU=_!9 z%U--vw4_2h^HyRlUn+hMRwC0E{Fe0Fto?*5`z=vAHA-78d~@C1Gy}`1$4dtk@slolRY-8n}2oM zM9R2L|4s(6{kxu2+^}u>Ze%Ru-w!E5_8~kfpp_FwyaO7d9-sW~9|pPXaDuql3SL+E zcabN@8Y29n8JvdA?O1)^KP2OSH~ZcDmDK|V(;g9t zzY(!9q8gk7w;RUVl!`J0jjRqs!EgII#oObsJqnP`s z2Es=zprJ_BuW%fnsHJX~A|W4)3_cF;&GLSmmhNvSDg`Eu`U)bXf=0uMsZL*P7gwn~q&4DychN>=d~^bh z&@csq!+8d+y&~7+nX~=o5#ZJ=DtXW&#cj1hD${Z;_g2^p!4cU~`;qk7le*|#Mn}oj z7wT*I+Y^=lNs+A6$C;~b7JbBDp{<=yYyP@M9kz@$9{)Kp@O!w*?U5wrac|OljFItq z45O-+jP4}iaP^k8^c>N!v47sF)PKx7{c;a4q0@L0Zn1dO>9I9V=FM*PVw_y;zGFCL z&NN%D*J-?S$i4csBK5ap(eF}Cp`>|mQ@_=Aswms%KH>H5{%f}1Oo@{lC+_3^*0_&~ z;aLYPncpQ*U8bPh##kfhln8f*1@kuFTO9O=8jV>x{nl*OK(a_tTCTrG(Xr*_vBV)A z*&WLQj#-rpEiAsX_1x0vnH|Ox<1MF?{P*p#Lg_+Zl{-bm4!JFw-TPXA{}Z_Jw!rem z(Dit>$Y^TTz2+uiXmCb>^U9YMyEMY`)Bdp~ z*Q3nkI`uGgJuib6-@S*ia=W)&?GF5V^=mKsG4a@~v9VVm_A|L+rs+p-WT}oA-GxBF zF(0Yp=w2wAZjDXZhwc}z=Wr(z!Lg2plh2K+5TIToo5m1+z)e>p+mt4d%dXf(L~YIO zo2rAC-@A^i%;SR}d-y{p0OD5G6@1YCrLZg%Jpzfo8YOK=-U*Acmr-&dndt;2z%ko) z`@N#!bYk-t_Q?720Kg>-Y|RUle|*tf6#rxJd%2!rmOy}xrvOPQLQBj$xejb1gv6B3 z=t;ipf7=B;K!Z&yS{hO%Ok5W1kM5@lJN+j?oL0_1=PfL~gdi@X4b6K*M6sL(3S#8q zhoPI;kN>ST2Hldz;XVWgi+}vrwRG3BddE8WVV=M6?Ysb7DIA66{n?&FbS2KeRvs(n z{sJcWm)INm$Wr8k&9CNFTF=kY0+p0l5$xt{mI=sP0~qbaaN=4AVYFnFsx}W~=+S2W#+UDPZ)yIM?JtX{8 zU0YriLwonY-jZIqEdP;8pcJn17EIZzG+XS=8De^;r*b%mOh2JmdrK=K`mHe?Fpux2a!i)kvmM@;!@uxJJAB*&(bGaBY?D70lwd!uT zNR7ilz$nbtsaVmlb>PHCkana_D!UikaE|zX$zz`e1}>%BH%Unj{EGRSTj_|tpcbH< z!!-H&_nn|)Ny6?vrusJ?mkWf7;;p`@W2RONF(&#L%H{%AwcL#2k%&kltA^8nTv;rb zvD)NvNmny;tOXg08uP2u97!dq|9N@dcUOz_3?wavG>^>2fZ;;Z+gfBZHasr>{n)-% zru|JL-6)al0pkIaTKBO1D-s^wc4h}zeSeFWC#z}fo$mKB#RoLf1S|W+!omHLE12M} zA4ZdNPO{u*^LrQx_n$R@i2DoZsS+^jIQ=zuRmc^IiBCwji_PqS>bI-$x+UXvxm->v zf0~?7HGhvmbZ`>}A{obr;pj;2TA-CfzWO#_=i+!+b>M^#X0xqOz}J3{?#i7a0Ft|Q zo7Z@wt)jY<*+(GbB;)hFS>Ac)8tctbW;k`z9*8a39j|JBO(GyL_wBEhc7LWoZ%n#C ztySfV4WDb}qkO{eR`e7SQFHyFN%eOKv4nGO>+AR=t@Q_sN7Fk|w$BK;P^*S@KCuNp z1LMSkE|A@y4QIR`tzJ~zST8TQqxr5+x$Slqfs5VovKyQnTn@^E@|ea+>&x*MI}j2% zJ#^PAF(L?pA%^TNz0D&U7$n>an@P%3R$BLfLonOM&1!con?8k@h=3Z%k*aBx2)WI) z`}Makr`r!EY>85+7C%OK3Z=6+(H)q_*jocQ0$qhd-k)FLo;3k~pj+2kynJ0leE4n!QL z;iRfGeayune9hgKl~e%w$n=I2GH#2T0*k9$oAH1IEK!Z$OSUe}NUE_6# zk+lgR1~-!^X$#1ua(nmYB%{+i-0wqksXh=f>L*$%J?xWs#RSHdlJL9SAB8dnoV3QS z&mN%Bmugr#idip|j$M5zA0Uh|>b%X#1?owl-HiKU+MJ;JHtHK)&_E8gypAh9hnG^r z!qt~`=$LE)L}cZx4%pCA{hro6#A${oFnr zG0Y&2KsCu^m|shkB2fMaZ;m-6l@zGOjRdu;ZS-e+ z*NAvk5`eJxDm!J);LX#A>iKqS9FqXgaac)Be!+SEV@&#+3u0mroSsoY*2|uC^yK4; zIpVW5v&DT~SR<7iWw~FMk}f-uW{GE#Hd=Fb`4%ux=-HspN0v)hiZ+LiW)+0{-i)|K zK*M2YV;~MB)ZJG}-fk%CX@{8H{);{_S+9CSLeD0*mb|0HVK>6(iafoIVhjGAME>Uw z!0;*B_9sixK%<9ddue4q#7{aS|KHEZyW}uC+B;5ekQds7vSSTpEpR|bL!al*4ynO* z#Dc&iWcNg+SG+ON^7`6KF(ot1<_2K_Iw=N<&UM%WzfxIgL;yNlQg-FVyKMa&=c|83 z@kHj0ekU&7n!

Sa|4=kNje?<4u5zSRno!R?#->dy9-iV?&=XxA9X8!%U-^cn0S%;MxKyLAB4^k zV}5yL*aI^?_dug(vp z0X;|&$xOKjSn;yn%Tc;Wz_KSY%i)OynHwG~Mv^Y$H4KHG)Ll7=_>-AgS=}6!DqZi? z4T<6FYM^mmzKP(ts*~1G$x=Y?3P>{$I3hUuYwWvU3_-MNK)x~|-m72c*t(&M!znzV zWV)Zj`1W%29kJc%xGQwBu~Sb23oz2$ATEJFaXfiQZtYf6o}(fACM>cU*@VPs75dR0 zK%~IGnPql*rzppH6QNdzqaZ05ZsZo0(Cz*j2 z`;tUja04C+0d3*j$uaW2O_FmDB+(s{EJW6FMCXFw6@cW8xdH%5@l5)5jP$Oz$V2ynfJZk9+WtnL9oatAQA{z9399bZKeiiy;aVv=%_KZ}q zCzR;dwJQ?gk$or$N8>6DV^_YklcN9q6Tb#M7}z#B?aI_ei5Nd!Q1=#1Qj0(zAtxpJ zOw@&^OoHWlaCMk$0Dy8palG;XMtlzG^OOVobR~4pTmM{`%-;^!9+c|s0OG{vj7M<8+fN~eJV5M=8%n?c3=t(}gp&_SlN~G`i4{-< zfG91U7X*mvhe#a9|16#T7TO+fSxtMXgadw58nF2lhxc?->lwDFc|fT6l>sV`7$MEz zUZ_a%rnD~sPS6|_WaO7415k#$pFth}MFyqKpUe5GRx7wUaLa#^#7m-wJ|f#uI7@Ya z@KQH&18+a=^fXYeYu7(X2Jx2@Ep!{*HI8@cw3Bcc#e0GVLtm-6d)&$lvn&lIs9#m0oRfo z;K5U)C%*&u)}+lOynuJ&C>sSnAV4dv+Bnf-m1g|ey_ppb-T6)vx>U4Kvvn4(u&_svr>p>zGNPZYT8=0go%6502&;siwr|Ye z2wPj8CrpOzb?K*GZMWPiryZ9Hvn6k-UEhrtq{Zf#Uz5_s>Rjfn#}>0dC&03pZKuY| zmglWq5^X#;KM4&~8#9x%9M-65Vv4gwIR8NelFuyIXh?F;H^mmeU6cBv%rH=7$eP7l z#l5Ni3}Cv!VfN4scjcYx_OVo`TYJLqw#T;@&!k>%W9u~UZ8J)%_?*(Fdc}Dcp zhabGTVzOSud40BU>&RdZOx&rArH|}VvSM9wY0&#dF}zW+^@fPp9Cfn|j(Wkw)Chwp z3I(WIzftqRDb7Zk>Dkpj6V=CKF;Udd@xYmrnB7Z76(8F3J zYk*M=pZ3-M2`wYoNB)to#+&#!0_B~0gCi^P+{xJnQeCK4c+%61tbNESh~AOu#4$T0 zOKA)!5OGKdS6|(pcv$Ui?WO*+0v;nOT}LPib^x#~gyJpdP?|JT6V1Na`mg{0VhI z;(z@Nh}1g(t=2`1YLzdfaWb4&%NhdUlv58kt0A_LTU_Ehws(!HKNAePinD&;gYL+D zHrqR-8X$bR!~pQe#|&dCj8^BhA01eN0)05yj7D{WVtRLHg>q)U9M1!&zCzlwbnhwSLQcAS<8fH6 zJ?z1u$L-2`Nr}S`_!&>jQ9sSOaM*c^-CEcUZD?xuu~bvT)SC(rsTZTY`opEk+siK^ zkRd#Gr{5Tci5QbUA}1rtN*Tb<$WbMHk0O-uC6qbLCbQtmhcGFIJb&ExPayEV>I_)M zE!zE}z)mBj?}PfIXNdzw#zsJQlVF8zutRjxR#`^7y_jU^!TuUfUNNhQoBZD(rL|4}d&1weU5 zS@GRDtgEzL-(#4)1Vow@;M2c)CXEaEKWm=Yt6`JIgvk6gB&9Jp*)+T(b$akzqwox; z_-_gz#0OC^0F`Ik8IPRwgj$x317t0W*3SxXwJIgF_SXvOiG7UF_MVZCXH`O#CbhJ>Z(s!VaDjN zWn7d8d|>bKe^mm=HF02u<1((WVx0Y#o9q-8;69)3OxFb+t{;QdJiq__T<1K*{~f7) z7uU(Cu{S`YiW|_stPNcias(RPfcak&cGe#ee}Q)Rus#xwU^$~e z5h&3B!)KCt8gMTGr~|x_LwOdr*gg9)1(1%CK_L;fm?jLLSMYbTfTim?#w{Qv%}x?`072P{w#~#R4BySlc9-V8An+-h3%&e{8r}xr|2VE? z6B-A5Q*~*$Ky{$4Qy_QoY_Fa4q02Dz!dtm3nwZf`O?TjKHYyWaHvo$ zBL9337)Wj-Cc7Il{&ezoe>GkIAP@gX%nD%7ye7xkB?-OUEQmo7E^E+lLIb!z#8iBq z!z!lgnPzVUI==yT-^9dZ{(LYH7|(SC`eOoTy}KKIH*R)@Ziom_AT*uijITFbYi}N}eX?w2;*_N%C*BY%GmH9^a}MY6XI%wq;270r z?wIWn9J4ny|0X|w{O-!4@*P-gY7-i+3T1HSM&`M|07ivOSRvN_$wPMJF{IyeknEHD zA)IF7&vW6{WxQ9jZn4zzCzh2&RMlL(7ik7}%sAFZxa*%VIP2Qfz5fdx(h)8HM2 zZB248_23Avrw-Jk_caOYK!f=S-`;cxX|+R5iH7KhdOK;kO|RdL1;`Sm`JQsjSN^~? zg3lVEsIuc`(69L66mhA|CXy)247MaTR8eoi3!sn7F)@G?Gm2$wOj9ZO8P@HcX7LVD zIq^8W!_9Vy-)y{EWZH^C_^XD1fb5d<=J6Lb(XZ6-{6$X?Q|z(l^~G@?Vizj|q5n>@ zqP`bxEJPdroYWvdd+@%VkG{J7%Agi}=mj z4-AqpPwNBLAkdqq`&|L90k$mde!HZOwwC>iZ$ezj)G5vP#Kf+lnSj&eLwTYohS>&P zx!f%$3K&xL4VjCd(N3fwuct};9%5x_j6EOAecdg#34$>NsxiwtXO=wU#;g-+(Cox+ z8`4G1fX#0gO2WV3j|VLaeP@ZLCGI?vpR*$_q$p3CO1vxM$6Ewmf?1aXOpDvXR+3~x zA4y93wJV(nD(nIpCG3=%sy{A#x%dY*{pfCZkITg5r%}9){F|l=1yDzl%IuAzEgUa{ z7pw7+fAS^nYMN-Td7dm^0Ayl+83BL1qQW*WVWAH!0pjh@g_xSD}6=V|K*5XsU2}r#2l^X+txTQ#vZc|VvFdaj@b@QjjI{M7OlkS;eRKzmlmOYMVbber6%MQX40T3=!}v} zTRM3~S~XIE)$EGg?F7jm-|weTQuVi90hBtcBU;li^^7J@F3=Mgdf?H|oBi^Pg^MuZ z^DSN4I>;H3<`h{&=LrK z0TNuSp)FsUY_j-6zt6bFKQ72G!Q<|)p9QmEoJh z@mZwN})I6t40>98Xy0{?Agzx9+6dO>}E0RKB56+Uh)c}wR(=8WJG)t1^ zl41NMQQ1nN?*TLvB7G07->fGXN6!I5fWAtSX99-36lWYwDE1ZVtjPEK;j+dP2iKuI znxa6vsEcC*i?<~2=MV1NJ?KLAuVa_$$(n#lwtonTYqa2LuEcS(^GNrga|EXwr-H?0 zu|dCJ*jw6(m%JiGu7FQKreM)(Q8lWW5k6bd><V-H14|7r)X*b3VwYI5KjYQfa&XV@#T=J0F6(Piu)~`8nXetS3uD& zVHp&qXgHL=;J3G>cp$WRtLo-AH0A~6)i8m_U<(BGn7V_3Elq!jW{-KS4O7?!c+dPb zy}tWv<8wX9(saV8*!Tszr_2%lL4pG|I13AcpGb!WdE#|>TSsH~6*y`O4vroPDf*FdtssIS6g zRd&)jX+(C-avX`37ozgTB-0AB4=?y21?5 ze8Y$=^FzL3adAase$$t}*XFe{cI82mYxT{H7x0Tsc*Kp2k}@^vhejzG`53JygN){m zBpae%7hao1zt(rPnsH;gsL#fv5l$4{L*F!+ zd{Rj+{|u+pd+s0j`L6)4d9>kZrWQ_@#1hS;k!Mcb@$wn2OtB~38wRw^aDDUB(NVAR zX4zZ(4ONR(vHoW4>KA+!2F95;9!7cK|<-7|KrN`s{DsyueOJ=l&73Bk>+_jCW9o}Ik;k|L!hMSW? zt8k4I2&dH%sk3Aaw`~k3n*DC-pwD9cw5)Bg`QpXTW`8B}f&Rl@8J9XLX(CmtciqDOhsXnWYbq6 z#f;p(^c4*;R_zhyGizt;sbeh$^ic~TTe|g9i6wr3-5|I^sq9C+!^|< zK*=}6X3U&KHhTB2!p2PT^+#L+gDdwm)!QQ>XnZMy9*bb9D0ZO5xqaUkKK;h1A?(3S z<2N3RV6?J{;!3hk+2buQ38#CK9o;ucM!sh|;NJhCm*urfZ%`PIek#wK2d9GGZ|2@i4#ew>2Gl?WyRZ89e!y zzZeN(=gG3&gac@jG$d!^ekz*eNC`DdIyOS|0+up1F*kwg^h=qymAb;Kz)wptC25(= z*l8};DOf!^^$hQXCSDZj$fQV*;+=ny`6WD38lhGaP{Ka?f>Oaj$}TZ>lr`I2hI@o8 z9Y>x?q-Q|>GGYNq?TB#T(_F1Dl`<4)=k`)^R^v>jEuvcW9#zL=-R8ARtO!9_5amtK=%a4oLTjmPItYWaOQ*(QQ<7{c|Z}Mz`~_ zQ|=tTinFr69O}92(59eBT`Mo8rZDnFnh&o@r@fes@OOYg4{ojAtS<0`qx6^i&{T$R z9;B`kMQlLtgpEG+(hIJfA|6jhX2{vb`2zjBoWiYSz}-k%UaBN2%jaeDDDHj%i;00<}2Wuz0diVEOk9=Bd%kqqqZA3BDktqDkLn1t;%NZSi; zo-4Oy`O8#Q33%HX7gqr&r>F+=0=Bkv)dTDxVgTt-F28QlYAw1b9311lcXJ&|fKHdQb>?ObTDM;BV^HBC zzjeKR#qCRPvMgnG8RbsWUXzW2|(2;Dkc9yTxVTzaxHTpaYaY?U;Lmk-gi%w||g8>TcZ z+WG|EfenSXWz&7nb{AbetLiD(%)i22Q0yr7x;|c(@mb*E(DN3Ckf{~!q*(P1dn>{8 zX9NAZK{fOPMbr5uwKMJQ9o`s5!4D)eFm9VFt~xdPV|no%E4!U+bAY{7+(kLkwJ?xf z2KwG8ekLhg!q;6gT{Y7>a?2N!TS);v?eV@fMnt(B5&|P z0L^;En)8ly;W3^(+I5L0bKsUb6he+2}-AR+DL#s0SbX58zNZdInDC?EFaD>X< zHLBh6NN|6+-6&cb(s!LXKFcad6tUI*r!a*IEoZBq zj<5c?ohrKIK@Y5!tc`S&EVDW>5LxLiq9S-5-$)8$_anR#gjVD%7MHNL^vFXqdIB;% zo`MI@$M`V@A{Mg&s^D=S+VV71%o`7jqs|bgO*JXCB+^lxE-LXtKP|k9i*@x_D0O}JEp`fNKZzyUl z6|LT))l61Y4dmS9x8In}Hv%FU=pE+dUEK=+&B=BbZb{u5{E_RiPsqk(^ZtYj^`}sE zPl*AYkR{yf`2-5;kyzV0?R{6BPiVwDs!|5f!RXT()UvOVdW`2~+djl*VVTWyOlYn5 z^DGjgUc}{;&G`s3+es0q#gw}@fovJ3Tyq=%iicM>f_wo40Khw)Wq*$daWonUxW1nO zv;b~@(wyRbDd+v5o{aba#?4GfHIvN3m=XZ;NrxUlNNgn))T>D~)^;4ciiO`A+icI!GT> zr&k7fNbEJ4x;~z`0w!U>B%Rr!uUx^!vUOyfh7Cg??~+D|?Q*FKG7#zDlC4cy zX|tW#r{!894=A0kbb3(6FmzBnD+%gX;7yUHa9xMib5(4dvBi0Tw-n^K`7K~4ZniCpQpO>-K}+~ zhL&^^8!&N#W4=&Y|Gwlf-YQ-Z8G1cnJzZY&`-ep9Av#v@O<&}#NBZi6kEAlszGK?P zty?5rZww=?XyO%}+~@njjc7k?QK}MGU-fTYot|`4Ex=XFmkPtUw`?=|OFdJ9qBfW))1nv8`hw z5CP@_knzd*{(!K8$4C|PJ)P*Q#q#9!IY25P2*xC*v&;`<9Ko9a_*<@KBw_C_``QZ; zOR+Nq3F6j(I8gS+{+P2{e~!r;qM!gok4HnlLq?{R3UD2jIrk(jOtA~eF?M25RQIVx z&c+~@gSb=4pX)k48!7CT^yiz3a`C#MZ#lw&;BohU7Rr4srYLsj)c!zCz)6+IDU z*#JQ*pNxO|*+)si;7&4~sT{P?VX6#z7lfYg(d9SQ`?31C@KPd@#n`C~v*UYgZIgEcq&-4ts70gEq-W z;j<9#qL(#Mt06a=CTyB!kPypEFyj)whs*k8WIho+JAk0xX)Pl;M^VeipRc7`j6*2J zrhSt~FI)6MC`wHD>{#!e9McvO%a%xj-4G8;z;rIUy#e<&+#zc13-0bzn7r6qF6i5cCM8mB}8{jV*l-j`Z93;vu@Pl(o5mv?i zy8FVdVIR0dkOH8dlICQzDBYb2Q`mC9@-X7r6x?`*Bzq0&3p^l%5Q1gu0WRdI(3;zJ zq96*ioUDUJ8}B-y$3jD+NC=?el0J;N8z9IVVqrgW?ijEWpF>Od^-#LHUWN3Wb>PD>Q{QQtgB0acL$wk3al~# zGE=aMH81#B=tfWN-!Vb7C?W7l*SK2&r~8~*0XQ&e6Fh+&5=}2p!0ZC*OcZ#B2uRM# zxVjKXe*iECjTP4a&q1F(f!G5a1a%ECC{}Wq%1b^5P_O?6E~5sN>X@B{tN$Xg|1h64 zoOyf^fA4=k7^S}Y7}OK(K}EuS{Wm}w_uNgq;}Vw=Qa7NQJ`cee(s#Z9xu~p6_R(7n zzH2Z8c9sVB#1%PEbcDLffp|^Grokgk%LIVn&mNuV8{Ijpul{%%Ub&9e#%04CFWqA z2igi=svFH9(G=W69C>b)0wVitxGM)Bwh6lzRk&EbaLO}jsgXh8@=gR`^B`vZSI951 zxa*oVn}gHx!(aCTLd%3~>n>)7HVdD?uTdxz=j@cJm8JKq+h#V3T>hNEwUmE#p6Vgj zyTp`Lmq`2HC*>k#u5z0Gq7r~&S$IcaA$P-~?*85g{U}6eeaZ*ShA*Q_9Q%VTxGeNy zxWq`V6o^rd?Ar9}PNhgEs~bvFpbwCb#c0N;su#728m+p~91u@W!s9erirYjZaFP zZj(3WPdVoq7<^wLqGsJxQKMgH2?xK~Kw?wuqkXyT;(V=Kxt4+tQ+B5ASD2Dc!AMuK zY|XD)db_DFBO$luVkbZ3fk)pTKI{TN9LY);va`X=jLKz(9Q2;Pzr~2NdLP{546KJ7 z%bP&_Q47Q=4Rkh9O*@NW#csFx)GJIutWfw>aB$IUalR5`9anB^)wpV8g1EQi84=~a z=k{+xewUemwd@Zivs|<}i?<%0UA!n!Jtz_Tdl(*Gnirrvn0C6J_RjnQruHmSicxvD z)ND!Y_2YGK(Q(R?R*_#<>@5#47h;0z(+&O`_I7nk|M}OQq3ObiX(K3K+R_Mi^h28PTz^8ZH z-joE6OcuaH?nIkA>fPjja7(iu*e2iGV%brGgobj*20?^r3i7(J1)jRh1+^-&)6prP zv$OW((Eb0)PcM7P+*8@)FE^bbQ#n5|IvXe9wGZB-w!zU7oS~6{uhat1hK%Bi|Nai$ zB|=EGEO!QV%AIY5RxX>xZI0}Ol5uUY7p2UHaL2WcQkI{&X&9a@OrZh~`h-VL=gp?{ zxyx-EPi7w4s;8-`9QxlP^_063N}<0QV1Km5|GEi_-~KSAJ3}#0J^z@f;flMeLye)4!R8+ap?FjpjILE-- z5V{pHzsU2|3FC1x`aJD74LhpPXedQkhNgjy?zNwoEQQ6*c~g4b9eS_6-#^*TP)P+@!s6VC zbG6tf9Valh?l5Zak7N=}``zE_*Fr9ajMDh!-+l{M-df=*q$)ehH-bZD2wzE2shYvV5D&M$r#gcpoyy9&^ZLRyoJ zaz`$GH~Fs|)%7d$&DX;u-h=quN^S?IHlc z3s*CQL3*Hw*gV1J83$x?Jq3jqu=z{ngSx!p2U4aaN#ZpbXY$~HyB>HCSvXpF#5K(F zwX`GtHYc-hA64bI_Hdye$&&${n{bM_SDEfxz(@nO7{Ez^T6rcu5LBWF4@}!H3CL@} z^_a=-2gCnBUX1}bAn5y>))%y$1738noq`TOudLLU$~lJY0&B;w&jrI-Sf2g|rUc3M zn4mA{3IX&Vgu}EZU$LsbD}_o~1`^IhI7AVk`)k`k{s?IC?(ld7wa}-m$9^5hT=#np zu!aK_D>2oe_ls6UAE-QmbbwG>;*7YI4=`KKvbtLlRLW;o$pLui50MfOHZx!d1RQuo z5fp6Tg*uAFzPF-fa{g20FXR|{L}a;-h7nx&7op0r{iIaW&tpLke2A{5p+=dSL-_vy DP>YNs literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/confirm-user-access.png b/windows/keep-secure/images/confirm-user-access.png new file mode 100644 index 0000000000000000000000000000000000000000..61991864054ade9956091111effabd70332a1f99 GIT binary patch literal 36712 zcmce;by$>NyEY6+hafPNbazN2-QB~`2t%iUARQ`QlF|c12t${Igi_KlN`oMsN~gqo z^V|E`$9}%!+u!^C@gCnFux3~X%)QpS;=Io5T*T;Vs}SH);i90R5U8mt>Z72bKSx19 zt;0qGzNht3T>}%S-uf!?DAi-sJHQ)s2RSV{6qLFoyc=r_;62VuRTFO%l*hdfU#RI^ zkDsETB;Kki${G4u{_b!|D|Im0%Hazds7%LasI+w2{TudMf>7~kJW__Ob49aJl=Xd#HEvUv=UCqLGZ}?D+ak? zA;x1G3Bw37v4B%Y(5}kQk2{+qUlf-)YN6jAD_Jjma>F8|U97j$0C^lZjvyw`s3tXd zTNU+wka*ZJ^*s{Qm*oG~urcz5XtpyrkoMy+?`KWaQ(W{Uzg{MUE{WKR^r%++c!1>( zteVW^Rp7H}|7)l>f7IZ!H_a);{@M38LcU|JD>O8SH{)8z<1;b|7t1M7oPXujc)k>F zw7D_#>*v=8o2kP`M{D1l2t}00s>kX%qIu)A+1{V*vdyXUU@F_si50PKcWQH}BvNOU zJ=N{oEz&j{NWAB&Zh7+($p)8RcRTwEa?8reS!=K~`fBp1!Fx+v8mzG^fE*<+;-^(8 zk}dr_Oj>roPw6H1#LQ3e30&GVA|{Vzg=T9@6q87z z6YlDVd3&B=CNYH@-p*>7wR-K8IX5mh^n-QYXC;E16LPm7 z7Wr<&a4p}w-r->JTrkvh#W zrr>0pYytGi8|6vDVF7;c=f3%3p72=iUsbNfelL_`vFsm)p{#KK)0MT1lIS*1b|ae? zi59O@#w{QgPqV2lMd9w$u??7!cd@(%^zelmNrSifUQN-eRs1PN>VRqgXXrow^ca3TCCC7Cb2W}{snO|2xxu$F zs{-|Hz=q9V{%PIHm+(SoBk2>scZTr2fDUKJVUK%Xf>wA{K^V-O=BN9@ zZSY6_UpRbz+5h&3$6ZIWQrcv5`>jQd-&76Pb(%xh`|*qR12UzC#%hYT&lB{oUKiHA z8cxl>qPx1ef&-uY%|easiHmi z-JfmuZ%D%ky!Zotah%iWf9QR>jdWZ1w9>Ga6sCnW>Y`Nfj-mDRyGBWPzlYYqWY_LY z(X*%0kp5^DyLdmte+>g!dPpl@o}0oM$%ST*q?#jw$8^#`W8zg%|ErA;2Mf(LvAGgT z6j~sGjw4e_Cfam?RlWZjrpjF3A0(Pf9G$uN9MAOg*2z3oW(gftVhv5^IR8f8nbE9& z#)KFv@!u8A9P(FDL9cJOIhK0U0w!q-%{2|`tKcMCwpJ0cI(l1%?}3Rwe;w=GTLfRj zd$ABuLzRA$5I~cF!}lcfI4O-Z)-8KP4RVZK6@%{#5pstik5Z|nhO^K-&7UvCwCf(rw3cVBk^3Gz|Ntz$d4UeQm-)BRh05*17Yxa z&9gWqr_~Sfwv&mKzcUSePsDI$mjxzT5sVYRs0Edt>KOj0HS(fp8@Ht-Hz}B~6-;nZ z)S`iLL3@jyDNAzx=U`A4y0?X^o2Y)r_#;Z@W~B{v{1DW3ZK8C?3cgL>faksvEJxlz zCiRU%n~{vcLpVeUvdTr>7BZcUm9mrlDf)h*MT#X zog>WzH`v{r@-TxKJ-yGQ8Fay9y`~IctGxroD6RLe7grw%mcEwq$I^_%qb3be z9F@f-2_2Hp+cjdg3DYSi;x$P~6-=AOyfd@77&ja@h^jExz(ZDv|Ga1|9X0kKb=qsw5Jz z#Cx|VOQ_}E6Y`U8CxsA>ZWSs-jXgh*yuB=bp(hi+Q*gOfw_!gwGt@(SUdw44utwwh z-)!~4a&rxW1k>&CSM^MkTko7iwQq5y@biOu@Ni31>{{1vn}Z4_UJYPLU#?KQQGkNa zc;Gb?Q{>J4ncrr9;<~zjzKt_^boJS?gn?-2a`op!F!)Z?hoi^B;lrcuepz7^dP460 zdF`z0jI|rd=rd!sbjPd2w9~wNdOksK$u-P!A8_&Wi9J``%c4c^ag$}7KfrTXzc3b{ zF`IK)KI~tYGq|-FxF8Eu2CC|{5{=KCQHVYSX z6o{x$#_#agQb*uf)Ft53?44-T4bsD|!x=o+y_Twk*MDLFk3RC>o?tME9cnDc>F3Uy zZeSU2#dd)U8e|m-?9g2esMK?k^4jlij^;3_3AOQf)nUpvxXkbdiw3dkpTUZ2#TqIu z4?N;2$-2zqcj6#%0>MYl0;PPGJpHF7)=k@g|M>OpJykvFl3++vvMQsR9DUOhMF<1V z5}o!aT1Az_s#6qnO9C=1w;V50NkSm*9Joh@el_%EcKS6@{2;F(gI=#r*=Sm|n?C&c z;b--;q3cc}*Y{zbU<&^;GNo2is(U5ETf6mqslZb{yRXSiD#u-xeT~uV=hrHAo12@f zR$tMMZAk8Vc>J3^mbJ;?$yE12aoA9_?-uAtk)cg_8X*x4{It7Fw;DSqPXpTkwdnT(_X&B zg1&yn`zR~#wPDM|WQC#1-AOyTgz4Rh%yL=>2l;Km?;@0r`fu#=W7@hx}< zE$mI$CYBJD?Uo|+av<|tbF%p$8Y0aFd*ppL1E!wnmmIG?NPNV7;+xDe@NYK5d5lK9 ziNoBqr~-YT`tPE3{hrU{zPa*OBrXHT+E)P_j%H{x_Y-#**wN@%sUbmHq@O#PqoU-l zEf$t#%h=Q@Qe3_V4dJTEH=#-Tc}c0Njf?BS7IiEj*8%lR_oukCq@YQGz}Egp(#yfiWr^#?6$R=c8;yV zt*}IGC_Um@{&zFU7((2ToK?urI6t7L$69xFvfba3=w|4CoBORq04Xj;<`-)B--`p4 zR{s-wG{uFx;IDGga4;^6oFqZLS}K(Lb;58Ig3#bRmAnfN12!ob-c#K2r` z=-t&(D;2c{tRG)_*cr%qZ}50uH064ai3?ouc3!TkoxZ!n>y7Api9ZYgFGm{@54AMr zVD0@VmA;ZGWA1n;g{G@EjhO6w&}cfn6lM4{&!lALxZmaB3g}WH@%Hb#M(8 z-{1@NFEoMsH5pG=0pGY!jyGx+&rWLY&Z0wBrWar#Ye`Cm#}f*Kplt5tvr7l*%U^HD z{gyOHZ>MrX{#MrnOX)uajJW=MUE_5Ki;BnRwKyHW>l2*ztKSDB*MAx|e7cT42i=`5 zhpY#}&f6hfcbg8<_upccg2y|obwBJ>Y?S6K=N9pW%yCH{4eF3zcU@1YFj5~^19@~+Idxl%~VOI#en$-RC9gy01d^@`pIvZVfQ-@R%e9w zd#TjVl7hPl6qoG6yL7Fql=5FBft^Jx{29nT@Za@r&9Ni+-ci$W<#upW4(Vid zkv^Flm-(YMK9nurZpyu9bTia!d_8nnQF7f8Cty$Y5Vh@woLBOVA|f|aG#>U4xA$CDiuJen%*mr!oOZK0cKR1*&$dWX(ldIU?Xf zoJ(enHRr)|rxp-edrNL=C*`+T&ssgxOoBLo8?SZZN%t6Hef z*(rC`U+SG)rD(~nB)SZA#LJ*M!^VFSg14SEYFnlA$|;dn%9MF$ASGq0`!<1p2u`Y9 z+(KYeaHiYx##n=Shm$=@pGr`y;(Ulaf6<F&{yiU!netq_kj^%H zz|h`opZ{Js<48dJU=`AOsy~hFYI;A{>dgjA3YaV+tzsI#7G*w!<*Arl$K?PyPI)#H zRN&vl&vz0(DZx-VNEP=kO#jMt{cxoR?1*X3NwKl?$tMW*$U$^h0 zUUi1pQ5*<%k=bug>VsQv87C$*r}O6`w*=WDE7F$wE;!gAo;iTcbjDYTDB)UUt)R@= z6MH>_%<(?%xk9`Rv`FHv0iL;i=1&hn-s~5zQ4GEy-u&P|%aP9;LEVf(+|tGznBBj{kQk23Qy6ZbCRrA?oqjJ;P5|?&eVF zi#f+p=z5 zW2}1Z6X|4V4H_<4EN+$zhHH#@z-5sm^`7rt%7hKr7Dz$-_H~Wb8MChze3xwmuuFY3 zZ*2&Ad)*|>5V{0e!Wroh`SXmkC;bIwVFGa_<~-T@SL2pKPnztHi{oVs9$CC^{MuZV zA^SlHRQ!mOyJRHvfJk^{y4S(7?Mxk4JlU@Dz3Y3fg8F%1bm+4xhv8$SUxb;OQ3slR zLOr}9f=gGD)+hp86K3+GvU|>EgzA5A(cyVx9yaaVGI^KO^!tytGXY6eD1xt&A;apw zrk=@Tn(=Jqy@Ku^}c-Ej)r05xlk4| zM8Yn8Fa;lODFMuO5@kh~C%xiOCQ?Rt$f7ayz64?}5Uk>2!4veX3;`ic< zdd&DEtjA@K3#8-S>SUZbw0@whyw{lxnR)JU|(Rd<}vr?Tl7CHtB}@B$y@m5?Zp zuBGm%hSBP+c{hOUnKPhoHY4k#Io@RJl3_SW()Yg|x2qb#U!OvI@CQJ=u-d@KA|+MG%vY2=CjXiVx%o@5^zG35tvnQ~eQm|lCi|DsW>~jsMx>Bk<}^E!slkh8Cl6lEf{ZTga?bZ-yKq|B-*Xiflo5v z8;e)|c1(W9K4qT=jghl0?l9$a&a<-@_dG5RI1_02lfO>GqY>P^&Yk_0Y*=6M9P^* z`3itGWfg>V5zk_YTQ67R2?HSuW=7_xP2Icpn+-lb zp%ku~_U{#aHsTrp6wB!R2e4AbK;rBOhI5whwC&FyAmAR%7n(e2CH?ox%=0+^;wLc` zj3>i~MW^fNTj$HY-%oC@AotfFy1XEYfkS5Z+dA%7!-SkSvuukmzmXpVjp13T&jLud znwbwYcp-V#deF7;D572=|9p|W&J=ee&+3j7))`|mo%9lQ7#VuMzO{JPR6}z4JI6GS%VAZca^Fq#j{=96yIm!W5cNkOZru*5zUV>PS$ zeo>FMtI?py61ephfQNNZSyr$JP$}1S(3{17-A025KUY25a^=@SioxXsQ0?y!fOu%-O6K~fPD}WgP`_QmqpRTY09064z>kApi#0*RZ7F=A z8@%~vCMN)T|235?Y_Jg?vBsi!KvzRH9FTgke2kiZ)(&n7^F(m_maF~&&S>!{U zlFO=N&*Sb-k$!cz)`*Qs(P~4V%?_6(51EG5(ZdfABQ<1qklT;E{S?pst0fDdJ1P__}uftSYYnj24u-o5z=_+D%hWCSF-2mzs^Kw62WTz@+$_|@wldh zqtYJUQjQH}N+G zY~XC5h)|+{A^1Vt)&6qTmVR%qt1V_ws@M^xH9@xAlIxDS(?W{33JP$@qZF}z#K5}& z$9RD?haqG=Kxs*@(Ia`YE`~l8VKlyN-eEYl@3y?S5X&mAIjE&JJo|u3n$b%2Q$^!~ zRXfjLnVnuMPXxBB`9wvd2xhJTjW_Yuytlx6YPUoZSH%xMyA?YBW@9$KH0$k+fy*YA zH2mDY)$#WM+)~JvrDWal{H-*M<=q}3M|2Npm5+SjX+OF|8=9kENOUg}jnp)>g;Xk) z%PC%f$pI9SAj3(OgbIxp(DD?jzTky%0L2COZ+5p{#FOfK%Gq}ZKaz~$)XyH*nNTKSaE|0jbw2^tWI}irS4kfn(RrT zT7FxX&mt{nvisL-sU`3@T1E1W4h@Bb3~2`Kt40()3XZkR9kt0=Xc%k7d@D|v)@h88 zQtF0c>nUa4+l515ANNr1tNQ?h|8nUl&`%-AFKrqx(2pPgu(bk@){6cQrwkG^s?3^= z3KfgIK$K>|Be=CLGu51p^W4GLJm)!4(?n-uKohb;9`Bv~r+o93r3y$2E_MoHLO#7d z@(^&Fk{X5G&fvfN3qauvf|%<$efWYbQrQDrs7?1EpP5dZt0c5`SGI8qSxc%6f9J?1 zYuuS3axDe=TnNV0+s9f#b+ptnA(EY%9wJ8d9~x!nGt?}s9K{5^JkX(*uLT>5i&(5= zGZ}H$x#z-gCOsYZ@WN1K1WtVaEK<5>r3F3XUs0rrCQhOj@6M{>FGylWYkgLTrH%u0 zHE#LY;E)7Ihm+dB%+%9$b)(7m&fHAZSUJqHp6_$R7%qFHeXRd(UxYkwry6|9NvZ}e z!*r{uS?QMcxafNcrCcV#HKbSRAykq*)yYRu+Tn~#94e8`M?vjJ!enJsNbiw)N>$h@ zeX$vvUx!4bRAOH?#$Ag}Q^vBUa+MO1f^ofm9xJ{vkGeh%SGHSsHV;iFBP8)Xkn^W4PblZh!f9RkFg-YcATW#^IAB-vBH00Hx63*#H+l=yLp%)j*+i|y?Mzv!D~&@knhMu2RG`8 zF55Pv2J(vCEq6su1atnoo_UzEuDfRDV|FxXMBPE_)mQ?zn)*i9{9Y;ezIZZyVgl6luy zN8McS2{HEfIhrlwmY8l++fZ(*bPS)IfX`?w8}2jO7Gg1u9SX(PkL)UvmHBaZSUtciWqa;9mbtE`l_obZW^ZEuwF(zQ7jpv z=!CzPm!qEGloClDERtvBIgKl*yaQUc!K&&FVO9qBElxHIEA?C`uX0*W)vl6k@Frf5%Dt!=&t1)bmW7 zQfXO!54oooFXc?y3?b3nn3Pg|5|nhpbawXESq0r*5-Ut(RJbvsF6pKyj;mDQ3|OY8 z)z@u0rsbjJBZ-U@UQ#r`lg$Z`gDI8mM%Mcl z4pXFX+D!9Rmi>VZj%cn?iS%pQShyrSq%tFI+Hpzr{|GW5?8nOlQM}2vfsDL}4W(8J!1376)kkK3O+jw~dIbT6^ z1~;e66Rdf3gtrOPLL++MI|HKQ;f!#CH!EI)@WNODkd8eiyNiEpL z3kWt$LWURDWr8XgQ;Q|Qrf^Tb;lFvAuJb3KeWf^r=D_dvB9!$n@w;2t?es5FIC+w3 zL_Spr%osu#b9N38<;*4TIuA)`ckjHnCiPN)l+c}46!E*#&$8AVbU*rWqSJgaZNYJI zcz3AfE#JB0T!Vv--tU{`7BVc^G_$nsWRpBlZ9jc_P;BQ;OKAAJRR7(v0|1oBbBZ)eFv z;Hc_=WI2s`^?~Rq$wioeecvqmKj;9|^S=cNN62T)|IiWk!n4?^{uW~be7PWd42eaR z;rD(KmAulX)9jXFT=7X6!jX`H-PIzygw=?KZXw@GpBam0=vH6S5`f9vzX{Kn8#p=G zd8!QiZ{>ab5&PK$(TjLB>ds;F#04!$loQ6#&-|#YJ{xt({hDjn>WYo%Ji#naR zcD8D_xL|tiGkHzC_bC`%02o%PLl=6cK!OnwCGbP+g;3Nr$$*yb4^mdJTfAKXb3jtQ z-1zP)Npv+b--L3WRWP_uGQKFHicLc1ntC#IcPd&0(Fm{f~<>IX-R9_?xO6A`7OqPk+U z^YsUzQN`nwDWZAhq!Yv4swWO9GsuSfNy*-raL0+6&L+*?0qwNk(h@kQ^vC> zte)?w)t+`2Lb=++4L=u};NMxq_1VWTuZm!|mmm_!hMoKOKPB#vf!-cUM~^a{ho)f((_O-quK5+~*B58o9+Q zWc!~l;YA-4S9$hver1JuSx1(#J3cDtBo>#{dG$uZnaa)=s3&soREA>)IT$yaKQ^vG zK2LRLdHVkP5`>c|3!vcy+T+}*WNODrEGT=suQb3|2)0n+$0uGV{j7yba(N&LnC6V{F%XIRt#1}Evd zIHJ+I5Nn%6SJb)IW?&?f5=q!QJtWRE+MZc{44+jutKb~WAs%>;cPM&k%+|WLPH81wrj~yrMVF3Bo{Ph!kL!}| z@96FXj`L;y!mO@#EiPcvx1ymJNH(dHsD`>wdV9bVp`>H+0M}5>x9I!rffG{F$5x|w zA#xUGGK4(dZ0?hjt;Xp@fcvucR2+iucD-#&01t$d5;0N){pe9)+|Eg!y74cr0D~N#MG`CoDx?y%qD&1B>liAnTUgz&hjrn z+3!D9>&gj64`sJT@njqgbX+Wvqn0-M&3juFJ7(Hl^^10$eR|#gSvNB1^58x^Ugmaa z<{c)qUa^sPe$V7skMg%Q&;C4HpnN5(MM_AmZ}0Yo~!Dq}&szs|a#bDWl~p0lcBY`ZPPb9c6#6LtRr9K|BDS_Z`V zYIrR!0ShWS8d6iSdJ=a7tc7^9q^r5F)G{ zNk<9T3gXFzP03k(xvdLXVC1S9qFuLnR&6I-Cf>If_Y;tV>-pe|<@+~u_gR%6UT9{> zXGPRs7C)ZnSw230?bN4-3RbrF0SL>W+lS`;liNMQ;Ptnme=j6v#m4=LBzLmz_0*CA zR~!CxZdrnRx?CPIlEBb|Z;`uqbgaF;Ou1TKUk-TQAJO@~@6Q>-_1B*dbSiEzgQV4; zn`4N~;a5T~L~3Q%fA}&e<>T@t^dywockg#X*SLxrF=i%6%_r;1QLc0EXnft#AK(W) z04`Q~&7W^j?V(K%SiOfq)aTCgv#s{SlERCMhq&L*J0tTOu-e)GX^%bK1c>)C`KJ`G-w4=u z)E9ei3~|*|%EwvzG*1EqpJ5?*W1>(2JU{`RCa*a3uAP#C-01QH z=terkrj*|{aFH_x7lm@Lx)^P!TO5;AOI983w?;yWk*&Og`+|EIO|lGU1y^3Jzl^{7 zQt@qm}|A0TK;qLoso7gZPT&2LARG-?niD#)q>`Af!POWhNtH-DHG0cC=5%~9CM z*hPV5YwIFe=9&gElhc}^LsEW+1>JQ$WbS+GZ+V;_x8_R_BL>hBX@Zz%d3nJyW|4Gb zkwNFAcSWbzFRbo`K^=-e5d+1i{iZ-wgAFX$Ce-#K>N-DjJbm>ik%)gP$VUb>r&44> z_4{*r->t-Unp%}_B6))F$rHv@!oq@(co689>%>Y_j~GVy=1WyYvDiI#Rf{=eF5r0? zfakrDRCiEVoLeg!*ix^P`!;60+``1+K<_sD<#`B$kP12 zd7quvpawJnvW=(nMMa`DH97=7P5;`vY$BBX@QhiI)KP;-a3u#+l5#YprMj zC_DT`i$O<(ui6Zg(WBIPML&<8o6x;#$A8tvzW50_v+y+gW_#!S$1FQQWs+#hKxRL$ z(OWx=$jt0|S8v6n#=XUGQjDsZ}4V3{ku4F%iQ|o*a5zFqN)vS^dqVLRn-^k z_rr{kYPJ2lw44i;~)Skzg_cwAPs>Z|2IdA`DaRD_5Z?@ z#n#X{&K2D>3*t*U#FA3&L1>cp!NQjkma6HHr9{g3pn_HT4zP)g?d*WK%N%1&+@X^p zh_lvvYYdyK79exGgNQ>Wi)fWvWB_@`=oD8s?gY9L2Em7X>15?{ePvSH@|SB})(_-u zT(!5-7JBd16P4&sdV0BB^Xxd^mT+CO!H)G>CxflTD~Dt(=gcs!C_*|T3NZ*`qTJx& z7RajLUSNtDD$;lgman(f+xiUl={?s4u_6LZJ)JI?3OXWDFw+VT)`jUGm*0|3;IVLM z(&NhpmI?W@jpo#|pC7sJ9)Ofi0+rZex&6zz&+AfN--sE?o-qs4F*u7UBH)brpn>3L z%XSOR4)^^O4az${)sCT)OIZ4Ex)TmSDaTI9uXX6TVb}N?QdZX_Tk7a9?(c5<0x_De zgh{^X&>in&j!QO41e6|`$CSl0Ay7>ChigOuW5)uFJ+{i~d8x0$@1%q+^(6=73#JZw z&gM%wx-s(49lJbexhzC0pI~oel=8R=jMiBdLIT52lc_q2OUvWnS-b2?8`gCMqWzi3 z`WBjLfS2Ft|BvwakB!)?KA22AB{7T(2*#1U|36LH|E~Loj^>?x5CJ`l>$MQoZW~Jn zlz3L2eIT%Hxbg;PeemCNfXJ_m%}n^}HaTHkbeAN zaKtnk{$8ev$N~MDI0UoM&D$JnOG`i>=ss{!^-+mGTt+gH}GNlUNU<~*~6n@m(=VZF9uG>^y=R(V}}&z z$q6y*;LE0dguk!r*QScD<~_&0cGe%52H24DrzLz;ap7ntIxSnOeeaU({P1?Q$aX1% zl>4Zha#dx|4BhkJorY~H;L|lunS%y05S;x2^^~y{@+8qV8Enk{pv(h+&l>D<2IC8q zJwB$Mi%`x|11a$*7Vwk)U<%nTj=$s%;3lyHCE&((!o?#>%c=_Q_uTNQxFQ!aoqS-< zhO|rt3KP)WzydcAci!B1`XUX|ULUIHLIo8>*Fy?++-*Imxp7m8cO%JIxnmC@?NuDC=Z;0oD52j1bMpMTS`wHr=-DEJ0=OUB&eI{)%n2Yy(Fxt!IW! znQ(ZOkAEqM68XayP3fc3XU6w=Tb|VK=Egy2X9!Xna=rNpvENk47rN@fl)dISHtX9H z@K0`d_;8(_TXTUM2Q~qbGrc6W=}k(w`xnD9d8vZOdI|eP^8sQCOOh4zxui?0Zz9zYw4s4oNgBtGV#dYV3X z4L^2c0%yuuFx7Xu8(87_*l3y{&W_&nC%aYncl3VBcIaj`Qg=MAj7G?>h`^Ql3jRpG z=yQ5Iv_x_Hk~pr7y*k+(d|q-rjjlxaBe$}AhX1X=)I>79#Ca~fyVX6Jlu3hT_o>eU zCq*pFEp@!eI#m&0+w-=j@qy$IkKq^I)$pT{eVd~w&)```950I94!(K#*>zOusNgy? z0&*}S(U^GkE|s5m+7ckm`Q!E(oxw6o-3n3=T@UHWIQKnX?h`SxJbY`bapQ4STJ_7fAAO(@Eo zaXjI%qmyxpMmW7tM6)ZU8ciN1%@|hUp7|gX4Qa4S8m`kUzx{d|*L#!KC6vXIR^Csx z2XkJtbUO+u(Z}y8*~%z2^|ZKQ#z~5R1Bun0PwQuek64YYNDs=eK6Yenj*WU!0JN+GY(B~~XBtr(M zM3m;EBV|EsIkV1QT(e(iBj!WOWI4foW)ps&RjeXdCvxR~M77B3nw_aBt3{ZZDqau| zY-y={l#4o%+m?V7h*1=Vc%XsvmiSoBCuT*y{@~LQ%bmn3l8(*3M(=KMPjzrx5#0SD z@>c0$Hd8M%J2m~4D!#YxcVti2AhWnjhGNxj54l_A7A{qem4}7dYfuJ_ z4DtRy%dLYOLryh2vu$Gq+;YE6T&Bc5=Ex=jOqlu)Mfo*GS6v{(-kyk3y5fSO^ZtqC z=o@Ko{I`rut+63vwF#tErQ&`Q?(ET#}Kvk^J&OP#}&gM-I(PXhQr z{u~`hGf`W;rad0qUH7KH8xTWajStq#v8CRjoq**tSzpB`aUHEavW0uM*I{G@68PJb zDXy2fA&&=3o&?sXIM?9C!eHc)<4`7wewZ2>%UL_JfU0ey_Uh8(ZF{nXV)gZ3DWNlS zR2s7yLD1ODW7qjouMWCcCmOc{V4bnnjOEZg(*AwyKFOHxcxAb-yX4R_s{ErbY`>E@qEUZpiAE?;;>8+} zrS)B<^$^W1*w+r|QE3>C4K9iFx0bvEhjvd!VcINyy5TRiXng$0EBrL#{uAxk`aa_f z?)`dqSS%=A4|!&S-6$n$r4B}6Q5$iRE*bBWL!wU@yRhRBrFSwh(L{Gh2;vg6<7t)V zzgwVqtR6oV9eV0q)P@$zJOm%q8#nKvj!aCJ*Xcp7rGAey!fG81BdHPtn+-{LY4^i% zII*REnW%&H)4zrqO}o%4kd;JHs?{;>>biLWw^OfFiCPhT?>E>noQ94}P9K%%nxzzv zpXtRR25gJMI8y>D%Tm5DsDYWE`~>N`gR%><4U>Iq3-y9H-w*G$ZlT<&Epa|$cui%% z&g$Ek%&*?BJ!FiLkXLJ53gdDiS1!TL^3mFF@9CC!$7vJ4Ga4Wb!4&r!y)-EeKX0`e zajmTIX6Xv@$2{(>V6?yO=90c236=!_9ncxuH5YF=w7{U|q>=e8yocEzaOF-2l-OAb zXE)ybKvBSz^uH|tzWY?~!_K9ypuc{t(}{imKu5Z4Tf2D}I^YDr(#k7umV>?u{kj_| zNsR~CXirmHJ(do({(}2ZXH-54s^$hgfXY;p@2%a^6w3oV1O>gDK*5ea->Io&Wme^} zl~}Vs4RI*y4ZZVqpKWp>&jt{mwT{WPy2E}QGaf7~@~}6EcBEEC$I_WXZ4R@{8I+wS z&wJagOa*uLAk8iWF>m0a_@CMR6na;jSd$t<)qlYY)!8w8!~$!@+GZJ%NgbW?$Dk7`VD(5F;P&KJq1PRr`<)ve#tgID?jbOqjcL>a^XY0`z zUM4se$AC>pBQ?=r0hDo1Ew*qM$PAM)W+zwK*xt>pu1&oW$bp2XJWCj|&kvf=1|h`B&xR(2;RDh;cL+ta;^WC*>xpm0pGF@}{CtEF zK?0N$xCUeC<$T01@P2^&>W8(K3ugxqx;F2&)EE9(O&Eu3{?y6YVhlWGU#n*Za!axT?_5Twe{8M8FGin5o5}k33?Nrx_%JoAL&o?wmbf&;@~SQa((G0 zch@AhZ?Yd|Vs+2a^+h_Qln(X$^G&mwzk~UHYj+W6SL19nQ_QXsao@%?sO06{Mn&*i zO$0pz<+ysZbb0#Gb{rEbE+o|ex)ezw`q%>P$QJ)?fev9~Qyg~$P(@{h1EHyQ#t~w( zkRXVHT_k7a+Tt3tU$wm_BQX3vmLQ`JD!)FuAjN%dj*8%c%v*Yssp}zgx%{Je)WaPE z^d zM%bDV7Wjpt;hAf+cggQ4y{B0JbUck=TSI`d{Lf%$UT5h2T~+FRbcgyZe+yQ;Kt-SO zm3SsVU8R5hzgdSVcmaHt5ktdjE^vDux5{PupH7>aQ9*NXHGa&8Z=9>%cE5pMY09O! z3DnQOl2IBm%?q?rW5&~kBmd`VH8T%D5Rc$l*re_7abNDdO?NgT^Q;D%B7fUY#sY!P zX$Ww46aMZB`0ovPsGMyNciM79++vwMfo=(cQlC~PgjyywP0*eu9Jt$NYAvlGZc2s4 zjnE=T21)2_9c; z;&dCn1D{zZ~LjOFdnggT+7%_wvZI=G)zJQB#HPQUs7CMoxma1Dyq zKoxdyNBFxFoDP8IkQ^3QbE$JM3j5>D5@6P#ht!pS1!XV6xmCSx4NQFU0<|A8GCH!y zwa3t=N)18yR(sOH%WjQ81L{F1=66-{ z!4ko*f>%Qp;Q-C>R`S+>_J1uX{5~K+(<-qiH}Ze(}*yU zSxU-iLnYhJ09Te}*pU6S?H5UP4POfO+xh57HC5OPI;w(iq)IhSHO$gc@H#z2Ev|l% z;Y#}(ui&ze@vW&FdWqL>PoL)YFG>4d6-ou3=S%vh@OymVSunaWA6(<15YgpSBn}^J zq5EFKqzqw~kU38MC=o@J@vek9mrqM+$@6>Nrb)HHM<|$`O3R2;z6j;~RJr}dv<+Y( zAvIy2?lPUWV~ERY_@t*m?>|RR(LD8R0h6*(Yj{!ovyZq5<-G8T_BV~ZVa^&o?j+x~ zm^Vgd3Cw;At3y2wem27zY{!>609J5r@jOo@(HzV&(hCpm>Tdi|CC9`}5KbX3i{ogc zO|&7n5C(5c|3>PdJ>fb>ZieEhos`j!YTzyOcPh%0Q*Uao| zUu*BR_FCt8u5QHqto*E(5+^rZdK~=q8uC9IN6@4{TDEa-W1MR&`Z064B!oh${jW5f zEDY)}jXt79>1K$LWq8;f&igWjV7wmuHpn4re{@n-`4(!I1FXlCk_ptIauS=vMCaa? z3}awj%e6N)T7O=*D4~{IaWa){6Vk$iM;ja&i6+P%^VCwR{$kzs6>W{d7AXdrA`>nO6hvLOJhu%uFTb3VY?l0nVABSRYb@o9(}SKb@iG{yjuT9qgfYb+Z9 z=pEF_N|m*rH}EAeE}CNPS>k(=m)Fp+vly2zvWiL~_`CDV_S6$Ly&bSeepNc9VqWi>=iD z0C_HZuEKAt-#CWk$zTf)ASM16umM-m&Z`orXDcLY zkmdf48YTqF$iL&@GYC{uwkm~e0c#@Dfg4%jE#$u7`| z>+LN460=njrIjDC%uAn)`$a+okea)br>=nv@!pxRHharXE_2PGCr+l`o5#;7b^WXb`L*0RkMa# zONX{TrDzP0HaaGL9xPW0f1-W58rFSW3j{I%>H}UvyB31OCO!lDMyJrSsx7C>gT<$d zC72v-G0N5>+qBoQsNBqU&xH+$9#%(?5J(vPd|ytOo3L6Dp3nZUV14e1eoZr!%SaZm#Z;QY<2GghouEi)qSU7;p9`z zVZLb8B|}U(0008n>V{(5tU-}Zl%C|dZ{{y=AiVZut%+gACbw5`Dt7vU06~Tql=-1tP0+_5LwO2Yl+Lf z*?7#iPm3+vwCVRtJ;da{sT2N z&hVn3hC6WvYPITQlU@69-|_@4)i(%ft~uOEIz73;ZPtl|QSL()%PJcsnL{PxoOk6$ z4L>WCx+Os`Jet{KDKci%`seFt)`e&RYRd?H-VDYs1US3tGwD|oO9by4To}EHw&nMX z@M2I&^H^OPyRg=p#;P?kSjLV>Nh6$09q&FnKiG)zGJ1_E9P2qWMrQFjZR+>g)0XE% zbaM56_&;1%`l}-R|6i!$_O0~lJ6CQ5R&j(W?q4n*!kug-57zmjy;TVGJA_0&wS(JP+EFt-hLz`tA+I&0(jPu%l10pS8Sd9w0H~MSbtgT)E&f_}W&TBVd`Qai9 zz_GXu)arxtbH$aJ`N2db-2+Z~S7Y#kJsd5g-~PLi@-~pnaf~PPGVa~OS^$pF(Fz%DC|wljziG_lHkz&z1ZFTvy90*mdv@S?u*r7vdHFVynhCRH#vsf)mN&s`C4jQybWqwazKNVpNn#Ni6UxNXrZ_bDG;q$cUeUa~K zJ&y3%h~UG9a=|zJTTT*{rMnB)6A}+VXrN%n$#=uFNLlmX7C<)}(qyWzU0%I(sl?;5JOewFVpdsbnq*iijh06-lPA z#z;4OvkJR?xIKj3e!8!^B7BuJ6Cxg>lIx>Uz>L=cpeJTf=X`w5;R0Xnhp^Mo6UOV- zPY>$>I3iaA`pv(m<`0?cS|F=ZYziS}a!o_$Ud%Ql;wW=RYuk3Y)-$fM2;qmwOSxZ?VhmrB)b?xlgM%d z;!me)ed13hAvTT7f8#)!GoGH7Oo~q; zKq@g`wMRu}c%3Q|?_4rP+BS9WHde< zobtKMcI;^=t!ctWTd7H9sajqr>q)RkoRQ>f4I|l^@2pH07H!gTQlksi&2v<=K~Dqy z9r+y9&H`v(@egRy)j~#(_L{4?i3aBq!L07TXx#BknS7pHs8@MmzkA6r(Aasuf0K2} z4&65J^4Y4*f}Ln@`BFYDXw=L*-Zp4Uvh^DE?Kp1`{E-O5@*wniLPUoB4nw3pdj6JF||E%&d0A<1mf{I`JmM5dx`>_4e`OeVx*z@-AZpr+} z%5ZusQ5`mna|>G%(GE~1%J%7`Hr0i8Hg?`-divaLc8Y;J8+|Xc9&qTW%1%9RMaD+E zQt4X8fGuw-a02!#C2vz(&-XOm&P`lPUhCvA(g_*u)L(VR*W4P23G;|xuCYKkX+#Q^ zITvQn0(MYLZzA7Mz$?||k0CtEg4f9aicj44FdzO3-tpxI9C2ytcHFsZ3VfbukQ&IE z{%1TC;KF{v%;(K4|oC6 zI&@<6((UMZvVln1)hr;H@E!nCX>M3I35cG=ek!LfQZm$PjNCm3^f1w_m)c0Nai52) znK@&4V$4+=hrA7;h#G>zd6s~RXSW`yfX$p#FHl<6?8h8oSDRmQLPFk zhkgTqQ)P8NBka(pQ3b!wf2pc{-f=1w*I=XLaDFbwKM@6*63oFlGhZ!oC_Urg!l5(- zvD^-FbY>`{D9A;rVDxhFHupR4Xtr%KO=w*k{TjjG)lBK{0>Rdm^RhtW-`!iMGRAN6kJ5=IGUNA}o| z-1gpbY4(uJF^kO;P8xH#`lAJu*v}XKIu~qwl~e7J06yd$IsZJsd%?eg9nhOE!)t&3 z!1}f*bK6kmkUbGxr^G>2sydu|t#vr;*I{&4CVLwZM>PT(XADeokYz8|7e^4J%#^iM%=dgvg>=I88 z^am82S9Q%XvIi0Ho+p*F*b%0VoNlUguAJ;JbLXlee;^*dhxj&+>Y5b&3RrkwLgHgV z?wl>1pf{nFZM`?F0)AJJP z7WsT*^NCjS6Kv@cvkRQhmBf(kAqiNs6d-hFEjU7BwH-d6!$^qIoiNkq{9W3!*mW#N zl)-Zl!^lYB_Rc&}9&0vGoE-}Pel##4eqno&@N+z6m4vX{E2knVerr2dS zZ;NL^{<)b1qoW%O(i7&TPB{nX0e@DwSrB9_0=X&SlzX)h>>IxVY3yE$CV4{voI0v^ zO5X}4ako$#tM?FR?|8*mjvvQlS2q>xp9`Qj%TC%!Fi-NH{rY{HPPDj4wp+dw>=C5u zqO+Xy(27QtMeaQxawDDf@cTisJolrOGoj^c?_XXkQ4<%THW^VG!OYG>fqtuIzf`0M zt4906{@N=D;J?~{9p%%s8mrMc6(O$2DuL{9zOgjyo$!vEzlBu2x`Bm5jwI$gvVeI) zO&+KvsPVqi&r#0iu01eQZX!t|JWqw!rZ*}E+0(J4%VdJ@?Gw4RT5erG+Ow2?5xwVz z906Snpc_L~ZTp%Lm%DM%t5IB)#+!w&kAw}%)70xg5=3e&t>`x0+6+P($Dq*-=8i{v z6UD3I=c=!BSPLzNNLlk*P2@(&o&G#Wpah|&&uX?m=HmU=W@sjK)l=he906eEfCUgq z*$L)n_o@E#pOoWu;=$e?4mbrD4ja5P`g6~~Rm7d(KdS{GYX9@L@sQg;UqZs8_kZWo z)Z@Rrfy=C^=Eg(`P*<}767)Nxd71zbWr)4=?u6L~N?@8(P93j3U?ySm zMx-~nDhN`$KE;R{$LP&3NTo;!P%s9haeh7A-wp%9Y|PxNfE3hrhEsGGQYdp|K^Fj! z^7>9gL1h|~c#9wdbiue)KiH}G@`sWTBY0355YfcF ze(cR9T00z_Q$k$vG0B@9p*TQ3?B?(1$~hB(ye1>7wtz-v_tB*91$)UgI@OP*DX60Dy zQlrRn#3MxV(VZ-W{`&MtBY;=D@`nQW;}1*|OJ2-y;=%7OnL<%c-hXUnNS0);2S4q` z)WH#%O&z+pY`}jNiqTia%HVBfL$_OTSSR-8bgZA#Nre(wrV^ zPI;$4!oZlfxBV;joAcNp6(UkX(-*nJry~(U(dTlZsO{iKwF`ROG7xw0F)k$h@B8KA z1pE$}VKye?j~LdVg=Wb{o(rE2C!PL_ggzR{mgBDW3g&OOFuZx;NkW35DX- zhvIO7oPz0i=HU|cJ(5JI^^5@%pnIH`xJXS!Gn@K0v6W8nS;l(bC%Y`MY&9F&J0plU z80#RTr|V^1w7`vK$jg4Eean}KA3%L_gfG*tFT?d&&3WP$l|wWLe~b4qrYElch^4`T zTrxdRKZs3K^vSX(Hu2Kll93(VJ%7HQBeDCU#2w7uz*FRci8x`_os`S)`ck1}1wdGq z+7ODSs|w?!RI5nyllWAp@X5{Fnxcqrf1KXKvS=-%HU~CPi{B*mGDPp~k`ND)BPIH5 z;?m2k0c|?%600w?+Q-Loi&LB8z1btY?TEjZ7F%5vmg7qn$BvEgZqAj4)7vSuBRp19 zG{12W)zbf7su;pQ29!+d7J(2F_@nMa;s|Q;C6rv9+_VEO}7Vm-apC|s5 z7Ucs}^33l;SawWh9`QszR!m$7qu2y=q8Y^4Gh$*H>q|Q)Mzb0Ctfbkc0aQ#Wa~3Zy z59r-pKWj|E2-+SKLavBO5hZ8uJ7ad<9Zi9o*Usw8aT7DfFOW>BaL@DEOmcLryK+!i zv?Y}=Gz6?Q9%sBEugP?#mx~D$Cv0BBs2O}@T(hCnO$B162`E_+uZS41u-9yFxG^qd zHpH?h-9VR;+n=SfDMl0d{S4tvzR`;#NNOfFzXk>8$d%e-MQz7T@qF%l1QEG7-%+FoW{@ca)#`0?t~?yDRi%1(umd+mG{5ka8@+T>)o=HbEz4r?6sQs%`4>OB=)Izkiv_4B@77{IcON4g;MLn^imm+co z$({GgR0?^Gemr05CA$F5F~!Uf49|~Q84-p9=MzSKJgWn_0u!l`nkN1k0xqgFB(B4c zttM@1XYeN*H%ixpvp>{~7=vhJ_+=`VR!b{Nqh?JGh7K*?=<;%@k}>tV`cU&Pnp?1T zvl)ZNxIzh{@Qs80ll^Dp4@(oWmAkD!J!{|J;O3e;TYMYwrV}ZlJhEDxzgfk zCh80VPC)|zJZM5x)8sKX_hFeV_Lcwy+MI9wzGKUl5aL&&oYcFh^E015YEZJ(rh3eb zj2o=+`6Fu-fI6zth)vC&jJg$6ksGK0V$I(vjyxY^$x;ll-u#ev=GVw0c@2^{bbdqo z9Ft!2FbY+q2VzDmQfnYTn; z%v<0$4-99qnt5C~hmz~?T5WNsfO#oeCV$vp*E;L+n_j6dk@BJ2Hz3d8}}~$s=dhyBjcX(vvqh`<&+m`K(-3b1gZr|)7urW??kgJuX72}8(IxLKi-1Q1q*jynwwWc^@F>1u3N76V~ zR{6h5bC$jkQ>ba()=r*uueN9_`o&-kLVZ#Ei4HP%kx<|_Z$xlAg!B20%~LKF81S)k zmr28W;^s$+uPZ=}_*=GpA`({Z2?jok8N%mWnT9`z-kFQdHdWe7JIy`0qLbi*CW?=9 zf%DlLB_Hq3_0Y51P1V@wQ!c0@b)i;~4n^!sNNlN<*G=zKb&A&x{`;^;OyX8VAKr>-koD z?7ZZJ^vbTB5!A{u`Wf&aRHEIjJ}mVA;-Zf*2mTS;L2W{K6)*^yOE(xO015cC?c;h zU!I!Upobg>w$RLf${gQX5Dk)!=fY%69;Xy8V0Ca9C7fue0PPUhKl5WHZ^c~#nG+Y} zam;axetOT-Y~B}F?a4DSpnEe__XhBgqmiq?*+;U-7_!{POY+rX(iMDtD4A%8FxpEx zg^Ci^mUjGggnNI)0&UlJmcz)s?i^9XnaC(CtJmGn91A%1_O4+-n+>dbTfUi`BsW$X zsFn=!nnaX%mU?7TkX7(Wu$;d>dhCLNImP}YnDYgi&J}B6(_J-9|FiXzzQL zC#kw4Zgjf08U28+6?6HTo_<6b$*Ep!?J=y6b zR9xAPWf(Zuu--B+J*my&Q;~i`uT6d?@#os z3*BUZqw|@iv@r3TpI`w-Gv9ByYRQ&AK-h&__{Sc3o8it23Gjc(qpx+AB~x#o z#C`=$`UZ@g+t3Q)3{`rSVx{wjZFDgMkg9pon)FmFMKQA*st39$! zVne$;EtpB|ZfZF0;%RApI1$Z;<>A7??{0sKBOi-*A{|k+J<8mJy}H6IPKKv-+&r zmme-S)a@?XfIQjgeYk~5!|@J^JY&A*T~or$-3jb)5e~35 z)Da7k_iaKa^+5rY1=flMfs(tFT@}rCV)zRia&1Sp(WnU1XBc}XYM>TMF3Yn1wy?SK z-TUC0yt3B5=y8u~HmD04+-kS96$VWVI7~}%4H|RES_LLwk!Ol)r#^^GYPT%ciQDYn zzpMwHvqmijp?DLPRL}7BWbD~?6xz0f$m^mUJ6^edwW+ysw<04SM~4dHuZj>ps&Co$ zC%2-^vn8itX-Qv@d2@2G6+fUC;?ReKJP{I+Hm^crp}%ii{`T$687YC{Z{|2Lx$z0~ zp7cPq36o%aGNvLm-crQ+#^LXI2!Iu(%sGSdY}0c_I5)8aZ!Y(evXyNn8L^*9*C__v zWaI9q45xzWHN7gT^NBGn`Zj8pkS)&gOR~HyppC`76-lw#zGTBnd!!Ra?|$>JfehP@ zwd(vC<$q4^B{69xV3H7fV%wCsMzn2iDX2>m85rfT9>gMeTCoJk*NdqRzj6-f->}p5 zD4ChzfPt_j^#5jCg+ zU=7Kp%~ihI$bHG%P#q`Dl=ii!8lxP9&8|_3+)|c5T0*T@>^s-uzb750PRb6XbuRIman0Q=PgjnRah*{$Qgy6ldz|SvBVu|^$?GI9|bGbx&xi@XYv#*7BH{&AI zp!@rXznr7BkLh=Ot-n}Xhh}S?>wPZ&Qc0&J5Spq&i8dFl7oQ_C$;W7;%a)~iXT9U{ ztmY9J0|{vfRhFiZIOJTulro$JLN?b?D$76+IDbGlGQ&nXSutNIT3212IwZ5--(&LV z++=w3k?{M$gs*I$$N9f=rdn)jOsFn3^>EFetXPrqYoXNMK*UUo)!I?Df(kmoNKrYR zb$Dp65<1EbAqc`HGa6Izd{fn&vR!_9@m$7o3{%7;F|ST(&2%h-?L>^##7lEh=+5LH#7B%>2~Uqldx8JsPwl zTDGXxk{TjHD=HNB(S;=9yo=|=_k#IRy<1OnrTDjJ&Ja5oW<1pD%kR25+$^n1znnsMy1{Sh%Rv{qDZ-`QBfGYUQv9h z@{QYm)Zvq(O*F_8Li5`W8a8C7xkGu%;B61%q+SuJajubXM$;OqTpp|*t=k*@z_Rjl z3jZ+~@!6!B)#^2VdEQzKosMX}6fASkGOQ468pTs_P*D-={hULIB$;^$fm}8RaH73> z1((_3yrX6+%bO>>V&nXiC6CS{CyT5EqMd_Z89=0e1uyj~uhX@Pyko??Wp)SEg|gnG zD$z`i5~;PiK8jM!(#>V~fXTyu`Dpdv9_fbTnVRPmQ3#3a2YSK)W=H-Hn8vZ&Z`NA^ z9+K)pQTXXAgu2_nLj&Dd#`Kza#zSv|Ps7v=zaqLduRdDOAnWHc1L_2ez~L(`uty4l?f)siqO0XX_KkO~9t>ds7^0?3P7{&MW(u zsdT2!F8hpw$@~8#z*vI+*N^Dj7(ml60vLT|XR{mD)!@4*cs@<0YmXxdpa5RBjh#0x z_yO{98NYHOO0N)rL)Yuht%t;5=YYR|n&ulvlBUdOb!mRubuY5WTCG1h12WuBuoh`2 zxc8c$#Ju89j)nhu*|ibC=G%cc;Mi7%GfshI7@S@%uN2ex<-2*FDJ3wJIzR&GNaoQt zTzNe1DbR83yQ8fw`@04{_i3b{e%Tk>xz+Oc(0G}ek6p;T8538Bdc}GZotY7HxxYyY zd;N3S5`vu0A7QIniRF>h6w4Va%&YW(a^w?75qgjSMd3lUhX6`uIVLU{u@^9Gy@SRZ zseSe|^r^m%JT&HU-S4?uVqX%Dx#2efVFS(zU37A;yE*wi>03a z<_A_IS1@NFG6v8tVjw}O?fX!o;6iF`lY{-kfpIm=FsV$Gm*VXef&!OUZUKC(K} zuSTOPlx>`8tlOx~o30%{;VS{GxE-)PBGMxo*V6H-<~(KdTR3ZwgDhj z6&Q$xX+-`qkuk*5JPFK{-bn7XcJkZtTL%=qfD&655X=7d9kgtFiplPh?}#&Az`RVq znI%a1(Y6%p^GfM(0nt_#xv&qGaQf4G+EssY_*eZynK79S>=FNPo{cI&P^FMzE60m>{ zO?X|NXkR!c=_NyM8<;?s`doC)N|Lyvq_Od){mX3Xl~^)K*FA|Er$tUEl7bz+bpvq(Jrs51KH(tj?wL132wwW26``1 zQ1XrPL~qtisTsVqh%oJA<5(&KHo8bckeWaPKB@w27`gIa_pwFY@(^B#2MiBbAZSYx z;w27k67?E6_Ui*VNtM^C*jTw*Lb86ZSaee96C%bUo-mAnRg5(;6JpoUih0n#8=Sin zB5@&s@QU%rkV5IV{jYTPG|4~@CY-A)#twaz$$lDlt7ZUM`^}_V3v+p z`bZ9`Fq&BYYj!vpJO^4%fe38fZYu}_`?cXI*kRj#@Lh0<)Tg?f@{HzMa{Qqir#AZd z87J`S&`mc-QvLUbB#rk+dfPy*t1bJZ(?BN5uR*p@4dQ z!wf8=yIfTWU>5+^I(qbXb>sh9VFIX(L?%3CP;zrjiwa|awS1Fo);f|+b;fc^C)Jal zVg*u%v1_N@)?lIQX>5vtdjHo0<;E%VK+?BX=jx7=j7a&xIUvNbVkMS)mt?B}a0jf! zBBDdVJ@LMaD>*tWZuvv6f}8gN-!>RDj8kiPyrD1P#yE{Z!BiVUdbkACt@oEZ zeSrptQaI0E;L7cw>jO=D06v3+GC?~tjWO?z99%385HCK?UPMFBvys8hE)`cyseXUR0Wa1Usgf4F>|cRF)r_4+8bY#SCw#IbrH`V~MD$C}Yy6PP+9nDiQ&`|~#&zG6Oc>1EQA+fF@ zt}T2)&hbzEE`S<;NNQnfgO(}YTQqqL9`4>H1+aWBmvMih0&(;6P#YJ-F<-{tjIY>S zs1T%_A8pdcbnk30|h8$+?S8N5f~^) zpj-Vkqy2R3Cp`Jv5u1Rl{kF^ALi=r8pU@T;AZM2l*A`OMWOVy0qVeZ`jF~2Qi5PRR zFr0&R%j+S>2qA@Ok~QdI`!$6iUS2kB!+G2LZFG7P!Bo7Fl(=g7cVf*)-3&C*GR?dP zUmq9hAg$%Dyfij5s7@|Q8S}tWAhoYrJCJxjG&B2QIW0dqFm;4F-2F*UB->t2T_w7;J?r2qI|Al_;5fbMN{V_zzVWDqga$;%}>bWy$mNOKDbYYB2XuMh_#_`re zeE3B5J75baI|3^m)8wnOQN589reDvQxW-9Js-QpKtxFeFGfcuXO%OJ%;4^g^0xXDE zF99h3zMxBu-FGKx9jBjso|pTcXH(GR$7Nju?cfj6#@*klnBL`Fl z;FIjiw~9IV{6=}kLHd#YlciMip&DHc!KbBYW<0+edi3xu{^*bg8tLiL@HZm1eg{TU zbvsfHC_QOoVYnPbyv-4476hCu?9AM|JHB}Dm#ytn=7E}72#)@@2xI`MvQj^-H`t2o zR;lALYYK?J=<5IrndMm9&}(a1i5Xqka4NmQnCV&yqVF6-jxcGqNo>wTdb&o70VIR% z6XVhH9(R%3n$pv;QS10B;(Y}tB9RlCq1QHMc&@4mvex_^$ zk||hbKut>4*lvp!5HO1>OWp`jL;%(ECj;y`A``9D4Co0xoMD;U#55A%Mssn30Oq*d z8YFC^7dcOmfD>yfqC7H!lyPNrcqUDcS}uAy5Gsx^%7m+q69#d5{}MBJW4vpwqNh#} zPT`rlO4Sl7MnT}rfvc4hbzfC%<{!L7QaB4#Kt}t7%$6S%;487l*>qS@QhMwdEMLIv^J;&m?U70)p^%yxdH2GBkM-VSqc5P;2ncKT zMFhEGRuTU`7bFVOChr6f$sS)D^0Q{%?V{jpzWqjHI>j}#e?W|Bmk7|s+#0{XGlgT9 zWWxX7TeNE@cnayi=LK|J7o9UR%#7FmHJaYY42T}93EX+Yz1$0zJ@B~_nBq?GuX6o= ziF*8f&&f`A9~&Gn1}79iNSgO>h$T7hb^eI#Ym1c$kd)uBW;jAy{; zOamC{*z>@pMrhJF&UE!y)Ypa?uQ3d-NWPO)2|eb-6gK=>*Ck>Nig=#wE}N7hgcOrE zokS5Mtew2MCT{E0d^PcXuzvqXXq@t_EQqakNQ*@)@Jv;*3z(c5hm9YAyk>?_DxVaG z4XpjXCHcB6j%#qJ=1!ADJGBYj!E)S`g zo!?9YT>Ba7{4Usxsh;`IIC3^ds;?;>n1=vJr$j=F<58*Qc)6%5ViZIxX}8mO6q&u! zLG}{4*yq-=4d;A_h3Ra8&pFm+a3<$ddWLN`ul%LNV6hY;aRA{u$wzAdqJj~0dI+u& z>7qUM5J!{kHc<)ls$u^kCF#egOgXuuhH;0&ajqn^q`s8o~j#hPQ zk6JXK4dVh93b{Nq@r9zdbL>t{Jg}>fCwV4 zgqZ_-R|?QL4YLG$WIEWq6PDfrU1ZY6)ynb$$B0%>TQ*oH<4szApc?Vs2>;Kx&0s{3k0^=&;M$nwRcm&vbw=qKky*ISb4v zwX#fSvgdlqQICc zotrY;n=%Uy?!-vH!#W>wZo4Y`(yv@~Znknivfe|zIy2$9eBjOnwA8?yrtV4JUeuk=5id@k`}BG&0J#U=i5U^wP?u-UR3 zu~rx@LwXt{a$rwFeCY$U2avpAw#k`uQy1e)1#5B;#U0Tr)***Z>9Zmo<$0Wxh#k=V9fu5Yx_F#y5y1ETLc6|2*^08EBrqB@;y3xgpWeGVrl33TQ{D*`X(Py zkyA4M8rHkH{c=~cK5Vk|w@cRcg&@z1y|7nOVM4Mds7+%m1)pc zn$hB7Dr#^De*2l6UotmB@MF`Cq)zD^+Imw6@-_4m#K)MCiQUToOXd5kux+VAJt_Jc z)Mlz|{7ISTG0W1UcRDtvs^Fz!Kd8zJ;vnT8&RQ-(KZEI%(SNpp(P%ec3W-h%8Ad|5 zeX28%wJQsk#{glnSQ?!?K}ww7NIcyX1g41ACfn<4>gbPqRIJU`nx*I){&(_WgQ>YX zJ)z93_K8*Rr5G}|VmtH#S*06L!&yKGCo0lJX+*^dI{SAVJ{D{&<1_%;f##&bv*3_k)|Y%dJx93I@LYpRfs{2RRVDhhlt6lHe)-k7%lz zwTkufvyU@?(fsFHQ=7pXpX#fsu7AZ~^=uDiUkXD16_gPTo`l1gt(pGA2ldpnt#x9& z3;&NVhGd=Gi(chbxpyDl_2|R)w>#|TwL3hf7hRW6zaru|w*SihL)bD>uIw5f3-ZVK zIWTCPW#5fG3_D)F4RG~3qZDCQ#ex$vC+{9`rE-d<1M+#tbU59*v9kw1eU%mrcbN7iJm$=^bd+Gy%%Mag`VPibDUj0uqAMOr) z)@r|O{Gp;51<+k=P;*cm1vKt?nL&D%tA#Gmhk-_1dIR(8Ks%{tc5%1LSr4MHvsu_h z$2(g<+!%J<*>>a3@z77{b`T*MnoEn02nZ=-lJ-YG)gk;v_a6?MwLMUv*RJEZ!qw-x ztVlTv&KN-x-EZb#wr&9sy|KhNS5%S1U1lhd3gW?WySwVfhiTD{-S;p@*nJT|s@wOy z`gJL^IV(DLN*X+SDZCrhc{$~JcM8nt^8MvHlJ*PMAzVGaAhUma+%*&%gjF8*qF#5t zqF4KNr%PALqPK&vhyLN~Ux(f@hU2e)Nb3o$pxRx1cQUL61E%4fcX#sMcUL{@VcX94 zb{e zJ*98;%yOA*=E)wh$T6vC2H({;GLhp*SVkQfa=l#L_RzTWVV+!H2+p^Iop!byOT(IF zKa1P@vpicP+I|UCQvR{S0tLOZ8rTUSN9_Vk#PTu2;pVDpzRRGi&mj+7%-Zhm9yTC- z2iLhK_q|&>^qxDVCIoJX=YfgtEFzK6r&?uFu)}Q|knKKOx`bWh+*@4hTxS-ET$=kF z*W0<@w(8yAq-Ozb;vMlvryqLBmM@}Rjr|}>681ro3u{7`y&ex`oO2gp%04YBZ~4o; z?#Y(hes2j7%WnYfg0BE_T$M_+R`LGxr|Fg1k{FwQ63J?l5-*!ZaNy0=2nIHZZuH$e zfw(OxiUxKSro8BVDNK2Hv#ogg-jko};(&(UkW8>b*_ zV8VRmnc{9RQPp!GS~;bcOPu5M79bG{Zmt>AMWMmgH8Yom?QGH+pidW*Ij*J(>|w{P&s((=B1O6!xn&4)N#LWw|u=>)d8J; z$b!p?ccD z%qI>Cl?!CMz}>xxqVyeGN%K!5g*xz>ROi=9j&_nNt(;GpUu3JqJT0W#I0 zy1^##hGf|VOUpK z+5q$nghW;&_2QY)Gt$xR8F!)`UB1tH7~0mmBII17Fi z*eB=HFS{f5c|};d{(fJez5Uj1!{QvEp|*1eqf)r7xcb6AwZLA2o~>zJQQ1msBPom8xhmqd^#HSv;k zva~`c2+`T>K$8|qq=cqHO7!Cb-%-<2(K!ZJQ!R;ES;B)bjp3781VxO>>QQ7Ah$T#7 zx1AVYQO4pedjjpILvGwytI_FLI^t5)<6OzQn+#Y(KG zk;y54PB9=+W&fgoKqkyb1?;R$4PQnK=%?!ZFntCQ!3-hR^@xX-EQXnrAY?wmLD!C4)X^aAxU@tdl@#)M0{2uw5q6 ztEZy(5m~ogHVd`QdFnUQ51YGxT3YHqnPLpMb7hU{G*(S$7}w*qs>ziF(kF7~0&g16 z?he6jxht>`-@PJ=TcAh%L74f2AW@vi9l%+q5k0PzmN7BDcV(4Cck)nu>QNt<4!MWI zyEnkS8l>gyy7CL0gLxMMc%gIHaJp^#eKefZ>$63yf9dPJj6=ll3~5{@yuhrw2U=(b zWO?;ec@3-of(F9L_CODbt!1zEclyBCZ-Hi^G4U}`SGtA@1ot0Y?uPxUlpmx*7#wr{ z@cn`Hk42{dy97gl)=m$?Nt+$x(>*YXf1GO%H#_NRr+a5tr*SL+Y|H!7w{o27LE!M8 zL|l^LM#=E?DE!wB0UdqiERmm{0Y^r@%l^X6KO#`?aC^-Sc>>A@B9Ps0qC_vIU^jiI z%SnKvhAZFyD_}XUuz+xOr?8sP3M$!8UVW-BlIiE)nLC^a;W@JBEdn_uiVz-bZl_aZ`ucXbw)J)K*SmH-M2%*_E4(^DD?-vF(&+w zisfn(_r0gKO{>?UzvkET07pM>3tIyk8jxKsxh@Cb{PJ~rD@H&EwCV`vfer`nPNTXM%Dd+P5zX0VEtO k+EKzUp0H@^xo^U7z`^J7>@Ve@kAQ!2(n?a55(fVN4@~hYa{vGU literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/contoso-active-directory.png b/windows/keep-secure/images/contoso-active-directory.png new file mode 100644 index 0000000000000000000000000000000000000000..1a126b049d1b54ba8dfe13e46b9e28f216330964 GIT binary patch literal 26652 zcmcG$cT`kO_a@qeCTE(QlhBfLZgS4F3Mi7J4={X;HIzY>gN*CI4Ys3_o)QRDolJOT4F>MKiyFZNA zyd(@DkYlx$s?vi1i|x?MOe)9M61VZqD;g7{W`p##zT__i`!#hRh^aJy$IZp0R5fs} z`d15jgjnhEIMrjZsYdNE)8qAM)2hjbTgdR%B@|UuFvW=V#+=u5oW84s4@nRGdGq(j z#(25Uw$Id1(4&vnJO0h5U!QOL=;yts3qM_#ecw+<`Z+Vc1T8YU%9SsO}P z0TU*;zZdvYBP%oImDJxa!3Oktm?~810UPC|QDVZ?LB|`cdb)DASBLC;k3YwGe_TK} zGz4v7J`@>L?pf?e4*PrCwZ+(VQuXgtu9ANKOy+p z393nxO}>^&0~+-zc;W{@z$Ke*NOFQ)%aH zT<&#yeY!hU>)4mU&-QVzna=Myhck)7cKAYK-ONsRhjA>f9TTAKlwuUq&|= z`ng-Fip8dh>k{7oVkyBQ6OG-aJ}|sysv&`in345O%-oPKy~rXY7WngkK=fFgpsgY1 z0X_|f(1X;U!O^xqg^?)t-+`^2h3KCr{gQ9M!Vgko>D+=42V;ra=T8&%_J)7Y$nH?g zdiU`&1`fT^;OU^S53k#uaIuXhnI_@geq8EGHu1E0Wy_=Rw`{!O zYFiXHehDi$*d-Ev1q{8Sd77_?V67i^)<{X|`kb$@vjqVcFPl{Ni|5QQ`j^m2gd%6A zHINJJ$UIrUW0?RiyWE}zM*2%nm&pR761zX=}x~xeKB}C}g%asn6-cnjvT@ z;2%cbz>%Ptg&Z6l1QSvl<_mNfXnPSov};wWv}k;6K#Y^H1gsJ}jyqn(!%-@kvCaGUOUGsn6nyJ*$&WF3Up4bDpVS;?oYtaKmaQKk7y zlC0ou(5y&iHiUCxdsAjg^0&MYrde_=tHTF3>=>3cn z(DSk?Vqqguxvg@2dG$}L;-TOPe}^A+CHRxM~$;ht}iak`EBpq7@8;DE2Nt~PCNvB84gB>1|J2ABnF z^*3oHK4WT|P8jloQMA2|k>u_>--JX?7G`U)$e5=C%}HT2Q{0furH!w1r6PiV29t}M z?e*a~DT~=!boH=&CQY1_Lg@9TCeT$o6kzvGwuVLNqq4s2nq!gB^ic)5_vx`B53<4P zaeLS?5x-+F2-%UgDq5$_)qG13bw;V))pk3fnUsQPVM1OE+USm14esNl0OH=bImyG3fpBlkC}23|Ir6V<&)9N`>5{phu``*AsWj{XFA+oJWP z)oVp?LNxG96E~^LAU9;4RQ7ghb+f5?YcBshRHu(nu=4hoD3(bj`{|cDd7(4Z-{9NL z*Cv*;)r9oa7(;%i4L%j=2V$dqY1T({eu$8!r&G={W;CCJS5zmR^S1hCnelfN0?xQ^ z_v3dCY0!cJdj^-YriaU)o>&CnUotm7Gw+aeg4R+4KH1uvSv2Kr!aXVV}{+v1_zms9lrSa>UzS3!6o?iAz%)SW=O$a6LSx}SI?qOP1|s9*#+IUhkNde{`pGVpC@bL?h$@-zH0KxBC)t> zfeF}Z&Re5#3&+2Hwar}9=+TBU2GU5m>}+qVc`>KPP?+WA<@HB3*!55_zM&MZ=4T1{ zaXw5(&>5k?{rt$>?8m8Hp~C$V#}bzM{c*TK_N@k)sS(UN^Yn(WptRtWAPMc&psIJ> zUR;vm^9gjIShbPP>2us1?{#}o zzs0W!=bHB_br{>X$<`F|{3~}3-P-L_{C-q*l-M!p!#{Oy z>3kchKxJ(Lg4zScOD_G-{yyvk38D`|KO`kPar*td(GYe^D=($58rg~rV zzC&jPfahyp>6`b;LB?o_5|h?%$CO&QIYRi_jNDHq{jU#eDNrY>iAX(GSH>@hH^E#y z_cGI2qVTHA=~dc+vAz<=qf=Mek(++n;lmTpD!W<+h18k6SASkPWq889nn|-CY(GsG zl!*2B65O|o?VMVj< zZ$_JO#uGu2y&iU0cyrZD8ElYb&a&$90tBPfq82~PY9A6m+iJhOz-ZdH9V&;_U!zVS zd(N7-_^cPZj_taMUM;RNC4}%3ZPOGjtFFB_VQz4y8my$8wt+?p2zeYv+>nx5gUM$+ zL>-6F?Y;M6Dj$;gHu&mRC@iL{$F4LyCMy0gn>K9ioLm0t9i@Am7bACMQ3cFEMn*;o z4~rr9Evc!v5JFtYVChp|<6CKun?`lGI^t1nz`oP;B%9d%jj&G-kcAI5sP}`xz!)85 zvZ5DN3W$7Od_4=z&GX1p%R z7cA|n(<1sPQ&ZO0*v2gZs|uLnH;Y3IX}#^QFspTsz9RJx+Zj#DBO|bP^0Tq&da2=s z+%-AN(?vSFyU7WX7z( z{aD3k7uJkP7Xb_Vl)J@%{Bf@L$S&*uan2KSnkb@KL z-iAa9jnH=cpc;G)y;fAS2(g$vu+G)9adMa^z)O<7e=VDDQ&E*7+U+AFMya-Q(hPkb zA(z4GaOWJg_u#ui+v*Dk3g?@S;Wr&)WETRb%?-9RF|Dm^jB_mCqLzk-_htmcw)aw# zNMUCnt(09h1bTAliW&3O)!y7AMXBSRU@@|ZdG(P`YoSh?fvK@5)6o0Z(etJ%HI3`m zPlY;*LRQ|8ehfUAeDbyNsP&7B=JUKT4?E6Uwv6kuIggodUMJ>~cC_=|FG$;%+g8zn zGYx(WY2%-QgE-g=));b*)wOnCXcwAs4t#M7m9i=F^z$l?$WxLByCVnVi&D5~RJ|rZ zZ4npurg?s2-=6&5@H0?2EdQf0d3)2c=@wkr@qVeBNri6tP;+i40JqCO$|I4K#Sxn4yuqMDdX0=i;b|NGmgU#(Qg>Q_^Czz`q!=e z5bB#KFyYy-4<6t+(c~K;$S_SimJb+9D}9+N=)>Xjgplj9n~8}>Fhf+%uMZ}*IGjcu za*>Vr!uCb9ni+-52L>_7KAlGl;EY5Mb+X~2?xnrd_)wMeDM!@10`gE#*elwvoCY&p z=%psMoWLI)9!LQ9ZJzk~ktV2mRI68pEt712Q8Md(M!Y6E&z!}1q`tr){x;ccdb&sAdO$SppQ(ElN8McjT~3kKV+m{-zIw2iXf5i{pOP7^RH9g6 zTFrjaXdUJDr*8k@W4YcB)o*vnqPakg4fTBu(S#ALK#T(5HBX}VFJHdqHNk;iA_N>- z({jus=wz^hPgJp=zQMRqVOXbqHk`M7*;;_yX=TP?BzHj&zsMd)#&vY=Rkz0RbhnC8 zz8vp*qR3(S2WxzfjmG6Pf5zv1GJV9*Pu!pvmBfijkwQg?hg|6yIKO#*)6MWasdJ6& zbd3i>DA7$0mUB%*=-RKhd<_QGIATW}Gn3Vyn?W_14OQVCsHNw1o@>{*p*)!=Wc1&T`Y9pS#Rpus1j3`s(wYB=F z#5VsSuOcDBWryBA*S;kBwt>X9BgAzn+aXjYrBHfGl1JhphwM@rQ%oX-F~N@?0$^tu z_SeHzfDuc)YUsjM!vFT3|L}(#&DOylkDKBxmg$&{w$Kw}wU9 zs$Y+-e_gq6I1Kt*v>f9BNtBu83F#LBr}p7xcd5lw@3W2SD$m=#4Gs?OyS#XU@h3;r zk%ZxW#~MgpkpQILforLvxJg*6h`Zrkv=*s^wo?8ck`lPQ^b@0hGDqBH_|X<5liZZk zox~kUz$T+;)s7(cPL_GR8jvobecI9;DSEALCSFrCMws2DuBL?bnISfnFOoC)7q_fX z<6h!h@+G4)OXlUCN%x$Q(s{yjN`s?PmU$qug=V2wnKMLMS{TP-p$xH`k?~3Tm^L8q z#^dMYSUl&H!s#<)Qv@Q-Y;fp>T@AA6xu;LjT099G;XPpF{`ifPxVs|@3?p1p{i_~i z7vjRLEz03w1cIr?NclddS^a%cF$F3Ist+y0RVos_2TwJkZSLExyzd8$HS1voCa~fE zHjw|)GW?@F<#>q@EMAlYz-@amH6gKFwcTO-ziXEEW+I$ zJ9`?2G;@jn=9%I3TQ?$DX*fTn*V9HIe#L9Qp}Y&SUnLrg0Uf%x&!Z+PwpI2i(Z(X# z5}ac)EGfDqN#Ie|Iqk$Heus>a;inJcvO~!u&3@h=)_o-E)2oh8C{nMWI=uWz;;Ok| zA~SQ!!u0O_2JG?}=tXnT3xM4<2b0%4)_Ee^QIKONN%Sosc!(tACic0R4u58>!c_2M zyTK7lfv||B6_=$U6n(LS)0PTBVr$(YhdM`tl!!i?E93_C09bIv!3WLny3>w7&`*8F zph<31kxlm4`34Y9V9d1fdCl6l=Vy_k>^?~neimv)9JZ2K*r~`y?~RS)UmneZX7-M1 zypl81ucaxI%$cc(B?#hRF^OqrxUmB-2C<=pX3gu@SXmX8zjzK~8`-^m4$$woE7Y+8 z?}Vr;ZL6@Ma=P~+Tbe8DBNO7I@ZH2Jikc1d2Tk*!|5V)<65HDIa7d@4e}1N}<=_-R zF>p0z_0%0XIm?I=->gdz^0xbVkvP7W6cu>5+qjbPWRN(ov{ggl#A^-pM>x!N4Si6` z{b%K7_=g?9dq@EeinxFF=$V4Q+$y_3x=%1jZ`pOf_$yK;YOKKVx>B(AE-Fq7W$U3^u6B;So0 zE&cPX#I`3DP`GBmqgQey$YBL)U=t^0%RUfJK~#(x$yPCg?=zC-u9t%J`*x$InxvoM ziQept`Aco)h%!6*mlS48I>xTS-t9OKGCB(61o}LR3k)G(&%T|xdBxe)+39sPo;ws@ zg0~aWnArBRa_lX(M_%Y^%j*x1;nZPEf96DUaEhdTa_gPY17>XKQ>dlISss_d1$3D~ z(!BzJC1iE(!T4POIGTW_dSEKJdn0s_b z52gzDNQK!PmpA9qBld@7qmyj6t^;uY>oH8}YJ>}bZEajgs*jb`6B4eNwE7OhKKhsD;8DgxXe2z z98Q2(p4A{QzVowhzzttvg8W;8unpCDF?2J<%B;;WE@q~40$Y5>XGe%MSK#wXJgzWb z1Wunn6V*H9vjFb~XrbVURAZpS;!!+;_F`ttQT*93Mtl-qf(o0jJkOgg_@hr2AEQZn ztHe_A3ZCYZ*bPg5BgN}11;qvVLN(xpLMRGCcwHnN&Q>?>HXYLd!X~5_;2>G;t$UwI zjG{tYgse2&`OIoMnpK>=AzSdeul`>h=epU2>|?J;t)Dn1KbjD4k6TKP^Xc0by{-BGDmg;M9Oo%<>Gh~>M{KpzY74HN>jh6Zu-@@ zK=QEwtX%vC5C`|na!-=w4)BurFy-CKRP&@TD>PV~S^t8p`X3b=^}G{S#436r&p_2E ztT!1exIG-g4;_`YeK!=7+& zmOgj&*il|M{+4q~lvumbX|5S&Xxl3Iz4A&$;%g20I49OU9=%~*2FfktE$nCS6cGk& zle#rnx@~D6X>H|2opkQuhN2Zg1VL|o%dx8@m`5;9s1+aX!@&D^{MdN98FkM)ZY-ye zRO~L>v*`fMI=jt+0O{=xe*su~*1cv0NI^{1$Hq6|A~C{t_m#*yB5s+Zh=`x8l0Vc^ zd5a9EdL3Ifw&2Oh(OKH~9 zb`9V^JCE?DBVgbr#EuG|5w~lHije_>mo68DAK*&tOi?yFsayr5qa7UpXeO@(c;3ol zBRa$eU|#JPkn0!-h$ZUGj}J3Fb#uw%lxP@$$z|sus-d=`M85#LQ}1_V+2)(K0kjAe zv+(Q#U`jlNk!)G?n&FOF?ISU9w@DHiRT4RN7qab)N%vGAquA#PX+zSNw*v(uj~D$Ev=>*mHT(<1INu@^T8 z_u2gTwbx3`Oir zqY>at{*wIrLvBKx){YvQK^K!zHG^dhe81J zQ786pZ<J@7|li&pK^cCLHss`WdfkcHZ_tnc<|)$>WvM6PlOFLVow!N>EdrYFHK z^kY63Ig{Onz7ox_9voFdg*m>!u?Y5IR0bp|64Jzh#-&OCUdl`Q-ef#+kK}Ve7QPU+ z!z0|iJ*h6N2DqwVt9=nWrL)D%=2ymmBxL7hI_kQUhl<5`Z~yS2740hLywdaBfCqLd zH2}3AD|v$<>Nsfr<2nECdzr8+sT$Tj81H=-vMo-JeH-pf{wL}fOKGxA8#E%=3CN|k zRR4kAvXv4kGi^IIsG8L->>bFP0^XJziOLmc=n6*9MRSDWt|W(TElH(~w|g0u_(Up1 z;YO-s=kQxx2_+rr`I?f3hT|taw52V@e2V|ut6IDaGB4|i48=E$VE&Qq&5z2K`*D=F zE<#4~5yJ}2vh-FGgHvaYoMg>;A?BL_G$I?SOYDOq!Q3vzlvM5s*lc_5yJ%@FhGgqp zlCB4LC9DS-fsF!!hUe^kWgZZ6T;KaT#OUe@tNJ>*o*+_cFeP+;pGEN|i7%W6Irru# zO#9p*@hXoL^L8Cqy57|-O+_F7u7Lr4Z<(F|R88oCM=SjZD_HxGR7G!j5s#ZaeB;TR zP+r!gtIR6X2}04@6nZpKh2@Q%2YSN>SumxA$c@n;J!NRDU7%Zn_w$AkIdKRsf~*AX z8Qxg8tQQzGr&g0f`R06re7eAUg?U}&9s7rZpLgYD$p%L0sXvLdYeIZ0r?kW(_7whR z)0pHl(T~;7|4iKn0vytX?iHhF0L7Wafh5ZU*X6Mk8oJnZ2@$Lp;xTGAruX66NIm(1 z1NEs+DaL6pRZn=)3A0N}k1*eaUr_E2SWZu~p`yjksK*hGv~DtMW4kB(9xsitWk`(L zYVCZKjlIjW)!Fr>$9;bBD7ixi^zuxmtc!5%lf744akx3Zax~%-dsBS^FS;tt4L>0m zp2sd?C8@5=&b}y5PcD9*X%oRAPuQ(BPb4&XfdnGoj-5&!rB|SLy7E@(&7%Fek%=1a z(9*H0h+Vi1`KDg?J-|=i&7A|cbe>&^k3NCpDBg3 z05fbg*z%-io+VEFoZB`nSrEj-!u;L21RAcIZ-MaYEc9Pf-C819HmJnD?d)~L8wWc$ zSl`6D;()uuGcnF@1<0-^zl^L!joixgErIW2Ckb#KC@E}4M74x!V-Wdd0Bf|EgY1*n zbEk-8Rbg1{;9~yysbNMbOF_4ftg`X@G>&7!ohL^hFPUQunGjz3%K6@k3)5MReJ{C* z2HB;3md$W~_x>(|jCyQtL>u5QOzHbaup$BCnh zcxHsfyFjkzdD2TLdhVnq=0qdX!d$}uN|)+gBiMs7oS@K`p-1pzpT?O|HoDGSpnnyZ zES9&+)r^IDT(q6iRD1UXnfY%m{KvsS%y|i!UB;Pf4R$ zs^TA!j@B7$ZUK<4$f9pJ_t_4274}F{&IyF^go+}enshOz3(YSI$nDj75XOLe_|J5u z0e)VJPzgCsrrFCICLr0mea=|kzM!d?FSYW^md2|1Hl%+@HVr#9;l{q6EjwEXK=*O~ zq-^B+4FEYCvSY({AqTKkor*aoiP8)-Nb{TnD^@6(-ZSG`LIRK?c~qRW5MO5ZMi?t zsBPGs-$f(9R09HI7r@4&KmGwYdeZC+yDr%-f#ato349c(BbiM>EMf-N4wOmZVN2nX zH1PG0^h{aoV<@qy!Qdh4Q*e&NB78ZWP(OfxH>`<-B@T8rk9AMsYEOl69d6-%?Qy>q zh{ZF%Wnp8R#ahTEnKe7v&^Y9%&98A{Yy4I>;~vp>7Dk}^ zp>d{$x!)JzWf(leee;}|qIBB%f5-yr#%NXLyD3mn#da?ZTFJEu7Gavdhne|}3+Qqj zsCm6m#+Us|@C?8Pr7D9j=Vm8UJHsKg}-x-z?St(<;t#6w$N8u%27* z=U@_N4qJC~Q!yOdBP#NfVtm=X4(})=3h~Ut+>cktBV$m`bhG-0Cs18Jf_7|j2Nm^3 zJI;|BQyULgeXMo7U5{5cYyS7Eng`J2rssT*JPO?Cv#dV@P>y_m=-bV}&6v6hLK$xD zO8@#lpTf8z3v;7{$=qk=etECS7gbpP+XN7)wit@V)5s3KnNhc=tpYq5us?vem>N#n znZm_;I~}tA@nGzs+LR)?S-|6%OXO!FN;H7}7hqic?J?4fNvhurwEBds@0#C%kN&TV z{ld==+9+q0X8aZVPX&*(0Bv4UlS?H;n+{+yMuCm$F#?}g@;<~6`C%HM^+Z24{KWjj>WJ7tUnhuf$mVqCuT&!{ z9Cj$dUQk@H8_(`8JQu-)qI~yAt%?^o{E7XFrl+;B_MygC zb${HSR9RtoTSqT%@TI8YmSLpC$h#S0VN+wI#9I{N-?M(cH?NeTJn;5~E>~o4^s*B@ zFhQUh+>oyCp-<<5@XO!-DFNMj2m!xZ$?%8|_~6HNwqze${l`XzoY_Jb%|*>O)0{!3 zV#~ViP;I3GECT7^h}g=%-Bh`K=^sY`rs`EvlQ%Y_n+1Y}!VxuDJO0mWuQe<2N z|9({}HDtR~Y*{_oQ(t^(t@a zjnQ&6yu^j-#Xo?7Bk_}P2anp{4C7!nS5WD-i^@`h6$cg1z|xyX>s>tR;jE+FLLrGa zF;TS-xQp0G2R-*~%FN!sI)+BTR)5Mmas4P&AhTALIf}c6#SU9i$mS4(&yc3y40^!k zm0mRqTWvk%Lo(lRILS4-&+)UlYfqpN9rV~+Mhv~3Vfz>@rK~g$3)h#2VAwSUVk5X| zhV1b$uwoI&{!C+>6pLxRV}g-Wdqv6@W$;oRmAxAm`>B!(OimdHBd5&bcsHGCUH_x}H zU-!Jp`d#P7kUVl>jo_&1$a+{!f$_TH#Q~6{;-&f!w)Z6ZW%0q@JovZ zP5Z?nrzjtB*%n4{biLI;5=|hAc0j2UrK%q9+}^)&Y8Be@CHtgQ${Mu~rT1kIKH0LS zFs-(U6^Jbw&!8|5n2HOc?5m7rm3?^<Msw-*4<^gh?$yP ziKw{Xvs$Ev?-K%tgPN3^KCLVqAvBpG+q3j+>ubz(>?683defKAIZtgeIEBTYW^k;e ze$-(pL(16e|E6Pf?z!NiIjKO=qkETGbvl(JeRy!3S+RtfaJ&H;$6tvvT8xVO62~vK z(}C7UX88c>OBZ_qxnE6XL)aPhr`uJW9Mp&pn)<@t?F@?JlhrbL_qBr7PNe3Gvra^( z6H~^_soX0UMe54}LhntLA-=|B+fagn6}tlc>_j9iR^EDuxB%E!p-?9vxv~be66KI<$%@y19<~(!TDxgdB#mfQ+=Zn!|LJ*iZ=uSd6kY zp9rw@pEAD%3B`M?S{Y+&oj6!>*FE3WV#J_@Tg4iyT5ux=8m1TtGgj)aDulQK4s62` zeHM(6GOk)cS`P==kC(Qs$0hQTuQHCaRdlxapBm{oI$WhkbjiYA71w*5$>n{0d_yK04*TZ*|4}mSPp?e7~;Ar_xspX?# zzz@d=Oe+F{b@)+v5{Fp-J6Pr%xtW+vXK{wvYgp7GT=Dk<1${569BN^h+AMA-r+o;$ za<2EHF2jdmKgQBAhj@ zN%buS5M9trl&*CNE~F=g5E7y=vv;sC;?K!c-vD;<{%*TIhAMpoG)cSj$|AN@KNclp z#s0Uv&YFlqfId`RK85~;h7c6oec*NX0p~d+%(iVv_9`v*0NBw6+AH5IsJ|9^0JMX* z2|ps0KVn4&io)b|ZufZXW=jn^!t^$GiF~AT$RO#StHnJg=Gfwuk^j9@kyID7vueOcApDu;m_AhTKJE)_comz3GO&Xq1E zmXOAHZgdor0fZx^47Y5F8$JXO1`xEpEKZ;g};n~O`4VQI>15f~V= zM#z+iQA7?3j;NRFUEW&*aFuASDWBAOLxM^~Y52-(lPU>QP$hMq{J;i;7TM%$tEw1f z&|0=`x{0|aDwF&$dUsw+jeArG2A(Id$rO3XHm2A8ew_y=!lH)rWseu&@28ykC~|%I zXz%5va;DWN%YCs@sg;R6!%HC7K(Kl8;=O0{bTV9=Nyh_Iw#`iAUJhX_#u<5L$zc-D z!@ouSMw!wi(72QWP=cr0qdqb_o|9W+Mz0m7c9S#18O{XpZUVLw5#w{DN%GU*uyfj= zD8Wsq_mc>(`MdcI4C#GeH)vJn379y(Zpax!ZhW1GmG{=a&$O#@V$K`JfF$F06L5*R|iku>ndbkgY(g5fLBnP{>>>?@#itodGSW@0wK}i=iyzoM{U@FmrbAh^B2V5L7$Ci+7z0zsO4qnGF#!(o!uqq~5gndX&$$wo zNHRMsVMjf28=>JR%L^{dWSNos?`^YwiKZfJtb9QU^oO9LtlCE;9L=F zDiAXa|71u5D8V~W596{!)Vg3}5yh%P|RBX=7kr5pCX~gqYlr zc}c!A?BaMyq4uh=g~rxuzz>wRlScw>AdjS^!dmoS66=n8;)qHM(S~2Ia3@GJ_0#y!Ra0VN*wvxWA0eZ)+aSW+5z`k#p5j>Ni}2qiT>>t{km!%YKj zza|qW4&?a#Aq~5t^dej2L(h8A*yA0d=LpRhiLsG36m55z3)8pld8lCbuCsScvPS%3 z{}9MGAr4r%cqHKj?-UT%A7z?RY>Hwr%&{38&BmZKCC0 z-3QY`XG~C=ICG9ZS^T+emggwrU9mqry&RdJi{~BQEm1eGT}=XV_0UmhkqQv2hoB+w`S73Nk4n zG;V47R{q25wx-lgb+}7M++%|i=fo*>tJM}i0@7ykHq#zk4^)25TA;|Qn0JK`ce+|UcRoo{=?gGIfHs3UgAEqNT7;`Y?FsjwSLza+CCZb- zWp}NFUPN{YlB#HNV`6A*!&zHCYEq|>S+UZ?pS%t%TYc8M3m<+mPwI$BWQK%C$`jBz zqtyV!}~Ru ziQ)KD{kue>fK8|V;O_l;QAw9rs}<*FP*^3!rAeNpO`m36cE{Cs7Hx5sjtyTR0YhB) ztVs+Jel5n??(~n-)Tm9&)h|4TF2B@?URc(|?$=csa0vU4Ou!(W*A{?UO!!A80Gb(b zHOX*dl8+ogPfgbmnA$BII%FEzTcEu_btznNny zLXb@X5ZUHfa&c%mED80xc{9LeLYf#|I$2nP8)k2Z(em? zoK>#rrpI6~M~|E0%L3tVHok`2KV1lsCPWfW8%^`oL&!q#G~3>nZ6Sc6bF>x$QtK<; zj}k5AcA$n_QzW^*epbLf|3#TB3~izNnNGkU864yg!PKwU&ml%PHjVW|L(^oPOPcXn zLcD4kJrQHQ)F^EdLd}q>c3vCfS5lw(2HLAFwD^*PxOGJj5qc||iF6Ly!?VKV` zs#3JM3@qoz4%|Zg{d9PvmcuXQzS>>^PMlTi)Y=vBvMmv?SOF|GkZ?&hWBG32VfRA$ zmxoB}-1PZBlS%{zTVF?T{TU<$?A^7edS_}PoSqS^(I&4+1a<3g!0DsgUTTP94C&%Y z?FSSy*ib0SBiYvQ7mR95`QN8Sfl8|r6jvCT?3hOc=&7=`PT5{{@b?boD90X_eW9EO&8@-RZe$rXWdx95Loe;>Ms(JoaQ<<7;) zsD~p1DFC6`Fxf$R2jiL||0AO4-i2Gm;MoTUOA^L;1_mGvz7MXL0g1>|V21Q0)g-UBH*R5ZTNe_rk(w5e$<`AQOC&cA-y<|$W(ez8c8Je}Nxr5(J zUO@eZ{y9LgR3Vt-k}zh*K7ivRvzfyc3k5_WN%xtv(a9ajAkQ6|W(f%(uO_Ky^5(3x zaACn<;JktMLHg}Y?U%Jx+Yb{rhosDf4zngr(E94DzdnKmhnx9foog;B%q8Qp1LB?Q ze5nr6(s_OZ#_h;<4H|)XlcIJ5zZ9?U}d@y9Q2+X{n!I z+utJcKLuTBF*Y9$H)qW}E_wky*7r#)r@!^yK-a1Eu<7Yo4XAaiUv!dSWVG{W~UR&$152UMDxtT+9I}jx!ghsCNgH;kQ$#gZY2H zZ@&{axS_{+zz$7q9YO`r2XzqWgdL5cZn~B}?ObpW8}>}?95#ocPn)ODE{DR_HyblA z26MN=e1Fkn6aTSzrj}YNc|(%%?S6Q`QfHs+^U&KDeI_?H*BPs~guTtE%Xj{Bvcc7- z6gKg@{MY*)U$0hQu!McPUSYaj9SonYawfbO^C_fhJD^hNBA2h9xrJdLr92(Y^_jfd zw6*;(c|&mksAVq@2y#DR!q-KR^TF!D&B;&UD-3hzgQp^-WVaWgbMJ`D+F2nlR#H#= z^UqcgT*-2;NPtr*Skc#$8q9xz!zcvG9N_r>Hj0>D+ekx2UUDB+_m(>3%on!>txw+; zjjv1(>1a}mdgVFi?{KNQ2E3ooFeXN?a^p$FjzrIW-FBh@*Agfr$98B|_!9uEtF zqSOR<;7;P$NtHIx!`a#O4P9zv~X@Tv?3>u5# ztNF!uRaYyBId*k6^0#cuHtr++R3!xrPS-$^s2#vnbVo&w$d<;U>EYl-3SRPPGMWcQ z%2pJzk0LfD1%@uZ6VlPw2M~ItPFSYzJxg3PRuJ4E8x4P>%#~CqX{ITV)tM#1$YjrG z7Bl|3g(wC`z7)sISX7*q$WEWNmjBU*+V@)jjzVA?#Jp-w-skxrosV(+%LGgeC090o zKNVaZ%?KI`La+`1J#Y1EGoKcj7l=UMBJ;M7(*~?6cfCt$*VLUIx(dj%x5&iA7@wUS z(%>+YRG6-krm&bCpJjH$&{fk)XClL$eTpfj#I!61>xA>EHJ#_}7O`Fb8Fq0C_RWe4 zEV$YmWobY7;N_(P)xDAUiOtJgFwQz4ULvC!(xL;6(}6;*u?3e4@Hq-5O`ND-=0pxF zl44{&cMZnV)HZXXC0?73d8-ACtuL&->WOryywKc)F!{fT@>U~SMEBVS#w+HPjg1f)% ziCWGHnHlNM=RavAw}TuQ!Y>)4q5;j3-pnQciZ}{!Nqs#pJNM-I+Q$<@nqcyhnf;%i zp6-OR6poVKy8Ud!WkC#laVY|{Jn)1=8xqKE{>l<|w!oqA^h#r;p-&cn&H8eC#e(0`s%jPDBPg;p9*+ij`A6!8sVZzao0Y_8fF1RMUk zZ3tUc)(X>71BrlAj7g)0o>}bO$9?*hR^YYz1Emypq1T+XE5pGIr;cI4QB{XdcoDf@ z+N;V)?wUm+K3n$+0?zvH&7OR3Ywhms{OjkoR#{{f9c>VU5)!>>nPAoD6L{@!Wf*}k z7}1X+pg)B}t857FjkP1`9sjHI_U#Z6k1COy1!6d-AbH-FLg6ckZ*hRJU2**X=k7RRc6PSjXI0?wXP#mg z90U1dUFmD}#BPXq=U zt>UQsl8>x_)!6LoCl`Rq?Mzdpe#NS*)IiZ|r^D~IEtE0XX=}QxeJ6nSWePT5?)>oR z!=&j0dXz%bdN`y&iuD-NhH(_mM)Ncj1ChIzNVtKL^>_E!9hg*7RG$KVgP=+uFV><@ zR#p}`D$S3jO6&v<8jl_vMhstbS|y(=u^3{>Ad1)JyfgXC+V~jRSb$%^Sk{ZBi=!>V zc}7$~%2hi|jFF2gZ-ng<9bwd--)a6O#<`2VjqmZB_5~--Vq$nyAoaGqiE)@xQ~`GD ztE2~HGqenjOTv85e@5sqRXVZ>zjQ=}QfIcObYs#8nWGPH3Md=*DA5PWy>vXZ1>E0E zd+nJM7i}2bka;6iXw3J@PpX@X=P8o3M`NICid!voMrzR%gZWMWS8d-J)@0UoorD0P z1VZRd0t5&}3=tF%l+c?>krD+Z^s3ZR(a{hfbPYWqCA5GeB2@uJ>4rKqK~NEpDz;Iu zpyGSbdFPqu`>yNz_x(-6&3)&bv-jG2ueGw+MXNKmTrp~lg54~;F-n7Y=iQcI8Oeoc zE;SyIxngbx&WkF}&~|!qHZ2-(Fn#OGR+1+8fS3s5 z_*NsH(HjtRzj{F}(Yw<{gPKL=-ScGh9YWmecUd#SRGZYRj4$^)FmE4;r(5^qm9Qcs zN8L6}6sSP&Xfw3-pepgU05fW1FLuErx)Wc)48^*9UI+zaY*Bv4R&MhnACXe04@UM* zxZ&&@;F9?h>$MyfY;+l&-;qC(VQlw8;|dwA&gItldAuEHEirS1Bz3VpQQ>`Y9-1pH z^Z`ON)cjiv4vVcfTGz*T$YqdUYO|lbt|B%T`z!5}pelW(L+WhbRAMI4n^+4k%I*1k z_E!|7+)M1?PV!)fNlE$eIhxm8z4c^@^R{1X?7daFUB7QWj#oJCL?m?!oA;eLtc@ys zrT2&%Y7w&boOLXQ(c3RSkB+w~bR(2KfG!ztbRO+KNfFAjbfYSxRP2>Mr`gP^N5V!t z!|#-}rG4D%B3Jsndl9A)L$@@2r9not+;>or$Yr}Y_K|rhdb!&kn~ooc=0mk1{bDRY zqs|h#&RC%Bj7B4_uzMGmm0k!!ALxuezifAublHNsiaoitzUS*EiZz4Xg3RiER*$Z`s^JJes|u#bzVO4{0_fMoo3EVf?YSXUe|E9S&x6 z%Gr&5b2c7Ww2MtFRHDg_o(hCB6x`L$Fkl!3)5{}Y(3Mm3p%db2XqHHvLZ^sd+Fp$i zpLQFm1wjPFSj?2GnfBMPU_@WH6Vlqvn#_9LB+08lpk#1CHd{JHPIiXX4Ms`&!ebZw z3q|Wk{Xd1r^tRgI67}un;S(~i>JvW-``BZ#3Pw#;ftxQMRZF%n$#p>&*O3Y{$VkW# z5h0d25F>^0U^sC2isrE7xg;rh`raiObT+hR4+@C{qZN*>E)l;kk~x#}I5`Pf1tw2G zLf5EF)o%=R(_i?Cza)OX@!7}05=3_vF}pMCO-wrISL|@^8>tDZX%A}~1uO#C+YXHv zz#VKGCU=cCR-I!|N8)rwn3vCKd)t;K;wye-0Bhpo^O5~O(h8f}!C(E#0Lcleic=52 z+-hPt#!83Wq@ga5pYw;jFp-pVNK z6APn1eR-?&A+D+KpUZ-H2gU`fAxcsRM~8!#CoxMW_zR=D|Mh##{5$`#@jYv{9{+#x!hdHT(e|9(Cwy@jNkVP5 z-yjoz;bZVJOx?Mf`F{KBTfsjh_hKA*fF?t(1YJQd*D%r?0<&`AW0^Uojk{%pJ@g8k7JFyj7g{yD$6lnq3)$d9;pN~oF#Om z4CBfRLuzl7Lksp(vMn7bVgY^A^m2-Ct6+4I&r6D1gLsJ4_myx|0rz+W1xaK|LY36` zlQe9JYMahl(nmk#In{A3qemLDv@6dFV1CEnRFr%)f;OY7ou0QQzN*=GS6yFTlxJs> zfi+0~=>42|==|+EN#|BryVEIdNyq|6kvpo2=t`-g5>i!7MzoNqM?jXLEl*eWd}3S< zlZ0i6^z#*rZ5$p`k0|16Ov3~Y@|q~{VZGF`;X2%RJoAO8cw%M~qKyV>g^D@bbD>%G z$%HE`dsUz0AUq#uMW^kfmum5 zDJrrUGBX%kBaH9TZlPQ+_}F^nv12bY(gad(Cl4RzmaNzITZXp;vl|5@kUncBO3bgc z7`q&yJ_%$pzauc+>8~82q888BqcTou<0M)RzUiyg>K6I!E;*2_>_JxHs4w< zzq4R63g?_CsAI#VUKh>XBNPr8OC^VhG!X-mgDl0Ojpf%>V$0%ag`?Jy61}Cw?;452 z-XFReQ5phFkqjKWoL|OB#Y|9|cTD?9sRKuUFrQ>1G#S&koh4o+W-+V+Z%n)bm5E2d zgS~ImGGiu8x@X!U(Z+!<7EMNWTb~wLtt^sxW@Y>`-D$w-MDTbiHc||eVp)3$S;)6~ z-o&t)H;OCB=W6~Y98I_}rWr_oljQIxPe=7?T+rc0L>B8u1;@==JtHn$LvmRWR7+jg zRxgxQ++-^MoLL|(aUM+M!wJb3-ZC3{C7tiU@MLRW?xW@^3hezdy4D*M2lROqey>!F zmibV)xzLzt@CkSZ>)4u6yg?MFL0i~+M?8htDA@Z*3S%Q92Ym?56+)BB&m3{9L_n^M zxbTg`UvlGY3P;T=jx{F03ge?kaQVJVy1u@4F@{-^Ovvx7+SbXJbrQ8a2%JQrg2>?Q z2w}TY1ZV7^h;3WAKX#);*HR8+xnhRjTb)@~n9HXo6r>oTG#4CX#9=s7ii*!u5*d9B zBiJj<`Ok2M>x8`AZ*@J>=sFOeg~zPYq1xCJoGltu=fUlmU81z^@`_2z2v(*YNIL7s zW0xaUJGJfgBcJ2l-8Ax`2$o)?;J)~H)xI-wSO7^6zX0*`{HY9nj_U?WVEkd;0nFTt zX(I@D)7TsDy+!2>jN+Vz%hOGvW{gi9|=y;BR?a_DcjmB&FPzh%EYSbNQma!N-@3UiVBrDIi-eajWUEe;oWsqrK7L&GtY^jFMnFb&sX+~s!XoFWD!YV_N>wS;(eR)6x-OvcI;kQ;s!on*O`VO!2`cUF(gegRN zJ-!8^rhQjnB$L10$Q+*c8a8%<+QyrtQLZQACq!+5B&Zr8S%+4+a!=0q)TgpFa}ArI z4GzJw%=;9)&$Iig<5>__*8Y7r7nSzBi*qZ9YK9O9bTzIZ?(; z)!T&9*dqn^?80;Uj&ZLEUc*}pX-_**cQ3H9>$imJZGPpZM1`&$A#@QVmFJ}4Z}R>s zLeebY+fx4hkK0GSELC0j$qbpOEWcv82$OR%e{dWxeu<4Arx08i3LOcnNF}kPNeoE@ zo03y4M>=M$B6- zDvlJ(l|RD8vl!*hG!bUMe@!*&gvqi-Y->KHN&rr@(FR7xM%CZdS{p8%JlVb)7lU|N zQq)7zQzN4%3PrqNI(uz}zO6i2p=NO&Ao20bf=T-hwpiqGL|?i~^a!gzL$AN+SbujN ztpg9P%01(T8p3{aksKPGB~9@Utby8g2jvK}7TdUUJQ!%{af}hsc_X33RV2*fW&@XG z&Q28v>R-BwEswJvASry_XV%I0;m~44=5yBS11*(r6_U)hh8oGqv41`|eQ@&#Um5@# ziPHdzfSRt!y!nrt!lWwh_hXX+vy_Z=8>xJ~^+K|q?9MXakYCP}m=y>Gi!QQ+@msGE zr8%pDM!5+V6_&vpncF3eyAx)gG#`o(=L0TshV|F=Xrg~3s6|0XHaMY)yN4?-pe_Y7 z(0s=d10A;?T2z^2-X7kSUZ~Sq+xj;iYb09}y&svA%t0&S#Uj_vgC~@kPWUij3jd3; ztWHCIEtqLuR~EQ#_>KO)`yIxYhr;%8wLrn=!MzIk2soBrp4Z|U_VsYR03<5F!A$~d z@q4FB?X3M(b=PHlk3nz9*(oKjxnM5Z(pg zTOMryqE_zhs%??Ea{XP3TU!^n#ysd>=j~MO508B|tC^iwcYXT~K(s-8aLpfHz*gYS zZ1j3(JYQaLP|!8N;_;aS;z1KJe&c9Qs@1AVw5R9nz4JI~H0A})Nw1%JPcs}yqFt$g z^pg-N<|`XBJA2Z$(v(?y)cYFDa-L25mlfE&NLRsw z_x0$&bmk;rIEi#CIXMlrOEwt#-7SgJ)upmn`TtNmI<$7x&YD zTA!dg{9gD#@Ns$=eOgwqII)4VlKY6fuYBL$4 z+!?2-Zz2 zxIM`SxHsP?IULa>jX%z`DW;8>lyL}|*HsCBJoeJ9w4R)NJ~f$ks0@g@Cm+u^YfyotcObc@6Pq_#Vfh! zD(Hp66K(B z#Q_DY$Ix37kC|P_uiI6}9d!n%>0_DeDqc4#C<=|~=`WR;LXwXKmUvUjpsZEqM$L0cv9H=--B*KcjyYhTwVIwo}si$pq&3P|*SlHqrZoOXMZtQ2uQ>!9PGkIis5 z{gotxPRW$suc)waS1ZV+morlR5c zF6|35V{XHeP|GaHSSsb@0#D(HTW~9GN$-3E3VxNGCO5 zX4-hQ8drYh6dcCZ3bDt*`2OiW(Kn!-m%CiBIZ#{hPc-fa3tD0tK(|!dlJkYkr!=kt z*~L=iuk-~PVq@Q)W^!#2RkxsODwRE-{U)|FL0q)jlwjoTm;XPZ5){UB)?-ANsA4 z<0n3S6evXOG$TgXaxD5q&l9r`*~)Xkps6&o^zv%hq)=Ce3uHNerTPFZUV|6-0Rc6U z^ZTUl5e5!mcnS^J$r*-S%YW=V$2;H$b18iCRhNn6mscb0h9BOZ2lC($dd3QE_)nlD z2G%tRZq|n7HA9kOg#ADl+*t9w1eDKBbseW%(|?X;x|{CiE0##ceselYUFn9PDeM3#3xmi+tsh2`|(or zX3z;OKK^;#f#V_0!<8LrRQrBm)Mu(!ZIf;VW*$KvY&4p5jhcNS-FaLs=o&42ydpNC8zz*+r&F1kaR8*W_&#?6ICz@hmGNaR^n zzaoIP0DCP`Ka-RWQqK*UuUy5T`)B?l7$3f=4*hv#(>TKQ3x~bMgjw%&;+{=Up@7@w znYS(VV9w-gMS%g!ZmNh-(JQ{IMwE&^>poEY;kHlz!0&ipguaq(?8GOF7nB0Z((31WRfZ768cH2kKF59?ycz^3HOZa-YW_&H! zKn%s&@gkQsJ=r~*q44zLs%`Bx2JX#4(Mzfd6dF0%NF$1&;0x{|f7+}H0YXq{#KWQ8 zywi)y?|{}^_JP5@Pp>GW2OQt4TsRsrBX=mY*IQDGJF5s`jmobToy)bjCBZS|=yL0n zjO2dn`N=dE5;@ni=PK-ELQlL2|>< zps`~``)rA+o|o$T;sNsq;b{56hlh%GSXzDLRpO+hs zv)Uf$5p294F{i&t=}SiETAed-$O>)NxYYc1*+OddyljuXW(|GKD%O5-FfRkNwBur< z2|jxMsaP>Ss|aL-b8-ETCa!_*O`vC~tM=p|sJ5hrGi-J`>lNH~sJoo7224ZeH*!Ci zaaETh*i&l2TJ79Gh^ENd;^c;Xl44Cen_s>Z3710<8_|Eo;Uo)<6k%EXI-#ciR7m`D zR(B3;8Y-6B6!R2&@!g{r4-P(+^;z-8Cg}Ex2#rCP769Y2I>yK$$h`No!M9!|$8I|} zX@sCIVGpKV8+m(!b`k%BE@e2byty2n?-5TK zWAu!fVsVLz_lmleFt<{&dPF<*jKvIJYHd&C(HPo1!cDgC_2YuFPYR%{1RVp@3=}c% zEFE$h_^pIlrsD2<_77V~Sc>6P@--0`>=vFGkgX>ViE#AFZ0*a^9yxqqJ(sNacQ#%- zJ7!1C1`NhLjmq)qc2i0z$Fu=C* zrgD7E)^{7v>Go)nWLlenu4);1pmbpeO4ywE1tq}F8()i5-s{A0i2VR}NFBbIIVez4R82nDNP$wqtV#FkUcOs9b*PFy1_N7wn3!iZbV;ffg6 ziQ~tOOJ^xs`NNeYW>)*4M}Vcam zpD&LCVTTnX-ZNeT#xFuktUGTi2++`rq4CWH>?Y)}{X->v+xd74?QmjtedzSA@p5j@ zEQ~6<`ei(YmTMwXLUF>+C%U~YBPUn$vFo!}r{~THCe)s*AikG6#TdOxn(oPZ{gxM(o*M_PQJ~u=|ds8v(4OC8(DG zGEMc~u;Hu27Cj+zTv?<=B7<%AV@Yz~A3r3;UVjZNp)($NfaMfacKz}p4=JxG^p3I| zt(=QmJ#RQ}g_ub&Ry`-1fN(x((E4h|^_>c6fX#Q%m9X`=qYTg? z%-9Yz?G%C3u|fT9Vm!ZN*pZ}x;P=_NSnodv9klEeWv!8p&P`FY{BTH&<%K`9K}7*b z7^r+u<_WI#RVgV=y)l$bK5Uza4u3nM(+?C%@=1!BveN>=L2rH0unaqbDrecFF*H5j z>l&BvaZ{4knUlEE9Zf&NzM0EiO{-Aba+4B>;yH{%mZ|M2Dj2VV|;oJ-VVUKq_6@|J@!0snrg7D zFN@Zy%;g~e@7k^8Gd_Nl3m1c+ipFWo_<~s&9s%2GOboRzdoH#lmSHbugG^GhrOQXvtBuB5*6*XK`e#`ipP1a!<*@^W|AR?I zBw40slG+Rm0)vgZ<>XI1J92G+qC36cKbW6f_Mq1Y3q|hv*!<0JolTJf{cKDbw{hV3 z^K^y;=d@O=*UOmvul_ixrOM0+K1z#|L;%H^%?L#t!mnU~a TLY%-a`arDAj+oXMdrQ_~r=$d+in9^<9fF%@;~U1at&gSXe|V%JSM+SlESFShoc6 zv4PJMI1v#raLZL&Nfztd5W_ZbaobAfxeOLoc?{u|87^>r*GbvP6$^{F^UwFK1a4w_ zEUc$)D)KVA9Xc!MSX3-8EQ@LfcCECev@h1M_YT zH668SD$2c4HvOxu0@@SpQLYdW5_0P*F-q}lZ!QTm<$vy%La4WTZMu<>_8t#ZyiI1= zbp^iZ;$x;mmkl+ckCR?0u7t6vfi%2t@Om_^E1rm`*?NuKL)_)^`gMZ`7K9k;Crq5+ zuN}7x6#BZDEhDQ9sFYsn58U*%NK2x35?V0FBK3Xe(v4qIls7@-iSFb?R2f97i}gpN zSCeyNWeXUw-*t=m9yfpOR>;q%m)q)~(b8YQh5c~H2hNn1c!%nb{(0DX8HyBxcbFu)7xOshjVSFjbGJ#TuP7G=TFLo z%KdJ9`*=-$XztIxyYb{y8w$J6KJnIj==lg;#tx37zlk>$=sZ%RZH07*MSAZe34~&A zx5IHz5c%g+TO1^B^bv5<)VKNre(vsxE?!>Z@D}M~eQ)H~l)*I7U8v)q)0l1cY52X@ z3KzH$Z9Ki0?$M+DdTolfp4C*oeu|O$mjnGX-Tts&Pc)+zF~O^%Fi9;2u+&Go9TzXZdc}C zylgqcJw-WcdOO%W)b<{;7Fx$#EnOb&Q@?2X7SrnEbROqwuo#uH?6fmzhu>Fyeh}Q0 zQPh@Gc&l$1v=oor+6T)^pQ};0HQaKfF~?VRjeh$G0cXgV;Jcfydv#bw=jb=-arvct&Qy5)tmnPo$IrPj z>}rk}CudUA@-SBn%Gw#x3(NZ|56>hHkJ0LZyz5*48OMI~6Kn;^ig_xSOjDT^(*8O3 z)>^ArafIt}PyRdZg2Z8d=~PCF#Eqldwo3O0BnC~yyf2&@Eb!=h0<@C`)gW$rTmSpY ziKdSFMxzCim9Aq#wT?@m9;lAlxD31#Ndg)(o%D1n;H3 zYJus`yN4YuwvE?%Iu3ql(%NDirGIY!A1@JA^VjgW*QJ$}72F%CavhL~LZNW*i1X-K zKVr;QyQodmGcywvct9Xq1X^#u=z6IO2X!fr(>7`<49vk<({izNqNG3OG&p+*Y-)E8 zd@<Gzxf*g3?oJJ43DhpU)Rd{D3!sFu? z5UJQN!FcdqvvGb~Ky=LJ<*LS0QPDzhJXMm~`BYR&3hm;>gh6X;j%iayT?B zxdoqn4Fl79Z^reY26!*KJaN1(s$-JAB!caRFw71H#+*luMA$?&OJ1WJ92YK>{d{3; z+9*K(NPV7CvQaI_qAzkvq&rD&O7iD@btwNn$@1$URE3iusPq>`&?=4v$>;jv_1up< z-dw(e@tXQ3=cC28GCxMPGIK>Z}HQ=Ww({z(1?6y_C0Bm{77cSBFe|eS4yMD|`QrF4bM5A8#fuZN7aRLpkU7 z``mB3o9Uvrsf4)+UMeMr8|SF>T1Z@Cqgv*4$dg{U=FqE)pMna+%Ii3 z8lMzMFUAQSkQ2$!87+N#<{bg9uV8yc!nW`|t9}?0X1^r}+5F3<{#NI;e@8@rhISTw zuOT^oHci($Iy&gZG!={U{e@Xyp95&M8}Oq+^C%<*2w!8SW@DyrRt5T=`Rx$0I`9aI z>ve7nrosI%sE-CNSrippR9RmfUQ9p;(NN7<-#b_w14%~H?sVez;H`)Pv0Fz`I<5QN zclxoTz~$9drL)X#`xO-e1%sxTV;lbrwb?e_SO{?d&(U;SDkEBMZWuL{xSLipb$QvO zNVJLhvHV0O&**F3;-2X8KlfqTbynE2XI1jI)dB9~|FhM`>)qZELN&i%w(&=2WvpvW z*GEe7g#`s45AhT(<>2G_fK_MOUp=3`sQTu>j|2?9SKy8Lr7*cqvIpSy1){OP*7!L) zZ>!B!N6%iu7JS>#73Z_QAgwofZxE?Nhnzp)T3w?IWLJl#O6iwhEC+tTS5ixyPX2l? z{kJy~q6g6-c`K>Hf1gFwA_g#hm#w<1o%t{GITP!JH3y+43xw5~7Z?(bxzmc0ycH4O zjEbF`&kHC~UcwGERRm!6*T_PPn0mGoi7zW7B51$MSp`lWQyLf$(isz_OlSJp2TGTGGlT3n_|&2%EU|rVc{!29=mwK}W+J&=Yh|uYC6q=!W|cU z-+3A=N#q!IQsjrmA2(m=nIH|<(4LyW>1~K6aKS{+D_!C94_v#Ig1^+{J7R_;DA9tv_^}i{Q81D@7B6p#yJLmqiP-8Lql@!-Ie~c0Q!n z;UxBja&@&is^^zJxB_1-O#XqpZf21w6#934+aI7}z8vJjuhzhpzSqP_9QAXbsb6`> z^a&12x}r~PC=xb@;f~4UY;43FD=l0|u=DEe^>vF0x~*?sT4_jmFc8^k8q97m*X$aZ z@v?O`<6~T-({-+!nm^vo$lleEI;F_>&N~1A98RyT%#bbfRsI&$ptgJ1h6kdTtS>pb zp!n%VczXUw#Bbwoh8_8HU$WhcdS`7tg|QMwLuU>8>nW4!DXS-xMuT#k-vk;=?dV4ZI2mi()w(>D0W&Q{xQj?g@U)8AU zWBKPnHv(UU=3uoZY~{1T>*vygojE;;owM5li5dtmJac3!&A5K07Ua5wdRwelsk2o) z7gtXui@YY>lcLM%!Ifv#E@u`w%f)2;@;3%+uGydT+v@6x!aOfdfddH)|Qy=Eq-HtWIetZIqsOy;*O?YG*gads>sHbJ+6k8YcvO z{^G_e_wCO0sGaGD@!ST&K{$CtWV~VY z1F7)9LSyTBb-nM(B)A|*eV(Nr86km%7?!xSM~?ioi)Kp9bBC9Gpfwns3 z$fF!7b|Cj*3ML(HZZkx#uC6MAak9fHa3%jh(|qEQlM^Af&7gk3)47G-?@qx{z*mYT zmwNG_Jez|6mtu#@Lf*jbCku2jl%g7*biv`K;IYB093$YUe=Ap;$d+a-q?@(_>W+eh zny|`dqM#Ll&nJdLN1|2NFA5e^t%-fV zQhtAEOxxGh)wR8CW7OXE%&|?Q7$5AkjK#)3+*gr>RU3=#O28N(-Gzi=FEip34-Y}@86N8mxHyd(-`3~&I_ZL(1EV%XqJTl(ml z$=mCacmX{c78iQr^x;r&TY!kOGKFv6&9b^TX{805&@d@i|G9+z4A{(5H z>T9;cN^wJcsmA`#K+W#Je(+MmM^Bz@-ixPH;Tj>&Z?`yP-w)Q#;~ofAjFjJQbMz%- zBk}Dk^m9|sjy^VELfr|MrC`l|LFvijLEd4j+Ej!qx#mnN*Iu+(tPr*w3nrtuLNZ0? zSwIvwIk8PXg)wIjeT?L?WvSSiexYJ=1!o2>A%H%7FFCoQ05i?`GH{SzQquGh#$H+$uOuZp)jSVHZB9o4``eAaF&UE@9Yf zth*SmcDeq9UK3GiS=7vWS{?t%(C6vC_2KCQip0CI4+3wRNDf$l$X?ppBa{7YE8zvL z+11$kuDqBT4`H>3d)A0-F6u-5KoFR^M5hlAMj!KlPS>=A>H$?>`>L2^Yoif**3xBYYtsJVJ{uV%rLqu~-4O7f2d zQqCU{V^+d|=N)Ou{&nZd5z95DHF?z{mU5gyOEfxn|0Og=i6Ntk$&{M;g)3AM2RnSTA?wRt{&V}B!1!PB(2Ij^yH&f0QfWM+gol_vkt z@G6quuFxLw-lJhZ_V`_fH6?1#6(e9Z+&lAhDfu+l9wCR>tx4a2w^9x;vVaL^1^m-k zB-hW}n`od@FA96{0&g%adlolCNjFnXduiThY7LYv!q%q^*B)IDmvi;||IBZd&@0-l z{wUfTYTF5ORR34GuJ(!+C^DeBCqh}5lIffg^g68n!A<&MS9YRcG*W}Q`8^suUd?aG zV#tOBpRb9MtukFBm~H|v$ozA+ej34MxA3c*%kFmy%^)k^>mh(WVocieSP7x#7>0v2 zJXbsK_Vp+6fsY3S)y@-nm7*E4<290sax_mnK9MLDH;fWO#eC3i4%=anhOzU|bV<+8 zNPwC$`SDg}rpo5NtId4f`JaTaPe)O;t_^d2ng2Sko*@U;opFh=wbe7P6XN6zbnC07 zxBFsJVVB?^GS*l0`(q>S?8Hl5h)gLllQJy!Kkuy+)m zQ|{*ODDW}H7Jh_HM^QcLBc@ZA{`_)US(m@WEhwG-I?q^pqLxl~x(lm{n6B}}Qe2_A zU0MTK!EkxKH2#iTD0H>8D_Mwc271uI{FubqZ6YFTX$u#EanUS<{M0;9o#)2|;=S?Ey|as3=t9et@9M(G%Rh5xp12v(+;Q|z=4 z04{}yNvsomWp5#!r#h-I*kmZ~fxw+-yhYbr%0%5IRF@oZnnw`JJKKa3S zMe9FbHSKwK2X}MhR3`fzWR(%~sJpaV_z8oxh}Wptu`&N6O~S5JH=H3`cH8VHxb-@A zfy_2ojoNk=m6?GbzjAgyDnpH)wFNnIMY*4&Ekwv9! z-)(LKUUku<7$A7t#U+2z?Y~YM6Lc8Q7ITIFPMAew{z(bUx>3;idsSO%GnKwYsdqXS zPYIjVZ=U!mE^umw7NKpracYFBFrlp=$9~0yCvT`pR^suiXGGodwcL1j9xCL|=NNI8 z6UU>_PND}jg0{hD#rYlgsZ{AYIV7yp`8_n1ToS(t{81kpN!#_w$&C6TwNTsucc~vy z-WQ80H(c1SkW;55pFiqw-C4O|@X z08-=YGXnI1tV^ZT(N|iQhp-mMrRL&d&iFqlrv43pGF9w40B$^Ps`Gdl3>O-wo~v=x zFdkPN7#_BhGqA9lVwtzQ535k;LB1Y)}+IFGau;KR@=X{W(GA(Ub5O+o1wi@50C{ zr@j&eEDCcHy;9Wbbj4#pK|7aO;W*D{m9%o6!80-xQqt1;52%K5L-2Y)efS2dU3a8i zbZDInh*$Kt(zkO|7q#4|0}AWwWS<})Uj}*}Tg!KQ=yEnH$omE-1`??)_A0`_y#(gm zoX|DRWLT^MjEVRkV&D@a62BEM&L61u;5GwH3=}BHo~P3%Q%-jDm~HhD$U-aSQrUo& zv`73vnQfHjy`HFnv7)cENYsx|?=JH2SdB%sd+HQF-7l;`yk_^;GQbaRrNT0QXZ6Mm z9P~0-++jkclQ63h^bQO?jRb7cRRvru zB}$ybSkUGynxkH~QUSpuCqWN0oILn@_cMS2U;I{g^nh&wC(k9_|B9T@U-5I{FOkp^prfgdrTEc3QRkN`gn zme}GscaA zkeeGDz&t{3uQQH&3*W%_ceI1|dr7KzT2~Oa=*07Pr- z#+j+{$68gHUVO1~4^Z(B35QKz^=aBF_J8Ji@)CqCZv&DCa*XwHu(%>>QmMIZ9mpiEQEGgf#Jm=^ zw&BR}x%XQxK21h#z@-eyadQctXGDHSrbXeS%M|CxEx1KQlwVKH7v;Etx4Lb0^OYmAI+lA zOy;v%klFaaw2u=$RguK}?_Y}>i(BT^AxKmiI4rXDd0q^Nzc1jdX86J`s%qbvJZ6vJ zb|FnvQI&6wztRs~l?;3`t!K9(v7~phqlfLM*VgVT6N6=hj3#vx4w0+k1pGnbQNTP+ zQloRPz-<-ohI^YIJ1DH;*OGfYzqu|yqbi|*EivSa^@qxaeQO;e;kS5z;=w0?aBv|+ z+&jG~uLNv4&86PmHCFtMeDi!YaaJpZFO{K6e(ePbc=P_1YT@Tl?*&byFRs&7ZJX#LpMcVFZn?^F&0ytCDo7{0J%5nI38l1aiW>E@s@v`&f#hXn0o3|#|6XrRWT+VO6FW~0>yiM=YA;jf_xWh={!rx`*iDE| z8Fgaz&%Y>A*k^znZCJ;y_{V4s?51r&Bj*apygo@KZ5Zz%fSN4NpOTH|HuBVQ*i^Cb z`nm-b@f*s;8w6i>N0h<8FUQyH`^uuGqGH-JcQf)cHi05-hy`}uTrWG19?LwNW?lST z9rpowYa@1V^wy|<4ttlYU%eN=w{m<2zig5zZiL7;V?Xel(bG2A`yyO2PBx5R-3oEg z!u9D037|y0H*!$Ipu<*=x2KmBzAa!bfDF&+ClyELseJ4*DV6O?Zhz?2d`iKDfFh?$ z?iG*Fdqp?)ybK&h8L zq9!jg{_5~5fyNsj5S^((Sg-D3f6=qapobu`E?#%f4Op4G?goqxPfDyC;st~po)do#Yvgc8Zwd*bWsrCCF-EWog{GIciC= zH2B8?D~~i42VBEm)aGz_S?FT*M+e5lhhEhx&<^7^;me;oCt>_LthV(Gft_zDH-71f z%i(fHkZ1tc%@*>VfO|5lV?-sAkpZqN7&rwWmu5h9+)tc?0STuKJ<3w*kRXjLTLED* zWisYMU+G*L>J3$A`)8W@FTRlms?IC6OAn3YuYQtTdUFAdaj;(nniaM<*-+J?x>dV~fVIb-cLjJ6tn zJ9pMfPd%g{!<2WuBqjdIZ?6RI1i*)=Jce(f2-SY2nZXAXaE!Q4ZQ|{^gD>1yf2T~^^6t;p32G$1xhB@5Q5+|kvaj$hgOu$oUB3MD=31|n z!Mkzo2G>df?N$j~R>N*7rK5h#G;cXY9SHMtr93UKWG{T#t?&})+ zaw_=QwCR-NHE0Yv{amO?qqO?3HE_1TyGw;IY{FD+q>u9E&tjQ|iNz07rYv-hs5OuG zkiw-MJVxIyqw9aaHL1}OAS?bg|H@|mZWduYxsSjc*BL+x`|Li>;Qz=a=g_J^eEJ2=&0`S)TIQNPwkZoZ% zgBoZ@`EWi22j2_`4lDQg*2)-azPU9i?z}2rFYQeOac~02cUld&bcT9RkjSLi2rP1x z6_Fv3`)2Sl_SU>A^^7eJ17e^T7`p_v;kUN2De7qvHbHU^5MF$$8W6FLG8GZkzp zBKG3%_Zg_}1Zlm;9aat$7bm}`|3uhP}Yp(`gD(MId##};|mofDpZIN@q~5(wuBlpJ-O*d)AKn$c%!#WJ^>l|`}4ZQ@h_ zXXjI$_f;d`#${v*9`WtZR&zr{D>%!r$5>&TcPXt(oQxhVI2DLT^&0x)yq}a65bl)- z*?Q3trxjdCf%Lk^Q^wZcY9oE;x3nVKq9@KKMT|z*%nIr%^C5%D0A#}sRvV?J`pxj! znmL-FJ2Wsr?jVvGA|yWP5gs7y03!2}CLC=Pli6p0+#XeEXg-`KsCpT`W#E8%;*w#4 z+ULQ2b7qabFCt1@PSJ{g+$QQ+#KA*%Cvk&~V0b8q34d_yc7bN898Y|_p?4@70sP@q zB`UEuNvrerG0?#vg{Bkp?2oKlh;&iAmzkZ@&yiDYc&n9M9C5!Bbc5Mq2h5&zNiF&s zb3k)EF%*LdAsI8>cP#C={z*+g{B4sx&7{I#KN0u&G&hdFUWfMEvDxglU!ydU?h*Fm z7LiQD8@D=T+IYbX<-{vkRkU+4u>RrQF0M^V+(hf4r{iH+S7!7mO4dNA@0q< ztJA>5{Ln-rrgm_sVh%x)ws~x;@|Nrx?ZYlkTzjU5+~)(MycBz4mqpLxhcsu_KdxPW z9gZ3`pea|r>zBQj1iGW-tSQrkz|onG)qu-9wqsQ^2EFhXlpagb9c8tq*+XL+XPNhd zoD#`h+l*A_1I?vuN=AptZT0(!`R{$jdcI9wRhP5=G2FZPnL=NpTChU*P>`uaRf-0f zLlI=&TGEc6uW5_Rk(8J#bI~bpzApq~a=Vjtdhg9Ar+!9jeMQZ}AQs1`DaL~w1tgKN zY8!g$x6EIugC`x)HnBS)3J%*j)aajR1rUiRYV5{v9D6ymCxpUVozDi~Uc_d#r;*G!dx^pV`d;hGGLx}7G z17pw@w7_$H}17-i%{>@;@5)utksbdc!r_>vtfB ztfLL1!M8_~M=I1a1i{!Vxu^|9)aEhnzII7CkBo==gR5s*=ia(GhE|~=eFo|g{)Gkb zCGx2Cm$siOYAMHut>R6)Sw`OS2uBr_1>ENyxB0Dn9GS}7stHY#ucG3{>eBAHO^D=z zj19+qyP)>D`?DGK9xFtXUwD+YluYfR`A1_1GQ~5AltfcBGRlC`xWiO>#D#NOSvvC9 zsrMWWd5sH%Lg^8c6+?U?JEvFV6B_)yF%~O9T(;i*N?+FZ?ADsaq6-eXqrC4Zz%V>F z3d~-G^hm{Q05KoImRJ#04T7Xzf&+PSOjWJcdT9lta;B@6EXaShWC+9&>LH0e%@$X z${PP$o8xA<6Lg5PH^!d7kn3akTGpnSBM!TlL5a})R0{4gU!32At`uVIg$b1$`u+{0 zYSJ>N94(o7|4dYEH?+JC z>P}u%If6zOCp!NoSf=qB0eiRaYa_ox>&pPqGn;6goMt?Ea6O6Dk4eS=8?Rlh0G0&w@k z-MDR_;bcq!N6O;OCltza##6l)yCS%K4Z76qGp3b8K%tgp#Sre&66w#M`SFqEy5(%! z15Y|U+w9k2@KaX}x}<1XPOIg_kMUO5H2xp+>ir)y$t$?&MLtN=lBicB+@gC_UqB^A zk?l7NF$UrA*Q0gs2Z%Tx;y*&v}(hc%34}WVS?1!i*=Y;nZ8^sA2ArcMcyv^B=8lT3mz!p^j#Q9B7>C= z6b-#s;oAyT(D<}!MYt_Vy(&XOa|*>9CI;21y#r-?NK&fBvfq2)-bc_{$)_EW`H{mz zQ8uubR*PTbDeCZc4IRlOTYN0X+TFC8f`*(r>RzQB%d|>^dksMkd_vf=%C=rmB+}q? zCo8BmE!5v~uctCT)b!ukfl(QQqO)Lzd)`>KlE&6}aDEXMHjJGs zes$qg{0-VV_$2ce{WTkTK$h7+}3!|2a8N@HHQsZj%}T8amaJ)KSiB|RLL zx)oExGW`PUQCDy2Zs)TpdlqWHm%k44c1s=A{ls=9c9%YR4-3s*Ur0Qgs&&w{O2-&^ z;{aM`sqQ>wYK#q4FUz~&@75hKwDkF7U?&0pZ6lTi{|$gc|Jzgi&(ZOJ-8}$nrU-%l z;;j|QnY1bc#CFqEI%0GMS1&?Si8_sz)aiWlQptLhCf+_ALR*ddN#|JN(0We+ z#BWAwsuNdw{$4sRIuT4w_{%x>Y}Z!(SlyMOu4JbMIIA z+D~?PXO50)ibOEPNfY4o_;V0S{NR;eg@uLdWoB9Om7aV=N%HgLRq#(iDU$k9IoljO z#|JlAbrMQXT!U_;yjv z0q;a?Q)pihJX7i=FH^_{;W2d~_B7^NmlF$ibry@Vv4m7KM=u22LCr)R_Z`EmtgjHk zBzy#7(6*tU(Uof3>{;7k4i(Z?rGVmlxnDGzOQ7KEL^PGu66Q6pk}Y6$S|QZt=P zD%NmxZ*q+!AJxOD>P7*r&r2&U8&8nS+!+0-b=ytKWc1yYSPjI|r?p*W>Y%>1%i`CX zKn;#px+}%IH;)rA71FPN4!^3D`?HU3_=aGdqG*gRRD|@ua_ZacyRL75gqlXs{Q_`w zk^BWz|46Wnou)*A)XTQ*FDod<{d*9AUkCGzcIA;3d2zNt=E^pNPP`lM2C$*srGRn? z1blu`0))5(v0anLnqw-$-87ZtRzCf=RmF>e+4NUS9aEmEuulS6wCWVwE))2)f7tIx z4d}^)FE&E~_ReQ-?@L84bpAM@$&h0d4s-}U@jZn($}c#`?_sIZ__?hjg5W9L9*1d5 ztH@2hCLX4&B&P@y7ecLtd4be+Avk8Vyq&|WIz{27z;5^NaZqnB+c*haCBaR5?ump% z1E9!m<@dM+!QdDHDJdyYQTDah*%n?#hKA2n3KDu{9*v84h(CEiQ84eIYuW2We0=<~ zdFu`KoRFX(s}x@DnX~^$0eW4i8%w(a__lIZTpzT4K-o$7hMx8>6QC}Tq8@NMAL_Rk>7h)f+Ae%%E5HktZe)hNkj zH*NudCm*GkTOoaZD@qwwXdTHR#qU~_DIxgeV-!sByZ?Uo6Q@{QmJGYMJF+!JL%gYD zZ0?FQgku#tL?)DjULAqELKV2P&NDOEoaOIlSwU-0vijL$87CgkF%ALkOQQwzwejRl z)DUI7`DgX%xvI_xEVkKEGGRH(LnC<8qj74gd@2f~_`^JIX0w%V+PT5~>EAzThAS@QIuv)>X(tMd1SQ9!o8?AE1zqp;h5Ps6zj{%^}q6+xQDF} z?CaT*aAB)m(seF!5xw}+Vr2;-a#YN>I{8)hgV-&`5GtqGZ!6AfEwY=!vJQ021c4-( zFL&5*G$zf9PSoDhQ4(*>YnKpfy`vx!6Se&+#Hg}=ADYFJ7*a!OoK+7xCB&hS)MHDc z@ei&Eu!P@@1*zwV?)lhtC+{92%wTZ}eRFulg~vMdK7Hl8ArC7E+~9pYyBD*D zoLbQMt_*MSx&+#UyS|b}0u4$IW-oIA2gSB(j>Q;UevLvi0xqijZRkDe-8ix(!^RNV zDcw}v64n^$^TIEWT&f?glNdN^?$~3oX7)8yJu5ENkPvh71lV#hc|v^8llg@AT8D+j zeCb|NV?P*Vt(jOSIh_e5Ft*H~H9ef+5i&2n&pvKFheArABQsr~ms!Rw?`X3lnzmR5 zRNT&{6B~rf+;ekuAey?qkr89WeF3yn6&8{IE$+n8q~2Q9<43+TPtR7eI9g?rI4S@~ zBJZx5hS+e5o+ga9)^PwjBNih-c{mQCZcmjc(VwLbIA&=t(!%rU0Z|)RMlso=?xxKv znzP!uh<-NB#QoXerPbP=77)30;S{0ErKX!L^Ser2h40a{b)1?@;UcpObHBhHihac( zd@tCk4M97YI(2dvAL0rWg4Gu3GWm75P`+>SV`r}0w}qQ&wIMNNtqTRdT)?8Lj)TAIY(H$ zJ*Qa+rkO*X7&3M81zXK(<*ER;QO^wXc@*b?%4NK=l+%PWKG&I<=VEA4CNGE)wQa$T$%gA?OzU&@G zGrwp(1>iAYm49m|mD=E6AwKMw(Mk-kr!MWvzmUM+5;HHK;Q0$Mh%GsP>;UYEM_3Jj z*~!jrR=;SVF77oIP@pOH?a4p4j(n0;oz|P{{6v!dxu2|2j`wD zBO&_5L+_-0AysGQ>)q?4*VF33z&pa0tr)^_NfT;hYy;zMO&%hF6x#)AHJd>m>ez^& zZseFe_&-PpBy=qBxMH{fYPy@koSBN8*0N8*+q#-jYmG;(kCUf9q5P^or7fk`&*kk3 zXB!I>6yw4ZUt7knUwvp2Cyxs^%*-E?K6BviL@+iQdu2ytMn_xkJunW&`W~v}I{nN< zCfBsIaGMHG&yMJ9r6kA2Q=gao@!F{rB`jO~55kM^pe8BJg(Wj5HVf6HrHU3CJbTJp`oivhMq)+xarH zA|(2@r!lv6Gcwa(n&N9;e~LUE(w8wn2E0;lCAj-r{-`ZvqVH8i*m)-F&#gB;^qy*iOJU zq|@!DdAvO_4wiR!aWOb*Oba2cySh%FH28&q6Diek^+YfbRGr7Eo{!EPah$l&{9d3N ze75FidXhrQ6^PR}CpdGz-u<%gr2S`+t#2asU7PPSuXN~>Tojkg%Z6fSuHVuuoBE%J zFKOiK=2}@Yy%W;lNw40>K{n`*bU2Q8)l}89Y9#YYfIr^QF2OfE;E!x!BXw6-smLr` zYH%odJK7GWQ8ue>#M&4X+N9WwvFS>Rkqh1F;YMkka+ppQncw5@)8sAceEb2|kNnh{ zSKjoCQnvyPYIS2rBJvn-cQ(?DfNn~UKxYW*8tGn9y` zlLJgC>wqb$p}U|Y3)+-1EbycNc{K4x$BGck8_|R}>TStO4ei>@tk6G#mp<;XX`0=j zKl_|mBQ$KoE!6@kYj8aa)UXBD5$!o{ss+GyXKHw6HUp!tn+V5CVYQw1qX(}Nt~m-4 z9uU*^b<1+`*ngt`o)cr*S(5Q@$8uUWZ55>opeJSls8lSy`E<`T7KP+(nFjVlNqJWq3h1{B;ibNE3K+@Ex}i!q;}bCMfN6xh?Zl=X|l* ze}Dg#4x6064K&8L6h*E^Yy+G;kzx_hIjn6Qx0{#VbtEIt$TKa ztr42FZqOe?D|gFbtY%>e6U$CXs}5)&^F57);$%vK`;9o?P^R3L?%Nb?;W|YZ6`Iy0 z*w8T!ZqTuhI64czrN@q&(yIUC-LL1nL=9Qw!coA-ys&O*K0t2UxigNmE7Jw#NOjl; zqKL!BtU(H|vAF?nFJ`)*{GuF9$FxTHQin2H z<3IO>!d5dq5715Ui+1DK+g^W6{=jUhk9nnw+RmwC3LFN=+pkAQ=yOAFhPlRHo6ggbPJs0tI47|1vq-4ci7kO2YYm=U*1-L=zZOE zHl{voGHQNe;nG6lWHTc(Wdn8R{IU{!U#G&dW+?aM4H;H8N(bqP-lw6kZNQ`B3Jyy> zX}cM}oAPxWxTmA^=UEd35(z98>?j(Zz(JA{_QrLMf$!nbUoJut=DEnp5T$l<1#B>~ zu-IsXuPoyD7gcz9d>UrK(($|-*#hp$j8-+4L|*SIA|+aT&yVIn{1-(ftw8BuZK*_r zH;ah80#JQwqC(0nn{@qlexl@uZq#~oJGV4Is8v7_9n`c?ch;~EDm!?0L;;7rJ;wLTs)$};;&Fa*#e}`3BSnR*CA4b zH+_}qR<%&sG)K|tAbI`RL78RomI zVYvnfS#sF9@z^dRO&Fc6whzWp`dv>-vnB!k(6IC~c2wvl;bdaB|9ltsCJO!>$U(`+ z0H??ef%w7vG4+;$RkUvt>K6$#<01N=$oA*B@cV*{c-?*LMNI$F_IJMO57PsrqrBbqzY(*AEk##R>dS=ji9KPo=-3g7?v-+HiYCvm zQb8TKbXp0_DGJqdLDdHiPc(o&qh6iw&z+K!z9w4y){SZ}QZ;xn9NfgO4dE6J1SGPj zpL;8gw_IZid!`ord9S`a{gQ5_25PW-iWdj zQ!Pm7SB$O8_w(<+*WXnz3;5H~`8S}~*jkFx)EMq~RRW#O86MnNqq0{z zTsQLtVdU!~JnbT8uRRlLrT@Gu&P;UHKpQHp?}7JydYZi_;~TZFOU{w$z0f_7eox(& z%ae4Raqr5+uQ6V3l@!U}Q1({~t)3z-9+i*~4n(|dX)Zs%vGgL>;ar`VP+4_Cy<6Ih zB!>eefeGwRp+mRM30p@B?x;Yy;NgX|*FwD)2O1poz$83*soA2WYt})LXzC&h56)fp z?Q7lzs;B99yvrL*uCB<=g}c5351#`@XFO`zvZsBfD+iQkCFp<}_$Hjo9#zrOuTUK- z5NTWL6wCKbwvAVodH7|N?xn6Lzv=Mi^l%aI;V=zjyV9xpNE+UWI_iUeEd9OQk8wMc zXPfk*Ab-`(vo?026`^K}$XztqF=Q^*h{!ScDjglL(7mVK#O^crp!mBP-W1Q58W-h2 z6}RUHeE~++gT1@YW0?-BqUy{UDGmo5yz_pmfh@oN;i z9_~&9=M{UEO;)m~eYHsHb-0bTUa3_(h-|Xl@xO}1ce%U;1G`lP4D3D&YM)GR-xt5Y;d359nOVEHK<2nbDn&i)O$LYR~hlz zb9=3Lz+RHFY?XHHwm~IAt&f56R>P!yEgm!8AUJHlTydS378UPST zuYHtG+tV;2DG$}AI`HIoV$s$T*`q?jD=O_HNz7nO++?2`@MI*h$a$1C*Rkd>6)QSE zWn5lzpTX~8+Ru1te<4gZY#@S>MPRVzBV&1Hn8N`e;Xj7`8~K-uM2y8jILXgym%s^7 z5sJF>GT9eBel|5!*6hp}hXZe4^Se`L6}In1w27#xSh+?uACCjWpIwUB5B&0{gp(pp z5@0cedJJ~Z5ddrK^)7=lqL&82-_u75=J$A-B_(~wa9x!oFel?&Z~-Fol*Z>5vPW>D zmgl1Kw|JiAh&#um&!XQ%7~jh<6())}OHxfR&*vk;IYuX^%RqyQ=$!t*A7KmNRht}~ z!~dA`S{_}BPnw$=<^=L&HrU%7#%{AAqk`+wUx6t2wHConk^AaX~~2Jev*0cmH&nYrIBISLW|}4wj$y=WAM=2 z|14qQ<HgWpJ`C%^Ix26&hFd1fuf`x z@!GfDmcR-*R@pril*hm#McXF(&vDcAS}CQeGr3%73fKj$vtqDchd{pUX8{E=uA>`0Q1K}ff#{;V05LVGk7 z@myO?nYFAONi1A+TU4UGo3z`*I6ZaWd$D2QhXRj28X*OsGw#h@C2^d}cm2`kQtRDt z6>B@H#SfswnrJ~w-*68Wooe))-e{b5+UtwJV^b4yJyg#AQSB1>O~)9$vPZe};dama zDfRD>B;ILBgBE}HsywQnH|=hrv!MqMjx2VimKl%TvIRp}m_X7?YGKf`VXn$A@2Kii z7!Rw7@mnJ`Hxlx11#r*@t@X3E!w;V~hJFS^MNC9yv}me zympf0_%5_$^tv`S8;`%V_+#cZl33?IrT&_yc zz#fr{p*FA;2O0nPTehU2p!eGNPF;s7GAsm4}z2r(rrBnox4kirI{!VIFwsQ)|VpSp+)t`^aWVwVqmEuyTN^`*~^zT?+wNL z(NB&@Y_Ww^tkC&)O?C2H7}>`G5^VhMY!7gGYxbU3yT4N;T%`auq)sqqcN&yL`w$db z9!ADVZwV|oVqrH*86We0KcD*6(4fa>$oKcA{h(Y%7fRGCzotS;7ju4kgeHHto*b%x zLR@WR1u4?5#*|a(gFSjceFoW8)+NF$0`f3@MkXw3J+jk#-xIrUNvw}>Oi$E|Z7^5m z)TUS{q_AXHomH$)tX|1Y(E5?TEUvD)Ms>ndctF}vg6>5b5Uv`tNhF`jTD@TWz~niH zLZ6DHqmg~LCCvgC_F038H{CPm`y|=uCOEJNMq|)j!$kFr@L0E3$;UToVxr5h;QclL zL;TaEU)%e!DSr_bKu}bUhsd>l=1!2G^Hc6+?R45}*!0EgnKc}2SL!biI1d;q#ajjx z!MlHX825dD+WT;$!T;guU8War;Oki3^e5T9r3qcszJKFs8CZ&>WM*goKyl*|&4T22 znIXy8)OBh3_MQ9XM4V>Ekn%20ZN$aYK=z2bYs2eR8SqXpoV+o4?u+- zbnA=E@-l6lbxW$uL)0J5Hh6BI&OCKSwD1vf7NR3yE!_#TZUHU@TEvV zdmZ=4uhhHmP)gE~5Q*)O#pYcbvMF<`N3AL(31k_0#z0xD-LIl!hEqssNQBZxFG&-) zl{!(c*s|p;vMJ-)-(IF8Fef_Qw@L`FKE|KD=Bdy0J440@NxTr#hQ<<$g0AEA_p#md zQXIUtk*7Cg?xJU)HZgH_s$OTY791N>@F-S39Z54j6nF7sye@%aM9>>D7AKVqYPMZ!{Rb=h zio|ElJfNvCSTW-A!99k0Y)t*)lDyF&g)RGPZ(?wjywP!MAeQsVvhNenZ#zLcUZVfZ z@AdJc7_K9lLloK2c`C(dpPM;xpL`Cqll6_{i9|>dBIoMz%h{k2n{DNq?nVO| zu8Wo)+?Sh|?L#ayyCMyt5bVx_S_#DAUoIl%%N2Z+=g){fh`kN$c7<3`tpfZnORwu>hV+EVpUlM{R=;D zE8+IPg8Q)T0TRWFbhInQJrvF7+&5D8Tu=n#zhgb8wo%l6DBNpczA3n{+6`=fl1%^T=wImSUJJq zeIuYkj^Ke2aD>aT4yVp#wn{(lq*y+44P&Hc``)@_hYKc zDUTXUb}ktO^UK{UO)P*5n3wd3D2wv0SD%0WLgzDbaI9R>#?Q9ByxcKy1L5+x!MRnm84SlkY0?c!wtZF>nRd2ZxJIGg{&A zbn|I`tmIbW{J++pQ1MzEvF(WHSe*RtL;C<~lF0w_l4WjR?rDV;z?Oj0{0?7?n}CyF zEId@Xd*2&;o8VIb56!iqs^R&^m*;c%oI@|dC_DiPFnJ0CNC#7<0{{&}-q4LOO{+pu za)3$>K^z%hAecmq>;bq3%A-!!dJ(HH!YnfGQA=RWujuFy205m6nZR+SBjS{_(Zhdv zZzP#j7U@t}9EP|px7ZbM(0JcHYo$aX)A@-XU7k%%n$=~=>505s?x^qs63&ISV+s>o z+QD5|B3$BpEkJu0>8dMyjm_C;FHBO?AZ$SuYx-8b*;^EnDe|@-E)oAc3@@90SG_N| zf?DcFmXHL)CXdpKAcwQ45^~_%{G1S=r@S+=&8N2!tp0*!RE*i&1$B>Ek1y9rXVJ8= zS&%k9(0q2J6iPMaF%74!JRC+4B8PG`7C}Cn)Ofo^I#Q|4<{uO$>EKo*NjbBCPhd0! zZfyx%?LNX_&>I%ia#w?`K>wY(#y`Vkv-JxO2~1 zh7=N2;9DbtHzyk6IE0#_fZMRxv?LdyDlMG34hR2jN!a*vIpl9I^H_~t0l+9lKfz$2 zX?z~DVO+sz6d)ojZNg`fAYT2VUbtLrjgQ7hGw>ZGNmkBo#+h<3*E9Qo$kgSlRrMpu zxDbvOr-05sx}UGiCggJR9-d_c0beZ53Rn|)Ohh6ElnroQN|orNwE3bcS&l|iZo!HW zP0nZ2!!H7#iJ~}OiE%ALRA5XnPLUDL69aDaMY`0%FiqgT&ivmSf5a&!7Dwz$$p5+j z3yHIjZoYqMdFguTSV!=F?s31<6^#-LXZSuTwYP)Kh*0n+?fmxJ+c`w)zQ`$X0hh4$ z)711z0IP*VS~`2nDu7xo9GN&o~*2(^Uq&w|PBSI#x>243)b87B5|r_=ruRKRCCRmyCwgR}i{#ae%125;yu=yYji zi=R2zg6f8oU*Pka2Ss}*Oi)DLi?p1}Vla<#w>d+zn!$N-+AN)B3bp{;lV&%Ip}uw^ z4Z7VrEX`IPG?zo}^oYhc{CI!ObMfqPqfsBqjZ5w2n5R5;PAt3}`r0nIx^e$e)P{zM z`zRFPJRq5cvCY%6=fKwbwEa$x5O3Hb<)o_j#@Eg0=5QvuYZ(cI z!UHG*C-T}Y@7InXy<5U^rJ%r3;D=7+La@2QrhaGg(prY8v>-FgRcQ0VqFC+7@ls>l zB9(s*tr0k)zlG?{z-BGzF^)A-&+~wOh$Aaybbq*@0=%?wS-fJ}|gHX@?{( zl4UgCQZC69Hz^t_U(lE)l!CjBgcryhdNNX&y&t3uOAMT?8KeTI4<@Wem0Bmi+8dbh zL5LVb1RC9M)UN7I1Fp6LLdkj`gSaZwAN=3^GO!nna^CEV*!QeOoX}71N?}1#Rx?~z zHT;m-Lx))-P1_)9kNLXZou^|1B;yf;LG4#S@X2}HUS4iri&X;M9~6DH2JaS;2iWGdYG4>;ExKbFM)8o8LE_n!&+(SwCkDQ5*|n$MO$%t;YH zZK;K~ItX(pi6qGCbYi9FQk-J{+96o~+H7_xUJaT~HH(}yr2AB!&T&tNIb<$LxvN6e zH4*pCa3bghk&9a54Qy651~-3E zGY-f{v99BK(jb(6t=Q6-@yfc<7I?h0@7oDNQjFw#yB(LJl62xpi+$1+t z{%c6s*r`m$Mcty3iji#162TeR>xI-vMk&!FC;|w#Yz?}&7_6p@4@ih{GxnST<3Ha0 zW&UF5@-VpP+)T+%Qk=4yhS!dEiUyO`AJ-_|--mktqz2=I6>#t+*g7B_tI`Nt}IYogzCrd46XuL1zL8;g5QLBol@K@^@ zz^`y9-LKTemZ)tQHDt`B+1OW2N4zAy7b9>tNn$lFbGLm*rwTvh6iqfBQ68Sk^y)$c z*|$+P*6-<0zv0jbSW1~UD57CC==A6cv<#Z3JV9bsEW49^OzTO<3QWx93xWV!+9&j}YGff94 zaw&5kwM_5@x>e!CD2lml)>OA^?UnMFBaYN$UqGBgh>69eoelQK97!{= z`H7vvqQaQ&wT{FbHa6l(0)8o46!c#~z znxf|&)4n7yy7fZNYnDOxMH*(BdsuV)>2ClswX>Jy8b-qJqR_@!}i4C0xMP%mc5-oS}JV;-qr@w65 zyRg9M`(0To!+?2IwJ7))LYD4x-j#^$)giz^F2wJiO&;~qb^I?e2C(>H&D};Otj+Y? z`<*_u_iS<1r`#D==sWR)fd?{H0(*7VzaZ!w^w1+=n(=$T3p)^kfX#GHCi(oMU~-tE zQU_gL>bu6nPMNqv2GhFJs78fAgDd$FTIUjzJ)JsiTMa z6Nh-smsIIq<(>(BlC;myB&j(0G^#}8oWk0DuL9kZX~sVe<$dt#`tv-qdt?bOz019) zWmD~!Ztb|6jHnkgN@K7BQZL5RrP{2YY>_vcp$(l?svz}_r zqhh}M0u;$T3Tjo*IE?f93Gd7tHQ8ja({M0Oy{~hWA)*vNlAuJYz!>B6&J%z42W@_H zPDr1NV~)`$OX<8zC6etKM@0|dt_lCb!vP&KheOu*01&ECyIq29t0=GD#9rUOn>8M}(zW#BFq8r29da1Eetq$=C zz;L4K0tL(Xbr7O?6e;Y3c<`K>iJD2xk^QtwM>+3)c4($9BmnuQO zI~_Uc4r~dXuswKkUg@}|3JzB$ED%TQpX#leJ9=|4imm_Wgh#9#$(5Ub;NtYB>k^6Q ztDYzHAWF6Eiy|O_J%)qd#H94R-N*GlR{r*nqhrsF6re_odwf6M=;w7`M5u6l#Cd=A z%7a1GuwjNeI| z{uj&RE|^61&9-dlQV^aj=l*(E8fXl(mCBf0Xmvk>5qq4ku#_uM+GM6wb>8>3E>}n| zR3=IUgGwPDQ71pk1ZhSyS;7H!Y`rjMSZ-YZ=~-fZabn(W?J6H?(Zze+A!KD#ED>M< zHG5oaeisiTic3*@^QBoszR%6x$cTmq(iIxt^YqjfMIS#kvc8@dWg6rIvXx>eKr~?a zCoPcqgPob+3dFU=3wraN=);D&P`~~#5=>dA3KI>u7YWwZAYKcEN`<+~BkrV&*KGQ| zvNx#p)BTLs{+kb%RKAJw7vZ#811V*5dpIfF`{`oPP2-ZNfI}9ZjymXL{AUAlkL{%k z8AE>>8>Q@oynLlo-FYE3_&-v=hiXnWu`m6V5T z=3nB!Lsrdy9eGGRV}e9khiH3RK<}Lms{hi140WgNIhVDt>c6uN!1McqO~L$KKqW>R^bey# zEQI{oV};Q%$(+SWXwCJ?lqQk4;++Ry$meC;HMl9|SKCY1H6$`8qot$)lLP;?7yf@= zeqtzq$t7;EdYII6u*Z2`)K`-UGBPqj-=`+oWIoqJ{03ib-~K{qv-4iw2>l4Oh>71D zS}hBsLm6^XjI$N2r|51Qs)adc!hM2uQJJ)wiPAbJCMnji) zy0IDnYNA*;fyApGDm6(M3yiZl4sF833h6gd&TB&MujkSb=ZH~4c0D&G>fj#%+)-EQ z+IEgLJ5JC0?+IZN%NU(@ma+8Jm4%68Fb+DMR+bCOo=WZmKJ8Mj_a?0Pj_U;`qTsxK zZQiaaNTJk%^*w=nm_`(SKInY=+HRM^)<8flag=D`_)nT)18sD8ox0U!1>@(rRw(B5;1R884sRl+3lY$0EU0AeIhP!a- z>uG{5ba7e7|C0vwlZTY}^U$M>S2^mfKuoayCiS0*d`&ivTh1bf)1` zhFMBy^~>Bkg81B$doCS=Eg-n8Sm%DTHxVyAVzh}yj)KNOlGt!l#|}B=cVgkQ^uIUZ zh_XrNhT4yIUQ`SFUenqrgHoTE@!cy%beM@q$_SSJW2^yeVrZoQO;3zC2(~rA|9>u1 ztQ{F%PE(eHR9J&81e~hDY$) zOR6IctZ7K$O_aFvRT%FePA=0kgaK&yHk>5<`SFhHa^5)3@bQm0wk8r3H~(md%a!_0r3;L#pG&6d_GUV);zU|F9P9xD22jJx6 zvq?_>VX9jn05=*OT|e{{QLV2@GQ5hC0}m=QolD-?(mx488UNbg9UFod1rt*Ii%frp z02upjmH0axG`n$CWgMm8wiZzAd>A@#qmpIqGUpd%CGlpC7Ixlvc)y1?w>TmITOh+MAnowx zyhI&Z!%Hkm7CP3_n#@=nPclL>lthDYG^Et#v-m)+JC7}9dbOXN*s7=LXrQfWcgB_V z`@q@nc-lOB?gaH|5p-9gx2QEzO8o;CGsL|0!6%EA@IOAvFi;yjGunh0g+rfzX%W5I z@@3GfAvSBJSDcuvI7INke^c7fta*aoX}XX(peUj^ncVl_u5X+{z=# zy}B|)-fkWfYEBr3bRqS#jmMy6Fo=3|79BMJ9_hKm$ z@%`yFbW+nybvX7OqQpU4o}!XwfUOZP6r8^ko0qahhJZ;;+Q z`}~t(wk#5A-An2Fhnr!ocycy$<6Q)OQvZE#rZLDI>Tpau(nkVtNfp`+Tu)<7S}_%F zXt4j7*bh%cvCU^Qn=fWV4F7l7a7nI)W{aSvJ%qU!UIRi%@{YILQItYP!iJY4SH>!c z!=%Yej?tQRe`J{#ZArm2(Q(uS!WvJY2{mRr79VMzBkT%@(A(HjRd7u`%xqQqLF~y`0rcWlp#Sd#1!O=EQCjB@UP>@u{ zkg(mZR0K>4{wE&%cWA%@G2X3zL8o4f-O(bW4jzjAf5OIpb^EVN>5P89%ZK-G-nx)}v&L9Yg+{Kli~UcDy+>1m~T60qb~udQbLJD?)+d83&Jw%WrgQwd7E(tY)!; z%!ym%-8}e>*c06lqhVJuK#ddk_$Iz=k$xK|(R^TN2uxi`9R?cpTW0ky_{zo9x%xd&34&3sS?15>0mEvOI-|~Q<5_cQBlUb=(Ei%$sn**|pH1`!;G48Au z?X2PEO`le;Kw7^y|470Ffy=?C@NeHcKqZPS&)fYk>uLHI=UoB9|Dz~Y_1|9&mvv9B z(rw%ghUyZA;9wTUg7)@zhS$MWJj)#wM{)MiZIePb-G9bf5xJ^#GoX91FfcDxL(-E` z!jJ94ar#ea#J{Npx6kbgHwsQy@2yxTIlqTAVSN4#d3tc5(h=8atUr4C6RiU42ym?d zt2p$je`Pdn-|Y-+S?V>d5ZU<0zxx- zE&sJX5C7i8k1VPm?XYXV|5p0iJ-lPY*Sr7AR}z%pv2E-aS#+eYGtmDQJ+9;ZCb!ux zOqM~Q{}9H0c9`CYs#oBA)_&KL_E8c~75lOV3=ztjD8TrzjMnD+IS1SJdGlL0@_g1m z?Vum@zjaPxf%rc$gOq+*7rWaqIRaL?NB`3z-6+_Z+@uY_v|OyH|KtDxz_- zKm?u5{#sTs225IRJAQi%K+;~|a9;RWn(>3+S9C?c6YKbrdU5Jk`x?sAMWvM^(Z|6( zM9k)3JRz0JfR+vIET6~Q50~NJ`iH|=6ofQV`iY5hTWQbc3L!oWMX~)Ley`@#a z@vNG;L&t$t-!|kGM7hGG&Y@t{%eZZkG06CLG&J=pJ@RM27@Os$1hi*2%CFl%DUmOT z$+WRr9Yi&!*4T7zKdDv z19TTT&nuwaj=<^{_;ZJDDr^m_I}hDWF+Y#5sWqx+2z$02mfffZgbG~rk~>)Lp1E`<{b0Y3Uo zL9uTWYk**N@pDK2INZ6ZvRnRV?&)L$7SXVRE8`VwR;wCtm9Exll)X`JYA&jM7;$dQ zYv=Ax6s)vpH)w<3cl&BaR(5eDbw591cfJK-rvkDRm5S|NVIev^O=gu++G7rc%B%`=RMNdyic&O~mZ_2%X)V1M9w* zFoh_PpI9{X-Q3{~=k5MfG)0n|2a=?YTeS2Iky1zsp3pg9)^kdUd?|hnPa=Ojus-c? z`no=Hu0<3#J=?|xHlryZAW7_*gGuRYr{#k`vCr^6$8!hqj-~7`Fp^n_Yk?%|Cs&ZU zO|ioS7vHirS@4I?u6kMzVp(<1r}+X6j9&ISWjUtImVnr-yh?H|s#1_o zZ{Cw%I6}U-Y%N2#QZ_fz+Gdye`{w{b9qLX?x&_tL*mZU3{=#gc^-PZaID!J>khh;K z+e3czY~p_^;@6Ei)p*E7_eOioZ+-RrL)q@IwP)oa^0HGXR&zZ;e)F)q$D3O=YVDFA zhS#+@K-2p^TAWEE@FNYLY|`#P?3IR4=-a;TT}tD(AQY77`jEp8Ns;M4h_)~Gn8(TAD#e)RN0gRU?dxtl=SAL~0Z&ecB2zX==Yh-B*e)=M-7Nt@``RR1c zum9EEv_nIylaZSkX8XoVQEFqQB!-$E{Og0QpLEsaFmcv^_GWHKvc7|as!1()rNEi5 z1Hb2AoDYgpfyA~BGOlb=J>3o^YI{5!UhN|yFl@+m>J=n0vR+WalaW1^$gw1ifXuBb zHL#t7aJ)+mmwrOMyqUGgg7+qLopDX|&dTSC%9a|~?k_(6#dt}#LLG$XQQBpYX4c3u zs!1Mg4G!{uRSdM=u)kA4;RMxckOkkNq_)NR$gZ&I`nbA();)v8q?n%uj<9rrh(jAI zq-(itx^a8sc-7iDAexd>D{HCIRae_{aJ{pQ2Y+arfQS4a*2qVmVi}hu1fAB83LV3$ z4)4^T=0E@>>Vkezjm{FrCP#)rUL@p=;UrnM8dU097@!X{E?=y+vz}|rIeI?W2+(im zxnA*6hiXmvX+FF=JNEv$dE{CP+vmA$^OR2{wv8-3s1LJs?GP`^^|_rFZ{I%D?O<5fz}?aRVf1~iGzC%GNQ&azrCz|Y%QW?DSyii6ET=2HTt zz8=)z>C{x`Q>U%9`kaN&f4(81v%lF`Tm4Lm;0O56Aqe?|@Z*}U04>M=YXr+=JVHld;} z_KT8FJF8@M{Mw5dYtl8HQl#qlX4lLi<-`N~#6d@&^_6Ci--rtFxX!V|YCFWLd7^?~GM%cR?|s*0rIqRpNw!)Ic+z(^VwrTr zUAQi7C0cyQuG`d+IgFj%r;;-p7Mw+I3Ki@6@24|WnD(K-Hgkqvm!Dk+Ix-@oi0v(NI0MB@yCy=B;t zgzV=CMMi*#sc+55Bs9>e!m_0cc+jke{^oNXHw&Q#7=LpFEV(F&U$6fnW7;_4{4=}{ zSAm~h!%XysvG0M*nnA-#yn$L`59YhgRgol$le_S$O_>~1`+18&f~*Pyl#bDPp2|NK zHpz}kdp6sqdGWqfQF~u4tg@^DVTa52o!*@tcIghwH;K1S!xok-4a#3x;01`_)VLfX z0JET)$d|*t4HG`F&2gS-tRXp^U_8!6ZqcV&a5r$Ac6x$)y4M8%NYB7DP~oA7r>JAa z#Ox0xuAH%rIXIUL|6j&|xDB&6_sWgtbJSHFJ2tpt0Z_^qlEFIO`CK1qkJjnrNb^Ha z`ybGa#MYHmXG~RJfG)%Fbrg>3_U(8Y3>%SaC(M`@18vC%sml?uI`f7SD|czewl_@l zK0DY1iI5KNQ+{Mv=QYs|l6l3c2g`k4*8p16gYA6isTPTC2&I|;J3(4V=^ZiWD5PU0 z`YW520g~}}at42{8Vvh=`PfoE=`Vac$Z)X*?G3VD$4#g?mW6N6q5O0X+)-{7c+4TBl;7s+-csM&T>j#H1?O0aRPP@NkL~egK zev!e3I^fqZ^7&+#Hx{-G%2PS3C1&keE zUxhKqmVWs5BHM|FkDJ>}7~j>$km$kyD!$#?><+$pvAy6)w_|WA%lLy(`%^FC?JX9hH z$hb-h7svR-GR-T_WJKrReu>TJ5|@5UizRX-xGs;aB^tY?bKSI)C*s26FrUf%D;&0Z z2F0iuX68@bVnpd?0*XKxzr*;Tc7M4tQ<$wKYtH(rF7~x-6?AvB4>(IFv-IXL$4?@B z%sw5%|1_tv`Z;T56BedE94@v^s%+eCwfS}%5@pYdV_T+)+VG5ZgtsJi_KQLnb5`f= z!w6-II1X9Ka49(6!~@a60$~ip`VdtMERX2*bN8lb-F*>^y?XzfC=; z?ab8XH>m_~cR&6W@UV9n5JpHcaSS{gh_9S%W;bu$&ym$=t$zolsKKEL`PK*q*}Z?t^mXhzNq^DhU($=+w#|>%gCLn?Yp8 zH|S7a=2=a!$BS0j9TykNIO1cKg#Ae?zb@3!r$aFdzoVtqoa$1$9)~8IJ1S^1sa*v+ zNDZDpBwYVn*r|Lb_bTV`O!||zrR1{RugVDe63`KiZHq?j&8$K8M~J8KDK*|48@38Q zho5HsRCl9p9!NYtd2HXL$r_7=vwUd)8+bQByIuyKCt!~+72h4Z#Ei4<*?#{J49k1D zceZYC<%)%u4w*Q1jd@?FS79Mb8wer99!4$b*}ASj4?K?r!ybTDSFP&A5tA6Uaulig zQo2^+%IeK~RVH@9uBzDRyK!r)n_6k+)1Qk&6T!@ab0Dohf8vnBKtP<2lnq~3 zM=}l7Gy(c#$6q7IuA#qA>PJ^)wzqdlK?SKtM-D>T2P<0jO5gf_La7qlF}nTM#FE#A z2wvXd8(q{dED@xY!*`xKUH2uniYY;048*{!<4auTsb1@s{;IlHy$RW^l1jOmgUK-x z7A!304n^c))zwjpr^Yd81L~z9R!xy$l9_Zl&8N5ithu>nc!eyRCO^#Jk)-x@hgO@`M_Z|mA;p(JjSb4 zlI{DQ7CD3|XL9ooX1A#6pcS7NeAHulfVvo-F_KLDwJ&l5sYM;D;c_bV5cWg5GNHJ5 zA1~<3J~}Bra)+zF3>Qx zN{5?ov>se&ZZq!J*~i)2Y1aDlu9E-B^Lf3ygC*BblR=XO>vct>4~vV!a{iJM2XT

i`>FqHyU9()md(k!(6>+Bh=@%ClZ`hG1Ix_^P(zPtM>_{4B5`=6X|>M{#fGvg(4 zXGSj`qm(N!mUW}cX_d)VFb=HhA_@_=U_LbrbalKGsBd^o8KOYQa8s{{ycWcLu)}8Hb>1 zxbK;1KVnvuuKD35G!W*-53t+K(7ScVq&h(=|$lQ1JD=ATGiFQrmDDfO&mBEQ%KU4JyiEZOE-7gV5u{5xlG~Gci}nz zFL%7}8TWi~Y&Uzay?)QCC+3{X>`=GHfi-^^?2I6XbowF_5OSN`E9oEyhljPaFLD6p z8$vfk-5BaaM+?FDyb4@w;bD1R?zl2S>9MonZS&1KsDg#S4zcaeC z$-tgH)7{3ApR1+pDec|eAyGXY^s1i>RoXD`SpP;V5FlO#$w?Wx7!ERDT+P*q>5*87bfXTP zX$^cvo9jYM-?NT@(yzQ!xNXMJ@83<@W bW*`LPB!-d`w-1#GgPF<4)BH4`9Tm)6 zr970UjnlF6xm{t&r(1^%i7Lkg&5tYr)S7#cYQuGzYHkW`xCU^Nn}|&v_j7;1k|Hv& z#gh*xtX_w`??}-oOL7a8o9I=r%ZtOt@N#tB%k3p~(*$ zF*K5XN6UDk3|>2EA}_|dZVc}`qiN%;?g;h+Oj+Plw>ZI3{N$HR_f zhRV9C8warNCLw}l76g6G)M{_&dY&E)>9Mup2DGOm{@Fnw&SCwy{)Z`MA3i3hjVJAk zpclm0SR&)UA_>LkWA2?IUVTTNJmoC<8mobsD_l2;HmbYF>1^aUghriM`#a-P)y~#b zNT3+mpzPBuBWVybPi26~ypFzU9^IImy0K$bq3;R@cgj&8=5PlNq1 z?v@5shn9j&to?b02CiDbua$Bog`S>MMuJfb1rw7Z#qG`6ayO*g$1dI!o6G~xj11dI zRy2}oK(p%Ng_{vi1Jwa`Ci1<{<>%U=A!z5B#2@=XoC)FDl{213MPYv)DpCgRwJB}h zN3GSYOhBdgNMMN1ho%3UqAZdQ9_E;vYwP$!hyP}SbosINaJJs9SsGJxf+>sK^HjE= zjGCxw_iOCRAF$YL)j;i|`5RqS4a$dnGXLvxgiOqj4BIB& z`Eb6WKsJ^J1Mt*+F8AL{QN8A(eIHLI>`}$)L55AsHiGmKYF9M?4Ff}!lti+rKf<=> z9E$cKCaYx16_tgYy5Xe z?34{78v6y61szCO`0Y+IrGov8F_}%#0gAN0FHccVGpGj|4?~!|ji&0W^eFq2cjuIr zuHA=-9rOw@mz zBd}e}_vZF#3jV*khlc+V)S_{IJUX$4U`Zm4>GTg`O9HfscS3CH8K|uvt6_ifaB5;9 z0B?p^2n-%Ou^ZlJD*4}riQT5lR|roZHEkUh^yxkS8H-=A##0dWQHtk=U&;VrvXQ9m zl%xJN;~>bc=-|0`=zZ99_%>y^4o4kXFa1DCbOlBDxiX(vagRWpX^?v_pPVQ^itt^T z5p*WJSG6V8d4KzvbwOxq;Hws4D!YQ%{WPWO#uP*&fVFfxaz!yyMO{>WElT^8qNXvC z%JF#c^e~44Tjs?2ufM_?-hu!rK(iC}nKy>KT;2MVr*3}r72>gz>i1mIcuGZ_<}9ns z3P!^R?SD`2L2|B(p_dX#*Z`A`q7g$ryuC3w%A4fRe8H^o2PO2`Kn_;*9Of%wkybf4 zl^r}K%7qmMBj^M!oogq3O~Rr7eif@`-d8WGKy3oQRIfRUBqQd>SDr=_I`9iWVV(_i zJW#|uvhmG*U&j8re0VV8s^zqya(8=rP|I!;amAj2Sd)jD1VQF zfOzHAP}6)NZyV;=y$Bv?Sc-M<)XAV;!1NKlGt88-A?Qa`_09%$2qFer6`o+l(2D|0 zNL#eL&*?xqk2!_+K9^Jsncxr8J`6LO#p&rVq)4iE1sLKa?nj`Y#B&&R^9z>yk`s#U zM_9K|#MG>u4W-vMb?+Eu_uvNVwQDeBM)(>w3=QO}hXx4UhRkrN`VuU%^=r6j2H2@1 zhT!w0f2}!)gea1t(y~!H;=$twE-@lyn39Rd{*lJVOE)vBVTJJt+z5WmePUO!>re1o z3J`-0pHm>|KiT+3T>o>Lpclrt-N#72$B-v{uEZI-TsJ3=jNEAaC=DGNhCr4UU{RZ- zJeL}@rHC>fK>1r=%4AMbiFJaIvrMJrrAGG==IMhBgr#7RzC_V86D5F|0Fm|7`3Vv#2U+PooK>dm-|*)ILgl7YKbI;vf)%KEoD5mQsEgUL#}h&fyAkc^k;}T(AU)k6y=rXzXqp0^G)414wpabS*2!OxTRd z>!BqzEb$^rXg(oBhIR)VNi6=Gza@ZQuQYQuVD?k*1IPjIPnVoU|i6 z03Ag`c}#3`Ok@4J!1UWNbyckmg*Ga-b&OSd`m6m~d5?u~H?-V2KG^>C7%E7j>2)Wc zsVE*4#P+@U{mx6)MAH+N+fxZl!plJO4Dm82qjFe_V{6D;bq!8Iyr^uNbqBujS8YD` zD%WuO@U?_9#+eE8;Jfiew zJWy1dNW^g?!P$CX=+H=bl%u)OzzXq!B5BzewdGoi48IcYTE zP4@Av*^toQO3eQ~rOU%jB(ufnObao(9_&8Cudf`S*2g4!&jVp5{)Vc3hlp!{5u z8eq&B*Agndr<|vEr}jk3W8WAP$HLm#&)sRw(Xsu_Y`;lg#fi0r&ykp5B=bG=zV5{n@0do$gmI`}Z^iU}8?i?2;Z5+6s2o>0ZhM~{m zXf@lDagiD$3sA_U3}~#)#42X)eQ11ydhk)OY&AXC!iEgUHce@?+o_Y)v`swtWWr4- zQCX5B(dQvpwVC`8J3Fb2HMkH-Go&OwNt6iS{9gYnYI5^6Z^GtL-m@oQ@_uTeZ?O2r zH~c?u#HXqS{(rr;B;Y8%3EqP|e@h3>Q}F$NUWedcI)TFoiF!Ar8304TamsM|?~So9 z|M6OAIAovCn1hJ_`vYKB=-Iz~J6%b+mvMW$xVTK3Urur8*?8x&q@EXkf(*W7g3KS9 z$|E57G&%@tT^GVGITw=CGP%SrYM4;^e4cvzY)IwdG4#3}s`37^gFGKpiw3HdF(-}j zsNmcDBDQ-QLxl1`l;G*u$Z#3ur#mRsT#fga`At5b)8gJ>EX-u=N4`h2&8az||jRhq~v3jGQ zpT#9%C0fOTSK?y`E;=T~{$8`t7X6#&j|^Dga+rVkUbS&B_WNiXL-7pd_~y}Pb+?9C zza2*s$#G)r)L_IW&!yS=G!T}5TEAB#6eJlJ>zcOuH<0;1f?jqHOQ3oSf@){Q*z6J+ z@i^Ug)|J|F{ipL^;?pJUM!-z7gvY7?{UYfX;uJ41nBi`3?Ir(%L8-ezq91x*!rt* zGR7}+IMd24me?*fb1nIlDWbMkU2{(`&M(?_wE#)p^}$*$0elz>BR#^Z=jp=6wze^Z zFJGybRe!gW>=}vjI1D=7meyw-YQ8DY;V&?T){1fT*6(n>=KVj5jm7*7NQLb)`C#=3 zOo+&l+ zwN6SZzP3t7kc!6nPVSdl_g#>c+=gTn_k(S}`*Q4Sg9>M0cd5OJNrRD%(&|0UbGgE% zoI}6M7Ov?`Ax=@X`yLipi2@d)*4DbKKT%%gz^@MH%ad!#ikR)h#JDWKel52oHo7IG zP6<-5>5n_PWB8bDUba=%E>o^5&z*UnF*3-MQgQUky`0#9&$;iiLUxJBap61Z3pMy_ zRf!1}iYeQ@zjuc-=go(2fuBFt$qSYyb29tqq35y>y=SFDS94a;gK!T>+h#R#>-S&O z?j@USjbwuyMki2KY5CZWv6#!~Ni~d~~Se)21W+_jI zD5WI7^*hI&nGo?o0#kQnPe`Sg&WOs$zhbwjNbf4@dZ0ub#?!gi z$_4-l;Y%AGv91L)-ly&Ljh|Q-x{9YxQio+}sX)7G#>vX1aPec7NZIW8&2nHXYL}px zvpTE3*z7C(pMUO+7p5x8i)H$XPzxIk21kMFA~0 zB%PGs&c%tMKP*6AO57F6Xm9-EOjt)p$DdNI7eAc06p^}_V?!6`%Ig**-3V{B4yhAH zKgFvy;IeheIYdY^rYs_AN->fCt+S_uiwm9&ZxMk{$NCg7Oz|D4Q>N=n??@WH5}NVP zGzhSCXa4oJ48InY3N2gi-5k`I(BFKs4<>xMD6r87Y%BJDeuxPHP9XNJDxGnHDbJ~> z$BA1f`UW=vAGa1c=-^_Jk$_co6A^>D(C!hqL^l~KoSK|USlS5lkgJvC!jrMKG<#;0nkVK=VNSsm1u7`{P1cqbo>IhMa^(-f|Pgqex+4JWG48g6|J#j zG~|R=vvwwe9V61HM^({7m=ewmLy*ahvU7~t0*L{3#yWLGp=SaO-Hx+Y`^A?<#H>YC zl2v3XH)W>B5bReBA^JTL^Mx6I(UXP%#@a|wWTI!x(zv%9=ZtEb5y zmjbJawprwp@YcoAVuv~7YY9<8ze@xXgn(e7e_RtUnr0{3V!4bMjmN56!i!QlX;Ilh z^fmY0jp$BU*L|d@ta>!8!uN2leBQ>`xY!$oS$AmEQuCeeQ`*#Z?GMm@)aGH5G;0XQ zBQD!&H$s>p4E94GZ2WK_gE*XR`Cp<f83X60dZ`s!#f(rt5c z<2*f8*RMoq{bg55E7nbMWco=o$z;dt_sslJ3T^<))cKahdo;w7LC5-mV(ugBHtb%GgFc>BFRS zLDtageDPg4CHesopDxiW$fus^Ts{A_X?f%a;;8;884tlwlO6S?^IpPRu{z0|xiY@_ zhL*i=b(NiL&amMQu8mbk4=1v*m~9iOJFeW$J>zYZq&L8wV6!)LeUEL1S_oz!Cf{C@ zvuY=Q&VjFgNsO5LpV-Kv>U^jO9R*tBBRv|)ve4lfP4Tktj4B%t8DVC#4>tV_zBn)m z=Y5wvDY*@-_)Mk-Z_o)dRn4N)`VtpBQ4m(ux(wdjCWpd3{4NnIksgKn{h)CAi?Er6 zo+shww25wXg0CO*TQfZ|B5q;n%th83so-x-sT2I7PsMc=wZHI*uZ=NVghx~FmH+7F zxs+M&Hr>s?lisU!eKMCjdpzi-F7#}s68d}|E z{s^uzlivb>!bZLclh_O`-t7C&jroPW-y8wzkX?mdpJxP41vS%vE_8b%7>eXvoPLTd zwJENI`MRx*#)f9C?Uc!!JnIc}BNA3XntalLM=NCS)yyE%qBzbD&t~vQt~`7E+r|$y z-qg~h{XNHcxJ1g zhT#G>B)9wYVpHi>b}Q5LodAIUK2ET}j$wv(278_aJ2L!CdN_)e&3O^51XLCg5a>6v zM^)bz!cQMB#iCa(r_NZT0)m+D^8HKxXw7zhCAnpVcK>OUqo2#~h{j6y%kW>;a|S6V zSEj<|;tose!|{fR29%u6OvtITLKRvtUe?0?jIo3BZMQ@&Z-IL6eh>$Zj1^l9JdVf{`8> zW69dwk8evd=|)@BUYmb4D=wA-cN?pks)2AiCK6sDIpp5PDbMr}Li<)fUm>9!%TtAe zW9#%!!!UU;o68qb4?iEFo2#_=Z#QiAv5Pe?90kHan(K&G>@9+AY)kSrd_;rEPIhZL zW!os_q}3@@*b(5CQf@vh`)0r4no=?PLWSlHSAbyDV}v;ITem8J(?Ap6@k_b|F|3+_ zhPjC`<}ATM(MxO%gUr;|qj6&F3h*QBOlpBNNaE3_`|G>(IY#VWvd{yiX(%CV<7-%KrgfRZ_d>v+6HTFmvCxKn+kUGn# zY6Xp#$Cg?`A%JKRbwGndj{RyAvw1Z>O_EcgB;OrJUo1_gUWy)VR3vjCpoDX^U!pZp z8%|{Fyzys$=6y@n*iL86M1i}VJ@M0KUMga*8A`8$7!M-MX>$~9sisz`oerYP% z#rcqYuIY<_qpJn?$>JgamGPL%1nd0yG!NRnySgIZ%Xr)1A8t?kwv8O+ELcu^nwOu$ z-`1X^$XaMN5EneJQ=SY5gMj@@)-oo4KjW@5t;da;JlG?{CSLAWb?30CfHDjuT*Z97 zY$jF$FTA}TPc{P21}G^R@#JOMmHe1uuehfN1|7Gu3x$V`^*>;h`X3#BsnJdS`KLdC{CpAWmfa8p zxl%0_#2j0fr&}FM`{@~M>t_ThXTdyIM{NlYOyAFy#W=#CTL)t%Oid>u+TQ3l@LhFB zlpX;ayOS=jga5W2WRF!I9SmDjd`BUgOk}9U*n>#{k;UyOi~)vXJ7$}xaMDr(R`DMY z1xEUn7z^etf@yJu$*R}>wxOwnFZcM5eB#n@P3deGkcB_}yD^YNsPr5M*Np8OjI=a) zk6dnDw(Q+Vp3GiVNQ<%7+>a7*AR2>d>hEd0efp;xRr@8Z*y%}KMMb}SseP%7h9WPU zk4mJ0@C!Q}3Z^xje0&QljxC^Z=j5L^Z=K4pchV8^39KoAL1{S~(*C9EZ)IvyTYoXR ztshl)%`5Qi2v$^EYHg&*$;$S%e515Xc=%2rz;Am`P>;)?XwTUJ$sO2m6grR3cVmF1k}*Aab0ZHMdaKt)l#%sxyO_1~Va9`FtNq5> z^_FaNkdR^O=>5PnOXb4fi^@vO3#Fm0rYGZlt79kS!PYpRz4AH)m?GSpW`{0JlEm{y zxhxL?_fw!Y zeC|lZ;^RW2Yc%P$F)uE8$+agF--qDP1dBQ@(kvkSobXuuHGQXxnbo9wS#)C?YW04k z8Ph#Z3=`r_If0{~UR8j8XhB&a)R}DusJq%?#QvsH`kdR%l{pT}c&MMc6mqtWe1iz` zh|?8ruiuVO7X#@bfgB?EP+y-=rY^307GlA;XncZq@@HOxN-e%Me(silV4am6+v_dZ z*GR8V>UpNPG=!OQ64c$?+0x_%P-}vj_Z7KT5j6{FN@**($>Qbf3e@eLmd786hEjlsy4z-_IB)liXBOhreL zQ-EJ1?qJM^mCzNqYYaiul$3sexC+)WI_)@VRkLo+AV(*(nwus|IR{+~P{?4u#?pAR za=yYztZ#%R{#4*C!OJtew;_Bv72cecbbQ}nt#;wbz9V&X4tuxv=fJ8f81Yt=EPePR zdAsCI?W?yA1ajPcRaHfZLcZ44AHHRhpZ}^1^(fqrM}=YEH+~^;N?yFZRV@EzrU{&V)b4_{3&e1bNocx9D2Z`l zs-@l@>f&gcU!A*pUVhTtQ$5r~9#lt(s)T3DztKLWeB|m=G{OrnJQpm$2{1^frGbP| zhcgdxlSw7G4R?yhrB0~wR;D^n#~e!f8W8jAGWwSGv}D~~o|6gr+nUs}^Y0!Ch@_m; z?BF8KZzMJdphh=9@7QwWjJx_k%?{OeOC3Ap~(6rl+}Ls z2>`DUlZvQ%gD=L^_^}`%#6A4Ssp-2rRlKic}ygYrgd`mME1m;Ji_{BIe{BUhy zC=%w8@93ODGf-{vkniIAqMZgZqMOvWEGptItPm7*Jc)KXny-@==0&UR=;{&VuB>t0 z+~K#Lkhi11&o3h0jK6^m4L2u_sT79tg<_}H2`p;8yN+_<|?q=~;O&9<}Zf>BE$+B}2h*#R3-HNr(ojT-{kO#1P8GeW*L76C9XlHtfKe=`fvoOMz>Y%n-}lxZp_!# z?5z~MCY0Sg^*VCKu{TT)+9Lc3cw{373$pC*>SLy)BAIAWx8e#fQF}4?#uV|Z%CXu9 zW)!=agjl9N!)x%dF4{$_y&U2??^?bsmqO~Q3Nby>;-p%8l1HbDlN}d} z>JCy}LZ&KtV|&gc0GCA+#G*Werbr7(m#dl^>wuw0hRemOwo2Gm-H!<%LWof{5(@NSK?i|~{Ak1VDY zwfmj&_*_{0*R2L4SC{&pcfVXxs&5P9XWxb0tzg<75)qZ}_Q-Ae$UM~+Wwh-?MR~Dkqj8|!x$pj?3 zR)K!;6njhjrC3ZXn!=El3sr8twaX=?A;pjf<>6@ynTHb)A-gKXT)Vh#*CNeI^Ixxg zJyyvD0@*vDS906CWj1(*i~3`WaI@HB{j~exF7xnqGJ`GKU2NgZ%lymlxTs75PeG>9 zOvs)<^CZ4rJ$C*dkZ@%{0s*71sr^x`!S>UZ7NY;nE|pJ4<>APACR}sjf_a}z(I$&% znWz@ymqu>*;kshKg=#Yn^MjNT;O{Q@dD#?=%aI!l{@H4{+J&MKv`X zQ1t}&u9Qp^Ge2kR*FiPm{tmKY)_SSp4BWc2I$4C@n8ONMt*%>MAdVJm<#Jkj_Su-d z1=A{k2i2Iia+hIo+tQJ~L`fR6=r+LzU43%A_nH!I>!}7PA7FKsj15W*13phD;@TDe z2I+bV@f2&bf8~~vz5WAdmk7;S&p03rau{Yi?-brU_fd7GKSsJQuxb*WgIXxbanzOrb> zt@hyzgvAZjH<_3%kDdkQD}MI;PS0(OfO0)GCr7EA*y9mdiOC-#hw{w{mOq_*@WdX6dcefQQdNA|dmHWG%;9xj}cr`>k=eBWfJOq0I+EIIY z5@b{{7gZ;AS5RLyJ)I55$Lko%6Dc#MJUX3PH7%+QRk`hTHlZ8dI+#dSUI5=4BDuc5 z5eG=RtA83m+NDbnNzt#I=y_Kj{5IypQ4_5&T(`mY4hft^w-+Faci3A^0$yx#A-e$v zQ_5R`)FW^Id)?m`2n?MBD0Q~_0_Izf6pN}mURT?Cx0wjK?Cs<}mo3)8xQzk;pOMd0 zQjlt@FpRHs_3jA}K{cDBUBNg`vv0V)iurx+a{^en!J9g~KJF`Bx@y($?*C?jTXpXI zDg1EfA_Gk-GQdx37GWD;q;n*BRSrLZErFwEGRh5HL6j^{Y~Z8@d)A}c*AtQ3kbSj;jB*%Prd;87P zBn_M%PpRggqk`zs=udk2>2J~-NoMLD3!)00fFId=sHR@I#EvBy(CaDK3l2D-bJ+Tz zXFZ>MTE6AAM49EN|2sMTW*iKqgmXF0p4?U@1vIK zp6|2^gK|!y->oo6Ov2DMrd(8CyY?IfD5*Z44s36zfAtf=TctOLZzkh5Wc3x`z5}Rw zu{t{8U_OoO&XGfgB?{N<5&U|jCF>5-IDYcOHeT*ICwGFa)eWeu2CZ_PjhwdO!ILM$ zxZga&14 zqf$-FtAx%T-bcEY-xCKzg~pqvPodQACkzMR!(ZQoR}tXpRAR|C4ar7LartAIdXp~r zDu0Ci>BjWQhcxta6m}w>o9R|E^}V}cF~2R=cXu{v_3)jZh2-X$ zVYu7u-JV6n=MCJvrF67cJw0_o%fddG40Seki2RXg=s*zt1ux!|L7Fn_DM(E~9D}rz zPv>o%J;T0BZnt7%U@9zn$j##pv3R=@i82!F;Z@*+RMA9J_y8$n&2>CV+kT9zZ3`=g z8O{&rm!)|UL1DM)?}h|e+hhAn(F#2Uq(6R5C*l>4r7Oqu!wkg|{Bdf4(a~`B`EY>a z$Z9+lMYO8z=w8`wx;(N_6}3SC?1qA4bEikFBRzvBzh4XJ!!z*EzH3)B6)1d9-_1x2 zWt@npyq%-$*t-#dmBwdtpl&M!O!6x?pNXrC2g9Di9##3~BM%S=8oHnvH2$ThoE+*I{09A`o=To| zygb_N1uB))KPFrZVoufvN)2tEzdScleKcRgRL@+I`5r85(}_^9siNTV>0ZyLjDTv{ ztgD%gPf@vONyARzpo`%TIHV@4!6LrrVz3lD@Mm8yHgLDB+^|^JePUQkMz2d2vv%DM zJ^>`WMCTsbRPzdDl1wH&vh;_uh|=LF7;&^+Q0|j`#ju5POCJmtwOj6N3z;&rK4m8R z{ccT1QOj%M$ByaC%g41r*ypgl?ZNfBPWBVHEo>?E%b~%A-$ea>RzZL*o~bu)5T#%ZF7zo=u4 z^Urr*vYyST3Tm}|X=!Y&PL8X91wUmsrt~V}`Da1iqvg1x{*V>a`y9_k!K_MWW7X@u z9gdgK??r*R&s-uW_j0G&a_4`J>4%jvLFWPfV8Xn&wN=ZV(cKTgreoY?T+Kn1K0GtU z?aZnFT44oj@Uey#mr8+CO!v!1OS&RzXaDxq)y*Q2mgj9kADH+7oSTn$7BSD9iKm<1 zH@|1}Aku9mOyFQ$fBVW?uond2?RV2tN0xJg+E<5%p5WpH$d07k<7ZI%hxET&`F9?; zfLIdq^5xtWO$zSgPIBNCf*B_-{~OR*NmeI-cl)Z&{8^FkaqaWUE1et5GQhGt@Gy5V zGHI>axBvS5Ob5T-ZEX-ahmOlr#`xc)6L^1HcK_1m1RNrl3rcB1U_3iMI|GiecCGCu zKJTYTmO!4dkQJ>;bWoq(?Ii^*(7XWICh)lstama0H{9TVz#}l@3Xhd5+d7ZJ3+DURmI@#y^4AN5i!VCLDeC3!_ootSa6s`0<0 z+ffYGSBLa}%BZ; zEw>Vo8Xrf8`#h5BxbsQv3s2bKTLj!twFKXyeP1G3Uh8!V zHKK!mgOmu<5f-%+YFuV2?6z%t9cN#V+!AUYYS8uV#U8fAIJd7mt%G&Yhk#14r_BG?U4cX-@39odfis< zqry3tgfZ8vNCTsfHpJPYpxoi)ZNEZb11Z$cFQAYz`S_9&!1X(g*tF%Y0h;%!7O+Lk zjTFj+4t>&Lmao{6Bax{ya)evRyok;Pm%BOT?0e@i+6Y#mu+N;ZiiMMZhNPN8D+V-> zRG1M9u|pQ2^bzF|3}QAAMc?rz!Pko_WtE)o<; z#2&noz|QmACqWC5o?^U>SmeePC(<>{>`~#L$&{;7p_V#JEC!<;1LZ;bX8Z}tMPj>y z6QcxBFH>R5G|>$(a&_88tL&Dq)TJFpFoFaTk+44bLorb4u2-d~@5yHFjt1NX3(cRP<)zf_I;MWEg{O-_q9- zMAVwdF>ZC|=f4xheH@eW5j65=nj@0^l>?ifEHyu2G z?8o`{Cej^p@x@!4eZxA$sej0>AEh+9F}}{qXvLpm09i4p|Jn>lu`=cdJF-5wJ7NiZ z?#`wo!4M{$hCND2+U&cij~=wbcn19H!2GY_zu(3N|65T9i0Z(Hnql0s{r}*q{)deY zY{f|b56G%O+rTI0_3@z4(A26YVpO`!K}eljQ3J(&!8FBySQhOhF|Tt*#Uas(nc#$(Mi&GR zYsH3+P+b3gTb6xYnuptb14+DK~h~;~b^8)@Ie>5yPKBrHx ZDTv1i&^zgF;ND&+IcY_y3Q41&{{xY)RCxdZ literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/contoso.png b/windows/keep-secure/images/contoso.png new file mode 100644 index 0000000000000000000000000000000000000000..8c72d9ac32d23940ab381047d6e240fc85b78087 GIT binary patch literal 30771 zcma&NbyS;8^fihVCpZ*$E5RuQ4NfT(YjJmqySqCrw765GKnoOyA_0OF4NwZj-Q6LO zo4&tw@AutxzdvrWk~PUQS?T_&ht#VPJ<#$ zDe;jI%;X}}Nenbg90@j)@MTfK?{5Vi)vu#AO$-uOS`IoMV8_8R;yS@q?N#>= z27&p@eGP?DdBFu2Uio{72L;yBd6mAg@oSDkbJky^8ZLv^n55iENsc=M9D^w#`)><9 zzLH0#)Cdbpyx-)P*a-Dig{~?XCFeF=+-R8Gxm~hk64_9U0nj!id=AYwi(~2ckB)3; z`9roxvssi=_+w>8CuGw;$|Ol%&shuN1F^tS?5l@dv`k6(sVo|;JAJabI zV8F+VX2{Tdve0Jz89UNrY&i(V)Tu@7c9dv^mFm~{IBLa;ui2b^BKG1iIsSC9j*pv2 zh)1@?5vaGni7(8*h@4hwAlhVUjqqU&@zEYwkr1K$#N7I$nZ?#8;vZ8(zWw=5<^VIoY*g6ULIXO$_fozpzxoolQm=i31@xL4@c8-zTwh}2GyGCW6JUNK6 z9=rH#?+esSA$AHqw*)i$I;q0J8y6DW6YfW{Tl2DhkH4Zw`A9$Aua)6hsaNu}ib=c* za@Nq`H^lpdDci-6r$AG0@6!`s@YQ@2`{wA_mJ2%p*t!l~Y(84je!m>M{qdy3vwsw~ zIZP?jU6aCHWj1=L9*#*g4!}`LS;Zx>9sI1=bI91Luy`mecGiF%amEqtz3_LiBR&lz z!I%|iZ~wrcF>Q+##5 z!UbQ2L?*d8GR8A20V|H$#3X1X?P5nqM_cu?OO;dG^{LE$n7}@Mj>)By#$WSXk@D@B z!?lI|T`OhwUGZdS&Z1M2_EfE2PVDreu-(z0FaN|qez%qy62n>84!O=Sk`^*+Wd6AH z-|e*RIQ$G*xj=imEV1+M^*;S$<11kAEkf56%MsQ>Xk74Q-)bps9-Xv5gf;?HB_EH_ zjFGB=yn5HY_0O!kM79^+GO7H=IcMM{l@#fXE2MJU9;Ko*l5yl9FxdL%I$G!5^;#${ zVmIXL6jUHMO)ujcgpBgK=RVNq**_o`1ESC$BhlP)!Gp;d;uB%ONwySxnBD*_+THz} zE2`PdAkaXX!~h}xgp)vIEGt1WK7MlzUF<*p^$SB0|2r@uRMcLn>T@l3qOG0Z4f8r(`$d>UQIpb9SRTBC- zMo79-f47ZjGxHIpU7p4{s{O?nX?T69lp!wpEZ|g#%Kv!Ln}V3MZk568dA!s#M8N#r zQ(NCa&)zEYx=`wMWvP_6)wG>svL}W=>2jMVhj$4@ZcKg4RMo3S3HCG0TFya)e# zjhbeEU5G|1x2f9KB-KyO82AdSKOvtc@nMM#YW+B#8PRS&GW;G$ZR>R|RGs%pjMc6`odbS+TQa2wU@y&ek4e}9tr;+LQj*EvF8XBDZt@Fh7 z);amBS+8+F0KsdTlym8r8@6`SdFn~%(@@?!?v$oV_j(~8x1Ql#p7rEmDL^e2$W*plsLI_u zPKZ_HggXB*IM_<#E&rY#@zI-{-)G&%eP!~kUbkK(r-g@x*$f>9*}G9}4hpKuGjSOy zl^?gv#E%}G^k_(V^L;TB2x)hfH=odhM+L4=R!%|%9hL9ml?J$bD{#0@z$4fZWqlPq z#5nzj{>s~>-q%qKe-oey`jjexuStj#IUq4Xk3+>TD46IaWpMIgVrz3+(1NGN`hH8g zNRRzkb=$u(C2t-u6f+bUv>omUEAA~rx>9S9V<^`b_kUKQC5+KFT%y!lM!Ij+EzYBwrIlG9R?D%6XSgR z*QIMad}E<(uNs+kfcfUNSQgW3w~9n@(3p9-htR~5$Du~AS(k6{WJ?Ze3peH`XJXju z3*n5#!Wg6F!2@cQ=&}X`T)!^zZA5iLmJGWTEvS1Jc9bw@HOqKS>~K7^nj8N#eNd0q zFC9WtgBfT~v#=|-CZ7w@GklXo?DIJ_S18sY=J&$Bi2 zmjL(kf~r`k)%`2}NJrsl2_YM!pvWe$H6$U=MmKE(g$A5oEf$PDxKF*2A7lUGTxq%Y z1*76{Ai3K#yY5Tjim0?*ug)`*ul9z$Wqph02pfDp)8|&+=(B7ehUv9Uso8VFZ_DIE z0==G=hN=2m3Oe?yc-Vj`Rmya0L=UqDp+*ko{8%9)R0A<* zTo@~S#5`|Wy`qNxGh4U4)6YF7CMIg%4VxUEwj#ECFmYBZGyolDk>Z00 zyoKq=vhF-XuWE~_h3H6>=pX_9(+!m%_}L(DMi|$cYT~rmUS~_|i){`|n-3MgajrWV z1bHdJGQ|rt!`2@Keqb|*dksMyY(kiIF~u$7sbN#ZFH6c;{vY>2%tNQeBA_~m*p)pT zWQ31yY^5rH5vsc#!QtLSCw2a3-T!rgOc}uaiJ8(28og5JJ&D&twKrX*AKz0Ng%uXA zwJ7qMK5d2*&=8$f$6edPrp}yGf-8m)Q6Gbo2R60`?JcY0d~9G-ZCe==t@>B0SW2%{ z?G%aIhYO!BSLQ?luGglD-PdtO#@&HaIF4IHymU;0|DQpQ{Pc>bCE*bOm6b375mWB< zY^7z>=DlSXcljnA6K~oT9${1OO^_R;LLdI>)1`(U8iMrmb+(#QDy>*Ap#}BRQ!}%! zLVuV4FrkB>3&Tc~?F$Yq9Uzo~{7yi1Mv?fX0(eS=5yc`j2{Op{4IQHlg7tD0x2wJ^k{N*M9y&2UC-ZBHYo{$ZhS}cSsJ?5muw1j~8X;uXWu5Yi~A`aJ&y zsI%nRSIfOmugRAupT_JcJ6jQ+MsnfyZYBSHj}a(^eRGm}SE&SE?HG#g0nXXH(k)SE#TWdq{P>?j);R&O;g%}Jw+}i1O+Ne+6uo3V%Q$1tCXSv>4 zMHOqUub4`YNeG_8|LR`XRUGbPc$^1v?}b)XsGC%gl4q#br#U)7boAA9R-W<_5orOP z_PviYx~d#=9b9XvuKjsly!c}nmU|GLkqGvH-2 z%r#f2@S99G;`ff&SM(Z5vzligln(pEj zOb7a;AEJ$Q&gQ-c-yV`d1{1VuwK4M0?cfYJp2SkO`bxlejt?3*;E?*%rmEg+wzG7| zFF&NQQ+@T{L!ySPki(}0Jm{%s5UJ%|QjZ@-AJeSnJ5R=LvQTb`Gu55^<*(+cX^$}Xo2EEZb#`5$gduN4A-@>*Phc{9cojn6(hRy zB4lPS^Sl*@-VuFF5?(<;ZY!=2>;6d1F?ZXODulOL`=$d|M7 zSbF7eDUMEM7jR=f2(n$Kb`Z|j8r&XbsgT~9ubFX-43p?93JVD!*CUb3VsMXGx86Il zhgQ{4T?gUJRHvJ6Rq)od$FPU7O~Dh1U(69@QGDPHmpp7^D%*Rp46%1xzu(T1j18BR zU0ijN!{-AF_Chvm<;@lr8eG;yd(cl}Z_N3@Lki|k&2L%aLcM)&7*YspSEi5f6#9@L z-apV>0ujVD>Z#SOG7w5T4ID61`tH??2DOs==Gxa{{+Rscs}+I7O%MOQ$=I+ zsfpsAS(rme3FDp|8@x_kQxI=WeW))GZsJdfU;=X$)gA5*%W)78SCFSpcs1qq$~@md zuzokaYDG+_jpvEdX`#Q5;rqRyhqmhQ=l|}92P7EsXlNk4>TzL@yHF;ZOJa<7rqCZr zef~5d1Pg9(-%v6Vht~^S@6fX7Q`9&AvM$M&O{s;%3>SKqP-^V|O3N5OZuo;PfPoC@ z_=6H0|Aq*SnK;3AJvbxueTdD-o=0?V9aaG8%vJdv%tf5$%(I<@|2BqV;!~I%u3uBe ze&ac)FmrG|6OA~Gea(wB$sMe6lVs>9d7tXRD4`&60`wNEPH_1I{yBODEy-Njqt>Xr z8(X*5^yoy3wsdZbS1Uu%48%bSw@X0ZSIx6)8llKJRw7>d9Zt;fhG1=gc zf9^2_2EJk#ndcXaPzX$Y;Q&UZFNxL?8t1-PHFL~tb+>vf$VL1X8cf3u1s(sidU|pD z)I*kD1nwJ?!R{DuzSto3G5FSmL;(FU*%1wFx8OK2wH%c6)pfVg&~t;{-v?(1i}unzG8CI|fF!4wE8U%8DxUE9<;u267h=kNTr!V^4nip+ zm*SU_K8J%^P++GxkyXqC6QI=7LF5-KMrCMCI+8C!>K2U~^ zbUK)L%&NC*5K}#~Mo<$U9lw}S{sw$KT0rk@qjX}1`YF5bv*=HC_IubL>HgsmL-7(N z4(l5B#47NI2k&YK&lV4r%ySOA?z{WDBVOk-g0 za5{$xP|lxS7gs>l?(zO=&gF08*PkKVe+Zhl&i#pMTfNi?2h43Puh&8MkC;CEIcQdM%^l?Mo;`g zK!-@?pwiMgTLin7Hs>H}t5$4x^JyqLr%6Z09f`{DJ<=7E?f2sT&&cfGKho%>@c-(- zYP)CL6?Audwt+=RuRu#2!P-nF13z8sBa#TXth5Qagee2%#&>rsb;Nv+X`6{`NyxeQ z4D)Mru_TtE6uLOipFcOpC?i{KE-md_*B75N)NUj=Q^m4n;U|Qo*iB`mgv0SDdG%?H zc=CM|yHbcsir)!~i%MU8)o9!0D1;v&9*rnT<>GQ)35oy1Z>@7_Z6^gCCTiIAKU74- z2UFBr^*_;QNVY90jx2hN*gZd6Vvc(}RR&v)ii(G${(agcb=o}+JmyBcBrzhEYvdhP z+Bt`o4jK!u+JWzj6M4+VY;EG^iB~2u1baNBJ@MQ!*viP66b{m^PsoElV04h)Guj&e zc%ENb;n}B1hd01h|L>~yS*$fv)DS5Z9g~9mM;Ni3FxmfVe){a-G2-&MZGO_dS!v+mgfq@JY&vc=>xDo4$=qW6SMjr z&V^$)4+Y(>#Tw)gW4|pRN5aYo5VaibJ@F1j5z{Bbr=X_Rn6#u693#c%xaNSsK!bh@ zv~<)_Yk*ANc?O0iG>+W;dlGAD-^Uz!zz3oC=vd_|+gL``ivFyRFZM=7+cfE#CY?vl zd@+Q+rOy({^w&ZSN>I$pR~TNSy|Nr(cFHClMP~`=7>&FUKv?t#H7tJ&x<{-iL&Ds6z(p1M*S73u*>5Dwv~5Zj#1Tdm9aLXoYzF; zc}*paAA24@Olx!r#eh7XPPgqTI{N6s==q03>Jo<DAG7yv<*x&uO$wx-y+Pq@q;;e-YJLS$O=7V;OUSBw8HJsu zIn<2(cU{4tTv1;NZ`R_S1vjfbHE|en<~o|V+lmb@Gi|*_$7K1@tsyv2h{?#3=J7-j zcoM8oXOk+xMP~J0Nv+@@tie28kZ*1HmNYiceD6agtp4}FlI`mn@$-2MEbPj~YpOuY z$6|V2ixh7fMWTivKg!oV>3vx&cO=6VV;(4`P^7Kl zvlYzP`_nsnkIvZ>Vpv<5ZuJF)g{YJ@ED0)B?G$|uyF&&3LL-yQav-ixIDAemN30s| zy^yKU&*1b)$GW(3$#wOo2*;MBc)urcJ_m?A@{oxZ9VpnKI%r zsq&Rg8SqmOTewIXaPmq8yPkGtY4_&>n2z>(gkHL3>sQC)Tcpj!4QMNuMj~vw?wmB- zdh}@M=R&V0@9KR6DtHMdeg=Cx+;sfu{!uOQ;VaK#OUHuuJ8YQDzKxepLD!vR0KwXy zT7prE>F;81M#)a*mZ@f{nBZIeFDtaLVMOPm;tkOxPoX#|M~7?8-}2u!7=#{o@_*_> zxY*YRdd(94a{lq+V5(rb$VfTG4Q05mpu&z{2fo5G(KZ|mMG!bfof;%F}^o8;F#&r zwcxhYJP!LBF>Na9(s`vz$=%?&GoF$H$gBjnF{oGTe)FgoDXB6D*!-w$toF|GtJ2Qe zpV){BBk8#MuO)pfSUxh z;kjfmBI~@IQvF~dEz5makQ%yK%A-Dl42Q=*BzS zSAjqv+Yk;rh7SJ1XB7z;RvEAEz)ClSm!*8V@OMV3Pw9mz;!-<=Ume%i<>c_|w%ro? z&LA3rSj-I)R0>_8;@K}R`%&!l$CJXYtg#BZIm3Aju)oyw_Eh&eh(xPUTc#>GMJ`i6 zK_X?_=FmV+exFJZPsG>@YYY>z;CS!f%qm5MUCm#ZFtYyIeu{ljOVmj{iNBE&C^15$e zT89L*@=a#wh3#zRd?kb!s+r|*DaC%|thepmOc!P>BoEHg2uA^fbz`Im?+HgIS>FT1 zW6=2=W?mJcs{C;!+}tpa!JK=Rpjgp+n%g{81dahW>SxcPVrE0&j5w$be_ZhC$sEP1 zM8rGBdG|2$zMyb#Q*%Zl>O$ZV4J<1r#+M5$$MFddH+=2O!omh&nf)b;eH-2#`5f&s zk&(E^VLW`H$?Knt&R#J>ehna~*$cm*ayY;Vw@7SSFJbmGktiXgl9I+HNuM#X$Yr_O zH%W*cq{Gry)|IxVu;|IM~XGc4PpEuYe5vUM4_+DKbm{OTgqqGzFaDfQL zU7J}KRmV@7fIg{jCX8SxVz;;+1rkta7$f!G7&Z zCok#IjqfY=w@~iK84X2&lP z)sDlfQyApXmmG&l=1IwJ120(J_r)Lf9qDeCgKqG5_3R=}uAZFH0Py9PhW^~(@yp*g zKJ-j~VD+ z<>3GcjWk$&hvMNe{;Tp&)Ew%0MbCA?C#y1wj?ct^(AnceAUKjpU> zsV^@CGqYQbQB~{JZbP}qwCLXy#U4hQkR<3T7&!qpnl|PIop0mngdj!maG98Yo+Bk? z>9s4;R~=wpS;^JxRhET`sH1gk5{A3yYAE<=h?skra=N&daMYaNZlt#S%Ex&5p#jDv zoDJJ!s9qn>sXa2-4+Ideb|qW;nF@nOoxImkL^!R|>dU0{f9QYJhsY|f?gLjnD0?7b z02ygRYq6~WQCWa1d-DeA!s@yx6#sfq6pQh%j(Kbugce*Fz`t3Sqs zhM8Dm()+~%(_T4jMU%f!)`SM{ic~ihP{%Vozq{B}+V1-n{|&{g3&CfF$aG#(GH47I z;8ORY@!m|`6z>y|EhyMEbvjpO3bG0gwU$OpXEby$UlX((w9r;8m?J>+2(iU%-71zt z=zm5juZqe}$_JoERk$S0I23=va^|P$>E;^{uAogXProhO{)TeFg>BeE|M#asZJ1(2 z?&n}oxJcA)5T?@LJH?xF@V-cw5GR5m?T-`A3IDj<{gRA&rJCkuERw5e7oiHEdg}>2 zn{ixdh+fz8-MLt{i5jDOWHXs~U7oG6>I`Ri^Y&vmtp4CYbG{YekWPvZr_HpKrs`ma@- z-i%&0VAtu*>LfC*=<((hmQmAL$%oWBbO#&RWyEqwDBDIPs1iCBw0pF-9Jef33y8ZJ z?Y5noH&_u8ZyKd(W@Ud+&cotqdDXkff6P#=`^;#La)=QN&52l_CyaShXxMPb!nSSE zCI=;j2?!lD?M0gEncC8`nb|CJzyDYwIevlkbc4z)Hv4#SHGy?+cmqQAAq% zmR_%l^#g9N0y-Ik_tx;*mz3hRic*vYLCY`OT#V#TR#XYW!SxB5xVTK`WyDIc_!<;l zEw#KW^~3byyeS?3!N>tBI&I+R0uXExOOUv$wLx`dn6yO2z7ZzSu53qhstN6W^ya*F z+?9*lvYbx>ge$i0WVajdh)-9vEMUWuz9195s3E%lE#0#f7KhXdjZw@EbL4zxKQYyD z1D1>-^VPtcd+v{EOLVuPk1-Hqzq% zI=GEBN2HyVo9kJRp>0U@{JC4bQ{6<#*pRgsN)q(`>fj?fksaWfxtG18y_f#G@0`a6@NrNP`oBW*o3~_FF+#5zjE4y{y-xo=Ga_YiQ5YXAGELL)lL_;$3G#z-DVGkVz zUXOO3q(8~WRPfUrK$YH#%$6&R)tU(B9H$07HAq653tuyer%H(Ao$#+typF*aD1R%d z#Ac;NET(Hxc+xm~GwyWz%fHdEr}D7CWCdccKamTlzALbV7QJp{Fh~XfpGlF;rF{R+ z+rSui__t}q=}iL60^^GjEm7bH7Br)x@u#r-1LCJP~1*1qc1;3&nUZ#H{L>l7Fxvv~ zGur#nY8>z1#2Aefi!?$(GFU_v_{vxy=6wb0F59-)ExC&H>`(O{wFkVknOb!BBh_Fb zyQ2A3=n{K?#O>1I4n1<(M0=qe7&628`}}|Hh5wBO`2X1)w)Rp|R!*fyIyZVG!{Q~7 zdYFxljy{;m;2SSkp`PD6>pD`KMFvKaEAQGAsJh7%V+k32aG3f%(ua5ZbMV80`fS+n zHik}icirLz!(rLk*mwv>zeto8#c z<|7PFRiaSF7SJexs`$G7BWeVGJPvad_<2ZdfFEFlXN8%n^b!tt#mK%hPj7{!R;LS} za?e+2Z1*hxV_@Pbc91na8_tb7I!QGb_(Y1LDi@<^&ft|cmJt27-5r*4b;-+mW!KZgRR5ID!@mU#4e_t zhGAkC2%Wn{FC!PjJWX4zag3*AL1p%@|B*WO?%Gd@DrfFlKK%xH)(m#xR?1vJ2IaVG z7T7up!p@{{mk%h+%tbLML{YpJr%$mn!rH_fWp6SC1cbrb{F4_uOpnbJU&B*}9|Zhh zwQ}x%sz%Eqit7#Q{~IhW@{eKiP(Z%JK-TV2M9K31|C+k(P%1=+QI1gS6AsLDXgw-6 zARXfmnCUN`L0-8;vyHm~4ND^O`ES)eLWxV<-_?PFrx_5BZ}o_>;BJ?tG>D7tq!z3n zAUWYQT#DH3ZDc_dv$W}bs2X$cls>XJV`9iERVwC4o>0n~cvbm1*kcoWgFKvdlOg2R zqJKo(0TSt*|niuXorS z{nuLJU2X;tW*rrGC6tYMESF&RE|SDgsxImvWfNXA)@(WU#0`?dAT%tj;iVmR6LEl% z((|hBFHVw&yv>rEf+T8KH{yD%o}dOYtBysTAv-N#{h)~Wz>66fXD8zOZwo^^`uMDo z7TR+Yn}TwZ?{ATdkBJs7;2Lr;TgY<+U^mYqF^6gn_0ZSaTKVv#vX zNSipHE6%d8D~xY$*!IuF@;H06oeUBTX<2 zjH9gpHJ+_vrspEQC_?j%-eLVBWKzvAqj5&@L&rE?$5$TqQB5f6hd9xX^=~;|{7t|a zvUES3L!ZTXO>76ACk+Fgf4g{!IF%@jc$rYpAZ}#s?I7|Ph1NWxPyKDHPj^y5^N;wy zjoLdDP7g?L_|+a|g*9re_|}NH8c;)M4{e92HRF8{7MN*5{o&1O0Q$FNF()Ru4#%+r!^IY|M0tyauWEuW*@qQuFoH(Me7jJ10{Plu{lz;~Hrlwa=XT56AG}MO zN+j~{QJdzi#~t~0iV~n)N#9n8nlo703FokmbCPa<^Bnu)8!hBMS(^Ve?$g=v`xqtJ zEDKJrYm?g<`L#_*;YiG%?(Rrtw7-*N!{A|%J&g$*j(eGm&5p{L-tZb#$qCG^wdR}G z%&|9Ts)S6>iN2)(kATqJ>8|qq69|bPE!A(6oanBFj7bJSbPj>ux_A#=2(& zcwnhTj&zp(AJd@3hR4fS=Fg~UeG2KkO^D@yqy#@euHG7$gNPqdNFLBQHi~FOmIbIj zv3vOUTk=yANTg=o!^SOW+*=hJ=C<$R&TgBCEaL^Fz-{o63B*gI$ue%HjM#g_Jh}SI zbjpVatC0CVbgTdq1k%fwby4h0aMV6i4or_)VW9CaA(IpSAa0mfn#mEd@$;|SL-RPe zO8~C)XA>)O`s7-p+vh#JPy%z-2?y$c{SSQaMhg7VVp1rr%!KZ>Nk6oeWyeUJm=x0Z&@{n}nD|z~t!mYP zPivWU=;~T*uSH!J+d6$Te)YPhSUYQB*DH85gKA9;r@#`03m#=vfi}GOZ?LEx@B&wU zqZ7#qM@aIF_p331(y9r}Ru(qAY^)rIs6C|-2_niH` zH`6d}1g(=+R1AtxvOVCGFtGVx=eEfE8Y|L9eTwK54E!tC^@b4wcK@{U(_bjf347RM z?M(zNr*g`g2dPg9;dvx;x47?oyZ1qznXzsel|7C_3+Sz9Sx~6FMXS(-(PU!TRHSzU z=tgq-rIg;vpWRawybQVw%GpZQPpJeFA@D71c!GWeI|ZBmpniYS!=ObGs-k_4JMBPo zKTN6`;1*|jaDyQ;w~vNDokB$~mn8p<4-@S|p=QtgR?D0{C|X5crvE;Y$rBr;_bJMp zukQ6EH|WdcHVJ*mjkZsT2ES|1r`v%)0S9)vdCBEvK8bHDC|BUuyG4$S=t9v`dI#6- zwOE9gy_Ibl`zX336qa>fCEUXRSkaJKE!P2G`|O)Ja1R>66Dm58YT?5QDUmY_@VThH zFiDC%+yHlF3YzAQjam*S3S;}h-0fN~gaU_GsyXdMB9Vwd6+~1NWeM-lyIQjp>VJOJ z{*(PN{86Wy+Y!n2HMe(8UBWhW%)Zs)0&C326f?`ejhK@gO1~1%lkqzG8%~xtWl~c^ zW#^HJWToJ~EIlVUtVelHtaPsoQmj|jzc5&JHGg6v!Zrs!e|gpCjI$a3^5}-g2Q!Q> z{Re4qNp?Ag6^=MIPN4(@SqxG#9WWfJ@#!`s1 z#Tnf$1>IVFDCCiCQAs z97C#_LCAW~#V(%ELQACV5Dq<&3_a@w36`3f`K?6?3^8=o4H3-@V+$I0n$~94D`(nX zW;OP)aIXKblB^nxd(oJ;8?Ib8o1U^i7XvR~B=M%GfqogsKnUI{7=7V##~};_ami!n zk?qII#{YVFGmSO6tEv>ccQeMRVN?QT;^(fR;c?KaY5*bmRAi;V+VVQ%Ki<6z%GWQp zu*2JK75HOkyJu$5aavc!JL@YA)Nic0_Y_UFj4$ph*(ZW@kUlh658J?@~1q2 zAc|>*p+55ST%|M+1g?{{i{<59bCBA@gH#C5YuKFu1%y+FFTcU9BBcT=ECA~2t$}aYH}Mf+w(L@q;IlWBql>e6sQ2TrJfZKMm>mU zPuqN43;V*f%4mlm4o}*vkjz1`AK^m-ddGu`2*}6s$_^D6E^)uP32H5|5<^}+()MV{ zJpWb{JF50)CF-4pdq^lS);CzGFXQbWV|1HUrQp3iMVC*m?p+sfo$lQNyLJ;;m~;R8igk7CXn}i@#fQ`-eaiVc0$=zpj`S#OLwAUvmpP2 zfPV8W^3&RtYu`)i{5;6}pKMPCukM~Hzf)vSoPH^oyP?ViM1~sfR?yW(Yhch651`jI z71$nK(ITBH&1g)d09`;|0o3EZFz6EA@_-DEioie<3sdxRlP*z=geEj{Ob4adHfE+l^XSzq2(o%+%mFpWoDV4Y687%VQOkOF` z6B)%15>KAPGyhAjts6nu2RB|= zqT`#lF+Gfu{vI$k5hewSDWJMrk`B$R^AUX3QwoV!5Y>M$yE{%^n5o|LC5CS0XLIWW zb*lRyhxZR;n3W!7D1u~H0-AU1_^uG`i-i*>`um}Yp+_|jj$TprLi?8Pvo4+IyJuN9 zvGi?{Yu)i^Fh20xyWx{6AfT6FMStdUwVyT#&p1tcb1;)q`gunnPUe*B!ryr@ZKR9G zhS_eqx*yNY&I{%2fr56o)W9S7c>5q#I$_LwniT zCLJ3yTE=fWx#!K| z!~2SBYKdyb))|9b&B#;Dr0W{14Rtz|Ds+JAjfLLKH!xMrN(pDu05zYnHNs|HtFoc1P@S-Ydca~EKUoC!xaXv33{kPViHlH5P-Sn*@wRI zQZ1V3m(~t2s_VsqsGj;?peX0|N~QoeL%^p~Z>n8uuQ1(&aeeZn2vW=7l$WHyCZ+|V zl8gBL@ELrvXUFs@h$~UyfOu z@R#^l0lgc{e8``5!uXvoH%76u@?;1VjW%lo(Z8$ZfqM?hKx4m`RHu(rI|aE!(3(wc z@veGE)mhi4d>h&qoQ`Ww*&v!ljWyG>R?+iBwLNzetmObT%N8YDT@tdAp3?mI2Kf>i zXGmMl;Z_sZL_*urMM89h-+aMh9Cj|t6QQ=EbQ?*qJzeYK{-*~GDJApo`Y+Tub<63%VX0`+EVBbBGAg{8Mq+C?IY}Gth@iE`7Wg5DcN}C^^ z#%JTu$azUy1=1fim=S+DX_{rTOB4cWK~;zB@X8Q=rRRaq9P2=}#2a4@aY-MyVUco9^*k8`4PT91JxQnwWy9ajoS zEO3-xB~|{b7SEqnizo~;vk3)2zB$c|F?OfY&xFaAv6st4CP30-dKXLE zKB)FUj8)`Ke_D?9jd9SGH(=32lTn-obohqcPyxAm{L>h38ibzAnUd5R=qlsBfW3zx zrZVNfe;~&?ebQF@qFvM=Q#b8_I5_Ue=OC>CDtkMeh}2ANam#49PB_M0+?(^-DZHJR zcfX%LxSMvb@*`7;;#lEPMiClYGX)c5s>As2Oy*%r9}>%&sgHMa;$gLoocleVD;$ns zHt6T^9UkJEo;{ny>Uw$ifE8fHpdb@k;O98^r{U8-O)Nce#euU#_#5;Lkxg<{%1aTu z)}oB{Ft~$E20?&9+k}pZl>6?_LB1=$zYZNp4BFztDu$<*27Y&z}qE6ll*vevU$g}adOmQIO=9%Ec_V?36+BHyaK5ARhB}BNu-}A`7fU% zi@UGQa?&l`j~AEyrAsWzHSd>T0iBP0B9hu;HhxUHf+J4uMD&54pnbZZqWsPb;VM5s z5MQfTJ41(=4JKX_Y&A=Nse)4Vu|M{n8_`Bhob2w?;DttK=kPoomfcbAD)5ZAJLhAK zuZ*%rTfRpYnwB@9qSDWP9kPQ(6LEbp$g7wzCQPZne+H)^KLFB7hIaNnWK&V>gg@$) zwp^R!zJS+Bn{le+nk_9YG2DGK#QvzB1C>1+E>MAQ5Yaka;kh|XnSJ#wcNK4aN}i!H zNxxg}))V+w<~a~65=|sc4g~B{=bPNC4mHFgS3%tSnqvzAzvAac%pSL8meN|8TtlUbfM%`cE=)u47CYhU)Kb;xOf z9U4LA0pH)H<{q1Nyo1&@AWSDzH!8lX&+frSseu5%i!M#fVV&g>dw9#}Z8OffB%r=b zGTm0WhWRyD7*AoLE$J8Fx^*S4e!1)CqDj8<6;K~@*Rz3jP8<2U;4trxu4(m1#a^sm zlkWDH;>FtzDC({2MvFgKsBO<}Hj}N7wkA2SLy@<5Cx8yjSpZv~B!I};3_6Gf(kDJ- zhwI6aT4AVsxD3H;rm=6}u~^Jx8X~;U)~1w~?-!+bw~I$ZhS?QjJMb%U+ggPJ3&}lP zcV+JA>>s)k=jCue^Y+B?bsD)R&dT{ZJGe$nPCJ}*JNVO8R+9|`_?SeEJ-vZfB?jjOg}(~{{7rJ0}=WljR!E@-TE9P?9V<%t2w&9sATgTRo8)W zkdpC}1+gTB?G`Kfvxp6|-?w+~nY3oQ@65CzbnEiT|2ndPCl}|n@95ss z--|bu%UZMKu{GxMs1EEu*Yr(9PbixzT&{XZ^!^bg(d_M$I(v5Zj7dQ}xem11b63Ch z$a6tD@~(HqJLg>UdFHb^5JAy2oaX>(B4S@omy9|k z*rJrrq*(RJb}}g)x*&-}IbHE?bfLkECBjZy8%j@l zxoagF#bSyhE)qdMvz7FWa1Wh(oFollvA-& z526teVusTJ&}fH8mRIYv6Dwi}mru+ORzK}R?%8BYrRU^-^s`w+$t4xc^^-)IqkSQt z;^TW4u`6py&?O4A4GPV^S70fo@K`!yg+%*Lne$aTG{4U_Ou=>;u?>TLtqCT{`YA>| zdm6>}LW5hb2{YA_MfS~CmN(c)jr9QlVFjJ{w?tVFO`amqqv;i=n^>W0eeHBro1e9`gm70ru0a*%)ReN4!Z_%C3Ox~EHQz1$7xcoCk)zBl(UU8DCb)x@ zM5~@--z@8hTn)-h<7p&&pgdWf*nW1*5>c6p85P8`hvoOV%v&_pF1~}`_okXHP0G=| z4MLSr+4iW~qEzv3^ZRyU>aQJ#$G7NJ+#CTMm=ZN_+}#gKD#0gvtt06OSo{~?T>-) z=#@#Y9;D=PChA{i9A|_Tk-jJYmMC#xo1hmvB}0kHM}~i^;eANg`~9^M-Zn+kM2Nmz z;KNeB)=3LRIU6M>R+8a5FVf>99=7C82Pkj_$N&5l`Ty(F&*Li)P`jR+y9%ld!cC&m z0Hc*$*z<{#o+-i^pi8PYBJ8})EOjxw6hEu(Bl6irw3PpNrV&XqDgf}CtY|E5~ zMz!UJEiEi8d|VrhrzG|~Drof#l)pPipg5Y$KFxjn7740@aE4wT9OhtvzWXZyzgmdO_?j8V(G z&kjx|(IklCOk2cghwAytH2{au1-Xep_Hfgdjy2`d|C zoN1$&V*}_S192pSqJR_l(nGw_8iHl{vZpDgdeJNgjps#bAW4+u64T`X&MC=yhgj%+ zySV5d@sax~*8h6Ef)@Y)PWW^RHKz{71E{xzQ7oPWpdTc7*QaIPZiZz>9<(RS8kRkL zDAlGL2>o!mvgmy^Dta?KXyANV;{=2^D23Mvz}LY#%VX=XzH7q%wM9G+{)bPh4bNHSka--QY!eReDE@O3}+;rh{rwP^(ydl={}zGvkO&Q<+tqtUx0B zp}A)Yr$z&1xeo;z2GJg;O7yYhA(VLc`U=zE(Ic0{ymtf_y-eCdzgDhXf4b3E)>JZX zyr{ZAcVNOU?I{C|o|n2Irik;E?8CxgUY{Qoek02hKn3 zYID3#&G8@lxB70#f!|S=(P$0xEu#itCFDZYB}Y~7evJLn&}4e@a7o*b<;Jv2O2(f) z^7W{LSrT7rJ^6W)Co$r>DB&YdFdteKA9Fr;Vu@8&(k^s9bbfCw(33N;8TkctX&Cci zfZ7;RfAT@|7s|*QmaBN!7#7Zd{@y~zzkl}wGXz|u=Jx*F+5U|P3{A@5Q);u1lY~XQ zLGpG(nunst?jXx_%17-V(TT=IoUzgmos40?Wdr;G(C+0YDDY1b;b&6+HHU=%nFMQ< zHQ2ukgg^hkzhEHJ@&<0NR=`*tLHO|Ce|vR@H`mhfl@jqJDrk(hv0lov>cr7)7sr3}RgNm?P3Hp@q0@)M*n>4o z`s|Yq!?1v0!~VG^Mn_&p)@Qs+5ucMu$FiQk!iH@kB=~mOqT`kF z(TJ<)%+vQ=4|LG94(&p7h_`77W{Ew`k{kU^VQzu9_<**kTe59vgut9_=8urUXYYr(`H{6JQ-u%g-~n9<*&Gp zP9Vr1%4W;8E{TXYo8;P=Y1GEaPu!HlMtS1sOX;46(awlAA>fbNMEpxi6D2{iZ0e;1 zjumagu|gMRh{}+riB|x*%!sF1LriSP^8jSiJe3OMyooCWQhkI8t^JFXVKg3c^3Rz; zvDEfltLA1r$OvY4bW;e3N5ciiDYV1g8+5NTo0w+e`E@^{Ioczv^tv=As@gDHU$ypdTzO z(nD19GVjeW)K&;(1wnr_{c1OvVaR|rgw{3vAeJ|=wlE}QN1Gbv)Q&xLu)+RykO~lO zDeaKNuv^1*h{DUX3tzESAb3hF>u@S3s<;gPCYxZQ+@WS@4<)2yVF=gPZ=`cEi_h&B zCrQA=_KUb^K$-w!`N>@PQTVlRL^`DHX(j1#HbS@^R+jw8lwHkLdC#`iqd#vpHDo1GnExIwfBh7rKvQNrbyD z$hqYnS$8_BPc#aXo;5(~aEO8*=u2{UkC7P#h{pX5H{r4a&uH%YX5K{YQ~UYiSG{V7 zFj@(*4M{dRR0^=P@?A&VU66}O3q}vyg>&qm6J9p@B53l+NGVDRkg6<9Xa?exyV@41 zwNcWFkI0B;A+pDc>q6qgUth!Fw^?d7ILVD9Cpx*}U`UBe^EjHb5=2NDdeAU$)h^nk z{BA0#IxpX*srN6J&TcZmvRmj7kEnyf|5(HaCp0tqN~2#B{&p#xMTq&WO;u?=Vdt+% zN6OH$b}^3=Y-dd;U>L2h-^_-|&f&*gxUVfv=$lKz42XFJQH*&lmd!NL>I~agGl2^d zsQj$Ur|e&83SQA~r4OQC{v#Dke&)o&qPi)s(V58ZLGvDkUR& zy$5#@U3}hhLMW?;7ARK`FjJy)s^oXGlRN2+yFU3k^!6$o=|7G^K z_RWX4|J%I(FPsPso0YUVgF{Gki&7f!Xj)?b#~$sQ4BLjxFSS~yRh^Bs$@8;Ei+FaY zj)S9y`CbfI($Ojp4l+sy-)Nw@eNK|?ykwrB7Tu1}_w0=^e9Azs_#r4-9$q&ZI5F7T z;+lkexGX% z;<4qO5u(UqriwwGND-FK!}kytIIQo9JSe}X;4A&T&sog)0DSt?)x{Z5xT!yXXa!qu z>Y){v*gl}{kj1KIfl&ourF`ux!PhQ`3h31B^4XdVX%W*a0mtUX)8kLrS_4u;G9HBa z07V)%qa7FL%y*|IW8J%TCrYrcvWbgRf5@;KG(M9#aqJA>ymFsWT-F`>pMZ^XchS+< z0FP;$6cy&<2xF}oV6g<4kHy|Ct!l+wriB6hF$m`dE3uJzxeOU;gO z8V%T%o%D1Z)@2%HN8ox)xgW{{l_g^*#U=obU-M{(EUvrsrpfC2nVg^1D~%%G8{ z++H_RqxO2M*lLl?wc!V{`Dll6{Rky@Z8Xs5@iJ;CnA`>{)tWG6td}$sNaUHoe~Tub z+#)v=OP*${GN*5)Vm>oGI{^3}NOBrH1@UBf()X?UG_$QvP*;|^Y{3O+J>DlVrjtdr z974MOY((4*yQTnzZ-B=t_iq)0`eQs6MG!cCf3r1ma019t@8ZvUxchqF%?zpwmELdv z_@y3V;8178`f-1*=KVOMt)W1&KB&W4@PfNWd_<(hMEzsh778>X-CSI%D+)3K0uT#{ z{lk0pNTr|&cuET8?)>Il9k1^MTwZfEu(|IgF+J2tY{kXqBfzv}ECWBLvfLcTEZ>#Y z@Eo}O<`b~nTJhg}w{>%QtOQ%h65TZI^)O`Uscw&?u1z~a!b0fEQb7NV*86W=lRxch zs;zt3IF1*5edaQGO5Q@q1;*PUsjKi!E7Z-EvXPx<`s!)v<|bXb{OouK;;A4D4CSMI zPcgod^lj28ZJbb`#S($US_`KaKS+1ofyMDhzissWaWH(p&hymM&~ntqDfQ_IhpLw+BBU8L;HbB<&b>PPc)4 zGgwDnrY|s!S0roSmsT9s9efk*zVwynx1Z zsVQi^C`u`<}A2Zp5F~kBGt9TtD8CQR%(bAB$G(L)9?#FKeK`=^uoP5vbxAm?3^7 z(pSzp9VOC6iigmCF{wpxHgF=1#ZgixK;jV{cFHCrVLPY`uKo0S1cL7EBf+W!4cE5`B&+?EwPI=zTCLWYAOfZ`haH*2k&?)-d`6gz1b`^VZrT-KwZAnosYv}aS}*Hx!l>y%@4WaH%trbl$HDxb`Y zeGw|oOOnE#(b+>RINTwQU#QcA5w{W4+(*p-DrorhP#!P8Mey1iN&exUlHKySlfvRY#m8QVng+HUQ*3IQub3J7G%M7QkEXR>ou?=;qq0nZPJaHqAX~wZHk*j^ z>BN4BsmEC=yxzJ3I?B&^J)0ZUe~{i*$3AUNvhXEJlzh@&`=lp(@}`I^zX_OcC> zJdu3$@7+cnac+)mnM+i86TynZVkn*Pgh-MgnH8UUqBVz1cP27WjV>MkaoVdOQ<)e( zSvYd!2pQ&pm8_-cB15|CSL5N0@JJ_rIU)|3M45B^BaY0M*Q_SKr_32T8Ef&7DCR8B zNPYj2pJx&R!*`RFX{z*RYca{u{VFscb&=M!#}d@A>56!1X9%yLQ%$VouajUY7NOFy z+yf6LNyKme>WcVs%dB5rduTjY`}z8|AEkVmORks8ncHi$AQ5gqP_el&FiKl=oq)sa zdUcuQjVXH)5M9tAMW8i8Pt&e96>W#o{xgz5lfp|NB9heh1y-@dcR6&~XR@}U<`^lz zbT}%d3&VaEzib~M8ThS=1Uo==eADL}%g`d`{eBAT?Z!Yl$+IXt@yy{zCUY1pru+fc z&;3?^T&#xS)&?`OF5_!bD0JQhMaIhsi;K)X@njs%F4L0!9WA{kOu{T~Usdwl7vbj0#S~zA z#_z9Ee+QLX_I@#L5ODXY?Vxy7Vl8k<<|?faqrM8tuMKh(Yc10-a)@~v34BG!Ojzq^G1h{b1??0(_q}T=1z7IG`^Q4!zAM-AbYA^#ODvR()vc;!p#c zFD~8h&m|&x1ZV;(XOak)4_kL$4JA0$i^zEuttb7gCe>qW{ak=Ll1OB-yb z=W&Dl*&T`U$HmJ{lw^9HY-N+g`@VTQ&6hj&Bt`xX8S%}@{`bWl3-4M|*>kj~b(!8f znm)>AG-g8+V@QdrMYqQBK~RI0xE|+@)hoDn)K!hLoTsaDw$57 z`Y6Z9XaHtYo+^l{w<+Xva5JTG1m|c=_@KW)QDgIZ#Sw?zoqtizHxYY=!i(t;i=ez? zM6h90)Hj>0V0;Y`XAw}2Mft_41u73MYziIbe6%RB}a1}87G$^_B0z7TUoh-;V= zHLw2XKzl32ZJZxcE)P4qEG1Cm+Ff zwOsAn7}5&~eO5JLN1P$zS!p@}nvZ>y?j5uoAtql{rQvk7zU(oM5sD;PUOWkiYNqX< zgS;8a5IhIAT;F}>z4YP-kr{dZYw+rF-t~iMK2G_m0i3q4?~73rrxUywv&6EvrB__1 z9M;2|vFGti@DOQY%wP-PPbC`f8>U+g1#9nCW0v3f?5cAM^X)7_5;}h2={75xiR5lL zQzu0UHKdvSI5D~(<2~c)-QZzDbtj?3QDT@EGGLys<`cSY4p?Ar`_bQP`e5k>an8@< z7(DfES3fk}+e8^Qw|?`na~SNUjIHB9A5J`&304UIUdA;`W)W;nSL4AiNf=_>C{UUw zoslEK=jma_bNTXccx$D^nC$PJ>eQQhNNC+hm%GFMb}Stbqs=v+#2MR`Vd>aZeH1x4 z5*s0xm0-pK<#cJE&pa}Sjy4UX8iz2 z5<8kbjLs8z5Hvsjse!FTSREuU-Pt=x-gGA|Y4s-W^ zZ4$g!r;|J)F-5wrk<~kb&rfM6zq{F&z+Udx*F%E;=nLF$eF@0e`5?C#nUcYDcU`uu z<>6QHP(?31pUQU$VtJ|kv3;0gKk*^1r{i;*8OK4cc@W0s$HT+O(^-YwOV4}-q{XzI|ejTI(2`Jfm=a){+|e+wqUrIe}P|Z)`8*_{bAbx zwpwz$8w+I(#}R~+s0;+~z4SB|kq?%11)6q$=fMp5`N7Kux)ZO%E@W~}X0zEvzXrQ1 zeKEU-Odh8#m=&QyTA!X5JhI0AI3p)DAszXZw);Z#)G3ZfBNY_}JVFEI@$d?l2~M z5bl_J(K=8J0?ezD5?qP~p@2(}@y$X!KGr%1Bu}GjAOLp04^VqoHT@XuDRKB|F8s(9 zY#GL)k`A5i+59MO`uDq&B}5!d`9;}%?(cq0XXeP`o*p}sEY*@^zv#UqkcX6r@y$c$I;9uRuc^B-~wEhCD_uVn}Z$6pv!bD zC%xPL&n=r_&yonX_rNsVH{YNXCe}s0N5(X6;69u;s7n!kP>Cxs%#igstawOYllAYz z=IZLMZH?_0>oS<0Wct88Pukun;Km#}<4xG_Jy0Flj1}trHMtIGDgAb4e%DuARmy9_ zq()nxe&6iiG7CA7C57S@iK%<>17=A2H5SaMPDm{d_c_>ym|on(7N=Xus4rZpldW=f z6y?k8>s5E;w=81`)_qJ@s$;B@5)csBSGtu=*wy~iT=QCpAb|pesodKY_{qezNeuKSh!6hBo*U-4*>9Aep<$KJ$%pN~(egE#BqEv~tC5Hv{dEMyJrpI+gyr~lmuA@d#j z`fXBa#rraM;*(X!rd9I0>PrP=6a(?g*#zs3lAUvgkaQTXK{@fyd}CjUox~F-3)tOk zen*+~oG)CQX=kFyd`=8EH+fU6V^E=tnv6M7sxD@FsiOQ{!igw-zapiUDLyUg`ODX6 zcpGl(KGi`t9^v!XUz1F70?F+hUtc?pwmv(%kNKsos>t*|k7rU!WilnjlhTVSy-WHZx>!nQgdTj66oYpC<&JMzM zy}1{9`6u|7XZ`}}YrbD;@Kd^VqW$^t+n$byRBGaf6t{{n2F;JLSNKydYBE zxz<)y){K#45M2hJ9DSyBdXiqKlz?$NuBf+0`m+MGF2#bQOW7pxM40RsT?%2L${D*S zNnn8lWgFxI=n#W{2!5W#hAYjl72xr>7m1q z5XKhQFil#fim$L)KM$x+OUm(RNCQ5GX#2RQI$2^%p9Q?nRr%LLmpiLmt~F|IU0cK7 zp31Q)RQu>}m^UsF+w~V_Ipo-)iB# zZd73QSKRUblSOk^*HMFpZ=L6S&rEuGtMIp++pJgq#W}IP3tUlBoI=6FBat@LbK13-z_i? zpi2@T8;sHn^vx?#k&2gj_CiXi*U=k>xQXnDF^tK5I^X5zZT{Dl%c0XM@?oBUP(7mq z%G>IVt>UJ%dY=2vjho`tM`^Zsl+HH?9qEP&^|DYiOgWP#$Ks-kl8^BN%&xg~$tF{7 zO<$TF32zwQQ%Gux>5si{yO-rSp_|dKe!2Nm;agy&HB$Ln=8V%olx1i92%eYyeWAIv zoQQg9oSD@)rAd#7bmO9YAtRpPxQypZv3FFT8b{ThTqh8SXC`c;?yy)aiOA(DqtPDC zMlwdECz<%rtS}u$F!pgm`Vf5fUwo~w_LJfo9W%md1*x)+!bP}_Zg-v*D_9D?A8U(^ z2EaKNlp+G|PVPJ<=OPS;Km^O(SA0i_0K`PDYa`V=)=J;LN^tt&=-M`!?3xhnX&}yG zBBn*}ai`^!o6YN}TC}z9b@FMpK_o@7ix=g`90{#MeJfhG5sD=F&U{gjIq#arRFQ!0 zTe&Rri_>(3z{oKf(ICm@2!sCCh=kjm>j>JN3eG6qlcR=y+Fz1 zBB5fEc^&4BiFZQ%ar=`)d^o}m!8%&X4;~C`JiD?;R|>heIU7kq=o1-odH%}IICgxS zsElT+E!>v6ePx6s{=~P%&J0%{h%_ZgT_TVQun_6EJo(ESdN?8b_%={Z16luMgez)P z7%NLkoaMPQUSnl`zA|sth2r3sj~NsVza~^ZO|CX*~ty#e3w{ z4{{qWsLB>`1Y~2w)wX5jiYbJg+cXRUuBz~Lx{6-Bk^*}H@uj1C^OFwA!wW;77z8`+MTt|x?CQG~m0 zn(1d;s_z4k8%{4mwT%$H2n7#UN?DabEb=#O;>kTYvfq46 z^Sx!IharuCQl`6)L`sr5>tT5UhU(&J`EL+vOpo7QH{qPdYVzem<&S;GyEA_Dlk1kG z{4wxvx@Ze(C^0528O;YG1`>siARq(^i>h44*9H8A^PaG(*Qf)y$|{DM2$a|ZH%H?EgKU=_o=PMWwl%*2 zGEvNxYe;*j+&9wl=q&E($8_@UJ8mr|uu2A-t~X-#FRvTs|32i81OwzYI1&OGyz4UFusWF?*z*TU zgxuOHj0EJq&C?SAO2Fo>p!Dm3uX{Df8y05c!(u9yt#j4eZL{a8!qGNUbPVV5-fBB^ zYM211Ogrc2a;T&w*7vAMOG;spM;lapmw(JIRtAbeR`sZ1j8lkzGO3E2dakkPc(SB_ zv85ss<{&&tn1-(ZVy@ElE-n4q%U$6+nIUcYmcujK8U(k4 z>GNXT=$#e7YzWWGiZzPm;MW(L7d(y9M%6pyoB;5Mab4o<9-j!1K>~%im?<{H2lJP> z4oU;uhc*uOvuFGF9v4csOsJ7H??Kag$ujQzZ;Ms8LCq~#m`!7E*k&#VjpMujiq4BEQX46v-=adj!SEv%e zO1L`wGJfRd(%z~^;W_pf>S;E`aY}GKbB?g2vDkiZ0usZlNj*hX3(x9Q)Ea#2#Ly9+ zZNNxCfD9Fd+@F0Ya?h^qv^l&V1|@+)?d*9)zSDsx%6(2&6MP;x|qP@=`en%(=aD&x7qV4|Mb*@_i`L z`_m)pmkM3IZ?b0)MNgIVAJrL4mK9LS!N@rCM(k}*@)4sOGU2pN;YWNSt#&XPxX3|9 zPB-m=Ztjv4CrixMrDy88eqH`#NAHpg6%muRi?fKxcA7pFkqPtQ7~hoTMTHS{?8oFd z;v(}qNaq<(?R8cUs`cI*>`NX@vZu7qUk3k$S{yq^4{x=C*ABmInJd;OQut2n>;$Z#Pfk8;Q8z6Lx|$j0Sc|D_DVyS- z-svb`t{ASyiO~8SH)}{VdnLM;kec0YYUam`3mB3_acOlk9V>(ttw{lY$gdE^47go1 zo$Rv-?otYZQ3ugXJhGH!m5`TGAAAROvH1JAUw6U%RcyPmM)h8|J4`;&8rP>>yOxf= zCTx9Ph$|-yn6sZP51pg4BWgh6(Rk8Z#eDu)k=G#Md*-fH)b}L!#lxAR^rlUcYL_A< zk%HtXs5d`K zqe}9^w(_6`xB%Z;ugT=$vaQOitaU)HANA=bpxXV(k~~un0oJExsNM+218mSkH%f}< zpJhZtdFQn53dgf?J3WgBmHUVj3^JxA-nrB|I=Qb8G8DhM$3oyJ09C;h4V)bML%gI9 z_#86W)%w5L>fF>=)-HL>y+_`200bVZHo#W@esU7+ey>EbNtp8j=y5ikxJ;(3`+7&4 zDqW^`0CWEh_dPIz)?9kcy&QS#^49}~_nqY|Hx1!=n1H~2xehG$0(l7GR-VoSv`4Gg z-AnzUW5nxrR8(-zZ{zIaU7nj^8;~cU^sKp;8vK^34*HZs{!aLxRW6S0zuhXbF@84@ zHkis@_)_%c*#_Zcadbs@!h;=@!YtbUX9l!cW5E$j@EMk?cMKd4ob0>X1~zZ@Ji#bn z;|n2r3%%4_A(y>6U|6$yb;SMsj_Y!R;Aa~*`<4&QUA`k^>)NEu^t$TXoIKygfiVGh z*|3_9Kd;LSsEQpU_C`3QsjQHlw3|b${=1h$0wI);U7ufG&dN{oA3Ub*%;>*vbu1?X z8~T1-C19PzesSV5(*fHpZh%<-Br4_Maf>U;q2>U>#;N!7xy`6-h<1hV?*kJ?md=>C zw)gh z?_0z2%RpN-tLdLXywn=s^!Wj>uV7*t=;Z*O1u6o$KH_3Id(#36kx&1^4u5QmM*f5J zxwVR+fIWF)lv(3lU*KF8v;cj&o!9Fb3Q934YE0* zBquA3&yRU+EDVyYk>*%|tdj7NGb3SIInmF@_7uI<<-vbLQ~z+XDsUs(L(!>IGM+W0 zHF%vr9K`}og<=KbN#JA_-vKMpYh8uk=={u{KvVnkqj2^OK!@!s+fL*Npd$6xdm#<| z%57);RBqzWgbfv+62g5N=F}*o4={^ctiqiG3H--UHxD4jKd3PcL2RawdpUrRd zHdv~G6sUm2tW4`<74eAGs2)8T9OwpR4Wi>z$q?EadHg75;EU5%sCouhSg$-PVF<=s zi12G7g^A{D$uLk-ZVoLVvToiL|DvERnM94|=vN~p{1T2wErsLY$g~_3%_o+z>C1SgvFZ6vIe#F=qVaukuIQiQSgxBP z{(Qf5J_N)U_@9O$@n9O;F+ZVYWg_)6Xn(I870$jWgu7Ns77z`GiLpc>xII#^`&Nb= zK%sGRih!QV!;=_KDz#aQPgmsXuXXdr8aa=#mO}NZW0!Q;J3&^ANDS(fOrZvdC&>x_ zQaihxL+2b$6Y&ZH{;@M&zR;J7V5m8wvVYC9VoOp1*0KczLo@|cqgWW4h!Qu$L~q$T z)o$&ZP)^@EbUYq3^q+kZ;$lR$w~Q0QW0)uHsFezHx-^J_T+7@+30j||9x-s`TQB!v zB8F41bOjL_Ip)0L0O@pKPSiyAtpdfk{GIcQvEz5SycE8|34SEH@)>Ax@~{T|8M1m$ zwHe_`cC;%Oi4C5uRVzMkjJ;nR(nE@v$1j|K-+L~OpY6N*3_DnQ;>A_O0w_1Fj}ORrg^)PCt)L)viw zCy*Zv9WT@mfq_boX-#)F<}vh3v?x({7Utmoun00b)#yUJc9QvX8t}hq^(~r>`2Zt-Dx4r05c;hVQbj@^IgeA0I1kic zJ*59_BJdB8NB@tg4$##>39-bvV);ih{=eF>|3^dj|J4O@cSZx?v^$sO)(~(CC8fdA z=5Q_$wR;AH3V~*q^Zp#ab|uML?pO&K%6AQd-o8HUneENZEcTQ<w3~6_m)E8D!3gpi$$YL!@Tw718WN%yn|`IP`1@wtgco!YgrW) zT;+S#GRJ|~Na^fv>AULw4lNTt49Hpb71RPRwr~iqu#<;})ohm)s||1&F|Io0!pGA% ziHW}}$`&Hrkgc`Ni{pFlIRE2$Kj&o&6V-b}AwxiqWfFh8db26$5 v%NWvrM;vcD-#AIUp!(g74EmxHOpKfCAi?AUj#X6WvOBblfeH0jA~^T literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/detection-icon.png b/windows/keep-secure/images/detection-icon.png new file mode 100644 index 0000000000000000000000000000000000000000..12d2217cdf732acba7e89aa067497e19bb634227 GIT binary patch literal 3261 zcmV;u3_|mXP)Px#1ZP1_K>z@;j|==^1poj532;bRa{vG#)c^n?)d2*Yw4DF|3{pu%K~zXfbyspAzH{=Vt5<*F$oCX|_#FGZ1@6!>04Bn;m9XBEIna+D6A-hKn8yXcBy$fkAC|xByySkx; z-oZb8+zjQ%6L`bBt4wgfSJ0*RUd))De)N?Kem)e%@&ev~G;Gi|KtXBC@m}Id;s#B@0bL3ATmr$0kg=cl{e%geM&(mMt#$OJNa7LcBd6mX%hw zCC#UwD|=?+2GeY_JQft&YzA!#G6^Z+JCINVB-hWR2A#lBxQMk2v?Q%aeh>dZL5od$ z(9a|4N{|y=dL}fs1~5ENIIdw>rVI7h?7W9Fo;jza*A9DPtXGNEVRdhkd(uByd!MbL-*q z114>e=Y(=(erR0GP|CC-O{cP_7ir6bCTa2IiQ|sjHe$@3Kt5Mn2W5E=Tzr!yBAPHT ztH5&NKfRE9;TZ`FxXRJm^Ip>L0T2#>&H}vY4}uKKU-&@-eeZQ90HT`u${eu(Fa-IO zJO-X{NZ_Mn=rCqLPfLX?kWvcaxfG$Wj3Io>^KDlOtRQ9>kW)xcdcrZ=HjzBGXj}8t zing};HBYVXHq3cNC5G?W(sQN75fT6}>4&5eMtAFlP~jX~`CI?}{HK*iFV>y^*UQfx zuR3En9TP*LnDkxO)_Mbwhop~Grh>cuPGwygGk$Dkb*-fY!pRlJp%30HTwK(OaPyUE z+8Paz1{|DF!uCX0ZYcNNU9Y^nWlP)*Ob$tu-|;i3gdx}vZ(w^LZF`nxt2mB zOy&?QP6)y$YCz)(mP!$zX=*5C1jrB6G24=`Ad$4RQ1@A(MVZR*SBpaA-q_5 z#h#iAr*^-$QQJ#+N<(;F(MH(rq97`vKoxuKn=9 z{@mOtrt&^6-?MYyd!_{AfFW6uZEYzhvV7?Sl{M#42{ZmQq_(v=e5L-6LvD{NXYc!O z?s$K{MIAiJ4fa8?B}2Q$WM*jjad1_qf3`A8aiso>a~wgoR;4Zb4>%* z*Y@M)2cdm%lcr}i96$0wXi-U={A~$=At92TIjpLsxdT>(YDpJReTF?Cq+zxeFPVMQ z&#$Zb!APJQ!EF?iu`?$Q-tg;wkG-(gAZ2>c*gn!YakBjJCm+ksysOD1B%L<4A8Tnm zJ$-6c-pstJrUP`ceUWgCq#@xqj1?S*%CTPERQ6GM#pJx{TerW~ z)DmuKz5K+JWiLFv^6|B+%1_rqLJl~MM)L!h`)CfaNb9-k8ljA%Uwl|lm^b(D51gs1 zM}_|G{MYEajwf|@Bs8Q6i%6xKEQ(iY`XVM}0^X$V3w=CkTIeix5{r8S2my^e%o7Rz zlMYgFYC>@os#JdsY(g=KJ&-|;!sxv4!db#cDMz_F_hcIh$&SZSUR31pigO$yWN{8! zvNkYNhyfb5xK!%YheY5BpuZFk#2I9IN+qW$0ZEwp`agiA=-Jg{0RSSfBYFU@GD1^CHDz#1hr>jgwsFYXhlvAC6x=kWmw zGe7==7{`HtS_;6g$39qrDzubsySV0%BN&SwI8`iL+K#{`9E`gSGKaa^m~v@0b0ww# z>O`IhLOf6plii+*IU)*eq-S7K15HvM#Shzc&-M z1E40!LI*&c=&0#B32J`S2XLo|9Q*Ra^f7njWDmdf_M5N0{>Rt+DDC>6{WK>hXXx-z zi%M5qY41Y$#uSIfhJ_4=>P)IHODce@Hkpxgi{@74Mx)KOk33R3bJ3zxmmA`q;mhdW z*EbCQUH^|hFYof9itO%=Jpas^L4$9v{O)YjGcg|Td;j(OW>4R?XAkP1DRBkD&4gT_ zIccEEsSVA}K*C}KM6Zpx-Iuq$x;Agxl%4Oq-O$$5)E3^gb6fubH%ys1Ehl%<@DW31 z%*f5kxhH*G`kC*)ZHl&jU-#|uvSr!#-b#I^!3ywVV3EVRg;uM9# zR(7+JP4(4B)~qhQ@i#YJ*RS8K1;x7$9PYFerUz>q@LhXX%cjliM~xo*lWVUTkuiGX zTW?;B8tuMH*cg7qrMF+j#V_1sM%Tn^0Q?FM+{o9YWc2@4_@r-j5){>aunO{D!}NEyR;5S^bp4* zS4A4b)ek>fJYh=4!^N}jxqHZS8@JVVxwvkCh`xK%=t9|tl!z(S(Ri_P?!5f0aU&O& z&dr*fvu@j4EeQ{UI0Cp2L%M2!8BL6!f!?m-7_0Ulcp~e_4*+aQd5w!$)5%J90Q^(%PxM#>sx7?CBb?#?Xjdc0Oe2T`;0`>;7Eun;)Vd)sjmuvVww+o*+cm>8}q>3+4Uu>9zIY z@HaKzls;7S+gtnRj86~UKec$tf|-8}4IDXi;P5*)zqYBf?aJA6pUqoXu(<3WHLX!t z02u>D2>L#drh5bJv0GqUo+(g|aphDd#$4JG!jIcdyC*t?-|4BiDU7INCg5sc#cgUP zLc~#86E2w>)IgF7X|L;r2D)6rgxE%@bWw&B+>~G=(|4REQP9rtfKn>)9bxLA>EJu^ z6g8U2AhuC59ii`$bUUERdDUf91I-hV4r}$|qo?yBpGOZ+nW{IWGBwuNli-%sCF*XoMHjjTa0kfX8`an=W z^$XAtpY)z&rYZ6(G^BY1ZvlPU#S<<3Qg--g!?g4nEKRmI&}D!3HGXX8P_2Qk(@Ik;M!Qd`Cc-ajG_-G*FPe z#M9T6{Q(O%lbNZCmEdi#kZVMVV`)i7ei6gUb!R+)LOdlvA(zzRU|>x4ba4#v=zKeMf7YP@kz@Ns z0^5%qZCE*%tCXW@f}O*Cg>0iQvb#9-^7xMWeUp{BbX9!=|Ai(2rDZpcZev^LedYqo z!;&mRfnw#OY+d)u-dleE^KO3eInj=e3C(_=8srYTfB4TL{;hCdbxh(DmV(HZr&Y|Z zS_>4#7p_*i6@GQ^0jFtfpEh+R@ZA5f@!o-)&mBqe)clE3j{Xz2o73L5W}NsF z<;VJZ6-V|X^;=u2EDP_=`f(w2;(q72ThD`zyR^TK+4=RA&x8EGKi`*d)G`LRZaA@x Ti{%M00vJ49{an^LB{Ts5>GlmZ literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/export-sccm.png b/windows/keep-secure/images/export-sccm.png new file mode 100644 index 0000000000000000000000000000000000000000..62ed43e9e71b7a63c98b224922a9adf2367f6966 GIT binary patch literal 33784 zcmZs@1z1$k`!xyz0@8yp($Yu^(j@}YB@IKDN)Fwff^;`1-92=73er7vH`3h0@Av=i z{qA=!&jUU%bIzQ-_q*4--u13+sFH#t)+^#y2nYyR(o*7I5D*am0N*}nFMyw~9G=jC z7ZB~gNPa>n8ztQZenB=Dl@~=osEow8H$(w`N4J&IvPVF`?t1=4?6WB_K|t{TDJ?Fl z>Y{hpf*z+j)pESj_-N6Rcz-_awl{d5d3WT_GqXQ+E%!m=Fes{fV=E;L3QJ6sic2kM zpvx+t`2lZ#`zt03lOs^{WioO$!Pk#3Nm9%*+>Xq?W=S??r;@+>YWBFozp^C4v#qM8 zkxtxL8lTNIlCNou-pfob+)PO&-8IFqi#*h%egMAQTBOUZ|5n8#gAx#s<9y%Iy85#%r!hq_-AA! zoDBl=5#=e<$DzN1C7%*S=2uoiSC&0^jlO;R=CC!EnHdvP<#K9t&9G)OFi6a2x3S=l zS}msK%11`bZ>z)W<}tN5<)(H}Oq40)UYARDjrY5<@|~Yq=4q2-xot16k%jZj8s{wK zo+vqGS?Xy>j}7?smT@mWy+Zd!`%LQpQZXa zBi;gcg*OuEH`_k$O)(|CPrwZue87v$O|<=@qN3b-(utwY%TQ4RJn0|sEWP#gwVcI% zNt@Ro*R*-~4YW7QW~DW};@z9SWmMvR<`Py`hXb+n#)8IaJah=8pF_$<_^-Hx9d>Zd zAu1~8R|_`OPoH8?G7EGiLXgK^4Li=1>E4EK4=4X>X7`aXP~^Rg+R$rpTXS8`LmEbn zv(Cu1;>=(-^gHYPc*yt(!m~aWSwEp3?@nb(HmXT(TPLZf6+^UJ~kB+MA3H*0f-B-dZS2K9mmCBje*B|cw?duc* z*J+waJUu>4E#J3$d@MBYjHZ^fbp6CH5-CP&I(VVwLg~=lNG_HbAHQ}M!$~gWcHxJD zQ6iKf{v?L&@2T&RySHPdWUSWth=Z=^0#N?Fe)qg&gCsUM0@_R68vV4vk?mB% z#+aI#ngvcf6br<6)VWy~G+1J6x~_ zbGisRG>whdPuKf6+ZJC+x;#Dni=UajZb!ml82fSF6FHXn5n*8UOpD(|CDjSUY91~* z5p=oFCmwz}`bO(i{FvVT;(9G7cNZ7S(@q#GRY=$YIySRyi`Hp>3lC$1&k;l@zPm)N zmmr$A*j<&knwN&9oi=u+Y$fdHS-WS=l7IH&WX1DNowem#PfXajy8Fr#{FXO#mR81x z(Zi>!J$ZA$6q(&hQzi|YT0E!%z;uXSjo z?6Gqf2E%LXLQ;3h`5ksT12NqH9c_Y1jKWi=gw{_tz~t}v)JwfvL=Wl~toN6ict{yU z23fSUOgA_0wR_T?mt802dH#Tnd9?LfZ>>MCcs+E_92W1sB9HvnvLj`9_ewm;Eb}P) zhd%?f`@7Bbg0KHetS|B7=vkPoCzXu|DjVT#SGDDr2Xpw7rNzbW|CXF>8a5Lmg>OUT zMXPMrJ{`OSBRDTPf=Rt1KcW75$A;#isBy>$5{EkK^UW=!9BK^UPJFrznC#)?{zo4n zP?maRywIpqeObmzpOTQ!Tdvq{NFyRbQGVtxf~k;5QEs1TvOSvafD66|`>YzDAKgD- zThR=f`HPs>WHv&)i89jmxZhR;#3$kP9f)7Je5Av1GM&r#CXLU2^(~?;Yen_^ytdqF zFNw`Y>-$%Oetv!=)-c~_?C7aWS35D<=-BMW#`%=ee?y$JlNE+t-@ku{Y0NnA>UvIX za-}sB8LZzf3hj8xASJQV5vT43iBr*wDJVp6>BM8=ArAVG`X7BFRN`N0!PupAS#oeb zUbY&U7Fa?=dMTG7m`tHpAk;*qUEI{zObcHLn^oI~Du69Yn#XUxH>$~J-2dQ@V^4d# z;7qcZ?2P*EopE18PoQSGUW-yZQ&mn575~oLfD;;K{a~N${l9z|Zo;>)!+or5VyCE+ zL0mZw?bG?EK+vgV`m$H-6ccNWBvHF-^fBCkZn!FmT$Ex}i~UMtF=@H1;ju zDi6^H22L7-a?=lFJiR56)?2sl-}nCP(G6E^oJ8aO>g&C9*eu3Q+Wax5G3c;q7IS~^ z5yz`i5+w85KCz~*u1HtH4^2@+7{J6i%R3H##dQsE-Qlc;?GCRerH~LAJ>upu%j)q$ zz0FdiqYHnJ1^M<6xu5kQ#;!E4l*)o5h&4Y9LxTT3-6nt;eTpeRTvwAnWhRKMo2k{- z{uAMfY4w@>8OuOFlj$@+9-A%J_?aWE$<|jPYL?ub7kv-|FLCnW4@PYI0K3)v2Rei? zHV=fAFDP8PUM-@||*?g5`;|BcWK9K&-E3lKGrRXne3HLoSna<~?jC!H7{HxNqfruLd~z8N*Ofn1N^ z-{6eido-4m^H)zh-&{ZNLdYqXtIfxpS3JSdF)<+IL>8Utd_{_@jl^BtvEkth*3Yk_ zWIsH(JDvGm0@=F{gJ_uknu$+N#}&J|Jj>r*F_1>=@$*&bSijLUPb0GSieAqW`M}<1 zinpW3QZH`q8Gn(f(`$<;Z{7c7b{Mb!!Q3c(u{RYKsh#C^Q>-)M><< zM}?3vo}oYZ&`fy+xyR4ow*Ay8Y%uu503Hy*o+TIpJyzZbB z_u)UeUXLu-s(u-n0$@nTq*p8w88UP!B{31zd*Zh=Tk}chcZ^*^yeQO_leA%Pce?y0d1{*dV%Hos<`5B9Jp_~cf=gfYg%>ctvAOy zamnRKbIRG;62s^znwf*Tw)ypLWcD1yy@=V77TtxG8|yHEuaH7e@Hy?O26 z&m?(jJXdW`>KX#b&NCjahXX$im8UrQ{wBpIu_yf6eL=48OGtSJ!mi}M%Tw^(OcrUA z@lLO@7vw{l9%lpHV*&yj1Av1Lf^U(w4Uc8Q(^L_ zdVs!qo&#TJXFEvbn9&q7EDQ{@HQ(?bLb|{lb8~YTgv^>vPAvWk;lkqJvg3>0Nmr@0 zu8p5)&kKUOucNJ9Bv{>ACUrAnlewlF#lF1kM`X-}fq`LfZ_i^n+unmRK1VB?(9aST z)kDCfF69V-P`+Yj9?phywpClJpg}vrrbLAMQ3L9EH$Jvmh#0@6FIr@U*tKPzh<>Or zuRe0yH9QQ)ihb7eo*kI;FO2)6vzVOfOm0GgNxU>=Gyg7mg2@?0N=eMZryz|UWIuT_ zUh3(4 zt8LzuDHj_jQgP=@2}M&zmB{d2Jv=Aw^3plBR-~D_?w7`zfIc#HXIAw9z3>?iJkM#0 zHgxxvFyreZhyA}^tOd0tupFsy{Ry2Z4K)WiVnd;3jno6QN7}qUF(650{A~ z7YT?>ZXq#E%5!o&)NUiv`R02`nH=)%kq`_%UTShSrhn)W&&Qp-w6e4uW)rNkvGJ0y z`t|B2c+AX&{R`>!Jzbd&tVH(EQDdjlXnZ2VOa?G@}f!H|ogkcLt4@dYij~O6uq*oEvNmyjx z1_#*SHt!|6D)bz9Y2RF#w)~8RFTNA7H`-}`n@1nq)eo?|iNUVWKX9k7Rj|tUT8jqE zw&r|7jXl=TDH|n6A)`vzy?)p9^z?mm^Fc`o4!wc_&2DH9{H(8~s;WwOR?n+z zeR=$eFUl{>!oni|7=_=o^<>|vUaBV_o6#tr#NI)8`t7~zr)n?m!+}tejEsb-Un{@8 z&j0n>6!MMS1uW?OV1dBUqDNABjI}P+nUAu?f@!H9b!=KjGL!tF3tH7?A~zec;X4T_ zDOVk+>uVbu8=c#V6CD-knhkaY#f_B%gcskgdeXVAh`XcpttL7+^KSK&)3Tqkzc(jG z_NWcH3PGD-5)u*`ro%W?j*kT-dUAT{&TvtZ_-v#!I$wa{bL3|xr^RbM>mNV z*!inO8<^)IukThs^U}#mzg5WnYISaaN$}mf$$j`i+bH9ee` zmUaiCp%HA5DeMWe>PD}CH51`ud$;ba1yhWUjMQqketLo|g+4-s&=%)Hk9&mN;KiwQ zA@#)xsVDCp5h%hiP?<(~pInH-h8`IZ33+7N$U}R2lD9f|*UGzmBSjvsf!v5w0pqp3 zwKb7X55utRK%i;fqWjG}`%%O312jl$ks&53?5;ih>G*JdWfFC{EMgzgygTUri}^)V zPhf?S@U-YV+&^UADI_1oew_up^y1z27OB~8iu7{BDPAs{|6(_FZ6D+?&e-OF_Pgk* z`A9=>t+~uvedjR*lSb4W`T#w6)nqi5=R_0NUjlZrjg_sau5n92ibQy8d1QXG* zy`vs#m88gGQh(Kix>qsJ38p0k_s3+@7de!$G%wBm;7!ofKV`qUooNFKb|o#YgRro$ zedNy-d76v)nO-Sj?vMAbLWpbYQELVRtLF70L;+gR<#1UoRdUa?vYP{3zoEF&2*A-<%(}-dU?v`j8Kd9p~lcO(e4$ zzDN)8?_ptL>bf|g!cEz^C#!026ZySgjt|TTjTiWz$3lZFm<`h45vt}el^M8En*WRwS$i>-zQtQzeq4=AJ`HaR{&HGL2cJ+<&lK5zrKc45Dl1F4l$b$l zE&1_wjjgOXE$|Df*A0_Fd>k0JElfvM)!|}C`4&O90Vd#d@bO)nkFfP3%=LWh&++R{ zeMs4B!q;A_iERP$MIc~5FtxqK8du}^mz$_JUu}+4%%o8k-l3z9$gcQRxtrPgwRC@v zkk>u0-rI51ouUZ3(Fzt;z4&)yZnfM_2bwoF#F-z>o&9VC)7K@=JVC*zuQZ1Ej_zUkuTm=s{R=oy0 zsPo}GZJ3ThcAG3h1#HJ(?8{{memL{$fY4RBr|-&e5ADp=;leJGgXxwLbZuNRw1 zHtW$n;C-)PwnQ|t&SFqr0-)i{TUuS-sBLDrRAYlRF2J3+-nQ?Mr^ow6vOS$jrmlF% zD-yzHEWLl@;RN+~UQTIH>hm6?vQ(tpCqDwRMpxoLTO?*yz0^O!A0!_pS1yc8)#S-% zqX^trv|CfX)+LTxEdaJOnA9*P@+6o5N`%~QA|{~Y_rlL|8J|cH+34mN4O(pbZ7WPp zklOAgQ29x##XQ)oC4O!DmRLMhWu1(M_S{FtO@f=L)$40U^lDTe!KNcyRu23_AVqr( zQVT%fkQ^iyOy&z#p4c082mg!b3HDegdBRekJ80oFaopnOP5+AC0IO@u@SUpDt$w(X z71V^Ylr>&Ak~{Q7cT++j%3@>Z7(DBTc+vv#3njefoa%TgdzIYhO*< z&@FNC4x_$SHxMAv6%bQiJViZbRvFCE?+C;A+ON^=p-2`5rRZVQ$2 z9Hy@(|1*iVP1_>%V*9peBiL-hBse<**&M@wyAQf+}VTr^mVGf# zZO0P9u$IdZ`pNx9M{hEuCvc9izM`TcCnu-5IZX}tsP*e6X+0Lh0T>LZ4@uq|Ayb8c z+05|QHT6HZ@{B+Bb9h|zwEQue%#)vvbVO}}xmbOsC~u;AI@3^B*I&H7y=`&-H}Ris zj^hQID98 z^|qvr?trx>v8}Iozy5dtD2k^NucdAV0Fg1e>T?)CZ}RfJGvaHDD+)sJyqljM?{EZ9 ze2Tsr+{6Kr4ZFU=$iT?o|9uH)!92yu-v0X=L;MW%yk~7pEGgOyd-m8Xq5@ znp*96zJ=NM6MaDDfY7-s2&-w3gxhM-b>g=4H^RrexS1m{LRtoFwV2jN)jXSJN?(D6 z4?Mr4eYF?QQhEuPX5a%@CloVlJICii#)~TdMC4qYuLi3I2PK!2#zI6k-ndv6z|oO& zyLWlPV6`g~_BX$)(?oz-9qmC8&fN4kn}T<)GHa)d_WaC(DxO7Nv44&sKMx?3Fsg@H zSy`R+Nrux1Rq8+>Ed3M|@8S5FGux_SS@rX7G87-RYFZ5Zljf=3Rs_wbctqg(%(9d{ z0vB8d$Od(-GQE$x#Ro?uRJ_{w`UiEvNbF-U)CVt3)UR}0hJuVerM3&L<-V3h{6o0= ztH({Y2&DwfzECtUwi>_PFlNr6Fy`QvrNqFcUl(ni+q((^jaOu=LtcNdt|1WaLYa@x z5CU-E-gZlG0;>`x&8p2ZH!0#qgn{HHK=ArKNon`5mU2zXYzg3~@qdR$N6q-mhTrfa zy~M2OWE_%zNl&$v(h*faqjqFwJ!f6AuUWNQR#|2&9n;j))3X;!V@buU8XQi-W8EEs zC)$cf@h->N=e;JsCz#Ipu$#kK0428R)YMMuY%awjO)OBv3_^+8uSmTsiR`({Zs+3| ztH_45o~CEFWeqfkD*o1dh-2cM&LI^!6+5kb#qczK>>7uN$z(*rNZ%F`A+BU3_eN3- zwT>=e7ZuH(6$3kXzn3l!(vCgS;NY-hPfA=g`^(Eo$&N@Xkj-7PkiIuRkd8PQ_n9=4Ms0;Ic3h-FZdR3Jv)CNjvYp28^ z&YEU3dhGy}o`eKSn)0vD?>i0g%%{iztS&4r-k;3JxnHnu`q{C%doqs3DioiOcb#}} zV@w9rC?;HR8pWf!x(vMi$6)kG9Nqh)gLpvJGmVcI($75aCpm9hafdC_OLY~-Ph_5| zq4`Mcgk{ zFl9xaeRyF*aELP{Ho6pz#rE^o0qudp<0dlG3L>iCo+U`@lALVwFh}eW_e__~%;@y+ z{s992WA&JDSWI~Y;uk`w>K}Z1P=ouJ(7%e%RA!wzOi}F4_kW1iSL}vZ4tn2`q0=D) z1p*^>GLM5)6}&+COz|!BXmjQ5rQjO@C*~q4EvKOK0s74Lj=_MGrsl8|wO*}FFwX1` zknlMHZBfStt4-Tybj?~~>W^O=+sEkX}i4gpR&u$+1p`G zi1D|t=pPELp#u}Tn<4tEXb$sNDHuo|pSGipK+E)9Y);K-<6> z%nE^7&T(XbI{*G1yVZ4G3j7k;-nY+vu~GaXfx`R#{b1Cxc~;kfcqk{fG!OhE3)Ntn)g3D53GuhHT3 zY!lEqAgykfuMQR)?DG}UzgQ8ziOcWCrRiS+iU}ZJt@#lo#si_pIgLBVtWn$yqIH1= z6?q7Xo`B?q^U(+(;d?VxkK@~Kk?mWG1)^y;7E1-xoYy*UC>|dtGrj8e2RDb1^obh1 z9^9tPd_`Sl5cG9X%r^R?YinzZ?1ac8gGcwKij~W>s)N-02$YvE-x9cFlbDvC(zBYZH-vHa%4*QgEFF99}q>`zJ2ql>f?T6SQ*k+gNX;Zjrz z5B85ShVm8YqZ~Zqp%N8RQ}GlW*Aua@193%M~c2UU#F zK!UTwmt`3L$6Bn>IYV7v?d|U?W(XF3BL46Er>8dAsS&@)Of2#(cfR4rx#{}ejn3j6 zUDZGHJ?!l4EG31Qw+^#6Ylp2oHVu=6Th7&d%m{hY(GX7KoSe>(Y~`jv?FTa{nmk2C z{j;JIvO2`Y)A(FA0u&h_#z2cvD)0k4!>#NQhk$Yf2@f{50?7W~uSj7dkL6}p+eQu` zU6Qfd*8{|}q=fn75wYKM^!)Enj%YWte%jyHb`L|G3G)$s;KcBA~Wt9>NkYlu*FUKu9M3})3Tjt1a{{eE#l(v>J-&XbfgXI2nnCXO^aGU zwsldAVA~o_7BinJQgdizey&CJDyaC9Le3gk4UPs`Kn#D7U6=$N6YHgT?ZJy~`=uWG zQdA1#0f^89<(wa&-N2Ysnkn;6pqOT0W)`$vMQ{MOa(cdJxaD-FSIh{HS^2msgt4qI zTjRwR-5_AQ`f-bO8f-e#4LNS?+Pq|~A}koZ{4cU4Ejk82gAwqrWJN<$W69=Xk8JHo z26pM?L~SFdRqu<1Z(}zYiRHZZ8fAC_;>+IS(O}nG9b8{@yGUU+HG$^k%~jDODpkLc zrLl9qn z;?gob%E>=`Kwh?5qk0YnXz$t%dN3M1rcj}eJ_hz5kifM(%A>F-wY(TVdfHj_Bq{rC zrq^U6zo3ip-HXe<{zC^bD@5SWM4eDRu4z=A;exf!Z>BfunGF_YM2mQzjuLp>%t{xQ ztc+#V74Yu)Qp1`ehk}f&Z!uriw(i7!=IY1Dk_Fd;_B6$jUh!O7KgjZ^h^O5T!T&igci(9LtZ(?$9mZ)wuUA7! zeUqy2Q5f}e=*)Mwl*ZBjg%iLU?+?w~8yu5~EIA)j(=L&Z+=!~l$AABd`k%WXH--(n z0D@_yL%%G|CjE3I`^MJR{IdB;Mn&A~Eqv17@9e;yvqYjk)|P&m(b1>lVmKY|7#XXG zJ=+(1v_6M2%KQe)nCYE)&{Af4?nK&$nh=27t2m(H3~KCFM!ywoT`u_}KhmWX0U`S7k#qp5K3xh(lalZWo2s zxOXI8q(s~S=@XHq>>Q9C6}JTU%bXQ?(#X%|ENC}-IE7P-{uh`4fN!W*>?r*I z0u@)?hCzU$v6mr2RHXEY?%u=vcb$Y zSaxZt&HKq02~{Dp?unAAJqsvITG71-bkR;ou%SbMu(-plS>c2IY-z~|yg&!VHXWhy zIRm=jzrzJdipKrs5i$U!y;cHzipWJXH&@0YcGDrm+8; z(-;2!{mt0=%x!|+MlT+&w26$#Fn7=vda>-|WX=@&)_>Z{+F+{tYVbT>sW5dmHD!xb^L-Jgb-p9=^KSr(f1917xOXZ^ zd2+;Y4o0y}yhDp*GG>giylG>kA4B0FAPu;$%EqY&3JVC(9$YUDtRZA;$V`z9- z98?_S1Yjt7`L>Ip^J+WdfNp0|jf@jjsa91NATuaeP4V>u)}L9#w@6B7hm05Ee1@IK zkTNKk(`Y@!tZY@ccJ$PRiA43FHVVcq;WJ1~)wvT}54 zYLn>@A>^-^r<#}mkfLbdZ=d33@P?Pf5x3to3~hYmek%Z#e(4S94h*N-Kc@;+@^ixV zjs}O`nWbh-hP-7>-gCI`5WRkhategie*x0srStE!@-mmF~4)f5|pj zWgI>OT}!XYy(7>T>nMkesxpU4a<`OlX!UDUGX7y*>`vYGHFb4aWT^oG2+6F+UYYfy z-3&h)qe^si5|4jKd$50VfIr<8V#x%e!*4FF_cKjL?8niL{~>~wN5nb71G>(?EmvaA zW!1f%e&26wTX2tN)H7foR`0uRr#sVm*6fUNg2Uh3Y~ywHVS8`4G@Nf0*5P(YV30Lm zQ3!kRdipRCZPxy(-xIt)=^CuIb-KGhAA^Rv-kh0cfLdvO5Q*yf7?H&R1)p0Y+utnD zlFy_zM`ta8 z>_D-;8BBD;y|44TJjTV7i<@PX*3zSkTn;EPoX!jL^FPAEfTr@*(Nb!9d@c0h7HGFA zSp}I;^4aq+Fu$i-)Jn)s?w%<8xc&e% z4uFEI1Tc)Q_p+U1L~d-nK3+)G*HTkcUMNTr6V;O#V0x3mPLrGlvN_Xk=tq+kzp(GM zANwl~IaVC^ZQpLael_sDxy;<8qkk4-tIKmBLUS`YaUWR_W4+_{ch2G@|F0}NE19AP=%1_ ze^{_{I8jF8$0d=-jLMs_=JJv$NJm6OSdzROw%`)WF|wNhB$z{s+Ro0-#l>>TArtAPFfOZZu!^HRpur%E;M1MOpkOP$ROFL!T?@w#Ejm;^ zJ&+kF)!g*iVVk2~kU(EMK%iJp7#LnhhttALOKYJ&+6oJPQu|G(tkUu0a7*-v|=1 z4M4v(a6G?+N_(}_B%-gShZR@ka zur6n6pPU*(Qwk@JNi~s$80&V&FhYMilF4Rtb4}+C)09;P)X+#n9DB&Q0ikO!488J6 zqHl-Hz%oJM$_Vt2-zXX8=;#Re7m0YRAv!v#uOuj9VNjFMB-r>o3o%d}Dq|`4(pZyf z!Sxus$)8`MgZlRYe@M=N87{XM01~jQ)kGGB!H>YA0QnPYXO~!8gcx?9Y1i;dz-5P> z%(>Sw`w0+^K#Ih%NPitZ` z6ef#9i^#mD3_nHaoyw0aeM>UYjn-#EinKQs!2W>n{wAKtVy(giIoB%t5s=ne_Qot_ z&6x}#v~%zN1;(uJV+-((f$Q3_U9*#!pb+7{NAiC8p)0I>kDIIlM|*|ACk1 z0l{?3R&%gpz9<}-d!fH7^xBSpL$s6eE<}vNbmq$_9o@v zw_LHXGM1OJi2`P2e-k&aU^*(T~6Yd4g$Iw8>(k&*jG*08? zx0h$tr|hmQ0Uch0}%gwQApDyKBr-l3tpf0QD_i|tnQ)Eo`qu<6c;lAa%_=6g+(0Thkw=q z3o6RR*iUvmK&w%rZC(#?+ri=C;i35SMKZsofmvBU4T&c${tQ1_YI!>7!D!&4z554N zPv@7o}t6dcd{559QRpGQ-9D5B@*V}o%hT;ZY1Clu}n@12YZ(!ng+ z!)Q&r>2nuA)Bo2Z42qw^ZL{1t+HcltxELU8x!UeqkVDYG)Uo;#wLoX3)l+$pGLk|> zG%}1@&AT@`x(d`mH@ehNO(VUSkf2_9{LjmL^+!x%;>Kga(*}j`)0zrC&!gehXa;rS zzNa4#T`n)s@tx2y1l+tyynwqyjDiNY2uJ7w_g*X*`?()6QV{Xx{fi|+R!D#p;0vVc zm%3IIJVlnV24oTJ>u`Gp zak0?TC(7IP+bTV*`ky*P1y+SBcA+_x7&epS#7(o8u6L`=ybjs{{FgO(TZG2h+Df7O zr!LxltHa5hfE`7UBIvCsoSU1Q2xH1m1`?knY5?LNQ_)48-mQyz!&n=#kk9Sqbp*dv~J_2f7RbLhjYJg{;jA~2ugeYNd{s~8zIv8 z32uZEQgr9nR=-@V!4{_(ySKNuVAHnrz2OQFOS4Q=f{|yHSJ53@zz(W5vDkc2eMT?4 z>xNb~AWj-C+iqt{?v7-iR&IM(@txt_p}b~0te|I~u1)LB*3nWEo+!S|*S#!J|5cBR zKa!X)HukGbhd4MnpB>!q(SrFHNvg!7

+PiFn^-{O7~EWRiCu$Vx8@<>#4nM|@I zQs5v5n4ZqselT09`O4>e!H+QUnq1;_X2d6avL#EX z_bMf&r{5xt%O}}I=Ljq%Jz3d-KOo?ULhg(Hv9TF^u-}ijXYphOaSScyE80@UlhKmGlA*+`VAQYpNy z*P=i(g|N6U(gMTdue@n19e(fOL=2-Mp+;wS(${n^HB+m&dW{pz;9~M7s^ly5 zm-*(_@aB#A^a~+qG6Sy*9clGX+K&{cxse+MW8D%wmMEDdoqg&jh;5O*51ngereJ6W zY>QeS43l2$0}HKkS|H-j;0pF5otOCmk711<2M_uo4RKEDJ~WYoH+Ioj(;I_k$o^*) z&{&|=qy<4v|MRAR1ei{pWrN4=L_AX>;NgFTOVTztcZihR(VHcnks zm-Y&qtIg@1Wv`8 zDPAEBNb`Eq6`aBF56rGE9cJF3ZC z$b2;YvL;<1_<2?-LoLu^-r~;~P}g)H;>NU;~;!Tm3AT^4K_Rv zG;mc_RbPX_#a{*F77e?AqggXH&kmHrh6o_j@O=0%?!6hWvEyJ0mxM-#a66i$(V|^a z>tFQ!dEd6nNsjkP7Gh>qi!x2TYcZrN4cY&F-A+^XlUEgzM=ZkUPmN9wl9eoaT0 z_LF~s<{<@ZQ2jWa5FbDF_isUCP#Fvb1x0S8e#L9S{YQzM1RUU9IJDf7j(rhiA?1*U z7_!E2=Aot*gX<-eHa9nm%Ceb`VrXS)pwZpCru<#_0=(2sT;gJ4%rwCaib+~qBD4iL`5 z@`g^VEf|tHp`r4GHr0};%{&tyU;KKYchbC%SUAvankGWYnCvUMgFpjlkX*6^ucUkw zkvrue3){BQ&(F?lYjC{W!fWu~OZyw1jlId7sM4XNrk@A%mzjzjet0Pg0R zKsXijeW@;C(MV?k%r+`<$MyE&+h+tSDTrnNg~TPB_YFoGAYN-9>H^qjC#xt7p0(rO zMQ4FBF)~I_h(weu)!R^T;1B@tf z%gV?&9WCw-YXekCAw!Tz_zWbZY!(X=3SQq?n48Tu*F`ZspSY&xVn?*>ot!UA>L`+8ons*xhFQ2+g8uAdU zM`eSw-xdo_LO7N{_KM8;pB&RcSGL_r3j?}N?dooD)um)^W3qWb>(xj|ucWm;$t1hJ zGZ>bD!*i?8NCT2#cpfv;(iNd$WnA(Z*oRV=g({_1y?&MPrZQ0XiyhzYL%_O$?+g%P zhW!!|ar3=JkMohQF%UULMRWKUsB&$mUZ*mICWmF}jX63mZ{r;Nv0d!bEpmhONk9~g zK1Hx`sVQra(3h-C*s-d1M3a4s4JsiY9es~xRdQ)u-!I{{jiDwDS?D9YH$p;_gucs- zaZ1W2c$6{Pm71a;O~!eNO(hnnh!(0dwSjj>Res=$1)i+a<^Qsf)rX^=S@g}SNo4Ad zz7gnU``Qd=dM;cyByq=@+k>&i`k^N&h?X;M>DB zNs4-j#t>NyYfvNdA$IbCUmOsI}`Nu zWIjP<_WVzuzNZBmRYA^uz5b<{0cN~CUF<^AdJ2&}QVASDjOzZ;+VSYXy zPcqNSoFWx9b$HHiN-gEqn^CE_dar$(sJw8o)H#~yGBY}87iB;>iu`r+q2iI$GyWIJv7@VL1Eh;G-(F|5!HUaT4KSw5) z`4nN0li*7E8o0pLQm3ie%GwgZl zP`+C%ViNz%beoUYjRs0oeti^wnsi9_3O&Dr@xICuF!U2-KW2ozt?Bl>HYhq{*0Z^d z^m>*fFr*>xP;S=0(WA$~0QAgN(brd`mjkvOkRUyCPepd(NZH7%|BdKVxSvQ0JVoQ> zFtL*UU{xWceY(nQEZ%>Q&qMWs(26--?Ywz6FLfutA0Usw1NvJ$*nKaasl==IhqvVq zR$JZ=SDjC-Z;i=QeKKHjO3@6`5TOvz5{MNF01ErFB{#0a7Ql>%D10#ULe1~3jnEaA zd&gbnI~;BfC|1WaceMubAkaa@awqX;+|HVg4%s{O(~!Lc>8YXYm_(4m#S_)KTIRBo#;dQ|@FFM!Iv$ojq4y~}1`1TeWk zeh0K8;3TNNsHks|g%n(yezWn(r-HVOr4&C9I0gUf8GGVqL5ZGz-9V}INnvq*ejW)G z`vW&OxuDDVjmY1+?m#gL#-46d#xC>^7{qa-@fwP4hOvY5h8;mTE7j0y8rFA%5 zRDr2rbHwNT&)t*G@5q>*gtvbaF7j=Vi-byVl)(2$+MP zy=cD<{`^86+%ZHi;}QKI=EY8NL)_~3V`zbr7MffFXj5jmrWe3~Rj{CWc{FKK%w&bP z{?zmnlC2)PM!9Ka-7tid zAWDl!cS%Vj3ew$33@P3D?&0fs&NBj*Z~i4Fvw~`=>|`~DdO@b6bpmy4Pi{BYEEfMZU6rDkO0 zcp3B|qYmY!!F}tjLX>WA1EKb=Wh7OXU9S>l3UiRh;zt}R)&pt`bOv!NAvwF4Cyk^c zUObP;x2Yv?k(lN&cwLUaO4A`N6sad|VP5TMEq?9D89VtTlXJ%6qEl=TMMxM$7)EdT z$Q=H|JpBB0ufX7CVPUCtn5hL)`7x7E#w_A4ANiFi)eLB-u%$FURz8`cis;qO`HX@| zw;n)vSYb9FVk!LW8M#DEY>8^6WYf?_1o?k^%-}i!S*F&^dq$b4kvs4l^Yc=Bc^wNY zn{#M6AZIPuo}vxgHNG@iI-oT@So!&jhE`BEA_*IrRlB%#84;IG>8bt_QZW)`?qhW# z{fHx1-9(BIhG3~orK^D8i^X8P4|NE4DqRMvjZ~mB2(+tjxP57n%(urDEDm_jc492Zie)>8{Uj~jblj~Fsa^!4mHpYr{)YM;nTVrGhz3Azb zW}ze8@9g>@uJxpjgpnPe494{B17|ul5lH(1lJO3UrPNc01|;Qo$V$9AWSVFaeg}j9 zCSJ0@-J-q~4v>(cfa$ag1lJuY4ZpOf7=ICg9L@1`OnY5}q@+81626XnDXwKGHwBNr zwmO@oqyx4 zYir9wL7En!VO6rwq)4l4z{tQX=+pW4C;~(tdy8$c!Us_I*Jcv%3}4QkKSC7+)7pG!IIlH6C<=#EJ}TCKgtxQh$@m%@(*hF7;t$ZH>E(PU3Q0rh$#^LbH1 z9CU_*SPC<38lEP7opr@}@twcrTse^nRISR&IBAs6UcXTpsQaGokhFnym|UlhrjmdC4w+@Ao60{rv};Pbhn5DxRr4Up=H8Ja2CNS_UUW2-!sns4 znQ3kDAw++R_S|P}jEE?r^y-nZW2k)Kpgkv@sPMjkU?KsRa}S@Z1?GF4<3S8X_QOQJ z04#MI%wx^x7&f~&+VH;^$#iZK=uRkh!4% z;>6shOGxpie#23iBbZNJ0(q5k#17b)Mab@gLsH40wJEV>Ly}m-DnwaI#h9l8FaA>k z@jtPoetC-6l; zw0&Og?CN=#9hp(*Gr_Iy^cpSr6tyzbqu{Db{$I1wx`2xfagA~#Byx@Y%;Ka;df#%H zY2e~l+knx+6uvgfP0eM~RXXH#mt4`Gzj3=AC$p5Y}l`!|=ntYvfE^`pJ$kKVM-Snh+) z3qQbhI1i7EkRdk2-pt0C=*M`%ev#dTalfddXZOmMN?L2~c;bR%g^J!-UO)#Be0J@^IE-nef&E)(Be>y^Ic| zp1ue#DIWe5E8vS8gF)Gu9?_fdg2x#*h9$SH6V)|3jW1V$=|?BXtm1EeOuR>luHmCr{%WM2zgDY8cLCql+WxB5Vd+4bB607W51;b-+asZalej})+M{^K z5GQYW)ik+pePqJpqot{-iySY6e4Z6|;Qo%Qj<{?TZ0t8~sJ2-yRVII(=4kDlT<7($ zEt#8!3>)z3Kb13a_diA{8CacMZf|pwK1RZRWVtjwPE(oR30z3DJ(WKX7(YzH3tT>_ z!qi{V9_7oPZS=mKiXw4^D4gta6brd54U8M}hefW?W(`0dM@C(l-`k9U4!`bkiIJ{S z%MPBW$`Xrb6k*HJ=UMdoZ4z6nX`aRq7Xd2J!3mll%0X*Iov+Tfm@=2TTbSc3fgGy? zJhxbFM)txh3(}Y?AJ4TEHW%}~cn%d#il5wRgjso?*)T~HCDI}kWziCEW~0VPiPM73 zW0?uoidTku>jcz~(Pd#m&iIBH?NSWvmH4d^aOB9+a#tqeD5=xezun?QioSKi#mv6H z^X-Xj^Tkhb)qZr!49@E&Gge1tIutnr?Rr6q9YrB2ifDUs3N5AB2&@$X40J6DI3rr^j+3^xmK)AKXB;9y3` z8%RD+03V4SD0?MvyY$I6%c~3AyiuuCPHgMZlLx#{g1@`)}N;x~>Cno;qAa%ZAV^&0_eiDAEfa%|1`spv`-y zHM1d+W);J5*_zz%wmyP*p{l+~Cuilt$=@HsApUNk%|VVz;&ta}q5~Pp9WwZoDnL1{ z5hCl#2-F`3T|bwHJAM}|MRa1u5d||AWD{%U5~v8rIZTB&qx?pgi~pqRN^!Q19iED? z|7}KB-zDP-BEJ=@Z)SOLp>9^B1SdLQ1e~&w9E$&V7A%W+$6#8}`+(c)Ky@;#3CW3< ziqNMIOo+(wb+MFlgb&CB3%S`9PT?zIhh&?N`nBZTmQNn{Svxj;P==_ns|;{j{?bkO zI5hi)D>J3Y=q)LBm_-}>(;1< zxZKNk^|O4?;5a~;E)Ya(i5DKPqXp9}k@meM!78qIC181u$xu^}^Mh4^K*I&W#}G2~ z_8PG^iS<=*8@@<1?0eM5fkEuB(g655f38Q9)PbMN2Mx$uGVb?2mf(z)CJcaZgrSHG z9FaT4?w76(=jZx;v%y)V?g3L$aQ#1jfp3uVd<9l|-})Z$n<%&l6hWPVPTOWA7aRo! zRQ=yvS0f`CDI?yX5xMk>?t45};DT!4U#h znPpCAbxWUUQbVCz;hgOAj(2|ItwMw>xy+*bo78N;gc$U3 z(dS#0=$CyWv5+=3!x>W*^Z2L!R;t)`{UafVa_BJO2-jv4j9~&QE1VcNj1i$nOJ%CX(L3uO@}P8`+T7s6@4qfW-*HCX$#&lFqt6kd zOGiT*K@GdpK|lR=pqK5%^b@bzhxIZOGN#<3r8|5wB+^KJG6=q6COh&ZT=i*l?je=3 z8KIQ2(4TmqG;Yd~pxA$ZmzP&(F_2JyAV93%|CRKo#NN-TxK}R6b`_pJihm<{D}m3L6Rwdy1M? zSL5dB!ec2|9=C-7^5VR{{$1XSpL71LwV!}-$x=7`t7?#$t9MCB?ti9hir$Z
M4mO(Pl_?mN(J9{jV!-Vw42EmqWwKbA zc6&x&w%WcLls!D#BKaK?m$$hkMtYesP0i>Aa)|PB{Qk}eqD=oAPc#j6 z_4N>`*RT0x>i*QuXwI>bt^tmbHw_Rb{-4JtCd^^LRV-8t)XeZEzenDW{IB+b(t4y@ z$+2OBvH#w>@{nY|N&cB|uSAAd+B#tG@)e*awI8Yqbq{rng5a}VbjsF#+OZV?6~bT{ zpo82^Qll$^$RU~Cv;Qk^O)cNoY92mbPt>oarLdKsr`^p~Gn|F*!C$5^LLNv^i*&3w zq3Dm&7ypbFG-TdhtpO>}?VFV!YS_d6+ZEkh)Sda&)%V+qi%Y14<BGQUf@~* zuECMdV|xYGBoXWy?;G5{*WM>`LTo zvF)|L)OBR))PhrE_$2srW5jA>_|*sU@4pw!6bQ;HJFHi>+H(#I3HBCkO4&oP+(zG1)Jkfk>E&F zZ*u2tcvq91gfjY0c)0_lRz>tYv5$<`mPfyXe>=)bRY}bE$mPd!w@N@q)vp_8KzcFE z(OYjZG7{AG)b3yho4}5^M5vV;OsCU4uXIs(l3NZfIqBK^*x0^DcYUY*TyKRF7J`a7 zJ34CrOV|EMLJH6wPZO$fn!M6VIt``^rm>|CBqvXeCX0G2tqw_2m%0DBKFr$OaE%Wx z90i53{8ipon7}6pkB81pKVH@MA_cIJJcv;RZm|v%#T3-Dr=EyCY zpD-UW5U*hvovl7`lDhK@;?S>+CJ_H*u>u;`f);@5+*zEa!l%-lQ3EL51zgYtU37tp zHuXw-Mc(uOV`t3z`0;Onr#RFeU8+{;lxaab6!(Y*Gm)b$WFz8uNSM}v98V`HX77zK zn9a&cOSRpxwo#{~GxNNGRH;~DWbb!J1?Z1vUk;EI0YdlUlg%+jCmi(aTQ^B0Zk>#< zfvk6}{@k-PAGqZP{WD@pVHpDMOG#`kw~(zO$$pUu|6UEMC*+NuR+g{aSBDLwZrr!T zt`~cssVC1iJJ0!y&5-n;K9K5P+?uEdN-sv=LQ?6sf;csVT+%Nkd*i0|XgW28cIzGt zza_ufkM&P1Q4NJ{(#mnBY@^bt&KC4PCHjWkI$yDHb#>J$8Mwz$fkO$D7jQEk_f1XP z9S}$LuPmDQ8t1pn}ph8$mqRYk2681_-N z`2Skx=J2hv4=VgxwX?VxF1q>t8>Fc4QkI7#`78e89Vphl?mSqeC~dy+yt*k3B)`Wz zSUJd=-N#W;ZM?fvQjM>Z4*x}5N)cXHe_%MF0PD<1FpWBOpiBBCaD)|iF!uh#TijwY zq7XnN^?QUNNgU-9yhpVP$T-LAPq6yS82>^7lY!Z?nA?zC)i@2FyIE`14Ww zjq@bR;Jrmo=9fxRv?a|(wAuB}oEYI>VA(x3_#d?l2&DVwTzs|y#s-M*Kge%j{bgkx zW*v;;2P|ZObE0koR88Yw~^gXYuKoEtpl*WLO{DkX&z7-JG;WedJ}dJhJ8e!s%11wMA!F+ z>(c+N$n~^;;&ru-%U4;~+YRH_bJrck{yy}qe}+_c^>mt*+z&#<`a%b?N@bTi;uox( z3t56LV)+96t}o>I_baf-P`pQX1<^hUCt3s67@q41sF6h@*lM*F(Jvh9kIo+L}zI;0g2uyc-t2tsPV-rfpS^rEeK?0+wfn}x?i8NHAuNw#`K-ZKD2|8Iu&92MHrIxlJ?U?dpWI8I^__`oG}XY*wgNZuAxr$L(fW}=eZQsngI=h%Jt+-5oTrSQ1p19e(Or*-M4 zB6ASXAS-^@AoTxui@qTRn54L$4}a+e^0<0eGGIw`3Bbh0rNARAo{tOw4;p!>a07nqA;fh;(;1-KqtfF{dF zMK9v05MQQ?6EFgOA4`~=WZ(5Fhd<`VQ9-@GgrnG*^9AbeH=S?96 zad_D0IGJ2Ju}&lr_}yiShs3*+F1hi6p*gWhJw5H*5jEv}hPXY!HW%&br=RH$qX&mh z$@|%}W!-pz9aoLRT0ilF`;tZ+!1%6WXOHq-##y6YODg9pEOu`KkU$2(vQxoL^-IU< zTctD;-&sDG$H|?;`(9(oFA&|E{<5`T6bAfC|D z-%9cuAP!O&i~HN@?|APQ%He8rJ@n`l&98jS%bP^*sx(DGUAl|WXkx$^MlfibT0+Aq zw`i5&2?Jtj;8A=ptNzNDj6gQBxMcH>m&l-O23;#+yiI>lyJWPH@LJnxw)_MRCu+zCJ!c8T(sZi(DJ{NykVbVjqR9V?Aq*96}b8g zr)M5FJ~QxA&8QBcvGbIo`1JLVvcqEQ$vjd&m4cyF*V+_u)(`t2Fxi3ZG;=0?gRf_A6AkpH;K&n@&z8X2^nI47cK>ple zNS2=b;s6kI(`jO$g=4<-6ZHiHwOZ1|PA@To7cFf{l!(_ey=D}(%{i2aa;;kTKv64! ze58vDzjO!`J-etL5P*BtwHYE1Sh0?$h|#Ku$BvIa`7gqSL!YlCbE9au_9<9HoxBC? z{P(p5pwEsqcd@AkNkCz74l;p}G4vdGlSGpIZJyP*?951D0c};9za|j*kSv8} znmz>f+~L^x2{%3a&=_#|L5ui1XyvoE3?vEh4f}AY?sDM&bH;d`0$7sN}qc^cfQAG z7%;{OR(5K+uGIjLF&^Qhb!nllcnREMiuQ5AdIZ$E6q@o#s=$MYzI~h%l^}Reoy5c| zpc!XZL*g>YDGmSgDTJoEZnPvnKLFpng1T8%f9ydVF0W3hR+n+TD+BNSMKz1Y{_FM6 zvCNIzWgciiUT@AXIf00257vRs=t&z#PvDwjv(Xle4jR5`n$?C4MJnux@&-#8@Kgnk!;5_c z;F3VuIbUO!Y>Nf`XPq$wHg5FD;-g2mlEKnI`x|hum$kifWUsKCB61R!!bms=j8DK zneM{P$ycBvP_$;RCRCtVl0$UQHgRD!JU@*$A0|AaFF(9C7?KL6 zsgzQK0A=TE(7?1k$>m87Ai=F!-^-IvE6T0+7XZ9f^ES9O<(cP!g+O*akP}s3n;_AS zs(yD!uC@-{R!|ipQi`6#{`uB=N5$`e$bby-5U(+8o#1%OfQ6&l9qh=Vs&Akm-izPH z>u*xSaKl4l+Z$y-oubJ3)Eh`Z19U3asZ%b;^_|j1eN&p1p)T=7td*al77v9cOrV5Z zUQU5MSd_EPzR!3F{K9P&?@EumoC(BVNDq0=G(7pY{^y;-dUj9~{CjdmTU`H4rP{ts zaJk-jqi3wh77tBwHlW(R(QUQ005Uc9h>>kCufE@@D=gN>ou4#~2>P9WvK$NKJIX`N z-&xPFg)nb3FtTC;3J;btFzj}$x?jeR=e_J7=kugB`!bgIlEbLT&H+ICwA%i;IG!z) z+d_SCcTF%yN%YM%`+5U=+&5Uk$9)y|3+Z3#q23p*A0Z(SsEnAMXeDQujAZdf@*`1p zh!f2%NmxC)WaAelkFLA6$hUgAbq9jy!Jdq}c z`_L`RW?o@kRCSEyrEnNMo0l1@E!WzG zQFO{M*_IygP!(BFhTj2K0on-R5<_ORgf_>=gamz|!4d*bXp3DRN?8)?NJ&GAQiTzL zW6AZYL*4YB-owwy4v&lMYHOyqRgVjDqb6*D0}EMHB8{{IoR|6F1Z+D&pJX5mxLJ)B z)W@0Et0A$-iUFM}v}}+nFyfKmUg<_FEGko&O`& zLwNb;hGz?9V*B`r6I&|ZoCZ@-DdXHS{<;fS zJKeU)xg_@s&TD_$>6ouVEsrFSWMc6L4S+ea0qQD6P6 zB>GN8#V%FsW*$wtvN?3upjVb&YkZ&b*5;Wzb~#>95j%<1h`rt!z>4g#J1XgnEP9dN z>|D|Se#O{!x)%IO`38jK3fRPtv>faER{_%)sd*nOivd}x?nCkbqpIVvuVI|76LSk9 z+7lr^Qu=1f*}P~EmNRdnOP;1wtnlUJgUQs2fVhv%>8SM{%Zr<>Um~~F8!tDjT6vos21T|u!4i-v$i0n` z*CbTu-}!IIs}sg--oq4FL+Wxi?}re7Vf$ceQ;ITVbzM8B&ij5g>^_)J*TM6zXMNHK zq_nL@x|KyUwOAciPXxURKN3uja=1Ra>P_At|GFvRudVA@xN}tl_5u2!1HrpLoF~EB z@?-wGCsopt?PcWVs32A|+ffY{!}}?7n$b6A7y|!A`jN4g|PaT;_a|kq^PL_CRfD7C7a|>G`b| zyjv>+5?xet4cHS>9{U_N>t7%G;;HnJ-Z~rMXmM9XY7*5{$k*MSo&6L2oLuXl|9DQkvnosIWgT*%O3! zG^JQo!GV%5D`Y%Mtj~Qu0blgu6!I*mY9|6C;r<`HrXYZJ?d?V&Twvt0aO^~s!(=E9 z$@$?}$vvgwC``EHqzDO4S@x`y`!(pxA zHIjBB0p;lDh1pBHooffC2Pxjw&2CD-4EXD9-DT~wMu*1bwr%grUGIyiWxI!|`qrB2}KA9`iSR7gPD&VgQO-O67-=utD+tqUkk0_6xRGv!vy2cWnA>#;rTeb4EHrn6#pcxA(ih*4KhiU{WU}((>f|_w=`-sZB7kv|Hh`U|yp}i#vSjaa2{;9FqFNIG$_lE<>eRQ18`= z&-fzr8_+A)wF3+)?1EP#>@?H;!HJ1e_|^!cA(D&PK@YVYPFvDfUI zSk{1SND?8UBoegc!P;e2re@L50cY!iWX;b0W_d*!?e3Ns_Az8SDc>GP8aGv+e>}KY zuIo31EFQMZ>>s!EUQK_4-0tXb`&YQ^UTC=IY3iWE@v?sauZqE0=l{M)j&$+r+?LwO zNZz-sfG;+A<}ostsrze zn(%OD)NNlmWB+J7{)q1}z&zCP7uNV&dVVqapQY!A6s$U|3)0MIwAN;<3a_E8cL0c- z$>;h)GsGHoqei@loSbYXfJ4&Sdf|VWSB}Hb@3=38-L7aDuz`5N*QA2_N2l54`F-B6 z&CSgX4HuIY=ETIrpnU01?E|2H{1RwS0_5ZR=j;i1YVaS3A#}&x(a>-Xkm&o-C<+P+ z_pq?yN1&MkF4?;{O5L{IM5(magh3&rzO>BM<2Q0($af~>+p#B*3VF8% zIXyuTzGG$&4)#8nc2WiMCO7;H&kU%uW>+At3AmwUUd~FjEf=SdkVJ8@Wq0a*#Ay=n z(hci~pbwBNxsfk{O%;L!8Ty=Na913SWd7oB6L{?js%LPsRrw9Zkk(Q$L0uxcEClj8 zGZsS3a5EMtjCMy;oeZ7f(buQBG)wC#SX{&rQfcrHmS`sma-QOHxVlr~!An{A&<6Wn z2>YBl%gbYyI@{UWY94vTEv;Mn#8q<*zKB=XGd=!{7 z1D$!1!qcTIKgYPeqB=ehx{F`sfR$YWCL`P^CpT9e z0!oG!n-N9~_Mk%mYJtgd!p<@g!BTs|E(Gk zNWm&+`=X839YA4_iRp40O$ekR0Kk(ov1TuWfCjr~uX^t1Q1Ft(7_2>a25BH-IEARs z2d#~dS)lY-wGq|+sm{r_4D!as`(R`+980i{__wp^&qi26M3~G zK%7nhj*dquqzS5fUER6~B-}z!{}oP&HNYH){T>CzFAnXFi1}VrM~3wQy~;$1ejba2 zs=E4t+2w8(sM*A&and8<57y;#ed5b~WIJ}0(mOjaw0=+&!?8DDUt#U|>eVa24p4Mz z=@>&{&z;YS?omDkdzt_TH)nX4FUycA7;Kc094H=><))zR4UlMf;B?L8dlEOQn6rSj zkkV~ZV6c?dZ$WD%Z*m1E2-dY2!#2)zzv}BUgU$KP}UDiH^@sR z-clR+$G0{#Lec?9)C0Em<-_{5jAeKBocEg%#4-)dR|mb&t3`A%aTM2Ro-oNbAmO@) zEtMicYqSP8;X2o4C=1Xl7o*@qtVR;Rj(kA0gTx97AtW)1KGa!M-{=8K0-g$DhG(6` zqVoe|WsqR5VqS>O&zxYuTDP}9|G~=cf#Gwrv+KpJ^U}AbElBGcxZ~9+>?K&!x9qR^*l{ezz}sTeZwlM+b8|Gw-2w*B_!KgXSafjs8Z9T@ev+b*Sp z$3Nwn+0i8Ifr>d~YvcR-hA`N>V`bjFhlO@3I^(0sIun#-LY~FhC+A-oi661cs?@wi zhF9nyuZj1DQ^+MHHIEo40Nk(-cA=d2J)J9NBIs3~5dU zLmlm#NO5(c&3ra7aO+akE)Kly)-lQyc=do%1~)0wZ)rm1m7^Fn!5orxDU$%W3?Tyg zy_Va{77a*V?d{MmShS=d@!`PZg*gov>ig}rq0e`}MJ?RE0%mpDk&Yg-F6eZ?N~Irn zF<$nODIC4&x6NA|HTV^N>N517$xhRLARLDJUnYKVhP+44(jBv*y&F(t*QOmX2poFm z2eL?)TCTKqfted~d}~Uh+quvVCNA;oj&Wo@Cb>RkMaABM0U%#d{At3|dN!F{NSZ)N z&pB)ZTyE%OqR#-toIX*nDr1|!gZD^Sm!t<++sIbo-VKx<`2C1zZDT)kV23S=u zoTZc=#{*-1>J3#0!KY=Zh4DD&yUZz3^3}2FOOw7aJ)Z+4`>q14x5~=0vB^XDc=bZf1y?>bqFA{)O+Lxr>DJu zVjn&T?uH|60T7PT!ZBM#_1fK^RW{Ziw2ek|)nC?l&dk?iiF!KCcB<{ha6gFt#$~ax z5`YaFNx?B@$dG^}AteeW} zc5)Ex*8#T=E_~{F5X-g*%#h)`b4i?WG@sG>x_xInLVPwOZk6ehdA9Y$TehfKHd6^0 zwS!h9kQtSgm9@Ot&-QZG6=-Qrv8WRjFD^gefoE66^*4T{H~-{TE4*J1EFgNvHa~WD z(#)85ll48wu)d2L)>Lp(527Ys;!;f3`mTNd_3PTx(;IJlq2Bwn6l|;uJhdGzPfDhy zQmZPByjNAWsgN!EQjSM8R0}h3nkDcx zAtxgcs?_jh?#IvfQc$q8v;>*qbd8-}l5C|MVNi7IZ-*Cdq@7()>28|SsJ;sDCU@K@o z9*c|OFI%Q6Edr$JW0q=`*B8fNG1WvkD zRpN!V=o-RcCa#d2|IvzSfU>h{dkc^NUri!?^11+|KtQwbVubKE5fV^I3-={65u51a z2WUUyy~`X2Gv5Lxs?~6?`)n3?AnB`BN*eqgGuSLv<}rolU0gJ}n-7%(M?Uu#J}$Q! zbeBr~6jk-F*GX2({m++w#g4S3Rr!o;f7!C~tK4DYQ1)iKUL^0uYpy@|(eYVS+NwtH zs4X~LhXO^E>g6wQw0-Nu?$kf=Sx&53$d}83kvDwO_=6$pLNg|;;^;f53?6UQUt%(J zkfBfZFmicOT}+Oz1=6Fq1_T`y_mFD0%3h`AynN1gZRe&V&9Ei2>hP56 zkB{T{$!%KwACIca%=CCl#XeqAY#M^VT{hAvDC+nufxjVfLO~x8f~LWRpijzS53$2m z?o`|VRb>v0N^HR<+i=shqQWB3vdhBK)6)|}De}^5~+EMh!mof7($8fV--2#{2Q{To`Nw2WR<4`295wnk0o8IANfG2X>I$ zJ%NgN*aq(psWMk;4C)M2HB(YOm^pS$j2z`(yx>AP)%3jvzINuflboP`I=6?P;ha(l z?RPJU`Owsful&(hU+Mc=nFQD5>G>>Wl-F3FZkiJ!a4Tsjd`YBWN}T*wRQ~J1O!%S` zG^F-+(qO2Yn0B1|vBR*D)+A?L(_zhGrj-}!j<%a1wLZ#40MixRqO{`YFmaLdN-gnFQJF)t zf(xsIF>-0R<4x5zT@VRY^_-s`y&{^zs!hUZ7(#D&&?zRsE-2G3Sx$*nB(9C!3>RP> zp;k!0$!*tT=qCgED}ql%w@mG&^|Un&RFe< zj6=>qEwdg4iyV#o+{=Z2>XBJd(VCJc>f(P|tZmQKRy@^t^o zu8QopkbL|96Bj%KWS4}M|MiMSlNhN&VeglGE1+rjsEAg6?sb{XsvDjHAW2@*gaCXV z5;U%w`R!v`l5#{Ik}$3@v~d;wA9&9eJ>|oA(Y6-9p?1%G3siQnU``l`u{N^fkNsbwmiJiq5_w90-&Cp^oa022%%8}$ZlC%9LnDTwY)cP>_@47<=pII zgZz1)Jo&}!pZjz63u8FMzt9^sh_@8G5nsRcJ-6@rwc7ZNU0VrPIA}74^^MO9#vf!C z`k5xJ_Q$h($xJR$|NIm`?(Q{e0~BAAfSwTXjXgCI@b<1fQ0orIU+T}QsnKDdq9-_8 zSIJzDHQj%uD^-lxRF3RRhTm!xHzVY6Pj-Uw5e6l-#6_CqA_2+<=44wfBR1GtisRYv zvKQx@w5oR1rwotif~6M9{)=F6bFCM3@_i9YaIfH))pL8MU(?d(9JNBv*Z-Yx+tTh>}z@g>b5xNeg!Ix1v;NQ0ieYM_7Z+^%)OoG z<5cTg%eXs1qTknIFj6KX6DXJN!6nOqy!@iO*RNbhx+QV(=!L7}wxYA{O?INw$H@vP zC}8r(Q}ZWlM{^((uDx(a{}HTwf{Jg7ErOnQ#8IBJzDUZBCD#- ylD;XDr&I7QjIOZzO#X%xNZhc04%FD)is8Hw;ECTQe}Dk~O>g4cWX>a`}~8{l6>GoDJ|iPvtbQsS@5 z$4QQW2k=%O6+XUtRTYc!Xz~_#jN~k>93 zzF&v=ur2ub*zd~(_>R(X#hkZb#392YvhI4mmD!CU65hI|flt1y>}#%b z6;DGWb&y1ouHoyB^;t{=t?2YJ2ilWvSlCu6oPfPl8ctUok(Y{Psfj2iLc_osEFF%2 z{d?khAmH)seM2O2W^ksgPSF$ne}12>xJ5rTeh9pzyfq)n>GSaL zNR_v|-0X@98S*}>Tfk%0=lA{NyvXac-fBISQ(RnZ(DKP)wb7;X%WI)er^fG#)VF6- zgU(hw6Q}*zt;Y?pm9+5K427N6h3T2oZToTYj(&HAY=vuTs<7%*7j zadE8BN;cj=~4MhuVM26juh@SVuF=L}lUS0%x!4=f%d_owAA&mr6 zUe6nKkVlcXOY=`2AKP}@pRWh$Q=1w9PjZx^;Ip<~^%G|bdi;I7nV^sr5GBJEbBvRWAuFey~zjT znNkE@_>!^;H3jPn6de%8=f z3g-*bJ6Y*q^uu_p^Hmm}rCf`KZRl6#)Ya9+?9f9^S3c1uM1U#5JPZR;a>DBnQ^Lme z8#SbGa^K633KnW=4rUqG4tohL%H&jK`9A5x zW*ZwpB*o^kBii%ilKd51703*BC{}Wt?U`3pWbZ>!Wo2C7pOy|-3&{{%q9u*349ye5fk?wKb+*EWo?#pY zjm}#Y&&L(6_hh@2Z-YLThgvS@C%N+nH+?b|uoTYM)@61Sa+#r&_&TOZIb}UtCyaKY zYA%k+7FLFDjx@4)92Ziy39 zjMb>=YCDn*DnIXnEpE=K(}iyOq2t+4^f*&K|NdMEGj`?5i{!aTt)N=bRvnAg==h|f zLy;PrT`!p%zx$g!C%7rq3NF?n9w-QZf1mk0TwCnBO#b|6HJ-shPj8GvA-6}l1*eoH zI`)ag&TP8Eux(g2L(l`-9EL$|SPwc7&4Hll$IqQUaaQelkrqqO66*!(x@$%#l6tMzqB%LJqKEz2eW` zjUv9;-2jO6e8ZlFJ|6Gtr5IOy3`;(RGx1#i-FC>U{1Ru6A80>0u*kZaQW`wmm;GA zx(?}#1R~-SiNMXZNOe86yCthE9m~>>;ofrkD9|kTADp&Zj%wk$QnN=n!*~s5+v-7o zY;THs_#nBM92AxgE#^9@4eutb-K)Pd@~}`rDNTp!aiSSq+6@zlOb?EHsnt(%@;;&< z2RaPJh}3yqNA`Np^2|!T=~`_=Xp){X-UM0#e@SI(I4y*qqMHG$Is`{)MX`8FRw^Tk zp*p)ZoFG+OAATlh9amEr2lI_7JI=j^3( zPZ#TGA&(&__}=&DEMm82SH&eI_$<2M{r+fTa{oVDp=iWF6V%t&Z*|$}FD_<0qm4QrzFp6=>9d=Ofyz1a=?$NY zwxgMXk&2N$qmIX+@c6TpPanj;vl`?pq-*Nw!KS3hEjS7LAxxJeYc?D0er>6ZM#5E) zG%hQ219BeQ+0j%kl|{VG=txT`_cCh1@%OQ_yFlBH%m#1!Hn7a9DsF>>Hdr#wqO z12%F^nRGtqIqljLQ3dRXKT?*V;aWnxHhsSlLW^7O3dQQ{mKMM)f=HOhy)w9NX?t-L zZbuuO**-u2qEB6`)ci9D0Yer}x89ym*7k79o%81RN`UW9G@t07O*qS&OwVfY$_^q{e&&F3Bu1j-cgNtT=n0_2N{$m};M)>EV^wS0L2kK@_9lLZ~5w8qaj zw9(J|d>z?$U%$S&W{>-x89+J6GMxlhf;f&f6OrWX`EZdmv4Fa&1uOYUyl;xeVt{VsdtM?*`d)keKHEmdb^%>VF$Sv_ zg`;k_k5aS^O-Q9oGuHQu^~)I?rOl9+KLL*$!O~SN4m0IvrAssI>+KI&&kuBF{r)Zp zC0ReDWg|yXQfsNe{dz3qN~Ef#amDZo_k@`jPc0c+*3Az6nO?KXXnf2#ReQ9`^QJdF z{Slei1(2{v(pX9HVmt|Ui2Y9!vy;*GWKw*Dw+;CSpV>`!V18v{ij@UQziR3&Dj5ne zZj+h7O;};Ck=Lkte5+oP2jDm>S? z^>GQ)-@B86s{6VH!G1TqU^EF(zwJF{K z|2-N{@j2KbTl<`fGLaH%XOl7YwLAR>&Nv%9*8i^+`|qRvK7Y9r{_4i0ITFF{IrF9* zZEH`rk6h)4QX{W>7E`d)Uw`3Nw%;y%=L?~$9SP4q)}Pc$lW%oFAdr^;WgKdgsQ)YA zsdMdYW%}OppRKLJo);g>CpWu-bh5j|`PIVKij7xV*GPI4}Bbg!}R$SK2G97A4a44;XERtxT>pnuYvy zHfCgH9bfZ_W8!w(AFZ*PfJQa??xhtGk#6`njdv5ieVdeazfEv)hYZaZ3bkyBy*WB> zP*9h^@L|h*_+7?*E@$QbP)^w6S3UWp3O#Rk=~uA4JPH8AM6Vj{r8VY&P2IW?MDWolu4+63RNbXXWpv5kXXT-}q9Sd|N@Q=SvmNeIv4qAE(oy}2+dYJ<$#bmHDeKCx38a;U#dfc4FD>fNB35S>(kLq! z$3)%A$L#)8c~D>B>9A5?cKJ!PK}Dl#)ym*BB}XvXVaY}4ym#k!I9AUU>hvro3Nwb@;M z3pf;IdurebVzOUoYX?@I8G2gGMuHyuB%_Bwp;>G3>~P&1{zfBLnZDlUQ)8@+^pKWT z+`OD0fkRhr&{AJp%e~Nl6DDON;o0+YdcJikjCNIoyOsTy0zGY zc6>t(asgpO;%2xKt%~-EHTY356))l!=MWb0gJD^^gmwJhEaHF96ML3orXLmN@bS*> zo{J2Eki&vNAdM_k(ni-iXyo_uyfvrk#)>i~dIqh#U`xrhg@MC!6pPaom^h(Km8qq; zM(f1=D#jK6oGWrNTcV93q893XPaCyWs5vCoV1MSd=aKfYq-SLuW5>+7T4kk3+YHW5>0NoGIYPnE>i3U@MgkcU9m< zyt+CR=z|t=^nG!WlMg#EY$XP%?qix^eC- zPmT@}72L%rdgs;6>#j5i`j%C0+e~VYyjfi>4hG#nQ8$~=s1ZU_JjVy?6W;UB@ywQ} z^i{78JW#33IR|*J*xMt!Uh}MK1s<%&%9W`vC*dgNDWe}(!`|a{zYALZHVNM#O)D{G z%?|*ZSW~#{pM%J0KW82K%%~(blwYGSpQpEO5B2wZLl?*MR2irxJ_*^Z02}9A^seh= z_|e=R@gVv8_kld>)&+Ym>~ISUi)#waCh?9xeQYV5mJ|s?rz;H=b_?YTAYgQ;iJ*>wH6!i(G-rTUlL*H?%4alj(6N> z&+PK%a_R8m_re2Cxqnslz;(lL7JMCyJL6_n;uTjh{7$a{PjfXV?5@2r(wP>kuu)2z4 zcwv7rpIB4kM_aw8@S)_xmUuiDrC|s|JVMqME$hw zVTE1(=eVcYXDBbz`uYjoL}@xy|~c0F)C&DwM3dNT{J*5CCfkFyq)CO%3v> zX2&&Xc8{p9Tmvqo3B0nP$8qo7&4gHiR`rXRs6MeOiJpg1)3sUNvhr@sLhowk8;++K zU6zDszAGj${ONvD>a?sVjTosgBLHjj5SisEr#`O@*S^Rj33eC27cI5Q+KA3Z;>-gLomC2IE| z_FVB&kq|Z!OM2IL;SW186lw9fV7p4ldZfnT{f2uriqe3=+MCCjfg%tP&g`SqfcouT zzfjmu2H6-TW8~rTYL$wDlcAKB#jvr-svH}wceTKFE(MlMNG|HTir<}2#G`KDwt7EZ zEUV17eQu=M+5y3dN!ucIzCbC`rr&yE{}MzXlvYd1WgC*Az3L~dr>4$gk{UxK!+=Ij zhbPYeWbFtsG+Sq~mY z+=CG!em&FE-!C~A1!2DE>*|wAuJkjLXmC8U?Qs?3*RQc01Lihh^lLZmg97qEg<@gw z{wtRTJ(VQ0Q1yYNT7k?7QE*{6)U%&;O>NV@IY)8rlL#}|Pt#e%ok>3xJKDC@YU0PJ zXbV_y763IA5}}hL%gf9DPk$ZOTT}On%56Hm0O5E+P<5QvEUli&@3P(E)TW}Y8b#6d zd3$iGreJ~{mgWEV2pD}9DvV;`zhI#gup0xL6a|l2yV`tcwaJa}J8X}D!g4$#0+TZ; z{sa))DVacRhzEKivPib6qx8gUcBFTP`l^9%8g;)ZXe4X7A5FhCFhSo4czJ4A_b&PQ z^Cz(30s1*IGE!1pEIyZ_efs*&G}`<2Fz}no{d}2TDbbs)up2<{($LTVWlIm3>E3ZU zt~LT-S-;Ua8@Mt;p67{K8M?{wmR%WIm#=eVlf;7FR>KlyAA>CH(Ya@{7Bh^0}LDOLV!vp^RB69_1e zhlQ3h#Z!GAjMsgywYlXeD>q3~{;hz z?~GffWY~!9sHFVley-)wy3uyO)idC?J*9`m8tw2(C?^cw=LB{OFX}6-Bkav2es^)u z6&!$1pn5|V^h7PSs8*m@HL{%|gvF90 zh}DBMw6xsPUN(a;mTPTpS~i~0&n7^tA<3GFW0nHr)p~nilz7$h^8t5p=jWb&<_nfn zZK4A$#$jDi-$(vGSEY!cfnY=LqhEkoFj-hy3WmM>84%ltUWm&vU2pB!^v60tfPV3G zm>VlAE8FPzVS$_<%{pjbUmeeX?Ag#vmVRh5)GzY93pkPazxsI`qttJ8!~lc z^FKJR$ZsXzMESZ!<@Hc4QA=>W|Esy1tFd{dtK#6`K#zO8Se1)u+V%ANUUw#b@_yCXIU7DAM8*JQbV-4hiDdStNwswjJ5~?VpdN13XT$B(g zfZ}eoQlCRlup&W;i)>Qc6bc-L>cy$)F6Kp&rD~j&<$H~!b?SCJTO^mv-1S53`Ogl} zrHp_zS6~0>bg>FBLz+IF>0Ye20fLjp4k&+5)@7Qwi16cCVlQIP125VwpU$EPxe)oA zzP3zGLlG5<)EUWQdoHxE%!QLGN8MMELvec)=jIS*&RY(}y-O9%!TOQJl8b&c<@vLXcD7q!uP(-?Wf$ny~- znGDMGgkRxwX9wIzM1K0wT!vf) zbMF#b3*!~YsU14v@Y3(Zu9H!*fa=wKvdJy81pi|E8)d}r`&^&%v*u)%2g;kts_V1q zno7w_)=VND5l5A#nsbl>a$7j{CYm1%1E197$dac;k|oLc*X(xx zTfU}Le5SpKpX?^r?mzWs9v8aQP{b7Ba`QLX-O;kBts1-NIfgf4hTN${6$~ljYA(zM zkM(OeGg=oRxs8dKX-Fv8IeG}7`AMx^jT(}%km>~kx}pZry9jSIKR35-*Rj9L^Q@2)4{; z-`xJGLL$e9XkxC{1&hlfubn3~@beQ1q#=qnr4G&~xif6s(eEuArTeA>kvXnPG%LuF zWhQ|3;xK$GPjAi!CrPgGqK)ycJ|!tY``l$sYBJ$lIPdSJ3>uwurrfzKb`v-e4cB&%O<2|d;QqCF--*B3|2|~iI4x^q!!SpukOuZWS#J}P z$_KcfPVyWe+S1a}0C+|!=HChw<}LPgo-05*wq6f2EwYq3tu|hbuyrsqGByJv(|D#3 z;07S|AdvfhSp-}>msdicuXkHN-x!CYA2hn`#LX8dk)LMmAEK5?BpStBPkB!XmP-2@ zi`dPV0)th#Q3sh?VBoa>91oYps)_RtzSseFTq6hP4Y#0y}>8nA^ z3Yzy*#Z$VT?)Mlrka8Z(PsmPI)8{3I1!HN%$Pm$o-Gpq3Fjm7>f*lf0^Fe$g-;d1V zYfbIHm+iFW!q7?i-7|$eV;X~})v)yb$zBhSJ>W{TSx-^Uge#@#}*EK0iJ3E`*bAVR{-_XC^VU0n5q{%+OBA z;j3ynFhQ|Y?v}ft%puC#B)w{wgt`#HQ0^d0g5grSyYH?6Ym`xdAL- zmNZ?b*=s0VDfDTD{5gr%|2c94^{oghaY=v-m#*a?NIJf6J?)s;n?w@ z)aj;46?JAXeX6T4ryq=+Y{+5xsijQrYI#f}F<|2Eirs6yOj;!oFzS*6N&+ejFWO;_ zX4*wg*276pG`hMfj7jg&ktj%nlBDzGnFwdq0vizrM*9n~IJp7~@g`^Ppt(XtDMWR* zg|lmtJnMNWm^?yAZqjnIp=04mXoN>`+uANF8pN7+iMIV)95{qtIY?NOHHxarrTrl} zdM;{_0;$Dc%&5WOx?I`Or~-E;LKOw39~@{bc>*4~L?6>gXHIK#nmWcD57&uTcb1%2 zpN{Urlgg27^!=E;y@W3`gOPyw4wxhPX6M3)(iJlWlb9M&SjyK*FaN=@Zijb_@cQZ-0taH^Xc;_v?bok_@@rFvvNhG-eexZ9>$5yxO-mtt7CK5MY6Zh* zLVvo>4S~bYXq}`+ZZoPN6bo3RQ~SOS4X0^gd&^}y+FGW-Fy++W?gX9L6Sr?l*6}O< zYh0Al_}5fAdlJ5Lk*<Y44Hw8SCWe-k$n4M8Im+B37Ld2(@dI&;NDJ~wydhj9u zJ`?vBYa2+Y$$PbZ3fF5BPrmM+uWwNX7Zw&q!Xkj}-0uK^KziXofM1CQxy}%93q9lm zYTM)EqdaYm(}w7uy@f2}KbJii0!Hx>lDQ3zYt7zwj2w-lJZ;JpdGAW^2!sFDTz={YVZL zR8!H6*j1*_p|1k`p)^)zX6h&|Jja?Pdw!C3mz{UQ+TX{lGV`ERDEkY36qiJq=&bq!v}4hf`&S&7)r}W?EyE8ms?Uc4qQy7mWEawik+Lk zh}y77tQ+}8Ch+s;&xbfc#bsr`pn6MiLet zr4Hl=TIYw00{P2zqv8}b01j5Y1LW4nP zOP6Y~maN%3?6A>JS_LM%1~M<&?Y>R=2IYs8xJ^(*iUb)UoB<_iIxZ=6a{X#^EK^`) z8hO(bAxeSgm&xZumO+0D1u;#M(O?_2I%ADLUndcdXqDz9&5e8?%@V>$1;(PKCO1zN z6)e(xty+i^*4K42WA;~q@?tKF?nw7hv>&O%KL!&jMm_dM;1quMUCF1;8NPj;kSpjd zgZU+^c@ecO1Pv}Xk;(nx5!cj)i0qg$7&SNdw&`m}Zi`WEE#)-;X8~V^xVXmcKrx4~ zg-zB(qQrTz0?-K0Pp~BmnL3;$@B%BjZSi`x-^y#azuEC@9gm!k+82ooYU~uYRUE`z zmZ+gyx>|xgyb&iU6H=aM^LCw`u{QB=6B7Y{xqgF1yl;`;^+ZLMVNu}1oloT==!q8B ztaZ0WxSqNp7SrEOW=puBx!VJb^Ol4qEESq76)Snfu@(r2K*sNE3?zw21>Jv^m={V1 z00Vd^N~gc&Xv*slj^BWD1Q2EQmouk;$PD11>cC*>$@OLrrj-uQ4ZnL}95&x&77_bX z11cJzi!`sQgodQDm5Ph4rH-yRHU}*pfAc4ggrTC|NGV>qE;!%XvB6`EGYJ3Ic*wR0 zk-`U&>r7|J#*Eo2viyf^%!`FCHP){{Ae85O6v{4+@ms}k5|}P^jPKY{45iq^kW!wz zFvYhjGe09t87>-CZ|YP$%J^MhCRDC2p49zB`;p!<`BZz>9Xhdxh=63wE}<)}E~vdZJMp~H%$8_n5%yunv=tIN>mFD@^OC;a!ew6PWr`9usc zQzh>=6KF1X;}i?@o{L6+Xvcl%{k^FNpJrmA2m4Pv&E1}`SlCx9$np!oxl&B^=IasgjZz5Zw2xX zUfHj$sia>4%m%NIWA(wDm!6V}{NeQ|Qq3@lcs!R3gB#*cH>Lv}Q6_-w$1y~t%7^N4 zsuF#}iGXiF492#G_Ny0Uulwc49IIaAz^84Nbp&$$6g!kOFd!v$y!59QBS7Vpi^8hg z;!Pj3%t1ybSiM@)q^4lF50YozZF{vKZEY)vt6HriSCyeX7zHsS(j6BJ#$7``aVgh+ zqp@o*>pa5DmBcy0-YB_-@P5ph9@E~rqp!d48hj==h3Sk3d%`fBP@6CoXt(RjgH!3}-+GuRc5ks;h8`yj z5NN-rr^f`wjxO4)uASxCSuhqC5~(6B3FQYilY9ySdQ*t4on8D8wHik{mIcjSiKb&B zYVEeiaYW$rKUb2;c1Bg?!%b~mLCNZK2yutPp>*}LK%9Ks@WHe#b@c>;xq&2&dH(F z&C3S3Dj+iZ&MGjOG)p^;2UiE#cGDDTi0n!-)bY0Cdk`8N^|i>Izf)(*n?Qi-Xy&!j z;50EZA|dVJ!9%(Zc#0DN&o^REM@sIegYi_gJV4YC=!x$ph<4QL9oL3++hOM|K>G|P z-v&aBZT)?K3$+*i1Ho7r;M1A>7JmUhwK9hRXW(Nhw~Z<=2#7x2szGJt5(!71j)*D>yRxU-VRudBm?sTI?89DC2G$Akk0R_4__h_RR_p70`-!k z62S5knL_wg02;E$?UHq=D;wQ-I#UX`R_ZVZVbV8XC}9GGjJ^{9@dWs^UzP#ckzZPR zI{izI00bSrBpd-wkV;s4HK9p83I*Bmjc17z0lwZwz5?+BuLF1bXQz!Kl;;WV+L42aN(yrj*U|1!Zdki+Yxp^&Cq5A; z;2_h}(C3Uta`3V+k}aDHAQO`OM4j%FFM!fj$l%AS0;)Ly!0D{A{Q8+U*6*eKKEV|ch*FnZ}BfBw>A%HnK(jifuDXpu7yWM_s7 zp-)CHVlO-7FIxxvjz=(yHM$VMWejx$!YopfBY+uTjB+d6?n-LVjh`UkvJD>tCt_m) zv2{Vi5+N{^3Ntk^(W)>kD=aiN_OiB&8*Y+p$Inp3rNZLCE;f;J_^tkF6v~twPQZW- zIgcNbAH=Ouy~Wl`^5DSuAn{?JhSZ4RMS{OY;GV3+*>jdPZc|$T>D#sgr7LbkvU{qN z%=b9lB}cj8n^&3{dyWDVVyxC$`2}wp;WWwXtUME_{Meqmq5SwZDi9v|qfo41+^?@b zbKi;5)Wg@M{RcGLAu)eh&SmUFSGnbWSPoLYciM`#AG4PE{*dgBBop75er+!?E`Pq? zgit(wyz!E;`f&91*O9hL`Q*P^{u%&%f4sDX@t7#lhe@Y;z7%?AUCoBY(nSJjE+dye zgGZFRdtHvpRU80oPyo(_zXBlr?B!%|$Ut ztxm=u7en{AXF?7U@5T9K2keI32(tfSZ=$eME_xvDD(14?3&8M_k`j&|fE*u6pu+&X z2_UTmY|Jh%_L}>R0P?E;cOpP7IsoT(ak&Bt0Wjw-`t2c~17LK!l%{nc`RAYmasJ>t zrFIY&#bm+|HLCsDF7E_DWzocnK_EOlAcxzb-|EHjSzcN+k1Fz9^8XT5D+q}_e`l$7 zRZeMX6#F$0v#h=|#YkpqM`;H=ShE07wy<^esR;W)RAmuBvowmFKwxDAwDI;ovij(y z*&7kAeOqGmWD9^(63b0MOH+Mh`2R#Up!vh&!X_=M-7|NWk<0%U@u&jGSwnH=hE<0Baqeoysry(BT{f1dSWE{5Ul zR^dQY*eN&(BJvVme`})oe<&Agr5-T5O;P{3jl{=NF(d-cn_nDOfH$4aX@QJDO#skR z4&VzYY9?ktD7d=(|Gp-KGXD7Z7`W(Sr)~I_zfYF{sNb6*`ts=J2+U5IcmDG;)ulkK z94^55N1Kl?%>tU8UoOiArR)NMbNC7~leK|d>bqXC=Y<9P_H)w#%ddbSwhtOkeSOmq z_F5CHJ%V(%wZqV#+mHi$oebnTFQ@(j{1}5ABa+S%vTar^<#pZ<97v{=3mWpQ z-gg9+_3@Q?sdRfa-6bgym|sk>(7BBJENvXe{oQUcEOy`vof+iFooMfwm7B?rn$;paYq9W;I|G2%cm~IIO ziehFh`|*FQ$<%BiI#JXFV)ZySN=<& zpUyBcF}c0<%>D(U!A5%M7Nk!$iInHXwq`dQ4J3sg+m70zGV1ms^3A2|I&_1xbIWz@ z1b=@q;ij7)a2=AIZ6K7;N>igf#s<~U#KKN=)9ezOW~VvJQf4w*@!atCbaYvDY=`&M zxinAN{C7qN5+DE$ZfKENT(>5eKfwrAktxM{oTE6FLZH-H&IK;$N@$5OtbCN78qL%aH!LG; zab$Fv3K%bkz-}DB&(@QR5O1j)1zgg8qY@|SP?#R?vM%3BddPnD4Is~-%ZRd-1N6PdP@JjAM{7QenEBVy|l%7%% zY`?qiwS!iQ80mdd)&MMIKVbIKzcR3H%4MRbKU`^GatV z7_f751_YPd%OfnLn2LiJohgDLe%vR@6IUlEqzj!fv(TJUdeHU=Ddcm!d{%_q?={qb zcIyotHIfqS0HP}2_0K|LjG?Tn0aUc?U*;A@e_2t@iNAN~FFGtZDG%Uxd5BOwh@R*W zEsM<5$QjVGqN`}Xn@Vv?4p3___IVC(g5jSrIABsL;p3n5wq`Cca^c41DXC=2S&~!i2 z1cG;y_;42_OPK>{j;PW@vj5)K2tu@KvDYd8Q529L4CgiZ5 zzP`S>xjFmG#f81Xd!Pk>t$7g8f}j-Ywqd(L1YGXT-i^d0(7Of@(M}fX|EoC-)1_z|g|BmQ7 zVaQ!@??WD1$(i1Y`mLJ20vouw`5T1q7Hego5tYoT<#r%o#uy z0KhE(m!u&CBy&*LCb3g%*A}wPMaRoC(Cfp)PTwt=P@*LW0X{v@<^i7?o-X&#-;;`e zPBpL7#1E0d-~vGUIZEoe50rvC~fHf=A(^Uq^K^N?nwd4KcmT- zWsnxE6Jy0! zl#hn@e!^0Kq@XuBvLC7z&lB;n-e?yI1#|x!p2D%Heqycy16q&&>G50%kl*Mmti=2j z0Z+&ry!Jj_(3|IBSDE!qP|M< zlXe!3Z(%5z&VHr!se zKL?uT?IgGFzs+2c=$ZuM_^coJb;yJ|UK+j`mr~3*77PbOqA?K}R6NrW;(M?O%}2(v zV-Jv(DnM%(mrvGi=li0YA|dau3i}sr_lE~|Bu?rn6?vWodIxZ%fFJ7(n=&xSmCymr zeR)-By{4Hc`-`7ws1m@y?>HDXVxNHT=nL3)xqW8&r@nWkp5DwTw z2@k;CL+gz$60ZGZM5-|u88CrNQ}6P|3jYL^BI>=lR&hK<*x7=r ze7w33o?!oB!SwBqKT~m0k;_ZmGH!WUnUj5?oqgfZe_4;)c|9jn3JVL6+X3@pwTs5q znI4dd52v5XEf{xLuQdS@za2hTb6GF@7}42>K#HLwL)c~G%50}2BmWrbUeDXIR-o>& zyoA)vsF6lZj*Q82nM0(!AG^3k{aVB0mLfaFWzMfFQ%@_BmrjRKV9g1E==ww^fR-_o zYGdl|EWH^};{W`c#5fHj{LVxoqGKYWixFr$fl%?!pT_-BI$`K!CAP@P3$p=}ZLl~c zN!;&=dw}iPWY+TC(BETex=-9Z6rHr$>f)J6t0I8YH183o?D4u(o@K*@&IpYGcuNcR z?ou4s)LIuEej1sI@lvq_NZ$`usO9urhg%oi&+#N|6&(X(!+LHUA;A5Uf`AR&)dmA@ z-qqCBSASaD5OK1BsPwI6>mdtb{rVuI8oF$ggu|%8GXS;W+cSl!Q|IDucO6etSn1K{&|5evzfSmZmrp&u*5tiRb8J`_ z@J>a1e(z4IYH5nEYS);!5&AS=e2`-rHpf{Hq{CGklLjM|xbV;r*_-sMDd?)oA+J>) z-^mY3H?uh@gGSU$S$?4D>C8n*d3fr9rkJ^?a_X(2G`LdW*~T0iH64|O!frSTL@HNR z>2fq80DBrB-Jw%SAV-jXgG zH^=Rb{MLCrNcT@ZE)-F<;o41}O@IC~zh(huG8%L({eJLsemO%N;6?_RK#+*5vZ9F` zbR(Lj8z(U-C`3s_V6sKtrP51T_`?{H-V}^IMYa@guz2Dy1M>>qz#$Zp3VL&&2S*8s z*~&!c**yp5kn}3_ZE+#dMYI&}Cel2s#;IpE+upif{;6=M7$#NGUcNj^u>mC)Vu@d= zuBg;NkIQ~iXrA-qVdjjxZlp-zP!&|`i0j`$XKQtSw}(?j?(>S4?lU|T zT52_>x5H{FW8=PN-N!Rbtd$@fr9N4h9JlEHaC=H40s`_!$ zFfGzjs_!0CDeICa6EVq^^xL=X$9l*5V8d!BY)tq;=PmDH@{9U7_UhGcms~2utIevE>dV56)w}S)N`NE9vv(hL>AU4b;$_2#KiFY zRo!fNJfvPsE{bEW^6Y-@5{9#3jB1}zM0j17hS?|-Me7JK6ik~oEV)xYO0d$Wo)(=I zKU~a9I>=2||H*{w7wxL!;QxB3v%sBJ0Lsh~@ciAKTH|IpR$f>%{$CZtbu0!_`sh-) zkOp_PNFqsnJ5_nEA)O7==h@)=ezbd(dPU}+#Imxn->|FLW$xE;j}BQe3IZN-Bn|j> zIKEq_mIfaCTbA*q>Gn?d#L$IFuIWmSa%%J->Pf2UMhb>1GU>3SaOdO!Cc&X22yco* zV?}v&BZd9AEXB-DarLKM)2<(FxiyF9*Fe*^cngamGO2W-3=-6Uxc=%YIaYkD& z0YpiJq!VMHVPGeOM6eoV0Zt--aEyh6=lb)1I;?aV^QVJ~i$5y;Qk9jb83$8B@2j#h z$1M>J6%s=3Daf$Ne6=jq4P^a|>?aZWz+$06Ag4*h|b-4sV~Eot<>&OjU1n zVg+vH=^{jZH)C@zcc1TAsM1%pYE6vFfSG_)(B3>8(^B!r&eqz#u!u(?-Ern1^xZuO zf5|?%UFADE;B%w~vSvMea9y2UU9g)*pfNwZ9*RZe!n|8Y9!%2tLarQd$f12K4rYG( zj*Ik(kYC9BTVR)7#lV{l=s7-1nKdA|#vTZ{EGwG<|GPYf4jX{!&wwMX(hhK)PAPH;0D9;eDhFn!pXkk8@uILtY zh~VYQgXC=WP5Lq%bHV% z6IT}Dukj%Sop%nqFBhuFdHRm3km$N#WQ&NN`yJd;{!_(s)c#HTrABlCyjz$-2jHMw zdy1V&BMEMxx&`3kSdc;6P{7`31i)3?fixe8oVPks4e*{5!US2_j~B&&KGFeV<6L-N zIR=b7KnGaT3Tw^TSxJ!zP!5Gd|;?k^al(YcEK zQVQ=#$(9LwESDXRp-iBkdBypfC6eJEr8Wsix`D zgJiWwp4ld!^}@#mg$%bR(Qwr(s|=g&jTI+#8)4j0&CbtZzo}vUSC6dlI@U*Ah2M#q z``z|<+}jtPM8cn1By14!uH%GPO4w+;fzduB6ilrP$UU(bViMz znw^_-W}+dtB$F&Nm9H_0~ z!slEqSPy2>fow4S%sB438nbmz-*g@|Gu8CA(fdfLP50+os0fGa#R9kJ!}&Q#GEL81 z?MM3Y-XzOf%n(-T`iWEhlK3TFYZykZ&ZK!k za$j!KMVxxXwwLz0Ov?fPLm0#^i<&{wy1ia2l!m|1ol|r_tK@}=q3;iyHF4oj7ox@m zES!}R_}Oes;_#{%Jjx|_j6Xu7wThE;#Kv;*G{oE>z1g{t8Y(f^XIFyvRiH}e2Vljf zl--4g#YPr1VV;f3kbokvenzX)7n`qrY$h*E4D`SnQ=}MFw$G<%xuaA=IdemtzsP1#VbUw6idNdv zb9|gzhWVLON=@ASuKOqqOn4O5RL2`^=AG#W$ya@@41e(0Y9d@5b-7=r8@_dKbXdY* z5|?eNGUP+`Ty90=Q4uhEwAQ4|x^#*UCy{o&4Ajzdwp>p@~*^14Gb4*#~&C zX8r(5@1G@V8Dv=EM;Xu>{qt1xjSw*~7seuuwPfV00qr&s=h6?5w2-8JJHqaF)wb57 zh_=@p_%&7V6DLnlFz=c-?qf75ue!%ZZ-{eB7RB{D*DfHdB0B?*GbYe^dq>9&h;1v7 z%%6jqeaEcJW}fxDpX^3$x-jzNQs;b?MBBg80xyyeLs0abWwO2+Ax~i-j=Ei}elLRe z>dhV7*y^-Jfc}9i70W4P|~9rVu&~b-_-;#XcXmaJ}ZPt>-TxanxB2X222f3{P(nyP0&NNlSzow<^0b`C(9=KVt&VaO94T3zCvoP(?>>kb=(pE;oV5Z zj$!WAw{$errK>cB@E*>$BPuXe^}VZy{CuQmrtBONHWu<5x4co*rdT#CxvOgHdj<25 zVQ9r&x8up)&Z)B1Rjl2WtVa#dg8a`9PHcOs1zB!B-mudo;RYE&1lV;;+`hhJJ6^5Z ziud_gcFwfw@Yi|5-p9C}JM-vIkHk+$v#nol$7?o!cgw4fS6VRPBKKHN=JVg5R&|Ut z-I#u@deuf^UGc3R4S}UhwS1-RwBv4W>Arg z!xn6I=9Wiw^T1@oqqD9{dJ_%@-e}R=zmWogU0mL zacw9`u0Wl5NSUdvwaf8tT|AedT%J8ow-vj|?WzgGq^NMumwfhrj_H{M{iP?ZrKP}y z##E%YaZJ$}*Y#9hp)LtQ85&E;m9;rTjcEBr?p!bw+Kf#zg?=^AmR^aA^X6*auRb+F zy+O8_Atg6E!h8^-*k9kADF|nUnu?;G)?s-zBow}UT#SVoykVAfSpq$M*hM# zR@dthN2#4*Rp7?Q7C>VkJ)CSQG?b^alD>7_uE|w;cl3*1)Y|AxU z@wSloG}=VA=z9>QBkNM-adObatTI=o7%VzeVJqh5v%Hy?UfrUCP{=@B2LSu z49bnX=e*e0@YG~#VvA+xud_$dI*I899k<5ZRDmhbfz8_BJ7-Tmt+(ZaQvKiQLo6*_ z-|$`Kqcu)ecn)K4=QpZWMBNG7T=^`VwDB!3H^rrgp?r4&UZ&A!l#4nDWwuL=(Tl;j zdAKS^?t!W=o`4bT?%&P+a_QET@z(H!aJHbGg;v8IeG_O6l)v8Yq)tea{kl?;(8w1H zt~WHzfnxI;O+!^z%eO6)UP?GxSy`#6#s5wY=57RTrueW=0Q{{1sal?Wq3ED2tzhLe zpBPaD+UhYOF{Y?MH0S99SAdCQz7ptXFSG}2RivODhxO+eNc9=na>Ln~EgWyOe9b;k zx;*8$G=&zvz_^S8ml6$N=h@4L=!eWh;WrAD31&w?3E{YGy3KtZn~VC5u@f z1hL%VHsDF&A5IhCrTbH)X$G(m*;?B|Q9eA)h}=i`o9U-5x)hCiXtdEN($?@fBxGsS zSfit(gMQAuXDyNfs{%;WX#oiuO=-aJc@_)2a4Vob0L!rpSZ>KiL9eiJ z4^}!r*ozHxJuG!e>Fb1m)osf~XWT0|kLj%iQrqFr5gHc)W{$D`BDbTE;r&LJfA=jQ z;e*B;ApaNe3@`^5&;WP`U4VQE&~)?#PT@o`blj2HrI8bJ|O# z(WIOTulbJM(^JWBZ61F>Ehpn}e(dS|>+ueWbQ2s_n z;dtcznk|;eWMCieJb89wc}_PDO$zxtGG5gthqWv<_F}fqYieA^wPqgBkpNQFq7kG` z0j@nT7bwM2(YfxW|UoN=P1-G$&PYSJ1Yfrm= z4vVb;$15WDeIg(?=ue`GaC}(H9zio7HSZ`;q!)rkaO(oP!>lVN2B*D?#p?#bAUN4N zE^tu$r`Jh!4ItNav~e(5nsD?OXiJgxz|HpE3}-ih1@HS3?|Yr(n9A|=u98{?=kxtq zMS)N2!)jWQY7}22wf~rKyKnTqv>%}%@nd{n7A`&s&#j2DzLCo_`!*$0o0x>(V>BV? zWpH*3g^G3k0PjbMm7&Tu9jkHOPJR(QQVyG&G(pp`=^6MUhptj6c_NQ*?Ph<7-r0@z zTWRI@eafYy&=wjCdp@CG@NhUR|azIU~4U+}0f%@hL%960UAp zBtadF{7~vIaI-_?j^jjVLFRI)X|bQLPXF|Ty`Z%hnw=oBF32nRvvT#T@nCX<-R>f* zw7R_VvE(jnPbC{khUNhQ{XR$GBLO@Mq3%?h%)|!@OkuBEH22XLCexC5Q7yn>PZqUL z#Dephoy8q;ZV*^ngWMfdQ?okc#Rw`L%oq8}hzqQ#oN^ziY+0fybu zOk~Scc>()}pwAeYp{`OQH*oymAB`=^8BCWHjpmbs{GvCUf1M!Q{XF8|_xIkSlqNga z5jB#2lh)^&@zrk&k@#f?z0?_3m>!B-LPG`Utg(a79g>GG=vfG=D_#5)dz^5-nIe6u zyYLRA>n7&J^hXv1d_L;;b`Gy|c%t3JPZq+9)HRz}y7VJsT2-i#)J;=-Lhqslam+4H zk)*6^2~gX*UR9@`oSH416dN@we-7en4QU)P?u(eF`rMsB6QeF_B=CI*CB5yn^MD5x z&}{89QugIIS9pjy%WunGq4%pRC_|GRc{|H7ziEn}%fhUTF|!h|-`i9}hg34Hs4bgq zaZLZ>Xl^_k{Tq$D_>z`8Fe%6#udm&$t|7=-WjFug*H`_RsPP6gV-%$+OPc*;dFxAx z5c{YYbBbPY+={)}l+UV>&PMXtUKDl=iSGP-t`BFReSDdcD;E)5ps+1V4&rb4r>{1B z`M!QS*_Tj|B@ZV%@QOFRjH7v=+?Mnlj`tSKH~tv@VDf7%KTJ4FWx2M{{)cBs?6apI zrl{#BSP{!%J!o}1rl_E{1cmBQejo+V3c~({E6s!?#c|s9JOhy*O_(k&OyfxcKw&^T zMQiyoclf-sW^r;-6{L?{B0uZ2Q`QD%dFFODY1!^>7Qyot=|J7#J361xPzdD3FIyhcf1R0(T}Pso zAmj&v2UJOm5&s?6>yN|~{8pPd_R3O=%ST}61=JbLp8~X5Q^x>g#MMLqc^DvdbW=%J zR~J}PY?rF4s*D<}XF>Q!Um{LD` zM^6{)_5fnn9}6srFux@?+SZE4S|tcA;KU|%uDFUmMUgt6;TiRsB0vfeH`s{BG{CZI zPBzVLMdRcyl&5v7$>lTS)O3#RU7$-D1TxcRfOMLbwX9D&4@@%qpD(>dD{^#lRm z1-Lt$2;h+@Dr3ak2bdzC@4aW$51&4C$tz%xgni&!VH?C~Qo+PABrtJc?2|+LnY5kV zF$nMiVIeTqT@7fP`D46+ctRB>7@IvI^@W_n9+phxM|M0=58_5c3F2k9KZ@MxGA0Xr zIyVy}4+Ak3x7EN$g8JflFr)y`ebxYZZn3^X7r_IU3SPGXaII!!)GEnloGsR~WkAnP zv+dD!w*sV}T3S9JM>dWOBWz?;?+Ww({{+|Lg7}9IR2-%4?HMI5+r!wjSW>J8&Fg$I zQIL!{@Yv9Gr!fD!sk4$lQDJ#;R}#HF#x;$N1jxvz^Pjh`ytZA?v0T9S{of&_m@uR` zTZfzAc4WzEvE!=GMTe>WE%*Er$~n0ThOpt>?ns1DzP5zGSY51-D#r}o2>Hxoj@F%U>S!eA~F(`Jj$9x+?JDo z@HFzh*#Yn`0RaI3glE{Jfa(OOm5W{wVJra2YxU(7{prCqzU#yt+4J^X| zA0@=Yy8u3|LmKHQKHv@oDtH%?mmc2ebN_qWmQxWD*kX|N4?uAXuxgss_M6?WKxw!D zM7SWySL^ob6mtpS@LOlszZdJ48f?OXfq(;ucVk*5GeMb-K`zLbEbnu@5tc6{v107>TSk+rF+|Cu8|xGk}t?S@nL|DARtEDtgC|NbuzKbShBv#cyQZm&9I)Bt&siLpUiQ@jB+#gW<5Jo{ z8UuLtDv0;0z=Hxlge>-~eANOgl3WN*_`QF2ZhnNhuGxJT=6|mfO&CSQ399DE=xAbB za1ssdYvBD1-h<#RHfD}nXlW_Y;_Si)GG;^sV}VRtI7FJfbivm<5!nzTLZMudM^ij- z1(t=LG2+-i(jm|J7S|gnkVeeD<>dvcYO1RTuE~h^HJzIJkYJ&Nm|2dY|JOk4;e#u> zD4`6(g!dJ23LZbx$r5zb(I0)-DcG3SfCEk2OK zL6?F?#^(rz5{Py+0rMQC^XMcHJs^Zkb=)4713`xo;66ZM3ko?bG=vuS!=DFWKy5hk z%}4z=k#fV%;hC!1&mh^!ANZ%6KWIxzSC?2#(gH+B`1+55d52pKywzYBU^(#J(&8X5 zH6E1(Z6LhCB@AdaE~y=9jN07nH4`u=ITO|3#+f5yN{jlKaHeUf>RuR}PvS=*YYIIvmp&)p4rgiz-x`}p|qe5FGI zxtZdW{^Uq=OELE80&X)01tb{#=vw`kiUPz)++k{?SD68Le{5S|8!p)TxgctuO*OD4s&Z+T<7iwoaN*~XH?jUwkJ)A z27!fjXzC+CK%4Iz`P#t>2@;XIH4F^AL72BxB!OY4H;}aY)uTxnn7;?~vOCOS(ZR*{O*%xC4MQq5Ond}V2?PCX?HSyt7qmc}3Y zb`&&~nkc4c*UuRuD&D~QJ=wKmYxlAO>9F+gy!|}W+1J^_*)ko*ng^y_4e|lrqehP}Ay`L&nw|d)BKFXf%*OZHpWkh5b>ucLP!^pf&qV zcY_ZZGD~&mtfs-;v!9X5QbNI%P;fYSEB!`Xq(QNWnyj>Gi-U^MFVe}BwjhiJgYMsNzi0Wo=l8aHK-j39`Lf}GU-c;m>{q~h`6@p-Y9Jh6$a3d@w&=!nx@!Rp;bru+Vp;9V4BtFn-YmET5p^8D32RG!M+fHAw% z`R@MGi$;9=$mCbd*I8W-pRLmP_s12Z5pWuF@h$jH4B0;xNqURlZq~i@T2E^}lW)Mv zq_;ip*#Eh^bbvxdUnz1qqTOb3(ztEB5-N2|HkI%p!6XunXqxZ?deoU{KC^U`% z3C(cNzKmmFEc46j->s_4wC{{cfzf^FI=NgWDO#t-WhU)gSumex2bD-_hicXMFK6H0 zUmDTkimQ(9e=;)ZoH(oxa0x&@X|R;|*bN-?adi+?7kY+pNj1Z`m4Pr-g{RZ$ZKXmR8HH-S3Z~B zO6E4)IXiYo+0DP)(-;V7(f$=hLKnmw}vt z+!}B3r@xv_lW~hM!&Wx3T7^e5eRI8`oA=A}Ha4D2M)#`ONH%S9R8$V{!N%4C9XHCS z$;v+s2(^ww10T3}5{NnNeC*Vj7rn}bna+>4nr!N4wB`9}m2_MDo>+F=qxPF09UHC% zL~ee7Oytl3sBZbnRt~I8X-4&hd^Q%egggg|<$h$&^HDkA@Yky~dHLywG^mm(F&=tA&PU&q@z5RH3H#ax3MSUY?(+_%8_C)F9SSGc!qa^A$((3(WSEmwD&=V)u zEfTaa5)yb0LsV%~EhVb3KN|0F*>SLGav|>Y7=H9D>h9k+^^7!j3+&$R#Kkg{$wta* z=$J_|SLktYnZHJt($*YjKNe*ldxIB4Vj)pxr=mV)`|?a(U0XURj~Nbdy14q#9Q)v1o5E3h3$QqR!Lh zHk=`f&~;jo3pEAmEctI5i*aT1+z9y=jdHd4vx;v^i&{S`y?Mh`IB=jwzuR9H6fHKx zT56N?nU+jZFLmlYb0VlZ{9#j{2qoSdcs3QCyiEX_!4mc4O298b@`JS&Z}u}N+Dtnf zytP5j3u1y;MS*PhPQRN{Ep@z}kTtEX7V=At#tmV0f*=tK9Scf4GzP}3rbdQs^>waZ z+LBHiE=Sv(#4Fb+_>LmVxezF;I<>zm- zUMkz7r^D7JJN<+LD%|^*|66>~cBy~ofO@kNfm{Zp4cZsj5d|WUPA0r5iQ5CdAFnP3 zi=fHV8Nss15?p-N!9i+E@)oW^>jktp49aK>ud~>rzV&*?%N?ZWTOoT~Mq5&s&cAub zV8JZQOoOm~)D=z5Ik*mONZk}B#zv;wY`hEk1-O!`(y}bo%OsCv{FRRlQzGpx-eXaz zdzsrN85RjK@pEO_)VguR0XZZ+MhRdqnfE`1}bY>R-h7O$Rj+(Bn+j zp8A)5RbuVZsvhFBH==1|Fe-65Np?Ovt$NW#s)WzWZ(wM8Q-?+Dx%}}km3MyH`z`0Wj)Kft=mt01Q-wv262EgGDJ^@wx>tTQx zcgrz>KVgZ0psETB#-@>O2L-uV4jKu!B_Pj17KrN|U<*a=7AJrhe@GJh?md8RCxq{8 zK?_*Fnk#{LJ0VKIqDNay$LjWN9NKEcZ$q zjxd1MYU#JP3oWKPz4)+#m4}4$>Z=G#6R>LtD0LrUF>n-*eSY0`Q_sW-) z6dbjZ)Nu=BQpYS|pLA6*{hDZEu2A7&M98x>7kpSfxXe9%fWTb|T^cGVMfH0ul#9?CWjjl`oCVC3VD+ zi0Q*9B}3!-lFx9ak!-iqP+CH>4W7fA+v1y>t(fZ$j?9i7xKeqPf*iLI#Q6-Lj_0fnLN4oB8@AoTf!f>BRkw5)a~ppL4*M?GrV=)E;*R7csd*Rm_7j1s~t$= zjEsl?h@6!TK#jQJ_)v}7J>wPa4`DYE_1{gj3wGkiE|Vc-G5@&+^DYHgVPcc62O!SBz;O*ww8vE4WSx%8%pw# zlHviB4K``KCbK<3VTs`tII|$vrxwUdf9?DMBcF~hJOrqXpLV}G%mG~=pwA%A2H??n zzJrZ-gp;o}+$40Aa^DkQuBf(uY}omL6c1Vj~qH?r=^AOs@-`-`OFTWmKxXy)Oq)=7y)={ zr~-I_bQ`p3QLi-`&0GASd8}bn5+1!&$x-*J7#97#a#^8fh(sjEty>oWx~xML!4u-( ze*3JKik!>EWe3CvM;4ST<^geSNcxv){q}gqxvh5@**#+TVp&A~P7V^ZFyi`BwUo3A7I< z+bF=@F9-17N^(rx27;*nIpmw@|qw!O9n&-k2N&r&l zqHt^rFpEg!bOb(3sM65BA!9dHt6~@`5NIeFh2+V{>2q?h1iJ0Z<5{uRk;IT%8=#WL zOOGp;72UPTTZK{LY9&KAXuslJ*-4|Z{M30pjV!5GD=Y4SOZ*&dsJyu}{+k?1-$lTo zqTHA(9us~8m)Z)tZ#~XT@5x<)>(FH4>O@JK!^tGNxU&7PG=UlCF;B(>FB($iM;Qy1IgqX$@% zzWd#XJnc?b29na5U!r5u|7#Oh<0Mx3xC!dJG!ef?AnpbUa*ncYzcmw0n4FyIs9R6H z&kED~YdJr@&uw@#fmos%w4`In>t(Q&v}o#>(}Ik|A$!dioOyhBB3|X(IeA$;VXvLMR6oxvD;%YOco8(a?2s;Z@bEG4e1lkzMP5yu;eu{o=FT)q;B&2~u zMcUD%A>~;@hXh6VW(#`sBSkTAHj_5 zlbQ?Ak7ty~7_os=s6UVQVXK}L=)Q2 zmszP1){)v`D~Gr1UAh`+K^R!S@Vx3Wn%hQFj*b#Avj}8xVyymW@*z6e-7i&w<5Gt+ z`TeTn%{xOK!Vf{@^u3ZFd%x~xMf0V-8N?~J*D_+n%!Z&DRMy4p@_M_J+8&kO=V0x9 zPkxv$v)+8p(;^D$H8C*h&Tf4WR|ApBbCsm{$mGDcMCPAPLIQTj*(mDXjfN#dYEgI^ zrvVCap`(s&t?BBks{l+R@t2S_I&=SV<277SJ(jNSz{jrR$wEV(a=HJ-b!oEX=GD6!h_1bMIMo#vD7*&Uq1 zlUsKg2~`S3bHtc^eo6}Mzz>B3iJe(}HmJ}*uJ26jNqgG9pwm)I9MS#kYQW4DH`Q@u zNMZ^F%S^wvmwilX(_iaCT?!@K!_OFLSOj@bW3MO_SKL^r=CaDac07<(b?p`G>}j2? zUb}hO+rSr9>3US;OcT(BT5_2@YH5rK7}RxfxBV@W9#A3-5~8Y6xPOcgvZ9RlPK!#NG+N0fW7+$w_A( z1E8rL8SV#KT{=GghM?2sF*sG^oPCz8;MWo`-#UwTnd9N>6*2)c?|;K9Rt7(UB)wfz zdrebYh5J|i2b$ax4!p72RbDXPn&X`Hwv(2>V+C7f;Wb$+X7iZ~+&wf~h2;I4qv54z z{?&3MX{1Uxvs+!wHSi-cx;!T3aeGA!pE!V*;?K@^XG2TzD1E<{VVr!6D*c*+VP0Mu zRLn2FoDN54T2??ByH~f-%OkR?oapMe2mf7!<~OcROdRMZu&_}PVGaa z)Y63Wv-G-S^@;Gv>Z8rRv#+gDEAIT12ug;6<|Cc$^c+q%gL0$FY|Ad&?vi9|s8?Cd zJLN09tFIct9v$5k?j>gjYWB}|imGtu9XfHcnh$!%40*3I z*)+K}%a!gT--sDMTHfceW-FFPAZuNzNC{^N-mCsRJY&yA@&+7c=!X~21JYad)D4yF zB$Vv9iGDSh?g2pnlZ}nD_kSF_9(NuS84+ix=69caf%pjPlhb!ZwMD7e$cyd^PTXA9 z#7gPJ82a?JC~yY(dSmtIGe1{E=m+qW+z!%7XmZn1O7$(qc#=wrWVjXR2OJ+W6gBD; zuh^s!o`%RYln$-sW7T6xIB2$oU*!}of80P5NOYv2b$t5ikfzrUc2jF!nQX63jc(oW zu^O@EJf<||u86DTNwcOUsSEtfXld5_d3y39m|X2mD_-QGd{R5HR%MN%kw|7-3X=7K ze^wE}Cx|P4WaMF^;&PeA^22CcuJ@fsPEFM!M{*jnWqQxTLFJt)f~gt{lf{yB@DCYN zq%N6n+;mkTb}aIPKGc&BLFuU4-vGx-;tR391gxOs*aD#aK|0wkpn6WrZwjh+$KUfg zJpMl5+MUSs0K%+@^h2^EpDi!(_{#E2x09f)c-j8&*WvJzH0^msba@s$76r$tS(^C< z_(JA`nljO?~=q6QIDFft{4#XQEdeBUP*cQ)yh%tnF~$UUv-60 z$Yi_7DfIu@sJHD$Qfsy9S2XZTu|8K$LNz`)}yX7n-7*Yyv{<+FcLS&%OTrCgw1Ckp}#1>?ocf|6yfs zUAs!sn2#(*Iv=UP>t`MwKc{bvfNIG#zzh1AzeEvOrNaWA&cG&`>4KN=p_ITs14;NiDTTY;^?(^Rl^X^|pzRzq~idzN(eM}-B;=T>77 z{XC$}1t1m{wH*~KLllWtC10J($^=}zCLA+Fa37W*ydLlgBs7?TEslp>b4#{2KAIPX za_u?F9~UlN_yJuJd!3mhCpW?KfaPySl^C#5<=CNTgCy0=Qc>01%m_Q-qpkO~!G!Ae}V9SZPnd%3|%i0k*cmzj%uyfJW`tWO;5X>H*(IeV#K+&TXFmWkPXM{G>VA6>djn8W z3ISK7(=Om`;&X!Id(Vl)4-^+^Tpu0Rhy;(t`!(Wny*xksh=&1#>`~-Gt>A1)Amca0 zjVfUZtM>rM$M^3zFYy!*5L>;pat&&Z+yb%^A}&h5FAsGS!V>iMs8q6pqg%XAT4*9{ zY_T~%#@2sXJ^)-$ar9S%4Kd}|7<^)15@(YqucwjUgWEo^SM^pOFVqGR_qq67Ov$jb zD|pHkq4I+l-0TKqo}h76&MYj7xtiA46s zIw{K0%+en8;jTqM9huQ?zV;^->_kSxhaIpxo~Cc0BYC~p?Au4N=E;?*h`+rPOU@&%SMEP%dmZ(rqgv$Z_sm^)ZjhwG?#J=6StYm247T^aXZW;F+pnK`-F}u# zJ=|d`7IFd;NS+~qJ!ougDSi9FtK(mJX)>ryXoUh+0akquBK}P_Qq4Y30~PYSv`S<*-DZ$?0^CD6 zY9OAOLc~`vUGa74Xi)^yuYu_rls`#HNjbjGGh4s3Yyb$MC$uc;TCEy9zV*hqd-hvm z@AN{OQ;1R)(I3}l+M9GTO$u!gk7RqUiZv{(*BJt*9rCcg^T9s`w;urtAwm|96IH8{ z!<_6{$%Pg`eVz{-GM5X8_3^MvaMqbuBj6m2V# zH309jDkkCLsKLFD)$TRLsb7fLOg~r{qVO9_`B&MrnzyIJIj6jLK)WR8{X)1NFyaod z+`ZnYw}aZ$SR?%i2G3Yi)$frsT<@=)Fw_-)!+>_wAdvmI_oO&v*4;g?fQ&bVV*ArX zl3g|UsOKi(69}#>knsgFdSd1dbG|X2tvuFMM74_urzsWsfJ1iGc&m@k&wfq%U6#M+ z!1v_VlYAaDkhXd2B+AE`0n5+pt{46wtNCpDG z@HCtW*9uJn6&!!CV#*d6r6EwW*73YL)}MjmxLCT2K-mTMkucM()+&Ej`%Th`AVfc% zUYUyu>7ylxOg;xbUL8CP_X;Eh|0Q#SB=_U<4{~Zw*|DGf{v8Y_k7}d+7BT)gJi**| z-`CaIZoM)HqBmjz?k-D=jJW1?H-2U+y@S8)ah-!p72&%XzxFWmHs*u9QCF_lJb957 zz@mD;Wt?rjc0b$>od&wI9%;&tWmD>NU$P`V_7dZ9jpe8^O7{$gP}LPFzWR{tINE3m zhR#0K-!bYefzOjuvuv-Gl#4jw5qzV#bo?CFws_o@V>c6HF-E}7xUQbjS_WW zxCTRbwLoY;Yvu>~+)0P&=&9l5OYko zzp%ZJSv8UWxkI45i8Y1v%Cxd@paBp?CA0sdO-$wZ9)Z~7w63#QA}<21>yF)$`NQ1I z;*CWgu+*!u4!7~~?~mkTcKR1i033Zmx=G;miSNvW&$69d$=Kl<56!3%0>JarYk!Ql zVw4trmG#6Vz1YSn3DA)bwVK6yu0$3BirB6TM3jOHq;tcp3G_s7q}bzf!({Ub>cnP- z3s@VB2hXwTI@lA!aeoe=b6{QsnsqGZyltUa5K3*t6l>=4IuZkFN{OK)ACCVQ1b z&?Fnz^s|tv3TwyHDhXq&^nkYMg~B#FL6s}c4Kr3#J+uS>`BnbP-#6GDBjP|>L^Ys0 z>qeNG3=U|C`P1qF(cm8wFGDE-?;8F{6Jbw@8;=O$6WmC}Rc*vV|!nwvY~gcE^7!#wo@$1;+Y z1Aba;#;$7Y*~16bXFNpPI5U2&@+`EUvs+r?yEXe5mY@ubhSTU*K5Yy`yP9T}%qj+2 zZ{97FmJ);`WHc|4ZnLLBrSOh>MG-BbX$46|Bcmg^{Gt-z4mdBO=|M8{-c05@72IKP z*zdN9U%rQn>g6Jzqk;UT!G%K@EQpzeY3xkYf`))&d0cBc1m!kcAl!mF_3R66AP($| z)q_ozfy!bt78vJ8SxJZFqX3M42v|EHG9L4-1e!@(94G62p-?K3oo>dGkU}Sd4>Sny zg@Exfc6-+NR#E&j_wTs5czThTF9cALfrz*u-2QDS`moG%sXq!l@_^QOuM%+* zBPi%2#gD6Ha#0J8!MmCB1;Z)N#dr3Iwq3|5XI}Vo_EQIh8e5*=u&8H#%4gy4OL8tm z^5w)T4b)-48qv&EgM7;#9~Uboy$FbShBAwNvPBH!N_s+qU9PdJv_4pp21MjxqJcI+ zP(uGSSy9K{%IDq zB9uWI7P$VX7HUZU>ODu{(VX#938cq2qHfq28S_wl^8dmkpcyNtYW0iDaH7eYzAV%s zKy3sD(waVhsAEh^1`8#p;&$Jlts}WfLM}~M*5n-U(511?5#AVlFulPNr{L3{(SoQ0 zrH%ju^HWS^#VH8XrJN?#WqcDy?E7#zkNxtMkE!Hui~TyX7&LxvmPj) zXBqxCnF6eSz4m3h9AJ!EHo03KHwnA;7izaep8kr|y-dkYhIb!|+5}=?Aa3Eyhh^(N zJ%a6k)-z?Ih{W0h_U5}D-9X{#d$+U(xZ#8RSmDn=2o8K&;~S@gmkM@E_u&idHiN$< z5HWDc%E}qP%R2yaCsfZZ6Dv2bZK@1*ov19vcbqF{P7r8*`J|5A<5J3Pzni*6m7>gKr)%&kfU`G_>yn6FI0Lg!? zxXQaC2Xtj)XtU-kAe3FGuopvL1tH?pS8(zn0gd)A^BKn26o=7I0sMj zfLv=xLJjGbL>YVSg!!I zzev@L6GGQYq718HSzGpw(tPwS4aHD2?T7_~t%N_7lFvPxzcGRI9a#xHDRx=pc*lJ6 z!9b;e;6yw!J@tdoTRmkd@#gFT4b-Pdzah8pI?-YshMBh@@p%P0O?B(rm?bTk`z{RDKYB=vrl2g#%6u%7#>D%<F*lgSDuQFLjJH>@DLqmk(0rm@7b~V+aK$7Wu<&cyWi^1jytD^f&GQr zj?~e2>@Nl9`u&+qw}87RwkV0GplgfNzn^QswHrupF`-lRajDosPG%t$ch!S6&dLja z^-0ic@$2OXJRK{t{;9$kCD`h42P}66Z^dsJxlqA)4)5=num*r zOX{`3u+*pvigEEQmAm8p=9Sz2g4@)zm48MoxSdKp&XH99^v z3UJ0cSUh`XzwmuC>_&(ADxum6U}RB819P%2@jkUxNTW{UkD?=Rq;Fr>lC+r{Y~3h_ z=-0?rzy2AA_1)B`S`En4NhbRheA!6$zRH)*%BYnD-TKE5WFJ%gE+TP3_r({RT!qTm((xY_S0;z`#;LdAv z^?3cLX&OOnnmoO&t!-fs6&J7` z_p`y&=ah1$6J3r<%s^i9w;c)OiTx~JnX*w43|(C6?RkkXfM_Cylqg8gz#wKrc&ndq zWjzaF_?a%XF?X()R`k3|mkZ@I`d2<|z5~6*;v;6bkp_}o3~^h)0zgu)LQRq}s#GB+ zLYFBOB4e%~Y#K;S)}_gMWjvoWE#X*+X{@mVA1omeBZE`gAPxp%LpL5g(e?QFc#;xh zY1TM~u>FBj@lQ9J5*nEccg1Dl}E>SDV z)7q%G+f@}Wp0uPiH)i6;_YrG1%|z&Zo7L`)S=~=n7~#^+=&mCQC8h7mmm+YohXv

KSwguAc3=Xs|pJJeiL1 zuM|mj({`qJl$DfdP{$(KqbZ@UDW8~LrF2*X_=)&RV#Usd4jPXlhH*?x7J4rkHmBL*bS(MfW z25uoc!mGAL0;`oUY}(=@N4y;@d&|P{c#s(3gMhEn3T043_KIgkn={wZep6pmx<@gr zBnsp0qO_L!4mVSIvxtD(9gya2`g0zY$ELa=*P#nn*r|&^6A+Va1PQG^S5?J4ZDxj> zfi~cmv*(WRbK`gYY>72*_<{Q*(tuX?b~~u;dsVO&+r~DlDA$`%J1I>nU2%$V+wDPj zwzn^&?J0eJ#L&}8J|&qrzV*@=Rnt;Vw0W_XiqB`k&Q-+ks-;l*#%NFx+bv6UKwW;^ z$1S371zzcC^LG6^p596F=ks{>L`$L76UF+4ca*Uk5MAF$m1MC3*OsAaJYhjKDG zrH)^YvH;v7%u=saQ3eMxN;kM9^c4Vq=8b&e^AoL}u=!svtjOPfSV3ftmtCYbHf-^m zO14-IL+JbYW|$Lx!<3xUg2?sH7*i&%)jH6r{sETb0Rdu|^h-EA=y`)?5m~Pt_2ptR z{kUrgkK2ERB9VR7b78IzAd`PLoqu3=I?}GYerIB~pv$BTIZFtb9kNI>GB-xK^QF z!l**Z)KH1O-j8!-xpCj!zYRBhv>Hk6xL8+H{H|`)*C|rFSB24Bsdf&2n3Jme>k!GS zy=uHUptgjieN73He+}wDoI9Y;%*4>fp%xPXrHoD388+m)Z@*Y3HpxR(Ep|0Yk})R_ z2s$QSxTCp!^}BL?@dCZ{2n!-Y8qAz(ZyZwQFJh6@xeltQ)__x4TDr3Dxo&?hU)&;- zcgbS<>l91=h*DyPyAJYM(R5zn)=8FoHX&Q1HcqCM{N+qK6J7U5p_;U;ZQ2)^nF;Nv zfyk(Hglj}xtOlYi4elO58Kg^(x#W`~%9W;JrG?)D(7j}NV^;7kh{kZ15p*BK$~z?` zI11`dI4lr#tG_Yiw>geAxz}VSN)8~z9oGBu!bhc(bvr1o}y4M z_UtYC@hn+8RJ~WpGCMn@8S~`C>9-8ug^|bot@lQ81{#Rlk*MEB`tb6zGki3!M6NV* z5YyaUq%3IEY9(ew=GLkbr}au(Nb%|ytB(b^aRm#^Q#DFCPvl}ulTaW#<8$a?Q)HF@4m4>*&H|2P(VQ7Bcy?R!Pq$0o)E0Ao95SnJEn#A@Qs9Ftdx) zDZpmNXPNt8@N4G|$AcR&&s4>jq@k=;!!qToj|YRqfw&)dFQE~VZ>N}4T_CN%3EnK| zg_UYd8KySuhlIdqsGmDNG!lrs{zt4kpA9A--VD6{@zSgWhgsC#?2dRWTXwCsp;K~PPi($@WiCkdu&g`M+ zSIp%4#!p01V)Na{{EHdCGq=%*(NsoNNrA3NQgAs{1T{Sl7ehq za=ZGA>;?UKDX~D>JlNX+ljN`>KrqtV1|5q!j%i4iajUyzDoETjmYz7f0lfgwfwCBA zL=YD(r>uUUrMuF|BlKtkvh7SUJR07#78c0K$w}OqV(~msUoeSEIqPZ_fMn zl$&h0tVSzEG?ffIgqDd+?4KJm^@RO>{nM|tPA5u4@r%Iids%3gl%Jq0zf4|#Z9)6r zt{9%+n6yj3{i`Xy`3Xf29xA~_Yzlr(D)3PH4%d&5|5gY)W^1UR86}`_;=s`baHMm6RUo3%wN8hUF!2^wI*zv<7x6O27^Vx4Pk-}{66}%P2hdu#klx+}W$`h)6)L=jpZ~K*LY?X)*oCVAcirMNh%YjsPnDApgg#2=IOu z?O00-`yTvgVA$(dzHF?2d3X5G@t`nAItQ5cWGr`&HY5m3rjtiUxw0T6NG9&}&sS`( zWt?#y12LO(gF((-k;DV=*Uj=aA_<6_Ni#$`ixd^bM-phVo+y4yu$#8Mzfp@7eE0kH zhrXEXpFhiv(w{A0oH~Bc|2U*l_T$w@EqOCSY22eZcbv_Y7#t|D+Z(N*QHj^698W~5 zGGDBT*6Ee0t<3q(8_o3;Co%J*%W4hg%%44NF5fZYwb7wxPZD(L6HsLEdZ|8D(9@xe zimPQ3(PcndA@1wrQ9#?LZ8a4B`9sX|S^iWe@zi;`EoCmBqJZ19PK5}c z|A(6C>Ii=ud~umb=QuAE-Xe#~B4Ux#+>}&&n9FfdP$?M-7e{^bZs9XJt9c|FZ3_B( zy_-jG-3y;>5`3Z#iHCZzd1#t@8H)N<6!fZn zm<6W8N`WEiI^{g|`cE|*Eh-^j4lSxprU5QWEE1}|J2UBRarIPomqv3vB-Ywgo3!P6 z&3;wNB$tZnclUw!`w!kblf-L_0DJ}#ebPcgvP-@c=|8RmuI^huC0e^+uhWl2>X6m5djTT3L4^Wj$lZyygZMRftLBSWD;Z z!CYmT#ZGa}e7ZQVbfUTo>c4#g&m(Xk_9m8UdQCL4$WO>Yw|s2Q*qW&O_u(Fo0|jcK zO80N-HsVEZZl|kr%_T7t_idfe>ru#?t$LoVTc^)+#PeI8bwGn1I9W2KK?jnH-iW99 zb3h{rV(9mx;AB^B(*Tg7%dDEmS<-1gzEShR;l?90GH}Ryz*5#Br;Zv2**tkA$LY)L zr*+i#vktsU7l}&t^NvOx2Cl-jr>InpBpZR_f4e0^#rxnmzbpxR{@tDZ`uYMwiXIXC zYyE(WbvDivraDl9IwF#)6gwh<0OC-VQyzmbUel$)S+yb|TWrPb5EKu5Bugu{j)jhQ zXT0=@cEgRdUQ54C@&xh=X)&CaNV+Pz?xA9)VfHASN%MzrQrx5J0?krl`OrcX>j~iW zQe<17gDi96^!}2_FCLGKVOq;*BS33-SF!1J+Y1&lo5L_l8|B4fEiW>^kVUH^e$FKL z6H`f)fST~|@HBIyiqgdnbDRo+R*YmU?qg1{6iboc@?wj7DCiZxIpLLi8ig##S7jl5 z!U5}{Fd|fm{*)Allr2$jy!>0VJV+vpN2pny&T&4bsI4sBPOUK=kz~Gb9Fijt(plD*^b{dpl6E&lg(fzYBUXCs$H&5U!2I`mp@T^) zl(u&d3%%cIt=v`Vk(Z7m((QHbkRjrcnO3pUp?p#+_{oZqmxr(^ynia!RAs=4ishFD zPR!e2LjJ?utt|ZOk!r3Qqg2TFy4APwILbj_x)kb>*s<8wHVm?8{|bJn6M2qbcF~h} z<0pZ$JcFvwDyh!%=;8!ynI4^)PLduCl9s}a>LVA`L^oosuwn z4<28YW8WuIMloOdabFUOh%}#2(kfCDFz3X<0*@Cz)#V7nxj-7&m~0FaEb!BhQd|i; zXJL-3EewgiYw1`;@~x~fro&A~KUS{0d>_rDz_&~G!5xYEr(+R3pY#u9<(vHXb1Mee`dFNoZR#o0nui+L^#FCwSV<;uR-<86_5{JRpu7S?GZ-d2HNl zvOVjooKtCC_F?$u{I+0l98pES!Ek(stl1q0V} ziNZmOsFUdO7b-8UAdrg~*t7P2g;*jxS*5@2CjSNDZf{%$CV!A!x%}hU<0nFL`JbO& z{O_m61VQ=-L6V!{3o~(+aqJ^eT%v!$fj4q)l&u$sVj|cs@;-hDK^I^8Qc*>dztWO> zQ~e7?6sP<^gA*)IPjEDTNfhKb&_DG`;$MIyZs^Um(LuC$GZhxfp6G^DC!q`shUhYI z7xq07_6YqQk6&J_#`4&8YhyBiilqCSK_L!w)XR1W2~ClX8{Qe|2B0ov_>9d zX-pTCmWFx_j7upg&=Y_NN04fxt^k5@Sxi)iozZxb<-@$_)(H_nUc8MB3$dbtLX;4& z)jXn8mSw3K<*51x6@85rKf1Y z;!)Z7{%Cz1aozVj41{>oB!O+@4%kcqnj`~)3j|PZa&DK-=1cV|f2y3Yu5cmqSA3D&8`IpM6+&(L{&H0FRsoo`AG)@UK{~v}F%SXs4x{qj=ByG)FH?GXdO5 zvWfn_5-+f;lj#ux7QhG7l~X|Q3mAptpk9`~R(0$E#33Y65L{efM)lbiIG5v%0jqw{ zXRUVzCWe?K8=ITJJK_~s|E?49aLIY2B0yORO0^3BuLB*PmFTq-4muKoWQnXO?$^&_ z4iBUdT8zqyiXcRgo@Je%nu;h&pZa1bPvtf6Ky$cOl@-Hpr-OtXogpFzO9aVB(L_j* zh7%aO;LJoU%q#r_Zzjlbmewfiw*sT7d0k^eNu2f~~;osRCeg zcz@7#xHkR(vQoc1+~0uxXDGUwd~O=Pzr9FIq$%HJ_o}l5tCl3s^`O8uYDiHSD=nuA zRQxk)@uZgYGln101RM23o32F|@Kpm-B-*V{f+c7!qgU(2GVH#LIdo(95I#CG)%YDO zwmg<^3Jo7W0&BL={z!ER*|Yj%W(aLs@XQJ^-2696cV%cFjCC9$cQ-)UiETz`?i?r9 zCGZ3B*^XD#R^w!1&{W3OCnW)dV2Putu8UK=nfTa9K#o;ZRCL(`P7{H5d-8p z`?d|Xns?hJiQqHR#KD+c{TzW;!+LD#Hs?R^AOvVgA>~m8G`KBO93^foMu3^(I9p9N zN|!tUvekf1sJ6N~mw8VV5K~IfgD5v|P+~M~F@+o@NzmYl$lM}%N9mzfRRF+Kwgl+R zcNUs!HFklMh`)owGjc#S>`S1+48H{@uT-i5!aK6860ujI;9R|8F40f$=z~SnCjdn? zDzcD)bbCEf{QKxAgZwTCRR%AFnlHd|GE4&ISDh`vMTSKJV*CnAaeicg(3k@q77WC< zQ31UkV50JtLqSs3-@0tvCAp&;Md-0YOK4vlAJWo4Fp4T|C+p5p)ATkt9@Y8o2uxwe3TX_GHc zPg68Gsc{*tSi2NQEiM{yBgwXIz^_KsRaRDEFl3#g{O6J$k8a!L z1(&tUTauQMfrb#23 zHE;&pqXi#r?m#|oDHL7}PzurAqhf%A8(J(90=z-zizB=%;LhNzV0Cq}sYVpn1W5QB zJH=nVP=0zJ*eChltKq`!d@9Wf)-{moBJb#U01_Gt$tqp}()f{@nb|6kHzz?=Xsc}& zK0PZUz*hwTo)Zvx?qqUV3;=9B2dxs++hFzvxELEVvmj8FH`+|Ky6+&=PheV}eshZZ z&*;HF9Y6ig#4&w3uKF8nUF`mSiD5_Mg#S6A$C1!?<4K*5{O?b$-FQds{vL*1hoco% zb+)bKW3E6+<>mhwHyGsoZWvyHUh)rLBYxwI&_F^WIoT|V!R&+f5uwejtWUwW($)+qo17;my zwgwfa#0zGk$qrMQM60IXm?Puq12|U34^>~m%?tFy!_5=%PASm=igjHuGJr*T!10b-M8IJc zPF$lmxb@>vM__{ds~Q@aPjYm5g!ijstM|Umua0p`07eZ& zX08i3iA786-gO`np-(C*{Y1bOHaD%}PK=vkw1rM-= zsu&s_l>zH+I*2NVreFX0IOYhVGC_t1&_v_&44&?R^$U!g?dS<`j#D6>31m*59WHki z76yTBsas)ES63HMKX79R+6*K?kz|1{3oAQ2xB!9r@6F2ru~OM!gM}8eJ5`Q*^_YKB zRi>N+GDV63)YBL*O}nG=xIp$xfiF0=@EX{0U)zKa=m4z_usHjH^%tCb46pK$7nvSB%WJGt%_ z6UL`UMhsXt8$7!z_Be^W6H6f;pr6%Fim)DM`OweKrDpfA^5b2LxaoKXK2~ceNs~I= zc4G*>Q_@zA8s}F1aJ)oX+H4Yk_wUy`WrSIg^h#3RLi5e=wq%N}d+tNGvsu5UP<}MS zoo~ArWG;VtfDXQ%55*?EH&v!l%b7LZvz%;v87!fO>xexH6TkcYsemK^3%66$83h}i zV+FUHlM)9t8N*Tyv~p#fkB9$9UTHdRSfErU}fzl zI;FaBh`zfO%fGY>Nym#KE5qk4d1?5Af;SbifHM4AZ|hEhJFT$08kHdKjmhB!Q{VuW zfIP|0FZnlNXLDL60f8ZQu!x4|BZu|z$9*ta){S_L;@SiWnhH5lT>rV>t~(zp7RAYK z2fQjkX4@l>Nh+H_c?E**cYtFt5)3F{Dn5K*;79mZy#wA2DG{NgHKLp%AtOs(k{D^W z+B-$o?tNGKl5_=WD(zR+CtgNP39V@w(5GvXS;RGNLgoQZw0OK!n_?MHBMjf@5GqQl z?8x`l-Bs_~Vhf|m2hz(-PjXJwZo28WH#%p3v)6cW<3d7ui_aAwwF8x8vLWG0QXT$L zkeO`%Lc9qg6yvoYZkOdTjwo2lZ`;aEZqMHkKiH$^Vf5D&fp_BT0?Lo2cuM5+FNad{!HNuf!89;f%YOvZ%S-3)6Bl zLC2k0f8mX0E15#~p)Zjd_xQ_k9|b2WeK7xLVC;lB41^4Irk#MD&h3zo1Zs{?r4C>U z5f|Mhjryi2uD|lv2SKtsChRs@UgbsB9aY@iZvhe3q5H3Wd(|4zYHaqXm|_J2Qr{18 zQA1vKQ(;JlNWTB{oe-q$Zl5774cGQE#lJ%D^@h00aO_c;<~z!e=*2L_)Ir0~p9{gKC{l zb`TUNi(|0t1wnI5*6>qJf6!|MkUQ|^@*Yy2;uT?Ev}P{dWz(k6;Io?E$3#XbDtxk5 z5f=tKuhsX5k6iHF`T0zhQ~h;cymMDvMUuv**qd@z@A|qvt*UPh>I6y^YP|TGRqy(A zZCL5d0^tUjQwHgmBm*X_iNYi1bobA5R^JJyIm>BRGHI;p9ufG+&p?r<#^>hWdk!xq zYiKT29vO7vF?c6fo2hO3XsNMSYEE@_LWUdj%dy_??oEt1H zU0J75lhmrMrvLIKS$v-;#EITKP(fc?8zx4nIfrT7{_dn-J08E(J3bbTd6gT%jMx*| z-`ZKGBrG)?QovKWjqgz;n!@lVj(0bzGF2c(ghiV|i4&JESWr$?iOhvpS0_hu>d-Ax z>84!)cf9BOuEr(T*C?}GOLTu0?qI^yBfQ?yU(U&i`pd?)OJH__72N=M{ z)>aq8pF5BiJ_BG5D^O072e6~U>!r_ty((C9*Sz8B=St*oxxr+fEHS-`p{oDcW~;Tk z6#9x;`-!@9sBl`>)t2rJnp;eKnp`Es;>p`iZI?Gkva4rJx@{mtw`5vi-BXu&=FQLi zneqcXn$IiHZOO_HOpf+~Z-oPYGZ>x6IG}n$I>H{_^lK@PGcq9wiu#sYeS7yxn(Qgg zlAe!X+uio2wt|1#(Mp0{!fx8`bK74Zvb|&!)CE2Ms^7Nr)R6q?&@R(jaM|O}A3Bzu z`6FXDOV!?frBH;gZrBh*a@gX0F1sK1^|kPM!PdLBv=i1hEdw7Pq<%GS3Oi|Eazz9v z#?kkG4`uwtcA5h1qz>J(_hiw=SD!KCv)jxMUfm{7~Gj{&o z#V*0VO;5{88rOIL(rij)tkp}rgsora(7U?V@0jLJ!F4AUu+;hVYX3TM*t6eEhqth5 zQh_u6$1m68I-rc_iYe}>~O4# zKNS|5c7>r!<33y_K9FL}*GD=2z5HAd$y*1OXGQC#e`7n7qTcC&Bht!>lVQC_#_7p9ZY zbzLfBe>TtaPqE!k4zgQ!t(6t1hWOp2sus?SljhTmTTq9H8bAFh<`FM4z%lk}SMV3L zIjz|DM5z|^zx)#)Fg5G{+=r@YvAm?2lB4O)w@EdRJ-)V8M;l%APkZB~_4laxHn+5& zUd4jLmDeMSi+0z2LZu3HRlh&?5}VEVcAYqC@;~XD-qkF{JYOEfd|zqEj%(m$+V^SC zV%C_lea$k_Cg&+S_FHn!SJ>CTokX5{_a4tgo=_@mMoga&Hg)S7L(N5vE2Cm|Q*6&t zsNO34&1rtqQ&m!ctFMN`#GqB4j9J7hD`5ZYQ$y6Q@T<|VSH2%H?lfm12g1H`=|zn8 z1Jr_hoM|Rj@}TGzL0c_i>PtPrgW|wraN)U(J>p3qOAMy?h=hgXje)Ko5F4X0fq0|$ zpu*11%}2vthsFaGt4lUa8mM(6eu3JOFkUu#gf{&Id0%y7%b``LczRrWuJzfX8((p| ze#(;V_i#GL8P}l+NbL98b|P!xfY)YH*!u3~zk+Xbyp9l`x3H`g@ol=i-P4>p&*+9j zB%!3J-#*HZV7>f>=sbzCZS&N~84GUQ@-?^nU8x!FwIszx5Qn z{lmB>je)(Zi=v)gu{De;IlI;^*FKA_Pa|3hv^>*n1#Sete;wCYsP&C`+q$Z&Hoenj z8lZ-4=-U*9X7lIVuXHP~!iLLs_(Ph3_q->v&yUP0zmbDK?}oT%kRz+KZM*uO=8@zt z>sPfK``Wp+3$5!q{WXNOujg7==)RN=w2|5$RxnpBUlo43R<*Rkx5Q+h_xW5SxO6tJ zDz8JJADy#_ZZP zZ)#Pm^cfRB)fppxTGLY-F`aL}S0nelD@%7111ZF3`ZP(T`R+5ADXZiWQ+|AQSqJrl zDS}s23V<=LfDH5z6k(J4BDD(St-w4k8{l7FM7W)PpqvTb{gb$EYX|ZG66)?oLWl(r ztA;2@1w2i>H9iRMQPi(ae-~-mO3!vJJkg7{!UsrD3|;R)QUHg-Pys zRaKKJu-fA^cd2kY_^kgU>oaYLRyc$&VAZ3-eE*e&V)~8Ii^jRjSDRoK^PT;a)9LgC z0%>u6t@FxnBt;a7a;_?M_`*auYj2-F0J%D8UpMl!%dl3kuUf3>;?tq2O2tgnCg%6F ze3y!sA8`n6unoUt!Ih3{S)^0y1$=T`*gyJpJN+kArrcI5c7mejdgdgR7-r?zre3+_ zB&=@Dy#4W2ZSM^F%&VT0m`tJMbrb)~gLnfzho#Dr`Cp*|M#lZsg1VNk+NLizQHxTM zh1v61&^##G{5ID7=XR&xHpr`0e)pHvCaol>1@ib~%ZLs0}C@yw-wUU^ULSXxFO#N^S zSbMvZrI=j+aDCj}mxJW2umB(<`V26jJ40G)7NR&5gh4eneT~#=j2_oLu&B8zF4e@~ zO%cIZBUn9TSQnEgf0}yKcb97=>(0>6V9QnWS01GM0&8-e%@-MlJB(sZ+}adqpP${l zsd{H%!kwg*uJQcUfri|GLnTJ@TSIjVY3&c<8hf!VQoBAciMioRYcj4Eq1yU;ePcLZ<{c-X?se0z5 zL_8O!u$z1D#YU=qRhr+L#GN{1R>`e8nbFWuDTUtk_MUm-MdciG^+){;kIFf+kJL&7 zmGzYBZ%U>OH&kf0V&2>JLO4#~-|9Z$*QgpN9{$kuiv9Q8bBn5Jt>?t|YEr}*GwHe% zona0~A7W@u-Bx}s(GKI>JI*3ig&wme3YY$A&cs9txjEJ=7#?(6xBw605%(@x*pF~B zV%Mc7fMQLK_5R(Niago|_5qLc9MgDpcmZ1C8dOVCq*4nwEE!Tx;Nnjj^HTDBl}wyF z@+kqOmb&)liT1P?8Br4?v44-}X%#E>6xf;OD2Owq8yoG$Fdl8aJqVhkjt|#nBjTuJ zJHK3-_inae-92wH74ZCKyjSy{`Kd0;X0=-nt$N2!Yy_PSrWs@iYw9=5OdeP-<10+sh@gvn|t5$T+ao$*6Yr!dFpLc?*wIH zpF*tSc4<{HH#tTtmG)8Q!YXbg?F3pFf$TT!-!i{=zijNFzyH%;=O56#uyafiT=%Ls zlbfn69$6CbvDBTgn zZ%|X3R7~h|>u%w1%B4D)bEOwG)zS&oqg^uy#XK%a&3HF>w7An-L;$t{X)lPZAc3?} zgI&Z$=r-!l%YCOn!6THPxF()M2GLr78~a}+Dx1wEL&p67w2bTfUDEG2bv zvD%%#q(<5WHc7ase@xJjl~w62_2503(XdmQlCKcqNHFG|<>0&jQaN|h+AqlY*47AF`>a*4E;B#VXA4OrKM$Llv_}M z3oSyj3Q>g90?f+vWZ%c`9$ILz&A4LO016wC2L;Yl+~;`LjP978C?5oyTFQu!D!W~K z_{8SM>f(l042>dmOt`J!NXqXq5(D?{&j{k}*6KC4W=gX*oS)OxS1ih|)d~gXVQP)HHQZ0jY(?2?C9CnH>hkab}tAYgO5f5|Mc!e zvje|zUaG?}fzQfwwK->sPdVyKNU}3M{>7ydZQh9Qu06?(U8YnL5k@xgW^ZFdPWd`? zVF%R++R=TVHWE;4Eo!z{pm)u9oUd$9#G3Qd`B|(Qb;{)7LI9184qbQQWT5Zb zeFuhFhcchC%K7-8OSZg8T}c|eTjEEU7NB%@sCM71a&D4xaung*ADEmr4pE!5T8!8e zvWk5Rk-V37i@>|zYhJJW(wiYEpgCk=zbp)Ef)szU4j;DAxIg~UGf|#*zSQt_?poOh32$w=)2IS-TKDy&~ckR44c7JbQKF%iAkd)t_sGlUR6*hT);1GZyZoNRrtg zr<0QtJnPGrT%D7k+dFXkR^34LtgIJ_ReotM7(D`PT565ktR4#a2*`vz*oeFi7N1*! zXeJZT9|lx$v_F7q-{O7BhygH+W#IP%XaLJCZsh>|cr3!x_?=h2fnF465^xWXivW$X zHh`N0BW!$-{qqXYG%|~UOOJ&iZSr_W0qDE^0n9G&8xd8@5BC?K_xx@O(EKNz0W6+& zxY$DI08sg2P50t39S|wBdG^`77efo1T8t7ABv6KjYnCaQp`FQ}0wCZFi1b0jwG=8B z$HZejPLpO2yux361|&HPIrNfH!KO|nL2U7dTemPSLDARePm|qc!7yun1nEH!zX~+m z1TVU}q|VnNiREHF6Jc7oMy&1{NwQ_k*gf0^kod!>$oqrC`vf&Cvh#Z{J+}VxM|W%Q zTn>gXGSFY=od6UT&@lLF!L)A9ZDyA?&f!CfY%gt?0Ep5>NPXd&T#3PM7<^r# zVUoZlIjj+wruhQk3H11+z8z7IG`=2#fd2f-bI@jQ-*bC@Gv%-fOqPgnZN3-cjlEao zWtM}KP2j%XlTxtHZ$U+1L}DJxUG6S%|CI=KnF(#crOG7mjt^2GAL7-;t8D2!4>q!6A2X0_aZ3Ge>PL|Ly_%`pA)O{9SXRA3-8L-Dw26 zlAMj^lWGY~nW%YiSSwnA0}=2Q#pvM!P79x~wTa9jvKqZ{RH8mJiB$4 zI=;rBDdv}r%HfYbFD`U4Q46r|YFVjYgI*aO1c1fW*&*l$fiSomPaw(sC!Y# zQ(7$J1ULpI93hrSrX(YfX8?@6cQDC5q(+QDms}JeTnQT!5{JCdL=l|{VMg^>Q3FJ7 zUiy;JvL`2`p>WtOwAS6GBZW|IQW%804C+ygVWyBI9VaEKH-wDP37XTOyiynGnT4Q6 zG67G!bK%1;u);d~d2W# zQqL=xc-nY6tID9YgO@kAQn(|In#wb6B8}K4-XbJzA8E90owIPPYZl4&U-lSHC_~9} zaUqrNMRJmE3IjB7<1j;oLgujNr5p-)vvMC|2InYc-Fmh&5=b$%<5cWaE;sud9~(FSNb2ETugNI&W-2)KS^0UUiCCsl@|MmpE3(UIA@%ucT*3_4>t z&tIDNg}`MWPoO0g;c*G|Dr?%^+??IK!IPjsP(x<0RO^yZ8^C{2__riUozTyDh~C=q z8z~ZV82UECVIqMtXZ9eTY!H@2ewUA0NF4-UP9pIq!3mmmnIzBVPkx7wI#GGKlPsfe zpkzzwlF&FMgZF?{B!&m^F<%(~4bCx4@HRt8lKRJHXLPb(swy`b$2Kd|6VFZWG>9K| z-OvTuMVue?S{`ljZt(73?W?|b-phVYL-0j}!Rr)Q9`%q4j=Egq!I`HeMMh+ijFN4a zLm7U^7U@u+`K;1(*98uy&6-{$44#DqIPk#a8TSQ_X;eFyp`rW=0FzcF{wqQc=m6~G z=(ypnZ+7cmb^q**C8-94L$LNe)u|Elzt>U8%{BB?ygO zot`JY2E+{Hy>UE6wFD6|Mt#($)+GvHJ=1zb$gSB#rfWTM-^TP8pL;5%^$@an4IC{5 zBBkqqDH?c@<7!Dd6o~nI94yX*07cM>2Hl}{&^1z<20wtu&I9rpBD=Z3Iu68U0ydMD zVA;rSYzJA5z+C@PS#Zl#;HROXF$s*_z*?SBzO1XIt`48~ND=u7;{Lk)##PI|@8A4A z6nzDrb;K6%gv%1}R8M78j*W@g_5n#AU=EdO2MegP87SkT8nXqQ#B8UTy+NPv(q?}7v63HX@_19cNfvc znYloLstODx!PI($&0Shr8ZBMD(?8G;z9U2>vlbTVq@@6^dLK|w!2&N^4Sbsb|1EgX z=lstgy~Phe4psNMI575k0@wxGe&V?5&qUnCozJr2(8zyOiF--?j2x9{>6CM^B{1Vk{tIj_v8wk8GG7%RtQtHba5Oy-zm&au}i;&DNSErs#jP zdW=CxbN};$EBzi;!x^*1s!~M8y)794i2Z=c#oiR zi|%BJz1e5Ljsf>nro_d|dcJ{JT4m6Zz){%ygkDQp8*mP+ag?U~fD7FjYBZSp%Q3uF zR-=P6`ft_^qakR~`NEu`q{xSfW|`&QQT90`CUF#eej8C{0Pe`=H0!EcrHhWFgwR0} zVTvGmVPg3JuZff7?xUvQ3ebGwbE?u5Jn1xi2zS)PIkA|;Z4 z+S-TJCj<32i^%r|#G}+lx)b7Z%t9~zdLWO?7_rd(H;Bk*kGmc7DRtu_f(g@ak$IOF zLXnt|s)~BDGy)^>@FXPo$N(mUMF}^IzuV)8&(&2>whEINTQTnr1m&Yx=?A|F$xret zKhNs;t&GB6L?Q};BL=k^zZ45n;@Gs(hPkyV-Mvk}kH=5{=D^$u5v9bisR={|?3aKl zFljmlVI6%Ew4-z>+hz&HybxG17uOZBP6SMXAfLz5;i0Y5s$hU7{hmv??2&gB5CA@u z4}y6=-y^ZPu|INX#6@O*yPhnbe}qeZ%!|$6{O$V4^g(-M`ZOJle}p>&N+k#skgJY( z`Yn24CoPK~gZ|->!mSqlM)`*p3fBc2!~Tat2?v%d3bx^&9f2Lce=R4xM;+0^y)#td zzIKW537ZNmYO1I}^X9qp)S|Y&q)di{JyNRJcfIBF7w!)u=Ju9=sS*;5Q8P_;!wFv* z_V6O#M@v_CESoP@NfdGZ@VR`4(rODVQ3_lNgz)i8>-GKshmgnO1-x+IZ=6@e@Hhb_ zZW~a50I_bEsMH0}Zoyg@M`Y*;$F$B+E(D}YMLo^L z@#PTaNIJ7ru^DDIHuttAXT7_zMC&LiDq>NScc@I@b|uC>GQ`3oU-B}S$|gdvFSh3l zI_d&5R1FPrhu}qqxX53{7)A_N;U4yx=MDaYQ%(O;|5_gQYSUT#+&H=^$8B$ z@PW$k6!;UBa!pTgSaRfz=i##Gl=Wt$md>N`;gNM@n14;egX{-1Qh0R27{YEy-+}Xp-uub*$9qn68)@j4NS$ z1j+S~BefDFNAeD=n!(>TVcsF#6G7_Kfo4 zhFOct_jdN$buX0Pw5aS%F?}oXswi%-+?^im?F|QW#TT%dR#rBiDl1rQ$-A4Z4b)f9 z7V!Vs)8TiSKfLMO_W#Iw%c!ctwriX2?nb)18|m)u2I-WN5Ts!fA|TS;-O^nWf`Fue zlyoEcUf%cf#y7q({K4=CuI;t=+Uq>$oX5$v6wIK+sd)@_2pHq#L>0<9Mchc z013VM4DJ~zrfS+7ew9^tOoy29yn1K{^U!ukFgH0zX3RMmJ0{}IJPcGfbz^!6V$>9(rJr%&+$*P5IJPjTPjB0qQK zd%P@EobrV5&R9!twcL2oDBWxGVrS*{h@<>%(D%nn8ByVPXQ48*yr8f7T-y$AyP~OK zcQj`1ecp9nlq$c=vNw2iY-efTZ*?I4(x6K+h;lM)%a z`m**Q=jZhfaeL2A4pnvhyYSRx0;C*DgUYJ6;LzhK|F&nn$z)GQ)hjE1o8m0xDLlu= zkN@)k84T>qY%GtDadtfRYCYil7*wW#Jow^cW384_*Hd~)vzhs!n{XnLh~@m9qDS%i z-%G>+`9vm`TIY@Kr*`d;p2wzx*kV+p=10f-c*D4K)`#uGkXNEc_3z$*C^H4tUJ#(T+hGZ!5|k8$c;j8sG`h76VdQfQ1V)m{to-?PQlEQ)wxcKe8)WurZ{aaD$E6|!vZ%>ZX2Gb!(OmF};EV3yBEU2Wb{ylcB)edoMZa1Q+&N`QaxL`|Nf!!nf$@ zPfe2wz1w`Nbr|RamYKx)c|B#E8wX{w+$2gOKl7eg1uOPP_xRZ6)RjW$?e2rt-Dxc{ zYW%3l(EJqhUtP46-n1R2#6)lG#TW~^*mL9Xnl@YZU?cl=O_89TbvOk@N|zILi{rPF z@$J}zi3@xiAUGzUMdC_B{K}LsdgN=(Hg+|i%$O)EjUivX5u8MABj}`UNg1T8uS=^P z`@rVtud1%fjWE_$9g5uu13fT=J&f+RhW70uP_;F@Ggh9+d9=tWtnp0OZAlA?B;DkvYUj}n)r2AmzF zm#j{6gY!bC7=6EVYlxnl1;9|jp+odCKNo1kRU#<6Uu}lQ%fANWsFe5mTa5oxmMvhuK=FKIp-3qk4;Qo(Qf~)y{mTrado$JyRj{!|p z8JxHwW=GRiZHiXh;9`;Ae8jz9q4l%LzZNCb8!j9!tY*c(-k|tmACApa5wEf8g3zyr zRdNL{#vk)A&}T8e7k8fl#fpN(U`x$F-v@TI4ps>M9hKG0*MZq+h<38Dblyb~@L_wv z-teEV7ETRdk2Yo3H+5;YZOiO@foyt9s)Yn>vpp{UbrL{fuK2HWG70}iTJ~UiHMOhU z{@`zw2B%}D%qmr_#GfnK>^7ZZM^@c!^@ytI6~YR>0bRMJc&1X0qw}A+0lJ7U`W?w%^^dDCvXob>A-gFMKer`rt{iPPQd^=)3$?Td zy-p#HO>#WUx?OC{xsZ3jK}O7?x0ZD2w=Q6|g)0C;l5OO7$_2|XY@{fy z3Nk(2it$|5>Pst^ghkK0!V?V`y-Nc{L>cgX<%WdG7w|Z`hX+dXcD#ivnJ400H=H-N z;_N7c?s8xLJ_u|Coqk$;{?J(C?a%F*m~i?l|IHi&n~7iufK-A}p}7iaYWaYhyj#Xp zgS;)ti+<4*ONW$0$Mx%Gmr-T3-&qP(G0NJ)0V(|5oCPm3+gepZht?k{HQR+X9R2%* zfI%!7&iA1-z5E+*2lSe;FXVLf%+`K>*)dZ#?KXV7qvtPEE~#R>R&yq=YpH5;y3@d| zyhHq__s2Mlc6+Mu7dJB|bm783CU4hbobYFMw^T<6t0Wq3Ra`&I|M36BP*!87Ul9B5 zb^ED_p5-U?YC*H6my(gf`7z_>uj(e4EIYgf&2qFG_(PEvv?rcI8JkL_{#|7)leLfy z6pGF*R(>75{FkL4{hn@B?5VVU-OZLhk4CTG79YfyH~zFOb^8Q2mt}f<^RZoK;vPrYDt~zC&AlO`qR- zJLe*Ni6$+hL>)XbiXLJDSy=iilk zs=Wfoa|FrmYo>SP639r9qoP|meSVj5ZTeLJ?W@@8Zal%>O_#~1d5Srq;&KPrY&;zD z=1c#iItn@HDXRF8b!9wW(7@x~;+=Ns7&=wR8ms;Opc|n@cTzX)wzDvVvQ{3OH(stx zgyMTDn0;8CP$^=&Fn0LE7_!cWTK>Jxk;~mMK?_tcdjo&npBCWoVAKB72#wmBRb3WW zevaCLcaP^9(AVP3U?ts3I5b~iYTGLM$H?@;+wu&Oe}V4vmAT>k7kpU!cv5EfHo`l- z0|+7BVrr_$ZEl+$iR8;T+oBVZ<{O0_k*6QnJ}bCFnwuP&j{B)QA2gOiP6A%H3(Q*2 zI}49TDWo_)^;N;Nl5o4=OIviOxk{MA+ak>Wv_f_2p{Os=D|f|RSiTU~CDXg~rSK}z zsZFlLVs|eZ7aJ$m{AnxhFsV?XrF~5#lwO|EdXO3}h-Tdx^Q5mF+h6f5=`$9C*uvlK z&xbTvq7wi6u};SiNxZC%GO4nry2e9i@y?kdU~I=DU0~jtj;_PSH$*EPwy; zihFC?@3D6`Uyj4)ejcN^;-&oQ-tnph*8dzbCy?V=SzDT$(NWrVTlGz!r68)o9HO_ocY>o^?sg=I6n&;d;Bs^tZKu;L%BP2UiK#pqB&E zHBDXHK{eAU5%1!oUoNNhD9zL?eq|I;taQ?L= zi|8sXWLDfw+y(Xah}-{L#!euHEq;b#OcdNSB^a3~)Z?P^vXl%;8!Ac)zIzAqV!l>W zkCh*mE(i6vG@d7R=H2gv@KBD|8>eIGoDQ?nI7|q2j&2vpCaN2B>Ur9?ZTMX~7OT4A z64Ty&{k?yk)ZtvASE$E#$m2UZJKl=mddL|JyYjfUxMqAgU!6*AM8ah)l&V3X?GiPa z-E;Z9&v+{T(zn-<1!Kd|?@rB9%haP1`3uLbv3uKbn`-6M4{X>S`gw-%g`TxQ|86aE zyAz6T>Ppsvmh9;fkB#Q}*zKAxX@B^4Si5Qk$s;9r+m!LCOSHAQ@c}A=L&>l61)#TqhJO8iRd)XyH@s zD3u>G)R<3JerY^MvhyWtb=;1KK8FyhKpu<2AgDdf3VVC<9q zCdyS6k@d;yE=^S+TclB%E%Nw-PKldD>q!Q#n1Aq(i zJy4bM>-}8@pS*s~Z+MtJM#&D20LB$5GGf23+5jO zTIpTed4O4;r+D21tgub|_B|u`f_EUZaf#Hc0lk?@R?%F>0n@83r>>6X5Vy%cPNobe zk%1lYri-p;nct(0ns3QYp4BAzjs@HvOHjW|rS($lA~)Y#)m_ea#bFS3-S6~%VnDI% zt7*J3y{af*;keCdq?ssOcaSLA%MzmzFf$BX6R;Ti?6!9-re8f=B{uiw`|w(8kanx> zb!PKN=wKoDo6%zXDP6gMZw4#A!_PbNr|c4MgC75&Y71nE=>8_{`aSc@P^5Cpaj8l* zjz3r8i`$i{yT$R)vYK`)&YK`^i$4FT%r?Htxw}tr*%NQcD&xxw>M}bv_m9{Z2u?*$ zKKUt}!TbU#K*!B|LSl)?sPTyjpxRzOK0X@Bn+A#M7#rgA2K780yGdIfG6k~}Vj?m? z$glTqH@;0xbpw?9sHQazR`?1&8qvDLYPL>^mfZbbR*gjye~~EHPArSPR67oe9d|zy z57s4u)>IpJ;W(vkciEFqv`9&3GVKH(p6Yz51#Qhoj?A(cW_2ZhoC$zua9R{0|2%67v}Dlu z5L$p_RV^DYdU7G)4-Drj#9Nzh*`KCfYQtC%cJMxFREE0VU63S^fsF+R zB?31_hnM8`z7TCDTY(dnwpPn0Evy<=$)9>0H!+ZFMN5v?hEC^ILA=G;vwxZT)o8UV zTz`$lDzQoj+m8CuoPy%+JrdkBW+Fc3*q$c`H!u=`%pgc60AGf>smmK%S$|tuTYp&} ze_3jrr|a4f)lKdAsLmSUi9{Mz;kl5JKI;r@vZj@t+r_ppae2Y5`VjKpNN|n`Nt-B! z;N9Bjm2q>d;{N=jJWxY-kGk?bm8%e(i23I zKMP*aa%Zi(wNIc0Jf;Z{)gO;I_Ppuop9&U$V`i&ew7xf4tz0%bF&oCeGCH8@zzT&S zrBCD_I&Z&jru3>#ZWjjvVK`W3jet3Ib#?V0Z~?@H1>81-0pa-P<=#}TnD6;f zdsSTe^R~n@Y)adg+;l)2cqcDfgrkWxxalrKjlF8;??cWjEjq})j*qf^Ow(;NVP3g? z+BUt5CP+`z@P?k~Eb__Bj}bu;j;IMA<^H_dvJsW!fv0y=9tpn|B{hO2 zX#e{>+57ZlK@rANqVky=b@H>A)B38=X@OVMqHbvFHav zzqony7#D10Vk9<%2>O`Iz@^kOz$Ng6?%}x;bJ9BCoeGC^7zEkXqA5dSe<*k^cT3#X zh$54SLD3v-Sh;QoLq@F6phV`CAK04z=SlmD^$dyP;!6p3;)r#v<+n38d+Sh*Qa1|BD0xiUmPdD)CD@caeEM({rFuZlt zmOc12RTb|s!}9A8&0X)W-|(in3uhaE`$d=8SE@{*f|;ua6Lv)U+1j;nr$gRO=;EVV z$0Nc`V)_XFAuOVZftgTJ%>k9-qtlzs#EJ@%^oftZd7qXA9%SA0W_CP>w#NQs3P13O z)vndrzQ%u@X_Qth@iAU*n@Gb@moR2{jiP`~F1f6%N{tr3wAn}PB11>}(4CZ`gypji zK)Ni`b|}6S8*y9?FU6n^B*Wniw9P2SGH8|2NmmWb1`DJ}IQRukqDWgaA0eM39>6z# zX0gj)FY8B(zx6wsCjB@@OPCBnGGh`z17HAyHwq~FUM)5HPRCGit=5XDq zJf>(^ijK)e<2kIkxylY9-GBJ%zjic?PpzbnZ;dZsY8c0L7S_;HG+LVz$mpu_Es~($ z@HO=B6x(hlss29b86may%y3t;u7`smD%`LsBZR7`t0*Xd*=~p66+|(?S1C@?gqIV^ z;m&*19|@g*k!}CUDm(sJu>_k7pP{o!qR~gt#Jif#x?VwPXsLT9P5a5dYji&jqDJEB zYmveq&+Pq2VkH_avL25KT1A8q=3~+zKV(%Kk2;2;1jKiL#z%WV@225!-&0dBv}sIB zU#z~hhIgvhJi`)L0cgWfi#qmM$(#yM1d02JD+#p4c=aT2PW}Gpd{P67Y0&-*m8;Q- zi>tnxP(cVt=y%AwN(80DoXDXF6=NyanD?kr3H$+U0bu!;JM|u6B5@}`q6u#uGISr% zR%1CP2ktM%%{GfZnEQT?Bq1QkWou2iB+9RV9V&<>kIum>jsD_j;^ISyyn z1&s0Y1bBEBM6mflxaS})!9Z2d66{Ngi;Dw-E!ffbgOWmzSe$#9<)4V%oZQ$U7R0~H>AT=@RGvCF{e4vB}TX+~FoZjz+e(?DGm0%jV#m6>>S12v8*VZ^I# zkM>Gt=4uN@c=aLNNfp-O==CMs8J~M8+SBz8iZfDoWm}hor|?Gij5mN>5$S1J%Zs~& zoDB~z3li1#g-{H$1Y9Tw*%W}pQjax|@s^hdYxlDgFiz+%V3r0HXkg%S@~R2p>{etv z85ye`*CMNi1P8Ng`q?V>rH=939EtZ5yf$|txDI_E)KwC<^Il5lJqVV2$q3CwKu=N; zLKJDFky9pr1GhzuNqhflLkD;bBc`H2l?H}h_XHxC8!{nJIDa`VpuCq5MgW1e2xSbw zE9xtV@gi(EQxxs$7~M?%-BBz)37}AH>HP(E=!qcPjrH62o>_PiXhn5(SOTTwyw922 zJ&zMTc`kq(^_yu=T-5y+)JgakAr_WH;4Hf`(9?ShU_L09mzUTRAi|Dg(&?An0(ceu zDL~qv)$c;|7zQNKst?j%%eyLx`vyIoQ5-XzNGeB~Mr3NqS1RA;&9qmxURxOs5AFZT7ZIp!&*H1s;l@k&y}R-S);V;b|GkB+&=>r@pN)GH6D)DDN=T7{ zL(`Ok?$MQ@hxS62Y?lK>#CWCg@T3NuCKz@W08LWGXd((@f`>419af+5uluD>nr|m! z1VS;mYdxZlV~#-~I&(FjE#^_wP;j#qQ3doJJ7lZgDYfhsL}~gps!5aCxMz`D6Dvqn z889KFycgY%qvF&z!BEP0x0H!Smr+VM4X{x1V*op9fMD>W!B$z#(2X_!pXotV`qwD_ z=IC-DQ2Ix`klWf0NGrMW|LgkmcYTnRv)-f{mIBNQz8gV=gfWuN+^KgoXFmlkk*ciF&$;dKvyyZ?+1ejUKL8=)=S&(teMG?vHs zIwSbu`Y$-DbgmZFkd@rG-S05tJiwCg}(0 zdeIc3i{Ys>`;DxY&v)aKCkAc5b$A|N_PqEeeuexkud4XjWxoMF#5&BtwMLP+BH-|= zuAu=XjU`pcc_}HUtAoUhAw5IUy1F1q=rvX2EWjfH2c{+eV%(?U9czyM%-=ZHL|<88 z4gq+LYns)sEE>NpMQuvSmr88k5W=>_eyA`~T6v zZGf@RAbZu6?EE71%lkFrLn1C$(zRF-EOR-w9Y3rS#0rNAIUFt}hcFJw6lU&J?fz^P zmPe9XHkWo|??e)yeYvLmqdKiO*rKiz(5)UXg`$nO?+FbV*P|EB0h=*Rr$t{F2q2~q zi~4a2kouBmw%2=Ht=2oYo=>ed9aT|5>3}f^O$^+7sX{F##@3=yXSx&7O3SuVcV+Y) zh7mWfm+}h}m@|3gA`8V>*WaVF4h|=%%HNrz2+5N217h80BceE|(9)TZBa?JVA7MF5 z88~*okm2YJ%k{e4m>~pm7;at{(Y1q?vLV|>k&+~*D3&Y{-x_|37gU-YVILIXJ)>WZ z?q-ATO~q-4aeLGQ?!Sn#1lNLqDd~+NYA-4?J2HP~;@P3wrh794U6`+zo(#ba+Knq%_yZP4YeImlr&{%%Vpf`Xo5GDgI+ zqN+atKp`R~8Y?@&p;NC?P9ZG*3!VCpucSFp2`3NNstY&vEPrYI%4)yVE+4$-n@}fP z54oE;cc4{7i}AbyMX?Ow2)D{51#p>@oW6(%oPXmpWruzjqAys+P*02g$IxwY!)R}M zFdFk&CdEi4!nq0kjI0&h?IsKms-$Tjt`5RIZOS5I#h>r2(VpjWp9d$sqNtrW+!9d! z_aw|)Sa)Zz!H>BLYZlIz&=|_lmV17hNn!A$vsubm`k|#w`9zvb3_^4(BV^^!n@klW z`bES9lf+%XPqNA5%cf&_F`MpxU7o(!uBbhU5_FJ0H)^Q1>@#t}*JM9I$h@tX3;DD+ z8K*-o=L8_F!Y!A-`~%YgI?igs2f-_ac$jl6D5|Q~j-$SxvyF7-oqk-USeU$$r+(6C zk-=?0es<2G)V?2xC}RW`YL+Q-eR%TkeB|}8LvgQ-?!<}Up-m#!|45}xvayqvh6^wp z^^OAapjLr|bKeoj<9`2>81hK7iNw!ofE4fF+tV8zpILK|?D1O41O}4zr)5bIp##9G zSW54_l>jb8Q64U0@*QyIz495pTXw2_Jq)K9ARk}ZPrNzA`K2w2*t!CFiU^eg9hyFt zMY$}hd^w#ehR9@S$X1Pr5FI=6ri>1+*Oc3bNEFnvM&pLhj&UNQlY9t0A*54bs!Xmy zUi;Tl3hGarcjmWFKI;lX`69chlSx?a-H>k&#|J%pYsH`xg(GD%Zb;p?`7q*CsVSLRE^5f&?R9<@LYLQ8yx*oqkZncrcska%!&)E zdAH|}3cf)(xVcPB1Lsj|(q2w>=%TRg5;CXH(lw};RR;+^3iwVG!uF;S)fOWy=JjHE z`J2}+KRed8J$#PmYXnaro9EKGSEFZ!ZVYNdS7O;P(%%4& zAuF365)0YRB*GdOCe*X_PT_~hrUJM?3)UL$%lLD$pNDn7ko^s_W=M5qe(0#?ij#|l z8X@$Pqj0yHY`_1vRVegB66jMSHtVBtm&T#1dw2fJkBq;_kNT0D)bYl4Rbe$NtKp>> zg@21+NZX5Yt9r?H+rOQq&EFl``3AeUydHO?`jxs%$pkMLrdKJhV4~h|l-zFn*_<#2 z(Y$$4!w;osqFInPRlv$BrX)#jMHFNlKsQB57e*Agx1+QBvYrZ0)F^e$wBx?o$xVRB01E`Fn}1q@|1h ziPvL6NQ&xft$RiU9+lu?B9m5_Sm^nmdauN!O;7jVQtnJ+`|dKR7LLPpGE(+QOdKql z$dxrMDa!_;G4-47WlfBWryd6R87sCDebG3PyKhBs$D&8-LP$#&WAv0c2Q_QiCGi{k zNJ`Sy64`C^u8U?-VLFn~Du|f;*Rr(HwvDtEa8Z&=@e#bb1nI(!I(A|B*#C*4b!L>~ z(!lm_@6*7rqc?b3_eoCcG}>d(Iq4el_T@_bWl$|vl_ikt>S})$_7v8dYBCb_$(<;3 zla#-QGUSo#no(i!1mC9uCg*^yVP_1+hPG-iKRQJQQL#2#n$#QEF1`l2hI9tH3=hhq$Mr7^& z{{3ozsq1iahVyBs(}gEUv+`IbC;sM>cPvi8ECLU#cWm&o<4V&;Y3!T%HO=Bu{b^+X zOej37&X)JkQh^4=BL(u~*%>1O4uTd*i@0?>XVoXP?bjKuroiqLwH|f z4#>dz8z)O()%Tkv_F>DFmxp;AebU~$@%*MVag_KxbHIacuWBo5Cxo6T@XMF)F=CmUbOFL z@K(VOx2pD>|4{U0sf3^ZKkopQc59Dsm}gik z?iEPp|Iii(DRjzhm6jN;vIW5;4XMZ;c?4-3-EM%Ha3`p$r6zQ4io_L^b z!f-=_z!^gtZ&~oc=t?`{XX;$moWdZ=omjH_=&`rIN#v7=b}r>D_SuSrkraOQOl>Y= zA)zD!T}IIw7M+4t7$*vJ<`@rkWXw~&0$yp%ZB>^;uVpQ-vp&(_2MjLmQ_UrvJ8D$I@24}DAn|bGz@FKr?$dbn zf3V_=}RKJut7x(vl=05y}kff27wwu}2LG7!da9Z(nWmum%=T=V|OYb$gJC zfLwrV+cqB5QGX=iDX_yszgqxPG`59#i_f9nQ_Q#X?GX=`5Ap!9WH+G_JdwsGmB)PA{z%d?E7J9=;Q;Bh9DN{Icu2Niz)wyoX+GPr zwX!38H5gnZ^AD_>D zxS3EvlBSo9cRV@gC6T0WORMT_922mWE8509T6uo>RMKOx`K(h8R{h5QqLN}W3 z=yrg&FUhqTY{aq@dVu^f*kB=bmQnNeA#m6I0)~Fg3=ka6(0$=UHp@7Tvq+6%kUVg}@dhox_Q-T~83< zjZVj5PzNOtl>&-nJmA12YYJ8y&&esE^VSNM{=mHFUUlQ=oP9r))8Fs5JSD1o-p{N4 z4$<^KYJw02oSP^mL#Os8bK2jXhkf;Roz4<^c>Ei8Hj^Xvppb?ywB??rXxW;PhBRIdtd79{;c#g|6G{SYHKjWa3XJWFb3B^R{936P%go0w^`KgmGsAd zCBxM0Ty#*+CHQc83`rAF&>+gX=czHOD=kEv`f)_T@iU9gY#Q45>@fZazg>(dxA({( zb$Rm}l7V0sD&0`!$z)3{2-=Rr9Lq<&OgF(|!X``7ymnV*WZkRi_^wDe3C;iUe8-`k ztbk+@Bxfaq*)@<1?wMRdEwcaO!n2c9{`i%kRxn5wo%{u>Ja11Bk>UsA`%2n{I+?p)CxK4LyUI-i%O!H5F2JB^kn%c_rN=C-_{dv=+)m1D*D1D+a+mKJN5Bz|oeU`TMU-XbdbwK08*l@s3(Blfu-Xnp(5jdA&(uD5T_$49w7l z1B2wG^RKGUZ=aME6{5MchK9pFcLv_FUoPZJBMvLz^Yc_{{0m9!6Dm52`23M!%WOtq zXHPzHs_lwY+s(yE1v41>KvJKSbD?}kUKVP?&JlhFBf*z-%U3Ea>}0wsG{p1-Q`YKv z44>g6p-7Ts@aeKZUgYC$#vtdIMp&N>g@JNdF42E63jxV}_8)R-cN>Hiw{cErqKx=w|o~(D2{-X3%;i3`X$cj+O=z`PA-~~uf z;G?6&-JZwnzlr+@t**45IQ-mFmN(sLsV0r)zdCgWi8^@o8NTJSsXOha>!Y8zFO|7X z3z%=M_rT<6@s-{5XhYT$u+C{H6Nl~8a-lJU?iCwVN%^H@-5$@?XJVXjc*3EePF)mb zUh8bc5~S(HQ}96EpDxu~FH9ahymc|}bm&_&Z#~@z$(xpk!#bH8v3va_t=#czNfe#z z7PLQsbxLHbErs~Q5l?|Y3o6miB1PQcyFG~)ViJq*W&sCu&Y|^oQ(0q7DJnE%a%K|S z%FeUhL4m1Q{9KGgPJkH?YDH;y-rc$DXd?Y5=u6OdJ%@S)1J=4zBR4@>2jf z+GKzk-3K)HqwI6nd9YzlVH3hYrM4`Me<{F!@HSZizV3K;~I2KUZ$!+aU< z2W0Wb&$lOWPKYX`B`C0JW1(EraZDJv{p74(aSN*6Nxqa3xIuP_=SsYeW~)VLWit5& zf=^n0ERs)JWQ2ii*a^sp`Hk**K#0Xs+LAdLKWTwoZG*XUrqB<(=z@@Ve-HB#NsaDBt& zkV^uo03@5^t6wLP?tLTuDnZW4aqC72Ri`XjFQ;Ziu2o_@4!ND7o<_OCT%x$cj{;j= z+3T6Ufo|88fQOcZN`1B=BAq^C2heN=)!!y0${|hy)0=pRE)ul)?tFIHd>b129+Yxn zn9i2J@uSMI5uJTm2_};UxL8U)*|FoSN42$pn}Zch`X#VIYtiXZ` zMmlHV#t>1MmA5rcZ3-Axl_}}zet3Cyam+#R`cbvQ+2YZ>1#TsIF3E+_|);z(j?AO51o2tk=n3YM`z+pnl??>`?vE zq7fz)1~oZDQ$PqY2!oDC3baslmW=;ggra>dnnxx#N%Zk~6QdC>opTR~Qy2wVNw7dw zo%=QZ4x@}DCh`91hka#dL zzc1Qp?(8m_R$=mGKcA`oP`l)`@K-u=r#9iff?8aD^b`f&k*+Ia3}qp?pK2s7i8@W& zp7Q`&gzib8)L`)2&MVxj#Z~j?q8R0J4kyt+{&{~88Ja9}%vv#Z6z|)MC3|gO-h?y` zb02RYv22fXq~4ZYm})(XFzXeB`R3C-5RGe7K~l`-@j9(b5m9oL13XxhfA_eUqq4|H zcu`gb6kM^^yy==MtufRpRMyKuAuQ8qX^7P=((%W9rgrb_;l}J$823?@Mb*8liM6lf zRBo3u^kI%)b;0i`!qL}ZRUcB)t;RP)cyI1B)c-Vs$%Bh>OR)^s?_R2nv$tr^gCX2tC#gmVGCk6FnLngO{vUw(4JW$>DlLQn=+me%chCtkc<4RkvVD z4jDP(i2h!FcCz+o{NLhz(3<&^PKm(Nb43wKM1SyH@QPT4>KrACf%kTm*Us*4I^HL+ z$@m;u%h}Vbsc-vIK3XS1P<&_*Y<9D@vIt73ywC721GC9kCQvRt-9(&Nj-KoA=LWc% zK7C3Zu|hV*!LaN^xt9ic!glXX&#Y)RQ}+LRvj06~OtFg|45y>JD4TRzo(&S&kIY&p z>x;XDbPOfSwOa0k4@#&K&zGdi=~FlGjs&b(mz5#!+IdUU>V`aVo9;XtIi5mZYF~ux zcX33x6$d}gD$HE5o3{PxYF&R!4|$C8-FUbCc%TiZvKgBDL6REhWTxfY-ZyddKx<1k zsSv|v`-whS5lD(q%jp$m$P0hzYu~GIfiF{ES_F6Xy-L{w4)lAfnX7rTAZ~%zk6Uwg zFMAwuV1$&=r|aZw%Fiz72=%y{3!QwA`z^8P!(Tsm%UY>Z~kC$-(hrYl z$yeg;>JSpddNsrE`ZCH$6yr(8W4Xoga;@)saWNJM+o!?H?|&b^@p$7KDe>#ZU&dSC1`(0ZkW+ z>wb;$x!u3NS?sT2iaW2>baB`WX*n)e{d~FkK0$~7$-6Y-|MSTzw``zHf<35>KuYjN z9=RgL`$P87{a5z6o{l-IG=(px;%j#I-+;3-Y?@&;=kG_Cz8eq9qB*Ob!P3(;rfOso z!cGhEFNZJBFW*etMt3|w=GF-a9@im9!M&l-FApIvr(0WA7kFkM{|}T`N{<8QP5_TYS`EOv2{;^}=KxqhaHp~)VgE0 z$gP`J>6-~;N$w{x&4Tf-Uk5lYAnbbQ)YR0rKix#!zlfI#SVXBRJ_I4RK(4lZ#dFi? zH~qq3(kJlI5I{QZ#_15r$6MUCr>{>=H6b`dmG0x`(~ADhItT-f`5)cVU|3_?-`ucz?9l^#12^{-uv&M`EL6)vGm<-{DtlFu5`AC(vv6IefPt z+Ctt+%BZIKtUzy-94(9cz$GLisr7+ZQl9&o3yl~nLGHSI&6?zTgC1MyfL@pyLpn%a%Aat8{!jOeJMTH%qg|l-^EK{w)|CD}1w-Iu4>*}G zb+w*aRm5|FH}tC9Rk@^_27)fl^nd@kvJq=pnVZw-=;-eo*mSru(#&D+I_lA%l_mJ1 z2)-%?wg2x!d4<)vbO(tZeJ)_ov^_bvi!*-MWejP#*k!6*ufA*jHJ-6$2rW@`g+WB% z$YM{MmwPwLIvurAgkxu9c*e*vDmM0C*ks99Hh*E$HVDz~V4!n}(UKqgLjRxZx_jk! zZXg~qlYSMjZB{Gr+bfC*!?3$f%cOF9e(ZC6 zB2S(`%go;|?4~LBE1e%+7dfgUVDtf|&$}Va=E*WQm*}JQ(ib)1Ty~qBs?cc^;iusA z4VU})yr*k2FT02*J<%SX0v5#Y>qM}8{?h1v z5aI%0%O9Vi(-+P6Zs=2D&(fIC5jr(@*uzmil0B`jh*2ki-R#}9aP8K4a>obxGVv0ohy zuSDKDTw4q)R86UjjfG_!?+Fx5P12@WQ0>IX!0?oP*I(W7q@s))5~Ln(Bf^f*5yN{M z0;n592;zuQ0|{ttwdYc++p~UEQ=8}8s)aFGVOz_>r6Zi@L^qWmt+?KW9ROcw>-6>& zDSOJax5y#c^4g{VR&T;D${7`kkb*I(2Z2tkQY64ORXyXmql_AO&2|FutcFh7OqD__ z%;$&lH`0`4=}@Nsn3W=LhKZPmBCjgs$W*G!{7DKnz}=zghZ18x@~grw0{S=KLeUE4 za3Y$dFu9R56p)_^(lig>YfG6o6<}2+$*`$9Kxj*K-YD)8TWi$dQ_E3V|5iZWL9)Ok z4x~L0nt%H}OY~J@xx+9K_x<-*F;HEvRPgCiY2u+SBr%iX7bno}j(fH;v@BW7OpSkE zis)+T>XSqok|%tzWZ9`g6*T3eD2zNDl~tzIx{9z18q=5vnfXcH4|`7e7-q9+ImvgZ2^Zi+d}CzK@Amz2tnz3DJo-uD+8^)}&TYE$24~*=rRN z`{;0McCQH3m-Q!3)##-i2I{?!K%7YLr{}mKY-8Ua3@XcJZvNe z-YoCcic^wYRb`oY%C*kx@XV=(LCgl;WZV#X z*l|i0h#MC^ddcrU&AJp;6N`>$hU)(Cal{&m*DJO)AFe1U{8-t8`@r?M z$4nvShSQH$6tf%NL035U#^A<`EDhkVI2a6HNCD4{O{U9ju>7PK@iDdZg@sQdO z9WTm0@oekgFWyX3oMcs)uCV+tySn=5z&pk3xHoNZl{b@U*Efw-1xNm)4#8kxwFu}W z&X|mreW0ANKEsgni1DgRnrb4F{+_)sNw4XLzbK}^WAdzs$_Wyr$!d){#z^T*BI`R} z=4_%T%5~;qKcF4i2>!5hr=(J(8oy?GTk!3W=QJ^TNqsTmWrc?N!8MqO`>ddm&VfPhw8b;wr7<~JJbAaBPqu4p*O8w#N@3Ph zr%A2R(wgRRi1TK;>2>>taiJ0L2Fa}4S=L?4 z-iMPTnxTRJwxohqv|ORGZvt&pZj4)!528mCUGR#Z_=F9=-WW?Ll($W9(-xb1mRT|3 z$I?f~3C755Gs-g*0LE^q8U@Gbv{=w1lB!9wuJ7rpHz`Hp^i@RITaDCbl$iC|TK(+j zVUDM6ERke^gdT`yxHiJnQ{=a|AH5yCAMgGbS8o|s<<_nZgLDZKqnDRX#|lJ zknZkMx+Wn=cS;FLBMlNF-Cfe%pfr4gXRo#Q^M30%)*mtM826QDI0`SGF;PGInoBsa z9cAq5%0u)f;L8QdfqFG<7YDx-FjpJ_=vGJ<D z*x%zl^$r&^1K3e5#p`kSy@Lc#D^ArF0=>vBe`6t+uLT$!-j1eaw3B1E7J}0jU|rv?bUU9aPCgB~@bX z)EUKG=Z0ZCHF0?BB2L@a8;#kDQnsBagNZ9EO`k>(Z}citz}__!%f zFW-Vc)}&9Y*0qraYr4+nXAc z;F;$4kMDLO{>BwV(!1^r-*(kBU1FKtm$hE|0)JBC3|H5`o5w|?#(DZ@ThG`oNF~a& zG!}rp1kf}cVhb3+c;*ZS>#M(_WyH!1JExV(Z}^_#!mR)}3TUN)MyJsS09E(I%=(in zd~Ura2_cUk8FxkUyKLc+a?>5HC+R;X;aCDFR{)~A0_K|*4=B@Go0&==X~T!pU=6(V ziXTMP4BL_I5}8#CuqpWPI<#`ZN9#NfHVa?_HVu!hJq#$shd>_3OuxIwrh{$_-f4H8 zXrq=~O)dU!iYw#B%)JAz=ZPa5yv4cl<>SJKYi8d#6YZz)IGfXdnO@M0 z%`N6FY7$w;Wl556lNu~K2}*#d*u7D#UrDLnT>JQw{5;`(u3>&Jg^zyc9i7UcSU;&M zy;8G^ddlkwM?!cW-_s6eQl;IMzh4B472~h>aJ%a8>bUl&j=DLJFGB-ZZYZs_^+h<- z-=HTgje+yl?X`|-5L|)D-1+BoTz(n*GjLXPLA&?z_XkOx8|DE^YfYUT*c-?k-tqY%;*y= zkkb`W3!Vdz4#zedBje`jkZ9;WNk(RVh{5>Zi_sPXfPVu<7Wz)k&Ldqm&c^py_ou!z zEWqZX_Qgw4BV;KG#ElomF0f1;GK2kyQ#W57Ns)j^5ge^UTYED9iHB~|5)BS_Be7_50NrB&# zU`XThjCodOt3!U*_Ds#;Qnn%8OWVaO+g3yX{a-8n#XsEX!`5!!^%dbuQ{B>97#-Lr z1C3qAK^#&cdOOm9AMdm4f&JCZ<>@#O@x)v)p#Gc^&<~C(Aa^LG^Z9cjzQz!VL$CyN zk?(Ps!QBq>w6`mj^78UD@!(94A+v}hM8l%FVGqbjCU!Qqf?q)CZ*|h43HZM9dtY%= zVJJua(g6s3pmRyWxtfp1HT=U3N0lF{jNwCKfV+qhW?f~|6#gVZu7k4&g#!u_+I8qc;QqTQ94VhH#Z*& zqQq4O5njcO%w!E*d#n5nslS{mR3bljzdy}F!y)lLyU4T^oV1&*8{^K!A|AL+^1T%W zmWi_NYJ+>?V(FE?q;N~5LahR_XzTuHrGE_qgc65duO+wD?l%u#J-C^-`{_Gn8T_$~ zOUp!NLtI{G7R@L8P7#iK^YvWTY4|Hd2k!DAxYSD3lBf>O%P(HbhDZ?6eq+iB7Yx>s zJCAVE5IKHufPLixqm7`Ra}WUwVf%^ViG*jG7C&=8K3(}u4Vkh3{dkkvH|MvC!~V|C zk2Gd#y5wL_9?O*JH8eTzCa(U9q7d;as%vV$vzB^sJqb-76A1uv*aTG$6v=S% zmBHnMeB|912VkuNMEKhH=En`7ak{Sow{N{aO z?OR<0ru$c{X%z?B_w}KIk-w`C6bWNS7ZoOcM{04n%=}$EophzB^%$$qO=IKnT;0BN zcK@5v?0qvE#~2RvHnY1e+P!#sT}oM}^6u54qidl+)2Z&kFiNA~NBsr6>6>rFy+ael z8gz-&Lp&!)JG+j%8&usrrzI_8lYdhyTze;2%+MTjRPkq zCX>U(<_C}Fr(m_Y?xdK`7bDgL(hTx%fESUJyu!3P%8K zKKl7hr03y<_yNgY~?S{(KcbYV~?9LV*`cZjb;ZO(w&9RNNVLERfS4kat_d8@0gWodCr8fC$!-dOm7G^8_#FIVoI=_4TheFDp7#?j6VwQF zP>PoTCA^&>sjiRY=V0W<{G0k+z~i#+ z&KT2i7colPGFF7e0GDa$aXV^vu)`xwjN$C_mo_Uo1*gAvL6tg91gCv^#ml_4#9iIBENB?K{+n$$=)kC89>DlOgIk?{t zTWCy-s$kEAgn+y;K?ErWyx<)?R+av^g5<}IK7e%?ZXn-2d5}>~HS?LazPlXqHT#9q zaqzqK9&G4MONW1uj9`cxun-LP8xzu+>gh#IrBNA3RA5DRHpxUC+@8K4NPMnsEhVH{ z@X_Z_>td60qsPdKXX{n1uipXKQe58Oh~CRS|CKHo;d}1x`)dLw+Plv~e{t!*Kvo*4 z6WAEWDjeZo)5b}Mo&)=x_nd0~n zpJ{xW`c_B4Y?#(-WQL;};1hsC-?Qr%-gpRR?1qL_e~k2D80X9{Icuq~2ClCQfqrDdmC~Mf`)Ik4pW^+{mDYRoO^=&+Ms4)~dgY4Ww#> zx`XP41vZT?W3PWlYHJx3n}(LUXVzvQ97pLST&RD1V_d6C@qPPw>|l`g_w}x#;L!6; zDQ(5y@d?#w#J|Q{8e^geYUjVJwMxk}4DoZ^TWl}CX|$U85)LFja+XsS){~2WlqK%h z&wGyNsyvIT&MIF9HdfO1Es49To`@5sZC`)|MU$SnFV2MBY|A;?SBj>sCBGTL2E~Pn z6OU4^WD~Eqc)H9U!TCKBCg1C!;1PA@?7k9O#@qYJvImS~b=E)-62|~3w}Xy=<#qn~ z`QFG|PbQOB_q(lk&mwSJ44)~}R0BpF$>T%`Y&@#$Z+Bm?8)!IZ>O9Ai^lJ`8J*Hdl z4-!@jhhEg)`Q2I&O=SdM{}R2c@NWG6O{ZqM!I3ggM^pW7$G4f&@?>0Y%#7`AMMGT^ zre|TFj}c;U5FW_wPXl@zoW5K#QYR3uQ!lm_x|XnGg=5Znk5xFI+XaT=?#|aJ3@tVT z6R~a*(#J_$n}Z8~^=td;GjL)w6B2yKa#r)Ph?ms{3W`j9mElG9jAT}sbQ_^_TeVDYO$t!y)H49=zET zGoTaxLu-cF{5 z+#x+e2CV)RQ=oxb07Jhb&St|b(l@;gUi&wqH(C1jTD4=_Y}A52-K}?heYN&PgZdoT z=Vdn`o(I2umv+nU<%Z}_vy(81QMT0SFY5i(2k=c1%S8>z0sfD=T-m_>2*|is{m`P%~>hTgGl3Sd^Kkc9n!v>{iyf-3K2rwvmG z14!`Z_w^_ClKRiL0iX%LVT|~kSck!71(V4a2ugz%S0w-^Ozq?vj86_BDYfzHWW4gm zBL+(1%X=saJ3=CES)sVp3w4RjUv9^uK*_Q7?2GBY;7<`Ld!$9yE>`$~$x(Y%BF zs{=~L3)jyAU9NLZHKps_>%aQmAeS!`+F0;7fB=z@FXGy$R725X^yjV2JNblAHAC5t zZ|fUZlll2r*iORt3ukeXRbt+}E3~JoUh}XMBh<3`JGiG(GL+7wsyScGl>c|}qf2Vj zeypl(%hnc$*LwXZOg%s;PD%tQn5j4Vk3C*+Sv{(px9YeohAMp2bF!F?(kU651i_Vl zF8^vkRE#E`T5az@ndqkz_WI*#o3{DNv0zIr>94f9j9At{GaYniRSP=LQBx|u9=Gd0 zT0#6Eu$zV+s#-b@DxUtoWLe!rDR}UjV0v1_zId#GH`1Bpeo}Hpima+=Ln9e?E*}?T zLQ$ooDG8K|2+RlX{{j~%yw+yti_P-Sp2f1bo}4k? zzCc1+)>2oIgK?X8_3xa7W0?=OoKUxlemKJ0CBUD6s2Cd3+Q<`x4B^qxqKA-23TFKX z3%&)dA7u6gVLyIg1MtNJV*}8&k)Vuq4`64jt2xTt+?}_YH=JSPq2B^O(>yxw4lb2` zmcd{qCd%2FWPWFcT7h$PRhi_V0T+4fF5X89G_61edo;*r*`Bh$d|!+tvmgR+ae?*h zdt@6eCjeBYd<1r?xN^FLo_5?(4{F&V%cC3)HgyimkGjSn-z#`%ZH&vyX=dv>kD!`y za4flkb>K>Z9j>hbDb#h349a}7~4yfz0isfPS^jiUojA2LPx@@MOGDzKS} z?0m*j@~p(FZp?MfZ;VT*bT*Zxb=hfBjqM%ZAv<-;RE0Mh#bYIW>L}s>>8@HvT06 z&^|@g=COMPF`x^SzyyLwoebcyj;t&RbT zHoijW=(3eV(eapCL=lxz>Qi$Tm1d;M+9Vw0dnIGiZ*8z}V z2XM^`MzNex;If7kw!Bwg+SR)H^deM$4A0v!rm0KsxS>e2SupL1IRCXcRi3k1Xkt%1 z!l9lytWwt5*wnCDti1bHd;epPpQ03~qf4Tl1>cqS?*)Oc`mxN^qH zK9@Dox{0qs-^Ve%s=_9sJttFtUJvl-l{rRLot41%84*iPR5v8az_(r7^j(FQ=2tBs z^KW0C2|9|>R=&}pFHX)Cza=Au9vhAqsn~?R{&^dv-P}BWau$r$&Na+qTTflz%7Mym ze$RCBo-Q|FRUzTL0Fx-K#xtx={q-9G$Jysls08&vXw5TCN@0(slYA^7=YMo@6Bi`095g(PsYP^jRnYFFIO9G81|a7;G+GFm)ms z2|!}JKZ|^Hw-T1(aA%?V!pd5CBNDxg+of)oe{Q6=FmYmFI)0b`T272Gt+-!J{VtEa zbmv3y?CW|SmZ?HFQ$qe+ma=~Jx7$uBZL=O<84?7Nblz;MkL0nGsH3q>nW>jFvi)S6 z_%a@o=Bn8XohrfS!D!55DCoVhx(^moRy0lWI(*VNGpdpDMd30ty`l5ZBgTvkFZJ(| zDEPgQH&eyx8m6O!-%mB=1K(G%I8GBv_wNrh*~d$DtT|gw4_3Mzr*+B-XqmpMqNs-h zlO8ZmS&skHE0u#mTwPfiOE}bSnn2etB@?K(Ytg||#k$d6u~9Vf>QkuQGWh}Z_=?y_ zPt3ufex2IB1JM(po1GX+_ac$*-Dga>4=)Lnfs| zK1hUqs~4;2%d*_O>Z0sVX?Pq=c3j^`MaGN`Gdj%Y)zUdNBO&T*q@2ND9W>CNVuyPg zpr1XbwrUa=gls*3h$q>L9Z;Slv^cr53%{yWuvhP42#d`hnbCY zWaO)HB7CYj&kLlo**CTviX_&ch}tE@f8-Po$n3CUAXGI!5DmsjD<-K zrZ#rRJUsFvdJ_i*?mP@yv;&B6^=J!3CcNCu+hTb3$fKJkdajK!=e70N0o+Ld`Z@TE z6u%WuA5BPAK1Ep(HS1U~`Y`5JWF}E3-#7VIJCa{Tt>LsoDsjxt=*F?)fr(S=)$Jr! zFL1fKIXVC@Nq88_DKG?)bKxZP>W(CqLyhoE=cE`I5ulPxU^CbCQzhHcW9r0Kb6k63 z5n5&*rY(G_S9UA0W=&jcyvK9wc!h*+ zxrpn@IcO5>V5p@v2ROkDiv~CdO7#g^^z-`9wJD^4SWKAMnQ(;AIq}P{A`@(n3{$rV z`<#qiD{`xq4Q$6?zS)uVC7Ka2%e><+;}_@3Lt^qYUal?XB}TG!;`heDFoI3aZVAC! z7zV@jy#9Vmsd7|$vhg%jsYLCcwHo z`2&u3?~S#|IFBFE^>KI6^~e&Hv3HePIcW`cki=y4!TNCyBjT2-FoxLqD4zCLTFwD7 znz6l#7?mjmQdgW$U+nxM8&JE|M0p>6pn5yq%}oH#5XVsv9$U2nD(Y1Hz#yF}D?kk4 z{FqdrbN0ctQ8}WIUwwlB=Ggsett3Y%H|H`i-23;i+VdfGe?b_GMR)VO9^?Jq)JqwB ze}nNmnjd0;Q-`Os%8)b>{cg-)E?nxls@TEo6zmw%ISnxcnNNk*7=5Fsr+8aSVP7OQsuQq1*>e&2LrmB3fIMm; zPCY}sgB@ZzFh49b&DQj=h43K4SMIRwL-?Bk1D`vzGGP z)-QeWS5S>sRPjnn>){cTu14gX_|FRf7mr$CWisf?#A%iv!+bU9iDzL_04{psk$*Pi z(csVP?P$9Cj6VeI6kOn!#D)=4Z^x;K1BlfHNmnpbeg( z4|ldf6SWVa^aflsC}3R>3K}`e;YNn$z|p5(zPVVt$~_M9hT3aVZ3HkF&b>s*5Ve^g z*~z7(h)yuO0siBd*DU{oNCSTtGP_8o84TvY1OaHIe}2^h_6h#rv++OhrkfA6|Mjzr z%Una)*{5221=!hw?0wK)Su06NC>!zCOi@;mS01DCzkkjn(}M=;b@7`n7QXeq?QT)A z73a`r%ez%oDOIVd~(%Az%ok6Y*+M!BL6Fw!*L^8;#BNH>^P^d z>)gWV|2zos)gNP#aGybYjZg3`!6PIn)F>K={(FO6A8^N>sW3*P{S`*Q2#n~@244P- zq~MR;eriGneBZvltr7uyKA_+PycH6%Q7Y2Y)0aC!vw+GSV4MN*qC%6QOkps9x(B1w zhi&KS#w&RS}$Z!w;kYhTY!)P7LbR4KLG~Q8fAK~ zJSJOx@4@U>^*tbA4Q2?&i5r4tP8whlftnDM`$j_INmRlA9HML$F=%cfLKwV-T$v04 zv3#!ceXozbbsjjX{92{udkgqmIV1fkT!laqY)?EsHY-cH$>n5C?h&C8tpr&rfLaA) zfm!%yU*loR`_-MPtp>6$;NJ(f5NE)h>WdmC zX|`w_?(*fpbFUHxltG8C8MH$$jHXR}Q_g7OeyC5xa)pvV93pYG` zEk*2q-a{rZmXzpUX&q=jc-YiHAdB?G z)YR1b>WmcddPaau2_Yd^TeSj4G!RP@y;wr3hG2%9uEX%n?Y;ct?>otf1MMt z4!G=M%WbEJ9t85<5sK)=jg7=*_q!znJjSWL!I`b3_;@^)av66%3K&g&eZ8lrCpgd~ za@c-ap#3vaGaVP^0(S@d8j$e}IH~~+mlwD=u1yty3kTT3V25@MmN(sCRdxvotH`q4 zVLy!kO$<0d62?Z7-GU~h)$0#Sq2dTQE|cJYK)-1xk!O-|Y70OCdyQ8NaooBSu}`&`7BQgDnvOr+QuUq0DALoN1c?l;&Z%khj8)E6AxTTEJ6+psPrR z_TM=41cZ>-R+%%&qb4Zy%4k>l=!ZxqosP2v95{LI0h9Ux&^w>F9j~C1syjpa2ayo;(2yKx6C9yT-iK(K%ZnE`=t9w|t zH4JfmR@)2KlA9}W4*mCvpIcl|#t8A8|L4`j_|bi=tgHk>&*qzxzD`k_fv~8%n@v&Q ztL?&vqX)JT4#3Og`!-Piy4eI8LO@?_eRH$wXCbS2j7DyaupoFzLD;dK64P=^;^X4Z zA##MY;Zeb7#Ny-lSqReN1YJtqYGvsT=r69MsIrOFgM)(=iGgMeRy)bcQwdn{u$VL1 z4wiiMnG|t19uI9n$?HC58LJptU)~@8_d|h0MgVVlK&474sa<2@?Pbx0dFF7o4N0=4rc*#SaJ!5Ep{5&U>?Hw z5e`>}zeLym)aJB8B#p_JAKtcO{}Elv1sjPkKb=H*6VdAvqa?;GA2b@@h`yaAa>O4e z@pZ0F3}OQoHjoxN+7Q&?@K_MNTK~>k11F_C zIk2G<1)4nL8|&-&f}SDZjQnrPyRh#7fq3mpz4;S}rEMoa6XViIt7Zyt7<*RM|x*w;27t>eX|TK*LxFyZ&zO48i1I z`{#K-YV#$hhk9XpOhO~(-2veN$RWa0KlQkr_S5`tZLkz9^>0`LcO@XaEh^C) z!&jJ>7lfai4K&r(!3JBYkPAPobJZ~*7jSez+*#JY|D*rgb29?~k=V7Xi-5Jj| z0m%4aE3X3Sq18xIE_g&WPNz^c6uv@&865v6UNJ-94gsqc-1cHu?f8~A}5yfrm6h^W*Cn9yMIEafMD*MTdl+u*|7 zhR+++0n#q+gYsZt@qat9(~Xlz##w`S%i^MMl>>Mdm{yLjvk8tPmR@- z>>&Vw?8}|}-3Momf0X94eo1y#hNS2*b_PDBiXg}^4^I$avpOX}rU0*A8;o@t+z;=- zS*He;$YdY!u^^nTJL7V#O=%2p!@|iM#s4eYmV$qdf%|~wg1=lCbMVZ%?$7($FlV@D zfl>yDMOk;?^Z-Cm+#T0vaFxD5mGACU^xhfBz5w1PLqWUjLbw)uNxp^d-|M|eKjx-` zdRiT{@6xp|B6%oKvMfvn$6j=}cN1&^;M+Ah{sc1c#^JEob*hIupPZid z%$Jc0Ib7w*x@+aXpGq`gp(0O~(TV!6lfn(!n4aHsSF|9KFj4AG54UxlKT^jC!G6KzRJlaS--Y>W-Z`2Tw@x&PL}t8#Qu!Q#45#Sw3P z3V_VMi4VC;l6(5$&Nf+z+qkqH)yZvsSd&YV+6{!9-yTWl?YREC))5WJpYuIy&no+G5(+V-KMa!)eiDPZB(YAOW%a6PdsR zbXJ$CKLcR`eo+y8`4pt7bYD@(BzEoLiZvbLg$?fSGD*9PC8414_)odth80nGNf`r! zMc-3`fcBgS3;7W!jIBUO25_DSn40mg$L-NzCtGbZ;{>i9hz^LMG z2r0@UmnO^Y!JTR@uze8MfZ_}npo5xl)>};!i+EotW(s)%5CNDI4)*qfsu%ecaHgJX z_4VZh#nsitYP1Rn60=}Sk&B1~Di|GrL-^6;dCHLuA}7Eh3i;mMm}hxwymulxkX-~*f;lRWw(LKxkV`F~ zzCRSros2FrH(Z`4YXA$7n3SZPApl?+r2xg$-Pc6GSwS6j043;yP3*$AmhuFa|!HDTko!{Q=h+Us0J%Gtzeu7 zs7kpZQU%^6c;Wb1+hxV*DIBrGY+OyK|JR!ywf`rGJd_-^XV#S<`lomqrXt;Pr;crp zs}QJnt14jh@&m6wnm`lvt1@gy`8;tkiD&&{_`%%bem?^B(0{mu-L2!3erv6+=B9W& zhF6nlszMIXY1RYi*_gNS1{h?oOIsg9k#l9NT%QE_aBAP>WUIzI{6F8TAq-SaK1QHa zJ97^FuaAug%%o1v;XddOy~KZ?r;#JUhtL@Y(z5&i`wjh5f+fPYa{l`+S1f&G&Z<7b zr`M6bUwiH9QzN18sHmuj*U8cV4iY@rg@Mcae+!G#huX#GyYc|y-*XrYXkhQ%g~7pr z0Imi6gb0+77{l=7XSXOZca{HJ?|8I4gi^ncB03+UKndX8I<`$OsoSZ7pv#sdvctIU z0(*iPe75&*QbZnt;6sEd%UjWG&isAgN}?nT2>rOrxtVxo1wM&qWYvhZt|C=+w(V)=F_b^eEd1^@gf?XK=-!d;i=6}MV?&r`CGXEAbctQ-B zN-)^_(FeU{cC!CF+rUNhf2u+~ysdL0Jjg!y{6%>RW4`#9p$AL2$V~N^j8;C!9)54+(W~)(3muA0bmgnSj|icz=dv@_;?z0_CS_};-mBn zRFlX?+!V2Wb6g3TjGq3!=9HfFfB)Ldr&MtG+9BljiP&@4Ym?LhL7cynSB%1YOVk6-EZ268y!xI^3U;6ro?Hbi!IzB6NU$% z+x=O!vZ-@Lesp$sJ(E*h9Igiv&r1LrHp&4c%KZ4T?L0gMj<655wycQcu>sfO96f6s zQpghhCRa`~aSZ>oL>`m>TiOt#T}6;_+I;=Jx@1eKnr zX6=!{sTic5V2-d8P!xjtQC;~03|c@BUJp9s+zdn{RNx1hanl}*RaIFD|KRf41;k{4 z{yG4vBcPI2{gja*Y&Fg_i~o0RZH*fU5`)^`WzB)FoPaK-XJ|;quN~}J9p#-f+Csp* z#~2B50<=a+1^)QO<>@F#l&k*~a2{+Rz8v*GM4*Q{BY+f|2>N(@GfZ%@SK3&CqLk0d1qRYJE{&?DYM;te)!Wwnm&UU$Cn0kL zI5J>y`ct!P!RNBJ>}+p=4v!NHGhF+_gxP&d2h8Xgmi*&eUfmuQFGj- z9;EsHrz*=tKN?4Z#58&99K|1l@k#VARb5^1QZ==;cO3Y-EJ(O0P%(?M*msO@lkR&y`<{(i>nm*e_n?)kI%_rC|4lKIV*hN@$% zYdY;}q{r}0<-&7oX~ggs1CM~Ai3*d44vH!V${`jN%ApEMeC=G}jHR0$`6jU-=2N&I zQ#Q4j4X?9sn}JDZ_&Su+`8KAJb4-J6l!B7q!en{nQ4FDAtu5Mq6KL=k-v4D7&Ir{ zL00dT!rcrlF{USCEHRE|6~32l0zJD-u;*L``0^JbMH8Ez`mT*Ue`(d2`f+BOJV2FVqYx~4#%qJT18m1Up3%C zu1Q&G(!08(IZ*k4pKl+i3sI!v6B6>rERWvsQDg#%Yd{VF^(H)cr};xa3c4Zvq)}Du z-<7Sm5Qt5^E?a`U|L>(=uL_*uUrKk2YnhAmdp$FW!#Z^ZQ(UUP9|Y+@E3!A1bK7*~leOC&C9=6nQDd?fXP+q5eK#l`A+a18%fzd9fsUY(&xU`Xi*RAl7wwNe zCAHP*Dcrb3V^)5vfZ>@Ae3`O77R9#e0e`5VuP?MF_1`^FzLO}#%jm@SWN!(AQ(aAH za71oH$%Z=paw zYU|OTHu|Jk20CQb?~oOHS4j4M7Ic}ZRe#%{iTk1!s+5i& zXV`{7cU#V6-6~)6@IJsxVP3IYzqcAJBv#NThBo-#i}1Ym_X3en^kx|sj3Vm6&~@Ru0Uo(aJn8E{m&|q5ad-(qM?#Sm~K=}ZyQC{#6MeuNQBcz

(K~5 zgFf2v^YnvqOifLVp`s)D;{^=hWi!R~{O}W-QDSsuwIWN+*) zg$|iF(xpG6vB#*Vaox5A_;nY+EeG{f@hAVTZ7~u1g z>k<8=5^Z`XG4K$oGx4kZ>EjhPT~(~Y!?PC2Bd?k8K86H$H|R-lxv<)We1V>N8uwCp5VntoS2c{V1tyLPF0eRRy?9Scp zM8?R46B)^dqojTxp{)58{(XMt2fD{Z@?TqVw%v^9C!=4XaraWx#LFK(tU0s% zxo&P%>l-al`(n+`a&dVAzrGx8k-qfkEfK!KmFrb8>?fa$s-tq+P#`bMbKCeH>sxnT z9lX6%Dm1HdkI(36nWkzMOP-Q%&PvDXiCy!?w(o!9T%5ALcpmc5K50xe{DT*?*#b5` zJza!{!b1`w`6t~3%nqL!J%lCa*Akh#{l$9}PU%;`i!X`?a|2GuMImSxtWEaOf<6OcC$Ch7 zMLzKDI5}qgoj=8MahvCfU#%l8GRvKyDTK=oLSz%robp|-%p|9iF0Jpx;i)(S5HZbh zc{J{q8{q{-fkE&CNP`;wv(XBR@`{`;S49n$I3*7RRjz`c5;-)V_y%Z~5>KIDpYBDX z>yQpWT)!=$GQ+rtkRJV5 z*qka>@+>H(XFR0i1v}xZ{Lgj)wlw!|Y4OKgE-gmn%(PJY`jYL6pOO`7!3o+GBQ)qp zD^>S`db`ZlUXy*+7K+2_+AqH$_zHU-6WO3=%MtmW$Ny8NBEgGSTuni%PN$C5MT8h{ zW8mcWlLN&>xlCX4hF7*N6dBXM6To5C{sB8@#~>PkkW?rtGeiK1>AnQ9=-0Ls9n?U~ z+gtdNKVr8G-Tu2qx8}1^1(_%cL=qv7BLt-G(bTlG<>zc{s5G}rXrdR(z*|1!@Pj#+ z<J4mKzUaI51_t-~=~@&K-0jfJ2My?mvoCQxH=-GF4CI=15Eyd&|Egu{DxjVE7c==ZZ`{2gAy zKb?evGOW7qFM0!$@g@vQSS(275Ou?}dm6G^Tn~>iPBoNts}1E1dp^D0CAJj^>caEn z+|`<@w%9JVu6=gq5xc9*@n~G3GZHyDm@4-2^|;d;C^{9_7(`~va>OWHa?_sJPWXv@ z#7^>$_0iMw!qQoO)1Rfb<}9gID;kR9=AD1BTnRJ}NNWsE8=B42Y(|PAOw;6L6m^>H zejU@0@}@K}wo5$OYo52Bm!PBdRVE25q`#1Zn>G&OyleU_1wUmqa#>z9Jbigi#^pW} zlHvMI+gZV)@2_x#rj1Uu;n3)4rM7ai9E4YjiLRL9h4X5rH}Sy?vwxtD((m*N%k%UE z!3g=GAPPu1>~mtcSAg5+#I}gWS6xfTfIgNg;&7ARzT%DaYoPIp2AjfPW+m67xIrYo z8-rYMfS%;w^-S=@ZmoZY#T43EfnVE+f3SoGZ#@1fFI8%zn{ON)*-GwAtXPyQcU3NJ zx{%MZ+i@w~#6UwDA+NKfbmuEX+1xM}?u6zsJgwIE_v5A|Xi6zHj=m{~4k&1tj*L63 zvyK*{#oszMON*lGwV}1PhcUFP1VZk-{RlZIOHR${!9*{t$BuE)2Iyf4 zjzAw%#yYk{na8Ht(p|^H;3gz)?F^C5^JX+~pYf2Yl*9a>PQYSfTTtRF%hWXyMSW6i zSKOKAcfOB?Xw{O5xT!l87N_A{gf%ZbJxZAuj1NL;W%@HTop=+8N)*_lSOwmsnCn!o z_Xn-N*FN2?{NR4sAo;SFrDihHLKZHj;YWLHeG|Kq&^Tm(s-Wt$GgvH4thryWwh7;< zE8>(wR`{#C!|QeYW7~Qg8F_Lx_e_G)bSy@Pr~K*9yg!WQgjvt*AtksAto6fMIT6~L z@tT5ZkM+r0%RRQL2`6H7y9ro1WB{*n(w^Vx^O^1|O1=RCcVnkHKLo7vh4lJ$ih@$% znPKa{g9<8+g0y_d7*i=rLtj5wB;t3Nm1%$fjO~Lx=hkBN)8BfIowt9{$8Bpg19ojB zrbaS)j27b2+y~!fW&WVXqZj?IDSyu{nb-7penUe3=1b~&Z9P(COuag4t*XPbR7qks zZcqFu-iYYXvS$2G-&tAfIgJJj$b?^g2yjc+i4_R^Pj&p^WP9j;zaNMNn!g_u?{PMI z&!0bk&Jb{aNVVSmDMQ1hiqx~=bK9GCZ#kv3!h`e=c(#{Ei{5!`4d(#pk6#5?9wg~` zeaX)DlkBVX(|X83xBRd(rY~qPzjPQ>MNdz}aivr1IV$`@>15MneF zB5dvObNjLh)O6P_0LGsjC73Hk@GXi&z_>3jL8e=#4Iv4-q9-x09R7B$H-v4`hlho2 zH10_)Ma6CEZJOSx{jAZ>U!4w(jQXN5tW*#4@vaGT+6LrwL-w3u^;nHC#2@LtSM8DvUW;2xeE`6^y4czA8p!R@D+yl@vIS z@2pB;aHNv$#Ggr4(-QrR}S{Wj;@-){U@ zGkF7nNmQgQm0!m?SGMQuzBXIjxm|216UG10aX!B7nL{mmj#R!d1jm(OW1ML<4D-P{ zXA_)IG!MpGNYvlb^f-}z-T!>P;lnS>Ac79ZwBGm6MVvI@xpOH|T<*%VPU{2ySR3}j z?;r_7k`m1R?%*tLw|qEU)=-JVLo4eN&1gDq!4pn8U~YJVTK$37>d%JG6%OqIeP>jk zSJK-#b^y!!RF?!Hv>fpr5lNSVSgR!w#!c>}HLmj&+e;xk+e`nX)Z8m0YTeg&z)VtI ziR+pBzM!~Yg8$C^(72h6Y-P++&~3gaao6aSaPwnMiPFo63hN;s5yw7Tg)WnU?St!wbyg%K0k?0a$2-*Mabed&s?n~g=eNBDH5{ML0z+ZwMriwMcgPOJJe zMfF%R5zbc+35sT8f1zl#b%Dsa>Pz_mZ@%WdyN(x)p{$KZJ>4IF9rF9t5-A7aOWc|! z{WBZzMiGvJ-_+V)pQVQ>-UdUVe&S$kKaF~cKtivnre-r;zHEQDVP61bng!nILr1xB zLe~3|?mI+pkUk#)Q4n&zwkR0)#HiBy`<>hB)0u1Q1+P z$$CtFf}B^Yy^~OzJDF);R7hC(HTX@rdy^3XBi1#+0XM7BbEmiY{P}TL_eV6ONBzz- z5c|hE^_xm7il4Xmy~mEx7H1fa+q%^m#W@l1X&DkGakL!&erIh^)^*+bE*+qR=;$p{ zfKWJG;$>%@dp_=Ja=A&)X{dzq^=Gy_VvdZDzCG{4{Bml8EA&Es<#hiMrZ|`3!0K)4@`{w;1>I6c!FM-?Pu&pW1k-xoJ&@%+q;U-Wx6yUG>MYu(xDC+LM0>x=kS}RuA9w zyBf;A^E6g06)?+B397Ian*Q=;E404Rw6|$Y@%_5Zczd_Q-;~WLw^swwDXX9Pefmer zk5mk>BBx{se{>SO%qER}g_ZM4vha`X_L=$L7v`=^*AQ@kgo|F_J$ZGyRC56vNFv=> z^QoV$k#1*4j))8VsTpPeRL|+Kj!8v&5H;zy?I*}~^Q&J5n1QKZ0Cey66zBT#7R*Tnp`oFlKYvzZL}IL{u8x%{gd>d~Cw5%*h^rj{ zJw4P}eMV>-Vch_u8@8yYf=*pP%DQxu9cB|8M#G;>#5NB^r;w^tuDiVsOiE5`yjO~I z9PG5LJmT_s*~~=xk=xX5H@lrXMh18$n z{SIt}-~OPiXCPudy>O40`f2T@ijWr%?dNAdj>OEBPj!#N2#-6+Qi z(3>(%n?<2!+&1deGgwp!I_xVr3ozKD4qT>q4Y4lGSbD$c{l#)BEnVlFOq~#=G_#@$G}p=l2^ zx!JqQxiNY|4sPn*2c!#>UBsgieTmyXG8}_{IOwNHME$NujxrJ+%=O+t>rZV@(pvS8 z##u>DkrPRO8Qzpl?Knm?#iTWE+7>&06y)*!`3pU&=_fam{>7OMl>32DgEa1II zT=vC#B8-)}Xn8(bO+#==Cis5r{sLZVt>ar;jq#g-@umThAXk@x9G+)MsV8KdK0co! zLRMARg|8$sJ1kDWgbZpv&vm!l58R5HXeQ@+_dTRHDpEK$P1JTWQtHExG{JnY<<*pz z=e~RYa0~!@laCXpIrroHKI>dU7!z)Kjg4CV+-$Am9;l*;mumT~_tG znFYjTVE8`JvJ0iX=**pP%+g|R1bpb@cTn6pJ0Xgt4y-KZgTFrCat>9)1~ATmjGNu zLl+%w)hO-CtNYfhK=7L5ZnNQ-t4>leyhNg-oXKKfEp^YqkP6?4jBR&bTGDeylY{sz z-xqq*979s8*j9RyBdLi{(swbT+x9amW~N+2PP0GVnaQFS7g1?4Qby23bL8?@&I4Z{ zQh0VWG;r?G#zPwMIA`*ZTuUps$^?N}-94C{hML*tAmPM8dW(spGEbj6 zhyCKK#iEV|a|UH$yQM@PGYh@TBG_A*3Z_)FRY4xMZ#1Q^O9-dJjYXWhnF#9YuHTmz zXJuK%q#-eXz%$U0qOO#Tv*adOuedHmC%w|)3a$($af59I;*=$ z8@z3XHCvbEuJnZ1qM^9ByjYOd2}%?_6piG(twN9AxU)*H#8DvVDY8uVMMIa`sMKWm zw`z@<0Fi1@= zVx<@vrCA5tv01FJ;b2qyxlqAH(@{bd&Y$*DSYCXo6QLcv!c|`t<})ZndtueO%{uQn zl44dZSV^LT^#yZRCdvK-^?Tp&TzW%rE|~6Dn|=NPjkOF7m1E_98EI-3-e;h}f^Xei zUBJ>_{2u4SIi@-b$RJR=-LLxneP>(*gkVQN;Bw$XayAQY5}-3RJp?j&IF)He4@*TK zAD`DFPl_z1VML*XXU4Rt+m+tZPWR89;6w)f$ry7zh3P%$EQ{H@Ef5hC4Hut;6=sxh zO-C|hkRaLzc6^J1VI`g~q=ptL=A_%$ml0S`%@jKF>(OSqAEod z*fGi?x8fteW^b=CX*eV)qakY!;_8<-U&mieZ7E;PNr~i@omJ6@L$V`1sjB`c4OM2W zW2?uE1@zIm2ZaMj=B{W~w-_#^wLQTId z^+JS=tiZ@@23_`kJv@ITjxWMC)uhCy-(TzgH9j<`N%3wgFT!|Kc zmn5{I!8{{?U{iPVMlV6WRc|gDwh;|8ZL_D>6y!*M8UpVlIonF$xhXeZx1MHU)`OWU zReC}TRcFf{X+)6>7Rruqsy)Hg7Fk(|yt5vPKtZh36xuZ9aUI>0WEKxGg9XYn99mUD zcLfC~zlgZ#G2tOkt1+AGPt$J^#30r1&ynCU`6q`r@SEepmTIobilrOW-maK8B3!D$ z*w+nSon+|E@JsXWF3I%OOK7*@MCfyE8GTdBMmi}W?~g8;vB$@^v2F;FJF>vXCy$Uu z%%@`4G;Q1SL|@1b4cbk28N5^Qw6Y3SLHyW14T%~)S2viN#;imwhB7F1-#`*RC?NF* zz=V*$U`Z?YyYzC|s*5!8UB6`EcuJ=9b`wqiIsSqYX*8j^#oN39WZrF)b+l4$c@9J! z*OpV-`anA}%uw`}HT2grC_kk8nf`KU$Z-6{@h)s_~v zM%=lr1#;|ZT_Wu2^p~Qd%u~@8I~j3k zjgsy!NqE>RFK>@c87oOSxGaNiS1XW~f3v@D&y8|5geT7{FI<;74R_(M|*bt+)37|@B>)}5mM{SXQa4i`O$qcg41O!pd+z1hvIrv!k}D2GdW(*)o=%oang8_sUg)X z>0EpZ@S!CIiD>q;Gx%0^a_*^c(rG_+U^G7OvGmQWlbcvOs%TfD=Cvgd(8qoayQ?#I z?^dMm^Bo6!3(<6YXT-LTcq_1aScivRGK#_tL^eB1U^S+K5rafzkrkK%3F?Z zZ=2V)dZ-o1Ns$vAi9Q)QT~c5y7~(#Fv1hv2!ev!=g^)aL9GFOB#+J(Gve9KN>R{fZ zdypsRIWgvy5l+F=`MN}cHW-}+xjy|4S0)iOBC@AW$HcHAqn}T%x^I!%=SuWURo6_( zEEsH~E85)Gl~q-Q!Sbti&BX28_lLT}1P;p;Gf$^9x@cbn=5j2a6k{PYo)9;NP%QYZ ziC47fCF-5P|9eqjoZ}>@a%6R}!-9p1aeAc4$M7m%2%mI+D%^ua=L=Y~XxIhcK6^Y% z0}#xfd;@mWITLN>l!9sgTl2c4@~i=LmAPa&34vILL>v|zCvu$mnG9l=8BZu(v^%@S zs7O}Pnxkfh%J~7kX1c9*OEs$A+#8u1KB_vwp}N_TWa@wyb&bTdJ$yl11&Sr-*RnE> zEVwa^JHa3Dn8vvDXaa~NJ}Z7UocS%zbUkMzhCfPpl~-If9KF`ym{hh=x2==McU>=( zIf=>V9t0ebiL&+A@8#T?%nluEU>ai5`Ps4p=WVnJ@~d>JVqYc~2VenouE;d6Id`}; zL`sNz9l|9U_|X!STlj^Mi>rDGz{2y?$ugwrd?j{e@jNL>s)39)oJDi2EN{kZ#YS`8 zobRSQ1^$iUqh{RsYEVnBlumAnDE(SXLWnp5SI*)>vRwpT`pqovyA~i@Jnm`2C49I3v0l`Kf#=yv>{xP+Hz{AXJj%V^GqY#0eEL+C z!cf!$w!S>fM*m2j5e! z$wyWG(7DRb%N()do_)C+cU|4Fzat-z5A{)n?@_zc$F4(r#EZ_Pebvco;p^FYL{i7y%W-81E5-ExiR1v7JGa#g;SY1 zFyl|EsBGzU9V@x|_$oP9I0CD!eEId(WM})^=k`n5b)8MM)VNWpMy+JCjaI8Pd>yq) zL)zlpTCaCF68$tRJ79T@2~CiLQQ_tfY=$~*g|HosvQ(~dqmXU-*9>&$3F0yRli_&S z>IOVeKXr@YZ{52I5}6aK>i9c6O2TF<2~8o+dgcjmtky#C%aiX&uP-`&8SU@VT)Q+z zUuZ7a9K6hDFfwqH^YZY{-TAHnN54Arp+ndXIjFboysA8d=G2n+_HV*}a5KMz7F}<2 zoa=YrejNzTf>D95B3uetu`3Y2!i2zo$dT+yxcPG!rLj-exk8SF4Ya1Hq5>mbt_RMn zVp?2QfgVLdDPRR9C*w<>!C@&37Hz?u4qCY`5P7nM$+!jiT|Uo3UgsTLK*%aRNCQha9K^l^zRYwKyr0Per5fk5 z?-}XrZMMJ*A}VmayKx;b?FTv_K+VQNZF_nF9cxl$`k4={G72e`LMNQdfqTG03P)<- zJ1_?TPu35B=mGc16Y)D<&XkvvyG}Ni+#!t;OjweR;Gco8wv6BOrNgh&Z>mU~z&$8w z{X!2cBLrTM0NF>grY(`GF|p|a$R1T2fG`vFNnUNsKmg8LWk2tFy=#yRGnbh|G(jQ!#N%(cINR|6k*?z47Xlzw~- z6xn4Zou-44Kpi{n-`de}TNo!M`KT7|0wxNZ4J2nEro9C2ti*DV8T}iiI@4F73Oq*B zA_`JH=IsDOt?U6%h^G~EpMwRB2t=HS26I4G4Ajs&aUdZG=$rFGz>wkZVSKdGcm#Bi zPl=3?)4k3%Ui46;A#q4NS&AqC@y`(FK1pnmebCdf#8Sn}0N-@_(=G&7pvJAr%Y$<@ zhC6$?bkqpR(dNIB2EoDkR}_Y9MZhgwJN~ z5#x#^f~I~3NEm#)G5=C5rMOC_Z!{8ERJ;(A(kI-62YN6JY|Ssg6Wj%I`8qEqh20~c z3}Ez!_kc~4%ekz(k6E?x;Hy|ufGb_bM#3OO<9iJkkcOcB9TFZg26V(SOy{~UQsKO6 zf>TUeBOZVdHSHcqN#UntV##!MbkLN5shyZ5q%k;L#{{ekF9^M&Ek&C8LY49j{QO6kxAY4;@3`CIFWXwca)CR7k81@h z_e&|YC-sf~GOuDcLwSES&6D61bHjv#b09FnvV8ly`@u)Uaz?k#vJ7bM=H%cc;a*YA z=+d15{~mKLy>$tyVVQq`H_1jA)-dh5QN0D$viR&s=E!8ZqJlyiH=C;2S2#qOkv;K; z+Y9i_SAzAKw>g(2g5Xdcf9({O0xU8W+9l^tV5kJ{0U6@FN7$=HHlsrQ?-CyqZ z6GsU`g$#eqQ#UYB68DAg=|O?(c=VtnnL$xS`Wa=qfU=eq^#$VX<;m&?wb@U$RQ`E5 z=G3H^7ju?=33)ZkV39FE_aza{5I*mNNMeCtpFx|zaDS5)#Pi?)o#_&IOd5JlOj7>J z%1TUE7z(Gho*stMAUR#G=f&Oxh@C5j-+<2uWSE|`FMWZTAhASDcg{$c=KdbkCO9?$ zyl0ht-|p7G!Iy2oBiA}FNdn_lhuaBBiD@^GW<4tGyl)m}E?&UKONS{P{yvIY!VO}S zqHfY5I51LvG+$(`9J!tLaJsj&!okA_gseIeB`Tp|8dt`_2Q}057lpo1lSjwy2;b4+ z;V{*-;_KMkrp+O=fXIyzM9B5;yZH0119a)B;Bc*lcHl_^iLRw&iS?%60ZZ=-6!Rd# zmQ0W+4rz^nV~F``4#5gla(}KIuT@|P9TScl-qjzv5sW6#^%0*k?Xo`i4%1dj-{WSR z@*(ZOT>;zr@{`})TS*M)A&~8>bh%34uU0Cc>VVjGFOq0`L`^Per>Ur2$oZgNnVTQmF$t;$yqdM_J%# z-HqW~s4<=h!Z@&Omw-D34pAUqf@B)brxRRA0%KdIxE9!yVp%9X=)MlIk}wIh2C%Fy zmOm3d-3oQCSKM(6_B4V=%J|s^V;2N(Cz?{6f;vyZ<}#2Mjshvkr_7jH6YUg)@CsRd zp~|8wg4KaQ@-);bfNUHd9Ys9rf++EF2V<-#Q3^P0fUVd%0+a$HIhK01@TX3kpyY@;#VdTfoDzOzp9G>i6Jf22OS} za2^1&13N3LS@`9L=y;Jj;II%$(@HdmH%Lu(0c&-4enwYx-x(+O13S)mws3QPet-yR z04R{{AiMx2UO}TUxiZ1lbu^jDEWRl7a2feW$Ms$&BT&n;%O8UK5r{gKW;*QGg_Qan zz198Vko2Tl&VM+1YQvCtx`Ny|xwBRJ(Z%mzDGt+81Rw85at8ncb^`54bt*EJV%8zu`NEv95DWt8e41S*tbzfTVw_c~V4C`M zJsH8^Tq?#f6A8jFodWk{yOYmqh3ZvLov5DqnM#V^248;3m#Q(z*E;Y(f}nG9k{9$+ zXAi$xNl}{rB!?WMVjzKFhbe&*W;KpF_0N|~&^N9%f+B3y!KPEL5R}7x%L3f+f(|@E z63l%jc)aI`MHT?? zhK@%MmkwO0nxIPE2cSxiD%b6N4-X$ULVuzT?fgu0{6g$jsWfzj3&n0+f<)@FY)y~6 zAUqWMlsfHzR+zz6hUy0%sup9GKU84zMQlc5E;G8Ho!oFyaPuPV3Vd}U~qf?_cZ7w z9HM{LqZFg8ES#2T39$k`64*^X>DGs4VMosuD-z9a$(8TR*Rz`7Q(`u5&CCV|3HtFxb z|HKt>Xrio8x0#oclGkRg2~a6vG}iL&7iVxJ5c2Qb>X!JZUfzVEl$>+o4wSxtF}EV+#-q(p9lU!0Xk|tQ zI3jyag7fHy{x3R1)7GBWj!PqBIf*5TaH8AIz}$z`(xpq#q?l9MJTB$6XeB)dT!DBc;RmL@lY4s zmfiX?e>Nr(waQmUnqxgT&T_@Awj2A-HV}-~lQ-k@RJ|xIW!nY=CT0GeHw~>9g)6(! zKbN97cDQVZ^fz_!2jDk_^_HKz?|h6VqX9!vZ%%5 zgrh+7wIPbHG*CNFAFTFIQjtjyX~bydf?-iBrz1_5@35FgawqzdKt$3orZ*q~%uSrL zp;iuZrF9G(GGf2fr{7={HV{kVBpw6@P|zh&gl^pGcrrcbF> z7pH^XG)?D9!Qw~#%fY0PIoDa+Wbx~gDd}?zg|O4onqYk@yKaNoNFrdhK=bSiM#JsT zss^1F>t&93pT2cj(rKu0rzn-cd*vbHx^P>=MSIqi1kdKttD`JV7e>Py_VnW;0rPXb zbJ9Lfg#-;Te_I38sliHUtgwHih@;$h59K$#|dcia;Ore!^UqE?fk_1Xng> z_y+KmKqbeVyUddobyzbm6tOW|u+KIiY-s_a3@TZ0IMf)|X#w7}JI^y? zYfxYQ=GNta*jALaWR8t|Ab_)gge=L?rm9%>N+#6YuY7#RYS1D8iC4X*g2Bh=JR#Fk z!J)j=*3!!RpxywXyt;W8f}8I8_m>@V`j;R7Ex=+vcn3c%VfUZ*ygesjLW;if|Gr=P zi`B72+?<&%Q@QN=&2Cq*iFS`6OMVac;Kl^^<);ISHK&q^jCSX#`)CLj+qn7`=M+3e;}kMQ}vx|DNmjT1zW97+dVm1{gAoaiihifkG^Q7oh#-&Gz5Z zZolItF16mrbq^XEfxQw5AU}Xi+?P!2Ec4qfN?G1o?@ErSmr6RfG(5vv0LYSB1V&HK zB@_T{=(IY~@grsdS96EeG!$Y;pOg-qg+=m7#whijV6!_||Ak@AC?P2>0t?E>2OC&7 zK{?NUf`K8S90_ms{`Zd)z<$RqRO@^E{yG87ua`g8@seG^NDIL)WBPyxWa~zpe)97{ zZLQ7(lR2W#lSZm^>rrI!B@v(6fq`fkZZ$sQ@1q+E$ZLUS!|~6VNi;(u2vhL{sVCsq zK*SH%BITxLAz6aU8tO9a@y zg*}g9LP@0jHpc-pL+e_p7hEYeUMw!4dV*fOX9I+{iM;=jb<{=`-`Cgo@}u@dmLN}p z945JtR%a!GSK*f%2y)Wz~vO&7- zz&VF>k0UgQ3^ELwC*lIEUw_w6eSb$8-6F`w_s90#dsmKw1L1P=OZTO#H2;U43~*C_ z%2V-i{SHQt?~{gkz(PBwXx8R>(rCXPddq{%~=qlC=!5Ppp)aCNM3}5&xl%R+hwpDVANU>!0ngiCS*c!2u zhMx4BOdxBMGdlvdqew5e1)`vydcq?==1tooI!j6QKbmiV(HbN@=E8XqWdma(7@9c@ z+mN)GfV;uA#`}^GAKw_nJZa9$DyGZDK!D}S`g~_35_QD59wa-KB!%?=;KGq4v>Sf!8rc85lk>3q{!#bSprpo#9On4aS!mf zCTmTc=^m}yzHi_u4g4)(x*K3U00%U{`Zz5o$+jdA3GvOY{-4KK z1SjF)qhRhmS;Cj36%+*cIzNcI^Zmpe*$omC3>E~zVS$4?;FIr0kc>+hIdHQwIw;?k zb+ct#X}A2HGh+ya~jwm-{Q1_?zqW zn^wY@Uq;!xsHAl-ihV)G|qigD&F5Jl9%6onKW1x>w&e`mlnL5V(PlD4DB zE=_$=I@TKnX`@I+GRLqeQE>Hqq!3K9+Vp!S;C5>9g5baJPmIu49sD( zT7h6$oIWm%P8|3KDgCQ{B?i-4vK~azY|cDIj{ruZIY?M|F=|@CS0GCMtY#b<6M%%A zwXbf4>VOcpBFT(qO#L)r9N&z46p{_OjYa$wODDoYW<4Jx2i+tJ4P{j7Gp?NBmFj#O z`<9F@^I6jgu28VVFfDg@NG=L@I>JUT^Hw2(bX?%4vQXpCP95=4+yA>s5Jv!$amN>a z`%FWgL68gfLox6O59TfR>7_)tl2>xLj+mBTU^tONX@^$gfKfdg558>-NR|F^NrPmA z6+Dw}u;ygTQGTFJ&yxE&zBg$IQF6m}hynv)dIVzaqp6t`D8Fxte+!38wfze3B?J9* zoIDjlS^(A=OFE`HBDH`S0a^fcNnW4|W)G%Ce#U2jWa00qoncbkJR6V{z!GxQe!*SR z{Ck`JPHs=FyaYZcfHHI3UrK-WAFZO zKG94F^)A{J2v)jeW-Y1=!K1dy?{&G^>=h}Q%{8L@zs^H8jt2U0vMP4Rz~E$+a0inSYf^eohDo z9@j>0C(HE=M3^&(WE$eL|DaR<`2&3C6e)X!%JMSZDnI z{`3D5@;5S&KeBh7_ux{MkiGvl@V}}l=978g0ZiDhoW*=-_CY4zSBeGxf2Xxamv(d9 zV@Yj}y|sk>7YBbVxQ$6*9JpC{)Z72xE3+vb0tMoiUG9BS(hY?=ClMQ|uiS)RXvG7jsQXzSfPP9!P|zV* zPY-M#(N$!OM-vRV`oIwHcXN5*A{0Z+eCn5lFLPdQxBP!E{Wa#laPGs1{NfexN|NMn z3Or?$#t~Jey&Bka^t|+lEg15mpesf$u5bkR5oi!mgL<1bMVQbba(Pu(Ri#bl7ytV- zJ-Pnx$_HR7Bez~q6C9&G=i0LD_Om<#1l+bJSQp=vI-TOcsuU&A{m7Gc6wmm|9f^hm7($K{TB*zUzm?Jx9;gWZxi-9SFrdqH6Liw_ zg7j?k%f(?ktFka7W#B-ba~7|`SPE6^$DGFQkwD|JOnylrVEG8tN|sE$iqYJ#%)#P`QD$N4kf@qm>c#~Of0Ji?S(k|802Qz+ZYeQ!mN=b2KZ+np6-!C3&)|^ z|5R2+#BBzQx_D*6uE#ZnW~(JJN8h}+ucpM0TtIUG>l1V^Hk!&=-^>;DYPy}Rwn|0` z6ZO1Wt8?`d!2N5wv2p72KnaEx&mU{8K&LaFE56uB4w(jB9q1y-F=V5fZ8N!DZ;D1V zL5!fs)N7yET!Hk-9n%b)W-^ZSF7In6;MW9v$ugKTLC0s<>QtHu-om*MJ4d&w=7Vsg`RCkn&fSl8?hTWK@aunDA8;E7SNYlTR*+~(cCRw^MHo7bF+K?;o-zciH$0_*=Dyc!01xmec_7< zVi*>w)A7Kx*$U13hxL!2E=m6k&h+i#l_>w+{rHZ8S@@Oj)m~Vxx95ZJOZLpy%@q!# z!L`tnT@Cd3`FIm4*RgDVult79s3ggOV|>DK`_8|VOu~h_5iOY_&YLr1-Pb1@)cvW? z@DU?2WQPG>$ACPk5| zhg#Z}z$3R~rYP&7t<+zagOP6yz8ccpCnH2 zEwbNg^>)`0^je$s&p&)ncv1Qq04;L+qy4l(R^q_L69m{j zGH`ojTXMW4#kID}bs)PahFskKa9sB_eY@vf30TqC99)n#O%fYo8anE~dL$b;+Lznp zo8~NTcdcots+m*yduslgDMFmhFPY#u-dfDP&Q7Ix{_Tm(y32~q^51xWRgdJ98VV+b zIjLuMe~^@l6}}c(vc?_wWKlHp7>RpBFL!P@hP|^mWm+#TLzwK6d>$|IuEBwqi;uLX zm{0blD|JCe21y>W6}+KUGwYKc2{#qZDEaX`YdCDh#R)aWxwW-5{u64(#Nw-verhn% zs?*}uk@q`JtQUiIx2#4j4q|xq%eEdK*I#b6;X&qDOrRrC`nTY_QL=U9o9~pw*T? zNywwXcBEjC)A$k~8esDjx?80F zqQhfjSqhkCN?1|#WXWSA5hx>=uck3*Fe;v=Ce;U-R&(L30OtR^)0<6)1D{HzF9OkCn z$D@_dd>qv)d&ILGyLMv{NWySL+X_8Lg1kG^nA>c+fmRo)zHcWmvKhXW;l*8qLQjfu ze;R8VF4S+=#(yU|NPZGjEsa<;agYqtz~YGPnojHuP5hgxQO(xO@N;s$CGPw>6!XJ(+@v|>zk)2u##^U$yl#C?9H!<(gAvg$WQ z;H7g;+;roWR?2EOayd&7(w@`ht-Jn;@cOyrd6-SbZA6@h^_udIA+w)l!t)OzHR>fA3c&KpBnQH{Hx*nHM*2Tq2y7vGuxc?n6&aB@coe|ym|j+F(lj{)d~=&mLPi6 z8b~=cp9fATLo@kk5~jos&PKv0J8v(HZa;Nj=RR6YSG5hLIxY5zsY&$oK9Z7>2KCmI zbX%zbB^M)+t*gN-XW`tmRT{B<4s3O7jh0cN#hQ&EPI@AEn~oK+MN)oXHE}GM!nIK@ z!*@oR%~V#ZZUAAc9wxr13U} zSSgs{UCkO?q!kU_0|T#}Ut3alTa%&j3!{?q?F5`f!>QV&Sc`*AE4f+S;Q0Ko3HM|& zz4@lXOc~k|WIIL0VscLq{-m#eC^(=z6t0($M~t;a9+rbs?|Q&-_XjO?;Aiq13tP=W zS`sU{_Mh&oJ!%V4K|e)UP!R2Gcvdi$-r!SEYsgPIajr*`SQM=%$~C;)``r`@uQTie zd*0*DwaC>V_ZCXwI)R2v?b)(yBKO28&B?_KfjS!PuF9&JEt^!0^#@9!Cnr8Ui$xN< z@%+5hh&#T8c9?&Vlk(8pn0@WOq&!J%`eUNO@CL?f1#-Rkh`2vFkw@;z`C$UX5bHD? zdT#vr9%Ywl3(`ErCyh0BJFr!UZK03jDB=5#KjIDvi22B$E|c045t)@$rCEpi*9kzI zRq-pw3iN~m5>&@`3VD81;Fj$KWFd9>Q8d(iSXy$Db^LnBg@J`I7+DkclUJ7aGJb8! z0%_4on5*MS{nlKABkb^>Ip}6#_5uboXz_u8`DIF>sBedN&d(f%A2q0kM0N;}HfLuZ zxYDN;RZsbz?*|a@5FOr*Fm$%L)MDNFO7ALibY4CtV*Jk0Pa^#Ne>2ZJeSx7q1aAWhco^Q15 z=Bdn1_*=+kD~YfvaiHqI9mhCIwQqHNj*cBW%%IseH~KQUL-66#ecetjT$$p>4o0xe zi6udy2+7^wKs;}#&<(mrYs+En(PWY&{FbDBBxW|2Xu9R-3nfpC1TPWaCG4|ek>+`% zY8{(6Q6^RPXY7J}1=i4MH)z6TNAi*9nS

ToXSB0=MO z0etXU^z@E*|0%pnuZZq_uy+XW@eqgh1<%1Cu<-bovlsUSjZ6>^N*DU87SYmA*mA zL=Pz^qyp8}xY{{V=I`B&PZ9!h|Z z)(Fs$!|8TAT~|^X(qhJtg!2M*CNb4Tjp2kRyFMX*m9+>a)6hUZ1fvP$Q2|a8C~NO~v@pIJE%CpIO3nOE@+KxLg;% z9h17GqT1_mRF>se6jx${otst66CPx?PFNb0)9(c8TJ_ZL&71v2*2xp=WB1M+vq*B* z@LwM%7;>Pp1@l(VnKOq+m)tJ;9nypQ61<8$bK2~sOP4~Cj3!P*ki7{YeSv(m$*frj^lPkZo9x-Y1fhF;R`ef`COGL+Gr# zPw01;+;kuaHBB6t!{TpI*e6}*oM5V*^eyr{4VZi$%Pl&#g_cgLOur+qdNs^!Me|Mj zbP`4enbSEN#IC-R+HkAvxWPzBR$x71)|w&WX}Qx8&<{xSpqm{Wr;Fs(z{%004s2PE zX2MM*AQkgpE#ckmnk0TUsI_u{TufaDi6=|j*hKY<=rSNFk$x85C@dK2dS*7!$&a!d z)m2H5gMbt|tDAA3dy2_2 z&vMYBs?9C~7wCgl$pO>&LVns1wuw2r91t{!!mX+;QtbVthTCQHk7_30ZJ*phnh*&I z@J{Vmy7_%l%rsimWr==mleer1@WAfTZT=UdL&FHg9--MHl!iN0%WcRLS_pQhU>#rM zI6ilR()w8ne^kxQ`M}4xwit|d%?GVPYx&?R%7G!Z33R$_C2m(7VZI3_IyjmVZk>oF z!^y|_?CA-Cp>0&{VcteMV20*MLIBCIMM{k~F@}yHZZIOA5oaj_a^Q42iLS0qP@}KD z9CYn_ZaE+r!|Y+&8rk~y@_A3N`eRu6u*mU7G}jwig*@h3$-EmGD>pnY0cJD3PGq}g zL7m$=Ik+s}#WBqJ_~4v4=k&c&XlQ5%Y!fc78CMytUKcK>9CYu033AXb5F`gep&&PW zh;pw9v@z4!V z@2~u4%9KwPl{s~f+hP9uU;m-Y_Fel93dv}{Xr&xrY_5PDKp}^XDxt@B?Afg-%wAiz zd*>e6Qx7d**@7kcsR?W1cG3e1SA3p*zU=6MOv$UWDeDu*Z>T7!XE8IkZa87=5riCQ znsRW@&YIeCmA)V0kv(o~B5d{sr|TRC8|?$_N)D(x&{ zczt-it`1N-uRzljha3o&g1`TuseKbb3!t*?Ne<}cK8^Jz;r7pt=475c+nBj708TC09iq% zzNbh0Rw3OoQ0d_?jcz|&MjZk~MXxMsQdxO5XRnYPw2={VfKfcOZ})+Hhx1Fy>D^XM zo!PlFQ{6LWEwVLMuUfHs$KHdR)~!2o=&+*62`7@b@7z{eP*RXxxO~lurOOvpR+KGW zwyL}&f9diiKJ7A|?$P4KSWQLg!4t>DDiD%`wlP8u(7({F+%8%gFu7rkyW#qPCgA@| z;O;=bpK$=L=%`$X9Pnsp01Ul1ATyPpgk1(uzQMhA4zw>hKz%gOx*}e5$5mS2dt2xS zTtPcC5OlV|2&B67Su3&%wt)-e1N1uCXxfRgcV_N-;xg$#kb|6@lt3lVg?7dVy4UNr zJG`hBL;-w|(dQv3vY&oBoq4R9E}>y3Po)!CC>}}HRh3p}S)~`weX?7Zv8`iXtS+ig zQ}p-8O^})7)996No3-BJk&dKi_$2!!i2`P@vmPD$`R5BDu7Sr9S|tZOGNe2;zrgEr zk_Mx*54S%!X?N$=&f4=pd;0Hhe8}1)YJOh&ougq1m8Cz20aPE6#hsL^(w|&RWu)MGIfatM)Pqx(I6R6 zC!t1Q{gz3K)M2}kiAqn4h(=umRHpf`l|hCYeQTH=bh{8eF?Q(;=(|WVV8}CNrG=~G z_IR-@sC;R-bm(mCltsdciKJ<6I*e1!@Giy~&`LhIGIGF+!i;O`mCCq<&Gh~j-G$5Z z`uK4c?+eG7Zfv%8T~M`U8@Bpa0f>@&#)8e_;NjAN3cNkpkOQis;^3R6R@4e;B_9A+ zMh=pblV$XhMqd;_$I`mMdmVy^cET18@-kq!MUZd=Ujm4az6L7?2Z>CA-E=AboCi&7 zInoM8E9C&Q)Prg$R3!j3HgC!YZ6yZj*`#))ABeS9lYHnbFemR} zEu-&`yqW}}Kbdm8zRt3G+2X{+dGJW3MFAkqLwPeYfg$tH_K6ino z(G0~RKfiG5r!ytRGHb^4!zn3}&$I2&zLhH%&RV#Hc^X$OTO1$v<)TFkP9z;iOlTDK zm9_I0Ekt=JnwolcAcE6ei?lHxek$qS8J|rTZ>qFf4(N@dqM{-+0d`SQ0WEWF1j+4a zG&jHmP+#wV#r?c!KXQQn&?Qf0gVpMDtEyxB(PNV0$?W?BCV6N*=1V@!YSo8T8S66E zerN^=k{K3it^r_4fpVbH`=%Hao!*m|BnTDlL70Rwrn72{giHqIDJqf+eL@g}(bRK5 zhdM%f2b373RhW$A@J6S%Mh>nFKrk0vm-ZtE7&ughPUlJe;%|Uphdx<`4RnJkC{H2RO0#{QG{H?-YOe9HDQ?s+3#>087M!S*&)O^mIIX0(H zk$uT0lECoL4={_xOeM)^nzDS6Za%aK6>Du!w6+I0#&89pHFD4*0&mUf?YaOU74i&D zjtTVXw9i3-m`BaJ=DcX79H68tAqVswP01%IitG`c2K@ka!~$^gX_`ZS*#zvKiTJOoIYcg$8B%Jr8fYGrpIDlym)EM zM>D-X=lprI#pt$14l*-xm#<#4YJEIZij_;3q@6fXQ&IlvzeeYmmJ+jFI3V;VQqsL% z?}^lm%*^bn@}d*R6FqKcT1u+Z>!IJy$jePSm04ETFlExTqQd;l)RRWa)6u@<0Q&RH z=}h;?UfZ(O8<`@f_q&hLBF-O3;R}J_faVT`2L;}66}@_%QMp)9=9qqd#oQ>RRqFz; z7H^1flX7A>dC*0GD$|sM?5~c|QBZ&+al;L6O$~gb;|xHG_OmXCf|}LT>pl-<^3dQY z=Z=1v&|3YVMdjMCuBT^pL7AiO?L-c)%J{Vv%w}_|bh$djU46W zdC9km02UcXr1r}cqlGm39ZxcFzjaeUuMvmO{?VK z%Ip`43JOzGPHM6fn?Q6cwu^MwNBu(GN8eBtCx)twy(JwWDsEZ!L6JPG8r-H3rC_&) zjbDqK0+0iQ(%B|9Ibt`V$*SU^!$-PDs?rA)P*3_S1}cv9bpMl|MQYgYtFq#e>8=B% zLm`@ROnEsF+=?dIZ72Ex-;X{c>k0zw0o@lgCuZf!rfRF=7>cIm? z-+6yLsxx!u0?A{YHFN6J&li34=@+vXFG|lUR5dp3^DoBFnlpLs3W>4tQ|GISx2mo_ zcI5&Z6_2g3DC>B7){&!oFJFVuisIs8)Yj|vq^0NheEi0AJCOtE2Y$Nbv!AaEeh<`9 z_z2LP!yl{~G2WP<q0BjW*yZ|_#o*7@j-EZPTacqz{jUB!-ONy#qfb!Ah-*}CB@g7N7lr$ zji$*e-GBz*g9v0pEkh(Eg+JZSmazO_!Xh#~00Hh6$JqS#G{4nJx$$x-f+&bm(~k@` z)lkR*dFkG?{2Z@J-!Fv^Y}%Fa3J4$JDQwD$-z!1{aVdfjnd14|81Mu{Rw5K`K*SM2 za4Vv5n&yLsidN8P0jL!`?%C0PJ7ea2iCy1_wFRJok@NSXt478f-$}=akKRw&2Q=uTpKxGzEkZ>EP}sw7?t5TN z!DFL$M|SITUDQDOW+oMNPM{nI{Z7l(l!LIS0erteops&{2Llv>LHc0XL8i;2*5;!v zF&pWK^u4ty2pthugK7_3m5a`rwKW-2{IyAO@ZXzFW9FbWM6>WO@Iel0@L%V0py``3 zT^OC{<;RiXs15XsY;VU`kk95?6!`weY>c3gg8%|@0ASn&35iPpZUN)^d=N1qH^1)v z?_c(Q{YVOZ_OZ!d*Pff1^ZbmQe$R}+Fn8|S7oGtbLMwjw*8T@a7yRk%y&byuHRRxY zpvQllHe_-&*9FKy0__)6=JCpIEZ9^nvEY$_^Ty*6pl?xOaBvArXPVoY3x$K#2Puft?|bA1Jp$80DDqfFY0nEHRF#3R+7tUAQB@CU{r4OkH%169aa zV~h3{q7=x1$Kx8YB!T#ULoq~cOk5c#XY^Jx=3(>}B-f)iB6E5kP9RuMtf{TnHD7vq zdP+*l@#Du66BEtm#_a6Ow2aik!hBpNB_(BN=ccD;=H+JRX6K;7Cr_Tt&d$!r$SB~b zsHix0>{wP-R#=z5Aoewzc2`zb*3{G>LS9~8YI+)m`N7dekNp1mPCfc}?9v~eD5$Ec zs<5yyH8u4|!ww+A6Ym}9bkBfJJ%acE{KB`~r$fjA9PL651dQ@dgI^#drb(6PbDd4z zf~l#GU7ZPm8M(Fq?on~{v7?cjYBATz7JR_;Pq*bG@xLa+qJrdsJIKj=iF znxCeC4-gdZ=K~}Wd;mE>5zq<|N48LiR?M>U;^<0q&X1!gVA}AgI>=LBR=RpK;$57#QE{?gOGzqNAC*n z*4vN+3TEcBzsk_QRie~sUWZrYbadwmBfAsXZW{@{aJQWx05Jq0K)F2jjp zM=VXm(hL27iij#Ax#A65qHTOXYlLw%9K zI<#BSyk3vnhPKg`Nb#WwC>oVP%>{%TIRkKah#Ckv*mF1|5Ck9}$ie-i3;XIHi~tj8%J5APFMU*OB?^6O!7%QOdX7oCnXQFT{?86;D#PUuJ7I-qI~GUL0xit9L}T14whDx*&NVQ4Pbx+ zHh_G9>%R9C#u9QMJOzXtJTRuH|BEp~4vYW+o&8|wUdX}Y@9xLC5Ud}3ytz)56(%=8 z{@(c4P^z9$9=%D?p5#EtCX+WEN=1KW)uNZQY9~D^?%}^b3$cJ4pz7d#*qG(0*qF5$ zxPTm>IgkT14SWDG5AXq!3qE*d{04+#T|g?xfvie4ndATx1~~w*E}-}0v#_sJhb>D) z60t6f-2|G^gdB|AjAezz#8siP!xkn`GSsK8Qdc}FC)1A}II?{4qN1|$;=Izu^Oo9N z&V4Cm9eWJvbXPxmKZo}^0S<1kRmKpYu_%{Dg@gA3tpc?C_ZYbENIE=`C=kcb2V76= zKA>4zO?&8#J+xoo`$j_!xLLhD4HF-rht;6<@RtMuE(fhUPekl1BL}Dz9PcmMfxgJ9 z0oN&&4(tOpFTIUGYbxXb9aqI~J_!9_^qO>}iC$L-H`WE%!F&My0Lj4z$PoGgLWO?d zqWcpn=4tk^N(j+4rkPl|6(2b&s~rK$3mmFbX>m^Ha*@5puZ`TUp-w9y~6338x}T%8X$ zGzn1jzo%?K=$>@&ftT}v*Fo!x4~q`u06|Olmq90p%_4G$S&;;v=ymyE`?2v@{w3Ns zD*DLHwU|aDv6E!lTT2Z-s53)PG*oeZE=4NgPsXG_6qA22sjySjpuM}l<7@2j%)l7 z-#LWUzl|ijUqjaiE52d@v^1{>ObAl?+{a83K zzlnjNg=s20yc&iYdIom&(A6Ma^dc00DM~_FUdcnu3=cY$QQfkp$UYx!U1_~w#GTZO z^gg{p^9n-a#deX&K3c4pL{%mP?-x*QPV8#0KBhIR?pV6yA&f+y$2xj#VS{>q0};?1 z2pUKTS%BAgVKhepVr}TKd@JEb1YQmJAc#u{*FWe-La4K-v53PXh&WU_uPrinL(q)~ zxT022&k^WB2kHq5G|=wk0Du%MS-BPhe&`S#G8R`gs=6JcSY40@p-)acic!=g=ymGs z8MCmP`eMds7+L_MzHG@-bY0x~4QS?uxHYOSIbA-l7vqbjvYmSlGToPwT}o;kM#^r6 zKa&~}c)Me361D!4T1k2l#WKpN#Rq3n3`QFKhDcwu8K~%*<@~5bsGI*dB)+ zw$)M(mCe>*MtrNep8BP>3TubWV#N%wHUvUn3L<#5|)9Uk50@KyVODuumY* zCZFaGK|I3eET*;l1>myE!QljK(#}*@^n+hM40o_kuz#?RF#gEAKk=XMF@g-02omK3 z2oJhHD}pE$?;CN6KBCB!6Zw-dd}ye6980~K9~bcW0mF3&EYDt*-pg(odR`;y-@@~9 z8I{@TS7@%X98iZjoXlyzvIZrdvrrc|Ej-VhaQ| z9y!4J5&=1&ANFp06Baedc#t9y?@>jxC{px46zy1w#w))#;R~sQl2qAt%+Wl0G_UugdbF+vC-v;o9?2P0Ix@+#dR(3GG4^ymD%S!3m8EYWye zq5UJo2qA>f2B60QG*(qtU;fJ96najEKj{FYNvy1zB_&-W#|R-t2qAy1h2^-?SYl{5jzi%dO+>o>()?8j?L~8d4F+vC-v^`W+4GRmKHf#StU3OrtWwqO-zcGQ%F~A7(Pa zgb+fT;DHAo2oDc8F4_U03&4(y=$!G?vt3N4TTP~Km`rz&9e$h1bUSy$hX4K-o)M9+ z3PjNXJKzZJ%!Y=BOVklGA7i(SJYX7?bz5}e@5k-><0pIXi`n`6aXWtZ{+3P1S#Ga?i~p5)1k?%lgL%7Oz`qA>0ciM{#eo0lwE!rK9U2}3BV z0fp_DC_3PIU@_^)+mdI__u3f+UGTl!A6Fd4x*B1GSa^L?z=bLbQAm$0qZC) z(*&Xks0Oe>4PaG}0wN&oB{KrO{U_ft;!yag%nrkoJB~QnVZ_N>-cIQpbG-AIjIc2| z9b?i=4-5?Mh06r=0@`C-gz%Nd<=Zt}5+cHrpY8>fgQSrDL*}{hYY4#p7Y9X}BK@IP z6QCGy0aOEQA7Wx+z&pbKQW*gXf~rfV?oXP!KW&N{Xo`B)6!o;J+n}&+gH1gL!eQz@ z$kb(ESX8gDs3%~XqWZKK)4ezB#MA=lPL2?+5kS!s`XB^i~p3qJlXUR!T z=EMn>oXCzRvD6bUU=rA|1a|TSR%Rg*?F3&7MhJ@< z6w!_BKRo}g>8{5+d~b;G2O~IKZOjNlA+%U5tg@KRna92em^p0jEVf{d(_H6--bkwi zV%ky$_x4#GL;v^2<4-=(`=ZdNPoH1^`q#!q2<;viFW8+rb?|sRX+s7$Ar0*bm&6Df zqYpd_MhL^iYrm!swhR&7`?O%Lqo<1OcC6NI$q3jbHn_ZQtDS9%V~zBC@w%@2d_IkS zu~sek!9&*UyZ|HE?bg&GeY_U?TSMOr+B;k@;^N{AR|xGAR;#tXzTUXtxbx0$LH1Gy z_rEGC>N#*$MxYO_$zF-M>FdZrAjN>c7gs^@$4>P+%~M_w3yR0ZUvi*IGFHkQ#@;E@Or&J{pnA;ckj-BZcr=y z{)2bWnJyje(jj!Xsdq<{r_u4&o3Haynt<)hqmMpXR8;iZYp;zTKmLw8?r^)^P(2`9 ze5cb4Ax3EDz~o=Ncronk>}-r6eD1vSyR;q*?%QJAuR6}IBj}nU>4o>)!#wWb7dbJN z%5S~J=cVt8^Up;o`(A#Ye@9t-Ec6;Ne8ZD9uup&yxDM}fJ6)`-r0Q3{s{G|Ig{k`G zBUQinW%aLr?y9ZjG0%f$jL=A*cousr^c7I@;KLOsPE=M_S5{V5RlqJ!dU~Lz(el>N zVS%&)kRAYvr62;c*$hc)XlTH;6aGddKSGSqZsFn>GGqwck|YT_0Io$wAQ8^F|NG42 zBGuO?FJ8EW=90$pZ@kfAv(wKZ@K2KOc=>tQ!kw0umY0|J@WT(o4fO%G_}NY<7l;5T z{P%F-6AbtVA{btm4`PCHWCt+*`n#>xH{S#!5G4h4lM6C&8#lG^ z37K|o?)vt(9QMYHLDwQ9xSf*Z6{{-!Jch;!Zn`NwH7zqcD>XH>u&{XhOMek5{`99m zVYZJNH44*S_+UYUyP~2ZF)^{Ru~D$YAO7%%_uhN&%{Sk?`|i8z>guotV!?zaOmpuF zyeM{FMpzdIMnK!^YwI?}#)~?E5$t(+Jmz`fayTtC>JCc__1=OIuz;BPenvf+7GJ?ibU1bSB{z=m9-%9%SH;;eo z+b}1-eP`0Q@5uY+w>&;)?m~9D^2x>r~!hj$`=4)bX_6AUb?2~L35`y-FbDS)4 zwLttz2?6>u8GcQ_7RdwgU*7q*zxw!(mihE+!%$UuZL!zq1;^r7{90&*s0qX^QF>*6pbd z-Jgo+(l4@W{|;TAjNp#|(6azh10s414C~U@)U_`zVT+j=(XBsh^0@*AC3fxGvBx0T z5k1KUDS#T12lheFu=-k7U&k8Etg+5->RD|qD=zx?Z+^qdikP`NC@5sw!Zg&9G1pVK zQ_nZhrKP@Qw2-;1#)?tk{Vz*&+mPcD8G&v+Z2miR1Wfh**MD!o&D|fnE$Y!5?)rZ> zeXln(gqt>9r4Ty8Hhf z%dXm;QhV2rpZ>|8p1-Br&rNqfX6iop^w$tB-t_2W>e2uDd!Id;XTPyW?~XkN5=V3& zkU997#N$ajpMQ>i`mh-;|1FOYI2s!pp{#nn^z+pL7_vzS4aDUIbo{iHE9jRk{b)l* z7}T-Hknpaw?04?j&(x()Sk$1f9{o*S21ed9n6z{(%M`6Yy&2iHw@6~@F{JZ7L&CfD z21gJD@WmXnm(S$3BZVk3Vcq+XN)iPw7)TmQ)WFQa&w>$lzxcdh1aX=O_$AVKYysdW zDNTYJ><-~l07k&xwFM&pOBOFIDzD~h?U_m8Y&WV~jMUc<=$RHhaIOx~^wbs0#VhW{D<*27|5;`*!ZV3UCk#f=No|@jXW5i@#=QOBN03EL@_jsRLRxNlVJ7|Lyv40e zoIVF}Qqz*FiqbWw-QsL;Ru`G=)}tp=SFT#aW%O&lrcoc#&$ZiZ4vTsBt^-V$3vx2+ z>gpt~uhHC4SXgL8^dp!NbY1;)#vIB(S4Mq2oj?EPjoTQ@H0R{WU+mv|VEUZ-pUs)? zGnbc_RNKuZ)kWEjja5FU&0Jr*ecPACU~ZcjLE8^ zDqi|6cwJIul3gV9DsagZ{M8b=ivT)6k$sq%aKly=Nr91M`mr;*SJkqEf*C>fIOF5v zwr=0HW82Ozx5QKDOH5UDS@F;>rfD*CHlHTpTEjTdl?HtRRjGTBe_!*O|}f z!`OjVWL09!hXNF@=PNWs=ug;CYi0B}`b6O;go^6nFVN`RSMxz!(OC?mz#j)t>A69A zY5;zsD=s4=L=AyL9^SPt&9@$dOx^lm2Z5bJL>D^Vrz6Jhq^_H~^@heC(e)|%>G7WZ zBDxNSGEXtPJrz!;eU!w1+}L*K2*IWWBlvd>#JKbY7{d|5me;Tgh} z1fRi|jS(Vy_BZwDb;I4g!n+Uo>0_^$zDp+s-+AEAk3T)?>DNXq*qk?P>bhSK7?qaS zP*BGnd-3g`KKaiMJ%9J^=WCDU+CUS(?f2S(4M+E-nAh&j?fE<*>*!99+Xax)53c?Uazm9_3E28Trr>2S~B zaCjne6ts*1q-b0YHR0^LhPDCvoVuNM)S~+XgMc9sV+l8Gp~sCG{$EMv87hIGy(On|B$$mlJ0^Srk3vN8o6ND#okJTZF1&_nD+#ptrxcfO z*UDD3KDk#c&b41%U~`WBhWLQ*xzFBt6;wdK^5ZxQpECr^9_h4KnvJ8Be-$_Vfq zF0^aE0thgID0(>46jD1(~`le2q@vm22L*wSppa1$B z|C>E==KJq|s7P`}c`3Hgk|co?aA~CeDgsiIGJ4D$lSxc(^c(kv3!*1UpLAeaJ-VXF zA7aUvyYWY|>myt=Bizf!2z;9Hl^>J2hcUgw=sBgq+zp#%BR4$Ma0pLvNsh26QVqhQ z_|b#li*9ZDY(iTxf;g?kj8;61?Qk^wRI_$gEGE@vQY{@6o5^c8O}Wvu$aMXJu(Wm`Ah60Vs$sMc`BMg|VHtCKt_ z{LtS`^0W@VNhbH?Flkz6^OQSTSsW+~ozRx`X&r)f1W2mcZ2tW7&u7h=70?=lSR+Wh zCWpWLeG^rdVPyP;TWmT=UDh;26EVNSP-QKBO!R^X=m>IIVLAO2wV3<50zr0-3uCO| zlaD_mt≻+u8UN*)h)Ls4gj~t?$TQCBNDOOiyp3-oWWDQfT1`FtL@ENGti4kU8 zXPRfaaUMv)bi+c^4fDgUTM*U>1TiP#x&;xPXLakMx*W#9Tr$7}n)7{Ty}{SmNwr3R zm>8!g1#YW}StE!bwqK`Aj_`gO<{Ka3ooez2 zJqK;rUlMWWA7A|6w9egn(_Mq8#}{qR3ctJm$SK=a?#%zifS69-`hQ=nON^Pay4%A~ zO!)x4ppz+TRQl)@iEilr!3tQ)}{Z_odth<{=La74&QeFpT7O@fY^OG+m2-% z$ZWili~vbHdT4KP8M;a43y)v&BwE?Q28wsI=7_|^0}H@tHX;SD^(DrNxVlYSTe<@T z#avMpNvB(7UZ45P?K3;wyu{Rbp{dgn)6JW{Z}Lv*Y@PBA=B>rv!YJaxK-!=Vxv<5M z7GQx!z*zv4)EF*1Kfqc++XC9lpb-k~XCNB7>cb8PZIbQYqM>R-nBX$X0X*WoPIfKQ zbRTD`^G`W(PQhJVpp=aOlyZh1uh+^(_ z6R$8lMK2f8i%q0L$& zXN08V$)_`dc+H#o4*&gK3n8Q1+sx@}xEbreZo%3cfk|k!{(z}AV`7N7d;pBm692JR z*D#RSW8ja>PJZbbAL*Ic(L2TDn%KcLHQc`Y9X`+(2Ab81Pi^?F+z2J56XvsKz20uS zmoY1^zi3ooR@1YX@G_bTZ`yY1H2GPb%hDBF9>q>N4ved&3zJ?FtkF{&Ny)6d zlx~lsl{~05XufNZ^78U#&n7x>x%{P5XKM6TIvf}#>=@uD21OJEwj&QXjh2c~{KtYR ze7<7v>1xK9x93NMZ&8&Ic-r7snrtQoIe{koX2cX^hmICZ?U@ zi$D`_NeZMc6JtsIMgkO{)3i-eE43}EowOe43$iW3-FUOc9F(3@*|`A)Wa=%qA9{NX z7d27CK)*G0;OS_tBQ%4E5P)%Quq}7;`!&!D_!S}Gb9(Zx5}DoWU5 z3Sw&MtkT9x6ecmL&-jx*`V@o6C;CBlk zw{6=tckbK;3l@k7q#&s3;)RO}^NY5`Z|>du$;I;*I2-NHKK;yusS{_-m_BX7w2wae zYH(zCY$67P zcO4KJ)i=DyQ`k6kxO+fH`gyp1;a!IC4FYW+!n+TmorQRup*x*Z^4&!9>3tFAB2E@b zUq$~`skV-R3FC9b@Gj?zZZlx{S9WK~6$*WtRaGS-pyNr+p=RI@+D;{SJU(3W5b&zeA^w{YgeJ24DgwQlHhSc;@bHA4 z+uj`d9@@*Lf`}VE;+hb~yydFh>LpP^w+TYm+?I!Zu21SqPD)(Zjd8hLjL>y}>8=6) zd3Wj2T+h%^Q*P|h`_6|4V-6>zHb!)Pa?_#w0WW+sX2SB}6Bhn=%oi#7p0IBZn7HIn z_#MA}HTsi*FAd$cr|{jW>wfg;tA~@#qo%EY;k9>v{P^qNxbIKBpC5Ltuzp)|<(>ET z{rCIJh*N^+_QjbCW(5BZmZga^d`uO^8o`v+y!nXGO!%myb>`Eg*dukLS0>icO+90@ zg268p5RGl>jlPKyAO-J~@QSJ3F#%e{YzYL57`j`rTpyUdp2jEW;NVQjp-s$KpUQOr zWz?$F=*1Z$mnR&`Bz?rFJf)#ZA_uqmfk2+JC6Y1kx$8sIk`z(3Z2En!1LH*x zV~3{NA~gq}Ew+ws%Tr<;jGhew7e?AC@Jz*!7}6|29yF{Plgz$}k-n*6$|RF>a%A?r zL6};`95@SjTFMp6pj_XR7|POtcK+7u8FL|w#+&{_Z$`!Fz(5tULYLy8g0vVu!9>js zp+TwGQuwSlk`lysB0lpEXhs9)s1Pp>Gq8Hv_g#nHvAS%~eIzgKGnOq|X2jqX*uHh!+SMB>E6cH`*uU@a_>U*Wt&3f>WN~Ur z=JZeJKJ(nOW5$fh$5$XKA;D^qhefFPYhrXP1WLtKAQU50gj~ej~ z#souUL@?Znt|^v@UA$9Go+;QhgweyNQazuY=VAn^51(ChUZ`wj){e5BKYCyfb2U7N zC4$}yRMptHc-3iB;^tzcK3FkKcPQr?~o^kES?OEjv90t@?Dvyz%2c zlIcj3-tbhczmOYE9@2v%R7WSqj-qE!);a1USWniq^1Txr#fQzc)_RLoa=Qu&OKTdc zJuWXQ+R)H|KJ@uKJVi4EF#;8{W$Wg-a~95>`$a)Pff0ktIyIKR)QHA=_|u;t8s3fc zt0Kl5kZ=Jiqjx1`1tz%9ze)hzr;U!8XA1Y!*36u~klO5rrc3UL5zJNm+FxI!-Z46W z{<<4}D7!w{yJfY{SOScYwqyi4wU*>ffBpBSzy5F2%Wua1^_noK>Kj{L7`pE7Z|->N zFNukX`(Ajim7;@X*fVEq%zgym=wY6$^MwF0wQBa?W})Uv37u(pjn_Mgt_XvV&_kLd8!G2 zS{182uZAEJxG{gIAV?9v{{*)WZpH03e-}9@W|QW)e(7A3>i8_UHb_qS(3=?q!AUEhugIo2&IGGypHO9qM)91gqNOat^Dz>^x1ze9ts9E zXim(->zKNp6l3&8(@bdzB&3O?dUTh=KJ6ZPqRBJaBv0(%oMcLRy#sTVip&MD;CVbA z*v9o)LFYJ3UL#qAx z<;dZKN6;;So>3HS`Qk-Ym8JP*HK#KIR0(JOPZZCmL^rAir9-@N#1FmBh11UwLO4J8 z!(c(e;U5mZ8}wf_jS)Cd%{D!=C|M&Fi%Bxy=yMHbT8hrxv>4OfVWvqQnm)cdmN~ca(>r}rI(jBW z_$EeprkH$_JG-Vv)@~XlN#3%m+FF~#+Gr8K?1-uK;oEP!Fz!^ZrlCCpu-NMolf9nW zUW$_{BikYru!F^<*&?*YyAz zL@4%-u7+3W%u=JBe+z)2#Cd)TMxX-=MRV2u*3md^=BJbM@^Yq3oBglXUVrL^S0!<9 zadw0l;VL7<2!^?6MxcoNpbl)T)!G|+srCq(g!~=^pJ3t4LXQKh4wLOulXs#?nndb= zG?5-U@J!~99!!LG(214q#xjbmj7dY8`ezz<2R4D?&*=!zJXvsJCi}L?4L51FNYn>2 zoTfVGEGRW(Tj}Ks3gVuqBxr~bl2Q`l45KZg z=4Y)x5MqR@j1VIj=Hhh(KMbLV0|a4b+CEo9AITMoWmYKO&>-y7Ouh+Z+!MpyQ%v=r zTwfFa7SrwYg)vIYH+^k}z{CTUU?*u+d}|#w_bZk#(1FYuffGSEe>E#yX^ga0{XfaG zmN6SPrCjl$wBpYd0~o=vu_v08k>a zRp%!N(B5_WT}=8o0tM33e*A%2o!;dY@hO^^cjAuVWrEQln&;S7sB}cnH;yW|#a9pU zk19pcs6rRn2bT!5*$hU&W&}GCs%HpS5DGt=Y)eKEBGj=*FM1fE#guE`hQ7ZLHQ-Vi zA%sgtLqh|04Uo>DTWB;Iq4BsvXzP0ogvjns`0wyvW2OZoU@^xsB~~h2!WQnpdAk5E zMUX%sf^Y}o2+ywxL{}IW7lHsIkn#dclRp0V<5AIX?bx}GZd+)QO0Ox{jM1 zTt0lvM^4E-cU9cT52k_EYYH*sEVfYQ#jHKuypYaIr(U+Ppnw5 zy>wo$DYEbDu#U-$Zjp*UVXE=aG!}Du_8z1vZlH=jQ2CilbA~)^*FaBK)mK-zBzhW@ zp16S*4USOb=(Y-RtjMHkqY=WzBE$&6=4|H(d|ek$F7rj6izL5NXo5qqzpCHjXltBT zMG}kv>Ldyd;YuUK2+d7%Mi8{1EM2?=BaZOkDC@%i8jXtw;N8hmo zraKc7j*cAjXld%uuw>5ik7j;$B=H3N1*HNZM!3odF+#9uv1`Cy;PW}l zKcD=ePjN8WOFW>mZF`Sy-+!>8wt;>}PiNCQcOV@>qmPvFyZrRS`{WRNT?jVc36op) zVsEU=5-wF8`wf*p@bBRp4tnxm^||SYf=B0SGreVqn3x-M06~v3D*VAA+Dl)9&`^0r z_E6ta%jn)W`cu64AS4F}F~U_wh!KKKi(Lb64jpkpYU#yW%tlR@`2iu;bJ7u@JJ{m zWDdj;HZ|wULX-=jhN8CcMBPwH;SaQ^TbnZiI-Y;H*?TPE(3@`#o3~&-bS?g7DpW1S zE^nW>r_+aDb|}=RFF5utr-^m~h>*;nC!PuDAMCW;y7v52&rE|3+lI9cF+#9ud9ui8 zra@d4+2>V#vgD=x0DXDfE$Q@eF@&b~eSl>hXUwH2(ypz$4<{xkCL}Yr^~nN+`J zcjA^EyWe_iEYeN=e8JAW`?l>md@3#f<0+rpEcT?t!;JY>uUWT!$DYcn`kgzD>6&@_ z_N`;zov~v18d+5;YRx6tC-?6?bo9{Pj8i9e>^+#6m|9z$Syfo_=BV*AX3S4Mbr5?Q zNn<%_X&+CXi`;hY+ppVd%B^1PJu-_+>Pw0~oHR8jFBcQ?%8NTEHp%C<#BbS@pLTrj zfunnm9G^dLU2$HP>as6fwr0zYJxiCZ;EZ6@t!)^A#)h)gWap59eMZELe&zKMG>!^= zO6tVH9ozRGm+6ZTm{+dP;_m%$_x108`3<{jF^-Pf15gcDdCbK5#w7Ds z9`fREdp+H|_mk5nj-yYWw3V6=VuWDRLPx-y+;{j`dUjrZ_Q~{|f}|q{F((%;n)}g5 zADSENh=EOhdcXTvb|RN&$QVz@4c$8@n`b1lqyKb4TMT;Gfxe!M0WgBZ4NdX30l7qS z3Km)MC`L@~;`cj^+n~*-I(dmqgk>PuePw_Wsq&1gOyW&$f>Cq71vJ&a%@~1>Z}iXK zA8C=aJ-cFi_v+vG$zB6r{4Z$?2$pr9?4I&obdAj`J{lp6|4%yrM%Gz2cFH2-(txq8 z(KTQH!7nt`xeXCwgkW=;jsTEN!bxrO`}o~%*~wB4utqcOAT9zTTgt6%;Lqujx5I5( zr3=ceO&Ebv(tmoQY)Jn;5?t7B^Pncs&+{@>^9_6TFK(IkXoi1#0DtGqR(9&~{)2i4 zp;zy|eR}on(|2IsC;$9dpZ-{a=zQ7`%QixY5rWMb&JmclY}vAkioEgTCsx$e)S7Kh zYsJ>BThj8&5Jh8Z26hcO$B8A36ox1VY$0mcJi{HhzK{|~x^aX?5D^3dZX>=Q-) zL#C@L%Y7a%CLG+@)TQ))fMq2!&EoKC83jciyLsvtb80FJAl7l4*H@Pnd7brh7A$tv zlr3GkX6x3it2b=gf8a=R@+s^cQc`jpb>+qRd6lJEo7Sx>Ey^t{HSal)R8d*7bLZ{@ z2?ye0x44|v^&8@K=FQD3TC;lj#*G^{Z9lkc=fR@lT;_2pQseCTvp$?Wuc5(Gl%G{w zQL^*U!R_(89lnPAtn{kN2CpW)^2%EiCr#VC??82J)%?ZlHQ8QUU3W4esk$<^qP%9- zyd_q1skx@Os4#!iy4doX#?;J=oT8#2mbfIKCzI0iw(r{Sa@wmZ>le>k^2Vr7cJJNM zP*a(fosyHDvVQ#*@xe8Lwmn%CnGol31Uv(1tAg4bLA5%Ks{A2DV{J}kAw~!`r|lZ3 z$FbpWXsE}v%i*l5sLsmEm3$tt1WU4-+5aAvd5Fdj%b`fbxr98uWmsEH+lGrLxI4iM z#l5&&p=c=%#ogWA-QBggySo%G?(XgmJJ0*=y?^9Sj$~zKGHceY=M`emGLoP|TWgN5 zZOApiBk}Eh@FCgawV~o)rN`gk&p%IhAwQq3pr(3l@lggi*Ghc9!`hxh*Sg|?WbuVR z1~V|OpZ;Lmm0mT2WHE{JO*gQG1%ypCC0dHf1m@x4b9p(!7pZ?N?S2>F=`X%NVRe%K z{~t5!8wHTDLBaC!bGCWK)se2hlD=FR-p@;nF~LY67(n?1kx_ZpoB5z<*+~Eois_>3 zIpSVt`7I|n?xLE7;gF-l~p6UmD#-Ho{Gj9%%B6G*aQkY!SXn+3v z_qWWvd_u*=YyYNbOl9~|1>2pErRYI#1B|5?t;WANa2$+)lXq7A2z(#+F)T?82fz=?O%%P>`^eI$bf3R zD>X;Pn^hlBP5Zc0xvL)Wj)4_s3+1UFk}$h3nA%d>=h+V~Um*yUpAv=#!qZcL#4<2k zx<@vpM1Z@N9se&V2mz8Gc}E>J<`79Ra7N=lbF)DgX50T=&fhdX zzIWHK=VY-PaHzL>1k6;mpbO{2&}{QAs4f;u$qZ7b=BwLr=BA8t11*IA>%gRrPo~%A zHv5|yb)5lj*vE|il5_cE#tKgO6-BeC%0p{^kUBnkO1tGi%oyDvy&T~OYu!K2ip}^` z$LT+`77OQEjmAZmRSgUCR^jW%vmIl}OgFUd%1)Jo#*K?uEbGm-^Fw!Y6ok!ZIqka7 ziA)EpStz3_!<4+vxVT{72__?%$G@u0NZv|3YW=*ltjsSlt+ELWQv{3Kw_qb%geT8b zQ;+c+rEK_qNR{U-jo+fxncd3Z%DU{fp3C8?xNjS#Yvgd&h zc$Y@5FLC0FcAWQ=+)qKac%ZRUG+^8KRSGr)<5T0dlnLXTcU<>u3$ncRS5|RSpO7YriXn0njw6~Zz%E-s@p}2$XQaJFE1xh=T_%;IFY`CW&7Oz!oF@aoYP|b1J-AE{JwEy`AR6Rgi z_>gaUJAbqo`N2?Io6q+}3xOz_) zyWb!CT{gMnJWpn)jG0oKmni7c%k99bY+!hz_HXTa-I+I0K#c5*CAeh=)L$^n_@OT? z?H=FRu~#oo{iDv}z(k4v_s49-B45cVdz1i%9qX6nwWZvz;l+PnA4rNHT}*jq9%&$z z^D++iZosuTM|j%tf5uY>*&N>=yD2y=)eaMi_9#~Qi95MYL)R&+G`is|Yt6mZ_R<`F z&eqMcMwFFX(3P7Xox^50tS-2w(U{ScUIf!NkELfObLgGi$(u09{P=NO()DtZo_})! z_ha{ZFA$qfb#Z>)tZvoBOe|Yq=o`alMLw6y>=1`_jMZ%PI^gl_s?>5eU0EEKMzfm_ ztC>ZG|9qnK0m+fRO)S1+badEA{o$GKcQxU+%hiMbxfnyhvId9Yrge`8tJPYssf+Vi zt+vW7hf{)7zuzTElwsKn_cIj5S7L$`(Nw(H)x#7s*BC&*(mMHvf8oQFF(Cq7Vw~Z> zz@V%z)K0iwwz3P@@&?+Sg~x~Q$9opAJCKy2AdL`X;irWedJo_~v&Kc1(|*`sA-9P(`=DyjUXrXjpb z?jc0}HBOMWIPupnk;*Y9`dH8G@V_TF;X4+g?QS7TqRcQY1Jl#DGX(r>IavwR#QWy| zGoo52(cg%LAwTYse~Tb;5DTHThxt;IrY>z6Y>%GnLUBb^cJr7nyg4*r`4j5G5cqGQ z1V%7Islx`B7&Yl@9>$Okg$@f6iV4&Nu?SsfR0XcO4)x{;Zl5hT+2D0zt%>-7&lr?#7g(RZ99Su2R zj;~LT#8-&VEnuHuth5#aNlOq22(<++VkJ#{xOzi>5$Y3?c>=oh0DzM^z8LJ)VOO|l zc~HT)k7AxePXJPXsGcu7q*D-EZZD(cJ6jmCzy^^(1WnQ{3RbM_P$r_pTyCfja?v=k zCxGQPu*FZe+4l;54q=N12}TFOr3ZykkxPtf2LtHbTtdvK`2>-_ZRHyqjb{1p<}_Z8 zh+0DEhojSWe(M;{M9#-?q*=XjSQbQ}Oh*hQoNqM7+vUF=rO;ekieCeMnyyf`3XC6N zw82VR$tRCit&Js&=TC>gWiS%02x??vR!IsYK$$MD%4* z>5spH(xxH98OsT>GD1mj{?ub1#NE-eDPsr)heGf|xPCh)a8qD+~yQiD41J5;D<_d1rtcPg+3aUN=_FD2bU$uLgd$raXnbHlpMk3 zYbs#57yKiR%oAc8ZonuP7)Kc2S=#BdBW3bkTT5c z;&B6(n&Mr5=Q@#Yy_IXH{J+RjU@?RK?3Om95DJvO-!q@FK^5{oCy804m!l9;x&Khhq`QumFmQcniP@gATHKlHM2geT zw!Y|}fJqJPp4v3-(BcCot;3V668JlUl&RfSA>##{drT|#GFZ}jZ&VCr#GS1eY4EjF zq@vo*wDj%{l`V_5JZO1o(YloLzhE%~f3IGbO~{dJ=9X4eqnY+k9SyVlybb+FIN;}^ zx&*L@$3(5G>ODA}u+%8Ubb)1Yfe`_VsuKBrDuO602Kul&Jvvbs( zYuMer;ug;#Gb~51KV0DO{0Q(m_m;N#A{ImbN{2GLIFOSESO-^6mfGcK7Y26JR$)yf z92MN>_nTff99y0pXf%M(?)^+4u8_b}7ca6Iy$T{gfU<S52~ zketSmxqewwL9evJ87FB4QTjxDh8){c3nAAC4-07rbrXsL%U0>_sr~iG-*ZqKCP)jH zv$}FEgi|ue|ME2wXgR;-W!BAyxcAf+2$G->QD#ntDfWsoJ&cw^`)l_e)fraa8aFau%v-?cLdnW zY`2~QyO=uWYlnMAvfp`KE?u;z$ovo*O9&x}(?52%0k9N&?8SRA2F{CfKT^Wb<>-II zNNi<^se7;Elaa+;5`+TS4-)>#XYqNn(|Er+15IU>oeT^L)~%~6D!_d%PEJlW+s<4> z#`X9p<@3@xcNOIUGAT((VG5LBiEd>9K|4U#P zukj^DOHMn@Y0kJZCDWaoguNYgr>F<$_j7p1u?4wEW3}9Xe(+I$Bx+ zf)hz=dIq-kEp-hQ7JX4=*?`KXCa|yu1s>$7i<8wv;{C8>6`dF|9k>a>q%~w}T~kvt zilD3U=%`l2MBU9u+v+~GrB3QclM=GU>Bh2Fnugluh$f5q4{f)s#=pA z6a>loPuD@258|Pt@VMETf>Im>A;Q1*#{bag46&oS&a?!IE|L2vGQwIEq6n$BY%zi~gi6d(ArBzyyl=$qwk4Fa9nFE<$0m5k4ID92&S-^YYb|5`z|_ zf~ba2hF^fLzQl;U5|Ww8+1Sw3I6s*#&>7BtuXQmU0)9SilS6~!{m>b_?UA(#v;u9HH61O}u#Ij;S!knKVakG{g^rOx zkm%nfM;wteC>&vMI^UkUWY~-**^hvT%|z7Hj)5(#)5v@?2+UA4Ald){eorNiYKHm} zElJ-BHe)*rY&mIMh__=i(Me!%itm}*XJ?Fo3(-$(CRbz##DMfHxj(vSwzaG0Ll;QG zPrUm7ekSfK=fvhYztUJ<*^-JW91Pgj^5X7dx2_)Hb>k` z#*d`fq${uh%bxukQb0!kM?jtjI0LkJb#$aXm=p~L^~#yRtYpM#X4F(3m{eO+fooe> znhquZv%U}|dg6WW4V2z+GM2N`lOi~%85kG@1-olnz8<^UyO|A+?%nzO`!^^_H7XZz zFQ-XSE9C(@y1!9>X)Y|QcrtbGy<#Ga{$qlTi!GzmYA}~_aFz*Wm~ElgpIp3mfNf}G zq{r`La-Fxgx3?1?o|;4xnw*i95}(ZDY;asLuc@f=+xiWl=wc%D8uDUSzhBV=4mBiZ6_zUvE9&Dn_(eeRA^*!;MqpwHn2m<$m(5EQP%b_ zub6;4c&>xxVrzFcBW@S6z4fr&YUhDF08*>boAO_xAny~o5cFEE(hixmX*vB|cLh_5 zT;A6wv`M@kZ;`?MPCWMX-29ytW$B|R2M)$2CX;G4;0uo**PO3k7xgRZ7^wCT=vVpP zKj}a-Fv_UZO0q`v%=*!kox)K>j<)+alHuiD-p+^|{_&D*{%C;Z)y%tE zxC_}_!_^HG?5?lQpBx+Gzpa8C;P(r9HpH}Hc z35=qomd@(mDGS=sD5}Yeh!>ZH2SI|xxjd{S%#%=AnB`_HzDtrmZ;iD~qt{4F4llww z2KI169Rtg6nR7?HcZRTPBJuQ&fYq{FJWv)ql0s}lmR0ulAV@113Lpp)+c%nY65YHb zINDdu&jE(rNvZg>lF8Y@ON6AA9-apZo+UxjieBq(AD$NO@5oR*59gOJveaF{Cf`l0 z`#Hl_Sj#1Npz4J7vS2s1BQR+4NJ=oANpi+DcAeOX)|_k?!i&aFYq*M}5(IMi^t9aN zB+T?y03@;u6HIS=3GfaF6P2{|@mQN{ON9laU$QRoBhA93{PAyw5|{d0Cn=tz4W6x+ zY)M8Md+jI}z1ekmGED?yFV}J`xD%}e)5A)|ph+7rOr1N(1AVhapnI(#tKMg-Ah+Yz z0YHhCi|k%qm@0z!SeT#ifOqf6s!uK|jvgTNF!kN@*a!rLkfcyf=sT39^uGp|+%A83 z7)ya?+cn-xnTENAkGopU+B!Otw&;B-|BCxd?r>O?9QyIqkdoC_(-XOqDa7GW9hCf5G_ z$HD&L%e-cy2sCZPZf9-d?`a&wDU15`C^}iqyRKCe`c{@DJ|-4cS=v^nrnc_;+qLtJ z#-=R`Jne|>aP<@L^X#kR5*4E^E7}J`!H+4RtftN$tq^xn&kmIAhEAP~&TBOR z^XR&bO}#3Y8XgBPFH!Bgmpb!|z;O%nQ%UQJDwmcCr~9-dIT?)#ssp$&lZ;u@_*t4@ zryot!?i&ITmFQ_5t$Ry;XA)vU4+Y<_Pfe*8sfNPi z;d03UEv>}c1C=w2z6oaVk*)6tDv#pM1CqzT)&h;EkK31guxi_nWdP{o?qOrpd0D{& zC8j#R`C)i$CQAr>=#L*qZe2=~L0Yai*C~*;EC1Upda-93A(tdxCsn7Eq?+o|i$kEjcQxcqSl||J z9z`zI4w0W~*8gr;N0@Pzr-CRJZxCd;n2==2Lqo@+FK~xQ4=lUMPBPtq?HDa2g2Zq@ ze+V>LL^nqdAK{goMXymUXITumZLv0bf}FNBl1jnC=MWbNKl9k?Zuj9TzT22_tMOr{ zzyAJn+iBgjx1;MdL11iZq2kipbn|@}gIHxf>U*@4=9;wQ=~>rN{;NLgB`C}3vS$2! zxiPEz`f#LV>ec!-2wl}^|ruP+x*&AX{-bcTg<;SRTAJ<>O zKTH=V+^*y8?`X6+A$2VQ6KcL5#@F7>lD2O)3*Ma)6m z&NeiV57U0EjNB2X7YOzVm45CcEubG|vrYL~GKw2e(RVkFU5-Q%J-z?l>n~7PhuF3T z$4A)H*v<%$MpjYJdy{qlHto3JS{9VTgFLiTuqL#^{nH%}VUuwidN}s)jWTxz^g{vy*R$I)~^`~`e zns4_g1Q8oWi+9eWw;K1@;@s1jaW-Y>Y%>Spo+kLJqi)(c_pl8@(4I(Ofzr{dgc zW&MBvC#U~z=w&=I=Al&F-;t>NV!<;BX2AwerWo8b-*A}Qn8*xhc7Fo>wx^1OMzB!( z=Mrmw384?!&WQO7xZqfvo1%ZjmJck zup(6Eqz69Lpd-lV^mSbAd59_Ba(4>6kow7WyTw!-U%;~}f;s4EBRKUbm&S@pOyPO{ zsi-WZv5w!wQ5TtWrbO#u?*Km&IQ)I3rqT{7pOa6JTr?@v-p|8##8CAtnae+~ z<3|lpH``A`d^{Qj>kx#XG87F;QO))X|K?&!Y3HYvC}l;J5Pe;-y?!CZp4XJ5pd>er z%s%4LSee0!M78>$Dc;0Ep%k%eh|9Yc70i$EbW{)ukX!)>{p+EK5TU_#5oLB|)|VO) zJID+QOvF?UhEt;S8`Ol;j3s?6gZ$bE$hEbVgGa+^ z2YU>QP4qake;sNeVEdeyYe-UW#y%AR4qfomh*yH+|X2+rX z`{A^vHk|7QE9qTEw~v}!lq~hFH?6YpmS>Jvv4o5ZsCy(HC9+C5D$lH&sW%;;Ce#%4 zGLACVBXH6+#u1x5u#O0%GniGVqoxh+ zy`0UC)@nL~?Q?~VX#6y=cIL}k=*Lv|XMX_@JxRyyUR~}sRej-5#}kq*+2n%YWhLY5 z$RAp8UUODZ2dbIM?Hhw;oBgb@Aqqx@fYDCe9uXGwyY9ceQe>16&0ryOhm`8v=4{hm z`-=4LHNSZj@*{AJ(S!*BYI!~ht6B{+#@qmkZK8|Jn->P_wzaCl_3yZm*6ekq2A9du zS>v2k8{hRhDk5TeX&nIq!Qu6dleTm8t060n+ZbPObsDh_LpN6{$@nX9H7 zV7`#<7O)W}|N0em&<~BD7u6xX^NH^_iQc%~Z1wa-TT#w%^19qAG#IN;Xh#IAbSvC< zBS_Z92Qt0Q*djmwA9PiUKloXRuOFD-Rybh5``cS0^m|Y2-VDa~mAY-wSN~#Qp(mVn z_6#X}3PL|=zb|winq(aOK{gQM12SNG3js!&J)Tg2@`92LVPduT=hx5$t8AFhJYoNg zujDcEPzciv7;g5xn59=bSkkSE=8OqTy0?_JPfDU0k5|@tf$1j!)FME3tLBW;u&M?>CO|yp2G&38xLq3`)aZPc&D#)7<0M$0OqVU>3{f_dkSg9OZqUpk}^KbmIB|2&-X{Oaj{`<9N!!rlj-2kGtL$kCL< z$K}}PTSTh}kH3!O7NQv#Kc)+=PK6BD`41GfO&9P(9|po>@bZ0o9{iffj_I%D~?O!-Ab$`F~K;C{n@nohoZ<4i( zPJw6Dw+MGvl{fy=tbVJQllNUBc|X#|d-l}gxt2yZ-+EN)<{{LI(0&sAao__qId)>8?^na`R@Wk^E(rYAp=CFJsa^6m9N-ba$C*`e?@g?2_ zNT$W}w5W6ZnsbhPH@N#0MQ_a?u?o}fJy-{zkTpMp!@(Wf0fWBO4xDEV#@GRER`IaMzQd5aP(M%4Ct^$ zfGH>yZNcU1qB8iweGh~=HZ9yW6_smL9^X3q3 zay=~v93ks_2IFTDfhvP)OC^~#NA$Btma`*{m}(Hw==jBo&jY{$L>av-E?g}P5DX`2 zAX*jqByG4}vEJtA??9S(oltnD0RbXmyP) z#d+oG4R-)-nu^@KY1LF(9S3U5+V2WE5Du5%%5qysJrswi9u~?;)H9A!7ZJvjc~J;b0ht*f46_wf zL?m&b|67OBQDx#7A_LYgV7{2m-RXxiEr&!1a0c?c2h3D*9tOD-78Q9tZHENFA;0vZ zdP5L?c)i?}R#XHQ_-q>`G_~Mg_Z9SvMd-VVve6y0(E?-s z!19rAT#R6#mG|Si%WY^NxacOsy6yPm^-?ku+%XIW9#w-Wfod9YghyKwua}6o)ou_8g5;S2R%EjCC``3RrGCY79W)i6#uz5QnXQJGb$H=H0R<0T2<#0KO@xs{S!cpE|@$`5sCd zF<56dOQjW#g0M{hJ76}I&5uUb!ctfB30CFq=>jVidpw+lwIaxmGseP-p;*A-Ai4gO zPJoAJnL^(N{}CX@5LA+Ab-%FxNLLX^BpzqAnACE7S3S_76rO=tUUxH+soVK2V2N=m zN=ni@6Tw$}MsAQNlMrA8;o)E+qn|u-)RPBfXlVE!CbDE3%nl15>;8Pd+$zP@@kF=A zy8cU7{kBIfs9t9n287K9OM|mlx?FDP*O6+@F;i3jX=uPoQRA(>q1etBkFX8%UaB)1 zJ6o=2SrtxC%!amuU>5QA_Wt=3V@-d|moy#yzdao2%uI{B0{Iz4jocLTw$BQyAu6X^ z@7t%~!Gg--fxcfqCD3o0mk-{5sV7JKdwYg~JXvxT+qSvYEXKCKl$HG?v)xZh!7H0L z1V+(|jm=<8_XfgaPKSjiWMv^|Xw3c)ruBc(RD*{2KsCVd$mD3*Pz7DGayHSQAL>ckLATRvXUOb7@Gpxgj!`80PV zR&jnKFqU!7DzucBNIq`;-3(@Cs%>MIiM}j_rc9ofb={+X>D)PGY#+G2;x~JYv~&(Y zqYN3VD$LXm3%O5_qURpT^vxQHkKa##FB{WqZatR^nbl+a*#ynb&aPIeLO5KM4RUqD zS?J86DI2V&jL2~!##`w05o`9g?I$}cH)vCo)$J=tf1btDC#{AfMU$gl9{kb|mr*!C z%(~c=muGowuw+fhz=vl9$+czR;uC)r-mN95W<|E1bPrh5gaeC9y#fJ4Wr?VU)cDHH8ql*n@MWLUC+6>xi z_9G~<-!K{!Y~K=%S>JCtl$z#coRgMzjORICGv5EwO+9gOo<-*DDQ9USFy=rIRfygx ze`&^EKdsWz2ldGR50VP7wz6vaG*a z*8^)U*C?m{?$;oT$-K>LRrRcJ)R2>S?9Du!=a@cPT@PSx3RDJN!V<^CVB^;OMPR|3 z#Qbk2I?O{N!!6(BIn1ubEOS#!2ywh~=#K8Wh^ivXtMrJOZl6cpyy&+KelKoxzcU;; zXRuH>Zr!)(aa~~-+d!jABnRCR`uTESi^X{R#3o_+qfC~E6obbe$i4tPaoL+$e?E4- z<{4@Z{9}=bxTR&y#J|O6avJPMCj|H1$w+yHLlB1~Q-n9{Ql3S2Em?2iV;F?QzawN81*Uja&Qo#=Z0TeW%b-*B9y6ye||4E_5+-ma7Or))&1GbEsC= z*B|ZC-Vwq zpFq8&kw~2O0^Wp0;($ZJ=`gPROAJiR86E#wCQ2R%O72*nK@Q34cB=a}iv%D0DBDui zkJKb=`}CeGXbH`it`n8+b^APlB z^-KC0q2DA9_|NdpXU3ZDodlzaUqsx@@D(&PPH1UL)tl+h{Dq;gdu15WPy&2M)O-P= z2tv7KWqD{b%KtaI4L=Q41qEMXG1c(NHi%>2T7vf5X|KnAp|4C#pQ|LF2+*m8CHZ|z zwW6WeXRuRGEHcSxjK0_5Pgh$dW_J|HSGOe%nZX5W8ob2Rh=Qs@>eD1tAhE6MmGj9v z3-3NCG8}|D-Bdo|w4go!vD?V00DmdslTmYd*~)L%L2S!CpnZWvJRwVF6n@)oj1Q8# zE-u=@&wQVAf*4L9kC5~~F?}MPeLlbLY|++}AhnA(#~Ham0JLvXqA$u(W6~|$pJM38 zyw?v2{R%>S$=R=9h`xAZhnvIK5+Nf6ECxO=Rwf2 ztE|pDGoTDgB%lBU3@A{gI#+SW$slo{NV7w*^8Kd_~wh1XD=|ujPGS5@OGT5OKS}M!SyJ zJ@!(b$KyqH_Xkg6ksmaG+&+ewUl+SS_9K1w`7lS2~4Q01oNz4ENnXNUz#0kJ}#r&$&z`e zvc~rHV1p{kb~@abpBs)KBp}3;m7cWJ)pyk!X({-@6&w^C9G&`0qSoxhwX;}S0kBlj2GYQT zz$$azCM%!wB-P9J^-HOZN!5^m9f--P%W6yB3Bq>+! zjzXLHS8eCm(R&tEoJh!bR75dC;xj!d#aj{!N<)-lT-W4Y)L125`%H^VJTd!%0=|M0lO&HJ z5cphI)U}nbc1dvG?oe9ZR(+CPR^<^dTRNZq2(Er^iT2t;*K=Kbt$;%m6zZ{eoQ2p* z=yeN7umA*CO~+-x2je(V{%8}vi9w8%!W?Eza(d=nd{&78TKEk}st+BMY4Fi9jv*QwqX z9@!oq9OfzcPG>Z~=LT6{i2xE>VSVHO)*=kwhLN&5<`({!X}A05qNWQB}pV`Y^KL6Jj|smC08-;>A>z>7Q8 zwHVZ<+~ae!tK?aCpRh?=olr&O?j7W+1=fN|c*(msL^esyMK6UVK|w;S1|pMLn2-4s((`rD zd{G)M)~^Yhtkr~-!b}G9R^;|@uh-a%ZPudPDsk5*4A zbHw7TI}binSNk&=Uw$fc@Xa??wZ+f>dbD_4N@waeoTN3bu5g&QH@PHIURxgJ2ED0G zXmL30s9k9BrX*-NaddW#+c`V-kg(hH_+~c0%D%dEr`GM)k7^1MHIFXjcUCGNIy3oT zZ8mugt4gw4-OBV?$^ZVm{X^J%VQ#TeBy}2Hzli%*q{*bAWjbH0c#0DH?`dI*y$jnP z0lOfh(#hj`IX>8qfmdsx*h}PA(sF`#a#aO^(br$daqIfr^ExdNU+G~otJ7vOvt(7! zX0ocaei2-s<@Pey>2L_dCG54|ToGSQSUX#8Hy-anulmit?L1Wuwld+IZx8nPmuX%E zgac+E=ltkwE^Upd-(Ws*b_DuV_(^Y7#Yn&?uElx#lUL0 zSh2tRS|@VNKvKIdlk>fx5t`&^i>7#*BC)N+KtY{L63xcy#Z%zP0@oBqMtq@6|G^O35|XJQFocl4l6S+~DG-Hx&UE^M;w2M5`mNyu4V%lZB!~?_RfPG^uS#kQ$`QuP z<&;b9{FA{pTw?5ap>#V6HWj)lBO7fD2EH=8A>8T20;t)-bFELa;ALyvoqG_R6m()AgYZtaMsV{Fk%YGGo4mkcC(0i5J||% zSg7#5=W=qge687}KR8Nr>?Rt-onBlj6BiIpkj`g8Cay}UtePkUEMR(Q&l7M8Mpjvo%{ z!`%#Tm&BDZOCgMEpcOPXNF&p_yIZsPrxLRv_V%rK14j#=NJy;l;KKWAd4>%{gdAq{X7zO=$_k#cd} z{&qQs>_#48%Dd-y{?=a%{lPnVe+0o$_qmnLpy?u)%7-|MKhpg9n)6++TT|tcXe5)< zp$@MU6Atw+pX1hU@9x34&etRuq8f8i+FQbLkTC`y0b&Wg?zH5zQ4p--kwL>7xmk^$x`Lj7 z_@T~~0(ZvTKj8)``tzPb=&xy`ysC`q^~#F5o4VlB7&X6B_jZ{$uSiik>6T*XMtfJ>aS zudX0)#Q(FkN3V-5v}{Hc61G68;L_e4WByl)E5#M#^z=t)|F3|GZw>xPtKrm94+GqJ z0WIG^rfInxl~Df>5i8qPR`}2tU!*h$OxLrW>23!3hye>8s%+rH<0%~hCMG)nO_hJHD1c4- zIl|b(^W$DbPQw?G$hgzB9DQQmO2Cez_~M=-m5bT}V8_r-)!_ASAzqNcR1_5pLxX>m z1kJIw@kmBY=rv_^*W42fl7sMXfzXFfJ6y%obS%hGw49e?hMKw>u!uD|KAG`zt@HH* z_FTXQZuYgp!J)F#Peba$sXtBn{e}RENfq=S<=U;9taQF@N6(#Pl_qI_@G^HH!@I2t zezYH-%l}6CypNfM9!$>K)!?(6=V$7hZE?bNCx&-%IBd}*ZsxFYu}L8Y<2y#8nlPHJ zS^!Zj(MP0h&RdTO&S)qR&b3!rkjN+pLC&NC?2HfYYFred-}pe8`EGHe;AIXx(AGKU ztT|@T-hLkDoyD|1HEn+mGa^J4_IW-2Y1KQ#n57Z0xo` z)qdf*wSVXy)x=@*xt9@;-q7~>H~G=)=Ke%S@a84LCdTw-7S3ZD?^G@q>@|o3HW7sY zTmB`ry4&n};r4sG28vt1l;@8G+SEuX>*6&KBRfy}m%YQr-23*GhC{Ub1r!J*g)JCpehpf58A;lQ z(s1{>s|bj6VvX+LR%lN;VI(BwNlhax8_9w>GohQ8G@h(l9#nVONn}vN$-kES-6%bd zh7*Wh>$!aBN{Xhv(}+r*q0I-%&bhfZiZqCcoKTB?D@ZM?jY)~sw4A!e6CozyZ+~1! zEE%#37xQhNQ5I0ZmqKIC4U&Y>4V-O092CNZh?NEqbK2Db3|A}|-RpUW(8AhTK`m(*{Gd^Sfa*UeJa>GBF%0o&P4UD1c z{_58z8x><9F0ROeBUDsQ_146Cy?@kR78XJBX=3#eEey{$v5X_lM!4p~qV*d)dA`1^x<%q7hfax=tq5Pp(IK?fAU4CLYF z^M%&*W)VGrpl1+uWVitxFUC2d1I=JEy#}QzGV>d10E5-gWeJn9#@>Jb{o{K=*HwBj z4wZqQ@vw#hmmC#5pfa_b=~;|zV}T47&SNC;v?-Ww%4tHNPVx9}@Sbbbql1i$j4@-z zELpN-;>3x80BuR8IE;Py#bA3yDM%B%P*GXpcGaNFk`y9cN7X&a!2`o(Qj-K$T#Oom_{>mhLk2pip8t|TKa5h_n|w!1sp^VjhQm~; zVsNguAqnv&QKv_SL5)36~DN{6}B@_BZmL-Atojtbhb! zq^cx_r13`k?5siKUpHtA3dxD)RRaCO_Ma-wYZOmo)nmhGa1XMnBbzLH+2$E?ZN>1r zSQ@L5Yr|#{ShlJ9rgJTQw!op z9LmQ3sb~_1NiY96nyt+foD?9& zkY^r3D+oM-c^aVuzWa!W;1UmS@nlqPP2E9|O9Q!vqyv&5w0eyy^$b*Bt2%75%f?(b z#T^In3+}peTHK}6;w~R|=`~|7y<%2;v$2gEPrUnA%u&Hfp`kSb5@4D?nU?J=zF+lR zs?{_yT=A->k#L&3QDBIzXvlS*FKx=exZqG*Xh@uA&?WMM=a^Q20f8a$9m~-1YX@`Y z%mE`LCMJpq0z$SU5>7*0P!)75cvO{6qw+6izvJh?iwUUj!~`3wDo9zg)vPujOsKPC z!o8Ky4vbJp=5$~RJ$SQJbvI_LB5}d;?}82*weDbR(>|efyOzIts%eXEv~bw6bK|zp zTzdOc@ok@^O@}vhXw*Wi7q*LU$u}d?chks2n-p3+L6>gfD~rgjZD;2_}KY#s?diz8?l8 z=ydcmiO2uK379beLyz{?MndR62|u(~C!NxTb593Q2Ve+HSi0v(uA{)C*=~9qa^C%u znN3?f8P~jhT#HBUeBd?P&FyTrbfl*Vw>$>2AenE`$#yfYKGC>!*M!y`5?Xb7XKX1n(&>_xo#UE!u-(!gk>eX~hhl?h2Q(Hzz|MOVR}f3M@Gr`>XGv$5G!QPKypK91oq1 zyQ~>IR;X*W3kL*)RZRM0#hm9AEp|wglAyE7u%jtsE;B5qvCjz|B(!?6ar67T{`1T0 z?|fqJrrajCJe6>Brw1PYce87LblwGobBCS9r2Sp8_Zrf z9XileG&9uA`qMX`pd{)Iy~t<3UUiYY@#!~Sfv~v}Bu`Us%^#UEow0*VD`dW~l$<=P zOXty-Tr;ETE=sJMF7yZ%8}_=ebgi)^|t!En*y0?eGSy*Z3bR3Ak; zUFoEG2BkNb{?8y`T{@u02RbV+FNeJ#NfIuJIHa%`OqJ=Q2B;|+1vn@wBG4!gt4jW?t}L~#M57dKsoj87^{5ZAF3BVPvTvt8_+ss7#@td z;pcr69dJ6Q1M{@ujD@!CAAS0xsY~|8-}u+~w%uq;a*Gaa?|s#FBGVTd&Jl9lC_9J?%<0z|C%JDh zq{U40Ylf;p?dCsNg<*^6^xhp3`2%Br`}?W3rju<=r^Gj#8FxwelWUa`jeQ$Fpq>-% z451qmmlk)(e!b$f@gmV0f#Hgm?RPR`p8**|F%14vhRz=rsJd)OAr;lpSoxly<2Kb! zBmxCThGl_@*jtgp2^e)}o|AwEmbnBO8DXbgk-FM}R#H+jX3UtpyknCmPY#7bA`bB7 z=U?S!rGp5xunN`)`+Z(l5NWA-B_kA6b8>PfPn^R*cn*3;7<3{?IS1N-O0z+&t^a597=4vEklJ|b1=sw&N#3XKygD3`fW(n!lSKTiM{;RqhlcnQs0ycq_ z;c+||UAX&3@SKScxPfX0#Y{e@LLKcu)3$BfHg@dz+}xb8W5?Fi)R=K}ZP1`0uIh4V z1YTD)ee=WPk|iS?4hy#B@0u%LeDTH7rAuWwtSFj49NN8eml6urzQlWx!O$i*PGIF# zB_%~NI+-B46?E|X>iI7)Jxtq2Xab{f-Y?~0J81{`#WgW23&1(j4sL}ocZh4=zA=56 zP{>|8{wR^&XygwL#O5NR26~!E-!g5-pD%Rbn->w%o<3^Wnpl9p``DTPnv?iB23lWi z5Jz3MwryleSY#f# z#W$dyc7QqU>#x5aKYr}!(W9eu1OoxNaf67S7m!tK(B@8l5r1LW&>8v%Ne}_7fs~Z| zGz)P70+Yw|rcFQxUY{eZ2rRgjVqng7WSBwYS3NgLt~iCJ;zo)q z!O&;ZfUGz2gydnkbOWdAj6^NDl!=;C;S%! z>!hF@6lr=~BPNB(2H}}U@;_DDdUQaRKi{5=BOl^*5nE^i)kTEW3H|{xK`7~xN08bE+mcf90n6mUF9x2`K4$Wzr7-HFq%JSTIa$gJ;bYVu`u*P#eO%GLHN-)Q3k=; z51tOrY~O*HjdiqG$a9@$Z|13PEIVw>-;{QG(Ry2*J|Vf+)Pfq;>B}u|&CH@t(~+HC zx8LXkRdQhdQ{f>A;h{EpaDp~G-nnN4jNzDmIu%GZG$z^GO7^DE@cENM8#A&HRxbxt zR`R@T(ZMp6^xUO>H@(#XaN3!#~sK^$nQ%89?PTJSPiSh2%^yyd#18Dr*(Obmz)qD*UP z2j6TgV6gKkcfSH%I$+cNG399SxJ&K{b6_y$VA#)==1~{X^EtQ7` zCxnK?DFfqhte)^UdQ5OSATa|CRcqcj#vg5f5kjv2qbad&X%MpEK(Rw+GY29dxbI-i!^LbwS`-@O` zLVjiPvZdeX0I5}&ElxuTC)sq9WT z(Ho6=cGr##q#YQX4sLi@tQ5w#?38e`_^FkSwia|si-;}hS6k`3X)QX_?!)GfHg4U8 zzm?F9HW#%)LL}*IYs(i4`APx3_|W2U`XCYy;fs!9-+@?AIDQS{4BQ#h0iW;Dpdt4^ z#RECWp5l&U+F{xRLRMJ4rdJ_B8C9%bQrT0Zb_YmQq~o*$oMQ%)Yew884W>0k9DPGB z6}lYB!8Z+NdJ>^55;Hk>jhHr@)&wY_c`u9=3=8ULmCZitqg4#h0W=et4ckykBS1tq zL8%P&EifJ5xxnoOJ%yJPS57tA^6Tn!P6rj0jxAfZJ=5)l9=(P+ymmEI`-;@@s7D7| zwrl|%WMyUH2x<^4xCo&eQyO2&N-KENqQ*42qo<%Ol~4Rr<$~vUB>rv_?_%B-6$bQ2&;c5hPHVfR z;j{yygVBNxnzZUVZRzfp-Wj@NV`k&#kCRBZZf|S;5FKymY`fv{#x0+;weHgBmZu1>~=>;3p9-AjgcO=1g8cE$Jo;4%d(>!{p>jHhFuM7$7*0 z#3e4!>EXzxI(h2rX`bPaL{19+%#s;l7NXq>s;-1pN zj~_K^RINOtQalq`CLt#SffCYh-q2NgQHSyg^Do@-`w7e96eYgkftpW`Z^B9)`32cQ z+DD37^FGpyn(@D{OzhVC)jsbHnZ$<@52wZ`Q(Os5v41so20D}i=s$tef$47`I%w75 z)_b38eDgzHUmbYqtO=PzyXw;$j3 zaKiP!zx<|l8xB@qeP{d2+B|gQosY%0=y21oJ0{%n#AUa(zv&m9uD`3}mUMgLo7=bg z-3tjfK6cYDy2g{1A(VwW;(ex$lAp=ifoL=gFUkIMzRX4wvg*3jV8Q6sI)J2x)&ERR zgK^8kZ0MRi64FR>n?N#JT~ye?fiM$jDRF3Acwi$Y6-DOZdI@SF?ucO@sClZ6=&}+a zD)rLRtt2+{s9#gmv}#s~D24*%LXt_0&DxQJG@_sdv3Y9#Ib5vja@h$0p$tibnlQu9 zl_i>&giP|BPl{MNFylucA`o~M2*J1(ps*O6Fr25ncwy*$ulfxR3#bniVPxmX=DZ4-Sl`KE`iY~7(z+xCxle5=sOdJSIj=f}GL?63b$xc0%;zkNRL zmd6ifcz*Slf4|m${N*>@-~EHHn_d6c=imG&qsaHm$KQJU!>K#7e1ChUr|lbaIZOs_qqdu$h-=;fdO_Tc57TQ-5cr!PY23VB<5ry- zHGhm=e?*d7+F$?kZgbbCknLca3}@xem<}SME8FkUT#Z#%obHKJoz3|6Z?V&}ZtEhx zX7&vi4fw^R9SbqO8Qa~sw~h;fza}|m52_EY(uAt z@JWKl!GGbnq{mDMyx2UBh)fPrO@nJUe;tcf6Ol7x8@RE+6P*lZuI})V1lmkx$dabg z^G-twg<&TtFdyhTG7)4IgIGF%!7m|&q#QYP7&jGaKY%2cWq09fPa}a8 z5)&>?Ym>C1!gtf1x(559z{ zzObYP$(*GnOwH?Fv3d(FJy5Ao9tdfjdd1QK;BYu5Oq{%H=hg`mCe+e_!Mb*R>dn{Q znKor=NnXL)rOS*^VAHzw0|vamEHTmWfRx$F)k!dgCQX=p=+Kc@UU|jq2|f4JlXGU% zM-wheIzXFDZrp_EpkCL|I}3lRNqmZ$oU3O*Bubg#iZ>U$5JaIO!a1S?`aLE3@Cknq zK=wIb_B*Sm0OlU&`hjQVhz`zp?LcfvoUFK-knDMEv`<-GhUt{s+jR$=?(5roaKBGK zt1K;2TvE_!&nqrhK*zCN2QR(&V|a&MBM+jdjDbNm$LCF<1ey^}0m_Dpv|2^)EJYOi zpz}UlqSB~FS=!c$!V0%1sOgfuqLit@{F3sN)O0XVaY4D;UK8-Ui>q8YX&L^2D{jv6+lsCYO2e^LFuzEJ|}W`%nCOLV9{8{1@vZhKcbBtT3N`=dO0g z5qd(enDl4+!sk(INr5TB$C-&z(hhV7Uyj9TR8?!(ZAcTwU30?&^rWyg|0bHy2+Z~W zvzFx6L@r`JZzv~nI}4Q}!i5@c1W&Y$3(NI#!lrk-{N*`^^*|{m?S(UDhN|)>j+_74d;OBLOLuNq zQRApi&dB9YOp)yo+1VJ1PsnA%&#EY~ zYL~YtFTc`WQ{!?f1`Eq|KI|P!2NWSYU8ED9G#nzt_~*bzXy&Px+lQ@#RCi5A8XeVaP$z zb$m#bpigzBdg%D6q#D-tX#>)M&is=&9W;NOUQBG>DSB)WM_Jv{rC#7!J6IweY^^%p z`s3fSpnvDf(cfr1HAn&j_B&x(bNxJ?K|x^qXw{usme>M9j;_JbBx_b^#h2X34dh^jc6hbwCO_|F?aImYqls1BCEchv>DNS-VyKjwTH$}&y{H>GQYnb zl>I?Nk?BlRy&l)FVIwHHE{A9zf^I-?FvBPzh*QAvE6@s*f{{aL-$BSbRotrB99 zsD)W0x4-Ics5?B!tVR8pvBb$yZz&Nq!ZGR*aq58D&GZVKDAL7`un`*HxEae&E-uOg z>D9KCp_h&Lb@lugdc4wo@ZizlOCCyt)6fefdZW=feDvhHkBSwV97+6VdT4G7v|c7;-4Qr7z3`-w<1HSTpYzHpk#APAUT@g2+}?-IDz( z@y!Lz8?V|MF)c}9^oz!vzMyNE^8ijTDCiaK;xhT9ld_P&+UfrUQB_xm9HG?*eeJYf#$Gm)`y?+H(5~&tX)W z7Qrb2sX=RoowsP71jA?3T{hWk3pwva&xj_*%n36=L_Ps162+tiy!<7>L5+e#X!p_5 zXKkS`ZLEABG;R?wif@z(%>R=2f6N&VQG^Mjd2O=uGN$b&F2Ln_sq3DKq9PvuhRPz@ z+e~xOR}a)08+c*7{Of3a#1?c4@kJAf^i&_aAqy^e`~K0ChT*}mDG&!btkzW`$) zR(CojkU%>sIU7SqfL?958bMbN`hH9Ahu~6VE%(IGRC=utQ8MR+1~rj}HkJqRub2*N zk~X@tp@gG_Ak!DRK8G1}5pvgDD3 zzh!i)Dp+*zErCX*@n)Vy`ZTtw>kMfUeLh|BIO5S#6b(%WWQw<`FLLL%qwlp}@>AN{ z&FSED)(!}0N6k>R;Ac<`F#2f`9$LDqak%lDA^~y}=>z z{-JT|V4FJB78+=CjkqyCw}3C&nJJ*k&zv#2#uxa;WpVnPk%k^9rC)Y{3FD;iIIFHk zn!^@${+0F=(Nut*#(Yk533+(_R3^Gxy4U_I-6=l1E=~5bq=VBPifC4}oEq}}9h$k2B6{10zyIfV zv|`2tX4GI>MnuU_3`ON@;tF%6R!+I!GdMvR(!@X5rVO(Aha?2Qvbnyvngy#tBO5lY z_qe>`$J%5$ymia^f{H36JT)DNV)J(t4}_gp&?gvZzW_?bovX2016$^6rd7k9q&?9T zTV{HR&c?WFenHj&?Kq;xC1OhjDLz^becZ9`01~n)bQT`chdv%c3qUIyfJ|>A>_`bO1Uyt))Z)Us|W5p@suJnJZqVIk^%4o;pdC z?n%HT8FsXg9e4S5|E_xYZB>J>a}U2fIH-{{C_x%%3k_|g3~C%4-Z(h0v3=MrOn1^Z z1wa|JZO1GGBrYp6ovb~+NO?+dJ5U!}f^(#*>zKo)(1yY$%tN~;B`a6Z7IgKw!FP%IJ$u^0nuED3Y6>P;X8fi?@r(-Q}-GSFUt zolWV}CWCC@K{o!{BE7j78e)?N+vKkrRgC=uQ|ZfsrlSl^;g5Gw^K`l!`Nm zAU6D`KPOzjFk#Wb`2dR!zP+(P5ls;#6`5%cPvBp&tBLMQpzoA<8$--6>(cYcZI{v( zqd_)M0Jy;ag)Q_I?LPDjy^`6t@wJ=C%5Xyp0*Z7vTz#tyHNhPxyWA=Ew4AJZs9eis#hy_st z>GSk}uvqsE3VLn|d*W0dZDA%md}m`BL@>}69>||54vQ}v{YzH0n{03evnhR;^mHC@ zo+)TI9#!Y4-|>d#x{6E&SDg6SI5<*Xyz#Ww=(r)^?9W)Hrt>e9Q<8=+%&8I84(xV& zjfL+V;cytXVMEe^WH9q3g$v4k%e8~Lpl9~{500Ao{HBDlt#a_Ikn=z8gU=O>{#*6@ z=gKw>Vsbvy{D{EiA2B25#<_yX8O4JEQo-~?Oj{MMnXEgfGq#bjET&iU($WG2_XvDH zbRZZ3N2m!FzDuC}8<-9-GhX;~@a?n%0p5^Y&?;oxZQ4yOEW08 zVCG6hJ)9RMzlhL)+mLj6rw=o2ePKKQ9si^PYVh6BfraC63Ob+;u{!0uKm*bN>Bko) z9dL&loXy&Sg|kF`I)Fu^(Yv6LRd4*K@F-azIEFYZGzcs@h&a?BRy*LPK0%B|h3~(o zp&9c?9DWfeis%4^U&O@mhc;?a-)P-M$mt-K4pa@cfhL9hFTMP)XPPp@2u(2BSe z2!^Sh>CJH!ZOmJpx&|;avheL;(Luza22nboNlB5X&YCuVexfd6Y|@hgS*9-tMur{j z97HVo(1s2piGEMPkads-Uy-BD$b5(*9c?I}RXh%!_TmMa&d`Die|MUn^8Hj|O9f{| z5_3M66Ayoi%sFS6}q+-&dhmtYoL(otu1M#fI&Pb7oeR7A{=4P?n5s zyALj2lxV(5YT>M4(Luza22nbYnLcdf*g$15#Cu;_jw%~pjGD?c|E#$S|MzB(jI>OT z$2Di}!ngZ>2CZTI#Brd2#MRqBA3kF8%w@VJ&7C`c>#B9Tckd1P9h)|9UA}7NjG424 z2-6q%ZqkaB?q6@5xgu@BhN7M`_O3eM4l2g79YrN>mg{6YkJMEASZZ--+1^s0Y^D;3 zr2`N`pr(KYs+`_{Tu~TsmWPRDF-+Cew1b)&-nf24c|`$}1HPa(Y~0it)2D`su`N0{ zOIUOeai~Fb?EoWd(Y#qo$S+A!d6io;^iKzk(By!(s&veRX;Y@oR26C4_T6(AuTjFj z%F4=_3s)>zx%G=-BhZq%77o}eHmq2aoRS&#S0O7;*t7q@5o)1}T|3Yeed5~c|9rM= z+V;v}Gj}9yEnI)t7f{*oS$j*I?BnT0L+2gzh1iGFQ->rTrJo3iK^^UYUI3Rzj2&B8 zR6b(Fh%devhK7aS;jmXg9do&BYHA!>DCBa1mc71^>~J{9zOZn%u;?J-P=gp_fwl&P zLLrs^AR`o2VYr4h`sN2hpcIf3AKx*GmJVVN zIpeb&MyJ@_hw%#a6xS5Yan^`z0Mw%c3*QSk9hg00(Sf;k5CMJTLz3t#W>EOW!!1)a z#h-$_k1xMMqhBdMDIJI=Hcu>^5_OD)3l@HVy(N(g3>F=j4mGH!9T-e5$S`2dR!OotlOp#xgD3S(q0U$F8> z^6oWj>F3OMBquv6i)C6YP*`rkWSfm?Mrv{jQ+*N|5lXI3HiayQw{Kd{G+9w3Rbfyo zbk&e#5C?IGKdqp$LlZ1%P%S^CWTA#p(dzZM7Po{Iyeu|fJ=$|6{d@3DN*d7Q8W@@E{9B|CkzIE z2!?YtN(Wz$8(Wf-Ty!k&NM`or+4JVkUOHjc%r8IvhzU0F7B&Z3z!=GrS9p-^Du^0gRSlI-^f z9NV^RU$b&4%5>pAPJgbpn2;Cz7fWFg{EgP64g z71OmQ1zrA-uG4YLrmco9ZQXIuV|UZyp%!L&`BQB1h9a+Bw}D9>#9x@SIy1Lm)4J7# zl{JZT=P)UF@W8&sD^@4YU!0YZnVnyx$-cEo%Q7=^^Kw!*tlg5dX6>w5bJnk3lT%!( zN$#~tYtmCQ^79L4%$YxH)+{L`@7}X-&cX#VXHSEitX-3Ip)!GBS4}M}D%rJT=i#)Y z^JdIY!>(Y^&!04!t1%WGoCmP9gNQ>7VvGeS0ik1Q$F}Y}I%Cp;d8^hgT)HCUt2Pw3 zqs$Erm$clxW0P$OAO=~{3|$UL^wm@75t1IpUyNz`fiu$f>08RON}msqzhp~$BN@O8P%vTK?;nW>x;WTlM=pfRWBG2d%dYS?nFw_A0 zmlkeGyc*!X4Mhi>vrY<=$mj`I!!m-kb`Wu>L3HgP(i1AQbd1iD@&c%|7&J1!K#Dz3 znqA!PM*3w$Xuha@WX=B+i~q>#_^V>{pCZ*M5Gy(L3h?bRY(PW{aGK(MPUrybE&gbx zfKjRF4;@ri^3}4R4M}QU=+9DOHanjU&YliLDNxQ+6o)QxF57=NQ-m}SEbSoTP=ly; zK+O$(ObySQpSW=T((QY;Zrib4)r{>2504!?mX-=sg_UJgJl2}&O3*NWfDkGJAf6HO zQw2jDY6L$eS z|91~j0Nw~R`9}TGf&uW0$mfC%kU9N;z3Tt;v#)yh?paym#!%<^tLV6)E3W%=ZR0_! zANXSRH8QL7b5h?L4YPItom7!Eg^E-UC_Hb*FjM{0=FfThUp>qu4FgL%h&a@s4ju3s z>6*e6T{h@*qkbu%8?vI(TTB#Ql3DtATc`?KH*WG&RmfpYRf0>FE+060j3S3sU4g8Y z6cma~hz{g%NH#+BgYn=A1WL%0zGAL~^*}g8pEE}e60wOYWoPEnB`Jh>wC#X?_Y{Lf zrq3%FK@FO&L_g3vXYn%nZ8TXz4=!4?Xz=jy>(*{k3_awvhb8UskyKib1bZQ?hR}r1 z2x!CIo0Cwyr(SqdRYKrT+3zFLfNfBw~{G5F$>4?p_s z%g;Xf@;@(h+q-o$3)hUEH~*Rcb~lqW5G?J$bf`h?+JV94O+~|C=tATrMGa!K$clz= zW?&L#tR%bSiMAMTV@7=~t4?Qm2@8a0O<6c_^kj$AJ89}1rUlD$Qyif%(>#%*#+xM(3}zg6othUHLIdFHY; zThfyEZrZSsZ&moNxqx8kYd36Pm9+NDf#VYwudtVAp-nSWves|gvth#~5SAhb13?U# z2Brh5ExjMC#C1Mr>da{CHw`JW1(8}By^Z2xlWKa+cdLqeRqegs9m-x%m5`Tf3IEiWW z$PqW7sTIl!G+x|FqaQ&9(0}|YGAFA9*^-9LBa`l64zTYUbXOD&#i0FL^xh{gDs)|N zD!mAeKol5?f{5R6+JRUF@OSL^Jd`8cn6{9r@*|HtHhAPnx6_rlVD=M_wF|0YRf6W{ z)0mfbcSU62EYVPO@b{-X@dc_nKThkw#9Affvuw4v0{Ja5r~=}?1M?LZ55a(onKP0e#5F`$Fk?oO@a(#>_R&z?{GT?wU~R6NHimLXJqvODk*s&7Q!x# zgu_xW#Xy8m4##yYU5E|jgWSxa&azj;&+h_CqLT20^&dnXcZ+k1Xd}=vzVPt!M8j+A zPR9nM18Q46)c(nrbv^jZlN~!f(fP?Pon&YPVd@5O1XJAY+ds?cRx}r-5~VpyG$0++ z>pbdT>S8wP;~r3N;OFhxzpd`=ytW@_w5kPGg7c`pA~_pHkE5h&>AvAu74nhHTWD7#S#ZdYdNlpU|G^iV@aFmZAg3}W32BZVrlhlAv z#rQd^m@3iwYuz%yqM~S;vt76U!nQI)8v2PuhaP_9v34w&W75PlH|d_%Ht zLNqxohVWtth!Alp77a@W$V3a({Num<6-GZjD9TU^1BL=)lJmaDpXF~=HW(T}JJ7;U zb?Q{+@@Nt*L)8UW2@Lt~&po#%IS0mILl&K*;ppIE+m%SNx_-l^fnN;Wyk&iMW{##y zyN{+US-g-|>@b?jGRq%tMUi9T3!i`(`heIPAp8Qf3J43fHm!+h5|!_o6$_H2>&5_a z>g6VYl=LbDttkqksYNtfAl4rR!Vt=LOwgP|aZV8H3}IlNLxwsnB}Q(FvT;8Zk8TnP z2O4ti00)C9a&XkJPhb6Ce@8`4byY$j4jrC2 zW#-xqTW8Fe5wtr39`D9&8+`t-rz*d!q;kRR`K84ruHxJ^Yql+1xLERgl9N-{Y}hz^ z&H`oxr%awXeaif>ss+8i)$2D*nLJ)`S5Fu{dgQ3FUw$!U>Wuk?r4{q0PB^lA&)6Yj z7A#DhI&YEJRi2o*VrJsv#k1$ZW?r;-#pKDei;9Y-Oqn)w?gCk3S*e++nK?nPXWiOO z*#*a@&YYFFc;(`i>jw`TJ!#5BDPSKrdIXuQ#0F$DoZ(du)4aksJPtcC_rbfT)S@N%9S%`E?K>0^WL4i{H~f{$U9~F zoIuE5Q(014T0V8sTuIZ{B&~GYtBOl1LX|~o$X{MrGGh4GGiNVPTC?6+mcMKBuDtA{ z%U7(KHajukt(rY=(cHwvd-w0dNKw31WWkc60S}_muLkk0a@6{?9~lY<`Bj~7A27(`1?P|- zIqH-<-3zBUqs3=>y$VJLDZ3QHw;SNrq}SjAWkripnv5G!)>In02VH@wqRH^^yQmUR zt{PB8NSQ|*UcIvg@ezG(o~lok!rf6g+R>@-7G@|EDsm3?9ekfSdpf9xx)Oif!^Z}O zr5!{ZY7o^9G(&bdyow}OS663crei#ZL)@s=)!e)SbP+wIE>16b>^j~3_>T(^#FK5_)(}yCq;tv_|6)`>AtAN)JCcy&5yfden9t0kqQzs1RQS(V(PQ%D zap{6-5ztlqq0$o1h&iYB?%x)aE#<=RNF|JB$UV@(>dbEz9mGIa6iJdo#PNIzAyP+g z!N*se&KazC79tKch+RsgG0A0=MlHPbN*qZHi8rk&7={{P{vak;8q%lkqB>Vi35?P~ zUEr#40#OeT<3IK7fNzYzaeA@N0{jN2d6yp?9n`i2KMU6+&R@t> z>30uyTeNWA6Hou=9M}l803GmohhS+3u}>BN+GT9+^EK#U0Dr|Ovh_IVV>?!Ht=Eiw zdfEK-5;@fBkCmKKW^*zI%TTqF4siq|Bjeq{o1anqcpI|n zxte`KAZ83i5E<%74juuqh|rkJgjhdtic9A+P*7o^h%z5vi+W;z4(Pzl2OTFou|OG! z(;FJ6Ne8H7w3;Vu4V0OTO)WqJM&qk3e07S#Pr_x$=jF7 z_>d%)7H}1j;YEB>J!rX)WP_)otAaknXhB?bxw&(uR=&;ir-k{0;IF&fC@lRtWTmN*?cFiS#>K##8ALEXv2c_9i2 zzoN;SLfR<$nqNbzh$(wmJV8Ei#)gesb8`+$vc6^4u9S@IU}fdT-FqfX7>BM-N?N{b)rR@A=WJfTyr7_9dD50; z%ai6zpIBL0xohu{*>mS)XCG^ben0mxSfC`c$}fNX#gGGs4pzHrrcE3x`91TNty;Bi z`;0mB=gyrCCWSDH=nX;#=&-#zwn(zNZtZF{+Md z^?8}ug+(PGrmUv!iz^&uWhIIvA3mHB^139js@voDd2-7uN(yp8cWFnH zB`H*to0XTB=W=^<^9tN9M@hNk+chKTAhI59(LpU8sQjY_8og=E=u62&=d?~hKe{B- ztY)yXV*Z*C5`p$^TDvm)4-uKXH2efLibj4^NOZVpI=o~ z1F;GDyje$5JZ^hgS%sO!+2M4w16dBQOj^5c)4o}W%MN7c=47Y&?4=<^-?Z&ujonjP zUShYGPM@_x4ZD~o&0Dr`&(VT?`?dvqenk!zmsRH-IlN)jD(J1-_ojV4b|Tb=;_MV6 zGet^1cy!N}{hK!J8#5#E+vz(N9heR^s9ifiiztq&%5tYKn7Cq9;_@~7QnD8>T>^PN zux$%2Vyv^`l>A3;=MNjqU9lVx{OCh9bCuEbn~q?reDs8$FH=$&?>zVrNarz^_~i)9 z94<7FUd8JX9iwIiqi85&0S!pjHRUX9Dv=v?ia4b!ykX6o^O(YW_Bg$@193Y#@-o1~ z3tVdv)CNZU+(T6$g^DaM-8g#W0Bv;_5qLZtbWK{dYH?9%P1FiIBUp4`I@BPl9dHd+ zt*NP^Zz3`!C`;jR5Gq+9=Rt=83;B`$$MiHEBSS&>`6cc* zkJR5B)G3iTW-5wwp@CQG_<|oF(qMED0lx*co@hxEF-oY1 z$V(tHsOXCog8Fvuh5!Kn^hrcPR2_hbS%qM-VsSJdYw-xekR>%1qZd~!Iyftb8q{4% zj6ozMdWD9pCbN)_dgRnNKDU$M^kZIVIGvg`936<{vBy)PVO#z5w1X4leCU6^@4)n* z9UWYR`wmVDuro$22>7hWt_2eft{r?YI2$@RAJA}gaN%nQJ6?Q7yt5!GWZ}C6=)mLg zSak6Hf^Skb{g!s{G?S$BLTUTqL6Rh)9SEI^%;O6Xr~>L@o?L)vNbTT)exng>0qr1E zR#sD0ZQ;9w_$moJkR_n3tgNJ@r1(OEC^L>1V&Q>cFbE;G)(%VuI@tNrv%1~xak-(j zTKLWYjX)fI9Poe?#H9-kqAnLAV5~uit+fNwp$6NYe~NkCx=Oo-EquoiONpQZcmOlh z!gmGQTGx=q!o{(6z(0;=;k$>f>tdR+9@cy>02koca7&37(Y^z-L1MS8n0pN|QX_jv zcqrdlD7<1z2;WCUSH+k%0|`7Zy32^@GrALzaPi7Ov;|HHuz;`;I30+mJJde3qee6) z?+D>IMB7H%kcaZWW@HoOsSPoEu-BNwVwgrYmWdo94Nr*m{}54^ z4oskxcI??bVf^&${370-bSc`N(Ke(Iep36F`+2L@CgDI2h(PqF$RRdKJ^D7!=q}>w zg^Ea(zX{eGjiy5lI34hP2by~H=+X4_)a0Xwby-=wZXM<)s0<`9Z(~QpQSYPx4QpN4F^_j-T^& zzb+aR&8ry*L;=X|lN7O$1ou^Cg+3X8V$dgScnJ|sKNZPKLa(LqlHw?77zp$e+o}?x znDkvoMZ9+*%MnVy5P-r1@Su*UxCo?C$E#023||-4CS}v124dd~i+j`I93 zKL5D;N2AcNefxa?68PkcfxEYF8$Myu@>MI>tlltl#MjNt! z#OR4=>;C;dc2-vn8#r{_*JDSH94-f>ks}APpli~^X}v!hGHJr>;bSMyU%Y(W*AxHw z&o|9a7+mlmS%NDoD*;8Oq@+NyWhn$6q!0grD$zMeiS@xYO+oQ%w1NZPV_y~pcFPRo1a?RP!Sio(KTv&0ty(ApS^hYlTa zySdQ|{94<7Ou1WJ2 ztys5e^^To;hY$Js%faI|?mDPTL6<)?aOeodndfIL`N(#9ZC(pRon=^CLASOcNP-1- zw-$GIcb5Xip-`l_yF10bxVx3&?nMI>FYXj~=gWJ}cfIHLo@|@Ro;7Qpbw88F_3+!m zzJH3HiiRceKE(Z~w1x5+_A4umYw5JKnoV`CmaJVo&ZdcYzWI7p{HtQ^`NYjd*6=U{ z3v!pXVEdSvHL%T4^Yl7}4E6_5+vmD#R zU`9j*OCy`*hQEnLWy%?RZlkU8;(F%MnlqWx+E9;&fedGp)ii4B2ySLJXil@fmer`; zYWP8(X}5fW(JTw-;%};lJ7@5GXD2V*N=%z6Y<*QA{EWw9)a1VUmeX-pTzoJd-emc_ z&VQXww%%pF)Y@k3d*`*XRTPDi7We8srV}#4N6KA6&wuj%E4xyZ;2=L$c&pRS}P zIlFGWg~-N{(J@cf)YeW-PU6lK)OUv=$;zqT@ ztSJ^>LVLmiAmSZ;hP-MM-t=)9YOv=Y-Q%NLmBq?~!~uuZ0zddn89vB9Rr3uuF@^nZ zQgagPpstwPBIR@BvYd(u2eZM`$_Jl)zZ1VbqD-6WClXBiQD@@*0Rc9;3TNIB0m?-9 zniufWH$v|Bb~!@c{r>ixQB`r7IBEiGymaQSt)<1EZ682Utl%H(L4Trin9kN8PIZ8X zN1%j+$fb*IRJWRdQ!0;&N`BSjTk7XKPhi;;XVsKqSt~!1}tKtx*`MAP(ssj@XcUQ#&rg9{`dVn zP63pS-Czp#gA&6zU$;}py+Gi^jF(>F{lp@kgi^r=dU?BMeAd=qlRd~z&VNeakR!Qt ziv2vj{n>ix`d%Bdsa7;Y;by{VF>A3ilYV$?;UC`;u}IGu#crkwQxe(JUsA1mVCb3h z^vR;4N7XV6#kyg(sQ}h{g;I|~dsMPx2s_19XiYM@~Cs=tx1Y zJOHW~I*OzQvdFjJPA|W(ziQ)`jU|TUW*D^c$=5{1%^;w)pdIxuf+NBGHwI(<9_URy zOBbx;FTf)v-vcpLuHD+fm|b2X>J@R<3>hciQN3;b-499GRHj{uX!@I+{lD$~`W;b6 zyodXdoMh(3cQr>uC;yriR`^Sp|Y(0Xhg68>rDoATdu*HcB20`9go1sPIUe=!6}IuTNBZNRbIksIbL$ z7`o?7&>3}8F{;TupZKbgR{l3Ie*XXu3f<)r2rn8IlxPxBaT=r-mfi`0qZ}0%62dme z_aDT}AyuXms~KXYjEf{hi!v(NSnngf$ioh6rKX}lmeBsLKx+or#+$*wi9pAALh$aH z3g(!FsPa&AA}3k1qyGBB@Jd1_G^$m$0oa>Xc7iJnJ^EUCq@UwkUa0j_W}!xxlF1OU zov|m*|9DU3CZBXziu_6?G&kw34xjU$#+4P8PErOcrt54{-{eXIC*UUO;C`(!N^SbG ztU-f&O20zrRT~U-T!e7Ch@A_0Ua_)J`PXp!K(GtJE$0AijQd z3IhY&^ibL2y~PTancYGv(4aOZY!HkPl>`_3tpqD20=QklPfD=WbFtvu(+g9v;OoW= zLhsLz+o@n^PXClOgIqRb)c5U3r=$6#yuxW|jZ3V8)$9E-qNVhVB3#gLJ2~S*Q_(RJ z!-i0V2tziMTFtcx)JKcSA_S819WyL4*4My&BHXYdK`ukZ$&B)A{S_ZK)RjO&35=1X z`Aq>BZfB)O8_lAbLvK&MphjmV`4okzWmv!}Jr`&5^xI4C3Y%Et1K(kU!k2W>*l$O} zL?D2=a^@ht9Bc~+o*wZ1v%jr$5q`20${-GslT?g4Ebfk2!3cHcDaBZnmO2Gg%Z{S3 zH1|5`QKtMu;u(Q2m4ebR`it3ctenmbodQAtmzo$nl@xqoQ=v>GdM`Cat<26Qh=RmI zhRZ3s+L4}zT%FnpR}4Op834P*UMD>kNYk(!jUi@GVmDK{ZFy3gOXzW@^yu}TBIsQL zC3W8nKeO7-pFx2e0e?!zjaR#3yYm;fCWiSKbye}8q6n!Y7`t)N8kN;(3Mt>vj2%@H zgu=HaMLy(sv6G4mSxht>S(|=25+aOn#DbyGKbi8_+sB(j&!yE%B__4=l$QIU1K62Z zkqI8@X@TeoJo!Icbojj1A>MKt6-ETSz7J~iu3kzSW937ulsz0v5$NKmtg-!X<5ghX z_Jp)h@)cP57(OE3j)p9C+&7aM^|5I!88s~{(v@-xpe*Z3T!x!%F}iL>7w=*`1}yxQ z)Cb4U>EOdj1WMwU`-utyDqN^v4Y5Siw%AQ&FA`kP(gj^%y4ip<1%?m47(Ae}=@%+3 zz$--{5;6LrVJ7q=5mg*aIMoB9nVal;r{MG6>o>7C)~7vB0>#!XR^=5}`PN^y$qT3C zCr@b*0wO8#`n&%`z-&i>_xQgR{kX(j@&JEcNz8Ps$8WlLZAB{>s8ZmZx)sLATaH2f zVfB$>PPiCvBI9HELcRF2degQ+U$gB=r|F%xS%Z0PI>JXs+8iuRqU^^PaEY z_&sh}L4n}fo*un%79=}CZo9dynOX-dQng*g!2g8#a7hc`VvK{&Py_2Cx*jHslvk|D z-anj}iUe-Bn&dARo0WXuaTP(8k*E{~o)}c{8LsXjv0gO2v9S~e(jz|FcW0r>hv*q_ ztH>$$_$1udi*0&f_CL#;^I=8!rz1#Xa}Klng+!t(n$9>d>FQV^w}$G`?4fLR0D*EU zH`zsZ{EF9uQcaSay{F}lpGoxC%A}nP4olm9DM*~_`YAtb%Z><~p6cinS?;1&ZjB7~ zbt=l)j5l%`QJP=?acmQ- zHiBr54AUu{T9~&j&?;0c-|{+*w5`p06fmi}<)#TsMdOWQ0VAa;OW7~&gS?4j7fJmB ziXV<3$M9DturaP}+=^^{QTelC#>(?T@d{E-ihX8VsrSLVj7{E>eX z_KR?7`MF`UyxGI4G((Gz&RJMMg_`V}sCQFW$cHOQSnGNe_doK)+pL*}rq(lEa4;P? ztSsIZ#-7$N}1(h#E&iKBwwkhTi(AMY8$_T#R4hDPIRPW!DktpbCIlISD{RVz%p((our z`{zvfX!g}4h7p;kVM+7lMt1|KlSFcwkZD7G0-V-!4I(04gfK+I!Bmo1nYK4MprirL z6BwJqonFqm0C{+spej%WzAg&Q{BqZQ&r64_QOAAM*?qImKM(Zxh|hdUU%Ms>_-IIL zz5T!J$56W%kt9D}T}%W{u{b;)($;hs%vP>i*mb-;*N9tAfH0*f)8K;HT^;WOg=ieS z2SUlSzVojgP9Fs#e+?_)HjRoCarv{8&ifv8Zl(P0IGH7CI=opPz$%&9Iq4+ZbJOv>`%-9pw&r(j z^1^Gk95>tS->Cji<=ubBh4aqI0viem|ENd_%`(r0+MWx_x+ct*P#fodc*#G4K_hyW zp|(6X30&A@yD2EFYHTA!q$I#2aGANpN5c^l+{XEwXQhd1QXVO!xE3WU(B&DELQbQt zb{5-a!9(#IOpG-^0JnGgn3<1wn5vKR=l-CKLK^CQ;VOSuJ-I9-K-^Rb^|X4~tN-KR zByOJ?ni#l!Yova(S7*3mnV>;{LeNGa&xXgQ;aVC57WteN0ZJ+^7Sz4ZjCkM(=J7TB zU2g$Y)6#;c%2CJrg!6=`)I&Q2ye5f^pV_dLC;Wpph-6!R;Ji%=FCpmpRb50F@P%nk z+Lhv@)U@gf$P)S{fp0|C{PrsU1B39cKSEJnkV054;+Qq74bMsd60~|cY&by?$8Eb{ zr`Ln)MfpPtl#PdnM@8g3Knlg8 zH*&gU{qlTB((mAb7Tfnv#^a@@?72{wQecQN;9wzL2fl1CMmV$*&-uLn6{MVfy-L2e zVJXw@WszGi)=m%Td?GZXJSZ$I^n1ReG_|%qf-dJ1v~6rSj`u(f#+}9#hcKBWN~{jv zbCQ!QkhLF8HHyH$k~N4$p>GLgMuK^O!$xz}K3z7=Y-nb4R2Aw0>Dank${2 zm>Q2bSw6j+b$;ScfZClgfVZI5Y=aH$?L=kZh@!$m0Q*qI_+D^NXJ=<6QNU^I9}iO} zn+juXnus|Rl+IaPiIo!$)pJ^0+|+rp_&NyLSsPtlQ?){x#Ef%rW+x4i7I^{Gqsx5x3VHj* zQ_)tr?~T0mp*pK#fw$6#LzzytNO}%TYbW>vmE|)WR~Vqc#lVBZBLNcUQt@r_yPr>f ztND%lOn-hm2*v8xFhD5Z69VhGOXDgAtYw!WOy>~#4+qr1Urd>EZuhe{2<{4$MmNXE|MuMSFfKravZ+d*6^&|ENmG5BIc7fuNIzk|! zNDE@i$2F05_dw1DcNhvr0+bX4UcA8-*g({0nyjbsP27=iCVA=1gx>+f_Ro%Ecc9Kv*ELtYZ;NIRdVOgLd% zTwy$=s4?uUxyChC2+RvE(a^Iqz@9l7AJW6Dk5J6xjkoZjA|nMLezJSuS$?jXqZA*5 zhws-#I5(kqY6AE`S&iN9n4kFP^n>)Zx5h~asOtL{d0AjFnT=p@qz#{vz@{y5Tb$Y~ zFBTkL#{wXY?9cl^3UR%*JA%PXC|(-*qJ98^NNobFfD&Yd865Wg&1?E_h%WrueI^)~ zj_~=uedu8TsE^H-Bjo&Ek~26J2Og6Sl`MlNN#&V$D--kV8 zHZv^-74hRBdh}u9VW^lkiVqERy}X&wQSjPcnxufUxB|E^P^mePdt>mVd|{9hzv^lr zG7I0uzJSB)S*;ev-Z)4Zax5`RJR801hBUIhR*GX_XpFmkq!Rg|s?C?^OL zpB)Ld%0Bx1P%A<&(g=^Rn!`e#pG>47*!$4U*96z3D3^Ft5U&D&36ERA48cvJwj$0i z-I>nD?Y@yC&HqVl(T&v+-wbo?{Z9MHc!w8Rd)!suOIG~Xam7|XDx-Iep$v{Kuogu? zjO}XUbN*dccODPeMqs9|)O8z2`Q2H%Rvw5*T;EilQ0>EUUbF&Rd!uJ>8JDnLWuqo1 zj}!u4H%i%WYe(Kt$UQxjTEu+n(7UcE!Zv6s*7Di7U(SxeNV;>d%iO4G^n0V z(ooZ8O6b}+bzBkFf?6RONONi+B<8+Rkl8iMkX9JD+D2FR<^}@4t8PfkP-4O$ebS}{ z-MRc}J({7wr7XU*TV^B18Tw^q&d{$eK9(8co$}B1LethI;0DB<`)vI#T}1pgTl`B` zfkt3cRZ}@~ROmxQ-v|4OsClpn6PMkx3Iw+JNp!6zI*WiR!peDxwv|*yIt6+R-gPD1 z73&mcrh?Lc{bP>50A3pK+{{MlSR^{+)27{r&l#KuLt6pNr(&(%E3m~*PbYek5#V#t z%>n8P>%)SHiHU&-^m9>93T}R8VQ$;^f~J$|*zDMwrXpyv=)>2qUmcWO?sHoAAl+S& zcW;fIs-<<)6LO03%I}`q%bm*Bgd}ijxa7ZCoZ5u=N06Ut%H<~Mr^d!snnZuyCq;)u zpi@fNh$~McjA&?ZntIkvgYRsku1AJ-JWnY6 zR+{E>+{93N6@ki6_x2q&+U#~$l5&gENCX_~>+3IGhrFJDo%mLtS3M9f^ar#<}ZfQ)h7@$DY+yXN~na%aoui9|BSzYZGc_Vq#L#g3s8Q)4!`2 zMMY?tfEW<&!#6Qp8Dbm^o(~(pPK~p8yOwm21+L1y&swH z4cD(6bebNpLAJ}CQaWBUrOZFX$*XwI$k?5~y)~r#rS`!}URbSCD4SIL>%qrd9IjKX zigy*LFB`vs3POj!3h&{vMG&CyLL|jd&4C|vz2cE&B8~irqAq}83$*+ecS!%crZ1lm z%DfQPi-d@GeMH%{5}7?a`w_j5z&sZIWt2h`uG)sqR2#7(Diyy$JjCS%$~2F$I)yof z?Z;D6j#1^pR{t2a7IcU{i-5`#U~F;!yTi&nlYx2qqEpz5c!(=S72kq+DJi@Z5%XR@ zyXBh)S%1(v%C!xk2`>!syrYu@oA1h%q0}A5B>yHuaTwr@vI2V;nA~-FSr~gnJV)oU z_P{{z@Nz}Xl~?|GL;4W{#)u2Jb7+vJ_Xei90pzgZ!l} z=mwO=XvJm5O-LHln%?ZY4UOiE7D`v+?f-e7l9Eay&+R3Q98^~{7SWH5=ipk*^O-A9 z)YY54pOJdCNw2zpi+HPd+_5*}ce#-b!uX3rmf4dZiU*B72(ct2#^y9IgeavMeLD#Teqrd= z7nAxj|KG2Q8zziYRfTjP<-bv-+L@PIN!ebja+O<%Ow797AM-dkW4mKe9yF**5J@8& z5Csl9suliX+E58gTVQ@ju1g%&Ih);5W&dG!h(AhW{LF_U0bAgxX!|+LvIJUGE$NNXCpv{V zR3FySLJf8v8v67*QZ?G8fSz@#1@Pv&vG2EgcJC$R8@Q#Z}SZ z-zOJ+_P&r@w4MB}pbr6lC*W|ll2%`a6c|THcFQN11zcXHTZut5UzpJ)8M1!)VI@88 ztdgx|6E3BZF6A7pX6~)#?5rm5ZKR$KIr*gdc*J?=G=Ke?_7!TkMZqZKFsUxX8Z}d^ zppN(;jXQYdkF%YE4nstekT0|NdeqqLYi#oGBeuQ2E&&RaGgAV_GBmDPU*kpZBAEvh zwVa>|U|0{;gc<);gh~fryldQH&{t|^eg#n1?83X6d?xAnmxnqF3kQBY{Mj~+A4hOC zGog2#aa_m3i#6~sX^VUBGs#bwjZ^eh)9q$6 zZ5;|4@ORS{9AVLbo}Jr@rj>{X#@WBZrQb$qB6(gN)rb2@M<_h4mgq=fBm@J2?>?-| z-04`_3qEb~z(WaW^j1)7KbER=+G|42JOM)rQR-`6zIT1avWV+HXVDn?U||qs&zgqCehD@<_xSw&(L~&h0YetO4066Wf zQsXY578BeISu_yLpCyt>`_Tj!J+TOe#)r7H0Tx2W3WMKqa98?r4S+r91obqZKf`8R zii@7!WU#yS{XLp9J#pA*s;MsLyT0gNj=KIj{n?SJte&RDb@2?YWW-sgZkf;G>RY)D zM04A|`#kBB>Ol0cl8?n|gc^)UZlVuqVkt+4$W=%S?QDJ@a8L?I49z<0Re}fsWAv8a z<-W}1v6c9&D|VeI|5wOxi;xWO_hRWgocO%$$kE$eCP>IIo+?NnQ0x6Uz&JWX$c+@8 zT*b|umI_!vnw7gAjP5NY(z4p|VPMhaScNy% zzwC9+f`2FN?9!_<^6soN7S{*G_XYEFp7f&^E?JN0p`*7ra4Iky_1fkoA1*xtZ$i;v ztOLcxiJJuZgpLPsLiqU7D{=h!T63g!>D-Y|h~++C8$ojaByhvX5Kcgjx%eEVokT@x zWnQGMv=njg=x1l~7-@BFb%mp1eh85u^5N&??L%Q+G!JMsJLGgD(`{+*?vqw(2)H|= zYyQ;Lt80DTg)=EeD00WitAO;IDzo@+ry?W8vC2;5GqZbnzfTLE0MoLy2I@r=?&8j1 z9;V_2NHT&Jd1gQ(g~eunQIHzM==5QFiMeZ}+MWMzG!6B2ao4g6{@(jkp>JQfx=CO- zz!aS~)rmg80ptEb3r|Z=&eAl846k=EkS|D~*L9PDa9F~{3P_`K$t&Wd{NuUJL`ue$ zG+#BUNU4_^RCxFJ@>_hua=4I&L9z9$?h+zvcDVUPtP;vTwFM^rXNF`mUj&v1tpv>u zTLGbFbcu(ucB^wAHB;I{ACw~@L0&f2Kxln+sd%JX89N|<)!Zt$wt!S@MtXI}dmHv+ z6C7D)5O_Vale9vNF^_37w}DLQ`ooE3hxyzXA5h9MOJ| zhnfBx!XLAVa2gAoc=@ED9#4pzfB81_b~5D6$hq!v@`4Cqw`PFf`*rhw!HInA)5Z9a zQg9IS5hVpB01{cfDNZd#&Q;pCtt&AMz@n100&br{z=*6W1@t=R`61{Z9QIEtds^r` z9CDL+bAqt0(#jDmO?p=MZbB)yAoW{nYOTNiecIo(cyQa<>}#UVF)$DZruG#NoiUWyx${bOxYDvP*AY3Io=wGILbI5t@>k{ zMLJqfF0?-}%0j~H@NbuY_2bkAyVF#2Q3Zd6HK88KNF3?-^t7n+uAH;8v$wavi&tBw zG?H{B(Enifyn-SkV2L}5ti4{~NYy0OX0y=SazxF9hV6%|WMOH)%y019$U zNBlAa85eY#-0jR7W+wYS+s7!3h>MR;EpKGB-tG6y!ND;|&kQLgnH(LhbhVxN1y_!w zf4|4ob}3#i5ez0fdlFqgw$fpDK3Xbv^J&zei={BS#Cp?&c{Q7XZG)0E!6F}_sF?9e zNVgTMIFQPBOMH=dZlWdjQ<;yC(n>g}OcE%^@_+!Ww_0d4ef(-90%5bNblrJ2D|z1ph_~% z2f@*-ZjSj?zka+%Y3|!`TrZSnQcbrNT0s+Q|JiP;t16qGl1DQgDjDCNVk|5r$tv(q ze?Ce+kil2J=^8Hnf^H8^>-@%_V1^tI$?Qf6#u&<*H2-vxN zpX-=ppQ$MYy3enCA26wzetM+O$%x@Nd(`%9yl^44%;=?sba7tO(ThY2xGK+N-~!pd zsmWOZZ&YynmIC{lDFi(`Q83aSj6}k2cL+TluL{Ly>RvrS{#fr)WAc z@BVj)*2dkwO3&E#s;m7%Gt{y$=f|&O13gllx_YWoIVu<=aZshd&U9>t&%s-@@!9lK zX@J0e{pr&)i#3|{iP%ct_xSuaGi>K5>|s&s=VV^NfOXM>DSs~y)X|rtK=Z@BQf4wm ztJN?go6ee5#n%RNWd>nI6AK@$07D%13%Z5!=_V%_qWMhW-;)SdWzHn0*o39 z=q9b8%xo3cQ63qiGKv6SlzGCk08&ZzV-Ig z$w$9~s{^xU4XY1MaNs3kNE(|>b_@MlsYCAuN)YtGp$c@qc|&bLl)rS*#T9<|*S`%u zn!l~#;ucTa%CskwnL_0L=y~J*`}sfsuQ0pUCr>z#%wa98VIDx8Sn-7TY$AV_ zYcLB|YxW;kl)fzzGvy=wvr&vXWb#~li#$W`=k&Ya=YIT)?eK}{#_~r}Y|F5C?v6dy zbguK89ot%+PLFT{Wi*}6-KMaU%UG|lSW3y*=Z=lPo<19e#&?X}K4N`_!r*Xr>6T+> z>wmTBzs`L1pj+kkS;|F;TbR}}8GO>JZ;cLTIp^9hS6zQQM42947y1-yeKs4Lb69NW zE@ydiSfMi8TO)Wg20R8t3gRuKA5{U%tSGx~i_gnyEMma)=Hk%wmSb=ERr~i-5x|U; zZz6{5u4GVq{~xx)%_-Qn9)bkF5g!Byt8c8K|A2Y=&RI=fXXkt}x`(&q(20~7*h(O2 zpHW}Lln%06j4)R^kuB(OIy)GqxY!bKl9~QKXTEX9{1dPC^zq5IHqdL14q8jN2K8nk z$rz^1By(4!Oie40vwVnnw#t>L+X`eE#En+4p@c^VQ}vDDm1+n_ngHB5Wk}?yySC+w zXV_hlGAT-mLqjTw(tIIO!N{i+QY;v7Rkv8u{{-pkjHQFQW-4uR?8<)E@$H zrnRC1s(|-_7ZkW_De+nw1l$vdT=r~s+c-~h&|$Mufb2>wWky*%h(S}Jrf%V>W@vzW z6)$$70@{_W0pu1U;U1|;(195IdN7s6$aN(pn$Wl~3mLvB^;pGF5N2NP)4~?@uw%Gx zioD@|z)cAo(}cC|9k7ICY&eyTTzAy(tXEd*qr_<7iim#Fu}sHnN?iNi&&{)M9W@N3 zBh0g&0n;%@fnqsa;RDV>3JVEmG-wEldFMZ1_Euobz`*}FzmmfGgJKu*R}H0!#uE;W zdKO@*kejCR*la~3wVI!h0!Pl%Dj4?%%#{QM$koV&VF(<*jOW}`eEGS1k)Jq2y(^C9 z#SWqTlhuF8GeBDL^H2ccit#2P*!R!YpMS0R@dhZaDbVk|N~b%;646y@mFW#a-jmf~ z#6Yx69{LCl^Y{(D=?&VTU})~%H8WDdqW~#ysvH?E8;#Vkl>isA-8if&m1NSVMx#g< zFDc51K)D!AZ~}+lyaLVsFpk-r@D|K`{`p^OfZBA(H+4@e6&v0Vfy6t|)kG9y#Ws~? z7d3J|yZ0Q){0Jt$$zX2?SrKIrUkVa!*_HZlI;8uH&)22{q^yXBgh#>gy1|=0TW_scDKk5faQ>^Z zn6&qA#x5cMW;bOUYYw8@W6JGZv;anMzSf-CiLCQpi{iALBbX~egW8sSDUKraS^mp! zteVS+%<1wJd%JoEvCC+%^qO7Bkrl&hRd;jaew7g5Nb=*JXZaGhwNt~i)a-_jWfoah zO3GA4S8|e|tJzGZKnwe6{`Zbdoo)xVLHHK8@1|JCM=|OFwaQcNVsVpfx-Isi?$RIT zT-IAqzDPS9SpWf1P^0e=hY^-CQoHav1-bfDBAib;ldh78_G-J=$a)Ac@~0O6W`%3( zkuq$G({}MuhsUX`wRm_@IBLW5Kc){LJGdD;y^s8XmlfIZj!;XKQDR zntK#Sow~HNnS&yUIQiyS2wWtr#BoA+p=9_`Bdt=DDJZZ}1tziWo8IIf;0mqOutqT| z`92fC66M)P#i#;u@!N5v;>m*SWemiU1+I$a5e8zw9|3!+B}GIKm@SLa(3^Cy5PvCx zS;UhCq6&s96xV0co@@<-+1Fkf7Z>Ou(1Mktkgx7Dm@kO{Ll%|A-}S63Bu7-leRr{M zpn7LfG0E>KRuxUL=NyISxZc57$}3DH&V1vTkzlab>0=v$6n48eli*kFS%s`puD#w` zzhuiPS)9Lzhlx$rKMw{%RM5RiY12T zj-PatGesgc3|0A?9DYYDUj&2GnDjlFdQb_&Y2OFs&DZ=jTyXgLEdR8^G!gujL!*>j z#~O4h>LG(uM;=dNK`0;z8v;_bJ&EB|aOMqA(wm)1ure|t(Q|B@zp=6~MBs>v%*f1x z9SA;S;{*QI<`PI91umU_Vbc}I{m~-ew${C-G5M=<1h08j#QVJ^pT2Hv%&)p%xdY1) zC6`;&=D2;AA#Y3wu_|d)srNgh_9whA7B7G5ekzc={6rpQqbxa&*YZZt;!wYNY{D6;k~bh0D>28h?slyQPc(*q=XJ z`|$dA(<8vmNl~p%SFN-?e-|7zk(Of9yv;m_QnJa1@5Yu0@!OZQnjPR z3w5}@EQ)W?lIh5;@eJFM+}AHPMGmRGaj(`|1R>fuCFDxj(7Kaxys7aqMt}#!R62RU z$vt8}O??6BY71h4da^Kv(wY~{PHea=U#r~#qCdGIlJ~)+BH&z%!{cO$&3r-Q@NqNN z8v6r@3cpOhb@@-r$@05UxpbagyHz=)evF_))f|E4t%5u`HQM*>5=FJoIO~wV&*&r) zv`C*l=dwtBqk}h>zA`HS%!BD?=i<8GAL$rUDkpOV{N`7b&Fa6CUc0R{VCBvZ(*Ftp zxe6~LjG3>xEQuOD`zfqA7LqgfC=#{T@`)j{+l%MOFqcW3GF<+owszjo ziy-A-L~7tCR!Bdgue#%mh?&&ax!$^gllQ4yB%42QU{a_8QJ|^n$0wP@HF(*^L3eet znM5asKaf>|e=_^@3o2UmW@}*eDKLDSoQz;xJYhEe^>G^4>_>cq*D4A)ea;zXkwq0C zxu#i;u3!K4ZXtGApE3HidSd9VgxDtru#^5(RnItEXKMe%9cq1vrl3UodU*2xyV#^K zJn4S++R)b@%R$NTyz?3?9b{1rZ}h%MT)=kpJvHp{-TPJ8V2Fm_^kwPjIxU!*t=^~W z^^;NeW88p#-J2kceZ*z8+OzYe% z%J*2VM5|O1_*Z+&Sf*l(>NG@`$M2r;safbs`2tBIckvl!CINKwzI`8D_6zyi_4gd1_?Iakpp_fSz8sFE$N_z<5UuhTWLFv+f_Bhkh!BH=SRzuK z9CblLvHB0#8}bU&ur!zifW?j;#2FYbKB*1#oq<(WpkWN7ZECDUBBSxz$5a7}xLg=) z;n#sEc-Nolh~ILA8seTI!?0Ts1yWApx^ys^u7xJW<=))azeksQ3*qL1z>rQsaUf;V zX*;;G_Sj9p3IVuds7b=@{`nVo1`aq42Uiltiq6Mi=cAH%e!;kXy7}dH$rmQ8_K__n z1}XtDK90-hR~n<}&)T0<)?)2b`_+yx30I^>4^)(uhaw}$gA~(gC;{1X>fAnW01LJ4 zX2gkgOQACuPSrc?w5b@xM$?zy)Ool7B)(8_zKzlZcKZ@Yy+@4e#S_0~oc>%o5n>go z!TX{_+AeTVF*Re6K;GPt-(bfojAEFlgQ#pKkagL*v*Kar$wgGmNEF#Xb{iv2zlA|I zNt0D@G!djtEZe%Y>qu2_A)5>WvLi0{DkUDObDrz$A`S!{P^r5xUu2-}BU#WU&2;^C#ZBK7|GkCJ8@}Vh@>&K&xLWzM}&ss4{e7z z%WZ$>J6ub_YbXMnO0o}Iv#=ytE(eONY|E9jt&oMC zyPc23Eu-Ml*i>Q&B>M0xB;AZ9w7)yPPh zl4sD!?U@Q0g9dq`%b%gafQYtCysgHxQL=YtStMuefuJR`cUHw<$o=Nr2k0)k#x>y3ESwok~XG}7UFC>Ldm&EO(e{=V6K6>y^}BND07eT zC_#cE7?l07s)ZmSW%#gX6_HcM->P0;ZlZOink>3Vl9z_Tn_kcU)mgw zJpV~My1P0C1)K*mjz}nTq|!n$eWMSiwm>{m-Fl3WpCxd=3*k`kSn#rGNv$B@Z_I+j zzfR0-mmdMnPBlx4^`#QFyc)i|M#ru7mIdB$)HLiFap@nMSJR&8U5|fW7YpUK+ykwHK*s@ zP`G91zGwNZ%IE6r!Rts{=jS%ZlYz_H26lrZPyG$_T`)nP#wZXq;N_r)Qe9oo@8+0M z@%_SINo?WGa`#vAdpKH%StkvMZY^Q*$Aq44G9k^ zA=mxSqlaAsBt&5fpI~dqL)-lGiEoN{8eOM_drHaE18u}Qu#{gZ{*Bo#b$4w!@+Ad@ zK~>`a{oTho^urO#eDp&Gl(6%z`}krKh>_Hj?Gf+*{C_uRVuSxvaQ`iu=y~Q}ExrFO zE?$z=0qnatevbbR{k}3{>0wrX^f+hjBhn2Vy^^Sn)e#U4;lI6t@bE{4oZX~S>$qH{ z?XEpq=WX&!Pw`AV8_E#H0wH42Mr19WLeCpRa{$zBN`|8W0`q?_7e-U0)FZPZx-?Bk z5KrW4X@BF@d#)~^>+;zB?i*J`vU7x8@ zGX(PA3mHis!e*61OV&WICWDcfWbq>!;3;~h*WUjb`vx!&x311kk}+`u1CkrK27eQy zpN`-Q;eWtGLsx$5@D1eK*{saZ|I@oD@ao5STx4PS9!^NT6_u3@PeHn(k>9B)00B z3Wj&hbxu=Nc)rD91L~J?e?0$h2;aE#a+uhhJ6!kApFh6wPq6%JCVR1lGq&+H#@#j3 z4Xx|T#TYk}asQH$XnPkvcBuE5U#zYx|GNF%c&j1{s=$18A-bImc82NdbJzK(PlAXw z99=>F0znLdej}&8{`I?GE1mA=4K58>?JE=P@*5$YWUCmNDF!>snoJnry8zHFc`+qs zy|#BHq^hO$zSXV_75Ny72C<_vfOCU_+Qjh{0KdZAGOp>WH*mRfFHp|@ z;m2O27)*p(DQ~3k#z(>M5w-n8Mb*haUSf}6YB zv>k+I6WVD_YkCf^z3z{D>7R6TTfziOEBrK95N-KIy zG)jU!7?mMMU}3sr=>FdIBhR;`1n5y>SRAXP77t?}PM&F6|8TQ*uCbdjm(As@^bE0kWPg{!N>1 zFxzCUnJp6q@E^pH#iUXR6U9?+#>};1$c|3XrI7l9HHn8Y)9W*%A4yWE1VTqf%1^j} zlLKr6N+Lm2aThySvw(}3%BUBo+gU|cY0yh+v{<6S1ARfwOhH-uP3uk>1pUD!XeGQK z^D$%tN~!qeb#0kV#Z4780t8%$2DDX>Q`FF<>9uA&QIT(9F1w#BUA{e^p?}X4tmV7F zlXwv)<>4ZoRC9NN6$NhRDCIMen^%(t)$){Bu@Y3WL88L+L1Q1ti+e*d8{;$ z6|8m$k7+l$z{?J~vDY4M%j)-1CT3>o`0d*AyG7%GF5AUg(U&cB_m0=fs#@sY zsoz!@{>m@gvPy;(i`ioN*QeX(*YkiLpL_c+RPtC!CJMth@vuP!{7_5tbR%!1oeH;q z3x%Y0&?@$mlarYu*#UHuO_AF_nyNyVgF$e>K`Z~=L|FmXL&t+0kGs=Vd`e@#+j&`X zzdvQFdE47&gYP4vZ|r_gH^y&Q>Dt=bJx}v>jz!RQ2+S75dGKMt5K?hL!TeG_Wn0%3 zE+KLQk%Y?eK&W97(<09&F|6I5hmZn&`!Lcs_MTRAgpya!5u7 zOu{wPe|O#g*$yKHS&=MdxaaWKGRnc3N>MBsI&=20ty8 z@6Xl}MWY)$&exloxTOBgmW=1UzZ_^+eJT**`+f*)nV&;XfNy5?yq%FHNBFVk|9l!R z`t|^AwzF-0+1iX+>Q9l&`ezYcic1TANVm;-FFxSK9OwM?enZwn=;dMnYSt(|j!wdd zaZS4)mq;xufe9;GG_Iz{#yQ)4yPyw(U!}&KEu2xSpRdv>lAqx|1SPycjf63=(PC;d z`JAY>&1DXke|~*`d#&rb`<&r5`XVd(gjtI9C1$wiCjfk_3j!-&UtXoEyGZarH<%oz_tP?J zCfLZ^om~)91HqO2~$B-Wx zs|;wef4lVP(G8;nR8l%eh={aGNQVfBbl2z*q@`OBlt#KngLE^bMmLPk4gP!H_amQn z-#5Rw&biKYj@8?@6fH~{=Fa9<=mRGTZ!-K9MNVj|=TY=A6(4D4P-ka6*|#F}f8@WV zi$Bn*n3(^ru+#G92PYjF4`&fk$=`oF=N1WH{hfVJRuzoB9o0RM24DYn_AL`QsvDM&()-UXl~&qaq-dG9bq!7uZIH^Ce# zajQ|;X#Nm0nLroASz3^-JN!dDk{qkWexdH^G1eV!heaxuJsXa$lA>`RaV(ZqgVGJU z;&h=ck}ZI+@(`W#zyGn5>qpu`dhzVL;8Qzl_P&9P7#gbc?{~o%A{Zh>+fMGINl(j``d`*TK4xXBz0T%=2+u^4AP&6`u^PBqK(yE}Loj>4L2`DI0zBfG@ zeFR4i%026-QGdePWct_X`;#A(7@CDYm`8D@9Yo0FKazt6eAgtX(=5-ww&UXClztP8 z+-G~kx(=0y9R&r~K-Mr{dSASy!ViAsI?UG?HJvPLMixX7s!G*x*&oZ8XrZV``Eq?y z{pCd{CD=?}QaRC*2=8TuW}38E-{E?;?fwD}tzj zo&7MIz?m;7cwQV79#uHs$%E9%{Za@N9An^ z@H0g1X+*G@3QD6nb^NOi0G7e>;-z%0Kd!|VgLsYL-T1s?#sIuAoD<&FDppS>}u8Qb(bv!Hn$bW8jglV%D<^>J4fyZs`i>ZYYr zS9(-b2<3UABdb*ICSpH#n5e=+FX7DkK8&2>l{>mJLYG+7Pb)ov+; ztB~i`21pEIX)vu4DIV~}9BHM*?r6|msMN$bw>inC!9uUe7EjW$xn`jOqMy21v%t4I zJJDV|(&{ro5lNuOp5`lChCMIG_q=Dv2d$cYk4sxMye`M#z9k6s&G_)oCU4Ca{YH3^ z^QQpyYzgubGv_EZntjZdoK3bjHf8~L{{Z)9yWZs{k>4D1UbNJKrz+H38@b~>58Pj* zEm04Uo_v)3C)#S?$T99dWcS$lV6%Jwx}pEHNFluxhfmNzf(>o>bjmhxFLZK`f?q#i zXZVQBm2X+a8hZVyKen`Ao}4RHGcMC~;cIo)QjuUZ*$9#+0-1d}=6%gVXq%A+g`SSD~aODI`fzA5T_M`(ca2Z)g5 zO6fIWdhyEcA)2Z8j!P?>imyTMalT@8j|a>@A3a~!q}e$YsW`Cn`l#!IsGxsdR?>Wk2riN5-MI`|(e z#o;S(OGQkDHGomp-{+4`melBd&kQiEuhRzd2b2$x@Mp343;ctRw;3d$J|^H3%GLpn z>aRgxi+#Zuk<(gS!SEy3rfkkL(?MFj?76!x)syyp05VG@6*3_oC%`yy6%vP5xif*thq_Ny$aA2sxSPtmcMzrAS+igup?J+?i*5PLck($^!&uz z7!%B_Jd12A_Rqr^7^T%gB_(ukP;5cMt8fE>D#N-L< zTJ@C14o+A+`efaQrWR_42=QB=cyXiIIb+_qj`hR|_PZY{jbU@lEWW<-_ppJf+3ll) zmvNK8rupoS1AwX7yz*iPb`m4SaijFJ4`*E$Wljrzs91D~zUSR|xy>jp+Tqf}H!8lo z)N&YICWgGMTAOk`e`@s-Oy-O6xuV&4aCzY#R{m;xg3Z@GkZ}zy^4)UPK17i1hHnk0 zg*J@1{r_`PIG>M-w=CCL<>{t=xa$&M_nQL}_XI&Enl3leXPa=1ZAfdE=$q!WPG}Wc zd+R@g;QL=+@kya+-p}?vQ(WPY)dCV}93lJMJhH6V@Mgpn&fzS7gUHi^%sjyowT%f6 zW))=}!PM1)Jk(5jsi1Dk`7!ceC3xjv`0rOav+_m=>qThif~W;;W*2H~QP!X3a~#6d z;>=rSIF(OW>pwDen`~Ody1$l(WQtfXs2cm(znr#r?fI zZ^IKJi$6CCsJ}p*q74E6SPu(VwM92)w^VjNjmAmK$~s45f*2taVfS5v2!0_G{-zDu zRzy2EJ@H5ZkLf=;v|E_~Uob9MzVpa)@yPRrnG}FU-d#oM{CN*x6DB+dyb;DMrhoAm z@G0lf@h#^?nBe>3->i=7j#AW#E~TuJhqCbA8oyjW-@kb*^hkroam2yJ7Pd1pFHHM5 z1|Ut`(lOl$kn+FM=Dz8;Q@a;HAf)cbfjb`lA-Z}NZ^P_-f`&na zzOr&1lqCuRN175Vn8!f_)F{Jj^qCZ=Zjn3u#ZL>TO`e`aSS=Fh0@^i8^!9D4*m ze&~0;JFFciTl?A3Q9c#aZ63N3H2Ir)>GquYdgWkj$W8ubt``qr_sNqErwOR|PE4${`=Lu%A)m94Bgf_$KIhwO z&-lB5mJ~9$VLfZ_+{ls)?$CUe4R+cvZq91W081z_Ug%4EN-lMtXU{?+=X22AE9RaeS!!TP|D4B0xzE;7&z)UAyN8hI zg9`!Cn<7xcC)PR~Uq1!i%hj7x`#hi2+mILfqP78aFkYBEDJx%`-N|r-;xzZdzn$^J zsoWF=G4=X~U!q;yKQM#Df+&-X@{O9YSPoSVp7I3M(VdcjZ@g^?^+yqOQ%Adz5Gt}_{Dya2G7 zJBEP}w!bklG5zIisU7q5`!|Plqa!e_M|8}<&Mi$8+Mr*o7uZwL#C(r&t>UOVm^2Ol z68ec#`4$@-S1c{3=QPlr+kXu{@YGR8P+FFF&t};iAoHQW2 z7Bqwz$q8K|%DS9}XB8e%rnt1bPoT-|mfuzbgj?z3G(T`8I(;h6S`?8Ddtk1vWAN zBGfNzJCDWr_+O{OpGe-B)sd_PP0t8&a|24Wsk$u|DskE|OB4lhR~s)vg}XBlTALq< zA1Z2EYmaaK72H4cD`Fb1SeI8<3+`U+CwamHfIOMchArsI@QRD0_uD{^^Yb+vyFeav zmg)xmWDl5f?~Te{VK?IhE0q6-V3J{nVO^#{qJ_eQa{$H z$P#Z+8mu^EX&BFpHlJyR?}SB}QvcRuz70{RvtW0SkEGlM$iLTF&EvY3uaudc^=z>9 zIn%1NU=cTDQKeQcUwL;u_@d&dXZ(Dw)~Uq~9tym5bF=&7z-nIVc|Vx161-IX_xZCF z55_qWr}}1}a}Pela;JY30|t!+TN;d6@Ve7tJw`(@IGW=75DzvmG2Zo*R?bQI`Zsxo zwFX>c&+X%pbm*>xLXXa>9K9fb*WTtxes{c`vcAOPvymJY%@6&)?2RH}rA!0eDOkJ* z2Su>X_bbYZq(g$}>935ZrmTgzv<8?sRVn&J+zUXPW-fg}9SxsC!9cg^IUas~ z$THZ}7`0xjP8jn|h=8pT&HAOLraCUSP~WanB?owVUZH>8#Y{+T4Zr>rjh45tfif7P ziX(5aEIlJ_&?MUHxap3E%c{vv111ob3>sl8;$n{E6ERFa%gmjg0-9SXWy`SW>*~h- z21zj6@}EL6zKba*f!ZF~G=z*&b{zHr)i6eFu)L(8o04*Mk1g;%N3*1G3c|~A{kNdU zIg*q~#{VSYB#TYunn|+lakVQ{g&eYKZmQ>~5!-X5Fl!6@_!7*@eG#gp<#AeNM19ec zFL!bHz>ng|j)c}k{e{zOE7hgf|959LV;2!Ot>H}pWuRzI7NggE?WKefYV`zlU6T(g zDXo0}KBdIwQ&F)s6-|oyg0_gRu&q+F0ayafybMvRs?k&#)V#3!_lH{k?Nq75qUWan zS=T~Zo{hz6LdYk9qV|nAX+g@)#|b51`^A*nNt1EqK~+cYRoOXy6UUnl+e!9p7Abf9 zlBoC(m@Kx$bO1p&vq03PJZrV<))4sNG(JiO&DN_U|C1XfHQG*MNdeYZDb5bjWSp{c z-%_(1Iw`x4mRtcN!|WtVulpjq3r#L-8-fj*c()ev1gqXnQ%TfSGo_xzZFwEf|ICFX zcx=Qfg5}@j>h=VAVyF9Y+GP$b9g%8d+R=c=CJQm0(g_jQHz)8nS1(#%K&tV1apywW}Joyx}=D#rphN z@ik*vS8zVvLF-5ES4!m|9RH8gjG4tl{-+rOYbtI@d=(Pt*2Ml?g=u3Xgo1;LIC4vy zhf_7WbicBuPz-tgge%kRc_RtZx}nh909 zK~Hi^``?_PO;L`QTLUj9Rhmv)JPyd*&=%uX{olG~GlXr{sq`3<%*)^F>UK?c1O|R= za#$2&0^h8LVq)WsWTIK+EZ8}_d>u>i&f-3RpIeGnby8clr9<{}@2)}~P%i}O5cM}- zg7z-h8_XWHm;Fd4{FKm?`;iGN<-|Mk#d#s@$Rk{aH3WmgTb49BfE~4}oi=c}Mf5?J z`uT79(CX5+dLIT$%RVUgdF?o>tPPG=k<_8#60EwiEjuN(=8vnM&fwWut#pG`$`)%X z9ci65z@`#3fm3+!EEJM(Kb<#=JO=U#=WT7)hA8T#2U>cG6qcX<{4(w+DGy{Oel`6q z{g+@>7J~~CkPHZ5&fQCpuI&0HyPGwHwDpcXz)f3 z6+RyJasKA)Ov0y$T1+_$i|DlpYM<_3u>wk9?UA$-UJ+h)5@rXZyMqQBPaj2p&|o$v z$6fF(eqNq0)tG)>DB(vAkOvjeoGls z*&plz1NMv>AN%HhmsGqnyPK%Jtk{7_baT4zV^hMK#l@EzCykFOgwq&IgVq=IC1Mft z!*exGjZVnBZY7{_n$lsDx_|sULm(bG9)5NgT(o{{5X5GCAHA?}R~2~4c-jz#?vf~r zKayhkbR}b#Ox9RNu|?2X+UlCOCBOsbM4xEYv_=z%Pd$!G7Z={bciMSxK7An7|bN_19oEc^40{CP!Cgpw+Sm_jgsZ(*TuLzy9yji~YarH2@3%roclhnV_*&~ydGrN zE8Q~Su}clF@lxbgLvgzw0kHin8y}3HMm+640+T-ZIB*}ZKyJ;i#`(!| z`&@Jf1nvDuydS&K9O-L9H`Dr6@=;sB(Y(uU+TD`t6ZG}=dj1M6K+fIKJa0rH;P)e9 zGW2%0l{)n^=?23Ywp@zMi>KE8+ktJ0$e`zvzaATweFG#A+8s8pDi$D+qqtgouUymG zjown`l2ixjtIgp-ad&3((4@jh@^%`8OuchYq7ig){(}ik;;Sz)fnz&r7bMHxuXY98srAPH{$y#T%$`;+%SaFGs~laPXgbsjK1)Vl{do z>oco=Mv;4SX+uRD?c(kS@YBcpgC#y%r{kqUhe&Xxl)>p}-j&9o;yd1KeKx_HuE#Xd zRg3NO90`xJzm&iu|3mWmujM9o$d4NBu5VRpNi&O;S@inIdOQHiI@y{fi$}#rb#10K zDbh)3l3nhq^NAqB>lZj+CN^-2ajni@x$uXCTKIvro^AdqeF zNnTiIVEgoW#x(?n$`F?`t_ByL^)CkcsilE|S=D5B9*7Ji=yC5<|J6vx+Sp@z!G_s_ z`>}!>FoaT`Wct0zcSlEDu1clxFwFppmMI){e^?}XcRRxNjy)UU@M0x_MThH2b%Ma% zPPdh7KR5=MRdeDmF#k})7jO23wwXpBw-_^H&m|GMssiFjp4|GU0ds$JJ&_#&vJVU! zzC?d60Sq7wcAJ|T4Xw;f+U*jTSt(2G+yGGO>MLRaVbtM&#t3GazYKhwJPLe-z?|~B zYo@DMn$OeXm+z)kHd?N}9*6{`q6=37U0Rs6x&MHvLjkQcFduM~a~wm-u~+H8)}6Dw z(IQI+YvwlVgb&ZvbGv`^PlJlPLlF_Jz6(;G9R*f!v7`G1sSCTs3N8OesEd~+z8o3T zlL8|xu z-0z1-P&j&J-AJ`U8c1a+TP=9h%SZ?1pD3w%9jeIWQ@)3oJvgHZ!dji*#LucevN@+g z36}A=-1C*A<_wyjHz|Up6zx6t;;oR^fI5XGX}?J+m6NY=K#K8Q&Qt_RwMXzL+}Pcm ziExUSniQ?4^$B%LRUNBOEUcM+W*G%5^mp&)35RmUA+0BIq<&%~?hxs(1K3i80+w4u zHwNO-c83>p4$`ZmX)THrb_ML>GVX3a{*_lZaKiDKg14xYh?x{Qf5d~n#?v1TA@fz) z=|1bGZR+ZM|5;)9!eZ75Cep!)nREVwTS>MJ$W1O8WAZ`U9N%E# zaD`1KmF_)+KYi*Msqc|GW>T#<^;czxP6@YJNLZRZwmpp#yeulDH`6YUm--eT&8NS;bc+#aeM_n z5P74CeJ9RVvC#7KJdzZ|JxSvn zZJdU>f#)S^eg&u@ zlBMs(dnenVKjI|9oNQ{&!;*f-BNSDEy`iaxmS5cs~&OJ>ncYGiePG0wIRTw^LX> zT(2-B`4kkDx5yRY32WxPQT^}@s`?^|D~!0d<)pjr9}(%{%ER1*4q44m_j!phAysIF zp^Q^k(pGE37jlrTJZ=`|^|nb?+DMMu?%xNOcQl(e*;z6Hb5pu8HX2$Le18|Jt-yDG zeh|@1-dZaRCbyWc6cpM>+HJ3s_oUILT80jVb^eZae?Z<|Y;X_95HUepgt-OqLbRiE zg?BXXvg?(@ty$uC-0z;okNbH)Lap|=qlt#kh={xqF!szXz`BQkceuakJDU+oty%X3 zbB^Ab2y)eF-DEkr?%T3Io_%khnCHnn7X_EC_WrwYp)AgLh;Uf+a)P({Zq66|jM2lR z=HkF@=CYeI=JYr-@O9YhYlJhJnY{NuxxpPJ<~40PJWNy)ez(nU*7Bu)7UP)Uq6kbR!glkYE2v* zDtm<3T?cc_>}833+Vl$CdJ(mDj`Oj9e~wi>fhRB0L3Laz4OH$`3#2)o_ph^&k#@>E*eys+o0`g;;Hvx5~1NbQUyHLn~gb8Uy5=H}#c)t4c582Ui!djbt^u_uh1+&A;3R%CUfh z+9po$v8xgeLa!qn;Wak15hQdcJjFw(z3EtW{f1*OT`w8IG3mf>qUL%JwC$%TU1JW| zqkluclaowO$o(6tF5e0Ad8qka$?&jRBVr+*YG`=)-P>(+khQl=WgF5Gdv7pU@|;F= z=KWZ%+}25rFdpbW(YyC#E4&Zbi&Xeq)cj3G10GqL0?R@*R6 zRqcL!Vr5MsLwTZe0A1g(I#JtYe^$NjPZEB#e1|`>wX#5t`@TEO?))j^cVW+mCEO2$ z-b+^_ZR{rc*N4ka&!8HN;^k(IpW$5_`IC`Tz_HBM&Ua=|Hv|hu(PCNIGKr|2k(X~y z+z%w7Bxeao_UXN>5AJQP&FJ4@0bT+AOc`rKQ;UqsNvbF|KbvurbO`cfQkeejL@SR+ zjsBT@)oVE~Pf`t-^{4E2p-}7JzZs{*21{Kp=2a82E)N=2o6b*W+=(l&f00`7uCbMn zY2+vEGCUKu#ZrZ7TtIdW*gEmvxl=lduvpzF&_#uju8D{&SB2HF3a{Zn-{6siz4DAE zZ0Mxg57aG|Pxqky`dR(SD>c|pna*UhJl7zlFi_NzG6#BV?{2@7G0PwS{F+vidF<~~ zOlGoU9bY_%ZNZK zD09KX+oV z&|;y$SHtb-_UHrJ@)guGvVtz7pLk5TovaUN&Pge}SP#YW*J05Qu6qLx*5hJ-IuGbv zp0j4vk6t=S@txc6u9P6n_rhvE?xnU^ZzaulNVBzOkJohK?}Xh^;CN9DIEPfg>pFpd z0Af)1YovVP2V+wK9QV+ff4!;FeJ6d&=SWtr6Cr;evNeEz!1`q;P|DSM?zg^TajN54~dni_5smqysD$-B{tA)GY7F_x&$A%bV_y zFs8tQiOXIf#qoaHgp2%=NxKT|#bsT^MIgQ!HusxWd9GLGG zj}JWt#_x=Ih#C$iS{-)$oo8|@VZ3f{(e0nmb9H*2-<_~ATQT4dC`Aq!F~?lI|(h+B3*d+o1f6LR-z^I-#gNT z0A3m$dbSQISqjKGG7{r;QS4f0(OEW?;^SbY#ug6lrJTBad>eMlIrZFL#Kyn<6kCpd z0zOwUum~E_%uNx4Tx|O6RMSf?&8#G*}_v?t#{D zNr1@pn)-FHI_!b>z95F*0OE-lZdgPVMiL#}_j~zPYwWP(6A|Rx$y+oY%?->!Z7kCO z8`4*Ch#8I=w>&iZoj+~^L)`)&WY&Y5NZWaw_3zp&nCM>Z$T_rJY3|N*RH8z~-3xb! zn(FW=1+d)r9a}@kP2F4IS2?EczB{1~t=&JpEK7pPV;2`jQ*IR84k(T273)^sYz*Kx zZJy{#l5-gIW)OlY3;KH*zgFX)G+0r1agh|zF;s9BR;7JS_%6R$Qjgh4>%bmlLi;?I z7l2jaw!Zc1AjNqYDYB2Z)&(0aaIWt+{fqSm8%4`Yl^TslaTykz4Bba>~P{$b1gaqi4 z?ZJzQx%!TZfOs*l(<3VK{CB|JjvM~!36|j>MnY0}h@c zqbn$Xi2Ud}=OtF@9g3g9)K)!JMqK=$5)gyrUu(%@-wboT&nDMi5=?yS;hT~05!+Zv zKWCN}_GKBAf2~{TXPg0w;=ow`2FaN5F=z?%qkG@Yl-)fA4zDZkwe+z-yL%LA8^PrF zP8bT{G={lNO#FQNih^QAl&a4n4semmz1rIeUFRDcJAHjMna?ClAKF9l!_xQE%QSDz zd=xD&7gXroPSW0o1ro9D@g!%1rdo?vDQs2&;j%1zAae zVWIzhK)pU7gLSf3gr$gjETJdV^KD6E;Ej>=W?u)la;soQL4GM68_uN0hgn@i>t?F~ z(lTKZrJ^OAhytI_(c64RF`Q3dTm5?8*lmwd`H3e~uubQn?s<@c!0IXH)8o{LOS(j7 zB_ragR&5dSA8aAz_6m~DVjJ0(yM&2YkdAEneCJ<_!Ks8w#^gacauiymy-zW`9J)fN z?O=M^l{ALyfCQ#7z(rpS?Ks*cYysV`FVWIcRqZ-OH~!ewsd}HsZ6j~b^~;S>*W9@m zfbS)FzQ^;4l&kL^z4x60{Vpae%ETvg2^B8GOU%5{B1daUGzgnPYt#p08O4Ql%~D#} zclF=y2pD&GE+@x>$xr-rY5~`vpa8^ifH^li7;tqY@QkPExr?O=?Aw|YdWMuiO8kq# zn^wl{fqDzwSqWSeWdK#2UiB+7mzQW`-rF3Jhlm#4K57XD7-v~gNi#{9WbM;torNx2cl=NWR`MeSD40Ihb|E6bI5p%&tjwjN`rc9|vG3)8;)|MRy>a11agohN|3?(LV&t!`yXM zIX>6NKnN`1N@Uo$vy}A3@9*>wPD+njKDdB@B30b(nC-zcN{$7AZk%rFZD0_3Ds4Ph z*6(nJ%?0q)&DlTL1cca5rYOM1-Sx9+==#3-hN+kfk@xkO zL?6V15}MsZG1+mnoq#UVd5rlM0WXhSMh7mXWFzu<$Wl$wBj+vmqgToufZLTGetNyAsi`vo8Uc+^s zjgX0}?Eo!VN~u_(?4rGk6$aUa)$w&|C?>%kY}iPt48s+jH&&D&xPS&q5oGp4zyIkq~4MKrQ%h^ptCNrB~#deZGpfRb0H|nu> z5rE_S8C%obw%3}R`GcY$hNp$X=huWK>x$%R#4!5TOyAs;;Mt6zMxGjy=T(AKl2$tp zQ|m8Mz=)06XfY5esd?DPKW7;ogq(f)0s&FsOe4gcv0A49^0>E!om8eHCzB6`ZGb95 z5oCAuBC#FS^ih3%ABT#%_O1~VXS56_H!c=A#JRm(OMR6H>+edvG^p!3=0K4M&u%$L zw8!bURAsuKa|JJpsx#l~NxuOvmfq#TpOazrh1Bg|!*lIV1|#^Fm0vp+v{UZ#q~n;7 zOBOIi#5z;$Me&9oRrJ=iTmlqjjs7qYs(xc8RDJx;(DLlc>2qa+Vvk)e&N8iy_Xcr1 z-zFYkRHQQ93HF|CqpJ8K%|Ga$3C|wnP1be;s^8oQx!GW*R#UI0(dJP}QnXe~Wt0_u zDqb@0n4W%<@*RXMGM`i5F12R6BO?`!-lh$!$I{kUX!&3h(f>a4{dXE1lk0Hfqm;V_ zuIN51;edRs(-BHq*V7~y?h_6jobM@uUyOc$B`YC^8p01Blew0Px&B=gHSDL0J)F9{ zd7CX(5c`7PRPD`$#f2<;%K01JQB?JBCwX!qUmnsQ6NWLn&(?;J^0t zo3)i;pQE;4=<=;fN$abE5M#@D6!8`_!Po=0mU>-sxaCb`^eY}W*k|mz8Tq9H8ngAz z4~IvKSIz~S?s;ZEPNiVXVEi(JOoG?D6OGeOc+6uL(5yPvj;aOp4ZST7SitCF4qqjtIxr9f$M;tSio%heL6+deLhBX!F!xF1q|8nS4DXnNri z;N$-AhOC`MM@>vH+CyHw^r%?b!BNvOtGXD0J)&dBqwosj<@RRntwbCOc5~I6UaMOi36yD~2R}I)Pmq5MJXXy7hyLNfdx^_40v=NZy3ngqs;gh zG?CUW^-)wS0lN}OUc|NwD!yaU-SSu^WXFi-!22j8$ShF_Mo$gb>-)o42y*7+Ql?_B4^9nkpbD&MMk4LQ0GcswWxaNPAqRG1)8cfgj$1Mf!| zWa2&xeC%Ph1E4&<85W1koTLBrvKnCVdguri_ke;Q8vGp5kr7VFeAsBt{nFKRa8}&x z(#+{`TnA+7>IfWgbdPepJr2!zXodfkJXrLEwrZpS5_^m~;Me_?%N-9JD~*s2;4YDV zXT_j#`wr1=Lp~ploE%Xj7x zAZ!5BIdiZ0cL@%4s(G?}HabbrsBY&r{lzHjwxJ;(Hy@wKL1INv;CLIiAxl!N3HMXt zQR@3e5_2F?7v~po&3GsAhb*%y)0%{*3W;U*iySfCuY6Z<(;NZMQq6VnXn-1)ft183PkYJYD7!n!h@1|NBzjmQ*JK3m#RJA;q_I z-71FoTO1w$n$Yfuo&^c;+RCnut+QsSHkvNR66${~|?7AEP?gn&2 z(15(v(aAHfBOu*-2eDHjDdN^Q8Ay`jx8Zf$fWv&>yF4omwSrq`jU(5uwN~aIpjnQO zdB9@F+tcN71o)k_-yRgEQe^<$`hwJdG*f67ayT8MSBodj5=1G|d9}j2m zA&aQKCq`o{3u}!=@u`PWx(PQGk9Oxrt>TBH8Bl-tg>|IU{ll^wj0x2NQCeTPZrW-^ zEv!7G4Y3dKE&AMdS-4MB%Ncv%Nm;(nsB7~6S<2mc2Oz! zq`?imr@Xm)oG=v(eZd*0aVHfsyy=x-PC(fZ{kR!pjbBlg7#B>q%_ zg!o#7=<*k+kk<_tGVS@14;Spj$7R2flA>X!)Z2hWcCyrlC*9-2%R zGGUy=v$bRZkJR`0HRuPso1bgUEN>fy^g7kKh2KwWC*boL6}h1En9pxt>7sk9pEyV| z_V|l+tB2Y}?Q>n#58s0q`}d)$Ko@7~qIe<~D_;uH5|Vy*F5d&hguj(WAcdvnR_zTNJ5q;vB34X{%p#M(ZRl~R0KYfUM2WvxzI!2-+?*c^%mpR5tyfl1 ze$g>%86V&8=<yaszHzN80Z7DiRr1Y~-ANe$*%FNCs zh$PiTcAY`PgLBHP=4_ zqXjqZN~D}fXO;)P&wfi`(cdgOEb5cq0_Xf9ixS;PH2JEIh*j8uy}zbZ2XONU z-?(zN1f1Sv3D|Ao{cF6#BFDhX!GN`z>oO3XYUt{iw}e!N)i^-z^VAWr-*0W1u{HFy zW69K5`(M56n&dZtYlwR?d`g(Y+p?7!yv+;JfAZ)sQk!xr*h`Reo}f>_Hwu#9Kr@=~ zj==sAv_HoAr?K>`3w4K zr(ABPByZRR>^5hNJA=qbbC0!)uC!Y~-u{keCjmY1zw|lo{SaLg&mbBt!6d8_ceA>i zh~4gcx&N=$FP;Uc2b*IRK7duFc^E=Z`t7TxL-3Rzc527%=Ul_-DzUXSG78RnBF62~ zBm~%UQ*_A-U?ji%9}HbT>UDl5YqLsUD@v(;^;*2|4san^_a-88r|I|xQ}z(C^q-i)zv2M9!AX`5o`HDp z4d7!5lRi9UzMtY!MwY1+T}hE{9$-ZABoJjpg-7nqNLMOp8Svmr9jPJ&qG)NQuYT&Y z>_*Et1E571ocY2);s(rZ1*q&_edE5CJM0GjlYj&{kaCBvF|`Eu2e$Fe1h%Ej=9TYzTMk(*7cW@0_-E5!OuH=5hR$WY7QmgB z$9$c+ky($Hh6ARRM_mEi1rTFz_05<$L*<*V(J_TTev?jez2z>tv|FT-d$Sq= zTK&7IfAcAfn;kzi@CO%L#(tulfDuzt|Gi0L*~K%QS)y@lvx8ODnNFQHg3mpp(K{Nx z_@7_vF`H1IM89%$CNiE~Ck`m?HUkvW8tszan4B1`ihHC?@PdPoiV>KNi?a4tb!abx z(Y(f+&foxH8_hgvFUQZHOQRO?O;)PO&8sj@ zT=x%|V5iAH*3ZfIF9wBq9!>l_g-xVAc$n2K;n0BBIB}~_$d-^uiUk|zk!UOI*iwl1Btn`u9n2-S!y=*_pZ4>Cd{fA(|pe%1Q;Go|kzt$w-T z-PH3Q(Wz?@yN|d(`-jU?p6Qik+=Jh^E-q}vzi6*47P;O^i&TAf_mVovTs0SeoJ2*r z^VAKuPEIf>BfN@)v4zw6xbFwWFNkoMLF^hn8WdG~{OF7D?+AuAwE8aE9)u_qoi+Q0 zHgG7>K>v|{@a>_1QKNT+>g_29oc?R76uV3bRw57b3BE;G6?GZW{{US%4q^z{6bb;dfk>P2pff;yi2syd#p*Qhpkg9rYLFX@+wuyz@q#H<9t)w{k ziEyNAhY`*}6cB<8}_}e_AZSsUR+IX8Xf!_DilWqF=_~3*% zc|v0O_)e_;A}LO;BY4W66)1ZqwBXr*{Wpp?o@NVN@${ymm{5UwcEzdAgn;9_Oj{FK zXM{V%Jx1kB@FafY(Flj&?qNfYum~k=%`xz!41I>72lxlEgoaMYfEj*g5(5!riMbOr zSEAx+7i{Ru%p&TWt`@@eg?peSdq&{BuiZYiP224wMzCOj_kC7B$PZT&Ej?eLZZxDC zI*AR!T)cQOJw3g!uuzBuxGx2ZfO1cShPqafMS316AXoVW^c zHC_=UZwN0oUFHzYhyvnBn@(_6M`3vF^F$g0#L)UdwPcie`5aG$rqwv#8 zZ^LiphHq$|$;>SI*T4R?bw~P{>;ed)3h_Y@5;q(<==}QP2QhPX&DC3<*a9Nbh6;^z z<(i^MjP0#0{oRfu6EqAVHoc@0Afq zCk2P`Gwln;FHPMmdQg5UgsM3}>yuV9oyxZ7TuHYY$??)So0b%>CMALyfGEJwd&WuM zVa|(43U^}N3=sbP6yQ-sN|bs0hMO^P&Rh5Yg*@$`kNKMj{80kEgJ5Hx#Gw5aJ@6`H z<$P|C2X78Yi{CaB4lT~W4;)2Bf~`?cgAidVz`KJ>Kw5}{R>>I}br7L!pZfvDiCl?C zKa?xZTKKw1SG-)`gFoQlsqu{QpJw>t$Apz9QKyk|L6iwB0#rU+bEAwzn2&)Livp>I?>X|@JSgO)xZEX%>jIi8Q)^TL z%Cr;7%UY@R#Q4FN*<7Xd2Q7ii8drJTCVu%~^n}0R$028&;y|!Ro2WD>3O&YGoEMzze{M(Ezxh zx7Z;QD2pMq6`n}Z+J@vi<;gcF6XWPX!+2Y80__SQjg1c_*(%51#-vQ>Dzqgl@_z)L z2o(smMcgMn4GbwPWDhp{3FJU_BxCdhYQX`3FOIllPS+OnO8StKA#ai{n!LF zJxSDnDXPhQMo2bkS0!Cj#N>(3WK}Y&)mf1GkCv+#g~?2GSTxlcax>`-x#4SupI(s= zL;-b2n^L&wjmm)ic??rfcSw&IMPv1Sni8Y3;Xi^OB;WdV@Pk9|zJsJWM?;#Il%a@# zgD{`&qCiXhAku*fOQd@h^3bGTZUUYql0^y>p#fwOcVRIP-czGCGOA4b%W_iG+j2uWea+2s>{ZF3A)4PZ|D{Z9j4`kG>1#UNw`Hi%>X2tk4-hrtFotO zo*K2Kv_xTcg-za8^XTmJc69W#$cK{PimIuIM?pt8@M}YtSm_2|(rx<0M16dsOdAWv z!=g^GNfT}EQMS^hk2BrQrzrkYG~O527AB*~XWY2%eOq(htU2jv3oSzAIvB%ra0SJA z1Cy697Co7k!~W#9(sR$`NNaa2TjReeIe*4KMl00tVWu={$yEzxKy!&y_k|U zd|kE|+2Hz#r_l&Xi0Xn=8wyc3-A3>^&Gi+XuSG!i=)sV+Fd{*7elrwYL(4qGIER-x z&*-Otb#sVMt0r~94~~r*$!Lc`4b%rEW-!I+4bV)z=MUtPo*{DiB2qAghujQSk~kh5}OgvIdP$0wb$t z2p3woI2AXmDv~Ly6UQa{y*vt^pCB$G-pvurOV^8viV6w}($mvduU_5s=|&9K3ql$s zHe=Yka}yKh#@kqB1<5W=Qwr~9z}r=*X8y0}`%G&dV}^ssIHv&3LCoW#Ayi7vpP(C& zgX0);ULk!#j30d2&1d|4fy590Tr@ENB@4|5&ygM9Hav+kt$|N8ouv76cbkyEP0;%- zrmSZnC%6PjG>vFUDe=Ub1NosTVF1Sh0ruDA6NhVCCyu=DO}a@PpAZB;NU}+^1fh+Q)J99P)sFv8sOFR?5OH(igj>#M3%E2# zP}{r-vy4FP_jGpxbH+0dtw1CN?4re+hO14$^8#Zv{F#F2KAOKR=p-NzlohB;T51t` zDK&5LSr4sS<6OkjG^QdM3RqD_343hXF$Y3kHaSV)W882>=qBxJStmJvt2z@jzEF|T z%t5^BkK+#=Y+lDeW|osir?`|)p5iAiAHd2At{ue>j(jkZ$qiGIk~eJLvS{)A!|BJz zOrA7%&Vmi=S3mLCtH-u)NnJGWUxP;&Aeo5TYyo`~uFMY(9y~aE_H59CS+izkW@gTu zITM!D)KrJVVFlvQO`5+!jIm?KqI+$quHU_F7t=yR-+DWwsZ7^4tzY-nYp?rVzJEOV zw5fnoX~CdBC3OxWzVXV-h&nZCs^rl|jT)osw9Vp&AAVR`T#|nD7%0VtHEVqy`b01C z1DYb(gSc)C*BSWostZGgrN*~eXiH$_6=*Y8lG_li6GEG)OZmMr?grpM+yC`_;(`8-DJs72X?Q~9Le@rY5vLf?Q;egFQ}H{butS2w)( z9@FGg$Id`&N|K|rtm-l15LEbxrmLx9->rK^^hl`?{*V`pQcoQ}5fS zm&fIvIek`Tc}+!0sjew0^X4Gh`@`R1iaCAaR87%Gj2KBpZWteY@V+bupMU;&M(dzgCbZwj4d(K&RtjFJm*}ik%15dv5>-%51xl8vK-k<;U;JLOt zA0ST9v7hbR_uAUu^RH1$M$g&)^ZTBEe)#JNMh#_l&!eJ0c2w>j4Jt zVsiysr~dIBd()=QoqB*nv}xb_mhTRDY4pm!JpTRe8%e!01`1$y69MSba9O3&;}izMDPPzaOaMvJ^oy@y3KIk#FP}qf(XQk zaJVI05eNvQYR0H_#iKSB^G_9Fc&mg|HfC+b$gR1c2z1#i@(hcSa2pprYFhe^SA7$1 z3MSd)WRL^m2U>ERJl+PzP%`~DOs?iJ_|pxF_t9Bx4x-VLC7gkv;(ktd-r7Xt3Zpph zW2_YXg-8s)97PHz(Hw}J5tlI7iz&H+AJDz2w2{Ns(}Cxv?my>ZZUemtG--JFfgf&* zPMGYx3{h4FQ#4AsK&tn%I0WTKP%cp#bM(+@D{!c^T=w&vfy zwNH98(^SQ8=qmqklq#FLWN4-;=_);cHK35Kcfd(&0wT3fge%M+X#C>~NVck~YR{fM zJ9q9pdh{p)!x69og#jW3M`VnibAkOCd=)AOEy>3a>RHZ#O0 zv#jv2;L^CRSXL(N!d+N|J%;NJBq5Al95Q%byM%dhHdbD~eeFtzqw1X@<4uVs|9H;{ z;h@K9hhLNSwD!G1us4I7L)BSzMn*IFHoZ)$>A*s|Du0`OO@>WmF7y6 z1LK+LX2H@?vr{PymmCDK!c$;=!Pd(U=n%yZXzu~q(%?^zy!q6d^Z)V6v|GFNe)xrP zzj@&0AOH5zAK(4_J4wrb@~3CxI`_1-?-767pEL8-#BcnOb}{PIXLEXKpFytWInfmhZ^;de=YYlzP6}@!q!WAA01UqxwBRmcGC6_1_%NwEyGH z+&`4P+7cH?Te z6Q>27A8@UFjm&4f{s0ombuHPrhy&*p`;WzDJAxmG8EIO4=lTlMR)?6+iehQ>D|LAg zU>YDo?hR&_*gt2Tdura<-PLSs343E{Wv`?|l`5kinJ=%Sml&^*nrISq6z!0)3(1~| zUy&xn!GIs|FBH&P1n`5333o81l=6tAc|?A=QdXNsG;1Lig`+>%Fi>~h6w$TOMsjv% ztVCm^S19I377?GeA?WOtd3h_(duRa&RGrFFcX^&#P`Iy-9j{~Qb?jIjJ8EaOLDEWG zp(2_v0=%oB^tdBU3&2tsX!v21915em;?2Nv7LxgM5C9!hB&kmVevdHdASnliR6V(? zmJ}a6G@6-yo*DQO;X(Syw2+*rGNGf$`6oq7{NQp1a7A2_A7S})`HA6+4C=@X1{nkK zmSExgnR0>Q(^a$@AuPwF>8Zb?7#h=RnOVnl4;;uvr$?(g+JY&E!viF8Xc{4gG%fnR9^G`JZvLk8|2<&%%H4T?>HEgO z7pA{Eebv&f=bm|c*}p$r^2vf%t*uyczs}R?iXm zMt&cuSCBqm<%G?;b-yA54b&p)}pqM1N;qQj~mWZy6HbKYz zj8)M5fr%QSi(dJfxP4NaTFB643H*q3KgGa6Q_`5*WIpOJ$OIU}U_XG~f)7S{bt6}z zAR@QMUp+zTp#LGK7WskZY8#SQheDuwJgW8csX(hKDLQcy-CaKAyHZjj@q>_0WD+^y z5`&Ce*Wo%D_h9K}-u->z%U^*X2t@4B?!q2Hgs;#vFNqZ#_!i(TgtvNXnsJDL>LSdo zxvyp6USZ(GvT-yyjiHr;?_a2%82V1qO*c<$dlM@yQ58QNArEMbQ56j#=UojNgGrA~ z3se5=9DiHontw7is2OPNL>UH%DGaTjf9;KSLKBHL zks2~ z^2ZQ710DN<)7<>Mhrapahrwg`ha!0ZT!@tMwKkvm`a~{sB$_lO&fO|i$M0#YM34i{ z55k7l-zom#^t}L%u&iDtwNXH_B*WCLQYfz1#Y~#GC?KwDW#dZVzUWxdP-*WPQ}e9o zql|A$gkXYA8E2En#f!NFIXS*^(SuBD2w#`flepGLT;eiN`S7?Dk78@ovCHE$$8BPt zX%tb&l|YLVd09!W4op89Vw`DN(Zs>j=)Of?08mNGmrb4axWtkC`Np=yxAE$B{LzY`X^C)#9zmXzw6g6tzd5ETeaQqnlhP&LiaRQahV{;tZ(l10laE32=3 zcQLdoKqw)x8AFH6Ytxq2CstHIl6im0E0JUf;Gz|=lOSu=DgTS1OT+4inducxO^7yG zL`XjGCcrJUKGAf>>%p=7`wQVHVn}2K4NDG1ZKdlIIWFf1oq9s$L-pR!^&wKm&}Uuy z(+8S6_NC_nod?9jowg~Ym4Kw}5V%WUq0Xa?Q1)bC7fPK}V;|b|FyhNy8Z8m`h=~pm zIkgP(){FAowNG5PzHPoY06E8X6T9^n`ME6oH8P+1`U5VrmRdrW1tn&v(!W&4*XavG zmR_Nqk!YJY#eVmxO8w zL9ZA-Pf1NZ3XPV-=_UpfxNGPk-Be&u6jTPLLc8|Cmwrn^3TZ}`HsJ3^ZJ`ZG@*JCUITysKAjz|9^%bZpz|wdc>D zKbKolcD4+vEG5eTu!IZvXzhDA0dA^Yp|0`wV{jJ$q$Y z*10@X4pYrx!{5cgQ4LD(y*GmS{F9SsLS_dK9t`0G1yLmVU(Y{>az(Wb8uSQ~M;p^#fJV)R0bl#>;5t)ccWaqun*e<-%_91Jys8nGWg?iS6=kmU=Hi0mA)Q z>*oh@%Ir({0jV*u|1sD=)U>>qFo+nT^P&TMz6Of+5);|5`LdAL*nH;e4_fSwSofNC7SY8Ul|Bt`^d;iug$BrEtK4zT1 z;^J$s4^CaYYVW4B8FLnodFS12+qOLQ{4knYr}oyu)GN6mlQfl0Oj>a}Q~v0t*#et3 zE-p9$hQ56auAnE|>L+z$?p#u?LS^#wuAIj!!HP-Em@XcoJ)I=abGqjy)0v3E(ZcUH zQW3f06xTPIu@+-vgy#BR)`}mE5yu7A#(tf9}kX5ff%jp1uFT(dCO4Y}>l=;lICf zDt%wthArh4HGg|-P+67J?FoV~V1!EdOBci?rBLwgVC`4r2C6ms2DcMAjA!Cek?Sjl zJUILtJ9qBXX*0^pN~TPi0%~&T;4w{==ggkDcu{I{@+7yLhK8{z zgzE+1;b>Ig2lRdC_(WD)&16Z8j!=i1E;Un?XcyoI^ZrLpw$-h8f<7Q;f*1rPgLpqW z5_Fx7O^=H@^}e+KL6{$eoJ{qiViI&`JX~XbfYF~cXV#{_^ZgG< z>vLrmrQU=-<6l6qyto>siG*vcjA;%dl9N`DpO(yLzy5#=oS6HDHYE#*uRL0IenW#U zaq{mFMzI9d*+vVz6JmC*%V}PKH1;K8YXO>`KGkCeUw-jzO=X_S;z3V6t?Hf^o_Xf6 z$DVUKgPWGGEGa1&J1)7p-hl)#P_|-T21*|PM5bY!{tf-4@n2KN@y(Hv+Tf@s+4PBt z%Gd<|gtqnj$1>e-(zb+xZBR3cr0|J=QsFVs@OUEp^*L&WMy1#OE6tGrLZErYHx6u? zCth(SXzsXR!?!}(7Tu80VwDihOQUG3i_Y%YwSCC&k+N)m^2sNu^q4kz$a_OxfAjUh z!@zj{_1tS1m+srQtxvDs+qUjziu%}N{ofrtc-+hd3m2~R_!YOic0m8WBPP!%D$MQu zzyrrmpPHOJ_Mt(KS2wtD1ze8uhQ35sH01-$ahv8!40#g`Ut<2nw)K_mkTJuNpn7kR z>`&4T4N>=ntbD?P34_QQ$qa-KqiY88q~$Q}3}Y^4$Qr$b5$?12FD+Q%!U7Lky~T@^ z`bvX7Xi36^9}*{;T)J|WuCzW8VyUaLs+3n$tz5Zs$)d$;*RE9*k}kv&!NQ=cP@z%w zP<})gtU4EEBG#{PyFtrBVF8`sws6sf4-}pE(bg>sU&;>6wBdv&E-W!zR}kwBGlvgb z*!G6h#6(t6dMItZ%T@E%>mQ=iq9;?0{D3S}-H>%7P@VGM@|aus{s%eFKK24rq?g_t zMK3pMUPzCS5FQ0gU7VH&>_5X`!{P^l>g2gg`Klr`aSBY<2uJ{1B|o69A7!R9|E#Im z4?i;hxA)KZeXm*n*L}wCV0y;P)iTq6-+k8q^_u=Wn4WY0x97Cq_nrL52Uh;(cU9ec zGH>A2sWXTF{_y@M9%Tw&zyfKxM0`Facn|B){EwNgn^gx!pB6bFE$E{GsN!j-`k`Y= zX)sNa&3ns;?1r;}WYDG3Ls|5w=&)7Vd=M@;#Ze&Q!eb&HH5G0F&?1Pk&_jA!?x&$$ zF}1!v< z{6P1%HC*lZ;tcD1NT$23;l9c5{JIgq7@GEf;=@f0hxrcbhDQ54nTkf!jIyDtnnIf; zzzg8d6byt%ks=Benuakxe^8HtqJHOqEgwzoYH>9GdTGUwvZ8 z-$r%DX|8zYZmT$L<#}JvIU8?!+jy#e!&t5;R#9h`No}p{#yHczH$4#x83&OZFlzguP!}uvkRa#P9IM{`q#&H{q=FC z%ADX{ogSEaQ&P;8s(%0jMR3_vcbx7{utv#ln;vL`L9^!mC6hOs%!lC6PjqcApJL4# zrwpGQ{08VCZbqcZTMjyRc5#k<%ANEE;~4rHlQhwmGt_qa1)DD^fmSJwZ(FwHVWu~T zc6V8ey_%p&7UCcKC5L#|L#*YbC7dBI)UeF}uky4FxPHSzhiO$oi0_z0<-^CSXxP+& z(Bz~5Ppx@~8wuY|L?0spYLQiK!a1Ela7qkR>utI&a5 z#E*s6%MXw<`RuIxk@I!gDBNr2_1U#4JdosI`_Ew`wwU2 zHkf+o#EJBSj}6-U!g7aGz?GO zHwIn*$Jid-^bv=qxI(lcsZE9TV}VDf=EP_nAa~(>qh@c-_)bz%qB-eic|szX0quj7 z6z5N})sFeE&5zjJW4`I!HjEiQo{HG$$wEX=MC;)HPP{n zerf($CT~KBR+uI-N1W-5WA3(Y$KOJ%c+TvZhD=WcE(gj4Fty;k*|Qu@cgR#z=cW{u zSL-HCW;9!3m+=Fqzu{N(%q2K6WH{j$kq7F#cuy+A0?j7)@$r%TAch#OCN32#$a-TJ z)3m#@`eGcpg?sS{fJ@V81jb|N=E#Nv1+t!a@$g{tkwLaIyoeS3H96Huj~--~O>?yK)qO7{k7TTXHcN(Z zBQjU>pFB^rnII_|nu*t$R4(s)tzqJ~JQHkEavNzvoS$fcO&w1w69Y-{z6tU2SX=e1 z-!7T>x}gL$J%~(S(u6pmmS}$7pl$CozN;NhEx%6%-d;6pND*>No;MZef0^EP-~=?0 zKrcPUGp|iU5qT1I6rKMozJ}Wk<#iUyWc1a6kI(1$B^tr)T+y1eC&CFm@T}^*6GQ~O z4dejz0;8j*yf)^FH)-xCUUJ-ND2rJL;ptV888c?oUy3>oXjzaBLk(Wsq=D zle|Roxr=2bh=nHf5;nph6bz|Q)j>r_WYIR4=hQ%N`Q{H5<{m?+uPL1 zzNcm9*L7!Gs2rWXSZKY`K+EH4Njxpx$M`kq>}Ur6!Prj5>>7V%5%Nv@0ho|-jlZH` z7^X}w`52^Mp*7$h(qv6hxp;$idYS!zWAQ!iq;Khyz6vT}OiB=YAJG>YlM}sT62S~S zqiyEIb`9gdRlEB`rnn7Voi{H<)oDc>wJ<(6E&vC=-^*#Z;;yMZc;XZ-QG=G^P4UwK ziSm?D>Kc_5eaolN*FYb=q^AtlTZPth2PkaQlR(d9d^Y+jroDqw`$wiv2c1I6pb%7) z3FVKzQbDBz+F|eodKk^4n=x?-IKn`q;zlko>3!Ay3(fuw&D9nZO>@VgQgAt{4*mus zoq{5`<5b_*{Bl3dQkQAkc4xAPfpwER053vhU@NZt{ zSD}Y!oJwCTpz-*l$lT{oqxd)zntNjLe&$H`-D%2*-<>cqD4*f?Wsf|_Jg=xxRX zBe|__tgU{+Z8aO-3i;ji9br>ZND^69MRj3eVL?%0!KF|XDd2Z|-1hp)$~9@5!68Va zTLt#1^b=?9_~j~9(`gD2I$dI+oPcu>ed5{6cb_EkL?2G%EGnKk6PPCsDqQt|F(iiS z6AkCBO8p&y`k%_~d(^;Vy7Go;jy6N%L;5%}+WSm>CFt%ax&I)!zArhy!CW`f>OY@N zLV`3y0Fy|??z4y*Q4?3Z?o5XGqFr$!}8og>r+ruiFrqG^oe4VAC;hYK|yoaxE{gjCDgBZT- zi1CA%X*8ef`~ep|{L>HFqfV=sIw|PrqIueAP)=Y5PFlJT#z3p{#AlAfV_BiJ7@u$8 zBVAfFCm(9(PPRUjpe7~C$?^1p;)J+RQbJ%NaRQC@OKu~!OqM3vvz)f(aj$t%sJQRte1%>%Bz|#dauqFn1 z>bQu)Sh?o@P_6IGJSd+y-60kw#1nZ!vB0?7P$>zGjw4y(X+x^;0|L$}M92gxXHPsW z2=yf3D9RJGfQdo|)o|J965e#g3WwCZC=+4^eCYs@172=qw@5=c08s~vPoSKMEBL5j`BRK|@fq$w{oRsp9?i|@ zG-^jB8M;KT9x${~UW4IGMsj~OfZMl9K-ggsM)*KxXvYI&z$8ChJ4D~erXMSW755V( z#t&lnvLnV1Vy4l2uKeH%pm8DZg!w~pTIg5Fw5@*Uvwl}+#oI=;$Lr97UJRY%X%k{k z90t44b6lUnse3NSu)IWVoNg1CQ7#9b-Gyx_qFa~s?4UB)Z%{RtYopf9Eibq-5 zE+&^VMM48mOqs7~5US;}2GN?p6%|@ApG6PVGxLPsF)Y~d8_oW$kh7iUv?;DQ)!Bwh z$!k$7Vgnv)-bJu0a&giO0jL8_7`SLBMCNPDTsJ88ueD&?1Bk zLhb1^7Nm#nYRFV*{~`!0z35+0A17s}40*bzVNlTiL)mqU>P|E~i7LGwX@dzIY2%p) zW{{wcPf*6iOGyd7a?Vq0j_^uzgVh zen877qX42HEIyx4SYn9b3kpBvAC28K&DPEj+H`v`j$XrSmHQKak&NI6oqAu(`2*_` zG_l1WV+)bgtw-AA3oi%-v>>gwr#0>L&I0T{#vF{*Fr%EAwPXy~9keaE0euNor$EEe zddNl%XFb=Ts~~xLf?(Yxe`tL@sX$PD{z#tRj&)Nw(8>wiFFmipk9G4<_i3?!t&qi1>*j>rSXo)m2RKjHjLT~fPSs;aHBay0)>f=%l&a0y|&;I zKN0wg3Qg0Z`2kJRTnZ~(3^9CBLBk0KevmhyckAK@lrR49Lkh8W-Fnc_wo^YGo2s;! zxrzqG+r9@ZiFXaSrt1%4h~e5J`uPGzRGe-S)3Uq?=r6-vCT|*`n0)3ba{6)jQ&b`` z#L%ih{GgTYpJ=r)@Pjs89;9(?$JpY7&&zb`eeKpC#1KQPK(qXSzq@LIpX+=ZF50^h zC-iEo)rEdpp2EcNMMmrA2Qp)cogavc`UY{#d=BPg&L8l3)~2q)F#^jqh8V6Zw7?I- z@{HC%Z*ve2fTOM{pbGp!S0n^FQg6>a~4Lr4J9OJB{_>66(94;}!s^KUuYCvH??3eCPZ)?|5qXS0O)O3U2G` z_*^{r=pK@4F$lid7TH5I?Jq23r*}Pgc=~S87i8<%XSZXW5W3Qz4R^(5RBV_Jgsb9Ud<;J!3~tL8jey2Q$^po3=MJRE!@pkr~0% zh0FYs$-FfaX3Sf#U;*;281#|}&mr1I(@r^t7(OS&_(9AxYg$}?z`Iwb*H4+YP?kc9 zr*iH3Rrz_v0k?fm`WbY8w7-HZ$3qjS? zfY0GMuw(0-MQe}lIe78(k$H0$u3Wh~J1Zk){!-mEc5L4oki2tKW*3)KDk_aNW8~m^ z2S(Als%2M)=I?NvKIeRT?2d_B?MwDoPg=Tv{DSjRh%MV&7Svhl#+*ZC0X@X(oowfs z+JhA=vs|CO`)qnKtEy*%rym)+DgRsn+j_EOPj2W$2^+m4BYACZi8F8o`DmUWz$3)> zjnQ0hzWPdP>a3^#@%-$$3+K$8Ic@yN5#uJjH*DykBWr4^lE#m9HhA|R+I{k5cE<6&6Q;~4EiLtWToWfvlVp|W zBE}D5xORx~gP3X7v^;-68x^S-r7OI{#$;rw%pB2*7vl-`{9+~M%enAnUhfJlk zq(G7VcDr9yq|&k~Xb7YVHGyGcMM?3wQzt8G+|F9Np$77Di;w|blgcXV5D49P#)WfP znHMfx%%PloUK7zVe1_nP78MzU!sfjJ*$oDv@Qcqg^2q}bQ$OF>0b+n)rz==dg%&Uv z{}woHlnnzvg{Nci-7{b}X#%1}?b{+hu%ejEkjiT+-g@Pg=bn9G^{SLsCbamONgtZx6KY5*9E|_-H%qyLg&4Js;o2j{4`QZS(-J>GZ!D$=XdyRk z>&xgtD#m!|_4q!1=m#;B7uBcg5=088hDJN^pg$L#EY&Lki5c`D7S@m{s}lXHEFcB> z69WnWNCrAp>OIk!;}jP}&l%!-?BjYoDv=Ug7^euMsazNE@2y$6>cL`eH2jMNG#1Y&BaxNZi8DV+k*jMGizj#)J(r3uh~5Q2}Cz;d2LXL@|C4GfmBv z*C)2nVZjkSq}BIXVMHYE5{^wv4Pe(*jXG_d^DY}bsu*&`5JPJ~6Mmp+L_h>chhGZI zgTr!);VMBeGXcvfhR+!6y*B@MhFbS~gs*wSNs}B|tkAjiV z35!8bC}^J7FEL5eB@L2CqbqoZlZYXPYl~=p;BvWSSr(sY0^k+H=L3{Bm{|mtYYd+; zQ0g@Q$|nqB{2*qUnwIAeEJ6VANm?EKrrYHguP&%cz~OXz{0b-lPU$^wEhy<20_eVg zKNvKP5dT6k4oIe;U`pGBl!Qe2_%WJy_`;C`&WB>SUV&b+ndb|!I=vR~`~8+JhR+kR z`Gc5g)_ep%usTUS#MIQ(`Lkxut*@>+xc^X2R_?Lm=@+vyckkIJ$@G%9>Z#p-_WbEn zCq}+EyvDC9s&44;&}flXQU26+i3{QqmGqM#6_Uum(1?q0hzkJXv?Yix`*M6_#ArkZ zjp_ekTpPsrLCiF3uC)HZ>LEc6 z=vZCfKr0YUrLw#tD=W(%a24d`msFHPxHR2VwSdd*bvhbybFzGzA?pT&41sCgSy9Q9 z8{5va*`%Y#nW{4um^^v%x{bS->3em^XmrH6x!IW)3l!Cxlb2mvTkUn#9zK3HDEs#8 z*lH@l18PBT{{<(}y-PG2sS}jXHm&>InO8W7`*?FZbU|+Uo#nBU| z{jvs;~inhu`6})ieSKpi0SF)-S)Z< zMooa)fby6>cY#l$8(EvSQB?wS=B5OLeo0o-(l$wooRyhTQSE^4QB0Z}iQ)4C6*fIO z)zpfLf(sXOa0-54x@vdq+L|;qC8Q`@*KA=@U258Pug9@#_kPep+I~X_wv`AW#t&K# zV*KFRfEq;X{e_sh%(OIrK;K3Vffh&=r3JH6mK@%@-&0>Yck#--d-pC|vfR~RpSOCQ z*XPK}$*!!lAKJTp(X!=r6%{AWoy$C(S5fN>fgMmUOOFy*ap9C3+s=;{>kqV$E}_DM zszD#trB~F<5Do2Uy#kIwT}3x8tBOgdD%gpxFhvUnRV`%d2#L6=Du+}`9tqHvb|y1r z*)TBBhZnur2Jr@!34zK;L0yMGyWWdmbK0q8@(-hh`j}k_% zh-AoMk{?tlwLkzgW-@q^Zb7(ci+i1CA%Y1Xv(e1R&3UNvBv zG;?n1o=v+ljvijJc4JOy$&vkgjvYF@W%t37tnBKl281Xs%AGwcb<3_DB~@kas=Atn zdYLvcFfd%BJroM_C*Rn1L44c5(ZjT-g26Y8C z<8Qs|^ai@v;W0$LKK#gmCF|I6ZKl92 zxHO&ebhz3VnKVH)NHftDC^0w@m!bef9b)*rfU@T0PCFCp^z1-5^2!kP1%^j;EvgFs zqM}iCLNIt3{Kxn~>p_ekTpP4%e!$g1j2~PRbLI7kLJevPM&lT((~|`_VoXM3YW|=B zBX4xg7(>(ZcZe15h``8gQNP153y7MkjzyoQ!a3bf+I47@o8ZB$}cb z($K#u0kgty7PwhikoiMQ(L*xL=TX>Cs|Bw%t~ozwEJj`?;xz2?iGWcNV$!2Wa5adN zZYt;=gftL6us+{XC9H8CyEAB0;4e)tsbk|m3(YwBdhUr|z+n^&Ayc=7m&Q(5_? zMo85(W&N6^$IfPK+qNSkBjapV0quS(Ivt2wMefC3KdO45Gs`_qPwV+3d`dVBq8GeJ z2E@bzPNM=4H4&+Sdr(Xcc)$^eJoOi$$tj$gK$BAdfr-Y1Bf?^NgdyA!F>-|C<>>&; zIsy@Q5my|eEztoqjn*y*7n~w*!V&?zaHItrQR#e1AgT$sjN2DCj?xfiB~Eb^JH9z`^KZ)n7ZiB%aIFNbfgf=2UeKgPOT6>3MDEHE0tQe5R1xR|X-{}l z)>YL#X5`>U{{9l*WS+d}r}dy!^8;R1F@A7O%t!MBYAWcA^rcIeLW%-`x;3lT*H(Kn zvQHjPKQ=#gjbEa<1i!oH(5Z}+l-aelwW~JoQFZJ4%cRe%vU7U=p!&fsEb}bd8PgSL zIw^>*z>juK~bK@p%H5FqjnA-rhc1(jAaATA&h5tayqi%1GU zcws?8io$0;co-aoJ1inW9C?2DL&84?}aZc0OE>E!-Avm5=U8< zkrP-D3uWT-`Gh-SL1T%1<;10tB@qjjFB?z@q8vntiSmh*2HfeZ-@GJo8mVOwMj$$T zG!VG;^8=9^>bP|!=&gJ8rDq=Oe(&Q?JT>C|QE$BVdapjc?|ZQK+6~*dzUK|ZYQ!YU zb-{U~({7n_w8!+FKbpAn-g0%`w5>l(-rsKQj)6W_&l|W1dhKz|`9ZieG_V6h_Wt#; zhX?iV^YEa79|r?C`t|Dvd*4CNm6R1OU7r?GYx?!-K5ONMaid2(^4x1mQ_b5t5aS0i z)2z7yKLF@a0x3vCm1%{6X=u!ZoxfbbOhxrWl2o_=T98(T84Ltj*A%oeMWt5~sGqIK zyV&a|72Utfa?T;ekmi~)mk6}LsGxer{gDj_q3)ELv`_saUvl*^YH9 z_U%0->CDiayS8m#y=Glr-kEVQO`ZiyfKsG@r}mVFAHaYzr8msZT1m$G=l+^swIn?e7SNt2f?T6pZ}$xZ7v9^A8I z#P~_L+?=^7bLPycu5VbgYW1pBYvwIoUR73n=In)cKNtm`f?j^@x(#bqFCYH?2-VlH zWy_wR?3*!t&c?MX(@&l|vU}h1Ws63AIKl6)A3pS*wd>bBy#-rbUDJh$(>RU0yEGmk zxVr^+f=h6BcXxujy99TK-~%Y4b{eZc8pgG^J|6vOlkp^)Q5 z!QiMSvvz~ib7f=Ygo0Jpa;?rwynj!KTN(XHhx+7lox%OQ&7kFJRcr`v0_ zQ@FofDW_SdVJc+X-Y+)^F)C4_nr>3iGDRAJ05R4UX+ESjtSWF62%r0MNa(64)ZN7R z3T=&Et^YeE-&C~Hf4BS*9`$Is%sxK%@$q7_)36t^+tBy?yivzJ!8BxZ;EzK5h%Aym z5_h(T?cuWu*F?LpGzCK8IDa`~?l(qZn+&0R@DatRe*2p*2xj)w>R`#hmT3f|Sfiw$ zm+s+cmwqP=foOOBL?!`wpBE&nhL5jXpMD=}C^D3rr=KfL1h@m>8oDjt=ejZKI@rco zCsSw}N}dCb>1fmWuK1u_$de71v;9}0`DoamQNJ7 zq3j3dMNu{&+3k4R-1X6i;zr(H7*LsM!#vT)1psIi$3RgOdNfcJd4}J>bC?vII>&~5 zR0**^R1-1jgwN<6gA1*V2pIDcRmE>!J z#f6Pj+(LEL)x}h&i+w%axt`x6HYmrxcI%1H?9SeBVh;If+=QbEu29+@Lb}v6O9p1( zfCBv2pkTsksV72vsn!W*D-X~_KW^gp;MJ14UZWV4T-V09U+%o;#SDkxLs-;Ng=|x| zwWI$VP+Eh{h>LSV>^P2Y5f{yjImJ3>w^K;=t@p_B5zmXOtF|El3h^iE9!Fq`i_%mcwX#lpOMY%@mrJ{V3fe8aE1?JB;c%nTJDn-_SUFc!&7^Q!B z(2cxZX~C?TEtPyk+4y%WtewgC8lyKo9;aI2>m$3iXoq}palj3>OkXe#U9x#WP?2LL z04gE0Q`Pb`Z9J|pAjg7Uk8C|26^P_6zAAajq*XL6zRp5bty`33+a;$43#6%%9FVUC zY8*L)NcN6U@f~uDQ6-A zzgK+AX2{{XC6E!=B4I+L0g>N}@Rw3^FK>PKxGPKF67y|mZlSMRx%Z*RRE9eVz&q#+FEIq{kw}Z1x8llJlbs~EuCdLzirWwKm zJi&CU!q);k{*_NgfgK9M7ok9Ec7{R;0qK6+{3N5$S!z%pm?);ZiP$Fy0?jb$Xw?a{ zRV!U{6`}NBMblXWxA(;f1lHgGA&C-*9-}#JO!poy9@5X(nQ~uc}$Au zkds0{m7xw_I&&Qk(u4z$`n6x~F8|uAuR%tV@LGPg zg(TVJZicmtvdd^rq|3~*6CT)8n6!8}y3H6Q43WkBu0yUf_!c-K+PG&!H+}Nw{UZGH zAwD+iS4oY2i`nhS)RYP1N9zxY$F$))VWYNAl|GwRDqT6BE0? z4|W*!xqqpG$RY6Mj{Ie)qAj7Q7@s%$8oOFX79rk<-x~!h`*w4IH;#zZ6=FXm5#twP za(Dd=ofr6JXLL{*aZV-EGH8tY2?QBofqD#03}qfbB+P#SPfO zm}Z`j3yF!t$ibT3!$J=X<#puhdt7`LMnyoHR-V}{j^(+V6Z zvA`+3qqhRLX*{QhI%h1Rm+ZoDbfhdrQt-Ag;(L# zP3Om6RYLW7x_>Mihx6Ts$uHI=t$lwJiJ*6VM!SD|r}X!4*i>TVvP6^w7(|oJ<5U1* zA}p1MT&DCt>w1NJ3}>XQyVr-s^Ot0SI$T2AKfx~=8)Lyt(uAIGa}e|M^V`*x7pc+d zmw)~Dc0-#g z%|3Z)@{_7G3bnPh`}z&2UgT*!SLuJPvLN-;cd{`1;%MNd?l!2YsU1Y@K{DSoG;q!` zOLx?coI-{w>dE-mti*iJhsKlBKn4dWvSE_;F*`lmj02RuiETVk6plph7wgBj&qk0( zf92O5r`GQAh_>hJ#Y`X_aOWVi2jY;$Z%BP9uQ190Be#+bPtir>`bf0~O*>7@*842~0%DL_YH{b!r_osDWA+cF8I+B`cY&K^eyE#l43ZYD=>&<_aX8>4f zBf~&RNKo%8s%)a8W1+S#oKxbl#FXZccIn^?<^O^H-ihb!q+tIPN3?Pi-z((%`TpqM zdug!E^2qOS+5MOt`>%&?{r2$nvi&gk^`e__Nf4UU&wC}@jysjA0hY?A=HjBrVd@$3 zNNra8VONOc^4jQev)lXOWUkZyQqb26obvFrJmiAljCnK0fm|P~1*KTI7X>RtJ3R57bQOe>7|2gq+4&N{I>tgMf?<1S` zyt)H9(DyTP^WYCUx%EAoT#j;me9I;Ee2t?Vq5 z7x(O9I&BWuDORdz7c1Q^$2ZzYX%;yG51V|KpRa%1&r;2F-AE<f6>>Sz5^8FFMajBPXY6H)lE%w*kKnITL1fyQ!4>v*%FRR$oj)Wb>JWw&@1(=Ye6p z@%zId{QE`alvSr@&02Zo^#17=Qo;IH@GHsC^Ir~JE85%fY_7n=S|r}fmDaWn=W8^DU+CG8~mI?qVCMf|WC{?E1U^}JOo3<`zi@!-zf)7+NbV+&Nq5( zZqBGPN#yn0*|-ly9kpEzG-wt-Gu8h(a18yFHD;A8XvG@PN6+~ zoU=821WdxOMY>sDPAgUa;NC8(tC{{>Ddli+v(O6B(F6Xu@bL?}E4l@qsS1$9Tf;OpI-T8v zid9uNlvOn1rn|v1kb@Bo1*1zmNzb4c&00l++QJpwqXW?)E%1XZloO9cA`7ap_e-ev zUBfW$WUR*)Z=IS5_3S#k4d&G9h&WMTAG+3!6;g@a>Na+E<1wZZN)HbA)ztscMX4nu zpF4E)r*|0$CAqdkCsDvtE2*0ibF_Tzlv3|@Yn|M8#5vHbE`RLE5mZol7fi>x3!uZo z#odjv^A|>d*-%spo~&SRsjY?lQB_=AUR{h)BgST?daJ3?!L_QXX+JvFmY<(rT8g?X z^2Pc@fKEQ8kU+Wd=H^|*&nL%UL33KuNm4-Mvk#K|%VW0z*obOxl%8)X8P{8ekV!COHX zn8H=9dTj`l)l%a!)xA(4m0EtgDk*SdvWxbA^$5tn$Eaou8*?wpUv=#wwJJ?fE|=Z^ zx>1-cU)IjTS7EJIph}}U_lw`+$vt6#)N-xCVP)NFyYp+%qJ&vVXor$c5KTHKDy$(Pg9bW)$|S;PZ0kVpo;1NJZ^evvAOz{=D#DJB*Mlk{Tr3i%DEsDtHXxx1^m$w{OF;hiFsjC&~Fi9MVc%6Z{MURW6LBb zQ;eQ?@9}m!T&&57663H$^tjJN6X}R$abV?e`Z6)fwoU)>79^w<2{+^Ra+;0EQohkJ zAg|!|()A*~>pq4?0Xjqa2X74%&src55>x37)Wk6zpjB35_F@kW*VE15#Z5a59ZBNA zu;oAa8u*%EQow3Hf||8RX>L}QzPg2!F2xrk>k^4}Fho#UX)~wEj>GhuQA#N_+5HP6 zBP~ah7KiU$*X0WasWs<+b6@bhs!K3Y9EK~nC&{loC!;%TOklU!^ROM8Kjn%pg&{&GfX>zn@%b&`wx+NspAU&Dwwr1CSN5)2PP;%M5uI} zshD4|{%~QY2PXypb0p^UG9LM4p=|3on?lp}IifYU$A4SM*Qh$odvBIo$u#|ndT2T8 z%>i5f%}ChrDtI!Q_KW`&HCOs|@Yn}D%xOC3*D0Xza`e8w5fT}Eqp0&uA@yvbyDIsw zzTl{FYb`9~he{-+hYuOW$IFK7e@CAEtWTBPW7`(X-yJNb>(4w+?7!hf72-XA~f2~@=HxrJ< zTzW2`R$Bl2F^QUf@^dBU%MBI0ainP?N^V>mxUMDNn2L~q+194%11auU6{Iz?Yx)Clk*O47bB3In}gnT!IotKCaPM?Mrl=*2F8Wh$>?rr=W} z%Ka<~b5oQXEuKQ5eE94rE~N$uLg|CT{Vw7s9x#Iq)|*%V*ZCw3CY}9&2Zxg%A2Yd=Hbu$tXZDweL~_En;6gA_U}XNe$;W0kGZKpIJ3I>XX@>pmkY(_kx)5DVYGfxFeF1fsPZtq#!IPD!My*uEyGODt^ghwWdtJ_!eix5ee< z+h`pQ~PWVf_owXyS9o(?$4hHd{H31sJUNwg5>h}TyY)ODdzE+{HiMC+5O~~ ze&_(5ETw!3BXo!B-C;q)?YrY9tXxKDl}SA(GUK%A03@YWU`-S$S+AS-`%q+Za#E6v zapc9Us)O)4@CFX4oc97)w%g-@MB&t@N){ANqpYSS6YcLvc}Htu@H<#v-3*Al1FN53 z^@~6c+b`gCK!8NRi<21)rybOY{Cr^Aktk8dpKnxOtE55)aB_0?L5HH#!_WQj+!$0S z3mqx_ar8|^g!w7JT=tM16rh97o4@)E5${7PIlQ2zYJlDc#-kP)*(Bj-GOZF~y0oI8 zrUN!n7MLq6J&1Y>_##c9NKrrBp)d?>?lp=1yfwrGW@MaZtk1q=TmT46!crI@8?URHEq{wJ=c%n z-MW)Gug_MSXqAfprI`urRZlb0F{S$4|9vFRO5t~1EgYsCjafFG+0+l$tk!C9nCqG= zq9qmb0*fcbKP@-Ah1J<-#g3S1OgfpIRyWhN=at4}H}GW(~E=!qhB8 zr|ARS)VvuUbq$S1yQwc@5aPIR%2b4qM7j&Nu(6?*n(-2o8aM~0(-~g`JlC3EqJkDv z3G;V;*{-cC>nD0%EH=YN#}lppyX}}eDpkmAGalcalfm?5k9BspH}rncqd_zU52>7# zgFNDi)6X0im9iVPuDu^f_^}Wf%9_|)e<)1yq!%&haWoV7So_U-;LgtP;1{7->8h;? z`p@a4clzx#rd~7-m>f3olW0nK&ecDTbXv>q$`W$xaoU2xO;MMl$7fyeL>t<~v=SJ`^#hb|PZRfW13@e8_ zlhx9GMW`6O$582Pr8ny0g`h?uImgP*j zthPN;HzmIfE4}np4?+B{yLX{T_*SRCL?D)GSC4GV3AkNB=OUBO>lV>+&w*Ma#IgTF z#nP5YXX|5Jc>lJ0jyJ{<=D3ZnnuIqYMS){{mrHHCG90Z>FE(s6>berLbPY9|Twi}R z(V||0E#fx^sJ+2OZ)L@Pu;VVGxCEoKlh<4MZeZ=5uZ0BS__VdRz#ZcogY|h>EkWbf zF;ZbxZ6y;61N{TMZwJjYRVu!hx~s3Eii-68@=CYSZF_sWdg?tHP3j-@VY5H%uJ)CC zw+GmJMUOumJYChRY8rwkOwDlBxOwJ;WE+<+5Voz`5VmFhSmC{L)Syl{z`J=Wo6VuBsm=AAn z>jdez{Mf;w5?r^pw*q!rzCLs^zSRpm5~4oY8_m`_XhMAwj#df}`}=#|zU<<^YJYX) z*Z*D&YHoQ@?o(HCIv1#6nNsZ>4SJ*gaS^KSCs8;j6FWSWz%}fA5we ztf8UkOKkd0B9L?OkLL2?pES+F7;Br#3E3*En>T`W%jhSx12lrsF13GeY*P(IwAia? z-9nB|PLA5ls_&QadCCTAUwqe!kDGAX&bXc>Qtx8r^KOTZZ|_rE=x%qTFv=DL{V$-9 z;hYd}Sj^3pGFfYCJI?w7|Ixi~@VTE0dMLa7$(v#TcnPfX;)2JUKiMrr{Ju{=Oj$LV zgOshPf2pZwsH$6}`(A((0zd{W{hGRhzAtz5suo`SxrK#=KNl>1Z2W?5^tv0ef)UJ1 zZ1GfGi)yY3g)I^BC%Z*%%V~6etqr|BkeAVhdI9T6)5!n2F|}ZT2@`w|Jg1e}D(@N1 zo^N(I$CuJOtKu^F9j?`M>OEAd;^R`w=rozf?m5>f>B2h-xjeNk$mM;Z_N~rh2(wY= z{n_2ACbSZ}pMy(kusvQRV91_?^qCZzdm_;eLDjItdkG-G1ip)^HOBTIAx*wvxq0y| zd<_j0djb`q%P>Q2+KEe(%vtkLm{WyH2b9j4JSp|d@qDYiJCe>uboc8TGJc2JNg$2X z;PNNCsJf0LxZK6SC2HeGvWmw77;(XT-B(P@nbjf~SiV8@ZiNG1Q++_*?xfJ(yXb)s zxngJ_dsrod5`(D2)c2M_?2|l3|g6^@W>r7AhpolG49Y z_G32iQVxrq{H!2qJ=y+4;NKtG-;L4o|F%;8aZQtZbxYeoR*#I#v<0=EVTG-!(^VhO zHGA;LWzgd&#Y)BV3|uW!i$j_2jDS(46Uy!3CWr*xC#eu{hK#t&>4}RhXcyknC3?p? z$oeN@8ZPKkt44M&r_%xJQ$ydOwY;eQI$~gC&eGoZ4Wd=vI(U+G!%r*2N;Q1shlE*z zuBR2)Y0=(q0!>5Y8V;(g{6X|!-nf0_Y38|~ntRw5#;$$OJXF~cNqE@yS$qO9>>(1@ zZBmY?hM)n|?>h*qsPWQ5RDni~^dj?C&R~d&fv{@X&!Pm`$5K;SjIHW2&>!rRmQRBX zrXZYuw%@!AeWDjuVM7d}r_G41n?&rG6sd#loq1~~UWV`l*(lxuF5{^pWI1c;|G(z2 zj*h=W3;L;riRJ$P&yQLDc?)PA0+VDk2R?q#h=y0tFM`REq{9 z)mUhigFxZFukkz1klne{%ZfoLqq!_Y@~Y5&5aT?KH+PA&q^r+QWZgZR$8Me*oC#6n zVJuWb{DC|{=m9tZL;ydsJ~0)Dm7)!kwiC;5H*7xB;7pW`Xoh9yHtg^`*y{Lr(6+T0}h4IzYh z?w<1Bl?3{+B&wA{+Q17^>5!#X9eSX<)F90KPOP{A?l8QbJ~HeWO5BH)m;Xk1h0h}Y zUSqQxhQZ5JBzMS5oab(QW03xp+mcdNKB#<4V5GT9B*Gty_P^mqMf<=9{G!wVMY(7O z*U{T4Vsqi}Hlg=5D+S;)GL7kbSrK-?SxN%LIsCxCB#upUY+m)OES(KRH* ziG`Rw{s4t6W4A1J|8MM|v-z1Hxf05JRj9;u9f<3tc@ac;FYGIICYimt~c#PWd z5-VO3&q4Irt$d^NgHW-OPtNAF1ruruhre~Z$Xw4d5I{0)qDzmS<5{ht^?Hut@LZNT@uQ>cz*qRNl2!0^wq3bXTZ3lt>cFRMY`|!r^f%xnwFLCST zDkjt5P|}yXW9LH-_L;ot4hQqGPBG_Oc0;e1;q)-YR8e`ZuFR(GRsSCHB1195?;cye z_8}XjoLDapU8a^D6`@b?WQix0T#N#Cw2BVHFJH^5pUgr9hmZ>kZZ2s>6xBJ3Z4krW z0V6GZ^CdMhC@zDgrG)Gl7;Xw>Grt(_=yhqv1!1$PO+y?AC|-6eLA)+!*@YD?u5k&a z7#smY7r(c?OK(`@W@*cx{|c}*lK_V0ZAz78)VS3II%-7~vfhgFjc4p%#On&?iy+qe z2?;RSw&k|4>|@4S;nL08d-_FcrwSzeAQ0G42Gv9%Uxf_c9&bOruD4hOJ}=V^eeOeP z;qEWF&ENF&kw6Bl+;szr1GZzH+GSv{WLX_W^H0zwFH+h>Wr!X*8o`3uZmT?k$N^Du zX_+z&`Ld*u=nd8;$AV^vD}Ity`H+>XzSv*m%35XKj72JXtP3qo^4B}KMjE9I_Ki~) zESyv}4puXB#CZ{qbrwWa32{Rqwun<30)l+SJgP5yF$-l~J$(&D@X?c14)M*rU!4lA z7B|&XD8){TVqmMlvOT@)0ai|9mOD=zad8h>0fmD0h-kL)=(dKzsU}o(zSNd4QB^E` zEZILD%V?9x1FdKnJ|DRI#1i?eQOW>ROapR6S&-=i0HKKUIwFp=_P1xKKX8#q zSS>8Po^W?`pN$-qIPfmgnFhS>$YO_-yR?v|>onE`~dH6q7Wc^%j@99ln z_!FXw{5@v+ar~DL7%7R5gYHo*1r1l*)%j2n1cX(on4C7#cbZ}Sn-@mPceqXmb^)Qs zq58z4I8weAqq&=j#&xS?3tqj~u zYo}e67cz>uVma(sh+Nz+@jIDN>PGmMAfke2YI=zMB@R38-Klr!X z{js=K^MSo~JuA%T01C58=k+!#hkk5RbGTr3cAuN8iyB>SQr@4F@>VB%XcoWq&KF81 z<}o%db69Qc><&Dye!TERs@?CN4(7Yy{x&Qfcm0=qn0jzHW7vR*WxUvSttfRKm-Ct; z{603v5l8%2QyJ`*EN#g{7k5`QdV|=g$&$&<;%fC0X>xJXg|Kk&mvJ&Kmp}Tgi~UYa zW=XS7X9vkzM1ft@T18Pr+6pg`Qy-z@fW;6Fhx$114-&3OU0EIv$rX>3Qsy-0R=J}p zF?FbgVvdF{%BPnNXA8I3-096@sYQnD)l~l_y|vN#35qMq@XW_4^QxLAlkVzvJ-1rA z-QS+huC8qQY5XQ!8NtW4NL3ZG1zM#fsK%}E9{#Wy7*U=`q$+DyS6eZ$jRG<7Rur%Q z2L%!Npi~^uTDx=S%ptGe+X}cYqE#%es`R$kj42VRr@^gRC@ z|K4lMzRO&8tDE1eS~s`n?w-uT!Eq9c=lW6PxatOECbLnc|Kf^i46Z)v&E$rU=ked!%Z82iRZpdzF=fp3 zKFg2^J0rc{2}!|MHS~NYM))TtR)8iWu_l9D1Cgl6Dj?vyT&qtKf4bfd&Mvb}rh*MF zSYKb?=yabkY;G$o+@0;&h}N)Q47xxe{8AXr=X2C|ykJqI#xn>AMRv&qdlR;telx7ug%m^DK?EI16pESj&lvF*!~}t(!4; zUw5AI?zXnIz0Pbo#ZJ!Qcf_etmf+%#!pARFIPg#zbd zY&Mv{?>&Icwf?qVrcfcoKr)-X{!)-jtF5f2``cu(Jdv8kIn`vhp&_AyN-F5_boE`l z6~j8{|2UYYQ?w^1jVnl$LDUH1AL0b8Zo6{t5%jZ1h{QY<_6Z2m=~m1LtUHR>6QtYU zzDXk;YdOayC~Xug{wY4hr4hRvlvp~62Wmoc%pGY%+9T`&gCi7@6u!6|k(U&=L0uoo zB|$uAaC$~V=9y1)j1=i^s47d?%+p;~24#nHK4WDrRy1{lRjINv&nFJgehpw424bV+ zo3lBL0yWfHOC2GFTdtoS0JtX!*13g|j~Mi@B&kElQjIN~H4|bKEtAiXriq+H)Cw>d z{pfg8kTP?cPYImqCXg66=mLj9EKbqV9ppAfxqF2wNWys8%0&UPB?qvCfn}7SG1c8? za^A2V(V4nH$U^*Yk#&8j3e(PoSwk=$Jx7ccVf44pN$9l7ac(oL5Ls}9j zNO4p=J4#y!Qj55mFu0zG0dQjKSf~(vAf|M({}DQvtA^TV@mTL41K9nrQNg+tWeP6L zij)S4A3@QL_ghcxhYqZb{eF?&MTS&~mH;U~a>mO-!xqJHMg3X_s7wW_uv4T&1{%SM zs*eRV#!Dx$^xNS2hjxovz3t5~`Pz8u#>j~S1jCAo_6ZfyAuWBxM8?zSgkw!1@d0z}j3I|6cqALL;k6QO$R8{+ z2{$nuCrgPis}jpnHg&VI4xsrRHls3;c!(KcuuM-}Ly%LU6xVn9TUIF^jVL}vx-DJA zEU18ek$cqVU$Z&!6_Humt?F~Xzxw`@Uu+=s<5*gS$GcvS9)}jQ5OXw8myY!^x5h|% zA~W+}!Bb0{0*{k2gr97UlwM}A;?9(}Q9MDkh;Q)`=-Psc*SD26HE#hQ;Q8KK20)1CW{>hODKVZC&$@xq5C45| zt%H6G0|fgSsN6YIac*EG-{?bcmb1zrp;r)DH-h4#^d?F{s+jvH_^PzV~egsF^Meh zXd%KRc_DsieCFkb_k>xx<4Vz3V7H*MavZLy|LodL40;B)FVfBFxz6>o=E@T8INL} z3fn`_>KSl?6&H}!6oSLHZNWpa+Nbv9xD zm6V(|wS8!0LvS@qzuY!wIlau|Rd;Gno6~e%N_VkTLXaYb!llK@FxZXb!yJB$<3_X% zLMeZM4Kcj(rOd=nvcCVlC*Nr>ULRhZK)I{`$I)ZiRy zO0(}G9*$)^*q~j2cv2JuXn>I*%@A*{0&-v)`il<4g=Zw6S&pHK7K}%^99dx>qZ3x# zTu;4t7f7m^PoFY7g$KJwVOKI7vhchxP8xhHqz@l4mJ0cSAt??|ago@^Bk8?E=M-0Tv-{Ub2kc-K2g$ z$%JuNxMfn*?>4#Zkho3bIn}G{d6P77T)l3x2xj0a28S0;OiX}dmDb<7PEJmOf`Y)e zcv4alI9hgP2Z?VzIy(A$c+rL(3lkF)Gjk}P-ZrXX+u{CxYHDhKcX@evX(?Rf-rioH zfr<*G6czS$D4!3DURyw$g9yYEBHug~ZYbr87tbzM0AE1cl_)D!sA@5^sf9%}go8MQ z7P{sh&V@tBFYul_h=Flxni0eVDyL&%t`io9vLoV^LX^hTh7zAx)oyD@x>-AEOuA_t zn137S0#od7ztx_DdqL`bJ{5Eh%~W=VIRSKiV9XrY!Z9Md}Gwf8o|@S-hP_e z5>ao)S2jo6(nkjVG{fL`f55x#rZp0d$x?xw%G8kxB3%FFAkD?6$;4bsyM^|aKW4hIU^(?_+nkb9Hf z)(evg=XKT0G=$uJ6A}% zcEt48Oj2<#H%17on);)_{LY)cx%aky{a3Vf^>jtUU#PYc9EBOZU|XNx#X7Ib+||H2C63Qd5ClFxegu;H6Gd@7B`|LWejGUGh^4~L z!2yKr0U-AU5u(8bx1EB6U?u0V(j~EAgef2@F%SlD$rAwqtQ5eIAt0o(Wg(tYHV>rK z5XSL;2V!U#$Q7r$0+d_lGL~qBVUrYp8UP{`f|MPvhV}b!fk5G>foK>eqRD+x+i!$J z`wmpRb(NytB3Q+Je@VG4^oYrK0MTR6LH($P5r|9?(a771j);7qzzYde1f1*vRQKWl z{%xJnc+ye&LQ0{4G3Z?iya^gU+&^iCDS4@mAI7m;caYNSMl2w=gY2F5sYrZ zNyCYKBm^sQw^-l~e8YVt8>TH78uVJoyoFZhz*_r_-CaZli)UM4Ir~xDJkETd6Qo>3 z2y0nHg$c>I69ltEc$^X%T@P4d@&V7Wl^N3GR)&BGl?>-uj04+rAo4hAk(C|P&Wsau zV5sI0#Q<42|MQ3^Dp6>(H2wt;;Jz85Alb=&`ZP=*M?jjqD&sldVB&v($ z%U6Z_B0s`JJZH5de$i{p(jKY#QXrq8;;39=r5|dG1hOBPoDJTuQhrIxVFJu5LhLkD z0}%KinXH^Yy#w~oUfLT5UL`B^&y5aBEx^^@e}`E z0ny_C5Pd2`7#F*0L$*m4ZGh+q)IJJPL@A%9T#T@gP40h9D)ZMXNQm&11Fd3glK4g8wp_8*2nm@ zBZBd4m(v&s?s?7&LGYAd@wVl-MHDHh&QewqgxoIIojpI#7Lp=QKVN6T3i)w8mWeg` zv+^K;9#J<*jjER_T07q_-1NO$P8X|eTLsTM1YA_p!|hJiK1ZgZFY%w)w~D{SSiZJE z;XeK+?n@7Do}n>P>vy_^(uu!er=jJ95@HLznm)NS2&$6FK^0nnMU>QBukh-!G*dUb zM{yr;j~Li7k!A<6Gv^qyuJ&|L+QF+kjhPqFBgr&>rGX1ah8IWC6@e!*WM&)oS%Z=~ zLtUc+OhC-*f+GLoF+9xuW%+#S*X?GeH5Hz*hyvoVprtFy22V3b_guyInECwrLbUPh?QC(vpQ09YPm$fo@~awWsvpir86EhCB-B# zSb^chXbh|(lft9GH2HN zf}WC4a~GZ;+Ql8BQO+$?P)}G~b_x0C<`8v-WtRg-yDciFo55Vh`5 zOgVFMlkAgwTG+C}N16F<&c?cqMrUhAlPdr6T>XZZ7@m*@ju?+r9aUAusnzN*zn))A zKAeo;MyGv~M+b(*qXG9PfI^BHN+DGlYE`fo3F!na02e5d5x?t+4^n4Q;Wr}>@`wSY z@Pp4EfTw=Jqej`z6pz0fLkM4k@$Ys@Nh1bgbKp1mw#_(|lh`uD8^3h7jcmV5|M&o# zqYzA^{T{iGM6|+N1lTUi`qm_6XE)o9KA=g(xbtS$^|BS`7rtyaB+m*5jP5^pf|Un+ zu!u`O&&#_Xou(EP(bWJw*nN&3(KiN!0TCAgg}dS_n71NC5Yoo-AlZGdUB!FaGG+a=tHwoXDFRv zVZtc%;50cqC~W2aGqajPeoXFIX3$DIgYRXpf1RN2$*X=BCNMw=yiqR+*t>`KwX1`l zmJTtH)rk3X*lk~uD#T%KJ8RSvV2C*D*R2@Y-TC!!iuwL82LmvSy@;}{k#>~N)MS4f zTbm@dK-WYEXE!au>5aglI0FQrLapcFUpZ> ziZ;SxWw*dpLPEmKj2ff5qN1Xzs;aJTl-|e2#%3p)QgMe`ksO*QEhVK7mV9zzA|b_N z9hI+;k~n-YFe|i9nmwZhCagL69C~}wt#>XCym|{5iLG3 zIq4X}N7fh!0Tq!nvy4aX2!pvgqP`6qy#j*Tr?JC?G;#zh)YDVzO2+5?^*A`bj)=9F zuYlq$ITV^(>K!Y~UOlDKaxtzGK zd86@5;YR4Jrunr?R_@+c8{{Exf{kvrwd+5Gd8x3tjvk(9=tw*+$sY zK;x%d;m_-HZ^F$vVE%MSp{=GEP^7#0rz+tYXd%x0-0hUNEL`Dl`ScXXeeBa zh7>n|q+fg`%0Q7tzL(MA?J*yrij-JifH~iWvrTe0);GEGx9Y}F_op*Y6GqXuO;h=+ zSZM06SX57e=^#a0gw7_11e8=9<5VS3)|dO{y3ON!keH3u0e8$8@^7tH1>n<>)I|$&5T-=8uBo^kfhf1 z?q40oBL~h{_$ro;ks6c@t!Wm$-93#fRzal72n$nt_9qh3;aWGQ?w#A(g_}s z`sEhE%c)%r6rF<7Xv6(z4%)>WekOuX{ZB22)MJDKb@??P{pWpY4)G!%8F;HB#DSy% zD=50ESJP=PCa`W^MnE{bz>6Rx1PM#jD+%eN44OBH#DsTgJiSbAm=0DaQD??-u@?du zYpr1c3PeQ-SE<_Qz5!Hm@BV2_8bh9epgsy8&h2PQed_gUho~ZH$Ov&<9JMHEZK6Qw zOn@*pE(m^wvLaGWiiyGzC=UU0h+m;hldiYqn;`viM_vkft)c9mRFE%LKod5k@R5o* zfyd0rhV@gE0+O5}Qi`22Db^ICEDVE_^8*&C1Bbdqtl81GcpRm+?#ABj&ig5q@Up8D z?2kjc`7ruq|G9;db7|xKy20)CbQ??jarGp$rOpNCMvs9jMTOb{*BLMd;e;VrB8x*2 zZn*w;#*oi}SLkWHzR-JX^^jXj!gV|B@1@m3`!Y&S1WvP#pRlUiofx;b-|Bo&;5)@7 z%N108BhEi~!>`az0sn>v;5h&Oqg9mf&5KlGQY}eX!lDqj6D5J4KKEY)zd}s>hR?ndY$zvSH}DBTEhLl zSb9#dImH#_JV}G#@Z zB5d_-T3{7Gj>^GhD8hc|=9(M>I7&13jLo#I_JrsS;}8P_5kef1jffN!nJ_0su2^3L zJ3-KS{2#~kRC3K^v(RT z_Gx$iJ=od*OEpC0i-i~>DS`LM=t?kJx6`D)?_ammLDJ7ho4+kW zjfpEYO2%cmGhJU50R_T)9VzGK3pDvO!$ou8j0(T&7m@lvOTVk&)=1F$=VoBQxb;cu z(C5oStoyyq{+qC#4rc@A?V;J@@wktjqCa6E1e@R0K6?<+c80d8RM~o)zcH3jU!Wk; zXn50+n@n`(BDRwl*@;58(72{}62y00bWlJ&k`$ToVQ#uOFu=scIaI$*swmRrj^4}8 zWh?r@Twx=r*W(c3Wa4=RZKG4^{{iAa9lxRJ=r=ahWmW|++Qcp3?qG-?tSxwHMW)~f zlnM=cjD1Ba_`#5+XKCP%lzAV4fim%fw3?*{a&i9uvv(bURTSy}g#@tc+3x-dgaFpl z^DI~NJiF3sXrA@XUJ-#1P_O}lR13ZLmPSGdC6$EqkluT*ulIdr|G#f$^LT^=K@pBaO5dZMf_muj!X?W63%ICP3+_}e!%abDApUPSo{KOOIoBCE+{pOAIu7>0Y5ld zsfK63j4&LI;9Nc92a%i~P&SE7 z0W`{=Zb3VE_}qr4gdgGGb&0@U%>ZD7kv(kS2bXZ4u*VTjFtD(twgzyY+yg�fS@i z6M>Ugx1ih&9NdEoJR+BwPhh}XhpSwGH`ftmME8Wg&Wbi9dfxm*uiKc8^cjD7e-bEc zul}RG{_nY{)Eq>DkX^yDB9Y33!#zeRd_BY{32?8?jq_SYqqX^kce!bOrTg0A{T~59ey>(Z0cKMWW3bi|y;svZ(=eKLn=fEwtW(a%41>sKr@ryF@p{9;{iID7hZREk8FchSokd{{%rp9h)V#AeL~XJoZ3x+*)3@mDe%msq zhBO?_ZPXiBIU^*aF{(%pGBIOEj>ayU473V_7B*PT`E34R`p&E-osHgCwOG_zm0F`) zda%+jsBz)G6Iv6k4gpZqRXU@g%ZFmGFZiFTau;()Pf(F1PAUKLJ+Lxlp4#dpsJY%YS#pvpt2PN zsvHJmcC$EbPl?~&qRLi&e~=xs-e{P&KW|oe>yn^cjhP4yj+ayL#!Yn2Jfp8EY5{64CNkpwEF$fKpAtsYRyPv@iY66Rvz%Rtn zl}IYT_J?#XCm0Y5LgsOCa6gC<{wXZP$(S6u(d#sJ#Z8ZR_N6%k4C09y41|tk3cK&% z*u*@_sau#l1Q-w+Y&rlDkxzk`8w~4WTL1QG-aY;$_s$~q+%Dz!`j?OVDjxh`*yN8r z`#jrwz(`sZ=tFA*p{;xMAKR&d4>_? zX>!u~gS%$3sN4C$y`NNpF+Ayi1iGwIY4iHylU_a}dwNTA7|1xMDV_2IuwvXUW&`k| zkm>_>Wi}kAxa)-i;|KQCO&d!l@b!ruW4NUJfTc#}2Nzk+&JU>f!B|XmSdFwQ&}y(y zp8*{sSZNII23CEk#Y(3PFz`mj8y>(dIb0r?-&1B+Qv}>k5x79zj#IGHs#4l4jZSP`0!F)jxj)i&{y-FZ-uIgMx*u%b5$kSUDd zXY4JVvb*SbUJZIKc(&7{WqVweW7__TIeT*SHa3)Jp$Ja#%fO;(K@D3Y3t4MNs_5H& z=q48&DCN%=kUnGqfd3k^ICFpb)SZPDtv2elkzIu2aDEe*G4o(6cnmGNBP)smS>1h7 zJuR^EtwliyklP>%bn3Hq=FB+Q5}Du3i+(1TuB+8jb=qv#(} zJ7ZTiU*7=miSZQ?H8X>omIkLn%Tn@K`PZ4m>AMU30&6Rj%%`0ujBweOmEYQO#E znN>8lh8_FDycm+J_X}?L@Q1_v4Ga9^7sWqwN7~214Usv`$UeC+*PK>*zAz)WdP8Um zRVx-FoWKvj8)ob&1UX|MH~xHKdPu`J0ojy&Xm@&~AtEC1gDC+upKXkxofxRfh@f$5 zhd3vYR#u)UX|+(TrHl znqak|$(lvM3>%cLDN(mQ_c{NOV0p^?Y4cunX49$*Ks2$?-pC2O1D2M^B9`OEAw@PoVkOWgUv zsCfyfO`~6$*}MPH4*Y;#IP@9&`iEcJ*qR7Ra61sb`zgR9Z3is)y`!pRu#5M67%9c; zw*CN&;kh}{;QDnf7LOYr>pf`9WdnTAjUR9`Dmv?4aaXC60F9x0$htZ5!49sU3kIr1 z-IpJ*#K`>MBFowN0lO`<;tZ}-S*huuZBWm|74t;~Iypq&W_Bc28xpHcRV{kzG6~e2 zYMdA-m%q0qxy3~3c9C)L1Ha(9>E{YDCzKWRF^)*pPlMtZ&gdsrh?eEmUmUMsA~Hw7c{1HS%%EIHiPA2eaaN09CX z_`%Gu=EZ?I?8ebLG^B*{gJ~fRb2mg&$|>t)@4o(kks5c9Cw7;+1U!HrfCO`jKvlh6 z?R5gXX~E}Trl)0x9t;bKOx7clc4^%ozr@A2$TNd`P#uDGzmVh8H6fcq(>4VrYzjNM zIV^2kSkmT$Nn1iww}z!`2~C7-4NE#*QqGhup~<*vGlf8bYzj&~mRzg_Gh{lEN9Rgm zha_=yNEi&R0e}lGSMIqT?ZGlT#Z8Y~F=$eU`GYHN8^`Al`1S4yKr9^+<~ni%>I{D1 zXH&fTuQM|{oj({o{{(8&n3w%8A27TFKe%Ghgv{R?o^I2U1LgO< zedOP7ZbE2CEh|p+b?_lA54wOrBSP+Fejv*!`4N7=Y9x)tFa{HxHire{QKw*a*!iAy z?Hwo%Tz(R$9k7uH2RCy|gwGA!32hR!7%FO3U^&#%fustIhbUSa&^v0OI0LIc+;p;y z@dL7EvN){px5E#dr||>cgehp5ADq5E5%HoMg~a5y&DvW$ef@DGOEC+-BdAQA&gSN3 z&JWaT$|Gu>$IjF|-HEk2q!38u>sr zc+E#3cK>BN*=1G>b4Mk&qSev&A_n|4!ZX`5K7qGdO|Q`uSi(D)<4n2VnRnl;#hX2Ir8L9h834oW*Ag1AtWk3TNrT@)-vj!4FUqaBCP8WU*O?5oJt!#UzmNMF{MIF zwF~yl>2Qf@Mqt&)8J2C*wV8HnMoj=+17pDv>4HGtKwvOAnX5yD z(nV>bwa}@P*|1As1D^;4M_i60JfMhhE!|3b^UiK#w*%=!5kr%rE+N|}D%`r6%eGkP zp%2=EX8M<38C6Z8p&@HGZqW&Lvqhhg8n<%YmZsXOu+YPmb&XcR(9qJVRy9{tlxeIc zn?N65uo+Z8Y}%~TX(}tLl?E_ii$xFvjuw*Ep~_2eSBLxvNN&tkGP#+#!QIIPSi0<~ zX|uM*UXgWr{psI5ea2$Q&e!NcK|({*D-8XHM8@ZW#UOTg=0^@5lq*1vQ%D1$?+X)^Wv(^H%uxY7W_S=J{~3}jF9wZNi-jraQH z{N;J zlyl$*=-BLPt){uPMXS}9m6W5}lvP#pT1H&HeRU5&R_MaRg=e(=%e43*_n-9~#^8eRl`up%_yh&-`Yf`6qT&e@kYJ)j=^fUJ-n z^knGMF*;}bAfcd+2SROCbVQa~W(L>H+HulI69mk`;Y8#6d_S#E+#XYi4jn~7*+R$R z5WfyBn-bD&GW59S1xf4sM{u)&I(NQ4ZE*(q)~Rzk0L234h%wQ--k<2hJl@juYS=MRYT zpg*M>FHYZ@j2vO?PBanv4}8R7$!>A_1(bpxY&w|cx%) z-!EG{bLMB+StlDBYj*G6Z7`w@A-TrzBgfG`4uv0WZmKIO$Vkd6OpgvvN=YaztJ$_~ zTUmbQfslZ0JNG#(y5fTDn8b8s0oe&YnnfihW%?Hd-2l`yHa{kEe!x|uiyx4o?_lr) zb_357Osk=?fghYUf8fRs`16I4FZi9w4-h-Z${SOp_Zy`?fgOJotdFBip*e#ccFGU# z_AhyEPBhwbU5ll|{K1d#1L+j!s8UpmzYcG_XJ+30Zw2ZRF%2mMv)yE~n^EQHGZ3J` zM8(LS3^tS9M6;o&cS@z&YNKVju%{k^gm@K>@E~QC{g8Kt?#&NaYGi(Jk>$tu0XtAV zmS)1Kb}^7HBq~5-V4UIyPRzI96l|?fGka3!2jrGP;RvYftVKDk0jUlCL1pi6NUg)z ziUJn+#sdfP4A4D(YvV1fhh<$Yy#o>Bs2o&oipU|RR_eeHJ`QdONi3%} zgtV~~a(?jP#xy>Ez#=85Z$k5DhSc-t3mmX)v(o$ld%l2CC~NfyoIPLg+fxdDz@INr z2xwY%0sH{k*MED4pKQ+v=L?Z}=(l0X0-}*3_yO&&9C8vVmkQ19s5FTF0Tl?m zyagF2d(ICQ1!lUQFK~8*P*4c_vUM|ptKVK2M1fGWbcyTv0_O(^7&i;{36=B&WcIFn z@B`M=0h-UqYZGS%)lJ)xNjpEX9KjNXC1DlF{<45%lrx3Ru4picGj|vI2iKRj;2fUW z746R#X6!4Y=L@i7>k|QK|HM^C!4D{4R!^V~{kEqfM^U*gbT<)>-QnT~GlDB!`yUY4 z`~l|&O$JIH!htmkeNjlUUuYBf0m_qR1W@1XY<=SQQ3xFTfW}j_EQZ2Y+N9?TiKX;~ z2nwI|dq>MGenHjKHYF4H>Izi1>}^fWO090es$HN0R;xDZSgh5c*|K4MMI&vLDH_`j zM?{(srCo?So`_mu!I<3XFyYT3HrADA=jS1j%BHr~hBjI#13oO6*mDNyQL)8lKvBy;c}nRR}Xq-_7A~Gt;Ip_Tv!}tYG`zOz%%HP z0m=rU2{zhFl1hv9{vb2x{84BQr^PB5S*wFP?Gp+h9Iaj47M_riQEy|ia7sx@NlQyBC@9Fu$-yZMM~)ofuE`8=<=>Em4gcz6ettfD z!cTN`G%nB1&dkoFYqPWRtEy^x-SRm20fy}E{J_h5RL?%o?bv@TFTW7s@NYsQCDYxj3TJ`Gb3AmQ7fkmXuq4_dk6v_ZjKV z4>%!1V!#hdO6dctSy@>KAK57^EJPL#9z2LhVF{=5@^Y9FV`*tATr)BA9*xh7iqF2vdnoR&YklI6%^$!(X4Xup4lfFAx^G(E zL+>9_!wMD2+V;w*i3g9JXsM`p`Q5kGdee8y=D$15zaTGv!Qy2(Npa6UHpXx2jONPR z|N4KvW##rY%jVCX|8+*fiLd7RA5To0KFxpkuKfs>NWT;%Ya|S4L}+^Q{DCZ|v4ySETx@Kxf!@HYKHfqs2 zSV;6R0{lQXE4X6nh8U=4QV$4Oq|c*$5mW>%3w{7U)I6vPi)mH*Pl79e!4do18DFA^2j`MelT-y8RrM^M*S~KPgI%Jefxa5=emN;QJrAo-ZI$fbWmQ=MP-(FTeaOO2e>m-Ok4PmY^N$zgV<{9%Ptw zQHLW#f({%E-oJibfTpqOc+BCA+cqs;u?o?(HP#lEm*?e`Rp(VyRGF+wy|_9s!DMsBBo;wCLQz3skk0TK2a3?!XZ#iY$K7zpFg<(x zth3Tn2^g$45p@)OBbk|?RB?(N;fMmkKo&M=GqAyZA$tdTHw_+q$Vj zeEL;+Rq@=ppBLxmE?n?~vY{$7Ir`J3D+6{%*|h3q->xbz&YJt_7gg1@i@sjC^1HRf zo+)MyYM|UC^8;Br%8&2^x+xC3jkX+EH1CU~Y51aJk>U zvU!^#sD+`;n9b2GVWxVqS8&X3l}CsX=wYC(3MgdXpPRpwU6Q z6MnQg1N?x-S^V3|Y<=SFu%;zJ*;)$)4okFQjKoNW)-aF!-a-v`zt=(O=DTuBRZ?uf=2sAK%swF>-vaH*4k<69^D5*{3g8e z>_vB9rs-yjt(Yn!Nvc>c971kMnRda*Nv{vdvaTi!%_UvYH`rgVJ zyRx;?IF|Z2l-P=hnyGthz70-;{y^H0Yy{FGh|_oEP2XS5_eVmR5Ce12{>uJ=)nGQM zrL;!@>?vl4Gc@1mf1qjF>SNGJMzaCoz!f)c`VN{uh|Fn55mBm1W7Gc1e0}2j1Ie&N zB2fZx&TS=PH#@Kl{D7$e3-S&ReE&rLe1S$hq;u#Q|C_60XM{FO{D5T%w@7INKPa0S z#MUP|DcSH2gyw6f1y)X3mq2CP1&Gr+Y>mxzdbR3{?{;XRjh!|psv>%58(Wi$RzP3z z#7zbr7R4T`MwRHR{m6Z8?yJIvAH; zb5*}l&>T>cq%eHOVwBmt-xx2SkvHBo1kq68(lRwx5d6q;+65#J$T6bk9wqO{hU;2x zfM3bY<%xsUyfZ-es4LLjZphdWzFEBoIF7pTM$V{wh*gspa<+59!zV6nC(T?cG(!hy9`Z;f$ zrKlM{aJumW$=(I|`NHo`ev}`e#=r>*GCAQyRat3tWQ;~@JRBLLHPVc-*)Dz?RW~i5 z`twakG2B6yX*3$OdR@Iy#BdPmDx*?wg~qg4O(r<$cP2K2AH2OGy;?1p&9tEqSc2JV z3D47F%=*FVD5!A0KN38vjJD4L3ZQ+r9nDec=>tNvnU2X4SI|5wuM`=7SBXwMw&@_6?#B2*Cqif3W;O9#RM!q!4Pg!Qhy=D+?+-p|}kRHXCVc z2c$%4r6mI32ZvLObb8u%2vyT!HpW)cV{HHJ8PLA8OB3y;MBjXxwd3T>(3VX{bMz+K z#|f$$_F5}_pJ{q<;}3ypZCcs@3aVG5Qdb(J?=KYA87wCH+!Uf#D^&~jNc$sc1<|Od zO@ojU(4OD|Gx))~OAe?_cAY`5)zWvZTJ-kWyK<+6HXX{Wwb_Y~@$WN57V2o9gPpl* zGb=-Z${bDwDsfg&-PCOvEd~b)3W4hkS}K-H=N2k+4oqxP7 z8H^{PM2mh6alxnAWJs~FxVmEVNaa9}bNQ3);lp9ROuY(F_ zg|~tqpeE24mrMxAtTBsktcvjqYnih?%E*e#2Gwh}G#Y8%o&*9|Yn9Q)alM%^9VevT!6LP~(_&hAaF0^SV9{QC|o>54J%X z1R55?wQm;yeWZg0Lr&JMBLLRB6I-Dl#E2lkSK1XfDh@p};lezV{rQ6R+w58=Jujnk zuJCAhPYjZjsYC2_(_>sIcFGUVmm3feI_sJ`u0L?&2czeo(09!bdV7!N`~ZPSVV*0f zNO95m@`H1GzQ9Y548+StarXSJmk$_zUEjy4Ac>v2lFOVgD7rU4VELB$!9|vHm_OhL zfcH?;cL7wh8JAvuv~FfdhZl<#mZ+E42fmxdRkPvOmyN72>(2eWqOxWB)^x((_3 z3;ufw4D4MD>29&-3;uz%(|2a^=LF-23*ZMG-fvtKQq0#UO5>noRgV4 z!C|&rtPZ={ph0QVb2lW$A>RAy=KH4}yZf!f_fI)~?}yQMe|Y5HcjE5(Am+i>_qJHY z#O(U31`WB)N7@yj_n;BI|8PrF=|2*p@4oSmSJ4j7%DSAB@vU`bdD*c#m6E;EC+&&| zMo4pAs61?@4F-)}{L8DG?|v`po)6;gof>)9`$zAd68X^7xO=8V-}%uDd;8 zeWuEK{pEe0qnV*I_`$QjAN&YEV0HMDMLT-=jJToy)8v`;M^cq^BEeKRt~_2iCl^ zF~gl7pe2AGV9ff_y4W-M0aUn)AHWhJb>Ii&7b$FiztP1HsO=$0caN{NPw#Q+xKQXlVa~19dZZ=cC)=cY&wJ#SdKjAHcFxegG#IKj6<7 z04hoQkMM(OtB-Zy2mJYh`}zZf;^GGzLQ}{ehf~aH>3shK&JPyt&+3#P%vm4B`2l5B z+W(-`Ke(|2KZqzXp$vb7AAnIg9gS^G8m%7WK&=IRb6X(73&CC3^B9ZOfMSMPbvRAn z5;iL($0?YhLO|T^`5@~4Ipudv&A<24(z`z?yn9;lUuIR_Jv;ZlkB+wpVti(0uYSYW zs{YYe^dEP*&&ZyG#{9`!p;O-fiJwBP^v*nSQ%;(qt?JI?L`7We134KXluQN~==QQx zs0SocO)uid4*awP5#2kp;C^VVIl1?IS`KwJ@ZIBag=i3B@0*_Tf{GeA5(=_c|FJy> zjq@5f_R0a{FT3%PW+iQBg7ouX0fdQ=aY`k?jsUj@V8ek*U=s!3Z!-RhsAuKhGo$S8 zSw(mH7vABY3zd1-jKX=_GYt;W^ZJLc^zrS{cZ54X0AuLYcPM|pz(a$E<_6@8M+Y;{ zAUC@>1X?7laN2SG0TaGHan!s7)TSX5KkBgm0bieZS^qKreQzFx%YayT;G8S)Q^W`} zPfR(CPfaJ+sT6Ve1cSo6R0KKGx~;g=faSFYu~M@l!-FaFMK7v48sY z_RIQ@xUTQx@J#K{we10=g#EGtDJdyYsZ`A26ezjvptLhc=bb_32eNdOAK?d7M^39I zXdYIg-%^CxrP;*(X&t4lnnKZ2&o~64g~&5K%rk)%dX=^CQ?7d-{F=~XPOpJ zJSDUtIIW5q!i=uj@apJ%* zB%%aacGxjOV%zM9;_ghn-@(TBmWGj*wbMFEctBt8w>xWQxC-M!-o4=8;uNB*?9+nl zr|&LMQgOhAIv;f3MLKbMNX_)!d0IOyiH9~rc5Dt|aYV(m11&3p(IfHU^(?jasTN|aPgrIAuhwgeo zoUto&N@#Orek*LP7FuipZl1G}D!Od6{ zUN+-k%YxucEv1n11Mlec|F=5k!{GY4>!YmHOETC6jZ>TvTt4lPGO0w`RuaAu+L3Z` zYEb>uof#-PDfBadZV_Re`}Z3$ZZ;T@5L<11m6g4?$ZiBR8k*s^8&Qiei2v)GD<{2w z*Om9)cmJ%6`(~BhH@kA6U*3JwqMK}Dd|E}XzJsBydkq}kd(fy}H{JQl%U4bquK3^o z6gF*NYpa)2bEQLnnMJ8^=z7>S*Sz)mAL%Byrw3`{2G{^7pF7_=bo=a*+ot8;NUcaJ2(+mINU%Y5r*&tu9LBo5a%m$}Ky$ZdtK*jY`{6o|`)1zf%H(k0mFjE^@&n^9Y-GMJR9@`%tef)SraehHY zO6rM(<6o`V^5u@$&(?)!jaq-FYjOduSoRgVl zjmm}Fq84mAl#-sCnws9$)|Q@{mY9|l5SRDu-uU@zcBf_LBqbit$;vJ*E=xF(x^(-o z`CE=HTeBk}IV~?AK@}p6$J26F~?KB-xvAG+HeG(o|YAVJhq@P z`|y#d6Pd+}cSp_Ja(Ms2WBkprgoMNsiOF-9Z~b~_+;@AAWfhf1$Hqh-kIT!;DJm*D zlvMcTmZS4m?aRw8PE0rvcRV5eWJXxT;e}fx=4?K?Xw{~~q_n);?1F+k*l*Z-1c9vB z6;bN zmzbWOUzm3+>TpJSPHs`fg3V!H?>#>MhutSLaif#tlTu5|suGe;F57+xW&8cc-SH<9 z($i1oX6Gd&#(lpf&p(mJm=e;fwweQKji(ujki4XNAHJjy8W+;zJKoh@Z*Ym{_>|MhrRIB z@OS?`kt3)|A1;sl-w#Qzf1CW~@}zf`#lP`w>>DdiytXXv z^+i!(v5D~sDUUw$!ox#ecx3oXj|_eFUxQzIbm)r@4|(a)=U#dIx#y2Y9S;jTaQN_1 zgbyI_gai~I0gVy2W5KB_-wN=9ZO|qxGGLi=DG{ z*UO)WyzoWP^IwL%_(kC4&ky|P^WYcf2L0!=u$e1@6Vfw>kALauVJ|&C_+`ZS$k3Pn zJ>=!bhQIjFA+J3A>`QaLSdy1lfL4a=AbcPtB?X0v%p&`UsI;^c-3!dfY-VOAs%v~~ zN@R3YWK`Vo=$L~cflY1Z7v}Do{8ixdpYQ+AXZxT3EMU^-0Tbr#dud+qn_q1W2tE{d zJn_+|CO#`k^|?PpSHe;-;;kk3aY7 zbHiVDpzEc*!9<-(Eed9^Qlm+5ScQg~%7#{zN>5+bXlXLSNvSb9t@`S!GL25FGg$?Y zS-rlhs>WzRJ?Gtc=aBh*apx5Ft9%VPw zCYa3BmC_Z&g~5%@7KeawDLPjKM!wKQY!>>03|-E?ghczu+8s1j<}3E?0*zH^jer9~ z5e$Dp@I{N2<}t{f!ne^%Z?;5>4RqMM3y6W{8fdjS22T_YO%l-KTO=EyVZ@14;R-Yv zBYfb;;>0-LiUBaYkd98;50XeXQcG8}%|@J*7Fbe>*kDGmnds{&q62B8b41EEhY(Rn zP7C4?5DQBQ1tp-w3`ioiK6n?*HlA5}nn*)9+cmOio}P~s_>*>9Gm|w$cyM?JyZps;CW=bym6*2^BA8nyy45EP@&K2oHT6l0o)V zm#AzJF-iljRx`>Abw_YojVuIq%WSYAKU7vI0=DZQ;-cgsNmQOl2IUud5CqDm1%dL? zpbZ14Y;oIhEx$)}*%|1-4}SFfOsJnI0V*;Z6))Xcq!l$B8L`tAN|Z+%D!*gtk`L?Z z?+Xi5l;n77nr_WYQfQPn=bltFR{wd?!pU^&sXDW^W~E(jjDq3C$=8_F0|k|rsP83e zyv$04MdLku*!55+G{w~pq>Um$ln#2gg4I`4G$aCbh*}|)zMVA(DoEPf38hajJmQ|W z3%uBna9r-Bx{UyN$Sej4?x$2D?O>-SYMu^@-AR>$a)LGi7c>ngwQ2-TlV{XCX%kW; zS-KboWSUZjqN9m@9)4Hg*SG-}QIPntI1PemLSE=z!6Rx83IdsNLS@pE2sWe1+@20}&XS5F zeyMxmDd_@~K$#!N;x6Ytf6xx9f^eZ;2O3OJ{qXI=Pe1=+#hP_o38B@YBI;Y4H>_O# z@$_klsrjriQ0+srt;tW{yl&ODt-G>{Yp9|+oMwmBYHmq8k(3ml5S^B7MyC!PgAT#eB6&4|~>J9d?uH-8WwvGh*b#|GY-Z zLuw`t(PS^oIQh+jIR_8Nfd-KBpypyOOwYo=d&h>g>FGt_F6_N}WJ&+s>hJgL+p95J zb?676*U;3Feus70f_Yzj_W6?U*XxNxh(c;wxrx9wB(n85G%$qlF z&yJld*Y1Rk6C4Q2&uP(UnsArnjwh7YH&G_3UxR<^iP)p_zWl1SroOqc2{uwm+Lde9 z{IGb%_e)o-q&Ereb`x9>oI(5I*wMp=4Vk~>2kBYx!NQbPym#YGF>&rSVzb@AV) ze4wzXt}`opSlj4ffkWeAQ7bGh9#g0OpVpv6LYWZoLoC`MrX_|fTJ+$EA&O6Djw~vT zM89a@HGp~KTATxBB$AW|6#`EbQoz$h*KjLJ5>+i;w)k!L!_wTIO=fw1U@E(?%i9Q zTbN%|$u{64-RTsKE0=#8uy6mGjUgENvV9RyS1lEJxmz}GEXc{-6A+F-*!TwHLd(Ih z16ww%FD)pmtg5rwO$eT%aHy9qUmvi0Yj{ko34>L7`<&XdXjHHIVfB$?hn6hch#aA( z!hi<)rY!el(4IZD<<-YxlHrTC5TH?xX@5}IwyhgW%L*!L8{wUp2QhbH$yW=uZ`%@j zB*w_552(pei_)xFy)ir_a8GbJtSFdGqPa^M!v>`n8>xu zzT2~PPib{EO$^v*Qb91QzF)OIH92j|jzFEoLYwZ}pmX(wo5uHGTGZBLk zxL9JMk48tw9zAv_ue?F(1TcKC8aAw2m6MUWHy~VZpcgRFePF~XG}Rr72u)5&*t!3R zPQZ}G$a-n}iRhrX*yy`K&32Zo84lvI<3a-+cq5t4%r`k)BsW@V1!45 z?AF?%P1|tgGC)V_)$8fWp!WFbOtML2NQP=FtA#I|2hE zn$*%#m@|Q5M8|(V{Gbc4)Z+kxs&$BUt+i7=d~E%gy3tEM!^K|GHqN<0eRali* zzx8@wjK8TK(IqHRs5hE`K;blA zCdtG}0Lq*Kr|ON8A`>+Vx^eUwXha5AT9-$~P05EVE~CngaV^UWg+zzW!JMeo6L+_f z&PRHTY~n|1Q1D}Sl-1}^3#dq$u0zU+zfykzu&B=x$5|jkWL7F+X5-!aa3hEim6UF_OR1eqVm(oudQKcF6vrnSk7&8*j{n$>E9 zp0=%r)|VQI)zs9c*6G=Jf-!5FaR| zotxEy2BcJJGP!?V8!8~P=$f1sOG~rLY^GJ5=;$d5Dob5e zRfWn(ofijb7>83Z>07EB=<$ct=diAj_LxxC*OR)V?65l}SdHKhsumP2X>&)n`oVn_OjT7i zts2@(m_>+w&SImzF%2qJTWyny`KCgl=NeWp8BY-U4EZ6iHw zf^wpgVfV=<=(Os_#%5M|09L#tmbSLGdZh-m0|kg=6F~$7b47K7)?|f^!%DLx)Kl9m z7M-E4uEAg?a=>c~VgMyFYE{(@ZScne?*uG`7lI$qSIMXtD%!-g$Er7kcPOV8Wx&!2j9QC;Q0aO;6?J}K{waNob)a(61GexCbU-T%ZhD>_eVE1D8+?) zGGnX6gyNQRmALv)eNM9&SD~T3-JzM!H&zscl^*gHtHjJ&6{1|Y@o=SH+!s-}`B2gJ zgO$mp_RO+2ltWl#X_Zzis1g&4#qYzj*Bq;Fw1^?GHG7kk8{=EDtHsdR(rpQi)q&Nj6x}g4;3+N0iHkTKaVT1)vLFqh zDHN2`l${wLaVRwCz#+6mo<{~-eC&|}p@)t{rBDv3UuIF;42g-6;Ri#*4oA{5e)dQM zzO5F0YC=Nj!LWme;}I??Z{*yjYi+5IJap*bp|Ha0TJpz81}>>6%svvbKQcT@Z(y^* z@b0u*1Zzs_@%{VvMjVSag8+bVBAbZ9qK=I^9263KJR_Gre@vgjq+yx5wIwbhJp4#x zO?5Lmaol&5IRY;!N(tJt??CuLHJhC16jUas^8?s$NIuRDReB5;y7xdutbX$VH`56IA|DTUg7CTFJDE3A6YDt;9Qn%@rmnGt8j&@WY4du&rSx< z|F|simu zNkX~3FX{{EPL!RLf)PUr&dF4pPaPMi6V0ruo)bMwvt0fpmWZG17F?G7+-$Cb%-p!i z_eptDSMHb+V6jP})s*529DM|`lDmFHTCz}a6)1Ul3v)kp?kcbr{;~L{%9p$`?%70@ z5JKO)L^*?$pMSM;KNO*=9J$E6^|s1|x{0HHnfQY);f1IHU!1Yd^@ow(K@-F0T_db< zH^wmz$*@Z^a~H+NnhKK9J%t>VM#i7}hpLHYmSt{raW57oRFe|tpXF&`{g0Xxlp{QJ z;4s{Ix7L|apZ;S13KM9nC_3q|pd9NdxT&mcwiACYeO^ENcGre~@2!5Cl<2YZ?38k= z4uZ(^`7XDQz^cWSTHSz=QCG_>nXJ6ty1%jFO2gbq#D-2n*9-V@cLaW^uFi822)OA&CRTXD#yQD8Y?<8 z9e8MkS5hHr&y9)wSnY3efn{y^m6oh9U1UVQ+0T%=(j+v`(RJ4UMbE+@EchTDSzVI; zxseG2LecYCGbJ?wB9&tW$5T{Ld|nLI-rKs)-tntyZTfWX02Xv2o0?eQXPm`|rsLvu zmRIFBamc_Cb+l2kyQrZHu{dvXj>IY8bg0q*ysKV}=ZtPp4X0w>#iP1xzr8ZGQoB+T z$KnIhWYRY?PW5pP6F;r~?ok`-NATc@MnlEKj5E;>mONO=Bc^4@a;7WPM(ynElvq-x zM=?>YSj>{y3M9o@@9f>c`)CxJ&}+-I1!MEBpm19Na%GCB=s(%rr3t4yz(~R_;7q`k;2M*mA`T=p#;QL}!ERP8cNZroqYhYO zMFnBYbAB(COEj*X#RNx_&5C?~A6bw&)GMaL`NQaFzU7O~MCR)f(nH-q{ybla1*)DN zq9(i++_XU%y9ZdpzVr>s)0winj5=+^pu^xHS$_k$(0LTLD`xAPwiLP?{AAupYXzOU z24R>T6Q8Rj{s5Y&7Ei1Q?Q#HD?&a)B$55D;l$+6(_80zl;Kw&|tSDp&f<4^q>siEB zEHRUVN9x$o%J_w#-{PANXR5N#eXY=}=WUHUyo{XNa&12xS25An2`|dM{XERg{NXdx z5UF>F@;0_VC+dcwJ}JWmKB>ten%@rOS#8Xf~+XW~@g>9=YK@ zS?i}3YnTGbk|#{rH$RFx_d&Y?v1fT|6>^!1S|N3Pv6*dAkzDgr9fOyhZBeA6mQ+3R z9`?$<} zG2QZXKa^uoVZ~i^0)CB{m|5ow%3P8erbpoj*eSVDx2{V=wi8>91fdr{b+Tlafkz9> zo_`W6=I&XjB*{~(m$H?|P*i7((GNn?vcdK`)NwJdRFiw&i#p+(;5{3W`|+fLFt+6# z^SfW2NKX6JeWJ>5uA%}anvu33IYFrKCy_Tl2P7)R>~W2>T$DA>Dc_tLG1@?A+Smj? z&Fnhn@SI9&vO@W@30Ve%9TJxcr09%TAr@L%875Uf9gPU{6`_1L;skY){Rz3Bl5{Ma z`KrHh)JT{BVP9Uz_=OEcRYSZBi)Jew?{8WYU}A0$=LA5?#G_;{;&=y*CQh&sijA-oNdi&tjts2`Y8$ znIiPdJQ_}oyehHm@oua#-OPM*pi#3E{iN$V;wH!ku zE-ABFa*CVNjGljn?i-g<80(K|sr_&YU;990`Iit=^V_$<@Nv9X?t_R#T}n%Xj2v>M zf?Q+|pRXW`=yxG3=e;Q*6H(l$BYgSZWfHu>zAZJ!9eJT<;jrSg1$0a;u9@G2{oj~^ zRI}4AH5KD~G`@U`rHhH5+6i^sZ`dxhLaMxY^*g#W4W;H}ms;a}8+4<-EPsCA(_ZC> z$G*X#FkX4lfOPznbVqaXI-AVn6>{MSL13m#2bTn^M=NQ(|I3)Wdn5kZWEASZRzczj zb!nPmCpQ>(b&uXjQ-B`-jN^bTpI;JZFs)~Sof(Z4e=Zw}x$zeAn+QAaSUSHV{!d|+ zZv+ioxjK<75>HqzZzx!7!ier*GDaJ@@tDsFG|G37LspV1U^(7)*bbp!RuK%slr}}; zzD85Ns-4#eD|F#cN3~B|#wu4~Uyzvh_PTVJXpQw>kMt6y7SSnRJE|uuHmP`h8Td=a z-rZrB)%01^Mqd8}TK*H~Uc{EDypHaZ7-^va%`i@i?@w4~TkBX?x%`!-P0 zywI8onF6}nJMIJ%O-6rbWY{^x~o&hI_1&q$;+_CL681g^KX$5 z*_XSRkzP3F6@6Uu6P0;CDQ;89MX0|Il`Cz5zp|h_MXG%xn35?8|C}dM?Raf?)7|}Y zeQ@Iz!kI1J0PWquWyIPx(zlaryz|qV4kUK}Runke4JU04Sr5B5{vK^a-IueOU5fqY z=D>S#Q~NB4@w3sSXX$#SR^Y17iyF(}KfAg|qHpUiK~~;eHIM3ytBIY3<>h_&m%eSkD$M!`}D**|Gc{)^60?wtcCkyAZ&1v#v&_ zOPjGR)ev|lPRk@=7rTxX!b^8oq>^T|`%6bTOpPLmAxkR#h;7rQSDZA`=$F}|lk8AHWE4#^>yahPP{E?~=NVF(Aymq4Cb z^dI>0nZuNt`Dxf<|3~Q&PNf(;DnYEXyPjiR`!L4;{1--=RmfllWTn-kH^CUJ?&Rxc z5{-RnScmWA|2=F^$SWY{DOuoPaDGnz`Go$%j@qJDrj7YOS?%_Ao4|fJjY&z>w9WSp zh85YjN~ohdU3M&lbDS=7E08c1&{XA45HHHVWNRxgjug+)LH}0BkSl+9Ur#J67q_N9IMFA3&0KNpgvw{Yx*|kbw zxGg*`QX!{{LX(YC5?{Eq_Pyt1r;-Ez-(%pZbM2lPOr$bovH2l~xksZY)q!u6WXGFI zj^Y0vLT$=n_)8ALikR8mzfXxQ!idm zKZ=JOyedSuUr%=l4IBf@j`yRFID*N z&no2E<4GTW>K#xzir}a8ndf~|04=0UiInvxv@@1o76Mv z1>KO{gx^@4u{4T(X7VoK#{hTs9by(zGTSq9rf`vFx z4};Nb&)-B&hwikXG^fh_{K=L9$Ho4C+x+Z6yFE{voI;|w934__SQiaGn$*)Y+SlR5 z0c9da6jtoYha<)zyjcG?VGPM9;8LZgr3I-3a>KCD&R>cl3@0*~bg$CTf(Ck`Befy_ zb3t0=DK-$;#L&j)DqpIZMRc@iSmOQ5;Y(v1NQ(d8L#7)*|K|pa0yZTLMccfdjWf;+ zxDDk0PAl3Q+twUy%n(=Y%^#-mZd|vlLa|n!*$Y)khcLQfh3r(l!*#u;=H_@&^CWp2 z&&<t4I7?+cx(Te{Y?O3LFXKQzI7A341i-5d;F zVKD@TY_6xaHaCmYnM{9^8NF^#8;STQMTXnXVb5OKSYyh0W@}@*Sh`*q&&55xP%TgP zcr&knK%KY4IE;`2&q|*jo4m|pT#OU0o3g*t9^UvLA>>OV?gp8563pS5HW)1IqQ(rS z_$^v-{!M`_yu0k~Xo-n`-OPW^jWyu6mF!Nu^6&1oGP7Z%NC(x`~iiQB}&^pNqewDk})l1s4K@p6bu zs`cwG-ozym!mnbCB8-eLZ9E;WOA<2J{iv%ANjJ#A6hKDCf90C%0Bpj6ghw<{x7^je zvVyy^;&b&Up4!S99`2{Qn%X-*W@g4_Sh$7Cn%-B$=o?#DR2$Qv_pJGTFU2Uo<64h~ z{r9w8Mb7N{&SQLmk{pQ*KxyZD3&F?Ck7RNRnWf!2fNH&B-nbEk34_ zwKY9EICKjZl6I;k|G(F9-4v8D0%V|SaYINGfL=CV3J!Bv*Rvx2cc6o{AV#o+ghbPt zd`U%34W>le9POR=fA{K|4B;vYr)_h9Yz*Oi<=}lH0op~oPM9geymI*<|MH(~9<0UR z>66+)4cj|%7N)jJC6gSdZKGN4dHOP+B5>M@*&AtJgd|nTTd53)OD?S-QAy?yO|-?8 z>Oe0~6J=Y*#5^jG&$&QVtQV&fHKIf48mkMA{rlM`=uH%2#gp&_Kdv(Fd5pY@pNnW$ zlBkz)Od$hl@~85}l*G(2tCTxfc*9m*d$nCM$HyNkR$4UhqQF2`dAXhlTSvkSG+T9; z*>h(?^r{Kw`Q1Dn(uO}*H57sPQ9lF3*5eG_cToen?1jKkO#fI%?}X#p#BO)h*^3$5 zM}C&0Tq^AFY@+bKB(pcWUgEvP-s|UP!+v3P@!dh@(yldmUTcd~0%)>$`sbY=O$k&8 z%)2#xpY=fg=>spPo)A{r+OA7;cb0V?d4-Fel9Tgic={ZgL&@sd{LFg;*y(&S4ENvr zcPJK4qvK<(v)g>$9Jku3KBc?0M254)=ul$Ic_xPj*)HQ|lv=-j7*1TzunCoY)o^?* zXIUv9Xzi}qqhtbkR^Zz+Gc&U?)pPMZ4UHcy_sAXBkg(8D2)yB{Wm4 z@d$`cZdD|@>ix4`+fA$4LsF(n-?nrrMqnxekI1vabU%Xbpgi0155}>yu<;dFPG<{B zD!m@P#Tyv6OwAd>36_IEqk9S5HGw-Nu^+W_1l<;e z!^6XA83K_J+_jx={-Q|!)YEuw<4P#uDR~&22FG_wcpilF6_wztWiEYodiBYq={T4E zIG52lDicU<*mQjS&p97!4S(6Nok=|Vl|AF1jg+AUh4xAzUN4etw|dr=YApq`_p*gsc{9ibXd+N z&eu}{0*+JYq@ZYnCo2KJy^3hRN5A>hz2lis ziuk1;7^D;vE7uez+wY=!Szz-)uAcE|H%P50m*M7^FIDCw=-_vELb$iW?9883>A#yq z^UIe`(&^Y=i3i3bX+ElOO6#$M^Hn;GqY`J>HZ%DE?5KO{!U~q|p?&jX644HhJbk3Y zQ8~Ic5SyV&M}zDHITgb2A006yJA&zX2=bO1a^Mvducf}x@~7)gl2E)y=Oydx>}1m` z#3QbIIYv&~Lm-cVAb?^@%(uAFs4GFCjJoA|Mc){>^G9pnSMkZ_L#9`SI>z*6^cUKw=%6()nov%yKY;GCL!J!?QNP;^gAOz z-iILhNd(MZoh=4ZV-*qN18((=-fGxz$V$c)XLzr_k<1W=MufVzFaj>aJYd$7Wk6bM zHqC-iS$x_xO2i*JkKb4E9+!yU*Y{TbP7xQP;;mE1{vISH*?bUla(cR|M<|cg#w00e zUN#M2n|E*D!bn_KI>?eD^tkRe`NCIo-ZZdP?j;fg+x2`KL8<01j*h)C)zyNyfnLEH z;e}Fhww4NZ)$*7$Ur>`)tIC=W4r7>UJxX)nhAt4ZnBcl?wsLox@xsEwPQlX=lI)vG zT=D4Ei~YI2gWyUyfTRETnMWgEtTid=ABBOAdS0%d9cU8cwYkZJTt?-D_}r{whP87W z-_7@=jv-QCscs9l0lDQdNr|8UZ=~}zEx!+Y(uwEj#B#itF~xE%>hf#UR}y|AH$qCD zVpAB0_er>S#I)^QV`QSs@irJrvA7a#Bx0bNDofatN%4aZzTVzQsWXQtP93z2r(bCc zU%)VMca4UyaJOQ$#Ug1t`RO-cGg!Tq5@;Qof(^odrUH@Tn=ibzAYr42?a5;_au|W+ z-=fA+L*A2GhP)R)o5~*JL|`K6Eo%-WQ2~DR7xvviiW(z8rxX*Tz^sdc zg9*sV$RZdJqzz}1UT@n7$Xv*?0Qoh)KwMDog!G#U zW0PqGBb3a@cN4UP60q>Ek$G~m$+U#Q@f^j1*VkANkD5e71Xc&-kYva+(ks+R*4HlA8p+=$vp{MtnR6PDVYWe|a3xo&}U zkl@t;BoO3@>nFKVZ#M+=BMZLR!wAXJYwP7%(T!d^`f~hm(nrwFo$o2#_|Ps5X!Z51 z7%2&)n(z&zno@_D1-;2|9uQYFm{+1>6XG4)K z55;uOm>+b9jfyB@Bc-5#;{eQ9iaU^6;y`aaY6{S4wU4MZ#zrf`N9MJLC$&Ve7#XhP zRx$adzkx5((O;^Wk zqeF7}TJCO@0BGgrd4KiwF?oHeM5!qBY=nqK)zW7|r0wbokf;>~Wk+3C)(-+xVfVMm zbW;8&$R0<~Cr-@AlQLJdl8A%^oUp~IDNtV-UffQ)8odHJ^l^l}s4W&G1R{tf zU{Jln&6DuiD%Ns!a$2S5SC0n!2AEp;y)&;?O~v_e@lEP@8CVtHmlPYYc73q5zCNrQ zBJ=9mGvYUDmm9sWAj9Wn8?cb|Xt?j$nTC#z-*ayQUIc-d=iKS~(ATq3ZvMMNkMKOf zmpFJeA?R%(TMsCK2z-?~`NxO*$G^WHy+g9VFtyR=6v$7YJFe>urZ2q#RM*i*NYMjH zX7F7)3LdC|ij)+c9wg+h?Bc@R3YI4VEtAq?DLk9a0yVuX1EBvn*J-xZyi4#PL9=a* z29IxoN~xJ6iRp(u=49J$#?1MCMTK#a0fJO>QX#G28w$V+u`DfftL+VYqfnsa1aP%= zi)8QbuYRl1<%+nFTec^N1q*tt`7KB#(WVgI1aug7AeHWWqHmV2GIKo0# z&QXN&YX5)+0K49kv;!RmF#tlYZui6OzD?k2v`Qj5lMU9%#heXT0`{s&9^P{j{&*GM zso5UO2FQ9F(xVNe+~W;_xeWC&A_8qX4GxF5Gl0y&eIQERLTT*Dsn375Cg8-c51Z$H zh5bGJ`gnirIJZ*<6eezHY!m>=tEHw3=gQrc;VOE-B6{3fS1$Vq!e*fSHHsv*lV(Z*qE1c zT)`VO(7G7MddN{bxV;Z?Tt7swl$BW6_{xKC4P{#!07Y=QQmW*hW!;QJQt2>JN< z{0>|PI!c9wh0%z)cW!1{^!E1Z7yi9G%##b34fZ>qL`vdP@b+&41%?zN>^9=ZP`c z_{zuoa<8h^du_nS7Z5f|sf-+W6b4`@s5(j}Mc=b6&!WY(=g^|j0iVYT(aaIr|K;^x ze{(|w2kN+L84=k*e>@4-J7?fl3{w{g$%`O}`gG|z6}|(9ynGnN5oI`{m+vZJcVs`I z|D4*#yo{ymmw&_02GNEc&w^|dkI@RDm%&oU_>AaL??b~cJ-a3@p+bB~r!%_zY0yG90E4<3QBv9Y*= zgF~sz`bWjFUQAs_#R@$~pzUZ}N7%&=)3V@_u;O2i!qiO~v<6jErIs%z_=cj@iSaZ) zyct^h`4baukC_^;mxr5M>F>}4oJ29k(8!21rE`RdR#}bfEiG@GamgkecjGiN~GeYQjy`;3fbbXH`3Mk zLt`I%dlhM4pq+q-FggU2+z5FBP;GkBCx;a|*Wx^{k>HgB;5OhD;P?O{F$GEZc9C}& z>w@@HUDey^c>;&mADeW<%jErbWjY@S$gh!k@y`{NrabeWBLqjv}P@?RJO4w zrV(U4AbRX(43Vh7o*PdIy!=U%}PoJua5F7*jj5;=M=9Nq2SCA$vGg}hj8Ec26@e~3@W2@=yi zzBY@PL*vleSp;?j_om6b8j99tT#;4L?72xwsgin&AC04%91^2xV`LQdH!2g;^m=>7 zkwd}AJrD%PG>#(SnRc9ZfNsfGD#wZ$E;AD|goB2*-N@8nk%M0yEkMU7S#n_Y;+Ya)9QL`r&&Y`*&Xf#NDxk%(0)xJS*g z#5Upy7OkC&Suf3TK{3S(EF2ugudzIggzv#OktCRF|FE8_m-yK($@_>b15+Wep6ty= zo7ei()!^Wus#zD8V=Di0~%C1hl{^#?g)9kCo;0O%796}1@dsU$%LvXYJ>jWqg&FUdK3QVd|2oegfh{1{?Pv| z#UiMU_!HfDopQBeOV6|?`q+9>ZA}g2${Qe>wHynun}ah=gPATe|&Xd%nc{y3m`^oF|U2%sBSUhK#|oR`Z1 zrW=8)-O+M;9Q8vwaT4hE@(|Y>Bq!Y?tqpjhEz#RD(2~^HwX;EJi;R-CzBB&}G!*q8 zoTSH{e;^%1N$w@$LrGLX{o;SCYP%x^2ZP<;3y&{ZXo`y+v9u0scTTI~q%8A2x zAY$yG&=rIdIKV+_Nt8XET6#Z$ei<-&l}F5XF^Hnqm(O=hADZaXZFf?E#(eouG|h;I zgwmbh2^7oUp?`GFKM=@XBVS*wfZs&uzGE(xEwX;OkzQCp>!|{3P#N`-7_aTV-77B& zOXw{Aq8flhL&`HN+QbJ#SJEi6P#uwHVZBLL-+VQr>sR4EkP8C3&+1=eO z9tJ2~@vyTI_PEnb3-^fdw?Z)w#kg%7z%=`f85uah*UD%5omi^?h>Dp6K*l71-o$KC z3f!#iOoBBEj@lE=L0d>45PCkXrhl`vkb&VjIy|iY4Gpv-LTh1ejzp0+ z-uQtgUnhUX49?Qil4R@}Rj-p6*tr`tzx;$6{*}mgb<7Umb%-?$uGoV8j9m!K!TAj) z9+<8{<==>6DN1`sYD`P-xgmnB=3luH#qtS~a)S2Z+abzP4w^$7>i3|KB=O$(*vUhb zEGkTTqHFZjUW`Ia%C=XtqO|R=AV(3glU5SY5&R>84j#ane5%z~KwBJS8<_0HE7!Q~wK?oZMu4wo*1@Z+yv+XXORfY6`ReEA=ax%dcV}aFXY|%spV&K3XMCRf zAXW>B5Hiu?XXl=1AT5~1FRvlGVjaqFUIfx}ciu-R;*A{8b?;~#BuejiDld}s*YzgQ z10!(cOJsCAoZc&SIvRk;L1Ig6R8PnO1TO^Ag|Y1P0++q7w->s#0VB`}dhfg8e9erO zQ0UvW;)E$-R@v(zrj4q(4;`j31qIP~FvRBtX1@3vLV ziM8ngO6HIjiUkHw#Y!yUQhwM(@d5{UihY4E1%Pl0Xe{a5di;diUX~;2L05)hCHu20 z*vRr_y|A!{^W7P%%<(RtHg;m91LQ~(`auB$mB5|(pKk;W@Qpy+vD@-iBDT15mZw(D z5q_fupfDWuZ7Zd-098vmOOyZ_cYkoJ94^qCr<|L2uSgfSF}A#SU-Y)6cla?w7n>dj zZv;tVs-V%Af~Ws>SzFPxk?)E-_%5Qmn*TI|5)w_3+Z034e59}nnC4W|;{>v!HCU zh>ge7DA4Hd%mH89e;jQk+}=~wo&p&|>)vvjuxTYP_9doMHpy26ob%gc*;?$V#b52e zB5{Nx@Vp5xN{_Q$_`ni~=z~Ri&xlvq;izf7GsHowo|(}0naR{FJ%fMNHIS?VMgtLe zR!e~7U^#~9;o*S(T8$s8zxZz(Ra-yL6QcpW=AnTEfaa|u@U_^Ms& zv^y7?yYgq9M5dhmvM?Q}{sPqf%*dMfwkz=E-21C#ZO(JoSmg&d42nguAGadwK;uI| z;`)-@aSbc9f;21C2!cQJzu1}Z9dv*|7mP;)*ekED5R7>|iwxZ7dm0Q*ZwHe%s;cC} z7ypo+~bCP z<2gIyJ6yF{lc;)2&aBP1bD{B{7=#`d^!U_CBlUT7Le2;4^ZUWbypLz5R0e3*#q`Lb zqr}E@B5P~w(C;G`j(hCuMm(S0e3}16EIHCfdfNLkUI$hpvK%1#)`tm2kNGI`e;x{@ z&slk=;lm2O8}THyJ!$pj6a+9JP`llB`pSf6&JeHIwAQ*J0WgR5e^xJb2K{+e^m^;? z@O8_{6XVyX3W*R$xP2PhrSTv!!B=mBN5Sau^r3NALX3g&Q1dwcs%+UQZEoTOQlS?k z`3@AE4pWi+c^~PG&)Wt`^6S<3a#Ps#@u7dz8;Z?+c@LhiU=%X~qZP*uoD7-K5mw{P zfHQz^dH5!m6dw^wiRIaqvDcU^!41K)I*?E%24?-C ztI%T6=&q=++7H7LKTF59s*Gg22XLS zBOFs7%7%Z%T8i)_re#?;Sq|-C1g}zr!6w-f_`YL(o zlviaEv?eWzaAsy;CaikwJO-txF1FFgK-O$uydEW z-Rvj4Me;K9G3AvUgmvxAr)266x>d@t4&QgQHSu|VOiVx>xnAet&)m9`1dU(C>>N0I*2KW#R7iQvl$WOAZ**jPD(F?e4Dtjef1vcD3zLpc$P-skKAR!KqZp>dL|3q^uxJws<=@-JhOQSCqM^JL@ zdj{I?xvk+1WF$_JqPQD*3H+`bsH!}5t|28D!|Kk)0@!r@8 zU-KQxFV7l5X8~#cQwP32y0h^f50zzxHhyn;mBk0d2RIOBk5o)=6KhAqF>bZe%jh@F=c3ylC+yyHu-{!7mgkN>n+E=Za;~@8qj~j4>zje0?V2 zM%|<1m>ywL{qxf~W}<;zovl%^X-`Z5L~xlY1OB`8oMyT&q;0zzPSz@0z9VEg?ZK+U zgq%NG4bXxh@EC);=$qtgG32H=b%L9TR5J`b1a`*7_wd=Or~7~Hrvp)T4|Gc0on*{p z0~fZ3T9xB+=RSVKXTj(4)bAmRF*NqxCl(}c-)Bt@kA=pp1V3)zzj&#Pdz*qt|46ua ze^)aS0Z{@ogV~Y?Ee$z84kfbd#ZisedcVnj!}RfEJk_qP!>8=@e@Ebse8XN48*kTf zJ;x*P7Aa`?=2_GnYyov(2Yr!88 z*AZiXY71!j_a4{NLR*z=F_UO1nX-}R6(s0-%Mq_sat^aRQ=;SHOWPR2`tr;8OJ6!RYFWom-E2%OCb<^ z>eB)CY5Tfbf?HE7b+w%1OPZ+Ng(GzeI_hN1$~U_I*bS=)2jUw@k9p$)kFZF8_l5b* zdFs^s=8rflfI;?^==6kse^-XO^n{Im%4Mn!+5gevr~qUxpGxLVw{^5oKwIZLr89y8 z_LWJ#aHTN%Pc&tJm%mr`pWm!c%RUBt)_Z)L=fT;z%O=3CS2j&$^!{OG7^SNY z`n{5lofru1G$&g&?^WluR{n4L&j*ZE>*%ny`2CcPM|{ zro9&HanyauZ%B(`#q%3k)Vu_tS3sA#d9Lxxxa&>h=RF?TqHa!|!;043_rp$N& zNgMhGjDDnOk+n@qj3C*%TyVF7sMYB_vvlnw0)J}LMo-0oJL z74pH9yH0CPt~8mUg`f@ju+JxDJE|KnSsIQ>+B;!|_Gz^or;(D_$vXO9eIe&`Y7Fg{ zvVH78C(Gu-%HMkgQs^0k9bV^gk(-07+zD-&$hG7&_Yc zAfJxurPJR_E^^#P@ZudiV!zmcb&H_h2TDpn_Zn$XDg~VY#T~IFA$-7n9F0MQhUpZ8 z?<4Mt#1zdVLsj$yJQX;R07)#b52ygIVgMWE>)K*Fg}(1-j?U!GkER_K0?4O#qY+z5 ze@pg#Lk}UC|6J3zVy*1B;_m?5ynZ(vkki!St-$HNaefOnpg75-e@LnqWYee3Fd;2gS%!>|Qu!ycUzYy`Ixc zeSR{YjiHxpeKM>5ocHZ`cy7vXX#wvCA(rl7hx0pjHJ&ixjEgVZ*jRhsPn z;4<{~{vOU2m;7|NY0+`H`!zRNnxH zkS&-|2LRv6V^?g+p6W)f95o3ju``N-*pSM#$)JjvOl4BnQma{-@9ZfQRig{8QSbx8 z2p$T3{TjjtO8Nm@3}^qhe9uF@znd+GC8x;B4Le6FL*}Utxe;Pd>=~qD7sk(Dszr!h zP8c>xWEj}lGN@%a_G6&yF}|&ml90zh6+)Z>{^vse7rg}mzit*@6=D0+6iE~Ze{|*k zvem&(hC?t(4^y1(Q(9Fd$X`8oh_)RuOig?mI;z}d_t#-jPQ%5veV192TRXcK z+2UTzt`C4OskNzzk!lA995P5q5)>+$qm5){B-tt7$N?zkVNS*Gx`1%6qr0OEY{9h< zph4g{J{Rvr!vi!-K)#$ral2)CA8(uk+|24prdZs&X4{u!Ia293^)=d`D@iOYdKim~ z-&djy5*+aF>5Qxo0SS_I4u5cTefJwI?4v66jv8C+#Zh;>4UpmWh zhCI8Id}mT?JBgGcE5#tDVJ!IMBJ_O-S38&Y-M*eYpzm`U$}}Ykim~{o>@dt>jQP0| z`YrFQUmwbmC0J)&Y(*i3y%D_Vl`cQ-weO9zei-Mx04Gb<|A6wg z7>MZ7i>At4n!Nzjfl6Xp??j%MVWo4kn_JT`QBN1MH)%jZKGVpdsx>-cH;c^;#ktHJIu_P;%q zdUV7nECc*TWdgEwBqOjun02IBLJ6e`MR(s>7bobQ$DE$L2-eQT<$w@_9Sc@=5q0KG z=33-W#U-40%oA11-5H(;>D10pHh!F<-C6bqVKSxjkeqrGWN}|KUQ14^U@p3G({!uv?%k z`Xd`54Jn32n)(K2&khW@mR`R$ zV9DdOkvgP}J^-3PP&SRqLQ94?|_qPm>72($})K}ylgF1jbk0JuZ)OD&F^~0&-&x}XneHszWvJvG}N?y_q zRgQ$YA^Or`@hV1 z?jr1jx72#9Ed3pq!U|MI;>*vE9Bz#N1r!gAme9n51v836Ts z=3}S4d4dZ#$YIv@iD$E_GSu1DpDS?=_pJi{6xlMg$sP58CEu-IJ<1$Cs5KnlxZGTr z#ydH2HUF&Wg4PP60=H_GR2Q=BJ-X^C`Psi5ZKL=gcfUXGLybKTXWe28UZE(>g~tkkVccLg3GQgZG|nZ0{@slIQ0E z4}3ReC$#19^PF|i#Rm%O4Uhc3l%EKyBnhQLZra(e&Bhu8h?Nd+sn8sqbKd7JxQ#D2 zK(A#(62|Y5Z)Ma!c6ob^&J}yHoAr(#T483%$a&}afO%I<@1tD4a8lB^OyZTfh+1&6 zfM=t00TQV`dT`7TN(z*hM?xB!#vj&MAtpE-uL=jc3jhL|ydh%2kxa*7svqD@5SNuz zdUb3ug~{SMc2Fm(I(^?U7YSBU=qW)#%MbYdq{fUl>`P?I?`pH(0)@o+iszEC-x(Y%|HRrEl(@>+&p(DX(#fv5U0GX(bS zKRWuLW1x!(i{ko=CL-$+RkgmQF}44?H#av&Pkh(XSMJ4A83Y*ohNFoY{ab7`ec}?u zHkYM~vz3NG$y2$Pqoh#;G?s{h&nCf1D0T8!%k+rNx*?)WfF~E&x6t$YtjhDPYxtof zpV_6-`IrjC^Y0gC@N5mJ;Afg?V8tV-?@xxAg604-7V3B;(&XUU!=<`oPg6kf*}`HB z;rkO_5T3IW5$vPNho2N#Zg=}|FMt3P`}aa(ZG~b8;ywE}v+VUPeb*1E#lJt{_kV@e z7~D;&{LEXx%*ljlLO@Ot9r2$~wfG7A9mTY*!==_fwDF^TF5Z;R)7wX1bNi;UE}n*A z?-F#KB!6iEN7_$6=Uc6-@*kM|aFck4#YrflXzR$p`oGAlR_xm^6I_ZfGzKJHOIO%( zKQn?c(7Ie)TqaaA-t9!ld$19@ma3A7c_q!y4#QtACcgCz4!)JST85jEKQ%|sd(ju8 zqNcWv8o&iofe_?#w9U%ZL<1I&ZbGDmcN?!XuI1e5254En`UhZ@f)qMT{4S&r!wm6twuG_}S$86!Olo;|}TZ@mqb)@M@XP!5$0QT3Uc#)#74oiF;{c-$&Y z7RoFvZQhajNCpRAhHhOhNu{AxFf0#*1N=Af%FmyD@ize;UdqNB3Q_OqO?D!$$^27lka+(ZqM0Avv_{>4ljn{d4db*PX56>PR9-dDQ92h%cG#CaC zmT50BEG#T3DGBQNw%cxd@x>R>kHhlBi4*bh@tiAg9slP)|Cy`sM;>{ktgLLxlqt9h zgUb&;{4hE?`nl(xn>~B>)~#FN;oW!Ng{xYvMzTNn;Dfny=Yj|9+O=!iv}qV0uUxru z`t<3DW$M(aa79pX<-oPSdUQ<=kma+G1C)$Pqc-LjadKd_nrQ<|bupOH-%P($b=AQsLOz+S=BlRI6Ha+BSoZ zUUuq~9Ar-%Eh-x{Mld1O@L|t=@Xni4KKSs1Deu4g{#zGQ?)l4IIDYuid+wI9$Rf)H zl=nV(SEZtbiq5vS<8QxJHf@RqT^+iW_WnhNJAM{9D8BY;7dg-yb%n(Rg~dgMMI{z1 zjpM-&h$8Sc2mSj*L_~xH1qTEK1s@0s3JSp({lI~+`lO_zqlb2Qtgw0W=2u^R6&mQs zks~{I?u5dI<^1{cK@MPWO%mLF_ub$k7|z~s!wtCK&{|htef8nPhx7CEq1YaO{Bfhv zICSVx*uV46JMi}CqmPaqI~FNVO-;30t+WP05aQzEU=N=-BIFGlHdIzt{&tuF@RMc^ z_+tfka=@L{7X(4+@l?_0WC+6aRx5T%mI`J|Fja=0Dq=H-q>8dXcn@bdk*9v zJv}`yCpR}YKPN9cCnpamDk?D*6~&Aj=}r!C34DfzhT;S&ys4>a(4avGA1om&D+`ts z0n^-f+;ImCwY9aYR;?O2awI%ocG+d92k`L58*e=E#1rr{X3Q9<`~?dZfIYy^uwlc% zCo(cJ;OCiVo&hJowJ^Zv-~RSD#IkPPy7KaJq6RWK=tvGkPQ^f~jCzC3YM(S=vRxoD z2T<6*6ge;uGazz6Zx}+O>vbx6g#l-b5TJQ;1BCl;Gnn|dp!8akT5kdkVB0ixLJsVS ziCGgTh%K#JwXUUAsnlzm)vac;_2LgCP!-$S+M1i2rE?iFWL!{imVl9l$*dFAt#NO^ zUON2)HJe8~%U4)`&-mFh2laLIS~(OpjVap~2Eqq)kd;V-XfWpt8InJsUqeF!x_R6j zquF4@zrkQKSwx*KejDo0ULAEIJleD={tA1z+I z7_ofu#TWDE&yS6bg-=9*Fmd^oEnAdIB@h2Mf(u6uQ2r=4@Vn3FezthglER!K+U1gg z!u|!w0WE#du}?hk??2&;y?3CZ?T%@A(V0Sf9ctKS;sXn);Kk zzEb_syKLqF9iV$3C_}>elLMw|Oct|v;zarN*Pz5f2e`f_fevyB^gWc3$(l8EWRCZ( zEltg!5CT*a^b_ozYy!ZbOP)MlY-W-D7vJ0y0#=74qqqQN-L!f937LXZO=>!b;|S)fqh2mA<@ zKt#=sV2KXWjcaYAR~e5SX=!Vv{S_}5q~t-VbL~#%vo>bexWC=N-ePhChUws`Cb-AP z*N+-pFm7bd*b#-kqYK83%JX%}NLgf&<+mhg>G@+vWRD(OGJ0J3s9}}<)0Bob3kDIV zbq_Km{DheUQZr_gT}(`Fyz)vhD^ILy5UZ=j%JR;ou&C`Hj};FX)T(SF0>D41K6Qjij`QF_7xF3Q$3`VG`_UX9T+wmV(Uz8<<@>PL^{K6gL~*^D-wv$(Aja zzRKuE4y5+M_Dwc}9AMB$pJ7Kfa##i78;A#{igG3IFHnp|7 z)N{85xF*DmF+_a>4JH~IrK3w4>t&HemfxB*)QhzZWT-0@8){Srov~G~*2?Ul6Z|A{ zAUXu2O-M}6y5^d!Km95BravX$d}GQVZ*rH^Kiv$0A^qkXPF{8O(YtPMQ8%%t4^~{x z2m;goMs4b(aWt0;9mC0i^mxJwgVkzgw)CDP2CJ~KSWGZ;OIglEBtihQON+CagRaPd zQA3aRHSEI*dbP%wQ*_XKplR~+D0Y-T#ASfko$N6ZkE6A<=IYDE!-t#N)Mp>rcL%V? zj~r^`6xpXYH)WAUmfy5!v~4)3^*WWRP1B~-E46x~K`k#j=nUsc4xj^|aYVstwbm4u zl!XK)ZCZEyhgC@{S0$}p$t7{s4-jrh`r-S;<=Px zYj|M-XdSI9q3Ih6i&maG9b}*nLDM57QB_xY^)=#=!)-0ye&(QkF(aq}lFG%PqYq8X zB8x1)VWCb}M4F2}*eK&dLm~$xbilu0=W7md z`_Ci?I90Qy{@@89*ZQoJ5#G0GufM6{j=L)FycaIUm-*s2@odYZGyrb&& zJ6Z=0EWi3{G5kKLm!O4?M8f#|MJbV`TYYbH-Q}RkFQemr{R#!EOiRMZ$KkRCWiAS2X-3x)3Be`6EX$QA8SM3cP8y` z7C7iS2ZUWBX)O9?qdH~sc(JL~B8m{bT{MfbTrjaX>1b*<7#$*gZNe@Vf3pgf@_as81U z+atH_JhpxNksX^;Lqp25b6c8KDz+nGw}O<*)6uD=3>h+hqcE^dkf`B<9H{jMz99OZ(w|7Uym8`9h7x!!%By6)D0Egbv;CkLE3v&ul^ z0H^e2K%G`a58%;m+LTIVX<1%=VL@I_Zb4pter{fNW>#!;Ob>;Jr$>+YxP;v7yn_7f z{QSb=+``iGGJ2+<)f+V3?y-W42cT;>eHIZJ??h5wA`w`AqXZ2FCW`Knu= zoA>O0(kG3A3fHKWd>atfPL#wI_~wJ`!%JGNnn6h$BDE=DYHe+8sH@LNN%d4HAbC0Y zEltg8RU5gs5|e-*T*lg=3>n=Sr-N4>*@K50EbPq3v|xj6d*l7 zy|*9;my8?`kRZMG#PiSp{hB*Tdx0E)6SR+d*(sYF@E$JBC2$+bzTKNFKQ1E`{l+NR z+ziV3%07eVKQlSocf9DZTSVHdnpG5lF9hjA_-YXck%RpFd<8>ARi%p@04$JpxGt1M zmP;sIp@TPBWcmFFd$EA`=}ytcEEq8WQ*ayCUCNmQN~K<#_@DnsePW4$dJ+Pfljbfks;%^4^qEQ+H;8NJP!2wpp6z0a@EXmNoNj_9)s=-axlVU z0Gma?sn2Ky%syjD`i)ccVXAJx7!sOk80|R#{y`K*!`{PZ421L_9Z3;(Da><6%U`+l z7&MLwhh?8~$IMiKJ|G0FU}2_*HJltwq&G;N#0>z((@-r0_Jjd<+k@%FQ@Wo*J6-xA@G(8O zf9~fuB*+?-Bnro6=`)H-so!YN+kB}Q+sQ%N^P_AIJ8Fi*!L~jWakO?db3kawJT{Y-;$ku>OUMTjKbI=rV3 zkpRiE&(Pij$9WAHPfr&5QO1cJJU1a@@@SjYE?O;OQ?uCIB(}7PEiGb;N>nv=Ce30S zyfxBxRrR&blj-k2@%TIc`j?oMDK^%K$|kY7UTkd?mCdK5V+gXya;ZhxAW2&jeI~xG z^^_>vNMPVT)lDR>3uTezHzsP-f2F8mbsnNt+wB50f;&I%ZscIJ$AFQ&ZXbQwpy7YK z&-efSI_B2Dj_z~cXdG|&^GNT9U+&>Olzc+TvB?8z!r<0nUj4^F>$8^{X!Ok0Bn&wA z9OO%vwDSW{4fuqA&J`pL`Wq1B4ov8lVZ8>715ZN6SwXQmm|KP_`oc`*h9bI}%^W0; z8zY*;WizK{P8gr-J1lF$sEqL=vL}x2O0p)6&hj0ZIev7~_|b<(4&FET$)F)m9~(U) zeZuIIlg4IE9Gg99934+d#}H(Z<>Cv~+jhyEIEo)3*=I=Bgpo{O?ih$Hvi!y*cjA~# zU*GJ>V{*rjDxU0{_S*lPv^ZVT%p8}J98gm9hEwE#iRYlP_YRxx^T_`eY>1n`AsRAo zebiU$V-{?P|7>+s&whhF298zGvx9M-w+>A$HQ)Z&tBQVukL74R`;VZN3b&49iy24u z9x!(7>q|Uu9qiF(tY^Oo>~Z_Z8}IhrelTano|D@T<@NL#qVO5(1v=slC-8=m9zMgQ zk^+%06RhtK#P-otzL9XavCAMSqY zb!6YuXM#unQU4e_{qYyRq}M(AvSj$HnM%=kEe;+Tfj->2=}ow|E_ z;*M=eJ9l&@+aW2t$egfaXVlg$ht{n=vVLvs*3B+Ii96s&GBcq|WRazNO3Ln?QR~+x zY}>*me(Ppb{?t9Y;FL`D{4~$WOp?AMM?L$nxDOo_(KK zxi4i^Q1WHoLtmM(LDA=#IV%qI@*ceHQ0AN;4k{?pQ62+97bH!r=>(*x? z)0(dFdA!UZUOn&;Pw&AX2dU+btNJ~q=riIfpE2vU9E#0syVB>m$`sY@RoI{E+Z zc;@dzUR}EW@YRE!JDiXg9AA1}-@mTjpK!U))0f>gR&nbHMhlqG8p+eu^Q9G<(ipDj zhZM5oABTbu{qe5HzxqDnGM`~Rya&_67rsi7$iWbhgOihdPmzPR7OPEg>-#zdTu*tB zsep`MHBk9mT3Wyi_=a&mN)ArhauXfT-d<$L=+=-{;M#=n|Gf-yKugX~TaVcN$bpy7 z$Y)+%c;Da;g5&E#Pt=Ab)`ce39Z0MViLc!o)1dGk0%qXxrxBNXKbKwOyu9yIZ_Hll z^N-PS1+8DL3BP{8!`Jp1()*UDzTJAXSKrZ*S*@4%dF1lGkFD4mb@gq7z4{Cp_xd-l z&sg58&y%y31%g8y$!WOC=h6IX>)Za{K0Nf*D{grV{x=3E_3r!B!4sJq59VDz;L+Z< zKH9rKMcQKkn=K$U%!F&@?jg|nv~ttOSJ4OLV5FkY7-ZIOX>jjbN78eX{-YFqh#4?) zFzU)aLl!=B`pki{6}Q6au)#*UIi27%a=;-o1R1|xw6?Z_6L5Zjqh#9!SWRd3U#j!G zEu5vj$dJ*k0cOC-!NLE&l=Z@R_HLu(#L>;jfzPNO1BTx>{G&b(`p#Oq>+^4Se!gN0 zUBnPy~ zbU$CdpR_c+;XQ#?PSDiLzTy$4I5!ZWmm10iI#z zr>s%|=SmL9s|*?438<4G2mG0WJ2~j8u39V>QMB3VTeI}|4GlrCIh+pq%IS~76{dUO za-)!O!NL3Ia|CK2Rl;_1K#vtpzq;Ga9Q3?x{FQf4?%99%tq;67@ZnbnJ@Q`&40rwe zfBpXPs-pi$uYu#}UB`YSdk%uyBjxAi!`@fyGums=NQKWZ_@Q-$1IN%R!v4cOe1_1X z{Q(Gnm|`FepnG@^zhc01;2DZrhxPow5nvlM<=$^d4_xwpqdf*p=;1w7(Qk0iLF0Pe zhVVzy4gr0K;#zP58h=w#rPOvKA->{^w1FG3U60rb30fqHZz?%1-?V5N_Y*x>g^mg$^=D_DN~35}=& z&J2y4W&HNwy4Pp9#V*&g_~`)Yl3x)ykaj}sGXg{59#G8e?L>w5$e#U2D*BG~7%Q*0J{d5|6Upf3+k@|t)Ni=wfH9u%+?Np!Tua+9__EcA-ETo6vM^u-UkpL7 zU63VghP3tm5}OMJ0z=i zaGNvjWyrWBKvg`inFE_(DJ#sbs;JzvW4p;A3O0uYE#N$74gi<=9NPlCxgc4!!`+6P ze?I4s@vFv}mBfWk>knD}n#civU!Q%BnO-ksbLMcRNB%zJ6@7;ExD9?r5Ca%6LD6?O z9S1`9^Gy}$D~?_u3LpeDRWOn^74AQV4WJ=o*>nQ!ssx@vvGg0^HE=Y-R16$V;d>(l z@QmSzmv#-J7aIAFjr0(~!)F|r0oioF#|jX}qFBP{l}naLUUb~jjU2cZB%)??HFH4Z zz-d*gnwKp3X3?TW{|FvsSECwd@_%p%JT=mI=F5Y-O)2{oQvw6JLl`*v(sQ*kX*YZIRNkOj2xVYa23dO zAx_&BHdJ7{hckq+gi{_!m9ncO_HZhY(=5*vcW>Q8y2v$~NT8<-+(2Jm;QJh$oHQ0S zW7YI&Ig`e?lLJ&G)ED}Ar`^1J)7r{Lox#wudd&tf0)h5gMwOyXH$|thxH#J&h+4fW zKIY(w6Y){8Nv&<#)cC0A_$am7Y-UtK5G)`WRtHYZjSbZ)nWgmHmNw$DIqYz=f`uT` z>dGpEL$I1L9<#HQNT4+`GJeNEZG`^A0NqKCw=5O`BXtKVAZirZT1+@a-NFe?ZaFOI z>rgr2*=jZ8msjadfy&=0IY14!+AN~oq-n0rEi5W5EG#Z6C@#xSIvzRY?I|Y=FnMfCIm%&wZjl~^nlt(DRqcKaY6RUlLaQ5 zQLtNWg2imJ3xZ&Gm~o2O?dYE!4rGFDS4W%DAQp>YL_TWE%aLoN%?2B4f_95lsou72 zht)xyI!Y!nF1l4sc?OR`6JrgTGDHVvl5y!F-4(hixXq|(Ho?R!X{HuktIcV|?Smsa z+wiD7jX)J3J-g71ZqjPCI0XU9++>EU;4q-hm<&dksAm>YA#7PC4dAP&XL>=01|ir? zR*L~WEuug_jE>zc4X2ZX|4i&=!;LbCA*iM{c6?}omDgm4!uzaN7^XEZWhd{8B^a*$|yBKp^Jvy+csE4(WEu*-?87| zu*{u3s~L5kx;E5!6K$>`7+Y(KAU(kF=RldD7Fu!s@SCEo=mH#)>EfyFzb z%65bn`>l;js~6)_DvRsHH3v%89?sK>;*#}86N|0oEw))}!VON*WOW`&tkOHgBPp%% z)wa?ak9W-QN3%g-xYx_AjXI#D#QUa?Sb7cB<; zn(x$xX#%ghG# zimw;88cpA?Sk%y}uB&Zg>0mX4{mA%Tf;uXusZk3Y4fVA(H8pK*ZSlvW>RTG}vWv`C zlT|R5lokZ<-)A!0N=u4VDpf^!DKvL=WmQdGZCzd6St<~M?UWn<#6|=|MBt9p5ymXNgHhkVgWB8j$&Fc_tS5deQR_&nyU*!!Vae<=N6abHPqGb*|VXns(JPI z-xX9;w^Y}K2W;OS7*SJJwPF3*lER#{?CK>8{NvJ3#zaOWr4&RR3d+sTONft4P0N@+ z@5@%TPNmbcuG|qHeYCm0X5r^^R7S_Lua`IJX*B4x8drX^FeW8euT<~dyZi9bz`9y( zO<7sOu|rMG%B9Pf8BL%stX&d#e}8(fFXPgH)HCbbV4!KC?SaWvqPTc-LQsBCUZNX(u8$*i^8cWm3f>GL@gDp=9cEhsHiBdR)0J$ z(kPgc5;D=3Qt%eq^jR-&7rcv8jZ`>)+Ep|l?Xg=R& zIvl*GuGNU~H;urlPqoHHg%;LpP^&FuMXllUPy7!b3B!1O(N|y9v^JzCWi(dgM;|}2 zV#!yjCkuD7r3o15M}_QG8brZlUj5zjlESQodNSc`(*u=9a}bS zj*CCOch}}!`-5o?+2OR=tobJs4o8H4;XhUF5ZA8w-hjk81krBW_WiOpov72BckbO& z-&DSG#p8;||Kg9m9KR>fkTz9ZAG_`G4K!VODF4=T^cTj3-fhxC2j83SC%C~KZZ#h~iR(b#IRI?zw^FM0~Pmd1!<2}YyQpi$2G z;+ zwsGwTQ$Ll&qzuA_Uk!% zyBHY}mYrYq`6n~A=x+sM*#0fF=0Gs7UcRKVC@V3iYW=!3YP%>H)#3X>*8H$oWp;v* zAn~Hp*x05ybR<@!wFs6~-+he+_|;s0aOm&9`O1hkLGMRccC6o^wTe2edVgR5n3LUN z{qCEuk3<|UDzE-#;bPDNYR;#1^r!dwGA<2p7f#&>)J@zeqg^z!quwbR1W_l@LRY<6 zRNEvcy;U?|+~uTGo85_{!EDz#okqcFG>I1KX&qpUs2c)3gc2dR9D!&owCk^T}EJuS7N0+J^h)TEq9L{+u}Hf!LH zofc6f58x$Iz93QiB<3=^uGSLEwWy|=zg4IUegE?$afmSQ}K8Ij4q1K^(SfC~a z^nvIRjkFliE`W<_b;_iqB$~2fohIsZS3sy;kpqnN6C#fsIB-CvY-(&%tCX#6ZEY%* zrlG0+tFPv_Xu*1=`PqnwBcKRrX(<@5YqV{ZmDTE&y6?XGE+ZqYroIg%s?vIUvW|c5L6Xd#6>f@7b|^^S0eqWW{DiyC^Bl zS-)jRRP+%rf{N0Dz`$UO!|ZT~Dai@A9J$WROfN4kSo!UD<<(VLIoUeBxwTc9lAcQ) z{b@M8*Oze#fLp+Y@dBzrg3W2BNhrIO#3=~0myFY5N9Rd9&RLyiRBL+3MYWmvv4JRq z6a+o(HR!KFt?5X6iqMM}f|Z7VcBx^IgA*3GN;KI8*dbGb#Y*{v72>noz&BV6f(2ZS zc85i8Vlkkhp-oZgp~bTPzRO~eaWO%afo=u69k{~t+f2uRh3pQ5?~ zGCBAi%XyLmb~KqaO{t0TTB=^mj((XJs#Y}VPn8^1lU&=WD5^8Nr8MXVqeZ2KC40$+ zcr0HN!zv`|H>;I&A!TWwuuc|VBe~>DJlhq$6OLm4j!+JidKd45`9(^S= zr4udZEJAymLl$pL9{3YUyHAUtMEQF0q-ZmQF4c^7(9iVnZ*5{%o(13a=* z9Oz2cC|H7sWK%L()1Wj;y*5Iig*;@5fB0uQfLzFmH8=7@s~^bS4jsX*s1R5*HoJpS za3)A0bK-!FjBWy{8>BnNZV**fb}y+e&^hV@I0AQUw`@P+R<_&ln+uPUvgh}me(3~N zj*JM3J5dcK7uH_L2#^(Z!l-cFk{nRcbR-8pw9OxFe(W<|;Vpg6fVTJX9_!h6jHmb5 z9{tCYo*OulywNs@xQeMg=2Jlz(mqIR7oZXJ>OXCPFvg?*2(Bh+XG7YefcxS8*(uZ~ z`K0ZSSWx_wK2^ZB9b{i6kWx67*{}eA71B95pbsyhW~`nekptGpxvB>0Ea`9e+9ZLU z(xD3{1|F0vH12Zh)E(5%y3irOE-sPr`@?B9q3h~&eif#x1&JKgZ=MCr@eCi7fU{o4 z;Y#NzLzh=|;&A5W05{VSSDe>=!3=Gjf2$o;hCKDh6A*~Zl@<;(zy&7zX?cv59=A*+S*(*2WqvNdypaH_W@}TC_Pr-+b5q+jJw~O z13q5wH?lW3?1Kl;JBUxM$lsdZ_?b15Ww>oFZQ7(nCZhv;0pBR zAyVgF#0O9N6gLDXsb9gn%Xu7^wQVoyw5$+W=~{`(p(cIp9u!)Jw^b@mmD1 z;8f4u$wBv?IT)?zGg@)Wh~9%nBo}C7vs>eG8;|F-#^=<>=C@qtJ(NDL+-Epc-DS6p zeQ4wi&pyxM!pjB?zvqe9JZ~A{IbckW0TbvsLcbx<;@95y^8d5<6@YOZXWOgONtP*$ zwk271(xyr2FT>ZSK{JQbP}?*OHq3GC#2_*=GsesmGutsU$+BhPF)Z)R|GYDM=d&z1 zP{)yzdoGToqcECXJBWp`{^T62Gn_*pSOEo%AkG-DWek@1Kkc>p-D#=u@4gn zLB{W&y88BxP@hfy@2Q)9-sz@aJOgr&oYAWGtq<@41>z7;v`JYVX^SS2+L~{^j2zI$ zOBH43&N)aRf$t%>(kBQ8AbJjB{6KV-C6K_S!9|z1uN5JE4a0F+^&B*6>1f>1(e!SY z!BQKvPEEf*IrILsMt3e)f3#Mk7E;5Oq|q}UtlhYEQHVYJX1~7QI=&zq1_O|2_*3C zv2F)_vOxLvz+1sGHU4Zx6n?_JBXB(VsRQ)b4$(YpX}z z-FBe#<&Va6dg`r(>rdCt`tzne#qac+@uzk#j97Bu*R7tNz2Vq^sT+RV;+dyAPlN_d z%WApxh`&zLyFUAT|4&;y|I+(|CNDa4XUA8^FFLq*XW7-a-hZHiwSM~3-*$Zcd-Jt| zJt0x_9Plp`?3a^30^fJITrRMLU@#~cgYB9?0^b7ASV!#&@K(Fs#J8_i1L2eJC`J|$ z>cUktu6{+IfbHjU8dk_`FWubAnRQo4V>v_S};&^{CXS`F#(6(DKo@>t(eb zFlOf5)dkM<|9ktx!GCJ=PP0c|I%Bd!#cc0sRxh*VkurAmZOuSCQnT8>pEGs%^koh2 zX!GNH|NZjEd1orv;ZnBop#R`?$~KYk&HHBa2T&h$-NjY`#j*f!JFi zK@Jl5A)(5z6%t6`+knv7m0(}19?;)0pmG+luT_JXXZyT**nZ-B4r&ZJsA`=9n2a{b zSw(wP(wi5C*-!6zcGZE>)Qpz3nq2n73VabHkc0CVL8=LeO9|3d$s`IiyK?+(&iJ2KkWYT63wJf%t7 zl&lU(8TU&KS|m4ao!q#kvvK>RjFwWP=E+TICV|wbm7@vuH%JXy(nQ6EEhU%XjPH}5|OCP;3#qfsFWds>1?ouu6*lHv>K&h*O97yTyolQHWHffoX)gq;F8)xHoP~lL_ zsTub=8r}m2K>8luGRa#~lXi|lCJB^mM(ny@rS)C50B71 z+8T=ZrzJ$6_gp=M8U=>D@HRgTv^uTfA2DQFy`R>#7GYq72l9L#V!1>OR`NmZ+c~qR zcWU1v43dC5U*^EmeJME*@*^?yZ#A~abrrzd26^8X&P^@N zxt5i!=0ZSXDK1wAoM9-)csU>i-9Kh*CtstxS|BQl?Q$Xq4WZH7CS{Rg<{uC~C}loK zS83S;uKpXffrh446w^TnpzWabn>*3gZ`_*f4O=?0+R!(RS)>T1bg>*l8yu6H&NFyb43Eg-4RrTPT+C@-WPQfg+jT`O{ z-at<6lH6-q#ZnDL^#bI;hRpPlhR+cyzm1av+qFuNEFrebha9xys~NU)KwI+}f27nK zQx8A2_`wyRs>Q-bu+S-jh=5}K#F&LUWjKmfgd<>V@FcS2zLsIWPp4i zk+?NqZRv9VTA>D#gLCfA%Ya=Ka)NEZ#(UbJqBLmrc+xdxgg~VroZLweGX55D z!Y8%BlVN`P>8F|j=~GSJ3V6JO1`I`%a2K->grAtDprByv*s&AFjbFEBEyY98UH-ZM zg9F~Mj*2PInKnUk4rq|Yx7oT7NSq*38uc8wa;|3OOF>hqRa9C0Y;bwOzs9sNrq3BJ z|0!d;ZPDW(+qtmaFB@_I{Y@JtaWya0Hfe65cnAp;NR7@_!iGQ=JE?ZgotC;|Mc*w{%V>9R1FAvxd$0LGxcH`LYC{i-8{G(Zjo zXc{yp4)v!+8=pgGX%>C(13f7A&YLh{0$2RD^b7EaZHQC4i=__jmsc7_PKdk5j>1xN zAZP)p1^%8;weUT&Y0`j2k58QgR0D~s!!R_yXDghLCmK|mVygZ7_eEI6qDCmSLn$I; zBJHz{%o4dIKv8h;Gg4Hxp0m{MUElWO_LaNVFF)YHsv`%GC1B^yokNEX9WrFdfB^#r z4H^W?h!G>g;qZCSZqe{?#LCIbedd{eE}A$0jW^$Y;o0XQyl0Lce)Q3Y|NX?1VNcjF zWrmI4B!|@bU#K5W(=FBmVi!KgN$8$GZ`%7yk47lYf6A zHuV#UeC@xl;++C;I{StaxGX?rC&E;jURkQa4?06CaocvC{ggp95A9kATBCOj7SFG_KBZT+RjN; z%{G?}IXDX>49brL9V##a9zcECrlo2utg)bFg_)s}euKNEX?j@IX{%fqD7r7c_@c0| zP{=)C$5<6`)iPCG3v*2=N*a|%im1ksgBYmRAR~0YMooo?AxDgIW)`x@QD*LBk&Vn+ z$HF^V@G#R)GW8@gLOb_tIeug}jSQGN!qFpBJiMoY6OMR@tUCu(TFIZLhEz}xKGJYm z1CLW3IlvM1HQMWA#*7(0eE8wRhsTc}FZvHwuU;*x@)#hilot`>qt2foZ(n=)C0S+% z_wL)WX)}cLbm6Hp#f5$Q3=9Rmixw^;iWP};`Q&3o2}7QH<@NR!l};Z!4Y%yycL0R^ z{deC34}S06w~^Jls&)SGV=xbt%_B#SOc*zw2%osA_(|aM0f|*u>7JH4CQ0houp!l5 z{5^t(Ld^@QI|nFoC}qaJaBiK7o;R|x6^bb%l;8xFgiw@a&NsA(G1~Asl!_lSwhaO! z%QinaF9?YuUAmme0gd$YT@XpJiB>*W)%G!JxMy2WpKth8?tzm7GEv9#y`8;9j2wu* z2eNR@N?SDXBYEcbXliS|xeUnxPl*BAYnU#^_OZwUW{qKH?}+hAB>V^~e`#f}mJ1$# zc=dD7YW@LMU~jQ~)tcJm6?q)V+%%|5|}c9k1x| zUvsh|3OiN2%bHRbWRcy>oW}w=n)msj>wZt^&x7T6s1U6$A2WbekO z@^392`_PydZei;`WJl*R&n~8wL79OcL^B1^RsX#FzNmMo=SD~41U7@}k;@!-`&E(y z)S&>X)WL%Xj~qF2)TmJ#H*Va$d-sqbL*O!N)-2&I9+WA%+@(u4-p&Vay`>xM$btP^ zH*Xm_c*v%;8#O%u#b11?aL?|8rVdS@clqQaO;c1Yl$VnmDs|1BG#f!c6u<`h^y;mt z^4}kSbU?rUz4Lp0_SwvksuUESeCM5akn8qvLjso}sN5=Q&swPyB&lD6MttaqgpJoi zbOda#0=!d!nY#n|sTH|5v(nXOL^E`?vNr*^*)_Pr$$_L$&%rhjO#$+9UO>7f9BU*w z;NS05F|0t!nACY@2WT>`hRM*5N~Gap6hZI?8cN`eesL6vFm_6j&{vC@V$^`^NIR04 z1uBy)=SC9Ktaf@FjXUya$%Wz}cfPwLPe9CbO`MDHRmg!@1gVl}d<)=xUtGPBpc)!e zHJVJoo35m-6lw@FnX$u+O*Hj4pz{>hFBMmo?7B&FU8A|LG(7cKS>rLSq`@h5207{s zaFXelc4fcoukW38%YT1-+o`eRtb+%bp-|~VfuSM+-G=f(UGHGm;wgFKnG~J?IdPn| zeHXypiJefokun^@U@dqK9Tf<*4D^VO{5i#pF=6kcvg_AMd8Y2ZUiVz3du!=Fhwhb7 zFW|^Z>zDVEg89kiJ*04M+LFhmlf5&%J+3OtzW!9t4DX1$jL+X>-c3vo;4a7+W`QB0 zS)%GR$bkD(cS0;RG1!^KVLM&6z#~*i4n)f=91af~HVlMd^ytx(Cr>_c;>5s#1Hly* zELb4C#lV|u;F#*iA9qE@eemA<$if5r_HWs;<^A{HM{HZSZOqTlRaLoj=Pn=ztCp|$ zwCg9t5)3UrJI7b<`fSoPQ@66SbMXptb8{6%0V63WC;)+&GiT1>!-tU!=nwmTJcaS6 z30w|9<3k05>|VR}aLL)XQ6}0xTi2}Z{$W>Wdm0;!)>KsJL;$AKaFur0*E6l8$JMNO zsjjONM~s{|e*^c2#*gq!^%z;~`rC-;<05{i>bi|ZHWU>e`Q+2iE0%4-b#M!cmx55I z1zANo7UZDDErNuUo!@gnYCCS)pxuJ!jzU$Fk|WPth1)uhYiKb=AnG43P~LRP^|#RF z6ok8wPxy&-6>txBz&MNWZyO%u90Q+%8HjD2g&K|zQUgp)A_stwOAhLu<_BGis4$FG zFg9QIKNa@=R&{5oJ3e< zJ-Al=w^)hAl*u%ezd9qC4!I9i*(d5&{r5- z;qWOG7OD}|1YwGJnXy&%z8WmQL#w#K^wu~0PQ#xZ@k%hJ*TD_42oxcSm0s=bD`~k> zAWy33S$D}3Qm}t=sJEo%N?Na4N{-~qseL-XVL{(tvpqwYewu$m4G{ouc|1FF=-9jjT<)(9z1yH(4mtiO%j$tg9agp@Ky=2_L;_E@Q(`+j|FaLXsFhq z>2XS*9*{Vq7KSvM;0KyQ-;aPC2z}3QZVy5uq==KQaR}lfjtN{&KzTx0_WOEWkv3M6 z`Zh|ZRW4*D`>hWY5CD{Ns+EAVYEsio4I>ATPFpLJETf{+ndPUh0&B1me85+dVYsg{JW0A+(mayk zC(Re}I1F!!-7NM?%yZM&R?_g~v@ufcF;e}JQr%(BI^7+0K1r@KNJ^dRtUF9f8tilq zsFl|1s_T|L^Q^jS2h)O7&*F}}Gmq}f%_Vx|uMVUsnj(}A>cB^X!wfKUxmy0LulT2C z@EXILY`K%na%aTl1R($$sBAnS2UnKmOIn^Im|u6+-=%Qx>q9wU21x++KncHQUQ#$; zf|2u*lzfNWyS6L)3fF*Nu#G)gXuB10QDX(|QYawQW_A{RKY?noI&uIt3=4Ggnl)=c z2!;(ChU0(%1CAX#26u5a2C81UBNRW?wbA*E0C%Tx1n>h{4#5wu(js@L$aM|%I}Ee| z3?FnRAP9Um~D$Tx;xz?ymEiWsX{@Lf8vr{SMp1CmC78u!-$16T(xZ-wZZS<9& zFb(CMw?09&clncpELyk_>XsBUHT0>sz>(R)kpVp|baRK8lIHFHHWV<6uUH@);XkX1>k9O7@o|HOVN*O7o4RX}Wt$*$0maWun8=35( z_2}sCl!_YK{^FC>QDkYrg(*z?!U+5~Q2t}RqMqSS1w*nz$)-OUw1C0xl8{#>8PRj# zKweoMiIvuM^^*KKsl|CWZGEGj+QXsdNlK4YHOCpuNiy=1mF#3S+Y#(31^XuXbCZhl zQ-jBTV<;ao>i|u1v}mk{zo73e@OahDIlv{TVV(n#a5!9CTwGRGCNwkvM`5u+@??j? znX0O?8Ws&Zq1{o-(+lOC11@5MA-uvu-`y~#8DI+VNu4(cB}jl^0QkkJq9`~5a1`zd zTwcIiR!xH`%F0i>Z|VH$_CZ4}Q_xTHSPe`?QR9j+;89HhDm5)SUEpMhB^3N7}zJvz>JFeNqNo+R<`G znQc;VQdAT-U^Q7GlSMpqQsE5mb6YH zf~3RF*Iht_NLywrT0=>=z}TFi4Xv0&=3L$Uotqlgb3iqtg-TDg7*zE25_s&3wIU(@&jS0R)%)k2G+!U&C&EB+|E z(^NllMvNU0LlPv38%M;$2>~B-(Y;BOZ-FFMQP(|Ks>n_0`&UUFaHX7=B#a(BUth!z0aV$5?rVIKm4+Hf595rXjGr$) zXQ3G?O%$*KOq1!uB3*&(K(@I5n5aa>iEJi|=%%GG6T>Tbv!rzBX>bB)?hZ*! zX*|N&#p@ZXQOVkik^M)08Tk5oBbW=S) zGhB5opVJJ~LYo*mk9nP@2b_R(Va(8}mj>6FFA2JkmESO_r8GjSH!?YGoU{HwsrDeL z?rlRJPRDI8d%Nim#438vwP&iNGJp`0R$(&2^Eb>bxQ7ahAC>&YYm9Bo0l9wX)x=+-j5?29kKYJRL zw99DD0cQp@1OOe}=+}SmJ8{JmFXWGyK6llQ{U7$5TpJp$VN23>4ex(5XX@KI)9W>D zolI)G1=Joj`WrQKHfsIUdn12z&wo>!JU~7(pugKe$J-k+K|wa@BsFXHrmW{?A05a~m2sGP%c;0fJzW5ius^-yEibdh4?{RGf$oDk6P zfrGh8)d{X(Ye#<)b6+>Er8H8iH(aVST&g!Lss1QO9S{PL0B`~vK?pz*Mkdwb2A0}5 z9hO>em{e<&v(~`csh>alPv&)7G<}!4e`^$ID8bwuEV;)lyPEk^HBYMHPDNHwKJdO1 z(NzG0Q_3sqU!k6Zh~EKf1w$;Vq+WTx6zT0W@=}7`B)J#ZK(e0e(0dUxknHF9#@UGtROtXQw-Eug(ywF z@sjLL3zh#r#&*#_759m&;zyhcKmth!FDG)4*2u;?cRJRZ$guwKY8Gc zeoxyMhJCh9y0!&%6{NS2uKm-(4aaWEYCd?%hAT7MUweD&I*prM`J?97|D^TpfBeVj zIqTCJ-FelI+FbY3w$6t4*1xsYwRg0so7MdKpSDhGd@uOKwRg0;;pZLsr4~2+k}OyM zxcyDP=uoRsvwB&r8~&bt8edg!_OY7mGRfbUld*U z(|haP2Kv(cnx8%5Y~1XM+uGdl%Lh|3nx)bHPjQO5CYXyy4p6TNe1m!oL3qFri>wT} z@3Xvhbho6q9fm(y^cm>99n2fYyag;8!JrOkH}iRjhPRgKX(X37(M$f{fM!yUy7hae zU7hQ!J1{wIlp}Qn%`l)If-ztTAOup~u~I#p@{xu5G&{jjcc@frtaQaNN8P;CT4V3} zGxL_w$nQ6OqKgPBqc%bjZDF|L&&*vv;-U<}gM%9}KCmJT=n-WO=z@o6ljTcR-6>($ z^}&i?2Hovs?+ao7+p4Q`;evm9=Dkol_36Ule=F(L(3gFqlIPTVJG7i+JtrlcD+OV4 zB=0ndm8NMf{sE*XHR6^upQL({^@=*7;`^AnTJVFKkV_XAc$VtOfq-~qxWsZm9EGaQ(**$PveGrp5Fgc2%g%rs-34LkUba61tq>YZNj$#Cr0x3(-LROd z=BA~NOLq2e)Ch8;s~VqVQgy9MV+5wbv_t-!dahnKv(jaF=Ok-9O!Vc)!jkB4#jjfC zc+;QES4i9)WdkIl#YHgKig%-;{AVV{o=3* zD{ue9<6~xT>^5-W^|#)?w`}L0{{qyFUJ6 zw*^~{HT_N7`PUZUa+-5y0Mx46g9_O%$@^FQG*(vQANuY z@K5c4_D9L6>>wu81JRZCe|VHG}BR9w1b(T1*Fa&P}>uPd(aFV!6^ImbBb zjB=z6lTt^fTronbH$tjCLaGCbFw9YFSW^A5$ybbY)ajopEq}BT^K7O?673{Yig_N` zeR1C^D8G4j;a2or6P0;2qRbCh{6>SycPB9)?^EGyDZ={(R8Nu~bcQP=-JOI}%U3s4 zal0?@G}A{jb0do!V61?#a>hJ#j09Q4%_0@dtYBIxbMIz52A&+#t|F&_+N-WNSJL}A zf&(R1aIIiqjHrg)Z9_d1ZYkogUvct}jIFV(AnGYJeMD;ciVGJBc7_WpnnW;k4rjUr z|KaT+8yD@qh^iWL0O$s-r%if05?Quv$@uZ(r%s)^ckf^f zI*#;CO+z<{fEtRb$RS7>vhjnDKBQKlW$LQsD{+k;Hdf>Jq5%i`xWS_D8)?o5b!$=M zk6CZN{TBQ~P83D?=Rco)=z)htV)zS5;4%QcCpp|5857CY5wAdz3!`;w))xKPp#Wol09PiEq{1CsWG2pNTd7Bq^tkB zc>TfaZ)sJl!QHc#AFZEt|J-#YLnp2nGI`x^oByZp$VG2|I%)Evje{qy`ThO>T)zF} zb&XqY*jLeK%%TtaOzA&;`bR1dzwB6In!%{bCe6p&=^S2H+V^-pf9|z~*|)IL6^K?On4%Jscj*6H29;N8GV%fmWuP!+iO==_baxtk zfZ(ZR&%F@&!}$Sy&q+kesk?60-5re3a88wqm=%JqF)cN!(h##wu~I#viAjZqp}`x| zOIdJVaPxrEga72~Q^#7JB9|s1&xwMFfg8K?CRuYyU<_JCJ%9P#%v?*InTCprgkpsu zjdgJ#BIF{L2%sxWl|>J6phR$e*4g;#4Rxm;4CLFh;>a5K~zNDjcFtDJMt_SYTWnz8)Y6`8H> zxbq)NHlDox$8Bn5-shlC2HK|H+DU43pOksObo2ca79VmpY?qqVe(e0C^=@hZ%NDPX zoxl5|fr~Q!@I;ScOKOE;g%cnkcW_*9i0h&6RCqFNz zSKnc1BayU`PUV;Qk2ng@GB2^J3ze9qFt#q}{)_Id1(n0Q#FO}UTfr zdDV48rPMJ}trb)v#pg)U#JB-P3$Mq+p)2u+LAKmzN^kB*x0m zKFYTQlvr>bF@6Yjq%vcZT=r+(m!iA5Zmtl027IW6@`pxPBAyhz{0hz0Hlj{v>_mhG zsWp!hO|3``Wt)gWBmx!%11>;qOWc5VWx}Z;8xajzM+8D;q0{=2QRAbPy3gSQ^a_RoqvGD_S#ll%l5390g6hXmd4?33g`Ny-mm)q6lQcf9yrX+b;(2 zG}R0%P?H^bH)F<(Awvd@7%^(ko_*7%O&Ky|2w1|FEn9@Qc!(zc3;%f$ukv3{KNSq9 zTeof8yLYeR51Oi?>dMFwV__NEeeC@UW zB1x~~Xj;8{<+;i$!r|cH!GrO(;0|&C3yRf~e}7`diWQyT{~!HfrZ=N?SHVx6x;Z zP1{N7?P@h{PM;5Cwn=H+islmDd|z^ddmZU5lhRw)%4}1+=>tiPnk8qnN=|RFW?#8an9N8F-TMljKjT$ZEBvsDPE!%$Qt-B7Wh4v>6M5U$-} zRdsge)cB4a2Buv-OiCH;yn?=atd-i|Df!-P5bEjF>03TY$#w+u(hleSj_Czd#Tz>G zC>0R8V#c)Sm9jcPlS1C zPzT^zlsD)_n;vH<{FFKL1mZ#L%mVd6;Ya>Z8-ljIHUf<8mxEn`Wj9%V>ZKqG!ifm( z$cHWH6AAj3#C@H=;$e%GgPS25TDD5mY8MCRyjfw19-@do2tCS00y5zOa}I*R;D7=B z1`X~vderzivlq;mIaO@TICt*c^V;jk6cSZhJ~?7_{oo_y&z{}ew{G3Kbn&wOy>iPc zigR;%7aTcw^l&j)ES}-xuAL3qZb$#5%cqLVH+#}7(5=3Gdn1Zh zdp~KB0}>z`wuFi5nmLZkJ1ui{&|IriZ9IcF(CJ0*R3qFgVx`o zNsK1KqHdrXC)(o+*fCr#Aty8lep_^uYk0&G=Ob=-xwRhh>AqXK~*h|-SRII2;aYQ8x3lIv0X3qS~=kwtG zlEAUkvi}XkSC=}*W6Z$kAl*Z4(^Sk zN0{l>RYNv;x5(MMe0u;dprL0Lap}G{Bd&VL5Iw-zl4!(xQfO%h5A_-7{(3&w-7K=) zVqTM})X721?C|`dq@I0uc2=BqJbQ^ORQ~BI6=oom(uK;d4h23X`bDiBTG!8x@_zPh-#WzXH)# zM-D)J!r}0cp##Va9x;F3;_07F9?CI$_H0VeIiR$Do1G_DcxQ~Cj)%|7%dyEpB+|V{S0qW( z!zE?K2%_ue3opG$k8fI!JoK=xDKn={FFsR_?4Z1%1X zLt+5X`a<#3x&mC~Lo1VsE=*L(0`@?vy&YK^w;}^d0hdgK?I>mP%@>F_@DCar)8~$S zO(cY(MHtCHA{V-!QUagN_yUeCC_>PPbROY33pLglbFqdMNQ}T*BjxTQstsv^T1?Dr zKwxPq0LP#qgZb*Pex^=P-8Vz=fX~w0L+UE0FA<>m&`MT4Ng>}gA&bbw z6p(`)NzHMFd!>1LI>Y%=S|n~z;D8heFcGpAz!E` zm?|cYMDUK-D&5y18X;WuTo-!WHV91am z2M->k^uz(Dl%I@!zH&9#-ijql@nTEMihyvyJ%0Se9lJMf*|G(f4({DIddviOg=@u% zWhgulfc5Lwt6txMUHkBaYu2p7eb=p9W8z0wr%ahLdi2PnM~|XJj2%06)}%GH-5a)~HHaEDcVxBU>mLXY(DzXA(AjX|3Ip$)J1H33(82x%}Lh!q-nV+;0IcsL&>d; zQ`iG}jlqXT(q2 zSkNbwd?F;s0g^!$SM5;wgN&6&blNELVnL)3$)dy<2J?B@+V!C|pM%vIx@?c0L?7oO z0^(8KoCD+!t%5A8ZmCb^0S$r~6Aq!*yf=bsrOv3$ZH zgH<`%Z-fmtx?fI_LKjieW5bRV zgyXUz2TeNC`a-miQENW8pnX!-1GJza*KMSyVS!2}13R}g!BwvENl6RChaq4{DGJZR zkfx-u2~Y=dN8yJ|J7)&*32_VFg%I8LNyJ7$hzE!p(fWxzPU>KwV>?PG>=dvjnTynO z08K)OkY1n{XG>V+AW?om7bi@}lRdA~GCqDMZL8=_W@5^ly#}H~4_+;M|H;@%G+_~d zYE)k3Q4F@M^E;d)vHVn+vw$b^FM{xBU!15P8s-RYbBk{iJgIKY(_IT(q0+L@smL5VfB49P;c;l*tHZuW_y>yg zfOrU`iI3FSKqUNOP$&e!~!ZZIIk-HcX#Q-;;85?WEu6C-s7WE&{ z01%%PNvlzj-SDRd${R9y5M%)HUK}7EdlCsxpQVSktm~Ux@1y#4nW{vzu$_MX;B?Q6 zbzj6(ea`_+B!?E}*<4y$ymsx{UAuOL!(jx0cvsfPlovE`Oo@a7h~_Y*lzS9!4gd5( ziOq1JJT zP3iN=hg&yqTesmD7aC43>17HLA}dw7+TK8)t4?)q$ja8?Qdv>y^x11Uo!4=dQ%dqL zB!X8dGBc;D-s=Lze_-aeg|kKo z(|swRCZGsn7>F#q3qf_Ks3mu@$O#p#5V{u+M^SOZ#lVjAt3$kBgarAqw9uN>V!9!Ep&w)IF)1?=Q^Q zW<^w}1hia9OsfQ(sr^V=hz_L1NY~o^V;nlQgK-^tqS{B$G=(8mrK^ha8!Nq1jeN=M zoucPDlsu=B@6hrj9Nj%@6;F6Tm&1sP6s8?iJk&P?4=Tt3JpoD|Z$2V+Z^+wI_gn=Y zAO`sD4g>H5wA4Md!tP%(b0!+}qRCht5EtUbtHjfplqVE59I5&c^ZzLEAP$WDM+TifNS=4RLW2CB#+pEq03qXY8kD$w| z){d1NxoIE=e!Ns9ESh`dkACet#&F&veKjEF3rt89M*y{I%q0fl^UH9-tcb>Ofw<1U z*H^xE0yPd0AsXcjxS1Ma0Y9yn#mAe3jM3FN;5DP5{yEo7O;p1)WFc_`!9$= zCI0|oqv0tki2)Wl$k-8!QD2wfwYY^qya>TgrPLc&~J^X-xYAQ~zvSNJs|VHQ~@ zmp5T@!%3qh(_cH{t84m`blN$P^dIRMZ8U@xzDdp7YM@H+_-SSuq@14`s$!U$Wonv+ z#-(Y7WLxXuKnl1@;5v2QB8o3Y_;PB8awNHDk|t&z zfE|UMJTcC%(gq6bfUo#>x;Kf1oX8W#Tk2w&BgHT2zH5wdcV>lnZ!(`_Tn&f{n7Uz+ zp*|R9(Vmm2CG-gHL62amv{nSz4pe$IPbAzCi1($R(gLq&ZrT`H=NmeZ;nO5(L+wDC z-+d2@lp7I+y2R-P!th=RdX?4Y{{;}G6nGR}S-lSAAg6XJ3k8s0#2C1bC`GV^jjU07 zoaJi(k9+}g01J)+!UeJ_P66SwI>gdOmKc?>Eob9_1r@hIm2nC`!hg(C-5X4xCIjz` zri{3Q?_Pa zH!0=x9itJTX^FZkS@Au}SSjyJqkc8s^sE{}Jy4$jHCGK7kHSuenVa@LHTgU*`bLLt ze8J@NbaJ0+Y59as;oP)9wiM2lR5D57yd*6rS<7{Xvr{~CpQbW)F3bKO5X~Q6^6;E| z&Txn+vrW&HN`++jQ_(u7U8eZD(T2wn4kXKg-!pbpwP-mb()zqhpei78U5{A2$)JUG z7Nj}J_(!Wm#VbXya)X^xXhmfOid^X0DnT(o{TN0h$gB;D`!`?)cv-Z#vP}-C=K!a{ ziVS8hpwAj3Cht3di6!rX@1PpQlLL9x+A&fR4J%Op4MDs(VH0^6v(PW$8{PCm!wUQ+ zQHxOCqHY!79;*gV71CxWIOa9_6jbR6HP634w@DjLMaX#IM*OyCYj$z8FDGzWfdn9= z<=3h=(ditS)f8`E#jCu~%jEA`IpEE&U!L8N6@L!T^pSQoGC)rBFEf3NS?*9Pe#SRm zA}OLP9ON$!wqt@E{BX@zAqVaXUO9cEN>=M`GSuEO6uJOKFcK z=1#T(PSqua%bGH_N;89e$_<|`Pz^aiR2pX+u$h*sGB$Ig=dmF>I`vrf&q2F}Z}RzY zKeX`?+OA!zjfeZ-%P8W$MeAJIHxMDnb?Uj2_;NwdNl|+y%lVF?K|g2uDP5;6A$aJE z1|);J{z&fK{*srNFNyESTw4t4Ga6rzEPqPab2Ez!ibQ142-8w7tkGd~jfE|?=z#e` z|8-{!rl`cZkovu+v^PfYe<*v?Lp|0%H*(j^BU;D~M&QYa2fYg`qJoP=z}vv>ymd5M z&QfggKs^WClB`!;r~6-Lri>CC9efcP^$oMjR;6g+n5wdR-MFM=P7Wylsj0*-(VOKD zOQ%F+No?>oc~=KczxJ*1_|;8Fgz^?gRaFliI<#cTlGUqMpFVvWse$`>`9?0dBti*0 z(j!iVi+B(Kr+A>nix;CEX@VKRXgd9hndi}}S=>UzscH0Wt)eKgTO@E90$N>V0fn}F zlcd3oZf2&TMhj2XK)E(7CLa#TV5pt{&(!H*5L6zyp1@Y;iMinVm)KiGEuLZwtzzHm3-9M_lzl+Tejo zsZrt@*WT=ztmY=^xlXy4grkw;1WO3_PCA{_keyr%MRg&q{FOn87f(m|gLb)smLiMn z3zhy7gaEo0S;Q?g`;Sk{a4N1pF?I@N)h@l&~3b2P{#o+0&PEJbGveRlYzmL&?sivAN6bi^jSf#EH+R_jK zw2%kYo@~;DOCcmYhOYr+U6tejnS)EnAGi!3K781)VS@$@8ai}n|Ni~K5`==U1o+1h zOd@ubUJR}94Sqo*Uxub@imDmJ19VlRjh9SKRb^)ALAQ5cp8+}rHTb8Dj0Vee1Ktn> z0cBY(C@45`aM-NxkK?qY|xi5ORcE>5MI*4sQy@d!h+F#E4_Zj?J1i3;bZad80@3IXaY0-z1Y0_-;WHbV4>c=$D>B9bxClQDxwz zlccG;LwQnZ?p3U88Qy!w-{%%;KSuPu0C z^bt3jjEWJk*qbAF4O~Y(5D`l(s(9gESNfC($>T%32GdTJ^!*8~lbD+%=Sy0y6wXW5 za#OUPlDoU3a7+g%D)^?-Xg{AFiT(SPaqgp`_`xX<^mnt|)J4xcG(%GjP}7|EvN+`O zTbMO3nk7QbSCK!WU;}vMAg5S+3IY%I*>Q%#pyA1=yBd@rVrmf;cLmpYz2DYxduc9( zsA2#+t|)lZUvzb<)U~61Mq6llXh1la4Lw3=8Qc}ybdJ+Oqwp_L9}xkYvi!^E2qn zfXAQb%osj=_~5~V&tEp!`hPx|Qoq#nLt9)9#kvuY31kxp&I=X~@OAUio;8 zu3fw0?Y#ZwTh!AKmOFp=5m*J#xpQY6aqC#;L;{x?Amd>*r&g_rk~FYU2FL=ha;pPm zLG&XX4CmA@%ch!2KooKb9blRdRxk>w!CM~6mRw-GX9E~3!HJQ;-YTPk7i|^5p)jp|dd$Kfz z)}&h}-6B>+7%T|xXbMH!Dv7i#9C4{_QWIKxkt<-N9C5-TF4+O2r!o7b zHQ(}_10D)uOr8H^NV@hZo~H4m)YL4d?-Y_`_cf;R5i`Rylnz0MX5*?QsvfF_$so?ed;FKvJ0095=NklKs;Z2sk|HmT7MJs?14JdwMAlhPsx*sE^weO_<=%9UtAQK1-7g%(~Ff^U06Weiw zJ)FPmFs*mMXA1CIKs=Cr2m2N{5^Lv;)Lovk40?Awks_TUshYdK?tc}HA!HHVj>p2| z`TDAhvme|{)Kl{6)sq}jUfnbntO%Bsj2k_z!d?F1hp%tlvHSBitG931zG>5zO`8h( z^!TVW5E?pU3ht;O&6Ts~%YoZnfE>VO;6U1@85Cju{P}a|&K)^&c61cp8Vj`>EYSkYr zIeRzEKsnS+S~QcF9jZTtotGrMVw@UioiO82D5tikR|8hE422D%#r^5TnhH?2X2PkYDIp7zfsA1#)nzd1D+P|Pd^R%oM4Sv?P z!5#PA@bi`_>1|SR>E>qe;Aql8y7~U(CT&x1eL$iOklI4=CpTyhi?eA5sZlFh)-bx% zv7>4G+P6Lk{q1b>0PTQ~PRc&z$E{Nuw{bM$gdn30?XwK#(YRx+tjB1(riLwP6(-WG zP^ej_P6qAA}j7jjEzG8YNXQL@J~N6Rd_zQ{DT}&%~((# zc`$F&JJSm$tt;s|@yJ6tTMvUM8#>)oC@1=_2D}vEfC8qdL1qTnp^1T>DYQHy|4xDC zB<3fny^_N@j?=vwGtU7Y86Wun-^c+EM32eiLH-;HpJ^`CZ6#xPYAgN+8T0YVpJ$GJ zM+#mIxO%oC`wO+d_uo}WrHV?wp+!`tLR}%Jw;g4V=5JVZiZ(?cAWmV<{sQ6}5jEVM zE1`mryIG|a3WIdgQpzBCv4A!?xIj9q2CoXK;^O2^@oZVwx$YIOTy-_`xS>Ax?mCDZ zTfBI7QHiU(tZ4j@L0vj`-M;h0nx%_8vbt%*9=ss?)qG9htyVXzfM*9cnm&E{h!G0Oaru6IA52xF=Zx?<0aRA%WfNr03$7|^PPG?1DM-Lp?ux@?VkGq(LHh6Q)4v_wPRtapmXd<84lzI{Ck(B~xD*#GuiZS;m^MKVNV4lT#ZRcOI(C$@TJRkcp#Gs> zX#*$08~Bb7t&*E|qT~;PcwtaVxELVK zy24DA1%gbGnH*C2^lUIcK9iJLdhnf>|JAc+PLOZ8AR~MDEr|f}m-@AU462eG2xfqz z+wC4TYSd7UVI1Sfk3WwY5RlaX7@CgOUXW^SPyx}(Hw-=@5loFMb)4Z2iV{Xe3}+%X z22*AD;ng%=JRds{7Q~52hse6m+p~+y=btuZ z1;kiYWg6?G(!>iCUNQ`XO+Tb$r+EI@MYDwL8R7gqs;hE%; zL?aN<$DtV})2EEvm>l?Q+VI_leompOkO;&7FE?@kRhrtQuA)5+WL*!*Uo5D@0OOhBsK0-FSEt7Zw~4)Y}uWUyv<2Qdnvs|YU2*S zZ~tDyUq74-&XL}lwqwp{2}@EVzTZ+tN4OK8$ZVAYTF{_%hZp)^b4SZpbLJ8uXxL1; zxfwj9(7w;DrF0s4uzMY1v@odZ#DD5bpHoJarVNj)Dtp!lb-G-=sbuay5JUf0Hq z?!KNG{cvAC`e19kXz(h5I1Ri!UJUU=cj2u7@m4?|{LpBXuS#-vrZyl){GnPg8 z;kL>VQ!PVzWzjdJ0T$|CDTPtv2$lUF>;amO2cw*!s47SIC4hIT+IZh5B2Z0Q^+lQU zkCK@$GoymO_oJDHs0L-+hQAF%Re3jqNj*TMFTds;V?ecdft~|_a5%hs_wJc9XD(Z| z?9ib@xCCvDn+k6+Pz_6|#5+T_>#>i~;hA5zpxxm@-z!qeb)16D0eB=qBXlAXL`vX6 zgu;<(ZVnPxehNQ0Qj`f?ZlIT~$l0mRF%D@+lZLvij2w^;0y%EvJlgXB(rgzZyD}4D zn0_>nn_SZC8dg5H{Pf|&+fS@tJO6ly##k--j)z2rgoZj9xISe*>N)T@LKS?@fgW11 zbn1aJuvU~aDl0JDKmIQha`5{rZ|7SfLwk`L9yf1SlV3gLY}7KTQLAwa_M|pwE!}+o zT@StS)awJJ2CblyYh`t;-Kg1ubwzbE@6Gt>h%i_jGurZo{@chRpxP-T%Di_VzdZqU|-e z-t)}+!~W3bAC2zlm~?Y9sp0)uzw2@*94B|5ZO~bLFiMUEQ?VjlXy>rBU;1ZtHOKuiIXK`-3S>sPmxqZ4bwj15Ovd zBl9g!NaO-7qz$#39${`Zl+AZvGO$p?DW4%_1-l9!+`Guw+$% z;yHAhJv{jMDHMJba+Bs6beplW|0X}$-PF*gFP)fTqC!D-Axb;H;v%-+Bd>ALDgi(6 zN5Vs^OebEbT>cwQ4ydZ3EaKy!Ul#}>!UK>-is8&swP$i+P9`%>A`L`)P=7@<>WAmI z5j7fe1fWnNEI)oNAb6GJz>YS0j3MTD0YFdyF$p9dxMbU4rw6Kx3;93Sp1|b_R5||8 z%U565<=QJ=YuJDp>fqja&pr3N$D^x|?z4bhly@EEm<10U>3PS#{NJ198%;}j>7W04 zhz{j)zkHgL?sPX|nI@QZs-1=+9ferEWL^-sT&^N*Li z*3IlFU3bsU0$IA@FDY3aT0Z*rOYipHa!gOZqvM`a#)B{Ajhwvdz78L}*=^F~#rqrH z(Pr-26HR{I;fYuKwtniPN1yAq?Wmdln}_npu4(?z8%s78UeV;wv)7({J9p-Y>1$r? zHtn8=U*B1vHTq?%!)2__t?i|TEoq^5Q`Vk*sNWX@x613v+3=0ZgSp%Lt*xM)`}m|Z z+B%3#^{{UT5RqnP(ed0SVOj*qAx0L|Tp|Zx34y%2zIo5WAAdBPYV)w)Ad5sKQ5#}Y zKQ~|}pkAm$5@gRci6S7)Uwo^mCS06`4}Y3{71 zvp|^EPd7}RHXY?F9dX%?N)MgF$_YIr9-+=Kvx1qLiO?#2y{kqdI`t2ptv2Dv4QfBQ zLz0iPNFm4sD2NqNbwousghwHnwtQ0Qy3EKyMw=CT%CEkq^#^_CyxL{>q|eq(n6vI5 z?+m{2CmjY)T$R$em7{6i0h#IA?u*A|C#Q0<;L9+zt~@4tS-{MPJnN7rZam2c!ug+$a@0j)eNmKJ?c3Z9Qi0 z*mfG?&#zLe5)yC4nxWOf_8=OmX3>f4EI|&`99j@b@B^Isa_d!aa)8)*%yblXvVKj( zYce7S+FGNcNmR?8V~89?2EY>@iGuJ@Jk8bK7hb5?8)iXCsN2M?6{sI@i->u~6Z~+@ zmY2qCeQVUNH^=UNd&2fN$8YRBX}yX@2MuSFA0F-5nEBoK!{Yw*=QWi9l~Ncrj&S+! zm{ms4V@F`uIA0%jQ;EW((mTC4oSS+kyD`%W(GaJ60O%47>QT`s=b`K%{8fH^AeOH} z4scq@b5 z|MtHv6$){nIsM;$g=Boa9d5(_KEP*>r84;!Ji@ylZXGv;tSTKF-{v|XGKPy4cRtOZ zPA)RuE)2!oep*zOR;V03d%Q`5dB(e1Ztu@Q1q@t+%Dl8!Y z*WidaW)0BJS(RjFt878a)w@ykM+#kzH3HDgI^&TLMVh|W8kx?(QN9WH^^&e37EQl? zRzoA8YY?VPu%*oee((-3G&X=7xwCyl|J?{fa8NM6VqK$=JtN;BWj)~mI5VuzR}{9J zDauVE*vs3ABZlI6KuM4B&JFdkm$x1&_q0h@rmf zM*PIu=^p~k{eU$A3~;|t2N7X(Fp^k+K0Q80eM4AkFS44~SCSCZknb>*5^Kdh4I~i7 z3LGGo?7GyP{-$jC5s_N6X#EQptu!bKjuF6k1r}_D!cN%Lg_m#}xhmn?GR zG1erxj!&!PxUQ+Tc8^?KkEMgC34G2!L?rq{Mxqk4b7g3xs0!zr>S|CvTg}$sr(`zb z;b0-OC6?NXNvQ=>5GL9{T5>K&DF)}B%qRHT5=7AekwsPaRjE8*oKbBP(BGAAqJGe? zz=SpvK8ROn9xMJOn5fk87UqU4~$Wv)(?v?|8SVw_>xTX0TL%M#+(FYxf$~zUi!pV^L@=%hnshm|0x^6ffDN1>oCB_vnbVoGORZ z3XY_*R>#Wzq?lF5bW_}Cz@L3g{~?Ij%|t0?vK^JbinbQ(fB9%${$U-b%3pl{D-fkL zXIK;(l)SYqsY7bEAg=Jm8r=Q|$w=;-si&~KZ49udsC^!$lqE(sBc&ed3gd_H#}Wa| zxuv%3?GL__(*;2g@00nIlA;hifLiuTM;K`uT4?w8#_S`&t@7@ex|-WwswG(5MMJR! zeDy-ZAm;x?4*iF#s2CumH!_(H4ajA_)zb@Mpb!aqUY;!eY)$v<;k~<<^N2SgSbTT1QEau^t39kzyc-XDxe}w=L4(q{Q zpa-febyUJemGZOS9p}YQ4<=Xk)vHMe&mke_t^h*jxCK@_;aWf)H@*f|x9%!-1UKLL zdH?(6zR?o@6bTxF86q1MV)d`F*LUiV6yJ?wkaZ9FGB?RGA`yb`KEd7V`){vjDP6Pa z7+kC-QuDcUS&I@dLtn-qOs%ZdC1LQI=h9$@YrcX{Ep3=wz{r$Ag`qmt$lnDs%TA7s=x%E)g1reLJyq=GXV@{HPjFm%9+BJ0ObQb;3mTMzHAz>_r*H3$L zW{}ooe(M?XdY;5f2J)7J%WVk&PUxqszrQ|STW=sl*2D^8vhGbUh_hoq0%}6P_fti( znT%2nhZ_;;QD(rq+11WqZRg|X0k4yhMAmp=W6^FCsxakD9xq6NIg1gZ4sC_VleCTe z;0;XX1~?4c{rQczR6FumvX^6tc(`y84-RfAD3f~jVX>8T&+?@Aj3G+t5w6w*-=PgE zHXoiXSqXlMx`E+o|?g?3x|-t_!Kl!t&LWT{F2=(jGa_|EqLHxxb1N6OiNjp zJ7n^(G+9pMBKWjtFUx5#5Oko^8^LjHs8q z3!6MfvMWTPZ?Z49Nrj_K3e#o}D{A;FH-o|=j{aa~vj@!|?OU&4NS{;T+7FRkW$(ur zHuY`=p_SFoNB0SpY6uZ?oFy!4yzlBexG+t4lod>NKEUICdj)UHsN}@4+evQr*1jD+ zY3#FFFHsTSKfSWnF8f^n*|vaCM8CFy>#AU4olagNy4r7`K@~|ra#4uB62rUO{B9>RCta2_ zgEc%4>q_I>*wrTME)7@s2=`|MYIpFvw4Siin_Zn(U)?lbF8eXoYp$DqE^ld_uRRSy zZWRaG5b2chCo(wxnfK1_N2mGCmHu0(m^X8d`-`Li!%es_TsA`fpS1Ix96;aI!HG18 zNpsPm7p={$DHaS|V43VnN}ZC)T;x6}{>+l%fm52Hy{fq%)$?lo035Ms=J?IhXI6Fs zMc|Z)F0OYp!nP>uY+TNKBoYo34Vqm-IJ2&WbGBjOwuz+DcKBVnyU{|Ceqmc=1kf`< zQl#M-a++GqGVgjriiA z^v;)DD~y3`wR2y)`J=0fy2EBYX%c`g&I?>^-u$N?6_3Y2%f!S-I=BBhoeUl=b{}Oi zmHN4a8c)GYemnA1KUJ{H*V$e@q1LbDMg^~9y;S4Pf815XisaB=-BWqxX{=5HYkG_2 z8dJl{Hg9!;P4~P6JXAUv>$qUZ%b8{uFd|v)b+S_?T~{i&vRxB}$;8Ij`O%}MRj6h+ zpzHklr}quuTj)4~_KzVzhn3&!wPzcr((>5kqpMRuCEq=q>*hAGI2?mCq)o{2(pt3n z_59il5HB8rPb%WvHWQkHRZmV>pe<&ISf%LHEhpG>Sdf0?{+V6yohMPY^i+nqA;~!l z!{ajD)4ub1F~}G<>s&tDFW=zP32pA_M&PK7(7r|I^$VL(E5*Znymvqrr^7*GwSIH= z`;b7$^WB%e(mQa~bz|JLgr7{{?R1=RSl?v_@RZpL&%xtVn&^-pH2yocJD+zm5}3 zZZ_^?I)@z>E(JVmm?Xa35xjG{to}jLIH)!h_PB3Y%;v4m=JOv5_;@pz&1{hQ+fy*h1!Nc5iqnvJEmrV?Ti`54Es~xRjH5)DWJx&iy7=j$00}#G` zvtsVm%Bt2cbX;7amkX<4Tp{kMqh>}?c7R2j}gj^-w03=xTO2cN#bKY_+q~qgL$g z<*qlxeRr=wCEtJM{nwDFS2J#f~1fgRic4v4lz@Xm%b z_iCcX!Unx+YQMXk-pY4aOQ6r0E51|**yf#d=D9FtfpLU+M{oD&}!UjpC3rUKAFSpBwEWkEDy_Y$OT?P zI|vg8O2)pEcPjMbX%htEc_bTEtCgN{DFShZUm7eWAOTFOb4ID72VZSVA?`t}9hAuYdD9 zi$bIQYH9J@+Jcq{hlG}pxw;)969)u&U7H(#RCI`URV>W*UXj3>*=TrRXKYSIIC~$0L-aL?w#7;=(Et*pCnh5V6hHqGhH~ z3}Lv5JtYwr4~hB z61kT3orYdEFPYm}ATCF-B0kEsl?)J8AHl)r-ek~i4Sc!}$NSNERUBnx52{Lg*F}?6 zbt`~Z^(mUp$tv_`&~yiw{Y3lf5lrk7s(Du}mz-57(e7TQdly<-0m}DnIXg-$N`A@S zT=u@+^Fn+u{<$=`k5}9Ij_!9NeO!BwMX%Ko(NM@V@$0wX0}*F)S6+TqAlY7-^^@t8 z7$jNp6%>gMjsMHd248C3%>gRFyp8wHr%R;5PIQ}gTuJWhP>yw>6+_n)i5;}g% zCpBi{Iop7ng^Fp?_Wmlue-83=eL7@%h3u&ZtP5Q5S`*y@f^!{i+5IvYESaFQqgl?d z1OJoJ;XKdRQB~2EE_b&Z{D;>Uqv>>})5+z{pf)0*qJV$*xymga4xQKehxsq@M(Aq+ z54pv|0bxgKpWGCNB*NpFK@v+6xth^8_WrgT)~xG8hhx-w*+ixtD&a zIg%~ktAE}r(5tc(r!+KO@aPkj$7j>!@q50VrII;Y`6c6vCdL3l*-I1m5JM1mxdCi@ z(4dR$ih1(yOpU0wtm1KEnfhoTvT6%rk}4&@HaH^$Yd9aqO9>y(jxwR8U-}m6J3^vP zpr;(y3O#slv6_>ChURdHc%s1S`-d?^ ze%|%W_0x*U_}`(_s9w9VhVd(VTfo-Gu)4vldSvd)u5Fd3wZ^HSeY(kEum*o7LiM^f z{ks(*%ACvxn7)ElI>GviTwsUdD{88W9qqh0PV|Y!tF(0`$z;)POz;790t&$+STXWi zYIZAsIBeW8+^Dj-DJf|b1O8WT&>Ai#3`pkskT2#xDa^`<)3Zy?IbnQI#_&!@3nqNh z&!F|7x%}|Xq=PafKuiE);OlIM+(dR|3-Pff*%)k=W8iRV1tGLh$vnfgQZXnZtOgMF zKpc@n(P=RYC&eY|rcua>yRK93YZFhpJ`|UYtI3dDxQH1~RG7vvsVP1YhF!S6KJ#5> z4{H%Ik#ZNscpR@HjS25Iu0^5sm$8HVc4D>;)TqnjSU^8z`PpFw0_DxwX|3kIW|*fI zWyH|Lv;>~WL;7#CQ+jo4BLNIYp$C|NeJi!&Mr3k{N(un(m2TwDQ&@2wVtWfNg!RkM zHhKuk8H8u0xqO4BCyB~DzxdjIE;|a^Nh9NEa#i(LX&&bFJE7#%yU7hf^b?+JG}~5D zm-ks4i6VHGSN{IB({8B>BuwVl68+Pu54Mt7xH&D8W9b&Oe@#{x#u2kssda-g1vmQb z$8WfOeEx*g;xcq5^7^2jDZr}I>!1VRy>zmm`!~sLIX>)1two;!Gv^kYEAaJ@=k0yY z`!Zi29fJH44zT0g`#4`&X;_bo!zj@E_i*sjhwR_TSn=MLg6%>r@-sPkgP^8A=M7Ef z&I|853-B(-hni^%)hCPn8<3ORU!k4x(0LrIsSx$kjOVK?KXz37bOJzD=6d~PptOZC z+ca7_uq^KriKuRHF!kG5+?4xW2Tx8qaKgnF#0ATNYMDTH>}BI!qq%hG4QY-cgX-!* z9ORW@-k)I9UL!l{!ktea6S3G6Vj?Bl;`Otse25A>e2B4Qe`4+S6o68}Q)++(kt2xO zeL1Pb%3p}KE5NLrx}Yc5}C-OGuJ200H(Ba!UW@GKKkx1-4B zjl+3$OS!9Z+63etj5vx!BKpv>UgU)yIqWWV&?M7l6aW6$hY^I3J!MJf*uyJ%p3TkJ zgyQ_x{mbuH2BE&5!;e5WDE~3(RSVn@!`mYdg6l#}pk;^RY^l1DA>RCO9Hq-=$KUAm zbAiZj9{Cc_{u!tOusPSZwG79XZ%u>xC+5nOGTV&bvGE4e4}N|LJ1T9sU6%$&;{yjM z@vzE(!foSc2fr%4T%uooMJFblK+swV6yPSpN0ilkirLRk{-p zB+)eWhhgP`n&qy)eR41m#%2Cde1rv-2{V_11#BrU}izEnwI3S$B|0-3*U`WY6omOEY z_KUB8$NbDX6^)dr7dU5AgOUFJ=W;2SNcugHa^^8wTb*GTh@iCUnNn|x<{Dh#DYgZV z8~0pkGi&KoS&UI)4TcR@Ew~`U8os($&7i4sNQ@83 zxo5d6rxc>8S8w#Wr`Yn4LN^^|RKbzm`Uex-FCtd7&z>poBBOe2gQbUr)P`B4td#Dl z`XogXHX(Ycc!#MVKHUztt;%2fluE0dofoa>Ibpq+w5 z)dy}muCIrec{*Okvd`O2%3f-}d2TkLohxNTTh|;8ewGT)#Ei>khR>2T@+k>5py9*= zyy2bp0kX^uqZZ9g$VkH76;&h(+q(tozS&|H#eeXHgupmyDCZOUTak;TE(wguB|&@u zpBLV%I`<~q^)8Ze#}dc9c}=CFTl4mhpYVIf9ZQ%`{rYd03hiO9dV}dg!wh{#X!LkE zPTQ6=H;vP>HJOzZ_TnXC!UKkWbVPO4pp<;kq&)Q8`m)FAza2MXoeKKKw=lQEvG)793%P$N~T^Ef@+l9?N3h)%!oiFFWo}u2$4i>bnzEu)uL7B%cTK) zS55(*hJRc{0jU#u2H^*yP`*?R%u(aLN)O}8_Jt}1wmo7FNwUL+B6f|KY4ZG}S8@&e z+=tdp&>XG%88_uYWeflQ4QfC%ae>ddXFe`Vf@7th%}vR6E^G;F?3CW3DarcYpwECh z8G^(;l1*doQq-VTl616m1^+G43MBG+-r{|4|2GTB{F#EV%Z3dK?3tx@Kk;IngZY>< zNIG{aq8S^ZPEg(lWY2CAAt(!%GScZUsgoi@;qI9ydq;t z1OurZkD=-*N5u=bEF@cUSa9kF2{2O>uJP@tdzEEavr>Jfu?Sj8eu0^e^3%UG^rZT1 z1%i_smuHY7!S8PO15Aby5O`XtMX0q&?>&;stfI7xjI<9Xn~Ze!p6edVCmjWuFYQd( zjeDGbZr>d`+FrKfs>BmQD$UP{p=~izGUC3+*1o1iY*JW5XAN4D5pUr3Yh*uT`&Mj6 zWiy{C`H)#*Wkhp-JV_sm=`iY~4biO6*i2E)8*VVDjQG`*3?}_b-uDg9k;!JDe@dFG zJztAc_j*^t>kQ}}>nbQ?#l@OT5kz4Wf2HTj;d?W}GO1Md3u_Cg+waP12n~BWdm;>* zE`->?*f*|zdl_^1ocf?sg6Sc1*8{>4%3?Pnc$G6Q_%`?*HHU&Q{H}-7c_q~pgdFQ} zgDK!7fR{et%OD%MGd5Q}dP6WHlegGOm|Q@%*6eaUAlGJsm(O_gx4Ap!K;!~cCzOkF zg{YMn0?T(u#c*jlYmSmLto8L{S6}oJ4kWvkM5)|h+;rE4HuA9oLs^52^3Z?RS%9kr zn|>OPMNf3id_adRP&?^~`kO)^l3&gTjT%tIFRJ(c?yPOKdk=xdvG2^c|7f)i>#{tB z+DXlkBSG+$I!sfacX!MBJqN}bdhULDK9^aAl#5a&cLU&d=qOMn8^uf>@DQ3JNoZFK zdss`sEa=1{Zn(mWxhBg^wwHuM=!LJrEg4v`7%aYnKx}St zTto?U%Yivm4a>&D*)Yet5C}W22H%NJ7djmI^P!8R=VxYz%5!-&!R3>8ZBYwcEi#aA z$|nSVvJv2AAZ&Xx8WH=a3#W@XJ0WlL8?<10jKMc1F+p*yJ!1^h`NuW*0VF1+pN+gA z>S-vrGKktS5-M}Yl;)O~#15VWHdXGge8KpoAiBbY;w^|dAnKs&^XUgpw4!NRI0EC7r;-~KV_>VG-!n!zZ;hBdj|2;gmqwy`gco{#M?@CCCIp1ni! zGEt@ya7=I76EFcIx*)guZKnONQlfe@hKw%DayChUF=_ zoI?uVUmE!tcyxo{_G;w>d;J~g$3>gxSj##8p!fdm(%RGqIgC43bqBF7&WUA-MrZ3z zs@39FZR|Um+Zt`YR|iEFLQZ^dZ4TyHlJJpfd`a69y^|}maA%jc03N%riN^@2v)$=& z6D|`Y5=1eQ16dlDc_}%A3W0JIP{6E+%DBE%nv%1E0o0i^W^Ojs`cqMJkbzO>w zt`soOaOfz0|aN{l@E`?E^LL|g!gN|zLI4Qe+&}5T};$afOsmUB{-a!zp z!d*a$qIato)dDPF7F#CEtk+xa8`0xhEle`Zi{d;i0)xRFIb}^dk(xAu1x5iRx)luT z-mc{r7u?|PY&tsmfQ=h-AN}0Y&JwDg|sPUBgxw&!xALICYAoWz7-LtrsD<+k0uqO(*UYHa$yyv>GFoz&!nq?Y%bQWFa`yoJXGD5nP}{I2cdIU>d}cC#mVRcmFQ^hdnE9ckXOMJ5ck(Uh0D^+*YB+DxV{13`5b6JeoZRY( zdz(sCDp+*&4&?}c64i`@K|(a^Nbq71}xd(dR{EdNLd2cQjM~20$eg_9n_pf99YMc1Za^a!%;M zAl9U%ID>p*H)kaQVQwjTVR7DYe*0bfimxu>uXhrzX`BK)a=c2kY*<4d*O#ej;W>Tl zEbSirBW{Vu9`>a{-UyBg0uzF9ye)>dkC>S6(|% zlO`GRJr^gN0uDPFNXVq9Z94Hh`rV1nMG0$xQerOIdJ*nihyS(yb{m-_>AK z)VQ$3szlBxhD6VNJcNGj&}FrU+H{To`EE&Sfdy_h{t=oeL4PRNjM+WKoGDF7=|dPI z?k958J`ORk@;uS?{i!H9(or#?@M09(h!~8B`6V{w5hSV!Na8Cg)e#>J zFDX@Dn5t6zq4^@isOaK5@(_)gpF9oLRgC`V*-CLYL7c;tnm^REStJ>CH7ZZtC~JA2 zMtsXA^!t=O`iE%fp8a?JF}xyZYJrNmBLt7dRNqB{lazt@_2&9DI~b(>>;mllK3XD$ zA%>C^^Qu|eZf+U9f{>J#3p{0o_gUm$ec>J2o<`%UOl5EUG)H&~>5ky@+?wg_mx&{Z z?1vl|lvp>A%5X$Y$H%$P*Vr^_Y>W}k)9ggpAC#SlW_rj|%<|%)r7<_@+=c5oPk%%R z$7og)B8P|`nWav|$tm~EEo`#>wW-=9*Zqr^FQ_hi{mUgBr2{gL`L1w5I=c~lG(EOq z*>Ly~Dum{$(iuS)Dolwci@Z4*bj1OW_R1`3h?~ZS^n^hPsay5oHFJ6)bNb2_O>r$! zs!L9f<+oy=Mui!{Nnx_`RaVO9ewdO(+Xg;IdP7W;zMJ0=mQDUzSRA0W(Y59-(lrr^ zkk!mm65n*`0~1}e7sks=9t50e2j2eQi}~+N!r3D?88MJ|hPt%mXd;7dgD#mS;5dY5 ze3!HxRZ=opKNJ;6Z4FH;+W3AV8_y`E*S?%y<#|$hp51>wRM{T+^~&YT{W2BRuc^IF z^_+aQ*`I2<=iGQt+K)H$!65XmUzD4&40O7qiF>~Pah_aA_U8T)jwpS((TEjp@>|zX zM(;|_U9koG&zaN4>Pj-Fpgnitj14Qh;9kO3YpH#0^O{HKUM^Stluh8+blb#@gAvTz zLp&J~skhJNS-6XN#c{^Dd2GbtLGndR113=$tGoZQoXFP-nby7amhM}SxjDMSgG<(a zgTLhRbadERZ|!g$a~P@L>*$~i>7=M;lf2c!tam1u7() znIfEac)wmt;;9-LL;k3-XMLv-)`I%F6B=Pl<{9r%3Fi-q4_pT{%k;j?M9gg98!Hq* zrB(b(Lk)&zG}hr)j+8v+ul@wcBEP=;2aBWti5vV!{>xwJM#TCOT7UE-7j>tHER>UQ zyp6$?O!sp@Z$^}TYg&LFSME=rxXx!VO=yf}kOQCd~> z2nHC}+p<5*QPbzR22su`)_!@JMcN3$y%diY`211lL9Imy?8}PN88#X6BF9Mi=x`#EK7KtPrb*Yt+40LVbvBfx^h0SpqE6 z)`Fj^F*-fFzILQ#jrA(FnWLj~58JG#aW zjS-GJ=JR$=h`m@CbJzqkSu_yMM+80H>Y5D^e5{fsoCR8##kPBhRtw`h5p^G%qi^3S zocfIL1KSIQVEl}o5x52Ctux1{?zZd@d@cyNWVS@a0P8PUi84s`o#IkeTXh3l5$lR6 z8I8L!@}9U-dT-#vKChOkaOmI4(z+jigJR3_aHhJ^!(NNpP;dXpXnCl6sgh9k-6C9kzA)OmF7z6Fdcvzk^8H)#i%SV`b=e^EGdbEN55qYQUz>UUH) zmJL>fFrR<%l0t|MawS|%SfUh`MV5hU?RIs1PJM?>7%%*jL^khp@-dETKJ0340J(fg z6zVkiQ>`p|P^P>?x!eqw#2V=(W^CGAfOH1RRdhbMD)c@9|*Z z)5`1N?~DmalECN$Qq5@Abd(&Z38+g?K`y7y=)OgAFi5^4z3GVC5lOIIh>UnuaG*zu z%!^>4COn5d8n|&TAI~_EB&u7b$H!wvgAH4Dk(KDXKhmp~ z8Au-bNFIDd94J+Wfm7lb*MF+T^oJ7(pJf{BRIA(b(qVmE*y24z(L+WPC*B5|0gGg} zgF@r#hK@bMb_5D}}hdvf!-=ef#bj_!D0VguEE|AXCf=XL@ z+$0NKHQYbYI@q#XK9P<(Vps)936O|FqKq~HwhewA*iD^_m7A!XM95_EolS$TB9EZ| z+-MY1IrLjWRNg8HtEG!9WA%P=AIjqog)OZ+qT8BBKkENsV8u=+ceabTH)9oLm0ii6%F=pcYteZPG5uR&^P?I!`^@Jrb7|UN zGTftiwVq*S@uB|s>+C_{#}8921+l7-2VDp-GOqD}W||;dU_Bkwq3q{Te8WH5!E9-v?RQ)-KUZRA`}^Un?<{pY5bX6h^r3%FL$CBhI9&cndhe>O{y$XHD-z5=8G_(Isop` zxgY~KYO2=fKhPs+Ecih?Oler=`!OU|OVW-Et+#m7$6pE?@+1}SD>J5crg>lBTpk7E-atA(b z6l1D?;x!8={M+{jMuDshZUf`RNOLUT@|@s4=G{yzUnB?UsJ%V%8}HYLA^XGGWnP7% z@IYg-B8!=Czr{e9r{`wijEkhq(bOvsx6YGRI%CUU4c_kpnV1(&(7CJQl*Bsbgc?>S z8};&|?493rsQD5zQ69(C1VEX5{ghu7CRnK<4S^D;uYA!udz)5>&RbWWrh=k6|2h5{ z6QsdmKfY67iZ1ppGyUAg!N%F!!p?-)D|Y3o5dK714>rf_HgG}lD)|Zr^VU=2)ZYwS zfX|ur+hoX~kuA_IODZbEJB!dNLwBqZ*%Cf;KOE2n3uD(N>NF$LXq>}S`ZDlO+<&pl zM+tyE5vhFpgZLc0n|Sn1;_BT|d>+YSD1nYbk8fomgW|WNWEZ)@V1KfReIYEbP!CX$Xqzh4g*f|1axFYy~xKhF8r z3G<U62nqu+ygy8=T`p1#2>l0AQ}IE%Y7!R&fpz&cfpDFF^cwNQ0Ev*^({uUWX+ ze7i#jWWL_eAF|N2C)*9;idKJFe6Hxli$h3yBgTQViap=PYao|wn+`E z3dhw>Rf30G>H%XqNLtnfwRs6+!o`QPMgrFt2cunhIr)Z0hM^y9CfyDZO0u{@fWCV9 zxIr;|{iw@+J0m6V4wW2vP*$+~ULXcj4%O@?H>mDU|FoM@LWqLZXNK_ktTpXqNM42H z3wZS23yeZIQ5FWlx_?!#JV6j3gXF!UN|Gr+Fn2mo@UnIa$=NXy)e3>HjHiq4zYrp5 zmni|3ymHl!2a|;|GAXIYA}&iAy{BK`?WPzG)FLUJ5HfV8{`sOt5uJ6NAAm%yN~KBz z!sOJ4d+cDz?Fx=8@SRb|+?wGk4?PN|7e%6WY~A@x0nj}YMK2lpkJ>et!3df2SRnEh z{^cZ5m~@oNbI{fs9QBmBbyhh!ppgPUUzDZo&tnij-cB^sh-8Npxf&NXI5W^Z$&nTk z7!PFE3RfAU%(P<01^W4qUXg6@2VJ059)ltx)9~t#LZ-oG*3azSDsZOke#@S^BTfIyjv8~RpjM6X#I45W~af_UfLX0%2LQ`BggxXlQ)$E9=DsrKH#>j`!wB17Q zp*+tJh1oFJ%0|GF7q3wQ2Jr5|Jt>SZxojdZM9kJ9%Kr>2Iri8`_X2YnPZEiQihHaxJ z>t~FFJm3E$6jH?#;0M7*1R-RE0PdBtxNM%T_wD0rTS_LBMabe2L&YKau6Sz@ED!_+ zZp#QBH$PY-QD2q@J|@Eb-wQxVgslW}k1x#PX7O5`Uvf|l#R1*+j+{J=_W&aN9oB2z z;5Ai@D25F_iNWEYf+4egzI)<$G-g@oR+*W|O<+o*T|Fo*b{O>uT%`CAM)hQSvmN|L ztZ$s#ftO&l-*l_)Ct9Vio`-PG1Y2mvC@T{59 z>jjh88ojA_7aEAY$|#@x7p@RrhYEy~Gn`Wa{`1>^u!Y0S?|sV(XXwEEf!}efC$AIG zi;RA{{`C}{Y@^%iv;_%oBal8&@Xh@ivewmukrAV0AyKztM=KPF+z+j^+S{eggA?_) z={roUt`EcypwWUeh4(4S+G+~8>9^Nd#!yz6VAR;iRfbcJxyX413+o!FE2h#@OR0C{ zM$%;O?oJ?O1^ayOdlecGFjM-semDH9*Z$(UVfzowBuz||1emqKnZ?Zcvbo?Kl*ae3Q-X|4>XIC*RLL)K&W zpV(4QB@C0k{elq!J)zgYXKGUl54b;PQ%BW6d+wvy-0GEh%WJ@k)_(Ra-KCw7woRYT zc0Y=-GT!_Ok)3F9Rz-5{1Wi>ZLH@L)!2eBD6lq+x^I)lpQu6*h3~s=1EtkiTVzav< z&Scd0cb3$s@e*5D#o4WD|5!>Ta#zY=w;7Gn8c%0A-C$WJxKzpGv)dh-j3UZmce?Hp zdfD_jOTBUtrZdHy^{bf=35#9p@ar}SJD36QKaI0!cG;>TnEdOTNjWkyHBSLd*~L84(bW!Pf;^)P-@#IMYH0zBLPK!!>3OHd5SpeC?I z?6>RC5X)wlxyEr2Rj(WAZ*Tq4g;D^ME03MjRZHsdyMV8hS_Ybt<7MObzHe%w9H!fe z75|VuNSN4u|9M^Xk>JnnIGXvLymWFm91>IgScLf=KC$5k-cuMcgU~q1TR-n3QN5&p zd33ke>9Y8+8FA^kAWBL$#9a`{=4;cD9vnm6K(jn*7}kH6JH$X%$zSWfNC7gFaXUXY z&?vmzpBWwS|1v#Zt*iAtZ3Kbc(Uhq zcE)^5!5T(Hxmf9H8-UNQw|tt=y&>S3&l0o{wEfEE&8#Hs_kH@_3~xf+ZN1rSd5ZO- z+vwo#d{e*0@qOT!lfc5tN?Wr<+qY{h;m*b^{7F$-0Ma+tLeYsbZXgjB*EhPhvO7!9 z%)*}~VErd$G#}o4?e9#}Oyc^Bx9i6Ov84-L%th*^%l+wKtCx`QhwoFSv*u=RD9Ry0 zo^ZYC${|H4f;~Kl{7HH18vX)7r(Wek*z_eXSeils9Nn0auZl%Bz7X9}99N)pD z9%OkOX_{{U*1U3b`WFIN8*W%i7+x)>{ zrZw20D7A5M|^jXMfn1qo4x?cEz%7-aA0{Dg_SHtnf7Z0v@M^t*$1abim7T zlNB<=FstbtZj%AkN;$WF)excf!!{v{WI84KJNR-HQkv`u4QJo^Jc&xnSyZ+%GEhhN z<;?7Cao7{?Z{zD9^;8I>L>eiV*ZViqEq9Leb;jEhb*w+3z4lrncU+L(F_8?0*fkIC ziD0dOFUBL4xpcvQg{nUGSmr%Eqqu&%tI!uTs60=JxMsx~skQ8hl{>(BncEw_m&8GQOSaT`Ya(u{tN{*G|35xEx$-dMUG;cTZ*C4_3g_;-yH;L{N&Z z-&-RkOZ9r~Y=4+xwzLiE4GCAya5zA8~yF|1bzr>uJO5L&gY=hq+!WCIfT@18^v@1U4wfK#PS^u}BcGLcNIsty(7cRH;)ycv-hkr|x!*Tdy z&ejlBoU@LMV0QDxLQ_O(I8z67@Lj{WuZ< zEX3>@jZktjg|r%G2GFi^>Wc*qv&rVWA>R2lO*B3r7&!wnK7;$MYlIaPeddvjiER{}AYP5D{uH>S3*GnYtquLH~jQZngzE}j=aeFbX z2l~|k7-aXiW&vcvrVHKgPkT%selF8p>#mXSW_R?if+KK1F-NiLisrs9{A@A_fV>8FN4+y{ckSXgiXw8J!g$`r64zt?>cQWPLlIh2uJG>5l}t;wnnDlgZ=(L zJiTR9oLv(viiJT3cbDMq?(Q1g9YSz-cMt9acL>4V-QB|w+}%0zp6}lCcm6zU?LE7@ ztGc=i|J>6~yEM$vky1Ncl0;nW(azdR^{lzWf{q8;thdX!K_TnAj48s5bsepBlO%a- zEJA8aZ7+f2qs(Av02=f>MFu2}Lo{E|1e&J{Ra2=bhe+927{^p1%=r9uFtX4ws@5n9 z`w^n}MIi(xl9IRl90M90;9iy zwSS)VCPKKhG8SFBXjY|&>|evdB!-{(y9~U$C??bjt%FMcrK2D@42cG+l#s!k5P65n zuYjUvHbu=cD#B0PAX{NZvD1#kxRo|@cD!1#JQcU1W!NMUo-NFAf|DF;$dhjqi>gEF zD7K*ii@hPg!X-NrccQZN-%=#W@iAu?%{djsVbQFiOd%Xc++d0l$UJFQzq|)>zsT-3 z!a9jDAwC^WV5E4LvTvoy)>;%^%La)NdT9k!R-!7GTNOHceT|sVPi{q|jM)2?VylY9 zD}tn2h#th4TIKvI9+fyw{m+>UbLCe{!6n7$w7NWLj3)$T)GeXEC}A5#pHNI56*$sE zAHqiEg@p31=m!#_mN%DZ>dUzADv{ttOD2{t$KOg94FbND`vks8SSJ^hH&(F14Hsm4 z!%T^^N)ea~K(!ONVPAbQaYTuEAuz4y4eBxv7V$loeQ>Fxx_S>Z;59hva!!?Z*xB#5 z^iYSa_Z7qqUwhxj_gM>?ERdePC{eK6!1&EaQpE`7te^<1RU|;A^ND+xbAqI zjg8P{5<^Ie+Gca02{gZ1Ibwc5Nc6r(mZHCpoJh+rdEV_JcS1^Q{S90}ewGL0o*++W zR3zAnqJ7j<%de60P|fO4IPklAtgA}!zNhv4c6J=RGD!6L-nUqzqFB2`RZ@$HQyhUQ zj5eJykO5pC5XvkSRU!+=xN~Ig9E4R1h+tX;KgiY_h~8Q(gBpAZ_uo-fjBAJji}Km> z5VtjZMZI^rrwxoTZqXdacPQfZ_Z-c!8Tm;}OmZt=Q#e`WlfXWzUlV&h5! zzex6?&7!wzi2OKpsyD!RN-I3&5J~&*F|GMZI`?`Q6&1z6Vx2`7_1c1UBnkLeUU2P| zuB|nGc8psdofap6%tU)kL88Hr7o z5W4_(91o~;R8+U*hyNHM&s(ertm?>8g2p22zloOkO)JTjp(sRxvU!Y(a~cM~{)F!m zNMG!k1|V4LpQzyjZ72Qi`ka6j0ia=HWK8ya|0_Q+u_XOv@P*(9gNZ_=-Zs%GDnJx3 zAbnduk#GkEYFf~D}oRcmoEWM*8Zs5}m-*fziD6R}3$PKfkV5QQkv77h#y`60np z*GfQiLGagn-JDV3ytl!4stxRY`0?FVGR$W%QZ*zTDf}Xz#|ELs>wD;M9PwVmYT`Dp zxO6Hl07i0g-?3tbRDO;Q8kXuhIv(J!+Sk20H5jK>$6mQeuhQ3C z0;{*<^rGZX?PSktczwReNt`s#$f{HcNfG^MY48juD&=UO2ULeXxDN(KoXiB@cG<*I z5E;{3?qUpHDbl!nhJT8`D&_L{`Ht3am&uJEPG*iU=wf<}52694e_m{N+P_$(gfyk0 z{enkG>*w%0*dZY~Obj>YvaAFylL96li3GyAFFddS3QSq8^fb^lwbeFgSdd9{tLe;! z_5SDW^|nNt9rB{K9C)nJmV{~!Yb~%V zF3h^#n4Jh|>7d>V@0p+tXowgqY|-(0NoXnoRtHcwRtdF-pA8dXhq0Y!#;6WbP7=42peB?3H$QpYPG>leeQU^i@zDX>)v)EehS(r z?gsWBk)9Tj@Hd*%v&jlj)k-a|ueF1T=yRW7gvM~c94R?~yLN}g>V$H_9Pn_tbu$F4 z8@Zp0Fi^(vK~yIEFg*kgp4HI2`<{o3M*#26wtp?2(+m1J-#+A4nzkAIvs zWt-5j8HoxNYYRo)56oQ8Xb^Xc8Iv;}3l5`3Oc1>SZ*6TeS&;GwyZp@x&2_oq(O!zUuw(^q{zzGNDKyw3EmPi3nSm+p3(;CV^QlkFwMmfa6BEg!1q_|-&ZnRu? zf#{>GANZ9e)=l55`#c)dMRATWzP#j!{&fM~ttAMulF_ca^hOeX-@X}24DyR7+B{5O z+dRhTs=TprZ<+h`+VM7i=R_fnuu<=|6ty>hnCHC*sx|NxbyF~8=Iq}W8B2b4@g>7f z5?3!(Wa4ou-j(?qj(mzhzj?P*T#{|#@Iama(`U0v%U1j> zZjj$dLhecG26HifWpykbH#VU)sPqqye}mcOQv*oM`6}dbN0L}feu!HJqZKBw8b3T- zu10z1?1$hjzsHB;bAQ-x>IC@Ed)Wmmukq;g$sA#KnFm!Z$D>|If1QZk=xJ!CZL1{k z`NI5nzNBCxtQ0~03op+r?Jw;~+$qLX!anE%e>}flI8iY~B&*KXyt!?jw^yl7iS7WX z^L!XF$b1d7s+Y47lEZz{n6YxNxSJbwyXD%)v^>JaGNZPbsSK8O@_l6MpfQXH7%Z+v zqdHVwe`yaAItF5H+hWTjGwB3^%$-y7B#*V5XZnK~y8Db6tEqvC0< zno)lD@0(yp*1&`v#=B8^VWSvb|C1)2SCq5udfSay9T1S1X}jaG)da@la{K4P@1C8y zYekp+v6NvO>}*!|vlq8)6hfiGFz8B4BoeL*g}E`tjmK9%CY^6qQ(3>}af7)m`z2VC z&pX`1#ey20XZphsli)*OAGDC>)tYKFpwfX&u?;4(?usDlSg~bs*kuL-0lU4(fwCB` zA8SMA79Wc`E|zh(?9JvERwgN2o-h_AZb=yX1ybaqz;2BHLaBxclMK+2^xV);7dve! zm;&H_u^AQKV`EK?7=QL;>d>%q|2$qo!2LaJ&pfTs2{g=Z0jY>gv>5>7fN^e(?*x%M zd&e8_`3gg8qatM{1l@brDvv_Uhdq~iUnTq)y7t$vLn@xgWnZFiT~l5qBt1Phlgs9< zXlMeuo!4As=NdGEldi##!@EVGLKREQ>au>m@{i2k|VUQ#aUVfkP+qh6+O0=fB z)wn;S!Au&6NHg5pkm3jV8QLJOgq@eiXR^Le3kr_zcI`{9SSZWobD7jT$h%(4Aw7R9 zxZL?|KN)(BXgQT);Wd0WBb3c9z7YF-dq^zgY0 zx^ELNrBpdh)8gMa7Q3ZlwxAD{H5v^XajG+8kUR|jIe4bbmR`sReOVzf#6Yj*hjtfv zd06@+Bx8oK$Hk4?DYp2=F29$uhu$VH2YZ`_QQoCBV5%6hWZ!bra}fM zCrf_DxLShVu2;cHyf0Jdj+Wv#lEE@rbmtUKIO+T}FV#+c(lLkLB*!9Y zsJdpst!C587|}g!rF%CC#fisySyY;CQAK3=ndXs&0XB&!t}%C739hNIEYWpz9+EY% z5oC!rHSan|vTWVT2UVi9A0C#9sztD$QVJdo6H(;m)I=FjT^P_XR1hy^tgbNA9T~ul z%xumb{3?K|maRgQjw%798DJa@Qjk#AQbfmBkD{S?{fB%c+%#EMDFp`wZPH60@_nHm z3hYD3O!xmX)*zMP$!#gkDZLfpg?I z>!@f{XwqS`z3yGi&M#3USS5i*Mf|fhM|$$@+?c}piCnmW!zv=UQ(Ut~Bq z#C2o*|MH%_DX{V?9c4c23w3;sz_~7q+smX)%3~e_6EiaryZLNvrb`#3#qywRG#V`} zuc71H;CzW4l|nYmmO$r@NG7%lmx|=CFEf}H!x#y%^6p4e?O6MPm7qvbr&~FQmyDgn z6Nhp==c0{UgWT2!NeiWTm?XAHga(Awp$f2TX$TuhD zE2&&G9%|vep8_!ia2@r#P-_f(zyf@pNR_+q4`K-ds3jrEy?)e=HX;sjA%otk>sb;1BpxnR!vf6t-78+|_Se;m66(6cM5NDkR*G=`jBPCHJ* zoU^>55lJo3l0)}X93s6)nUw`^){PtwH|Ck~1FrjIz4K@+ZVY{6KtBpr^Z&-rKdE*uDU#uBT>rfc0ip^nZ0d z-DG+)v@PlFwC@W`P&tI#?-0~kfuP7>dFz@vN(gz1>!LaWQriL;zId8Ljm5cgL|O(^ zV?&a)8o0~IPdZ7Uf4AzG0%=fP$VBB~fm&1~GsR&dbT;gj5IS3tM7DWZz{|IY+H0fG zO0>!<%R9osMvjlCdy_{c)qHHpe&sVWWH5sK-%DZs3Q)xhS}(hYs|eTz`_oBf(I}k~ zCsG#T&T0$Q(8=T?EygJmaLy+};GM-0}_bA$84%Wt#L+DnjG>I+cWValq~CRx2cq>|IVgT0X!mip+4MdL=I4SNOaI$hb#CYcS6O&s8Q-WomXOu zt+*=QCH@6!vbRV@0r6t|)6=LUzs~E#@Z$@VK^2~xDik~_6M=KDdZ>7{1_Fitbo&Cz z<0L^{0R#u+sM=)Yj015He7*BaEjzh7bDqJbokUPI{C=QSHbjX;j+8++Ut*2v9%dID zIbgAX?ksE!5~zyTz<}{DjSq?Z4lStAw$Q$#`Bn)6-FuO(2^sPid^p>b zn1l?zb3sw9C(yjdaB=T|DBx4@jjlHt- z%kGO%4y0ANxc$?Dm@;mz5*-vxExR!4F>#aq;y0?f5D1{O0c&hRqquPhzo7y?Fj#{j zXOb=C4TxI^9~^etr*IIIGlhO^#CM5GuEbsC33lB0+%r5pX)zeBd+d_FAk1ngF7l$X z@w!sJ-m_1!dk8-SD5QuAsTknlV-c#NsnkIuOI>ZuQ~AiCwSnkxbOSxZ6*-GgagK!M zvJ_h(oFLD6%&;%!nn?>v*GR~nnGZ#HhKu@be4CcmKxCU{N$L@DIl!2(U_??T$USt@ z(zTIIlc)eSlV>s!f$wh=F}{H@f%P$OXiR~l+^>`;(hv`FtpZe($=!V@*ABC%k&;HA zd$dVP_;bJF1|wb7pT(}pfRK>lr~_lB5O(&%DwKK_%=@^#X=G@6{Y^P?* zVZ_)?4lJWO_mVXx!Ag0>Nqo7I7u_2YZ6GDw#=>N@6;-@{R^AEN5uD&6E~w%}a?kot zWVtt`MGnxALF$=Vs*!%gqEGkda+}2203yRmAtO`_x59&t%_QUrxZOjIti%Bi1U#-1 za9?A(+4ogPZ{{}BXPT@#9~*jDDpxX0Gfd`FVLCLN4B!gP1B0BeQyWkj!t1g@< z5w&2O5TG8#11aJiampah$aPJ>e*m2_O!>LATOPG`7ki3OK@21S1MJnD_nzKnXC%kHSc*8slVA#FLX4 zOHW7YN4G)O$1LE6e#*5nj6z;A8aGj8z+*hT(hbKEJT7Nnc72@K8MM1@x7x%An~yd% z@`h%5LciVo;YPv+Z#KAGBSuW=U{-#1HL*uT4tha%M58#;l~Bz<11sT;1nky934)p$s;)a-9?TowFxzMRi@1@4 z{|PK}%$UHIF0lx3Cts&DRU7SQe&`@8zurqrcuuoB2VmW(o4k8Sd8Gu15hP`ASa!Yeb8q8oK0SIh}bO}mNzG8KlP-PJq z%m)&n#KCT)KwpI?Gda5xoi-+e%K0ea>d@D}WyurIZ602Cgpni*^^3iGVGFv=ogH9H z;kxbz_n8YY9DEox@Ys1h3-}=TR#Puk6*QMsxadY2j1{kYb9#aJBg5~?h}WeNo6yTj z`8YxlNB{Zy4eb4wDc_N{k^!i}+lPP;Ec~;MJ(a!OV4n@(Z}KZp2dh({z)QFmlR$+L zpF$P~^O-KC)!<5-Cn1Ui@p6Zl&Y2gNjdkX!bTwv0W{RUjp#@1%45)Dw1<>XVc?3;x=_DEh@y5qZf{%^F}gS0 zH*aR) zKG4)zGm(@1ZV5KdUGgT2F@R-Sh2qim!UE9~s+w93e_}b^A7M1}i)N#UWv|IG;Z2|- z1zj=wSw$!AC=;xK5na_q`s(j8IJ~MMhWkc+3S_T|kjZjhX4-bLzMqu1abP@Tn4l#D-V za7~ghseBmT{Fqw&Jio(g27ed9H=jSvYfMfHNK?ac6T=X$)I{{^oPK+IJ6W&HdTE{< z#C^@#LpH@1hxNN2N$~Dtnz)Vt&H@UtaEg8jYQzClh=*1`Rbh{dXFh*PUzR24ecAWx zX!by98%$4@e5JKUY-=bLO|x+cKjWUNhdtsayh~M5d{}T{;7E^zVzz4wvaljl88`LB z)(MkFb$$8zJ8)6M>i}%t^*DK=RnJkvEG%ZHX{6$R$`^KM;j^=_R$+sF^?0vzspbdR@i; za8O3neVQ~9PQ>04aG9^H)ncUF)ebevK?)LyV*$pJN-gp{@fd0aR71=Atkr4d2UvKNL)sH3Q=yO6PJ_yTn}D0HY@*GNx* z_wSvZkft-CpeF+rm6WPDD}OU52M5u5KvP{+S4jX51!qNh`BSf+o=*frCa;xJ?l>;d zZ$jbLo?U$#k57pA{U8S>E;3qvijw+r&z<;{8KX)%+AhZnvFpF$ua;Xkh*etH*oHh# z0)@@(RJ63TUpWiAYN*-SZ{MD8apcEmaLm*7>Ga;Sjb1q>*ZuQHzG-Nq6L^?^_jR24 z0Kt!#O4YcqzM_EJT>PHKBxg`aeaK7yhK9brK6Yv98ZIv_xxFZu{P-r<_q=!Zrk-mb zm#O2`wIx_*ua7c7#?Sg!?0PMckWBJ=>3KdOM# zaOTamBZ(MO!LhMF`Y`YLFADMVKNkW)^NW+{)zuq2L+vVPqCbyYejC^O6>ozIGLeE`|hG*rs zU&ixa5>X?*%MD{-!pj$+V#}L*zzP_jUDo(qU393=E5E-*Npsr^%U};vBUFTow$JET=8TB0ny=B^c95 zE=D7IWtP#ODea5O%}jgQO~{9(<6Cc#Vpi96^H3i%jYxP|NS<{YFlh>7d!V*CDxi2g zDDUShh&Ge8RaTmso6jF+%PP+#Lf%8q1S9}I<)n>4{Pk9 ze}!OI+2Y~Z+Yz*?Xk)<1St%Vpv#M5I`0;b))6#(%@#|*;f|c6L+!Vur`>@|77A)2e z7n@Q&@FlW(hPu>%yQWs{jXQ;z-u>fPjKk;?rX2pQ?Ij-jTvc<2g9_&i&b~n1#1yBO zyW^V|;ziilkgZo>n%0U*knhX>^#SNb%=9&UUUwq4x@vPJmGgUu zO!@hiNWmHVLi2&JqH8Q4bd8@9&feou6!k4qHEBWJQ3F2Q`CZ!T>IQjf-isuQ9jB*< z0^XZRA@K0cFdchji(YGO`nODIt{Y6lN8{_6p}D+nm40>mr@|J=oefiB7MH;jM#Enm9O9 z7*Xf53FtO-*A0?g3rQWEoterPEQQXH^i4p!@_P-zt7fxrBMJF3a{ z8=o&b0e@XRJsdW+cUBf=x3kmJlG9R&NJxZvIbE!GwkbyTEDbK8ecaQumR2}8Od}sV z2>IPFlz52sJPVI@FYN0#?M~^?G1T0@`)r-6bK7g@XJlmLdz3aba2%*?28Bdeo!3%G zyC0h4Xfrf#<{<5^8GVc+>Pez-asMnUHLuqFW9#Ty5a77Z$2UJG*!VB5hPJ}yb$k6Z z!l0P1a)LQmMy5?$Eh#-$fQKi;m+jP5^oQ?W)WN|;U-!eW2B$c;nlfiKwT0W}uA9o0 z^R>3a-qHGhM?vDpnRx6Nz7Nx&(1~5YGUr!h+%+Niu4jn_n)f53L#cjuYs(kh2IyO zIZz2BZVg369bFct!$IB{uZR6?k+}Kkg-(Hk4aGQS&4)*|Q;$1N0S|2m*DA7wDAAD~ zn2?&^FnfNNG{0FT2sw`swFth=LhpQTgNHpmKXW~{{n>u?;uN&tyJ{AZ;4E03=}J0{ z49A{mGB*EgOT;qB5RxJ%o?^gY;0EowzVvNewpytbMx&F(Kq?(!=+9RLI*iy6e4Hmq z175Q)+deI-)P7<|B--Q2zVu&ATA zDZ}*<+C=F4VA4CqZ{mqjV-rKjQr~iA9|McYIlo`-deVAUR#yDjYYRZ{-M06sEpxs| zX0myRDmjXc<=E{HNj4yh(%f<=&kF%uKfTZ;(?Bw+UN@YYaq&XDO<*_DWap{-8e0?~qOfiJ``SU@XnQ z32c?+fbpnYvSb}>Afk>K+;|`%EcBgO@=s)Q78zwP(Fhptb@>=imdG0a>ju2dS&t$W zXo<30%sV2uaT|ybBrLQc9K3_pL}*wggB4?eS$LoXg0(ACpYmBj2w*K)W0Bu9Ec?(5 zl9i_*?}$+_E-OzL!;DjxR^pzSE4e^SBXcn58$*+>adA$UC)piP(@J|5H=ctM>#UlO4YxfSP4?p7j>^mCtWuFS%k@M^j* zm4qHw6R;%aQqVQ~ow)2@_oW{->#0CH-8n66XK_S7@K=!2bC49M+zGV{+rZ%wY%~#c z_ERDqokm8!l=^S9hI2Q~#c0q&UQp$HOv4D!N4ziTV;XHkTUt8TZ63bJzF$e5=%6z( z!F_|{^J;ks;V^nNFg4N0^lx%7OR-cU|;d$oX1gH(`9H>>Puv2%1p&0FCX@)*f| z{Fhf13MDK0BET&8wcr-^#9H~ZNBCpZO!ygP6$+g}SMmDUW=F}I$4f=^C-#TBux>%- z3gW~pPwQ>%>(OK%RIUz;MlLJRQKDzzW%lv&T4MN1t@^J#$!vs~#(~Q~r>j|J!&rO( z$&DKp2twX)?rZSz7`&Q@u$RD({^PvnIIFU+!-F}Fo?R(sW+P?^u~P~O$_ikM1JG{Y zyP_iUh$+U+O|)hzP(Fqo;YoZr=>8&m-JdcRnoJ)_nFDztaC!_rolNQ@EQNI@=I>lA zTR7TOjvM^`(0)NB-73qV@jaY)-nP@g&1ep_M0GvpFLriG1v*#*{e4!x<~dCk7+fKd zL9E(H!c3g&bSgSlb4QwipGf1KG)XF+Tw*gEl#yczUomKtcSN)q>Lre(;q|ffRrg0Q zgDvpjTDfh5s0B9hkWCWT%s5yBqjgnopL*Val*z!}da#w9N38Hw-Hy^|H%-JM@5t)y zY5x0Pag=SZ5kHR|_Z1Xk|Eq_N3uS(F$yZJMRySVEg0Hnwh&q~X32sY*&X-#b7rYnZ zJt7fO#xlNs3L28Fo<;4oW;zsC9X5oH)L;R6z^oNXz|$-E3v|N}0QO}SX;xB(v-^oJ z916@XAkuc1tG`ALzgUUK1dAi7YL=Ztb~sD?;zu4OmZMyDb3ihjRM$V{pL`<5Nu`r zu7hBehs<=5H>2-j3Syy94rUavLX0-a!j+8}f*Ugl@YF?DR*Q|KG!beURPaOeFh^Dm z6gA-ujtGk(Rhn)sK??PNLsD|4z>N)+Ar1P03!4B*k($6HAsAVT8YbDLx)Jp-VBadI z2=^nTk;u5Tw94wS0Njp&z_cKbm_!qs=Wd`Y@w`;65wJO%d4x#iRCgHGRBW%bXFE3 zkOuchZ+`=lq3*Egq3g?FbP?a_IANRg`C%iAt}Izp2JJ&2f2$6rqm=+Lk8;?Z|Diq6z~6<2ED>vnI|m8^L>vp64Nq z$1S&46yndNUKpYXNvndo@Q@J7NIC;9ZP;N^)KY9eldmwRZ%IQfP9QlJjDNTF zc)}5#>xl{niN?-8H&2j=44KyvaaOuJnK?r()`>*SzX0Qc&{5=1gS>*EkQ=HzA~+P) zI*ix@_D0uSGB&gQkUVh%=(NSEuTijRJDJe6Z;or?&Y-Znj*HH^>IHHj1r7coQzv2z z^Ko}32cgR$cEVWKQk$3`puz79;l_}!D14WD`8M&BT*%w~ z%Pg%HQWoysk&9!i`a!AGW!G))XuIC#on9rj^;mmcmaVGNs1R@{MKH%el|MDrF|DyYKx}!Ff|FZq? zg8#VvwASZG52&`|vimit!y#ZdkKbs=EwXzRulSH>xIhjX%<_}0-37IayzXmk z$g>t61y<-bqgYd{FiC)<_SpI(;v7#*raE6bpQao1N$7VI zc*qMTqNF{x+*c^rg{l=T1St*2u*^zzIMc=NwBks1Orqy8Uw=LN1w8)M;H#3M#!aV4 z3vmj(Rshm@%WQuh$a`%2jSzq-l7IVo^rI6!1VE7XiB$ zS}i0uFs`!ds)t1-5@t-ovl+ykz@n9+Q~WsSShi?#uu$Bn-BmW(H)GdCC!gO#Dg)6K zQ|_kY zUA@-32T|NJE3+_KdAR~^9CDGgaj}|&*e|Ga7ZuhfS@ycR|{LEP-L1hi0hH0z#QI+47vtT_@5#!@YZlj{(VEvLtJ zt!+mNTNz1pvW$3fW?|BiVwC^yC3{t~)D7(;w(C#F#{*+~2E@Vg^2_71lbvp}iRN>M z`1sZOt6Uc)5`K4M-*p2mJv5iQjL-w5xe-5W#p*U`?z-kJclA@V&%k5+Vd=nT;1RtD zl4dGdz+8dIIGz3jL=qBJQuit0Lv|jE3{_2oL{xvFlvpXp!T?gMMZ$6TXfY`b9V4j! zZ9hvDW=O%*h5=9RX6kmb6&Y*{U~ai;R_eyvTTerMCKX&98rAs^de(7RC=w?>tW{vo zEtCe6P>sq^CSt`TbhNtBsW%n%IAJhZQqOQ0@+*N5CMmeP-oNYWjAOkcVv*i#T-|EYp~UDm+ik)@n^Ta z$VtTB6pC``NB%Z=slJ_^i&%e>0YC73yNjJ$SQ-eEKqLr+&pMEmm&eU^vdUA4kCMMa z48yScWg)nGywlw8{hF>z{K=p3k0C+V*Z)2^KH`De4^tPvlu5r1I!P4b74kv4eZNpT zqA4Ug)HAktR19LmL<#&`dLL>eOIAJ-aR^+XsnlQ&W+tog9HTKCB5970x3ti@3flbO zb;$&UR6nNJ8=C)ug$UeE7BK|zO+?$3R*s6e^C)0Sije&2uPadNUwPENA2=vo<5ON0a73iIE*2N>KO*Zs8% z>Ly@|tp4x8U$uV&iL6*!S>Y29Sgh@=Yxs2+Si4R(`pje>uX#bggZy>W%$3#D&RVxp zbMvr$1VoFH@E4HI?N6fFnk?>D&s&;=U_l~cC_zIkHbhYg%7NAmjb-wh7A}7PR}2&4 z8AY?yaoJf}yEh3h9`5e_6np3imGgP*y=Y%FWFO8}yBRsp%`LpJ6uot2mV&dyQ1GA5 zSUV=C#2gVbi4)4o%Ok&-Hi>BzFRichvGL_4Wg=V3rEhx_={FEMI$LT(=`-O6lCsq2 zi?>M-etAASz07j*barlJ!p4!^Q|CmaT=gppQLyjO9eP`R+N-T9);n?a=v{1Vo3q5%7Ohuat_;=mjK`>Q3nTu^_gSm zyHi_(B7Apr-r{%paJlo4d+Gn_v(p9gL3{Ft>3*$ieZP3@ex32ybUOrNi3Ar(EObAq zOkw-*el!W^3AhQx-=jTVqMaN|=|7F`@txsLx>qQ&Mh2Udf z+iSPaMHd*I@9sT(0Q?;(}*wfL>eZon1XtRFs`+O zwkObHEL^qu=0a7&q_i|kFG<5=2RUu}1Vh#OQ;E0yLdRDgG+dcRWx&s}W1{V$H=m)kSUWErQ3sQ2QB%gmQGmWGM> zO|lz)>@-+>7Orl8c1b;98J6LDB%kfu1#7ttj5SD zSBV^*`0esb=@oE@5zqr8-i-4yGjp@DoF;iqjxy7d{-j*9g1x;4`4(r_&r=U7@jDVmNV46gkdZu= zxSC(PDOYfcL4n_{k&X4SJBr?w8~s^^tG6XVeUpFahb)K zRmR!p`s2p8nHRj!wkw>O>TNs|pKiGRwz2cpSX1HUI*R8bz*+z}e`pwQ^e&#A)8`l9 z3Njrg+RXO=vp7e*veYWd@YJUE7{AP*o3oPTT@1S#YBdm!r>2&w^8G4D*wQ_BAr5Zt zp1=auAycxAbrp+yz;6ULl#6Z4->r71r@oE9kJOeB?ehHpElt(^0M|;C#d1+2@kFaF zpWtOO=}c+uTMJR}vK{Vc7Z?Av2B;SNL)MqRbvT1!?6d^TJf6{kMBi;s#ucNsp5~iV z>9q{$x>!KpIHz2W`)NCjNKPtAa+e-1*3WNR^FPkjPmK(X)YP(n;wC_nf6XL@pKIs* zP8i9ojr)7?J}9Y)u*1j2Q1##Hsr4*5wNFtb;9;!g_?9|n#j`rBXhKoY-3nh{N|P5vJnyUu^S>x zwu3VbRIslZxETPTz-2C|a(eS{y9|RsfMjv}o4K9@+vYrhSAVBd^MCoax)2 z_2GzQHFPSgviaY)e0uo!di=@pB-Upq4z}Na$158O-65w7JoVntYanDQV$X1 z5jQBU2}V3zxR1T;@2lAP=&9RjDJi94CO6)&-!`(13{zKsv$J=bdMXEL_rq(1?|XbD zQSJ+#WaCrO)`o+XnHJ96OT4Qd#AqxXArTf36y%*3)>ZenS;i`-;osutSYG~?l9sc` z4qj`3A9InO>C3^%>1OQc`q{m;K+H+O?f00ST}HK8qG>@q#NHEN^L@O%;5-y)6y4 zhJqjwX?}sk51GFyD8)5%EOY#Mq{`=E`|)_b-HlbMW+^v58#=`N1zcfp*yc*aJPpl` zxKIYW`&1;Zyt+^DVtg1)X1l+o|xcS z=I2u!i+uU8ETYRfMb{o^zIujWdcbgTrVPFRuv9X@loGr=?TS z3bS`qsZ8_(df&7iKE)P5p9N;tK-=c1A20W-i9)<4_ts6kkm|;c1tT~JO0fxwii%V1 zetum79rva-iUAJ!=tz_6)PI3U$UqdG&EH^Q#0+04AHR2qu1K2imcct$%o4M_ zU>A`K6Un#vzCd$4l3;i-={2YuV~@w53-BS9>wHKUUuY|{jFR5Z&vTVp%=4S%DuDw< zzpB&`L-m=c6$mq^D);OzkFv6I?!EP+t7rI#5d6x?XnX|E&ugNK6cly&*4J5KTB*v+ zzw)qKL^v5|A)aMpj>G z^0PGEETYL8;4cf+U>oZEQ61%`sil!$IZ>X39tddE&O_LPr8S3*kYfBUM7E(Q5(SoAKsGmQf%!+a#1M&Rr%SE+@t zwDNO=NH9p1y?hkhI%acGDjIWITSwfA**#H55iqO#u|aZJ$igP1|$cwF`Y<2^3h8h`6J8NirhRM5Hbmu zs-^mm3Ga&zP)6()#5NsK9HM@? zCJUQBj`A1fMWEXaMY%bCygYWz8?`~5yu(dSMx6m3cS@=hMKJ7nCdp*D-%HY#Uo-`- zo-KVvKq(5mvv6xj730-#jL=t48-oxp8f8N-InF2o(CFQzqZhZ(JYy1B4vaM~> zcCM`J{}ymp@WeU{G3>-z64e$r2{l>QjwEd9M@cXCFHj0V$hu-WST@4~(3sR4MB!3E z;DA)48VbV;?x#8ANS(j-FR~+x6k||m4bD9SKSnUt|7j#cO zWJ0bPCX>ZOhKUWU$R&d{98DL0Sy6<`w~zZFOw3w~Jla&+KZYSaV2*(L;89<}?m;_=V9N{aUZKGCw`tn=QJ4Q<4PxEb zIOuuA7iIO~vsikF5#MF%KhJ^yK^T|hboGYD*)MC`$6UHTV?iFM9Z#EZ0NwGKlr7(VwI zvQa=n$Z5`K+)KL?a$f=_$=LG<#XHE@giHen^_D{v0#LXk4~G~lc0?#riI*Y9o>o0@ zIP7adjNFsr5rcYWiF5kIl;)7pEq1K0_f6vX60$W~dBw7ob1M-R)o#j5{w01Ii~h(} znV~5Rqm&$)&;yc3#noj!=yt_}M6ODr>Ki?&Eg`t2%MOC@ znloQxM)G6Bpp=v%338eiM1-ZWF%+Rv&)eotJLchXV{0gW-kKvZPjw~$vw>Rs;Eq$^ zVxA=#cHk2&Bs1`dpgXE5A;f5s(zKN9-&C~1L0l)zj-h^+?0Z}wfBmRr1!`XD*d>?ro3 z%Ai<+8q580SIMYYJzGr3S_p)HKEIsEX;eYRnZ|3lfNBDB!UBMz(z@=t?$w#|8X?8Y&O}Y|FTW-ql1u!`IyWBjScJL!&0b{nSN3UHx1k;)D{~p?(Rh~%CR5U+m zpermLJ8Yx zUPTbOYCAhEY^{JAZcYqts}{TUw?IQY(>8q*+z%Nw^Fc3e^mKJx#G_ks9Jn4!hFGlb z4z>A92+DC(94=gJke|#yXb5`5f0^Gg+u_x*DUxr1*0c$@(YLLO6Sh=NRMEi*4oZa7I>l%NBE-! z5gGb!_1XiWpDWObwAJ&pnX8R|msscfV7i_x;otzDU zLPk7K{oEwqqlEVg+H-f>3%EF|mH#sJCl9vtNw4tiuCtu(Z)r?NM1iX*)ZSqEYL~^z z#@o-k#{j)=3lw(km{)(6b9z7>Ep^%*eKoLVkDYnhsp#njL~yjpc5gexUam@TBP@^n z#ljrl{wL3BuXGZD`z!(NHJOn%{~em4p5t}&u2Uxb15NP80x)KRlf;;4Xt}2=4Cg5Zv9}-Q5Wq z+#$F_aCd@BAOV8AyURCu-n-WQ-90_s)zzm??Y+-FJESq@P;-Qmp*=GSnEwqq+K$n< zMVIWVB(yQ1s=B9=>sM6NHP?$T#)RdSgsJ{MeIJhr#DcoZ&wqQL_Qg>D-t{Hq-JAr6 zwHolL{`$&0QhDSl=S|)D-%8Sv#*9)xTOG)R`YNgm!|Trj0f;Y|MRz`*bTf)v zA5AgVom~pyW>Ne+4ydeserc&a?mk(nl==`!7jOwOs8V%*2HgNTb&__+R3I)T*Yt@< zlxmB-(n+fn+4JT?w)>!cH*mp$!f3q6pWe*{4Btjs-5bHl5pPf=ti1`nkG58xbe=8s z9~iEvxG`Rwv<5gY>jK|EnBBEMW0Ffwo3e0T*Eil~@L)P*Mw_fsZasnj-MX`Wu`}8% z*7$}0(f9P^WL5Lwle`-*a|Qv5;l2B!E%skRf`T0fHAJq0ds?T3B`FmMcJNmkM7g4g ze~att2;0wMZ_z3Lzyw3`(o5E5CcV-j^(VP4kjUt4vMrVn6fLi=~tgJ@GfhbVTN=%2AR&A!rRoeicmf##DE&+*K z_0T2A1Z_F*_QzCZKy-fxywOz}a32NQ5GtL)U7jVwN6&imISpyWiM7HZR z)u&H)x3_8+98X?;lhu_6rJo1|T_!8$>5hs%gb&sR zvzK)oUT&5~duwb3eP|3tEXl{SyvB)rWO72%4G?r5eWR%WjgYtj-wf!BcrwNiEU#Wyhlh-8G&sEEP&;lkX}n2uO6O03*Y2~ey6DadRu z?a+WG^wz{ayy9cl333+*u9yc%s|6*r9}38YGy&S=>gZFDxCIO~5V_I8`I0=m8V>Re zR_Irza&Cy^3%JJGc)(kAq+-1>A#6zRQlJkMAvD5?R>?h7kyIk=z<1y0LMmxA=c8^S zUTRBO2vpK!eMT?CH~?16#2E3FjOzI`thBDE8bImu5~0QZp-CHCkZ{`~SV3ttzVi!8 zC8!7VWy2X=8#`Nz-^GcLY+uKtgY?$ZlQ>Lt@7I%-HFeh9TOlmm^#R;Z~P zvl#~1u9O17B*KxfP~DgGGfq@96UG%*g|0gD}RrmY|} zJ_OeUJj}DaX5Y#_Da(UZ79lL%!N5%RZ#b<^BDhfHL4I<>I7YCTR6?B)Cc$HKbxiA0 zJ3)wWv))#@9sD-2zU)|$9vs7Pp}M^rB-*bM*klnMcS<24o0#2>+K-)!K5QbP+F)jlsE%on-mlOm(M? zSDfZ7ax)y2k|3K|2R&|H*AIu1zVZtu<4{Cym!KUMK-446dh+q=!ai50nki{= zAYB=uP>znKr|G#!8|d&4%+Fe77;O>a224Zf!HGxhE+ZgZlVR^|yZQS1N)X4v%RI^~ z&CV)u`$}%W3a|+P29f_xFPoGw#enlhRR0J3(iJ+}{5)~g`qF}EGaN}$y z{G$5$`nERc1zN^=j6%*3pel@ZCZ%FqY<+bcK<3)qqV!_rhozAb9M&9exu>vWyP>c( z5Ed3pn<(RG7^R{UtMDXQ))#i+#7ZPN)6uc2FXq@v4p5e-Txa`7zCeBI;=c^Q15(!w zZgIOGt0^lho2nve1JslupW!jE@YE>?ba+(34G>?qI|izZsY>Ceoo9=T6(&=x*8r1!gF8Da|rRyg$M~Y z7H5AiD*2Jq)m0TgSm|Al&02j?1@OOhb23nhtQ_U!q~12y)_yH1nFJe6_`LRKT_=a_ zG_a*iFAhq@{+yY6k*HKt_UWgilVOpveABU%)08pr(A#d1DP#If_W?G1St_Oux37M1 znoJVt^z8U*e1R@v>3DT`qJ)-?fwJ1!FjZ_lwZuhCNhE8(W+dx^Eh)P?cCM! zOFnnfuG7;=<%CJX=hKbA#3{JSe(H6)AuBoeqc6N|Y-BHS81t&zCavd!q%Zp_^K34z zuKtxmpD6@bSgzEZ?eD(3=7tV733{8j_!+s8-;b@gg{4;Cifa|IEjSpn8afuLdvA|ode<<-Nl00TBJ)e{mEOQ#N z_S^vHiIuJ`E{=?9O3TuH%X@7L1yO7@1^BbGZB`ssFP*iCw!lo- z|0O%MCWKM_NmTwVKZXN@jw%nsL^2JuOY-|fgi6+fzTx@b3nN%{P^LhN;8StC4+}KA z5C0|#l;r~^=a<;_oYi$}DI4f6uN{S|{c+u`nIhKTc%F|PkCxHhSX)|LWaZ~pQCGj4 zkJ%uW;cfTasI8QPN$FA2wDfh>{{h6)BAs{w@UHXdnPphMuNlAB2XK&yd z8`r|xQtw+l*Y*x(W0PXp=tv%&(3ym!T6=G&wUd|8N3A}G0&*JssIcl=!(+zEdCy}p zOL1}W0Qc;D&r>7D>`cy2x93~?Y|i145q0(D^9^uGMp^gk&l?$<@gr;R=+Oit2xTl9 zj;k`J|4|dznAFDcEF%w@aJ_Zm zU^&@z$MV%dOU>0)OC%P>F7Keb)+;a$(CkDVbbfU8cs+X@{zQResq5=+tGisQ!1P5H z@@2?NSIXDh+uvqh8HrD;mT;}z-DaTM;n(rFwx)$g#KKWlRx=@gTW@=JaYgs)Sz|g@ zuC2rQlq|1BZYB*)cbo6c#9&ITY2<@RxRR=RZd#_^#+rt<3Lnc^>i9~c=Et!m8>8mw zmY6{ITO`VP!rxBIF<#$yHw)e6%i+eKJTLOH^IMByVM#O(Vg9T_7pF#smdl4jh$kAl zHA^LrsbF#X$)lNvWDFu3h0Y;BLxL3dLKc+%_NRn3Hr`{7cOHwFuqdcuXzYx+5qc_^8kTHEnG&1tpj!+8HO^)*OvI5;M z1OtWha$KwqxkV)IUR=H$uyeFLp!9KP93SCD#|prX3$`YATnL*h9H|MXAAOG3W2!OW zIdc-cIjtj%@hBv%t8MA%YS-56u8_ft0j0Neb&N2g;rkwwyaRWp@78uRmOF`*s0_8^8NQ zJ1Ny?rUYolZ5*bxwM!#K?9jwbc<_MziL_HwD><&~O_q$5BP3x{$2qQsU0x&G$!-dY zf?W@%!!hSyC1Y1Ttq!R2Wi7Ex5>C@8hqnqhiV>uV-69!uH@cj9`gTx9hy~aWu8DZv zO1^(L_t5w$D|h9!cSon$spbaUyWHAg$6b&$(k?%Fxzh@^s}71OrKjch2!a~61CD~ziX}PaK z;9ol1gX^2Wjn$8@(JU|gF@lSKl+-kq`Pgw%{iCm5uA5vf{GQ`%Tgoq00yT9%cGnu- z*deHhWukcM2>^<=sz2oT-@Gr}UEJYT!P-`^jN3pC1RN=gFC@ApfWu7N0svbTUz+=; zJ>tfi9P(H9YM4ZrXE~IAT z*RxBOH5(r$H^qSo)>^2Qu1z>XBgF-rY__-+Rcs5K;i(H7tE*=zufYX&4RQVQbN=hk z_lji`Tb_KD-Ib$9Ru_i@myDf%6^MwmP+*Tho%4UzSy(ut|E!#88cjZS#kelbE&Yky zH7?=nMp;>cgARrKbCx6d;mK{+lgP=+$;-=MbR7KkzLaK_-UldvIhO+ttkTM=Zjr7X zt(^%iRQoxmrZ`w#Rb^m8UYq=fr-u=FW@cWq0#BkwV4x6@bFzTGzCJV7Z0=J70ybmJ z1FVMBWNgztJW`t#3{N?qg(Vs*_adJ~_COn_AU~_k4`Ckc{MD0`=VxG9S($NuA&k0u zZeD|kTxnSj|6jxxBgnLG&JZa+UIm?Xo*A55{H}lh{%yp#^(7R%>dZ}Ej&?ETOg3to zI8STQC>Id*^?dgQ_CXT&C`c&9^7b_)DfI-;K9Q8YxZl|LIL_4fYNzjc z(n(@|(jY$Y?sVe;CB?!0C{2pm^=h-Scw238Ts>@7WHQ9u_au(WV!?$jDJmEQ*()=- zQ|avb>LmjUPatxa1-6FScCU)^vQF0xU0+O$oq8-8?z|kdz@mzVr9Bl`zSU9-aO{cq zwx$WtudAZJd*bh0Ujs*zc^;+(F9V6zlgTz=Ka*% z@5Oc{@wa_nJK-0!G}~$WjKgB6BSx-2y%XelYxdph8Fn#^1VeoLd&zj%vZcc+s?D`| zkP^Nd^{(g+r)Ww@YS2#;0#nRQfe06qD3i0TDBe#Sx=pR+Xq4%6uErQsN*d;2C7pu~ z!wen%0gFW+KQar9M(Q>Q3;g6>pNi9m}45i-rVWDBfIrH(d^TJM0+aHFy4 zptikc=zKCtq#Mr3dTJl63+y6~DV9Ih~J|l`S33zle9ia+H{UxY?StF1zD$hBvEHP1j zpxE*s!hPpqiP9WYTAsC0CzICTtiH6FgylWJxqn9!pbl;pAUIBE9sK7Ho=kF|b;EDU zZ-Qdb$e}&(xi@!?Z}DgMGaMh6AHPBwkA3BVW7-7~rO&YjFiz)jB2$}O^6q^~CUXm3 z!%R_YkLk3a&me1b`7c-(bOSYx>_84W zYCnBEsvB}oczU{>AeHYQB@Lw{_|&O6?3m0BnW3QH(OuYn+ZxOS0XU-1^uLEn#%|4n z9}XHql-uBVV)>4`B$GaKJ6cCS!!LI!<`Xh=#|sr54;{QD>-B{JC1CkmtzIySgazFek|GX|a4sI?G${l- z;E6Sy8217DO_h>94r}-YN{xvlQTad~{)^XIwPf~u;FA6pd{bm-&?UxHpWh$@$qs}} zjM`koq)N61llpL%34wW;Z)i#^li!UyIp?wTDvZ8b2)8SlgV6Ixur~7+%b_ufOBe~t zuX<&fQo=>d1R@%2IDEK7s^Pt7BEbw25=2$4Ar86Z#L08^7 zBmM?r4Y6^Jkz|PC%lxmb0ldLxe1S`zU7{0pnqmv1z{8>@oP^``D|mJvFP2+J`!iRB zsz=B8C6_uDb6W^qOPs}_F8NYD1ZO)7ulNz->b+&4(XZObLoe zJ74BChvDwkaG$ zF^i*2+Kry@fF!DVmSBV)!BqY$SY<$W{ag?a5dIBoMtIqv+XwfRJZ3Mr+__#JjRU0? z(W~I!Ikx>^B?5#xIs=9T76~T!*~~-Aot^Z-XA~`CfCYj^OFf%>KxOeOWnhE^2#69H z8V{&jmIIhCa<>r|%+v&28X|r*L61Yw#0CLtgq}tI;YDuxJ+2TO=wihMlIX)yM0SMS zxr!j5lQALl9Ehd(5pCTnKr~muG2(~q0^XsLczYT_sXcopS2|s;%mNZjJ4FKP zb1xC#`{hHN6!Yl(yK~j1$5^)U}<7dK{&ArAo!aRNPjN6|Eh9xL-(c5e*vF~6w?rileqE5Hg^U z1S8=>gY@r%Ac-wZW8k8<0V2&lbxiyFYoL#D-hb*4x@#RfLL}trc7A4*eZm`n6_&E! zkkJazj0Wz5d7;zu}&e_wT44|zObg{MAFE~eV5l9tW}d}X8p>KOWoE@Oz$zJr@BjRp2u zJ_tG@G3fp&)G-Obg424yq&)xx z+;-ErweO%7q|!Q8A32;Bxi#5=$TIHw$<6jA_}(IlrTnTWoJ`sIce=BB{~!fC7^dKv z2EL^>90K5dCd5a%H+br7n*w?_E}Xc%Zu)kvK#Sn}@Cs`E2`1SB$XI;v{{1~C%49B} z4Y3;9hT@qWLr1n81q;D5YRXW-1lBp0fPxo@#x-mb#$J>n1s#DGHtKZ5k7Qd0_gxpo z9My2BU*1hFObJ}x?G=UC@E9T3Mnz5gj@b_}iYy2Ig2>m*5OopM9FDxZUP@Cbtvx(& zMj(YWjL2)ghshV#wzU;QxDgW+fe`p-`kra{#W6n=$Qv>{ zXrJ{TC4*ikQR}wI;GT=x+QeJU;X`;>7mXm%%*^5lQ;5lVpQ|%homyF+jx?OMKcL_d z8z{lV1&m(nMNvdNwaE@?*FVPXA38F3#~24tUlxVT?Fk|_dg-$gycgbz0}U|wiL*qB zYnOZOD-EL$$FrneNw|r9bwVZ%_EsLkEV;@SkjI!6#`=S~_|%4kb`UNO&cml}gW1!p z3B?69z`hrkppW3dqz$!rj7dRF6}DjR>SiV@x*O!ADVsMUD`w zM``^EAP8e$3=cg-ftbxV#N;O>xuMZWv73kK~7JT1qCUCn8hNxL4M&^Vhjyvf(o6MFpBJ3h@qYm zBmTSB<0d3xU>LAK7dXC;y6+Pw#S^a=vcBBZ!xzfX|ebs^_-AeM=_MGZz*!$6jISx+6fBqDr zfC+6pYV{9 zXky1@=2Qj6k*h$NlwfIp{c1A-XW^=(3$IiKFQg`+jMXgo+E_WsMF5)^WTgsukH!N{ zRAhM7?t{tnrWL%19<#d)KzNQyOz73okUh;TQh~`LNDO>AmCas2yc0{KmMAw&%uuH! zR#6)sojI0Z5)PbCj4wC^#6Qx=n|@kk53jK==eorkUc?$xlGz*Q4^o*>dky+YL|Z;q z6tw7$rGR3US{|H;@&k9&v5i*z0fR%bLg@javNEo@Ka@b3@%fIZvK(y>xcAKr)$CX& z=$QkK_5%Zhg*=jWA7##xjJf<#S?)Fm-7ae&7FLZjqxkQ!Kd>@YjrujY<`5AYMFNo= zPW(Q!wi3i#5eTcVa8dL~%wVADo%z=;eNL#uSLy_d4&|2=mHArEREN2J!Vv&rXA6Ax(xuRIA z$dXHgVx8!`jl`6`XnhRWTH*H zA>w1n((zqZ?~#nKAtPe0`GR20v=OHK3u%kDjqEjz3-4cAtFAX!n@B* z*EGU%q#6BiYi8$izqf@HnmQlj{_{skX!1e!eVn^Y9Pi%OpNI&V;mm*5Kt(P!qi1AS z6Cf*mHUFxx3OEE*mOdw9r=l!yP60DEIrh{%o|_l+b@a;1gI!_pOjQ|Eq0*r5NU``x zRWD|ba8cTcm2h@zZs#R3SamsjOG%Mr5{Du3#qWQVKD9AHm&6{hDyJ)GO3^nV@amxbkm^RmZr$a_8uo=`#}o+Zj5v}K5VPJ2 zjwnDcBy)oNI-oy(@h}LMBRE}T0I9|Grbqh4dc9a|2>r&ElSd%apg<_hslP`eZmy@r z>|X;id%o{w$MCdW^h*){ZS(kbqI=Jd#9L@z8OV8b_?3gn!QIqK1rUjP>Sa1=P&Vps zw$YC-|2ZFrrPIx{I8U%t1Gx{_02ZmW+G$gcG+Of z=s_0jhP2vx#*5J;L`H_VgKvSEr95OHinWZ*9y!M@X)j_*Wbw1KG-CV+ep0XI%$_qF znSuzy4I5*;hn5FjVmps zl39KumNGC{|1Ot4ox{JxZv@uo=DB*8mPzqDbhmVMmA1UUwzC&-)~y>aAnbFZkNY?b(vAHObJI}&;+CTyba{%>iZndwhQH?1lalst2HX0Y zAyj2*Xz2u8IU^g(o@ME(8rhl{vGVJJ09_V%ig+#0s5>;Mlk%SAzDzypLv$wA1xg&0irc(OW-{V@|sU+Qj${tm>64Prp(` zKG;_3B@%NnpG}PM^87Z?+~B9NK0cpf+Rx+l-cqsGHwO!%45@ju_0@k--6#(ws(D{c zUM8AaxbVMQ*}3}sKSO zUlR@77#)2q&cAU~F<&ag-{msZ`nXQmR$^U05nVZF(&7l31yW>&caz1OfW1uhP2xf| zU_XsV7BUEYHl1X(%Xd#t(^qQnLh(AWB>;od9WN1lzFACZSkqHKcPKEsyK5+l0pGBZ z9TKkeATX@5X+d_jw#8@Vbf!tped50{&9Y&CHD%JgY2ezz%fS0ofgyJtekGURv>;Co ziEp1CmNdCe1<)ueo`oIt0|EkMBpxn@f*32bGmlgayeB4@j5uL*jV=7#4}RwiJ}sTU z)zp0J_W#O3m+xWSKT;`&?d}d{jW`dkIeuxTrgHVxU*W;u@S_#{4f6MW7>lv|FPNC^LDJ0UVHHU`(le5 zO~7&zg_P?2SFYxG`Drc1z5F|w^S`UDE4c=4G8=2R4LjD|`Zc+O#l@zfWjEK>3D9q{ zu^#0QBHc|+i?7+z2H29nAfv*dy2~-qQ`sR0%h2Ynk-YJ-0Vesw9y=Ta)>`B zJ}yqL%d4TTSMC~ESt(cO(1fxo{1G*Ca709iPkhX0=;km&qluN@t)$0mpI=c?slK1z zD~2Q>l$Dh=0Bt*)7Gh0E&+Cc?Ckr{Oo0yW8sjZ}=gP=giz(CWk<#oAP+dpUhdj^eG zv4)i9qh;C9=G^Ygj$rL}ene!Idop$5$$HP6gJyhmHF6|*J3;zTI}2(r|FW+D?sV)%*d+*$E`-J~HQ-hFsz=xhAsmArf_%B;J|sc`03ktL3gwv6b&_Oq+T)@Mic|ZDL+Fq0o^E z_8(WbkJ{Zhc1K}H8|vw48Y`=_Aa%zdU&~5MfBn)V=69;DYWm*oJ9&^#$JE|zIYSHr zmfwf_)2{Tc1C0}69Jf-}egCu8pARFs(V}eB@Nb9hX!dHi zYwhn{N`*T^-h3{HY#CX>^}j01ESqZVAN#nPgQNkbH%nk$5Mz&8W_DUVxZ!~+%s~l+ zHa0He_2+#`g>MUAO3zl>&ua96IbVo~ODcx#-Z!;FkH1Z?GL3hP=7e#E-C-{R zb?DP>4rbE7>4(rb?N4UL#2{#whPsz2=F)a4Eei3w6dw9%XpAi8^mZ2xuo^pFoKiEi zhe0NV7bpy?YQfw*55O##(1S6j6-GLP39FgXbi=G4Uwqf**K!8W@(`gHtzQ;b+zGne z)FKR!3zF1tdhf4&w3nBK?&LKu#%7hIB>Z1us{$x&pGV^97#OV=5b4SUj)e_B+E2|0 zSj%BNy6$b{bWJzf-hLo61y8ZExHOcodtB(MGG6rkPIR5-<6mLnWX;Ogl{dtJ50B{N z3wWAz4d8fO&3}J+99nx~i^iRc$ z(u{OW?j5XJc=gB7Vv2$GgYV~-i{CryP~Rnn_sp4BA|_~M6NsbjFRUsZk6TvDSoFZ$ z>9c=E_hETrxxQp`V7HLb1UTz6XjAe!n*Y?hVW{M^KM)=Z2i4uxg*9}XHPU2xef=f3 zWoFXdZ4nt+;ohw^U%(fqh3TkL=|UPb^gljmA|9~LQ(&spSk~NDUw)})Y`oQeBT+V! z$D`@>zShnLsHJs+4R|l)oHJVh{K=V!>6oJt~!&LLe~Rr5122#EZm6s7B{eM;^kR-^Sgkz4Ndn ziV)`BU&}bepurtgQkK}F6_u0mP9VeAdz7nIBr@|Zo@BVE>(g61oJes&C}X&w(STLJ zAYgMg+lz>_Uq3g zG9MaxYr@T5O5dzwaPQiya81Ji^95U7gMg=DO+$b01+W*Y@7pg;1MlIz;et;nY{D`e z<3|}GS(OGt*2ObBcfR#nB!u|R?Ps%Ahg+ahw}a|cmg1;@Esx1($~wcjGWwLZa427Y zjJSA~)l~cWn0NCA6!1E>kbqfT+h^T652?^QFT}iiH`VThnaJOy zCDqP~vxRyCvmq9AybDNjg&+yGTzxe}_~^785b|GMn7F>Bw;{-sS^!s-5c|IBSN#%bY6xQ33oK)zxP>Mv!lk)lS{QEE`HS%*#yMW*W|VeCgK zG6gdH>`~5GlbZv_5{2o7M)J_(p_xI`MZlv14q?kK>(rvMj@xFf;^H~C9#~n#!po{2 z_-vv8W0KjXK ztVw+l71>|R8{RCL<}M{#`R6PUbaeP)OoaG0j^nnnn}-bDPy;Ju6B^6isF| z8Y{JVq3#&cr(u&ViZiU7FtqM!Ia$QMVW-lnTh@3lUC6-K>J>NP0KRU z=mGu!=wvd3bO=CHKU%JR5HMHCjkeLVKXi^n_=tKgG0qB$OFE5RTds&AG^|+y7?IEV z1xD46G>ZO6HpoDDb6%;txQx_s6MlB0h*}Um+Bx8-6gv4n!Oa~{v5UBb^PAL_AV2|7 zARj#XgfO$9pYi?Nc~F0=~C|0_+JN-l{?DOopma?J)bkuSjs#)(cGCRH!) zPfAnp6YJtPgX8@hO#r#Zm>jB`5&}sR(vK#=Y{oiVg29ID0hQzeM=pc~11M|bAZ2al zt~#|OjsXo{kd~Vd+gY>IP5Hz+DKK>IP6y9|Fs4P3#tB*Lc!H8TWXMq8EMwWK2Nw;8 z?0-|N)svE8!rkq8J5(??rL>h)7SOJodm2cu1c+UY4p1%qAT zOt`Bepp{u}w6N%6%tOXF{j)h^{;?p@w&QF-eltDn+1z0<$;Tx^e^47oC?ko(Cc5e2 z>!!KY_x`?}^vke@k|MS_r%X+H-6$y3galE1YCnl9z62-C$OHWr+YO#tJ3>$l@CW>7 zGCjyVRhZoRS&B!B4BTN>5JadYnR6bL66yd+ilJ9VN^ipuL_#?b-G~_ziN`pG1_z54 zB@@>eUy3UnPRWz=0%^w2id&fs!GU{-5PClajQ9h%LaorZ81YkZDgF@*pK7Id3icu& zu2vCB6!)wBK1FRx=Y4;SR}bK}3Lu16J#46GD>OC_XvRi5Wubve;`M!M8#KjS2+x0C zV2Ce_fW}OhN-%jc6{*6T5~x$Ws8;ZnhnC+Vy|#xT)=(Ig4tWRJNM@U*vSV<}oA<(T zMC{bl76OXGo9ia^G@LA z+yo=`+ifYv`#vgIygOhELk&7$k>E(jdYy8tUfFCK{0Ezc*fuybv(>;19i+sUWy})v zkfRrT`vw;QHJ>6O0)JdtKrrcMf+V7qrsU>xC|8S)j{~;@ffXtZoZ2j#lk@xjjTM&Y z`-T_!(~zVLoDk!+Dl0joo~$SwW`gN(Bz_pZNwHtD*-x@jv;f#|;l)x7^!*BPy=!LG z5L9jLG6WkE6tKfPtI|8*)ho;G7-SrY_1TY(bl)zBy2Nq-5#ecgkhO!$MENuG+NGI% z&ZF&oxSTW0Tohvn%L@W*-q_$OK$7$g_}C@_@%Xf`crU_av!{zld3I_8+urU`Hs-hElD) zdK>C{dsJcTTU}4NzJrE_{#WUwY6m|h)~qvGC}sn`>q7x{Dv}7?*$@{GxExf4M}8;< zl_WX&>#8M(ylR&|m$B4p&~pmTk`<%$(w4o6(bBYV86*(12flJVWb)>7rW^reCv! z|6ZKtF3gTFp)-n*Mn>K?SAkoDIsurH@-{NNeez>Q0q^(e0j;Yg{!NmU#%$_v7 zqA95V6DVi(f_bQbZ%Ld460zc7f{mcm8T=q;9()(%8IE-I6KHW@1}`bBaD6WKpD|Dj zf1(wbNczYH07|%?=kuqvc3GTx_KG9Nwxyo`+z?*{jJFfgKXs4wrnQmiz1P9Sssyf1 z(m&DeBsa)!e>3Z`*U=nUMKDV^Vih0zv7LKuNTiwM;m_6rN6$a+uiJI^=-gUu*Kh^v$_RrWR{dbkg}Z2V6+;QYO4-Vsx6Dzu#THX_2!2cEtGO3XbPH5CJ!w z$pJjI7(U-gG5nDSc*flD$al|-T?~l#?8C)b>Bs%Bw_=^#r=_>a19utfsTXhc&LatU z*jcW0j3f_qM>r(8q~v8$H$gjlS=!nc0`Zdn{7U2{9 z6%ut}D+`ILZ!m`(7E*ixW|I1n$;4Fr84`t~AB*iX74(IlUI~;?*{6YnhNyv7C$f~A zLB<7&J?8NK05*gs2^IMO=*&3<=FbvnIaB~HDazh)(~eVP;(IpI*-HsHc1T4u2|J3I zBjd{&I720awzlv~Y4XrFCyEIZ6LcYdDuNJ@JeD48M#>+?hoH=-CmbWPOQ+f7Hk_Tl zRI&VL90k(Yd^_fBfJhR=o(p-OTi>meWMsa8{DE#tBqV|Zk2Oj>v;@i^sYDdU#zO8F z9jByx0f+^PespE{k!}dr7*Ir{el1;)D&+uupp zz8}y|0l#O6>x0K8Pg!%J!~0t;sQE+WA;OKH(SPRX;mmHauo*S7c*c{2c%wXd(j6(7FlT2P=fg zBGE7b1$obg&TogUEG|*RMB87bjHiCZlM!SCl239*msJ)oRFD5z9+^mOj*b6yD+EgX z7((>Vpm!F6MzKr>jmK2z6O9i+|sD6qM_!Pxvrxkq57Mvr%08$x>tS|2yBMy&^NqXd4E+?By z&7xg!gbxXAFogv!z=JtgY5RcjMnJuu#F_?Rt0{2{O#%|E%qb8Ywk+%Ow-JZ? z7}OJ$bd=-+?gs&VgKn4g`H%=r4O)-N)|YI;#_3I?c9(tO`L^q~%;<&mk#B_I`fD*Q zR8CkoIE4kw!a#ZDOXf$MoJk}hsjyh3QoyAv{iPGVg;Dw^(y?8vBpfvwU+&bSO91J% zM-n3MRji^YZ$eMPbdVBs^h}$`jLeNQ%UtXw~pcgt9~U{ld(Aa%nR3 zv-I2@tU9FZPw+B9Aw3sc2e)JN2@lw$I*Vjg|H#6dC3|jLbm(yq zefwZZW&QmH*4EbzoXE#4nt}t3j0&o%s%mO#+S~D*|7t?by+oh>Y2ixL?@WL-b7=X`iyd{45n_;h)FI(>P4_>`3gyF<~Y%|*o3@WWiO zAq&K&XJ^sGw{V^yb)_slu_>(a_9Y5 z+T5+649xMC7UJO@9^2J9T2^z0KExD3`>vC&dwYztQ^5vG`^k9 z2_e1-3y~6m8h)dA4hIL?z|Q+OBYYrZ`oslS&-o~3D5%Fh!>F(TYG?EGh&|zSYGzty zhKbuygCpOV2YT5AsZZr?CN@(IZ)0q8h#ANAf{aq3Amb|s%@ z_V%P3Il;dDaW(YE7b5!r*3z@_LF6hE+Su%xVv41y&aZ-3li8m9@294{ep}I&2EMoB z3PP_5>03`vj)qRYez&GAw=9}g>5tPaH1qENxy8xp$>9S_s+fPOdt0ouI1hHj9>}3w z1Xk5H3bL@Y9}WyJNJw<~a6&fWn|{ub7R$3TJ|PHLptVHRb2aZ1hag51F|NuFmFEnK z&XG0Kn}wXktD6+^KMH|EV9R(VZL~eb-%OKktB))G#qa83@q3SYci1G@ z0|(1YQ!IahhG8Fw+Ib3@^p*&L+bZ90)BK10#}`@*^x=8_5?_FiNRzqw$e1d8yw>_W zzHXaK(DmR>>{w&Oo)?@PH_N3Fc7i!lkRA=bhJg5|!rLU9wUfpW-)~EQ6T^oE-m;iM zR+k|p#tb{__cYz+RtOaM{)fR1ULqPlL>0N}W+O0alE7Dd z3ywU;L;DejIEY8VVgUxAVyxH$lYvQ$GvStkM;zqc*T?UaiGsS285sg24?l*47>yK8 zf;GDZM0McNB!p=_Wz7JJASwMGbb$zK6iP;h5($osz6_0o6k5h$b1FXq5-H0w3x&RI zqMO8#FFXW^V}bKSe*VKkD5$Jm)T5)jd&e64j}u(j_vi2)$6A}0k>j+wTHE*Mo41e zt)%^^1bTh{kUtzf%|AS|SZ+MG_*o2N6u?;~<`7@XObep-C|}Sf^GiKX2$}%DSzqYa zQ9vX(t7B%%K*4qE37^Q>XYiFDm+xojBR*dTuR?5#VKQ;408ME8)=TCjJs8ze{Q1|6 zYbzWyOorp&y}=pA4U>@KC#XMYkG9MdZGAiB-U5lHOF)R?UFYDO%LrNg7R z?JLrZ6#|>!Mu}z$U+&c$a$-3L7T{u#-~Vdqp+!*lLO%R${T z>f7CO4|poQ#s0|sa8+;}k2+6lCV98pv2^S?XbSZBD0A%i7||u^+A1YkdmMgoe4Y32 zeK72?PcLLMZbJR~=u0FbA@=|3!T+fVWjIl+f};#dw0&E;d^Vpr|}L{D6;OeKHAB*v|pMvThD&X$m;0&GI$zIG^btOeA9> zNK4eSlKjCl2QV@j+6Y%MPUH*Xgc^fpDq4^=4!BYFqsBq;^tI{H1LCjUE|6gp>enb? zs9UJvR|!Mq-n>;z=DuQ7Dn8V&qh!ISz*001zyE;tQAks$eC`gPShnY9!@p``-#53{ z9UUI@08fi|liKsw+~1zRs5}@>WP1ZohYkKdAN=^Yd3A{JzK}`&aF9vaF^p1it1ABhO>#lL?ad7b-m7&2*1`?2DFu}w|BHQI6){GLFq%0Ij^DTc-J^p>??#Nl~MyE~PVtzWK6jnSgJrVGc z0P>MbC1n-d!JBdG`x;&C#I(pOy$)|4XVR}}bA4(*UsH{}b|hEJ$0WZh)sCCR8hb={ zs}gUV%o+vxJ(62EL%Qx=f(%`8H&mL4nsz5x4R6Sk-Z~-+^itcGMc$%VW-*tbmhQ zqxzP%Ku9;9L4VQ*En3LEKHOF8JFOpPZP|eCoMv0IPUv?!20R7hdN*DUmjoYgS-k*R zj=CWdLSJU+x`-&(g!x*v9qvXWs#@u_^;?47fd{lxy@Uc$zrd5~8LuEm$#)%I!4%A!)Hr(jF< zy8bEX*T-b>AEA5yrM%$!Ft@vdeM1O7p#8B@Dy9&+XeUv?4zli(gz>_LCq~HPX4k0^ zHg2J4dN!}aZyn$(veUyR;1;OqNk84UPZhK^QjW@&Ps1+BhZi{!b69pDftVKHz#x=} zd#hDDYE7TGk4copLgNgsr-qICeDc(t;&n^ha(e3In$_?PLAGhEAwq(5kGNCo}>f!d?b8%`Iba zl|hO~7sK}!=Sbal{!x6SJz5Sok1E{Z{)0MQn}$#dS-xg7cv#D^OL({# z%2?`;9B60Fox?ssfEA%VVb3=>ohXA#DNl7i&v#~-2Q|>qg0-FaY4;I+15GlhrK8zM(fsXrNL#GtIIy~zhu|oE&IPDh=wLK!Pu!}K!hvsV;G%^ zQDSUdQ0({3;);jsqXb~Hs71UtHats$toMbXCA`IF*5SF(!o6@BQokVF;ku?*H$BBZ z2XLgn+R;c`wXBumo_@2}5HK8KIO>4Ho3D~Mev2pihI^~!j=pc|s6X=*UqFWNmtLAW zKC*q*PA}I&54Z@n$K<0%g-e4KoFmF9nUP64yO3f3wP zA_BQ?PNL(U9#_PSeqJ8P{B-~A>-Ng*>(t$AP*X>bWpu}@g-VY(5rXB14T(2m=fEqC z!snjB5h@s*0zu@s9w)IBIr9IDR~Z-th^eW2A9I_k zN;-mUx>~A}mLfpc0n`!N!(4iZX!{>|u$wnJ9H{bf)KsBFMB&K9Do*?{8)T#oRO>?q z9H64yFkhO((I%qQ%@~$X8iGH47HEit+K6jK@Rk}0${B>_`eU8xB^*!zi5P5e)*&rg z?w|8y&ldKo@pT*q$HS!daj1UQ$FR?0mvakFybDP@0KT?y5|hlegwqejd1i>)U-mX~ zzFBoHjN?d2?$&y$uy{i>j)mb|q5XMHc z8MUi$_daSL#4p&)#aIY0(;P*N9GVt?cGtrL=;UMZbrc(~r}s}A?bhff@xlvo$E}rE zaxF&^Pwtgr)$<*G$Xws~)PGnFT5;Dw@2@IVk$O%2VWI5$S29U8TS*Sr_v|@*-bH;mN6~ zU3WchM!!3#G(qr zRxl_HgTI=Ru|Zu?v3wx>?D4=KZPcIWkPILD2d}w6wG3<*nV3{W`w@+UHbzS*joodO zWpEPvI+{0#z6vCe75WD4L=-L8;d0_f-63IuCr-3e{D*{|;Ra412PuO+CyhX>m*sDVAbylFo14ns-C>4I z$iDFQK`5|wnMR>NPu?V;%hh7qMtr2keL5izjN6JYeQOaeLH^I%N)=~S<)*vmUfxQn z3~snTzVw;8ZsbtrtsDqyKwew2j_*p<+)e*JHYSg68B>*&oqzvuWT|!Y0A4+p{kvgY ztzwe0*3R;+uFL)Nnn(mVX(F!p%76W!i4X{PUH|+lzKFokzwa(+`Id4qs!-h`VC5~e~eV(14-{6-vmCekGquXlD`|xtJkq46y zDN~?EAH}HhrNw|7$Rii8V9Z=d$Z_qUY2A)mk}BwSvQzC`$klQ-^0GTyevUh`MB_KJ zV$(ttppwaEgpTNbX^<#&1^--_UD?umhShKSQN4T!LC3)8gzm@`Ni3ye?u7EdmcX>P zvqKKdof^g&jf!Fy7M?1$L1(KUkfgyRZU4pmf*u8<1|U*3+UF-H^d(>%2Sq7EZ?O;( zs23pi3^c{pR2ZS6`8i6~RFfPfHp@;=>Hh z`O1UU2=ifK=Vu}sDk_+Qg?lIz4KAEiteuqn7!0NM(1}$9MC2xq z4;?g@o(VRsy_*k00V7H_v>^e)ws+veIb-z<#>oPwyQtq&0&%a$Hl0()bJJe4_zGX! zW#r7O{R*FHZt#(r z>3+)5_s{pUoQ~48gB7X~73xyU!^3i`<3X3B6pgOG^mv#O-Rz?SzvMufdvWQ=9iU+i zZvtAZ$>`CYXehp2>p+*#1lccgFgu_K8jCjz%91cdz7FVRMOD#j-4I(XF zudx*h;SOC*?h)}by&LT5ME zCb@?u$~-(N@DYXzpMKz`hjH~M`D`97>y)9@DV<}LQ&z<8csHx+CmfzO?{1SY9U;Ir z!{Q|27R1#V0mG7CSL_!Y)d+eo`V+L%8QPye1XgwC_xn^SKS}A&3GC^8#VYR%4^8&>yim(7WU}{?KQ6~yDcI#+6@GwNQ)d8>)7y#>cm#%i z3D%O9rvDgOR>Z+gBd0~3ll2o_mw$E8mslR8OXNgYne}^Cz{=SrK|VtN26GrzBO^tA!}%)fuV3zh#oJ z_ft+x77rCg{jv(3L2UaOpH1S)%mfVa%ws9F*+=?-uY@WsEGt0mw=Aku|W&?xd;HcULNdp*oa{dM{%Ii{X^uC zK2xC@#VD8=gib?G3!R?#6;IJ|3)pgP47BBOm?<*+{UC4cxu zDUYjmp?zeT(}1TSXTz^7YA7{8d^|FqB8mGu#=T*xRZkN$6++O~WXkDP`7y!}!cpW)d>|KU97@mVK*u<9Kf3od-d zLC7Y{=nL$zx{{huOXeYUEG}oWR4xuDGCU)U4xt_+i82-k634J#B#5k&lwcn~WnrT% z#~Hp%*>KHF#naJ0Q5Zy&LIup&!PUq%kehn4WdEnj_uXaD>&KwCq2u>!jl%a#;&+Hi z&}GuwX{6{|xk}*fdf|g}5GRj3DWbd>hftnR3e)ktjR+@V;DM4h%>i__EV*1=?(@ys zR$a}X7%ucTbEV7HC2m6^x?eA?K|vw+s69+Q?)6;>Flkt`xQ~#TppB;oj9(Arw8(%m zIcfXuyWe|V-9|)DG>bC<0_VcXXG`$c@gg%h*GexGVID54kA^fS0wDhKei*_qyXy$` zT|E2hyv8LR^;~25HYqDvOl{6CcU9+KXMjg{7|GQ*8lEbLbpMR^DBhUhDkX#h%69O6 zCrl=mYTOB9SR>US``J8!<|RO3gp};}xTjV6x1Y^XLO; znts}AGi85V=W-b^)cq>H&41D)$>Sy~AG`|;K2;>=P4Y@vU_!)*kozL;qT5G5b zn5g|vdYP)-99}}-ml$Mp&#sc4K3Jm{C^+m>ea-U$Jad4L7?U4FZ-f){J0{YzT^qQH zxsN=maN>V?92HqBJ&8#dYNVws&6?T}dDcyn8U!_>NS85$Bbp^RPW=hKD!ddK1D6f#-0r$0;AW~f*7ejHFKEO7e=CtJ@23gifv+<8f8tZEpy%DX+yuD2W zWhlbEug{$YZ|j`}$R@q7_uVR+Z&%L#n1sq^YO!S_;d-`N9kZ3DA|f|#!xnzNWI@%> zbKRSwp`CTF*WLM7FP46icWi%HHm*$G@0)nHBMt?Pc!eKUS?73>|ATxB9|yc@I3u}- z2MCjcd^%E!La_M7Rd9y;0R)g`jsIc7^EIgZXODNdHl^s(9b=Hoxg_s~8>>2CcLOCr zp|+k+vIfq-4Smy{uc#lU0u)RliOcVote3+pv7j%2^MAOGLxupsTm)J-pq(m;F7Xh} zGQI2zWUi>hp2LZq#(jHus8CI~i^0n-z)p~sAqVD!YJf}dGw+Hi$;*Etc|KCQdRGSlQ>G2s|41TGwLNA@unM75#x6w6OoxcOv zSx5PTvFZgHuHE*bVu0PUTi{2~7N3~aDFqMuQW+3X@$;ZLE+3}WfD&e>m^5N?P8iN8 zRKiL&%a#N(gN=2esz&W{;eS59vFe#kwZMitFbr}7YInXOu!x!J-V65Ok})#TAjp)? zBz#K#2HDeo5y15 z;eOr%^0%WieFB6NeifldhIniOgo&3)5XL!dE8{y|(rt(oaNJ@EyI;9>y-h6tm7e-0 zI{j|hWJ?nLQT63}epo$u)#S1pf?G8_+xW?z3kdWJ^^_q4hYqL_8Ot}$-k>E5_?AcX zi9Q|%rEIG_G4F%>B=&H~YRZ+D3kyW^e$*K|w?2CA*K=W8GERKhZ^C`R@8*oOzjNmS z^tIw*lUi(yKh)xLM4sANzlLd-cp89b^iepoo3RF1^f>PgfrEO%_}g|xI%4rFQ#?V8b*Ca^H8RuY1Jkv zVQG6%m|{EWopn-C1+1ak=F@D4t+M^&-gnAId?>n`T`?8ziJjYzF`NJxs&z}!{eT%l zKo)n(>i@?nNNfp*AwQeOdy9wJrJpYg7cIW@^u2u(PVY@ajGR?+fcAi<+ZoH zqt*qn3isu8=5;fnRYY!^h8o!R*F+y~U<%s~-&6wL1o3jC8i_M(MJAwFt1D2vt~mFV`QGO^aE*HZf!;4mct#aE`;lk|?zX1ILR zgf06fEd9~!Sk^HXN+!Frje+leh(^9L#M&c>AvD$%+*uN&^>=Y?NTwkgV|EN#(W#@L z6BxeOP<UA0i%_oU)i4&CB7m^4|&s+8ISJ5#IT{W4I&Zexv@k* zgpWIyt=4(Ud9VFaySV?LpQ?~M8|H4Ue=hGh;-HGV|F_Z zwgZ=5Tfi~>RY^0b5N{hEV(;U=PG@WyNwsGJQ%1uB8(57ZF%OV5RXao}Qt6)+8`KtF z6)UEK42B&B74ipH6%|KF%r0bTRT}LzgvNzOo&3Sz#&ID0cViI&>}|p#n8P5-REOQr zHyN3U93}z;QcC<1hF{r$@)W|b&(+{6`E5%%&)zVX8~xi*%v11qOoz0SN{ezo{L@sw z`6n(3l@%3kPc0^&Bh$dy(k>!nNX%sTw_m?#*yYD)zGs>astHDNNxvMxThW^5^fPzH z)3{48W6#MFyd)F9bVc%*WgxQY4jx)znD@hE3a7A9-3)rNv56W^bE1Syc-*T_vSm%H z$*B?`h60J%v0Y&}s1+1i_Jmn)2l)RHN0*NmQ=)CxM^U2g3xioyr*UGu+t20OZ94tP zLU~G3#|}_T+lr)t(Gjxssya~Hc`N)ykKPvl3cJM$DW2l+J9_W^w|RL{-+$+Hlz=wt z&U)WR-d|R8$@kg`@B6KteRrB#H-ZL#h<5EJ^$3dajNAol@=@GQf?%W=4B84-CG(RF z1u8UWivwT3&p8V@`-5VDEuxnEVZxg6L2U1XO3%}(0oltY$N$1w97Uga$xf-T{yX0A z<6$6NkRBQ@^iece9By#uW-N)Oe_&zBlN23~CbD~#VtK>P;Z}qgyA(k_8QEVys6rlS zI2M6iLh2`Q%r_?nC{YRVgD_26QKhOAHF2XZZI%vB9p~AuK zW)_?+uf*t_tl?9KhDO%fsg+kkkILjPpak9UtlkHVm4Wb}7QboTp;MaFQ?Ml^jhGaZ zHCYf}ZII5s$YXziDMtH;gH&$lBJMk4%_O4nTa)Z0;gA#xjAMe3K2;GJWeotVJky1%AJ%W+Y~hv#Bh~6u_Q~oy910 zRH?|Oy2UMycglhAA($AsMe;=x1?M$yJGbpsV*&(!FqT?ZN6+5Dtouh&7<4W+Ej)>r zPbUxA!|AJdD~jlHH2GksULv7|UEQy|*Xxq_n-DcRZ4-fenNQf@PE}npouLv=gp!M4 ze;2|cv8@juZ5I~q=i}1pzs+jAXHBhbZv&x=D9h#z-rdG;%sW6GmntBC+XYe$F)#*a ziUH*lDXGz3c@{G%1Z7|N+qXf}zZYkxFJ5^T4TR& zXb83xi9fvd%9))LPCq;x6E3h6efh=baCmqaaDqlg!aqFTi5?^n=FZl?fq;%ZLK8XzUcfyO=x*GsjHf>x#Dicc-abi z6g3w)Iu|K@J2ki*p?(F9m`im%cRf8qSP5@0FW#HrDzUdYB~_TTPttJFP{=4erRV}g zhPZUPLn z6KX;nL12WWB-d$+Sk^=2lwo zN#qg~H<_?(1p^q%m*rlskKFc2BQW^isG&qdclvb)ajqsBQ9lD9 zdv<^D$s|VXx)SSb7<$r#WFdXBkki4Zdj+}7o$|~z>&-V(LQi|;FU~Wy?(MIs;hGy{ zgYe&|AWi|V2}{?hyAAu$p85~D4c6_A=Fk_|OenhDg5 z_)n`YTOvxFd_Xit3IGll=D+*rhE<6JlF&iNJBO3^XyxVe_GM}gv(ym>itXR;uC?rM z9j~n<>Eos9f=3$}&;%u4bo(h|lC+{RV2U1)4kfe93q{<<4z)1zMfi(Gzy9reTD-sG z*N%qXl-{;>p%CqIhsr&bSP!2CX%^4ye)$bq=Pk%KbZ=bvivkwl`1trT`iEHWN4-#B z&oiowj2#j~_sA|vPtH;st)Ks8HrdcWZ#Ld$Jm}Xo>pAAJGS1LPj zS2Ggy0`{GrnuAAZhww!1NDS-RRvww>VHY_t{ECN#dUhR?%_`J#KV|h(uHs$_ za_@0WC>ycFuXAimEXf_K5iB1gxHqW8fbSe0RI{_&8 zhZGo`@Q-QI{j@jorUHI_NVcY!EW$NZy=6K)_h#xZ7nwm<0gE}w_+FCUyu z-pE!?Vv~m@0Hm}D0e?q`Qx%tO$joQ^MOVlHIwzGELbOfH79SSr9?(2>@ArNfwCVCe zcp_L2Dl?IE!)@ET=VkWty)`HcwUB>@I++AN#2yBanup$ob>N~YSu45`2?zD`yq}}= zx?laigV{DTGO#Ol6Ml(HU_)_wxOrU$a>5T|8Wypju<+-1RmG8_kdFSL-CB7H{@1&a z(+lK?*Bd0~Cp;d#R4%OlyoeSh^5YN`~5aDC|(N8nxtRM{_%e zjkR@NG5cC}`{UV%X$@g}w{l*RIx?cdzHwV$J97{J8XuRZRwQO!n_|QAUHo0q-0(mfz|751GJCi z6j&kbL+$b2`LdOPDT$(@AP`?tPc6MEfJ?e+P{^I9zafKbMJhW5NkYfh{8s~jAo*)^ z!W_FEQxuF#t`oE2uPqQ-rYAEJRQ=O^A$lqzulbLT<2Et|4xfII5|Tz;H8fzQp`eWj zB4`QQM2jn4ExE4mR9IP??=GBDv7w*&l8*9xip%?lmOz_vPj%e8;YWsMO-xKi_%lAS z_^enn>@_Svdjj#unann0NRR`)8QiTC1Jcy)uN;fjxyT}TA;|=ZnofW5M+vtk%0b*k zQ2hLYt0CyWh@q7rK*3TPB~|?B@>uc%-&M_K1xDPZUuLEWOjki!2oZ`61Swdm6OaN; zUslw}Y;a?^S z(YLtu6ov7s-wV-oxwtdL%aCK|VwS_}k%-(o;Yg_pV*a z4L}7vPCf6#qL0flgil$>rnI1F%LIe_+!!}_#eJxwnM&NuuMpY)OfrPa{~dNq ztPnVgHns{a@&HkUY89pweEP&$op|l5BEe$kCfRU;A}kAI1f)18rTTChN!uD6V0W~o zT2h41^`@-n?0o#bac!jM*}NDk5OX*Yt`fx44%5V%?}K42iGD^m@uXv&@I&72dal^e zS0D6Qdij=!R{Ky{$h~w_MMfy>{`cu~f3~D_w{Goh-_UpBUwb0G3fy(}U$Y5Z%4lw;J=(K#q5_MFd4fLu>0 z6uFWs*|d8+30Ir86-+568UNr|ioalRx?>iRaGRhX>N0D_eC>tKCNCaa@oOi%R5X|4 zN>O6MuuT~g>S$3PrEH}fJ#L2XLy8QdV%5u_0;aU%WD-W`9?fJk5bl5*pxh9m;u&o= z>0JZf(gtJgWuv_0Hm%pU9qSM#P)p}KkJ%pQ!&qX(DH}#}Anayau%Y`}1F2y?nl!ON zFN*sep{I9*!e1sm2)_TKB0f0NJV(9s5i62`P5DV672z9pY8Q6eLX4of4iXgrO?{9P zmMTQi7~;+EBPYaCvUpmxcw&trq@H*aQ$?OvNTq<|R^n!?j>S<;2y8%ZAms<7KF3vMPDN>SIR138g$!6VZcMgtrup&$tZ$G-^g&bss;oh4k|k zJ)vOSW%(BJ&&94beC@fnkc*P+9j8a9zF*LTRa3+<>G~lS_k8d<#T{CLU1g9@H(MBf zKllPM-ih)Vb6OCA?wl@}x^%Yh2f~A61g`uaWl4Bf3w@AP^>LhWZ)QuqwRHxWd;U-p6(?Jc#Ot~3((B504cDUR8Y+Kqp z*O?g9wQ_$-Gr6Nf?Mf5O2@n7opyGZoa?+vE3ZM5)9~`xm-*p-ESE@Ir;wJcH&y^nF zcOk5IHJx8=!qnA%-Z0MGX7o9#7ob_StRgDD74yglCdnz;>Hi@gGE&+ki#;Nz6)`>d z&8;X(4w}Vj49x`odK_OLStvOe1+PAI42~549(3C0KYub^W)F>;(!_ncpCO#WGFS@E z04J~Q;C#977f3-7m%=V>Yl4`*tY*qMV&g5Q~f*{Q3y0I@0jo84~6 z5I}Q01GF6*df)5H*Scixt7FR#T|ZodJMbLE0y!CZq{(kjl_9!M61n|~EN{7rmxQ;{ zN&i!o`V#MpaiRYh034+e4#3CdO;sTiPPmtb~&F$)#XOR2*O%}rj(ZRR~Qxvq(S zzF$UiUgm_$4WcEw|8^52a24!{hO_eSn@Z1f6Cz}N&HzG!Z#S*CI$i5ox(x^rG>ueI zQAx{Op+YnhXff3+l^1vB#psCw)`ITX97gw2=EKArxyxxDRe!w$jU2=mVqVrhlr!w3*trsWRmIjlgq}s{{3&7l ztBJ;PbKFY8Y7;+Gy-DbYtY0-thh+Pfn0LyrgId;i=pfse?SanG?*VoogwkA%}r+r;ba}O~u|3?;pdU8*pr*a_s$6p~~l%sXApEyrd!t`J@O*VT!I_4?U(m zd;h<)&52|OL%>BfrMMaL(a?rgSQUqg%?PCf(h2oXrLPUYNGbGcLBtz#ycKZ(_8wBO zfvfk8ao>IeZ1Z9nazDds-TGsObStQekRQK0vH6)OAq?!e#^OlQ=k$O`i~w<;g*JTy zZu({d9NRtUO%D9NwTZtYKN=LfNRp}KQ#YNw_(9H;jCF&6zfBFC}XO)OfID##U}n@^%^a+J4L3+b;l{f7!-Aa zl<*$iET8D85TM#uXp7iB^(fhZP$LcJ26A@GNyBxoAxvdc@ex`!K z?L0y}dB5zq0cX`B?M;7w$obHz*~{}Y(WI539b+3 zyHM1eaBSXOxcPq>l5nT*<}gwWfiuGZRQ;&(b}hPE_Bu*I2g<(Ky^Ya~bXgT=w-5VN zs@^L3#WXzMN#`Ug6ORbNWSbA7V}HhyI4?gh8}!QYNBxB`wdW@%!b6hw2Ml>oyz{%e z*6MbRy`b?Cy1Gt=Eq*+)nnPTV38Id>$MJt{$^bx;Y*fT3j;h{B9-w{O5#RVe24IP*_g#+3U?OBgTilTa+91J&a+bw9q79IP?++>6zUB!ThOUH@&pRdS4 z6j%TqZKIkZ`Gh#XN;U~R@@#}~nuuZ}l;1s|rxJC4X`q#ivoo9u;K|s}qwYhcONtNh z?IeMv->$It`uMy*h6NUb+cy~2B5n})cYrqwIEI2#xOv_sX>s zeoX!p`k)buTMh+RGzp=#{(CT7Do{nM_?sXv6yzmFfbjBY$&koK4hrfE1HJBjW~m9;t+=WcKo7ARU+LSOnoF?rT$lB7L9|o z!m>!!(Az<|POBmcSwmL`nqEp3eSk^U2o6^(XYkDE#-4KtNvaf|!Hg~LTeK>cB88?3@pi1=xnyI#Z)1J2$*FrSJ z!y#G4t9H2^8dpRrzTw=+4fXBW6%eM5zL3?#f5Ms?dOA$b_zNPqZi3-?20RNEo1lF zva0;(TK_<~Jgv1o@Guyi}v7t-(YU+BMlJs%tG6K;dRmspc9Ko)A&WvCk&GHI^H-9&o z^>Nh6P;G4NY3dW=M4jAW&}%K%aF1$oLYUUae3nJ{wNIns*BT76W`Bh|+h84KZyV(B zB>)MW>}IW~8dW471C@C{}AZ?*f3D#xH-|tpqWbVQAs`Cni=c!QkY}6kE%Lhe{Z&aR731QV`6{y~A#1Z== zJ_VDryvRYLz5!JYeZN{8<@$R7q**Lln-Yk4VNSjkYj{BK zc2Sj#ywX0D`>nMT53Q}@SM$Wu5#$OGk>ddLsuBG-)Q3TqUlQqCHxJhn09)mRgMf`- zbG-BK?R?w9+}ILeTZzM6G4)6uGGU`~SpLj{J?GRNNK`ve5@4Q0_AxyHPTm0z=(rSP z@kG(~mX&)qv1je)W3G26c`yMs?W}Is;hHZ)3wvnGq`^L)=oF6VPPdEyr^u`)Ytw} zS=Ccn_7e+hCS$SNzw3*;@;k9B&<=&GvDDD9cD7cwv=P~0?d~{3-ICq{(OF(f%QWQk zyZ4Z`7;*k$wJ!a%5-HpucoPb{53T5v67aQl$4i0ZP>t8yw8HGUPB-vPD#kA${8Q8 z>TpkxocWGkr*zt(ySy-~X=1F;!_BRwwmn|QA=2{hAZc;?*mRsMeDI=fG~zB#I#WR6 zkcYa&y~xY^Q&UF=Khuz@^3u3axSsaMv6!8!v=%=f@flG$X>D_3!FCyX?I&AiXPdgp zN=AD6ikjLAM{?av&ED(9gR!cyqYNI)&hI~3N=izKN?#s7v}9eHM6)t52qa1H@bW%W z2Pw_KmTmp6G_tPlR1LXn@jRX>?A6tJKD$Pt#{${~$;NdJ42-r{RJT^p)=v)In`X#9 zR#rN<>l$imt8J}paP7_)DA+|!HFI8*P;+r}2S57DU-vf;aQp1f6xfL9=yM7Q!2YPH zp|5suGIGDb#``C_?%C1UfMBQLU0l)D*5)^QuP^Yr0$IyK(fZwj&uUyz!xV*lXk23g z5ZC)Vic_jUT;bT*7?6LE+IZF?h|QZ)-FCrHpi)B~2|IE>CC0ZzQzoXoj17S5E=={3^#g2R#RS4|&+l7uQ|mZF%z#7dLGV z-s8LY_(F#xLvX%|%Byo1du=tyZ6h2C7M!dkV^u;KMj6RyNZ*I3N=T-dlg7Gm3N=~| zPqIONefYD0)XD$+{b?cSWisgfp8V}!(90m}3*!c$j0g&PLV3SB1(Xw&u@oGZX0>g9 zn5RgOKd}yz`%ip_`$xKRKG?`pq@8B$@+fiKsBXRK=KoTBu=wF8p^oo`L4ZX@LBH#9 zGc%*GkGGAfhaD}&-_f)Mc-Xs~3~|L+ zK=}eFE#hPJ{*uDDnz{u%#(WT>F>xZfn(qIPDR@|%`p3fYU*m@wNJruIMz!D*yNLNi zXR50yFfaA~FircXp8z8fy!5eO4?t)#R@9%AcnHqjREsxhef_j`pX%XF)1vB^g3VY? z*$gdHD=S0@&Wln4WXOYgc{1oP%^hh?HD7=k-uDRXJ7wbBN2XP>8z0Rs)~@wL%v zQeZzX_X}S!Uo#cMH0q5p30E>#?3ZzQq96L)*U;1+MjA!sx>P@vVFk+WdXQoQXGuNQ zqSL`BoUaPjv_x}o^^p?ED{*yaUNtifwE}Yocx4?`^R+NbW{emGdg+1?F(8xGlUJeG*2H7f#U3*D(pTC49e3T@7n2U@A+}b=NB!frL3aml`=n zep23-gwKPCoAs)uE1zQb(at%dSkUJB6|2bEtFFAzPa2@Lz`{?z>zOnq^B306;$7dS zL3XJHdf^hrNuS1q!j z3}abJ)ga8OzvPGE%1`xNZAB8PvZ?l@&HZFq&QUk}CJxglA+d18 zI;voyC+&APyERvfTUG=UlI1YX;{}U}(a26#T;kiV#BXz>xT9c{h&e9TnEk*uzzSvk ziZgGf=EfdMfu@fZr<;{GiaP?+5G(yB(^Ciski!M6%>Eo}x?Be9b5`9!MrlBU&iWVfzQ zR}Wjf0#UL+UP<|FBT%^q!9a&V?mNpyIGWr(cP|d$-gz7apJhzE^bec_%m)5P58U-n zc%g5#xCXDuFnQDhW1%!mv$(hCK2%8sv8?IbpF=<8FmFZ)2)*^u47L zQMjTVsAycx>l9Ur5JAg=g+0-@_^|)FesX&M^W77&&qh2mX-c8V4WJi2qQ(Mt??fp= z6+&A{!uYI2DWFb`4YuTbp5W8ScX>p5<;nAFZek9H3#030ewe+sJ?B*t>DA5{!d$HN2O7yEI7a?Hf=_tI)wssj?HF=#Ty@V zdBOX98zbn?vY2jB?iL}aN(i+Y zCxl=iQx3YO*`xZr;3BuQQ?%!?lXpX^cj$Ii)bD|_Rpcd`RTPq)d+LQE`utrG<;fw;WKJv6CcPTDIe|3|ZLL3<(7506^>c^= zVhxRzbBz;zFjpXXv^HkE@q1WNNe&>(_6#+HiE{c{74{g!<0B+a&^r=tmVcsey4=D5 z3|e<#&sbKePa}{S(b;p=(y0cdX-$NO4L~b3#6M~d2qK_tX|Jp(&_NZDhq}6$CCe0V zKli?WnLGX}`uM$bij~@p!3C7su1P3=J>bzV>nj#!t~%p%!}9+CA3@;0xpVN1RW(IJ zltUN?@9aP#xs)I15pJh7{cqP*eQRCUk>Xi2B6|5?XWhlZdT54oawzNUC7GTCQa_?6 z4sxhCD{Ic7pxS30lM{2K$7DL7&H^&^OzJE&O4HyY(h^CEq>cNiaS**0UROPkC?Ezt z+=~go=u6OS43uIVrSpM9%BlRP+4@pllX!ldA8gQ-3o_;pI8B?zq7AXgqS5_Q24dY-{QZrUyNSZRn zkFK-Zu)5uQstpuYY&fQIK);6^&O9dm^oo8M2Wyh}$vwv11;)Wsht5YD2Ut4OL-(xV zivxZligF@V^KAv%ArO-^MG|i-n8pG1b5U=maqwDtBTrpO@p9vU{sZD|1vU=oxV}+^ zG`OE{n?#~3lE|##UX4%)VdEgRa)LU)s1_s&I-fa6t+Sz+kOCsog>gVrZ&G{YuQFn! zfpGw4-Z=m#)r@#jzA~W^i+ethh+LETC3b688NbSC7zYrA24~}7&B;zg#N0`R5)B8d z2*Q81>$J$ZXgKkT#AeZOZ=LQIr4fmS=nIMT;3K^U#TRNu76uy!t8*=U<^a*bP6^Y2 z#7WS9bFdf!NjPMQLjW&kc5TcVO{o~7f?f$BRhE1XyR)TtXhz0}D%)plLj$9h|Bt=z z0PM0j|NkZo6%^c~D%*vl^WR@>ZMCh|$zI}KwZj2q2e9si6H!3fA*_&ugd{-7BzusA z?7jE+?mgfC=ec|H=1UlYwXH4p;kev;(+pF~5a z+XkKlNif(@D7(jI@>noEX;xy9m*}R&w33EHd6oGLB_$6w%Vt(=#$M^78UJIyw*y z0EL2ryo!pdqLSjg+@r6*|K*5@v(BG3Z!EuKz)N!g<{&etFefh;xqwJ&YHD_Nc2Q9g z$_CWb)F2}ihW)&ipOTWo%Y&?wl2S6VG7GCaZ+tqOZ^au;nV`qMqNmkoRO#>eb?{U4zfjUB5$`FQ0UZyt_}T=o7pZ>{h@T9jSdVffp^ z$Nu`)r+W03kKXvl@)be#&21lj_;E)&ah@zM{)c5PKZ~CgggM@vhB=Uj5gR0YqzpdN zZ=akwAh8W=F)dfLJF$RmR8?+KXxWlNrt&43=Eyl3!&UVh-3Gku?YGRYq1D3I&nZBIuO|#vGtj@nwCSIbhAg z8fNf7VrX>BX_y0$faGPdSqC)glG?UjQg=9X1HJj#6$vp>W}7yp=qSeBf!({pBM#V| zj(>#u8;$Pxm|Y)y_>ReDUAN(zg9(Siwyt^O-4CnE8xBN8hllO@?2E5cQj+THszP7; zM_X&xzMZ=^ZwfOz?S<9d^=eWITt4;Q5mRQL$Ihw2K5yD=Vi6|J9)11&@kIl%CHjmy zQ(A=A^F(PdR?5ht_8m{V`ds@0@dX%H=| z$qLW3YJGN{J*!e*Q0>?peGDUtq)FBe)I_Y27@xt|jltQ$AK~WO1?*w4@kn|eI-^Q% z?#Tf+;w#Z$Gj5HzZPc{5s{Q??)Or%fYmR6bQ^)h7!sh zHV6HbcEeNKPsJP@uBYFId@jFhnC5`JG%*MMeHyAAz{?MC%BVHZ8jswQJ7iC+L*TgB zuSK!^+X^RKpFDkOc4il~^rL_I2OWnz(+@9^g9bF4qo8SO-|)4&L5d z3=xl-@Y|S!z`eC0k@Y7s2mbpymu@d+yC9D&GY9^W^x-A=QK^{?fBq^Xm;-76RwLx1 z+;ea$=74&KXi$JRb3jZ3V*)sHz~5FlDRVG*&w!aOObK98jhn z`DX<%2XxJY7jv*B;b_qQE-(lE4pu_O93a!U(q3=P0g>`h$ra`RM2P$eKunAyo5ijf zP#>#l@1~!EY;K1c%t2y&?B;c=^U7nhF-m%rhg?)ql?_D#DSPU%p5+y`&JzjJ4FWMp(ka_Z6IdepkKLD!&1H-I_# z1GWkXlow2%#Xj~=-!dLKVa}-Q9>}WF=p6Jz3F4zHXg<^qEeV6F**s)h-4cczd{9Ap zq;{rX!O`7_3{OO`xFxy)i9I4F;bnjpo47)>e| zz#R0O1uA>`w-wNaBd@v}nR+t^>V}6v}|zP9MXB4{8l4{=7&$l!}CEA$R=o zNRdYkHw4$6_$uR%0}GOyi8*-k<+tf4jA_JZ8ZpBtW z{6XG3F>T3pSWp;oHlLae68%EI<)}AvfHo-av4c4X+F1pEEF-K^bjjV9 zhw4INd*0Ytz<$FfPlwA1&SPnK1@`r71B=M~;Q({6bY}%hPP-%fWf3((Ixq*=zd3Wj zfl#wY`bPxaqy*-Gl>S)esEpL+$~_0Pva$FG>M+r9za?R%kWLUC1xFHWB)fCl{h~XD zX%0XH%t2^O7f4apyXY7J4Ez<%0W}rVAt6FBn1lW8p?m06Mnpq-ICJnpOgVU?XFiF? zK1!rn3DGQI4p4HgIlwwhnGR|W{B~E-H4lsdg+F$?tp|$yV%kF@>ib#$B0uU@_9`QY zzqB?T%|di3j5f>HqN{_Vn|Eb5Q--I8(_!iF?>$!0NXI{24y(~nQdD;^Ey}-eT|H6Jd$w%Zg^Cr|s_Xmd62l9o{%*_-bI+SR|AI*iN0L}MW5kr1V<#;b zbNvH()qQkOgB^a9+X*0-Ea`HvAOak`varz@N_?~lwGf^tn0}tH(T!nr$pLmvj1QWu zY+}=>rF7J62&F%R4r*JrDJoDRpkwJM98n<7g#5vz(e)3QGjydGd@x*d${Vm9f(IHy zHz*Si1Ot8uK0lhyKD@+Y$}}0M{0#6{AcwI6ptKlQm|Vj(2h1qU0Sc$O{LW$DR)9^# zxaRlD+X{@}aRpF(cp1DsX~AJ-#srBf)Ze_kkud}(VGhu|PyF=_)Kq4M&Wt%A(8NHq zf_IaiUA}!$PkUcdoc&HABSKL&P8*&GY2#cXnF7N?)c*4k7FZaKK$^bEn&MhYz@cY!$57< zv5jqWe!ms72*Z|!pvgtd0aoe{_Sdmr?!kG}W{;IRU}v>obla<6#PiX}b^^NVBY0<7 zNKAV{2k{ozO^Hv(veKxpib*FT)7bv40hWDdbWor?thKe(Bf|!HSF00?3 z*5wg(;CtZ7-&TMm_f=y3vWV7q_tFK=4x22gAnnUrk1dO6u7XU71;8P1?HY#!xp`@L zd2PRhJSkJ!r0C3na?b&+k}O{^2X96Zhp{=Wg?Alo`Al96-khyy4$vYfiQVbwG}9GB zemg24pi^HE4?s*ncxE%0gQXiYZR}hm4}kxY%>}{H9V^1}(RS2aj6U{${wiZ;E!{{& zD>jI`U8OxX|Jb(W5jDhk5z|0RAWHcDzH&6zQy=XIbHIlLvf!G7kl3!ZhZ|5lq+m=2 zojCw=@XGem1`Qj8Se;!C42!TsB}<}OR>rjSvIB_@8*NJ%jd7*@OC#IVsxSr7#L$+ZEoeYCvtnR27`a~`XoV1SQm$gE4rq32nrmd0hkxW@K#2lP0kOURO#2J3( zz?(T}B+Y@(6~AWOz)6^cu0HzirA+aR!MI;40Q#GMTR~wCrY|324*08#U=Dbdm5RfG z0-TmPkh>D2+HRLFp78q%C*8Lx{2*j5_)-!c>#Ped>KFs?eA;q9{6xydFcM`ReKANS6@F}`i@+xI}Q9mVr8EjWZ{c^+q%^o4i;gf3fx)R zt2g!ZbhWp3^s5JYbjHZswwL#`yt4jqzs@)?ph0=m1AWcChL^s{3EJBjRoL0l(S;oQ zP^+H4yn4EoZ&`S0r@`3|!Lz@otEaQOXCS{x8?YCmb8U0Ky{E6cr>ooHaCE7S5RQXm zx>ttf^bcsdIyylF&DGLp0)qwSph7EY^*WtKkLGIc>}cpQE!k22T5QXa@?MbD=(KvR z!DMsB9c>GV?_0XPxXl^6k=s*@Ny@od;%RyvYMtgtn07^)g&ucWzeVULhIYIk- zHXmthZEf!E=>u`FK~-I5I_|fts!{DiE1`raOs876HH~AeGb^g>rpH`<(jZP`%~7|{@y-vpllO@D7MMu0lCvU6#4bKs8h<{quyXz1@( zYX;P9{kpgJmY~gFSbeBl>p@ z4WQ6V_xx)Hko(vBa{OaELLwWgx~a|4CLq$;JAmyU&GP5Z54ZPgsCRl1*x#ZyzaCTT z7g2xu1BqBMEfy0R=jgH8b{p|ACZ}X{(d|ZHHNZX^o#fzdvON^4wUca$ActGhJ1B_j z^D&#SZ=rF(8j=s(F3IGk6Q-#(y$x!5<>cbYzrA46L!+lY%y*0PCeI%|dFJTrW`a>D zEbBl~F(29SQ_Ms@5l>lo0?kt}0Wh>Zb3YDw5)V>g79xQ2@M0SN8OSshVr<=D%mFD9 zTvFk&_VcIC^_>d-V2C*&$K;vcnK=NkMuGD?J#&DL_}-ZV-n>Y6D&}B%NQ1&0e1}&V zc>}_YvVj#IKk<)auD@^djzh#B(=?vHl<(Jp*%~Gdr>D(l=C$1_K1p zZDoGZZT{;Lu?w2$t21Vc#fF`gYYvXon+!U=*-GCy(VHz9wf%w7?E&FsJqDM_Y()^f zu_OAgI~W|_2j-wxXTx4IX<{&7dw#_P` z7yx}$#bDcUq#FA=m;=3?USp#hX>C@W%^6eJ<+rcvFJHtPtPX>LzJ+5n=z5JV{r%mmAR=ms5RFY*vNd8LSYl4q z;fzXzCgxNpW|SYwtBKF9K9E&(II|)#yYf(WOt zwr^qE!2WUdZDTIKa_oe=OKZERNTl<}B*PRW7J-$LtdjyOC%t(o(d~yUnlgWhx4jBXgHve^=-q*TjyZ6nZ_Yq-@Xs&@NN#mX7f!hMqG>a>>_|cYsgs7{f7kvx z8N8VT@w0+3L*`qV16rPFRHA?A*Ik5S=)gcOXw=^v;63vB^ zA4o*SQ2;Op{KHEqAE;2-Js#zr1FTc@Op6BnB*1@G2;5O=pmyXeKb^e$@=#sSzOHxo z%5N)hfH*&pSgE77rE&o5`s6eD@Dk!83x4LnKe9DEy9;$;eIyh2{8Y|L_uu!Apo*yc2m09sOBcC5p#}1fBT;E9oE6;bn!u*K+@hO={`e@wKdxUMBebvpabKYpxJ32aGmzI`S*R@v2#tzJV$u)+<7!KLVbO0WhDw#t2S6( z-<0Wn=72K?x36fPzBGGZnWMd<_n9T{@lQ6N_$s5;%0@rUJQ{xZ&l~`sj%3U(Y3$?& zE|~K0mK`bJBzO!SpR_U?t<{)4P`zj+V4-7K(W)3)Y*eCrerv=T$R#P%Imoz_M!~gS7{mGK#AHSS-%ij;*z9a?a z7fbVg@@nE2aXsLTuDJ0JzSlo=-lTouKC4abh= zrKr0aDoeBNR)@`Drn4^W-9i8bL#^S!-hi31H>czFzbD=La_aP#l5Y1;`f)(U^jDI8 z{BrUwFCYHHvOQ>!g-`j9yKct$6Cb>A;zMI5%o#KJ;W1Mm9y9r&OD5m^h`pI7t?pTs`M_}fyOH*%sIr%5Aq~HE(#_dZIfAZ(A z+e}hkWfwNcQB&wc$==Mts7W)fzkQa?&d#e2lI6J|Q;Wp{8@VX{+zs$f!SKTbnfT}? zY|P%w0Swn19IU0uGUBS?Hze}66~G)cwyHr{rpC5d*mgUe^RUsmXBoVy5ya!5I3)0U z=ym9Xa{Eo8#F}_B2h&3uZu85{=%gvN_^+>DFm2vR-&Qy)=3vwIB=}=mP%sU6_LC4R zn*w@f@OGaehEn{HnS*)Hzb2T2f3rDT=70}gj3-25%t5>Vwz6JqkBGunYD}!tFb9g} zfI?Uhm;uwv5!bXb$}3k`oYm=F9=w7D3+30jCU{o;e7O={k+(faOT5 zCf6K*ISAfGmmslX5E*aH!S})(^plpAnu{;n@nr+2Vh+AVbHIydGY@FgI-NnM)9I~N znh``tjxr3SG)Fr)Jx;65>SVWlc$_AO1>Nd$TCE;w{_;IPeZBRj;F{@ybvLi5y>&&y zk5|;+5?ue&*DF3gWVJb^D<<7@{)E~5&_4Ez(NpG+zGQ^H>#iM}RRKX`KVN;p8^IT+ zBu)-lri$Hv^PzoTcpUWFu$(;#Ft|^nqIS0wk=1#7P~(ju4Yvf>-V{7REZ^_sR3ssY5jGFQYT@g5S#)zp8!98}u1Aq7X5bTA`W8SVNT5)tT|W< z=HTr;bVDN5l&wJub5Nl@rRIQ9ri>Nl!24$fv^q)%<^V*tXLTYrB7*`#6z0JDhD3y( zs5wAnZ{`5)PlTxlM6syiz`e_H{g$oqyw6p{a| zz^_lHUIy6D3fm4AAIBUZSN3fMm0%9SGa9I(Cj}KxGTF_2j5*Nj zGzP04Il`Z6L@jWfL2MTa;(}mnu|u?Wf+w)C7Yi7Da0zZ{R>)55)3*oL{5Z4$`}A!q z>aclF53RW^sBqOmdNX(2b5Q+_%Zl#_ zK4@}E4=)TrF1}MA!OjF(7P}N}lT+u8n>6z;uYQ0AV6Q7vyRjUowfW$r8Zju35a{6m zC~KR&-67rNS28`c>b8)Y+kzXXuc*Eyv<8gAtwHs7yp+^olyZ-?j+?UJf=P2phW26( z_<=-Fqz`ql9h&FDb7y%{dEhh56OXXb7zWSqPd0-qBAaOr68R^aFZ&g$45Kgyj8~w0 z4%)g57K;Uxxwe4U2*hFYM{dIhHZK5k(5p0vXmv^Zk6CUEq1?Th1Aapyzdreim);sV zku*c!fjI!c99%f@{xOpu-W-0I{j`O$(ThST1K3eSK&hw~9FDB4EIjfOvZRDzZVvhR zcno=qpB04hHp7_%<(>mFG$Q5x8C*LYSQ6+HKA0q~CY=7D}&JeqCn*mh7DomXG-c`Rar8clPT)98|x@2q@1x-F;8>UNuv1km&yZ*rVMLSeLGe13}1xcDoZ( z5Vc*lId5f5TUxaiF{yZrf$Gppfe|eMTZ_OPATFQQ*r_VJEFn=~4l1z2VUmH}$Nqt7 zy(X?UG^XdB-A9Qzpsz03vC8N@(kokw0{7NcGX4dU2@GnWb4fwFj)m;4s_u1zIOrf1 z_U80sy?#-hs1!;?ufkLR&<^qTZsIV)j!-8V7{&a(9 z^4rt4Y+K17b3kh!*2q1%?E#UU%h)HI32bpTyQPru@)dDiE4SpL42VxH;C6uZ3EWc~ zyr=0%gWk;~Dg>eEW$os`ea)de%D@D`6FVp}0VnZcOzE3- zczJyawJo(dYCu=dzZOyPT5Rj~>?TToYVaEpbp(ysY~;%*w@-i@;~&d342>MdC)u!9 zfW!0<-+-FVS-$(0;QAl0sQ*dO(VGKH;P`Q99enNxt$H`68*wk5_&eIAradxx(wqx# zS~zmjeHTr>>&{>KTJ+PNn4>ai&afzG->gE&nL}=}IQZ23Oy>{MhY*)wc#5`+e|1jDcBCtQ<9QHkgA^Qy-**4wLy_ zHD~Pg5C3(^hg2tG>eyel9dZZ2CL?94_}~#X9^q|u*}C1*?Ln1bgTM@dA-FNL64ksd zsPg9E@>~CYu*)jtmb76#r^-&C`v$-UVUI-aBPTv`?JbY+!yUXXN?x!5B|88?$dUiX z!3P;UG3jo3dKWfha0YZ!VQ>SO18^tUq;CtzPj4i?Q+4I9*tN}b=m&)+P?gQ4|V$9%8FW@&i3ZYx4YC`4u=8s3_9~bPiJd$3)X41 zUf0`i?dWP%>rh_#vvWf=8pM#tam>MS(FAjFE}By^2Q)U=lFYz{6t*~%THDvDQDa@e zW0h74+}F5lM@2WDXh2I4r0|E`kl4E_p#|O$_-H;e&4K^!GQaq)zka$O%PQ7%_+k=b zj|tdSwLG>vt<_<(S+MycFNepS)2I%L8{k(AS!shI;E&&iq$P13%XXJ)iQ}gsY@rw6 z=>oo>*#1xVm(hwt1Byc1O|DnM>-=LH8FRp=HeHLqJFhV$LF2!(92*slJ*O2p((ZV) z&wqdS(shT-4!YtE91r57gnnViLiTs0)SIoeAv4mFr_mt!Mfbh3r3@tmWuipa12`)B z-Af~SA>D#GuzTp!l!$L~Nox+*haBjAdv6JdlJrTnr^}9(?5+&n*Ho_MREd2->-0LM z(CC(>J1c8Ybh`h9>WK9$xw3az3|$;aLIi_Da-je#_tpmP@7bB(jYhTGELe9?BaKT6 z-j*8_-;H|F1^*uUCOpz%)qZtv>#|){U=Gk1)GjW%Q*TdR=PP?VmTX7|pTxEcQsEfg z?Dpsb-79w&(U!~oT~;)U|E{W_n3mK=y^G%F$LdaZNEEj@{9?O8qw84jlSm3q1q4^c zR0PC!KfflCnhP~Tf3OcNz7=(B>He-Y$qiWAi0g9G-8$fzmh5d_8c|cJLj@r#(=rYJ zuM_joL81Gaw6tH)P(gf@e}AcZNxb^`b!iwO)DfiKpx=W+A{)RPh37QGi#OLvVYSkk z1I8Ta%x1bC2cFzM5sbrfo6Op_j#iW(+q1lwlDExhwJm-<@@Fdw?wC7w@ypYvE&3Q+ z*Ytqun?oR07Jrhgv$=^mfIxY{jr1|b3nt%p@zp-B1zmXCG*wmA1j%rbq&eTCztExc zwW(DOjc;@1&HH0FqG6CV-zKRHZ0E*Wk70ma3dF%5+_9W~S-3T*0h{!#!L_%))^tzs zA&l^akB44({T%kI|BNwH=E5=RhMDKzFz3R_kG!ztU7AK1y_k+(;DZnWa8S4x;E!zv zHfBe!B;6WNc5`SYa=baD_Lh(eQx;ux%i;@eSU|tN(+}{A zMopUwcHyd<|HQJE=~F)r?$AV>bvgIvK5)Z9#ldiO+c1i5eL8}+WH3f6noxI`+g8?3 zU)lEKpkpaD#2Kru{LO_^7lRuZapUY!)8>ttGW+}+W{j9JXUz5Yb*p7Ii}GWz+31ES z0IkY5QGiOu05=6OHio`&fwiI#%t7mID{5|A(Q^CBdX{zbEh}1o99Wp#NY_(7^YVLO z4n|FzJ^IEOCo z__3$jS{t`*-m&!6C79h*^uh7tjiFkK8xn=_Hm79{jst{dyTh=3_qMH(kv5NHwYh6G zQpnzx;9ZsNCiEW@%x$DqSbL}<6wEx~VlEBDTQ;3y) z4r#^ive#ldv)Wt`#YjSS(w>~xWDbh%UAE;Iwpc0>`~DuOxYr&EjO_3aE7oHM!I#O1 zC@}=nkl3zIB1+9HrrC*1U8u#2n@dBZ>C6FkVp^K) z4!haXZVhL{s!((i*j;uz-Q$x|*106IJ!Dro);?kwXlEy;;f-Bo!I5pdayqHs zAY;+RK2B`0q1%g4qrC;aknQOcktE+rohB(Dx@B2-DN2qd5B^LDmUd;e`9c2vI)j=8 z&BQh&EK>ek3sxTJ3Eq~EI9O59n-0kVrXeJ}9J_CNExoPaMkhO*2B)K_)rGbNBZyML zALX&R=&q-a_LnbUe* z2GF)vx}nMmW7%x)6&8f`+gdn_LtE6?Z)3u{q3~r z%WJ0xRooa_dq-f=7b$ef=G9a09y9r&i>Ayu|N2KRnRNG4k56+MexmKYwyR^bTQ}0t zt8!~cy9^^8S|7Lmg1*jMfU#p|_~-n^p%-2^d+gMC^c~14b1#}af9&Mh5TnOUdxTv z+}y#z_Z8&Gi-ESWTcmEM^i%(Gi0`+&)^gkOuG>~NVw;>ATnjn=XMaoVcS$*gO=Bm{ z#}3E%lG$UY%p5xzoAk^vlV|+s*84Hc_;$-TW0sFxH4X&f5jHxAXALku-i8r!+q1iV z3?3-7TK;tM^4eQh*4(zd`KJLzsr4j{s4n@%MUxkfolN}Dn8^#qO`1D)>Z~!-7L2~? zk8Rx!yWP&u9x7SmQOTW(HMo`X2&gyRX61&&Z^!zuyTFD9zd5A(HsVWaZe0N$r5UWr zElaXeTWKyo_WU~+PhNE4wE3v)g_Gu?7%<}}&K`T!-D(p}B3ej5oE9F|31kCs5R7)| z(usctiLA?XL&^ZNt`$Sw&?Ze7vrup>)^gZDo~pM*7P0P>sAXG|a`f6@>9NXUrV9?Zmy> z!gg%lwkHxxu+?hr(CFUVn)vpHgvf;Cmgf4yi3f{|3Xi1cY>!KSb8GUu8}=VgO-o5U zd|-cEZcbKeX3qOt4!*lPYwfP2eX%jw+1Uq@4({E%H$E}tgH183c4xiz$;OnFwA$*L z1MvyjIeF;?6(8-*cz0_;T2@|SV$$AS;jyu?X<4~%eYNxL%}MWk6B~CZX@Bg#^whK? zM>1n$<38LHwQ5J^YoBa7m~aSmva>Ve}~TOt$EQj?RD5@Yx6kJ%Uh z+1EQ(?a26iXHt50VPZ=1{x~UD?`}(6vtf7A!9$su*@)b)9ypv;^pCB{A8bFAo|TJc ziH_QvlyVqN^wGA&H#Q$m$S6bEj-(`KWu~PhCGUxiTeW5X>st=Jxq91<9XpcJlaCxp z)9DPwm5py~-2eLe=tF6cJ+coUJ`^1tot&KY?ibtN+>(gyNJ&dQa^whob1y6NKw|2f z-^9GVE%B{&yHk#&$3*W-KAe`CmEPW`3;kj@O8D_N+tHy^)AaO+xad`@x4pGB`Ry(7 zyJ8aR>S|IDJ0VV$x8oD^rp96(|=TP^!ycW&9X z5vvxM1FY}#;$K-wPF`+aVc82IYhGNP^#AU^UaR@(%9SH0{N~Qv`&>7#G^rO%B& zAN9N6tA2IY{dfK8>0kfxh2Q+?xnKWb(Y^QIbN_v+ma01?<0W>D%BuEtYDa-Nu=cBL z>QRN+*L=C=^^_#~NMK!ET}eqvW@ctlQBhS@RYgTbZcgEwAB8{rY4&qp=Dzr8{$D=L z{>x_>&#%t-^XIvX-%fb#>(tz%IS)PZ_+1Y?bLT^k-TBZ{zkcwk-#+lvZytF3&Ig{p z`~Iii|7cx9Q)5m}R&H)SdK{F2w6wIOq@oPBLhDB z_U*$X=Hr0_2NL2Aq^2Zg4$ zQWWv7`{v($-;<~>6@XRz&Ica<^#jlS_P$4xlGAtY+=*(UzQ_WVg}c1G93uglV$+R? zh(PrLxKTXRHz&KW;AkNl{Ah00zdsIcg{vJ%_SyaQ<0tA*M|5gCs)72aypIlJ0GI4XFJIO^!vWm zZFjjLn_8SM6A2{8QY%;_pa^JG2T4R!4pb8L#*jd!b{YY8lmQ+j#1LiV z=5Sj;k*bLSgUatppKrO%q6%RcgZl~Ku!^2@i6Jiumi=n22V~>8( zK;b1RHukHw)(5MLFG)_k&0zY!WiP4h+FyRPR;3=e^QosMp}*+Vh~!2!*)KSjkKTLn z!?!NB5q~h+s!=)hBV1~gqyPN49pkJf`V|GGqOLj~tU*b2M85>_9${{@s+Irb;i7jH zse4GVLBD>nqaGdWK!|vh0v4<;aV{9_iL|HgnlX zV1pi6zz0Q^K#GE>Tj^)C<3P0<%-!3q06tV&C+P-Yc-F{5vB{Hunxr|496hXAP#8YE z$w5Pn?l0%yIte&9aqdunE{6{*hSTY>(kw*#Icff&vNXB|>kb=_a9B`HHg%8}wLHs| z%D~*z>~06vA`qt$#zz@!X803}NFNiS8Req&nR~JbG}L%>f(IjjCLv-_CgjWJBy;15 zrDTnE3Jiq^=0F&4b6Vzr1~W4R8p!&%t-tvANPqaX95)RWZ!L9ME3O-ipRt zrU8R>hd2imlJ;pf6+jV7E-e9U-^1eQWXJnZaCp%{LhKV}J61!d&2FOYoJFQQKoSH% z77whDuqbOR8c2yvA6q2zLwv+V8xc!DjYF#+ZB$r<;L8px(CTNUx*#(0L^|fl_C^$g zmyXtDI_rQIz_yBKswZo9R2q?~VQKAyltFtu6$+e*6PqMBCMp%JaTFgZY-kQr0%N%* zy*eY}lCX1fJ^*VAvLJePTF}`kZB}1wu}&*7C#ZsX~FJ9eMH5vk(0UrnWC?d1Y?8!m;tJk92vm_ z4MIEy4FY(h!ql^@B*@DJjs!JCGgI|ZO=^4k#Q_~aYylk-WFrFu(@u>*wWac~s?mAV zQ{t?c18^jWfX1hNnHr3pprI8SU5`GX3ke){v)w!}bB@Yvn(*#Qdi5YVUgb7kos^_< zn67*04PTvcfG@#RA2bksCBktiY2&`#Q=R&eZXJw|M?cb`zc6~wC2CzSdeVE-LfKGR z*@vbA+6S|dW`zg*1|}SK3u0Z+Vs!k1=Y^Kz{RjguR({fM(?;*LJD$`=&8eD$z&b!@ zRWa|eU!sXYo_dgG0Z~J~tfPrnqjM)1-qfB9j0lE0{U%0V3BnW7oC*~Acwnf39t{P_ zW+x_uDn)}CK^Q6Q#~ln7j87ttHHm0YHRY^PeN=}X?x7^dgC@~nQMnHsypS{jQ76=m zMlQq{8i7QK>P~9~g7}m{_O$ndVFe8gB9<=-#(IHrr*qA;V$vFQ0=OsgMJiegSSjGi zNKx03jsIw1ipo|3_DFGthAb-^SZb;WXHgjBP%jMm3Fbf;Z*yAa;5cAl4K5#;D;U`{ z6|8POO+JLutJs*Zv{}${K)1xQ*@EfhBB7YpY8s<9Oe~^}$xPBA%~(dC97(1MD4)N{kffVUXofIHFc0QPkS|`MQn=`Y!hEZP&F$OvdU7$Emm|Z zmM+GEP*u>yY$re{ZTdz=fJ7oWkVrX$$1%LD0q2*Q{BP3)O|{Km>^Cp$JG1E|MA+)nYmu6v0LZO3)723^7na zoNe2U^FU$-YKK$d>@)}1bmVs<+Ett~L-)=S2&*2JahA<#^D^n_A2S5p^%cu!y0;Byw9L-Bj zg)Ty?vc9FGpeQ)w322Tl8xfHwn=-6bsi%;Tb*^mFUr?YdC>lMZqHGzY>QbjL za)^!6Vevy0CCA|y@)Ktcgz+|K&KxlCaZFPldqY!Q@jLIn{?(=}g~!S<8TdfN(y(t= z_@^Je_u;2s82NcWN`Yx&S^v>n+rzf5{&E9J_n1*6zFIWhjd_{*S=qU*8WYU|2#ahpb)mP4u29#6^56yxZB^+B|>OgFpM}|7GQs z@{;q3acJ-UlH9D%SAVQA(EvmFXw9@3G7qPH^3lg1y!DnDBBmR~frM((XuAIP%B$@i zT?Pm72OjL=*lwJz=9;oEKK^*^x(&IKxY9a{hds}nW6EkQ0;upWz6PJQj zg4iHR<=(aatF-jPpRZZ3H_@7f<=6y<$7aY%ivRrcPe1~c7l=4)1Df8YK|x(z z9pp*7F|l9By{z!advC8?zd53~tO>gp_I66)usWUE)gOPc>}9|FV^zd^V41gr$uZSb z6@2sc=1m(mm(_I8!h~(l15wLx6rG%zlbKt9{T^jQdEjp~41D~-yGN4K6C(E^FS(Cg zc7wL%?RVaLYt_dUm9^Mw!8l@}2cwu2y?frwhky3V|3k-NT}GzFK|1YuSw}W+So_H* zpV%0K$QC!7!O+#v*7W(upM*t3VI-agXTuyYP>4JiSR@Ax3AkwK_n0l3*^i8J>F?jM zRh5~dva5Yux{;F6$EH@<2UJdjPfycL?|t+N5@UPgc_2gVYLwn)e)z#F-+t?cIgebr zdBbv>s}r%PM~G>rT?(^??=IY?^`2&Iy=7Qj!Llxl4=%wSg1hSwBm~#s?(XhRkYIzm zy9Srw65QPhZoxCSeY52|_w0Rd{a8O{o>|jftLm-lUe#}*rG!p$GYV`tDZ?n{{Iays z^(oZ<_VZY5%V;EmP6)cp8qUT%=z8p!#|_i|&S{qGmdcVp5`%&^m;k3GB?Lf|tH7{+ zvi4|ZG&}2H7Zpm8saW{;*9b~Bw?AVN4=&dkJ~jdlGAxpFxsw-o?5{3L5F%9KhxY*; zLh3906e(Ga4`Y$4gm#uLrX~rYw`WH3s5)18)JDM+D7Uf_SCBKvR4N>RkB!1K%H2?_ z8xmp0X#FJ86u#Kou7aqG23G&{v{4eMCNksCCO~Uj#^3Gkf2Z_)nTRs$a3~`8q0(3w zgk7dDj>CtRez2nPGG-FH>GdYybO3z}H{z~7HD$Edm6~d{5Tkxdk&>ef%!-^0rH zHia>#CF9JhvDFCt{+hlIMf8APR9f3uRMTF4YSeGM7L^_EE#n`>;+@~R7wfrII(}Y$ z)!_2+c{{j9x3$Hyg&=0-(ksO(dQwTo`?-1f-tM>gkX>0xEO(xTc%Zw!tCFLXw>dlm z(yGg0-KsAz)5CF6mFg2%~GC4X)8N)R5tumKq*5^&b?Js`=bA0_-@g5{HH5Ruib6rOq!Ry}w*(u$Vk8Y#5s& zdmyX*Y7&t#2KFOWyF?M-*YK9GG3w>Ie*+*oyQ=JGTMTGNCrqkxq^; z5i?6x4Zu+5;<3fMWTJKDOipgroD+9%MG7`35XxnBm6XVqHMh96lv;U#aTGJWUwRUb?=RQCQ@UMABP*`D8n(|0bE=TTtu}EC#>Z4EH&{bIzy6%no_5<;J}h z$V@KK+2x}{SHuHflf@NT!(449oRH}N{q(Fg_$#N?WYH{pqguzA(S}Ky?z`#kYlNI8uPfi zN#lZ6#C_~AvPwt!=X&IB0@@vqmcXO(F#IMG!UEC7fmS0gY1UJ3>`+W|5gRGL(QJ#a zVZ#fyHm+N**)jBMH-Da5>3Xiyq(Jd9ZDwShT5ERKRPdLx2w+j*&eU>V0BuIb03!jC5PyZNZ;k%|!|6+gI{g<7hq=^EQYWYN2`kxzwi z;1P^G74&OnMOA1gb#-iWd|Mn4*E`Jvg>BT3bE-x?0Z8*K25h(py5lU@o+_7gAFR@UZa#8F>k5>VXry5rqA(LrTIU ztP`;@F%Exj7yD3LYxBc$w7rQ2clh4O$Ft{{) zuTEkb8XA%w77m2!**@qD)shO+TaoFVMPa_XyY+Yj>lYNMg;ibF%RfkcJ*3>xXPiHe zn$tS;ntvi_^z}6RtmZ~CPjZEI$eYzf-2GJxGNJIjkWV7*DdK6WEc8t!ZlXMJwXn&aN#oMe#0LRI|E|E z=1XN4*5=cSYb7oKYUD*hk<$vLJ37N#@1ZxB`ev+%bGjd?PKthwi;emPbc)=ctgL|B zo#Id2hIUN|uEI!E*cZ@fuTkR5cR%YV=ar~kvg$~#B6IM>3FPab=P^67*G-C&$d0ww zZjUY5p6bIfzP2D0(pf)S3Vrfhd7x8a&K6Aalb+#QwO*nZHZ%LPpD$dDBv+=@YiyI_ zmO*Q4Y2w-Yi$dxO1y)kfuU9~b9T?+U(3My!n2MqibBPZAbn=JcMY_Z-kI}at#mKpGwjj~er()YErJ*lK z983ex3VVoe>xx;7SMbq4;3I!a)x3PftyOLV z(&fxuYlZ@PHN3|M(CU6c^T@1@rg4i7uRUs`QG4Qu*#KFos;59r%S(UAX{v*~XhhBz zayvUTTyu!6>2&1MlI-hN5xxM@!&47^iZt-+Ey)jYcr}OofkGb9v&Yqyf|jMcoRc6!_zG}TJw_$dR{)|D)tt7la`TH`-Rg6N#dR(d+x+hb_Yb3ge~S|z&V z<}Cj?vE#6vIN-q*kVt9p8eWqsx`3aIp<=kT|0El2-0DzW^XJ0qM|Ewhvg^!GIeH*FlL|H5-^H>P=F3JUk+|RFQiKhwVubwm zCl%IJ8a0d+`D_Mb9r)7g%pI)`A(0!irfw_Qcv%_efFGw({Yu>rZub|6C|w4hMPf~v z+&ikZrO>}!TMZs|jWsxn@49mP^BOQS(jN-V<8D{&!2m)I0WH(N^ftQoZU3dc5TRp=b<*o5 zuKU7J;Msrk3FS=Z3P8pDT9k+$S5-dI^pmuuUKH+JEjyZI@v64h$;jd{}8{9KDjL#{kW!ahq)_>KR zpnGD8PY7871ZGKYuFX!PD;pbdy=HCh))71dz_b$@H-`~#6mG!hXCI$M!9?EP7p~ay zd1Em@1;ZXm`{KXrM%0n~42JcD6#yS_HAS{7oedtdNtE~e>}yseQoj6m zJPv8aEScX`i(?TPs~S;bg4ONNYSO0pR>i2j0d@&O79BrpyUOx3@SbFXWTHlv&KDr8 zP40KPGt%*D<*Hh-8!at&w9UEPw<9R~Vo~UiK;~OC7U~2ee^35icI7s+bIp57xj7gL zPFttOMI+Bsg!boKgeqJUUZQXI^^w8;T_r{9y^6n8!;~dHz}WLnib}C*czxL^`z6CI z<$SK_E@xYY^vuprx`ex+KvuR|3>#q_oNZPXeq@Jtj0*Pjysa?51s?Qjp_SEib!{3I zhtf|ZjeR%Z%38G7?~0yO?O*Mb-*kzl!>emm!q&OtLdpyDq1W$q8M%{ zA<>5L!@9Y}ZlR+w?N6yts( z#gCen@l+-y_13eP=dV4tuUI)(hRcoPDVrymnzC?z+dym0I8QmnCufVh6ti)$e zTFs_;B*UM^)5rv<=n>=l2}{F=CQ^=8OSo>b5jQ&Xvfypsr3?Bv#j3$%SaK)&j*f9g z{}xJMm3mZd%f%Rx^n@+C$VPw~lfAT!ek)biJf;2A@dK@3Pk`uHm8S$bJq%r+&YlRY zIT}8&{)n!Pzn|vrBpCgR!B<`j+?J?ZgI5QA(Hjua|@o z?iu1PQ%eH}tS^GqH~R-4-H%I~^DOt1!GBK9KA34&*BMc9zv=^9A}o)Nf@SD%X?)Aj ziIqH_b{6)N$HpY@OkfOujtFD^Cd~fNkVX@_5^F3iCt$L!1 zn=iBP0AJ}5-t8ZGyO7yC(T=ok$MNvniVOiaAT&#k2J0}NT3RWoA`2@69a-b%WF&nWA9|TKtpC}>#pwOGn9F2DC$?> zpRA6fVzJVq@HkxQaTY1T7sUUYzc0?O?R2v|{aXt8%q2$8$-ScC&>>1>99@d5f>pZMz-N%iS5rDzADc>F_jb5H9ki* zwjF|wNT4=n>*L9LVYj`?y1HpzvsB)7kejr1b9g6fMZQEO{U!57Y71HQIUGl61YPBs zI?U1`)V@kn8Q`zc?}D{m4>_5nCb||IITy`T$*5@u`>!4Aw<-o%zM9<@jw-Gl3Q;WV zcF|RfIweIsb8iprWYJ&{o9i7ZDZldR8m?-xGR^sqcn|V&d#(=NVNcpL;wGb=cs2y0 zNecNdnG0nIm8iTVcC~6=)kTYpXwoV=V!x-rQ<&nnL1U5HCUA5VF6k~L{) zN-@5X(_efRREt~kEBy|%t*ht-(}Ra4P_@lmQf4V7$gN51q<^AKEflR)oBBU975DR6 z8|v8GR5h{6pdIF;#ncQ0jk;;*qtpc}TnhY%W`T88^{TE~peJRVP5o1{%!flNWDz|! zV^Wz}qhcM=#8-PXz{aKWr$i$OJozIevU=;Pd^a>!#Tta;S>CV?uUJCor=-{e*pTnr z(IMK3!F`?7MO&OruO}78N9@B0cJoP<;R;^o}k}$$B0a!s5Qde^hevH=5#LUEG&nCF+Z_M6F?eo^h zj!H7JEG#u;_XiLPpf>w+cL@DTM(igdqE*?)oVfmth3YdsAN!EUdh_2W?0-}-=nfBY zgFbp#X}G|xE40T=Oq|WNYcRt0OCQ7?gAF8o4riChNJ&|!$G*TfY}RkYBzK}#%R;Fq zc(6wjEKPumUrgF*37@m0Phe;C5L6wX`t}nWY*eymHl>Qutt%?zfdqL@{LRxwr6uT; zc74pO{E0Z&J&qzBHab%Y-S!D-3irb_r8HP566^Sjl~o-)G}of?CN|#cTs6m-W%Us& zdV`M{fZamuL@rdk(ZfQFwgkyRDsvh-+CkbOQt8I^NHH--Ejx{lW)Z6M-fsW;!GlGQ zRMHXCEIa#3MHyi?3XY5)$dl8t}nK-5EnG&m{h*FT{B>u9?4Ya({BcQI(tj_drX zXum%@jH;=mr(qH|zRy6*=VP;D|%GW2wj?JxLMT-u`8 zM5du+r^8y-Tw2IZNy#eAu}c4b5n3QEGP7TJTtDk;y8E4nf~eTBj-W}K&>66cZb>$2 zE|B{Ha*$~X&*>R8xSYUfgm|F2UM}`4>QGhbSItES72WKt?lDP7CPp`CH zs;6gV!D_SoGb^?&Ud7N!xWpX0%bo-^6jIAR`J|$YLmgTO3cwhS3dbOar}MM=<<>to zYc;SM6-thL0>?~LCC#Kn5ep&|DSTN9iWOzLw)Ja^v`T4Pm5sibOGic`pHNpAb=;dPQZ0p?xB^PeqfMWu4%y1qfY&v%rvBu&Q`=r5qo1>Mg*uN^vb!3nL(G zAJb;y9Tm=%Vq$dCQ_xlPNnak;Zs$*r*RaUUrLx7F5%S$IRoBZAUD{Iwck}JM4uYey z+iFbvTMt{n-DNG@%ng8C5{_iZvT7@kr}t7?5%!#QrJMxJ*rQz*a8i<%`Ur3QXK+aZ z<|7_U$GMfo&0ch#*YoD02j6#I?ppTtPjRGK!ht6TB^`V7^$q=59%7@`tr;2*Z2q^4 z`35MH(1;C@CoXFML7n%T7uUe&b-DDe^uLi~-5WM6Q~X!IxTbqvM=fbbel#)6R%yqZ zEZ014m!!d9C%Te2c#y(QnzgPQ>vf&R_H@3O7<*%ojb>FM;guhy^oWo@fjnctRlpnp zio*fxsw&2(KYP12BBphMip+I*&t=^9m{n3cfjPX_nJz!OE@YTnqF+ehb zAcAFnXx}toLPnv_YZdZ+R2Hk*zV~iIdGBCjsYo%lI9@Ue3&})QSZ~Cq_7hYNwx0F* zxdIm3B@^$^k?YO2;!Aj0$7n7`{?v_Jv zvG|{5dlL3}rl|>H=)2UX)0kiTk&&-Wf-@i(^y&oKdC>sHwKT)P#U(iu#1RV5j>(l- z<*dxy7W2Oz6Ovi6Ka5K~@$Hx9vcU_#n!bg)&+K zS7$ZibK8vvJg_a8S=uAd;BH$^$2O>>cmox5nWH|B^L-%%l~izx(40HDC?b*K2hAvX zPI$`;x=X6`$L09i>ON6mg&^o!ZP31oI(Y2z5ifZ(CaFJ6EOPfW!nc8v^BHloY3-h;#)CfUN>BzwGF{oae2!(ikSALMz}c`g)r zKYcNKOt>kT-#vUTn&$dcYbh=4m6%@4(WPaM%NO*qYoeW?O&glkE#vtL*SO-KviiAE z_|{l2Qj{oDUNGH7G$T{(((DN`@<&eeMuT~@k6lEtQDW*JbsKcS=k_eVMcDEyyQ>hLWl48 z?&5OTYtC6r_p79MUaG`8B43w(_7|QSgOE^XNf)Rvhv+woYj0M9{Zn${7}^;6sF8cs zR~BweB5YVWnCCw~tmj0#TiZAB5~WU1%rw@x>sn`q>q#O}KG-cAzbZ}k%ZBcM3C`&~ zNVeyxqrltk zW8ZB@%ZVw1ijM0V!iUJm3b-b*n-JE0Txnq`*ylIqA{!)3Du_vW#Y+ z&Ed^=R^ZCH9eOR5@=Ig}r-YwZS%I-C~7$MKMY>HI*IQ0FifETyc!k1svf-GnG zY~F8Dz2mZ&nXty4XpkaHaRM}3*fb5+bf()|Rizok)Uw|)Xy=)VX#)=G7~tj>ZgY!+ zcmzT*J8A7$gdEANoQ%cQMR8$fBwD~Xsb8QqVl)vQW@!(%_3Fdmx2>tEyO$7?vYc*y z#ptSa2ae;#)3w?T-F@#R>wm+Tje+O7+Iy-RKLP1L4Mi1_ z2Yjb!k%s#Ew(L3;)af-}Hom`-(R`0tiJl~GrZ|9RA-wDUao7F!BYlM*au7dIsw?FB(ER`@z|y#$UT&B|pIHuejJ<1=3OP{{@LKGFFszphn`0 z^PH2FS?@hf3;SK(My*L!+iR2!D7vJTNo{u7A1$#h)m|Q-nY!T9U3?D}BEt^keoxmJ z-hwxRUJ057`re(r?vC@+==-ZVoc*?vETdv#a5wbYFK8PeqC)yr&L5Qea=Nz|=zHPF zvly#}+a3|Lu)Ow`8|ut)*?Dc@DhEIw7%?Sppd5!+<)6fkm1oU~)f{(l=gNb!xrx!JQ6IuWJw!ixjuXPr}|5<#fdNym-i> zzHprVhY>R^m!tivusD^jUCJ=MQI?W>qw(LjG1BV;!@(t-<>Q_x*3%a02o+gA5@tai zONV)xortlb##3EDv3-P2M{~M50YUMNF^kX_?Ep9&rNI#+EUl$)l<#8n!cOs7QFP*W z*Dg>S{c83%L z`M-7~ufLKEpboJSSDNu-Uz2mtN9^)KNLX=1g!9@R>U2m#1o-jMmPw4h)uLT7>2n*- zfj@9fJUDN0(ZLjr_+FcF!j2xeuzzHy8xrOt;f6*K>mi$&h)2t(wv?fd{XmXB1)wkH z_tJ4xqTaWL&dnT#j;DGh1Org|bFZYQrQrdul?p`G-VIKGXmQ@KdQPV8RR$S;%;07C zgq_|Z6MEV`7SZtcPG~mJss(o@8UjAA!$T;AMBREe@2hAJ`WZakU{#p%6~HHS(4>SI zg`W6D3c#;tQ8R1Sly#ObuC2AY#FWAEi|k|)XYjjyW{K1MI8J7FK+<;;73&=ZN)!c*He3X+0cK5N%7keLBPW<(p1ckO6N7Gf~Z~)ko6#ik%jn$!&KxL9`e`J0jwj zYX9jEU{{1!n$>YC++=rh{>s{~a_~gftIxAc11_e>3+9t^BD|L7>H=}MGQq?*Z`X?n z)jm=c8V#a#G_lWt91r|Qv9+S;*!<9;lM;s_h$_H@w*eNyCZy^3!yr8H-cj^F88uJ9 z8Qk2Pxy`|H(fHHwuIx>-vrq!x3+zp2jIh);wwx*2ormK$M8h?_X{0%ZhXsBLD3Fvu zZRAULs%@F?A(*m?Ve zH4iY_D_Koc-!3$z15Yfi+sP7S?8ME&9)EM$eaQZW8hv-kWtaE?{Pa+kM~^4Mgg5|+ z9x<@hp@s;oEZ%M{+%pOTFtDLRLr4S1a08xVD;os_=Hljmm?J*O8Z`iGdbZ@)<#^z7 zm&Q}~m}IoNx3n>@M*KS&{*Fvg4hN&L%{Bdfb(v8OUZy%2|L!zEW*!uIMg*g7rWG25 z_u7D1heix)I+`_*4~`Kril{^cKYwD&*X%x%f;M1;GiE99t59)DlqE+6*t+sAYfC0i zh>IvdcHKFrkx>BjKq{&C-f}zK@@yP8(Dc zAp>Q1Nj63#d`7s%j-#C$(qJq@{}`VD8yBh<@L?wbWjyjjeUq%Y*Jnpqr6?+FTB>IZ ziJkC~I#dMfM7Hs`Pw49%T`K)q#DgH4v9_c=)FPx1c8x}fO_BWN5Wbl;<}Du zo#>&8?XU}j1j2N$k>Mdg{TH+F;S2&4G+PNBkDIOtX@|vzEVsa$@IWx%0naN z44WA`p=Z0%!m$1E5FEtAZ9VR^4Z(SY*-4t3Ym7?27mkWD*ecvq#!H|7efdQaJRL>vfhB~NJ(TDBuce8Sq8@*%^sSyYWm~&fgrzUwF z=ZNtm$gyDW5clYv?JO3z4_L^ejGENn-dDK`!p5vl7%)>~1$rgU69qYQR%bg=*qZf6 zft2g$z*WItG?kV8z3CbVnuL;I5cQxJXAUL)_AF#04;1DUg~x8}SZHMj7WKtbNqp== zD^?vA`K$Jr1PW!L4P^U=-Z-%j4!ic3q*nY3a~A{TqK~Gd0#Cwj3&j4wyeuI+)L?+$ zg%w15;|cM=(;4oT*5Neo4u{1HQ{RL^p@$Mw;}^Xpwy=i!_;onKve-3$(@b-%x{(t} z2Sx&Lo9z6zIr&9jvVzS2grxf8cADw;R>cTo9f1iCpa`Obv=AI^s;T9$#?X#OB&WhA z(t^d2yy?yRklC#wad3I82$5mQaWE1_^U{K2>%~5*kqNlXC|jGiLV7vgco0{kV3?Pr zsG<#7#`O(>krUC%>X!0!pg>N&exx`-!?iDwM4;Z-#8Ykr2#zH1RLbz6U5R5CD0JT$ zjv)tqWYNY4kG1F1gqHL(`{IJkL@6n@tMY>!VahMVzv3MRPSimMe&AwW>lv*pXbU*0 zvV}2ReHr_$f;Y+JV*_1*9d@{#%^M>^F$s;Nm3U}nJf01(wG>g~2{hh&$w-MN`=P_X z=gWm+L24Nu_U4&6CMGor!#N-nLHMOSM~V026~B=Bc2V{+`*fe)N|7hDa@y)a zbUe=oVN})b$QRqAdO@GGV7fAwG4uF8CCPs5nb}V4!WopvjiYr^iV7*Vvq>LC3CxbA;a^v@t!&6duu$rMNwSOA1R$}D2#Ov^PSnPzlAmMK( zyf7V2GaB;aXB6(07tHumG#FiADj0uz#3z=Ije-ZMP5r!F*$`2m&Ri6H-boy`oQw0z z-i7Sg9u*frSnOYnaP-kfi_>BxN39ZLd`7EjbRh_&OohQ^_18GAk&liNXr+h^7pm+K z{+JggP``3zJe0*L(Dt4`&F*SK*qM|!g=#TO?p`ZuT3X6;6n-7l?6V?k`x{eB2zN|1`Wn^ zSZIg@tA2(Iv=D0|I0z!W*8j%N(OMAfKyw^ zBU|SX51>2gu#$EP@6gb;H&`Lt{{+0s+G^%G$I~7{iTMv92!E$`6}@-xEf$y#FQ*kQ z%;X<9dLpbuYE;KILithv<44(pNBID7$Vr}y+$EYi(+a4+ZZ z@T#(+`hHc({;tAx4w4Ia+Li-1<3GW~?>%qI?_>Hh|gwPnG^-rVt4hbIJ&q z@uHX#4gKT{+?%GXg*)#mRyfuyI30Y8J1Ky`g#suos|$4km~Bb|Lz|C7iia z&Y^YRMOv|A7<$iXbraRiGCiyRp#z1TY+9SJl>Vx1TU3Q}BF`=r__{*`d)G%;rbhrB z{4VsLH!{Ku9fNgg&moIYchRCwi*14@18wdUibg)gpOK=Eo?o@KX#`&cYudHnr&uE^ z*3q;x=Q6;PB$|~h<52@uv7P*(-{L(&Y_YwFAfrV1&zlE97YcH{u#Nsj$A}r0AP1#P zD2^H>E)Z21Qdu{t1eO(_q&__#W0fkg5Wji3aEV&v8=jsgEI3hdCVI-XLyuadkSMB1 zdP#eVIx-`61^-|AqYz&r>b0oFZ_7@cr(8W(>{z62Zo$>_jmLMB7_M=npQ$V)uj_F)Iaz%;0 zjYI0%dU2dbMUnXFS#oyiY-csja8y7W1POoPm77RT#+rd zMc(_YGmX~u9T!=Tj{U-Wf_)$kJX`?Of7#n!ABdd2Z}Y^BIQB4iD}aINdBr@fDTaLg z?Fhdl*I?Ab^CwNmx@oh(ek(D3_d1pK4q82V!Pyo}>$vs3mmWI)Dp~91p2u7bfHrzz zE|cBeW^gdgW5cyoO|5(h(k18%cE#}^yz}b+OVz2%*AWIJ`RmA}=xMW75H{;1PEOD~ zX*!D{oxe9U7O4eLgnHXUK#w))3jmKka@M(T{-lYDwE|8LJ!;QMPO@=fEs@>6p&B?c zeNKGbyiyIu0_1l5-%dd>pzGNi_~saEfGCewQIqlqeeLosM=gH2 z_M&ms4&s1U1K(yy5&xHrP$1>K6DDuzvw{Xq{+yg2wTB)$n+h7dpq!vHYqTrPp3}lZ z=X`R?a9f)+tj+Pgyv)nyJHqdIDA}?z-Iw;&qy|{t{m>Bi`&DsloRr{L)eZ165h^b#x($FT0R9tF z|9y$4lshvBd1i12XgsBVoF{GD-mazNkM$XKu$^Fg=y~s$-~aeQk?sW3%)~8o8`TXE z$p$fZ5q8AQe};*Fgo=L%s*&DFfu!?YY)Cz&Z#5MTvrp zMI)1N;ApEBmdNrnm7GH9YJmYaE%n*!NuLoK@|IEe~K&E;QzE0%=Ee5Pt;9& zJ-RMHn&{Qp#pTN}eifGk^H_ZSnWv+pk}a}Pn-UD>x=ZGfJRJgVaZt=|yqFtk@}z-3 z$79qeSqF%r*j}*PFrIbUtvfaj*-6y0muwwYS$7{H7gCI{Slzp~vGdg1`v>^n?GJ+lbLAY|xg5(a^caDzk>TWneAUp7hCq z=DnU%!Qav0;vvC`GI65g0$4=cZKSc*wAvzpbLf3e}TapEFLRAG*U~L*jOi)wb<8s^wa9 zDUQ_8d+=cR&8_y;N@hA}Y1gS;$U*RITk@;f0X$nmP;VgKe+FQR(BEHsA&T?&Dj>BDtU1>(=lsx&PYJqNe|jaeMN>>6&1T zj;W_kc4DX^Nu4L{uRhpda`gWUo1)N3YX^T2NLcY>#vR-V+=jL;x(|m^$HvAA3(rhT z!r(;%oC5+V7KHO>aBtVbqmX_}3X8oEaok_gbaawPZP7;V$(f^lMp@P;K(6)HCUA$M8@n}{O z#~tRa&m^nFYL>GWbdr2T%a*PF(I%mmn4QRtmWqt~)n9*70S(fQ@Tpvl%1^ycDpt+^ z=DPB*wEf4_-PV>vjYbt85!i<%Msm4!7Bw9e!f_kRtVdQhJaD1EPeTbG?qw{t9Rc&7 z7{+faI&!4Ep;$I=#_8_qsi~n+sm4f7PQKDxmKU%#J6kY+f*Cxl$$s_~f`2Ig`P&CP z_Jdv-3IJCdBqEJ2EH0{l{aQee9yBfdTwPP6P&Pkm{jFPcy9e_>E#m4^?}1Ckq{YDo zbOZGD>i)zwpD-vJH}#a!_#UH>NHWpe=RdVU@!dob-0Jn%t1zU1pj`yj z6xo(ThA&GUTFdaSyysuZGs1`-KQ<{tA>nHuF%*cfZ_&t^3!) z?)HzfJJW8K_@1s&58iLY#*YQp&21J!{RISMU>(0t6C%4Kor*0au8+Y_xJb9PmyTh< zM>h}Q2hJ?x*gE2S#6}uJOFg9e?PssCY=9m-0s?{$b*4%-3K5YW^YK(?@^AeS03<{|CUzr5guuWa%}|&$7VQSR z#qnC&Pw#fKrYH?Z(-Z!7TM5I5B;IxgLwhJ(dW8&KGQ*t6A%nzLl zj^7QTiob~>qOzw09;P=w8}PSMU}&{4y3m8P2%tYO0+!|Z>xBA);jzW~`ueW=s5Y1@ zP|4nl*@&b|-*x^C0QTRvGA>?b6znr2p_UD7nn{+w9aptGQhQISRBUzI`Mq^& zGoTzzkO7}mJ`hMc&q6IBk{fE6wfT3^AW{lu?-@CcqQ=4)8vaiD5r37YKfI^*)(a5< z&x_tq<-9@T2Ti)v6{?B3&!tyU`F6kKiSptR(y@LYk>YDnrkk!M*k zq%}8r<#=qer_29Jfk?upZmtRYV&--lE<~&UM~PcP92>2_1D+4k45u>mX-0r?LA@EU zRDi2n(h8NFqas1aWE-$s%IV6Pz+$5XOIE<1`q?6EsY(!(NMiKK#0@9G_XpTMva?R) zuTt3}yCJi}M}0A1QVH4bSU3~KuL;7HUnf$NdWi~dNO??}swu9%>KCef3K$)>{MeUF%n89qDCMP3yy5;*u|zx`XDiOA`1)?M57&Fw{1y}Gvqe&W z5rsIRS`+WU$ET-)%Wi;+J`}WUhtY#X>LhA+>ACr=D7J6{a=i;|J+y?aG;~t6inelc zl>=;*zF0?g!owfCSmCIoG@=uX%F1C2b2}mNK7+lkYEHK!+sFix!8m|OkBY$d(O0yg?Kl$EeId=cFo-fS-dR}aG5#K?26MLSmU}0hPkwV^*t~QvX z>@pj4daX5Cr|G#Ml}(>G-B-*kFMBF(dG^K(@43j4VFNv{z(f7l(1h}&%2mije$PQ& zw)x1_1kDYKxLQAu>51zL<7|;f>N^#2b^bIqh~cVLAXgI9cS_>woe-;t+k_l6Q-xOg zg;x2cacx3(%_`T-koXk^hooN^#o7ECWX$`U9;a&XWri=5Dh#i*uVg!rgy6Ly+IZ!E zkd@tO6PhI39&=(qAS_VbGnA35uCzjJ5XC}mGH1v0uY!n51*=LdNd?j1fd?DxlK%+( z+g5S7#1(qtK#EizmT>YQef;1^z**tf6VSArugOk73R@e_4vt{@7a9154d@$~BdBCg z%(mXZ>p{qxZ8y3~vlbl#<9CZau_mG2Y6Co|!{dCd-JMBjr_ppcuC9*#0SYmU_~GeK zt@!89w2IjyxBz5xN29{)pB@gU=w@x7-0p)DPSA7Lv^a$+qQNkIx0MtD-q3`3`IQO5 zDM#?hdIWCZkMA4K<1Va7BVAtBOXgyaX>j|X`{|Amk<0#|&*|5}@K=OKd7p&Y$vN2W zrh^H|<6R33rzFH4i(rvg`@ZSqZR_NT&autRhHghOy(F#t43$$V11f_PCMJdcxykpB zGy&p0+lH{TbD<19VkL}v{8esm6PjheT}otmGF|twX)NhbjQF3YHpTZaSRE9R$+)GD z+N9=SAL5i_NeXVd)Jk;N1Jve{TvhT&=150y_`N=-TFkIq^MT&}bfH33z&UsP`}oOE z--{r_Osgd7F6!o_i~OtIAnv?)&b)jV^{afO3L&R>Q4J*GdNF~@gT=~i1a(aL6vnnWy5e2VcbqxW z82+CZMs*$gQilWq1Rylxke9PC)yF)t-;|^G(U%%$%XYe6Lnc%$<3 zlX`HX{hgIz37SZqA7HShkc8;|OB_hwE8rCS?_91{(=qr69f1SK&0@R8nQ!+lvlFYxVgDhK#e&90S|niM;AI)-VYP&D#zoyrVw0Y*--!P&rTt`j0HLZ z|MkRPTDN@#JbOLX_IiI}8EMgj-Uov9ssqLP%-ZQfNkYZ$h``C@Q)HdZ2N7K5Q;}Fy z$y>ppA~#J?pn*RBPO9F%O_vx|s6HySZtzt9i#G0G@_@&diunEMGQ&qdDU7!bDQacp zx}&;lDDiKAW&~ju%2C&EY^ZzJT>;A_M+s*)614D6$e|0EQ6zZ;z5zqK-h`mhc38v3 z>vq_nK{YZE$`gJlPZ{d!9~>hE*4Cagnkyx!J@3Pb3}QY9NDU=G6V6EidSkuCe!bBW zgA4@)C05cD!k*^i<6~lCqN4JF1Qr%{b8{0y7Wi@u{UJOotS|WCg`gh-og}1X@nc0o-}P6 zW*m#6F4n{CZJml~W>O>=s%&*5dVN8N3W_J^`wpd9p`GpO;X7B0B3H zo;JLX-XRUkp*q}{HfvK;E;+Vd7K3Wn6VRJ zA}g7P5g`c2;zoRii)(3VIXyj1ppxp(!yqN%v1>kX=HDJ5-Fl1CMLKY6Bi?o(L+1OO z(R#WY%@%Opyc`u31?lvotD^&H#1k4Cx}!vhk+`c&mO!!%iaIL)TGSQ_dvGKc)x*bg zVbEmtRaI5>%NIBzJdku@aY*PchZCQjfyI|A^g*hie391^C1+=6dJ#rQv4^3KPP@e< z5gDN5fFni6l^i}BktC|;gKDtn2QqC2g1^Kr^c-0BT9W_DiQZxPyDp%7^BT;V#0E(G z0{1Vl_n?IOy^reivb*jyE_!oOhGnpQxR8SQ$X#|7CwFo-h_|$_sJDdaiRngG3Dj1z z&_NjF7u)dRum?M{IDso0eVZHPqTC}N>b(8-cS)gn$-FT=q3B^j1D}kU7NFV$yciu^ z0YWL?zC?<7tJ$HeL0|7|^Vag`D+l$=oylUrT#*kMQl@-JQWfXb^K^3S%f5N!O5Jjq zSC{wfg>yH+r#*K~(>xcA0=6A}7n`sUqmsfDz_lhE354@z9K~{B0D8v1J#}CE^vylIj)*bcs+TMqpU=?zSjq*?_%bUl!*sQw_%iLb4uIt_D(wsTNXKUud!p z6U`Ca&vSih#|Y0-5{iE3ahBF(eRKi}WImp^7LSipkkede5f_SyR!cl1u7 zm}3id+0L*x=$m&oD@di_WzE0x{rD!r(W6YvpFO_6U~{Yo@Z`SDA5;Y;L3}H5n&j!7 zUoMoP4wzfTfypC2C(`G`0^-@ntG*{vE|HsrsV__7&}1o3F}6bsnwtUZ?U&+S zro>@KZ`Z(QB=yM0K8!8wAT`189qUA?*|oK&y=95YjfL)O)qzDMrY*;f1gHZT9+!^6WT$T2A5nWf&FoglCB$;KG@|5`-wK(yis z+G_5PVP=R0k!4tSw%2O(z*MnT`_o$0XohAJn~QxGgju+UYtoc;DVm<7b_ugT5*`2D=u9QasI+MfbcRR@LUOr|C$ zYu^l!-MGDbx(ZB0ONC+x3yGMRFsxtavK64Mn+#UGBB?&<7RuJi9ezonY?<1 z%4ly%l9T3X@KMy8yCFVZw@CdKm@bp_Iq)6ccH_n5iwTzj?17Py*1vzseO`V(8TBv_nk@)V1lD>68Yrz9dO@BnTb}*yTMAnO(evGZj3pJY z9Ts)n8pwUTU@c^nWbgv7I-yu<$_@BkE!drwzz$os)NX@MH~X#o`~eKQ2kf9x>go(d zrw_PUciHS?pCCc!<@V}`Fvdh~VNLr*jo_i~peIDqh~I~;hm(gus%mxgo?$;?L~fvw zh$I$S7zid1`=_2Ewj>WMCsLJrUb+UedimbLB9U)EL!Y_3qc)mAq7Br-TY;6x_V)JU z_JWp{mJ*ck!79lhT4G}GTYh$S%!&HCJHjLaC%X8}5s@{37vvgy!Hxrvw5&2-aAG6y zFD>nD)W=)m2fW@375~Gi;7pvxdS25{*L*o^{4zTz z2qbNabm&$>QvZsC^qE4%YozL<1v{hno}kwrk5(Qy&-V~c0i>z zj}aRaBa4!6&(9?fj2k{WI%)}1BLh%e{enXY*R`Cwg7!P4ehrb8Fs^ZB1F4!%U!MVk z!`xOp<{0*-v}Az5wWnbdwoOVZSH#E18d2;f!wDw3Q&4&N=VNY2G z3YFAp^!L-|MPTX{Yraw-_x|b+v4t?$hpdIN;w$oh<}r)Q4zQe}KGJyf%W>o4Yy+p{#@fUFc|C4t#omfxT8dUdzdKu6V7D&`)Ss zyoIbI)?O#Yq=b*8oGUjFq6DBF(){V7_aR8neQoB0dPsId&x7(cx&r}3=)iSCg0SNV zlb9T%ANGU>3hvLopvrZaKmDEC+Op9j^K-DWVr&qC-|pt3E60CUMp01m_pt%J5jXRK zb!Y71@%1$jq2Dua@!#Yjy&R3@X~Jj>%0$h~&dj_6DqI~RW>zYDS^ev&YzYJJ`X=zI zc?S?G`6J}z<@wS0^nn3?`2cy1y!*Z?>D0m`$NWw%ov=t@*4CoJv$hu#!%Vl8cV|0i!vO&2eOT1oo(*mZe zDVV4WqgYN_)mwn6DJVLYyMI^emjhF_acUDK&oH(O6rA3^4Ti;rN5@tfbn@HOqy>=_ zkCBszf}{z=_>^ikl@t{6$RKAsna)-Z(6=?eExtkF$~M}vMismSk3azaP{C{Toy-{3 z6$w=nSD1x?&7x`JqaD^Uk}BU6;%4!E)xNvVBWu6Xt0#u z0pLrp1HK4!eE?VknhQb$Ws0WrIQ%5oVW0^~M5d0=Baq(Q*yxC9dAM2vkY*D=MtwxE z%G_dlV+L4}xIp3sg@qsgylxM{xjpTtm*0x84~BdT@g^oF4t*|rw*C&AIWjKNYT12C zBZ*%}S2yrHb1kT|;kfCbBj>wGBhecWc25R zBI-X$tL;i)`z?xbXwQ44)5p&D7$hr_-#-zZ)He~AjzNGlzE2UE8}OIC2P^FBv4GuZ zm>`lFEkA>Fo-uy_Jkd=4t$E;s$7qUt94{y5UEtHn(~9?Id^+BkdXx!v_z_{)7KIE@%gDXY+k|9V#L1<0NdC)-zeDw^C!AiJ`wOv< zq#L_Gle8PliD$q1m%KcJ1@V-~L+KyWP4>)jh~jLjk0Aq*f?ICG+InPD=;46?R`f~v zn#NBHum_=^(IMtGHa2+{Nx+D5>+iC(gv5izn%P)}Xq!k-p&QRF)ZghV1Zm!6Gy}-) ze6R3n#V?xI9`K~?ZM5YJJ5sE}z_ zq-GL=M5jYz2Z$BVLk|k)d7lcv3Kki&M$3*w)D@RX^`=6wUr|$yzy^pOHkL7Ya$)7XkiRT5h{7xZeVv*NhJ> z=fzc#81YA+HfBl}c7>sK*eIpR+eSD%tw++ICG;5drw8T5-WD8wq!=loW8w4arq4Ig zjbf%K1%}ic`0y9;mqPTcg}ZW}6=KXEm6esj0iYepe^@>47D$I)Zf0yueZBnSE%DZT znt1@_3(1%;F}I7omvM9CX5L81!fU3W3J66)(py4Gw@l}A5Qdc#Tk1=kB_V1Q1mzlux!MOtd76? z3BW%*DuVb>W&_%BX*P;kY%b&U)sj3NZ_okxV%Sp)2z~FI21y%^H@#?8!`4K7oM^us z{E7%S;Vlgf4Gtrlm^~UA+T-83b|t|1mOcqbBOopeiI+kXpg9U+*=`C2Kqp<89#0zf z5hlG320Cgmi)78D<)$*(0LBXnMzB3D2(Pf?|HE}7jo<(%K_-N*GgbcnU*Q7OA`EF= z=)>JWKVfhKZ?Fb5Pd%`k1iEGN^s8R1YWvI4fO=S+7c>AbV{i{P4jPCLBS1SlKW8`( z+C@_i(~ByoMpub?Xe}y=SThP|M#rOpOGpRVC#gb4^GgB(0)RUT2hhGjYT#;%4^W|m zx(7ed=0t%JUpX$s;P`FGy`j@Rn-Hb}umx#DI&R+YsDE&qZXvim1fLbP@y*B=A%eq` zrURavpfNe<4~~X@AeB(n5)6F?S?Hp~#Igo~w zxNYmaJ-$6CyX~GwMmU&!eE=6mP&^@OVb9Q7U=DBpaQSXv zGCeMxN+p4L4|zT+VuO@~1ooB&RJyombV2gr$~o|k`Y&F1q)ctZH^jI+KD$(c&*Ib+ z*buWzvhV0$*&!|s0E8BvJ@aW)Fo=IWv`tnSQQ_l?quFZa{5-?T+FI^@h_}7Rf?6g( zGDQ0UkY`X0^2beBfh3Ux$v=lUx7|jJIVFYTzTCK+Gw;7xk3l0j`KV0SS)n{@APxyR z^&QvNjj~Obv*#a2*BE$XpgP`yAthBkD!ZfX!}p3IsAI=U#t%L=rd`0Z$8^Jl&82~% zNU#iG00RC$2M4E7KR_X}!J$*ZC0#$MTa-X**muj*w0v2AmgQja6%rVQcNjc41G#_F zlE&r#A~$UYncB*xu`vGJ+R62n1RjNOTSK?pnxRGNZ5kO(azBTvaKqxtq=c$t+TUk) zVR|F>&;HaSh2xZXKbKZLj{1@-!;Y)79&ARp}E7Qht=7Q1;B&Rj~h1e6o3fW88Z@; zMk8E>>c#8{ zHXH|@_=d3X1ELeX<{jkLF4sTeZCuEyEfPGm7yAWHOwTI@faa11e|seVjI%6b2prxx>V`sU_&1T`Sr<)t^0mT6-bv)5r zps;;BOKV?l50se~j`E2m<@&NKG8SPWLi+^=vRMb~SDlH5$3|Gh&y$#CP z*_msU)&NE#e7mE%6Uhm;g4PD@2k8bPHx&_;EZ=3=9w0SGi-_wW$)5)Z3A)_`Z4k!S z5|&!yCUOz?PO!(S2k;Tyk!wwZb%d1d1b0Bk(Qs2iUq>9*L)Gov?*w zo)6}~j1GSjgj-rsSQtK(;f<0O-iMEgiHV1Yb|C8i*Bz#BzZw>XLLf)$BM{OX!g}-U zTgZ>-SzmyY?@0a1cON9K5?lxMVG}^x^4htkg@^?u7i^9f@9|zN{-bLuJ8w|h(G&30 zjr8+6q3S95^r2 zEUw9BkSOP>?e6$)D@BWMv6INU7MMONl!s&K(H((HL1)o8VU!>mjH7gS0H!|x z^Cy<&R!KBJ&DtPtuLQtWn$Lsdc!&k3O!|n5e?9(CU&n-UZw+lP3;`ksOCs8Oh!)mXxRo2aL%xJ)#&O3%r9#t*h3fs|aegzA zs*vm=lE|cZ`Z1*RtDPxSHB!EoNF#=&--ZgMnfa%9p;t;1@97I&)Ys2{3vr0MYXjN| zmo5>iMoJ^XlJe?`I0U6wvgCwMo$W}M`-ar-uLJ=P2j`PA2yIJnv< z#!Zy5EqeO}`=WN2xIcp{TB1OPB46ibpvx+y#~}1NHsfd|$R?^SnXuIvNI;2x)}SOpea}?f z8I*C1`GAIogiF*EvO20#S$e$6+wR3kA?#`GLrMW#i|{T#B@UEed=OzZYF>w1KNiM@ zy^^+keD$nFx%~S)LQ!K-phL%edG!|yk?kX#ObJjDlty%%OOlraO%aL&kHCKpMd5P0 z|A0!MEc2DTL5+x7lCDua0xYc(OD5}+L{PZx80D!{gjoMTGmR&_h%1k5Xkn-zpHEoX z_V*ouoVqu%n%Muk^p9yUsuiT=c>*^#H-@1HfI8b=67=+p>LK7_c!99bdXIjSfY~wf z?Ac=p%tUfvX$StXl~Ujs4AW}+)ZKaghK!N;`fA+;WQHy2nu|Rzf+vfjy}|jhb!dz> zs&6F%=D2Is={xZ5qAtJOH>Dlu@JsP-i2eur^`p9T(r@W6JACx39Sa&mD?*rQL zj&L$ls&Z&1`K!U$$PdI@@C;W7<_0VTtK}`Q6PLEy$EMH_ejX`vpI=gf0ZkQoL$WdK zfgY4h$g2f|!GIl1^DhRhPft%NJb;9uMC-d0@+yhcme~~&BA;kB^Tg_bo`qLc1tm^| zfn&h=t3X!=z8P}|V;nXv%3}^rBvP*N5nyyjZdSH__0Gj%ZK*e8-l9g<4nwV{?*?29H^uilIK1sL-!A=J73est{@9VBrB@ z@5ql+1%&^<40|>sc#6R=@!ti|c$plMsQb*d`-pPfzdUXb*f-VI)&}r$Jqx2w>RVR;pUH6HlJPMOrG7({+yh;`+Aa|C z=(~^CcT2y1O$+NqN;xX;L)p?WAZl$-Y%7LC8S$SLOslKHJ*S4S*-1?g@JQ;L_FNSz zMG?aKs?c$X$Y!2%t#jN;1ZL$GW>F$n5@solpWXVT+zL_zo`{3t1~_>i5^Q-Mc3E(^ zQxJa#p`vTdj70vO3K!mBV@gg@M0o>0gNQcZ!!@wriCCx#x{Pd2C(PZ+oRmH?jChF= zg})`tj|W*9uJvkVk>K!;>-rdHA?ymE8^k;0)msk1MtL7SM$QI6Jy%y($KQG5l4!~A zV}|wSncg5W-YP(G2mO#_Ku=_n!3pWVuJe3NJ3M>zh7{%_O5`ua?=S!d8h#8 zQJ(i>R*X;gnqkr=zuNNPy6F_qNQY0p;HB-aEbQpmH20wxCI_ELs__tqgqmjWZJMGP zdcn48P$?6+jU+v}_VM&w3vIl0DY{$~bubv;n@I{{@J39oEbA|ZiDYk#0V_#2z{|Lh z+GGOlUD5tG~Ul zAHv$P+eXx*+L@~xk*TcD2t#Kr-;%(QWS~Eily>+%TwVgABV9munpf*&yCH#aNK3c> zovE6wFa!tZ0@1=F+IzWo6{r*|4dHfxPdqd=mUJCxQ(&S?0{jlVs)g-a>Sq~bgxIb- zI>Ao1I<_oN+6&hyU)1d6i|L3-m&b*&q<6WHzbzpgC2<*F&cQKNml6$jvhP0c>0%q% zP7fmzx!hHB6dF&vyB+)IXV9p2@TujZ)_7G{lJ&Ne^y!Xi$&-q(zH6h-mLdP~2Xnj% zCM_E;JAEuIGu|y#GU;FO+A$Y2V!}zDTFWRLcF@#vE5kKoNYom>J^g+S4s-&y5Pvn4OW4@%b~Eptmn_zu|-!p=2ZS!W_0M2+$fmg08pV ziGB{SBauWe4&(ppa$*8q&MdSa@A05l;;5Q&0>ir(iFOIj8UswQ0kbC*8))dat;o7! zE>;PKbycZ$uqdr;fOPQlKpHf$Ly~;f@GMz0?~{+x9DfZ@&_0#fJjMY^zPlCmCa@<; zh$i+xEqiTVI!Q)jq=PwWN|F}B(%gob_xXJfKMjfWmJ*J5QXZ8D<`k_B*JlrOioLe7 zm##)?qrvH^`lobQr^uwX1hsRgN!Dw_cmX_dS4Tn?gJnJqOhrQ?xs}QX+oO^S_<1hSv9OhFBT-$6FyR8z%~U9Ye}l*?in&`6bU%)NYIxaX>`tG-#Rn%~SP*tM%Yb z5KS(8k+9Q)DfFHHzPs#CEtT$p@x^m+f*IYHz|+Ys&Ig^!vlmT^GL%=OFYwK_)4V?g zo{>JXzeXvFH&1qNG(VepjI277ffbt53=0k6F?4-GisZeNLAeVlWN*vgE+f6nljJC| zvVmo2!J@~`e!l?g>;ZvV+^eHXQL?imB{s}VlqZDm>3L}M=60TdmD+e<72$v4^&9#w zuPMMJQnhgbwlLUZXX>Ul$>mku68R?tq~kD0z{{tco1lf_iJCM?ML{|tGFx1XFI@B^ z9?<>G)8&N1DkNm{)3Fh)3WXmozMkvmq^I3n+%J&lM)rR!duig9UtI{AGq0W;$XPar z2U7nojd@?$xC3nLFacmqrD-#e9qMbw1YO^BuD1F%LM=J(s-XZ{1cqxj%z_>}B5e5 zm1}cz?k1LXsEI1^ROzC=x1D7x;Fw3voBp z(dC@xhi?+}0ZCs0Ukv3?1jg$!JuOq1J$xu8ot@?&@ZvtGU>BV%4tJn+K*l#K zQ1~$Retnd7SNTfu(MKi39!O8!bnK7wL5H!(&--uf%xbyrlHW9LBA*SUME)g*tb0GT z489=N6B*TxZ!+4J&@609a#)KUND{WJQ1b}>ZO29Fip?}Uh(pi73QPlg#l)Aym&I3^ z&L9%9RW8W?M4Bn_Kl4h!fOb8%^BusxwcVc$b)InKAS2u1#bu;~L_*uX04jZ+te2OF zR^vdA-Q22{otlFxGr{#T*2>nMQhL+on?=mn%FK(s#L93(zax*>DhcY$VWC8GUt9+# zIzYj~8sNS%HD~f-=PxF9Rio>p&}&KG%fj3h(Px3HSy}ybrta&g>Z)j#_?y|sCKk@3 z9g*Z@x)v&c@fsEZPiwXu?(QT-FYau-9Yyvv?X>oKftNP*CzbiT@t4zIBCmAqN{gh5 zzWg3eWlguvf47J{gB$y5ithCaf>}Uo$d>BRPESNq(e?{4!aDWc*;E<3B=Uxg=G#-1 z9Ia$uj*uLNT-C&K7Map7ShH$j#P+3o<37_~ z<5L}z)mOK#&6eo_iT>Z2!aGKLe{pAypiw)e z459=^b|X>%`1fU z9(VPQ-pfBUWZ^gjWMuU~|FNx2I$N`N?%=1KmIS?(N z3|Ze2vnd*8?zU#^+FB?ZJb#s9F?N+@1oOJQGEiISZN$4j z4z;W@T{tQu7a0n|Iv+DoGG(xshS}rCQVo|azIDQ`eTV~dy(;K38NIneJ3*Piu4g|PJ@=&L$7 zE~zUuYo3gknf{@ph*V;t{{CUWAFZ!&qG86ygi0vRcnW`W@9?4{{B~w(ygMvnS$Co%kp#Y+F0+$M@sWxL@_!*d!`})p#L@Blr-z z!%w3Xz;m{;GIEJg+$B~jfl#4K%QQ2DO~hh5{jzaaJ%76Y>qC4TIn4WFUl(#EFqqrJ zH%Y~J1cIt6%T6}m4=@euXjn$r++}d3zNG{-c3XkR0xyJIgm1Mnv?f@jwj zUI|*X8c%Vk6tSP7!uSIdnCSxHEZb&BQ@7>j)W{LVzI2|TRwua2_<{d9P7m~A|pu+@p&Rl0}&GhkjZv zp`bH_)1ae?p&)JBDc*E+qK2hF3nsDv{~5)6e00!@qcOmvJ{8`K;C{^x@a*x zvJ{q&juDBiorK;x@>Jz=0$h7Pc3PqXhoxpKM8?g+<59~)Yhf1sR!Z=8>K;!V7rE); zET)gR)`mD}DOLl@$Jd*Oayt?ItZb>Rp<#qd6qdkCdSIxSF~T&HG6Ts13oj*@gp5o_ zjqfKa*ads}83gfN6u|Q8)_j0`@#J<65dEh=`7pVo?=ov18XCIDc6ZoMrVn%=f$5)- zM5M=U`u#6ppgeNQ%HXG8ir1N03zpz2{ha+a@nwDjtwY%%fCG6u7z7dwj`_;pzl z1Uu+XH})68-HchKgusLgUYL?)$y#gR0>u{h07CSB3z^13RCI~K!4lhez6%IhPg255 zS!2t>lo$F1t5y?~4ac(1)As7(xJUQjbS);_ZKc@pekk2iAirRPAh<<~J<#bAmG|(% zZY?v2*A(E_POjfOdln9{w0JjZ&zIr=e=rOY08Bq*$)2rv6}MV4GtrzXo~>V{D^M`= z-d#N2teF4Z;NDNPY|Z};40yR+r*b$k`c4`lg-qpe;5R1nmfJRdp^V>1=tHH1Mf)?1 z-r$Z5DDbZ}fh_}6b`(~S1ln|W#=XQV18pu+#hBLJj=%-1V>JBx9|?6;GJ_xrdFjI% z{H>E5N`TKtu6m7gYsi^|`q6@UZw{?h$rWy;EN4YoJe)wILZY zPMf8h^b>7(V0>TW&{z`)3GW2w-Ki2aAIDRTr{13&d0bz=_z*fR0l6%RRL@nS(th#I z_V3-dN4iq2|DIYnw}a(VkfTQKxBavaO@%qqrQ`{8gLxk>#7mt!X3BxT_(J?VXthE( z9o<=ih(MGntGo&P>%Zq##pj?tN+a~9=;RVVE(d7C&9vuU46&{)dE4A|M&!!0;5?Qc z&@=RQeluh$9x0eYpOfCoUS7gj=?o-jDQ)K+P|(6Qbm=%&5bT&OXvZZBo%lMH@zbcl z$dOCR6S3caPBtc0>+LzYu~0fD`Q_qpBUFn=#rJqHwVz(Y|8U}>H?dGgDPfwGj8#gJ zV+v?q)+38Ry%4-;f!0Z> z*YYx#_+2H%V`SCj*xQ_#V?A^|)$}NAX`P7>?|zz?o$sPS{8S@R&d(_{#9LL1fBw0| z%U=DQ_L|RGf0GHnY4w9C*4hT%(pCaS-O0kc`L>Cs_vQX}>6|pSoWE!#EV>RQ>i_?% zXS<0Z!?d|fI2!MGr$1K-dpqXTu+r?=RPV>+_|Ww3G^A;vF7y8W+bSL`q(^0Mn5=cd zhHq#&G^pd3TuU8fL2|Oi?zK07k&};ufTb;7km2^Zn==tSKEwc!7}B?WAC}KqhTGsx zcYzP%EG20WYvB`pxLK7*X0#g=8>Cyy^XvV^F> zi*-Eu3JJ#c1-oPJ>#b=uwW^O_I33Uz8WRL6XXl-4;;q6=7 zvLtSn$Q5-rY?=$XuyJmt3^-9eICF%kmiF-dr<~l(9fQBP0u-i7*troQF_~D2bW1<2 zuPbRKf@zyQofZJFclBLDwq4s{tQPJ+)iJNCPuC;I~7 zu&qFy;e1BQ``kd5_E%TYm8Q^oFwS47!+3tdmvKk*rX$(ngG3^M0;0OF#IuBFk@A(_gtP`qSm=9_o;!A$753iS41doZ9K}}zq{d`cK2ocvB}!r z)lZjSRSE5G9)8_3E|>>YERHQqmj4_KYMNP@8KViLA2>NRY&jR$59?nn;Mt=o%(sAl zt!xNnK4gj*--W{%}x`+(xif30}N4uuo04X#nnBloF! z{_Xj)E1qp9(NSGBCNb{vYJ84suO6IT$+}TaI{xsL$n7gpDKhi84$ zyu}m0QHzPQdmMf?tY}gzK0Ieo;Dm>ho23ibCA3+{{dXSsCXhbfqabi3a2VJkxT4%- z*nOh5!nISZv+eVSzi9Vva)3KyBVq3`Y8GuHk@sd-`JcWLKo={Q?+JtNxnx7CU&c}<1#awQIJ(^eD| z4#-O=RTt`;x%AU&CO4#EVcceaHQsH?i>z5WW%Q}DwC4uuecRzA;aI3CG^0 z^&U>8tg%|{{J}nTq)*rN%ar+aBW+cFJY-DjdKu7=+!Fuy77};ApCBV>pcHO%e;$-Ml&Q--6tI6E=V>~Vl7hc zwNqlTQD)vzRn43IktFA*ej(X3AAn9cxFD2FzgBzA{Q7;l{tlQzxB;(X39pjsTf7@- zHi^TdB3O_c&HID1qsObynTNjk)jsEGg++9Y+bnKFJHz$}RHR2@Wbb6Ip%5|ln6G6V zL>*c#WxR0ffKRu2JCXgxeDb%^YpY(s;ZZ;O$lUEv59No%s1*#_7JsJ*h4^-g)rX#6 zONg#{TJZg;2d{YM{rC0>FcQtac-QYBjGcm{IY8{plsXa11dCyAFp1tX1ks@=F=r9O**>78eg_<7K{$=*1M&9>jeVw8FAJisJ zp+nZ5kdB?|^!&(XjoFwpo!#|NhxL$WUe8Y2OLN3pQPEC7=;;I*sCutnlJGG$V4QkO z7APm?@L3|?M?s&PcU1i)HJ4Q+3Y1miJ0BW0@HzBqmvP_JIC#2*7}x*y+)AIY4+BBS zSTIa}9?9l<f2e+Ti?a`Pp@BJ2KCBFSZ{C3@P0%;NQu?UISn?q$cz|fNC=Zm{E9p?w@vynip zwo~U)k%x!l%;Wam9dxR-`(LScwxW@;z&r(rXD98b1d4`xa@=4$TUhIM4 z-8X368Ef~aHY>)zR-gEcTPA%FQG*6=e;Sv0N{r|I9T>5EY@`D4OupRgGqdWx_lYBvOcRk{{ zSx=DSO8+O%$!Ty*?rj)PqU-Bh%!eZFwyLdb5^`(j4xpGc@n zI8e{JsnMZnTUkiLLHSqpmlZR|4aZl1uuG@%S$g>5g6Y#N>I^tJ;}hhS=R?AWbae5T z=R3ZvCTFPI5F+m0{y`G4EvwzooesUjmppebc5Z*Tie}B(ySdP<#d4wyD*sE`ZjO4+ z{5bd>g9~o0G*!CxxbFRsDg3xe?{KU0UQVuXA}>3~7}j;^x9(+_P1n5iw)h%9>T2<* zY>?S`1=zcNTv?w{zm1)dpS7^;R4`@Bz%+1Rx|${KQ8x81A3HxAvabXqD%2;pk54i| zPBZFTComTzsM3YYLGJTUs4#*t_eX5&L`k+GOmNR;!i0-juGkBADm=fF1g#`v zlLNBVKRA?-OF+@pll0oeWV!6sKPSrO;X)k+7C*GKEQSyU=px0$#DHc5lqxO)_VERd zaTl*rx5TkMo02Bs(C|*)5oA+gZZ4!AoD5Q=q7^TTrng>2B0R#~(eeI62eSH$BJltp0dZ6)Bo?tQrc+4}OT$V|h9A zv+h%=h>*SjX_#7-rFnqx){qvO)~(;xg%;Y#!PV`Votb26Mt!q}FeguEx0Wv6A=%`! z+f?BMHwSbC_R6ZINU(|UV$7JFIa%J|?KtcH_vR4?uXG1ZW{5<{3;VJe&)!BAiR}*@ zl9q3%;ES|7@a0JD@0Co57ZANUPYdBtm*`fUJnn9ArI7RJ@-M)aJYQoS^HuV4T6fGn zV3r)=Yg1hsv{As0c~iVXgaoSzO3a934LrXi#&t6B9+OIOtCR6L?e%JIy?(qq`R5J* zBv;ZUOU)<2U8j$}^zOdb4^Ash49~LgSN(TWey#plsIeYfTNdE_9)6m+U9ntZw9-(h zlvdZ}1Tb_5-k*F`Wfzd z$S*BFD&4e$fjssPE$-dC4StEk#1xUwW7_o3V`w$djR?!f<>`}XxV^pAl05B6e)d9v z%e9k~Zavbs@~DGI_(b*}YBFosImgSZ2vzy@8d*I!8UJizb)8P&+#qAAciC(wB z3}dl+hlS*voSe+eX6H5O$f44|{`o%Wuj;|e+9{_OCy(A=JL7c$g*K9E)2rlf828^W zpd@TMF`#fJ4o0J7Ms^k=^wbv3F!y3+DGDb4#jX65A^p1{ZXTUJN3!CX;~y=Te>nw; z)N2eCT>o|oO^5Jo)pN-au>3;v*w8T{VvQ?K40`!siBJKOFa=bZGTc3TSO2W^fN=QJr%#Mw3fPrf)&!D%H!wipLe6VOLq$x84Iz6A!vM+!+BpoF zWPtSLCGn_Y94dSLs%6+A{i+JRt?{6;&?WwL&ssCrep@eQJUI&sx0E~hLMuSIa6wJq_eqMP4s|7b%E#DMyy@eo%8^hwQfyfn+YZGN%-@=I}U z1hm)0%;^v0hD2tr|0dZQ$T~di7!z}fQ9G|E!ry+x%cZL-8Ga|RT0FO&bpcxn?nV2A zlar+B-F75fv9vpjWC_9GxEFK@`f5*$G=i6hiR`Bl%ocoRHnH8?B)1VRJo3Ie<(L(Z z@V$EzF3&H@vhq;dmC%5zdT!cE1!8(2Yf>>xT;;)`nR45wg=h>3}G7NWcxe= zaslWIcV(V#$ADlT2GTPyNYBn*0XC&DcU<=M_5FL$z`&zFYwhiPWU_QkfO8a(L2h6f z&w)CCTO;{H$Hk>)!NIJ~7Ppof=Z6hgk%5fP?C1p9X72w*9IRm!C{lD|KxQ$jcetHU zrq7o0C1aq#?M-R|>Toh{qd0n*9M)on#24<1I;e!m|GNZpej~`TW!UU|(#{b0>D|Qb z!bG>-BZ6AqA$5IJ!r;!cVpI2b-B`((bgAS@u+*ID(M9Uwsp@ShD>ysnN@i*B=|cDS z6zw`A4MUq<4p~6MW3dFPxb#qtcZ`SqYeKJP2H_2RHDrkva~BDcTrLt;aiL$-7#sEA zk#DkuJek(ZdyZN^j3!FK`=`LU&Tmoqv!h^Pu&+;U0EF0<`q;_)W*ifhr8>@ zWpH-j`Ob(&rf@dkJFzkcvPU2wzf>_aFu3{6S#=NGZK;5J(Jtqv{UUbVB9v{q%uWk} z5JELhUf!oaSnje(i_F|wzHPvZ(J68K4%cm&ft-c9WD514;K={7%s zl~S^g7JcvA*0Sx#EtW!`tVr!LrqoVm({rUw@p{p%p09D>l(lZ?-u9S&iS{Slh#@{_ ztEf1%h%Hj|IG~HyvRLvm9!VH4m#ig)708Wy!> zkaE9bYXxe)eh-WhV7=j~88^+uj3SrMsg0OpKiZWvi7il>xjq9P)n4VuYy6StFwu`g zSVFi3X+!o_+i0FeQKY%Hb_sQx{qv_#&kb)6)o(HZU!w4|YBv?Pc)2X>wCY^zOq?zk z->T&-9XvOTGx}LcZSv3pcIzmn#Jk~U3cDKvuSjp?3MO(adqQ?-9U7hjroLfD&Q>fm z`o0bbcm#|zfE5c_+z&y(MuUFcE#?Y(iaZTOz=Q9*?)`x|4-SKxYdM)t2I6CO93JVo z4K&55BC`wImzBCjn!EL2*$eaukxD!$A2Qsl(d0!MPqwHF<5o_FfE}GoKo-^S^?!nj z5L9e<@Vws3mo@KZ$}SJ)(o$20)A_CcUhJocedaaSr2h{0rOXqo2}9Zsrw_+oz@{Vm zf0%l!pt`oMYZrGG5F`PDy9al7mk?Y6!QI_8xI=Jv3+@^S?(Xg^-1VP(@As>7s@4Tn z6kN8&9~%M$RPvoV8TrUd|5U?S!!KE8`viPTX4d?hYUhz9LT!+7sNw2-|Ktc8 zm;L#T=<2eRy%#t@40t(mCccgH`q{|QVKu}0!+kRAt3QXpVuOhX=f-1a8?7`kc0Fh1 zbFS-XzK87G+EO=f6#R2BTl0Z*pzsl{#^zhKb3D_dNh0UqsHrs;(S|ap2>|r zzQy_YkRkjXZ$!kH4h6aPfOE*X2`@VNS(2a203!q^%GO&}m-=?tvyZw)HKezx!Pd+0 z>+?hgL%=+0Pp?s}->3v8HOxaL9E?_Mx0!?=;M6qJ(ypd+oLMBal{+UJ90mB*tXi|Q zSu+-=j>7A^adjo3F1&~qz4J= znxPGbP+|!;pNOhR1-0Y@q!9)zQZ9U0+`T7~5VidO^&3QxhNB-uNkGgc4Emiq^eSBL zSL7gOyw)|F=1-fOP=@Ew)eCgJkVXf=nb27Os}UAfT_BbgCLW%B1=!Wql2}9wZAXd% z00xT7A5>l53cb(D z6bMptU1jVCe~k(|1^PEJroVxEb~tzE>ZmJ_=q_fWP%PBnHzBvs zwU|TbP&fvyD%c*7W9qOilPL?a);;h?hK(eVG^RB3>iR31cac}cRop^49#@0 z@kWxYKqlEKsF&i{u^>>q6p-Tw!w}@&k)e}ffVScb2w}qMNmJ>X(Ma>`5EOyo zU=mb6QL!)`DKzyUeFml4|KILD8Dw?xsq0JlP%XU(1T$)Gd%F%wn%}2in^2$Rwmt^t zAfO48L;Nd`1z8H73w5!8yBedm&m;k=T+6*)<%6oH%;s zG@8lVdT zMnMJJ`HGVkvH(VWc#%4}hIM01<-52HM#+=WtM0vknf8IVPM&EGM56Q*4{pg{0v$RN zg_f1M{RVmHQsAHRQlMozHPP;l3IDl6aX`6(Cc9i(MKfeL=IlU zSVN5FkcNtBoU+>;=be}>Z+pF@v>L;cG{_wiBBJ=<+&V7A%JSe!UBTEkWX(E+vrO1) z}2SqVX1;EY_EESY+GSaDgm|6x#>=4sn*zx3z*u3G;Gmq&elMXxz?YlVb?HsTUX zy(he&`rFV?A*9BBW7g+UlZ|ACww2v8%S^CNW6-x`&(T=H432VS*GFgTbx6(V<|BV< zl)O-#Ok_ydj>9W+AFYqaPENnD)Y_?#5T}d$F$|U^u#l`o=Rf-+Qm0 z9qSaj=7N)^np)$sRD^hPY-x`sl^Jvd8=*TfKh2_KBPD4hVRuysom_ezrbkr2pEp!Q zT1E6zVlDXT-5l8o%A%p2>l)Sv!6I@nU|?=;4!BT2AiipJbQFND zQBqL}0wAXgPOC-q&^Fg|2|RMpULF$sHya_C5FKR!M%++4@iZkD$N~%mW3)#|w_XO& z#aE1;#d8RQDTE}yc=5+P4L1mk!kuFHvkzU$J5MY-*rjqyOmz-r6_dV zb@j$<@bg$3F0E%4D`ryXqasAH-TH|RBB|FCJaF1Br=&Q4VVY?(A}Oc7O_P@*UTy*E z4uGQ~E|Z9E!nNs>265G)GrPl5Bba+qzntZJwiN7muv8j0X}7CK*>QGU_3!8GcHfZx z&x7*;LDS{ZPx3b5#p`s`)6r5?Ca3l66#MWA-pxNAgD%}MPKPCMRlF;ZI@7A(h`>x| zaZMHPcV`8Ev)kX9ujusT0}HG9;LN5WktYd}>eUU+`_BdldENh@w&AbO=es*f$LEpd z8|MEYB{L)=%YVEd$G{nq4v&s5Qp~tU%j5)THO7j9H7%m$#){4eOQ15RPgSm41>5a_ zBr^o8iQ(aZjlH}?kuf+sU8Qh2${E%PzJ$z7@54zFjEKk!;tsc4Bx14Tz4-X}oq?E- z*w{b;whah%BzrpKIOs=PxigLkzV7ZVQ)XB-N`J-NjExJqn}geaKG~ojUHocd=-m9LM2zrEtWxEfJ$zjRL8{hr^bnyRSmeOHsX(YBe01x0valZ zF>N1c*f4*BjgUUCHZdr;JVAlyr~t5BK9c&w1g6Z*AKtBG zs9}b9#;%zd79qJj&Hg>$B^n&#dYuP+pA)6#X?y;i);a>>Bzn&ZlaUe(GRN9lD#eU~ z=3PHDix4y|xDT-(%AdTD7{r7ORrq!E)O1{O#3OcYPtI-JR(RiEipiywG2*7;l#N8Y zeVwp4@nXS3ix{M&c|ngkL;UxnmI-aS@^{-HYrwy}{aI$g6FJ$|jJ*kHNC0k%Od`^c zC+N>V2n;$p%jp7XAdT4@Kzu{d3@jAe>4G7EZPicW2b0SNQJ({7inaiysu@S;HV6?D z$m>QI%BH|+`^EPVK~0GH5ou0OPkY>-F(APNdCb?F&**h{^aR2{@JT67rT9_fa-Az- zA;(Y~^#s5Y@VfAMKe2(t31HkP2^Js&GQYLO9oF=qUxhwh-2Wy(c*R6-gr-iIOv?R) zyyCypz2&%1puuoRdnn%irzCv)+c)>QGHgItWKNZHb6}u!j4)vs@L?V=o>YtWQ~OgU zJGD=cQL3J@51?UiYYBc@=&0MRSSz(KOZ`EcTi*SRo57K=(nCcobX&9rCtp}JTo)2Q zW87aXqma$#{4^W(l`1BiPZ=QqJ~SooYcaB777awEz&E#jv2V$F3B}`C^kvjlY{_bP zGQ)CzWg^C`YL_Y%&=$Z<7Q6`4EscS?m34QGLr(PieR9SK1#9#Vqk&C&=T~zn`mOZ! ztWX^T=+DMihJmkJ9}l4bXY>?sMz;=XXR)VG{@Zq{&h!Ksqc-Y!lTbw;!LIAV&^)NC zvDsFDv-*!2YVADk13%bTOz`uA(_u4 zLc;+WwF<2U866A@IwTAsV)9wfvld`m7sCuN&{E1Uy(Y0Q=(&@E`L&*UteUr2|5K4}ci` z$!8XoYOT}T6Zl(+$WJwPTfM8RtAN!2w2QY4>Rq7!ZpWg{fQ=2eeD1dbs(%I1 z|BW4j5R(u%%bUm$@NN}tyX)#W=X`wz+41t%O6E?W2Hh5Z@1MwY?Y4&hD+B#kL^1nrX0BFa;EUQ4ytZjeGNaL7hm<+9#x%2r;E_h}gGNoq z&NTjm^3=K_U;Z7s??3=ce=OtjwxZf6j?MF|;z(aU(Dd)Z%vLDfOD@d6`xwx%5KNCQ z>4(02DuVTXy)h~rmuLkv!C_i7ELQZex^5wJ5ohN(?P8qU>FT{RMX9UfTPi2vX<6xGH(L}S=L%nPt>b*VJD8~EY&MCYNCGw=)))g4PLd{a3VG_p>|Nf z0A9>85o*p5NzEl%Xd6uHVfKEy`A4D#LimR2P-1O5RREBX-D36-KtgDDc-$f(Au0J5 z2-O#b-t$p-)s31x@sCvFrgW)Bd0q8uq^@+76CNIH^} znis)@2UNTR4$DAaAK%kqKCo1U({65VI=!EJ1OHk9j@SF!>sDy|Mw_dxD#RP0UggMK zk&fnByW9%v}vAd zd2@T*4PthU%QD$V?j;aJRY|_V=#4bg+qZ!42|O)NijHV7sRS1*X1al62DM9%1wkV% z#0Dw9H8LsFXAJA6U!ZtX(Ms&vR!*JpbX_76Y$7z+NX`hVr;`@wfwF2TCEfK)Qi3UQhVB6~MnFoaA9si&Jm*YSO6nZB}@S1!bnxRM|rBPaGC#LfY^1lSm@SS0qCmf#gk}px8YHQ>{;3N%A;cJjv zFgroW1g{W#&b!c_4`7|;Gy%ND1V${?XBvBAKUNV$0HqY@@eUvZox#i4R6PP_sCELa?3aCG!^rZ^^#`hDx+YJ|yj^p`&jz{QX_t9;)l-MepH`ESAlueV8@9jjMg3P? z@#szzd^b8EPmi+sQMduD`H|HSmL;7b+Tq32ufQ9$oSowHQmL*fUK(7j>1VZB>u~vx zQ&>V+)d40(FoRW+U(-`8?CImM<##yOg}t>r_c|0-^GfC>@Umfrd@uO@{6Z{bR;o08 zq#fy_!f~iu7!&^W(FSb9Yv-Y1zUN;b`2)~+%`v5 zA8~uHp>qGk9`yF*<}oIH+%y&F>gB0I-fTpe{=C|d1NMs!425VS_4L=9rqykWk$ail;sVoD=uCKZ(NZY za@Bf}gL%3NnA>6xMM0gT+;v{8v}uDD%P^|F7q6i zkcH)n3o{LEq_w1B0Ae&HIhe^0=E8kh5-0 zlKYK;V^qGL6PG;fckj=Fr?ciJ&R-&;TGmEQet@VPo0&uuCb$cNc~i&6BXL}gtqf+8 zgBvV}+MXHTLr|6W*A&o>s3r}5DHWU)5jI=xZ{h`Ip|Rp`Z7sC zt9xR@cBMj1C5nN=(cZXaZxDmSb)9o)2;R1JXr&dEHT^Pj^2di&odkUJL9~x(ad;VF zqG-f~@`8jC-&ErXzg%XhrJ-?HIknnk>Y@quCNnh=(NS~anaSwdDRf4kL!^uZdmhyD ze#X&)HQ-FE^t`J&zPZV2bO)51EXg*l1D$Y}#-VB5wYmR3YbWz-b3B%=>7#342bU)6 zwz_ZWx|PeP)+;uyEA7_Sj*U)cZKc}kbE-zS8o*ZsX2? zL9EB-B`h;tHk%mLw5n<6_$Pk()|IljnX`(HHQ95GML|{#LQp|o-zaBTDauR@`ZYqd zc#YNMCc3dwP4JeSj;T*bO>NnGXTxb_?XgYwGKY_erx1z#V&ZgY)53eH>sS*g{Hm;`I9 z>6!Ctbni22WMstqURR!RfPXE0PUGy8hupp2sp>=yq&Nph5a9Iv@yoxp#0*~7UOm}X0Z8iq8rS=^6>%bTRmkRS4OolW9>*-yo1j-bL zxS|~Mug#=Ehc%Kh?A|YC*OZboS{XJo``zVC`1fb@rS!pNiq~h*O2@_qyg7Jw{NZfg z4$v20QpWgA`tDp>=y)6Q-QgYV)*-V!Ahtu`x+aSKL`ceLBkbJ75K1Na*e$}I{ zT$I-&@0@-z1ImLGLhC3{5`x4|{HM%@bgp9IBq{m+SMk?J*3xf_s`dp_nc~itGn_gp zOikEWYIr$oc{txBPzlsw>1^1gKak^fJGYn}z!uMh*{zP*El4z9M4+{nxBc()TxSmk z)s5K%)Ju?n@ScXEzt?EX{j?ueOBsOE>=q|dci?pfMm&#q@K!)U0uXCURPZl)bLY1Y z?Kq*=MpH|#@Mx#29Y6M3vFYZkUQGJ0jLX%S^j^lovCES&ll5i+bmJ0`Ult+xhfP=K zaU`>=-|EnR)ll99Uha7Bj*H)xiCC(n6~4``$GFF;xSZFmID9Rij~{R){zNfIVsFmT7jdYM3UC|KHR z!l8+yLTCgCSu#Ny8ioF;GD|~bROijFMz2pRgx*1wIyOvP7A5penq!8{UD4-I#er(< z+gXka7ERnb3MAAQu2^1oJxRL%D=?>zOocw3GY@MAXw(1r?5erOSPpMg7yIkLZYm`U zgQDm&DKKy}*Ar8-0jX~4g_K~d5Po{eHF#rO!Gw+89T^2BEd01HB}`g3MUvN>DLT}p{w&`Eg6}{&Q%?a zHbOowKE2|%Qjc3evDa1Yx+{gdRbV%>YxU_MRqB945Y%iM2d)^?UL(!)ZdEWTH5L?oj#9twj@7<1NA<6V3QXKOqtzhh{jso5gH6pOAG9Z)G_uD%1)+OuYh^Dy z(!u-YYA`HXHCkHoUNBQ)+9&-z*pZ1WN|+Jz3FeT!e(Z1%x_nYi>#Q()Mo>*KyQ-6u z2=m*%d=^^w+ZbsQDM+2>LLRS*4ThlFbKYdnkx}ATA_`ssg`AnCcQiUuJxS!xRDNR? zB639!Q~tU(w{|j#iUFEHRyGrk-cOmj#7^b5Du%nA*(V4BA`94j>ZII3J{s&n7h8Qt zjmv9lW@l-4KWhfQ|0&t|@~M(yKp`1Wn_o^eiz&U_ohC0j_&vc#mycOzYg=cpFOFLq zukNl7uFmhLV{PX?fViP2EA3usf1FaOZTr5vvzASwIpNL!bo$!v>T{pD6Yi_SA4uDGJ%$I+o6Pw%)L_Ta#ZXZaOBBKDXU>Q3P-b z!V#pQ)%#j##LNGu%mYH%8B;fE@#N3y;BH$NEnyD$Fn2Fa(uv}o6lBIb{SRtS53Tcv zBB8nHkQh)p&mA9vr^jzy{?0zamf#F* zIKrC3d4GNuRFov1mh_GON|bXtdb*Uy-?)mINat%|YGTiJRq7i+G@v1N>0Sy5QNn`5 zMn?U@Hs$A;ffJgpU7M*u_`?`M><$9r{YF|$ShY@bm{x{Pz7Wn4u@aw_fd(#IMrJ%Y zIVmwEMXlR$Uv;V!vltmfwAOAvGRC?70ULvWMqFGfj;Z6JYmN6lgU6+4*U4U7+Fp~U zHi=l)*xub;8L*MKW%7HYuqo5$jF{W#anR-hXe)M9xE4r-&{_O*B7|@Jk3THy11OjS zLn3|R1LtWeu3X@RH|`jwg(G zEC%sz@5{$`oX-MUYAP1&+Oe==e8?0_1Y6`#qU1=k|E5_s5Cc5b2j>3$xeL8n7ZkH{ zcFpx#yKsO!+2`$1tYACyI!eX5uZ+EPqPhy|r+dcgDw{r--lRq9Sh#gxMo!Dh zmmkCM4Tv%$yzEo;XJR7tbA`At!!STc+{8Eu6tbx%n(vbZp-$RbguM{CYH1E_ELlNzH|#QhQn*D8fT^tDbKl!YG4WSWxHlO?^JH0 zh_Z?b4v*uYORUGphKIoVnN&H|eS<}R1&I3grHv}rS#&!U0^@!Y`KOrOw?1*HPn*4n z{vW$fZq-y(KXcjT2nWK&lZ#K*LmvT}xq$O=;+zFG&e%0^BrKFxtkB`?zqN6fL#tLs zitfKJNU=V2@Y@l*0m1t=s(})+U&{P*;NffT7fb|1J{_!&TU}@F@OF>wfn(qmrqi3J zjgt+}Yl0XNRI)$9lP=vfvNGdw@k~w=6b$x1bLvQNnU49kl`+D&i5Zp}$jU5Y$0MeX zJ_^m=*OJDwaFYbxQwIfE!S7C4!Skop^G+81X`F8vH9&^(DjU{+*rAzpgCa(Ow>f-v zQpMI|_!%#8_tst6`7TczSCHJ1Hz8Es2vq)&kAr`9r z$4=fDT_eq35f8tAb8S41j(A4M>y-S8Qo{MSSiJbEGfm1HB{c8e;u`d!F0e6>1Ae7p zX`MET+v)~k(8mz;;#jbqilFtGCLo&TQ}iawoIQyH9M{L~BEOuTY4BaL`lq`+qUNo? z=@c|7la|%(_Q!qZ>0|qGYeqY}`Zm~m-HKF{94;95)20jm_NcFOEdg|De_m~zg6sZg z*qk|^eRzQUEVZ~QD<&9;M)Gkte**6(6aG)Hk0MP3I)J%3A4_F4=>?NJ)n6=mnY3%i zz7{Em^0N>I!`^%jTS=cxm_iwNt!8$)ep$qk_K)E-Al2uuM?lq{F*N2C5cS z)Y+6(Ggt5qH2g``abNgVOXK+b_jC8o471yFY=*+riFMsd785_O+1b5fuIaCKHnTO) zUiMk(2!|Ok4l>8;EHM!+!V3E?tkn_j1fwSsY>q>tI~2aRx=Z4_!iWm{7`rAM5#=|hm;Ai8*6A|>|iCbtpAbJN_6qm;CMt{N~Nvi#q}OKSdJnc@%@oQ1!A7Yo1j zy^-Xjj=Eae>V*b|h^8Cj|Mf=K&df-Iv7=y}!2=Z@3_e1}pdWrYLS6dK&sfWBQ;NI< zKh^#IeYR6BvG{SnsMg{b*QRPEEcDn^n|agvDGLVriu?aImBdY|puc3K%}EKJ?%0vx z^AjdblCm%x5&JD?%K|D8fe7^OJfscFPsNW(uw0vKgJn%ehJ-o0J23Atn&g~5 zgi|16t;wg^PnHy7rAR1W4yMayf866>+ATaqT)GWt4CHTV;ngx_Nlz$^o#5}dY$@jGdUz@NsHgFMT8E$I?lR&yVe7foAH~F1x7A-<9q{&i3fO?Qhc76_ z<0n}s?Pre%$*yN?)jvYH6`eoLpI#b_rK4EiJ@`oyW~}nKUOHyt2+sL9A4H$%dzq{u zXU@C$Al1J;D&X6xC~!TuIQ1O;ci{7+biUda$5Lg?^WWdJ9%O00ztkNlQ``MP&J-pM z`XIQ00VwswLb<)p|LOQk7{9o8k8daVyN**$)dXjxzr3(d2mp0_@$H1m^6Fy?c6H~l z4#(UTu+bMIWT*7TlSc^j)y4jao;dGLZ!c|82~<%VbZh*)4} zU$FlD$2I4f`{~|Om$f_{-Un8j=j((n>!-h!zQ-lr)&89wDcEC8s^koDmXUV3q7oDZ z=6z%6%0uo_Mb#mOhHwso9Ze<#*MWmD}B^&(Fl$%w&G3h4W}tVT}6o|!4LvNug_ z@D2!0w%qA1DI?+5*)n{m~RnrCAxWcQvya2@rNo ztLFx``A!hQubv?zAd;TEb>2~vyMy^Wqy5=Bp{42DQ*z@HK5zZ$8#z{u>Qm;G42Be^!fFJ{Yq}xOUdtzd5bf ztgJKLH=;M+FmVoTJmIZhx`1g(dmRIwK|nM)_Lb1>M*U?WMzMN6g{e!`>}SvAhP{lLkMt~Yc?oRT zc_%ATgHj&j5=NVo_aMI-_nnn;`>l7iQ!^;yi1d(m)8lBD!Ek#}L+CtthcHUP94}#- zg`;!`dQ4xdZsg)7{f`ADA5Q9|s>LiH2V=g8ii?~BNdH+##?vXEGN!@Z)iw9z476K|L3~!rndJ`bOW&~w85^9qM8c$4N_HzXRvK28&cehDMv6jliu#|@W_an# z+$s6l-DM&0uq+7LblN)NaPu;k&pQqho^Wk?B~V65MLeovD-u=`AmPHs^2)f=*U z;l!nlpRwr_Pz<;?)f)=_t4Hw2x?P(tJ+Oh9oQ7p<4){SE*MQFe&Fm=Tg;LH&ZBaTMkBhxvpj<@li;YmvnOzf=Yb8gb=C)SrCuTG5-)HX5Z5b;LmrdOw=9!qZ^cStWGg`ym z9}V}*$daz0xtZRohA^$)pWmuPt_K2(*YB${&h$suboXCnuc?;1mg{8CQ`tYv6oiZ6?LTBaKKiraDYCx zFc_=yNcq#AArH?~tf)ZR-kd$&F(0p?`4!DN)TaY{;!JfyA-GPwSF<7bup1C%s(14E zEwfE)z7wC}-Hq)EAd2~Xrm0tiALBwdjtA$o{3iH3YS~t7O<1?m!_sRFf0E^%W(6NE z5+gq8g8r0vGAHEODT2>t+3EFhdKtE{};J85`sc|2-r|kO5*?8sk3@ClwVm3j7`;-`UIoE zrx;HHJdW_jKt3Agx_y4@w~R-hwkFDrt7ncb-_xXtfr@i>7v1U_%cn?P!?Z|UmmC9vKcj(f<^b6`tys@?$abmBC{#?;{a5$qKfD!*$9hY zKE7Hh4W9H9o%}4v(a)CTFQ%*89gh_LbI-JINzW2iDwv0{Q(;H!+v($)+HCG`o!aLX zYWP~-`N<6`E300%CuHIk+A%c*dQUei(8<0=uBEv5lTl&s0$P3RFW;?F&?K=nUk7N7 z3%FJLI8HfD_^;1+*SbD&ou$LMHdJ80Z)O;;q}VRsr%-}FT61e^3?Ypy=EisXvv9cm z-Ny@y5g*`;lF4Jhu8$&NN8&IsBMDSU$=eS}ej2>D)PSI&Ry2i~GNJhd*OTxrK zQs=XSqhHPM)EtkRd1DzQ-$&~hCv5{Bm^la6rt2bx6yT)hW*a0gOkFnz3 zscj~tH5WTgVA5%i6jQses6JB8Or^~};#V{L3Aum{(^1bd;(JNTg-}P|^9jXUr9!-f zGv=EX)7!c8&YND_l%NF_A6DutTdTc<7}S-C7{_o}c;HitaXDjP?Q zyHoEE=1Vj%jp-j#+ZWG$WJ{3dwEp3<(lgouVPn_2_m%9q_tMcA&HLz)CKM}>R-keOXQqISVYRow zUW|Npc1z<$zQMKr%Xh;A8%!e0jSjW#9d0JC#;2Uyd}T}C4nYIo7SEpKz!JL=(S z)w``tSgED0F(#k)hjL{^HUj~b=Wv*f9UyMqfJUkPLzOU&6>vQ3!u=cn{75<^NdD7R$ zV$W2@^I?`g_wv3c*Ia;BJk|@_7|5>ZO1|R1fUi}jByVsD_47d1bC?kcOD=LmvEV=E z#%DV+p}BVGG?Q+FrWFDZyiWNX9xy*hB4mU?qAvDD_tU#1dbR-$E$N|Tz=$`r+<%-K zWOP}<1()B=GYJD)rU~F~^BF66l4Nh@!^S|mQQn_YL-E^bl7&Tr^Q99&se8{q-LmwR zsCwB{%Xjh$3^`L2NF10G1wSIJ4Z>Xj(=2%n*53KCpX`ySc+LE)CuWoc@zF4*-_-W*qC{*v@;7e@?dE|pGJrQ6p;B|P(@}EJ<#*W*=BNe@ zFw1a~!ALqy5|Nz)2PN<=sf8-1tSpZj02OF_e)9S@QeY<~C-cvjvNFDbKZxMGZy4R-1>BTK2gs)OaSYW67P3#%t$WuD3kF|KzG zNiMAKk8F7ud6kkqYF0=R>w-j`Wl@sc78rso-vJU*ZcbA6(DjRrU?X!r+61TsM`Z^m z(p0LFpgt5N#nG^6TLNcOo3X_CX2vHkQA0|7r&vmgsZc_Tg2t-UWrc8C3W}!Ow1Hyr z!d380Itr5dv{;RPvx0>G5)Bb<0wW4)f3= z)NLj=(J=SF5@Uu^@1Y(OoSNkP?XdDVKPMt>R<*)K5uDEH!`Lq9gC^%8>~W`D_u{7q zliu-M8?aC2!tfe`WHMa$cI~E zq{c#zw8<31O=i5Xj9YR^U@sg zk!H1MxtTLvBz9+Zq$TCYC}-eOQJRlOEDJSJ#ZcLi*i#ffk{!MqaUsYr2}NAOk#{{9 z!a4(YOC}Q&j)&ELHMFT13X{Rw52Rh`3HGGW1I%0lfS?KeEvZA#)!6tExaV0RlgIhx z!M?dTVmyO^F<1uySNYalC*~pH?l&x=q}DE4*k;&&)SiAwN_Q|&pXI^4lr5NRT#jYf zCexSES8MP+pR}-=X3#PUDqH;K(G8cmGieGpWFCI`LUaS!Yx${`I78jho;nBi^{{z% z$+s6s-2fo9=CaUxUcT8u(i{TE4A+N1zu{Tn?FyT0?(G259+SxLa?O*;(ti}Cc9z*Y zk`MZ<;YB7C2Pp&Il4F6FC!}7WWd0_EXlVKf8TqD4Ae0^haT4x2XF zdKo>)PIX@~zJ-^apesa9-EiA+_GzaydB46AqYt_wVltLIyrtDQ4(a2;WqEcPX;pEF z-)bp04R>bPEnzj8A8KK>-T+RWCVH4jLGLXCT9uF)o!0t?*_TH!w0)q+2mM?jpD{V& zQx=0E^k^fo++?a=0+JQ~yQsgii=f(aU@QU~F#yVEshSIPx^{bHnyvV1F+ZNU(qyy3 z1>8Z+x#8itQ^cT9jdG;K?HWa=`I+sCB|B8+V#<>GX;B2?Ad!0tE-Is#8M_8yUo%$y z_D|tN2nq5YDUyF#PRkorDac}FBC7vVbYqc+sJX&c4@)Bc=a0? zXm1Yk`=G?v*8~l4yV~TshP^)N3$Y;)XHd^lLTXWeoM&04?j8VDubHrp%LPI;NI_`~y-ZpTfEML!5FVQ4lqE`%*a^p8YEnDGWL`wCdIL+Q%KtmiBLU z9>OHVAKCMdzpfHeSu<~4cwm=7BP)?eMdW_HTeQY$8w2+fYqC$5nz>YBdGk%@?sy9E ziMf?D=g58zB&6{ep7^m$l9f{fn-wsGxeMn)`Q z_v!Oh0Bk;Qu@Ld6@=H=Z{%imvy~uBpz5>1rC`XbIJ4N=&3%^F6Ael-FWR%`PS$4L6 z?-!Jb1F9lfNVGy^}KZAEyZ$hrkg9J*Bb zU2(4Va#LuX<0$C8#xJFMXablr@!4=QCW) z$*S(U>*|CKjm%{8ei{`oR=}Ca z=Zn%$Z$d44N>#Tmq$-MOeQc$z^4|nPXba?O!LUX+cC3ED1OTOzK}2;f5ZtVLebAT7VO z%N~ro6^WL!Z`jxaFuQ?5i^OwB)}{8ta;A;Lr>SJ`fz=n0o?vX1eE#rbAw<3YKsZTa zcE;t<=DHLbY}tMJBYw9Ej6jHG_=>d{F7C~`WbEu;ocHO|Ds=4Z*W0_)J?HrtJ>ctH zSbn{y*_QAXEV~FimB4&6n@YHYfhf^iH-DonN&{UWvDm^k5%9RC_c01Nw!dR|DSx0S zCOfw4Jx3dL5j$IEuBZ7}d6iI5=5`3_tYR3-<$j&uxzTFv=x&hhTVRNcI1Y5wLaWbQ zEy*9sq)%q12nErQ9d7&xYW4;P^M}z6HoI_qDlz*UwVOkrPL|H z-$N+zB`dPe&BW+SB&LBeBb%9!`&Uyf8Jo+HM0^|<{L>red5QfrE%6? z7|Wh6yv9s#Jmb~f=hil1DzE=UuNH$s6D7Pm6X{g;@k5q=>jhffjd6X@YsxIp4dl!e92%qTyJ|{wsmDeu;duoXIKe|#GCRI znlK=Pw_d8(wfA5!?oap|^X73DK;yU%B4TxTtQGebe7s2-XYzW`jG59`V5Fntb-5V? za$?Un;0@c!$qsmsr~-B*&cChFci28W?oEm{J^PP@bQ-`cI>2VSJ6ln#4l-I;%EP2n zXVR`Wx@@d$TV?#|w5gl;0jcWvTFAhKhh7$kiJr?LLoRnR+_)drcy+t z3ZjLH(s42LTkP;zqMP7fd5ntTB&4U*&A@WF)FT-Fa&#at$M3ovw4mo!b&{T4p;I?f z_P|Fj+~%#fv#t3gHEY>DIg zT&9N?2GCDY864&kdtreiALY(Dt#3Rb@AXRFWUySses zf-$3B*M6qI_cw%dw&!seG`Ydxiqz>VA@i15+C6c+#To*BYgwOO>8J$V?qLNqZWoB$$Z{&k*id-FZwk|^>DK@mfT!Rp_+^lb3$vmU12POh)G_)599~rhxR=krCvRiBh-i<2c z>tp|15;a{9#4B?eT|UZr(mv)G);#`VaV#^CAUWeOTFPQ5Y0A1se778~`>^gMT(ld@ zv4LzVUXw@4^3-3Dc3B^ng`cb0Vys7a3F+F?Afi>1*Vf9NwbHmiiqdj2J**zWLVtQE{j~8y zwGMiy{_i$nK2xI-gh97K{~uN%pWvO&7HEHL4mD&V5N+G@3Bx{;Fxj0{XGEwv0(Jcy*bOt~C+y)q@ot-1SX4wV zB;tIlEgk^l;Q;VOPZaKWkRcp$|F@9BK4)%WQ!eZB;r zfqTc9Mk-o>w57TP5T>_S#_NWT-RsI zSJ*q7DQgPE$Rjaj;R{&Z^wsUlxl?z};#0kXd@eV?y?ytfRrl{w&=uP(0h9GOrNUb{ zc_dtBPTwPvI@y*9#1cS-ijlk0?R7Gt@OIDVb$&j?fhP%%t8DA2FIyn0#-u_YY3BWM zIqV&i)A(%u8sNH-@eug-RL1Re-IHVUO9;2&$-Xte)L!#zx=XjC0Bo{ml|N=IUyN!Z zyR+l|-z*BaP;RsS=VqW(3?{zh8xl6R+i3$1+~G6=if#WK{&}{-6lT`mZQ6AC``hN`xbBZZQ9MoAD9R@%=Vk_!QdhATeVbM zXKIRwE0JD;t0oCsxH09MBRAQ+K|pC>-xdL|fqo?tp8D4yf%Og{==zv&nVgRTpsa^BLngy@9@!3-;S;^&j|!QoUJE=DURnokF)*XE|#4p%Hpt3opDR#ac>4k zL_%TVrjyh&;7u3yg6ZLKQZh;3k?GTEYqVSR2mHG5Tx|JuJ#Lq~1i*!^y4ZZLYHuTA zJ!4nv_O55&I}5)(=+zsjC>5VryDK?3C`ptJ+T5t-(BcbN_uT&0wxLZVSs9(`d+#KB zMdEfmhnLHH@YH#XC}5)kETvrbBWaM48uOJLmYDEDYVR7r1+kme{1*J_#`Q!HvLor< za*ETW2G7GyT6#32aVv-4y={MD^x;fhJtLws!tCg<)6<18sA@guD-L6(k4s$QXZpmg7P@n#(N~UZ-zsctJv0RI} zSaZ3kWY_GPZwRcYC-9rzg?(wa%|Pk(BJ3`7e0i^VgU9Zm`}!^|t>tc^WntkyyMo#> zI9M!hrjVS?!wev}bMJ8#6^+Tm7o_GeQ?u+ z=?x4#TK4WY3GujWl_sy*ZBOr>to-*r?sVVjCW7sEieS%J!qtbzVSt=W!^lKSz~y+~ zHu=ICr8sfntS*ns=P*0r9_nIC#M1Kh=b~LcH61W($pE5tjkI%ls5>6nWV1&ie&&ZW zp3ZME>+N6EM4;x9EVuv)9XKtXOuxF$0WLn^o84$tqfj!6-)H-} zt(eZ^>3qIkqdT8$2w%WQQpsEmk{4gga%Q$+sOS;?K@!;3LimS*A^ln?Byl$0HCkT| z6RQa&pru~(t(zOwR4Vp;%P|a1&1QMgIOlVp87oi+Dcwi*K+2o=T+&hJc-K^<2=P4r2Lp{`>fj^1_Mac%rvr{HpP#+#dN3j8dtTcbdhX-_>jd!sj^7y3 z(!yIUR{LHCn+?SfnK{g?D*fb*pzi=N?&*$=P)^%wHU2zLZR^m`G>lIMaigH#PDQfb zSUvEqu^tuLH$7jD|ImXc>TsGy;bXYDZL>Z|9Eu_2bv92Qlss$S2cfwZNhy6cS7K@S z{QU#-;qvn)LG6dScYFDjS?>E)x*6Bix=%w(gZ9&BX7hy_|Dzn9y3c0e)qTy8-Acpn z{~8|p=(@GKtY^y-&1}?{ zfJhwmnxC}>ldI8qUBT7`&;JsKW9YTpN{_8^u(x*tr7#&ZTb?s1JRgbdJ?(Xs;w!+H zm(?zkp(U$IZF5geeQJv9oToJAH_u)dxqe{TZgiO}b#=A_%}A%`m2IE=JK{c3(3J1- zbyw9|*Tq`1-BZrTBauKq6b2%$xczow=Vh6m{C}1_8^nrJr(Bwmuk%1852P#*5=}(6 z$RBV*7oRJa+3oZc!F!=kZ-(zh7oLwby0!Zo&21f@i^Fe7xi>sEY$bB%uRBz9!1vH< zwY8c&E+c=Q%V*@(Eg}|;xXQT1)c$0>##y9LlhF4eg>(tHstEZIbLe@r`3;|ElJQ)* z!;UKCGacqeVDuEyPMxruZFJv!o(NS;r?%RDzm;RqnN6oR+xdQ`L<6Gytl!%+y)Qpf zp3b@Udv?&+t8Z@lj#Od@S6T9|O6E7iQpqU4`ex4Uy~Oh#&<>yKOz&aeh5=ZV4_P{bs|e6e$CQx!Va)qKDlF4h5czb zjI=|GOaO~>_ig}(lMgz|mhsC_&{C9B@S|k0r@>ibsAgM+UR6RSpU_=&L7s4x2J!~~ z&om(2r{@Ea5eR2gDVVDlb%g1ZxM?-MyD2O5d^($V-A%0*JlXX8OfWg%tU!~6r|EU< zasSw^C;+i%F|;or)>0=)ex5yX!gQ*ZT?U;8bIrfI2QG`C@Y zGFCI}ut6qu7E@DyZ6p}Y{X~XY+zq@gvq&)uUCu9(n6qNs4EUTg{D<}SK(?U|E@&} zB@uABoxgtpVtE8SPOoL;nZG2!=9O@<+3pMY1&N5q@VLi^sOziuuTr8+lr1an_Uj4Q zj4*lkJR>-3=fLp8Sb63n2ZT|oT1KvdG9SzUdqAAmRCiN9SH5`5JcZ}1{=m2i(h!*t z4JdiWxO@%REdE}ks8yy~_vx*le<3>3)@2HWlSICSDftH-BkfG=S|8Lm!_Rk41CU#> zcURBj4riwp3Vc@tqi=J0xCI~5bsC+vv8VTn2gGAW`(lKsH)V=NA>~&AbAC6GV}C00 z1`(-|NmS{p*Y*Z%Bs>=OhFTRBkjfZ}2J`B^hpZM-Vtc#QBkR~wqwXGpsC6mj&OUS|H^d<6pu_`VipO0gaNVv%Qh|hq?~@mI z?bm+;{KZtsLxw1Zh#kNK^$E+Ne6vQMF^F=E<8~iu3a@v zUzfITOq_|z{6Uricj|)%XAFh_#h=CF{>vnurfUhJ^2fwY5R5k!lG5@Bp%e*_|JYz!w1o4f64d5aRPZ1Y%@q16EjJv3qd6gMID}F$60geV~p}0UgpqL$5 zz{EH-H3T9;WTli>$45jp=s#FSj2=th3JAN{F8sC*tX`nPRoBa_FXFE5fJ9@gHB6b@ z`F?Ci7Me0~XTUCSHHjdvMW*R-=*e+=8DQxp2v7DGQmU)?Hr5Th21*gSUm-kRd?sR} zDiJb9FE*+1U4x1&{8Y_2BU>2m_5>1FhS>HTX$A_KXCB=vk?tr%HA2jMH4M^8{kTA|1NZ*FY4t3}`n6vA5Mk&bSK6kM~n7HtB{&$~w0u-Xwyp&$IZ^2tf z5~PHeB`2<*APBAnhv>2{L^l_bI(T2EnJs(N+0_AD@s({a}`8?s9z!rVwyQsEF5dbNIok3 zXozie1w;$~q_y)RGXy&QsiJB=G1BiW`B9Uu?|v{4*-# ztyr&J4~V;_+UTn9^_8W+VU1-sco7z@fEuh$TqX9Ay(b~A@nA>aI^qv$dumvc_>6*H z1@{l>C`r<5jR=VrYISt50PN@xSdG7p`JlsbiAuyg{4@tkb;`&v`{c5B;PUA5#YzG@ zOJlu6Oj#k|IY|>}&Vg<&r~~e-S&VKM&govN#7KzlJG2P0|HS$IVnv;O9iR)qsI#!- zMLIC3@ncR4tB4vB`wxN(6S#?br533h!V7499jAM z(jaQ|@0laNotVmV(2;zrqmUKuV1#BkiZcM<7L; z0@byEhMRR}HSm(@_!h`&*po|4U@aN|KuMVumOLnr^6BsE?L(E1Q(}mS|0XD!UGBoM@L1W?;9qR7y z=c*KQ7&NKGuv7~uIE|K0b8{-`;^@Ja#1O%I=%ndk1@+gcExC+rDl*p6p)e==l&0o1 zDvrhb>VQ0=t$HA9L=h%S9A*{6f&+yEeH6gn+h_Yw?@oHEH3e?iIHqqPR@d4LKPvs& zTK`uo=aV@Rci|_lHYGi1gbG%RgXoLhK-}y1zZLuM*zq;Qb=&3?#;6Oc;r}UT%@7kd zTQB^PP5DNA>l*)CUNlhV&mw;TiJ-!(HJH>%#%`#At9(n-!H1GcGmmKbBxd%Ldh@0E z9TJoWlH`XHl#QrCQN*wcQxP&FVX`CJ!FNs+hcYl(EjdgwF$MECU`js9R@H4#YT|RK zJ6JSjGPtuOWgok7OAr`=nZ?P8%e`c>i&uy(lu1-I*k8iDxL2Isi_JbY5mFwCm|BhRWff{tMrubVZmjJeq64?FjBsr;X8OMS-eS>lL*e>Q@r(r{y7Fv*V= z&|U$b&~`~UxYB4<{ui9KurnaWHgrL^I6V0-JP(`T*h(VYQ9Zr=%9G@q-(f;(0!W*~ zf>PpPaEkn?jAdYOvdrg1j72%aa>EqF!lt)LMA?=aJgQ{+uzSb%L;O;x)5DT{WoW2* zNvL=QnE=%yuSifFs{)S7Tp$`w>4ZLaE?iut7LFol7H)CAhcot;jEprJ&K7LAgg}|$ zjUj9Zr#~rnj@$z})!f*ABZjzKz7}SSUI|eQBf!DKLynbj`)v*N_S3A==X7)ikfasJ z(A6=5t-5aOn4|pf`+of<9VxQrzhaHJg1B9~c5$sqkC{47kwD@dHX4acA_}^z_@4yI z`CX?+%M}pH-s|99kP50*>|JaXu{aAAA6WV6Jbg8S-2R&^wgTxGrGcrwo=GDyuaXpDV#ZGX+<-^ ze)A~*vS?E9QFhI8< z>Y05JWY4M%T|vApQD_gl*shcD1D>q83`pt)npS1}D!#BbxYdWk8Xwj<>Uxnq4S4)+ z%k7}zKuRAn^W&gFF-m%DA+y1$#1ykFLM^&{301P=Wi6$$s%Q3~MK1wS7g^;Yx$aRx z10$7G!p{q_X~`jz@6oIUiSxFf-iJA)zdwf(UBAvC>-fkUl6Er(i;QI)7?eW8{_&S7 zjsG0Qsik3v*OdAGrO{3}{?wYue`8@Rniv*z$P!&&sLcA6baP3S*tD_nZet$XfFoik z>Ac5JBPhVh!^g|=E8<6BA5nJFAQgQ>5-w+SXM0sr97b{+Ce9WsW^&Xt*zCW+pa%6C z_%$D8o5z1r>zna}nfJ^8lBJrlYFoM+E;&q9ewOqC4~()GT$$4RNQhh^nzrOXi4;|S zK5JpZU0&UPe?HntIy%FGGgy+L;Bt(w#OC+w=Y6LQR3>lJ$`)s&H57))#Lo4I?&{Rf zWDLaBlmFBtz>&=&d2U@gOEy{gFUkE|{R%!Sevp2x=6@V8;EP%+`|r6IGV@Ee=+Z;B zSK2yhTL&`6#QgNmUB)l^UONIUcY!FC(R5`n8yxJ!8CXl9q?gim!jn}`)#3?D4w*=s zf3%d0sf)zI20x12-)e6dKCfrc;1-F_?uVX#!r(M2Ym0csexD4vB#58meY|{}h0&_L znZ*65KIpCAya<)~GqE=J{Ap&iH)mNQ*!KC?U}vZkj+4;(ecFul%KWjLkWGqVgsA(u zXIQV&{JAGFK78_Ypyc<9^<~f?q!AXO+s9pvc7w0)#Z;n^Sv4V>*>F(s+tw*Zp-aE- z$IjMt2bca1(fno-?uXfVWwt`+rtd`G23iV{N8MQ|o^K*vdPI2>_Wi>n6XrSg<3k42 zS_fwK_4nwaLnADF+~(u$8TYpg=gW$Vgt#Ovsz!;gS~#<+iSCE5pAr;Y7GIV%AA@5A zzN7MPc^_1PSe$luA{Wn;PyF}qrLFB$K2GK%Q5#6jZ_fa(^C9crW?e6*Ix*pMAhTbP zpp*WrXIjqW2{*@-$6z%5=^5j;|XG3;Of zO$-Lvkfjlj!dv-C4F#`*4jnY?1Lap1=??XuN>`$*<-$+W@5g@@ONUL7wxl?e#D8sv z8y7|Um@Lsm?#)Zs6{!n0&)=&;CapLumB^|geeJgRDXT3eTcmux^xI9er=2f(%WRcx z<gPfZcX;KU0(`z2{2L*T`>bKh5J^RUr<3-gogZo#f8*;Y_fiR*KkYyHh_NM(4+ppx)=@j!SzC&syg{Hr}1uEzYm4Ht-O}TzJp!rG4*U$GvXT&9vKXy-a7_ z))LaIL50vsO+NFv2#@e5tRxyIjjIp08I50WvcH;!lkRh4lts~OJGSw}{@>Sim^&0* z?zylPCVFrtZp{Ga|5}r2v^sjd7E@5aE!@XwNfIsHuyJvqB?Mr8kOs7!$lGrA!LJOW z+q1Vi2%=FeMGJ62Z=k#gQZ3~~W1bRWNg(gL;ychxcc=cWjfUX6biF;rz&lGF=K1$3 zBD8bhc4xr_F^%@x6|o=#Y3s{XhCsKA)NHTlU53r@(m8jn>06l^-;{6#R8`;3RDj9a zqYWMP%HQdvPt{mnX|3PpRU-4HMb0#W1i=I3dw<>gzpR=|f;#VK2i`Kf|2lunl1Xeb zVVzg!KG#6if3=&Br+X55-2~>3!_h7?jQU2~d3|M3tPM}B-p58^aT3zoz1<$MlucT0 zX3jrvO>B-#fjP>}ijc4>`WY*!HiXASkP?7yBwn3tyk}=vCLxyXG(RMw0H^4Ie$J zK>!F3oS`Cq7rx)HhC+l|mP)%I<^xh~WQdvP>G`}9T#H4TCS0@-Q=Rq$ zDCA2l?+v5PryAa}N@+{|{EUYVXsucMw1Qno+#22KO!g0f#M}^*5233F$(z&ff=ntC zvNT4HG%B>|h9-ipJxq6&$c$q=O#MG3Jn}d9R6+kdgHulqc@=879TY%y~=t68v@Miwk4Ud=;&#gtM$7D!gx<(R$AHyF7$KL)iOuF9HaO9Rt8X#%Q!P8jHd6d_naBYFYnPg{ai@zQKjRRP8E+#g3G5CvEc zyAtzKDdOCS68!FN%&rYjumyzT-*MDDvxNf$!mmxrM{I`xB-dOB=u1%ZZ(2il%$jJz4o z{I>Z((?&ajW#1m5PtMzE-}haGZlcFjp(oFK7MFsw9SaSwh8F)a#~x3@{#JfPT5QN@ zQ*24^xMc7N@5h0xFN|p44r|eQ6*R|))JOf0U$PtkLGknng%4UZNf9Ba9yx1rRI`}2 z##PNF8NmkK$ja=%ig8$W2v(~H)6i-QRF%SZB`*-LMlyNog>nMD)DICWR7>`Eytp&TAF<5 z{f5-11C+TpjD@nYq_K=u9C|KJI%z>2nQ~oG$Rw%q9jVIN_wcHsBK}XCk%^I^R#fMa zef8PswK-QzB{1h7Nm=W(bq*EOGP3j31I4qcxXN)Xe7ulKRRfaY%3kt-nSus1)V0KVqe42|DPlN`ijc#h6nB%( z1kd=2ZYTtY?ZYh~LKbGCJPC8%wPd%uTA#0#3`Z>Bb@))y8Mn=#o<5)WWj+IyUHI9+ zO`#|Mdz9GDQKy)Z)OFZ$WIiqI$_zz?=*T^}hpZ;?RnxISfD@R#m=3%1h*-HJO5JSp*;iJCv^HUb2C(NJNbeN`bYvIdl&S%`uXCh~;3@Hj|Nc`0y}viipF zWXy9(yVkdQLdQe?tP_exttgYYYr zwU)}3_Iz&{O-JDt=SIC_FS?`3V=sMG)vj7@!E87T$OLbYDWEL+Ln;>{ek7rf=q(8v zx<0+IB&(~+Xg6g2sv0z7{reU41jtzbshjJ1T`2N59(gCO#lbBO6En$N1l^4$%ptm6 zoK$h7uutJVCvwkk=#@wO*@Sp5j~coi+iG0GX-v-eD>c?#JcB?LyW)kaw2Uz9i^ z1#Sw=?C-^`ks@vA;#j=Xv0Xv+k+e#!0e1F6Ni$+^u9*9F$MbuET9F#ss)xZT>Lw;L zH;JH6m*v(_el2@DKI`7SlHx7UFfY>nhtLn0IS-;igrKJ!y~w9U`&DD)9@Ty$efcJQ zT#=a2<}?xnifR%MHwqpC?GqgoHd30itNc1HDM`P&@@Q;1=(?`jWS^W79;GDO${$Jz2<5G7NbiGL+Hjh3=yNYZ~3()i3YdA+hC zJBk^6C?5;2wE*LCNpaK!2N~;_`nx##Iz4jJYb)_a?U^9BqNNk4BIY$vu1R3jMuZlS z?$<3=i&Zq*67T{C`$KXb&1-!DOf1|U{njbSy>SQ1@Z)eY^JpTy-g>3382>s5oMb$e zX$g_r9=i|F4sT;(VR?4yhBY07OkBAn6J+w6UjJ(ykI0@7bNv06GXK;euB$9Q#uCg% z!ZmB&Btu^Omkjibqf$`{2njXwK8cVa@mL--wXn0<2Xb86+97L73hsD>NJ!mW#O)jq zom&?{OIv~rD^-~n!3v>^Z(@QD)eKOqgTQm{TRu{k_%;I+FGiNXG%IAqh zouLXoGRza~Z;yIbs`=*m50S?~B)bhu0U(2<5*tn<%zg*qxN+0T_5FNVc0fZ8%TPHA zTD~ggien6Qny&7I421*WGxEG3_7>C-eo&LaaC(3BdkcWba3X7iUC)Rkiwq_$cQ~Ghn4a=Ko5J3DwNsgYj0NUU1JU)pU4t5_6M5iMbWK`+Cs| zpa~3byyr&O61{8{&p2uo-`V{~0*i$1<4_PMgg(x(Z2Xxl)wa)n(bsAKDL4F}%}^{a z1V8%=SRDxwvwzwXhK)Nypds%lj#RNHMsGfO?A)@GQn+G6hksM%1L^8M9P`Vl8@t~0VQg}%dZoeQ z;ZW|3({AN&@L#!^#mN9_^E*Hj+id&ha)#KF*?g<2(PtV1Kr=7aI}7JDQOI&Tq=pH`QHcnp7*Y>|I z0bUX1Ed&iea7e>zUcG3aX(ikR5cyGjwDMD9w+D3%n+Q|a_8h#gMVgt0q6!PV+=Nvz zB<769_&JAf`iCPFlBsot+}Mz?oD!7yF#^OeAa`32s-d6S1g^JP1{QW$6>%TMXrOfy*O8*t zZkQksC`%$x|5s0;Ssy2TwRSSd#|3M?W02v(9o%pnmwR@tQ#0St9!5S_;m#VLkSaZ< z``3#$A~)&iAo$uCdRCcKha4^?Z-vZluv}DhR2-U0sqe*>IfZJb;X^UIjAN=6(OyWj zk5Ro)KOjkeRMlNxdfm2QzL9wI_U9F<6(+S}q{Op{HPovQ6jtC6(GK`K?#;Fvv~+YVqIs;?LqVtl7LS&u$Lszf5$~bq7F=6Q~s2 z_`*zEzmFe7L!~m5-Y}9^fzEQFC-WjMxx{7Mll~ORQ$`}W73S)dGo2WJpYoeN)rh9o zhkqXTwk*?QVa`o1WBkJ%{x1J#HObcLo@uzBD4RF+8)wj~Yxym2`}3!+!H(9-p7zUR#I(?vLG=Ll zfk2n9-j-lz51v|czp4&v%TW(Tqwf-nGK2lgan5*F={Ps3*`6)XEp4AFLIK+!S#tAbo_bT?nTwCx zIo2r1e5+xk>6XnmfXC9*BlZmiULj++{w(lGs7B4nIePgf9%#Y~L&?eivPob&hbKdt ze-Ti$1cVd*vjp%VxZ81Y`@GNpj0TN9ZLTz?*Gf!Hxm^H^|URc`n9yTlV zLv-}f>#4%*^zSLx{O6y|>Il-vvXh@YehFZ&O=*S;ZHI`%egAZ_1OWh(;~A^$-s@aS*|7i7 zvkB`s3h3@Vp zw$yR8Jk#IQ*zLMy@B10n<9~C09MBWqIK_rH{N($4YNR>s4*4#HZDpc^^3SfgE#~zM z!r>aeU&E;d(61d%6`;++5g{g2kNg`llkJIR44yyzIN}AllzOm%0viEa!L6ey00>M% zj{75kxhV>l!}5B&H<3y~5HJ@5MBr4$U%cM0&f;=u%m(W%4q*f=h67w%UPhdmOjQ3I z5%3hCn+b%op6*XquKHu!6788hD?{pH+d7+_PnsG3eK&xFLh5)^*Dwt6vD1<`iJ4r} z^V#ve>UuiNwCi51{y_V9MTq+~#YPn)wDvOCFBQ|iq07v9{1UPIyFHu8`}Py?rOirr z)}aY}ZP;ER5ORl+gs%vi_KdjCA9@G~mZIf)-D-VxftyprgZ4+=Rr}N+;7`Em)a%IgVK&^64-SkunCE#BO=mB=j*FzBV@`z?5ReC z`&@{70+~R?9oIl5d6V7Kn7XYewsbx$X}t>&I_;{`HvN;U3_oRRw#1a#i~r@BAl)io zYe59_2T8HPYJ4iiJhg=ROx86#LiiKHONsh>$6>jzpTyv2zK>>@*! zsM%83Gzzk_JZtr-#!Ei~Z*DrXNwn9VyN#11$;Cz`WUw1nkfB_3Hc;`i9#^ z6$l!1Z28piIT~?5ZBd6TCVlJ|Mm&TiA`+&_fKV5dh)YaqYf>3dJ0FE{?QPrq?Vavp z(?W3Ce()uK=`mvMwP-%;jJ2p0A=Yi;$+N246%TLpFywR0*yWKaMeYkbgVEbD@?W#< zq#%dYeYskp!p5qAu}hRG?}mKR+{gp_l^nyr_b}$pPbx71$lf-kB9rmDrHdz;UQ}uX zlO6E1!}*NerQo|&W_WX0+`Y!ayTo9_R#SO4Bm!f~yqtOxV&4M?#0IU+dK}(%+WKE6 zNW5d8yOkZ&MzZ#qwvL&WZ464~3^KLirHkLYIb=AbMkGhg5;RQ$d$m<%hjuTg|cqQ6hK!bAJ z%#I*BtN_pKUr|Q@ZJ;{R{{64V!|6_cs2I}MZY0o=;jjT<872JxMAkqIH*lo@7-;_2 z02m8UDg{6q9)K~OkRmH_gJR?J2)4S`d~R%hi3gKUpgRq&02z`^)PVv-Mz8-IDat%$aG$3YIbjBh`FrvJ$e-CWi<={Fc~0jClpo1&pwq>>xDVhxf+&8#EghpO6?Nw{9wBI306>11;~25!pH6s=`(As%sUD4ZYgQv4_bsGeh-Ey z%>iVjkaKfzS5tqLC;|iP%;|1Lwc(cR4eLKHi(^pPf41mSR2N(_rK%4dc^xFx`#D{$b9=t!&P;yAsJseY&<@BCFFGOc}iochmgMDL69>7>LJiNH{&IRgVL&?=t8AFY8k ztd{t-j^zSN-t-$Qv){)alE%Q~{(E1e)seVOLGVcndjP|*b`;U}3$Zu%c5y3}mk=0! zL79aKY*j-N_{71}8rUZ+CO2GTz$l%`n|bICM=Hy($$RE_(muylQHGULC`+UdDda@F zARJ0toc#%fSlo=SFtjlS0vMekLLj-7&?pb{91r=TK;@s-(0v@$ujBSctj3f_mq>QR z?iCSjE(w|sBOPzD1Ah)3Z^QFW%by;LY!9u)ULzZ3RDzBk>QqOMD3!(pPFSq2Fe;Pm z7=2fN8h4Gq-->lBV_<1QRO81&PF|q1QJTBBUt6H+b|QVOgSg+6FVY9`?_THtUa5(6 zHmPV_iU}w-(+O^XUZpFgU$m zPf7p;T`7Fhy969&VaX`r!Hj=DK$u#LA>dO)Q{5Y-;sa=%`xYam*E7zvVpHA1L|i&AO5UC67( zH_*e#YB3#M%c_AqTD~(go4#OD(YW>fc{CWUInKO2zt55q)Khn3U?C!yn zKeMRxh#iRZs)@s;##t29vB6*>y@_|F%H8~fN;kuP3>hn=zc9)e&!9lJBr!`>Hy#TL z`jbNvwDgz=`SnG$%FwjzF?INvNZ;u*^6MG)&W96S?Gk|v#= zc<@E6y-#HegquCJHB@hg`AL7$qhc6!Q@LS)C`rEXWl2W?gi?!o#-rR=q~i5ln5dR8 z`c$(9{N>+~haIQ+V`tEtwHsgsaCGH*9a&F+-1lq}=jkXPeb%q$*d=$W*K=khpPUZf zaJlW~ccHdltow$X`a+RZe2naS`pDyEvRaxwbq zdwk80x$O)DNr{DY>OuKrLn`T6G&0MW*m55Fa>=cX-$IpJ`se*fRc>d|1;I|!5TQk3D#8`EZ%SE*NWDmnjDr|JJ^>{{ znhBPUYQ0Wr60XRgRJr@7rw;cJG@-eh{3*V}oBYWyZLEs}u@j4hOM`c=>W__ZrBNP) zBT^E-w}ov$eaZego%@^gEr>J@az1>R<3nuSQ+OQILeoQ)_6k$A^}rTFJ>T0?jM31q z33pUf7$eM8<6bDp1WgfP>t*TGNLz`o`##d+SzMXnX(+&20g`tQ+o_R;1af@wBZVFZ zs0IItD`E)Xro&Lk0EaZEL0?cjnUp-h4Fno<`&fJ)N1O_Okg=dh+VG_7FelJ!#o;}w zU?`I7NaOpiTuvUbs0jw0BpD_1CvoIcrn+n67R?MYVTxCYour}Riz?_6))Vl^0sc`+ z?1tpL@Sxn>k*fy}6ja_K94IfdI>kZp!d^1VumMsT;v`x8Q^4XC3WYGO)79%_T7Tf` z>8Zbgi)L7KqBN%|jcb2oQ+b>;Zvj=KUv4+eRT1L5yf<+(&q}mP{52cVUJivWSly)| zFo6G#JZkJ=&@_*{bSlYhblV2>5QF8t7;8VmFxRtg?b)}EMwH`wPK2k4wkziH)O)hv3eWG; zv{XI!TC-Tt3Ju%(wUc=i#kY@zMuMIlga4*Gc`gG)9Jrq~#(dD1WW;|^?Hjes4-HAc zTYEK*lL%p+4P<_hqM%BOBy$Upwo-JemOvCN&v?3-kBd?rMew4Udl0WMktVEO-;)MG z!Cw3-Lh&j13sHct`~dk2yAQlVG)TlhR56_!z9#wmkhWhc)4f-?F9|BieX>+gWUL}Y z_`jdgBZdViOV$m{g`dy!sxv{V zGd`l$xQIFcqY zX?OVt1{zB=5_K32JPhMAO)=n|$4DC%$Xf!=Ns9R$>*+_8^56N)jbw8zk4civ64ZXL zQ3}{%#5|OMF`AicGII@PjzG8ZSt1phWpF+rT)2Yx424KmUQb>m83sx6@F@3yXiE>t zG4!?#U1FxUl8Qg6qYi4|>?OJTNP&U1yuBh-P~S*bKgj{=D>?gtBAtCAkU;Jq=^YT` z85rXp5a}5h(pY_V9*oH?_3^X4T>mdu|&f9~A5vuDp-5 z;Xy2-DF5XaIqT4&DY`y?6%-&Hu^ zPlYpIVHKO1-z*2bKA*Fqyma8eF$)*3cgr-ZiqBRM8!LntE+h<&a{}q57K4BqsPuUk z8q2dymG{{VzqM4PDXy`M?F)EM@7u9<()i(X=X^bQ(1^(sXBrF+Tmsk{eLPZ>sg(w3 zoG=7%Bx0PLv+1^jYC^kJe4x1Ungvqwg`Q7ZG}on5TXM}gTT0A@k{p@XA}Xl( zCS*q@1b0Rh$-=a55h7wkX@m}09haY-Rtj)`@KCE5KamL3+JveqC8VQsa?2sU7SQ3(LNUvubWPnq%hlo*0proK^4F;X^t6jO?bJaM`9cq zcOA5WEj!5Md8+**w=v6Yyw_{Kfh%&7Vvbf#(W;qrHpNPF2WZ}S@LjPCZ4lvRdK*md zhqZYJq}?H}n28WheBQy$-c2b}(xriQY2Lxah`N&`no}@=uTvNmQ+HVGjqghl-K3~~ zH5!bJsy9YLn%d)}nqwmBeGyr2d}RFzQoYGi{mD|@@lx%H2!R_>7l&{sMARJu}vS}HMk!;yq7sEnQF&q=T<#jK!!xjha_r=uwg~VrGb&2OA_==3a&gW z5DUCC%fQ6gapqm;H4k)Dv~pDb)@i=QV@02l{2&uL2JKTo{l^mQKSA=_h-fAPdJZ=^ zaf*bWCLjdYFK`n5N>X_@V-a@m;TM`SJj6?b9t6UrL>wXn9?@Gw;6(tDolH_lM@L93AWGIs(B25r_eXIktP)57 z@B~OqE;M(93pGCE!ElDs1+No(6P$Mlz8HQOEQiVzrw~A85C;z>K{VF`xTossgyBFO zqGCWODpZ0F9XhTN@UVFUv=CKR6(&QmcQT`enVqcM!YXa7%*a$QE)}Y^>i5c!iJ;Q^ zhK+gd|D%1=2Zg~5H@^)-Hh#m$f~k(KXcJXYW+T! z(`vJtoemk9myW&K5P3TikF@im3Ni#c8#8&P$w|`|+?S$-@hFQ^#vZRJ-kqJD|8sqHT$bw|Zl9EdX z8c~Q&mm=MEP%VIU(n2`ZZ}qV=V8H?ZRFA!jv*I7#N@z;8WK)FK9Obn|$z0VJQwE^C z`K{5K3db!7BAng~2lc&RN?|x467$bNq(d6{gavB^GdEH;-aEOOG@!0DI=b$-=sM#f zYmASmF+Qs1_?Y^mYuxy$6#JP}YnW7TLR5qC5w*rkH77>Y9xv4y6Io|mM4d@eoheeC zX;MAV6r_>rjhE_;iy(q$f(+q_=Q=)GgE!FxWrcS@wwR+qgx2bzqc6>i`nf!Ju zWLp|oR38nie2Buh6h55jI1d;@*5Z{WC4u7JDGo<-+zY7A^bCtB0E39IcE_E!5|>aOCTPo z+YYW0+O48S!~d1{JK!X&2DDxv5BeB%_}KWY26tz-f35$D-6b!+Gcxh_&7XX!+s6E3 zO|xC#FMPCw-o@{VYLS+NO^*J+#)5!XU$ zlpPV512vCq2c&i92;G}&-5HTk+8aS3ZyKA@vgTbmq=7@XZ$zp-PY;#8l@y;B-MB3s zHfkv~Z3DXrmhKTm^`Ch%*-siE5=1ZP2l#5_uj zWZZBdC1y(varSg6o~A|ANKK1PX%Um$A~rRn)?Ka8GSZ!C$WkMvEiOuGm=%+pCpAoq ziqDL=vqcQ9C>|Baj6z^Sc4QK&P170pxlnQjnuyNQs3p}uK1Yfpz4x3Oq0@O3W;@_r zmp51SYzM#m{SN3E7d#c(j)k#fj4e^!@3~Bmx()HFxo*H(i&=zqAkt@!QMFgTL4A*} zP7j!45JePRkDzIKVXB}gfiGC7%B~ve{d2$;4SkZCZj(3NJ+-+sqLwsKsy{xm_V}op z6Qo*D`^VuhqQL}i0zmlKC^8w0lgOPAS$iBUXQ)Ni1Ww`*G$xX0Tm)GbLPWL(sU~tw zkZO#RqQ^(Y43eb2wWCM>>At;vKVt>^=rfQqeS3@#8fY5r9i5Jgg5Eu1T=hFupOfCb z`*-{7V_cOTTxGxWnQ!JhUqq92iT513*Fgh87@Tnq38JRkz^(yYeE?D zjC|SxTp}Ej1**J(Z)vT{{*q@-{QYal{UbdCB=>+wcmD{vuO#=Q z%?{-L+|!Rt3GRW2rHvB2{UpzTNXNh!b05jwFUrwJat@W`c@jHOmsx6gO)*|u6j?Eh zl47RiIf^yLZm8if-flPi(`9_y@0rV3fiF;@$WA<2;VPMqp9OHgt|QyQj{@{kKs(@9 zr1`3cpZn$O(D5q)O|OJXkLT6q*wO91k80KG8523UX3Ve}wLiJ_c6O$SrY(8hKA$2M za%$PC4=y$lfuG<+w*4o^J$$Nn-I9Sf9_|x&a>f&^d=>Lms7#f)>W|8VbDj%;sPI_$ zX`U=Za9jaS!WTuJ_50?SDjv2OZ*x}OW;guH?HtU%^96x6Xd~bVdU=`RAQ%LMc?rbR zblbsIg10QS9sj?g?Lb%!pfHmfMiiBp8I_P06QB0imTxTDcIw^!QyU~S=`n0Yk&P`} zw`;@h!ijTMOj*2U`m&w({O7q?=*ErGV^eau!krgk5?XwJG* zX-{{Ly`yDq=sAa8$wEulFapCro7eATW z_&+a1$F+=X*gPVx83^@>OdyJgPmfJbM~H}xO>7>M&@_UmC8BWZ=;Vx;6lm#>M<%uq z6BB3(!<~;IBr2(;6yE}eQ3)ARqvp{`&7_8pps2|BmJxAj(D`GMX=z4eLQ`COWLyR= zszypi=70OoSaZDd2O~RwFuK>IwQXM?9-G)Ks!=m4Auc^8J|i|EJ@U>b^%`gX_v5dc zKh?8lBGp-H)QsjqBxK-Rs8|eHH=3d5QlrPBlbS~*;-pB{BC26J&O+7}oi0P)!**~@ z=N%ARx&T_-wS;yi4yJt@uavQTzk9sP+}dTlOEK1in#U}$iZRM#iX=_RLDL7I_%SQ3 zLE!p-lrR>M3dgMjAwmLSQ(&f;fKh0M{M9j61w*f$WfQ_{E9SaxQ*D>67PBThw)}p4 zn$(Zx9n>EcU4KMmJB%mfs$ztjCPv)x1ZWs-=cvsw0~kcq?ypS2pxiCVCC2USngB z$C%7Y{$O36dSb{8r~5VdfA+ouPKsjrfA;nQ2Z&h|xI2QF^*#0JGbfaEaLm&IZ3zX z47|-TBrb2zUADn@I){{TrcrPlZ3$l4gmZ%1oGh0!SUM*U_QGDSAGTK!*5>bLH(cAw*u-eaRG){CsrRJglARF$SUx4%N2 zQk5H7?|NzSyp2CD+Ene~hOxIk-7RU#9DkPTmHCNTVHMXUGKrao_4W=xytfw1#dL}?%8^u{jlWlvfYmPoAXHn>%Z4$+i`96e%GA!CthvV@s9iIc1!zp_Nvp97wliWwP@DLQ#D)l zh^_c?nfR9)wC%m_puBXa=ZD`;zR|Mh{m;HV_Lp6&_IlSHl)g)vRjzW)YEQKpF>Uj* zovxL8yo1K9iixXfz55NzT{Z4{r0MW!TQ(e4?|QIq*@RcXx5)A@m#tbS{)v_o=O0|Q zM_Rno{q?|UPt<%jW7djO65Eq6j+wjexn^Hx{<^#Ir^906Yu)*9lkxKpcOAaq-?cv( zK4a6Q#fN6BI=66#XUQ&Cm1kNw6K7)apxtBF*g3WOo zHoKDi?wWDYs}Ro+VbDBuBcK?Dm$6fftyIMCJ+_xb`&}TO1^9Aw7j0_jj-*rc%^eVd z6q5f#6cY2eLIGak`yHq*5E?BgH`=3Qdnv_!lVZD7wwL$Y<9)X3zM{u`1^@Nszpgl1 z7@qe7QU_gX$GqRLbE(@$f4HglXIndWTKD-k%Rl&R;hSw|)UG%D!H0U5E!V$nxsIWR%W~5gq10F*8m^p3cYxXibJ>DW4yP>$xEsO*+z_G6B%$nh zp)@KK(B)0zg`2a5vZH~lv7@46het&wm5m(y*xh@Ebz$z~Oe|oUU)OP8F|Huz8OU=M z@h3{^p9QQl=RpeuM65r`0@>NcUG${nye;4=!|Yb02+!Am>Y;jq^@KD>s2boqUy!A_ z*1%1x4?GsAHdy6w69k${V2`GiGB-<(JAJl_-lF@wg-`nJudD7B0qJ9=^<;q|jE!Y% z7Gp~oTf^8o#@4gI1}1N2;x^{n#yne@eIv82Ww}e((Wz`lDqGuCnbY1rp?=Qr$Ihfw zI-PP)UhI-pva6qY(6r%&7Ki7R(77If^DC0sJa0r? zx`u~X$`zv>e3AQc32$ylK)GD2?tt$>2xK-6VaCJJJ4u`|*^}?VWY`7z; z2qsrC{kjO0Z)R4L|5$OXDFlY|A z6=f+oHD&VDDZDdMG!PxYnr6*FDDV;m0z+?zKA55Y5?u}uDs^oXE&zk3Z4|iy!0iF% zeGp)C4tFzO1^4xP(-!Ie_hHz+bc`S#qIt(bioGn~LfaMl4H2&>T-tc$^! zUP%N8#`pwz6D9_?R5;7DiGCZN(Wu%5Z^8Ytm`u6@x9J{;UJsZ@AQ6h~FAZctzoR>V z2$0ju;Qz4hfS29x=??fZexXu>m?}-I73)|l)cDuyA1vN{cGa%JCT;uNl29}1u2-x4 z_nk4n>{+wlzi88$b^GkommYYfb}Jd)2PIXKQ{{ zu41iTX*0JS^}O}TfENzJ9v} ztM>F5IN{c6iBWgI((uDh%lDkE^56F?cZcU4{2twCx&z`_vM8yd*HFEN;Xi!h$o`{8 z-F`fHMi1>=s1`5Jx&kg9X2A{cWE{I9mqd1n>@^^-JjP1pP`iw%ua2o*;*Q(J5d%%lv0E{9P<}PJ$Fb8xUPgqoC z=60~$b8OFU-^|(DzUexnMq=juk0sq&e)#R>2S=A3DnyToEHmC3J4T3xYZe|^9Gfka z9UpNs*CtGe#MuhtP@7P8Tx9InsM1*xWwP-ohf+Y<@Onh#*iyo@io&5c%Q|{jJJI)1 zY5rFzfBMcrc_;=-2ox<40r`S%>tNWVx_oz5Eae9_fK zEc&l%zfHD9$aX<<;0}m}ozCVotB|Q$GIa-Fu+tT{DnQbpzjs9_c1yrh+HjPS3(H6a zcgVJT73VXWyNLlchm8oJf?y+K$8nAfRAX#_IOf3d4H~Gc!dT;Gjc9`e1q8Q>!4wth zJ+wHe{u-1VV~WgFJ5x?G_bxnZdi!8`Uc3CP7tRf>oc$lL`LFyxedA9&`=512YX!d^iag zDjrXr&E{COYSpAklZFo;I*gE>o}Q7BF?#gqp+krM{PWM}&YhEG8N_KEpF)+r0?M1n@K&#ZXXO2kr{I3!@D!0S4`o z43$t*R2{dtLG1uUqfg)7qsNYubxl?!1rMK5v9W;P4*!%$!zY_I zZGoHvf51<8E0iJJfNG2|!U*F}!|cuB&+pyYy?g&srLvDWFT@5Y!_BL6cSvqb<^ zvj&7)U!3{dpKrH1v6C%UCg zT(b4_v$ej6y!H7Hze!)dJ-1fNugX98>h1Txa_fDsR(Py&#>{Qw=4^|)=ZUg$&-WZM zYsr?}hHbk}nzwPmmXnXZ()QMS>pfZPvsapR8u#;-wDAk8Jk{Wi2VcMI;kuBhml}Tl zz_ZQof2PTdA}Vg+Yf%=rS@gwYCQVFo9RCVG`N%&9WmhJkSaRy=>Z<{Wo9H7U7j@sxgn0LN(`+aZYW&Av*5TM14BY5@Pkoi zE@SIeZ<5FUyx)1d<}GWuqt5%}i*gZeOkj#e?&8S>=2UH3xqw^Nxp57G>Wo$GxBK!c zNd=GT&e{Qg2c`~Vfd!21XRLrRKV%og7UHPu0T^oX-Enxd@go>gu`psXYj6TXSK!Vn z{=*;{Y-Q+)Fjo-ZQ9xFiq_VsMam&`+sWaAo)^W;zo*!{X#i7wRjkK1YTKbN0bQS~d zi9mZCj7J?o>_nk7E@Tj*Ckmye;JFO3T{bXdXkSu< zeNdT`gCBA){EFqRWpW`D83s)n1YV9Nag;Rwg8`Y3CBeH@AW9clN`Zh6=Nbg^nYvQ3 z_jDCL;dPYNT%}Z}1u9R#Q!3z!Rc%qK&B_m4q~!@0)E_!J0c30kEkLkGDz+Hac9ZI; zA$j~4zK&yL?0u$PxTrDUfd z*#+i7Rfwr9Ai{(|qIl9=k*XsCr%gIc&04^2fiz0aQhsL@PhNe)HNyCSMC@eayOic|4UfXy=i%a0a(yA%{w3f z8-oUdjLzfnZQQsyBO_xJAw7NMs8LxHCr+L=ZOWK2S))gf9y4Z4c6K&A`uXRd3kwV3 zWeAS@a!GKOXeurP`ryLMEMrXegkeL5FPJyq=kxXH z+xyF}I*y+>VRZJWv>~aTJ9o`Lo5$pU>ulkul###wfVu<4VBh!c-=RZ?apNY8A3r`d zC8*!Wqz6i zHrl|rF=IP-`flF5c@rm2oHl9lniVTOE-xw^f(Zv;%MNySVT2LJ9|p7{U?Rw(p+TLm zI~Xqrs5^irkNvFy{Ur@?IIgZsBIj^Hq7DHSsp^58tp9paONlAg!qhuacVJt|0yZ3^ zQddDuJQPsLTk2LW2H2Gdh|Yo}-GS{1euR@$R895uFW&Efcd4dpF!Ry1nGZBt211W` zl+i@MXdvSOo3QTSYGIZc&$QoPvw$ZQ)UWj1JEMNx`Rm%#iEVn8jZ3uLUZeW6Z)N|y zdDV{mR_*)WQmuZ(-MG#__TGk3@Jgk6d{;$*&NUF?>Im_*gnJW(ggQb(qv)zl9(=X^ zqi=i~i`yAC7UG*&;_64o)w%cic2!^O5LpHHGA#FCi-%rmU#m^8S6lXYu4(tXo_zb} zhnqg|%7<0{`&OyA+OhFJgzW->A&+d4r@lE&E ze7Hut7n^r~G2eYxe=kJWs?Z1n~a6>8pof4vtQfBRCa?yt7# z^-}ZBRiAAWQ{}blFTeM4%dY>a_tj1J){lSst>>D2`(m?iUTgaG>&?G;;DvXePWd^lx{C4 z7nYZc9#-A;bpJPu{fL{~vV0JVFb14^&__7n&A@6wt^+b?mH{2HgMhq*E(8)m1OR&+ zA7c&!p_ntPa-_nJ~rKHw^2xbTogl&BpR5}4uEf+_>BG?fLYLEw@$Zf$6f)SP_J zf>KJ+EpkC6wdk3E`$HyzT)mpHGXdtqGD05Cd~rF4NjHbs7T%IgJ0IB1EVJ>eCI zGnnuxRX>x^J8T;oQ}OF2=?*}G0Ut1R7!nOJFc_UF9wr@SY^m%^l02<_wkO2=JDH=5 zW{)Pd8YfB@X+v~#qfp$$QS%78H@L3BffIHN)G0)2j?(^u>aP5E4fzMg&gx9o4gP(Y zXL%riXM|EJ@cxDZ#3w|>7MOKJV89<{Hxe4TGj1|(2qBvb>~AnYb+{(o0k#kXt`qep`ov`A)t~7>L zBq`lHfA`tv9Xfo{zHyTlX{p2fZb$Cv6Cb?Ye%q!4;1y0pgI1y9l!TtWdt{Fphcl|E zcl)+urx8QaHJ48;aAl=s%$_pK?^B=&_3YU*H8mL`q9_v7*wmDyzJ0!jVn1|n|5smr zzJ2R9h!|h9ux{PD&%XHF;c`m2bOU$&m_B{_$De-U5%C}rOp0!F`sUkjzV0ZBA}*#- z)LAoTe$wI7+}wP43hffpOUVata~NTS@n?WNBmeVzcXdPE!RVOCaS_58K^Ptv&(7pR ztHh3yw&{UEBzD3y3gw`#@=D;G3dhLs78un-Ia$woQcL-ht@+8f=gnxt3YRmzPzfNn z#33Gf9vc3g2l9`1DP98J_EN)7f7^2I>j6Jh ze7r@Kr&|5I`t;tj>bqYjgX}Hb^GZZQov7-~ELB?x3C-bk)E884BvfgJf?RwfYeHjd zm8OQK(oSPdWg{Rq*@*)EdOs6%rEZsKWZFgQ!?H22VhwdHV?s zEEVfn;~GT7;Q<5@@s03I$BKCVVq`+I$f_;y%tbKc3X7&um75E3c(NmIvQV*+wMuh5 zc>(uR#C;GW;_6!C>%>-R2!@!1hLLoxft7YH#BCre*Ndsv1mY}IXoxXK`#MpT6Tz`? zPi?TVgic04_u!y;3?!;TE!y(1sZgP*HLg)~l|~R&bhUdQ{8-)vdGe*MhsX}N_WJw;9jSCCNsk~nA1 z92jy2OYhS_a}l876;0|8T} z)u}L$bTf9!P-lvsrtYG9l~Go&TWE(Ig_43wOk{}Y70q0LGC@b0p%^+I?W>9G%&8rH2M(+LaB|G88Byg%MV8Hq zC^Iqg)@-5l*yxyyC}Bj5u;gjM-tkU0ef&C^76sR6jsVG>=`p>$frI?!# zaNNP%rJ%y-E}Wc?D->wiKM>R$oI2>jtpRxD!TLkG1FS-hSjBa-x2Tf4=qbtb0n;bZ z+`?QV;4+v;XFdpsi!KxgGb`y2Vqp#!LfK4aUfF=~9_j+Y{0q4Yy+V(`F$nEIGLoS{ zQ=>PLa6%9rJ&lC(A#)g8Yv@Umw~62WkYvAAwU@%?P~ub(T(E;1g%lq?%G(q?f(FI& zggK)Fu2{nz>&m;YsHiK9Yyzx^^j}bWF-ACq;%U3lfKf6thsexF^B;b68?-}kyWo=` zO4`x`N-lYLg8?eu)$0y;EyZy#8Q{gGOP3BCo|Zi(bL_a$Sy^M!hi9e_&swx_>CvNy z=ggfwW=z(I5hKQp8<&xhk(rq}Z{9pU_2BZrY)ADg-9R`41`O)ge<02I*X{Y|dUo!* zVD4HK8fbv+*}bh>w=SDDZ34#hNr#VTOr8oATQ~e#KpH!4!tmiET=x8vM-P4Y?nnFg z9LE(8)YLTEiJ)ii9%IIgBP|9Dx7A*~`V1XBj7h5E@QfTZZ1$9&BtI&n`}gmknwkvB zR1`_mlp#aX`u6!AhUEwL@9y~Z=X>|=rF;Mj2|Q7C1qSSRkD(aQXSM&hgHM*A4<*UL zNJ~lW-?tz518u=j&ivjzUAqs6F?9!H zBdx>Y;dBY20bB^bQIMj6h*bGOl<+?k1Q<$=1Wet5-~MlfI$VFz{fZ}vv0Y4e zK)i8@7w{Jd&tNbz)C?KBU5FS(lza$+hZY2e9@ZUPBg}F#3+{@#0}#DHc#f`ug6=~# zKK(X%M#c}ThD==8s{3X#m>u7aO606TgK=Ag%+Iyv1u{OO+;g z93%G=4_u@mD&sf&h$;>F2@94uJo+&rt_c$O8P^aATw*jD3h~W^xaLAUd6JMQR89l~ z-}(U$S&XlTk}5okgBS6%MQ~%OQWq1BF{dRPJTmc(@D{kHhfO5`HXPgxY!Se1z;hVjrVdWoxqF8!t6+f&S6qeb0SV0z`-_e@#G*S<)FD|8 z#2fr-%0Hjto&^G5xd69(VmWhJ)Iy6~Xw^M2vMbhGRMzXLCVK1XYH!AtvcO5*aH4*i zkv138Mk#|UNd=HcAQq8E02w_!D?#AwVlw~1K?wvOT@0{>P(bnn`H$wNYnW)-HcZtR zj8U;uk`%US>)Nk74Xu8Ea;dVTqRV7O3gd4RR=-rr-K~;5=vFssR*?{Z2u0n93%T$V|s}TA9b zsHJc%iPdmM13{Y#&e_3fJ20RzHFR!4E{c|Hl|^R@U7Z~;PBLA@73sRDG9cnDHy(KQ zgmM*!RFt0v6dqN5t^hIJz(cGIMU_)~nYYa6ocF7=|on#CcdvZ!z&t82%+J{E!brkmK(sj{-wW)fAwzsV4-B1`%v;d6SMMLD{kV9^@)zq^NiA zo@27cf+sN2h7f!9?2WnuRreLyMh_k_d&*Cuh&%EO7%(6?c@V@zg&>)Mx`V!b;Z{-o z8#b=#-Mja+Y15W0S+wN01;6|O0Hq}orUMNtXr3vIdSd!-4YA}fTie) zX3%^DYWqQO|IZ78vj=jeGL{oiC;4oT>z*jx73nRwU-Kp7yaVm5*O@!}=b2r)cJJA9 zz>;NaZ9Y-d@q-W3@%xj8Gkj@`5cI1gpceq{gjWbUtUI_mnB{aex&xBFa8dv+K!^j` zyIxe~#OO*u4Pq;|u*Nq9(HCSh6sIfH6)M$>sn#_3B1&;6HiH?(U=pW`i3`Tyrm2w7 z90|p5u!Jj!%|ZPF2<;`@YR@Fe{h4GWDxV3;^Hc$jb zUPkSXkGS#wBJ}})^KLMheg+LNpmcl0=`b8z`WtXY)ev!GLbgD4e<2lBQ)mIU?zSo} z0SM$7F6QBPR4(l}`7(9>#n`IY1l46#ys;kF&2Gn|is!?CG?uXgy6!?vE(+SC=RLP)+Gr*@&h;vUC(>^`@kFvs5tWs#;CGx$T&9*w^d+@ z1YHCcl?(!~>}BUp=lwc!+$;ZDRll;UYnV`2oPCkcd(?mEkO8;b-X}~%C zDxIW|!{p_vy{A(6FU=Oq9Hk6bBvuu7r0j}Sow2;mpyG*$ln5k6+anp+gS6}sL|<92 z^AXwIj_FgO{xHMAbU)S$suNIyG+hF51;tHHrXqn?CKw!WBAZK94(#O3ZxP_eM9AUg z2*L=}Np8TSY>`%=|vI#INPJtjJV|1XBk8!JIeS`;7)D^J~%_V6I^E z$M13|((C$>BS)rBpT?Ibj2xMnoi%>kxCvQVqu_4Ts8M6ajLFK%f=8=YuLiH+l`F9h z%6V{rycU;qF-gWl5Ht;QSl1*CWO!n);Exf&!_}aolHyOpB2rXQ@!%SnfQIW44BU+n zm=)MV!GQM=dC}*m2tf34%R{W{0ZqmUYgEdLf=vN}M-5Q`L-X;I(k&&b)Hthks$dx}SVmNgV<*q*9`B0zb4QODeDcgupQ?WRS@+3P=YgEf zKicD0EoA=WmkDT_yt57g`!QrS3|PnBoH5V1Q(`@XtOd#UTPA_0#OO+<3Cx&DaG}t`x`V3& zWFqAwW!mrWcYtCT|A5cs=Y~SnCM4_DwN`C_yCKHckF1946e4iZK^=4ul-x>q!bNV9 zu}yiHi+Lr9T!!RraCSw>IVAj(+(_yJZi!SJLX)7M0aqAobzS_IP?CiFqK{fOJRSON+NiM56WEiruPu%D8Md7v(=F`9EX~q`t$< z@S#|4hKWOeBH+eBCWyNU7vaDXk5Tl!rw6Q>{u$3{q-@l8OiZ11TwyN=g)7QzPUQ zihrc?feDPA#BmF*1;B~{^%u$q zf-6~tuo&^j!Hc$p1$R+=4*&;zU}3%6@5tqw0e!;YI^w0?!c26Ub!Vt^zRp!q%sFPp@45Rs6lZZog+xLVU-Bia+-s zz(f%%5Gq7K5=G92Y>MYLU4q6N6u?WbL3dy#N`-+kP1MJk`cQ{NQ9g0v#Ol?nCrz3( zbm(xt$HCyisc`-A#~+UzIpXvAAQTXx$(PFma~w(lYbI3?{04|zAH${U3RxZOk06)9 zI@Bqk8|+`O1kH(T=-7Np&gd}|E*@<_dRFut8za4f4v=Uj7uZlRrskR>)ID+4N$?Il zG|Qc<62My=YEz6r2!SiS$ZfbK^{QmzHbMP3sYt>IBaFWWnxRtzG?>S^<=amEqM}Dc z2%`ldJ2pD0QU!M6l;QO)`Dw=Zj3Gt&XQ6?9_Id9KlNS0V+@=}@X7B*zZEC96TA`8h z&Y`$1^F|CUR|&{W+H)rBIa_jRTR&^=po;l3+OonmOf58YiRq%VpeQvZd*-Z_BF#I% z!(#$Cxd~V(@}A53k1P;kLiTjfxG~vP_=M~(qdLmEav!022OD+&*7RZBhmRf)oapH8 zJtNanR&3txpdp8jyT0P^kt<})Ab7lkK+YD{9b6-Vg+!V5d%6P<%$f-aDAHRK8d@tg zi%e*N!fmyNLRJ3ly-7s17D8MTp$gbHv4EV0x`Uv^i*j9%Oq-y<%%wXt^XUNKVI%zP z54Q=4B>ZzZFeH$Z8P`X^BU6kIdX8p#m-`GNJ)aZ+Z_y)?D*3{JpaHxkpSeG#|2#?< zE+&?U)C9pK&?D|i(2@rV#BaITjI9MV1r&-oRUs4*P>I-9!TA(;ty({V#9&e}G{sDa z53Yj<)8&Xt;Rewi0I*fjFb)9>6wf9^$qDVzOZbIGQNX$`8xS!y6WmPWzW}XPFht3- zYI*jo>4}bW4K#PW;=qmKWrqbwaYisl>3|~&&!Wd&4^YD4Dg%&zbT`dGa7M|_(jMEr zinlGDt$2!QxPBF4hC@1t5szWWfZ-!JPp50pF6033DRn^RErA=jP0$`Lka9AHEb&Ed zH5!-3Vq)sMRq$jpCA-!aZMsb&$U#Y)v)q-1Q`_sI49q*TbN5=PNV>rlS6{B z3zzqUsI0onItwbg?G2coiN`DAL`2LKC>rdrg9V2*3cH$6Op0R_szp??V8(%q`IJAn zB+N&=4)9lipwP*HVhsAgU6Hpq#loySFr2^-Gw4mo1rVO~7?43U0&DomhGIbeuyc&9 zR=fi|wwK(6cWSOuIM;yZ0}`p>oVY#+vIW;};I0Q2c!XLxSCs6winemz-1~G#duFU> z%&lsE%8DS+RGb?@1e5>w00Ig|fpQ{90X$<5cNI~+?p4c@%HARacu#!me*DcZQrpMXpCWLEkU!K~p{XKkB0`H0m%zD2y26Z8r+$3TG5Iye_!m!S z*Un!!fZ294)rIag$x&D|VZu)<*X+ji1IS?v9o5Y+{4j?FCH*%8#2?&;SOdhTNLQEp zoS#e1db+2HX#Yg_&t}R&#tOam(_==BY~SJYFFFlcuwuI(wV^r;k%2)&%y7OaaW)#b z@lc9^%qOfnxJH;chM!TegSrcWJUma7dK<9V7#Ym zz!Ke>yg#7+x@^JYlST=y+}kx*X~SCz6$f@aKaaU04Tqq+Evi#6Xtg#7IV#OZP@EC6 zJw~!sksOURDJ@`ZHv$el-~~Cspy{qCd=W78s{urf+`@&X)&`>uMoJOyY0wEz2U)^c zm=A|J>n3}+Lm3YUU640_2!hH5$#Q6TP4F*Dqshp7kA18Qe9R)EuU)&bPrMh zXCk0%jE5;WV?_I1e)n^d^o<@^sYBO}Q>J+-UURWs7(=)LKd=E{J2WjJAt=Id|IMU9 zJpp+RzkcE?@B>TQNdesQT1TbzyWq8*14axgZca~INa4In@cx9RO%wg?J&uPYS2@K& zJ1M$w6$3UgoRJY!BJfoVsHemALAZXwX;p1eO8x_SQ75J@W6TD1h&KnyDj1qTkzrbR z0>}V1LFFA@t|9?{1t7HIundp@an2{!6IB>{HsuZ4-rvNft|LZ0!1;y_m<#6jecI z_zFnW6m2ukmHO2t6~2fyXu&cG5l4}ZkX zppJd=pnudyo5Pp|gajp(5Mb-SO;>T^F zBs(*lOmi^Z%XE=xbW*a8%4Kv#p>RJrSG;l%7zVK@a)t)n8=FDT>1IYD3*<1Cr!%J< z@MyXSgJJLrm^lOiE_wVz2J!)czFY*fr{@@6Sa)!BF#8XlX<^+#nEu)HCv*p!HgEl3 z>ka^Bdpv)zcCjU}F_32Pa7Pw6sCrZVMGgG+hjwieh7J-A@48j<-laGr1Fl%PkPgyw z3krxaAo$@7YAbI1=C%ghk(#}nXnRQYwqyD#rlWcoxF;^grWvd#@54aBFlaZ-HN^hk(ulPdb#Dsz8^8Gh@+fNEh^KD5L2rpCE_ti`eaeyaIv*h!aS`57E~K z>P1k(M@bOkpck@&1$h$^bCb#|LrUvItWuI7r&!c9D`^lcN@|3Z79kSRiUuUG@ePS` zBwNLyWls-%Slv5=Nj9eWahE~d*c`v+U6@Ba2mW>hgQW^%-cSzX6)O!8#FlpFgbtXF zIS8C#`cKaMx7_(vRA)@U9Tjlng#6-V{3rmMGO%j5;DmgSMZpyf7QKXwH-= zEO3Z1ACw?;v^-n>Kn}ngAa{bCszB|-p#>C~5-^~ii=yIDG!ZQE8!sgeg8+k$F6k>U z6gO5SL&E`tqRCM4&<)=a15$n!@xeM-0yOr3K9|(_4#cpn=k%fHb&CJvt;Om@B z@2KhpZO%gpOG+j;{%wFLU#so_$DzR?FTV|00=PYY1Q~aMGY;n==5+reBu?^;Xb@Nvc~ld`!-99Qe__ zEkoWp%DH*8bN{c*dzcw6=(us_8cuLhHQMc)hZ2J6+l9a`gLj2QV1_ZGQ&;yYo~g{2 z&b-4^&jeZ8tmDo^z`F1qU|f8L7YFy8rv-4i;LwsDB0CN14z3Pn-@`L4tUCzPKbtPr z9pFk3^XUyg?*PEtBLxRdGDJayENGUgJAkXdW+?9075hzGmb0IIWXK?4%UVJAmDe0) zHG4EjgCGj(Zb9|n)^0c#9Sn9sv6b@W|6B79Vr;7saA_d7n85;*H;25}4vajHAsSH} z0%;QW!~$Ush!oqnhn5szFeC@!GY(MNgboX3MjzAtVCG-;ixZ4@6u)Z(yb8l)2m%Ef z@IX_UbFaSWlbqDJ!a=3{sgdfCQl5c=Hdv5SaEbvD?RP)~W;xmFPL7a=L~2QbH>LEU zp^vjeAbndfxRHRx(^= z6^Gz25)5w?KL9Dvg>1JEMP1jci*5hLLn<4 z2n}^x#a;MSgJKIEHGS(wFX_ua%5N}yFjN@jpdJ9~6^N)^f@3+Ek76olm1Qfqp2V}38HJirmQE*^dJE#Bt1cXV6APqg8epk*;ixV-*=it#6P z2i%6s+uSl_4+j1yWCn2a9|pWkblLiF8Q+U@m7-Sc3d}rW9Q?MVgDV653g!U+Zb{xC zFh@$<0AFMaDoF=?1P&>*8F+I z@Kxy8k1-`nEP7Ne6tp53#6F^mDU9vLN2I^zxYmHsJu)YFE37-XTJS0Zc}M?Y-9ecC z(NscrK$8ysVY&log~XqzRq~q>#Q#wq2Vn+dl*ia?(e;j}FwSsC8AX7 zsG-8zWgrLMq`R#KPC<__Jdq&V$nFT$je?D4zs;Nf3R999+h;(>f_pK5tRe$Je?vWq zDQ;tQt_~Ev;t?(88pIjo3Y=nqU$hi8;P9~n`GF<-+>_VlW-U26eO>P2-Oio)fn1s4 z>N?y}97der8oL^j`OM7t1K`;Oofe9IATW~&u1s+;&mrIH6#J|l24Q1u@}cr`T;l74yx{S&$$N!ZahFiDza#<(yB8SgkGF+fQK(y`DO43 zTEL~|w))*=J+7*X{~Z=s!I(n}_-WrGs6w~_I}ra?aE&Dgj?o8*A)iM8qY^)KN{k&U zFqZAe-EzFh0hQIzY5R8^C}?!dBP2=DSb?AIIVUgLT{v~^DX3awmY?}ybI#HezWpwi zuc1GX{9t}uH7Mh#R`ce7kCMdjUjwV9I1*b!!kG}8iV5$Pt(cF%J!1YWGyl$n1V6oFt^m}Sr; zP2GXCYHeuELUL@W)jfMK(GT&4Q5SCn!FNr!h^p9?WnTd`=u|}Dm zB8Hq9k7xz9i-#j1uO{NLHNE0=d5}Mt#*1|arYQ*YGmJ38_&WeB85PjD9jaH}`)#+u z(WS>(t&;^|n$|M{b>RI96%m$wSa%Sne=_}lqC22J-ZZ%t5eOI18E__t^PJf( z)!jk1Js`QtsV>~GjX9!qn^kv~b{3Y(J7*C+r6pISVUN&?aE3Xbd9FKRRQqkR<5gXp z$keU&?PiT#TShg+rZZZUMjkfmo1O3VZD8SPewyB%=Zlj5V(&S7+a4WRVEAF4$_ z7^A(%BwYNbDa>=6t?65o{+K(tEUrx$9Id28YRQpmN`#aqh=T>NR8!zKQcaH1Qle$t zJyGzb2=3(QoFVrXF7C=adzj&(g@V{a^Pp}xP(kw21bH0F8e$6r1+3KU43oxs@*1i| zcLkg%_o8rXi-8&fbtyFE9`^#Il?xgkD_{W`ShflNqWe`}H#{4O6>0{a zLYApG8wMvt;K_3a^9BM(0_r5mQA=^$rMpV0xNW3)d}By=!1GWAA|-q14Plgeqv}$cyxmzb$th8n! zW_kA>%!dnTajhw~d*mRTi_nM_RX|W!+(&o-nFt<%IiM=oDs=^{A#Jp53D5t-M<(yU z*U4~w0r`GSx&uBT7T$tP0RtZj`+UA#yLQc)GiS`0F{4M19!1E`&K^I0{M4ya*Q{9s z{)Zd`(4)&Eh+c;x11K3Eum?b7WLe&}ZQGzhgF1Ka+`D&g zxOVN@wR`vO%a$#JM-VQ(YQD>_VT2LJ^#L?mV81f9QIE8{OShy_v16>lBtaN!5k|yS zWT#I;>&8AC9P(ys7O-RpxFLzK)J;c z%queophW0Hen7!54LFn0&jPC@drPUPqUMa!T>_q`;KYdrA*}%riMvQa-2qUn;;g8+ znlgO_Gdv_80;r@g?ZJ9Ox4#SQt_e^N0g#Jcoh{j0`0=ns4ZmObLFUf%RqmgTuumry zv>v*9@;1*o7zLpo2u2AcZ)%#MF^`YsIE);LIdKq!6%ZaM0aeojc9~6HEwxJ8&^Bw^ zPlq)d3=D$XL4g4){}o}TgI7I%L#+dH6PqGLfE{FdiqG~kEnc7*JqMWd`C-3M;B#7 z!fnuTl@~Hz3>seNVn6x=0s^E0n!St)FDx=6;P?7?SlkTk@pn z`(@ui#&*K6(Tv3(0>?sE`e)Oh&>h@B^A7l*d85$> zb7Y(du)+D-g^bOy6}~Cj?g_YQI@`zrjn8 ziRRnT37`}t)3*5{vu|^{cB5a0G zOf(Flpy{873iNj%7-I0|BHck~-oest-!Y$qsZOsgH#>d8)QLZPCDE@rbMue%?$c%Y zs?A4F7R_6{ETt;s->m@Ufi{7*ZA?{Gcz-@v$HcYGRBS_`}5B~Z{EE5=+UEd z=FADrL4ZeaU9@PC*XzAPeM14C=K{?s0GC6D4sFw>&EkcNpjK?#vb9x7&tp2`tpHs(<1DiZ|;>46GlW_Hcs(2jsp~upxwL1` zp0B_DdjJ0YU=oKw7-59*=K+H|l-L>b$veB^yo2n>C}7>=gou%q;@OF_ zyaxpbz<2*pYs3KHMG~tuChx|12PwGrvmp5v+l-bh|2JmXVH6E59tfKJHMV*jokAB6 zJP~3Vz;VmjfI7kJctUbTs*Y%X(L*Zg4z}Ybr$5nQV612$3?YWsEL3Bp#u^~eEy-zQNC=rjE-!fZLgMaAyaH7G%0-VZCLY9jp`g%M*^FM$hhjIyw;*H| z+n6$ENXRq^ZFn+6HstdKmLa;FeTYJ@|E|jmsW=H?x)S|`x&wO=gE0{BtG`!wK;W&? zB;aZw7QrJVl9E91Gvq#Q`+rpXZMekRX;objvO~ZF6r53pGaBcdJ0c7leoTg2uvDBD z(OJghyjK=KVEP)Sfz0E@;~1Ha$KH^TkJ1=^_QVi5@z`8FcqBOH0&e1G`*t~2&*bK>rankwRXLb`$(k3K>n z;D>U4_XojK1BB&?CRNu&^v}+Y&p4U!f^+a~(BY{m{9pwENKHkeGZ!Molt?WlT1~Pl zgV2pHIm$Ea&iqNW*qK#$E)f<9`bmoyD9R=1#sJ0;N9;f-n-ns((ry3BpI;f30#s*E zaX?3Sf}ks#x&!)hj&%u-9@OlSs=butc$_r-TbW)|qGgcRW`ZHFv5sC1u)8h+MWvk* zD7s(<2fAwPJtKXTwWrm{JyUkMPw6;(z~>MkRajiSpyQ?*x+X!*F#?KgND9+Pmv};8kbHOV#Z=7Gzr{4jli?@Yf1>yt|RE+=x2Xz%r0JV@s{;^F4Fhndb00&J0aXe*e98DXBwKh79fVeUH{{ zT5Q^~dCRU{!!k#%T)Xb=)@`?K+zw^5XV1Rw-7~gsIKF)L?7p2oJ9XyxS%)ii)Re3V zvvtTw;71@fLy#qdzn;Kaca8fUfFKR^2g*wn#pTPFj~qF2)TmLJnVE1MGiD527cN|Q z`0(Lbvu2GZWD&sd%P+rx1a5kCDTHbouWS%RYI4f=-+wR5c($3(>Fx1dw?zwnLpGzc z{k!&c@7!hErj3TK?%uUySD&6^CyjxY0{N|JO0RBRha{x{&-N9$GEzs(ocfdKmZ2IB7%*s1a+0hn z8pcIWNlEG5yEi0%5X_ zt^jz7``|!#B~$0bl*9R>U-l>6EGLyNNGfle*@hJ?V*w}jTfly}R@{8i^!YqCf8GrN zZE*W7=Oge_3j$N-LF{UYYLU>;ky;;##V18B-9t;5@V{j6cQQPuLqK(HKAc_wHB62jln~F zy>eZla-ub%aa5J278EkU!$k00h=)`+6DrjK2bQY!Lz2I#cYp|ko2vDMDnKEn0MEC^ zmIRC^BrUQUM71tbn*Bua`9l|h+lld(dm7b_K2+&t4V8vS`M^nX7L3ftMDbTd9I~tIRPnhTS zG|wD2x)W`8dmXh|U^s4bfU~~wJ12&Qk{1OFM8N?#tEc!}3rf5TUZQ8Z0b^59_Jdq- z+Q)v_sD7ArwDzDaHNO9?_JE~z`mbt`vZ?L3!xQ$hleFCpjMG8tgJk0Nji@moPtaH5 zRM!grGQN-R!awRDNIxPgKFkE&#iZj!s|TD-jgx3*flN~mz+jSjQlp@zS){ZGd9YO) z9OX^6c#v)0wOVBwVs# z9A{#-KewT3gDMoNIln`iGfH&a>T}g(+8oqAfH;D^I&U2m5Cx3EBESa64CdXXfPMA( zfEsB2qi{x*Q)By2YoBEwXgzZ8lwI!AG-U!^;2cZzUKSNyqqP_T1uGuT)JENv*I)-u zu|bpeH0rnJlSzly7h>&#p$GXMB#JPPamX07;0PuSfVOxGZ{i(Xzyu8wbKo%3d%Fss zP@K18MmaFMf;)^{mQ;JJuOMD@yvy`0hA!hF73eEOA8QRF7!|rec)ydMe*w%8F)WA# z5ZqB#DTeBYL8f!%@`1PCk{um6x>QWJ=;)PwdotP0B#$#UZ&=cZ$rFC`c=6y#Tj7bW z-+jJn)tU{Pcl7SxXXox6V=}UOe%p2WIrUUvYFv1XEZ46-!52(oc@cJ`=IqehGvF?#gqi4!Mg zW@gTxKmX*(le1^f&dA6h?ZN0_gx`Mq4SY8Jx(p1|oFGB2ga3n*hV<;-OQeNH-a==u zZ+py{vjoaTm5qHn_jc{vW!sjm4x1e$`HdUa!Q0ptbamX=?DXM7eIBpN;r#IZc5{E7 zrzrs)_&qd!$q&@4PtP&qvL#)HARv>wckY6^1C6=!?HNNy{Pe?*K93*ld-dv*oSe#Y z0EGXPl$5@G`>3jX?AVd-zWa9Fx^)^&j*w;CNCevg78~Z$iWMuGG-RK_(6sL=!YUy&rgs_J~)2JI9^ zUv$1UFe2~-enBz;tr+_V`j!RU5Z&R@0_{*v*0a9k7&SF2chIeQKelGJl}vL&1Vq0Z zI2$;VfU(i*xGOdeK=EDjn8r|Oq7J7x6dXzNo`~j(<}ziHzqugGP!tzGW&k&~xyLK%v0J^pgNA3!U)$OY06OE|*7GcW@=$0e;V~ST_bl z_X-V#iuEmV^bU#8$2s z1u}3Y5}QH(=L!gr&+lt$y|tz6QNSQsOliJzZ#KHD>9)TswXNnuqHH&h_4@!kZ7%3FS<%2xW%xlHnGMvh>UM6 z+}+qxu~}q73rj-Nh|0}S%@L0=#8=`Q2=PrYi%@X@kqM~}Ak&%(m75C*&A~tl7sx3k$zhh$=#l@pBXCvzlcFox{y%^LktC4g0WsB&=cU`IPU;A=hGyW z6*$<8WhdWD-}p|}?s41H9WG{Lc*3NQvExoQeS`7Ih~2GIH;hQpZ9qP9!5qs{Ky0o?Hc~j9hw+Za^6YH!CR^9h8{bM@`|S@0 z*Ev`Y3|UIXBowz0U1S{uj}O6o5NtJY7tnb;89T>}>7t{JY^!uZrd@$FXN*{Mr?0R+ z3#?)R4~TW(J&BIzhghtRx$dCQAap*UBvt^SV|!6>dWGyzPaiopX-fXMNd@C4=g#=a zvuig~WXO2@G_7ELfKrh)C?eVKb80&CNxGup)C|RuZ$EY9)S&}2r~f!8HS_rCLM%QN zclpL4Dij=y@`w?^4@Q+3uGx65FQBzvz3u=2?xDm1To@Kbar5TQ zIC}JGZk{kQPn|az+DoCrlyS=J_6d6;+3XPn)cg*C5og1 zkIc**os~5P5(~*xRdwvxvFYi`$FK z#q$a*;RP_j?UmCWMi^oIg}`wb%Fn=Fy*s;olN4ha9~n7C5XJ~XM%6fW>J+fN*}@6dWHSuQR>Fwu?4MU=B592m?Pf!3gM3-e}Yv_);Qr zhuoh3Q!AFg7{^zNI(O#Op5J~suxFo-JA5^J(OMWV;baF0hxU%4XmU*ibQ=70XY`N9 zfrmo@0xQlBs8jfU2bwEFv^_+#Ah$3j&k$XU=T7e2`O{v5h8;fZ#L**vG01axl+By- zfo_OD;Z0a~aCHdQ1N{H}c?TeVM^H)UCXzf{O=7Cm72@6~eP4r835hXr^~zLlQL0)ikk}z65tZs& zrMB)Yq`6DwPIpKTwRpL;VI2iD1Be6hzfNf z8nKn@mZ{p{mIpB)OMLC=1QM^tQzDhZq;kcfH>e3TfGPzPsc&=dotg!-sxsD!!(cqOW8 zgV^fzBI0Y@^k8E!M^aXFnWe?k+-NVey6XBop48PXjDryij004GJ`ad9M~ zxFT>KwKGPt{W~D0(!Mf2{&AByCI2Jd&A9<*2%)Ff0C<=80eAz<7&;WmFbWiwzA(2< z+J=rl99Wf)+uh)i{qzA@VzLC%yTQ)d*youCS`OJcVBx_%A|?_)pV7xR@)-V2$sBL5 z8r1PnaxhBxE*dF`{Hb|3rSFh9`@O=Xdwi*7#8eAc5Rl4%Z+3vX1Fk-RD?F9bBBa#F z{N&qDkE_j&|HRZnEGF_0y+%zx-tb_9mUMI7fgNpeQ1};2EdeK=2mDOmqPxFQZU52i zw}eF5-zC+4yHxZdlcB3Vj50H3Bnr<^E~F|lLoq`yj>Odie1IaRf(H47FEG^Efm6z7 zS$p0}-|@rt!n34rDi$*h5Kdt5p-Ni7>1Ue``v=U}_1>@*J%2qu=Qum1Vr5go6>bGb zt*2z9z!ahq7MB7gjh>Mk3K&N@vVprBLYy5euw8c#5DV|SAk(f$R@ENsEqH-x^H{)c z7=FsnP!y=(C_Jc9{yWk#vL3*o2TI8N^F7={%J< zVEr4?3&CCEyaOIf81e%6s2Z;D?)L55r%#`rnVFfDm6ef^F>>TcFsG-dgZby5f6mFt z;qF5|Tn^|ZK1ZJsP}MX%;RBeVq2Np$EDDN%Dl1%8$GHQjhmrk$sPBd>i(CT*_5kou zlDGp^m+_zwcoUi}cq}R45~GB3XMn)pV6Q;(K1%-Z2e)wLz-I*V*;Jr#8*TP%3mUnm&D6 z_Q-<5Gk!(w);VR&sGn64hGnJ)=M#8_jD@#hxS|1m$V+fMz|IE7cV$fxz4dgz)IfO)VAc zl>*=HdhMZC+NaOlI&sOtw>u55)2j2xDeIbim{k4Q){8creZBeDMW$;_60%99StaI=(?nT)pT@iBXjr2zS>(NgJf@@~{4<_UA(2yl)u&VP#Jv#- zRIyf6rP}4HH~g^2#3@S;KKSa}!d)+djkRJOYdlU&KuV|;6<-sC|A_dSq(Nv1>Efck zHLd|FIN}nc;?WI|HKAr?LS1+rq8eSX<}Fq04$NM~7$>)<%1V*Tj2IuIoY#ab~Da?Fa87tHw!!J-KkP_T?l;x_-+sD$po z%$a|@?f|7DPAISiY>e%ZJSk$)zYJ$7!(}a=cVMayaG`ZbcK`<66{$I+bZ2SV{wz}` zv%skUuG2PoC~`{-tR!nJY5pSs|FC;OZ<(g(`Cit4*724pYy16jVz-C6P(sq=07&hI z*YM%)-Xbe*syDyeRVF#AWQKD3aXMYX4?f_>WBnf7frBn+7uJEQACh z@YN6@-2sIL`3w(vmj0<+y*ii~Pl1R2Ob!oajnf1I9;U36Y;XAss%Va~7YVeNCD~qH zawIY>ld&@}QsD9oPgE#GZs6wN-!%bzLqDNhXfT4=xBryhA?s+X5eKL2aGfFD0e%w) zCy-X!X5J>V6$kxaW^H|E@ajn$T*qY)<(Z#>#D!n5MGXX4+};9wgF0^x9RTnbq7oJt z!?dSAxKM$jx`gTvNN-^F;Lef$EPwt(kWqXF5ZByYks?$_q_6NvCeL83$T0jM5MnrH zBzRVk4gZ<;*9+i1g+~Ix42hu6-5zTf&;KG`R)|}`2*R`N3nP{kcG;+hRuzC zz^4vL(J(k32e{IU2*`ZY3m|txfB~l>V{^h};`s}-CksS_&t(HM#x1}U3CarhLgzNJ zg4?t66mj2p=saQo@PRxJ`bKd8_kfZ%kb7VQF8QO->tTcu#&rj_VPfTyyscZ0@5_`K zRyJltDN9yaYrhJ2u>4#_7PqWkmfWZN!F@aP^9#TDr0arT*Qp|^j#U{OIQJ!Z#a<76 zMB@DeSdz@mt(4=ZvtKJpz0Hw!)0rXhCw_c~IaVhix?7&C#nf$;wf;BQG(@zsT0eA(3bq7}m$`Z&i{69~3@ZXys zy5sIQ1pLMh;ueTr{QG$Wp<<2antbuw)|{{UOf45z`;Pk>L{)eL1ZK-UwVJdaIBns+ zml}16u2?%Zp+Riry3z5kKlIYO(--dTnl!z1#s*xD?Img|H(_Y<^R0;%N6|%xb~h^ zzaQ~asf3r_`X+tRw$qd6ZCtzCvHvU^HhIf!_cyWJ{n{h1fAaI{(;E)D_ZP6~%ML&E zT8D^xYCQ7t$MZMYAr9M4vq9rm-T7d>`fvAMus(OmHruL$;&;R5Jo5TS<9^+-?U=ap zsC(ts)4%OJSN_pAYP9M!Vcvn)TK50A$MlsuoWE_(-Fkv;Il(%m&MkLu;%)cV>oH{R zJ{#L|O5U*FGk;y~+ux0ktWrO^TEjB;w-73!f`(Q@@B%tdcfj=vrv3jN`U`aj|ATWD zAQa@4oX3^mZot)W@J6i7&e#swH&8BmlsThmc>>8He9MEN?jT5bXusyPYR(wVQCe}l zz|@&|$PM#C*8t2KTRsnk0t)`~X#7clCorspaG0pDRR^@Mv$i!$UH9FONA|cuPC^OL zr8BpIwC4otH-7J%!}hisvGbQ*ZYTd-3H=ImUeLjqydENJ&S27ORSj0B+!>d*0f)-LmKi}XViw>eKz&A}YzgN*>Q``Ch= zp7xpRT94hfT%@%yGU}dy{J64$i8}MqbR8g{9*{t2q9C9};kNLmiUMQH?axOEd$X;; zEfq1gN?s|!3m57R#8JM2hp#?Ap@nLW2(j=9-8+@BA{HPit2oaf2*_I?;s$>U%#;Q} z zt1!X{<9Y%=6&Sd%iUA!v<(Rj~JNH+%WD#4uOj@>zdHwiEl@y*Jh z#i3tQb%i%n)MlE%?tmyXrb7KZ{G)0f_fg7aM`yFc zkpoNS|90f?X&-gslA#z((lqF(!NU+t{!a!nn}PG7Wt!r*i?L~p4P|TyGsXu3TNo=e z3_tF!tvVczGe>exLywPKlKPuqm&$pj*_9!RP1JK;QFrjWLcsr3-2vtuTDEqR-U39<1Bu(*cuy+5AG{Cr`Zk&a`>k z*Y0t)_$;GLeC=)nCe2%U_@S5D3Kd?9sDe5O6z%S=5m})|=K(*S$YC|=d>nE6tCqX# zS*td-RBJ3$ZTN6v$6wbSuhrzE+6_Khz2R(&w%>o=CG%t<>o;WbTkU)HOP{%PTW*b3 zpMN_bWA_=~YmGiHSMm8SNt326+IiQ5b?Uy^WygV{wx9NozVnrsij5*GG>y2sPP2CX z_MA0ZemPvIR1>6boGeiOrPrHw+6?TKe!dAsc0uaqwT>StZY{4jrK=K&Mutv&wutL<*BTr0NxbMJhbx_VnaymDvt zmlNOZ)~H?IFZ+$(cS`>5`%&+F(tqi;!hgN-iBSHPU^2T{;e$y8VRffoJPm?|i;i>%NP(=ePc>Pg>TjwLA0fd9ZFw z`Db28d~e>`BW=56m%gt-L|kns1zgt$t z-{}shDH3Z7ayQf+0Bc5ol(I|pCdow)^WE>cj-Z6@0A&&qOZdl6)E(%qQktWz;&`c~ z?tqvjt}8ZqKu|Oa-v1GR50F_T*n#|vA85g(8qBW-PCEiq))sy}VQ-uCEpKLQZ8B(i z%hcs<2CrzDva)&V=1(Ua8nw>8$H$!bK^s5d8_?}>)=v^XctbMVABq@dBc(0`h#uwu z6)l8!j_po6mR!X(xNKad9|fP zPGZ=9Fjubu!4%?u$pn)bnLL)bpDC-v!WNn>L37Yvn^#AuJFwSgfe|1lLvPA;2Q-l( z7#0v+NUSfB_NxYzI$Ux7qK2P9aZ-WG4xI3RHhleCDJ!O|Kb1#Q++mcU`Tb~8S-yj1 z{Cw`6L7Q6++1NB~ZR@nv?I%ouR*dGJNieUB~>I zChG=2#DP8nhoTyyk}z*6We7?oIRg`J4hON&bv#`9upy817va2vtELFu5hWJ>2XzO5 zLL5!uhgm8n6A(R2ZqVX_xLptMq?xJ1q!Qtv3Y8>2c5ca;q1CZnq(tT<#rswbWXeev z0Dc1R=v;$%3h)i!d;Zw9mGvz-ek1pILy=~fDcR1mZ(T{WR)TYL?2F)6J_T0 zLsvs<24I9M8M>rvlB(*e5}+AW8uaOk>c_z$R~!)E2?F^KaUrxT?w?>-p~GlTW`+$9 z|5gi`W@Cz-cG!jRkzJ_@GEzlTf#3}lTpPHn3vQ-UGKioV|EZH8^#m>tB!Z~B19}eb zF~oA9-wfbZK{$B3F`yW>v?mcqe?GH8(%D++CcEnB9 z>qJ+o@oeIkzpX#}Wsk8@aWyRQbp;UGL4J#`kJIlf)rz?L0nvZzkON z@^`5}>^P%6^TyX@?s~n;pcy}{I9C0|4_yH1%O zcFfp*KJCcom>8OU0K|0)Vv5z7cGJm}1l!z?nS2WU zfgdMQBar+|nOVXf!@91(PymqFV9>>&zR^$^bhPqXvEXg3=sw+f6R#&%L#FOPABpo0 zpl8N|ov4hcf(Fxw7f3$gn$t^tJ=PiU62>rmdA3&$9Lx*sJgepUaKHmkF)4Wta}nDL^{RmF07DVm0%T)b?MPtQY-77@tVqG#mZ0`a8m(19pm*m}2~djY zAM7zpgBBD;xS<)Lv}WO`A!YaqAG{#bu1FDzJ<4DBwC4MP1@Zy`A7(0r0apwt7+CQC zx`Xl`n`)>`;U43IjYVdvlbv07df5Hm)MzC+HYcgFe{~X5PvLwH?$B)bW*(Z+Mh-)@ zk!(U~p)57Yw8tNsL+#WY%w11F5Pv{-5Q1s@*8uYnGX#7MGUQ?&g114NV18aJ$cL+g z>6GGgRk(VWVT2LJbq6$GV5G8+8?Q1|+%Rm&kXK&Gc<$LT&ptQ)rPl_(QJWR!!N3xn zpcJp+(lSNDU03;t*8mep_25r2%K#akQwffZ{U5o2j#)f)bXJEm6YJznNIX8F#i^zJ znQI#}XoFZ>kp?4JkEXeCha&n0pcuH{6^6z;9S+lLe&IlN$E|f{)AThCTPMHsO`pA` z*Z#Fn{K;TP81n>R%n0KJok_X~V@XOHzJ?4zeXGv&^XA{JsAQx3RF}hNXTkfs( zaE*2k*7)$T*FH#is&%Pq4Q_p;W&D5Myz~CVJML=`|KvM2Kh!+7dfhu7t5f~O=8wMC z_OVw#uKd)8x7^qKp2u5Oc)azkRa=y)*s#*S-n{quw_~c;5h}e}{-Guhz4XC7Pqv7? zKT$}ii8~<1)rqWByIj>;_dVPC(O23&`s#=GzxY193$cn!sC(<9&F*>XtqlOF z>(Q55Re!GKJx{$IdtZ~X_cprw@z&)YYJA(nO{+cq&dpWpl}bpw`GLk2{?q*C2Wpk7 z@LK$%&F+8U&4*uZ`Oaqp7i~D(>WdL&A83S|J|rYYff&rUQRD|bo==p|Bsu?|qJO;Z zfMB*s?+Nlw%7)EwO4%89xIZ>qoOA=Di>qL8@m;CwPSN_61qjG8k>wa3c#=b1K* zu``T;S3C$v8lPH>Ve*dQPbHRo!7hvZpgR!JaOEqXHh@A2NSpK+9sprX_$#P3)-*%b zm?7f^hLC!YSm14P4sQN9;C)CM{9$pL5uiB{DCGmBlWbGplLOfD0CqarS{{$Za{9|B}}9!l`;Z5b%xS2}z*N5t3`>0@+ih{2jpbn!!?D4iK)`?i%8F77{!>^y ztwh1}@_UMeiJ*(~0S<6n0`_K`gL_>>m&f?$u+Rq!Ra;FlBf z0&z@CkW`gh2-5%uyUeu;00E6X!A^O{Z!9o2E<_YIQXi}MOXE_T_ z53BA?vx+I!v&r}PR`+G6Jyc?h@k z;Yh=^{SpiUH5EW5XTBNqpae>I`-cJk{~6r@fLl^?I1l_OH$x)10c^NGmjbV2l-ZOr zstmvgRmfBz$}!wTf~jZ|^7CTgv-4rvQ!6kTFYRu?3Ce?9sYGCg1{Atgv6%;33I`;D z5{E6Q1hDkEV-E5Y_k$o5AJ#~>27Tl-bBU54Mi^oIWq?KnOc=U6Y+qjAzOKEJV#QS(}M;|ai@RkomgFKM?jSkQa_P2O1 zGj^J(ljXuEm_3R)qNRcd{O*3V|2K5OH~`~X3Fxa(V*(MQ&0n~O=p%V*-j)EmAy$Mp zm)0FX49Mwa@PBaLfeD^>s5=;)x#7*X=C=I`_e#8{25JrXGMJI#Ayv(qELkwI(z~ zKNA|_1_~7uk#IZ425`j_5NPv4+`llPA$JL8bXnqQ$o`T9PvOcPbC(y`Z~`-@kk4=p z1rfTvm~dl7q(&CVlS=S9lBHrjp<>;bgv1(e4H!HB$S)i6f7y^beCGP6>VFwkwH|JB z!1DnN@%16E(9H8QOn;&7;D51KqRHI&AMr69o&g_3;H@5TGj>>&M=C{6GFxnL%L8-v z0qu_nq96(?ArS>^RJ%oY;5iGrG?e&k5%F*I5RyhMKX?b=H|JShEx;?_vq2Me06js% zz7Y_63JPs;#0h`U0Z5psp->=cysyGHxg}UZtTeO0jAA05ZY^$0WpAzDm{i`h&3UWl6jUI$pm|7xK*DXn z5y9-%fCDHZBm=9Ca-!qmfcyp1ci=QgL&1~e@PmaJhzT-b`9twxaOO}0N>jy8{^Z~S zGT#c;L-=8YiSQ2op!%TVfN~N+DW#egg84E54dz?mkaupuQYdyw)?}nVh$z%n(*ZmI z;*U!b_Y(~0Er@e?Xg*G!Wb^#C57eT{m}9&#LYBID8;l4zq98w+LkK|L5>dm9P;8}L z`7blJLJN2yufQvF_(GQwfdVi>+;sh52E_wK`4aO71E$Kun3J8GcXrrAQc8?6B=St^ z-Tw81m~$U9M34g&)bIrG;1U>rs-mtbGT6}|ks^-85v(dI=?8RG)g`zF3|a980wQS- znZh(Lo-U43D9D-k0=|rI0%;0z6R<~H^ckPy7?-YSd5wT5UA^uAB7t>@Bwk1$?-~G- zBIo4huivm~(&VY>>FFazj2M|dVpK-vm@#AK&!2zbzyYVziQ+PUkw^X#z$~KE88Kz> z)4&LWZItbCffc;#_xivU&c{LR7ymR!ngzp)&?(#0Pgegvbz!mSt5}JX0r)?f3nVyj&lIt|*d*+m2xQ!!vLUufQE1(}21;+{96p zu?<4>;ED(gP34wgcd;~Bp0YMx1$In_4)Ar#5Tlm6YniM>;&^dB~(_u%PYeLt?j2Yv5&xPDZ^>wJPe2)fZ# zn+b8KfQYEtG$_=Wi}TH07)f_fQZ>MZJrV_xxXgUsE!QlRm>B^Eln==qvN4~M%kzi_ z6ju*k;lv%A?tw~bE=njeiaor5_*_ zx^iP{#l)z%M4@8sm}*TiXov=Xy;35NJeQ5b^jGe8@ITNUKnp|-E*ec92Nz^o@Cb*h zz;bcd0|ztaD~{IB%iv1=X7|?YC~FsC=i3qPvvB(Ib$Tp?YgfqQy0^Y$1->b4F~;)U^r1S zAsT3jcl14zh8|>zLl7u-$b1?`z<`40eo%2hmE;paOrOv(N$H_H#J`~brWIVMSouS= zAP4xhfd`9U9f%2nHo&%R+qP)I!Xt+cPn|mXhaY~}ux_*0B`sOB z?1!n-rce7}&z@Zn0dVPYIA=_qHi*L&_v&h%+BrcRs$w0q|s zD5B&+DgF8l*s*Kp)TvXaj2pLY!zR(Mq832*9^SoU%ci|P5zlDcym{l2rN8YzxNqtY zQzlNHuy*ZQzuzBfC+E(b{b}Z`3F9V$ClC{!EL9UHO&&LR@LUW`50!n<aQm>^g) zDv<7gl(Wc0pxJ?mnl`=(X1wL#mShhowg-Mo9GD&=<5CagWIgLiEhQ&g3zBawn9+h2 z{>BUkL;#vKFf`!)H2eS)ash1b@aTfDf>AEED~?XF?f|-1!yZvWci?yBq*m(!g0xzvQz)x^= zuo=z>#aZH;6;B)4QBijW_qub1&S>Pq3C%k&MZPHA6%DLbvfbgc)nM9S#*V-s9y$yf z*PC3_qGw>%I~eUL0@ zDM%`64I;d0R(EQIC&lVZjyjiC`Q*%xnSCeITu?@463!1Y6b;knI)efV{e^-ya~#r( z8~forkUXX?@#cLl7e2@wrI|DO0yO~_Zh0*-zmuaq&9QerrAZ?g+aF*q1tnf8KpqkX zhIJS$&DvC=^+4_@nEO~scqyB4qnruZfCG}E6(}3@9IHS10}jD2T!VmP4swd`;w($5 zA4Ko~DjOsa$29Pqyybcv3U;=4tLLx=nUR$sTBNs5=NYL!7vQa}dBD2xlVT7Ks6eRV}*1pZ^>azh{B{ z*sd|@7#zingW^LW{w;v8FfYvj=?^ZLUHGpu!^ci9%o%dOf1t&m6nkb+CHKlMOx?|N z7f9I|qtZKd?Q-l?0SpTv%VeK-?yOnge)aXfy@$~^N(+t~$uA5^3Fx9K736pS>WhsV zH#&Xt@pCq>pTZNNi7KQmrJc0EN)PU*MXUgRU`vIIcBYRcNM9=;$FE6u0PZ0$RER+x zP}zY4hbB#$kTH7rsO%9VMrMwmFm>5)>kl3{cIxEOpJ&e)GbW28Gc$A4s8MUytnvBi zoRG_a5^E+0e%aZhKlq^C*|RxNBTk(--M#aGp{ZH8Hm}9s}`Tl>I3wDFX%!P$Vc=_s}6} zqcSpWg?8knijt8rqFc8fP`bcY3k%Ne+qZAWj$ONU@BQZ6F1>s8&&w@>vJw5RV~6&? z{bs8U?c06+>1Tt}(hnUxuHniBoQ(p&%0ZwU4kL^({w#ng0%3cic?Vo~Fu@{>vqX-l z6pw2bbZmXx4g8Qz08tN%cP7k+c@cmO6Y*{e+$%?NvYz*(mR3?Ci&AeZ{IMx3TEqfH z#4))}0G#m`p+|-*fyTHL821R+IQD>{-~qwg^K=J%-ht{H$k;X(u+vb3fa8Rq831pB z$M`<^Z=$4`B9DDNISuO$t_eKveouGMP^b#Gi4j#AMpbESsaP+jN;7L*BWprq6m+XL zB4_o<&{&AWSIiX(@eOgVK|&KeP%yp$o}|G2yhwL&fdn2hbHfE@ye&!e3OAp3`asa~ z0y8*>s7f&}>EQS1JfANj^U?VpmULfi1~=%8e;cQ~HKkmztdDt8wVn{4XsOx|2yU(S znu-HXrXJyfa~8r>LU&+h>_16&5CrfjP6%XL+(h5mfZ@XJVMXfUwm&V|?$YehKq%>f zh(aqA_>^f}$L)_gC>@$i}%C#6* zn{ed2yjxJ^faW{6Z~MzHzVg(6UO0U494@KTy&Kmr`KoJ|HQTn!3?xpP?u#pJAyH;O zf@b_6i68V}9EsDKHC@u+U!f&)DlT^qhH{lKa}g4OofG6FmjDBha1A{Lsjz^Zn|FHT zYtEFrr6eovZjc(Grr_2FVj2<{v{Z|hA}A>WPDU7P^`{B$6v3BTCU3;Q*`c49Qpj+R z2FN;;B+XDc$Ut#`7;ySqKtb|22hiM&Tt_&TtFmLRUrIijYN~6H7TItX`SE#Y*bxAOK`$pq;=XLaX}@) z%A!kT$@obMP-AqJR&t0*aulgOLqUF!xY>KpD#w3h+oNjC1F{$ z6uZk-ke-~{X2GVN=g~DZo~Rs zy?Qil(ja|s@;h%ffA9UbyY=qg>aDlC^z2jUN3kAtKN<}9XwFJ;%&!)Z=hvh=AYcWD zyb*oMiWRFyW(>>B8kRk7({GW zuWn*uV*N&qn$)XT@AcPT`{<(%IXS4~2(FS)Auw3r!% zIPicUaA@jMjer7OG+b$vz(<1IFYpuifH~~MP=g`!a4xxKfpiC3nPJ1(YDAbG98AFY zf(9i(;2*w^;h0|0EqY17G=_Bt*9u-Uc-}Fu`%1b4kin{gObfRliQ(*eOF~n;nr`X| zRq6s+fGXD`q8IU9F4u7iT84-}4T;eIhlpojbD?rmBAx@6%ZJO^hp7bpg}Q_P-Cl{% zAgN8l55gsm#jVf?KNxJCV{D$I=smwZ9t9F-6cTQBfC3&DPLOCa0yseRffK~SD8o}$ zc06VHN3g&?#vCx}MnMJGENYsGuFN2>2=E97nzG_$x@Yf}wI8&4XGBuwTdmrU&Y0+T z*>-H-)VW{3&3pGLqJ8hSHG}%~?b5ktw=Vr=OrCXk+ul#wezao!R=Z#R^@nL4+kdcU z@AiYIj(`4bulbAD(oANM|3Ku#9te5`&a$orJkzLKf*d6U0t{{OW2SSj|L1p#QY*NJ zly&173baTe2@hrTr&_#eaJ7o5xXpo>WbUEpPZC@M1?SN6wyBL+&N^m*M5@rb;oui+ z-ceB;`9I{UdGq%m7&;-CYO=%i`M3uGq}{``<(|U2qWuodX=QE!7vwu5vHo~y`vY?V z0+zgs-qEA9i*gU#VGoS+V^H*m!UBOaXWwrhG<$jK ztY3B?DfsG>@49{2xlfOtAAHa*C1s@Bt*L%30D^`tfxtOpK;JLhzLz~R^Se&nzWKK6 zk|j%Yf6?MO(_gPqyGxfoAe-&lvva|Md42l!?$r6a&%gdQWAub$M^C99*Scj(dUWsH zvEx@seFuKn_LJoFF?P|IHeo{Z#Cm;u_8*)we9w-p(a%r z2F6Y@b%JVZDdpb-xny`EHCn0=a7RF1;Wh_OE9wqtFA~FLCDk6TB+~5BQo&=gdk_ok zV9bU2q~ZVt@{X!2FF?pyEIBg&9WcY?!6NH}XiVXucThW1U~vvKvziCK;7H|Y3HmyVr# z_Uhel{_N>Pk_WEdxL=f+lAGVHecK&dRrBl+-11H?WyJijPn5=s3J9n=eF!1}0 zo3;$k%%1i0Pt34y-moZnMEZf#XLs+}_UY%JY&mq+#jBhl<7z3)x@!jH__fYE;6rN2 zB3ab7Z{L}nJvwXbh|H|?%u!jHnd37?Oq}!U!XtYOS{-}md=FL{8dl4hK- zVZ+jU_wJ2lZF9|;_(S^8%mSMm?1u~)(xpomVCj%lS(PSCnDG7g--qTMj7%SqmsddR z5tuBCn>TNT#_o1GP8>h#bUIaluB_jOtVKJ7rxnCILnF}`FWKjoJEA6hfp8m8F6QygSM z7mCV$94E*D2uH##vCsxPJg}r;5)D_l=YSwfhY*Na0rNb|lu3TuzhF$O+bm+i1G1+- zV_WcSNEp!ta4T70m@*7aRQg82UoMVha8?~67z)@RKZgrExwP(pdcfd&m%{()c?Xy~ zUbmDr>Pq_^1c?*}T=Ye{;AxQfyL@tiIlrKoxUh$G{wx2N2&dKu^(;Z+qA!t|$w>b< z^XHoBFWm3oe|JVBF*snLAnpPM1qotnaHS!#7thI4#(E0>C4)5LjQ~=eL3uAI_0a?b z6#UFbZd4*j_6nlCE(>Hbb{xeYKD!%ab7BF&L5Yd;h)|5K4)8K`IjHGX6_7FZZdw1{ zyPy9uXSwDp95t*D3}NRiSlE4F%Dw}8kFJ~l+9UC;-);A4*MXmY_3am*wBNRN*{rFP zKK}Td_3L*h_ZiUr>yFc={E$32vup1Rx56aoT3CQS6hk1ysjhyMX{LndB&HPas25|J z$XrLHRY{KYNBt?KT&aS8xF8J{)KmfI9i&8xX%W7`5mKso$bvp3N=deg0|kAsU{5J? zZ17`jTRM}@LH~yd$IU09)JU%ZB}Ng13#a0nzX!!(@lrGk600(n5`E#vYIV$zlAU?a zNzU7#hR_BFq=9l3>kjaMP{`$+L zZ##Ltdt7Oa0095=Nkl^g9UDMcA+JwNT#>qx#A zBooPF0|6$vf709;Gr#EY$?ij^6rHK|ob&-8E)6O4vf-&&ZJNF1@+(Ddch64WG2o!AGtFL6EQm5(RwhO&c4%mrhcYxeXmQjYY5xdRBA|B9 zZB?DIvc0_INQBo}pum7pl!22Ykb?RrN@Aov*tJoa!w!LHz;}Fr=NY5F(k8Z*ItMB@7c9)@08gKa|`{a zcO4kkv-fu$zZpDaSjMQ#JqHfXm_29Ns+GE0v~SP)8NbdwnOC@b&$jdtLk^uP@?oh! zlUchkw_#K) z`NeJ9w&diUQ#2K#vSH)q#lJ0CzI^$fJ-g24oY}kQpvNoW#uK`9?ri?zMa!2hTef`J zZ$-Iz@X=kncIdLi{9@j*QwR4SktLk7vw#2oZ9BHZxS4;4 zJa+8Z?%lhwEkL6V=nk8G&6;(;{kCl7%9Tr&EIN7Wj3`Us`M$lo7cE+{Y}tw>OO}8S zC@*N(U<_UMdAz?ZUb15O(xtyG-m_<)&nH6Lg3L5i8wBQU7-59*=Ro`%xFXHQ^7;34 z>zW)}YD`r0Bx}StYt-P16}T+* zsXIU`?x6|N9pI=B*aBXBcubf&S#mti*DT0I51DHg44a|)ndB(UIeGZ>xgr_Yw!sU0 zN0=ax5y4&1qL|O{VH>gcugvQ0TVx@p7_g-L6kBIo|C5hYrA0x~YK3St!w?cC7d351hVY&kS3Ejbs zG4CM6-M|2{F7j@Ei)vlC5c@*0EZ}EsyXN{p%&#UpODkT~3y{1Q0Wu7qDNVDc`MPU- z1Vj@MV*Eun%k~<~n1Rxx;U;+!71R&}bQ};QGHi@UF_-;aQ0IXx1YeU~yEm+A^X7-M z=dE;r4piLffS=B2(Nd#;d?^uUQY+;A`WbWVV5$o`C+cO*!ZEua zA}~Ry6ayZI(9QKji7djfierLAfY<_b5K#k8rf>D+cXbuqCpvLYP3DX)sXKrw#Md%_ zL3KsQ?g-goRx`IUc~E%7%h{wn{OOeK`l#zT4#0Uw-*z z{k8+|e)Pqx*>eJtGw;-)S~U}=|2PNabHCqG6EjT|whZtbSI4wtCQzy37sqqkdaT)RrvjkVhkY}#}5)VaLm(8+=go7Vfhj%}MZw|%eO{H3c!keOA|9T@Nu?(6_91%6nSP+mR7*iW+i zea&&NYQqfOtHk)KHiz!59@& zfbZj=lUf9{G6i=}2;k=|o;uTi{4oW5WxO7u4YDBo_6;|b4-g;>*XRj~uK}uE@B}W% z4{#(0B?FdFnTdBH{Q-av*P=V%SK^o$Q@&(I^ZI@B7R(nQ3W5GBQSu9+fdB z8&w8_1`V1ybLP2o=P>e+gEU3|GJy0#zL~8Reh?h8RLBXG-qC=W3{KDh8G;oO9P)g? zY{9p1AO{Ajq#%}Kj-fqfD-;XHoO%;;NF5v!!ykD9|KvX)=qJ5~9GFrK!Ga5j2Nf9r zk`J#_2~qUO9%G9U1;Y0+qxc}6r-rb9N^GS#A7S7v%3V(w^^Q4`*F9tSV zZsLs>LPB0-NKD1omj|;p-`Qyfp8k#Z5 z?nk}6p?a}zk^RJvID04wGav{g_{h{9_=+A=off`VBG(-Rv_i$_IKFeu#H^uxhmP8x z=YG@J-DES0aR-mYAwwPFSE<(82$~YfyDkGRJTUL-5LN z(9M zk?hBb(F6oOn;K<8ccfHQ(OuM#u`zg7KMW0Vo*K?N10D_odf*2%jHd`7T@L0`iXn_H zH7(#*4Uew-3`O?2RYk4>~*L|*1YjzN+B zq z$i4zu79|)bNID2(TEHu-POsMsRZNwk=TTtfp-bNHzy5Yu?*WdS{KCRQmncfOEWoR} z9HLtSX&oA)ri&0~(OZ~v_MF4+1$hJ$CQ72SAn)AKW5@QbS+%}r&jB;%|K^7VqiE2f zK@bqNfFaAWtDqq7*s0Tbe$k7iCi-jzx##kn4zHq#jH!N??cAx;1val&Vv?rg7hSB@ z7^rH9B;i9<4B%#^tdOzAlBbpAsHPR&tlLm=pt*6ug5imjZG!A9=Q>xZ``5zK`GV}Z zTd_mN3aZ^A6^oHc(WtuAxiXFq58KE1)f0 zpK^ZAO33hYHTr`>^5_vvUubOH{7^YbqQr~r^0NHXRW zribSW=?*aW;D(wQWd{UFvx~tD#Y1+%KgcTJnDhu<;_qO*F$^%^P#C;|Thk{D8bX4g zNZn^z@kc^HEMWV96NVhb>;m$A$#1=G`lSiT=wjiI$`WDI*bc| zFJlWWZlpn&mK?!H$he@3Wb&TeQP232$|^~>IMS*V&3KdL|H1+X&mQ0T`THG@>^Q?@ zaoyULUwzmATp>>D!_Q;7-%v#0P{ikmjhLaqW90wnd5}#781(9=m^#6o_o!mW^T_@A z_sgz+IPZWt7>o^k=TtNhay?t1+GTON6}>_a1-YjC7_ zi_NVXF|Q9qf-Rf2j_UNy>UUdgYf*2>J8!b0LI#2keu+Ub9dRYr@pl9HT)@NF5n0Oi zJ6@9PH}l={Rl8ugEPP*gnk*f`i1@T~-ECEDf?)%JFj}(T3NNA<5IDe?-Owfc_RGbF zVlH`JSAl>hCh&4n0RM` zCLTCF#JJ!;H-%zliaq2WKYN;TrtD?D1In_l`RV_1CEwytjr69)deWk$WI;)y^AvC^ zM2k2y8s{B=WlE%)92H28)&>dUAi*`b%(1iw*^VJhIRlBhWIS(JP@Tb#ha3=dlz#%J zm^{v#-^A~zAklOK+BL)6FC#>J<$~-KBz$Ux`lCBypw@Yu_xgQrF=Hvy3$gR&VoU&P zf~@M$d}u!;+^SH;)A&>k1abO^N?S4Eu4!b1UqI9i|AGB`PaHXlo{&G9VpbayxT0HE zKz7%0pG(?16aHkc*SmZ7?q7fXb@uGp>o;t&J6y7&(a;2ALPexQ5U8P`UEgrGL?p5Y zhkUH0VGJQ6kSiDp#ue=Gzz5t+F`#GxNi}?i0mGN$Oq=9)wDRQNp*XN9>5eGHX@T66 zX=4%Qh|~-DYRsD#{36VpBKQmM(CpF7A0^wPWJd*$tq}{XHViMXo>vd7;QX(onFucC z2&qKJAXxz}r#C62NT$=6wm95Wtdr3L}g#!nke#HUk4XH6X#CSh&3FcU^A1 zt#53(v@*A(#@^bkLPb_|G9c%l*uQOfO8=olQpS!S_kEwFqleF_3NBkfovz9LF9&!G zEFYbMXstkh<2!kJbYlLX_?)Ep{R1C7IrCFiu$GBAOmt5gGp2vCo>(_VCqJ>LE zKQ1+cAh0u5OdBTS4ap4`@sT;Mi#l0bTOu>~56M1r2cW{k>{4jfWC`IP+6=tFCU^~cE zjhpUz`@@Z`-d)%Ht*vji-TLMSn_9fL>CG^O=?0~Zt%2SJ!`7DX18sWq{f%$J6>i_# z+46&}%|F=C;=^^VKV0{A+x2bU-qx)7{zi?@Hfg!J#oNr`1&*<0+t&0>U$1_r)vlHe zSGIYR6@+vL#4?DhoX2neci=-(l)(%b*X{|(Jzzku6x{*>9twW6MIw^Rg3HwT=52ib zIiHE(wJI(_a#=+8t&;2ChV&&f)-v4@z{CH6Uqd>9C!oB|hq>?z5dj^T#?S+ue@rs9 z0B8!D0U-Br1Gf)>Tb6|RfPlRGyj}$Yh3IiIxfT)F^LZKARr0tITO)fs(h^@$R6ic% z*J!ds&Z0kIXO~HwfIvbJ*jknLaNo9TFR3WqYN#Dih~qE8zN{!V0yOJQyOK@&F!avZ~0627Y3`DNws? zEU-oMCHtVc*>A$kp{)&YMvv2~+VO}J=7|P_Vz)rM^Vy~?VO%c&n}I$?!<7p-5ONl= zf;`;g;LKT;lgIM&nJVF`1Wi@^o+4YG%j1?M12;S1+Zy6FCBFmcYVi;H3B&M1zsyAD zIn2a^%yW>5$C&>lU(}|^B6J~spT}l%;35j>=gEIygh0@9kY^WyM;~Q=(jCApbx&%* zC}M%#jBR9rjm+4?0tL`F837qr{~2yY^?1B8vRLjbzKgm8x}z>Bc*CD_AWtUFjSj-P zgR20@MYzJ5&xFIFmCMU~YOhuwJXNmR<7MuB@}_(LQ}*8f-u&RxW$u4E_JL>0JoI## z2me#{{{Mup;p+`~ee$OJ{!{k8r^_IL0dA=d-}h9h>d(YJ_)M8co+UWo3e7eL*#;E{b|5+&&LxO0LGeV&Zma0DNY1JO&nHZp z&Wt05;l&elXc)|O0VPJdzpiTvz zk`ss)8R0pJ_nId8nCxKk5#N?!$A&#-Prg}7vKq;PJP`LXP}8i^V5>LH;v8IR)5pTE zjfJy41$jt}H%U;_EXt5bX>gP?*;0^P?(E8(OCkjVT%kkL@kl5xu5*TrllxFS zr{NrQ6{aNzaCKzh`1$@aDB&J1G&z7~_EB%a$7%|#N5HNC{(?R$3Oq4!1-2RVoBu)V zFoN(Vw+H`-aQZ?pG+K=XmJl2VcZwIVA~$qPHpRd=gmnkk1~XexAb@c;o@~Kb%a40U zC)5(+>RPHb5^(4L7D9YeTsNLjUr3-$6XP3&ui@(rca3ip5!VEWY#Kn-MZzsP;8Ej< z%FQg5nhN(cj*4#)5!WobdYhPPbvGZ)0Ujr!{#4z(e$AL~zFyI)#m+aI2lqQ5-2t&Y z;85C?naAG?U~@D_0AypYfyedl(B?!KE`4WK(c|bA2B%wWCUm2G^GsJ))H$D zG3@J(;)39D3xVIF4aP@S6ml9JgViKOks3cpYv

K#Wy&@ zng5e!{3ld#oGbrj-C169#DXNu=Nj;hGf*~mL>aC~&0#Sdf^MgoEFd<6 z2<@Vs0zG9swp%>*XBqB*umR_{2XG|O2{ zC~!G|OYSUW4&7b=?kA*^>MBKqz|H5`phq}XplIt%cjG~ff%%%RgTLqrf8kw9QM6i! zIs)8Y#3kUt3Xnw}L3QDR1>J3BE{j%(XI>h1)Fb$cqW#WUiAH$q zk^nav9r;WWJKTYDB=Dd5Ba$n*9eG~NIZHCkD=|;*C%#C3NHlohkATcq@rK-hZ+IJ= zHcJkQ-N3uS*UtyW!Hiy5cW^bJj53L2BU!`4-`@P<`{-(KSgO_+s^aGV=GKNFgW)aT zwVrQ57rutCH`29oV{1I$T9Rrhom&wk(tK5}FC^59h_7!=Xjt~XmSw9ZZaq}s(@=8& z1My9pHjM1})vDGlcDHP{?Cm$1Eg$zv#MVLV75^^5bp9s*9)}_Uv{+!=xpoSNaErPS*MvXLH0Yl0;1P5ZCXu7-2p+!qhb9PA)^VdW3>z&FkTtkK9hE}f zGwjT7+QJU`!|t;smGdP>i30^K)heY%ifNJlREs}N@TVZjDHdG6kS2JB-@L6;xpB3G z6TM@-gKtt(O1qNoJUikgV@n3}<2-ZhNKj|OiF)75fQxPB4FP*6Ldjch{-1z{4t*|& znN*9;>Ed`_!JA@173M6Xg8+>=>TrfJ-7#H2^_CF+m%nluM0Q?QBAyaO{g+*aHH zp-5mZD>O6>4KcF)PM7T|N$h-J-_+s5laCxdpzA75oM{Rvee^A^eq7hhnj zSNuK@ZXxPAJON8hCJUcJnap(ua22c?-V_#$G%*=FR^U5R<=T-a!~)gb~IK2V})W#EnbH&)5&*c!ocO zAK0NO1n!>GB|yHSC#D0sHwkSZ6b=j#?96~n_w>r|gS+Ho%ixQlP_WN|ZpHK$FWep- z2UYW?4FLTi;{KcmWa(ku!8L)aYA|!*pH5bi0_>g7`@~dv-8?lAzu7j6h-+qk%T2h{ z_ulX|e7zB_eBJ@xLPf0~5swsAsR58R4sEbXSFSBoNwidLSo*iqR@t8Uo z?Sr6V@K3?SwULN>0R26{qChSWf`^JT3UnY9Ctqj)AoYH4 z%1uhLMN0*;ipkMZN{pCl;YTpaDHbK!3IqnYRfbvIDS|t>oFnD#te1ps-`-L*?8$;j zZ?a>HnPxXszp6rBqf!8}0mL;kR+j=e34QhDSFj9yMd$1A!2tFl%l`$S1aWdZ-**td z9BUq?tY_ZO{rUIn&YPg}K*i8J78OKdpE-L4gyi62CR85GJSZ z7TCquG|Bz8Xn#a1ycst#a7Qzzl@yrBQe*4W<$%9ggY%XXJ2lnqC z)UVHn@4frQ7hfGYc@`3Y+YivhgizhP8er3+KMuGJnxKd-p*zr}p}60QZigVC3Q3x( zY1kB1SwVFM_=acm8MtQz@>%qWr$Q!RqotzL3O&UJZBeFDsEFJqFunOxAt`0mOL%9hh1XvrQBs8#8g*sdpsanHQ54A2`EphwN zd|)%2C2ZKTbwsCcR=4?o?7atI9mjPpOiEO{!HnIM_Qo zZD(g^&YW|0X7-W3$L_2D+9Pz{0oo2shH@UO`LzLb+(@yoq_`2BhmbS6_`{IX46pzpCy_X9CK5LH1q1yBDP&A*mzgLkv!zD4l-R><|Yg6CNxCKJ+v z>Yw3Xe6J60k$`?E&Fsil3+Y-O% ziu<^K+d7<35O*^WwH=ry1N{DCoVjd4iCZV*M;UJp#;ytPSR2C6G_DQq`mOnxzu158 zZ8bZ-PP`*T^@GZTALqjjh_TLL)LI@XF9ME2)MS7P^ZE0}!40|-^JJkc$$tw#wWAY8 z6uN^k{iGt?9q|!kPz@aLJO4B2{yoWehvvUo^Q{x?peM7956mV+=O9FuHbfgzq>X8T zTLkY%gYLf&yk9q@L_*FIVkNpCv{2kU(cB6_rR^4L@^Y1VjbJU3(Zzs=1{b6kqc;mp z2up$+0fy+D{0X8p8bWN?zuxcsxa_$DcXsgNCm7Kp;9d*2sr%4;0QV>dZdLevBajU`6$yI{H8?`4f!HlzWCiUSP%t>cDeVVlH(?k2 zl>x5EZ3i4295)((OW|vI9C*M9oEJq6^h8J0ZDOU{#Fa-<>Tjk(_i~;r1n>H9zS7f=1>r|;<-v0(G3E&oi%x&1G`c=E|ddLO;F{%emC zw`n_|T!-?SUso`$O*=BaLDe-YA^k);EO_q;IR04leFXFz-Ge(FC;=o;ehBWIkDKR% z=7Sm_{h%XgMEH`~2cGMQ_g3P$U2}g#bbcb}_@eCpDbX?sX(wb3R0Y$l%Xlf}$aMZ2 zGFL_vl&f4Gk!a`R(!MM!P>?`%S3u)bRGfW|V}z^_DNJMs@%53uqt5&%ExZ51zV)M? zm^H!ONdBE`g18&vEn#Xnkaw<;sL23n$4wGlun>e}>`kG#o0Pq`i@R=>c71d)=Hrto zUkUc-mglErX5}bCnCOzMgcMa^Wno(P6>c!16e$o>6vGP(b3Hv>=DL~qZqfW}g09;G&i|=|zE0F5L_0yqI5BLvoB==U zh()2T7wR)w3+#zswtC+SmrBlZ#>`DnI~X+PMf$OTN-4C>?|Lxc_%qS-8`%DFRX;B5 zr_&17Fr$fi*Kqr^5}2U`_c(9^-9*sPutxCQ7IuHqzx3~t_ZQd`^$?xVfx0xien<$n zwzgJOR5V->jg5_PtgEYQX=$0Aou#TZ{bsc;i6L)sZtkH2@m8lt(&!dgLh#gy<6F0G zAD*6LHVIVMsWy&}^_oDVv!XK4EF!i8=ie)IN0p%CuM}Yi(YrJq8nt`>{)0KW`Ju3= zL8F&LsuG@`pM~4(?;n%|5qi+X$S^n{!jjeH^M`}M;L_5P*B5~DLqA})1M_;nLcpDI z+W`j$$BhUa1nDTxhFSQh)&%rdnd%3G5m&N%6D%5|ixH8Ffnaot%0e_BI7B2;Q!I?c z#3)w_Gk^Gp0WBhM(!3(s(o9*-^e2)%xT!1=DFgbLX`?>oDFd=}({=z!6>dAYR$$%8 zggo_wt?NFse(h%;So5jPYjMN52XM#4Pv4Kq*afN@Cr%#K~hZ4M*9!hPZAa{##Yw zM?;Q3^gI7i@_pA34ie)Ge&wFH=-XOg>$si`2r84!hjyg|@8{X|(Lmg7>(w%NqHEW7{09s4_>*juESHAt~HhhuLN zcdWy$4R);oLc_t1HA>t%HFlj8a}&miTO;pYqwYd~8D}5dBJcdDb=&Vv?)xWK!|Nn4 zW+-A z{SjR15?HITsVj8Nzu~!sc-JwFdL_|S4A`9T%Z09pr}q}g^SgrQuY9&IivebhYQvof ziAyIworJL%SOu(BQ6gc@ffDnK2mz5ZR&sWN-n2@#DGnjHyA-zq#ih6whvK0S zq;S&jzd7g3O>Xk!$)3Gt%`0ox(0I|!)f&cXqEZ-RKh4wcG0O7VD4`W2pKA9L<4WdK znAeV@yM3u8o8|Ow_QpP2cW*T|B9{U>{rMdk8=DHb zBduIgBgXB5R^D^$q3_qpM1cun@@r{=2-?Y9{N{n@#U^3lXD!CD7#BtHnaMhedIl=B zcEb&d^0lqN>+i`Uo#*vErbfp4S|Kibh!!fUEDjY4Dx<^QSi0UD#qb4q9De(cbA=Y1 zAg_+|@TjOL>qP{kKpThNlJoF!BEDOmoi;=_ksTkp`A;q){cb8!84Md|d6n9_o`a4E zM%q_oq3aeAYm7qf$i8uo3aaoC&?OcX1OV+%`6xD$y)U9I@|yFla>mZ20-4U{_y7srZ>vg^r;{Uw9yirY}Q`!Yf0AnY;;H;$ z_Yz-0Kr2cUE_hT$clI?`qd-|z{M1K8R(Otl9g|FjbDO?mtxRiON-|9*5n}Tf9ip^-()Y4bMTKnK~r<90L_Oc$)DnCD|kL3+%B&j zyU%f_--b{(>SEoNBB4tZEzV`e3zvbjc0=r_9W!7d4JovmG$WfUpL*Ui0o?o1xFa0? zBMY?TKao!WWx)vI)>({`-oFdc>?bh_i-=WkcqHyoOA?c=*0DNeF_G8May#H<2i{PR z`CMa*RshWgt(j~JQa$s1aOZ1CK57S)?>w~aJPWK|dv5x&4UphF$GtKR^{GR0gQ%p- z!*BL7)x-kmJctaTaAs?WxOu5I6rpyJ>WgWj&K{Y7?Mq})81@TIk8X+=Pws&`o$t>V zt<>+n$!=00KM>1A@ymlO>Yg#&Dm6aY7R?FnAUbimnMqMG3L54)L|2Ee-ho<3%_b4D z2kVO@j|k%rsh#32pG;ac7viRB?Yc---}l&GJoA(Mx2~QTIrbp$XNRcb)@UCN z+fa*ejQ_R~z-Se6laH|OE?PT@OBZN>NkXuw z1ZH{)Nr~w$#0_qbm0G`^*BF=Es?T|=%fh{h_D4+fYjAtGHhpnaPm)d4BG6Rtq@F*||s&@_UK5z26q`?ki7vhsz*|Y3d9*Nv|4Dk5OrfK#7&dCSNho z(=poi>2A9=w6@lfF%!!*3FSULJx!(%VVt1dk6K{RoFJ6KX`hb&fF7(I2V=m|@h2he@s&`%QRakyD=}*5J>vVj-ub8IvZtur{f7 zMEaIh1rcNshArRDC&uqRZ|t=LB=Edm>UN-c$APJFMzRzGa_AifG;1O&H#nOuwplq6 z^Mszr=ep(iKSXR1b7XM`i@l-(ukiy3u?~*uTOd{M5jl#`RQC; zM`$n-zzYZS?6OU!mI@{ifAfFHjK_aZbR)5A_wYWET1H=^BuV+ z{I*;5?K*xeZumVjnEd*7zng9U1N&Ks{FOM$OM_;do|CYVI^9wsulirxpo>co) z>nzPJ@Jls<;&(KKb4CZh@)@b?C}~DEipL0i4(9&30EvjZjrp&tmdsNh=&}zHH}LT-#Mq!hNF5Zq9|2F zA9mLz!QU|Ur!a%N5Zyo9RRPPaZpPjH!n;z^#VDq0?egGenigu;5lydSjGvPOb|hm1 zt-y#agxrFm3k;dLQUB`G7qx+FruRn@m0Rxk@GZwAd=c*<{m9RnMXYnO9PE`eRU^%h zr8Y~?wuL;-5=7yxtkiZCmg1ARtwdY`aGCE+X;bbIy5JD9(D2^i+51}dh2vw9h9A<# zd&>(o|OP=*kKa4hqM26+c?f*Z}o$>;Ncsgi+9{8=Lo0CCRfd zWNW^k8z79HM`|EQb19$yKc=vqWW}y<-U^v~bt*}{ z!Zy@#)+yy)JVQ5J1Z47C`l>t~{v^93(k~>rw4|>FQ3n&X9dw;Ad*MSfYaQ)-GTMkp zROLoe+7YC=M1~oS5XdXLp}3o1XriF|$0dYQ0jComcl9YO9Eu}qxL;r4LGDjeApk9{ z@uDo%M(#KsoxYb6!AKE^oGn*`4(!Z#4kUD@wde(WJT z95MmE)T3?P5vEX^*CkoBH!YFLEYJikB6k)VeKX9i8O-E|IKxkjOrCjlR4HZ-JfKZ& zkM%BnY1kJ|)9WNaoKj|=PN0-BNkqVkD}Z;v=aF%wvvQ-zA!*}vx&oa~)sWC9J+Z-y zQoyh-Y#6pmew}s&Tp|hvdauKmlcl=d{>A>P68A{?88Wv`u#hQ}?Sb915y9L4iB9`U zseaF0x-LbfV0)>Xs^~Y72cys?6?WgUqD7^O@vRfe%!{&wF;JJ~YDPIveUzxIZ)?a`En4cQw-A0-5GSXy)1Amy;* zP#0cleAoT?!ZR+2#1fAMM$Z!Qu?(f({eeRj5DZ7{I!=yXUuNYNh;6Sy8{OnQe=5$- z(s*kpCKr>a=#a)td!a@3*O*fOjRT}gwcH(~AH^>p1qOL$z46gnDebSyPfsp1>%YCi znTdF))#Z1LQDpyKk8)<5HX)^l>JurUyAIv;`IT)q4Agx~&1N9E5;VYuBhCtjr7@|biW()UV4QU)=B2&E+FDo{x}j5x4w z++y6+VYhhDr;ZriW&a38h_zg4yCj*=xZVntLveTz;T&TmWtH8Q<4@smg|C=TIK!h@ zrk+fQF48{YD*Naj$+@{T4zH6$)nm8N1H^>U{{%hq>NjKa-_CbJ;E+lGF(kzKPo3Kl zXyc29Xj5J}UJ?u1s7VW$cn*l?sPc33| zDFT)wPrtW_mo0Nk+otqjmGR=Lf-i$$x2D^(fs|1yvq;g(ef9!1C&lg7u>F29;dw?% zvWJpOZ8m;AdFJ6~2C2at(1Lp4P&bq(jbULDt?VFZ$k@Vi){lmL?VA%Qw6mWGyX8aDQPnc8ZSDD6;CBNp5H?Y z4d&))+)%Y+9C_FWO2@JuD&!I)e(E1fdQlnqFcoE%V+I8~?{z5mjc80@2p7xp;hqA0 z6gCzj1ToLQaGnutrhGhqW$uzF?Fch~gu&Xl5v=;)=K!4F>AEWr=C|g>3GH}A`vKNk zRNGH1?LJoEv%K4=JgSoJ~r>n zhbdi9;V}U2O=pY#DjK3m3NpzRud9%DxYJeqsK8Wk!ejmOJkDoNZd#QdHf8xvPFd43 z;I?LR63`g@whVwU4bq^ou)QZf5&Yt?Mp%$WCD`CnEW~?hAq>)kEqee=dHTl~+(ZJX zB!$vpo62Um&(In+u}ZNrJK?C5GdwslK(?&>`%=ZA!uHc#{2-9TjI}~C2A4Lb@Io#u zfjM6J%0z0p4~3!-Z?lgs$j$zgq$*hVNt&mX9iqpP*nhWTpF`ZtFPU0-riF!thj-7> zNp@6$zkNAYev!4_&e&l6sfEITY7AP7?%;&C+U(iIlwG-J<^o%=%*0qqud4viliZmz*+M94?c zVo?Uq3LVc9+s%kJ7O#Gfq)WW6jb~3zado7Vqvs!a6`B(Et za-$ZBbrR{DeMN!pb0N+}ShMGNCnbanBLrH9EOKPTvX-usxA9Pg1*`SM5s5;>=8_iJ zMdR@Yhn=Df@Hx(w9FGCliAlr*-m#}IuB#8D5#RgJMK1Ls-N}@NHbHacWC)zkQlHUW z0j#>Q2_~UUm*TTT5Mg+LPNCyO#Az{TbJ|74uJt7le*BFqBBMUR=Z{tsCFG2|I1<3Y zxEqqkO|7_?4V2Hb6-VWR)v_CyY)v3RiQ7z6hZ7i19vB#Cbc$flU&r18XtKkU5Ex%H zi#_i@p>9h0oT@eVM2Ozp=L3gf$~{W_TC^7xj5&@Yf`!LZ^O<%vfbF?124Jh5bWL(P0 z#jxg!(N!Qc1L=r#>Z1t_@kNS5!M1kyE8W>+%giH=)Ot_n<*2N%atkGe!95ZxnvNPY z@@~)=mo6EH0d!(M?+3(0L5zSCM3U-1d3TjWCrR=drdLJn4PlNio^Zi|BE=j0!DAt- zMr^JC;qjzP*zK0<@c*zMZu~m-^w3RE->p%g4C)`w==^%=?^)9ks*#_x51CQ1^h7>{9=z%y<_WU zPEx=q=eT=;!E*O}v5t{uf3-MuK1(XoFIMg&YWUX6EFx~Wel_1e;rMUUpLddEat!b8 zBX~rWH$C}z9-T*YtOqyx2Uts-Zd?a>dxnYn@3^0T!}(~k#kinH&!_Ygm?jI8yP|@M zs&Azp7G#YuNL|Fj_CGn4yi47(4&DjC*@3J6T~!sI!|8|;S}M%|jYpAb2G-_RtOh~} z=l(kMKNixgZ^z$B7?_43D0f{vF{k1}<9-dDhO0od=DZuqoW;=SVuUA;?Aq6 z$pp4T;^zQWBD|x9bLE;%J%0O{(J=Sd)Zq|%D)rkoif}sN%W!yU*LS%etsEVHjKkK{ z!1eo>&E%x*7VP53#36XC|1@}ye>m$4OoJTg#u!1>Ixo6ZU!{l)E%^;gMtE*$HNQm#gC`>)9l5K2kzDUZ?gRC&Hhm8}9MJuPMkgmx@~{iZ8hb zJI0F|OtC>8CPAy-Y=WBg#qLq@PjvH@CWqL&=JC>)>$#S-crrwcvl$qQT}wZ@jz@9* zHYvBfW5bSWr&oNZ&H7qfAooZ9&p&RHXE-Tea4a4K{!CL0Z%LYN${N!K8h%C6()N&f z7d0lVPHWEyPbiS8OF-LC@r%tf&zQ0@X6y#Oio(m3q-LBG-f6Ua3f1^a(cC5fR z%gZ0V+u8_Jggx!j#o*soso>wZw06k1QVWEf@*O1BDDF|ZO_u`nGndNAuQY4ooU7st zLN9}Tx6APBeKGm>30p^BER$&L$=1-UFz0GzqB?10zQK1^o#e=(^|8d|8qEG+b&--r z+5vO?zVRKr{*B|%LbQUt;uDnt7goRg`#NApkpm58XOfdsxdrs}uOs%qo+yS}!;|86 zobRj+xB~LrG&|MTBNSWn$;SLVXfUEVQxe`)`Fex_rQPu*nntYVl}yWQ;n4)t;H<8% zn?J^6rYcDrqy1nqCQl1f9WMW}GtzJ*5t$r@DfnVA`;aMhbR>N-gI=KFTp+P%N@ZYH zNPXAmmH#~4|Ki&w*0-1ZU^bJy?LYcALgX$?(CT&e4MgHhGmB>hWJ1C)FI5heQvO`9F<6!3duF2U@F{VSvs6-y_o{*djHGPj?Ca7d+k@d&*> zT>#;2K`(E`+odc0uleK#aMi8VDAoE)U_)1Hjwp-*vLGK-3V?qq5Q7FWI*+j=$DuN& z!R$ty%18XLeH-5^M9br^#K1#+B&2XC`4xxR=JhD`?`yQnE4|?>jmxWoeB@ps*VwiD zR_P4j?0%y667QM=Jd96Qn2Pe;fJ*Y+T_!cvQIto8Hd}y@g@b{a>*6GQi&;-o1Ko)> z0xG%TcU7eD({IP?n`F+df}gOZJ|bK|Anld5X5;_TqRc0_RQkCY7tepP&l)y8qAQ?1 z_^yDz@LSkPaVoPQJA6znz-D-7mwv@ zgT)U|QBVS_X7`#ToOC)^CAob_{HcD*L_<*!2)r(GK@Dz9_hA2P||Ln$4 zv^k9nXX)$L;_L(a_Aq$Q;5gh?3OG^9l(3KI{RD4Wx?wJ!@@s}XQVX}ozY!d;a}7m^ zNTpZOjr@LZ11p*X1lJGWBPFQ0Y)Sp}YdF-&o%6eLtO|#T%;h*NwJj8yqd_wwP_B^T z>#D|J3`RPeb~#_s5sGXHa;?g;7Xo(5fIXr7#N^L2ED>Z()SCJEws6Lo%6xJF9-BvQ zfK~Wm$~bxcRIfiTeU4idj~lkG@kJp?I!rXspF%05_L9RY)gB%+&#hr-dzW&VhxK+Rnbe z+o6b)`l@6qW=|%0Vih|}i<%fSX6U^XP*w{G7e9FiCHzR4O9LA=l5sEw-|rkZfte@$ z;1qm3)(2V<_unq~dHgG5UUcpx1|SI9(OC_=&wQ_&~BDqlcKqdc>h z1C9a!kHld9;DTQ$kwAx)_ZkVfkdkoj+_@VYqJ-#_jLfNNZt8_!_q4pTKZD7<74@ z#cQS5fE8vKd^@KGBb$)`2l&uUImN3nse>!2Xz&lw7*h)Bu8NtiFf2Jy!Gx32ni9if z6PfaUls%XM;k5Ccj0+<1?>Z~p~ z)jK$UErRa{UPAe>6R>2h6b+kL(PIEol2jryYEQ5K){X-_J4Lo=E5*)3sVjh5c6KFm zz^Ro&6AhD9y{OAl;^nNXJciMd+?K87|N#7e%!a)ID=>ipelI4I)8WwPPzcj;_j4N^vp3)Kh2}p5c6kgO(yj}&tQBK z-ev-S2NCW5Q*=6LXPqq9uzkSFJx19?HAY+pvgVZ4(|(rvBk1c9mZ=K8kfqwf)rNV$ zhPwqEuYXHfEW`?*d@ink5>WW^?`6P7ja@LX4Y9wJ@9sbg(Wd733o~gfvfRiQ+t>R< z2X67yjelCZn+Gi1`G;zf#)whqObnTD#2}9xg}t$%plfl{=Bpo1bAE8xFvZ~Z7rotE zN#kF=2RaroZt-u`EGFH%i%3@DGxb(!S&4UG5}-z;Gm**YW73%p9l@Rg>W*SP8?fIN zRUK_ak_NBF@3A!ywH=J*3h>`;x`Ma>{N0jSt@8v!#^Ok^iMb&IdMntn&zj`_`}Z55 zj=**J&1Q%f1Y30?QfZRYa)&dY`Lp&qJY!jI$ow%79)*gU^ncq&A7YZ!9hz$imRFpP%Rq1oB?P_ltWu+KppcS-l4EyaS62@8=AI;UN34`D>tFbFJU_XvEwv z`kJ~!y2Q?9+$+I{4~z`x`;nHawgRAgU9NZv^63b*(wfOfk^>A$BH~c)* zxY!UwD-vNDua+`Uq789}hq@)Arc9elDCNQQOunE++SJ-jur8^8*SbmZIl~fd8{f_a z{p))^4UYydb3C>v*njUZ(zm-{>$l>`YJ3Yp^Z6P@61AH?2aB~(F?fo1$=_hclD@1f}qf* zb?vXXy}tg5K!Nd8$^oD;%w6G{R>=B zIA&_HBWyZa|F7xjq+EwTXAF>!&?ZB*M)!K7lupih1gnDRKkyi2L5lo>c0-c;jTAn} zA{t2u1XO~bqZWr|HP)fe)#$&OVmBGa0@KGOHI1ZaZURU|ye?VvsLm%n!pmgJV% zXj!8BV#NIqN}Tcc)BB_zYHf&i;*uADGu_X8Lew!Ega_Zb*SGVDDN=`bdjDQ4B-;fb z(*7hI)*>wG?cA*uuqe#R%E`-#UvFe%dn-X*h2UW^{w`ty%rCzfSB8CmM;R~i)1#)b zx$C#8{qJwy`Cwp9PF7OlrWl_nd42E1#kbQ9%>%Ef2#GO%(9~h+?%LA z&~X%IxgyQ$@a$}wOssd4mx%D1-612A=S@)q%AeDMPgA^N(oM zPDWv|fz-)&6Vm4t-evkIz$0qL=ZIibV~M!%v+*NDD^^(S*(R3x{B>3U=4%#Z^Ez_87-8&g$1QmBcr|;v(uM1ZkF5 z?1t*%pP0+qMVcPya)i&6K-Z#Y8su6$Vl<24#zYyP4z;|giNot%vkKzrt?>7zyt^NE zXxRayVN{yZk(6=4=z(ktIap}IE}GgLQoH)`N!>VzeEWti3sH}?tdks7D7UVvaYAqa zIBZ&OYX-Y%D;+!3@Zj0P4?IJ(D6IW0SvU=pP-Kvyf@`aX>~{n1=0RxMMje@fyGZy1 z4V6qS)deweS52&|8o!*x-#HbN_F;;R)<07QVUH_1+o7%#1!e&3;fv(;p0Mqrs3)B7 z--C}TnZlkwXSTum(u9R=wD&?j6@S#z{H&>!KucpHhtcFR1}iX6SP|GhCcS{*v8aNS zKlaZT2`=~&E|hF6t4QZT6I}37;3hiK=BUG3bkm zzT26D228>@F>E{h1@k%p;=;EucAz&J#4xH?+HlGbLn@^<5SQ&G}<4)ZzaU?x3iRHAorz3b+th@*@* zyfXMbSfz^i=ELT@6opwnJ^eg=lffc7dy$~vA}+VqQc`JVOzB$c@U~<)7E*P@BI@I- z_vK;&Vh~HOI(}3H5mSvKh$Dk=xunqQ2J|_lKt*-DA&8no5d!>Sl9gFtU`!@?V%E5R z!dzPw_8w30H*Ga4$G!l7$XSep|-rly3j+GN1nQU95+XvB94QBTFlNnSe>LSrN zn99_LNG(<=`vpr&mvEMeAz$#hX`w!r9-L_7umPE>EzLLI)mP-IKp7e)(;RA|KkYQ2 zrBq&^jER?UQDj9+7-st1 zAVpmbB#@?gp9bqffX^sJ5rqKe{1Jn|jl9Wp8mb4W6h>N&>eQe?;P){%YU@I%+wu$F z$Zhg`_c_r)x?emeFu=fEtCdWd<=f*Lsl^9xh079*jvl))2a!Ly{Y{CzlpqW)`$DI&fU+2zxcULUf@J%t6SK! z;AsVioHOnET^v*8var@7Mp|M$c6JzM`FAwjeWAKk_gO95-QCkD_)Qqq`)liEKdI@3 zJIHVznFfjBjm%bKM1*(kIfcDCm3W@6KbV7_wDuFzM00bkiZ`KN>4EKHNYBt8U$q}U z6yDe=RI#d6FLDj566BdK$k){s-@# z?-4o+Q4;ukl=SfV=f%&fD6bA%Ki(f_2w`lI%nE3szv?eX(8pU@F(x6>7HyexpS*=r68xh=UG0XoDXH!XW*#R zPD*!arTg%VeZFMI#i^x~&(R5$XEEI6(aqoLQldHhSU(I-GdmE$s-w-nU;-mpy8<*Op6_W(U}nVgPJOB0eI9Et7P3WO|v{rVLo zu>*ltvpV5WC^xJfZc;vVT@Lf{=h3IL$3CBYTScoRq3nxnOYGMUwUeGKkkQen+F+U6 zx9neD+iDZDJ36^*#!Et);9YFs!tI%^gMMCN6&8GhCUV>ScJJ+ zNK2clo>kZPhMsPOTj=|KH_}bjHuaY7H_;(i(J}GARDR3)n}ReqD-R=@U+Nu!9Ji0r zf?VvTwvp+UraAxoW?Fv6*HnE{?H`pf_y;7F_9mzJcbB58^GlloYwH4B+(Ns4Mk!Ph zUrh{cePgIEEoUus%#2J7PH+Nch4=(SLcoNV+t2EE-egIobuAt8=aw3UZ68;W<6Sz0ao5Z(5qsvaxlA8PzpKnbF&b zwE|q}s=yyhGPNq^+FmaEn@L;aEb|Tw92hp^(marvudOrcRrGygE%gCS&dFzE4oc#^ zh7xKyM~a0}E3z`ZO&97YRQjZRhp8)V@tjN|o2nIqViM zl#|8d?#V8+0h$l$S?V00FYLS8ORn=S{;UIo8I+g?ENg19@$=d>lv#jXWPwdCn3|iLo0pfKpZ~i> zWZ&a>^5hWKjFLhqPgwljxtGZ)Srs;=VuFNEOSd2!i|5Q-Ql4CHUsu;t|4UEmJ0YQO zy}z=C_F`2mrvK-Hk@mX+mNA=ob^rjmRPtHBs~rK0y?=g~D9jIo6GF}Zg~rOyMP`IH zCgnW1)p42-*k>X4Qd})qtha1qBRL6|0q{f&N=J@{RW8v%W zAAhU#be*Oq9^o~U8Q+4c-Cam{a9vMU>hm9qm|H*wC*04JR4tmGj?*oF@JRd_$u*hI zJBbw0ECm%op8{ukTlwvltUeFcJ?H&QPhi{#lKf0mreN)VDX}0%@a9UM9{Ivd&N-g* z*Aiyi$NlJ%O>R$?Yk)cQB*mXX8Io91+15z?$6>`*Xv?tK*JPvMZ!8WYeWBt(Ou)WgB=d*%{m!Bp3bO8K4zq3krCu|HCC1iDkGMtEi*aD{? zJ>1oSo<4nmgumL2w*JF4)WdSAbTaT~I&UIA{BD}ka@M`#pZ;H+18v-iGt{5VFd(6L z+KPsZ7t}1(6oRYb5?l;~{K=HH$4;cz9jIvBuDXlep*?L=ekFn8jav|P<>h@m&se1p zcj`Y`wZ~rqyk3l;?r~x>q&PC#dHi@Qt^*aJ)!*CMcmq{lzy{HXlS`h${|jiz zsk5jkdR-ED71<~|aLH2v{SGjdhnE|Qq5)&+OW_(W=o!sbz>~$$$1zl)Tv!y#6nJ#; z7`vQM_DZIrng8rsKmT(~a~j>j#u2NvkbD{*Y{Zjv87Yq5d&Ls%iLGxZqUwE3A-5 zg#id+MJ{$iWTM-#@H<<#Lz%K=CDmTc7(I%)UN#$yJloMWO2PMh_ji5kO2M_#!4jhs19hFc}6g3XKAJBD_bz?5CWb|7F+ zlLxDB5CrB@amPybzz9IwUj$~;EK%0^aG5ayzFQMu-Pw`sDjKNwkL86?ssBSy$VEK$%8)##J+aTRfq1ewg6dBgg zUf)z=1-nef1m0vT_ti3buG7~4Gn9FBq-n#-fM%vhPph1bldR>o(`4Ls8zgaCi4 z!v()fk2S(0j+w-yO^N%kD>E>|%{7uBI{^MqFoa8G^MWy07$YIqyCOny`A15Wk8@mM zkEAJtBYP+pa-P^hHCd7eaL)BrlC1l@|`E_<&I zfs-gS3A6+_rka@DL61V*m^`+os6%FyjSU1lF+l*pRMd?pOc1i*04+xda~2_J{PA$g zkLH}YH8gek_!qB}#S7=EpMqenL{W&+)@LVi12KS3y(RMJ?6qSr8|pWpJPJz14|Gzi z2&SD%&f-!$M8~@^Zx2rR=|XT);wr-wR}S(x+YUTZ`B{KjhtoRz2BYmP+gl{JZWc=` zO`7x~bRdQr<=F4pQ-okVFdP*ov!;=u50-07OMe!PSLkHQ;m`=tS24jkx5P(@4Ixv) za7QjiF-y@$86CM0YFcy3yq3CS-lC$P_6(EKvYw%N7&1ctbWTOCUX=%Cm_SG|IUa{e z%5`@27bbGybz-l>6Y57y^lQleT4pf)qpWL$Cuxo%M9d)noEM2H#r#aGAuR*P!#IW{ zDoI^-c`X?;4CP@gM-aBvpl02b)eWSuG)hRYxEe8VgSN^8wP~n;#qjLSAm-U`D1sm0 znh@Us{E=P+@!M1A{JJ#)Zfd;`_mZ~xnx}5}-KrQRJg9yz zvm2C3Ypmq)hFw;R+q*_$jC?{y=q>85p;y$HvY`Nd99?xsF+5VF4^|Ew`l^Q#apBnrid4m3cwI@gviQG60{2cG8%bAP^DUu360lnCP9%SkxCD;Xg zA~9>7Vk(@Z%4<0x<@W`0k!e^&K zSxAJXV#5BjJA(d!tRc*&#a*j)cwTb2$N`Y@QD$RPqcqQK$z=ov*vys{JNcD!wk(8Z zk_$VT4A+irxnFALt*Zzq9eOZuL~->2kf)CkLfwYA@URu0H5uH%Q(a+CUzm}}Ra}c| z2A|sIDa|cAi)ESxDt_h|PaiCMt-i$~k?mgvjNN(o!G|*5;2C-TQ|^sT-L~MV3D6r! z^oZcHIADhg(VH_Yka)AA_F~}TW(60&*1mpHXM?fP>Ifr~vaf?j6duNMx4o_a1LPd+ z6+AA=1wYHfn7F|C2h_~S6D)~C(HPVn0`yoD-#vZnFAe~GwA^)PX4Z?!ioH4vA2CFf z{}NiwFyRt=v@{J?iAtv`CRpo@%b@DyfT#6<%Qn#f<{?ao2|qU}euD(}PiI#Rg_H0R z=7Z5WV=*7XwkV9gxquIve+%)NXpk7AT69wsPViypim}-lr&4Sa6Qk0oc}B{$D)qt- zWw0>#cu?NA318@hBNZhmZ-gqWuU3NRzeVn5r{83k?Nv=Aig>**GYn9jNCF)HXNhom z3av-v!p$%San;?$p3^dZqG-P!gEIUu9W^ zR~8sC{*Q4QGu*-s!B?!R+2=AM5Xd3+P$l=nz8S9Sk;wkM0w0$f!u#uvS9a)a&_cS5>V|OQbO?0ky_YHazX*%klZj-T6#2)k@+LfMu*0PZF;R?~ zk9Im5BTVzxu&<(FL=5GS3svIhcNai#A1v-8>YS$#u2K?>P@xsja|DE{P*7#%_0_ME z$)t^hn;eD-gul_n(nR{d&Z1r-if$6B7^*3}P_hX}?5;*cF*)}AvF?0+F6t*wPAWxD z&P@H({bFZtFHqost4k}T#MOrIKtdWii;Iqu4OF7p+dD{+=)7FYU2r%4>;qAIy6o0* za%V`8ZWjfWT7N8G{skorXCsCcQoMoHz5qs%VIENOBI5q(fA}R<3MR?fiR?gN85Je4 zuMKg{mU$%!@ww#d&^KLEQ$bPDsxji4v0nuj$LYUg$5m=M|vpOCn@0EX^bR&L0Xe%ozwL9AX^9Nf^V|s-HLc*eCvi(WO z=W49ZtV>%v-9){Ry_(sgVU1pmikw_kUEMDzSU8l@lqQD#ft{o>o~iT6uBT{xzNs@E z>`hV5>+P*xK!F*RRJ}Kk@{C$sH=mDt%!;JM_!*x;L%j2{%{SY5xunjB=rw*uv6kX? z{g+QwB;`^I&@CB+D`#8HB%6m-v@5W5vWp6XE~Y;3rDL?;qaW7OX)!m^!?84>TD2$r zX7Z3m0#4!c4(oK#=Ige$c4b*fgO|l{T)Y7&#wdBio&`q_Tp{qO8LZVFI2~s6 z7nO;jXMP6IOwDLjibx+j{aq%>sPk^6JtA| z3j|on#c==2d@H>tZRa&aTvle$-0;xya<+)GxRF>Y(NXL~aVUfFAr-P8n2@VJkmUaj zmdp1dl4?8XhQ4ix__#fB|4n_T-8#IO{6@bbb40FNqT&!k=CZz)&b9~_`VBJ=&G+Ty zO|7pM1%*b&=32bXf+E6OzVsh7oC1}#o#X@krlG?GRrTm@yI9vzTcxL`gLg0D)e?p# z3t5HPW?ym(GP2hMgxRFFb+wfB2{&ZZvROS?BWqHBtnM=Pb>1hNcuo!G@S_zzmIRb- zK0_lJ@u!Zwr(CxwpKhuzF;zL44R`u~8eVFIUSC8KO#zzdHRs4bdXM3JLQefwMBG{9 z0G85iW05iBMj~|6<<>1KYTM0U4x7_8Fw@u0NjDP}vS-kS?i5gDjH*BIZ;VDTBWT3~ zqwyjM5S+qm#=y#Y2=N!lKiYzUawO;9Qdt&B`dO+G-1O-ZL8?)MDcrtlw@(FINZKe2K!1zH?9WX)-jY_?BFVW0cSCi z8-#F7na$iX$M}7~6LH{6AIQS`5?LNzO!@QCVT|@XHWp^`e7i^vGxCJW#Ho|hrrSMq ze+9Z9UBlWzgz010GM~=Xgyj))vw*!!;f!8{(*RT(;joLKa{^K|#U`uz=kR~KeXztN zhm~uQlf(MoVhifyq*lXLJ}|d*Vgi*WQec6i)M$*P#Oc? zdVeuIv5N)SROM8JD?u0E=exy6{C6>F^0< zn1kF+0*@RdKU?`p>J!?cP9QMTTDjI0>5C>|0-&m5`#eiUS(%lcRYO_*Qg~TOc6r$2 zQlkBPp#ot>Y)v3#Jb>))|4MQQ258S`KU7M7rZfWTlMc3wIL zHa0pAvF5TiZXhc1=0#4zO%DK%7m{#FMrN#DuyQxO?%w-g=V^PeGWl~wGfazd-&7U9LXN~-6^dOhN^j{e z8*&m?Koy^eNM3e^s30GTD6UX0D*+*abRiyMLDO#c+G&oZBspcFvS41;*8)t{y{Tnu z)MVcGv_k7qUsj}#8tNY_mrdu+@jfnsG108TMQ=l<0 z+!R)W{m=K`QB3UnpH0xZj%`UU_l;oFr4C-Xlm{3fNi}$XE@(})3A&HnZ%`*N${1{l z#vEgxr%f^ueos!3r>pooN+YJW%CwO6EfSJ;fYkC* zB!+iXY;$w$5j*wNWlCZ;DcQNG|2wh1ir!y>*8w>0o1xuBh%NV(4=0C*RgpAOYOzdTk#+x`yw7kqGg`YN`*_2GU>z+&55&~f@8%{NM&O0!%1 zXx3x9@v-V>k4W$9B2(3=( z^ZsfH9m!^o&Plc{Y`0Z{b(g~56nM7;**mgWdAzvz<|rZx2nbDwU*yCyI~G|sHcxl= z{&sy59mS7~tk(Lc)?U~G`e5STLq^nmaNbetez_gy;Wyy-Z1YqUrSPm??)(1wW2SkS zx5~y+?Pc%NG?~cmT@t27S^56b;=9HN0d&XqvPD+AC6HyR{tbidI}cwtEvjyyFg+yu6oU}GfbKEPQD*=M!TCRAy;V>hT(GT+y9Rfc;KAKJ z0TveA11y5OySuwBAh^2)5AN>n1b64I{Cl6ObL#R0MZp8i*|WRH*P~5Fpp+$1oxI|7 z?Unsm%E8t%Vv-?W@ToQRxX7bRdGZ84tlsN}6}Wl4pUK?jNpA-wje zghv}_Zgee+5al##D89pE?R=~>H_&nT^mk3%W+i^5Euu5tzcYLow!Qx%eRx>j%H}WP zs3h_u*xchxFl|amkb7=bJu6jRMT_I&Iw>V(px=g!h~VtxWMpWplBxQWUJUeVGY^Sn zdX|>__!yA?y8z!*dW-Ag!qVH<7`CImbh%K0$@{3N7}l{Ecaq5PE4g{D=s*dow>}A{ z2lyYtyb2Od&JEl&MW$JQPcnhF?r-p$EY)SrZiT%GCu>>avS{-ODG3>Ac0gl~J*U5= zNmNflBob6qdOFP?#=c%q^xMHt>itqUZ*PHt5<)JAx0k@hPNA2{hOF`N&ldbXBP0mB z4hZVxKbMTs9tI!0+ zT$|eE6n6F-B&5-hkPvB^&_mnC<4SNG}WXY7+Gc;@p?orVil!Dz@I{0rkAoqjNcOUl8NBsZO z_WxUaT|xu$d^w`S5fw#!Tt6!YU&*4vUx&-5IpOi!32V1A0Tn`?E?l|Cc5u`MHPlnTtE+cBEu_p^ABqa#Na)9U=jG=!3DB_$l#_RX zoO;^kc%}@J)IETUn3=Poj`lbhEyuzzA^Db+uap9P9iNIvay*Pb&YFv=^)ego&1PLd z%B{qjc`Wn}L;Lq3)X$BuUi);z0hEkWx!FI@-FrbxUhv%8;&VD@)rF_R)^w@MAn;n_p6wd{bL(1x*8mjvpJlR6!)!28C_#cbh0E^6v(}ES zQd$Aeh;WkSdoEz7k~~R8MJEMxN?|UVMO!m zNPOs!ri=wvYG{h?bN3E5J^O2!k<{%naSH5c{^A+(i#P?vH^(VKo5RPkrQgnCDbu0_ z3;~lD8F~%R;+ki|&DQo7kk@!iK9L!iNWoUzgS|Tm>t~qM%6L+-eZq$|FLrg|pKif( z$YzJBOgVmJi&RGui+}a&n3=Q=vsoB_1^2^p=>P-}0uCK|Scmev4w zrl)HE30HZIw4J&eso7M#c{(PaX^@VLre?1F9F+uR779Z@s+yM7gvxuI(hso`#kO-?cqE! zI=8tk&m?~fHG|2g3!>kWoGFqzu{3kQLitYkiTM0`JA~?sUjyzBs?Suzd zOs=w<64c_JhMOdg^ri_NHUUfl;CP9JMh4j@u)0CV_zm~>P zuq5mp0>J}03?kebfWeDM4h0h_JW@#XEVbmbRKF>jT_6AkHG--4^ZbE*E@BHy8LgeO zRAD;~VL;fbtZ1R=Fz6FGnQZ>dg^Vae7@S|l4;qxG8u*w@RUlFrAdT#Z3(kiMOOe8S z%1Mm`iNVmCkO9a}I0suosTt3|0Y&H$MqdI@xeS$o&oGs{_?go(LGrGJ&q7%1sPdYXN6xPf4i{- z%Y{s{hEJm9Ce>f(*#EsE(5o`UUW)ZrGyYo?j>z58hJej@%W)C77ec-E#8-QUa&lc# zAMhUWl>#(n$BOAk%hZSNQMcNwj_<@MLx>m+&)A)0*J68uiaBKkS;|I{rHTdDl9#VJ zo^}fJp&X?#{R7g}d^^qWsD;ljiX-AG{}MV#1xW!|R2amVube&b73A#?=^H;QF)roC zzsD+(Q{flyu+zaNc^z2N(o9oE6DRhEY!p{c8giN~P1sGa-xuj}5b!M50(8j0W<^DZ z8#O6n&qTsF5}yP2XNHQDW_j{8ZPPgRBuArraUb^daGoJ z1l?wQ6kpJzrTO4kAWeGgVvaRGaiaN&+!L*+(vOO>Kz;#salCy&gcXvA@Y4?n_QXl>BHzai;F4u0NvAhP?e`D7^scZ^10z0=}gGvgt(U z1gx2lunoX(u?EN!$!dzENov^LeSwj2C@^eunlppE>%NB1F9fA;K~DJ5O^?%BKy<#F ze_1Lpgq)M%l&l~;k+UW4ut300uj~dnGEjcLEYcFfFQV{+oETTTg;!jrNhgP8i4qOm z^6R>#V{e&Cm<7x#^qfSH7NlqPn+<<~^APo-r|WR#!1`BlRme=m7<1cNUACYw&cIt7 zPTMmQfJawDTu@*6nd*Ivy*z%^#@EP5;01qEIDi&Dl5>R0xBr4xhyeVCWFzp%C9&tP zhv3zlB%x9>=pJ5dpT5U=JwlwKYCxGd52n!{o&Pu_N@cl*u()Zyy6b`40pP26M?M2* z^n3r`O$@5C-0&aH_8*0y6N^q|aUHz7!9dO`i%PWhw=4F_8j0DI>@HyV3hLfv1O_Tj z6{_ypi$KZ3zeic8PuUR&MXf|}qDmUIrRT?#33uKU(*%UkQ+|cg(&cY7H+Yvo|1RWa zu&hDK^6~zVylvF*SyT)gyP=dgIyW>(?SiNRZp;IW)@(fj0$0(5>C*y#g&(nDe%Yyj z5DFy!31^&VMttDj>5hQTwo%rCqriz6W#(iE&BG;_2UHr4>SpSUx+ME;R71<($ZB!` zzHDM{O;)N~5a3Q4R3_RS1QlHUJfPzCV?U5fjhxdTQp}(mF|tT4bX>3S&jeo;b0Y!;~MGmr-4Xod5NR#0)$Qb97IuJCIC z2Bmk=BrOY+2RSp-c*{iSr$y5ZNsL-Nv|Hw>%Oq-z)slo~cvKfLdU3q!hRQ?S9Ss3Q z`~sil;rADJi!`1&qvOpxV7}Wy=)Z9aH*lrVMXc){WthjtsfQ8ju0KH*!>9n|1~~S~ z2uY?jGc)T*8iE@P@|IUu@p&HFB z?`S@K6_hBdWe;HK@APx5=B;m&H3h;$fwkUL<8ZACex5PXlWCz?PmENaKo4avLdE`Vb8oBZN5A zwUq^s!R4>bqvXpSB&4n}AJLmVHt=6A6|$*2xzdB?Edg>-ipbvrrtfQpx4+MC9e*-~ zemvzC0uI!dH_bz+u_cJ^z`mNN*^%n&)u8tF() zf{~+ClopnW82=FYRfbyxuSTgz=nn=?Gl|eDKWiN^9VqFY7Q+AS_k(9pLeQBLCjS%Z z+pOWoT6>}Wn27P4so@+Q>wWKUQuUvo7~AhpNl8c+)G!o|51;+7ERB_XWqjl|<|<%C z^dMgKf?w?`i^@iXyUM$Yg#_rp%bF-bN0E_{;fSF=?>8DF<$rZ4#QxwhunB^OAt+^{ zMhGVaYNDdg+-g7kyP9mCXM+`TkG!7^hPMdl1$C29(@KoRlctA*+A&7ac>>h zAI6L^%y0vT9Qs=Dr^!=J0<0)Fk!JrwgY_~mJ3mb6b|5eat3-(Z9S~vTAD+j{&d&bU z4NFDEOIZ>A2~N^@>odKw6_0|~BGPk$ScOmJ)8kg`ZiGl}S2=r@8%uWoxUB62?EWU9TxCD@)Z}agtTj3ay;}>G_#|CbsB@ z`9Wdfeq)2nZM0MW`LYKm7tLpy8&P8ijZH&YKTPdp>^MWIRBvHMj>6WP3My(fb#)Tk zpTtB&0tpE#0^E#Z=WY26P)Ir`0N$fo@iZnBrGeKL-x~v+^Uhg^2lHpL4|MjWm`&gx z0viyAWm(iUv7!XXj~IfysE?+AQn+sf0V1rIvR5cTGVKK$y=wwL)fr^R>GPg6lJoOXL&LR0np~bY8`i5>04s@`SkO)xaji4MNPveeAp8i&i z1L8~fODkdw0Io1X5Hf>Lny4Srpm{V4z700cAgMZdBYP?$KDh6hkBt&6jvMLh@zcl3 z3JR{}_;|RmP^x;94$>TUArA{N4P%ZQ&HXaSo`5{Y;89se`m|Psr|g?>;5QVOQ>BWx zT>JUIO^em;#XjRHCOlp95Ke!Il3jl*-wU)8ilk28u*#8qT*?oVoeJI;?k2jU^`jOL zcD8T@8@P2ohVkKpqf9rU5exul>AvO(>@^r<|6wWi=QF4UFZpw`m!ILQH7rPC`%al5 z5HbZnfkomamw-_C`>b6>p1s%4rQQ0|aQEHw_RiZQ4v|s;4yL@zpBs?ox*8DQ(b#cH zD8VO{KP?#?n$d9yV^^QQn1;U3#g>{r45LX73*U{AvXJab%Jc#at~Qo*>STpc|X zO-P`Hh&~`kq`iT<^as$5Q;5oP_#F9bS{@T@$Hdd`-wi4C9lOX)*Vi+N3aDVg*}Z>% zaHZ`CH;kO1U_{|;vH@YrWZH#|jo>Em-Sfl2{;e2yadY|Ou`6+!6yFF1@mfkw5wOQr z;tV75&@D}Yf0zahu_Np-9=0?t*aImXfRSHE?v|gAAZ+*JO6vy_KD$DIGU|>5y>5~P z<`zsxf=8Mk0O|4%ctL_VRY3}xFsBX-GE~|jqamEGd}>SptUok0#Sk$Ie8#s16bvN8 zVn#>9Jd`o`{GPM!c=rHkN{L>e_N71YG%1*U>S)xtaR$|}7$Z7c9|9p5bW~W-3OR-k z4s!*5X%&WX3?4tiicHZUB+dAs)A%6rr8vSj*uO$yk|VqpeCg?V&GRUDXJWjBC)4J{ z8VlWpgBDykN(?TJV*We>=;>KOB&I-EQQ?I0<3faxG(?4?^n+GR_iY&O#thJ$jd+%< zH=f?YmzpE%-Z3DsQwHao;6o}LBR5xh4AR|hf`S9`22grTG;p4;V?C^22;B@(#agYr zcBfvfxGkpgSZQ`$Rkfe5v|Q!Lkb2&x+j^T1o_5I}WK&pDMY%c*L{TYZ9zmDTRoVl>+{UH%cGR{~7+W~H3 z`z)r4d?cIu=sJ7Y6`uL+B6Vx$_hHsSfsZfY|709iY5!9@39mxF6e_~exghkpAVyCIn^oh)bl zd3QV7x5Mcn8~MSj>06Y6Bl4U-xo z1%3d9gNlKDOFGTz@GF4Z%=}O(*QVdql=m+VvP7cEvISo$7v#gQ?x3XzpubkroWF9d zo!u`1Q*o~n+~2rn!Hd#{@~;_i*eV$NHK6Xk0ISl*#owk`(fO(zs3aR8D}}*KA|=jx z&*CQuiml3LEWcX|*E}GYqUJ3@7{+op;Cjs)Nq-)2z9C{<_gN* z)arU-X6D5Md@(I;UT%Q=WDx}fxo|tNKI6Zm)^pVk{4oO!EnM?9eV z%f|B#rNk+0C-6@*_ zo^&?d&1O3?FZ8>%ud027go^3O^M!<&Li~cMSWOS0fNYnR`mvw1bZ^OoRqmQ~7=0L< zt`hm)Hq)rI^l}yx33=vYy0~T7`OSQ?G_OQl7v9g?xh$KxD%{(zADY#L+`OvTM2Qnv z42#TSh)2QcO~lZd$zRPT5?LQhb-4j71NW`>7jD}%rwhE!$NhE)gZG`(YRtGG%$Ba( z{dR)9m#+rhC>PovG@?QeUA?zO$etEr875J}x>c#XuZ`hlur=w503p|u;CR6W zQUo@F3(J4gmqr4h6K1F+S^g@&Fc{^ytF4VDq-(sX2z4noY(TH67Lr97!jq`3@(ds+ zMBmKsy_DVoUtRJUQ)cchjCO=VJ+)f`Tm04&_0d@-jC?qRfl(6r3GvQr>Q?MgT3Wi_ z=BEID_Qt#T$3a(m*Wttys_(+fAK$nhN6AlO0US=l06m+-vAm8e5)x>mXJ;!)*ai^Y zv7NlVvJ@}9bCc^h^NJWG*Pfx0UIZpUq8H2J}SX z)9zpf5>iANL)qcsA#@(7!jc2|s{);lgJYfi*9csuNb<1NgTq)_YNrR3w%>VeD<-oX zj!fiqiJV`ZoGvmY$gyw^`OA^Y%?0H4PP&^@ID!_h@%}IA;6% z`wflGFun4cGjuXC6OGw6e9K^s>AT)Mn}~TZe|l!Njjh1ESAK0vLrKXmH@6?(Qk=dp zDa0tLeNO`aZ1x!`LI`zB$)p9}@=8K-;_}K=T#cix-nzw_2T^W;Y(q_6h&0@DdD+jp zYovD1=b)O&3&-#C^DZtA-3rM`Nl}xmNM#go&`rz7y#d5iiOAPT$k$&FteY@8vt$CH zv?T)GdmOW+T0zRGraM*U(6+etm z=0!zcBfo;s1Xgss(H3i0q-07A2%TkY?0a&u z#GA9Tt6QJXFhJ18e6UniN{e8SkkFNm`f!mLzE!Me(V>N)b<_0XFEBVDIW;vFY-Ojm z1_8|g2vr%)8yOinIr*uDC zd^7)oDD!ir4L*eKfUbC*BN4V#?r=gj$^8ZsQwWV}>Zo^7!i zjxiXD-yI;TA%jN@b9GyLZQl6~JoT60xQDppq70#ZS#9pRIdJuTJl}GI*b!9?lFrG_ z)>B>O<*@|&3zS}89s#Ts)Sc~(w8Vzpx{cBqNCAJ zQ6X24kN*m}ROFG12yk$8bky&jww~|w=8s%Qz?MU=;7%MB9zdU_bzd&^8iK;I93lTh z6Sc*T@%E;t0@WEtfy+G*ff*6qG;)yOt@Ex-EX+$4HzwYdV30y4lV{!gq3FfH&3$mm z3L?pQOQVjV+bytl8$dVH;is;E!*l~}|D{^+_OdAYLF9H#sX3RZp${ZC&rR}(-+)68 zh1SeAv(wb`2vF-|PD~tp>FlVyeb}h@eOH+w;!%7}_7!fE81q^&O2o6}y}CJRqp9)y z!1eE<4WG;Cy$P9T`>CUr`3C+SI-H!WF%`eC%5M@UM}Xa`7&h%H8xf-DG<5wu?A4~* zssG)Bm5+(ivvC?XKv&sL!EX(FPccbM3~dVZxjcZIWygv{bqhP|{;FC3c{`A3LF93W zr|z1eU8&jYBi+`^r*Busg-%}htGfP95j?l8$4^OALSp`ZXH~pCx-;;AD z@Gz;pF4;Fu!tQXbqnNE6*!1g7;8S9~1VeiBx8fq29Km&p;SiRWqJfu<@O2K(*15H* zxOjY9EzN*(Pw<3{r>nC|*74ENQZtVa&`no8FkowVVuY2oy4sev$#PN=Af=dXwM^#A z%f(z!T+hWrW%|QQTG@Hpgzq;`Q(IX-E7;6U{cD)Ur;6{RGmlH(BqaLIg=){v22-q% zMIMJ!>en6HD!xUbkSb0PlQ!;|rQn&R_I4ns)Vx?(nn{mjnIe*Y17L4ic!2i8U-A^o ze#XvgELwRUo;j}TvBcIFJ>V30I z?B}JFDI3Zl@8Eu^mwPfWGBr6eIyu5@FCdg*PH}j-LDG&+eV9bTOiz?;@JoVGk)OP6 zPm^$RT#2Aw^A)bNM8tjP(c*CIoBmARd(Og1+cmi6`o8FNqA6kGFtdHSMjSeb%mrtS z{|7L~0xagu5yxMP&r$melsfRL=`6-2XAAJoc^ZD4_q+ccngS}iXq%fK{c?Wo^R_0uQLY<=o@d{iSRR#zd^>zjbsB{W6(d7v}5ed-6*$%xQEz@ zDJhf`#I7ZXI{#Hp`tSWY=`<8$ofTnZs&VQhbRNScmcx%0{I3H6AS@YxrDg8pbo@$J z7~|7;%gLr!!K;bw;>Z1Jqw8<=_VcrhOnpX!7ne6%8;jSu`?inF#kY}fhP+l=NrD7* zKU`&yCG?09Yy`q6XWqAS=iye+%C6D9@3zM?xkWBdCX)KuPF~}uETO1-)Z%ztkfApv z^OV2c5$5Y)smlSJg?RZk?#_zI+HH4>UPzxjekx9vny62Tyo{xud+*$xy@Z`Gjz)Jq zypI!+xl?{=2KJmS*Y9TE8N64+=lWD#o$_v8Y%%yJ-;my*ZR}ow4SfC~>da1hmbh^} zej8})*drWp^dNG7KgA%&e)|a8b95<5oL~((v~4yjWVZKSb!ubTkN^%ob^iK=sa|;i zT&>)+b6j=_Htai_SzttntzB5Yyx8Sn$I~TFo$M_J(556*qLiL0Q1|;1+Pg>a83=j~ z@T?+3DTx4|bzDjy6>RDcl9{zf>{~kOUSO^jI)r=u{?+EE!_6>>JrcsUKrb)OCtz>sLecPY`r^i#fB+sGrn8F!16{kJ zn;SP*D=!V7K@$1u)IV4)X-}%1G3pbiY<+;U3#S0;&+DW?*5OZxkFa3}E;{m&4p=+r zW_!2-LPn!&r&TSL61#nn>WIT0yws79N)EmLI|)b)BtXd&n8_WOU zm1fr;Zd1mt9k<$Je;U-$o+gN^M<*DxH7}8j^nwP9+>6aZchE_W|B_Oc9l0zw^^=S+ zl!bEBlq0DL?WOzN4uywkcMS@&v0=2+9XlPe31TYXs0~kA!S8e3QONbXf3Xutpy$IY zL$1qE%n89op%TZ>AytF1?2vS3ipInKg`zkCIg4eZ)hdKcS3h5Q*vtnhDon$O`dWOlDEnMakaG`RJay`YqiXM|~spp#Udcb)bg`W3IDGyT76UETA+S3jUMfBSqP!Fkj1V za;}im!#WYSmB$Iu=6YtFM^U}2$A)pE_E}1QUgtYUww|L4-peK1gt&15-U36TO&>W8 zJZ!4TrLK&+#q_=F#^Y7}q~LqEH@dagULJgo&voYH+ifGyJsmA~4lqYc6DbUsjBde} zMp+#o4L_-*3>ygA=PSu3Y_J*^c3<3x=-SYKFXj0v^6t_<*qr2TtTSvt3~Xul5p+=` zK*yAT`!3C6Gv|cKOPGNUk}N;&>7;8pBS%WK-V!NCZ6HxQAn|%;e6ZdH06O#B_xZTGxrsD4}Gy_oDJHX7Y_*;Nx|<>V^|kM&B;)%GA3vOJUiM-{WJ&13b4*DKK^Peb&-;v0%F z^gqVBI2{0_J>MboAYcz-{y$`9zx$*G#2Hi{iAE^AwFa;m6$9vj~E z>3W!3K8MZ3az#OKo6O=%PR`cR^JQY1bp@22*0MI{3abM&y-xQma>@N94<4SSLqhay zSP@*;g`mCP0=GVwf1)o8p$?YtKfqD|BiZHx{D%j4BrJ5m8md5{6sgdBDBlH`FKk?2 zz+(dXTH2ff9C@YG#7T+^TxN7+mF1NzOiWg`7s)toY&}g)0~HOo&nqTU{rky{&fpkr zPNiMRao33I-r8?Ic_+Ru{zXFU;&>skwRIWmO@hNjmAhR>4OO{ULobB#r-~b}hU~oj z>4&B5W}KSw4Q#S`Eo{^f zGQdw%&~Hzzuu_Fw$X^u!qcWjw#l-_#wc{*HZ7(6PVwW$v<^q#He*7X4vG=f_F7)fA z31&(u1p}7(`DL}!T3VN1jV6ydtYL#qv(5Pj;6h$)@YZ^d9yR5p?$YmtrDzo+3-j_D zT51poD-Ez|6jG&1>+il<80ot{v|gn@O)tX|lqJ|?fEW_6uX*Ow4opp(8=Y^_q9&O6 zKu~#Xb~1p2^wwk8zn=t|OXsmN(9ac~|knPjTN~SvKu#tI44FLBsql#FJaZ?gKhj@Ui1C$NLPgy6biayecWWm}j$j zd*kJNxn;Xbfr#68`^Ht|BhjFt;oeP>8Ppy32___nMQAwlYJ zgFG(IPP`MQ{KUau3Jw)}X|n8o^QH*(2iG zswx^SS$PEkA->b27o?nK8mVpBXG=bPJwO`Yp*G4<{-{N6Zq8?x>I^+ywkUwDt*4n{ z>H6n@H5|Lvi7czCiVBw}QK-N#$Wl&HiS|V_H5_f|WGiR~(q_i`r>nObj(6&C8O~*cmRO+Yk|3g^iSM z{hT$$=0cM~jHqyo5AhKPJ#w+tyJyu3OKSvr0+5+`4=HS2% zA;Lvb(Qr_)fw#cE2zkW1!BSfx z0q~;?Q=;_KjmpEx|rc6>xa!Z62KY8Td;NDs$n0% z*?%*pIc&KS%@rU9xrh`ay%V)-*gv`TA=H`faf>uBzqTt7j$3;e? zwsJl~6*faNGsA~{!Ld%cB|{)SvMn-oq5(ft`xvEi_fAvMv3O3ld(xm^FRwAvdetHy zmqG@eha0v(QX8Koqd-&OjktPP*aQQgN$AFhk>dT*86&6}jU;fQK%StxN5)Cti}&ci z7aO-*1qQw@i#=3&ZxTMr*v{&6$M~Tx5FQi~@qLi7j>m4+$K@h#?^x&?&F@v7q#r8} zu?H!uuWkzQF=}jtyBZ`Q_i1jw$!t^}r#{?z8d0i#TV9BsC7WkGHd1>CF!lmvyLk%x zIQdiJOMoM|y<*_G*XhZ<_5!X;f-(M*cE?qr@^WVcElYgupUz}4?RWfPJ|$lWaB9s(h$4`E6 z`O&t0+_u0(zC^^VdynX!U!70h-1^3}N5y-V?9SIwfF&F#o1v)jxT}L9L|nr3`P=Z= z*%9elyQhJN$_&`TjkV*}*v6uj3ZFdWcMY2|Kzm7O$~4Z-TS7`&@w_*`vb58zrE78* z4GAhcyR_G?s@s{1GX1Y$Eed!;7xx9obvBpP>T$1kVDe7*>f*;QXu1Fu95gM`6k<3^ z`hw4(S$kOTG0%KsY&UU~Tcb`p&cH84r7_Zi1$`S1OeftZP}8W0kUeu)=iPJ8r4>pB zVfCtlqD%}O%y>A+(26)V%HN%|p!h!hBEZH_<`64KmCeIID5#)EW(ovCva#OgoIKs~<418v4RVgHq4Jueo`}2Zuf--h+B-{<+%dBX~1nzL)z;nwnXr`*>VV*+hZr|9xQ>@F&kq) z$|CYO9Nhf<5SiO`QEOhVh#L4E8q!ILOpohN?N!h2-F!IwedqP{SCQB4*v^M_GOr8I z$&T0SQBM~e-v@A(^EC7Z?kO%MP73<|cJ9WS!bzq_axiPbXK@T1t;K4=Wrq3wI}ez@ z$-m+1ba6jOw$@-V+hOo>uQY)=xzj7Srm7ian8hbW#x%jx!%p?LC}>&q3P@$FrBZ`M z&#P;-?Aiz>qr%F$Y^rsz1jEr zQt#v99X?l)k^dmEhGzz0${>!J{aiNG^oDA=A=@C~!d@3@Xui}ckPaN;xj^du85Hm0 zZ~sl@BkIMT`N>teRqawjWucajDMo2le5KzD>zz5RSj4Mo_wMT}P#m0Dy9N9$-MvGl zGsDx(mtOM3k1GrIbG7i1PLRm)>uR*@#=`ES*aUnm4-5=|(RX?na%)FNM~U6=jEt0& z1D03;h=P`?9alWVI0zyAc(svJ(emgOw0A3?zQM!ur*D(HA0anrYM295Nnw6K|I*jN zKc8U|OU6{A{NP`?d{ap5455iGHBJK4GYW7*SOcF8=^Y`Zd5EjU>edSDFWs&I&tp_oCs>1sI;!pDF;Fr<7S;sqi+ z0NvT_*>K(zNYP3{(-X$HVII<1hx2J#%1nGT9-w_Kf=Lt@(H}SNU&x*%#{~0pj!fQb zAPA+6JTiG%lVGL93*@?M>w3~aJaxLVE(ZA4QVRM6@xK_2iuNBdjP@mdRQBG63mWpK zc|pIt*CnBdnEj3Z^9wXhIqnzCG$@7#x6KOeoKA5N`}8#%gHImMWH}eSrUcpU;94L?OgDSLg&+$sMv=Z$H#5L7_ti_7X zQD@mJAXdQ==h|4)ABRXru^|df&f$7Jl*)9z21hIT+`(siV+k)qEOQ}DACdQUu0vR( z011)?r42W*pCwuTV1mIYNh9umiHkkrDrDGqaD%8fST3a+);d{lIEVCO-8TT~2y>6T1b!y;2_Vn^D^HF%# z{t&;dm>;A(6zBjo+LzFWp8PR2E-FJv?IKY$DbMpREiq0O=Eu)L)Nz^Xp#B)VHcpRn z3xo9S0!7qO0&l?VOKI0J7T=fZNSuIC8qR0JVTe){)yq*VhN{N?mJD%?gL2A+AJjZ! z(C-#-(=Yu)TRj16aKvfrK~UcLuF-}zH=G{glT=-_cHMcYq5;S=uH_A4lKE1v+o|sP zBJU=c3X+PG=t7%=PCbzFow|Ar5UEg+enx3Hkxj(2w}WOO4eb2w4erLcR7kS|pW1d# z@CJSpYpQSr-qbO&yvA1`bbMQ?^s<)$^3rx!n4t3u{&$?`!%#9m-v`>9z%u{wF`M`T^}D|t3^+sLBA=N8`G9kef7o0d3B*SWC$iXp$wVyIE;(KP`bbh@=@t|z zrWVn@)oWq#Eyh(i`A*0h5RH+gk_f1LnLEHY?&&7zQO$*mrU;#zjHj zqNMJmW@2h`YXn=#cysva9N~K#9}8lAgl4}K1BOtl-t^|tBx(rbJ;Lw(8*wdbHh%Qf z%eHN!g|X|(UGzslcuFlh*oH9E*^SvSwS`dEdkpy>9t%yBFgDmcMh0S-ii*sL5ql7x z3hMUqUGR6!?R?mH;TE);q%v5|{?7In6SjosRWS}>L}UWb4{HqRj?!srPXj#+8I|!D z{Wtr7FN!zqc*WA-*5c1H<~5v`0jyZT2BW^f2f@qi?9fOneS#1nS*XGwgV&v?r)<2K za;RpKsgN=ZXr6^2aQS0!WK67w&d}3({rX5pwqZ9JqF{S2$bV6MO)%m6n>$SiGDy0? zx^^Q3`;9g}FHjc`Lnx)=;(doPlgFy<<7#ZjBRA?rNjXn(5LSQb3w2bu5JSc&*Ing2 znj7w8gH|$_Z=UbA(vJ@r_&>fN!hluC8v{9nm2!x=(3~{kM>Br*`s{;m=(L;W%9P5G zThRScj}izhdH{PoOI>${K#BoR;`Ub~aFZFi+CgIunNyNH@~J zS`Ez06fN~E4WcMs`uhB=@jXL`q$V)-cBAI%of*C!S6ouG zLysn+cl^siWv+B*!$0Kfcf5j^RT5`li=ue0%5b ztJYj=vPOhQBPvw$3yN(kq2Jtt^I$Uo41R4iYQ2Hu{Hc@fK>$iz-K*mrEaIluPUrZ; z#?2DP-7Jvc;ISoNl(0^k91lfkCu z&X?PQ2W#D~-%TD zLv#DJo`eay6|<2An(c>HZzmgV)=rZ#-tW4C_tAK&a8%-HY@Adl21&dy(;~+6v$D{S zw?A(mbFY^lm9Nho1G3fU4}TdHA7v7`6@2=JAS;Y() zJWw~G51rnV&+Xuc5olzcDfG=+HX{schf^JwM(ex%8Hu+Jl9P~MWRK~UKqPyVE3C(2+786YRVm%!OH9M#^6UXN>gvY9gGoEthKrV^CupNts?&# zpEwLNKg9beeEZ+0}a_;6#43-<7dYEg6zsFMS!23(8r>ZIZ zA|fCMT~8H3ARgC@oZM*p$&o{EX@EgRa#qA*5d@^DdWz3K$|sbbM~YZ|ecl4Uz;h69 zkn6&SD6DaW?P`Nh3W}3)aYcy{rMp?^=yj(V(O$ z^~&ceEJhE!SMer#&Yg5Lc5>`L7MY`R0*}$v!d{ahFWf@6^E^!#=cMTz5nGq*5G^xj6i{h|rQa0v@<;-xq<6^9K+AriN5XUB9&JS^uc(MN zOiM$@`x4MQw8x|iq2ZyDO;9b%sf@O*Lo7vIpUAPQPq=i;bMxT!(`>f5J?Gh#eNK)? z%rH3ki>y)R$E?0hFQ>NT+E|aD$_7#%*osagdTZw?7cZAR7x@)(OQLwm=zSUxI8yy+tDj zs>)8;1*uhvBP!sj+G)1MY^4NU0CuW-A8??bZatR>zRt_D^k&3vO=BMcK#W5urI6(G z>OV9l(o_a<>bIOHh7b=UYK-<`oVbpKbXx(c5Q4$Ut+fbgZo#`dUYZHWf&|@+^5s}l zhS*+^aOy$p81MG)Ol9txbdT2re3&~4I72@Lo&ovx`9j&jRo^_tgfG9PPvY$8LW1`( z>9gfBQJp|`B@r3oUm^zseGYps{nJuOJAB`Sh;mjwr5;@F@;LOCF^T;p4=G`&qbIPs zAh9Bf8zIiEB6Z?ja9XQY9{6U529*MX$m;VzM6_VL@wik^qtHQtGtVF^ zmCRU=SUE!HHvSLrZ^CYH2&R2jvT@&EMYnmJL?ycL-N_V@XXNKTLxD6v{`|>$LQ=*) z();j{zk36k8A~?-lT+`ft11`Ro5jDx-_NnCj{HSHNuCBJ?f;w>E zQ&CZAvRTha$+fC#oNyjoTh|H&f5`Ecf0=|Skq_t+H|(3T$zzb!v6y3rQ)q->45FJ5LA=t(dnQ(Y3JNB(WL zg5?ja*p}fHq;ek28XhkM=g9SENwX^>;(mwT>?2-O9ODv(=Yq$f>w@sD?j~~ShX}9y zmZd~}yJf63JH!JC2@EFSes*0b8rlJ({nDHm{Uj`2_qF6t-VF6QNC?;42$U^-cchj_ z&Xc~GI&EXa;%NkwGzg^D3X#6}?^N>pob2*@x1+e6X#oR0HOR;{pES@SaHFK!fAn;7 z5T1?r4dKysbsriVMh!*#C+Ze$ON+a^71!eK7M$WzG+2<}cJuw+ckcUNGLxC)?3}arv-h*s zXRRWt5l$->!(aol#D)4t842J;7z@DcicmvJP%G$%pKT})buf#O zV|LrZ&x^6n?w;Xb(=^pn=-1`*>yc0bROq*>GQR?xMg% z>mPJbOR06Au8)^jtS&=iLN)27(#Q<6$I4TE_90Q??z>+N_jU<5@Mm`h5@r!hFI0INV4bHS-{V0l z#w8EwQE0$0gwF@v>?9*?R7vq4u}JYGypfDj4m!+HP4CWc3o;#ASXdNpD<$tKZv3`Z$){h$oZq&%c>m7t|%OCI+t{(W`GcAJ%Sfc_<{8=YcmS4k$7fSU9(3M|Y9C7x9G}@Ly3F*=n8;ZZ!849j(59d@5R}zAk7%HI-gniS{ z;NIiVq?E4*JJE}>=9Vg!DRLX|%aSG1liE2W9U-XlOGcdF>G8ORh*jbj%CBB{;m3uJ z#ID9-?h+wK7KROl9b7+OpcCBku_MmgZVfU*F+oG2r(?o?&KMm}dbYvJq#ur^zJ){7 zwBz}78)Hp)XJ$G-jpO%I&s0l%V%c=uLC^h1)!yB+(;r#^Qr*mg@BBS#8P*2Tp*Uh$ zQTOmrcU;gFiBv*d6yv!aS@gMF6i23Rt8x9Dr$e6`rUwSxe}p{^CBcV=KXHW6-$K3# zkuOAG7bzcem~@WGvSl!od}ET_l*6a0v% zN_pV&xUNB$ZE8R|Gouo4FJ#j7u6B^C;sNb}td z@e=9P?nC}}9LSMF@Sn&g(9_7DRyMc(+3r@hGLFq&YdF<9BBmzLium{KMw!LD(YMO3c)uz~AkafMPpa zOa9U%4kLG{1z!1OOcQM&e%BTIl%;ck^@h@0&bwF8+wl=!0RAx8Dxs zqLudx&8NE$Du$UWR|Z^6tARr|gBqn2919ET63RoVM)5FD|MNn(Jxyc<2xa8_^fE6u z7k_ZTl>w?Pq2T5VYT^_k0s=&{Q==_(nwWgvA{6jWx%8#dOSIjK1BsUe6>&~{ZV}WV zAQ1)qgz*zuG0($JbgzH=KE8RoaBguqhp?c*G>f2=Lz;w)oP>x-f;zG)lxx?sQ+*aQ zj4fyR3Y`4tL!w2~GL!|eIFqqpkL^fYN@QZ|!820o+@J~n!N9SVRNxdZ}p@(OMd z19^G1tgL8VL6Fw@EebvZw#sKHUhzkxgNac}8G(@Mz zHO3w3SOae7*JWi9N%Xt4No+K)ld4t4#4r}HLphO9z=)c_Gub;kLo<1~xf!S8+WOo! zd+eDatw(KKSpT%5#0-lF6zOrLo-=gg`>tQ`rZyn;W}Gl|=GL)kZ0nL(F?$@^dGj>n zWV7DZee1k_b^i_=5e}iuJj|)BqFbaa-pFkf_Cu3p( z?-jFR7{-6YC|*y-WBiIP(%}eL2-I}Pf49F^DjJgP2hh!d$B5@f&|%51v4hOR7~ zP4eH&CITk^1DlZ&;ulzS0Tn@AHOeI$mdq~FxjLT%1RJIHLzsB3(vLi^F1^VyCb$8x9Ls5F@|x za~4Ix_WQU0=i%_28MLLxf}vd6Gc@nS$q%$&!ZHL6 z*=!`=U*_gzHLYiylb;<79?aJi-`7FweTt<0=sk$d-Y45KdIQR7h;#l~%aa(e`##%) zN0O491cdz#dG^QRBP{6ktp@T6{7cJPFC0HkiXKbfd$E4apdmM$H1cVt;-_n}35ElS z1V$od&~pOK%!)e8izw^ozI^EkeyLk&4h)kJ{$lXmOkHlH<2UeW3(*S=^-eIuFo>Y{ z9sVmGVQP8g<}X;r>&C6Xp-al&^+NeM`MvxQgKtY;O^vzRfVEL3>*OpGGb0%xX`qcm zuG55Q(4W9Fc4Ib{>THjw_|gNuCEgAe4cd<1g^s#p1N$?_ULZkCS6z(DwZ;$E)0!>B z)02FoE`!Ki(>c7W)U;y=A5QzD|Hty7(!}%xJ0p@G0ZBD-c8&py5`gv>H|P7+ zZ=5j%KR=BWKw7S=r=RtJxp#X{U1VfOOG|8LC&Jl6 z@s@L~3%`1%2Bu+d72EV`2YrwqU@x;E&Ue4H#~*vNB3&iVSyf5ZxG9cZcN7w%qGWN$ z`1d>@NdFll_(tDmCv%I-Br!+*@9H`7B#Kwpj37l5pq1Q3I5n+n7YD#Yn&5xY>R}|} z)mGnG$U^=8!(t*iCBx{Ox}9F`gFywxMZCiFbRI_a;mlWoku|fAh4=Og-n20ml=p~; zrD5vmigE-xo2Z@D-djx@(CUe}mfO89C}i=-NjT8UKdOJX?x7dpY|0xrBV{-jva9gu@ixAoM@enJ z=L3odn_?ye)Bq_dDZi$wY>v~LG`JzbD6iy7V{7-v!B{#Tua4tRzZq2owl)7Qi;)r( zaGoLAOK0bkh$X8Fb2M=X&fTs!u;=n`IbXv~O)46{uO;Lp6f{h4V4N%2*`FuE1#loc zXM}VUpiH>#adW*vC?bJjS|~#!qSIlpaz3A-T*a;aVanQ&H!fC>!7EVOw3AwnY=%_Q zkG(+D%WC5A;)})g*LEbB5*rpUlrolt#?yvC4c?vC!Rx zgbapF9Ud*IgrES!^C33@Q=@sr(C{!Oqfsx{vgdAYVKHEQQ~kmMX#Vlxo|x})1a8zYB$tO(RPC$8^gmEB2lTL4 zCs#4IV@qgU{TiH>EhI`VSBgTgD=Zjfkd;G4OZ}$L6FD9P85*n?Nl;+0K=3R*q)6+0 zhzX|O?~zXZ%}UI6xIp9W9`K4X+t<$R{CCC44T2%mhsaLl)x(NIygxHPhF&JNRhNi} zzMDd-H}F44S!Xjjo%&*gH>!vCAs{OmY*UTkdAh||&cFL}LgLFm0t6W3D&&Mje3}v& zkxfmVH$T@yY>HYqTK_Z_RdyB?c5jo2?;~hij2l4&J8FjWe1a5hFIR(MI6uoKieh3K z!AmW`-uZ(!xplzZv(<8Qi>{IG+`1PVjeU_?VSOJn@G1!cA8eziJcFx(0lOwxUCmwc z5fkUwWWbokh(G0N>~HM&SlLftN9ZRH8nMn~Wvz(@U+G$WeV(U2q+PC1^-9OZEr)SO z2}@qzayuRGZQs5muUKFb6F#4ZmsGbup?-8|E2QhPh}@Nrq@A+<`VCp7M^9B3Nj*c^8B2(^$Upt)vygS zuB18zwkc(Zbl%L^&d%-vxL9ik86)%xbc_V#ARA}xZ`#@`kHgA=T2iM;xYbUfm?Ou3 zv{JP$#WJ^pybQJH4rG_agCDXk{O|ALRaOb`4V9GGf^`>ScHPn~t$Oce4R!t|o|~`$ zRHmmVbJ`GDl`3yONkE)w^!K#o0+G>yBs`+R|H4dH!UdU|W` zkx>>F2;aX*3h^KFgFoI=DTsytVqpwHM<_9gB*KW0lb2a`Ulx z(*~N6WOf$0>I5s0q=1C*QbAFaU&tm&I6BZU{291!aw-E&dU1S*(gwl3EuqLhz2fI;99EkC;OXLHep;oo{ z>tHv%#Ic;Tt-D|v%HcUm4AC)z6gm+KTkHfGr%^N-25aDavak8;uyntJ2h1ZOWU1x; z|3TiulG6Wgdm)<_rSkI}d`hf$zj}Jnugdq3uD%yX83j8NPy2~S3EK?@C>RrPbSX6fL@ zJTaVgcg^=tbzva`z0eyNm|h6yhXSCc(vH=P}MLm#C#H#zTls3-UvY`>R3 zdoOxTVOf|`$<&K9Otia_9W}W0+6}c4sKcEa!bg24Z#2c&Ryu)vQdG70M@=i;AT=vD zDS1hh1MXc)N~(j1@kx(Spo7T&pN62H909?x(l2*z?r-k5TsBAa_!sG`J=ci;Qhwev zQME-U5%*4ntcyMN=pQToZ;gMvavAODv(4?KCAJd+GbSA$TY zMR-e!i|xJqqJAt4E-Bkv1Cmm~3$KGUsj1t&(9vUCbGopdhO&MtkWGoHJQRLe;fyp` z(8i-V9vw{;s!!57p)-_+TOc((8Tpy1u()_|ui>|%E)MDSiti7_@)=v9wIaB^O2NUJx zvh_Q#7=OIm`^p>FkH51400)PMWi|(vR!4clzLOvih{IDS^)LH$N49GI@5q+nwi4~02Cz{kf=Q%*?0`lR{xT%PV#Z(3PAr)#ve zzRv1k8RS;iSw4KxD3Eu*lscXD+xIhyNS+g()(lk^VRn5*^%KAFOo-ZFwLD1hK{q8c z>yxdd{rqr1;e%talrP?iEzWnXNc6MUg99H4Gdp{IZ8vrDO=}6eGH%N6U@*@Y zUbyb~!Q5%?87GzK`tHs;heG@yR~SX$^T52KM3tKaFbRLAZDQ%4nBm!2}iP@QOZQVn3dGfZN zc7_L2^Kbrg4};Szn}Pq5B5K0IQfiN-6>y{g>m%$j#i%P0d`^8R?RpQTJGu z&^4`D7PLYZtaHOn4y_?}_$^G8nbk_hQ_>2~r@OIK+NW<&LZHdoy?aIF)j(rOxQyV z9f)|Ko1#Gwx<=UQk|C2m94I65^=~We!XQq}k*kC@h~5Sr0pd%8$;NR|pLQD&EONZ6 za_z`mqNs}^=ziYh-zKn}>K%E6dd;V+b z0+0%+LoqpMZ-+T;6Sd@>xloW^R#(*&XUg0uVa!I~8-SmyQg&CswS67w;)$@21Ut zFWf)%Y)64^5zQqCZ9@?KNjhre#et^2TfS$l1y3MLD66aOTF;m(9$L-B(1v-8Ux7~X z_3V;F3on<8sT!H#9$_irrxJ(eS53DU$xUZyHjCW_Bp8XuS{I{I56-JHR-dNo@PK;x zLiTFn%WTu$hTq2zV0ApaP8hd*ktg~Udt2Zm4oWR=b3_S*$cH~z1VZ)8bP&r(9{M95ZEXsVC}XS5=v?72 z7)atBmP9`@Q&sY1qqot9Gl}oxhmOIu#xb!8!{=rfkGo>ovf2)XdGZ*vGpyhWJ84Du zg~%Z=u3>%K1LJfml4h*;$4T;_RY3_tVQ;dFho0@fL$CT!O7TeVEjJudp)GwDW|@{4 z!KjcRpz4IG&=tjNOXZ zH}PzSyaW^rS*RggcYu7@l+6AkWhe%O82BHkUs|8(e@v8_<~hWUiXxWrHBH zN%Q`kj5H%-V=>WILXtLKcD|DC2JlwfA00kkp>VUrG+@_iVI3T+Qu72*;f|GF<&W2} z^*H(OuNr1dQM#{MHRvIG>K+ zzJ>ySU2=5Ikgh7T_^n3u{IT|eaU!35rc4;4L&!8JK=wz~~k4#)lYRa4`mRzOA!Iog;#KJmsc7kgo@4ZbtEd-oDl znNMO?sn0zsp^UdUAnJD`G`N7v6J`{VMTc?3f)a#Y$RY3vkH4i*G4BpUjK0~Mi;NTL z%MJy6tiCpjE=BwSa@3EHtv`|~eq4sDpz-26sXzB3IDyQp{u%mC4)(3d?0S%pRojit z+Q3(qcu>9>kl4rCz%z=uyVBk0&j}FoB|rjoBhjA%#LG!!ZSd`7aHH|@%U6h$JS2mr zko48Gp5fUSCd^4O%T%BSoc8FZVt%MR%epjxLI5*M(VoU->mH%S*|5)45;i1t+-WG1 z&)S{~Mny1BZK$pe#hkgDK)E@$MC(AzjBL~Kr23E&&1J&xC}H5t-1<_{g*Z(E(OTF| zqvGhBVwTPX@QxlnH`LFd>M$6zPp8I_ub8FDJi8puFp>*xn?{~Fgs)%(~D;U zy9JJrjqyZ;X8NJo;2l+Ls5KvzeRWd20L5SZnHIwOEqmrnJh?9ddk{QamWb|L* z7zE%iWc*FZjlS454ejOZh?eKzr-XJmP{|E@f{?w>-Jmbu-=GRqv zBLR!9ScN~>;peuUl9qI4ggo6Ll9rYR>A9fYX%YR_sW{pN0C4!|1*@E7m8czIS< zbx${+cucczGqQWLOnZBI8Ta{JY_2UroOHJy=%C^kFSm&@6oPugF8xI{5QdzZY87fN zt^1$^@5xeCwM3w`t0$;@fIVR0iT=ayl=}lzXY)}as-_B3TLRww1qbV`uWER)=(MC% zkO>#e6vAy>Mo3oUc|C#IoxG67J@7|=Z-B`t>)R0;zS2iSy%i8w@Fkai&~s6|e81(d4y|68Qu}14%V$ z=lj*2vHW5v5)!{mT1S$EsT7SV=qAkD->SHwb&$lAcgaTkP69;Odm{AB2pd!-5b*90 z(uOTUiB*QO9e$b(-<8deyE)_Xrrh09!bFo|fi;mrbL5eq*gWWny=ziFvzWS8DxUME zIJT=rt6A7x@Bb^NnbtbC|K{}L2%Ui0Y~QSqM0N$r1BLHLIg9Ur?J0L$h*^#7(={zb zgyZ?iFI5gIkoe}Yv_kA^f-ll3-Pd~>D9tB%Nz3Evj*W(gud59wKV)J0g6_Dg3k$is ze115^EPy_zykTj;hmXE|nqr57l{fb3_>2-lql>Bc0p(}OjXxl%{43SW`bq*hE0Mt{ zNmU$+L`++){zhM7%lQR8A5PY0jx9#iX(yEIi;9or4zxAGSM>Kncqk#GY!2`+uL_Il zBtDUL0RfgEii{+f*;AK;fntNY1{2Em$2A|+V@nkCTU-7LsZ0s|P#U3A6EM`ihT+xY zZCsh&l`ZMC{~jfnUsvu#&s$mlYXRBG>Px`kaZv4BLeTG*=05$0^N%IOY|jzZ4}{UD zA2)?**tU3*UJH^f6L2w6ZV||mrk?=Jhu@^RxT04Ce!8ZvNN5fzThrNDXnlhllDEoZ zMrDg9k&PKeqzqtI)Ws^CRBLl(WL8#p1`=e(Z2pxcO{*BYi#tzG)MB9e4HJdgW<`r! zGmf;ul9vUONRxokOrhJaX#vKtZRVn}D_6v&BGNXNjj-i6{=C*NeT-X65meu;l;WOyC_*rI)t?4Fhezyq3yPX8i1pESSqy8)D%06NhY)k(l^~u z(+e@Q$=Lbme?a|FalDXOCm}?aaJ^-ox)Qv_|4d7;{zQASk!hdXD^L3+>=j0zFqFKk z7$mxoK|9iix$+N7YreQhmxq-0SU8>UnaXJ~M|E3Um)P-YiSSL7z#j|^bctF zx2Y$BXy%}O?P@QqkYnr>97u>GU#M`xY#Ph>3x~#un5Ctg`KT&u)7=0szN#(wUGRoy zaW*f-Pv6=civ>{)Au;P;ASaAS6qFOEpEIdoiQA0=Gv{+O*JG8U$yfRU9)bas4mfxH za5+@oV!4dFj-bF!g95UJ3c9<-Pa?Y&IO>`))n=Fs**El-Le98OK~0hiGNedzI-{&a z_&At$?&jA>Pdv6G)aXxYx(S|PRDUGh+4alh@gZ^a7}t1&PmfYJ*}gQB96W`8mXhEU z_APHy+&Rq}TsgB7N=s8pq0^HLwH?cxqeumc#Jm>i9Rg%}Hrq|J>8 zy4HAOVdH%y+BbB6C&w9>7$nV^IT3JjjRfrvjSK%U=hKzkGRB)J=W``Bi)LBcA;XlX zB+sbAlJYiZe)<+HwP2bY;);q;pdP1BOMAt!Z{Hk}_UpaoA}mDUH5Xp2eoL;q=;AA`LYSton)_5Iw}K;;Cw%CjYnb+l$M~1 zRY9?W)kwttvR=ZbDo&Kz&p59Z3b2bcLkZw2iMrr9#NuOUm>HH4ij1kKxH@cEPKQ0lPk<;%NxmVbFhQPydJdhe^>DV#9{9%IPF1stBDGPLu~koP~)4adXR$j z&?jD84EEW0uy*S96F{uzakQ5kFoN0hFZzqi&pNxofYsLD?i6Z)DiM<&^B_FI(C=Kh0eWE$R3z?R18vff~ zRe8ejp%N0NHCZ1`aQ6d)*+3XOlp(#1u%{oex;#btLD|o>@C}4V$l8ynaa5s@rM!>c z<4u$C!tkt)nMI$3E3C5ZsDb_ekE_onF|{h{S8U~=E#{d-k#T}5$}U;*Fb&EA7LJ%l_S8X8N&D?vxisd zkDl&a5*;@3^@n@V$2>*v<8yDm!g1{sLHNP#eud@H>zXu*2jHk0ZfbN-s=y z=Pi0G7aXvAl{I22xi^FQ5rkQ#I@55S0;Tu;e?=EUNv@gWe=FKIAJtj18dKhIWt1nV zlVgO5QA$SQ1V+WoK5xqSeK@%OrN=JVMz{$LWl|)t5kk;<2p0tKoG4pHO&QY*Be&yQ za*WEa6T4F!O-ox8br(}qx9{>d;AM9G;|Qbk zXbg6ruoV7G@MaPf+$2bj;k&g+WJjQ(0U#H?0@#Q>=zKsDd{m-QHkuLfc)gu>Ozzpx z9v-YJw#K{NuE#gnKi)r{>s|7Mb_6b_6{ZBcKo^1aPX3o2!H*apPY->4PjQoVRJ2J~ z@hu_`wd^7FI-|SPK9V65Gg$91ti6)nY4*`w1fsb(^&(yw+ZNeq2l3 zH@1yw!N6N{`Pks*B_peptk%MLW#6dOn@UaO37pR3#pRG(Kx$R!{{?wuAxKTdSM5D;u*mEoun8i#T5=) zVEr9DUwXv!3j8&o8?pVFjP%m+@%6YbJwGsdJGAy$I6mp=chXvxZ|Oq)`|wGc?kCpb zG07>>*_x@tPqLct=G9Hz{32h@Z)5_%{*qua-KJWw7nS2);_|2}oaM69&Va@M;jbgq z#{WBzB9G|FNy8yXM32(KohNQvo!_ggtC@)xsjIMmG5^|rI;}$V6?mfco~p=0fejZS zV9%SF06-cTT^iaV$9mehetBjbgrp>7b=AGz&(qgcM|JRh*-1gob*Gnuujkh|75bfs zLvHTkl`P62=RFLqgk+FuckpTLj7Y&t-tXDh$pf3<+I@qMub}D@cJ^USzaXlrh5Ah* zlkdAG-wq1=DU}#mm43n$T7a9emK+_0Ih<-p=1an4}=VbUvSf)-%&SjJv1st%@b#mII%cP zW1D|ti#Nwt;hGj22hBpg7KZvgi%XmaJ2Z2oVy8)uFHky!7fTu{qI42Zoe{l-gW|uE zSj|;wK6KQG8-&6twIUJ`yEZG&>*tRqz0m1EN%KpZ6&ed){u|d$>BNw8x(und%vpA6 z6I9P1@Z(HNNq8!qUziFc6Fwi0=m!WzbnSN>NZ)7;p%s#uzX9uRSrPh^Xe^;w zp!dQp<}o4ZG@%^OaYrM?)7^U%#uaqLht=EqwH*L@vy%jrwjh4Y77B zzEI!T>v%LW<@et@qmEoIE)ZH_2>(+RunVO{gua4jg-+!3ug&w=y%X^1b|>#W#U$_j zyxvpzB^Vg~-A`D)bx?v-66@*OlqCy%kTc0{*ns~@zrnJN7SVLLMuyprfDKdsps^E) z)x2H*<%?d9UVcy^g?^Sqb?bODVeLsGv?lLhFYJCLrA~|5h@^7aTo4vlyCQbe+$8FV zek#6;Gn2Ep?!F5`@sYwAXWA%li*1N~N{c@fA{@UYQi@DsQgJ1#EoOH)Hj0yFT1!PJ zDbji=MQ8+=fW`2BEZvS;dkLD9fb=Hq-j zj72h!2~=zVHS?@AX1gTRi;hFND=rQNS0=oy7qb@E4W2oe`3r|=>3XgkJ}bNk0%Ykc z5?8Xz+uJ#jIR4C({xwJ#=`HjPAlOv4)yeXXpv2yA44jnRTKm*asJpx+*W{Jw@Wulb)5fxVjW{HFtfQJ&F|np%$6aP#z&1 z?~pN@w#*kl+r?(mYnWWHxS;ECw7Isqp{0a%LpEn0!HY~n{r(_4W5`=Ndyjq*+`E5U zko&x7Lnr#6ywUt2Ls7YC0qy0t*mv1zE2$aBq||%(1kYC$7m$SX$AsDDyThj>Ei@fb zIKpZaD1CgqUv`=L02KiX&+f4WBqBY49xH20Ic2RbLu!gGGvyiE$q(#ZWh}=R$)XT% z&O)Y6?3hLO1iGp!e6*5_6FN~122Zr;?%Uf>GAQt2m$dBJ#Ik4|xOSoCYEJ5(12gG8 z?6@)w*|bQe4;Vsf;hmHxFeG`U1y4*d>5(;)PgOTGZWxhtg~D6s5i$%^?dJLw=lo@7 zep_#1U>-3)X}hNN{1}J5!BNXD1_xYoHy`1#ZTwa)w(qGe}6$I5b+3| zd3FeA5(H4vIE74`5W+EV-kENPe#*8M^U(fkQ*~+q?F1>?MCQIV>LkfS)I)KQ1UU#v z=>9%hlHQ7V*U3qDBgIH4HG(+YPv}UtCH+a^v5Cmy4t&vgt?j6V`(|^Llr8=st z40U+_V2kVi%D%G{!p-=!YDjWNSZs^DbC1j}at+0&AN5w8y4V8aN;2$?<)E@j=Em== zk^&sUc*GTi5l!K^QVJyiL8t3Trf@&ZII*TOb<0B1VR2l#R2od);UFHh=qp@q!LeMV zA27S&;qhgD&NPL~?d+cLkc~`AKV*rv9X)CJZ;__l8+)je{$YB$tBA$Y=@^hiB9vpw zL)=e?s35^hKJZ*>VTNLFPeZ&I{0~a_bhDYvt)YuH($Tb3g)tb5$%cNA_(yD`>)$G zv?8^cdDQT0b$R|7+$(?mDsYsGHL|m{7<4VE=<={SnClP}BudzS31yQgPjjAAkdvQJ zJTw3&B0MkV`L_845x+wCRopst1Fl7_;64Uk?5n3CGx(hG_Nu2IrBG8sGQwfr(qS#y zh6AHaxt`uUdrz|g5h0?e5cpQP}dXD8yipd z)~3QHk(sb~5pX^|JOKN$u-G)u1I7oC%zY69>Fc8xm&Nc`;Yz9k_^rv%5xw?|@@fg# za~*7L_3zC*%Bd$f!x!{OUKk5^E{t6T^Ll!E`06T9(a?(2^w)gcxcTs_uQAinNW|1l zX_y29DSnb7W(LOCs^yUgUfmo)Wc&e(SB^9Y)TJlcePz8j2Eh-iFY);pi?aX*epx^l z{?XBqtF%rDa@T$;ZM}`PAGXE&dK`G;fywmswU?Gl$ZX{BZZ86g8SWP`vO^}FnLB&u zF~KIF0|G|%?gxGEIO6OG5Oo(Uw9aI3r{SQV+5fLXMQ%xTO6u#ZdX=4Q1p@VI_!^=) zYIUm`Fbjj{j@#3IVn+p{M+ck?!Doyex+lRhAmJ$Imt#mpG&(2sah?nsjAu_xg!wL&I(?JY} zzJmqtwoWgsX1JUMu2fxj_v>UDvrEt23W-a1Qc}|V(h@Ez;>q`K;B&E=MIU7p#BQxL ztCAEA%ZwAYTXmx5ObT;i3X+bXH+u&I!~x%^^K{C&9RI`)Mu7MNZp(VZES zLbyr*O*{EBVb|B8BFef?$rY81unm&&^tWat^Q^0_Oi5}=N(SEE?44*DzyH(?92(=! z!qDN?VbYZ`Clc2&9>QXr>O)E`V^egv4R6!vIGpVf?_DpmwW8%8=_C&E{i6$v@g8%W z2`i;=B1Q?CxdLw1<%f_y4!8;Sy#h&ug`NJaC@Ia$q5s&^BE!#^+eUkQrzKBKy zYvtsVke_A9yUn23PGY}$=KY!`Rc={helkdWXvMIAycERpIs%#wIKlzUzFLF+epGDl zi0|nAi1M_YAB?f}F>^mzxE><=%Bq!iN6)^Q>xGDSeqKVX#ZVN1FN@ySv;X*{1iN^P zW3dmRjHi`ZQNxChjEvB$?;Z>7>UWj<^MuWcY z2_}e@oUZ-{eidU+@Wo(RZ_z+#Bi1=%S6A0Vw=V-b2rxW;l~+8dVN)L)JIlMgOki2@ z@cqxdr}w3ZYj;fxU`;5?>wZ(*WJ)pDzNLvq`- z^-slBT{JYNBCFfhyPh{Tvg0Y%cD6RSdA{W5=rp+Ogboat#eP9WBM%k^JFfbegzy=1 z-8E3hKWET&F0zxdvvhjA%X%3-m@?GyY3uB?2k>&&AFKjz6>U2zdN>b{;*Rdom2Vd- zR0*~^M1;gLvhqFJ8hosa`-+=hUp5}LegpNqX16A~ASU(t&en_F4(8@xL7Bhj8wVWh z;J4mz0`q2EdjHfGK5kz{P;;{$9+I)AX6(3tP6T{k7s79>o0`D1jL)k4AkbHm1jV0+ zUreWIb%F3)D%;WZq^hO$1fY8ro?y1Y2GYZmiHU`n} zm*<0ES38AmfXrC{l5mCMYDFsE3*R|te z_zOn|cRaAn>fxezvn7=oVk$vH`)b2prpfpH_a_ldb+wi$PPhGk9Sa+@QbRb9ZA;Ls z<@3z13cyxw?zJ4u0I;!WU|^tVZ$6cz%{3PFr916`qPz7$(z{^sFtgYF{^YF*nYF6g z_#miu82I{(zc-wtYW5M28bi!b9YA(>78?z|7};P+Tklg%__pjZDC&8RrL=*;&M4P zIX$b`;r4!#v~q+$>rUBs5F};M+;q+#{F=9D131Lr>hQTX_gjw>ICgYh)6p_cO3BYF z&N#Oz?aj-{&&y8N+L}Ap!Cfb_FUlnLOo%;SYdTzLC20fcpn@O1Xo`)` zOixbC^yQ|b8&tI)HL;uU2i|Dvdy!WK-fxzrr+-;(Tv<6fuR-SYapI4c3~#HvO|6yR27U)s2u7z?>9g31H{}Ou0P49nZ8B(gYA0yq zo@{kbieft))W0b)8vB4aS0#&rNvEP#6l^~CvGzzo#(#jgtd>gNWRu|q;}G&Q!Iq^+ zW}m-BN{@y#f=Nw+7CS+LLvrPp;?QTJf5B5{R5BP5z$7I<(UeU@urv&jAg3jV9a9g; z)bc}VEBN|MBl!6v?{%}!;bSFu{)MFRkwgXPLqmSQ-RWib_fM@2AXmr>yaXVtH|$Mr zs*!f{vdOR?7TOBFy#aOtf)c7!sdV+l^3qG5zJt-DI@FvS&eg1${bhHXn_FwY9Zxfz&p$73lHPvSGg@ z3eKkWSRx=!{l&)c+^p~Ds>&E~vuwWMiy}ir$Ly&0U(&UA1U#5Grr2r94X{uUGme`U z>MOQ8gHD&S006*rY|dX7L&mB~FCSQ|HkS$$QL)vvm6a9uXIc9|kU0N8Z=nhof{a`- z?~XPbHT8Wk-bm(A78yTy1@Idv;0N9GN7D;((!U#|wuo^qR2X5#&#FJ3HFF!u0Bq zOCWctammig{?30yXG3Bh5p_PJ@!tuv(B(9J3ZTd-}-sAw4}U1-Zfvupc^ZaJGM9FM9n6sAV!`Q-fLL>8g5BU8e9gx3IP&dntSlqY^o?e{+7ek^| zi{9g_GgMTB46(j~Kxfml14*V-#l!B+Al#!JIj55k*Vl0o5tZC-paE|vYA-}qz%YJ` zt>NlCzt0qy!h(B)D0$3o#Lm{au`%y{G(NC>nSUKaM0lWgtZch>S9lJnef{UwmcZ>W zMCN3JP6iRDBxYv|ig0c&Z+SibOS^{m_6U5cRibwzFQEti%iiE_1J&|TY_fkBw5Fq{ zA1f!zH--DfG>vwoT<2}=v%AHFWZ#U-+CPxHi#V{Q!JZF$9>z5Z&7jaw!pmi?KTk&vfs|+NN3N< z8{hjlsylvv5#hclBWN@3^*IFpE*VoL9cP@($;_%{sqb++T-oX>0|@Z-F-ef>&&OOI z^>qE23(uO@l`wuktM3jtf1D_xS0xknq~YTp;ucBG@M>;p+LB8!Ve7C#NFWu_^J%+x zw+BQlhKmlrl3lu}s0#3keM!tnN;A^k(*_^fT5_Iuxl`|7=DCXylbcI9n-Hg$mzwr61Ca_5mn(W zivNW(f)n00A&nAwAB0-o*d?LL5uZ|3vY*YgVtU5ni4&s;D)Sjt&BIa4ze>n|$~ z-byzFo3{}X!axJ8dokanpKaccs@^ZD*>DC<`6`$lu{ z>vh&_Q1L#=M}_Fzk3$$lt><+~;Q;2te@Pw$o5(%$SV&I<2^3=4-d%$gg<5VR_?ZPK zeQp=#8V{J-8l*>vod&9;V$b&*{t5ZQ>gq<3t_yKrILEx5Y{cXxLQ5ZrL=YGF$ANx1M9MfH0RaakiuC=UGI~pC|!Npc|gE?8O z2JY`~*^cK+zFzOZCN3jWda(KK6+>43y#X-D7xv!jDts+v%^@HnIzA>5@Vul&TT^Ey zzVV*OYZDSVbK~E4SZja0+cc{_6V1sp-f?Tj4KHC)c74V5_{B$4;P^Ni zF=DRzw}~vEv#yDPSb0`+P0;INeC?7wkP^JO66${6rSF)_@BY*ksX-zcl541Z-u`&C z#(S45=x_by3j=o4lqGqUt!cVh#rafluPj=Av)kdUps(>H>n{Xpw;b;(BmU0&Q_nk) zD;sC2)6)42z{+$a844PYj<#`f2xa7^w(d6?M#Pi0Cgut5>mf1w3S`*=Cg0b0Z<2$m z`9!3oXkPoZ$NpCDiOT~lDPC_k<-oS?0np-YyWGg6WLY_xJ_LrbHv7G$800 zOx2O{6*B815`(BiDq%xy)%+u(Y!vF7<>e>WQWcxR zpEQ#O4jyZujtF2@xC_(FHSVA>2B(ETy*hTfUvvqkR~fE9J|#|9;Jzm@iaz_;8`3bD zOKZIfW`xV4=kPh7yo6PnZF54u8Uj6nJomB9*@eFgnE-&Cg>`kw9c+>h;)S9d_^YwLX4yOeGSjpJ62Ho@k*=HR#kJe?C=rUJmHfspkF-+!%Vi#@qEZDpfTO*iHSDeM~ekD5H`maQ#Gd z{==ZvZ?1d#~Ntr0NB|>p6O*;W(}o z-{{s5c-~?U3wvKO2sizSWsb`ez6LS4wX6ufV?Um(-1-28;YsR!YN=Otg*4wd`u^^I z2iF`e{>He&r?IGgV*4&N4fiZyx4&tkBr$SW!|KxrLzZx~qM}jyq@cF0$NN*PP`oUd zs<3LHqEeexb)3IW5s9&Ka#^g*9P5zp=wi9X zeQx9tm&^Y$QMhd-TVj~!J@}|G=&%k#j@5Sfv5U9v%<4s~k!&?VJUp)4??BDT{rkZo zl`+U(Wo28x-Q|{c%+lPtwzK+p=y6oCzN#s00xKe}i(01mGA-*a8}E~w#iNn)*)SHK zjI5>Q0K94*-^-QYAZ~H%2>Jk2v#eXCNKL`hUr~MV-}rD zl7vh0eO~`>iUDC4Nwx*Ghekf?!x9Nb%lrABXzq>1oqmOtfnP1xR+pzCqWw6j1~>JT zr2K?WV-NWswiHQ_rHT|Gec;gDFnl8i@~_M|rv zIE+PPe-sE;Sx1%Pp5mMeQYM|9rV4wpgY}Pu>i=@B@=jfPlqmF@t&Hajz5JRC@q(ER z7qRM8W%$7%;sLk}stm5f?|VDMNz-P&bqXG}Mwhh0PIl2(wQ$f>&Es|j6|}IF?06)j z9v6yHM)8djybnXkg<#y{V_=<^COjAFG2C2c&Ow97RCHPa9ck3Sw}$E%QQpfI&18$X&UYKediSgxP$#}il_Ea6N$fcZ*q#UvONyS!mi=(C1H&pEA zNKS60?=M%)C8ddr&~h`_dkP`Jh1ecBU~AlZ6wa`c_(e(|VW2kKTjqJbQ|?Z zq0+BU$w#uicO*jCv;8+=RxXI@L8;VjDsX86sWEs@1kqATn{-FylDb`c`pR3*b!H8H zU7@nQTri71$?E$H`V|bqjf0j+D4ca>u~gP83IbEMh%29AsB6=adK&I7bLYM=2y?+Z znR3xDB8nXo&+`tMHISoe-7pdOZz~F&tA#pCP^J8pAVg^&B#A<`J`AT)#|fz?_OVd&)l6&YBu21(T;)@lurHG~a&Xy^_1d zH2FneD+c&9y0Q^QOC?0em>D2Pu(7ipd_#H%NeUIgr1j`=^~7^Y;IAtB6KTDy^*@G5 z8zZ1bCBU6fq)P?_#(?-DFC#yFb(JQZtx=5x$06&NHe(uG`Rw7X097&S)tHLKdh;ir z>b^r4RxiI%NZ8vShgjN@;+=!LcRuOtQ-`({H_$Xl_OR@k-nL}$0O1x z_0wv?7kAtAT+Pwfr`s@scf(!z=X(3%wD4H=*Y^h}ZFTv}#Rqdr!V_!9cJJ%G2G^>l z+FhTK@fafBH9s@e`vV;{56uS8z4N!r$4mw?^dnATEcm?h*RASFzq@tifIHs5pi9{& zF}%mn+H%}vD@{^t`>~jet{+TjF61>ercB;5-z~oJIzA+$5?nJA3_I??G6zFIYGMV~ z(fp*o)QzN2A!~oDl4Ab;Bh}fT!J6|pKZW7wK;;ulBs)FwS4mPf%+N`TS}tZLY~=~1 za?2PRSZv-ROJzQrojQ@onuEE7lWTK>JRGI3pi>f02RqGGo$A$L~u~Y$CO#+;504^wHlEQQ(j_ zd*WCx*AopX-wmZQJtrRh6?fVs^>W^@dS!hO2xy`R!?oZsa68Zt?VJv|^=}ZgC9dJq z2L^rN;RIv`WcKlJhp(f9^w`uQ(Hl&EjQqDP{24b5dy8B=7p&YluBYsGOMJ7v%+ztvF@45|L?TRv-eLyJ^GlC+E`MU}OUWxP`Ld)DxJ#CAQ&P_d% z0l9MccQThBVv_>X8hUP>2?MImV97Yf0VJQVo>D&!3bC<+;b^r66pAztFl9q=m8E8N zs7gaqyPyFAy^IxAQL;(+*{5QRE-Z%ZCYK3@~FVI1h zeWags&EJzKew!pHaoGEFU}4J+fe5KTe^90en_Uqoi7)D5j{_66YiADcFr2!yF3%h- zd5k^tWjNvc@K)4sBMWVjT|haN1T#hgEqh^2n_1(5&)6cJO3_aya||)e(rsSQ$Y^f` zO3c7E+`Q- z2thztP=bwUAo!4M-P`lr=Sj{x*e)$!P8*$|R6R)b2{kV>3VDD%@nKsc!#)Lp@H&rw z@zF$I8Y}nV!!{-p51-}+kzoJ`9NGxe1&!cGhHr{`eU z|DeW=Dh?UcSgijFL!kc|B+?JU2tMq2Kd?Mz+Thx|2!$Fqey0Z2a)4FBK^4*HU@@lJ z{yOT6V|YXtxFibs3@ZiLWRRNDWb$SDv0DE|(HTBikmz<^ucJ`n+#cNFdQ$@ZM$cz_GJu9lu$#Ymhs#hB(Wtk`goCW@FY%CYREk>dOPXL)1V!e z#x-UrDF&*Ib&ZhDDsb~jQ6TSfgh)k7Vz9WzDF4u0*>S~8uI!@Wn5X`YFcWb=`H4_P zC{YfrBm*{NT&~0(I30m1P9IB0`E1rli)xVR+|%8k)yeqA2cr=q7h*Pntg<_qn)yYp z$|Uti<^qOMLY8a5B3uzMfIM>Lj*w3>Hl2aD;N`nA zl{)x>qFs++nVkZ&jU~WNGDeWtM;B%C0iseru~r0MDH}yD>u;WU22zqGR=v`vyUcl( z6p(D!8?+OBq8AfN6lKBES5B)&i7cs4kRhxoI4JCKmzJqvpEsdxD9R^}{o#!t+kv(p zFFsX>OzA1Gro$ngZwX#B*OpUjFx)NVP`xwhn8khQFM3ncF%|_3jm+`+?H6lIdu1>I zuoaca_F{5Ju*P&dAJTkIS$33Ry_>g_5(GVCecCXmi~Eea}Ge|6fO9VzwRh>q#fer;g>PY>nXBb)aaGC{FGxGsMC2Q+_s%bFtc?CzsogtAc`rKhPT38qj*F7bpMs!?{5r z10}fLX9d@``K9}42FR^NL!P)8U*l@brh$v*vGWTu$?yvA{(>N@rIkLqd+C*ymiB8O ztqvJvv}zr*VJK&#E0dHbteSf4W!8;;FOre~;V#Wk9B zm#%%|J3=Cbe*;o;3E7{72yj94RVt-3+m}Pza1a^uGw|Ie7+mHtLbOS@z(+PA2Ka+a zJDZyiJld?Am{>!2lI#~B)VlZY;i(c49ut`t#59jv-Dd&-f(EcN1I8Y9)Kd&3bKMeh z-r6dI#W1AhT;HCSzm4CMg| zfI8~{X8C`UsH=OCp4J-@MsW|XJ(-LVLmmQ3PS0FStnT030PZIw(>kQEGe)WB!8H3~ zz}bd8@XaQo{~8FG^X-i4d4gpx1I8W!r`PCjZ@T^gD(LWLkzQP+$?LjueJ5nr|87hy zIz9^4q{EiENj*Z}7j`=`|3x_trorI#bM%PbiVB%x^(V*+cea!&4cmWrk!NlH`=I-x zI}>Dqb;P9CP8+87$*W|Ixb4DYfG8XK*`lADQW1oE{sq8j`wJ#;F8ns0R|?`Tw3%@w(fzQ{jHHTcX%ISNLHz zfyw`t8S{0>U*Wrg2TxCUL!KMX$64W-;^#&*h)Cv!|1B2qsCI{lGC36Lmn6V)5w#!& z>It%C!^h497K`H4m>>P2!1MIKXMtD;E+=P*eTMgfZCxB{Z~cyhy7xpVWrLvtsxC2L^vE!NaDMdE(lAA*RDHKWE%j6mzNAUD?O;>Jgb z@~Z>R(9nCgPbYgd$ci0cF?=XnxV`GONDE(vk^NY;o-a2)%mse>HSwJB_YWE)f2?2| zh)`6a|KF6Jfy{It^(-h)`)_R%^}NvO>Zwhv{|`NWmu$+!~$jtekt{+WcL?8!t`G`w1i`f zrLc@3yP9bFe1Js&dr+m5fUf;D0AW$*OTJH%#UV++xVtfM>WXJCW;?&98@-OCu zdx^hk1{ZcIP2nz4NzMA-I7iibu%U{=UyYG16<9`0%D9W0F=Xknew zr}wF;=BVVI$cK7T28I!u@uQ=M6UqIkBHt1eTXV%wz{4pR%^6n)j72ryusV{=AsQ*; zD5!$dx3!WUHbi#P6aYWufw2c_FBf?to;UAAA+_YeQ&lSz#gCOpnAf9CBs^VyXB(r& z2QLHKfP$dcbdgnup~U3(|D-H(UXGv;oKGT3w86#A7ZvE=TxM9lW8XVWA|N%sXO5%&{cT zGy@akkcMzq_xqsLC?qkCJ@aVL9R=}e;hgTq3PR?~m?q`gAhW|9x;n+Ufz6~ykt9Pt z0Hwe{eCW;+b@Fu2vs>D*GteE6c?)N6|d zAsoqTEOy>CDDqo^F~n)TJcqDZ>dx7rIpi4ZjeluU(P_toux0Mq`F%jEBZ8V2k)MuH zHA9y&>^U*##-u>v}{Dlc?^R4S}M6Rw#s#dZhD)WRZp% zm1C4!Oi`V-t4pe>Py^Pf^;d(2Tn>ZC1OrP({UzsYR4tcIdB24pR155~Y{&H5% z!%p-}nt!yTLzOc^EP)R{(Mjl^|w?7}6|+w9UaDPlwC$gq+X;jyG-F^{Zhz2-0PIe$39F^e&v z(&f~ZG|lp_$3*PWh#igugQ^|ODv12FABpC`CQ61* z%2{YGLMzD^zx8fTk=-Bhgcb@EZ)q_@iYbtBn>eteY_f3cTvD||Jtq(2$9Qohf*d@; zWS`tpW*3(32C|>0U81d4jOrE$(H?&gd&d|&6qp?7*1E&6p&~oFND(JdJHkQSC5KRu zbGS%*^e&jd3|maimli5Bh!qgleSpih7okss=~CdR@8iD0l+Sil_+mQWg^iqqFOp$| zh$0!HE+DIGWMa<6>BRMM&W;s~PsE{fuTb5i=|3HR=y0NO0hP+jB^$=RFC%DbqH> z%>x7zat9xK)nE}D3+a7NCZ|;%AVzV2YH-DWYchwjXl!Gfq!gh_`Z!tB3_OE2XSUnseNRp1xo zX(?OmI3m>YlcP2a4Cx~G2SW^ah$Fr`q7!v)ps_%Mi}SE1jMAk2f#A)1ikIB>(H zx3nwES}`+7N$FcWc>({mox9bot*vi8IZ1zErD?)w`n{L_sGKj|zIeWE=Bwni7|l#= zqxU;S#g)G$eS2A0_oAzOc)R%m;bEwr;-wTB`pVW{s0Oizv21$w1vaF zM5xf|y_l@*@dGysQ8Y+x_A3{rOq?9H)+{E)q?5L*yWzD%Cm_>||3d%Yo zGvJ63J_i$e=yAY~@lcSIK;(%5hXcnK-u69}UZP1eo=Slc4MDk^Fc>oEC#3u|CtGPV zm@@Kju%2XIU77h9_^zpBpv~fbRndqGkD&KM-3vQ6pUAYa?%xe$TQzaXuyvSV9C+an z8gcQ!f}@uzSL~>|vd=nFMY9?S;+UU>SIARh8Ng3Cdtq=TBBVql1ZDJ{5!_rD-T1|h zi3RpG@AOc*H6@jWnBm6;i}pdRRpZ5f?}50j7xPxJj0sPpOAvHf-8INR9k4SxM`Gq_`) zr^5y0&V^ADC}NV0F}0mnX0lF2)wePMDuW1XXWd0D}e2)E7_}O!P>2ldf z6|g)xAVrG5L+6?2ZFF<<{kAEFvb(iHh9di7hE*Ipt~}0cud*+6*H&K6TkkqOI2f*{ zpC#~DaK(YQiRmkFqFHl-Y(li7?{SYF!}Q#r{mX`&%xg}q5=W2yRmpofZP=C8CGmiri zn%yQDaSvH_Y=SKtS9}K1xg;Hu{vC7oSDyC%n>%6IbH88Dq|>dO*BUppsA|3F*#L#9 zo{`LI1*sL-ISn6R`sOOeQ7O<}sk* zQW)eN{F({7Y|0+t>Fd@sc(X~LyUUi&A9bzyeez*P_B&n8WO2vpbe(8uJ;pPJGbPP6 z4%i9eM=q(dNKS88XyLaeFX|XhVzO*)WhM5WhSZSFev#=zH=}khcHZi)eck}9&0&fx z^~b?yv>zSR@}DDZVMf1Q8!3UItCCLiBUE$Fi1IJPdd#1`1>`#-?ms&9;h{~;ea1dp zzUdKtTNUkidSV}xkkg`i75?pO^ta=FBXJ&dNv==&>*G#-WcXjgv-e#*5#NJF?}%)) zWWL>SO`qN`Tx|I+n#feTz6k$jz6RmNsd>#`ijJWYrA$C!u z?s%of0=^&nNxmT+nLh0cHVWWJ0$e%6-341-!l3Y{Vm^Wy>-=8=dcSPlqV~^Z`xl*o zt&K`>)zbxQiXXqAQ9(NqM%@T$JBzT#+aR9dMmdIWS%!sz#9cF_R<4T-oR(TP%I|tP zHas6^wD?8%!!HI_k$}DF21cn@#X$%h68bxWeF&|1v(19w;5jHWYFruh9jouhJKH7f zShAhT@Wh@B!Np!|+XJyT*}QCv2Z#}&B~lVQsa*h(7Co3V@p0#-q#t!;3h^tRkAa3} ze$?9>mHHiPrOqB@h38GI;p808U4gg4lwk%y$1o3`$|^U?Evn|h&5{>}ONw0Oh%uvE zjX`O$VjvXE)F@FY{4DNVEROY<7Dbx!d{BJw_05jY;S=WAlwfYo##t$$f1I~={_$6a zSEcF&DDa>0zi=i)#-SL-SY_Fo@6?);hbA^n4A9}EaJPW2o6jV*%qdTOD zeQ}m|C?mE2Pp&`bIu7C=n^j<2#R^xu8CzhlmSe$jrvIu5*^&jxbW zU+x1gUe7@Qwsq}`=B~n8dGk*B#HuEN8fMr_psi}u?DhE2lH#h(@yf?->&(2v+Ntk% zxV03M^U@I!*OCrxs(gBUnwLu~2}@f-%X=EIt)kml#gx7}?t451j@xu*E(xa!AfBy_ zn2_syygEB|cXzMAL~AL%@2oxEX;I`{+lc+O(h#F*;ce;hGB z&4sk1k+YXm<3Luydy&^F-UMs^PI`H3BCWwWtb%K0S=({s9ssIAShtxd(q=(!-V>r_~=qh_&&E+CEKYD`S;22774poZ_4=AEeGGYfxFr-{MRQHp$6C8e9_9aR)xfHHsKyHan&|BR~3 z`Fc*$g@)N>UJ|mWA;A-^cGU-h9)V~J#-d!7-Zy<;$vv6fF0GCc^lyMuyOpC5RfH7) zSkJvdIEQ^p$EB;Q-Q%VEGp+H7G0E$j6D0&5Tz!LO7F)O0`P8`ZX~XQ!`#nK;*7c!m z_oo(Vy{U8hF@Zqy_iV?rPM>NI{QaxFre(!_m2?~&D}zoSll8Y3Uz{ov9W5x&C=S(J zp{&&8T!5+i{5kDHDeZ@$kM&?)ak>M}dWYxsz^!m~r)%dgD4wRuO4CUqS$O!p@HQV_ z(f1I^L6tqc^^X&yBF+z8kE7ZvBKer89v+Q3f}RwjqMc>*$0v^(A9ed(*Dl6(h7PID zf2=A1w0@ia{@Yj%V~ix9%2K3M*Z$=2P&=UN8Eq?*?)^P?|8`jYUQyP-fiXij5TSCi zKBE&*`m6b3++S9vbWcGM$!HDqxKW#YKf>6PcX+jxgXhs6up?pPJe+&eKqS~?-|71Y zdq3bx@Ial0bij%ad#F7%F*`4yjqS8=I3z;Fm@wCQaJInJ^5J1=CcSE%X=rqEa@6{3 zh5grG0T!e49o3-Enx9rUxd7+Z&imXyv~&X#xq_Z|Hc_mY;O)d_OdSu$F&y+8&T`|7GlBpqoYXd#I!Jur1Ja>m@b`Ub!BNil*f-y9tz& zl&0ZBCwe>ZllPvqO+)?oy3Jv=^+EOh;`MleGisD!`RN%TxT}mi((;py3=+JbW@{O> ztN3!xq>XDTj>KgKZl8f{k@E8DPVWX#xvNi+DAnl}vVK!O$nCm21TH3_=;c>s`o!M; z-tHdu-OUX_yc}B$RvZw`=GcV-g% zt~nh$T`>gXyMw{q-J8L|!G(p1KuX)@CO9wdY3=T)s_Ez`>e;a!#7jft>JeaS3g+ZI z&of3FV|nri^W8=6#0SaHlzEj_=L-UP-KS2n4l4|N0b6!_4F+1y=d;7EGa9aq?x+!Q z#3BEcsr61h}|!OmlJy zjY3M@mbEd7?v6tbhVMf!)B_1EoLg_hwG-jY*>`BlWx>s)k+N3d&lAKx#clORV~X zaXVO9f%4~FiM3L|XG6}*;cBF|7m!h~$R3cXv=SO+9f;Jv$Nrr= z6*okW@C)-k+^_!Giu)Qc*q5#UXO;^!^gxBdXkqs4m5z~t&@p|7Ot`@lj1%M^JqTT~ zC+fU4lId!_h+Tmw9bLX7SfB;naeSzHX-PLs+?=DJiaFF>8{+rq2}o7YIfKW73S@jk=L^&p!+Q9Y~ELlaMekh za|a}~n|6dy*cs)a)#-*_-GZPgOca?3lJMGM8U0Zix3oUu)Ss^2yyE zcl$F)kq<}wlyx`PItFD2@U-5#Nq*7YI0^2`N=|hm-i3!|RgB(&E?wTmv^@g4`zv)> z;)^PSQxpdQ<0(-NcJG(P#;n$}1l$Yh6;6%%j?>jtPsKRmwa)k17BIi(6VN14A=YY? zqAuwb>5V#KR}C0B?2w({hq^I#n=NN6eV7u2hf?J9_h)t_;p1g%;+vhhe;O6ke-8K0 z%KIK}MHe2IC*uF7sHpAtVc7Zm_M;-N%a!7ltHWBe$6Mn<{7Q?qC@-(`R-fQLi}CRR z!7X!yn(GrDnVo}@EO=%cYhNYT&Ze9!pP1jp#PMmIs8ltdgdmrRz9ly`lh81SWqg#+ z>8MWdM_UP9b&k+mL2D#KNh`ydWvBm(%cN2e$QW;@z&eD zVC1}@ssV|Pj@atXrv1Ll`oqVtmi{oe6EO^Fpi;thfZ+8+hF4>uZ+07BziCUcuuZbT41<^|!!9zN{?la z$TkBPE_%-C^YiohI&1as-~Eq)c6L9Sn%4G_%PN+qr#02pKdNGy_yb5iBP(luUY>!0 z+j^U4b#3hj+J(cM+Ysgb()7FT9)7HQ9abN|l>wFCNvkHFulhWnzAuXO%K(4GXlaBr6z|l!p-1(_uC|AP%B06bqujT< zXm*+(g9q@fCec7Mqd~eo&K7Uds0~nzO5<4YzwY%r`kyXQMW~w16xh^WMIH6Z#+x7q z+^cLBzS8aGIB@S(*);y{?K|3Bl_x6lON1UJi zZtQ-vx^=Q`FV9cPMj6_Sd%_iyzPIQ9(Q(nXqS;exOzK6 zv^ZVPApAjqXP1yLSNtRCUz*Mv zXvLN#*a$S@+^mdH{By0MUy;?DjymDl=vefZ0?+Ic`K>UW_et($D+u$Q~wxz73j=3}#iFQyO14wj;MfenHVUSQqF!q#8%I7t*!%P%Y}^PE`p_$JKZr-6{mhCA^; zL%$d;)Yf7}8r_eB6Goo0Hwl>Wm3q>fr!&v@mEw-~VhhKzDz~a*s;ElDzRwq9W0b;3 zc<8Ev1FFU?23p$Z_@paW9f5@S#KrYq62*?>WjD%iIzrg7EMdKCK($d{s=+Xlh4XZ$ zmjaUi5PPKXATAHSOdh-=6*ltfbm1?+UQrOdyL$slbM%uZ@k44of0D!kxrF*9)hLObs(972BN7UUvD@ zSqYKjV$nM~&QDeaQ9-c#^XVYp&MHzOZ5Nu44>1ghVgt98f2xdbBP8{hmi4qe&khiO z>2`;%&CUCrEp93T3QoR&lEAUxfQrgi|C6ptz_LM3=^jqgXEE4EbsvvDA)287(JEqX zxuvBY6efgi>ZraKi=6Jr@&LYok&#ezf1KkSWUs0&{h8aE(TJ}kRSddJoW~lB=lSDS z^oB$j_95!jo$HgfzW342Be?c3XzL!f{m`0!f6_=I(8G;~RKU&B%S~iV`8#+aP{JX7 zdv83&-#7j#jf)`shed3B_MbD9BmnjChsv-PJK>3ew)-{tCo~K~rV$7;t*-|tj+AuK zE;I~Te~jYd;wx@0gXd>oMuw5JcG4Y&%3tLbwtX&Y`qw5dHf~N{2WuT!k1hR9i!*CR z*{S-U)@PMf8KtO3M~&!%uMQ8bH6g;HRs*zwYO^%l)WaOsY}@ib=i;^pw3RAu5cC@v zXv;$-pWoRHcr&l=c)A*G^90?_>jQCe0lRa;tescOqt#njZG*xH)u5-Vv-CfmPa|>Z z#%s5yWJ1QDfK*3|De3Bd3Fizab>^7yP*T+KaV0<~xp>jPO~G8(zH!rSS+N-39|G9< zlv|gEqbg~-kE!s?YV&f<^X>1`S{c-%X){G>I5{oh9h?zWRh8S?+1;={&3@DFqx-Ykqg zwQaqZR`&*Y_ECmKhMPN`!5a> zG!3*RT+OIvs`???4AqnkZ~JiqJts}yyV@jrP)11b7kv$sk#b06!+I!lOl) zd3kx+*iho%C}JWk#$MK1=PZ~I4GC??jjdY%yC&e^!iM1OdUUYsPbR}ASnrPSQT)@jk$X*RD`sx}{qhU>)AVR=jDq4&+$$qCmO6PqAs zV+|Xxh=_==;2c04KO7_qJCb;`noJ&;$6JzPU@m?!J107`{w?f%Vsd|guZM~HFbznn z-7CrE2Ddia&0falvXygRefo^u1>a+N??J8`7rV%GfIiJ->&iWX7h?g63i_08(rB^% z{^IX5TIpIlj*BX{NV6|H%}nJ1#V--Cj=l75|4eD>l*_uIo*1L9Y`H>l`4{4pBU--=8EAbrtDy1e2Veiabrc6(ue2LM$Ksrk`weqVji;pXs$x z)Y>Jg2Fx(K3YW?^pTaAydFx77#C6Q*4}Vv$KVRjQFTwtT=9^AVrf+I*W(zo*-sN2r zaq@Z>TwpcolYb774#7k$tEdJJVE#U%lL-5rTy#rn-KOdY3_km+k^xjjPwBnDz7 zsaKUjCCksGSwQ>2BXs)Nhi~Wl5$_t= z;e4@Uf2W+2@AIls%O%j=BNJ-4AIsE$el5m#D~m&UYXpdg#pCqYdswD68-hvvPRb9K zfo^X2gT5J`of5DqY|n`a2@%5%R{!Yel8+hlet+^)r0NZ+0Zg?1Sb-y2j+}eb;wHx1 z00CMFZ4tQZ!pYO#uzrC^rb^9;V1$m24mub@Gg6YkuL|52#9;T|$^Q#Q?*G<2)1J2W z^B{lt#Vv6C$(}3x&8(QjoU{37@u}>5)54nJu9HG5HM1Ke2biHz(LpD)QgkK8r%C>a z=7gUS0mFIIf3qHTRTJXnNoT*24r)>Ifsa0^qAm$a?Kg8c3T3Fa00Z7S(hV}<^$0Vn}g@p}YUpoLL zCAp7}PrITxzShB}2peI<-UU?1-jpxR@Yuj^7@u>7KYQbjmkilpS%hh2f&x!&01?F( zCdr{O56q5WnA*Ep?HgRNMP(mPh+9nmTFR1wh(lBOT$SCMWUd<(vK0|*`bG(lR&h;p zVn)Ip3&UP}X;kp_jV9Zw6#opAn`150bhUH>I={Fg*?c+M#Bqb3`mObD5iF9d1IGfA z12Hqb&O+Ivj)NMF9{7MJS}qLkDG}1gI=#YY^t1nO~3cBoKw z$Q3j<j5Y>KEUHYndeay0i|afBDD&OJ-4%05 zK6qy-{NB70IFu|nBC+|9dfDOTZX*+iN`^oUF9h6(lBmZo(uv|Sh4P13K@3Wkd5nN+ zBM)Xp>;IjESPy8F;Y&R?U3=e35bZ@CvKk7_lc5PRWhB1;EF?kmB|Er;J*j_0QiP#B zucpVD#-<-dGT|LIiDa`MmAZ{0KGiEjSe8kK5C$m*AwYGPQQI5f%QzQ7X7isMdhOFF zd{-p+aL|@2S9*#v`Uy$m)8@`b7yK|LvLJ21E*{?vq&-|WB!4+S?l_wWi~%S1C@ayR zP4Joo2|3b7yTcfS;hIl+dJyWc-c@vI^yAIiInhl)DHFsBKbe`V%^VS);xyzT5Sv-0 zvY7sz)CVuNnrFDKKx7hT?ZMbxhvL?Eg{qm`ma0+F~Nww zEm&KzROpE?-!&31$XS8Z6dsn2luB?7+B#q)&W=4{QXtb**VED=@kF!kMZ_k)7{mT# ztA-MnKw2eatv~Zq&Jxi~o-%m^Y5dzm2uBgMx8x6c)22lFA|+SWtsuKTe6?7{^ig{* z$klN5Qfe^$ZA81%_ecb6LjQiKK3<=o5i^imHRPwEPtFzf-G6MPclA!URHKrFaAH;W z2ykjzqg8~PuL2>Zg3uLn@F>GohAo1N#^|O5EPB2~1w`uI4*>#7X7gWL458$iaBLM} z^=~%H^t7=V))$BkOU1g-w9?7fNKB~1V}n6`UN#zi0D_Jf6VMN@aghK0wMy!rnSG+w zTY>A4#VKu{r`qf9Y65`cTo2y-&)t48elROxj*SjC=oN;?sNsIgzfS=uh>J4$!`q!u zzLzCJ%Gbqu`T0wkG@@AiIWlv};3$F{Gq6m`Wa#+fgkt%L!%Aw^WIZ;pmPR~D=bFL0 zo+)IHgb4nUM2--D;E1A}I85N|Q}Jgh7ffR%d+g5-FV@}dRR2);;cv8rd%yUjKUfG_ z5@KO?HL0R0V*6v0UldR1E;H0w56Za4o_Af5|MEWT;$nxYlKjLhUey;fq#!)5xs}l% zrJc}6CzrxE0DqqvR3rl%BNde-%v%hhyYYjbKp9xj(U7c z1pa{{ag9&zZHn(_vw9?eoZ2u?o6NOCX?+gLQ4$y z{r}jX;!r>VfWNK_qzFtT-Xqlt$8(F?B74WQ|BQwCy#J-r#(tTUL52)N17$rpv4&ET zJzPAS>Cs>l!@^&W>>N@Cl|U+6U}1WoJY*|PsQ>dr30H{4=c0eN?l8!*QoIU^J$a8l zh7sTtXh|kfCsYaJuSg)~UE#wQx-LkDX1<`5v%`aQ(vVC(Mv-ez>!y6oFfbcue_-lG z2?5UQvp4{ugkDY3=oalyLITvdOL5)Lt`PI}lu>2QvhyPdt~gAasXtPcOtP#3K5$x( zSWMfJSA1>|#?Dzt;@Z*1Cd7`SdPCyNB*6_wIg&E6p0b7IXC1weevA2pATv8;IV6N6 zKP*puH7yKl!O6{wSWi}40;eP+;8SSh&ZOiN{Z}ha#gIXQ79_zgo zXU#{O9#wHm8@VX4;Ji;YY`=Mhr;|`a-RDOgzRLL3RX+g&mCHKV+4YXI#`#of5V_4&@M&VRD_)VU*avj`6Q|`C`miZN;C2hkHUDT# zLt<5M=Kf9)A14jO;;!S?5U_~z@&Ayays}Lws(=5*W~85u!%ZM=W>4~r-lth6{&h9< z(6`K4$fasAsUk|@Xk`3futz9T2}n}R2UVba4*G&+`DyM6iZZ<#4CqQ9IQ=HAP8pOw ziRPv=xxbY`?>5KeHnUoHGC;C75HV9^wqS}Z`aJR}$c)6&zNsYL5-!7YBKL-zk#pFL zQIw&P7c9b?0&R#1{b?UL1U!iK-VTLMNd8S#{2|*5m)}3mcSW4i4ce_oq)O`Gq!{U0 zbAy1jJM!!b;Q(;tHQ|qDhFWN3*B8DI4$9^~m`zAH{wA7}Dc>brWAf~O`4Vzn+|4(O zA5pWAG~>_nX~J*dXQ%t$inM}DAa|X-hBdUUz;bg6DoF1E<@jPRjK`%zFid~|Gb1-n zG0}b39f4{*{ENw|Y73h#ZHp}%vz$7lD&8!PS(bjkE?3?Wil-P8?<4am7#)oz+zJHY zXh%W{A!AH!fE#y^Ebc6ve}shP_AX_!dRNGVk)MrUOP^=wMB8Dc+rAHK9w&5Eg|{?)dvbGE*0#w1^Ah+6v^sf;Z#Z~Jy{>={ z$zxZ~Hj{Je{ybnOTnJBtVu4=$KRPWf~pr@K2^s2`-k!v z@brt}Xj2RAq5bkj>&&NL=NZBGBI0;x3e#v$pOOpN*aQCO{ICaWCMtq*t5py)q`2E2ECHRyEzjMC>=*qm;TKLME?oBzZk$hzAH%v zu%o$cZ{QUfLo=iPPT2qcG#)sU8G!%KK5@ITk$c4YedLtW;8eMemivEJ5T^dtAGpbI zYaB~JH4U8Z^FM2l#KkbJGj>aYH<0DE9sVjp+iBYBz# z>-NHMZN1<1I0CXC*~?jbb@Tt(W=P@;f08a#as2&nz5O`;hV*}r09`v0+{`xHLJ++Q z$=}6cfC~oS+~35jY7t!4+k6tj7r;BxJQw&Tc)q2z-+!jmCB1cZQ%8ao*CB;17~Xr0=%b6ADV2 z$VCW8On0$OzE&hb0%4GygVgz>>SlPY<8*-j@uB8bG5&7EP2iC;kCEY zVI&?7z{nY+43x~EsN?sJkvCtB4jn43LNW^LhXKmQ@MUj@7J3&45Y?1%y!+ZiM&A(NL=npgDl12*o!nR}Mm89IX;2F`ww?Mi!n# zpJa*k??)QY#M4T>27fnNjx4f_FCY&Bp>tN#lFI%d8gwyS{2dFN83_7=&tS*`FzNw> zGylX0LJuPg6MD2X@QOzOrKM}q!C$JDW`}-IGtrX=aFP3OfpX?}QM&OJb!vvnNecn0 z#$0^#oplf?M;(ZtZbj!BKNiXFh=91GTp%DCrkDg!Im*Giw+th|Tnj@5BS)dZe_6G~ z1yYd1!sDZ~@#BVDe%=Btdj1>Jt!Iod9KbvUCqY_a7b~Xiv3?noS}qi%n!^;CZv-X~ zPW}YGW00T3W#o)28b~~%%T~L~oekjSdXtDAM#K0)8h#O;d1JsS0~FAYAY$GP=2>1Q z_`sP#lm;oxIoT(P`W1@xc_YTi&h;Z@qhxP?5+_Pl&nYkR1Ci=l`+!kFGkEQ2263Ry5*k2vNv1t=H$G?xGl;FnBMghKafShq&ycqzN2EUvRRRB1 z4I_(7x8y^CBA4w326`eGQ2EOuFn)E6>d&K>L*okigMeU_qou&#po!9!BwF4L=@Db!kQYag2H<4WBR|i6%8sILb3ql76jwinwttR1Y zK@4n(u|tqE`%IJ`%2aIt?be%-)I>Yk(<8ts>WZw+OK2Z9F6<+b;P%>7Xnwck^ znjP-cw<8(6CnEt}Qqdnu`=Q6kcXxd}g|5<0*QLOnk0$mgPyY4>hR&YeDn7c=sEGb@ zr;c<)(`JkNq^0`hufNRe`=Nj>{N$~=5qg$3(^NN=lN62Uk=G33j?5xJRqYy>ihqO* z0aV4R{01XNN(jOvc=aHraItSF42(*M;mnMwcEvSj1T^3t(=J7;5P!-MRox#axSncmjMez81zk0z2kF4WHEifF72>424+209G8;9f=;%O$C z32#NpO0V0KS+|)~<`$!=sHo7K<|dEh$3>!Y$)m--^%KcgK7lhP7g?436fx+M(~-k? zp;1lf@r`JJIyedi1znp?b0T@T8W59@sKs8ocTA^2dOuxmWN&IoA(4;ct%SjBf> z)SW0@Kd>21UDJUKZh`1`KSrr~}0S-dxHe8**u0v6A6o(3IVAShv&mAHJ4G;@D z2gGr9E9pVdSp>?XY&tiP8Atu9Iu+k#U>IaDE9pHUtkZ=*)2kHvKl2RPM4}818Nshw zAvRfYYlK7MoJIxyd3evS5MdQYfgYL_e$+|@Rk>njjVLGk>88_HoMhqyh44+_8|-n5 zC96H!hh}(r99K2#Ha_WPeOL&$xRxKjY1|56#S1jvGz?dT$R8?EFd==;Icg70i-!IbTYRY}69CR5>wGQadH5(%kq3zqRDi zqhn)l)z#HiRpDtwaLl`!K!}0@$@kXzj+p3ZdgAo+bBA#{*uw)Hd@nCA52v?xre|cJ z96O5wfxuu~a>$Rgw178vNJvQY*9_<|`dDLD6hY){a;nhZ2so~F;^N|Xl+@HoFh6<2 zaR81p!+~o{4k3BGoTUcr?2I>Ud~Pn3Lpk(QajdcCFI{&wA{M7&5CE}6!^sL$m=#lS zF!&WD1a(~{QkJHq3SSl_TLXqHs8t}bM#m!ZCZ)3Y+j$@encMsskS zFh{#4;?J%6rt6%nKX`nzN2`avics%Z<)Ow@%E+!9k@-efY7ik=y zT0C`hXYTv?iMjVDGaS#08Y&N4j^tiC@o#?~I7i<-TI%ml`OOzP3Wxtw)BdChq>1ed zeE4{P>`TSoB`0r!TiA9_HXIYJsdr(KVax)$d>ND$9yloTpQCoabC@q zC@%3vfG@&mWK8V4*AUs*=4ddi>u=ineOgZQ!t?&Gn@n^ayIv9S?a<%VsdipTF^N}# z0z%>vqI?2EVxn($oQI=uZs4bbj6u@z1I4N5fA@33tJmWP{-y>OS5H*u`1G&&G>Z?x z5zz_SG3ViIQ8jSU8_KQM+qZMwtxk^4JtE@4X*jsJ@|#AqTb~N)dHKSngu~-wNpjkn zOyN>C=eb^HlBLm;cGuI3jZU;g_1Kt+W4Lug-Y_umY0q~WR3_WY()WovVb3+x0(Du8 zZ{H8KZ}`#dr8D=lk6E_e*A)SN34ud{&L@|#k%mSg_a}d!s-2xa7M2jy2VJH&!oqLF z1SI(dqh5*rWI>G|IzB$3l;=)!+Z*Of!*BBzjGSQjKE)@(_bTKuVJb!>?MF(pib^D8 z?QXvRXqd<-NDNcrqad6tJwpc+e|4~ zjD8o3aVeNX9x5irE4b%88XFrU!rb?%HNGOiKX+YS zWV$E_Op}fLz1bw4tkMJrOEWXuX)K;Xd}1Q6#3jUs7@bDN1$o~DI-Jc(0|7O_i@Px8vHvl*U^JgZIdx_Y%K zo$LWl{uD7G41B?;!-#5Hf+TgSGR6g|d&tvxN=*vc4lM|1fIU1zv~fASZ1YZSO2l!- zLRARl_i-n2Bfv|LMD^G5RB#q>Pe3 zCWoatZ5)D;+nx9>umZ0gA`f-unZ+@7@YQ_HTY%G~yc!^HQdiy5Lb(lpai&SD@^gt| z9VxqjC9sQ*KR~?#SBstpsiwA;FjzSwM{NNu21^nGCRt+B!PN(+MX^rjhH5(X%Mhq0 za$ie{$43O@OXxXe6T&n};CWTNdQBaQ0Y-|soRC0u2ml-B0Ns5YPo5+(pjC_ZAc!1T z_S~~ohJ*>b>oI%5i(1s8TN2|J5GFjx(1h(WEDQMa#jcFk^46BQMSDI_<(#Byycj2H zeeU+2@|RM8jPD<2I7W}T1LYxj-CG~7v(in{GW8kI+v-2}pUzbYi|&xJe0r}Pvpu17 zJDlzd85UW;iV`(u6j&kG$5XM?(Y`VuB4H`nJ5MpMpHH61)WcekM7Tf^Yu-0N0ee#Nos-NS zAPg`n6Z2;TLNy#@#5mb)*yYYbG;6xBKvMjYhup&0Jdp%H;GMI^JiQbHs;a5)8y4nvo{-vJGd ze0^LAvb}K-XcYYl8RG@os)K~>Z?u=lN;gS~-xSTg4Haey7b!d0!*q_h~XS}R9(YA<{ti+63 zs3JTV!@79wz>i>vyNV@)*)7g@!Hlug!mr7IrV> zul))`r&CD&fTXYOhjhl*(VkS23&ETrusq?tsNO3u9-DchpG40IOChYj-|b~%F`}DJMvmY$2nowQkbXV~xgu;ML>fJs zVM^AolQ^tbC`xxpW5Ul79$4NPaQ`U96w(s4DDTZ+n5`TVK@^1H7stMip{T{`$GmA7 zEvCd3P0vR(%SRSKwwIFZL08x!gKqqU7n{4_V@Zt7Dt8rUIjJh;*(EzYeYqtFPPpgy4a<|2sp*ZrR*I&!zTxVU^ZM}LURa_3dU)AmE>QR5 zz6iNU!Hh)vkE=Lo#HW(YLUZe(#Kc}@0jWGlF{*G_E(^lGmN5zm&=5qbX5f^z8PTdp zj1BlIo-3#WjWVgB@gG+t01t13sk5QX$mp*Prs`?QmD}4VIXcL(!y$)=@cm3p-b)T4 zKVSi;HoVjlpKn}`#2m33fm4YMEv|$?nTaom&Dqi0KFJ!5%c~AYbG#{nw7xL{P6KwaH$U(v-`*N3~BLAOEYoG9?L=)|IGphS1N*ek-ljC6!o!<;N(8Y5QKz zq=JD?aQegiP#aPwawicVUX#$8$~Jw7&Y5PBrIb!0U`=ru^c@m+Af<&N2mRAWY>kg1 z%LPyZ6f>Y3X?=`QY$jW5!l2dPB8W+3Ql$sPlhy--n`$BaXz@}~S`{;w(u&JP>R6mg zbsk0L#Nh@Lnoc1ws{i>Y?Sc{N2B&Z8w)M zI~~v60$KOIkG-EIZiZhT|Ga&yH1*oKec2Z1c!7ucKE*zt`rci>oWwqF_eow}zTDjU zt`qtKc3v)1S6}}4US>Vd?Y5s_+Eh2ilo-VXrfdsWsgiZe{~vjbS3c6=Uu3E4Ja~OM zORUo&7~Yn&B*)q0i_TR1nL#sQkR~&a!-KL1KoZ^SyXVUJaNXTa&^PF>mO~I}5u9%o z9PMvlg-Rj<2$qgCj+cdpQs+mY6CyM#b9Y7r0HElY259t*`m);*ayZDKE(M|>SvDCh z2Y5#=CmWN8E|08o&wpkIR}XFJ}SVhe~Ek69}?nRWLS zGJqGq9tzEavg;386e_c6V4_XMsqG1iGq8i%D-zYdT}9E4y34Y&78 z1KgTfg+Fy~UVgVvbM2nA+rN1bYl(^R)IiwE1~SGcd_t9pKI{rIS*WezDEHPr*}8O( z`92Aw!Qx@_>OrKl`xu^!Tb&~nltyogmtAR*eVj-Y$xyWz!>p*&$3KeQD-xZEPfI>A zkm8+>OHP;eonL5a^M#_YG@? z?|>bnS-8YR8dG+Y?KZ6;gJZ$5;qiXc%|tl<<=}p);=CEn`yA0zNEFv>Rmrx{Q%b12 zyocCR-HMqQHwhw1P=I#AbinW{kCllgFRhjpsUb3lDKQ#?R8KC7vBA+)hx? z{zY!OnUOhtrap=EH-xBGO;8{xlV~?uNGZQkD)0zSTF3DB%Ot! z5zJAuNmG7Kjb=XyE}8ZRHCxbPlpeyD3MR5xwrU8nzU9?}PKW95xa=Q4t+#r$czv(U zkOSZKl`{>+3cI{6-Kfd`s@IZF(XB*M1pz~hQ5dk=jkyr6Xkx^}Ft~~pKg1_71i{lz z{fX$Ca(f;RxBmcrh--(jWvj6y#kKe|X#BW8)w(qI)n2LUAAyYPS}5P(CvU z==hU(un(){w13r=!C$GhK@1ukc+#YSUm0Y72$s( zoBjOWRDCa%EA!=S<7st4;;MK#p`+R2Xs!X*_hLJIbw%Q4|Jb4<@GvHR)!Y58( z&QRXkOK-#a>f+?N!XgJv)FFMDu;y}ew)dr2hO1CpcE{ly~> z=>neoi5pR=QN#rl3rXt8@dk0_&w*$SQS;1`&-g80GW9gSuv>k^2htU_6tQtRqR z(K*S%$%2L}!VXNj6>CVd7+k6dxwFJxP!%J#uEgyG*@PZWgmDHscP1rEC_;=S0vBTL zAVZKhw7PRp&x}v5cASJzpH=D_9Qmr*=z@ga5Sd_GHh>plydMWqf4oKvKbV0I z7QS(w-RH2Tb8Ub&5@BslBJb|S{jq%S6*Si$>|VfW99(6MW{~Fa5n|$7fQ%T>3MCPMj`sE(E8hc59F%!SMnB;G)7$F6yM5 zs{JMXV-oo4W31iK-pfOy9k#pGTN!dWs+mqyV4GCz*TY+}&#s^AY}r!0=zX7?Dc>i_ z=s4xId|>C7!oasc+(H<$7wf$Z#iGbhW=1UMlCdE_cXhL1UZ_&+VoQQlo<5O;|yTlwHGmz!u+lx zl#QXa@5q1EcRe&ixY{wA{9m$wiaKd)G)PX||i+cTr1F1HWnlQ71+;lOe)Z5b4dWG^8 zbteC&tVso+6jW%R@1Y|a{az~lh+Nz==T`0E2g{?{rV6#TO5hZYX^IzCZV!bBojnS6 z;hrVaoBrm3X&r0fWzUOQ5Co0O8kTWVKyBsS5@C$?V&7Whpo;m&#gP`|&MGTn#;Phh zgq~jp-_-h-+-`{h`q1#QcP={<8l3F33B*-$|1cP^3cjKfOe98L;_o-l0OQh;x?qn` zTL&kiX^^W%s{4gt1V(K7B$vW#9pm&x05T`tFL@-i^}KF6kS>f0z@_ici_#y%k&-Mu zfFeB|;paje=J#)c(!#a}gQ0R^s6lb1(}Z9LEkTH7BBvg{7CC-ZPg!Zd!JqYrC^`Ud z0(vCR1xXMtvl)87E;1OCUKh$bP>#xx%~=G>Wx$Ow=JMmwkB{d7@C~pM$_^SOkQOJm z$_At2)mK1OV9L`Ng!-0BqmTl`fdyGIDB`%Dym5Rm3ktqgGQ6BOW)iDdiv)nAD)Esz zmD-sV5C$Sk3xfWJykf1U^MaqGfNP{xI8&{d$}J{6hLxJ)$~#2~f+xU{W+Mb1Un3tR z?TTUL85UVfukKoSVtuT4JME4sVAD72tAF{_PXaUYvKCfe_Lq@5YCZQF-L8B+`o@2n zez`ju(oLFz@zahJzR$7qzMaW>ntM6k&AMM2^Leb5dPz$js)&e9?=&&Hp!Z|y_=?T&$9M64EFLNO*# z7p0ywPO`Dmiy$%Vq!t-cysL>AZr-Nf8948(C~5qrn#tBt|KzdI<~`6Ut<}rEU_W9p z=!phAlWUuKcXtNVg;13+0j-v-@TMh7%8fNFo*e&7tIV~y?TWeWh&5W`9JiV*N}MD; zU^7jp=En-=K0`EFr7{8?2-Zxb7vt51x}Hs=%~W&H5>;rCD==dPxJU}}*vNEjIkE$s zzvnbK(LbxJKgdj+`FR_*j2fnsT-@ zo%&zMqeW{@-_0)W7vD`O$?PFeYmDVz2CC7l&{R=Tir%%px`Lm0I_Z@A+*9RSD-9G3f}JI3@{i_moTnIy z?WHAsomv+fVV^p~etgrZP&ntp9#{asQ4W^_VU`X2P{pjK$u$>;Cdg_LQIsiwL0NdY zc)S~jW~}eA8Eu8Iv$}ik!D6 zRI+sX-J|EGt3pcVw|90&6fYyx@F$)RR-7Tz(O7@~*7dud>H&gL_?4ml-MiK0%i5O% zU#}y=te1Ws-}v9(eNOZ{9{)YUS@$zzFT<5y=>91k7x%GV8%}7FFT8iicXzL+{W~nfO7OUqN8W3p%GtZO<0_t3T;~x$ZO7UO$YIx|vf-*-*`T z%-bBI4FFY(bDG{j2zvl(3uGZTw?PF(nKSE)P>CikJ6DC9eo2~ss*A~x-YI11PA{33Nr>rBWjpoxo|WSUQliuWHA#NTYzKpBFHA^fZ&( zhCI)7te~gw@Nt4}kdJ5O!3p?@2(gIkn#X%clp!{BEi*tqyAVnnge)}$X6h60z6^r_ zkRnbnjlTS&ql(V+k308ThQ{ZRVbSR2wKjDA%&feNes9syZgZB<0`#%j?f>Z-vlekS z@SdR8$A+a_IJ6pGLSOXpeAiWlt|CyRV-D87T=kAU`TD%T3*t!yNvU;@?~XKCNvnR;D)_jwU8g`E&2^OT@I;AjYq>zP%VGhWv5Nns+Sx}V_u zM}n8f3BlGjX#c-~f3b@LaU9PwmjqJ~hDPx%E`gGnm^;-cc$H+|fl@DK9+SkMeU z3x<5Gzd@SU%no_71s1K}BB05PA`6FD8si?op4R(S=F(n&#PJQ~OEy_Vc~$L)7G}2F0H(tm1`$?l+!JigBcy z)_?j74{gORJ~!-+*^Z_!`Q$Zwcas+U9qFdZ=kGt6yB6 zR|;B!KQ*l=o71~tru14Roz7V7gJb;GT3BfjJ7gV9@-c_`{nw}CM;feduHcw*k%UzV zj|VMH>bt8Z;CJwbgQKA0>s&D*n*1x-z}#GC?wCiQ4r7Vr^d%%p0qK`dwwb-t?A~Z@ z>WCFJuy%2;m{5=1DJcJ&pTF77?@l)3!U_7iAAiOp_T}DVwm60~l8m1Ao8F!51F`e2 zT(QvJs4vE1X~tMf=9~h8Ea}&#KvqX+_^}^)J}jYnXQmFs2fMQf-a22qHQb(6&Nj9D z`sMKu@<@MyJV8pn!N)`qb;y1lTzm{yXbo0c4TX{pjHni_>Kka6-hO7XZKdol`_o@G z_>y4O_O}!Nhn~~?{gU3xsrbve*FypFSBQb}0l z%bI|x&nV?5N|ZA(8x36x@f;Lnq!{at_&%y@bQi4KfATs4vfqDog(z3in#iZ+u0JWBA0zl}9zR>=(B@tJL2GKQE}ux7?A?&(;vvU zq3hn`dy9AcK+~avc1a=wGRPqA>nJG7aCzkE-ORFf-Z z+=eA-PHWNiQ?%U}*{XLrSE+|+So!x5ll(d4$&QWqB;5Lb{D?yt71&Lw(Beg3Bk|am z=D$CdkIvWCd-fhEl&LoM#0eC}uYwqJX@7}F1d5Lq6v2}=3gvwG8Pvm#y(OCcgK*G( zz8XFqC0j|_olg?K4zwu9`wCOXK%B{9$5~#ABO8FPHSTN$A3eK>T988AOeN-#f(6{zLzBn72qLB)h^;mU#Dk8SN>zrs*8l!# z;L{%}`f1TEaH<_ZA+F@VjCCKLPXU3XThAX)-tJs~8K7A-7VcnkgPq2%v}sHS5$NCJ z%!~QqMKiVL+{HN++jLKfH_r<+^NJ{#5D*Q$8X;rX7`qPt(H?kyEO)gt)F!fw6gf%% zXy=6b+OPx^WeKkDB7M4(ae(9ddj{Oj97oq;5Mc*>x9YlrQOz&z-azS~--6z<@>^`y zuX+$~Nvk2u);Y3*!h8z}si|7J+79cJe`+RyGHr~WCV$=bH|pEFDq4sO=J=JLDBL)g zUwcfW80~*u;5B!?7KK^Gr@v11F0=i%m!O7VEgr1*_U7@Z!|0sa>nN4yshh`F37&+dK%*4* zlfdWZ`}19F`(x|tp4C1$(y2dW_UbELS;-YDiW(TcLYbJwP?l|w<^3m^q6gjM^z#Y| zHD)frp6iqpYM~iE#gV^iPOnLJr+-wM;BY%e7~A>)xVq5{%X?U z!*sm0UJIuYz}?zIgWQTrL!#bn+eSvC!>ue)P6&?j`)5joF|H$DhVbpX!V&too{QbA^&36qxVsHFuBFiXkd6;8MzMSrKsB+G#;q>*@ z!USoh^Oup#r;|TBwCSuR#~C>U_EUS_9(5R(l2)3TA&ii}8kSQ@$=@-l-q|y^PUwjg z!z?T{3g|x=F_C_kdwCrrrHM#o!KEO#r_o1T(4c8zG@sKtg};(86Posg!(cvf(z_xX zX-0eFSMG$If($4YgUyTK^ZO-+VBh#>OITT%zj5O(&6=ZDpIwC4v zMpGq0^$Os6UgqPeH(5-ZO)6+ZF2sYb@{E3H)mpRZbg7oViJ7~`BcDY|V7 ztEsgta)NvsZN9o0onEFU{J_}B>{u~cInBk!TZTN}NM!l5xdpTvX^0oLrv0rK`s`?P zGJG=JMOlwi8K5q(i|IypLdI$-)#&Vb#ieiUMl$?$AS?Ld$dy!m?TWy2`uk_jSkZ%b zXFCkA=iKUDyXd2S({Cq6eFFinzHB~H2w~OBaSNuRBB8cc$lNUi#%GYryt~K{UYB%h zuURE8^u_1sO$joRE8xM;mWb;x;)4fS_fm^!7v1k%ty8l_3-6W+6HIB-O%Lpm2b+{D z|J5AG_3tm#@nBnP7@i;sOT@`FqN}s?^-EE4aj~cmY-vD%^z!mFnP|D~+sW2nCl)c(pI(oz5)`9+ zyomCuYHB<_IKtp`ujS?Cq@<)KJ$?P#n;Sh{-RS7(^@H#Yu}& z4gkO8aRR#WWU%GrgEYm9lXT>bLMu9ngBgfnn(0&f$o`%V4>z`Z$k^)*vpdN<^2YDp z6-&U`pj_q0F4xg*;(;@|*BQsu*E71})ER2n(b+jpa3)So4We?Ko3nFMeOp1{FNAJg zT=pLnhwsvieo&-o5<2TE=zBWZ5Dq56vMu`h`c#ya?cYgR#APGyz0Ust$w_$fk%W%3 z7N=Zs83DtCKQb{op{ia!k% zqcJfJ7d0(1NP*N`)e8&BT!|_ETm9=(kM#pEYfQ=O2Pjy^foNtoEAukWRtM~mKFjLy6yItS)x%Ml8F|QL+-|NzU zT?jbzHtP<$uSYl92j97kJsrMW_nEq{P%;Y)B`0828gQiuV5p|1N28R^)TNL6#KTEh z(2f_IAvZs!l_%(@D8Ha)T!n;Ms znwsj_4`RU|;n}~4hj?h5D+cLR#s~&+Rj|Qd!38*&lq3T7RS_2M3FW8|%dQXr2f1ZL zWTYlCwA24nSy*#(v%w_Z9}k|vkHo_R0|>N~vYesw2xeTvV`JZ8V6q1lfG1+Viu_*a z8|9$U?r!P7Aq+fQ)xZFdE0&y`ToLXao;)|_q)8>|yVrO{A_uX$B<>D!+-TX(TXGrk zq-k=fN&cvH)Wz@*&hJZ`znAg855zdiVyBs&o)yy7otv8#O4QeBaJ$_iB64+hk?1VU ztJryd@?6e%?`F5Ue`L+Y#&!TXEc4KKAN@wR{#KcTA;Pt>DLdyzO4sEcE*Pth9OURf z-KQyHt%RdMIJ`Bq|4Jm9h(%0o?i{5a8~*mamLKdIGQ1wK71F)FJ=OF+S!y|S;1PU1 zV;-7nXlx=%wBlH9`}ssL##YR(;Z#_E{1tCfTC%@uP8Q|CxJ=z5D<}ItEg2g(o2`u% zPlu_do{@yuaZ#yVg&m~0$LD7Z>_AG+Q2(>165sW)xL{dzL6!O0ymw!u6(P^3kyfa{ z&7}WTF3>i~C0bVqVzqp{L2wjALP9b=53C>2eR5(^_JFr^MG)3cX$I9eid$c@b6XmL z7LLx}kUunu@$2yZg26oCPt3u=0jsY@i1`~a$+?A<5cP`UQd>xOTv3;r!b~xJ zEv`f@4XZb;ag#TLslx}!U+WrM(|bG1-!-C!z^WU6zvs5wTXM_$uv0zc`Xz%x6M9E+Ta6WlENzb|YT7PQs-}*iJ<8Ru^Qr~!>+&4Fg$ua%8rPcYc^ucWGKG$8`|J2m# z_jottzH30NGGoa0n7jp!x_t6msi?H=?Cj(m8sbS$N%4HpSx7FO5yND5BN1s>hLlno zwkN&gKTiLVp4qtve)|C)pm=Md;Avx}wt3&(`+fAg-4MlM`r%T#!1=Mo?eqDyz#rX_ zd84V}<7@{BetsQ;l-Mang_pg~+-G@@!_1A;5yQM6U+W~@I3+J#kDqEVqRv{}>~61| zlag1;D;3Jw-z^wT+0A_sHI0_=y05ss|FPVM0Xz{@6Krrq{K;BH@HO0?Y@oeyY)kE4Fxx+ z?X^t;tM|X1a92dL45y^~KnCbnsOmpc@T+*MaI3JY9N|C7hK7d1xY?^cmv?pFq*oDo zR%YC?|LC|zm_@2Tf4rcJ%ZvBw+EOFB%dJqO&`f2a@xc> z*cZesp?Qsg3r}AY5Tna7=3c{4H%R*|^1M%pHt7?9zmWb&m>|l!$ zyqDv)a@Zpb^_dl<&?QE3>i)L(mYIA(tpxAwo;kKaD1}@_b4pAz&4$~ymWrYfQ%=Yh zrP_Gq;y54PVBQuLkUFMl+Ve`@JWZKDr)*H0&vGixT`TU1=#;ucAgc4J))L|Fu4Se7D zHTm($6xVk<^8M;#+Pav*en}`iYxuvEw7ekrX&Nv?=CVeb{!OnNUi6f2_2yNFpb;?F zNSNyE#<^}IDzyA~>q^JYm$so6&iXt!b^+P zRtWq7oP0{qnjjv{vtWyJIZCu<xe5qVFLjDc_O(|I2`A08LZl8A! z!+0zoQ;yu8xeK-!^HE(~WCOuG2blO}=sUW}*l$f(ve>fDGp&nkxOu76i%j89+(|7H=ce&WTFds62&+kXgxZYPzMao@ z+N8G0iC_KknI;s`s7ukaCb-HwuBv`46GMY&5_p5*+#-);_le{d;DLyp4|2|QSAckus(iD6mCycx%Z&bsD@Vv4SGpdb?~yU& z=5kl@6gjN&o=oTpzu$1SCJQw&tu_~%ofQ0_-hSeS0mYWR*{So0YS^i>37%6-gecs( zN$64OhQ2)?=h}o_83mgneLUTcT<%%Khir^o7|YAo8Q05r`j1Zb)9T$NVs@O{bMr3bp>Kg zey#C&7I!D+Gnf%GetXb<5`}|4%p<#IaJ-l1H@7<>Y+X+-$U$?{}P*o-90~kac zK3s-ob_iX3xVf4w%drSX3XJpsOmWMbzLV0hZx5TC!qY;FrnZz-*!NIm;wG9J^^ zFMJNB_#<9RBIt}(MD~kL)iz?v47f*AjozJ+yZfQZ*UWT+|A1SxYFusCf;hj3$hbg6 z5$+6eJrOU#@&g&O1*XbvB_sqT46`tHelkTH9TDQKH4yEJkIL3Op=gKHLJYfukix1! z=q3?K?K ze8PTZ%!CoFh+=z<3u5}-Z{WVouEfAdo+AaH(zu$-Nfn)tpl_O5f8Yo~PxQ4p^vu=F@1Vo%ch1<;&AarSI-`rO)n62Mqq6&+c{Q z%g9Lw>}JUHEQpvaZvqjpU|VSYUwA_;xQ!nbUmlVfwTAaLf1=a{m-2% zt?ZdbRp?xe4K3d+DH6GGHY*!ZUb@`8JAZa}{`BT6jSnW25Vl<85a9M2b;l8oS~cfa zikk=XS|)RwC(^3AYkJ4AZK1j+^^edPnMmrMQ}z~)ZpxV2l;hZz+JCN~1Ii;bsJNqO zgF?b+G=wJ<{dno{j_mPmdCo2A!*Azw4!dx0rDj4ig!xMw*qhRJ5L8Kh|BbTl%-WH( z>VZ4WBh$-qR9b|oCqdCDmY^@HdUmIOOXlF_oQa(|qvAWjhFVr#1ljYUK4=b(vZXx> zJ8pJu$#-rpoPQ~`^L{T5>~xZpn~5SgBaJ{TI@M#!p6s42*%Lbp=eFGFx>e7=Re?Jw zJ2T2b+hSA+w<(Bo@3Ox2YTeeH$!*2tm`H7MxFXzdQ~}D!MbHqyXqgG1=?SIK$*Sz&UnP?(EKd=l9Q)k9z3$`5|LY0jfIk;sA(y zakXM>b4u$gh0ZNG)0@+Wciw1f=PkK z18A>FQ(4y+qvSh4A8y0lOzS(C(>>&-?&ANWqta3xnn{Rb05tXtrQdHYX>;V(k7rc$ znHG_pWbw`F84#ura)kf@+L9DPkSuA*gRm^HL@h#SKnPru`IfLG z$rVfxYp#^R6tD0u~*AToReSS%G2jdI=CCfImVw{De4Mg!%+r1Hs5-NWd^)_Xz_b!4VYP5y2J~T(g2ZD0o7GlLa~h zf-@*M{DLb?9y}Td2tz>{C6V{~A15#P%r`%^;{Lx`_0YlrP2azICND#sUIgR`(MiZ0s5HXwx zXZ;o%J#ouNQQF&fdQK?qoxC%l@um!BCdiIi5H7GC+?sB@Ym1GqJNW*V#s+@Q0wxcG z!CyS_r>j5r?IkPLFIl~Q;i`4#?{_e7JNO_VQcco8uT_}z`h9(e4^{ooPu1(!_WtN$ zVPtT|KRq+$g9Bhh;6OJ%9|n#st2x@bPoQ-N<-M+qVna%Wdt<)psa+?URhZ9^?SS&c7)(P9$|13V_Sj?& zCm-z1D6?f%*fMkbPZ_33?-eUQR&VHCF@BpzgcpisX@$CsGE3rtjwAJ|2_{@T8ZJ?X zi96_Gwu7xTrlcYpkm0t2*j|Zjau%Bi!9(i~g2J08^~gD`!j+V-eZHjMI2;Z!(nx%W zT>58j4rIPu+5dD-Z+ew3qg3{0okB4xKrKh+3>PlIKrYJBakk$I+L zeo9}Q%twEK`OKVfLhi}TlS3O!sqrS{^z;1=X#N!gmXO#49=2J-&z8uuYg|bs)~q5; zZkr1{1hDB2D;_}Tz&{Hl6(d5%kxp8tPyxMHn%^}rN^h^|F(@T|&>WFw$M|>ogxBh< ze6PfW9Qm7NT@!4iqii|qQS3>)___o7Vx?jrz1+EB_i4irpZN1AfEc|In$mIGK~{w$ zy>cM6*qE8q)o&SN(@fw^=}-!OI0=YfrJ6}C(xQU6?VwdZ=3{h;^};BilyLpF$+VpA zluCO_l_#}O)ub8*!;v}3SFBFSG24M`P}o|jOfNMjm%C6$zj?E6e@!>nz)38 z`Qs5`UtQm0Z#5(om{Q8@z3TKGhLp3*EjikN_Y_BfldM+$_vfX`U5zW&J72Y zEyawMa&C!)Au*Qu0X&@Fa?b|^G2wZh_^Vh7;KHXII98%Zd~{(<_&+E_Q!)_MIUWw& z#0c?RqGT~oJeT6*0Ql{NS4wyBxN|T$536&Kxh%vd6uE)yF`hE)L&2~wI2Xc*v;WM%iXXlG^_0%r zQWUqP$ZtF(cd*gD|x zqdy_U;_68Bh{DVvUL?fZ3oG}$aGoXWk)yT)gwXFCt?Zkg6Dp;?D_M7NTc-JrYzy5c zcYZIszR?!79k{%KpFjS`t3UT`(7R;y`bDcBT(r zplLI^WBu>haPr2&k$1Ffo`*jlz*Tfm(GeaUeIz7={Q{KzNXS1Ez+;MlVEUy>VQ+nD z%pM8R-iIlL+D#S136&#Bc}l5^_KKrdtTZ5?hN(6&E915UD3;~DuJj^3w8stkil=rR zYgRc(2cyA*>NsXQpcjmo5Hy-X+;+hCJE%9#Adp0XL(GF;%=t{?!j^K)Q>FGzRYOl4 zmL6=>Px1&rBSs^xC@6m2L2|KOv>kBup2U)2!vP*dHnDXFnPnC_FR(!OLUGJ?0Hz>Q zHl^VJ0zl@ra_xpAq{n8In%}H5K_QR5rY7kX)g&Z?Zzv)Z$tP1wbg30K(RKhfQl<=N zhBrCL{iSRN6fFh}FQNkMYPE!(DVAkcIaA9WnT2X@I{?m58xR2u=Lt|0l8Cm0^a{IZ zJD51vcEG3vDfBPe4(KD4nC$@UipQA)YTpxxezQQE0$!QzASI`d+YVBS41C=INhw%O zdNE?f&RLk7n-PQx#Z*e6CbgU*Guy$$S=#~X9Ek{hCSGjaL3(Zvw;iMxYc6FwKtTwX zv2zyEN=y(Hw(j5=4zX0&efyNbovp~R-UI|1Zftj#x((SMs4VvMJk+GR6qsaz077Rgh0zvi} z4l0!P(WExb^XGu@sPEhoqd^R!K^H*uF@yM9{`5jPTZ0S`!mpPC@hNA^g>Yde@gd@s zL%g2@&z55aPrT{mJdao}7mWZA?GEPwPsno?Gr1H{f{Ve0kK)ZJA{FBGQsE--2xqVO zWlexd2>VcA@eC57HtM6a9>b`~7-48{2(aHzl$92)lbxW2%v}gsr zgoj(a{6Xl_i?6-+D{I!CXz8Q(r079H$eA+dIK;E!Qos?rs3)Er@fv-I&M87e>sVOW zdwTe$U*_JGpx&=3`zxsv;7p!=2 z!I!@C*rpc;ywm7UIGOQ_3%CcsX^AH-K1957xI{R-)H$PX<6Rsaji+;hKSbXwaNEJn znZ{ewqs9Vq7qcDQo@Ex-9h@>pZ3j-b?-x(}Y0($%UbgCC(715bx@9XLncwf=Ljy>r zv7Gzayoc&+a-#dd{@P#vLcM;ixZlC$Z3jp=Z#$S@cQEh%pKza8x&G6)ty7xVm&xch zBH_-i9{$b371$1Xaw+O?sh26^H6ZGPdr(nNbq89X!4Jc(cku znhdiY0I}IQcH#pmceHA~(G*HL(34SS%Yf2;q_^HU!`B@|sbJG`ju#L#jn6$(u6(-O zno#X}`bhubCJl;XXtSY9baA$Wm#Pe@rB3>YJzxD^Mc+kj2M}RecMuTXI-$!fvt(4b zlk>DM75AH=_s(L5Leb8^5RJ+H;n+P%`|#W) z*Bx+1irAwr_&E!r?Lge`fMpm3mXN3rZ3pQUc4*)k1*)9Z0kXf~F z7L=nx+M)LNbq5pF@MumTCXbqCybaNfEDATQbuFa;EC2W;IzeZ1{}4x^0FmpGsRIUuprF`bdylU!j- zs-P1(X>$Y?PVz;f$dG3Rk*KhB1jtsj9qg^`Mu~(BLzo<^C?r9A72=o5vMMd8(DY&* zw;doq2E;vfrBdS89i-QIlZ!OlN~F3W;vq#Po-_PGFIrPXmWVVBW3vCA!^<3bAfav{)1)c-YxI)_jiIXS?9B?PP zIAC`XA?)jKYkcd~t#7>X+JS=ng35}Xo}Qz1#}Ag*j4|ra@dSfG>Q7=B#1q8}u_g;TvwBUo`sU4=n>Ul@d?ys<3_Tn>q|k7Cy6KJ#3b`w(>(N)bkL#mr;(qYs zjaPl{o6A8JTG0o?wZvPL3vrQ>e0n3A6@wQyC2`Ub#w%yHX#*X zaoj_paULGdKR-F|>E*B7Lp?GdTUZ!f(9bd5sCd0HQ!+7Ur z^IfUk-^;E)<7BJk=7hnK*`NL4*{eVI?Q2#)0+JW5T6YcVos0$Zwu27?AekhT`yrsX zf;*EFUHkXd{OafG^=oOrgUK=aFqUR~m*dd_{q$|?;@2H~ zAlm`W-D#^KwtXUo$uOqCvtjxQnHL?-yts^SmPu> zh8%c!^oEUa9C-MJ5RDg0cqtHbh{nF4AOH{HaNaEk1aj))pHfOv-A&HYeg_E$qqc+0-2Nt$AAwv92yG?_1ejsZ3g%JaPo=s| z#rEWK*T%#BIgPprWJ@ANFX#RZ_1MA#;RB6FDS zz~mR+I;PGjHKv!-Hw!No^_d1kVayWIvon5@lrq_a^dXc)JX;|TzA0o zq)7}zftm}DhX&qe4fFjD(kh(k`N|_L&S{Dkoso04kSx#^l(asdYzO;WQ_HML<#uGA z*XbM&k#rFc*`|g}x`+z=56lR!9IK zo?2>udRLQvkj|4t&V&SKB4Z9%3U;w?7W(Oo#!~xvwgcXx5t-W#5Qg}b%4z=1LVBq= z;l1d(1BN-}3=iuoLjG_FwJfnuW#;v!Ryk6uy-=;=YzJguAdzAY1tDBENb3lI14IjT z^sCqFc2{?Tw`}1FH%SoZImwU~<)H9Fu_UY93^rzzXty6#xhA=g6Ecu(h7$1;Y0)TN zF4qtbYrHAN+HECLjhD6^rJPYI3|QtQPD5t3JGs&YY02JwYJ}{ph)*q= zGUf%vzFDZ24rUap#XTn44Z}WWJ_A04`MH3Ccv*17gbxeI3Rj?Uh5H?VgT%ymz^&-w zfZc_Kz(h@P-nJKCcxT71ZQFO`7L^`8bl~8@!_86y^e6}k@qu>p^mq67IozI(u1h*d&H5!fG-QBn%5KnPMIAWSi zrmn6o_$3kvlHd`N^!4=(3=FtjE<`{ep7!+gpe&h8rqO5=3Iz(nBeU7u+1ZI4kQNDX zHJN}pc>M`K#al`Bk6!k58?BbkTJW#`I)Sd8QENXa|Hvs~%pm z`o9-k_sFs@-}~4TFSWMFj0PLnYqQySbD%nAzy%&upnkceLHvTjAP59Sh=BO0aR?6= zT^_<{q=taBTrg0>AYUTu*XyYb>U0K#X*AT9$0q%Q)50?cTJKC~yd}#7y5KHlJGdW6^$VA;U$Xil-z+c_(g(L4 z#2$Pg;E8DR63gxX7695}e~zx0uHX*)W})`iztB9))*Ue00X@AeasSWR4x+#-9}|mt z+rhm1xI6Kig?QTmTt{d3``Zp!|48#l1Wim8>_1RiR^=WVJ-lo8tIs{(+T786rhUh& zZ{_Sis8DK;o@{vGwKpn`o$!o~`Xi)2AOom0lnc|xm?A}fT+wIIibU$%qcdZ~6mL-? zp5iJ#1&EKhhuU#0gc@_)3lIR0fGe`aE#}I&#pnn>&jDAaZbh#s4jurKh^hEf+;R^$ z%)@gwEjx0FzRV0mhY!KSJ6z~ZL1;p>BOT>KvJY!oCpH4e$v)cpyL6(AU|POi5Sek1Vl+hOEI@C}sCK3m>wdqrj86C`Ljy%1 zhf2<@Yg^GHWcN&qX{SdL3%F|I1^fHY$4X@Ws{;6CAjW?yz znVKulZFZtK8n3|x#z2;oOYH1KNYIW8TXK6ctDI@op0omasbmQHDr;C|kN_tUjU7f1 znehcY0pYD<_JjgcR`n3s4k~*fEmHv!V=l~`QjUo$Amnw}lk-){6$4pS?%!=cZX7~w zP}MV`LR?lsgcga)p(b z(w$afN_g)i-|v9$VM*^5nGk~K$iWvDlFD4l0>Y8w zk|*}GWgQzy0vpTp&+Ka)3X$!Aus{RiC$IsZ08u&;CfmW5G6OJ25l`=GYSDT@5s(K* zn3<2*4#DKDm9WHI#g9H!@XS+#%RN7{W|d1F`c75nmt#VyK%%GVq^O0Tqh+LI}U|Ko0Oz2@H4$(z0|E zhv&nwMOq#Kex8b&f3$lMS#Uz2mo( zh`{rKA6LR7h8`b|d0O1EK-y4~ksD1;O^g;;2@;L-lVALg#j79ro11=e^>xrBA6j*(($jftZMcM?4%M+y;+)=xVj|cPSuGt5NB+YFx+1MkIZN0K$<8@sr7w*64V;%Zftbepx0{D%3igl)gdGv>P@e(XII)c7sy^IY}Q(b&YWqn*sT3h zdSyqopw;#C^w|bH$%1fq@>y0{ztY53v_4di6 zTEj_+^_8QR)KX_kg*zozne|RpyWA>M>l7+_B_i#YfS*G{LkgL^PpR*=OuuzZySdU1 zjXJ%=l(ehiqU&z5MPDlnzgcvA}%@06aFXf3Ea;)BiB*4AdVTcmOc$*0z~@0dL0aA#)C zKw7mcJztsM>avf9RBA19gS3EBRE=Ctul0;Z{h4lwd{B66)!i$zjc-5hNGvp`mAli5v}wC)n&eik$;Mj*al>HXQr)9a zH%Lq`7qzAos5h0^l8dby_nhh04a<}|pD%z4(r8o)g-nHtSF2PC)V}q(!>1Dt_GFgZ zH`jPmiVPdytuH=>Yz)Y`r>6^;bochCbb7D|@!b>Qa@oYD963K{;SaA@y;pihWA>nd zpcNozNQ+c11JCQ5PY+M{_m(%M9_dO!h1LwF6e!PVMjJc&2fV{WBg36tJyNOMX0f6V z(d#sQY6BRaaj2Dc%B=QeR68Hremr}7VXxAn))+u3_}tag&0DlqtuZ==_PtJmr1t)|s% z>FSgA8C+;Jf2=g8RJyXN+?)0`zf*WZZ7{3RLCE?|1|wt`k|U8SA!87Aqe0i-*JXE@ zTUwiN)o2wFT8x6eoaTR54qR2hbpJ19J0NA7J_CXagve3`J=Y)fh33eIKvKLTfpEyj z3^l;y9FjlA5061kt>;u_Pz zf_TKypkS2D&XFaoL<2OEkc0X{c;lHrOdFKaNX;nav;#P$j7$n=2-71T2Uh@#7zG{@ z4?GDxc*^qua3;s+#sPjF!mo(H^n1Z(=T)XF-uOWa=MOxp>Stb><#=m?yT+L!57<( z>Bx2vm=*5-N%B>n{XdJA-@|MNw4UNZ+X3x&0RM`ImaKkw$%^$0zxbcO-SCp#HAzwu zqmknY5YYx8oP=4#KaL{t$~|H}{K^53*cHTbYY}1+2WTl7)2%A{rtVB=yfxbl0`JT+ zMk&4Yx`VH#^?WDeM59fZjtIe!VE6bQ`Az1cYrhM+u3qr~UvC0`w9-GE?SKIf5!(@a z8V@|C=$P%0dFUEV5c8aym}SWN4T}F)2eB$W-*!;*tDn!?4lV~#W`HTohwfqCb};Wg z-tNQO4hS$bu-6^rB5Jv;x4Q?E&ia$5j@KPiD>c%7S#@PqU0t1Xz}+ub6qc5C_4Q8& zq6fUwP{R8v^yBQ!8#i?$Q&v#43?7Gv!^5xQ!~(Zs1YG%`E)MM+cpM~&&q4ICA%sBm z0C*Ark0}->PE7ezcn~7``6GTsZUCYPMX>2kcy=xj41@3>W+0d@vn>hXK?s0yXQd%4 z42^?=@M?u3tj3UO(%Z5C`nSJd$RPlpF!hN#V_7`b~MtlrnpIiT>?c z4U%J$j;s)eqeK`od;e%iC~7fg=E_6mqtQ3RVscbD zU}Qo8Aiy*({Hat!>jEm=8xQv%Y0%EFp%?(3kc0p!M4S^)h;J^s-$7!bHL=v0mapDj zE#==VkW2!A46piGT7_=+3-6pXWHRj$_`guxZyJOQAR4`$rq`aRS$0q#;`;>QjVjsW z`+7iTYPn-;rBXRYa}>rwa$q1wiFxUa#vUB8_8; z)*Ymj*wV_~$@!``t9r-StOtP1MbX7AG=KrWP}n_?R-^^yX=RRteJy$~2`pD!J4_9~bOy zXfupYGZ|#lO=?^epZ4sG0CkCdDlMlwxx$uQ=}s$BH>rlF`1_sck*?9VugDrXOFVPi zs#F#yH9dZ4xkB7|y>wg{qt0GOaq`5^6&kXdd;y8yj!R4e&jiHOX*M0h#R zf&4VvD>0$KluDd(n7cJ2Hm#`fGQ(8?hM~h#mqGp4^Z~zn$#j}CgF!dg2FszZGZK4*V_)yxI z2Stn5cn^<2*u*@zicjAcF3b?XGvNTNP_y9(kcULFl}$_(NcO1G*c*OCW4b-!qcY$S z#JfChCFdPxv{Pf@;uRs(J+dwu06ziq;|ecY0j1@itB{!S$_1N(vxF7xluO@Bp(&s{ zoFzwLw5S89u(+%&5eR?E=^}8ca1q1^@iDnyWZ-$3Tq@7_RAQX?$YO>Jh!Q;Hd;?Gi z%lO&eZ@Bu}Z!Np&NBrA_g)1JsyzOA&iu)H`_k%C3xxc;nF? z?yT+Lp_e;OnFMq}fmz|c|4#bk=l^ZV%KI2y7q=Zmmn5uwnC}z0@QeTXo2OrN4f?o1 zGCHDY$3r|V;#Gu;2A&78hsftFKk^q{&s}#wqc?Rl ze6EjxS*G65D2oUPh(vq=KW|c)0I`9dJ&7Bh`6z{3g1BfLE;@$sD<9E0h?$7D+|NDS zA0HnehVyH@CmuuuIPf@P{_zlx1N@+xzI~@RR8eaPTWmouPr$cOkkn*Mnu&)LA1P@C zCIHHYD=fTLA;~OMZmF~+>~G(7OyQY`a+q~cNP-{YB%FIjc&(P!9b{HR$=AMFr5t98 zA2)f3sNx?A*pOc+ZZ&N#RMEHe6`qtFiNs0oiSU%Gf;5R|xdUfl0xT=K2cUbWRC%7x zRXx4)M4M)SP+{|E#H3P444@s-qTZ7_U*e(O%qk}xm4B$a$>c{Se9pv*V94MP$pyhW zCH%2O4ZSp@W+)*?dgzoIQzFn7cv$B7RMs7T3 zQ(-EEfR>FT^BJ-oWR+WK)q0WPE$Eb7C_a7$kEDWSiwUk80kb>sh;n5@P}>XhLPww3umR5{eYawFnzO-kt>5Xm|X4I znA2CU@*;E0HALW)q7-1#Y6(4Cs@PoTNhqZ=8VlOobTSf?5bzvmqX>v>I<}HJuQ#Wp4vNXMrM9 z8H5zQtwp0_`yCurjARt5kvZQhvC}k)T1Ml-w3Kq?NKh3~QdBdtg2N*UX62KkTt5JC z0YK(|p>+qOHOvLMBXt;kVNeJM=luQ|E*n9p=gf3PJ7S!RKEk8E81Rtu5a72LKH~oP zYrF>_=6_)-4v?0x0Hr)QN9Jf&W=2a8s&TXy661z-NJ zYj3@;u~m*fBie18i`%6T=5$>G!*hVgLE30?c45tc*o79oyK(Tw|HzUx+EPy~}BVg`gwu9TVXs?H_ruE#N zd9uMuJt5fW91Q&A@n`wEg9R(sF1%qqXk54=TH}Ad?EtJ{QVwJ>_`uQV84D!d0SOFk z81w@XA_q0%BLdOr*m@Y2DFep6Xelw@*{6R+AXXiXq;xxPJGe54G9y;65RrM?!Myu; zyFbr%K!9J|$Ho$-dD8rurhpXxV!&cv4&t)^i^GK@Iv($eaY46(IF1Ot1|tadF$h#(d4wJ5RKz92iJxzQq89u=zBi)2;!HrclDcp7aWP zR)sAir?0^Pg@bVBs78VLP>f|VYCA}+^lUubFWL?`up~f)=7{(KGIDodYmF(X$cFg* zjK(Q8s*_lv3{q+c;6Y@YPk8$TozY0zW4`tUcFqF0PE&r$m10JTm?e$ROlLG^RM0sK+;)KYgesRS`tX`W3+WKQN;xf_vyil_zC}0cV_EWEh{s3f zA!a`4w@s$ybn`PB(~8uMN-{Jc5^^I1@XrYrXuXVlD0W6;r7NY}`kOcF_SbaB+YUqz ze8@*Uqwzf30RxT`;e%38++^&GMs7QJwM-s8WrLwjF-gXVCm>y&|CAIT8s3 z0$#5--gdxYdU~3WGejXTvb_KQ&L*x8kvD4pnhpV zRv5}Tt&RcTqNK1Q&MSzoif84Yeaf%EO}w(_(S)K0Ao{uP1mGe3%F~J-1i~{NjOd30 zGUt@WI;JrV!RhQ1O523oKA~|;=o}+@$FR;mq_q#J9m87NI63>M+CF;WRbv}b*+#@G z4~HK~)b?>?OBu2&54q?SNi?=WD$YKxvQDb(%-O~imJzjO+~k}d91RA-kX2fY08*GE zIFDrUmV?Nd^B_Jvp2OmbJOGb_t7u9PISJrT`6FH^LU^g3&H5T2Krb@hT$ofq>_B zmM+p)sjI>TfDva;)6nXlAO32(1d1`&ldr^fu>Pg?IxQ`I0xKWH-Ve*n5J zWjk1~`~mW>fM?y`-0sHp9AK9}3ILBrF$?chov$_zG^15nwJ(Rtg!y!#ltkHU6jQmCu#* zWEJ*qDeQUna6?VIYIKH8!THEa>7ru{W)=21;e~RgXgk+X3avl8x z9`X#?Z`AXDh3x?0$c+%dKPUMACffn8A<7n=CgLOAMQsPjoVB>KSaZNV9GHNnjSPt! z%$*r!a7$_;|i+WVdf%gS488P)p$Z` zcMuL9(cxC*3c&G4+|O>q@s1@YciwHxg;XBD$`e$&=2R}=K*gbGr3>+e@;-#ho?QO7&Bn{*g1J3K2L&h{z$yW-vY#(&jaMiOJPx{ zI*@?nO5?&T+EHk>TW}n6+b!fwG64KCtr!}VBHI? z$JrT;;KhCaopjabzPV)OeG6Btz05ZY3zk0swvZNm{klche&_cI+Z^sG!X%DB5ohj+ z@jS-r7>HzE$|L3}=EoeG5?v96h5$jBrqg76cWi1{vzdL5aOu4gZ_l#aoJt{grFQ?< z=7xF;8<*zhu#@!`h73H1FCOO_UnygU_6?T{twq*=&cA;fBuMlQNSWasxgxDtpm zgN@|?RQ$Z{VBUSa-JfMUpq`g{8?+SC2M~;*Jsd)Z1NCBd79(zw-M%9?$Ub@WjN# z=;$b4bTBqH#@8JnChy;Psw;+w5SW?py7umTZ`ZCpogKZseX^bVcI`g6-#Ih|)`5^f zgl6QSp#Rv>I+Mv%R#w*E-(Oc(*WTWK`t)h3RC@I2QI$${?AS5j*4oxeIe(T;iX6QaXlXgxM_ z9B8~?NA&P3+Ajf8(XRXSfd8J5edPHZ(LK4nmL*Dg~9rD+u9;%r+?PKrKK9kQ*<(y$$hEajk9boyZdzwzqbj zI@x42niDc!Typ()7pz#nboGz;;{40+cd%&X151|Q`<2_*?mb*lSyiJ{X^x*ffecZ4 zPfrg>P^;CYrKP|PSOEdZ280lWDwRq+MY{l92;|}56-OHsL2N)pNlA%JCPN^Y19~}I z^jbq{X?c4`S3^@H!kc<@Kguq+^ADx}m?h^Q{Kwl45W@B6m^*7bczA2)p=Qs~Gm?{y z9oOFcolk!L-ZSzTM>9i8-yM}GB8?mwos+?+|2US_|8ThooVr0H)>*R4rtyXV={ zxgBGLRm~Eqs<^W8iHtWFe(~-F%hz3V%cEBZ`x2I(T{t-7fn!kU0zlNR3?BfX!|w5BTB!3IW`Rdd{^S z%&$9mABZv|Ry(Je8+#E>IP-9H;J9H4qv4c}<$zljClUzw(2LWfXuVLc?i`s;eIwV) zx_Xu{9GsmA3gN&UP!7@FgtPw0tRG`sAQBAFL8K^&k0wBs7TggPe4G8K4Vt7Dx0IgF z0A>d$umO}gdQPu5G3>%q;@>Bd3U99V~o1pKT4$OWwg4}wQfX_|VCC8v7E=Y%OB zj}{l8tu&}?2EYk8zymZG8whZVD<1J%&LYldcz6>2G(I`!Dm(~;2f)+9!$WvvUJ%a; zfIt8O5rIb*9|3q09w$CSkP9!b5rhzKjCK^>Ew_B~i~q53BsN#mICD}TgqQ98#TR~{3<5k?4)1K_tj zTS6bAk19jO&dp)u+TA#~@}~#+Hw#z3-@$_~w$+T};*x{|C0++Eam zuweNEOIAIyXyy7PE7r&FcOW7UggH4Jb9ewE<^bH{%0oob#48V^c&z&P6#*fme~G-XPQnsXk3OY(|!lPJNwN7 zZF#VK{YUl9Li7g#H1g2o4nG0(jX<71ouy+Yw^a}ROIq7MW@^8dCcEnoReMj5pjz2* ziU|d-Vafps*x~~)3;7^ZUShPAc({1z#o>x00-|)iFR*%M9@bZ&R_AR89|U6chnj|< z%-as;-N)GdIkp1~H|Ukw_wnqR`U_62c&nbs!U&p%R*u)5c z9B5v}=6?*RpTmEMx;>T|ZG_8RILN+rG`(|loNxQR9Zzg06B})8+eU-7vDMgC)7ZA{ zq)B6=v2ELG^4_24`+NV+TFK0;%za(wx%WPHa9?ip1WDh_9h0S^I(bA4sA1cHY_H^Z zI(iy{p|0#wsCkHQ$7xot}ok6HG`j|^H(dAcE4%G)V>n-L`e$8f=DlJl1vtt96qyrPt$ZA9X0 zD<%9?%x}WwtBEChUeq^ExFS$FC=vyAY)6@}bREnu=JN9+MJA~-BXM^t#j@;%W=Q!d zU~v?-A3>HviO(lO%DUvssJSRY&llJ1h(tFibp!d{gZ{xBBkOGoKYCmcjRU~eF-*3N^Ixedr zR;SRbCO_u$`kos3s0a^!FZSjEmTM-P8L(R|@o}99^a!8lWQhL}GYd}|A^!Vw${qC{ zLjvRaNKx}St-=XHIeY|!{*nf?tOSFUxY&;mcgFxeK$z0B1Da>42UUB635N0O6x?O7 zEthLmY6wS1Y2~mOzm7cDCm?b!i8V!k@m7+e4^P8)PFD;tm&aM=blwq{`jpiGaTl0( z^eT(Xizvg!DQym8GXbbQPBsj6MSHTh?Qkj>`Va03CPcyM&~mK%>A20LZh-fjjiKW| zJxY#$D78^VfvkT<<-Ybe8pUDDG8V9M=VJ!L7>m887vgL^mY&@N*sw`z9kR z5HZ#-og6=oU#88QB7^h!+fPVy5q^s?<5e-=8L1|&_EWHGDYf%MA;Buv24qo=omR-G zD=I=mai>Fj^z<_wat=ed0E2f+H9V(5WEA!yHrwWln!Sl0j?aCcEvU=0!}Yrh-p(%p zbEwI3m*{3*jVSoZ6dAI{(tnj~ltA<@z{q8oIuocx+K#<4%cB0hl&%G=pc(x-#LBL3 zaEH$P!{stQ;;KR8vCnyJokMQfvegc;^98_b0m{>Hci0Q?T$HPl(#U?FlU4AH-j=v> zWovoFf@8PAl8L*K=qeiasQ=2;a`cUqn7L?3kC-eP6tGs1@6n(X-YKTsOP~_$VqDyp zc-e*6g!s7Fj)~Hc6%-}C*)`mb7N?kcET6VTU@68pV)gbKux$<;c<2lSNhR3w(`e27u;TLJ~Y9i?q z7)isk8>aI8V}pAWi6RWbGlLqAc+qw!_2I8$CSKAs61M7CH0C#E`zri=pW-)}`Yoqh z%m^1vveqxR5>@@9BSM`%l+~(V&bpX&t|1CecbbDNcvg}8a~iIe22+4M2SpAqg!BTM z#J^xieV7Z-l^$w%Uk$N4ng26ABl2Gd3*)oo`_j}(*7df?{|UyKE_h3*c4Hjuvm?v) zxKmx^q#0fZ=6>$3J$RiBHk#w#x-DVqSXUu;#S@{mP52EuzraJ9phSZLNF$MPqoWBE z8g(zb3b{7pir;iY-zI1oT)AVESm4y0ivOzXXsC>t@t@&!e?fO)3Kzur$Kkw-@dEP@ z4Pi*kti`e37vv?wbP8|WIvsL@Ep8<8b#%EN9zAT3aJmjDZ}cR`U%5!e1UOT)q5jXp zaMGX43FHjjNR1y4mrzU1x4+`N)Yl!C|H-F(_J{&k(JCzvMID&u{8P7bTv^(3H}z0- zl#}`)+0=7FM^|-}Qo+JmcpVI94donCh+60S>pO;61I&05g>y6>sqfa3bAr!v_qU@S zRXk8Iy!{M5J-rv@fakNr6sdu2+I{vJEUf8-rwpQ*f2+lHfB}r$m}S{(Q4q@K!)9T> zqq~F0a^ybeQgXe%$u>uF>?>taL5O$!=aowK<)ZRJ26M-z*D~?-=f9qOj%jk}2SBdG zAmW=;-6vcuo?{U*kHfk`Zx^)?YwpW=zf&e$ zXQvxKG>)_KD@8tEHd?wvi8VA*7C5Q77bxY3n6EFZA#&O;T7||TEJ}TOe; z8kO8k7(#hVOjLNuagcD?IhVg`ZICk!mk691mMQ@3(peGE<|BNhhR2g^=<2Cb+OyX- zv%GYF5hRiJeL9JW6^T+kFJMz8zESlQ*RxhAE1H-CY~BH8+DRtFx5mS$BjhOVWCS9f zHo+4*?x(3-1#_8S4j>NvfP#o<^xI(v{}}|!nd$(-2&jXaM0wyD*WtKzU%+>cegAQN zttvqlj6jqJ+l+k|L%qkSK3a85{jw?aeGe6J_RbTnfm%!5fSeM4gbWmw9>*+sGRNR1 z7sXAl>l}kSuK3ypen5S!HURP5!$-O}Ese z;*S>$A9@1yuvYhBjwz^^!U@I`N=&tcz2Xbnc;1lR%4%iptOt~@Fo_zIU0&{q=^+iV z1q%)MLY}dX3RjN|!ZK`SKbpSZyyh$GJ*{Z&0}&z=dY9C$@~E~b_N<%&uoSi7<@VG2 z<;UU8cCQF~z!9{a*q0@{uVt}C4?C*PhQ>e_UM!mhq+C6_M)^=!G`M(%Y(XlQvlTX7 zzPm@;#{X0ldBw?EWO_G4^LS)_%~AeQVfZUytA$#Kce=rEc{d@kO6Uhd^@Z|kwcH&4 zLIwEl90$4w^`GTKd|nK9$nzl$X&B-h=+F^kvtZvwYqa0q*MXd$%;y>NbH1M*v=jj% zC%U~d;!u(Ahye+KDka1dpQfpkmsLvq+z(A!Ofl1fFy`o{j?f9F2^@19r}GDUn!fYGtd=WhQ4?Xp^36XuHr= ztR_mY&JXczC7#KlDoci~wkes8XWb@Jt7hAT1$_^aZmOy;u)V>mI!Ul?)g(Dh%&}O^ zv|7xzP$%>Kn$p=k_GK|o+=Obo>?9Q$)#aRF&!Jx2ukx#O3pjoEYg+-hJRz(6Md`jw zX}wM>X?!c&U<`T+9!{DjCflOA%DRGo`m4{MhKS!M#_RJ#FI(j&ZHzH4npqY#RhJBc zE4u2N+Nz71y0Z&Y6mc0K_RaD8+#->gvR)PPJn|Ng!|E2d{iL}p%UfNP5YWba+I{TF z!9(<)e4}k^t}dd@6!{x5CuM5tR6E#N8D5S#S? z3;x_sq5ETUydaeSP9lsQad#MhcSg^N>xKeTI*nc{A9(vkbV6w;+T>7(CbM#=OBOy#XU|3j@t&L1bMp8fnc z_Q3W(TE@8$;VR^dlwWIJTlI-WmCvx#*48$df1{$bl!1Z4bvLu zeQ*6J=1xH3CSG$Wy z!3-*zN0Qplzb0H($Yup7lTlhVa`yM09a2FPW_9U`a1{dvEqb=DDZ1t)*{MG~q-`h2 zf4Ow;JB}nF7W}oWZ&z4=%-RrO*;1i10qnC?Z2x}D&n1h&-tCz)*k-uqEc?kBJ}4aB zdp3MKbX@`oeoGjE5on^Rm^rInL>B&Ty{vKJ-L`anM?NC|`~Ke`WWg*-W|nK17!4`$ z-SEEJp}(H(4;(HTEY~@+L_)05%qgV=#}~$xNFTX^A^w@wRelzh+-b`wnqNI8fFVAM zt?5U+4X98hX(fAQHtkP=l;uNdQ#xeIkO9Z!_)`!1uYr6OdRtfXjNTWitp68v()xWo z5O^UKGPXwyM^vT7cm?-7=Fw`}mek z9n#M*Pj&|I7+75Br^La7r$_w-)c3>(4mrYU7W_XHY2j4-YlJR zuj?y>4ljLchy^VP_H-0zyArLMAG{zA-GYS^i)qhIo^2V1dg??TU~-wfuJouWh?tINl60+_H#ihB>7EL#{}rcqJpngPTT zmD1Nn_?4*+%5v8Qvr7Dc&w>=gCJ4*mm#Tfe4p{(9G$ifb&@Mq@+Mj{?5k-%PNGo$7 zCx-Sp1zdLSilT_G;3>mYIB!!NyfwL$sBB1FdR8x>UMb7qMx*%~%kc#*M?w%e%?8Mc z!lWh2PzCjUQ-RDZiW#<)4|qXQ>^JRyx}*`RLkZNWsEFk?;K+ zowJ%ZtAPDGXVqNFw2^YV8jt!|gq=nf5t|&&S@1makOO#FI&f^w(QJ z;uIC2+Q@nJdeJ^=HR}FWc)1!Ck(8GHTEThlz6JgI2UR1v!6=E-|T^l zk5S9aOpF}eox|O*yVp$SD7}&fv{ubm;}_FZ?I^rZUd^@#I_4e!`7iH?Foya=Vr@~T zj7=La3GCj8ZvWl^!d*^sX@Uh3A2v#Q8RLOA)3_#VBU7<>i7Pg!8Wm%^7YnFwbs~rZ zB*>)HeD*{-*cxOKbUCkV)~~QG7Y>OpSy9}XwD`+6ww>uU z(;>s;OY(%&O|Q=c@-f-;>j8HLXc8FtmqXmo?WleabU9m2X)G)5%R8LmEO`3jx-iSZF(5ZiW z9~ip~+h}s$UomAQ(QWhoH?x15TV zTb;2}8^+aq)4~JE6jS;i;_!XnDX&K0o@J=hDJ#e`!X#`#Q#gReE>eCl3c~f>e{Iw@ zs=!?9(V$Ad{Em%ZUKxk+j=s`S5@!E25a+(yb55YkQ_TyAmRDQ9Y-v%bZcEpigymoR z58uH?;}84>T!DblFTxKGGRO7376#Um3LOGSs#L;O2D-&xtQGbJ018o;4$tX-$h&OQ z-^{a({}&m4Y~kQqnWzIZJ@vYkMgS3bRpIOH$p&!k)RH>HUtjaXKq}91VG7{owv;5C zZ&eS;qh^w%1u%si`#`6~Qszxn=18MTc)u@0VEfpSh!h{;rD{STv`&!1H_U$tKz|vF zMZYl|Rm2aWW1|_*TQ&&aV2VBWO75D9NO$iY|Azio5vHCh))YnLA+!Ngsq5^*2BLz} zy+76oI9*RsH$eI0;n&#rzkV3~&vQ9=0qC5y(QplgTQ;#-_2}s+1?u8MvN_PPvYP(Y zL?#*Hux6B3WSoBcW8bFgQtay($@n6tjje*;sL?znoqdmLh8H57#VnGWeoh#TJwkM_OH^+k@!EpOr>>PYMh*UEMSm2O45ir&sUebMwAWdJb0+n){5t<2HsM%ljr0Mu;r0L~ zg5{t6Xq4Bs&C0|pdt5ppaaj}0qlcH{*$Y}U*?KDh`jB*6>VMwRW6Sbs4JmNpKVRcw zRc6e_$5Uvqb=Vm?2w)LIXa!KT&?(5U?xkHu#}DotQFgybK8kq8VaRcQcblqgRR24b z4{e~}4in^CDCsO=#}R^wb}x3R$jEB@DK=|HQL)anD44-(Q*5A?dlj8vtnf-K1QpP3 z%bfc1Iw_;96kd8bNl=2Qf5cVsi~J}>3ZZRn8cfuZY7X5ah6R+Ah0~c)1g#GnN$Q)S zaN8`54PMJ(rUt5HUd-DjU?v2N^!_6KR1lMtR8e{8a8|l*wcE8!dE;q7>i4u&l~pbR zF%IO5UPqoAOoh%}f$>s&e-dl_U}vnAe&Inv6M2r@v<7=zOdu7NxEwEUyX65e z2Sc1z@CwV|I8C~VU7!pw)cm27MvwaiOdaV7+_)}yHu8yz@Xk^x>n6KAz|$GtwbXPn z;8_BX4um2zT_UwgOO1TY((T!D8nfbKHi@wapP<{mi9iXpE^`sNDOr8ph6HiEo6<=p;P|E3Z(h49-8-? zQiayIk@^Lb|0%F+T}MYMK8MoK6!M+^;*ZczpsLuyw@yjqW`-r74iu)Ey3xhtps_|4 z7K`D%nHo>^v?J6pQvO}gnMl(!hcKHA2?@_(*-aJPIGSC~u^>L9f;pDl9~cT_BI6Oy zK_0B)kH%!e7$epQDIGT0(ULzq{6KL%iO4Lt(AECFx>)JCb+UhkEIeK1Zm})Lw_(q! z&VJzUO>cRBWKDHHyT}*EI2AoLJ%a#DPU=o*K3%&RJl|B^PfQYo(bEWtgw(&A zFVIKN&%4UbzhA8_`PY>j*#EHXDNE*x+Bg6cSCp6Y)tZ~{{!AC-->l~Mo#SWISNWo= zrgl)DwlbN?r~6gyOX4bJT+Ad)4~WO_i^Vy6a?S}jCyEWP3Fgs{GFAZNWo@z|?KQ1- zJ135I1$9d$XbS)H$KT$NQ`C3vC-HcNqXc7Sx69*gq7T}`zAFCi?l7tQZe?}h>)(DK zx&K|4{2zmZ@q&*2N`nOC7q$j;3y9u=4z=w75h?)Qd=bp?WyICrCNn4iIGh5zBG1V# z@M7XZXrK|&u^RhHc-S~*M!AKXAId!*s zLkF9Pi0&_}+(gJvOWlO)n6O86km1`yd4{%hPi8G{nECXV(!WIvUn~`(caUV@ zPK|5A2q1@+f-84{h>E4lIpttVTC7(4b#dx&|6Se?u+8~EFyAmm}- zID6&F6(#AZF)}Hiovze&4Du;?!u{ojr#z{*Y!TbymsWp}n>Ufm-qK^CXF{{|As?r$Ke9xA0$`t?g(v`QXKpaY`IJ<-bU;6K6D3R7`*WRMi$w1PO4 zVKDk)Km3VY!vR=y3W~l~p-X*Y>NF?u~ph;{64v;mgVTRbE#GmFIMsM4aIRlwj zKhKlCOamz(3$g@hlJlgc%0^1kUR+D}iNb^FEf7vi4}S1Ns;-&hXU-DRV_TMSg=vuY zv?YmQj}^S7DuzvsL{h8vPLDd`9HEq4e_kfDcQEu#UXXGsmdGD4E zU5q(NG%j4joDiXtqTlKJm1u03_k}A>H~-f~(vxGFT{sJ5FV)*0k6OOKDX|oO@<)?{ z5m9=;#xAO8ZWm8ip9x77rD1$`FHu2#r|>iLL5Qir{D2knpzfxCd%QZe*odBwyt8LZFH(o4{Q)iru?sQ zc`s@xbB=s~3%Tl|JL$~9)?_IL2l&W*?Yxziw925-)GO9TB!L@-+MLjmqyVj%v@IyM zQ6;#OgwMM&r-mQm06+krt(O1~3L~~qO1)@=VS=LBF##Yq)qnVquC>mhYthK?J8X__ zZF=#F7WtjI$f~iG$>Bi6{M#=CCu;#3gg=fVnAM&WAuR1+SF|Y9n5Zb_(Z&O9SKKxl zn9>~sF6O4}T^eOEf4MZ2P%+3UC6@p?Y}{gQGkAoAzy1z}E)kt^On>e&&uZaI=of4t zuq;l?Nikn~jl*e|XX)J8 z=$z@Y+U59>Eiz zR3r3K?avX+Ya%*Wjo&M3_L)+(qzc{Kr-#M15}Jl=bGcS{FK2H(mb7h%*yj}sEHQ#P zguHN97b%P%?Rz^zH=V@gDi%vdVnC@w))n!Crytb&d8OdTe$HFJ zxVJ7VDgrMwN$;*hm%Ep0c+8|fAMp;p7tG4`;X={3BHQhzOZmBG%0aI6(eGg{27Qg^;QiR21j_ zV7Qcf08Ro^Ok0q3jy;Ag=<$v2`ef42dL#mrTp2y%MX(Av-FdPN`~B(RlFQb`lcf;d zh}bYr0d?m*Ndv1yHL}}&k}Vh+R>7laE!>sEPeSsVS`e$nzVds+vKWln(dWYS+r0;- zv8a*s_U130=?k~(mFgwnxp|RNAn2g{-q$ihfnR;@BeASw*9`}xTVf#y&&L#=h@N`Oucw^+F{ZdF<8i|q ziA5mUZ!0UK>mf$ZjRgNTO#hR)tl>mw2me0d3NQazhI1-Ph~z%#fi%r|1yH_8KK>3S z46UMp$7iju#T<;fP3<&G1>bp_#5ULG94jjud4z}9wsIH0vnOS@By$wZ4Gjg~=1KKD_YMt}z^ct{N{7)F05|IEXkS5OmZ|<3F z1Ydo>`Nl!DL3*#6f|4uC#ZJ(T<;2mK%L^G~k)tF##rnefr$7)@Dp-50oqJy%bBt*O zw#^pDDhlL;wV)+CZD5-c4=J85nRMT(?$~1vJh4ntRim+lz)GE^^q!wa!fOPuZ8J;ZqZu(r9z&*{PB|)EPp#z=?Y~3kEZx zyc~R%>A~vR{-x(4`fjlr+xhH-PSi=~G%t-Al9V<)JIL%NZ0NYn$zyrG;-FRM+{bgm z=i1Msy>wCinHHFj09LQb)3`ct6?LOB@Y4tjeZ<@!j&PPc~9(Dx|kL)gm@@? zUEr%j-p}I!8_@M36B!M3JV9Z1uzwA||3-$6-QVG3YmS%V>)=H*WP%%3sh@{Tg_<7R z;5g!PZKI)*bqEQav6M|VNk z=p<@asQ`C-jeZ4H1a%-%iW)OE*%(vMJa05j&1`a1d%vZvI9x2<1p^h?NluI-p(hQ1DXQ5#IB>02{mM>}EaA`qOiz`udd z>&~Q(NOoelJl_Rn;~1r|IeGgGf~o>No5{W_5HK-lhVBnkiIb9Guf3hrky-O7*A#|R zB+~iu)5s!0T<%KiBvnapW&rpRvj!(!c$m9{8D2TH60;n|?66#?jhMBd1yQ(elbci|axhs^cccvL%@#iJN2^v6)GF7tC~ziqa+Tu0i2a4cyHi3R z=o@27X_hW*Oqo?7iT1M>5Y?N`4d>YykX{jMv8k(cRPzO4mT_O?^$%&rd-Of}jB$=l( z9?c|t%eD_`XW7ST2Hz}a&9&YScjg~`9QRiwxrG|9Lhn`BkD{pCXY9@^NdI`=L+5<) zAT1+hT>RSbl2^od@vl9j^ZWX_rLAsXD1ThmG6H}l9eBx;kD2YNm zJmGrLm~X>aoZ-PT(W&s6X=&SOL{U-_TRNiC^~+2bkds?mEc+LP4(*|pxBwaNsV8uy zOXvE#y!{(FpfnwLEdHw5nQQ^Gw7B-9d|1yfl9mb18#n(hF81LH%c4Zs3m`WixVmC7 z2dptX(8@rEc{sr~gfMMR0g4nk3~O967OJp0cz+k_kU2=45?GAK>xBkR;?UW>ZsBvos`a=>n{ZEf#!0`uL?L4HNDb8bsOC&92ya7=+5FnaC6i5e0U z5EEV|>3x{@A^ocUcQLG!hNbD~!1+$`KsJ44+5p95<)D%UZn~c;#4h zn}c=o!76^Qe0;M?!nnLDz$Qv>xsIj7B91ka9EzvL{$RKH@8MzHHN$OEul?K0>@WNC z)ut9QbGVLW|1s`ku5^tq#o^&Hfw+W(7W+%P1Z#s{VfKsW1suGOz3Gz3bk!jJy7T3^ z>;uBG%F{#oNg0rL`}frk&lPq`Ek*gUy6?6?`H%VsD|3g%mgj_^`jV)=S9j;FO`BLx8k6 zql`;E&s}RP>P`PsQZ%b{ii)05YvhT?+wAv=#wzQeOgQOSeN3MoXG0P63djgC-QsGu zOAYMK2WT|;=l-TYF^_tEO6?4w9<&}>`|WWhRw1RKm)XeDdNh1JqZh#atEkmi z|Hb8a)^ghb)^j8j+nQ^vzK!xHx1#-uU0aX{km5x2C*h}E`e$wnl7(%AX1hrh0MfA^W;p=A z1+vV5?g^pp0jAi(LV z>u?k?JBmuh@_x@?c_7I%R4~N2a&RRP3+=F=A$!t#=hfy^sh_I0qG~)^ zfRTE-U|MzkPlR|5?En`ziZ;YR0Yaiq?-AmvT>N&4sh zPQK;UBCtJf=CaO8T}7j@pXo<*eRh^+hZkepV{-E)@4+=JM}$GlbkO+Pl$M)`(p zMaHb4+mj-bNwgZpN_N~fK`T@qjY=Cn{g(a%dlh^YY)nK1z171E;hT*UGe~*m0MRvo zqrAN>c`JfJIvsR6J|2mmW)3CHya|C5E4ttlY}S`YMzNhYwNUaMs1?d({1jaMKDE7f;@9B;LzsSD z@;Hc*G&H&c`Q%Q!^AYg;omb1Q=%!;JK?o5mLkwlAqd*|6p`n4M0#_TH>z)9cA|++4 zQ%IFt!9Um@4NtjSX{$)GF1dp)+rBcrdIdL=SywnbwZ9&YKvBp8)9v4~bbj@=3y%lq zf~W~*u{fHc{usY5(_`(R>gztyXm z+`4d)n=fU@E@=+k%Hm!&91#l^6c$3m`!`zn}S*Dt6#LfJ)baszL$ByVJKR(tfK$4`ZPx>Ezt1om*u0L zpB1kvdD8tm6TSR)rch(S)9~r5x42z{=xGU;C7kE#XQ&-0 zlsVY*Eon~`LcU|8-TDb3n3t)10hs-lZVsxekVcqt-c?U$k_%uJeUhjhR)#dEN%)$1 zE74=1u;J+^z(qpT+Xt#bD*hb7ip*u(^Wy^$7k{Z)U^MCI^#y)GzS_lEV0x{RPpS(D zh?;a>7-%QK81;2w8+?&4Z;?R=iJGtwsGejf3EAJ_MoLv^u*y5)KGn7MFbA>=A=&d`7OrS$~zH$L+8}W;nyqM*E8JyG^W{6lp zh479aS{jLu{h(+L0z&INIfD%fyvlS=jo*PeYPVFg5gfkBgieYcS7Hc(v2%(FgjWGp z1wI6Ggd)O{r6X{v(RBcLP?gnyXk>{c%S6rcH1}1}Uv|!LI1=zdSQ1Q-yW|XwIm@UP z{P7IRQii~LrZfFniaiYJn2a)ETct6z5oWXAW4}>}1#~cMk&FsWxQdLu%iFHGqIX@8 z9h73TSOG;6B5!8@$r}_h^!Rn%!9YLCo=0<#`6D;VG~6na)7E%DF3iv}YG`vJK`d_- zzk5sBy1$mZNqr^3!89r4dB_4d(c1l&{K}^4l$l|NmOk@W0v3tzZvRQ)vmY_h$iRkc ztnmTQ4cmRh9qAnX?e@83=;31Y_;Ow}DT5GPZ;f4IRqlErU_peBmQN~W`fAQ_IA(D$eOS*T%!QR`)-FJC-?0Oq@&6?=ZUdT`k z-PsXKnh2L-K3CUDnZu`Qn-L#C&AJ`#d`l=%3hIL9vUci|wRF3@0DCEcg(*`2B*;3@ zr+xPnKEz9QJll19fsujtuZRT)+jB1HwYIY7w9;rbr!b5Q3sbv?L|K>%{chmIKW>JsTFRyR^!|Eil09YVN? zV#PN^Xe6H`w9)OG&Ytvnz2}}GRZFY?t;QqOp1achpm#V7LSCwj6iN!NRUC4C{eSp(Sn;Y0sDBSeyMahv{w1eE_i;`bEuUHCq5ofDy)_Z@<4 z5CNt+69$zmSQyqJMn(v9Ax&0293Z^Ud*y6F=ia*?W**A3#T!~RvoX?+nPE3-&>wLD zwc3-8JX>`f%Fmr~DR=(>F3=UWl5 zB`LzO#Cpv3xE85$v%}(-C(6^}(IhXEY%aDNdPO-rNt?W|*+z$Qn6R+Y5^E}% zVAIvJnASK7{oXYx$tq^BBfrfW=ke)MT7O?tqv#Mug0zBV88}q&@o3>kKg0lzmRh1Pq48{>=h=ekL-i4`7 zp!!Yu@*J~EXNzBv4Y7cd>g?aW#~jy;<6IlG+GeA|heGFWL2XX=_ML3X(ua7Bb?il`~s=IwoNgtGvuw*w8k|}_nlB?(jK*Y&~>B?16Us; zSj3-s9)rR-kGDa2SZJoHXhpo72^a)jK(Tb8%!(!f_;2vn{>(#XKSK`g5S7)kZ<=-< z3>9qf+4@DeNTt0C#nPhb$y)~EH7mp5I)4wo_P5^`W32Q9U=wkHkwca~6_HV4_hgz~ z%66SFJJd!dH_$mwh=9~|vpr7nRjdr0{~p$I%C8tpR_w$E=^spvu!~rRUNWA? zyx(YUuGK_&ui^#_a`^+nmqC!sybzz_awmmZx0+)jkrkt&MfH;3Uf1r2g?u>MGwI1;330XuF*;1 zyWGcAD8#+7v4UqmhnvDniwE!$;zUgwz!1^p6{=B*p+&)Bvr4s${mpsW`OvBNT;I{O zR&6NdEN@NS80L^|j-pU6&y%N|=&f11E#gGuXdW%2lj@Se+alKZ4Ec6!y7h;rlny(1 zr`usIfB(XgunjPc{J41Qz*M}ehNXB1+zQn%YutD>t&cvB{9DC!|JAj&J@Eg>Yqg$| zMt&zlpCpAaha&Uz`!ox|D*Tr=4b-yNZKFXTm06$tlb?$dSjLEWC4MpcPs#G%75FJ! zaP75x53pCt-B96t-+9iHWL)H!wclv=Cu_kh-=f#Ukgt6isAGAm zwAwt`d~~u)s^&xmn$Y2*&uaY^c;Vf7{to)=9Yq>QO|%`o*{zQXVa$6VRRzicsz|pU zx{BQ;;!uFylr)3p_W%X z1KbQ^;k*nf+1F2e^=#k7&SBV&T=g3OC!|~)dDB{)L#@46lMS)lXGG}(1;K5qEA$xU zC9NW0IH+eFx7T2hT4Hdn{tD5$ffO2~J*9xCcYpjmQ-bujo4CB#**{Uc6ODxUA=03=?LN9gZWhQ>n|NkKkozQC0i&J=OMZg$8KF zpu*Kn7`3?l0GkS?1_T_g)r%h`2nJC>rs|mobC)MAH#&9l(|>;z`_W~ZI(JMrfsAD! zsUcwjd)yrV9wog;ubG|5_IfJq5}|4+Amd5Dc#&_fgs-Gd0vyQt?`C)#@$1b4#(x4qvichwq6j7;^0w!CEJwUTC}L49e-Sc>&%(@5O`A4| z0_sfij4h&Vz(x-hK9`$NRgl0jFj!!IE;Ba+edeLXEScYO^#iaYuGqxl=GYUm@=ofA zm9y{+X#k?o9;Uffo|&}E2bG43h6TR5N2t2OXISN|S+Q>wF7gCfP6(PFyV>lz$`G@Z zx?lQsM9fq;sS+^Q*w1UY0g(FyP$jG}#r z8AHodryN5aY41)pJ6&vmTrQm$Z4YaVmLSA`=2$S0fC`z)9{{dzfM)zfuiz7g6>AJC zCJoGX6QQwgS`g|0)65^O>Z$x738gumScv)&JVQ7i7Y2z}@Y_Mw%UwZsFq^qq8okru zPs3WIED0(o@&JF)autX|tfXMvQJ`A$XNHdE2JNP;)jUc*MjV}(Q4b#3gagQ2#Z9_t z)~|A=M02IVI@2=D%W(pqOm`Ze6z0p{AYSq=KQo6VegOdicGjOtuLEG%2TM%(2W*~P zF3TIR$@leFGg+&Daqz@eT>hhCMgEh24C@)!#)&l_$Mx~6pyNYJEG9}(1$M$PVzJ}s zgPE$Xrn1{B9m((K6uJrTiWE-$pH#8FD;s;%y0 z=jf+f_<8=j$!4L~l9bJVWv2_wUr~LG&jX1r!lHXLel-=kR=eXzf1BKpc|B*=Q7T`g zt$y7o(ekd4KZYWVtmuYXVRDb`{cOOt6Mhi{S)*~nyOW^a-i9q<97v#`y-iMWRU-3O zFy)7NKnhOZo*(3dbWoC)l7T*ayT7hghqE{zGJ!Bmo}O9z3(^P4di4(6+)AIr+86X$ zssX)vaQ9aW{-dtS)psRk2d##4pxHq?q=xT zh(4F0JY3ujcUzgzF0sGrS5+_NTv0OP( z3(Wo{OXvX-N=m3Sw^((%$+$TYvsCu((~nu}0aHbvuWD6e=PrC%|2ljCWDelyr$}%e z(-aKtakDPcF_qHI_-ZsUdR}Ft^*GXmSk%_uK5JIz>g;^v3>P9tpCZqnI2gHpuTw-* z8c3fs(J!ERGlBJ$(97B@L#{}*VqUJOzNJO4hMS8kyP5aw{_D+d`f(%_Z0ty-qZ#qB z_jWgHkWXtx0TvGroCQ(d`@8SY!kX{ZM{(8_eD{-@N4eD{+GsR~!+@x{QN{5%GXD=V zO|-<`-nK#aFEg|G9O2iR(bk5>#GT(M~)mLr)R`!U7;O_1Ohv4q+?ry=|NpN>*+-c^%-%Qo~0qCyk?z_)E&$E`18;^gF zbdj*l7{y$5HF1LvX-PG}l8jNm)@bD&A^@JleS6VvbIKREJ zg)1jJyJqEm^@V;I4_s?emB$dc!p=Nid-$l4c7WW7j@3sdc4~9 zKV?vAYK`2#0<|@WXCuY?OqS3RMnNK)-BnOrb(TzS$YXCt_QJuo&?< zPraNJRy(R(rI^8T$&}D?lBQwCHDupe-01nVjh@f)va_Q@r({0wljL|BtJ$7%+93Ow z4Fb?C;~*iD9aAX=+i)#cpIsa`XnrqI;9RjzZf^eEq`kVy7(78}r(sNZM)4w9WMx$S zdakV(Xe?OFp2IzFTsQ0Lte17pV$n1D!}k1WQM=QkX8+aq@OY1w+NVY}cXY*tjR=XbX-4WC7R!sy4m;tU~6e? z775WZD6vX7HK;g}VobEDzA4nuSE?9U{crk_V?BD2{6(pt5 z(3xww;9jxeUaqn_Qf?ZbG+?N9T)N%NIasVU1-*rZr2cp?ww2+u20a4U|H4r2P-RIw$I zxr;TPz0&L!`DLQOxbBaA;9idY9ayIN{Q`jgG3dDn5USAUuY4#=p(BCp-EA7w?|9|t zKk1o&_$zqV4$1E6xG?a-L9+$*et2(i8i~c9`S-GgQ((^z~SYH?u(8@S`{6CbCzez(bsws#^?`-_5u0 z;ve}C+?xMqmRunbauEW)<2W8%Z-|a}%v*&&y(9NObOQ!Pj7++XLYr zMY&w{nL|rNnP#9?K9QI1=0F4k>)lf{{?c>*r5i@S%Rep%O1BVYK<5Y*H!a(RA+))M zPz$UYnRaGzR?u2=uC^HsLH-5OnOP>yftfveS8pbCU<1cDbjStW=1PtenIN_D{Bh?Y zWq9ARG9+bNnpXQaiyi3k2gd#v_HWNw|BFv|bttd)0RvesgmUR`?Sl`ru5duEpQR^< zV2A#6NZ|ZD|E4U>zV=d(xeM2hN%Fhm{^k9iM{Y-G7FXwj1&P2R9G z(B?;jEf%W<&dxoat1Mr*#8F{59D(Wb62Zbj(3tJ}LK)TkwJ{JgT41r7>pqb8`iFp} z#Yqqy^muK-M9n0#`q+{&)ck3_!q4|sGkE7M=dG2bIe_N0~Q1wsYVehbG9<{EWjZtXH3cVpG&*4 zO`)V(VO=j|h+%qqQUu$LOY7`iGq6WEI5h^rAG-O$CCFBfnZ+B|cFY7^Z8V4{iFIsp zW8bhbCQDY5->xL9$vCe=E0QtPRb}YYC-A!{#w+g&Wp%4p;5 zkF`bO=c|e2)1}vf+E}iHU?w^FpvOb{#*eV)VTF;}lExF9bPi9-H=gmdHW-5wWRu_0 z5b)~nkYv?+Wq0_AJfiFuOD`RRVU~;4+vY0>d%UYm?bN8dy3Eu@@q}%nQc1Fd8%Gcd zfGzdTBYu>~QNLt6(ub4H(k$g~0g4z=JHc4{#opQrvFhc1ZKa!B(oHcFfMx&_`5?5^ z!-zKgQpCllXMHwSnNKh^C5;1IM)DJUjs#5=8%tBZ#w0baDauujH%hw{cxYh)s{rPm zx5X2uF9?RQVZzY-iZd89Qymr6ENNOtR8NO%eCj3y^4QKj;w;WJDV)>;tFvO z3cZB2VME|zp<<%CmCTA1cn6f&!W!Nf7wJhcf=YYIFzRiG080|D=fXersRyd^(d#jTDk4q->2acdWont^!4}U`-d?t7ZyPa`%)b?JXHe^ z@Lm>D6v<*cED!a*-=M3YH#y@uXPt@FMTwoe|5Tf%FW5}O+YJmT>;-%OJKj9jk>wY? z7Hx~DR;T`&o}mei1S|^tq7&dGuK&S!oF0@aK^R|`vT~iG?ipq=n90U7Q7|TEZ2r~^1G5ASnsAI%xW*FT>Ye&ZL+C4vhz3x0?mV``xG$^Fv}?3wOoUf7el z`y-%nI3+r^K0o}XI-s$T`So!)0pXdmTkkZpurmJ&5mAIzI<;T5NuE6|n=v#xQEOjz z&8v8x_#PIzISK}Iib-e+uK{!8C$X6q535r%Ueo%igKQmDs_*mq1=5x zh!t*<`mMdwRMY0#g3vaA8#rXN%}w@bDMqObeuZ(w1t9VM1OR5tBI*7X>y4y2>5I4| zEe#_x&o25%W*Sgxkvui|hacr#BlUZl8>iWeNm3S5;PFl&`#qq| zFzjA>;)fSyzA)n&U0f5XxFW>JWlM%%L+^w1092IhH+~#w5_YcKU-quz1!PqNqP&bCvl`Ltk|QBn zV>IIHF0AlFb5VBMX|}6CLvhLwxP&|Z!aBQ(g{v;CgpZ3giDNqt(uMkDSX7)co8JX# z(H8Ic?rn`Mqas~*zMGn{)hjfWX{S2Jp^za9$8~{UpK%3z4ztd2*cT;Y7B5zxrZVih8JKzU5bHEt zzUE?l6!r9ak^5|9rI8_Bb8!wf4 zO$!#7W_bQNmX}jZ^my0cVTHZ%vc5D1e!s{X&aTnVaNa7>x%N%0_3;y1y((r%aB@HG zc=}uU*rMQlY+J0&3(O^7WIIUNcU3C7eHQB#_#p!>tOf7PeBOVfi7Kk~d>75CbvCG) zI5}Flvc%ger*r?FED}Wa{hOaXc33ffv(Z)qju2|2F5-dJRd3ErZ0mnFi&V#eErcp< zljisH^KaY_{Vs;>q=(si8 zn3-dO!nDe~yXWIL;eERiNE$1brLg1ZI!|&eUv-kZbuJ6UFhTnkz|JAbJ z%Ya!AlFdy*&WncorTMJc`_qZS`t>SxOQXvuJ(`(>Mu&RM@p-~XT$VDD^}ZuFFIITa z<{T}37Fvt2>`a(Ww&VK#e zys^L;3HGskVQk(LNNju$#g~9wN}r2-d-1*TKJHTJeyI@n{KjOlsi2GoVWS7n28jqv zjXdo;4GK*0KQ>IbZF1{wESKP2{_c8Q2`Dmnz2B_#G~RZ3VC>q?God5dwxsy`1*qE3 z3>OOQ+-V7e*rxl*py?Xt@M%5LfWN*z^M+#pmmm6{wFG zQN3~%i!hW6nAN$6T;y=Xyw{#xW>cAfa-kDTh@I<4%c?>SKOYklV3v=uFWgy!E!x7G z`}K7MB{NP^ah;YTh;VjCyog{gM*b|)Z4sYq2xCQ!2~J(?|!!L-@t6( zWi5hhrXMGhl6#fsq*ZJ8+tvtmnu)AMhW-OUkT;nc1Q3KvNlikktxr%Gpz&v2W3`XN z0fwaI?9)!pnjoW8d%Fre0KL_SG>9W0iz(z2=7t2DWj40kG?kc`ZX@l?@+QkNpA^v8A zU!~95nqk8j5`j=J6hW$HEeE27F(p$S-1HMSG9Wu>J?nFj#!Qgx0l>!yH2r{-s2T(~ zPXsIX+~OLVVXrbj*n&tQm}rS;MY`eVP`Ksun!);Gu279-EI`DV@Cm?76(;KVy)4zq ztf2jKdjbCBM!6cG9Kjd;kmbFA37{x|Dq%jY++prr*8T>8SJYWTih@YW?3E8Q>Y1aIYnPHJ+u6 z;!M^`{VQwj{Z3R0DVP*9SXK3tDL;#zY+tRvvr@iOq_-VqTFbNu3M6(^Nsowj8n0cC zv+bf3anlKTJw+n2%S7?|HL*ok=LZP^e}5ixvykXY6433uR;o4`RE-8wr#|m?J=amw ze%s}*T{&1(-OR>s;(z8fe4fTNC@J1;XjX=_Q2)Ce|Tm~o3iP;L!B-;Nm`sfq?%M!0=(7EBr8aOCd8&cvyH;0rcD>zajP9cq@GJk% z46l(G@d?f=%(y-CNYSrwy>EznzE|HA#{0RS42`A51NMH7H_@Px)k{>KH(-`jn(bJP zn$1{0)ko5d;x+(3=DA!3a;Hy_!8QmBvNYzV z>LV-ZDew9Nc5+gLy?vGrTI#3T=1Yi$?A5uv9 z4%wnrTMWCm! z+qO6AE>^bf;xgQfydj>2$Qsa$yA*le1h+cMW0g6`pCwjz+uhJ_GpQ0JIi6smiejwF zgLR*I;6;f=b+jx5pq7eU5CjjDPtpGM3XeF+?|fb#0eoCagrc}+pb?saeY_L{Hz>E@ zW>|_&plY~tOU`11td|-g%CE}#M`+^qxw5+|DSX=36;gDbT`Fo z_zxgog2JWZa2|p6=A4Y1BdA2sn$?<1PO^D>f)iHlHp?B}(7?c(RPtMHl8&wez*Wn7)N)f#8M>Kh2~@gRH@-VLP{o!!T<*d)af1iB?at&Fk>wGdoh&rhK{O ztT67Up|?MN@AnEa{O^G#<9@fJYB4{eJ?~Bs{vG03;Z~Cs5!m*jT8&ou+FzkM8*Y}U zuk~CuY(B2fGoreiX;@cnxqC0Xcq=t?k0Ak~P>ZDf-yOzPPuZOm`mC%jJ`E`fE!6>Sh{%^sK|mX2o(llLMY$ zBE9~b&GYPN3(n1ve*q_I;reZFel}=9TiN}EbDFYoy{k~Ii+;{5pTKJc`eDhzHj2>Q zco6Vx`prH!I}VApmTc76xv#%&Fe%J+fR`W!whS@Y6jo@C z!2yJc>AK`qJ>Uw}a;K=!O6QawDNc(= z9L`tN^tg|t`3rMha6JqY1jD{hB(xWV3JDYAK7BIqZwRZiO^e6|%6h;&Nawgku+sPc z?Koks;c&d91QP*Ne^P^)dfkOiVVUxC75pRjp!zs{%XRH44Ub=iwRQ000k1UP(az=h7kP!`*M*Mt zM7(V=)(EiJ3rWMUls^MEMK!s~Go{A^AxyD)^38#+UjEhyzrO}?Lr)U>6aN9p0Wmx( z3!G{>gm&a~XBtdEFp$1Ks*L#~^^*;Pv!GEME4PO7tZ8O`)KXr^tZ_nt+@q*DI=uNI zW76IH_&*j9%ced(`6_fl;vu>}3Ch4CA9<&Kf!v5%u?DwtWMhrSDAOo>eBD@>>rL3G z4MK3$v-MDaqobQ80}#Gn7Ko7@gEa!h$u$RB{JvU;1t<}TA2}obJ=*GZo*I_%?B zCQ%=%F<=qp(02O~zJgZ%Qk=T+B}9|uf{8Q>8*jz?&#KGw1Qx4-+oiWsjtAGsH6;-e zl(bZ#l1jsE6{LA?12wcrG5%{5P?S(Bm~e$6wJ1_0%cbEl6JkkLE|jjSElfG`>uG{p zDTql&uuS;)H3Gkn6k)rB;^Mb1K8r&6E!Dx8{I_Erp9RdHlUzWLA$7JLw&6WZ*h0LB zylfynxn#t~RsI*%lB1&B?^C5PL}!L#Pt6gk)qp5#gtqHHw!mWq!)5kWiXh-iBFsbM z<%yDva@>DS3o@YFjxjfq&Kg>FY78=OG5ZvsS&{@|5c=~MmQr39NApGQ zuMyd44L}}|E4l}_GM7^YicOG$NlgS^e)lFcaRIFZ>aZ+RYcBVA=Y*@Gg%m?mz($J| zFo~DMAqlCTk;n1?r;`6H%5ybecAEWx%#zP7Z6hw{2(NqRgB#dkHGr-wtO|s9qaW=M zkjno9aM;qmK5*37|yxW#Q>A zs0lRq>fQGX{#VmDk*L;hf>>5-1)Q8-7`!gq@h9D;uYyFdxW14EBN+BB@P)W1Vkj8} zg<}8VFV@-CeGIl^?7k3Er6gn=bsRc z*y@-|R=PeD>BcKYzP`vbaxa}IVs;P$8%xClHqa^3!ahpUj~|DcYzZV-@iRV)>+V znM$u?PQ5C=A4oBJwV8!W4~>c7SqA7mNY8tF>iwRpgXTGlS+S);?!TX>DZQWDAB%HI zf|g_AB^Qo=i|4Y@adkp+-U610zU$mE(R1WAf44PoBqqU-B&)lObn^pmmq@_Q;!~l* z{hqt=|LVJxg-QnHvjsoPO!T?FnfNIK=RFu=ygc?I(C}&tEV<$7ZXHw6CZDNqX_q6X zdlu%_Mw@$u+h-nYAD(cVlhqdC`vXWPQ)y~0&(@BP+_j`U04Cp}ZGTXjLzX&)19v_h zT$HTWgf32&)_lN>YK*li89A}Cq4CdN+OHo8?;budlewHb|2GJq&N8CDPcNh8VK`Y>XEN$% zBRBYx|09(=V~yElNT0`m&*i;KrnsjV+UzmY!#FK>xTma5B^9MEv4pca0{ zOF(OELJuk~?J41#HlLf)AA@GP6s)r3{LQaZnHP95hLB5-o4q8GBO233R^LUO=cO{0 zN`gc*6pjjtHdRl>q9a1WnF`8;M4*k+3<=I~N?2bRagi2|JpOjToCjh8UJ1x|_-fT9 z_b#1Ui-+ljeRv{>)dRA!H+ZK?aEY02(FE}~jZ*tdL1g>QC%%l6y5F3XB@mGXu0(S! zmdr(I%x6vZXy;_$v5>2d+uj__Xavm|=3@K#--=Uwp$#dzaQlBZHx6fMSxSDZqa-|0 z@U5xV+ZLR4|BbR-LCfJfi{#fxwXK_`!o3gAehk6&vOB?#?F)m+8}{R{iVc1X^O zd>-wvkfnhJ3qBptm{^7c)JzQ^O{F+0850+F~vwwB4C0mg%z6ays)ZkGbMJkmCm zrC~4G8*9;^>tq!ro}sFqcPPSKz)f6NBt@C(RxeQa-b|szf^o)Dyz9Z`nzo|Nr*3B{dImRnpJkT04W)3%9#y*>vAWtXCsXTiq&p2yW zYM#jc(hBfnXG(%P!3)DHrhpxFnwep{85*m6k|>n z{?+$=i`1uqiJ6(17y)REwq8H-j^e;ruHoh~*m-(l{UJt~B!v?V5G#e}V%QkLWJlEc ziZsl=h0v9YFN#`c_t|!H#@Q_SK6-D8UEy;zMCv|;cbmTXRotIxG4Z#Xt~6KoK02tCZO3U_2E z+t`F(44c5b(HgFPHogQrmg9=L`Q!!{X_X6Ee{-5u*iI^AL>-@Wu-q9;!jpJ*_q26u zfkGf~lRw@RSgIjw>yg!7_I(j|Il6843BSdkJNaZ;Rt+=9(RWd1+0*|ZXbfBL#cTsT~ zJYvr~?x@CFf6sTFHrH*9BS|HiX^k3fAen0XMZ5L-YtVN9(smr-l?Oz=FqhT4oga)8 z1iM1OPb$7RB3$j2x=G%7 ztd?=#Pl2ob@0wRz`58O42Teh3r_k{vD8PKMeb3YTj#GbzrjM^_H z6wzAGpS`8g=-j8n*Z;AA^u1y4h;!N?FJ9=`K__T1K0n{B2N>Z( zi%?x+eBI9Ne6MfA#qo=wu^FuX?Djl@hkY9wNc|=Rymv&!=0d1_A4g)8>kSstL&qbc z`4XOn-$G-oectv*%K|Q@o`D6i#$<_?Jh7d}Rhx}^S2xq))^5+sBIEnvA-Jo<%-*~* zm*zcG;0c^~D{!!{MhJ3cqoh36=z+X7On38c5#$qfXg$Desr6g5^42~Z6Q{FnxvHlU zb_AUZ8qbLR0QQIfGeD+xpaWWY-M@X%>G-NmKbY9~IQZRfHSYp`t(B|XE%p5*_`$3j zOrAP+N)>!A7oF(1JESb5+EPc*MM!D8`9-NeCrS~4v`NuJ?YG^%zVWwJDUfA_XMNx*pvZ9J7Mn)}Hy z^=lq!019?eM7W#;MfhNIBg^p68&MTQy}gnDz(Ten)CMVWI}S*rbCRXINcX`xj<3n{ zDBMS{tz^+?#z?9lUkjJ8AYQVUqN1NCtM)}yJ&HZ=Pj}s18*@ob<2)~n3y~f#Xx-n? zu~<0Rf8$GTORi#k!q{32_|)Stb?BVh1U8W6@~1{^7}_9;sCV^$qM4s6-OP1=5>zd{ z%fxv`s6M0UYz)u)N3UAEe?OSvre8@UQxk6UQc0t(lBEA)$U`}~V@BQwMT;-Rbh7Tt^$XAR?MHDBjr$FCOynoA) z{!0<_8-G7SW+(*qBJgUf>ZiCrR%@O)X_2G#?$=U!U?NMuTw&L9l2iS9&03Vx^)O0O)#3Kzs5@=h zZu2gS(fid7{M2AJ?hf%-N93JgwA)I7;YZ(m32qkfsNYNKd=ev3&|`O%^|@5>yUAAY zds~`*9jDKEEqQpI<+Obp_#5!5{7mwCM-T2e&v<~$y1#R3487NPY%3@b`wS;fTJeDV z{+hkVZgz@uZWd}yPF5CoiO!X`&cj=Nj)Ze2Gjn~CSJM&PXjh1VN7l6Qmma|K9Q zW6|nIPV{vAM1vE|r6AYcxQ<_vgdT}-WR79F`H~bcg7QHp)rmXuWR5?+-h_}^3W#6K z&J7AcGN`D$D<`OHNQxn3`5M%n8FV5I?mizioRdJXg zI%yoN1Tw*|s%C`LpUE)(_Jg!RRyolEBuEt!D^Fp4qq%OET?+he*B(h~av*CBB7V=h z!vd9zbSX{PpA-aNu$4o2@WdDU54ozoZZl>TjEo*OZxt>d?!5HZlhV_l&)RXv%THD6>*Xm1 z=ouy&IaK$v!&fg~S86ui-WqrAS&t75+qLDALg+8cX^WoITO}` zmE5bxfpyVbq?qwN=)t30vkzSr(U>=k{k^_PXZh$smbYFUPo@pA{BPWhPmi(e#1 zji5D#oJGvkdU$l>rAj`f7Jd_ZJ>iG@#QUX4ss!Zw@M)7ecOtaJYjgdKLE9Fd&sE)t zV|67lYCW+Wm;XkW3+?>_L zA117D7T@#wwAQwo&F(DHb5snUJA%$=_Gi~>ON5A%&m*SNQn0?{NS%0obvZip`iPCJ zosuP#q2il7ckH-anVWgv(r@edJjO$v^DnFJYuVk?z(vy)(KJzwEF(ClHV-iE4Sb6@ORhAD|& zGkDD0m#W!U&+w)F@mWKq!j$hhe$uMRAB}Uy7IvICMa_vDR%WR;EnXg@mLuO+82a}^N7~>5zj+Ktn zWys_A{)^%ALX1_dnd%ibALiWttslKHM|KNz+_eQ2mtd`AM_c`i*IZ<`XtLl(95AfQ z_3SvxlViR$i?W}#~%el8RM~ds5Q0%c~%bl4%x&O_Y(4D2&+U5kx z`-M6>=`&kQCD-c+@}Q}yGv6~w`jI0eHw+HnIAd112Sc6B`f;?G5iN`5keqEdUG*|i zI*zJ}TJ9l3$=~WWGy3ce%C|C+5B4i0p;kmHX^L|K4QDV-uD@YHiM=OxT=Y~{P`;Im ztj&b~($*oy!t*Qh=efpa!n42RB)}p-T^cO~XS?14DZSZnwm3PD{;kx>XJ`i5!YAeo z^q2Xk%abtP$4jO+Tl7L`zR)Q_DpxrH-|D+GqarJ89l&%C|D40Gs<_VAX6Tfs->`hr z=<(e&blIfY>s-BL{9tjqgb0PC{iUG3bc!iY zi=@LC4gQR^CXS}VG!=HdY~oYB*?T_>0_HOy{6Aw=|FeLPg*u{HE!>3H5aDem4I^O&OCX#KL?sSFHOk* zT~kL@ZfRR*DET5X_M6~9@A+UJM`1|Kj%yx?&zrrh-f7PC;R92V;M)&fL&bs^U023p z%19l7c%`TLE)T0|XTIcxD_P+i6)&ga^Y+Q(lB0=K=uVCdH;d(u<;fb>o6Z z+r;fSU2r+27E&|6Aw;@&h-Tz3!A(^X;xtWZka<*LRmqbUdvbq5u=X+au+LxMsBa`- zFRvZXj&8=N1v%mO?WM{UOKp^bGRL=*j6#&)_A;z;C#u z=PIGc`~EdYAo~_qff_Qn0z9MLHYLDomuW8s-Mcy&+1!cAdZ|fi#2KlXPjw1!0-QdV z_Ybd-&CVNgKd;l!?&phD2xJNUecg-yzUg7(-VE&XF2N6(Ww*-FoL_zZF!_2ol_YT4 z#=ld)cG9$#58A8(Z5(Uq@3MBm9%*UqHg)#f=@o$Nu5@e{^?C}dNboM+-iAqDwnkM> z-=JBC_zFXXP?<6uj(PTLL{+!yiSO6 z=$6p{IKeg=w zKcAc7_xt3{mlt-Dw-q^(mlb-Fw+Xka0HB6lGGzg_?d*Af`eN(4ffKAy#{JInNgGWr%1d3Elk8FTG3ICW@ zKzS=A-|#ekK5}{Egn;$*p-1()h@=2~0=XR>TFoi#c)NNA5nFZd)-A1)Xq;)RUx^N; zWS4ip9k+wBD}&h}XK`Z!?=7sWSYP0AdDUC=mHxII@VWVSJiI|RH(%p=I`@tIK5W=^ zMcpa4dp|Przozv}eXC+`<5N#TK(5Kxjr+*c2in=f#l)fIw%2}e-x4Or z`l%&`@e5Qau@}fCm^4WEXHmR=#pstIWBXmdhlro^bo4t!vQLAU{(a1d(!jUzRwgFN z=c+DZm4u$0U!OtKb$GY)H9>+7>|S}T;FtZ-JM@ZtuKqm{h^bpWyxLD9bl(CWl#_K5 zW**#iPi#!SsYGD*bOXQsGuU)qH6Ytx+I-pM^f|J#d+U97e~hz%?T@ro!0`T7FGPRz zNqq$LS0a4tGY|4|Z~YFYYygpNb!8>#043Bh%`cP_EX-TRWa?BSdAZMmoTl^@e=Tl| zJ~V07{`%f__c)hU^Gb1p9FrV)3d*MG*{!=4@Tf#_d`uXYzHsk^`@IQq-%lZ~f$SKm z8F)7m3P0WqPx<)RtOWCyESKmIb@#<3fqOw-n+BaXA_gY!zGoG{i{9LDTr~(Zp^QN6 zej)dJ0N&a`i@1d)4u=+6tO?9@LQ?NJKH$-=8RyofmN-ha} zxg~|gW`&u=B*a{`yNeRO&jo+=z0QXfx??@_PR^dLZECEuvIsNrN#0Hj))P{+Y%@rf zJGbKwm+UgM?e)*>{BE~HeV-z8IG=q}h7NDICXjJi<~jL#E@maN z*Sf$*x1CwTt%AmQ)sFeT4PAjpZGkONB6#_t{zn@^pX}T_`MnT?Tm-Weihm-u+b~RO ztLc5l^{X$=TRuR&4ER#K8O!-;&u#@2=&f%PSF)7O>{Q^|GnKORrk@k3qRI5>@~V<6 zgrZ){h2I{QjFlIGZB)WBf|lEe5apQnhlb0%g<*c*Bk zlZA$JJSO?(CqfSC%^6e-G2%II`^4Wuk80>dfB4IzSlBLaLk5(3BoCr!tb-W-%LRYR zUUYmeQU2D%-T9HBCbHk_2Noo;9h+BrE6|==} z<^^(%XJy80as_g&%;Ui(A~=G4IaR^D#0+UinmGq(SFG}+8Sz(22SkLRw0~hguH& zjM($gPjOLqp^vJc{_GIYuOsvaxIEKP{^Wt{j>VUb9#eu#fhzrod#5PqB!VKOiU#s0 z6U!!ba#S1{C#ZxQ-HIAs+4gtH9VxKUMbH&m$Dd1qt<(xvI&Pak6!HrsRQ}{^4>!iV zGxIWn@*!}4k{|xfmN9Jm=@WB&FHcx#kXmSYdS1kJp(0vwypqQ=h3AK75ZVu-fpcd^=$2X#(3aVeTVl}ddn| z<#&b*X*4r|BD#O>z=Hr`km7(((03x># z;!?>+6_>;iEdtE{a>fvI8YXd0ZKPUWM8Z-oKd}K#2JdPKh#)wP2n3gigK zTaKiG3Ro{>N`^2de8eMMM}z>eaB`Ne$1;r-ln0=YMyjPc&M{K00(G$p)&JGN8pI%h z?x}I4d33(V!>nRsh`uu`SeB!RlF0kKlIlde_{%I(?j1z&2F9!1 zJ9x8iC0@cS0hQ3dSdCsE(&$Umu*P~!zeX%_pQbsHj;T(@h=J|t#p+3S3#mv{t|KyYu4YEAar8u4 z8K}Zc&F>%}&Si=WqjG+oMy5?TZBEbyuNICRU)|)3*XkgQ*1{ul(S)MkfSWuF6is-->WQ)a#wuHz~s$%bf2DRMCD$b+JKv0F8(q(8A#a$k^ z^sJDfbjIilKlezed=ynkEDydp4+L#&9LPG^cd!N^5ISS%Ss%YDB+WvD;DwQF^gX*D zbfY$SdI7BdJmJj)<5UTBm=*{)gFzQ$<;nI)ErS}sH@u(f0MTH&AQ8I%;nCO3g=MU7d zEa`;a@@)?2oJa@vJecChF!fyHHV20U$0xjK4plf}^45>+6HyeHV1hmj2k!f@Z(w2~ z8%Rah!6K)&p+ljNv?h_rj+HLs?ve~WcG|UoGAq#quiraB#A30iy#w}< zUVn%}6Io#($Sk17ZIJUUPzF9tXNn4=7EE9klp)M{3}YAS#c9DC^7y7MHa+~~KRkZ? z6AtrNR%SkO;=mf9Y4QDT*GIcrKJwDDYr5*z1Z@9ppyzjw99q-fyvFbTTub8}zx>&| z3JZ>bZhjmGREb{+WkHQf^4!tJP{TCo(h4u6{N&$0n{e_&b5o!8*=`Hi-{rO36mZ<+ zF|YAi-l03*>0e&sU0kDEe@C}|IzR10_uu{T<)t~Q3ui&jLFDIhP;x_r>KuL>nWF>U zhbWz4h!x6=sQ@V=1d18j0SdWHP@G7C;P~1al|e*GsS;2Eck#!Sg`S&Ap<1g;qR}AR z#2iJC=^P^mqL)At2}ZSHQ1k)3(8}zdy zNG;b1kOL&wyg|ndiMS^M$v(_CGT7%|YSJ;6i0qpi&~BvKjZnVBC{}2+@ry zT~(+O*~@g;xjjVckj`0{Qx;Vh3%m3nwGKi-2MQvA{VN)eOFjY#XdIQ?C`T7^My9$# zY*@ZQ9weYtgQ!3WL+Ly(fy@Sl-~#|m%o=J!h2%@buJp?Qm9z@g|5bnT?Pte?Of zl-sofsxl(rikH#7gR28W82BeK$UeGv5XBoCe|>ug3NHaBY_1&wn4oF<%Cdop6-6;M z0Xd6GWn%4yoNzs`s(85y(z2GlYR$*@UojG~W=LM7!ySUtOB2)Uk@W=gD3(u|vN3Ei z2g3wcRyYCnA(k5~6Uai~3IdYQHoOb5OK6CLH*SrC37B)RCzOjTeg(~XS-L13WMR!x z59}8*&EF71yQs&_58$yD)C~vE8*qUmI3&mmzOhoWxcmc`%2(yu6ZCoLez;`CBr&MU zB|aM);jTTFR=6TQ_0BVE;RhDE?E=9f0aXDp^}`*dQz2AA;6kd=iY&(b%`@D>@(H_z zOL)+)dHC29s}?0nQ86FgJCPv#Clp6z%q(k*>RCh}N95&WR`w446&DN$Ay0NXXd2MV zL_=@}#k>`6?;~)dI;vYvOVl*Z=95^26*)toRT6P0l zm&yL|#@ zKXeNE92|$W1#&>;%z<8}t3uP3b{-Xl-9~{RMdd+V#x4)_77_7Oz4Gw`QCg5n*)fNY zzaR)}8I6iT#qtW#*K$M!Y6)800S%?l3hJO7gWSpjWsnqw0pUaH{6ScHv(ya|O=F$= zSyCTn12j&KAywGY9C0BJ)tQg^P=xhhPQkR`)qGxVlaZBc0roV?T(`Xga7+YC0Ej1y znBUNG3L!C$atMGUPKiG?e_)zr3%c^fs^ibAui4 z&rex1*>|hk^g*xX1Fn_#+GcO{T7O5gzt3)dm$v*)zxhM%rBCK0|IU+-|5^WFGe2e~ zN@>g(R0t8hCXOA4CBLR=bIoU**>?Y(Yuf7nz-9S}W_q{Ra+7;yO~Cq2_u_APOdoZc zKjpCg>FmV+JbL&O|MPF&-#^j|p#USYS`8FL7$}FZ=LX&}GW^%o2q=p!1RzrZ zhqIteaY*5C@Ia){Qj`*x5-J2e;WVO@g;Ob!8mp>|AjK*eo|d`q#ra2C;aC`h9Wx~c{{xg~PK7Y0IiWRA> zZWXZRw}MD6RK*a&iGJ_kYQPYNbP@nPfVCyMcM!!J82@8?2X73k=P5O90T>sgizMs4 zJh9YVuH|LZ#DaNh$+?`7f3|aQm}`lT&;R*|pAIREO_$s2^wKMX|E=|Px75{EbaZqq zTkM=BSvM9sJ_VIFvCyCnxX=zg;IJ)CR9EJwrk-kOXfWBFa8;aM7%u!h2DKJ&2Of^4 z-vN6RE0ITo6+%PG;^Vj6urzU&gd-{E#9;Aot)W@3IULJN3yWO3{SK3LeqqtXjD9}A z5rPE~g!C2`r_> zIn&I%87nC4Ye*4IpnZ`fSO&j7I^R|YuHki?%!?PtM{Sx<`OC-*p@_9jY0KkHug7V# zn@yU>H8wq-pO-Vx->cSXH!{j1#9vvbB;gZlC^b4UzOb^4TPT92Aq9={!&=1(Y4Y+> z3MB?!AbhvOIXyXLF|X7&Hgpe+*uCOIf*KU2=t!3!3V8z_*X-i@Vhj(@?Sos>(%g9ZOmabC+4$6=6HWx`0<%~|$s`|i^Y{awhru#qDc?(gF3Iz<@Pz8ZmZYlbZfSS>2Y;T7b2!eP+s=LM2x!2 z=kNv5P4G9l`LYBJvpKkZ1>$g9>94RO$n3AVbFMmWT-QImPKEhhMgX?d%yy$ZxBO`5krzzGP9u?k7H?h&gQUV2z#8a z#o0N!$|6Me4?A8ljUte|&868OFLeJ5`pC@hK|=88M9m+9-XKm#4r4#y)_r!Ja}gbT z)5_A^+>FcX;fVuwCu-y5LI!;<2ns`=YAidU9*;IS*bkCiUJflPgrY|}2%QoLLbYrQ z4$HFB;dT338(JzVtCuZS_~^(YBEJSuvor*9efAEJU#xBM*<=ndiW?)H(#33xE|POG zOvDfoA(1HbC^up}K373O#$W#T4?q61Pi=VabNAl$fe*cZ&4YKZx!C*Bpy@-p&=X+k-c*~0AZ!Nal=V!m%RQs8APp^6CzBS*tYt4^;{N;mt zpXu#wG`W^Ej9;Ojp#Z55pL+*@Ymp+oH2@+^fd+8HRkq9lQUPLDV3@%0T}n-fNV*U7 zDjk&?h>-}>F)@&=cg?^v^PqrY zSpwdr2FRLo2~asoVS>W4g&e9N>Q_xDv4@*`V^DXE>I78!YKWvq!bn7V3j>xN%8nof zOl40QAUSCoVPa!c$wztwqkx-eoW3bBgBa8cq|~7Ll!G)U<-%>_FWihVWK^w2W@rV4 zLfxW3a3QrCMN}Su%C0aBl(9-;iAV;yM3=Ees*@rn(qgz;>W3&&iN z*sI~{6mg(d^*9oZ%nBF-c^n-P@)(9euHG6V8QEXFjGjBVIxvKRe-cCAME4G&cw^)B z*gLo!jCmP#N?CC;u=?{UIb6q;`kMUI_r>l1;F+D3g?}E#%agK+5fXOSw z*9Tx$g}j<;dGX+mts_0173HNT;}dev7sbS-PE46;7XcJiToy3xBJ>nzCZ)z4n7TOZ zaJa@sC-?7_?k1ym5`ptt~4KFAYv-`DmFT8jn zDPv~Yfu%UiApYb(%j>$`dvfoQ69*2Sj*l%Z%+$mSd9N1^Psnasnml^gEhuDPSf?&Dh@FiTJ;552?YMEqnLwKVMjO@OWZt&xrI-m{~!XL1<{IzdwHe{+7Cim6av4 zZ7#3y-1ePE9d@;>dq56cF1~IMbSqP^v8v?fKmJ}^?1}hO$%%>Sd3hysvnHqtOc@?! z4+Y(RdLuMeyspZUg75w4yN8Y+JCl-eCONC1plV^+?v_&?uw@W(-vKh^wR@t!`QXkM zySh3`D{HdTGY;=Rke7b}ZStgsVv`Jth(bQMedYZ5jO?70clIOc0MUFj z1PK9v~^_}!}+-vUMnnbb$LiM z4~c~2XosI4XAOiL(-Q+bwr_rEF?molH2>-Z$dl@c`0c*hVBA;IWxz66226 zRhA9+4Wl#KJ)r*z>66_>b;RbK#I)XkyPXogg!$=cIRTuu?;`} z(Z`27|H{7fd5`lCecGp|CqFnl@m|-;y8`xGeb!sGr8TC*WPNW@VgTqUVgjc5X-guw+ZRq^nC0d*^a7)+QgxO}j> zfI))-Nm3FKq9Q2*5KY~W(s>N_z!KFNJ4ZlJYe&sC?C@mr& z#o?WlAh*f*q@9ONJo3mL%M+bGdX~Z0@aqVDvL8Bk^)X-*Mpk`LD@oDg=!}eR*Ii{C>#ahN>r$vOhaKJKzWdF z^>rSAx`ucmIhIw~Asq_nt>9|1MKY)eLeMRJVQ3_YM^717st3_eq$iSyp+t6|tEwPw z7`5_0IKY%@3M@ek zHTeuDfEp;HK@&nLt|&3M3ui?=YLFWxjbs%I6Dx43Ir*>d8MjxZ7*W&!b^z`h^^5RNUV_V+pJzg6>?`dT|W>RYC!rW_uB zN8jYsoQ0-%H+CBu3HCWH)c&~6>+>a4G;85$b$I9(NG)s+n$c6fKl;Pa@{1Ta(R zgTZljJLcwQs;a758tNS;%ktb(eQndiqR9)+;Cb-?9`_DJAUs%s8hW}1YHI4*S{o{= zN^4uXMy8fDx1!cqYatN!0RG%I^YnO4Rc&>B!~D|Z(#m{EakI-QrX@r!<^mQ-T2izd zd~WmNL|<24R#s8o`Qfhq_NI=DlS^)8uLk%r2^cVZ>PvJ6yw3iivC5j}hK4$)!)&!I z4UG&gnB-UYpea0{;bjqW%Z(C`%i7h{a3L#uaG9mo)KC8vl+%+)1U?N|}>MJE!fEJa$=T<}mK{(JcA$KO!t0mQtu%W4y3@Qc(swp1{rHKPjI7k+@`{0r%PV$P zPUZ7DVLS5p4r#-m+hv(-uDuX*@Zgr0Upsg(zM-Yp;`V|sR4>{{g#iyRvI9JRqO~;F zoz2Zm&&`-E1MON_SoB(L_7(Hg#O&bE#TBcK89_365G3&^@ACT{)@9quqIG3u2_tT5 zVPVF!qJdx#&Y6m>K(}bPhde&N10Jv0JY%uUH#avnG`3o;m?8{oo=V7_MorFR)3Nlq zY#yg=X5PH8>|9z{oSmF7TO1;a5S%C(&fFxEf?Ck$a69HL%M(LAJq`6O10zrt&5jYL z`sZ3e8U1MBy6qiY1E5|^ao`#)fLWQ?eb9V#vD@nz9%*^)wFiIl)89ILnP^&aLa+`t<|i8iQGpokXw|fn_E=eON#U&MltK8a>4iD zKM01h;YK+D7Zev_qyf!vG75K)48XA8$RPlbK*gz1+~@>BWS_H*%AgPwa%~Eag3FK) z&UI~Il;S^eZRPknW+@+5k|4(z<|QZeJHWS`MDw8tZjaxIZsLH!*h2d#&PkNC@N1eP zF!lnZA)A^I0C?m{FEHid5jZXYQUWYVCrj&`KzMOIAuKUPq$DAQ{lbZbj8i2L0ps!k zRDQ&TZ#AIzRYwMWUYDu_loL^uwXqQ7gLE|}_z-nY9N$cH-JFh zex6BWG{Ds)Bwtv-Ek(HkMKgDW!s#F$Wg{yEu2gSwbjgejEeJChwt|p}7N0PM?goDV z+=5_bFk965|2uhKqMoSVL=fp3>e$+sCOC1V6K=Vf&7;Of8-2L4G5 z+7{hAh~kZnztOz|&gQg@WH%i)iqGS*_V;ye+qxww;dEntOI>YKeM`sOvY7{!eHv^< zEH-LgfuVqTJ?Ng#PCfqgQ_ojbwbfKNG&D4gjZbS>qu|ewazzs-HWa~1(^!S`?r6;N>|#w-b?k{#&%d;{u62}C zD5wp8p4Jgx%-*@n83$qhRi6>iI znoNreIT@LU_8#85>)_P%JP4Ju*`%NL0oE}1R6bL0TiuR5$LE*41Kq8sP9E5C=-}DX zYQAn^h@G~E*bKOY9pyg0e^>swyvgaQ?A(l#r{dRd++nrD+T)4{n^mp2Kp3wcx1+PE zCMPvB_bwuGcp8(-N`RN3f)l`Km)C_&AF zY&7GYZtAhOz^txq# zCkU(3>GxRDQj-oJIX*ZzF+Vj|T3ohs@3HQoN!YIxA-{adr$4YfVZ(uo*^8YAc5Nst zFPfg7o*EoDaq!TY?6Ve+d`p1V3_6HPD_r>8PE%P?Va(BE!-FH^j3I3RJbCo&9#pspHXu!J15Q~O_e zv9!EsY-VC|iaZ`XetK-q2120WFep7C#dn!Jw(YbpYyPN$U8qbb^27o+05LF;}~aCDQT&PV~#IaT+~ET&QYP5q_+E< zRmJ(o4<8ul>YAUP>S*hJZP($ls%E(_Vgbb>6Lb(M@;RVgyLaw66@PkSVq$1)_)K>0 zu~UhQOJ*NG#HfjaiIPJ+m^l3I@zH^;uWXKsi)(6VtgXXb(Y4~>3kkG_11_EYLk)ut zfcS;+{-XzW?cH~{yt<{jssVoW)ZDzr-J(^~mq8r&D2s~Y9f7`p)iYvmF*H?$N=)Ad*AZ5Ie_+-(Fo& z_{_6U=jP|NG&R@PHg)!lYV;Fm%hGw}OF;Y$0_ox4?9|2GuWdVYFs8Agqq4LNMW*MM zpn}}?qWw*jB3}5?Q1znx?Dfw+QC?Qm*wj*8-8wWnYj?xBico&Fpyp3#<6G_>091Ze zcB_Z1{`ro*Mby0cTQlDFW^civ9q_ zaW^h8;-NBaeM`sl>lQF)VNi)9Ey~ZC1VT`@G>`&OiXN6H{`lA&ioofKx<5Pb%rEUY zkzIQ-ud#7t$;{T#uWo3vODIu|DrE*$iZEOP;SO_|kT%pUI8tbWm$)SX-Y688^jP% zNS~S4a*KQ7GU`v~HI_9ESv7va1WOLz91Am!S%^P`#383o%~_JpH4My$Tyn+v1}@&c31a3)L}c)rol> zCo}7-Iu_4Y&lK0qt~kjQx{2$T5RdNTx(HDO7_tidNknx$^4kM?+wjz+)uldv60wxn z=5=Nk%8w}?I^%F-s?(QT-j?1GvzhA!T882&^;0S*1*8iUN*-pD_XIIz<33`FO(1W{ z@e`oR>BXg#QrDPTQ9nh&?I$A-RKn!bduJ_meKTfF@919~UvOhM+eKWm#E2*j{YMKR zglq4x)Gi<8OHH0Dx(lF97&l+#OJJRlrTVUw+Vz z$H-~=vo*DfU>J(C55O{y()5Yp_|c?8ehQ$A>5vufL28r;ijZk9T6G0|E}qo~3GhIW#^TJ5ob(%!5jF7ih7X=k&|{ZJ zOg@Ma_5{Tk;NAgPE`d~$*Ujo1%dEK&RB^rr1@!YqgpO7XuvC9j0?gGf{8-n z!7dtdLptCQH6u+(U=K13>koV(=m0!!FS=dhgE^ReVy8-PUQ#pK0q7^E2USw+UMKp+ z6AHO}eCh`|p*fl&LAqn&fWZ=g!SB@|JgZF^1THT(MT8JkN2#MH>8|q~TJ*ak=(R4* zPr*lWXnv=kb|*Y)C_H2W^93!E9HoQ!7tjK3r`ut-S*&OgRl4|zH8zARw1O^2g!F?V zk6Uxu?6wuS#48q_mB7j(YzlWov_mTvLVy_fCXL&s!D+KN;X|Wec@u`RN7=m;PQVwW zgU#M>xV_F5^RmO`^vLfwLCe&a7aTS_ofR1i&@L)i2y(VV+Gc=FV|AzuN`gkYM<&lj zAwX&v*a0P)X1Cb*`}EWX?qEQ>Cl24SGa+}h)}u! zl<;$nA@HFY@gIp72QK{`a3Sv)WRm;i!8SneVD9Tx86@ueJ}m`FmoBAzD> z_~@G?K?CUai=uN=34@5FqQ~)v2<&Fo!=H-aVCQ5*edBH@XBj9DnBm9m?}X>*nUd`Z#Xos@*{7G) zckDQRc1z6J!uIKDpN@9-#h30pQMhS;dRf!B)vq`Ansyw|-*lp&q|dzI((}r@Hy_M- z`S7``-!605=!#xh8Em6sM7xfKrv9pYLgU9RdHMS1;_; zQY+^mc1ut%s@tDyxC>V&V+dbAK>e5~FoA0UAIyS_ z7`a)E7*PBfX;@ZXy{u_+=gHC+kDWc5RXwucDX3~IX&A8UdR_PInY{W*n_k^L-q15{ z(l8_IcBkGkuyQD|bkotyn!ZK5M{n(3*`H9e;ZW|`#{SL)=h2*own?8osCNu5=9Tq# zjt7orcRslCAoI`T$lB9`Q*bdoqq0U`OdVKi-8B2 z`LQ|}A3m3*ue~unE#<_ig!G(qBNNl8+}Jya*kqW+XtSV{*JWBN%*#zkPE9zIUR~1& z{|eQrY=~e^lNr!YUpnY@JFNXJO}VE}pGio~$thScS>bbnfq*)fDKnt>LZrlPU+HdZ zN>9y7IGvT8RXDli;C*-*;*;>f4%b|Wf!haOmvgAEH#aBiRANF}R&Gc4kOtmh=>~lK zej9v+5YK_riG{!5*DNdZH5H|2PA8v9&L}LbTsAvkyvPC6@JUPBVPShT?V+)5$4kFO*6@QeZO28(%SmKLfwS z>19_jBno0S zwekT5{3B3Ar;J?#naIlme4zuCXJuu?B_t-MogElk;IGZo<<*9Xg93u-F`xv7Vb?B9PRCcmU+ z(W>!jr_Y6cWOmR3pAEjMSbFeahkCnC9XWdV)xF6l&kT)CQdp3qkS<~uKJgDq9`IV1 z=P#VkJ%0SyfrCfSoi8=PwPps=OpPLoJa-^RQu+Ob{_c*$hY#;Ncq}0~cj)4R(+#%+ zlBPjM)$Ny4rOMXU9ma&I1BzZDWr_HNU1b#dY0!$wu@&{5PSkhsp{FG0Dne) zXwIEpGEj3--;py?JE>b-@K2_aEBbrw{8jnt9@A@QTPAef!6Bl4>d(&=3B(bp=1>j+ zq#6MEpgUzFm&<_6VS0D3FXnXjiTsJp@l9vS=I4F-3KB0`iknyVW%h1NX{#~m7rK3C ztESCvePZ4no7y<-(yIo2Nu?tfdaXTXJ*jA_anJ{E(Bab?y6xxdZRgv92}R>e9vz#b~pG$&u}brvJl@}sUq;2K?#q* zX_(cbQea!}%>L7@>DAWkhPm#!5SE1ILHqi+nxvW~i>CLF2lnSp)SGluNbj4_lJYy- zr}TqqomGQ+TKRIzhz?b8`1ORdJq1nfk|y8T(#45IJ*&8_acsrLSvov)*iodM6J>;w z>jq(F6|0OxzvUeTByjZwArLYafPxltdf6D3HcwD5Y+O87H)nF_HkY1J*4H$ypKtc& zRhyP9dQI2L`jd@&ixv-^A3KoQQQo_PK~Xzo&TU$FIiWwM*wQtxrR=3K&hJAX6*btkxy@GnMf)fp3?OdUGEt4pDq{#UvY)A z`R)3#?D6E{#iYXd)Y9?c#emJv2OC(Tx`w^krQ_$D#|M`6hMwStR|{j$jUBr%x+|;o zT%W6KSU;FO)H0=~mtBMc#N-U_NbfmXI`>*;|Iz%>_6a?$ptpBIoAKzU8%!sw7NVc<0q`Rb<7e){4+;rl2d}U2*W5>YMlKK#Un!Grh5sl`s^0`|ZYM*)H z$qN?>D{JfehA*1zE+dcRP&r8?mS(@lxv~^{aNnup$4iSV+S__;PCmbf87G#XvLN_m z(!~YNzcM?1Z2!)`Sabn#T=c`ZNdp*uM707uG(Nm66@j+}+(h%%{Eqey-1OXCN9B z4XH=^9^JQ;5r6R2*Y*^YHB~pXEtsrKH&`@yR4W|MK6tgx)|#E$UraxfTvlG)(mO;y z7Iv7pMQ~=M5cdw;9tWHx%gTKG@uP7u$I8pgYwH>&=T;2skCr-pHhG5Wfx{f|yF=c& z&gSCv>(}R;D=IFp>Kz<1JDtc(64<^x4d!S3X(&K4L9aRX=$>7>b`_V^*0l`Gt~fp1 zR^S_kVe&G#FNFfbyY2GD>nJ@K*RGvPC**r@cA{r$B~tKdgu06 zO3F$L%PL1E=14YOSuA$&qBSrJGU(yMlk__#$NIKx+?bMhrnaWBxutU%1{dmu2KxBJ znN&sD)PO5H+}~4nKJSU2{wy;+BO~YB%iDK%4~<*B{8>2ig=WaCw598d%M%qPxrerG zJ+^&!>Di*KFKrDva7x9QoQp;>5& z;t{l}2y_N$T3KkRuim)f`K^0)=N6U6#3ZMlIqT5;JR1V%QMS5xM8hBQxx5~SwY#k$ z?)bsypL^9olWWSvFo0G z?p#*>xy-^{+xCr(&yZwfQoYVX94L_d-0XB!#koCuH|^fN^L%01?nB3O3rp;LeU|$N zU=XTBHISd=z=#+bXg?W$eAAYfv$8Tyolbdj-L@4zga&%SClDe5K#3v$x#_Wr;({Ho zyb^o(XmxqT)-BtTQ*+RJ=pKlJV#M?r;+HR=Iv%HOtgkjTVgIwwJeQYOl9HOf|L~FF z$$9yOi)#a!Yu{k+;EHnx$fj~eBG&^@FOWk|cIyzu1U+KXV=`(cmK-j5|J!O0N#QY9Jyb3_if#jN3yFTrUR-YE@QBy1_w<=_&$mpQ z?M_`kUo~>BbiA|Io0Qg;nA>wAfAHl~^(~8f&4B%Ub>E^}pEP;ToNbu5=@qTxr_R+M zyUL^LT&4mZu9B+B?J3U*TxhKy`0)|w$EMCZaH7szvS^Qdjs`dmV})C z(-(%%)sGJ>STW8yp{ZRqnF*Dq2+L$#aeM7R`9u)P5BYHA59w{4lY8TeW3yXN7dI9) z4R#G!3d%zP#($MXl0 ziic}^tdom+S;NGur%DqlCU<7_oG2cfwCP!;T`^g8t>b17=TIl?7MVrB_4Ng63s*Fa zr>Ok;@M381>6(2h^~vWu>KaFu&HCxW&I4JEC-Qm{E_5}HTc!ef^w0K4Q|iE;hH%Kes2h zemH1z=-s`hedCCC-l;>? zpEz)SSiUiVuJH5oR&EaGw;4pH^XT5ewSgfF{F4}TKe~4i#Ty%cqvs9;;g`~3lQYP4 zfr74(&oVvQopdVpXzYoY#I(W51wKoZFXGa6RAp6jn6Ls~w`HX;FDEuO_P~*t@|q@- z-2?yo637A#uiWQ%z!~;>H26zt3Gs2qlTMsWpIBI?ae~^gpoP51Mjwps68sgn?$t(n zyUwJYJaqENiKMJ~lb8Di0e)WxEyLS{cLGy`AO7(YXQn5!volYeICUa`T!qxA{H(k3e$5 zAiIYVG{j@qy35hu)|ixh?8vEOaVckEBuOsH+0ZoUP_p3X@r}jV(c*&KxcHOsV_Q0g z`87T?PFIR&$Qc((Xx{S;4%@|^-ZQZYM-LoJP0OBGSmM{GkPFT!?RoBZ(AkGBdR%(I zQF=b>(6N}J%KE;cDd-iPx2!o(ni~{$t9h!btoYcmBQ=fH0~be@?ff;$FsGvAq6!!tPynCHHqg^~3xFcant1tV(^6EUvpauifEckPfmzQNUCV=>>HZ3IhAt`5%5SqoND>y zQ8vYQbNsIU=GM4kG?wq;+8T(Xb+$n4cD!Jxxx zTTD+&i93gNs1~tSwN)>?L`9+k=L&|oGarKgE7YsXXRvf_YKd?o4I$vnFmt| zx251-as$z;LEyUIZd;ivE4pwzHom&4qrP*<>gDbTh8RD~$FJ_m%Tp9gAn5gY9M`ob}1i_km($pqHiIh(QZ(dnjPCS*Eg1rySgKsHLN`Z){}6w(9WC zRfBNKDdj)QI}7R$oTx4mWQ1FTeEZ7{6%Fz&ZV$qs?(zlQGH3W)0jI-*>6+h0m3==K zw;FUeIyAhq!_b4Sf&4TmJ6|J`ZDLf8D)5{8_3cJ#V92?WqCx`QNz z_YQEA1V}*ylVgwW?fDXPE%6FGS`Cv<$I>Vt#&D2o_q1 zV3TLTq!XkJdr$&U$T#dlK`{ux4kl}kP+sv8{L65Vn?{5-ooErYUv!52hBK+*gX+Ah zZN&Zhj46~~H@z>pdc+ps>qxK*_-jd|LI`?$fpnKdAS_-+zjttTUMBnCah1Qgvn zh~f>5zsbD=H63%=;~dX*jMe$wrp2-13+YAYGm}#iW79H=>Ra9LwdK2mY)9x(HQ+kn zard=1CdM8JMsaCL%u)EIStpZo?0)`)1bqg$F=&E*jL++p1+L-Mjyhqb$g*X9Wmufek~T27+mOL!Ajl+WaCdhPGKApn?(QxDf(IC!06_)|mJr+} zIKe}3*N?n=_I!JGpI`l>yIP*Ux~i_a>n>J=-i0I2-MsX|jQx*s(+95J--%QiKkZ;E zzgjT7f63DvEW}FXP{uT&Ni(wJ`l>8HS}-RyCp-J@=gRzG1Z#ZJFI`}`>>EiceY#y| z!Dle44CdJs=9y-yrb?FweMysR0@jC3V#;JD;vnkYhMSJk`=zv)$&hC>h3d-^O5r^7 zNT^I|h%w@ATCLI7`V8uhp8b8f2h;{`-Sr%=M9lB%L0xFL zxo(1^Tb~@4;r_p34HBqS2inw%P_EtHUI=PU0-Ywp&rkZ0?f$HkX3rUWd!N-T*Blwu~lPrY?n9QEDY+mK@xg5+G`SRL%|MBv3 zanC)emMV!!YE_~MXrB9Fi+x&9Tw58ilc39MztVK%WH)=$V_t?Mna@8_a{r2lSHTbD zwz+5z%~n+wxEO>iHXY4(+0R8sWFR(Dq4ykdwI?9hl*W#zng|?}7JaM|UNl~)b3RKZ zDlgYhPpXMyFB~YqaCTas0Q?k_we9&lzeDBkadp|t{A1@OW9EW?qdUhr@*1~mS#;J# zQ0wvi-fIKs{AbIn$N9ASpT-MaYp=xdh&j7oA(k-sxaIS3j8irQ9>H;PJg7y!*dLWM zKy0L!{hkmlA`C=kXmz+E3Rd44vyKkWUu?vV3AgfGUYGaOlX+p-FkdeELEr<$pd!ObmcE(91NWpsvky;g|XS5>Sw%F~D@YsUnQf#x( z+mEes1dK&$W-5qf8f}_yY{a$Sp>VPG(XhI=Jl&UKMtMLiq9bIpE}#ZK5QbJN6sS(L zf*O*7yhL`1c2kyK3f==f$K@m9@0B)MAV6iPp+ZdXa8U}Vt;Xb7%y8yoOo}Y7_-79-!ZvbRtF#|d3MUGa zy)OY9MJ{6W^8HH>gosYEgvDa#X}rXkAh@frxK&c1af+EC{tXCqB-9~Jo-m&2PL{Ly zEKH>|h~H3?T}hUcMVvtLvvj;Uj=4ZQ>wU4ynONmu2n1I1>W!hjK1bOr!vcPt;90(h z$?TA5Q@nkZfHKrn_QQ?`8qQqkXHR@#&tsB*z2b3y**m^{oAE_6dhvqaVCoS4%^U9L z+LLYT_`$A^@sOuj{vF=<|}sS2e*2TbT;thHV=@M~Eui4rYMB3xL-VsSYs#Ik-I85)vPRu%CQ zayGHUJT2hsDI?jyNm)FJQUWgq-n;!9%4 z(e(1)%xyY3x~m81i;H`!>-UsT4-enpgafrOSJv#%9qFl`$+UdGzAt|TL0;H;amuBs zX_~5;eHXE$C)i4#;+ECY{}^h%c7c0-m0>sl5zNob&&_cYxNw_ANtJQMyU`|K{h9<8 zwyAYBFE6P;x*2-L4UKO9S^iwsV2R(EITs&ra;A-PQmKw?TW8P^f8p^Wf24|uUsuaV zA3z-^q9G>o`)k?#zAj$qcF9c&)(+wSZI9KUwG;WaW$gKBs+wbL-JPe&73^A`_!Z1+$Lru*ZWVO)PnNKcrB7oF`WU|}K1 zCVWrVZajYR(Bq3{LQJ2`@>Z!cYoajw)KpEw(9q{4KY&lT!KB?w;-N@sb1|tqX=+AI zgOmS_32)9dGiK@-&MJP^xVT?vZesQgwtgN#@%JhS(Vq*3rq<|{+0y5%&_50$6~_hY zaGInxD^@F#ghIkzN&is5^7~(s?l@m`$`-e<$XnkWBG~t2QjA&C|#9#W71v+pnuQJNZ{!WvfZxF#-+&v=M>sOvp zTB4V8&g2(h@8MHgQuCw9gayKsmA~^HT`e|(lO_+zQfK=`_7bkIqw4q5o^vaxtfK#y z5z`%F;wDdyaVtgAS7LRYSvS!=MSf*NKj$?Td6&lULQJIwERqEHLn@+|W-%qWvLXAo zf~cr>GPV`u8N(!KZxYA})eP9Kuy+AJK6}8c5BnF&R}xCMqSt4$Py74L+hXyO`Q^o` z*Lh=RViP3E@so!B*jd}=W@qJnq=GO*W?R~#yX7nsv-*#2I1lc<##F{!jwyKa0qPqMRUF(JOJ zExi_$$-#lBAMdgMVv_p#S+7vjiX+Kk({Q?N`1z7-}uw=7m`eg{mFwl zay4n_EDaa!ZH`Qs+C9I@=hN`7BCmM(qM?d0(Y;_&{jVI8niaua3WL5uu&rW2Vfp32 zPez;02emQ4mA2m<^kU1L(wJkL=>1@lzCnDNtpv%IF-MinsOUA`8L2VEL1AgjNq_=( z^Bw9JWF&J^HG=&6M#Pw7rSk8##vHVt;%hjoBy@t6j77p_yM+c)YKgvlt>iAy>Xu%p&f6mb-2sG;v^7#v1g`MQGI2BQ7s)U~AFiVIlD(9xlb zH*Ifz)|+G|rF+AL1Q{IS9V0+{@TeTI;ZR3!q&7p;5^_l{##U#nOyPTr$nc7lv%7?j z%2}Em<2Z#`p!YFoq0x>bOFa`FOWdT$sPhoSuqXQmognhf@HTK9AWw@oxxnNKI<<6; zu9T^^z~T%AnW>Z3hzUdvFjp6=G%OsrJTsYsXzOW-XSKElqVe4&g7DwdQ_9hS7pyEK zrp&O=G;ol+nLpCiu1aR6Ik;bA;Q1_VFbxW{IWJ@7@Y>&PjpZ+&o<25mp_G~@epA&r z?svH^GDBo7>ct?Rwjqn*s=BD%ZK_mx zth4ShGg0)5_3tLlvecc73}Qa& zWa$e=wt32FNsp_+lV9JV^L3A{?qjw7mp9e5hpa5MJl(n^l1aFA>s-k9OG6kqZWngT zb=GHRY_$(JQ?>Rhh(F>~MkQPv;@K37k(HH$!=R?L6_<_(3+&TwpL60MQ@ie9w~WnPPmY{&H_8-^=e$ zW$mHj&~O94I7Q%u30?EUz`X>KUW*V$PWFbS% z@tcuz5h8mLBQIPM&}6TW&-)yZ_xW8!1?A7u7F=du<4<4ac9>G##IxjG6jb(cC~j@? zE%D_%@2g3PliB&8?>RtZ;8Aw)A}IqB6}NFAquvxX>%8w(tX4fx#G>%dSXY&}_}V9p zREZQDvs}H%t`EYwI?sgoJ&8tF?p}7u!8V%f68C49f4)Oz2Oy69$Faq;$@wp;^~`)h zJ)PfdT3zLz9|yQpwF7nx{@^X^9)||bRL8hEzMq?DjfK(FVB#4jdm2Opg6+iB;Rc1i0)y6;NZ{9BI4+@a zj<(0vJT^%NZ+d1{(B!%3*vrxcXyY?xDr`avaxp%M@&A!x?(vCx8;wchmmC@e41D+5 zYwIo~Nf6(Y?&7SF^!E%BB50-LK=2IPKU14hx7@ea-$YU_g0IF zpsf)%3tc$m8;@p7W$#T-lH2pC=1Y`;b&_D+fGDjdIynFVH&JqY4tkxeIBLG# zjl_M7%m=$-QxCWsGQo>`8RkSO@k>s+>Cp)WEqY8G7Akf2i;$TTyE&vDLFogJwu}rC zrBd@l3cV2mw^oV@HvAMd#NuQ3AaEEEIfAUiTo zYS!I7mwor*;1Lc6efxwSf(}!|BjX88HtZ50b|yA5?iOB|)^LV9KT)jATZ@ZK!kk2s zkxab(FOs))@{VL@hf0;%Q|{!RSmWVTfdeBBs6h2=Rg5`pjAH!oW*n1*euYpVnk{3Q zkjU%L25(iqZ3l|pcL3VbQ%%hfeTkx;ou$7J>d^OQM{A+b_DWAT^(xu7Kb8db?xeOn zscoL-d}BMG3LNrw#I1Ybz)euMD4CNkX-u*ob69$yG^P+bu*`t2#NhtguxECd7K(87ev&M@>+Df6z?Slcd$1I7O zV2hCj2Bsc!YL!8Pb>BEk^P~Y!^(4RYN#B3FsN66;C8sz!X)_G5*a`pxer`q5CL;zk z-p@vijvc()h`hr}`5@2#F=|k;tcs!&nVv~|VkbOIJu#(ya(~8f0MVs)B*Pz3MlD<; zWu`>Se!Ydl#}YEhb49_ot%V%)a;poW$gNV0%SO^!I&R-zvI&7~p*;dTB(Td;{4vg3 zgRU6BT4~54ui+L$xc!L;LKX1gLsSJqcVdzB1X|gP1=gF%7|m^7H%X1OrE$utcp3w| zeWXq1%NbT+&%kU7U64C7Cq35?O?X0U-AmOZ*mle7^W$IO0K9C;DLdu^00dcE0ZA?s zPZHz_7OEK7*Qh{aSjK;e4hWf!Y6ONbOQZ6s-(!Rjdf*&|rDB_9zp>dRw9WXKsikO* z%Yyi&qLx-^k2!_-r9rX}cVRa=Q{aOj7A9R+1I=WHPS3B0IVw!sK{4}>^{I+9VXVKh z7nZUEP0S7@w8w6K2Fs_e5{}!VRkynLx~lk35)ao>4l(_4B<0R|xZP|wRulPP#IHBa zvC6sMYBgzqR&AloyKuh$t$eyDFD8M%K^bc3G3Sw>&z{s$S#lzjiLJla$y>lh_E_2z zNd34kP`tj#q}8xB6WIlCB4_Qx1V5p)5W^I6a(8e8j)i|M1!HNJAG8w157$OMLstGV z1^GGyj)GoRP*vF0h+ZFPrmyYy4YkTo&C?ssjF zJYrboiR$Ct-O9Io8Moe`a znAS7U7vf|>%9*}d5trh^oE8(8l=nJ@2EOlySxpapc@o=8^GCsV0DKA` z&dhjK0dfu3$K`S`p(l`DFr=qkV#Y3m`AB`DqeFJ73nquy093@x6XI^29xA}opV1|e z5G^!rz<(xx$w+;r5y4I#lB?fmV&MITFNJSSpGxB?tq_7>k#TQ#g{ha$D*dafbu zl;{sDe=fIEPj&*XLksVYte-9caLvy20hHSd+j)lnejouwKiOJ{pXj-708n_PzZc>q z!8DcL)VSYut9$y>ZT0BgA>?)za64IbIAs#qoxy35qy0<`N~36ObbTq+e|LfYMc8tiT)Yk+%$1Z{=C0}WVt&}~nF&gRsBt&4^z|sKF%$AW zRtCmRNQZFsE49R>X@h<=k+Chybk8mO8MTl>J^jlo*elL$QGE&`Ua(w9WqV1Qp{Bq7 zs3}elaOiw@t6juG`1q7zHLm1S(_R=v)$}!;RBa=MI9yk2fF*7X=LBaRC;M&&v@n7Z zvBYZc?QCuRZo;NXPst*uze3_7n#7?~Y6a8SsJE69SQP^ekd5A*L|5x0=S6|h$nm-; zU|v0XDfNyy7M?x`rpYd`IUBPyX?3Fq5^q;LR58hL#5@7jOM@ygR|8;=?<>x|jS#y8 zL2F0Gzj1AUMbEb%1$th0`ucP}yk0it-VS6na>RUQd;AB9rk3`AWU{%`jn?U=J2Xxl z$5;_4=V)cO^0cW5Tz&NT-Eo!Xw?o^}X;V`69@cF8sm!*$*3-ht%fiX2qASp);7Ak_ z(!|>bsW&1rR-ZB00QRpE)-pY2cuAi$_d#NwexAf^uMplbqSnIJ;|Uh%cm8%@tE3Mh zdhoAw_7ju#VMK+q(Xz6wr)!so)Y=|mwpXD$nbtYl!SLQ8Ymb)mN_+~fJ9!K)55Rs7 z=?8a52aA`k={z&~L-Wb}VNP~1G-TCFsCYv#fdcUeYRvq^ppt0CzBb>&YOG>9tY=0p z}Zrob!lWrt!%iiKGJe;X{4 zzZj3+e(^kJ6DGpy47yKnW1k)$cd}b{-NIYuy-Z;-*b>&cfl`KoxIW; zA7ppOe6MB4wSiEhv7DK227S~BV~@zNNocKT%IR@$ZS9$Exaf`grD`-w&16XvFRnB1 zouw!Oi>aPGC|UekW3STLovQH69psSPrzj~!l1u`nR$vC_*qn?UyC@JFSLmN~Vrma= zy*BO{+HWnQ6`ur4m;}tetnaB75|>g-iqd-n#0hVJ?}4up$CXhII{H;I_zp=u+epjnZLE^+BMTSJ5ORmDbaQ27OSS$D>pM&j{SrY^^YtMQf=-JSr|SHk0$ z@oj=#H}Ru^9c4F#f(F#>l^5M@Ph7OS-ry9fmaD-u-XYTdr^@-uuMF)QvtNoTKK*)B z{KDO(9x)>)%%R0lMU^rsBNfs1lPYZVDRRa*TW`6hXXq3(&BEE!7sjE4CmFitG@wzb zL6a#Mw?yH38@6;{zd_pYVCSq99wukN*{6E>|~tw{AQKZ*~g9c8y$ihDi{ z70SJ%Ko+0Be2f%I~1+^bA84~3l-M#cW3dKRaPF+w1Z-|}u8o3zIvGa+wkK+ees{N+3jo|2d?#_9^>&Qs?YI)&t+`rvD zKMnpw^@)b6oIa$Y2?`D&C_u-zl0$Ib8@c;=*j0NGe3wm)%tFiMIwg62SUDe`l6uLH948;ril7YteRlALIvN!YrvFS^NU=gUFN#^96 z_^?+z-txlvTCNeEKY)v|wDTL}=D(u;-R++d>tz4FHwn-BbA}US5p$jO5?nW~(mue{c9_61^6mqXJ(yT9-qb+tL5n@?YU$ z%_l43?8Mlp541*Ddsp|z;R7p(Cq$k@m)+?ide09g6r=D5Vf4X2$LJnEd?(?90Doo% z{?EfJa+>+CQzu3b-xcllPU#5UaeO8@tGb!a-Cycf&Tk=a*(SQG5g!1ctH*5w%KLpU zJJOE2R?ffKj_h<(ojW$A8OSF+K?4K_;enRH|4aID#_^?~X8|tN02WqqM<`n0?Z)f; z+f`eUv-lhl<@PO2Pk`gC8*=>l^M&amS-B^*IeH!Fg-7=l&wr0xxL48UNGyR0`CdG~ jy@lxiEd6-9;P;cLm5vTbsgL>=;rWx7R*|ZaFbVm8rJc}j literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/remediated-icon.png b/windows/keep-secure/images/remediated-icon.png new file mode 100644 index 0000000000000000000000000000000000000000..d0a6ea1e32a2e4f064cda5c64e26493e16553c44 GIT binary patch literal 1105 zcmV-X1g`suP)Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!vFvd!vV){sAK>D1LjFYK~zXf-Bw#q z6G0UAXQ2kAkd_#Y#t1}WH2SD9@?cE#MQuePilQM+1iTP6>Vr3o(YV_t)E3+HflJj$ z2t_CjRA?*9T5C%$esk$`x3mSCh6lf#z|5Y0b9T>s=ge%&>cQu3{{@Rw6A!luf0+H_ zbF);#1||3cWRAt0-g;0hwo}`#%FPd5hQ48=?N@~OG0#L#VQ#w-#*7f*Weep;h0f}*iGiuih@?c}{2=ef@+ zHLwMJ$ry3ikK-?V3Fa0cK5E?ea@hD}e%36T{HgTcU{h56j)&Z5l}zet3Li6;T!oL& zg%7|Y7F!zzS|7>3)<#1kd0#1%^A$jiJoEUk&;QXTbv^jpWQVxfk90^icW1wGrm}Db z@_=uE|mUaW&k6v{+3^m{tVb1K7Rd=$Nb zPU!{+8d5@KDG<)pgsx(MLfXKLhqa$n;%oG`V?(rT!UgSj=U(!|y!_**n>=5KMqy<= zRH_jvDNai+9C@+eXY&#WUXhRSAqAlU!MQ6!9BU1YOr=#Tz-gPs*3v3Qb>pcqD9ddi zEjq8_J$+vu2jX$|i)zJ7CBr9sb6P2Cmt9?fRa!nJk#bLsnQ-(JF!Ltwxj!|G28>D& z!ql1lIJ!wZd}=`6L8i{z<>Jv*O!`XHB8+N5h2gfKOz-0XJogrr8}Ej8Y`x<)Ze82UPxOtz7cnK6P>QY;~c_{6;!)SXc+7vD` z+{^H%_ai>5AVA&>UB34#8oiW@r%xPUN-v= XCOo3GZ~}av00000NkvXXu0mjf-^vBO literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/remove-menu.png b/windows/keep-secure/images/remove-menu.png new file mode 100644 index 0000000000000000000000000000000000000000..04c622a0511af4b892a5db88cb6d35baf0dafb43 GIT binary patch literal 3301 zcmVx!^P)Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!~g&e!~vBn4jTXf40=gKK~#8N?VbB? z6h{)r?+-hqfWpH<1Utmxc$@_&mLcY0-nJoeHrT)!oEW6Ykq+_$LIOo0AcA}+4kUC| zF8JU~I1C9f1Vs=5KIOgqV29xQ?tV?Bshyqe>3MkYPV1vlPjyXqS6A0g&v<71hd<6< z7&p3&uI^qXc{u+?CGp|@gHa^`mF=)^qoZs8#Kc5C|47N7X=C@k125FPjIAj&+dvhP z_ry~nN;}G-+vw=r_tN4Oro?Px_{Nu#H$nG5I&}t_-uM1WQ;?BTD?5Bp%AQniBRs*{ z7#;nexvT6reB{{J*qA9H!P=NHr`Ft6ZJfI>aOLW-DIw3afmy32t_kP9IXhJwD_6HT z&Rrh@`@H+z_n6t#_Lc~RfqxBRYtBf(HZW^t%7VN1zGX&~E8BsJd{D}sgc>WNS`CD% z${9a1wzTJbW|`pAn|wb1+2Ca*6#UJYHNXB~-=Tp|FM3W@MOiZ#DGTZw{6hwK_6BVu z@k~;#AO2>*hHviP>py#b9z~2ffg+33#;n+ff5}qS*2-Qfcyr08Pa<<8%)p-%dRMRp#LdLh<8$jq^)DOl9VIWX4vCl1}`|^&CcSDjEaj91t$X% z@>pDO)xZUXCu&&%a1<6Mkjqh08zfS>iH8}yfNE%5hYZ}hrlr*^tq9w|A_}bnX5?b3 z6m*yO3#4<*&^#Q=MHF=aS8IytJE?-AmKgS^dcrVGyfHmUg)^d^Up9nq5i6vo_1ly% zB#zEl{@PkDSHiDVfWy#m@r-oxlYUiXgR?XG&z}G8`yb#5Tt5J0MsD9Zdi;b^bHmXY zGiw&n6S+M-s>lI{p}BhPI-N1E*6M0R;pU9Z?Kxh?;o9Ncg@LYp2e8F1gv(YnD`f`) zJEN<+mu}$wM4@T@R;6i={m>ljJ5*Rrc_pRkkDD`a8H(#s{5l~N5EHzd!&)t9>*WaM z40H5Lg(3-x{m^jSk&u@^&rOPgjEI{vz^wW8XlUTmi?}WY$iO`iDm6EPIYYt%zfONz zvD$P4w{8S-2DhHc)bz*M8HCY*6zw_O@thGYA&16+DC7Sq2av~EKF33&BZ?tA;Zd15C2po zPfL{6Y<7t^Jw!q7bx?=5bxi$oSUH3D>^R)K>4Poua0c_8-Mzen73e;eP|+FK!WjHU zV^FZmTRf0ZNHyBb+gFtMQ0fe9S+g2Sa}ZIA4zPY~nPIy;3KF;kwIRd4NrD2l(D5Pr znMx69aYpi}KBR$EI3t5(&PWkc?+o?pkr=8QX&^1mP{LRV-{LFF8`o{wfvu8<#L*cu zYZm49^laF=Q^_508=8}!^yl;WMay1OavQ=p0}lA=*4J31-hVJUK0ZG5`8BuIyeE#% zkh@Z^Zw&Uw*(6wweJ92qSTxT>x?b! zIaL%ChoSjw@baW9l6A(FtHb9m3>-avV(`)s+yHp{w*TyTrRj#FGq%6kNoU~qN)-jg zVQA*oE}Rp2MjdCy#IL-UCY0jbP4@ z(dX{YxA%%<>&{)G76|*H`DgK^4J1B=E3Z#5iCRURow0It3mV0O3g-;`OkMxtCYz3G zjT_1tpmFWyQehzMhlZ9TO_ejihaaCtyVxG=JA^Yi+Qs5Z={OVE8L|ayH@Ax?L>QFt z&XBDoVVnUF7R6o^5>`{HGz{*}*tPdvaRU*xK-dq>lP6Cm$Kct7B5o}S=?pM(`wm*P zc|$A^!JH8X;fE$D;akMjU*w(unKM#E=8P1PIU_~bI)l$7bawZ47vG-YV+nxyH7%`_ z@DYVT_zw;LtlwOGbp{!EJb;e@K!QXG_~_Ib?8*}bZ7_!=X#eM{?xh9TdSOaX1587{)=tE;En-(LtV1c-T9p)?c&^9u##X!R)*fPT+`GI24 zh}<3?9zXHb zt*^iP{s#oZ*w`3O8iqgzzuggeRFvW4_%Z$?dac4kTlv zfJi_{OiWB*y7TGek=u8g)^9@|rwhgapN!qyo`W(n&`Hm-D(PzstfmkNSV4i1pT&-l z#3l_^QzuXNV+93}No*Yj60?zD_G7N|gV*OS3?Pril0*yERFI=o@_bYlmmEBN%85NN z78XDIvTN@M^qp-hCaV`@!$X96$P#_u77b8*CG24^c9C8vNv49 z6Jua3sBe(3=LwL{m{Yr=sRfasiiG+9Rc>3w+Qnk2=W75#& zNRsyt43sj1Bt;PthmAI1)im(*-DD>9lYtY6j7)k+G%#=uVNp%p(jB=yqCnIkNfO7T znRL5#U`Pf@iXtQq8|}gALY7RD1}_cq_EZWuG;xy>8~J#M5~h$WFbbq((!@$N z*cc&MU=*l^NmC6rMo1PI1*&1vRD+EX5^-Sg1%2k%w6p>#!phQof|6>GsJHeZF)NWw ztb~~~y~R&sFvGY1%~$Oq{PCxs~=?prFJdI_MDVG{>tP~LxiGe1i2TJ7xJwbnD*Q^I}QyIrfpTiJkU~GE&PnhKD zieIiUzw9Dmz!@)^*hLZa5f~Iw;kgKm;+>@5KRp32Qi37?F9P_FE~HZ_kxIm!tVA4d zRz*!`D%!~Ip&M)qJ&|590|j=E{ilv>C4)*>gUnZ&fWvVV^X60r%IkiMi2 z@(2LtQ3N%a8D>=>sc0j*!FI7_yAlu5A4%uLq`r|DQ%}j@IR1XtV9QR z)?@Y)u&c5glwx$pWK5HB6dnurWfiz$hS-rW#PT jXLynYMn*;nvlsp!wHHD%&o4_000000NkvXXu0mjfrY$B! literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/resolve-alert.png b/windows/keep-secure/images/resolve-alert.png new file mode 100644 index 0000000000000000000000000000000000000000..ffd43633fdd2998225a6e6569628532fb322a975 GIT binary patch literal 38547 zcmZU51yGb<_%7WgAp#1lq;z+8v%nJ4-6h>iqaY2^xFATElynKwth6BA-Cg(N_rG)J z-nlct%r3iUzc}Z4-zUy~0;|d6Vv%DZARyo>D#&OeARq}KARr21AOU~ZIO6kwe;~SR z%1a?sj=tUj9-!Drs!Adt)Wl=oo1p@aFUYMevrvo)Y5KqZ>g+Y{Kn0`aq7X|M$OHD$~lwTR)7{TTl#0>QaU_OR(@v$eW zyTe%qwO^k;_qS#o^|?6Fs_pNn)U5q$YC6w#40m*ooU?NA|Tt)HBN`I2V~d0~yI_9MG3sJX+8JIKd3qu%Y`VsP}8eRbaO z&@Wwr@qK*fofJh-?=BZriC&jDP`lavR!&VQ4bC2P=E4_TcT!ix=O9&O_(~#L z*>){@kcy8NoC4%%c z3A{5OoF?evJ7my`Oum)tf9Rfj_S)EQ`1kd&jo4WPdjR5CX^LqCj+3RsS#p{YewPdn zvoT|SO!cBta>5`;+INnZQTC`jfTCxOMW=Q(g^>r@&tK>wCpUOhVg|DW3q-BgV}*Z? zl8()X>9(AAus)FN=F(GiS)x^TD(t?AW2~I35K18+vT;(6{e_4=o9t={DxP{x9)+7A zWTJ}PNM(v?7;w_-BP;JEf@B%A9D>f)cCI-j%@N^F808-k`MCwr#?}@1tWU0X?tjXU zcWol-Yf|NC)%A||QQXZYjuARDBi^j};_|neLtRtWG(z|qNkMv^j;LeK>Dw;U1UimL z-x8=eDDD$u#e8HbDPFCl@Guk29k!mS@gWeBY4Un7AveX(pb+)*e%sDUO+>2>bz;Kh zzOWFRCEABVA#jOJ)Pu9I#{~?JoLI#PuaVXvCmj%Vqfwhg_E8FL~>@f&aNZ9Y=%!vt!z43Yu8fw+2$BXm&)J zbOpPaB!aETh&UieqH657+F6vzD}m)B??Uu+&k+WoTGwo+?XC6US2bRlf3QZPNj>zD z_h9JP0ZZaHlUGj@>eBGw`%dw@&n{2PRRJ%nAX2#>7F_h_kw&`meFoS#67_U{!kiKU z@XG2-^%lai#Jr9(Hb~@_f4{Wz^->JyQ@9}vjDKmkZ zne^c|ybQy;ld&!$ffHHOwyr$EYN9x|kWI{TQY+V&2|e#6)mqO<*?k9?Py9};(zM{; z*U7Q&$p}#f!@`iSpJt$29ffEIUmvKRw%nojzAC3Z;{qs!mofe6!N_)5bGXef{y-7Y7?=uJ;%1?ZU1p z|6Y=_H{}{#6I?2{y*=dzb}O+KGKOVgkU%C z$0xG6v#?KCm1Yto$S$my_v5x zSNTn?l;c6a%w70m8!;3xCAZut>wkifEkfLsF@;pNM9ye8e`JoXsJASX8=pk$cJ2Tu z0Ic(;SpG$y-*3FZ_^+U2qF1J(K7F4m-#4k#w{FX_ua0?n zKCCBa?*gECAH&v+!7cb<^;ZO`F-BC&QF|8dzs~dQ(4!jnZBf%I9rwIhxtsSOnm?Wt ze+j)5lmC?9oZsO@5-I1uFZ{$)OMd1XW0<@asMFLeC6pR=U7VtqcJO|sgEpJwaL#q@ zmT!PpaIpx2$?NMz&?~`*a8b-Wf@LmFu%hm_cst$L9WUO7atXr3Mte7fWn=>%{OW!> zJ_kS(r75x>pO9Hoq+S^P*o5(M{K1xR+53|%cU#7M?2g4@sp6A~Q zo}-AMUX|f1!&5E1Ga5v$3~SrV5#w0%Ow0c1J@f>)PW;}+-Bu0oFY4^{ zL0?f7`yRX#JS7|;GKfg-dRjY&%|YeXOQJh#C}fR_kG7A!P`g@*IIE{?%V8S7{6-`{)AL&9!YowFOC6me3bh!@=(&%pXOb}94R=T!WoZqR0HFC4_p~MIlD>C1x zJ&`RjP%b$Nc|UgG_|^X_KlTIQmeesTi$uY~0VEw(hdbW<{(acBSAhO8o(ysWK?CM2 zDzJF}&P}^ww&GLtzV9-;RdSKj=~0}eqlj$$!a>z~TgBSH!cD+oiaRSQe!TLV{#pYw z$R{+-=b_8whDF>(a%4iiV@OQdOe}}IA#o`;#0R)$hP8J=96tl_n&=VG%eQxcsDIsIo;| z)|}Efbc(H{i<#Td{b4U`%I4DC!n}tzd;(-!F3&9~EqQl5fOkENz|Y|EN3IfeJtct& zGzAtIT0ky*OR464;1du$Mzw za4Qp7;!U)o!bbHUy?Nl87#u4KIt;~NaIdq_Txk5bUCm^~cT}BhlXZp0uuSms{mF90!`a^s#RhocY;*96e}#vK4v; zub`AW`GVex!i5hyVq4chzpwBvA#D1NF66zr(%Yc5OfQlBmX63bOfT*VCn9=B&{N~ zldr;3Jz{)9U-(;BaD4*TD3(6zu6L!$Zf}QTv-wQd=0@nA``;ZjN`DIa)7y5nh~3C- zGrGLDukG4r-yLU&T2$?&wgl5BCX|vk@hJ#XiP~-LjzS6GGWZhnAdD-p zq`KHmoOdhonC-vda+227rq5{N(=p0;4*-Xm>=1mAA>${_-GQ&A#u{XP9az;El^zuf z8nzLg&w(SN(;E9`EdjjAmYS6b2Zn8X-DK6d7TpGu6pf75Snys7yx-!ho(Q$FUf6&rkd_^0;;U;r2lh7scR-5!R-E%0Bb%|+z zNJzW4Yoq^Pj3GtA!mC|+kT!3shJz*Lucy!u#osy+wY%As>f;~CDal@gZ`peaSfv}u ziQ(VnsS@(?w3<+7+2Qryj)tNQiBrUqzkQL;p)D9pXp)=*tsBV&c{28adhlR~Q%)pI z`^Pb!##y+CDjx8QEOZ`3BVnObc?G-d7G(KtD)9#G2H}Kh_GTXz)Q0F2Y>Lpm{S&Hk zUY)NMooU+34Jh+q{V!H!4H9!O>1$!(2Ht`@3y#j!ChcHF(uQE|RIhh6bEQ*7#$1m6 z`$Jgv7`(s;RADR5AB5qIL3r>6+9f7qHb=a9CMUVo<8rQTGXuhg=mVq3HI(MXm%KUS zzZ3X+D1-me=9iAMHR0#JD?WbdllF&8!1C3nP$JEXw=-BaH*^K|6OG!4`x&8^u4Tbr z@{mwHK=F~Vymw>+ok6Gx{{vp@N7?i2E**DMr=Ro%C5%ta-Tx60uI92AL6(whT0T#9-E>}6Am zPr0HG_-YSF$4`@_R0bJACx^Nnck10(N}3Jr753O%CRdM9C$}qO4^N{_W*0l8hJH~Z z1NJ&)bEd-p6?1U3$w~m*ia-&!}Y(ofvmWUaCKkxlv>qs6SJDC>KVCo%K zNhO2`S2Ra^hsFNGwL>la{f1UWthC*<)VtSQ0!n^T%!#F{aOmCq(&HE8v`C0_K&|8q z=Hkz0S4K~yv}lzYICV6=dbBVKIqrkv17S1f)y8q-pRf>4J1cr8P4Qv%0w$V{a0qVB zppsI}B(f2|!aVgsxog?a7nfP{6(%+Oc}YkN(DyXHOnYMiD#Md@g+5g7*hcB#5~#*G zY^{dV=(J11QG`J2%ek?gxen2i@^2NT#Fx`F_wvZpI5o7Jru5NA{lX}L3KZd^V!y&Q zd`)dW>Pl7mkBksBm>rNI{K_8|PoKS9Jcf zLEe3I=qhaw0u*U4S1))r;C~bNCW!t+cpT`4sGE1%D%Hz=`Wo%n;NlWj6@@SVYunh3pf5keAdyCfR04 z)byRG8Iev&A(f7&3=(^Kic(=p@;(ZQyg(Ho0Ze8ONEt+uJ<3A!hkmO%h|Z~tyu=Di zzu?}S!Han3Z)ec#W>CrQUlmmJm?QRtI7;`o= zBUt^!BqWJe|)yY<|0oSbZdX)skE6tn4HCAQC)YUzhac`5j|Mikdr;TV!^eYMWyT* z^P8>}5DgRKeMWj80t5Zkl%IUuB2I5Lwc%~rwQ-xN3e1qr<`Br@rf(Rgn2a_^9LqS{eAMN07hvQdjEG6h7 zX4Nc?hu5O-)=DZgWGCk+fB|~&_iUB4L$BgIja>ZcX3PRvrHTB=yW=jOv<;)?elVh> zn&0Ol6YMIF6p84u!nk8Y>r6;@NJL9UyuM6;{6iZSj71EVP{SV{|BjkU>0{Ex!J?L!Yh72A3AC8iD-r|#-47(ZNiS69$Jj>1A{9m3OxHc!XNH35nP(C z@l<9GI&krb=5vls>bb@V?0-xAr`{d59En8|F*$%GP%rVRuLA||b@{?1ce0@Cr+X$( zLYl{->>ZqmPk${0QVtKbpN#qq`yOM}1=d7QfhHtY*Y^0!Yh(UAdI?-oE-V#Aeaqvo^+v|Ij4X$sAi3 zw6wD15@%plVQP`Dp{KsDJ%_?8_}p@%*}b8A*srF^qDcVO8Lb=cGSY2Zwf?xypUsFw z72Qu4lSJu1DBn7l~_9PYEN$a%zZv z@_8Gl<4p2|D8nN3g;1WcSq53`cx$W?W{DB+QTYyiuma1#7|HHI*Kn3;(}s}p;!8Ag zr%vEH4ON%eN(}WQM}$r%JDZL;X2*q2(0fahnZ(Hf5aiU$l0E&MYQtc#-N^-BBsxD% zm`>1#kcNevY4#IEk$*@*`?=+n(wrLAWmt2FKY3(I{{uC#l*WXn0xE2(V98aT3`t30 ziLr4f-Z@ll(V9goH_;ND5t*nSJ4L$)$ z!Q4I2oL~CVn`&vb=>eX^({>sN5^# z__m#i|2p_LS0CnbFhS6Wk>X&R)QnL-4QT2$b=E-w=A~6m>FV-l*t!*_Ag@BpOQl4* z8rH<7kU=Hl2@1OSaEN=bqggT|w%3)^~Xb%SN zeyPpdBcPp*GAA!s@a^^juj-sIU+fs5#y+uS*I8}rgdxqHZzDfX^Vn{HI)4o~eOGl? zpr2}hO7@Ql7DQg)DIsWIh9HWb==~=8!}B66nn?bVgJdNB_m+XHCr;v6#Bi$|X_o<{ z4QT5H6%vT3>yX%P;L~us6Ye`|h%b?T%$1H3;pD@R_JJ80oE_&JI~gcd`bIj;;b{kP z9`z8<>e?lgLjcT`dM@8v8Osnw^GorA>ze%E$Rq<(1L^kkTgdlVqtX7Pm=ftk`xb-fwxV?us$2acL&{a%UJV3!+;3?LaSpC z@l*(9EWE(J{u0Wu(;eA~byuHG?Q(f!ZEIn}0KdoG*LO!ud{OlidX6N6r^RXj8HS-l2(T>vT% z{#X|**ym_#GIW1&P5ubMuGOs9E}7GzEgLpd{;4Q2gH6U8)5A-v$&2Gc!au-K8~Qru z%|5j}mzo!rhmnLD?l}D^JM+&MC}}naIxkA5tss$^lsgs*S;yj4O2Vm5B##qpbV*}a zs0SeZNHn|O&(*UH;x|5$(BM`kqyeYQ=PiD|2`L!l#%Pv9<)TWky~+xtx#Dr1npWbv zC|lfJunM4{geyx>#p8T(#oS)Q^n3b?bs&>f>sp3EYEIzm4T?u{bL&rd9wD^7wp65| zVwL^{>VcqP3BXHeI&d=P`*ji+a)x_1TmYU z!S=!-nD#$WL#A}>V#sYxEpG#6v4(yWxe7(reR9p{A&{N}TBx+}w1$2JC1**Pec7z_ zu4sf7wI*QnA$z&2b01bM_&VW@1AywR9zKUHt_Fj$0R~2GpX)V$27MksNAKI zZ^8zC1yFCUEo>*;!NWP-?>jH0j!GMjU#6GgdjRAUvt$}+#V1MRVh-xt*&%2TrAkQ~ z`AS@<09}(msEWmVEYa}L;CdgV@KyR0XzVWmy0l6xaiH_(J8Z!9BBT<#{~c&bpSsn* z?5AeQhf!WCk*(+_SqGWMKC;2viouGcv^I8o6+?N@z;;Cv-5sc(c>ET-r1@FBQ9S0T zksa6=rh;yiEnQ#QwBPHZ&+N@quiT{mek4LkyLnq#ps4L(JLGB8e(lh42agiFO0%ts zOkLzd#Z>Ip`Rhy;Xt1FXR}YTn`yr_02OdxBtgCmaTwX3Od*N5cMa~kTvR*zW5{ryc$8=p@05Cwd?kT!hy3~L8!MNDhR^qe&#or(&gVkH z?YU5>Ed_;)PXP%=qK%r;gcU9i#nx);Esip%SBE9KphWiUePCh zPBTh9EX>B_K7Pze8siLycg18hchpukb~%lk49!r)OXN!F4eA2}@D?=QyFh-Q~{ z;wp;B{z+txQ4FA(KzU&e@62l`=BW#ZkT5PZGb&U3<+609nOCS&BY~UbcuJzjzkM?~ zvBb`Pajx;nv8*^a$-4iaT!RoXH&LcRSe>&du6?jbsfHc^Ce4lsd{5RDd9Tm%TC-$C z>l2+=>-4SGXTX1RLg!arSAd-I6l{|mkW)Pp8kw2&H!@-0!?Ry=0o)Udn1f8UN^;Jc zwzMcZ*&cV&%8PuoQ|4FNB1KfhgSn`8SZ z&(kZV?eqQjJTg9o`S})+X2$oa3m|FIKv^qSMwumL$DY%uv zP@$({-UiMWEX${U?Y#^rs9W^cHsgKW;&u6k7N*yF$DcLIhE@3&3UrYDCvR3^VzBfK z@VGs31KDf@y@~hu;5W%RL2#e7NV7t}g_uyx;LyEnFWPNG$NLL_rC#5kjX}@<$ou;K zktJP8a)P{=gTn{&^HY7Vw}y_VHe-y>^C_HvhA82mA8(lyKl9`Stc5(>1YEl|v}_^I z-L0U*Ej={>*vVkW6Z*ajL)$7zm4uqH{)*%$kxS1bx->(#iz!_b*DlnKyOxeDmx8X@ zCh#~XqZ=}Z_!gcIrsd%?GXbvm)}32(RG3Y+M2KG7dOp^V{Bc9 zm@|b`pk;rn=VTzo-{u5)sZ!wD;AGeoZWRczFbtY8mwo-h+AB5i>~&)fDOx%ZtljM*p~FpHydKlMp@6zX5J>lg8zHjotq$kQ3>} z0x%6eV-?hb4&w5<1TAe}X+iRWgnChn(dB<1Dc+it?vr8<1PO9uK)Jb}HdLa=h+5KR z10EfV`S`?JrJoY8%)cAgK!`RtY+glv5>)vzOH&9>i**GDK-xYltjed;Rx!U!t%}f$ zg%E464RUGYTM1-JuD2mhO0v7LQWu3kHxig7ad@%cVjX`|R76Ol{Z^5k5~#@*icyj- zmgc08%i&e<2P_uPo&a>@dJ!TVRd)$o5>(| zDS+iM6R9)39CFo=EcWcy=hDE(jFW4Wm?4v0Z}Xi5Y%&_DFa-teNN4>)TnI5(E(*s6 zJ97#^Ma0MBD{uhFH>6}kH{mhgZ}k(y<1zkI!a+Rrel1?~^3^=4u@A`j2v7;0&feD@ zwVsV`iEIhB*7dPeFTKv-@8NGhi50*7CT@O5^!57JTD*8%U;T{n&{w>#0v}c{=Uo~( zO>fh=bb`}@ZtV(~O0n5~28+KGzWV2GR%%j+PU*9}8pA#E8|_AAS!Jp)&T zfE%?H1;{=?ukFkj#4NEgSA2+ccRBGK| zby=aVY}zD;5W8Tz0)dHTou1MK_c75lW50JUDY^3ziayDR#z+}J+2F;>lC!%_7x+HL zfX!~!d;Y;?W%~E8n?Xh?bqLLFLL;fk%H_W;v8zS@qrfg~<72?ZS(`R+sdr5wIMn^Q zA|`h?S)%nID+`a&Pxjr;i<C3JpGJBUKn!xehpNB>hrz7nimGY_teiQfh^Jaxj{=WcPWmX8&T_A|g-A#)NpU9;w&L=;PwvW5 z8VIYvbHBCVeZ+bYFAG>PTgyHdtt17vtZZJLpO{T@&$=KNkXY&Q$A8XZTmz{E-|Bp7 z^p!dDRv+|OtF!AH0yWJ|p;wwxYTS7RKw*qA+@hTSlmE^W6h8tJ1L|&q7Y0=Gz2LD5 z7K2t1x z3DSnNTcgQ}62lQ}q!cL%a)Jo~Y{B1PrRlII{sRBj3ks7q14=VcG)SB13+5Dge)0Vf zy;+}tUeY~mSh^9|TZ1RHDFS*wSH=I~Y-ed$D(WWveP2Nvu;5~Xwe|*e-gRxO>qQa^ z^EF=zd4TVT3k;E#pMO){Eg)wEts^7yitt`&QR2wws+;c)sXwd%cl_L;C&UbO|4IwK z?0tVMmyJsyPH!t}es4(C&Hpuci7u?DExu#pi@|Z^`hg3yWp_t-sp)pN%ud#t5B}oT z3N4f$6zo(UR)O{<=13jh=b%?7vD<-v?b`WDyzjNOB;6uc*F-z^pb^^k?VBSX^m&A% z91bZK;-$A-D8AM2F+y@f0(uJ<6u$qObIZZBiH&59U_}b9jV(Z9E(J?9m773z?URcE zT%+i8>G8AuXtmBy*{cf+PCWLl!@Pee1pz{aY5CLl69(;)I@?kvCS?>2d~7ElbRSEB zOIyMJSUMhA+($4(G~Wdh&Xk`{^vhmDlz7<=+vhgF7#&S~ znb)-AX8B+UG=B5OEa*=+j>H_>HOY})3V&A>;omR5$gaQtzPaPtM!3Gv6E|d&ZRpah zl^pXs&h2imv?e5rtj@=>B1FN9T6!3AqSw(7m5p%g=Bg=nO+#o2ss82V(uL@a)`8c@ zOmW$VKqN;Y@d>9a7)A3WhG!^wT4woScvl`Yg8%ZvCtaa$4gn!??9(TncuUH#*rd(4 z)ggyHR9p%Y-qhn5f0?{4$8B%knv^Ky24fD&?Ywm`r}e+p^r|+0lyez18AQBvlcM(; zC-VI8d0~{!b`BGdE*li%jO4Fl5+*ttwy-PW8Kd1)82fpDCE{JLCM=}O-Pou1JHoBR zm~Ja>pNy+AEaVdm*A`WexpVk6cQup+Wlg@fJ7mq5`e~YmPQMn zGHEdD3{Z2&vaR)2!8M6K9^x=If6>Wgr}S}ZIpvSFfboN_4n|kau {^FI#S%2(NB zyfkHbjfrNoSU|5G*Htq`OtNPcnUAEScD1*@u6UTc*}6JK_n2lpjOwZW3J6$O*^Z!5_jQWE1DE*+dYb5sIzyNqZn z%=FiV{f*2lOiP{2T%G737FM)Tq|>c_K0?&SM5o`&vuH7cyH?63k010>8LjbBYOsCx zSu^EGPiLQ9XuuVXkd9nHw%B7~D#M00wOv6B>&b~Zs0IN;4<&_BdebS-7(k`ISt-(% zzU{AC7as$;16RGDe*WcUgav0~_1lpT@=^^NbTLAO@ZTO8uM15e9dc#b0JgegeKDT# z*@yZ_xQJh(16lJ9w=1Uo$836-Ol|(8=jT(K$DnonX92;B5|Nv$%9-Pe=EL1FK26QX{_(rhR$>EU^<}`XhHEOaUkjL&{*#WO)MQH^xfpF>f zJf_PiC+G|%;IuGY2_x;6iX#1e`SKEXq3hFV ze)DQHGnzVee*U<2eo=mKWHs?r_xmX4RX2?iG{VwYHavAEY9l~Wl)9q+9E^vJ?H_fx z+|8N;y(z*PuqDyP-|;77o{VSCJys3ONZZw)H4uWTO`YW`^-jX_HG3hj=n}@#;9+cR zVRajg=kyv==KfG)rzQj&JMlJOQ(FM`+2nCRQ;zNj@VS4Lp&BI+!qR9oCiF$Eftf^I z1yzlKhU#ih4{RW@BcZNQ!a>ONi4R^C9epvQ8100*Wico(K_xvG5h3KUq|)x5QW%`w zyvevfL%iFS2vsxw26V|Bh^&Ruk+sCCT+fqJmh8rA7z~j>O_3~< z7ZnhK-dLK+d0+#PfQoO2Z@7j-xPZV3Wp7%diQE>eXmjyLrV`0HzTK`G;;HX{SUJ#S zozX55LGE(#B}CR|{TyV4?)`A<(fr-0)bEt9l{K8m51!D#=rkIxq^FE`&*=fQR`u{y`W#vHAOKK(-$HQ{J6s6hG6FqplMHJ^kGdg$MCf|H^2-8_?lEH zA1{M8KC*0~k{i&iZ?!Z>sD8^b2NnlqZ@f$w2_r1lFT={sxhm=XvgkWA!mj=UO9A*W15q%xdWUcitsW75vrA>kP4gc=KC|AmbhdMrUFoI zulNoStSlL&8%JKIHrwkGC-8NBU~wd?2tpLJ>KAdENqH;1`Avexmd1eM??2XxJ(R#r z7N!h}*$_WwiLVg{-*C63DF4&YeTct;&NN^z1T2AP$hfK=a+R#s6T0#!UwRQPV32Wn zgYctp)-+nBBTrO5(Y=rCM(&l89#iVNK;k1iOW(9 zO8_BA^>otVX`@S(N;qXEKqR^`lV{r9_zsi3B7s7@Imrtn;5k8oc0$HDI6?Ouu2xxj z7QQe-P{yQdIDaOlmuG}0ser-;%pAG*B_7{-PH9nWTWF-h_`&!sh%P^a9RXpDjLYSX zr-=!K;AlCZTNK6ahBO*Wvy_f#V<#y$KNMvvqjz)F8U@pWgA=`A|h(z=(B`)LV1emaywhpemz^7sB*ra*h5RN%3@WS zFGbk;IClgcVQvd|oN0S9s~2Rq3BBe__lbJUM`HRs$o}L;JPA8cEpA+pumE%fA>s+@ z1AyUtepl-HTS5WuLg0^*5Dh4nO2dK|5GSW1)GTkg+Q zU3OnEXCOOhxZx{VX_P#DlU@VntLNv7tLm258UBfTc;%Luu~o5-{}I#{R-ipd!Q7}W z4s9eo3#mp{EyGp43q{KTo$;hFOK(0$3ZJ82&venfA1oJyx?Xp7oqtMVwuOtDS(+c3 zp5>=tt4*kRfKToXM7V+pt@;h04fux8W)+307{mXvN=R;VzR!$aN>BqvWdt#nVq*to z69%Bsg?lSu?2u_DblgdcBYiCr-xKtZTkE)QKeD-V34FqbZ}~snLY=8X zKu0m@_}=lI8)hzn_-RBs4KW~U^?dzO1WVg>__0$6bo5Fs`9dY zd;JE`iA37c)nmi;K4z3pv@SVRLPdW`QEzfEia8}L3(87aCofwQ{zHq<*sBOu?BAjD z@q5>linjLPev(V@wSX36nFB0EboRWC=fUI&p9f12!7LF;GI zLW!czi*e0RRyd^dkqVVgcotWCnaOM?s9vip2B@)ju__dWQGKS0SI>%R(g=t={>Os} z>WzQ5^Sce;JVx8Utuaf;iT_cw^9sph@caU857ScaZmh$M)$n#h01=yR9T3@sQh1*4 zKe^N*cis*V3le_iTlb7^(Vo+uNMZ}Jy*~Kj-%vb^qQ)yCG%fqHpLJLwcxY;(iEnY_ zy`kDuBa>Zzk%`&vN@s@?<~IKD5{w%reT>dElUD#_L1TebjlT|08(`;LrZ3fT*)YmB zfU$r%woQ(wE!&$&Hm(En_z$^k`u|ZM=-cK*CV2Z6OHkrQJ4zEhJe+Fcqw8SQ5D4C*F>C%xb zpXwssh8PF^H&U>UFMh@6Y(O%L9QI_i=E}?p^SjJ9;FH9K^)Lz{Pnm?(4frZA6@$lB z^K<9=8(!*H7_ZNP|6078rg3Ufc!dGT!lC2{WvxVXPzk`P1&S9<2Ou$%slgK($W)3M z-^LFV4>>Y7LLii$9Q=ceKnb>W0&d!K&`c1nN2JM%3=aIv&Lo7Kxjq*ONW`2$L&VcD zh78}HHDO^iU&qhp8i=@NXT=>j6+k2yNogiRgezqRBrR16de)Nx?I&DF!82bcR0ox| z7_s_CzQll_MATo6OC+~UoGn|0mgxXx`a)+K13*?r6~I`FR&}$=DjV$ohP?rRIa(o* zumLoAaAkPpc!bF7=rNeK*@1+wKylI525##)+{rivux#g^(^PY|Nx0)WTZyHyj+h%x zPi&oFv$M20RkT8WC)IPHEWT=Z7t7$v3n^L-pfTu6*WG02Tv+KTwBY>1D?7ZBc+ z^d;0tC~O#ENT{FXPn_;o@F5gNKtEjR81)|$)|hw4fNlP-hcIM67<0oqHsvy85)Q}=QJ~bkQil7s0plBiocr@WN*06 z0omNF(C5>I`S{8Utbw6sS#2rKDaL(9I0jaK30^NmexL;j)sgUG@>zvkNif4p;gsHd zU!ydzQSHU}hoF>EA+LB;^?4g+yvXUtNRG&42K80#roPT&jpa$5vSDVE8>M>kNs}3V zxTPzjHIOhNk8ncsN*puV#K{0O8ce!3+`08NN;@e%(V;R<#rf0``Q7uZe9v2(Y%wfM zH4y1f)?-LaO+|TSQ+wJ4(h*b*#B(3oOAHSe26i*H+PrQSb#n~*m4X2`$RA=?Nh#w$wLoy#IA6TT08r1CGO}3eaM=7~s}LfGny0quf-{0%7Yb zRLos}r3+W7pd0gZ&{6YVWfWD=^>Yq=1>2<9>EA%U=DM{+(1=JEWytV<6Y2RtHTl!) z&0_UPP&H6B{yS3Q=xA@IL**~Hn7rQ4I*Bi?%RlGr2)IXXpA`tby(h!q>foktgyg$fSt6#Gr&GB3eVn$mYdD2 z30ENn!A%)oKptS*&y4BhOKigSr7g(Bq*GnfU*rDX zogQCdJ`zUbIMa*hU((5fpP87tSE;li=YJXZ`x7pK9NvGpLH;~joM`6%;SeXK_2@9> zQJ?RyGIg>a+>dOn#C~Mo+Q#WVh-u`x&&1WEA&CA3b)bd3U_Y@pi9w<$eHSPd2}dUx zZPZ+T-qhv5SW5h1AAbLai#S0mtPZGjrEdA#(7f=_bnm?4dtv`pbLZzRVbQ-k z*jM@g`C^LlctPi#oR%CBe(rp5hACxCxbIGuD6_W_SGCH#>pn0#8ebwd=Q}s&4Q8kQ zvjCVuZ|e^HnQSG(KDZ^YLvMyY46yT#pr^g!Gxyz*C$zuQ>zbl|UW{RN{t8aAk~&Wj zgoC}U*s>(>TfqAOj1S<)Q{xNY52qKNK&|EdmcQ+&(Bf|!fJa8o6l1?Zv{$6X@;$$p zCm*O4%u1rnN^LKdfa`yd-wxbsoL#`ndQQjC7)Z-&MC>YP>O#c6mldy41>ry?ewh4Q z3a=As!g&JkqCK>CtDC(82#WZCtQbVO=2sjZ{Y*kiTSHSDN?lAB!25QQTjj;6th za|0N!^eK~|o=0wbA&=3-rq1;IT^?!j_?~Ec(o{6fDD(fUElfrYsZyH4AlmccL|?p= zKcF6;@4rT|83+?9uzfB24I}AHJzwlaNNF`{eG_3}P--c@E*V6K+J3fd{wGP5U=Qs~ zuMfo>4eht!QktPY0O(@E?lxS2%hIbKh@@Hp2TER=vSrkk1Qz%+fTLKRo$L0vqitcS zF#t%=eE-F<671ENfkAK~NP?cyz8|b(!s<59(1ax65|bo&OO*n~8Q=y1ew8z=>jW14 zD}{AVvO*xe{PZV)>$U<>=xTXywK_T!?zfG85=r|Yi|T=0=Yka9+8EmG(eL`7krkZv zg{w<~`s_8MMOfYcc7w=FNTalg!>6S?LeEJ_n(hu;Oz!4p+MgbdX6mIE0nfT2(J47w z(0%g)@F|{SsC(hfKvn`L0HTg5hnTS?K?Wdy-?JsuNJk01|44`XL|12iV=y-`BL2I~4igCj1jHRDmxIn0xk?n!P%1#olFo0uZH z_)TQZcDBy8R3NAN)b9X!#NAQhBTEW+EXjuM5fEDT1NM}z^Msqszux32$U$J*jep#Z zpMCtrAa?SLNWD7N%zeETduw`N^F_Ntff%Vm`!v?GKT{Kl?s_>sGAg^lEN6iZGYAk5Wijydp;9D z5SPj8dliFPKoRgWDc~TgZQGn25Z6Oa5dD?{uU1}!DJ}%v9R&PZCL9D?A2;TAPpW+t ziyZ)*ueS8L!ZhRP@KzhmTc(u8PFPr!x2dY2hEQ}V1FW`q@i>ydc&bj2n2nCD#`yUQ z35+X>UHOlLcHh(gFS6b`EUGT-7pA+UJCyG3MnC~!kP%Uk5EZ1QLqdi|N`Eoy6fD-^S;;hedo;OUpTX8&)RFRb>F|*Srm50+~C3kAo9oBk9HN2 zLgSB3hi%qU5B6-kvV9bbHRH^38$8V}Le30E zR1a+~0+HSY-tI3ZRtH~G<4Wj%+(1r#2L21S&o#@2ZOa;C`&PUM3>KGwU^5U+RkKl9 z-{iTU=mo&StgPZONYuv+o;T)vkq9$OC@qWK%!^x5S)lIB;c=Zgc|-RD!k)gf7g?Z2XCZnmnJ6SKJ+Rv3lOA@Y1K9Y8Oi}jgNKH zFMu+W(EAVHF9~6;r}|IhoP0NgaE0eg!_>D0U0|(=xB3bY+|QGiMMv^-9aM*pd0Gv2 zPZutD@TuXbJWg|ew*BgnUS!fs|G&TD$oBSedT2VV9^rL$xC6$`RQ)ssAh~1xO(E_g zVBUs1=9BGWdh%^eBWs)((y9NZVTs4r(Gf%+S(0tG(`=J8=b@{LRE3%`D8*S~JNFRJ zVIWo&7I)SqL*vgD3>Kd)bR%n?Bas(pp0nLCSNqs-FFAlBt~)tE+CTxO#%($!1>E*$ z7dG9{Qrpe6Ww%Kgbn_O=Fr}V>fUv~qDFC9bR|)sqnVbWdB3eS=p#Vq}|4%)QEoNC> z(_g~yNtC^f6Gj>*ZP7FIEkJp}A#J1?OMCTO#FM8f6U_9_`chT^pex%)j7x8@X^&%7 zxCs(E^8znQiv>GMFxo>~h7P7f8aiLOb_lWQ7xKow$Ej~~c!+*H3F!@4mZ0`OigtX} z_{c6|XNr`%;WgD!(K8CmY-45;q@L>?FG10Q@{F~yBjdDB-NCzK0>7#iZTkMvPemv=rS4UjB3*2K8}*u- zHq-aEr#?uo0dMZWur5&KxYoPh7?(JS(?|ZP(Vsi`LoE4i@<<}<``Y-KCIUv|_zxA4 zRGf4bMAlMQEVY~eCdYn8X<$c$`DX9Ve7fd^ITKTSo zmFwweql3r80^JCruXo1evl`xf!C1Aeq#&Aq<%y021B0~~@1l8zypAZ%n~v_95Bbtu zrSvlPg~mC`cm0Tl{qH_&n!TPJJhXK9RftqAoymJrJyKL#OURK>gJViytqKtHX#rT8P z7ynCldd;}cee9XU!$*Wt0;?+=JXe!TACvp?;T_Sp;U-j#GXZA|CNlSSKXoXI_=_s{4&RKe=}?eX zND;1gJ(H|R|Iz3t#}&$80q@FHGJ;vzD9Kzo%?5e@Q=;Jphw|M%TqDL;O-=8>5O+Vp zE2}r^YaOoQ-JRxDG_yC(@u9Po*Ec!;Yh|d3I$ZD9#D85Tr04t)cQB1zJV*l?Mc@oR zjrp=UlfL^T-yk1-O-E_{P{aRY?b8XFLR!i?JY!msjsR`@-3eW$TM>q`9z`D>U4Kg+ z7dKJeRyZays9Vv`QOTIQ5TmxSJ^clrTGiwJfzD$OoW7CWaDOGn5E-(|eL{LYo#z>b z+4VNQZ$@Uwhsa72_T>C{#P*f;T}QWjjNOqr(lP4^t0kW^+PT8@MxUnNr>cppi}*9L zrysQxH*EhodVI*1Ga4lCCg)f`^v4j8Po3O88YJl^q&y5!PVFN$d^F2mF2*!T8TK{J zgvYV*8D*U(<3z0?9RIABf$5MP|R}bQsz)YeNd{7Zw@Kiz2I>3G1 zcv=`=oZToa_qDFUU_{=_Pp|)2v15pmgW-6Yon$%>0r0%EVxcVtq@RkE4wt zDCQaqx3a9q^QLql8vf1X9QJSU-P^3gOj~Q5F*|F`;d@#x=YLglC3w79i*up)1WCP~;8aE_w?|gqnRcVj)90b7T~sD%(U;59ZZl7d zYOg1Gi8C^ikhcfqyT;$vC1j4TcpMqaDk{5b9LDQd;CC-fhA2vSdd>WBK91~Nccat@ zMz1O1i%2TkhF|NRpc2LNGWu-7=(q=-|1#wi*jT;h8`qpJ{0SRs`@vy&h0E3urU3K% zyIS}nE%ipIsc+YinI9;_$eRr-r0!-T1ySjKc>LmDon)R5*-^N7iC>DbC}ozhZ_L9; zp7X`c{FXhW*U(wzG?SilzG%$8zQb9QXOA_Hf~KjE^8=@kN*?i5#E6874w`gngb zFKqfh!bQq$OhV3UKy`Ciyho_=X+7&UN1|SwmyuKtQNhqg0(e;gJ;EMiJ||^9 zG$4aPQM3R<_JPyyD*PYsOXZQNJ38xW1b2ZWpC5yzCNwqw0uGFnYfH0<+Zk0cPy6Ic}X8dk}OJCe|U(-$}zOIh@(##C=9ZfUo6ZA^y zC;L*e;`MvCW!^W9yC(X#S~_&oo7aERlkds6zwWeJjqAj0KrpO*gR@kC@#*JDhOdd& zU*4V+EsYx2!z#jb<~dOI8Rg?-$^qKRPXl}SeBD&ktm5QB?aCI{ zY=!#JY}PlBE*`&PKK`Mn))VD!e%6I@vGUkyUGI*mxqo2tOpdN|j<|SmMj_bDW%ff~M}>ntOx)NDT&|9^>(MGm1!5__?Ht z<1(ZEYPKS)zpm~+9g&+ka;Iw%-y4^U-~)!nEuhTp(%pbPr$^;siFneFFE#-x#>}2| zP3v;0b>&t98P)5EY}S{q$-dApa2J7I%`v$WM|q{#VZ z2@9L9cNx=P)06^s5hw{u*#z;~_bdbYsERY%E{C9H^V*%}nl;ys9)@(RkQEwd2ia73 zlhnYs*~BzHo}X{S&)wvK&U{W(LKqD=fw5+6O>(AZNF!+s z3V2nnBRy9L-AalG@MBe9nq%MGqDwe*)3no_ zMEUhgdEku~=XC=9=nY|OI?pSYK5jZz%@CKC5#1Ld@#z;jYMVTo!0f%}I+Xf2>_`jv zJyk2vuAq*Ef0Sq{*v3c#+&wY1s8_?>u7r8#mG4@anmW}Np8T&UA*vgs2IK+V(Hk&k z@~8sl=;kz^Hj;52v!@V@*`%t#E)`&AdL+RBt3*mEEb4U{IT;`2Zdr%sh3 zCkta6`lASU5in5Jp0T=f_NA`3bqlH3Fuduye4tZ?A3NFi9gqh}TCs_~PiZ=0dnKeF zdNM+n-cYI#0rO4wrssn?T^||M@sZ3xxI{KL@h923>Tr>Fb>FF*TN1SvEtfRk+W*5L z6jk`ve6MdM9ihhe(xA^wZW1wf2ZNcFBZw!%C=hR>27<&zU2w-g>sgzI<(51mGuJJ= zN2sPt=y=m&@Pha1j<(59O~N<%(;9M9DS37vdnl(KtN+}1MGn#Q=w#xWX_V^I{F{nw z{VOULPvmmCF6ihMzP5D#{00o^2RI_a=(j*8l$Bjy*jeGDPj@Pa2bjMY`w5~2D)Ap? z$a;%L&#PjhBx7F)e`yqZE@&Q1nBm@JV%#|ge?j6?3MYvZ)tmBIwt%3)L8>NJ#_<}Z zEJnLVQM7~=dzeZL5qnAA#4JGB5x7fX@83*YRbxrFwD}(%ZV1ql3YBLE?<^T zRAi)@KEu_f5)4v`Vc-Q47c0?V`iiy^%vpK{AmSoj&79Ai2%*p%f1J+r8=W^|Yfh&JL4Nkra{`-i<4z*OAhqq61RDU0YOh zI_xRbeC+xvgoPQeQmKWVf1ZC;fKbu#f3z385N1#)$Xz6bVP-|rx;iQ&a2e34=dYR; zM@zH%peo4e`mXZ7R1WG_rNizKX(={xrG)u`9cUk*w^@C(OCo*xl`B(LTrSGEoGnhE zI1W8qAusg@Ypmt9&4pw zVQs9Rze7%EJ^~3R5tdDR^=F;L`^jw)w{)pbtPFRciJ5*VQk8#n{o-4eV{?=n zAJz^@#h^oIXu3jNLq4xJq@Opyz6R0Geilo4JA@B=n=lhAk}U)J`Xj#B{Tj=iOaGA_otu>5EV?-zw$Bx zK4WFPL>aAH_`KKJFq!xm6mX@e^F;|az?AY!uae>!9o*qa>@Bf{ zD=O@xxD_4ERQcGv;qej3t$>o(f27x^Cm&4#OcSpz;mccbOEG;*Ovz?U$G=zybp^23 zTV3ZKNJ>tXgJY-i^YP)NGy2cofufR=yqwr=sXyk>v7DTTKza_}#4>vO8}7ts$B60% zubH-x^qq0#C1|5rDwfQ}N4w#Cq8dzjyz=MS7{b)aE%jd8Xc}Wj4raUKg%QxU09k~^ zJ5}vXJAWa}klq%9>ce4RdyZ5+10zQ|eCZtts91mwN^ps-V>j4hNT;9@DTy4rxU0=J z1b@~7_Z`5Dzi;1GoMcu7KpptSs5-%|LjYK4qoEMhd+Fq56lV~x9AM+1rE?jZa!5ai zHPxxKve#v96Q2w@7#Xo-^NjBkht8F2iJ~q$2sL>HaQO_UnOyLIjfKJj6eFG*%PoL zP?s4p=QX3xCm!Ku5-=w4*`g|=1^LW_vFQb^Ds`m22%bkQ2vUl74#@5kjF212UUAis=?FQxnm#s1VyMfn&}$^YL0Jua+E zvm38p7EI`rCOA7>W&>v7^H%}z*xpLx)0uzMGJfr99%eM*`;%~;b!J8VhQ|6Pn6o0DobK7)+y?2OYLgN>k= zo>I*9&_TR!yvO6RLS@-u&z&D44W3+Gcub098nbD9rO zGo_Ex$(=q0r+`ZD1*n-;lcxY=XEjjhLQlR@+HALZ|NEEPtY_}Y^%tAZ7Kbj(2MDe_ zdcepNH$6r)TM~Nc+;A!<`&MPM^=W-d^4brZKr7dt*ZpQLIM(53U-GeG2Hot~6>19i2+8Q3|fu2;wB~rgnR9ywt+}haIc~&^y8vv z<4S@LiAZ-T2^ z2(Wtn=d`At=j2EQVB3fKVx2^76g;C}Mh^&C2HLnAw!S!VJf9(Xmq}Ir{@uHf8I>3N zn*y^o$xXPD*EF{W&}57G?=Y}^B9KZ;r!ee+DSv4o_e?ILPN5F(&1Z>$^f4)|fBPEs z6n{%>5jXuq@v4_5rWp#i)7u+j+pg#CfmtZje{OTle)r*)MBm=W(-oNuf-*>0!)sA}(S3}keJKS|6Wt_IHr8pX1x5;r`G~Hj5i)f+3 zWRhX-(Gr(3-ujr=Sp}S-M8lD1y*+B&8ZW1wLM*AH1)HmZPTMVTi42Ce<^X*KBVv@JKMHtfIw$f>~BSxGP=4f~Q zH1^6oJW^)yrL;E}pKJt>jM2${*isH8M?f+rmF=F4=db-+tZShf8|INAi9W~sOwmPy zLSl=wi+k$^=?}O0Klim1mvMx(3(cY;%Y}t2mF<*R9-0&yI89RC`M-XrFHh1l<~o^W zqAvG$lS)}@Csf}plw4$+ZMo-v+}}R0a4*;6s#coQCB@~irB_Vm- z8d`4{jENEsoWkk~5pCFk1FaeO+?1H>#EvLu`KrEg`#RJfsxVQh2&(W=48}jyPNHF| zip*DrsMLd2gZX74VYC+b0)a*FRE~pj|u1Df?qhS6(`fw6p$(LzkZnoA(+A!BmQIE!k#30%0jK-|M=T8?J))A+XNS=s&^WBFP4Z&TX66T zm(WbMTJZ>2AH*+f%6K6f^c_c8q`_D?++mLW$e9Z4nx?Vq9gzzSuqab|Ge!oVBbJ&2 z(^2o7+1JK0P@s7XI*G48q zG(MEf*$97esK0fT$F(2iq8V~<8p303r?$#vHJj7IM=<4bl+dtmQ?_n%ywZUB-LRuJ z5&!!vB5^L_$mXPNqHeGCbZv4n%$y`DxJT*FLac`|hp0k7ebc(dj6T?hlJ#@Ge`L|D~>4%B@r8QYnw;!$F4~|@jg}xP5 zVz}q;e}DFXj#h8FwRV3UQ74x%xy;IfUA=TiMmA38WW-IP{PAdi-x$%CvhRq$^O+1%+leIZxKK<$loZ{&+Tzk1?lxL== z)GJc&Y~Yc3UE9Vwyy&tA3gmE2nANX8WG|= zO-+Ui_pRSsD-+XY|F2|k!Hi2vLvaEmTAW zf73U^q%6v|r1nFuhLFT_%-QXge_`t{idXvoBiYMJ;Cly%?eFWno`1J4RJ>2b*}2^QBD`iyZmL`;tf-RBx! z+JEHYN?(mD`vqDAl7Qa0tE;V zuwq8N0`cB3_s^;qrnrf=zxyV8$YcwZ>C10Q#cU1Z?M=t?oEJWrmI;*q`%^*IO2BwFMoww10qVgy@yz0U9s+ zNW9?DKk&qG#0`npl=ByO*G4@37?#Z{n-Gym6-_}IcUkZj$lVYgx*_Pyi0_m zLw$OpH~vu!S7WaLE2T1;_Nq_bq=Bp!WbI7{`DyljVbBFd^-aP+Gi@k3$v&69nE{h7?BK1Q9jQ+;Pq|JL<^Ddw>@eDj z@*ps1LBEx3oJ;l}^e}MR2`)eS#9`}~Ukaj#E7in>O$_}W+Q1YeWlYSg@2!(uqvJQW z-lcHLv3?^+TVO7TgltCaRY~@hHpnl-x;yS_Z^8%nb3UqHUR!Sqhd8q?czZ51GIzQVGxROaDmJ4Gu32ar>o`s& zu_oNRl{N>*V-C;|^r!A8pnVRV@;}`nKU&HMs&RmvmkMr!0tdtz=9ARIX#B1`e0vIq zO%-AEP45mwG~)@T-w_5fQRHUicu}P)JK4C7?4yWRK<0iG+9%;h~JMj&taMqbzjMO=3Bm-B{MtMWlQD0$reNFJOy^wjBKy2nx{8 zw~eN#O=wf5C48rQ`spMrF+qyGl;g7Zd4|kg^moX;9F$ygA?^#4zGJ)G~T{>U(TYl9M-rha+9!m zen?DxH@Zj;W|^LZ4-#qp2Cy=KCJ8!bIs;{}TT#w|!WiNn7?OX$k!d!@rDUt%?%mAZ z>`tAsSWNNnOXH2u%GXy6((7a=PQTY+2T#1n1({^Y*DLual_U+k{jE{`ydw+k7a+q9 zJpdz81GoNo{(U4kF=66n1B2}jD5 zY?+gFBFfa^FiP)5Ux*55G+ij-mbE!mVxtDp3=cZ`^qN$o6fq>@WP6+TUJ-Er(PU`_yX00=m1xPnC%Ohvd(8je1KU(_VW+_VbKJ)q$YhWD zftc3Hm%T#S%FZ1%Fg!=Isfwx|5ew6u0;@orL*_y&Rx~0p0a@|W-^V?tkU^~?)^-^l z_wXhAt~L?(sQ=h47aV8OGi1~K_rKaCD#Uo) z8^&f8%Ev?CJ7Y^F(3+%t61Z(qc?X4>*i^$0G?3`iSXcV_pv`9UjfUXn=Ag(q|C9Yc zmZCKa-S``PtvhzA6B+#WOOEw-jdym z7R_DtZS<#^dr?M|+w4DDzOuPy=jy<$xrbGxCbIWV`_*sexUl)_jR3uB&-p%KZ>?ba?LEI^pBao&(_HH zs^^(+E@c!Y_hf;xj6WZ1)g2WFpE@KLlHf$q>ix;dm8{;>-HvJ$)_Mx z%%6$4XZ;8dR(NP3UOT2S2-;a+A&J)6o89UgdOPUy7|K29v-0v#Fw@v4DJS+~{cex*izKW-~(=t^;uJ5n^Gqfg+ z|I!iekNqgpBG23xw#>el4pr;*#r)3K6|kyeGN+a`&AO8JvCF*n_>Ad8K!EII`>bbc z1k$KVe)UV5Ps{PLs}_Kk))#@R%D1mM8#PrLh@EalJQDqD6J9}IEyr*3tJ3TT3xv~A zWhj2~k8QyZ-Y@d{V;ANS_(uzmuX&|5z@t&IMTLTzN24}PYZwO z=xQ33@adQKF5B>syUU1OLxR3G*5S$ibAg|Zm>H-90@Y!juT`viMXB0do}zfob@k7) z0i}${a<(ztyR)AF>(n$>Ns7u!cG4gvzNSk5E49TOW*?2=UFmuBl0KUvS63~}1b9m= zzN4n=9TiT;9vEzUOcuqnGfjMjB+(o2Pex@Pqi^!XMt>WAa@VGliVLY(yo;OQ|Eb?1 z2`>Rn)tdd&u>{gHIrB;BlYeLv-uwWeiLLOq8%~`@upr-qeeh4ehaV@UA5>dBv%#u; z*`Q4e$yWkO3CrvF2)>FRMhUZ@PoC`S@IP3W2wd z3?Tb&Uf1($q1g~GPbI$g^gUlHweXv7vT4pxh(LNM3V!?RZ*C3r!V}A{(hTxt2YFMhE8e0XG|z~$e`e` zlW|OE^H$-91j{BBRMa)S5QrlLR>HsFBZ%zay7H3cHddjQ0WiT7D`XrYXQgs$Eh8_dv2_iVFnZgu4w{# zSi#!9*s}ca8$eTj=ldh}=`dGCcgjA#{nFBDIHpCYemK-S?)g=0HJ~?0eYd(-4P>a` zq3AfAI6e8@aI*d4XjWj(RPS={dD-_+-1n+(_35~WY-UXyj_;};t+h<-wJE?x-(UN$ z<}anYe@l`2worhg>Os?M&@QHj^`dPI~+EQ-@!hf zOY+vpiA+=OA6{=M+MV%ORdB0cFkP#E08gBmR4R;@Z;CKvNip`43w!tJ)^mathG+dwlaAU0LTTK-_=PP*y9`$mmzx+|erJ(gzroVx_><$7@ zw+B|9bU%}U=>J3Sl*W5@a)DheX>PG0^rQ3eyqiI*$B5sxkM!zBR96U3_XH$rLtIG( z$mhZY4ElQbOiqU~93KS*jQzEamU!jeKc6*mG{61Z<{hD9Sy0L@-zlC%kFdI8$MNoj zJ2AsQ`O#@?_RFY$E&hN8Tk(r?9u!1ecWOGYCZRfDt;GAw53$vUTh$bitn9%~h7dS0 zY)6dGHNU&*&xUSFm=|j1AV&UTM-uF^)zlvEjHFEDrUx)ltM5&EabR^;s|u>VQ&B3( zMTr`ZG9&s{AR{I+ooc>P{&|>A6bFvw>Cbl|*O*-EK?{1=@Q-o>MdtI(XQtlX??|h4 z1htkFvvl6hW|1~Rv(x3MCD#`*`MjC<^b z-c0QEV@=op`G0iKKS?BWjlzkL6tnZJe4x^V`-xF|;W5$o^CRv@ZSIquK0|ji3Ll!( z&v2|Z&Mp2Z3Q*_Ku*P-MQ2**7Duwz}C=pyt=`yWSGFIg9_w-xCz5@2X@J^Z3icI+7 z6W&g$z~L9kf#lln(9cbu78kM!12B z6+SOsslq>5?meNf(Vt7iJ792;?gp&amDcy-wotGb=vR~IWaUdTq z;HzFK{kDmwyGPW0Kh%ti|6W^$zKbSGg={F9u~#B2RtOPucFv|_ z3K1?})hoTzC^C<~p?~~B{*c@3;f?D~G3XDl!D5gUyllVW*g-99uKbTUTW|0JCsHw6 zylN8f=M+?p@H8Wi=da(@vl_^HbOvvE#6Mu-QFXol7kzWZJkVh6Yy1)V!`PpB&Q7gs zD4>}t#c$5Zt6~fst|?v+zPpDe8`BKeNgCin9)|BYY!Wjd*7!|LRHBF!aQU7`c|wBK zAYX+7Wl1B&vmn#|Y42dUzv=j3WUHZo%;92TDOCx2gZ5w{jb?hzpA!ji!7M?VBNPSg zeUqSCf#nyr_GOCUOj5!A6ZC`Y1!dA3Sy5`ofgySfR3t%JcWBv-4%D}q4w%zusFV(= zgd1<+j%KnyV}slsOi=n>d4PXUZRa>z$q*Im=D-{aM)ht+=P| zEYYt{1S2Bdem!kM3G0(rwm70G3pZm0?*SqWd$)|E1$@0&ej?ONK{5Q2K;(oeL(xe7 z+3`KUEgZvKa7uQGDc*?#>D$=N=gf}0=v)bP?dJ|3sE44U1Xm9X0@y>LZygMf9R+yi zEPRa#ge-6q(qR|1J^NN(cJ1`$L6k>Dx5zf}&saKvqjz#RA*EJk@9=q!R0XZ~hY)qc z?l*is=t*2G=&pjMFoljP=ho(hjhaE`quB~^b^(*ztrrpF=gLm3q->r2uWa_3Aj4@6 zE0pJ{mhTC!H{w&TrG9a4OvLlI|37qTmjA9Kw#Fcy)v;VVbFe^Mj=U zp~EX$Gq6f;hIHS;&!LE?pPWZ7NezmN+?sxB={9w&^CF=+)O8ZmsOP>A(45YGaolwS zC7i8hPsrl?4?X?v;+j^=g)eS*>Dk2BJ=PoWS|{WlF(ldgPcuB)(ytoRJ9%>PxGrr2flyuK~-yyZZ~+$ za4GMv(R9on6-wc$1-3u9YhRY$wB{m|Jd{f%$?=oro=6m~7vFl?6pH9m#Qmy)IyIc( z9r9~+0ef+VMwFY=X(_+V+YFwQ$9yIsW)RPdcCa85y`Yfd97D9r>VY$Pfoq?{m>ce| zR1fpK2fuImy$M;|y3yOrH>~=3vN&_z&v+%Kb=luc3uWzcNTNV>fr757>;_?&0k9H+QNy4Do2Hacnaeb7VK2qqxm@dc~hK2#y9k1run8`P7ydHP2;zP7hqhxne&HNyV z8^@>#vl5ypBQx?Fp@mqUohv@;_(LPSJD0A}^Y=7Oru!+4+#}4q!1S%l_HZz6=*Psk z>HQmYRSL_v1bZF|l+?nqE+4X)#H+Ii4DV3iRj(a_FS5i~TZ%i|`m5Ua2}MWSMWDz8 z=#oTk6Q^IHE6agq-u8*)D7I#w?~|>BkZl&?q0UFsj9RH z_!U2v>S){LubUMVM`U|zbH?!GYf;Rg4k7$1^VEkudIwqsQ}(wvF;E+=L44 z5|icdTUYHpw%4Bj)xpQtRW_nKN8%+2`Ti{YLkV5KJ?ZPO~8df{X1 zgv+u+FkT$M!cKa#XpW-B^*7lI>y=4D1I^*skL@P?^VG)2N?ruNL|D5ug=^<2)xY}0A4 zIRNmu!tfCjaKp(~J2I)K0I3vwW*Xo}Cpa~#7X3?~c~^9AXs zg-`9LIF%c`a>M+N<2{@rk>SS}zleXtSa0s`{ z|EAx2Kyg^7qiJm4_-$T;u$*)+HGuMcSg^8GBSkIsALc%G_DudAVMUR#>9b%=O z>e!IBlk8Hi*6XNR4zoU8!ou|T0&K~DA4b5M%xxced0HcnK0BPiL1HQgS)$4 zMffAHm1J!jeaWYOO^-z`?ge$Okyfi$mG0+z=yXvRF928kT$(p`)vQ=o`g_iGCvsg%+m6SBP?02kBrKlRA|y5Dhwu)V z3b3Jr$f2#_Qk1lwRQcl-&JR9+)FY+aUTyr6`h??tC1UN~$C0sr_@U7cHv2jhm~$5d zz3o1Jv9qPH#_y9%Xgcc1_T$j}UH5w`N&a>sJUeRR-n;fLn)kyiHkh`b0v)Ci`B~cjyAa|$*MO4 zFSkUFv?8N(Y##n2VY7Be31qSsmDRX^-~X04D8zcAr_FXjR?@aMQc}g3=Eu~2$+ zViGGu5q3h&1jqAuY`J3FPPb?sWypRs$x0Q-wq9fNdRhL+=T+NM24C{y^BNeEnl%O5 znt48JrN_DLBzjM{kS;A;&yG2q6+CiTSl=e?Ggn2#rryq?bn=KbZtr@uT3q!M zb`-7l+8M5d|0Mt5!wz^0F)0<_jYG8ZO>+ff!i{kdIy5;5vVIUNC1mmvB^zhlXOcxZ zqM>OW>R6&NG}$lEHUu^jBrXbl z85!mAsY*Nsjn3r?u_~B~Pd(eS7_;;-a11jtQB!k)+!ldFq0Q6O0uOIckjHjx>VN>g_#vSos?h;P%Ul#OW z_a-FsunJoFcp~tpydV+qq+r{G7eliV)EvnCNuFghc#tXzZ~;bx2Lmc^wE(KAM7)D) zGLKcv>UJBdEAdGHtbI9n$AQEQr=%YsLN$!5p<4E^y`PkmX6G_z=A;+!5F0XLM*~lT zXQN)Yzc=)%Z435K<0{kQRA*0l#+B71q9GWW?J_9fuw1ToREOWzLUR~nychGkuI%qN zB5tfPv@P~9{_bqgu-09!FVjz^`PX0cPhXd}@CpsG81_I6y~SNt-yKkAj10nm$Adq4 z$)i(DK7j+dqa?ybI2jhOPBecUl@uyp>4=RpY zCFoz7pQ44a;R07cW1BtoyE$}8(+k0YL4)UQ8fdMMRGfbtO?=j3Z(gl5*3)q!2@b!i zUD>DFJx58^=tixXuwO<=T+7Qy?m<4)gS*2rcZ8Ov)I=FXu`LkZA8Px?5;)4C7!T3F z5R(Kb9kce|^vpT*Ml|`I9{1z9F_(P@6rC!#;C28c7CbRi%i2jN0i?vg>psl+K_<5(V5w#A zB?$HM@|II{>MI3t`Z4NqHG5}+QJzyS^&I4_!i@srx(eux*lcz7 zpZO{qD9{wE~G}l(6$+MiH9^{u_^{D&ouCar&lLE%~F>yikMA^ zc<`LyQ~I8ZLWpeKCnC~-M1y9GuX%G>YQz{z8jX793)&|Hq&?BosU|7Ol_`=Gsgu5f zJYsx%ilq0igpZ^cGLNGp);?#H*abK$e?=)ILQweph_{Nygc|e)A=X=%K!K&fKI8N) z!q*m(>mX-w1V!ek351=p0^2uLax5>2{jBuOKCqfV2IJ$SsKG;29Bratmlg5Pq~pOP zHMzXMJQeserbj@(Le~myBQR}M0Kh}{2(}7r6D%|Q6=cQJm#BnuuX@3S#g;Fh2iTEL zKl3=40gi#b5;6jS#sz$GhcY4LEMXGx{i#yTtl>!2D9ma7Z!6;ToU1`zh@TA^=Z7D` zG68ND__|HUDp=`O1)jHHucS6djXUUfGh8{5Co%c#5zYoAmX_Ehtq}-8Sf+9dI!og} zWEVO<0V>zdjx0HyPN-NOQJA z4>;wiG#2Qw$gXy|9X#>oL_U9kG6cW3J+*LSH^}kNLKm8wX=>~tC)3Vub0PO{v-(pj zWlY!y*)1+?p_EpS680{Oia;6s=qlq&wrO+YL>fR&Rb(WOcRK`?mz9Zm|M@s2(aQ`O zll1RC+!Zvvy~c4((b4H8fWQNPV>K|cdE!Sm#8&0)HMWVdYLov4Srl15szk0&;@*Hm zEkI2z%$+3Pl|I;^TI*8ZF@d$dvfnslt-C?c+Qj#N|I#Z^F7=(^^x2n<;;g_EZ!1?3^sM zs3#u7>Y2lM;l>~I6EU3|?4V)6ev8e*{>Z&(Dq(Jzi4*sr5}_|Y`*N|ZBcI1=7;mCG zpe?xE9xZgI7zh_5?2j76esyzY-{x=A00a+XQZNS&p||JbyczWQ4@}8FXr|ELkWOk_P?Q-7t1#hlRY{!G>J%EY!i-m|l2!()$obL-UV`oD4fs zHC4Gus}R3EZ%FYVL(>ixFzk`+QoDl?357n0MgM0>SGbUz0TQC{>b`QU1)7TMi@^vK zRVFDrCsNt+9v@utba^#HbQxA2053@{Gl1*u@7?ODM3D)4o*j>0{sCe!8`ja4(7z^T z_sgN)hgWU)GI2UpEYHH|u^m~p(Y^g&6WCvSqcII-@W+6SgBFY$-Uy%kJ}Dy&OxSr? zw6Xu){IE0_v3TTIKnHo3Ny->i1DT787}+H3m=j`8lU-wr9eNYG!LO*Ug0x#Mo9HLI z*w0C6QrAOHx7aU5jJNik1%C)|Jwe}IGN7M9Ov|63zw_2)`Xf5su_uhbpf!^`1w9Y2 zR3DjP9FPmz4)BB=VE9`cRE_KeKebQ^e?vD;(n?+?RT2|rm#ewJ_VU)CLj^p77n_F( z>XvmV>5osPBYUDCEM^^z*R7p4(u6W-kuWPKu$p5B+f5?4r&a3*6Dp8x0PX8M~^yElT)xJJ#5hdtgcT>vFQ4-PEQ26$_}2c8FK3fFc!N3c@px zjmm*JZJdi0)$}G}moOw;<*(VvPIka>aR64zDI>cN`S_Boj<`w??yrW+SMusa=<^UN zZh-`zpY^#r1R*B6%q@Hj?Vdkc33f^dvwnTB3s}F?Zs#89q~ZZM?;}2 z#2hUI?Hz1{pgk?nD=5~H@>w3$n(NOS;C7XRY45>~7+a-a{e?9#7JxJi;?uxU!ZWM( zsCt9uo(NBo@;xO?SR$H?KABk&!|w^R>;CfD7t|Mgp8%Nju{iM;rtw zfY1$>4<0w0c$SAs*&m8Hm!k{%q|ANvca?WhbLg9j{Ftp>GRj~`UrP}ju`es?!qem@Bm0?$Qty@5sY7lo>U>}>s5gRU0;0@31diK`=`B$n%t5Bynz6(`y za=jCLS@de0zN85*z~TX932Eu@b9&HrN_Q~#Y(T}Md-jX9N!27F1oSpcAIgHBd%DFU zh{i;z2QIL!EUpz3@c@K6PEJ*#%c!KSbq<7=uGyno?^j4`H$PuD%=G*mp&C6+EME{| zElt`YayjPa z5uhHSo~?CRM1OxI!`Z6RtX0?wvMLJ;#gTpv4cL7}WVccT_Z0J_Aj8BV$jXce{yZEOxWxB~v$coIfLm?=3vYPA(z8dtXrx1b#12 z@Ww>^nnh4rL74?aFoX#uG$#V}%n=7|Je69^2zY#iSbcZVS3UH4wFqUm!6kz|JoZ!Y z+=Vmw7;LYAUH>Ou5JrUQ^iIov_-Gmz<;srKj5d)Y``ZkQkrF6GU|pd0o=DPP2Ld&! z8&sCR^D^zD_%$NxV15zhKz5ci{o-IN%0P8xG*QujvGX z;ACcA=kEF65S&5PS}|0OGQhpttaaD%DKNcuQ<-^qP%l8|AiXhieyIwmaKj1$7}Ece zdC%l%JW)L)$M%bq-+lWZAaH%I>V@clvLO;oi0SSvKa4-8VxQl8(?nD!A!5+MYBwtf zWT!kP;!P6{LG!OqCs5PJhO{+d5mNr^ZZ{7EUQmz*eThzbl53a7>wQatCn-bnu`wwR zPk?w67cK2oe|zWFuTT{zKL@d4e=q`f8<=({*e%{o1>cChoyhe(l!#2_B#SU@ndu~+ z7SE72Kk#%ta-hhIn7IJ$7$L`1|>tIQ_jnCIepKL zfHc=wyMd3?6rVP5HH}7k-iCqnk@_2(l@J(2Z)Qbrb_mwWMRhGK7eARpFI_bGU_Be? z?Z^(*&U>vNZhh1_Y`K9e4a@%1X3aBbeQn#Kh~zwCGY|Fd8EWCUXWZgnu14B-#_tcr zm{?0#Dr1h$&(db+M1*`M=)FmL3zAJ)ybMgWt2$HIkzqV7#6RhuqDtu0289ug-~|Ay zTszT~S}kH^iz+b#?-wG{9tP@HlcAYiT&DXSw_*y(qUl;ox2IEof87~3)oOME&P8i} zag6sdPsU^eK4|;``p_3JR8g=_2tB};{i^j7#pw>08tzahdS92m3N~*|xh+stEo=1& z@I0k`$V%FqV-+4M;;@(&UPbd_1!FAK0sSEF?2ruU;WVE=KdBd28jYLu3=GaCuqv=n z3-h^owKBjBC3h6bvsd?5D+Hz{%&?j0`3XqsfI|yO7G&?wymRz`WTR&qq0`yU>WXX3 zWcFU32R6a~%xoSSWr%+f$Ud+BhxLOO@lSXb77AHau7}45i`V?9_tPXF$(hL)C1ij=-t40pEJfHTWJ2TWcTeNV*H z4HSy3`A^Tg&`Fcthg*MLUU;>hh6^kjygdm!3LxE|J2Wo{{JF|mxApnS%YLoxC2Fp^ z4e`IXf1VU-SnxgEcQ-uY3dM+*%t=}%QM?&622$~0`FiNeZUbZ5>+&wf{jJr@Ui+); zR@?4{btfT#xnNAX79UGQ6w4R9@BURl=?lu~@m}@rr5G~lIW(TK@UOc|T7`7Qnu-{T zD~@^OZ~B?(tEC36Km?_I1&!+gmGGqZ5Pf_p<7_a3M(qMOY&VED#@%&Dd8-j0j> zpR%qz9?E@<-w3^hG!!9AnUN*q4%xSvj$;;wsf0>uqDU%94Ca_?W+*B~Mx$<7vL0ni zS0|k?qa^F-gmmi|B2pc@7|Yye>d!lWynoE+-G0ma`#sP1dA{E#fGPFUmwudKjtoro zr_S5kmKG!oW}kkJ)im-q1{8!FR>uGilZG`)mx7HSSd@NYM>W#e-P6P;qu%xN`IqX` z6r)F*(w%5Q@vG9$-oBJuz4JX#nBkH%YQ$+IkL5odzzQK@^n8AL(M-o|^KnRPg>?aS zYi#Q0(?HvRsv2JjdK=DsbS@P(6?sHZ-_I}^H}`5aFP>Z6V_iSJVB5cL`V&@KlC`m` zeBf82FqdvVQz>2LyDp3Rg#A+4 zZ0w0~W+?_e!h%V+W}DGw-7(@PN$oM$^`B3C!5<)Oh=7j-y z{HCAET-e8At4kl2WyHJ8^VK%IATG=;0nf@tNikwE-=kh&(`g#FJyqMS1FGeP`aaBm zvFSO*dJJg~QAFCVU%8MINyRfviB-O-U5&d3w=GTRC&(47^b9PO9Z6W6I)`V++{=~B zNQunDfy0aKe)TU?7z^DE!jVepQsoTl_ToZN6n*aL(c>i=nEqQ}srd!Q7OCDnHC9Lh zv(~K+N*s$nCbwZ50`wEdlj8f+d&OW9K?}TOlHxh?Cm>h($u9!{CUzYqMi7VeJ$ZtS zeM!noMl?M6)q=NE=|_}Ky3y6z*_Ym$LpA-Q#!9wtuXNQKZoNpI$`&PBt@*gd@jS>B zaOy;Ix;oZhA@&Hd)Z}&$Fa;3olAyqf7snF@wNdDLJxVhg(r>W9$|s&TFK>34IZF-8IcoTl zT&I`z1Z^Y4pWnOMof7STDFGzE1rEN4`j=ujP>iiWk z-fUa3Yu!YKjB@4dqaC#!M2oMSWC98gMh%2wzmIYnpb{QE_#U&>$NRB{FZGCYmJ-tG zCB(a*@K;Gqnx$MW<8zI@^7r3v@ZP<088>yrlP_V954Tyk0v`)QwhL7i&c&fRjWd_? zw67E=EQ^+50)a(l^PuC}1CXzGlvg!fZ_044R-QxQzN9(rS}OUSy;e%@K2*XE+k$*P zXktjpK4c+q4c1vY*Y%AucG{U{T0WW~(LP{jhwNrU6dD&+_#tmSNeRt~x1V}-bXfEsN{?lj!0N+;h>X+J zMo{O1{SlNAliN3J4t)s^1kEE5Y(>rSxZ_%)3)Cd}yMaUa&C|Vw&R=R;wD zWZJAARL$%940>Z!suiU5`U`?w=E#9?r|E&iF1j7J6?cYapsx$A)bLMWk2 z)7a}#b-HN710-R#C+jd*#OI42Z$pCo_Yeq~RpyUjN(!vfl;m;Z?n>i;A?8A^MWP}r z*(W7{?NNAVEj?>q+?aFSM{)`COy7r|j5E5uPvh1yX=|sU|5Vrq+k2z?S6KyR8!A~;hsL0RQYg-*SgUVTYFHA9vRknBSS7%bG1o5{J+BE zQ@_OOa%>y@5mIDz`F%bYRM+X?Byh!+1)MYt`Arg7itoWTQI5LL36D3V6&VO4YW~-&Vs@i&uZb-p zAd49phTY{1pQgNF!70z#rbMl{B94*cPTIwB^zbKsm3bh`7(LsAHH?l%-YX!TcuC1A zRAeu)g^IN)3}B7cQ?j=i*?DGgV_{-AqG_c+Zq21kR`R(a&WQaI`t_$cR3ss6W0@XO z(~4fGG^Sx3EohV6Dh%-9Km>u!AybA-bo3?IVDrD3pm0hzNAp;m$0Mj^ zGqmT)m_jLyj9frA$RVmcZs9({bv&{oQ6^(w8NhNiGO|U^x}@y-E#=WIjxr{8dhd{u z{Z7N$Kw$t-%f``HYv2MH?1E>x`*`AGC|lLwv2vTHq!S=LH>(Lm9ytE-{| zvXs_UjSqqO`2gMf6jVW84lcM;RPhMNUMN5g%Ja^9KZ$>ou6RVIB+&>9wJaG5l77-n r^Fd7^^fEXUYU6ZJYJ3UFhf*b4LW$k$Ew%;!fFH@->!%9BG1mV8pSdNT literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/rules-legend.png b/windows/keep-secure/images/rules-legend.png new file mode 100644 index 0000000000000000000000000000000000000000..a044d20621b6173e5ab9c755448c6be3d03b549d GIT binary patch literal 34867 zcmZ^qWl$Vlw}sK*o`FDs5S&4SyGw9)cemi~ZUKV3yK8WFcXyXSaOZa3@AvI0sF|vf zp6+wb-s@TGgvrT>p&;TRLO?*Eh<_JWfPjF(2ObB)LqR}5js|8u0#6_v6vPA}Dkt!d zfhRDg0@4By5H&GKFZ!^+a|FBZ>JAVPsJ;LGAO~%WjUXUGhQx&hlw5VrU*X!6l@l)_ zY;!f{y@c-D*Q=i2-Y;JH?%SU)R+YhETv*6q{E4sdiHONlh~)g;wPj_ctw_I!!j07v z5h>#2%T^`UL8KHU$3L(AgfRWEoHsn$FSI(xjcR0lq49TKzD*jG*9_o0RHh7kvaD!V z8FFYg_<0;@#7LE^LW&uNyg!x9&ckF-qsELEHMomj&+98wpm6M{QJ)M!&S+&io|-Ux zX7^2xQ)qk~JC*9{?fIh4>(B4Q7RO_#!(KGL{PnN(1)oU~awdrAHA9dFaar@;`bTnV z^f?2*>RPhFgmBm86e7n5&@QX@^_7H$;usP>#?ui`!1h#q^dUEoX2pDoAN{x|GG1y| zBbOm#yh3VC$m~A z{C2gg{3My5r3MM7te$ixD`m{aq>8b(r%fyp8cj~aJD?!gy6;RIv}3&PI_9GX>$64g zHw~(rM6cWTl6BEKeM&9%gK4%MB2-l!oUgC<-Wg6e+%s3>T#MFgGEYXcjs88$`6(j( zlB$&$4!wnwwOr}l5jmCR<$*tANMl46K9l=>)%;d-f^Jnazq3?>Hu!`P_chO%42@KZ zYQ$q4`p|@byQ4)xX1ZfGL;tl{jL;@!(u z-uZtY1V5TYzgXH+;*WfP<>xmEV_;%*S7pMim-55RDqYc3SP_G!STZU@p(Oq_{BAL! z1?P_=)2@WyF+#cGYo@Wb$%_QT#Ue7JL(fwLlyrFqhQ21gq0KXL&kQOK>MRzsqqjFN z%qyh#+jSNi9`g{NMYhaJhnI)Bc}Z&Kr(CDgg{F1qw9~MNP>r)be^?~OU%h0)12SfV zf&o12dpQBEJ-?R_jF~vF2K#>VZv|(cDp?4V2EZ1K^CU;WY6x5BrjZDm$Z+2+88+sC zmd%qY+9?G?)N!2%TeI`?`*e&;VWrbbyJv8A87Y=D8wX!ZIY~Vrw6#3lX0()ytI67o zawnb>4+CgdSt(`@N?D5Z((1b_X0zefKF-#c+^hN+I@8U}zc-wAUdDlj3!*l#o>3E1 z{@xy$xf46dM=%!s3=heh?^bMP->s)Ja_`}?a;7to^=zDZ-cq;;RL|DQT%+XKc2nN? zE4hgEf!0P3JGLi>Z`6(sS=X~h!sTc7`J4^%8Q+6(pCfD#X}g(7um>bV8TYNU$Esx0 z2`Z*XiSR*V+;Nz6TBFhWQL~!)Ztyu-zk}2B(PHP*eRRFCfD1^%v~q&0=P4Wt(z3mboB|FF-V zLfyp64g)7BRw2GfH#AZfaVdByC#{yD%Jn0>w(1pj7MCXnTfNQ%Wfl0x^Zs&OkMr<$ z-|2Hb&NfT@@Lj$AcFke3{jvusH{kCUG#WR*GrSi4+)CpD=zSuCYch-Pi@|nJkXdnO z#r*z)VIfpplZ>{ZZ`}edRd~RHx@m@o5XM=UUtRQCmac`1c#+2rRD?O{%P!yB?%8r3 z!f}q1?ET%UEj<{Vo3`3u$@XJ!$TZ8V(R4Di<4okk6U*rFk4F0T8_e{vnrp#oiVvW( z@ie!oKXEemfdt8pVZoOPQ*2liGU;3{HqUqGOwX!Jc-5R7%;1R)tVo{&Utnmvf5eC1 zAQ+Lbkzr>y+Kp6?jgNP@Xumgco+5N&ax9kgNl%WY1LXDWB{^evi^F1$l3lySu{$JWGe-#S!Rz^M-cY=odYA8MI%er@kAiRdPpNX*Qk=_DwZ7Fw z+qI0d{X|4WL|CdP2DEZl_qIeAZsSfg*Po?kdlE@@!;H|Z*rx?e+uJ|uX+m`-<1*X-JUMW3J*pT3`@R@+1&qG?|ePC z6>>b88y@0d*McmjudK$|O#T|>zC7N&9WH31QazRxkz{))&ht}himMc9L8z{Hxa7+m zN9;|hP>v&!oAetoo<(YGGt^HhiZ)ly*l^Q=;LNiGXzcF;5(~!<$IXk)d=4Bw!to`p zd%||;Psqu*&u4Sj-kidG}O2_-PCJyImhR{aJGx zjw3_-@Zs5a3d_HRo^;i}h}obIKGY8yu9mFo*Xc>8Np!eQwO)6wNQB%{nQE0vg+^G3 z?w4K5W$L}%fv8?cEZP)kI8=A(RN?lMtzPkAxg!ZYhcJ|a({>mKLQW7%r>t~-+g>or z=gN(+n!_%gDiNfMJ_H$Reea+@d`W$BT+arszkjMV=~uW-g^|k+wyPE5EL7?0*5RC7 zXVW20^ta80I}8u?F?7z@uFP?_V!ncVVWm^GIH2jy`xh(UduTAl={E`-f^bxPnD444 zK7$VY^5u{w%Zyls-w$lJ8K}+f6zQd!cd~UD(3W1_RHz%Ry0c0}Oxc8#6`MdfImb;DX@#m7&_(UPLoq49LCA;R?8p3mzY^S5h!BCgFq? zBX~pUwN&cf2k|K}QqA-zJzq~Q>^7MOdNNco)d|Y(7mf?PsY)~U(ppcz=|-UU`^PhX zolEISVk(HQQOnQG4R@RoGd3n$HNsqM48By3of%dF%d4x8mmEbpI&a%09LLgZkH)sC zDeL^r@fO)<-T(LtWoR>l%VG0ashYy{ppqB%`5EU6vcw%7uSP_Lp5E=zbU*{P8D6*1 zXr)<2P@Q99z8-n7 z&rO1=4#uFMvVs?X#qwtubNGev?JIwsiuaT{cT8N%`|P9jjdqVy(M)!iHG8;Ku8TG% zHa3^am>R=DI`vu@lhcI?T>VMD_ZNpr9=JN`G}hTdY0LRikW|IaXdL_(R9STVwFId*(PCX+FsMPSb_vSnJvgCD1EhyjZ#tCp(? zWW4Sc(JPpa<7y}rQE5HwwZUX(T9uS?s!C;KJLfp1PMggkYPrv`P=83ocYV-}K}mky zFV-cT;51UqsOu4|AUb+^FQ2hwZ6BfNLUs}yZ2Hcx^kLqduh03n%nmn;SwIG`1@1)yCNGM*ZO+JAbSJ z8MM(~33^FF&g4rmNDSgrz1W=WY>vv$!xUNR91i4x0lgsqvGSo7A-H5vO9l{=f|vG8!{ht~bSZGbQw|qn>+P z?R?eD;`K5aPjx!2Xj%#TW;BF;YS3@+&CDoUv%#Vt+kK_poD%Z;hRddx^UR~K7$)_EQ3`imZ$@;_vGIJD@2 z3&I7tM=~E?KG=T>RXSmhXbcNJEav-cB<(u4L4F-4YF7a5`tI6KB3!eVh<(3N>n& z(kOYieH>CygZl2EeW5w$-*uOxEh7e1XTSd26I zzyjT$apjL#bG=`U`UDWrb$^2M^3_8#zmt+I@aCrlM*sRUb_P_a=)hxWdgDaJiD0mz zB0GvUS0&LDXk5sgek71>9bNX5Ox@HlmTt--tX6C>qH0>!G^5ogm-54sYWJLl{?|zL z?!@W45$dXXn{^F7{n;3El`5Tae%%(wl1g?2V8nA9Yo6i1?o?ey-Mk<-XFW0`{?J?^;MZ1;(m(%&|J4>N- z+Cry~&lR0UeQ4W=p!xyZRJ!gO&0q)Wq$M6_wTo_W2b5jzPX1!P_*fM&dHKvs;LMGf zF&W{Ya+o8HNL`)9qhk9^8}vvP=y~+cU9}X2TU|XCIp`Ddv@1FDz zj)9h6-%!o91AM)#+^&QAJeK(;8O50TA@(svQJ^-fWgD7 zyt1;f?DdHtI5j^u@7U<6^Ih6=sa=QBka`5|mv&7f@hnn3+rf_QyQ1K>DM7m(l?g0K z+WtGYXqP%gTm}fEig=y*I;x4iIyStl`N>nfjcoJT&Fq}ecf zKg}CZ2X;RA6g%*=+f|H(|9U^y{i1qQp6xxbKkzxGgs;+F)6b99<1hT7lkzy?fdh?A z>f1^^NO*NV=U|vr0O^kkx$?XEQI{VyZWuL$asoyB=d@FgDv3fYjg9Z=E(sIiW^F5$ zKLT>bG&RR@Q+#r!R6|ggB?*&o|0?|ov-sdmo>3g#-+7m0GLtD`zE(1|Sk{wZA^}Gl z{}g>bkMxeGG%I{Pm2!bt z7@K$VUG%7yI1`?!!(1nVWE=4s^T&IIU&#dpn@iMJa{VVcds4K`jo~fq)m!+-Z6n6 zmy14szCE3bN@6YFY_#hRIdIhR;BgS0^?ABmy{Oc9bUPlPHuzYvfk(CO&Yv}|qS4TJ z6L8Nr=BczQ%Y-O-K>KpJI|(S?9~zN+{XIq8v`oEG9^N1_pKuDuQ!L2fpl?JaR=}4l zln5(>{>&V+S!A-?_pp6@Xj<-370F$hHe+`crI1xoQ572#X~gSEBHN!>oAEg~PBMxc z8|5;wLhF!s;D7rA`N;K*O$Z+zTN-z)!A;o`%Nx*@8Vc>7IKAPB^(hp0M9fZ=4V6X8 z@8gpRIFF-Pg0cI|ol%036^W4;LW-b43SL|z`eQf(N@rn0(+E9G!v>jCGtDPCHQwT8 zng`xA2U)2y4U-@OVp+ad=GAY814dD8L}%5FLeemr7*(BbEsPcsFMVNH%Z&VWSB!95 zM{H$N-P>hZZr`Ej(^xDMCs{XRYb0QzE$|-pO$n=NHKU6w6%|F8E(Q7R1@=*s zFvi0D4xf38S4{hVQ7O9L9Ce4f-As#dx%{y*h28xy0k9sL8ltn$(YQJgJAfd`VztK0 z!?tFPK$XtmY{<{w!+3|pVn-&wA#olgaLM-R_J@t(dwUrC;uATR%3}HAsRPIl99j*S zZ-8PD&Fo<2FrC1Eh06E1|6}EGcQ%Zzy!U!mH{n3NiZb0xf#vZ?pPA_)80|~t_9`G? zeq~#~Jp6TEkh?Gx1qtD9>-PrBuZ4rCKNXUQMZfID%PJvCh(><$n+PFvKLT`$G4C2s z^;|aGDDZzO<{&DgX~hucJG4p`$a);w`eLxr5Cup1HQOxY?^ zrdok*ZEe|IPDoxUoj_kAA|kTGu7yxMtCB7R^j~dHCuK1_cb_WTc2q+w=1S&-+>UP=RBS)glZGPsQo- zr_Fd2`+Px5`8FU6xI6a%@&fKf1P*=2^PkpjJ=G2OQ(7L0mw+!X{F{BB*=*Lb1pXu9Kr_hl+lhQ%ab< z`Q1g}T!9|{9_R%ehfhn2GM^?~I!J=tA(YWfsY`!qNG#GB#L>{ue1x2ePfMf5t2dt& z4WWEZ+k7DpJX?Etyyg&Q;dD9)9RJMi$}m=x<^2S}gqqU-u5qA7E~3XWoEeI71_8$p zQkc>EsT`qO0R&>-nHdG$5l^{KsLiL9txLvKVqqOQoF-$RhJ6A4*jIVg`La(REB2Mq z?oa2tHwM2-NZ!uSGTh$zMmyI_`TR=&8t+eyuM`wwxca<6Pip}6TDmF<3J<(tjE&)a z`fe&M`b@0|_wUHLTU|-4K4tltHd#pwp<-v&O06g2f66Yl+~Zg6>1biR$VmHL!NAJT zh?04f0fO0xk`GBQ2S>4Ie*Pf9wUnXy>bu2aM~onLj|9~4zfs1n1`MtV*z(2-&8CSn z7zWdc^sU;{|ArmP7PmC)(2qL=D66Hf(E-5G+u&!V*ew`?0&%Ai^>7IJYi5iA{k?}(g}SMb6EbTn8od&H!rOESkq^6drdE~p&mz?T&@2MDlWrJ{Xi0&dFL`= zUs3kj*qG?56#40!;8?K1-<^J3ux~IPVWQQ#B)X%-p|w@*)WAEsXoXt4`z={>xaqkb7_(d8cUUX^1tPYP0JG}Yrky5kz(iY-5ZV+Myi?XU}>u7!w z-f^iT4X85Qjcx7MJV8U@r(WJL+r9L>;IDuBbEhA|s$>Q%X-HTL1jplP1&^_HV}b<% zeg(f_RS9RBjA*HImM7t!uRKX4oyqM6RGIQQpnXj+DpRRYJG+s_CTfjKN*Z(qG}7zy zeTdm=BP}Cvw*LPF&(enTsEwxrWkzQUM@TjxfpKiA_4Y7r`c!)5Gnu$>jKgi zkAE_gN0}~}K_5!Q;eAb8suW#PVX;1FW*ur07{d?NtHnNipG8E>pc!v{DMT^<{M0>-BMk4Z;OV@ z2*VZ9Q=(Y3!v2AuXc)VT&-JqUQO9Yva3JA|PuvWDFO|HZB!v%d^lr5c6_ONadz;Re zEKCH!7Ax#wA^L6LT{aPF!@_Z?o5Y@0l%PhNbv)D%ZAl%AzFD~FUrcfB2h#93arW+{ z*b%DJ+9oPQp@0u4J>Y+MdZ@ZFnt&_OA`+iNL07nYM>?HdUi}Y%12MMdRdoS? zNTsQ)%y-{Z@V~{mteX=lTAXHZ}skcwRiDw#0a4}8dysM9;d~= z)CBd)pFm>-cI@X5+5u3pNGe5eyd-$8XAZ9G0~(__V*8<*A8~K zs15>CD33R3$bE<4GoTJ&OddNJLEGrUD-ldQtiLMnQ&|joBno)J{u7K zuyc0@Mu$Kazf-djgQeums%A%wemW`(6FGNExLd*o3d}fdR7`$MV>%;fEVS0kV+PsT z@RneLAS^xsbjnuARM_LfnfEtYj0=?j{~2jFW+5HPUFW8}cpqwRK4`l)#B#j9cyDiy zzdG3>r}OBi24b%8^Ry%^;vuB62VhPafFSdacG3fsiguCn}z3xg?IRZ+WP0sua7TgXARd|oDvce$akqWhqf_&U2QkJ88?s3 z2W(buN95kpe!xcArZ^ki$a^pavYQz^8yVzt_E>`1Jv zN1X)qgt0tk;8S$cSwZFM zDk764rpd`%TmHV32oJnW4C%NKzJ9U}I5_M(Mlgk4WqL{TT6H0@gBMHcB_^`_^_WRd zgwe*@mQ;UG4xM7G2_xy)_*An`z%%!OKNBbkvQZT?tS_1;M3FZ66Wg{CM)+dt(Yw)+ zXwRL{Dk`U)LS2sZ3ls%QR_KVfCpY%eWs5d>-W|2o=eznQM_=Efthz z=xrdswkrQC8sj0YS-IIPV9QY|M)4}x4P2EEFw*^gy<*t(ue1KTUJP}6=P67`7SjEE z9)@@6J^iDq1gjohH|avGJ2l}CiBVaBnj5}(N|qAAsXJw&b`3UG>KYoQMZ8*uI*fgn z&OB8wqa*{X*7gC5#2;-iCDt7kt7CGd(`uxr6s0xYrQe^Xrg;X3KXDWly;Z^G&wMKn zOuE~Q@RP1!AyW`DtU1@bf4^%&x6S9vOp4@fCTw${>aElZ7p;fn{5HfLd7cj8P1Hm)*4Cy z(9-}t)*#?jmX(pb_1-O)R<7;^#d}>f-O+NUE4Fdb`^Z+5T#RKvU%4DiEG=9do<6sA zv@Fa$7iHb0zu8wEXYIdu3T-wuAt(PPsnS!Oh&)#>wK{oqR?jt2>K+N2j2Is(Es(_d zhVaAO-0C~okw!d-fzh<|$8bJ`*&M$?!7yp+gjT@S=Ve>xE8O&)!2(f9fnt})3>nkg z*cwV+MgJ5V#FO8dSd9j9)0L299_~126SPapmM2M_oj&^N?>+6WNcVf7Kb0&flxwC6 z(;Ml6wPy(VOiIgh)IK=dYdnhH;MrdB}wG4Bv0Q-F~=xzVYc|;$V7VU zTknd=e08pJ{AILtnczp%m)pJPMN*IwHvx9xu5XWrA*ck1MJ^W`Pd{T( zfeK^4Tx$&2!5#ouU&>%Mp8*hbF~5$^25r+?t>dx6NN(S%ZD%{60hP#s_ApBqc8Y-0 zQLWAOFHp*h;6cBV3F0-Uzoe=HuTFN2Y|vw(T~3n<%xu%`fLCG`*&M-YpB>_+qM za^4$?jliZ&<@4$Al0`tmFUXUty65MwO4<3i1$67hswv3jV^nyJLd_-{bj}-~-u{z7_^&s!vOr_bo5}t7 zy!qadDk6H?kE1JGq~qN4h>FiHSH%sfWDa=UbBe7=n6-AlfB&9StN;{_p1o6YI8b_P zpI%-!-+7z`{}4(t1?nVpuax3g!Mv(_fkEFAT@$$jjXBgHmn*e?$5qS^KtcYE&wANg zHqA0l62Vn2Ha5>Q!;UteEi{)e#M?_{vn9NuIkLJfi~{@%HTrGeJlI%pSaz`cHCzOX zn0lXlH0E$!WNiU_AEmbK*-x*Yt!|_FgW?Y8q3QWD)%(*$v_ct3z3nApaWA6c&sR$f zjeyEa_L7v4m&Yh$HMmS*duT+{h*Q=C4Tz3>FU~}_TqySg_RC$LkxR7^$jlOQ{px&|UC}(djNO>$=rU7a18s;b;dFYwMN^Ndczk zBbZ#47Re=YXv^Zp98eBuCgXHXo4*xJd*>9AVY!me60k`Nx_eM@xY~&7J&U#AZ8r-vC1bIBPbGi$2 zw?-kEnr=N^Mt3hRbZYCaTHoEx`Zv^chNo$2>I#EX5cO1vkyLV9ILj*=3JWnqPI1c* z$}iA`f|0-8EdO>mJQz~Ju>jltHF-dY(_+-b4Kad%X`LSnFvrP#R8;N%mi;>6UE-?7m&X4E~J2owCRO71$O?0KwX+rit z!<--=$I^o5>sSy`pDAvR*vE#`sEI9EpC>HM_Fva6fInHErX6B`YYPI;0!*i3p{8UHu!F$f?at@c&Va@k4qDv~?j1gi2=Si{i;E$SNpb7I zN-&)03oM=laDLx)TTxN{xrGN}Sdd!`jl=*g3*F2q74)B^H4bC~{Ual&rrjVT0JDsm zi;LHdw*^m;C29Q_E*Q;xVY?8$Z8)pPX*C*_ESf1vjsX8h116wM|KA7xOj1GKgl=v* zrYG@lF+XnmUi(Ex-~zqjcm7k>D(U**vy&9wTLhTU0kx{rkOnmymVeBn8PhJfq`EUE zgVkCCs1!hi?Ozpm{=6a?X2)*jv#5O?^$o}W^pe)_-x=eC0$)?!LtWKYYd%YEPsigQ z8_1%KGp&X4iGkn3`s}|iljEzU=dX!G#bqR|yAZN$(k^f4SwT{CW)VY9NwsXLGzdE= zZh&!*H68PTY;Wu;ZE&xZz)`{utPrwWT!9e8DqGI=d4IFA#zxv7G2r}1419ratp=P) z3=&ZooaILA)fG@%#``vFDBsIA8W7|NB;@scu=T$F9Qu6GnHA*vc(wnu=bN|=P~o6g ze4g9*F-pst$IAg%L7U9$<*u*4ok*)$kL37$lVQr#n&@VGCN3@x?u#e-4nU$Z|GA62 zy@&sW&@H!W9dYg(Vld;#~mZayS?JAQOyhChuN?KA7x z4<%DG=F`t*l)}LkMqTl;yu*oVBMWQY!0|Qo%mbvMlcOFQ_TjQY|Ku5xLH(~ae>T}C zVPXug2fM8OWq!4IsRku^%N)ik9C_$)&u4lKXKArC@>XB_y=La`Ek&@102)Fz|iu zTQ{jFr`J*UKs?#3_^7>s5agO$h4nTv#aig~vV8B4lYB3iLJRJFz<5i{%0gp$pyKfo zrG-y{;fKB9@aA75;k}Eju*u?=Gh5izdFt!@H@O2uXyy9>rsr{c5+weK&zswl$Ctxu zi2?hlX~UiRC}tCg7=*T8jZjaOkKV7lYyyKe4S=D&6bC=Y00`0rj=^kvIKwB_dKi}V z?#YSz%;tQ$fD&JAw=L+b-T@fP^L3`OurP=?M8&d2G8w>hWwhPkCLk`=qn5+h>__qS z508it3DA9iT0FV{Sf3-%JtT~cjtU_pbGtEi%Pm%F^S$0EM$2SyDzn^QbNriK>7ulS zf*bAF#sZS8Q<`l23|CWh_4v+6K{x{0ils{{pZu2u-SdTGqfpghMjJo@jc#>%2}lZR ziZkK!<)#1o)#vx%6Ub4U@dEs6i&F&3e|I9p5*dXRgngG96I6L_yIJiC!4_54twH+w;ncXb{O^qo$%qxVIGFgrfUR9kTRM!|D{GjiXy_D82!yZ9$``|ZsmG3_g|RIBbS(lZ0@?i6_g|x5 zLyb81bun44yCy>1<9Z9k(&aNR)pEe?oZ7j1;S6M+V0Qte0VlXb1bPDLLM;2uiG@te zWQ51R2}T@)pek&|*c{LF`x!0Ozl@+mn-Dq`FPc!-V$JcBZUK(3{bY66-n26{mw$ze z)yqYS!5<|SV-<1^Hc)a-jGX#hp-`8zn-qp!Ih`ouN~Q95Or;xrXt$@9^!jB76~xz; zl$gu7ETrXMh*cVllzUJfKls@ZXBhQ|&Z~)9Nz_^!VB=T0h3@~s$C+o661ntdsrMH4 zB5Z!WTQz)>ZJ@UUgSl>F{V=@zI4erGPEiB8G}ZuYn9j>SD9X)u)K)4ZnwKN@(Qt~U zRm}P-)hlCzN5SbP`7bWM1u-a3Kehfcwc$JNsCy!*i=P#sycvags#dN`qm@Mj$7@^i z7WOi@1rnQa2D*%t*wdjEYFzhK=P~fA&F>fu6j`u|=P{5NCRnx8umeI*NoYM18fG!D9I$cplo3f z1uy(UR32;IO)rMxX$Sm+0NE7!(?X`Vh?x&19Z|MccUv*bpy!eGEU~}R^f#d_}lrpz+ z26<%oC?mWDnDyXGW1y%UXk1|SYLP}#xSX%V1Br>*FU)*~>o*?_c|_i;i|F)Ci0WKy z)$=)#`7%bv%t9OlI8(WuZ>X!>91Lw{sovjys`E=prrsGtav0L#bNtB9><5QFN%aG( z8n6mH0aB>f=+-o+Z=H^YX3n5VuN#UzPc#Z~G0_ z{8`|m;PxvrK?58V-C%$>Ub)JXCb=PkN7lCp5z_oU%jrPtejx8 zBAAsD5mLB~z$_((#|TlkT7UdB{<%jP*JX)e-M|z>l7PeUSJ$W|CXg{^whnB(;j8}~ zojgxYkWL7PMwnkUE)XIaBn(#9CRlE9YF*67ecg{)ckL@#KhM5;IUydZN|BO-F)5#h-F_RhcsdXSyBW0;*8S zED{DOOQ$2>$!+N8SDHd!^&${HF2pn-&v$lq0EoQ?^bPUk(kCko)KH-n>UF_+pMoE+ z4~2ZG6btn@)Mi1<0M)E6K>Y}Q&RI-@9+SHKMX8GPEeFlh%Ll4gl2>Yz7bobt$VA zWxrCs;y_#$!x+1B&yqjsKyLWk*I^~AwdRs5qagJ|sUPg7eG2=}XpBScChXa~Gdk?J zs?_8uAae(V-iaU}7OP!cLc~|bKwY(9hV4b|`>N+<6lCls0)a|RM9uiJ-5WxZC*t{Z zbL@?J%|kqI0!aBCJ#OLZU<;82kEa_8bYkD{q`9`($CM)FI_-G={=PKf68c{cih09} zl6pp3mhMMuN8*F57c{4mXw-@KKQY-ul<_I|u*&JDM3u+b$>H}r5q>!cuQ(e4FvwEr zG?9@=aSq;~x1i7mgf7#FlBH^Utejjret853HsZM%kK@Q^N)yB&!Bf_Xs!C+)Jbg|@ z{n#4@(18g7Q=e2=u`0o>AR8XsLYY)*urwfZ255g&qR`{U9el_{gG^#bvI>ZoZelnHeEm4QbJKK8Pw#4h1bWTE2r?aoIjwV32Ys(&BW z`U?Yyir&QARR643_m!jOfguW2|~}$907&P1}pk*LQ=m zqYn;A&zvkEmTtV2V)>v2GxgAGovMUyt4ezB?XFHCtR+crA_h=m06$0bJH`+vV?Zj2 zFA2qw4(Y(|e_`ZNvj&)VdGjJ#K%x1CaoY8M(?w+&Cr>PM}`kI5_!c zhmDnObVT>n#a6maqspV1S6U=dnVs*;JATeQ$G#8@zK3$@zn}a`1ZMA?(}T~sF!w9G z6q;y&x;8OfJ2qSO6KTq4X3G^3P!eu^dlcBrQ?T>K*8BK%{T)$^y1ny_e&Z_Kg1#K` zT&f@Ts~K2fnwi$@&o)aGmeJ88|IDp9xKd%x0*smY+e*Pn^|S32X&6E%fY`tI&ywIu z_qEMQv$>7GX^LC}t}&M1?`^4mV_0ij>HfcteG&cRyJkb%~6_r z!Jb^pVp{*mVoQG&(gNHG{}y1D4I)XWpg(id4{$2lyUDedFjTdQCoke=aBv~_{&Qj? z!I7DR>b_; zkf&;Sk&o*2<{=F6n!BRzW09VYke>Gu>VDO2Ljl(CQKb-Y4aS(^@{>%C92~cVLE(LR*3tJpZOFMh-g!{@(3mt4REK-4V`=V!c^^K8gjLA{6mS z@BSc`iTlg%zsVMoQgnv+8s6iU&d`~^0Mq8v0inXp-ooT!nwa6ZzX)>FEBkE(178hc z%I8nQ0kncywi`Ff{o-|Lj*UAX4L(gsq%z9DtH2qA9mTfq2ihETQ(R|uX~d}-7fP{w zb)B7hyMpepFr+^5x244dx<5iS#Tqwl^V(&U=H9o}KdEz>g5$e6a>p&VAwb^{b|Mud zB9i|@_fh|%&}5suXtO>&p}OHsb7b7|35}3@>3e6JeKD5!MOoi)12wOButsvU+49^{ z{m+4Bs9O_Q&^~hX33l*q}O} z$EwbaI`8|izzDE~&=}W`@-@p9Mm#l_T7}!FuVb`S)A`FeLLqDI;gXS#qy)T#8`W+s z+USohZbI_Nz3469mc(=-5{EzA7Mrc~SuPm8F5D)-fyY{of*+~UEs(E8#%5LHC!~;1 zuX>*o-;VFEO%Cfy=Tc2Rwm;j*Plt#&s8(os?@j4T!Pbb*aeJgxNK>Uq6=DtpojWn^ zGN2ES2dvX1Tq<=t#|uOyJ}=m=HtTb(Ht1Tt?S8?gPkt8=@D_g?+v)LFZy-ngT6dIZ zoaNO*Cz&9bKNH2JLi6sp?T@zU)@t^2leKcQQf9lv{MwKeyYbdP7KG&e+v<3bnK!`m zx=>raRLde?_>0%w@xbQmU7k7_(x&U~xTICW!0=DzH#jH{U)t}^OUqE z>&1kE(|RF6R>hiD%f+>{W}{Ds$NIo|Lt%_$6W!}W-R8^P{q6?}gd|&)W|LpN{cd47FR}GXz4771x>UF;cgpwV&mi^E%0p(oi5!6-<9phr*rd*) zg*kd3Rhzd7NL$-K_jOKQI=b4HC$~=&JVich_fZYd8!L0~>()c@M72uGznC20a>j5A ziBm4Kn!d5`vW80HuuZoW2F;2qjJ)f_qgO%0_~IK|(&1;8jF838)XUP~SC$sD`{7m} z8$p2Zx$JXmYinCtR=BV9TZxMQ`C%4zPFNXsS4L!1WifqyC%b(81{h91ms|EI=rhjl z|3t63xS%EfuF{ovtDq{%rYX|1ofy*|_%ODn>H*ff-4wz5*;yys?QMLf>DmPzmhig1 zHz=5BgGl&ZgP)?g!BUZGIcmbHwcXHv>^DIXyM*nVQFhkdv??=v?l z`%z-AfPO-NMO^omF)ctoAVGit^gcR{`Ky=yv_@~PXMxl|FtQ@u7PNu2B-kj-|%hN8mdgx=8Fp31? zm`)=j-yR491|Q$lZTzfOWQ=nfQ}472x@atUauKIun=)^olEgDC2aJ!JrpeX-%E)=q znt@h4B=$yUnVj%(C4x4OkEBhlP%Z%1RFpDS&B1u598h{1$NKtQMxKNvMk>Rbabo-` zXv0tVq=(b7S0Ipu4#&)BV5EvY3=yiQo`l@ZT4W{wfL+uNC5}4V9UYIYOR4*B3S`6} zL_P{dNQ((g72HBLUwA^4N*47HUsTA4?{Vvl)|KUCLY|{ABd}_4u;);FwE9W%n#FfmFuU%F~izjJZt=9?OW# zG0mzkzuj~S>$oS}P3z_>oqN4b-DnR5F=b@jmOs1M6j8-X-rnu2pBWYQAL3EfT-a`^OZEL>l9od zb{@buy`J6QULJu7Yy_LdZodO~k+}uYv)Q4n|+NoM~WuOIC7$l^WITCo)UUgtNLQ5bj+*F`koGp^2xUg3J*8qgDAnJ)fND1ob5K^c1F|Y#Zm;kj7PY%t5Xk&xtm+Q$okveDC#Lqil z8!7d1c$5N&g@u4PTn`Sj{S1IGX;UA3^U_Hyivx%IC7%8cegWDXpZ$>p2KCTbfv!rk zdQo7n7&#>G7?3SSEUZ9I6zV}gD|IYSs-@RyQ;UlH;cVM}tMYJlV+^9qplyU9cgvBK zkobW7$u|xF6DYHS);0KNaj`=1Lr10hHIyT;KOgU!I;Ejc)_S+AQ~x&dQfBhR!OwBA`hWJUOEDKUaF|60EmzAda6&AzFXLZ`i zFR#19q&$;llqKTBMp<){o}$g)%(o!pfQ|J;#kN;JSh%NG14*0d?tkvwhve`A$)ugc zTBUDMEJ;VS_--NMI+TVb^uvDd8 z+zfH~Sb0#=#~M{(GC!LN{pZtZYfx8oT(@D(R5-bUi5%C%Xf)uyf$$voo|h+wpmKsV zr!l+M2{|1p4P)DCg?0yHI)Nyd)35zcl40P|Zcd~S5dJ=;U!q{C1O|`$%}+NuwY)k} zOsw2}9VAY2zq;Pj5a^+@GI1aP9aM!bYymow!?#>!>wJ_pOT|e6yh3?>81zE-;#^@^ zTzrEvz(0^9A{p=J_(8{9NORxRaZB5n4Q$&SlH*y8i-MCV8h!iwrbLKIwg(-6v>sy85^4 zJ(5(#t+DyhPOZUdJcOp)Mh)Ivv(^Y96<9llBuZWV_c4{th?u)`On}XGG=JHT(aY=l z@Jqk?ib~ldx7O;L=?$v^TbwoLav@)x1r|lX<*0E$#+WH#&VY6bKK%chI_s#ax@hgw zAl)V1B_JT(DP4!|?k?%>5~Kww=@gI?`&;IdYjSf`xmY6Et7p^~7_&UP z$==2RK1SXvLB*O2TcqhNmh;U`;OzE$BW}yL$OiUpvE>Gvm zPdzrKY&PD+>ssx%scaUku1wrTpj|(puGeZV8v8y6Y6ET@27PGub6sH!ADk=|bys6s zcX&5dG;sQ{Zb!pYntkQVcWd2ft(g!(Z^40%F;f#WPgP2uHWly%TTQt za3-2Z=e&7y)W}WRt?56aA3jHEe1nfhWL5!-h?NyOwDowZJNgJFE{s0n0E&?wo!@j783Gt0QF7B$ir=R)n#e^V?QEu(r zJnriw-Ncu075PE( zIcYcXXiT2GIopqGQy?YC1$Dwc40!|;9tCR!_%Qn$;9-D^jpb5j0r%s4O8&VY2H7h{ zB+-u6R_7A-a7mUz)+_L}#2xYkDhnn8%rO7ErB%%q0R8j2D=T?@qR^IhHz1fGWyfR1 zkzv}Jt%HjE6V&&-fE z6dBO(1R4)yWMn#}?9yScZ;>_fNzPjxm(N>CN5^}h!Zysv22JmL2M~gBJ5}@nQVbws z=U}3(MwLhu#45!-5sM+*-v_EFq5>e)6NX6TR+q4`3H^F>j(kHHelOilm# zHyFw;py|{;2NmBDOw$|VbodZ4Q^jy;ERxRg^k5P!no#Qauh9k#I>kL}=6tN0dTF|m zvEhK1N@?sRo4AJacK+Fm7t|3``<3~zs%a%=w9j}?w?JQ(N~+OkF+A?!_9B#!$C0Fu ztUFNX+eftTTB>R*R(%PD8qwJW5B@7F!nJF|Y~6-`;tc*Rkp!lnx`>oWK3HJEPs9#b zy@npSzrP7*=;E#w^k*S;4;IiF;5Ph5f||Tk zWk5rpv^NMkHU>@dxNsDLovp23zQ^B3{5D=_J_TM!1{$lFFo{Z!b#_AQ-y8?&{xJhw zIVfwJR$2AVW1yTDBMW^iuZSNPzGD$4h4GO#Y^uTp-G?xWZw>Rzq$EhMcSk=)nhXpN zcfW1B-iWoon8xWF1nqgY*Pz80iXe?g!2G5IvZpm&c>(0s)8iC?a_dH&|1B8@7sLnF zjV~YJ$4-3p$!C$a!M8Q;WKty;moHD9L7dgZ0{XiXKQSryT*DflvvI8-WgT~bRbQyo zsb@!UYCA{SU&SSOAw{8QpQ;{-sDBjzmj?-TrMwuW}Ycf$Wi zkUaO<0hJNP9~#sARCXjum5+h=lR&C|wza@Sx^U8&7uA1MqGVhX4k=(^{Lf;OwGp2R z+WzR_>1OhOUkcvS;VzcTD8g!2YYD0)`cv?0b4}{uK7A8@;pBzqZ*vtRE-Nc*X!xlh z$5>(SzmN0$iM}{1C5j9ZJ>r@*=}RO})CPpiL?BQBjb*)&huM?a1uc8PPwb(+ z)2|K(`E76UcnzcKGIXtYkQw+vZFGmopDG4q#a^2hJEn1&tHH35dHKlAR^~ zTU}fGtpRf8&P zcO(-Qn!EtybIFrB)ZF0UkwPK8>2)~g0Ca`edHNcg@jNSgtL-8VUHj8P>ct94LH~O_ zB^0x_m83A+pB|1~vQ9%?oLv-XgI*%Pg4TDCA1=g;LPWx-6#QWi^dVkHKPibUq9v(- ziipAS`{0_u!n52#fQ^;aQcH=OVpyK-dl>UG1mc3k6oniByi^WL<$|9%)o4-ResVJn z3x84m#N3%AQrNbhy+>nm`-X7;0GA))hQ)llj(p#y`1ofl8PodRRq63TG}0~%9`hMfPLEQA}W zsN@yrLBGJDfHHN5D@U5;MYhJT^}q8Rdpk*d3$_&n6_Y@vQ0-Bs|9dpGXS_lmVC;Nkpa4`P~(D_8|FA4q)`5oijSU%mQT z!bnFELX{S@hPkVBQtzkqa8S810$H#axRweFd4w_hsJ zI)S(WCMNl#v|5C4Il3gKu2^q@)RZ8k&H59k6?%2cMSk##v4G`B#$=(4yvSrPFrGre zau3AAj+%=ul`9BE9!$;674f@v7JQsH3M576XnX`c`-hdQAM=3P0jfCSA503Dpp!0# z_mx&USx_d_>hmoCh5Bx0)iYkVG3g%M@5@G01dqKx2iJ=f^RT zX61zx<3vuqn9YO!lJ-eRoi&JEWixiXIw1g@`BxwQc=1hx@<3m@$N&AZq*fSAre89O z#3rcwi~0!q(cY{ykVE#ch`$)DC^Kvv_rQ@DoNVwR$!qRx-7lDIv11xYC<0QMkEJkCbg)$Q6ChtWCrPTt>Q8->?i6 z9H5c%b5)plq$4Ee8pDP#QC2>$PKnxJL2oQ-^E#0T=!TPL(#l?kNnFo37V6*-G?smI zNWgyg-zze!^q2>4?zl&fl*@X;tNqSEUt;hbvH0d>C^!P63`M}gCp*G$au!Zo41f{>s0~jSN*o;`^ml;zQr!m$RPL|) zMIK$iCgCy)w4b3UO7ERl{jV;73>4fsY*>&y7yN3b@O(iqb;;RoRZk0;eN}UN1%i^$)i2I~`*$BkMW#UkNP>YH?E+LS zK6rt~G49ZxzWA4bkr*P{_t$BZyS}9gvW;ch8oUFysEoxu1}UU(9*x8r?(_S&9t=<* z*-Z>MF9f3GPJK{kN+Lv4N-4mB#=J~tvZj~^l-)wB*D?5Ci0F$07bBeGdAsxNk6*c_ zyK25)X61Hs5szL27Q=4-8N>Vc%BMR(W!f@2h-vn8k=>rR)q?9##-pTvNnz=4gd*s1 zjkF55Qcx=tw5dSeJEcEoNYB8W?3myC9QjIN@GVB?3x&>s8;|-_0va25iV%8c7}2E- z7F7d-S1{Ui9uurqL-;C1EE?Yg#3msT25(Xlkoi%3Aq#df(7Yt@{8*{1!g_U4bE;xo zk@mhYo}nbE*0Cs-|EQ~f%e)lN>L$O@Zh^9v8R-q!q>^kHxn1!zfI0Ihh{Tko+>lTg*Gu7FvN< z>@`YR-Ft34N?QBh`))|qS`F8ten6n^Wry7ukw#rA3?cmS>i@e&nll6tefK@O?$xJ< zRjbQGD30d(?g+H{_MX}=G5@;>g?6V#NMkTzKlWov&bNsgGLKx`sC&WwoMSus-?U`S z*?V$N3_ciIHMlF(tz|v0qx(@DDg$YAq$KnofcD>8HHm&ff9{boDK440P-kxV+T<-Q z>HqyZtHAS3d#FeIcH#4$alQLbi2T}Zg(Qj)js>#{L1~5(+)X_)57OoDCVb7nnJ3*| zTI&yPi1DH*AdvOe;AJCKk+$iiz%LPK&G3C9Pj=Vk=p#IJDky4${F47TeI`%~P2tO* zTKaba=K@>$rCisF#;P!SI>O{Tj}iF{o6Mcu-Pg%&kSypy_HPV>o$EfLOxfJb?0qPl z>2W?TY@d*PlaBVCe=z>m(D0pfrm?hSWVE*|6EPztA%CZFSPo&>w0)cv;H>HhQ>S323JGl z$-bF9Z6@eOG6`;zw9w!nRhA}BDW}%xp*E!Pr_xN7>(9WDUEDEE;El8++EHSyXrtUL zGjE%!2(uKl^h-wp$ml$*b_aFk?$6cIOl8Zh$k8_Bv2c{Pm8aSR?n7{|j!fCx%!gi` zp~r{2XXn8Hm?r9@1Fwco=i3oik+Cf7K{lc?Bck-MQn>#9yD46VooOW3Ft}9jU|xBZ z;5&wz8U8)oxb#8%WA)Tpt-Y6cDN^u|Z*q`*4`>q&!kJ^~Tpn9Z3D$S)KI_&G7xwl) z6V#!c=ZfpU+t@jV7eyK%y|JNwV{ax=LP1kFJL$~gBQemrZf989GT-3MG}G0ZFU5~* ztMXU;)pxqlsr;Aac~5N?pZRSqo$4k-9U|>ucc>(Li7w|cU4%lI^ zKBxiLP#8tVcfWzmOMI;;-B1k+cuoa^{5;CLl-`yR#r@B(%)%K(F)Y8FgvPVo@pfRK zP~;5YD3aNHP>?|*7bYPF8?ul&P36HtJ-tUB#Q{`g8-F3_FI5Blz|osS$cD_4`Wmty@gl`qLm>M zmb`sRKGDeb%FVZ*pVZ^vo<>fReYX>(r+~p_BAHNmUKg53q#fa41JU)Q_5F#K3_$yP z7eArDQEafb(LC0sA{)M6i;u><81Y9qOMx&EpEBj;;p}8$ni-AIoI1cGbP%E$VQ`zy zR}1yG-*V_{kS6B8wwTG<#U&+S6;|8V=Fh6EtmgN*9#+(o`))ak&4GsM%E>TV=+%cT z%Ar8i@IpLtQzr#mKPq+6^N_>+(eKhPEUJohn_y{7juQ_!Kw7t`d! z_mPko^Yh*7tmzCxC{EH>1;B z{#acCN%V-`5;M*0MNHn^&@hI>&t}G=Xy6r)nL*P3?X&6WyQ!$Y`1PpnL@neS#10?1aSP27fec!Y?jr)TK6+)x5On3rnp}AK8oJ!*pe5F z=Y;lg6CpO(2^olH4{v!B%pexo`HS%~Ha7c@4|hZ-sJ?xljS51$-$Y3=*^p6JmM(hL zf-v;zG5nLI;TdKH>lxKxCHs7=nxV#w{LA#=zzM;z?34Jk7DvJa!YKu+v(^{aC806q z3}IuT+jq>$n&u(MZtY!)43W|yUr^|onbFC38v-`@=iHtci|GQ~k8;kj`!^q{=XQ|Q zW0C@~vrePhljCGeN|;B-TSrx%SKQCq{L0G8f&v&B`LToWO}`Li;8rUT%}g7@@^0ueoc^YIWISR~M0 z)Li|7Q+|2x=3w&H>|uQefBcBj$@;rkMJ|u{n@rC>4!o+#sYe|XmJl4?Ti2|KHQ@Q8 zsvX0PU4D6q>iRGe1k%*HT=#?f>1!r-DFp(=547$fJ3+2RCQnoO3bHdBbO%l}{ zEiAUd@f{D6v1{>>>x-DwNNiv9%?FpjbFCt2RF3v$pd%SEBxO$yQ0Z(i();$OW5r(s zZ?-%Ujs=vKt9>)1$Tz<@DHHWkuSYhs-0oPI?)RjZMYSkm#d{B0f0c=0FCMMshMncX z*_khWlE9-g^%25Rt6XynCt_a zJs;>$?t!`~=elRyHi#$ME!rxM-A6isB>F1a3SlCehvi9Q@uw#+HX()~u`}32yiVHd ze?d1z!A(KUMJVLc00#xXKLb!)d7&b>5|SKj6(Po)xEUHYwnPK-C?W=3E`MI2f^PTAS!p`n)Va!=kd6?n#DH7l_V%~0YlYhf0a79EThBNy6oD%3;)mn}c z6UTF!#tiEBJJ*q4Knm0qxE*9NI?vJ5;Hl0UrlYFeANJ}EnU zPFn(znATvk(0?dp6Q<6I5<+{H-2izv(aRW|C~aeyFpoLsJpVVvk6c;AoJh7s2QE=i z-`nmd`ld#anKH~2l!P9`JWc}x(*Gg^4%>OEkBAWGT(kX1&<&D1Q)y$1Aae6!A|Zx5 zGtB&~rDO0la5We>^D0IyRc0>u^y!|kjl7qoDJSyf;2B3u?SXm6OGpNfGtCs_PKNsK zrDdzwp0i?zNlpx1MR^w--r>B{`TQ0g;|4Tm?0rdU2Hoe+Pp8Ok-b3}) zjr2dxzu%NAuKMl|U!-$|-}(NOx|`bjc>8qucv+K7{(&<|DeQZgrXMJED65=co>%3& z3^}OeOI&Y=AwC?0RPkAv1O`#+o9;$zKsIzjkORMQJYnyANhzH_O)&rP{%XqIEf4+w z`;V~+JXLwd4MLla- z{P{aF8y+{LOM%rs>E`R@KuccN`rka(R+Y?zEDW=k z!C^ek&bQ+d`*fpfisI`k48H`o-rRjVl_2w-X=|ElX6t~*n&^zDCI)&cCiV&zzey9~NNJ$C{3la~uWgENc!0ugVgN+9eeBR(TD zJIVYFBJSUL_>^zp`rNCOoObk{illF7KyouU2JIHHuNX{)gUt)wZM!#zI z+@J3Mx2z7c#NhQdO=y$x45`SfdkD^^@K$Ehr}HfhV~fkuC~FwVPO z49D{S7SDNmeay<~)OocrITHWpo6(y;A;3f#1s*tk7K0_9@gmv#h{lIQwQQN`I3r~S zndAA!-K(UZzU>`3?0ZPO+Bjn8QlEr;UhIbcTkwVHX&=oV@m`WcXIp9%gPAq+6!bM= zI%}&Rc<^MO)Nw5}5~+IJUvt%u-J3=~Js7xsY2v_t?bf4!arF^=qL>H-yl6s+t9M+1N1H{8IBm>Jv`2A3nqVx#1)2CW?)o^gL zNr(|gh!j8Gh9aL4`I#A0bWd(+X%n-=dY688%urx0b>?N8u@Ssae9eJgq4+B(+88bw z$>j?f;~AZp{o7k4al9RN0r0BbUN#2A|$FztfB9o*`s?XwQO%e)>!44crRtR}jLSn^}!ZVra3WB{ei=e}u}k zGdzU74Qe5F!0$R@-z|@3cyFuHg-WaLV(H6SXggi)5sChrPu08UIdX-$Q{kfpdjI{o zV%9Hga2G!R>)t#hIE8N!%2*99Qtvwm1R`0eiYCH?L|QGBVcl_c zVs?4}+lua|`;B|~Ub@CxKFuQSvNk)A^TeZn+^^(^Ct>1jQJ+P%b}r5Y39r4)vh139*wC%BI0*`t!3xwq#}uh_Qs^jQH8%uV0p(;n(LFG zV^^}svkb!l96^AmW?h|{Q6VBQkyNZnR+}FI#DoHjE>hcHo~UlWRsh(Vq0zE(bcdC_-fTf&LkUSsj*r4!fWV0p*yyC zO7(feAt+@o{TaA-GBIQ;f+|HpIG7To3M?Xj=(f7le<2BUWUVQVqqP?OTZnZ=k?T2ntnSqOLJ1rw zJ3|qPPA<8dT4esLImc5HDPihrX_8d&dmFE=$Lr1eDt?r4G-dV6*%tbgNe2{A1fyBk z1VOgSma^^Z2xn$-mOShwNXMfo_EV^bD&I`DSH8C@LyAV4&Z4FkzHR?nSCIT}?(uo3 zd4H#>hWBu10rAX1?M&A zhxzk9NU06)49jGt&VKQ4i#v?m(zx6F%l#CM`1)e)Bf`nIQ%@^jKtQNQnZbi(3;Ng} zCkWXIKb~U@r{AB3UhT46YfQ2|T^JGgoeU!sW9*E3KdnApSFDcfolhQX)#!h1vL8OB zzU!WhdfuhrlicB2-3mAYtOFP3st|<@?+ycfkGro{?kEDK#X{9i+XLIrgrp)L6LU zzDD@^qHVT9WU*~~_%HPmb&{>-72z}k{^+keH|N^7l1lGZqMGKmaF2d#sHEws0l=;C z7vDB)3b~TFU^bG$H8TF0uNsou_hNcfkf|CvHj{@D=)$a%d2B0 zCxJi9t$l4v7r86L{w5~7RJ~!3yW=;ONe+!B#;KHw}U^#dM#Suee23y=4P5s zeuj$Zo#Bc33#uxs1P{J`L4#dF{#xXs9T?CmGWxD6@26;K5DB@o9ZYnxUH##!^Z6zaN<&V=Wo$f}+()^lBm%TOKEFNf-a%)zK*w?MWO|%82Qb z+)9J5e?KG&>+1X7PEXYr_r|8x=%1bvJ zZ3^M+!f{E=f1LdiQ|FJ^jk{MFP$vMed_tofk;S*A>Sp2Hs8= z#09m}9+zv_3EymSHsqgeMcZ03GYi72Qo&nkbQc{8-h_6&6m)aTZECvs>palcZIx&K!teLA;|EPoZ<|3OoWS|K8UKwy_m6q!k-mnv z>c@k_x5|2N*1o>Ey7!YGH?ltzFeB(xc2v!r3hMILndS8zTJ>IS>z;j-EafbnfDDTB z=O|m^gBUa0|W1k9xc#r7IrUfYs+reodRVAJ4H~)-`RV7*rxHsAm#tN zoo+-b62L)>MvwhE6X^VjziE5yXA+MaJ@O0sC@Op2PS%l1+w3>X zJZ8J!IeCgl6JH;+sIMdHhv6#_WEYxGHJd7sy<=^0pDoIRMxyI$Jbi#I9kjtrdEgqW zjF4xY&9X(6uV1-!VY73pD)VID_(|s{n(=a!v8`hI3zuYVRHZGry0bYj1c_W-56m*J ze-Un8=ki7SDgA!$Ol3kgePTfIQK(v$X4_LdM-?%>`VO)#RUuTPtg3UI{MV2+@)qyU z2;-vHQzfi-@7>EZ zlEhuu=4MATd}r@G7_iA*G=BLJnNAJ=Ub~w%y}FJ@dx=6|eY1hSgvKtZSMV6OG8FtO zsl*9KN%#t`?qk2+z#3Aoc8!E^R;(w>Yk6Q39_W-gW`Clyq6@8zQy|AWsUjV8)^}xm z-zFL7u$qbJGx9T0S;Tm!@iE-@uiPa%gRM5PenX&&$wEiSckdft*E6r3kzbR6JDO^S z0Xp4k>nrLuUWSuOA`auPesR}sK}DCY&8REyD22CpsTR^*lo(1yBH;g)-{dViyi=6w zHV%9$5zRGlOP!OUG6_(0#EQ>KjDUqxE5l9RQ4>YWlO&?0vs5X$-gw)AFKLK%`4HW4 zAcjg+p(!d8s#o{6U87Y0h>Btx8|Y-NH?-mKbhR@na?{GZk;P9W;kdL%xzlNRi3P>* zN?3+0@+Gh>D_lK7cAU}RZVud+@;mTx(X9gMSxY%9j2Px2hmdJ0s-26~WL12)BdE|s zCYq|Qwagf^7qT!GTKM|}b+!fi><*#VG8`1tFj1X|*mK+{13zEEgaq~k*_xLUOCfdc zn`xB&?QHA7&o_WB#uQY?6x0zbqGtSx>4|cXH2>#Kv~i;K&!1mp1m>rC|0CRX_?7ti z@@fS!c)nX3t==14|C(_9Rr9@vZwEK!hCr2VWhvM8f-^)R)7D$$*+Cs}3!s@a4FH(q zz^6NBvViM#@`pVcF>)j}nT1ev^|Z6k2C}BtfM^$@EGxU2VqRfS14vf!M*~4t@Bl&>7L zfZ+ZQdO+%e$0LBAbLy_|r*>NYcJX(6xcAF@+CH7|{UIPM>cw$Ww;yER%rM3SSb_fa+D;)rMC3s&03u$0irB{RE8;3zt5!V!x z&h`zoI#KXhIuu)gN(Ie|%Nf(Cy<6Ve$_gKx!|L%L=uN`ZwJzXHtXM3Kh~31B+2K~rn);I9ldY8C4m!|xL z=_<%OFpCZ8{Wj35Z8L0x9x?6)FzDa>HQP8rvhC+l5ih6a4wPbCT{Ar^A%z6)ZU_$m zuQjHKuKB?V=J7E?(0pnExyN7r?Kuu{p_|S`+Eic?(1I@88pFg3UAWCmI}9Bw8G#AX znzp~lzdNe4y25e(Eu*i`PbMOv0ZBS|xNNn^YFWN~oj%&A+Mpd~>q+X8|1chQhmNR> z)lZs;6ZxVaWt`ARMh?ziFoAl7<~3}<(lcAiEy#qvK63GUNz0T$5-Q{fOb2Q3W83SE zCD=R}3=9div_?v`6Vhr^Uf$~%?kUu8;44%ul$M1ecG8er{Ax#^+pL@`e0hGlgp|pP zC5XL&sT<_hxiG6Lj_w*=EC!?y3>vtRp(tXCDe2N3XWb?j7K(4BgFa6~s#pg80)J4r z5Y7TR0LPK{AOdWSzHaE~nu6_jsH+C{*Nuu2>ohR?BfIdrrtx$TM#c)+`Om2&U(8v2 zIt!hY8~@)68}i$5CKt6r{|VmJr^l<)xPACrEsHM}KUIkS#z?Tp*r_mg!R||nv|{4Q ztVz~S_&mFc%|=A`KLPfz{L>=#5`_eo>-1!VCGP|>8B}-BZ!j^BFbs1~m0&^I#flc2bG`nHa19RsEnx_RrbJ0Uq8-i5y%&XIQrif ze=KF^0Mp9ywkPwNQ6^x{ajhghg(ze;^CWG{pz>kfz~Q3dzT3mpv*mbqVjMy4FIL*Y zPInYGM*C2>-)%vc6QUt&>%+FG%-#F=%Y~6P6jQt^x`IeFd~Uk;C2XVU1OD ziR%JiY1{!i0=u4Pm1R7f!@7KOp(t_6>$gyYumaZbbyf`IL#D$+{I+LQmZ{VdEt*rG zq%cXo;?;%$I4o!l96&KGdTz}G&yY%m;Cd#52&yDBgBXo%pd3N|_zaJrn#uSdURUR-tP`wI)?+nmuhB(j3p4YblyW>agx%zs3@7hXn3fP@2XSmA_uX%YARipcq^VhvP3^i+odR>A0XgM_w!5 z!h#|r4*N1n9rw`y;4t*AgN6JZlGas)MOGb7a|wTHa)<#G zsJ;Y}EE54OcGz1=#|Dx;iitixaZFN|jUlPj%0LC73tvLw7`HH46z7m^fvy>7bOQ;@ zDAYZGqkug|V*_;PZMgKvN$kQU7V(0Ee9+b~nN{)^;S3rVA;}>ODShYgqsvf&zyKgH zx3IKJs~CMsHlrsfg;2O40@}FL`BwMOWFUY*Wk1DT|Kiu_3oYO&bRfNc|HNi(b=74&uu%v_$g&ew#)Kp|iaQ;zG|FXi?5UETU8 z#5gEll4!xT7yyK!NL`P{5eJhyds<%3A?NTDs#&TAFG^o6j}D~k9*nDg({6>*Nc&Nq zl$$$F2#fmZ*^F-lD*{eWH|S5H!-554;Ur;hHb>51fHi#VqrX>YTcT5&pP-hsfTHcO z)LpQ)eKFiZkOLntlow3@_3hM*5BjKxwQ;>fM^m!tV%=J-F>^>#J22zY!xSZaoytIj z;#s6KA!zZElbYDtKk{yim>|)TkRrL-Y%Q@@gj(#SD1R?P+VQPnXl72+?6!td3%h20Nh@;X(jfvZ9ia|U5L?Pb_vE>#E&Q~HtU zB4$OVQ0XewK*Lw$%Vr1YLlWj#dX|XO5>o`T_B(Kh z29QXB7#O(BxDn~(f2aq>gVMOugwY`!0^x`0w-_-y%->D6voS$pugqFoLCYNsP*BGy zb6B9|NP;?jnNQu?6BAbeSZo~M!dzGKcWcl>P7ySns0wm30@zSk%grvEnADn-v5w(b zKM!M`oh&C_pz)RqbZ4U{VF#miVkgmm!znACUy8{*b6iLN$xt@UBvy}$C)rSpYWq%hN!4=(A5x0m{Arabxe+DwhL|U`Y~%?nnrdNmf*jZ% zlnTd0%59?%u%%POUXhCv+kbUfUVE!us}m%M@V*!Ik2s?LFBUjGSrxP*G50joR4j6e zK2<$^#lgxU*s%I6AqEOvyvD`%SXf~x650;HN8NH#r!T=UK4Uf}+v0PXdwdJmaIA--;(7zAD$+N|gU4sl4$?Dr5d6IgX8PSDOm^b* zV|B`4DPoFOgH#dW4of43e*oU-ceko3b{B@{G02O6noMpDc#hLJs-n~jnD#^ghj4n# zPW0a6$$0epJ8&vHz&wp3``(@3DHCi{zt*pUI0=J1DcUlnpjgVMQNZyW*I&bOJUcGL zTm2LUQjioW0)Pd`T?vY*s;Yt%QPos=4vYkb!eXO@!y$T}(it|iu~gQRLQ~s>A`C}D zWhE^D1EQe0XNOff%SaT^N@Usmcz0@=(4|^U5v2w}cFTMxtx$J$FdGZsX_+bL{TBdW zQf?_amVrsMM3dUly;+q{ri3cv{wN3;Whyg*zUT?~gFD5ucHy%`}jafcvl_D4Dat_pzT@uC1{F-qTg7_{4P zAv`-U*(S`d5RB}MDkdIqj{1uJz{{T;soW-cA-TD|H`oVALItt#>zSCKNL{R5=M85S z@y&rNQ!Su|OD9!;7K#|cw1}Or&SYlSyt_E;XR#EHp?*!rIITl{1JF!LmQxH%vcqtS zjCr?Vox+@;FqPmn=&b0zqY1OAlSu^~9~!k5Ixr~Gc}?`gsFxOl)c7e?hoAZDNlHKh z#*;$MGyNOpTLmJvody|Mjt!ihCn_Z#P&@R#W7uz~vxAtl{)&Auqm_!8`$MrH69bREc2JVA^~j?T(4^p_$G`I6p%+L=#c6ae#nT4b=I16N8M+-D`-!E(E^sx ztspi}$7!E(~g0cUK+o@rC9P&vFDra%obd=>*Q+De&VqhjG@$-soWyyf7 zjt}0~?W}3_Lm-7!-{s?t?~k+LP&_<5<|}&N^c0NDrmIiMIIB0y(LYc3a=A%JRh+N& zXa(x(jLv7Yy_hnL(Xw7;y?^xM(I_LI8kxhs*sYUEn%Pj}qyu`WX5miTpw_tD_!4x= ze$rziqu}k3W%Bzq#PM7025T%Ww#!r(Y0l7g)(Woqn60~;op#^-hLHL2HLIJswX z2r#BtSSicsAFYzqlG* z%Kq5?)e9(CIImDyR|ISye>4dvps_XcA47tEmX&nBSts{DSG~Il&!VWK50SyvWAHYP z&U!EVQpkr3!LXs4X9kw3+x*jEyBXq4Auy!|Vr{#(va-gL%=>RI!M2iFZ94II)g?&eal-W>ZXf^1PE7V}c&C-c3gz+%3~6 zsUnmqnjS08(~Y#letr@e1^-rUEbs6vxcxYK`jZwwix>%Nv^gzSqU&0GP7cTF5X+&Q zFG6hXl}4v4Kj4@CtqTS*__Hvg@bEq|Gk2geyzhX;*t?QdU@Ab#2)h6d9HPk#xdzU| zubNQFg|m;gG=3$X?v&=dAL#CEc+SQp881URf%Z{F!22(l%_a8}ID(@ke4+xX%O~I& zZDPB)G*u{8X*0eYK;Jv0!x6g1v>58DF0*MRqAZxP9i>6b3;Qzkoj*R zC?KgTRyLf>#?(V8V0Lf;zlx50pK-}*Xls9sGgpXPoh5~cuO2_;o% zyWSPP_^gtvH7=U6KqV`Qr^& zX_fC2!P>Pv0Uem<@rnT#Wtcw#mL6*+a8U>555|)gcNUw^-U)J8iuZW}lpR~=qfcNm z2neWo2BN=A$srW!9Ka49Xuk`vgf48bq|ig~k*mb*L)XI$qW)9w*a8B8mH6cP_#_ZM z_2b9bKqry6_h5o%qs{aV(C6;H|Nep9eBk}_(sLDM(`|Sw0|us8JE<5?3b^k%0}8%7 zSJ2y)1z+#Gj|WgktnH;^KNk>Uz)_jhR$~r~R#|XZ{`Llsf`yTlRT`ti$r(L3G!(Y< zjo^ehrS7;1juTv9s}w$5N|J=5&_CVe04R<9pR$OA6$wBA|MzO90QkWFNX5V(>mh4^ z^7!9ZBntRqTd_s?_t<6EW6P~`P7Du6XBRK!o2pi8iyGW(p0(uv1m(|fDXDWcOAQWI zH{V7rJ~pO0th9L??!3wk{Nl2l=3n&kQvbvL*@b|JPV1n2xca_!j+hh`7H5r}GHoJ> zP@~6E^@SvEk$|vXtM_t*(EtB^x70Kjn*+xCMq4#&md*#$zUMj#-QE;;zij-i*J|?+ sG3r}Ac-~vwZDcR}cRwQM#rRzyv{0Jl)~Eht4k+-Fl~R(d7B>$0f1aS+82|tP literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/run-as-admin.png b/windows/keep-secure/images/run-as-admin.png new file mode 100644 index 0000000000000000000000000000000000000000..f5166b77bc52d4a9cefe687f04e1bf66450137e8 GIT binary patch literal 29080 zcmY&7cNrV-JukBDDD&}6nFRFQlJEPiaV47MT0|;0>z8F6I_aGaCg1oobTLq z?~kmNtamcAXU~>rp1t2lRb^QWR8mwJ7#Iw>PtxizFtGX1@7Kt1&~L##D!tGjut0TL zNtj<_&EkeSm?fjz@bmLxBE9asH$Sgn_~AdHuj9vtW|JzreScEUT=#oafrU zdS78&UUSbSy39SrJ#|o4sr_{Q*S@mu=GY{_r=oSP`>wa${`^WVKii!MxB_6;jq<(N zl1Q_2(H*#r{cbSq$vKh)FF0|3|7TNxh~2Q!_wGHP8A#Y8&f_z`Go&Llb8bXvXE5mf z%+~mjmx5j;MQB~EeKz^+T)=(d;BN}ABgw`eS41wY{w6e6V|X6Fj7}F5+YL|unY8sr zyyJ0$$lrjXi96(ijp%U((5Q|)`nq04!wRYnW3s%!M~CdzZTv2lfZN?o(9>;e`=w)* zcBCl~Ko3Zeh$o5d^+IYtaltQ7z6Vh~SD}lwuiuRjuaW--8pChEy$riQo;-VKIyYQi zY*O8{Jy6}YKZ64zM{n98N5}yO{QlefH7|&L!pEL03$>4r7z_CIAuYpOh<(Zt|ga`(_3XOa=)8zSPJ(JXXQ&jg^Ji+!QVH>Z4Zuo z0^u%QOtfFU`AUj?o&rK;;xO5nl1qPAGdW`xhNOzeKnxlamd7q04%(kj9I&v)a)TgF z^tuBN73J5Do_i1A1IW!|Lp!*q{Y{3)vfJEDnU2?-=_j3+jP{8m>Q2ENm#QB(%uEg0 z`@3k$$KbXn-lxZ$fLIxL_Pnw9P5w8juB(1G>+|Uy3pLg_E+cpc)Oe z&J3s}rewJ)rE<FXtAi8j?~=q0!H%O87k_T}YjJUZ z&yJ2H3{KMa7PLf9#tR_HsD;BjV?thB>6OZSmv-%*ZZ>JDDG|X0JSFT{2M6j+tqp%c zuG1G`rte9PG@F`9{%lPcFRN#2;KrF+G?WqY{TF{4%6O@ld9XWiooj-~E*)0W8GQ4_ zlLG$aaNXmt$1i8PQZ+WzbFyi2nr}>{-ow;;AeLO$xrk*u?4$*~AKVI@B^`7D^A*~) zDn||Dkh42nIjEA#d1QYU5)5d9ELt7z=&&h@!HD(C@FN|P#vToruptijidB|6wm-Q~ zf7RB}v9_|h?C#K~>srW!I*jB~EjIkhgTje67Y(<^d}r3dLv}ox)o%FbPj_Mtv?Yq? zHO5KCdA4HV?U6!FJ|{1n{^KUirw9Ai2zR~slBYpfPare83& zY`#})B<8%g-2qIrXec>c9dPT#A^P*W_fvRuNMWA~^Um)llXN&uY0}SVs!A@?*3Gyv zusiS!uo?%5iXZI6H;($pS0+*qFNuuvjM zfOU5Z?o_(H@6hCV+eBV=+;Dw6)kNlYEf`De`F0aoa5C`UQRcL*MMf-+Zpm^f+_)Bm zjlhpfO{W&NKFXM59V>{d8%iP0o%$6r%?}b*XZHuicAb0a?F9{HIL%rN{G=9yt}g3# zOew-GGw)c3Nl@NL&zYF8teuU&9EkWM+aMK~K}=#{Z6tE8R{x&!y&*EcC5O?{_>B}y zgYl|3Kf05OiNz$NJEzYUPu}z;R}Xp&w=(E9mWBf4{(2W95{G>!aL($1pFsHr4=U&9~ehPV7S2z%A!{r4yB z{bTu|1hN}=(ebgkQoKio`j`PzXi%!vf7bDwYbqwRyq&lgn{Seml)r*J8z-a1<2Gya ztZ@lD*~Hd%Ue08mYnt1b_v8KI2;$OKzs78fk|-1R4?s>Y!equM>v2wSRHWC5MHl9M zuL||w#P%OIDZ5wHp)<7xau_!tEhp}xl;O~vteez#PAIuNhpl9Bw@LN+Fe~9Nhk)77 zkjHDQljWm^RsVyEhHO!v>!J)tA@@VwvKb-gwZLb3d@NMUV9@hz9&xh!On^3cn(z$%oxC?pQ+jan}*$*3L#blo5)3cTq{QV~OeXTkw+P$@KB ze*HoktEe0GkVa$dKlZc0x3Afj%^+*`y!=xN}9y{?@c61`MIHSnnS{(64vq{+Q^8Q;q!Q4B~dlMnP z?00YgnxpxU7IbSoTjS5*5zQYHkJ8ciA{h!J``*=njl(k<~ORFF;hp1c_=Iq}G@Or*TM*~JIh_cb0)qn`+y0r>| zurjh?^pJR0bL-<}Oew-u*uQ3LF4>4F75FXrA77-w$2ZI0Nzj9^{7-`)*R|I_1j$l* zZJqT~wO@=0dlC1XCZzt}Oz8Efk~SylPL>=G>rd{=FFf@u)an1>ID}3Q+lCwXQtTpS zdJ4iMW=#yHjy_ovz(_uu>(oC~q>=WNx(M{j@K(3tL>W++$VMDzZL=qz!eezNTUmmI zPV4-KH2c@RwcUE`=xJD=;!aM|WOzZz;$>6x2`^=x@1yiv4$J=6IbC@h+cq}E4HSg7 zLu8Mlw(4FMbOLTs8D?lc#95SAR+_Z=-c1%Nyy7#@GeG`?1mn$T_^rZ2foUDCK0E1? zCHv{fEJU^O@Xc(g^=2mS-9T}wo5%5*ZRq~wS~uB|;Gd_-BnekL)x~T!`XVP7qP?gL zj~9|!Gu{WwNf-}}d-o>`AG7qJa4+kJ*oToDt^645ntl zOZ->Q<70Qze(%r!Uj7x;m0{!fyVV@X|2UG-!QXmEE=fXnOtC7D+0-5Ur|F)ZU~o51 zTKg6w0sfd(5|Q8Gik>qVYiqJvCkyc<1tzZ5`>J#Zgh3!#Im0f|&>Vzx0Ek13;hpps zT$cqZ+y2t=sfX^3Nrq`%d#|wCK+b!+Q702fnr2k#(fo#BdJor_cYQAD?TikoXt;*E zhShjzr+=G=ndWhzcOMHw@U$6!x<@pMxEQycc!{S7X0^l>@r|R&N*mSFDbnPAP9lc= zLfRHALplcY;DJkc%T|!l%Zg`e4*Lq(R5aL^(KrBiba6TfDgokX!*{faw`H`Mp@vln zA8Q;6_!jWL3gs0UhD@Vz$X+1U@jYaXl)zw>V4ZMN^sser=25R8)Shp7wDu#qLIrEm zYvibGIY)I^v4B^Jzq)cujCz~>?g4VmX7$7u%iJffgE?Yc>&;I)o@X;DopJdNCT#ac z&=7>0)`>6W%6To_&FIxYw@|Iw=)gJW&h3Lm(6>p?utg=QADKVCqF%pdd_pPZd z5Dv4)2L;Vbi3`4~g2V~@Z$b!x(+fYm$LcTY+t0=eP~N}WXI7xH%QqD~*YSy?J1Bw< z!hO*YAXT!-qGN~fuj)J)e}=>Deeu3xN?tny`;*TI)iqJC-d!)^Y$O~jFE&Tn^wk58 z<*9YqLU=%&N=z+-{-B0s_r)e4#Ib3cP%~IZTRSgeNBS;)^-lpVC(hvVJpZBX=nW>d z&5~<&7V(+LMO2$TWMQa3WD;R|P&8h=vSH8v_`bDl?%?9$LiB_p6Io~M#*%ZURVu>A zV#&VEj}fqO!yeG{llBy3S&gQxP+fQKd=mSb7<}o3{+uj7o9`z?FUsbVsEHz?wOWxr zEcM=ya^(z3u2k4p``svyk@27qTYnSWz~9+DO8W7VVf?0c+Ja4y((r5_%VdJ)Lvm<~ z!5rY>IO}nRA373uw5hPsL@|(EAHOa}=j2!;=sFw+zLfQ{{~%oaoQu!+9_vM!4rcXB zzk%0xgqYR)SQA*Yk~0Et(!=}KfTu+3_9c&dKQD@;z%TU41tv=4zM3-y&4DrqY@<~e zZsu;m&L++tnk}SNUo#LkR;XbI`2R3if-dAb1n@|INYb#h=to(xJ9J&q3m|@XB00{Y zv{g0kr!~!#<0jKo_jeqlMxv#<{KEfgoiZ}QGF}vmk^bhsG2ETvwVWr?7d&bKv3*ww z@aYXd8DeAHW6p)%oT>sgp;>7cntOiAh>{RFq0gw%1SZ5-hfW23THDER3ae0mAH$t{ z4D*vS$|u?N?Q_%RQ5O^=*jm(@f1jIxH4#~*XiF9uiM&QxZ1k5{mZ#-Drl3N5%R;-j zyK)!mC5|;FbeUQBMYMZa*#D*BB4I9f-9!B0Ve+rl0QYVVwg)i0bvMF5`PS{;uKG^Q zLKxkPf)u-nyCGghBKMnf*&wzG%96mn72@FH_U7Q0o6XuSMWdf#0vt14qseIb>cCmY z@0^?IU1%zRMlVq6Xv=;6rW|znwA@&yr>(dhYSr zJhdtNua&LW=}XId{GZr(CqUR{QW=7{$*Q45Jf2<}xgwA6!HDNTV9mFBkKYPCn13fK?5r*MQ zmG8EIg{#px*kq3beb>~2(*c_JPxiE@mWpp)rz+60Jaxk8fl$8aP6(^5Y_%pOgY0v~ ztzjvdhx2V7mW6p!2&vziH@~ek$4#&vht0;~0lV~dYvg5l?1?V|l{cZOIjnmMj?>up ztT+26Zu9OJEW8ZO@BuVGk+=pLgxL+b1Zis!z{i{S4<#KS^){em4rGW@|KI5(&rf?! zD>-})W=<_EJ#MIz=D6OxZ7%7L;hvul6bZ(Ro1*FJXA{;!15bBr#0HDc2-&O@Wxra_ zmK%DASi0JB^BGk?bSoViSDG{8MrdO^j|VJfW@B#icZcpVf= z=RO``{Vj9B8H4}@Jq~g4B+<#M^0fj{8V|~IA$nM-?Tq`v)}2~>E=sw+sBt{5%E)M) zJrSTtC-g3eTJ;+EcVEuGcgZO24e{UEwmE+A^L^_-VX6NQU9%L8!Z@3XPp!{#W+6#Xv#V<>rnp;lc?1pzf@5`kH z!PJu6VDdu|==t`r&M(76;dB zRj4EM;9-oz$mSF^WV3rkM%U|q5BC=h91tUG%43)M^j{GF^y%j%*3_FO>!79v=L9FW zG<>_z-W$#GMRIefImvM+J{P)&=Z`zVL|=Max*SQ|=JEI!lkZ)B=B7DQ6q{_d`&NU? zX|rh)Hd#Hme8jZ>e`omt13XLa$H2lMT9utE8~zU#tJ+MM<3f3rD6U>RXFXbpD=H;y z69a1PR^xh|NRMan0j&A;c>nEf=aEj|FKFjBCoNW0W5I!98=mU6qj~k|*pU5ZQh{TT zF(|uE664j#GMvHe{|^G{e0g;XJ1305z)mt-pa;73OV5+YjdS zo^?w2Ele4??WPEKPAjC_7hD&zC@ZC&VvE@ab8h{QJ-O~|!@g{AJWI+%M)ROAAunMD zE>cE7jF4wUyNs6{r>kM-MNhJ7Lt-sBry;U&1%4E##R_p-OEGU?UOLbn@(km)@CfC+ z^Apbvcu+{(3|YsTL%po$z3MCxHDc_d?g!Z|9_5$V#(e1ZZ)_p@#87@}Y9uVVKts+u zxlu<>)vxz|H@S|JeI_h7p(Wu*gNYxX3p_lQJ#TW-PfNeFr{oa4A+1G(pZIU&=Duxv z_LmHjTcZT=jh(o8!KFXrq9pi%GP>7QNud6te7)S?K<=O288^Zr%N)in1IdBMQN7O+ zH%DbfT|F^LBD+PHf@ko`=Ls1?jf2)7MJOSuS%%=hl{de9FdIU1!HbCFHQmX8skJRgN{ey4L1Z^Ut`Mx);E$kzQi7j#kGt@eXp)w)Ji z__h!${hv8V=fyn}E#_b0R{J+e0!X&caZs){mBdGDKffm^RrR<)l<_I>QUEm)$GFv- z;O;GDxG5f@wPSUK=jy{se=ALMY&LdVZ#3d$_zNM1A8M~dw1^*J<%$B9;grvh_ZecG zxZK-f7>87+w3gk4YbrzGw_5Zt2Cx|sbAD*l&2ItoM*`pCYUh;#W7x*KC=2Y~ilDF5 zOAmjhAPa8 zB%f~SXDXhGsvMsZDI@)~ve3+TgZy-mUl5?$ZO!(`Mt`WKfl)|=i#n*}x^q2Z!F2x4 zGCY@yBy1bsC2f`~FEMJE$B{K;Cl`Zy-^+8rg&#jXeCaSx6f>5)DpN8lJ@b^!uJ%tf z0M7iHPhVR>`E0KOU6A{PlV_~M1yznicFpL;JLd<77&AQTeGXvb|d5yZDB7Si= z2lC&s54emyj+9IzQ)UnqyNXO*pe$Cko&<8Jq+EVsMY=g(EO4hB&BCC8ybBpSqrF}H z(hbWEf^^=rA@h5qCeF9~zP`n~BQX?FfRu{ki5Y3c2R>|Cp^u z=KEMfrE?5NW>$eqZ4tko|NX`^$y{K1D)`Uh&+l&;RDA^b<3xOhnL-3eRFk`!r`M+j zt@sA0zQ|uFN3TpG*r;@XCDJ9zh-uDP!t8rtcv`J3NUdRhFD`o@RGij(w~mQ3JMg() z0)?@~MT&!-_Tpcd(cMF-moeGDD!JpwK`vV&dHyW!)t@WSZo+F7th@V$Wx_O12WbpE zmM3Lgb|>@&qixh!oCe`e-WwWc&3C z68esH>md%3oleX{VTeMsRPmDxpMwSbeu(7opDCZsoj^*)LuYTr8%-*qSZ z!p^>;n@d_|3+6-FP4tfT`(vt(v@q)Q>ibFcC_661##H^P^`GDX^>~OI()`i);CEb$ zed@$5gUtz8lI}|rE!tz({7Rh1fgeaIWzf9GJt@+8g_R0|gn6(y(uuf4+}8sP?v!Q) zg4uF&-G{Uhg)zQ$hEKD*%PZ$|gas)jQ}Q)a;C5)+@_oG1P{fN7Hcd!z0>7ETCm&`h z-jYUD6~>Wj(^Z&QG3y_~l-fiu3OXKCjYDMDV66bXG@dg_!t zxxbb8=Bm&5a~pBOHVcW(yj0IsNN4}pPVuC@ph#)o=>=eAgp&`h)zyn|D!rC z-_lqiy9z*!k?T)a=`!(m@!q-)a7;pgI3}#$6)6FVGXN8#c*}%>+J`e|2{SiJQxHh+ zz}TP>P8I;)YA6aD_{ptw8LG8TQZ@tWil`+V2CoQu@lmj#=iiM%11UNc)(W3{N&=u{&_2#KKgB8)71r=`sp@_%)WfS_-d5KJ={^<-B+|Ub8gH zLbyI`1~ZVOg(~U`Qr#c*C61B1P`!pv9H)j8RoG8awyaoQD_@VM#W1&2Ca4bGW1iN1 z&jI&2>8{d8u`Ag*%lhCqqrR%c0% zR|qTzNj0(XXU_JZEam>(*-r=^w1i_MazGVm0fSBe?~ESbU`ghwSZ;$DT#WOk3eDDY zj4beGKc`$c{9qF}BOM}p>g|8tOY?L_sI|cnJN8rO zEGd(q^HS46I{HgVShQM%qC|-YZ&NvQz!Mk`Z4bvjx9j1F@cpKEeBh6xe3B~&rW(B^ zf*s9MZ?{BNXY>feF!9d9g7DUqL`D740yp{5+Tfq63@=loS6sH(Wmoj6b;o>I09)^_ zJciWg0G_mzzmG}+0)z!JkAc|j;t$tzVqb1l%7}x1TVRxCK$e!sm*HU@TuK5*{T&;I zJKIArJ>?n}t1NIKr?-SesEdxqrTZCy!%Nm|c4i`{hM^NY-%B zhb(^N7}jzwhONMYYd~Tx2uxOp2vw~En zR;7)u6TPm_ZCOjKs4h+f!}UYdOsZ|!=+dE zXo(pA3|*%R2S@VtpHa_EQilEBviaSc z9Lcpka|)}|_*!9;?JXJfR=@2BEfQw_n)tm?yXBdjVjteUta{_V~`cvDeA>*F|c)6VKpGT zhI_;3n}#yMmI{~BtGVz`n-?E&7w>bIAp|56N}e4|-^6*Z&3rS~KsR6OCeZ zLr2c8Zpe7QS0_=IYHhcgnjqfG^T8NOxthdQ5Cr#@FXk9~_;Zu7B17`O{9aIP5iLSF zMO5OU2kv*wFDj)ecZ=REbz}TeNM$!7l%VBn0^vFzFA3HizUei!Yr&7WnE{gl zRqz$PlEnI%3%)b2fFZY(MjmSi!ql^*yRdlNo~k1fW5eRXe~Ytj2P5q3D@LF249xtv z)HE6j2YkfecUk(|)f86&_eYgb8;b-I9wov8a8}7M~VoCfPM@GTbMnClT?HZVyU03!n%IspN+JCaQLe< z|JZa8@sCgWmAx(^wYxPx3}Xl-nHb28qstS&q^GUV2L69G9oTmmk!+EA{w#^9EVGHf z9x+p^Bdf(hbn5(G6ZREY{y+9FF)~3Zte^fNsXla{LQt;*1C2P3>w{xMtHLsrjr=Tr z0~Egr<8N7?{;5$`R#vEvLXenh>@9aZ>pW-V5h-*=zfw^0g`Xx6DG=7hNAo|UlI9oo zb_$nYd0*iUVT-C0B?4YfDvz3?FJ5LRLgN%ngA@WuJG;n<6kOFqQ&w%yu!sOv`)9Ai z>i&5_&!o?o3r7N)X9C!3)W+mp-OlA=eQFJ`H2maoZ+yivgN+%(GvOUx)#AJkFCo?Y zE&!t<9L|l}m}Sxh=BQESoH*rgqbAx#${lvcoO*Kp50v_4&p1YA^_X!y3)G_pS%k67UkbO7gT=%oeq|W zT$#J=hQ7zn2PF?_7?m5Nj%Rgq+E_gHva&VSFbn-|uaxhy z8i#gUeww#KsT4UOw9cB$G{^)hTsR7@^BnCj5E?`PmMSbI_np3-m)SN*Rw~1B#k;>H zAFH5m@n*IuC|}fbpg4sobX1muURkr1Eh21x+qPY!+j;VkXo_xrExL(Oe7zJ&-DVo7 z+~>KGQ2qEv`A!uE7dGk4J0sb424@(zZpjKI&hPuT@G~4sNdUQ$gxGG6-w*b@o zjD*2|+1;OfvuOMN-W%-x+-B>kjN*UUO@)5!fW-5@Wbkex6C|=W(l^jL8NLK~m(mh< zc<8|D-;vckHpuXc`yY73Yxu`?Zz!21Ui5k%dL6kf#4(KR1kHRtCdOrbO>{|%TfHaqnJ09z69C@U$pGB<={%a#uOaiY?b ziAwzhP+j0|Frowty(p4eR=;Xi{iBKdI?(GLj^$oVt&#Dbp!-N)k0^IfG+&L-o~t*3 z67goJe?II*D+zNx=i{*r9Ah^6&}H@nV|3jQK*t~QT$vj z(wPRk1sQp1uHC4P$U_LAlYBrMwawX=rx4|BAS)Tp|XiNbmXPj_B?T6_;}h$;wY>TN7= z7VNoIz^RA^c!O=e_Zp+kHp%3}LV_8p6*_m=6Alf~>#wjWizdxAeo_Enh`k}w(aSLY z;=dUiX)n?J>)#@S@;{OCt+Q`=*BMw+`kB&N4f)M|r9jx%s?V56S+oT_imMM6vX0xyMo$O_1nC5{PhLYD0W(}cp1HXE}ULc zJxcC%?VBYJpQU^(&R1q*8iP(t%dET-Ve0ywMqGkv*-a6LM z)8UC~$dvqrpX2;NSY=9nd^0&qQL(IhWp*q{ql>TAnuoO4K$-d@9s!#+m$1ebTORBO zS_ZthPg*v~6O8l>X?`lZ-i76Ye^R8l$i9%WP+y=4Ovf2>}eDWt=*B^|Z=p`S{ zpl!vI5%Eh11a~sYoxZ9`<}5|y(*(b={|O*5ABSHWi@J%Tg%hF=s#$u^KAx)Gm^BQZ zO$IpB5lfM|7h?aC&czmamkEY?lMOzW*wu+YWaWX1_*=l$vN$KEj_VuBm&5+pTefv* zTSK!WP>;FKMZ-bug{~AlVVGI#8q%(hu8p=%DrnNk`srC`zWxS?<@bmOB}bkYAlWZP zTgleh2%v{Peh^-wj_KnBf7@N1_&wt7QYsY}ru8gyB2G;mk8fOTO+%)7V#WsF6W28= z(NAv9)@K5fn=|5%mdYZEp-MBt-bNda=FL|cpnIKHo@8<5y1t=ho6X7pB4hQokAKDY zV$^ypQ_$;t>+j#clauNd+6weZtZZPBE0Rs;@mmz}r!$k*^YHjCQ;_M0jRbS-4eUlt zr`O&j8RQMdo?votTkpz9ICnC*Q$nw05T(&3PFjroC!`}X7B8Fc8+hA%4R>@O92*w+ z6u&xx(>u})jm0wgo~KDf0ZD$xS92z-xS&lFqAjY$QZiK?&eZMsr%zX z{$dOu<{(>5NLq90S;)Xj*;tX;T00V~!p{Ig~By<3MIg$s9h z>kc&At@2znLo^=cP@5N!Gf zX?Mde+X)3iX5QECTd{4_dXB1tw<)h2OH%E5CqPW1J1^x} zyiMyalX4+m=4>sX^?q96WqtLj-^qwH?5XXH1r+SlS#8>(@cob)m$JKF9_1aKFIq?i zZix{y-EX*sSuCn=x3F#8mh%IU`EDB~a^kx0DrM{A>aNpaHd9Dk=|tsXrseBD#2V-< zbWBgoKpG+3oe*y!j0f_?A&BlsIXE`BQ!Jbiz9J?2ysYca=8i+Z7er`QT5R*R3W0~- z=H1w`=rLMcp7^aN-mfrhF`b?JXg{DkBXeqKQ}p3nRj2WfUv~<*wvB zOV+jUKCr=t)4T$e*p1?#SqS>MZ&$2CV6h$bnCpb&wmjw1FBuFp@5BE_i25DJ2_Kto z9ygy@nWLRe#QSUNXY`Enud-IKqtDO8c8c}8@iuBQ9ZPKGc_E4EC{1;LpB4T-?0^de z|IpAq)d3yRmme<{Rb|Ld^S$yNMYubf$lX@b{MPqVwfTs3BN)D9sSX*qTXNjDDq|ru z3lb5&rp}JcupNak5g#y_5t*)x1muW);g}~oOhI_jXH)8(+aU}qh{2a1;69`2Po)3F zljgDdZ#93haFggPbWUGPvj*+z)XQlycc$cwb3uYZFP8y9=K-!vT-CIL!h>yQty!#- zK2s>KmMIVC2+>hDEY0pMEAgQHYb7vRzZLl+@&%d=@gUQkm|J)G3C=MeK zhNYH)E*4_+fzA|U&IEvr19vRQOUvg~#rg{m_PkP=C5gry(XR!kx9pgV)uy2LVw;ar z)g#mupllp1QR6&|vJ`p#C=ep%sbFA0y(91bwIJp~()XJEW`Pi3%o;E=SBPa9a+wda zyg0p%$amgEyi^t=yWf(UarL{#nCAo{Jyn;ISXOwU-vy1>eRIWFqJEA6@TsgEZA2x0 z>F>g$ttJ4m+g56z=nog;uAd`_7`q@M2f%!DVo>vXU(MuSBH}~fcnu))Ps&!D=L8Oa z!2BrH7u1WANrVK6>Mf!xOS=W$9hp8(v2crr!6U>6^7OJ$!D8Z@s0%UQUz|u%Eg%Ii zXgN!v*$r3FiMsjYNr+|jR0y>n<~+Y+L(o|7&t-kNj_xkI_u5LKp3^R%CcD464YZdt zpcFwURmn31C`RdiAg>Z%a;yTot%QvuX?tcLQf5lQciCEawKgSqqb>3V%k~xdV$LHu z^3Ov^N%Y&b%1IQdXvYEASv;*)V+I3AO6lqX4px~dMr3{#Ye)%3Bo9*bM{6f7>nB4L zK6t@?zp{%yU|rR+h=7BWCWJb_Jp;sa^CBy3E!zJ9;lfJ9lMrLStAOXlmxn?AmNRXV zx>T-ti2MbnxX|GGd(1}%YAW_EKrFhbdTO3&lZ04<`fq!V*eEk!Ow60<)Hau6$TQ{S z%WD^3-?1M0b(8+2NeqDJt5*4}{BZq_`IW0~oN&&MtT7YjoX-;h=$Nop z1qIl03gql;u*TT#nW5p~XM&;P&zs_c{*P8o)z;NPW21scneE!hb2g;*PF#6JF3I?< zEI-w$7);PTVsk^yyyG_@>}@)+yl6^XvX=4|zPX!@gL*4?zM0K){+91{X-nATj1Zvn5jPp&`~F&N&ZB*AwBd zG$5F=|3%pSv6k|;Bim6_Lnl}1%*3!DR-BDD)`R>A>SnT~0%^z>eSw3l(6-So}=X1S+go|?j*hTl84T?>cEs{_z|P-z@!C^f?AA@>*wup z$7LH|mMskG=H(*a<0QbC6x0JaWiA9mPEiDcTrd&ce-dAZWs4QJ$ljsmEc)W-SQm;U zW6c3~!rykrWMgo|3EGq_4H;N=q(~bz~>Ij2@R2A zd;;I5PU#mv!H`iqVa9igHQ;-(&;>L})R6un_zLBY#vWKgb%jyaKYJejlBT|_JRzSg z>8oydT4-oTgtzNYWDfcOwTa_9$eP_e`q#iplYUc>6kN!mnS9xUaYOhK*( zjDF5FDe}R#8NanKvGA&5@ZNscuYABf)_j=wnQ{FB%ske2Fw=rY5@;>#^Av9KDrW1vjd{o!aQxdl65dyt z!%}0u10vtaC15xqtbHDz+GXDBT(MRuLn#t3Igb!PN7aF#bTTpct{+Q}hw0J?(XyIU z?0SvC|Jpi$kVp{yIu;E3Xt3d7dDl7f^Hb}eBL8z(F{F62RKT2Cn2@weypdswF#vpd zua*G?zXn57@A=CmeeLXl3c`=f}KQk4JqUc1}V&;aEX z9`frXFbVN`@p2v12H5mHdu$;~bo#{0dV@{lO`F@;B5ILbD%y`4S8VBvTF|YpjE*Fl z`#GwZR)Hy4dOxk`&O^&m=|Z|9&hReH>dwEng6DMVj}}w^g;L==aIM%fym2BNeTFP~ zdoV9FT}Qtv-yF=emILF(pBroGVGn?a`XnOIOt2hHFAoj}oUJ7g_Aqr&gf1orCv7iR z06E%j-*pL}v?TFk?27d>dEi2`^!Ox%BsDe70JlbGs$h>tN4%ojwdH*7ETD&;~J8Q|DC0B z<>NOGYFws;z97!3!G1?V=rR#|rNJMc`#@*htMBv)ysYWYPZNw-yk!-dn>mus z5pR)NVuO@0*HxT3szK^q;CU;M1|L~Or`o)xSJ%t@9n5xrclUi}P_IZu9fwXZ_OJ#X zO|_@c=lZY{jM>9AU9g1^Qg^(Dt$Y7x|*U~g4Wa`>R&PpKZ zM2jKon1@PnZ``s6)W@M802hNg#bi0QcJrCZSwxJ_#2Zu*-#He=elpY_YjdcSk8&&|HDD&4g-GH8=JteDk3owEb7#;D4=4FrIB zpL^hnysP$}l;*p?k0N#??qiEKP;^7xMYc8eaYS6}LPhIws_xX44f+O=lf$j`{<_^3 zFSp})PLha4zh-Xn89IQ*bAf?## z#3CnQGM*aTE!8B#dXdRiS%+r&w%mRLahp^GuV}`+3Y;aApL>|~>()94SO9 zCVu*{T}c9+~2lUI<323pLh%WMDP z#)48T0FkayhQ5n1@~8JMM?kzvtl#UkA0OhZVP1M8S`H?8>%`*2pm6!iqJp>eLn+(u?($&@0DQK3rz&JA+eh2j6 z#PK3w#n55I6yvWf>4IUZ5p=u3R1?ikWn8(J2cK1??jQH;VDk$SYCQ6 zkN-WTQfyL@Emp6gE4E-K>(YchhB28@5G0ORBJEheqm0;rX1e&xnjA4{EFzf?Ce($> z2|jiApl9%`TP0cboPBh1PUgEMX^Hy8 zC$1R!cN>1d7%iROv+dhDQ}j_h)0yD2q>#&tplJvD62Gm{gPBJ^)G7a}HNNS`^`^IT z;VfxF4VRhA1I@pK&vx9QnWI96XMIUNyTwirQZcEC%ft7T!3H<~r(b$ofyJCLDM7Fs zCa15m2YtO3AQ^GZ=ul{=+f(C4(2dnM?nZeD5;AZ%UQ-7LMj-5hXruB(fMfzDmT-7z zk^Uu=p;#8`aU{YCD*>3}9!y9Zj=L>`B)=;drn)~vGo-y53$=}GHQ%TvZeU4Aor_K1 zALPZ;0ZE5KVgq*FEVBPRPHW0h@Pqx}1W^R*sP*#5B>vM?j7}8I3c-txYwH5R^;yZ3hhu~sBtk|omZ{-E}gn`*-W>1)tM)CW`-eoSWyC#1EtqINLm z-PX2!Qao>`$5AnO_+_E_YUzB^8CIL|YE!wyd6?nWEM*iNU!_<^BO^2ZAx7tIze3mg z%!M;GaqedSQ2?~6C>-6CkTN^cv2ODPx9a11y{G{wVBNsvc}NEXO3fiaU$%SAI@)1> zi+NrQ`##fz_!RyG8`7|~$wfF-j-tC&K+6Eos|Rn(%hSuE!Rq}if9sx-_?3pZ+vDw7 zZ*T9y!ourI5nIRhL4;ybj!tjttOji6HT9mL?i={SJ&rOhApK`Ovc~1E*o}hdC$e{S1XyqpUrBnPCshqJR{0-lwU~4c%_)$KDI!0Za6FkLY$p;X>2w-8&9mH6SpxG%bLb99%3(6)*QhzIxQNM&_4;a5~5_B3XFqhK?yS!r@^XZk=mA{>tuHVb-tLl zs3T?G#^AL(N{U(gYSzzh-_AO%GFLp?6ikSnLTjL$kfI!Gpt0j@MM0Oo5aMSALkKPA zpR@&H$$wO*-Q62a-z4gtq8#C|zr0eFaQ#SHgZsvA=tzs(#Pg!(wS<0jJA6}ba)GUGl1%>aE&ebz3rk6q+{v5`(Y5U4$W!W&#VEHe*HHB?po0I*s- z$)vB;%}h<-wIpK^ottqVoON`i5HqsTI}u#SY)Ns2vP_vzl4tN>cNvU4DBv`Hzlr186c@) zPp{yWOGpSUV`amAl@UxR$sHn`WF-4bJISwoKO!%>Wus{JO(-Y$3Vm-`QdxB*uDh;1 zg_yv~Zq$N_W4fyg5Cv;wZkrD-{mLmVt2m({SMCJ=F1tvOHa6dj7e`877Qj&IKi-UP z5ogd`e`RN8Ry_<8ic7%%(}uI;KJ1UdQ$t}&ZChJgsL3ky&A%Klp&1OqI_*)v7+Ul?Y#N^ER*8~4 zz8gO=pb;LU`e#06>P{}!v_TSmMbVu5<<2j;n#*Vp;5iw>++Mv6`n3h)k-tYU}`Txv0d+)W^Uh7%UdiKbnT?Qj$8X%mY>f2CjDe)Vn^8lo6F?xOv zE#Y$QfUQ$epA1=6gsmHHa(KE8i6hXs&(CC9s`cnmf~%H#QuL!MER}DAtQ;T}N+AWu zIV`=UiYs!R9Stsb#P})cokM5S+-!{Dl>yk{?+kh}rPg^C9eB<#RbaDe332=w#YErs z4IQfMN*{`GgSK{vkn@I2a=tA(iJM$A2M<*CR<{0uZ;_!RBq?UCi zCxUV=r=JYllUabxQMLPDa2^=1`uH`>xxaTsZEz?3-EJ?hSp=qi1YSujFm8NdZ9PjO zw{KhB%(C88{B|kXhLBgbuq$0FQ~f-XDIyDuZ6%MF=F6cvVazLo)@-8^ce8%Oh}^9u zlb=joh2&(ts{Aw-gUQBd8HqjL>0^`dR~h%zNFJ5j?YL@}ybfp)sKcyeJv@4i7Yxj1 zaB7n76_2bgHSy(&+-I^Xw$EiYLhA76+>}&|A}=Xa_EGdF2EP6q2R9ejTgo!$^Yx?; zg`B3XD%tPQNVvlWNP{AxCS@_3&1y^Scum?>E3k2LOy*P0NEO4=7LmqLxgH*KaPhd- z(@ONVvg?L(ao;H58C94Ln@@JeekI$R`Su(qyL5VZVMmlA{$*3EbbeIS5D#jVEG*KW^ioV}_T$(Kyr(PKectcyvG|=2oJJaiL|MWAem!{87ta7cg(LU}0KHC_dLk z?&R&KJwZZ}<;iYwuoG^V937Q5EW0KUEcD&*i7dD3!;5YXrEk;W@EsV*9P426YwT|Z zoQwMqQX$b(o)mkLV!lJ(84A<3Z0{jHY!HWR#PA?iJbJZfR#sM5QWNKECFMsYkLIr1 zcjR0;C`n$d5WdjoH_w+n2rZGC@c!VK3VQf35QU4Qqga#~kIZM~tng(?nr3l6F*0l!di`JwiobAZE_GJp zNRXpKUv!qjg6l(6RVU09)4A&gwJBr0!7DYEsXfV)+G-6jd0oSnSJrwTEj353J>Sbv_`>4;l~!_rD6I?!O^QIvSgMs>lIn^Y}`2LbGfVOJB!Lf^Ysk%g;C2m6xRJ5n>4(T z7D7Jt+H9_*M?c0igAV4~9<2f-ua^NUE3VxaOAobfAQ%k*s@;LVjy{QeI8AC>^_Tz( zOM&z1BKcyk?10{n?XirJWLi_;XKZY2V&c?d(qh6LUt%lZx6zAylTWGDX0J~CE1#WXiq{68CJ11=LwgreI6gl`4qZ* z>tq|aBo0F9%UAv5jQYDkey47J=&6wTbJVN@&-4cuHjMszn~nGGtxo5%Wk`M|J_eW; z*8oDfQtr7{Roomvarf~Cb4da1DKr@~lQ|43AXCZ(=cTDnuaw74(#qw-HRjh)Y_xnI z98Eu0F_(?lMoog<@?fR~a>pMiQW;u{=|@gxk^r4_8Is$!_&P>8KI9JLVugwkWX~!- zaZ~g!&P_rYmZs%5Y|7k=0xM(8`Q2(s>9`~KXZ~)7je@`v%fKen{d34#lE^xixwGdI z3@aSzJ{zy`(-Jtg^jwqhrF_qV#^{<(uI#B%Abxs&gZ|`R+(*8ahJyr`IYnSDn3mSJtVhV+oVw!TOP;! zjsnwATjc0`!=*&nRk&~*TjfWs{kn6}ra@;lLNX>~t2m?*hF@!#)!fk`cEjHpWp)i&R#&#peCA2PL@Um0=00T4X7Qo`O!{Y(6D*oL}oqsVCbv3T^*+6+jzjr&?BvnKw*IGFf*&f&u8^>t|gyl+ZS9?C*0!Sj1M16 zNff(wi1CUXeoL+}^s?apkx4A^0;0}^d&ZSJm?+@D&2OQRn5fa7N?ock0xCzFM$jYy z|5m2o*{xCSIUni{!$)}?GnqCwTOQY+7t=ubdt$5zc9P)UCgT~8-IjOG$@u6w@)H zu9(;`@Ar6I5zTMa)Q+cGZ+@5f)rU?oH@-PhKGLyhVe-CElM#{{rFpWoDB#MSxAyQs*$#ga>TMOV{sq zSUP69g7}i>iZ=~3{$v7tOU83>1Brzg{-S(KvJte1B|-i5*!NG0!ZP5@Hv}eDq^&so zdOw^hmYypfh}D4en*tPF|87vrpx*=*f!|(z47w!3nkOfwa&=m*F7~8{9RiIw#29Fg z2l19?tG&1nVFo*<-w%oPYXH;nZP_m{IR>l zVt8x_*G=gY+JxI=V8XowwMO$stcCU?8pa3%oS%YZwN*P>$`Tr~i}`I;wbg0_hNB5C&&7f?Y?#Hkir<6_eBOSO+P1U+*c^Mu>K3xWe|WZ z=!Y$`U~M_S9)t`+eV@D4`%|;<^udzrTI30VA)@#Cwvr9mH&d_+*k*hkoY_ zayW$umPJA#@v0r!I}rW86}@u!LzL`j)&Q3+)evF!x}3*`&mVe=ijfJ6bpt-+D zF$-^B9Ce=-O(QTiHX!OD`zPIUjk8!+SuBm_elrt`QSWdN{?E^vg5E*x8x0@qfr!(| zRxm;32?eTib`i`?6}yMWT!Q1y;yKBZentZ)na_&c zB+Io_#dPQ`>4=BY2=d59@%$jK2#Jfiq7`{&Jnb}AsHL~3XP)xkfOkG@zlCWSim>-T zFgirM`Gu=JO;J{C?9=QA##aYu3}=c(B|oPq)Qm9B97<@tXHpretRExi zFGbF9_Ej0NmdOaJSrqgI6z!g8GGtQep zKw4sg*_p|llvK;=7|bRcODhy6`|mvF{>`GK1-UD%zGn+nXMu!X{XDEfrp$$;KJn&n zCk++3$itJt62-19`~Be*Mekvdf1!DVsyR( znn*X*V#G80@&M%pTdT8IV9?6=lL5Tc20~bgm51Hy*Dr&6jFO6dyn~CJERu}kn*sFJ z1V_u;(7>zbje_)MYZ9Ak9{{Y=1q3}RyyIz4L+rem0r zPE=-`>g4$*T3HtEp9Lw6rBc6PO$xrCHs-e^(Oeb$Y{t5x1b`3MAXB*K=s`5~N0aWA zd`hML@de2@R~QuEwrkY2+E%SaAe)LY`4T2I;j=Zmc|K`IfnhtR)^z%NMq3`T@@g7N z8Scr_B)dyG78OGuhRHc;2M*SF293NRpqmXs5*|%!9hFEc$93Kj)SQtxI|z}bd1VN; z`bQN@^9&6k_=nE9T`Yh7*Tu`;sXfk-cAG%T)>z-T108AbZ>#15yySGgLPc)u-tR-h z3|S$nrF3gavZXnOi#Mg6xnD*vFSxcREA7`X)D?Dxw?prX3eFr^rxRfk{~;^app`Pu z-V}@L`ded(6YrB*bSS?TN#C5<;D^Ti5|fj$f-=6 zOS0WTj^){(o;&}Uc+`Se?hTQdUJ}Jh8zeG%S=C|O@iUql$+~KIjHcZH*2Z!Ch{$XS13HG z#Zqi%Uy^VkiC|e0wP|?2V$hoPciy6)m`OleVZy=6*_oru-DTlDQnZ>izcw&(fU1;E zN*lTl=2W59|KjjTo;@FIgMwuSrf{~kY0=Y47Ki(l6Z?QT+A>Q)s~&xp98uqOYRnV4 z$>?*Qy|Z{ACWid(V0-9vdykEp%Tz;KtZT6+bJJrPa0L*F5gvD64L@7~VxPA_Vw5%H z64~{mbHY6j0OBTI;JrTtDq8QcBmAwsdruX&fkp$-QzWx?H)M`WH&SG`_hE{qr-)}M zV@W)2tT+PR_Khrnqoj7GdD-vKqQUs{fz4xV-W|ro%^K?ttILtOzzZjxKR0!#oe{pQ4UXsBE81|^jJLw9@%G1Xibyk89*V*Z4rn)TKrP!Ikfr*rqfDcJ&K zIxVhezl8HO!~yZnm@ojtp`Omj7Y6D#`2!ENcwz@LXe|MvsInZyPVt_(U}G_=edazVqw+s3vjCQU--nBBToAqM9|vQlgU zD9+Xo-u#wjr+u2#`KHWohz7(oTlUL^-C}n(z5Y>bnYDFp;RKp~>w`MiHtyF4 zS;Iz(r)5w+xmyijX#ft>;}7N=tt+lTa=Gpe2-Gjl&mA2r7o8TJTG->$$F{>zF)M7Ckl@#VT4#i% zGI=wRk#iA;7CF_$)gfXqo04<*vbnaXd|#v9kSx=KL1$+G-kgLs9vvpQ1{E<7Z;t?STbyL^zQb$a1Y-INrc zt0PH?u%*WKU-~0l_I@VJ7sv^9IB12h7xzW^!D|NxPR*ZcmJflo(&L2dR9;?Qc64-P zXH$tXKC^{C3kZ$h*Xm!$$H?U(kJe)d4xOWF>i={Q1E#kyq>1|RWcKG^U9AozkB?fO za}6n5OJFb)gvB^Apv4$#J{~PtQRBwtVvC=fuxHFR2js`XpA6(8O7*0Wj$D!Fc*8U^ zUm#tcOT3`z_p2gK3SYoRilt$_XW;d7=1-oZ=WAO#c(Y-s`n7A_w=JHzC?_J@9KoZE;bG@1o9a&6=8HTDKl^kcQ zTr+|z4{X(0-F>T7->sw>0m?rNWQkMAz`2EVQ@ChpzKnm37f0TVx+4$Qh(rk%yeuoJdABj&P15&IL}s(9vK7B>zrCxX4y{nI7X2a&-hUIhGgK z077qO>p}-ML$CO4B@9|x#1r;0hKYk;U>cEcVm_;O_8Ya`<+d!0T*9Wpi1l1=kX0XB6V{!f ze}8pAN5h1yk}m!2Zvt-J3>888GqM>17UA+HdDwH3m5Pd>-8!s(qv@_qeOlXTQ?T5A zMI9TK!p{`lZe9svrLUh4bZk{2swB&q6M(2y(H>x&r;z^hrIY- zj%iL#lh2;(eX{9Slu)7L^fap#H#kqBxFvyaFwgdUII1@cKLi`>LmvL20V;y`@H~kV zsg?)?#6-kJVTD<(H=97D@CEX@j4~1dww%=Vs^2K?jNx1#^Kc^u8R9)8?+=9mOqY^QtO!Q1Jq)H)@|PLq}xaT^02yj?&(s#UEXhm#48DOeK-@^$w%EIbOezC33L@l&(pDCFhxBu~X{#W;)zdHe2cKK)|N9vFRu%)Z{8|K$nN9nhp$&s!Xu!_#m+PXDCMvpfOPFQ zWpl_75p$qN7s)`JHjWY_^2nh~+z8;_E7gObtcsDFK)Ug%AR|f3CY( zVokr`wbWknJ>nm}!X~JZ9Dwdf&dPtI8i}luOL;&5XdzZikui8LP(@iRl2txiGeJh7 zD5y}Tt4Cb!E24WM=akSt6HjeKK|~gfCTS$8jp2nV8!)m{lz;WDpnS=hZv)ru*oVN2 zlI89K>A|$ZVsvmfr~xDyP1FO^>S0_K`5Nz3cJy-kn%;D&@EJv=l5v=kn<1-81*H+@ zCvlXuR_#T|9UsMxK+jvJ|4wg(!edIWP6q3RebPk8T5=!fnxGYsEu+%i2<_$YIV@0U zpO=B#Yo0G0m(6c&`*MhCV+5VpvKZA5Emb#WJij{eFOf^*QvR-6T@Bey@0EdkrC5|s}xpeT(XfB8k<1=%bfC9y$* zxn(X)C3KgcnUl1p}9b2*$E^c4^9TA|-&q>%%Tx;^astVfaZNUW%RHahv> zncZ*6VeQT>mV4h>63;k^Kr#U(R5~;U?=l~HTYUZ>*_|QsOx~Sz1yv&&BKS4S1T^)N zH1#y1COKjj$@xw+eE+ISjrIIZbCv3QQ6O!CS?v~Xy3^@b*_3?muw$z8E-MNygqRPr zi_>z6pV9??6ejK!#%Y0y;4Xm~athfhjpM!9lgytNRAH2(Th}Dm?N{dbbpBYI3H`3K zR_nJm#%a>hIFy$w4q(M%l@S^Tp(M2K|8J6Ap!@XXI0CJz`?#~SB4p>jl+bUKqgs{v znkU)pLPtDNA5;6rQhP_|IoDEUNG?c?@QjydP*_SnL@!k!By*-(U+JMn47MVz?jPxm-lV~qPY2{aQAIbrkWTr?@&0LrJYX2!w+m4&q0 ziuvwer9GK!6|%KLjU3|<+`ojP4Iv5L3GT2TdSlZ1zh*;O#;T*s2NT4wXf7x!{T<*s zDIHf{04ow4)sXoU=%33e8mdkB>1sVaLFWySEheog6o16#7G9jadRF67`)5+OaG%3l zvB{b}Rzv?E#){9@WnNA>Zrq2^Kstb{)?tJ{BNXs zt|Tt!O!_RR0}`m((mb40F!ej2{oHJ;bMLKI!E84ktGpir;C}VW=M!;7IUujZNQqK> zUu(XFBYHporYRje`^Nge&M$c`zY^WvX~BWaT&l8O-%K2b!qGjrKJDy)qb=*a zN~J#QoXCKrU*qyZZ$=sY0`_Hc5N#l8vf?iQY*tJCDvl;1FrWOI`oXI|)oVYcI#i6$caS@D${{BW=E5hP zu};p$02#qB1jDwn#WmIEkwX#SR*4^(hRVr)evUN6DI?aauRcoV(P7rr*E3<9UU^KD zui*SUUw`<{inH2*jguXM?xJc|l)Jo2FogvyNbrpGes~}+)W&7Gd{$tGY3Qgy)$}_I zmdN~fb4{8Vb^uB2#>9Ip7}X23ptQg}kZ1gs@jk$z7|hiYTpxmtRAI`j0W?(t)Nm|Q zZ1~Xh!*G#$&Ylpo++VAHf%RP3xxJHd)@vL3Oq5z{C+uJ+A9<1Z2nQ}N@tv5VMROJ! zh2ZBXsP>(at@^>xw|*psdmA1vyG#k~u#%r8^binyS^S*OXkV0AhS_@z&z)3Yn}*99 z>F-gzuy1ho4kontO@Ig6m!q?Q^$!$k1Jxh(xEZl(Bqs(6U&k*DxR**TZQGJ zT)7j4kH#E#p&GW*P_f!LCp%PR#-|6)%*4+HkXj+V+4l;#p%VH@A8oq+GqhRK1FcRC z^;+H92p2yuWux5-nqLB@RKZ}SgrgIPxG0XgN!d#`XOZTf;ck!@1ie(lp5GWa1CBqV z|C~=kqPzVp*{_!PV#Uhy`-eVJ=yGyDJW!@vrHNUm%$UoR*?W`ZsnSscMHvn)cM%i$ zr?2{6XMH-P9#X1ek2@Xz@ndW(pXox&Rpoyx&wZVJDRE?#=nd0{SiOhjo6y9RRYgT} z<}^OlPEn0m4MO{FV4@TAdX}h|mxDaaJZ=W(m%-T&C)-_tMudA}ji(byrg%`Kv~ASL zpaAd+;wh(*l1rK-x zM74l437FV1?vC9k>1HQy#6^BhfCn+%0Z!{NNCX-v3?3nKgJlymPR^_l=f$q{-21%$ zC@Kqo2NBcL8JO zJLWmG`iin%BgP4obVV#Az&PldWQ>(e?spkWi19QD{+&(uMf@ULJTe@ZHmLU!>;LEQ zZ`mpRK@NoA{P3zhj;Q{x{<5Mp{2rwl1$dHFb8fPnkCVTc0@3Z~C@ro75D$fxWyaHs z?+!!^oc;?RUBxsdNwW3EP^?qt904;>mIBv=cZ* z+t^}mxHFpSiKPn+fhda1y_b|YLtR!UI~%xSiamk|&h#*4ro!$h0P`t0buKAv*i)B_ zU?k+(88FE5NAR2ay<||LJdSOBva5q9g4|192f+KrzcFy(iiC;x{` zo&bdhA0Qvq*Ky@gsVSqkmWr%bxkB$RvS3b-}dF$bW_{`zBHYT^)3WuH!>;pp;Hv;#XMhQL>JiRLYS{A4@16sXy0_ zgc(oNq|AyjrZY72>%oNn3yy&PE5_)}C|c#0J6Q@}(i8+unt57`p13Aq#Q2riDG7S+h>jr7OcYiYk9UqVbzKT-5bD~{&g|4Mk>b24c7;pER_ zsjIG@d&|3tkhB=%BhY^XOgNt+Er|wYzwzVP;<7UvwG=;Yd)1dtIoTug%sj$C*erAs z9uyhQH>ec?l^NiCdMJd*INo2szaw~HLG;{A^aTE1^Xb`Ff9XF!y?#>g`~5B;doz;q z*wWnG+{}zC6WZL|oV@k^tNr@X8c*>l~1d z)2X|AmH5vmb{}c)hEitg@S^0Jq4mCg%LDzW&WqmqZ}G~bLuR!aP`Zmv!K2m$g6rTC z21_tH|A)*g0{JzwD<|1!=G|n>>{q~bJHUlHO*AxMUuUhc8#=wt`wPkAsokGvAx{Xm zz_fR5HzUJ5=I-adUa%&jUuu(|k>v|jV8!0Zh$!_|WG_+N>B3@s>)P2@x_tQjp`~s$ ztL+BlY0aHzq-DD)8QNXvx(a0w8X5d6eRlfwe`m94c(80MBY|1zSWI_IcmSZ029`e_ zwTK8N3))-rST`Ss&_}+kC1os=hlWvth-O%u;%|n!|9mIAiV9iaL-a#v6ASK5kwVNJ z(0V&j&s7tZHA>m+8h$n6p<*L2+(^N+8k#DJ_{;_)AT1Ved0uT~{u&2SsCjr=PjKnE zuF$wnTQY%R2Ls+6D)~Ip-H?)uXdkd?9LB7;PChe>yWJyVv z&==G3uk2pv*u~#XLKihJi0sz2qP-7L`*p%F@@YJGSCHlQuM!#hs`l8 z)PrK&rWO5zNTNBz31&Z9B9ASo92EVW4~9yGcoiUqH1S(69#|rd3y!F{ASNofqnhX=-jnrYYtN%YRvT@>KSK({n>_@p9uPX%&fycptg7QI)m}wSv{Lwq7wu zN}Oxw**QKB#Y`L4scW*7?#yePD};$=KnrYn6fHB-G_RbWm_8BZDAF`p+)8MFX+EGq zAi}N4YNPwC884vq)EN-+{+#7W@V>B{VOKdhwy%w7_Tl zr>o;M$24R}jIs`^TW57=*hOd`L39W3YP<0Dh)QLzQ^oW~Byw`m^d%a9CHeC2E)AmG z(H}UI32HMqy~0->eh+5;SgEBz5Z58)U|Rq19PUuN=^LMTLG%pFMG_}6=WljS*+n_O z##P$#%EnZc2{Q(DP^`67(BSQuNf8L`0AXZz;Jycj?giBq$X}YGJhqUKc5W#SZQ3CI zg{a9VlgTcQx9eryCF?OWF$em(vSj_QPxglLDy9~7kc~9aliuZ}6xOuX<1e&$ZLaQQChm4`q5=_UuZmuD1LWo-fmokcJXojc>a&8~&Jjt`8# z=K@gk(O@7xu{cm_N-aeLItS?e@$Ct^fV4L-`c3<^%B1K&L=2#q{sP?{Ro>r92i-Ds z@Y4;(i@9>ER|hW6$#T;g=vs?WDZ2AQ|FF2&*^nK)+MQolGx|8_l%3t5mn*f$On~Jj zzG1s-Qwc~`g+3B@cO&3j18Pv4z^y`iiIN{Y_laMgY1y|pTE$>;ni{E*J&0%p9=5%t zwLH#w*F+Jd9F?lCW6kiRG+8m+t2bW>{d;Jx1QsNgi?!d$|E)5%@>a!_cdrVahi**7 zwzae*^>Er*>g)V35kKe6J3P>xyiPY2{^~d%0rFDSm&`>GPEr_qAVDH*!Uz~m#MB5~ zK;qUz>zRflK+)Exv^)l7BdO1taLPCf`V5ZIFar7e_-C_3O6iR@<>gkUC?f6LoR^rQ2Tr*5e)bh6Ltb`yuTjF2DbZ*$UXtr~Ca ztHPwmd+Z9ls^!lyZ_v-|n9o={zw8=P6BeHYE7TaOXTX>TZn(OA+)r>ec#sgAa&!iql9O9W)+*oCNZ74IwC<3KJ?Oy&rgy7 zx~?c?kA|T-ge=vd3g79I5x2PR)U=+!lPF&<^qtOWj!C97Hx@7Y9K4z6DO&GGKdr5K z%6@x3(Yv0Y@tDUnUpPz0RK5@hc&C9W^SQ{_|0hWke0dq^Xvcu_z*T~P7)%?3fU|<$ zH8fB@HvLt=Lv5fN9H-dRd1=h{3Ze2??!~lh3lD=-dB1Y0htFu#RA^T&my=1PMHAhvA8Z*%;l4=kTa3l~AP?88x5D<`CW!WdFECbOieeBD^$Ez2Ca}PFL?;;?R|p8S{?~tyLylj}At2TiWF^Hk zybO;zQM2`>(r(s=^Lzgk_0_bArc15tVQPgNkYm7pYW6J@_6`6dh|6D38KgZ$Jnj7n5IS@ya6#OOzX+Nx_= zSy_8o``*n{wuVv;zh<+8yZfqZrQ^-Oy!|5X@MeFc-aAJL2FVN=kt`CQdp`uck1JmKx{akjR$uBB+!4i4{aWrjY!m58NZCC7^`@tBE( zudc22ypx$Cm>@u^fH)uyo>BOON?;N>8*fja9KeB?1iMc=yNWJ&aTy*87CR%^56s~aTZ(I(!BJKc`w|& zbutuG{^M7N>#L)c`50L#0UU~c4ikyt(EDN-#`n{vW@bfsUq#z1Dq`fy$m(F{7I_N| zMCIot;rj$lBYHV}!@aT~z1-F};Ph#rAE%)OCChV7k$FqKwcXkUwS8+URnY_*vsac#>6itG=nPy6Y z=L0E9{D}A3T^G0_3t_ZD9D&b%bK$gC=z+KWGVo|bQMzT>E~8PHlvp*9=seuqs*vvP z?iwmj&kv^}P8$%7Fw&%gUT0nY4>g_FOMec3^@oH8oQ0Bxg*?|M|Ae|rul{EwVkIb0+wAHR`tI}3q~|lgoU5!QaJN?Cv;*z z-(6bWDbKu5%oqvt8bfcTka?i9yZ;@&)te_vQ&Sb??O?JcyA*7OHE9*P zkT2CwTUA6d#mT5HNaCq$Y0kbE6K9New&dCD#sOT!02NO$5%bw)t9%I!&llo4l7ZWgtcy*pKnBuD)wgY z%x7qIR%tW&%eNj~dLO&|$)yb!+XRCfBpB7n5lWTFW_c8y1EfX{e%1<9b6#*{wY^-~ z-(f0{8D&ey-?j%gi`8+EUnw1_4^`^fGL#Q7*d`934<+?AHqfkn>Mi`bGnl^G?z!D& znek3NWSPHO0d}jMvkPmS9LdymPxaoMGpp&$d}xLF+?b{{#6|4Ywg$Nh`ssx{Evg@U zWo&p-jOQ-20<0}Y@o(0APt%$8CioAlfW_T?y=2>Tw9<-=_u^TNft*0VjWqhOb|b7i zoThEK&vi;k=@SACkA^~Ubuu~k=(cqqY9E>JcX6MQq-494!-Y@q>Tg_Gk`q(rSbP#G z|2p9R&Vh1lCE+`Bqqm>K@G$d7s9Yjw{yK(`#2I&*D^1P@lH6OxQWCOE+0>3_ee9(& zHDVEcos`=x>TZz#7}3@IC%Gk8al4;Oab4CNxIqRFo^Z1WTcdJW3-{IS(9YBplM7t;cZIzZ8e6Zv z40tW?1m9kEOiTl{*Ku zOWZs>m+I9`dG-aVqyZ&Q?TC7kk-jY`bF{#3D;GUsHLHyp{Yq76B`tjHZp8(fdqCt9xqnp3W>k7ee*t{9|TvN zrH~*jlxAVmYu-0v#z9_!R#Z|tuqT*N_LkR)>|@^ZRT*pN)eN8Ou4v%-AbwJzV)5ax+GYkP!%iRW29=Fgk7HfBb1%Pv zC``5x0P@KUy8QTby|&|cn3gPt62mcxi!etcMIKGAAn$7f{!|vl%lXCSG55rIB%wF` z_22)lLE^raL=9cDe>sz;`j3nU2N z=WT>|b)=AToN~d`)4tQw)s^EiJTFUC!)q`A(fYF zltn;Dn3Fybh*eN&{0I*cUAvCcEzUO}4D$nL@$5W%_5H(2k*^fbtzgqnJKw2k9N8AD~YY&GPkjLi88hcQ6( za)q?~i``jDr8N$IS%Du0*BU9OmZwHjjXr()6oF3K<+`V236Dw;<~A6E>y?1|hArQy zJD_RB|7LY6g(b2~@$>vla+K5Z($bgPo>?2|i-}-~kFn_Ah}*ykj5bVc{|UJN#g_lw z1L~1ir|TkkvFAf>69T6lnw46Mp#jge#|Zxu_WK06JJ!&T)s_Qr`N<#t297g&E9Nrj zD`{oG4Pyp(TGR{2Q-wnW@GHS*p>iM+D?ZffP+6)SWQ6P5GUUwLb7dhZvIYA&leB)P z!N#W<&jm4^uR19)DVAdW1J?Sp&$DzRj8a7VvlxVv?DujSF2hyuS_Jt!$8{N+7tZ*R+p? znN_E35uSsRM2dUQJi=be3leVXthXBrdl7q$RobFD>n8Xt%QE|zX{XQmba)ffo5;MbDb0hH>j9{$s9<>Dl)}ZuwN!4S5@in4=V`wLm_H6_MxZ}_I(#Xi$b4@twIOy13 z^D!`CUB5eSQ-tNy-K^rHc9#Ey$u>oxc^exdxnwWc&t&P32O&(e%a70BR5N6#k~`$~ zkY{&S;mK1DN`N*I&?spE_lM#^k{5B)Tuc8#Rd_FHp-nkY*8W^(QqWtcm;^(fps zS|RCBh*e`->umTC<0#|ies|3U8bXv97m6b`qajh1)Xg3_B(fY<1@&}$f4^RuXh{nC zO!Ky(tG>r@PmwbjAa(|Jv7O)C2teVh6+fdLeo-yTo>!{N`Y~2JMrDHA0()&JRVRP! z==I}KL~wO{Tj!XNDe z;}xe)TOwqvqpBJ#1<#0vpYybqqBsn7aMrpN!|2k&RzQ4>gk&XX$xvD@q7I2OKCzXR zKW|m+XUlHu!^NwfOPP%r$8?NFMA3D*NEYA6^Z*A>Qd7CG(fIWw2rb`HCNv|rtt23Q zv`VKj*>XDNe@usuvp2T+bD@PReiyIVVs@7N-powWc(%~`q%dFk{8hNTq4>R@-vshy zx@i7nc4Lnmb=P=K_uS+=h0i%!35ix^f{txpcM01m#cupY>U?cr-KQnEx}2O%E8NsW z%A?ZrybczlPJVxIqFTk5QV@?SENVxd?YvoQ4|uw7KWRIhQ&$!OY7n(I2}0MPVxZy? zx(62(5V?-C%Q!>7d?$1y^S|AUWNkmWNrZSlLim<)WrR9Sm@zUjUgWwgrke|K~ysU8ZCUOEB&T2#r1oCTxT5lTd&`Cp9C zP7_@5toyk>Ki;Wqbo)PC%d>W-;${h-4`4U12MDAFLt`s9UxH**Er5u8#&__gD1TXY z8ez5PtqE6tm0{QTH!;84umyk6=@;uWG*8{vDE(ztjd%MaXLdSi%OmcamwXULjt3Q}FPlb^ ze(J7oZr%d{6F!kbDkim$ZpjQw9EVspGYmsYIs>0ZSb&EHF?Dx`Ge*VbVkegl7l;Ic z#bzmX>s>kT+1$V?3K2kD5bFj8r6NgcPDnt&Cc7aTNZ>D(iuVo5NlX-}3V|LU9zq~5 z^N)X_>Ht+39e)#B^o7+)I`2+ej=X^(j*xDqPo zCYv*A`0H%8Y0M*)LDIgW(%13BE+$(U%=SizJc-xU^6mBG%)Au3-&nmvo*r&~&Cg#r zehKnQ-bpw=;W5+G(=#)pY+z<)zBVxRots**?%ltVeZGJUtZxSDZXK>DoclVH{#(}` zH;AJ5apKIjiv%dTaL*(}kJU&o_s9gz421$PmC9u<+cPFLma1ExxQn0W`|A&s0+a~Q za$0wirC;`@mGcBFfB?;sM~TB8ebF08=qao3ugYcK$i_}%iqLcHNeY7S1E*tq;VduH zek{lbv5E8a{0LllYocm}iP%txf-wJyWrUb@eM6U?>QrB`@&9uMW+ZgL&r9JdP{iXTuX9xlxm~*vK3(q8fpbQYcga?o|_GE9I7y zW;@^682Iwp_hzvVhQla`zfcbu8!Fx0D^*z7v?sZL0cI16z3Y;Pigqw zesz3Ts9r4AIyl)$j$w}ZTL>X;@>AacD7tNswcJ^~MijIoExRHZ0!8UgE?T!`P5~J5 z0!XDe#qcoIT_g~7-QAhyKWSj_P~W5)$2ZSwG~nz?+HidD6XB(5sE$TpG~r)aGNcZE zU}gN~u&SfoZ9b_7zvjJ1Y&8lSlPTGnG$Nsp+V)4ejlXahJl{9KOeJD`-cPqN#H$fT z_eMm=$-53qwTT2*B<8P6d*YYQDVAj3;AekXNXJmuI4`PDsPn+cFYtd!5!U_kkP|$8 zq=ihZa->CKx7bipUXD0gUX~k!?|FN+DUc%i(ogyvgeW0ElsP{?UjwQyEGdCSV&dv^ z`SVk|e`bFEJ#y?x*MkF?7&7p=B?P?^KHs0Wh&#PuQA`#N(;Ze+y53lx!+AC^LKBz0QMI5eN0}nvBGw zA(xyk2$w}rb+b14?^6ALdDvWb$%yP?e@-kaeyWeE0p?IiBKcT00*x4H%v-jFirnDq z2izkjD5p@7N@UF7|2+DNg{A6YXu}a(MZca74Oq>Fy_5K;Xj+Bw1DbT)@!-IV(;;^` z3yYH37<6WZ!pC|Z`-rWI=v)cp6gt-sDOw5VH2KJ{u1bYeuIHet z8hr*Yrb2-dqfKj8g7x^z+!@MxwP5$1Cc zS}pFr)+ot3@ARem9g#q)yEE0ZQKyAbi!nCpC&qZ1=ytn%Ht|Z6%jFrPA{9G4rA#Pa zas6iwR3oxoC-`KXFFD)~G<0YBSWgr`zpJjPiN}LZci#Tqs$hlkmZSLTJw2p*Bgz}L zAfyDSho9O;im`VWKa(}@Vkvs;C`8AAEzH>f!j5q&rfBgCy;k5G$4K$Jt zhuxLn$sF&W_l|;X2M$)FL8?XX`Iw2%Z!x=@+3XhB%DzHJGS;*dR#YJQ$jc+gg$J)| zfW;0D4|8^t<}>-Oe?~fBxfKl!F+k;V@C#awzq#hr4kf#gF0Gs~Q@2_ZFu4HZc01jT zZ&VCez@GVv4$t&yj_fv7%U!z<0idrQ95`QzwFD33%)K3MrBs>aY)eFcx_`q|X$wK| z_p_>rNsB<jwAsL=ZELINP$D!7y`NE+OV6ZkJnal-pb`AD|hzM z#r|1fMFdr|bo@fC*thz6Ou6oWr~IMqbHEtWv}ask$6|*VD^!8(^xRc#q&nXb2Z!06 zg9yeq*+lW0R|;UP07@cJT{Z+T8}pGj8ajiEIPkpL*}WIj(aCOp=FipCOhWed_A71Q zZBJ`C$}6$t*tPR-_GjUdRREhZO{v060;R%&vQ>d1!*o8kQr8@+BS`eX7uPXBYoC4! z@*{*mgs>~SxVFg-y?IMl59-%1WkRzKA#h>`px(Z<-N&dbGujCU5MJh>QFTZwxlbZs zjfcEUe)4DajD3iXw#<0HIQ4=Y(vmE6JOU;KkZnaph4oIM>+{`Se+ubO6U{9v@67j6 zbsJODb5mXEx5^IXBdJI?f*BqZkjr2MP%P%FbgXi{Eek`ys!hv)JF@WW zqxi^`_}D^VY<%S>NyC~ zof&1Olx78egBrc5fcrfCtDVX!&(*;=cmpFCHhI2L{rof1r{6kP`GU_^b3IV9w&VIP z?rLH@4TO(=$d<&D`1Jfo-Ce^o$sR1SKKj7D-<=90Z1N~M=mZEg+Wc3 zU0)Sma+6`gli&}S(P+#J(CT(o&0%IcY_HGB=SC9D;Hn9(b2b8_!>`LA$9OT#g*doZ zLt}UZ(G!7FmUJD$;kQ(stP$G6NW_DuPYomb4sQsI2o(gr(V0$$7KR{N<^Ktr z?YWmgj(gTm!wGfkVgT4Jj6TO~l~dG<#l}fgreuw*uhvq=NiuD$IaP9z=%nBKsFGx; zU{fZvsS6#m|8Z$Gk9FRWFoYL?z$6Ojrow#@Yljei3!+*u8#3^xV<*#AR)q^q>95~1 z2Or?b#jfMPC-TEV5|@SxO>T-wDFKUM^n{QWU>x@(makJ}i@$yInERsY_mPkj8Y$2= znqF=n-Su^f10e8 z6sO2!h#5f(%h{ytuD29W9{t}TUwu;YJaNAwb(Ke{rSwWxyuF%ZH-h0&m8VLw_ffR^ zq*gA|`zWom6S5)5QG>3|X7^(-Ex`hskt_xd=tyKBpPW437yX>>DKWE_Za z>E6vL`)fhhDJX`99EZO5c3^8U?L{kHUg`ytH-F+%C;)7GUHG9|)Z~)RN&6MW-OdzY zbSQu^Sy>zl$MssO9K`xBStl|Z&4b^nTkIa)1rM6raQL6x>B!g~mS%PG{$8Y?ginVW zTe*{mMy9G}chzaRE$KqIz{N~lfS^9BXW_HknMlHNchg~OI6il z54>>DJ08ci$7p3gD4+E%|3x0ID7USFXy5^qZNcwf8%#h42=V)CKk0J!hs5;l`F0Y} z)?ig5iPg*ve7-wgZe}&?coQdhy%+j$=X-6JORyxSts3?|@oC&jICSnF0u~w; zxyQR6!9eKgYPR6goIT>Kccf5+E*uj&WTyM>bGKMJ@%w8lk%vX#K@wL7Vc1GRlf9wv zp2u<>@2|1)Vd?CM_zw!TW%B$kWEaBe5Zk^nKr$&zv7aU_eMYTRP*R^)P%je4Pr z0GN5X`**rtl{4sULOKQ(2MzrAbhDmtecG~(W^OVt(uZ2s1MPeafi8Fk@$m@y2pONH zIHxG`1hPtJ%DVxy+QJ~V=VaoPc(PCroqNQVE)IhD<>0m(YxGFLOlNOv`!H7~9FB{v z^KN3E?IWnWE}NP-oDR}w7tI0al=}UWN^E1WfGXtly}`>RecXUoVkGN+I(E$QxOFlx z$e9&1^gEX-LsUhwHUg4NeYXaN&2*%uuf)m!)Q5okKVo%bh~s=z(xP5g#sxBmeE-)K zQXs$!d`^c8wA4I@WYC#?k0)N9n%dx?&-PsNR?!>6#2Iba)$p#rhnJi&(Kp;6D(VPZyBb5qa@zpjF+yWK<<(!*8Q*;pdUP z<@a%2FTL=muB9F=41;jY`~X+pde6erinuz?3 z`aV-8RdV|NQ#8J&m1^WejdnmDtTd>}s1<)?Wx8uFTKORI(y??ks@SYhQC_}T`)xO7 z%>{laoSxQc5K}6uGqRnk#zi%GX$0in!QaZSIZvgP2g0J`3ISCu*-*naa z{Bvd(9YLErJp8RB-+q!%sp;ARRyY;NwvDO=QI*K;28{)jcJUO>>tLqJj+~|xY_&U4 zxPyTAi6z>$@D?PnMD=-+gzc#+|bOQRrnmqYplh3w`N=^N(WimM6X8w8Nu6a@q4XY50bg9;er zm^!a>Y0e#nu|Rf2x&zM|~s=Y}`z{lZ`sj;u?XcPSOzZav@u@?LP4AZw0{SrU=?*WcrXe1F+5?QZvm!YHidNUsHY)X9vn_Lf{ZZEA7wlZ1_3MmHHqiS$Wg7c-SyyoLijU`H`6QOLU$|@5|?rH~gm@LU^uj_=++5r29pFGShE(7`* zj_`+Q<{O!K#Z3zm&>EKSPR}!#^MKd4lkGF@RbDsgWnNAsm$+#1GrpbTjTaBc6G-o3 zrID#yF{h9sp)1iz+lu~4Ti?E_8|psvt+gIZ71KF$Ee(@6V2>#8W$Y~XAuU>pVN*vv z3pCNN-MWVtxGg>T)J-b1chQ>P?&+plgW2Up$Qmgoe*2~Y-4hHQ3Ww@adJV@;Uj7kifFk_!dK}Q)|6u7@6yoMFmJ3KH zW>$hggc^3)rs>(fXq6g-OXd*hgSMh?PjR%$=UZX2)EOLWNPd~Z{3Vfg@ zMR|8eyag=sR17ZT(aoy8=2jn!6G9EQ(>3$3DSIClG%`*NZ*PTUQSi~UG^u?h7OBJY z&Yx(vjm-4P$BVSE+0Fh_B3>9uEs83YCVhYy(HQ*^X2L&2v)@d~715Cc|ELZ!{~E77#& z0T}nRS9^vU@9)cGH-lA851UWoG4`k>_h-ah8Dx_{FB0ni@b<&=tOFJgOTo z^o56qhm$b~c#+oWxjD&_>T1;e(KN;^ShJyc|4HAq*W%rbxhEM1$O`13j5~ntrU8xY z%kxuGUz8`j7PWbODL`WlRG96vBd=851C5hJhvjc^NJnRoQ=90%eX?$C41BEQau@(R z<=?`)FdH!Qoz)G*$nc2~Z9|Cm@`>%juY#PUWI5TQX z*!=gam+6>Rl@g=vy#4&^@;MtY)M$W@^2&lRaVt-YJX@r=FYe zTS?jv0gr#Lo}A3i&?^0*3wR>A>}f#ecp&`RY*3Yw3LorWXTe;ydh59}wr<)nF|_PJ>h)m_^B7K@9A2mfa*?&{mr z_b*<2fzKU@`6Acv;HP3u1gGJBaimHx#Tw!lzR^K0NsfF!dF z=GQZ27a-xrff22vRQh0NC%IInO!{WCUoDW{99d<<1`^}S+yrW_L}aPn8qp>}QvL{0 zP49u%dib7JYIR;L(CY_Sxoq6IP|3qDPQ7iFPQgiaKq;2c{>9Vr5mw~x<(i|>;%d$Fv^BXdiI$K{8 zUePn1g3jk85x?qZ`1q5(3aal4Q?2AMgG-QX6ycb4IB_Zk&^h}N6z`<+ z`lRKFD41N|X=xlmNwDRznGTwdZhnQuQK=74K5StA8iqR4+H4}RX;fl2U|e8|S4>3L z$hoX|i***hT{&XO{CiVnr~6(gR>bWc(-FBloggLSSM1;rif_j6Evpy(g1#?eAHt>O z!mb+E9t}#Rx6!{bFO@ao$?OtQGcSMR;n6hti5q!8%PLn^D#}nPzKEJU3`0DMLt;7^ zLmVI_arolXcbP#=Pt~2wpPQNObYhQo{v=GX04E`+76Q}$iQUR!b-WeOxRTzkWWDMQ zG!MI-mp>hn8n`zzp75J3<*A>5qalSwH1zbw?1F@(%+amkpC2uW@-X%&H)ZbpnkQSR zSW-e>dekA7nP`vpBiCg8u`*=IGfQ@}miG+!eGo(9aeunXlkvF_qZvqQ`ySYklVlK^ zP2QPnCYV8+J{9ySEqxjpN*K>7*)_A#r7)x?_n`&GP4iRH*Y03EGB@C44KXE&xN{4? z$tt*WN!(+F#QQE**6gAmza!-73YRi}|&g&$j&I%!@p6DU_hw#YWi2wrp z1|AI-ZmLFt$PY}!wX|t@oozhyHPxVR^RY;x%!<9o8G4HEe2Rw<`)Z{jU=+JR#J?)a zY>Z18B$9L?I=`74P7FOy8mMrD8k@U(n>l^MPFeRZxE7gQCcda-`Lyjcy*}{y2iUhu z_!Py8fz_^-F6xU9;WIxYAhhmWKqi+=Dk|#;f1SZXutO7<&3U?z@3I0gk#3i(H!t^| z%}QTBpDa^j0qTMz899wMLS~^ZmDW+N3bX7RQVpVpDo8*L6QC=Bbe1M(=*eeQs~A@B=5EBe| zWcD^h?S}aGk(d1J$8uxg0-jp4kP|z1+b{!cq)mma9s&ZrtU-_c^?PploDAY7?n|4e zd8}@P@QrmWVIB-~Ne#r67RMPiXMWy>y!Zl7b7G~Ytig+}98i9DcE;6z(WblWB-2XPMm0Fd=rb~~jVU>O{ zoTBazE9Dd#QVM=Ap!Ncm**E^FinLmxhlCt-!YGC}C4$k^`r$G+ytc{&sX667cN|Uh zW~dk60~$%qEm>%1xK4x!QZ&$VKZtS$jdIxv*GD`UI(EV2z6b57<+-&k3Q1kdgz}1B zwLW7F?rjM6&VIl6Ad?Iqf~D2B&sYlbw)1KvXi`^9aOaT|5#d6`6E<*za>tVS`BBW7 zNjkRgNJIVsBNE_=lp`nSaS8&=&tEA1&_>^hf|ANcdLyUaey1&)5WPMX@rT2WF3ynm zEGn^yTjn_xrUQ6pz+2U7W>&37gqZ%ppHcvSW{iX}Ux6wM0A_m9z&omY+M@_+=PaCC zfey^TtgtC&+~;>ZZ@53;1ZFhU*PlOLPBwQJK~cmTrn_-zb%xyo*du;MISgP8sq_h$ z8i7B8M@h94G?H}a1g2ZDu{lYTOY>l-HI{i~Zi4A>4 z7NsP6;y+IhEB3$9($qAO+9>QvM4*59h$vdsuUjtF%j!J)!<1455Z25kq$kD`3*eOx z8h*@*A=fp1$ueE3b6esECw#8{17hFo!Bpyma1s<-qWRvu8z=b3Y>4YzevblT*ggx6?e_Jj zn%Q`BKz4&otK^my&v)E3oA}%>^4Je>y*AOMYzeTB-7hyUA8c)<> z)aZKr%__jW$Vg}f<~=XV3%DFwBY9x+DM3ed8= zOs^z4ATj#0cGGnO2)apcd*DGxEZvV6uiP%W&=tnj+%Mb5+jFtd^2g)#=jvI0v$YQI z6dFaBER-lOF;4GlpcC6}HA#}emkiwJrw#GtSwA|fPQ!o&FfTj7e#gw`6uo5#0zLz{ z88ZSWEzqMQw0R%rY8U}6Q|Er^XW`4NNnm_I>6{ZXk3QJM`TfC@4*d;Io8kj7Qwe;# zZ;HuU#QRAzQrg=1!B@S5h}s!N@%%{l$Ia{UDjNgX%3%TfB^h0p69Rx{v61oSa#F-m z(I4Qgi$m55#Yj>e6c!QCgRf7!Ujjf=8`*rWRhZw2u4wZfR`wDNoqAy(u8)g|SG^9a zoAb$H8_oQBhGw2(Pw`l5xUijs0J?q-EWm5*f8Q)Jm#$h7h}YjsbhRY zuT4NBQ5Q!JMYFJZBrX5!eO|Snz{36R-8*h>1J@tiY=zFg(Z{qxcUyhfL*h{zL%nt} zdr>hTA&x%wpz^HrY?jb&^0Iw(C`z&zOMlv-6)8YB8B+jy4dY57+wlTuW(cq;CV*6v zS4V(Y*mHbDOI7uJoOALFUk(vU0EG#sX+Ob9kR*@KmFD}~qJe%B1-9}>`Y<;@7%y_$ zi=OX<@rW2*V3sk39Sil8>-uF{bIzjas@l;XIr4H_9#}-J6y4KUHR~#gGjEK4y)$gw zj7Em8d5bQ5OUCl01uNUB5An5iqB1asxE#h=+hTdw9QeRP2dMt1AQ=i@TO6dmNA)dT zed`Wgq+T14`VO`qJ^+oDE(AHC1!gdb_euO)r@%f5tW}8zLHa&zJkH?SeW0QBUA<9>f+2*M-U{~Ny%R4Q zlN+H4@ZuL4e9v_opuF1w+WZG~1YAt?9QS!0gtyB4`&6m-*fT!E6k9hdq@thKGS3h) zv1$N-af!**`#%BAYFv8P?I3Gg`YR}sk76D(Bfh51lGCf!^dt%G|2gcBMf-XJX1H)P z_Ftr;Fv=T%?Us2PJNW7IXJCKZtOz2L%pD{5%%=8-D_^K>9=&|58{Vg>GUYMMWJk|5TqE zotV0K6p?90K(SYms+h5HFNB)csjzNV`!LS5*ycbu%Y|jkAVQUDUZhoK_RhOA2(8i*J zct39;*RBH=^(|yPZo{C6JY$ZY6DJCa6~56jHfJ-2ggy?C5k)3`&(tdr~VS4=w*uwS2y0!7Vxh4do zkPw{m+JHgT^{7S&DPS21cYgsBU={K%w0oXLpdLQ2zjzuQ4P<=lbiVyc90|k#3vDfP zoRgFm5LSjwnen6*E{gE+jNhJtksn$q@;m#OfI+PAGfks=IyC|@QZq{Wq^Sajm zdVh8(YsQ4K11MEdboKNInRr>vZ6;ynKG@heXL$fph3xqWKzsXT1EW6zwX(X}LMy5d zV?by%wQ|>RcL}#}k9W_NdnnLFYWqN_(P-s*VOv>9(86e))2idoyj~69*uiFN2H6FG zVk?BhuaCdj^T$FA4xYNPG!mb`B*j`G8mvyb_$gZW1Jy(qkG06#4J%B;Gvu&q3lT$P z9i&ew-CaElgCEx=4m;2(AYk6Md|8IgWRH}BQ*r7Xq9&q*8?5=ElBk>7&tyzr2}sU^ z=;H)oC=lT=criktzhlp%G3wSXybZ9ye*aB^(g;(4C0<;>SY*+@ja{k-o{}Fzxi|m^ zD$s56anZHs8R8J--Wc9A5TRn~Z5-Qxxw@bZ6#Vt*dpN}ci))xoGB}v`#deS&ktgFM z;{2SpmrgD63uz4Sj>@z5=>EwY@hccwzen_X^tcC+b^ZINm$k<-k*D&SfVBdNNPV4T zGF{UT(^y3m1m$%I*I7S&$)=KKeq=Y6I^_*)%6&&h!7=>#2DHEfQNTu3IM_`u|aR%ib86HFqtC6 zrY|sk62}NSK*2PYI_3JFP>_O2CGj`% zkMEHFK|f*bP;&-?nW9W^+X|ck4RmCzQ%mBK*rJsH*H$s0M1qnUzPOqudoUJ)^e8>s z!DRk`L!tb-ML^6i1zo4XzeXSzOwlW&roXu9Rn-uoTg6|GL~c`EzN3asS4}qvX* zLCKwLpGwZ!an{!tj(pm>m&>g8jaR*1twnhYKoN5pC)9~buXGvvM;Mx{596Pi-($12STb>k(v*saS z<72RaZjtiAuw()ikn@X2dg>8Wd>3uTr#*x?XakvGy$CS9@ zIOG|F-8f+!;h3IYN$j?J*{KXQN5fAAR1>Gchnx_3mQu#NQLfFQB>J$zKw24#SQa0)<85hc zyBsbKqGJtxzn0sK?fy_^2JK19U;FdOza=4uGfgy~PA1h@yxfpEHgU3Cj1szErAE4W zg|jH@U599RF$MBLckwF->TcCk*zK}rztj2s_2<2Zlb3%moMp={#fwUEG>i zchIlUIwRnGF|KLZpLy0312&dJ^Sl?aEI@mM!cGL~_aTyBD3)Be&{UO-|2-wn8)jW` z$AX?-Qpf}Gs5J$QUL1uhPt`WLzvdrRmkWqlh>B4qQMS+E0q{-CqpLZ)E6xSnYYV z<}cZlN`OMXWr8p`M*@x*w_EFHQWMdIx~}3;(i}de4|WO0!0}- zF}eCUIrm15Ob;t59adBjbFA=1tO+I@ukjK_M-><;{dk^GL6xs-oInK_Ni18^*@8t^ zZh*=8nL7nk^_2!Qo-8)7lq|@ZbSCM*>teq|(*0J?z=x)Ss-FzhVU>+FfsjUq7#UWu zl#s5XJ4@iG_-TQF=*c>oSbmOym)Z7P*G$u9ZzRdfx>30hptfIU6?*dPzpSYmrURz* zS|LHG0XoqlA0nU9EkA_9sNT3RvmTh7!1ppX1JMindYH$4#nC!I5FWqTUg?!AaDt4Z z?TsbonXu;7QzUGYA^TFS%}Po)+y;^K{RZ=(dFyW24m zIY$vNUyFOrC=s`rXn*c^IE56V9h)~sYM~a$wyBDd09C2Qc$|DBY=QD_;a*DE@F&2l z_fDC`OhBPi@VyvrAg06+Se;@#Eb0$5hZGi4WA}0tT53&z%#?fO`~sEOKltPjHE-6+ zUVJA8xb$yArW%8DpVDI8BDKSjl==B(BnSQIaU3nz#vk-a&xy%)K3<6!$=%Y%WFF_x zYUbBlNVjE6Xg7(22Z&{DiEWLbcgp}CM>)I#^P@Fl#^nYd6;>E`RbOV1wtpq;U;;F_ zzjO+Lfx-eW*KSBR-xcG-4ouSs3CC~DMN|QQfprbiytzhbYpQDEI{$B>b4v3!_~JO3 zrKL2**IKI$7Gok$vm(7wsp%}veTcNYKek^5Pe4-rrTf(XRHDsv5Xll6P=0STdE`~r zc74*xvzaaBV@6z7fUV8}dVngxb{3XmK%*u92|JL%eJWoJ*sY+_G8zXobj!JYZ&p1i zxk;~j)9JhS&dPFds|nT1l%#+JCl*Ih71BBp3GoOVdOBW$C2e(`Twj@}WXr!*hB@o< z=k`}3T3+2r4z%>+`7fZ;YuQZo{HBXe8<={cdE_2q%pgxpwS^}}{#b=FVtPNY<0ejn z3^Pn{h#En`MouCDvktNbVBaYwr>tv3)xB2G%RXY!saaiATi^#lOepwn3Sx*OLGIG| zct9=O^KkX`7gh$S#~M)#ok>O&=FJIN7=f_gt&UaBS6~xkDHHXp!t1lC9C%k+{^L8Q z-F(7A7+wCD^fwa5gZa=!*x)bA^Yh=?!WG$1*sH{FR87=Bii7RMP~yNSOHEAv3#i|| zgJM8IxRQ2NgVYmHWLrG)3$Ao_Z_(&1LOpPe!I!hqhglcR1?#SZ6a()O3Rp;HFNOg9 z@rAzgZ`0WHjcBGKY9LkmW8O-K{jc}O8#nE6EY3^|t8j_+BynpSdY8-@n2j(5XiHzf=+8|K3Ql;BRIC zaJ>JeME<|L4N&~p{P@IO^G^rCMRM|g6h-@~>PpW4d`+eNzke~DsCu&@{%Yvg%|K-( zbsv5*FzjMC%>!~TF7mKp?$?V{$$)JH2Tj)?_|=9<)KHYGum1x;v31ro z7J4s^<|8E%x#ax+Vu(Uf1#kCAU?ZKQ^XYYi#Q$Qx!f~CO-A}bVeka@83380hOx^Q$ zh~)f0lm&JQzI7Qqs)bcmjo|Q%eb#EjApbk|(a1>M6Qshts==>xNK$OiINE^D&4MX- z%q;=f>|YlB@$amvqK&U&p|dpcVg70x7U>;U2Xa3^@*>$Z7c=JJZhDC>Th#z3XQ6o5 zF4us71jCM*t;qg?p%RzbBKWluib|$!8Q9f2@pdm3_&7}4Tc@u7wq{;7e~!u{s{#|B z99%%HfJ5cWh&8o$iG&$wuJG7}+J%3Qh5hY%57Q_&oG7jm z?qz&+Rg%Ni_TbIEIO=TFpb?2Uq`AfuM!P6q#hDBb6;hF^?DnvN+o5ALDNQ z)Hv##@k}R~sjm)ri4*TV)YRXaF{?)vmMH!6wiWt#FKQT5JDMx1QqC!U8uaH?$^Qp? zUl|rEC%q;w3@N+_MuAR&l!gMid1-5nwzA|a9z0+Q0P@4@$7 z>sxE@wfC`)@5lbL|M?L-k<2v9PdN( zax9x{h3xet+i3?BrI<|BkJG9y$9U7zWO2SL^L6gOitk4d!K`IPN5lQ{s#X5n`W#79 zVQA^kahPrFr?6m|74Z);dJq>I`!a?oc;>NwjRt0e$!6ob8d$pm$9YeH&+P_a8yR7c zT+9DpO}dA@zwc)Px=F7!A^p4JVmOf9NgbA)1<8eaRS}SQ%2S9d6u0VwMMRb;1%Do5!FQ6T*d7 zlg;)e%x?O1Kh7{(oh4gbY>#FJ;f~c+qKR}<)b)t#ean>RUFS~$DDJQVKSB^ z=wA#4n3eyo;k76=nHkfaLO8AtR=l%DEWbfkCqme@E!0XUJas1=r!U7!!E*U)Vg}MC zRX&zKdNpywh|6&7&tbssY!U9=z*)XA7xQPK02fHP%5oCnZHjR8_4R~aFCuB2QI+ubPCm`0)gGUR0hWOGpN~J-NJ4%mi00b%pA$)z z*r?W8Z=yQiwcNfi6{f8Z(q>!zuK@hJ zxRaiPN|u~`&2h{a4LCJDc9fsLecMEQS5^oXKrXoSsu1YnOr!d(3ba*o&1Mtg{g{ho z5q8+68I<6l_xtdgx$F@hZi6`}AQ|)qG0or9tSZ5YqEsr{D2Ftsf@;R+6`0@3$-26P z#C{J<#=rW9$kqEj(@)-q7fW`YEWUn-p%%nsPxX--?++#Qt`soFY^c^`6bRE*OQ0*(P7g*)igjC<)QgWQl zH>l}jUt9Bzk2}818L{x7?v!;sYMY-?u~9$_qfo4Ch;k>o6ZtZa+`pwbrGAj=(J5*$ zn~Y{-Af~>fk5%(r%;JSU{Uj?P=8IT^mS3t;^NEP&sAhHy8As9=op(Zbp3uO64%H#^ zr=F|x<#EQVi`!O>q@1W%v}qo*wjo{fJszGE?-{~(Ys2*;-H^gsAa~}VFc6oBbKB4X zqfYu{lthaLht>=sJL2~`s+D{~J7l)IJD#?0knC;wuxS zZ8#{#mOO+scvkTp9r#38F;D_3m|IQGFfKf?oVUAbM4ZT0!In7Agn$L>&V4t5icKyv zD~b35%*lw6EL(;7&NAnr`=ak|FvMBUZWx^Nnx_aE2gnQSJEPMxzot7J3;4&(0mZU< z?^~kYR|hli&iiqYNROi@fLnng_W@(4pRr2}$0D0YR5_WAhRaZz1p{9~p+-x*6eE>Xn_) z`tV}h`9q3X;>e3P!esgPo+z4|Bf6NTc`cH+ZownDX|xbSnL8r^3SrWpWJ5E1fDoF< zka$gPM1RsI+Zh4=w@uk0X-rA;i8mifJ&X@hXA7IL+a+_TX`s^hWE+f0RuR;9(t}Qp zEBmYyDlMwDI!-{1Bc0zKngrqs?+6P$*0c{7S%RxIIV9FP0Bc;%dlg#h^#c4{Qvm3JRyhqKp_jWE@{Vcjcy z(@Q~YU+<&-WnK2SrVs|C0qIJMozn4Iwtu}A=WEZsm9pcFm-b*n>};>~VkPJ|RGh~U z8rcldnKvsCReL!@d0UneSG}}igjJN`Due(%#HYBvt&>p&YsqC)lqES zz(KW4VvWu_+?5dPvjpaTPN?!vrBOAUg~UH^?DD6c5&723ME;$cam}0@-?OfEd~7U1 z34x)`-goO)dDEHV_>XPh&fY~%VIZ7TsdkJ}761J1*dlQ}Q&izdRfzVT`Nw@pd0pK} z4KSaQ+gx1Zsf*F)x+FIY2Sp9)MuQ@Cyr>1lX?O=Mic4k~WOBMU1ztof{t9fbO&N-X zXQ1+olrsfQ~!-2nQ9IgC9HGS(8R@oGk}WF-D2T%#8XTl1`)h&+u0Fz1U5h3-^7p z+AFjBEL|Mlp355543TE+W&|6Exj#X6P_&q~;mpOyp-M*YqI-DrvICDkpF)c&m33u> zyTna$U}E0VsTnUCrLBN!sVzqm%E8s-XE_3I&mNT)r2d&6ATULxO@qI+@8aPG-CgUJ zw3ttju?2EKX!3`o28IC{I2X@7FvN#Wd(u0Xrcw6vCz><6dtP3c571e3kzj6#5k*T) zkj=N=(FuWwgYEF-cZ&MX#E(5ZT6@%2I$C+G`tw5>EM}!fWz?YW#TfiaU#;(Z?vy zl=Cn2#uI?vuv;~9Yyqg2<$=8TyJ5Gb$6|Gh&|gnK_3s)}esRHpyAJme!nvGZ zc4mSZPLSzqg<57t*tWA+Jg&;RoVowRrsB9hcTNO@jgmM`X>kB6!9w~c6H)^*GCJ?uHR@BElxV%tAsM2Fi$Re-yULnj}a*M(w2wQ9q zj@@*}hMNJTV}Hoju7%ZWjp;OXCTGz2nehe%@Fn%o^jtC;(~FQ{jkpKmX}RjQc^$Z zqvQ~L))i&M;V0Tv+VeRVH9U5+)wW7YRQ9Cn{-#%@4V3#I8Ox7pYxZ+_*NBJ)GCx~1 z-`zFJt5hpII1<^OVJxG&m*AB|LY~gmR%}6VKU&mRUuc|y(vSxYF>>ROh7fJq%3jr# z3-PIQYSh50!aYvq+TJAg{$+0%JeUqvr!=o!j{2QCfdJ8D_X^wY9>^jQvzGTp)oLJb z-y1aC;ja=QvP^-<8Q$rUG6lPdgv?!u?)hEUFQ`L)ALi;GF3&JNbo=a>XRaW(rg6D{ z7F>cNtTFUpRsy009HYXTn-ykfsvi^4GO*=1;_T(wC+P2?g_h7}hzFKUH`y-Sw%-i* zym~Gwno}bjb3lMWh*F>!->q5Z3*EhE$II+ntSvR*WJG_?bWcTuO#hiYSM}%BKrR(? zm{;<DxPBuW*pz>IHr(p}HEl;(E))pszoZ;8_Q_T4cSS5; z{UEiyF72~h1B-X!e}Xafr7;bD^EzbH{BtSaqciVHyvTn7RhtV+eb)+yT+)&gBw$?( zu{Y;h=j_&tLGAYp)PSEBx*e>44#PW-2f&nEWx%1YVI6qQYnh(R`|;z)2OH&X_u%QJ zzkmN8LNg3^-WE@7!UI|Z3WhordR;!261$neq4DRz$2#pa$M`$S$uobnh#`|4Owb+a zg7;4^g+a4MXjmsam#KGDYZ{o|fd<04A!2;i+~n|QNJu`ani~RRZRIYVuCDHb{Zpi< zPChjEl^Y@nvsu)zBP6=T;m8a@=2kYDTd7a&r2J#vUk z=|z9Mk~E8|i=o+}q+d?nO6EyK(9&$>A-h2k5Kq{>f7jq> zL=Y{*GAQXnHp@bwqj2wP8YJfv(tXVt)vkk~Q%Dgl_qg9}@}R)BOYA1LuKjVOg6|%HVA`Z8R>e zz{N0G9Q*k=7i{6Aai$RMl2H;eGN1}Ff^BfmKC6y*sCp7VFzJLP(woZd1rRa3lc9k^ zcIAbO3`l}EP1BzdTM#P=->Oco=Fj)5X~t-boYc?`3rdnF3~AZ_E2Iqzmyf zo4N#_nT?{lL;^41Zx5n_-aZ?X4Q)9SAa3JHDY~7^qqTj#?j4Wx}@c804Q2 z@rscO2T8TpnH;jey*dq0C<9lBL;pRB%Yg%-0#JR3{HCCyrlwY8^3d2-Zxbo^4vzz`%EzqzV+ypwVN8Im(-s6(q%BDstW^W>88Z&O;?(uyG=SbtQQh9%YXBn^VMiM`RJTm(j9e^IrI2SgMra4<#;xsVU5OqbrCxb{&9%~VsGz>vuuPCtD3cV?>QQfN%{^P~t`YE$-ih-+ zxAb@MJMN@ke1&IX%#Kw1zS(*#w}$n`u+C*6Unw!WMk?LAnx$Pq;#8CK&}&M_?4hKT z`$UJN`9m|a_-?ams9SRN1jq`)v4MhKmbsmsos?dVneqrJM=a(KKou22N;aGWUA-dP z-06kRbe`6;+3lU6X&h#r?r~|3VXC~y6msqn0RO{^Qp@?6CYblBGTrNE36P8EEDLZV zt*)=9WE-yAxovuar?q%QgNL=VVR|L(j!_pA6EjYFjrLQf%VWh)U;+?D zd0R&s5X*~O2AV6qg`p)-eAg>@*yRL8L(8@e#(rx(|}Wy zMFpc3eFj0_3+47{--N;#2hpWK^6gW?2#y66*}~7h;&3M#sKqWulnZRNgjcBXcrj}9 z(>Qz`m?(3dF2iN+%SG;&r=tlOH?^GnG>#erzfVi%T)if^j8bW&CqTVtZ`<`cfH9ot zb~U;Hp^fe9pqp>d`JeAuwLH$wgZG;l+y$yuLdT9whKnPNT~biCy%8BAR^yqx0rfu~=EYhXxo*l{>q6NU@ZY)32>g zr;ot+~_($ z+d^m%vAnW3K=|hj0p^;Q!f3)(Jgc@xXKn#fcJo{Z2_a6Uf-!dEhoG7(ejE;PocZ9p zCPN>T(T-utO^vOOgu)vGb^s1<{KamZfAqc_0`&@MTc_Fqd}7)+l1{h3mnk6ZsD?}qjY!ps!}vf09nju3+KdGWl@?yNz^-Me~B+mdTogR zt8uUg&)e{PO24U)^B%z#R3Q1+9~nOPlwI)xZuev0)wg|s29AHaM*<^f3x~PuUCL;H7+C>JDY5|yT>36BlvZs$wWuW3N&+7pLS3Pdps1JK&X4Y- zNb3GX$}f)8DUVPh8avSQ9K(98utl; zucx%0vuf!81`3Nu>-SYgoudlbckBq}&&SqBRo3T@8`z2}H+! zcyHL-aqA~gIBdQ=-556X`SYOp$SG6&j_f-T;`yZAJp->QoTlq8#pwNh&b2hwT7O=! z<1TZ<><&YIQ+5v|23$I8b9sm@_9+Zc6C?d_z0s1bLcjI*&cF>vB8j`Z3%j3;?d6j40E!`iK-0!oOU4dpO!uNkK~d890yTxHeVF%nkUv#hS62?i&oH`AUt{L4 zg_U`M0duxfl3Cq{S6EXZr3B=B&( z`v{9-&?p;6+V7m#kt|KCXAlB`@22z5q=ZePMg$9{<)egKs#9pxy)YDjc)3oO852_lZmUIGcY1r4&57VNKw1`wb2>LPT(qoCg!`_Tkdl9Fh1ljW+aA zdcudJST|_1_sR8)+n>rZyVbz^u@akaJRtqz`i2Hl*!Ci-;2zqCA$Gh5`gGiQiFa?j z4In?3H9WTF)(M$q+n+DTpDvxoMqd0_nxp-GI>T$f-6$ar4rjdy!eEvzd4f1Dti755 z1G5EU!Nk|eCI}3ODi6zIR(lOd^9Qrc5oX-{fbhKP#`XTC5Q6Hr8HC?zU4p`?_*|@z zO$%QerxV{~$#vI;BX00@KqEuI4MT)fw;>;|hce$6JEVP1w4 z%4*;7i`h!Z!1O}ZP}Ubzk)DQ-#CEQ-Ai`{Z0m5@BbOd&WZPwNZ&An(gmFLEp{Mr`p zU*-~(rEw86nU0tH-wk(ua_5&K)9s-4kh-AGuu{ucic4Q2bW24L6D-puC7Vtna(x>W z+t17oqZ@n0@2&l`tBrMd1|*|Be{ucXX_f?BC8efmRQ70=*JE_~JGJl#y!3U`A$_7z zb9q11CcphBu~B#KjO|!K@$U3{1Rimpub^b3$b#7=uS3*8D|U;6xboDY3tpdSZ-$`t zEr#o?slSxd)`T%B(D-6 zzR9@Jaf3qyH&o1uT!_JXi5*Qt$hZxQlq2$7{A`pY@^$EwZgRcsBwsUS{irP61jNufKu&@m)xcEu4*7sm6R@Lnl;*%!e*u>zL zZsX^sqJ@imfaId%k--X1xCHJRMz-vvkWR^|*vVwA70r{wa5YIVTvg4jP767H?MR2a zA&p|iMN={Jdw7HhYk2Wc3|=c`@1UsG(?OS+!Zv-`KEj&Bd()|>s4*FYTEcluWDkpI zFUvZhpit-&6@#^j{sx zn)PBYrgBQj?@!LZr;-(KspE40I?Pip*?V&M_0!|PYj=(k7jgLxx(uCLnNgyg*&Ixaiv+qZ^Pq~LBu{J?IUtv zwbohDH~OG>w3lNmNdckr71G+`@zFg|Pv(Qe^zmcu&!6!pFh>(YmBanmN47j0C}A1m zi$53y?y6t0wZe9)BOevGi~?XD0S!9EGr1)N9Y7vn4mZQ&0Jwkm3`i<5a+qF9Ar74E zw5qZwB&pPUWXi$~3mM##y4hTR-`FkPHbSfa*-{VzU;k3*dAM~WmsM5(B6}Z7#5htV z5oQ5SDDwMQS~$_?@QAiBgF=_^<7jT!wI`sD1Be9!NLg}WM!W|lVd4fFS3W)?TYN3v zg9pwR0xcUcUuzv_8*D#0Nf=h^V*@8o{y`rg7zSzdgK(VSt$r6zIFu8@KExy^r>`&e z6zRRlRzYNWLX(V=O*a7d;WE`&aO>oLR905=aRxf}_wPr;M&5JJpKiC9IrmpKvzm!0 zVHN@dmo?ab`aG|zs7}eag?-`v&k_cJ8O0!0W&FX0f5$Te!gNI=?6xK;Z0x$LSqJa8 zc9pBHS>Su%{n;dK3wVs~oHE+##){|9%Qgr7-A3@ z;{$0c6nru(Vqr=1p9(5{K~@DAP@j=-IBullrxCcgm^1{2+G?pWgvu~Dd>eRr6oPkX zp@2O@`V~E%SE?Ap6_Zw0MRiLL{kvRN*DEy4$mAzDd3Z0V3gkEr4RACS!2wJ8=i`ic z-A&J9)J1u1FJ6@2e%QooKheXMW&8^-GGQzV=_N+v2EFd+v)<*d2Xqg12<&5K|Z=~v6z7FR;dLxAXY$bVF@dy4783H8AG4ur;@lTPF47)j!WhTY0jRJ%ai$t0r zp%(2y6RxmIi%|0LvUkcMzd8MnueYT2tFtu@c|+AeNIgIC0fSo7tr^7tOID(k@Z`0)D}$&4m(UFL_|Dio zmL^VnV>V(KD|&&a5f@o_@`RI*?~k7_BGH3M&x*9GU{h|tHUC?6)hq-FkW-%1DxnAt zbY}egF?ki8p)iA} zpsC;KHusw+Td>cM40bg~;J7?)JK8;XE;vD0O}TFDM>8M4okX!DiTo-d&`g#OhjAaE?@!O#&&Y;i%;E2Efue z$7*j3bHPK)>8eU_Dqd4ifzvK%FuB#_k@d2K zYIStTgbmTc*(fLs5M4OvEWt4$u}Qi^TIa`UN`-m*q6YFRE!_{kZ4TivV&HVV@#)ij z$_?P%p-jY;;Upj^(87o&2Wfl^jCM7rA3^=}o?*n&Zt|b5AzEYAzdrIyg(u3m_5u>& zb&$ty0?^L)!k;v7dsQ2SztgH)O}0?D%t7E(dk6K>k%Nft2~(|U{O3;|`0<#begiXC zZ;Yn7gRDt33ohQJBbOiLQ_x!j+f^O9r!n~G-F-$`J$5$$(p9_sy1r%Le3j$;i)Yk= znB=jhEeBOTy3xZS5NqlIYw&z}sTT`X;{_5{U;i)!@~8;=FqsR>0^F<6c0~}Y8Q-l0 zB^tGGtd3k{VU%^A2kkr>$@qLdd-ROe7-c_@9n`a8$t$YaW(OzXRh7x9^f6K7(&BY+ zv8$HT3g5ONkv<>+v8gE%icX#StQ7`dknvSi>G;mlLaoPqTObH$>s0Y>KP=0(5C_Op9UrV4RLck! zIOzH{26)i|lM@pHNHq7z9FVM-1r5S9V#QC_kn)O1IY{z*gRJTtd@Rt-%TU$icY zxLYtXn&2O}DtnZNtzA4L(q4i2+8U3(74xALo`~;xTL)R`tJ`G~(VAl)KEwVjH3}fLp`-FqF|>_7Ml$fC ztY$cuSlCR}EFQyx7^)dKD|!LPeGd_2ILM(DU!w>jV8_wW=rTkw>znJya-CP3h3aPW z(4j%=^t*x9KBjnda%G4i5pEvqVz1z)grUt69HN%<4$}jQS#7Dh&_kFtDzlJYrEcpSc|NE0d(nL4$Z!!g`pK)0O(cI zH&m)$01nYjm^tVEN3)xLCevG6sEw4asbRxRDkUgAtP_OVoMnAX7&i_O=%ZnPpd_F- zX_OI$-Z#BI(s4PGIJ_c5%TcYP*uh<3P^g2F#@{W?4ib3>TsW^beepoC1r`8O{Z>_B~~GmJ<<`3xj4?WM@I+9*1h7-dP=rS;7Sq2Dk-(fEZ_v;ak3 zHdKb4Vk+sqWu;UIZCT%1Z(PWvP$hHqN5m+JcGo>6BebYwu2WQpNZJpFxM{yT8P?VW zW~`EWf^$3lmh}KxN?uNp5?2Z$%19@@CKH+&;H~-12-#1LlHAo9_;rY2!x6bDjq7;F zi%}}1y}1C0wQRiqYGOHxWWDJ}O5&N1&|mIgUp*C^B!1Q&lq5y6$kxhawl=RI4ehP$ z10E;=4w?P{Q(-hGB#&pa5*~3m^7$8R7ZUJ=G8S2Db9wNFbYvf-3N0smUR(2YbsDgt zf-29ek=qg^XnwV*7gNs{&w!w0F45`cO-2-p>|pj)vl+&yn7RTop8>3}H&ZhZn5OxT zEd2`&2fXa0NOtsV-}95Dl)7hS8|zaF7dLtd0X#DY9fxD7SCEWrJL8p^E~{ejvJ|cq zz9;{;M$Larr2dVc{cq%A|NkTYb0Pa57XNRk!2db5{ofl-*@f_Ki`5Lz%t0$mLzFup z?}{k}7D29LG_A-4kRk#Mw<6jIO#K#_k!c_alyM8_#2{BmE~M$=a0aPs9-EEL5OuJe zsQw~!7g7x}=^7Nc?TUi_B6ym_Dlo&`4tT_u_(RZ7Q4@JD@{G%s)c5Ipjn&ps`GUiO zc^|d!?hWy#Jlf3Y+DSv;?|;GekPbISE-+07$Tx-{bNxi0Q+DEy$D<^$hgPE`Xv}BX zH{`y>26bSC5l{wkMeoSsf!nN^0h`44e>EE6XuLnZ&;l%IQ+M;sAmRVEdXPI*zxpMf zp59-_@MM*vsI~fO38;g({qacDe@;kHcF7Yz8O|p~s>(jbV~mwWZkZ%%;N?Da&S!0!f&IL z^Yd!ZdQSb)H2D1UUOex0D5{F{?)_}i;G*f1t;irqv_uyv5Hu?@~CrC0`V?#7Nt!XqfMlqj6zqiKhASBOu2IYR}glbN>!=p2lmF^ zDhAiPS2^>SMCo`uV$*OTmT^y&XAh!hhL}KnP*923VOM&akk1cQdFG`Y^kzVI1k>2W zD*F0$j@6e~#xE8LnZX^KAPE1)tK20Nv6>9I=z5zNsM+{Kk+mw3O#L!z^2yz9|3xM6 zwriuQoHkFA_7vHB=$E4O!9(Oc$>M%4$jTlv{MH__R(?HTB)5>BtY?!?ut;VfHIQN; z0|BN_-L&^%xDK1RyNb{7%HAyVs8+0BX14M5XtJt8CYIH|?aF??jz$&fVXUz7`ezs= z7lUp?5s2%jYW;{!amKNDa~>g*-$#8N5k|)>ehH7>jB*CddR%V{?X^C7vf>g|b_8?8 zr2*kyhcLj>fq+4`b3Gm?IXJWwU^q;3S&x${NCE9|9n&hauov_q~G zFk&*Se#vg9bnYQ3a%vYqbA3c8ze2Jc&wWPCJaqtf5gDg9HG|3%pf08<=^$#8*siCu z1o_0E*SGw~s_jGn@p1(p5>P;ssD$Gd%Cj` z571D;b_F?!cNh#G``4X4!Y2!n8Uej+!(V_#n(abL>i(X%*Audbv8zV-1JN7j-V1qt z3+NZTW7xf|+z&6|Ctl%Uv2f5yjm{miFxTLZd~A5zK4DbXyCkQ%fa@B)#HxPTLbFQ9 zu%~{#hJq%#oKaoa`lFHw>0{YE;-+ES;xCskv zPRll}OVR;q(7;lWBP~^k_@e}5zj=O^5cr?VjL4)(h*WA{gW%V?Q)wKc>tFoA>bU(I zW}-xk)tRxL0#1C;^{n~RJ+9xVK2ABuSqD|EvyEoUFb#mt}$z6*$X)9pZ!Tpu&W=+SXBAn7zf zP_GwNu>rtw+*yuJ4#&jE2x?eOe;PaZOdmg-`lYViQci_9Vd_=X*d{DnKGAE(SaCNT_9}PLaqnnF=Q$obak=ID=2-} z0Gdavi)}wwH!_+5wdA4)8F=dX;OBx;53ZezOeavUHu!1?`l-f4B)?UHivRetZXb=1 zK6F>yB_erhC`?m|!!vrm6Du(kcaq_oen!DJTMP2GJR_($oTpqJpb6B9&}{Rea-*pF zM5w229xv|}OP_ZEVHd_fi@%8hOWF$k9LCfmtVqeoXebSJP3Ts2Ly1m)X#%hW2>nMk zKu1;z%M-o^G-bCwGC+6HX@!~l%$T9DRDTpISz;<|AsS1viQhzlNooeqk|qFGmG)N0 z;T9JP)$%CJM%q29hYa?YUA17_`c9%{JPkA4gPrdXj!ce^>u739VXCpJ7$dq|Py=ze zaHwA9VuldvXjo;U2-gsJt_3gz3+F*vp;|9JoN;-6RdI=`*%EXa0u&bBOkn2E&fqb$ zY`!Pb0}pbE@#EGy>Cg~EpKaACU{wZ;XxB#OB%rT9uJmquZrD)Ojm*1w#-CK&=#h&R zNfrHx>qmOmI~wq@iK3A3G2NX%3rI zsrcZb`)4cW9zl?;?cO27PmlmOpabmQub%(>BhdYx{4X#0@&4l@@;@WFCe}6KFgfwh zKRRq|H2#-&ib*^*(X;-Zpl333{uj0G0L!AB+I0IZj}B7S1mJnTOGdk@d;FEku)enU z;OajJcz*{Fk&_LuMlWUI8y}DY&T9odl>0ZuL>zm%PLD$x?Bc$twYnaNaa~AXC;>5X z`0ro0Y_0`^kqHe(*+7n;5JJ-+~hqh^SIT(Bpqe5bWA^QmlE$({F8-fP2UGP7J0x102Z zat99xd79F_gMB6T7|1otKL5~tAhtx?DG_3VheRzd^G$$?t$`FMqz+U zlEWpHY;7p-b?9ZK)$T7a8l$D`U@+|XR-^0v&$leM&p!5v_>1igr^#Qer~NjqyZj<0 zSVpy1v$Cz%x<}vYOuM_G_u__ukPDLH`ygkByZQ3{+?~#hMQ0eQKM|%JoYW=D8c?Nu zPY*zEp90>=muTz-1)!H^N%Rjsi5wI%*#K#!wq_H*6p`F@ftx}^S7cvp1 z9nb1b+4Gk6xff`1e*Ti&Q-&SqRoNfE&N6&Z=ka#^h>EvD%_TsM8-qehVvs-d*2dCYPYbrC*4M8hZk(bcpO7u%=)Yp%I-BDE0bcTHqP|YICI+E?gkNf(OO2WFQ zGcn8GMQfI*;*4LVRd_3!Zc2x#oi#b-aR7d+^IWs{5u3z`5)`PX4H+cnJHax*A)?{n zAJ!Hoa@P&L3~qEkBo6I_h*i_s!2#h*VsSJ^Q_}3L3M(7%hyXOTL)P4*Idx z+b-YTnvB>X3vw9i4z#Q)7IcQ0Gnqeg6gGeC+J?KN`0SLJMJeWLDC>2wX~svY%Kh+? zt-N>i^U}7^VFb!gpqY%m!ZkqcPx8j8LY%9FG>)$;T`jO^UvY}snq!qBriCxZ=#z!> zy(?M;+U!J8ZjyA`PiP}-j@m)TGPc56YxmHoJ=lkr)##|ycBxs|pHwKE-CnG9zVutN zGg5J^*J(4@@51eAw~LoU%QLU2QzP=f?YAc^sBaTl9Pq zq1t`Rc3!(7@gdmY=EyZ2@kw0JZ{T1#R_nr-)ZU)X+h(&<{YJ|Qmfp9#{N}F3yY$9q z%sWTg=SA*jL;}{w;gBP*?9Vk-RlLvIu))x#N^pH6$sMJ-H^1#HU0`9PVpmE!gB$tX z5KSoEe}D#$TFl9P0n%(`k87q#iEjbLL^WkXs5%*R^rlV+7ST&3j6=giBLuuJevW9y zdr9)lXm)$ys~$Bf%*Ns*u#JWahOD4DA{m4ZP(O771xIME)A1~2f@uqI7{W(ehglKn7ae>bk)f= z=`LDMxSD2Bn!C+kZ6mXNKnJ~GCUDB6XpbAI_-FF0w?t_7uzDu-hzjlYe9UV0{$y&R z>Dzq!7yq%yUFjrtk6I9R-h7 zmTRu|yR7Cfr&3y^dmzOUya(l*0GEa>>aJW?TsjT3wJY!eVHb7 zQl>Y>+-xUuoS+-J)2)(v-_4%gKXO@w632t{1lJbO__Qs3;7S<|KH8n1BOOF@Dlzee zBGe?P9iJ-B5Gp@+yZRE?ZATmY)1XNN49Edzq?f(j^w53FU-bTGlV^T>d&8!2P5XtK z{--tKH>Yw+&g3)kGuF|~syK6_+wo(_D)`wL$qaFdLez958`U0|<^=27 zY8o=TLs45?y=Z{Ae4vHcYFfO!p$1vH!_WFNHS+!`a&j8>SQgm0Bg=ib;)31hIKD7> zQ`D7Cta4frNDaz+je$ZG8n~@o+gO|a6En$xLD?P&KTYo5EQ+oyOAHwW`bkY?X0Eag z5lgd=jBt#}(wEbO?q=dB;t`aoENl7dKLf#Vha-2$TgTVp9OBy%FK*IRr1AR=M2E3S zT+Qb<(3>3DC;PciQ;OAY%(A|ND4cj0%{ervb@iIf_#4mUmz#s869k zVkB_YYW3)o$0K?vErtu*K0nXjjHym~8ZAGUI#O<1CHUqlHji*bDf1@oaI7urTH*%| zsq-8@S`Ig=z#AfDwtKgTVhWFMkdW1X&ATAqoe}hJ-9?lad@$ymFMGa-u{4k9%Qbm0 z9kHxVk~BTi9;@}U@~MZE(u0OBVLS2*D2m|@%x;FU|K`tGy@55jAr>|=&K%PMrj9hr z*XcZIy`Q$=^z7Eegy`YWWLOrJ&&M0@>e$-cr&~oyjdSc|?NTgC%(7VB?IYs2+!5pn z4e!a0^>lSlyp`G~NUA*!fIB!-yI1Rw{h4j;ZQM4|WY{xNI)vSpS@woS6M*%U!_2ESd5f&%`0b>IyQj+oXr4o@znq6_)z`i40D{l7>+KaO@ul>_i4X%-5}%- zr52F>m2j1afE|ZV@1CY%f1m!E{BXi~IytG_{;RXW#dP5c{|2>@iP7cHH*J531R&ds zAnzVy9_utxiQ}F`csm;@+;s-{ck9P<=H0>#cwNM@w=2q`ZLEnQl|j=F_7}r(Wup?`J$eIL%f) z-amYsdh_aR@o7ud^0%m)S*{Bm>W^wJXV8nX+&_MMTVO;L+;EbJr2p@k>IRo^8-HMe zMlpH=DS+y}|Iyxi21V6%>!OW_C?H4_CB1?OND@JEP=Y8;kRVZlAUWqu3rJ2XL2}NL zqr?VDl5@@=4Kz9D=FZ0V{r30mTea`Gw{F$>bF9)TyVqJh*O+6@5#|`rb9anESZKJi zAqHnX=j}BZ<55iKsgz>UE(##YU8!tq@@#NoH*Z)g1R!P$a z|KVQ0@7NhFZhKq$S3AY+)Vbl_Q~eNChXFE)q@{atFfKMr5PF)UN=DpdWZ7ysIIYu*#G-NMNoCo&=;&TO6M2QIMJ7&HdcetbNf?pJ?@9)HwFUE@W{<3Tg^`WhRv`CG=ebwjn z+KSf})9f}G<+XCveix`u$n}sof@JSbr$vaI`kYzT9oDsq%@_H1Rq|4H`}E|BePTsK zehv&?q7=&ndGzYFIRthjZ;a1T^0B<>gC!Q~uOi@VWyv_KkIFE)Md=>LesO;SS#*W{E~qq-B_C zFkZNO$D-Wm;9fi`>1e~Wa{WaM0GN>82|3`ro7^#dB(k8=uCCzf!!l8s$9JqJN`vW; zSkHI7K;ZT48r>QZWsAriyV;m)Jn0^$2A_(c@dPN`gx4zWFdY6l0adv-{lP=|789Od zNwl^fTcM7t>i|3V*XKmUw70Z*ZMl6EeN^pDr?gz|yBmsDCX()dUN#L}T`v+*@h)9d zgPf+DONj!48oP9$onu8}9BF@|tMuewb<`V${y%Z?;IR|>ivFQ0$iPqA)*Y*)+A(jX zFIPr!Z}N|Qk#;+*+EL78aEw51#i?rSjdAMHc$jQIos#FPL4 zemFtN$E4lAyiXZ=Qj+DeG-WnypRi>aQmh^ORoF)gIoVcuw5IKV}{~{`sec?N@$M<_s^6 zEYbfKti_M@WhAPbe7XMhaLLza@D|+-KP7?Y*1_xlm|LQLe683a6>NMry5nm>2k{|- z&+J=gVW)T>+?V2J>*Iydz!0n5=sj@F0oVeR;QIl0;;dlkCS!=R)j~*|i0e@zyf*dp zv_WQo;sYX;G)d@es)3Qo#`!oPXZ8f3P!!X>7`v}pLM%fXAg=q>fpp;U119Qr-Nz_I zMSt{|r~K8@OpK(SQFk%fL4;U>otD}~7nwxkdN{KaZc6Qb+TGvT+>6!on#Q6MFW8mXz)UQ1~0z03ZfZud6}BME^Y!K%Iz=dk&|t)*Nav z)N0%f*G8zmb6Xb1I`6>Qg_kLyJ#|hy_wKTt4?SCh3t642Va@2==QO~Jd?4og#?rz9 z^d5_ZXr|`pZvY0T!ra`zw#A+Zj_e?BPm>t%(0rX%p;J3!7;AWYB-0>xE_I@f}!}lxHz+V$Y3i)pcLP}RJCwhcix|EP@rMkW^=xom6n!JqAq;MpKy#3Yg;Dd zp8j5+V2YL6b2^k;>8fE!oY;iJ8yq1gdmU?a90UR#{EMceC*yy#ywgP{zj|Zg+7}(L z^LqQ{LhXCpALbiQGz@?6V_hFL&|3Yn@Kbug7nce!gJ(MlZd&5W7XtJV(+U|qvdtcJ zK)f~@76rm%dv#NgMf^2z8@rs9nr=+pi-6f?7MnCizXd=t8jR<8ssp~xgGo;YK!eyO zj7{-+LY+36o2=}FzwMrt*0?k$He)aeAL;G;7-G`tT~DRUawwD}qb#}>lDn>ba6hLN z;Ig0nWt+n34q;K2h~RKa`La-sc=$;acRr#h0LQ4ZeU;g+2+1O4n%+a(z#|*xEnC9y zCU4n|bKuo~7)&qBmM`f()gceDZ!-y+pIRgOR+t;y#*)kRuyx6j$)v_fJ_3VzQ}sSM z6d&&J_xl3n<|issE)^;*=6{g=kH?vvG5}M&zVjZa22hZ2YOA%)(Y~bYgY)bsvE@ zT-Ss-ep}wKR|;yQH=1?C-PR~gpnD1u4HohlhmHCZjfC^-jt#x{r}PFCp~BIeWPinm zzQS*^NTI&g_#1a&4i67O@#6m;1O`dHpcR)fn3u*)-b}(3(CJC7-C;;sJw!Hr<=^2I z>l!C<;tz|claI0q?Ozcfu0CKne7QGkJ%qvEzDL_QzQY1>AK<13baR<>KC*O0@BJ2} zXMU&jlfYki(H^;!!D&6t5L-Nn73D)wP^|c8a`8Hp@nmX4agC<8-#y~vS^ltIR z$B*V5dT*%7*#7#PDucPh$sk@b*6h~`s;`3UHH8rvG;4859vd5b zRX3PV4<~yqls#X`4YYaA`k{A?#2ea*sO04Eo8n&GPs!DA`go{CHJ~?M2FvT*p}O|c z)3`}M#DPme7SBtemkXf>N}s}vUTgQGS8;dEF`bDhx0DH_K+{oskqKw_OGz- ze7c66Ipdlc&Nzw8Y4u@B^cT|pN0AGSGe()$0o1dzf&;B_uaLRowK2&3c>AJBuF?lS z(};)mkCmmc^kjX~-6hT!Crk}9xNazN^+E9|s)rPztjKO1#wYk}gZMW(3<&+0t)TYF zvTvGGUXsFp<&qO_%w@cGx1WRXd^2V!9|w&^37|9Ia~D8Qu&XhGyrIhfL*9@~Gy?yo zhN8C;XzykI(I{J2H)``R(2pf^A^Om=7k$9hB4#a8&Q-NpoMl4eygPpBto!tLNM@>1i^K^|5z*n|GHDFXs=5E%Z~CjEsT%xRhZ*$+~GkMmeuaaBF_ISu!yx9USq%YgdkfBnQYw0ugJ z*;FeRZ~vOu5YVXHR4sRQ9qtOcbl>5dRkhh{3F-x~5?KXmmm8jgy^ptV41y!0Y&5&@ zzADSe)ReT4Ehvtf1&p#_Gq0$q04L#;#04<^P+bG~9ez)N z5(2=YenxRrU($PI_uOzBZ9sYdQq4`I!~SUbAUZVTb-Me(!_!}w&@>lnen?%-x%P%9 z=-}~&b~3Xi%UolC28lRrpbLX$Ao)pVYjBCPQR15)EXjnh`tkkJ*6s)90*pS?wfsfA ztXQ^t8lVaM!2mie7I3U%`V%Jq9k9|e$ul9d{-pLhbu#ue>>a_z{%VtXr34$@P@x_l0H>aUV zwFATVcy*g^9_v9g>oF@VX8}{NzNMk`FADJRF}*M$M6@27wLJb2%bS8KL~NO&9XPm$ zpAHua9~Otrt7h9w+mBXx5g8sJhn@5dyJMGj`RHpLjqtzyRi6pJ*s$b$=kVly8x8Cn zz-VaJyG9INqrcKO7lw@Dax`MXs>bZ8vW(2_1xpK7q2oF4zHjW>`0fDq291yk17HjE z?ykO}6;U>#iQLxLs$FpS*5B4|<#ix>%t2p28s`O@PQ+KH5Z0#nx;oN0=HF@w~s z9Gyiic)Xl8z+Q030|+efZoBQ4^(T+0g1^qFtJgSej2k9tYG|B|0#p|_cC*Qf4FDbk z&_6t0`T>v`J=LPQH*M|If=-_$Zp=uIzOxPKbo#K1>af~lj*aJ1&~b4vH3lF%3<-7v zVgy3JcVoV2=9hs(1N5PQXas-8{*Z#ZyAb-d=GpE#!pppYS9LrtJ1_JaNDzQvTmbRb z9o22MgvUz_h+!)Rbb@{;bCXS3QBX5#?R1$0j8 zh}#e8;?`mU7tMEiv+Sg=P5Zn>TX6Rm9ee%pLYDAB4w}B=@Om=@6n zn3v(U$I=P>q_<~mdxchBgUXJ@FcFVg_oEcQUco&)m(a7f$9st1pm=)%;9i)_-(fsO z6EcdvU=Z0)AxI&qWHTnHgk7QlW~|4$9*vl#wLhSkv+arJ%k}_tjSGytOz{(eq|Drw zGr@tEXRu4l;C4_@4D^qSf|zD%{O4ss&89j4A3qq?4lAw(JdHYr1Zboo^eF*gU!=sK zyi4WF8K~3tz>3X*xJMGxifntCupdL|1tB&iD-SpKDJC@sZ;qpd(RKHR@8@VLa<{$i z6{HN$^mW%K(UiAcTR5T_f0_n1e)3|QS0!J@W%~gsAG>C`g;qv5sPg>929D4{L;sR# zVO=W+L1r`HcJwLrrjl`Aq?mnfh*}guVGdugKJ-#~IF@*Gvw-h7Ivk)ek-aWNrIXC7uA%(fPhOZu6hn3*|=U=C=?3%4-CQvsl-Fy_uXwtA!;%W^&O9KgTUe zI_WaZluNSUtVqkx2-RYD&G&?{Q8u6#K6wbJw81%L%8K{${5g3EbYdwH|Kfccvqksr zTiLT7{WxBxT2(YuhSnyBUh6~rc&`JT!o2cZPT~d}ZNh*HF;lqGYxIkE4Jb_2=B_vuvvYps&4xpN}MfZ7L4*@0n zi=a$lf=gDu76~^xx0=S(boh4vYZzBjMfSEOOx$M0> zC%8e3OA-&%PFGs5)|%H2xVSA$vsO*F8(#>hC%=hsz}LHB)A$Kfqm`MO17qwJ@^SMp zMdAHSY~L^JvjE9QC%hsJ>)sxv@Cs2dda=&mvf6kxtrJ3S8#*a*SM!s@`8^|ClB3Wq zurxnF100F7_)Gr;MWDmBx||E(SHMrd!&9mLa>E90!REj`ffcrY4X>dL(Nx6)w@M9M zvK>@jJ3!hpF}(hiFCK=|r>Q2e!nY-oZ~3C|=4OmF{5Qo$6z@ukwh&`U z;&sFMu=kRfiS2Xb9&`;_c?~p21@&=M_&ibdakD}KreyPvE_vW5w>QI2gqX;%6n_@} zOw}>Na4|wPi#Q@NR;V{On3 zjrCIX#?;F&>e~WGssbhzX`|oiT#-h{m@Q)0FLtICW~-juV3*oPo~aTNG%8}cwVV_^ z{HXEdzOYk2d^fUi%-0|Gqiheu0q)m0ej-62xZSYRMia);^Q9(9xZZF(5i7?q;WQB| z8x2bnJaaaC=}}v6Zf@RRh+iUX)zn1> zf9aBXg?`&Y`&=a&6=uZ>6vT%QA*Awa>!rQEr~o-P&?ksxXMlY^k431r>DW|xhARt@ zyp|~_DBd^!e(mo5ryzz=RLb6T6*MF?Z8T!teOKhPvw${{eJ6LseXk!qL|r@yy0f&$ zZ3C+6Oh@wOZHa4NEG?e^`WOA}p|8{N#~~V>jT^<&(7B2|8q_?^F=LeaUchexF?)JvRyt5Z<|pu${mlcyq%GaT&~s7#|cQ#z+T z+y)e-3&9Ib?2tlUEerfi&jNr{rrmPhSfs-?j%mTTJF9KHjOq4+*;8*mq(O+J_ALj2 zvr+Z?XAKlMZ4!#)WM?Ib^E|q8_jhl_0^@yWxdad_El=S0_QOn8f$73T+(6)wl=%vu z6{0kx2w#BdKcjU2{>8mnU?yW>HO+<(?y1Rvg$cc8py z6(lC!z9p@c6o`c|B8^BFFqL`l%r25klkcE>!0R}yQ00G)-X^E)$}V(UVy>`yPx<+F z;^RQ_y-)+4qPaODZ?f&cJ@+fpst4jbiolhlH7%&!m71E_=FxQt3_Wyo`Rw2A!;<~| zd(*82t)Zp8CN!=d;GTufepyxfF{v-d8K7VYG}E|JoUXy^u>UY&a|*m-AaJL+8Q=?7 z@PD8hq;EvQxdhZrvU}_VopblK0gp<|e;A;zHeXukz7OC8{U_Y`LVqd>`1Y(M$`SP z=C}8PkaB&+;bs)krPati&V}bMN^^wYoVR@&phlzZGJ05D{In;2p3*W4kusxy$V2?b z#PwP;3j(tbpLCM=x#GxumQ3OgRm*c?bn4Gd&0_eWId((s${5=2ay6ku@V-0j#Qk;Xc%$?v@R!T}Ek0>@uHgMxQ#$?2fqoEgT zTv^Q%1ZG|%l&z|HDvwOyd0JuCR~KH@l`RUz%8;9OlY&wQJ92%`nM5BsXrYIC%j!k* zg#gK9-j3zr?dnEs9M%doJ(Teg#(DR3flu>1MnzJ6u~eZM4sYnnt?!uWCpR_>EJlpo zU4XPwdB0jG{rP=Kx>yy-wQIjTq&3Q3^775~&scV7B@@3@EOf$4#J*M`0V=egv~)*jkD&Pmu0lZ91uEe<4BU<$nglD=9jsh{y=j^2c! z6-3-ITkgn6;kBaFe=HRV32?1N$9I80XTuTIKh|7kZsIds#j)wXn>B|x>9U!bYX9e@ zn(-e?S6=B~SCd4jIIz`$ejyPxs}q0<;O=%VpMY)wasr*h(}35{wsPeQ47|96-#-gl zydLzDZw;E#RGDn*H(JQc{sz2%uGvcknrDvH-spshkmtXy4UMUxM;-X~VhOx(Mzd3G z?@vfh%>#39*IHj^NlvEjLo>z13x3^jC*j}or?c{*$ zGE7WRQ<>fVrB^ZimOuaZnai1dc2l_+lX+f;GRapGoN|lkr&B$l!HX`WR0tI zT0I52VafmeXg@3HmvTmPEuIOq{B=~zKVUBp3Yd8&D=cD0o&dw6HkfGn?!n>A5bMPW{bF$i;8-A#o-q9oj7N9p>S7)}d&iRxu zW2$46Lb%d?>(Qt&$T3CcX_lUDiMU#>r}Z|=syVb?P7l`}TIsFLtME{2RUo$OjznB8 ze(}7VDLp8tF?kspuc9Ha3IYo2VL|?hqkFuWSfW(;L*3&QQL;2Uy8v|SR@NcwV_WV# zvSbmOue;0&l1$fesJ{9Ly{>Y9fM3azb0+@7(JR4G_}2&kzr&qdFH5(u|6*=ok;xgd zk5Nxxm%cAe_DE-BmW*(GKJ3AbD4bWdvP^|G>Q>CA>^z&s)|dntfam9EpqA#5Lz{+% z1{Bxw>jl{lDjmng+IgPKQ1vHWJ^0tvc#~b@| z8M3hA^wGnz(wd^uA#>kzS7YhVGFfMfrPQ^^B zsqih{m_aVu1?`bavp3hp^BRYmG8P;gWU-@#HUhvN5dbjGX0BaEC>$+;z7>rl#C^wW zAVb_4{Y-E3Bg}b@U9KSDVpy*@tfjCKa&bAxgOk18yA! zgZgt@Th3C(1#aS3>k3Xa60fS#USNOknN-qsea#{o<>2kmFY|Oted6!R;Lvlxu^Im? zV0!lSsH`?T%c8Q6<-qbd0OltxG^VcmWwq9i$1Be2vJd5P+p_i|Evt@GZt{oo&u-F( zFJOJlHN)6BhS)(=SVc@QZ^(7S+d;6B{$Y2jjFIAG|Kr75V;Zymk5NuGPX-T1RGv4# zIa?k!{`T>0SpuC`pq1~}39)a+ZJ|VX-)7%?=@m1UQ#2eA#9qrhYaJ>*l%rAglMh

A22m;t7OVixKnLuJ7>U4Yv%cUd37m>3h@Ak}i^vAr z>Oc`+a#;Nbw_8T*BsK5@%O2;;VEU%|EKFRe42Qy2_Qv6u<>3AhncMmZ6$(YnRl8Fm z07F(VdoB(3+zoY!H!*Qa@|9ymNFplyWRb(Z6DelP;tNuijvPBPTFaPqA}m zxv1BMLzySD_leLv)?0*yP;4Vf#pK($f-dR2S@#W9fkT@!RVKN{o*siy&~j`1THvN{ zLh`C{?~q8&P^ke;*RKZ>l^4_{Tz|y>!Z0acZN*ql98}x}MQJhvjFPcA?jI!jKapos zOt<8pdpVDN;k8UF&nzj)9M%sEUD!;x*|_n$v{(47&zoSzW^c;^HC>n#&FcZ0?ZZI0 z0DLWX#(+Iy&Gac?io{R8IQY@Rjw!DDq@SJPSLiM5RwZY>Ok-I!l9K|z>4WY}`+>n` zTvfD5a|F6#du05*?nwU(ZFZ(pcSMcx@Cb^ZkiLt zSS#lLRcA0$rqrO@W!~p5$oOb!YhNP27jBN1Vms0nsD6NsdpwZ!|C%{+R!>Sp!9<=> zUf%4d%lpQK_9a--s2_l1(5q(l>1SXblc(wBUwPdFZ@YB~ud4}*EUVta^q|lvIp&0^ zzZepa#L3Ma3e zH{xOk8VYz^)vjqxvdlGHtLZFZXIVeP?Swis22Ia)ZN+dd3v=4KJ34GlPW4Jke%p&* zjt75ZOq<-E8E!Jh94kGLSH>1gJSp36PTxriue&F3L&G4b3c-u}y-VEO9~1I%ZKNJ@>2yPw7>j1gibuHQ4E9B- zF)6?$NBw``C=*gFKp;9l1`TE1S0uMA>$Vb#Xf?0RQOZpC{#f0dwKm1C_LDJx9^X-F zc;G&%PeQzyr!`oLoFal7oXGs%lfS&5luuO$|8x@)pC&TCFPZCz(^{6yZaf#Kj{U*|gsmGvlK;eeLWuD)9JnS*srGZ**R-g+v!Uv&B&3Zr= z(zN?l19=%i}X>O%R4PB@|qj^`kQ_R<4?l>L3w7E5V3BcO9o1&8fChqX;PdhPg z9V(uO@q0MXd8zd)ptkB5w|WKiTspEp8|s-E-^u_+$BG*9_zv!2sG$PQ-6PEJLBwY-9zaIW- zKaM9Fq9dJSE*InXAkkT1dNgfjvGULLOFC^C5-lvK$zC#x-hUfAn;}wG?r6kAjfPl_EFNYcBg$cL2=Z=IJEa=aNRz$Mx3{Ejr-vI4_(`$cW9+>qSJ&w z=sg@+$Uwrx=F9 z%OW!H3#txOrRt<9O0=}O3f@Lthjh*6Ygn4lvlD9<#8j13IjfTA-!xV-b~!p&i0NSn zkF_%R%N!a1JpxsyCBL=AFH=4{aPm$*OZz*lF!swE5pv}44UHS!{EFS}3xIv&OPfQI zn@(Fh9Mw{+!9#Pt6-Iq*8MY3aqdB7CFM@}&m`^&a%r#yfO?|d3#?=Z^_buCGB zR*V3`A`FS4op#!)HwzZdC@%Okz`($=7lFI>rlSM8<~$ zqAKi#EA7Crw=Acudt0e&#i8~kipZVP-@Nk!g=X${Z4~xSBqe(~WlD0<3rde((BtJU zvtO*W`}HUzIppruTRk!nqkQu_E8b1(7Nm81Dj-WErt>k=(dMb_-c22hGTL;o$4rj~ z85&56l$OSO`o1|Jh=JJe^S7P|Y6;w7_3^mOEFP`9l#vzFnCK+0WrONo_{O+izCVgx z?UpY{nmHez8X;{DW-W&tj@ z!gkGa3^Pbs(X!@$__#?-2@x9Ak@Y#1V{OUoJ9P)?-CyZf8=~!g!%WT9SSu~+a-6R} zSv?KtEjb;qBI6jys>l&hnAR%BJ)*M+TSjBt~)(7QC_`zu{^aq9HI+HympEIdwe zyXih+ZI|M*$IGD=_$c97&sxt@ijlb~^ipdyG6odqCoqzw&fw8~)V^zlw4B`Xd;caE zUxhF!hoJG@Cuhs=p*(6xai}#n`YbG<(_&Vnzj;?4m#hwl%RL@eaZkS!Z8=-8tizd{JQu-DAw>F1)TlN{)FE$ zx9aFP)|`A4h?m(@^zrK#>Vp?jiz|JUM<}G*d6!hSA>%=H@x5_HZMNakNSBx7_VmqT zUA(bXE;p9nnJ*M`^`;(u$#60{+4XTsU%Kb(mTvF&Myuqhn156}XPMTwJ0WVuGFXs2 zZiZRDe)I^Oe>aGsrSi`*I8%fsuw)O8bbeAlKr)vL44fxUjWSIeIID!E=lAN?@^Z1co{N~kT?5)frZtYTuNvXdwD%HdhKy| zzQu%54JqJ9XwG;%`E9@Yb}d;E}b`ZaWfCmNMl} zT)A9zX9g3q<#xjfuE+)>2d5#_X1bc;_lG%cj;#5Qx9ZQnJI?U!fhBO+J=+DqFy*%3 zmsxA0A{Rm0>&_=jdTn8Fd*slhj7ZM_m<|o)5l0b$!PD(8M#l5M;e?_mc0`bdG2!A( z@BD3juTJ_SO{>$c97GSsqalz81*h7=Hf#B_Fl0_bjRTd4)!dNhh2i1m#X*HR++(-h z5rr(|HXqwo8ng$L%e5T#8&NEkmi$v?Y}InITV2oaP}bG-9LDISFjwn@TtO(Ko;EJc zXwDj2Q0UlP>}U1DJ&+0ESu@TXNi!ZB`Jn9D<8-(w>#%kg;VEW04ZEZ}nmJM(wEUD~ zTFF&jJXOECJ^tv0n4fs3PVTd#3AT%l5%9bHlq`@xE{Ub!<*@Q~&M!-QafQYf%_V)Y3 zFYS(-HLyeLcaSOJ>{}xBXG>{?)NZyHr`=#UuLdonDYmBXX7FXZ*|-?KhNX&)q&)?% zE^Uh*kF*yuKD)=|DQRG-e0yR)YvEghoJaz>XKi$;83U?pcSX_?Lo$SsBM8d@?&ios zSOI(}CX!LB@tNsJ@C9v8@s8CB69p;8#}xEZ2cFT-4nvxn>Z-S@I)9t2@~7V-x9unQ z)b*C@H*5EDXX-*iqkOwYR%GzoUNIyo0hNdk5te5nZY}Tl{FSkriZz3rH2gzl=`%3DNH|N>!KSvlY5hj_Q0dcW z&muiV&+!t{D^8m(#~F!6LJbXkX3PwbNX>XHnVRBSf*e$W zCS`XCy&W9Ni6rdC6XWN(Yax4R6FVcarrwX7jN?I#uZ=57hIS`8R}0A)#ron|cJV9T zj@QwsSRXs<*wJ(iTX$OR+Y>mvT=ArlyX=(|v7Sz&IXw~yEu}dL183s}T1SSC=NI7` ziCrjfi**l5Cg|(;=!rH1G71P+KXB0*>C8^)SIG8D&;C}dkHGU?D2fj;PW#;e;A!JI z*PNrjv9ao37@C6l)^r%x@4lShFY&eT=Mq%!Xgw&s^wQ`mN;`9o;aC3E+C?V?A>{n+ zqabu^IUC4u{@n(Dp1*E7$<~L379>cuq zhku0BBj_Tz)2pnbaAb;ns|cs}i|oiVk%Q^Lqh54v_Y5l~%xrKmgf7-eSTco-bU9X# zjeXIaDD{~ciz!#}>1od#%$qm|bz9z0S%@PmcN-QX;jI$_L z@2hvrDXf~v4Z{uK%0It7NN`m=aA^|}Qz{*h*JM2~++49+*Ur8-$Q3ajIIbtqfxHnl zN+Zl`vaSC8*QDj;?yoPSiB1bKtCL&jBbVw&-CM$_Zn)Ob^d)G)B%n5Pd14t}@xTIa z4ciM30wFiKR`0T^NFnTo-Z(vUL~q}c|A@s27Dek{>enDTDA{`3g+&6*i4Id`@v7hT zxQPNgcD57{t3>GuUtS1A^?DpZ_xTI~tR`}rWmy-S5`x=|{+xWU-BI=(r>#D7vzqc! z8iCe&xD0?5Qh&Ehp zkCu6~2Rq!!vfWIY{F3;qtE!$rSPEXx+^IC^j_opi+QAeOGcgp?zrVlVch1-{{#5Yy zwuSVNI5dVZ3e=aujCNXR_hi>Bc?kNWwXL-Ho5#&^$~QTZ zG|D2fRD1~%7_|DbN7+r6nZi7J^e5!u4AzlPHCEqg7t^2mx#XG|<5w@3l?BIQfDw?j zfx!jwOde3|X18gaD#0)1P7s1?`IRfys;5~i#3I-XX84(zPhI?51mlnP<&^vtgm~DW72o07{=nOmk(EQtA+(jZtF-eC%hRp01JU1963{Y3 zD5GP?l;)Ux8e#wdhx7HX!abz zQwUg!vfo*^kh0fWQP(%rJnOy9GqvpqJ96x9jOVtPie~21Mx$CL9@S>CJVNx|WjqJP zcU`R{1oLRVp;V&p-T3<58TwY{&RHDX0_Tl1=Z!U6^>JA@mS2PZ^s^fpC5EQ2nGiXJ z8vF#p1FF)A9TYjYwYZX`4|`8Ky%gQqQ#|bSg`5}j^$mNCf^T7~?6y_bIW6l+#(IMi zm983iHHdO)CQn*#AJv|3Z93%`Q$f1~fe*mA%u7&23zX!?DXaVAl;{3UPCV3+$1#RY zbD!^|A%#C_&mSU&{WvPPYKs)PVwbkE<`j##IvDPF}2oYas_Q6 zHl>1Ryc+TM<8!GMMs3aY8}r2=s^w25OfsP3$HigpECjI2BN*(7hx%UxLi=ydp_c%G z$Sic3i%Wgthqa#brO3-NE;}?`4q8yYzU;OX)jvV%xfM1Ov63$Msd{g&1bQBkDrSl( zLGdAS2sDWCpCM!L>I#Rd7nZ(hqpEt{3+&ks)@BA=cyqK~=Cqv_0ur`r+u)EWRgHQD z@80bVZ4|O@RA`)1+|N}D)hptZ!N-f8-~70YZAgJOA3?5a{K!r09VJ5J;&|M}QhTPd z(l_0yP3x)GigGJ{LXpyqLIq}(;7*B3BAlVUh@dE32|YG;Nqs#vTOmWPm-<$>`JSvf zbGKDgv(g-}iVJNqQ>(BEL@pCoYA1ehzA52OezB)E?AsIWE1a}482ivK>#2qka@hAY zR4Su&KAt2z!bP5eByAw@>odGZSYm!<_dBz*o3BZ& zeC~g#BxOK|slg$YU=(4LBm2Q-H^unX{pz35xm+W9Yx}v8XU$Sbf?d2!QI1~MnY~0x z;Woh~kZ0D2;Y8*e#vvKrL}cAn572m5u+Og7DS`csiZ!2rvHX$r!P5=}+ltd6Fcs8_ zk@tM-*($p!dkDzPrw&iysKQ=-Jp*a`h4Aq=#_b*O>YPD1wW|2yP`QRwJkWs0m}|I^ z2SW#qc{r-dkIcm=iH%(j4Zk3mP%Yy_kdN&OKhshKrjc^2k$G7bEXd@n&=}vB&>aW& z6;jRzI2>|Rz|WbSML9S?54yxe%9R+{^GOVpJP4Uck`CFGGyDD z-FTM^&)rVHTP*9I>4cMir3MzcDMj6~Bln z8G|#dC;|20&gDY28Zn6{!A`U*@C&e2@zJjcfe^FLDDiCd)JUm@t1~G);&oQlP5vAs z8}oR^rma`n=cxe>hpqH5j<>>o*EZu)!)Ic|=cjVNqKE>0YITA2Ar4`7(H?}K{BYNW{h-`0S86}B;#^K$dnvfmvUGR3}dAh6m3$~ zJw7l&`6z_;wku+qoRQ&!0#GFq+n3OjV1?B_6Q)tDs7PSSu^|w>Y?1P^vU)Z16!kZ0 zUN;^o)K1YmJw|Q!Ru=xSX%ae%9meeR{oDGrqg@pUr1b+@kl@x5v}J{S3j@|ddH>pjcI@mokVYMm``M>C#19LI}}`DFP}R&B$&qlAvT0ll{r8YoCELA$!zXK@(p4 zjku-Z{FVGrkWEFwXb2NNG>~NP!$YOi3|~A=bqTl~t z6#h};ydpL?O>C9v8LPG{0y^6Dj<3wkx$^+zBbll~YQu+1vYce#j zm4TqG6T@Xy;nTSm?HQX3I&5l_%o`s|-=mje9v+A)uA&EW{w;L$a1L^uanNfGmb&P# zS+uiy<4-|kpt0JU8fj`!AP9WpQW6Mx>s3e+n#f;$a^!J5nV)C)x&tJI=4_=Q!GG># zhaPieRCS{BT;W^sM#{H{vkq`YuJTkPvYPhGiKxb*i5P^A@kZ5NZjOn5kq%lUAD0$t z1S~D<0yKS>IyDL`qj1AB4!#ScZ{s&s5cnBTq1B+2JDr{N-O;2V%HZebZ_Q!15Km^M zYIBY_qW}q=t5MgvTW)GSnw&+bolEdNl3V-c26FgeeYZSDdWMYUloywEPPxXOLh;w$ zQh2jsN~Jzj*R{S98+09=5UO+3Bt*;NDpI4?Su(xw4SOuJmDsZ!oO_;mEBG`;mH`LZ z{Jc9Lx3@1!>%<!$#LSoA+SX7j}F9C{;@IF4mxMx~`{EIrF0+c{hcoPP_VgQODJ8 z2SuRI)o@Ie-=U*C{3QOqDFVp%F!WAW#P#Sel@4%5rrLca4EpVI!}=i{BW1gjAzuO> zo*T>~Gi@+KVUQm`ii7WEPa6u;kx6=FC@SvNN&nd>RLy!5oT^E?rJtjWW9Xlp zKVu+FtK4DZ?KFILMAq2A=e11Y;418Gmg|vp7RLcducr=j=fZ6BJ&qc0OtP~zjFu&v@yqq>{<6-8T+GfyQq> zJ7DJ=d-}Yr+4)M*SaR(Pr)H%-Jjz6ePqA^INV7>FgaE15Yds{s%u7ugN1sMyB4_VU z<{WCIj!;b@XXA?Yb~4I2hugC&s(Dz&e$Qnp8~By#U5zJ~9d*u`FK(dQAxTsFqw4is zE#Ya=)RlmPOcWfO^otqrb;^s;W`=ASeFUEE0fAn z!ERYqPud~<{Nz~d8+RpkgUO#|SOJdrF3?#6((b(d-J$;O?hTBh*gwiX=UL}inHoc? zSzo(!ifDzX>R$;a!x}`n>KNTPtYCu~pCZcpFpG+FMJR#;LC#XRX^y?>DlBq9cc(>~ z1?Otm?Nj9!QOeS#3x86O_f+TqPP$MKvf6v4mzx$MQ3sW~b<@*Q4BM-h<3GmTT?_?W zgm%S;PC4XZ{IddyCY^VEB9HTD2-fRrsxYE& z{!v>MWZxqZ`JtTKFGcF2P%-`PCG_7pO$%`nOc<%+Mu>6BubX1(%>S>L zdn?&Z(7utAlLMHo#n8QDv6&qp0-WJJ+pO8*Zd>k^6yE(Jf7g7x=)G7Tx>Li&cFGno z&4ChXy2m_IR!!CRYbDl+zWBz^Jk~U3V-piC@DU_ixNJ4+B?z78YRiHxPuT#^vmEG@ z$S1X!`oWPXX8M}XIlcpn5>(n@(i}h6VjH2k7|l}~ysw}PjsUk$dWlD=4!ZO%`uQGP zr~LRrCmH&|mE7%(bqWaP1=cvMRxrb`nm_RwcGy?&w{07BJxki)#8&3KQeL;D%kyP) z=*g#$$gkdU=W$E6k@HT=UD#Ts2XiZ;H~K-QiHn`k`F7K^ajdf_UYEQxd4>5T8C6F^ z$yZg4ige{NrDfs#SB!dJC?nmGQGhjB{4%dnH*`dBiAb$#A&^=3RYGKh^MaWy8X3#% z7T?=YoS5Jbf+Qs{7M92M#|n6w((a=V@H^j1eI@#qtr$J>c^fe2R@=8c{gAl#p|1W* zYEQc8l*B%ZV&o)&cfZ_Pl%n7OrAAWst+l9k3Tl@+zF1EJ(dOexXqV&D!Wcu~~- z3P<;1b<6HUqZP6q)8hs9&{O7k2OIUSMcv8$O?8kfN;QS|I4EZ^%Z1)rF+=#$C`Ze| zzsFvcyVqIwtINH73Z@rYU7&@Fhd_8)Nt^i*i)sNeof3PG>0bp(JyN{KuvE5pIizq)c$ZV${;R^v za^G}*!<@F(?5~s(LW;o(w>UH$exz2)l2N zvc~7<;bttn*F3ydL-Ee=aTsG}z6wQ$k2=r5fXhvNrI;t9F(D~}$mj~LYhB%cyqc#J z9c4zI5tQ#!hI2Y>tbpczFRZWTi>?eA&We9DlX_tRA#S+3lnq&DnI?RroQSp3=+?)* zU+542w?{c#<%X9#5{#|{@lGdmrf2vGW)fFB1;`@koc8<~wMS1ZB}R1<^8_I7XLbiH9OYSF&zPsrBL@vPi^^n1`7Ej}kRqq3nqbolU* z)ClR5a7LE0J_-9^^j}vVOa-yCi;fEb#P+K=PiHCC#b9z%g0bd^s_f4vKUu8*>-uv0 zwiz&BZ6PzXZHF{`igB6G_;xpCUEs-iO;qe#v`~w#$(YYxAZa61@Tp7xeui}2kD~_K zhzq~4tAG^pa~Wc`0!XZ^Qljk0tcIshiM5^V0BBUdtV6v!U>naAP~1CKEEkKQk*-SP2gbC`4g7 zL8wU`NZ?c3KMgpF_44xRG`(Jtb@_|ChDlZO?~Tb({EP0qmm2ubH_zElN!FzB~uak@)O0iMCwTOQ8r7UzZ=O6 z>6-Z9y=!A`=5RTiy_Z{{?1U)zfm_hPy`rwpvK8Ng*naiJI|8v$F)AHuyieg(Jonji zQxYuCG_lkIi^5)uO|8BXWF<(GW|Sc0n793Mg#!(%7f83HAeH<{)Utl9z)#;@I5ec> zJ1-%F;Z=DYM>5LENIVm=jk~QvaBY8u@bX=4M56I3&sRp}H~r2e+a^)AT3W0D=VwuO zj$p?i{AY`9@Y+`ei#5j;0@vG@Yvl$NZR5I1wQ_Glk^OWhvm17T)U_8Lx-PCV3*C5& zWSgLC%Vx1)%hoo`qVCo?5kU>|%P@uH9f2#pWNWyN90$rU>E(mlHA@NjGACj#-J zNt~zH+VJr6_3Co$Qz7u?2y8pbRD&Wu>V5%KM@S@Q z^3i3@iil)v;9C%BAgnKEV+yH4Pseyi(d)w&oxm`0z)k%*A>|{cN`J6etXyfF!D)vr zCvv5{%A6@ENsm?JT+9_6V1fy@+i2XiHhtBr_=FbXmM+b!waLSW zJiTQZo+fX~UB#d^UnhI}{kl!Cia+^pqR)p^mlqcoYDFI(0wie$%7~WjATGoHd7TfX zqHs=fVP{zD17Wo2?aic0&Al*NmW=1e>B{OuN1to@N$lAXKo7v6_C)0e8UNO(#Jncu zz!w@=s+_-uniFkyd~4;7g^9fkri!t&)L9XpUsrz$Fb%@z6TO~D9qCwAUXs#k*z2yW zvK?b7A{xrIXN>TW62t0C5mvfS~hU6vg9k!~TVoce2` zq(M(3>*V(9M%xw^S)PTl_R>xMkt1)fFsOfD08nO>X$DH6d!h$J$PqLo*0Hnt^7p{C z-^j_dDs<&%b&1zl$q&6{+ZB{-ZONH-7>DT73UEEk;v zc8_i+j6Q~|NHt>kMt#ZzABji1m%L^cCbE*BqJ{hoBEqi6X4ndDzh$%zE2w%XbMjp# ze8}a#?y$bEFV}5({K6Kd7Vq#*Aw_O)8Em#KQ|I+*mGg3*@?7lddRSN%@Fqoj$#}5r}3IvrF z_Ix)7Q+>3&Hn)aH-e%}tz2CgF?SEgTSFx7~i{uyyzVaTtVm`Hw|nQ)ItB%^@ZIZJ+mw|YTFZ+%y#S7MjiB(|x#2~|let>Z!K zRq6F5(J@v<->N3Su)*kIE{cM|O!YHv1_3osMd|La@*f^k!5nozZN;rS!o&3#fY5lJ1wl?FJdR{qOoR~7#5e9rkSlirtZBn^wm|iUpTf-k{y&cmj2np zX*wHR)*RL;Q{~MT-m{915A4r1qkPnAtpW4+|Fx22Wo@j@Hfb7G6Q3#5@CmPhPWDtM z0&pP_vv6p-))g=hjrt-~Ua0<9mX4|OO--5J`d0CCW??AzQIoyo!{{((>@z}*s8p(P zJ_%up3zZ>El~wHK&0xeOJW4^dc5EMIRBdI=V>O)P{6Zr5>*JmtwCUY3lIb(f?~p&Z zkVe9f0hU5SQ6jM~2J7}BrCV-X#{{pXb9x_xFD^U`3=CVZ8?AhWNp60Jvfkq$Jql7y z?*`GazjyPv(ZJ5v3+zzI9MNJ-@9>IrPHl*eg+25~b;B%pJO$E%tppxQCAEvXfxUGi z|5!l$P=(X@bt<7WluZ*0g*lyGPY^J9srT{QEMpOo$riMITFfSiQ@O|2Hqnqfl+O{* zAF7DO@cewYzzoH(&1T)mVpOzDXjYgfhkI%{FMJ+-L>VdO#L39!Yz**UlNgT{z7H2~ z2s|S1@+ui#XoF>HZ@S(}1O&1Qtp6 zxfm44SKo~)Jl$nuF^P))G~x9F8T?Fn+wi(H(g z5AMGDtRkW~q7NsrL)v6>N-Ao#Dfqyj9k<%+#j94UAeoy#^{wA+$22VqiB85QHyi6u zlB+8*iijvI!)@`8P~RLr*I*TlF6tI8)bkH53d^%S!7n2ET-43x6%)`+nixoVC5uI# z{P(Axdy0S`R_46ZqoXC@tth?&)?Z+}A&zHo32idUmI=vZG18gJsDzO6}_a&XVg&}#q{(h>e!pC1bT%MjHw}Y28OZkiQ^ZB2M zQy|6MP)+fvTpwp;3hoy{QC*ns=i6hzX}$$D5pdhYzLy(BA!avpH#7ILS`*;dhV1mQ zj)lPH@$Wz6a9dbNUNMlJa4U~&6GZDi)34LVJEyWRA%vz8Zc0LOHb!$KkE!SAaD)$! zP(Hk|v)lPYUmo%=g!s=K0qDzA1frGpkjO7ojv$=E_%hxjxH2Jr2#l<#?k4rS7gETX z)Ba(!lftD81i{FgRphqHk<>7_{;?}%j_; zd&|70i~O39L1j$?{miv4u9Bc0J^fv#l6&3xF+21jT{tOLMV=svI!Cnfs|i!&xK5Yh zS3g0iIR*dgV-w%izL7FJZ# zKlT37hhV)PcvCL+E59C{!BXabFC|xy=6$#(WszC_7Z9 zw}1~`HZ^_#E+rxC++}1KmdznZacaX}B^2fjet>FIP#_mS4^Qbx9bL?`q~yn6i8g?l|W0*}wcN@nYfm~AVhy7%Xaip%&G z5F%*OiqC)f1fyR*9b7zYpyu3$nt-M5fx)76BCRjaqPse3PxcNd$$cF6sf2kZ1FxGs zsegi&&xie(g>lu5#%@-|0`}|9Q*4fkQv$gfZig$E!0xAlm3msLjE4dbqz{L4#h^v% z?Umy%PpC;wb(3Z6jodqe4<#ryqmT*Yf^8deIl1%s#h<;4zXD=KJTiWxf3Z1HckAR+ z8JDykxr+^O-ut4RL$KV(ETw*rQtqqqS?#%u%3CvNyu+VAe;T$4>p73PlPG1T=4Fw} z!Ed?>I%1Mk^t@wssQ7DojT++ydRmmJ=`+HT6>Kt=KcJO?n_ivc7~9!lT_8}-ybOcM z^}#%jL*OyUepE?hqSqtfV!TG`QTBt!#&C@kaa0eqm zddn+m&A);(TR9!Fh3wtHLgvwNa4nQA7{sgQVu|nZsP3ebU2u)bY8P0C@{qHP6OJ6Q^y&shc96I%ER1mfE6h4){7%yu%apU#o3sOkQ&%DgdgQ+Dd?%TQy8)WD z%5GAgKM66?5!1+IZpL2W+G_a4AznH5Q2vavg37b|WCV@NzF+sV8$yh(x@4CMHc!1E z1(yW+>Q%unqu06-TVB9Y*bt(bHto<4ia^DtIms<awh}|x>A`t!*^n(T?Z4s!sP+3ZY(Nota!&>vZy;FwHrpvlEQ9IlbSSl)siP6v}web}XDgUk_skJNugs7v4q<0mMtg zlSbs0R-g|x3M;vTd?>~-^}#|qf-Hq0n(eZ8q$q(W$jMlggL z4fsagv6SblqLrS|fm45+2AGfQ_9)F1)P||$av}*un?~TQ!Wo}e*dI9$+c648v}op< zVI3;yVMeHyyUnHznx*CnAlT=sE_LNH{vR#UMq{ryJt6x7@rnspkURY@M?-$mN3@}opq z)%Ijr+XJ%=(<@^%Jf0B1i~~oF$dkxoul7P^+f%Tn)2jsW?K($yLt!ktsvfrr#>Kgg zl3Ac~P#6_4iC#wA;p!aZkfdvAofw=H4eY?ceC-jlzzg#*#&%uL3~R;#pyi8T>UP^t zvGh|I&VWG-X~%9DF^VT?GfJVB`W_V2d#s*Ka7f-#PK*eeBs-e;ANeg+gD<{_Ok-g2 z#Oz8js%500PeGC3STSK#S?U?vbVZ=EY(cfaT`AmuUVS(ueYDx$I}FIogd8trdcGnD z6)U^P+w4gNt9TS=ZR5KA!I1UH6&+M(Y)Rm6b)q7_2h>EFt5Vtj@(SkAiv0)5Sl;@r zy+yAO_-t1Y5d$jdvgh$Q-mzApY`@_BDx?SmrYQ%ZKditwmaPA-bqON!c%Dag2(Az} zTV^1Pr`)&ip=c)|PeE_7zh_zF0iAaUR`T0F0W}Y#nJInjy4cL|IYBk_=8iR;`9QS{ zxylAa?h?ThA=sIa=f_CVzsjIemzzL$v@+Fur1J50`knX zQ{+VcH|}yTSGIR_{N{xF=o9$!*un>+dgBkHpgQCA8Lge29kvXEp|s&c3)hSHN&31J zyHpE8$_8YHlvm4dPA5hzI8qZ(`d)Jnu&St9|J3b!P9bRC`dQW4Q}0{=))Al?6+GU^8s7ZUx7G7YSpA%!)0}?$tcX+&<%is04L< zO)O|ipHi@w`bb)gBT23G?l!Mm`)>n&W@#xa+rE(R`F1L|l{I=MgN?M@5mp(1N+eluI5qSfZnY75f8jVF-oP?QF zo$*Kf@y1Q|#2vnwvPfdIO%sL?fQ4;nT@=P3}tXioxgohR-5ws9$3WQOBe7 zNtvz4ky+^o^D;y|M9!fw{^M*Vi*>sUN@D*Eu9swfR_ zShHR<==ONDdTRx?v68&J#Q&u=XW9&HOg-D{wcQyp+lSWMVa6SRB93jbut^1aTzX%u)FTZAPm^s{y<=xIJIPcKU{ghjS!9H8>2m3q`#2i)f&h+*=c|*p|6Ev8Jvu+&8@x zw%)bWA|f?V)5Wk%`G_D(InWc4)Pc%kHJmO0@bta8&>I!@9(Dm*aPWK*Bq81Eh)L&p z(u~{5d=PO&yE(*>-C$gD#-+>uRMy4qv^yq?UP-XA@GDu?^*Ao8|3-g-3|}tfVO*bx z@{9e&ji`@2SX!Ikbyvwiq`?kX#Oen@ksoHTzbVqDeGnqYpFr_($6xn(Ysa|7qtCF~ zmPbYebC*^zjn)w$r}`Bfn^eB9 zcXKh3ZSCni4#gc!VTxZEUr zd+`K~?`wKzBusoI7;&R+0k;`3NqEbF-i zS*+Ai^%N&^r$=lgUT?i?K1VWE7iN`^&w2Jn+-E=MvaT<=VKr?L`MLh5%*|)XL^H@q z<~CaKn_)%|2ff6eS88gBeuEORw`FElPTZ`UpQN*nyW}s7F(FNcIQ1i1 zUyS5*R!@t#;_RmrONuy_kaVm!OTXjDeppa10iSYh@yGQj=Iy+npDL?6cA5Xc^YM_W z4FIC4Dq>Yw5m&_cuuFOR>loy;D0Pr|?UbWt%}U{zx_$bLxR>f?90NNe3m!{>*J8CZ zXx)^&ZToUYXw)brno>p@a<14d+r7)#kPExJ*Je?bsuE*fX=e0HQcs&3wMM->n@XCs4wQ2-lTd> z#LHQ1UYj)LJ2a`6GhP0<-Gv3#_!D)hWJhzSml*XxbjV@&aVuf0fuMJF%6#_Rlpedj zKn(Sl`;8=4bl~@4zfVzSv%DZbOzwk~%S3)=Dew;^(JuhrpoIK&lDS3><;G*F418iElv1}g%ZZL6l3PrV;bJYu&%)0x7#pi#P?;E+}iwRkq zS~82F8g|1?I7##382=0dkikPH3ygY}#bcM;(R58N-ku=jMyQ)p$I57eOEPmN-@$QK zCJdO&Yqb}y!?eTiq(ttgtoXqz$6^GpmYeg5QV1T0E!F{ksP9O-qO!|U8gG7a@$zW9 z$4QCH%6s(3YV+2$0`7e#OF+(NBHz;tnRl-+p+`MisZC*h@H8)MUwdhr%}{k+kO?@O zdm_Txt5=1CK-nkTbmgdBmhAc<7scGJ)tBy!5T1`&=b1-YlZC}mq}Se& zN1^{s#JVO|f$@94dYK_@?#)gP@nmVd-418ioDlu7&GcGr_gNz5=Dfc$COd1)3+-PH zU}==JnjzgjTkcMVsbhw(N+0WJU%bEmrMMXPX9v&9_@QUq*p2yjA;;Chfy1nseaqAd z)q^o!pXs|cWB4BBL!A7Y=*<^(9UJSCLKTNYCf_#N&);GtzPQ1^T}oa5j;c)ujhDIvbe|cq^h22lh1mUVTqFpC^yF~C9SKQNt!4arlj+|Ne*1x+~&XE*Y+z3 zO-DT`vw;b8VAgxs!dUhObOl|H8OWi~;g9ZjEI=PMOd(^XCdD{t>qsa}E90Z9WyD}u zlb2rQO60`tJ7kC-RCn$Jk=p)e^FKB?_aIFm-vn|Ct0f+zbs;I_2fP|tk;Hpc>kup~ zAi?siFW{JxVY2j-W*$ z$bF!;pl%%ZbH+2^#}M}zp~gZhl1JF*?&7|howV<(FF!?KR~8gfiy-I+;AEP_%3F=0 zSu&b{fj4^wAmiF654Ovs^(+#R?;ti2 z`%}Or;q=12FgrYWUc>42A9R5!RkZAsOe&1PwK*g6fxZ) z9jO>yA65f-#H0%KR;W`D{#&m|b2V85k2}x{7}Jy!rY~kdLO5L(Nfsg`N+f_9Yd=8J zjJ+R>@Iber0d(={U*rDTo6+58KKyL-VF>1sOlMZHudfrM`eDlqnWphOkY`R-i$ld6 zD*1?hzHU?=wbaqMbZ~HPCVL|J;lvUE-F5GBulWkJHBogRPQ-~GLX4$dYAO55L zvIC7^uZ8a=RkaP2Dl?}W#KCO2nudJq7Ug%U)c;yetqyj*Ar!B(oP)-6r%DWN6AhBZ z&4ZhFSM#zeT@V^dn|@$Am&5L6R zeVK8!LFeRj5&BK$_cB4<9qWSdtO5|6b-{1mo8cFGJwTF`=Zw9;5Rl9{-ptxj&Q+Sl zIpLXgsLhVMN~No>n`#)0X`qR-v%m#hOg92Y9tQs?DsWEhXvTo4XLBz4HlSx4$wk*3 z_vAY>Uk$1ZWty&{vXziqJS>h5g!HHGa+C`kpT{Mu@oOGbmt43maz0kD*GdL#fmm-! zuyrL=)MkdUVzL8*MaBj~-sEq7q1C-O+Qj{2Icw#os=|r;OStgabB@M{dP<)uq&4b( z2ws}Ll2G#)Hvp5Lz(>}fcSUlmh}HDlpkKnT-QJ^?7+uHlu}lr88_f zCy^=Gd(y%xP(a7n`@FP(8aTQ}MlD!|FFd&X!xZYh*8+Dhd31yBf?#KV`+1l0mW=L>A8!XMPsxn4Dv)J~I2Q~V^mtIWu zn<@X(gzcS-Z@{Q5H}xx%>e%T2jLFhiAXZUv1Z)NQ(*o-FINTEM_KzTQ{)t@yL81vJ zLHNB_2Yv^ce)G7pke9nmzJb1xZ0(n5mUgaA2L1)P1=-Fi+oSCMkD~YN_G$PP24`6i zK6x~&F`#MCKTUr)xLVg|J?wHXs?Yl_z~I9{MZ|+JB6F{ii1WOUjA)3fMr1tib^S?)1Iy;E12EI3Su?w>?J^05*ETwu_EHN*_(leqI@F`p1(ERXGNDC!Aiu4^>8b#NPPbO=;D7z% z$_x;^N2M4u1A0lqB4*RkH=?WK9`gczg6w(~5N|s!-`qz1SB4;W4&F`$4_ZL3!Di0d z#sY?me%nuEhWcUw;0YKj!)NeIMso*%nULU$!YgWFWhUsgJEoV3O&=AcJ;4c4z0Q;9}kvbFjE*1rEwZL{CGp=nXwN>Tgb{!O{yB&8r1rl zGcik2k|!HWsRXC&GV=X1JzZZ{w=ACEiL3t#)WC?*guZifRoP2P_7_`4()9Une+LH# z^M}H}c_i0+`V@lh&mj1F&2s%oganWs=&0+-s~0 zol3-?gwm;Sn{?HCPY=O+8o^9aGLBKM2^T>@abKuIEaqI~nh}ipdmwye!E9me>xBWQ zMeBPC{i||@yXox23A3(!{;A!o%SG4(~Q*0CR%iL_xTssK=W_12W3(TAbYYM z0kQ|t10)fFQJ4nM5@HLXc&13Z454@+RX(6;U=s#S7tpjM^H1w^U~qSGm8GPU!#To- zj;5}9UaXT#4u?)1cS*q-bWfD)rdufnN+%^!fhM{HKyX6&2zhbw?F*70j-eFK1!Fzr zcMS}&5{y3r)h)b$K!2&R2L1S4W?4TqDUFYx(bcq0rDa`&$p(AF?iPD?6eTb@$S7Yo z`09XD5UP$R%8IeDXH<(^DR`@+w4(q~tf;NsurZERJ6u}4gOf*4r9hzxBfHWgQr9#B zfgQ&}Jb`JVL=l(Uh{wdU;x)a6)&=O%@%v~4hv6gxPHsw}&10(0y+yn{Il!?epH_! z&)6&Cwr1#hntM&}SGtj*obEFds+D@t{Zi9jHL6W=RQx_x`Jeso_S*ByQ&U7L8M|h7 zzoOVUXCexFj7JG>3oDDmbLqe(5%QhJUU=Zp_LjpYdU;&o$Y$d>$QnmfChbTa=?F(o z1vZ9b!6!O##vdxqLf|lt?`z4~*!i4U*3UC0cG}u9V;AM8N)8zaposowEs>0B8ni58 znIx5sM6bK*hlIk?{blJYRTQ8f+?5NEYdL;KG@#0{Of5)#cFJ5w zUY(bvrHW@{ryHR`zv&{&f)2dyKULhPEV1$G-=~g!BfKjo?PzNG^y!-Z`0SalKxJA) zT3Z&%Q1XTW(Tgo=x1R(n6A4oFy(OnUAOf$Iowe|`kV@?1UUQFA==IPCx@3|sk@H=H z+v#O!4~8-;38)V;!y2H3?Z688p^Zd=*J!-uhRGQ`*U+yP{0<_yINQM(|06B^QsuPN zTIHc-n)2WD*tg@)AFY6b<$>I_TkEp@AELT^8UE~_uIIFFwE8x4%eT3%LR-2Sk~-=# z&RIa*h!%e%Df8^+LA&)^U4|#No-0`2{{4t5p53S|OU&=ow|Q=1ZJnqhZH%9Y<~FL# zW$D;c|4(3oV@Kc89h>6M0F%J&_$xf#quT|P_eme^X&*21o1lof3X7l?aBujB>)OJW zw7~BrC$h~D>uL`DF*Em=yUvIEyEDdbXAo9fD=TyXx~!xL*+R6ivYP*8jU?85CmrmM zo=c^@SPNOO^CbEv*9{=ZZP~iEBf>K+#4byl@tSiqI_@hMHd%=_GJ-_jqr&0Lp-flg^ALQEC4Y0RNZcLt zBKhnLaykwW9~fR|A);?5A{yk?YsK9OwGiN8-<+`yMV=VH1>bc|y-kxaD#Z7ECWO4M z^Ga>cubP)2VM#&{`&%{p%?JE!k3b=5b_Ss(t#8POTi0G5MMcb*>UPIfAbb@P5_0h% zpK~@)ALy=f2_mn*_$ps*HTnn?<4z{em6eu?L+N$~3KI*P*R@Xos>B$++B3qE?gA9< z#UcC(54#G)FWa09-zM?_%g^vvh6p{!ie6>_@s%Kd6Z}?ere!X2+WQ&dUT*)DSgsU6 zDQCe;=(s=ix`op}hReOJB^Z(%a%Bk~@xT9T)VwB3L~`$83}B~gQ8s0C+ri}#Pa6#0L`qL=`&WnZD^AnWxRqnAjeWSH875_$llAC^9Ygl0XK;|QMy^28&O!_ARny?wcfy6^vun-;JZKc+=)QH zE-p8(C#O(C&T)f+c`=we*aBI3ZR&lvMS#+nhg>7))OEr-9}lSG!^gzMa%IvYGb@*;OqH< zD@U50LqX3v-?xN$ZwOcte7=dj8e+7fNi9oX_ti$1=NYbOw8m`_>qC`RL1cB_KbJka zkUmw?`W^i3Rv0kU>#-5`hn}GGkTLmNfLje7(G858mzsMj?Esjg9l)vqQYtf5=D29Z zDfNtp8GWJa_O?l7rgHiiR-xXqmYGq1P^k~?;}_lT@k#Nz^Ncq*B7sxgPcS}ydi35e zL%irCUJ(RpZol5Vabrfouym`tZjtFq$ptPfDfN>?-ZKsn9BUmoWR5=D z-g?grvx?=rbBxv>lH_jG7}XFjplw{FYjuWp{*Q zYpwv5!tX!OnC=5*=QLt09HvX&6-<*#Jl#OuTk2NKl|#GaqY`d<(F{JYi`eN!moJYz z5d@L0dRwV|g;UsjgXxzrr63{s4u0im@a-*P7fH^_9)5W|iqS@xuAG?`-xxLAbMUJvtxU+W z#5X6DV3!?~z%T{Jj3-xO&K$R8*7`$@Z;YQm3n1#>XOyQ_VZWdkC#1?C_jgZI(JTja zZ}r_GZ{!@S315&h;xB}yg@}Q|V+s9@fF3de^wK;bB>YoNu(S(8e(KkjBoT z2yxqB|zIVvRj{o%N-Yx`m=52P=-%^qctN z;c^@OZ1Q{;;$+ug!L$)zn_hHqeND{gsPj#rAN4j;6(4Da0_8-Cjs6Gh!%8h>nbh)q zvDiaWx`De z1;Z;!)I60(`W-v20p5k&V~HMiqs8N)1ZVjD^M=?1AC{eGD8%Q1ooalQ64``r$Q4qw zF&>3P<@cmVlOQ7w_{=HRGR^dur@h=_uPJj%d*@kkfdxQVxKEogn?QHT<30`fg zNrEkK#iJe2g>Ecgz(7)*P)y5#92S;AqwC6jrBMw0Tsun~2`d60SgPu$_*oyIJb|pd zTpf_1cp2;pl#PKsnB+cWpldOOe%P?BE2d2R!er5v)%b9#6 zOd02k43%+Y*SGjvui_^RJ&U=_fzDIPDGSXXH;f$1^Q!?_wlOU7&#jd>KS=?qs(*tc zH?H(Vc^4{(&Yje(v8@4THh(1%(W~3PN`vYaH&Io`*TR2XfiJhwxeb2UK50J1$Mk^U zstCVEKm(nLNSLBXupnH@Jcb>^V~Tv7bL^j4kqpM5#ECYi=1=)B;6_9)YUG}+PUQNTEzbeV zxj>0H^;`a-3OKeC8`Mzb;FIb6BY-c3m9`yVnC7{*09oK{2Gyc@rMDxAfxK0}ehqC_ zr2h+&ZKkFDY{r0t{jWJ7^b{rK<((si*Li)1?Mv3W`ucfPWaATr{*fj@uBPAUz(vnd z!cb)@D<^`!Mw}UXT)uq)XxiksgPT^v>|ljFs=T8C)k;RN7gf#ipS2vTku~uR=yPvc`h^$Dth_S;N-3r6`F-`bHCA-&K2vUXHC z;govOp9mDBwZ{uZQL0%wh2AtnCDu+UqSUfp@}^=&qT(IVy40Daf~=sC#`l$C4)K^- zD4e!3QFnQqHU^Ve=Ua2iQ%Z3i=E^}oqlN8W6Ord6^FM^~%>Mlw#0V3Q6yTA|h}ycK z7L3hh4Dx&vHP5N^3ef!&8>t%hC0&{)V^?1pr*6z+nRm+Q7}PS>@Qa?a<~k>S_--!u z?L}WR1`lVT@O>E~M-U@Wy<8$kbjCjaQ{7mPCu}1ntNC+AX{MHxN051i7=kuMeTm2> zU4`a+-{irPNmC>@|02G(0FPge8{y@x~FTSuFjge_snZeYI#N zV`Wtou^u)?Zf~fi--JcVP#k(Tc6UgzYDO8KnN>Tw;ltOiGZ%%U)cUm7djVQ<-Kv&MJti93P0(iwi@a80 zPl*GK5Teg$EdYu<7OlU3uAsT~VTAvCM%$1XLqlK2fp@bUZZnkYHiv;W?&`HbB5W9e$M`| zU&8KzovTVAc!F5SsR)yU9#||71z3WG0*<3v*xMEu-XsACVSL}_T$6x`3QUj-V*ri7 zMCp}Mw($CAopTumiH~t;@JzY$8Q<4MHDK3#3s%HBdPeJm)b{%J??|Qd{xf*WO79Zg zCpE>B)^DiE+=gmw-*RF5?f6jx`q3U8Lz4w=&M|#Dp zy#JLRP2M@+2@L`^xBy&jgj{7QFDPAOWxM=hX#37-gzvWKKB#C9ul`aV$0oVZB}*qh zAKoSOWw+~$8^Wh%ZP04QxeHj&Tk+wrJx8p*BSEJYC+1cG!%HH8%Xo;JF~;D8Qg%q( zw?bO2{`_Euc1I78B`N;FfR|Rplb2JvZfmfYpotg8YX|?hxqQ9nDDv=K_j#jRVcK;B zU7@2XpnHXY?oFb5QGpZ^%fqRGTtT8;4dzLhKGEUZT?P?a42Fd+phgG3_j}LYrzU7O zepIrM0uL>;$g_`7CibNP-^x;Tr~*To3FlHoei}lnNqiMP&lA#EZh~T}8m;Bt(*w}G z8T#+DO^W5E2gs~zS7Z)zJ~cHb4WY8_tZB?QU*N;vwLr{@#2c+HYzsQ?=v8U8QeW2*Udu`_7}E<{yW@H+p~LMTMhM|>C( zP^Js;mytSwiNrrL&P&tUEZFYkSAK|@8A@5a=c{~Uil}9n;yK>w*x?^#jt@J{cQnoE zilt$k+-K+y7&d!Wn3e*-FPy5-dsE`klxsf#KBq9@VX117%(ztR63zKdDh&oVLD6*2 z1Dt>hjl@U|&ORzZNK#gRz-%oL0n#%RNwI}4l&9*QGgLs~e&=5K0hR5s>An-dtpWp} z@*(V7Zroj#?<=OvCaB2hwI<7;Dj;7L6WEM2+(g!(^{IR)$n~kr`+c2eMs8yDv7_nI zGc1v9Y;sg4ZY*?ZQ1rroDe8%QooU9n_CZ*je5ojGKXa{+H-`ld z{n)kA`RS!Qz@Jbh42e}Ig9t4P0brNZXtXrl1I^e4PUT~im}HKh>y+~jbTqa=WxhC1 zWEEP&uU`iNz6fwiMd9lKhD{US^Gcw*SlRkh$38T6E*9bblwIY@Uz zeb24qUG=`fa;0AurCG-%?$-}1yCf3VXy7K2mxkkf5`V;+Ka6=E^E-_!p;FfeiR9zi z(?#g?4&I1g8usxVb@a%j}+@BUEemD5@6`S4^#?cNq)ZJRKc*pP^UE^8Gey ze4N~!I}E!=F5(snZv;YohOYjG<|772IwGk-mD%k>Dt~f`quTVvw~(AKaQucj2BA1Z zY9>Y;fY1+Qwu3l^D-a4B<3f%xn115WWMNj<*UZH5g5oJaC*rT7qWGuu1)^RXzV9=e zh)`3-d$#H{jR}COPNU?P zzN=|IJ8ux<>;!ZvT@C!N_x`etdMrkQ!}csXxw!gA`vq!J;A6YL&w<<)s*6{Xd1D484;V$tj|pnjX& zxr?(4N13&?KxLo+YK(!yiy%%01Tr$R<6aNlvydpO)^|k-Khw53Cnz_?loj4;9!zAp zb3Lg7u2VucMCRKXNo9^~rX}0K9 z>o$^7Mrj5m+r|&7%nnpCN0b`xf;FOe{mq=!rk>YV#H3S7=ZPV)ho!Nt7uQ{3xRoNK z+&ZLoS*$ca_fGK5qFo_5Y70{A?T8&80bV3Z{1)U~zM=*fhUoSOjh;EuqG8>K$#{V7 zk!5>vzqCK`Q9MW}Ze9Q(NwO!p5~QFq!lA~eW~{+C#_eoF z`HZ6L-ICU*&?wHW7W2rz$fo;?7GBkz0ZRiFvXC|#-CZA}U z0Ef?JQd(L)V-isYtbrSTVf0vATUS=g$6V6{9R>npZXhr&mROLo0uBg;m2W1M z+{42>LGYbOw2Td*4$M-=-0H%#ZEUOq1^|!Dd+f7Nklp}n(vi4Vg*FPv>gIEWL~+_S z3ov4cqhMDNAext2b4qO~@cqCh=n7!o+$Ak(97~kD4B;V9E9`JYN_x6a0bHO=15(Gp zL~WZfo{k)BbYM;r{qi5-5zQ)Pvls51DkCP*;TXV!AphBd zC;YRpTJ8m^H@srsVM2lK6+;Wk8)a;Bub$S;y2GHn;10SC~=?_bjUW%`Ez&6qOSi)ZfXG~Su`i@dK%)p3Y_`|URP($T0Co5 z&7yrv_IyCuyTE_;vT&P$5=d^4u>$dot6k?d!|-8iNndso1}7OHC`l8(N+-IzDW!<8 z|EfEM++ly8ZNCCe@xM9ImKsutL1It_NtMo_B!-e!V33qXY3Tt5 zQBs;A1q76oFlgyiQIrm8kdltG=DvUT?|H80y`J-)_q^A+&Of&|d(Yl`t+m%)>l>fX z=L^21s#@24kMdz~2?)0Q=P9UZ@^B6A&658R^o;)7&v!kIUQ6r3i0|N~iIfjKekQ%y z&`z!Ji1sl=c_Co>1bcJ(^4Kj@3wTjrc6S*5KmT18W4>Xb5Es9TqahrJfM2uL(TL!I z1(x;UGG)6r_wn<0m?@ODUxK;;6%klk7JP!1e9Es0v5e;|1MASg8%@bvPA5b>UbZZR z`*VA~>oxH|fBx6>?jw#&E(eH_=m;}-(N`X(ZnXEp{6j&9Z3L@d1a3dItksX%1o5jf z6EA0x;4RW%D_cf(wMhi*XkPx@=Hb(gMWKrwq1PQC=byRE@%!Te_HEmZT%^@L*nuY7 ze_Hw+j#dQOsxVI?CJ|kgDc^6F@8xIyHB^i5Fzn&WP~2>FyV!R#4+q1@^Vcwv1Roa% zJ88e3AKQ-B$@^c-Q^T{)P7X3FvYwoz_;3|Xeh0xp`SJ1bMaTeHCs;oS=4HGK_VP-? zV#Gf){7|Z^tGn)*X{~19Qe9J%R2;{2Ov5Q>QG5U|$X8$GV`^o%sbDz6$c$Ysw!iwv zz=+md-852c-Jw)F?GU7)s1nn{Pwe?I234=$VN`@qUeeQ1#qH&i1Zdm3JiipKHxkwy zC%d0!F438vu7`ofDDtV_Lh`Tk0f>T)@U~SF*bGT14LYkw+8b&zbHj@v{~v#s0Yb8b3Q z+8xP&G2CHU4-i_BSQ*}(o<5^{W^)I0V2|C4Poob)&C2GZgMKrdHc-4Lr#%sU40#Iu zXoj-WHJDdl)Bg0(eQq0CQkT2dD%(to|1(fatMonjTuPzjr{w6ER*b1+C8A#nD|*cB zmtmr`@8P=Lu?$TVOJYlPh?slGXNPxlR6rp4!-;@Qm3gaW>{$6;$N_-^$D7rJF&q5+ zG2g5Yj3Px&mwe=(3X^=V}st-bV&W?UR@J<`=T-Bgu zu*1T*D+}T^;GSDr3hM+iyzi9Qs!2z+;bEYS9f{Z0nL%b7J$irYaTfrjd5>QI z>U?#>tM3*6DG<*=;lFvBzF2^=EF(~H3diO~Dq9zomO+N>O$nkU5uZ4x7*TH@HPA4= zCZ4oFTPVOuB`NKpP9rsRl8nC`83bB) z?InLlR_&XIw6eMRn)l4j=h+$Q8K%s(-}Dg#v?NloxNe`g75gVn({Ico@6Hs%NDs2L z))$<}JFD|9>n--F=er}`HnTMrh*NEuky-to9t! zlo;>k9FJeMmD_6rrlw1%f+=eEnV1WoFjFZnV%FKjDz1$ZVMV&j$v`2tn@{A7{R%O0 z8m!`ad32{lCuHnsDJ#Mu;@xCC?U%%Z@XC%JLbB&P+Gqy#PCOF|19}9njlK#>S0YdU zBYB8!bRxmZE>}eQjGO2bPXPQ2+s#+ag8F=zvU(L~(d*1bIb2EAjy#20p6xx?GL50? zImR?Nf;Tp!J$SH$i9xH(Fts&3tsIW;ZRW+S1Sh?#R>e=>7;-N4``ilSV{CiIy?zvu zFl{TP0Y9~sl-3A~xq^bFyUr#tQ^qR94Vh2z@OFzWt@OGLti>-Gk?41diERrf?Lm># z>U;@2by6bgJ8mCj7!Rv4S#1OmpVuH;wstzWddkDTw|HW$Zst1M!p9nk}Y1O_E@yxWCj<{W= z_*g@%x{#ty4-)=LO}bTEKgdsdd3okAS|T zZ_?MVx5dcz?N7zaM!!YD&FjF;1HsKvif$&d+kN)oWcXE&ATY(eJ$xT%qU# z1?t9;Ygg7Cg|d=6$J*In2(qhp8`CH2WydZxJ1+>x>{C!cZYN@rI;taQD$reu4C*(0 zYJOcST)eR(nHPac@7KM>WfbOAY62e($4?)-$?dHpi*M1u2H;!;a-GH`tZP`JluN-? zVIlUVxgvWEM(Qt9t?cE049a>q!)SZ?#RBH=C-7P7i_}^WwwCv`5(j#aI)z~9w^O;7c zpD`&>vHhoI?sYf~Gdl zDW%B-2l^$W(xc?kDFj(npzttird~l(y$<(f;jQyTyg*X?bX z{>$b;GJpd#fc%Yy4@fw@ zvj7jyd(-WP2=A$Tj_h6%PHsYD4heMGD4S2s`3P}>Y46c!S|uu$70eU?W=0=x^SS&< zqe_2oea_LZF4q%&l$zmF80C*&=zW^8XWj2-{Eh$Sedx+q}1!Jt0^1b+2sPSae`_yNU z{p0+hu)y_OvWK*&1{{_^S$^gV%{r5(8mq^7HVw;zIo_n^mlNxiX4++P%mT7p`f{yr zso$#Y4RIWkU)e<*q*us49FNW21}GRow#q+D`ix3cG!s_2N5Cb%d*}w_F%Bz03bBBG zEXv~DY2JyWB_HHZ$4G&iHONPm9X`27<7s|D4G)hc0HA|Y?3LYEC{u9KY!+v8+&xTO@7%nR}QuN0ioJ(_3k4KOldRX3vH7-AG8C zZRM*KxT(U;zNVkZ@}2UILuB%CQ4k0yJ%Tl(#J}Ab)IP?qYClAIkC~U-obzP&=iA%wGbfr`ug_XR~o<&*+~*lxkU4 zF_LNrAdecN1)wY6+Eje&Lmq5dL4KyHiWU)Y8VPiM59IMiPVfwc8c?7A`jLjzV%wl| z$fy?j)=oC5z?$&ju1R4BwP&9U180aqRgDQkVLq`n=u9nfHKdFHUP;=AM7i2s?wT_i z0MqiLcFHV-UfsDUz2Q%HS@*)b_c`^#gZ=#D$iS5-CTihcf`DJ;CRw}@4&-{sz~i!^ zNY-|68RVVWo*8l zYOz2Yo7*&4hOH#+2yKO@qj}QsUWW+8h+~K}sEHJ_94KQ;2EC887$D~{U0HVsK%Urf z!9aqz?H&&7VCqX`Y}fGBD&ugJf(s$t^M`2T=Ik98om*RqBojDo4Pw9JhwSbi+lcga z+ItVGv0Kg0uM{lgMI}ZN-g?CPm=?a}i;9*u;eX#?)nT0B?CjhSJzs}M4yAv!BjJIN zjt+_^;takJ-p&T`ayF!M8)rh)(yx?#Q;y;gLF zh8IVtVVbUX^u3HW?2Z-Sw(F!hoUYr&cjanX3cw zfmqMP@YMBr@xss_F5W^_?XFMXKSR*E$eE(c2R&ObpAVJ0&*FT$G-X?VYxDZF9jTS1 zjVXq;jZeP*SYg9kKQNJHTVTtpj(kL3yH!18=EdIrJLrOulJt;m0YEhq(V7aE8$bfu zR3iML5Jk?zEk!Cr(1_X0GA4irZwJZL{3CZ+ZkbVS%#gI5?^psNTKN0M^W5?oVRFpqT?1X_)Jcjui#*Fbbe?$qnneVJIC*B{Tb2DF> zpvuqp@@Am6U+Ae-ly`_-+e)f=87z36Les5gQ`db9`23Ncld1Eo!5xkuVy8Z|*u%?E z%iQ++zF1Xrt?BeV@HsAW%O=dszaxAqKU~bqRTV&seVZSr`?{jS>oT|NGCAr_mqDkt zk-7kd2n-E-ms&Ys4kgsa_3uSre%U{#p-3* zhHruuIaLvR%uS!3Y>l`ewjI0AkRS0c3?YnW@_P8H>0nOpUQ^!TxQf6F`$}qF;HE#a z$w9w?=FB4?Q*tt~LTI&^=mfbJ*M=`!a=ixLQis@-+i;t}Wj~Hglc4z)zA)P|w$fSU zr0O3D57fvDHHLn z&GO=UK+hcDIt!wbkcv2^s<3VD+h2YM@1zd*$(gqLJrzxFyUWa&)8WAN84`}FzxT*` zePNGqf?fU)oi18JXeXUz_ooB!=RX1%3Ox2bhUTtHar!+ZPmMTvto9-r&j!MR?ii!M zSa0_iaQe=vVhJD0~KeBPi0-?D7aCaFDAj-Um!x-?owH;vh1;GGsM|DoSS^WbJgnl}g6G&(3RxKqD)VrTihTaUR9r!B*^v7TAk~rjx~kyl$POHtwR<;0C~L-P`n>n-kZZV&u0rp zUkr?X*v%gVgmxUV_?JTWEGSkv$6i)OyEFHv_qY?bmneoNh;V-QZ;AC+Do>G03=`m= zy*@?vns8d;3^4IKa^>-lCJ2Rw^~r+i%b%hM)R9ya-|Q)=SUA`1z57YAF+#5R$o}aY zL!3{`X{VfaZalL2&24y8UyA3d>sQa_mPZ$%+w$y&%m>-J=#N<|9uD}7jh}9!M-1w? zTOLO=Jk{A8VjfWI;(kYLY*}q;WHqFw>KZwHY3Y7q0NJ8l=v972yMTnkOW?6Fm_L3{ zas3TW|9u(JR!d6eS=a}iIo^4~TQd$Wp|o1}FXNpr;;(OWNrz=2igP&dn&YEAC&j~WiTv9p-q}s}njtb9lMpaJ047!>aB1b2BSL7#V zuOrv$xS zIf~kYB<=!s(YfNzF<6uo59ZkHtQD%Vu>&#!N&1atwofCwdy z2@o6`zBw_y=hg87%fe9J&qVu-fY$>k^tuDW@ZG~q?tG*=axdorFW*GPej zDR7G7&0yp`H8B2_D02le5rNMjwv7{204_`Vd2Lt22{8H222&6u zyQ%`N!8u)IAh1@5>oxE=FDv>hMKgepkxP~f!41wPTm{Plh`>1zfwTI+-9ZEY@EH`G zjR9{0#KQ9Fz*+SK&|+{K@i1`q8hDHnxQ!|}`@i#$lvgmFrt?iOaPb0UMG-edi3 zwn|CXdW3ap`Ut8a$!~9Ojl0&1;6*S{BBfl%y{E-1*L1$}16<_}fMO2ZzN(twpjdW+ zLst^p2-{KaxQs~k-!4r78g>Led{lRkz{khnhu$YV<2yHNVB51?f3SPsnXFb98N%}` zH!C{~*TsIq%iQ*to)lUJEZF+vCgXDJGyK!3+5&6?fB|lOj|v>>fG88qEY1Ss-d=c> z{Pq;kraoNb_0R})iXGTaeFk3h445}WdjwNQi_}jjWY?*k!lsBaXTEi{gq_hgxWxIlJr3{EH(3Dl0xCP= zGHhCT`vcG|w7WhBz`YOmEi=B_{Y%56zT}x zWz2w=n+>z)&FsHldp}_*g{<6XoQvrXa(2VY6icuM+TP4cw=4E=g*@z*cvi~RFC*Rd zJ&Df{umV3~taX1B_B4oPn{#RxvR^mC9{6ZHKLAXp2nU+-Q6>jomSTu@T%N4)5!#>N z5CVbyzD@CmsGHM$p%H(D9KR4IrSRi}PgZ+Y_e%DGL=G;88RtVtx!+uLTFJ&OfO;k8{-FKHgTr8x5jz{QQ|5+*ui3c`|zi*nTDV_ zpdrYGpe;|~p6DQ89jyvc7R~CT3x>RCy~Pc_x_A15)chEuwC54mEN`x>r@v|^cg6<;>LUM~38EH$}x zYAf*EtTl)0xa7BGtkv2)ACO<^g&<^GUtpW4+v|U6_LX0#huaMr5G^^b&IpOT_((h{ zF*^Cat256&AmGY52nwn4N&-4)tP!2vr)>ut8^Tr)bpRnK21OQ1uRcn=omu+x2WeuK z&nA{hx4IG-7NnKr$aG{rE3Fn~G9^P(GCAg2KO~D>m-OLSnB8{Jz>WoS`@UI;A}!85 zztyhl5ZY+%dVYy5Br`GN{Z{fwUVsvVy>1#js>)*}MZT$r_|CXV7`9}$sU%BU`r%V+ z^7jrA7RZJ>?gasJ9|*etbX;s^!p`=X-ht2&QAY=ueJtf^edTuPG*U@}@?6wJdlHrI zS{nJKw?!=RI;#^XeJh3QF~s~=78AAc;I@r^e13*=9-f-4kH2X5QT{c8pPx1=+(;HWD3wNmodm7Tc2Lq8|m-T@RRWa3d@d^EFIrjER$Z zN06CATol#*f|zgiWNx9OR>&I#+1F)@bj*tWU5gekf#Jo8H@43c_hzdwCls_2pPVvZ0=`-YqM_y1&`Fs@U77isIYqV!pj78RJ*-;@<3iFK)Qp)E9z@q2Jz; zwr;QS%utt$;Z80tmsGpT=hM~XLqAbwJ?QpvliG`MY@_&tsP-?Tns%hb8E-CcVxYZb z{^uLPI|VAKl5Zl?yfu8kUj1WixfAWQ8YlTmlEqKBDtv+fWrWunQ9aA2Ix=UdmM+9o zkOP*$Rkq7{M&6h=T%&hlICSk|NjYtq!vdv$%`J21iqpr%WD*iRkqVUx38Do<@tjo^ zMLij|;RWKZ0!A{kI$=E$FME(COy?XPthzK~9rhCGSEQ0-vN-_Xs>i9Ru_-X62a?mw*jk*cPq)s;7 zNIHG~B&ZPPucOjzKu1h_*Mo3xczLP37aME10GCyCUmB?4G4A?dYEGp&rZQjI|MaBI z+4M^jD7>=UND)21KpYPiF|5;_`QYu7A@A+${hg(IfOB}9J`(3}e4y;;M!SN+8jRd2 zyCR%l2!nsXyS^9kl5F{xzBC@^pG*QmSEE@P?d1Y}AH&h7@HzV)|E$lwZ5H zM<-${w+Q&ZK$z|!5|Sbb0cv+I_5% zs?34g)OH*4t(|5q6L^06qEo2H^?ba1raV}KTswiwOSFI3+I`Zse_4-t4BwtjpEk?l zB&5GRx@gT?>SNNiJh7BZ<-z_q3%FQciJMGG5xX%$3%r(m5E5Yc5bEwTy76BAmdQ50 zbjM&h3>bCp#Q^gewKsZ-EA*fr{UF}iy( z%6TrK@grJ!V5s@ewd2se4qe~CQ&PEpGwLhN#G+6JTJuBA$OK29pY%p$umw+hdl#JT z{`%z>7XQz5ppsVjUIahM0qs<#&6bxB==_9(MnD&EHf9`?GnX%4*v1fTej*^8Us(Iy z31feK#uK|tg!7r;YRKAj#Y6{kP`>jz>HG?Og#Mh)hKAZ|4eF%v?nPsQ`Q{ za^OgH)c);S0WT{ejp=XC3I}ue0zeGFv5ElqLYe*TR{=Wkf}UWlH&=lDxe zQEk+<5a#<4KI}vCxY9N`n<$%2k8=fMvhq~c+$GD?eJ_ zJpu)Vez81oCc2rW_XsB+fCJ-)&2JmuXu+{5fJ*osTLoO=a`6s&$Y3i~vBi33T-a^E z;Mm`Ne9Lk|x4KR7x~S>Ra1iw5^GQZ5PPd9Uh zetWLb{862_AjVxmsu>&e>z^-f;sY-aSk0m2h6K(KPuc0;ON(!`ivm&7guhlmf= z%DDHeifA}VZ32MbmPBYf%ma}SjOvu%@uCRDL5ZC2Cvj-cH=9|E-j>%`4AeHUNO);A z@5>q9d7#jj9X)SbtK0CBxYj6Y_82e3=C&6dP5*XsuJAKh2vaEMp#gcEr`5HId-So; z>s@ngH)dKB_)@B6n4kT}c!aXSX?C&m6{fzfX|o{s@Ya0|!`@^tHq@RIPleBzqPLUG zqdn)7CW?tsoao_R9wwVX-qMhHUfh2h)A~c*Ck5i8{5V`0MGIZ#;49EC5TSqOcbSOt zyEs6Tkzijf!k%-;I)&m9#kseJ!l>8tPA+KTA;78LxAdrIJve|C%3A$`bN7Fgr zVa$0uPOqgPBjaa<#uY*)=QoXa9_iRg z4Q%z_b00BlyCE+hcKA<7c4?(s{alZL-X{=~KQ{j^CeYj(Ijepz*5cs^fig2^!-Ytr_z-$$?b zT**mqI<#4RS11=3|MuE|4YnaRO?s0B)L| zg3-yD+hhf8E%J~RLArj1wC8PA$J}W9Ud?pynoL`a%wAPCl#9(I_jHZ3a>>oD^U|3) zXV2ofWclP|#GZPrj9{f&B1zE24YgX>G~=to2BQFz7g&YgULa|2Y6XUJ77V3|nxc8< zsPk4IgzhfmY`?^F6rRrgd)iwjO?+!Pw)&)w+9M1p$<(7|Ah5xzi8U~*cLNA@CJXzzuY_kaRuN7YL zJkLnWngvj}fIV}q83@{$kmIhtZ24`tn_2Kj%J%m*rQGSti~JYr$mkciHrCImXa&80 z>H^sWaj|sAI}MUqXtfCtfw_ECP=rcTN7iOI$$9{4aP+`;^%`q)X#DtEG1w*l8n8Dl zeO;-I%grDR%JOTgz~zxc8e@eSP+gskOZ>v+K*v3}dDb}wyxZZ0mDExeKHPwtAsMK* zLbQJpg#M@g)pFi%Sa|E+G>31zF9_$EA$Y3f(?t_xz0&ESl6V?KDoxSA6-?)fYtH2r z@+x`?p)v=tEG7Pvme`@IJT;VJ^OuRAB&TiA$FosA{(pz&8!d@?HLEg~Tlrg-4-D70rERk$Goe{6;JLv`(hBBpyI z=9z0}=rP>K&%k38eL`;i$mHC&WwyZ|xpUemF$snRuJkD4hn!GrAHc??f6TxjH4s8z zkCN87m~!+v`v_YvLA;;+Qys#BXKQS6Q}L@Busjj~xx4RpqYD?wT?7ZBZMT4K`f5c- zTV)O0?iT=R>q-H|+#Mi7jGgiuYPPn$7LkTCJSZ1-Cl?O40it+2PH_0g!oZS)# z4Ndz_e*>Zl4M1XAj9iZfSS?Io^lhTar6UJd^ZtfblU2ci*t_4e-Rq$*cO z7%ocecYa)P@iX#m3r@4{DU4(==P5gUgkO+x##8ej=gP2$fGS}(dnZ12MNo#i z0NiUCe7;KJaeG8x%zfEZH9))@&>wM6ATO%ll88+N53mQ%9g+DA(Q=#hVBrN8*w9}s zepd!N_g!05Qls0#Y2eWZU4FaWbTN^)H=CzH7xpn_Z>qPn{{8N;o2%s4!%5hGwNVCN{2r%{vC2T6 z7c{Ha2|lVD05+mhISv|^VSm?u?!0&^w^$b`b5dN9R*?mQ#M6)0oi`;?ECB@p!@e2m zhJE0SDlRbcJI2}^G$*S0%ken&%@A}3je-Oe-R9@B9ugh z)nr4fWZ3HtHpU<8GEzN8Acd=%?0Nq+9i3J&nXc~~r<vK1vOC49_&VN=nUENeLi? zS8=~g@md=Ep#Wp*zv4DFlt<2$5(frTc^1dfxb)!}s*#c_5-ioU${;;ORwV%%z=C@~ z^e6BIb?D+;B#?_E=Xw|OY>9oL4b3NCCm7*C2!8P>j(9*Eo-}=wJzW(}r?f`^ekB!o zsr#b>gi&da1oxLRO%boBxE>cm9{1H>VUrJEm|Ic_xmW@@NlQ1srt5wx!n;60CSrGkFn(uw(by6<*Tmo3MI=mSqf5sz*0 z+s*Y^o>yn9aUmY!4!t^^`hA9d7K4)G2;5SXE>?1Hqm zfveadS~-G*lYGRx`q%n{stP>nv#e7@!dax}m7?$BuFF3xYd#jZvfM#mRU;H(asxNm zL{}y{t{;A!K9PM-1@;BpD%6fsgN(dcrQh`Dwc8I~Iwd$*Ah|L+x;YTx70c~vp#(kg;`Pm@N$}GNTf4`2{h?E9qZDZ4(UmQAaW@T-~{8ZXaCgRiw z;V4u9A2>diDv-jbn24mfhG1u!8X?o;jAdO`5UeC62^mp{f6fnrZ$pqFa#3dtw)<&S zO-)SzQ<2O<8&07af4M2va4CQvs^mqqq&}r38V$!ZAf~oFX^ld zvDzBYnma@h!&(XEef?KiqN?bgj@v8>{sbJo%Bdpnx}$ucfb4}BgDJbBUBl#iM3La`tj&gO>q`b0sKjAds5C-+6}a$cTKmbJ(|lyF1*FEL5Rz&n?X=J z`emqV^1(omfu=*NrBx9fhL=3i;Q`;C^n?u?{Z5|1R5_tB%}BQv#ci0yrTB?fwX|?z zf=WWl*sz|X9>t8b(GKmzy^d#(2h9W3^~eBFKBQV)=5ZrbK+_WUaM@UoAQb9TNb{C> zr?^!<@wp5q*G~<_K04GdcdZz9fm!#&afl5)4`#$CG*c<~R$Oz{$)XndmUzqDey+%K zcQm??_((U5XNZA5O(M@7@>D>GE37A^Lp;|Va!5(4bo-m6TM$V+$*`M80CA-Pot)y` z=!Xs6{C#2Cz3aBZvXr!xIs9oDM#9!p@ts;Lb7z&OLuRdWegvHahr59h4lsjSajuBv z+db|#B1+=Sp3^F^fN!`z7WaSuOYE2bcJ=zdd$}>ljQW5AP?XUc7N8VaF(nKr!VYK& z5c7gED5%FJ>@j?;cw$vv@?MMmHlToY=+(OVdK*36249hlfy}fov(XYQ=AAG%Kn$-c;tJYVNox_r7H0-ZMI9z(|5S4#hK_IueMu8l1 zv+MZSU#oIFd~>`$cO(IN@n(%YSzd|T(fwc>e#OwEj&_E z347II>U6z~#8D$bm+I^ID~j-r(G>xDLj-V74B1uMwbmEYa#3w{Qr>h{aZg4eg*q8h zP+)wNs8YM=l<*W~H!IGq?v0X{+MrEDOP}Uja|Enc#mGIMyrFIf&BD;+G2`!#xyj-? z@s*KCsv{Y~ME|0m9n+-6vzX*YuMz>Zk=Iie(YE>T_%leKSo|O&%+F=HUW7h~t8A%O zu=cNj`L2Dasj-<&SD^k3k@V;h<`f>0rz|MD!wRLSsPLp%tf~`8<>_V$%_2EDhP|aaamx> zL3`>hre(8+xcgG;0((l^)n8W1K<2vFH9K9IjlfUml*J=o_ZD?Mi^K{{3s2S0&~~mR zT6vzUtFLtrofw8mg0xZM(_HYikgcZLV@X|lp3`cT+On#XgOVSQ35={L$^LFu^0Nxz zd}J|a{iCCgo}WVOn`Et8Swi-hsG--NdljN6@V(<>@8W$D7>^)LqvASJAoi}g;olpd zb@gyp^!tO_s5wtQ25NcRC{u~1w!|EMVP!t_N*_l=tBJ3_UN%LAv%#-d%2@j+j$sc* zua!XzOYQ=bXcfn@TBL9z8mRZ_atxKVx|T$?I8K-{p}wQTL>O#}YRQvj<%3Nf@dkv- zr>fz37ZNc|5vHUy`CE=!jUQ*iu9Xc@GWr-sAI?>9MX-D|!w3Mh$ zBc2Y#@UL_r3)thHIdP3I4)3al5wsq$b1$=kh(`hG5=sZTjo)KLwiwnUTXitxmVgg$ ztfKyN8_srTz*q?@C#jd4pq0hLbk4eS+mhVxIA+H%+@-JcG2+N6Pc)vyB$tdYI=2M! z;tj2UwNg6-WjB0qw5R-od&423dA&|_x=#2u4D(utDjv$J$LC6r`1q8+W>dhVx@oB17(v9Yck)D3`u86MCK! z9Wjwm+6~2O8>xd+Y|`)&Y4(5JRl+BJrTFyawpjf zA0|)I4_v%D{7&T4RX)@yHW{I8&r(njr}bWxJJvj}yZ^61)f> zd-B~hxXM}y_)tj<kGUy^$mRV+15rvHs~Dc%`{ zwYA4Hwx6q`;~9MVRh>_V!#vwB$N}7*${EdWn#;x`kd@9IP0YlPLJ@HN30XvkUm^wn9y9%cc3$>ZT(0^H9^rSir$V z6PR1kt6NCy-AW|yv9S(ysB8h^m1zA}tvkt~uX~*g3-h;tiV%T{mKGEdpsUUJ)D{&L zt;b4U>h@=ct#r5FrjMh2SA-~khYl@9i%uliuT~@=Rf4m%7*#Ugi3r>hfbdGH8>J;e zc5*9)sqIk|zw>r&5WQ`A^$A+)*6`Q{EvB*dPplWJm*Ge*NO47$)9cuh)xdvV)F=I7 zWkeWe?Pq_z+G8xb>gy#Io#9X6{M-{sGrI!Ozl_G%T4U%kG8vvfU_?&%9MJ8zSy}T* zYFUs)%4!;ttEu6+M12epo@N95Rq#XwYq)(Ho~QC+U>FI@8dlu^u>XW}MB^KrWxHHM z`9>F3iIi$dM-4^bfflcJ`9qyuT=W99-j3E<^?OwjG@GVI(|l&JC`+v{8dm4CwKDAN zQCw_b8zuN^>HxIa>44t@Os4-2^y2^D238W_LV?dBMIGk(T1^05`y=kq2Oxpt0dT6SDg(z~_l8v!?<;nP!ERX3>aERPgaLaTs4b3!m@ zz`BT810x*xTg5MFUDaoVzCvi(MC=pGI1BL~-w}vd<_C?cC8O$Ru@%&%exzVs4aj>F z)RZK?2vc90K>-tJ_!n{}{t<{qhG@}s93QYmgmUDnaMLk&q^NtUr3e-G^>mJqmvGtj z#zAOwOcE*CqCY_=Mkqn&FTx)#0;rNa*{c?xJ140kXCGqqqgW89576*FJ3Ct@34sK; zBu3ZF5OISSMr0#;UlY*|bZAXp`uJSb55;qa0;%>k6aJ6~8ALtwvU>NZilt2dh%s{^ zqI5Nx^6xRcagWtv3rQjxU7-uWF(QFTD*@OZ`;B`#9^BleQ>tZq`+&=g)c%^n>`wyK zyEYnXJgpIds)g>_{BW@~48}yC3z4b^ZuPRER6RvYM;Z^Q6-TtK%y7hkA4>`1fJ%FW zHy?AEU9zW~3+r`MTgI$>|MqPzv8QcM_zp-4U)MEY&fnmnfzAj8^wh*lalb1zwX}@- zkSiZX)QBxHh;`Kb*BCzvDIs@iDp~oev0e~liW-B+>eaA(N%^bKgJ=h7bVbOwi|wZ% zCswSm^ERD&9fQRKxWZph)3bkgor3x6rph}v$%3Lvx4wVaiBscxd30S-bp7M{49E*Jf@r9qS93P^FBw<)HEi?`%HPv$7!6~QP~rp6>k_x>Sj zdE;{+<^Ps3DCjr6$sWg_e_C5hIniaHisxGz3~ldnD=gn#wpLWQs{0&hQW}>xIctEa z_Y_3H{$H5;Bm*FL`F=JNHjCqIu$>8;?ePEtlCgXhVES_akR&|l;G`mOPE&pY6jIFC zoVPrlUAkD{9hV4q#C<`i7LY0?=q5`g+r(vw2UQQ*+5y3m_Y|mf8X$NvvsU(^JGj8# zJdS7a4hEa1~ja{A5@2o^lNZSL6W5&sCfIF8|oIySxOTrB7T^(mU?_F#g^3#ObQ+ z2Pe0j&T|--4`G;-q!s4*7#&&b7O}ISBJ14AW5xXf?jrL1dw{iJREF2 z|H<7N1{Ou!GC;XL^0o5a$-Ma6nvCn)VGeb8pCPidYVyt9swb~h>OKduF1oRe75;h; zqX>FtMkYc#Mq}X{e4xW8=c&yG+1(JHN`bS+=05!bf&7@5=s##uDuf{@Iz8(~aV#>e zKMFNnd_V}V@crsycrZ#PI^m&Ytfza)0g#f_kSlDalYR;{C+-{ zWYnw`BLNyw_?zqkfVTE8fv8a}*jzwm6wVY}aEo3M{-rCQz^?BeOs{7|#MVGOJ=H|6 z$?hukscoRgyuFqd>D`1ORRz|Tv_R#gFC2SfrqBB>`}XrhEK>tec$l{DEuTLQ_!4*9 zTGi^)?WrN{gsu2P#hJb@o?I6WGg>B(UEZ1(I%SJF)88 zOL{T_v}Y~h81{t}KL=5vDy{X|PlfncK_*wMv6Nua$9iRf`>HR!kH%cy$El|s0urOO z2MDpYlROMHO;76qaR00LsZO`5yBu4|GU6r}xo>FH#k4+1;vv(f-&|H`~*4WF73dy!ci!Lz}eK`KJlEi-$@1*uLn%y zadis%Yt}b(JI!)cxzMzNTy;jr#h#~;jFv>d%nQ(4f;4IeVxkZvI~150T$dNBL<9yO4AUfbfX9x>RP}4zy+3B~W3ZtpImma8JN>1i zh;^txLs3)$SZ_~4(;TxtFujQZ=+*;#qErp0xixY5-9PpN;sP3(7dW;O!ADe)Y(vo1 zpjqi3U_&uOJ$xB#7Io=JqF_rl9J?p%O-$b0!g6-4dgKk9wPSm`#h_J~d^CZQux@NLb2X!lQIzITJ|GmVCnqw;+P_ zUzCSxHZ^Z$SJ7x5R^*ub#(4#Mk#{!OYyYd6Hu1lhKg(_NiHHWtptaU z2o+Nbw`}zk6k9sBhRO0dJD_m{?*D_k_l%0FOW!_=EIAYwIU@yU#NmVCx4($u@v6K<=!y^#C+l+12r7(%osH=D&lX9Ni?#s=-<|VX zPT0CXVS`_JZ1&j$-2~(LNzvrfDG1%~6P{w`2YR}S>i|}-2nlAiXRZdm*nu^0Mtls& zZ0?`##R6%$Oe8+YTzzD#O!iIuwFFL-@rnNW7umU^+Kjl`+J>besvKgw?t^Ij7N0yA zKCO+R2ZB}gX_P+iD_EETYmaAMNJD0*N3#Bw-S`fEMiGJ7?|tRf_&MK`vAz_PzRKGJ zCn1+vVf;nIZz>iRei3N?p~;jbE74b65icK+e>)utW(aFA3Z9(o6Yq?q#mxKioxIX+ z6C)kajM27j&U<1abemDpdy|;WYA*WfQ>q*ojs@%#7QCPmpWNfs*!M1|GpZwgyr7s; zNOC5T>miLE_IuFnON7^bWJbn>asX@JvZ^IU*t#;$DmPO@Yat*NTFhvf zNlz82IW$aK7s>jn0&qp54hWCc`?4E=XC9O#J8*yR-DGjT$5E>LIX#m+Jcu`5{q1o< zRM%Ehng&-6rKKG{q2DO~;bIwWZ$dv@`-nS@$}1swMm06wzVj8xDlg-+Vh>N`NR|!9 zN1Nj8Ls^iOgmco|N{3G`OE!K;B57;X0}BXe+=*%Qth~eY$H)xyO|EUvb25-1QgbJn zZ39L()er<`6b9=}9Q}dogPZbm>U@uadPzJU+0h;ji2UwiCnbrxfg)D$Y=wISv>>Ha zCQ|*vpagGOg?bqTpQi?boV!`Yh%ap?$P`1Or2;jO zUry|ris*cq(3YF<9b=D+CG3@= zWT-M>I4B@FaM+}XM9dx=+*=@WCe_Vq z?LkrSJ8(*JpFe_^%bz1m*qWzz>B3=c-tSoBiz00MS5X?TLEg9)A;m4RwP5ovwCXPR z?O64aJsI&@LvvV(ex*nhVprK3*F4L)1-b~-ap{2s$eqJo_^Qg*=eJZ6TNO@3C+((V zbmC(sPZW7EB92>+(^rI@Jx4by)2M~=I+b7Wfkf?MGHI_z-dPcnbEHMX;0<9yk?5o>4S$4frO@%hCA7sSkL!i6LK#tV?tr~fC}1<# z)^X{g^0?8SO2i$9IpNo&93+_4^jy|u7vpge+5Uj^nc*bSCPsH`BhlPdM^b!KdnA%75<6m8a%-VA9Q}nOln?kdUp~?E zpMPk*%QDy^%I{Z*aMn>x^ zaGzIkg%BKHLCBN5P{}q^G6jDca^2B_%g5+Lz0pw8@bu4m(5-S7BKAa{O9( zEgHA#rW}y2iq9a};wNw!ep3MMkLHt>>7($%G7oC;4SVV8_8|m^MuKz+X~Fc+tFz_^ zWH$U3ry@0GUNN^Ygvg=cF0P6$4&|AaeAt;*o)?fq_93!)4fCfJy9#yUVvemi%-9El z4E)aX-mw&d!d_plSd?;p#4=e?nwEA+*GR3rhy68?O8LqX&Ju0%K$Acd3S2 zOcZ;NnBoU#k6jNy4~lG&Jx3(`#7u?OSt(*2nN6*iKx zo#Pg8cP^H6oDB4Jyna%7Z>NioH11%1S#cNmXmvO1z>i`XUVi^1=cMsq^)z9nh5BLs zX+RiTrXBI09_YxWxVi>Js2<8|l9-G}E=B4lUcB13IEmXDXz7PV443!w69`R>2U1jfz+=hRzIB7gD;C0nl0_F zBvDqsJGfys7F7*)7n8*o9c}CGAh$Dl2LykVB30fd?H~ats74md-M*jle%As~KZ7-V zaVGc|=7KgueMvgnBR!TQmr!OZ{8n6|D$fhXkSMJ%y9!rv-9}uM=z}nQ7?3nNa65e} z#dc_-D+?ccz0x=-x=*p-nWjzEi)&(BE{L91AbEDd@hh~WiL6s;Yl_JpAXZd;IKvo* zQn{}!ibG%6pyUa?f2~zLGBjQn5>vzvi4-rqw>Yur05K%lKDc?7$~Vy(XZ#-J^-g4@ zOdCG^Ma>+OT4DUW#ko=Cvi;KnHp!o>&F=sg|Mm3Gd;*$Qy4z+AKaB{BwUlmD5OSi2 zX=eK{mbqM58%vd)=LXBfD&(H0pZEMH4y+42=#LN6S{kk_@$;{?kWUILa=d6G9Cm5y zUkw)x$tjShOFM`oKgm3w6*CR6yOl%|;zP$-)`;R#=^uh69O*GQrNRpFLOLF3jn${M zBcs_RPv$x5-Q+RkN>SyTDdT72cIzuA5!zu5o_A*B{O!ke>AncuF5nNqEwfUyz-r6g zx4AX38E%{A!dUz6cxf1Zxbf6B5c{D*I4~wyq%K>;7F33co)!&h7!?kJURB>NbaRJ_ z%Ks5N;|IgYGj7qa2|5MLEtjsAVhq+-NieDD62+n1Bgk+G7=kaLcT3O7tsjiV^s1da zYwTvV2-@pMQCXKOgk@Oga(S2c*h|S3B2`YPzCfaAmU}0fhm&VO1fT9_Rr}%C=^Okc zbch6bZNQx5(UM$i9^)CamZw}3k_P6$rIgCW;6x1rQp3mAvyE&+Fv|7Y5){(DlzFf_ zhduat_6J~EoE>GEH9|v=W7)trS&J zYB!ab3d}>2f6@s?yc@t}FoijivcTwE27i)I&Hg~iEx3Fm3$}lA#VwA|tRPk*8rbEVna+1k|a ziu_u$beLa@5_WVDMY5kRF0Q{JigXBKo|&Jgp*pqMatT$j-?6)C4+~6(T^=t~)ML&Y zGke2!N5w;AtfbCu|6LLY7|^VPfk+A?w=eyxk5m4Px3w9BxBCs`tXxI$CP(1$@HdJI zLo39=)f2YHkx>j<+T^pbT3--h(FtPn*mTO-pc@{dLH&4GUF|0qG6`oGb!{m8 z1C&%6S8iQsP}b@i>IW|d3^ferl^wn2C;EeIdYJe4JKl`b+Zh2H+z8z1PrTkaC*5%P zGfNT2w%-KL%zE~;y6(*8fj0xlPm!P&UJSyagz>S=br5V(I_oBoIe$!>eaB*^^bDt2 zDO43{$tQysf2+c>;QMcnUwEw%l-n?M$+)Bon*u5lSmFy(qC-=QK@(KsiNVeL z3ZcpwI)kltv-MPQ0k{le`d@4j555Zs8n!~{F^mf*ozV41dZGLo@gdbS;eC(+p$S(e zPblZjFtrz#)!!_;ceR1!6PfZKE#gnJXI9?^y?p%X$I3xfYx}aGIM16i^5*(M%+CPv zq=awzr`Wqxn?u)RPecc`f+fRkr{dN(f*g1B3b&A*va&|kJHIuzRD~={4#ExI?m;`5 zAZsBy!3;kST^!|U_jhL>hU=3j@b(FRVGNq3EI;=?c6qIRia9vaS2~+HX7tuG)XI{0 zS2Pq!XTqU4TlS;xHzc4H3ndAiHn&~GHW8T{c&PsvhZUC`28SruE>+&gPjMp8d^p{J zMrS4$8%7VU;j0?Nw7_o)yzC^edqISLcsnaKNE`Mu&ero*_s_CViWou&{x$9vlTwA- zV2)#6{cU#~31jqe)U6?3mu5tc8heB<-JdBwXf%rpW3$sB!X9{$A6zGa;eR#f zl0L#YF+zm|X`3qdkfRTIbBwO41mwRly%w@J6ls^@rJrZ4{`{!#ks+IblU};}<6e zAP60)FBNOp-$g!@YbO)Bt%l|>q|s@-lnz*u=`wcV6?RH$EzNwP+}+{zf|#zqQi?CG z5YIG01hP4cscemT?Bu|6axtMd5e>cYBxqANy#V~)!X}OM8ZBeU>h}jGkt~Hr^qM(I zP}Ms5*fezItfl!i;82d<=28AsZ#5S}-W?X{Af>FAq~YIRb4k>)f*70zNCWw{%8BQr zNMzGf@&OK_;GURXaqs=|@n*UbtrERhEHF#|WLjb6mxiGFtQF8K`+1wS!BI9mR{ur* zVJq8>;w?zds`Wk;DhIp5ZjNDXu^Ou9@Dtt>x3C?IW1hf0l)Wl;q(5d_wC`|oqoEn) zXfAW>xGg?W&hqS~MVnicqs;Uww_vDKBX0gENIY!@+UMw@=mzZZr(Ym5f#K?jZ!>+| zSt=Egt07_`A73eX=0_xkO?}IaIP81UbX@jj=|1kn{HS|D9szh5hFillpu$?`%JyY$ zvwX2V_&J?V8gjh-Y)WkC$$|Mt!3obJZ-IQqU%-j)&1`J$VdB#|2i$tIAJvJdRvac% zqQgf^Kor+7s+Zg}9^O?QRE!t?Ir8q(V)}y7;y9c)gz=J=;Panrx&pMl#=oUTi_Q-a z`|>0Bx?g6g{|rZ%7cxFS>aT^H#ISp}0Henjk-exb5WgO1&b443Mj$MJ0Q$7)nNsVh zC?ckT@u;hGXGQ)*ftNJ;2FUMVKPz+qkjC1L_VcY2(>$L670p9_JxJia^Yh6i=Fm&$yia#D zrm;EHQFUjDgE_~wEh;%NWMuh@P8_5hGp!}-!edDiwd)hW>3=LD^X(tW}~gDJO1 zP8tfLARfDo&)`@=LoKGw6Nue`Du0o*D4ALvylj1~iMm06?sKxfoZ&5wEy%HrV=Fl@ z?MfutBV>K?r`uEI^A#eGP$xZ?CP4sFc2kyshTXDaR)sZa%T5rwe*~32hoUHLvh1T* z6Uh3VmULzP0Zm{U1obzy=ocX6g0tcH)coX`OgA%4>xKgbNjA=(+5&M4Ac%#?DUfQ? z8RDt{a>^r+WeEM_A99KZq%{Ti|3gjzvKuuCh^qop{8}IY3;6Fpze=u43I>J*`!x`Rq6b*5R*zh2!i{a}^O+L}$OOCmByOfB zDcP{QiJyW%;BDTt@u?uMD(=bGL;_AcU($)aA=`)TZ|Cj!opJq=7b&@P!oia2Ozc3Ra$9KN1}YBuWmkTQ)Obx0$cEofv|&U-!HMQ{)bQq#ESh z(;QTwUVAnLS9+hsOiBxj3=21CMAEQdgLYKR;p{8K+}qms41Pl7-v(If9UJrN`vazA=5n4$KY#<9AsQcBMmU;$4pTA<>vDEPg9zPa- zc32HdJ5dihOp9d2G8vseo;Tho95ev8BJ(fE7LSlp>7zbnccSMc+pSiIO$K3eLLs{E zlrs}*cT{d1EE=Ia?l%)eJZmlHEwdGBu{Zn+heJ{oB;gXL7_`9P#4{#Ir*tNO|Bz^~ zBk=KTqn9JplekOr=uB4_*GQ@S1@~E%p~d`@Hi0msx5A^T_zjPWu5qjt8PzB)O&rQ#3KfG z(mUDJ(0wK#%!^EjF68)OCsAZT^GJ9{YW(SkY-}BM;#M7Lrf2|2D`p>rXA$i)Ol|X! zazUqt+D+;2rJ$U->ep!z8~l}7C9h_LNUm@ByG)Ss5I{>E8@tP()HVA?G&$X1+U!q_dec`0`P3qA zz+!tFvIJ&dejxoI*E{WOfe#XC0dI*MEesOso`<~QRmm)e0qW3mJk-$qK2!Y*F-yj$ ztHgcEwqMdSg?Pl0V&G7nQ(DqDU~I7Pz<9SWw+) z?;*=;z7`~LoeDfwy%0_ODX{t7vD<0{fdN>;>C1aTYq9M?E3@;r59kK$7~29Tg<*A~Uz=%EgLUuJ4VC#flhk~<_V*m^$w^At?b zYXGMi5DX|P+=#A`0egW)^g%fBQ8!hBQ4-iZmjMqN;4;$+j-LtIe>W3c0#W6jfDH3V zFoHN(d((aY)^Uc9o>d60dZbdQwC6CpI`8UiDeHYn3n^G_72v-9$fo~KHZrT z&Uz84i@!zT&w>`%qq+n{C|dFJUyqR48tZ2^gnqkkVfAN96Qw-=ZJYHOoWu|4KU}vK zo>|QMI{n(kCuqR=T4(+azCq35odW(RjW?Nkr>Qc?Z{G*QA^pPs-t1+3k`a}$Aw$>b z?<+!Sby((v->0-=`E*HAxUqL|2JRLjUl2?VG@PP>TcwPb&nC~mqOomR5rJF;hGjm=($sgy`%futsbYS#h0*!>Tmi4!v`vW&Uk?M)R? zIR3oH>^(%!y3jpAv)DIYiu7R3m(cDH;tHA?zz`cY<#L}$@Z1&LCQPXQm5j@J`640Z z?}v(sP}1ekyW*Z=r?H>CBUh#Ah}t2dHEGZMq#dMcTMD341#DHOq+TbMP#^T@xaVh}V@jTv^q^#nglc;MZ0#KYGwtjv+3<3w zM3?_kl{0k8y*vfdh|WJnG-NOq%bis!`*)SKKLulE*xwZUs~FK z@RXAM6#-xIX{2chSKGGn``{opqq-3CWT%73VFz|_b3Z6a=7#3?hucyuKF*kmV-rXak~AyU|Q( z&D)pAT&9z{)J?r3I)P8|US2s$h1reO=S|W|0VY}Uukp4v-=z*M3~VDEe7G5GWh|Q6 zw2RUR7cv@C63wW;;|#+5(moK)r(H7(iJ2V?;zAquR!qz}U$7r0o8Qt<>MjDMv6Km8 zm!MWKl6Y*fuF$P`Sl-r(?U>xWY-LCLC1vXNL4u=6sal!h(sp~5buRu3OvZL7!36rW zU^4yDt(6ho>if<$DzTPovd}2(SWc8-<4lk$Y=nT9S?E_WQR7BnX$}+ii7su}gZ7`8IJYtO@`*_E3q+Yu#9r)t z#SqCB{Jfml+A0diC6(037qlW>7wkWIZq;1{5=X0-(l{Efn=Cn{p72W#81Ximd>bgp zaJbSiiZjX@M3EZQTo74?1xu=lNE;Su4@Fe~nYzqzIZi_*$p)1xeek~9S7PQYk*RKJ z0gWwU6O*w{jHnOG5YC%ja=6kO^(ZI~#>|+^OKAq0VR4=oy!(Q2!10A0^ZB-WqquIq zg2lNG>EX-huVUpB{(J>((n#H;ZSjLIc5(6PRQPyCf!pFO_e!5Y%^(7A>)ZwLA)z~fm1y)oMc ziNGh3t-#f2O7cT`oZ6c-*UEKo@`N19L^d_Mkrvn|5$o8OrZZvnz@sAElb3AUwKZK+ zF+cZY8IYh3o4$QBBa?HFD;I@F0g#Ie2Xn8W2vLxGcdE^7@}+cLR~EWU1Sj=YmCbGb zqljiTD?8DHS2{Mc>6^lj$%b@MAvP$P!xN3cm)B7fJ_}F%>>A%oG|-d#M+=>Q{Ez~uS77A}STdhA zPPCYJRV$8S0_JkSVRf-$QKnVr#hxmU;@Z#USk5M@kUSjUJZ9RU-_h!LC-k&3PwaMf zC2ZzGREdHU4ncDaT7utSCMSc|PYTac1K`CD=du%8*gJB!l`{hko z(7f)il1P-&uLX?@H>-a~L+wuw0ehNDfm>ObjmX8xIT` zfn#kB4;2(wpB)qLMV{s>c+~ReTD)p!%d_%pIuHp}#SiC<@9Kvs3xuf0wfw?1A0NjI zbOZP|*X6KC0u_3eu@r$t$s^m*HW>>1y*cpug7y&mmeN+EEDJ8t!w?Nv;pWYy0-J zk8eLuG*~50ihXwyo1VkAiv+v^{0p~`5e!bv0yl^pq z`>fj;_p<+qGl`Cnr7=zI>G?@90vQkiZ~>de8{WS0!DY1x>T|Dl@YiK)FJ@{EgLuhv z0D=(8y#Ht4Yl8|osrQ!($VDDRp52jdv449@vai*I))yy|deqwR+LF+j`|D+#udA4c z^QE=i8*jLQP`nXn&{BLXI`oT>`IXTDIw(_?&o2SlfnQ%qTs6#Z%HDu!;urONT+Y`{Feg{zA7F1WC%L-H(^SA|F2> z1#E%e&G#D?55muvKm_jHj6go?AiPo(dx_fQgJ1EuOjbX<%ZsSd@mjqQPC}wU24~m1 zv&$uE6>|?SE$1C{CtJ#g?PxGO{03J?@H^+5{37;Y6R&dng-PEmioAc(ebGGg&S0?O zY=PMNZ^#t(e6Q%-*!*j%(nZe~dA*cGa-JkL|Nx%e1#KEk`dI9u_f@0yW}mOi0g;$FEx{fzd|n&Vv&IoDNr?Ha3q z=7xEF=Y`^4mh*PJli*Cuv~GQ9_q~GTckdEc+^g^^6RPKYrJQXbEA|8PuYw9;sTH_* z_zsUwp77la>osa9c%0q&3eBFs3g+?y{)?`KLDR|CyglDb1P?#>!N+-TRFcl?z=VlZ zn00kRn>(C3zA=iXQCI+;a3#_~_O~Z9#v11Z4i?E^)mmuuREv-WHIpryXwRx7*GW?5 zp!|yh=$~dIV~Yd?L=#hk{U#`RZI(N5IyiEc!hmdyu5G@6OXJdRc<@X{3Vp_{w8Gz< z&Y6R7anNlwMqL`RXDUpp4Yv{#e+UN(x;tX7hBEkgj!q%p-I4M@^95wvYUaepG+hWj z@Aa-~iMCTJ!TJ8B{V|ZRX?s$22*i1xZ1Pb_~NSB+vvup*d?Vm@%~WqumxU zYgL=Wcu=s&Efj|sS~S70TAJA_i})qyJd2E+Zr_stNA=+^n?IY=(sMI#cCtL6lQ00S z{C8D(Xe7o*?t0~28_rSEU@?I!r|%-AQk6AlTaDNg%q|!+FF0r?4{pANRd+{Kx2m5A zeGD-D>UH(X>Yv(ar+Ayx{5h53aI_#_S?MWEqB&(@9)X&FqPbZp9~qb!Ow``0?ibo* z=65hC*e}K(d?LrG2))aHD#dO*ZeDKH>8r1dQ;RJkYt}1Osm2J+u>`zz9i=|Xg+C^O z%XbR4R^nop{Ad*^1P`pGbbcCPBDTu>gzLWreH(F4Q@#yE=si^ZZ5k&HKLVyOREXf z1res4U&+2sZk_XA+;aha2Gk0bl2An>>j!GpsjnTzAK6%yKh&ny3o5J=c|O+IJt7X! zA!}yaUzdN!D{{KS-Ix&T7HZIB%b^`uQj39<#HM&tao`a>Q<(OH%U@v&KH*Q+AjM6N zEetk2E<^H^O!5z6OQ<Sor3d$G+1E4{`8PJnQ-CfVO}lLv)JV+yB}=V=5SIdjV!iK*Qlp(^C{7sQ!{fskp1%q|ShDYCm^TVpmb<4K)b|p}_*nNxV^rnJ8>(HB++3ZWsR(^BVavT5|9jkI0jKb=5CE#^dWK>TLg-JH%H>g z1t^{w^Q+_#yq2)8SV{%K5kc?Z+i5P*wpxA1sU-bT*j#~$yCO*$_lk1q$MqY00I=B! zoXJv=xPBjT8y`9tJp%M;IS;z~4<<~xhN`^PP$4MvE(6($vkiTvzZK$Cze_{i^lA(s z5*lcrPEp?B4Rz9`F0(g=Sb+z?BG90Vi!T%720j=saXuM@KY(T$nO_+ExCsUET{d35 ztFy#o3j021m%fRpo@`>rw*Affl^pnBSA zNV=}mek|nQH{XVq*7yBxBP2A99!m9Bd1}sp6Xt4EGec=COfp;!y{0qYzHwHrc=50(jdrd^wm|K(&#gD%gH?(s? z{HUDA*=g~YXp`%7Y}y1oL1fe*AfHNEnH*8?YN+gU^zM(PFAaz|d)PmZC_UX@I^pf% z{uuY~7fwKQ9yy0j6A-0$Jm5Q$*H<{;mG1-6`n^^6c6{gOxx~Crg_|^ zVFA#?e-@UzcP?h;BEyT6?3e69rH47_Q_D&N)R^w0c73Ibc#w{OQ;}I=lc@V{bKm?& z>xtLK<+s401=+5~SgdvQbnqNootO05 zUG{tc^w?q8d%9UCK~bbNcICG}SXxL?T|2mY>!eomroWYD+khm2@8jBvpGOKs;SWIb z+ht@mJ$+~}-eCFR0+E~O+BWq7M8c%77JlTRL*xtcEjZUwc^!bM0)1>oVsln?1KUkm z!7}>V*omJT`{59rc1PnOlple9Qk+nCl%wQgolq%5T-RTk6*B_T7rZXJi**Ov?~+#wQPZ40j>^`(g| z?A7I4{AO0=1vM(fh8I1H#ovxwU3`$>Zcqz$&;|kasx#leN++~Nq>=w3HiDtEi#^Ek zXMV)K3T~^l{?{Qwvy+OxDE1IzV>}`Gb5tBn^P}db9^97s%>gNDkAUyJJ?h#H56 zB6LW16MZLi790ku(1_0V=10B^g%0cRHgt=Sgcnv%zza@l`{6z~uxWvki5zZn@Ic3W zB*$i?WPtI8V{EZR8n5;QWc@&rR)$lSaUVJsch8TKGUeY9^kBuSj;BawpjK};2ZGVe z_thZ`=zvcN@J)N}t;~GnF8|u6Wzfpb4;%us(L@N5OBDz#@&p9_(Bb}EF*AQ{rxTHlPjeMj1qi6U zO{L4Jr_Bdp+yvVZ&ShAc?{shr3$j1e`HfexJcw|L@(RkE+U$pzZc|GHM9A9cZPPgQ zHPfX0Q@kWlyr}DW1dpP2G_-Gi7G$1hAaI(c@%ZIA=_!S!3$8>oIWc$~-oHu*-wh-j zpnN_62N;>}AaRKxm2|J}UPRe7)~%cOoT2VJaNXj81ON8E6tLurNN@iD(!0`f zd#(e+KoABOc+e;vmuLirC58AbD!AuNnirKzAAMDGvfh*^Ne%ium=wP^Q#PEJm-xW^ zCGv%$uTIWAV`uJ*Mpt29jRQbFk$P1l7Ay-S-hKu<@E|e-EBo}4cT{zk3kIwq7BvV2 zM4P~#((Q|4kRzcJ-wy$v?yeZY}q=F^P6(L7T|2k+&AG zPw#xY50dCEp>jTz&L%e(^IP%qz&>uS4BY7ruJ2upWx8S}qoa8z3wQYulxX9J-|p~T zwPpvuwW+uD09Zr-j=!YW0T_pk?jEFZfMw^y~CU zgdr$aD7H|^KRsITYmmfL8k?Yu$;DE7W~t*eD#w5B%kbyEN2)g^7oUBY1#6Oiy`eG? zP<78Xr4;IOeU}FNy#SQv679j+AfEcobB?M#{a!46qMBJ5@Xu9X$fa&<`0zoO3p?f= zXLy?=mI~CNV6b7NI#RXFLl~@^UvPehpXKjt+V@8{9JY0CoZ;9j;;4lA*?scc;aUNC zPCN3R)**H`FTr$0!t@oS7GVnX(j9FrzaABH_GyOmTm~K5&_L$T>s5ar5NGG?07X)K zR+%#*(gky?i{;S7XL_WX*6tdd79o%SSV9 zbC7Wv+(%_l0zxY{NmH$SfXYn@z4Rr!dRW|z`&2`IrY7o64|$xZeRG%v6?Vbet0^T7 z=7gha%aZ=LXP>HRm}bQFgI`(0E=*K-?qT~j#wEHqE+d3nhAE{IJL#cDSRl}D zWkuD~XL_^T{z_7D=%wDNklg`JvVcW8OG9KQ5tAH9&lY|nfbHm_H%wikQSpKbKDoln z1O{bv*%fK|EDxYMcrA}OTN>j6{2xiN!!hbAj z#VDRE%S2Q*wlG&$q=CN6frG{*EJj9zWIBp;|-6 ztz#yBz@uxL+!K`Y4Fzmm*03Edd~tVfEoa7bS+-8*KJoO#%ioH{Ng`AwLY%}CQEo}J zHglbH`j=$I6w&L!1Qa-LyuJ`OL7?C`N=WNo$J}o=UVz-HFVI6R@Da!THCZ_clqhYF zn3&RobHKtB4oAr82?6lZ(EPrC%pVjxEha*s%@ZRjFBbc6PWO5P8!DFBs*% zN)wUa;y@7n02KBuKK^qRFuK8ueWzM*QXjeo8q|tZZl+TX7y*nZ`M>?dS+-V%SLC^I zULeTCO?AgdcPrd0)PF3E_|4B}?9Jo3J`Pw>DlDeIu-uWXCkERbb=Ii#?`I*v}HL!VZA-@u*o!6!~;QJ&a61A9QH|1dLi50FrZm^ zxAvA(UCtvpCLR|*?;3@Zlyy3{xd7wk<_7d9JE|y& ztvOeD)xeZ&s;h)}tR=%903~i$`4OxK5JF)t0wTCg1fK=2SXfgi-2vu+2Ylq*kASI^cboqrP`)fQGvZq9h_ZMQCDPqqq$Y>C8rQ zMzV%79}g52h86 zkAkdsYoEs+-`uQd7b5J8;}U)3ao#K&)}`H?PWU!4nCnTJ%Spk{lS4AQS?bLwE$TS= zxxQN2Y#s!=`;F>Sa3~+ARU=bXg)dQoE$GZ+G`>?B%*GlTORkfRDbiaF2Kg7dN)(Phw2pMm`& zS@r1(o%-#9w?(lx#iZuGAt^?%OCsHDC|ada_7lgE_wOZ16YcDi4(5fcgX9SZ;8o2Uft;ob z`3xMonorCxJbwe|!5~!pIbw)7{%zKRwCL<>w4Mf8JVR99t%){6@>qv&Mq)H{ylF1@ z#h2!+nRdi4MF$%maAE>=$P$bhln8Lq!|=FEXErY`<+fcxMFZyT040c*KdaKOmzP_L zDy+T1wBGqj`m2Qfyv9f48)Wh2k1eXmC9MAH9swceF*gPkfKEkX&5-H#bHd=;bV8O= zs`C$gmG9jY1-dya^5-xAddBO>L){yd>z;s?ta^N{Mj5hq?vW$@M)I++%j-wDL9%@( zG$vK`ktjA1x`u*XPirQS2{GEpNHv1x+ilXw%38%B9Q^BTZwfmXQlo6Qp7{IXlm50z zZIVc)4F^(`5n3s`sCT2dfdCmT3zp16Mtc4C0i4+Rrbu&r{tIXmP;J@h#3S%&bgww; z+Qm~K(;P9a=_$Mfha5J+;Y_45Eyc4>KAu23;@qcvLmNWL50QPS10pl9$Eo(l`5i{Q zHIh|z)tC$zVVIdr3XHi6mPPGEq``k-gywA1bXxIeOJkn3^}@XBfTj(Qc*~P%!Da}$ zkFJyz>2I(tTLiDam);3`1WMV$&poKOz%?-r(x#S`(F2~rJ3?|`Lk5V%VD*l8R--Xk zo5p^Yt#fu)^%k}KMK|!4kK{`JqoriKt(af(@jzR;QAJ1JzVRhSL9!vL?Krg-x;=66&LC)AtYKlFJ+z%FYZQd$%jZHxt zCz+U*rhDHQC5n(CU!J>2(<(weVds@)#k~M9Wg-yoT9>+JSEgrT_C#7JqoiIU8v&$R zYIj6nKoCN9qen`HT0{cg#IR9QxrLjP7@*_`)hYwj$bdUZH5@%rx@zDnm=!Y3_YvB` zBOU^5G_)C(mN{771A^xV!%$|pqp}9~4`MB9eFI2X`^N(@nl_#@JS<=ibnXf)*p=IZ zQ!22{2cavVC>IHF?<`W!Gl~`iA6gKiNBFX35AzQ{Hrk%=+KyWyD(5zK6+nIm{^@An z`#3EK!5vL-f3`WYFV>OcrYPm+5ViMV3<<|&pgy%XI(Y+HH8o_P+PLon>- ztU0FXgGX5pMHRssqi*&47_f039R1ct27*E5R5yYT9hv4nK4NKn%I`bj8I>;A)?#mrszqb|RV^$4?|VTMf=2y)L+~9355&&d{+=e4(Dr}|eAlW0)if*9PfrE01~Cd0j}cUGh;sxgo~dI_4*Jd>!Xp3U(P9t3ptn2FpB{LvpH*(0n#6>( z-dIedx4z_4i$143V>5AlT8lm$Jn!n3OURlF0St{)NKO8azqdczp|jO*zxQ!(8AB9& zlw)bxQEtLqcHv)*{pX(9zW+}@HW4V2njVBd{;TfpifS8t?rN%kzdlniZuZUdH!YFC z-<|NUszGdn@L5XSw4nEY{o2P1m~4JHJ_g6%%wOPv=??a;PruIsIRHSh1CjN+-1-0P zqAVJ#|D$$0O#`4f+glw0&_-a8`)9R-FT(gB(Pv}_^l9n8HF9D7pYW5OWpzKK&j%y$ zKbtq{C?Kq>n+FMz+aE$Ot-m{pnyFH0sy+Wof0(k{UJO-cc zT>Q7*GduvPW#e6d6Ip0_4D>esFVB&XZ5M`7`;TY91T>=$Ab+CguOOe+BM3$Qckkj^ zA#OJ?B`%$c(KuetZdm_#)v3>_b>hENRiPDXI6c$P-|g#D4R0`MJuOP3{4Z~m=_;|- z)3z`Z=}B72R$uh0a?ln!NWaSBqiorK^sCh74Yt6o%7*i`^Yzjj@3BFke7-FF!G4>I zkGUK_&K6m_=bd)FDU}*}`=1YV6~`WTUAcav4w0SczoU_!#xBICBx8$pDBS(e9-OLn zb*DAznUImtC;x@$bg{IVVSQ;!Kc4^WWkn(x+23W#)jj*494GFfv+g(f7`ARU9B+u| zSGeU_16zl2SLXjHw>uxew3jFz*oX!9{W?owIvdbX+&n+ZxnXUKY8<=$U%DPC)F8lH zA@K~z;g3egH_U^HGbSKHJtXkp>)2{F=y=Ig?=M!~@^C(T1LPU%VM~<{eUsftv)oc{ z7R%TH($pV1_g^E4AX&od4l-bF$E0*RV6q{?!NY3NHt}%ot2A&nu(k8tE2-;|fd9wH zHeoMw{H;i40bDtz{Lm3#^MBp_Z35rOR&aR%E0_^b;Qud|IKRt=2{Bf?e;Uv;FZu22 zTKn*L=Dgwad1Cqer+o$GF|XPF=*LuDnkwhirGy@^rbhN1wkB+1tc8wPS#k&iXBxYN z)SHR7Qo5uWf$CkiQzsms(|0laxEjDW{-dZXP}Ztnz9zokp~U&{zC&yQLbE~><1Xd$ zT!Qb)Zwg&WE0PiY!CS&3S7q4t_Gb%GbH$`@Tk+Zh zpW2Cv2_cGFT-d1^8uw+keDS-5?tp^cQ%u_%^M|7x*@N{Ye64G9z|gi|cn2A>^1C6rynFXDBezaBgJO&>*VvLjFX}7-&=Y$upV7lh0mwY?!8vtTp7D6^}+kR!N|#e zTlwsjKH}O<^xUh@OJdJ2fBl~|{5E|U&!TR-D#N0SHDhxuTvY7qRDEf82E}#Hp^KjX zvy|$Twbz+F2w+E%XZVJSz6RD^PxFZWqj3Fr|7+8T$gF4mqZ2$l9-sCpmL!V~ME;}p zkf>~L@Ily-*WW+N_HdFSYu?$Z3S|20H^^XYI9qKB)6pt0Iq=!Q2~o;d#@UIHZ^&zy zm?G-81-*;)ezDBXm&rQc$&$Z5m||pMd9Wn6GYHw9)O6sG;hqxPS=7Ss6$PJd=hS_} zA(K9WHtKv&$Z9lD?L>gs|Np$b3f0gQisyR`7gYaB24BKW=j;KUc6x!NRLXYewpI7pmU zU}S^}VOHU1`2F}WI zpmGMM&rhf8qD0sy|5R=RY#6XD?SQUvnaj6X0}1>kJOas81i{}Bwr5>_+;?zLJMIZv zi2`*A9umX(;>C-Jbv#3HP$xLfn~9NoKjN9BCk*fnk>Hcy<0i`BncjHbpX-x#?&i2J z$w5hNvlRRXvn~!qqLfdE*9>91Drns0oWnzZUnPyv2_*tUN^s?wr<0m#>zWx%68aYI zOQG=~JNU?@#tVmx5mX7=A0wPBJfl}m+5YWo_Aoq9w&f4NAi1uREkNa=WK97M83p)Z z4fK5el!`5sK`=aR@SD6k-;IyrtO37~%7>WoUogT@P>t&AHc|C{yCde4!9@MO;PyBC zkA4+TVkl0V!FAzaOkBnYT36SaFdy9w2>9`t2zC?=UYgJ4<)Xg#TiAR0`s#df|Gejy zeGa!AeXUw%uy|}LIiS{F7Y?P#=iTg|u*S_522FD9ezDkac%V6KhZQ`YSZV#yN}rMV z`e&SehyR;qgTcIG&+uWeWyJqxJOBFy5>vy&!$-TTlNxla){8tp?1B49_4T=m*WZTP zqZs57Uz?j^KFS0gc+3?SXHg4Z|G4mi&4{geWjr=AlHiN5e!N9^xZ@k@JU4;z&=nV# zDGY{KdXlO7k$e7~YGTZqb#Q)qdU}5<#uW4WqmDi?w*W=5!ZONTWnB>RqgoM1IsVK2F~hG z`yJ!kPhV-o%(x18jRuZ>?zr=v`ITLWcjPg4IXjD}#hk^I>Q&>ETsFid;=iMjQ+)&@ zZyK>Sq}ai1X%`^-rHG9Dn5`xxvkv%luhBSklIw=II@_ zqtVTcW`(Cb*{|mhyQ!tA9d;iST1w83Hhqy1X$2`P8fGTHFYMDyQ{+;Eq6vfNLfJj9 zs_fj-UUiCkbK@>{g(nr+GW3XNB)T*=KT4davO|5@Om$+XfHGhjgOSMhDnz@z^}chb zTVHtT`>Ww2oM3YK8zk)R_Lr>Pq^XYyxmhRuzxQ`%{YD2$m5IdDWO!Kk(zu0^0sH)oaU3l5j z0s_*~4GIX-N_UBLNH<7HgF!7)L_k`)S#*ce-JQ}6i(bG2zGwOF{oDJD@B7C2^Zaw> z81EPkU)P*Z+;QF4eLZsqDFpBGE?}uDdePB%O3sSg;N|cE%aB75lOzkblr(O*Acn|N zFqP2oh^Mw)URpNG>o_B`@JzRKbBI1Tq?iULA!!|pDhLZYIR(0l3aDpPby_;lHTf3b zT^NeJenW1qRg|p!dI{DbZDyisQ@u~GN&*d0D-$Bq;#HD3cvInbF1+G&NyJ!GEaowY4NOJcLWADB|gB4Yl6cvGoWq`IZI939V>9Q}v} zc7-9}FkSPTv#nojsp+A#@z`vu?Bc71Ji1c!Z!hB*3*NyRp1t8HJxiE0(LL>tDBjn? zt07@w5-I5`M{<+T3}KY?D*vEt#Af0ec5{0kjQwQW^@2af9`@;C`JKe>2G?kNqz7)e zbF7FSB}K^vucKwMW3$p$X9gPA2(vWOg|YVx_hDhiz$nJ$#VZc#7VDCY5WmP#)`(Eg}Y5ZF?-m&)w7pbBQNNCM?-e5=%Fs6d5?Tu zMNh{WKGaaKGg;z)kDD~p_8}RIaDGdN45u0RlsaMQLd}BTRT7>%;65p#PMo;TPcvx{du7!isHEG4%)Fq>p z+I_W~rrllFrzSO-8?~mrcrXq_v*fE7M7zIr(J-P8U)zpj`g6&MdwqUtZ!6Ep;fSCv zyjx;sDCcTFD|Xw2@(E6Yw6?G5G?6=4cR87u^-CLn+u?uggTGX1xO4Ljt4MuLGb5Lv ztvJ0xeRvL&z}p!uWnBmOTqUz6IW!Rmc}8UC5x45sqT7QuBSYpzn*WIC=Crl_0IzbV zJEqO4)Ep`wFP)`ew!>ROrjq1#uc2SKBVSa~Pb@QXq$Z+fKG*-P3Am?(9Nw~AQ??2$-FE0?WJVVQpt z=CO7`=h5=M+j@HrBj-|8v@^&EkJN{!4+`S5xfHxS#jd}{j9)q8e=65v9Z?X(8z}ew z*0A8Lu6}RT+TL$nTg9xMPuOAKzd(!kKw3Ltswep9#Fog?bofK#?%l4YnYK#y#I|Xb z*k<uLqbP7ev_rbbBhpFDEB|^f0$gZ)TnCcW793o8FU@lq^uAr>EDo8=1V| zlH3xRIijq+j7 z%|J-Po_JshHeZ<2tWA&e&KR3o>Pd-DG;r%aZG+*kd&z> z!+``4gW0&OFJsUZdBe$HQyMW|V3oD|@EC7PX;sFBMqUh@)>m(qHXABMNILsZ#=jSL zX$|MRZW&+bTVJ+os2=>KO~|X4n9!t#aebfgYO0nM@=;iO?gpZ)alIFcHz7P3dU?7# zV(n{KNU)mWZd()=M-1Mz_@7(vA#mq@Ep*2hNM4nshlWj_yxz@^V0kN?A}%3eg!x=0Gl!#yPW`Yj{`5!u;le1? zqXinKV_Eb3n-CV&?A?-kmiOWjg4j1%h@6;XixAyy0)K{9%JXZT4P?0`v?Da0+2j0M zpN_|<-eP=)<#CEW>?~q>qW>UlTLRj`B=W)zBUqO))waaTHn%4)=mm>i?Mq(YDZ<&_ zv8%;9uQ1?o4}TKtimaP|x)|sx6>94`;$4VbOiR2g7r5-<-$RlxS)%(qf zC2A9sSiZaXlYh8cKX92?WTm(ZX-vyTXCoyyT5m_(Lw$$gZRe8{%cmw|=(YvSGrH#; z#y;igbhQN^#|QWMNpow%_&m5d!wGnmCUl*m!&Q;$;`co*&CJY@tZ6g`GuxHOjiJr} zhQ^4zwP1i}i$<^FTeVDmZFnz~U^tgjEM|P#It$gi#QDm6H{lkq*;#(N6c4A_OYvC0 znRRxsyDnv$te@_(BZ2%JkUSHCj3!V9<>haca%!1S4Idpn$8f38Q?K1|u<;w~rFe(n z_rYB5V6a50=Qs9rKMoH+bYAstS}S2n#PFCL63jYds~b4(QI;GS zE`9w4dzDP(ef?2ds#4iu0}xio~|Vl`aRsUD{qxAO`dW*W60OTdr|}g z1EZ3Fd2#fiCF4uZyDX- z2oGm6ev(W6iKbL{k8=RIC~vAag-ch16N)}#+go#8LfFgC1bs0re(jWg(@YAN`o7r` z|08jmrs85`dq5yFosLFwkmmZ!oC3qazC=IHieSNOhmp3L^N^~qBJ}qlEoP9bXAs5? z90LLU%XeeLk~Qk_a~NmKlZgw|+N(Q_S!0pq1aj%OpnX3|IDL*)_pFsfLc8Yg`fhq| za%hwpKWe<%8TxKShc`p@xI`Lx>0S z0DSDsb`&iGiz;^)F2uS-J6J1Bi|Ofq1;X1ABvUp*hljrh>MKkh%pC%U|k$1UXjg zSj?wnGdVNZC2cE*pe^ugAT2r`5OuBjE#-wU_6j=QV>$H(w`T)oZxlD zjk_z5eslLJj(>T-GEH>h?KJDua*CkKu*raRroYFz!?<+EbNN`g=i_SArO1b^3b2)h zI%z2b`&!PCc@Jx@fqspo)iuiDj|v?+Fsa9OhS32GUiI|5I^Hb1`W<(&mW8XV=C*wl z@Jzw|gsw))hWAb^ZoZrO7OQUT%SGE3?TG{xkpDG1maCq7AE`Q|m_M$S2yiSdoVXy- zg}#5tZEEtFR9H7IGdbHo8kLC>vj1SINKU$`N!7HIgwe&87YRK7&mIb_gb)u<9-Dh>NLlCbg6qQ?|0+a##orvg*B|cS@YwTZ#J# zEOovq*^2Qy?uFbGFs4?LE=?g3b=MKo^Q6QQR!Z7n@px8|T|6|Fu$>1@)ty7CoxQ!G zlyJG&<+O(r7A{}Nn$9>SGsu^T=E_b5DBverQQ}ia+LlT;$5xHLvKxn%BuigR;zwItm0xJez{`UQ{-h@{r$xQ*Gb3xM1wRbYVW$F6c z#fD%meIox_%oo0(TkymiCgolHmggz!-F7=O4CR!ZWYI=bkq!eaW3^Xbq= zG*--eW}Te$Kn3&WUaogoqPI(E`wCAimNqgu_q|2z`c{N!!3&2GQ%lmTABDybyKe49 z3!Cwmo(k+`{x2i?9>MB*&aiprwHZN^pohu{J|F=rlcP2+dVk!y+TzXx-kj@=X?1|p zxcy$+llGO|sI29BAN%js{=acH={!%o?lSD228Zt?eG^=8pB6A$D4nh#bq}Ck{QVBb z7Vws;f@yWW`=zx4xVeXc*E{N)_6vye>Sc%Kviqs3_c(3Qa=kZVB>(7|sny_9G`UG{ zSCzV5)nxr&q=cUg`M8DJu-^sN8xPFbtDcJ7uaxZ8W41Xm`^S{c^%t}_9t#xrowa0y z=VxCnpS?{bZStmNR0{fy*blqPT0L(c^DVR@H602=KVQrtTq&(JE`%oZOWFJJ3^oy| z8oBLsG)SC%iQE@5-z-P6< z2sH@STHQ|C#NR>13@>a>?Mz)=0=HjD)RD^xf-?#~pjmal&=!>Z zV}?TVF3lhmn3X+G*x!gdQ5vEmf^Y3T}1@mFW!7a

8Q7Q6}YL(RL^hYrMe25hjwkn zzWlRYMz88TFO1wAv$|PXxx*4^yPu4sN+g6asr$cd<^TEW0yTnvDxQz%p`oFIr=6{> zem(afkj_9YfH(~=1BJ*HK_LwrAt*D={1mf)Y{*Iyoz`Pp7FG2bo6_K)Q1241`;;X z5OvK+hog*yxHzad?`V+q-o}u$wRU*|ThiEQC{HeK^{R!*p3XQwO9yj~LcTKpyVU!I z{)jEDMuRxP@^3t`L-mW;P`@X$f=tW{Re*a>LDhXmZiaB=j7AO4kyjbQoX)P*iF4 zAz2brT`vhCkYjw*LVufrzgVw;5ZBg#Z=ycjo`AWIJRdL3$?EAgG&D?Y)g^>&R&!2y z_8QbHGsb_-%KqPGiw>Zu5HjbUEN*{#V@O z!FqM6%W+ee)QSK6SoK^7QfWJ*zQ=d3(SJCCuXt*t9jUIphX=XQ><*8mKty_dP{@zM zO@`y9$WmMkZhHgMxPYQeh8$s7Twu_opMHUiuz6qR!X_Z7;_=b;%v!pg@Lb?EzkbHM zF;4Y%W;GWP|B7)TRMkCt3pLe4e((vffN?wJI(eGY9cBNwq{PHS^>fm7HovF$%|6=d zd_Q=E?kOpjoUO(RlUs+2zg>h_7yj2;b^nNqD{-iksVn_80l;-xdmS*{OxA?%4*+$~LT`?(h z)g|7g%V(Nfh#ji?&u(DSl`{5;xT=db$nco6uGz zf3zP1tyg$J_3W%oQ6kH-F@Gs|M^T8bOzCX%;H-g2!a{5%afQS+SynE_zDUN z=P8MuKZiV%*QK;q^P2IO((ltH>sxXWYR4f3_y$}E$M*imAO7F50u?qepZtFYlz?WP zeGWmc(?EM9qIavX1AGL*IKq~MBbFPctt_x`vFUH1SG}ptvA5ON_BLV8s@~CReDyZC z-xGB|hL4qemy49VJ2!f~&x0H{2antd2@ToLu!#Q109 za&5lMQp48EvPVb9=lnY0YTdj4jpslOAGiT0IsaLS2ljRUV0pR6_CXV}P9&!^0qa#d z2!8P<;Q4gA#qe2#Mw4gWw;pO{?yIgPULP;Bw(0w@o4J&$-(z<`&~bFw+pCSG_g+sG z_c&b5<(k;9UW1HMETa9~TO*2XJiT(I$=1n)?O*I3GlUeWHt1a-_C(yS`#LXJuFfm* z6{dg>5Ay2hUp^f+2OVkWWNT`|Sc*`Eexd8;naC;Edf{a&NY3+S{8!#WV0+-fcQOY= zZq{N98ux=qm%`50t}bBHUN*;_V;r{bJ?okm?GXdj(;&+P`48l%qJ}gzbEc>Dsv)GL zt7ccKh`GVhN|G5AfB6~?AEK8X%zb36B$z(5gW>$qz*K*Z<6^nkWD{;59?3ji3AS&^n zPp#;hv|f+xC&wFv`j8GjCdJW(la}sf%EXeE8Q$!BRRnI<91!^m?RJAC_~=K2w}{uy zDo{OWz_Uec`JLO=bv%&%RZ`gcl_B&yoakfjMjZl?R)!zNur9pVETpL)^GT)h<-d?) z;mu=qndbv$tBnB9T#1WqsMcN5AhPq>&L(O+Y@SI`^1u^cKb~#Lmhf`gpF#}yxBDA7 zAsjer9xq;U5rV^nB@`<_21a>b6yD4(m+~@*%WM4GzfecCV zsbGG3lo#pF@2djZ8_KI+v<50 zNk4uRPf+z$6n}kh?mX>jE>|)E^?dioaaSB7bhtW%<{Ph;w-O8m8AX;-iWnf(n z)V)0)NkKX>${K7wx@OFcu=7j(I&SdFFnutQ`pa9=S$g4gL(rdP9)2{Zz@cMDFg3P6;?aYYNMwGGH@8lD#0ApkJ*nT>Vb5;w7&&Y6=;ua$Z?dsG?x; zJ(ZJSulgyrE_@n>z+fDWA2`;qDvu5meL<1jWirwS5}Ns9LkhQU}k*eZRTAR5>m4GTn(Ya zH8p&sehHD0k)pf_w1jkKSzTqfQAFYJ-u_nvdd6yko24KFyHe6?D#2UFV^cUcPlRI} zL3FM8{F$3RLZAI$w)*~2QT2YafFN+*@SD3`M7)$NB>v|YMGF^GW79BpuhY!#DxZrf z`_C3FbohhRSc16XBQx1V0;QzJ%FSS2N|4W60lT!$CB&D+c z^wR*2ClQ~&()e+cU1Rm}uN$|HWsZ8=I5sn}(D3v@w->%0QqvH& zM|#-9in~!bWhBB8kA_wKvE`J=cSD`tV=hn}cW)e^{nc7c^P>}BT zo-tnyY_%(kv9EW~O4`73Ix3hY_b5zEMOQKr?`MAg;zdP$0_B!lVPt+RHD_H>TK7hd9g2pWeQ-aM$;1~&^UeV+*K(HrpV`VFX7xpPn~M4T0cLA7KA5g zGBw_Yma{DFn(t7{^zd3{E;cYwc`om`XeWFbvvq5(^a9aqH4D76w!vPbY1GN}xUa=q z1NpM2i*n(*S{~UzJh0VDlwHF*8FzJ^)fcY(Bmr?~(L4eb2o_{0)ukCj-=EiQIC1MR zKx&`05G*t}hZg#|{%&pJIY&W`;ZK2<5QxPmP)*G1IlzI&&Swaut@kx0l=wsFh#BrB z`Ye0@T}FQe|KH&XfkoB25SL+FH_92rri$cg@=S!2q>*1MaAUMe2;!(7nqN0I-By3F@({WPrLp3yr0-R-?-2F8ajDbS%<)n;kb4g|E0|@8?o8d z^R)D-R(a48IT|2=Iz@k;qM3MHv$UG<-i916bI#~{rG*Ak`np|D{abh@UmMK4#HA;Q zl8uAvMdQ27X-QskV}fBbsV65KxCt)-XnYZH#s*;L1C7CZFAm|^V(QoPQpv}eZ1%wH z>OhtpXdpr0}nYA8VSfTPX`;__C@t$Cplw+7>v zDCXkRg**w#vIBWfHCv zkRBI%PXvmf*LgB-&15xhBRAavO5N^O`!(dSf%=2_`UN@skt*) z&2puFb1=HxU~krGDZsj%!-^mo4h&RlDOO=(Pf!T6sqa>~eDosP!5OE8mvzLapar6L z1k_yZT)RvDq3c?HOJ$zpiv1X5rLf1vSycxrtX7UKtNPItC)(l`8?Cfb`Z=uxZ476Bd2ri6Z{zfs?D`Y|ocdrOKK|O|V4x}q zE)gN5u@>9a62^8hI`FJE@`@GEFCJ`21r|Bd)07B7A*vYw-1*nBw~G8c0vM>vjjs2e z?9OMOCYMbZM>$!FyvP2@#Eh*J6rn8bMGG=c-1Fp3O0S<(RXwsqDRbMC;RcHcAzTOb zkp*fMU`Fz!!#b879r|w9pMKi$`;U+3t=1&dHL;u9=fj7gX#;kczMMxepM&I{zI70j zme<*cSc68O3st#3AA7LGZ&Pon)qM79p3w{z7IN<4SU5X!yagbyGPfDFF*-@Rl-=N9 z5dUF9tfA@^8_fIBwfGsbA+wX~>E(Mm37Tg7oK#`V2N%UbiRIYZQHciNE8tr#_(uD2 z?Ynj!nXSb5ToUOXq&EzX(T-%Wsa@Lpw{@pvt!OFQ80Xxk(J!;5-HM($A4uj`0iy>M=X)+f%Jo2pFpda%LHf!Z;D*+cN*6p;lr>xE-)un2GyqP) zr@mqM$Y9|_N5p=JK?@OR{kTE)9^|9!j+=LTN}Kau<4e~G0#+%yB^>2WMX(EJ8cbUf zPewOROdtC(C@WG1-0{{FSJZw`h_(o&V4_Thd^Nj>lJNb&K|=rV!IpoK_d{d+XkDqF zJ~ET(stc*Cl z4Um?Jvrj;j@ta^~wj7Qw)NP$k%GR^Pd6fK$&pU|x*bq184yZg&8c#+ru6Oj0_b_js z25@*~|FXqi{PL_xRbqnb@M&*x#5cCtQ&F5A%oIbF4F}T21}an$j`EawQjGrBi*Lo!kGV4-qw^xs;J`4s*{KN*7;1~vn3FC1=$NP*1 zKnbw(1`ha$rw6A@&ibt68HBw^XSkxv;`0~Dj`uxkNm)dUD{)lMdLg4Yg7w`2zT!n5 z(H}Rbu%9JX8^*~3xKYxJG_zkgi`Db%vlE0*5kb7A{TRNcM38699VNScsm~aTmGxU{dDF0N;l&Wkg}^B8ORT*(E;1WdKCh&^cK1YaDZji zIO-q$GF`>T9y+?|Hbbyv=v{l{*gW*%609%fZgTt-@QnM7GYfLx^>JIQ7d9Ca*i@+%(R3`KY9mf6`vtZ5n%SBp4k zSx#0k0Q4>6u?q6y`w5lZcu)@7N-yX0E?hiG#sdFV1D8Sm9LC{M$2&uCKU>8PO8KB( z(>T0^qD65xa7dxa>*t0AAF?3=iIe;=MMmqm=36STSfw4e^|CDe%U=YK9}7z_=U|af@hp;0G&()?7U>spJjm){YlC&A*b6L{@}srjOHl3- z&nqmKUa)wnN!7i9CU`?eW3CfhQp~MfyN^Dur#0h%*Py1LigL3hn8Uim$(s4VjRfDf|P7kn5(5j9&yQf zL5yxtajuDYsnm?$IqneZy*W&mzr5d6oIrnQ@Zw!rHXF6R)tU9qbVZNCgQe)OIp4)) z+z(}v$VkG{*f?uGZnpf&Y!9RKV_5q9Rih+Ehd=RbT2 z*Rl?p+%Ls6igy4jhAD?3lu(AZFzY$aA#@`_HaDB5df`a0^8J+66%s}mUbGD-@W%Id z0G|RdMA*n>LN|3{QrU#V!KJX~H>KxP008sN%A~59?xKv*|=Qjl8-p!;x zeDj-6K{CScVb@Xh0}g#Fz5{sRoIe#*!7`P3xQTG?p~lN{)X>4@DC|i+oMp<1dHhgm z^md17kC*p^{ngZ!c@*073CwGz2x1L=zk%e@ocY!J-1TP!ji{8p8xr_CQYvJ;vU-+G z__85lN#hmbz5KPOjPgUkx z5G=9DXWl%5(&{rCNm#OQ`Tc9eerFbs8tKdMs;sz5`n>6*>WwTIz8BdIL*^}H~vcohz{^{&`# z>ap=X!QK7BmrhrTlZ_D{k8cCc_KSpD8sS5w@`xMZra^+cc=Oef2ekh1-}sT+G|hj4 zK%&o3`XW#($m1iz}`;~T{os@H%grEA828wW_U`dY)?{*lEuehi>A z;Z-o9t+Q_FtMnQYcRLCqj9kYHwF7kDGfi(SCB$pD6;29`M0X+ir6iG4%x^DI$lh#( zV$X``c8%;UmcB{qzUaztOU(CnExdPJ7;QKGKg6z@7g+TtK@$P+T~vZgbj&Q4k#hR9 zP?HTaWDSU%nWZuqI4=X5SC~i;o;KJ*)4aga<+dc5_ALGlH=Z97q<})e3Tj76X%rC) z5jPDRUe6Ctt|a=7e;Ed@1|1u3;3lpdPvOnMT|}$f62DaNwC}N|v;hR*hjdPk{y7)$ zM%6b44^r&v6Al51Xvr|YVmv?(6|`vGa`l?EPBp{Nx0Hri;YHwTHqzQfVj)I8V^CR( zFYQjs2K)9GGS$|_%(yWcuOEff5uop@qsl?y0m1+Z&VUP&MA+qG@Lq^qgyas2!O}NS z{^_EL%jj;0)F47fGFl=$)3kMB6Lj1-i*$fvB1;VSY zh`ljpL5G#4K6ngqO1XI@Wz9vq=h256zwr@$7On&O_%WS`OUk#ml%4K8RHDUhF3d^q ztOp`69%Wt{8k)!i65ZDfjapd!BPa$aK6_P8QbqT}s$1@=^WzjcV{iUF`NstMM9M~R z!KUgJUye7qtzwi_$ipjm00v#5ou7#?kb~kJagZvIRG7lA%YdcB1w)V z4*0(YEyC?Le{dn+(V+xf@ZgvKZ|n?fykxi4(EV}_vN}p9Xt*$Mu8aLO@CEg?S+Ho|^a(aeTHWR^$9y#Fke?4aL6pecuC_6M$E6?{ji{ zY8r%{-NZkJoR857qU52Omdod&%Sh0woH9u@D>U=!-G?y+!Q8bQSy@>p?~rr%yJ~Iz zYow+pBZQHiW(NZJt6r-^#CkF`R!P zt<>E{@8hzVWxqHOEK+h?0;D``&{d?qPntaGyb)}00Xjh~1YkvNR#bz+WeRKJVsTF3 z!jZ)f*?!&%Z)fF`3K4pn^1`yH){h}{UM?S>s43?+K|wj_UnAJi_!5#563RY`O7nGB zO&q*X>N(@|(G}CpRNT#oj+xY(3JH>)jbo&$mr9>)AXv0_XN;~3r8WY61{7myaJ85F z{$y$MXrSqQbqH#Ibu3C3F^S0$ugrWQK)!}bVkw$K+vdKa|5(Fq+&h>`ekD-Azv~s% z)-4wP>}d)tU2nzGAUp!b8<}9yEZqv)Kln#O&Ln>$S+8eAps-E?sZ*4Z%Bp; z4T~Mjt;j?`s1&ptn!mpO(FmGg+GD`g+O3Yx~R-VeiC!0q+y z{w#`7fBx9K%#rMPudNV4cfMYooeul=qwe4+AxL?fzl=N}3P!&}_LoKlq{5|qzXcTO zCVU`y7#WG1zm}3tS$ert_?efBE6SnD6UpZt10(qHw<++VqWID7U2T;oUy2jOi`q+v zw+W~Cie6eOw3@FiP{+l`JHAjaO|pT}U|8J(<2CSC@<$%oGU(bdk(^6WkRG)4(fLZH zb5nXCnq5_W`CfRDYvaT%b%3=}ikgc!TP)o%7BRwkFvEjTx-5i<+{V!B_*MBsU|p^%m!<>PyB9VLxs`9G&lauTJeun;L&oX`k*ar%WJWUf$IR(jmf1*{2 zFqq%*plsoMTF9r56V=$`az~1%?Ks${s$Sj_5Bp`y8F?ci+E7fE(5o+Ql4uWre+Gd| zncYE($8mwEi32n)IXXb+yZM|=Q8`aS2>k9dh`9*T7{M6aIzt_-ngCpeX(3CAWX2vi zy5m4Tenyd=JqntN45)LZ0KBM0jFEOVW>s=Sk4h;K|{0DQK%``-o>~ zn{cw1h#F-PafGe6uI7%21Bmkp&0bU4!>pjRC^g`Kzaua#5Y;;=yj)xfX+n9*{V_G~ zzUWz-6{a6Dxf@BWpk<3eSp-~tg=J%q@*j-!DG1c22r(mNneBHh`1+T{X2&K&%A!va z;1dRZM5gb1v%4tH2$|<9kzT=x8jOfQ^+}Ud0`P`IONjbw0{!x<_oG?9aL1hx=>F7)a5MU;m1aR@8!zHEe}>JTDtprJCsgXgaU4aMUL`MEWb8ilye=^iEQGTzC>&>GoXM3=M=eA+{|w0zLu# z0xBwv28K&g3MixRA3n72D9%U(Ip*SM2yi=q#o-TVA^eWQmd1|^GiX9TK4tfu)k#xp z@w{Q|sCN7F>kxyD`uT`%t#g;GkVbLAv`bVg`d{{4=o7W#IdjFtzeZUbG~54EZRzzl ztP?;iXxMljShEiTM2P~npR~1fJ>ae3uE^&#AJ#XY1)*9=DUy*%>bAm_s}(rloI*3H zkh;B)qRnlEb^AT|z>W>dryJ@|uA75rgm}VyL9(3W3{a6|xiX1nMisyOLuFsISUzV2||_eCRE1>hHz0eaDrd-;uc7bs0CL2Jh|d_z^0SFArzRfdeMt zfHdscTm=kVen~L z)xJHyGo9B<2_x;Z;fz{&KiZE0sC)FH`fl#}U*td&@T4w#3;u=(5Vt6qM#}>A!6smx zmxk~Z{>BP3N;3oGiL+9QW{D?q8fBE=SHY}v*&KFY zV`KO0rY-3IiOoP_gbr4k4mEQ?(6px9i~gGIi6HBSdEd;T1SViY!ZiUDXd!BEPAGXA z53`l^>c(6OP;LnDbRTUfMDK! z{pwlT+`lpyM41IFEY%6&yg{!MJS$Ymzm{x$g2nc zY{xA~4gnA%d_=KOpai-7_jW*F^)HKn{8UGci2vz7ZU%W(2>u7e`PDy0`OlI;Ha`Bd z6A(y+D7eEQP+I+GB9NabG7aRef7a*!KKLWHHX#bH??iDZowHF#%4RTps4oLC0w`dr z)AQo~Z2^#KdqV=f4(l_n{J?;K%ImLDdY0Q&+J|vw-pbdoQPP zlm7%@t44goW^?`e0t?j9|Fdt+C|orfG>mFaQV&04KuP1&K7;%)I`3xxx8}SSa=Hp< zf!uB(OV;G_a5TDzv8FZy4GchvhxCe)RHBUJqbx9kfHu%=0)ZB&X{KEz1+qZ#k=rso zyU3WwnYaiAq@}t2f-9G+=vSj3z_k7Pb(@yOZe;0v=2w?y^}I6*JS|lNV}yg+>DP5% zXPtY>EjspiFBAjtdV*iBo7rLD=8011e3f~iT5VAXW$9EXvxu^-(f%YU;z0O{7c3K7 z?7?o42L#B7-d#rKZ~5k&r4z-g4ZJ%UUyh8I-J;4JSR`rtO56+=hxV6Thf{}r4WQi| zbbRo71aL;(Z8dd(3zRaxY<<_7>O{HiSGRmZ%$p?2phYeR5MW@~hPOMYsuHBr%qAMR zioAJ`rX|a1{EQyxt-(5j=g{fYDb9S|F`apLw*bqZ`)J6vnq~1>aNI zw4Q!RfIKrnd6o;PE2V$F7J`aW-FFclRYKQMRyAlPFt)%nbfdm;!Kb={N=#E>iBSta zUjg0m*R;n!k6@?S?Z`-rHXtd=?Nks<oAybzJeed8#=(cts4ZVl9Q7MZ)CexpRhrG5_ zpn6lR2PIbW4i%G#ggsy4?Uo=cRKVt?ZOnrNJODAn7QEACzb;`5U+v`&wf)yu%nJw< zGkZX0UAu}C`EPq_XRIY94XEY}l#ZI*QB5@Ioj(pyoLNt|1);W)guf(cX1NYFpg$%#?I22e0$Rxz zp~45Vt)+;xWeizeA=seDZ3|v7gr{umLT=2bWhB6|25xd5o~VqfXf_<;{y4Z6UoC&w zR4r=2nGOx$5nLQ;ze7ab0tNENlk5%xeA@pWg?sy0B!4OWl~l-EE<74(OeN4D2=?Or zi5h}9p%4#Wb_6FcF8<$TIQ)YK1U++9RHw{B9uCLZ7dv?JiJ2jQ0YFZ2eG6h7 zy4Do#686({s#HW8ehdDA)j^Jw$!q8?AX6bIR_7|qCtx3Y>-+4ilw4lbA}{SuSgJP& z;g2ZrUgrtE@KA$^tbefSgh({s1w=pCpm6^k7oQ0&Vax><^OJ6aJ7GaM*CWmN2L=$d zmb+FANbfg8*#;lT*cvy=i$w()@!M&rS!Nxg0IGmQfK08iC`LEt^1h~TC7@t{EnA9| zKxRwO)Jx+_*8BYvM|6QmtV|KH6K@(N8>&cjI&#sz2A~Z|DO;d!#$UDgLk@i%M1R7E zKcLpP^T|U{@+)ETSHuY}N)bA_qDxDk)>5%t^U~K%6!<(I-*v@fHVrw~ksdr(#l$U; zG~R&;H#n|ckS7_9c@9qLnL9M7AJU|S8_ExRq)m? z5UqnxGZdYGzA(sFbh`QqO1_V3o||Tl?3}mYONLoLgJDb7zeyeE_Uw1%Y1{~f`>AXK zBgDHy**%KgMcfR$=NI@-t%aYmF=gVpsbF&6+UPCxD(A5^V@siIAQq)*k{kZaK^piM zgn^B{DMwRMlQ5UTDt2iU0DT$#>e~c6VBwXut zZ$pN`^t#^=nJj<8XtXDy$NE!MfBGBLM=zWwa;Lx1ztHtPTxCjX(!-Bdy^I`t7)3be z9f6Vq7$)%Xng9p(i9tl?&{@FDbmL%cCp9|b9{&x|x+ru$0Es^@Rsksct@}1)7V_T= zul!^WLTN&U)h8ZZ0S^6pbIQY#(LN91>x~ZaX!Lsm%~E(V`kzqA6AUJ$W&?on()ThJdQcP|3F_3CD-pee%6hFS7>uq2QCY0UT)HM)-zUwZH03Sjw=~s~`g&v-MQ{Y5D|W z1YGIn)b-}i`R$0@ZfS!HocZB!@=E-R+1XhjG_+Cs*8Wz{jPHc3Y1DnLRwL!-EAR0P z?q>Y1i^``X>ussrSkRUz(|$XteN^v~<*2ng<&oUuq9zX!cHSy@e>kW%eaQoBIoMgM zo^gI-So%314TA|SJE{N)A`14ZnGQfn`FSl9DTQxTTP*2#BgLa#0%Sc+vihAtZ*~*W zxI@u&iomeXH*+)d0yAn4-D0zN>q4Ql%`^Fhtqi6+_&Z&~VrcP=UfRgkdF<}M$Uv65dA#ZPzzS@BlkAp!^{hO9?xmKj7sjIfPsWQLnyp5}s_+2^ zdI!en!C_hU$qKdX4p{~o&UIEG!)PuRZ=g7H(y_zzamVbVw@3o{6vS0w)8s!C)TQ> zq6;PeJ`hK0G`Z~`F^O;&wf7_iRfrerAbH-(P0MS*^mc-wfPCXk(nEsdD*ucZ0MH+ISd(o=K5GGGLElDEO=qn07c>Q^`4a1S~w52|A`6bwR*dg^IBnG_7 z_t4w-={ZVeW5vN)@l)P}X)AaIIh@7>jyn|;c|s@sG^<2}pA1P;IgA=}t2vxdlpxc@ zlJSi5xf>l#5XQ)U88VZprGn2I9ylwMdfF=0pJJjq$28SF=9Y}bjH4p;cDX{rWA(zK zZ5U>@J3rS}8SRf6Ea?}^5AA)>irAT{8VIKLoW=f(xMa)Q#EC3F8&iON*R)dD{L-$F zEuA=_8QEH;xI-f^=P<&u3Dd|Vj|~rR#@2@=@+hRg%urC2VFaEm%O+7KSaFt^XZfDOp6a<^ z>ixG13alXpGO04AwNO+3xQod^!VE%5Y<=}C58Qa9FGbBo%_IT-^snUP4=r!LWr8wg zjL)GBt7>*ziQLXaE|J%Gl*R{1+)proMi&!9s*_pLjdv3;hO%NgTTu`Z5fD)nkr0$p36TzIB&Ab8 zx*Gujm2gW*E8X240t!fobc29&iFDUH7r%U-^FQN^bKWt|I3JE*6x?g=weFbroY%bO zHD@A3QMbFg1+XCuoNL-p**OR=N-c`ygPn2 zDa=~4Q^lr*^tfkSxMb(k3t?`Oqyb;oBAwt}Z?5DGLtZ14o2nE<-(EJy6;@YpF5Fi^)dtlFkW*%>x}FY`);e%2 zYhgR`KIUSdi{wA#8p{fLNcD@sDA6A9<$HMf@^d7(N#tDdNrQH07IOJSqBYYBZ?X@F zK900CEqjw?1V&myM4)j+kSpX;%`<+ARnHyuct@j0`v((UK-_O7^KA+~nh-HKnmryI z6xBbLE*r84w3}PY4Cly`eLU1ZKX}vsnxa3+1Us6dmm(N{waZaTJ%&Tmep(c{ZgB8Ze5i^AkVgA-gZ`(Yj%p#( zRBe&6mkW%6Iy&F45%g9>y z+}TX0x_u;`RzWiUx<^FTK!`M#vGUe}P&#w|>gTg#1#%PT4JFpqqh;?5E`2dS)nxXl zjxbQ9&tRDF;32Nj0G!evxW=*3>UCFN93-LZ>1{{9?+Cv0pgHQE>_7gp-rO$^c0+xB z5yy55IfM`1Aim&j#^x-UDT2;~Qvbf-V-9BBUm2^SNj>`5BDfjB>+_i7Uq^)gS@{g5 zSoEnK=c)8b=-%ONIOUrMDU(0w_6b)!ikV@9IVK#n#FwiUU$S#yta_|?x$D*RSW>;6 zkIdo9EyBuC@~QJ2W*SXoUkHrIG|pq)d=bMp$hn}r!zwFx?~4=f?Vz@?ai!`7O+oXa zjeNADtOCNC*Lv0D?^k~h=m6>80wtS1_B8u=u-6&{kp}>M@m-Es{ECPF4K_7%k}yFM za$GUm%P}8nO66n8NN#b-W&|3Vx9=pCC`r$8w~~q6xg2v2 z3v+k+)B4+InBFii+j1N+&1f542=r1RY<8@B$ho!bjkT zSBEoZytxhqy&1`rV-n5=dc!y(dtC~r+d3V>lrPSb-$HLitglqSc;6)%l$s&Zuf%J?Z)x@*k;p-0by`Dk3;*R>n4EPoYZjNOBEy3ubjn(J2`03ZV# z^yw0V#DbO4da<2(1!3=n?azSRfbeetxVQE@E8{>3*u^3NSt-Mw`Q@D^*E9no51NS9 z1Oi}S{OIT;vu{r3JiXX)}`(30vStnxfsUp+SJ-bc0q-^A(0%3K?$5jyk6tL_EX`SyCb z7zrx+Gn3R^LOJT)SOs(_nZ9I+aPZA;yg2Zn4xPuiQU&1n9aEh>#iYe_8-sF*FF52} zoyi$FF?sw=GRdi~YlGXL7q*1Nu_6!NsmReNSlCXCB_88^i-qja=;}^C7EqRs>o26M zG}jWMZ5=)M&63YsC@c@ zZGJEl@?I(g7DngCmk@~VUG~$usbec3>-o#u!T7GKVuOb4_)_WWMt}n^*WI3l<%@in z5OaxfJZ)&CT1Z+@A5JX1HI8O9dhAj-#24;!g8(mxqhp}GPuyf+bvZ}Sk>be$naN$q zG|cnKl~%U&iJFN+HdQ+H!v1TAJl^BW{Ei9Kj4y4sf!(~mJF)s!bfG<6(py}(@!8bR zX|O)wbLZyQ)!itK*wD}EZLM~_r6?*X7>q{tUX0MWCq&@K_jZrv7wl59-7Ho14|*>PfeLrZw@7MruDUp3_>crj6&+cioo zdRvcYZ>HO*ru1t~c*$m|=-1*<&*CkqPBPyT;Mt+g)ldQ)cNcyPF49$DONYSTDjM>l z`H|_;Q@nZNgGKD$;DPDO$Dw6TNQT9PP1bF>)j$Sy#Zy=zX+wgkW8@?u5D-)6L|&va zbM0)Ox-b+hy~I6BefkB(WpvLeK-`%MG8v{{l$@>jVn`RcM5Y2Ej!K>1ieM?jg>Uus z^$^1DJSC$&svH~jq&aAMn&=QK=6HJZf^^8Gn*$J(q^HKduM&2IErE5f@v%JQKUZ6x zBVyU7>?eYsF7k>>?W4PyTX=&Os524+7V8&-ei`Gl$wv9V$ToXEOP8!c@cK8aLy-bQ zgE>1y;w7H^M!zExAwJds`ktyuEg{Hy_TBnYQBEa?PI{bn7H^o6tFx-9_2Qo6YP;11 zt;l05(`Q*WT9iEUOKX?d@H-v?qiry;#uZ_M7}5mF zW}K|RB>ZYI{bp7R+-0qIAe5SECWKb^<2&jl%nUZbefeg~rVQE`i9n17fS`$r<7szf zGXiSk3lIWzm{0-{NB_WW6u3KGzov=4IgN{(~meqNBTTz;x*9_N8cUl4 zrU{&tG?WG;`i=oGkZWQYSj{aUm8u7c7dHH~DFLqwXtuVbuj1bZU8jtvM$(rGdB4eG z@f=^OTQhsUD6+iQA8>1e`?#sBj)~Pr)8ywZ#fV4x=)!MCllV3C3LPdbJ@&itm6)9H z8if}zxbr#C$!MW4mAR^pAywJi%U|Q<31e3FDXgE=@77=)OEvBW=0!@madxjw7Cp-R z6(FJealC+{r>xhid&ErO;OQ;3A!DEE#?q=E3uxeAdMT=|CzfwQyn|j5G(uxxyQjcf zyd7O$8z5Na9~&3Cj;Cd7z#&n*XEhl0D~1{rA}6*K=~h)f97Tj=K()E2g-kA6#>D~= zVRYRozqKru8^7&tIPCE2wDEf=NU5JvQyh}fGdFLW!R@cNHfHK5OxlbRWM-fWMOqu0Bx@O7bd?nwQl#QHX z)>xwR;9Ta6k~BSynQ-=ps+I&I90S2I091f6*#*#Ob`r0_ajK+a!WrZ(>g%=FVb2^& zDQ4KKkFcSM={Lx^0mgnJUy)pDL9OaB;a`D!-|? zv$}5gyi`d5*URGRgbiP0+EAeECzcq(@KpbBS@y&`k})b-QqovX)QM710sI%$hS{>$ zgT}UOxKCdlQ+KVW2uHtGLd7&}C&zcT(Z(0E7nazy8oS2A9i1|!Uh~&tbdqXjVlDSd zopfxHv$ZKAzj|NqG!bDO-JofM@V}Cm?H(idxf;d}6Qw*Ru0Y31BL#vw!iB}1WY8GM z3Tjh#v@y~l!?}h`50G>vR9}hOmiy5#eb?|WrOlT?H;MiUTs@;fSF9F%B z^pW92IvI*~MnB%5LUdMcjN98lgqLIXB%h~ogwV)L__@5)jhg3$eV9BQ%-8G)drG_X4rNdc_J6G@6tDao4CQ7eMswrjn!Vvgtg#KdVNW7h+!k8{TA#5r!OxDuvg z1vyIcPfU_mgkRYa{S=cxa6H05CxyGT6WD1@nOHQ=r<2Yg(34dY!AE&k;c3b}NfTy@ zO6x})>n&X?f^RPSIfYoT$0*#~;cGYK&j@~GFA>H4pj(1Id#mbd$hTU;n62Wamx`tlc9lDYl=ds*u0iZ zI_7hqN$zp4H?&;v-s3*vQf1`oTwQA#oVIx7@-lWJTy-kmUt*%Pk5mokUcnvG7)zBq z$)w|GOFGe{^G|KCpr|3E0C+`^?3Xxjyg=rhlw_O}_p$3VRsk>+CIa&5jX{va$XiF% zGKoMsmy3U6!s*gRtX~7CFs@g9PhzHk@zGgk0K(JvF2$_$5UT(mCpQ1b(#`SnxuZ@l z;E}S|2ttzEay-V=+))7Q)7W`}^xBZ)!Xk43Wu#_VaXVSddS&B@Ih-3X4vp&eBf59l z+W8A0HE(zIou-^E#1fFTr_p%pvezId_+sH zLz-j#3O5(ar?J(&@31u@9vn;+;YlY$&EuSn0uf^0R*Qfuy9*VQ_Jj(<0KZI)bc$Cn zu|(lEdDC!d4@b_djMwF8RsmZh;@yg%2n;Dx5xA|?@c?(0qYF!D zYLIR3N7}K{#_iLDy#>l%k#nz(zs3}fM<(=CK04>l1x7~_AZAMNDzCMz2*x`HQ1)X6 zd(i?H^d?BcPy{r~FO1|`+l$2-sg??y3OV0?aq9y*X7ucO>?bRRHO(wAVdXTB;#mKE zBZLtVoAL2OHIb1A3l%)c8jiFlkI@~?4Q<@2rxf=gpH5nNwcfS%abfsC6l9N}6juRD z7xFh78x=uF{M2-$G@T+&j{vWm^GSdrNL6)9XC7MIhG`Gs<;3?gm6d zPZ5b6-j*3ROZkCo3{EYJakYdC4|lKO*u@$9A{p5HC{B1KFdyL% zC$fM3IYW3n5iRfvTcM9WP&gu}hYU#N;$##&sBZ|pYyg(jk#FRz;x44e>r^<7sQByQ z_5?>v0x>)rKv*27hrGyVqPP(93(|Ltiryc;(<0S9iBiu=#|a>`KUjNB?JgU4=1n!{ zD68UMVVliBmJwSF<%iI+O1j2M!LT&41`ea@2orus#8%1B=Fbo;kPG`6k=K4B6af|9Ofmj59V@yR1ttm)ptk($1o_+ZckZKk<6@kNW&RY ziuLL4{PNr?@uwX06vRk=O0lnk@3swP=W)leLA}6>Y z$XQE>L`S8s1vBm=%pDbA?p#%MY8=UY0^!a2fhY>ZbWZb~8sBaQ3QKk1B=KWlQJHG( z;uyPNcRvDj+(SC}b|CE&2!np#G9jrYd~5=BM}u0-1ED(Rr=hpa${BZ^T4$DbDGAc! z0+L0PT;zcUDM6wdDF8-v&qX$!lfF<0G?qNb#{eF)=y{eh1W6`Hp<@|OpRk~0yu4mO zAZa$>Ry|3&LxP);XahFNT#7{oVx>E?h*r_5&%_yK2r~|$>YZ@wu3CH0484PV{NMDt z2UAexMD%Z_mJZb78PXx#JcO5sknHN;gL|up+~O~u9hw|Mn{3z)C!E0(s@-G%6+yLs z5yd=cyl#x6OMnjf7ds4IiM^K43^b|!{|5qQ91tP@zdAy%SU4UcW)j$C;3241ZI&JN zjvXQDPZv;CP~L`6E&o~qwIRWAGuNCR2ZK?w~nLfJBqNT--w%y;iuh1n3|4priwWNJ2*PLxCTv+V6rs3{ zE>-`fR!bK+d7<;~P8C79UK~{|p&bA+s(*i#ES(eQ!9AVlNf3Q((#+4Ki)Pmn0&rd1 z@kD3BUo{Td(6{kp(txoGg~xx+19}f&YcIEZi23n9I1`FFHU2nmv!d4Lt}#K(+h1pr zS1@SSxU8e+c0(ECUjC1FhyaDT)*Af5fG1sQGt!pg3TN-uQX+Mcd(7=p8Iy~Z)D?MU z8@F6y!n@#97US$k2oTyNRhH$bA)tuLK#U5xd|3vtqJJ2fG;B9%k+#(>2qcg|VOe9F z{~gSd>vyd?cGqro;9nKy2!S#0SdDmlKO(W8k(iGT=0co;tCQO<4;FT(j}J4@Y<&K< zY{m$Y?Z^*u7E{)o>`(|=%zr*QWV11b*KWN~Pqo)_I<$w(QZE`Qd~8Q><$v8W8MyE- zw-eUz?~S94@nf!9lX&l7xUUFC0(}VEFaPj5;%&eIn{&(i+ndW(2rK_!h}LKtDniQ( zZfxLB&1yhzw3f3SSCFLwph9{orRIOm01$xKK2;&@)y`|Erj>TZ?t~a$P3oB0@ejT& zIa4DqSR^#gIPvx@!lg$>3(ywBOaF{k-0kS- zbuB6a>?d=V-N5xy!i>{^LfcvZmhG2@HU|no;F+F4_#(rXXae?$Y`UbaCkK}g$vvB{t zv|C)-SizS$VxS4agpG&mhNhNdH@D=&hwACd2MS0*BB<2eZa*XuQRE?h%G@w{H#aI`lL&mV zDQ(iV3y>;36|Q$NgO_(8xj%S`@LEiKzWlYA_vz{Cl&9R1-7oCQeyAdZ4iiPW6@x;E z3aZfC2Q#E5LP^1Ghf)65lk9bCMY#opxV+baC`H>frqlw6%PVa6YLkLz0HGKp zW)cM7?`mWePzwaE8m@@p+JDNUSd)>iDp|*Qh3?9F%mYGz!L_{-+J$%-yjs0om1NwT zT7>=O4zxJZNGo_vTds{wwnXEt+zY#$fmMVB5}XBWdWUFk ze`#bG&npynOG~QHj;7Od#glTdvg+kB=kVso=f3o_2&G&W)JbuGqIq1e!;v!t*sLlk z(@&l}*@;kGFj8Pm9NE0(ln>&XzZTERXK=WNLFq;^?&dm+xe%HoY$oaU5d9UsmEa+7 zMe;UU`Ax-=oBzGA48ug<3ncC#`jsj{;7fyVV(S5boh#YUdNpoNGJJoy2l|N( zi_*Q5Aq`z1EocTQrb^BSPa9*$mN_^M$I}iCm)}Xg>y`CC@?)Vm;>T0PYMmRyta|LE zlqKq2t>>heM09S<)cHelq_Sd;RZBo_Ml)k;Tyo>=W@e!Mfl7L7*P+@VFzqS;+Ts8E zY)L>P&b;-C^_HQQTVdebXYfmNvI1<~ce||`du8-UJu>b`?h|ug3aohyH2DWl53Y*n zk{z?Adg;2lm}q(G`&9Hyz$85UbcNU`|dAa90wGZ!=dq0iCgCgmi* zY|2o-=(hl6GkLw;FhcEQ^kS5#z=h*04THmkIY|TRXc6E3#D+o%W2T zS^&T_=cHL6hw-P!Skw;6G2r7)jwwdt7Ut&7y#ar}x+SSde}n4O+nf0pUyvvneT3Fj zztJBbHi%v4G(2N&qvz|MG|AVDw_TeYu2!ViAaZ*e)8wJV1c%{smFVBFr2nT&4#t#{coE8$Hq4k zHkO}wK3sGRon_NWtsgWZ8cx3pr0m+M!L1Tuq3sb|u(h%zg$a$$2(Ig>c6t2`xbSJ{(Ek<7d3 zP#mJKHlQ7+8NlHjPcx34U;3rtv#aP0bfdEV^9DzKE}F-})4mDs6(oF3=O1-n*_9D` zR9hNF;HM@v{ROTu6~Ff2)TjM)#a(&yt(rA zkG?0Yu@K}Ewl`Cn{FqX-~j}MhT^|%E9QO0^_MZ0(sOEN5WKt4XfQHmn7uUpn2 zV1t&6+({`U_d%ZD>?AQMeLHdVgBYXItD-x0FG(^#mKm%U=@R24X$W2}NI5uHV>|g! zX(;}^2FdI()kM7ad#&LpSubk~y+!<(ru*R4L6Wr~ca)xEBD$t@1JqffbansZ;Il`F z*F2{SC+|63?1P=)ssOpPC2LvF1Jbqn2=vEYERkzjf%SBiepf0!tq@7vE1h%XO!@Jw zRUcidKasq8W70xM%rrwrR#G^+s=IE*V+RM9K%@ncQ+n`pQoBXzjj^~z-t@2@^Ely^ zEY+cy&84}KE|cRF;}G-Z1OPjo>>qpQW_ePNa?8RVmR8fQwC2YtcqCxo!JoyN9TO=v zt7hNbV!D+v`mK+WD^MS#Rkpd9Vn!4U>p7uFRtYNR-{nCIj(_`8R}kXtCnJGW2_+d_ zpcb#tJ@H5o*yWr;vl23Y#e2@;vNG0Sl9agWFU z!(4j(vsR{Vd!tW1cm#*my=98cH$|_d|I*8{nNYv|P>`PYxa5MkMIGUg3N1&}8b%bF znOfh;sr1(&vy(*8;*uXr*qBv&hQNTo|JCBj#GCjfGQ2!WdS-#V7bniMn%glcD!aWq za&PnJRA$Xijr?6-B5G4UpD}jwjx$iIS3NAN;FvHs_jX0F_#e}Cw$_?4Jiho(=mekErY!p;nJdtAS8c_{1^I1Q&RK=BYzsepL@mr-Gf zKDv3x`C+!JR(198&h0jO)P+C%-~asBMi01QK^RmB@U+Bcb5dO9Qhi)F<(3f zWj9|e1SXpG0MyWm4@&y|1={BJbGYw81RVm&Yus`4)<1rW<~cIVcpI6m0A;;%*R4SO z+O-K{Aa%uVkM^b~l@;W^n<4wML0}glle_A7XO$hZ2jTdFKW_y155E1X8pyd{fDTG# zUk#L|YgbD&D}Ttja2nAtx%EGGYqPC-KU=7GG#Zp!i0JvMeS?^5H>H6(n2hY)v%Eh% zbWvtN&Fo?h2!^8p_L?ZUR_C!I=;O(DuISM`Wd(2ehBwAf#_+jeF|I&QJafa}H0u*x z7&S!KphEa&cu))NZQn+#@=G$n95IgP;hlaBN+L;6@N}lb9GuuF`v9$VH+qeW?k_pf zGzFH=Vz<hjYsQ=It=L{s`@aucJ zGtg4sQ3oNeR{TD47QMobn?Xcp#?jOiT!C;!2NS$m7t3eJ?RzzhbC89K!t97SdwqrC zm_xD|VEwC`+klg|BE9{6PTYu@?H4cEAj59()&Y#7Z%O~6FyqsFoQzHeGQdc;Ojw}0Nr>?4WMett#6QkW6T zMWvL6E)x05tZ8AEN^oJ)R3wdmW!6a&VSY27UgTs5# z$d3M7T*Q@typA_SLJ!5?{bmF?-QFlp!gy^QX^^<&1(PWG91tO7ZsTHVaV|j^tGTgy z1>^E)ac8{*FKVL+1&oVH7oXEqSJ1*E4=o%?UrpDG48;?)Hl+7t?A~!V*hMdyL|G&U z-sh*t{5asRU)q%y-Bn3vc7?8W^yAw(8%IRbYC9wNU>pr0A$uhgqN?zaGY1>KQV$k? zF%rHVwcEfF*>%RjxO_yL(f5(_9?B6>SMh%Z>ME9+xV4AH*r2m@zGiDXt0=LFHeIhc zvFNb&f*Gn*@ChpK1`7{+W<9C*>)I((=RKE@vtR0lRXj}1c zn{bFBqoTVkj?}RtFWpw#Ssg^J!O!5i8Uj%`S`u}xmyRp&p<`Q0{3fJ2$ut&=>Fx|< z)ktYSe?A3xK2S2(i0PGGKSdY0G~apGl5+#f{%u2S!hECAZ>v3NSZudxtbqt-UI8^& zS~Tsbm_JL2SlOUpzNY1|5mL-3!#pl+mj!%?xJp^nhKNQj;nuG=MQV6!g+k!JLmj`q z+33!KQGE;$NADfw;}1IcU(Nh@h4U@Q-e{}}a}=l?vGAu1AX>=n8xC6g#p5fhzb>5I~f~Zo> zzj-Vxb_B1nL8|Hj3i!;W303!t9|f|wA;e^ zc`Oy48XhdWo&HXPqo58&?zDEZQ17C>U6=YR^P%mQ7PC{Ak}H(sj2AM8o|8k>A(k+R z7Z+UgsT-fK*AfC)eDxO8-0{_85V~gFd~qp7Zs;W;d9+zwumu$$Vo)=_u9_CnrBx;8 zXwL&_6}^nta#Iz)_vbH1rCLn3_lT<&soLx1<0`fKAD%%iA(S-WNSwU>A+2!xfj^K{p?Ujr1xjSLY(Kl9!s8;Rijv+)WKU#z^KphHr zk2cY}QJeg-jh_fBz@!W?3kWWA9%(%HzLbO-0$z$tP{8R+F>jm7?O=hY+}XoA7w6IR z=+m4ou`TuHEKf2)bZ|_Uh_@D7azYIi!5}-}ov9taPM!n7TUgjj{o#o~N77vr$D&}4 z>3)1qzR812kSMEtS`$=Kq>FXyvi<##HFcL$aVmeFz`-_)@GnV#Q|ExGmb1f~5A+~V zS&Ja}@V4Wj*J9LRVIn?q2T4Y!0BrXNs3QyMk#y7nA2U{Eb7(pR(d1TY10u`VXUMjF z*Sjs7uF%5lPR8yyNK0quGNV{#ckM7KuNCx?;dQI6WA=@p3l$OA-;EGA`6+-@88d^w zVGsghD-@$V_#nM{#(JGN6)&ubz^3GiD~{Z6{Oc%VP(G27V;jeoZ4{X8@vpOHcC#=7 zAPGSpyQ6`7kS{elSgMyHZ^wZt!evKUbdkL#B`zB z=qciVx#^Hf+k|3K3z~W1UJ=hh7ZlAk1q2vcJa>48K&5mxZdfPBZBWGp={Q6+>*S$( zKw<9Swx77snD7S0eQij<#VoSa4Kr&fI#~0B2_RZ!^NXh7i4ma;asKe!7N7&F3^+=B zxkf)pH3jovx2>!RSNZ?Il2v$Cdx48<+^Eu}MSN%hq)+a+9gWIe{UGzrZI{L!upPv4 zOK5{H9~p3+T7b>9qNPFYMe{3#*-y@qg;a(J_bXBq>t?>1H12fI+#pT*L|T{mQxsLu zS{C_<5(FT`k>#8DiU197TC@U7Lxa&B={Vt0V|!IPpk~GXpvwd`(ycWHw?Ef73(Lv? z#`c>7V7jF%9*BUP3vDA9lX>$~*^pblV+4;lV0V?>vE1Pha|-l;BHW&aT;(}6^2mBs ze+O%tu+$M{Cf5%5G&$s_=EQe)4CS)Bz$9T`Jv9;ux3li%)OvOrF=Z#1GwlkZ))f1d z0+%-X8n?<4Mjgt7?aAsRjuRv|4I8P_kHc_|I!bx0^n=Cy3XDn|H4F*Ly{*qTCJGjy zB+4)l&RL!x?`OB0kQ&k43E))nCN!A?dCSwfa~xa_na=jP^8V_g^Q4+~aTt(3e*omamSQ|^7iR4^; zx%#_uxk3XE#pjG9xL7dr(MQf(g9f~NbClbd^qiJI-RT~a;m4y;MbL@_#m9VbFw5(J z!TM~6>u{s{$Mh)_Qpk*Q*Z*0{et)W=v2lb9nwglv452zu4$GrhyC~wOQ*E!8ll6P)X4$NKl&2#VSsdOCGtohgn^1X z1&LZjodX3{7j6s+CE$!hV=2hM8G>7N@(d`jqbL^e`%W4gqL5FMz{Q9SM8Op(6fU1* z!VGjJP%qvc(2Z~0p#L_H@>v;Mr3V5{dV zR5H@srR+6rT5+BgLkp2DB5gG8i|8_)UpVQ!_4gN@Q0V^s&Hu0bqWx&`cqZVu_dDL! z(eJUN&K@tW`LUy2x2u?^k5*fbRgwhQ#Iim8OjH8T8_m0IR2@@9t>zwO9;+n@EO%v+ zeOhUDdpWYydgI??z4wc^X2lKdTUtmsj;^;|Jc=5Qk46Ujuc_Ji*wCvR9^-SNgc(i@ z(Y@iZKys?a79m`qI&S^FT%1lCQMiHYu3d=a84Fzg>jSiS(zaxgkotf{ z4qg)MA4tNK8`lwr)>DIQ4=iuwnUTF=oKyRkx9*({se-SeM96+TG5jang;hzxQO9cj z3mlW$Pm^^K*XTd~SIjYCXu#vYo?HP^V)fLBoW%KWNamaG4e|llZ|I0c9)Xv*{a ztxJe(2(1@;pNHJGg1X$6j}PFu0+|}5ee)kr%veXL@RfRI%u#otnWmA74=VM}P;xPBP=BOdn&ut$^Nd_+&`o#sP;~MlN(KXF(3>63R)wNQJ zsH>#lm6)QxJL+{)D?L2-@72V1#oT)weZ1MiYjbw<{`-}BPrvJRJGJx0CK~)a+Xe;! z*{Vb(mb&dXmHHh1ecd6RGu|lDJsjpseplR`V=~(Ld-Q;eF_Dg+Fme5}obMHpXTdte}uX(q1 zUS}R(`h)Q6N2H|-XG!shzorU48psZ@=4__GWMzw3SWp|MTQ0AD#I!F#*#>IgTmOsFcf7 z^823amh{n}+b-{mwTw$8yjHW;4hDd=Twr(T&b^lVb`TY7{)Sxz5>!*wvH4m``_r0 z3%DM2cQvz`Fb4RBIKI^fQr%xxcaJOv$+-d1pf}RToZ~$y(#OVad#4yYZGdVlRpQZT z-fUG+3%Tk1p~TecV*r>7Dz0&EXfHLe1A4KQuMq_A&(Ymr=CXoHmq#fhz&)aKq@o0J zz~)EGQK*7a`pJD%<|Ck<@kC<5Qy zUN`ReeV(h95Httw|Glu?!A`BOuU}^~SFds^KI%0I--o;j!G9cyGG>lCy%`Dt+|Z76 z8^4zD_DNFoufrj3XvM?l3D<-*89A3MKv$3l{%a`CNneV&b7GVKG=aTdG>W;JOB93w z+$nIcK*Sj94k0Om*CJ9!GcH$SI$#^Gw~$J67XumKx}O#jWV9cF5|8@t*dtr#RaX#g z*(t5DJR13x7`Y72NxbpuO-(q?n6%L~pl;Jz-LbbiRQ zM2!C)sWcD4ybz0lb+N1l&L-6pV%CF{)YK7W+^f{QJ74gAj6wUQC4@26K?Rq0c1!av zVVZru^b`F7<&FqVqdK^_yieCXYYAgO97!y0@GBuuKy}FHR`1a&$;G|2l@IXqd$~8C z`kN06_3Y8fc{J*Goo#D*?0CZG9zixAp`X9M>$3CMK0GxuFYmIy5ensX;?${5&+;CZ zU*GJzDXjnxf;hJ*RYcAO^~YNmf$$t0(1OSkHbmsyP;uy!6PXtI4Id%0{Nfal-?#&c z3ddn4^7SZ0`3~i-c(Su1ASi@R37haJ6`kyR6WcY%Rl}QbS;NVVXh>)(@tOA)zY=TN zF2kZqLx^dp4Gdz*3pc`LQ79P$Ll9S6GtFy>HRu_hE#65Winli(L zwlZJ%)(YfX`8MHa{F9&e5QD}S3O}oy{EYB=P<(oblb%N0%I^V}aQyKrfRPcG9JPRW zbf{1eSnX0KZnggT`PBB&DU|z{lh=W_!-SX<{(`1;_mO9XKY#R~g@3r8IT}1*f4q_AJ={R1zm6x4{p3D? zqoVjG4-dzVtFAAcYAw=h39EEiuD~EcxyPTxRL|JVe>l#3H2852&#;W_;3wAaCQQ_` zos*^CyIsA_&6a_o`rOp?JLv=r79p}lXLgY-D{RdtvD$qT8fPL#;AG3;JJ>uEMZ&m~ zd5DJ?a2R*^exiPFe6ZV0`6NB*NZN{UibKVCoKhui5szE!pSav6rk&h0vk1`cw~ONcUgt?QUj0XH65em?YsEk%J0xZMU4cgA0J zr#dLYLY<)3uyp=UR}u1m|CdYcfBQqX7V<@)-<M z49_@xvaUbP*9*&lucxW$tsOV(f{n_@l$4aL>awgSy1KfGDmVooyc`s(yDOTHZ91wIywy)6LBXe&+*Y)5&D{Hc_ z;5~YSydQg=yP7jwLgr3nG}P2TzH?9N5|X^F$Z9CS4QwE_Kwc-a+O$7MBj;9hrmFhU zilC@SB9F}vt~$^l<#%&;GI4TvR36>(*OyYQ=+^j$e{|`c@|l&yw%DdVqhdU)^WAonnOJwpS1rtBwxMHLD1|fTxCW6Yq3;!izcNW^-9a zXuD3{>33DULm$>%Ct{C+t>m-Ifx|(Jx?40b^w!1OqJJ72^eF{qhAdYX z+FM@#?{E5u$M*ck_vIR<;#26Vu%eDPn3;;?uKd;05;|`Ep=Xnw;)RRM!*b&T6{(NQ zL|GNa@X~txRoDI0Ql2|h7k?a*a7`4%HD+4s!>lP8+@{>YnPIMe+eeWlbug08O{i&? z%i(D+Na+bgO@Ubz7G6zOF*HDyEV}a)JbY=3Up!Nx!MF%+MPaa?M_8)x2Ci zA$nI5D97}P!;3$eGiLS>KK~I_j>oK2`Shg{bOwouWcVO^-EL#9b7fhh@_`E(C+!}3 zynN`RMM72EGvdU82(>PtjEdc2Bb9U#hgo2J~6?jF&{o z?1mSKLeW0UdYWhsQZ>^z1=`J0ik)S$ZOS_(} zN(+mv)jB;6mYvg*wbJ=;Mx#0|rB4OXmb^RBl&)qPRj*Ao@3LHOcCDn`@5nVP!%!fv z4$q1x6L0a3ZBdv-U>@tOM65@Ek!sxfkfT!&zH>1nyX^$x*KdKG0yg!LWG;}6h z0pCRN-9@1vruo-6f1g>k&>NajPEX2K2$#rrdHVZ(=9FV_#zR3nramg(Y%kUijvBta zwuFs!*Gw6kUwkMZV!wzI!&%p}v|(%+wHSXr(OVnvnjrRS!@H?*wSjp_TLqh6pos5G zG^yLV_smM=6kSl1#TC>oL`U@fZL>QQ-U@-TAKL>iBp*1;qoXbI<-~q1R}@H<3K?oD z-FtXzb!<`JclF7D=ySb-%3t_AZ!f7NY`IT2iUd6r%-5LmrVF&|uvc+?F1@E;nEQ?K zOGIdWDfOF3vuR&fGX0uRSLUyJ*;C)-`ZD&D%YGDitKV*nlrJME?We-a7H;f2i2qR4 zhX2rqsyf~($DYQsk9=xI8XI4Dr<8N8S*DrBOSyXL1))aogj*hdPH2+7I)A?p3MB{! zk~_W4m&0@8b1eaUwNHX~SY361k9HfG2IBw1C9E_`Ypdi$V+ znL%!nlC#9i_4BoB?{`+UU8MJV39I@HX^wt}{8as3)hir2VoHbgeO!Ddq)c5YOm65< zPTkx;+kR8AFAL_u)m&8M=n_$QDAhrS=)QA+4fB+yv=XPV+r9k?$F6s?5p>l&+Aoi{ zh|H+0UwX8(_WNf>XODtE&)8Sgp?v7%N%mNrs17 zq?Tuhg=+9?J*0}{-Fo-!#n1Ag^8W7L-%gcXWqp-uWZ}J=!sS0)mdY}sY4^`XDD%-A z3uy5FUV=@4cnKUf8lBUD!VP*;F%6=M+B&-*BaZ0meJz5rUsG)X|ImLlFOxWPet)7w z{93KHauR-xhPE=f-%RnhiGtHPKV<_0P7Nj*WM-2Z2D^TbJuWzBmOFMFF*1EcdtJOS zdU=;L8Hs9|@?|4fDbOaphjOO&^JTp`qu(OHrggRBHqQhk)WuUa7@+wC@1T6{jk+p?%`e3{UW*jJ`_q? zLwV6RqjU+Y>)N3z??hKqeS74pXN@xHzsEm-jB0=J$BM*PQOXG0v+RsR+jZ=2OOKnD zuPjNAnSM&Cxh$kBaLl3Go|=CxdGeyKjm=DCzm^Im`Y}@tQP83Aa~sK|EQM_eE9O5& zzg66yZGP74`AXuT0Dg{u)q~8t?8wNQS2C6L*?1@woz5{f)vKkb3T0#yYM}9&mWc7Q zQ(&g6B$>CXrOTVJQ|GVVJcUAfbfB!Uv1AE$gYLJ9JoxnMOK4_D*O;9iyA#y0$w|89 zdKiAXoSv7L_e{%9f4ila$n|nO@hX0q{;Do}^T2{-Q>t5cEt~60gu0~^*vHFrrptc! zZ2IdKhT56X`smyzOCFZNw?7HpX1rl-Le_w#t7=eev_Gi#b>LS}nPS(poT;#w$(YTi z4l5n|Xp+VCAnF6Pz5;dgiy6Q4TUOtSE8W|6su zHzLOS_wh-nlu6m5N8fr~3Ox0~L!9|Ep)is9k{+a$Z%m2}(e9GVBycSTH?Vf175SE} zkH$?N6-gv@`7R1VKM!xg`Q);R9K3R57V5mHx~xYIgko&wr(;JHzE#EK*bgo(G!<9> zs6Mi%SRIsUDk9u~NI0}i0=8)(Xx%4az^7}t8{l63V i{6FwUU+s0r9vu(pCG(FjHEAF>5EGIT%n^9@`hNkrDw93{ literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/settings-icon.png b/windows/keep-secure/images/settings-icon.png new file mode 100644 index 0000000000000000000000000000000000000000..f6c9b07c052e690c29410b9dcfe46c8c8142f2cc GIT binary patch literal 690 zcmV;j0!{siP)Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!~g&e!~vBn4jTXf0!K+iK~z{r?U_xI zf-n$;IgNL*igS1kPvIH7fd_Ey(xod`?%cU$>SJstgcl4Tmc)C^E$Hx$ke8i~K#d5Y|Y!bO=~ zh&gSWsG6cN*$o-20W^^F;~~8p8p?+@6pJGvMQ^0&jTF6+qBm0XMvC4@(HkjxBgGbk z&&1lS%Iq_b$3tG1K#C1m^5bBhm01S(8YwogIFSer2jP!rHYCLcr_-rE+P-3&n9Mpf zQhY)0EsJFT=V*NlLeAfu$Y-Eihv?9bJ673mgWigr= z4Deovb4>BE5F2_1rdha}q4RW@e2va_y$`h4d4%&`#@x&>Z0M8?DFbts;Mg#;3=8ay zUS<;1iR+W0v)pO>BZ^#MC% YUr=^iHA8&8yZ`_I07*qoM6N<$g0G@5RR910 literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/settings.png b/windows/keep-secure/images/settings.png new file mode 100644 index 0000000000000000000000000000000000000000..bd9c0ef2973c454393a77d6cf600b283069836ea GIT binary patch literal 628 zcmeAS@N?(olHy`uVBq!ia0vp^5+KaM1|%Pp+x`GjoCO|{#S9F5M?jcysy3fAP>{XE z)7O>#0Sh;ij&6H(aTr+0HKN3^v?L?Hh+*ZrGaf)8o)VytOKNd)QD#9&W_})nFsGt2 zP@D@S?wnsxS(KTcQNpl>|BMw-ln*Rgl$r=qs!)=do62DNou3mZ!wHfJ&QB{TPb^Ah zh%NXJQqB!FJhM1CClRQ$h++GIE&V`Y4v=toVo_dZUOK}8>1XXgF?NXl(xT*4hOhsd zU&E9+=jZ08=9MsfJ2P!RP>cSge5j)F`$?D~PMdI%=SRNf@UdS%km^Wp*b@PAW zhABcTwK_Qj1r3d7N=^;xn5p0Rz#}^Q#a`v-Jmu~jjH|c=8#@x_r5};tf4~3b#y}SX zU*Qf8O;rYm_qAJh|Bn1n+YrQ+)N{hpIka5AO&}pHA??YWiN*Wafac@lXPd)k$~K2yU97dO@s6z0rovZy7f;#rYldWy*J|6P zEXL8be$@fluGzVVzh?MruHD;dc<8Qq!{WLM_VBddKWpaw>iMMFHLdGdPjb(7&0Skh zei2UgD!1Pf_&w~XMd1B7QDxTm(_`0`#+Idv%wy7-sV`lU`NPQYOik3mWXGM}b^qOe ce`Z)eB|F+j?z`T7VBj)%y85}Sb4q9e0B=9<00000 literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/sort-order-icon.png b/windows/keep-secure/images/sort-order-icon.png new file mode 100644 index 0000000000000000000000000000000000000000..c3cda665807eedb8ceb32c2b4aafd747f69865f3 GIT binary patch literal 487 zcmeAS@N?(olHy`uVBq!ia0vp^l0YoX!3HE#ix>&|!pg?LJULN2Mr$wiq3C7Jno48oj> z%0O{0khpVxL1j^9dPWJu8vZj@Kv6!hXi;h+NU1_eW^O8j>34okpbRHSCOAK>q&%@G zl_9p^KS((@*znBalAKhA74I&o14TA@x;Tbd^d|rL|NnnIn-sHJ zRJ1`B=U?5OpTCJ8p1Xa2M)t`=o8={Kp4%SF7F1rRl4J7H?xNV;y3gH?p)I`+W9BK9 zvHsU&S*>6DNB?5c>;JF3F#*rJ^%mpCwYHZrWdhFQEbATU3vR|{)}Jx`rQ9nbJuJ5Hv9+{*J)nK kA^cuCC*eWx^$D9;7(Tmj99@}Y1qwC>Pgg&ebxsLQ0MK)@&;S4c literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/status-tile.png b/windows/keep-secure/images/status-tile.png new file mode 100644 index 0000000000000000000000000000000000000000..8c4b1e335618ded8db3350ca90f6b712929203b8 GIT binary patch literal 10357 zcmd6N2T)Vrx^EDrX(&=n3<#(o9SMZqi=Ze{qzj1BR6=hGK}zUEM2dpM0D=VRC@mC4 ziXc*?DG+)MEupvYw&(uOoOkD*bMDNWcjvv#BzyK=-`eZ9zV-DlF-AA_z)TP(5C{a; zzou;r0-dM_foS*{P5{5L;6?&4K;vz!rwJ*`HsE~nrBU~eBkR3TToot3}WPY~h!Wf(iwb@|sZ zUxcn1Ip^2?fzGsLmf$URk>%)=D&%;%;GJPMMkRqO{$Ka@0!3i2=6F4Wf?gZEYPpwW z@N;u%pir0)xN#Yo3c7U5L; zN%e~uEYV9jBDlv`vxJZ(9zso1huMl;d9?)pVgNZBmh^P1nMEyk%G2?$)!@s~AvOBKNAL8_I4{)*Zhr8b zzuOIKbC>`a$7yEQ@Kj+TvAya-$L)Z@yU%S`7#8cfb5WRU?`}9c7M@#WSS*v=e;hjA zF1o37R&D@Rc5^Mb*IO?-t6akHN#fXQG;x0|+V&rZ{DKJe2n<~8j;LO4B`*9Coma%f z=tu7iY>a<7YA@!gA>MJJ@CI7C7|-D9&lUdK4 zR>$hH>EDY0f_uC^8Lo!RJob7}eDrb>it;2#yXxo_2o`*0_hC>b5A&;r9PX+l^0G~_ zJyBm^#SGJGMg@H3WmWttxE>UoR#*@YNr;xig}6B=&Ljce+x zU3kCn#3L&=%-<-&e9a-R(fCJq!Mo+g!kEd?e<2QBX2q(Zs3)K9zf?SFUr2nbPLoRn z@zm2`7Qg}8$R@!cTHaphdNeUqFC!?tQB-=}U(-YV;S((aUr}3fGCSfP@%58%=0-)0 z;$4YP1xJ+5D%P!qow0$bB{$|92Hwc`e4RmYVNooHu3Jw&QRUIq(yDpSCR^4pwa?9S zMqM5wd!&EtL4PT9v12QY6i$RcX>Cv=M1T)Rz9NYPPuZb-M0!+R;;OwJPlK z_sLWO;YS{Ef&tfN+BW)l2`n$SNvE8Rm|*)4)Rjx%#hn$;QDbBiMvai8sCm;c}eYM}_4fs@Zc5%pMqB-cC0b`jp@$UfmQek;mGPc>ek#iy zJgRs1wePOo@ybrn;p$4&D!c2KV(>WB*j1%VW`j5}W7nI+iOkWc@3$GFi2r3_WyObhgL?;$=nI48?BzNn<6BsyoRmi|ljRQ)7* zwt&@Vc`SXSO5NlE>n0tv5@B(8vZ=W_{IqYDjM+AZXy3d=*DD$?x%SD*Hww4izFv=u zgYSf*SHT7S33GgNqHndf(M#(7v0z)Lk)pC4^!|f+)iZ<8&Dh#wcn4nT%m_a~8`mOW zrr2{R69?{AsRbbR)oYyzd?0-v8Bkm~a{(ZDarXhe>$4-MeBAjW+D$ZDHiD<#A(Cjn ziRKIn?}gr30P7+xaR2P#xpKq|V(?HR9u;Rfy2{dIYiGxDO!~fwPI=}SjtL@nj-IX8 zK9%O!Ck31*Z5ukTmPch&hG-KjEuO@!rGzorYTRg|hIRX8TsB-suC5W8GOO}V) z#rvHWtNO3IPJIl>B5w0SE4e8p_7CH>45mH~G`_Ljr0Wv%l>Q{7vfKIIO?};Vda2js<4r@e0nwc^A{)V+x3j#crPnZg-7VhzhS~wsv%h zrB^XxSJ#A(dZ2gadZC~6{ux(4ErGG2x3I=YP&^Uz)-sk^?QlK(G$?U&qzY+!K@k)X zwg7s2u9rq#CYv_YNt+(j70nEK%?1O(M?@5DY;Eh`H(XpohKQ$KM`5KJ)amVOgLI>! zqUcddrZfW7XRn0St4sGt&&ac8+!B(KP}OYZ}?&}wJc6P?aomSbVeyrBk}_7SzSJwj0A-$-QcU=8;0pPKDV(~ff8kQU8#B?W#Oe3+nol0Y3<+e&YX zOo#L9orM`6z2Z2bUH?UtU-3pdCe`O~KKQk`xDorYNlsHrOXZ_;Fv6pgC$gJOTR64x z$QgyM;}?S5Ly$h6%hjR^oYuNg6Dh(1x%=n46cl%N3lO>c-17sCC*)31D=K8tNE$ea z)Rn6n+HA1eb%SVTlUWp-L~-pSCZ?rJf$8hYwqIqP+X_>@@hkdFrm(^;-*67#(;*#s zqBV1&gR?~mjDHQ}iMzw|_KV+SW-j|4HD`GGw6F24bi|iP&-20je2a&hNR8Fi*S2CZ z9{99RYr6f8tZaSN8oj4SPbObaQCZ*b?(Q}To|@x^Jq_L7>BjEVQ?(Rg7d*VZr>Cnh zG~ZKNcK1Nw3o7F_=XHEacXykAbX|T}x~D_G>8;(%udJ+WbH}bjd4;sReBoJu`PeNPt6weA`1F z2WHZn#i?J=$-%R6jAnBVroE;CM!gf5sb~H1rtsW2JH`a{3Cwry1d$nqFv!3ZAFICM zhNh3YE3t;Q_J5bcId+)OiVzG5!(y@BTL(iUO7=d(9>@~%Z&eft7bVU;9s`!#n{YY{ zi!ILiT*7s1TFHc;^G_K#`(WIHQdID?;4N27*qk}YO97&jzi3}TIn^UJm&uBo~YpCM`Y50filc6~~TE5m+r!;9p^&;p%UcE819?)AF9F00HKtT7;2<%6CJW!}L6zSp~igH5A)jEF}2Y2Tfpj%Q^{O&*^N^zxeG0=U2S=-v3Y^G;9FfX~= z;^-iTn*_|)De#&vPGeSJ8z~q1fhpZ> z46!x5MZWaAj>Hc6@#BZh@OjAU>Z%Q~$&q;7^>OW>kp?D1E1V4`^#szL$N<@6VshVf zNsDGkvK-DpAmJ6<{Sf$-)Rp2}F4Z+PmJ(?lFl`|Z?igVtpz@awrkjlXTrJ* zOq!>NcTTpdpNo>z3K|iCgVII+m2CVM;pymER{=deK5E18eS@rj^=_<>vz!V$aY>Ul zq9^n$jz-f(J*Ef54}Yue63PlO5`e2SfQ8v07b56hGJsh%X$>Oi7;rTIcgX$b>Z-=? zQupS^56Pk`_)III=$@W#*V(BlfdQe!p7oyt0|O6cfkK0<%1=_`(OotiHGdo4mdgs+ z54?Tb2e9!<#J`EYqosuymusT?V9TjvLuo}|-1C?peq&^BuZCqt(cjA}vCznf^dEJ)nB=8}%z=hS}PbMZ^m zi|GDJ-FQ?=@TuEhPaT_W+-#MOKohGnS4bs|+d-y&&w8X(($dmYooWW98!g0?o$)1X zmd!w6=eikm`h;ck``yy*(_jF&l@S9tIZf!aq7xIlyMFRe+$p5HyRiv-OBe%9BJ=G8 zwN=^pSe8OvFT7e*?Q?D+_>GKv1k50Mgeh|0SI@{oUq;33WZ1slYosCrn8XTk`VzG? zGjnkO5i4JAdGz?S>X4MUYT}WmR&-&%DK=*>3N5jwF}G$Z;(4v;mAvh>BS98Yb~DFx z7%Rkz4RTrREWy-nZEmjB+rZ83EYkX#ThNkHgO>Cu)vyTk9X)Oc2gB4DeNA<>2X5Lo z$~n~(E2ya@s@Yu0NiW&WywrE&@l*!4^>&f8AiPolz{--f#xsvp5!UFzrObLQa;4N? zT{%(I6Sg)WtK&3!c&zl+Sc_<(Ozbl*h=FK}}#NLy06@mF8dM++HF6qjAYNP-J zF0Qgw(wJoPH;{Aos6Essi@srn#~GZ1d7r_&3l;Y{YQ4rB3~Oo8A*Efte7_aoAN{SRVKL}eKdKu*>o1`PORBH?=9Wf6Uv)-32s64U4An> zKGsDGsBEGre0XJLWp;LUk*jj|yM&l`1YNr{n(mSA|EN;KhkDkt_j{dh^UIoLFY(cM zE6gNFEZi3L{Cw=zH1G;AD)563{OHj(hV|o19(A&EwSa;Tt|T&N!G!=DGY5mj zCfUR9uV=sEh8Fo%*V4PEz0O}T|7aynVi5~` zVLs~xuN9Mc$eXgUW*OwxkR&4iTxUQ$aKO2I{BRD@%YzAtbt_I8m@&Y!xG>{1^lsOw znu+WYef+-_s@^P~OQw_uTEdEyMLjjzR1^K5GIpD6Eo6BPpZ{0|m>l5%wYVs|^=sQX zEyTnJjse%>1I;g`cA0Yqf7{?DiG9*of_~7cL|fF12)?eivcs3vtByQ(^3s@;UiRX6 zY7_h%9;6fbG=KgH!J>oGkkT!dCGHemAferzo_#x#&eLbTv_El6s*|O-@1cfS*R*D|o9y)$^jFR5k8Te*2AkLl!kLg>o$q~n}^ z8L4H%+RcjH^N%~<6zjdJ;MfVFXjb~40W0zaSOmF+7%8IZ%)QClXJux*m(Dq=+Pe4`+OiV9vmo}Sf-7PF4)Tq{6*m^YI}f~gGo!6O$isz1=Qjh73^Ko>7&r5zaqmo z-&sBY4>M{ur}}Y1o`xlv@^Ss2`%Ggr-GJu|2gI0BZ~15bEevk5jSpoC1Ib6DFxt>fzy`j#G_I7Vyc;%-xUUj%%3$oUAzT7Um_X!0?}^9xwtf4oGrEuz+QE z<@{K9TOpzY@QWg%uZ(i?Pk=(hc@&Y=4GljkA`T9on5F1ezZSi$kZgn}udh#}@*XZL zs9aaQf-lPK$_08wZ4Nzz&-1@WMn+7J7lkgdLVq-5sWo;@_)7=nGB*?^sri2H9#BE9 zizl1XfF|V6q#;H}M;Ek7x1>&f6yu6Bbv4Fn1cu*vap(6hG!%NL8(LgaGLSB!c9dHX zv~B9z0j+$~vR{8Q?M?MpXIZ$b)>&E*PX&fgt)b)n>&vF9C~D?qLeLga4)6cndY!Wn zf}5nE_lr(p4K}>J-#E2*4^Aa}u5~LeEEl)DlYji=BXkw9n-FiYR1+B9Il}~!QY*1* z3;~K5odz5fo5|)VmJT}O2Z9vzi<`$SF@6~YhXeM~jnG57P<$Y9;`;^TXW|=l8;@D8 z8-hZwn54cXe4cIfZnS!-l53!QTGxQBN|^8g4^&Ob7jM^XoK?Xu>&CsjG?%38`K#s+ zu$W&$y@Ldt{JEi9!?xNX&pWYWt{RWByk9FTkvDX&s|Xo|Z60?*1n7oU*2#s#H{-T01X})# z4Yabt^LtKek=`%+U-p)}NqVKhAaG4=*8uDZ_0xcUJ|ocl|9YLKL^V>EfV%iE1nSUj44dbc z1xL_n5JUOLh{T5W%&e?DMjmnLS~cL?Tr-sn!DpDMbG1Ew!$a zcYTy$Aqw4@7=pu0J2deJ5FJ4hyK{RF*4Lj8mYbxZsDVlBKF2@HUB!o?6uM>1iR(<# zoR`2eU_m{ihxU)|?w{&UmzI~8_xG(F2P($K#|xi&dX`y;^__o}oSa-&r_^1;-d*3d z4n+KM8SEnYz7A^b&^!`_auqyA_WaI|Og~RS=Kz(VWb_30*sWt07M86DM{~hFpzHJ? zlWKkZQaa!YXRN*zM#zB=m>EZ)QPLwyS@VW?d3q+b+P&KWhYLLE3HpQ@$(BDN0U7@q zYRUhC-2F4;`E#W#GvJ?QGhm<V1j`XV=6~SkeV# zI^(+&E$a^}0pKUu_9t{I5T@<0vy?OC7LTh)Q zRPxi$v>kdmmf-LkGOj&rf1q@-Wh^cuBLj|0Yu&jLi-1|l&>fLgTka+yZVb_Epo28k ziBbS4_B*I~%FK**Lc+Ia=qZ5dc;%?Uyi;*yw)y#Y=za<&SnSkXdw0V2DlogIJy;N# zE&(wAd|zl&K*aOAv|7}uCLLqn8;7qC;`CW3~vwu8tny^|v!4^v7g5BCwQs+|*|V_^&8R6XEUc)gNS1Bn8<56L`eR$; z2@bW)>4^RWH^&}mVDrUy4(7L2v#hFqrc1lb0$orb1+2^pV(vZiV`!97(FB&&A%?yI z5b}aQ!Iwq4Yky6Q`@A?5EB5ltGv9J2@%iIX_8XQNv1EYDf9+y(AwCOj`(P{s)jX+?l*%h9 zU1yhK`^W0J`%0%9^m}%#nGLQE27d&6<6S|8J6ofet3KwrSA%pPi`;eu?8V>Z$IJjG z*GLc88|>D($fHZ(Pwo#>w3fHuu>E1OPZGj@9-u8EUuV7gg=P_R-z^-dXvSq+(%qJ_ z`Xf@AcwYt2Ao-RS+Q4S*B*b?OX~<6SyuCS4D2Y9(DS6SbIsG}}Mt?0SHmPTQochF? zhc~c!hVxjkZXBb}_gqf?agffCmg@=KaDs!EZkF^+JMZNvf&;~AJ=Gye@rK0KD-{Zw z(e*n|>-J^)BlgkzEbN*@slbih_qTuVcU);COI-yxW7N&#bCpO@8(ii5^#{g{th15u zIT2C_o!d;`pm{sA6-{tBjAc43n}+1@&9pTVJ*9kj3M1g{~EWpMX&QHh1#Q`BhGqp1O z1<&K~;)}6$f^xmLoX*oy(E2?SeJxs!C(}y>BL9`A-5STKxb0HP5BYg3vxnB-S2nZo+}Cy0TwjV1cem z-hNPmcNP|F{?IVCU}$K_Rr6hEh5bbUa3!D!=ikKm-n*G1Srf)T5Ucbj*Tzh_l+e8{rY>*WoOk=fw0zRV9^3=`nz&$y$cFM52ScF|AVo4mx#f`9+1T3+BF(D<;)R$WA1c3Kkae8_!}jRY^0E-; zF#oTeT>Q z8>Uj_E*8`An&W7ox%q*~0O`A4q|2K?*)0EN?^!r%dWsjRb0Hd^-)bcGY48@e$t5It zyA3~et_(Q?o+GC3JSOjbcf2S$-~VmEy?0Vp;_Iwtyk#LKZohmh-(}RQP_j5bF7>IK zw5Cp7i+D)c-kq4s3S5CtAXt@tN1cXqbAhHVqg7-G)b3HkwWG-Byr75TYExT}JF%M3 zS9}*l2jv`Rz>c}R1rj{(aTn{G1(0fGZ-{I%` z&ig9xVuv;1Nbl-Zy-31mij1De__lg`r}0{MVAPPhXscC^vb1h)LzV@=S$Lv$TuXB; zSXB4@S9fw;7q&JDA&64IHAKEH8ZI?jwvLkxP~(u4v&*GwYMX2Xyx=46f10hUl~=#> z;c+Wq?L>9g&}A35ek}E7Q&)Ksks|c*u)wUH-dpu*5%Hee zOViI;Nr;n(ebbAp*geqqx~eE$;)q!Svt7d4Tv=*~_EOG;)UiX3ts-9qE*7g&&t{5W zr+*y%lMi;v6`w@LsZ+BjC3(xfz$?t}y>6=;DuJUEk^0N2`*CIiod!pd*Qf^XsC|^j zotQAh<fB0*b)uOZGMq?Qv5Sp6|)WRSqeE7 zqtAllspk#3J@5$M>K*7t{Zc4|Di`h~vuF46H6UKm?@sCE)Bk=4M z#rG*n!g#k4NJ)uP%>PjQio5hDNfn0AgKG)9Lygoe6(Fsh1O88U#k_q3NNYn4L-rSs aY4GKT87*(h|NK=Dq_1;RyI9jc?0*56mY+%h literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/submit-file.png b/windows/keep-secure/images/submit-file.png new file mode 100644 index 0000000000000000000000000000000000000000..63c350c9a9f70a8dd8d86777b5d82d1ba700edd7 GIT binary patch literal 23858 zcmbrmc|4Tu+dodk-Gc5mlBkf%PRO1X`;vsQ&d8QD6eddsahEox$QENNvSgUCXRMP7 z*}{ye8B7Voj3LI1%oy{%bbp@L=Xsvj=ktBOzu)r*W6tZm&g;0&<2c^OdU|lt(Mn>w z>~^KW5RSZLbylcqKyD8BA{uPrU?C(_jo7j7 zw-xxl?S{2Sq>zy0`^_KWELF*aLPFkMHs>ua$M`bG+bfi)o{LK?DVYOY6&c4<53~;N zyrT8M-bDKGvE9c`=cT;p5e<5GLqsu^C*GZ#+XIQ;YWn!ypN2AW5`;&`kG^Yb;mr@m zqxgMq==9d+ICo}3JH#Q{z0$LuPKu+?EsV2@4l+N^L`JwezQ67D03BtTD9%^L*GLE1@ z;M|qDpSi}ZF>E@KSD>l1$$Bu|_K$fcrLALUipSqKyx%_qUt6BO`16_n zz`58!^;5W}ZDAQ2OCRyb6r%BE%zpk8vVH4?I?jfyuSZmgRHCGlx!g{9EAeCJ);#6J zq-75k7%?Y1zm=VH4U=4sQ7;Lrsc9c=do?+w%J?GOD%RpPOog_KrsDt84o>1d?;orf zV=v`44qa4;EN%H1eC_uZBYTu5zW;NlC-LN`op^3V`&#+yEOlni&rh4*kLKB3DP?kR zVJ*S&<=u)^%t&;lVXVx`_IQ(z=p8+p%&|r}^6B*oVwz;fiRsTDzf-+--i!@4)P8KW zo%QRDY+~!vmruHU*Y^{?%nDtc1PfS+VF^DFiTdbs_^B+txJRgzm%Iaql3YH$l-M|+ zd?g#26)tYa;FeO?*|mG6M$_da-9ElQ(au&8#PH^&&E@hGu1|FxVAS+gV62!r>LXUH zoVf0q+wAeIEbtPVt{KHixoh8BL!iOgDYnnVcBWbm#vA;3=pPEu6p59IIk7R^ta6zR^Te28h4(-b*vWecKDl{%dCj3Dl%!>B(kZZJe z0^@!xTN-rw{(;2`vRjt^gMEDr#z0)5(Ldj%%^37Rq)Avt`Qutm@T4RxV;3jJMH{pK zvlz6xZLIEUpK9pKCWX=G#ukHf1Nh1Lg;{GIrXB2B1^w#h={+lY*f;r_qdH$A+_tgc6_qF#2G%1!M5K{S2MhMX}>r8;DQ_g0)S`&6F&{Cxgq~Xg}-H0 zmT&#BKIb2znkl*81|>iE6Ef}cIe^+jFa+_v8gK>Q@wf&lY0~>}4P;9Dc$BaqXiX2v z+Z%(`fUr}t79l^a$BqX5i8{_l25(=~V9n;7YLA|W@Y#a`hL#{$z@c`o?Jb!8G#ox##c?^Gu&>hy!(W>^-9o9(-cflC(QD@BHs6q_y2l1 z$Q3~mc=ZUujj}GOTchly0&btv?KL84BL!7wV>%^nS)Qq|E6|WUSYr}2zHj72y=is@ z`@5c>;xj8JzQ# z&MuCf0S#|&!4~hc_XRb%r)|hKmG-xoM1YOCZ-&d#x}BP*6Z08RM|H1oXDb-Ju4S7` zPPstXE2|xqZh{f?`jp(%99+CZDA=P1o^9U>7Py;|{ov~p);?kcn`Y87>aFS4T4^^& zG09tr!B1jc1bi`-vyNhp&+D=>YZ|&DXKvQ83idqamgnoI?0L(1v?arzTx>RS72`X$ zq5_?McO}nTE=1*;LT(N${j*rgw%43AeDXWigxRnH*8(-0NFAIDZE)ayt9((nMN=(g zt5u|$yvs6<&Wd2-Mo7bA`;D!e5=ngz)xC-^OO>x5`ZUuZoYNkQ+2qhw^VN)d zA+crvH$Hr6Vmtl1PWKFD{{gM1cW~Jd--){N#q5QzLtYlxl>2Ju|4ImTiS*r2Z65s?WMphslH076YoKRt{sSAGDeV@Kma1jmq~X2G4iSs#Wt6T6 z|GNHOR(ZotLqBZmSLgD4uTJG~rK_mZ6GglEYqK!T+cW?1;=cc2V~k&j9%;P_E1j($ zJhwG=UNs8Qv%_vv$Oaw`qLu?0vnVH`rhoJUx3#k{Uz&FBa_-;-mNmue`(5SAj=yLA zy_Ns5Vtg~!GTc?Ca$~?J@nC(znJ(1*pH|nNn%~Ng+wp8|L+Ewko6Mu5@b*_aTvzWo z?~OTwM0n%}FAJu;%5rv$-<(aE^e7@>J=026`?g>Iv{l#2^m=A|<(!=KD0rQpxU&>> zX>#_iD;3?n=)R)xrT8LZT~%7~wXZ!)J~xM!=euJ$GPGzh(}oDwKvRGHKpm1#u}BX*Wq7 zM8O|&zY2sPvaAw~Ct%($sZ=XEwhyz8ryi1zyfn1`Zf1I{$)FCzaONc@1;?M7zxqi3 z8mg!&*paK{iZToEwpN??y$7K_6 zo2DXFLv2oGFmt*ETbE1giSPw^_OSvCHPzH-VrvSdv-h)1Ji?aWeOmqX%k~nVdN$X$ zz2;6U#x{4 zryiJ&^^M&4IqtI2UhfTBR|qjFl}uE>(>DmdC<=@C9+VfqShtZS+Dj6Qs6&I1CM9OH zc~7vYd7R$`UxbF5QM;RX{h=-mwHq2qte2=g@pI4D3dZuB%6rcblzZE+?Rh;UGH7~3O1)F(ozC~Hys^w*hn+W7$;)o8 zz{UFnn+B7(PJcSJVWV10G}PeXfEh9RH=8mxbvG+IB4*@Og2qLv@Y%#ek&F9-WETlj zhNzoU$oz+cMi;3kK6zn1^xNx&<>w;Fj!2VNZRhsJ8aFzMpt1Mp>=oN z`IjvNajfUJSh2R_`lCLS{>B|O;E_ghSm7!>F~k?t3qbYb^a8oZHL&77{Iqrv{DO}q zc!sni8Q0|S=@i-VHd<9>t!!MaQ?b`MmA02YbAIrY(n)N({kcL`uJxT2slFlyTkic8 zRhWmF^ghZ&&iA#e<9PiMCo;rWa3gchp3!S6riq@8XPtc%Tc}36`}%{4Q#R|}@RdT9 z-dMj7?SHc9kp{Zu+y{Sn^c$za(1|~PjMs3}DVIVN8RZP2#hMGKoUZhS7zQ#hHZ?85 z*|`H@35yj+Z!c(;K*Vlj0>sXK2ZE z=Jb|wI9)nGaAi~@xgx&+Ty z-%k`61J`3MHJ)j#Z7*|S9f|QX1-R2Ip@~)!c%LdtQ+mvrd4E-2dS74^K7=YC=jWVV zu&0Q1ExfO~?#nRiuO0q$B(VjrttU9)efcM_!*&Ci%F>n_Z)+#}AC*Qpf1e2Vm2)w- zlQq-_Q*@*Kka2zloRhYSId^7j)85q&dm~ikGr@tu7Y#<}rl;5;DH)tx%hvcLG(Wc) z>)50f_ueS*Yb$7F=7L6*_nGdkTP)>DYQ4v8><2$=Ele?Tx*2Q+>(W3w3)3zP+$nHz z1>d_QK5J_9+`sy1(_zP~9ga?&W3drCrMJ_D&ka8^UFzTQp8#rLhu!}qAOFNPeOTd7 zJZ52e^BpzO8%E%oX|K~J>1|2KKuZMM$vy@d9zM2u&?4vCzY(`DgxHMuGNWmXY~iHA zL@T!LOZ5&_#F{^7Y7x79OccR)5TEEPlfI%+SC>O#hu7ui1UAI@#r+p?{Ux037XdjeB*tFVDBZi;0RKn zGWVkk(TGWS+0bL~%qsD@x~VcSKfYeTW{`kkEtnti(Y+lreBNsGD|u<(miV=0in}1~ zaonfW@;UnSf3`+yYn zjyf2!&wZC|Ep{=PdS?`kZv`9>JN-mI54GEB1>Hq+2@zzawA2GH zWHYSceG0-ScO|}sA47I6uFnmIqio{nZ971EW$VL>RV;&#|){V*@f{8uw2*!)+e`C1nxxQhr=-}b(Kqlv%{x}6=?d5*(=Jq;RwQZO6ee`SJ7 zNU`&!F6p(!%(r{6+`}kgZRz+eAbwes#yQjMo|f`E>w|3@yc?foB#c6K9C)Vti4%m3H_XEvdD^=@4C;?MX^iA(TxkK zxa-+A?evDy{<^FX*9OJj>IIxV*{YDluJz4EQX2Eza~Kpbu^~BR@8|{U@vmJcil&vI zgY#a=w6@&REku_m793Ce@yFuRQls&M7Jk7^%2nGSqYct5o@J={zl{BcpD6*B)fP zu-)*<%?T>v=ykQ-=9$ml4ayTy-ky`y3EO;!1Fx$?wB585m==O2T<&vUHq|+;RBK>D z6^NY+k=@}U>06}PEaN0aF}1llLp=!l=C`pQ@9IU-C&bWqhT?r|Ycrm{Txc=Di2G}F z*pSIJ;#l2w4LhH(Hmk3n%A{Nq2>H=Z zfBA(?Jq-c3CzzU8ZK&)RHQ-W}>A26OhzFOUTtUP~lXE$r-lnmbr1Isg-RoV6avcky*Ws7G**=<8XeAF>Z__-1i zY{-}C&j-EUz{t2z@&Y|d7Aj1etUEHI;EocYVeR0x;S1`0x)2*3$lREtBq*cquOANv z`jeDH_NA*B8Hi*TyPhtb9oq@YaQhzfD$>{xLd3X^(ws||vTWNX4B0SZS?|w%m$DDm z9|}QWf=4m;9ltYPtbGdR=S#FH4HI$kY+dj{B;5%$;C_+eZc{<11lzupiuIvNwM7wLIpjp+?|BKRjs*g^w~U#EZM7c@w|_D zmws1S*hraE(S|c(jxBfJvt0~5;Ye*HeN1}2xqWFH5jfdEllqCPH%{wUngv7bZo`aH z#8URMbbb-r#8Qs1adkvq#$jhb5^4%9wC|d&+);p?IVAB{5!{PJWDAY1S|y)~F{SUJ zN7PI5-ZWSUm0_$bc_|_F<2bVwQW-D!RQp12o5B|`j6dIdJ<*o?UZ2e>#w>nGD0wmZ z<1IV?UZ{V^aMRj>|HfND2t4opkIb)R!6us8L(9RY3tacq6pXA@n}!@rewnzKKIdTo z?k_>c>$R+gtmwsO+fZWraC6Z<;am_&`s+u6UsIceHPsRf9z2!J;3?KDT(_e(wvKag z9D}Q+3(|BK3~8Eu8KoqWJ;0nw`p}VQkt3{{5_m}I_AZ&Nr8~KBtxDm*Q)etCWb077 zO|=3|VMY{Zo^5^}m|`VyD$kua(pW7y#g2ull#J?;g2ux=+Qg-@F(bpiKKiUs1@00< zxMHER&GE!ekdXm(_p^WE#Da0*6DBLH64oGB!B*_u*s z*A5nEF^nv_y2rMkgWCCf@~hlc=^p7MRzn<7RU-8YagSx^1}= za1pmHAJ5g4p9pD21hx#AKuI2LQBT1(-8L7&q&-JeM0(Q$*5Zw|?kM*z<%Wb9%-ZpH z|G{{HMCWkVhVKd6c~aq9+^R@=#mpgTl~HfZ01X|!%`E7!)*m*MD$=88v8-6OKDq`xnRFXc3huR`$$*cDoHn68xZ>svcjqu z-F91SnMDza!6YVSy%ZX*JM)IA^vzZ8uyV|$nEoPR#;Hwv6SMutHjCF{!>NZM zL!(XPX3PIWC&_11l$w2v>;9D+v)o$}Cv@zw0^@sp?hh%H-}108$_8a%n;W?Qo6W55Wfp%MXlE63@O)3 zh+8AKW{3(+#Xi~N5n9k{9O|mIYPRz!*XS}p+w_WulJvL}rs)#4 zumcU>bIAyF=JIB?kWxMpCs^3?mjW(PFsmt;_5w4wUpdOq+I3$nPyrH8jONjAN75_@ zXmYg)^GeK4B!nowrl<3=DXCuRqJ4SF=W_h^$P_=4c#D5;mEM`4);g3>eUve0Kl%nL ziMY!5>^eJ)3rg9CVfYw{mc$ktl`#Y38q_hNH_CK=2FEqLCI!dQYc|?684)hLrcb9DG#QYl`No9n!>AR-u56lG zrv7sGvPVgwxEd-!+munkw1OA51@gOb+_tk+&X8Fd9rr4HgiurrZQg_C-t85-Bz{6n zs>B)bu46>}eIEnr`j6;D9A^3yHgrp@sxF`8OmgSFk0Q^Bcr1d&?24H?%j&~{6blCc zu%1wY*<+3}X2cC;#jo3AZ^y?W$`JFZ8?ta?5I7s5Mk0AND)Q9f7dW>Q2e>Z79|>)h zBO{AsK^3Rm_BLCar*mPLGrrC3z}}~K?u6_-YVTA|KYUT4^zjzgl|WsP&aS}La$TZS z@nU&rlC4*WR9{63Sj?xmvTu-Kq~-46B=&{8|5CeTnc7IBut&q7-NiSQB%B00*N?8p zc+t9&N^5nLuXTu($o9`uBjs2yg9~Y=mvM`|8*zlvHfqrVNu$@^)RvsO*arD?=YCq- z3)&W9p%10QKw56}vIxY)4Xord8i36xkvXj7^BixRQ5P$wYBM}@0Ig(`AB@dVf)@UB zuwSf#Hi%M?N15Kf71Q!pIZU0|*_)#ojv5DQ>lKvXjN;a{{pdf$Hf!N-Z%nsVoB-A$ zV~p|F9s-N3fns;>_ca1er*#lv;&kzfA(yrEqw5?mZ)2uE{~X}r=DTFnK|33T_xu%?bXX{U zV}0$XoE|7CmLQA}-TKp7>*&R;7D}+&Pegi^z8o3Zrc-yJhg+7@u=`mYRi{;~%sx{I zO0mgv-QuC{Q=@|QPVOm7FgsXbp~#@$DdsE!Spn)6IS-fQqv=~!v-274N+Gu$x4Q-C ziasazm*B7qGoig}O)%osyAJ%;fF| zctAdxlJ#GZU=RYtmL~sdu*Dcp$85}$?tkjF(!yoPUsV2+U4Q(MK~StJpyc z6q1g&9X=+5KGg+L4%xHQ?YTcTqi&m+YQHwfhAf(rH6w#of+pi_BLV2q$3tEl0u0QD zV29=Yar?kYJpFeM#wLe-TjOA?^)(iysWx|rnTTq#zJ@x(xCI|qTY7F`I@p&~JNCr_$v?s6{ z`rFDc)bSnm6+=2hfuPE5QbOO=&TS*jqO`` zTx}9W_HVYv(k)qeA0;v3N7&2V>Hf5j)og1r;x+!HvcGW3H8KBWN3p1Y$K8s(TIrY7 z@{@)cDNDx#PtLl!z{`du5!xx{ftfq7F)+QRY;2m6Quy!C|m1_ImzyHy`Rv z!!z~Pak7s6=%XU1WcK{A7yj5<{~Tvm-G|(>V!GSi>Ls$Lt0l+k!!EQsE1b;sYpv^z zOm@^k<4k2LOA&XSa{|5gbc3>AWW6xEwg<*7<9F3nKt2d7^Rri03KT&{@~peO{L6cV z3chu8P*VVF2a(Fo+wRu7a9JTap;+<`^jY=Gs#-@U>{%c8%1%~G(3l*c>o!`wE93#U z`IDd{#?O%6o1T6+ZM)mfNrGan^_jEa>~9wii7}kdK$2*%uqUO-`z{$+1iz8Or$r0A z%dg0fl#IHk>|^R8%m{EiD6j7!+hJ=x`jJu5oZb_&l73ND8xph!Qp^bahj@CZgPxW+ z?gON701(Ow;JQ)Pzn9YgNyyQ=(ZAHo*Zpp+P`|#(Ugzv>uXd$WnB%EzbE5$qV_9+i zmRo|V8c0Jq*Qu53<;7p^c{34B;DEA8F!P_ysrD7-rydNoO&gBT+ooaa<={jsbVa*s zHg$JV7$2%j{=WKgxZQK+aRNi_OUe3xM|fmd`^@Q!nwFHDxV;S(6}?u>k?vW!`w3w+ z5_$TKWA(bAkb$o$`^*b-cVr3|NlETJb^uFHGDx*3l9VH$n!kkJ-nr9`5Li;!b#;UA zg3OcTp1PKE_z4cyVK-h5&$kkL=WI^L)lk2zZcAUg`OO)1vDAs^fkTC!*~ulW{+TW@ z+p5kvm%Mkd79M+kF>wprfLNMKRxw%R7rtqZLiy|fG#}WM2$g{|pA!!tg_De2Tazpf zl}ulmF?=og9)58^XQx|z>k!fe{tCKX#H565rvHl;OV_?g#6Mhn))!3KQ*6v7rx;&a z{nB(TvYTJ${;a$oLUcXCY;j&VR1`n_0mBF}tD+j0(?!+a4oYHFmx z2O%0t9ed4Y*_OcS^gsbIkh@$T-e>1`@R|ZIg0#u;U@139$JAMLblZVhZpXd2p$Lmr zi>On%MB$ggdqWTw&&{;14hN0;@Sfax%Xw)Qe52>gzLlpWm@EUsA7~-3${wcIgoK`Y zyXVQWu0V!Kc>(3R5!r_+!=*(|cCF-@t4;IgunG|(9SH-hI#-1M3?e;T3dh%jR!_7r zt&Ha@=E1(JZ90_;jeQt^%qyPl+A>HH=fMlbj?{sn8dBfiG{UfxTQJcX5HjJzV>2oK zQLD->qZ-Fz(-IQ;=m?-=&+eFy$gJnOrJT#UgOx1sNazuA6=(NhW<$rpE7fgF$u>F1vxPkIAh;0HPb-#?qxB3cH3F1k%pqa0p%6ke<|W=9H|c%=yr7Ju6Lj z#EL>zPKYEzb@^p?L_-werJ6fmoam!f+uhbXbAHjC!z^nryR#h~PUy;sg`?@3&Q!bybKj;}W>uV3%tsOUfxD@mK9ty`-er>tLUQ zfN&LQSxx&X&ghsd>LzYYU3G)ia`pQNug{0?nKRfrUpoH?;I%2t!*-zO^r*^!_~?gf z2drOSf~06y(HmyzAfcS129S$11=$S4|NooGe+NLDJZXQFtzgkFm3(QrIkvm*Pas3x zeh27=c_iVX(K||;#WVwn?GS0c0p*u^WBN2BT!I552Il7Q-~E_{WyP+f#D+Yw@-0n( z%kyC?xJV46`pt+U-$qcQ8QJnB2WG_PNe$W}0c>>J<_3d&LOj>G5%_b9h!@;c=Q%iK zyAIY01s3tYSn3!Isf7FPMwdAqtVg2rLp+W#OZstzIC!4pL3sW$F5D}?47$>>+e2{G zi_5*HFa$15GYML2TWBeyXI?&lJ{6n=$r3gJj2Q?>!tD$w!l&PPG6(ZiSh;r5?=b2) zicRXcgesEk4hg1fr<{TkZq**LMv^sPA&Shy!ex#X%$2#8DoPqoz1#^|&d*FJ4maVD zoDm+`<{X)#A158O0ZcrJ-wwNBk1Z1ci$xOVoM|L{vt&n+h1STm{TUX88Pl|6S9)=p zY=IWh(kD3ECXuT@%6{2aMR`=t4rq7tpc2d&jKH;tF3(akCv$qW#c0;8iwwft@ZL?l zlSS)T2VLxkbpbSc*h(M-+-0oJIBxH%=_7 zxsXV_ORGm}CN^+lFS||1XxBXV>eMTb(28`U*aSLG*|hLAo-R`b|8zM! zbB&gLt2DV-er6s|f2o2$-Z9nsO}+zYaA-rug%pu;>U;o0zqZ^-2)5pK5}0e1cN?OXtm2;irewJIRxJa3)p)hZBFk%&N-@AJ#n~pUlyMD|8(g_oe zYr-B*GboBDlP*0VkB;lG241x&$i=kQ*0f|b3Kta8Z4{Bb0$XiRhLQ}EU0V;xm*Y>~ zU7CDJo%BcB-1h9cmY1c3oRq_#6!t&)>&Cf!qoQ|S_eq-ieB2a+6&o4QZ!X=GV5=CKTaH65O7bJ^* z8x%QS=tW)-E>C!H4)J3ie^Tem9?{)GPg0N}Emh?P?9v5qZjFc47TFOO6~wlyg!YvZ>b|JiP--z5Ycr@qIoZR1nqsI6CN_OR+;VL z5Q{zx`T4Ygc?o~5YU&v7AQ7o*)c$B|MVHb2LX%-LwF8d_?j*Ula|W8#iWFLj4c;cT z8O2ZSwyH8S|94T%zk}=lm!RmhzRVJJkR-4t3iv$SZvo1HT<~~zhO_efOF90bAU$E_ zzC1c34gTxrcOY;zNTrp7b@j-DQ5(G5ba(r6O#n(|^$}5zT0J z`>oAXNLGmGBiR_7tk5Mc!vaetgNwE{ewQVumGW4vKu|BGsF{ zVGPJN;NslI*M;L0W{-5x;Knf!Dq*g)dM|1X+ zw7m?*;&yJ{cUliLZHPZ1oRT!0;=18>5`T{rqMF!F5J;Xx=$)C)k29^M_fBcUKlzVl zt$76dSQR?ef6Zw<_ItH!*rR`F#jFY^JoC^-%n_zzvwI`A@4jgH^%DI>Rgrj+XxB>p zAO=d(FXE^$dTR8rMEFgK&A|2hGe{O~uh`F>lL2xrdHaNuxUhu5i*aYl@h^j~4y8D6 zaVVj|P=&WF@eI(xAh%80E4*}Md@4eBIs&G1GeB;$I+k^vPTth{|4TUhzY&~&5sXJh zV6O;2`f$b2s@#&Lp6!{gUHe}XF#kO(6P-*fbwY&|0{NKZzw;$PW`$V*js1PpA+XRq zF@a~FQD;TnS`ocCG2Vu2`W+H)rfk5_uJX;qPIxVTyPm3_ya$QW7#?1_{v?g~;v-`- zb1P46iH$U7Ym|^0YQo5V$jvgUz4%C(-616q`|$~nw0_t*yIk&w*CL-s%hcls*! zQ>eUo;zoST03}6KQ7m!GIVH%Sa=Wj04;*)?*~zG~P!cZD$Pd}(25yUA+dn^hkpG5n zuTbMH4`h@hPJxuQv_6y0n%bfYal~1uaq_Mamqtu;1AfJ`u^}hK^m7{diY$9~pOOvl z#wk!*vc;|&mLiGS!e1Q{Ri8jI(WUJYG9g6`Su{OR;2Kw7sT(&;Ba6)lcdymO3e_UNWt2TrwmX-pf8CoV@ieH}>F74Un@Y>gG!^)t`o!lfhiP zKRwWpUM;`Hi*A?Eu;_?2%5hHe9C=Mrv7s$HwXZR<6}L7^xdqsI@o#I{7#&Ng{#bY( zI|*&$LeJZf52g@XTsJc{2U3We85?L4{@P|XO}_)8x0%K{sI?FMJE0x81{|B1W6J;9 z`u8k)7=S#(Vh7L*`!@%k;Qz&dp&fQoTJaZbyRAU`tKL$k?fM@~xkQDF!}3sN&}IXA z=;_v+*X#waf&J*^-r4o-+}B%1Gazi4oli34=^6Nw%#9CJL02@(aogEN!8$5+WY8I~ zs2vdGi>z4t-b9Iaf)lRb)xaFHW1v7;#v1|OdUS`pM>zi`#lGlJp)P`RRYl-qQ=+R5 z=r0AY18a?aR?Nc%V7Xu0`Kw6M?=BUS-7SB(iM|wlmB=3y7@Cx5#;%(SRs~E|5K$;& z7)&~RNkmvjlg0Cgsxl_4H`?9GQ@FXbrzEsF>$Yj(D#VqSi!ZRDuK*}C?@o>RwxbGe;fG#piZy6An0!{uiY5OiQc^kxcZJi4B9F;%OS5?FD z$b0|_{Ix*i>WIxu+{jM1=trB}>xRG@0ca0N0S0eeSspz$W5b?tYDjXUKQRY?_S8T8^E zoBe$hi!oj8-#&s#{r2_{McR%&)ioz=6VaWA!rXM3|o$&b(1?IM{ z#|+(t$jS+oo=LgMT*tI7!_xRnfWF>b`>G6Y`y*v4FIX+qy*DDAMT`bRG?fiv_$8wJ zV~Pg3Csv!BPb>Gl8X)xBy7DeFR;Tk&{5+k&g&-UiyJW;6$u#D zRRehMts@j6I^jnjtBqN&(B0rNO!G`_&^3p3`1`nXy;f~T5oAkq&7+h{t4=TCVN;bot z4#(X2K`$#k*LVR02Kqt42hOaLThLt`Z+9)@W zgB{?y@%kj}TTd`q6=TnqzEq>G8M~T_v17a9Jj@xnxOos59NdmCAZx6| zwzdu>`0?T9gY|cC&?4xk*gW=!;ptfypD;%z*t8*bf_HJ%AjTKrf;1;0aEO>fn5AiS z44TpxDL=%RUMp~JB?kd*5-jJ|rn$YJ#TY$ppMnjFq<#im!SUSu*trtJS(gij4NS_bV?dzg+;k!9Nh7k zY(^{xOZ4@-hMl$Iww1$!OxZIPjUU$A`n4OwvU~bvnI!&MaLoWYN2BYNCiu1Ehq?p} zg1>=haD(y;Cj@2X1%tO%KJ|yb2%}szR-GBLl>hN1;;ESvR5urlI8+0!U6>`=nksa# z=8Jr#Tg^={y(w)0UM}rn<_MUn4>kK?AaALR;ooG^b=hmBH2ffUWyKWw*_R%mfNjG$ z1~jM8$`NFm4Eq5IE|Axy56aPp+ttpQ#~`6I+Ps&8nMyXa##wRoKe}62@{2`dw+}W| zAI=qLGnVx_RAya3>C=(5Nn?G)n)h(Q#7Rp=zk?f7_cbRk7RIATKoZ*jd^Glj$aM}M zjiZ91eS%Ra_!%V5T&JB5OAe{;Pmp}fy{rwb^O-e3n=CR@;1@~Gyu3&?-YtS9wLvWt zh!?pDY30-DOrVCk!asYPFXty14PnQh;UrFZ+xD#EG#W6Z^5J&te3-&8iTshEJ+M^P zg>A^(cujzt69=0%XduGIPn<&LP+Y}?824sLTHN(qbEEJQ>_FRuat+@@pZ^ILdA$Y| zxgM8i6qKPfcj{3_h3TZ&NrS!Q)G--)$Wh_h2mLPR&(@x*K6;|r>5{TdM#EgsG51aE ziL&{}r`Z4NCso-UWd_H^a^}AVJTM5K7&8HmY0dy{MWaiYBnu3b1$gwi(}B%3f{E7K z(Z&iL)9_gYX%)P3jG-|=lihe}Y9Q)C=}v-WM~_hSTw&fkEq|5|GJC`E4}I4S62 zZUagGM%>B+ShWeJR$vzY>qg8tX>Ie+=Smy=tDt<4RSy4T1~I$K&)2tN&skx>=CEhL z(^s@q;Of|8-eVoQm6Nd6YL%uVbKfl6yp~}GqgMHP+YaC9!G*p%oAC~pY}9h>`)p0T zz}6qN-yTEBf}gTIlX;#4|G;r;aWwzpgf}baRbY&Hb&fkSTFcvXFwgCLfelweh7p~r zGUWQR{H@PgmpyR`vevTRo`F?z{x)(T;9yL_yLDVzi@dVhEGxz=OD3HIUQ~GCm`&5B z*YWD2&)p;DYH)y^NzX!Kh-4NroC{nv1J-vU=c8UVvAkW&!$aJiF+L zky%cjxsF%P@az?jym>Gzw_9{KVk6|woR00+uzrKz!p8gC(tz7gwbZ%!Am+WEtYW=fZ$Qc_ z{3Db@BsN8Tjt&fXru1Yf+2D+Tfl){Vz^1D7|BqAWk2L{Dj7R!wg9p>If%+(QvkZCb z1n{WEJYfCKg$z~s(w5t+3tq`EsuBaVTRMEA#Ss1Dzvv4!T9Gw?5u>f<{?@UDML^?kUdyOI)g+6I0wm4-A6oVaAVnGs0(N9w zUbSh{hmGkXZ%dGwY*52Q z{*%Wm2KjT+P~!Q(DBZR?&88eW<-r)jwa)NbqbF|R=}PGWxKQOp`8GSw1&(uepy~Kk zUk;^ggJ5>(kin>vk8Qvj&dEaxs)cM5r<`wI`V4bP#Z8RJ14LFB+T}QzI=(YBe5wl2 z7IAcNAAqK@Ikr`ArLFUD;s?fE4zDUjzHaDo2y0!N{@6SL5%2x1Fq#i@$=z>)VFITk z36;zX;Rcu-C96nfrh^|Co0!Z$tCJCMa@!8rwJXoyra^=4&zfl2z;#!XfXgI&;MF3c$ZM* z_#vvqK{+x0ic4lg8=MI22vg;;*>vyCK#v&`{Or4KM*MSE)2MMnN43(}W9|-g2jul? zrKYovK_!t_hRsG!FEO?rvB}T~mg?CT0e&Z8vMSXwvvEiCWx~7NHoM*qRiV5O_eevB z#0=clo7D+>01 zn>sMhAYlvuO*UIcc>+yY?Z`O!y0y(_33n%HN_Ruym41Fz>Spcv``a7wz<)c4H+D5r z=n_JH+I-ZlOz&3U2*R#YO*Xt=OFtS9bAjv;MYjFt2A|h?O1?ZN-{@10CO9l~oDJYY zzO<&V9Qn5O@;e7b=qBFW`sA}N{?SJ6cfk=Tp3;ij-0VLmsWEb+OXTK7(goo6o5-7*{J64`v_8nzt*Y zic@-OR#Kq-P45$snLljHdHLE!987kd4@2_~oMg^>h$A1vcH%9RWA-_xvbC z9}c6BM!xd*O;_k0$Rj(Ig5n%R0spq-aWS}6aQz^|Um>8qxYD2UrgZT4jy?7MQ*_%s z(_B{EDR{tM`#p8FCa@SdIFkQ;=59y2=&DN^w@YFh6lE8-Z1vV=j#0Xi!A3>wbQ(90 z@_Ke9KH8U6KMT_q!6(;78fS9PSBD&sS)w(tqf$ZwXJhi#LP71E-V^86=byN1NW zbglvcN1a__gzkGqOlerlOxSKqMo(Jgq5=aVi&(kK$A{9>!!qb5J06f69^Xtm}y?taUm*7hdUfFp`I)p;KaCgcFdR4w`I_u(^Ksuv5|>Jwx~!JvdxjL9g&t!e~sD8wLB#M)%xcfiY+_f(e^Tur-~Tb~%ymo({j5nh|0W#G?gx&w>isS_muO+QAq(wr;LF;!zc1 z(>Bi^ZL3Ky3?>}E(Z5XuSb4}nsHhDvee75ug{8nxKRylaip++MSU%;Gk;h8Qj+pP zzdFr@j|>%GK?a7D+6}uRqKgqGV$h}MP=BOh4zD4oow$)sW?Tx6N(%xz`LuU07r{U1 z>tMn{Kgy>cfR|t~vHdIMZNvI(OaF7+&#Na!xHmm4Ao?a6xZU0(nW>L{AY$P`0Nn7sCaZ?})^Jkn z-n%x4k%567$L@y9vuF%r4qgeLD|1JDCu|5CfLklu6qe&`438PqxVBo%8+7kuYK{j@ z&8&ZsxOQWY6Tdt^cGR>!?W>i`HaGLcY->TJ+$6|&-tLn%_vyhU=e*`4R)WiqX?EM8 z?uM%+>4Re%Rb{&M=DDQ7#-~b3he*03rRkwnmHx_I zrOH#8G)0`*ZxDVo^)RVd;#~WK$&cAWvGe!LAAG3J-%pk$_BbdSXhddDK(r*zNFRx8Xv) zLf*$}qnT&Wl7(tkMG>P0|zt1DmpO$Sn{|A?2-b1JM#5oiOBku-^AL-e2F> z@y#zdSRNkk`?~JyJkM)Umk)(@+u!%y^~Z!;#uOj-`U`IKbVf%e*NW?rPRy11WMIcv zA-L;;Alewxa~!qcDjbPioNcFfVA^AM*Ww5KhoABjlXBkWdXWnc-Y{5)%;#Bm${LG& zeqs|Fp>rSydKc37sfU2_lwL?%*&EtS)WX)GQgifh1X5Wc?B?SZc0~s*Q4^Ve1Y(vw zNf}nu$Y1c(8QjV92YIxr7-dGH%G$reRFpr{c^}tBY>pbSeqtYWXQ&1FqN|J@{5T}~ zQg114o`H}2vLZSDM53~+U};s>TOhgcgrftiBmaUTl8kzm3#s4eH@;K!*9=t!xRAU= z?rs~G$TL*VEPmb&%D@h(c^{iP+2e_BMCD7ru;UGfQ5T#CRs0rbp$&ac{6=knJPXkV zUmoKhLEJxpDeej}s12fZAys`!g)uu6;=(OIz3XlE(+RB=Bx`R`9> zQD+7P=q^a9$3xG&PU~|ApFd;vfoPq9ojj_EQNttg;ln=82iqvhnQryLBTc0lp3Z&j z46cmHzOb`|cJnRpl=n6uqI%rie=15W4o&I~e0wFBHkE`V?`0KiVHy90D>4^|&i1lH zWSC0$P*__TDA+h8Y*#>|aPs7G*8txsSK( zs)bo4_A5U&%c#t{ENl+IXSUHqcD9S2TdI4eK3)&Tzpct5;Lhje@1ej?Pj95CO`vhJ zi<-#sLo!wA8z6y<-$+agV&mDDJcIpGz(7ttH-|qCxfTahDs6fONAF}zmLkV?N|iId zZ8AAuZGgs7a0B{YHxc^xG0Q5ch_jfG6>>h@*4AMSFik(^NV_@`hqyY^A)sQ7NvpQ- zDNTY%lhC<9!W$xN&KFe<#j;pW}4emwKG5kSO#d?0@wg zZE3kYh^zn2trhwlK?~m4tckJL@9*nuoZ`K&+Q4vXm)c-qi*|xn2Sh*n9v5O#%$h~q z{zC+g0Cwb+9oyC;2`u(~d}0Zwms-j`g^fP*00z(srwE7=P+Uqree(tT?&M#yfSlyE z)gP+wQmhhppLm}|_Nu+#WEE6l=3j=Ji>_d@wPPaa@KkE?=q9odivI@UwclCsr9uRf z*e16FC!+A4x1_ZoDM)70_dnb)LO!2)*Y#5E9Z5yXqMSsmk>yF!=B5Dpd?32%qCKFy z2I#4#9=`SmJ_*=Z!8X?4>xo_D22ulS2Bv&QXYJ<{Y5{B)I8LMHZoXh<>|v*OJs7~2 z#_Y%o!z|33;X+Du51}tpyPzja39EMxQ|FggsBdxWLXG6SA?iRbBnS3c_>(iCxJ$mB z@u478+CP}fG#pS2bvDG&Q>P#FM~tKE%s_~EwfX9uD%~AEI_@5JDox(JL6YTx1+DJ8 z-Y&XMWnW2x3ZqfZ26;GhMp!?Vewa`k(@-X<=np*k)baFH8mM+RAeBxG@Jg=LMO!!8 zU!g+X@+SmrIN{K)!%fkaz5vb}GSAh}t@;pF)8hl)&ZsHlgTv+1A+5ZoC~2$;sb2Rt zs_E2H$J?9aoZW;<+(SX)g=o|(I4y9MKG?4Z_0@kGt>*(Io{VM{L<%NjUO;$RJ3leE zx>6)Nw`vgF4b?HJy+kP`xgJZ?EH+6*(og8h*kmn`eO(^0HXAPOJG=a+{r3R+w?!~19 z{*Kt7HhX~!C}Hi>@;d*Bot!m}_71LKy^qm^=D0n78wV5l;pOBroLbeG(2H}V@_f$D zYCj$Dt^OwKDYSvl4JW?Jxu-tC^;r0+FDrNHm3hsDPUG_qxqjz@Ll%TeD(!`~0EGT0 zJq>s6!#zo?(#m;;{W`>^+lLNXKq5-o@(R|2Oa6MGXUcE|lrT98n)|S`flFfFpv72l@r;8Anl$&j}iwNM);8l9{ zLDH$i4-oE+SW>y-lJQ-jmMmre8EFi*2tz=L;}*64)4a8p-mI!L#g4~zPehU85efHU z3)aOF4E3&=%mI>=CM8?fx}aWttZBZ2?rt8FaNM zGx~2)2P7J^4r75 z)l5n@>A1Rjo*pDrmbdy?7N!v@ZJXRg+szyIGm7xo-hZLxd*pl!+F*L-ut)XtgzzL+ zk8+ITFa@-+sPWw(QH+UMW}leH)EpYy?sQ}N@;&Z~3w)mV9BE&`46H=l>JkXLv2@eZ zUt%_Y=36X&@YRK|f1GOO|4b)PoE#M3LVud`w9~T~FFfdP!QchkebJsy)W%~d(-GAV zAe8^xM>`&H1mJw4Rd-(1ew_GOEAx#=t3U?84F2}~AH-Ep&ZB_;V580vP>h6V)qbpL z)EzK(g4#z?l|%~G+(T%=EG8BmSKhMUXdlTr*vF-u7rbkWNpQWc+zIid+V~9E7fS-V z6Gl8A!?1k27Ip|76wabJsV$)Vw$5>>lIZxXzE!CV;%|f{gDo|Zim;6)b4FTM zOSxs4+*%*#apy2^SxpADcroAe$V+&eoXkKQija>lcoa(M0Islu)>+Azk=lN{-V=f3 zHZh^Jgx`E~D9^z=N0z#bCi^NxhD4|!t|z0ty|VIlx0c?mYBTi@#d#!L1qAfrd4t^+ z(n~p#`rRRTkG?&1B79It3aLyM{_O~Qz`1_{l2eX2tXES)Hk{>oKc-rP8+bn?^W$g3 zzgOParRjOOSlv!jwfBCc&w`(C8(5)9PE?P4cEC%DXABR7D}4q+F^|@<+EuGY%N^tT zQ-064j%l>EbcG%I>s7>Kotbyp$y>Z@gcDvwSLYWA6|~_#eZ&Jpz;_-?J<1&&TWC z+K%q46UBb|*pogJc}DeS)$Nt^R0n^b)ZQA&up!5f9KyAh>E|6hMUhh#F~%Qy9Nu<) zllVJK36;TwPZBH0u=;maH?6#-4);=5?=ll6oTqb$~a{GGpYY>R7KwsqB&1QW@Mlipk zZh-Z#V(11oPL28d*d5P?em3?}y?B?+kM2i2*Gx|WHNgYskQ<_w33APTb_OVRKnY+Tj8G&BE^X)rSb);C>tsP!mZ zF8qL=Tq&!Vu5Cy+yvC$m+y&nK$kz@6%#^WMZ=POerqBrb!WYFAwZ&ww-xQS_Fk}Hm zZ5DaV?J6;*IQW}j_^tG?dvh$()qVppIncFF$kBm8vBc|XZ%4CCp=IFzEWVlaE9$;U z(bmmL?GqG&XB?qCOS;RIIr9(L^lCvnp5Yhz4`ngm|N=6V)yiD2jL}LRI6LC@tIB z@>o}zp;ulNyW{hc>~??oRk_QDm1QRWR5we%l3)aU$4_C77WS!rns}s=<0HiPPe$e` zfgYT8PvV)!IevRgwk6LccosV4I`gucZycHX-0b*9&U{3vQAifN_d&j(`1heGNQz_q zF})Y&t+ri8v@Ih0=!VHHE>*k~;d$}n>i$1{Q8!FZDQWN^tmX~UqYxt+)qG9Yzk%aU zzOw-Do4Hk^BsL*y@=Ka8pz2L2#e>^7B^9}VOK<4};jC@Ny5_>{H`7yJl(}v_r8Orj zrcHMC29jeVbT&U6x1rC_4b)?dXN@MPgxg+I#~=PW%OrSy-`^yE&jW&8aA7s4&DXYO z?E(fb?iYtWbf*q^w#`~0&j-A6fr4VJX-0*EOa}a|fYA6jyNGxNB1!m9yb$ig5mfrq zW-Id)V||UH?GP|e{>;Xm0_yn#3DT}l+A_}s7TDO9aJ%#|zQ=!bA80f!d%^qK$NbWd zqT;~uf%a8hts$DPO~{!K;~MyZ@l6BTUgi%D7pNB;7;~Y1dQ~octAm{%ktaa;|D_$l z3dxV*IlTw&v3I+s35!ft8Um)W3eFl)n}R7<+9;gmCmYNnlY-pntk<~0Vk6mKwlN%f zVK;5MWOpF`xb$43lPGg0eNau)08MP7Qzp1)b=>yP`P}xYwXNDRm-Ew0r4qD9`9%J) zZ7ylvQ?mnkXF4_Nl!iE@E;`TH%7U_7+O0ahB`L5H)LxDtE5LfM8L_xvsMJwsL8}>* z3i%s~dz#v*Fgc)ay1)n1XJP>T8B^O8Za@{wN@Lw=sS9giVhAg}pS+!--W%X7oK}l9 z>X%zeUe}p|ISTl``g9k^p5Xsltxc(iHO-6TIBQH5+sw)HK^|uo=tIkbea??!8DH84 zawn;>AU>XPg$6x(pZJBD!3g(u)H$qotDsF%>d4VukW_H44C&^Xc6V}+kg7~=@iMT; zsY;tXD#hzP;bNpU2TU0o3knAb%=%S-@<43b9+bI0&pye&1 zD26tJ&O{-q-(A2V&Z=szmrO?0v4#;!+j@EQ zJ=j^k*u)JR!pCy#lmlJkRS{!7?uadfr@)BT5iGx(Mf9djDnW8`qW<9j#tt zL|C{HW`aIYOO;6V2tS*w7d}wpTkKtGv$S?SLIvHTbA4ZOU_kHUo z>qt>oe&B_iC#KqSoabZx-8W|)is?!r!lS6%FJNw68wB_N_nW|APgs(R&cEH(qxKbw ktoJP*C_^C-jd8=R#T)8U;+BJR&gVdnpEy>1B=qY40L2D^J^%m! literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/suppression-rules.png b/windows/keep-secure/images/suppression-rules.png new file mode 100644 index 0000000000000000000000000000000000000000..cd78d0a8600d93db15b4078cbab984abdbd3998c GIT binary patch literal 13041 zcmZXb1x#FRw6zC!8Qh8w?hIah(BfJs4#nMzyIYYDFRsPio#MqQ*5XBqOL4fT$^R!e zxg;br0Wve^ynFApp1p`xQ<1|$CqoB;Kv)X$Fbxn0ju3d9iV6=rlEEcA0-nIRX~;=| zYQ9q(0#6XFB$XvWp!!6NCsQQgIhwP)o*M{+J^1e%Zp5kF0tDiTP=HBlc^jSN9{Or8 z-i*{2iZApQ_^;~!Q7gqApm(F5lFuBR2Qsed&yolZU;Y^$;qmDral^c3FJ(u)+Pnv)Hva9aC9qZm-C%Os! zQ`5;&d_<;ucE~7xuOM&u?dFFul?HaD8q}l@G_Dr(EfV`p$lb>4i`V&P|JqbYe~;HfH8eH;cM-4*E@k9!IIDTuuyFj zk+F6Juhn-yvDn4Zag+Bi2f{J% z@N0NVe|7sZGB9A1@`O1KNfJX8iP_$Rf`3g;DuL(L>di;gi)1Cu5eGzl|AwLI=Tu`d zs(#V(U@t6q)|&bX@+C(v*)-^ zUUy8L%TNTEPL_+5BLa(D=aX147rz}&+U<}{EYg}`qvS#hh5;#_K^S*Ya>L~pl^nqW z+ux>l=UcsxKhN@;snsp5tZMZdEl=0mtzmB-N1JTs%Lh`w=ZZ)>Gvvoyo_3zKh*n)T zKiysIRMyBCd{kwJ(asH6Fy;s@hqsq7F4bh?m!#=$?_Kix6 z!nHT9{rt*WSoviX=IJh+--!K2c$o}L&a&~-&RwvY0k~4?`P-HRNGoKE0 z_=tS2gY##rf;D|qQMgDib`UVecCLxC3VHHtZ zT*B%NxLUutkib|?l{$tB$(FQT#giYik)%g3-2>Usj{ekY1~e8x8z9;L%A&jUu1uY~d1@g%wSZD4gudoS?{%{EXq8A7buHdfnmi zrzty&9xw>X-j}|Jb)LC_^ zmYZzw(~}E`?i1dK9O30V&lM}+mRemO%%RNLfwTYp`8F$AAc_0s@7uR;&EUKy)LWN2!XrNI z#0zK~Ig%!vZnfv~_wX%<@?&YUmeMGSOC&meXP!lX{prQ%YdUP8wQle_`!yJeqf3i$ z`&o_>xW@4udZn;BgSskHEY=K;LutEF-?MJHu^72%m(&J@W=CcdDzgU$6!hwt{%lF$ zFZZ1hgWb;Flj3_+QKq4xLBF|uFk3`xF4!ChTl@#F$MH%lL`_NR3n z2*h6QcD#OlvI1V_;dVZ;4{8o4r_^DES)LM&i{~6%j2b3``d-zhnZrQgAls=Y(7wZ&BlHKXMyj+0EyPM*d!kJ-bzV2s7BA8mPj}Lyh~4X z==Jr$)^jM~HSl@CHCyRVN7SX6)OT~c zG6sh_y_P$s(prrkf0kx1hBrI?w?RK(deZDlKX~}+xs@_`kS2U?j+$*3SzJ6%*A;9k zK~um7iOs02V)u1aQNgy%2*7>xhM_Kr{#DKqya0y82>i2n+M`akE0~NPaWLcUrv^db zoJPqb-uC8-c>R|q@oLJ4wN9|Vzc1|^YCq__5B+xGoYBX?tWgZ1r#BHUbyiVORz6v2 zEc=#|no3`^*6O6XQu2;C445pjN@u^inK=#GBnGdquXlGX5P`CgjSi9_@Z7=ofSX!| z%BRd8qw?M9I@{PB_J^VjdS1k2J=E6FU`k zus&22suAzRxxD3>T=P862)k@HxfB0eHytB!z< z*_TC~H~R{tBWbxD*V}C7OPg)xk?TKQ{q{KfCCbVgdr`O5Kv&PFy|Jb}Sc{SdhqD>~ zF!{(@VEK4BTO{}IZIRvWUmwoLZ+796eZYbiJw;Ou2~s*r*^>u5Poo=zMCg;7Q6!#f zfJ*Zpcu zYdRG*&5iQ@SA6bNnsDNanDgEk%I4Uw0nyi$Gq0`WD_&OQ;I7E+H@~DW5>~I1#GX2~ zBFJlcUmm8#UvorSlarIz96PZ}#k|v@A9U{ejX)P$Gvjw0rg;^I($-_-`bIBC;TU7b zD~%(S>n$uFt%^^1fYTA(l|d3cH9S0ADeQMwhkCjR3*zj3N_IV2ZSFvX%C%z>_0z~{ z=A@^~jWw0WBy(^Xk$daukt(SK%;aP-VQG6uF=*W6y*@?OBvOfUh}p`ZCP#bApq5eQpw7w;LXgL9CGsajip&A3jV`6&q`kGGYHBi|Jq>JIr}XD&$H(i6eFw!~u+i zhzw*E1=f$4^$=_bZ_uaGvckyJq5~SoQQreO%1?;eu%o<}Yeup;b!rl+bTCeIa`nTP zuS;-(4?OYKlIcM@pzd#Bo}Izd1k0Lw63PY;b+r$OP&*DSLMBwc8C^AexHsxq%@P#- ztF#gy_{uOis#$1n&D+eu1(b$sYBFgAvIQ{|@J(hF5;U5IhhAer!p-6RMgOTcM^+-7 z6?Dj$U*d}Lv09TZ@RyQCVa*X;xZi;ls<#b5sMzZE_EYE-w1V2<#6OU~Uwo!hIOm+z z|CY&X#ng_$%+8MGdlg0Ku}9O+_#)mO7r2lX+4h5#nc1cHE8&gJXR$&PNnB$mMw$vb zk95=YQ$|wTau)wP8Z7mJsFhZVpEcn5l52V7gp7qb12Qc#7TZt>BOe2Xl8jUhcuk66 z9ngRwPHhwaQbA-)Y^>1Pgc*6?YO|fp^~qX#a%Wd@F@44x5ld!ZN&kGH$HZ{4@0N# z?Wy&W2v!gQ-esfZloYZsFRvzIO?U={-#Z;gu9+L)^#)@>=ycg$t1R)T7>cs-pT?_! zS?{tik)~El+2OneUm_xJJy~LrX5O?N1=^p^v$Aa0>L`!70BPdMls9pIE$D}KO1$@L zkfi8O1= z?-rD&gvi;KpZSj#m7Y_^ctL|An_`!Unr!|^fEy}51DS1D7|n(p@bK z)t3Uq^@l^Qf7Pe>^Ayll2+!-88jCfColyqPO%R@$Z_oIQCO@;{sKmcazLS^VRGKzq z7x>WWc>>JuUvpoLM2oXUEQ1eCLh=J2*EV=u*7;pGzNDv*tUD~%NuJ$i345^Y{cBxC zb1F{Ah>4W}1rq1p!ie2|PZq!!e~|&jt@JEV0CWc!@|4%{GMwAN zOaXfSouoky!8y^@fD(8iTfixyRmk@JPXly?_pLz%Jmr{nLJ$NO3AzU_iRyeK(IJN!z-iHBTmW9l zEpYs~Xua=^>i+lK_CPi!rl9DcQ~fsMEe4yhWQfCB%ihcHm&db2CR-KjI_(65ty2_L zCiC+YNaUO5inLeEDfVCq=~L;`;~hr!kC!n&F%QkhFE3ruJxGw zu}Lg(P0%c=qEf;5v@rL@qo#b6vg|)(g@M`7g+6~3{VY=r9lwCp)gwH4G*~KJO>U)B zgZ5XQ?KRC!t^RsB!Xlp`6YX}tU3J!}zEvG`(j77iBq$>z2_q2`l%<$Wsa1%%tmmmaU`ROS8{=lv9T6dBAvs4X6 z0_v*_iWW!0Z%<-ICmTod*4tS{v$-f%K!TFL2b_idI-Zo zFs|mu67P#);vdx?P%aLN5@}_5lJE>{Ga{&<62Li>WYcd#&4OF^Typ@XXRY?TTImSP ze_a&XbGX)eR;rv0mG4%JP@o^;;pHV|mmLhIKBfMS*ef<J!Ao`3>=m2XCV=0*4)KcD)7M9@7HG6CB}t_Sn&uMZ0A-HXa%e3FOax=I0qZo^G!*^N`+yLqyjJ3&Bkf5oy+DQMn!&)C#_BZ z$Qb5EhV63f$dP^VyHu#u+mJ5;Iv@eqjv-k0dPWTLr*x&;+SIH#Pl$dkvdP?5Q7x%7hSVikM=(qtUF>p>}f8x>3V-0_1yl@k$Y$>FLb1O7cYUvFL+}W#NjGPK)96r-~-|sfqZQ^j&NyzWV=N zvEoCo(EbF$6-KrDL~IcetA-Frg6xSq`cOg_%co^f!Anjl(fsv|8=qvk3^MEn3x!m1 zHZ?gtLr|jo!-pv;Emn|23R2a0#&%mB3o89j0Wod3Fm)uZ$v0rKs??w;`CJ5#%4D_$ zvvTPM1{T`geALj)kN@Abie}p)v77MuSr6hsf?`}x88i?N?3{(Fz9gYl z?%v;JcJPdc!brDvQ|RkkN8;Yip^YA(?pk=i#V4a*Wt>f`t>4U%#Y(GE&SKEZRP)3> zT^0*pMPYf|Xd9{N=;&x@-~oLd|7cva7`sQv^Z5O8qMTAW>ur)SAjV&06n;bryWmuW z`X*3`*X$ECsWw>It`Wf87V0$;>Dy+Q<*$b~{r!@Q*|n1+qqI=Cu&b*IHa)QlZG)j0 zM-$;=x>YeD3TDU%W$q3-)vTJcc*Guil-NjB_NUTo8F(7v5y}*Zp+8DkCyUqC$L5`J zzcL-di&ZD-eozh*gw_g9l*(NVmk9FvTZY~>AZ7#!R+g}Fa<(!!dRZoNe3gCEu@9JT zAF~fvOb2NkJhNC7UL57&b#M|SSR^eCFz2*+T!rVkjtX>JDQ9NvW?UbHXnFzrWr;Ol zF1d}t{yg*K141ZO3yYjz$uzjQ(m=lYml%Su#}Om1v*(VsNi&^XY+5j+Wo-BMnni&Vs*pA z!^_``&dJFc8iGB4m)q#^2dwDCf>IVV8c)GO4XGdi7{|&VPz9TgR-0Mp@9`4~U7XN%b8}NKO!qro zu9rTYWi`L)pw`xoc^IWc@Vq@JOy0K0XgQLT=?|F{G4c zaYXt~e@rp6tdS$Q5=@shN?N-IVB{srO!W%vFk8?R1G>znW%n1kl&?)K2c#mNRYa^g z%J^(yOMnJt8XFz$+wdkERD)NG;(`bK8V}FyFJDebUDZJP`*&*q7oe$4W~i)=^6|j2 zya7~YXg)VVpacOC(Qm-Pv*|VL&dO1RtCiAq*~~L=0GPE34U)p7Ai|+1N^Ng4SAoV? z%OukmhK3Ia97cv&>Rvp!`BLQ+j zkR%J+46~|88#m=ub&cT#+%7gBbcMx2-04}JuaGbZz8`b@)prrOIFexBW5XXod??{T z^6BqDDHGe#Du#3E{DeDPKeG((1HQ$PrZSnbB_je_s&okNO7wwLY%eZQCX&xECu~%FuT;Hx{|O4ev2cb#TUVu4g!-o zSalU~P#l?JFP~80OIMU)z1zM@7YW}a)52IU>_S;V0ZlG6=JcW*e6;&fn;y5dM7TZt z*?TCgWBdz1*B#$|4d@IW(N<^VWMuROz!c$)F+w7V+J+oLB3b|cl0*xwzU!Us`oWGY zKOg5S3$n+*h4^@=RzD(ZJ++rr1{c4y&oHTNtY|)S)ru_0q%MGu7DfO3s6AV4{sRn6 zJC~5_Y$B$ro}C*fjz_*AZ`tmSeL&K+mKeVZ6gLG@$3#647f>j$+HxX0wZ}cZ<54S| zgRE;$#Dnx*(3}gdHN`H5@GIl37QXrd{E{1JMYDEGRRs%ycQ>YmVk_Z;?q#K=JZS)y zUts&=)_#0!?~lprunK)X-2q_8O?{D=tk2WMNCBgAR%&+k*Sz`E2`Zn1f~O}x#OwPQ zF>i?P<>h6PL8m9X*~7YIFDt2dx$bRhdU^`n$y%$GaE9IQa<~2OlUV^_TH-e zeEDLtse0{cJD%nDoH2sfC6qpGzo6wRT;kK&C0hO77(%C5C21Ot^&P1MQ#AN(sMS!o z?>Yjv5sfcfW|q*=(Y%J5fq~!d=;u1B#0)iE@i=WA9ofHr;4bnhI?IKzZRDo5Pqzki zN495xaTfKvJAZk891M7CCbgcs{?_21ith5=Ci^Ao67S=Y*mFOvTrNhuiLLc&+Zfme z_n1hpga+LYqyp~gu^u*c`avLKp$lgEW?=um<%2FfVtUZKXVwC}XXyf?pXN9t2PxTq z`<A!NV#^@w%fwy9Ej<15QN6G!KtiU}DbAxn_1;hs- zG|~|yKh;ow?US$O=j~mbN7=padU(1xFXv`6@_+I6ULYZ=6$^a())q5XH&2|Bk}qQT z>ogTkBH7^f;(lVJT)gQ8+1Y&&Rqm40!r=($tZfIoRkB1Pw%hY1Fx}W56X1ywqT^pa zf2PT0|Ih+UdmiBa8NHN96vMm>;UNtCZ|0d$bRK!$LFSYBdC?Ms(vKR>BkH4C+51Kgz;UJM1Xv9VW|m+m&`i)x(OR*p0(d16>{@L5R!c;pX8L3_~_)@jX>k9 z8`hJ9=!f=8I0R%hauUK%Ct;QJ<{K=`Y;37;B_$IDcmnL!VU54^&9vjMuJ*1jie}VNWc@7z8I=+VP*lQhV%98v*a0wn&VZd$ z;QfR#d?soVD-)BT@89D=9C5bnUC>1}xC)%X5;6iVN z-BIDSp{6!L)KOC;HVBLBfg}}ce@oJhe1Ki&>)nWW0I)0VecI!MfXW{hYXgw3Y6GAD z0J>VC?_E2&E@5!okOX}orjjD?rKh)&>-CHIJ7D0R_tK4})?FvqQ-?mod4BnCR<;y;qU<|1Sq99FW*m!fxwEfQZ=;>H~z}z1*zCqNb|oFprS^GFPdD znD2HpW5$%p=w}kcE^lu5qmMh^;!*QqS29{-CiEKtj}Da$jg9TcfFrvGwy@x$qsdHO z{hPxFU}2@iVT-0`VY0e_(9zd9$K0d%T%}s_EcSTZsKu_=fJlZtb%-Q_M#ceWI)#oT z`GL&wXNR_5{uq5KX?~U_kJD=4Bp1QlPuAKl+AO?u{Ler;_*e-4S^gL=)ixwKY8s)e zt)!n;mKTJZpO&gAwF6!s*=8CXwKZUPPQ9LJGtr2}W5CC zhdbYZQN4xFg-EG9DNk3KBCa9DycPxRFb{%SP`Cc{B)9AZ z{hlt<`V*39j>Lk_G~@N@&+K=P=(V{DVh;y&cVu%PoVthW7SXYrH5{3knP+j|pQL_; zhsILr9KJ0=DC>z(Oe{#kFCqg|!`b8QlB>z|>Jup8MKQG5AmIwSY= zQ9~qe)0^P0QARN55-~FA{g5X$6pd)cvZ@8u5-DQb-M2J)aZ4k13Ewq{U>qUg(z5O1 zE;E$jSylaEkWe!2aF6B{78b{(7Q5U{#O58HxRCe{m8|*Z9U%o2D7f7DSX)!uI<~*M zN9njOPT~tmHZ(7=M*fuUus7+&!78uvt4or^yCf9WibMe%nY4@OObbG!rYmEVB>{`L z)S<4kA(es{)_=9&HKmB6HNmbm-<{w&==5Ru3dbsiNKN%)o%;fwhR6L8fiG8itLg=r z&O@li%J7@+eel%`S=?#)!uJSjW{5U}iY(YW9|ujrWg;!qwDBjSZ(lA(s2X48d%Fyn zakPO^&1QQ(^j01*m3e;kgER|W4hBoV3 zTq^cSqPdWzza6O)z-9R=U#pcE=gv(rk(x1Zzj@C(!8`^zWwNI(jh|W2`&<{%l7zRJ zBA!g&5=9bQ$9fa1z}6udE06yZN*=j6IzDceoM}YALJQ4P$2Lcz+2a0&X<0J#mbsn| zs+gqy!JTJtd$6Cf8KU9v&XgtzlthQQG@E8pvrr;D%<>zNtCb&-qqzc}!m4}cqu^1x z5-$E05(ZI5GljzP38A57GI(*Cihze#KiSCdLgp`(VvC-mcX=8f=5Noa`}?(xmlmsO zO2-svSUE`)yu(xk)n6)e$xURR)rOC;jxAgt$5WY)E5q1+4%S!TXgxb)g2si>)Ut{( z%%#eON(B3?HCc1XvRToNll4>51Ca8#3k=OSvwMTtxb+e1euLoH)T@=?2_Mrk1UG+Y zJC&xo&R4w~XCjwk0U1$0+jAHGmtYNF@Y{BRYwN=Y)EiWTy$r2-PA_-oAXZHp?A3+*#121;d+V8_Ra|NhRJg-X9x0t_zD`=@sS?9#fDi&L{B?-xJy zabDPQ8JJ0^RNDJ^{%Vm*eI7BDutfo%3^RRA|rB z*7CRSZa{Jc7||5M?o1Ssk#f@cv%9M2oS~z?H9cMq{;IUOA10q(aTv5w4^YB^)}Pc@ zTmPIe@EyrrLM&~;(rD>_5yNbPDtyQW zQZq7^t3R{?E#<3!&}TZifyj3ELyc^{Funq%Op(Ul?1-DNcI9TKU^S&SE?*`H+KlmR zdQDuWg|boruzY=3WVv6Y4-R7n*Od3#D&>iZ^6~L?wdMR8=)V0WVmV3D@n^PZShWWim!lM0_WRJ4%*E{UjqBi7J#dWfFy&SK|vhM|EN$~o3cSO2h}Jhk@`hDK^g66-dGA_ z(FT+n&3{_-_8@&?6ZgR)qyqsJhnzo7-w>W5(;JdnoleSYNlmwUvdRNX$JI|8H5KJ% zwpJXQL!tEEtRJBy7xQbo3z~^UD`*)T8-v33@2~bD61_mIA*mTaL3C3yI%;YXtJIug zzeO)c>2R4yxy^rCx1e8gZqarxykSiFU8b4CEHi^r|8#6@uvcSb>o%~upAq7`|v^eP0BpTr)B_-YSKU>d7p2f#^Gz2+_ zDrt;&O{-55=UHxXd>AkxPuHS4gKr3De@CHR z{~eq^hq)YhycB{!kHRH{!~Oigo!NI(J{3$Ed_6O6$QG*gjNR;M*IyC^1RUMmLb#z8 ziz6yhdHUamC5`Ris1-)Fd5j-OF+PxT4?(ma(DWH1Bg)bB{St%tMm7P-&io1&N##ku z(icTN6Y2m!PePRZ$T15n9!>6OOv&T~+@PWeP!_xHJ%V*?oFzitELQtdDIy2B6HwU- zDyeE8ZTgm1w5bKpnD1xB0XCG&JDZuDT$qbaoMIlQ!h;$4>!T8E_G8ALu1v}ll}zX` zB5#7OecGbwU~oW_(%-fE}=;S1HiL}&my40C!+HTY|lB!~=2$*8t!x_WE??OhHMB6)fBM>b#Gz?00>ys(c1eizE1{y;l@U zN)Nby?4o|~AF((-zu(yci)7iqEbo8Z5T5SVdUdNu4t}i9kFtxLLI8ZZz5J&IJmBZJ zu@9iNX9K;Qwvb6TaRXxY4-y5;#FBb{x}hJSdrt)mN96lkX1~Yu6~WCRv1oJWWAC0hcKE zv-Weg6EZeMx$!hZva72r9zK5alWHc<$A4_-?YRUHPWu<0G#x<9SdUDK1lo0bd%Fc4 zI*{XK`b6ZRC3?H==CImSzn@Ye!$3nr!_KZ8{FRYzv&msi$GB{x-dqk~O8NlK=iEMs zCU79w+uQSh{G0X#*bEG6eOJv91n2&XVu%n}T3C!?-q4cbng5>51hS1qodW{{|0um1 z%D+4(BQ?oR94Rl%%F4`$0Om~3VoG6n zges82Y$ysm)RYl(31ptzC&Ud?j(qxJt7cUDkuxdpzwlJV!WDDhU!4!)3@(@|sYWOi zD2D05Q~I4tHuisUhv(Pe0;WQDUl1${i0WP9LUy@gk)Z9$MlvwYL3bZm0rNi2XUQgJ zvG;KTj_dLi0H(D993P&EuDTXj6!8FG^(~ES>Qo% z)M9E8aT$XQA=EEbKV z&7|Jukp)jls%m1ipmjZ6PIPn!o2w4omtW%gy@aU^M45bE(gE4WqiEevUN~=E?V~VR zt%rf9TIdE`CkLg^@2}{R7*_)Y+gFI_2Rtb)o;Y@C0Hq7?+?(ksxviV^-{mZ!4A>&($uOdbe)E>)9v(<9*=F*^*|thH2AUS5pNH~p)9prm(^^>zcW ztN>B-kbF}p6AOeJ;0hLKuPY#`OI3PwDyF6d0e9S-oVA)|Do$M&$UOFfHa0eZ0byXh zMsT%#r=YaYP(ZD5lkEj}<2-Rh3CnijiZ{yDi`opD zZ3!cxVf}!@stBpr@RKzv2|${q+REYr-d`Qs!7#CBKq&r=I6}Yc;9snrAf^P=d1ja) zx-|xKVreXJ_K7ZpVKU)uA=z_<>rsmRSaFE!3wSg3+Ca1zpRg41Z5Cyg>kIA>(P@mU zVywMmB&<)}lLiyk>GkBinG#8Di;_|&X;%2tJeylIi$p&xaEDTVn6Mw{dKRg!%vFB@ kKXnH%?kK{Iz}MHl6~7mG3A-&8;fGAghdDU*=@0sktxEC2ui literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/timeline.png b/windows/keep-secure/images/timeline.png new file mode 100644 index 0000000000000000000000000000000000000000..1d3467c2f259755ea709d6703a07f77e4f0a9aaf GIT binary patch literal 42949 zcmeFZXH=7I*EWb)u%M`bpwd(j1u0Sm1S}{`dhbZ@y@#S=m!crOM5IXxy>~=GsnS9R zkxmE*AwdWs-;VeFyfbU&&-<>K`SGnaE@fSYlnZzVLpsC2<+Wg@6C$ozO zP%qf&X;e|?iYl!XzpYjpir1_hKd<~^Fm`X)NoCtb%1@*wuUX33Svz(h>Ty=HP z>ksK&_|gm5n1xTOzM(yN2G#kr>6}VYAm2haNq(ogs$e@t@tZ*W!c1~O-IS}hilZS@*U<)4Zm*Jv z&+5vCxUNuM4l8NCS+u{&oL21jx8MJMgyBD*{qI~1++$?;?RRq{pxz#Z!EKlMty?^6 znLgD$_%kLpcKI<48*?dX2#s!^S-*1fu>RUMDcJueo2aO0xIqKu`Bdq=57jwN9{x77 z{zZo+`pAnG^v>Vc&D};vM>i+df`@XAWPdm9-yo7MHB7zQkNPn@{OR-O&-;eXy5{EQ zwtA7L-Sm58$#pi}$vL8q=o_)v;bO}$j~HVEgM{|>_EyRBl>5DPPfSeQ+{N|em6T}8 z?yX01r4(wh-EcFP!&F{*I)dew$u9ZP&W>R(;$3 zl$!`fczb&Z%A_iqUvRZ2XuU{7RdpnrrcA+7~))w+)*k>ZaWqiIL1H1P89a4O>Qcy}BhXQE(lFw5mN!c1l3 z+PdE?Zu_)pblSW`?`)_|h>3|wz|K-ON`&3-=i{gJr+vJ=b1EuyGcz-F_mIImOBvQQ zl*tH9e2?Z9^<5p$=)mD{-m~A{of;!Q@;sWaUwo<1DnBGwxSwE0Gk8ClHoX5v#o+ zdkZ10&gTywD07*Rte$WQ!X-@&%zlq9cODay-WvC8|NdP=QSsF!)bg@JSF(iG)b6}^ zOmuX5M8pYiA0NrSm8B((d-tBL*5OnK2L={Vm6Lt3d`57ynzGjAt<6n4{PG|VKfjL? zd-#2Po*Aj#un>h(VPs^4{qLJ1O-x2jrY#7USlqoa;)80g>!CU;Sh`z|Hf?h&eyMBYZg)w1AToT!9*0h ztLgbUdvbRBWl7PLEo^UBg3&HBHU4?#joQHBxbQRw8t^FBtLMUVtE%)XCw!7712BA| z;^LTZ?=I!$<(=!<4q=QabqVn)YZ*R2Eg9-;jDU$ zR8+#t_e^{zG8^|WjcCsv>FkXS56o`d`}d1*o_}Bp8&`+-?rbEtcP0qqNoyff0V%Lq z-WYUFX6DzUN9#8GlqF#xVlLyKo;;yeBrW)~hMmnVDA3i?ioSIC0L6sfZftC9qK#a+ zPyz?3_f5FBv0kbmzi*)lW8~GnaxPr*viRWx)UWTSQ`S4mMNeO!Sv;KtM@PhS{sC-Y zYd}w@!S7J^UGt{8D&vAG5!YI*n4%^EfiN6vOLZzG^`^_i@?X7^_O@YXu&`CpR zIh2NGe8?OOtpC)lcroWho32DI#TxP+krguuBZ#o;Q<#?^oJ+#lu6-`?Tu`M9OZQfj z;81RQx}^e<5&<458-SsnV3$dD6KXCf;MdX9bDV3Bfx+)X991C2AmTbQ(P-VgsG;HE z_@XDQyeud3GBfYVN3irJ2-|x7`TY>~xgG0cgpo_vfRPBJbXUg5$Gu8!W?)r5Ts#-9 z6h$#e%AsH?Yi$13-K|>V^ubd&%3rL0pT)?2DR4-=b|Nlpe-Gj<5AXuZSnObh^O)Dq zrhOAWW6ogmunx68tK&JYfivgb!wXxkqCPz0L>X6Wf~9~}pw$?4b#=4GTRZ80dQ?-q zl*7jCceMVteh$wU%ekbf-7FXIc~3iB8n)*(x>W*Ng?e)4)!eF$FV(nGHm_>9ti0SF z4obl8dYg{A`iHEn%idmIi(n2l^NEfucU$C@MsGhZDG`z;@8TSsontt`pDq>Dt}0cl zl=xFygi=RytD(=k)}<8`6r7U%=>_iBfSfJG-lTsXbJNz^Iww1O;iH5Z{M!)Kp0f6_+TqBI>2J7aRk&^`eCv5v&Ru(X%I%x{Ur|$Aa$!@cHOW@K;3Hu< zbu=`3A7N^Z`7znJPPKt&cP>zDrq~n$$_bVmAK>iYOVp175ZMEEO$X-PpvWBvH#&+LW9A9^Yh-+%WWS zI61XPsKoDJ3iCdGq_~(wVcUoR1j2h`RpK{+vx9*Cw=Q}=O%Qd4f^?p~ZR z8{IQPIoS?&c0VZI(7NLc#b7CWQXWj&sq)Ut%@wijW`Qu%m3YNdW@X(6_ofvTRG+cOzkyrmQRC&fh-VM+_AVDK{H#E8@cE^lyQ0pcBF^Jg8sXvL z4lXWecnqhaOC_SS-~wgs!ow$mo`-t|Q z`u~0xF@jfq;sfT^{a8YR8_gcyy2TbL4?m+IIBOdjNm(T1p-?eB3+IbB`{x{&G@DD? zI2FASH8I55>FeFSzrO`-6fG0HBE7|a4Pcily0`SN_z~h`odZHT39@I7rb=HnQ;y@b zAIaJ(cW|@{^Q4%QxdIE1*aSYB5GV4x7w;^O0r8~%ou6UK*H|mP&jILG;Z6l<~?!t z;WO3b!DZ(KqXw+WQrCLh>Qrhf=>~RN;r&|izz@PZB^%ouE1%e4Ty5%wY^};{qv{cQ z{BNd0CBMRWkCTXr=z7-xR?Zrm;)O1mvgY?jMEvzJRegkdZ>pzZ-FlVixUJyaDOj0r z3@v?H9I~=zu!a0_%8*?jJro+n**I0WvlHNW_>RASwN6f4hMfqHBK*Rz)JElVSyECG z%KJ(4hl}rC2Ff5IU7=*0v9V_yO&X^JD#ud1{Oiasq}nt0DRhk zNT9{8{*lY8ytg?vDE?_JCkZdw^FCt&eJoWvD{90b!V7!G^`;AJ3ti()9lG5y8pHR# z)jO#*22uGzN~Gpz?7{xIl>eSz>!NHzCXd`I2lr*Vd+@?oP3;bNH1$&+gIr z7iOusU(ZKMp$&#ct@-FuZaAhy)9hjQ^G?9f&>!nMSjWPB66_@h@&ruD{-|qJ8&9as z8n;a%$NRaz*SfvtlxTlcnAyQYGaq<-Gq^v^6cgmx)pz^@Sg%fVd33%I;qw@~(y{=3 z!OAPjsxWLfUsLpW-zGOCX|VRnYUl`TVig1D@uLGnL)=c&>|v1i>FDYj77pbbq^n<< z)#o-4Y;voei16m&rB4&6^){$%17ZVVC$7_7;Sdt9ZZWteXXWgC>qDLI149qEWSaT=+tUB)4MNlCJ9 zb(Q$0wo#7{^1_7;*HF6@r^1w!5!%zy(Ltk=qncGyV+au~V(UR%NL+{LPeKm*>a}ay z5D}>#KQiWzgKQG&vqLHJh-Zq+g+({lm#>0>au#@tCnV^ZWg&NUA{uZW*})rnq!xW3(nDT+Cps~sJ zx|J*(F**3__AdskM0VEQ`W=5k{4oA^jvDJyo8-ECh~$#jRxm98(UcoWZWHwENabpz z)ko=t)3J}WV}dSigc^Xe{*da2e;@p3F30`$%ie3k6k|;fjBnDDe0)lZ-uU{06|7H0 zD*d}u&l<%1Y!z0s9w{rjr>_>(f)Gu*QPa)qGKo0oOH(1!qya=4Khi6YEkAO*yHVTEJ6nF0K>u>vZ zyVe3=MofAMPIkmA*bk3p^Jf*$^*(wuF!h(eC;VD8MScTYt}qPb zg++wP6|>TI==8q@5=uahy-8fLf$uQ1goc|(@1Bc@M8m422cy?(`$ zkP?F~+-EF1SL&gLv|@F1N_1w=I1$GAt35Sd@P-%ZeNR?-y@Vckg#o;l%z3?2tSBK% zYKh|8iOmNZGWKFga*vrH2Ijuby1LaPtzps6vO>JvB$6C$lX!uMcW)h@Zueft~!VYPcy2T ztTWrgH#7N6i(yG38yqPsqk)!z@Wfv9_Afk=y(sRHSMcJKAm%SUgw(0k)r9CluTSE0 z%$}v4@M+5jjV5q_+gJ|6_}#sbYUmAEd1Z1@dVc^GQj3fQW8=ACj+}t2VO|N>QAEPV z1bAXt$;{^!k$tLd#<*cGicO*2lB~t8?M*P-IEMnqnzbS9l5T$*PMX=Hl-tmMd}96k zhqdo=EeAUV6RlR0JfFciP`L#wLv{9{KH_M;adqE0e)G$8D=RBror(aOp3V^})za97g#{yNn&(2zKXXy1sVhAM||{f?l_jE=27-bcK2&uS%8t8T3vurfozY|TOPADZ}Ruv zkIDI8$$BB4C`u4Hcxol4^PYd4<4k>Z1phK&l8WL@{AS!S(g-H^oW{(N2O>a?yBzn2lop!zv7?O~=>xuM$ zt)-`TwL9ICYNRJ}c@neW$gX)?wj0%~DU*i2|Ix6I&=E5pp^rZCPB8=W0bSQOb|#K- zI<2(CK&Dr;SzDBh&Fy;9kD;LkQcdJWRAqTv&g$?^sfWQ6W2dk7q&z^SlZ#CRUek^7zB9EaK)v$u%~a0&lfOyZYci%?Pg{ ztP2J|ntOctM(~}e_r5J&(sPI_4<*&en{ffQ?==&9V9KSvz50fNf3l&T$?q|KRWROQ5`39=lfK-f@nonviNy8^e5*eXbjLTP2! zqJ}6d>`P$pBO3>_edxc=NUl4dCH4G3T`5_;o#SpFX?N&ISIxTQLU2K+?(A%c@-p3N z&b&=_nVr421PNwZ_P;ka7Li$5?H$O=zA;&se||UM=VUF-18)8+Zq^ktyPsrP z`#sDEc<-o;+GEm3jBu9DPJRad;twhVgaZF)M0yl%%l_JMq_g1cci(;Lk|I9V9{OER za$AAvANaY6%hIx?qn*f3YN39>L`oB!*wN}b_|`5df-HGGpMKxy!X-iaORDt&uPyI< zIoA9Sc-?gGk_IpF#e{T?gHnYlLO28F`8tVK&_J@-^8n?kq9bNbaJ}!#4l%?S`8#gk z%H4x2+u>O3+pr*+CrLIFAB+~d(9`K_+2ziXi~rQERd$^DoxWRk-Ch2>Xq!ynSLdwc9dn8%1U)!_i7;LCLlHA6m9am)Gp)YAWyy-eZH z4x0Taxb-8q$`#f^PvtvWrPSqzR>O-~^2iK&YG%reD<|Y|lSyT5dGWM03N^~1$W!N> zIyn;ZZD;Ta#rEiGiM$x`uA1AFg?xTepIBWIB15N8l8(z0C)QY%WR4c!>BFiu&HI4Q!#gkk~sJ)%S)xH-K3kZSP z2|;Nrl3B!Gq>V>0G9)BM^wqRm{9mW#ltW1rs2;sJ^sm$T?*Rb2oPTi!s+p#D{m5K` ztn2_U4T4gCL}gGCuFrKH_{P;5L&)ZwhPS?}o&M|l1Y4ml(VyB0k&J=#HAI+vl&@|T z7nLEsM%Ex#tXV>Bxs**7mfz~Cw$R_|_?Pr({Q-|yz8xaB)l+-Nc`708*-(&aZA5Z! z!6n^#S6-&N_yS;v)~0 zqXi$MXk^f#doK%+8wNUzD*eAgq-FAnHh=zZ9F=8;i&|v~KQZjgoJoPni=I!jS=ZX? z_Q7=Sa6wESnii(iL6kQDC_p#1cjO;OAo$#Pgp~5Mefh_qN{X76WAd*9168~73i=!Cd<@g*x^rRio;y$d*P2NOj_GWy zk@cen>Xs#~Lso?iVd1>_OxpLxZ3pUd$wP;BiL&UHN)yq1V%9(QN@dx(dB$(OVf<-_ zo^v=YLSWyk)PF)d=GqEu4rI(wh-~Q|R1n29HW!s?#IyMCgQzDEA@DrV% z69@HLd(m3lzmuN1^>LE=(une{i+|}bs-~*9pDLRa2>-`jT!s?N-ZwR#@0G%SU>p{!fRvX_jfVq9<1x_9g`*xj*=@_zy$=8gtX6^YK(jMOL=2hGbK7c;! z)ZqiaVu7rzno-ysIY=8jwWelxM&SK+stO@xc8jPrDWDlLqUO^xx|aQ}u8@Y8U<#iF z^l86~o}r=Sr#0*_j)|CXl4$()8XXMfNZeP`#&wQC+ib6f2efg+p3FoiX5vWl%8q~i zV(Mw;S9DHNK9%{*@f^ z-LDut@Fv{>SdVH3+CyCUknOGn;kI|OIBPv);}r#|bKw*&!G7N&{1LB&wD%|-KFBp$Ld+u!prDBBV&vieqF3}nxYbDf6xVjKMnqb(gLi$IKIOlIcQ8@pJq&4T-(6|VRCe;RLN+7StuOWZRaY$#wFQ~zJC3hA^bjSNXmCL zthN!TPWyU7K)pxp1do7#T70mJ%j&z+{5=2B0u;?NG20W&jbYxfjNWQx6%~^00XjM{ zfEWyFIyA)b^778~9X~*Q^x2)W><225Q?RVS>tS{)%E~?gHwZ*>l+{6Y72YhEFhKIK z@+@&KH&}Fof=E@z@6=4Vw3WW=?dua-K}HiiuiMqWB-|=YrzB-k{g>&J{@8sDuJUwxbCW4~8WmQE6%&)Z2{ex!U5Ax&nHn6ut zS*3h#7&2lz;}{-22BWy&Yd6rV(=StI`(aul6kEd%8x($@_4aMVLB%M*KYp>@I!+8| zQcxP?n!w=O*S4fqW72$Ljz7DTDCJu)BTbanfSH%|O-)V~WGcs(11OkY8Ud zGs_@dn+~Zyp>Cq0V4OhVlnnluS^orv0AMNng@rrUUt#g}sJtU`sUbFh!v&~2JLzG$ z^xmq&zD}7BIe^kuY^&erRx)Ll6*Do@S+;mBi7ylaF#`xegttYUo}ON|j)7=B_XF2V1yCER4UvF-14qbmzO73z3_$=^4bdJ7W!e_<~Ecc;qM#jQ9tx~+F^5IAF z(C5#0;7G|gV3DFgV}Kk$7wF*jpppG?Etw4slSftKZC|f5_!*Q~y|R>f`uzFxr!gNX zdJ)4J?A>df7_a$YFeCKtzLvonS2_jGT#;YD28V|i|Kz_8g_|AK=mG#g$}NR9$TVmKw1I z;IIWrc6e>qik|=SviGU*`!mlOI4zNpx0Yq6Xil&&i$~`qJbFE~R@t49V17L|p=q$l zcUx^CkUPoix<=0%pq%GsXEVHMi}$^X;nmw1_c`*4lphv!g89=*=FYW>At^weS&T-NNO!+{~ZTI_FMz-AU!2XQqlO z^~J`C{OsIYIx(~EcN6V2Nad2cL;WzO@uli#l{Q7d4|SMpT1ph&|fBBtneND-qWM!;!=PvG(&o9 zq_?)VX4D_<>})3RHv@ufA5pVNL_^~ph&NET0y$2)h2hx>AH;2G<6aK;yqa3`?W8vs|FL_on3xNJ-^InnP&yhk z0W6klZ5ZKu;QubZQ)u_({C@N)?Hu6+&O7x+%$i+kkp zd8vIfMjsIqd-beFKAj$xA9^gbY+pM6RCtz3-NXR|h2-TuScswduB7t7Z4b z4GG+%XdXkR@cRIJvJ7E|aKIlepybEbM-I#1#vtEo%;~uRcS30s@h>YQ8JO z7b4qcnA06<$cZmph@=?16&G9EY)T{u-Wn^T)z#54h*nD2qVbFz-I5(f-{**3(ljwP zc8X~Mk5pb!VQ7uLWAh;rvYXj>pLt>_1Vmun%VN2AOjRxeF9wWQL_zthfW)v-F}yUp`R{gmTvxUlr0a)+jt`vYiS=K-9(DW$vt!Pa^emcBBo^8%-`JcV zT+4ix!8#m1CEu(X7vH|zp1j`k^k$`rWT$u8)Lp`wv+(!o`jugB`UeZ8!vj)%DauxN z%*@QDew_FRa0}xGY8STLo<{4e%-^)QiR)up+C%jgm4DNEw|BVhK*(hcYrK{|JWmq* zFGl;{NDYt;Naj< zCl2bYpf$wQ`E-_jRFBqqdObrqW8S~FYkqR@Qb|v1>wO5NhCP>iZsNku@EM9&5cfY? zcNq?)juHU@$OOoz&=`1=G-24%u-YTjrZfKfPr_KGtDdWCp>DqZ_0uCQSNt}6<>kFY zLa&14#XPWBR-8r3=fUyg#{;$|eEWmXj2Ar&rN|p=*BTH_-u?{-sIoQA$`nD;0?~0v zc5g=ZzNIf1Rh2?l{PnvKW3}bwUl3L&q|hV#fQ)##$)GSBA+@T0_iiXYfJnePxVl!F zCb?J;rfDLj3GptCB%cXT)3{G`+%GXY`yBadXAI!FsW*J|S%c=V45Rgk%K08-q4-pw zR^Rr8s|1hUA3vJZ0o3B(Cv4LRI)c=_-!EkKdl27K>Ddq~*A+G4_)Z4mR4~=Q5^Pf` z+9ytl7ecF}<;oz1QoK<%cr%H)xZZ5vPfZbr+xrmr+(01)%A0bTPG9V3=0vTpBdl(~ zV%m#e&*>;@p`xOq%h9BL;KNX#_KuGJu(QHtjzj$A zm6b-;7BIy(W7K{9BF$_F{D3HzzyYBY`={ZbOSPy@0Y)R~`hlYTSDVFL_q zKRS5q%wme~Wbb4>;s|Y+)~k7js->)?GQ<{u*C0hJx9h#ANZR*g%(ZdC(5FXw>jw3) zsM5~axj7Iz*;bVvr=n_2^Gc;(u|U#!dU)hh-Q_VbFo;+<7I1{>+kx~m43vR^#L%gH z_Hv>#dh?<}Mtb_C)fRGkq|CX5P7Aqf`bD>Deb;=#=*mLu8@K0^+?&%Z+aeT~*9c6! zDFR>{Zth^<1EA1C4Z$8oNlS@|iGi%Gg(BS({wc#Auy{cl*C`yZQrz|je~s#_<-il_ zwK`k`D8cS4l1!Q?o0%sn;j^oIF>I+uWZZ8ie5Zwd&z$5M=al+VD_b>OX%f^_e~Nt9 zOeva8p1IHjH3v9Xi8uXAEURv>sM&B^&a>G$IcZy3UTV~(`WYq8(Q{JS$q} z;hO<=7D1EJjJ@?~ADiTO(h!Zz&f+C`S8AIC_9=@O0r3hXu%`DhF>}mH7x88|IKFK@ z{{H^<@(WPB<^k1-ovcst*hkfLuXT^)>N+icC_uFek2V5zY6gMeL($s3Im4$3dPmW5 z4gmoH)X_aK16HDfi2P|PV~77jVkm*2Y4Lo_^j~=~mHF<4e^99ZA>8s`AWb4O@jh`) zs`cW(P*r>v>5ggp+`qsZ$6b|02>9nQ5B>(AN4@g@JBOBmFYgovX4Y?*4h;-^Dk}Q1 zP7y)_I5CFR1s${TIf%EAilH3=T!9Mr6X=)${yMT{WMGg3Ndw0FFUE1NukK40V-gdQ zP;B2euNL*B+5B_hU*t}Z?Knd1G2jG>q?kph+!SBu#nVtIwzLfU1JwKSK0}p7k<5Uo z2HBGhg~SzRTEh?erVJ(gXiHK4Z;67>Qf}cQSTIF^A+__nw z+H%mnzHj?G$tFLs{M(Qb^C;?a+=|jUCF{SD!TEgw2a@H>`Cro}GYN8k1T7L;k>hUyG zblLaq{vicZir>TsKV)c|I~j{00?5l?@3L#MUiv#BrrL+ckH&xB1-J}gI??&5-Q*8J zS;76`Qy|!eE!g;*z`;*LC^9(>WSQ)q9~s_HMci78^9r8a*Ali)cYqr7nr}HBOKwY* z(v?PxyzrMz_y-IEP3a&S%>(O9&vAy4G1EWm?=zVZ^e?2E!2l^ETR*mceu1hV(7{ho zbqx*;baL3<)rqhIL!DQqj3aSIs0 z3Aqn!y$oaci@^cEW`qKMmYwm<2+l!C6c8R&KHQ7Ubrx`%0 zbvBa)uSW$Mh(2JQY_Vj`>!91jOMBz=Z7-z_Z&ZOENtQ0P@Pl)mxE`oU`gnwwK&n|3 zj29nr(3qTSi89SvFZas9hL)o1g&06@N)h1Xg3j~#b=%O&D{C7M>%~E2Y6j%cxr&lR z`&L}NL@MqORRV>K(IIruQS>Rq1=BRfRbG^JBW8Ch*PqmgcO}Zil3fc2JM#q2$K34I zqDuc*T&w~0_FGP9uCa&sN>Sv~q(uCy4~yZuaSze`Jw~O@^%`pQoW|l81DHf9ev5zz zVZk`pJBib8ovh{pgu@&*JH-)plP1<{C;(PNqkpwO&T~mho@vZS-kc`6L z&(m(>JHRLC-ZjVqI6rPyI;IoYzjjizWuhov=w7g(vg}?5OWwX-P@4qr#!0;1HIKDX zseiDFWa)=DMkqCWk}&_0U`h>MIx2(G>;s)WteOIkLEAdmVpgXlP)AA&wR zroxK_v!W=f^!YeD#Oej~2y%Hb;v-`J2op&YRVE|!j1)y6>Go^5L%HD*U*Euw6g^_! z+YE1%30kZe^S-mY#E{1l2P)CAVl3Dbh$UUeeeQ$SmO;{8Hwtu?l^}MMSdGUXQW8Le zS_W1PG_>8ho0p|r=Wk#ax}}4n((j2HIMxhICF1c1wKhR$x%m|%Q&>4gPA?ZgNWLPZ zEZz+1imqvs`!kS@-kCp_B(ky~KuBy$P10klQw7;6Fq^abE(P{01TYBJ1#WSKh4C>I zsV1>5e#R6esp${0EE*>Xp4K6HLDt8h#+qAay9{|3X3zK~nJ70m zo;r2Jk#3oyz0Cb+zftbB^h!^S>n0Py8MH8{4f{U9wlhWqi;l>V%N1c67P9xFvrnm@;0b#^Sa9`c48|zVCSqQB*Re2GBhuP%M5pc{1ZgusMN8eH}DSfHK&)91{AaHFH6(-Lb6F&W4M`pSr&1+6O#eG#lueM-VC zCmgpo=Fk`jQM`aYXofs11O(D>-lrDD79AyArLLuADb1a!)W3kssjeO|JVSekbz3pk z#>sSLETO&Lzh`YLuck(Fde3qQNQ2x@pWJ3I7)TO!DT@%-5kn|f0IA}rJMD7`?&1Zv z8{2^m832IvJRqZLfUqg*`Hb4^W0Myq%#L~{f2TT>5Cqqc`utf^tJb2}b>qE@GN zAGZf@H-Fl^&qDZc3jl0MNl8vc2?+^G(Z#63JJTzw`#nRpgD)1$2l98vZaDIIdz)M}rbN z2K*95=UBht;@bD&7VHcQ-Tftn@~#>*KjyY4MW61}PjqKwK-_E9cKV$CD;+`b&e(e~ z3qE!Ki5I`iy}+LNt(m4PTzg&~yT(}xD(!csU<@?0WeS@8X_HmENjMv}8Z2WQ)8yWd zQF(Ymz9k-f80d=2JDrkb@j`h*zf0>UB4)x_W!^eW6%Sc}#_{U@{of0UL6VM@^k{AG z=UpQ>fW+%+PcKDBVgj^h46JE!G5m6`@Z zVK!~?pA@;~bX>L}<1aY45t#Rj=Q0uOl*z;W<=-y8848(f_jDo1m2>IGx{O>Oas~al zdz<7Bi3hsfW_1F3{e|(1%rfer1qZzv&qE3Qa?xK`3g=C$gWGLqp3@C?q=H|hh@HVF z=^F18$5dN&ULT2c=Kz7a?)Q~z@`CLypj#hxdMqu4ldzyu{hBIormSat@-sxJptgqa zC$^CWYe|j)AioBkfPbH7>`M|$t0@^4na7WyKfYf(7Y_=%91t1k5I}7>ShzQD2r}0% zrw+d)g@x6N=lLQlp1ad}xh6Kftk37FRm+$~suf$eCl6t=1JR@ChH;j*uY!S1K+H|n z`9~;iJ`+S0XITK;OTk0haPmNF0T~BG!RV5%wl;-{0TKv^U5cG+e~Z!ygl0z+_QBWD zSw5Xaut;=(3{p)7*>f~DL#ed1w11}&a(R&UOI8BL=f#2pK7oZ1L4?B+^DC6K6?zkA zs1NLyUIS+LecKKFEN>Z&%t1EJvsa;a$`jy#icQU!-sadT?S&CIXK85{9yVEh5JD=| zJWf*{+-b50fe2UrEcec8fcg3t~sO65qIolk5*n;MFJ04i`Q z0@zSGDRA{_@9ISDOod8$cVP(05fGxqUU_yMXb}P=A=Qm+gCI)IOCuT%9}bHcHl;>v ztquZ9QWiw?p>#>X^k(`i!AY5T8ke_k+>214~?|m(K29=jsQcv@B0ov1v$9GedchpqmT` z)eW`_L2p04f@3sW`+Sw+$v>41Z>>YWK}iHY#uvf5FbMGudJ^o1-U&zCGEGmJT{7(o>W=HFK0wVFQ6F)(yfD}VYlxNO#?B zc_ZFqFKG(D2tmQ2z9KF(>u&c(Vm|Gc$r(cI@2TB_HjNW`ud^}-jhdWnWm~lwB|T4I zhrXmvnaFo9E;O&+Ea&=34;o2#p1Za=Hxx0Ys zU3_}MJ{J$uT@r7^yz|=gw1%vQBAqF1>)2F`AYLF$KG>{(`&t@nwe{-V3hrt}XJU^e zv0{G^AzVJIm&1V9g5zXSja8dZM*#{|K3VD8u?i4N6qj=T5VUc*_poDz3iSXr7~cz& zG5ai%xu;|X@H=M?@Y3&W03QR=FEOLdwu1NCwfAG#3d3owOnX^wu+ZYzT^vK$gSYPw&l$QAe0A^dQ%6L<~FHZ6J}zwP6CO>peMV%WPfM%2oEX7dY9A>FVID9do_NEu(sK zQa0taDaf8r#&6}ycPn!r()_r*h})A$QRr@5~zjv$C0 z_m4@A`2oI7%w9$lOZ?KdKCwj;wQ??r>b+OP=Qw_0WK%6WcKJVAfMw@bA=?}&Lc-@d z1ui~-0^)k|r3vB{@!JUzgyd2lZ-S#$pIY`xhUH&lXM>iRgB~!F#l>zmtVA3-BZXT= z#x_M5$5bA(4b3Low^=5(1CQI(Zq<+(#Gig%g&awOCu->>Az7LEr5|(wxUbc3{Pcdk zncNRqCaU1iv=)+QXJM-odG__&9dmES-;3g-R^h3IqKseHz~@whkDU zi=K{~nl>l1DR?89zsn#mLK8u->Szy=6lij7bZku2b+Ya$V@N-BgFnvZVCZf6uV1}X zP8+HsP3n0v;}B}h;KtyaUwp;1a8B)$b3bm7Es-*;+3*jAi>InDi;WDUS`_X z@=t)iYLu=%pjo!0nBypy91X=nUrNQ;az31}DYA0LCz5s_2u7wZ6)7f>&Hz z4^F+B{wYYmR9qQLWr;tc0IQhmh~qx)Cn6?x`6fYoXwJeD^6MI|1<%mY`Pk&1CATN3 zZ7t4njaQ-X6Gg{b3(&1SwB!Q%vkRzh#Q78EW(#y7e?mPxx+~QwSTCH&sEp(1#q2;y zQA1pe&` z{IYpieJd#H^Q)=Y_I~NuXFjZ4pEO1}s_fGH7hBuhK!j$r$XxyC?_8*!;i>jTXkpZN zOwObe8XxF#S2&{=8%mKa&F^vJE3XV=t*V~#A}l^nA1lr>yMBFXmj;^VW_Ws+jMwDG zGCiQHLo%T9i_lCz)}#}T>7VF>tDWAWEgHIKj1#Ehg z>p;Hc%-to7vp`>pM52^IcfiElom6pBXL_S0T_7>Uq1;g;=4(BY95g>8M;A_xm0e0d({I^_cCmhRiE^729VlqhMl#2LCnq3(>zL^04< zfXG9a*Y660$80)qqkr+VZ|*4|O9F{QyxUY3wR3?1zVtQbL6ku_Z2ijGk7LLFz-~(o!Kf4LKh$E5G zBi@R(Y@zFy#eO;?mG4W+_Gqr)G;(ikyPYjIV;?Sej047=Ue6$I=LPjO!?G)Lgr)rG zPM}Z#?(eO-KwayD^*F#JxB-w=8Bkro;!Fe+v3HLiR#>R*8MXDSjJ&7zbNxFC0 zqzF)(3_jUnl+$2s57~6_m}^LUQMn&9IqmotjphCTa3`X}2!a6g$a&W_7L<25BqRoZ zm6K03^&_@C-9E46Xqo>6`qA1%87RFqlI~)2qD7U0WGB~3@B9vzb`S0MV2)6AZ}?xN z^$ga+5}~(-bwOgVTujqsrf@t8RYBLy6J_J*?ld=z-P(&U5+(6gTD8R_G*`rOCstY% zt@tZ%r52T%(Rdc%KBM;EoLW-sSK#5H7qeelXTg?Qk+(pQiiwLf+)@m_pk0ZXz)HU<#7=VeRJp;gqAtVe=PNtRwCYnE~e-RmEal2NY z&7af7z$roGu5rc}@V^Y_i$p!;5+uX7Whx8A>5z42#y$GZD>r^eD&b zOLqkyUiMSNZ^8?Ax-7!kf{FefwOD+59}C~4pE1PXju`1)jdkUU@PQEF#6^>jN6MhY zorE5{)~*k%#NYpEywi<*L20QZQrd+86C#mEYROl!a}ln)>^v8RXg{(FpT#@Ge297c zlOrG~>nOcm##~#FOIrzTim6dyZW+;jdaFdEpcJbBO#~S zB~YWEp7PNKyygpi>H2s~tJt-IKHBUGgxa^NJ70&Uw`ua^xPEsvb!juoXRW3^*yeMjH`Pkk6=h1XYlUv>5>0dehi#wSJDOvNb6B){~@BDiz z#&H+Sv_w@|p7)maJ2AX!zv3EppOs-W^1L^By&1PfdR>iV3=!}PsU1L+p3EaY{kFSp z^`3uw?|fKQ_<_6=EY({TZ$VvkDt0uzL;Bsg;0N6Y)pu6BB=7a`ysOZh>g&4$1Siv2 z)dqaSjD^9Hk7P>Xv+`Fvyzz85f8Wx02nmx$Z|TwKmtR=?q%JXn^hk{&=Ni!2M*96a zLc#mvBYyn&!EvAAQ{G4tpHNP#BWVZ!u{Rr<>&(~I;maGYBy}wZ^F1W2j0_A6$brH( z8!A=Iue!PukNTGewAB-Ow{)%hr`^;c7n_%=4g=lID|z7Xrb*MYd?DXx{7GLi`3#q=*oyK zvTF^<|1A=H>BqYe_>LjINYOFdp#qa_TV#-KDRMWV{?D&B+W@707umhDK!ZZ|*?NoH*>&;cke=tf4oJ%$}Mf4)e1Cb z+u$vhyP=|4-TnORm?&|*dRrK27OpIV9QtzmgqdpSIri;j-G{4_^+wUp;VW|Ne>t3) zpKf^}x}b|Ps#K-dljyudY$xl^xRhakPq+LU{r0fk-@(hI^VfHzWpVuFNy?}eaQ+k3 zR?8L7jxoJ z?jF5qo=+-+Y^}jHoXY=n<`U>Cjqy)6U$$I2Q-JFEy{14E6i%6#e*pd!k zQ;?gJlLjn^{k)=Q~BM* zrQQDWV&M`@o`c-WEhIiLt@1P@64SV>)Hzit7M=V`m@ZY>?{TQ(*(X&m2?=P}D zQ}*7ydfxL!it2>O**))rx}8tP@5l0+@T^{vplF{h4PyOfsj}a!ajAwHY&$tP^o1Gz zbW2g?rYH}ST|v$Gd`R9j^hv+7w+X-4R07Um$6r}|J8?2yzXhM@d_R3AP-RU+XM6Yp zS>n#ckJn+hWc43&oj$UIbq&ee24QVj0}1Qe9~r!PX+q#c;Pf%G4|xSON+L(&vC#Nn z4~iZO_huuP>U-LI)fzu@^9oLnS?|(6-NilqbM+1}SnPhIBz|avp!>--xDgq_Capx? zR3m%!iX9H~Uw&)D%st%F7-zELM(BP1V(!E}$v;~Q)=Y@teN8_q-$spXAt6dhDku^P2!k}JARrRbA|)U#H8c!h(IwI?4N@Y~r6S!7 zAuTbCgmevgKF{9Y{e9OuXRUMAZ>{%_^Rm|7Yb0i#=YH<{lh<{9QVR_3&RV*KmL8=< zZ=JDW9W?dz-2M9D4$;>PV;xqB==OXA=Y&xnHm zA(|YEF6|0(K=`xB*R$sz{#Fu!mmj23{s%87Z=Cz5XL(GHLi!&*)v;p{*+uizb6aK7 z%#44(J7^U(k7BKhMhoJ_yRlflbn^dP!^=r!Jw59R2JAmjz+=bcBCJ8=Zm;X1z(Vcb z@>rA171n>=froBe9+W#!x7 zZ~ucoVN;-CKUU8i-tw3$I!*T4{V>_LOBHy=-MzY_y};Ug&pMW@<0w1_(aFJkduA#- zx^90GLw(sbq*PfLQ0)5!g4=OpV^e$ZL!VoWX)V(uiaqe(Wox>ih4r0MRTO`(vaN)O zvCpmXQDa)Xp=j+N3V7-GZIVW-xGH{W%$&w3wYnY+i!cSc zkGI-N1WNas-HeBYy1C{?=3$O~xH>M*-+NDg*x@~M;Wn|mPB$A|JXK&=7oLSV6~wvZ zu3dztx5S4}tlkq05dpo=o(MT#bo90UG-_(Da2Z~FaJQ*6d@{9xTwL)QdY*LbN@opv zDcwM5`*E>$EaN!|JqLaU5)J>ZP#cj4;op}7j>sqcfKm#=a!-w#mlQrX@3E~$={ESF*JN|fuWo26@OKgd8R$RmGI-Z znlUGbEl;_~OWbsGW)WYS$`Vr@@HhGxD(~%=ZPygDFx-L@s3FRj1>paic<6oBqmw3q zJk&D1`dE~asn0{^jf92a$jsn3o~k?Ix8a3_>4~sx?4?dktRLWc$$#oub57b{ z07g7~^ZMJB3>EewG65QjHMv=0G2z^xJJmxIcc1m2;X}{Ryrn5F!0^(LmQ=a_;JRPu+q*OrpJFcf2Yd0 z=_97q^@-3bZ(Pnyjj~Ymv;|GJS>$IVTMQ0%3?^h zjf{y8E7Zv&=G_aS!%o5)TSQJ6DRMb}8w4(V;4bFZLdp8i%TM>7mi^?yr^RtaVyrv0 zbC>hiA*GnO&(0fhwiE!_(yEZ4q&W7M^xH4Wa_lDm*ml4#EmjQV<#3PwD>PJ=ooS7qCxd zN`my6@Pnc!?HVz$^3sF*o}3m{ zUbp4(t~bDbcDia17ujRjYLoIgT~A`%T3tN9d7CMWAm);@*Z7F3n>tJHA>Be@(Ws5l z0sj}&;c<`Y3^Ir11WAK#x>KdrV{$hX6Rt3)S{BwsF?#M8Ff$9=P5lMZkm`%hAee|{ za2`z&8n9q;9eI21((j@sMr@)x6nPwecV8V7M{vN_69Dy0gn}q&+r1W>XM1(9w~dWp zS49*h`$k3{ffgkd(CV}eYPLF?9Im)WMGXl49$QkHi)_D)m3{^00L3ls^n~HkIQEtv zirQu=wIROBfs&$vxt=n<{mkxwm@8B2Ve|}~{@$8Txyat=tgU-OD(1DR>|0>)tsU&H z`S*C*IkunO_ocq9|BS6`oVXe?jhT+Nu9zyH>=3sLfe(>-ItYK6*wpD~g~?lpD@x^E zS-#~Fx1mT>mz%p0lc-%ob>7ph_p`y*McOWhkhIw{2`W3}EY|*}wTYDpw61!8Vnhid z5#uNV0qnHuvpsg@*k7noWyjjjF15YgURFmkQ(YVLX{2CV?}D4y2~c&3z79N9D&ntnDBvP-D*(>wrCj6d_>L3#N=+J zS_}#DTxSZZb>3!(v-G>KPaN8W#xyGb9-r|cugHrXyCF5(b)!Vyu67(Q)h@3(5o@qr zaU0NwR}_-PbyfXqFO1T)QPPDrNdgKkPR@cgJVlE69;xpE^~z&5saJPj0{erVF%&@@ zs5Q59h(m*vzKPN@Bwjs+)K_wmn$#DH(SdRm>M<2Miu*tlh0{slIs)3Z5AC5+nQ6$K ztUnelJMr^dWo0F5Qi?h3b?}K;`9|L0hN*GaG`ZYSSza}C1^wSRqwmEWX$?{OxtNfq z=`YX+s6QQk-*`M=%qQiM`phO{>z1cQ)%&`lL)tjnxev_?VieU`7}@DNzp-b4cVY%W zh%dkmVPbk{M+QnqPiFeL+$(EMwpkjwy7l{v)mer@$ z1(w*-qC&n)j+zR0)n!}5j_UNsbJjkxY&FZYPsr?LPM+@3GG@*%eBNoc<_OUPY@MXI z32`rlIy+xiCg5lQYI&3ud(eD%@ zdrsDM^U~ZChmpvWTqnV%Qm-D)2c1h*xi1xWn#&o7i?ecCVkse?pNus&to#8d1vR;T zN5t6o$ZXslOPOjXt`;Ba@*hoGotjVX5@_ z6+1L-K8HhsFQmTHBl}xTU*_)WE7$z65J!)8v^r&}DC)c8jo|rlOd&hlZ*PpFE2!CZ zXMKQ--*tWZfo9;iZEU|MV)m_kC74s!yCU6f=56xct=pQwW$xXp5ePoydJ;{Ckv&|4debippyQna`YIU+Age(pCIg4!{Lo2;!9hgJg!n>h4X5HR}NDo_JP z)GHIY=}GB)S|-=r<)PKN6M22y1f~8S+tdVjNPzQF)vRbhQp^illtuZEW6&AH5X#(% zr!=>;ut=3+zPhF|t|?yEQ=6EWm>Kz4r~nuV-RY7wKJ*~sl_AtQy=oQ`Ug*8=`Ov{L z?j=2|Z-$=8(l^bPrrg1}ETkohcpi5^2iDqHT4FKDidi`TNc$1#+q&+>QL#^};LO9B zW-`*Z-l8hr-g=R|2iQ*h<`G(vO3b{~1yWK&F9tq;yU%sWM3pC~psnF~QxD(9uRoep zj_q&C^dE|ZB(YadpQ7CeJApQ?N=TVK8ZNsiP&)8(c(EaY8cywW1|Y}8FQXc(BB&#%+AdXtlb-1?oE9V81VGP zV-NOZ0b|jF>P^Y|=xI$RN54qXV4n`!BH>2I;4KYheHVgAh3}xOOz0}cON6o}(*B0B zOji~J?Moks_ZAlq)cACw{TwJ&SR#$_BNr$B97d2n@1nhV%;oU9T8((Zz>DRqO3d|M zjr%q+&uj0z?ynGW+o<0@f4i!Y6R&tt(!OHNFnV+W2|z2+W?AjTXB>BKXZ0+3%%Iq? zi8aXqa*1xij7eH1xr;xQ|K7cc9$qOWh34z8mj^q?m8@<}4fd?F{}FX+v{h~gSJs_6 z65xKBrrB=U$?IeM{j1s#y<{?*bCT91(~4V8{27p_a`|}x0iONLE2}-U(EYPM{kacT=ajNsd713 z+I)9oP7PSSmsJ>orTJ?XEgtxDj*nW-J5@E5>Tt5PXW%_YJxt!N3Ls$AwZT%_F?!8szd}rY2(FTAsfL#Mx|d zqViv$^jjHljftB0G=Q_;Pb^bQj^TKq$J*eOHg^#OL;0RwVGIr2S-;>4UV|$-5SY=K zrit}H!JXN3dvFTq`u^3y4Tg{jat>45l6DObZ)ajcG@GuqL{f7{wgl&cq68SwCmU#6prnG2K5xV z8FtP53?0Vb6|e)yR|fh-mCH&Ag7+@5ZkWnGdUPHUH?N#KwkFQNzz`RuQSt2==-6&l zba{jzlD-|QH8nMA8ktAa2T+ltQ51Wb^36+>CG70MpNYdiFX{fev$UKB`-J_|L4=87 zcK>TP9rGw(4As+@UB7A6VFUO~swr0IJuBoO)6}rb`1p9=v--Ei?rLhTf^Rcb8srhw zqHi~R9!Ad%oO>o+gMnSe(L0~ua@km1FiWIvjQUBgeci}G4p(xZ)=TA@M#L&x9v2nP z-I2RD{W_Puy2<6bb4k0y)~`r2t%XX&=LDb=0YX~vuz zBdwr7@Xw3@G$WO2CnrQO!n&z&4L(?EHHcbb3%nj{ZC%#AKCJlWLyw(?b&SL1n)kQ4 zWke-(84dM#NLl9uEX$`CTCvKt!bY#njaUUrDW770+|+ZT^~~R@+Ro%`h9m(3j!;qu z&s42xZ&{HaUTmYclGPe23E$L_OjnD9odXt8xR(99H8+AkoG=^vEz@p zG~H5r*r4E~U7wf#Jp#W%_MFX$HJsdj@y}WB`E1Z?)6WB2&ns+z?-XL=@hO-;f0R}SDv=07Ibzo-AP+dB|v}OBEwTbtr?A`QRk1BLRdgo9O zRzpUS%G^ov!UV?`DHjHn?O=_E87gX^LD5nNUH^EhwV7}w+RU-VN}ZtK6Bb#i)lot6 z9umCsLG&*qw-!zo*6wn603)xmRap5*?WOxtMbny#$X*QeXH%TVU1bCw{OZ@#XXp;t z=HUUkRncdo)&dGiqONyIPDtT>yIONA+U$Gso5f5z{iA!jv?Z>k9tQYUn?()XmXbQ! z@kM9eCq0+v8;-8<0!=u-9deq z<+b+KHvTzUKS;nKWf)kaZI)mnK)lYJukR2%s1_jrXC$$yebE0|LY)S_0OHj+Oljpn z`#ddodI)EOvfWuHzY24Q6=M0EtKwD?$RW5 z&T7Hfp!-jXt40Qxb{~}K=7@BDoO}+!lCir)e;&(~ra{M!Cp|pRoQb014xyxBHAW_C zD5GblY#eFoy|P)?eE=CW7M8{Vr&FLq?dFpmP$AH(l)P$%^on^glknK+STm{Q} zP+`saN z8U;1;G+?S!=w7%6vu#S0)IS%bb@P3mevJEUb09IV-c8%psRoDXV1bLuUWIklzdrPc zYxLPK{w#U}aXhii$?Aixky1t)o^rz?8bqAnr1gbgaz2&Aca)C;=aGfw&RioJ7fSZM4_Q;ktX#pKFrsN_ST07eMh|`P^20o8lG<(-0~`qqJpvu z&FTu2E9?p&eCUAyx895?NsE<(ex64oZJ*6Y^hb2d|E(J+%JAJfZdT#45~PtTNGot} zJig!q<+kEQmPh5$-2wgldQVkZHO`kA^;l_I^coLHR({F!TH=n5jqS91pr8~3LCvYs zq0mP(5tr^;+sumL_E2XxP_x+l%1RC2Z>urXT zJ441u4}HJ`PYDK5m&fulz5jeHry3nTcU-eGDM{<|A# zhtGPv!lh5eUAcv|ayE4brDn&>z@ow(>c063BTo=uqyzaknD{`ddM02cIox`{V|$`1 zl$uhSBQo`9x9})chfCnY=~q2p=WiTvJph~8Q(DhNV#Ze3{`*ERmr1=kDJ1J@GNzG3 zi~}8~7b?FsyFi7yf&0<1X1PB$7kUWEqSJCLnx|R9{H&AEP*S?gX9B%WPX0T0=4To0 zX>^KyZC@z3mP`3VjpG5b%1QN;JUFzF^3};?JE%ximR|_VyvRxx8ilk)sBihejhH^wnraWrol93?mtzh0 zS)ik7!2WT91pZ;Nb2_tx)ysEDRGxeyMjn?gp_&TjvO}eWyE-iRIB7MEGyIgHZ zlkbvijqkuwL0R_cAt(*HP1)SgTPY-qh}LG3$nGG$b?cS`E>e?L@v@nfRR%DbX&CEC zj+^X_I!}0f0X8pE`WgeeZ$!)U-}cFS^yG;)ZxMDgP^QIG8v?268c9^oNK4{LWU2@`c2d1_Je=6%zW-&y}cioeWV%g zf;9MmjH#?OnbK!LD`*Y%#vi_%ZQkD_u+IeKlUNG2F4C#zxdiw?kFW4S&iVVi{PeE* z$AJe{+H(GalarGL6<0(k?$oSHJSL&iE)v{|82f?X=ioz z2!+uPQs<*1M2JrXiRY(`|ls>L%nF&ZiAR% z?^nW(5T1Q7D1)HdM7A4o97Xi?<-bj=UsD>{%D?!cwExp{`}N*i`adsUUi=@uOuqJ? z)?c~Q|7ziVz3}h#KsWFIl$Y0f%px%26E8!8o2G#cct%K?rxzp6^dPM#EaWu#X7p{y z`o2B0eOzDj4lO|;%18zjxYp;q)D)c!Zc3RdIjMy*(AxR(1*+%T#(9rL>nB&TD-g|y zuk^IgxB;^St)d9I3@*W&1;ndf^KFGaZKk4(gEgN_crVuj#YkK(Lj^?f*r@__Z85$? zO<2DK32GH{;?r;5pgY=EN~*hw^skyw0@~F=i>rR}Q|9Oo!`r~>kfiD|1mG()mO#Vm zzSP0s=-FudV!2c|n~+R2kd<>%QeM4pxdvousKZc%HZ?fadaij%YU!PC=wFOQ4QCTH z+7E6>c*&?vBeYdwQrIckP~bFQpY4c{XKnC;!?>;jlgHS?WX(cy3kxAE%o-{L59;R! z6U2TvgH47?CS*ILc5+;!0MBQOm7lN0%bmk_LBJ++#c2yAAP_$ChjC3VTRHaKWtVf1ja%FdS5nwV3yR3ZJ;fj@iKe%w6`Ok$>=-q*68MZ#NcB4(q z1|YqaPY!eph^UzH(!c2Ij0}ZYWBf7ocW*1gihDlJ5y)s{@ z#(MFbu8sLks!PWAI=F=x=ly~pnW7uEaXJuU3UagRUnUH%vQecT@|HRMd1~j8C+*`> zqc_I?>k9xO6vkU{Qo-)9AcMZxF1sxPCbOp51Sfr{$7QN>NJ~ctq;qBHAVHNIAj_rh zW%)}FEAo8m4aTx*ig#$|=I47OC<_N4Avb(=Ga(vHFId>o`U>QbpxawqogAwpj>AWa z4rf$W#(f^j^)`So+S45}l8d)k_sGN7h4WzQV;0g~W35^4<(q{Vx6AJBr}6t9!imTgf)7sp4hIVn8em>RyQxd3 zT^Ag;$an`0U4>Dc+!OdUm_+9;52V3L9(B^h$evYCPiQa+eQC( zgA0_~S}DpGHMXBaWor#55Fmo%K!8&0Y-8JZ64~jI@U33ID!1yaC z8N&__$}6f&79z!XK)C@fmG%y*nIr{6N)T?H0|s=4gK+-CP|=I*a2O$Co%1_a>|P42 z0-!8B(1W5u&lAqj0Dsum?n{O=VQ}zli|(ZzBd(~etv${Z--ZLyS+7GC6wxS|OFk<| zpW3RC><4Ossj_Z6hCp9qTe}HItdSv-`Yy`uf~kK*pS!&>0HjybTdc z^4)@tVlcub9Ir7{r zkmn*B;pxC4QwjAj9oAU^OCiC7H{Hv_?6o(G3mF{J9Ejb$)2p*z6K_fy6a?`OOCM;%n^Kq zgg*iGprfq#R?V1z=j{6UKA$@i2Lds59jP{chbu`EGTW_O<6uNAM*>0EIm-^52M6L6v^kwV@1xD!%aOAm`3NYWF0;oOoT5;ipI z-?r^p!>>ZE7g~7^Ue7Tg z+5ThN4k`(8fvLO`N;$0YNq2MdYKv7J}yjC#9N$qdq{|@hQF4g|NuJ zuc=wUC~`$(H&^0FmT$}#UU+iLFS^5|LH0dNAi7PgUGRk_@?2y6LdD>~M>`nJHdIhf zRe312TV0r)%|kqqH)W-1WtIO#`)ZghMYR)nEDgy7$i1vS{lciV6{<7p{r>Ljz4VaT z<0MOy*A<*7?6}s;g}!$kYQN=zs|SwQj|=;dNv>AsWM_BtTQ{p-qbEHBwLo3^yd~2} zt!awwMSGTDHwGLAOwFMDBrk2x6+X*R!!@xsmdh?Fnw}b2U^ZNS+X|wvw(ncgCsD|7 z1sXw!Hr}m6(FVW@R8g%sGzF3O3w~l4)1!JPzMsUD1OQbn&wqTkZ#T0Oa$VxCySsjL zzT>JuJvU)~RI5=ecrB1`n|Pf7U_vA_C+-4JFBDmcvv{*D8Jo|OqQ#qg=U`^)?5BRA z72cAp#|0GSV@vl4`KwaQDee_yzV&g0Hi#8;ssNy~a4vE^W?fI$Rj)%L_tY6zI_?*m zeuE4BsLmMNqm%{i>1wlkQS5gpNK2=<%Gu zd$hq)@7fBL8L2*w((-@GCK?NeGH|6sOYqr-DEr#1C%mzJs9)f=LAZqq*R!zM3q7xf zbrTTj@(I*!h2}HACD#S5i7vEDwX7xd?3ONnGk31gVV=PKL9@ic(L}XFplNqg*{l9d z9NuYp2*i7l0dlA)2qF~3Nt?JMVRa)ai&z+rmv7h=@{q-vAP7>cn#Bgg+eN#mX`wFZ zn)d4Q1kq3sc>K*#Yh4z9(f`Lwug)Oqjww`&eIsGJAE#FfXILm2@b_wR(56uwdZAJM zBA3#HKVS4FnEE8h#j{$NHg$BazIXrG$9}q6VwsaW0l!XgSYHl|MT0*j$ueIlnQT3w zc}y^Aw5pw!mKL=-E9&1g9rrn-;Bi6Jx!CH{_pgFS%}ZC5%9LC^uj^G@jjtF%yXDUw zK_BxruM~p`7ZP&I7*(Czi#SV-{(na1<^8rbL@}=dqALv*=4YOvU74C zs_9(vf6Kaf_sU(628!B#4t03YEwe00+?Qu7O~~ELor@9o5QfH#-9F+nyXew*nej~P zdk23TkifGLm9BWsq99sW)tTG}<^wZX?7rxv%gWZ>D_3YwxZIYi5N#$o3!No|#OKO2 zVQR8{vxjg>$@R~fPEOa2sHb{@wbb=W&45tUx!DMV=BoD}C@FQxHk{(RT^&%ddt$pd z`5?&ia6MTSDySgeM%q###u$qGwDIU3ICIV~)ZaN>LT7=-<&ps0R0V8(Zavxa`4h_K z5$D)QkJ|N%ECYhR1WtN_rq9cswCd_nv`8k|*H7_02H)S^IeX#qk@#LlW@%{@1Z%ji z%%b~&zaw9(uw8nVJQ`@-fL}Ks`1Xr&FYN8!W!NXDF9GIK=Q|P!@bfE6O4h%0|LNQI zIF#aLZ>HjHc9fL?sxoHD6gjVAM8Ony)8G~I_4PW@e<7FuM<#v$+{XX*B=y4#biD(b zrla`s3&!CqDQRr#@ zb`{>ZoQs0K#qQudm z=T5&dq$3-=-b%uSIL zFijoW#4q_Pc{?NJpJ}kc;wyH9Xs@->4&Yr)vqmgf## zvf@n8j~>D3iEL+LZf5l_icgxR^sKkA>8=%7czPV|O(4KNfa;cJ-G(rR;(YK4o^&uN z4J)e-!dAkXs7N_w=CBJjUz~itHcs1t3!b8JH8TcLZDfzJhC?w#!B_Y6n|o+MdgdUA zN9VSXz<(Xef+Ldhk|`HpL)+zj1aAP6^nP#pdG^4Qo-0gA`L-px2wHvQAPO`%!=Dv~ zBt(qs;80qS-uRq?66EtnV5Xb5p>6@7#uKlOT@QZM}|eLB{>h^g+EHVGxTL`Xmt26^5AcN$th%t`SAHUoby1vW@kU-bVAGAao0 zATquSVLiNq6^Slz+v2KciH`er;Huz}r}r;;T=V?{N$i6gunzF{lck2OAtQh8ienjo{FY#@#ryzkRDY=*Ol8$;D=aZYPy+0;$j0?fvM9>Lg#!Y+^O#_44 zh?eU>6Tic$_6VvpON9C^a>#n1@&AI`p^mp0ZRA+fk5APRSBG}0pKOGC?!LzQyEcDJ zXl`&j#PJB2;Br`U|C-plHr$WmcXTKGnzw2y02a1d);KSImDfu=XKu;}XIhbIHGb4X=f|()-3Y z;LcpY9$db&2py-Agcjq+k#ZT$a}EI>Gw$FkEnEHEC@ByA#RAYraX^78=_EXA=m4^| zzQZIW2$(F2YxfB@6Fw|45qYy+IQvuY%(u=14n7V6?b^o8`*{v$9kF=ZM;k-q-^2jB)E12VC@n@+(ClEYnY7(`O?9UYhlT_2Vq2|sW(OLdW6kG;m_Xc+xNEGx-#A9E z!XWdpXH239U`ZgDZ#U(W#!tx=4=!Ysmfk@!FezpO_Y#-72_;x!;xYBMlrdgDdY~Q^ zFl)AZq|Y+>HsFF}n40&fI7FN%TI>IT^jG$rlm=8y!#meluvPFq?S=cc4JssQP)LOD zpK+);qoN3X*}3%;*!hEBmHiU;B4Z=zau*WYa1LGQ;zj`>Mh#d^9NI7-Fi1wn_Ims@ zJ3cWnNByKSh(r1(4|zZz6ar#pu4op>3TVXfBm*%Z{X6Lcj(`_{J=KCODmf98Z8i}4 z(u^-b?U5>w5+n4U)9%}|ZijLQNDZpH$v5j5?O-A%{RH5WTqX@d6|8zNtn7)m(`5pk%_D zh1GIMf~F8u1+O$r+vz@#zr}Zw;gs!F7d<|Fn$9`i%21*(>M938dg!ANbAD)uVqlTp zPE7Cx^?x|IR{3A_;0_6qXZhuGlPnvJ>$8tvkCdAmxL;J9`EtxO&@HIP-Y2{6I|dTM zww%WwfqS01q?v{o1qRYHAgGhNdNd!?+%Y zCK+z#1+QuNZ1))PImY+wUCT3*%iemYP1|Fx9)fatin$t(`@K9U0AZrsv93wEyM_x; z37d1UnEgrHQMTz;^968$3NGlb2uLJu-ZVp{PvFqHw#!P6j+-x~&t)TkEG^{-e6viN zGH7H%1vMKKB-=wxfvy6H;LWZZnyGo6`JFAd)M6E`T}(9%Ue{$TSa1+#kCmqiVp8@p zzF)HiIo061AA>sMgJufHIp1vdcHvrHFqUDME{ClPPzCx2^h4k+k5$WF{P`{Nez9l* z)PrV+X~U>}6ol3)ART2-ILj9xG(Jv{Eq&18ya{Id5VET`+T;}K}KRI(lm=ZrsD zqmM(Y{`O=r)B5z(=Cz&BZO#dd)lAOG`J#qH2jkn@nf)I3pC4j)Ip`*B%YRYaKv6-^ z`WT5$E~2kXLeZyrc^e!uc7q2VHk2L<=m(&xsJ9Dg%8x)B6m5U?hc<34uqbiV4~nDf z!A}7Y_-z`g!FA!fC(&9i5Ek7}xd4t0K~dIQ_Um!D798Hqmc;nWZe&AgvFL-*Rq44f z_i7hCG4eUL`I)&339PyH=ui)!a|;eEj>3w9UY^-sFf~4kdo01pQ%i&MGMo$m1DWNT z_T$h!m5vJztGx49ao*$Q?SGwk^|~(aTlxNa#OWj%-4`~QqJ~nnUF}OOEKvANA6(cB zSeY>wnkNuNGF0WQf!ms+!iLM7wACSql*qRlYm7A#z8Sxv4p2=#iMiS2y=(*6|F7By zp4H&FVKSvm=1ue&JU{{*5-dZ`D&9zs5g9i_l!qYNt`fqil6FR z^CZ!_w|v&iM_smJ?(klV(4;FH4VgQ6jJg8iV+*P}I)xp9Cf}zO~_eBQ4mWj7|CfXD^NVxkHXtXJmi;d)=pF-Je$Aw*Dq8%G-fYLcU%q|MlN2 z?LWl0p%|huXZ<$k;Jg1Q6(4)X_ALFM-#&KN|Ng)E-T#i4v`9YETV&DC(P~mGCDn(; zN&?8ob2U)EyJS#LhSjkwY>;nKliik|SWW7KD$DQbyFWoiVa)m3>gdzf~b`toxj z+_|adFc$F9NGu2qFHl;ErsCGa^az~I8+Lu)DC*dZPX0}oW!|ppYqqV;M5>zS_wl<7 z^3NX?ntw#uYeQ@8+|_V~Qlnhe68(+X}ngRtl7_VURZ#B7YqlOM2{qY$Cd zm+i@&y?Kq(8|}GF-FXX**g8?$TVhAgC=c3B4)($~w!J1?5_r9YMPAs!N)rb{*Q2MN zOhR5t3KSU9qxC&wkv`;i+V#GadpT?*J_w(Fzi!;RBJ^mfCE{ps#2o1UKGzkIE7Tec z&VrwDb=J6zH;nCkU)0Ey`R>!8-bWtCAua*;2umWn-xSF&V%%8pai!;d&My*gbrB^! zTcd{?!PvCaDWUDCb5lu7#MG+wtuVP`xub`^?0k`N8x^z`>(K>6#inF!u0G*_27{Ma z;JBZ5oalK5{Ad)=jt$tE;Qu{|ra%scf4>k$&-hs%!L$wR?&gB8s9xGo7>f*7i+ij5 ze;BLC6AkHB+byfhy>>Jf-r#k# z7j|+XwyIs{Sz{8fWo(E1j%gR8wn4$u61idpW2#JA>dTr- zpgJQ%Cbsb|TZ%4Gf6TcnNi5C-_o?4@X6H#5_DOpQPcd}gpsWlT{YOI5`g6AYrzHVE zK9)m>)7myQj@{o;ZPEWyqfGv0MkV(HG0Oe7>2lBOE~RuJ8At6k&=zE!N=}v~J6NnS z@E`mzNPov_SPJ1Sk&}bUO|Ma?n6#8sQz%mwwLV69u?*zBDi;c>P)$$&u-JgEOqz|? z-bkf=)3lvj7B+Kl|JNCb3rC0J+qD9}Q1|Wnluu}vS!W<*=|e%=H}|gA9ZGT^Op9q^ ziwl!eVJ)9-y=<##?UH!%0JI{oFt)s#YqpU6jgAV(3OvgH|7SterE`r6u6{(bYZ*_Khg8{p43KHm12NVp9i8V;d#(ecRNT4_Eww` z_2EqDmjm0vCBZwntAc;Lj)=+0Yd$Tba7UX?x^c$d-&Mt6hr(IUPQxc;Z^Yr~vQ#^( z;uabMtEX0GPBV%}W!DK<4(W!Qci2?^PO7VTuXi*pGo^zTl*Zp_#mkszZ+~E%6Xx8) zTecfC6SDN|`E8KTPkGTL^s&Oa+C)TOb#n*I0Y5=iT|CM}S3*y<6t~c7H|a1ab`+8+ z{}h_937Tu$7EeqFx$g^cEX6khH$JXvmJQt!(ZH#8N}3X$#AW=4Dma@X`DN{p=&9K9 z)2Ait*YXJp(FS_WO@eJr0c$M=w!?j&v!a;9rEjrl%%IRQyy97+L>U~I2)I2z+2mz( zZFbk0TD=jn?cTTv2me24@sD#VE%@2$lHGBRuII(Hq1f-RHTdi1E_NN~w`rH2qWP00 zZX~4d=ZD-@~r8Gy^8x45a?PRX`hhT4d;*EzhlAn*bbt z)>0TL9+3oM7h`rHuYa-W&rq>%6t_OtlnJE?kS2cG^nX-`bH(wr#?A2?4?rv%>IOk2 z1G0-5D`-xnSCo{fFXkoz^~o;|Fh3b?LxcbsB_fFg$Ln4b%-zS}D9XI2dhFbkOO=?&j8&jBJu6hWFV= zuKAu!mgPxc*XQQMyl8j%PlEtPMzr3=BhRfN({)fa>h(Bkq_dex_S`jZGwSz9^4y)< zM|3ejcY=VNrsBe$)p>Cwdu~{L)}=I8TzM4WxU(|34{8`c@G#wYkYL;vg^RwW9R-t+ z2qMeXe4vf-!n+@n$E`GBg}lvvt0tNd*Q}knHy}0MT8O!xwU_jdZpIC9ZkI`^!!Z47 z{S_Kee26omsThImA-uGQo3*8AaZqfE@3O34xDhw&v7tF<K;p*!6OBt0Ak<+-{{ zb}H@4L-(gVblq?pl$AI7HnLrF8?{LF$4$x>vkBKYBYZV*7#ydN!e}4wwI z5B4l&F1*D~g7ezJbEz7Eq@%GM%zBY{{pV|0s{Iva<<@N2E;R34j;*`xy=9Yu~8VFSAY*Gy$=YxNVY6d+}uI zrhkMxVEhoj!8oEa62EV=S==KecsMTvE{t`ngh;i~y!2A$B1nQ5>I+#VL~|evr=lk} z>(Ds4`kfqn1Wb*uhdC*9j9F2qgh(yiKrDnyo>2UhvCp!_oPSs%dAUnzoHfgJ^1FAO zkznoGHoa!&8CNfYD4M`ud8WNJd+5$4#$G;k2i8Bku&@hZ zG=UsS?+^b=4cV`{ybjkL7JuGuo6i0C5mX22WLUyvK~irZSpH?ojnIo%=9vzl4KwE} zv4533%*_1Dbc4W={CVqmS*e5d&)aogjcC1@y)k@1Na4`!qqVODy%9=#iAOevC1nk4 zo}=Ny5FS+O^@GQ-*qZ#bP50I`JuM4i_IZ{^A8x10t-6AJp6l2qYC^O|m=Ajd6jjv; zPkK0Ub?&_VIs$sdKVvZ=Ue$PuumSy}6wUBL#NWIgVO3$aKOFkB$hAK1k!!z>xDPr8`sw*ZTd$+_rCVs5*d%za|z9M0-PgS83{|C3zGA{g>FotkU+|_td)-i%~-oLo6PT8Y+x5Tx!z|{ z2UnS{U$R-3Yg>`v-u71<{P)K%dZE#B>CEOhYPagy1JaR2aRU>ethTQeD~gwP7u%q~ zts_Rf9wADNgPIT$UYI7iO4FBl9eFa(Gm#+E6Nby}(r6+D0bVf-a&JGK5t4KhgR@^3 zh$Ln~R|)dcfgi@8QUo#cgBZX_#QlL5kD=@VoC2`W(l6RfioZZSGq$qu;!f^Rs2`LG zpv}xlllcO)gEqdNB>PFEIsn2+>goqLo6Y(DFAj4m$UKV43)^DuTYgEVX&&|!^q}LC z_KV^bDDd^dG#P$7yr^!G;i-Jxs)3bqKsYQAW~V_T>Brd%jQ&@Ag-ko?A%42pwBkq7 zIRfJ*&A*R*Ha?F`$N2)cgoIY$9sy#PT*ax_0CG>OmWK-Oca7@uq`8 zFo<4_l#&~$XfM&P5%fI?#^hAw<~~2;BY|iIb4B|`IZX&RqccEH?6JB!rP#p+)D;f$ zTW^GFOs*qJFv!hAarjwfZGEOfJTcZ9QG=1G>Qr&WQ9fW$)pb3^@P~HS@sy9llpV~H za{1jH!X%*xbtb7k{mBU!*<_tvSKS3OqaH;@;`OBw?C5ZNH3z$1uHi{0+OeK~m!PlGD^N#J5O!U=hQPx%e!U?Z zw!Uzsw=RMkarCg8Nc2M{h(~W~{1TwOWBFq~Mw_$Id`lf@hgDjG+I7F`Cagp!CKMmo zY*t&&9W2?SAX<6DyT~_UulO(VP+etTDdF(#7INf|-`(7`eJTQjy4NCQwa?Yqt>H2! zpC;}dSRbq$+;1;fMU=i$Ds)_n9wq6m?)ry1;JOuKFO$x%7%8TW?Pa%qkT-Sj^#7Z5 z7%MiUF;tZH7@=apJNCd~HD3ePAp~LCfjc!59wDVnOZ@VhGF?KuXh+v?JX{;)m$D>! z6jI(HF%*yvWlHf0lf_#<=9C;JRzL0CR${n_Y5Qx3vc+-mIl-5C7uuW4&9#-;|ea*{o;Ha7?0NY3Stb+E0G0|#3Z(Pw9iZu4&?@O6o@eE$gvP|f~Y z+ZU^mJGvQLxM=-Mh^qa%ay1JxVeE}x7vM%gn@b9U9N-(~T$a8?mZM+iDR%4Wm*xQ; z%Uqrc<+s?!i;ov!8~O=tIo*Vfhh0f^oASRQmDEOZC!s810)`v(%O8Jtu0XpSbC99O@vMk z2Spv^F=q8s9}o3ucw*euh#{aK-tS-F{;f%Foq(xW`qmKSMo>&Rlu9r8h`GryC!G5q zvSPB}f&af`Mevqv11ENx+zU!6eHK9=?{~8E<-(bQsMv4xB!<3!lNFD4epcL2OBlph z1<$(3ObF_#4c#_!m}qf*A}>_P!Sv{S2I1$tt5e;k!8hB2c+`Ny!5ffXs+9YZxM1aw z5J`7Kzu@v%>J(v4K(TgotB^7#V5lSt7Z;wK3z<&paKizc<_RGoW;f#c{xR z$O6LzB5L9lQv2Ch z{%R|V^_>|!gXGdcgf$Gi=d{0LxBHFE^R7OjRrAN=!>XmqN2;y@!%eM_VQ1!yLIS;e zu| z|4fwo9zy*69j}n}f4PU^3mnYzHh=Eyo>LYvZVGX?uI}X}J0EFZp(4JpySm}EMcZWh z&Fa$J(S(!d&rb=gLd1V_4~q+!3NL$qvcNyo&Od^W9Aq%AE z_c>mr`l)ZDaM-nX;NUBZ(~LKjx`wO9S^cB)V}%ePZY(ZjIp9Xkr^k6z+iT375K|rg z^bVYht4KOqesr3}n&loN!^ijTHs|NSBpCbw>xQ*N*cn*B-2J#<%s5aDc`FnXQw^sb zg!w652@}AuL3tfwlw&7bRY5M=xEi*P0Yd+wrZhp(Qcgbce%M#{P6tF6^TUWBGNP8O zIMa4XN%X2)FfQO4*}3S|ZgiUd`FB|i%_K6QihZiB0pcSNbL?HiwVA`#Mq0>H*D|v} zMc0qf<=1g?aV2eAP>=kZ*Tq4K&{Ynk4t3PkuluyDd%=9~&p}iib;YJ#RP}`Xf~==e z?N1`1-Te?^uehCMm`!>2{CSgNt)6C6r~jvF({DoTtf_q#*GO%Y4xP7Yg^uhE1}{W0CXMe-MJqULDe5knlI=H%*v z%^`{7zM~-bQ4{4CLmv?I%^_my|6>$208wyX`a@l1-I8CW{%YI%B2&(j9i3tjHY0VF zBCD3J2~NSq!Fk#}I0H7dUX5FQuedd%E!Q0P3=Rq@ZOf6szconfO?WI4P}|h>UF{Wn zm$E}grRkqCVw5DDZY5P*e&e}L3Y1Q-uI3)sIfvo1EoR+E0*Xk`Maz13-_=aL)79!d z@}0CRGrU3&CZ(p9LYzJe$}wjODAsG|?Vmxl_)y<{`_izqTch2+=@X*sLzVBun*Xob z&ORKn6jyryiUW6iPAR1n5gkGJZ9$H*!}NZ=Z|w;=eeHi`Rjh}-+kTB{XEZo{eIuy z=Vzs_8P*^Am7g9}7ggT*43l5G;mlW?a%?!dwhuHMTBXRX8M;@>SsKN+qr|jIyW|k^ z6=U*MU#x}Y@2{B&=S-a%qnhi(GzT-Gt@ag$Crg6fBV-B^Cl>uC746V)sJDGaCg;UB zDiCZrY|hZHW)}h)oRKWsxXd;~?*VPw(<(vnVGp9}x93eUVSBI{qJ1Adgq!MKLI%!C zKNq2I>656+t+(UHF5S8ZMbUX@L<#VIoc(#}$?3l}}>ycsRfUx>$exM_Mqz zM}>&5TpQWdmE73WLCr1?_Pn**6s2yZ$#WKYXd3VPbI7?8!WH%5em7_G6JkF(!=x}f7#)KT+c4F+Tn%ZU* z((Oo~d?dl~CcC3CiLr%cQg?6LKU`es=*J`Y93$XjzfK|aNsNTjWo?rmX8Du&eeSt% z`N=7K`UlxkUyQ8>v_98D3QYUg=?VM3T zBAT{c{M!o8+;)!&y|#qpnI=j5a8zO0-j%~M5PF6U#BhYDhbaZap_U)0) zVd3F^by1|K%xag}an8mW;G%f5Boje&yZW)c(awlEB2;xbt096-i*=mK#Dws!;Bh!! z!d$ZYJnL-I%BLjN$J$nn0rSMMBObN|E0~iXdg3cv{R2FpaYrOq`(1;4^W*0wtbzqo zIomgMA#D%Yz~y!!^F#@U2PN8*e?kz57-8!lF@w1bJz@5EYZW}8IfLHK61#CpWyGV4{NDRH88gDY7sp&E472M7DM32X& z43OO!qRz&hsn!#GubSO`lI81Vx%X?dIEy`2UNy!I0_c2S2prCQBJBm75iBGtSAaD0 zv@&?L+EYO8ng?E(zIaf$wjZ!X@qn2~|9NATFJ(Y1uD%m%8%G(e@{<4#D)Brg;@;tc zSZqqlP`F9dXAQuGkH_Kchs+3V&I6RIQ;|sr(LGV1gbhKt(qbLXTFLR$nBKmJS2kbQ zl|H;Om3n%4M296<44v4Uj33m2+0Q5i@3G=+qs;;N+^rbv|T55dj zF3IrSiuH}i$$s|HYxZM72(_)&tDRw&KxeQ~VmZx5St~PVZHN6JFDg>?3v=K`7gf$9 zyDmH3B$3=uYR;hU`)b&Za~gX_ve?TSlBtTMJ?*M8m*w$;2U1t6i4=t6Q2MtPB)3g# zfX{L4MRU`2erAW#6SWq{Bi;O~X6bRg_4wsC)IaNB=LM|argqFSV;!J*f9R?x?ai5) z^<2KMUH&9+{)dKtRU!=d`R;HqF7nEsaB^NW<$I)rX9xrgAx;HkXJeu@d?-l~F@EF=9PSLPFpw5( zij>J@<#^++e@R-eB|6=xI8NP-JlAxJTvi4I?fyWl)`+tYf5;1h6%L(i0%s%01LD5= z{JFud`1&bYFpo9Npb?lKZJMpT=#rY?+NG}j2*g8gvq3IBQBV^IgKhhTsGcL5if)~{&3yV9w-3?YqP3Jf`d<6;Q38u*3e)P{zdHdvV$biQqH}`TS zcppE%T9n0HLQGuT3!QE6WoasPwh#lQhqnK7|4o_pWmb68sA0i-avW z&jDZ3H%=*t1MP?!U_uIZF#w!{%zxI^jePS*Tb_aMZJ|5P$W9IzXb)T!X!lyu4S297C*zO<&z?Oy z%wHQo#MkOZ`nImKnaE8&1$Y_Ra3Sfl=C5=?(DxmUk(h=a4U)IngrB82J5fL`F8)-o zMZN0V+o4~W<>|ub%X$0P-VSUZn4XCIC17fVAw6OEJj#yv&P5iP_3892Dwi8n*c}Z9 z0>DlfE2%@3EBmR^$J)>dFgJrgcg2lIqRqmLS>zid|#|B$5_{NfHCH86$LjD~V0 zPhU!P?EF+dJ3JnR0B%xgnM?XqZfM@n;!qZqY6_Zx#t5uGE!cI>dNtDF8IMD~vIWBW nGV7StZUTth)ngd(Up@>fwHJ6kahUITb+swd-PetNG$P~Q=Q74x literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/windows-atp-service-users.png b/windows/keep-secure/images/windows-atp-service-users.png new file mode 100644 index 0000000000000000000000000000000000000000..87c529be50f854524262b401da6b15d4f48077e9 GIT binary patch literal 29294 zcmcG$1ymf}x-AMxaDuzjG){1L*Wm669yGYSH|_*$B)A0#5F~VPw*-ekaEIUyxAO0O z{(JVj``mNixbO8CP1WkIu3EL~Tc6B17tv}eaxYOyP~qU1UQ!@%x*cqTkwc^_t{LGA(IED`bT* zX;M7482PZ6;bA*@H~wgv?h$-PTJ|KPp)dLGOqsYxP+tk4FldaWX}x_BmEL1YKnwW- zonH|_vunLtwuW-~T3vp)38-+N`s(9;wFj;AwR-P0{E|y)D7wXEQ<0RkvnWAyp>Jd= z71#A(uCDE&w2-vtLSA@Do7Y`a2i;IE;xF7GRr@mK^gNhKdeQ6__J|w zHOuo_iqvt*I04VvE~uGH9p${&W~JnsgX(!9V)wth zAyJ7xJmWOpdb{a_c5esKb~Z&v2Muf|vBoEB3AoNxxUS|K?T&4uWe1GzCcrJU> zL*)`EzCK(oCXfk$s82wg6cD2hzZPZgL3}2Cc`c!O7k9PL(-E%mjrwjLqc)G1;S;gc z2E_C4?}zE34@F|>;5l9nTLlm1E_&xG>oG9dxX9I#>;3h~k5bh$Mid_Lyo%g!?2UDZ z+RJo^ofPlB*V-HU&E$I@%yHa?gru`!3zjXVP4?Wc_QBLS*Ng1Mh<#H(-2D36C<5-- zY6K3zpV#@Z^D+k|h2nAR9Lz+oa-kJ*wf@K3rmd$QVTo+`9S`f6Wpb-+PJ#0IOtgcv zk13d<8q(CLHScWtok8v9bZCeCDm|moH*2O}4?m?$#IH*)YU z_C7d4=;(_S^y;VQN@eXbRTX+#8E-|h#deRXT2zjxzk!(4_k>hdJ_b+n`ABlE)gH1p zeyOAX$qN5rlVrqM_<;iB0nV;ED!GE%_m4UH-VYbE(M$eUKQ}J@i>B+$`>(59Mar3f zj47V{)HU1q)F+m7LddQh{xC##QZ<4-{`aOufcdtmg3!b(cswpH4wwguEB@0K%NtFL zj(1ypuz5PBk55C)wG0X(?k}yVmziCA8aU;I|K5DeP4mAeyl8mnzkhCOF`@8yo9}99 zs@yo`dGUh0q3~Fx0>)BsW|+V1wf=H2#tF|rehQk++HozpVw(0U+DQmP8I7uqlZDn6 z6tJCPFP+qCFN-^Kv#A*}v>sz%;(OTW^M1-_g%GQ;AvsR1{YTY3z8V$zOSKigAa@Un z!bf4|-l6YQ9tNDk%#bMr+5&u#zj+qyvcx1RWbKx&F2ttJ)f>e>Eu-VS$VrF-3zl4Z z3HQcHOfLQM(w{!tkjJcURFn-l7}({&~Vej@m$RQv0A#1e(sr>&LxiToxqy@2b#Pzf$xARgwtX$zlhrad+E@jkqjz)5nx_< z>aFdV@smnR4s&|C4yEk4+K2l6p7dOKR71$b^pOh2kp#wQKbkU=>0n-=c;sf@sKYx!{jz;JRm^~UHFDzE^=}p>oTN$ss zgC#HQ+7@*zSBOyTjNfHrV7gK_sb@A2?cto^Nzc;KO=?aAd?*0=@OtaN@ep}Y54dLpN)%+TYohS z!XLMdmr;;5jYM9ss+%7ex(gOO1|m};14i#{3BNw1!JX1)hZ-~=u?Cej`*_gqaY&+# zzcOPpqILb#Y(%f!FqSyRGls+b#1ZH#dD|usTp&)4o0`rAZ06I=Z5=?!Q58OU0Y!u9 z+LgmxqmO+N_WCn<%54Y$?~hd*xt6@%sQ{;Dv@>A#PmU;OLGt5 zuRSHF6|eQU%vd1A$VYv=t`7j;W(D|5_#@xMvW?T0vn57WAwr-czPuH*6f18ihx|ew zF zl%rsw{QW_8g=AC~y4wBsVx?SDarE3=vnZ?x5|=eaGld5z3RR2=vx>g{qChW}B#6Tq zzW0pKJaS$g)rCyxVsz$q9O(s4A#nsk9UN5^L>}uogAD^}Uq1dD?>X6zWp9HJ+7PtZ zlp=cwMhg2?=ZasD&^7pW_1T-Hcu8p-S z9VjzzB{sZi{{2z2zQb>yo(U9?pQP(>|Aj`BD|cTgAWQuz3>-ySu|YX?ewe>Uu?HBa00$=3<7o7b|>0G1t@g3|SeKSJ>JB|BKrnUUax0B+DkLW7X|3+2xC~S=8B}Z`Rg`Hrhhf#O-IH@!x;<=U&@6> zelZ`g9O>M+$1F{-;(IKPcN-1T3;6MKvBPG(~ z)fnbV51AF=pKIO^@maC_d90T2n~lD_U+**YTyjQ&el+nY*2P-mh+U%xamRC~@#JLqriBq>Xln!_KBm)>I>SmSpJI zB7>k1VRcr{E+Q9CCg5|v130)vx945M8Elkd0c74MPV#4zI*jpjx6Muu*W zzkmIRWAE~>BlWlCc{LMpp*rE4%hvT7ZuSzI+MD+sh+Z=F#hNYZybFl)Uw^zi-ac#D z&a<=NYq>jWTbzp{9T&Z0f%eCfYic0$0zR$wPg-3$09Sx(%AcI1CRoojTQ0k9sxl1T zsT#^8uXm{22>euA{9*7;qDN=ac;{l)RF1y(QLiIp^m3;tVJk+nr-&&kA_|%IIU}LV zJIR`%%yI^{H#bylZ}6MyUNt7lizVxy?Uq7WLEe=;^{hsn--I>_A}P#NaR#f!len!6 zhN=r?OjkO@?UH122x;xUUWyr90qO9NCvQGgrO~4JOKiDP8x>pWjS?_=*9ButQ&gEu zZ1h*_k}s#YtN4oe+2RtX-8$#8HeVdecMWGUwgLK6U4^0=}GY@snEUl%1e29c`3X%uxVw0 zZes2%GxZuw=?r#Bu8#7p*qbj->R{Jte|B|jv8<9}ZbEHiNY*Qk;%JLwd(#)&W!Rgk z{@?ZIp9dWf0C#I^9+`V{y%c~i=fm5z z*sT7p&t9_I6O9Y`_JPZKVUD%oP34;(eSHzh^S5MTfsgmym||7egDLdmc_K<-7#od} zqdR2*qUxGt z@Xflf(+_Ly%o8O;8}Ekjs-q0b#$>O~@EABpnyNLjyR_7KPV-0QZH{=#dw5R#A{gI( zc01KzC{Y}2DlVz6B9pFBd(byUHPbAj?k`%H(8Uq#Cr1@1;hlE+4r#JYDY^a5_j2cR zxM_d@VlY3nWf&5fB$3jRSyi4E`H{$Va%w@6Q`NLUHNCEXaAZbWIZFz+*BpE;`P9zciE0W6byP~17b{9Sc;={S1o68)@QZ24eBqzR&hyKZ{ z^7X){Zl32#od-g`t=gw0VqkRsFcPOUfre7R!Y_LN!^|NLhP0+trLBDZm{PI&b{_tf z2Z_Oyx>0yf&*Dnath6H)&(kW@V)>Qlms(Ld52TUiED0t>7O^Th2e2FAc8h{p9<9J#56mY7krZKelp@K)sWZPkU=ZmYDH z$^Lxbs(9{xX~*iz{jdJ$ulZlquk#n+!L|N7N;$rHsI!NLSKz1N=H;Rj%RYHr$?L zx6&yTeG&BT(K6gFC5Z#Sfs-5+r7}&o&hy>^B7YW@nsqt5;6Q1K72W+|;Db}(UGvlC z({*2iLu=$wwPZiHUV_MFCU}7q05*QKeq8jkH3^+Cb%;VDT4o|-HBu8+g&Q>Hw8Hu9 zXz?DM2D{hO(UrqYt4xq5K@!IR96}4RvHI{JYbh{?KP9ejF!`dKV!E7FE@%A1`;%}b z*v+WZ<0b5VmiMPrt!_cHpCq$wSPp?hVQ{Bq6c57%2QT$=Yp_kHLSgPmXJ2WeAKd^^ zdTNAjw$Y*#wm55J?gXD%;x@Af@_Kr9$9A4CuXctsuEcSf(FGiKqfDFfMK*&S9ogMI zVcrw$>7XsJ?YqtgQt!1Jy!GY$>B&SqI@_;&FtF!Z^PcVCI!YZXWjp? zW4@^K7cTMZ6YS6DK$D~I{O=$t16U}K^jx>E#|r_$j_Yd1(8>Q|nl$?ajc~b8oTl9w z@HrczHybIQKivtjla-IGWXY@B6mueZr^t1n5uk5^1 z>80M+tgdH=V~}^Y#GfEYD-!=94F)SX_=O~k&)OJcrxxprzuc45LZJTmhUm4nA4oz) zZl`TyZQdHljRDYSLuF9%oRL&Y5jG_OmIib8W!`XY=&qq}GKBG?(j-49I(I~>h(^g6 ztA6Wbip0|wtQ9CpBV!PPE9GLyLj$Ff4!E_Zvr{pke+&PEq)L~mVM}=aro~R!iV)I3 zyCciv=o^Vc5JURmZdl6H52B|-V&ML;>02Df(=(_?xs;R^6LSE!QRb#y`qNJw30Y{| zvi*%CpKkU=gD??)=k9gTN#T)`e7!44O=*K>A5jAV%Wr03!c(aid?|sSxcX|}zqSti zHcz6T^LWD(Y9RXKgrVh?qNUPr2FL{K1p@_DG?aW5eFEhv$xvE8=A>P`A;1`4I)gF$ zF#3paooYvZl?kNJ&1Ak~Ot1w-B{3fvnU7pq9FH8GRlG3a0Ir97pnISj%VDL6(P#>^ zxdbkm`-sd-dIEZh%tun^YKhEaKj7Tqo5yl!n!(Ke9Qfz(zSo0^rrsa_Aj7sl;-r&w zO}uIA|KP(Yu#0M^lX<*_5(0&&Yg|=fY<*HvQfyPmqGOvfPz1~$AVVR-kJszix*ORm z_jJyp(SciBP-@XUz7;>NY~3FG0yITbK~@2CP_zqeELdLiM0g75W(oQY{te2nff!Yk zn^>t&0yun(_llyl?gxq?a?z>^smyEA6jFz}sUrcKDbRZ`^m|Vc%f6OHDKaK%eTtDx zSFQb4u@SAz22*msh3f!?H+a@5mcwqy3|8395g(A7X|#GXb)(m=yXQ)PBAASpT#@dR zD7V=w(T;V4{)@VhFnaA8zgI%A0A)2mw$NmQRq8T{%6p@aq1=w7aHj-OQDOR%eSaK> zRTGP67YQ&}-T(E-ML$3|`Z5{o{u*xDe>2?4)G(K$rIrlSfEH!@Nya5Pl^lNO$NL-J zw-`u&rOJ1s;Njz7BnlgIB(yQetch>6vc3BFPaqk-7WTcY0x8w?OI`i$#x%Fiw)w^W zF*~HDvCefn6(0wbs-2V-L&#R2_)#Fg2`~1w$hB|Z!d;p`w_anNd(gYwvym-a3(){e zoLh|k=f9jFtcfgJj* zF3cp!4^0}`QfH?l5ASFhc*zLbLwL?WNVsYQ0lh^T?Zr<(F7EnN*q|kv$jUv*&%#(B8zAV6y#A>12-lGi&ZAh{XnPWi7db zLF}^SbE>PTnFa-c7>zoj)1Z9HQ1SgeD^{YPrU>#Qp9WWi%X+4S>6kA08W$iUjgr1KFZF{PG)x_2b?({1H_ z!H4ZSA`9e));FY!d1-c0Uxy~#kKzhjTG^7PbT;7`1xeE^ZU#P7l;-m)Sa|0oOYqi~ z=*j2y>#QCi-1?`_wy9Qsj;1IitdlDGxzt(0=imuxiLww;qb_d{PnUB&efw4x@9i4o zrkZiDR+W^2sX!A zH=A}llYT9Yap%MBck-3&sdl;TYcYb|c^&vH5!!p&G}T3*Rf-6%(Qb5@UyLBm5F;ll!u5Rv*DC`cV=(^PtHVb+8^rA97+Z)ah#IN!#haSmJ0D(ld^3^nMEJV* z8SGhRZ+$*}Rjhq87#+Taih3B$zh19Clj1a(<5`6^_H?a!k(KSQ6dA0dplAI^TqO94 z`V%=2DvNwqop>p{W5Z4m{Vt1ww#v!eSAU-8&hx5dzB^Py-soHmKiGUCpB0Or7Cv@h zk8P}h3}qftCE>eK&8OV9>m*lPuV_=@kq3tWh+c!PNN6pxdO%1QJw+dYc&5$lUoZvdG{Mk}Ca4n)KC#Uol)Vf)zinTQr67 zROE!n5Kdva5sKtamD#gAZJ zoLNsPePf>DqD+|^3E^`zw^_JC20MmY9d3Th2ka4>t`;xTB(Byl-QPM}tq9zxd?vmZEp~ z{JONjKp){Dtl{P00lZ>WpG3f)=riy8kAU+}w@G};yiM=`xU9rL>o&Fs{J^$)-1|tx zzRc&}fOFk-g(3d&yclqmcWHp5+X|ckLsIIF^JB%J<9LCA{-O_ymBF?`>oO0$rc2DA z9Tn0_Mf}0SH;J25I``h+Gd1A5jM`mOsUF|woiOeRG+fk!Td==Kc(R1OdcjW zb*G=ocrYd`9~9qOJkB=B=se0b$T0Wbl_wazH3mO5EW`NPcG-=4s>S-opQeR1Xzy#{-4c{PM=Nhj#emu zGACfWbDcDB>H#5QUB9aq;0kYnWMw zrGCcQ;xb4SR(KLUIb*BE8HUwOB&i@Nn&M1hVlF)wRLAVfclJ2s5=EUHM)$d|KE&;F zXSDPT*v$j7{>;L)Ng6v*4VNjg=UtHnO@}@cGo^u`+@0#vdh^ppOJLCuO2HS|L6>P8S#cp6ul}6fODy7frp#|p=da8Tmp&xjA$RAuDDAV95 zAV-6CxJXvt{pljy9e%ziOTvM!JWlx)A=G(bi`vXnQ&>q{fl0vQAd@M!N@3>!FRo96 zaMEU3Vu3JdKKcE^8~UWKfXtZ#o?_R}PrpqcvIB41Ooi`8C`GRV1NN^oR6A~=PbH&z zC{JYeih}eb2QME5=5E*G8ZxGe9#loI!o_aaw-cX*%!VB zgg3G(JcV+$0Ua>9Y2}5(voN92W-MmVsU&#Z`=sH5qk>u;z*Vr&@hsaNu~9lE?3Q| z8%i#|F?&-C4R3J=A|SgKcEZVQasB{bI*kcs?0xHSos)a}57$;*S%sSp(=%0NQ@J z)fuRXk8ETre-osAtE_F>b#6~PcfD6jMDnu^1rqGGF+JFK*Ut_VCx(M$YzZ(U=>VCN zKB@L$dX*S?{_3rU3rb}jCn>wm6jjliqc~Ewujd*mK9#$ZaR6AKFs|yqr^&}^G^fa` zPsqxS!2}|A*C}@VdZ9C=hK2Va_q0R#?lo_v?KH!}9^rIFg;C2CY5`H1E!VOZe_)Nt zSD)MScfARJTtE_yT&l3=(Gox^<71Lrs4G`P&%2vObR#flVmMyDpPK; z<-nT)m2G|6X78rzk+wO{9L?n9GEDcXeP6hW$#0d_uxq@ADSG|Jc`0xW7n(R8h1`#o zw1H^g)XCUa4sIMRvb!U$Pz4*dFg4Ea%)%ZomL?4HYgTo$0vc(k3a-yf#eU{Y4lUe+ z`BZL*UW$^!>Z8YeM1!jiyT1^pNv5>xJ80pj@wLYU4s}hLIcXb0UFDEI$GecPt?Igk z5N>~QS^ts{Wt+&^^%nL_5UV`BNNw;pbN2kAu`XDGM^h02lPe2Pl(_geGe!DM1Fzf} ze8id0D-0X+SmMzCuI%`CRo?%mR;fDDtub!%0Jz_#=t<#+^B(|Oe`YV0&EA(8+8e*j z4A98$%!}qdVVp?)5lRt2wC6yI`T8i3`KKRb_Wua#3bm$x@iKa$k1@e(09&K`hlPVA z`fd*4Z~Wn?0TmPpYEW23Uf|;mP|*`K`c=UmZ};UBi=?no74sG)>1PS_rSp7`1g04k zwiX)g2HwSZyfYSaE5y&o7rnq0cI&cF6{>s&sYKfW%HpU`O~L$v$m;PF2;c3|z14BV zqd1dy$`49$_Quml%}4HcFPL*|PWDqYOI3QkQJueA!b0NL632fSVVyGSe_<6M0=4kV zIj|O{G>g`v{g!p8qMrSRvfM`^5Z4qP(FLBo*+vPsqJS*jN@0pj^^xd?xq`lbNt>y) zSPYSzdzS`)1t|s4(9MQqSN8Z}{+NakP{?zwZ7Wf2nJ+KKu5LYNE0DZ%9&>iFOI2C~ z(UGBi5%wmlx(jmzjW2d&-r73&;j!2b48F(AHYp~i6x8@4PNj52{|P81tFWa4Xvd_# z%4~oIS3noeRqJi47`;NWVI82HpMq~U2T$AJx#VZ^7{!AXZNdo}h`R%de=v#XHAHDP ziR)uy&r!0nx7%N*8Cg?>qAdsmRlkT-fXortgkJFHDKTNcng8#@iQ1iQV`nTS6VpX! ziU~TLa4TN(xmt7>`llO!W7CvQ&gu|68%H6$P2;r!s_TJ7Q+Snbeg^mD%`@i$)71&K zJUr+3t}(O3xhQgytb7k@B?Vq>cvH$!)FXp$Vc+!)Wl{A&{c4)C`RYTbznT4JLd8`N z4PrU=ho8Z^-p%dG_ejE?381~LdD)y4sH~wSxw$H@Hmtne@Wqj&K2gVob2e1ih!E@e zzSE$6jw*maZeER!lO0dIzd;in_Ke%$2~te-!Tuxg5ONR#XrWzdWLeK6-*q^jp-M;$ z^(vELb`~f&KCD+2j^%7n&8$SbKVrQuQ)k?$Clc4Fkvz3Gp}&S(LJ^#2454tHgQY@4 z4|L(o)q)Pb35Em6Ng%;>TIkDC4^l3mf&DLaJ(=xa(22{xWU~J?0Pz2ECjJ9zNH&3; zPHC!&e4i+BTAG`ivoYs$l%4?)7-|4WDXj`q{G+T;>^L1_W^4Z)vNkkyQf3QYx!>Z$ z_uehez-uX{20?E|tSJKToqN&3ixa)~5M*(l0KQNrr-R{H%bm?BV++{kyQjhc!g*SF z*isZQU0MMs4G+arQo4)(b-^XG4B48z1ID-x15%L%cU`I-gdy)TXIgz(X&U@hKJVubDwq@sGX8o!_|_GED!r0 zOVCgAMBPjsIk~I*iwk-a8#a8K_6e0uKEu-E=vh9lIY?pBQoB&&Hny|C0D#d(BnoH$ z3aZR+{xh2PzwxvG7eLbg-j4SB%QZ_E=5Ad9tclkuy}yW0HR650lp|SjC&{E9}#lL_{@UYi>wqiE;uIT8bu8M}2*Ww$@`g z-Zz^WhPxPl*jii7tK`Nj<_60{MB6dMhRp@N?zdjG=Yz9R3o!tuwFYQq917n?RywlD z?Hso_61lr>$L@EHFRDw?<32-zXTZ-CjBz_qfiAjrQ3PS zbUJ2iatfp$owBD+CA*|P{w_BgyK}Vk*wB6d3#^(aJa}s(BO+Nsshg0qq?7ul(^+Gx zB~@}j@?#Zvdo0UEp-j@1n5v!B&j&cmKnXsIGI}_-5}cHgo>8Y+hoX}Cj}k+ zRt~%WdaM!QGwb^Ptv9)x$b>)_F{4toXb7?329{w~jRFYF5+wjZMH^khG9LKxN?Dez z#!9bdVJ8cmA8!Yt?xSoJmu$puL}+}WRw7W(E{=1XJgY!wC?nk!g=|02v^g;F;d@9Y zSe8-MQ``~Dp)QOeMKuERdDruzt?7&HuABbxqwm0^tRuh?rMR0X=G9daH!1 zTc@{7GHJSxX~)-OzHnlE|4SwS-)-~Oxf3-;Yhfyj$EupZ$?V(41P@hALcrU=(or?H4;po0`Rt6qaD~5^kMOw@FJ)JBKk5)R z%iXBJ8>gFY`Q|5quFjiX@628FZK9V!9n2O%v?1J%F8>qcKe#WEl$B}ZCiqjeMjsD{ z1rRV4NOJF&>>8XS4;S$dc^6+)w@#GWQ@r5m0qrg!Xx6owmb>ngRYb$~>qGRKb_*0903E!`cM@C^U;mL@DI@ZD2KtP``A5 zM5W%_0zW;B1GIOLvRxq<`7FYaQm>Gjv7T4;h!w_ZRZ`d>QTI7y$ud5|&jvE4z=(V% zh#5ada?4ViMjXb!c{h+!=$@HjbmW_A6+_=Qc$nYI&+lz}-l2d}C zq90SQUyb0{6Xmh(vEf0&u@x#tl^DiZPW9;34Y#KVXJ(3;rF5>CGm|q!r*8H2lSJnP zruy`xu@TGk)?NpS$QGEIfJqz?P!}}WaRIq%@2Ov!@QvR2OcMW><=onb#)qA8L7@qkH zHgY6Sp?x`O95^-8hqOk+oiXGQYHXkGR}}#2>z}$`2A?Uu`*!xJQj%9@S!dGmr~atR zw%`=QiN3W=IQAsf!03dVUcBTsDrPSRa^x6CMyM|d;mg|i!~&(nXBN_ zX`to#j1hgx$XeadxeuWV-Nn4_QeUOsL3DD97NSw0ll{Wq0m0u@cW1kR8G@I!U`0Io z_zj&vzvUIVU=?UD=_3{M^IKc)iBE*K6MURZ#a>Vhg>p-9hU5fayS~XHqPsSLH}}m> zShp~EP)>kkPU{TwbzBS=5W*D-)Uufrw#60ZKH%e52(VZrVI{TCMNb8_UlN3{;Bj75 zvSy*#4ia&<$KG6X(SvU;^CgB6xcuARFr{BIUj%U)qH`w&JEuz0%apg`2pX|9s>KX^ zdp+wOAtE!HtAIX1UTT%UC8#u&A<_hK9Op_5;-w!29q?FOcZ^vDnc_Xh9d%!c5?d5cO(|6_wDtTa#=pyZEG7 ziQ;rYSGPt?+OhLi}t_Su5IT z2UnR1SpCz$(ANp-;_7LI$<472@waI;tB^C$_?5FxQ6H{kX<3s~Nm=PNc8@%pVc9O{ zA|24D_C!HX)^t32o>+Zz8S8=_t%!vkB?|F3tN1d7V`d#x;9e?rOAf_wg>z<1s-For zw3YK%x<|PPm7>(OD#aR#3!fkP8j9|S{G!vJH?a9fW{5d=XBHifz;7^mos91mwu@ipxjGa!E zL0OYN{qt^Et7>{HG<+&FNAPT-mny22aK}#EhP$Mk0ilJ;b~4E*!xHhUUGZ>^K#*Dr&c<6U5fWliySEHVW!EY|PiC@w zg0r40EXUz~ZwZd$Koj^BfFKqNb;8~H)x}eN9o?e^WJwJqNd2`N+oVWwnBh`gN6Mcw z5;-cJ-`@{iY^|)g5d2ABwtXK{yU4(qJ8RZUKLAu?#FlJh<==qJ|1LF0zeyW|HRLQ( znwlj%qF6jaLfl`h&n^U*$71gv>av=&6PdPsR(jg;AtK2gBK`}6Mg+c~yMcVpWiQ~$ z{KN!c*#MB~(GxcIrmF$~lqvOp)*9JA4!e-c8X`z!^-!&642s9Z_350gmMlPJ9qH{h*jTe3CKF z7B8&Q%$qcUvP{<`u6G{--lJ!xoX{eDVhmq0iYG+!(Q5Q|xdKvcMbQ#vZkXKQ1(Hm7 zZzkSz9JR3Z4rTk`PYm(hYT&0*8Y*-t%By_-4YuJu(%_^A&c4jF58rF2lE=_|MIS?2 zS+;YRR7H_w$ii=4$9j?VOBijCvaz3=sFUr<+M!YF%7dY&g$-J!+TjhmTA_)AsOo-i zUdUb!6PfE+$-zv$zueS5Hb&D`mW(R7nI!I?)drPuw{mSV%Pt=%-{PCtl!cYPp z^w@6$0RUn?1aR8FHX!Cv@}dK4vj;hrtM;eS#QjF_LpS$n7>$8vh&8dmM=qL(Al3LN=lYx*%L$GS#?tWZPb+Oo65Sdgg2VC{uYnIk7VQ8(t8# z7PzQmJph6$Mw6>X1@hE(t1clbQ-)5g>xy?5$A<|si>r5kLw36y25@~Y6oAu#rwaJ! zVRM2^WPXW$mnIb~_l>B*n(Q^KkdpZ8(tXiY_su$aLJ)@)j34j#kB-1M;{Q7&%93;0 zdpnoc>M|6-n?Bct4hI{VFZ273+#SPK`aE9Vr40gffhoWq;5p@p0OdsP|8cYAN3GxQ zPBG!zY5G8bTfp=`nWTKU?yq*!1`y+BJ~APX*z4UNrEI1heiwV%U|@-h^+tVj+H~sN z3u-8JDkoJ&7>fd+b1p1e-I*)`mSiP_X)IQ?N_2UDZxJc<?>bY?pvu%K*`C79#@-$TC!BeFmCRXqgwSNEtm)io|OhwC_L>41>gb}9- zL_vqmcz`t8v3t&}`q0U>B7C)!5O7|U0XrM&PPh+XHcs2Thk!<$?Zp(tokh(%s4=7y zpS2{VCZM1UC4Z9syhF=ElJ&~`9-+|xK_tIZ zpK>>;CJlEoAeZI%?iNVUwo&(G=G9b`JVUId1&79ik=@>C?TfUsBCA|6n&l5(Y|>{K+WiP!32 zYEc~2HBlQ3>k-jCd&wC15kH1r9Rd9g867DvNgGV=tP5oqC&1a(#CH2ATmK0O3L-DlnglHSXgXe^e8-lMI^{^h-Qcr8;5y%2RN zW&dn>>%4R0w%=`fHLoPBB|7v)Ak(Vt>M#LCJTPC)G(*)cU^=-0w6e0p8pE$cYwy&k zlz|(;hsW2IKJ_mcuYE(buSi2BL`{G*b*FT4{bKMUnq4O&Ih(`~yPl3La!f@g=3MER zUWJsFdPWQTfCtuC%S0y1$x_-}Wn zV~GMYivY~i%4x^9mJE!sL2}kNZ;lFcIXE-Dw>G`?&tq}$K|Ro=>s~YutTWZu1enRp zv6b4_fa|mH@;zX?WVVCwjZv7x>Q(+zvjG|qZfpxEr9PXy1&As@Qx#$Jwaez-l^t+_ z|0<>WzX5*$I{a^f%+*F!ssa5Uq}bO2k(Z;KbG7`y>pbF;n|t`pU&PJ?>B5f*7Jv%~ z4GooY`d@xfwWb^Jxax#Dh+0s#p`^R~2#{xaw2`mwH$oFoqn~wi3X={(0IqA3UYs#pAnPFOR_*}E&gvvg%R;4fk#4Ov|Uv9r$q^rPve2LkDOzH z{tp>Fv>9y=mkDCO&LWQ=49vsF8UwExN`gM(MdeFLTdHqq;zn{}H_A&-TNOMT?5Ifm zO`HWRiXmIRyVxrHdN0O1yDf^y8={{M_$dsMcnXX*{tNz0{)l>qA82u=2ujq&GY|`IWnXYE8YprF{j5!xc zDMFo9oEb|}bEG%68Wfy&D{&-y)ah#I_+Qr=J<%qGV*gHZ!F=&jk|GDBA}%1NAI07@ zPbnvT3oOs6IFAOmC91rQ$NT5CeCl&EYqL$A+!OoF7J<_(cYum z859I3Ce#~C?Z|lJF8E2z8b(l`b1VTOiQFM_T{5Rp{-<5cm5dxOvRjVKUbaFl=`p%< z?NU)5XFU2sIZW)Ek1Vk>NEP2pL%RdQy>fr4OMdAWBR03owAA0cx=e`#!j0wydl;Z@ zXXo3z|8q-|3fPPZ zyl4VUulp^=UnBYN2*!Um9W2^Sy|2;@9dG`uGXmBn)pjgEbb?6AwgD}!!;keZ01de? zcX_=^g?Sy1xB_G%L3II}gY-~)bHN2xqi-TcUp{@f@8j!mo;CK|{jzc@vIr8Fw)aNJ zO~~$m3;=r6X2!Pnt9N`IstyIJVOh~-c((G82n=|DQ$dt?-Wb)rlMcl4u5BRVkLL=> zZ2;l|-C7d|7e_L&fE?8g2waO_q4)-%SlJ579ZukM*C=q<_3*<^_bQzlIlg%F^2qsRkDTn?w|=~-lqgtY+PGz-$$p2+(VKRMIu3~y4NGO7x1&&x)Z5N`KN2* zsbmG9?f}}?f}erX0mX*MPRzk-c;ITNZS;q3|jSjah z2KcIJPOV6Begs{G6^^zw2xJ<9Ju#ut=4jrlx{{GJCZcZ`VO{k2Rxn9szX;PLi*L0S zHw7{&U0$|5=lbYvALwZwhPG0|8>$4%7R=)FZ0kFOY;VPzxWl3sc5a_ zfNKnG-ix(!@%^nJ=AzBS*Q)*GGjWcA>3e3gj00&Feb`k!3mk%sozCyrrzdkl4QX0- zcZq|Wn<7A%GzsXSlL7hZrsr+`Ba0T+F%Q~}&@=k6bN;Fr&FnKJIifK7i5vXljaT)m zB$v!nG?xA|0SJxour6!I{r5O2$#UPj>j`2nncGHM$u!!eeK1%R&SF??QUDq2%C+!9 zVEV&8KfteX{R>6({~OHzN2vW@UI_?Gz`t;C1;iLYq$1+d#CUYw1lFo`?ANp{0JO)S zkFEUYpxZyLPy*AZuTm z^my!;pUlc>&RdWHRacB{^x4#pp2Rq2%Ub0<)TICxryd19FwH)*G={pzfC5R!Sv|GKZ&LrgH^ z)tbKQI%V*e-@DIrO;67gv`?$!l_)+(znWMDjmdoK=+sPKy44mhYSo`{Lcynw8Q1xY zFqB$I=<^+~?2R+NEbPoBwwyr<3V&{_@b&zZDoRZcS=Yh7hHZ%?Oy$g`j)HsQC%L(x z9BJ9h@UbctZs!Xxg0DXY&X~#~m0kgRt_WOvAOoihFT_~pQpdg9@B zQd`V7|Hwt8z<(gNBl0tmn9e_p8C?0K>3bA)(rxu%Bfz@f%EE+Uvo#yD)4r%)app*l zhl+L~K{(1gIWh01?BDh(AVeh$t#$32jdWvg5ME*oCu(n-BQ=Sh!775DQLddGLf07e z-VZjL2-_BBes_(qp$}Ju0UJK!=qXU*i}UG?Vq}v0+l02VmK~QLE$UxWh~wO)&PTue zHM8{NrlHJ6V_&}Q2K43DUcW+W)=>DeJuP-0F_sO&_gJnDl?=|JG&qM&=Hn|iMk5-F zLG6B+PTs~x5_?}%ksC{*VS_uK^BVC`a!5#s{+}c zM`ag6*PR8qpa2u19c>6z^d&{6Wo333n1lQme2<`-j1W0fVZUci`kRby>0|XBf z+}*<9?mC13!6o?M77`qSLx3RrCeQoS{=V9OcGWp`zH|SeilM8yr@Pnc)oWeX)of~b zZlaHf&biBt?L2R&|Gvtc70AEx!84anEXE|enAjBJCioG!mSe3Tk1ONxmkpjAuiYdS ziqxE>Coic@1P{aEb-F4mK*NImsRJp)amLersuOW?lSOgpw4E%JuQTwoII5Xf9Km-borG!FRNE2mT>o%1Qp2?t;+tbEyG9)-`^&+n)DG1P#*Tx0IHUt-#5tt z9s|Fwqk@-}3{-fA$Jyg0*45dABnqtg(A`5oFzchaQb%cW7i2!&Xv|oOj20VluSLn9 zXYyO(XMz&QJdTb=Zzw!~Ml*R`s3KZ3co9^U<8%ed{U~BWWa2n!WS(OaMQt5}fn!l4 zXEh9`>S9q#e_{Ys`tLoYF!09wyDBS7OMhKN>gD&%L57~u`((#GF5uc&H2(qta3_G) z8!_2jA*6rYf2RTfC;a>8NPfY8JNfTk`v1eGuahhLX7 zTWqeWsX6LriutPx)PjNy0iXmj8Ewu#0dXMdS=Myz@E1qjBw+mh@GA}(>7H>suW@#w zc=wmH51=g!&)8t0AAU&5BDM!E0qGR41!z-4*vAx8@9kux`E7a`ZD%1e|LdbZ$;$za zSCrN{kg-(KvwL!gz18P{Ud~Zip|ao;9SkqARP+r-ir^QxXBQMIp+B@9YsL(cL!>}L zi5VRq#}Z$LKfWLL)HJ@YuIO&GZ%CqoKA|})2KxwqTl@Xty9m{p4)cDwmQkCtO|A)j z?&mj^_%5zyDH(%v_RyOUOd-Bf`BPsN%49;)k5cxfNO!dHd zm_^_iK^zm?Le}4zJJMFZ7&kv+D8O(E)0YDXAt*ZS3IU2(PQ;A9qe+C*8t{NdH*j`l zppoCpI>OFec)Y4&q}M0!xXl{VU?hAK2cG;#<*OZ+2A8m0T<3rOAtuPD@+~c%+aI)- zY~ft2Th!s{r}B%e15wmyO#{tgjq~`kS1^|-J6Tb_Km>7P{3>|!Er_i^x(}V;Fi4E;@fHTZhq;~3hzBhNW zISOpg2EktE<7|j(B=Z=dLzNoMbAZsl^}RqPW!{Zq-kZsOXtDWg*m!tj7m7-rQ|pmJ zSrap9{&SVG3dcS&^^vpP84V#qd-)J-N&Rywk04B2@LL(oi^P?81_?Birpa6#@KqHc z=n|ph@~eDf%UYD3shdIhwSzn3%WA`nsny`eF9B{JZ9!s}&YkkHmrEJD^lEgvioIO0 z<<$}|Js$B?+z=S{&g81n_@Y z>Pz*RWXwiq185TSX)!QpWe>xcCk+-@#ykVs253d~xj2n$5^XPPeo2W5u)-?0iTV#e ziMlEr$8pmn2X2Os@p>qj?w-{e?s!?9qf6?4yW;oJO{4v>IXJl0>_D<`0-MIPBuJV^n6WqqPicNn`jke}`3D-& zD=lnvWlOyq1;wDu#p-bFSB=#80!bQTq10JVZ&k_JwUyAWgitIV^-y6ZmQ>V{60g-p z9mPSZjcUadBXOkVLxZzUVT|<=>bk`PgEqzS59dBc%SWvF87=kS>aXhrFLi?JoBXc)QkEyarK^p*(3 zC?B!g`SD8)C24yR^M5pktJmtbZ@HakX)-{yyiA*VYG(rK!+5rcfQXk}fDfs~hHh`t z%M{sw(rx8s$F5n{CoKo7Pf~p3Wg_Q~L@SOfXb$Dz5i5XTl0P`pnM#e*AJ&zJ$yu|V zHO=8iCT*bq3Cn});d_NXoPS-;M=v%~|QtJC?&HF&CRV-!gEnLQ_5~k_gdcm zB%_!$JQV+fG{-E<1{s<5Iy5Ij4M&LR=iE-zhxFHMJ$ZHMpW8+r;vkeLrSvL#$=$L` zKRzoTV~?V7eSK8YGYKw=_N`FX3&jUUJOXaGQ~n$4oSsczc_-h!M=;BUJBK?P+7f7r zIyEsz$wk$QDD@U0x}wG$gs{jF;ZuX%ZS!*O%bmh}6)k7AWQL7PF;Trq^c8 z?;%xNrzr77bgI>aijRTV5N&-`I6$vUY^brgra(922}*@dFwrCpe;vQWS-_BCT9jd( zhsdZI7ZF2V0Ow$)~oT0`-$n#bs{0-b__=rFz@ZQkvjr> zH+PM=kv!w2?)Z@}IeCqS^XtgU3zRYpu)UYOno$)dfTj-zI^vBiq^_j! zUz|G`S--{t%2ZdrpXD3Q=sS~4^2J>7md&9P$5R;Y2Uagfx?{E9n zr*3(;IXUzGWElNn6jqFNyJ-{Eq$J(-jC%`~rKNSZZDG@uasX0FZKb2PYBRUa-P~&{ zxTGmQyt`%RaX4A5mwQzocNl!jJZhs@LlI#`?hzd&Ufu+$6T6-Hj@hmKM0Gbq z;_EyQh?WEgVCQ>vZ+KH6?WV|jP@w~>aVuu$tBBkI)8^E%?aU?kC#CRHT6Xb3NCXE> z-Sf5NE06{J$esk>y&W=pEzcn(V6L|*+Sy6_T&};u2wUXY@VR@;F^*1S`EWqBtBw}g z()P)|IGP~D3K$A<#1MfJ9mLms#_kIc{oB~8t~VIkYJ`ld;%6UAf7!rIPtto*LQ1t2 zy|d?fGDvGcSu07Q9~XEtv^b?e;8w9udJb2O6ZryL)OdRE0fOnRxPK@xHW>B;w-4va z_&8wrKVwd*y085n@{N4=g*xVz(Bob_+DKg^rI-2XgZ#fo3PiZmRiZAHR-PS43rBup z^ddwyk z1rzU8Eh4%s>4l3q$8#S_$magF-8>5rb=V;e=L-K=bdQ&7@C>8z>75;wUiFQU+tJS< zT6;V2v_M0&sru72#KUGLPebJQqS~C{>Y_42B}J}8nu5R#=F}mAT1dIM4Y-83+FM=F zRo3?>65ToR5-kfX$Z&k3-2f1ff=yJCGK-J)Bjt3f97c`}?~eE>jQmGa(@hg_5WVP& z#)ny*A7RibWD;JrrkAUQ9Sjs;xTwn!|5I!0jPCUhhnb%#!N zmd`i?7+&Qk9YG_ESzW@KF`QJgM&^q=l&KBsSEqe=v~C1F4}NOo$6<6_@Ko__@b&)w zO8KmXuqBh%B5R?@Q?kE;%XCas92c`ulTx&G3qHr1oR*ji_fEN?{XnP>QDBn9RrXj0 zm&8t?XX)4SkKx$h3HEa2CBN6t6Q!O`L#tR_9D^(bu2naDQ#x|fmpvOs7}#eGHN>dZ zDe%=cez8>?B|G=Y*bgZf#jqoJX_w7s;avPw7!ySvWb{=Ch-$xfLfkhdVBS!4XCDeS z4q>J@B=}a|S}8#=bO)H_HU)RmXBD04lIrTj(4wLKceu7f3A6gHwwRdQV5roUfq_v4 zpSckRt7|SF>x*$o1C~T9MpoVH=1$Jub$IAS0$xWHX9Ba zw9i$GG;bCeN6379yu&>qYK(g31`_yIt(Q9)iSl>gA`g0M*(Q`w&3#h(j20BL54b3Q zDu@rHoCUs9S_W^OE}4q``TW)#7Z%qQq5f&{C_$Sv*k?S~;S$f{dVEGl&8p#Ta7pI; zanc(G>dV!4(Qf3^;NO)}u0rL4Wa){NHB*gUG7eNE7%!&t3(HTIwae=Z_P}<%-@r$R zhu+GMs$Sr)_YYa}<9BI5If0zZEXy5|BCl0v-lFT0X~ozIthPrib$*FQEwJu}|Y!bsRKp=&12yxA`c zdDhH8L%Fkx=+fg|$Xmt90oEAl%N--U%mQvQ#!L}_Qk7#Us42MhM6gXgDv9TruQ~MP zC*0xU2sZ)>;x%Zl<=o4jbejFPWJhT41K+yLgJIOSN!)(%^L-sIL058&61@*Js}vn) zOGfzLJWd7kFRn{i#yxtMZ9F2Di0Q`&=QoBxWpm)J?#*>O_Bnz!+V%Mhat|3yCh18Z z5gTfyq`h)uHdY!hK|!wY<32)#tDRQA-4asl64S}CAH>8ukD*C6k8IdUWCirSlBHjA zFk?=;vNkGbm_7qi4*}6C61%rd28V+3Gp>&MFUu~`sX^m-#Dbtc~V+4BR|%4}Hs%WVq&YtLq9ub|AllULyvI zfqGy`O1*TS922#)i(dRD=DKSYL{+4dD!pHO&MQvu3kNlQ+SY}e1n+fwb1;tIRzR5? zEZQOL^6$3Z6vfGN8Fs)l&^@A9DGbNSyIAc#=H)1;v)gjup5s3{am2}lzGpFw&6NbO zl%m#2Jf;vZ7VOuRSa1v4uxskq<`sM7QJZS{B{;%Sn+%McE^Hd>9E+ro7wfAYMFx!U zG!%iv)iEhkU*kU%K{`AZauk{=q^Ri(%jd@1GFI{$OP;R=yf5WSNS6EO#N4Eob}P8c z<&nq|`p+1G^ekE;1HBkXUDwA(g9<{foKIL+(Z&%uraS40Z8@MUsJA$tI9V-feWQc@^N5WLGAi@9-9!GWyc*P{`vv_&i=06P&laOa|4M?2MngP^1>svP^RsL94XKn%yL@0CL3$p*LrUV)sj^q zplO$(3~thSImuLMu5oq+OHPcYxiA>nImg@h?kfgj+Jik^`1WqSHA9y$rjXWN^au$@ z$8mY~rq;AavV5v-c5|k;ZQKaIoB-eW*V^}`e33*E<4+Kt0={)LnxbmfCqJ0M$pz}n zUnMv*xsT?R!;Y9lwMmp~hQ#y@O^mW(R&eelK3-@GCPu6Ruw`cD4Q@$iY~^a?NUR?V zNKG^$`5%Z|{T|pGL5!HArURMrNRczQ48727!V^!LSFXm6-Z6eyeZ}ab2Ju6ec zgsk@nKuCI1-7z+URZ_=*#JeYN=Ax<(z?w)!1yWPHm@%H8xS*YsbsJkDMo>%I!~5F6 zH&fu0L^EDRF)HM**q`+vbgL=YI_mCe1;5QF;N(?Zq9N?>_qJ`;_n>Sd>vai7}l=NcJT;gk%dhF zodE5);ZGGm4ds9GV`kK)gv@#@EXTu{bxkP2me7)DY>mE+>KVrl)II88wc;VqxEHI>Kdx+AYE z5AZ)IHylwi^>cdjn?qODYjxCLVj)T>&OVegma!)tbZ5DVLR9;k8|X(P1@1Q*vI+*E3Y9DDp4;YRDzq zHv<*xT;(X5MhV{lXd$p@p42@WB~vC}j&1flvausE+3M?pS`wPf^cs}yns44b?_!CG zu+Olg7ac>(Vo8Z^+I}iT3T4z9a;Ku*5Au7l!b(l<(K`9ytiXxT4NP}Y@*+Xtg>xDT zE<%Afa|IA%K5Bwqp#wdFh2e|OoPCj3xEXK<`M9a+j{1|oWrw=Hy-~Uk&ayH}pcQ$Y z6vP$gY}%2&f@8h$?R+=AF`ZXvc);F!&`$Ty6V zf*>PQX0}Y;zgftaHa(kz7hLL_FoU;cOerdi1E&i46E)( z-|d^WZaagraC|>ZdTkre{`(SHg&12W`?(_)9v6IDkJG4;#jd8$sr(7=FBc4m3AF;Yfz0tRm2U6M$&~>F^lv4I+0Jd8igzM*OZk zPO|ywzTTC}%_{D0fBK5ut@B;K%HwD5iI|Y-Y%(&6;Z-gPH_k}^$}Q1nhx#wC#{IN# zgn)S!Z}~bSFQ$f1sTz)V=R4l-6?mon#Ewv`PVT7NBy<_i*Z*r0RrM<*PNcz#t2{2o zyjvHJT6rTzVb;GRe+DFd@WcMRB;tvdk^CV)dpRo=XzX^{Wcory7dsos3@qmAlD(6D zm7@xiYo>VRU*bTHZ$bRlJ?{ym>j9^TelgB83eP+}GoahwqLMj6#~Jfiea? z4rtZjBam>8cD*Uy^SF_ZVrow{rPG;mzcLdi2yZA8c9YsE0Ah-`^evf>f4I)Q7r9Dh zV-lwJvN0-1S|+A1+af?!AwQdZrK(m*2Xc4_tQdg+ZbsZqTn6}9A;6Od9B53Ig#I_5 z@8<(kb!w@yVKV{upAt~|Rnicic3r4M+}4DMc6j37kNC#-)y={Ax0Rdkv+o6ub%yDl zUw-obenic8Z-*9Lqe%^c?{|74C`L0yPu`wPjY;T-Slp8i08@2!4?4N?g|77k| zQ1Kqmd5`79wjv-gy~f1QSa12BCV)vfeSVMWWSu4lGIumJCww8~ytk+yid;+%Rnt%- zfjwuB+~di{*pD86^F!TA+)o^?0YGsjb*Xcti^j0^;t}4bLHDnMuL=14Dk`(JPW^}*j&4=-vGRB4ga&5_Pg%(i))Iu>uyQOFGp2(!*jN`>j%DP10i&m zH zD!XI`m0}a#1Ns)GpFN(Y48lJ=l)u+DSJqT;xxR2_u{RNB=P1Upd%0F>=3HEc9#1O$ zln%lU57TTU`fBq-M$87iS3JgYKY%$wKKOOVUNuH4t^|q&H{Vz4?;jx>7=h**piC2PipshLrII*f`EYAfQ2Y!iBPIEhO2T3DE~1&<7%oh1P^g^6fq;|!%pJ}rPUBNY^uk` zTI9Cg6167}Nxo$vL+#W#W;dWY+Q=?8!DzVxp@V?m+8m6|Du?O(T-C>}^1K$qP0jLI89K;7&g;3&R}x-s^KUJY;8;vBPI?~79g8U6Svd)5 zBD(duC`(v$Z17Jl^SuV41$3XZ9$6?wLXQ(w?r0P%EikJF}FdD8mk|e<N3N58(6W2VQ92MX%cpWP$nBX zP5Kh;(!lgE+ha@CAHr6>b)Bv-*GQ}()i}JOvgCSD9wV{iHlUOQ#qHLwTWtE*vvJqOqyJ^g@%Q1rot_v(|`Nw@hD{=^Qb*DV$YIT zKAhqpKv@nh!7M$n*mue2S4b)59XGI#LCIqym!VE7!G50jLgs~j>>2}OE?BCfxmXEm zel5S}>)LMtjk*3cn0>cCWOntXPvd%7KfB%Y$X4>toRi;4hS}ZKjO5jL%BFyKbYKE@kyNUvLwMWpJ%Aq)&%=7mN(I?;RNQ`E>J|L1$o)V2LlP<(m`-{ z+=HV)NC7LuOGZ=4f>1a&leAxFd57m_PF^OJg;>CmExBb4g9YP-oMJ+y7ZMF6-G_1f z7{a!q!X?eOimLA6PYOxJ+-dD{)2E^%{L{pUdFso~($~F=Y|C@6 zHnoeCGWJC!^`2HcLzK(BFAUBRxwz~_!M&O>;h8LigK+Qyezo;7KyrbE^?KxT>uKUE*)jC`Lsy z2$E1%j#(r8BSmQ0_{fpIHkY)H6W-99Ro8n^@b{S83k0vnCs3I4ZmAl zGrzUpZQj7eBw^WJSG#uy?`|P$8MY~hk`2#Xty?pmZ3L|T7xxU*PrS~}?v5n?OdQ;e zeCYG4ydFnvE?<9LVYt5d8RI`GB?tKvk=~&rVB_l;B@gVXoSWKxbNsP+kLmsUbaCcqU)deNdiPlUD(?}&f1h&V`S&^e zpTn~Ms_5JUI|<5y|Lv-473W?~XH@cf_+C<{p9y{l=&)YhYw7gU-pldO(1edI<3`P? z0bSlptbc6cG;#4joZTa=7h6cZ zZbJ@E{NSIi8&~6t1`&60YmJKF_@jy9Ax3?ga7C?p17=(=p{to0|1`4Pq~@?(jxH>r zms7q-i}+Zx9i-sflg z4Wo+ghtlC++C}81jUI4%8Hs|tv68ed2&jgM`4MiII52=TrEf3&eL4oppF1V#_@4;& z5Q$KPKYn3<#f-^Y{GoS`bMlTKxO|`)!`W(5jmy!5Xq$x7S{W%=TmI0cQl|o8q(MI* zjvE~}$tzK_c`qVF#PR$a^V=w!Uqs<$mz~%Z>tIPo+B{EQ3p(1<`0{TM$uf zLRrsTNty%hD$ajiNtV*@aHPt!Ue4t^B$zda@JVX57l)8d%3RWBc%@p)K703i;X!X6 zW9bV&8JhMd<4;Sg%6UQ&2pMSflmD89q!l-GuR#`N_~aNJ|(Ko)^Q zN|uHRR%+yM=f*JSw^aod#wycf;~I`geiDISuIm+mvQ*hFKjBQ_yY}Oxs#dPK;gqfo z+>oG(>p~Y3qo>>De09Hidrb}j(5OzP(qsR#se6^Ej3ndcSl5gQtJ5@FzYSbGSh?^^lo7mZ;WZ57 z;7JCvzqt7R;n_L`kCLZrQg1k<)^3aL?x%m`v4~ZR*pzLDh{GfomM@1p*`7eThG0#u zo)NTSvr5Aj=b6*exZq;z$$Hoy?;Ae$aaY+dW$J$F0uMcjgoo+xRb0Q8#N42FD+Fx*9y39hZHkdALCiNPm z!Tu>Wws}@K;S$5Q)vVc1(D43vg)-mDSb1o?oLPYNjWL7F%i07D`D6A#JVz3I?I95r zO9IiFjmyZh5-jli!-weh)Bsu)>5n&keR{fK(t2T4y|Fp%&3EWYd1OqKA&I-<*S-?( zrk}c9ktzOTTA2T2y6AD^zAfUSv3A_CwCJ-7W0Hk?%r^oKRxusxGdqz{4AA&=t93(Y ziXMN=!ohk$=Q(rm+6J{_%HTAwQMHA`5gsXpxPK*DRzb&TlDkZk2cz>)NVC=%(V#On z?(rA8hU*SZ(BcG|^U_o?+cI%lOPDI@BNs)fr=>Ac%#z``f9BqhX&E#^w zg@T-WhI3eWu`60;v8>mHTM@`s^T;{=_a_>^X0RQ@{gleter0r3X_~L4&{fUTNM5{tRrfvb-D@pkx5wLZ~@N;MmdDag1tZiyA z?w{r$y@j7PMO%%eN(RQ=?meSTZ%OkX##Dz~tTKZ?{$HAq!h*PXbcBhi=WPv`@Jp}EpYYo9p?N3ARg7<%F#B+GFl zTPwrK93#O1*4weuw`}*f;Ktj-owCIoOf!OioKe;P@3D*j_gJjDwce;ZIwi`PUD7^A S65x)=2g>s5a+NaXLH`TdWZ*ae literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/windows-atp-service.png b/windows/keep-secure/images/windows-atp-service.png new file mode 100644 index 0000000000000000000000000000000000000000..e2175190f47f37df0d6e9edcb56bb8cb7b5569e5 GIT binary patch literal 8898 zcmeHtcT^Kw*LTosgDWVAg?a@M=?c=DH0iyU0E)CkIw25BY>0?}hy-ayYN!cSN(d+= zDpk6)ARr~7gp$xnzVJNH`#sNl*InOV-yiQ<@0~Ss=InE3&6(NzxAy++JriqYqI;H^ zix~g_oYmLUwg3Q*$p8RM%BPPp+V8JWn~VvjAPZeh0J?{V$Pj+>)G*cn04fq$4(^>` z$Y=cZ?1KOR*0!UADMgHx8vqcn)z{Xr3UywY>;v~$X3F|YGuYWID{PCmx zfqiauRdQD&#`&8r%)>cS{dXzPo=nA{`OL8SB)N_y89zjycSA|sB`MP8!R{u_$=<#m zPN!ulL!CDFsNfOo&q@|4=f>}zndqwPL&82J^n2Ctt)2B*4^O#CqX~S9n61-~(b0f= zk&!?oluV%dGS7fi>Ppt%HI(3Rs*y)m6P|UHl$3CDb04jSzjNo z5^#Lg^b&NuP!eqckt!noP>{`AC!)6fd`(CVW;Eo zkJ@^((hs%4;DobXB2lWZz79%A?ATtAPH)cH**Q#fj$F5hKE=jY=K+O|z%K{vZ~2V; zkb)mJOBOoEQ^Sb;LMwO|a|+ErRQg5!t)B?|BS)^|zTUsr{iX0UzbSv1|6HgeaQ}-< z_rVJ0`mLxK0gw^N=u>OBnn4huvrFK2?-jT576p z4imf5<`+k+JgGz}E%p?K?t+6M5No997yd2%(t+*_`NP`CTHne3g{`fRAg3SdDo^R< zbZ37B}F2X!VOW2_T-qoA%JK60sbn4_EPyaMTSJih~b7{r% zV^>#KKY|R@4;JN9N8bA#QpCu6&DZO2u#23*Im~Lm$bvzKBDyN^$CqximJTSCo6LSv z`u{2T_b(0Z9eMti@m$SX8wQ`N2>n$#9SH;A{*4z1tmk$f#sZ{EQn6T9r zy;%!aBu=VVxiwbO4=zHm)3;xLFo46KF~`x}q}@iUOx|<#Mtdnay&jhLf9vvXCUBeE z)*%8ms*kCA-8?PW5O1E6s&=vr8pYC}*$d5JaB9gGo zQ;k6VS_;&pD}|v|Ez2MqsF6Du-W11Mzo1Ec2g9*Z)}ZKMJ!G*6w|2O^+0_I@_h78a zpuleboL1F@$=<^0rFh}4q$(2y@qb#tH4C3jQ`*ITx;UE7QU0hp^nMm=G=wYWJ;VVB zgxvG@77x2%uyqPXe{Bx<6?EhxBE+-V5WN8?93tZQ@ z6+z#>$1gj@7T4Y#hl1}cdsdjNyEiB+E7RtIu`T(AsW~c3U}%jdd}p;+vhHp$q9l0Mg&I;HgfepWC#eCaT7 z{)1t77HeZ0yP*0%@T0m!p^mu7=g&^3{#du~pxL9e+_FfnNBjJLb^hn}6(p9fsqd~W zu=q~xf0lBPh18M{e6T)pDk=z(gU14%mNe(yIOeUU=qnzus39 zVIC8eQH5J^&n;EnVqBV=0_R?KN?o^lk*jp%PHtd7q+_Av25|=bB}*|FUAOws^&B;5 zNXP`LaQsUmzpg!U1mm*pi>Z5g^2(faCK`whq0=H$hwfq}V|?iWm)Heuk$s6VK3w(W z82RT29C>cDE+`(p<=wZ(79c+%tWg zCp_fN+2QGs7|l`^(>iV5)GWlM`?=#%y;35Wcx9!j9h+^ZhV5X-*`@`xBNm%$jZ65= zD@FZexPo;Fs+SA}r=ckAykk6K42{hPM|1d>p8lu$p8FpwzM`QJ8I-*Nw?`AMx<2DD z>&}@D_Lw2y!Yh_qNTlLU&))Zt_^}tF3{UA)1)m?^>U(NBi0bfN`}K{3A4F6;WH?KZ zfgeF7a*u+K=N46o*fBf7J4PVbOwV^`6iHj9wKNpXk zK0PV|q7Xl@#~@Gr-1zlsKDaj}gx6%U5Wiu6JCnUTY%j3@7W3%5$sO6*(6SB>Sr{5VQtH*rN1z0D6HHU+?&oM(A7mMP%<61^46>=Aam#5uRjS#i_|a_eqJQ8Y zVf&Nv&DPqGrzFx)$zH_T&(HNi3%*lLxT>mL%?OED<}quH7)lX-%-RjfNu41tg}4n| zUE$kNoj$KO)W0(YmH zX>Rpkt~V^CiPQn14*ztXhoV3RD-&{8h}Gp32Gv4NqduEQ{fN8Kzs2BB>0^&aVU(2I zLT*ErzywgpqZ4aLfkz+))Y5fYiFI_&n%RrZL$5B(_SXE|IfDvtJ*Yp85>ZJwYM)t3 z;*oLw=`FMG7_Fwl-2J~N|3V2RQ3^ok@E$x~&eQRBCV=O~zo5p@G3)&^g-`8{k^VqD zQhFiuA%VFfc%dhYv3Ynhji7;G14B|d$CJ6&uTxE=5zdXFeQzJRef(9S9rY>J{sw}< zJ=6O$9+WG+CD4(PkzS-a#?*Ffe!f5y<5Zs$c*T(68li_vBN$*VLQ-$E ze?hd@sWH?Xr4n`UgPPCqtEAU=mk7ZPA;wrf=MrPXTDa^$zV+-t`}R^&ErBJSr^fF@ zd5rnTU}Nyhn;|UiZ}<{+?iEG!SPgq#F?1g!dIxEkqF8b|LW?`_u<`?ctm(SeawU3| zNgE05eXj~O(CM9XE1TAdv2a$c-W$0*6KgvDPe7-t>Dh=-L>$qBA5Cir)Yv*uSJ0qc) z&#gYcSLYS>)d32`bK-sb>^9t{W5z$9W7|8hBdKB3aQm6{cN4MUTR{cihddw1@%C>{ zGRJ< z^>=?;A`+XPhr8)_z;s@?>3h~hZN+)OZp>{P{Xg8?t^pHZ;+m!Kie1UYAThxb3k-&GM! z_5L)4j|I>V?*rN_sw|IJJag0h_k~|HD}u=coD4@dEf0Uf8jVI5mooy1X=*3l-M)d! zV0GrJB(*(Lq#9(J5rSx$*8X8&aHo3)hat&+rM9-#x+!e4prfg1(KtpMtF*T^tz`=u zIm^fk=eX91tD;=4^;GrG67IhiEt!J0mhCTHAKLG*+gL~zHYJ3Uaffcnj{-DOBOA zOyx-X>p7)Qv`i)l*>gW*<<1+P56$1L$TL;Npwk);x4}7#g!i6}c#3JG;ME(hJc`L? zW4(svmemX$ z4m6j4x?URcwbbsVuaHT=qcGd-8M|~I;x|LS#Qm#MS(n}MDKNT40I$SaA zs}uiX3iTyc1?yE@@M(bYA8r_9p74(rQZ~y__S1Rk!?`MA2<_?Ytuk@pRkPOj&-$&z z^+zpEu;D9y;oXmmS47_z>C4omdlf@ZUuM|)zsx)PBA*czmCe`~W49=F$M8@7?VJAO zs*c3j8x@q%JrpC28rUMmr5X>dMeJ^jcY=FsB6o--1_q<^d#hPu~}je)Ex^-kx|A2%~qtZ1)$e2dG!_i8-8WZ11Hh|);)jc79@X{NdnAc zxZa3Qj{HM7hd+vv(R?@xhmFW)zY>C!7-EBl+Hx^+0Xp%;%2wvHUM}w!ftUOZc$5$V zp)@!0QsBtJ>)k8qjalJuV#gL0H{D1J3JIb*!EWE8y{f(*Fa8>KGgcs#?Nxr=Yfxr^ zwqQVh=iH|byM9y;d#ZaNw%e@}_!F zpGAjRtgch9FQw5{+}qN*e}3bLkt7(`$;0>9&jZIKrcSFB_YMO?yKV(SI4gc}a=YpW*ud zt&Id7H{!-vkeu8{#qpd93Zt47#WU_gqc&HA@HMw+6Fz3M3!W-}rT~n40&a>wxDNPK z{yGf+Xw~#M2Kc?R=&KQQb)r6G#i8mr;PS`p2L;{T-J1)&!}16-OhapZ_(R+ z-96)CA5Z$Fx7u*YK%9r6>fTW2^eF*8mD(DKeJwo;$*p`7y(eA8N)U$&2lS z`vNku!y=MUsj+^Nfz-gRl+)Q#9zv3zfqF(sfqcEB9*#)jYbLaijMLpXCc~`(u-0WBKNf<5f+dAKPBIrw#x%qa_pvmHU6-ZhG2#%azNP=W1(Z79b6VEhjB zbwkpyIAo!lHIsuExR$R1K4_{|TXPoJlfPp7I zog3^mqM17|VaojuQG6?;m0T^@7g=k+qJUjO(k_PY=ymre?9~(F2pjIUFu`89$P#dv zYr4<3c%bL3!~Auji(%jNTHn@N-PJ=RsL?>qxQ>-7OSqBTn= zHI64>ZI0XGCBP?V_}G-6pZJ2gmRFR}CwkTk;b89~OfsvI$&kz*$jI`pg4z8dr3)Cp zV6BhmT6){Q!1U>iGP>)TQ&JkhHTbJhXKdGRu8sdb10LPGD#HYL9^LgD;PORj4uGrO zSED}-4q*4@TXriRcE4b9{qfa^Tuj~K-xz*%8Sp&5i-LYmC-BowGkwtZfZ4Xf$!zdv z05bs@T*-9vc8t0v;6_p!VQ6h?zm@+g;4R3bAbfkZ42_mkChc{l1#W*!7A70t-uELs zG}0c8uJY_%U0JCYCuvL;n}wj|NX92>2Cbbg*7Tt}3oL_mwq5(O3;9z!lj?eZsD2k9 zAEHc=ga$~-Xj&A@A34cW!0Hhm+5wuHUM;re>~^Su(ZTVa4&{m3wjM#q$nM zz!bi`#e(Xk_Q3rOKFCW)#M9cqUrPBZq>WM{yKyR}u(uB8#PTUn0pE44gE>hqQ>KIG zr}j*$p~6iWV&Rw(t6U@^lkSvY*`e0ib-`9j*S+jsSH;(Gcu$EzyI=K--?8<*>+A^fV+26SDswb;H(1x(R#+cKw2lo zeIPc;jkU`N9W0QRoHnR`t-O+lw>XXE&AYTGpaWR^CFqM(EXmO?tgp}4FJI@b9ci9j z`KC<0g>1vr*Nc;cnUmPGZ}OFT9u~&GUq_#CRphbt=y%leZpB35D7nrNdeM~@X`hHB zvow8FVaeAZkfleRG`;2J{9y8yh^ucfHjcX~F;F($83gK9>2nD%%^Q%QBK zP>nCK4lMfu4?x`M?h01ooyNgip8pvY3`l`?$cNL3=Kux|3ZSwF+q5;^(*Pmq0W23S z9KIv?+avZgBCws&b(FaexGeYAF#SvH{@+2x*e=SyKI>qKW&@|=7}bfPxtaxB2CHm5 zz_lwuUIw=}<1WV8zO}y3ANi41)Cn5Sd^Fk=vFmd**qRtswM!IB9V%610^o_EGM2xt z3SG_5`Egha_o01W)-xew&GomfuA-s*Ms=loS+V1_e%N_N87IKX%Eq`##$0Zg=nW!sHNdy*UNQY?D+Z zs4yV0&*-d*VuSspmEu+3o2XVVCkyqt%)au(ED|9^_8j4cVN*eQZ?ULs=|bb@kLsoa~L^UFz({e)2e74x9#PQ zH!e>=vmWL*h&f4V5w|7JpO9T!Yur!BgwR&MfyuOKth(P}^=>azx%q&fpE}Hv`JsKmv?b2D`d7nPEB-9;3aDqtByn`S_Lw1_{E%4MRaJ% zivn=<=JE4*=@MIAbTCP#7j{e?j`+b3E~&qS@dxgsH+Y4k&aN~|q2PAI%01+^U5bTe zr&nq3hB%ct8G5ETzoXB{olT1hlYrgq%i#91J=@4VSSkBcaA$1=qdi7h>f@*Fcv?5n zR**+!u^i`&^!mtDJWuWQ0GGYNav%{KRQ2sPnGLHPHANKQ{rEObKQd(VrKc&?MDOz@ zi&}TK0>q>NU>33rXS%h}%iq{d7kn|y{RN{3F1}7_*-)-9r0#!v(Bk6|pW()V7Mc2( zv*){jOVf`~[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + +Alerts in Windows Defender ATP indicate possible security breaches on endpoints in your organization. The **Dashboard** provides a quick view of active alerts, their severity levels, and information on the machines with the most active alerts. + +You can investigate alerts by clicking an alert in [any of the alert queues](alerts-queue-windows-advanced-threat-protection.md). + +Reviewing the various alerts and their severity can help you take the appropriate action to protect your organization's endpoints. + +## Investigate a machine +Investigate the details of an alert raised on a specific machine to identify other behaviors or events that might be related to the alert or the potential scope of breach. + +You can click on affected machines whenever you see them in the portal to open a detailed report about that machine. Affected machines are identified in the following areas: + +- The [Machines view](machines-view-windows-advanced-threat-protection.md) +- The [Alerts queue](alerts-queue-windows-advanced-threat-protection.md) +- The [Dashboard](dashboard-windows-advanced-threat-protection.md) +- Any individual alert +- Any individual file details view +- Any IP address or domain details view + +When you investigate a specific machine, you'll see: + +- **Machine details**, **Machine IP Addresses**, and **Machine Reporting** +- **Alerts related to this machine** +- **Machine timeline** + +The machine details, IP, and reporting sections display some attributes of the machine such as its name, domain, OS, IP address, and how long it's been reporting telemetry to the Windows Defender ATP service. + +The **Alerts related to this machine** section provides a list of alerts that are associated with the machine. This list is a simplified version of the [Alerts queue](alerts-queue-windows-advanced-threat-protection.md), and shows the date that the alert was detected, a short description of the alert, the alert's severity, the alert's threat category, and the alert's status in the queue. + +The **Machine timeline** section provides a chronological view of the events and associated alerts that have been observed on the machine. + +You'll see an aggregated view of alerts, a short description of the alert, details on the action taken, and which user ran the action. This helps you see significant activities or behaviors that occurred on a machine within your network in relation to a specific time frame. Several icons are used to identify various detections and their current state. For more information, see [Windows Defender ATP icons](Windows-Defender-ATP-icons). + +This feature also enables you to selectively drill down into a behavior or event that occurred within a given time period. You can view the temporal sequence of events that occurred on a machine over a specified time period. + +![The timeline shows an interactive history of the alerts seen on a machine](images/timeline.png) + +Use the search bar to look for specific alerts or files associated with the machine. + +You can also filter by: + +- Signed or unsigned files +- Detections mode: displays Windows ATP Alerts and detections +- Behaviors mode: displays "detections" and selected events of interest +- Verbose mode: displays "behaviors" (including "detections"), and all reported events +- Logged on users, System, Network, or Local service + +Use the time-based slider to filter events from a specific date. By default, the machine timeline is set to display the events of the current day. + +Using the slider updates the listed alerts to the date that you select. Displayed events are filtered from that date and older. + +The slider is helpful when you're investigating a particular alert on a machine. You can navigate from the **Alerts view** and click on the machine associated with the alert to jump to the specific date when the alert was observed, enabling you to investigate the events that took place around the alert. + +From the **Machine view**, you can also navigate to the file, IP, or URL view and the timeline associated with an alert is retained, helping you view the investigation from different angles and retain the context of the event time line. + +From the list of events that are displayed in the timeline, you can examine the behaviors or events in to help identify indicators of interests such as files and IP addresses to help determine the scope of a breach. You can then use the information to respond to events and keep your system secure. + +Windows Defender ATP monitors and captures questionable behavior on Windows 10 machines and displays the process tree flow in the **Machine timeline**. This gives you better context of the behavior which can contribute to understanding the correlation between events, files, and IP addresses in relation to the machine. + +![The process tree shows you a hierarchical history of processes and events on the machine](images/machine-investigation.png) + +**Investigate a machine:** + +1. Select the machine that you want to investigate. You can select or search a machine from any of the following views: + - **Dashboard** - click the machine name from the **Top machines with active alerts** section + - **Alerts queue** - click the machine name beside the machine icon + - **Machines view** - click the heading of the machine name + - **Search box** - select **Machine** from the drop-down menu and enter the machine name +2. Information about the specific machine is displayed. + + +**Use the machine timeline** + +1. Use the sort and filter feature to narrow down the search results. +2. Use the timeline search box to filter specific indicators that appear in the machine timeline. +3. Click the expand icon ![The expand icon looks like a plus symbol](images/expand.png) in the timeline row or click anywhere on the row to see additional information about the alert, behavior, or event. + +## Investigate a file +Investigate the details of a file associated with a specific alert, behavior, or event to help determine if the file exhibits malicious activities, identify the attack motivation, and understand the potential scope of the breach. + +You can get information from the following sections in the file view: + +- File details +- Deep analysis +- File in organization +- Observed in organization + +The file details section shows attributes of the file such as its MD5 and its prevalence worldwide. + +The **Deep analysis** section provides the option of submitting a file for deep analysis to gain detailed visibility on observed suspicious behaviors, and associated artifacts. For more information on submitting files for deep analysis, see the **Deep analysis** topic. + +The **File in organization** section provides details on the prevalence of the file and the name observed in the organization. + +The **Observed in organization** section provides a chronological view on the events and associated alerts that were observed on the file. + +You'll see a list of machines associated with the file and a description of the action taken by the file. + +**Investigate a file** + +1. Select the file you want to investigate. You can select a file from any of the following views or use the Search box: + - Alerts - click the file links from the **Description** or **Details** in the Alert timeline + - Machines view - click the file links in the **Description** or **Details** columns in the **Observed on machine** section + - Search box - select **File** from the drop-down menu and enter the file name +2. View the file details. +3. Use the search filters to define the search criteria. You can also use the timeline search box to further filter displayed search results. + +## Investigate an IP address + +Examine possible communication between your machines and external internet protocol (IP) addresses. + +Identifying all machines in the organization that communicated with a suspected or known malicious IP address, such as Command and Control (C2) servers, helps determine the potential scope of breach, associated files, and infected machines. + +You can information from the following sections in the IP address view: + +- IP address details +- IP in organization +- Communication with IP from organization + +The IP address details section shows attributes of the IP address such as its ASN and its reverse IPs. + +The **IP in organization** section provides details on the prevalence of the IP address in the organization. + +The **Communication with IP in organization** section provides a chronological view on the events and associated alerts that were observed on the IP address. + +**Investigate an external IP:** + +1. Select **IP** from the **Search bar** drop-down menu. +2. Enter the IP address in the **Search** field. +3. Click the search icon or press **Enter**. + +Details about the IP address are displayed, including: registration details (if available), reverse IPs (for example, domains), prevalence of machines in the organization that communicated with this IP Address (during selectable time period), and the machines in the organization that were observed communicating with this IP address. + +> **Note**  Search results will only be returned for IP addresses observed in communication with machines in the organization. + +Use the search filters to define the search criteria. You can also use the timeline search box to filter the displayed results of all machines in the organization observed communicating with the IP address, the file associated with the communication and the last date observed. + +Clicking any of the machine names will take you to that machine's view, where you can continue investigate reported alerts, behaviors, and events. + +## Investigate a domain + +Investigate a domain to see if machines and servers in your enterprise network have been communicating with a known malicious domain. + +You can see information from the following sections in the URL view: + +- URL details +- URL in organization +- Prevalence in organization +- Communication with URL from organization + +The URL address details section shows attributes of the URL such as its contacts and nameservers. + +The **URL in organization** section provides details on the prevalence of the URL in the organization. + +The **Communication with URL in organization** section provides a chronological view on the events and associated alerts that were observed on the URL. + +**Investigate a domain:** + +1. Select **URL** from the **Search bar** drop-down menu. +2. Enter the URL in the **Search** field. +3. Click the search icon or press **Enter**. Details about the URL are displayed. Note: search results will only be returned for URLs observed in communications from machines in the organization. +4. Use the search filters to define the search criteria. You can also use the timeline search box to filter the displayed results of all machines in the organization observed communicating with the URL, the file associated with the communication and the last date observed. +5. Clicking any of the machine names will take you to that machine's view, where you can continue investigate reported alerts, behaviors, and events. + +### Related topics +- [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-advanced-threat-protection.md) +- [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-advanced-threat-protection.md) +- [Submit files to the Windows Defender ATP Deep analysis feature](deep-analysis-windows-advanced-threat-protection.md) +- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-advanced-threat-protection.md) \ No newline at end of file diff --git a/windows/keep-secure/machines-view-windows-advanced-threat-protection.md b/windows/keep-secure/machines-view-windows-advanced-threat-protection.md new file mode 100644 index 0000000000..089d5cbebe --- /dev/null +++ b/windows/keep-secure/machines-view-windows-advanced-threat-protection.md @@ -0,0 +1,74 @@ +--- +title: Investigate machines in the Windows Defender ATP Machines view +description: Investigate affected machines in your network by reviewing alerts, network connection information, and service health on the Machines view. +keywords: machines, endpoints, machine, endpoint, alerts queue, alerts, machine name, domain, last seen, internal IP, active alerts, active threats, threat category, filter, sort, review alerts, network, connection, malware, type, password stealer, ransomware, exploit, threat, low severity +search.product: eADQiWindows 10XVcnh +ms.prod: W10 +ms.mktglfcycl: +ms.sitesec: library +--- + +# Investigate machines in the Windows Defender ATP Machines view + +- Windows 10 Insider Preview + +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + +The **Machines view** shows a list of the machines in your network, the corresponding number of active alerts for each machine categorized by alert severity levels, and the number of threats. This view allows you to identify machines with the highest risk at a glance, and keep track of all the machines that are reporting telemetry in your network. + +Use the Machines view in these two main scenarios: + +- **During onboarding** + - During the onboarding process, the Machines view gradually gets populated with endpoints as they begin to report telemetry. Use this view to track your onboarded endpoints as they appear. Use the available features to sort and filer to see which endpoints have most recently reported telemetry, or download the complete endpoint list as a CSV file for offline analysis. +- **Day-to-day work** + - The **Machines view** enables you to identify machines that are most at risk in a glance. High-risk machines are those with the greatest number and highest-severity alerts. By sorting the machines by risk, you'll be able to identify the most vulnerable machines and take action on them. + +The Machines view contains the following columns: + +- **Machine name** - the name or GUID of the machine +- **Domain** - the domain the machine belongs to +- **Last seen** - when the machine last reported telemetry +- **Internal IP** - the local internal Internet Protocol (IP) address of the machine +- **Active Alerts** - the number of alerts reported by the machine by severity +- **Active threats** - the number of active threats reported by the machine + +> **Note**  The **Active threats** and **Threat category** filter column will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/en-us/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product. + +Click any column header to sort the view in ascending or descending order. + +![Screenshot of the Machines view on the portal](images/machines-view.png) + +You can sort the **Machines view** by **Machine name**, **Last seen**, **IP**, **Alerts**, and **Active threats**. Scroll down the **Machines view** to see additional machines. + +The view contains two filters: time and threat category. + +You can filter the view by the following time periods: + +- 1 day +- 3 days +- 7 days +- 30 days +- 6 months + +> **Note**  When you select a time period, the list will only display machines that reported within the selected time period. For example, selecting 1 day will only display a list of machines that reported telemetry within the last 24-hour period. + +The threat category filter lets you filter the view by the following categories: + +- Password stealer +- Ransomware +- Exploit +- Threat +- Low severity + +See the [Investigate machines with active alerts](dashboard-windows-advanced-threat-protection.md#investigate-machines-with-active-threats) topic for a description of each category. + +You can also download a full list of all the machines in your organization, in CSV format. Click the **Manage Alert** menu icon ![The menu icon looks like three periods stacked on top of each other](images/menu-icon.png) to download the entire list as a CSV file. + + **Note**: Exporting the list depends on the number of machines in your organization. It can take a significant amount of time to download, depending on how large your organization is. +Exporting the list in CSV format displays the data in an unfiltered manner. The CSV file will include all machines in the organization, regardless of any filtering applied in the view itself. + +### Related topics +- [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-advanced-threat-protection.md) +- [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-advanced-threat-protection.md) +- [Submit files to the Windows Defender ATP Deep analysis feature](deep-analysis-windows-advanced-threat-protection.md) +- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-advanced-threat-protection.md) \ No newline at end of file diff --git a/windows/keep-secure/manage-alerts-windows-advanced-threat-protection.md b/windows/keep-secure/manage-alerts-windows-advanced-threat-protection.md new file mode 100644 index 0000000000..f8d4307dc3 --- /dev/null +++ b/windows/keep-secure/manage-alerts-windows-advanced-threat-protection.md @@ -0,0 +1,134 @@ +--- +title: Manage Windows Defender Advanced Threat Protection alerts +description: Change the status of alerts, create suppression rules to hide alerts, submit comments, and review change history for individual alerts with the Manage Alert menu. +keywords: manage alerts, manage, alerts, status, new, in progress, resolved, resolve alerts, suppress, supression, rules, context, history, comments, changes +search.product: eADQiWindows 10XVcnh +ms.prod: W10 +ms.mktglfcycl: +ms.sitesec: library +--- + +# Manage Windows Defender Advanced Threat Protection alerts + +- Windows 10 Insider Preview + +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + +Windows Defender ATP notifies you of detected, possible attacks or breaches through alerts. A summary of new alerts is displayed in the **Dashboard**, and you can access all alerts in the **Alerts queue** menu. + +See the [Investigate Windows Defender ATP alerts](investigate-alerts-windows-advanced-threat-protection.md#investigate-windows-defender-advanced-threat-protection-alerts) topic for more details on how to investigate alerts. + +Click the **Manage Alert** menu icon ![The menu icon looks like three periods stacked on top of each other](images/menu-icon.png) on the top of the alert to access the Manage Alert menu and manage alerts. + +![The manage alert menu lets you change the status of an alert, create suppression rules, or enter comments](images/manage-alert-menu.png) + +The **Manage alert** icon appears on the alert's heading in the **New**, **In Progress**, or **Resolved** queues, and on the details page for individual alerts. + +You can use the **Manage Alert** menu to: + +- Change the status of an alert +- Resolve an alert +- Suppress alerts so they won't show up in the **Alerts queue** from this point onwards +- View the history and comments of an alert + +## Change the status of an alert + +You can categorize alerts (as **New**, **In Progress**, or **Resolved**) by changing their status as your investigation progresses. This helps you organize and manage how your team can respond to alerts. + +For example, a team leader can review all **New** alerts, and decide to assign them to the **In Progress** queue for further analysis. + +Alternatively, the team leader might assign the alert to the **Resolved** queue if they know the alert is benign, coming from a machine that is irrelevant (such as one belonging to a security administrator), or is being dealt with through an earlier alert. + +**Change an alert's status:** + +1. Click the **Manage Alert** menu icon ![The menu icon looks like three periods stacked on top of each other](images/menu-icon.png) on the heading of the alert. +2. Choose the new status for the alert (the current status is highlighted in bold and appears on the alert). + +## Resolve an alert + +You can resolve an alert by changing the status of the alert to **Resolved**. This causes the **Resolve conclusion** window to appear, where you can indicate why the alert was resolved and enter any additional comments. + +![You can resolve an alert as valid, valid - allowed, or false alarm](images/resolve-alert.png) + +The comments and change of status are recorded in the [Comments and history window](#view-history-and-comments). + +![The comments window will display a history of status changes](images/comments.png) + + +## Suppress alerts + +Windows Defender ATP lets you create suppression rules so you can limit the alerts you see in the **Alerts queue**. + +Suppression rules can be created from an existing alert. + +When a suppression rule is created, it will take effect from this point onwards. It will not affect existing alerts already in the queue, but new alerts triggered after the rule is created will not be displayed. + +There are two contexts for a suppression rule that you can choose from: + +- **Suppress alert on this machine** +- **Suppress alert in my organization** + +The context of the rule lets you tailor the queue to ensure that only alerts you are interested in will appear. You can use the examples in the following table to help you choose the context for a suppression rule: + +**Context** | **Definition** |**Example scenarios** +---|---|--- +**Suppress alert on this machine** | Alerts with the same alert title and on that specific machine only will be suppressed.

All other alerts on that machine will not be suppressed. |

+**Suppress alert in my organization** | Alerts with the same alert title on any machine will be suppressed. |
  • A benign administrative tool is used by everyone in your organization.
+ +**Suppress an alert and create a suppression rule:** + +1. Click the **Manage Alert** menu icon ![The menu icon looks like three periods stacked on top of each other](images/menu-icon.png) on the heading of an existing alert. +2. Choose the context for suppressing the alert. + +> **Note**  You cannot create a custom or blank suppression rule. You must start from an existing alert. + +**See the list of suppression rules:** + +1. Click the settings icon ![The settings icon looks like a cogwheel or gear](images/settings.png) on the main menu bar at the top of the Windows Defender ATP screen. +2. Click **Suppression rules**. + +![Click the settings icon and then Suppression rules to create and modify rules](images/suppression-rules.png) + +> **Note**  You can also click **See rules** in the confirmation window that appears when you suppress an alert. + +The list of suppression rules shows all the rules that users in your organization have created. +Each rule shows: + +- (1) The title of the alert that is suppressed +- (2) Whether the alert was suppressed for a single machine (clicking the machine name will allow you to investigate the machine) or the entire organization +- (3) The date when the alert was suppressed +- (4) An option to delete the suppression rule, which will cause alerts with this title to be displayed in the queue from this point onwards. + +![Suppression rules show the rule name or title, the context, the date, and an icon to delete the rule](images/rules-legend.png) + +## View the history and comments of an alert +You can use the **Manage Alert** menu icon ![The menu icon looks like three periods stacked on top of each other](images/menu-icon.png) to see a list of previous changes and comments made to the alert and to add new comments. You can also use the menu to open multiple alerts in different tabs so you can compare several alerts at the same time. + +Whenever a change or comment is made to an alert, it is recorded in the **Comments and history** window. + +**See the history of an alert and its comments:** + +1. Click the **Manage Alert** menu icon ![The menu icon looks like three periods stacked on top of each other](images/menu-icon.png) on the heading of the alert. +2. Click **Comments and history** to view related comments and history on the alert. + +Comments are indicated by a message box icon (![The comments icon looks like a speech bubble](images/comments-icon.png)) and include the username of the commenter and the time the comment was made. + +**Add a new comment:** + +1. Type your comment into the field. +2. Click **Post Comment**. + +The comment will appear instantly. + +You will also be prompted to enter a comment if you change the status of an alert to **Resolved**. + +Changes are indicated by a clock icon (![The changes icon looks like an analog clock face](images/changes-icon.png)), and are automatically recorded when: + +- The alert is created +- The status of the alert is changed + +### Related topics +- [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-advanced-threat-protection.md) +- [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-advanced-threat-protection.md) +- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-advanced-threat-protection.md) +- [Submit files to the Windows Defender ATP Deep analysis feature](deep-analysis-windows-advanced-threat-protection.md) diff --git a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md new file mode 100644 index 0000000000..a6b5ded798 --- /dev/null +++ b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -0,0 +1,73 @@ +--- +title: Minimum requirements for Windows Defender Advanced Threat Protection +description: Minimum network and data storage configuration, endpoint hardware and software requirements, and deployment channel requirements for Windows Defender ATP. +keywords: minimum requirements, Windows Defender Advanced Threat Protection minimum requirements, network and data storage, endpoint, endpoint configuration, deployment channel +search.product: eADQiWindows 10XVcnh +ms.prod: W10 +ms.mktglfcycl: +ms.sitesec: library +--- + +# Minimum requirements for Windows Defender ATP + +**Applies to** + +- Windows 10 Insider Preview + +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + +There are some minimum requirements for onboarding your network and endpoints. + +## Minimum requirements + +### Network and data storage and configuration requirements +Your organization must use Azure Active Directory (AAD) to manage users. AAD is used during +service onboarding to manage user-based access to the [Windows Defender ATP portal](https://seville.windows.com/). + +If you’d like help with using AAD to set up user access, contact the +[Windows Defender ATP Yammer group](https://www.yammer.com/wsscengineering/#/threads/inGroup?type=in_group&feedId=6869350&view=all) +https://www.yammer.com/wsscengineering/\#/threads/inGroup?type=in\_group&feedId=7108776&view=all +or email [winatp@microsoft.com](mailto:winatp@microsoft.com). + +When you run the onboarding wizard for the first time, you must choose +where your Windows Defender ATP-related information is stored: in either +a European or United States datacenter. + +> **Notes**   +- You cannot change your data storage location after the + first-time setup. +- Review the [Windows Defender ATP data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) for more information on where and how + Microsoft stores your data. + +### Endpoint hardware and software requirements +Endpoints on your network must run the Testing and Adoption Program +version of Windows 10 (Windows 10 TAP). The hardware requirements for +Windows Defender ATP on endpoints is the same as those for Windows 10 +TAP. + +> **Note**   Endpoints that are running Windows +Server and mobile versions of Windows are not supported. + +Internet connectivity on endpoints is also required. See the +[Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) +section for additional proxy configuration settings. + +Before you configure endpoints, the telemetry and diagnostics service must be enabled. The service is enabled by default in Windows 10 TAP, but if it has been +disabled you can turn it on by following the instructions in the +[Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) section. + +### Deployment channel operating system requirements + +You can choose to onboard endpoints with a scheduled Group Policy +(GP) update (using a GP package that you +download from the portal or during the service onboarding wizard) or +manual registry changes. + +The following describes the minimum operating system or software version +required for each deployment channel. + +Deployment channel | Minimum server requirements +:---|:--- +Group Policy settings | Windows Server 2008 R2 +Manual registry modifications | No minimum requirements + diff --git a/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md b/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md new file mode 100644 index 0000000000..24d44a50d0 --- /dev/null +++ b/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md @@ -0,0 +1,95 @@ +--- +title: Monitor the Windows Defender ATP onboarding +description: Monitor the onboarding of the Windows Defender ATP service to ensure your endpoints are correctly configured and are sending telemetry reports. +keywords: monitor onboarding, monitor Windows Defender ATP onboarding, monitor Windows Defender Advanced Threat Protection onboarding +search.product: eADQiWindows 10XVcnh +ms.prod: W10 +ms.mktglfcycl: +ms.sitesec: library +author: mjcaparas +--- + +# Monitor the Windows Defender Advanced Threat Protection onboarding + +- Windows 10 Insider Preview + +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + +You can monitor the onboarding of the Windows Defender ATP service to ensure your endpoints are correctly configured and are sending telemetry reports. + +You might need to monitor the onboarding if the package did not configure the registry correctly, or the reporting client did not start or execute correctly. + +Monitoring can be done directly on the portal, or by using System Center Configuration Manager (SCCM). + +## Monitor with the portal + +1. Go to the [Windows Defender ATP portal](https://seville.windows.com). + +2. Click **Machines view**. + +3. Verify that endpoints are appearing. + + +> **Note**  It can take several days for endpoints to start showing on the **Machines view**. This includes the time it takes for the Group Policy (GP) update to be distributed to the endpoint, the time it takes before the user logs on or initiates a GP update, and the time it takes for the endpoint to start reporting to the portal. + +## Monitoring with System Center Configuration Manager + +Monitoring with SCCM consists of two parts: + +1. Confirming the configuration package has been correctly deployed and is running (or has successfully run) on the endpoints in your network. + +2. Checking that the endpoints are compliant with the Windows Defender ATP service (this ensures the endpoint can complete the onboarding process and can continue to report data to the service). + +**To confirm the configuration package has been correctly deployed:** + +1. In the SCCM console, click on **Monitoring** at the bottom of the navigation pane. + +2. Click on **Overview** and then **Deployments**. + +3. Click on the deployment with the package name. What is the name of the deployment, will it always be the same for every user/installation? + +4. Review the status indicators under **Completion Statistics** and **Content Status**. + +If there are failed deployments (endpoints with **Error**, **Requirements Not Met**, or **Failed statuses**), you may need to perform troubleshooting steps on the endpoints. See the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) topic for more information. + +Naama: Is this a correct process for idendtifying/resolving issues? + +![image](images/sccm-deployment.png) + +**To check that your endpoints are compliant:** + +1. Get the *compliance.cab* file from the SCCM configuration package .zip file (*WindowsATPOnboardingPackage.zip*) that you downloaded during the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://seville.windows.com): + + 1. Click **Client onboarding** on the **Navigation pane**. + 2. Select **SCCM**, click **Download package** and save the .zip file. Iaan: Need to confirm the UI for this + 3. Extract the *compliance.cab* file from the package. + +2. In the SCCM console, click on **Assets and Compliance** at the bottom of the navigation pane. + +3. Click on **Overview** and then **Compliance Settings**. + +4. In the main area of the SCCM console, click on **Configuration Baselines** and import the provided cab. Iaan: Need to confirm that 'import' is available/ UI is correct + +5. Right click the imported baseline and deploy to a predefined device collection. Naama: Is this 'export' as in the screenshot, or is that showing something else? + + ![image](images/export-sccm.png) + + Iaan: Need to confirm this is what it looks like + +6. In the SCCM console, click on **Monitoring** at the bottom of the navigation pane. + +7. Click on **Overview** and then **Deployments**. + +8. Click on the deployment with the package name Naama: What is the name of the deployment, will it always be the same for every user/installation? + +Naama: How does one know if there is an issue? + +If there are non-compliant endpoints (endpoints with ?????), you may need to perform troubleshooting steps on the endpoints. See the [Troubleshoot Windows Defender ATP onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) topic for more information. + +Naama: Is this a correct process for resolving issues? + +## Related topics +- [Windows Defender ATP service onboarding](service-onboarding-windows-advanced-threat-protection.md) +- [Configure Windows Defender ATP endpoints (client onboarding)](configure-endpoints-windows-advanced-threat-protection.md) +- [Additional Windows Defender ATP configuration settings](additional-configuration-windows-advanced-threat-protection.md) +- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) \ No newline at end of file diff --git a/windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md b/windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md new file mode 100644 index 0000000000..3d31d3693d --- /dev/null +++ b/windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md @@ -0,0 +1,37 @@ +--- +title: Onboard endpoints and set up the Windows Defender ATP user access +description: Set up user access in Azure Active Directory and use Group Policy or do manual registry changes to onboard endpoints to the service. +keywords: onboarding, windows defender advanced threat protection onboarding, windows atp onboarding +search.product: eADQiWindows 10XVcnh +ms.prod: W10 +ms.mktglfcycl: +ms.sitesec: library +author: mjcaparas +--- + +# Onboard endpoints and set up the Windows Defender ATP user access + +**Applies to** + +- Windows 10 Insider Preview + +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + +You need to onboard to Windows Defender ATP before you can use the service. + +There are two stages to onboarding: + +1. Set up user access in AAD and use a wizard to create a dedicated + cloud instance for your network (known as “service onboarding”). + +2. Add endpoints to the service with scheduled GP updates or manual + registry changes (known as “endpoint onboarding”). + +## In this section +Topic | Description +:---|:--- +[Windows Defender ATP service onboarding](service-onboarding-windows-advanced-threat-protection.md) | Learn about managing user access to the Windows Defender ATP portal by assigning users to the Windows Defender ATP service application in ADD. +[Configure Windows Defender ATP endpoints (client onboarding)](configure-endpoints-windows-advanced-threat-protection.md) | You'll need to configure endpoints for it to report to the Windows Defender ATP service. Learn how you can use the configuration package to configure endpoints in your enterprise. +[Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-advanced-threat-protection.md) | Learn how you can monitor the onboarding to ensure your endpoints are correctly configured and are sending telemetry reports. +[Additional Windows Defender ATP configuration settings](additional-configuration-windows-advanced-threat-protection.md) | This topic describes the steps you need to take to configure settings for sample sharing used in the deep analysis feature. +[Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) | This topic contains information on how you can resolve issues that might arise during onboarding. diff --git a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md new file mode 100644 index 0000000000..83ba41ee70 --- /dev/null +++ b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md @@ -0,0 +1,64 @@ +--- +title: Windows Defender Advanced Threat Protection portal overview +description: Use the Windows Defender ATP portal to monitor your enterprise network and assist in responding to alerts to potential advanced persistent threat (APT) activity or data breaches. +keywords: Windows Defender ATP portal, portal, cybersecurity threat intelligence, dashboard, alerts queue, machines view, preferences setup, client onboarding, advanced attacks +search.product: eADQiWindows 10XVcnh +ms.prod: W10 +ms.mktglfcycl: +ms.sitesec: library +author: DulceMV +--- + +# Windows Defender Advanced Threat Protection portal overview + +- Windows 10 Insider Preview + +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + + +Enterprise security teams can use the portal to monitor and assist in responding to alerts of potential advanced persistent threat (APT) activity or data breaches. + +You can use the [Windows Defender ATP portal](https://seville.windows.com/) to: +- View, sort, and triage alerts from your endpoints +- Search for more information on observed indicators such as files and IP Addresses +- Change Windows Defender ATP settings, including time zone and alert suppression rules + +## Windows Defender ATP portal +When you open the portal, you’ll see the main areas of the application: +- (1) Settings +- (2) Navigation pane +- (3) Main portal +- (4) Search bar + + + ![Windows Defender Advanced Threat Protection portal](images/portal.png) + +You can navigate through the portal using the menu options available in all sections. Refer to Table 3 for a description of each section. + +Area | Description +:---|:--- +(1) Launcher | Use the launcher to quickly go to your Windows Security Center portal and select from available services. +(2) Windows Security Center home | Opens the Windows Security Center home. +(3) Settings | Provides access to configuration settings such as time zone, alert suppression rules, and license information. +(4) Navigation pane | Use the navigation pane to move between the **Dashboard**, **Alerts queue**, **Machines view**, **Preferences setup**, and **Client onboarding**. +|**Dashboard** | Provides clickable tiles that open detailed information on various alerts that have been detected in your organization. +|**Alerts queue** | Enables you to view separate queues of new, in progress, and resolved alerts. +|**Machines view**| Displays the list of machines that are onboarded to Windows Defender ATP, some information about them, and the corresponding number of alerts. +|**Preferences setup**| Shows the settings you selected during [service onboarding](service-onboarding-windows-advanced-threat-protection.md), and lets you update your industry preferences and retention policy period. +|**Client onboarding**| Allows you to download the onboarding configuration package. +(5) Main portal| Main area where you will see the different views such as the Dashboard, Alerts queue, and Machines view.| +(6) Search | Search for machines, files, external IP Addresses, or domains across endpoints. The drop-down combo box allows you to select the entity type.| + +## Windows Defender ATP icons +The following table provides information on the icons used all throughout the portal: + +Icon | Description +:---|:--- +|![Alert icon](images/alert-icon.png)| Alert – Indication of an activity correlated with advanced attacks. +| ![Detection icon](images/detection-icon.png)| Detection – Indication of a malware threat detection. +| ![Active threat icon](images/active-threat-icon.png)| Active threat – Threats actively executing at the time of detection. +| ![Remediated icon](images/remediated-icon.png)| Remediated – Threat removed from the machine +|![Not remediated icon](images/not-remediated-icon.png)| Not remediated – Threat not removed from the machine. + +### Related topic +[Use the Windows Defender Advanced Threat Protection portal](use-windows-defender-advanced-threat-protection.md) \ No newline at end of file diff --git a/windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md b/windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md new file mode 100644 index 0000000000..797551495d --- /dev/null +++ b/windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md @@ -0,0 +1,119 @@ +--- +title: Windows Defender ATP service onboarding +description: Assign users to the Windows Defender ATP service application in Azure Active Directory to grant access to the portal. +keywords: service onboarding, Windows Defender Advanced Threat Protection service onboarding +search.product: eADQiWindows 10XVcnh +ms.prod: W10 +ms.mktglfcycl: +ms.sitesec: library +author: mjcaparas +--- + +# Windows Defender ATP service onboarding + +- Windows 10 Insider Preview + +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + +You have to assign users to the Windows ATP Service application in Azure Active Directory (AAD) before they can access the portal. + +**Manage user access to the Windows Defender ATP portal**: + +1. When you first go to the [Windows Defender ATP + portal](https://seville.windows.com/) and your directory does not + have users assigned to the Windows ATP Service application, you will + be directed to open the [Microsoft Azure Dashboard](https://portal.azure.com) to manage user access. + + > **Note**   In AAD, a directory is essentially a tenant. See the [Azure AD documentation](https://msdn.microsoft.com/en-us/library/azure/jj573650.aspx) for more information on how tenants work with AAD. + +2. Ensure you have logged in to Microsoft Azure with an account that + has permissions to assign users to an application in AAD. You might + need to sign out of Microsoft Azure and then sign back in again if + you used a different account to sign in to the Windows Defender ATP + portal: + + a. On the top menu, click the signed-in user’s name. + + b. Click **Sign out**. + + ![Azure sign out](images/azure-signout.png) + + c. Go the [Microsoft Azure Dashboard](https://portal.azure.com) again where you will be asked to sign in. + + d. Sign in with the correct user name and password for an account that has permissions to assign users in AAD. + +3. On the ** Microsoft Azure Dashboard**, click ** Browse** in the navigation pane and then click **Active Directory** to open the [Azure Management Portal](https://manage.windowsazure.com/). + + ![Azure Active Directory menu](images/azure-browse.png) + +4. You might need to open the **Directory** section of the [Azure Management Portal](https://manage.windowsazure.com/) so you can access your directory. There are two ways you can do this: + + a. Click the arrow icon above the list of directories to see the full list of directories in the main area of the portal. + + ![Azure organization menu](images/azure-org-directory.png) + + b. Scroll down in the navigation pane and click **Active Directory**. + + ![Azure active directory](images/azure-active-directory.png) + +5. Click the directory that contains the Windows Defender ATP application. In the following example, the directory is + called **Contoso**. + + ![Azure active directory list](images/azure-active-directory-list.png) + + > **Note**  You can also access your directory by going straight to the [Azure Management Portal](https://manage.windowsazure.com/), clicking Active Directory and then finding your directory in the list. + +6. Click **Applications** from the top menu bar. + + ![Example organization in Azure Active Directory](images/contoso.png) + +7. Click the **Windows ATP Service** application. The dashboard for the application is shown. + + ![Example selected organization in Azure Active Directory](images/contoso-application.png) + + > **Note**   The application might have a slightly different name than the one shown here. It might be called **Windows Defender ATP Service**. + +8. Click **Users** from the top menu bar. A list of users that are in the directory is displayed. + + ![Example windows atp service users](images/windows-atp-service.png) + + ![Example user assignment to the windows atp service](images/assign-users.png) + + > **Note**   If you do not normally work with AAD, you might not see any users in the directory, or we might have created a test tenant specifically for a single user’s account. See the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) section for instructions on adding users to a directory. + +9. Select the user you want manage. + +10. Click **Assign**. + +11. Confirm that you want to enable access for the user from the notification bar. If you click **Yes**, the user is given access to the Windows Defender ATP portal. One or more progress bars will appear that indicates the user is being assigned a role, and you will see confirmation messages. You don’t need to do anything with the messages; they will go away after a short period of time. + + ![Confirmation page to enable access to users](images/confirm-user-access.png) + +12. To remove the user's access, click **Remove**. + +13. Select the **Disable access to this app for the selected users** checkbox, and then click **Complete** ![Complete icon](images/check-icon.png). One or more progress bars will appear, followed by confirmation messages. The messages will disappear after a short period. + + ![Remove menu](images/remove-menu.png) + +14. To remove the access for all users, click **Manage access**. If you click **Complete** ![Complete icon](images/check-icon.png), you will not see the Windows ATP Service in the list of applications in your directory. + + > **Note**   If you want to give access to users again, see the Manage access for all users in Azure Active Directory topic in [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md). + +15. You can continue assigning roles for other users in your organization now, or you can return to the Windows Defender ATP portal to complete the service onboarding wizard. + + > **Note**   You need to assign roles for every user in your organization that requires access to the Windows Defender ATP portal. You can assign roles at any time by going to the Azure Management Portal, clicking **Active Directory** and then finding your directory in the list and following the steps above. + +When you have finished assigning roles, return to the [Windows Defender ATP portal](https://seville.windows.com) and refresh the +page. + +Follow the steps in the onboarding wizard to complete the onboarding process. + +At the end of the wizard, you can download the Group Policy configuration package which you will use to configure endpoints on your network. You can also download the package from the **Client onboarding** menu on the portal after you have completed the onboarding wizard. + +## Related topics +- [Configure Windows Defender ATP endpoints (client onboarding)](configure-endpoints-windows-advanced-threat-protection.md) +- [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-advanced-threat-protection.md) +- [Additional Windows Defender ATP configuration settings](additional-configuration-windows-advanced-threat-protection.md) +- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) + + diff --git a/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md b/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md new file mode 100644 index 0000000000..25b7014683 --- /dev/null +++ b/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md @@ -0,0 +1,54 @@ +--- +title: Windows Defender Advanced Threat Protection settings +description: Use the menu to configure the time zone, suppression rules, and view license information. +keywords: Windows Defender ATP settings, Windows Defender, cybersecurity threat intelligence, advanced threat protection +search.product: eADQiWindows 10XVcnh +ms.prod: W10 +ms.mktglfcycl: +ms.sitesec: library +author: DulceMV +--- + +# Windows Defender Advanced Threat Protection settings + +- Windows 10 Insider Preview + +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + +Use the **Settings** menu ![Settings icon](images/settings-icon.png) to configure the time zone, suppression rules, and view license information. + +## Time zone settings +The aspect of time is important in the assessment and analysis of perceived and actual cyberattacks. + +Cyberforensic investigations often rely on time stamps to piece together the sequence of events. It’s important that your system reflects the correct time zone settings. + +Windows Defender ATP can display either Coordinated Universal Time (UTC) or local time. + +Your current time zone setting is shown in the Windows Defender ATP menu. You can change the displayed time zone in the **Settings** menu ![Settings icon](images/settings-icon.png). + +### UTC time zone +Windows Defender ATP uses UTC time by default. + +Setting the Windows Defender ATP time zone to UTC will display all system timestamps (alerts, events, etc.) in UTC for all users. Choosing this setting means that all users will see the same timestamps in Windows Defender ATP, regardless of their regional settings. This can help security analysts working in different locations across the globe to use the same time stamps while investigating events. + +### Local time zone +You can choose to have Windows Defender ATP use local time zone settings. All alerts and events will be displayed using your local time zone. + +The local time zone is taken from your machine’s regional settings. If you change your regional settings, the Windows Defender ATP time zone will also change. Choosing this setting means that the timestamps displayed in Windows Defender ATP will be aligned to local time for all Windows Defender ATP users. Analysts located in different global locations will now see the Windows Defender ATP alerts according to their regional settings. + +Choosing to use local time can be useful if the analysts are located in a single location. In this case it might be easier to correlate events to local time, for example – when a local user clicked on a suspicious email link. + +### Set the time zone +The Windows Defender ATP time zone is set by default to UTC. +Setting the time zone also changes the times for all Windows Defender ATP views. +To set the time zone: + +1. Click the **Settings** menu ![Settings icon](images/settings-icon.png). +2. Select the **Timezone:UTC** indicator. +3. The time zone indicator changes to **Timezone:Local**. Click it again to change back to **Timezone:UTC**. + +## Suppression rules +The suppression rules control what alerts are suppressed. You can suppress alerts so that certain activities are not flagged as suspicious. See [Suppress alerts](manage-alerts-windows-advanced-threat-protection.md#suppress-alerts). + +## License +Click the license link in the **Settings** menu to view the license agreement information for Windows Defender ATP. diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-advanced-threat-protection.md new file mode 100644 index 0000000000..4f552589c8 --- /dev/null +++ b/windows/keep-secure/troubleshoot-onboarding-windows-advanced-threat-protection.md @@ -0,0 +1,101 @@ +--- +title: Troubleshoot Windows Defender ATP onboarding issues +description: Troubleshoot issues that might arise during the onboarding of endpoints or to the Windows Defender ATP service. +keywords: troubleshoot onboarding, onboarding issues, event viewer, azure management portal, data collection and preview builds +search.product: eADQiWindows 10XVcnh +ms.prod: W10 +ms.mktglfcycl: +ms.sitesec: library +author: mjcaparas +--- + +# Troubleshoot Windows Defender Advanced Threat Protection onboarding issues + +- Windows 10 Insider Preview + +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + +You might need to troubleshoot the onboarding process if you encounter issues. + +## Add users to an Azure Active Directory +If you don’t see any users in the [Azure Management Portal](https://manage.windowsazure.com/) during the service onboarding stage, you might need to add users to the directory first. + +1. Go to the Azure Management Portal and select the directory you want to manage. + +2. Click **Users** from the top menu bar. + + ![Example Azure Management Portal organization](images/contoso-users.png) + +3. Click **Add user** from the menu bar at the bottom. + + ![Add user menu](images/add-user.png) + +4. Select the type of user and enter their details. There might be multiple steps in the **Add user** dialog box depending on the type of user. When you’re done, click **Complete** ![Check icon](images/check-icon.png) or **OK**. + +5. Continue to add users. They will now appear in the **Users** section of the **Windows ATP Service** application. You must assign the user a role before they can access the [Windows Defender ATP portal](https://seville.windows.com/). + +## Manage access for all users in Azure Active Directory +If you remove access for all users to the Windows ATP Service application (by clicking Manage access), you will not see the application in the list of applications in your directory in the [Azure Management Portal](https://manage.windowsazure.com/). + +Gain access to the application in the Azure Management Portal again: + +1. Sign in to the [Windows Defender ATP portal](https://seville.windows.com/) with the user account you want to give access to. + +2. Confirm you have signed in with the correct details, and click **Accept**. + +3. Go to the [Azure Management Portal](https://manage.windowsazure.com/) and navigate to your directory. You will see the **Windows ATP Service** application in the **Applications** section again. + +## Ensure the telemetry and diagnostics service is enabled + +If the endpoints aren’t reporting correctly, you might need to check that the Windows 10 TAP telemetry and diagnostics service is enabled on the endpoint. + +1. Follow the instructions at + [https://technet.microsoft.com/library/mt577208%28v=vs.85%29.aspx\#BKMK\_UTC] (https://technet.microsoft.com/library/mt577208%28v=vs.85%29.aspx#BKMK_UTC) + +2. Attempt to [onboard the endpoint](onboard-configure-windows-advanced-threat-protection.md#onboard-endpoints-and-set-up-the-windows-defender-atp-user-access). + +## Configure proxy and Internet connectivity + +The endpoints must be able to connect to the Internet and send their data outside of your organization’s network. You might need to set additional proxy configurations to ensure endpoints can report correctly. + +1. Open the [Group Policy Management Console](https://technet.microsoft.com/en-us/library/cc731212.aspx), right-click the GPO you want to configure and click **Edit**. + +2. In the **Group Policy Management Editor**, go to **Computer configuration**. + +3. Click **Policies**, then **Administrative templates**. + +4. Click **Windows components** and then **Data Collection and Preview Builds**. + +5. Click **Configure connected user experiences and telemetry** and then + configure the GP. The GP accepts a string in the following format: + ```:``` + +## Review errors on endpoints with Event Viewer + +You can review event IDs in the [Event Viewer](https://msdn.microsoft.com/en-US/library/aa745633(v=bts.10).aspx) on individual endpoints, or check the status of machines from the [Windows Defender ATP portal](https://seville.windows.com/). + +For example, if endpoints are not appearing in the **Machines view** list,you might need to look for event IDs on the endpoints. + +> **Note**   It can take several days for endpoints to begin reporting to the Windows Defender ATP service. + +1. Click **Start** and type **Event Viewer**. + +2. In the log list, under **Log Summary**, scroll until you see **Microsoft-Windows-SENSE/Operational**. Double-click the item to + open the log. + + > **Note**   SENSE is the internal name used to refer to the behavioral sensor that powers Windows Defender ATP. + +3. Events recorded by the service will appear in the log. See following table for a list of solutions to common errors. + +Message | Action +:---|:--- +Windows Advanced Threat Protection Service failed to connect to server at `````` | Check the connection to the URL. See [Configure proxy and Internet connectivity](Configure-proxy-and-Internet-connectivity). | + Windows Advanced Threat Protection Service failed to read onboarding parameters. Failure code: `````` | Check that GP settings are correct and there are not settings impacting permissions in the policy. | +Windows Advanced Threat Protection Service failed to persist onboarding information. Failure code: `````` | Check that GP settings are correct and there are not settings impacting permissions in the policy.| + + +## Related topics +- [Windows Defender ATP service onboarding](service-onboarding-windows-advanced-threat-protection.md) +- [Configure Windows Defender ATP endpoints (client onboarding)](configure-endpoints-windows-advanced-threat-protection.md) +- [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-advanced-threat-protection.md) +- [Additional Windows Defender ATP configuration settings](additional-configuration-windows-advanced-threat-protection.md) \ No newline at end of file diff --git a/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md new file mode 100644 index 0000000000..6140029820 --- /dev/null +++ b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md @@ -0,0 +1,24 @@ +--- +title: Troubleshoot Windows Defender Advanced Threat Protection +description: Find solutions and work arounds to known issues such as server errors when trying to access the service. +keywords: troubleshoot Windows Defender Adavanced Threat Protection, troubleshoot Windows ATP, server error, access denied, invalid credentials +search.product: eADQiWindows 10XVcnh +ms.prod: W10 +ms.mktglfcycl: +ms.sitesec: library +author: mjcaparas +--- +# Troubleshoot Windows Defender Advanced Threat Protection + +- Windows 10 Insider Preview + +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + +This section addresses issues that might arise as you use the service. + +###Server error - Access is denied due to invalid credentials +If you encounter a server error when trying to access the service, you’ll need to change your browser cookie settings. +Configure your browser to allow cookies. + +### Related topic +- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) \ No newline at end of file diff --git a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md new file mode 100644 index 0000000000..6c48cea5f2 --- /dev/null +++ b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md @@ -0,0 +1,57 @@ +--- +title: Use the Windows Defender Advanced Threat Protection portal +description: Learn about the features on Windows Defender ATP portal, including how alerts work, and suggestions on how to investigate possible breaches and attacks. +keywords: dashboard, alerts queue, manage alerts, investigation, investigate alerts, investigate machines, submit files, deep analysis, high, medium, low, severity, +search.product: eADQiWindows 10XVcnh +ms.prod: W10 +ms.mktglfcycl: +ms.sitesec: library +--- + +# Use the Windows Defender Advanced Threat Protection portal + +- Windows 10 Insider Preview + +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + +A typical security breach investigation requires a member of a security operations team to: + +1. View an alert on the **Dashboard** or **Alerts queue** +2. Review the indicators of compromise (IOC) or indications of attack (IOAs) +3. Review a timeline of alerts, behaviors, and events from the machine +4. Manage alerts, understand the threat/potential breach, collect information to support taking action, and resolve the alert + +![Flowchart describing the four stages of investigation](images/overview.png) + +Security operation teams can use Windows Defender ATP Portal to carry out this end-to-end process without having to leave the portal. +Teams can monitor the overall status of enterprise endpoints from the **Dashboard**, gain insight on the various alerts, their category, when they were observed, and how long they’ve been in the network at a glance. + +## Windows Defender ATP alerts +Alerts in the portal help to notify you of detected threat behaviors or activities on your endpoints. +The **Dashboard** and **Alerts queue** provide important information about your endpoints that can help you address alerts. +The **Dashboard** groups active alerts into **New** or **In progress** queues, and supports filtering by severity levels. It also has clickable tiles that give visual cues on the overall health status of your organization. Each tile opens a detailed view of the corresponding overview. +Alerts are organized in three queues, by their workflow status: + +- **New** +- **In progress** +- **Resolved** + +There are three alert severity levels, described in the following table. + +Alert severity | Description +:---|:--- +High (Red) | Threats often associated with APT. These alerts pose a high risk due to the severity of the damage they might inflict on endpoints. +Medium (Orange) | Threats considered to be abnormal or suspicious in nature such as anomalous registry modifications and loading of executable files. +Low (Yellow) | Threats associated with prevalent malware and hack-tools that pose a lower risk to endpoints. + + +### In this section + +Topic | Description +:---|:--- +[View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-advanced-threat-protection.md) | The **Dashboard** provides a snapshot of your network. You can view aggregates of alerts, the overall status of the service of the endpoints on your network, investigate machines, files, and URLs, and see snapshots of threats seen on machines. +[View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-advanced-threat-protection.md) | You can sort and filter alerts across your network, and drill down on individual alert queues. +[Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-advanced-threat-protection.md) | The Manage Alert menu on every alert lets you change an alert's status, resolve it, suppress it, or contribute comments about the alert. +[Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-advanced-threat-protection.md) | The **Machines view** shows a list of the machines in your network, the corresponding number of active alerts for each machine categorized by alert severity levels, as well as the number of threats. +[Submit files to the Windows Defender ATP Deep analysis feature](deep-analysis-windows-advanced-threat-protection.md) | You can submit files for deep analysis to see detailed information about the file’s activities, observed behaviors, and associated artifacts (such as dropped files, registry modifications, and communications with IPs). + diff --git a/windows/keep-secure/windows-defender-advanced-threat-protection.md b/windows/keep-secure/windows-defender-advanced-threat-protection.md new file mode 100644 index 0000000000..5d1e82ddb5 --- /dev/null +++ b/windows/keep-secure/windows-defender-advanced-threat-protection.md @@ -0,0 +1,84 @@ +--- +title: Windows Defender Advanced Threat Protection - Windows Defender +description: Windows Defender Advanced Threat Protection is an enterprise security service that helps detect and respond to possible cybersecurity threats related to advanced persistent threats. +keywords: introduction to Windows Defender Advanced Threat Protection, introduction to Windows Defender ATP, cybersecurity, advanced persistent threat, enterprise security +search.product: eADQiWindows 10XVcnh +ms.prod: W10 +ms.mktglfcycl: +ms.sitesec: library +author: mjcaparas +--- + +# Windows Defender Advanced Threat Protection + +**Applies to** + +- Windows 10 Insider Preview + +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + +Windows Defender Advanced Threat Protection (Windows Defender ATP) is an out-of-the-box Windows enterprise security service that enables enterprise cybersecurity teams to detect and respond to advanced threats on their networks. The service is composed of four main features: + +- **Advanced attack detection**: Actionable alerts with real-time + visibility into cybersecurity threat incident details + +- **File deep analysis**: Dynamic cloud analysis to provide visibility + into a file’s underlying behaviors + +- **Footprint service**: Proactive exploration of potential attacks, and + the ability to map them to specific machines + +- **Threat intelligence**: Insights that are validated and enriched by + security experts using telemetry gathered from resources worldwide + +The following diagram shows these Windows Defender ATP service +components: + +![Windows Defender ATP service components](images/service-components.png) + +Investigating these alerts provides additional information and insight +into known attackers, their goals, and actionable recommendations. + +Endpoint investigation capabilities in this service let you drill down +into security alerts and understand the scope and nature of a potential +breach. You can submit files for deep analysis and receive the results +without leaving the [Windows Defender ATP portal](https://seville.windows.com). + +Windows Defender ATP works with existing Windows security technologies +on endpoints, such as Windows Defender, AppLocker, and Device Guard. It +can also work side-by-side with third-party security solutions and +antimalware products. + +Windows Defender ATP leverages Microsoft technology and expertise to +detect sophisticated cyber-attacks, providing: + +- **Endpoint behavioral sensors**: Embedded in Windows 10, these sensors + collect and process behavioral signals from the operating system + (for example, process, registry, file, and network communications) + and sends this telemetry to your Azure Active Directory (AAD) + subscription. + +- **Cloud security analytics**: Leveraging big-data, machine-learning, and + unique Microsoft optics across the Windows ecosystem (such as the + [Microsoft Malicious Software Removal Tool](https://www.microsoft.com/en-au/download/malicious-software-removal-tool-details.aspx), + enterprise cloud products (such as Office 365), and online assets + (such as Bing and SmartScreen URL reputation), behavioral signals + are translated into insights, detections, and recommended responses + to advanced threats. + +- **Threat intelligence**: Generated by Microsoft hunters, security teams, + and augmented by threat intelligence provided by partners, threat + intelligence enables Windows Defender ATP to identify attacker + tools, techniques, and procedures, and generate alerts when these + are observed in collected telemetry. + +## In this section + +Topic | Description +:---|:--- +[Minimum requirements for Windows Defender ATP](minimum-requirements-windows-defender-advanced-threat-protection.md) | This overview topic for IT professionals provides information on the minimum requirements to use Windows Defender Advanced Threat Protection such as network and data storage configuration, and endpoint hardware ans software requirements, and deployment channels. +[Onboard endpoints and set up the Windows Defender ATP user access](onboard-configure-windows-advanced-threat-protection.md) | You'll need to onboard and configure the service and the endpoints in your network before you can use the service. Learn about how you can assign users to the Windows Defender ATP Service in ADD and using a configuration package to configure endpoints. +[Windows Defender Advanced Threat Protection portal overview](portal-overview-windows-defender-advanced-threat-protection.md) | Understand the main features of the service and how it levereges Microsoft technology to protect enterprise endpoints from sophisticated cyber attacks. +[Use the Windows Defender Advanced Threat Protection portal](use-windows-defender-advanced-threat-protection.md) | Learn about the capabilities of Windows Defender ATP to help you investigate alerts that might be indicators of possible breaches in your enterprise. +[Windows Defender Advanced Threat Protection settings](settings-windows-defender-advanced-threat-protection.md) | Learn about setting the time zone and configuring the suppression rules to configure the service to your requirements. +[Troubleshoot Windows Defender Advanced Threat Protection](troubleshoot-windows-defender-advanced-threat-protection.md) | This topic contains information to help IT Pros find workarounds for the known issues and troubleshoot issues in Windows Defender ATP. From e83937f3ee952084934f5c511903716945bc4a1a Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Fri, 15 Apr 2016 13:19:02 -0700 Subject: [PATCH 002/439] fixing Windows Defender ATP TOC entry --- windows/keep-secure/TOC.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index f6205dde4d..bd3cf71087 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -401,11 +401,7 @@ ### [User Account Control](user-account-control-overview.md) #### [How User Account Control works](how-user-account-control-works.md) #### [User Account Control security policy settings](user-account-control-security-policy-settings.md) -### [Windows Defender in Windows 10](windows-defender-in-windows-10.md) -#### [Update and manage Windows Defender in Windows 10](get-started-with-windows-defender-for-windows-10.md) -#### [Configure Windows Defender in Windows 10](configure-windows-defender-in-windows-10.md) -#### [Troubleshoot Windows Defender in Windows 10](troubleshoot-windows-defender-in-windows-10.md) -### [Windows Defender Advanced Threat Protection](windows-defender-in-windows-10.md) +### [Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md) #### [Requirements for Windows Defender ATP](requirements-windows-defender-atp.md) #### [Onboard and configure Windows Defender ATP](onboard-configure-windows-defender-atp.md) #### [Windows Defender ATP data storage and privacy](data-storage-privacy-windows-defender-atp.md) @@ -414,6 +410,10 @@ #### [Use Windows Defender ATP Portal](use-windows-defender-atp.md) #### [Windows Defender ATP settings](settings-windows-defender-atp.md) #### [Troubleshoot Windows Defender ATP](troubleshoot-windows-defender-atp.md) +### [Windows Defender in Windows 10](windows-defender-in-windows-10.md) +#### [Update and manage Windows Defender in Windows 10](get-started-with-windows-defender-for-windows-10.md) +#### [Configure Windows Defender in Windows 10](configure-windows-defender-in-windows-10.md) +#### [Troubleshoot Windows Defender in Windows 10](troubleshoot-windows-defender-in-windows-10.md) ## [Enterprise security guides](windows-10-enterprise-security-guides.md) ### [Control the health of Windows 10-based devices](protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md) ### [Device Guard deployment guide](device-guard-deployment-guide.md) From 508c3d49dc4e90afc1993b3c8b073eacf99ef5e4 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Fri, 15 Apr 2016 13:29:51 -0700 Subject: [PATCH 003/439] Added Windows Defender ATP to security technologies landing page --- windows/keep-secure/security-technologies.md | 63 ++++---------------- 1 file changed, 11 insertions(+), 52 deletions(-) diff --git a/windows/keep-secure/security-technologies.md b/windows/keep-secure/security-technologies.md index 81f5647bf1..741e8c2005 100644 --- a/windows/keep-secure/security-technologies.md +++ b/windows/keep-secure/security-technologies.md @@ -10,60 +10,19 @@ author: brianlic-msft # Security technologies - Learn more about the different security technologies that are available in Windows 10 and Windows 10 Mobile. -## In this section - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
TopicDescription

[AppLocker](applocker-overview.md)

This topic provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. AppLocker helps you control which apps and files users can run. These include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers.

[BitLocker](bitlocker-overview.md)

This topic provides a high-level overview of BitLocker, including a list of system requirements, practical applications, and deprecated features.

[Encrypted Hard Drive](encrypted-hard-drive.md)

Encrypted Hard Drive uses the rapid encryption that is provided by BitLocker Drive Encryption to enhance data security and management.

[Security auditing](security-auditing-overview.md)

Topics in this section are for IT professionals and describes the security auditing features in Windows and how your organization can benefit from using these technologies to enhance the security and manageability of your network.

[Security policy settings](security-policy-settings.md)

This reference topic describes the common scenarios, architecture, and processes for security settings.

[Trusted Platform Module](trusted-platform-module-overview.md)

This topic for the IT professional describes the Trusted Platform Module (TPM) and how Windows uses it for access control and authentication. The topic provides links to other resources about the TPM.

[User Account Control](user-account-control-overview.md)

User Account Control (UAC) helps prevent malware from damaging a PC and helps organizations deploy a better-managed desktop. With UAC, apps and tasks always run in the security context of a non-administrator account, unless an administrator specifically authorizes administrator-level access to the system. UAC can block the automatic installation of unauthorized apps and prevent inadvertent changes to system settings.

[Windows Defender in Windows 10](windows-defender-in-windows-10.md)

This topic provides an overview of Windows Defender, including a list of system requirements and new features.

- -  +| Topic | Description | +|-|-| +| [AppLocker](applocker-overview.md)| This topic provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. AppLocker helps you control which apps and files users can run. These include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers.| +| [BitLocker](bitlocker-overview.md)| This topic provides a high-level overview of BitLocker, including a list of system requirements, practical applications, and deprecated features.| +| [Encrypted Hard Drive](encrypted-hard-drive.md) | Encrypted Hard Drive uses the rapid encryption that is provided by BitLocker Drive Encryption to enhance data security and management.| +| [Security auditing](security-auditing-overview.md)| Topics in this section are for IT professionals and describes the security auditing features in Windows and how your organization can benefit from using these technologies to enhance the security and manageability of your network.| +| [Security policy settings](security-policy-settings.md)| This reference topic describes the common scenarios, architecture, and processes for security settings.| +| [Trusted Platform Module](trusted-platform-module-overview.md)| This topic for the IT professional describes the Trusted Platform Module (TPM) and how Windows uses it for access control and authentication. The topic provides links to other resources about the TPM.| +| [User Account Control](user-account-control-overview.md)| User Account Control (UAC) helps prevent malware from damaging a PC and helps organizations deploy a better-managed desktop. With UAC, apps and tasks always run in the security context of a non-administrator account, unless an administrator specifically authorizes administrator-level access to the system. UAC can block the automatic installation of unauthorized apps and prevent inadvertent changes to system settings.| +| [Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md)| Windows Defender Advanced Threat Protection (Windows Defender ATP) is an out-of-the-box Windows enterprise security service that enables enterprise cybersecurity teams to detect and respond to advanced threats on their networks.| +| [Windows Defender in Windows 10](windows-defender-in-windows-10.md)| This topic provides an overview of Windows Defender, including a list of system requirements and new features.|   From 0cfd1eb824f6879370f777af139f1c2a93d21cfa Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Fri, 15 Apr 2016 13:40:48 -0700 Subject: [PATCH 004/439] fixing links --- windows/keep-secure/TOC.md | 15 +++++++-------- ...e-alerts-windows-advanced-threat-protection.md | 2 +- 2 files changed, 8 insertions(+), 9 deletions(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index bd3cf71087..c9fbc03197 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -402,14 +402,13 @@ #### [How User Account Control works](how-user-account-control-works.md) #### [User Account Control security policy settings](user-account-control-security-policy-settings.md) ### [Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md) -#### [Requirements for Windows Defender ATP](requirements-windows-defender-atp.md) -#### [Onboard and configure Windows Defender ATP](onboard-configure-windows-defender-atp.md) -#### [Windows Defender ATP data storage and privacy](data-storage-privacy-windows-defender-atp.md) -#### [Windows Defender ATP portal overview](portal-overview-windows-defender-atp.md) -#### [Windows Defender ATP icons](icons-windows-atp.md) -#### [Use Windows Defender ATP Portal](use-windows-defender-atp.md) -#### [Windows Defender ATP settings](settings-windows-defender-atp.md) -#### [Troubleshoot Windows Defender ATP](troubleshoot-windows-defender-atp.md) +#### [Requirements for Windows Defender ATP](minimum-requirements-windows-defender-advanced-threat-protection.md) +#### [Onboard and configure Windows Defender ATP](onboard-configure-windows-advanced-threat-protection.md) +#### [Windows Defender ATP data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) +#### [Windows Defender ATP portal overview](portal-overview-windows-defender-advanced-threat-protection.md) +#### [Use Windows Defender ATP Portal](use-windows-defender-advanced-threat-protection.md) +#### [Windows Defender ATP settings](settings-windows-defender-advanced-threat-protection.md) +#### [Troubleshoot Windows Defender ATP](troubleshoot-windows-defender-advanced-threat-protection.md) ### [Windows Defender in Windows 10](windows-defender-in-windows-10.md) #### [Update and manage Windows Defender in Windows 10](get-started-with-windows-defender-for-windows-10.md) #### [Configure Windows Defender in Windows 10](configure-windows-defender-in-windows-10.md) diff --git a/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md b/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md index 5be7738055..5e384fe297 100644 --- a/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md @@ -44,7 +44,7 @@ The **Alerts related to this machine** section provides a list of alerts that ar The **Machine timeline** section provides a chronological view of the events and associated alerts that have been observed on the machine. -You'll see an aggregated view of alerts, a short description of the alert, details on the action taken, and which user ran the action. This helps you see significant activities or behaviors that occurred on a machine within your network in relation to a specific time frame. Several icons are used to identify various detections and their current state. For more information, see [Windows Defender ATP icons](Windows-Defender-ATP-icons). +You'll see an aggregated view of alerts, a short description of the alert, details on the action taken, and which user ran the action. This helps you see significant activities or behaviors that occurred on a machine within your network in relation to a specific time frame. Several icons are used to identify various detections and their current state. For more information, see [Windows Defender ATP icons](icons-windows-atp.md). This feature also enables you to selectively drill down into a behavior or event that occurred within a given time period. You can view the temporal sequence of events that occurred on a machine over a specified time period. From faef95c96b37c0c940c5e90ab1fd99d5d08ed166 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Sat, 16 Apr 2016 07:26:03 +1000 Subject: [PATCH 005/439] Update TOC.md --- windows/keep-secure/TOC.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index c9fbc03197..0eafd4e95a 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -402,8 +402,8 @@ #### [How User Account Control works](how-user-account-control-works.md) #### [User Account Control security policy settings](user-account-control-security-policy-settings.md) ### [Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md) -#### [Requirements for Windows Defender ATP](minimum-requirements-windows-defender-advanced-threat-protection.md) -#### [Onboard and configure Windows Defender ATP](onboard-configure-windows-advanced-threat-protection.md) +#### [Minimum requirements for Windows Defender Advanced Threat Protection](minimum-requirements-windows-defender-advanced-threat-protection.md) +#### [Onboard endpoints and set up the Windows Defender ATP user access](onboard-configure-windows-advanced-threat-protection.md) #### [Windows Defender ATP data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) #### [Windows Defender ATP portal overview](portal-overview-windows-defender-advanced-threat-protection.md) #### [Use Windows Defender ATP Portal](use-windows-defender-advanced-threat-protection.md) From bb288107f2a4dcb4bffe50729e323489443192bb Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 18 Apr 2016 14:46:48 +1000 Subject: [PATCH 006/439] Added Seville topics --- windows/keep-secure/TOC.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 0eafd4e95a..08c40b2046 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -404,9 +404,20 @@ ### [Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md) #### [Minimum requirements for Windows Defender Advanced Threat Protection](minimum-requirements-windows-defender-advanced-threat-protection.md) #### [Onboard endpoints and set up the Windows Defender ATP user access](onboard-configure-windows-advanced-threat-protection.md) +##### [Windows Defender ATP service onboarding](service-onboarding-windows-advanced-threat-protection.md) +##### [Configure Windows Defender ATP endpoints (client onboarding)](configure-endpoints-windows-advanced-threat-protection.md) +##### [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-advanced-threat-protection.md) +##### [Additional Windows Defender ATP configuration settings](additional-configuration-windows-advanced-threat-protection.md) +##### [Troubleshoot Windows Defender ATP onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) #### [Windows Defender ATP data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) #### [Windows Defender ATP portal overview](portal-overview-windows-defender-advanced-threat-protection.md) #### [Use Windows Defender ATP Portal](use-windows-defender-advanced-threat-protection.md) +##### [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-advanced-threat-protection.md) +##### [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-advanced-threat-protection.md) +##### [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-advanced-threat-protection.md) +##### [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-advanced-threat-protection.md) +##### [Submit files to the Windows Defender ATP Deep analysis feature] (deep-analysis-windows-advanced-threat-protection.md) +##### [Manage Windows Defender Advanced Threat Protection alerts] (manage-alerts-windows-advanced-threat-protection.md) #### [Windows Defender ATP settings](settings-windows-defender-advanced-threat-protection.md) #### [Troubleshoot Windows Defender ATP](troubleshoot-windows-defender-advanced-threat-protection.md) ### [Windows Defender in Windows 10](windows-defender-in-windows-10.md) From 626151f7455d7b7237c7817bf45d26fe4ab3d995 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 18 Apr 2016 14:52:21 +1000 Subject: [PATCH 007/439] Update TOC.md removed extra spacing --- windows/keep-secure/TOC.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 08c40b2046..6a2fbd0e26 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -416,8 +416,8 @@ ##### [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-advanced-threat-protection.md) ##### [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-advanced-threat-protection.md) ##### [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-advanced-threat-protection.md) -##### [Submit files to the Windows Defender ATP Deep analysis feature] (deep-analysis-windows-advanced-threat-protection.md) -##### [Manage Windows Defender Advanced Threat Protection alerts] (manage-alerts-windows-advanced-threat-protection.md) +##### [Submit files to the Windows Defender ATP Deep analysis feature](deep-analysis-windows-advanced-threat-protection.md) +##### [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-advanced-threat-protection.md) #### [Windows Defender ATP settings](settings-windows-defender-advanced-threat-protection.md) #### [Troubleshoot Windows Defender ATP](troubleshoot-windows-defender-advanced-threat-protection.md) ### [Windows Defender in Windows 10](windows-defender-in-windows-10.md) From 71a2b10743ced4c752be1aa914cb75b5908b25dd Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 18 Apr 2016 15:38:49 +1000 Subject: [PATCH 008/439] fix spacing --- ...quirements-windows-defender-advanced-threat-protection.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md index a6b5ded798..0fe2cd8891 100644 --- a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -25,13 +25,12 @@ Your organization must use Azure Active Directory (AAD) to manage users. AAD is service onboarding to manage user-based access to the [Windows Defender ATP portal](https://seville.windows.com/). If you’d like help with using AAD to set up user access, contact the -[Windows Defender ATP Yammer group](https://www.yammer.com/wsscengineering/#/threads/inGroup?type=in_group&feedId=6869350&view=all) -https://www.yammer.com/wsscengineering/\#/threads/inGroup?type=in\_group&feedId=7108776&view=all +[Windows Defender ATP Yammer group](https://www.yammer.com/wsscengineering/\#/threads/inGroup?type=in\_group&feedId=7108776&view=all) or email [winatp@microsoft.com](mailto:winatp@microsoft.com). When you run the onboarding wizard for the first time, you must choose where your Windows Defender ATP-related information is stored: in either -a European or United States datacenter. +a European or United States data center. > **Notes**   - You cannot change your data storage location after the From 461f0ce837d0e28e1a060f56c2d35f3adc50cfcf Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 18 Apr 2016 16:04:03 +1000 Subject: [PATCH 009/439] spell check --- .../alerts-queue-windows-advanced-threat-protection.md | 2 +- .../deep-analysis-windows-advanced-threat-protection.md | 6 +++--- ...uirements-windows-defender-advanced-threat-protection.md | 2 +- ...service-onboarding-windows-advanced-threat-protection.md | 3 +-- .../windows-defender-advanced-threat-protection.md | 2 +- 5 files changed, 7 insertions(+), 8 deletions(-) diff --git a/windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md b/windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md index eff7474856..3fc84deff1 100644 --- a/windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md +++ b/windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md @@ -27,7 +27,7 @@ The following table and screenshot demonstrate the main areas of the **Alerts qu Highlighted area|Area name|Description :---|:---|:--- (1)|**Alerts queue**| Select to show **New**, **In Progress**, or **Resolved alerts** -(2)|Alerts|Each alert shows:
  • The severity of an alert as a coloured bar
  • A short description of the alert, including the name of the threat actor (in cases where the attribution is possible)
  • The last occurence of the alert on any machine
  • The number of days the alert has been in the queue
  • The general category or type of alert, or the alert's kill-chain stage
  • The affected machine (if there are multiple machines, the number of affected machines will be shown)
  • A **Manage Alert** menu icon ![The menu icon looks like three periods stacked on top of each other](images/menu-icon.png) that allows you to update the alert's status and add comments
Clicking an alert expands to display more information about the threat and brings you to the date in the timeline when the alert was detected. +(2)|Alerts|Each alert shows:
  • The severity of an alert as a coloured bar
  • A short description of the alert, including the name of the threat actor (in cases where the attribution is possible)
  • The last occurrence of the alert on any machine
  • The number of days the alert has been in the queue
  • The general category or type of alert, or the alert's kill-chain stage
  • The affected machine (if there are multiple machines, the number of affected machines will be shown)
  • A **Manage Alert** menu icon ![The menu icon looks like three periods stacked on top of each other](images/menu-icon.png) that allows you to update the alert's status and add comments
Clicking an alert expands to display more information about the threat and brings you to the date in the timeline when the alert was detected. (3)|Alerts sorting and filters | You can sort alerts by:
  • **Newest** (when the threat was last seen on your network)
  • **Time in queue** (how long the threat has been in your queue)
  • **Severity**
You can also filter the displayed alerts by:
  • Severity
  • Time period
See [Windows Defender ATP alerts](use-windows-defender-advanced-threat-protection.md#windows-defender-atp-alerts) for more details. ##Sort and filter the Alerts queue diff --git a/windows/keep-secure/deep-analysis-windows-advanced-threat-protection.md b/windows/keep-secure/deep-analysis-windows-advanced-threat-protection.md index 261556159e..96fb483c38 100644 --- a/windows/keep-secure/deep-analysis-windows-advanced-threat-protection.md +++ b/windows/keep-secure/deep-analysis-windows-advanced-threat-protection.md @@ -17,7 +17,7 @@ ms.sitesec: library Cyber security investigations are typically triggered by an alert. Alerts are related to one or more observed files that are often new or unknown. Clicking a file takes you to the file view where you can see the file's metadata. To enrich the data relating to the file you can submit the file for deep analysis. The deep analysis feature executes a file in a secure, fully instrumented cloud environment. Deep analysis results show the file's activities, observed behaviors, and associated artifacts, such as dropped files, registry modifications, and communication with IPs. -Deep analysis currently supports extensive analysis of PE (portable executable) files (including .exe and .dll files). +Deep analysis currently supports extensive analysis of PE (portable executable) files (including _.exe_ and _.dll_ files). Deep analysis of a file takes several minutes. When the file analysis is complete, results are made available in the File view page, under a new **Deep analysis summary** section. The summary includes a list of observed *behaviors*, some of which can indicate malicious activity, and *observables*, including contacted IPs and files created on the disk. @@ -47,7 +47,7 @@ When the sample is collected, Windows Defender ATP runs the file in is a secure ![You can only submit PE files in the file details seciton](images/submit-file.png) ->**Note**  Only portable executable (PE) files are supported, including .exe and .dll files +>**Note**  Only portable executable (PE) files are supported, including _.exe_ and _.dll_ files A progress bar is displayed and provides information on the different stages of the analysis. You can then view the report when the analysis is done. @@ -77,7 +77,7 @@ If you encounter a problem when trying to submit a file, try each of the followi **Troubleshoot deep analysis:** -1. Ensure the file is a PE. PE files typically have .exe or .dll extensions (executable programs or applications). +1. Ensure the file is a PE. PE files typically have _.exe_ or _.dll_ extensions (executable programs or applications). 2. Ensure the service has access to the file, that it still exists, and has not been corrupted or modified. 3. You can wait a short while and try to submit the file again, in case the queue is full or there was a temporary connection or communication error. 4. Verify the policy setting enables sample collection and try to submit the file again: diff --git a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md index 0fe2cd8891..c483bf1efd 100644 --- a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -30,7 +30,7 @@ or email [winatp@microsoft.com](mailto:winatp@microsoft.com). When you run the onboarding wizard for the first time, you must choose where your Windows Defender ATP-related information is stored: in either -a European or United States data center. +a European or United States datacenter. > **Notes**   - You cannot change your data storage location after the diff --git a/windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md b/windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md index 797551495d..62ed1d9566 100644 --- a/windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md +++ b/windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md @@ -19,8 +19,7 @@ You have to assign users to the Windows ATP Service application in Azure Active **Manage user access to the Windows Defender ATP portal**: -1. When you first go to the [Windows Defender ATP - portal](https://seville.windows.com/) and your directory does not +1. When you first go to the [Windows Defender ATP portal](https://seville.windows.com/) and your directory does not have users assigned to the Windows ATP Service application, you will be directed to open the [Microsoft Azure Dashboard](https://portal.azure.com) to manage user access. diff --git a/windows/keep-secure/windows-defender-advanced-threat-protection.md b/windows/keep-secure/windows-defender-advanced-threat-protection.md index 5d1e82ddb5..1be65e18d2 100644 --- a/windows/keep-secure/windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/windows-defender-advanced-threat-protection.md @@ -78,7 +78,7 @@ Topic | Description :---|:--- [Minimum requirements for Windows Defender ATP](minimum-requirements-windows-defender-advanced-threat-protection.md) | This overview topic for IT professionals provides information on the minimum requirements to use Windows Defender Advanced Threat Protection such as network and data storage configuration, and endpoint hardware ans software requirements, and deployment channels. [Onboard endpoints and set up the Windows Defender ATP user access](onboard-configure-windows-advanced-threat-protection.md) | You'll need to onboard and configure the service and the endpoints in your network before you can use the service. Learn about how you can assign users to the Windows Defender ATP Service in ADD and using a configuration package to configure endpoints. -[Windows Defender Advanced Threat Protection portal overview](portal-overview-windows-defender-advanced-threat-protection.md) | Understand the main features of the service and how it levereges Microsoft technology to protect enterprise endpoints from sophisticated cyber attacks. +[Windows Defender Advanced Threat Protection portal overview](portal-overview-windows-defender-advanced-threat-protection.md) | Understand the main features of the service and how it leverages Microsoft technology to protect enterprise endpoints from sophisticated cyber attacks. [Use the Windows Defender Advanced Threat Protection portal](use-windows-defender-advanced-threat-protection.md) | Learn about the capabilities of Windows Defender ATP to help you investigate alerts that might be indicators of possible breaches in your enterprise. [Windows Defender Advanced Threat Protection settings](settings-windows-defender-advanced-threat-protection.md) | Learn about setting the time zone and configuring the suppression rules to configure the service to your requirements. [Troubleshoot Windows Defender Advanced Threat Protection](troubleshoot-windows-defender-advanced-threat-protection.md) | This topic contains information to help IT Pros find workarounds for the known issues and troubleshoot issues in Windows Defender ATP. From 6d2cce3cb1a4bba54b0d1581b016e8bbca911983 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 18 Apr 2016 16:33:01 +1000 Subject: [PATCH 010/439] resize icon sizes resize icon sizes --- .../keep-secure/images/active-threat-icon.png | Bin 3176 -> 2016 bytes windows/keep-secure/images/alert-icon.png | Bin 1108 -> 1489 bytes .../images/not-remediated-icon.png | Bin 4655 -> 2270 bytes windows/keep-secure/images/settings-icon.png | Bin 690 -> 923 bytes 4 files changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/keep-secure/images/active-threat-icon.png b/windows/keep-secure/images/active-threat-icon.png index 6eeaa57dcddaa1c2e6375b59faa2ccf322066f2c..d1bd6bfc8102406103d752c3efbc34576bcff250 100644 GIT binary patch literal 2016 zcmV<62Os!}P)fFDZ*Bk+2_Yi@000VfMObu0Z*X~XX=iA30IUzpIsgCw4s=CWbVG7w zVRUJ4ZXk4NZDjy8_YVmG000SeMObuGZ)S9NVRB^vU2y+80000BbVXQnL}_zlY+-3_ zWpV(wz_gD5000PdMObuKVRCM1Zf5|%8|H@q000McMObuGZ*_8GWdQa6gX;hQ00?wN zSad^gZEa<4bO83umcIZ100wkLSaeirbZlh+sP57y000K7NklaTZ~p$6~}*T zoiof73%ytq7;7|*Xw$^BqM{Wog6YL+?1d0$O=(I^OcP_`<-rG^e6TM@O?)95jWI-1 zr4&kOODPv&=mkm1V?7b@``UixXWzBF@yhdT>EGYB5Y=#E;<@#%Nv|goZf~<%0+*3FPgPb}*&>V$v*w|VTy*(t z7Tk0l0M~qeKJ%`*n#Uhp!_nbUg4M(nma9pDMb!y8A`2rE!Jc`zf=g_wpBafTT@ z^fX&{4{_V=w=t^+UfB6}PLE#1k~{9;t)YINd3rYii21wTJ!8t7c`ksRo**Eqjye$X zDafJ|DR3A+#iMK2Fk{xIxb>z!jt?H--o?w=__u@1oj0E^&7H;S)vGx%5-CgsMN|{C z?f$Ik9pjwrFmMNV48yZ18RHm{p#v|mqyG>$FJ8iB-P7^W5nSSQ3rf3?#Y=AG@T&v# z_dknM60OYpb*SeA4km1#xaOqj11gcqrUL9_4isG%v*KGf^3Q{NSog?Nlz_~LH7T0LY(mC(gDEy26N-VL3TGU`Nmj00 zP45*~)Ax<}Idvme7-z;t8Ec(QR#b82wO{4N`EyzKn_qM6zoVI9DFjkXDSVEGIhlM( z^9zC{fkH;10Gwpc_J`TF_XKx;`$t?p4LoM@_87D0^fGhCbP6EGF0fv{ci-LgoOq7) zYuC1QBWPlds!R<;SQHf~ry)bcGgubD0L-Jf%ufOHollRTUJX6!PyoY~Qhqy|2B)^5sjpw1g_QFbA^_apcHb{QMWcWZ=+?bemxYAqu#VTbAC1pFPUs z8#gkNc^89WZb?J3V8v;I-8TC|M5uY8d%pxdWW6g_~``_Yf_ z^@Z2*iI4Z@9vez8ftg%!Vx%pY^(fnloq(m5#0#pCF`nBu#K`a%5BzQ=e_A<$G!ABX6lRtM*s08N$0bC> z4N64{H(EBGf9&7O@l%WFz2uT~*yt!7HD6y8R2Qvi$rYx6#z#4R>E?1>Dlw5T;S~bo1d^m(g98c*v!|9rwfvQ%qT_c9|2zm;|eE-p^&` zd}CZffgoY%!@Zw6wrP{>-Nto4rhc#Yn?t~rHFmuKrBFxjBRkFDCX9@dC5CVm(`wl_o4E07BI_gU!4wJ7T`$YI yLT+l!&i}uL^EUJ60yOGgfHwKtT~*pc!2bZvUX;)yhATY)0000Px#1ZP1_K>z@;j|==^1poj532;bRa{vG#)c^n?)d2*Yw4DF|3;jt%K~zXfomUBP zmDLq~;?hjGT2M+G%aWIbSVW{+s9LL3XsOUvY&%mswpvFz>Nx74 zwGOrF*m1DnGPYJ25JhVQk^m+|6Ug@R^7enZ_rLwVbMK#onAG5z`~G*AbIv{cy*FV5 zBBSxM;HHd@N~MDBVoKvr1>x#di=#*x6DEMKR5at8mu;(S>+;DWfq4^^JQMBO)41k$ z%LAi`r8Q~UiHxr?Wr4_^?Z!exf+N5kl?ltQx~fQ0VQ-f_)4poil1PUba_ZvCr>d|N zM7k&99+=W53``^fs{r44M+bI`c%v8&M#5^?^wPFnCL)7g;C_})zKxrAf9MsuH*Brd z5i9`Urqo$_+LY>ccLmBE*jBgCgq_d5xG@wZDW;P^`^n0hIhD!ks$^x=yt&DW`IT3{ zv$IaYv@s`s=pD-yU$#)@?RNb@@Bv=jA$(eYEtGw55Qa9&54{p>*bi#}4>R-PNnS)5 zd%q8L8&f%H=m@LTzmV0ETFYeG7H(@9S82 z*|$TJdG^ii3hsf z%0BeM1_iTe!N8Ue{B~JIvMQOJdreh!Rdvn0>Wa#m8z3CQm3|Jf3u8=(C0r5s@N)
RLhnfIwU3=2t#rKF~~xQY0bynaVwvOA-UKDfu^0^tzH!P z!W6kBivwYBE=X_R2Vs!jwV`b487H4NH49fDf3&iu832w8SDXnTw+EAks@U}Y%hTsC zMA0d>Z615^m1%l`W{=|ofDGavJ%l)tii0X*RS&fC+IO!1PUV8UO5ZrW^4RLmEPdE^Oj8>s&Ny7n0ix6;LWJ)254$6+@A^;?&vnUHnDApk5S)7+T$8Zver6122qQ-qg=%OLPsTtr}jAz1*1s2m(gG_G#8cyg|rM5(o%bY4`y;`4+8&JBPisT-rKp|iy}k^ zRqHd;K`=BIs!{CN`>(H_c1A15o{ceC8wi7NVM0NX0C$Q^vh3vK_4A(I_>N~oO2Fau z18}i+cL55EGR#mUqHNvv^~s8PnS9ffDPvj~X*3J~1db#QS0@W+Wh{B`;rfDXt|-4~ zb8||E-FL58@XTwqxS)hAb-ia)%muQ2B38(JqK99Nfvco`HfTSb7Gz#Yjg%Cb=Su*b>D9m z|M{;Qakj85hPZT)1x8|BsX9`kQvZGX#qTY-m1j^`ih@!$lRD??XXiqMp;o%&r5h)o zKdRY!m?e+@AhQ~wkD3b8bk3SKZtI@*LLt{v$oPePrl&h7mU6ydEEaQxtjcxV^Xui0 z|8q0SFVYkK>c>S2npQzabNzzkw`NygS5YyiqB2=kS&^)mlbl;Ir?Luz>gvjx0yxPOVogiBQU(IXm1BTj33k_f8f z()-09*0_VEin+u99HyIP7dPR;p52GBBo+e*C0IBvjuHBdapG{2T!3J?90CYm;fWuZ z2zNImu&~Gp9HR{zK94BQ0Db#7<8VfVJ5(Vo9I_~)E%$~@uyE`x2^6<7K+565A&O%4 zmGnd62Dnq=Er;j{B2;x0d{iiA32r|kW1mRFfJ3(m?4kLus zD);f)KdiXm>|-8Vd(WHizcFg^}x63Y9 z@e!Zny@NWzM;~Jpw<6tbGPRG~|FbcZFMagcjoqcZR&Cqgc%tmW)4%`IU%l6<)8ZcA zzLWTlVwJYmv`uz_<#>$swpbMT+DZ3k{lFj3SbKQ+28U&;(7or0HNT!P;mkG9Klib$ z@#M)hYP6S^KxF$>j4wX{JO0b# zw$``pr`Y@6eEsoBmt4AN=`Z&e6z(ZFfbmLWy^(v)z$Re317bzMuE+-t27r?>IiuGw1(x}tp2iR0gGXz!rN2&(RPUVZYsQ72U2`imWTgO@il z9K}ZN>aavVf#QGLL=Z2i;fB`2Rg;o)^};o6%+O7mInY18I=pWM4@)y>!aaCb`z z7g2^H-X38QciB|!`sw3OsGh%YM@ybpL)Z-G0SY6{jJKAkOnI;=yK!BiK>WzRNClG= zVclFdz4!Mk7hgE>%%@&@6-6ya)xA)a#2bZDKK00h53O9Wx@mtmrmznj;fDe5wBg?R z4_=;Hc1g_-eq7tqgLeaRinR&HhM>8-m&id;Xe-s!UJNYq}v=}0jr32L=*~vhKd9S1ciK8(*t+i{FN^y5{Dm|IC5m-@S_ep z4E;pnhy?!G9l>^loj7bnV#J6j39Kkqj@T+z6gbFuc$j6O84f=je-spX;0W;H#nFyn39JfR8d*$(N(!6F7sinI zhuMm#*yz~%L>O8UX>wghd2JYo1 zQ_!2QQ;^^f4;Y`XXEaCxt4O^eLkq61kWj3|u%de4f;W@q%^qU-o(fs3Z2Vh%`GZvC z#i9H`9vf|t*;QCfQ%_VD#2QsX)y6f8io$qYbUEF7GE-yA$Qs7Zx@|awf%`Ow!P-gi z1vSREz}1)*#RO`IQ3T(mi))15YAaKHoZPaVfqZ?|h;igYs{W!l=#M~$pt<#46iXX7 zLVO0r1aXUzoD$Yr7PGg9elv=>GxLOa9va$}uef O0000|7?1G#Y z;c-MbxlM%1C^L?Jr_xTJ%2KV05VgUz)hZ6w+ zkf%HOMgaiyh4k#nKL*v5AeecM-~gThsmN)|6K!?3evpF?(>|IR7Rdk}SM@qcNRcTa zTu4+9gGy&oBO?G+dBh=!D@Yw1Nx#CNUJ7FZmCC(V5{3RyMhHb3)nzfMv=G2ttSm1n z$xBNfk)h033L^v{(RZc!y+68Bqk_UIk|+acXnUF~VThE86h;I!;u6rN`SH5M!2jKk zW(0)*>$_>6|BqoKX|#|CCa}?aParWlY0Q(#3=aXySYO{91ppBD9M0a;Cu5Ol>ul<* zHZ{(htgEixZ;i;%4Rk3%y$ho(+d0YTc_a0*iZMoS#vw6x!j3>v9kSa~37Ptkk}_T7 zf-wv?5G-8Ve?9gkVXAVlCuugoW+e2a&?c(?N?~oS6aMkG{m|~=G36=csa@D#(Ih-| zL{G@#y1#~d9K&S#kwr=^Sl#qnuyzwg!y||n^^4`U)k;BIKd(H@gCGb)2K+}<1q72s zyt#0uafkChsk9JT^|=vw!idq|Gk>zJ<5hW*fUPr!gP;f=c;A9_7zQt|eiq^tTKT1C z^ZEGk9t`ADW51;a1|Tp=V8Cn9PrM{zMaINz%*}yb%6!5bS_-jP?5p56HAZ!{Xa|4Q zMb(73xKq~FztCvwn~B+|Y!qMg?He0~K7AS*4ubbvV#*pH*5tV1`FR5>n9TS>HhW=V z;q^SD+8$rfGasLjAQTD@1aa5!vFjeblUwO9Zd8ZKQ}RK*bQ?Q6vcEqwmKCcEg|=sf z_;NU$YZMn3m$IFdy~1X1mFUetUvIAt+Jr0LT}MYpRaLdvq^D+eb8BeGgT-PcBv@lI zQI8-L_}SxjE#JUABBQmnwSS)R;Jkqr6x#{Id}6X;D!JVVv#v4D)qwb`H~68BR=gOJ z#r~Ua_-K*_Mol4u!(nk|XJ>PApaybu(BG^Iu(6GK;yz46Lqln4X|li$u85hcr%Arg zc)j*bNz-b`_BAzoo)@a+pOS-ZaA&@IV^wZ$ZiUh_|F5g7HGKXNo@>QjdlZ|)Args{ z0kbTydYZ7iyF2j7*!cJX==Bsv_7fgY+i-qjVq#?l)x{b!Q5=olhpDF>Rgsqt*~=JA zsQAMUfqUjJ7tq_+=b(2x@w73YNz!<0pYwV{EXF=KZvwZmvMSH#)ilPX!v?-=Z?{Y@ z>1b-+b#E02Is`~P#6$lR);X#-aB^U9?RaHgjVJPX%H@=n2Z7ak-u!K~`z> zoDVF~`nqh|a~FM&Xtv)PdlZu?8JUlfH!|OVUr!6l&VbQqw5Fye2%^J8tJ^mq08NOZ zQmMhgI08MhSbtcUIB2GX5G^mmARw2aIqrpf(aFg>8yjd_TP57s#KZ+MSp!p9S&94I z4gZ(|Uyd0z>#H&9@=-6;Ap4Jc$+8Zo`;$l+9kX#Z{qUe{Z7nU3OiD`1p6*}EwG8=} z*%t5YMvjk^cXoE3(LHaVX22h)rJqWSi}R@?7kq9cw|Vq0FN;KKigF)T{>(dh_mxN_ z!s*=(M>|7O#7zv(7dw8*+^9_1{-L3vq@*OtP?Z)c3rBcGja5JOnRJQ8EOBSxpm5C% zKl=9V#Z<{FXJm)l(qffX9Mm20mZqj3#NRE@=!*dsCAIP1MAowYd+zk)B*E1cZEoJu z+NzhXaszkBs^S7Vw|SP5kkI6bY-w)(?NNb?zN4e#gZN@o1M2*xw1%W)ojk!;=IYXY z>#|bswTu~B(R8e(ke+xZAEdPpk&fzuW3!al#AK5qTsGeSji3p&N;Z^sxTK*{{<-=n_d6_ delta 1095 zcmV-N1i1Ur3)BdZ9Df0B;1ucr0004VQb$4nuFf3k00004XF*Lt006O%3;baP00009 za7bBm000id000id0mpBsWB>pI=}AOER7gwhmd8#cF%X9Lg%CM|5P~}rcMwQOa3RMN zPr+Mo;6M_b$eclBAzlI@(h$Cx-{W?>!}PH1O1t7ew5n`Z_HTwJe`}6bj%F2q--`?J&7~Mq{{pICF3drlz)6;zMYILiBQvN)Irimjz z5YR|4&Cv1j@!sAZ%*>EGJu@@Y(9p2Fyo_vDm}v@CTU(3Znu2mt^N@K?rDKCa)e@8r z*@>>1Lje#4et%Wb$H&JJ78Vw;lk>pm!NGxq`uchaW^QwHbAEmvL3I#G)%oYB(x@Y-=r~SyC*T4b;@scs&JTEER#(3ewuzia=8oCIf^l zl^BZ}8yj`htE;OyA&^Eu(#tXf`o1 z!G*@LpyPM|G-w?qnpIX->g?H*W$$MYGJAY{lz{ug!$XAq{e6YmuLX-R=LWcNL6naR-;5iUhT`Un@^Rstsi8oWkAI7pB(vauHv2Mu;(af^5|8r?bhc3u zqNjxgoDO?HEPjjM{r$a>iXa2s);5*GaDcMo;mGx(>&x;$mH=XZSIUleb92+u($dq@ zqrW`9JaAoIT^$`AmzS4{r-YPB!6-mtJhD?wfb7{MJaTUj3=C*o4Ep-|$bdY&>UotA z(tr3VJDc*!$qASD$jAsXgSylQ2M2i-&(6-Q>u3xYY4PxA3vzLBfnU5^(f}2@kT!Y| z3du@$u~34aEU&JvczB0~hHQA44G#}jRaNn8!s`QX{-F_2sVxr+Ye+ZBH8Gybg}}z( zh)qI%cz7sG27Smf_LTr6)ZX5{zP`?&j(-Hf>@tfI{BCb=aYVd|iVEIr9&D)e_V$vB zYPGesMV;Y9B#n?k!8(sJ>PdFApDhSpPESuM8qJyCmRxRaZH)}rKUL2H6S7flqDYJ9 z3U_yR@X$%%Ux9ssH=MLdE)TmAu}G^YP_XOkYs%Q)-_Oro#(hdcVm!GZ@$>U@ia^GH z8r6eh#(hdc34XvUtOaVyJ|!V79t^xfxt!AXDG8V`%C)v6l@5^n;ZmGRQKaK z#7E%}ju`A2jlGCvYWF>iwL(jV+Psbv&R85LID*nd4yjy3M4|-TJkT;8xkUoUahK%; z6Yet%u-L>~f_S>D9#+?p&&sc`B%Lx*-(tl%qn%sxakiuB^q=qH>gv}DT0T0?Zmn&K z2prXDCQx`LC|pNPz=d=?k2oDBD?XwF>32uK1doG%Jv2Z+9n1*}#7KvsFx&YKj2sss z$7Y4r`Qed}k3Nirs}fu(k{5#7-@_%*00Q8FKzNmnl))bJP-KD$Fc6PQ;7RW;rT({O zo~nsq`G%zV%k+NpZZz#QT0Qqsz<-BV^q?M^1%e%dAY}EiIDZpbI)G&XTztuF197*T zNY%wjYINgj=VY8|gW9ODd~j)QlP|06!-o`8tv^U+Er26|B?Dq`bcp)>ckD6M-Gys} zEEB?)i4{IxdbZ}Xp_iMJT3J`B%YS$Et#(UG7^yDLRr$UM-(0~AeI=)zJ?&)Ea>I1w z=Tz8XE6+2&vn6(GOQHVr>n<^LG}Y_}xtWo35_8U$8baDD zQ|qjc1w5oAxne%$XlMm{gb&@Ta_cEfQ0uknjj&I4$PacvPjSWq$AS(`g6q1J)~M5BIzo`; zi!>h%{hbG2EE5=iIj}DM{O*y{*Bg6qT^X#jh8iL784K_B$JX)vdX|L31w#I>u}Cju zi3PH5=eO_!k;ql%rW2;r$+6jg>7V83_ZzkReJKnBj!7S+k@Pq2#;ayTJ%z6>F(Cn?fPG5 zA}h#~vtJ_Cx85dYSISjhiFw8Jb~|hJg#T2((#tFGElDJTX8pWXbufD8PVaBNhXgD^ z?y-$+bfssxC}}{AtiIY+efNB5D8cqeWHh^^tEfq%C%aYasuow^_3I*_Vq{Q90J{xogu$U4nw($`CV0Vs;la#=ztIcib*hDT03F=KZj zDoo_(Xk2uN$i|<+rk3SS>rY9Zw&aI{L@qmLI3r|b{OFS(zqK%=N$aA}YI_MNH>l0i zZ*?lomg7?u0ucZN+WD4inccEnR%cLy zF2~2^<-tLq51Fqf9o`gd7_U(-X4;(Domq!o5;+!{eNw*;e#-USN*$T+DG#r$em?<4 z13D3-TE`D5Yy6afhYgx4jW-`y94--hG)tAQKveEMx`t75WVY3k-?0;f zflC4V>;oun5PL~p2aFWA0>o&5Ank2C`1gMth|>$bn~#l5@ndvr2hGb4n!F6lC4V9{ z6OMj;03lR#P8VT9m#md<#3|6_#ZCQ4smb?6)wq;p#Cn<>R7jRUwv3#3v$wAgq{A4i--APJz6*cM4ec#=qv;rvl846;F{X8p>5b3MqW(El+(`2>K9$Y zb{Y%r_ig%l2xz{B3m;#FT6~*hyMcRZ zWY=Ys3`p3A7C?OFZfq$_Skbxbik7Ot$(2(!*Rje6eL2F!W(SIn5tsq*{6K%_5n1S^7L#Jq~(iZceH?x0Ru(009K? zU>_r2<1oXl=c?cUBey?DsZ%M1dFRoAu`MF@G_MsrR(H0o=X67C?%tW{ny+2`6f|?| zE7rqfbfk*Fqtj$@*?gLou#xyIb0kX9)7_Xw1WVN&~r=N(|L8S%@%o;tIHLiIdHE^fnWW-(pMn%o64+RQhIh4+40F6;M zisjq*GBow+nZAU@rKp0hQwm_&zU|&`X4m=gQlkx2%7$_{yT;19-2>rlCZ_WootIfI zur_yU7Q%8*gAi;NSH1IZd5c@DJxPx#1ZP1_K>z@;j|==^1poj532;bRa{vG#)c^n?)d2*Yw4DF|5yVMEK~zXfZC8nV zQ&)D^Ka(~EYy)O9-n2_tk|lX#3or~bZHFdIny>^2CS;vX$Tsb?Ups^(U%pHhl4;Y< z*GVQT3D_7fvaQXsE!mPK%htXx@9F9Ecb*JcI+yFm)4lhdd+xdC{Lb$v+-@(CP$Q}n zRcl#6vy%#fV$$ucNoC5%DPLY1P*FToRsD^^8Vm8S(>w=gCe_S8vIkXRqFnJJSTeP~GPX?2_T zQZBEc$yuUGL1WVu5@>m$UXy%%9St=U z9=EebBK}csl`;uRuTv~WWr0GDa*w9axjA7mWOVJ&M&WYZsl56cWmA;RQhtpxF-ose zHof}rAZgkbtzG1q5W9C!SyFgsCunLC7MmHgjQ01J#QHafET118sMW=QT}hP!Rd{5lIxVu;?%S>O_hY8-4fWRruD_LcI$GFSrIsDr}P@- zlN66qI!37^WntG;rsDy+eRJNX%Nuvi{Nkh{IG}{hrJ6wHNP76}+Cd|gt9;bZq@>+0 z>Y7&c-Bc45A*_SmvBk*)y_8P5o`2FapeM1!2b!EAp~yFf^9BahxLZmEDVyMFDNjKk zRSP6l$>D<;_>!?MIH18nsGOz59K}!Oz@eq8AW==KcwtjsigoY?*QK*_m!6QX1!%e|_&xh<*Q6Sk;*eckgm&7yrTo^F#e*3+@BYg@6Z@`i1s zY^Lt!@dHOF8lZIC^N>N*x7NFxmQ5Ch2)A?8XX&8vyRf6gheBjaBqkD9pQ=B5UU=?e z<@t-zcRuE;5pe|EpFd*Rg(GJTyGXyis%^>WcNbM#<3_+sj08d9aZW4`Drs^G-;@OW z#mIe^CO%6UjU2aPC42g4_TfipVuV~XRISzlC1Q5o-c8S3nLB!T;>b|+H?L43kI)kY zHnn2f?FjbkSR#i=m6HBj{U*vLsRUgsrD~3ZER{OJ&f))$K3b^CQ^QQx*-Eqy{k%N6yVPCG3;J2!1 z+C`88iQHsIl$&D4J-X7TqVX9-D%O_8dJT~yMj}?#s;SLy>xiqHf)`!{@`&(Im<3=e zRTr#knqFYjLPo<;?llJFz^OywV+ZKn|DgBZr1!4VyVvQ1*XjM&={@<$FW0zZ@Wyre z_#JxZdZJf{xZV&4IN*!hP*dTWnW##LtRhtes^M8Cv49)+%e_*;UCHmlhT&udVX*sJ zDsUe_{)TnyFfgV8XL7URkXv4S7aF1I>w+fg>QimEN}MAB?4Xj&J0l@v>0H$}Y;k7X5P zS%^V-bH>kgN=Fb3{2q-^GR6xknW>}3vSw#W*HzfJhg8iK^^UNitE_JF4fa#9j>B%4 z6`iD_@3&6_f_wueZ(ldU*@vLE8|MZLGyR>E0(h;YG%Z!l9(wE~xyJ)`1ATLo-uaih zstKV<{-}a2RfbmyY@lj#^x;GF>8A|K+_Oldl*>^narcm!Tn-9Ni@KJIb~6AbbLj%5 z!t~Mgq;Ut*X->C;-u^&ALMHLr@PfHLG_-Hk(jC{g#tmJw`Zj1cZ&%It0UGp6Hg!V3 zCt_$1nf3_E&47kA?OvMp(DW@@@+EqAiXEHE`VRW=j|xgIEf|#)S))RN5=bb>5?M+{ zDYr(cn4DPSjODomk4FPZORJ=8N*dMl#&5%xj?%@)Y4Rp1n}XVIN`eJsLd!NCAWW2M zxKd+`v!rb5ETtc0N$iZA)pklfEUZZpmnO6?8l1 ze{uwlsi0IKXho9djLE13$ggGS>;GIgXoLTBIrhwH9G2pM0a2<}*uMF+@0Wu$O$$(( zG@C@j*0OH5^PvNjN!MyM95xuVbyJzWq>j|&8)xOOy&N!Gsg$SG%BpoQjoc;22<3C4 zC{jhFwYfFzp2*{mjoNyAXaA9$GgK|L^^lyUM2dx0%qq$W1T;f}Vcg?}^nt@hLcMC3i*rde>-gm{`sy<( z zi%%$@fnI`G6p^n>Nsxj&2W_+-mMtPtEEqJiIEay>TMjC@!FK*2Pz<(%xKi4A>QK_q zwrW;?J8)RS9_e)uxr9}@g!~X$;`9t5$xzUu;ZN|sA?LohLZbGI3h=Z%~j> zh;pSmZW+uDP%oA#7MSnt#DzBK2-LfOW(B2}mN56mzte};WQYf#UuP)imwOQ3KzR(l ze~qsFrtruwyhAp4H6t?QFf#M2EUpCCopBGJUVP><_>On@3D@Nd4c5~jKKJP;=npzb z>CDrYC|_W5xuKJcm2y)+dCpq;0F;+Ck}pTD6Syfn zE-zdY3~B?Ac^^Ii+?6AgV})HvcCk8q6$3nmJXr@+GSS0IIovttu!-dj&^e{nafeV8 z*dC@&KbSgb2wB=nJ-YO!&0=L2 zZOG-;cxwzH;lM+xMeh6p?*wwgO@K29S(r+G=cxiS+?v4R8bX9JbNA6t0t0*Vx-CWR z_DuVxx?yKk(<~WV>$+{=@%65jylQ93unXKjqivqI8pYqePRT46A`(gqw^NeM07r!{ zZA2jcW6#BwSeJ;t{p$E*Kb^mPVfOqP*Tu(OPoDBVc@ll@!lQE+9-BM=_}uw3zH?`n z;2CF6F23>{C(3M@l`h2S?W>DD+bYKPimEN%-A?BoqtVa(c5T|Yr>NbLHgrTlEpEI+ z*Z(=KZxz+eqH24jM>l`@c}hZpq?qw~@A>3Cv&lrDf*Y)$AX^@P^oScM`{;4{)o}gl z)AZtHx_U`^nLEF8zaqW#boJ_U^y^`|^s@z9+nxP(T3)77j@B0Etevn{Mb%P5$)nvF zw5V2|zDO&JV3*$JZX#WCwfnE?`YkDS^Qy_Z6RxWs{Mhwu9dXg z>bk8t-OiA)hyLw#DwGsco-rzfbH96GqIVBaA!P0f^l9dLRYAKkI?%IZ*DUpG{Z`$A zMT3z*pU%hRLxnYgKGott$HD;C>%cQs4)rYbDSehMpGE1n>6eGhi+zS=b63W+v#f2R z?k4KkLY>=~uusi$g1_;`pAMOv&ppHNHG6YqzcSwO*Q9Kr?(GRxo4bFIZr!DPRpFkw zO^LvgRU0*t5L}YA$ z3%jq(@xaZdKXcl5r;J<4utQL`CRDp=`1E{lcT(NVRfeuLZ0anYc{qA}D6QRI>D*LQ zxBIP@^xJO(aM}Mnt~-F|(0=W_xeMhwl>qfJKak@D0Rzb35EauTtk%D{f#NG}>|VBL ze0Gfo=Co^qy&WEVk8k)DilXSPi2!#IA&jpe2A^gq>YYDfiJ4nV`esSjR8=-hYDDhl zy7ECmy@?FlL4nGh%@tE;(9r3E?~aX9A=`)vg$w$DwhSnlxxju%f3oS=fD90Ms-~#` zX1YSf75el>P_K?zEffq;3eLJp(RsS~cYagH>JwKeoTgNY(|!>^BM7i4Byk;uaw|fi zv8CQNFyWYbXH360v#%{_+!@igMti$fOkMMKL;T`7@_Hzf0my>QY*bm^*(s1#)(=5C zImxI4SZ#25+-4#2`RSj3J!o8srPl*K3n@L749=meNW7+Gn@0%U8 z-|f|oKV<)}V}~iW3V1?m0D=H$j0YF`)De@4M#gA8P3tj=tx*Du5~s?cHUXj)>k?d~ z!C26k2DzM5lw1k*t3x38QME6(D|~~R{XtP!Coy*x-kGcDqj-ws10;$ z+}IDB!r__1-7OF3_Y zp*jMa1IFh|(Dn2EmM@PCQ8XwQpmKvSEPQk$^U0?GJPFYX zxnenW>yy%--V^`udwTaxy8f>d7VQYCQy^$1&zoTlZ(jk03s_Y_vyL2dYz4O5M#h&> zf>YN<_WE8^IGv+lYs>wr<=$=@cd&loUp1+MdKJNu4t@Rj@$mzCzpZ;gy>(r`JEv9$ z`VY~10glgXEVEX*d@`bIN?N*?^&N}*)U*5h{`bTYu31VY8DpRTSc3pBU$80>_~dZ% zF3cq4dzV#Y#TqZ@-)o9l_XH||P``%hF7O4sf!(4e!Z>v>i86u-x5Jb z#A2if;&+uYs}yn5@Xx)buEpV(DFG%cRI6|-DwbI}PU4LnAuAr8x9R-7Mw;=-{0a6$ zV9SBn(66E551V4fIYM#&vRxT6DQOJ&497z`B3E4U$5p9b2A1K-)%D^xACDoanAO0% zfMt)rw{zao0mqo=vrIqr5+y)wY85a!Ab`A?RI8xqCUmh#>&sxYi}3R4#{ELMd+N&_ z5B~YXhWv4dauM&42C0d@{F0(^j)OvyipUe7VreQTnZTj?$fxA;H}jV}%5}`<)7of0}vnk2xp%NQvLz{+vvN_RzVgQl?q z_-Pm$)K3rXo9j1wZDyy{l7H=0%EAxWavR2jK3p5$bH^Vx#q8t^7NLaUl)@!il-5=O zzg&oOEiOMZNVu2++;9y?Y0SzU%q9&h)% l+~jfW2%kh}quy^s{|BBBDhH}d;JE+*002ovPDHLkV1gNY9GL(B diff --git a/windows/keep-secure/images/settings-icon.png b/windows/keep-secure/images/settings-icon.png index f6c9b07c052e690c29410b9dcfe46c8c8142f2cc..697ba3b0c378a23a310706d8bd7403baac74e501 100644 GIT binary patch delta 915 zcmdnQI-6awGr-TCmrII^fq{Y7)59eQNUH*|0tXwAoEp4w!$dprdIt6qPhVH|2P{Ht z3W^*F2X+AE*h^d^N*qf|GV+TUR<1ka0Tki^3Av;eCl_TFlw{`TF$i-iDg(v2K;q8% z1(ija=@}&qYxvJt0Y&-1qD85RAf*Z=nYpP9rr-HFfij#Rnc)1ilJdl&REF4s`u`yH z++fo)i<5H_foh8wwjbEi4;1DA35O>Z}66k`Kv4aqFYNo82^?vgqK15=u(i(^Pc>)Yvu9$A4B$Lr&!cCEXk zP~YMt5G9ny8$O9`Z4O6FkJ{pl{x$)og+~v1FZK?;GU0`QM?$cGqe$!Q8%jbR0Rf!> z7ewxfoxd%g|KUcrc>nKa{&PkD{``1gUDNKNqSPQCJki5N8HOQFJ52c>2Df~?AiLWydNuM`j3CkUvlZC$>GC?@7%i= zq&0QMym`w)v?h8jEwGwv`~2IL?862Tk&y=&Qc6<2oA&JK zS(cfyIr3%AOTVvQzi!;SxA*+>$N&D#n><-qOD-?`EA8y;R)np7vFqHUM@nsp zHT$Prf1O%WGiP!AV&!eywh1_G*uTI3{PX0}(y1v%otd+M#{K&JJ2EP2(ln>Clffdc zE{g*{e)^=eY}v9S=g#$cEDd53XiMyP{W@EagXPG}mn%;^EjskJtp5L`<(X2QE={LT zd&|koSJu_3N$@PnlzLboae7mR+3Y!U=NejBoqF?TP08XVOYh{F8`m2fi*&n&gg*W8 zW5)OI<)41qaC39dSk}2}RZL8bfrW*Kfy9()ljiNaem%VFsM4~`OL^NZZERACi-lbS zUzAw&^z=+P{S?TEn0EBuy?I-vTz>yOecrrzOY}muL{B|65*8Nb;o-TEwe`l`yRM<3 z_wL=BF?+W1OrN6CQrFElr=0qh`TOr)+j;Zn&%csoD%H#OuwaJM!UKm7GiPUKi*T{t zdTTZdxu&_ubbP>+byewe(?ug^PxWkhHY4Q|MLw+Ku~kzHUGL@B7IF@6vAF etGf0telF{r5}E-1NS0Fo delta 680 zcmV;Z0$2T;2eJh|iBL{Q4GJ0x0000DNk~Le0000p0000j2nGNE0d#s}R{#J20drDE zLIAGL9O(c600d`2O+f$vv5yPgrNkll3{1l?7FK-)z7UfK`RT@@EX%4W3XNakcDvPu$K&y* zATAV05u^xGgzuBfz|lrVh^(~V?_U?+Zns7mBwJ!ytFD3Xjp$-{ zrDx4iSsEHl?}o0|YrUK?ZP;1V3{Ye@6wVGBiND)Kf zG?4S-A-x+K%7-=-iz6XLZ=~pr6o0*uqBm0XMvC4@(HkjxBgGbk&&1lS%Iq_b$3tG1 zK#C1m^5bBhm01S(8YwogIFSer2jP!rHYCLcr_-rE+P-3&n9MpfQhY)0EsJFT=V*gR2=jZppNPK{`)jO}R>_DesZdCvi0c3>WTr_yl6? ziD8uMJdA+583QBC7dpyN!T>{%IR)<)h#`z-<}X;x%#~%B&6N)`Q&wM4c3U+=e7(E? O0000 Date: Mon, 18 Apr 2016 16:33:46 +1000 Subject: [PATCH 011/439] resize icon --- .../keep-secure/images/remediated-icon.png | Bin 1105 -> 1278 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/keep-secure/images/remediated-icon.png b/windows/keep-secure/images/remediated-icon.png index d0a6ea1e32a2e4f064cda5c64e26493e16553c44..89d0890c1465cd7689ea123b4c1b62cdd3983d61 100644 GIT binary patch delta 1266 zcmVuC>9De{;`G@QP000SaNLh0L01m_e01m_fl`9S#00007bV*G`2jBz} z1|bW|z&I}e000McMObt}b#!QNasa8W%t!zL01R|RSad{Xb7OL8aCB*JZU7SrAtL|) z019+PSad^gaCvfRXJ~W)tPjjO0000EbVXQnLvm$dbZKvHAb)geZDjy8_YVmG000Se zMObuGZ)S9NVRB^vU2y+80000BbVXQnL}_zlY+-3_WpV(wz_gD5000PdMObuKVRCM1 zZf5|%8|H@q000McMObuGZ*_8GWdQa6gX;hQ00?wNSad^gZEa<4bO83umcIZ100wkL zSaeirbZlh+sDJL#CjbBg$w@>(R7i>KmS1R7R~*NGC$~4bNpAkNNz<@e?LVD!wAI!k z21RUPd(riw51j$=p@Jg1!PvuwFoudR4hMUfIDHWWoo<4HB8puRW~~-GR@&O)pH$PN zCb@0zO>)!w@9d#To3uAc?}%j&`@P-!yXX74zwbG}bAJxP7{e-tZZ%;5Q1Tu$BQfTF zFh0VFw86N=ZQtrKS{HJtsD8#0(X)@nd;aA3MN#DNRP6h-u5%4V6_>}bfg_iO{S2rH z8g_NGeA{5M6l?xuF?#$;E*JpJ{c+>j`8SeMBp!Y=IzAdwg%P!z%WZl9#NW9+IhuF9 z$bBz{zJI&+jumo!fE<<8$Gd8`8)vRQXY4W|Cs2lTLJ?>#EwNCX1}@gxG!vPUT;uwFMm)nGaO;r zl%?j1jc0wvi#M`i008!53p`;i;QL_&wQjx8ZnG{EEEq2Xe;>LS;?j>sl1Pej_Kc$P zhJU8>E8EZ5Q@;=OMl;6}ZM$2(t|1oMspf;a&TY))K4E?>^P;>&!f19MYIC|*)PGnG zh2qjI+2E#~6|}>N#b7MRDN45B!S?2kW<9Ag9+~YGM-OcJ#G+-tCOwtM_Ij!SqT%Ph zp|>ikI{HXkb?@Nw1g)26g#-Wqm}vWs?SJb&-{RV!2Y>>+w2dT|SRieg72}cKfv$dq zU1BUENQCSkH=f%`O~fRMr0VGsB2zMNzssReT;xoyQZ!RWmz9x*`5`1_^O&YVVUd&! z@4{tdbyLiMGD24>#+^xidYF96`_em$@$V-cT}FoIH#b5}K~`MS08 z0cm3aK)a3FcniiZzR_soavq^03~MBCvwTFhS&1cIrHw5V;dp{qpo}7NmXUGZiZ`DO z{CJ1s|HWTtgwb67MR((8wjAl~`=|IMFm?A$YOB>82pk4;d!4J1*5$OixcBSAvD*9D c|GeVHKbgRsw0;E%OaK4?07*qoM6N<$f=L=u<^TWy delta 1092 zcmV-K1iSnG3DF3U9De~I{pI=1D|BR7gwRR$EUKK@|39p$4UpmKcr32t;Bu`lvDT zU`+HyZABr9q9IKLybv|&gEx%PxZ5Vw7TffJOVvmSMJNqaXn!lqT5C%$esk$`x3mSC zh6lf#z|5Y0b9T>s=ge%&>cQu3{{@Rw6A!luf0+H_bF);#1||3cWRAt0-g;0hwo}`# z%FPd5hQ48=?N@~OG0#L#VQ#w-#*7k^KB@qSvPE`p-5Ig0ptr0wLr9Ot>uDmAbLeaRSc*pK5cdv+XO&FqY6>4SmRyC8(1j1cA{JX423jAHi*^hKcHFsyfai+3x27mH^bx3t=z^vakxQ@Sc4;-og?>k$E>%E5hFKy~3kHCKAjB42u(u$TS8>sE`dq zAu|wq6!_7EokOjdZAYg=kCb#8&r2~=*X8{wIx2<8=5KMqy<=RH_jvDNai+9C@+eXY&#W zUXhRSAqAlU!MQ6!9BU1YOr=#Tz-gPs*3v3Qb>pcqD9ddiEjq8_J$+vu2jX$|i)zJ7 zC4a*wdvjVTYL{JIfmK>QC6RJZjhS%t6fpB9@3}uUj0TKK5W>`%{W!WwJbY?E-a)3$ z+vVcXRZRLy)FO;(L51PApiJ-M0X+8>l^gGdcI6_qi8chY$S3mgGRpY@sSZaTTFPea z<49w7{`(qw=X}5Qk+^xEig*bWF6vTSyMK8o?YP5ednwu!E;HQA@Td19KC2)=-V9y7 z_bVE`l#8cNEKj4Rfe0kxvj^HGJvWb^Mh0-1=cDL?18z znrY!*>8RBQE}JBZb>pqCm+Hn72bM0Mxpa}+W!2&dun(nYjTfg3F6pKAuR8H?LOtQK zhC@miPAGO+(_<6ya3l?SwU^oo&CoUWW|^;81e$nTg8w^SHv11IJfgL50(_qU0000< KMNUMnLSTYn2MJIB From 3be83d3197befdaa59fde11e859c91aac22866a2 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 19 Apr 2016 13:52:59 +1000 Subject: [PATCH 012/439] fix table, spelling check --- ...rts-queue-windows-advanced-threat-protection.md | 2 +- ...-windows-defender-advanced-threat-protection.md | 14 +++++++------- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md b/windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md index 3fc84deff1..9f5da1e2b3 100644 --- a/windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md +++ b/windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md @@ -27,7 +27,7 @@ The following table and screenshot demonstrate the main areas of the **Alerts qu Highlighted area|Area name|Description :---|:---|:--- (1)|**Alerts queue**| Select to show **New**, **In Progress**, or **Resolved alerts** -(2)|Alerts|Each alert shows:
  • The severity of an alert as a coloured bar
  • A short description of the alert, including the name of the threat actor (in cases where the attribution is possible)
  • The last occurrence of the alert on any machine
  • The number of days the alert has been in the queue
  • The general category or type of alert, or the alert's kill-chain stage
  • The affected machine (if there are multiple machines, the number of affected machines will be shown)
  • A **Manage Alert** menu icon ![The menu icon looks like three periods stacked on top of each other](images/menu-icon.png) that allows you to update the alert's status and add comments
Clicking an alert expands to display more information about the threat and brings you to the date in the timeline when the alert was detected. +(2)|Alerts|Each alert shows:
  • The severity of an alert as a colored bar
  • A short description of the alert, including the name of the threat actor (in cases where the attribution is possible)
  • The last occurrence of the alert on any machine
  • The number of days the alert has been in the queue
  • The general category or type of alert, or the alert's kill-chain stage
  • The affected machine (if there are multiple machines, the number of affected machines will be shown)
  • A **Manage Alert** menu icon ![The menu icon looks like three periods stacked on top of each other](images/menu-icon.png) that allows you to update the alert's status and add comments
Clicking an alert expands to display more information about the threat and brings you to the date in the timeline when the alert was detected. (3)|Alerts sorting and filters | You can sort alerts by:
  • **Newest** (when the threat was last seen on your network)
  • **Time in queue** (how long the threat has been in your queue)
  • **Severity**
You can also filter the displayed alerts by:
  • Severity
  • Time period
See [Windows Defender ATP alerts](use-windows-defender-advanced-threat-protection.md#windows-defender-atp-alerts) for more details. ##Sort and filter the Alerts queue diff --git a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md index 83ba41ee70..69f5fdfdb7 100644 --- a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md @@ -37,13 +37,13 @@ You can navigate through the portal using the menu options available in all sect Area | Description :---|:--- -(1) Launcher | Use the launcher to quickly go to your Windows Security Center portal and select from available services. -(2) Windows Security Center home | Opens the Windows Security Center home. -(3) Settings | Provides access to configuration settings such as time zone, alert suppression rules, and license information. -(4) Navigation pane | Use the navigation pane to move between the **Dashboard**, **Alerts queue**, **Machines view**, **Preferences setup**, and **Client onboarding**. -|**Dashboard** | Provides clickable tiles that open detailed information on various alerts that have been detected in your organization. -|**Alerts queue** | Enables you to view separate queues of new, in progress, and resolved alerts. -|**Machines view**| Displays the list of machines that are onboarded to Windows Defender ATP, some information about them, and the corresponding number of alerts. +(1) Launcher | Use the launcher to quickly go to your Windows Security Center portal and select from available services.|| +(2) Windows Security Center home | Opens the Windows Security Center home.|| +(3) Settings | Provides access to configuration settings such as time zone, alert suppression rules, and license information.|| +(4) Navigation pane | Use the navigation pane to move between the **Dashboard**, **Alerts queue**, **Machines view**, **Preferences setup**, and **Client onboarding**.|| +|**Dashboard** | Provides clickable tiles that open detailed information on various alerts that have been detected in your organization. | +|**Alerts queue** | Enables you to view separate queues of new, in progress, and resolved alerts.| +|**Machines view**| Displays the list of machines that are onboarded to Windows Defender ATP, some information about them, and the corresponding number of alerts.| |**Preferences setup**| Shows the settings you selected during [service onboarding](service-onboarding-windows-advanced-threat-protection.md), and lets you update your industry preferences and retention policy period. |**Client onboarding**| Allows you to download the onboarding configuration package. (5) Main portal| Main area where you will see the different views such as the Dashboard, Alerts queue, and Machines view.| From 86da773592e1550f21cc13a3e724fbed15506fa7 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 19 Apr 2016 13:54:31 +1000 Subject: [PATCH 013/439] fix table --- ...view-windows-defender-advanced-threat-protection.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md index 69f5fdfdb7..ee15489273 100644 --- a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md @@ -41,11 +41,11 @@ Area | Description (2) Windows Security Center home | Opens the Windows Security Center home.|| (3) Settings | Provides access to configuration settings such as time zone, alert suppression rules, and license information.|| (4) Navigation pane | Use the navigation pane to move between the **Dashboard**, **Alerts queue**, **Machines view**, **Preferences setup**, and **Client onboarding**.|| -|**Dashboard** | Provides clickable tiles that open detailed information on various alerts that have been detected in your organization. | -|**Alerts queue** | Enables you to view separate queues of new, in progress, and resolved alerts.| -|**Machines view**| Displays the list of machines that are onboarded to Windows Defender ATP, some information about them, and the corresponding number of alerts.| -|**Preferences setup**| Shows the settings you selected during [service onboarding](service-onboarding-windows-advanced-threat-protection.md), and lets you update your industry preferences and retention policy period. -|**Client onboarding**| Allows you to download the onboarding configuration package. +**Dashboard** | Provides clickable tiles that open detailed information on various alerts that have been detected in your organization. | +**Alerts queue** | Enables you to view separate queues of new, in progress, and resolved alerts.| +**Machines view**| Displays the list of machines that are onboarded to Windows Defender ATP, some information about them, and the corresponding number of alerts.| +**Preferences setup**| Shows the settings you selected during [service onboarding](service-onboarding-windows-advanced-threat-protection.md), and lets you update your industry preferences and retention policy period. +**Client onboarding**| Allows you to download the onboarding configuration package. (5) Main portal| Main area where you will see the different views such as the Dashboard, Alerts queue, and Machines view.| (6) Search | Search for machines, files, external IP Addresses, or domains across endpoints. The drop-down combo box allows you to select the entity type.| From cf09c4032fbc2ca986597e4358581eec9fb79354 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 19 Apr 2016 14:01:28 +1000 Subject: [PATCH 014/439] fix table --- ...ows-defender-advanced-threat-protection.md | 28 +++++++++---------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md index ee15489273..13f362002e 100644 --- a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md @@ -37,28 +37,28 @@ You can navigate through the portal using the menu options available in all sect Area | Description :---|:--- -(1) Launcher | Use the launcher to quickly go to your Windows Security Center portal and select from available services.|| -(2) Windows Security Center home | Opens the Windows Security Center home.|| -(3) Settings | Provides access to configuration settings such as time zone, alert suppression rules, and license information.|| -(4) Navigation pane | Use the navigation pane to move between the **Dashboard**, **Alerts queue**, **Machines view**, **Preferences setup**, and **Client onboarding**.|| -**Dashboard** | Provides clickable tiles that open detailed information on various alerts that have been detected in your organization. | -**Alerts queue** | Enables you to view separate queues of new, in progress, and resolved alerts.| -**Machines view**| Displays the list of machines that are onboarded to Windows Defender ATP, some information about them, and the corresponding number of alerts.| +(1) Launcher | Use the launcher to quickly go to your Windows Security Center portal and select from available services. +(2) Windows Security Center home | Opens the Windows Security Center home. +(3) Settings | Provides access to configuration settings such as time zone, alert suppression rules, and license information. +(4) Navigation pane | Use the navigation pane to move between the **Dashboard**, **Alerts queue**, **Machines view**, **Preferences setup**, and **Client onboarding**. +**Dashboard** | Provides clickable tiles that open detailed information on various alerts that have been detected in your organization. +**Alerts queue** | Enables you to view separate queues of new, in progress, and resolved alerts. +**Machines view**| Displays the list of machines that are onboarded to Windows Defender ATP, some information about them, and the corresponding number of alerts. **Preferences setup**| Shows the settings you selected during [service onboarding](service-onboarding-windows-advanced-threat-protection.md), and lets you update your industry preferences and retention policy period. **Client onboarding**| Allows you to download the onboarding configuration package. -(5) Main portal| Main area where you will see the different views such as the Dashboard, Alerts queue, and Machines view.| -(6) Search | Search for machines, files, external IP Addresses, or domains across endpoints. The drop-down combo box allows you to select the entity type.| +(5) Main portal| Main area where you will see the different views such as the Dashboard, Alerts queue, and Machines view. +(6) Search | Search for machines, files, external IP Addresses, or domains across endpoints. The drop-down combo box allows you to select the entity type. ## Windows Defender ATP icons The following table provides information on the icons used all throughout the portal: Icon | Description :---|:--- -|![Alert icon](images/alert-icon.png)| Alert – Indication of an activity correlated with advanced attacks. -| ![Detection icon](images/detection-icon.png)| Detection – Indication of a malware threat detection. -| ![Active threat icon](images/active-threat-icon.png)| Active threat – Threats actively executing at the time of detection. -| ![Remediated icon](images/remediated-icon.png)| Remediated – Threat removed from the machine -|![Not remediated icon](images/not-remediated-icon.png)| Not remediated – Threat not removed from the machine. +![Alert icon](images/alert-icon.png)| Alert – Indication of an activity correlated with advanced attacks. +![Detection icon](images/detection-icon.png)| Detection – Indication of a malware threat detection. +![Active threat icon](images/active-threat-icon.png)| Active threat – Threats actively executing at the time of detection. +![Remediated icon](images/remediated-icon.png)| Remediated – Threat removed from the machine +![Not remediated icon](images/not-remediated-icon.png)| Not remediated – Threat not removed from the machine. ### Related topic [Use the Windows Defender Advanced Threat Protection portal](use-windows-defender-advanced-threat-protection.md) \ No newline at end of file From 6c05a1779d4012be78b7dc289babae967805741a Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 19 Apr 2016 14:04:16 +1000 Subject: [PATCH 015/439] remove shadow from image remove shadow from image --- .../images/not-remediated-icon.png | Bin 2270 -> 2467 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/keep-secure/images/not-remediated-icon.png b/windows/keep-secure/images/not-remediated-icon.png index 13f5ae9de9430becc0e1941fa18b9f7ed00219bf..7d99acf323a5c3c80cdffcfbbe390658ee563dd8 100644 GIT binary patch delta 2228 zcmV;l2ut_g5u+2383+ad008^$M&6MjAP5r#134a@oP?1{)_(|YNklkom~(=d4dRLkOM(L2sk=G1~?Q427)0tOaN1YHSrFl*=FXs?Z^Xv zAV2sX&UwUIXjx)QS5sVf6ZNaE!iK7-b#UU5E+z#W01=`Y2w(_?;lwa=u}>_5PVXy* zGe8__kePxrm^{SvZ+^z~lTR_!YSSZvIv<}aG}SSYRez{{<{E}?{0g#UF<2J|VCe$_ zCWu8aLV=SInUwfg5M0`XL&#KdV)1`TbF~_b|M`B}k37t9OK}}gHM|*4g-{5EIfiwb z@c2Va-Fq*bXhVuY;z=!-5$a;6WyPIb?#h-8EntEry9mayYd&YGBF?Ah(eg_kn8 z>C!GJhsR+lc)>x2G4sZ&yz}!r={qzAJqv+=xi$#6kb^k_9w!Fvqa1kb5mtO_8v_@t z<><4|GjM#8Jny4fHVJ1hW#GEc^8Sy1L|bdDxPRpq!jS_spEc^v$WM&XcySklpV}Bf zrJ&8LBq}GPJ$0O!Bh#$jdLw@02GH{4n?XSYTn^4t?0~TJ9)!J;U7dO_t0xK!lmUJ&5ZYBAcCM77xpoGyLhxPo@N)2`yhj(TOs)_ydYK z13GZ%O^*HY7vzV=X!b9l^iXNeFn?PaVeyy0&(NmzsFsL9@ELy5IV}Ft%}m~TJMQRF zdZxzcF^BVjD1+?=dSaS}uQEBhl*QLyPriH^m?WVKcmyo#W>U-yCk4LSAsKFJj(qic zYFoD;l*kj0Q0(4IZk@=E6DSo4C1yFj8?QvZUeLH>8-8pY6+ud)Kv7?zsDIWd&t1dF z4L4H%Idtn#4 zcNeqS6hV}pmFw`s!zm|c)YoiaqJJTs+6cP(LMD$LrelHn$Pxz5U&n%rHj*tKMa?jc zA&N{{R|x5g7d#o0Z@tOByMKO4z1gC4U}a#qr-wx;w@p_DIGk6|C;meIc)?U&<@|4c zkKxfJ1XavAEM!=xg!9%i^tEp=B(1oht3sAz4$7q8%zIQdWps0hc2noc=8KYE5zgDP z71pmO1W)zs4-u@ya135{CAD+UL%a~)*vpJ37PU7J=k_X5!JPtwTW}!73dCnc=f`~`UHm+=e zR-n;9ihw2K;kpJyN`Fih(XK|onIO_tupr_PPDUz~8AakYx^@c05K*d)30e=_L;Ja> zX;_8qk}Ejt+D(Aa*!c|29own50y;KM@7x?RFVIv`ogvN;!YO8u^xLPkPnS*%pMq#Q zeF7Q+&M8vw!!19D$?Cv&=97^MVFP->OfrcH26{TF6^_IsBa;Qekd>a4scf z-zbAO|A5{rHn3Paka@Hyag{u-V;&{LBu@(qA?ez6BXh4 zI4Q8cI_d-AAAf)1@Ov*sp}+eMMKh=HJxIL*RImVMC8h=9JXnaPFj`hLnMue0f;kP8 zhCmQN@+c`0G7&W85O7c*A-m=}{0E0|+D64=!ylp6yO_$^3+E%?eRtY;`4DFW>0nl* zCEa`}1JLC6{h6SO%+o2FFmVLwcX%m591bNDiyG+}Vt@38n^Hcp`JH1xrvo$7cqb>H zYchco z*Uxt^YIqkn0c53NW0P>KLv`7?kVV(wyIN9B%%0xj6>DaSi6{Tg2mjoGl^`xhERIwp z7Sc#|>VHq>^R#9Wi*u0y4P*#nIinYBWa#S6*rJ69*(p-e#I`$4U(&sdiWcbX6tux* z9uvhhnK==pbl6ExbLJ$cP)DpC&Jue$uHKJk4h8(NkRn4tLRt({ZK0);bl|qVQ~!JKKb*7I=fk-z_~LpwIcuN2*IMWM_WBkN z9Xh;ZbP3>e1AiS%0-=yd2^o+GA{p911k7O&2oWX%@}x#Eu+f@%aXTM*C_DU~S)iI; z6k5D0zvS`MUj~qC1!O{yHFaQt$2?PWRGDfkco5IhfDx z-ZlQ}Yh;&9WZU5I3<{8$Jh9cg`r|#9T&}3}#>@4`9~(+F@93>;x_bKXJJsE9k})k? zRlRsk+JEunc@tA(FKp+fSN3nbGKvORfC&(g3=x{y_vWFW-`jI+44n&rBx`}NltGpd zj6&<={->T;_N{Gwm#jJY!b^RpC$p@lQ8d!|i~DZ6@#v3#)bfsHcifRq>~FlFnkhRo zR)2M8|ED&@wt@g+9vlOK*qS;$b7FecmaSpKdVhE^zn&ZbE#^8i2K% zRXJiSV{z({-}ehcciu&y_3qoJAGp7NW;Pisp7`EjOijh)IgyHk2b#x@&_W<+MR@IB z{jH*%sM%SW$Ot!}2}Hq3dT!l?>#beQFdN@L7DEVfqcB|`e{0|97dN9Ly#0q?_Z~gm zTYu}55E0O9AWz(P^qmXqrw`w|&G#R&jv6g?xX47tl+cp5vlM9NP-wxcRE5k#QDmX& zWS;Wgd}bh}P$0Ga^c9;HeD%)yTRWy(TD)%U)bD=M`SL5>3X`6-uKe7{x4#=JRDJt% z;XhML?z#snmpT-j9w-FmDOy5j1c*c!pnqVHikUn)t&@zT8c+Rk{Lu#&5MtIpv@q>_ zrvCf;i?;GFe5r5a=i7Vt`^kx!tRt*kfxgaYU@=p#4lK+ryIc$V93T*YRIcanv2xQ9w!?I~+9$70?#2+QOeE-l1CRt3`S{Vfz3;?S*ok9SZ=}&>16N%Opmp%y9k1;4Jv(RP zRHApTSQ`ch0l;Hz_4+R&oDi`RBtwjmCWxFi>-NPm$kaS#9m z2E@q&@9w?tr?p12FsMj_ot+B-0n?Sf<5|U@`Ahb6K9yB3{^s`vM;0Y_nJGoJ3oKtV z@U?FYun7uQMa*O(-?ds^@)gXa%00<6< z4uB9SD$oIz)t`+AW`9J45m6!(=*fCkeqznGwN#S__8kAt4=b1}zs^_`JtO_M{h<4r z^}}o<2G0wtWCWn#h++l;U;@aqBKILKMrT2!PymIM{(`2^6)RoFTs<`pDgFIV$KQKR zQsu~@ypiRhleG#^QG!&+b6S9s!OKy=;VSF;AJzjv41%YW2!AjW05XzpC`vV~4aMtk z3hy5`Z#jboFX-qVuAIN1JSqeL5l8}QN^DDcNtd!U0&q%T_#hrEkD;A6FmZyt7Fd90 z@JK;I=fKD{ju&ima#Vq)Cdtz-#6xlmG1<$#Czh_RL0eJfT>Jp26d z`|hq@xY*^U2!A*nA{0vw@*L*nfFqU7$RGiTg)}yaQ|;>LMTkg1D3Nmy=SrLBOS95_ z&5gq;d;gz1G&WAlC;@WNS*Gcf0Jwd4qa?r#lsrX{m270|?R}r!Co{DH0Q1+{mLO7Rd zw9t0ATNZl;*@FZKDb6b{OXUB*c{#Su-?|h-C=;RJL@__L&f9+hZFDAGO~-ue00000 LNkvXXu0mjf Date: Tue, 19 Apr 2016 14:13:24 +1000 Subject: [PATCH 016/439] Update portal table --- ...view-windows-defender-advanced-threat-protection.md | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md index 13f362002e..a88759d18b 100644 --- a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md @@ -37,17 +37,15 @@ You can navigate through the portal using the menu options available in all sect Area | Description :---|:--- -(1) Launcher | Use the launcher to quickly go to your Windows Security Center portal and select from available services. -(2) Windows Security Center home | Opens the Windows Security Center home. -(3) Settings | Provides access to configuration settings such as time zone, alert suppression rules, and license information. -(4) Navigation pane | Use the navigation pane to move between the **Dashboard**, **Alerts queue**, **Machines view**, **Preferences setup**, and **Client onboarding**. +(1) Settings | Provides access to configuration settings such as time zone, alert suppression rules, and license information. +(2) Navigation pane | Use the navigation pane to move between the **Dashboard**, **Alerts queue**, **Machines view**, **Preferences setup**, and **Client onboarding**. **Dashboard** | Provides clickable tiles that open detailed information on various alerts that have been detected in your organization. **Alerts queue** | Enables you to view separate queues of new, in progress, and resolved alerts. **Machines view**| Displays the list of machines that are onboarded to Windows Defender ATP, some information about them, and the corresponding number of alerts. **Preferences setup**| Shows the settings you selected during [service onboarding](service-onboarding-windows-advanced-threat-protection.md), and lets you update your industry preferences and retention policy period. **Client onboarding**| Allows you to download the onboarding configuration package. -(5) Main portal| Main area where you will see the different views such as the Dashboard, Alerts queue, and Machines view. -(6) Search | Search for machines, files, external IP Addresses, or domains across endpoints. The drop-down combo box allows you to select the entity type. +(3) Main portal| Main area where you will see the different views such as the Dashboard, Alerts queue, and Machines view. +(4) Search | Search for machines, files, external IP Addresses, or domains across endpoints. The drop-down combo box allows you to select the entity type. ## Windows Defender ATP icons The following table provides information on the icons used all throughout the portal: From 4e5fad30d95e7e13706dceb8c8190e6c7ebaca65 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 19 Apr 2016 14:22:27 +1000 Subject: [PATCH 017/439] change icon --- .../settings-windows-defender-advanced-threat-protection.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md b/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md index 25b7014683..bca4c8882a 100644 --- a/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md @@ -15,7 +15,7 @@ author: DulceMV [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -Use the **Settings** menu ![Settings icon](images/settings-icon.png) to configure the time zone, suppression rules, and view license information. +Use the **Settings** menu ![Settings icon](images/settings.png) to configure the time zone, suppression rules, and view license information. ## Time zone settings The aspect of time is important in the assessment and analysis of perceived and actual cyberattacks. @@ -24,7 +24,7 @@ Cyberforensic investigations often rely on time stamps to piece together the seq Windows Defender ATP can display either Coordinated Universal Time (UTC) or local time. -Your current time zone setting is shown in the Windows Defender ATP menu. You can change the displayed time zone in the **Settings** menu ![Settings icon](images/settings-icon.png). +Your current time zone setting is shown in the Windows Defender ATP menu. You can change the displayed time zone in the **Settings** menu ![Settings icon](images/settings.png). ### UTC time zone Windows Defender ATP uses UTC time by default. @@ -43,7 +43,7 @@ The Windows Defender ATP time zone is set by default to UTC. Setting the time zone also changes the times for all Windows Defender ATP views. To set the time zone: -1. Click the **Settings** menu ![Settings icon](images/settings-icon.png). +1. Click the **Settings** menu ![Settings icon](images/settings.png). 2. Select the **Timezone:UTC** indicator. 3. The time zone indicator changes to **Timezone:Local**. Click it again to change back to **Timezone:UTC**. From 368a5b14d678155223148f353a1fcb57a965b3a1 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 19 Apr 2016 14:39:36 +1000 Subject: [PATCH 018/439] fix numbering --- .../deep-analysis-windows-advanced-threat-protection.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/windows/keep-secure/deep-analysis-windows-advanced-threat-protection.md b/windows/keep-secure/deep-analysis-windows-advanced-threat-protection.md index 96fb483c38..c6b0f83269 100644 --- a/windows/keep-secure/deep-analysis-windows-advanced-threat-protection.md +++ b/windows/keep-secure/deep-analysis-windows-advanced-threat-protection.md @@ -80,15 +80,16 @@ If you encounter a problem when trying to submit a file, try each of the followi 1. Ensure the file is a PE. PE files typically have _.exe_ or _.dll_ extensions (executable programs or applications). 2. Ensure the service has access to the file, that it still exists, and has not been corrupted or modified. 3. You can wait a short while and try to submit the file again, in case the queue is full or there was a temporary connection or communication error. -4. Verify the policy setting enables sample collection and try to submit the file again: - 1. Change the following registry entry and values to change the policy on specific endpoints: +4. Verify the policy setting enables sample collection and try to submit the file again. + + a. Change the following registry entry and values to change the policy on specific endpoints: ``` HKLM\SOFTWARE\Policies\Microsoft\Sense\AllowSampleCollection Value = 0 - block sample collection Value = 1 - allow sample collection ``` -6. Change the organizational unit through the GPO. See [Configure with Group Policy](additional-configuration-windows-advanced-threat-protection.md#configure-with-group-policy). -7. If these steps do not resolve the issue, contact [winatp@microsoft.com](mailto:winatp@microsoft.com). +5. Change the organizational unit through the GPO. See [Configure with Group Policy](additional-configuration-windows-advanced-threat-protection.md#configure-with-group-policy). +6. If these steps do not resolve the issue, contact [winatp@microsoft.com](mailto:winatp@microsoft.com). > **Note**  If the value *AllowSampleCollection* is not available, the client will allow sample collection by default. From f2ecee0c2eed9bde4f36f1386943f1c7e692ecb8 Mon Sep 17 00:00:00 2001 From: Dolcita Date: Tue, 19 Apr 2016 14:51:35 +1000 Subject: [PATCH 019/439] Update service-onboarding-windows-advanced-threat-protection.md --- .../service-onboarding-windows-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md b/windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md index 62ed1d9566..80f8bb1755 100644 --- a/windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md +++ b/windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md @@ -41,7 +41,7 @@ You have to assign users to the Windows ATP Service application in Azure Active d. Sign in with the correct user name and password for an account that has permissions to assign users in AAD. -3. On the ** Microsoft Azure Dashboard**, click ** Browse** in the navigation pane and then click **Active Directory** to open the [Azure Management Portal](https://manage.windowsazure.com/). +3. On the **Microsoft Azure Dashboard**, click **Browse** in the navigation pane and then click **Active Directory** to open the [Azure Management Portal](https://manage.windowsazure.com/). ![Azure Active Directory menu](images/azure-browse.png) From 9d6c4a2c8011bcd86167d867943c92496f8457cc Mon Sep 17 00:00:00 2001 From: Dolcita Date: Tue, 19 Apr 2016 14:52:57 +1000 Subject: [PATCH 020/439] Update service-onboarding-windows-advanced-threat-protection.md --- .../service-onboarding-windows-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md b/windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md index 80f8bb1755..1bd656a63f 100644 --- a/windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md +++ b/windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md @@ -84,7 +84,7 @@ You have to assign users to the Windows ATP Service application in Azure Active 10. Click **Assign**. -11. Confirm that you want to enable access for the user from the notification bar. If you click **Yes**, the user is given access to the Windows Defender ATP portal. One or more progress bars will appear that indicates the user is being assigned a role, and you will see confirmation messages. You don’t need to do anything with the messages; they will go away after a short period of time. +11. Confirm that you want to enable access for the user from the notification bar. If you click **Yes**, the user is given access to the Windows Defender ATP portal. One or more progress bars will appear that indicates the user is being assigned a role, and you will see confirmation messages. You don’t need to do anything with the messages, they will go away after a short period of time. ![Confirmation page to enable access to users](images/confirm-user-access.png) From c9e454cfff83b926d9cab7b37c34b94ff285c380 Mon Sep 17 00:00:00 2001 From: Dolcita Date: Tue, 19 Apr 2016 14:55:05 +1000 Subject: [PATCH 021/439] Update service-onboarding-windows-advanced-threat-protection.md --- .../service-onboarding-windows-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md b/windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md index 1bd656a63f..92e31985a1 100644 --- a/windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md +++ b/windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md @@ -100,7 +100,7 @@ You have to assign users to the Windows ATP Service application in Azure Active 15. You can continue assigning roles for other users in your organization now, or you can return to the Windows Defender ATP portal to complete the service onboarding wizard. - > **Note**   You need to assign roles for every user in your organization that requires access to the Windows Defender ATP portal. You can assign roles at any time by going to the Azure Management Portal, clicking **Active Directory** and then finding your directory in the list and following the steps above. + > **Note**   You need to assign roles for every user in your organization that requires access to the Windows Defender ATP portal. You can assign roles at any time by going to the Azure Management Portal, clicking **Active Directory**, and then finding your directory in the list and following the steps above. When you have finished assigning roles, return to the [Windows Defender ATP portal](https://seville.windows.com) and refresh the page. From ca6ff29e5e33556fe098e1fc24e84fcea1c6689f Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 19 Apr 2016 15:11:45 +1000 Subject: [PATCH 022/439] link updates --- ...e-privacy-windows-defender-advanced-threat-protection.md | 4 ++-- ...investigate-alerts-windows-advanced-threat-protection.md | 2 +- ...-overview-windows-defender-advanced-threat-protection.md | 3 ++- ...leshoot-onboarding-windows-advanced-threat-protection.md | 6 +++--- 4 files changed, 8 insertions(+), 7 deletions(-) diff --git a/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md index 3362a6187a..6e15ee83b6 100644 --- a/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md @@ -23,7 +23,7 @@ Microsoft will collect and store information from your configured endpoints in a Information collected includes code file data (such as file names, sizes, and hashes), process data (running processes, hashes), registry data, network connection data (host IPs and ports), and machine details (such as GUIDs, names, and the operating system version). -Microsoft stores this data in a Microsoft Azure security-specific data store, and maintains it in accordance with Microsoft privacy practices and [Microsoft Trust Center policies](https://azure.microsoft.com/en-us/support/trust-center/43). +Microsoft stores this data in a Microsoft Azure security-specific data store, and maintains it in accordance with Microsoft privacy practices and [Microsoft Trust Center policies](https://azure.microsoft.com/en-us/support/trust-center/). Microsoft uses this data to: - Proactively identify indicators of attack (IOAs) in your organization @@ -34,7 +34,7 @@ We do not mine your data for advertising or for any other purpose other than pro ## Do I have flexibility to select where to store my data? -Yes. Data for this new service is stored in Microsoft Azure datacenters in the United States and European Union based on the geolocation properties you specify when you onboard to the service. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations in which your data will reside. Microsoft will not transfer the data from the specified geolocation except in specific circumstances during the TAP stage (see the question [Is there a difference between how you handle data for the TAP program and for General Availability?](Is-there-a-difference-between-how-Microsoft-handles-data-for-the-TAP-program-and-foR-General-Availability?). If you have concerns about storage of data in a particular country, please contact [winatp@microsoft.com](mailto:winatp@microsoft.com). +Yes. Data for this new service is stored in Microsoft Azure datacenters in the United States and European Union based on the geolocation properties you specify when you onboard to the service. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations in which your data will reside. Microsoft will not transfer the data from the specified geolocation except in specific circumstances during the TAP stage (see the question [Is there a difference between how you handle data for the TAP program and for General Availability?](#Is-there-a-difference-between-how-Microsoft-handles-data-for-the-TAP-program-and-foR-General-Availability?). If you have concerns about storage of data in a particular country, please contact [winatp@microsoft.com](mailto:winatp@microsoft.com). ## Is my data isolated from other customer data? Yes. The new cloud service provides appropriate segregation at a number of levels, such as isolation of files, configurations, and telemetry data. Aside from data access authentication, simply keeping different data appropriately segregated provides well-recognized protection. diff --git a/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md b/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md index 5e384fe297..dfd19d659a 100644 --- a/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md @@ -44,7 +44,7 @@ The **Alerts related to this machine** section provides a list of alerts that ar The **Machine timeline** section provides a chronological view of the events and associated alerts that have been observed on the machine. -You'll see an aggregated view of alerts, a short description of the alert, details on the action taken, and which user ran the action. This helps you see significant activities or behaviors that occurred on a machine within your network in relation to a specific time frame. Several icons are used to identify various detections and their current state. For more information, see [Windows Defender ATP icons](icons-windows-atp.md). +You'll see an aggregated view of alerts, a short description of the alert, details on the action taken, and which user ran the action. This helps you see significant activities or behaviors that occurred on a machine within your network in relation to a specific time frame. Several icons are used to identify various detections and their current state. For more information, see [Windows Defender ATP icons](portal-overview-windows-defender-advanced-threat-protection.md#windows-defender-atp-icons). This feature also enables you to selectively drill down into a behavior or event that occurred within a given time period. You can view the temporal sequence of events that occurred on a machine over a specified time period. diff --git a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md index a88759d18b..c64ddcd962 100644 --- a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md @@ -33,7 +33,7 @@ When you open the portal, you’ll see the main areas of the application: ![Windows Defender Advanced Threat Protection portal](images/portal.png) -You can navigate through the portal using the menu options available in all sections. Refer to Table 3 for a description of each section. +You can navigate through the portal using the menu options available in all sections. Refer to the following table for a description of each section. Area | Description :---|:--- @@ -58,5 +58,6 @@ Icon | Description ![Remediated icon](images/remediated-icon.png)| Remediated – Threat removed from the machine ![Not remediated icon](images/not-remediated-icon.png)| Not remediated – Threat not removed from the machine. + ### Related topic [Use the Windows Defender Advanced Threat Protection portal](use-windows-defender-advanced-threat-protection.md) \ No newline at end of file diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-advanced-threat-protection.md index 4f552589c8..7b18fe46bb 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-advanced-threat-protection.md @@ -89,9 +89,9 @@ For example, if endpoints are not appearing in the **Machines view** list,you mi Message | Action :---|:--- -Windows Advanced Threat Protection Service failed to connect to server at `````` | Check the connection to the URL. See [Configure proxy and Internet connectivity](Configure-proxy-and-Internet-connectivity). | - Windows Advanced Threat Protection Service failed to read onboarding parameters. Failure code: `````` | Check that GP settings are correct and there are not settings impacting permissions in the policy. | -Windows Advanced Threat Protection Service failed to persist onboarding information. Failure code: `````` | Check that GP settings are correct and there are not settings impacting permissions in the policy.| +Windows Advanced Threat Protection Service failed to connect to server at `````` | Check the connection to the URL. See [Configure proxy and Internet connectivity](#configure-proxy-and-Internet-connectivity). + Windows Advanced Threat Protection Service failed to read onboarding parameters. Failure code: `````` | Check that GP settings are correct and there are not settings impacting permissions in the policy. +Windows Advanced Threat Protection Service failed to persist onboarding information. Failure code: `````` | Check that GP settings are correct and there are not settings impacting permissions in the policy. ## Related topics From 55c26feef53d4ba04eb25eddc5f477878100b9fe Mon Sep 17 00:00:00 2001 From: Dolcita Date: Tue, 19 Apr 2016 15:37:43 +1000 Subject: [PATCH 023/439] Update configure-endpoints-windows-advanced-threat-protection.md --- ...ints-windows-advanced-threat-protection.md | 26 +++++++++---------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md index 521af51f10..197e07483d 100644 --- a/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md @@ -22,7 +22,7 @@ Using the GP configuration package ensures your endpoints will be correctly conf > **Note**   To use GP updates to deploy the package, you must be on Windows Server 2008 R2 or later. The endpoints must be running Windows 10 TAP. -1. Open the GP configuration package .zip file (*WindowsATPOnboardingPackage.zip*) that you downloaded during the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://seville.windows.com): +1. Open the GP configuration package .zip file (*WindowsATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://seville.windows.com): a. Click **Client onboarding** on the **Navigation pane**. @@ -32,9 +32,9 @@ Using the GP configuration package ensures your endpoints will be correctly conf 3. Open the [Group Policy Management Console](https://technet.microsoft.com/en-us/library/cc731212.aspx) (GPMC), right-click the Group Policy Object (GPO) you want to configure and click **Edit**. -4. In the **Group Policy Management Editor***, go to **Computer configuration**, then **Preferences**, and then **Control panel settings**. +4. In the **Group Policy Management Editor**, go to **Computer configuration**, then **Preferences**, and then **Control panel settings**. -5. Right-click **Scheduled tasks**, point to **New** and then click **Immediate task**. +5. Right-click **Scheduled tasks**, point to **New**, and then click **Immediate task**. 6. In the **Task** window that opens, go to the **General** tab. Choose the local SYSTEM user account under **Security options**. @@ -48,37 +48,37 @@ For additional settings, see the [Additional configuration settings section](add ## Configure with System Center Configuration Manager (SCCM) -1. Open the SCCM configuration package .zip file (*WindowsATPOnboardingPackage.zip*) that you downloaded during the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://seville.windows.com): Naama: Confirm package name +1. Open the SCCM configuration package .zip file (*WindowsATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://seville.windows.com): Naama: Confirm package name a. Click **Client onboarding** on the **Navigation pane**. - b. Select **SCCM**, click **Download package** and save the .zip file. Iaan: Need to confirm the UI for this + b. Select **SCCM**, click **Download package**, and save the .zip file. Iaan: Need to confirm the UI for this -2. Copy the .zip file to a shared, read-only location that can be accessed by the network administrators who will be deploying the package. +2. Copy the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. Iaan: Will confirm ui for this 3. In the SCCM console, go to **Software Library**. -4. Under **Application Management**, right click **Packages** and select **Import**. -5. Click Browse and choose the package that was downloaded from the portal (zip file). +4. Under **Application Management**, right-click **Packages** and select **Import**. +5. Click **Browse** and choose the package that was downloaded from the portal (zip file). 6. The package will appear under the Packages page. -7. Right click the Package and choose deploy. +7. Right-click the Package and choose deploy. 8. Choose a predefined device collection to deploy the package to. Naama note: If it’s a package we create then we’ll set the necessary privileges, otherwise provide guidance (Omri: what is the necessary privileges?) ## Configure endpoints manually with registry changes -You can also manually onboard individual endpoints to Windows Defender ATP. You might want to do this when first testing the service before you commit to onboarding all endpoints in your network. +You can also manually onboard individual endpoints to Windows Defender ATP. You might want to do this when testing the service before you commit to onboarding all endpoints in your network. 1. Extract the contents of the configuration package to a location on the endpoint you want to onboard (for example, the Desktop). -2. Open an elevated command line prompt on the endpoint and run the +2. Open an elevated command-line prompt on the endpoint and run the script: a. Click **Start** and type **cmd**. - b. Right-click Command prompt and select **Run as administrator**. + b. Right-click **Command prompt** and select **Run as administrator**. ![Window Start menu pointing to Run as administrator](images/run-as-admin.png) @@ -88,7 +88,7 @@ You can also manually onboard individual endpoints to Windows Defender ATP. You 4. Press the **Enter ** key or click **OK**. -See the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) topic for details on how you can manually validate that the endpoint is compliant and correctly reporting telemetry. +See the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) topic for details on how you can manually validate that the endpoint is compliant and correctly reports telemetry. ## Related topics - [Windows Defender ATP service onboarding](service-onboarding-windows-advanced-threat-protection.md) From 28c80731486674578e30cd8046d6f1eea8252a13 Mon Sep 17 00:00:00 2001 From: Dolcita Date: Tue, 19 Apr 2016 15:40:21 +1000 Subject: [PATCH 024/439] Update configure-endpoints-windows-advanced-threat-protection.md --- .../configure-endpoints-windows-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md index 197e07483d..b246b53e3e 100644 --- a/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md @@ -68,7 +68,7 @@ For additional settings, see the [Additional configuration settings section](add Naama note: If it’s a package we create then we’ll set the necessary privileges, otherwise provide guidance (Omri: what is the necessary privileges?) ## Configure endpoints manually with registry changes -You can also manually onboard individual endpoints to Windows Defender ATP. You might want to do this when testing the service before you commit to onboarding all endpoints in your network. +You can also manually onboard individual endpoints to Windows Defender ATP. You might want to do this first when testing the service before you commit to onboarding all endpoints in your network. 1. Extract the contents of the configuration package to a location on the endpoint you want to onboard (for example, the Desktop). From e1d689795dc4353ae02c89f1b4444387f8bba550 Mon Sep 17 00:00:00 2001 From: Dolcita Date: Tue, 19 Apr 2016 15:42:05 +1000 Subject: [PATCH 025/439] Update configure-endpoints-windows-advanced-threat-protection.md --- .../configure-endpoints-windows-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md index b246b53e3e..73eb80f7ab 100644 --- a/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md @@ -86,7 +86,7 @@ You can also manually onboard individual endpoints to Windows Defender ATP. You desktop, type: ```*%userprofile%\Desktop\WindowsATPOnboardingScript.sc*``` -4. Press the **Enter ** key or click **OK**. +4. Press the **Enter** key or click **OK**. See the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) topic for details on how you can manually validate that the endpoint is compliant and correctly reports telemetry. From 9159bc0587726e02eba39ee1f8186bb7704f74a5 Mon Sep 17 00:00:00 2001 From: Dolcita Date: Tue, 19 Apr 2016 15:42:36 +1000 Subject: [PATCH 026/439] Update configure-endpoints-windows-advanced-threat-protection.md --- .../configure-endpoints-windows-advanced-threat-protection.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md index 73eb80f7ab..6cc137aa42 100644 --- a/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md @@ -83,8 +83,7 @@ You can also manually onboard individual endpoints to Windows Defender ATP. You ![Window Start menu pointing to Run as administrator](images/run-as-admin.png) 3. Type the location of the script file. If you copied the file the - desktop, type: -```*%userprofile%\Desktop\WindowsATPOnboardingScript.sc*``` + desktop, type:```*%userprofile%\Desktop\WindowsATPOnboardingScript.sc*``` 4. Press the **Enter** key or click **OK**. From 4833d49ec07d38d64ca5ff9b087fb4e6ede4a459 Mon Sep 17 00:00:00 2001 From: Dolcita Date: Tue, 19 Apr 2016 15:55:42 +1000 Subject: [PATCH 027/439] Checked formatting --- ...ding-windows-advanced-threat-protection.md | 24 +++++++++---------- 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md b/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md index 24d44a50d0..0a95b9131a 100644 --- a/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md +++ b/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md @@ -42,15 +42,15 @@ Monitoring with SCCM consists of two parts: **To confirm the configuration package has been correctly deployed:** -1. In the SCCM console, click on **Monitoring** at the bottom of the navigation pane. +1. In the SCCM console, click **Monitoring** at the bottom of the navigation pane. -2. Click on **Overview** and then **Deployments**. +2. Click **Overview** and then **Deployments**. 3. Click on the deployment with the package name. What is the name of the deployment, will it always be the same for every user/installation? 4. Review the status indicators under **Completion Statistics** and **Content Status**. -If there are failed deployments (endpoints with **Error**, **Requirements Not Met**, or **Failed statuses**), you may need to perform troubleshooting steps on the endpoints. See the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) topic for more information. +If there are failed deployments (endpoints with **Error**, **Requirements Not Met**, or **Failed statuses**), you may need to troubleshoot the endpoints. See the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) topic for more information. Naama: Is this a correct process for idendtifying/resolving issues? @@ -64,27 +64,27 @@ If there are failed deployments (endpoints with **Error**, **Requirements Not Me 2. Select **SCCM**, click **Download package** and save the .zip file. Iaan: Need to confirm the UI for this 3. Extract the *compliance.cab* file from the package. -2. In the SCCM console, click on **Assets and Compliance** at the bottom of the navigation pane. +2. In the SCCM console, click **Assets and Compliance** at the bottom of the navigation pane. -3. Click on **Overview** and then **Compliance Settings**. +3. Click **Overview** and then **Compliance Settings**. -4. In the main area of the SCCM console, click on **Configuration Baselines** and import the provided cab. Iaan: Need to confirm that 'import' is available/ UI is correct +4. In the main area of the SCCM console, click **Configuration Baselines** and import the provided cab. Iaan: Need to confirm that 'import' is available/ UI is correct -5. Right click the imported baseline and deploy to a predefined device collection. Naama: Is this 'export' as in the screenshot, or is that showing something else? +5. Right-click the imported baseline and deploy to a predefined device collection. Naama: Is this 'export' as in the screenshot, or is that showing something else? ![image](images/export-sccm.png) Iaan: Need to confirm this is what it looks like -6. In the SCCM console, click on **Monitoring** at the bottom of the navigation pane. +6. In the SCCM console, click **Monitoring** at the bottom of the navigation pane. -7. Click on **Overview** and then **Deployments**. +7. Click **Overview** and then **Deployments**. -8. Click on the deployment with the package name Naama: What is the name of the deployment, will it always be the same for every user/installation? +8. Click the deployment with the package name Naama: What is the name of the deployment, will it always be the same for every user/installation? Naama: How does one know if there is an issue? -If there are non-compliant endpoints (endpoints with ?????), you may need to perform troubleshooting steps on the endpoints. See the [Troubleshoot Windows Defender ATP onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) topic for more information. +If there are non-compliant endpoints (endpoints with ?????), you may need to troubleshoot the endpoints. See the [Troubleshoot Windows Defender ATP onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) topic for more information. Naama: Is this a correct process for resolving issues? @@ -92,4 +92,4 @@ If there are non-compliant endpoints (endpoints with ?????), you may need to per - [Windows Defender ATP service onboarding](service-onboarding-windows-advanced-threat-protection.md) - [Configure Windows Defender ATP endpoints (client onboarding)](configure-endpoints-windows-advanced-threat-protection.md) - [Additional Windows Defender ATP configuration settings](additional-configuration-windows-advanced-threat-protection.md) -- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) \ No newline at end of file +- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) From 381d9ded95b2e8ecb209ec724b94a4fe65907be8 Mon Sep 17 00:00:00 2001 From: Dolcita Date: Tue, 19 Apr 2016 16:05:56 +1000 Subject: [PATCH 028/439] Fixed spacing/formatting issues --- ...-onboarding-windows-advanced-threat-protection.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-advanced-threat-protection.md index 7b18fe46bb..7256569ddb 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-advanced-threat-protection.md @@ -37,15 +37,15 @@ If you don’t see any users in the [Azure Management Portal](https://manage.win ## Manage access for all users in Azure Active Directory If you remove access for all users to the Windows ATP Service application (by clicking Manage access), you will not see the application in the list of applications in your directory in the [Azure Management Portal](https://manage.windowsazure.com/). -Gain access to the application in the Azure Management Portal again: +Log in to the application in the Azure Management Portal again: 1. Sign in to the [Windows Defender ATP portal](https://seville.windows.com/) with the user account you want to give access to. -2. Confirm you have signed in with the correct details, and click **Accept**. +2. Confirm that you have signed in with the correct details, and click **Accept**. 3. Go to the [Azure Management Portal](https://manage.windowsazure.com/) and navigate to your directory. You will see the **Windows ATP Service** application in the **Applications** section again. -## Ensure the telemetry and diagnostics service is enabled +## Ensure that the telemetry and diagnostics service is enabled If the endpoints aren’t reporting correctly, you might need to check that the Windows 10 TAP telemetry and diagnostics service is enabled on the endpoint. @@ -58,7 +58,7 @@ If the endpoints aren’t reporting correctly, you might need to check that the The endpoints must be able to connect to the Internet and send their data outside of your organization’s network. You might need to set additional proxy configurations to ensure endpoints can report correctly. -1. Open the [Group Policy Management Console](https://technet.microsoft.com/en-us/library/cc731212.aspx), right-click the GPO you want to configure and click **Edit**. +1. Open the [Group Policy Management Console](https://technet.microsoft.com/en-us/library/cc731212.aspx), right-click the GPO you want to configure, and click **Edit**. 2. In the **Group Policy Management Editor**, go to **Computer configuration**. @@ -74,7 +74,7 @@ The endpoints must be able to connect to the Internet and send their data outsid You can review event IDs in the [Event Viewer](https://msdn.microsoft.com/en-US/library/aa745633(v=bts.10).aspx) on individual endpoints, or check the status of machines from the [Windows Defender ATP portal](https://seville.windows.com/). -For example, if endpoints are not appearing in the **Machines view** list,you might need to look for event IDs on the endpoints. +For example, if endpoints are not appearing in the **Machines view** list, you might need to look for event IDs on the endpoints. > **Note**   It can take several days for endpoints to begin reporting to the Windows Defender ATP service. @@ -98,4 +98,4 @@ Windows Advanced Threat Protection Service failed to persist onboarding informat - [Windows Defender ATP service onboarding](service-onboarding-windows-advanced-threat-protection.md) - [Configure Windows Defender ATP endpoints (client onboarding)](configure-endpoints-windows-advanced-threat-protection.md) - [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-advanced-threat-protection.md) -- [Additional Windows Defender ATP configuration settings](additional-configuration-windows-advanced-threat-protection.md) \ No newline at end of file +- [Additional Windows Defender ATP configuration settings](additional-configuration-windows-advanced-threat-protection.md) From cf2b50cdbf156c45ce8f4336ffcc4a6a91e9f94c Mon Sep 17 00:00:00 2001 From: Dolcita Date: Tue, 19 Apr 2016 16:19:49 +1000 Subject: [PATCH 029/439] Fixed spacing issues --- ...privacy-windows-defender-advanced-threat-protection.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md index 6e15ee83b6..0e17ad6ff3 100644 --- a/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md @@ -32,7 +32,7 @@ Microsoft uses this data to: We do not mine your data for advertising or for any other purpose other than providing you the service. -## Do I have flexibility to select where to store my data? +## Do I have the flexibility to select where to store my data? Yes. Data for this new service is stored in Microsoft Azure datacenters in the United States and European Union based on the geolocation properties you specify when you onboard to the service. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations in which your data will reside. Microsoft will not transfer the data from the specified geolocation except in specific circumstances during the TAP stage (see the question [Is there a difference between how you handle data for the TAP program and for General Availability?](#Is-there-a-difference-between-how-Microsoft-handles-data-for-the-TAP-program-and-foR-General-Availability?). If you have concerns about storage of data in a particular country, please contact [winatp@microsoft.com](mailto:winatp@microsoft.com). @@ -53,14 +53,14 @@ Additionally, Microsoft conducts background verification checks of certain opera No. Customer data is isolated from other customers and is not shared. However, insights on the data resulting from Microsoft processing (for example, deep file analysis processing), and which don’t contain any customer specific data, might be shared with other customers. Each customer can only access data collected from its own organization and generic data that Microsoft provides. ## How long will Microsoft store my data? What is Microsoft’s data retention policy? -Your data privacy is one of our key commitments for the cloud. For this service, at contract termination or expiration your data will be erased from Microsoft’s systems to make it unrecoverable after 90 days from contract termination or expiration. +Your data privacy is one of our key commitments for the cloud. For this service, at contract termination or expiration, your data will be erased from Microsoft’s systems to make it unrecoverable after 90 days from contract termination or expiration. ## Can you help us maintain regulatory compliance? By providing customers with compliant, independently-verified services, Microsoft makes it easier for customers to achieve compliance for the infrastructure and applications they run, including this new Microsoft cloud service. -Microsoft provides customers with detailed information about our security and compliance programs, including audit reports and compliance packages, to help customers assess our services against their own legal and regulatory requirements. Windows Defender ATP has a roadmap for obtaining national, regional and industry-specific certifications, starting with ISO 27001.The service is designed, implemented and maintained according to the compliance and privacy principles of ISO 27001 as well as Microsoft’s compliance standards. +Microsoft provides customers with detailed information about our security and compliance programs, including audit reports and compliance packages, to help customers assess our services against their own legal and regulatory requirements. Windows Defender ATP has a roadmap for obtaining national, regional and industry-specific certifications, starting with ISO 27001. The service is designed, implemented, and maintained according to the compliance and privacy principles of ISO 27001, as well as Microsoft’s compliance standards. ## Is there a difference between how Microsoft handles data for the TAP program and for General Availability? -When you onboard your service during TAP, you will be asked to choose to store your data in either a European or US datacenter. Your data will not be copied or moved outside of the datacenter you choose, except in the following specific circumstance: +When you onboard your service during TAP, you will be asked to choose to store your data in a datacenter either in Europe or United States. Your data will not be copied or moved outside of the datacenter you choose, except in the following specific circumstance: 1. You choose Europe as your datacenter, and 2. You [submit a file for deep analysis](deep-analysis-windows-advanced-threat-protection.md). From 3c325a4d6b0e62db032692454571cb6424a5362e Mon Sep 17 00:00:00 2001 From: Dolcita Date: Tue, 19 Apr 2016 16:29:39 +1000 Subject: [PATCH 030/439] Fixed spacing/formatting issues --- .../use-windows-defender-advanced-threat-protection.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md index 6c48cea5f2..e916d5fdfb 100644 --- a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md @@ -29,7 +29,9 @@ Teams can monitor the overall status of enterprise endpoints from the **Dashboar ## Windows Defender ATP alerts Alerts in the portal help to notify you of detected threat behaviors or activities on your endpoints. The **Dashboard** and **Alerts queue** provide important information about your endpoints that can help you address alerts. -The **Dashboard** groups active alerts into **New** or **In progress** queues, and supports filtering by severity levels. It also has clickable tiles that give visual cues on the overall health status of your organization. Each tile opens a detailed view of the corresponding overview. + +The **Dashboard** groups categorize active alerts into **New** or **In progress** queues, and supports filtering by severity levels. It also has clickable tiles that give visual cues on the overall health status of your organization. Each tile opens a detailed view of the corresponding overview. + Alerts are organized in three queues, by their workflow status: - **New** @@ -51,7 +53,7 @@ Topic | Description :---|:--- [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-advanced-threat-protection.md) | The **Dashboard** provides a snapshot of your network. You can view aggregates of alerts, the overall status of the service of the endpoints on your network, investigate machines, files, and URLs, and see snapshots of threats seen on machines. [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-advanced-threat-protection.md) | You can sort and filter alerts across your network, and drill down on individual alert queues. -[Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-advanced-threat-protection.md) | The Manage Alert menu on every alert lets you change an alert's status, resolve it, suppress it, or contribute comments about the alert. +[Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-advanced-threat-protection.md) | The **Manage Alert** menu on every alert lets you change an alert's status, resolve it, suppress it, or contribute comments about the alert. [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-advanced-threat-protection.md) | The **Machines view** shows a list of the machines in your network, the corresponding number of active alerts for each machine categorized by alert severity levels, as well as the number of threats. [Submit files to the Windows Defender ATP Deep analysis feature](deep-analysis-windows-advanced-threat-protection.md) | You can submit files for deep analysis to see detailed information about the file’s activities, observed behaviors, and associated artifacts (such as dropped files, registry modifications, and communications with IPs). From dcc84173dfeb554ecb766559fa64e1dc10916658 Mon Sep 17 00:00:00 2001 From: Dolcita Date: Tue, 19 Apr 2016 16:31:24 +1000 Subject: [PATCH 031/439] Update use-windows-defender-advanced-threat-protection.md --- .../use-windows-defender-advanced-threat-protection.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md index e916d5fdfb..f5451bf406 100644 --- a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md @@ -19,7 +19,7 @@ A typical security breach investigation requires a member of a security operatio 1. View an alert on the **Dashboard** or **Alerts queue** 2. Review the indicators of compromise (IOC) or indications of attack (IOAs) 3. Review a timeline of alerts, behaviors, and events from the machine -4. Manage alerts, understand the threat/potential breach, collect information to support taking action, and resolve the alert +4. Manage alerts, understand the threat or potential breach, collect information to support taking action, and resolve the alert ![Flowchart describing the four stages of investigation](images/overview.png) @@ -30,7 +30,7 @@ Teams can monitor the overall status of enterprise endpoints from the **Dashboar Alerts in the portal help to notify you of detected threat behaviors or activities on your endpoints. The **Dashboard** and **Alerts queue** provide important information about your endpoints that can help you address alerts. -The **Dashboard** groups categorize active alerts into **New** or **In progress** queues, and supports filtering by severity levels. It also has clickable tiles that give visual cues on the overall health status of your organization. Each tile opens a detailed view of the corresponding overview. +The **Dashboard** groups or categorizes active alerts into **New** or **In progress** queues, and supports filtering by severity levels. It also has clickable tiles that give visual cues on the overall health status of your organization. Each tile opens a detailed view of the corresponding overview. Alerts are organized in three queues, by their workflow status: From 8a20df11193475ac6f570d6244204b42d55afabd Mon Sep 17 00:00:00 2001 From: Dolcita Date: Tue, 19 Apr 2016 16:40:06 +1000 Subject: [PATCH 032/439] Checked formatting --- .../dashboard-windows-advanced-threat-protection.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/keep-secure/dashboard-windows-advanced-threat-protection.md b/windows/keep-secure/dashboard-windows-advanced-threat-protection.md index a28fd40d5a..0133ef2c90 100644 --- a/windows/keep-secure/dashboard-windows-advanced-threat-protection.md +++ b/windows/keep-secure/dashboard-windows-advanced-threat-protection.md @@ -60,7 +60,7 @@ The **Machines reporting** tile shows a bar graph that represents the number of ## Investigate machines with active threats The **Active malware** tile will only appear if your endpoints are using Windows Defender. -Active malware is defined as threats that were actively executing at the time of detection. +Active malware is defined as threats that are actively executing at the time of detection. Hover over each bar to see the number of active detections (as **Threats**) and the number of endpoints with at least one active detection (as **Machines**) over the past 30 days. @@ -72,7 +72,7 @@ The chart is sorted into five categories: - **Ransomware** - threats that prevent user access to a machine or its files and demand payment to restore access. - **Exploit** - threats that use software vulnerabilities to infect machines. - **Threat** - all other threats that don't fit into the **Password stealer**, **Ransomware**, or **Exploit** categories. This includes trojans, worms, backdoors, and viruses. -- **Low severity** - threats with a low severity, including adware and potentially unwanted software such as browser modifiers. +- **Low severity** - threats with low severity, including adware and potentially unwanted software such as browser modifiers. Threats are considered "Active" if there is a very high probability that the malware was executing on your network, as opposed to statically located on-disk. @@ -84,4 +84,4 @@ Clicking on any one of these categories will navigate to the [Machines view](mac - [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-advanced-threat-protection.md) - [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-advanced-threat-protection.md) - [Submit files to the Windows Defender ATP Deep analysis feature](deep-analysis-windows-advanced-threat-protection.md) -- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-advanced-threat-protection.md) \ No newline at end of file +- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-advanced-threat-protection.md) From 86eb284ec8ad712ea878c650c0714ad5119b55c9 Mon Sep 17 00:00:00 2001 From: Dolcita Date: Tue, 19 Apr 2016 16:41:51 +1000 Subject: [PATCH 033/439] Checked formatting --- .../alerts-queue-windows-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md b/windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md index 9f5da1e2b3..ef53e4b27b 100644 --- a/windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md +++ b/windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md @@ -36,7 +36,7 @@ There are three mechanisms to pivot the queue against: 1. Sort the queue by opening the drop-down menu in the **Sort by** field and choosing: - - **Newest** - Sorts alerts by when the alert was last seen on an endpoint. + - **Newest** - Sorts alerts based on when the alert was last seen on an endpoint. - **Time in queue** - Sorts alerts by the length of time an alert has been in the queue. - **Severity** - Sorts alerts by their level of severity. From b36941c9433ed00067b91afa0db759521fbc4a54 Mon Sep 17 00:00:00 2001 From: Dolcita Date: Tue, 19 Apr 2016 16:58:26 +1000 Subject: [PATCH 034/439] Added clarity to MD5 reference --- .../investigate-alerts-windows-advanced-threat-protection.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md b/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md index dfd19d659a..cfa1dcbe86 100644 --- a/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md @@ -100,7 +100,7 @@ You can get information from the following sections in the file view: - File in organization - Observed in organization -The file details section shows attributes of the file such as its MD5 and its prevalence worldwide. +The file details section shows attributes of the file such as its MD5 hash or number and its prevalence worldwide. The **Deep analysis** section provides the option of submitting a file for deep analysis to gain detailed visibility on observed suspicious behaviors, and associated artifacts. For more information on submitting files for deep analysis, see the **Deep analysis** topic. @@ -180,4 +180,4 @@ The **Communication with URL in organization** section provides a chronological - [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-advanced-threat-protection.md) - [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-advanced-threat-protection.md) - [Submit files to the Windows Defender ATP Deep analysis feature](deep-analysis-windows-advanced-threat-protection.md) -- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-advanced-threat-protection.md) \ No newline at end of file +- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-advanced-threat-protection.md) From 45e9a05e702342002d30531a8eddc122c6376392 Mon Sep 17 00:00:00 2001 From: Dolcita Date: Tue, 19 Apr 2016 17:06:11 +1000 Subject: [PATCH 035/439] Checked formatting --- .../deep-analysis-windows-advanced-threat-protection.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/deep-analysis-windows-advanced-threat-protection.md b/windows/keep-secure/deep-analysis-windows-advanced-threat-protection.md index c6b0f83269..75d893b3c8 100644 --- a/windows/keep-secure/deep-analysis-windows-advanced-threat-protection.md +++ b/windows/keep-secure/deep-analysis-windows-advanced-threat-protection.md @@ -14,7 +14,7 @@ ms.sitesec: library [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -Cyber security investigations are typically triggered by an alert. Alerts are related to one or more observed files that are often new or unknown. Clicking a file takes you to the file view where you can see the file's metadata. To enrich the data relating to the file you can submit the file for deep analysis. +Cyber security investigations are typically triggered by an alert. Alerts are related to one or more observed files that are often new or unknown. Clicking a file takes you to the file view where you can see the file's metadata. To enrich the data related to the file, you can submit the file for deep analysis. The deep analysis feature executes a file in a secure, fully instrumented cloud environment. Deep analysis results show the file's activities, observed behaviors, and associated artifacts, such as dropped files, registry modifications, and communication with IPs. Deep analysis currently supports extensive analysis of PE (portable executable) files (including _.exe_ and _.dll_ files). @@ -39,7 +39,7 @@ When the sample is collected, Windows Defender ATP runs the file in is a secure **Submit files for deep analysis:** -1. Select the file you want to submit for deep analysis. You can select or search a file from any of the following views: +1. Select the file that you want to submit for deep analysis. You can select or search a file from any of the following views: - Alerts - click the file links from the **Description** or **Details** in the Alert timeline - **Machines View** - click the file links from the **Description** or **Details** in the **Machine in organization** section - Search box - select **File** from the drop-down menu and enter the file name From d2de4e02d3be58d1ad372d3b2e4d9e5119642854 Mon Sep 17 00:00:00 2001 From: Dolcita Date: Tue, 19 Apr 2016 17:12:21 +1000 Subject: [PATCH 036/439] Fixed spacing/formatting issues --- .../manage-alerts-windows-advanced-threat-protection.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/keep-secure/manage-alerts-windows-advanced-threat-protection.md b/windows/keep-secure/manage-alerts-windows-advanced-threat-protection.md index f8d4307dc3..7bdbe03b83 100644 --- a/windows/keep-secure/manage-alerts-windows-advanced-threat-protection.md +++ b/windows/keep-secure/manage-alerts-windows-advanced-threat-protection.md @@ -75,6 +75,7 @@ The context of the rule lets you tailor the queue to ensure that only alerts you **Suppress alert on this machine** | Alerts with the same alert title and on that specific machine only will be suppressed.

All other alerts on that machine will not be suppressed. |
  • A security researcher is investigating a malicious script that has been used to attack other machines in your organization.
  • A developer regularly creates PowerShell scripts for their team.
**Suppress alert in my organization** | Alerts with the same alert title on any machine will be suppressed. |
  • A benign administrative tool is used by everyone in your organization.
+ **Suppress an alert and create a suppression rule:** 1. Click the **Manage Alert** menu icon ![The menu icon looks like three periods stacked on top of each other](images/menu-icon.png) on the heading of an existing alert. @@ -87,7 +88,7 @@ The context of the rule lets you tailor the queue to ensure that only alerts you 1. Click the settings icon ![The settings icon looks like a cogwheel or gear](images/settings.png) on the main menu bar at the top of the Windows Defender ATP screen. 2. Click **Suppression rules**. -![Click the settings icon and then Suppression rules to create and modify rules](images/suppression-rules.png) + ![Click the settings icon and then Suppression rules to create and modify rules](images/suppression-rules.png) > **Note**  You can also click **See rules** in the confirmation window that appears when you suppress an alert. From 96ea32f5948ca4feaae8f658d00bd470d69f442b Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 20 Apr 2016 13:37:07 +1000 Subject: [PATCH 037/439] remove extra "the" from windef-atp topic --- windows/keep-secure/TOC.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 6a2fbd0e26..87580f2f5d 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -403,10 +403,10 @@ #### [User Account Control security policy settings](user-account-control-security-policy-settings.md) ### [Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md) #### [Minimum requirements for Windows Defender Advanced Threat Protection](minimum-requirements-windows-defender-advanced-threat-protection.md) -#### [Onboard endpoints and set up the Windows Defender ATP user access](onboard-configure-windows-advanced-threat-protection.md) +#### [Onboard endpoints and set up Windows Defender ATP user access](onboard-configure-windows-advanced-threat-protection.md) ##### [Windows Defender ATP service onboarding](service-onboarding-windows-advanced-threat-protection.md) ##### [Configure Windows Defender ATP endpoints (client onboarding)](configure-endpoints-windows-advanced-threat-protection.md) -##### [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-advanced-threat-protection.md) +##### [Monitor Windows Defender ATP onboarding](monitor-onboarding-windows-advanced-threat-protection.md) ##### [Additional Windows Defender ATP configuration settings](additional-configuration-windows-advanced-threat-protection.md) ##### [Troubleshoot Windows Defender ATP onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) #### [Windows Defender ATP data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) From b53d4d77f9161669b163d12a990617fe31327a09 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 20 Apr 2016 13:48:36 +1000 Subject: [PATCH 038/439] insert meta tag ms.mktglfcycl:deploy --- .../alerts-queue-windows-advanced-threat-protection.md | 2 +- .../keep-secure/dashboard-windows-advanced-threat-protection.md | 2 +- ...orage-privacy-windows-defender-advanced-threat-protection.md | 2 +- .../deep-analysis-windows-advanced-threat-protection.md | 2 +- .../investigate-alerts-windows-advanced-threat-protection.md | 2 +- .../machines-view-windows-advanced-threat-protection.md | 2 +- .../manage-alerts-windows-advanced-threat-protection.md | 2 +- ...-requirements-windows-defender-advanced-threat-protection.md | 2 +- ...rtal-overview-windows-defender-advanced-threat-protection.md | 2 +- .../settings-windows-defender-advanced-threat-protection.md | 2 +- .../troubleshoot-windows-defender-advanced-threat-protection.md | 2 +- .../use-windows-defender-advanced-threat-protection.md | 2 +- .../keep-secure/windows-defender-advanced-threat-protection.md | 2 +- 13 files changed, 13 insertions(+), 13 deletions(-) diff --git a/windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md b/windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md index ef53e4b27b..f5652bafe1 100644 --- a/windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md +++ b/windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Learn about how the Windows Defender ATP alerts queue work, and how keywords: alerts, queues, alerts queue, sort, order, filter, manage alerts, new, in progress, resolved, newest, time in queue, severity, time period search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl: +ms.mktglfcycl:deploy ms.sitesec: library --- diff --git a/windows/keep-secure/dashboard-windows-advanced-threat-protection.md b/windows/keep-secure/dashboard-windows-advanced-threat-protection.md index 0133ef2c90..6a79e9a363 100644 --- a/windows/keep-secure/dashboard-windows-advanced-threat-protection.md +++ b/windows/keep-secure/dashboard-windows-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Use the Dashboard to identify machines at risk, keep track of the s keywords: dashboard, alerts, new, in progress, resolved, risk, machines at risk, infections, reporting, statistics, charts, graphs, health, active threats, threat category, categories, password stealer, ransomware, exploit, threat, low severity, active malware search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl: +ms.mktglfcycl:deploy ms.sitesec: library --- diff --git a/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md index 0e17ad6ff3..2bbf4d4002 100644 --- a/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Learn about how Windows Defender ATP handles privacy and data that keywords: Windows Defender ATP data storage and privacy, storage, privacy search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl: +ms.mktglfcycl:deploy ms.sitesec: library author: DulceMV --- diff --git a/windows/keep-secure/deep-analysis-windows-advanced-threat-protection.md b/windows/keep-secure/deep-analysis-windows-advanced-threat-protection.md index 75d893b3c8..236929f516 100644 --- a/windows/keep-secure/deep-analysis-windows-advanced-threat-protection.md +++ b/windows/keep-secure/deep-analysis-windows-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Submit a file to the deep analysis feature to see a detailed report keywords: analysis, deep analysis, analyze, submit, submission, file, malware, threats, infection, executable, report, troubleshoot, sample, sample collection, behaviors, .exe, .dll, .scr search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl: +ms.mktglfcycl:deploy ms.sitesec: library --- diff --git a/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md b/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md index cfa1dcbe86..5265c474a9 100644 --- a/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Use the investigation options to get details on which alerts are af keywords: investigate, investigation, machines, machine, endpoints, endpoint, alerts queue, dashboard, IP address, file, submit, submissions, deep analysis, timeline, search, domain, URL, IP search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl: +ms.mktglfcycl:deploy ms.sitesec: library --- diff --git a/windows/keep-secure/machines-view-windows-advanced-threat-protection.md b/windows/keep-secure/machines-view-windows-advanced-threat-protection.md index 089d5cbebe..9ced68d57c 100644 --- a/windows/keep-secure/machines-view-windows-advanced-threat-protection.md +++ b/windows/keep-secure/machines-view-windows-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Investigate affected machines in your network by reviewing alerts, keywords: machines, endpoints, machine, endpoint, alerts queue, alerts, machine name, domain, last seen, internal IP, active alerts, active threats, threat category, filter, sort, review alerts, network, connection, malware, type, password stealer, ransomware, exploit, threat, low severity search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl: +ms.mktglfcycl:deploy ms.sitesec: library --- diff --git a/windows/keep-secure/manage-alerts-windows-advanced-threat-protection.md b/windows/keep-secure/manage-alerts-windows-advanced-threat-protection.md index 7bdbe03b83..edb42090f5 100644 --- a/windows/keep-secure/manage-alerts-windows-advanced-threat-protection.md +++ b/windows/keep-secure/manage-alerts-windows-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Change the status of alerts, create suppression rules to hide alert keywords: manage alerts, manage, alerts, status, new, in progress, resolved, resolve alerts, suppress, supression, rules, context, history, comments, changes search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl: +ms.mktglfcycl:deploy ms.sitesec: library --- diff --git a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md index c483bf1efd..6d4b6f8d00 100644 --- a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Minimum network and data storage configuration, endpoint hardware a keywords: minimum requirements, Windows Defender Advanced Threat Protection minimum requirements, network and data storage, endpoint, endpoint configuration, deployment channel search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl: +ms.mktglfcycl:deploy ms.sitesec: library --- diff --git a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md index c64ddcd962..2499d3bdef 100644 --- a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Use the Windows Defender ATP portal to monitor your enterprise netw keywords: Windows Defender ATP portal, portal, cybersecurity threat intelligence, dashboard, alerts queue, machines view, preferences setup, client onboarding, advanced attacks search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl: +ms.mktglfcycl:deploy ms.sitesec: library author: DulceMV --- diff --git a/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md b/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md index bca4c8882a..86a75a445f 100644 --- a/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Use the menu to configure the time zone, suppression rules, and vie keywords: Windows Defender ATP settings, Windows Defender, cybersecurity threat intelligence, advanced threat protection search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl: +ms.mktglfcycl:deploy ms.sitesec: library author: DulceMV --- diff --git a/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md index 6140029820..f1345eb18c 100644 --- a/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Find solutions and work arounds to known issues such as server erro keywords: troubleshoot Windows Defender Adavanced Threat Protection, troubleshoot Windows ATP, server error, access denied, invalid credentials search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl: +ms.mktglfcycl:deploy ms.sitesec: library author: mjcaparas --- diff --git a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md index f5451bf406..d93f82b596 100644 --- a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Learn about the features on Windows Defender ATP portal, including keywords: dashboard, alerts queue, manage alerts, investigation, investigate alerts, investigate machines, submit files, deep analysis, high, medium, low, severity, search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl: +ms.mktglfcycl:deploy ms.sitesec: library --- diff --git a/windows/keep-secure/windows-defender-advanced-threat-protection.md b/windows/keep-secure/windows-defender-advanced-threat-protection.md index 1be65e18d2..4c5bb73ccd 100644 --- a/windows/keep-secure/windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/windows-defender-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Windows Defender Advanced Threat Protection is an enterprise securi keywords: introduction to Windows Defender Advanced Threat Protection, introduction to Windows Defender ATP, cybersecurity, advanced persistent threat, enterprise security search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl: +ms.mktglfcycl:deploy ms.sitesec: library author: mjcaparas --- From 0c617e302473782da9b417d05a6fd9cbc34cfb50 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 20 Apr 2016 13:49:40 +1000 Subject: [PATCH 039/439] fixed typo --- .../troubleshoot-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md index f1345eb18c..bcd779a9df 100644 --- a/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- title: Troubleshoot Windows Defender Advanced Threat Protection description: Find solutions and work arounds to known issues such as server errors when trying to access the service. -keywords: troubleshoot Windows Defender Adavanced Threat Protection, troubleshoot Windows ATP, server error, access denied, invalid credentials +keywords: troubleshoot Windows Defender Advanced Threat Protection, troubleshoot Windows ATP, server error, access denied, invalid credentials search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl:deploy From 2563bc38c1ed4dc1f99f77b4e19b96b2474dcced Mon Sep 17 00:00:00 2001 From: Iaan Date: Wed, 20 Apr 2016 15:30:32 +1000 Subject: [PATCH 040/439] update endpoint docs --- .gitignore | 3 + ...tion-windows-advanced-threat-protection.md | 4 +- ...ints-windows-advanced-threat-protection.md | 63 ++++++++++--------- ...ows-defender-advanced-threat-protection.md | 7 ++- ...ding-windows-advanced-threat-protection.md | 1 + ...gure-windows-advanced-threat-protection.md | 4 +- ...ding-windows-advanced-threat-protection.md | 3 +- 7 files changed, 52 insertions(+), 33 deletions(-) diff --git a/.gitignore b/.gitignore index 643bf6e6c0..b16bde70d6 100644 --- a/.gitignore +++ b/.gitignore @@ -5,6 +5,9 @@ obj/ _site/ Tools/NuGet/ .optemp/ +.sln +.suo + .openpublishing.build.mdproj .openpublishing.buildcore.ps1 diff --git a/windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md b/windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md index c5e38182d4..3fa9537fcd 100644 --- a/windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md +++ b/windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md @@ -14,6 +14,8 @@ author: mjcaparas **Applies to** - Windows 10 Insider Preview +- System Center Configuration Manager +- Group Policy Management Console [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] @@ -37,7 +39,7 @@ You can use Group Policy (GP) to configure settings, such as settings for the sa 6. Choose to enable or disable sample sharing from your endpoints. -## Configure sample collection settings with Configuration Manager +## Configure sample collection settings with System Center Configuration Manager TBA diff --git a/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md index 6cc137aa42..5b6df19735 100644 --- a/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Use Group Policy to deploy the configuration package or do manual r keywords: configure endpoints, client onboarding, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl: +ms.mktglfcycl: deploy ms.sitesec: library author: mjcaparas --- @@ -12,25 +12,53 @@ author: mjcaparas # Configure Windows Defender ATP endpoints (client onboarding) - Windows 10 Insider Preview +- System Center Configuration Manager +- Group Policy Management Console [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -You can use a Group Policy (GP) configuration package or an automated script to configure endpoints. You can deploy the GP configuration package or script with a GP update, or manually through the command line. +You can configure endpoints by using a System Center Configuration Manager (SCCM) or Group Policy Management Console (GPMC) configuration package, or by running an automated script. + +## Configure with System Center Configuration Manager (SCCM) + +1. Open the SCCM configuration package .zip file (*WindowsATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://seville.windows.com): Naama: Confirm package name ((I can't download it)) + + a. Click **Client onboarding** on the **Navigation pane**. + + b. Select **SCCM**, click **Download package**, and save the .zip file. + > **Note**   It may take a few moments for the package to be prepared and delivered to you. A progress bar will appear at the very top of the portal to indicate the package is being prepared. + +2. Copy the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. + +3. In the SCCM console, go to **Software Library**. + +4. Under **Application Management**, right-click **Packages** and select **Import**. + +5. Click **Browse** and choose the package that was downloaded from the portal (zip file). + +6. The package will appear under the Packages page. + +7. Right-click the Package and choose deploy. + +8. Choose a predefined device collection to deploy the package to. + +Naama note: If it’s a package we create then we’ll set the necessary privileges, otherwise provide guidance (Omri: what is the necessary privileges?) ## Configure with Group Policy Using the GP configuration package ensures your endpoints will be correctly configured to report to the Windows Defender ATP service. > **Note**   To use GP updates to deploy the package, you must be on Windows Server 2008 R2 or later. The endpoints must be running Windows 10 TAP. -1. Open the GP configuration package .zip file (*WindowsATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://seville.windows.com): +1. Open the GP configuration package .zip file (*WindowsATPOnboardingPackage_GroupPolicy.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://seville.windows.com): a. Click **Client onboarding** on the **Navigation pane**. - b. Select **GP**, click **Download package** and save the .zip file. - + b. Select **GP**, click **Download package**, and save the .zip file. + > **Note**   It may take a few moments for the package to be prepared and delivered to you. A progress bar will appear at the very top of the portal to indicate the package is being prepared. + 2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the endpoints. You should have a folder called _*OptionalParamsPolicy*_ and the file _*WindowsATPOnboardingPackage.cmd*_. -3. Open the [Group Policy Management Console](https://technet.microsoft.com/en-us/library/cc731212.aspx) (GPMC), right-click the Group Policy Object (GPO) you want to configure and click **Edit**. +3. Open the [Group Policy Management Console](https://technet.microsoft.com/en-us/library/cc753298.aspx) (GPMC), right-click the Group Policy Object (GPO) you want to configure and click **Edit**. 4. In the **Group Policy Management Editor**, go to **Computer configuration**, then **Preferences**, and then **Control panel settings**. @@ -46,27 +74,6 @@ Using the GP configuration package ensures your endpoints will be correctly conf For additional settings, see the [Additional configuration settings section](additional-configuration-windows-advanced-threat-protection.md). -## Configure with System Center Configuration Manager (SCCM) - -1. Open the SCCM configuration package .zip file (*WindowsATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://seville.windows.com): Naama: Confirm package name - - a. Click **Client onboarding** on the **Navigation pane**. - - b. Select **SCCM**, click **Download package**, and save the .zip file. Iaan: Need to confirm the UI for this - -2. Copy the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. - -Iaan: Will confirm ui for this - -3. In the SCCM console, go to **Software Library**. -4. Under **Application Management**, right-click **Packages** and select **Import**. -5. Click **Browse** and choose the package that was downloaded from the portal (zip file). -6. The package will appear under the Packages page. -7. Right-click the Package and choose deploy. -8. Choose a predefined device collection to deploy the package to. - -Naama note: If it’s a package we create then we’ll set the necessary privileges, otherwise provide guidance (Omri: what is the necessary privileges?) - ## Configure endpoints manually with registry changes You can also manually onboard individual endpoints to Windows Defender ATP. You might want to do this first when testing the service before you commit to onboarding all endpoints in your network. @@ -83,7 +90,7 @@ You can also manually onboard individual endpoints to Windows Defender ATP. You ![Window Start menu pointing to Run as administrator](images/run-as-admin.png) 3. Type the location of the script file. If you copied the file the - desktop, type:```*%userprofile%\Desktop\WindowsATPOnboardingScript.sc*``` + desktop, type: *```%userprofile%\Desktop\WindowsATPOnboardingScript.sc```* 4. Press the **Enter** key or click **OK**. diff --git a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md index c483bf1efd..6d4a18f344 100644 --- a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -13,6 +13,8 @@ ms.sitesec: library **Applies to** - Windows 10 Insider Preview +- System Center Configuration Manager +- Group Policy Management Console [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] @@ -57,9 +59,9 @@ disabled you can turn it on by following the instructions in the ### Deployment channel operating system requirements -You can choose to onboard endpoints with a scheduled Group Policy +You can choose to onboard endpoints with System Center Configuration Manager (SCCM) or a scheduled Group Policy (GP) update (using a GP package that you -download from the portal or during the service onboarding wizard) or +download from the portal or during the service onboarding wizard). You can also apply manual registry changes. The following describes the minimum operating system or software version @@ -67,6 +69,7 @@ required for each deployment channel. Deployment channel | Minimum server requirements :---|:--- +System Center Configuration Manager | **WHAT VERSIONS** Group Policy settings | Windows Server 2008 R2 Manual registry modifications | No minimum requirements diff --git a/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md b/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md index 0a95b9131a..82da79a4c0 100644 --- a/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md +++ b/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md @@ -12,6 +12,7 @@ author: mjcaparas # Monitor the Windows Defender Advanced Threat Protection onboarding - Windows 10 Insider Preview +- System Center Configuration Manager [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] diff --git a/windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md b/windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md index 3d31d3693d..63f28c3c31 100644 --- a/windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md +++ b/windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md @@ -14,6 +14,8 @@ author: mjcaparas **Applies to** - Windows 10 Insider Preview +- System Center Configuration Manager +- Group Policy Management Console [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] @@ -24,7 +26,7 @@ There are two stages to onboarding: 1. Set up user access in AAD and use a wizard to create a dedicated cloud instance for your network (known as “service onboarding”). -2. Add endpoints to the service with scheduled GP updates or manual +2. Add endpoints to the service with System Center Configuration Manager, scheduled GP updates, or manual registry changes (known as “endpoint onboarding”). ## In this section diff --git a/windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md b/windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md index 92e31985a1..3f7ffc708a 100644 --- a/windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md +++ b/windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Assign users to the Windows Defender ATP service application in Azu keywords: service onboarding, Windows Defender Advanced Threat Protection service onboarding search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl: +ms.mktglfcycl: deploy ms.sitesec: library author: mjcaparas --- @@ -12,6 +12,7 @@ author: mjcaparas # Windows Defender ATP service onboarding - Windows 10 Insider Preview +- Azure Active Directory [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] From 406b2a8e280c57f5bb54eac036a3a4cc17929cd3 Mon Sep 17 00:00:00 2001 From: Iaan Date: Wed, 20 Apr 2016 15:43:27 +1000 Subject: [PATCH 041/439] deploy --- ...roubleshoot-onboarding-windows-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-advanced-threat-protection.md index 7256569ddb..4cce488c83 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Troubleshoot issues that might arise during the onboarding of endpo keywords: troubleshoot onboarding, onboarding issues, event viewer, azure management portal, data collection and preview builds search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl: +ms.mktglfcycl: deploy ms.sitesec: library author: mjcaparas --- From 93ad344d47a728925897086d00304696b4518133 Mon Sep 17 00:00:00 2001 From: Iaan Date: Wed, 20 Apr 2016 15:47:33 +1000 Subject: [PATCH 042/439] Revert "update endpoint docs" This reverts commit 2563bc38c1ed4dc1f99f77b4e19b96b2474dcced. --- .gitignore | 3 - ...tion-windows-advanced-threat-protection.md | 4 +- ...ints-windows-advanced-threat-protection.md | 63 +++++++++---------- ...ows-defender-advanced-threat-protection.md | 7 +-- ...ding-windows-advanced-threat-protection.md | 1 - ...gure-windows-advanced-threat-protection.md | 4 +- ...ding-windows-advanced-threat-protection.md | 3 +- 7 files changed, 33 insertions(+), 52 deletions(-) diff --git a/.gitignore b/.gitignore index b16bde70d6..643bf6e6c0 100644 --- a/.gitignore +++ b/.gitignore @@ -5,9 +5,6 @@ obj/ _site/ Tools/NuGet/ .optemp/ -.sln -.suo - .openpublishing.build.mdproj .openpublishing.buildcore.ps1 diff --git a/windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md b/windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md index 3fa9537fcd..c5e38182d4 100644 --- a/windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md +++ b/windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md @@ -14,8 +14,6 @@ author: mjcaparas **Applies to** - Windows 10 Insider Preview -- System Center Configuration Manager -- Group Policy Management Console [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] @@ -39,7 +37,7 @@ You can use Group Policy (GP) to configure settings, such as settings for the sa 6. Choose to enable or disable sample sharing from your endpoints. -## Configure sample collection settings with System Center Configuration Manager +## Configure sample collection settings with Configuration Manager TBA diff --git a/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md index 5b6df19735..6cc137aa42 100644 --- a/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Use Group Policy to deploy the configuration package or do manual r keywords: configure endpoints, client onboarding, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl: deploy +ms.mktglfcycl: ms.sitesec: library author: mjcaparas --- @@ -12,53 +12,25 @@ author: mjcaparas # Configure Windows Defender ATP endpoints (client onboarding) - Windows 10 Insider Preview -- System Center Configuration Manager -- Group Policy Management Console [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -You can configure endpoints by using a System Center Configuration Manager (SCCM) or Group Policy Management Console (GPMC) configuration package, or by running an automated script. - -## Configure with System Center Configuration Manager (SCCM) - -1. Open the SCCM configuration package .zip file (*WindowsATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://seville.windows.com): Naama: Confirm package name ((I can't download it)) - - a. Click **Client onboarding** on the **Navigation pane**. - - b. Select **SCCM**, click **Download package**, and save the .zip file. - > **Note**   It may take a few moments for the package to be prepared and delivered to you. A progress bar will appear at the very top of the portal to indicate the package is being prepared. - -2. Copy the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. - -3. In the SCCM console, go to **Software Library**. - -4. Under **Application Management**, right-click **Packages** and select **Import**. - -5. Click **Browse** and choose the package that was downloaded from the portal (zip file). - -6. The package will appear under the Packages page. - -7. Right-click the Package and choose deploy. - -8. Choose a predefined device collection to deploy the package to. - -Naama note: If it’s a package we create then we’ll set the necessary privileges, otherwise provide guidance (Omri: what is the necessary privileges?) +You can use a Group Policy (GP) configuration package or an automated script to configure endpoints. You can deploy the GP configuration package or script with a GP update, or manually through the command line. ## Configure with Group Policy Using the GP configuration package ensures your endpoints will be correctly configured to report to the Windows Defender ATP service. > **Note**   To use GP updates to deploy the package, you must be on Windows Server 2008 R2 or later. The endpoints must be running Windows 10 TAP. -1. Open the GP configuration package .zip file (*WindowsATPOnboardingPackage_GroupPolicy.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://seville.windows.com): +1. Open the GP configuration package .zip file (*WindowsATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://seville.windows.com): a. Click **Client onboarding** on the **Navigation pane**. - b. Select **GP**, click **Download package**, and save the .zip file. - > **Note**   It may take a few moments for the package to be prepared and delivered to you. A progress bar will appear at the very top of the portal to indicate the package is being prepared. - + b. Select **GP**, click **Download package** and save the .zip file. + 2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the endpoints. You should have a folder called _*OptionalParamsPolicy*_ and the file _*WindowsATPOnboardingPackage.cmd*_. -3. Open the [Group Policy Management Console](https://technet.microsoft.com/en-us/library/cc753298.aspx) (GPMC), right-click the Group Policy Object (GPO) you want to configure and click **Edit**. +3. Open the [Group Policy Management Console](https://technet.microsoft.com/en-us/library/cc731212.aspx) (GPMC), right-click the Group Policy Object (GPO) you want to configure and click **Edit**. 4. In the **Group Policy Management Editor**, go to **Computer configuration**, then **Preferences**, and then **Control panel settings**. @@ -74,6 +46,27 @@ Using the GP configuration package ensures your endpoints will be correctly conf For additional settings, see the [Additional configuration settings section](additional-configuration-windows-advanced-threat-protection.md). +## Configure with System Center Configuration Manager (SCCM) + +1. Open the SCCM configuration package .zip file (*WindowsATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://seville.windows.com): Naama: Confirm package name + + a. Click **Client onboarding** on the **Navigation pane**. + + b. Select **SCCM**, click **Download package**, and save the .zip file. Iaan: Need to confirm the UI for this + +2. Copy the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. + +Iaan: Will confirm ui for this + +3. In the SCCM console, go to **Software Library**. +4. Under **Application Management**, right-click **Packages** and select **Import**. +5. Click **Browse** and choose the package that was downloaded from the portal (zip file). +6. The package will appear under the Packages page. +7. Right-click the Package and choose deploy. +8. Choose a predefined device collection to deploy the package to. + +Naama note: If it’s a package we create then we’ll set the necessary privileges, otherwise provide guidance (Omri: what is the necessary privileges?) + ## Configure endpoints manually with registry changes You can also manually onboard individual endpoints to Windows Defender ATP. You might want to do this first when testing the service before you commit to onboarding all endpoints in your network. @@ -90,7 +83,7 @@ You can also manually onboard individual endpoints to Windows Defender ATP. You ![Window Start menu pointing to Run as administrator](images/run-as-admin.png) 3. Type the location of the script file. If you copied the file the - desktop, type: *```%userprofile%\Desktop\WindowsATPOnboardingScript.sc```* + desktop, type:```*%userprofile%\Desktop\WindowsATPOnboardingScript.sc*``` 4. Press the **Enter** key or click **OK**. diff --git a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md index 6d4a18f344..c483bf1efd 100644 --- a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -13,8 +13,6 @@ ms.sitesec: library **Applies to** - Windows 10 Insider Preview -- System Center Configuration Manager -- Group Policy Management Console [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] @@ -59,9 +57,9 @@ disabled you can turn it on by following the instructions in the ### Deployment channel operating system requirements -You can choose to onboard endpoints with System Center Configuration Manager (SCCM) or a scheduled Group Policy +You can choose to onboard endpoints with a scheduled Group Policy (GP) update (using a GP package that you -download from the portal or during the service onboarding wizard). You can also apply +download from the portal or during the service onboarding wizard) or manual registry changes. The following describes the minimum operating system or software version @@ -69,7 +67,6 @@ required for each deployment channel. Deployment channel | Minimum server requirements :---|:--- -System Center Configuration Manager | **WHAT VERSIONS** Group Policy settings | Windows Server 2008 R2 Manual registry modifications | No minimum requirements diff --git a/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md b/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md index 82da79a4c0..0a95b9131a 100644 --- a/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md +++ b/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md @@ -12,7 +12,6 @@ author: mjcaparas # Monitor the Windows Defender Advanced Threat Protection onboarding - Windows 10 Insider Preview -- System Center Configuration Manager [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] diff --git a/windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md b/windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md index 63f28c3c31..3d31d3693d 100644 --- a/windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md +++ b/windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md @@ -14,8 +14,6 @@ author: mjcaparas **Applies to** - Windows 10 Insider Preview -- System Center Configuration Manager -- Group Policy Management Console [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] @@ -26,7 +24,7 @@ There are two stages to onboarding: 1. Set up user access in AAD and use a wizard to create a dedicated cloud instance for your network (known as “service onboarding”). -2. Add endpoints to the service with System Center Configuration Manager, scheduled GP updates, or manual +2. Add endpoints to the service with scheduled GP updates or manual registry changes (known as “endpoint onboarding”). ## In this section diff --git a/windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md b/windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md index 3f7ffc708a..92e31985a1 100644 --- a/windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md +++ b/windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Assign users to the Windows Defender ATP service application in Azu keywords: service onboarding, Windows Defender Advanced Threat Protection service onboarding search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl: deploy +ms.mktglfcycl: ms.sitesec: library author: mjcaparas --- @@ -12,7 +12,6 @@ author: mjcaparas # Windows Defender ATP service onboarding - Windows 10 Insider Preview -- Azure Active Directory [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] From 85687212b74da27673e240c24dfa0562993f2daa Mon Sep 17 00:00:00 2001 From: Iaan Date: Wed, 20 Apr 2016 15:52:26 +1000 Subject: [PATCH 043/439] upload --- ...ditional-configuration-windows-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md b/windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md index c5e38182d4..d611db439c 100644 --- a/windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md +++ b/windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Use the Group Policy Console to configure settings that enable samp keywords: configuration settings, Windows Defender ATP configuration settings, Windows Defender Advanced Threat Protection configuration settings, group policy Management Editor, computer configuration, policies, administrative templates, search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl: +ms.mktglfcycl: deploy ms.sitesec: library author: mjcaparas --- From fc32ce7f7f80fc8c2feb369c5441766d7c663ccc Mon Sep 17 00:00:00 2001 From: Iaan Date: Wed, 20 Apr 2016 15:58:08 +1000 Subject: [PATCH 044/439] updates --- ...ints-windows-advanced-threat-protection.md | 44 +++++++++---------- ...ows-defender-advanced-threat-protection.md | 2 +- ...ding-windows-advanced-threat-protection.md | 2 +- ...gure-windows-advanced-threat-protection.md | 8 ++-- ...ding-windows-advanced-threat-protection.md | 5 ++- 5 files changed, 31 insertions(+), 30 deletions(-) diff --git a/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md index 6cc137aa42..fa502c8b9f 100644 --- a/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Use Group Policy to deploy the configuration package or do manual r keywords: configure endpoints, client onboarding, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl: +ms.mktglfcycl: deploy ms.sitesec: library author: mjcaparas --- @@ -17,6 +17,27 @@ author: mjcaparas You can use a Group Policy (GP) configuration package or an automated script to configure endpoints. You can deploy the GP configuration package or script with a GP update, or manually through the command line. +## Configure with System Center Configuration Manager (SCCM) + +1. Open the SCCM configuration package .zip file (*WindowsATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://seville.windows.com): Naama: Confirm package name + + a. Click **Client onboarding** on the **Navigation pane**. + + b. Select **SCCM**, click **Download package**, and save the .zip file. Iaan: Need to confirm the UI for this + +2. Copy the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. + +Iaan: Will confirm ui for this + +3. In the SCCM console, go to **Software Library**. +4. Under **Application Management**, right-click **Packages** and select **Import**. +5. Click **Browse** and choose the package that was downloaded from the portal (zip file). +6. The package will appear under the Packages page. +7. Right-click the Package and choose deploy. +8. Choose a predefined device collection to deploy the package to. + +Naama note: If it’s a package we create then we’ll set the necessary privileges, otherwise provide guidance (Omri: what is the necessary privileges?) + ## Configure with Group Policy Using the GP configuration package ensures your endpoints will be correctly configured to report to the Windows Defender ATP service. @@ -46,27 +67,6 @@ Using the GP configuration package ensures your endpoints will be correctly conf For additional settings, see the [Additional configuration settings section](additional-configuration-windows-advanced-threat-protection.md). -## Configure with System Center Configuration Manager (SCCM) - -1. Open the SCCM configuration package .zip file (*WindowsATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://seville.windows.com): Naama: Confirm package name - - a. Click **Client onboarding** on the **Navigation pane**. - - b. Select **SCCM**, click **Download package**, and save the .zip file. Iaan: Need to confirm the UI for this - -2. Copy the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. - -Iaan: Will confirm ui for this - -3. In the SCCM console, go to **Software Library**. -4. Under **Application Management**, right-click **Packages** and select **Import**. -5. Click **Browse** and choose the package that was downloaded from the portal (zip file). -6. The package will appear under the Packages page. -7. Right-click the Package and choose deploy. -8. Choose a predefined device collection to deploy the package to. - -Naama note: If it’s a package we create then we’ll set the necessary privileges, otherwise provide guidance (Omri: what is the necessary privileges?) - ## Configure endpoints manually with registry changes You can also manually onboard individual endpoints to Windows Defender ATP. You might want to do this first when testing the service before you commit to onboarding all endpoints in your network. diff --git a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md index c483bf1efd..bf1d4c5eb8 100644 --- a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Minimum network and data storage configuration, endpoint hardware a keywords: minimum requirements, Windows Defender Advanced Threat Protection minimum requirements, network and data storage, endpoint, endpoint configuration, deployment channel search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl: +ms.mktglfcycl: deploy ms.sitesec: library --- diff --git a/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md b/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md index 0a95b9131a..d9c889806c 100644 --- a/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md +++ b/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Monitor the onboarding of the Windows Defender ATP service to ensur keywords: monitor onboarding, monitor Windows Defender ATP onboarding, monitor Windows Defender Advanced Threat Protection onboarding search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl: +ms.mktglfcycl: deploy ms.sitesec: library author: mjcaparas --- diff --git a/windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md b/windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md index 3d31d3693d..0dbde57476 100644 --- a/windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md +++ b/windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md @@ -6,10 +6,10 @@ search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: ms.sitesec: library -author: mjcaparas +author: iaanw --- -# Onboard endpoints and set up the Windows Defender ATP user access +# Onboard and set up Windows Defender Advanced Threat Protection **Applies to** @@ -24,14 +24,14 @@ There are two stages to onboarding: 1. Set up user access in AAD and use a wizard to create a dedicated cloud instance for your network (known as “service onboarding”). -2. Add endpoints to the service with scheduled GP updates or manual +2. Add endpoints to the service with System Center Configuration Manager, scheduled GP updates, or manual registry changes (known as “endpoint onboarding”). ## In this section Topic | Description :---|:--- [Windows Defender ATP service onboarding](service-onboarding-windows-advanced-threat-protection.md) | Learn about managing user access to the Windows Defender ATP portal by assigning users to the Windows Defender ATP service application in ADD. -[Configure Windows Defender ATP endpoints (client onboarding)](configure-endpoints-windows-advanced-threat-protection.md) | You'll need to configure endpoints for it to report to the Windows Defender ATP service. Learn how you can use the configuration package to configure endpoints in your enterprise. +[Configure Windows Defender ATP endpoints (endpoint onboarding)](configure-endpoints-windows-advanced-threat-protection.md) | You'll need to configure endpoints for it to report to the Windows Defender ATP service. Learn how you can use the configuration package to configure endpoints in your enterprise. [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-advanced-threat-protection.md) | Learn how you can monitor the onboarding to ensure your endpoints are correctly configured and are sending telemetry reports. [Additional Windows Defender ATP configuration settings](additional-configuration-windows-advanced-threat-protection.md) | This topic describes the steps you need to take to configure settings for sample sharing used in the deep analysis feature. [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) | This topic contains information on how you can resolve issues that might arise during onboarding. diff --git a/windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md b/windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md index 92e31985a1..fd231a6601 100644 --- a/windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md +++ b/windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md @@ -4,14 +4,15 @@ description: Assign users to the Windows Defender ATP service application in Azu keywords: service onboarding, Windows Defender Advanced Threat Protection service onboarding search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl: +ms.mktglfcycl: deploy ms.sitesec: library author: mjcaparas --- -# Windows Defender ATP service onboarding +# Windows Defender ATP service onboarding - Windows 10 Insider Preview +- Azure Active Directory [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] From 48a36ee74a873c914c4d0cac0ff40b3048b0343e Mon Sep 17 00:00:00 2001 From: jcaparas Date: Wed, 20 Apr 2016 16:16:41 +1000 Subject: [PATCH 045/439] Update TOC.md --- windows/keep-secure/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 87580f2f5d..a48fbf41a0 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -406,8 +406,8 @@ #### [Onboard endpoints and set up Windows Defender ATP user access](onboard-configure-windows-advanced-threat-protection.md) ##### [Windows Defender ATP service onboarding](service-onboarding-windows-advanced-threat-protection.md) ##### [Configure Windows Defender ATP endpoints (client onboarding)](configure-endpoints-windows-advanced-threat-protection.md) -##### [Monitor Windows Defender ATP onboarding](monitor-onboarding-windows-advanced-threat-protection.md) ##### [Additional Windows Defender ATP configuration settings](additional-configuration-windows-advanced-threat-protection.md) +##### [Monitor Windows Defender ATP onboarding](monitor-onboarding-windows-advanced-threat-protection.md) ##### [Troubleshoot Windows Defender ATP onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) #### [Windows Defender ATP data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) #### [Windows Defender ATP portal overview](portal-overview-windows-defender-advanced-threat-protection.md) From 9efe6c7e38df4e0d6e96aff3f9f550545f6412ce Mon Sep 17 00:00:00 2001 From: Iaan Date: Wed, 20 Apr 2016 16:22:07 +1000 Subject: [PATCH 046/439] update endpoint --- ...endpoints-windows-advanced-threat-protection.md | 3 +-- ...nboarding-windows-advanced-threat-protection.md | 14 +++++++------- 2 files changed, 8 insertions(+), 9 deletions(-) diff --git a/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md index fa502c8b9f..da95a7207d 100644 --- a/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md @@ -83,7 +83,7 @@ You can also manually onboard individual endpoints to Windows Defender ATP. You ![Window Start menu pointing to Run as administrator](images/run-as-admin.png) 3. Type the location of the script file. If you copied the file the - desktop, type:```*%userprofile%\Desktop\WindowsATPOnboardingScript.sc*``` + desktop, type: *```%userprofile%\Desktop\WindowsATPOnboardingScript.cmd```* 4. Press the **Enter** key or click **OK**. @@ -94,4 +94,3 @@ See the [Troubleshoot Windows Defender Advanced Threat Protection onboarding iss - [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-advanced-threat-protection.md) - [Additional Windows Defender ATP configuration settings](additional-configuration-windows-advanced-threat-protection.md) - [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) - diff --git a/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md b/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md index d9c889806c..749f5fe435 100644 --- a/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md +++ b/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md @@ -30,15 +30,15 @@ Monitoring can be done directly on the portal, or by using System Center Configu 3. Verify that endpoints are appearing. -> **Note**  It can take several days for endpoints to start showing on the **Machines view**. This includes the time it takes for the Group Policy (GP) update to be distributed to the endpoint, the time it takes before the user logs on or initiates a GP update, and the time it takes for the endpoint to start reporting to the portal. +> **Note**  It can take several days for endpoints to start showing on the **Machines view**. This includes the time it takes for the policies to be distributed to the endpoint, the time it takes before the user logs on, and the time it takes for the endpoint to start reporting. -## Monitoring with System Center Configuration Manager +## Monitor with System Center Configuration Manager Monitoring with SCCM consists of two parts: 1. Confirming the configuration package has been correctly deployed and is running (or has successfully run) on the endpoints in your network. -2. Checking that the endpoints are compliant with the Windows Defender ATP service (this ensures the endpoint can complete the onboarding process and can continue to report data to the service). +[[[2. Checking that the endpoints are compliant with the Windows Defender ATP service (this ensures the endpoint can complete the onboarding process and can continue to report data to the service).]] **To confirm the configuration package has been correctly deployed:** @@ -46,17 +46,17 @@ Monitoring with SCCM consists of two parts: 2. Click **Overview** and then **Deployments**. -3. Click on the deployment with the package name. What is the name of the deployment, will it always be the same for every user/installation? +3. Click on the deployment with the package name. What is the name of the deployment, will it always be the same for every user/installation? - it's chosen by the user 4. Review the status indicators under **Completion Statistics** and **Content Status**. If there are failed deployments (endpoints with **Error**, **Requirements Not Met**, or **Failed statuses**), you may need to troubleshoot the endpoints. See the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) topic for more information. -Naama: Is this a correct process for idendtifying/resolving issues? +Naama: Is this a correct process for idendtifying/resolving issues? YES! ![image](images/sccm-deployment.png) -**To check that your endpoints are compliant:** +[[**To check that your endpoints are compliant:** 1. Get the *compliance.cab* file from the SCCM configuration package .zip file (*WindowsATPOnboardingPackage.zip*) that you downloaded during the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://seville.windows.com): @@ -86,7 +86,7 @@ If there are failed deployments (endpoints with **Error**, **Requirements Not Me If there are non-compliant endpoints (endpoints with ?????), you may need to troubleshoot the endpoints. See the [Troubleshoot Windows Defender ATP onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) topic for more information. -Naama: Is this a correct process for resolving issues? +Naama: Is this a correct process for resolving issues?]]] ## Related topics - [Windows Defender ATP service onboarding](service-onboarding-windows-advanced-threat-protection.md) From 5b550528507a0a36ea73fe79034bd452a77ac59b Mon Sep 17 00:00:00 2001 From: Iaan Date: Wed, 20 Apr 2016 16:23:40 +1000 Subject: [PATCH 047/439] update endpoint --- ...ional-configuration-windows-advanced-threat-protection.md | 5 ----- 1 file changed, 5 deletions(-) diff --git a/windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md b/windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md index d611db439c..b11e25cc3c 100644 --- a/windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md +++ b/windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md @@ -37,11 +37,6 @@ You can use Group Policy (GP) to configure settings, such as settings for the sa 6. Choose to enable or disable sample sharing from your endpoints. -## Configure sample collection settings with Configuration Manager - -TBA - - ## Related topics - [Windows Defender ATP service onboarding](service-onboarding-windows-advanced-threat-protection.md) - [Configure Windows Defender ATP endpoints (client onboarding)](configure-endpoints-windows-advanced-threat-protection.md) From e1e5c7f734540da59680d0445a1c78882decf93b Mon Sep 17 00:00:00 2001 From: Iaan Wiltshire Date: Wed, 20 Apr 2016 16:31:05 +1000 Subject: [PATCH 048/439] Update minimum-requirements-windows-defender-advanced-threat-protection.md --- ...-requirements-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md index bf1d4c5eb8..b2b2d802d4 100644 --- a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Minimum network and data storage configuration, endpoint hardware a keywords: minimum requirements, Windows Defender Advanced Threat Protection minimum requirements, network and data storage, endpoint, endpoint configuration, deployment channel search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl: deploy +ms.mktglfcycl: ms.sitesec: library --- From 4f62a9eaae6a849a715535136afb6d7b84e957b9 Mon Sep 17 00:00:00 2001 From: Iaan Wiltshire Date: Wed, 20 Apr 2016 16:31:17 +1000 Subject: [PATCH 049/439] Update minimum-requirements-windows-defender-advanced-threat-protection.md --- ...-requirements-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md index b2b2d802d4..c483bf1efd 100644 --- a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Minimum network and data storage configuration, endpoint hardware a keywords: minimum requirements, Windows Defender Advanced Threat Protection minimum requirements, network and data storage, endpoint, endpoint configuration, deployment channel search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl: +ms.mktglfcycl: ms.sitesec: library --- From b25c245c0837fc9dad2163733cc8bc82e000b044 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 20 Apr 2016 16:58:41 +1000 Subject: [PATCH 050/439] fix deploy meta-tag spacing --- .../alerts-queue-windows-advanced-threat-protection.md | 2 +- .../keep-secure/dashboard-windows-advanced-threat-protection.md | 2 +- ...orage-privacy-windows-defender-advanced-threat-protection.md | 2 +- .../deep-analysis-windows-advanced-threat-protection.md | 2 +- .../investigate-alerts-windows-advanced-threat-protection.md | 2 +- .../machines-view-windows-advanced-threat-protection.md | 2 +- .../manage-alerts-windows-advanced-threat-protection.md | 2 +- ...-requirements-windows-defender-advanced-threat-protection.md | 2 +- ...rtal-overview-windows-defender-advanced-threat-protection.md | 2 +- .../settings-windows-defender-advanced-threat-protection.md | 2 +- .../troubleshoot-windows-defender-advanced-threat-protection.md | 2 +- .../use-windows-defender-advanced-threat-protection.md | 2 +- .../keep-secure/windows-defender-advanced-threat-protection.md | 2 +- 13 files changed, 13 insertions(+), 13 deletions(-) diff --git a/windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md b/windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md index f5652bafe1..1c40e5b7ac 100644 --- a/windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md +++ b/windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Learn about how the Windows Defender ATP alerts queue work, and how keywords: alerts, queues, alerts queue, sort, order, filter, manage alerts, new, in progress, resolved, newest, time in queue, severity, time period search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl:deploy +ms.mktglfcycl: deploy ms.sitesec: library --- diff --git a/windows/keep-secure/dashboard-windows-advanced-threat-protection.md b/windows/keep-secure/dashboard-windows-advanced-threat-protection.md index 6a79e9a363..4d303a37e9 100644 --- a/windows/keep-secure/dashboard-windows-advanced-threat-protection.md +++ b/windows/keep-secure/dashboard-windows-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Use the Dashboard to identify machines at risk, keep track of the s keywords: dashboard, alerts, new, in progress, resolved, risk, machines at risk, infections, reporting, statistics, charts, graphs, health, active threats, threat category, categories, password stealer, ransomware, exploit, threat, low severity, active malware search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl:deploy +ms.mktglfcycl: deploy ms.sitesec: library --- diff --git a/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md index 2bbf4d4002..7c69a1bfc1 100644 --- a/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Learn about how Windows Defender ATP handles privacy and data that keywords: Windows Defender ATP data storage and privacy, storage, privacy search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl:deploy +ms.mktglfcycl: deploy ms.sitesec: library author: DulceMV --- diff --git a/windows/keep-secure/deep-analysis-windows-advanced-threat-protection.md b/windows/keep-secure/deep-analysis-windows-advanced-threat-protection.md index 236929f516..ebb84e186d 100644 --- a/windows/keep-secure/deep-analysis-windows-advanced-threat-protection.md +++ b/windows/keep-secure/deep-analysis-windows-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Submit a file to the deep analysis feature to see a detailed report keywords: analysis, deep analysis, analyze, submit, submission, file, malware, threats, infection, executable, report, troubleshoot, sample, sample collection, behaviors, .exe, .dll, .scr search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl:deploy +ms.mktglfcycl: deploy ms.sitesec: library --- diff --git a/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md b/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md index 5265c474a9..74775e203d 100644 --- a/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Use the investigation options to get details on which alerts are af keywords: investigate, investigation, machines, machine, endpoints, endpoint, alerts queue, dashboard, IP address, file, submit, submissions, deep analysis, timeline, search, domain, URL, IP search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl:deploy +ms.mktglfcycl: deploy ms.sitesec: library --- diff --git a/windows/keep-secure/machines-view-windows-advanced-threat-protection.md b/windows/keep-secure/machines-view-windows-advanced-threat-protection.md index 9ced68d57c..8616d79e99 100644 --- a/windows/keep-secure/machines-view-windows-advanced-threat-protection.md +++ b/windows/keep-secure/machines-view-windows-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Investigate affected machines in your network by reviewing alerts, keywords: machines, endpoints, machine, endpoint, alerts queue, alerts, machine name, domain, last seen, internal IP, active alerts, active threats, threat category, filter, sort, review alerts, network, connection, malware, type, password stealer, ransomware, exploit, threat, low severity search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl:deploy +ms.mktglfcycl: deploy ms.sitesec: library --- diff --git a/windows/keep-secure/manage-alerts-windows-advanced-threat-protection.md b/windows/keep-secure/manage-alerts-windows-advanced-threat-protection.md index edb42090f5..8705baf569 100644 --- a/windows/keep-secure/manage-alerts-windows-advanced-threat-protection.md +++ b/windows/keep-secure/manage-alerts-windows-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Change the status of alerts, create suppression rules to hide alert keywords: manage alerts, manage, alerts, status, new, in progress, resolved, resolve alerts, suppress, supression, rules, context, history, comments, changes search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl:deploy +ms.mktglfcycl: deploy ms.sitesec: library --- diff --git a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md index 6d4b6f8d00..bf1d4c5eb8 100644 --- a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Minimum network and data storage configuration, endpoint hardware a keywords: minimum requirements, Windows Defender Advanced Threat Protection minimum requirements, network and data storage, endpoint, endpoint configuration, deployment channel search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl:deploy +ms.mktglfcycl: deploy ms.sitesec: library --- diff --git a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md index 2499d3bdef..deb8ee61cf 100644 --- a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Use the Windows Defender ATP portal to monitor your enterprise netw keywords: Windows Defender ATP portal, portal, cybersecurity threat intelligence, dashboard, alerts queue, machines view, preferences setup, client onboarding, advanced attacks search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl:deploy +ms.mktglfcycl: deploy ms.sitesec: library author: DulceMV --- diff --git a/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md b/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md index 86a75a445f..82d61d6548 100644 --- a/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Use the menu to configure the time zone, suppression rules, and vie keywords: Windows Defender ATP settings, Windows Defender, cybersecurity threat intelligence, advanced threat protection search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl:deploy +ms.mktglfcycl: deploy ms.sitesec: library author: DulceMV --- diff --git a/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md index bcd779a9df..c1185997cc 100644 --- a/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Find solutions and work arounds to known issues such as server erro keywords: troubleshoot Windows Defender Advanced Threat Protection, troubleshoot Windows ATP, server error, access denied, invalid credentials search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl:deploy +ms.mktglfcycl: deploy ms.sitesec: library author: mjcaparas --- diff --git a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md index d93f82b596..e96b671b46 100644 --- a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Learn about the features on Windows Defender ATP portal, including keywords: dashboard, alerts queue, manage alerts, investigation, investigate alerts, investigate machines, submit files, deep analysis, high, medium, low, severity, search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl:deploy +ms.mktglfcycl: deploy ms.sitesec: library --- diff --git a/windows/keep-secure/windows-defender-advanced-threat-protection.md b/windows/keep-secure/windows-defender-advanced-threat-protection.md index 4c5bb73ccd..3b5ec0f9ad 100644 --- a/windows/keep-secure/windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/windows-defender-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Windows Defender Advanced Threat Protection is an enterprise securi keywords: introduction to Windows Defender Advanced Threat Protection, introduction to Windows Defender ATP, cybersecurity, advanced persistent threat, enterprise security search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl:deploy +ms.mktglfcycl: deploy ms.sitesec: library author: mjcaparas --- From d80f101fd902f2a3dc6dc13ea240e580aed44cd4 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 20 Apr 2016 17:34:53 +1000 Subject: [PATCH 051/439] update min reqs for windef atp topic title --- windows/keep-secure/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index a48fbf41a0..a14fd1f89f 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -402,7 +402,7 @@ #### [How User Account Control works](how-user-account-control-works.md) #### [User Account Control security policy settings](user-account-control-security-policy-settings.md) ### [Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md) -#### [Minimum requirements for Windows Defender Advanced Threat Protection](minimum-requirements-windows-defender-advanced-threat-protection.md) +#### [Minimum requirements for Windows Defender ATP](minimum-requirements-windows-defender-advanced-threat-protection.md) #### [Onboard endpoints and set up Windows Defender ATP user access](onboard-configure-windows-advanced-threat-protection.md) ##### [Windows Defender ATP service onboarding](service-onboarding-windows-advanced-threat-protection.md) ##### [Configure Windows Defender ATP endpoints (client onboarding)](configure-endpoints-windows-advanced-threat-protection.md) From 2e51194ce1a912cfc5b8f240d7ca3f8c0bf7bab6 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 21 Apr 2016 10:09:18 +1000 Subject: [PATCH 052/439] add ms.mktglfcycl: deploy meta tag --- .../onboard-configure-windows-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md b/windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md index 0dbde57476..8de2f3704c 100644 --- a/windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md +++ b/windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md @@ -4,7 +4,7 @@ description: Set up user access in Azure Active Directory and use Group Policy o keywords: onboarding, windows defender advanced threat protection onboarding, windows atp onboarding search.product: eADQiWindows 10XVcnh ms.prod: W10 -ms.mktglfcycl: +ms.mktglfcycl: deploy ms.sitesec: library author: iaanw --- From f25ff721b184f39a769a6a0a17a6bd14f8039be6 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 21 Apr 2016 10:50:47 +1000 Subject: [PATCH 053/439] shortened windef-atp topic titles --- windows/keep-secure/TOC.md | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index a14fd1f89f..aad7f7eee5 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -402,22 +402,22 @@ #### [How User Account Control works](how-user-account-control-works.md) #### [User Account Control security policy settings](user-account-control-security-policy-settings.md) ### [Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md) -#### [Minimum requirements for Windows Defender ATP](minimum-requirements-windows-defender-advanced-threat-protection.md) -#### [Onboard endpoints and set up Windows Defender ATP user access](onboard-configure-windows-advanced-threat-protection.md) -##### [Windows Defender ATP service onboarding](service-onboarding-windows-advanced-threat-protection.md) -##### [Configure Windows Defender ATP endpoints (client onboarding)](configure-endpoints-windows-advanced-threat-protection.md) -##### [Additional Windows Defender ATP configuration settings](additional-configuration-windows-advanced-threat-protection.md) -##### [Monitor Windows Defender ATP onboarding](monitor-onboarding-windows-advanced-threat-protection.md) -##### [Troubleshoot Windows Defender ATP onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) -#### [Windows Defender ATP data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) -#### [Windows Defender ATP portal overview](portal-overview-windows-defender-advanced-threat-protection.md) +#### [Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md) +#### [Onboard endpoints and set up access](onboard-configure-windows-advanced-threat-protection.md) +##### [Service onboarding](service-onboarding-windows-advanced-threat-protection.md) +##### [Configure endpoints (client onboarding)](configure-endpoints-windows-advanced-threat-protection.md) +##### [Additional configuration settings](additional-configuration-windows-advanced-threat-protection.md) +##### [Monitor onboarding](monitor-onboarding-windows-advanced-threat-protection.md) +##### [Troubleshoot onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) +#### [Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) +#### [Portal overview](portal-overview-windows-defender-advanced-threat-protection.md) #### [Use Windows Defender ATP Portal](use-windows-defender-advanced-threat-protection.md) -##### [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-advanced-threat-protection.md) -##### [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-advanced-threat-protection.md) -##### [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-advanced-threat-protection.md) -##### [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-advanced-threat-protection.md) -##### [Submit files to the Windows Defender ATP Deep analysis feature](deep-analysis-windows-advanced-threat-protection.md) -##### [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-advanced-threat-protection.md) +##### [View the Dashboard](dashboard-windows-advanced-threat-protection.md) +##### [View and organize the Alerts queue](alerts-queue-windows-advanced-threat-protection.md) +##### [Investigate alerts](investigate-alerts-windows-advanced-threat-protection.md) +##### [Investigate machines](machines-view-windows-advanced-threat-protection.md) +##### [Submit files to the Deep analysis feature](deep-analysis-windows-advanced-threat-protection.md) +##### [Manage alerts](manage-alerts-windows-advanced-threat-protection.md) #### [Windows Defender ATP settings](settings-windows-defender-advanced-threat-protection.md) #### [Troubleshoot Windows Defender ATP](troubleshoot-windows-defender-advanced-threat-protection.md) ### [Windows Defender in Windows 10](windows-defender-in-windows-10.md) From e37d4f86d119ef356abb8f472a76e02ca2d337c3 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 21 Apr 2016 11:43:49 +1000 Subject: [PATCH 054/439] update TOC.md with windef topic names, update topic names in In this section --- windows/keep-secure/TOC.md | 4 ++-- ...rd-configure-windows-advanced-threat-protection.md | 10 +++++----- ...use-windows-defender-advanced-threat-protection.md | 11 ++++++----- .../windows-defender-advanced-threat-protection.md | 7 ++++--- 4 files changed, 17 insertions(+), 15 deletions(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index aad7f7eee5..3e56e7babc 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -405,13 +405,13 @@ #### [Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md) #### [Onboard endpoints and set up access](onboard-configure-windows-advanced-threat-protection.md) ##### [Service onboarding](service-onboarding-windows-advanced-threat-protection.md) -##### [Configure endpoints (client onboarding)](configure-endpoints-windows-advanced-threat-protection.md) +##### [Configure endpoints](configure-endpoints-windows-advanced-threat-protection.md) ##### [Additional configuration settings](additional-configuration-windows-advanced-threat-protection.md) ##### [Monitor onboarding](monitor-onboarding-windows-advanced-threat-protection.md) ##### [Troubleshoot onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) #### [Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) #### [Portal overview](portal-overview-windows-defender-advanced-threat-protection.md) -#### [Use Windows Defender ATP Portal](use-windows-defender-advanced-threat-protection.md) +#### [Use the Windows Defender ATP portal](use-windows-defender-advanced-threat-protection.md) ##### [View the Dashboard](dashboard-windows-advanced-threat-protection.md) ##### [View and organize the Alerts queue](alerts-queue-windows-advanced-threat-protection.md) ##### [Investigate alerts](investigate-alerts-windows-advanced-threat-protection.md) diff --git a/windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md b/windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md index 8de2f3704c..e33d88a10e 100644 --- a/windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md +++ b/windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md @@ -30,8 +30,8 @@ There are two stages to onboarding: ## In this section Topic | Description :---|:--- -[Windows Defender ATP service onboarding](service-onboarding-windows-advanced-threat-protection.md) | Learn about managing user access to the Windows Defender ATP portal by assigning users to the Windows Defender ATP service application in ADD. -[Configure Windows Defender ATP endpoints (endpoint onboarding)](configure-endpoints-windows-advanced-threat-protection.md) | You'll need to configure endpoints for it to report to the Windows Defender ATP service. Learn how you can use the configuration package to configure endpoints in your enterprise. -[Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-advanced-threat-protection.md) | Learn how you can monitor the onboarding to ensure your endpoints are correctly configured and are sending telemetry reports. -[Additional Windows Defender ATP configuration settings](additional-configuration-windows-advanced-threat-protection.md) | This topic describes the steps you need to take to configure settings for sample sharing used in the deep analysis feature. -[Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) | This topic contains information on how you can resolve issues that might arise during onboarding. +[Service onboarding](service-onboarding-windows-advanced-threat-protection.md) | Learn about managing user access to the Windows Defender ATP portal by assigning users to the Windows Defender ATP service application in Azure Active Directory (AAD). +[Configure endpoints](configure-endpoints-windows-advanced-threat-protection.md) | You'll need to configure endpoints for it to report to the Windows Defender ATP service. Learn how you can use the configuration package to configure endpoints in your enterprise. +[Additional configuration settings](additional-configuration-windows-advanced-threat-protection.md) | Learn how to configure settings for sample sharing used in the deep analysis feature. +[Monitor onboarding](monitor-onboarding-windows-advanced-threat-protection.md) | Learn how you can monitor the onboarding to ensure your endpoints are correctly configured and are sending telemetry reports. +[Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) | Learn about resolving issues that might arise during onboarding. diff --git a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md index e96b671b46..5aa2a35a19 100644 --- a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md @@ -51,9 +51,10 @@ Low (Yellow) | Threats associated with prevalent malware and hack-tools that pos Topic | Description :---|:--- -[View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-advanced-threat-protection.md) | The **Dashboard** provides a snapshot of your network. You can view aggregates of alerts, the overall status of the service of the endpoints on your network, investigate machines, files, and URLs, and see snapshots of threats seen on machines. -[View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-advanced-threat-protection.md) | You can sort and filter alerts across your network, and drill down on individual alert queues. -[Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-advanced-threat-protection.md) | The **Manage Alert** menu on every alert lets you change an alert's status, resolve it, suppress it, or contribute comments about the alert. -[Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-advanced-threat-protection.md) | The **Machines view** shows a list of the machines in your network, the corresponding number of active alerts for each machine categorized by alert severity levels, as well as the number of threats. -[Submit files to the Windows Defender ATP Deep analysis feature](deep-analysis-windows-advanced-threat-protection.md) | You can submit files for deep analysis to see detailed information about the file’s activities, observed behaviors, and associated artifacts (such as dropped files, registry modifications, and communications with IPs). +[View the Dashboard](dashboard-windows-advanced-threat-protection.md) | The Windows Defender ATP **Dashboard** provides a snapshot of your network. You can view aggregates of alerts, the overall status of the service of the endpoints on your network, investigate machines, files, and URLs, and see snapshots of threats seen on machines. +[View and organize the Alerts queue](alerts-queue-windows-advanced-threat-protection.md) | You can sort and filter alerts across your network, and drill down on individual alert queues such as new, in progress, or resolved queues. +[Investigate alerts](investigate-alerts-windows-advanced-threat-protection.md) Investigate alerts in Windows Defender ATP which might indicate possible security breaches on endpoints in your organization. +[Investigate machines](machines-view-windows-advanced-threat-protection.md) | The **Machines view** shows a list of the machines in your network, the corresponding number of active alerts for each machine categorized by alert severity levels, as well as the number of threats. +[Submit files to the Deep analysis feature](deep-analysis-windows-advanced-threat-protection.md) | You can submit files for deep analysis to see detailed information about the file’s activities, observed behaviors, and associated artifacts (such as dropped files, registry modifications, and communications with IPs). +[Manage alerts](manage-alerts-windows-advanced-threat-protection.md) | The **Manage Alert** menu on every alert lets you change an alert's status, resolve it, suppress it, or contribute comments about the alert. diff --git a/windows/keep-secure/windows-defender-advanced-threat-protection.md b/windows/keep-secure/windows-defender-advanced-threat-protection.md index 3b5ec0f9ad..3d3ba2c66c 100644 --- a/windows/keep-secure/windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/windows-defender-advanced-threat-protection.md @@ -76,9 +76,10 @@ detect sophisticated cyber-attacks, providing: Topic | Description :---|:--- -[Minimum requirements for Windows Defender ATP](minimum-requirements-windows-defender-advanced-threat-protection.md) | This overview topic for IT professionals provides information on the minimum requirements to use Windows Defender Advanced Threat Protection such as network and data storage configuration, and endpoint hardware ans software requirements, and deployment channels. -[Onboard endpoints and set up the Windows Defender ATP user access](onboard-configure-windows-advanced-threat-protection.md) | You'll need to onboard and configure the service and the endpoints in your network before you can use the service. Learn about how you can assign users to the Windows Defender ATP Service in ADD and using a configuration package to configure endpoints. -[Windows Defender Advanced Threat Protection portal overview](portal-overview-windows-defender-advanced-threat-protection.md) | Understand the main features of the service and how it leverages Microsoft technology to protect enterprise endpoints from sophisticated cyber attacks. +[Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md) | This overview topic for IT professionals provides information on the minimum requirements to use Windows Defender Advanced Threat Protection such as network and data storage configuration, and endpoint hardware ans software requirements, and deployment channels. +[Onboard endpoints and set up access](onboard-configure-windows-advanced-threat-protection.md) | You'll need to onboard and configure the Windows Defender ATP service and the endpoints in your network before you can use the service. Learn about how you can assign users to the Windows Defender ATP service in Azure Active Directory (AAD) and using a configuration package to configure endpoints. +[Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) Learn about how Windows Defender ATP collects and handles information and where data is stored. +[Portal overview](portal-overview-windows-defender-advanced-threat-protection.md) | Understand the main features of the service and how it leverages Microsoft technology to protect enterprise endpoints from sophisticated cyber attacks. [Use the Windows Defender Advanced Threat Protection portal](use-windows-defender-advanced-threat-protection.md) | Learn about the capabilities of Windows Defender ATP to help you investigate alerts that might be indicators of possible breaches in your enterprise. [Windows Defender Advanced Threat Protection settings](settings-windows-defender-advanced-threat-protection.md) | Learn about setting the time zone and configuring the suppression rules to configure the service to your requirements. [Troubleshoot Windows Defender Advanced Threat Protection](troubleshoot-windows-defender-advanced-threat-protection.md) | This topic contains information to help IT Pros find workarounds for the known issues and troubleshoot issues in Windows Defender ATP. From 01a03ea3b7385609271802e1f10b067f2e07c0ae Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 21 Apr 2016 11:56:12 +1000 Subject: [PATCH 055/439] remove (client onboarding) from links --- ...ditional-configuration-windows-advanced-threat-protection.md | 2 +- .../monitor-onboarding-windows-advanced-threat-protection.md | 2 +- ...roubleshoot-onboarding-windows-advanced-threat-protection.md | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md b/windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md index b11e25cc3c..03ea882d31 100644 --- a/windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md +++ b/windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md @@ -39,6 +39,6 @@ You can use Group Policy (GP) to configure settings, such as settings for the sa ## Related topics - [Windows Defender ATP service onboarding](service-onboarding-windows-advanced-threat-protection.md) -- [Configure Windows Defender ATP endpoints (client onboarding)](configure-endpoints-windows-advanced-threat-protection.md) +- [Configure Windows Defender ATP endpoints](configure-endpoints-windows-advanced-threat-protection.md) - [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-advanced-threat-protection.md) - [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) diff --git a/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md b/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md index 749f5fe435..a55054b960 100644 --- a/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md +++ b/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md @@ -90,6 +90,6 @@ If there are non-compliant endpoints (endpoints with ?????), you may need to tro ## Related topics - [Windows Defender ATP service onboarding](service-onboarding-windows-advanced-threat-protection.md) -- [Configure Windows Defender ATP endpoints (client onboarding)](configure-endpoints-windows-advanced-threat-protection.md) +- [Configure Windows Defender ATP endpoints](configure-endpoints-windows-advanced-threat-protection.md) - [Additional Windows Defender ATP configuration settings](additional-configuration-windows-advanced-threat-protection.md) - [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-advanced-threat-protection.md index 4cce488c83..e7d7577f4f 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-advanced-threat-protection.md @@ -96,6 +96,6 @@ Windows Advanced Threat Protection Service failed to persist onboarding informat ## Related topics - [Windows Defender ATP service onboarding](service-onboarding-windows-advanced-threat-protection.md) -- [Configure Windows Defender ATP endpoints (client onboarding)](configure-endpoints-windows-advanced-threat-protection.md) +- [Configure Windows Defender ATP endpoints](configure-endpoints-windows-advanced-threat-protection.md) - [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-advanced-threat-protection.md) - [Additional Windows Defender ATP configuration settings](additional-configuration-windows-advanced-threat-protection.md) From 3639add274f61e8e3441f77d4d7c071864dd0907 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 21 Apr 2016 11:57:25 +1000 Subject: [PATCH 056/439] remove (client onbording) from title --- .../configure-endpoints-windows-advanced-threat-protection.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md index da95a7207d..68c3ac1e2a 100644 --- a/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md @@ -1,5 +1,5 @@ --- -title: Configure Windows Defender ATP endpoints (client onboarding) +title: Configure Windows Defender ATP endpoints description: Use Group Policy to deploy the configuration package or do manual registry changes on endpoints so that they are onboarded to the service. keywords: configure endpoints, client onboarding, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints search.product: eADQiWindows 10XVcnh @@ -9,7 +9,7 @@ ms.sitesec: library author: mjcaparas --- -# Configure Windows Defender ATP endpoints (client onboarding) +# Configure Windows Defender ATP endpoints - Windows 10 Insider Preview From 51eca089e1861ac9112b1b89916c690fbe399e65 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 21 Apr 2016 12:45:11 +1000 Subject: [PATCH 057/439] update link in In this section --- .../onboard-configure-windows-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md b/windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md index e33d88a10e..98d3c0a7cf 100644 --- a/windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md +++ b/windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md @@ -34,4 +34,4 @@ Topic | Description [Configure endpoints](configure-endpoints-windows-advanced-threat-protection.md) | You'll need to configure endpoints for it to report to the Windows Defender ATP service. Learn how you can use the configuration package to configure endpoints in your enterprise. [Additional configuration settings](additional-configuration-windows-advanced-threat-protection.md) | Learn how to configure settings for sample sharing used in the deep analysis feature. [Monitor onboarding](monitor-onboarding-windows-advanced-threat-protection.md) | Learn how you can monitor the onboarding to ensure your endpoints are correctly configured and are sending telemetry reports. -[Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) | Learn about resolving issues that might arise during onboarding. +[Troubleshoot onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) | Learn about resolving issues that might arise during onboarding. From 8c88848e5c4ffb2ed8753890af70419bbf061d97 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 21 Apr 2016 12:46:58 +1000 Subject: [PATCH 058/439] fix table --- .../windows-defender-advanced-threat-protection.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/keep-secure/windows-defender-advanced-threat-protection.md b/windows/keep-secure/windows-defender-advanced-threat-protection.md index 3d3ba2c66c..df2d8af280 100644 --- a/windows/keep-secure/windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/windows-defender-advanced-threat-protection.md @@ -78,8 +78,8 @@ Topic | Description :---|:--- [Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md) | This overview topic for IT professionals provides information on the minimum requirements to use Windows Defender Advanced Threat Protection such as network and data storage configuration, and endpoint hardware ans software requirements, and deployment channels. [Onboard endpoints and set up access](onboard-configure-windows-advanced-threat-protection.md) | You'll need to onboard and configure the Windows Defender ATP service and the endpoints in your network before you can use the service. Learn about how you can assign users to the Windows Defender ATP service in Azure Active Directory (AAD) and using a configuration package to configure endpoints. -[Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) Learn about how Windows Defender ATP collects and handles information and where data is stored. -[Portal overview](portal-overview-windows-defender-advanced-threat-protection.md) | Understand the main features of the service and how it leverages Microsoft technology to protect enterprise endpoints from sophisticated cyber attacks. -[Use the Windows Defender Advanced Threat Protection portal](use-windows-defender-advanced-threat-protection.md) | Learn about the capabilities of Windows Defender ATP to help you investigate alerts that might be indicators of possible breaches in your enterprise. -[Windows Defender Advanced Threat Protection settings](settings-windows-defender-advanced-threat-protection.md) | Learn about setting the time zone and configuring the suppression rules to configure the service to your requirements. +[Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) Learn about how Windows Defender ATP collects and handles information and where data is stored.| +[Portal overview](portal-overview-windows-defender-advanced-threat-protection.md) | Understand the main features of the service and how it leverages Microsoft technology to protect enterprise endpoints from sophisticated cyber attacks.| +[Use the Windows Defender Advanced Threat Protection portal](use-windows-defender-advanced-threat-protection.md) | Learn about the capabilities of Windows Defender ATP to help you investigate alerts that might be indicators of possible breaches in your enterprise.| +[Windows Defender Advanced Threat Protection settings](settings-windows-defender-advanced-threat-protection.md) | Learn about setting the time zone and configuring the suppression rules to configure the service to your requirements. | [Troubleshoot Windows Defender Advanced Threat Protection](troubleshoot-windows-defender-advanced-threat-protection.md) | This topic contains information to help IT Pros find workarounds for the known issues and troubleshoot issues in Windows Defender ATP. From 5a8732f5b17807b9a35497a21afe7c17ed287d75 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 22 Apr 2016 12:48:02 +1000 Subject: [PATCH 059/439] remove "endpoint onboarding" feedback from Naama --- .../onboard-configure-windows-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md b/windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md index 98d3c0a7cf..4c671eaabf 100644 --- a/windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md +++ b/windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md @@ -25,7 +25,7 @@ There are two stages to onboarding: cloud instance for your network (known as “service onboarding”). 2. Add endpoints to the service with System Center Configuration Manager, scheduled GP updates, or manual - registry changes (known as “endpoint onboarding”). + registry changes. ## In this section Topic | Description From 8d80163209c2eb43f7632475c9879a15a336f25b Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 22 Apr 2016 15:00:01 +1000 Subject: [PATCH 060/439] update image to reflect active malware detection tile reflect new tile name "active malware detections" --- windows/keep-secure/images/portal.png | Bin 563593 -> 400929 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/keep-secure/images/portal.png b/windows/keep-secure/images/portal.png index 965f8cff0d3787fb1af4987da351429d6e7150d0..7bc1d56ed367ede6ce4c468a5de5047cd8bfa30d 100644 GIT binary patch literal 400929 zcmYgY1zc3y*PR(y6AK)OMsQBui4K{^x=kOt|LkPhiaq@@v1T0lfXT2i`81f)y4 zzBBK=|9c-lpZf0HIQN{r*IsMwGlr=uKe~ZSi3@>1Zph1_)FBW|O9%wxCISYIgf}fB zz#ljcayrfs2*W7)KPWu?QwBJQ?IN!vi@g9RgNtDjRekLK>yWIri_}Y(7xqq&qS9VD za0uT89735nn>blIxLDfTK}c{In80yd^l=$`2M;Gpix)1CkA%IV;3&agN1e=!(5KS7 zSlXIF?i~~2fKPDHpJ>>dySN!SnL+d&uFJEaHMi zXriLx_T=SDuH*FjxKPR4`ES%8gWn+dNW+C@EC>Y>CdCMertmYvki@4bztY!@5iKKt zRQTP(GF-ZTu0sweZy;_Mr^@>KQuXO5t2{eHQ3ZF%mx{qIajam51&6e0CAqo87ZAIra>k-1^m=|u4)<|G!l!|N zf37vFP@#rEz8NL>UlxRjyC1Ne3*oA+wHv|>DVEYiZ1mVMI^3R56vSkWG~HUekB6Q& zaOJXmeibA)RT`-c`-tFZrEiY)Whv*H#if9>X_CNqC!ta+IJ}5xe3vea>e(Nz*#BI1 zQ*-_F)=zpy7_W8^qoy-9C$G=Xj&ApGT@^Vv+`p`a1@UC%IYNNDtHbt()${7h|E_!z zXRFklE~@-7l&>S-<^Z$vAvGf&Zy+26X~_Qr<@-j@B22_++>GG-CdcBvfN_`6);6n# zXUgN@Ka0&FCm1azDamXq37Pbg3QBhtERDA7!WS;e+8kJ~ufJv{n|Fl1)ZnbmPy)wDX&OcN9qEULDTaCc?78aG z7&Ld({&_tJ;x*gE=IJzxMRQcOm9H?9v zg8L=|)y?h&^|or0Bf8xvdna3(P{}y|dp<@vRh<8SjKz26y`>Py@;qe7*o~w7q*t}o zW#nn7*g{PwOVj;_HLj#0tYnUmeL?A;pOeXO>kvh@o3EqQ>k9gjI(rGcnnUDMW>U6n z|34R;d12AX@*goP5Ew0-x2FUtv^X7yrhW))jn_U<;TCLnl76CFi`73_IHIm1Fs% zEccZ6Pllrp2C@SW<-)tpQYfY1GKoYt{JKeTVSdoS?mS$4vOI#0tT#FN-W?&)t7BvD zY*ZD8f{0`p@r^<;I4#RCLE!$IVbBSRf`sJH{AD@vac_H;na$pGx6Cj^(%x(Eyq8l! zqy|@DPc&lEj&QPU%@D8IBFjhaHr$ zH;FN#I=)nRhS?c$s;)GWN~luW+&!Osc}8XSE+-(ll`PnR_zMZRwbj5 zBEZLkE@vo2_2q9enlKRXwu~XO?{QE*h7w^X1!xdse}8>Sd)G0mhE7+kIOLy1Z`gU6 z%E=(`5+)F+gW@>29eQE_{pG|*(Jx}eozw%-o~U4gy}zAarG`Q=oJ@U&cYo{?Ddk3v z4wBTEZ)4@p(WHv0{xjcpC`gd0KjDf{beJ5RC{!Eim#0_bi0VL%RXP*tC@{lFI(dUL z6ox;g68uglr6>4sAgvo%Lg%YiCHy+BX~Qm`yAD|Z|1VYp#9KtL1Obz ze}7&K!xi@Mj}?rSjySXXFcfO4U(&YhznMy-&&c)6L`ZhgP?&HLsflN@nJ~*sn!@E~ z1ymlq98r5zp#n$d2)p)Yr-t!%G;31voUlaD{~~=e#cla-J_}m+cw;k~e1qXZxRn&z zk2>jmehFBl*ZEwYso!QW@lt`ClpM^GafrZNl*mF~=WMj{s>)ET2`sUj$p=4oXYvCzI zb;i)Ypg5|uT7$(<%$Cz_V$vdDNQNLf+^9NeH@MnoA%9LP8#h4Xhv0=rSn=m51Y}h< zD^=V5Km|nq4w^^H~KE++PYC3$Xm0qa`7cvzoaWe2S1r1Ddd+k0>hk z!mY^u!NPx*8!FS=(Pz%Xw1*G9=vx1s3g-+tpo^s?RzN3gnN{CJ3MC6?{M`A_h` zI1aDBRvgW<-H;r8jt`&z?MD+N)$+;F5XQJK5ygk1%G|2NB{MfC=p$=Gc!gj>kj8ws zA;f)@gS4jNHr!$6;p%&U zyWhmwATfj=7WgAv3N=k#xE22Y?s9?*TR11z3}K=tEAFi}Y_lMNL(adGe+Z-u>VWG? zhK6zCe?vr;8^!uvK%yRA;N#_a0Ddv}Zz|n9`2)qkUwU*`(N8myuCtlg*aSaRvKP)~ zEX6tN$z}ud4}xejU>i>aagm7NX%3N?Qs2UOk%U>@@E@6iLZCxMwt|89B$7686r9ha zQ|zTnR{jmnYBefqNjQI^ko_qego5}x5!0Haf_0hk?Hvk8!Vay`+{eWL^_?4iH2>po z58-~8aMd=X9NdW5Ayry0=F``stMehY%mry%U6C;7F%b)?@?h;`WSsnKE_S1&n4dv3 z)DhVe6G1d>&Dz1$%byr--_RMxm50N_X?P2 zo1w3#svo@iIyV?cDpsf&EF&JBa?7D#Ao&gpMYta+L^5c7$tkA1Qns13)8I&Hn z#yj#&&e}RbuaqusZD>pCk%Hzl$-m>*e4RP(*A*cAS|QAY9~N4%u{5*cx%utVjZAq# zyG=5ZVqXX2JAT58NS!KkB~n?&pXndU%3^ZZ<>RFpI^!YmFy_QAVyc|8begZ$e9^H;PPbSG2mFNn$LjFzY;;P4O{fo8i;ZsX9C(Z+Xw%SdvmhU`-pf)1|WBFQo8OJEd zh|H0*9!pVg88`*Im1x~|V;>wDuAJhl&3p$o z)aF0+?!~`Q&w&p$4E5{6MJ2Z()uK6%=PdOf>GJWvD7>B2v;2nsZD<#zV{h!lLuFwu zHvH3rpY5jj+KQ%b@0?I38X7iCotE4%90Z?0t6XV;>Tk8AvYo-)0`8hIq>e->qg445 zXCd~(?f=*UCO*Vi(lnH@hMu3^+VE%Lk6H<#KkQ`V%emBvaAF*42oVFLNu-gonCOs` zM?Q;n)U}3ZS#X}pj-I~0e!4=BEF(W@96~o+uYY7@Qu^D-XosVXq~_Y)y}508{+FSD zS;>~q1Uy2A}>#BKjDj$B%1`Jp-5>gwutqGXa) zYNFB6m9x!}b=0;*HAas!U<=Ms-u?fu^yJqbk+ z1zjw4kKpjCYZz!)*?#!&;Z9 zViM!k*zr(}TZ=aiQw*Z4&byqGs>hAJq=@>p>Y{3Op8IbY7t@nui$2V*HnrtsR3qhk z@96!YZNiJWO&Wq9HgGQ#0o_dZW9P1_sDRKj$`qOKtEJx=85tWN8G-P2P?(^CL~b&e zFq(8tecpKcf>_E{<-f|3CX0d;>e|q;n*C|G2|gl++s^DWiHsCvdcq(^X`B>{wKMpZ zcc#pCcCiimTai~G|=K{p5R>j z5Ax03(PhtUTFVp^5;I8}xA9PWY+LI(Og8+}+}1 z5C6WG4-Cz(o$^si0D z?|t`eXv?GjYgXzfddOQNdbl7nk_m3JK9&7<)jm6(`Za?sjt8OWxvh?^e0hMn@`&KZ ze91`6U>-`b!Y&VljC@^x(mE9SiaEc-simrA5uCUQvSpZq9_ncIU?Cr%Aq0u^%B>uS zHQEZ?M#$`v+^xy?cw8Gcq>k~im_$nwdHJ}|5CISML*Ot)FH(n+DD2IhXYKf@Q?D|nePNE? zFH*RSQ!$2+!J3&VdA?rTE)plvC=DCnUz(T`j6b}lzxd8$g+~(V`fMe7d@`5;OZ=-v zQVVN9lSI8?$3{ML@$K@epVUE7O1I5p{V8}MtQ3NZk}OLINI_}_>adMX(hweuW2{b$ z;>MO_SCXeE!VhDHd`$RiZ6L5ZX*wHE$^A?oxdd_U?gMW4NL`$X2mk`U2j*o@R6jwKv!=a<5lv>^sa zkjMO0{N;xTnus}f6PY4YXGa2xMulrE6DmJSYa8Z=_zYN~@{s6Te)3#=(4Y9B)RE13 zMYn%Fi{!-OTAQrRFO3cwb{b6XD#J?^oA7^)@wo?1&G?fi5cMl2!6DA2|Mb2zb!YEp z{lp2grgqE9K8C^d*|^*18K^@3ZKMEx9it7^Vw!~KiM_zMO{k|%7z)lT-EnNjOAn(m zij9>l92(D>qG>*SZa)U1B3c+$n|is6XHML$)9>`KpEqf`~-29{~xVU=>8pyVAeT%L*#IC$CGaWvo2(MsKRBpumD5 zll<)`P4-`r6iji*WD4dA49R}UkMhH$v0tO`2-I{HxHApbX8H)lcNeB=UYZ(y_Y*03 z`V5Aw;$tT=h%0h^q1%;nW+P3Jn0qdu+ePzruY*eLX(lE#nIn)=8v}~>5n|mlLV5Vi z-i<6w^6Jk42H^>cQBEBL8`c^WjhlEMb}LiNk2j8jw-up-#2{!PBZAa02R!D65g5ku z#XFVKZlc_tn+X20Jc^XRkXlhuQiiu1TU&2e0|A_$#Ucsp#d z+VAtC|EC~5G@Y>j_VjOeleTTI4fDXDML)gL4k=EYA$YX+?`6-sT39+vv8Io&$dnE7 zV{^!a9o}~^u`2P8Acb~h6F`bF@9hCkT$6ob_>2YiLNJB@hS&` zYVD13VrlNU`SDWb>}daj!z_(8xrnULSP1i7^m+HLoj&d zt-Ji8I{c14*$TL{8Z1x5gEV^F4~l#&7ZBV{t0h%}7bY zTMeO3L6yy>fnG(NP#+uu0$zMbl;nW1hjjKB@=*tFb3aiWUkg6jR@#C1xHofvQh(c^ z*^AcAgzN+9B+Ro9`8&nP=Ra81%H_qLZZ{J?l1|yA)_DVEuvSFz?gl2spUmNOJX>Y* zggyzO>N3TO+L>AyCVI%BM2tX&ODfX0+8AD>r8NI4Q%9j-7}jtFL91OR_g~}satKllrTpHA&N)>NaP3{;an*uJJv!EEN@OS5MniX%;@g_|O!f1vdZsnFliWVeK%21$ z=wpqbHp~!=XvG#B4VV$*MzKr=Y%`5U#9`Hv)N2~kKU6h83UZDuEscegIP(uQ;)Om8 zYBmfYLL_&szNX(KPY9PW6C^8*F8bREo#gu} za1n@VU7TINUj4kER(|5%To?2WpMnBfVPc|KIJw2&E{3t`wPR-8r2~CT6Q>Z#U{29pLPB4AOf zU18iBe1nFD#^-a}=8!Z->2?nL)Swgg74=O&BSd+kpmc%L%31F{A_~}|)uja9wNGge#5KYTFapm z{Gq~dezCjQdOYJiaCtOcR#a3}P|#sOk>T8tEF7(nAJ4}cp3_PoX0tYw52nZGXwqWd zeJQHidOSyT*!Eacnq2Jpc9y6BEX*&xnHb_I?Z?2IeE9}9QG_TgXp$kEfl<6Ywjh*~ zf)}e4p9=bu&G@E~@C1Te{`{cdhj(t|HMWc*)^1=frLRq>iX88b-+S+4 zZi{D@=(R8E!&!z)EGJ)|&e_Gk5^4xElU0^74928p3a+@_E{U&k3vYH@;Eep74C^Xe zbBf^H5($S9hwhmSo@S1wx3V(cH8|F$nV^BWGL}31{8+8NHm>(w+{Vt~CD(%{ds9OD zYvJh!-=1w8z)+g(qy)kXeoWEA#y_&89I4-1u9IN*+LS282ZcJ-Q46@axM*8Hil!DZ z?TYn2nq1AizF1Y@Y53E9r;OK`RJPGA(Ah5G2DK{9f^(-)@ij-2`NOxoJ{Pd&lL`W_ z(1A!{gTN7nmt!boKvYRZIT>WxYJnoUq{5JoG_JZMxl22M0`HpNh>bp&PMZiK3HL8D zXRlGT5B!@@Hh40B5@wb7lEM=!FcIV8w~h=;6zof+?=dA)>@l_8anX%#0 zS38@DxUU}hjAlN?$71sjo7o6Zd5w)%pN5si_S#6W328Uen6<6Fec{%&b$UlT`%E;y z4o-!mr>Cc(_|(F?t#ntrYwt6~-FFQo=mS)!=>=981)~{oH{I(nBo&tpSRO58M*1Pj zCE?-za)!5_vNMvf;k34?mA*|NEsD_Adqi}b$?*+89Bz_M@7Tf_&?e8(+nX*LiXnnD zEJ>D&+_S`pe-o?C>{HoMGIw@-a9sWUY3Sdt`SMsf@#cp>+7shirUVKnQ|eehjnEIh ziv$?j%>lM%axSdpL5kAv<=(Y6DJnzh5l@)nyUY4xJ}h+VE8r8iPWt~~PAgIsqn+>I zxIbZAJKHa|^OewR0mJ+J2s3tI)q6K{U^R?AJm>7}j6EFGzmpHnrK;>GHPaICLnGq! zE2;5MK7&kfR%+rz08QC|v>Z8t?+Fh9{N$ZN3lhr5aT%R%R-qmpm8&kzITrsWqp!V} zhO-4Hh!g&{jlz+eg`~n{qn-^(9muF_tP#B-`Ls&L&W1e}+d2eKNOx5Z} zgu=&ciZKx_^G??2{d+ynOf8Kc7d#J=grDHQ-aEMWweP^oc~LZ_-=TPdeO+-+;d&sjiw}{*5D{QiK};>+m@D=QZEHV z9HO=OiFVeoeR(u1gQ;XybS_A*9!-bG|5%r zn3lC|pK)y^{+Rdn7a{Klb5rA;zeny*R>;>q>pI@}Fd}*;g)4}4HDk%?TCOR^uXXn5 zT+8;tpt>la*)6qnL=yLW<@-ZqU9aKBe)Ol??&AbDC3zRMp*e*`Mc-o_W21I22iU_Q zya(L%o0Z3No~urEV`F2|*~rel?!-G51MeD)TCpVbjHx?;MuM-Ky)0G$=~4}VdI=%ofQWxdIK z8t;{Dt*v`j4=hs)EK_@yFCgI^$x?w>_k@H7(u7n{7s(O&n})4BM1so0a#WqSZ^B4| zB4deQp^`8o;$Vio8#me{2%G&8rd`b}q4>*;{4+%xL%dxU`J5qL~r|p zi^DNp`^(7zpSSu>f_D~U`paWCm$(Tpq|#@=ZpouZja)|Af4MQq z;-=$yl(M(fd3|-<)O7MQBA0!C<3{GEo@t>vQ(r+w0eAT%PW_|y$p@LUk=qKh8XMX0Uf(G`cDWYz)RL{G zvi{8DW?jj_uHhW;H|!E=k`N#CR0o2FWW4akjo;>HZsS8vwgFBd%tt?_wwSsGLyMD*_c zSUx{YhVZ>rLJaCJXA)^DY{6hshLVi^&-Ry(y0Ol?A9eby$Pz&#tDiOpjGVCIG>TRG zxtr{~*s~@q3R#bhnw8#-QVZ2&3q?FKNs6~f!r&y`Z>827%HWYZ_1y2Cxe3iR(XW*Xry}RV^|tzR^{?6LgG6SJhgd_kPwnuQr~ofB5jU z|-LPb@lN z7uMXJ5Z=SR_#BpT@`DJLmHzp0CJXFb)R)mH7=hs!$?RyEN{NAYl459U_JEqoI4d2- zx^J6^q7Icx3~DA5O6c-SF*2R`9Jt+debsciWv`^9)JUhmoizP&T;Kl7T7ktoj{<-w zP3XVE{k||DDk0A1Cqww)&kq^G z!z4oM5*0BsduAgMpA;ir6&G=?OIR*DZo=!FR2TfcItfMDJOD%n=TqYaN@+DO26NgY z$On@7mVQR?^qXg05?{=+cvkQ0(!Tq1JFy&k_4#-;eqLeHGg4w13!h@wpU}(j`tq19 zhgtq(^&;7Cx)btq-PGza`>H09Q`u7n#mf%G6#nJX`t4VH?d0U#dcyW|UvCMR>pAz` zGfKG7=laCjP3@B5wB-~3M1mBzm|X9=+W}@Vzb(XLW8rR=v}1=Cl8(kCpPwHFy{b{{ zzUTGj&fIUPrSESl3>D7BB{1W-nVR>n9yGGYN5Q>{=!3Wy8`B$TLelI%XNT-#@E`x# zt>mqHbyO8pIBj2^89eKYg!oLO+G66!)@fC_c3%5Q*p!E!#0^OsBAr-#-oI8^cT-SO zy79y!_`n|D6Oy4oe`VHKUro0^dwow=;!RZO1^J@HX9G+2SFe*^m(yjCU^`NuE8T!< z3u-KAttYLdA9&(O0$R+%*W__k<`Z&qIa$Kmf$%TJAalC+<9JY-MVpOeY$JxHsVF-( z{SrYHGtd=KeDj3Uw3v&kxa?>50QYjO5(+u0e$s)#s{0s!o?PI3cDd9SQTJLOkE@Wv8xm%0=Gk&&w%Q_$f|}5?`bEuG(-M;ZHQQ8aKCM zN*#hU%&%HvOLlvXMRH@a9r{oAy|h0XXd>>k_#6zPPOz$$9hwAWzKMBVG?y`^lQTs9 zB>#OJyu*X+FW9t9yhKcT&o%j81Bn}C&rH3#7$p-zV73B;?b{x+CdO<1PoF-01z-l~ zvU7#@9|OIU%8MoG>>uw{G7Aa{%1v6ypW#r|(|L(~vB~A+XDx;@U?$%wfuIm$8smMrYSX9t!8X6nEZn@uG+~B^uD_9O;ngzTUkLu zR=GB77(|T???tf@0K!IoqG6Kpgh!T=1m%?>PZ_yOq>4P-?qjO zdqy?y)_Mg7&@8A=X#VT8UH#>LQqx7J#1)^%zNu+ zk$9%W_U9#9pOeKvLh>;)dotM|V729-^m^a(Y1RTROm zg9I3L2_CI5k{GA|pk#zg6^`iz9|i}`NYDx1_T)6nT(di#bptKR5Q!x3AugM|`TcU4 zXS%wVOR>&?-N@_f&&D#yc&+!X4qlkE$;THIRl5T2V^kZ&8F~H08QZ>FJECh~IN-4# z7t-&>w;rw0 z6lY=h&|+JHqC|=VPS3lE$&Yg&$=Fohd2LmX)4KeSdPM8-3tQsk8wTP1-3^25SDyzM zNGwAvTDZ78mG%-bu2Auc0wPUTzS3vYR!54v4c-?PboZ=AvZMkp45~b!1DX1hy6zJp z5@&-k(GpiD^H)c;=bKdn;2|->KSP;f?mN}ax{96s&b`wqxxzulO+A@rchpLTi|H$0 zQdYJzUS`k*4e2$W@GmSNWKO6*OamKpnmW((R^CRt03x*R{l1{UeBi+`HNR;WxaskP zNesv!e+=wkZBf%j&p*E%!HX!T3EEy=oPN+Md-uTe=#%B}_Sb`cwcLlZ&I1oJPukd| z`#c0W4y2(>DAmR9$e^rL1j5b3bbGB)JF{d9v7Ct{w2;tbcRTI+HorF@aeaYJ=jE`_ z>@Qw=z$afbGQ#3c0K`h3R5jMS(6c{l&ftkxC!G>@FJ4F%AVJ5s?8|!b>O0R;gC?JY zmA-R88H263w!vsYO>{q53^8!}&H`RxW^=M?yi{Mz`|MAV#(VLTg+OsRDq)8OuG*RX z7Cas_#Hu_v905p0<0}1venE(H6W-)%5KSrS@_SUv;1W1-H*qmDm446G9|NW;0IF@0 zfzRpSBf43S)eNQTI=G*{>*R8F2<N7fNjTM{$-G!VhX2+-dM-#ReVDg# zm5NlCuWnEmj+be~PpRV3HHc6Y2;W>P|4?tEt=$ETOz4Rm1GAnqhemN(hv^0)605Z3J|l^eE+9qy zzWES2inbQhuC_KJJ$N~N07ZasrXVlUJb*#l`qDc%$dCf&Z)D^@IitxD{lS|hl3~%~ zV5LO2b~^x%+kLa5bLj3CSU-Pk+RrX)Lm949Yh6q+UoZB1Wb?Gjo`b@xU+)TxH}1s8 zZ13EE7C-p_$`2nT_hFQkl~pQ$%pch@o`>sCxRVS#x2gfNJu?zaV7~R>)hCI^@yt3k zHadu}(9kZx$wYw@IoIGR07|wOhy#oMbRCXF0+C;_9UUF#J5BR+ilAC~Iy)bL9I3S$ z-X#I#7#cioe5GC5K6#^CH;I02_kA!HJ3ALiQkCEK||2eXu%^DdtvsjR4Q~1r(bM z&_yt&Y?+W~pcyAC%^Ez9!3eZJI~XY_^Z>!A^-+5d@Koj0yOzLlRU@SVVAXEy2u1=* zsY1>**kGCs(xDO8x9jVIO^K@H?gMYxzlDAM_27R+g3`8y~A6UVn1w z8uq*IpmBiwxjPg>L<8ooFj%|GW#_%(@E_!QNPlE@JpG7Q5G7ud?IcT3s;>cjeaKam zR8Tr-fqc1DT4GA)WTbIg+Ldc@3>caU`NaH(DGdB;#QDJ0)v%y*F{?Fd3Bozws+|{E zO+T2jE^}PHBDxA>li%O6_dPHEP$~+<1#rmdt_H3z28LB6wsPA*(LF)uGQf}+fbu{_ zjE|3J`d*!0o*x@DdUb;FcQ=qO9Z0b3=7WqKFALC82?Vw?@K;rQ_7e_(D~qm2o#ICoG2WXd?}1qRs8dz? zb-#PSYefKT-b^ZMJhP%(AIK1^Re1CHUS-??D7vYssn0<|9335{**AKCAfdZhz}~4_ zr8TDo)yn65%c8`4EkA`y@FND2gC@npS?Zf0?&$Sx>)A9-1j!5izg_UTFmcx8xbm@Q+caZm5TiNyjh4w!G@9`(c8-xKBJ3@dHpxi zWuyf@lBe|G@w3?syn8Tss<>AK&FtJus=vBC2aEFF@);+Y_hsR{JvOboVLbC4t{)d;#Q~sqdwZR9nRhLT{jRTeuEm$%XrLwW^lRDvTTBVJ&pkIColy*G3nseKnP z=svF%q&4nE*@Kw6gBHgicz`!>&wY0R{akcj0zF$r=W@Eg44i+1lNNHwjO(;*;XBJK zcJKm2ugRZ(2KE(z3h~T=G63yo8)Z$PNj7{JO*pPseXmwSnW87kjbyS_LvwyxgJ(qE z60ifk`^<}9Y~y;)Q3fr(m*c(}FUNGW^k0r1H(g(9fRsm92=L_LyWSwkl05)S0AlgM z4%`~BgWZJ83sYxj=WJDBfF=a@cbh>CeIzvNGQ7XsLnyoe@#V9%vN}T>PaCE6=n%y~ zp7msa991I)&v>#iRwA<^NZn1s^e_^DIe$Ww_0SSv_{A+W(Dq!+jYINUzql zn$ErfqJb7?fD24cO?|N%Ee0IVBwAzzjXA(4IYx^E-5$#BWmbVB-Ar-s=m$p=z-hRD zeQ^K=<;0x?%vJD{Ea3}i-~phr&5hpYrC?=1$D?c6Y1!#7iXmi|Zm)SgyW>*}h!9w6 z5Nf9`KPW~H`?D`DYv4Z5*-2Gx9~c$4((xYH)o;}Ri7FdGcFRN> zGls|T#C6T6*OF&M|9EY96$nsJ>?gt8jRG*HG6AV^b?kdBba#M2DmN4~>Kp*a8@PYa z+wvMuhT?lKx{dpxtWngc1y09*gHHSc-N#e$JsUnfSQT4E4<5`o@WgVXMZ-g{4$FL_ zsD!px((K9Nz$VnoH5FgcwY-F@-4Ka%kChZ)+FqW|UlS|3%M!UF1q8X=>gq#`YQq8W~JTi7qDWVs;fb1)422WW3rI_bHF}Q?^%Pc8V`_* zvrauczNbC9)b+e`{)jFL$28p@-8(I>7c@{$fYmc|4YwhP7Aq6U#jmGWaz>*yw9Zl?6MsuFQ99gjB zw!ezt?e=vqB+UhQwVzB>2by>B&A2*Buqyy>JJoG88*rgHLl zAJ7UkJ4U}1n_{v9p!Fxu1ru16D8*bq@)TViWL~F>zO>{A-3*nZ){nAO}rU$Yj z!xeVICvfq4Yh3vk+?3gXMt z_KXn0!jh63fnhE{bHRJ;YyeCkQC;NLocuL_>@=K?L81 zj2B<7S9}Vpx$lI7Z-`?W#|l}%e{TOM&6YjoK07RZV6{9{Ggy80uC+~f>6Cg<5~t1= zkWxT&L{i?f0@M_AWqSB{4l-cYz%1B<6a@L_SU^Y%F;SF} zX$1z452)QGdUa0SZ*Bw0w~fP=&I^J`I2w?W^}~&E-{m_79zY-BzHZU6$an(UW*Tn5 zbQT3c8gqZYiw=B!1yoLO{W6$2iPP^YK3moXx>e?Vf7XU$MAr*J7k&#=6SVjONE`Ya zght7S4;TQfe}T9MgYjP1$ec2XdB9!wD;}ig4GP|@($apm+m(GUfye6#mLkJ*yH4x5 z$1=9~u0H_BAqyk~+0#0xkwDYq;T1o;=|0^;c&bm$U>llE7pBF*S7tUh%b_ z`AI@kqVl`@r)XseQu`VR;yg>ySATw20dfWG!HaetpG6@j5UEX@l|4^CYV*DLkp;kJ z6dSzJ%UXUBVD1e~VO^G>1_STUcM;FP9lUikSfSh)@iR8C za_Ex0-@}70|DX%+xtyr=4scqV<(eX8rxoiFzy-j?=q(25%83>v7UBmf4M$TO0Bd!@ z`U?RD0t&``P(pf=c$xqeNjXK=Kq+jRKZ#{tX4^A$c;wvZ3b!QO2zLFAf7Dr0SY1tb zRt6iAh#pb%8MlR&`Ce{__eg-h0W=Rmxd0`kl+3#bKuTGW#w(%%~OTcME0wCwtKa>TFMk0Gp5ck7#(4$3@d0^Ff3H0uG zt%{v`T^&u^XY!kM0}XhF<}Fb|bIHPvKc~RPA0TqUTJ>g#xq&Jn~9@EW71K zt>TA8DkVS>e+$55aNYw#0ysTey7OmG6-C`9-!0cIKFxYTjDJ$nv(MNYB^ zkkcEZAI8y6$Gmz&etv#wX=!$LHrOu#25>B9+n0K8*=e%LaPF%ISoHCln{TCWoC2L) z0rFuUU>PuRbU{G|eHae_(dRWc#|?Zh0Y%zcI!I8tLT??J8XKgQW#xMEA?e!t^(ULx zN5Ej{1RM`2TF?XrTMU?h7dn61?<_a(sp`;$~v*FAu@M{DB^`I>IsbM|9Y0yY^ z1v(j|71){75qYZ$;4#_^0!!~@Yr6%46LgULG?Yb_L5%tWnF-E008T?_7dm#)0|Z4} zzuIavl!z%B028?1Q6VV)mw$%AYRnA{?F02?v%ByOy^cBTqQ7Eg`hm#t+-YzFYk^Je z&D z`sB42VZcd>i|&SPY-~teEE3W=_wu1d6zJHU9q;&pRxE&`61SZ>AcBqJnbDpc;7K6c z(}knG1xzKDv*%m;`ueVSt}mNF!2{x)#4;6azXM{yP8LC~=OE?neF+xi)zPL0pwtGS zB?Tm`Ay5ivA@VH{8$bkbAr8j@GN^#d0kZZ1?{K+0k%U$8g`Hg^aAdrl-uF08H=&1WGA}l>^#@`bm}#fMTgpA{5g6>q`K3S-DM_A?06dQpD$xE zi^y|65hca(4-Gf&QEN@FMy}t0Ao=N`Br=G~Nzz~w3w(-11`=6b5NUUn(2+j?7!+VZ zfM5Xo(+3C#aj+`qzr8{IuhX*w#!9;}QA)JXmED$k?*H}zxC8qJt+fDAFpdO!IZ{AE z0}ks7Y8znP=D_*{&InkCYfs-~prxI`dWwrRf_ewsn6+rYzCh3d#dK445KOUC-3%Jb zz?{xI^>BgNxdKJeq4kCkKApH1KqP&@Q$cbq9y|%5ah+I-kpK(!M+MZeu_;id%s?3i z^d1pbz+8P`gJ!mbwA1ax%aV zN(B1bhQKBM{UaM4iD-)eEQ}8*HH$~{Gc)P7K}+@u^6@7}_Z#0&g6CiDwi2F`17Rq< zIyF6=z?=e91Gu2SH-e1o)z#@L)a&|uzG*3146QPNnF_Xq0eH!`e09(#RNtFi2mw|c z=y^z=-S-SWuU`O6?gWjtU|xX!XyjV~NbvyRG$5^;=?AujKrHY1ULX64?+Abl01_)O z^evBpxaX0LNiWzB@m@ItccB@BFdd*MK$asQc}g`o!n#0WHi85}X9hryLOPj4V4&z% z7|RMTUUEGpL4Re$m0G+5U6vq!w$N7A@!?A<(5wM+E(3^EKp)+ zD(K?K6Vu&1A8P^%O;$XUPRLFVBnf)D&g<#CDVe9UmI3(Mp~Rycm~@t}rP^>&Hw@!Ye1k(d3Rw6A_=1BZj$z)S5jKQfA~NWhI;a36f6cM{2TC~7!AHS5Z1i_ zscL4%V(iJ`lm>DpJ*f6;ME^q~nu0OW4CPEfUBMjvsj;0#10fol!M@x^z$=;n5xYiv zdEePGF974LEHF2q2)3~mxA?yGf_PDtJ11n2mo0;pI1D(PANA`&nmtARv@We%0c|-J z0RvzjSdW)B>@=QJQc+!>W?lm_`n^Bj7sz@bj~oCUaqOfK0+t(rvhWw)mDSrD1ZV4yf8tbi+MF&1S4Nm*gi8BKX_9fX{#tZX}4 z9JS!EL4fMG%#%-eqYifYo%|$kLOaHw1l88n)#c^o0o297CiuFNYK?AWRApX%1bn`- zavv}hU(m$JR{@gqFa}6_04dd$!v!F`ZNQczP&Yu0n+Ng`*qzg0EnP$(*i4iI^=La? zvo+Unj_$S0Utb!Si~n5>ufV8|fae1NZ1q*&z45PLV-R=}y0HY10GQiGd&ac78Y4q+03gy?|XWB+OwWMe|`nr7QuV>(8La;MA65O7a;TWpFBzIGr!)N zzp`x$B?9W1G=gvK!kmTT+u8+dHzQktsN)+uOUt6tQd;23f!diaJ3ui!G6H(v?MpKF zH_rtxyf*UV->4tp0C@v`-o6D5cY_>wJ98aC zYM?7k`RhQ)hKGlPD=~fp6B39wuq%%Th$i$ZpdEnoqY|)d)XM4^FlgAo*wD*@uAsl- z9+?lk!> zfJ$aW!TtOz*qF=LXip#IcJ+)uoLZ*>cbt{zGb5cy|qn-IC8N^%N1aM;kQ073>6Dp6eO|BYdamnrM$MjHwKX#nSl$KV2aj-jt?Q&ejsX!1kd8hX z8wwSk=apU1YCx`>7gKx>Xar}h8lgLrs=%WJVrIU#Vxn_np|+^AGe4)`=0=>?-Gf{Z zOLhUU!&c7^-q(Kl8Bm+0kx@OoBOnusIj?Up#-GMMGd44my*^zEP%Z8iL6|02$Tu)6 z9zfd!UHOdC3ske$n#9HwWD0_T1(&_Lo>g=?Dh=WiQQA)TBwuhZ3HU@jjHg#oOdx8y zRw_4$VPw=6A|6ipjH6ojhXN4cI5YAMB7>te^MnxwyXKb*t)XLD2C zAn&U!Dq4q~(FKzA?ZZzQI%Thct8Z*oXCBWht!=bl+z|Td&6fK-XVQ!wK|G11u3kT)U2|D-pomIA@INCnRJbf}% z?~ORY?^~~~0nYE;mslDFEj@;o1NhK%W+qeF3>4F{^waQ=0K4Qohp~|6=FFUDH8d-9uvi%#$(ve2Ug^z^eU9twUt{j=5b360W=eu>iRn zOW#0eM8wOZ_gQuzF@1--4F(DZ;wu6*;2-eCo2sj;Ltg;#VyZ1@7k0>e8QhoxYzkPD z`}@9zl$Dj0IyySQa*Qo4g+D^Q1UBjkeG0H9Z2wbqad-KS#UQHz_Merx`Or8l&ksT& zC7;bXT62PvLmVI1%3qEuZa*c>!N| zQiH8Lk!bsNcX-a?lA0J1ofci8sz~m(^*yJULgsiq?gg#uC|P^#V*~3~f>}3MWym`M zk{iQ$Cu^h5KM^Yuh`n2;G3u(#m`11)!|L(ezFJ#rG$yWJJV&8nW#U92N0{yTC2E40?-k!A~U2K_Ax-pJ#Owkfb*V z)Org_RaL`eD}wn!utmI+dS@ey6OoF?0&IP_kTMPo;g@Jliz5(e)b!Rjq`BKj2r_3p z8QXr=+&t>vNB6k=Afkk&DJf2xG{NDjXL4~mS!xz{iWYfpiM2hNPU80$P$rU2ek8$i zp=FV@2OAZv0>6YzF-8ZLoy7*SZbZ3&Pf&^NIor77tz*zaTissr)H&h<-hlRyJkLGW zkm%;>@`oX}mD;LEA;l}*2+Gkty+`=-uRe_D@XGf7Q1bn7OVIk}zgO@(ZX;EY4elGU zeE&SZ3v5^$cr?T#4q=xK9TX32y^3--P-b(&xumkY0*lSj8>Gw46{1iRNZXoylI5`p z>cMA_?~@L&fSA03-?9PQ>4nTmKb;ZZU1oiuO9ao$+0n$|UkHXLheV&Y`+~4$YGyX5 zy^E{ymea-M=v@l_QFiOOjXuiJQQ$0*gGrgtNRUd)0k&g#H(|^IIXt_|+)D!^0 zfGvNk&F<-~#?k=rf3*1M)lzmmZt$@2X0F+OO4lpEdk`2!GNd-mAtVFIAwZC2uj}vU zE?Li&A0V_sA)1}GXSIP3x_+^S=K~$<*rJDQ!HbK(zxE;8m}ke~9JGcTD=m9aoscRO zbX}V#1&}yhhU#F+@?YXNz7}|q^}$DRsRGgsdK`P&gSZiS`HhfLe1epxygYG#0$+yC zfco8ZqY-E6+=)l8wixu~x%2c-z@cLx4Wam_ro3F}%o#4IsDRJG=5UT%P-`66w8`j` ztg5aKc%@6`-^ZT#DJ;m=;K>S}v6?=fhW_+`3cV2FvhJ;JeoW5M&Z?-Qj7+Z3wWNe&IYViOmjN0VUN>Gh_VL++%{FW}ng#;(bR=$LiT6675F$%lN$=?>KV{2KHgB?0kIy8EpJ z@tF`Z1yq)gT9xw=p3Y~&Zt1NW&HGxwmL9TgKtX_y9BBe2g~EJ{R88$^*#yH4>j_53{;4+#HddDV+rRb}DQ0;*|BywJ`3eJ7C^$p}r zJ7eQM!v|+S{=%-k^L-9t^=&ArJVexNvSK-UQ1QF~-=#K>xGZHhM;kJI0s{tK0J;qq z+gZ2dnc%}&b8|DZo!1?0P!B*5q*rwVL7d=04Gu_X@^?&n{=stFDi;;(=XNA>wCOAPQEu-cMchy4OM zXMC?Oo}D%%)x0L*qd*8yBq|-EPi3#R;2zypTLU(Hr6B{){izjX#_FblfdOc7cOhZ{ znv#*NZOF8?;7A`Ah^&x|4BB3r1%mb==i1!-{1Xepv6{YPN4Rgj?1o4zI_Zebvt=C~ z&_xjHb|68JnwpBh5Wvbv^aLU#D2u*$o|vj5&m_&#+phX$M)1=Ri4uf&BE(Ir&l0#w z3bj50|E-r?;Ag~_X{Fqh&E*~0fzujvf?aLN{uj$ko?h)pHv)_&E-sD;tewHnr9MCw zQ3-$y0+OM`bHbnrVz~fMheqG*xwTN2K&6m{ zT?*6~K-uW|Dc}G=tAJkt?xf{V#Dp1rYI%DfY*xFFkdAE9hsr#p%yO6brc}NMt+ps* z`|ntJ2u(ZX(WmP_jEgS)`h)i-PCBCdRD3BNhFA;Q=dT+w%W)~3| zkJ_Ci?5*fHXB~HRVRvm+x?@-mv21dptuBs0ojL!}O+m>z0z>)=K5kW}Id2rt4c1z* z`y{dVZHy@Aq{#;{V&q6bX&y8W048di>hEnKp`dvl#y_3_7`Oe2W{v9oIc7+2-@h_H zK(h-9$9rU~^UU47gkH^Qc>IX|2n&1(fNB$xTmXXl2Sg1!OUq+`tgKF#k~ooECE&5j z_I4Yy2oMbtL6HO{%y$%QVo>{};1?wGbj)+5oMLdIhhG-`Ae8{RGPQv=e{+!A=bpp7>GqrGr2F4MK2 z@l@+|6sV{sCMM3(Ie>t-UOhH9F{!fa>a42r0MH{n5qD^N@4iH^K6SZ7%TCk$)ixM_ zfzLQ->H1^DPl4PG7!=@-&Ug2GK5g>lRvwmTe^1j za{z)4pfj2n2KIp_yHlJX@e^DQ_Mj)2qQ%8M;dmY<7x^8X?mBYvI$r#>9|(Fy!VTbu z!}e34v-KHZL`*@%euJ%r_iCQI4GCs37+N+NFE91`5U2$L0o(qZ`9K^<+4Wy zR@4aKABbVdj0f4~*OlKfNtDw<-1pDw8^ci`GcS2m|7*e!q>9teBX{dA~kbw~Vj;Qfa89brz zgG>c90#*csuyd1xl@jh5{R1rpNCmU4Xs5O)n|OtZ&g%iNT@VX2aDhU29Y`81L6j$b=%pnJmO z%n$t=4Xac&WzP8^di7D{F^AS+?DEO#>scT&$S9N7nlcKa%5fevb2BsJuug$N{{$)_ zTK5MYmrCQ-`{vGvJ6JBhcev)2caba{sUxNL$QK8n&B@Bioq&FJ0aj$rF~Inf@oUO{ zFx3Gf-5JaJcL0F_+aY8m3^w)!a7e)cUIIhf&eZfAgfAqiccJKklBid@129w)Wc`UheeSB0CPP)bt2zYYkYqqFlakOmM3pH^2R>L=X9hZhBiD+fG# z$m&-Oh>Zb2CWJ8J<}2spDcJ{$drs{zs#G*1?Iv`AVK z`mg);#gl`J7a>%GDC@BLF9hwZKtSMo0%+%u{;6)_`n52Ggd-vBq6hvB6$IK+`E`LU zBYqkpr`FdS{kG9d=S?edPR4uO@FbOAXznU(Z*K=_L0VYxqHvJ_$N8IIK}7_6i|^r6 z_JJgPP=kdUaA`$oD=-od4J+O};`dm`XFz`a3{%66mbK+bp^sf=zNq#l*+lf~{{CqE zQmtu*N^nFsw%ga*8OaS{la2#%N-Y;o2aB4;P|H zgSJ06J39f>a!_#|Kqmy6Q+xN%?R5^irBnzj(?W;}Lc?uuBB&r_bQhM;_F}_FgnSii zB*0j39V`-X<0NcazQQEmq-z887SMmXY)nj$;k|0BCK2)o1d{;IL#jJ4C?3%BfaOKFCtF~RC5~%WN;B8VyzHm>Vc;YiMW9Q zQT+>qZ$L?R`2ep0RU-qO-1YGsnKPX~Ho%?s2GttuiJIzaL5%4#d+v!kle?b*D)}gpCjX1jr@cIm(%mdIn z zr(nOQ<>i}C?Ed@%Ee`U6;*_TBs%R5aQ*lU2Ra9s*P3Q@L>+ZXE+5!STkii_7>H?D? zKAtkJ1Gguk0@N_Aw0Yox0GIqd5DQ;Bq(}P2z zpqRi1^6neFEFkK0bT8;Z8p5WAhIJqn zf~_b>9|wB|PqYioS{a%VQgu=nReOoaXUKvFd>9B9-p@9{RAEDyYN=S5%C^yF+*A|1 zHK^Wzw_$T23e+MZ^d+**FD%G|j|C}(-@wqUAs%6T#kfZ#2`C*|Ve zBAd%0<%okjgw>KIVJmVb0gveEhKAgEl38Pb%bFiOy7bTiFuRLCixXs=>VkH!I*o4( zBt)~)bPp!7Y3SF0{|d=z#8O32Ayg9R%QjSYlCbMBVVzt*opB^s+%P z^{PHZVp&Kea;2rNsK`Not=jVcvH+klBIlg}_=HAgOi_ZKjE0WWS{MeQmk^)<4lGdV zf?@rF9_!`ih6JC1X+e|{z>b-fl_Ky1Ai|Kb1gDFiJ`Pz}kTwIje++GQVw^t9A5M*? zIepd*UII#BC;WfF;y^Bt$TbMK@T|};A^ps+&D5Xp7z`08L&$QdthDM3K8BtHfEz3a zGiz(0?kh+Mv+Mi~06jJT7}@afgXsM9B(gx*&8tnuCq9C<1^rB8CC$@@%keb~tRU?Y zxUG`jigxyM_~2o;R#sG`gkg@K##z|=J%1Qwj$(oN1YkKfcbQ^g!%o6zL1$-YBoQs$ z>g~_f93yOPR2C709->>f-{f}P{=BvS;b%X}f;E|`-`UXl0cq6i(Q4q!A+jPtm0A+N zLbPG>Br0KkXSFfpXyBE=cba51hbj90$6qS;5gU1k>nFav!Rwr11R|>ste3fJYvwaozlfCpg64qq1H8eqD@54h z7a==-0Q#Ud8|r|VdkeTdpkIGoU8=CF9k=06o;Nmr1MmW;H)-?H0|41wY3r* z)f|BDzz|2gAqYOp_$lVWeeXk5477b@BnpZUmK+9$zr{kX2ng`6$)L`+!Blk7EO>{j z3&xN{miFH?@aag4_Jgtt%HyN+PaqT02{_HMz8V(Yb6=N$fJ4wmVcm5E!b%r4A9X?k zGT?(i`SHmSMF=LC*Ft4LWV)aOR39S3-R*B~mMqda%yOn(D96WM>2*Bs}NTd#OUVMM!PJTW;`3b3H8~obZ z?a$&U&$Sl{u4DOKx&&_m$xYHpx-)#+*}nu1ugc-uKj*!Os2YduupC`yGD@?y6rrfc>|TRO6g$B(8g~u=UrSs=l!~igQA%JR}xySWXw6AuXa3n zwLRL(EXW+Nt0f!&$}yrYz(@9X)Vy;#bBe&gfY%}PH+iWex|kOG0Y--g*l*)sk#!v;^Oe3!*JI&l7vKb(yTEl27A-O>T}MFM9~-3 z-+C4l{_M_QE7@GqmEa-181geG>w$Ct-}w}h%c`e!R=%@Rs}Rg}U~Xa9qx%DI7I_NN z8y0rX@ckK02_4cTcy?u#S&%$Q={x;PLy)n7rxgGa0-dMV0>qEwu9II~&|XtKxBdyd z@?w@ZxnYIz{U=|~SZnXM!-+U%rB_Af_=_69Z$6ggEw=S8S)jS(!+;-p>)mfR<0DKfiJCcnlBmN->jk!F+wEU}8~+q8<>@6RWRMCIo5@Fa<+c6F z?=ty9^)r%p8B2%%^&xQn@B6FiU4fFz;WK6A`)9UHYpzh0dJWu>TuPg3Wl*Z3-0xsJ z?@6mM$`>;~(_YNKCP z?k=4eCzboBv*_Qs_`Lh|@t@4w zE7x$7cUP3%({phfXL@fmwCMI1sF2Z(c3}QzS(DN_D4}P+AtEax+d%J62(gnrfW%RO znTbiiQ_@@A8)O;0o){IqpGlv~+|I~i2ZK2;zQiezZxB-RtaHCk^;gUraaI)DtVw_H zwwY9O{GPr-#>4l;>fMjp+-$Z2KIItmDhYi$4!#Sl9TXkwj@wN?H2e9P6!bb%E>E_Y zFnJl-?5cr`B@!nmEx|Q7P(8U@9?A1bVznn~y;SUol9ZPHCZIbiR$OjPKz4H^t(-hG zNF)`7j3q(K1f9ta!k~6AV>$)%z+AW9(YaU8#Yv8b7oPRe(s6g%PYK$;W3NO`$baFv zpWOYfiph@FgI}K{A9;vT%hqTOHKD?h>Ci+LsbZ*EzQHhb4l+KwrE9EiNk=NrxnYaV z^AYcSi_3ZGeOA#s_PV|w2c!KK$r9O&ADW6vJZT&0>7Qoham-3O(wqPImS}>zM!tpN z?d_;+-IZ6HzaMOX3)lTo`RF->M@bBQ4Ym%zVsRI58;JNJlx&_k;tb{8me7iuD}zn! z%$ZP_Xa%yh@!HoWV*!xHv$sn42$TwY&{6n}Uwsi4CV}d?7=t`(<|2zW-7;Qbh-%(`eB?y))T`1)SIF2mEyhP!lmtL^^nZdTz^ zt|3h^Mb@+0q!7ksZ>73BX?LvIQNML9Dos|zFw z&!`}llYJ&dF)en>Z^H3q{@eb+x}GABEk=3fC2_CHmGn-(p(gV&#*YL$^AOW`pUZ zg=by%{KlQXKH+34;4Ri(d*jS)?iZY~YjDfvt{+da&G2eo+{@meg>w8Z_j3*toLZi) za%}c@x9W@u@go)Xp{rzxw#D_Uwh0!Svc7Z_zCNZC=ca}4>Ighxe%o#t>)aB+LWEBuf>@s<=Cvpf{Y7uOUWPam z<#DS%6q}Q3t2n2cVr?6fC?Q4^zIEpvoeX<_l7B(z#r}b(q4a!dkz?g6U$LG5Z;hOfU+T<bIhyCmEBDjJ6)1<2$DZFiUUPbsRd#g%mvac>l~wr zwJY>fCil;_W^IRQ9BQgo3zqj{dcuteC^RU-9eV7a#6_uMY-$N5m(e2EdzMa@5s_v$ zmZi&x8u~Nh-pXlXCnME(>Ms#I=*EueSfj{M^bsUQhC*jE2BKAa2<=Ivj}78Xd1ap( zjwf|r{)`X!*|N`iQJ`kI$l}IqWSA(*;2+z5=s`x2pnGktTi;%rhWyq@_gcRZa0J6dA61xDmK zuo6xSLe+U~quk0ZAKw&{nxtFPO2tjasdMPxvoq{WnW%2jdp{XJ=HV$bB7DG6xq&a2 z{(JN7Zf_I!-wT?Y3_C1>JAugxdG}(!r#gH&7K$)J_0X%-J}6?LBuP{$K0}SmoeFc! z-qg1=q2Xz4{ve%GWwJ0erG>+#s@uxwDHo6tc1Kj%ShKTcXS0Mk3dQiNgkwZqGMF?X zABKjXwbJ-bHP5gVmzT$tWqkSVrSc!I0u@f@(N+3&`P%Y(;u5c~V1)a;->l81dS ze)?;gL-;OP-kNzZd4H47QRd}4gflmT5|_VhD2BFI{y=;452Tj1uD@EBY8~1MZarnu z#V#PF$>I5Rs+p+nK{a4&5T#*d!<0c*X#rl;5;IU~&_5~k;Z#|=e57s~;OJLd{t{X6 zy$yCy9l;h*Y;5k^+`QUMgp2PW<&lXPCmgkslo8W>MTl~-V9WEIT{y*pB_PRYL}^{G zrcNgKzPKT<+Gfa2gVAuxA|OJe2?I!3MMilgdms1eNtzW4*gV5ZTGsN}yZPP6pUb7_ zpP8+GJNfo2N7BV_J$pS2Cy)BJI3N~Rz3upmgI50ZDMN=~HH9}lu{E`Qm*Z>=rbYjP zTl*Yj;#P|nO2r4ieY*n(Prghw_mWA{85V_hN7$Yy*l+zS$iJL;c`Ic=NqjReRjvlN8>{Y7G;|X`iZg3!t#8%!_hf8 zG?q_1G*2P|FPmZ9O=GXUEQ$;;q*h+&+cNmrb6=sKAhauDDuWaVyuJ-xC27-FqDED_$_ZI4q%oIwxP6&HL&Tx1L~ z{urpHt5Z``+&0DPPOW*{VNtXxC>L?=sAhZwvzV{|%B+R5@Sey&AEuwX*OqX_i=FMU zk}N!jt~X65lieMjm-W8OuS4;G#Tkz;R41C2jLH<7+kMMqOE?|I??TQbS%`90rRO1d z)VtERVx}mmiJ{qaHkX&T_|4k-{b{cp+2J!%Xp%a06KI=`vDg6)?o+YSl%Yraf5 z-Ff0K_Ak*mfBvs>-gl1blaoS$j%QXnv6QERUTlSB_`m-Z6yA6HP2Q0e?Pig8ccfF3 zMY2nbZA98YF6A|6qepL zMzuE=J<_wk?B7jLoJSB-EIW5ZlzoaeU~D&9`Q&~;=SN1)ofNVag6-SdWCdTV5 zi#jVPMkh+SNLqSY{l+UIm2jgX*D<~r!f9;njrmU6_rLBP1)AQz^3SiZv#-@sFB61| zYxS_w-k0~^Q6Ljdno;`t-*t2CYfvjiyVsBInRzw)a)W%!OWf#m=Xrq-lOx0*PuaKG zFuBq3o{5yT>I$sgRyJO@zt7H9jJ~d$A{DL_CF$@gfNl|UCu35`4 zj%im&l;nkZ&Ub@$hsJ6|-p ze3%#rrDW>py*f`dJN(-@kl)B~^G;V@Z`qS{qe$n<&f-@H3N>_}k$eiz4z6)b{oSKm zPjY0@T-TxYIk1|?IAT+{igk3!WLUL`W)!6-RU)3WJKcbx**)W0A=xd2CT zKy>QTefC9evdXdDWcUiWvI{)*aUdp%+q8JYLV&B+D_&jkaUt6hZSi_3O1Zv z=Az`;?6`p|%FY7iQBCO+1pQO|rKXcH22m<~F}O;pta+S>=>r;qvV(Dh_$o&M3z9Or zm|+46{uo_dXG=C$8VME=g`L@5=`-xzo}21(YaFjrd`e}a{`R}vf5(zi^lxkfNp8e4 z?~1WDzofNLp<}ifD_3!<(Q*!uXyNI1WN9_h;k8$g*khI$+UC%Rv#pKV-b`QVDNFa3 zr0IQop{LD2=&x#_g#gBfA5{yJrvSB**cJ96Soc8EL5(FQ^*j%JU#Z#+$bcD{n9QuK zw1dnFA$;V>6%cLjzc$^#(uO3hz6eAgd&yv=@Q#rdq+KNHDT&iH2J{5{+Hjz2V~pkX zGI5y(N`Ib$XWSmrTJ-M;2CNuJ!kflD@I^$op3X_DvrgljQ36gbf9bgR;)e}SIdaPL z{Jbs~`Ih&BMa;(|E;4+r;>rTkS{kBHz||`ET9wEdWkz&bhiFOXE^ffkK!wmpN+sO*F0Vg?7wNax5? zT@uNNzZNXd(ps>M>JGn@p3H%%CRdu(A{V>Z1Nu0EHe@uo^Jcp)Ec+2eIZ(3y@-oKHj^>?*>$tnc%RY>Z% zZ^PH_tp&gNx8ETiG_BC)dOvRb0UheJ7VeX=kTONeMK$JX(qiIl*)yb?S@!9_T@>!E zutcc+p){}`sEw&|EEe)CZm|EPRipfSG-^ndyFYfXF~xypl=E>v2Sjm@%m)mj5o2j* zeB*WL&rFj0#?N5&DUF^dS#FXSydbTZK#BP-+lZQz_c3MP}!|N;yRu zg4Nl+6R=v&*^FMp9IZ#<9LkCo>|*QW(RAg>o2HHh_t7sz|0CDxyq$9BD`SF$jlaIk zpG!JI@w{@+JGDp{(?hE2W~4$nr9!8o!eYGIHt08%GFv4s>cq|06R)9CMNeFc(x48r zpkw}~NHiT5F?NkKFyQ8I-o5)HVFH;7p*|5&Y2xHr4~$YJh9sN@LzVwpy% zkk(RWvMh`su-GX!sFr%W(^qFXIY;73^u++Zh-XOz0W)g3+=Rn25G`k_C+ zgW+LX5rBnh+{Jg}Kvs4t3A5o4(4?jSW@nEY4EJyK$ie z|GmPjko-cDz@)dbW*i^erNW*^$!#e-JWS7%kMxf=c@$r8;NlzRL)WLnT`sKbBuZTh z&irp@-}lBBRJVMHaS&1%gyBqZ?pCI!BeL7?M8&Y)W>3LCv7U}T%S$pLIWbH-BD+|f zo4|N^dwF-fB<7j#lW5Zzal@-5dR7f2Yy#}}KdSmG+<&ZV&@VDTIbLd_pJQM-;Lyt7 z=isiM?3^n(oa|`ktT5;?l`mCCG+P`yRMaz$OlCtmonJWe>o<-sZ~PTQN~bhBLu;uA zV$^vyro0VioP7>yPL39tv%+IeD(91~8;vq5Cf?HV7cbVaVCXMi!ja0N z5+Y#~6&vBQfG#Z*L-#iF-H5qdo;vdIJ(m2Q6y^3k2HCrZeFyRTF3%)foJebNiX#(# z1;>X!QiulnUXf`2Q73!&Zf*(ZbJk=o^~3HKI()2iXlp9UfQXDa4@PU(X5u~Gn?ptt^tRQ7k1Zn{GwdCm zau)v?74C~qAXmsJH|CF%V)#UQw3bCpU(wAnCu`3p9UZ-7A#4`rLYX60x5m1E^P1M} zXk=_RM{o4n-fP9|Km#kQrENu~G?MH%RD>C-QEg#~GL1;E*ur<6m%N9G{Zcd0C;3TM zl3kSHEWR5%Qr#<3Nl;6GvLF)h?)Ok5euB2@<}olMA37#xSdur~9SZdntW& znb&>Pd#xF}=WN*TET(i?D~EYwkLtfhuPK0slOJ{O*Fm&s!nJAcIJlFjPOA9L)dI`K zx3-1$cj_O)cjb*$N+dOSb(RTviSt)C5wHlD$P%Z|QV10fvmSrlU@U$}z8#WF!BmJc z!?P-QmEK7+6P|rmApALl!bG`X!o_#X`HDs<+NwSigL27;XmU1`U+a6D*E4<`eAVNr zWBg@4`q;0_p8`1&@GPYSqz$uX1X09>_V-koP$|uPZGXADPgB-rGBT$=Qp7n>k=XGP znW4^7%TQmJWRIqdTO+{7b#vo0cnGOkO0|WfZiOj0yE&TC&ywNH@3k<#^SdKRZufH^ z#a|I2jxCm%LJhkWCf+b*($buw{I4AHGV0e{7DyY+c9!1qO&v<|5q)4cf4(&$^4N|| zZCI~ry5lG5z=Z=@IJ7CknZ;@&`37fLne+N4o}@a#AY~vdnv9MqWw+k3T17VNnhG;N z-agxbwTOZu1|F>-QJ#=?ZacS*yqrry#I=T4&3W#1TL?u$@R(ZNLGS#xcZ=H|WI|sv zB3L}^#j7HW6b<6FSR-6UDk&xL>2;JSiVW@Lar+AK1~uHBD@@dpS|0_e=mYOM3P}=C z;;=ODa;hEO(2b4^0vWQmN=)sGFoXg^nd3FiRAMK!Q+n8XW#NJ$rQQb-Vgo{Go$$re zlka`&y@*tN8}Ux5NmPeOeUwk-_P|S|-IC2^>{FG_dG|d`5cPdinzl-Sj=IMxZCX|0 zRlM`GBz+uCf?1?YrC)~t%jT#3sBhoTkaCos+A?|8Q4=NBQ*WfhAAwnx^b$jv5s+(n z3uJ8-(HBWU1YVH7G{M&)JDoZ;p4DD<`j_gLxVa0hgocz5b2O?fFURL3N;#^^zu6ni z-nph^U)zMEq^2w+m>}1ZYRK@pbfdyBM`6%@R9d_7t(>>E2{$JJy>-pht#0~o)>;E% zQZ^@69sa61*@BN@)SAb!V%F}AbQT1qEQX2;viU<2gT}}8%b5fffonoMV>%T$9>!B- z0b3U5KdT-^`89k)9>9K4lj{c@&w8&9hhVW})R@C-?>8?4`lESpHKHi7G^62b4I|Dx zUfEjD8b73}+Gi`&a|oH8CfOU|%r8hF6xFroL0e|h=tv41iDb!5RYjmY(v9LX9N7NZ zG%?h57wv;dvX6=9GEEC_c!7Q69ir_G; zLC<=c(;Alk9_8B2oBpgTukTLs$Po}bZsK~qxjzP=iOud&P5IK(S+*-#(TG;CRunSh zlVnic3#B}@4pc%cEF`WZwb7}+mq*`;(UBCF3T4{6j?hsMs+JhI5cFeXB2r7<$K>FL z39;Yl?VrVzR;Rph)KMaS=`nTrRfEDu0>(d!-!CvaGEDuoiyb70x_&2Fq!!8icP+4?${e;ifi50Agh^ZnOeVp^gkunGhF>? zP=9FGqZ>+g@57jzoWp53BSbp2z43ljjHr}J-Y3E7J3VJUbH*ll!pihY{w`nqlBD`| zTlO7x;_c`#yfFXIm0LRvr5n8)4ifFo)|}R zuhR@{rsU};)IxKVkK0h>n{^*If2A&>Q%R@T6t8SvjXu~^q@4?;+)3b3^vAFDhCjn9 zwq3scU+m>~pHFrViB3CtoOp2_%Dnt{)c<7xcDj%BGqnjuQ|n7Hzc>h!Bzl%}!h~+F z^!4?X{0g%_H+BkNB<5(1j!vbBUZv=77A*{hh$hT-c7A)GVkJVV!G#)*uR&>4QI1^@ z#W3Ae80#z1{dyO~M@@P~!3jTBmE}-^x?9KIY)L^RuIkjbZ?x;j#Uv8g%O2FBhDAtO zFadhHB95EiF8&=l`N4JaHuU$4U*Gy-1I{z+JGg263_?|z_IMX+D`*>Er;>0M-TQj; zn!o#UxOvBUWoP>sF%&0fC>iB-#g^nfV-;#D*X}=I@0AoZCQF5=&K)D~vg}OA));TC zbFJ7i4!+r31~W2=BDb%{)tbqmFw|tq_B|!Kn{&-XS5h|jxWnG9x(JlXj~k4kjr0&hs|&l_OVPgK&hcSi6)mafre`FWvuO3Ci8QS# zv$*j^*dw(I`;T|6|Ld;1azDIj1!}oVF!E=0!ZG)nFv&5pMHKkU$^}}RVroVr262+q zao;XhZgFynBew?plSIeeCrw+(#lc!;V#Im6mPD8#rWAAiMzxE(cHGBfhiYj~E+0u5 z=4R}$m3wu@8FdTBO?K;Mrm%D49vMa+%fa<5D6z<;zx)3#z^^yCd={QOC2gR=px|g` zV~v5uV2QIr+DF69&5u$msz&O}Nc#m$?%H*ijD2l}6~#+I=1_OdeZi{Q#Lbtow5LKv zuDOv1%OZNaNS{xSg+7HwUFb#dtJRm!MTL{2F4CigRQfDjnn(*99f?!~(=R!@p;U0x zl8p39!eg(iU&31I>w8Ncb@13#ZSr(kk-8DNRtgR4+&_8Ae~3yLrZf~Qa;ir@qKsm5 zhI>kudzWd!GAFiotybxePcaZln|Pd%dUD}&F55Hnzn|9ah+yXDSTBa2;>E`LOIBR} zxII&k8i9^GWuJ8IMB^xd182CANRFC&P2ReyVR$WT*tswg(PUT#|E=5eM!MA~H3{Og z_-+M^U=NdcqVOXoNwT=$NqSY`I<}k3;hI@fwl~PGcJ2R2E}Xh7ZmiO8#t_-Z9Z9wV zdEk(-(Ypu3yV10QYfF^X0|z!_;Zh$WJsO8nh$LDtQLK(;UG&?HPD<1A@h=&K z2C3Z{G&JDo2XaD~sCG?!mcViArWdQwYmOJ9DWwj?GHgx;^Ix-0j@~Li*JF|;+cZhx zrtGT~GIVaZ?^VGf~LFj|(&WDrq}QBmY8VW@oW z5(*QoR;R7U?kjyy|NL~e!f`@`>jQ-rUlYZeI`_ca5*RdxzFLgl!$=aPN^uvr$P7wC zKI=?{tTZl zK^SRtj>pq>;nlV2HqBO3?pF^+=z5~!73_sn8dA@4W%e*J=}3vG);0D2x8vcX-VYHX z;AXo$R9`zoWbaNdLf&WNW|&UxFHsO+I(sqD3MyP$Z=g^LS)`^K|?6 zn{KQ!%k{k2p zWTREawnWcM7ZH6%*A*{xwOS1Rb6*A{(l}u#8|b`V+bdUpj5QbJA*EZeLZ21BZ14t~ zE6k(#vxVWXoNmqv!>`u7Xp>D&H~=1#S!EM(<4ex}3ir+S&`q9K(o z!?Qw;)BQfxS4YyEBBE#G)5U+wQTLf7JG+uwqk0H!g>y>vHL&!|D5Ee+t@qXqia98J zvfQ{H1rJS(3>OM*OoCET7dn+*Z|^uampUPu>lHCO#FZrcSlE@%#K>@(rJOiDrU{#g zd%2`T_6r|K&f_x_)}+Ok{6c+fI~2D&|8LDGp)6CuILp{yGW0>mz+X-jmX%%q8E$i@Mhmj(iWvxYLKJ!yVoR(H zlH{cf6*%Qw0yH1JgYpX$N%*J_)b@@?y z()L0TF7?>3lnK{Y6(*g@hhZ6JOwM{&pUB3N)TyVO6_(ca;U*uXZ>ZPeXQ(pqYc1uo zeHbpSU5&|JjHxn#5ua2soeGs$2Nog1hClezY1snela zo&+D=_nYkc+WPtFJh6-41Ha=Bmn@#7Q(9a1RPoRDu3eLNJJ9?p&xbFvXH@H!v^*vd z8x{#;v2v$knQWl-YaS5jMaLdGRTHpj53s-+y$JR<%wPK4(QuHm-+T^e}V(vqLWYpB3>s)cX#3 zbn{$mc{zEQ5oKJI(Wv;hovKqcBb;11{^ngo1tl-v;z^#!HY=r8dt}5;y#MlBW31~> z-frkG>ytj&AKOnu=O0ciJ1geCuyz+tv3G?YIJ4%Z{8e5IlgdSiB4?u35TRC&4pv)i z6lipvdKj&bd9BN=kVc>qP66M#%7m(tU$~Y+o~-pze)zhPB7rPWO=AP^;7weMw@Q?Q zRwk9y8NOrYs;1^gmCZ#(hH9MI=$Ins>%?0}fA=^D&}jrR?$sa{vCzI7JJovqf9?F9 zz8MOlwL_vsPiitnxh)5f6AA}D%6u~MyfBwD}PU5`*9b>quGr=^48D-3xP5bYY zyGM8A?rz_n_@1I!P`>iajyWScIKNRJI$0)@PT3D{4Cns0pj{@tT6Rgx`$DAbw{#|B zRHYrNi!zzAS2~Zq(%)mGExpP8gxBK-EL`WT7T*~GuB+mj_b#PKg@zKYfDo*6&5{5PzJ48q9 z8aW*N2LFwlvVyjIq`mCeOG0X~U*cr_EMPR#J<2ZWN=#C1&ir<$j!e>A2HwW11m; z{)3JCu5EyReiRxThCRc3N`3Rg%kvnL0W)rL{Odt3e0f2&kce8)=R?&en;N0YPgkd( z5pdz-@vF}me;QjEhO>}hZjdN5YH)I&SM$AUdgtl6k4Hl*O;_^L(vlgpJ`VoQ-`}(n(cXOD`OD?tL#A5)LnSV`+F9+(WH@4> zSq`d0+QcqVS65{iE`meD84dZhoLv*SU)0wYF)s`jRa$07qhBA^1aUx;`AqOS)$(@W zv*pX*RMp_>)w|Tk@hy$KvK5Ainyji>;_#4%RUn(K7n_F!QKz`n`pAGxhLV;{Z&VHi z;fz_#t(Dj$7W*jjHKPj5-)k372KeoMTzq=|{R~7lS5HE_sCI4hhw9&nF}%^+X4@9yG`U5s{%THJCUfs2|c+uN`r?QehMM&z5FVCkK%8>Od zS7gvB!U_{->t_E6P~_MRd7#hF2iJJ;!tC<`^5Oa_G2QNKISh1;mke*7=vDus&p%)4 zC&cY=NmVsqT^VA9VHA3J6_s!I3PoW$x#J0^ZjqjaS;btYMN(iLZg$&Iac$xJ{IR4T{zj(@u7DkKHqI{a2oAD7;~ltTVpFn z)xA)jtCXbbvN++_6_?>@O#ejWb|8G^A`e~8w?fNA<`lChrWyQuuMSdQdXr5)M@Lw4 z@@-(b;d1!US7Vm;j_5;1`KK?Wm3U7%+j;tY`TTr_p6lV|M|OLQ{2 z{|U?*&b)+J~3QlD0ufL zG$sriCi&^R8un6zis@{4NwP`AXwBlx-b(%jUDp??yS$qhzXUEXT{hw7ney@OZt4Wd zuIJ#doee4s(N6r+a8ri<62T4mMkqyC#jLwB5a||0QEL+>uw4Wh?Jp408 zBU(gtks?8;7@KZNoe_}}CtIkvxov%>1z8|)ISBNABfLZtg;pb}k&j0h^ z(YczQv}Xq|B!#S(B9fUMxy>B$^ie~n0;<{!S*8|3zvfO@7^`HuOxO^Fi3?lc1rDPq z^i0~WOKS+J(23wt`24Uh*gqTp?mfQqvyzr>GBm^W;}2*R^Jv4)zi_(89VKvOUHJ8C z)HTk0pH`x1`cFF>50u=7Bl53g|5Ffc@zYGe?6sNl>Ps^$A z2>R%S;`1e5-tiJW6(%H%pV6mv^ixL%GWxxv{_-VjG?In#GM61v2-SLG)B{zl&{@w1JrvFdQuX@jv4N1|3o~yAOq#Ct>o1709H>#A%hx1$#XWOTuy>p#$>zgfgUCxn zy|5w2NRY4LI5>Y1zKB8Zk&wLxF@;IoES~q9BC`dnw_bl~soGECcIsCO|67OYy*Bi0 zN|9n??MEH`QLWEXauPLbF?=#OEv zQ+(*wBurp{RqG>_J6nPI@=P`xPjf>>xZ2)}vj4ib$kl#Lv<)$-u(Qc$G!X(UP%Zb-ptjCQ%v| z)0&z8zSCOqVqwLHewLZ%L}^S-7j@M0Kbo3azKFoTyX9#{4)2V?+9qgqOdra_{M;oi z(Pzm1DzY^H*8W7dRlzfuxFYLQZdEr$+W>={kWAVRUv%U-Y8H-eopR$O9Ctsi@pb-@ zpB&S3e;9A6x%#K}P->8+<46ZP(9&L-sae4rksVoFUWsPMhCDTtQ~2ijl#CQNGA>ud zXOJ9`UQ|iE{ahkdw%{C*aG=0{+mxy}g}%J<=r7FXb;8Ub%u*J>DJZVq-rjJ;jxtPB z!r|MJV~nrM&3Ufm<1S~L{Xd@GJD%$PfBZj=Ep+THjuArkmV;v^Sw}`>Wbdrdus4yB zot1Iyy=Ov^k%-L7-kC-CJzv-R^Zoh5?YiAMUDtJ9C|Zhu%>p)pvBA=hO_6&gavi{MqsL&r%h^8uL|`p!pU(OuDht9|@1Wvwn-QCy^OeY(WzaL)fs# z;=R< zV2K<;#0W7owwqlhI+#>@3wQM5p@4;IoF$5Ks)4C zPyBg;Ny)N+PEjN8F7bUl@St04S;BC2iN9t}^W{bcI{kYeB=g!;hKUewxTJ*;i6|pF zerf0RtfHJ;ufUcoE?1gcY|p@E}Zij46jy}z)EW=6Ey`6-3vM08=|=VMUocch`%F-A`PdLwi@|yoDA`Z zkxIkMSq6F(gZEDERlic@9zsd{_!F7?M#|^(0EQ-_6;TwlK{*rLa7kn&O>Oh{5m@+ zIeCtIFEPaRg}`}x0FMpj+v1WJQF6@pv*NU*pKG>;ggRIcJt6F;PD?N}pr*j19pH0E z#1+m>)4^$FB`Y2v)Pi|nA@W2RnmYb#>OZDTVHxaWaaSor}nt?iuqSlrOhR9fT zJNzTNis%LACrDxzLM~$udQBUfAQ%y#<9c`F5YB;_G)P#{HZLgZ1_t|I{-%2=?6x3> z>DX=EB9~du1vvDYM_ywaUi^8EV4g-rH}^J48&9-rQ|6kVajJ&z|JxQOHl)^C=XaqS z2Z{?|&ev|L+?cjmNK9)prb(T2kv0C@p zYZ}_VlJb4Ck<&W|B|*>JvxhVzJ&kdykOp)T#KfW$jZ$tGa81h6-6;w(fj16Z2(Gtn zV=iwvtjl(H?uhUsBWpAW44n&&$?rW#_!`Y#`M3M>nOXp|N1e%M`HJyh@vtP4kaxRk z_E~iGFQ|#X9uZBLALT^ph->7fbIPu9_CweL2=4>n>{E^nk%NA2ou9HyWx+g`Ag>VY z=^miH9DV>(p#eYgM|=)hJYs9sUV>IWShqWtL}DYdw&c3-qYg%(-B<{a3vlyhGZgX* ztdD(nTr6f8X-$C{WX1&xEfI@u&2L5+}_juHA#IqAH zS)p;Y;;bj1Kw2IG*k^oeU;V0o|9GKmMZoRvQL(~v0OHG-3QSLLnRGN}O%dmvHcGW= zo3F%vB6s*yuBi@wrd2I(*^$yZ$X`W|>M$^c9 z&S&_rV{al3|KY4&W#fFOACXsU-bT$tJ93o5X=nmnEd|NwRp7vi0+5rd{;c_cmbw% zx4dMo{`6cMeesJ4a0xP`}x*v6YeV++XQU%amLZv9Y&$7?h!=o zWfZLt)1M*c5Am{w#yBHo^r15?gLsB{tj|%Om}0mU2%Da^w9jHlpWzjdmYEJkBw8; zS{ej6=l^%8ZzQ7lSX(}^0m6$_ztI45sxkYCaKo}mon;OV4&nZON}}h{A!sD0v$QkW zJWl^z8oPIdw^p(RyT^#6ipN`@WUHH%oyw8lu)_-^I!IuKA(kQ!+aH*z-}e$K{V`xD z@02ZZ%bPpJIo+PZV4mye8t6 zxkW<3(4(3g_sCjnup6&Vj0;~}{HibfWd*UU?$3Kn0!e|yz5Tr1>UiwOsDwK|M{7xc zO59_HSu}o{0^uiJBA5~HfaF~OmI^D`1O)N}IRzky0fYK>Zz&i)O8*u;SWrXmU8H&6 zibgk_P;vN{XWIPxjTg)(EGb7pm1U(aye&jqpl)DmABw$MZB@J0W81S(&Sj7}&;zET z)KpcmSib0d{vmqnR2yuDO?o7dJ_v%fZgy~R5U2tyE{SYorgwa@J^gYr9p6hhwTIlx zj7_X@k47^?sRmBxf@(jLRGSLJEr7!oSHo=!&#${eXRHPM=wutZ7@76aD44ley5M>BqBq%R6?;7*Q#sIwbv~y2;Hj)Lkx}o zPke%d{4x8(sNZj;v-d5J$W7d|DQGAnL$xE7vwyIqoVs|28mW*K&LuG!soTv5NX*|* zHWgrCVA$|!OVxDQ{FKk*eCM$!yDT|CxmVueNz;UjWrq z-fwb57htV21NL5se3o|mJHLN3AG~2^mj>QIEzkmXCJ<6EV|IMnxSN?67#x~r zL9hk_2=F@F8K>S`@XRNrY$R`#^3~DD;e$t!1Xp*ziZk>0dGNRFMxL$N}`a~$mue8G|qHpR^kdt+)pTz-jLR;esTJ8qooXf1RBt2QE-rhg$I zF&9-Jt23E#d1RgzWgoEA;}b9_9PsHdYsQ+d3s=t&9JmS}AeG^Hk z#GjIll^IFi45zk6Buh-#Mnw+a{$5D9&h;Py!Oztb-w)90IbgA~Gxh-|AHZ>(fgQ*- z8Q|Y_sUKmCc{^CU4ZJ6N5Y|jc$Q`H*A%-oazPtC_B4WgfG3Sq6%Kvuz6w3!!{6mnU z6}oc}B7PD!}sp^#TBRf$xkB-H|cp$!97`%0{-vrz63* z)Q;I@DLfQT>t}fb# zk`qS4g`cdhJMcFM-mR&P-@()O0x|w;W-UhGTyh>!#4Zv-0mFL`fonq@A~Qr)F8zLh zsex|DLWw|+gDo@--7$nwFZ(3RHN}>g?rr)2heBiYp!>zfnfz7SUr3~OfvSii;ORf7 zKZnyr+JhtCi>u6q{bChaveERNNR_^GW_=Gr1ad$(1h$P*B*?x6*pYcx?Ug%+I0GY| zD*1PkN_1%c^e@0|AAW=%IXe~o_7Na6XavNMpdcK5lkfM>fHnczA#RR>efR~ShCc+u zfspJCs9QV$!ofq9Wwm)~>;812hsJ1V-WwvVxf8Q@fTIro`E&p{zgbERZ ztc_AKk#}{o5G6b+<28c?B{%WdljBz}y2~ECDX=z@TyC6Y&38|F-m_I-_oB;PU-2&I z8Vo1tL+O2gLJ-9<91}ZT{C2D<;rwd4(pc$NbQ$^nUVHaZr@cFz-BO8Dw>t8%G0uu> z@vq3|yQ;GD`Poi39>h#ykFuHPAQT(VqP}-~A7ZdV zv++>b8xZ{501p|1DRpd{Z?c*4UIJLBXbMF6b zLuN)>Rv3)!v*``5Si%RB+Qpt=)D*(u06XInbd!Jr=pl#$VFum+hZO(-ivW7@1ZGQ_ z^(Q#AB3598g-7S6Sg>eb$yc&i?Q(c{ozm%y=lRQju+`xq5kicR@(-8FPo#lXc%n%& z1Gps<{Q-3*;V?|p0BgM4b0N7_i4f(R@o^ZJx5Bel&cALFb|+72E<2OaU^x>%!0AQU zaHWHp-rUl$x=v}!lQE=nkHsQbnN?X)K28?5eER9jUIWAd$?gmyGJ%H|!Jrk5;7A%} z!L_GzEf+O$AMtLvCGOCiIL=I6-oQ#~h_QL9hsH+dM{-5*$?Qcrsy!#Zzn>;QIrd%U zU8y%2(@*mH`%GW1W{ks}f8YaXg@@Nqz?z?Da_2mVpeZI4zNYXLD!!x0TkM;=${bB2+*m)dxc}+>|D-6 zvUdR@1b2Xj1QXXPkd2UOVV}Sj__@k}Q~m^tO%*ir2OxUswK3618Avk$ycNLFi&KLA zL`}G^FQetA1{OT<(#%e2u!}PKDLcYG^1^3 z9OBlA?CHF&U&XLsIiGWiLYLTBAKGg7+alr{?M{wDAin-B; zEEG`rCI~5yuaR3VlH(jR6Y@t_8FD)33Rcu87&6liez~4x3Yu?~ULjkBC+rVOw0|daHyWUj+^N@Ik#Sv2I0IHV7HC~91 zU@-Ze*=No}?e4o;FQ*BP;SBMidg9ayi-}Us@Bb}>X@9F@zIAt_V#mMJf}^mwh{yrN zhJ_4OAp3I)M3VkLdc$C8egI#1oxOh6MO0191rCehacoSl3?w$iF}+jZ@oZinZNS-Y zg!Iz!eqx_vqXW0oVui;`7~86$HPQRqlIG!&u*6*LA4_JBixpK1>icHCw_W*7#MQ-(}4R4ZRs%+QnSI@JRAhua_ijW|eqJBa|IoxQsQboxmv_ zV>utmTxcIKvNN5fCC1k2rrB?b35&IR3iKxf==l+Y!$_b+jr{Bwr9#FPsi z?rKL@#rt;Bu{x`F$Gk(Ag!(S3rPw5Oh9MiEU5$S$TAV^R(n7XDt}Z|!$`_QUt;;iK z?Zi4L8qP!2t9#4+gjo1~mS+53yGp;vcTp z%+9;|0yHMn%@4UY!T98JclU%yB_f{>&LFhb1_!h-#4rPn{=It2=LyyCYF1i8zT+&U zDyxXAqV0ER`$^D&>R6IbS?QeO8E`^aE`|&3$U1*f(!~fD3K=JxAIEMzvC}uj*ktR; zcN^UAdDo)M?OdaH!z1^homio8oT%frY*&S1cJnLVgd9B7N2x$!ZB}$EaiLOys}9EL z4m^=4GE1G#y1?i-_v-!pWnRRra3yZ9KV=@-wP+4wo|=#uZauv9>acO3 z;JW3d5AyYS`DW^JPTuqFq$2n|l(H_himrN@&0J4%E3RI3Edq~1tMDhaG4+#$^ssWo zw_*eyiMW~;4mv8i75s>VP|XH2x`YZZ7vu13+Ld)!eYPg_$2j?{b8Gq z{WOhpt$E~-xf?js1j2AoM0r^3Dq~_~$baQH2J*IHhUaV`+XhibufULGF(h9G+03`1 zcG_i=wVhqAO{UZ;7|guuw^o{rDLKz;{@6v$UeRl&1AC}|)vZq*(eF6EJdu{FBlOti zm&k!tz^6+IqSy>0&w5Y&3kS-$Yc)UOVCYH?QctCQ3r&605SoPd_fgugvSZqqPrLHtSzZ?z;Dn-9^J81oiWxO{s@$B1nYS@ij2`%TRcnhRGfB*E~3n_3+ z;T|j#$<3oCvM%QzkP+^$on$m=zW9!OFSaE~d1$>4Ls~2P)*r7ek_jmp=TCTRM&|S9 zV7PUHXF0hmh_#%&bN!H_wImrv%aA+%@-7&FxcP}s_Jwf=|YPbbw z@A~>WID5m=iVd!^K5`qW-q&)v{(lSnoecF4`8=wssv9z(KFXS2zd4l_dLMOn8}?jkRyC*-uLJSJwqyjosZqnCcQzlB=~WidV&D{ zyWivOW=7(CyxgA5=0ZmJv2ne}h4<&EZ0_wiz{KQ=uwmceFqPQ&dhBjV2{zav zYH5u8=G@ZN#CPwr9mzJM;+VO{{Amx7mOpCsTK>AJ7W=+9E~Wwp^Ueaz0(+B64%`@s74b@ zdKV+y#08J{=B6No@v{cQ)F0CnYieo;cYVqiyfoJZH6{0+L#f-*7Vz#_WgSxn&Irh3md zCM?A`eNr4x=e?TN9!GUNUF{8db%O*d{5Bb<2|I0^w=|85HZ(gpY{f8Pj3SC0Z9_9- z)6jD>aWspkUtFT{g<+)Q=sYP;uEqHqxhMapSPS7O;5LIr`$H?&@gtDr-fsFTw9RCQ=Dw zkj^}aTdvd(Ga4`R{!ply&&ZIDr7ZRE9?@+wrLnQexKZmk;1i;*cuxuaQp4>vyER^h z&eY|XR%6w=gU;Wlwc2LCuJP-AkpAW#(U@j?%eJvs;>ADzeD0&tY!|T=y}EKcl^1m+ zO@1pKiTFOKjMGV-%%@g;=w4bCx44YVtBpi_{fE~jLeeWQsM)YZY)IKAb}Tk={5WeR zjFfcxSKN@}@Qzh%<4qqDip0%7zG@9>`woTq2wNE6V-sA0nGbHQ=j}APpkR)N!gnV@ zeWK6u)TGYOw~zCe{8^{45U^N4_ed^7I5{e1i8^s95)&rz(=Ja*lhXo;sU#?KT=-t| z!!Ur;&VepjTKC*W$hN-nuw~8Ga;^uRhK94T(*&cC^la>TQQR>n57}LoY1T`x7YQ@g zIT|OH98+W-l`puM?B(2i`4}l0#YxoTlJ`KvnsFknU#!UEP&NNDK*EcQ3$^`S-crC| zQt-lo^6fslTHK$u2p1$@r@mUVHL6*)%gCg7XFF_7|(3Z=XX^Z+F!_QN)Icg_p`*BQ3w-Py7)Z5tNxx-AaH)9wtPnN zNR0eA0Ou@)Xd<|@aI84c=+U2q^$@%xYUwzkh{$fu!Vb?@j6ZXIFJ&=t6h7bATHHq7 zt%h!1+!klrd)boi^HcY8TrDgJ_FBChCW~z~BTgBLiJto&Bz+o-3CUw>uTmc`3&ON? zemVSFhbQ`kD+tTsL4sdLo$jo#pHQGS`{BJ_UP_yxx#FDIE3(pNdU-LbAd<2Klg>Cq zp)J{&AKuXm*2xnGe~utUl9bO+cc&Pmbdq=r#c)q<#yM#Hci}hU@hH156A{!Vi^@n& zePcQo?T&=~;lAM?ZS#=R)O9>A+-Q_VV4o8wo}uAMA47Y=&g$pX=O-zDueBn> z(hdTh?uR<$r&1?g5LGF>gE8JGv`LWb@uoT)$)>m^wG{^|Pmc&H$*3p%ziaQ}fk&K| z8Y?j&mXQu033VY6jgT$*5n0!(EM}Nun1a1reb5DYMHP-`Mgg-rv&FT`4u(9ovZ*Sm zPWcBSka^d1IxKd7gem~OiR_#D5|t$ofDG+1uIql46z+I?Gph|;Sb$U~{ZF;g0?@Y* zrWBG%w1J^{kQ-csYCYgYwcq-!V;3^}0A=L-eY|Paw3%J!gMOLp_>Po(9&}&39)D%K zu~qh0-m&E0aWCo5i16Fu?vV9*z3M9E9Q(zeA(=D$fbvYZC#UjCY)jf>+PDyFi+zlklt2C3DvA|B2vdY%j}}6xhx4Lyh)@_z zUHc72CJ6n!7%=ah!y+1?&ZbLAv$4V-d3vYc#OnE6XF%7lv5>W+)ETmi#ZuMo>q}6Z zAwVEQ)^%V`u?2aDNk{oL>Cu^&R~I;dG6x_I&pH-Da`B8q8`t_F4=auPnN4INM z{RENhp&%>x6qJ}idVzisSn+l&U;NBDx{7SaSFWju(2JV3ZVc%lj}GIuxC-- z_x*1?fo3s?nDhe(X_uBPlzE&NY^iM7_!TUZSc^`^O0*0A$ zsPYGZxcUlfMLkhyLt;}R7xZHu&hn&OniTd ze~pv!{S!ta5?dPB+AggZ(M0X?TJ=Ab!MR; z*Sy8FzEba5n#Wv_qgOoJ(bDGRtq0|QKwaVD`kvn?gIzW;e!v5ajV|>9oiN@S19HT# zk0_Uiqzt2~rUv>0FkDFZgQjm1Y@zhI&KGdo8we%D39LFtq^m}WnUS#-*cPC=E}*NY zL>g8;Yyl`js4D@+sAmDp48RuL(*}BSA-p=kYq2mhi+yfX$;i|Tj0FFB=zt5r>NX&? zfCP11AckD*T35MUi&qwln46qMGD7d$gmONpbsM6J#Lib|>1Q84&GEZcHgLog6wEE6uRB`?3| z@?V$U#P!eoX2gk7M|gu+zCNwUSoL2$8Yltf^e!2}v9OBm+I{QcA8R2%kCEOwYd5pS6GF0Bit`tbJ{*7}2| zUS9Qazej>Ks=v#I?t>)KAhY2a}2nYN5T^a8a-07!g8OkiNQhBll`o4+76ehx^Q zXOQ9<#1ewWwS_;pVQJP`^3Fg({1hmyeL-nm@>*%4&Hb zBAScAq{DvL+z$9pcbqi~pn8XLkHG2!Gy`syJk$F$PS30Q1g^r12pey|Gx-&M(F_a3 zv#GX2Jfl&%^$0iy_76fJu8T=H} zpxcP+xY6D3T>6))=MEd|%YCi&m1iOYIiAOVaM+(aD=Os=0%4tsUS~36qgYRI~ml8*3Y52Y;3jo4M^|p{{SK+ zUL?T4S2wT&LC8O#GkdzNYsHcs8}~r2-^Tb7v<gW@WXJD@Ru8?OMV;X&1=4-^DGECNj^P^9>S=Ze3^ zit@P-F3TQO5&jlBjW%PLLggaNC0H(i$pB>q5+T%VzYfg*^wPndMczW@5aE7Mti3-8 z$1h%p(jXvYs;YUbG%f6*6XcJB(hQsqLLz#48szdFAH(o%(s~!4zMmz8aUYi>NHkF{ z<%5N6dTS_t(%+n%$h7``oCF@(VAVQtHbV;bNzL~UI$wPFtk9u>NfB9lcr)40wUh7u z-?{aVH&nDd`)?U8{995k>+-$uMvq97DCQhIzx)5fbQ2B=vI>^e+`!cqLSc-1E<@&!(Qg zG&zr06c$bU_QulmL+>!q3GYKiu#~E2HlW7+9UKbY@EadsK_v^kLkd7bU)g@}sq3t) z>pOUNKh-j`vI2En<_#dh)-JX_2nrWjze&z`3vbI<3fLYx&nBx(j#-tUf4)2fmJH|% zK;}Bg0hi%a39TXkLVgTk!~sy;1bi(B)C#Mi!P zGm%M*oM_k!wAx*~U%a@0{uU5}Y~_ZKQ&NbMz_{O<%_0i-+`kSTe1e04wK2^nDmtd&OT^OJ9TWI=TIYEvE!iCNpO~7s3B(n39j}t`8BFtI@Zy;c=pl!Y)rAF1DW> z0r;{j9F4}k)gw(OE@#&DXQZW;KigA{)$j4dqtpYN|EeRlQfI%WGnfjW4IjR8S=rH+ zF4C;QMlv5fL>Gx^W_``hNT{Y5ZqC6!y!H&prz4s=cLap7o|Sx{qocymX=-~WhlK(o zOk|Lfj3|)7AjE6n&;i}MI9tj11ARd?(l(5a7*UKJ(IsLZBEbOg`|g5@MEh!9#3#y~ z9$s%kGGB`;SrHMdlq&!ci@$TW4!IwutzVgeSf}{Tap~x@Rne0_u1(-GUmP3CGhrR= zGWrbkHWuMfVcy)WXg>m%H05!CO~ckXl|kTj5pYVI(A&#oEl6Z?+%a~2qK~WvbTp>Ywe)H>vpsiu*b*% zUjLnwnpfay(*|L}CHTLEJ=-!}Yz0vWAca#~%Rv->KsX23eRCiyatoN91$FwTraYHF zfb_>pfSxkvnUFE8z;h&7937uNr0qMvLTmQ)M+A7p6!wFz*PB#Gg0P~my`pUS>*mX{ zh0;zimK+u)NW`W|f<^`-mU2mvOb&Cu0=eVx5KG*Kd81?2beFU@Law6o;038usplAz4)^2`7 zrYE2a2v{NjpPm@Fph7(GY>aJffIe#w!8!jmbw98A%45|7xG0(N%0{4 za(vs&kc03Sj{vIk5t$s_`7Yo^}e^YwnhH&(h%N^CV4<(?uf~hxn4B}LqRiND4P`Lc1 zpbZodpd)MCb~R|2&AtlLsrKDdfPqafE;8Ssj4CuO1%DW;Yq?6q#DF8EgO1g-O24b4 zYZLU^Q9!o-n^iaY%26{tS1}r{Ley7*bn{ppG9rjFF53^So%Pm?Z;xEP6T{a*=Wo&@ z-AIsyjYdv!{4z+|{oh0sQ}A)8Gw$^O$%UqbPg zN>|8>9=Cj|6}t&PFF0MG&@fnwB+?zUtHknweY&xF0~MO{O)==kkbQ1t{{eFysyP1Vy6 zKj;cu5bv7|JZx7Nr=!5?3Kk~uRz-|yMd}VyAawQv_k8uc zkc31k_ZV>|$w=BWOsf2^FY6sQK#Ibo%@qtHShx!rjJH}?F}{o#e$LG9sq2a%3 zROmgG0)7OVn}?TKT8&MGC#vDn+C}=CJ@JH`f~CH2ofjc!M~ZL+^CUSjJkIR;;;J^b zdo9}rNcJH|hKfj&svvQE*kG+QQ0mkX+NJNZX|9NH>*?J_PStg9S9s*Ie5%PWDZtx) ztDU#}dqLr}WmFzi(IHJccwGdHs&gkDaV%EBvkjHFvNrCDw3{;Y!M-ub|{YlOO zQ#XvMjej`Z48;3dF$2L0!0_Swk?T#l-}3l1!RB0^@9d$_g9YS2i-K)}@qG0zzSADr z)g`~^%o?`w;SLo$c44*pPkCSgLyvcKRS`lZE%ORfOq`ba3!>XqN=m6YgRpL7&5IUZ zCI(4Z-gn`kcW^7kpJ6a}-Q>KxXv_LpKIL#>y%7zrPiMT1_pggxHkhQQZ*CjjmC0@y zY5Cgtzpk-3i@85AN|k8CsSTfTfop3zD%FP=cPy11iB`8)Tq;%0$EVR9lv|_{ll_Kd zGL<_`FC1(K=8}H$9mwI@L};o_&6i?>q=&wa}3U==Rai zE)>=r{Zcyj+jaI#@3&YJ$JjPQ0&;Lj{~`u&)NvCg0c{tcK?clpW}kv19vGQ@^amt1 z0)R~vYJN}srL%SiA>I=KmeIclE8xS6e@A@VPa$LVE7@Hs7|5hN1ydp~fUgj0v;lBU zupcbcg6F{i(*PRWA%`^~vwJtxMj$r|VQ1~+w~TFzz*cb+1o^DSsi2Lj%4!w-v81)N zHKfo6Vl_I^!y(`<u)AlC!lNs$QeM=ztdSag}n_a}T@mc>Fm%WcqcI7RPP@e7<-z!S)Bw^y37l`NS;A)I1 zxT#~*`*t~gMGg!LXH!kuPw*wTB7nf@EqFr6=ze9Hf{vu~h0{*%fG-k|1ZCFR`Cm8T zoiS%eJrna@(q8|le5y+W(^HQ_maLJCBkGbSwa;78->+Uz_Z#EbhI!w@J0!7O1qs7; z&>CY3^fSf!kYpDaV5&e^p$1oqU6>6&A2M?-kq!P(ryb3kqljR%BRg9Raf~gDCnDu} zpL`#S7VD58L&BMbVeAw`&zY;1@B=yE$?0cR|1Mrre&OzKktURK#LMF$A+316{-BHh z>S!%DnZ~8KoH0raOB6NqY#pmI`&9wnQ1@%X(SY5GODZ8$^I3mQ%QT`S?S*c>d7)<(kdCpu0EsR?kM%9DYTKQlMu0?97L}dr;MnGhzOs^&;E|JoI}}(-P2erUJLUu zz7Ky2?gyMzO71@U4BqM2bXQh}sAiDY2eTe(@dLl0Qw(q-1sq>pV2kB<96S#XYh08u zy!Z>J-xZ}=6W?#@W-U*43nCci&;G7_vaq(5WuVEvGsjLWLvt zHM!*;X<1cF(g!xhl)#>j>$7jU=WX7}yxGpqJ)ODSK7Jm5jfjfS(+g(d7fC*}8Ma?8 zk49N&qq7ADsxf^*$*(x4=jWv3Y+IQ`d#d)(Ke(!|mVg%)lQ(4-C^=8bBsKesoX z^5xmuQ(4Kr)icQdjwZeB)}HaPA7^fR8zDT$CjF>@tqT=`oR!qk?;J zet3+%rVg;HpKoZOnENBIfS&%#cp4;y8g0O39;Eut{W!R-_*u@{t&zC(q*q1k0!}{- zr+;~!_N5O!v8Cg>w*ot0^O=zEWce{%c`q9-`kSTpM@Gbuzwi52uIHG+kc9V zlV4|^|LZ05oQ)F+(5&}6CsfeLN-gG%{@;~roc=WiS2aY0eM@b}XQaV3Epc#Jo`+#v z=zcvEXDpWZnqtgbYB)_fFy}jVoJQOnnN%4Vn1Q52G)hu5F?T=dog+%JA;s0p`KQ3# zFVOGsO@OeUB4+#@3FQ+9%5Dn(8;VU#`fn7ww3s;^LhoK(-ybnf9OnIsb+snJl5;od zYj+HZULC)Z-14KO&cKjBnK5L81^%ZX$DY@Q`AJ0#u1o^=Q|s|qsT=!iMvdKXKCsH(@LPC2 zw5(Ke0{X5cb1si;Ezd>98>ym`U~$}nW&D(RoiAFHS9#x?rr!579G`}`M3M5x&t27z6mE6w1a(X%6kOT!K0bGzc74Fy zsybk&t?F^%l=Z5uk8V@*Wr*)bdI${$-%{+;XuavnRq;kUqajQwPlty(-ZRUO0AnF$ zN3#3#h*lU3qJGkuEXPJ$zpejVYuPB}l~>I$u;7bAz!@zHi5|Ac?SB~0YQY4}+9y2^ zSi_(#Y0pc($Nh50lX*^FFagt76R52hTm84bYH3e{6^e?&26BuOBjI>>Keb@YSDIy9OEzG`xn&->vHzG%o1RQ5GGvO2cTET1mqLRVu7gQj+T~?P-)xPq zA!9H3GCb$Wo`@nP6h%cAQ(%j9>_r7t>2U=5S@GC%lmPQ{pyOJ6w=(~MPOcEQeM<{~Rg4wh} z$cj zWf}gTqs>8Fzu=q|ZJdZ6GF}aIH8qmcheDp(H@^;6*p>5Pj@OFdwJWty!08;$-jt?2 zd=||e&N*{x`7^OU-`9Pah+WJVv1%)Q_g1?42$S)K%j4Ux))txcpsNC1nuQT0ir~@vjN6M9CH~$9_b+OlNOfKU4qrcz|ENq_@n- z9MTxr5eWpZc=ZHGx%v%xQwUn?i0;xf_JfC`dMivuT!b6pO5^hF-!oXIt(XGyyX5@$ zaoG~Gs6{<7@|j6vuZ(fdYR1?`GP>2Z`buURN`#)mhNe!!*{-#Rv*lP*V>u{WK}X-Nj+k6nLm1a>_5OjyS>6dMn;iSf!ZG=n68?_&v24-?Eh z&<94m6jVxP;&-}YFX+tc|JB>^ms;7zwmRC)Z?(G48ltUYF^DE&je=HDJHCXhn4OX5 zO>+-1h56z)UmMeZb(#ItD$nm6wf*mh=Eq^}Kd|QmaMPOqTS#Bxp@0Zk>}FPEWS~7c z>amtO-=Ms>TGST5bBc9UO4_J7Y!JDfk9jAE%yUs&h$rRMCH2zB>8bG1E3VxM$3xTE zW5}@n^jJh+T>Uc(5BDsb#wbwTlvdj7m`NB#UW+URF(TWGoq0F6vd{fKZjF2o=|@-< zJVC|`PvBy?mnAUH>|wItavW$&LfGL*2+mZ`jol2Zr6l1X85Brmy=dD7o zt4c;Fo(FpR?3uQE$gx||l4YOq9(=PI==m(UNQ%PfYZi>#3(*UGdzjnW_66tePg{cb zk1cQRy?7I^+EFSXh7tHSvkll& zaqBGG*tRfn~1~$Gamu|Yue8J4-TFfa;NgzlMP2n;T5Vf zWu{G{5|7DcEMI-D-j+h#h2?j%N9_h;O|*na)n>_^7afwBP8Xh8h!wtF&XJob-|Jq| zbg(+_>N?N1=aop*d^!DIyJcWLk3CdJaoEDvpt(69gH#P8Kj-mD<6K^##Q(`t*!+(V zw>ya!Mg^REosV$ZWTaXab^iZ_UD|o-IbC@leKdtO=PH+~lAPl%hNdG#R@_ueBMo!w zS8LjG`@gg;K=HQsF@z5c6<%~ny&V$K6-K8;v z=11#<3Kn-@pN~Q~f6TZw^_aaU9@3T?%bp2fc}QHqW^&g?oNhDBg(~)gmyq1Yq@FB; zFB;-8wn8zpbRcXy4>9=MO!oir^p-(wc5T~skRrvQNO3FfQYh|j#odc*k>J6lI23o6 zV#PI3oZ{~8?k@S#>;9g1hWuhClR4K~=OJs~wVV#?&No76{T}Eb4&Suy3 zzOVuzubi=L#)=ZV-5FTo1(xA*GeJK3Nfo&Nlm&jLF zbgUP~Tr}8BC`-SYM2AcwF3k(R7z}4eSm-ozi|(JM5b(w|ddSoGnU|(*Ad@#!_AQM< zIS|MY{)%t^62VeKK_&r{M4hL2Jkdg9Q@$67o^FNB)kpVfFV|@x7iU~jOYctzydrG> zkoumWwynZrU>@?pDie6r1MeMR^{LfY=R`jExHH?uF1xfhYp;3cKxq3YGBBh zC~C=Ib2<8cD~rS-=){Fy0@-MGK9%`f=wJ?6D3!G#^t}|P);CNS&N}kYLbHk{Cw!*BZ_XKiCI4r zTftL0w&yo;%(NqT8vmB$w0rZD<)`szYgo%`W=EGb8*JM~u*UO5+d80YbMFj6-kcFz zItcS8#SB7PJ&ua%2)LR0Rg{a=i|1QXiN&d;)#`0~ZGtPkbl98tb#hbf-k&?m<8{?$ z-!DTj)-b`oRk9Q=3X6BOA%#`g`-aa>}rc$#iEw&$?X!G~oz5*qAWIZ@l*> zQ=y*N<(}X7Ye-vY6K2CbQRqL>LUGPBg;KLh=>!=jB&M99(nYCya@NowkxQtlp%IX* z#*%u>0f=MZ7d^}^<){2UH^mOUZAYJDBq3%{*uLOEWxDn-ke62`Xn z&VjdN^qVyd1h{3ASR&&l}>cijKo)#;|;a!9DQ2zINFGYOcB=!j4d1O*TCOp9a z*B=OKVx=F$|CAD zl(K%241f_-|L{_q9{JmkkEsdN`;f78e0%I#{Er-5y>Vj8%I`i@Fn zqF7%Iw*3#>zoVEk|1YbA{vHz-;tLj z@DIoByWNX6cQs_yoV^*35`xyFff2_DcxiZXzb5&mLj!npK)h2|rrsdBHW|K1UfcqT{l&G>}MR>S^Oe9M>;`7{pzS|X0 z5#cYSWmEpG#!E5%Psg>GYc?wBijm3+(!X5OoY);ya4`HY(awT}LkjEh-7_Q~?3+i+ zE$fcoMFaRBhhlrGUP#=KxHg+LXi^s2*#F9}Mw8RF88Lm!6A@@Rw+5n`L;_W#BhV1CS%JjQ0Avl+J zY>DL^lrN2x?lpW*BJdZ~Bfl5Wc|49V8Uq@)+SA^Te|-1jz~CJMBHgMmZTmBeG9&LE_<>e1ax9aiwM*?JiOE-77V$;91VS%Lsbc zrt$XxVB*d%+MD8TMB4oGjhdRDwLb#}4%nK*7y$l6D;u`+_#SWSrC~`3yfBoXdc*zh z-1w&C>C-+w9XRkDZ;_AG-U>;sj81g68D^R2+I<(S6PF&Bq#IH_IP>UNy&@i1ht!^p zVfwF0$AP9_3L*jMoEoE@+(SOKySMY1c;(ruC|Dx#wYrq5S0|6(C&&%h63I?7`MA(6 z*Xi=AXBHamL2H$ACaD&xm3&1Q*z9Us*#BM@cn-6BcR;w|B|2f*WOzSk(Jx6}HcZU3-mztti77jNMEQH<#!`T`sW7p3njw_)qp(^K;D%mXl zEMw1+1}70k3cI2)JF=o6HrPNGa^v8W)NrXKaj2CEi-_@QkctcTgR_5Ok-2@OTWwm% zHjJvz5&l6?$jYkPUq|H*WHv+?PP#M_#6=9;MD(z-Ro-)Q9mXVBJi!p%)p*qpSe)bR z?1P)-bpfb|=gw8XvkM%abc;Ix1#ray`QfB_{`^SUF%*}B)vKYNyP z{wq@WJKf@J?cEXfGaCeQ;4jhI-q+b^+X}So&OpfK)fdVu>ObQ!a;qT(kAzlxYof~$VkZL6*E4-*g;kU85p3c;ac}O{nJNO zzCK=!gk)Ww5*r{;OJjB?+w{Y%K+QQq^y?_`uL9{-tm6B+9yP4z+r+*zwOPKne49^| zFCO2P+*~*d&Hck&Vdy&;|5&)b`vjlC)E4@3t);Q5l&l(c(U3>y3MW|H8#k@(+7exW zDJB;_S`S2a?gE4~4E{xGc{{*kvMz)(Zt4Mu43=g+n0r=z9B(j_&#FBRY*=PKm0>Or zA&jf}%uoEme;_Sr>YK(5r;NXTSpSEuQ4AI>;)(AbxW7U`$hvSS<78 zTp9MMmC-AVy^|~aD~bA|dbtV{cXX50>WujhVQT7Je@0O)bTDd{`+xJBx8~6OEW* za0zvp*diWigw$$E5M$Utg1faQLJT}F$ni{nLz@XHQd9aM9}mzWV; zgf4RU1w{d6fAdn?ufIaN8Txwt8?46#`+!bJD>$+_3fN2|v0|SP?^f04HAn{(aZlT( zP#vgEmo-I~e;Uh%Hng?e?-G2kZ*H?~RWxW$9ZgetrS~?q?cJ*rK+Fg1?qC zG%^R-AbI+rix3Z$V98_7u}jJzU;gZVyNEOu?f>aJqDoAM{Q8c&F!tp7_IXKQcte%jg z>HG_<9BSNY+-g$veB{Ub@x`3)r(fOy&u4NidowzP`HlX?k%E{swG-eQ~EwgVvoru^7lksPy zq=MeiApY(Gb1G%!k-?ZFO#S_u$5Xg5WVLH1w8@8A>Xw3pQ0!!Veeh02V0d%et=A6= zymE%m(Y&Zmbw8*2IcUdJ(9-9OVVK``6UGg0*6sy1T8YNB4M~?$+1RMNM>3J}0a9Vl zh)Am>9p_!hIQC3vt10P2zS2Q(!}9b+e{#$FhkJ_CFjP_MCaCO-2o!)`jxQwA+G78b z=Q9OjJ5?l3LHHXmpo(?Y_X6W?MBR(wU+^cv>qd6|m5{+{lS^Q{=MZEwvBFoS+=((J z;l@Q8ix{*?Q|Wg}a^tk;x40UI29Q`Wn^wqvt0(iENqSz4mf<4}}UFe0)~~T*irvh)Hy3UO63^9}UD+@4dU=(203#o|goj;7R%$ zN0BQURXvN=!7jX+;!&wY&EAqDZHHG|##Oo;Ouwkn)brlgCSs?94s=EXf^_d}^!{A; zrhF-#N>yg+Z%wD>)R3pw)F8qMqe?()O_J0iM&v8lZF$rCTOjc74=%gNny1d;Lg~Cq z5t?9}iyv?!xWQVjcumh=nPRW#Vy~JL zgnOP80wbPh?N^#WbI&L@x%>E%qfUxmVIEK&{5;`V`5@hkjb&a$p zBxH>rI1K)Kld(PrP$%6pzN6Rh?YxnrtUv=m^*W%>=lGjsIJ4Ge*)?9mafrz51d{RT3M9QGh6iNUnOFOgP=)jGUn79hZoRrJrBT zz{$@bwS&(FH0S^+-aqU3>=h_qj$mzMy{HzwJO}42uvKIR*g<@*HsMY9I59wo9O6Q4i z2Lz6c_gs*y-ETY^$nQGdnT7_7C^QT^T z<*#%#y_*xu2lQyaYV1hWmoDD|7_jQvbJD!gc~t_Q5jOY0NghM6D++<-H9Gp}`Sg$f z5Mpo`pow9_w<%%o*Nm#>E&e$%WAhIS7=kaEDVw=kx;h;q_W zq~Qe_3uF&>zvI{u?DATfN2(9(d0T&e6&8TJp8K7}3LPd?8@%0EzCG}--+~!C-Edo8 z!XU4}G023lAyiJP>^FszbGnMP3ecJ}@;Zzhd)+m9>VSGr1m{m9owtaEudrf09vR18XP}0Q zDqtsVKOKk4q*ZbpTlB5=HJWeP824~SF-*je#8LVWecY??@A~{ja0=7<7GPbCIypMo zybE%J0d8l+e~pyp)3}zv=rqZ$;!5_RvcE88<*w(6*gRAE0uT5*5Y02#UpB{U79iLE zwnY^9ne|NR{P}RliP!aBzYR@e_pAlBhbA*s@zLb4A4S|M-D9IG;M`}QUvXL=ssr@C zKkL{GC30MH>0#no^VnV^a#(2so}aC@-9tan|Jqi!jfE)kf29zJ_#)F=oWHuelLb}% z?G+idp2!=u?hFaP1cz*jBp{Yqjm-!>%Eo#w%4b7vSwUy*Jdj7YGw=BvuQSfDbW$%! zo#BIv@bzBj)3ESkqOd3AdA-wed=%g3rsw=I0| zUA&&X4u)l4|44c1euLWgwuL=LSI@s6F@ko#ZEYiF`HnxYZKK|Dsl0WGpIsl2`H*i1 z)pPh_2<=fJf%>#c8CrTv|IghC7JVfqqlY!vn!iH?5{wBb7Kml z@0LAY2(Y707bHO4h}p#SFOtAYu#g@Y=DgJk4==aC5UXPGRB!w*|Lh4V3?Gz&LFn_= z`&SOjwbORmEq^ZhdH(LTEo`A1nHX5Z%|s}I93&6+Seyqxp*dy{-JgMG9bc3%_tXVP zX2fA98l4@MyUjUB2Y3k_97O=hgmFUFKVud~#x=&h$CUMNZ+{72myMrydahp^U3Akz zUlox3m)Q3ss&LR4SW&`J1O(rnIuE_Uf}XllUZ#A{-1U(}FQQ7cSOcRDCm~DMY(duo zmtqliN-_|YjrMAy?%en9P!H52Cb<6eG|TF@$qIgTT)W&rT%F$DT4|hIA@2>1O6+=~ z*k3s=$$qW?wx3p#y$)cs%|LE`D+_Ny9YN2_YwXtcyi1=W9EQ!*gESH`MDTMrKOGq3 z5W8v@sD}H+U)HC^+B)9)n2oX9h91K~M@h*Jw*T65D04T2 zB^9zEg5A;kij`^12Vxk7pykinCI1>31KGFCKH1~Pf16+!jwVeC9d0}U&~i(L8eZPs z0E5&6g18FtvoyNcydH<{`kc4J9Q7x;_z=Is?K2H-g4hA-9;chLdoX0!=-JE8UK_1H zayUqoWLq1TA72V`B&(cC6bhwk=M*qIuCsd$$s4}J$NCih{-zE^z`O4qTKe1s#>x`Y zq*Ozpe^w3|;rcGO_xfE-dmE{5jc{^Usfr7qfB zS-F~OjxY;;Psw(?|1@uzj7#W4C)S8Evco8CT$qSl~etWRqcuQ z`5tKhEfxaL3F{p(6X_;f+AKe&ar8rUg~5L(Y8_v5@1osyO--()sgoh8`2jtKm~Ydf zj5HL5_2ob^=gEWL@MUkl^Cb`DVN|Q>68vSPIBY4C<%~_sN-$Zp6roJEuy>AnW^&oY zp!12x?|N&P<$0yZ$h~azaqfEUTE5!ju=;JO8tU5iob2Jf42*?bZ|B_f=0HM>?2?;T zF0LGnd@u1?Y%0aRO(uMGY(6YL_W|CUk=+M(@T@;&f}W=#HNfUmXkX|81gF<9RCGmZ?Y_)vu>BoJ>pf7L~Eu-tx z=`;8Lj2@Xpe882kqs?Qm)UVZr%=FtHm07a1m{@q{yh@0gSz@MEB={mAkmM_R!0*R>S-}#NG@1(PE z)#=;f_?CBvs;Qm{t!C?_pntQV2>zK+-db%=8E*XfyGgNGD~;~afyxva^w62$XnI8h zEI6<}qe}7DHo9`8sl((iaeZx2&CB@M_f8>#TGF(hAvNRjprvHK34%CWN9X4APhq9B zzAjYjWvTc2!}_`NyR8!skBK&Yd>vLFu!deKT$gk5&&5wQWzYka-$5P3XY!>nOWE@% zR#UWBG5iqe3qRIR6OOc*pq7Zssp0D1cagfIp5L2k<@2h{>aW)>c@VUZ38DlfaUe#Z z=Kwx+3n;E)3|Kk%2RaYpazN@B_R;}f&J^<1cqZcah<10pqc?$FGi2gJJr0N>LAwBq^R>W$CCf45j4W5$G)Wz( z=+QB~xSWA=xU8;a0#4I%iuCwQ_YfWLeaLbMchJQm`r>K3<+@Qq(H~=D>#5I*NYK_? z{clBj&km8K7Tr<%mHHmO)Kxs@wFbKb%*BaUUxnu_XrxmbnHgy9-}Pc5eA#XOBX>z zm?x(f`^8X%G{J0zR4k&-p&cd0F2cn{|HuEp-k5-?{uCY?$xYNu2@N1ZLsjm@L0W)a zF4|ja|HC|v(1KZjLWX)%1HPz=&~|fks@lN%yPKKAEQb^cMmRFO_owAco zSF*S-eNwDH&9vchD~b=jt%*}<8b(`5#_k_x7FcQhncOe0Sck#+iAi%TV~(qFj{5y&)5v|Gk?e%h8^B(iLAhUO%)F(_^Kfj zqhiALA%I&R^Aj8rlHl-GSr>_7@JueBNLfA>GCK?=l58{{vFhwnvDCsSE&r@qpcxx6 zHlIU2e}u8cQIh%}Q#-XO%=A7<^ib@;qEu4}TyhB;6ZmIsxD?#c!Zfz%ZUiSAG&T>X zK-->BREIeDriQe9uI7nKNU!>p@%Gyy*34FVqv@9k@?i2WfQIrF!6I{~1VVE{uNo;H z6W?JE_2xSF#eY}q?v|0!eQ$%Zx~oDLC>?AMG~H3z~|@_Pee(es^JVfPNRRxg!2ec=g1sV(+Er?|;v> zCY78IsYkZ1qFhm~%)YW*WT*~&usyO$a$zE>$2Xorv` zz`rXo+?ZE^T{d|!l3Du?F*?HSj<2BQ;Wh4$d1Jj|%S9uLD=0wP?<`P24{R3_L_Ag1L3h$aW)rng#{^5z`eB?aoAE_7;XyrmD z5OHMgnHF#+L>Qf%k}QT~zf8HGtK6_%>K{F@T~6A!Lr%8^6}tC@@0hTKPttB93?d4J zh}v7saq*R!Mg3M(uM|&>!e50K;n$Hu5*3pxBSod%?o*lnZB4F(U*gRn1K6bh1RJc5 zJ7m6RZ;BhIJMpQs0ZX>1sv*I>J)EiJW9AP6Dl3+${?a@t4ovJos^S@|%3?sTshHdt zfTGA@nPz{bgn+`l6owahV)PmPj~zEng}0%0G~9>g(e|-$VX3z#Ql}kmGJLFLRD#-MTUuJi{jTaXiYULY-tuI(`#LzV!5bsc(MebOt~m{M z(AYf;@@-|fG&iLNd7^!uvErSJ@PlsZngu6qFirj4=RLxa&sfr*5$|3P@A05}+c;OJ zS7gq!L(MVGEPkr>J$yKV)h8ORK1u2MaUzVADk*}6WAs3194%{qS(7P zzEB07T=BN%*|9pY;XbqGM`VZv0i@o29}1kwF??UTPnGtIXbEs4ZWxaHrx!iVZJM~R zK*_mFJnpsW?75d#$az*nt7r#c8r8%?>d_6&u@43W{pQE);n9@h3e%it$36iDL%tNV z8i79i%o@AW`tRleyBRlFj`uRRi(b(gC$dPUWgXVzir!Vr z*FDN0&Dzh!7E^_g*FT+PW23^)AB8!Dg?VI=0)MI^g<<(OKCTOm>X3gq9Z&{E9(HWR zg*h|w1ol+QvbVjR*jVhHeQ9y@?S*N~?1L8a=qYF!fk6i4$M{Os6NlZ4!=8!Ec4O)8 z7KutH>6!=6>q42S;Gmw1Jw6!Nt(n|z-n5GNUhS4V3q~7uIc_%Fj0G`9%sJ{CAQD!3 z8k~hJBX`)q;GeDxgcvsBe)p5?m3M@yQEVkYkP<)rz?8A@SDQ^t`AE;%3ZS{W~?|&uG2P=C@l|f&c?;bOKxNFbK_w5>9B$UXoi%WPb-GRX|p?I zIxT}_9wUUAkc}-P*7lq68H?%Jbga+U36r<7_P`>u9CxP|9>$&~T;wUl`F4|w_CT!( z=6Z6EqFBH2D)Q!Uu2MHs3=p(`Gz`9qe$MoTAg^hXZrUowI4Rw9@H zwrLwBn3$cv-n*K35xti-4KOK_Pb!Y!+wr}Z&C;$0mH+$zfor7R&}lNLiC($ zX>!Xgu$p!3VwLp`ikR^*iT*t0wFV7XYa2 z4{@^VB!@8#%YE}Y>K*wYH5J8K0Wj{Bl5@Ar)R{v|DFAS0^a)_xu8dS{eYr(v@+YJR z)P9ruT`!|!ZT`i#iKBi@8AiV)flt8#(; zPQx#Q`nP^2>pQnxD+Eq99XiGLm|{>x_7QwExd^7o*HMusb4EL7>s}gdb$>u@>F8?S zirJ8lKk+^ug`G-skx4qis2H4f{dY~xu^9z8m0~1RE+cyel;#$rNEm=by(gYxlJO%l zvvx+C+Q8Xzuijdy1iXYGBk~^`aSypA>s@r)!~lorF(e z+rv|id{a~Hy5g>dkI~2HozF^;i6iNpm%o2E>%mUjtG?%oN)8L{o-W+CI`RA|rGbAb zQ6nW_t$dxqmCVSCTSJ`q3J3#Q==`FMyxtET9g@lXMjCQ>ctH>EWg6ESC^A}nHn$d| zD%g%3$n-mG43;z~LU_V!()+c$@;&gQMc^YP{?4U#us=7kf?ICSNbVhU2H4`t7=mH6 z!$<5!LZo2gDG0ImBSW70erfSZKea2{?nG9QD+gQT4}IHSUe>`2n%e)Er3c;BpqAX? zBYBMw6E;&04O5mMU1RtZm^xeS2vqs{a1l=QW1MJ`q7p)~gr1v;TvFdCH8>+#C^QfAN9hC^_iYkuvI8@9OHn_j!~=3w)4 z)P)lO^fI%A-K@cmuJui{+@rF6$Z6cD3@4Gs5x>gCsI+-QLxEVjpy$z5T9&=_$GfIP zB&@&Obf|fLZzpAtD{0}E(Q`k?;kgD;aZ1^VZma=<(MJMiH|!tX{1TA}9BKpE;bLED zR3ywr3vglxheRX@6?$=~q&~q6ihZTlr`T#{16>{^RRsjpS4uHSA{nN_z+{xGnro;w zdTmP!d*+c|89guYEctpH&M?Y;A_$>W4!Ju6-H-G=vI^h(coUUmbMN?zW%hRuMsm4~ z(o_Q82qLD%P>eiQ((e;s>7Kg@jmb6C7%}030?J(gA4RVzJRWiMaZwzuPLeIVZh{k5U=4<3b|IA0 zyf++CrklGr6MHyzd?C-eR6?Qx?ppb?9|>wM2OZ9SGl7uQK?QdUkOv0Aw(WJ06>C$c z?72@*mh^-C{p)YW2~#wocYc>{uMe!{I}vjIKOG)Rll>yUQ92)^NO>&}2q#%?DstMv zN=A=4kJPErDrfO|K5g!I^0O@ju(>#`uT5LB_-yN~mo>U!4}RH4`kFV%OF>DY%3V2I zUc=^gyOjgkQ2tK%vUdLR91+3dUt(!dT&Xh{u{jTRWbKtyysjbK5O;53KGoZ zhxp83f;3SZg+Xz0ljx&Nv)TN?v79f@Q@>b+uaZi%loWy~Y05Cz{o`=iv4C}r`AOLg z6JjW2aP0V=L1~JM-efbGE)wjlgofC#IA5c_`j`@?(aB=h5t!Yq?MupJ1^w}cp~i3n zL?}m6^09ix*U_(5g)%Fqv?~jrUvqH!r?u$g|LK1D-E$7<1U*itJxbcnkWe^RO^6}e zNK(=rMgJ`S!{F)*1wUGrHve`TxEpe_ZBNPlQpXt-VtTIU`1WY@(zO1V^S1v?=1a$r z8Z8rn_WQC9-|yxc7z5e|`ZfKsH0U1t@Ed7MVwQ3cm0gO{bd#VU5njEkUI=7n(~1Q{ zqaDR$XE8FjxabFY#X!f1<)Cx!7E$5;j5jp1Ae-DLp^xO|{2^L`n)N*bJ3nAVy_cNw zD;0BP?oTkRmP{|_Vq>L8$lKG!>-w zZpU-;W?w6dB{XH*b*Zn{J`FnVc)B0{RVP)4ce!>sZTLJpF-Wvl)WjmQdYQ}3(J;|X z+fzXelLCQF)RD{F1AMpz(2i_u2omV~3%)NyHfHgX$)=(sOvg5H$KpguMX_$`O1(x( zq4}lhctQWMz%WiZ@ezp?$pSh4qfg&FF8R*8FIx06uvF}Y4TSmWgr8V=!mo9rV#-5I z`ub;M;_#i&btDk{ajs<%!gCG%O9=sT27>-kiA79F5h>;uou=TYUn7&y0|N7UukcsT zY7-@(SPTJH49lfX+se*7TJRa;9<_3z-9!VIVq~oSrXZ&x%V*<^L{HS}gYIQ}4R6Xr zx-#{!20_I~6wyMfo&9m6c6Lr20}hwhqraCdIgNtXFHHoGEf~sYe%qCb_d>1C*9awp z`}p{KktFvBn4gEoMO;f{l<=0Rl156T zUJ9!mT+ubL`zuhhd`=9786W{2ytn_?)Ekb6u;sc;my0?5BVzzXIeTbenmCdI0*&d8 z&UTP^7$QQLw6v5uOes)f+L$nWMj=>`$}&`HA4eK6li%(8)+_4it^m-_3!xRcKK!M% z%-;&V4bCv@u>WwKOK!pjBWkvmOvA%s^t@^Gx-;^K(ov%13*pH&__8v5a)p^{g2&8& z!_2~>WRT%`Nn7o(d>L1tr1ML(-uZOvxVppR8^x%Y65(iIfdm?xvJ>Gu1>=yt5tiW} z0$zx6IQUoH5qz-~D)1TuV?ig#P>N>2hPH!1vt2y>pQ9KzV$+ z?M9X_85GX$G46D(rfh$H{9*WFx>L~o>Pq^Ur(&7o_uR&PyZ1|&a0egn0;KmfL(6@8 zVRL%5Lr}KCc0Esxhp;b+Xg&;KIot1~>WwfaI~#PkEBLcs_-3O+Z=QC)I@AC$hC~oL z1WIKeN@6bUwc0@^Zgux{*j%&6Y539pIQB?<=*HYHh3FpDg0qhgx_bJv$OO9BBsn!W z9S|01`L?~Z`QGoX?tcD!VP=+!>_oW5#?I+f!ds3FZ3Gb9rTDaAX1^wkFU zA2sjFt&W`*nksd54uW*nIeh$eZ^*;zymSVKX?fZ)GyaQ#UEw*|lF536W(J7aQ;ORc(ccT`SXJt(j zz-01XP9AdZ6GrzhJp65IveWF@mB+^**b0=Q{6W#_dg z$HU%}4~-I>b=tp*i_-@VIxwmG0e6yE*A<3k)KV42-z_DcDwN|y{L3RSy9izIzK=!6 z#H@Rdk4L{;wrDS{A*m;Ei<>s`YoUU!FW59xv+R97k z?>lbCUSsWP9V4tqh*-f-x=WMXlfvrGViSvtiw3M`d{9oXsaam-ujkEyZ18baw0SDn z@AY=IZ9KC@W#*el?*8IHlO_YM`1Y(8Fh}sam9u+sUG@I(xBzrxY^;PtLT<;69>yGf z+N#q#AEshk>VUtq4TOMv2+NOyDNy+E#~)Ub+pEC4PVbAZB*uA!Fe&#n(0YF~k)@;l zdWZM@b69M^>czzYltQ>VJ()%wlUCQCpPJ3*wiOLr13SGXShQPTC)4Km9$mzX3qL>S zWD2>x9f@hX>|9)r3oNeBBXjJptQ5(!c3vGZr6%4iw2{4>-FE`7Mh+K44)?)VGb7Rc z%WdmlZr;B7KOwe)?^et_v+*BIx!oiO*L+?_eG!FyjutKFl&i=~@wIea*Y#EHgsj|Z zZ1O^|$vW}1nJx3DzDuP3AP$So2B$tEf^P@~}5@0VGF^V3D|+E*~Q<+uTb zk*&)@2V|kY?c8%CZwR>Nx4#NkA{8cmcOnR#c{FYgQ{C~%vb=PdcC1$Ss5b8Bc1y=0 zHY$(wlX2~N zduvM#-o|#bKZc@{(pQ>YPqTcbf6%eMJXGs9F#qC_*g0!!f)3^mf(xRj!~Dcf_mLo8 zwi-Gs_ibvW$?vr#WO2C7aNXsbO>0Rf+GJ)TC3MgfxhZUfM?v?OG}{^5q|Y!qbYn)m ztJAZxb|c1Y09r17!K`^A48g05g@fKduji*rw?{{~a8;`E3B9!Wi`_(RK(aQUe-GM# zd(QhLsK@bSEvyu%jK0?Fbs2rH{JI8uAe*oDDL1IGaoQOW_B{k!cGmiBdu4RoC6c|m zop1Ec`@QlncIT%|m0Ao5nalc4lp8@yDpmpqHPV2;V^W3ewKCcJ_V)HrAa7P5D0_bGtG7)IMiYZp=krKAGRV443{BzJsi z`tfp1#DGL*m=zWSF=JZN7?;*e>~ zig1w#2M)^^D-b5srlHlQ*>>B8S_kBQcrbQrfL}cs*~U6PKbd1}YPz$NB&li3^tUfE zx~%_Xo@{wy_+rlY4AzFeGK(OSSaJdE3|VW^n184j>qbF|?0^&GZ@i6lqpBio`%cAg zI8%-PW<%w)llJ&@`~HMRzwugfRA zOlLhsTJ}P$;%B>(K%_1=P?e%^2=xl6hvOt>X;|S{4 zEEm~^{P!9J&ZKbiR$O@Kq${9<*B-}H-}{vo6lLLC59Kh{SpIPi4p%pKD7L!b*L(%N zX*O>Rg?@H+UZJi;;MB~_OxQr|oK1tu0Ti2=b>002Jy1FY@%xXfdQFatwT&Ge9Va4Z z9b^Y2P~2}?yro+Mpdo&9G9W7JgQ8ER`c`@MQWU54q! zE-o$r=zRO7<>lq_1}4TIxzLWZ7K=fv(`NTex0tUp#W)cKyhcV^T3SX%+xNq(O>r`F zNx!?55Gpd_+R~D-%nsMxqZZD6VGoE3)%cZ4=@IK}^y|G@**RPYrUI_SBqpxJP6v-T zDxsM6ktzbEY{JeYEt&VjCgODOEdE}Lj`#4$2{jg$h6dVuym*pjp7-An(c4SnuR=~{ zwG7V*33LTpzRIX>%5Bl~O96#0j4SIp28mX)NH{s?uLVGmjXdoG=&&KZUz*h?LTc%deXsYzynK8de0=SGuTL#$$I*Qu72r~~eYJDntzXNH>rKwrb7Nz7h-A$` zt6WHT8t3#p3z?8lX=MRts)DleyiG$sT@0yU`Zt{-)fVS%sUlq>BX-@&#xMKEc#7gk z@V*;hZytvQCd#Y^32o(^&Y$Wn1s%iQ^J|M=?d99?l@q?b`*I$F)$`*r>6o_3_15)? z%Q>PZaVlG|U%T4!G>e2$v%1{veqSe-!2R6sG`i_d@UAzdY0X!QJ3bX(jOB=xFkE-Y z2O3~F(tT|l=+(5|S)W+#GsM|+^yuVoEQJ47=|1F)^uF&%;i(n)rAGJc-{%EqVa285 zIK$7+@M^D0RnL!$0(PaCq#NT~DnHe5Ey^{e;QF2_p;DD6(tf^~bv##{sm}uqz5P%6 zuLGcavG^d7XsP6yXpCEEW_LOYTw8CpHn5}>``Uylo;Qi~b-8?~e@G*PmVW^8i6!TY z%hO0$tN@tP`K@x*+pBenZ#kuX$Zqj?!$L!d`*l)S-da`uUyOuET`XpNU9;OY-XWf7 zhHj#9qs7&=#T5TBkZYe78(*zy4alGA40Jv?X+}%td+~c9`(>)P91He6Gr>=qh!B9k zHcKYhR{0t^npJxFkOx$}H)-JeuVQTv?JyL+{*^|oA;;CWBOHZ4hojqIuj0)okq@L2MW zADw>aNq4UH-0oZPIIiZyqa}vVEsRR%6!x?{oK;klQ)tjmZT2P z+*%^W{aSTzW~1rA45Qk({rsIT@G=qjPT*5wj<1rxQMfe)`1AapClKyQy{|?^a&=tBdo*BTyu}lP+Ad+XSyuQ9JR_TD|;;^NhS zOas1KD;tJYTIu}U0l8K(0J3;aUC=>h#tPpk*tWsGPBKX{T#7dmv;TCv_>Y=d(@+Be zHg*v`RG~O3mZ)Y;uGOFfjOX`Fx5wXCXPz6KUhdC-|0$^W-AxGj%Q?hRaJpTM+*Rp3 z5c3&9=Zu zy~z!k_`LPj@1t2-pU8C%4R+=VqP1;_*Ch==RPaX=RdzcZU50)_E~4=G|DHVn{%$af+_gx zw=L5LIlOHS=@9B8VZCgSVSfWPxx(5ug*49yk1j42RXLm4xVa(O^ApU=X27cg zhIW#Ccj7}z-o#>twwzj z;9f6|2KWrDpir8ROFlt(mJtyQu)NspUaB+tSk>u4ou#H|YZ>^joa}}VPU{G+s(c`k zG&D4{DdA>ib^3c0RZ&r~z^AoHAsfy(#Hr*@t%i)tywKhMWEScU7aT zHlRN6V{t-9hL(oMKHH#tx=C^`gJr7seVoCy)^{{(G4#{moByDQ?_R#^RDM&F>y#K2 zhwD@@6-p-K7^xri)h;6}+AJp_=LlV@Ey*IbWsp;e`aDJ5f^DjNNoS|;+P&|HPOY-3 z11@#NpVg#zZSz89H~W5@UNC#&4eR&OCrX%K7P>(NkE-9=W$dXL9sN9|Zc z701n;GzoSDV}$hXPcu?YLkco;DJS7Y)nata@=8$oNHtIE@vL-<%1GA~ssBF-YTJx%a&9cFLQt@=x{cylj*0=>?!2jZT3n)O}Z z7J_L>x&^-1xp}R(dHY#l)DfS!!^;?}<8Q4JpP7;GaB#fXIU_*aIdqT(gZ{vGeO+$o z=38HRo~`bEk$0AlS!bW~$A+bct`#*UyVT?NH^;Yr()XQK;spPjuOGE#ooME!JPNF6 z^2Pb4CLZ@Sp`^l)y(0{vU-Pcme}3#=^N0kz?cel0vA@feu?S3g`@|>hQyGK6`driLuP|c2ofp!Ezr-%I{#h(mEIA9$9%SY zCF<#$V54gw+1&R{0^F@41)!$j{X?2qqgJJ>A)Fo|+C11U^GBq8*J4$iz}E ziE6i2Y0{wG<-5nhF$9)A%G)visWa;BvDx#HH0U6_VRUnA)vEmWPs1ugyVlY1A_$kV z2!_UEw`e{lCT8KG-4&sfUR>(8m;rlPjNUJH|Gn+^?!)Q4n$pceEF>hx|FX%l|QR?+si&7+DXS>2RJ#sXnQk)Q)p|HPX$RY^co8S*I z9dLB_SgIT^s7$sJ!Xa}#B?*dz_stoFXj5`Kc9+qXsA9*74-;Veyu7UWO2bF!yh1+o z6{P5Yq2D`&0>U&C47@6YuyMLVXg8;CGclM|lsrA_s(1~W1Z@Y&DF6qG*w|2gCG=l( z=;@6)q|Xt@4R)G;o0a_O@o22-Y`TZ&d56v)DkBueZ@!o1`5)9QdA==Te4Ik`X(0(& zH#v6d5V^FvO{-DQcfw18C62b4fnLiL9&y)71LYELZ?W8Mtm>~kL`b-^TZ1s&W`O6; z$DQ0oKygU0uW$4+B{Z#ZekZ~pvH$Tiwo};oVyGgrgd^I+hLCL7qFo0$U}o)P><3^l z)W$IoF4kA41&^UJoC9bQ(-It?n5zt}D+){VgI7|Xh-7)a0G8YW-Lvl05{BSUypB$M z%^V^wNEGKM4=THBczwY7cl@tN&{c`pLBX(2lTx+R@7HN4*EV~DEKJr8|96)LSR`lY z7$*Z7vg6}p(a;ib^a75Ld_BLfxGf#T`F`_#Qwg|~dD!~6^z3JAReG*xH)!mzo(F=zq+XlU$whway?6dG|JRUI@fggl}SX{ z_}YU(AXvnYY$Iuu|BActu=>pTN(`wK)7=kCwT1$>{lJSiL(lJo1jOMuCrgfA7c;)2 z2|25cJDaHtkq1qTS3}^>-1ZqFxBZ*lzIGKC=Vy?hwXtEClanKpKyr7AfPi4vlI2?4 zS#{{L)^arq>{HI>b$)$hyJl}SHFa`Q{rTy78VDv5NAFV%_qMcsE=do#@82=o`Z(J< zJ^OrVliK_@YeIH9O5t92CW?t`Uhl6s8I-|9l!|Ew(j*>pDk=mZOT-hokAdKN@!foJR97yn$# z-fuo`0wLm~OFrr%JpRsus|{ULdQ_9V(0KGH>Clc{Qt9UNCB*qC&-1z<<(jf9M zNM+}IGxtp3{Ou&&!z#|yW&h~)G%mCKY3$Ap&(RwuL$Ie zhcujJlOUQ%hJv^6Gq3hidm&VIJ=Zu?6{*p+C27!-_VAQ2n3Mo_B4I(d%l)Oz)t;N3 zd8?`J+v|x0!S^8uZ~9p)cODP2^Ef~PB#MnV+lMMW1O^W*cPv8iwKW?ruJbpuQyV*o zVuO{nn^(D!8M!iqyTPq>DQuB%S~emA(kvSxR}RxP7FCr*6ALvX-)*>JOaBGI>3DIc z!7rpFc^SH$mRg=VWkDk&GVlm5BcnS1>9Z6ik4_u?`mw(vB;Zkg(hC zJD*Tsb*v%Y_cmWh{PL4nIe?i^lIxAF4iKnMbq0^!OMN_xVq) zVUvq#VOv{5rgkmiqn?w)VVss&@1Jy;=S2_&8UW&F3+cvTWLL^Ov_Blf|-286obK<r4>GzHGsU{qa$@{c8v^^bA8C3=aE z6O2HY#_#s@|2S>k$G`6wA%T9P(xFc3Lk(l$=(!-+F5u$I9M69YcH8x=1h4N4yx#;i z+~2ot26%2krbo^d4m+YxUFPm@1D{o_FBXQHQtfGASjh%p;mP3LQx2Q(K2B9WUU$*X zN%j1nZ==p0>;sP)A|Vw(21Z=8luvzWSWrX&4#Z%S-!b`7F|+FA?BNaJ1H;h5ag2$W zW|Zy&m*lXA_?B!OKqN(ZV`)&mwVZf=p^Yr{A_WK^?1BdCd^#D+NFQvd9wsiKCf7~B zP=5PNGjAH@K%L|AQ^)kb2nsi-^mfP|10jBG ztRe@wlG6dD!XL0C5Xn_O$xyM5g~$&?Y^RD-a$KxL*(gi0T1kiXf#Izz3v_t{ULRZj zJ&lcx1@|xmm@CSmaiP!>lZM_XEu$^Mhfhx#IbwbjuLoC_+UQqkW?5B1iGJgxw~4O4 zx~{5&EChD{GBvdrW`Mm5!AZdaVh4T6RHK}plb0g0F}pfmi0i*{@4foDMSNbvZRd<* zJ0dOxvZR5<#nuNQY9t*(S<3Ck7!P1Zf%Ff0Eob{|d+3lycRxW#3c{DtSMg004T}y4 zQ^Rua9f{{EWQp>kusMU-#L*74RGolkia!vYoBL2TEZ~8`#fXUH#kr8#MY8=iJ9D^v zGK_MvfpQW_u_zuh4jc+sRvPgzAXoKHcG(dyjv7!YEx9@F-GhURY<9I7$(TN5B_C9( zthl&95KN$#2FVy$qN%>*&|J$?8_xY~KE{R=g3;I6{LQv;g$wx7nZY3;#?bW|edBW8 znOkZF(z|qoiFAxXAf%v_WVi7JaI8}Jc4jQlVTA<-)r^`88;pKXSfS>CDq1KG7sS6; zavWlbrD9nuelVG@$-;#SkC-7^>!fs|6%kDjhYY~CmnTE~#1Z5o*fHkPw1M>{OP`v9 zU3ZK)Y_|`x>f4?kz|SY3qmumnW9fr7e}#CGJq3cu$Gri_c z_I!Q=qC%1i4mo9+EvkCUdI)cse(@Bg*N|~Md9hw~vAA}$cxoCye5ibk`_tj8&wob^ zRQD5Smy#^_ovBCkvobRZ5j0*eVGhsUgpXp1`3o_)zgC|kqjErZNJ;|*nGy@nOm&f} zA~sGLH7>uZY9b~avrw9b+%za$KK%Hwa|(P4s42$5M=q&ZJO6id+RpA?gD55l13m?V z3)u-`GYx?f&D-Hh?q9zi{vPKtBwjoyDFRSLo5DJa!^Yv7I^`~iBeEq{LaC99D_SPT zP`HSPkA#giX!Lc4q2BpSX?e*J#x#9zL1!Rpmmjdk_J*hogQ-)?>7jx2&9a%IL}q~B zVqq(6qt=q+a69K; zz9-lp_>G)$W}HA7a;#xYIix889PVH1qTl*t>1+{UwfewZ$iL|QsH3FP_>uKsPAeDP zY;3d~Pns?>W0D|qMMl(*X#rtvc6aFnJZ7S4aox=eBNUumAJXW^l$1ee(j{5O?c^+9 zP&oVg;Ne7(xkD1^8_Gk~usNWUDKSya?Ncx-=wNXvfP8G0Kd@3#n1U3elw`%*zfR*0 zp-LN*7D>;!z>XC=;+>f*K`PHVH0U2U}}l;w|uhRa=~;|w#+`R#5V4i79d zOe$1*MPk~`FW9BV@S>JtCag3?VfgU0zfEC(L`%r=gAi;G$>j{xuyX-v^25XUF@jWb zrmz&OO^9%?L5!6H%SgasYjAu&V_`i7Hj;OJs1%2S1` z$W2f2*A~T^sEXJU^YF?aKb#iUn?mcQ&B)PMqa?9S73pmN8DvxibRYt%QiBSr@tNgv ztxAyXt|%SE(nDwGY;$?h$?2+CD>7}UoE3?p2fXW8v2?>g8Sq-+za+b|vIv?egXF+q zR5p4(6I>WY3D9v)5x!OdAm$UrJb>e{8>hbv32K&6$v=@No2rzIf)&NM7!XX9&WxFa zU2qN}f~m*XLj0aOXH=#qb3`;K2ZC>xN`7ts`VCTw??qatS%e}tq06uz8(oB4&kA~K zIOCFvFQV0q3Zyj9vH&dEn+W(={Dr?{8A$LJ>>#lslP^kt=U#ru3W*Mt&_V-28A@Pz zUpP}{K2&($jtWZ4B4cWt20vU$Yks0j7oiZbbl&}+i!FX9T#t-1yXgP(T;l)Aj7vi8 zN><;0C#zie-4bjGwOVc*6Al86F>BKgsV*FZh%k94KkWKgUgV zTDCzG_EVtj2a6w+m>|?dQAz9xIBJyLWXpL84$BBVO&nmFKQ5tDvrJzXYo#w5W8vI)HWOfQo<&Mf(>O z8=1A!sYIBo%?&=Rbo~$Cbbx4u2PNo7J-`-3HOIJ4DW3s=4R=K%P~7PPNFmZQGs%&f z;+E#KVId(QvXvuhaBLv7tIM03mk@Q1zJSY!?7N(~@WLa!AsK>__#V8EHXY24EX^DbzAAyrldS z047XUQOwwu8#;!X*jTdR%V|Q1XGZYPDtlyW4o9x~fz$&;9)%u=7A_t=K6*8vPmv6p z3{kL8!2$+3jJ@}}u-HKU0n-K%)vtCF0J02#4--`^6JW`z){ohjx#?F2t?HcU2P!%Z`kP6 zu*}FrC!$3--WZGx#QdUQyo0EeHGrtD&03zO>EO+(s)b9Tn&~PN(_H*Z_2`;OzT{5n zDbiCFCfW9euAGsg^NYYEc=d1Ve?2~UOmQb+II_0R?J8~!adL8F?^sQ#WLQ>88qTtE zOkgN`LnfOBXKD$6ZsO;N$c8~8NS;sh%M}ylcY;(%d$v*!;zIlL3F8b`rg33Gs$m6R z7HnM*ZRLjmzfSe_zJ*;cpd#a7X;DWUQlGc3>&5=1lC~q{Crq#K&|A=^_xsK_S%2*# z9hA+RVy@(h7Th|v|=U&pAgFYPB60L>| zoq$3{>Ru$*g9Jb-Zs1g?e|soX>IYkA5<3sWIFJ)N{4phL_u6Hb7>zqEz;-gJ$(F68%FRR>;9!*^k0K%3dPf_`E zd5!JtfMgotd}_Rnl=ymQy(?(WmB+b|fpHs|YT?O9^d3d$Llu;CTJ!SbgVhemCM_pA|x-r3!>vvgl<{N+L{(J5naDI21K zriEqqq)qY4kK$8RQzhEzYXUg@eOo4`95}$x+~?*e#Tem7t8hJyesc?mE%ER<@Qujjc&oa_oG2PhP(kCR%q{JZk)f!t>CA{qAT3?0U8OFCCB?IUB?m z$lD|&NHbzG1Bp6B5MH`uP;~6~?uTft8#pKJ*L%C_{JP0B`d1&QSFu_nAv%Vzj+zOZ zky1Rul=q9^tU_>m?R)FE_2yrfba0P_9x;5--vic}*gJI5f3J&*{psq~9?*SA8^Fe& zpULnu(lm+=6woJR7S_>W$S&vhOTG?u`<>wI&LuRy#yd>$q_xT@Vfoo$CeB$tepp>h z?on5byY3u%FRgYSXU|hAVTf`dPSVkn`?Al` zzNxauMJRGd6YW~4_DL*-Ak&;A%lo*r)8@#*hu43qV%4|i;q6_wGeX1aXdX?L^5v;0 zK&uln=A+eOSM%Wi=SJA^;>6_erJ@;_GmXHTIHh4Dvm{{F*UlIoQlVYa0aBNqdD%x0 zwiIGpED!E!u*xqib7VZjIQ02=bCc1-&?JP4Y-3 zr{#4Bzt|^gOth$X8oB7wN?uv4FBETHw)xuGpXSM{A6UCP#qw7ltVDhCNJ6Q*!Cmt; zb*pV{^#)g}-G{zO*K#8Qmhc?m1B`t4#Y~Hf$_NU#VbB#HdAAL$97={!?K3?b)eSmi z;Zc?yRRIihE9CB$Y;L#tV^i)v6U@qnS z*)EjNCajEv5kzJY81?AHvTk?>=e&9`GxKS%oh=KW1ecnacsylgdS((*s%-Fb?dHLh zuK2E!IvkI*pK{+REHl(b6LQ`AfUg{Rk&@M)gPB~3e_4M1TDrnM(ZKumHio?un|CBf zqu)t%kTo#3o7W5H(~r>6*QPP*a!lsF-KC?;-OxY_+{k<=M3M3ftKBFHaQL5gmJA z!J%f6bQ~d9F8PmSANLCa0oDKgi6a~Qo-8+>`*XejTr-4EU5XntsD!PHdCZ+ z3zh=K2$Wc~sEH|jh57Onra();NW4$+Gca|ru{K|Zh^iP1>4r7PAHrB1n0|h!PF6^X zT2gCz&sF?XgQUkcv;m-rZqWCg#mi!F3WHUbl|$@ z$|V7pvK$F>8A8-zjL-$|u(S0br?p-1;%AeSVYS#>h=ehFX=bTY`|sG(xNebG=G*Ld zUy?cv^a34R5L_c~JA$%;rRSntjrDM~8pP&MSjEv`4bbJ%zC%@#p^2&ggJMX4X{nSA zn!A%cU8Zw8JV2)=8|(ZviUFtEkJzM4n0q|*QVY1LH;#L-Ba&)&`%pPp z;c^HgZT;jVrfZLhAqJ>cG{O;NlkBHWIB3IZZ3qrn_5uIj(^%ojPFegtH-~LH({M%T z3?YyspHwWcgxBIyjUAg$kJoO=(4aF#`ZUvz$UgvUNr$HCUhFInbm8Nio@^@Gb;K?k&{>S_3+tevyCpu;O?C4657= zk+mEYs^SMUV_Bv>qI&og=))SD=D7azlv5tr(jX8uNQMlAg2 zzh~Ht4OZiiyU~a|uRu{fnu62%vPRWWK=Nt_dBQ!t*viHLj3rmQb7K!W&A0{4zgPK_ zyZ?U{pbkDXlfR){YCIWjQ@tdp1h@BW;fhD;*A$Z zkBV$UAFGO3DUAw{7Y)zU@)szsl4d2-R*sEA|DD7ozM67AXK?%^2UFfq$>?-M5B==U zSZO?`WNrzxoZ@TRW+Y@Bs6vFJ;(~Qst``2h>p&p&VA!lpB)H)v-?M|w;z2o_8)gH) zFl+vwr3rSjk})5Z!FNbJH`@;=W`+M}edSlxeFl|SmJbr;?V*N275zW;*-=trZ-hR# zqtIh&ARk#z0Ww1RLo4;0XKd|Mo9KQloXmf&Tv?5Y_R`Scs^Nd2E0{tS1%YEZ>1@W- zp#a#WVOdf|`SVc0T2e6Eh??C*Nd=+MIKu#oN`L%Udm#*HHc3Rl1srQ!31TQbEhi8d zp^7P1!&;K0s$p`hlT*tq$BsZrr)4p8&WTcUg<2?rNhS9qX%&P%0x6RL|7U04Kn}Bd zcyC!D6~{2Z{=e?wS(LT^-5V=P+053bT@uL)F3)RCowdCp9>*Kq~q#}ko{ zc@JPLy=DIhrjcSKbh?l{v#)()Ffw&J`ysEeW}xJ zblZ}`5WfBWXSS8~6COIh@k(P!3~9i2B8(2n)$ixHpVDn&qHIm&GnQsvg*BL^4(ObY zgu}C7Q3QZEN`XUby^e7ZqwG!*eY0(M6oF>-e_vP4jAgW03+YG$7bHt~--#;Tp|sY* z0bEcNgIGiW-wg50{q?p-y6qONv$@VaKP+ zL0rGPt~`8L#uYt7&(a89$DNrNWnS;A!Y9rjv24*3KX??083(A+Om=?HwDsO&=oq;# z(Z0VYdkWRdNq`Db4%=D$cjoQ>2wo?Od<;q0k)q*NLyFQxj3e9ZbEE2!*Np6ydi74H zvof!Dd4ZRKZ_|Ol9>=QyhlUzj7{Zr9P1AfQKeyh`yC2pWSQqC|LR*lGo;Y~{ZdfLS zYvg%tzpPuZ`;EPe^iqJul~KRPXuBV$g&#K)0$v?ix?X7(xAk5pWj=O6Me$xYpSP|@ znx=mpXPvP8`is>9h%&MeDj5$~ZOxnoG$Zo}5=~qxzGrh`mBuk@ z0mZ*?hE#)D?+<{j|AiV`Fx(dstwrp#483&Wqb;V93=a)0U`2cAf48lwA)N!xH$rG1 zFRb`sxBJ3nbh#*cFH2w<&VZ(2(S_ZdwS|nJ572KEaGMN7lecN618ifPo*j~QUpoqW z(19xk_VpN%i$bB;#EDG*4QFi*8NYIJU2b;zEGHx6pg4`to!QT zI`L&BN;kuPQm($Nv^emiDT$Wo?B1|IGb?-8ufA2RvAR@=mQI9%*N@riEfrT&6TnV->$-z1w8yrgEzL6to@Alq-@Pk4a)MvOeSL?YEQ?>E^Y$W@$<*F28D&>H&e*VrwI z9DKgo_*hzV=(xg_hYaA+jk|uV`Nj*~m#>el-hJ-5tvmeg=k}?n=iy=NCgf8tX^VmX z+Oh9N7n7OulwO^{OI+{2rh}ZSi^o^151YjTne2cmK0E`Tr{igjo^>xc*gG;1$H!F|SYa8m~CE4}o zKc@LJ zLtkoPq(?>+u}Q`3a$Z2unx~g|Mm93ivpF^${J{Q7eLoCyigpCj5}1zAbnPg5Rt*%( z*=75$d#m1LuwYu?vOYB3!RIxRW6JNXE3shO|KQ}pYt%QJGcw{J=W<}L$72)EwW0TU zS;jN|`v-)j_pJxR?+C3d@2c$Mt!Qv?(2;*H_C;r_(Y!z8iG}yx@gr}V*yZ=l``_NT z`#}f^-2T<9hLO(zTH7~~l#_pT0#|S{#FwL_Pe*p&Ae^zU8=it*Tf|FS4bLbauTQBA z+OLa70e@qSK3XukE>yT3-`5`A`$hGFSfY$?yXFXRM7ZhH$<5~4!yOAvgs5?ZmjIdA#+ z*8DHG-~`B_aV8p=B=W$MHIb_lAuP*MX@CJHqvDJ6+$B~b+AmTi?@{~^5dwze^?SKA~PAW>^y~XMEnalHk zeB;^l2+Tz@^juu5drgHXniGADPQT9&;~64&4tEBgoE9Z`ZE7WKur7e*Kp+H%uJhG3 z$L=P!=Iv%9Z#|Cr^c=6#y6)p6*T9GAi|(7+VM>Y7?#r<78(b2f-#3iS7ae2eV9HTZw(Pqa`p50@hKCZpT#KiYhY_NrYnpZzFsC!8_A0acv(5 zX|%0zaq;gPTOT=*8=gzYo;`2b3I4A|GIji3cQtK9K9|u~6xN78xxd@0D9UmdJM*Lu z+X+q{#T8Is0_A<0?Pyc~50*7Nn4~9KG;+wcWi*0Q?=x+*D(_XRA@KAYXed~@vwI>^ z*+TX(K3KdylW;~+KzypZ)+BBAMGm9O_3US>!oqrgZ69hqz8N2Xyh#Hh!{R5>k1CO< z3V(oMaS*-!k6~d2=`?0io4-JPKs-DX3>k=?8Bc~a#j-~I+~2ADFkCN*};NKJtWfI30srrjKIMU~2&$ki2I*F?6-tw!K3nRa6C)O$>hB#uxpG~xg7uG2n1|G5395(Z5b4LHQ@ zy{qZ<><*o9u7?Trt%BI{0-+8ZcDwg52JdxlQT-Iyt`-DDgN(nC-EnBPft(?=e^!1M>chQPO30LHb27_yhcpmIk?V_&~usVmi~u^6$^} zYz*YttKR*e+fMsCZ)4EmH+?)DLpFToSN2g=pe03OScyp+CK%7!$B0jH*UYim@CD1S z$|<$G-eBzRF))zBbnOX_tkkLNRr<5us*@kIVQL1Fe>O+Ir1L~b->`~Z=Q2Xh{Gtai)(S<&d3POe}3D< z1O++Mf_icx`9(H&pU*6A&)`U1mFTWSazOKLLmTLkpikeBBhKm2w&rQE) z(zjVsL)VSTrPtR3jNa${D!&_!JRwInH>>j|00sT;EMcz*w#R)9$r+WHq?YsTFQO{u z^Cg3wp$X7)?Hj&o6Jhr>V5b(hvUkG|&9@15-@9;~y?=e0H#IAGjR&&SuZ4-q(aCL2 z2UcZ5(7rF)olBvHkPO;VGxb%TEnGT7JJ3c8)VD7Wg)LqL{ntS`1Rh^eanTx6pPV1P z*#zE)Eb=eB6(-o=MnFMK&#H^sxR{`@KPYV(e;FR|w~uuO_F5>npW)9SK*F%8{w1U6 zR$@pTsq$uL8z$}T0V5DmZ!baQRR^Mx;o2dLT?k)-l!CaqJ1ax_6pR6(IS;%awIh9+ zcp>$n`h>?MK7^^YLxnLr4tOkB)7}c)BlaW?00Td+>x>c(hOOA7hoWB2+fN#lSVUeX zFNjFS6Zm%iPSn0aaKyU*ruWBv&x3zGUt{yEJ&F55fyna?#;RJ*wDI=~HAyxetQ=C7 zHN;?1GSdTp2~7pp_<+9$pX*+pmjYg+0v{K=5B)bfUmHeAdhZW;UWbjkJ_c?+TxSd6 zYNCEQ@9j--q)DY=;7BD}oo_~xe0$q|Ug|oQ+IoFYXpKL|Jajz_wiMtFboqzF!uy0n z`aIDq_#q>5xhZtJ-Cg079>QC59_r>q>4hN)2^`i24LVqqP1`7T6Y*Z&#u{y(>b?D~8ZLG{nzE?y zmnj`EXH6YYT-pJ6>~*kn5cWF|Y7=L_l}Yv)N(T;lTTqoR6-awgDFJ>C`!W(CotYbRD9n9 zqZ#tKJzyu{>~D|ur6lM;B5N5IeKUTM8M@i8i_M&bT1Wix#<1juuJ$b?mgEAU7d@vq z9EFW+=I3fc1H=rQSmtSJYz(8EHEs|Yzg_iqKqQQWTGkYoctvI&b{93c^00C0ud)=G ze1Yw9kQc@;9CSp=1D#n?Sj^w|vBKrj?>0p`C;S_yyJXWQ=f)2CP!#dw7?K;|3SgPLg+T?jZt9>CgIT*)(zj8HNy*#3XY)|dmL9(}Jw1l7g z9}l#>KJ$}p&69r|yl!JYt|woX1m#6Oiby{qU8jXS`;*>?^~z_)5}0`d|Mk2;JwCU+ z?-fqeQV2>;E?c8Vy6om6{CUp{e4A=n+Pa^i{A_5(8+N%|$^>DoZ*%OunL_v@_?|f( z__UCo*JZteEMp_wlUz$+_PTWQ{&t;5?6FXx^&9&V;@4vamWLt=qK-&~Yb#A-6VFEnCL zh%^%OG0EUGHDvmUuqFvRBl&;`8Cr33d-eP)3x6qp_9KczHgw-2GgGqB3<7+wH883T zJwdQ=Ls-;E`mg|gjC^0iMK4^FzUR(P=Sn6$&lkq)4MP)jenw?=wA`@vZ0whd5N)=FC(=GFP45|dUEcOOkm22_N z4?O*W@N}HU81;_>%V#ynW(!Xb{1%9Hh=7wbs~zWQH%;FkEK_i$8{fY9^<5(35ob>g z3Gf_p9gmeSKXCp~Di``g_?CI7KZm@LAi*u@D9i|xcWiF!X@3f-1NYxnPXNN8;t5Q0 zpEjy4x_7b!&~@8C3J^#O$xAQvkT^K#jiC$X+N&3?)4nckdCe;^-#AxOdzY4~rfEl$ z4c+tf-Vn#prM9iRe|&!stWKQMy}XS0j`49>rpK)b`;qDxFzx+gHn#NJD@gw-E>L7k z4p&^j@fTv}$Jz(d*btZ2n$g>z2f2CclYmDJN&OTS|NXT}`lk@cXRUeK41|)t*}b0j z|Mxi}0}CnUIqu?{Y8rKrbkVFW&Tb>4;}Aufn4C&to>Ab0yGSp=K~r^wzWrw7&DX8> zV4&KDp{I!7XpUzx4UJfZ#liLKD4wCzH^a159+8ApJRW`3@~e*)YN8 z5dW;Y<-W{9u8O<9OvY-LZOW}#`Pa`%>1t%qC;yr6!eIpZP?N<%=UXJ=zZ+45Dl6eH z{23)?j{FAsW--6Ocbtzcd2gOmOd@rz+If5f%;PjEDqp`Ko1hLfx2j}lEvWMhHM}d# z!sb}4jeEn-^q^=3>2b=uRgE82WvU>^Q_zUcv&Uxw8KaRj__t!!a*Ed8hN>Zmu>vA# zSMVilJ6qwIMzFnbcT9FE)x#R~b^$pw@*=4TfH}@S!9I_vCFM7cEw1MSq0Qn#3=Kyu zoHd`~3lz!25|<^_kf4$~geRh-P3(tQnpX!IMI3$zV#dD7TD(%#g@M{kWMTeK-42#( zctj9P?6|=_*$0;f99#+!lmm3a)=t}IVwBSI?y^BNE4uU8dYl8{ANQqv58DnQ%wX|Qdm9#Sv#BHVy|VKkmOnFTXA9p@XQJgi{C)JMSlIQuru+zb_1OsSk@1} z92}h1yWt_0!LHzLlq8Rn?Me=tlse%P`>^4<6pm-;cWE-(wX0Q^z2ubni+-j0Zr?XP zlOFwLisR-S`xG<_SLh1}GMxmeTN4WfH80|H~+#Ni1M={1`^H3cGHsws3 z(jt@%r*{8UiEHsPCE(C=lr)hbaJ8V*b*#gc#am^lncICtY6U2_{m9_h7X2f_?{1;t zDsi~QmZOJS08a-Sb$pB%H9y;l0R^NBmQ0PnTqu`DILzjtLyV~`q}bh7uLuqo&6~ce zlJ%T(;wM8p(P9IyerbYaohodIS0wNt^9K9oXgGR3#P1_uzLY%>)aGZphSk7x4lJnP zQfKsv^Wb5@cothlUP;|S10;Icf-=2v6wf+p{}MQ6C5`tyC_xrO#MGxVe^g$nVt0?H-jn!*0)}kbW$r?UO3}TY%j;&EqQFgWOD;6Sr zfrBHHFSQ24)ixm3f3ZR~Z0#Qsiy1JbWqZ#t<+OZwx}K2)`7`LFR7VTGo&!Ljn>d+@ zwPJ-vz2=S06yFJBjnnoJ|5Cx{W!4i6p?q1D5P=ZY^biPt(?Id!s`r%?-Z$Uj;Rm7S z`x!Ikcu~r|Z;q(?X56SLr=`xN`Yt+3lDa*o>u8CSoPCT3GfnG6xFY_2)aDZ+pl@*qSrjKeSutQzhhsrjv zpRbr}kF6SNaHxD+=TQK|Zl_ zyg6fZ^$O$Kcive{$?Pm>noS$)`SxO6I6Wj?Vz}61RZe)AAuFoA$1u(tH_Sv7*goxb~MV;R7|I3Cf==p;i8M_}gUofGc-)Zgy zzZQ+K0N_P2(Mr?4+N-;0YvkCvC~}fjiY;yv<;F50NkJiG-B=!k!PDWG21&VarB&OHkHkG>SAyRWv5WI>uYssDu z$*nMF-&D#wqeIW}eOdc{wYeZ`tLmI7#f3KI%T}(|GPi&PGz;>Cj?n(vsAv{8pqVPI zo*hFT1W!&C0IHq1b5}1`*eV zyDuIpAIYxw-7P0nK`IaB^N@*RWvxWXm)&Xgz;5+N-`UvHIuJ_LCug#9*SQ=S9hH%h zdBJ-q6{@JXxBN2VKENL=g#17n>;$Q(7J*-Te5XFRXl0H0G% z>HSHw>a+i7noVRPXOxqRhFy|{wQpVw(0?D%lADv$4a_zwc(n{u^9P>}9#$%Mk#d0r zDaj8>G}hUe@p_Xsx+%|KnF+sH9Yb-D>&^f}JqKJYqD1>wnycep+5T*`WsveFo#|^9 zvsqpVFPe?_jDXyPmutJ|%UBAt&2G2OB7PBw>a)IEmEf~cr|*^|q$}eA1DP)`11zvx ztA&`tf`=@e2*BAOFKbTcPDAk}mM#s+@=EcYI2-7AQ7B1Oxi;F5`}g#jJ}kOm(N9@@ z)@)Lq@V_}A_>0!1NrDTzHuG!wc&O5%l^!Bcv8DJ6rbfA3VUGH|YI-u`>RB;sxT|(r zZDJ-b6Xj69uWnf8{{wtMgT7=LfU@28jUg>9rm{RwF;O!IubD$El`7^`&4D2VaSc^N z40KKm5kLg#9i%iB5#ZLc5GHiqV9jUHV2dgy6jo8Yn^&jiu7lIfIIGS`;AR z9KcLHBCz zmf|GA+&~&w$<$r19JjLm>W%*0D0y&TZemef8?qk3Rb7$jHb{?gm}CZ1vWC zJEXt-vBw^pWtsP0gvo^^&%MhVWrSqn9H5ZeCj2Qte?!DwSX&HsRqQ(mJ3LfpHB|v6 zeE0b5&`eB2utErnXiv1p$F?WaID;r*lX-z;i^x7V4xNEGKwquv%VBx}r3l}b&KYzaW zzUzH3*t4()nZ&P6t4c8#JM{}TnJnn-Jf(1~+P9)yi=y?7Z+v6XS5eXx4u1%kJ`SRr_o_ONG*HxoNji(0nO;Dv2Bk+sp>6& zz9>RqqzV02zJ34zAOJ~3K~&lGXOT{E=`(|xJJU0c2!JjNQAuwEolDJr42Y@il?X^vXF!C)`Dg?) zL$FGsK+qWx6reLe4Wt7_O=E}@pQ1`LrOQGz(52g?G==kK0#kq*v{DBsCiR>nVi^He zHXdCVj1iEEV5e7ASY_u<3YCC4Ni`02UQ%Ok#-!TX0d%L0&O;hV3J|(6ZPgMCP=z?C zDg}rEWJ>QGtBPHXQ5>oY1~ct*6id;zRd%}|IWaMD*Ijo#@W2BnoN&VO<;%OV`0Py< zdY?+w%)Ix_W;2O(0VLmhG6{O&(^6c`9Xtux%vyuQ@uqUgo}L+p`d#(wx8-+TC>`@k}F2aZV&lRSDRWi=h=g>)7(Tt@>J zSVbWa^XHGe<~6T*@v$$4>z$A(D5?LDdGE6l4rG_#VU4{9{lr1?N$K8Mw{G2< zHET9(*f2IW2EaKNV;mY98W|Zm=%9m+IO2!}3l?sVP;B-R9b^-q}0mslT02{>FCLlAcRncGWV`5OK}Ym(XxzXdF5r7`$qHK?|yfd zLbw>kIgL?7`upW*wF*)#K5C34BXr}&jaOcI<-&yvhnqv~cKfnRE^SY=UjD160!UU1 zmO`ZZ%CAx5=|sl~#j5oivt$mC!v{z^xm8c|lZofjF2}=U8Jm(arp)SqNn{@|&exDNQ9LIz|;{9rX&8J*~4axn-Iu zOax}68AwZU5LIYuEXpF8XbSY6`|h47CQf<9smY8gbhVp|BI;fvGs3JGAY?aXvjT(yFLF?iFS%`rul{9+n*s6dNnqM9m=7sPQyHQm9wv3&763Jx1Qm#7sc9)F_3-X?;NFAy zaCcF22eX0}si-2Yv~I$Vk7orVqB%gTgdvexoSc4F4?9gefYi+jw7$Guddp3{3hMqX zT}^XmJGJu^`oh-k7WTIEZg&Y`clj%MXmKi=F!+*6Oly_Tai_>njRIDc9Mfc7HJ(zi zXTVv876PN1l7@Y~tK!F;KgwLFCqG)^X z9joBjks6|8K9s@d8Gy?#zx=Sn4twcKU)pVyFzq}y%jDNTHKs6{^wAiCTG4`;7g|(^ z(4krb@0Hfqm^=E2gRWsjaw7l?W-%q$4(wWBzyKj(l71yslb#DEL||&BF-CC|LJ*Bf z7-^Aaju`|+P*AljuD$kWzjErY9)H~NMGQue&arY-aH*)f$5X%{u`@V3!?gZOQ?ILZ z#VcZet%aFY?$Tyio`V@F<6}EbkvVA88MNy)_G+ZSx9eZ<;DZm|cH3>ORx5;%e$b*Q z&@n;CvTST@?9MyyEX(qwlTI2Q9-g^op@*n3%X1jM{N;byvh|4rS04P+pZvti;w^7^ z%c-wE?Jqz6-?wdfqT$_dz3bhly!0fOH8(u;;9vjU-%YeyIi%sUv(9|;t4{m1e1Q)d zd~i2hcg??i{p;i9L{YRp@PQ8;`@-k@JewFF|Ni&>7ptm*%lG#>&j(@2t=R_6pBK`ckEy*%oG_u<*2!XU7>Hazmu6wYhEQ* zt=MHa2%lv!#xH&8OKaAw`M?K0U}ny_Way3E z5vL9O*2(@Hz`TWvU-#>0#NoxmIYSW|nFkT0xo579?%9kfz6M?LrCNI=&0tnpJR3lf zG|1Cnv0K&cUGmlpX2C3gAOfMZjLcwJr=kJS2m@m2d>+I|eDho9?XzUzkw+fcD%EE` zG1`?J&S11D{)p^0Yv`QkuEDC$wGfhOfYpMx_&h{&J*#gH0L zE&3ZSrZHsOwr%Uzuivp_M^ZnHjEo$7@WF>1a)@(o&6+j$+;dL~UR$l!gAYEqV#SKX z4?lb^i(t{r!?cW}qhnWG{*rG_uONSIp*=l zAAkS*KM3GeuX$yRvE6Rxd7di5wrtrlJUl#a-aK^T_#{rP?GI|yczVHVy)$*4Q^E)} zbx@-i6)^&lCI&=>YRs};8lg9xTM08??<)ai6)A~l&A zSx>Ir*{&(Iqz$YVlT0duP8F*A1t<;@YVKfG82bak&NZM_9NxVq45(IpQ%XOHHRy}k zJAwu4ygFs{2EwIvDFc{V9T-zypQNN_jzEW=Nb6eKIYQqW7sR0HXnkkS4oe`NWA@)F z`}57}x{Lq}uE$(-NrmpGW2_#skHSbrMAeza!7P@OzK$9-_C8EM^7d87bwzL>7)=3) z3DW9&m^O^xz19hUB;0 ze#@4}H@xYMzcD;CtO~@K^j`*NgjCc(cgE_RlZnG@3!^jhj5HX9X<<6mpBpSj^R9s* z9=hsCW+STbgi%@h-8`!>5Ko)g#*G^{Z{D0`S)To0 z3-dg0wOSiDZd|!?<ux$=@rE_umIUb1oH#+z@x`RudLe$jEqX^hL3Ej#P1 zv#z+}ic??la`A3xc-UZNS*}^L=CaE!d&x^)vSi5;02*Rajqw*%gj}P>a~VA!Aca$i zsWWw^ZBxbw7?c!($TBALwN$*2j81nQP<0kl1yK=!!l87C)JTh_0VrXr7K|C`k`+<+ z;MU)#VTLyV08k*E&>>pV1=3*VQWgh+HK+|bnV6VJ-Mf=(73!LWy$*eHaCX*kIvI5` z-_Xgau}-x^=p3gTPOUDNE7Lt0}#xE_rPCo#EhXCxKlGV=%?H-X7L1 ze82z`R^770^Hn(pdmKXNQD5_}X+BnsX9{&RGk0{pD@C$DwMf#SLM0+x2?RiiK#O1r zv>n<&0R%`6G*D)(O%t4GW^9s#6F9(>!^3%&!#U&)lm$YGtO0SUa_`Yc*I#wjRcD@g z=KlNdpYpe|Eb~0y-BqlqxgSYOl%=E+cclTO5Yd8Ty+pi6=uHTd`Yf0cYNUZmUxEq* zSO6on1sem#fln#}h# zzhK;FH(vOi=grFx-QT1Am}3qzIDs?(s(ND;k+^|MGyI0Kg31yHJ){=I70uN4nHul(eEXo@6tRZQk<8{f~U* zD_@znPqU0+!@4ae9Dn?9V|e4njiuTlhaNi7YG=-yMTn_tjHQ`1o6UAH(a0MkBO@X} z)ZyV_=UkEul%<(jyWJ)kLdddg*|KG$JGYC-=FOY8Y}qn4Hg?^$*8<7F-EZ5mecO)h zOO`BY7wtUHH*Vbc+0TA59D$0#8Jxj` zWwJii5Y&`HIPWX3X!K2RyAxR{7%Q=W7)+rt39KuEfWp39E^SO>>5RF(IZz3yEbXe^ z*r^ftK$0kC)EM(TPr8F7XP8TY*i(Xon4d3sc_SuO~?Bc4=+taNYtw+t9{bjm3@jn{iV2%R(Q3IsaGsqS}fCwC@y6ByF3s~i&wbu(F!M|I+rPPBLB4SQ@RFq?OP68aC1?&K&!sWE zW81cCuKwAoRjW=q>7;Hqb?<#DGoCuh%~q#3WzVW!-JF>@nwdhQsY9o;8am8(y;8i} z=&u_xk4le4P{B6r3D`DZCv*#n#}T#!+p48b>xY4 z+glHgO|+#%V*(yd7y~(!4XxzJ(%aT-aF1>L)ze;qTfT{f&qH%x3@ya)A~YAm4T~EF zn?@fi-`cLDLce3qZgNI_TnW3jH-Kr%3LOBN38ShirRJobb?6q*rm}_fP*sykKgM|X z-FNT1@4iPJb=2tS=qX z%{)RGMZ`HLpa%QFcYkolt#`ijo$q|?vMdS*I!cT&^Dc$;&U-D2GI0rJMNyPxIX*sq`|YD>cVc~0NO*I8~IaQc`8H3Xs!w1EktMNWuonT~4vakH%&AJe!^ZJX*iW1ASK z8>ftGc*2SK(2({%tu6WOmtOP4wHR(SEtnGGT+p~+pT*K_vN_}z%wMr;)jkKUbwANyWmT`iq^JfnBOQf~S&W6o z=)JG1?>i&jE?rW8=`rvf_MzJ@N4k5mw`=#=bSFaEz!JJoHDeWcl(KU+(1Ocl1r|I(;GXx9*Tb4mtYh zqZcn;JUTj>tPny7U1Qgo*4a{bMo%iDqk~wCp z?YG~4=2_>Q{IZth}V4wF}Z0q*ew=*WYmc1NT34$RVpvIR3;&!?>I4J_8Ub2&BU}9s|~zuGjc@Ik7R6n;du2#)+1pO_pMT45`tb#pt1gshH%} zu;B%UR)P6#p^2(04C1hHhhc|_Zwc?a?XGO787UZ<-`aQ4V>@=fs3BPjx>A&R)v%%PesEE+M^ZZ#T14$jO#Q3C_K1FCsclL{`$7E+x$2SUj8;g%(BYk+qL6 zT7V-CTHJ`6rCl;^vWU1@MjvWSG!_iaU)o%>%2LtEY6j^a55nKh^@4XD!OI%(5)0VHYo6oNA^L z8jZ&C<;%Bk-##)jVrFAwW9cO%lSnE_YG*pK2n-5SPXQ3L^qJ(Dz#`$yHKLIys!pcj zNgCm^#=^ymZn){X(_Z%l>$cj@w@j(-06 zKfYkuisgqKa!^r}ev{%@A@87;iMSmC6 ztHR|fgYbFPPgFqkDkw4&KrnZ<%4{*1_m|#!v`Df!1DgVcglboH!*($GO|YFaA+i5oQ0v^QD>xN`z_UUXz_Mn zL2-X|G#e-^?)&e4hm)(ijSCT}^@p&*@h)a*hV&HuQDRA0}-H_ z$iQ$!1QifK2CHFRP?yjHW>gH@=()?~107ptj zrcPjO2lk3Gp%fTkMrNSCvxy-kNZV1}>4i|t?4G@U^POYk)0=mF?!JG&qFAwX<7uZJ zefC*Lo&J>NC!EaFOHdXNB_Kib)yHJyxD{HK%VJ7^IVSdtS8o5}Q-E`@_psEqCv)Cz zF?BLj9O%0&D?me;VUeJ`SWMv zd>db6vmICgU;?o(3Zj|_MCJ$+6Ro+~UVCh6&#w8p#?i;~L|7=Q4!b&l1Bv$`MU~z| z(%sV8RmS_5#Vy~JiKA8=b?*3v)39^{VXO>oSP3JLSA(j;B4Ey!L{1bjN^t#yXB}FU z9QvbMJh7h4XV8CoKBlo}TXYdRw<{%~A+? z`&O&9Zr!@FEDzIyYk;UYc53R#J72_D5t;YC*Xuc7xZtbaf@9QmG@~dfn?Ahmb+3EN zTYl>oe&J=_`)5D<*(aZTa&G2owOW^6ddcONU;et+y{^@2G2E~Jx7Rx&20U{%!FA4) zT2*yn8p^^2X5Yw_XOGFE@ZE0JY8Br5PN$Ql$bRnUe(v(iFMr27-qGpIJLk%>e922* z0^rtLZ@uoi>zMheE6#72qTQ}9{__u@L&K% z5sJd2(!imo-LfnprYh}rd(-+253IZQ##?XGB+`hr(V$tgZ)bdP5Xc}zL~u}Z&V>*p zc9Zerr(6>NI5SF7O9!w?9i{5} zpu~Rl$~6~X{DM|{`m105-VN8^eA-ie< z-Uncm78ifb*)Smd4+ILh8J_wK>cN)8+PF6KC(t+UFeu0x{etF9x1kzP9<8sEaB#y& zU3^zl)!$dafne6(Bf(4$`O3bOggy?H5ZUk7!Q>YS5&fLYkk#3UbTGoB1%Y{RHZHc1 zDZtLy4Ngc_g(Rq1RA&rw2FEpMH*lBKH`Kk`l5BIdm(eY;V7x$5nIxm=yqINLEWsQ= zXiOFW$Rgv6bFW)-z6-0Ev69OschCeOVt_b=8MfV3w*{;fwB{CU@0>jF(AJypyzyiI zG`@E2S^wo(o6bJ-xbx4Yjq9;|xhIOI&KG2yDhb{rni8BN7^=DgxuWpE-~!|Uv2S!~ zJuIj%dDzIr?uZvwVCn{(V_PQ=l;0#u0D z98?$}C<8Fo?3B~ryXB-1^;6ZxsTR+eZn?TARb8t`(f0F|Y~9`|T3ElLRoY&KP=JXz z0ulMZUTf8!XxCK>v~y>@`}Q68e04{$eA(Jlr%t&58_&l0I`EPN53QYZgd#JtVZy{5 zoEkt(rp*UJ=oe^4b<`&^2G)#&PT-|Wmu}p+aqr%}xqo4HcJ_PU`=0l{s;XYEm+R_# z_wH@C+sl_P-?(w3_x^Cjb|cRLfFsV`5SLwcS&T8p*lM-B_iuaK+nBjdbyuKn*U-8#cV+6|cDT(o02zj6?8d`j*Qs%g2*a?Y)1; z@Bf~NfY}$ttAF)ZLkJ?Ks&9Sko3kWjyIt0G{l+)GF&}kKpuF&fFMRQfUko580HA!NNs4G%y`>?m_W&)v^ zu3oox)4FxH+;R&{xL;tWe)HYoOktFn*$hk&21M$((5dFyfdPuW8cD%altmGi9DV%J zQ&-)bjrr8z`c?}(Xg+9q02h_%fC_+7i6#V!ghq%#V}gOf?mi;VgM6mth-DoFc10uM`{48H&X zAOJ~3K~%e!L13f%eUbgN!ti;(i=^wtG9u?#Wgm9U@W1=#M~096VAC6zEH;Ncw6B4d z!SLSqiS~zv$*l{AJmmgc7E=Smv(kNAHb!_%@I-1)I20E9a`wN#`u{cgIAuykbwHQU zHJXd{16tiK={DGHpnIL{U|R5wT)t&y={FkqiVR3S49KvD>)=9Gupt``8<{a^;K*tO zRdpeVQDVQRJ5vKkx2DUOS`q`0Qf1^P7@hmJUj4DZ|F@6-QWONG zFrRqGOlM{er=HX*Eg=dM*q{mq>TVAnp1=;yNdXI1OWIQw?OwIB+VbG`9k=<_S1&vM zeBOALZ!N>v1Spu0p(HMlS3L}X6hxE_CKvDFqx91g9@+ZKd!H4>LI_74b=2-Dm$!ua@juh$zm7o2g%8B3QgJv>W)&;YD`(Xy;}2q0$!xGzJ1p+rU&1|w>O z8#4m}K;Ep^>kYUM>|C7^!+a5-mQ;KQ03;;?QjER`CYn^d_i8X}*avl8=R+2eEbEYs zC-bj4zYszgT$|ZWLRIsDWKqVo}VfOCcC;7Cslrzoto1Ao%D|ho}9UZ zM}S4@=%7a-iy*)O{aAW92IB?}kU_+(ggY9HrH_Q=6 z_>UozWd@;+c_5eF#mv+UnjA-11>OT}hTbjlE{R)WeUHY6Jai3 zU8&62Gfjw&Rc`*Ot8cvarhC5d)nm>(_k?F%xb}>vlpEGyauT7837!K15MnYgxh&4o zzZ>+^hmT5E|H+2_-Ft|G&u~yvKnw!FnS&~@3)qTuOEr7LLibJ=c1%pnv70mLnZk_C z%mhs+K?XJ@16U4zlN+>17&YCG1`~3~cA&vA8zPDhkKcCRLo1hH)5^)%+d&RR5i}+? zu!98??)Tam2ueWk1kw=9;;uA5YrT8-Y`=PP<*CJ{)3N?!EZ<12WyVtiGV=~hs@dDo z;B+X-J34iq49Ed+j*7kaX0~e8s;58w={Mhe^VY3fXJ%&1EQFw{y>-4@uJe0Eq$rBa zgUED)d|ac%!3ZNfh9F2Xz}ORcCZa0V$&d)_P_zOHE5<#+tg0M&N*Irjr<`X1#D9tI2rpu?<^ zLG8Vvo%Ch@8shy>PRZzyOY=r4kos(bfp#D-Dp~`5d8#~GethyiDw+d2fC0n@i`Mte z6g&)?dS!nO+HZ&$%xZ}EpsqQ5pg*O>9qs#|wW0CR=WgsTWq;UTM>t{}alYjT;N$Yc z$KoL}4U=w2VQQp~`#Ol}e$@BG`sNgG7rW1go$X=oxWGWHSs@v|q z;ofaGTy@okbIv&R*%uvq?%87-Hid~vL{SA71=M1%az)^M`;B!ZT=%F!FqoP!n?nM6 z(0Qb77H>=SEuGn`$660fPwo-y7U`OTh*ZplV5$Tn1F-`PsGXTK?2`j_V*6?10*oMJszBcZ!PFSWj!c9Ig_DwMlDT?z zXJ>Z%uI)G0M<28LjHkCYoXoUdum)H{JPBo(5ao^v8p>gh@C3(z!JG9C0OZhp*|KG) zpMLt$M<0FPefRCzvnTToGWB4?h7D`hteKvkE{dYt?RxJIL)RbBY6fxuIUO))L-5|` zFh0hZHyg}k5Q^s?vaLg_)ymxmc^n@c0EMNLoOhl$N$s2y5zk&!Rg{@c6~yc)P?Iu< zG3Ine9z16#Qc5|0k=YPLloJQ&XIL^BVW1P4-5dudaHHJ82qQeEAkQMIDTS1}t+CGJ z5~`|TmJBnZfH_#VS{N(Gg`n)5b0P-DuyLZQ@*%y16=n)g1l8oC^vbo?I;ve3b21K| zhIl9wH8;$%Rg|s#xF^fD#Sgpg9x%Qw=M+ltbQL$&(h0<(M+dhWJZ4pW&pr2CbNx+I zOIB{%w)2!zPMVk)%Ok7lzFx?WNj71WJ2)(;A4M->5KD7EH6>(9nrR89WMBpuMl?_~ zFzKra=3#j-RAWb)_0Nrs(6|^_)*rUMWJcq$++-8_b7@XVF!g^1_8}}7_TvpG_J3vH z<83_c$czbQP=eaxEBQFH&jROZqajH*t7;I4`#jr5x_{`xT>LPbN%UC;`>9Cur#R9( zIAV-Gsso?{&JF=EHW)SDC=3!Zh3x^|4Y}FkwXwQY;#SaHfRfavl_9Z*b0h+ov&=Xk z1(DCuoSD*~jGvWy_JuV{+k`rk$(=F43d_3o#*_%`%BV7rx`3Z5%AyuFD_k(?2`5~*Jv^a3TWXxS*j~l3AG#R)_lXY@oDEwESngY-j3j5 z1Q9WKg&9mO*D~OU4J=TCnSj|UNmdX!6EzCrF|TP4H=9GvG~hE}Up*C~WxmU1L7A}USj zo(T)=*}0&qL@tS%S@1zrR5f@PQ}paaqM3Q`&<`kb*G5)7Ff-LAQ;?E+-&_X0Uau_6 z{PUo(A`2fpDRT59jPS#T0RmN02SU->bm6o93x!hDE5xW+v%+`+!mXlR*Y$=IPdL~6 z_T&VULCkrVy9s&NFz6r`t|w9ls3t+>!r0j9&kdckgDXf&UVZ|mHo*cVaqN~%PMv-B z=}T9v3@!`HHR*$gNg-0c!R7;UptkvATGKxRdoVDIOqqWwu-d3xwsHe-+m0Q(PCDtN zr<``?vSky7#`X65`@tR*qujy6Ksf=qVPW7#m22|`Gng-rVa7S9KhO{u^cIjdtY?Ekh&-Dj%We!x0hD`Vxp`MV&A~&d0VTEml>7f4 z@|EG7LK7wRTeA20c{o7Ij-vTY&v}q6s!J zUTY==HF^isBnJ(oM9RK~J(Ok{ytEuIlCY#eE~TUt9D4>?G7k@Mf-*Z%Ve;M(3@t%g z=*bs(E__CXN9tDG4zRnvfmf`7*aByh8^^;`_ zOas)!kP51RJ&0SY&i7)x3Umwk2Sc$}G&u*yWVte#GsGe`bY2hv)Ku_IF{GW_FwT_v z+6Vo&7=Z|mvdShxaFGkO_P4IyzIp}LEgL880!9unh^h~zXf$F5gOp9P%my=)F+nB8 z;8DX=!5%7R)ES$$rN+7K<-~zw=h)?62`Yj-Ci=^je5CoH`pN})*Stt@ z=sPUrEk$HFaga6AMoEMbMtDr25OSo+z<$j+=dO9`8Q_3Af*BIAbcvA}l!KpMx9YqN z>)=3+M5W>74G2w#B#&}dMD|R?9$|XvNza5gpeTjm$KhL0ADF-#fZ)T__|9h={?&s>;TWIrge@yp=i?WxIAXJ-EcS_?#1A??-)^8g@fl6Pi+ zF%cOAiA;zILWtZiU<2%#zzMXi-plYy(V7x+nPm{1&TywuHkx-HTIiX`Jy3>0cglz5Nbq}xKC{` z&Pg3JG%g1@5o-Xk37KQ`O#K*o-4vyIa28wc$4@>3E2er{b&R3nz(n2>dYSvi2&B;< zATxF_2Zfq)KvI+rRRmM$Nu;(-t#gGL5};4u&r$T?Ps4%*!|xjA{2vC+FUmX*Z#+1u2BnG|^Jh(gL6Ra< zGIPWZG+}=Z=FKeIH-JDy!FeCq_^-|4FnVGzEebNvI2Y^A`zZ)EURg_Bsxg#N^ z;DZ?P*ak91B6x@3nxIA%#O9o56a@e<<(^p_%B?n!-zQ@`BcV)FASRoFjybG=6M)D9 zsOdr-8y|02@O}NErZ%*H?&JHPN*Lu19v(WVvSg}r4uaLR?iDSxCW>GD`Io-%`OiJ! z_|*&Zcwon#4}IwGKl!g;R5nwsdxy|r3px7+Q^&4=-+*jb>m zCAm4)OzWD0V`hlO7`gBwaeQjBuIm`1FB{2U)$CS4>DMA$j01%P_6E4+7gRWY-fnkv*d1QlVQAK@l-%^|?p%s4oy zswR)%SS9OwIWq~tsY1Fvlx34XND2m`!ZVnia}pz%^W|p){fH4pc(iElq|62(GqWCJ zhOxu+mfpg5rTZ;Uo1L36>J8N7tqJ~>keduZnk`ZDklNIX8={U{=IwwRM?KYn5DHXt z|1Ny#IHVeEAaZclq#ewNU0~NjAh;F~@ZH59n4#n(0~t7Fd3OSd&EHJ|zYW9Z(N)+Q1C#k?*L@xum3IP%Vmb zwyIi+@v@lNF@OGxX@E%nU-7bm(G3A<0vP6La#1zMTq58=6ejBPbtE#AZ zM06g6PvC&4NCk>Xz=MJk3x*YojtE0CihTz?2xA^@FKiAFXdo;lS_-t9TF^l->REUk zz~BLx5@;ZBpiD$+0h#^WCD`HiF9XUsEQuRPgg-a=cS(E^Fp-i!7%t%7Ml$bzd zU^u{xU67RO`7XEHT2)jOX2eBM5po5HR3b%n&Y6fp04G&lwAyv27m9YQYXDGfkGJZ& zioIBtCE9JN1ysNZ&@GV;X(GpmppjfF*9?-Mr^9Y z=4lSNQPVY2Uqk73hX)-mcorq6MntSCgDNp+%LH=@2Pm0Y)B3IlN$g@D!HH&>N^E9z zvX({w!NCiBf{=Kozz*O#nOJWnN7oF+1Km=u z?E)YqHh0ehUw-%dw|(!%pZeujPF`>U+Ft62q6O!wUd=84gXxR=&kO~NG_p4mpuhuG zf4%O0TjMoM_dD9_s7B*NkZCBx&0m?UlF=CM(7@#v$cd-sRtIEiHKEa{&CLP*cbhi= zh1I=+5eQV*$E?7LWmD3fBPL}t&Pxq-mX{z3)TA&n$rTARG6Sg*l7pEu5lzM(zKyX> zz$!0TP-jGHfMc{mSJRfNo|*67KhAe>aUuDW9j}a5AWBgb!}2>LJgG3C9^es1=KJ6X z-tln!+r~U~ar>cPn0cVWm|q{bAslA3{V>Q!JiZ=nBaAS@K42zKAmEL5S@?(~wzMv0f0Eh!uz$%M!| zGiA6`RY3IKv-6P(sTFFj3~FX6fjyLb>4jCR3dUR%vC}~aAXrL5hN4AeCJ|=DnIq6j zsV47D1Vjo0IWSv_V8B!=0}~Z(O^FMynjoSsAgWO^c3>+CGmB>M>>c|UQ@yZ2MT-rY zDHO`0Gr!=RBT*GmQGjwoATz7PCK{`21kVIzMyxorR1{|Lqo?&FgdOSqaK94G_XUry z)m5VuN-!awC+q-jPu;KA-EWiL5!@bE3Rx5=3}ntyWMV)Ewc>1~2n@t;fx)Mn8xt0j z#QATQgM2d+0h5w<&M6X%R23d@U?K)Ir97Z(QIQ)T45F4rMHouNwm1`lG;H@purY>H z7KQ}%mJo#@OC0lTwfT!*`sh7d&VTvK&b;_ycgzWh2|g6905Txa=n-&OFmcj~4BmC1 zTV?L*s`oX>_3iQjcC!srKpg-UBi^@t1&d7~Y|tT@*nYzcm|0;^GYnbl8pvqa`j_&R zWpH4v;T=gQuAXu%J?GeapAfTPFAS8EUuJzWW3zs-EZb=SGm)!$vBl23P#f(v2pc9) zbdxHasR0SbV5&hg#B)S*onF^fu{GY|)@cq)72~iUkR8+rk3;MiqW=(QGK}F_4V)T> z^%{$!coYfl$JcXhgb_wK0E9-MD6<20-*)Tu|N7}xs>Ymi7IsZd{@m}r0~3?c#CcBu zxg%aH_rd*^Lox;o)|#W37$6s#{tV5m%SenMhnM>L!)sB0AvbMwj3eIEV5_nIqr?%esK=bwMnu^Ub~?dUImb*ze%Y5^$)kE~+B`hw^E*h$A9 zQ}?P?t9|vg*M0lj*Tu*wC5>XF1V_Y5%0wm=DHU!kk)3$rvFAPg+=;2>mw)N2x8Hha zQMT*4OWwf%6PTqc0m*sK9Lz)+WMTsN03&8-UBQG~Ev+hWp;F1qx;_=59MY(g=%(uVwy}R$(3Wy^~QM@Bn zOLYwFT4gISce`Cz7VKS0H34MAWGXQPFB+YrSapdxlx1Dl&IRXu)Hq^Rk8tF$eIhRH zm+lkcA*8Q$yH_CI5bOb>jx$Lr3Lyd$u_jnf6tgzrc+MAy?VB}V17$S?KzN9@ooz~} zNlxcJcY_EJpov5|>!zwHESvf^k-rkeF}UHTH-5mZG^kML&CoAgyMtX7Mlh!2*o#xC z9cbFK^y>PyyT0+kzubN2z0Y{nD~pp(kq~ICWKlRb+zK(mejsuR@$5)@kh`_}`R>9M zESt-)$59QCf|HsVIS@l~x!=gp=Y_E8fNn7OlyzA9KnQRIX|!oGL4cSt(=D%6OdG8Y zliY>v9Lg~-k`oTxsVYB4X0QY{HUm2&*N_@a^Vvg0l$x`Noq<4(1mmbCFut+Cq^gU` zngtp-i~pKafXG^{SXG-fbz*0Gse4@eTvr^Io92F?U&#oMGYrS!k53!I;kJcGH@(qG zKEeq9Dd5?eWEUwHRL31naluthpy}2aDuFA!3A-WTwnvDDe6FM*_Mv6PA*04+bEnl^A{fWn&de_}|Z@qu}DJPz= zdiCnf_v|2Yp)3R{brdtC`e!fxsS}So`d>c&>4{eB*Ix50?c&3if8m>DQFgjB<#<~~ zBqh(BVpVuH6HQfc^sEb?_MGQE=d+*viq>6EmU{EVhLoHu%>)cH4W44GNRp}+0cI)X z%8;?9+82(9Vl~e$aJDCPF81bC$oWDb9;y(D(FaR)ow#7?JSy@>jml>n@yf@=0~C+PrzQW2D&gc zE{9$lu-(x-bBH1WBhQY_M2W#fGMIKlG#K*t;wAf#qyDG7Nd zPi78aW$o5!+e6oV>N5}Q*zx19dgba1FGM7SfTr3#lx=x(uabuYAu|IdvYKcHx;f2X zSyx{RbaPR3h4aG$5r_RUcTetf>4}PA zl|&p+=RfepM>jt9J);gBaKGovuxjIe8xOY3W)L`lB{95<{dV_=o??fgGmNf_5k~j{ zz|1uFT{D@8)|H3zN=D|IRs|CkvAoSAXZtrRG%!OXtF}dFiRu`5oCweaCFhCRrIa2q zzX@z+xoM$q4NU}tbshC!5UU&U{$}wwcEOh6KA_%E7NUA3%+Ix5J z`s6=;YIb(^O>cd}Pyf`jzkAhn-AY!iSSA!x$UK#Du7{T3(eF=6WtTM^XTCL5;qSl__brSDU)f z3OLbo?ZsFp3CxcK4=zw@2q z>hJxV&P&mns;b(|kg#;=l2rGsf+L-p9CMCBD0|(y+wBoJl%bO4dYY^N03ZNKL_t&$ z?chHj@-l9}7l-w_AG`fxc%eo$VK3|st^d8-y^`gYGVErGQ7ow_8Id_qHeg5wCd&eZ zAOXpuHEC1!Z)gI!t=w`E*9@5>H+)!DI+}pBW6i{#9AbBRZm#Sm>>{MnJQosGV+te% znTI-2A`*i^sp*T#k*6|{8gt-AV9$Xpmy`RiJt``ax1J5xT$T>1g#>Qj>B83{|Vv7QtNP7kRGK_7S zKs$j{6M{qI1Ox(V7)%5VQ8+lq#_oPe)x!LaQuq3a3katumJff18BgYO=?RJ92pk8b z39=<&HgVi9@IJf_!almNwtxC5|4Ks*y?W>+@^E9qVgiC0Oi4vVicrK9nVA5!#d)e_ zJ{K{uhz-qG51P3!TdY_TxdT6(gCFU>Lyazt5k~mFgNW2rh+2+(5j;C2b40a7vIGZs z3MgV-`%su>i{VE=y);(K0t2dy1P4Kg8VV2ReDc{cNlgHD-m&3O)VzGNI$*!nUqNuL zIsg#j=o~rc)HILZY;lAQ3;le@_ZLsj+`%K{tu^Tb%fvS`Wt9!l!oxU8KpIr#;BAG%EiW1Rx=Ju#3 zN!85W-Fx=zTD^8vuQT(uxBbqEryOI9Yp%KWgCG3h%U}B9U%cdHb8|EI-m~>1AO6Q@ zKJ$W$o_TJkQ-9>IKlDfM{NMB4&g)+O(Gycc#yltVkuy^n7_x#D9-f;b`uX)X{oOAA33k&nBR;`+!U-%r|Yp*23XX~XK@{oS{3*mQJ~ z`U{`?^w+-n#aF%Nzn*gH`t|FdyLR2`5B=>wUUJDVUw-+&efCqIo0=Yf=O4b~j=S#s z+~+>?%2!;vWXY1UH8C|c7 z^{pOo8ysFr4qexjU^US$U~}EOqUwCb)2&6=MJ8%+&S}m%!%PK+?3j-ORJ~ClD9uV(8`_3VhGJQ3Y=T0e5a*`Wp0?(K7d<7O-*UZn)zPX` zRh@;|Jv$!Ua`%HemXixM@Bl_5%;4Zf)yO)pHOcW+ym z-6GX)6Dcf}S``)pTQezu8tFMzhPAL{(*%}yDJn-40LvC4N(wN892`LbPvjUR%B~aq z_FffxT@H|Py6w~yM zvy_sVdGAw7-EP;+LI`D94yyV`R&3`17ssFtb)f&HD9p^b`JmY-kJ+sCv!3YSd^0ns z5wr2oFhOFajwV!H9<6*v#mF1L?oef1c&UVL$VD zU~1s;!M__}geL{mz}fRPN-Zf1{HO@^-B=sVZ0{|B{Ng?Q2!~eyCLj+YVupbn8$m>p z)e1vkcyDTuer*Ao^$P$z%yqxGFjkmR<4&t=%0vv(hF5W@1f}L>;Sdw-$Pew{qaEhY zPtM!{fT0KeVZk7k50_3ad)K?(_swryS1a0M0j$^EaQ!jI z9{p>tfAziFcYXa^*N|foEqs}hm?wlXMH8{HBCK6CeblBE&-}3;dG7On`tSbk?|a={ zM{QiXX7!47z2m;K z&pZ9qum07Kee@F_|HNl5y6B>1OQv4*f>*9u*7~KFzwFGj&VB1!-?A{fYt7mf#~;1= zEpK{LyFLA!pT3wlkhj1*w~+qiy&rhjAO4TeeCiWdedFuzea{EB?U)&B6~F&K-g3fm zYk&6VUwY2j=l=Syz4oE|H^1*a?>%bcrfaUg?yo=eH)}Vo-?)Co)Wl?pRe|FCvre4Z zyM4(-IQ_(p%a*SEy+8WEH@@}Fk9_2P?|OG;K`+(L zw@k@#Q~4yAGlCHqV&J|C?SW*`0f}^|4AkfX^5WvYX%vSt7(@_L135&(F5tF$_EVCs zhHZAdmsm`pSxgSdZR8Aqm;@ko1j`(PrkW%+xKC(b_k<*i=^F~Ti6~>HQ)bi5Yl~uI z5!S)21TO_ofX09TI0phe+7oBLqK(u7l@Oq+pb4?Ac0ROs`?iH$ySLwY=UvxcyZyF1 z=XUHWs}!Q9Zf~O1?)B!z%ECmeR0RrVB2aK}&S?||IdaLOfeprBz^O&cEfA{StZ>f2 zl9Cw_MSF1jgWvkd@kjgiGoKH447q7B2WFMpd%xH@F*x`^Cj1dg3qAf|O_n9g!<$j= zNo3|!N9T!%MB$tOGuFGI?tV_>+iZ6;X7UFLXUw@z1!RM$So7fh?gUmfW(Io`jZvWz zJTV(NFgevAX)4;%{wVM|U<%X*m7oB4pagvXF)biNS;81div~3LYZ3*l zkZM_XFXryU?#&NvySuyNuDEA&JMJ_r1fP;=R5+k0SfX+Zt>wU)6250h>YOGxVFrv% zNdn|1W7(cZee>MjSx@Yyp20X)bqP_6$kZs`0mv=dQ(C^@A8)6RVV}6) z0Lqo{{W?psnaLs+7jKzLGPGT8FB#+%9$&}%$e{vuq$VQboF{T-jsOu0Aw2NF12^4t z!|vUC>$+xU?|o4eC!BD?2`8KoLSSYhI=rtzb33=p>qL@RxVF~94q#YRU$|IziP-s8 zU8k~ONy)iDM3#h^B`>KVjy=OtO1><6)k5&4a}FRgb;Pr?vrCsRHzJpxCc+Zcna=K= z`S9O_jZ4o%s1L-iIz~P=?PvYFc z5re!>DV4#S0Ys;sbj&;d=i6Il`ObH}`zv4h#zHr4IA-I2f9r3abmDOfbGs%d#`V>jM%XR9?87rN{`gA>Gg)?_d^=hm!QbJ_1)HoK5M_7DI3cYps+b=@Pfn{K-4 z_S^1UzkdDC{LIhXe%r0v@4xTVlTPmSI;+;KWaeJ4o}XKIXxl@VTyn{|=bZ78kN)-e zSZj7>X5E_AXPtREq29Ig!MpCbQn%5(ddf+i&b(S0YnS6=?XO>X!~5U& zCq4f8NyycGH|ARj;4#up^q}cYr_FuZ>zn=f}Gv59?Z~H%g{(<*? z;ID7J`KIHJUVqEY*B^WA(ayOY4?Z+8Hnn@#Y_AeYynXx5bsN_+!x0M4b#E@ksC5;q zPG@%4mp}i-FMsJv^9u{_eb2k!@P;=`PEPLHUH!1X{1F~G3^7KI$$1ok@7%mO32j)n zadNEe`_xfR8@M5=|9(rTVe7BKi%hUVllk!dI7`qZfhQ(QQj^;W+*Z$j)#N*bI|9uE zHIQ?GO)|CLH3n|93Yek9Y^o{i=rB092N;u)!JC;`DJYGn$(E@t^TlfCR)%5?+y-DB zumYHZw$(}?5K)#jG$Vr}4=(y9edA@0U&}SCR-bYbh>q=cE?DSb=dOiY?!5KeSKoQ< z^}Fxe`p`oUw#S$6np@zMCVY!b6%w3_rZK96bL>7zxyB{+7>S>dJ8{+^kcx$(y9w`|$6ckk|8`e$b6oO5o=mMwSOamUl1 z_Oul%Rxoo2;bFR0a&M2Rkp&-Om86y;5QDt;Db}8ud=Rs;46*JN!2_@q$ymj#xl40h z*DY82qD)oQD%wdz#MlfDL==Kkg{rD1A}3MHBCybS*b+MCYh!pMBQE2V@jW56C=f!yU-aR+mc@BiT+U-hkPjh(5s z+eNHNQC#!Ao8S1xH~sn>-+0kQ7w+7-T_8)AEq(Dze%_3?Ke&6_ww+9+ckL(u2T>#14~_(=nO~ITyqpQEG66A2L*o$jY(=dq{8Vy<7j{ z&;O=9vGg^+@+<9j>4?mPNX;*ravxNxDla#O>92hqEc1YYv#&fa-U>Zj77M6?>p`}} z`iphCGGMFYF0z1*W_1}hGq8agZ+hjXe#^$141}iYmGcwICgvThvRI+E417ZHC%Wvt&&9=58>8i71+4H<_t`gQwsmB{x2W_Bf`Oj{pDcy=jyr z*;OX^-TU4%bNARXBQkP{-1o}NTC(;r@tvGKb8u}y<&$LG<+u@}EEP_*Y>|3AU7 ztIZ2O?o_ayg>0E-zl+wj<&-W0g&K-jy(qXKB2i)pFokSev;FxHo=W&2&@_esL&{LD zyfX#RUhz%r%~|^CiV}>fDuftpj06%H1Qr^*g6&2%%Z*!1$s(Yi(1672$0pcC`Drc^@W&wQMzto!T6D>gF7boKR111SG_oB z?eVPEoVU_pQN4vz2}2pqAr!vXxubXaL1aZ$P>#n$YTy%hrX8MxG|gn)HJHp=(LQEI z@M;NAQmcfx%%GBe@b>b)J9nifSCLTEG^d-m*^nwq-inrl|CUahLHpBR@HGz<_V=&oHa zv7*1PzGvU=Joq(h)~s5-;;T<=otkdd8uhhn*UldqX2_ZG@o&7i(+fbJn3peGws651 zQi4~A9y@&G`EA>kkh)~`>XpOuMgSnlzCC+hdu=}vtys2t`O*~-v9;Q5Tec{hNRD{% z#cj@Vn$}-^b*~{F9UWb@YE4>8*cu7p)T!~EJ9oCSW}3QHtJW-Aw#-W~Y`^iswkMx_ zG9G4@Wu{iM)&g|k)mK0H$xr^Dzx0c1R;`92YqgzA%S}N`ovpA|=OJn_5@Otw&a%Up|z`YrI$zUKb z^+MeOifzBjM2VCY8jbx4V!mmOw7xa5gExIPNg+axL!O(Oxn}d`pZ}>JAMCIH%11u> z=#$@Q<=Li97yX+L{?O{Bi$DJHkALZb$Fp1|z@)WS0Vo+~LOZi*8We!%TB3yl>T3P% zf=-QR6Vo2H2J72XQ+d!l7%zN!e0uv!yO)p6{o_CT?+5lD^f1j#<}a8hM8+jj6ubBC z*|Yb+)6YEj#V_2~YUWeZ`NZVu+wZzbl+t=_{LGnyhmN(g;%`3txv#(QycZRvdTowL zYlWz-)db{4T~f<(Idb&m#g}c~aPfxMUOT>O^@@Rk`ssmMvbsV##%vUp8-E!wWKBIOo=_U$t!c z*lS0Q-hKCbrzTrjmWj+ZkozXa>li!zgM$qLq?%KZRIWGl;&D%2SB!SW`Xmkk?-ta=@9(l0;1!_q3Q_?Ou+BRn~#U^w6QNc_Np1c z#yALh?*XxnrGx(WUOzyTy_5ihLexPL<)OTo>+CYuxQLUB;4XqL1`PoN5ZldP8AMVc z5mFXwBjHg?mO*UQXkyD~0W=_{<)IxI3Wl+sNR?pv45ggAOYRHwGYYp6@bd>h5tW(FMe1+qVx7508$HzP@ZBhKMj5Wxe;_dw0CJ z?L9YMPo#VI?tSEuN7k-fp9f!r{PdYq+qZB3U%&tT{f)-)V<-RU6Mu5ktv3}u^C4`1 zamOvUY+1j4Ju40#Jp8$Pz5r+HjmGrU#Psy!En98{uw%!LB(-_oo|>Av_sb9b{7?Vv zg3$$Mj-UA4=RUV+$>Q4nx=-0iV$%B{r4{z zoxgMYj>jK;%n>hLx^(juSJnF(0E{uc9xJoTh1r;mZ$?B-nRGm*yN@fC!0$h#HaTOY zSB5gtIgPW++E|Z&)ZasAb(Nt1A1N0V7z2BPH!J7^x zW0Md(JKB8d#t;AOPr`@a{I4JX>XYA?&e|8PU;eWn{E@|r7X8tm{>_&kd}e&IZIhHZ zX=iGZS}5`mBvVK^IhvMx@vm5{naO){j0zD zb3uA$vOV4Q!uG!V9^J6<;tzf3-@UNy1-9;m7q@-wxo@=1&;09VyI8tp#jk(#wEB8%Wbk%Q;{DKDOHeh3htDo~=1h&=$LVhIFlA?yv! zuLS>S!Urv9K!B(s2qHN!pcE}2iVJ!K3k;BlBDThi(1A3RmO$1djVrC&K*=)Dd|*&1 zg*d1wz2ylYiG4P-yfQ6uWxt^TB$4p16pb@kN?!_7)={h>1c8D?)JRZ(l*o`%1du^} zJ|#n#v$k*1mC5vuU|z^-uLON5K~5nv20jbytil5`S4L_8C`LiOP07GglwewTP zexuz|hauP3P_@JjRiO%KfR+wbZ%YWOk}!4FY84(N-AANDS1Dgs9T$3_mUH9nc({N6 zh(3UkFrupC-GADHy($2QVps~WU?$v>a|;Lxn<>=Rj=&Y@oT^K(UG}hKmNg=s5k6$Uwi8FpZnsz zefu`7xoGLqgUH@9!IEG^eLd zojT#13n2^*4c&CpO)Hl#o1C2d(9eAMzWeU`!23T?tJRpvdvDo@1d!D0>5Vtuuy*a* zc5C_NO2M-@U970&KWXYM6r|!T1{u8Ih@3`yEfq_0$Da0&lFdMV+7RI^h zu@Y1fs%kw0LS?0gxqQbPXZ7cKhN~Z-TERwLpLRw~n!#`H*?vh-JbRa^Gtr>JH3TF| zz7p2Or$T&Jr+ zO*h+X)-C$bhd#J^#q!_(Z-4mZ`=6Yc&dJo-)x3vjKv1xQ7DZ8Ll)xGb5s*ph{U80U z-?7#nI&$1A!%*RiWMJq&|LU&`n|27WcF(@oKJs6FbLrv*xtGlA-UA1-cJo(1`rBEn zO=;hmR`L6P@X4hsmZnMF7wCWZ;KN(@A3EY{gC{1Mzy1GyV*Q%c$_h3I z4;?vv{PZXOk03ZNKL_t)j_pscYZvXKo|7>(* zuCtKPK7IPkp1miU)BeGSo;Y&!6s4&#Cgj=pRI}L*AN$xJj4fO=J>6!s}vJ@|KbeA{=PJbr5bYlp2(nBaYIPPO!LiD`9rXL?PldqfI^P7g5V5y7Pq1z`n6g}ml&!m}Evd`^htEQt$%`0baH5j3KsCh1T@{^-3Cu)FP*4T-Dxj7u;$d^N)rr)LsI!gz6`~ukFNqOp z0zft6#bfiv#%{T4^JTZ(^xT*KcI#i=V@{o_xAR7X4-_6~h0Fk!Ig>JyuJ{f}9jFH_^F<{OGTLcSiFbpLJ6;jQ zqNI@MydffDcpCDmZ$4SHo-+K3b5ja0qRdbwkpKvrhU_tVFHOFlqm)nV1`6<#~$wh2E|@b zh9MMNW*8#C5F`W;gD8+;O4;_o4Y}b_S6h}%Kg%+d46uX*J4-eQHr#A&yh?aUHjZmRTDLH+6#Z1;n7e1J&WhlSm zv*ihA9n8CrbN~RTkTQs%-EJK{di2z(6D~0Xljm(Hhag$I7#wV*H7DXD!^=5W6vgS& zrz7dWnDc8@B59wP*|?Ip!L(@c*z%Pt5yFD`qobn>Hg3GMQBQry8;wQ?VRCX3hHLe{ zO&d1;`(OU0GtCJf^yrb(@45a45r6FHiM{*wf7`cz_u!m{_ZS%HZ!~H}@Bo%9S+Ziq z3MR~%GiUz%`Qzi`zTJ$|LxhzRPJCXBjg75aw=U1yX__utwCM2RgG6-d)T#aZ_y52L zw#=P7S0PD~yzhPQ`yZeFi|OgjwtYz`s8NzYU=fKGtlmZ7 zn_m@cPdcs&jcuJHc0d7ORnxAgAfxDsX$|0p={tC z0*I93;(@esB!4So7CU&|ASG6VeC^`ljjNXa`KRxB@UbTgFLQ>||M>4eymZ;3|L6Dq zzxy72Vlpd)tx5V@?c7?jY2xz$W7s%oFede(KwFR|BsMRK-FsdoLLO2W28j~D?$v{b ziXdP%iJKTd{mS&zu9tQPFPzrYSOh6r$3jri#3sqfGx@=1wpnXMKu9R*f92J~eBh|h zjWI53`_{4XLr0zpDr_8+QONkjURD8dmWSPY_C{MH@59br`>Z)6BE;%d0DS$$mzXS( zDT;zbT|$SC9P{2QQPCE-#3Ttjo|aQ0}v4;LK$Ev9EsJ*3!af zD1vjTn#S%uCtlfoyq=`(cF2n}uN^$%jL{+&LE6{1zJCzhf9UY|GtX=Ag(n#|CUBv#C`QTh?z)5RaHpA3Ko(aIP8lDThkAw^olW4Dmkfv3YY%w zA^I1PlnHy!gwajl9H#>E!T2y&WxY!`yYxz=>wsaPFQ67_=@i@c5>tQ$fh~X;#vE}D zi>~|BNy6gwTrHz1V!{eiB`7pN2*eQLNK0c94|2o_m?6NNkvUs#z3tMCo4)Oid;j1Q zd+vMK6qs@bA_T$)lzwq zNMbvzs?hUxkFJQM_s?!br7O;Q=%eCH@i_GVFo*_e&D zDyXB9J1Yz;0U{xUDE5mULKQ$xAgTID^`e|-EfHsaQsm;r|0+Bm0Aima2tX1z_D`U) z|ErL4PY1Eir*s^qq9mcWL^I=f1UB+qp`=0tRZ=A*B=HF2g2FJ!!U?M z0t7^4Y)x2H%JiX7L`58@iAV;bya?8DdF?SFsVQ+Fr2T1@7X(t~Rwm4>WQ#m7k*)O? ztrnOp8?p`oJ_MVjLCMwni;%NnV@=4E5*M--TN8+*G}@%K#3Y$7Tv7|r%zI-j%6gVq zlX$N_7vt(sAJnT-fR#c_y+2m%LY9G<$g0}3UTf!PT+%3l^8v;z-$UKa* z))iUaY-VIw*|2Toq3Em62|=ePnqJ(YqvOX;PPa1zAr%G^o1_AGdA*g#Y`h(VXkub& zbacUv9lLh!+H>sK{>iE4$iiid#uh9bt;e*BnE_D^4?p~Hv)PO-zL+_dZlV@65<%m7 z)ELujHpj=uf8Yb}Z!{XUTAyJfilBi+nKNTfOR=qJKMUCgoU};}=1_PTW>&;8RXQ#7 zfNmk3qYgVh=Edc{FUYV-HZ*G2Q+hdg9drbggo>m<72|#82w(ElIu4M%gl6ty#=TuA zK|~s9@nw6(I3sCUpcM~F5rV{ZFG1M|vt2NM!5z2%z@|&S_Q(JIkw5*^^!`KrR2LPN zklHl&nRBi!nK0I0fvavD9U9AvFljjujD}F;aITu@3^Z@oXnZi3?f3rC#_t}$=*7mS zkOZ(mR-PO>Z+7%f3}$B1nDr}_HcAE2351tJ`zZ;}*J{%+MG#N1>w6G28dvxd6cFaF zRDrdpp&uEqN$v*(i<0!xq;WIMCBQ<_28b0*N(@lc9iVHe*>z_=PpV0s$F+-jRsEa* zbPFKVwE;neWR(U6Q9-~eLJDvVQUebFbL#zrQm^H$;dZ{0aoC_mR6r|G8;I_VUGPZb zoEG~nz*tD|&al#S%}!4?zczk))x3G5%F7@LNT5uNc-U`8%8GIi@oV5UqF(Q&Wd(S<8^S$5uz5nV1-ygKC#A)h$;o5ly zqEKXc)&gJ*F64JUqO1?b;vy zk)PPKX%od(J}?3$IAcf!s@iI`0E7^nF_C$(Xwjl}yNy_5B#H%_5Q1|hl?YWYp;_g^ zY|O@67XpB_o6VQ^mj*~w0Vr6Y<{zMlo}mipj`Ee{K^3IL;81;hXC)Y^gy)|$&awe2 zs|8w>2{iUDQb3ui3DppJ^?(tO!U(G7$&Y{L=Lc7mW|%$^?OORJ(|jo@pxa zSsN5^EFD8BYkUxpiS${DR&vG`K7g$%pcLC>iv|z`Bt-#hK=2|6LPRj^MaWnI*jW`X z-h*5SO3o<>K+e<@K}1@4L2SGbnAxysh|6Fof_i8|)(HX=D>x`X)}}UABUL?^pe6*3 zG$3|X5Xg8i0}=$vR0L%OB?*+h3OiM0A}&-FV0NuSiO4htcI?{ozyBZqNkmLqH)>Ub z2z*h@@JpSIcS6LkYr`d1{qn{ug1F%I{=d6-*DJg4{`T7k=hg{;GBM|())k8 zhOdV+^~r5V9{be7JAVd4gHT(jvb8=07gzr8e6<1qK`7Ji2--_5Nlrp`6;n?j?5ZUv ziE`0G7)0Pu+BBEBB7xPQYVrY%6c!^QfY`UG^vE;AywnCfa5XAt>SL+Z@^R2p)02(9f$s(PBRD_; z7sRY^=QX$f=ZzjYPSrkx05HXcp8|?l<{?FA=~t~AOa4KG0n06xH~qULI(-CHH3W@A zahj&8S`>u@b32TkSSSYn-ap4l{!H zY>g5#^W?+{(qiuL{NQ1nIeGf{=~Ksu44Gu!d=Jx~##MWSB*cDj;7>>$C zLnw-@HGOh?+M_;q-pF9XaI}C_C>ILub~TCrzdU;E z$jYS)Pn78{7K{~6~Zka3ouGF>!kf;VBLS?!I@*q}HKnNV5tPG7BSfk32lE4c9 zWT2rW(W(L(I<3IsVU-pgO2i65srrr6ZCp!9=uCu4q4bGUs6eHIl|UmyS0k7bRFSJH zyb7}iL}LHEx7RvzHr_Z?m59L(AfxJ$4-E~Bjm@vsoil(yM3u`ri!r9ZzyGYa$3Nnl zwO0$u%y-;z*T?_xzwLc>--h-5&N*X=C@?bMxU`-|c!6;gXn`d1zpLq^!{UzDQ(!;^ z#!!)K5rVB*kt8b&%mSNiNYX2fyAir3$Q(tTxu=?|C@YiI0|H@4$umdKvpN&t?I~d5 ztn0dZsOQ1%#1iRi8fTuEs{{gA$a)Rw(BRnn-uu5SUi{c!eEOL$d~W=}!9ga-bZr2u zFRpFAah~m)Qd@LxyOL$64p4z`RKklIBSxl2oJ<{i;mA{;TX@3&>Z_dX6AH! z^J0XPb!l>yvs-}mJ`4ub*mwd#4HOU$){bT-?$Dc0H1%xwfV=gI8CiK8%+Dz?RP&J% zNEKkxR8beq0VS@UC9c0c@r>%Lg`8k*nutj#h((1fCIbUfwt$LIa@iRx5X17c!EOyB zq1ec#PFNsfl|&$bvf8(s3aw{?jS*XI3cykXwg#rul`w%I5JG9WN*ZYu5%`&TgX3-3 zPvRdMu_~^r%qB^a`Sa)R-d$_8rz1LG*obH>ctnC2fXF*2iehMJC{5Eh0UVSI(V{3o zWqJ=)=Uh->0|~H}Lnx<%Mx*u}-~PVOe*SY}G)cqp6Nh)bv}5CjOO3V6eD~dVKKb-h zfAv?N8J;&Xe){ClK>w|`Z7H(cP)Q<)?uO1el&G;GA|)Xzc@56FqR5q9sd~ zY}vBqD_?$~)oRU~Hw=>IbbEY!;``qJ{eauQfB)XSdw1^KdHVF}haY};;r#g<)?buZ zcf$=gd}G^-AN$zH?!5C(-_G{z*>l@%x6Pe9wZ`Z8zfu^Qm>-}OBBoKlZc+b|B`s|)khQ`dfcioA2IWV*|w}J*BAoi3mL!=80 za7nW%qbGN%wn-vY1FcZKKqJ)!6e3YusVb$!bbt&fW@`alPGS&(3N(NSkjSY96r_R> zWv=B>FasVM%C)PO{l}v(cZXlAs-Oa-iUL~oK&JqWZ;2Hx6cUSEg%DME9?v`>v+)K& zXIp&zv+M+^LIW`XwrSmL+O%=q#0!&_3U?-55yH)WOzm`Ls1m{{rz{{ z`M$>RE$%$>>n4eNZYm!Pw#n1=P#!9b5ZXLp(u60s-SP)H1tm!%2X!5Lfi%> zQM?q|PcwGHOjk&2Y~K;Z1gc$GBT5HlfiX~mum__EbrV)PcbTodhuubCC1ijkNexsf zNMRz8ku1fO6Jok9%Dn?S_d*Ggv7$iLnF%xN65RbglO*3`{nUMF#A5}l9DLLgC{xLc znGe1J$&$2hq0hG#vQ@N6fTIfMB@rN6K$RQTsJO8}*-w(dOhM(i$}ZphYSPyS?h_sX ze7xo9{8H3^zR)f$sQi~oMTvyKi2v+M5GaGA=N8XIYTh-#K_|IY z4Mc2=S+r=;!i5W8-M^Q~1_>c>BpMtzaG>38i%4hCuGi~}7A+ba9PBjHIo}5`dd^jv zx@)h!Hol!8^}fcfx8AyZB%EUj_lm|(#V2Es+X4e8CA948EdI-0ibsUNaa(3NC8om z5CSt48PEo|pL*u`$DaB6mYeSw-@p6$tq(6+v3Tjql?h-#q*4*%x*L3J*Kf1f!Rtj# z6VwMVLwx4Ra;=#IF!lagEfA$P7UPvNP1o8F0 zTEFWL8r=jzhNxt@K%pwE}#kJbC&Rs|D`Vhuc>qL$X0isIh zxgaa$IfDcmE%(ZU>K*+FT9Jo(f1mH9b$*@wL8cl4xJn|4#1Q9MV8_8aUo_Lv(JQ|D zUydzZ_@&?em6Zc$F1a`~8slm;u~Y;UqJ{`+g}eeL%BiAfPkE{fCTIu^+cN&p@tqIO zpSuxD21!7a5DO3mNAH3)E;BPoAzn$yw2|#Brk`Q#Wjf2*K)7GSQnFVheYe0|0a*x5p^0He2Wy~`oYI@CmRl^NLX$iHbwhggp~FexN;q-8 zgX~@Jblx04o+EFiL_Z*^5JeqWYRmxD6UVm5n&KHcF4SfUhz+i&vQE^po&#Y8gGec; z!VrjsW!lT(kUbylsI4z!GYE-oBaFVS6Kd|k`jsug2Q_dE6oGsOTVXkQhI-2Ju7HY) zVeTDu-%Ya@5kx>F%&Zzh(1C%0wQJW;OiY|UeH!2(g%L9~Ju&{$u@C~Yjiq~4UA=ns ziWMu0qOkV$)|pJKsv5^pGS^;vtuaPbj5R^cEw|lbIgL7*(b3V{x7@}I6>SU*e$V%O zxA#SXc9JAeqe=z}z^2KXb?eq{*k}xiAZs<5`S#my7f&I0G62&pTecV?Fr|(9)z@7O zYXczA_uO=2>a2(`Th(y=_17~yji4>_x^?STuU<_=Ar#J~A%w#F#JY<&Zo2g1OM(g+ zRw~PW-g~yjT6@>G-Cax4BFl-0*@ht2a>u=U=>~EL~)UzgxCO*avy}1$RKgi z-DKgyg_}3KZ7&^3TrHv!CEZrxeQ@@I7BIbsP%b}6l}QK+SZmn;D4?wuw|#xVqGh+; zaoh3jbN}XZ_nbI+dj8Ut{SLtgFoEN;kx*J3zr`cWEOzil!31O2k`OCPp#T#pdEXKZ z#2l*>s^StZBnKkICFo=k9dovhOjZFh-S0A{_Z<>}Ruv+k@?E3O)?!Jl+_iF{DMVEE zvr`aJx%@5PZ#(I|QdQ=P^np$hNdPsG6%CSz6tF5G)}^Y5vpagoJmsN9>yApmM+5^apJ8c~EOucvs)lviUlBlPU$jEV%P3mkPV3(rkZdqL&6-41GPIF9^Q z34x%ohbV-|!vs|#HBbwg16~71soGqI3f(GnDA9zBA{23BUB^T1+yw+ML;*FVVqkdE z7dx}&9PkEPp9g8Eq%cMV{CZ2KfAXk$pv2Q}DkvTV6rPAR gJUAt}8hP0-M`&O>T zqA_^yp)eNAe6BX6jCZ)ar-~}Y)euBPneCD#%T)ErC!d^{m>@DfuvxuHLb*f&k zUvb41n>TN^*1jpgQ3HWM6r@N~M?ff|Ji!ukL};9Is=-z+yIB$DWLi#eGiKUyqE-!FVbwxor*7xc z3@%qf5l{qiFiFyAG?;mMy4B9TOCVY}7|Usyot?Y=a-@`snIPqFqM`^4b;h-GUrz|o zsmW9Ac57_y5(4@fwK;>ub%2im03ZNKL_t)I%okqNd#V{L5U79^2vEc!?yV(`&SD2| z5GBtg&rlXt46IR6mBLsHaPYypL@5MS2_7an&$^B~b_KnQuhJ5;=W#77{N=x9MlPZq zLp7j8ld8V}B2uR61=@o%Nze7dGgA8US)Sp5O$HQ;Op%gG<$_TK${j=RsPrj$4c&^F zl$R%AMyHdq(q>BPL0SLmP$y=duBhf9itO4qF9x2Cw?mZPfyxM>RKdWCis|JmE70ZM zoB%>Wy}r#m==dha`c=oQTcl)mjgF35<`My_+f@i@z0}G`o7| z3{vj-QgG=$(jhod^+6gFOX@In%G;3wQN#`e#zg}@^bcbF#$^lt=fht)HhH4mz$s_) zgpBuvB?}O10Aj~uVGRsnQusWYmk^UNKvuZ?#Q2`C4lZ7g)r*0Cl~88FGy5046N9R0 znQZ_~A={G|&!@>A&>2x-m`JWNs;VARRm<&}Qgj2*3u) ziVg>!E6|M4)5oa_)@rXVFxClrFTx8%7dYso^m@+gNeGDkN!1?`hk1dJK-59!vRP|t zoIvvSc;P)^%5eb>P$@NUGguQ*R?0-BD>N8Ph1C;zc*W;0+GIX>4Qc(tl$*CjXek;j zVLpKx0~Xo;wda282R}GCJzej2#}RJ)@qhE(AO3kH)*=XL2!V_#H4D|5ISa&jXNQ*L zDTRV0ItZpox^(Gs=iGq<2lnmTck0wQAlACc$uk23Ln~LV+`M`7*w~nJF1E{g{ZEh( z*hW!{5S!Sq##jpoF^3Qgt1$$S5)(*7%55s3YE2T|Ypt;o3bsjSg~O3CN#wmZh9F4N zRK!z>>q%r5A*gDnS)x|?yh9H~IWm)(ZT#1JZ*9`)-C(R$5i)GZ6cU`Vs*0+?gvQGW zM9iJ7mB&8IIGByuc#DDn6K&Xt5JD@@nt7Il+zGgzlz6qgplWyI)Pybl*>}C z@>@G6&0+^{6k=dt4M-23B5|!NFY`~ z0+CVeC7E>8+5q{IGt>Q)Sdr=gXWCQpghqn`H2_m=QWuM^gqc#?Dk3TnJw(e@bH{m0 zDwRRJ3VT?w6$7G5o(Qm{0F!DU1V9xY#6+f3qpd&$kQQY@E*_6MA|;5bD9u_Pykmj@ zf{G9`$Qo$W@7OY()^fZBF$ksk#s#Z(0HV2fS?U2`4CNwo=MLR|`|XcE`kCX$pBx_A zR!dG3a>O)Gm53P*T0jH3HBzoJB?X1*;!hkcPtq%E?mL0YphH3ql~PBAOGvG(4wXmP zqd}=#19bwcn?VV5wH+a zfJ^|3GBLvm^qAyNAs<3I4?HA2_1m{gXoR#&_CX2rDL@)jj1mluG?KxI>EX#qn#lWV zuI39cAR1i`TDTd+gYW@$qqMZKKiX z>+2gE8>`pr0Ej4rP!vUURlLx~xlHj(D`i!VCY>rmY>ffb1MIyRYXK0mc;$#vGf7-q ziNX-E1qji*(UNp}jaXaV!~!nYEleELvx3;hAwQ@jWQZyDL5R!(07Vg;Gei=C8bcjG zq+&QLf{!H1Ai=N^6+;|*W~pkVB%J4{fsQoqE&jr0V>Z4e!BDQfwOV%VwLWY|eI4G20 z9J7@y%ZngjGNve$j1nU10FIDik7M%859Dah3ji>HfhL3+q#nF5`qd{0*3?E;FI)YE z`<~vv_r1FgO`Y=ngZ%@23=X2q1yn&Cz2`7fNBF6iU;^hJ$QUaHBo@h}f0`oRoZqCN* z2BF6bUOd=_Sk9v!ll~3^K%g3KlLHSvoefb?aZ>c9R(xn39ke zp-gCr$S5mVDRc_+QD&y3LZLG|S22~*yE3(MZqycH1oJlC zJuc(TlV5Apn+Q!Xi3$rD(#W7fOqnV*1t~LYUU+LPqi7T-ruIEIxcX%bF5#pkCKjsQaXMy|5;qn7YgIvH>(lK9 z+YN*LH^W?suvEEZOGV{MMQ~7ny1+rN>(Y64Ps+OW447c1148*!^aGWSY(79QB@I*a)YumNhNC_1aFL?_{Mm7SHs7Q z{)^Qt5Z`qHSGL)hjoJ7|MJPO&Oj@rmT|DQqiw8s{&-8!kiWn>#6?GQSyk4UfE9Y%{e&?(E zaq&hUC8^PL3ZfyjO~PIQ2E~px&_ca26ugic@6!VFlG+unaT{pG zo}Qz-0DHU_4(M>j6#|6PhZG&fktlq$y#ZK35~m~qL5NW))nhr7dOojHa;7c~saw#F zAY086U|@#LhTDd9`nBgWJ@bt|v<0Fn#!wNI87dGp%p9m-Mr=o+DzVDv$kZ&KX&*iM z;sXm7E{9tK3{-53?wr(30?)k&{;8rGaHVABl{+96>xyUWjsi+VmXJfw6w}XH_ey9V ztJO>hsvuQTh#C?q5&Hs>bS6Ma+hSu|8AR)*wl1yT0duYB5Qvx*>OqEjgdNl!lVkKI znWcFF$LmVDa<~8x9hgdUMN!Yp0E@&wBAUSkh=3Fd6{RSP5GV_20Blc2T%uIebNBUr zM{44;(bm^6v3HOmn6*iNA@)>rs_p4jgCME|F(g3gwiC;^41k1GL2AgTih+V!#vb?C zPBXOw1BfNzboPJI*D@B9i3o6ptYHDXh_J#0 z0Te-kHEB|hXywd}&b;;_6yAmUI}5n(jC}T0`nC!JRGDl=IAV#svUn{3#{B>6y=jbO z*L5cNopbJcFCw?f%F5bTRXB@k|oNdBubjLERMz+sL|av?3M>I)P@_~(;mPc zG{z7x4I4ei05cdEaC-qpo*54`Fx`}7i84jWYEvR9nxaG&ce1KjTUJ%pl1pT~ckexC ze%$vWBeT{laVc5xfk;M0M!qfHyZ4@RzVAC(zg11jDkiO25(^~5nhW+zPgf>$XcjJg zgG(>xP~RfUwn4R>bCV0BW`p(8I}sn*peb?C%T@8>{L+Xpmpqw^6dxk0|CC6i@42SM z;}gkx=d$E9Y4MYb0?p>H23dmv26*d1YNRj+b~pagr+44~^SLWv4AtN=%SIwxdwkW0 zKKjucZ@E&P z2&=~04?g&S%UWbnhzSe`5hXR&vhDZRQtSR>22fUpw#eS$Rcks+Hi} zY{L2WzOo&iKi<}JUR-zsm%FEn;3qj+z3{IF_$fmF(r=|m6-e$g1W~|Dqqr)Rhqi6u z>#raC(X-E7vt!Nh&=8AyUy^a=n8Z{A3&mgpFeleL#HawP3Gv#TZ*|$-z+SaYhKz_| ztaaJT&ReZrc2YH#eo&L+nj!TxNzohkeh2h;?9_Y8QkJ4;kBVmhee$$(59NXf$6S@A zxFOLwEa7b(Xco zIh=>cbd{iQv|02YI!}s+0GMZ*i`APUzAiGAiBCN*BPG6-)~2uqB?#9!O=2UWXn+dI zDt6a$e!IB$L~H|%G~1UI&Ct|8(o%E4)}(x?KH_9VuTbG7G_?9wGHN_StjXP_M)v5* z1bSJgbC1EydheShIS(m_tqtVBPUmiK56$^<4!ppqn7mTWdoZeFJtf1U+`>R0B4IU~ zgHFZjB?&ty8zT&(7u_vQv-cg)aVL`JV;(9#JRvn7qhYF;i_2Qi*u7f zsF{y_htaDdrV(#>Q{A@^S0z7dfC2t7!#P)#hz40ZnU9Y_9h^f@r-pW>-n^k09of(x zPQ6r?KB4DMk;~s9fM7u@D3~0EwjpPzfwE*#=c5A1Tn6S5R$^gh0;S9R zA|`;i#he+2NK23hGtdeqrjCeO?PAN8TtpJ#i-?j(458+sCmz<@L2bLL$#QQm21EJ) z16)m@zW)}{sBBWN-VhBaU2$}N=KDA99ah5ko|ulb#s`-;sNQ=c)ud5Kc>rRC5epfS zIkke_mZJ6Z&V7h@J1~^G6(-GWeI%E^;A@tgWDu}{JP;@?g99Om1qzXTNHJAZ5BMA* zhdOIqN*RI3!wjAgKmi;8wUy^3RW&Wx;f652Yv{UrH}1KACXSarb1r#^n*t;ZicBgB z7)Q3qDu5)u1G5*X&F6mq)JxyN!Wr{{pj0o!vBW2({|j6G<-KD#??lD`%%Ct$ja`ru zH1nXt-Gvvuf0KERoEe#>zB3dFM#f|f_sYl=F|`pOA>>ua4V!YgyOq6PXeVLBlmVFX zdF%-<0}6z?7n2zx;DL$|457IJ*oZ+K!GJR(Gb2kd(YiV-t2i%Ilp#7)DhxFqw{pWWbSe8%fOtM&nNtcf4q zDDU7J@(nlTdOq)V-eH{g@lQo{t4}sX&i#z^ez76Lm>W9A(#`Z|f4J_lan+;$K3T>x zNRs~E2dr-RM7_%V#Z4|&FkoD0oH=*e=zC4zCV$JY#V3>iMqOUK_{Po)YjE+;T;`b# zFu(wB34B$lLWCs~_<+hIme4BwG#||oQl}J`DJ=0-FMqwK_28}S$mJO_fI83_*bKr+ z#50fu$DYWdNeCczJ@fC&Nv9gAaWDjMG>V4cSQ#bZENB{Z5||Z)jD%QNiV#ANa@!k_ zv2=iXn+BqvP2Ry<&)*nefS)>C1&f01eZeWx^Mpdfd@;S8FOQUXF zS_{vG$P-{{rlhfHoIY6l26zCetz~l|>_Wx!i^7cZJXesJ0An-Wn7K* zG(PvAJ@XVItzB$Q2(yT<`SN+jNzejFNjPfi7tnYA85_ZZftZ|yU=ERZNW&VY-7dQW zd?T<1np5pQaD`1MthTX9rnW}Oq8+jFLD-2D8jMAln}v&!CZ|LN8IqhLs0SNK#>S%2 z%t+*tcXO`+YTs28Ca9PyNLh3Qv<*C8k8=y% z@Osz3*pBaKtT$sdgE2Q1e`~l4b=i1H{^i}6sn5A+W|llG6fv#-K*Z;coy$w&J;Kzv zfoOAH%R7Kx?db2A+rJb(x7BX%^}9REq{Vcy7?7I3vv@pxrlA0k7!#MXP2fEFlylE? zU}`YH0PiGRmW2>uBr!}q`Gdpzek>s0U2rijw1(dIFMdTXw@~KmX&yKlq2!o40OgxlAMSd`PVesEDb8nW9D}z@mX- z9AbBi%ijmy9(6>Ni9nPYB5~dP;|h+v341__3`u-0%E>28K@n<|MU4z52C+g_!4QjV zUSZ5FZ7dOp&{IvX6e5!7_8t&&4r?%e$A+69oPOfi!t6dr0KstTFgpVx8!gu#zst+xa}x*kd6)r|7#x8hL=4QCe}VMn zJf8(BA1%*aiYdfuZ%QUa5G*;+YBVx2u*K+zcjm>da5uuXn6?c>EGdq^g49!rouOun z?K24=2hJHJ%mi|x0j3Z$q_*%xk>LnzMpOZCj)M_JO}r8$t3TrN#H~xwzo0?G8aGG^ ztD+Kdi)lmN`T*t^f=(&V5`jQUre?H!2i$m+qz*e^SCSp}`cgX_;(VJ@%aFm;sP?<- zqnh_(xD{T+w;Ihl&-x-`0&FqWQvY62yHZF)z7K$=Wz~64VmYmz(8omh>8oe-7Qwx6 zy0>gim#r60|0MBqb6Ye{qCKTUBQ{tR9V~H|NQc3T2h+6s=^b$Mmn%+&_RhEG?69~^ z0Lxqw2N+<0w;u)sjbIiK=E~?i*jb79$&kGK&g?M7+A}v4vqq)E||5 z!5IzDcRPQn{F)F~ww>{d(i#WGnV?!5il>1H4ddXv$=tUVKYi2H00RtgFCPOwBSVRa# z&<#@DO!<2hs|}I_uac&(l;UMJZ;)%%-YpAOs-j zuyfbB)~(=8LEAws$p_3#5p?CvkP?x)app^hNygMIqexqgJHCt&%wPkAzziZ)SU?ET z$I5H$8cJl|vd9i15V54OT*;kWhd|n=K~H%EV#6x%^^)D}vR!JcHDoDkkVuisu5;aO zw_e8pRI9`V&1pc9OeVZEnJQIm4cIhyA3yh~_e%VoUuWa3E8kCa1bN>}G;8`1o8 z`N;Ouz3xg$fpd8W=f3WJ{w>*W{}{VWY(Ra#Sf)5gV&HT<%$yoVUI>?YBVke<=VkArg*-@};UgTDX!T%&Ot`sXK1R zb3exBO|*8ki*e4eq=Gt;MY4KzZxX^;!;+cX1gu&{Et0Sjh`n%QJ?vnOojCC8K zs|0l6nk^9`P@AC{)dgOgM|sS54-{^e;5CBDsZyg>prtom>h#XBuKE{no3iX?@O6rI z#=TieQ~`}z#FzxI z7|pQ-%va@0+0bst7}Ln2N+A{Q7cW@9-@(;#m-RFY0Fv

IM)!flE)gv3&Gc>IDd@ zJG?I9DmllCqrWsqO_jd4Hcg@c^cCCRs;oheanS$HIsAg=9jbL+{kt@)|Dwl+NXN_R zz*2voL`UGJ73Jb-pZ}=(^%^)wz(V%QA$fEYAN1K&I0m?Hj zC^A8!k)_UDsEpcNXYj2jSh&m`{p1+r4h9%tfOi*tPH8>#ExLQ1PJ~L}u&-V-%!rs( zAPS7x8~3c*x9{xhZyXyR8!Zaaph9fSAx1D0sTqh?DRvFDZv|hY7(wa_o+RdQv=}t5 zAoi=p&r8n)X>o}dL2CK@0v(&PH&4z?ot|Illw-ri>e2T4^{dv8%XlVEl@v9bmTb8Y zV1=+cQcfKgmBC;{g-{FY-ZQlAjdJcldHPfY%QHdjWehCwvQr^ElPpFbh=_HB zJKa;SVde<3O+-U=OS!9vw6Y9+-PV$i0M)*ML?z-$U%eTtDK0vy3XpTTsWF)AKDhP0 zK!^s8(elCpT3I{Tx+1%ti|c_kYL3W+g@C9jGw~A^lQ{)3feHlogRS~-!S z=9y$ZNai-8btAe5gC29#Vb(rT<&p*vKof=;s|A4wN+0$k9)w&6ZEo_~x3l+0{YQGW z&|7+%g{Akqno)Ba{pYThnl%`f^oRk@(;&G=NdPy^L4G>;2$Z_v0%jIttg6a;4}h6l ztyU`R_fuz8wZFmPTaOFG>CH%mMP33ml!c}7Kl<3qmx+Gz#o`_ZDT4t9c-NpJM1W&~ z#j5I(shDbvEurHxr;z7Nq)1YuD;tsOAv#8L%m^STYk-of))F)`jgg&z#WYo+z`V1NMt^tia^;hS!Bf#OHA!}0YZ{M00@y{FaqaCrt!?HryoCX;^>+A`O{|{ zD9?(ap`rFjar1Q>KX}usjlLSR6$V7|agMs15FhsN~Z{1|^Rnt?Z-XgHLsfGn=T6=>Mn3;`ZfJ4k$XMOk8EPr3E zCm|*>_V@U=$(>78XJ==pr>E0TGi$fot5&U=oSa;{ zc5O28NFM#_4b}J5itbk9P0dF&HqwWVi!Vi&ZYZOgGCFE zKKkgY)#G>Gd8bglBO+oE^`1G4rV3*wNf{wC08uq{K1;jn)%SX75i@hnRaMnXmw4}s zqUgCHqz}B?Bjf-B{LH{CnkVEigFq3@q5`T`v|Fe=gM5q(hBhPb%C--r3JVYnP9&CH ziC##AET+_Ct^NzNd|m@Cm7t_#n*;#h)GQ1zu!2Ek068JYKm;OS{Tb)Cc96N`)&{wQ z0R|WVKrIk|mntWGuGs+*6jl$^2C@L0_0@i|V?dWvz-|T#G0tw;+L~Nn=Isn>nv7>N zvKRn%T=;5OvTf}40$YGF;hZ$3DjbL;bwWr*suix?31Fy#YvUaNP*XCOA3mi|yg2>X z(=Sh(Y}~r#j=j4x)3OY29yxjZZ1-=!zi)1C%O^gtb#n_XV>RQRS|M!(3P4s;jcm9R zT(`}u=O9%$<=l;J8s7Y#g%dCFLdPM38BxhNVl7Znhsv?#Pq@6f(9NjY* z9$VH=;Hp~|FEUmXh$;4M_#yKMZxG&O%%*-u1ZL_9AA0(S+A}gDxfdA>&@svPf^G!X zM0G-Jgw!3Hlqp$dtP})`00DUxfYTkkaG-kj)x)nHJv%)st!&itu>g=DV@}o-LKIDB z=ls(@df|x|PK07&{p7lBTec<*%GA`<>xT~i;OO+3*-lG#-LtdZ1hPxY9hdsbxJL~q z1A*1ZjEsh18_De;S!Z_G;tauq05Yrf8ol&ETK7Pq1QH@O4?CgpDEt|SZ?rNBGBbC+ z!_lj4agstoRfQ_xVyKvz+0~g4f~qnLU{N826oMK-Rh{G(DsqHqBv63Bipa(yFa-&S zVTcWp;c5X9r8qpr#=Y>q+wH#k>Z=D195{abc#JXKT_WO~%kzBOwrzX%?3tXLOdr1d z-K9=ry;yxQ$mg2ekq#zk6c#70rdkn&;8PxfnGF!9*&Vyref0fX z)(&Gd13V6$ocQ*$NB`l~@~Kx(wZ>O}=FSmE5KF~g>1}yA3;eRLA5e$>bw@vlk&;EU zhp_b~dgC9cJ0)Ska*c?MKVx5WAOm1Z-WWz8N7|_r3-c!qu03@a?Tx}Mt5^0bKfbpb zOQkK#q7*flL1B(85*chJR4+3f0M8?x0xNOkB{m0%CfFmKn-M@Q#+poS0CoaHL_{QY z@!VFNJz3J-O=v#g;3@luSEpV%QXM>Ys#7jx`LMadhk1jDOL`v7C|Zbxh#LD+wVdC( zbJd-9-LZ87EryZgxtuw@<)wqGzWUU`HxEod-s16*y*I5zX4)f})1|u5)z>po?m)y@$sfJGc&Aq10L6=I<*7h1!472-mt8qQmV1B3{OF|r7|9Mx;4P3^CQA~gD^=gVGw8p)QzSn#GxOYY&+Xf{ud1pn%S5EAsu&{?bvm87xw*Ny zxlX5Z(@i(6U%x(u^cO{InacG5oO25c3+;A0Mq_3t&Z2@4H9C@5RZ7Yt z&gG%5MX#q{)adeBn#VURKy zV1Rc3i_@`?vM7_0C`Bby!eB8WfFyOuQN>C!o4{gyMpDr!#>lFI2vb$9rDvKJv8hqd zO2kkKD4Bt>hW$r?f&!>AR+w50jjT{=7pJ#pXt`vfbC5e2V1R#Ixa>^oRV2<_b|9p6 z>Nx#0Ci0-uv3nre@r>uqJU~$urs5i_vRHBLLk|Xp7@ZK2spg7pS!*w7y=sfp5ivN{ z0s-^~D=VBxYR39@G0>Q8)V$L1DBGi0#>+t8+h-Nuur=bk(? z^V-q*S&TRfZL(ULPe}+ssrBE=4=J6Ni-=9J-2fFbAj7I{t&KPO>E}()XpDV-#!J5f zwOV)wCK89tLhPKenUl0Bu<)|R1Xo=>ttK5LDLI>g*}xSr9l`;T6U3Dg1a$*9L+s^F zjF_yp!mHoWjCg`*BeE^fapRoHr3^#8kgyeeOTCA#exYQ9H;r5y$@|3YGFu`0fB>=jg7nUk>2oP9(o=OZ10~@5cw!82WFfBAk+;b5;{}-VEQG^Acqjoxk zV;P-=jhG3cZq~r(IV!%Y^#8qYO;rI!RRa0UOj$-9oe<{`$_0?l&U6nSo%;Uwo_ha1 z@7;6#wevG)vf(z8>uJDu9{bkwFYNngpZkIv8g-Hf@-QHRuHsc#VgZB@QiPu}P;b2P z#%r&=7D8yZ+htjnWjQi3QWQnE+fD5KPN(zQYp)T}nl)=KpR`XzDH%}|1^RdgMNuS` z1hn3c6NxdFWw$5_MvO6r=$RQrjwpD~M8qH?@4a&l8jGTs?=Bcq<$bFtwDKV0%(dI? zfBjp(#Ue_?l3WiELI99X+&S0nb~(#^N|ZPUvk*d-Wz5V@0BqmB9YFfz{{8!%b2s07 zvrF8EzTo8Q8YBl8;2$4|NGVN8Dfl*GAZikVHdeQkcwrYZO1Z=?0D#!ImJFzo8lbE- zdp6CsNPEA+?e|r5h{%i1;Z3$dbz;3}TA1{h#~pDEOXqXOKtKob}t0xke2 z7ZzS2o?+)T8bFCD-~>?QLOxiYrLi0l#s)Bvv#xJv*&gr>z=(*{6H9HYAD1!kSBwY{ zLmI0yh8n9N80KcrYSbND)=soBBAOW#Oqr@;+XN=_SQvF?{agoYh8$2DTOcBkqds>}ps5W~gpcqSr@2*(H-6rvO$aai0<+gm?+AwL}Av9leuG4x3lE*ZU0 z{})LCP4@>Tm?@Ac##n9uy#PC4baMGuU^QhX*6X&KRlpWOU|xuJJhM}vb&R&v={h@y z!_r$eT}A1G1hWY9D6-S1PX9mu_t(e9#~=KsA7kjzWBdQ?PrvlxkN(o_cigpo$F7Xb zLggIK&7O5x+b?7pDMekFo1LGZ%^+|*(rR0*mw#$1#4!Z9XqEomLht@Dv(u+f@87@w z?AfzfmU-{9EZebT$930TCnC>0^UR48Ct{3wo_p`#eDlqN2M_Mrwd-P37czyWYGI5j zBESFpzdt=aedC_JU-`;cs;c_LCqD7O10Vl`Klp>Hs)*>*pMLOx2Oh`?#}6I)^)LL! z@aPDsIpU9e(k9_%|zc!12e*W{Hzx~eJyf5eG=Kko9{^$o! zJh?F6x$lGb{&%1Ib(gg|o$jCfr$5`V^O}!+;=d|d*?;)`|8Vx~>Fch$?z`XpZdsPM z-+ue&KKHqaiHT78ZnyhafAv>i``Xv4ssiwfzwisc_~3(Ck*D+uGlvk$vi$njzkbUt zx9r}%yWb&VrP_@F1{h%F;IxQIu{-y%DOt^>rbYpdYfEUND|saAOlUGjG8IimS1K0S zw5cZ4bbuAEh*H~^o{G{*!*hs~6IhI4f*!kJ9Q zko3T@GQ2s&oupv}ktGdyit?hdK?97S3RC2*EQF|>tB&XG-N5E#Qs46d1e8oc)(eoX z1Oyn8G(N=vL`pJi|hXq9}%oF2`;`a5eKRaTf^7Lbw$} zQ?Xr|*{g0EAO)Pmx@+C)EeoCfMO;uV3EZTbd&)X8A|iu9OhO3c)M7^$PM$rse|%@h z+Sa7)`zXg(c=_HgSR&4wt9=M40(0J<(0GPqA$_KIZ<*Eop8HONo5pRd+EUt(XFGr~ zaE`?|SL=^m>AhnF5|MzN+tzQ}x_Rw{vZZtRALR%zORqp{`_TtiY;5rY|f2<%=FqyW%+q3Mt=$|66ni0${#I{c=s?-P- z5bmm-fSm+Y{q_)xm;FlBr*AiiD3xT&vV_ZEArrVnic$(8v|24@j?t#3PQLikv$x-N zQ)cvyzxnFRZ@fGFMc-i3t(021Mk&fBp5>H*MN9JUo1nT_i;S z8jeG&)jE3g=tu7V@Rz^*<)@#1`ak~1|M>j#FMRQfUtGO<_2Z8}{+;hU_MRJW+`fIg zs($vfpZ)A-KP!g0xw$|2<3Ih@-~R0{e)_)_k%u07=#5uj`#=7-|9yCD^z7*qKYH%D zq9};y#TQ@v^%6{*jM-vANmVhaP%p|Ni~I_j|v$eaDXJlPCYDfB)}WLqnhZ|E z-g_c)&K*2>(9GWZ-uH?~vXksr30-yktN{l2M~1X0tVdO2H8PMvz|wQnTC}6Sg4rgi z9i*=zmV*f+l7X9D7@@I_x{{SqN(>Ot&~HRaCfi`EVWOxM=1pU*P-wJc zq)Dy4vay&N-C50E3m`QkF^uN4ZE`{)4j!1AI*W=$g+m!y-13T7j^XtaGa=0Fxn^>r zz!21_iLt1Yx-VW-MqDZBpzpZEKw5`vFsH<79MHzdhOy0iN?8?9H)98-2{t7y5E+qJ zk!6$#D4CU;dQ{Uh)BCOJ^b^}skFx&IZ;9LEyV7YdXM-+Ho?0L+wOnykwPQ#KVs zZK!TdPYXa9%0_IYL;#sGV~l0HxE(+X=#P1Ov!@zT&*jT@wQMlosn}u5`eO5185XoM z5ZOYgcqsSqK*;MQP9%aV1c*My0Pmw}6qo!y0%8!LC0Q<*>tMd)9c;9fb5kzvdB0!I z1+@B%dQS&HfjPpu00Zmu;#yz~RG6|U!}?D=aW|MC#)Ray2nN*94RPAyNmvPxDXC(y zR~Ee+cgv-)Y&q2`Mxc!74OOQ*{rtXXzWL2Z|K_XTe&ic}cl7A-EZ1XG`+xkxj}9I@ z^w2|JIdb^;ZMWPe%#VKSJ4cV4VCEnF_=l=t_jT7j^TQwSd;TS}+7p$)cD3eB`Z{q! zRnMF`lPCZ^v%q7=j!jKXb-P{feUkU5AUVb4Wm#Ti<58oqD9p#;9Gk^%w|mVs*F5mR z12M*Jo44)UzVlPR@X6IKN)bwND{=54=`oP%ODmF|^OnmU(pGy*h_r34E_uO-L)VO8KmMvShJpJ_3 z5MpNUJwP#-FpJ1dH^1lS@4t_ojE|3R+qUh8Km4JHoIQK?#TQ@v_{TrKapOh{VRU%- z{`>EL=9yky-2h{%7bB_d7AH}q zm^xLbnnf06zyZ8cWA7DV&}ZRNxb%93lN~gWxG?Ffg{2h|^_&H%76IEo8Nijjk7my zy>Yu6%3V2+R}aU>o_^)j{QPy>R^4;c_y{BT(n%v-YpTpjJ;wKn(0JYV)o_W3M10f$ zbNMiB+SC2fnpT{m*dZ9Gmd(|}2N8ixQ^`GfB5>g(Dgy|Rfs%Q7_x zK?Ld}iKrP#R{BaZ$3i}Wr0%=v95h0h0d?YH^dT5KF;fwzYD`(DiUh!#Hr)QUVZ6R2s*RVb8~aK zW6raoBJXy)-~GG)@>{?8uWr3_@4gpao1Xp-XGM3Rde2R_+<*W5GO}js_}qav4&v@R z;ZUoz-tLpUQY6`buQy?gF@(_TLEv275HZj5^x+;)A#wXt6n(*svj8BF69>SI97~pE zRq)Qap`jrriXhH%FjBimW;UiDKlj{szxD0u>FK>U-Dpf;F3XaD5JH4au3u+nk~7qZ zDXMz!ld^!BHN@fJVUY~Mh{zE$Gf0W+z7i?s7m;?mJwHFMs>hBUJ96a6*S_|(r=EH$ zo#TnAsWUS(3uSkBbR^|Uo_+S&0|yR#<};s3j*lr}(L2-7bd(%mfC1hv^hTP+)<3pn zjh7@uwN|WuT)Mo*z?9lHL4gQ%U>G;PSKLHkDN&eKglV?b-up`!rOW80v^+Ab|8GnN zhEd8XG_uOYziwVx-lYC_}?9b|0X0@I8(syY|{Uim(3U*Gd1VB<)Fb2$w z#gQ4ja>kVfVlhpv(bY_eNW_IIx*`wN0-Qq(#E#X>NQ9ISgAoylQw^{vA{LB@q6HEG znR)N>R#ccqa?X4tVq&MEl#HXVILiqZeK*S_KrBWlIlw+Bix?S99c4Zmgkee~3`%tb z69@GmC1$IPn5`}jDU+xYi>Ov4WM(jf_4%>ad52W46Ee2G*std5kOF4WbCwZN41vj6 z9qUouGdyjCKtvY%q8AgRzI?}GhNAx#KR2x~NH_fSq2Y~d-#F^fKgQKn$%S&^Ku)I# ziHRKnND^Y3HWD|mK*`jq`c~3HZI#P50mGmc02o6xLssY8dQmg!mE}vC;64Q!u89Cb z;IL+*^}s!woY0dmAAWPj{{F=x%S1g*O`SN~nYnGx)(_pdVdpra0pwtj%mgKnf!ONq zjJD#4w09Z}qfKGPAXTQA1%&|V%=UKj|L$XNo0k3x9QoF<>|IF90J`+e^BrAN|L?(x!0Ke3BUn@+CY6i}A`h#J zC}xQ?PXrK?R^Axo*djn#vS>1vSYiJmJpTNlZZ>@L#xMb@aU?YXHGpgR#dRcREe6d42f@Pi_dfY+Tb|CPKN4Gmd_gkm>JHR z9CtnWzQg7B{+k{^y}nD_@^sXZEHGP8FvC!S6=<2yhKunJ-TRS`e&WMfu4hjl`}05l z^UmDD$au@lR6|u&P-EEq{QP{`4aD4PkFH)lvT7`lYfE9>%HYANB}$`zx%yHFDfmyh zgJhZrp!ZIyx2K<3mJw0PHT2)=7gPHi5t&*bB7-oqKo~-qGr&|GoLW5#BmsqjHR9p_ z{MFp?zx?&jZP>iY%w}e0W@l%?*7aQ?BQnkiv2M`Xv^+2(Q3V;RLPVe{A}(VQc1~0^ zgs^IO6&ZwBO_MbyGm3UTHa_~ETW;REb!$3sG9DQl9UUF*^>O^tm%g-p`}P}dxFN=v zj<$E{09?Lj{4SFse#+>;(O zNRw0wf6|0T1_N89U{pb?EFUi|b?^nEu~2N35e^Z6MTXQFaff9}y`DRG)BkJncWIxb z1cDkxBTd`{h1P;wLpq*Fb!+Zy*=oej+eeJfSp_V=niu)q&uZ>q3C9Ga74=6!p3XrU@YRTiz0vMS*mRLNxoi$20q2?Oj3 z09tj?%SNYVEEC8~70jXAmDZ3lnfL56i>m6uY!)Sxr~zq`3uXua`>H}TWQCeKC&5SG zt>6T#&;S+~a#wUq4=ce2iv|+TnK{5LCR;VY*o+W@fr!Pd*L$m8PoaL^05V&?Xy&Bf zWI?c?A=D3piB%OG855MU%o%B@x*#H!Mu?PTM9nvHwW+8FczdvfzG5IC8i-8+Sa3{0 zhirziK*=YDdf8TOvI_>N_HV@)mJ6>HnFNi&G62M2bt!PHgXP6kvFeo@Coaiq87ZP> z1x7}&W^%GPGJo*M^lSUiWRA$PEN`t@Gr4i&)=isWfKa`(wWed@vSjp60&9eG%v@Gw zk>yZ9Yt8tk>$`^@OR79e{V*4c%e74%5v7RGQV}>VXm_SOGlg;%*$A<_*z@_0MM1Wh zZf}TSjk*{N@@A$+VkN?9gc;;%?p7=v_m>(r^nR0p+Db#PG1w?k)|4F1o7TtWqz{$_ z50r#AATtFikxP~tWRX(;!uss$xS9xMw{jVqz)~Ok2qum|Wq9)_zVW>uA2@kt)3){Z z+`45lgQRMC-|m+k@x{51{NkKA|fU;owr_sVNOdi9M%hmV{z(r)SJIt!{w4zcVyc2T`U zW-x|m)6e3nN*|b6Jvy1CmIrIsu1ysEWR%!ywK|;+5w%*a5JJitAQ?jd!^6YL3F1QA zCnD9@41n<7n^9F&(UgS|RaHYYFnpQv2F%Q}v$HS0_~IA-)o*OxzAc83ED1#f%o7t6 z&bgOgetFlf-9#qLWz|jlVuPw8TAt-8>w!$FnJSo?#VS_A?V;2mGWiswlt*G%jE#+r zjErpFy!o!X?n*r=i=t2kpecv)-S2*P|Ni}7{NfjTw2Ske>|6c)3^2d|i|8X;_Btj4 zKxJNXhDF2(M#kLjc0>wc(Zm-;6k$S2i8k!db4Oz%5VKKVkzWC2$K7gyn2=@3z<8lE zQ?!N*E(CK<07O$#UTmsZXWCQZpxIQjyM~xh>o1G|Hd81mkuoBnre4W}9LOPpT%GXl zO=Fiam0aW#m-ypB?%<*z6N@24lH53h##k=6j6+=5uzr*&W&-b-v#e5{orximF=D6$ z6hkP(0vHI!&S_LD7vMzlOe6Ulx~UQA;wwPcQm|gtSftP;2Q43X8CL(~8K0HHBIL(AXX> zLr--<)%1$k4$P_BTJ8e(af7u##yk z001BWNklyy(6XS)Krxhn28$W%)>R(3Z$5&@ebRWl+660Dzv;B#G+wXh?gCL?hvtrHOlUPA})j2J-#2jBvi>?e3CFB?{0?TDJ` zQx6In;T*$vZ74rN(#?j5XwLEJKEdlA!$k@I2-M@Xu&a7yC z^!^WT-mvc0fB7%|&p-RKCm#Ra__{6E->@?;XveOdL&I57v?JV|cizToF3)?Xf7OZ> zm^ry5CNIOaYuApCj~_pNywz&O7*pcl%$YMUzx;AlRe7FwI-SwcQ4v{KSeTfY7#SJq zRpu|WeL&Uf1$2zDD2imj;))!?l8g7qg^QvnilQvb(b3V}yLbQPU;gD?ciqLzU;XM= zAAb1Zd+xa>gfKQXcH3>YJ@UvS05L(%zPH_W$NKeaj~qJmQkS}vP@N-I42S+ zpS&JZZX)p}@;nbwnYrC=rzVlLKElj7w|VpC+i$=9OJDlZx^?TWx#k+@-0|Zlzx1Uq zec=ngk@`(M^2j51+;PXQUAvNYqo>puEE;2i^zC@c~(RwhqWG7%%R1asY4_yuK! z_XpnC|EVuB$s=1ABob1Bo7q5y*i21I2xQ2pmJ@Wk z7#?eh|JuX<@Asd4`F%fk|Lu3*F}7+b7Y(s1R*+Di8|I6oJc+p2Sq9_6l0E5Mh z$k>gJss>e!p#mT|t7_=!J@+D13}jgRzBfnHMeOdF3k*v2y@aE5JYk1)NiZ zc03Jbk{3~9RaK^dAR8Tt-AaQoL!-~y;uq$baz;kvqNx~}Dier}2q{@Ekf;G_(R)=D zCo$O8G67)sbeQ9Ta)iTC7Fbd?V zAnpla?7SlVE4$Si0~9o*91iAY=J3Ri4m`QfLwD@C?b>YHDr5#BOr6>ATotfwjhObup{NQsz<#6r{#s7$;M!xDe}cYlpc%l~Bnfw-nJmEr;@T;Pw-1A`bw z9FK$AKn@ZjSpB6mUrlePc4fDZ_Wewk9t0(gj6hZ=Dip+IsU-*l-B7V(Cu}B_;M5GB zeP#MPKYZoQ*|2%@c-LKb}-mY0dzW@H{N(7mFvgG#!j6& zmFM~T_3L-<-rZv^TnHg(VqP+_#vmud!^0C3699hq zcYpWa{r128wO{)+BKqVfKlz!@d?x8B%pYPEJltOqdw~>(;GHUXR^w*Eu&nKAz_eK$c~n{`99e zY}oXNfB1*<^YZ|PhDLt%SAR9-7rynaZ=E@F=JTKbe4ghi6EQGH9AJQV9%@iZjA$bZ zVi76?#E9Yc5F}^gV@HmD<%NDRSabV4K zPqhhG;!3eKgeFGZzgj>aRTfS6$`@KK=nS$}@=}B2pvl)J6zV z@1j{Nx_0;0U4QsL z|Bqk(>#siawQn3eG{wSN_ZnpjK}3AFf*1+dNWG8di=tKfNR$~ViB!IuS>`KsMQ%i{ zXqBBAFyI6R;oN(VOuz&d1cM49IM1L&0Q~>Y-h0Psa#ZKS&pB1qZdbP-Ajgiy|Lk%Y3e zdD0uYyXu_#M|JnSGdml#yMUSV1MN&tzt#0tcURSU&U2pQ;Sx@qc%M&n$XLrHA_yVx zD4RO7^#LGjoK*w~DKjfcrk;$EKnSp4!;BiK5;GtqL5L{Cgj6MfSy^Hcy+VmVp=FIa zP*g*RZU@5%fsGN(H220DA=2Czd<36C!8Qq53S*#BgmEKYpp%TD9rJN#l@5M&t(>VR zf2YDRWd%Aa6HF;_=>3dNeJ)C_LHs2q|1^k(fw_Q-d9TH(rD8(q{_Tp34qy^IR!anh z#99ko!adLBH?CRdRbF=dVP~##0|cv4pbv`%@vKUR#MazWxKKU4_GM(W)z`qDdVQ}12j>rTm^iogNTVw>&cEMcJohUbBrC`9eF zl0MoU?D9!cC4r=y1r9r5VmK4uf~KHQrquNE z%X+T6SJ?YhObexCBLHQBT4D`CNy9DM_rTXJ1R2<3X+!Wx`VfQ(B3__|tq;=Z>r1`X z>xNO2ynXjQcU*GGrJ1^g%l7}x*S~4uf?*KAE(8&UHDnWrQZMI%c0n3-&s$ZYBYML1 zdi|h-4r;gCk3IHSrF0O93DN7$vdmgLG&FR|DW}BhjN5RbRbj1##@#eY2=9FNyHp_t z0zWi=-aFs*F4L%!LCE}y75jhWBOeJWu|~kRuAYS4fAAw8K?nendi_mresdPQO`NK}=RLots(GF_8Vvw%d)wPW z2mpr=lB9O(si&TN^2yG*NGpgn6tXNk`|Pt%KmGIyFNir5d*$ZL+N{mmmPSx!WmY0( z0@oO$V_lejbn*DZkBASy_x|?`&0X@p{^HYj-FDCN#iuv>;Jt*9*J`z%P-xX)PZ+=W zf3Z{<6{8YV8KmMt9--ZxpdVj*&#Pa3-b+qh_3f*FaQl4^9(Cf$%Lkd&TeflDP$>06 z#U=YyO2sH50dl|>V!BbeO3UaHSq2}w>d5g<_mK@rS2!q)4=^-!Q`XaM?9Sz77CYFM zDX5!ewpI&S-mJMp4`2SF54>~P{NXQu`KypS^nEQngqx4K!PA4WW+{%hOC?P*PYX5W3b)srdeKZG(lK*mUx*Bdnpv|254PKhB*QT?$R5EVd43^NM!Ycd~K zq&F`%x_?24Nj0~QY=hFY)!!WKrbfviZi}d}71Kc38A@_`s#f9E*Am7~}wu8kI!@jT4TT`@{RzuIr|cJhS2OgXcFJaLPnF z*$Q@TqMsqlePF@F^EE-b4Husos)*`CP*%x8XCubeVJK4u$Y^{^ zNuVb7miKzf_DpxJSl1awGynmT2R{aF6NMR0-)hr_(Z^;G)Kq1yYSV0S(J6eFUHJxO zdSm2_C=25MCYy{W8AGC?Lb=**Mh`#TzUI!K{p|To`|Q8pajRCW-Uss>Y6_F5Fb+yD zlnOuPrI1pWga88?Has`vZpV2C1R-RK43fbJ#RjPdIGC14vDcoYUdV|A&=5duhy>{< zFbwV1jb>9svMg9@7;G%E zGDr+JKfG`e8k{QmxC zqtR&A`^HAboI#qRR=3tN%E=r+wVR3om??{X4>L{x>zG8_X&a<4q1_oD8_O0hSY~Rp zXyM@6TOJW+GN6onmfA+5&{AD%`kX)6`9iNjNkPgWit1EK48#yJFIYT(>5@f{j*JPh zF@SI(|JXC@Oo^`Sz9n@QJJ_a?mRdNnY~h06d&h6j9q#}1KmGfSH{P*%TxvCUzySxm z{N*pb=z{OubKirHW}|=i*?)a@)B4xF_S~QU{E161|NiFjcGgJ&W>O|)!=dF}QcFX3 z(UOI~b>6F&EnP%e$g=FR?|y&%`t`4Q!)vbp(G9}xjI+#M!ujMJ7cTky57f905?k6Lxqu~%Mm{eurb;*8C+&cN{C_{NRw z64F@Y8j7G`QWuj^v0e7Ttm*-P|2hMps)d6`AVnbRN@zn$~fjKElm|f%m9ZVg0Xf-pmUqGdCiDUha8-T%o%`GJ%*ZCvY`Lz zHEV+`?q;9{Sd9q<=LSSd4m&;1%T(-ufl0;t5CR(l8Nk3bU2{%=6DU=3=mb#I>@6}K zh=>RpG*;L%8bW&$#?~U_ap{-_xm2#77N|M40oUwVo3=)3=4D)^WzEdk(^ia$8!&x9 z0+<3h1?}!s{2stHc9vM-0zs)~fhL7Qd?v6+>}VUeJ(-5pjrH~QF>|xooIij5f&~j=7C>~fw;>;h2vCM7cdkU_^ALS+ zCc_rqdoiS<&RS)O9f*Y?RjJwRkD)^Er7D6LD?WHH&N+yRdTWv_&)FL1YI&B&dJqvA zRaNn#1m|q-#Skh&LF{v$=Me!(k|h3Im7K8F#x#w{L@>rw3X6OG&dl1Z&DwOMqR3clXzdXdQMrBiUa@?F^RwkEGj`* z>wW!zz~q56sXMj=%~gG^?yQ9>l*rcWlBbl!D%aB{ic+$7ijGpG&>AQyNm;tw#L~^k zrPJwniFApwZp0PS`G2iq~@T-NP2SYLeN(MKF|$k#9U#!r57>qG}O>CYt} z7#LW(c!{+&71zqtC3NX!-(J3K$=PR}@z8^h+jMMbv5_N=IQZS~ z`5%LG`meeA2OFMx_MCIhJ#gRs+v8)eJ?E8=thxW*`yYPr-aDUp@^P22uu4do7zm(1 zY%D=llqgRpC~-{U^VZR;R{qYL&b##T%Wk;!4z_(DV@UJP*zu>H@Vjq)bCM)iUw6}U zYo9-S)r$Z5=O6vYfBgLAmw(^Y`jj+CZULyM_w`0?)yhLpJMF}qZ~f6TPd)3BzQT8l zkGJMVH6VbDY61dlA@~tFJgfqEKn;Qrh^^$o5F5%(kmHX&{MZwY`T7N4eCo-^+U@Sx z#?44mI5s5X8`j!djYJ~4rtFP+AtF^#V&+PlY_eA4to<690A4iJqPk7boLb0sPCK8g zr$k}F4QQgEnP>%-x3GJ%U8v;F#GHB&Q6&L#L5-AE663sd>Rd-anqj=vv9-i!Au*tm z3tmY#?lOOQ#t*528KR!qh=7%Btr=i+E7vH!!5BRQpiE>)jBiOg#wa*OsxvgO_ng0( ztwe<+hVdB`Ai0LNXtziAX!|B$B?mabNTgU0%+w`+2H<4px{5epN@bB5#M}U@u>-|< z8i$;X6Yyw?2cB$Sb;pC7+u7+S9ec{LL&G)HpiYT2>Qu)`SzkA8bRQ}#$5_5%uqG4S&x>laQV|?NfBAPIZ8cPmE zXeUWi$%Z^77&e^expVBjH#H|3m~8+l*Hp+jBH<8nV~i>Z)LG85EY<}O4TeobPqyJ* z|6(nsB*YSf)sYyGU$SJ$f&~i>IN*Rh&tpA;Mx)VaG`#nb8W0f&Yqzz}3_%UE7BVYp zt?@o6sjB87uwiFdLAlQ@n<}1ftqmc>jEPtcA$~kYdZPE9Wf_Cm06dvTP^;ClEK6LH zrD^087-zFAOEd4Bg^KsyITte*nAutzKN!J+m?h!M;tthCz4!5(cDvmqNqTi6W^LAH zZSNSxL`znHGj^$~wa6Qi#PWu2ikef_`3o1^d;fjwpI`5NGB!3cfBxJ6SOXt|O$<>b zW+c^;&Xb#(n7dal7|I#-SsF5w=hW{*9d-a}8iV!zIkiV0e|W{gNB{hZXO}Hm+;EX) zCz5s9(lnfS>VhXd^1%$SYAxs-&;nHrI>_1pl48*^7EDZ%XPpq7iF)%YQ<|DGK)Y+C zXR(7Giz|dyY++RZA>?dz*^)W0IODYY?|bA2-@l>NQBXpLHCG85LWm+g%|?H_wRuF- ztFFHGoadDSj&BV4LFl4k8K{C({wC4XRtQdL}Jwto_z9&b!$gjEgc#dqA)?k zLrWKS(yY_YI-OJ`3=TAEO$7<%F84gv?FvYO3PBMX^+u=N#Z0*V&L|_y+Duk%%l7V7 zr+W)TM8vTq7*R~#^29;6MzhM1h*B5L!tM+bwe`#iG0< zP$kiXv2^a7dmnk`i4Co%H)DA}@~mUHZk@A8kQ*XAwGPjX=AGOQ*6aNSMgR&5LshXj zE&I1KT`VaT(?$k>f>c3*U^xLZ1_lEcWm6c_sl_5ngz_L%Au7fwLc24zzOQ8dGcn+| zaGQ50BC|c)x}QnVGFd}41WBDiq_pffk648YDhNr$9ip$YMfTvXI=w<*R&bhjor45s zPsSL9QNuzeW(}|g4FIzOV({EX+<5<*r(2s(JNd*jj~g5|5giZ<0borX3b3RhWwM4% zmU(N8Vd`vu#O$Fs%(7-I+GcdxEh z6|k(1!~kG~6<*lD&)Tfb+RmA%X9bf%=10kFNE&UVjan`5=50y#LHdd+4^dD?}wsz|$S z3gMM6d&wy;KK_sYGAgHjj><|Aqg&@WOAr^{sDx)mdkbx3U8d+-Gc}`}cqU38V5yfB50$i`_^6 z{|~M{_LNV2>R+Gy`C4#(`l%&p z?63a(ql*{L8JatI&%JB@`s1H@=)s>IcE};0_`Cl#G^g2U)UUec`cHrIQ!hU5#qWOi z@7Y>X>uX+d;kUp4jf=l!EZ1$V)oOLd$0@0+ z$S>n2Yu0w!q{qXYd5cMtXZF|@PX9E>qvu!d5zHeH6|97^h00-gLD9}4>n(uD7+Yto zSUk9NxcSt`==C@MY@ay?FXFxmk`4hBy=jqlxXU#jTuPYztVU|s_hpc)h$H68>o zMYh{cP0?HV3RL9vOs2sx!I~{e(yCKNHV$J1WuPDkLKb`)8<;8mZyTN1Q??`Vej+94 zP8C_0YDF~!R!oVsPtV!d`KPFKHH~wIP4GfY&Ot)1UN!h2Aci5p5Wqy3XyM6c$Ddl) zstwLPa`m9INKNnmzXOwmB~q^n~LfyDblmVZz$w4f63x^yz8BZ-E?~ZtzLa>bHIh5 zE-^l2)+9s}f*P}x7nVq4t>Nh6H|HFB+M6IFFo4w2zZ`S+&qI?;?Zg+KuvPmWE#Ya7A$!sa15Z3IZB5T<_ITHBHMh? z@h{$Qr7m5vm=q#~Mis?^JK{FL-~IRBchB+19lK)xYwvsDQED~;QXgz$ zrJEi1qSf$OYka~|-MVIqs3JfqF|09`>P$@=$WN>~V#ObR;N7?1{NwXK|Hbp(^v1JJ zKk0|pULNwzhaS4<3+G?*H-GsTAO6D+ocpRXKKe(0_L+b9%pZN|_dfOM|9#2jH+ULI z>U~*v(}H>PUD8}T()H>(B;0iQNT#aY_C(ESsA1owi*LH&_7A@IgJ+-p8}I+X`)|AZ zp)^ew3=KcC=CL=Q_tqm;9sSpT^FM$0t>;~J^_3s}$otkkxAynn`~GFi7k}(yfAZhn zaPIl%pMS!Oj=1oGuUvW6_fI(P_&@vOkKS|Yi$!GN!iBfoan~n4`4kbXq5uFO07*na zRQJsM`|o|v@Zj*D{pp`S_Shqz{p@Gw3=VZ#?Pg-;3^gI?z+kfCz&Ss-@}Bqo!AH({ z_3O?!^QCv(_QNF$=AZYQul(D;`iJX(blrKcdDVO0_ujr{l33$KTN4xHoQkM;sN$DT zR_YgS|MhY@h~oC1Sy>=6GUO{O_VMKhwKsveWExBb7Gopf5wT5aID zbwC}Bs<>_0I|X3SG+0u@+&YUuVntpP_4umd4%_ryCkKiFKnu1-If6k*K(h00(bnz( zPlpKiyiMB!5JA;w;ocXby@A*>2n^+(>LIL{`sOIb{bZa4$~rFP`&&GyGY|N$3SDjw z_`qAvZvy3MDP}u@56)~mjvDM*``c)67B85!S=+ltFlnb%t2dwl%N7mqvlI$sIc%-Y z3>9Mm%E`Hxo&NGTrFbt)!eA+Pmu6BjU}eiDjeCMYA}HPP6i3sKn>J^8V*Sa zs5OR`?wjm$z~O9>2dJuH8<2BBKdWY(-u%akARs^h0)c=!Xn*J&P>7f+VNQ^Q1A~-I zb7)R;VAv=E)G$MVps-p1uUZwq0#7Na{etb+6+75rW0(*$^SN`5oed!@STO%>Z+pw& z+<6yV_;pL6+Zs=dUwQccANlYf?7QEJC!X8<_@j?Y?ww%~4+|m^RkFr+Th>sX=Y9Q& zfeLXq&AI7fW?Z4rBbsJyQb6RTr=GHS(cI0OH?BPLaHuX>y!7zH4^I-id2{PW*I)m$ zhu7SD_dTmtALVL|b?Y~GJGqMKbaF~Wl-MR-)Yw{5Ya(fcyemYM)U(Vd*5z5(8h+-< z$G-UaFRgoi?XyommFMZuz(Au`-}wB7&wuU!@RE1D{jE1%f6aHk^UV`Ze#yxvpS<6`%ljL4pQZDjU%PQ+bkpa~|H4yG zJ-2G*ktd&Y(zhjqAz{6*q zecGZ0gGaAAWMX8~wO3ucY15|LZ@+cTnxCcJHb{Jyfk`Ex5Tx7t)cRi?+hLdZmuC#O z*cwKGk1ZXEYUeFe4{q1HF5TOxZaak^{DMM%M34%!>CyIVT0ME?zMh(QJhFD(c;_d# z-hb^iW6r`d`9MO=g$ssO9(=${j-K0Z;i4*vmWm0G00c1aM8Ir@Z#*@ZTc8RuQT8+* z+vWpM+>?sBMnno2c3!2(f(T$!jzVEl2B=YL*Y6E0`?|HiGsw`CT7WxlmF7U%)=c+g zm$isQg^5+6DqP0lL)H%MjgqFm)lYtiEf7RR*b)Hm(P>S<=k3uA-}>hBHHeKB?&DyN(HB$l^ z2LzP>6(WOBC?^7h#ALo}4VXF41C)u?un>^tU1w`3#iwdelWGphD14zhuRZ+6+y!X~@u>cg6=_{RS(PHO80FgK{79hZB!N5|0!A86n z<3-e%L^LLs?Ttlc7CYFEN$!oY;sX)Y93^%4pBG$g`?7#fS6<1u*-`7~OWZ6^CJiBRR%q5Lnz}9GxTK|A=Ph4~T4_|lA>8p-jefvXC zcLV3XtLizaSyo6e#;GUk`m@~B`{ux4>Aw4QGHQ3|%4=_Z`q}ZLkFK}cS=J?M`o_oF z&Bnmo1xuA1WczY&1creSf=iOy?|SgQhaNrlm}9Q|!4F5ryA~Wg_F1-{2sUikFmLgE zLLhj{;*!9e_t$G_I}53#-2f)%c<%h6_3PJlx-Daj61BQ1!-fEc>1#C4IP;}%{O#ZQ z=`D9JUATadSq>sutJ{KQfULD4%d@QOYKg7aU=3MQBnQHKW2oK ziQ^6H)@v|?BuVPdxq7`GHQQX0?0GHzi^bVz4KrdNGX*!NoF>>B-L%XiV^}Ie z>AT+{p(1;&NK_+*G5Ml7?$yUGIC4?*@pY{y)^FZ0$7aD>69($ZA^R@hZ}Gf+7w}*W z7BG;=J^}?05!e8+MBgr`-1XYj7MM`HfyM9B0GsIV5CMUD^4KFDpsK1QAf=*7;>ksI zdbal7_J_6rfFg`DIX^I9%i74hU_@k0f#lEl-F7i%&dlWyvZ^vv8I6V>ytHpTb&L9q zjaOr19AE-S1G-BW>b|4MYmHW#IZu`yu@Mr$vr&apRdCXzuC;8~QprUqJe+OhGAd7d zt)^uCDEDrwb^&}8sDcG*B6h$OVT7`()U+3KkCV$Zk}rxq+%%O3g#@T5v8pSI3dMJQ znjSovEAvnQWwJ@>pxv%aL> z?fNj-KX~j)vMMT2GGv$mBGEvg#5w>FHD*$RM@zn8wPiFFRjsI|+|Hl6(b*2vL6cA$ zGQ;~o=8HN5%{Q^XoUC|D~^_S^J!GUWIOZ zsK4*Xm4{5E;WPjAZ-BH&$6Ri-? z*tBW=YtKEi-W>43q+J;p81{mo$Q5iGjlMxwvy^ZSA4q@x_|w<@@W!{i=?!mr{cErI z{@yYM3#-bW2xl+q%}IRzV;lgkrB>vIHci8N2{5CDLH1NP>&?8oebp z6l@|#AK16w;=YzFe7*%vK!m{th8>0+D1+~0s8LQZU{WGd5+G)+zmS_V!^*@Zrd>IZ z*lGw`Ifj%gRrA=WGWnncJ4F{k85AqCikYG+w3kgl)7(D*Pz?lz64Zb!(aysMLNKI4 zpsIAzjPTR0zz143WeBPWA+Xc=!_6~KIjZZ!qG3DW;>~0j%|m7k&mC%>a7_RH2QJSn z*g;cRMkufWRN#ODHDK95!T%6KSt?I^m1t##$!UtMt-5HRm29Q*D zL=hDOcB;MIV8xR>v+ROQ!e>>!21UAoQbC!(zk8qGVisb1nJs*S=^M%p-^rR8*DnJU5153B(eDXt112wpL)glk-ue+$kwB zApqIf6SrScn|Q)0x6x;oAGP1{XJKHNxvo&vkXRFf7f}V+LIggO#2FM-!?u{{sQTB$ z^@5PIt{We{p=O>|5yet!WQ|6hsIK4;ltCVz4I3yyn0W_^CGQ6NwZjgk$H%sFs)EEA z^YcfazU9W-&p7K9KfLbxpWb};rj29YxcCwux*vS!+XtHX*`pgi^MC&Rs_Sp-bVK5> zYULrr!^2NJ`HU#nn*H6emO_n9Kmu{>^q>FjKhAso>&`g)Whb3>LT7xOU_bZeZ?r}+ zI^OZH;$@`W4VJI|(X|(R^PqEo^EJmDb0V~H{f}?|(pSFR?)s6DZkm#Heceu;2XW2h z);n*#_WB>a{ta)KyKJA&f8}fKO)cY+5bEFg?)MSW(_eP#OHVtc-R=y{nfs%gZu-iX zzc!Y+v7E0$eKr9)k@CQVzaVZ+FHyUX9a=IXi5s~0C7!!Zq;(is|vfcQ!%-SBeExZNQ=zdSH{uZFJ z!xN$w1qQV&+ddia0|DyGsZUXbIY5EC6eTX%FnP3H! zi-C|)Viq7bM5>8Sb|*@Oy#Ond+)x(()1tmS0I0(I${%0_6HN*ilzMKl!a@;4i|&xI zE~$e}uk?iO-bA`xvFUGp6u&6YkLd1_5wO`F%(P`Y005@)u`II(WsCSTb{>I>)I=pU z(I-`A5#OlU{T4&iT7?xrRfw1^i9l_QdDvmjB4i3?5I~AvX{X6}D4-tROWm?zqp_eJ z?fA|@r%Fsq`C1m*e_K>o+`bV}tf&WKsHg@aGyUVeWX?VOT$Mh2sCEVsW1D0GP|VH< zfkZV&1Rqt1loToi1Azi6u{s#4d(oT7TH%MY-oXn@ zC{QSAfD)9H6;O&B_(;zvIZ!)ziQX5zU{cL+`lOs#CGs+@h3ZJprFGhw)nBXn3tMz% zmVGd5v$h9KRG3+UaO!#OrqMg@>GP?wNi(1Avka|{42KZBaZZdfku{D9A%r~d)@n6N zy$er|%3!q!DnLQhGdY0C5H_yCrn?e$sScUGVRYMQ*q|&n7{eNzB?~s9$bIe%v9qM1 z+~*aNI`I-z91*BRTua~$QjxXR-|O@tK+>>3?0(cZ6o3+2f+*P56d`CROV(7g6-w2H z-tV$|?AH!E0I>ZHU!fjG0GPSm>Zl2~-FC;Rr=4`(dFMX!)bo!#{>1ZZ({EhxEza@E zGtd0$*S>M>bwBB(%7mkjI`Vbrz3#dn-+0q)cS4znC`kYgL7~FdlImm6uKVZDec`ez zuNJ6N9Ubqi-89i?G(P&Lf7uxyQ#J4V&__l)9dh-5{g3~=;G#?FuAj6%Hj(!a3|(^R z_b$Ek`<+qmfp1=Z#dojy!Bgutq@C_3KKZ}r%^%*}8gF%4AkBgYn++RBF1+Z{>#x7Q zR;z(b=4E`MyLR0svgX_0yY>gy+&H>9tv81rc=*XT{?0o(6KN2C=Y4lI8gGsDT|I;Yey_u-aJre3cl-gB2PT*O}E^A--ADEr=5o$eC!9`zIt>tOX{_|?z#JY@Bf3= z#8^6(|H;SxqA}#Gkr%C6{g&T;>&WIYSFh)-F4!>HKmj1}e#SD5v-YcJ9H!po{} z#1H|aloBYk?xYCZg?M&l5h^H&v|7r{3djQ<6iB1w90OB|bnJ#eCr#Oq8c>l%r?A!l zO5zjdgjvd!f(T%S2DZjaV0KZsy@&~KAzrwvRun@}4YBNyDiA;h@E$%x@Wy~E4~?Qq z8L4WiR=}~i0HR(cSy%5*ngcL~sRUj)N+FbLf?GuX_pD8>yXD|&$tRqoI5S`sc8WVk z({=KuH>&^ylmi(Mpjy>?D{CW6K7pkSXBAJ5jfhrq%G%TN^h*&jR6vG^tcqvki8vwz z^=vGGM4%8dtU?HAI4Ix>R4g#5N*NMY)wrxH2>=TPs~2K6#)yc5Rg`HvNNYv0r)o4J zb^=i~1Oa7)E|=KKRSHoufOPWX#qHZW9+vXdJzUj) z2KCMrsw9dK9|owZvWQR#bP516LNKru5nQ$BJ6)}U&I0nSL3z@nr@CBou* zTMocZgg*AH71-?5BfW_X@z?m@ZKX3*EQ50XFR&FUsKTTI6(|dd(hOerRBlvH%SA2~ z_nsQBf#PAU1W+viQql5th`Gd5LB=9MtLF#-qBV1;r)g_Cku%fQr)(9YR*a(jR6u!Ej@7}Fk(s8}e( zszpIFB4rKMn3_`i&O2|v;yagr@IxQS+O2>6+?Sqte&goN=|6w|qJR0q#S*;a+0bBf z+43cS{KtRP>iTd0;HnK{W6JeztF2y4y&g1fMMYuQHpV?3eB@aGkN~hKb-Uvuq|qbZ z)Y&Ae#7HyQJUXT_9=9??G}Z}3M1fWH+4Y-cgRphh^=};OZW@1HnUsjNrlLdyrgr8Z zeR3lJW)@-*Q5blPjJ7e_h8j||GsWlxkpX0+)e#YjA2*gvU4&Y#?BO*}#eE-2!vN2VQyZIUB~t?tS3lG=*rvhK{cn8zWon6?B$y@B%HShEgdDu$Qf(1Op(|K!$5& z5dc<#MM7!~Q9yv25+@MEq;XXui2-vJk&rVd&|IZU=m1?JgP62TipiJXR;p)P%Rt*s zuc?})QBa!$m`zYHM~XKw2i2U=DEQx%w?$4NhM54X1QI1xm{Lbz*M|`Vz>=16F(RlJ zRW>z^nu#Hx)3W4^ssVy(E`bOjHEM`RU=)E7hzg>*2Fc;O!PE!lq18oSb)oog)Ri}& zstbGLee8)AvqGZAT2YTuH9Fm_j$D7EIj7Si14I$LNbisAiAYeWP!Hjv=ZqkjK-dgU znV}FRArOcs9Ud)j7KuO@kPr+zK!SRZWiV;a4W0f&F?p6$4_H%IcxDf<8Y_TNMEzur zD$812*%gCt01!(_l%tqFuRTj0nKFNy8O1x^J9<-{(n;r^%Q6%3SH!#x6=f5E5udFm z$_!XQ0LK}a6acdpn8Tz99zjI`PP34>et`u!CJTvK08=0Lz3fhS7E3I=ZvTa)Drukfjr146Dd@M45GIv>J4!aW}+6dIlRVFjG1yL|Jt|5-1DK2|lu9>Vl$ZerC>tXx5ET(Hsj6iY ze+D4pjWI-qh(gF!)tJP4FRCHvXFl~w=iDEB=mX9)&n z6Da~2V>AdG1n-H6*+5xIA|29N7R~cK_qiJ5axX+=$XdsS#rxb^YPZ`=mdFH;X0r}J zBt#T1qADV?1M;P_HfyuC9V5Up7d%K~gL*|UmQ5NIuyJN5QosXFi_*Dl8CooYrYPT5 zZGi1$(hJvBckH*~kpDRUKc9YfU2CH2y&oRx9~@{LddU87 zeBEu#K6s6yyT3(vEJ=Utc_X8dlPRF3=oGAfkJyxNtb!P+)+t?KB16n3FqjNuqK(1D5LT#wM8q27 z^Nh$u4oQ5B$N-Qs?#{sn0(${jBOsr(6K4=$oOM7J^2At`NOzA@g2uJd=ecz*gkX$; zL6lYz6)Nj9?b-1uw-c%w^)igLBAVsdri~+yKmPb5k32FuvWbXDVT`efTe4)yiWMuC zELqau-*1eGn+;>Osxu-gM2HHpK38juf)s&`fl{Z{ZZ`XZ&zOh}LQus0wc#wyoO2Sy zI7{S2yapjwVoQW9%barzQk5i0(llje@4aJYYePVq=9a>R7hLr7$H)H1JKwcw||PgkaftpG9E8=Rs9n&4!R$>%8|Mx#*&cF2C%%wOS*o*P4xf%kGRbPk+_f zX8^eSjyumk{|ic#=iz|;4|?ruUwh~g2S-Pu!V5~^dv-rFYqPeSEV7qkT^j))jL7+l zY^GQtr-~T$Qj@CXwdZ*6L1F+T27pqIBFsQa2wJ4GMYLU2iMS`25v^3fDca;}k5ryA zWxcBcFiHY0)ORToR6#vL;8g%%+oDT52On(PX0d~9n*?-W30#9W;|Bls^>073sq>rX zzUrfY{6XLCY+AowLr|i{idHUwL=c9-B}>HUx$$*xYo>U3cGgziMF8H0^e?EcYCN17l1m zn4-$eTk;NO?N`vMmty*iMx-HlW(&2TrZICoHNh;D0iowKpqEAfM4BjpL0+lt{RV>; zgb^HEajmIN%FG&jJ8n!Ix#>(chAY_t(HGPBj>gC^B2HX(v}Xj0M0z5y>3#2ag?%t( z!7E;DB^4reBFdydK-y}JJeME?NpwI8H$X%v8i~d!58m6~EURCJ!AG9W~m9sbJQ^*PXmGC8odt z5v!69U|T*21d)O`KvkSUQ3@vrSA~~L+=ohD11U_&sG6b1ByIU~bhjt7HYXz+gqT+n z@iHx7vnU}cljND+$Fg`SisLbwBS8!kkOFJ-e64Xl)bkSDimAXO()XEY%U z;)>!v)p6PmRdP3)7EC}yc&QhsU@$a52%-$H@FFS#@ruSE0vX2|w}?Qe+iKMNe4blQ zGM`zh$1f&CMCwH>Il~T`fz)u#`%p{jS(>sTpXT+NvBu;+0I=*-gcu(^~`&Z!c!>FZ0d=$tRy& zw{G2v6)RS*Tsd#vJnwyPBF2`+WEBVjHj;-3D(ZtbN(|HN>q}eRT3=m4P|@iB0|>dV zHR|4b>rC2BjkC;_SwSR0!DNUb>O*kGcDr3;jH){4G);+=jJ0ef4g2rAUtfQ)){4M6 z2Qoo&BC^H?6`)WU4Iwa*wFZQ4x0@tZBP?mGbIFM(p7{2+zhh{4keS7kb0*Ka_uv2E zKYjLJKlZVY?X&+rc^)pk^s;YVcIp2&_rK4dKQ~DdE=x^sJEvpTW^LAX&1CA&RblFw z-&l#KV6sroj%>Gl!N`m2rdB)!CDwvK7hh;1D(m-dXF;PKTJpBY5}T>%avh(7x$l|T zWfnUCQ0*6Iaz{DR7n4Y94XWS${&hFrc;i_w{mADfssI2W07*naRE@>+1{=;e=klPp z-f`DsPd;m0ytrlK!SjnsZ8IiuBav8L@E*{*Jtichnu0&k4U5>^Z*1z zJvwKVsj5mTsof*>13*Q%T+XLIkMSd_lYfg`17?lR(Db3}x$ZXpI{BJb2nC2M@&&0t zK%H*h8kn|TAH1d6BepU@>iLeP-CgdH| zB?J&@n&)+wsEE%!m<5s;TcPq1KV;^ZvmZlU>b+x5(=4g=WdY0@^1z0iv3c+z1m_F@ z7v~E>?$e}J0{}w7J^%njFM8W<`R*Ab@ew+Vmgm{C&pvzGZMRHJOvH@ETBDx()O)WQ zthLN`baeEghaPgytzNyl(P(VF?aF_KWhij>-FL2EyY9dP54`2Jo0;wY`yRMzQ0VMn?o86O$B;)*NM-~m{XgAO@(<2kyIH)AaDek33@avDT0?cEQ|vNy9bzYeB-Dx8FK4HokoM z(mU_G(|dp50S6s>?6J*y1FV+$nWq3|L7Bdu{pn9{o|u?$HG9-iD~~*KwJ|35S(atS zIA#_RYZ4{N^Wc)?(MKO080=fJWJyx1IVbz>yYHGcYbGWp7A~CMo1`$CvoLG3wufv6 zb#0B=-&;CN(`;+;`JRQn(BX!Xs6=IMg?b>A{u4w&khm#?s#d&%8Cu@iNuVcSHszna zROo8f2iu-`7-K>n07B~FOi)_4ZtRpr zyo3N-ZIz;wMHIG@m=l1?Esxm*s)er(V49Ctz*>{fo{DJY?f3qvYPR2tdYbDK`dYr6iVb8%`DFmLxmz~o`J~KYI(a2 z=h!(B`Q>nWXKlBbPI@-I(=tNg4#B7)kM**&M6$PsV%8i6c~W=|Hs~&M%i^; z<)Yu5Ywf*HSA8dy+LC0+R%^*!Y{z{UjBUV)NdqwnByoWIgU1`=y$jrNZy4}kKp;Ra zgnQqBgkZw6A#wV|b{ad0V-iQPE%%KqTa6`IZT07zz1N!a{aAaSI#rU~#a0|#b7&k@ z)j4N3Ywx|9Z+`RpR1QOqfSV|UH(ILh$7c0kMU8;9G4jPTG|$mFrjS%-)!a;!5Gf$} zu7j6hzS_(Ik{rnh>m>(b5Fc}ZFDn#9(N$i5p2Gu~_m&8nLh6`0=%+?wxI)BBfTH4; zK_U4EC1NG^K@>pY!A*$^*$60vh}yE#KNZ0dKH)EcY)*l-Xu!RyU4)WB1ULz@>p63R zq^)9wXY%#VP+fG)U<{Z7*uzr$O+td)#;FZxVWUA(kJJDvU=AjUpm6t*Lu=0<4k$-Z zzL|5yNeVcu6+#f-HgKDw#s^>xc@A;}Px;0anE3@W5JVu8&DQwHF&7aiFl%uiptnGv zAPCSDx0lT!a9!C44ku}AQ+addv`Pgupi-8o(?)~fG7$qtL3F~Zhu6Jefr`o+AEbAS zrq&$G145k?7%&9OWW7$q)B*3ZwBhT<#?7X&Tp?CK(&@U-BuT2q7!!dJ3a`lL8;k*! z`uLZ={N=MQy2Qae^w1M$Y}&YBut#0SQADC3aZX!^05Reu5%0;c0BnpCZ6 zpsJznz2ieDMok?(OYgwrttx_|Z>(@{_;%tMA*i zX#=TR<|m(g@^An46Xi;!T&~{ut2fqaWtY{LE?so+;J#aK{g)fx|Gs7;+w=V1&aUpB zo}PB3U@pUSKIUUSe&RUZtcj$>t(yVsF_T|8&Ue~|#aYqH?r_dQ023>Pi5Drz=M>Jc z_6k!Y5)kKHhgrD+yiDNWRq~TsfWm7%J)6f4ULp)B#K9{Jn zrdouB;|dhFGw8ISGS3;|s3oe`ww<|$+m0#Be0WaUPI3VRC5TgFR3-Dy#Fja7O=rrb zKsYeQWG!>A6YX?9LcHw$<&8m=Y)6u2BIo;t46Rt=3QWzp#3Ihc+vaAB(aL$YAT5Fu zIRZHdo`&&-=61mxZ>fX4+M4`OXrLlwkZYqc2!`N7N>j;(MHiVIdZW2Vdu(Hb*GwjqOg znR6~lxHV>~Jq2pK??|G4AWtbgnFJHC6*_uuy$A6~nDb-pzvEu=0bh4(&dG=IEx z>%x_%oVsE2`b`_Vdio3j&H|2^jkV4>K;Q+zXwc5F0Xn4`$p>kOd9C)ErYPL9(Q&Us>_wOGb9dwY8`pB_4N;I`Xt+q`)bl&`qricP1Vm8Oo3x%uYLeC%T%`|yWv zTCkvN!-fri^hba6hky7-Kf3?NkxiD5tiJBL>-zfo!UzQfZ3~{)JD898cs-&u!WAYs zVN}!BSeaLH15lq+{bwG-6D{Ux*8i%V(d0&i-TTaNEEp6g;CwB8%+1KmQp~QP1S-LH`mBRwnkgkB!0RzcoP>e~@qi&>V$tl7 zcl(W*U~(A%A@PAul(h8wc-A6Hqtn@P}4$3GyRhb)g>cHmn+riVDNL%9&-3vP(`UfF}d5 zYT!{nF#h~g@r)rEDZmOP)^;LC{(urgL=|8*@!;?&NIJkaXW-8ahjSY3BykXqZI?EG zhmcDSU0)0{5JyAaSyfLY!3>E5e2{l?$6+{%WtJ;m&)?Ue+oQ0sjMcmOD=61?Qv5vp@9`93H*ovMUA#`&eO!;9%hBq}1+t@ADo)QLonz z95^sOK3=Xx^?K9VByGAUo_MO!oLs+t1xOl=MyXT*;G9#{iHV6uqwylxfw3_H@xuU+ zW?ENZXu+_m4E7BU4h{_t4hGkTTCL_>s;X(4#-;LtMGJr9rVorAJz`ZRCmQQFpF_ll z4eCnyE-uF(_bK9T30cix}==|}hP-# zo(z8bzufezxR8;aNX4h4jla0$3A}Jdw+e++BN_5PyclHcfPe~@q&fJgB=~! zW3w;w*ui|v$7>NS9>J^`h_=)MT0aGa9;JM2Dk@|HgYN_zZx@r&oK2tvkoVq`hX}lb zOTEd|+x!tH0l7Sxr9?r9-e4v*1AvZS^EoG4g<}CbXkj14KH z6~;jG0(WEgRF%ys>+6a=ACn)j>ANe_a1Z3bUuFO;~161A{WTa-e-ljZ3)!p(8)N$p;Q|t zR3SsD$eHFvGYSbcFNS=^MbdB9;x5f`mFNflR=xP3S;CUd1Z`Oi%-e zhXnn-mmM!M{HS`1$P0iB^#k>T&vcS=;*DX2uyTRTbFtzM2q6seVr_6two(~bf~XU) znzJK>U(TR+5@HVJAvYs51|lS&2-MBCuhC>{#cB={v~jBBm>L*_457M7kv+gZ#YzB_ zn={YU$#XDm0+iHR%g|@GKm7mv(SLjQZ~flY*Iok!yblTplvk@kNr;pbBtn3&l0spi z05VqAP~-vw2&qzViUX+{f+0g;kdi249>ld3|6ST(mVFhHKK zU>FU?B!TpzMarZlp9vIeY64QwDExl)?Z*Hf-4R&_fShdhvxl z-E{xf`r)RKK;4A&hFjM?%28G8Rycc zw?FxfyY7AeJKy(}Tfa1RbpQW2;}3Q`xBbpL?t1H6FTC^iuRr?8Ll>QY{?@Hq|Mj!C z3@=%_m_uSZc-DwUjb^?KcV{~~K+FWz!dMy49Yak*R$SW=p%A|gs*r_MR&+|<-m6vyAV z^P8Xe#NVEC{<**VyT4;azVVH_e*EC$A|iyI{yt{57ElB6070};Evc$NNf9N*y~hku zpGh2t6VxD=FOXB!EbW333<-EOo@uli>W$WYgS8e*iq#&6EPZ(x4APW=0M9da8 zIQ1et;hNhxDv1aIh9C?P z5pir>Y^Pkd-^8QfshB&RVG&`&$GeRR62!|3BJwH(0Sl3kcLTMK9fuEm@{|AiyTAL} zg98SlrE)c{RK%wxL;Lsa85^6jad%&DZ3DX%~1wo2gd=$Zp*xfG%x|) zi!p2nX@*Q)7DuoZP~tSteYbTk?Yl27;)w^s*C}Rzd}R;_Z?6{J-uCtX7#a&{d*4@8+R>S(9v1V>f=XVI8<-gYOS+ps4GbfJctadv|6)Ow;4#E z3xvy?MMG{@1cW7uekPxYp%L9ePQQEKJs7H)!9a+ z&MuBCk*#&t`WQZrP_2~2qg3l!yKcixAG&ea(|fVef&XBg+@Y z-p3@!x$duf3yDZr+Xjkc=s3OiVa02Vu_n)dL{XF^36W#wG);*pNs{o^iMp>M10S}p z%xrV%S&gDxfKXM9u|yP<7t%DnZ|jeK;g^2#y}x#2P}XoF;bRor%)5g}4xffo8fmjs zilMn;DoE6e0Hj9ARI6nW!8tM<&yyKncUvPo7aS(A6 zA_7Ga3o%}O;k(GBk~uMvVIqK3S{1d&%eu7Zee-#-7AGRPiFB(zU6oZ}tcb$o%=V)E zFT|^_S$Ih@)SD4Ic!g2aNC#+Vj^>2s?-k47pqPPzJ}xsKnvdf|JG)qp;oP6NEPOux z(}lJ#{4fVc@IVPzz-FP+gfK&-+ub4%dfcn^0zwgtwok8 z+gG(XAW`x&MeE80usGHXjq&L{k9C+SP&3smqM+|Xt%py+Lc$6!uuKffG7!O3x+{H) zQ0{_>gSkDSP_t`W>b-$FyICz~K^2&8wtZf!kx2m$C1zGQ&>Rezgo1(_R6Woj-R~RE zn$jqv0bk8a9ZblUx5n}yw87AnD2t4wS!3_s1E2cqzpg|Scf`B*?O(HI(@i(s#3D9Q zuc|J)_2z%xzJ15KGtS<=bB|ZO@`{Tud+U~a?z#IfKK|)5&w9(U<-_Nmch>W}_x$L` zTc@V#jZ{uuv+kWD=t6p;YS{N`l%gLsdg`1dc!-euhP_AcijH?6T6yDFZ=nooqf*c@89*!AOG%_ z3m2$CsZ=VL%Z3pdJ2f?xIj5R|T$W{7=EldzqbRD@x>m1R9#`UOt+Z_As*cW{Ow;<* zMB4NUSZhd}^LldDoMHY=WC$Rl?(Xh5Dk*2)=VHvwX4CsDcPDi&OumgV&N*hT)oL%2 zS7&19oHaK5LO`0P#t;O|?7g>!RJC5Ohh=sYMfGOGi-1hv?jAjI%Cd}^yL)?< zjf{Nz+uz=_X>(V1GC4Iiab&W8uumi}{<2ZTAg?k#Jq-hZ0~IXGn#Lr-{V^O>nx!H+ zs#PkLMn*=qZQHhL^_srEK5I?0S>Lwp(KFB7GBGiB`0(ML-u`N}Dk4um{q)4d)QS}= zIyyVotv~Jl`ySl8ckj}XrS*D!*REYev}n$h`i1ha6aba%@TxS))N$%W;%9i zHk*iJ@!mvH6q!uKMsc&5F&k!LM&_D=)SA*u=V@9we3GDXAfjG99AIJuOC1vyhN48) zmYilP&cHAbB#mcOb!HAeWMq!hA&5xfbXU|Y0IUMT@D7|ff%DDC*qF`nq4(DsWuC_l zj-Sw@Up;i)7w{j?BU1Oox1L^$DVlLfo+%V+H1>Glap@I(o;Zy zfhw41iiTcpss4)UkurPq&NX0@G+|02)vUrq9NUefCsjroB#6t3o3T5J%~lM z&UCOb{Y*95%Vq>fAU4#<2hBnXe0|kGcVWw}+3+r{CeirB=$;o2pS@}AyWVy6liRod z>Bl~K!9|y!y=4ud2@!&h9z5{OlTW?(OSfPD_IIAY<+L47KXvoXpY5uYvUR8Y`@h|`@%#&}y8Mc%7j}Q-5C8b+ zkr7cI8*LmuGXB;}FJ86gl<(d7l?S$Nz2t3I*>d+MZ~lBb{r~;^CF}3I@7_zU`sGtj z+t5*s%gmp<<+JP7Z+ic4e)!1Pcvr2{fI4m=||L8NKJ z*%$zv2uDPOEc47^(nbUcL`o2YVwjqZ2SA;wmI%b$a=1Kxyw3CkExMkNvdMKQ3{>Gn zEI?Kfvln)rVhbCLPD>U{T9?dG$s}iQSar``U;p_3zWEP+|G#%sYLre9nKh@a9a;I* z6_;PtH#FSaQ!Vr4?!CLW-T(d0l6_&vQ#+nN>;=v>7zXM_R`h=Jj(Z+?^ywcwyluy` zyDx%HOiwxKflr&wdb629D9f5@v+gr7$Yq!fv7Cg81%QaM%mwF2A{rPN=I$2R2uau zW1?oW+11%~<&{@{>QkSx5vPrMM^|lhe5{nzRK*zkuJ^p>n|FTylmGOOef^zdqlZ>5 zU3K+!KObnmHn>`HG*d)rjaMN?R1{Z_0(bxbAOJ~3K~zEpY6Ah5jkPw*vMkF=<(st2fz%oiQ+g0 zGczMg5nIcgiBICF01O2{WFskf0mqC!GfqqhdcyfHLaYX`unvs6Ll;|PNyVjgW)?OX ztT7Q$E(i?gz;`s-*+0yF_h)lq_gaS@(>U|Z@|woWo^Zc0sz0Rd^#sSG3`&53 zQfcXQvqL=DhyW=d0}!`}KSmXVP;d=Z@m>g%BHN+cK`Y_9VZdzE7kZyWQmE>^qR6?s z4y;7p#c?b|WA&+PE<5MR?LYqVmp*^)g_i@IB+33=JAd>a|FPhV&fC89Rn(6dmhRq; z(@)>@t?xgydBf?(md-o>!qFoWdk*YgFtljJ${|%mhFzA=EMHZtwoWF0%0yt0p>eSB z{KM2df^3RNnGrM_izG1-ft3oW01FZCy|Hi-PiS?pV-ZRnqF^$C$(}nwgniKLVe6-J za~*4U#88NWVS!qbtQ@aD;_MNFX&b~}Lf-i}wUVqP#u^nzsAuU5uKAR$jDR~JweUFt z0iqBh5Xdk)?;#pRiHMMTYq@7&aK)N6!wZMv#CB9GyZ7vQ%UNrD>P=+evY5`ez?RFFAdxM=B?v(L(0s>&R*1wuwN3BTLB9Yp(xn*f(; zl-8ZG1gH~L_Bni)vnvG(7~{o?R>3_c8iaPJ7?4oVE16Zj$sjqIH%>9Z1loor1(YcB zE+zoU5$$ToKqNTqstbIjmJyPOS(hwX(p4_^_H|!=#ii1_{p_>PcKdcNT)3c8?dTs~ zc=5#--}#N(lS=32)7M{d!I@WIef7V7_DlcpkAJ^*#p<;iPVemKiImo#vZ}kIwCSvM zJ9a&C%fJ2m(BdUqwruI_>|8anqQ9@x!}j(KtzKozr8tX{4I4J}bX3Trb+ev?1!u9W z<)ShlJw08E7cU;4981$Q%Q6v^%B7=6kKBL%{zjwjy)v_NE=|*+p`j&9mb|!;WXSC+ zh#3rf(M1<++_=SBtK!S$@|9OzTB+2^r6g;nm2&Nu-}%mki-t4j&pzi&RUMxgjf@=_ z=sWk^^G6R)b#!$)=hm%T*WbJNkw+f2kuF{|v~lg}^?Lof>#l)eV+?`3ldG@3x?Z2~ zS!N=0?geihZKjn{Da-uZ-uAY7vk?dm0M0%4+>IMImP#d6ziipEcfb4Hk39BxqtS>W zlctT;Yu2SM8|WXp_~MIq@7W(kk@wko=bg7^^;(5QaXd0I@~gjc*+uD9bVgVjy(t@X@W0KiqUUb>;dci-)|2 zsv3^a_Ef&qESf|4Lk@o{d9Or-$UuDN8_0C~_U$`&?O3sT_2N_3yA;*fLY!m`j!UgE zPFv*7_OqBZho6}Tw$3O}0Yw~(KXmBGQ5W?N4RS#aDdid-qOErDvRfF#*;f6wP`$);j1VV#YbR)jA5Ovhm2q zF|ob5{}I$jC2N+da9O_KZ;f6I;r!d`oUQry21or}S-c$g?i{+OJ!FjM}= z$FAL9=Mc2anU5)*2wal9e=ClKEZ4M`qFsMR4Au3j+=eWrYWUDK&hgS%1V< zR)B|~WhkixkTtP*_{@1^w!{D;V;l8}EUl-h#7PP85G7^t>as?q zR%^Np#I;HVBHlU6ELkH-BEzl}Ct0&;h{g^ds?|ChjfR5bI0nOIjYeaNk`4f+YGl^AT|JwUL^z@_KZvEUBcJAKy{ttfen(MDW^PIE3 z`lZ{q{@@3{@teOjvT|kFC=rN*;bb8NkvG#cu*bV6AiEW##zIxIy3dm^3=t)U_lPV> zP}@*u!%D_W?4=`$2VnYC%VDWhR5biF`BLpSPS7a=f_p0|+0<)PUDSE{wH1tcCpD>7 zmYxafftI^#wF}RG3mdYXgi4j(vc&IGl{A$T0Ar`)UV=->@@4&AZA7A2vt|vL!jgc9mM>p!j1lKm;l1zf?!MrH^Xv6ysT4bx8k+zhi#4m) zty{m*Ij6{oNF=k?`pg3+N#e^dzf!~zD~Omm=<*;ZAs1e)^T5G;%*SgK#e$7gRf_Nm zW=5j{Xnkz-YhVA`J@@};I@67(?tIs~-rdt%7J;?oe3sWwy`24!+$y?kx;`t&YuTJrn}^!$z=d1_R1H?L6Qf);7F z_-{rBv28c4B84|Sa4;)c^o@|EYWmo}b;JO^_~HS=wYm6q}Ds|sM$;i)WLwPDk`&6{uk%9lIKNk^^o(BZLqri+#=UA$oMmVf#5n$u2Ob?T{) zJ@(l1dv>35_U1T-0SqzJTW-P3uP7L5XPSke@PrIz3NLKS4n58?6&Y(J2SbGdgMbJ^ z3R0n>7F|`DtuQw=F!o_>%F{1_Fx)44rcswAAoY@f9KSk{4YF&a3w- z;)o`F_Bfi40tdlOuTF!8GSn%YLOe*w7$Z$FaoLk42tmE1&Sh*Vbxpvt5w~9l-@0e_-tXUg?~)bEqoiD)nr87tL>!;>mUExq`OG)J{^dA|9)JAFeJ>nX zzI^%GwQHv)$M633o!+_a&+YogUEiCkPdi2C-Q?8NAyT=NO&VQ3==9T;Px$flWiwa~IP-Q`N9ndU&e<|GDoT7nM6(Fo8BN{B5{ zOMr1Ucy|)#B-Azn6*p==Fo__tiLnWF4lH@gRecvt8s~x3I5V zDV0m5{+^Cy(7+&zH&Evs zz)76Y$r>?RtK5JB3=9lheDS5rmW@PFlx59{$*~}90C2OJ9Xxn&;lhO%UU=b(6)VE@ z{lq<(w5mQ^V&@_fCrQ{B2XIngqbRQ?AWEWGy#&0FnByoCr=?P?1n*psu#F;i8h=`40=HM{h5`%2D!W(8Fo{#zX*$z<=6_tGW0YDVEm69YeAev^+JiUGI z?mh2)?|c8?5B}hZC!XB;qX$(G^jS{uB+leJXD=Hi>=J5?MuuZA8PZ8qOtU_5`&aKc z`>gXn`q7WBU3=OOf3Vd%c&~s^WPF<970!%~S)ztnjVxchsHd}Ix{;4DN%MEHufoKps+C%!3+Ks;QqVe*<^)pJfU(FI?V(kQqMDw z7fG&B0+6zjFhi+nSu(eu>yJd$1;kzADMx>EYx+V}UhxW-EpMH%{AAoT)8feDpy{9;ei9Y zx16=HRI8nL;kgG69PH_`Bnl=X%CanqqF3CWM0xgITZ&u&oNApWo}b)xpH4p;vsfzm ztR7kNI?Fq@5bqIUt3uw164cm?lB9DHk}i-T<^Z?95oWwIRT72J!<;Lqs$uP;AVor0 zP>M(Dz5~i$JR1Taa|*}Xp???xsd}cSHG9(f!x5iDcCk`TVT=GoN<35ZkbyZyT&Z;T zlqyL_HCi~(-_>1h!c}@Y28VjfiDe>dEtp|VlvFlsI{nVCef7b={@B`e8*ci*jROmY z2Kxt=E*yv%NV?Z<-11u=O#k`QpZVe~pYH7Je%HHy^`Z+esK)$TANuu={jZOI@pCty zweif6Q@0EbFR~G;HM@50s!CL1p^GlR^vLMpzxb=aZvN%}JoBPUZhY^rxTE|3=^y{! zC!cz5(X!Aoyv&h=~w@ z7U}Qx3I*lQesJhy0KWJW0frUg5G4R$Jd6dKTmnhG^I~I5fh8M`lOZAuByj`)Mga%d z08d6H$>7+KgOYc~7=WF4B4%TPF^c$%jbX9?#KD-N30MJd2q14bcZU#xd7Y7#!s;bV zjXVe{-rCrTzvA+%UU=b!#~yoZ^ypz@Ok=w4oLjiCZ_S!Dt5>fMHirmmvTZr`W5fB> zm{OSS8UteEoimZqR&ri}06-87SXB)h6(Pf-Vqn<70}5|V4E0P#q2k4`fdxRJgiX9B zBA7ykoGEZd4He9jTpUFLY5*uRs}~BbEXqu(u-1w=V=Mq-h*vViY*c;F$x&jc08%CrKV>_5uLMfQ&gNVoV%GD^6K?V08S@(?^}xyk9Gp ztgm;s@@B;j6jacgr6`%^nK3eC;)L5KHbTL*rYZu(40Mz%fHRM z0$QLCZ=TooHYr++m85uu5|c{HoMis>rP@zbnae(bPh&5P6w#a>>na zXC98976ars^Gk&%vH+kKC?Q?}UZk?i$S9E*;-GXRRA?5EFhDRq-=L7fS``_s*B_3m z%LvPuy2JfenBEGvm}B(ft~U9*3MfGVRj(vo`IOVv{>h*GaTG;{KpJ%o4*$;o`G1Y6 zNy@RZ8(uo{(ZBe!$%)h?ouyhOw#YKM=DKU&cFo(Ql(3C|`?r5nRcjrkTpZGC6h)dB zZM5e_k9Tc~3s#^YbA)<@&_s5)xog|x{wEVZuABrNeDRJ5Lhxbh!KqOJz^9&w*l;G~ zD5>==85~)Ms0SuyV(%PU_u*{2;<*iX((a^UPTqbLt;|F55esxj$&$3b5V})zTtfM{ zwhJ-?n0XwGF$@w>QWx8)Mz(|GiHL@cS)r1&C=JTQ3gm?%W_a<)Uw!=VVLKG@NB-OI zD>9onGWHXn_(Zi*bD3kqA|Bq2H>cNb+;HQEe#1o^*J?>*AP12h_IH=OpDfBt7vjpp7xW8e7J-6PAER7-gGd)|>XuB}!Q z1>(-0_q_MUpTF*giF#Tc7^qds<*wv^{P#Z`Z%DaPt8|#y+7Er;gEze6JyET{0T3{I6*iou4n~K12mkr|drGC|1s5*R>>!aB z5-)%dQI%*J%yOXG=0b&80|8#~-SU(6R3y;jAk+j{LY6fn>p^4QJ;ri`*k;X6icbXw zSrTyB#x|TwahoA@3n83y#xkG^Ph`S=3^>d?Ob!+xNVWo@IudM5%Wyo*U_}C6AvxYI zLTmvzhZj{6c#VUIRFs$lS`^1Ifrf{N7cE}cn6B6BQw+n*)s9;DaF~BP=U%+9LPe~x z3J`$}!oz5+^*&=`a))%}ZJ{cv!o(0E=DhRKFp(-8W0iw9Ew!l$2!ugw4BBrvRUwGx zN|`ff3L}!!C<^ex=gMTrFE_K*;*MpL17JZujVRcqX}$+y0L&}`=3EwW4rDNoAk4>n z{NzCZgH=P9>oe~&ubBvmC~+xHz#_hRc=WLMUWF>9QmIs`R7xC5?V_CSbiC(rhS?hW zYLc+-V-jLfX4BQx<)IJ(s4+QJDwP6%3TzBRT}Bjfl)z`=6?3!^XMUMA{|v6UfcH+7 z;Ymbg_M3P=bUwhDMDN~@&# z2$3amk_j;va9=(HC*{!VLUS>9@)Gfcb5AtJ2TPqBnESmmxjt8DMWW&;WKQ?pwrHPW z*a}!cs)p1O7%*f^xyIrlB!;16BWt_K0>WxVv{dUzDnx8^3kkz)%Mm3CRzjtm0Duq` zuIZsE!Ya<{EbJisI9q-N3Kk$M`gDQO9C*FBK%DEaE9w37&o7aH8Sxb&T0ML$ep6z-%2p5fD>^ z%5dV>)TejZIBV#b2?ZNke7s1shLV3J=Tr^YFnbkijyBWpz}m=klXQgLun!NBcivkQ zD?m{tv8rMPqy(Z!yjm04B+626auES1Mmq=kD%Fl^XGc^nIq^^^#ZgC@Jt+jLAnU-k zYzN8~%1r8=pGxaL+WO$b4{xhC(j=*_T($hdx11$SS4nIf84(Ta6E<;AU(&@!h*>>x zRO#uh}if_7>QpQYODChf<$P$o3cTbGn64|HJi(q9`{>5_VTfu`WMj*r#ghs=` z5yTW0OD&DS93KcSgzaY(b~lsbn)MJ-@dq1#K(@I>5#_Z=(aD>;6&(#3?}f;;j@d8( zDwoUUa(T{T7zJx!4t_T~IP@gcdQyur3}YhXZ?rBv2s7md#V|qnW`bjCzIdNCs1T89 zo9NDTSp;s4bF;pIR{vINp3U0SJa8}{^YN31f|W$1 zY0^^cm7v6))QJdCNy=zWME%v?{+@k@4^K``fhUd}ePKgwT?>H(jx{}*H3ktW)B%Pl zHUOw1jg-=+DQlWelQJYmmUL7SW8IPQ7cxI|;NaMBe`hTgQivGwuu-H%-v-PXw0y1} zr0@hrFchayIps1(tcgv42vDb-_5*=QZc&TLqkfkQjkcFmXqsu?)ehe zm7EtJn7wVlLH=(6~Js|!`Z9YVCr?ErgD=I>4IFL)Zeb>hWXcg_=t3}q` zKo}HAAChOEDHq)(xIz`KHIv>Hum$ zVk|4vs{@h1lQNKJj~NmuZcLUyAYxYJVuZxTT=fgrl%i5xE&+&aE86jc_DhycTZNdcT;nIXvLhryi`Z= zGEVB)Z_{ypeifb3&qn_>AM-IEFEcW5u#a-hQRqY|@eNmrODc49dJ3Ig3M^eQvhDFF zZ@cZbj_$s}q5jRAH+lgPm?)5gPQ3LZv81Xh4jgC3mlsYn4vl(@qFUi@m`?bltE;y8 ztPS71>-MLfdur#dU1y$oW*l+OGh<}VTWe0Rn?im^11Qdf2-@9rOPEtHO<;K@eUXbj z14Itw#2Xbfo6wpDu|=MZP|NGm)4l1igTN~F9z;+FlR3C7O6$W0zkJGIquSdrF#sYW z?^LxYA}NZo=U?Yv-!QMaq?v-%AXMs-vcjlXVF9Jqc=DjE=|`(7L+pbHr_p(1h3sw!=wdNb^zeBP@7^3tSWFrW$!ZY^!|<2h66V<*kWPOM+# zdv^vjz054JGIBqbWWmHA#32gQvl4W z>N3kvhRb{uCC+CsV1p)Cxcf8=oer)PUYI{iaXbT^3Zk_(de*zg3?Iya9chiR;gbSD zRZJkSz<6SSiIn89PoMU<&r~bGYVQnDq{xXHZSs?zn8J^on?ZVIuaqAOD*?QE^=iXW zOGHgoxox$Xe-g<3L;(OqRH;jURwKIUUSUi;9n^d<%&E-$^{yi21bPF>6fWX2PN zat9^lg-cdkeCg%)-gn=`*!Y!KUb%ARqN3&q#=JPzIWy1@NEk>uJ2ze%H_!IO5mmTz z80A551ySkBw_Wkwdw#He$FrL^Z$9UobC}tS3;wmGQmnIW7>kV;+ixW>U<5T_q*}e& z+5;j28Zz+)n0`Yg1q0F2rOT}u=3W(&Y|6J>E(GC5_% z(xlc?&ob|QVk3aP_pdmSF(31BvLe?+S2Dr?e6BMnMqpu_AR`hB7*FDoW+Qe^xs=%$ zKBr|9kqUY5XBVx%ao~bH3LjPWR5d(gqZQ5ilg`&85VM8?g+R=bR!TDDZoOIptjWAn zcrr)DKP+i4$18v?(u!yyjY9&MydHJ#`O8e+uYgqYB9Ga_OuH1;%i*KWu~9hY!$LE| zz%2EZHgN+6m=L%VASQSZHbg2?hi#zw{DEzE^2BpBs)IxzM#)1IuIZS@ZZ;aBfZRC;z!+nVaZYl-L(Cvn zfx2A~au_5Mo{D0Ig&c1~P&Hr$z)n2K1YV5M037Ua(?3cZ4@PEhY?X+-&p^z~D#A=b zKwbehoM!c*f&SI2@#K@TU_snfEvxiI(YmN|hH4j^(ko&zX(1;N7(NKKS=u6r&ka5? zX7@@%11EzNh07OIz4xy@O7XK3Cu-GW|2~fw%*TAp$H|TWCkNFTldL-T{8eY11MlG! z#=;QdsuwDiYp0&Jc6j-+D6W*EnlFqI6#|^lO*Ta45QW7fyO`GMqvMaH*_CEJ! z=6eso0|*c#0D>&eEKbFt#F_`Itf8t}ZOMvmN86w5f8cNSPjG}kDC`K^-#Vggcegv_ z4mlL+>XKBYp$4hCq#CH=SY&Y?K!6w?-jI3E*~=f!z4;O#z^OGq;n|oV|{8F-m zi~Oo;Qp;==I5OV*S#S#ivV9=V(3>_=NMbFNNgfuld=4&gg`!srxcac5h6gTKF~|xH zjn6of%6Ju=ZMU0SW#1}Vhaz$*U6!EWV4w&rDuj8Z&6ACAV4dj>Z=cK4SIo~PdX9p= zf2sfl&E_mZ5XPeDqDI)$$j{Ao9vjrp|z;VM8R!tfHg-5<-!eEsQ*Rpus)Ai z=2`AH@fGhs`*tVd^~)TK-j+ZC4Ne#|7`2)KA(={M2{KwQn7+F6xBs?#?l0EzYstEz z()12^>LPOZ##Ww;#_l;X#to)BDBAYMJ3wl>ZZtXgvF6r?N_&vDnrQPrGasVxV3EX; z1dMX*OYQaE+}w31-A~B2fB*v3B`_KQ!D2uJNCl&)GmxyU9nTj1ByX>!mFt<-J@yxX zRscah2n9$PSq%@u=v06XdI1DD3n`c(!c#)e02zRJTf1KJ!ri?Xk5>VNVz->0NXbHx z+!hLU(6#WiJf&_PF?6{SKt4twSjy zpxQvR`VRF+rWPTh|9O5HzE?x^68e0Si+&>?CA^XAd}F=UQg^V#5=(s0AVQ+k*kqKn zZ(p4%RUJP{1l>e9+KKI*w1BagTYbvI-3E)6!pqdwrP}sI0IZ<`?t6{`0-6FC3Xp&{ zwLrnj%AS=KZ0}4blMw*PA}VVTZ&_W(Av~R9U|rF+ws&^y9h;5qG~TfrG`88Gabu&g zZ8lERV8>Qt8;x!2%Q^Sn@7G$t*Bon%Ip%!dXQ;q({r2fYpfh21|7H_J4sB&;`|H;p z?-7aX@C}q;rm)SbC@hhKKb!kEC6POU&S%#5PKUQJk;h0qD>$UHXeV+j3#k5@wh|wR z9t&$dc7Hdu@YAr1@&J=%Am0!@r7gd9c5T*sg~(IWsZf(TCbJx`^>X-yo0=6q&A%Yf zo2HGssILlh=mi9=T`Oyh>?%6&aVaxn`>XKSPtxEz%?b_l#MCCRrC ziDnzC-vS%aBLkz4Mt}i>*;)@PmaC4QUCYsPZ<@6Q1?zyBEql?G3##Mi1TD>$qzsNs znsE>?N03)jbL~z6m)2 z`2|wQV?91e)_1Ogcy8GDe8dcv?|-bt;wox`D!k5?_@6nNQNKYgqQYrU((c0lr5Hib zF?0mmH(B#!3lq2H>+8C&Q|z5HCS(M}|H*uIbl!hLfi1u|d5A8t^P~2EvQ=GQq50H6F6*k0Yw^ z!~Uy2YC`DMKRM!23y9s zlz@3MK=ipUHwp^&M`#(7OQk_=S;$@Qd}H5pb1go0G8ML8o}Y2?5}>ixG$$`;Vn=`O zB4lZ!-|H4+#zy=+A7!rz5v|7xUl{&^bUVE6YqJrC7xiRfie^e5uYf`8^w?2>uThl^ zb1y38$sD~Y$QB2s{>;4^c&yaM6?73=^}1^u*|4fJ84I^^|oTrKv+g^7SeCIIW3u$O)v?m~i{Kb^AvK(7?x-e+HoViGr zaB3T`J;q}7*`t^pHkYyfqZ7D3(oiQMur~FRD8t!4w0j`JcYz^&#PWP+syU$ z(;K3-wylUQ9w~}L!$Sp!!d0Q%wP8vC1*5Nm?C%yvl=vnv^bw3P@r7}$3_9wpL#5xmp#JouUm6AMTTS5RM@)ZL7Ry>>3?Djy6)lI5_8#S9l~AKex* z6`;;6`(q9L#Zqmq0nr=i)^=vi_)@NS<69cvY#?#&` z1`D9TJPAyn@3vwMEUKN-z2z)V_wC)%(E)n7QX)*Tv77& zYP(F@|2o{F3KKZ)m;$1#2>Rx>lTpFLqa<`qj7B^=cbs^7_}HMbyi7l1RqJ-To+%tu zAriwC5E!*XX7evEj0(=UViR@jU|V-)x0$3;34=SDOZ!p5uu{w()a5!$ISBD`TT_yqps~^cU68* zI^yHGBBAR;h(7etVhsvc|5lva$YwqSpYD0SM^b7Sjz>1!^_dDTsT^QQI4D@AyzU04 z@5{A%EUB73nDc`KSsP!E9?(920)A1>PmhlXp^W4Ig^C%d8|LUP#Us()kD$?ic^$ql z2PUJrg)A45pV%nnUhK_Hx954Zlf<@aHLwEJ_1W-ak zqP+!86rS|klo*asN6GCVqRt;#f*^QM0aAGFU&0$7mlgP!(^|9a6zS7&e$UBgERZy<3 zNm1lBwJqL^J^*vQgauCtH(%L9t~e5~l!x6s^ECsDwetjj#&P%;tqX2*5P*)JDkHJ| z+T5qJXcAWOH%oz+@JYbEBq{uV(iEm9!d}5E()_57Uk%cSa6l=0Yy6t!wYMoXxm`Ax zHSfGhNV60(4;oUALI@lJ^l`0HLw5!GP3f))q8{}7EN2^xUxx?<85zw&WL|#?Gc`Nj z<6W%Jz>~3`<%t0{#lm0p7P}z&vuqS!l{Rm#`PouFWS%2BKo&T0pTx@$FN(=9I*s88 zVai4zBNx6l46+J?D=c2V0iotBN<0-d9P*zo;fGUemxA6;Yd1x%<#PL&@dzNKJ3Loz z+c42#xN~v(1IwbpRub_O2Td%Gia$yhfdduOM0f~79*3>x@R>g?)x?R%ZyjMks_~ml zX*qp|gIC*rEw?A`GvkaAoGC`zb8FSA%R+b~Hs>5dwGJDX$IH1dH>=Ep?r5j_1jWB` zD$LKvYzN8uo-Y3}D)Y2erO~d(J+zlauGFkEin^$VCYW3Izj)Z3$sg`8y^j^Gv8Z+>ndA)p!LDG2@U|K>9iayCtVffV>gnPb# z?frt9W`9gG2V2UzG`pTJgouO=7(sP(($Jq7#$*vH~rD7+$OO}#JaUSI^d;OzTAOx4=rt|G58TCg5 z_#Sb%YaOI8)ze3VBD12ZBTEWAbJL}e+_VoDGCA*eS$>4LV-mwqzXS^&X~I0 zVF&gH6siugk*RX+-3IiF$pGwtFQV)v`VOc1L+<9;7cW<3r@)^Do^x_sgam;=n$PCS zKGcBb#O1@Q8OXE65l`jVnLFJbp_KW;q&+VbVt}4Enh)syO!7-9=qQ&NP6GNhpumqO?>>U3M*Lz{rSLTp^9Tm1d_=T#3Pub6Ac?HMmpcj@RtdKoBIJj|#^K#mG z7DkCBL;xwTu#^NZvpe73j&giDFINoLTHPHu+Fz#sZafU|PS`1SzO}yZ#($C~49aZZ zFs(>Mm$>1jP#2X>F2MxT!*bP+%-gW|>94llH=_P0T0TNX$n7vFa^G6GOd7gtwc+Tr zKozRhcBUtc6@;)^Fu1ysOBbqKu%YUF!mtYu`Ho^UV5}o~gE<&5gKx0(0o`eNyXt#w z?UIfX0Q4Ev@WawU^Wp2s0L%H(*^3yE4>A6;LzZOOUp3pX%Rh&JdJXaOBID{fVE<%D zxU0WH!Beo{*@tQF{YhbgPREbKtc7o0e-*y|8lZiEW2_Nm^;MBf-e^`ni#*V07_(Q+ z1a3-;vL(C9$~0?W#;ggNim9i&L}wPtI?`NK>ocwD(PRJzda=H z8!SQI78UE>=YyJjpy2JpFTmeDxdRZKJEIo#t1z>U(e@NX>CMmfn+{Ihwawq2Q8GlS z{W}c(2fAFx9@Ym)*OtBQxJGJGaVD2sZFIik9n}0O!;{{CS1Hdg&`Owj)%y^aU#}Fh zG$bk(35=p8|CVZI-|Oe8bNu1MrX3{Q%8|=8OC|=!9wkTbCa86ul;50ion-nw)k~9h9_Kt$x2%}P3g1b;f8c43ei>GttdU`)beV|x zcGk#o9;cK4lAu>LgjVgr8e1E6ipVNt&uEP=PV%%iqLY!OSAXxnAI&z7p#D#H#^)hA z*{=1x#H*Acy>f1pJPC@4L;!;~3XIRJ^`X6P386X?_uG^?1-e4oyPi9p7D?I(U}O1w zYAYn8uZJdw|=<@FvH~`D#>gYx;jsLP1-j1UU zDG22%#%_+d)!3+8PcZMk2+pFQ=L@My&&hD*OVu3QwtEV2>_t?pI9V8-XqE!0Az+Ox(NsH}_r7ke=;f*qWO;n1v z+)AIiJdWA8qSkX3@D72@pNp!_s$7?}c4*Zr2NhQzXOyJ7LzS_< z*(9$J%DLd9QU;pZ#suWf%^%M^RDYk*LQTX@7y8Q92?kZ>nKaYoLVxceTj zG8p13j`yCs6Kg7vhZ|euQ;wSU-#Y@BqekUN)e4k?%0zx#7d26Wwy>K6uFO*3%a48i zuN-?SWJnI^DCWW!)Tm4;P*bq|`zZZ6>fyR8{V4_|zWdCq=hEa-*~1J33*SRn1>YXF zEhlo8K5U`8eF~9*NsyjSB*5B_n}ey1$Ltz1A-7k^wSd4HN>_)^bH`gljnMr|q{!ov zX>CV#gErPr`Rey}F~6HtXO=x0S;;dgLi}QES+J8ko!mH7dU|WC7s;Lef~&rJyhHzU z%h-QY()$C&&4d6HwCJX5jzZqV-yrXWx#sTv4$aq5FONpFnuSv459GqX(+M{eJOQ2? zMzv0XVcb(9wherPqKGb7q^0}a^oOZ!Gys5me;~h^YIXuu5kPt5aC?BBKCO3&(l(0FQy)+hNU-_ALU&cM9BAi{=b zJmgV$rXhs(%g(gXbXh8kF4p^aC-$8!+iUcyB1f+4_ar`|nTu|v7v(F_R0 z03Av}-&3q{XS6kP`*hb%J>Z(`(JPih?0ha&zNk?kDQk-QCl8I7kv52K99mHS9!PX1 z76KECS2i~w#b0zJmie*u!gb}*5*|R~D@(gjp+E3k@Q-k2y!tG>n&$`!-Yr)^y^HoxXRegN9uUsg8W?iSvM zH4|f5n)00?a-C}!096i2Vt$u{Np<)fkE?Xf{YI%m72N9fyMvFarPS_Q;#aykE_l4E zf4<*+`ij=|W{FugM$Qz91Y6IbaTG!6KEXFpgY0g2a@+hr1CSFSWuC{c2`T!T21R_^rRjyF*dE*PKKa38+T__Ye2NRUC1|Cp7!3~>L;W~HX zBm^$k%vq_pG6W;3Z;M8-vIGELd_G3PkWgl@qT;g=*#fAlc&zhe4-8AYkv{GnmUbpK z`b}}|_g9vPN{ths$zoVl#$W^0o8qP{r?tVsdJIwUe18sEq+7wozXAozXTT+kJY3J$vI5cj~J4|K}FNZ#(+qJXM&Lc zz<|np6mPUf2TCUyKWHXBS~mkm=;l!Abt(6CNr~)jsm^rpBUoAk5h8ZXIJ9+j86|Il zjK%nL)-9Yf29wMV4isvG_z_v3if;l?m__5AeQz!Y2N)T7_5DmGl1Xn?wdpB_DeB+$ z$mxqEejm3mfVEsg^aO$OU;bO9{;e6wl>f@jL7iajCg?>egWEbks;i)|mqw{LAge*9 z@H9`2=AP(t=ZLP3;@ms|0LK22X>FKZHBMSK5E?m595^kWx`= z<-4&k!N(7#PHE<-6A<)yXwR*=^Gp3Tk=lbD-jSWAR@f}OLnMsjf1Is7z|;x&41y*#F8Fj5~~B82=+va20^yo@jrAU^hEh8#!%ma*V+Mr=G>K5IE0Thb8V zpQ*M_+nB!6aU{XNZE_laTzeyJ2lE>qfG^?nG7vg%D#Rsog0~cI9hhK`vN9Ka2`1hy zc1$-i+8=uVyoy~Z+CmL7xx+bRV8@Te0g@>mxWyK^p<1-}u+~eq8MgC(>%t+G>*UH@k265)`^< ztnm~$1ir|tyq_aA_)`}VHj9F>yNbD&Q4@#7S9Dh(D{d~zyo3~#6UQj-5zypFGF&&5 zG8FUvI_52FG}kU}tpe@b0s=X0>rp)2x|`DZ?Oh1$fzx2(J~2Y$w;{jMnG8w&fBg~R z`e%6}BP0;TZvabBXPUi;;Mya__7+V$M{xv=f*HU}N3p*X0hSN7cKkxo_ z)C!MI!tZ2-25Ld5fM>h za>MX4spjlRl;m$CS>pe;a4!jE6JiDzE0XbdUjC8x^H7T>t8dj`$A5}m3v;>3maM%{ zHMIQ-s+{*IDhdP!rUX{P)km~bFj>=7@chAh=rU9Zg@^tl&`rBpmf>8Pm)@`olax$W zqGT&AgjJws7jJ{a6}(Ptz=kg)vHQu4?kxI{>EG7j9diBEkd>3t%p2j!mrZ<=;5Uzj z-=N5Vb&F2fkXvaA?ADPNn=!D&gmOhEa>!FVTT&dVoLl~)9wHt<2m_J?u3}ppxWUQt z{dRoW`T6#z25(iu(S4pYX3A%~6 zZJ&3+{&iYE@wD^l?Ed2@mQ{HxKCF_+bR zez_tB72lLa0vcydfwvOxGSyRA3Mh7X|{BPrQQxCG)O8XwhE$fFhT z{@u5Ahv;G=r1h#x!O_i6e6KNsNk{V}=b{q2-&W4oA@ zbcva&2gkEh|KsW=Wwx?VsHxmLF_phg zA=JX&S{H|92SUK|s<8fD7+pN|E5mrx&XKk-FFNXvN}l)U!c_Q&RZ(_y^uo~LXFKVo z?=82lIRAh&j^EEiWtjYbw@>kmd9)?|;mgim7k<~_vRt{ti8&9_hd%i<00!#Gz+r=Z z+Su`xX5+>IeQosmxmy}V{jKa_gJ_$reWE8kXd2ydXNvOyBqq?MIcdVTyfuPXcw_VR z+h=_U`-%J@1lB1$gl5EE0&GC_ha-9#M9+9bmF}A_WJj&?FV$j z`{6KG@xtayi$&?k_ViJ;GjC*|2?_szVhH^-Xh1I;ScU z1<*f>Jgh^;H9J^b5+=y(X8Sj^fKlr~St$M=LZAt<;?+lOIZkPgHEf`+O7kg21U{gn+0VMby&D|5F;cxl}UO z9zUmwh4C}TF>A2V?yo8~tOZ+Gpybso0@Dw>j99L*wbKzx<0kqVu2U-M!4M0TGvV~8 zi~;n@^Uj?JgQ(MeA%sz;34Q>517w9B)4w{CXPA-_Pq9^70>5VxS(5d!&-d8d*HDZD z=0d39D?JOyI0|8oBmg2#T~e>j(`d(;U{QZs^}&EAdPZNrVtvbeKMN_%eL(+U@_PAR zGlrq*-xiX+N}Mhi#tM60kMVl0pK#orEQ!w=u%#}o{$j%6~bcz+|Rgj}0aR}*-@SRVT?Supc-Csj9+ z7|`=n4VkwzZLrN0F?2mI{VXOW1y!c~sh^-K}InzwK0W*KFobg;Ltu2!5jb85C5 zt2uPDXj=C?{>HPiv|KWqR-Xa$P_qZ=T~p`|gqARzP}xO56Zm(Us=;qR_GR3p_s96G zx?4CJKvFUR_3_Zxr(q^vA(#Lf2_8x^zfrY~!i%l|9_uj1&?` z(XZ}S7|$t#w~7UeY2x^uUCUa-Flv?yAUD1}yu<5z%v(BhxYhe1q4?Fxt9U&OPug~W z=B068Nl^9vu-mbzI3VFiEV|PXtX@RP?iniXm-%i^+@~(PL;iVl?SwDgzsC0H#JLtAgv-yN8cy_HU>wni%_Q z@(!G2bLP3%W^V=D5@a+>lgI#q5AVeHl7pSQdHSt=`w6aXf$0%u`-RVUa?Ded#8zEW z;(U^wn1LsSc?GKa>Z6!p=a}3#Z5QEe@X_F-hrdsv3O4+!5> zojgo6$%H-rR*}8GZM?00G=cMX)%7W9_us}cslMB}x;7-SOz^vVJ?>(aDrG;7H+5Wp zp!h#RuF8P1M<$IT75Oj-eP|6nlD}ikZ5W0UdmTS8JoxibMXsK;;nMmD#4E}zgGDL9 zRaFIWgkHb+49h}_iE17u8YeoMmA?BeQKKudIBQY(mE+}-tD`=B6+lXU=WlAH5G5{a ze4}<7j%0jxmM^AL++!0bm}UBc59K&li5LpXl77_^t({v3HLPt zAPo_>OqiUlR_8UZ{DL8p%?ds#h(10(*z4JWwl$G?>yV+6xkmY?Nycg-Z69YceT(=l$T05 zgj|jM6JcQ_JvZYYH+;eT1FP=I$7_Ls_{W2OJVQa}yXxrr{pI9j=rDA}mRqvdzkV}O zQk{>vK6f>p_pf2O9=rKUe&aYZRaIODRSjRSyX(2+J~oRVx$d8M!2d>-72B+CpFKP_ zzu8Y6+PDbU&6&dFx$wnwU-#K>r#!SS^f2>nCahhZVDv8%pXqfF5sTBJZU(x&e;XAZ z@QuAyA85_2TOHC|@%LdEk?6q&SpgC7^UNaHU|@#yzQKUc=9FlE&*smMX^YDrB`%YU z@YF(|7#%Y;8uX`^TC$2fJ=KfQ6S1Dm!Ch%f^QJ3MrrMN}(;HDEADD@-0IS2A{2d`Fq|3UKq5`C3sD8TFZnK zA+jgDC&mP6g>WnDpSInbV`Ke>23kF2;1%C-)^YX^*&=c@14&6nfHY89=BEYX5pOyJ z^tn0+_Qd~sQ~QF-kuY)f;OY|w6(GJ?n>AJoM`3Mm)p;Xungkln-uf@R1 zGvqUXT=8I=IvZun?}Zai#tK8JYk&*>UO@G154J01#B8fjH@MB*#am?tN_H>B`3wCN zvmAZ#Y`lh?^$M3nK&ymgO+JO*=1coVta zzWcMByQ9wE&-!`3oXdV4Xhd|(w0DqqW=%Baxd;HTr{y9c&$V z`Bq7N9XC!pr-=PP)`4-fds)b1U-_MOE=q+TZ8zTLc`fU;Id!7LVaj*@HWWpLCr$5* zyleMRoG#VhBO5;Sqzb?HYZ?k)cD|jz!)t1GJSlZH&c}eL_p_E|*Bb8|I(LgPkh4Dl zP-23lkg;*nY1t?=0y4d`XpSt_mj67nk2n|7w01Y^7Tc#u=i;IeEdmqwVCiAZrtUe} z$@zPE9tn|9D+Gva@AJf*GzTj1N`Uqpl;0>s5Hci5}bPN;Wo`AU}WT} zRmV+d0?h8CG&{px$ULwK<+W)%!nr0{$gTZ(Z%I5%%S6r%n-{ld){c+Q4CIFSVxBRn&-S_JHQ&!s;tb3 z8ydp@9wf^%eK-H#2y^bkIg0ndfFTbc0g183N_7qC+@qf+`Z&2(Wh)L&y*3{ZT%MHG zxS;>U3^J%1XDqiYFW|I{_EG}@(ruv!6XX#>5BqpgSSdfmsnSS?9l_W`}u? zP>#{~LAG7xb+CZXY*Lm8V#OlkC_BvG984^sOAY#NT=?8g_D7LtoNM;7zh-1NwQ-Nv z_W_UP(h2cZk4zHcI7e+FWm~ARoTMdX_l)QpQiA~9V&J-+l^G`Jl_?Evp?zr$hli`D z?9N^3vk4vfAA7}lu2hT|FvQJoi>{r|N`CJzkIw5w)jLTEfoGJ2tgV5A@#d`j5%RxTe&6*`o1kG}WoQ5GaX;l>S zQCQ?SjIP%^fpf@qwHHwgwu&k*;~MS9wUqJpZZHLEZ>!h2$0z5ihvkg9IWNHS@e zY#DBZ+`P*}G@m=$`-eoB1-Dk&Pi0_R-3Zt>;OAuY+9AElBWS#{F*!(Z(81JkTZ`-p zy@8+uV>liasi|mx93yJBK+Jd}D#lAS>CUn*X;1=PDaF5xkrc=HCBu|CCb2lmHS(1k z^#2H~KEq8D{>1Zihc=bbI28uZ(xl7*y1-P)-&t(`#q+GCN*NC9h$g+tcu_G@udaX( zN0L;_>Xuzx*tqo_ahqZGT7vj&l?^NVy7iRVEI~(Ja`fu%U=DYEn+$gac~t(Aj<1ZK z`|=pn2vkq%>+7gkGOh`VYFPxe7bVHqkWcEAyo%dXGIF5>z!J={p_bFf>t!s-dm2+S%VKhHzIox8-8oEG5k@*kwc=g>l!r*|yq%xl zfb@VcbvrNQE1JL00v|aL0Xt4=E{>t#{wMPJ7_2`bnd*&dkV~F(b|?=@Xp;-0_!#3=f4j`964tGXxyDP^{CTgm(1o9SRou8^18#&XA}!I-Mb^S>Ac5bdNk zFtK-6IPVjO##lfBR1ckV_?+4dQ*>lt^T2?ic0)zecvbGki_-R9h{`7^snMqxR5&ar za!4}ysCArNUTTp*8D)jFHz!oQGS%1b5EXkTx-@DTf}<|G17f3ApKLr^7n>+;FaC1> z{H*S8*i?a1K?(#7HTh{EW4gGZ9}aTCP*KX%nXBf-fB#54P3EXbpfo&M>(D@+7d>8d zt#_TR9K=o{Yr94lTXgN*(+@yv-k+NZS|P9c;sKEpJ;hRUdIL)JPfL$049P|os@!5B zsLLtt&`^45$QTrpQ~CISFJ+)SGfC7b-lc;9e?hoT&!Spdpjw0^9Rp)zI8-iNYy81*fcnp#u>uJVgbOP7Pn0_tjQV`oZPtID zYzr^(;?E?snUhh0GVwyJSy;jovk%_D|1jIjsIq}4xRm@)N(C-x0 z$-C3bHR%C)PzC&Ym<0a!a8WTGpWq09QLnGNW7q`$w~>%E{-3R?GkzcA(v?w%dAqUR zn${h~PdC00U)s@uE~w2Mw{sl`1+K={J&!Jx@!`z@`prEx;1oE|q$$!@Q!@+F=5!@wi^a<2R4P3wL&LKQ6|3aFsM1rr7qcr_pQ=Il(bk=Bvkh0A_fscH!_lm{;7~Z& zM!>8~X90G5txM9GWfoqkzGf&H*X3U)FBon2N3_be_dw6s*dbJ*UXQ{QwLX1d&i;op$`j0{Ysu@6kjl9D+*lMe`vlZcyS*pK> z&S$?Or=IBAEdnm%ym~^b)$VQ~2xxx5$=Aepf8m3fie)G0J1HY*zmJf*6pO zY*l#TkP*xKJg|N?T<=rwF*{Nb$|<3VkL2MeVR~>qXn;fMxK7}*j-m`uQBwyBnV0^! zYpo$ZTmj$RLeJ~E=q=KGP5n$iw~~h@HvXJGA2&CJXYT*%rR75!WE6;^_Bs1ok?gov ztG69zhu@zo+j&7M;;}2r3~miOZlI6tr13sW2&0H#;}#pNax5$XsKTHK96bemjFyCJ zw?cU3OMViN;V$k1HZA3DBMblk)JMYv3HtB(0yN8A|M8UOSM>KKSQR;_ETfv{B&L!$Q7eAvA9)vE#PT)nZ@NcQ0|xFJEQsZ>T;;tMUu4s6 zU%)jYX}t2`>jH(m`@Qz9%K8`RxUmVhZc)jz%Ou6H>b8ZRAzEv+b5MVUE9{Ys<{gqz z8ob32v_->ZJ|S$P#AnyR`?jyN7q_=-LnfAEp`N$@Yb)Fts^)6H&+=LmqP$nw3FNM$ zb<0y07}go0Y=yWgDb-6$HAp2y%WjxWD@~GFar(riQxSc2kNq`QQfGW0H|CnrUp2&n zt4;J1oR0)HR{Rzr#2GJd7W~}4f6#jy9;EZ6Z zs|O;V;*XdiV7ay2`0M5>f*zpT*3M0@(LE@b1JbAP>7*sMo2fEELRP-^CJ6I z$BsK+YIdJN>p2&HPM?uX38iHzFe4-=?_pE~!apAPOHPI)zAFcAk496UPj(8XbWDh4!X=7OI&~<7xZh2a_h#5-QmS7=VYO_yDaaAW&OhH| zamuL@G6MmO$idisV<9qk7UXNjJflx%+5`*_7*`RCkAt<9S*F2< zN8sXw0*Y1Xnb`ttgun#=H}qsJ7fBQ!R4~?;5xL(tJG|6E<_oj{Sk{R35b^q99`znx zuv*8wzRGL=u3N=p|BTyg6$>6qej`lAs(EgWo zu1X4-UGvvv1H>jCTVIB6wc=VIFzIMS`STfz0omiJz0--I!T)~#_HZLR>u%(&EXlkkW?%vw}nJDF#i5Ea;>Zw5nD z=Kb9Ms_$8ux?veBNUJ%}y6q!Xrk5Yn=us{HLm8?86@|jqv1(PaKm2h@_vw<@Hv`L;{WHj$Q!^TEpON@j?NO7nU_@YNpFU%%b^iiSPTApfZ zIT9LNKD=Vw(M){K#b`LyWNeL20iXk4F`$|pd)w9KU;e<1>EOiD4(r%_7*-CA3=aUf3l zDPJCKou@u-go+k@YMPF!?K_fUpca;JDG~@rS;KDbkdC=R;N$oB&(cu*&kB`5qG6U!3cS3m=_UG}45y zl4PT|&2kv8XLYsfoo}`rjMnz!E2Yfy9N8+@cS9qRDpj@rbjge3x42Gyu8g@hX>+j@ z3x&l{si5(nWB^&=+Sm55Mo=ZMyc`Mt5c7l_B;XQ(E8YUZW^LG`G_r~+R{1Qlm^EL# zQ`y@~e)lY5*hO*e2^4=1JjJ=7ni2f2KZFq&X(n^Lkg}t87P!3aXER^K#5Y$-bxKe4 zcOBO5ncy2^MkgAH zBcS?Au&94HgoqU*Muubj5T_U-1};y*0;#o^&rF`hf+a>z@cP+ze zxqs$JWL;5ffd|wsAOeaI>-)xUyBL31&}Z%@|7n-pbv@L7E?+HqhGzCl`Zedblfpbn zY?+c~#kCvI*x7Q6WXM9`-BVinTG(>%je(MKobTKR-%MwPsr7ZrZ7}LTD>#TAQN}JI zk#DA|Zhg1_)l+lcpn=^GB(vkY&shWC=6A-nVAvAAZZWr)nfRy?*g~P@2&WH4$Y$-} z&VRr!b)5-+J)k}Hi>gXj0DTtueAZf8y5Ea-Jyrf#`CL*W?Jqb0L+>~Q%9?QYmnUNK z_1KG_ahV4w)$VRFu8i`}eGr=jIgq-R0wARg%VUc1i?a70Qf}YHKnAZ#o095nGKENO~ z7MQK`glRy%zIMQl=A?mGj8)1^4LR=xF5!PAl=r|;4=$_@~}oIiU5xlkUI6 z6G33t0|ijOC>W*=h4(!Uh^5Vi1`2h%>iu z@^Jo@p~8$<{TeJ8IbTEQq<`D)61al#@zJTA{OY+>hyiIv04O8`QO3=N(KULW;_TS@ z$6#maU?rS4E=M7D8O{+~J^+tdT7--QfNkmbQ+kp1p8uvC2+kCpt{V$etlJUpOBY;d z(UMoJjO?(-chZrzvg>egNY;Ha6Bfm#j%-!<1afMLprK)2rPsW>va8y2;|i81fonJGPnZ`c-Tp0C{ z#Glmp$Y;2cP+fcrax^+A>P2K$Ed>9`LrTc%s&h>8X^?dL+BThQmWYq6g!v#AnMBgwBv zusYpf;V`%?&DKV;Bn(8P*h8}AK zfe~e%YR=W#mGdTP$6@z&M)G_5VM%@lyYuLEC<(wMr0hN<90n`g!oOrWsrAh4SJP-( zPuga-Hg0S12V0A6fY6+ByZ^!S$Va_M9HOg;PHkJhbVs!^-iE_faG<884zEH-l;}S? z-Pf-)l|p&NK8*=f<4$76mfUJb7x}*LRP^6CWMtE|peeV|c3WYQbyu22`^XBf^63Q= zW8<*Q^^i@C&2RwbZ_>U^38(^$JoGm1D#4r#`2<6{RX$ovSggFieY~j1zp#`FM&=O! zm@?XeB^1!vsMc%({y5-v73wZJx-vKf<|jb_O*s1L(-3FHPr#_0MjPHa6a(>63unmb z)JXWbULu;kF60&Qrds@+pQ^os+>}#E!iL;j6HdHG3eWbjA=%S@a<3^ zv1=5B?2lNK6CS}a8K(+wjI)xR97Dg-ycdZqxvlm|WY}eWd3bgwc=a!^PKT2EuAH)f zyudO-~Zm{ zx%1_Gg0s)sE8n&DeiJO^2a1AoK9MJ4!(D_F9p(|f^Lt|em8)PlqAb|CZ+Z2{(pM-l zkR+I6EKy~k*BGGu1sH%L!V15c!>XF9icjFC5^}9?tfs32CEz)piY2xvp;`Ocw;;Jy z(u*;sI-NQoR3qK|ARvm^#XIbtNYN6oXX5$0Q3w^NQ($l|Ede^4#s&G+&^(2)U;NhK+Y zt?-JrIhpME&L&`rEi@ssV)j03bud7Qr@wg91vCz`7Ll*!)a#P~RZEPJ2a!~Hpruay zQ$Q^izKgT?Tv74`Og6*6?5;30V5gI9xWM9ga7$a2?dM&4f;0>kqGup0et!VWdx%nK zlA3i6D}O3U)`-2;ZY}d<>)?`?-{kIo*;4&4+{1P`7#@&?Dd_8;k~ADC)NUT!cX?(s zp?GF0hnjsXN|KU-ywx}6?K*!H63!0u^%={woc!v&=ebS|72(R_Zs=Jp$gDj$I20KH z@|BrtXH-n6s+W{hnxNWDAUe$+flq(E?gYYCwq{;-g!o4)i99*fg3N%{2(?tI#?PbSiEZn}EX!`Zan6ujQB?5FY68XbTInC4|6->|i5)h}SzWmqGH0 zm5F_XNh0TZk?_^scTT9>bN%Q6P{V6LMKk}!V1pE>DGrB?X$p*>V+#{D=QGus1gHPA{XW|aDu7_SE%P-h@XokBHIfHLF@d--Z|)L9scjAjU7G7fzdDj1AD48)d1 zQYevODMavC*KkW8ok!o_n(9>+sU&cO&|79@XzxfMY=VD?0vNj_H4hFCbkJ; zv6f-~5abYW5$})Z)D30G0+oK{;;DBtp8tITIW4J_+VFCwP^D8)10u5kA;`EFsCY_* zku-TKLV26N9s+w*)Eu0KwOVOynY8c0I<;IYa=1VfQy>h=FaW;<(O-hTn|u{u$*^R& zX^F?ZRb}hP>-3pnbw0n@MqzR|?;Y@CMlm*}iUpnn7d#CJfia=?=ipzVK*hjEDXZ)K0rUz$KR{aO6@Z@w;A78WkBjg1Z@3N=-s?Jx`v|&YU|V4$YAOu< zaEqB*n1eNE1G*%CC{CJGs&v(_^fE7Uk$k&&{GL>BKpY?ofRm#_Y=rv}fG#&Bj!c+W z+>Vj_)N>!#H)i+!v#6-``7nJ2tY73z&yeV>Opus@Vc4d;GADw1U-U0DjX)|9mrkpSG`fbu04wm`xXgr9OY)(yX( zbzIaraYRH&zklSQuxa?C!-ZInf>gsj^dkNXIa=4S2{)ZHzarMmS;X1__%j3=En4=u^~}XI8^jJADp44F0?C>u1yX2T zx|!nOFu=h)aX|^4A7gCy%@d;VzsJ!NsUM2`j9m9~y`?$~Q5My7Mo8z23mRb&5A9E{ z7vTA*9ZUpLM1TRL+=5{nat9FomT$S1xeyD<;O;yTWn_q=9h2Fqz6lE*%2f( zGbX{`B}B-XWXRNVM6fRdkVSTvR}}x0Z5by2psrcb@Np~GK(6_mX7ArePhshju9)S7V#+^bN3ZU;$Es`Wda5_uFSEbvg`3eBO3#TJ$gzIf zlsI#-wt-!CxCzoy6^G`h5@#r>DZe-TQqgNm$e5%xMJMFKpc!hF%h>YyY22=8cB9|d zC5G7aufbf}Rt>HLXsQL;u;`3G+Kj0{h;kB!2(aSi5nd%$Q}!t4#^yChhRy>n5)umN z9_LxwO7<)>MhZ*|jq{t9ncC#VjW+MM0vcZ4hfD5NBTqO$u0YR%f9Uq z;kI*&T}6t)XB&&%W;<*dg7ibTGk zeH}X`q!1Dbku7AUZFX)V{!~v#T@Utz1{a#IPI=4rwZC@YVs}*e0e=Wgpf&8wCsL+E z=~+2(>rZ`Qmfl-b9g5Zl>sTSdmI|MciC_#jMTvt1X>S3n2-*l-J+pChi482He?%o} zdB`yBybwnj3^gJIWtK!n#De3=(q}|kOwn!m+uh~?qI)Uxplgj~@wfUhITp|zRi1B31D6gt6T8ai#@*sC0nm@ceh84c zfT6<>BtGwN6DIcf)e!u3y(p?UA-}+NM@Xb0I^kRyslRQ%G4!RjS*$&z@%_vDv4Qf! zpIwxkiA|a?YAD~x$yEXaQj<96(r~_9P^$x&C~3iri3F)U2Y_{c7$%}0PKhu-a{EUE z#NL;SG9RHU&gZ@lsvr7R&(S?=iSILpiP;ou1HC27!H8gN}X3nP~!7fTK($%;2u|?51 z%w=^<$2Q%+a{o$KZ!|mo*?u53ljmRGm?O+ex9U{sZ5%QPHd zze5{t0mzV69i`lf{$9z&$%`(OhYvbeyB7KtoKP;$F;nnBtrT4907K>goc%nlvkC}2 zS{N+(H+f}@-5qpCK1L$nph&8p(9`DQ-an%DuS6^;v9;^H=*iydnSU4Xvk0-3=Yirezv4!b2BHQheL^+g33DvVl?3$rFNR#Udm z2rGP@l%c>$Tm!k=9C2NG8uB><>Bo&PI|b5?cY?Kq-1EvV?EWa{JZF&VcaGhWwq~eeu`LyzX;tk@6+r*$ngG&pS*e zUBWL0N&$(ZSJB^PcCtm2qT}-cSgB(un{CQ4^2+5;kZa^M&Cm6zVa~-VQ0%+Ihs0K} z_TFyAcOs+RgJvsc^Q-*K&mq}4#~5Tn$Mua)!Q?QX)mMrJit#J^C?1G!`D!Pp*;9sO zllOM=YUc}o{}^`{oO>&m<6XG}3Xl7!RLk}*HeR@QLNeSRwwQo4{YfxDBBZ4u$kfp@ z-QwFPMLFdq$#ZnuwJr~Mo!5i#Kkuaf!S3<;xsAKwUterWrBsHDK0Nqir5Qwnpz~AztIe-XiIcI^7k*9q?Q3QZcOQjMO3-|6o5$pj zsWH8UDqf_>?eQ6%k~#1HLt3n2FcVDQx?>KT5S1aocx!6XmMUvrGGOS+`qS?p{Qnj~ zAw0vBi50r4G}rFHtNhOg3mpqMFZVduD9=YpoFVBc;)|I=Aa_EBJO3H@uho}1RwXuS zXzthfC$Li2`o_Y(VyN*X6s0GDVNfsL8yln+?{*A}H~rg>)Ta8mGoJo_HE&>!LeC7B+{9?ZeRjOLIjvJ)`4ZbCAn)jf)V3!E|_a zo?}@RM|dg?EfYJ&gCS(~)2}yD6%3a$JBF6iCzPx2Kug}#lo8*(|1EL)wvzSqj=M`y z4{;54iZT=!&wzBAdy{2GD39?j-{)VgbjJYo!O4hvW8~m38aqOik*5EBn+!6Um3YCB zv+}{6%<2g?T5c)Xfy16E_AV4A!ETX`=ySKBBUrH12R)L_hd|$*w{{|e=dji;Oufor zB@sydPk7Wo@UK@v*bx8xU$tM9?K%q~D)>f@^6(&*V8!O}Jp5(7s)XBxKOe?!Mg8`SK6O{JvfNypGVt zgaeZ{k?{NsNV9Dsu$b8y=e#vFxuiOP@g)Jc0F#zerIl_HThck+#YO@U=#x5O_xP4~ zV48jz|EX{vyH9VhCv*n{s{7MJWoTxC@}k?UhkhN&)ShJXe_8opkb3P)vjjX<{>rU< zuPfj4uU?uWmOyO!o{UR_;DjD-3Xc`Ar1w>_FTHRT6+M&=z_MEh6X*7!hu^9kVR-rL zC%N$%g+~pn`XlOoESKRN#($#xJ}q>TQz{j7TlIG(L-Mhv^x;hB&KB>000AX z6oInYKAcvLJee)%e>GQXr_GG>Sy_2%p<+d=N_S&+MI8PdXbuw^4ojoKfP&tw6ScSW zsUcuSmTHcliFPpTDNR@6K6$0-Dlq&Jy2lai{QrsHePE3ybe&7dalR_7%VFYH<7Odk z18Ej^IktlHuq&f5%z|W97RM%O`IC2`yPEPc=3c>Q1yoEq=%88!eh-$#roMZIe0bmo z^|3{fD3JC*UK6I^+w+ui7CAF&m+dY~-j|0_iGoin?kApCF3P7XZCzzeLwfjlnt^;E zQ+lfS3jq-76fFu|5vygVR+R<=c$g4n=%)@0>?_aAb>^>X#ae7>)}OS9VL5F!UO&Ya3Zez1#jwiHe0D-&ZyIk}KlfWnp*XMq z^3-{DrTI^3k=)Eg0zfV^ApJsU9o)8fpJdJ91N-zmOPYWA#cyZDov*^;ISpXDlktg?uzLWbxIeh<7 z;}|{vA*gDZ2PidToHRCqc@4BZ(aZ zD&CKMJs5isJH6}jFFh*+;sd*3v4NBde13oCqPku&^y|J2-D2o--`?GcT^*7v8u{OJ z&&@@%@n5P;X(Y$7tO&R(=_RnyyK-a*Uf z;qcACGTr8>MPyKXENN&0&zFcAhHQECz48-EvkTMNcktRAAD{88xEfE+yoh! zsMZ{#k04(~NdlK4jF3jkClcq+^i|z_(VUm$7De2|%TAwV(0rfDwugBHXZQ31%M#U# zLtj1!2N3N5*2Sq^(A%Q`KcC5DoP|={b&JAd5r(;ESA^aL2z#HMI2rlO6JD?Qd&Zxh zza#Urn?IU9_kHt*mxieAutO>3Nrmr%DV}rvjg4)uj+W4@nofPqpKd2$Ex^42G8`%G zU-k}EKVC^^d(_X&Q!iIf8u5JHf%3lzcw7D{7JfP%LBokX+gM838qNq;iZv=HX!Sd8 z48J|e?sPjGFnZfNSQ+ZS9v}aEwgx4^^h(!ka#*v(kRcgb=l$|cYN+v?wB%}uo$eh4 zFQ4|9b`{B5m%qQ0lRKf~*j;N#pUro;FaP{89cJdgXt7QKp==zCJ$JKmpy+TCK; z>Cx#@hr`gtD3!dMo8{|V+GP%OUKmQ*=lyqDnxBCPSEBHzZ7zIOHmw!${A4AQJnkqu zLrSDhZWtkUud4@r##ej-TOb%&r9=!@VcZ#&nm)6{R*zKyu-QQy)Oe!+)T(X}evE;|cag83GnZ)N=4{E3nAb}?gjAIksB0~>OmC%%Q z2~X?QKsE@g2trv8L5fRB`7sL({V+V$)@LOMf?_t?la1H_rd5kf}7I&gB0 zLkW^*j+I3a&2=&9WC#~ zEQ^WCa{0Q<;GsoKuocY_UY+$0jJ24~L+}>Y`5yOHhPWKoGKt(OP0Ce68KPO&va)6q z)wlPj9F}W7zR%E$M!!2pNt?)Ma#-bAUYhpZ+}-%hC*0||QmNP1^|&1P_`F)+ z4c%fw?}r#_K|#Sb_tO&dkwETsg~X%BX+^=c4@U!~i9;J{B{7ccx3`A{T`v>NP4*i# zU#=VVs0l)08CcMNESbUnk;M4$FDp79fGZ}Gu;In_Gy(_o+G3U3%@N;(LX|m(-0K8w z%J(qJ(QWT%is9-@3msRLev{4EAkI*1$Kz3%jU~nMolZiHmxVZb7^=)Cqn0a*uBU6^ z*JbV|Cmrf#8TDg>zEq8QEV>qVB6db7Euh|raWp{#$R54KbzBR`+LF&wssoF4wcIYx zM~vZ0%d%7Vquo73A(u`$`}H-}@Ba7pl<#Y4F|$$n{pDR3|Ch@@<38E)TBb2qjUL7wM(d9fWFM4}< zZ3>`kB9>u(QKSE@ld*W@dB#MSWD5(!?a*;PW6O#i;qwfp)TX6`>me=yj24EO zOl5UFQutjxbv=&>laPqm=7q8+!yv`=5@sN82JorER*Og~CNOl{=Vj0R$p1izsudtI zj#zFeh7|y((es0lA(8UOC^{U7jd+ite-IpxU{pve8pn}W9#ytaL5&K+#4h`pmzwR^Uacx>z}nP4tOV>vKD<*Eq~hv@GR2=l4cv zVliArvO?0m-7hA@2bZ0Et}{Y|fdrE{dGtOBgF-R#InE@GI0D*18DxQsP zg(3{g^|M$ES|ZEH^Kz9YGL&MMz<2r|p z{9kTbT9(V8DQX2;VEyU-v?QIR(wq@v3rtOrV}(OTN#{y{OQ29Tz*-tLOQ&bfM>#aBQ;}ThlCA zPI>z?R4pa@R+pznv=nB8R=0}ct}gyi&V^l6OI%M=hlVouyfX=787BFH&WpjozT!zG zdb&Ppam;fPe%Jd==;2)2;-X@!B69EN_$Vu8az0lc=ExcceYZ2xF@_PlDl!4zJ%M;% z>#0v!ZMSo&WZ)B+Juq)iccO{(&2%NUq6Y8NE^+9f71l>rw;O@i7CLYK)?BJ< zo-VhWy%zO-+YQ>7 zaf-LXkHd{0^_^JVp=d=8>SvGILGwYL-phzX?(dnla|zR1@pMh!feDrCm0|g`JU%Cn zOA*Jq184r$vm(N8S4NZA#k3>)9p2Zg(PR5{{U;j@51T8qINHpZ7}Evbjp#aZFa*Gpl`g}>6-esm)f9~*eus^0JX}{eI9ZR9}Zi8T+uh)77V86mYze5h7VmyjQXt$E9 zkS%gj!XJPw#}PH;AdU%5OMCdPK=!4eGj6v9vOxTe&d;w%D`#qU4jVec(YG@n02Yzz zP)qQ6tr>E&U%Ptpe^_Jozx8ok4r!jHCT53{YIya>@@$EWfK4UElmGrPy3ZVOySjy4duqudP(LLXkF`> zBk`|8*G>Y<@*60++TRaPuis+p%PFZ^=GpwPJbu44o5+4`r;T1^$op$!Bd6$aXQvRU zy%(5@0;yK`b9~b(t8NE_R5fsNVn3t0)L^H*?#%phHjo!+zq>q7O?`ZOw$x;C{dm2v z)NwhuLc(ods!>}ow4R-jvEJmgArGadrp6SWUgP|=xMo$x#wM`oy>Pl((^gg%h0gxF zB~0?m?as*3(nHnD;bJU>=YH?QHAz#Y(R3mf74y+*kFm%+usCTP?dWE3Kz-uD@h&pR=?Aj(ozDy$LB<4zfP+GXT6Gk3FtUdowzNV zk;nT>^F0zj=iR-f7U-X+#k_PRO;)xn5x?j0C{JzXsq^dm9z`(K?z8#ZW$IM$YI3)- zveGJN={-JO)gnI<61T&u&(`yJ4UW}9Y)r*x{SV*~Aj%P%$Mr;_w&m5$${o3|%T`6x zx}V3&!4ewu4r?_1JBL=Tk5-e0D_wSrE!&Hj?Y@4e3t2aVKXKhcX5Iw+81K{XI^1uZPOkCzi(bZY(Wt|1Mqjr){)flpXcP^f{61c6b_D_Mo2+ z=#3pk<^x0`IRA9G2pX&z`Rpx0ZpR$)Q1d?$iq$IhizHo-#&EXd8MW0w?Xif6TiQdkv`aFYpr{mb3uR|-8EIW0{Q zs?GKV`2An?|DW@eL4z5oJ)~E)cG;yeWh|xY%at-ni*UU z22Djz5BvU5#3;>n5%qrgr#!)vS8LkrdNv-U)$MdSuk+LK2}HAO5861)2xph9&>CaF zvqRsz4)(tnPq66lUCWv`_wn(0-1E_PZ=fzK(rrjyR0qKBo16HZL2-dJ9#8E23@-cS zYRBe;pbv~!VX_IDWef42n|WCMwjV7f904=Nck6L>(qW6-=vL{9<#gL z*h=3G-ekDhukf|!GgdK|f9_Dy7~*nj{jx1(rF{1+X4b4mrrRRd;QHBSiXXg=6hBOd z33HLIw;c(RRdnZK(RN8Gva;MiVsA)SeP38t$K$uP_c!Ljb}H$xbgWQvUBpV-;=D1& zo6FP-e+99%wauIR@0Qmz?=Ri7jP`U)4DE!;kWH64RE4Q|s26W>L7$&&c$lz@K}gYL z9KQYxIf=j7Y35PKS+J5 z=!=B9lLoLC`zXN(g z;4}YL5!%naGi>7#s&^4rZ7wf9kEauAQqlQYSiF4N-o?s0UqWDz^zMT(HV;-D?RbDz z8y^nb)hAh|Ijoh$A!Txp>*3$YA2XyDKMU}udfVW_7Ud7ivU+Y09?h2x4G#8yjE-^8 z?f9w*jkJqhw+-8LN-uv>gjZM_ZQj1$gr>+@Sz^?SXlsYNyz6clX>nJ|{5g4c?te}} z!foX^ISB=YN#Nmd@x0N$=hox1pQd3j&yPX`2Gf^g+T6Et%ipgI0qqX}DzX->5v5tv} z>3>sZBQ^KcaP;f6QBvaFrKAMt5x6W<$ zpgWJ-ug+#x&u%vV3_|vznTXdC-r9>79!oyPU{Fw|{Y?jIiPm&dKqe-R&Fl3_1uFgwIg*`q# zZFp>NhN2M+F2q8aL9x5hjd*U*vJZao7q@AbKe)g3`KMUg54`O>7-b9jdL1WY%xesk zUIqa4bYOoB4K|)Hv+kkQB;y%&1f&TR6&Dv56=nM#p)qQ?zP@52@tW*cS63UCpPn9; zYL#_#bU@V-My?jXef$Euq``yGE#c|Au7%ye)NiL%NkpWx^yTFDR)O^G$@2Q*ibKWC z`cN2J{BUs;eQGp>XTP|}DqflPdLSl4yC1#B>)VY|aF!k4dOPd4*Q?#iGyDCpb=#z@ zRo7O^)e#g1o39tY@-XbAYHhu4k4_p&OM9{CvVKsy&m^^A*lCjru=&|=wfUI6K5Bea z{IxdiyL$n}f=!PGL(@XT#t8`5SX>{E(ntu38D9>Iw!Y^%x@zC=YHxJ5s&ugU{WOiL zgnV}(214AjLxYxz@p${rHUYcK>qzcCz2~;PiUc z<$E>qf@H|M8D(m|8#mwj_~&5c@+PAxwvxziYmqtVWY*|;JKGVb+@+t|b&Yc&$o%bf z2&%B!9AD*S6TTJc;-MG6wpexD&+TV(jFTlDL7feS-#rywdLf<}x+o+px&c%8s{hu& zTb6gMmL{)Q=xrP)76M85)~`^MIP&*fjKg|;o^$WGtR70QDB}a;t;N4KBa~0Af(-g} zmzGS`g()jY+E zT*itBL_i+={daGtq3dbo&D-_Hxxuu_ajDjJH$4YB6yG0u?Pqe-yUW;?hUDe#-OBIx zcbg(QhuHh1W=JXf4GJ|*be)&pqGMFt&!h-x9}d5sy*(UDeOf5OJYQLvUTU*+{Y%H( z?sN0l;Pm#8gK_6hr_1+c>rYgd_d}Wg^Gy zL3<-;U7oD6a5a$!u~htpOrYB>-Q9Z{Sf4{mlxiq#d+O(}owYN1`T$#PsW!H_<>)JvE32^y@ z;fL7HClDYmU2Y*swHPACK@|`X$=O%{{fSA05$3&6C`#G;Olc)S;Jrt}| zfdpTYbql9Up3Kgpr^Y9_k6a{Lz4xpv&>I7g`3^zxU_CCfjuet zGIA*oC*BwAyY@>=Gt-5DS*e_mR0+pr_vq&P_nyx6Pw@z#R*yrehB~|IuJAnb{xSe* zI;XYj=Vp(Gqxs|U10q5>{>LY;wy3lZA8mc98Gqc*l}22;?0b3faXaepH|M|Yjjyf- zLDQa-%5vT|#paAc96}3#b3= z<_=mMEQAuqhKDYS|MP8j8Hk|~+R}rO(iC@d?VB|4 zMqDgcLMcN2h@T789Kzj;h9nS*gTx9Y1_{1nfO+r65%Kdu@EHWQ>_CB1uc}-L0edl! z;XDpjM!$DM7@&0VI7v>rkJ^OACwnomyv|wD7UvwzRP#Kh0U$B#3F1tq+KFKe4W1h8P`5vm+Tr_U>=3KD}mZ3ndm;$<5F+3)t z@oe;Ahql=;oYf}+>Dcz``_8rC4uH2tu+0bMd0FQ()CzdM} zfy*Fb&3YeUjkIiw{Nes>$-7RNxAJ)M+I_Nx8 zGCjfLVlXuHk)Zde%^R3PCF8^6;Nf8~$=&N2Zx>vsC@12qO7gzaWH!I|>wTKKc zrt5_z{oNQ5PnrrkCxuw8LIf9&V1YRAGm+0moysed%n37**-t3ho>t=m4u!Ry^qvmL z-OI$2TzMeI8dfj^-iqNuI?Mxf8eG>&R6;;gY+*L^;9)BaI5DCK@DdE=Of3_L7Yl{T zTnSvlBo8|8K&ugd2T;J`gf*^g?Q(zCQak60zsE2WF*Yrs1kuaC>juK%I-|$+C{VFT z94#==(6fqz@d88(6Nu*kRI~spU=5hPt^`<`yfj{zL%uPE1;C}WRL3?83Qq&V!xx?P zhrytW8G}m`V0Iv-n6N#=K?&O!;*ZLQgaZuQ_I=ohgoRSmI94}<*}hM=C;S&lT6SL! zldVQcCIl#UqN9Kq(7nBGU~umF9nDY?ViFM8O#GWaU_xaCuES`^dM#=5Wuu0~r#l4D z-7S%Owi*W%#gK5n1E+U8)P0s($$=yMRCN#mIIxap8eu=;57s?&paKS@pEQ^c{2^0>GpJjL zdlncu?j2yJJ3;;dD+-)eQ?^%x3c?2w!dXHfd;Otq(qI~QD)@ai&A9mVS{L+wWKD1Y z0Avb-#h0ZsCL2Rqc!Eodi*6{uk*vxt%2F}UmKv(Ub3O`G;dSza0h+->$(3rE%=Uod zd+aekS)x2lSVON3%{U07Qn3RZsSx*Qh-k38B$07BP}vK;dF!eJz&t;u`KiJnY&fLi z)ZNA)Y?#oqIc}tnJ*Jcrc(;|r)+ER~UWRob{9rya6Vos($xs$u&N>{F=%Wf%&5#M8 zxU-Uq4c;I!V$tXqAUw9VZ=f;`!ngg0^QAZjV}(L|xjj7GC3wj7afQBX>Pln1NqTd$`AAm)*m$|L9gpZjLeXq4f?D&lH3a zLKqWmg1%j{mnGdqHv!2*C&MPpNE4+_8!#ru7+l{EDXCG+KLN{tL(zT$yQ@A)h;v0A@@rH5bL(7Y~3G@VtVO>#C>6{R5-4XLG=AaSE-NO%pJ3t zB^D;TDPlY_LDsuK;CM?rJ#I*AO09Yc$X)yt0l5Q85~Tii6#IxS|e{k@ku3Bk4;(u+NoDgC?tbEp2R4{r;bH9uhVS7#G<4H zp#Z>mJ|v*F)U27|VJ@1eKM70M-GdYsoNFPS>GH|U6l6-Jk)^s1(3)2&7SA2U648vH z4*`lfuS*+O9MrFbR*Up7(IjOMf{|-N((YPtic#6AVbF!DNYDdVG^kB&Aka{jYbcQ_ z5<+NVX{lPV_UU&7*fml~uxg-W{iy_?LL{mc2p13rgw%8mS{JDn5Ty}ejRS*gkpo9- z&ChO4(^^pZN;)^4c2g8-$lcJ7QDEKQDhBIqJ4D<-s^ahfn11wL${-u}5QaHlMzqb` zWqk^)ad=!#LME4WQxvLHT@7ibqy-&}*tSj<81u-IqOehR1Y12Km|9l{7=JTPd?6rv zKVi>1%ObfDrZFZd9*WTe!IYoazlPb_qgWm9>DR6a42t`XrXHh6zQtoYQnlGQ2BdxS zCk1Gf61gwbvAR(G1E5ImdA{>{AiLmmt&5MhDvin}E71r6VZ6wAX@k;Gcmb9t?4@4I zG$nf>=tY6i(Iu_5xHOt=H2r{9lg2dZDaJ7c6Rn>p+P*5L_mHo|zsn;}k@!I}@Ssh* z8*~vc7!i>)!$!h9j}1GJOp`Xocu_InCYQmJ2q2q8Q*K#O>(u6}4ni&^!s=JGSVLCX z`>F}ljgFT!Ryj_G^0e}dv1yzgbRq^sEM}Nq9&k<^`MMuURrQaSoXkGM;6M$N5}l<&D zS0+tq;Y$3!WsVx?uqmXbES@GmW2tg4xta;rK7j$1(LE)RiwI_dCJlD-niG_VS>%TE z%#~UT$Lwm0Pop}d#u7!ARn3YI)aoo6O7UqSsK5w)pP8Vn3Y57_Pc`eoU(kyR*4Wz(;ZYOYCf{AC?OGrN6v{(_!cW^q!l5wU$p z*;|JTnH~X$oHv@Ui!bXp@_KX7&#R90w34I2?haqmdN|Ye>V;X`wyHQk|KWcT)|vt8 zCd8ePsW>Esq58oDYr@V0bvS8k`PyY`@uKtf>HSY}FK^(E5M>B^Jm33>{=N|_UGC4! z_d(e{&aw41tmIoMmHRKs>eg0&>c$24_aA4cmcOOTJbSI$?5Fuv02-n1zZX%1i`F*TG&iyE7cQ>NzG`Q}3N;smxIGe0z-d-Tj!f^;UF z{^*<_6?bp2<0l^ADnv(41DS2fpuRiKTK+E(Q^XqyAy+X;po?hcqoG!>$#fR+> zSpMeCRwmGg3~<*rIoQPlV!?r7BtWnrLRMaF&yP}su%)8EORm-+At5xRPzN@JPcl~S zoruR?B*fj|(amTCtRlHyL9*T-#wa$~vBfZ4F)}-cgj<5X+AxbEx-QFcwOcJK&;7n0Q zX|_WxZTUyhf5QBVtvBrO|7HOoUXd2M*s9T&Hf1-}3RC&+jolcA0_0DpqV~TCRgHG?<*`Ji$_LLH;Jocv1AdTed^3gav z5G?L5B^CDT^)l$;MhTJVKyW(&AqTMx23RjW0ZP^vGtFz|tSX8XcF-XaL%b!~U5?+1 zM?&D_bLanpIrR3*5BJkeq}5{V?eFQE@BOCwG%OAd2tCf0c1!(^|F=%(WkJ%{f5B~v zbUf2Sw?fNokHLhB(>fwNM5$Ok*`i>&*$7<>blGjZz)396i$)Rd3XO$AD4lTFDj(Q8*^1*r-`b$R-vQ&AeSayu3?` z!=Xz|d^rtKN@s=k6%l4}jlnP_SfL6BT{r_}I}ED!$5Fdt2!rmpO8oxRRt3_nLzx13Dq`L;~h_aj5!BBqeH zvqv}dX2;vVhqFvedf{&mO|Jv%(oNz#+xB;7Yb(WcZ?6=ci?#%(`Am_fLkkm6w`ZQG zzqZ^|aU+QVBAQG5uuko2F~$mjVQ>u0*+RI)$svNz)ICRxwlH-e1=K72lh_~k`2TV^ zBO()+apML(hc90)gntd&Y{?0)$V}IM*@syVqGvf1mqbQ|>}+yX=8d%IKH)pxsXYX8+^4zh%M?Bkr%S6ts<}scD}5SdlQ?MH`)&$FZ1{M zHYVgeaol$K`q8o6?#1S0D!l3~Tg(x9K=qHP)k`LKU987ig%R#C=Z?^*MZ%|_P}P+2 z@q&7=z_gcyqibl?nhY!PZ?((QGtSRH2-qDd&R*`i6Y)2K`?b5fd-r{c-1l6ftxiBd zfY6K=I=LvoM~Q1d-+OEB5@$-N zEjBZ%M%-AFXDFa%M$miUc+CkL#8zU%!p@15P=cz~2&nEQ!pUG=8Z>+g8oydt zX{`Mv{Hv*owZ;1_vB6Ij+Ohg}b1==G^2vegA~Y&xXplA)Jn=(9yp2izT=MtAf>z~* zj?ZmG$LtF2q+zo&)a;>@8Ax#Qj;QQr@blQiqVPD>R^xKW_+UH$M>lT~a_z$C@*%qw zkCT!^29Y%nO2yBCB=O=(ftS@;A{pcw^vM55NtnW+PkU-UX~-YCICQB6(S<> zXSfb64@d`zj{$_`&L45uwuGvV76$iV!EKNL!QEYk;O-tEf#3-?!7aGEOK_LqPH+MQcR2liXZ?M}Tr_L- z%+po1tM=Yyeb`}RKDXHsjtfE8MrfauR#WrXma+nokK%qU*NNvw7s6{KHO!=)G>ZA* zk8V)w%{_2)u^mg%B+KZ1b-RGuW2NvD+;VKCNdE@2o&@uKwHee($$_mb8emCMQmq-3 z@#!h0O=NfImGQ|A%1umUl`R}=YJQK)A(z(LcMs!+kC^C>PGzB{OwTCyk0OTy?99vu zFySFqrNwqjz-j)3bB6uDylpOZ_B!*$b7&@(K2d)4i%HEVliyvH0`IgT!l9s;xVW$K zs7Ty4*UNEKA`rj3sq`;6)QsO`^BJWEH~eoOHy+nx?+yKLPbmJLMRR|~U9@po>i(xT z@NRV>W0}YE>Gv@8>)qh{wz}XAr%5&53dW^H5+5(>^2` zjO)5RVyg);WiR4_X6kLotQh2)tN@9_UhB_OY$#E0rhIf6^&ToYMF9OIu#O8U8 zSYVOE=~(V}3>;8?!R@wECrNec0_e!mmx>M{z5dkiSVNl)i}DU+=DMqI*TvlaE^>#Y z#lXhp&1vy101ELvFf48o>48X5j$nhBV1oM@Y@_m4h=)m%;h?dJiO%bJLo>W=Zg#>5 zJiCS;@axe72klALEVOK+(VQJu8fBW{dYSTTX5@KE#X+m~H3?L*5X}Y|U_i1F9 zG9{+}b-kkEd%p~!-0tQ^i^%gDM)g&7ulb^fe1h)=QN(})$6su+g!HNemOiK_ZQF@Z z2Rc}JTpk_SO$n|FfTa;kUzg2nIJ`!tDF3Ff*TPVH3#N%^pyQ!M*}gQBC@2pPfG}sc z|K2bY_wmbTlmUM2`7ats8$4HUNkaW8+D?ZwiLxXo?%Q=nml;&rAJ^r7sXE&Aktz#$ zpsTig%MuQ}7#Lsq753-xR)TzVzTsF`N7u4QQ$-~v9uuc=AtnBe1VOPlw@`~`t;DU; zW=%~EXYl=~uJhWGn**!5+2wM1b(hVaY8hC-dgtCcA|3}YufI0b#Qpxq?6@)v-vak@5r1Y$y-y$tLwAndp*;-)6Dfw&*R?f`}8K_ z0XbwICW)sPiMJKyo7UWD;P~G8DiN2DA<43ocmy@_l8X>+3Ai=x;&bUEMMWZ zvE?~a42js~>ECFL%^#0`TEZ(}SJcM+Jtmx~avGR_nyPD+6WkZgiQeIMeN;F~g6Z_p z=W^%ZpL~ZEo704;|7}OUc_Ck&wckgNa+Aw3On5Tbr&4ia{O$kB$n(R0Q?@8TC8BFC zT`I+y-O)CM+6NnDVkC!}@pxfFOzf3Z7RClB{b_k}QUqAw$Nn0ZIdID{4yu$U$Hc1A zR!6w`_?Wp=S24rwFO}GOtW6idTW#Ww69gwHjEse_rb&J!70FaFHQh+5Aixl)GRdUK zB43wG7+Yw!vMzhR$z4#*>MC$KtIROaYxn$Daw2ipb6d6g@ocfvz1pO!w)ScbV2hhs zJ>9rb$o(6uL%BH%YG?imts7piDz9MOo|+1w8}80bZXk8p>is+2w81*p6}XehM4aXS z0AnH{A$D48Ubh>xESh)|a1&v?($o=nQ1N{*-t{y-TlD1-9zEr z@fg7w?7mPb7uV&zz2?0hQWiZm1zFz^NVC>w7Lj;dnj|JBLFSL0OK+ehj5SzW1|(iD z%Qdqk6tM#U?{74fv+Lisu3^P?=C3c4Sz?Y-=N1`VL6(mG=7>Sj}9oL1NL0KacWmTPC7f;F4=QUIM6*fVxt~CUnu3PilGZp;}b986zv+DLJ zZEm)w$EMHA*T({;&-bI3(TWr2yGygZFc$8xC_WwRRIgj16nW7Q4+fPw(tP)~qdc_T zn;DkSxe(m-pg*zg{Qn9`y4=o>R#k(p!u-a4hgGuf4(n7;A8ky7*M)-iuV5)HKK|#c zCEraSE_8qX6sW^Z55cTy3)*~6ok3~L_z$YcKiP?vFH5?8P@)eK^2=t|mu{Me8^g4l zCbSw;(v!odNqJ-9J=6tbz zaq_K~w#cW?E7h7E(LaPHFIDs%)&N9#wRkKM>%i#F97rZdWqQ;yKoJHj!y(Of^HZ4b^x}}`N*V6 ztEj*Nx8L7x-r3pNNGk5q4;%yzEB8YanX{g$fv;aAM6PbyRK>6V0t-#7YcJMjiwd(| zU!qk_yM!Otr@x!NTu?j0-uOSCGy(kQ`sbQKCOKrW+(>f=pB-RH(U@L+-^R=2>((8N zS5@r!X*GH7ye8Ksd*j3?=puE?x~6GE zsK$K(i2Tc@WgnlV))yCxOQA|9^8l-FR4(p~$X#zV@ZLCc z7`@&EzerFX_eYbcj+^+s+;fgOP>BRy^yU64dK2g{$vYYJ_A=J_`F!CK83h={Uu90p+H$y!`oOQ$Dv_OgiktK;bcUC$@Zw^*1z8b?+9t!=NkldBKmR) zYw;qB&H*%akKZL8_nT5u<1>X`m&>XGPL{&ntNWzn#iloraApObJw#kqy>4gLz{1cI zX6DL(Fe-l8*Hc992@?yvpIb2L@(b+oC?tr^EpY_H3noQanwXemq^GyJop1L8TZXfQ zJ74ej3)UA7Jw{a2M~_ZahA!I)mT4M0yqic2nBuZU0(J^{>-KL?@1FquZr?)VPBav|Lopy#fnYs>SJh6X8hl9KtA*&A{Un> z;$11r!T9?@&Nv0gdCMm%dnY$f*L474b&~VxD!a3)rhM*mbY5C^R|f!c&!e~}!3&Yx z#M~Yu8lu!!@Ein+D=XvgH*b-IAln!(+J?kg8TDh`&a z^LmnqtbR<4>Tl#moY*UC#oa$5)cVE-{NGAJ(z~JtM7Aa5BT3B(|5akD8UI7;o`eP7 zJMe!_r8SsCPqoM~2qRFTKdnppX#0|^VRnQxw4ZZPe{e&%W_S>3H9eIOnLtwPZeGOF zWE@s}`x!EfanpHpapc`nG6Mx_Q2tm%WK!+hH2#!?T-;B*NCe+O1~L`9vA9yFYt(_e zI4`3cuU$5iuY$6_?NnsE&eorINF*fQaid+d%r*zaD!mU-2YdV0Ew%d{FV7nj7^D%^ zB+ilU@JI*>H(Enih+UhAQ>u*G7kw?NcJ$R7_x7D%x32}{knK&Me@T#&tp^-jjps#< z_Fn*ONx4A*XW07uM@Y0A6uMXSverdKW*ce4z}Z_WTblLN-A48KDN|GRZ0S+r1!uC7 zebuh%mjc^fY^x6%o(%pU9`(1_O!3)5Ptm-*yoRsaoG;rp62XV_<7!n4(x{4xiiSTw zhc%>4J2lD4%4WD1O=gghQ(dU=(7>BTa#uDkTVobViI_V&a-30X%?0{XKd$bJ3-F5V zp)z9c?7ua+7T1+2%XE?u!so!{{^qdIRe`hHq=&kdg!gJ#Fqn9f(1 zf{N<(LEzPDGQVvshQZXtM9lj}D@BMmntZf4Q>Ca>ugXfMAd>5Yt69{S5T|WW;%~dy z>FH_XHYh2xa0Rq(>Ek@5V%eOO4M%Os(Zx2t2f7__+Zt=4ueH9RqYWZN9HS%y)%yGQ$$Hy~3!+5Z zfwj+`fzm$3T2}NO|M}D9+H<=LLDeGiwAnD5h0?ktn4vM0PzpjD3eCKZHS0eXcK z?-XpcpYGf#Dwww4KXU$O@W*(fY+Yk*t=q|7?2q+fSX5M4ymMHD z_9j=4ZG{6_C^b{u_2QwzaK&gZ60QSa_O~o40-eSAjeX}yQ&?uEadXG-wdvkO|#d!$$*#M!f5CA`v=WQapm!`bht+A(Uhij zp^JG#=P`%1O13g4)ofokpPgwKN6|z^mY6@fD^~aB=H^{r5&=f8px^cm!2Ep!Tk?BZ zE$I}NDPA{9&sc2tK05`FUf1P>2m(Uj^YuXA;@uQvBVq|)4VxBQ-vb{b>h{}l>&gTk znFg5#2Ib=4h&|k_ILF6fcU{dWVl+APhLMheWR&3;T--$DMT>FGEoty*OYO$PQEO-X zO$pz(tszH;4i5tlF<){{=iD*PBuO-=lHvRJT<*7zb;TU%IOb3tz~aOVG4RejhNXQF z{4cij6@@>IZ#<1V`%?$aPJMo5U1{oioQPM+NY`|$e@U^+ic4s%i$Xz`JYRUdnH-d( zmiToMA(NGk>Ua=tw@U+oT9v9V+Qu~PIh%I+y#K;K~v$9@yL&R_A@1bU$4W~(05M41A_LT?^ zBm3Bfu-nz*-+TLOzt?UE@rZ?IP2fwf(MC5!XO!;~W}jMG8XhXWTK~*URQ8k4dB^P$ zjjTK=rQjV&@M)t`Ix8B1MVWE^^6t*g@1Y@7SZr+UZ}M^Zr!jXFIh2d`6w|CWx4qSf zh`MR@bdRX~;`k)F`u#K&6$y%JdyDn(G z@i{TKr>BK270Nl*xZJ-vHPo#pL5B__yJ&9=xV$O6taF?#4|aj>PjG0a+tUKx5bW=O z)`hJ@v+K!Gp_jRcx2Os6i6V)O^Y{iSDQQ+(#(JIitxH{FyU*iTOI;JOld8kIQQ4f@ zvZg8}DLEye{OJt#XkOabk6QY`@!hXO-2ZT9byw(X+G4%0+wt$Qu|`>wHXd)=o9&hr zw$VTN-w~dl$3Ghym^24C1_d}=oXa&Cckz2W-8{`)7*s4t@QCs>_|`>=_+DJCCfma% z0V5E(hsP?D4mZ!BAn0J+;rUj&KxLMQgums>{ATy&-QvOGfnL$9uz+Uc?|HGxXsJE|CcM&*0kSK^*% zPq#sumEPsIb7GnRxFc)`HR}Lmq#ZR5Z(1PF1Oe6|M-91`sc(%9TRJQU$9j7|5hIm9 z4J&d6UmtHQc3QX2n%GuUwqGr$kFq&3n|ApfVsLhH1z+x!{IUVU2vBgYbxow3A=I#_ zPtr^el?wzHg|POVo-XU07z5zeeNs%<{wB&j67wg}wD(#FwIRpS%gJneLq(p>j4-r| z5cV9{B6_{UyGrT;9~Psm6toplv@pMnG#6MQ#Pu7cjw##E&Tck5k|~?-VUS$8YWZcG zIzZnJ!8hw{rNicU??WE>eGJdSg6`w9#GS&@De6LW@wIHejaH$)n(x_hLlD6vqSg|#8hiNAaiYvv&65(sYq*+EQa&K0wbpJ=u}$lltM4vXc~NXQCp&yEepjx=2cJifgme3EEpOZTLr2G!W&sJF z_#ux(SN#J}n})5FZ9ER1nRL2&`q{1giMQFGG<_?D`B^xuTm%VuPb9IqKw*m2r)vHzD;tN^MB>ohP&2UaN;b{ybxJS1)D};AuR#3W(Qzh3 z{8EU}x}Kf#QHG9p8vt#({lorE5xo5&y11SK3#5;71Q0>gRDdKhOC4I0%5xmq=4OlBj{1+tro5MD~l; zB4)f(IPY6CbOXXtppzl^vaTrca_DAg9Qbd#1HiP^sl3B!?e^iggf4L?$Q0W1DOzwA zcCvl!EH?k+|77FilzAoC0i$#3(5!ngvK%{c_w)g#NPCqD)JNbY>Uuen$Q08Qd00=Z zXv@k>%UI;UZ@C%y`m01N{*?O78;wQ+cU>TLwAi0j&R_H%JGVF3oP{bYB8N}^9~U5f zU|at6rXsAW{Uti8go7@hu2WhB`g8gH$1AMe^gbcvZcL4C5TAv|aqP7Mho0(O^_xgM zab9iw++vzyZhuZ<1wpvxS=)Wzafme;PbGc=EP{hP$pTZ{eE>h7n<4`h5n0n`5cxPM zGlQ45S|7DfoR^u`-<-FiedJwIVre}NwK6P|EL^hhePr)gsS$&O$RIuB9Y!g!v?RR@ zp|m+T^&WS0tc5mw)rK5h{dzr2t(04RSL9>qSb0yHP$~T0Vu>9l&}v{7ju_3n{6yM4 zp(M@aB`YICY{?~+wf}yJG4fIfMC&$z7X|ZEg_7q-`6OslR7hpcPL8`nJ`Um5tY@bEi5p3q^wWeAR`*dx0iO2eZxo`1 zQe@3L>#Z>nK5afYG*~T2M&U?b>K&~fXyjA77E522S!wRbKqNyV_v1%g8eaGHJ@&48CM4Y zpQNwPcQrQ`Sbv;9%50cFB(P~bS>)xKveJlsZ(=V9_&pd`7nkKWi%WFbjzV<^G-!~N zl!>gM8oqDSka(kLOSM^%JRLiW$y36}O4%K9>G#`H6|T+pL0B|`sbp%SyvRfKwXz}b zQV!s6M~~=6YGuMpGBQ#jr9Zx7YRB?nt@|G@L(JBYVwE5=YuK$kyl~qft0|3)c)LDX z$SsAs4s2S`Y;8JpC=In*bkg!26Fh_-fhC63I(#@v?Hz*`A~b@fmK_1)Le!xC+!bfV zN2;w(0nf~f%4G=!sqjc^*MABreS#}v4ehXmAB%y(kV2|)&3-Cas4?Z(IpU^q!%1<= zlKL_s6A*{Y{T}NRf*bspj40zhWBCo5;A2L!oPaEgNV_lA-73j$iB}CmjMyIoMf7k- z>Y+v=gWkFqXYk%ASdAW zv{1UBMnu+&uuWVJZB7BrrwwtBoxi(^fq}6fz1(hQ^y;|lEdQP~1=s3~nYOfWElM<7 z&+fHg*jV<>A98S6M(I{fR8$bpY8u8<0={;pL51B0hIJf>=cE z$yqtFeV>aB zr*YYuf+R{53Q1{<{^^8?TE$!A+ALj+9Bt-MI0fzcI9g-|Vz1KDH684qQi!~kN5+bX z(FZ0_WT`3!fW8KVukUn7)eHdVch()5n~slK+g< zyDxG3ba(LYV#bc_7ocLO^WXTRTe(I`Mdkl;7#3@={+D90!)9a3rOSp#uL!lQ%pL&& zq3hM(lwFwPQ}9E}zJRI;=ZA(K5d{h~NO>(n!;LNI!=Pp-=LN)!GJecnvP9f|r zbMutorPAiJ2{p&L;U+Mq^?7}Mw`NWNFtZUgLZVt-s~Pp{IQ=a)*2nzkm)%YMdd6sb z=q;I^{k^`)n)?Cm3L7)(g&KFXjz72BaS{;5o8Gi^ZGe25O zlrvU^yLwn10QTEeHXRb6wXw0#|gRsjnk*@PjX zSa`|Nn9T}#bxum@l4uU-+G!}j(mhZmlY#EpohOduwq%~aR8_Y3L1xBT@Ds%n3@elV z*aUmb+fCH}@w=>Rm+Kqhlg(#(B>u!^&W^T7*!5mz8K$o_GPgF|6Snq~aK>e+%wPGf zZg%ijFkeWdOkYh}jSxN!t!6}|mimcyfCQ-l!(NxWZLF3ot~L<`OSZPKAlG5BIw$`w3gMEhIrox2c5jU8 zd(81yiPOsg@c?Q}LbxvTERp}EYSk2+)?cd>u2cR+P5~E+3wl`p{1f#lXzS;V z?Yp7Ll|e-b7i+G##l4!Czdf%RK+FC@KLcv|4FJTy0_!dWG(<0=Ken-XsuxLGq1v6rwRlAbyQ$ zm18(RmUH;X6PbB3eE%LyM*tX5_E}vmB^+P_|4p1|&LfDLOc*z`csok%!-VLDS zHXx3XYT2g5RKj%N0CDRxd_OURip*g>c@ zKVH7WkU(7c--#&DVEj5UXkEtmYm!n@y;YH;#3rtopvn|n84v^w5fQA0E@KZ%OXNVH zse?FHFqqNw>@tMJ`bM&;+C`o@aCWfe>r}vMfd{#uEc6e?kl+ zL9;2xLw|6z=gXnQ9d z6yoEbBEZdL&fGAK6E`RJCPd=mCL;0B;9)>5WFza=wLmH47%%E(5~B@focrDXw( zT7m1|%5K&>1aA$typ5A|wdad`gwz$80szNjR_Y~GFn z2Skc61_IKG5-PS5HZz0Jn?+%whjHOV^z*A@!(wm1te+AN@HtxP5SR=O{`Z?~e7IBT z5A0_#)cN`*)SL*OSlYxyFFnf`X2Qu{QSp}h8;KP~y0BsT=k(eR{g2515b5Zut*j7o zLgCbKwJ@-l=%0A|E4GRa2!3Q9hnBsu0O^6bxZvDovL&Q}Bc+kgO|wPfawejI#wyKd z563_YABOu0hR6yvgR%(nZ$0%st)3Ka^*DOM2F07KG_d9%Z}nS2XT?5ZL4zy8}h~L#ucSv>~5^q+bdeTU`yp3YWh(ScG$Yy5hb$c)2a{<~q z?TUgP!DnpFBEw6hbcN+_pN%UNSR`~1PIu66^-}h9KN6RPiV8U5`Ka%Lteo)MqNSsQPwfLJ@rU$=cZK=OE)k- zch9pD_)db&(YmmyV+}wcME1-wBR=#{)c4jk$}-HS#h{%e94W2(8YvL^*59(^iYZ@v zUJx7_7eXf*)=enI2$(bTvkD(I< z9n7qpW8;&Yyt*T9v@pZzg6&cyIl+bR#UoAC=~hPK0rKp zZ>%LTF){4R8}W;YHnC^vl_qB?WLmlc*(8mTuMGpVdQysJAu%$LclZSuf9tzv$P=XG z5iQIAW$eQ(EN7JE`Fk3hJS$p(LL$qgax|$|SvVHsPto#{4(Lxxjnvs7^QbqNp!&q+ z{mzxuI*eYiPkpk`9My|>mz9qdaNVSu$uP0WGLzbdo9`!iDla8(8g&%9Mo0V>1ibn7 z);aAtcRIV)y&oUfzn7l=Y}MBu>N-1BbKn0X=p~}SvQ}4SVtF!KKhIj2^J4*F`k4e& zdPHQ;f!9KTeJk1%K8aQNT`M_k&RZzXvVxDdt#j*2^A?-Rr3k*VRMO>W+J9rvU_aIW zai-%B0=@Am?>-%k9i1lb_fUmi6E_0{FI#LQ0tAo(5<4m!9{ne7aG_Ps2&qcA z6sYy#Yo3Na9BLw-CE(KQb3JxVZIl+kt>ZpZG(`^IqazQI_$R7nH6p8O+Id~R74ggP zwVk8xeF7-yuLhcBEv8Ddg!fw(P(m6eEj+v-@}X8XI;d2!#Pl}imTL7bfA@!9_oi9dW~2oeaL#jRmLWH%+FuV##+%|y>*))*PJ;+Z$F zB!!r?_}yPU?kA_lo!m|B^*qS(35jX5>sc7b^?soiuD8|<9>K9tG;DM@v~yz+IDryj8}u@p`>4PV3BcC7a8H)FCVh>yZEj^1ncuPqa-i7e;@zAbNX@^4bS4$?7% zr>;UR?#S@>q@->NJZaF4R|`~{lS7~wSUJM-sL)oJTfK~*FcJIl{R#w8Un zC&f?P_ni~jyK$4s)a=>(%-Q;=fx6|?e2mbLnox`*p4wcgr%l;x-sefb=wm;!Tf6To z6=_jJirCX(Om5dsRNkOYh$Oiw%XE8eoFD3cczU9K8wc`sO!%iS)i*XzBvaj(r)BYz zi`^istnAoaC{7s_VlWCu)qpv$4#}%>OIj^nX5bJK5P;-!qhjxdBqTw4K!YNb=Fi2| ziDqgg70ZP(URoqXVHh#8_j9ct_7U%R1r>)mp|X-GOkY`b?DWI!_3vZG_)>BNH_M~o z%=F}cZE)JkvIC?t{M^1$EnCL|q~+cV1udZ*=Ln!Y3>VO~KLP=7S2YKRO^HeiM}ium3|L znq%nX71XsJE%h)c6LeV-RPW)~5NLcl;Fo79OqwTeicHm@9XZ1EDZ0X#ql5ID=hEh{ z-y&};SeQDl46-bUO}YoK{XVrI-WIGh5X?O7{vdKY@K0A&t6@j?{egjGKblZ8+$!B- zKtR3oQ3XJ+f!C)SKR^pL;PLp;XuakkDitD+C#c+5%yToCu zRzE*)hYdc#cA?A(C{HP6O_3V9twmU5-&JBKDAK-;$;?))Q@G3TE%h4z*TO4?@3E5j zJat6|1&i;dI_z%`x)+o4FEIq>6&D!yI6dl5Di(xfBIMO<-DV8&Pd6v9x5juuAm(s- zc;pH`+C{+>_tEyie(YUo>`XoBsPa!nOQ8C?Hg`@i~FOQR-usbgvP5m#*R713g zq9Z${vy@wJos(s}|0{z>L!4yIK?w>iq-TID8xA(+{!thgd(ucmgXb@<%H)&7L&+Wv z4vv=3ehk|7ijT3!0)G|q_Lc@MyJqzkqg#pS~h{&&~zR*aS;{8bY|Dx z@gu?j;cv&6h}g6UFe(Tf_s74gxDie}8P4f0m#c2y_cUx)1e`a&?1@7Xed<9l_ocAG ztI=ZPcI{T>X4b$`nGvJew7{?TOn5F%w=BwiL&W;~G1>&h?pvmx27EC0k8YjFS^MX* zW>S3a3Kd$xS9Y}1Koz#YJ#@&bHYkW(}aM%9LK_d5wGhH+5!LbyJsI&sEgj7Rn? zvpxi&I|vaKu%mo5Y`l`FcDy{D+dV%tT!3L1+$-K2+V4gPt`xGwPIz)2GNE;m3T&zw zy#+Xbmm`awmN7^agEjj|@X5Oy3S(0JGCdkYfBy}2H%`AD)yb_k3(XTWFf}$+hsnyS zBEj59>3Ha5)UPOPm3oV|0AM3OFdiPRIygu#0Rh7oqbdUSc7{!HpVhOJSmleta$Z88 z{WTA-{9J2rIWh!Y>+>7r%w4V)mr~~AT3cI_aQcWOUZ0MB7_v=HOx&DpEUc~?v1b`J zcl4>?BmeoyT;VYmuE87;B2}w}h@XI~FCU2p$t4ED?bV|E)wbI(?!f18+|D!IK&&K< zxp3b(3^$VP@PUSg1|Zvo?~r>xKawwIy1_w`Mt8MXBO>R&&EI~=QMQ6DE&a@pthKxG zwiw{l!dhj>-q3wl@s(Cv$kg7LHF=e)JJu*_Vt3tldE?e-ja_~^-f*f@UfdZv`^`>}+PMy25i zmx?+=Av-Wm`DqXX0NZ6D=I3mS~AW`A|mc#Er!Pt+b8$^>9ci~mb%#i7sEx_K?KPaB zxX|FtKL)BIfWTU_qX>GSugct}MjR2=Q?T_Lgp=`1O@Vce6a`k&rCQsKiI>E=i0HHS z*L?U@^qF=O<_~%-gBaoOF%)ujqv%y1*ZGp)FYzny|>(;D@5%43+*Ol`hlz9y90LUv2&cj1>&IsQMAec!e4Y3I+b( zL>QlL?(&ZQYtsZ#sf8edwtOWuHN!xNRvcne0sl6o&nSIgVQ0_Afr^j1*$*15$WFA&riSrjjjIv{re_!MWZCCN^Bj1ip$In$4iHRZiQH>)dVKdHaw5_ zoEMUTy8IvnNoj$)jXrEdRNfF6NIS6egnbM7dm+ii4G*G&3jsx8GRs(P1C)6MR8`T3 zw9?O*%>gOwpioIJ1gC-w=45o|&ifmH7#R_w^z(ExSMH6ESvJeAY0&*HKvCw31pm8{ zsJ;cvlC`Da69`ee2UXi|m($NYJUsXo_JvngkRSaw#DW}rtUOlYDjcwQNu?ERZy{iH z$^ey;PS-JZHJROizflI`JH4MwU+22Ut&T)PH9+YHe_Ns@o(uDKj{c7euyh>!#QEys zlS2U`MTKa6!Gp&AQL~Q)PiBY*0>3HX-q^t<;eEQ=@+)5a+c-1~T&&#cdS-6|956_! za6J>%nE-O|H;)dQV~5{5V1yWETnEbJOU~D)k7 zXIn4}_QUUaPM~tt$ankv3(na~>VQmc)bu_$6F$j6kw8|ZXN2!;lqroH-wyYmqPWZ; ziHdi^RStkf;03(F5NlK@s0V_{4gp2CIy|R#Jy{nL>e1nbdfLdHWxp;#&Gazx!4#mr z*FWB$S&&)y&}~tZK#Dcy7jSi092<9gvyq?RuqgvvCOe-swD7UeEzI71#!Yl!$4%g{ zv@Wou;Xq&hNE(8~1;HeTB(QvO1{gtC9hzU>`2WRuwMu8L>be+V1C*D%uP3HY-Y_r- z5)CH&hL#NG`fM3=J|`gJ-|Fp5rh?RSb2PTxE6C!v0=XhPV(6SwC@1d6IC z13VyKbO%Cm#u8CRRTi-9<{}y%A`k0eiPmNk+WY`B4Uf)Ix1L(JnI*2n67%TpoK(#; zDyMd%D;N*hxv+?jhfelh2aS$FcD@?Y{|zMh5w1K9l!o;|Yu7?hqKS(OAL=e-Z^`&= z83l?e4Fcz?F^5_yS*fuwEWv-*{+0$Crn3r5O!-lffC@jQR-Od0s{Mopq2-NS1Pzix zN{k*hUTlRDV_tJq4f@bYX7UL{+cr9j?2*BJ(anPh9)9+o6Ez+OoQFw#x?R>rXk2VO&q*z0dLdg`t3_SS^P(~IAsw6+LH;L2J z_)eqhp4`$Zi8!Pvw!mt!)f_(g|HN90;U!}Lbf4Z_?|1&Rl>Pj- zsIEy@O~7%f@tU*i@`NKDnNUAeo*l1lD9L^d6Z3}3@8c^5=hMGCf2KVr)xcZoAhm_5 z$GIxeG_+65tUkgg_#lLkW6WePypXE^m@<+OvlNXBWaSbA->caW$S1T=vIMoh1H3#dVzY2C4|_KX7z4?)=PrURnyqjuiQ!Wu%SbAE zzhEtD0d5kK7W`!dQ65h<5k8)Nq)5H_E!MD7F`UFiSu->&eix(Ye{k`NOS^r>!oHpm zWHy9OgWH|(9-~rTq>^7KZQ` z1pt9#N`1h=i!n!&RiIBw0U;_PhN5@x($F{gSt3e-_Px77^C35B7C9~)T|rw_fb z0gJ%6MFpk!v$8sU&u8wXYDC+89}o7F^>K7kNhXcRx_qAp)D#~twxy)^L15;RSPpx7 z;()`a2mr;i-S;+fq{|81l0=^y4z4@fAE$MSPk_Bd|Cy=Uq_W7BMPoR3cq`dUprfhb zyO2^)>$4DjW*`_`;56;@uvRLp^}juJbhK^tInPTS#)^076nE_~GTPu-1<-#B4inUw z^IaofOq|oH!zp`eZ%Yeown#Pg7a;7MO358R3wAl`&X2d&Ffn%ww6p6S-E66eVq0Jg zzL-tDaim!9@*nJ-*@p4jjO=c2?&aoksL;W|Id}uuvH_ILh5ak$R{V}+$x^B&>HkEXC&Ru73mX(_Q7oDI{0d`9L<<&M zZT$gDM1wezzRPF6Xb%Yug+($b#Qh4;<1&kmP@}1uP<{R*(cxk5MCJi~j6>b8TdKtJ3iJTnjF@N)%L34kALo0yu|qt>sl@<9^}97MI^EC@z~EzM4WV6*(LU z7lfb2lEe%WWrXM(q-8&Jy*vl&8Fb?N{6CuBIx4C@>fb&LH3GuW4MR$&fb|_@ z%gc-c7mM~f-;y=uG9_+(EWOW)^;T^qa#S*p4|E@#braSy^X736RT!#Ia}|^@7P9fw zut2e_Ex)DK>CM{&LBqbHGw8@WWJt2G@B#k`n9*>sV16J;r5J~#_hA`FmA}?)%afS` z6$|wWc+r7~zzi5571n3@*#$=yggi=s2H2FJpMTZcIKU*H43foo9Za%6-{xrdcsbFv zzf(gWW0Ga65c9XY4o!dXFNP`YEN>F-y*JDVcC zz0NO%gcv4K3eK~=*CrEH4e`ELKBHSy3$+58h&G%7=d3QC=>dZI#V4o43a8t~*nu+Jb^^x!bg&u9hxVqB(ce@j{HqQ1 zn}uCgH}#C`pjmJ+s@<%uFV4U2kY$^$bCB{M+q{O28eGW&8O^s}Qg3^|APqfGi`3V5 z+vUge@GR8M(e2$)p0NRUd%)Vpb$1Ht;?!NFoSaZ2WWju_=Jn9ciHV7Wk{;CWeWjk3 zPm<2g2E+feW5CE{<47CSbg;0PL7tK*qUt$igs+q|YCF#5p|@mkhAdSNfZ3rzi>GL5 zX;Eu2IkXi`4!2z;C^_Q_bJwdlNxLm;=eE;b@$it_+h*Kt^*qUs6BI>twW;6VT@m$k zZexM4na2;Pj?IC&AwVw$K$2iK9b=G>+?eFwml;~d@YOEn=r`&ky9!%7iymmaiwQPixNo%8J<%$;E0{35v(#q4}}qhiWjgL*ROYf(G^(3{f|FpQlA6JSj5JDAUs`5>0~` z`A}TVTGZa0y)}L)N3x16jGrsHusWe5wHEo!lI9PpBfdi<#-wa-6ucjQoeupO%5lF3 z?l#eB53%%DQ@SS6(Hc|11a~Vavxn6qH?g$8A%q231(G;LP_J;*BmkBL{Z~|i#cWO1 zg%$LNO+%>~DUUo0W{cAF0z(5OS(sGFAQ&HT2PV1H7E`~2>sr=PfI)?}(gK$rn_BT4}IEEcfZLKbk5C5KVTAG>{3Af%R zE9#SYoRxE|P@~fIzrV-*s-B0^Zbjos`~QVG`*2i`uhmG42kfi`aknCqbY5 zeF*4Y<(oO$emiOzZLPN(^jNtPiI3S|3COQ&J?KF9X}j}$y4f10hU(ZTjxPHVI4w_6 z{yA|Qee_+MkA<>0FaBzC9JCcvB8|GC7WpA$y)iK{P#|YQMYmtGSCgbIGPqeC$&drG zFee1 zv9-S=xIpj4mQAqpafP~B46o!uK)I>c5Y60)y)N)nsM8z zb0nMT@9+P+lt4B5wo;KlR8^hkeOrFkjHA*D&lq5TH#RmFoaqhp;cvd)`}ue>kPnpn z(>1GizkSK^%J*N;k6xPU6fNuOx!l~tABS;%1X8o(b9L_a_+c0f%mP4;l-urF31 z^mm83?$!Op3RJh{(l1RT#D1NZ*#D19iYZ#QPJf_j#wkNxt^3hj%?0WloVC#AUqvd63QSa8)qOzB=-t`)n|!X5WT4T>C29{ZV(+d68Gb${{@PHKawrxmWTi-GGc`Q zW*tW2$7UU_qPn0-*-SRwTr8+O7WJDg>a;)0VwWTRZZ==Opl+l{%zXLRygphe#RQgX}^^`QzlmbWA0LnV0Eg8l9h|`Td=h!7um6-+$WOU!|x~0x%hp z7CZqmrF_VQ5D(z6R1zb@wtHOmIUUi8v@&8YB-E8DQ{);RRj(cX|6ZaLrWRwMdo(*s zNfj$T(}6eM1e_BnNsb9lFZn!ViE`D>D_RRf*cqVK$sEGEY%z}IDcGr<)jAW(fb8g5 z;cOv>y=+Ocsm4S!1y?tb5{_j7cSv#|*z@~m`-xq~ro0j@K*z*{{txlspbBk{T5l+z z8`vx)I5Rbse3}wFNJ7mBkadIE>fXNIbTz~$tU!L|g7n=qEtER2f_*DkI7PIPhF< zo1K`qa^%8Dw$R2ax@~SAxqOS2qdaZp>sY8&WqFI;%uT6YhI+zoZCNu22^ND^dc&rt zH+`i{@+=B!U;N_r+uZY$Tq^A-bM6}+9lDI&2OugcgR*uCY>Jzx4Y$(7QfN;)9WX#dmWDr9KMbW*xEd!TAiEI#vjU){XN^1E$gS%*fdcKo`1SbMnYgN^7Arau zfr{HSJsuwT5Gbo}3y8&Zbxb-Cq9I~|I23iYyiQ;YFGV%OzHCqI7Z$gWivt3JLz_|VdEL&gk>p@fu#TdDj28=?8B`de04tB`Hm^{EcjJA|3tm`^_dZn>`ak$!93T<7jfC4r z0%-nW`oHEEqxv=mIKZZ`SEs#udaPuVO}C14OFcuZtfdbL?~+=`jtRbUuN}@ zcXv1?j4{||&Q`}1rb3V)7nf1N95jRgEYbMzm{#rNHFAZ`zO_1#P_Dkg!lh}^(6%-O z=${yG{%FYS*KrP8T<^<)24HHdPV<@nx~eoaZBQ>G5@?G8&R z*%Nsoau6`4P=I734cs;ubo#P?up@S}JbrO8ZD=$=vc9L?uuI({NGT~O`X2`#>_@3S z*W0(ti(<{s!pfa(=VvA*JvLqCv@6~2$m}bUJE|NVY>f@P1020e+JsQ`pp>w1z1y9x zxsEbJ0`RS@3>~t^Ip|_p@+T=t8{VhN(WqA2*x1lh4)uoS>-W)9Ng@B@rHyqP~iA z^3_X;`{Up7UAB_Uwsgej2rVpDi}kxCu^H)v>Rbz_TCjo{psJJnQhz-5r+%#009F zno4?bYpW2!wNtW$`m7AT(-WT;QkHaACKf%mb`uxMw8L>Xs|ktHF|?aS#Vfu44i=%W zyhk!+#^MUPKVoTcGbX;GW%k7}d~VUe@qxuO29qV=zaF%X@XkLaPx8Rm6M1SsuggVy z=bTde_Y_o4_Rfwm{fvbP0!m-g$0^X25D){L`&w!*v^O|r78Z<2C-?C7ka%9zq~k1x z3=7n3@cWp;*1y;%;%5cfd6}GvdVN2KN4TcyYEhNwbV*oPPfv4duDc(tz+JAMe&*fZ z^Ng@MC5*X)7SHoKPaF)y{=~%E@QneJcs=Mgy#LCQznxE5SXdGzXs)%JjH4}S{3YzR zei}9?wp4GmfDBKKNexEJLBaqC`ef@)j_?<3JrE!3s-19&4#!zHvHCCnjo1LMt@dKj zsDcZ7l;@E&U$cD#`8Em-7$0!FJT**h+GU{95Lx~?edJ%mvLC03@!=so7n!ajyY%d| zzhs)v&L%l^mO+~H=$-#@$?pi}zqk7r0ltUWu@$ssVZYK&J&%@+;B7|WgHCLbw61?I zMkUq9MJ|t)95aedW~QfGEZjG+SDw`UBppk%>^wX?2EUjM>Tsp0Qh4LIUOYz`6koaA zPi?p$OQB{AxfYC{mJ}ndyI4F@xBQ-K%Nwa6CFV;7LJlZ+|iNzA5RgU%X$G z_4AutZf!}`b9!qi`IMA*udQOQNTC={BQ=FYj*l;0+)_)o3wX#ZTqCCr5-;AV z{VceM1mP;1TbFSKtBFZpM^%m6Grrq9IF*ZgncgiZF2hRmP7FW&hLI6L7Pd#%o4UmonyFS@wx4x^N9s`Uk$x2K(Q5v~_GOGdPc%U<3NV+IBI@ewcXgZSDJVq}bX0kgm0{;n0xnm-WZgOiwVkr|6KkD(V-gD6bIoBB1lSMk(#2 z{Vy}(Qh7#kJr0(p=jPa%AxU3fq8`qWHGKMv(3Srd|H;YYF^5&k6TJa6GUmm7LTZm} zw2X|5I91BbbQBn>pAUz~p-?H8XJ_>O-vmq548kvu=IcM+9g>@TTEAI1iwz3c*%dl< z`^HK4OSWv>(IB4I4>e04xgq+YzV!Z(vfiZ_LwmCr*R&-cnisFcm`{a_-xz5?4z`3q3u(0aW2dGPt_C`$_p4 zr!#$)%GkgFw@XWZB$^rhpH0~PUi;(T)4bz#xeJ{wkJr2vi~nU9s%hWy`dejlp3IRbX+xQy($m@ihx38KSN?g@=+77 z?F*(CQr9pW*G;XRS?Zs3;cmvo{@5rLAl+ed&`nZ*!$SR_k!&ie42cZ&SHmq>beKXAEzX^0wba?)PmG2FdEU zV>``%uYHF4On%&4?Ekkl9cT{I#BrsK_kRu-li{#7A7ry)%{e&Oi(h|*^ZQG9Dr$Xr zuE{fACm#?Ko8NQ&h+26xsE?Jpy|zF{5Bc~pV+)A|>|uBQ?Nef%8JnCNM^3z&T5(P% zCr@2y@oB%g3(zo0dyCopwP^b6zD~BZrQrz$&~jy^Rnp;hq+ODf%u)!?q{@`2$XtM@ zbE5(p)HJ);^_-k#MF#cKm$U1wt&%&*CM&Zq`5M`iM!a%Ssl{E}J;VS0OC@SMPx-;$kRcwvS|g?l$UX)Zkg~=_!19;aTy6G#J_%uo8q)*}rV4V+ejh z5fpZc`djK<*XU>!S)UeYI z)O*%iYwf&>E7n42tc;B<%*^Plz*0kDP$ocdPHgo~m8QpxCu!-WfV@016N);TH}$4o z9!edQhC9^PRMeHQ>!GgAxM1?|rUF)TQDru7vVp;Z&)seH90|110XyaVBj8CQu6CW% zBPmVBW_a+fqXYL-OEX*yjyd>Pu<9sYUsB_*qHW;!qqMB3wXNz0%ClZoP^CX4Qv33X z01wOmdsS6wOU=^!E4`Huf5(0=cpjCHPTNQ}CHG zaC3l`=qQVpEs;0&Wnh}R_XI9UgV-baiAYQ&JhvjGuQla&bmSJa+n*Fs+)90m-XxGJ zO)yZJ%urP4kz$LcZx^4z9+mPLHhzzSGf6-82Ryd4O9z~ocN<2<;DdH{>g(fBL>DB| zI{cfVp-r`F?XO1P{eR;pC-$+=hld?2Fn}-R#kE}AL8*52RPrG&sHn9aTOAD=E@>7Q z-E12z0_>NNF!$TVZ*NpEtZ`KVWdMW=gM~7at8hM5Vh83bc&qiKh58fYD|%zoa5*TP`JiuUEN?ez$#v=HW8gO+P)QRE-(63ZEx;OqT;>lY2^>OAA8y}USX>Dn(;7?kv^L*-5%%h-P z`aF1h>Tg9weAx4*0RfhG+aCRCMC}|WTV(m?=mGaq!ZIlDoAG_u&BqV#JW-~yPzrS4 zyPuESwqmi&QH32p5!@eQrm9BBrj&>9Ibc6~``X3XB+c>?PwOv;6 zyI6VR-q9g$AzGO`i;suZa4qVl0b1ZK%g=3LfRsP*I?as{{X1S1Yox z11?X?&IY%3z6ShUwoqTc=+Bb&J$$k97~Sshe&9wGkk=A`8l-~I(AEWp4BJnJo?32^ z(!%MW5JS7&r3dK;@!4AHP-|Fu^6ykUJcl665L1lkKwusYpaY>DvSQ+R0#FKf%^^0~ z0-%El;*hU}r=^4QNf3$)n7Vs^#Q?x$LKzeYLM|popN;Q^j8F&@6PO|6*%%bpv4Y!JfKMy>J2_kztoq znj4s+r`OUBh(t>WW5$e85MX$-A-=$y?MH+LfX4tJ34=Th5o(%%rjG_DXKT@7ve?UK}D&f)b<02p|As~fFz!n9;G1ma4e26B; zN28dv!B9X?;m9dGb;l40X4WH3gfyML(r?;6tXBlA4cHgr0?V_-aDp%hfdoK7)B6hy z=(bFdsjOsUWQS-PBy{xg2UdQgc=G`j&Y%lPaAFVJe`K~#8>RkX@J@E@SrF#47luSY zQKb?WUUh;lQwR)r8Pg3WlK>Ka>{5mU9r;V<=tk$fM1C)0z}DSScR&!yMl*kc>GyLp zNOyI$tintj4kEAiOMIcNqvLbJoXie89GcwiCY&!LIi1hBOtPJR@$XOqADo&tdWmqg zdZDt~hIjo00oOwW{%}-3{wd&c`D`w3eSlbE+fsMQXT@(>+^Y+n8TtuZBcG7{JG=4{ z_r+m)PVDmR93uAN*UA;aEMgAzgE*K)?Cj*)#ZGCdRFJV~o->1qfYnx?%A-|pH^+Bd zqIV2syGX%&@MrS|#4YB{2j`{le=`78L^0XHSnNPgmkc^c(dB z^!J`myFR=}oY(V=;1KMOWa#=aTXOhD_!|&O;Fz6yBJUaFTCu@bQi;nV`X#UR25R!H zGSQ=;r|q8(RZ8WA(%i5~$%C2?N971g0beIRx9arE^K%(RpFcZ-!QYF@CeIw~-Bc*T z9chQ-B`@Wpzd9|YH@ZB4#v{<}^{&dPMz$ZCO8ZaxBOMnSV${^A?Zw5KbG`0Y2V^mm zdFtyzf;$V^N}DvR%Ig{``F!?}vD^kCH^y`nFbD~p8mE8}L!;m01%qT!!z+GDSIg2f zHwgLQ3oZJlcW+4wYynmb>MSY-5C{#NFAI9!0Vo0aL6n4GCU2rda~qqeZ1%vugX!#V zF&xWXDl`Q_G6*&}67mMdq!5l;wuLGEz>1oi4J2Lr`_~lJFD^jo%}87z$k>0mxyJRP z02C7^nX{q_F1#g35Qs?;l|7ns;54+PR7 zpaQ|50=8^cMg?3PCJlF5hG1-SNRbr+q5&i;b_B}8z&FLe*KCwFrp^uZ7&^%Mj=K?dbr!-!^hcca5a|(bvY$@KKcmjYZYyua4*raTG3FaCw?F|GYbq8?uc#O@rG&Y3~8r$nC z@(H;r`MZkcM#JdQ%1U6f$=;!@2ZFW_>nC_?Jf`o)S7WfQ;4T`%wBs!a;~X4Cn|(cUo#;)~g5 zinrlg`Iqy29qkVe7ZAuK@Eu~02pQ>LNYI2xb_VLs(7& z2s8y(XdlBhkO$ll2&qhQpJqos1V%U}$vyDs2HiWxqZD98Ac|65`r>yXWEy z(IsJKbWJdVJ8VH{azJQqC8j*gMJg*$mBgFu zwE!anxEqa>l3&?$kl&B$*|1Xzy!o+7z~~Z6JUA6vYM%o);2WP7xu4~~kbd>9{*Ih{ zyECeffb4}W7|KCz(S<|&DT>59-`9CEb-18TDTbu@ESGLdTEGqlv zDb^Q8$?Y4Q=Gn%F`1rB?DJ0lySiq*1gK1$vU^sY^Z7hY?sj~Q!K;a82%olnV8=sfJ z3!5X6H{q{i5mMaV@MsQMb}DAkOpu~tAtLMWZMJZpstok)-$4KeyjDnFbvz#S{DB!3 z^0n{W+r*$)Ay^InwQdw7p6zo_+6N0I@ep#GK?`6`4fC&3M;{GQq3EB7F^ZiXv2M)e z9@sidkL9(Wl3EH0<=?Q6+B|7!DW?y}kvLiWT^a7}ZFFiP*Acmwt6g1PhE0Y)rhvYg zT&>x0cy{y0i|zLNo-linz0U@9){~ybH%TbS($canUoR-1mAebk7oJEFnXKnvH+=N4 zbw-V>c=~Gch{DpmaEgonb+TvT;Zb|&b4a-o5{Rxg!a7K>YbLeL&{Jb;35QG@!py4A zg(__i2NKW#|D*d#1Yx@m4g*||C6kn&L!(KQn0Axr8$gQF)FA+iywdTNBh^dJ(PdjE zwB9?^i*Q&2`tTqEmW}9)3{gzasi2?&vuhCKo^*oF}ClBla##P%E`4 z+ZBpRy*)LBhkY^Ew3D??+%pms^tf!!|Mj#@sPlZPdpGDuRzq(>y4u4=={h>fP9?W@ z7FLLGqX%F*#eAnfWIf3d+zt$%yqh%jzWUoEaufLmsz}8G<2-Ko3oU16D^Yv~&{i@@ zG*GQt5iw3Sywk>@`>p`DgsAj^2@x2`Ogub63J;_m>=^0*L2x)^#;9InB#>%R2yh(S zHPh*yi5=;rg8s(5XD6I|Jv*I+2GPJs=-fPin@9^Vn_|ifku55jyIf+E&=M+%kpS76 z<&#h1tFIS@Q>>aSmjc&|X`ajhKwi8W&2U@1DpwvL%u(d|;|PV=Y4Cl1-^2Juvi{I` zzF|i`_b?8`7Pp6x?osV?EezF!V6aph5YC`8uc<0C^P77X{e5c(6Y#Bovgd-=uZ-8E z6OXiiGyghy&$ZU^GB9#-M4<*xu{_m{OIg*C%7Pd$9XI$@{(ijtdQ<3<4yzX<4gsLE zamREJP3?V8fs~LbxsB8a_t`nJGbj_9+J$HHJNfrUa$ZHMQNT2GbV?ya=mb>2@M z1YF;ll*3z{{vd@^yV&}Gp{8ubsXk0j$XyN^Sl@Q`dt)!mqJHR}Ou(1to7Fl~MkUVYjPPoyK& zCRGaNGM&hY{>}vkNPK9~p)4Rt*7|4Z5@?M{FG=$f)*=gAz8B|x=>Hbk^Yo93{2rYG zjcu2Bn?ER#99zpg@PxfvW`0yq;S2WT`fpcFPX7{%9j;6WB>T*JNb~fw{p5VhY#~cV z0@cxA;iQ%W8>Dv`N2S;K3;2eyqgPJ((Zz*0g;cjNin}7`z(|=VRL1+g`Ow;y#;ly6 zwA*C31ugNHWXXZyJ zvwL{QKoSVKLe1ZxP!a6=CM~x&g4a5^9eJ_8xD zF-?rT&Avihnpm=J=r-bp@>~lme)Rhi--O(%g)8=>qa{#N2IATU|nEam91*azEA4phX<6 zQZk{fe(+3|zu>(S2ZwwKgd+4m1ON%sppwe`A&@FZSS>6}PnMW$&1+?{$Va2(dr97( z>|#OAH16zntC+$;3oz=dBM5r^%KdW<+a^kmCyVHV zWHxIlCm6k|4VM*IV=qL$rhAIZf*F5O+~~!3wdxlZ=tx!KQucf|0F^U@U^qFv(e`6g zsQ|9=&DC~mU)yL{;^cl8W0~;xH7sO$Bbc`M@+SK*H2j^nL&F-@Ama;?$Ri^0h;p5S z&3MV*GjuzeXeS0((Ka+9?ulsqE@^l!mGM}gWm?w|n16h%Tatd_kK1Ptq2u+9oJVV5 zo9Wx4d}n@l3rBtwQ-govea~l^7LfQCvCECulkImu+x;FK$3%;LCCf?RaG#dutXga8 zw{O)|M~4}=*!6rjBLC3)t&PKl9EN>5kYTH&WuY;A)LL|C5FEjLKAiU@Ftpis_DD%o zQi_}>c4!g)%Hw)WaK+bkGWGdJS+kHRAp6q%rQKVhuHn%s)0agVY9IKGav6Rvt>daH zSE*R&j7&J9o0proDC1NGM&p$hDlMxtu;f|CrmU(c_R?DRC9I-^@vaOGp%Tw~sfhGz z{6owbAjfWga=(FY=+c3suBw5}%-_t|4je+Xa<(4uN8(*sr+n`|ta`~K$@>lu#tjX} zMfa!F9AgNEcf9Y)N{vl?RpN4vT5KPjjO@VDO$*$|7(8U^*iEa?X`X>1VF$su-e|2M zbL(g0&9h#(&_LrjXv)mlSQ3@rYidFK2tf-8#AJhnF54_lm!(I~#jOEAHRg5rnO*E4JMf1=v96_KwA**OtatL}2CaeM7b_pzz7-7P6=(1UUI{%wWDPfr1gSqJ%G z6%Rfl12=i8jnddKW?}q8>XPI~6=9m>xDd#N)&L`ulY>s6eB>8%f;cOm6V>B8F*NO= zWFOk%PUF`_x+No60H7-yXbNxzdaU#L^OtDO3zT6*BHAsJmcY1K%}dHLmf@q(3V+08 zBM8d@xP5E3x)v%x=)BnYzVhkR{b0AJ=IGaj(?e%Y`{P}^q}N}$l7$SMJz=L$=aCT} z0Tu?%Hq;UOiSTd3v{JqsV~T%Nrf-=D968B~d#)U80U7UsNmMk4P$$=F+tgI1D(&}KW8ZuDSpkKy;>b-%J5EH5toVjtW@E^iNR%w#XP3`Vs0D*W@lCL zjtVjs&J$axZ;?FmhqZJNsq^3BDXIHfdwfBA4foyz{hEJo%InmWYNMt&M!WL!HP8!1 z>xgu%XfyM%#O9YvP}QeOqEt%ld({JijUH0p zMFf23QEhu_S)p5cdfb>*8vb5C^4L1+zn9_XqgQdDYYGF!de@t2;{5c#npX6bMu|-8 zg!Xhdg)o9nNDC&A;fQhxB5MFbSOSsJXRHyh_>a?(i_vT)^P@q7)8oItCveBZ^ZwuD zJlRdogUAiS_;Ki3*68D? z3$~r5W|#n~B>W)0-ZL1okgsGp7+*?(QN@^AlwkH&A-X4K7PRO%TFKD+_j9#(zotBl z2x1AK7iYm2Jf$bv?$99NK+sFu=WqrJ1U@^)9~ECw9uzz@`e}3ZDwTckDj@y7R+V9; z!-(g&y@4)o;+cu-lP?POyVjVfGWBaPF^s>j66~3&O5;)~F{Z#&i?g_z)B2lRYA}7& z+|mCgp_aA|ca&_n0WYuv=UI8s7Aj-#cyoo@c6+dgy^XiK756pw=`z>v4i2y7H4Vh`?O*CXng_@5M!q@J}AIlKar%P1>PW7oEYUuxW32tRtmkXSa|vO zo^82^TOO4)Ricp=`c>D5+sxItcs#-i%#!Q}@;Y~SlojpfAzuBh+VpJ%Qu6$mc;Zr@NyAS`43$fG=S0i`gq@)jLog9t9lKHGCP= zMpgQGy3YxI9WN3O`&&9G%2!3d3&+bNWbRTz;7|r83nSC{&TAEwZxCvt&JNa6-_l&Y zEAcGfOfAJ$^>IWK*GK~lG8)R%^&Pr|pzoh-DXN^feW+?9Kw|SMQ8ItW-oFMXo_x;= zD8d`KI{xl{buIfP zaPnqug(rSLWi_6bF)*Km0t+*S&0%Z=aSMuFeA+j$M|`i&kw+p7~K) zWh=V2FE}kJCzhG;6XT2KSB&o8UlI}~K+89S-jKu?hfQGQV=8oj%G=^I7i8>Y0J32B zm~RfE{l`s#R|u9a0j`l(=?pSVi@k-{RGdWWo)tE6Dt8m3L&sr+722q93{wQdO;c8b zv!2`uj+)WI0W=?&4abReAJP9XhmSFNG;Sm%fM((Y1-QONq6NwjQZaFngnlUt_*>el z?(h04IFi}&?3 z!6Jg*cfSp0>V!lqHh3aZ*7egYb4W3m9aRGnQGjDUY2@=a+XE?cCk7&4Y_@R2gilWy zg~2h~b}|SpBmm)C<`fQj3Qlmr1}a}2DWOh8QquAm7=%5TU14nh@q)`ColgIi=jb?8 zHvW43c!tRv;b6LU`9k`x|KFdVT_raq9jT(qyDE3z@??MJ-}En1{}ii&nJmgLlW|#~y*eS4h6EZ8o_cBY zHwNNz4rcX0@HeJgC_ahr3=}{^LTDnJk{G6M zB68J^FXr|i2LHdZgaPf(>Ag)DLWyJ}5Q3>Gukl$U5@77$0?T56btyVUNdWX30Eonl z1#oh5f)U^Z*Tj;=0T6)lUC%|~a8XR+f2`d!=X=r1ONI-^auWr5ko=@%FUM#nv>#4n z3RTH@7Wn12E}yMIiGjJ(n;j)oJJ%(ybFk2Zxj^#h9dEd}&A%9bb-%XlP)oaR-!RfX z4a8@J?0_4?Z+e2m^IxHqgp%r2fprSoZm^p#<|+&(ToLB>LLhL(1>`khRD$cTCTK72 z?)C>B1u%LMim4y8@lwo5*1OFNavmG%|6>-Fw*yN6!XGU_-4Xy_jaH~8RgnXQ^|h)7 z-G3gDg>paiPQ3%x22%1KfAjjEUHYV+axbA@9WB=Rtz&H@s8wjNg>t!i8pN?3Fm~^i znfD$?n3y3L9fGP{x`s>I4p~>p zHu|F_eYr`nr+q8Dl+oURE!BD~?q|Flq#`Eh-8Lw_QaY($sF*GBQ2b5&;!+Y54Oe!| zOHsDum-`h0%!nRX_gNKpaHWL>#SfED_NOOio<#h%3BVQb&48fEZ=FZ%%je<)iasW;9v#-RF{TD;0%4e7Lj90uA-{Mj zkmDF4KUW0uF;QcOL)of1`1&aqbI2~i6bofrI0RxZVJVyvZKMA9Pf=RRV{0q;R)gehv4>P3)9mV1DrphV?P7VmN)i?#zW|l zd(%g4w>IMS&Y;y_AOKyKr8*f&b@2&O5Q2-=KHy|0@t)AMw9 zXDd0qL1jueHdWG`;^M-%80)o+)6>%%C0wmOeL@NVh5W3w)|QqVeFeYi1MW}G&sCcY zB|n}2yS~N&V$wBlGVMjR z7-P5@7>IiX0HfNBreT;+BRNlh_);>@0GyiTFe;4Fb5UscA@gNyQSm_RZ3~^7x`ZEJ z)5nRISE5aJr$SA3@a~UGxiqNbFMjiA=X?XMxEVU#a)r8q2B{Q>WJ= zsBWiAFj37Q`7ne-PbgVniq?p0Sgczx8tf$!_8zX3>tHDRvXwc0w$=VnO+6m%Dlk=* z_mErZOVQ?$PdG1HUnTSJ0{I#m*m-tJ-rmm6T&2f1cI*acrL-J{W`d_^PcxfnDg_WyJxOqc>5h4u&Os|ttWA$czC13!*~P)jw}98b=1;7 zra%@lOrY6Mv2{O_!?TYJDnl7GU>(XZK@Q*mgB}A~#YR$v6$60STsq_{mfZhT;pgQv zrteQsIlg6ow)89#ONzT)l-U~d(4Nsw+`EI;9TX^@4))pMHiF|A89u+1=;;M95K>yy zB1d+ZO3g@cK{VXKk(Il}Bv%ZMXjSr4s_xovXdPsKg!}Wf^Rv&p+=;bmgZ=%RD)obQZZX9l5q-U%6-p$~K5$!Dr0BkRNY4O_ zUcH1VJEa^p*OLAw^7enTlnTMw$(t~l99HMZOU~wDU}*n*IUs;0mT}ESGzv!5MH?sOPDNs^LQij|^3Pd;K&C=2mDnv1R zqD^k^*0~zLa`)fQC!2uBhc92Ut-$E(#5cL*8J2>AR54L)xNoH5IuM#;^q3uieM$4MBF>BXYnd&cPuk0Cc$B)~r88fh+wK--;&NUYe3iAo8uNTQ z$3~6o3lp$0`g}yGLAYMIFNREP`9J(Hj!Q}M;wIj1hmOyFm30&M+q>D05`9?DdvJGm zeeB8*bpCa*9RA#1+(0s{SSfp^KuN4lH(dIa!2f<2Jv(y9uq<6Ny-T|I%4hbZpKeAY z!u32oKT4b)|4^3_m3Z~*w&myJ-+_y=yQ_f8y`Tz5N5`vx^-dJA_vw~C!0-5P=i#!m z9RZ}OqLsD@IW?v8a|Si03l9&My8pZMa3{^U^zvmb4k=J%bu1Cz!}FcA83u-}P07)C zr^D?*|DSBwY`T#42FIb6@VOr}zi`eH*$%We5s#5mqxx$jzSIi#CPF10%2npZ z@nADYjhlkdkth;XjMMiz9euvhzCk*kQSuWoGhTn=A-YUGmZ3F;`6_oHTR3vdW(H{``hK4p@&EJk`5&VbPWO`y;7c*kmjR0B%ECBz>!F>n~b*X&53v0&nbA=d`J*DG+F$cUE~RF(reUv)Vl$ugbi5a;Hw8 zLRU6B1M_zlWXsOixcskr!jTVjG~EfEHq!VoFcT)r(py7EMn>{`jOI7zeeUl2J#1dA zQKMwyyICM>%&2D}5M;uZF?BI5_oqKYkck+=kd-`OL6|Eipp~!v;x0gInTmv9s6Fkp z(X0b0R#an&GJ#eUa#0{;%g7M)*0;X|IqLii{p}z|fyGp7tR!2DXGC2rHim){v>3(n zBv#-BMNt43*l!@n*!c%_dydV5!nQ;gW{fJS-%_ldNVY6Ef;Ou^4JxpEOU z)8YeD>kqH2^)l*L_f#~a$^>gvkk?B+TY6=Zl&UZKa0d$er*t|OFLWk89< z*VXPhs@{Xq-d1M|zn4{q>ezK85Pg$-*T3^ifd=pJxOgPM+NNEUh~f^}Oq!TyAN14D zjhtnEeFlG#K^l$pp(XJ_5E_U#0)Mmmo?IhKaQ*P*KpP4h%J3WNJl-V2G+oeodw0aq z!Hp;=2Ui3!npM^aZ@#?v#-~h!bK7bf0pfFjx~*TvPDM}0=>K-ekORq6M$xaIz_|wP z_Q5}u%H+L^7OM@q{NDZ?a&>8q1J2&Jn`8!ntl`<^ak>Z?ifout>px>hEb7py1NN6Z zz5h0NULFr`!4(=^?%UgCswKexpZi2I){{}9C%};zq9#m0A{v?yCl2qVt&F7Gp4^qC z^QyI#0GErz=K*rLCYy^_iE)MgCK<4zgv2E5hV~w_a%Nmi%)#vwP%!PoxcgXJBVq9K z^Jn7+u~Yo)`t!vok`kGR=C#2kVVbBhPsr`Xt&t?eXnB2pc5AEJNeCk!hXMv>OanSH zVyr9vC#2Oi8)H0`+e~B*J27YiPZgwbdgrC7x#ScW0{Vh;r{1WOZ9v=H*tl?d$AaSR z-IkaG>G%*spVYuq22teGYSI%q>m%LE--4yr9s2J}ix=J%J>ty>0_7 zkr&08X=zsi)vc|bPENBAx4=Vc(ngR(DLMuMp8miG8>imq%xrfzH3Fv{6Y`rU8A_=) zoW|Q#xbV^WrSC&FnnUb_UaQB&Xecsi$6CfMT}cDZrkLg=lFf*M)Pjg7@5baZu-RR-}i#n54@IBY;*PekACeQq71 z-!qZ;jb5%s`Trh-pAfAbe*T=EAAi0(b@wsRR8=tT$+pfs3jC|b4Rs$8pfs-UWbv6{Z1^l^mmK9d@=5<;whp}>R@y{TY8 zH!hG+>7m1{B5y^8NMpexCKhzsKkEeN2z#GA?(aW3Pn~uA-08hKiD9%mkASfJ*6W3L zh};>WMTnompE$6=5z9wjWz~7f-#g%FG(uLkU>yN`eDRG^i#hd=olR=ok=_{8soTUo zMD?9gbWM17WVfEu^bJ+#VpeCSRA=brWFos-FEHF zOfbOZc$_xz>qON4t&;GIQ&#*!#-|=a2*#EiWL+y0=HT7f6 zpovxj5ptscXy5-e&VOTO?#*~U!QyGmOgnD$b#o(VY!+XM+1OEoZQWy ze@WuDOGsq7C!3`HR-rgD$D|O0u^CwX$(#92+vQCdJ)ZS&Q-;nEN{vXP{RQ6Od2*~T zSX??Ti_Zy&QxQA3fBX(Z4GCA*`xQY1rX@%@nBno$)Gt&hmUwi?2pkM5kiZsm!#}hQ zZh;1`E$*(TBXKk^hs}3c2B@fYQ)7qp=$El8e2j1ZirT`K1YhUp_KKSaOTY~EUoxk( z39UhWUUa3uzXdju&qqpLF^$x4xRcpuAwfd~Vq#z>$~+mtilWO8x9atT1sNt!4cyzS z5&yTHFYk;MXk8`;0)>Jgu6T!AQF3wr&*;TZ=0>V}Ar)3634;+euv-Q1#?{=Q-IN2y zC`Tpa`h0V~msI~`teUTMbf))_)oaa|#k_E_b>DqeZX^t!!ixYs^$_5!c1 z6a^bC_IF!V8gCwfroQd^=w~0)-r=t)jO^ZgxXKe^wY5aNh%^f2hLC{?uu8o@t*r}m z7?{^f<>e<`9{!O>*dVdLM9JPdFG&wYvjztTf1hA%EEnxxOaVMJ^~LlF_6%GTQ&S4^ z^5ml@3w@&i&970vT2l^rQAW|g-&sx$5F^abNQ9_7N z$=P{79X8-&|3Il|zuDxw|M~>ndOz=;jTBvz%^BwA=7Ip&#>UDfYcmUT5HYbGks25* zM{h9BiSs?%=1xW0+Zm(-MB(P-q@P+k03o=5)dolvhqG?fv5?kPRh>IJIu8vEjjg(m zjpZ^|tx&Hr=(4IjKRUuYx?CVYH#9QZS-s1Y^{miD!$ksk=O+tf2wx#4CMOS(VIj~h zSOc-)?spGvDP~tU7uVKK19P&nvNAFdpx9Yh<`)(uiN20crCPh$`;k;0pIJY={uwEw zg8^1I2P?X-zds+ES1ihOux%~QBrtO+Dk`QPntQ*rwR^*B*JxD4#%)xMPvPk5wmpYC zwd#S?s?_NZyg+(ooVXd!UTsbT)F$HqZfAL!F)>fA40f=f8oKGO=5vPO(j;;8cO*kE zx5*6a4k1k@b#J((rsn1(5i28mFY6{9G@Z58HZN}{ok+5^8vW{}6Ry--AJ_%!ViFP6 zTFDlDI>yJREU+imo(Zsfu{+Q9_4N%EV?sHf|9AH9U&E!Rpr9Zlh*1Q=7Lm1d!9h`e za$>^8t;yZ>fwKE?*-}$8b+Jv2j?x%d9YLShJAK<#bnx&9Z0+qF`xk-l`?wENfP(f9 zIvxkM6x*>;2ksxl(Ri7v!{6)YJ;n2l7Dp2YO>l4T`usWyIw~sY=C?<`ksuK{|-Z%uUz{`|w3=01H06CXx zisZ~HBN-9`GCh?cSSlc3KiaBMr6L@d@ULtPK*)0nJ-o}*S+awZj0#mYTw8=EtGm$9 z36797R7`5r0B6F7uUZdU2LRyDdj|n3bo%opkO#p4Qh`T~F<1=+0wIG;0U=sh$3W8) zOJoukT|`o1N9^gf%-Kexx?+Cf*jZDfdTn{ONG6cA5<_kdi`4INXZcKw5rxF(=L4|# zy}iWQw>k9PgKSX39Xk9C?@k&s!{E2PAKsoq+2}3LhYK~TJML3ZTNnCf#fqmFAJ&_5 zY#escHvKEyf9|DBtWD+c`R(+E%5JzcH8(!DGsWnogL<$O1$|EshiSsmQbyHHTBhg! z+JIvl-#R`XlX8Vx9x@5J9d^CmlH!C<&WM+5to8!M;iaUiJoC9b%ny5pNJlt5AqsFj zu!BGelQ>ABIXOZsMq11|LAT5(u98VeLe>hv~v>O^8Ny;S>*mrkjRq=GWDWf6Xx{0yl9+DD% ze^lyF30nmw091%tm_^j3H9QsRo))J3IUC%DnzGwBy>7G1$};WjTCXF^CIj#MZ?Z3+ z_4wRRmK(FftE;b&{!qoe67G;BO*3bA!Nmgq7CN3B&fZx*d>ao$G<6o3w55Ggl z`%#i2o{7-rhdxNhEZP5YC%oBChnq|2dhvx6_O7P6&}6AfFTXVu)@d}u>*v8PXbwC% z#VC(-(-(K~Ly+UOhyT)H?eB3Xh!D-^QPe^4BZYD89^h1P@@iNAUTbHvdl{VMv{{VN zBk=s#c<5KnVJ51qR-YIK%_1}Zo!;zib}$fj^s_x(Jm;>8iQZ^)d>mGu)hD?=nh~co z;T~cB_psryn-HGycXg&Pmq^%O+@_0*-zxgrIW)e965;E<8g@8)RNzJ$onDYy8?Lx2 zB4hz(o@KK&{T&caR(ckmIz_bRxTWOoTr1%DGMbzKOamhq{AA(Q74kgkeL}`X0Oc|Z zbbv!Qt1c3Lfn$jUwaSvkud1U{yx^9C%7_L3`Q;avOwYLQ&xZoEgQ|{if6Qq-4u)uk)NPL ze#{VUatuKh07X?S0)e0%5`Z8`jU9hq^+%eNl+6~{0RZf=AhK&%=%4y>4Eu|L{6qZl zQY^oQ??mVnt-6Yf2W|yGz7oK$TvVyW)FAWRiGBSGdO$>)x}4^Rc%1vC$8cIazOhBA zNBkd8NXVgx0TTG(?I0}^)BMk@up$UVp%amq6jb)e4IcVYy}zRvVv@S$3w)WuxV~G? zJvr#1WY?<0=1o)KiaUBjc7a`hZw;6i^5L8H&M@uB3)`rJ!VnRmz);=~#MDKTz(6Np zSiOyAg|d||ZFGQ*)U#)p5rV7v!+TwFA+g_T_xjhU%kfEH)& z`1jg7-n;eo>JG#u_&v`|EZq2@!{Am$69EpwIYps`g{4ylOAT`)wruS zUHxxYz!@x$Yag%NaYFb1!X|WGK1qmSAO<}{qX|s2vs|s(bn$uZJ{r2;Mixr*@xPF6 zG~mGcUEk*B@B!=oC7d$C>Vq$c(+bu$2IN^9OU&nL9C(|Bx;($bbl(ZBr;qoOY833Qw^4V8IQ@2)*bZv;B{6j9Wrn5u~Ds%&9|^tJ~(85zV7L7@o_ct3)lalo%_Y_v2XFOqA?#oKYj7+ z@BstB@%?$Te>|2-1Ke!G8W!f}eEe$+$)fzX(k(T~cm+G+D zX7&Atqcr{MF7!48BJxc`w&-s-s5H?VNmWbgsx+by4CMW9pey$#yR5^$wQ z5r;#>kJOH+VI^;&)qsH5zsG(kAm)H%Lm0?U!AJjQgW-7+DLrLC*x|S*Wi(L^@NaN3 zbbwZ;UZK7HJQiI|L=BY~tA39sy=bFypw|w8a;V(NMXWh9so6k#x zUrOpNm|a{2#e{fB;lccKEO^1*aa&KAHS(W&21xgMwjzuWbJ`JbXhSY8F8WvKi5m`_ z@u0pUYHhDi7%Mg?j_G9rPW@m=2qg?F`h9i#(4t8zW<1A8KjK!hGE9o1R%m$z-4QBs zUaDj6agYd8P+Y%qR>baKNx8akiv&?&8lkw6LBS#7_27&|z=Ob_GTwoCT!RhqOAEa@ zss$E0BtcR_%afO^G8__vC761EqUcQr9n%V|b_wRtg2Qe~5p4it(85s|8%sg`Q^O0( z=WO*MZ*WafDuj>LfB~GPg=AXj(A`0wry;aNzKEdfT-_RC$Z*txG^cWe#!#}e&ns^r zSlHNRm+B`pu?hAt?(QEN8yY*`*SPhclTz3CqZX{y^DRNiC4CuI3{4HqjczVnh$Ayt zLpi=~4z=;^zTO4(Am5k!Y`g692}VXBcriOYgJnktBi$e^CxfxN-C^x&6%`iEIiqj% ztMz>JE&FZZp0odZho;vvAEYTzul3iijEq=;eBqQ3JPp`0Wg8baR~o%6@75eT?#|em z?Kj%Kumlxpb*pwl#OZbTJgysXHs7QEbNl-|Tdz_P`=kAiM);9*RadtWWUp6$n8cpi z{^F&p>!c~gG!LeqAogtxZPnFeCSV2DE^aQjy(IDQxEunE?A&xl_Xg~fJFi-;GyV4b ziV8;No<9?(!p|Q5oyAstz7N{aI$$8oWogy5FVy(u{}K1^9@Vl8P#dQ5Zwrw|D3iwy(zLxzQ7Db2rH9&3gZuh|r7Uj;zc9?cTURSI_ zx5X==bG}~t)PJq$_b@5#e~s(UHND~W^J7gqHoMK|tqE1uNNKZnuQPLkkyy}o%j0as zm_)GB%EnjNfy$H$T{#7VN0U}Izf_Ez%|`W;{syp6=}@nOAAj#QSv zoUHl2Y}*%OKt* z%(OJyt7~YOYnbO;{`E_X(rcUUIK4Ut2vu18_nVGK8aC&|?whR*O(*$_=$^}qdvQ_hU00KYw%9v;!l>;Cy z;$o%IyJl0sWjpWB2LDA{{mO~Fy!=;2MyYEl*q5_KhS!FgZ$7KGZ0Im)Y@coE+<%1f zx3rDdhw>x*mcU0gm;1RW>sEe+6%-*MW}Wk$F1;yBBf5DExkZd^FUX-iC{_I3Wa|my z#zUMuY%F=Rhq8cbtjF+#RmGlL&wkVW!(e~VC44y8&5$3&%0lbG9w_>&(rJ=H0D&j`G zs)(L=U*f9eAmZl}=qf{_PMI)fPD>OzT%Xr*-=BX8g2BuHa#}W)sFia}kFnenEafKu zHt6s=csr#3cFO#EupE0$`5-)ua_P0pcKJ3ts}d1>HP-c7Ryd^pR6q4b+I2HBBsDmg zZd*8`gh3%YXCHBsCQ-XndTMIs8yaEF`Ri-rVw7__SYCjA$nh*Y_>q=v<3gu!Au6dq z-c1$U{=;11q><{I&|Rcr=hNaTkmG~JOyqlvmHTXJ^HW3uCT9fr`30Q7%o|QGz9xOp ztY*j-3YasqC$gXwOJ3Kq=EcRmqu8}ioo=rO`ID2BXnse%Pe2I$qh7~M)@tqE-AXfn zw7K05C(TW38(GwmXPUtQ>)Gxu2MGAysFH3qf9xkI3f`{QPYJ(A#t|yiRZ15@SyZwm z#Ux45A9IRCa-Joo^WM_gaIvsV+j1=}E?RTC=|?-)n%QWR zZ!%zrW`$v+v6z0J${)n0=qsjMhAD^w#Yhmz7;4P}Q4_kzK}^+Oy~=X=xgRzzeOfV& zrG=koW=4Far@r>o2f_1G#z;}t4L<4Xu{&Y{4p_DTBg&fV^x)efErTD>s;kc9K-_8B zsriqlL3h=$t90m7yXGy=%iuT;-E5s%*~HSts7lC8Enl~n9cTdW^|sNRyIy;GSXmKW%s&`9EF`b=~&Q<-Xj001;}We;+QO zVMMWc!9W1t$HV(3vm&R>ARY(2E=a1W1vq;2B@H#s+cM3EKp+rkX2^fw(H>KkvZr3! zAj?1x&Jd_I(B*6+vpnJutTHeYBG|*~D`_agc&e620HYUBUqULvEa8#Z`hzb!KSS|_ zwfJr_lvxA>eX%6brJ}klrJ98bl`^1;I~p0+ze`#BwO86?bNSx51cVR% zxZkYj1Vrc~Xf(mf^ooT-og@R^`_)w)O@aOwjI`ClG>{ii;IUA zQ@NQPHM4T6qNZ4-ab$yIySqNP8Bpc>*%HbPZGWAN4%bI_F)=(XSDodMf2AHWmwSna zt$4*J!btPOiRnvqlbKq;K+BWc8y_0tlR&Jb8Ti~Cw2psllD_T;zr6`R_6fiC`QLkY zak{_nN2-=!ETxa6S^Aop8CltbAE$}K?R~uuRTOO}ZU)km05DU>>ul}PrpKJ;vD=c~ zYWsOgrn`J}*ZpATwxy@tIgmO5{$ruf`+hSrN8^6JK`c3Pa-!pGX$ee-rka;1{`GtP zH@^Na^y%&(d02~(X5zlPzkeG`(Z|mG@O32}8IZB0KpKR2ww$_mNi>T3X}s>wXX6aj zotvkwIQFitu7L6TGU0_;KSNhvUjzJAT-|P#<&O{-AFB`_x}?%$k$UDj>)j19bB?g{ zMgN+GLas13$9$}bpv%uoU^bQUt2-J=TXudmu`r(yt1%Y80Ng2IH*cF?zmUmw z+MPG?PVT4WmVmHUmTCJ<_k9xe4j%p?TX7e6<)w4Cm|B2W*GFlR$}|!AsL!nX{V&!-E#f+P z*m!3wInXf~SVE@d*eQ^{9jS4S3H;vU`F#B|mNHYqu^KFD48llgXm9%a*W+qil!D#) zeZ6?)7sPKXPuDMUs-;+%G}?(&6Xv)3BS|HjLeB4J<5*iSon{g+)Ut^LJ+w)Xk)}rc zbve9s31cc_X<1n}`naj7JZwy-qMTf3{dfI$bqyQkx;9+f!1RCYhNy zPC&^EfDkcIM%-Rd)U>jp|1v{NAll2--PmVIwD2f z|2-x4zXL6BK5Tcm|9v{VZaqlefOkmG$x%qf9cbnF{vX?P#Rh-s{iw`&&Vp%tlIbf5 z<&&ERE>jNg)8W9c)EwUD+2UXIDIv6GgX3od2X`*ue$%$5wzk2U8E*CRB8AzL!-g+qH2yrx_!mIR zw28H2Z&RnuRA*zOoHMQhp^1iu%I<2Fp!Z%#tk6T>%F1muk^fzBs=jkJU{`JsbL$Sod+`fxiIAq`Fbh6@uBC1&(a3dioCUU#9&FG=^|9J~ySO zr_=UfLKly4{%d)q!U?ctu=~!7@Z-+v^U2Pd!&&dO3g)|5Vp3Z!q5EyY z2`PRYcD7ls*IG3H(^G?&Rn0CV`FVVNzoYzcDHmS6xQ?h{{93p*tG}(HeRNWHv55yN2 z7e^EPCt^Cj|G2!l(JnPK1P@2p?ta3zg^hp zMtAEug?zKa0xamh#Wimg_dObljf*RT!x)2He9|g$9@vjPEZ6QS`hYXvpawKO>%1siq1`~TS_OU@7EvJk}BY_xIrt{IS84Tc5W=3@L+7LSmrDm!i7;#;E2;$0mdo7tb_J&B=x7cCdnX^N^0?U8IPJ=d zHUDkEOhB_Gbh@}i<9=33)2Qk&MdZB$E4h9wf3ea&r^96`%CU^^xt;S8OXB?$)2uH? zFcOTm!EAN804%td@9@$?VY$BV$H%v~+*?jBXSSD_TaPCq6*KtwZQ#!KA!;|jD?ms4 zc)hjQ@^j5o@A}9APG`q)3i8;L(A}GAHr&viV0##0t(6-bpy9vFs|qK|#|ix0N>Y5^ zW-xe?wXrmPsCqMb*l@mDgsykS&3S!Knz$!3>)2>_UpjSFb`UKGE^-Eex6x?i(5cxe zKOL_)a;U>RS=BHx7_Rj7)(Y+F#uJyvCSBiZ?^C<*;k<$k#D z`kDouU?$;c=&lgPQ4E)=9IobgGd!U;tA|<8Cx~0PR*e%D$CUB1b;g`e~ z{k3`!1`7%?LpG`p?AFb|e`aZI?_weMhHcT{5?hyJhXKeQT^KL6~)q>4f7jyhq_fnObHj(x>`8`u%S+kq&L z;kj=H@6VaSPQR5BAQf(9WHg64RPuYL$c-xn-WH}vg?I>P`$}^B4v)JY72PMZ2yTvT zXFbmRUo@cbB ze4qL#@fQs_Zr)sO_SPg?`{fMA#bxq)2v-!od92=W8k_i@0=)Qq+Vy9lh;zI^qFJk?2rp&0Y&@4p+lJ|M<--G4i@aEO{uoN>$dU}1^$&B4#YWk{*O@EimG z(${oXK+QO1_cb!<<63d4^J5_2cEH)Ew*GeW_&+wl^^NV2EL&oloU8fvX&Feysi=0&#n5ieVho!7J8*-<_tTVtn|g}MyL&;wYe?Lbn&da^NHJiZsuqX@S-f^+@3o)P{&##0R4Hq=zTrg zHq2ZZpQwtBi5;x1WMZy1H7{kC@f*2ovk|gx3TvylO*Ln>OmUSeS>zxgvA2*LTX`Ox zK8lF+uyb9xn=MkVcNE}mb^@@Y_aYrDwoZDaL_~mJYQpRET*t)EuXE9oQ)gme;R|7= zdHtv2CuHPr*l4agfQ1o=CDYQ@wrS?`c0Ui2JXxG)VNd_6t9`);N>4~2mm51h9Xr)t zKX$2{DIR!Q`Gs6CPl5+w+QNRM=XHN3pYfD%y+KJCTtv}{OEXxk05m|1+`jy%uU+9~ z{gfa2v`{;fKsAF5wkTNbRw}7)XyM`a7COJvfezloQss)AA1QwN<%~Nesm#I3wQ1S# z`79h!xw7M$p9W(sruCPMjg2)X zIF=CfG3sX!lHz}n`!yzKQ8Ja#-za4=wMj>DQssin^g~bEzzU_|i#6BDh~d|<+f-V6 z4qfrh7a%tBq0I&h3#-8V=TEW;jm4$Ku+^k*#@V`=xn1)Fc;(zWxXj}fCy$Rcv=A#1 z6mAOwV5&OR=+ycOuKNV zCBd_qlz*@(52d)nQRkyNb26FH;&X2rG(_V7>;?Uz-BRXQi(^7KDVlvZlQ&S^_*-;d zF9eUtoqlt9$bIGCvaMsmxEqk!iW7TLYAHt+csMyZ`B*0|S6MJcq9Bs; z{Om5P9faDjZ`PID1=Pw+v~?&as4sV1Rj8k&Ovw^CGl7~)Y4vWA04`DLYX)5IFSqs$ ze4-`vWW3$v0v;0LNd9aEQ&H-zLdEajF)*B=y3NuX&)A3L8@+6Xsy>V8)5;%Kva*H^ z4e=HBG1>E!UKVrJ8Aiu^@17UE%8{a>p~UjMT*d>t4ozmaKS&6oY2cm0g~27`okX1V z_s`GA%BUxA`*N|ZUMs9f!B9k5izCkCoA6~TSa|3OE<UaEo(hOjG}yW+;_3FGACSdop0Fif*OH2jK+hW0%g^%v57l#GSPPtyj<9Go-J zK@s0o>&8#SCmxq0X>JylmX;Ald7n|p?YP42`8m$m94OopYa=^o=RGk@xX-8T0sNp{ z9&f6c1k82K^<)31FJYzMGqQOcQz)U>@JUH&;vZH-ypOg;;PE9fc<;hmX3BN>g+^8T zzw$OO5t86*M*U7hwHK<1>oyuRv;=WYTchBau+xlk@Cp6t-F-XKlE#_*)p*wNKr)y{ z_?`UU=B|^rjqbPi4aEDmy7hy5gy-^3KPCogcXKuyrwdnu%Bxhuu z8~>MH?Yn0~quAy8^21&6du$~WQ#LQ>oORqf@2ub5ekRdUlFn^TU$|nYr^@dFFK7vn zhMYQ31@d!onnl+-uG?~f!C_EdZCfNjB6|6G!c`@i#!)-=M z4Yjm%7^V0?F~(^6G#O4RO?DC}AiJrq7o)7a^rtPwbuUDo#HOc3S{OfN?t8V6YQ;iC zGHnRuV%~u&swlq1U+}UFNgTNE?D2icNSQDFzuc8gIkY1CXc5Ij@(Lv6CFJGB3dl4<(RqpjG1W15 z;zyFYZ6jfjl%>NY2k@XVC@6*c#lm}8>+`ogM^Mo+6yD_*HfoOWNGG@_Lptc%B7H!xBXU0buvA6O`@KsBr$yQi+5{ua zNq$w>@Y`FX=Mm6jp;+R`!vubjSd_DGqdv(efrz+um7^?Gb``7fL4| zO?Z|Q@}0xtR@Y94VJwLXdVzyD$WXR#<5rFC z+`}lN7Ji9Vp+yu$(Lxj>GoxO}qC-ag1Y7FT2#r3eDS}OfG^uJ&XEP()gAs@=CWHb( z%UXslK%xH9#E^$~7M2E0JaU3pj-<{~miU=m`?pwLiVxQ?`H32W5e=jMj(Yy61R=(N z*!pNUSD2mGbzN;ZrFtGw?j^OTJ0RN7>mkds3VCpaPMP6BT?$4;7d;h_tfOVsFA^j% zAHhb(J9wv|qPuC41tFwC<)bT96Jc#GwJ5g+(@UF#BCQ1ka|9X|RLa7IpOD(hE>sSIW=*4?}UKsHq<=HeP`7x2yfDpBAO8&7FQzmTO2s(Wb-Y zH1a;UDScxo~ z9PTd=(7livcsK#Dp<=rUK{6XTk|Ml({H~Z(5^sYD5Jsz-jhz%jZ0w=?q$_;m70j< zIAF;{_Hs7kHiTCm08+SIZ^T~OV1E{*Sw(LjvWt+FH?b)O+_dunEV%OVY z* zK{TBw6^tXnqJ)OPK9I5;`H;gAY>tj5S6)Q)bwO0NRV+CYy`MgxLPmftBsv@(k+lME zRDD$f!X|>7I$x4PHKGN|_=~wJ9}Ink({Xb5E+Pc1bFkhlB@@Dv;U2_HZ&jcn1R~To zCTJM^mMMxnY{j5Y^$1EZFu%YmYguDGS(+Tnnc!LLcQQ}bR)NX!j5S@DR?ew%Y;35+ zEm{YbdS#LL3h@y*T9=0>P>`T&gi7GmUkTG-11Oh10urKs4LgIPZ#CDpp07n&kE{Xv zjm)bQ>$ZDZ?=xh$@6ItDg^jAwG1x(t4QPpEV{ib!QS3^k#x;*IyA8})FEWIWnROl+kR@PN#v?p52%V*kT} zqJ)FW`lOL*eAuUyJ-6CIV5Y;q#&jmz4IrABT>;=Ro*gMoZ#hbKX z_Y=KZX$?**MG|e<0=l^ymZPB1O}Ds20)1s!po^j9wh8HrWxcXoR>yhM8bORs$IOvS zn7WmZaRIx)iJ&2BG%>-JHo zUWb2g+g|>34F1$ocUoXe5XpX^vi(h_z~Pz!#}r_+P3(iVNFOM#)vWiEH=xb}%Fqe$ zOSOyQ*dYwUB|(^@L&rkG=z2^t;?q9PLL(?c1bIRz+lR>0epaRZjfw!nS-h^7Cdgul zTwJU~cR~-rMU|lnXZtK+`Y9DXh@P;O+s`sX1XYGyP#2=rm@PyB;ZLy9-30N8C*_cy zzC|uOG$Cu0Q?sYibb}nz)`K$UG~-}MB0s|{+$n}yNsoVii#ANRQu<+Ba2^3<0Bz_t zD(ywx@#jFS+9L+POe5XRC2UZ579H&>ek%%EvR)n&%tyg}Yl*m!MrrPEB{;{cXtF+t zAS{}LHw<}K1Q^vTVp!MTgcI?feUvvDp-}atc&Oo&v`~w1d$)Jio4(kBo^ukNfM~LR zI4-huZ&(z)QWK{Mk_iEp zr&kU#h`O)rgFIl#{#6MHua2BX)>_CU57*7eh(`H)Q!9IQTAUk zJxU}sHqGIinmevMK9)XoE?A?X#bK5?Gs(@-Myc_-cFx%1{CRFO87eCOquu5VR#4}Z z*hH+Yiv+5BWQr0ognXpn&d&YTks3&87V~6}8P${Mn2fQ~KB}I$Y+9IK3>47luw}#u zY$^r?WE=58&-WVx3LP~plV}xa1a60h=CRwkHIDdX0g!hi1)k(;hs|r#i3S(LnrZ!W zi%17cw1rc+UVEQ)e;o_U_tdn?2(CTw5SG|7Q(z{8L_9lQ6pP+rJ1W&zG~Q?oaysbZ zdh-ZT0&S_0nSjh(YyG2}B|DOXD9vOOsL<4*6y1lh!Qw5*n@;C}@18c&7@>JEzV4&- zA?Wg(!EeGUeh<4^c^pm^s3WHiFImjfOGB6_T4H4JV@+DVoL^;`>8W+~1Ig-A((xEX z|3&42g4yFPYd4rQxxKtjdFH>vixWlv)fAhbde7yu4?)c(KB*Tff35&j5@A6JWo#n2 zLRutcln9wfmCJP0GHOS$0B5=zEx50n-qqL%oVDeA>LV(BIigIeCee+9a@JoZ6Ckx< z!ggTOFQuqI8I<|om0$Vw#*7lH+1LSb3c|s`po!gl+shii!sN&-G-~! z_X3%u?2Rqq{@eFr8L3PZisx$N+?$du3A29~QiM~P{_(r;7Yw2|CA87BQD5d#n;3R> z$B@@`81}zBaH@3CiEe&6I7oya%@dpaH~jRgmsVs=Dm zC%C)2OK<|g-5Np&?k>UI-QC^wu6@ouJU0*h^;$KnYL4*_K^w!fFT#zs?n}P)Sb{x- z-;tkwkYGYMtt1rl)+%9j1QGrz0ZR8}MYY@h)jDQEJr0Qdzcnzh9ZhYXx*`Vdd(dlf zNmlP-s@u<()6>)Y_ONXLfo$~^F|hILXK}Hu?r5uWeSbZ@1pc&~t=?BpSHTQnTP-7l zi=GD+R~ou7?V~Hb-;1S6FFU${=ioMWhpV`wefl3jR@HfV38m|J&oi>aqX&fEXNE8 zYv?WM4S6ud+G4MPvGNgRy_YL?d#DN~icEH1QgoDa9s0O7M@ESn_zw_tap)8SH}(%a z;tLwQZlfFn5CSY!OYDurJ!gJ0O~7m7QuvBrE(m0Nevbb+y0P0zuX= zyzB(LICNZwF{2GU2wq+aKmO=^%l|=QO*tRU9!`4R)0`ggRQY}f=q)N2PVnR2hlF1a za^Ffmig5b09g=C^W`y5n0MKgR$Nj^5>&Np9$?FR9d+LPW`A1G>J61K-OxB{`rorph zMZoJ+>nG`gVeKu8a1U|%4ae2)JwzK$A$qk%E>?$6kUY>=u*z7`nsfpMk?Ka+65;C7 z$UfMxNZKf54|wE*dN>2aiweO3ABZfrwN5MKm`GjO>eF z7-G+YJ;Mkdk6HU@st+ZGq)z0@!a#JJ4q~5ZEFRHh0<0sWLOZ>3*Wm%7} z;dX6a$Bvjxv*}LKDit~3?$6r6*9~rOW)dqxMv=@TTm+LA=0b`0o8lK+SqA$9j~m2z z<4|0kx2%ehGttn9XeCmW(eKk9TMdj2&6#x{RL22@+%DGnnZGM{D%7_AJ4LtinAazh z=X>=uug)Le1h_8e$<@_3@%df4R;XaTZ}}~g zIl!fOB?^v4L_QHqGpbp2i_fH%ya?WGuCjI+2M{9u*Bp8Tk!J3e9!QHldv{@C8$pMu z%@N#h=d*l`2vGkLLIG=4wQWYu5-kI-#Y_&#MM^rM)X>+I(?urFN1F%PfPjHP2Afuh zXBeFJvn}D8Cv27(q%T^$_B=9IJnT`AxS_MjiBt1tRoBO2SeyFVVB9;WV>om6tbV1r z0{52G}-Ro2(+ykxj)f5+{E<_Y)jO9J~MSs z{ax4o!#Tp17*N=hwgg3`Cx0^`3KezU9!i;y=U9128t?+PBv&>GdQw>QkhkUI0y6(c zDAWy~iR^mGc1|Igb#b2qg|?@#&esXR9Bk9EWz?RLdB5hn*=3hlku7}Jzu~)gLgMqf z)41x*jtS4TDt*(di5+>#9(3P$6K{1x7{@=Ul2;lIjP)02V0~ZoamF?|I&v>>ajqBv zk>IFQ(nm}}@{9KTpJ`GNv(drYVG)ZzRn;p;^EQXO^i=ZY{uEJOB4AfihbnT6+Oji4 zLVhuZGEP?Gl!)OL{*mLX>5RY0Xi$-U;khvP-&~hGb>KZ?G1yI&T@_n9%ej4EJN)Oe zwi^h+I5wbH^8^A@+>Q?<%gxloaBFbr0Kq|Pz^lXi;pk`|6cA2$Sl9_<BIz4@e%D2Pn-_jREr+`wo6!HSAjqpIzE26iuYJ6Iym5IMVWO8k&(*bF zU%XFDR90l73cnh*eljRRQ87S1eqgre`JcO%g}9y@{H;p+P^h2C_wu3=^LU{4I-3}y zDjCukb+vYvApVHI5a>zj60-yS=G&3UH>Ue)kGo}ws_J1>RKI^Cz{^x6P%%qlr^A8! zE%K0xnbM_*4oXp*9J-&L7Na{=V+8{rcBlR%w~2)jtz>?-KEFUs?fwz6@j8ZhlR9qDblJG^ zn8F1o{L=byc*xyx-QzM5u)iRDCSTszl2u;m<};jNBl(_e!t8e;B}MWwTlsm_M>WS0Xv;;Vl~2AO1IOSNDOr770V+w<0{5Wk$(50xPLlgR(Kz>y?brG95pa1w$iH zL2;eJ1Xl01|Bf;$lUV0h;cB*mD0NIQ7lF`V(@)6o9`@#OLAaS2Y*7kn8hUZ)oBUEe z=Cb6##^aQux!z}e3;U@bxo%M!OlAh}(;KJD+}G8p z>p^o*g^I%MhmHeq!mCzjpHzkxB|(4S+b=Bsx0_$5Qj<_mM`owrgt4lWlIZ2M5m5@m zMW^})Z6X)ZByJjEWSEx|K|z?{jgB5{geam8nns4&Bti;ey`*ItC3?FyU?zU^pK&Yy zmZD36`qBLn6C_%NK89I=J9O^Pl;rQb^aI)Us(o?0Do?ZJbZud4;PYRlt#HZe?scMe z=S;tIW)vH3prjGvultCb#-w+0Jk(bP^jVyrHa`J69+!m*!LeSgYenCWA^XOcZq(I) zt<~Ep+#Ku$!JGTiqa&Ai!RyD_-9?k!$KCA4b6q`P_iOdud&FH#9iBPHM?W!<^)WRw zLDF^>C+_G)L|RnvJu)!u z1uw`KUh8xO>~;Px zVsU7phedwYEwS-^CApmu^w{g&GFP>FstvMh&V7~G{!UJ3n8R+_-f8&5bacUc^>-hy zsR4Jd>=P(R^1hoCxld;s&o6~`wT|zz2SN`Q52u|^-Kgt6$7kH{Z@F(nk(ecf*`=Ky z{GBglozG>zFiqeBp00X*#TEtMPNz(O?1dk~w_OP<4y@nTg}5JvbsYjW+2fHY|1!wr z%z{|tAh%TD)VBP>|NqvCQv~tsV_vDTPxH#(%*@WqYYDMnu?`L}psf8=k5DyTTL&<0 zfQeyyu>GMC78qB^!=oa2Ovu&4hL4X4(C1Fvu8shu`my&n6%tzyF>{#Vkk0VBPgvDK z7mx(4b^AVyXI`Af*vH+5=83OrVQm-k>lIcH-wtoo4>6_ut;Z4P6zYKcgWzNJKfqf( zA=vg{gxVjY&;RhcBK-X8ZcaUpAa-1hf-6D0{dPYLytl`H(NeNR^f);1x&2}M-+1>` z*I;jGb)aHlP)f^aRr}jG|Hr@F5AAYRG^p^$$!w|j(~sx)`l+>Q2vP}Z+vw1|-@#NJ z0m@Er|8;oe6^X8Z18s#K+AKB=e z5m`hh6@!VowWv9ZKpwEmL9qev`*iirfbiwu&JPq~@14B^10ce@`RR$c^+E7DKVDv5 zUZPj2a#tjh&9S5r19m6@CMf zsUMSNG}P72_OF{B*6~z}ywJm@aYi7aW5Jqa<{Ie6IOzKVQLWx&|JHrD`f=U;)RGL= z{Z>#@g~wAu-jZ?A$q~%LT^d%&1xD0m)>U#Da?cVQzjQh|WHBcnB>?_QyJAVm=S8hQ#mopU1irPc>`Xk=!XP7E6J`Y*i%LAKRp6 zPL@e)f)8~xAm0)x-AK-|{ z9GI2!gSB||IGN@LCqIKMIRbpO1sg~Wbo~cwo3I)pNQ9D{Ov9|h>PuOrv&)O9N^vZ=4VJC~C73<+1nfe6|6@G>j@^uhR~rK%(uFt9vq!61q6DHabLD zr{Y4Ax|(TG_jHq9B+u-m*f8Vb{yV&0#}^;Pa$bv;PE(CF+E;3y#iIyz-j`tA?eT48 zWDTJSXF5pZ=4sT445AxzQjZ^jP%@7AoaZ8RGQ(1V&_Jr z#qt=;%Jh2t8vHGby6*lM&~_5xvCEEUBM~u(8JbrV$W5R|VhT^T?v6LEWDJrcg;D)Z zHD=?w7K73=i$FTsvXwByfow;ZLC)f5R9yZ&mgIjM2(eG$)0|-fq>z+<<=Ver^x+!l z>3k<4Bqktn=yZO49Br2UN3k<9A}f{qF||88I6dra0T?(;cXwAxkhcI`q$1^*q|3*; zAb&XA_kf$EkYybKR#qV&`{Ks&Zz>MR^*-w~;S3B(vt<^j|DYl1kv18Wz4m})#mg1#8$05JNW4`U^bCE?e#*z9; zVbc3F+RXD!0zAteifRVa^Bua6iAzAuDHMY7o*apEWSa6@4^wD_MAier04vCV^ppk? zV#>g?$z-W*Z=DKWpB%%T3?z0pEMNX7oKfKm*+>oLx5*OTQl+i-Fl3WOFD^+4Wh2KF z@VrWf_iyh0pVcSr9FfM%)B)$%dxE5DcUywWVf;qE5B9!9A;CLn0NM^+U8+0 zNWWwYPp$CP4JmS>GSBa+FC_J{OB<7r;7omjKvAW=9->pqB`jYPh6oSYd&TFYzx5oF zzx7Z}V+oPajB=Ntgf!RSQE!@+RK^p2nw2+HuL|nnFL}Fh)PBdQ$s-^X#vQDQiGX|v z4X%dFgI4G46+L7;DoOl~6f)+sF`{Bq&O@RAFKni*QS&oZc5rWU87C-L8f5c@stnb@?q9^Z+knrUQtN0yuI+h=%Rq~fN| z&vP~;#M*GNkqb@2jxuy-aHs{TYb8lYgRpU`g8#{mNiO+>eX4v6e}?hX6IuMacOp@W z#|^`eV#}Jzd%KaQ{EZdk9S3t6Q)~Q=l}=6@;x8(# zxf%_RnC6HrfZx<9rzSrp!Y>?$FtjlV6wywRR37b@kf4KH{;4?pC#4_8FC3M(Tq%tb zw73|7rkqH*ZUGD-&g0rPFZJSuSo;_u(ZNhYYo%8(nOdG@A?7*L08d7oI3cZ4$|^RaSH* z=z6th-!`k#l>ZI}ib(urC5=FU7zam|^G@`Oa842_sjHxUga3&PGIZP`l*nvGpgt@H z)h!@`X)T-U;Rm3s2ycnH4?)Sy6ZKn?d;eYhI0~YDS$R2cy@=z#2)iGwlmL{AoXs{5 z9Z)asqCSGT{dXCWnCP?HO)F>K%4S;TmP~g2DS)6?J~#Vqk|Mr=UtHMpK8!^0X|zQ6 z#t9**-W%KIFFJN15-aJ|DKS4)33L$Dr)#qx$)q5{K%=FIF2}{XJq~v*nrC-44ATG% zj4|-}bPOW{uhAK8E}!k1OkCh#5&{*u31itlgFmeyp?J_DN+UHnH3c1A+>&=?_$Lt} z%t5|`#Ydh75YR?ae#?@L?ZLx2kjLQf5+zULiE7tWsWQ5vJC-f&NScG%`Hpc+j^WLC zdH(0P9hN?^3gT}4hi%3vbeB%1nV>p?&xRq0kZWGTH0JKRcRNF!Hc1F6C<{@dgYny& znCh@ZbHZ0k74=GlRBv;Q>6)Im<_s=EYXkq^z@;0TglG|+#Av@*U%7`}Vo|Tc+#l=x zzp>drzNFdZ?FPGHAjBJ+48Dxw?f5YPj-v>qgvbIFNXmojH@9xGeP&rt=3u12p2X%| z=tk*y>~-{>-p@bH@Dr5368#wMrVBP!xCq4WZxjH`a1xqz`tHRv zY`Srui^y5L5u^+Df<>K^UhzJH6TczpeUfb+jX6NBNjcQeUa5OMZZ8t^$z;(fN1Cu7 z?{^dw`oF4rr~R-T)FMJ5NVUQc(DU?)YK=Pl>3uVb zw@PO?7?Z!`m;T$g^YhD2ubgGWZpi!JK5BewK$rg@k-U8P8EXKiXP!Mb-U&^SNjm_G3ZbA|g^{>maA^AF5bWzSp z>A$Ol@`TEQ5|>MQMw@2QlhwpJVTBl^|4?G+eQ9DSSuESDi2k!KD;X!ztEFRLaOO5; z+wh;i`j)qXz7@!RXS!%##U-u&1!@X@>4++jh@wjVOV>DJ=K=KYd*I=m^tdNX^L=rt zQJMjs7GrbcVj^PJEx>j?w-ceGMwJStW7Ly~+*bGrEe%O}Pb^K^*tqI5;p>_HDX?Ie ziCO=T%Dd3d!L#<%r*r4=i>w=diSUR|5dC&UrqTi zEg5-niM~OhS(YaV)1RXm`{9T*X;*Nomu5`oL;U#)ogbE8PZBE`+2bqyom~!jN{6pv z{)F9a;qUr$B~2)3k@OVWM)E$K6b}U2T3yu>NdL`F9K*V1dAHhi00A8cEix#fzMq67 z)y^Uqlnx|TlBbKX$#{ur&D_Y!ls4$G>*7X)E5i7rJGr^3%UEfTudZg9X)oC}C`dty z90t#;`uFr^d+&=;*uN^G(1K4|WJ;Tx!M;KcEA9>s4u{I{=+@hRKau~f6op3@+Rb|D z_yB&|_4W0Zf$tAnr70uf_18>VsXp}`X!<9hz+Xntk|%*86f$6>gPt3@X|Zm`jfEOI z?!te^yjq$l8V4xHpWyFg?H;9bb!T0U!qAND4buvHn`U(gA;C$8Mu1?BvI9+wc8nKS z&$ELjY>bz{u7|NH#|n=P{?bKq0i9JYOF}YGhHyIue+<4!gOa!+MnlVtF^ut(xGusZ zsmYdsjeNlyF?EGo-?N2uE<&GF9+!oY{$t7Kxd;jJk6W7exvwGomU%(2{`P8j zAN46JfQ-GixmnvLF?gUL68F1jcfiMU>qXnz?DXw&Dl>=F;<}(8{nK1DF7szT@9V`< z%q%49Sg~Mgd;Uxx@0R7|Rvj0Mi5#zw_FN%fwi=s_?oJ1{(eCupe09Xo+N{WV?GnvnqEx{OTf_V#bQq zj|Xl~C=pL(UT?V^E^F82gO|3!>Jh_%rrR9+*CYsviHi@o-I@!5LuKAgy+9Fo%-;C$ z9*wjjmz3@&WgF+k#M8K)`*nNV5}w~^z|8mCtR2HdZuqhlDv&jU-VEvKqVq$jz!wNE zSpaOP#WFqqUo%z#fu25z{-=QU z($XUU*l@Nw*XVXKZ|zQHg1nsHqj_{xOA7j9Va((@K ze-|D+;P@B+u4N-%bi&}0ol8Xyo*f+>&F1&0S+ZqI|62l@^;%((Z^?nF%Hbp}Acc>R zhVO?_kXLBNUal+sCCiA1!CD^isfr=`%FxWs%GcFtrGdBsD&~h!A~Dm&N$o+;kGq&; zgF}bat_=XADu&CQJ0a|OY3SvpO^Y2rFoIoKR#xV)fU?ri9eVu@YabNeEGy9q-N>kG zg8&&~h-U(@YK@J_Gsn!?(w{M|tmtav?#6vMRRfX8(JcG_P@(FSl^(%tBm!B7;wT_kBv!`2`~*`FG>fMOBK8}Kx1G2qaR%a>(DpYuk{^tB7R0g)-vU(WTi*~wS!G~y zMid1_?7jrqee23l_{1tn1WLfe>y8P`pj6Td1QkJbW*MZ>|E)+F{&Nc30gF#PL;=Es zXwjohUIl@SX* zu47gDjaQwBHXbw)VaWa#+b-kid7V#Nci#nTQRYZfhEht1L7Q}a(Wgtkrl&F*vZemq zU#hpDpO#C*ai!HCr}euIWp;YF-~w(*FO!OL=C?pDq8Q3*oMaXrh^4SzBZtt@%4s}I z(Y`b^h0%64XCgrxa@D!{w7GXOk{WZ$a$j3uei~AFiW`70c6DW|2hX6!z<66a8X6nZW!sq`1qM57 zV~In9o6}<`4+y#6lCq(HNoGz-thP*EoE7-eij;KH(gA4_ zW5+6c9d!a16gTiIZbxfg#}J?3uH^&XvOMVaAKY8A^HXEMOCvuYe{@)|nYOg#Q;QZ; z@`xGJSH5&KBB%{!O-MUXH#}LKSo5hQd4i{a zy>5>SJ=i!5jeN?JgP{D=z9lrgul^UTB(jx#k>laL=qK#wVNL&X+7bOT9E1!cT(M&I zYSJ$o9bPBLQXvK}I&I~g!IpR)MXoW^d(P=A)4=0Vo;1RQzT9xeGw;HQOYqoc-j)%6Q+pU>&6$HF7Apyo2nm$v#bshz$NbKiik$0LzH`|OpZTk5X^Is^jX??l1u5~z0Ety(5`+XA3e7Dd zKv(8BO=}+n-J zniu+$C~SJUh6j$N2t5=cc95qrS)~_(NBqxy{&o=>l6Wx^Yd??kW(pTI0|5+(R5HS7 zPmsL}UKA}5ZWI!-8yeqH_I$7~fmpXO8LG|e!AN$&ydRnTS*FicSu3mA^=a4^KNNeZ zw!VZay8|#|p1uaxowdI_aPHNR=(qbjer%n~XCjQqYBIG4>^`z?r1_x2(v%#iUhR(C z3ATFFp$HK8J}isK+Gx6PEZ17yEcV_$&K9AauBOjqIv?c^#9ze6FqJnQdCqi0y|gy& z|FkNE>i+LDXSyB-8VK&QLN3Q?n;Q9AZGI0p?8(VuTbEO~?iVYF-}n4Kva74BWzgz8 z>;>yC@;Ig;`x(#jPuRB5d4j5y@Xywo{nie~uL=iVllMq`KgRr++ZN|q@7C{Hn_X*4 zI9=YB=bEQwzGcemx}UB1b?Gv$x4mDTzDihVzHCv@IFFqft&v*?_?urppZ!o}uSJg= zDGNJ4d(ktK1A89K11@cR?!0n-5BrsA!N<+<*%_K-HbskPkJCe~v|IvwKbL!><**uS*Wg^zPgby*UcwDTn9Yo}P zoM(4$u`*BomIteR5-&F*XEEu@;U_1g_kijIu^1A4f)0WW3x)|gKRirB#({gjaBnSLV@@@Bbw9J*AkR2w%{DH+d+8`zmqq`6pYu5aUDE*uJ)+AEIx zzL$Ky@tiiGS}nH%n41iI?!=Pdo_yc?&$c@B`9pP{h7{LvstYyB~S#u&AIZe8h{P5!1Ul2jgKS3#C?4~L(ZE8`mwVqR;B!`*l;N}%#Wx4hA zwO)?wM^<6qFa$M zh2rOp4iArdrQ!O9Y(6KwyrYYYT)bS3uGW^uGyW=J^muqmjv$2KpqKd1C_>kfcI&gB zYv*=;Jea3wSJa=)CY+7P)YQC!b(ZzD73%4g9~5yQd4oAvvmP^ zcznn6LkX_M zzB%rJpZrqs`1t+&ZweT=?H;NKw8az=cdQP6ep`tLt7I@efE7ELtq1ORu)nE=Nq;mEmez5Mw7AThBQW) z=U+R8Uw)PKsVH47udK`*)g?`PtR+lcseCodU~f)wo!$SQ&%wvFg+E%y(b%vLO>Sl2 zxK)W|ZhkP5MOZLqC!ZJG{M6?=B;U|b$7O~o37Cu!`7YD7^ytiH(sShP#6*;6nHiWF z#~CqeRqPlU8RZYvHLjnGmzYyDRO66>H$xtnsHcxCXTO1K?bZazaSRxfa1KiFP4=9Z zBB}YgJ#@41Rlsw}%|}3_N|xtvRFUpVCUhuc{g$Q>_tu4LTqhu|@#biHf+cutHSF15 zsoIn;1qC`W)xnNKe4@u*aDq0;i-iP<*uxK5n#GuC_v6X(bzHc7iV6AT3lmN@Bk95v z;fe;rg!~yyDpG|f4#qOcuZS~JhaesY$=3({g!nV0O@^)tB4-eTB@@A9Q5oKW2a9?6 zx^52+)s`i1o)>P3dm<;X|!G6Av-nXmFY2Sq2Tj3V|R+OQTDPucEd% zpsUCo*8=)^BVGfh=2e62oQ%Z)+XDcg;t+5yywM8C=#t)c+(AAnRy+ZpAnX4X97hsC6SW`uvSv)#}ElQ zGh~|w831vV+-z4@10)*&&9e+pFEo_%o2OijMl;ug)j!qUaWn!*G4vZ`WGf%Iay|eplXF`(p_aZ)8{9VRHmlryA=^%5LW8PWp_OsE+A8EZFe3k-izB{bd^cF!;Dy(f2`h zb#-S`A7UO=oM8C*^Qk+?kKg0`!usV%aXp9eW$9j_T#c;L`F1cro4--mo8!{e6dDU^ z{Mw^}M9{mbvhn43t_+nV9?14wSt44{nHXb!)R~wV!$JrvYrN>Z>er0EQQdg^c(*<{ z&(0~+)EFt5$XcrP7+4*>oueo5N=`J19$NBBw*>MEUmT2aLbIs|oAnKN&I1Yft)P%! ziQuVH;RAg)P;EFvNJ$NiGC{fsMM{Hkp-KLE475-i@j5E_;7?PIw8T*1(z=OIj>r)a z%MZuLA#}gt`_VYi55zokQi3sQC7?ybyLedsxRFqUSl|gJX^OGRz7&Jdd|}xj;l&>F z<_d$l_mX|{un&Cgt$odn>*}ooyacn|sYwCJpJ6^>|V?*L$qI181+T*4PA9 zaW;6bxgze|lY#T`acXez(6%{oczi;U@x}hDBO(MEUc&gEGb$|H{(gyfqkUwbF+5wk z^u=0hqlJyE3zN&qN`Nv0PHtRGY%EH7iaxkniLL_Y8lujL_RsdWKomIaKts7+V|{&n z6Lv&dM0V64lFKc8(NBF(M^~;)zwE85$p`H$oNb+7j}B*^dOG~zoX1L!SgYIWW&y@% zh7Af92*aX@LzrKX{cf+aeYw3^ihH2M++CCsP(*P;Yr` zY)L`@K-%0NPMK_=7GY;+=g9W|Eiu^%3VwUJ2eZrTq2cLU*(*}BMVf}PbF#4^fUp&9 z*q-*l$#YbdN{5H1Yt<%%CNcPQe=EofE&!H*iBZUJgH0@8R3wNX3l>9$4n|Wd=#trV z*r;1FaZ&udeq#TPaTmy~T`^aZQ;4xP`z(NmhmTLMPB)a+-o%k zR2e$v`zb&r6l{bC_0%+8058K@wyaL+Z@)Z;l{LZz1tMXAPQ6v&0NYZL`Rvv^xG61g zOeEyXks=2p+E=cYBk)-}Et6)mVp>*q1Ul#-{kI8wA>)YknJpdG4G@^r*hrJWa-}tG zq0m4Jp;k@gBh<+w$j;5no2}6IN@{66^p)Ji&W`b0*&%&MFkDd7Vv3zql1hqMePg30 zUGm)A+&be5Dc1IuCDLMpJQ_#;&;d$sAbd5!Dhd^bxTt(C7H-SO`4wP`i-&g`?(-ZTFW-~#vmV{G>axm_hwHFmgSP`fkpp{gYm<_QXip20H2fq9 z?qbvgxEgJb*I`>y9vu%M!0Vs+VJ)>W?$aoolarH`d17UC=1Mf+^!NQ8E+qalVX95l;4#jS;3&w?WSK!)BF2}N{52jZPXTVc795=HEC3*5(fg=XZc$Okfo(dBx(nS412I|FJoz?tjZ&0MKhAfAQ{6P z>9JRwkXSZcD1tGq#_dR}zU295 z>WE%r`BK|icUWMs@_R8~ddOT^e!Irtc6@*JqDkglme=_i9r+F?Uach~vrFXd)2g~u z-1-35`OtomE$o5=9G8VRlhGvwLor1WcG{p(yh+0d!;ut5#xuKIfhIt{{5nT(!6ZRZ zDoyzZV$B&nVS1?P+84y*c(_^d_Jb~nPyR1eHj|t}0v8`k3?9@qCl5v!JZWcpyCB_# z-|JQ~cyBuW=70qG9(BDl^K3P|q3v-C9CmaSA{F;p&U_6nzJC72-C<)j=Vf=leWj74 zSAdBfB4-|-HlfK+754$m2(C6Ow_C21d{UwfV9{9E; z#WbQY9T$kQ09fp0@oFb{W`sFAHQ{k|7b!6%k&rD8Gxlpij0hnVQtZ4X{3qKLlyvnV zIhY)1^CfpmjD$qplw>(-lj<~;{7rfU2nkX!5@ha`x9l=w5DA=Kf;!p33GiVMul7-e<$7VNI~h?Oxz^7^FrAnr3ObZ$o>XW z+eApC7pGFc3%rEQH4q|Bb^4t`11UyvvFU=)&pTHXCoU>M7P_g$gmbXJ z@7?%$q`sI6TgN%wlv@8wvdNi#!%q;J8xORttE;QAxwla%2PY>sbkIpk{WUr-)a6@O zO@hnkSV{g?pXss4?~OjX9v&0>V@Iwv_4RH}Mkv(N^mG5G1;D@Y<>caOtrK{7oC*;u zRib06Oi^RVI6hv*h!mAbbRIF4J1EYHi(?vKZ5PaJk8G|va28d`OVSX?SoXR#wXvDr zDbM6zuGjcixC0duABI-ZSRgk!*V^99+v;~PzLh`&<6!m?B%VUW0|yzImox=v_khfz zD@$8|6XWb$b4Y9aTOim(y;=D!yF>_@_(1KFh& zoKOj_sImmMP9KCoYaXb7Y zb-UEnMi&5i7Xz^HcqHMmdh^5~9uQs#9f$?1iSP1_^zzrxW3+{WMPg|}LV})b<_S#J zO+!P91hu^gf1K$THN&E$E^UEy&!@grcl(W}!zqddw@4&%-fD@%e>51?`}_NmrTDH{ z@`9Pu@>a6anV)vxP#TRju)3f@Oo4EGlfd5E-82){e(mUdX}Y>um!-++ZO4@wJ(4$s zf?}-Pj{n8o3cPP&?zV}8__V)&`jk3Ovoi!Bh$s!ABiMcoLF=rwIH|&UyV`E|pYcPc zvsU@N%s+v(X$ZzR8~ZW8tu!!3%6JVcao~&Z3i&-0aV*xC3Vx2~PcY?3JX~LOf7q`Ft_n0}CnqOQPZ%(Plrotv^}1%c=> z#)=cm=%2Q>N|p`tSd&NVJnE5=g=N4h<>hCQT2biiu#nh}vWFswpO03W4`xe$iHpbM z;-rG>)>Nh}+1dG9tLl7@XAzHF-GT55m+>MhhBygBNQs=WT@6i5{RKh-0wBg-`AdUE z3@-q6ZLnJ@E-66_g9QDA?LIbW4l&cXjC^J9##^L{U79>Dqh@ZYhi z92-;gy?6-_WM{{P&cmY3t=mqpB#5w*N2gUF;(x!}cv*9Jo#Os@jQ?2SUVr?PRG_8R zU^j#p7=xt|onrR200;DFuT2jHsGXGNpWSM z!GIqA!ie@JlU|1a8H*%pv+;mzT=-+hn**pp1U8mX$iA@FYk$NGRnxl+h9_cU6tQ9j zTo0u`%1;`Fn?*xgA4qt-pNpu?T=J8JJF6V8w)=*v(~14~@mXz*6tFP>~4OZoJL>=Vs%C!MjXuQ;zASHOy*dNY}dhVwFg^w}%xS=OJlmS8c1y zWJwlCQOfNf@wuJ{?XsyA{#f$;C`3G$+odxJo<%k;n#cYv?e)kBL1wwFm*7tCm+iZE zpLDg`*{!!`K|cis^OX$t-7Lkp_)edr;cFRMa~cD`Jzpso?}3Vr&i9i}90khkQGK2V z8LmuG^P;5w-@pW--}?ToyR0`clDYFbLsvN_1WgPEA%VT0VPv^6VB)q1Fn~M-Tqmu! zy9_Lu&@}C8a2N;rg`$I*rvd_*cPN=6#J;{M61THr>GnH>-PYEVcANOP2 z4(lDbiWUV8F;Wz&Gc&-}ARruTf`c>HcdKc-L*fT3{7=8Phky^}&YPXBt$focD=4I& zm_&m9yEGTCk1HGRTzRX2RlCf^!@tvE!~>f^TKIW3T7Q z1$ZZapnPujetT9FZo-QnF!-2$y59$`zI|`TxFw z15h)62|xX^RkfLz@0hXpE&>gS>FHmpd2leU4EUtl~v@|-GE2bfake|2@*clQP@!a>L+UhA|s=1b3Ej?;h~Qkp$p7$D-Ea>zN2!4ePO@=+osORVclln7DN9#N%ftJ#OuMnlUCn5bQN~p1kR&85 zNN2M;J6UkogWtvj`V=Y>IYFLGb5o+h@p>BtM&x?iUH9PNVE#XvR$U#q&oS%melMFr zXGBo2MyL^qTnLbij00s&mV-4!<*}8n0_l$QROKS@TW~rEtw4D_BWYh)nrbjPn4e1) z&|$!j9~+gkP+i&?Q0RDB2UqzNm=3~dhDYs1xsqqy0HOg@W`of>APK0ttWGCV#vUEm zZYfsipC8(eX#rVk`s+1dhk=yytEv1SsOJ_Y${UQ|-!B0krLK!^iO-EF$M7IDhzNpm z0JutTR6~fsGm(5EsM_`JIQg2bwYb&edapDBdUgGy_G`r~!ORVeA|EJ_ zc~wDmj{mn6yj37*)1%``_EoD{7z+?Gfqj^whUhZ-3g_!GT-yD^YY^dbX~#xo%-Y-?yLx z`F+_LS;XpywVaV+q9bp*3s!!NZ!3TG^s>{^)ic;ii|-q7!grISZ^GuD_I&AbmR9HT z>nyY(r741RouwoPni*9~)hcLDUi_!#;&vo>$hTj`gwo|Ci2!048*i;4D8pHPOdfxy zMAAbS_6Y1nlZLMgjF|Pt;vb2TD zcQZ3rORT|h&PL8gb94v}G_-5BBSWK#Bm+iCOm~5V?X;LhJuP$IP9FaHt~ARtOAqoC z7$v4u+-sPAEm@aeBu#*xJ7+pljXGV9y0GE?71+qV9!Kr)G#Bq{%?=-ErXtvr=g9R@ zbm*q1r8yQP6z?}kkW-T?4U=SMUA2*>+SD_QIAv8O3!2EmYv9IN1G)@`-_##qylXXAM3pTK>4U>TUibXVO9ZO7Y@WI&!!W8k#? z3IE%o7^STw9ef0YGuhwj>Jn2m>R;8S90V@Dou_d29EnJ+@yv|O9Gs14Tf-{KHor!| zpF~PYi>M(2t8=k&uKfbs+_2HZ(6ks~%C^&&9@sOwKBCB8pFyA^w@n2F1#cmfRckwk z=&wX^!{tdDQQ*B-I@|=HyZ`1YIHBt#&z77ph-a;W4W5-@9W<|n?aF8DQ6L@{_r zhj=p*J@RBKFf~6<4g;IR-B@+{M7=hP5j(&z^b>MY2BD+wXKqfmhw)WK1ygs@JYS~@ zEmpK$xqN?Gbv12aJ`fKdsTF4e@lR$d7s&T5F^)8~r8QtkmiaVNL$sm*4pcTWGV=1` zB^WENP1l-*1$AqW!C2p}X@wkk0jYn5Qy(=L&nHRpHlziPI1Bs4^f=LP53o&LA#m=GZWJ_of9+NCN^EeOiT^a-A4?=p0{7!{leY;OAJe?<{-%5|y^AR< zWc~7Wp~Lqq$@iuJxn0zu13(m@%ZJ_;M8&Ud;4getyml07`S!) z7C%98<8}`x&qDUq_2ma$UET74*H>eCY*BC`$N<^RCjE_}5-J+c@bRr?#XC7NpN2@t z!^Y!J2ddZq_V!BOzH_2IKh56Oi>3@duSt#I5%feNv8%v7v_q^;sUR_cS1z&#EvO&i zbMbAgGoh-;eP^MG=iB$`g30aK^tf_UDX*OZM`1CsTV|@5r9XinRq@~+uIt@u_Z5>s z-?L9{+83cjk~6O7a)yTUhl|vEPGvW75n!RQt*zx`Jx+?wi+{GJ?UlFpNdbkrQpfpC zLqP4#Mmo3H8&~tLx%KbuyQ{r{UkzFTPhA}tCcMuB&q-&RDd0Ha zLCQFIPkVrn)5lxkqU%P)LBcdbve?ilMLW4pBx!Iev~DUq9+%Lp3!9V%%c6@NJuhto zI}IB#K4jZT33xM8V*IOH`GS_fAj_*PfIuQ1L4yc`+>wPTf3a+U{vZq&Q#(1bOo(7^ zL2Xrn4yOPVVg~?F49sjni)f6?;1OmfMx{h3FE6UQ@PQ($MsH3erh$T}{V#z|2`AB{ z$Y^wKEVj{L@adp$Pn8tQYl%a)fkr^hijjm19UID4rj&z3f974!-ECw`fSr(LE@v48 zOF$zbHuorCX6yt9NaB`zm;qQ6mSg~iWv|AJO9C24-eZbLzzhUnkq<;iAx1OZdo{pz zUWMz=6y(B(7t)Icj23VJMp+mPCz0(za>|&o!x9)65HQSO9w&6O;6zmbK043<#~DV; zB{|nLFyO>T!$p^sQ3fD>EG!i*|DyST?lfL`N{cX<$%^4PAD$@Av`#8FIJJ+qg!$Sr zyRws3oT3+Q5e$(K!k3KP{d4ajkjMA2C$1n_|=ZS5=P_FBe#Zm(p%O}!OPB0lBFdLR!Y9Gor5 z6jeKpsv9#9P{8g5N;FI z3FYEteyp$RYc)ONYAGX=lkyCapFD*5R;HK+$xK(n;)-4J86yVexa~3=oQqZ_s({$@ zmDE@2MN%z)F{}IIgBGPHZarTxdvvyZWmjF`age*7sSk$NAv7OJpBJp@4A7DCrz>#~ zd@+`jdxTJ}5$O%$B2(#q%}nlr!OD_^*{&PgL!&VV*BJN^`&D}&t7zbtn`Abak#GNG z>$4uC%MIiR?XP_B^uF$M$BD^!i%n&_B7lU#V3cVOcMDULirk~s_{xckHT0VNPx7jw zj#6XQz`EL)ZLJU~EhS|_EO!{vko6_s2KhR_JuW6KyK3P$n>yX6bUIz-*#tN+VqKFe zGy>-&!@Ie;i7i)s_N?InUM3ojStf?vqcB!kOF_I|h$55CyI_S3sDLfnOb`hYphT?5 z0O+#ltoH3sAedxdO^Bi)nqee(kq7`v5giJdm!UF?#>a+2;Ic6Od|E6xGL~zD0*L^C z4>W+N_Kgi|m$)xB07Ym&l0~XS8jMq;2PM-0Feo|`@Lm9bG&uEk$Gy<;XTdKO8clq0 zqNk^_uFx&Y23TtH=h*)ca4|=tjBrP{w%3hBrp8mHp|NrS=%6idK?{19tMf~TQkFM5 z;+l9Sl{O0k$mrmjg#qHpbBsuN2y#_26fjFeB36vTJ3Qc6EWq&YJl8vq+~>UxJI+C= zI{uQ^{!}rpU}GcNbeMiZ@Pk-yAW^k^_nqF2!W=ph!=l!jpkuOToL|5%Nl`UfR2BQ!z2ncBwag5Fh zHvyy*gzCR4@&gw;RkZOe% z_uT(ayjjHb#=jDy|@z)4>$ zqE`i_AEwF3|ItfE{v?Zt1e4I;K93!uuz`}vuRZys1S-l_PKvWfdZI?eqFYsmKT&&f zbFmgFbuzq+y_p%SmMC6eV>QKnunHoL0b4hd&Je>+dx=6p*r=Y_xHlOIrz7n!0DCn6 zr7B4NzLx~ZLBqru?ruVr)Dvt$5h<~6DLCu}4dmoHZIS5eMvzcPSMQ7cPanZ+lJ&GZ%zdHbl?4~mOkkx|q#QFLTH1Av%hGzgQ+;HzXxXkTn;_N`xN z^?U^m6B%8_7_atwp#9K_f1q&=A65F-T9d=iTv;cKIL z(m3CBnpr;90T2{`24gE3xCQ`Fwj<#<98K7C&KgJvCW><9GE>#~jRh0i+X_?c8PWGLaw~C(B;N1E%dYc7>7z-GMeKl!D)XZ9d1_d*8yuS# z!Q3iI%fD1PND7xbj;?*^?DcH&&77^&Pa6e~ujQZEqb;=jAtc&+1zVUE4)5topMS+h zRn}4DItRG`F{mI?H+cjK&|pp#_1cgV+*JHt{HClIu=t}@${gA}TYoeiYEy{yvL6Qs z!dAB7Z}B|yHbH!qW6b()UGpWlW{XC|D_8 znfXPH%U~!@&Ja~shB9G%*|W!%eoF~tAAJ(JB?3^wjy!b)uxUe|Y~c+NN4d!Y4<`T0 zdX8}_f~wmt=t|KHCjTTsy8YQ_d(#)QF&<~XDaESEi&3LlUv3fS*AC_1a!Pz3U;U(> zl8}blSA|@5pF|i0QZ~N%VeV(C=3ICgc(NYD4JK;I{d)Dve*8GeTo(|)2kc3c(8}2e zr^=*8j{apGQBuur-l=~1MTU}pmKPuvRaU0Gdwq9lxHCKxzJd0o_&VI-YA&I)$&T8O zn&boxxl8nZWE^M2OKyZ$eRo-Ry`7q-iwA!yrh9AEWyWdN0zKkq zBrm!QIi1a-W{vBIqS0DC!?$0C-<6NyP}2_i46n}VPf3yT6a7h-j)p)M09Sb=DjtZ( zU7A}W7xr9%1O@e@;o2_RnJsb|)?}D<4_pkr?kcJ40zOwMdXA7=1m#+)!h)ydUF3VR zivQicJauq%!2x10!@%xCkR`sd1RCBS3B4#M>Sv18;h>Pb{Jqoddt>r#+4m6jo~Qlr z_ZX^wosA6~v+ibgch+&YNbfg&u)XNB%4zz3Ce2jZOgt%iSY0j9Yy0nPjg9BQzVB{X zL%_92;Kca&-xI0x%b}s4MD15?+v#s()#iuW+$1UE1R&Ao{cr>$KjRue*8Dd*cSQzL z9v>|O0myQ2qe5K*zoaW?H{q-o-OfZ36yr1o(1!>a?rEJ~&8bvA!qmR;`q5Vy^NMif z`N*1K!{p>3`C(Hz`ega`1#0fS&}Gi;sZBe-PByfoBG@Ig+}M8az=QreeV65}A#YiO z-}EPHVY$&mEgs=f)E0R*-{G|P-)yR5;IO#L*cc~E?6EK%IY529*1>L1<1iWLv!qO3 zp5zfx(u=M;8|*S`Svjob?fmaV3+nF_hdLQ?{O2wyQ487W-kwmn9rC!m$g2%D6}tX& z)f$_Q{*_>VKylq_(dseKyBgrU6cw#nPXhu zV9Mq$)l^il@m`Zx1c-OADf8f9s)y>2?apX!o-Z!!2plLEK}1K)UfpE9R_i~Xn)RbC z)y&DMDfTpzAzj(#c|6|rrqLBRlh0hg3o!QDoAeT2N>&S4r(QnvPf;(bJ2G%M#*QN8M~}4)lDXi+mcL-t7zkqEeWLMTlx2mE7duE1D*LKwZlR*k zH7GEG+r)F#!P`?uq4`w&>#|#xP4*-{MkyJ#sqYdHl|B8k)CSLQs+8fw^Jj)-FKRV! z@~Qs}Kk=`WeL@4Pui%RayrS8yl`4#eEKmG7S~FZ=9}{M$VwjoM*A zSX9-TTfkutnXPiCE1+3O$PQAo~XxU!8gjFNq1v04V_{(w&1clh+dJ-C0fHb1Om~Nsfyd zy*tN@+5xj>Ma1TlwFu~^7n0%4((pY@RZKN@ZTRlaucV}VXy0+T)Yz&_ z1BuJb#E`&ehGK==NVSWdUp@{PS#=<)NeKWmk%?Im&Chn-=?w(UIJ;tJInmVZ66! zDE2|2ZP!)X-N$L$^YTooLtep_21J(4m4y#({@~+>;(5z+GksMv-*jOp72=Q$iZ1@X z0*G8_(p)ZDihhosGiRp%v#LhD%~-`yh8HTSIVZwUvjN#knJr=XMG&r)G{h$6ZVm-j zFmIf(b;Jg)r)*Ws0a-fP8r$oo_L!WQArFY3) zis?tFEEUMciejcdQbi~J+5gF4pfHHvse=E9Q*~Paq`K$~01O;Lc#9vp#`YsLf?41i zzolVx3@jA{lAeB%xI6Jh*c^)wp?7!@?fF7(hysCb-59m+h?p@#D0cUku-wzAv?;s< znm$Gu#_@M>HyKR>*WvUjKoQSqniZiI9i&f)L%@G1x`ld<5uY5AXVx!zCNbhl!zhE2 z%W(whaVxpPp?*@G-0%4cqkwpfMD^ZVCahF!bj}w7lTxJ-SnYC~WT_hJ3?W!(fPxtU z4U^WBD*!$3I{Kn%crK%W16pI1(_p%!^2m?uU|<^IXm_tE$W_qgtieo(e5 zXf{gkrBOotdEqUVR;ogAiX;Kx$II2vZY*bACp&2Qf!=;r@+)fofS(2@{gN-7t3eq7 zz_uSNq`R3n`C}pjbv3W%*FzSu{dZq6P{u#N09mk!wXd=(|qg`Q?Ve(+^TM~NCoA`1?Wgo zF5KfCbUY2T1Xj!q8m-W$s#fDvpQ+Nka4cezm1;W8;OV>(+>CC+QQGG(q=8fep=a$f zFk(@QupA*4t$hw)I0zp{&n+t3l~57v%Ft#9qdZwU)`u2cvt#r106J!@B0R&y9vvvF zTcL@!cs{%FzC2BQ*C?I@o&F_XKPT2^NCjHr1vx+4yln43HczZXp?nkb?@!_cPN~{C z3xv#0muImH9GR~|zBcps`h_-;m~DJGwYBI|on=~Y38ibDCH0l~_pU&Gh|Q*0$nxlQ z{*OLWT>-c{M|gpTl1%)&oAe)*YJIwJkJGIoD_IFq5qOz%x7bVDhH$RMt19!i{Nj}I zUu@1FQ8izE5+<&mPx{8I8%cadsqP+o_gR&P4nP)8{5bSH)ku;0e&`BOx%C&Hw8P95 zIEl^-s_BjgnFpczZUO2@MF=YWZ9f{416{s;kEA%^nqDh}Cwy7$V3Km=Du*@kTDSq$ zg~bErgajC|;vZ1+&yEXxxApf*{x?SHJ|{iJI|ISNmd$W^BksqXJQvoV6yjXCN{)21 z61(V<$(kEXGUkg&e(Ix#0pL%dTbwFFE>=u2BSRnml>H{s6bg*~z!F1$ssm6(0+f2> zXdzZ;FmyZ`M;go6Mwk3C-520MX8pqN%ZCMjS5NX^l2-mJ($39&r4Yt2@j6`gJs*u= zBrR8}_doMfh@XUnslS*d?3r$bHp%`=sBVmIrt zyxEj5wjk&|kXK(08@Z0v^Zwlk>jgB1#d8NmFEDrGbRI25F~w?POA#*fhg^=xa}mjg z!$PkV;HA(GcljB~{2zJ$;%7xnX6nuTe^%ZKl-_P2oLx?PyXEi!QPI;ODrGBYO3l?# z1;n+l3-+hyP=(VH@lQ4hOm*T`@mKXlLYuW1p`C{!E+nC2Ln3{U?uu2Gnt|w?AbupE z2EjycgkVK!oPDeHAvSnBj{7=*tq(Wr+_t-VorqYz{O+8M*JxN&TAoI!)iAT2M>BL4 zQ}lvxRGh4czR%c**7$+{tH9sHRtv;^cL#O?P#Zip0TQn`?f!%kTC1itW61$m-jNYp z-c8GGf&TU$Gf|7j(n4p^{BQv{6g#xjj2FIS`1@5lEbj3h%8WNN78>`A6c1;cXnU_4 zpZb5_0S)g+s4AgN`=uPZ`r4u=vss>%_y0bPquL6t&ZUI3&^PG$M(AqvkFSsa=Zit3 z>>F`!n`No|HSG+Rp2={dBGLcve>h!wC;H&`6fww){@>S0!g@>Im{}vj`Mw|aV6HmS z5Hqw@(r}i2CD-{mm^oQdHS~)za#` zMhk~pWK`mqN24+Fc2Yju=dHhAh>Nu}2SO+^>`!t-{5VClr5Ri-t!2@rmy~cvcJ=&K zw4?BgIt)gz!8_WOKSnnSQj1*{g@As5pK@(_*xxUYBHh*8)-p+(>fa0Mr(BSRG?+km z6$-b|g&#f)RPP^}vsy=<*UR34I}C?{=}+RsHf$Im!~Z+jJAw+_!|g$sNZ3$3PPeCB z*+eQN*Vv)32V4y$^!dQJXZuvfasGC})ZD^pxB#vk)Yk_k($N>;L5BZ?^B(O({Rq zdAEmgb${q|oxGb$9Tdc4^-e2(ypu8yZy)j>=Yz-JZKv8?`fQ#oOn_zB+dvc|h=%CKrLc4G@jwirfS;fb{>-$ z^%P7oQ(9!gi0h(KZT}O#?Y9%7v539Fn8;Kst8f{pu739`?<@*TY0)UEto@~aobZVc z#9Hyz&T)O~>GMApokeTRGLO5ut`CXI%;lnndX&W(RF}=*HI_aNAuzCB`Uw&&Bd0AV z*SilY6kJ__Kc-x^CZtwAo^lbW#$e>_4TI$#c(Ol|tq-M6dz`ZR&$9NKiOsOrOjN== z68`33_2&l}k?*b+hXc1H1;xTr&9*_`GC9X*=xF+`R2Wav^S%AmF&_!*c`FaKI z~*$#u^# zT;QG0U!TO>9}?1mU{<|M*$&{9#J|@QAHIb~fWK=Yzrj)&J6)f;J7$(sTV9Aavnu+$ z6%MtbNiHV5(D;@_I+8=QFM#(2Bdd&3aUr&4(LH>xo| zMrSXmKTMn#ju0>vu|Q$U%BQI=heY;1?7QC>9(n5Pw?5Ko#m_l}^3#}M)_RuUhb^KK zmMLC~PlW!j)u^3X#bHDskmuAj9skKjGULQPs2uyJvbEY~M?_!j{ohMyr+H+eYbp;|KDCbN4C{UNtnIu}OXJ4ggetl#1G;NB0{|OUb<>{bcCB z%Qkr0)zLb8s8)W0aA;!apk;aQ1}kr<%KiI(D0!}%NA?V<#?afg+&d7LlK23o*1eCb zpKLq@K{+6cG>=Glqo;V_Z8(oHaE_FfDi{NNl8uquZF#zq8-`5Uvb+W?OjEpbQC6S6 zRsO}iTomlhd0odO$mVO&%ktUW5d2m&K)#v+|0Em0eF*nR){;$w zV2w`k>6eZ4!gA5D4=g7?HpV7buzu#g%jKVp_>(jszOVQL+)%deF9u78Yz`X%2#W(q zN~;5u0xR6}++dfXiUgF^PTu-{Bi5g6PoC2Kr=ngs&{)0*)%u7SKY>#LL@K!u$2uvX z@rM2zzlQ|PHNC>0{H5|hvD<)w68>V3);8B~E%?^&(Bn^BUGOdRi?X>_pkhjx{kKBl zMvn<(@xcT2d`}ustqP?Cw~04Xb5!YTSzMDBPTvnbJ6^c_rszYaK`J3mbWJKs7jy(8 zc4Q7Nv4)ue5dZ)LC`tez!7vLl7m6NNW=GfP-GbWMCcQ3!V!RA}s}<0m_E1t=6h$om zmut60Kgk>TF)ozt;fKSo(I7g8K z9n29B%VHP^%l(uag<96Tqv5{|-7w7+;@SCG?n3wJ7R;t=J>_WopxH;KJoSfG8l&H3 z-6hW)GaOaDwZ{?3U}=EyI~NP4$*9Qc*zXDv3{Ccj7uwv|H3u@ylpGD0zz?jFMz&3OOF*oVY)Ti+x*6YadF2__X18emUeoy_D{MJ21D6?7B-PVT^3w388$0!(`#( z8@ehH@@eSUDjDm)b1hFB%Lmo(QF2E7XY8M|4u8I1xX;8Pc-4YXKxCr3F_KwssP?g9 zMb*Sg^~GrC>t052z}iD=_EN?`((IBJQyxh^+^fJqi!if&iIu8@C_PE8a>z#zhZ4|T zOHB@_k`gH!3Ys;eV*`povSkkwKk%)O%8v6v9U42$yokQns!)wLZI3ljtKAScCi6M^xrni(;BuS-b#kf+1sb@)>xKCL0cn6*! z-MnIe;&ZHIlY(c{pI!)#|Devz1=3aCaj=IlScF=a9XcbFYJV#k4z8`@qWWHW2m;^V78JOs2r_={x z4KG$OKeFI#&+bVp$1LK^$47VY>N&b}Wx8f+D|TrM26vugQyvitXbHZ2LdJ;3ph7Rg zRR3AMF0^272pfalI$PIEJBv(?ze~_;j)Q5Dw=lwwLe?Sjb$--p0+WJRIk=Y%ygs0# z=7sl?gDww=2{4A3+r<-v^C|b%pa9X_%R< z5r{Ith?~;Zq4=e*>HySv>~3ymonL!{a+m-1n>$oRxZ1XRQYnyQC~ zmASbg;~DPQiUtlbsCW$fcx3_R(J#r^j&=@b`6Z8dYMgQt?BZ4JDSziFe1w=AISFm` zgHwX&nK2uPn^=*UQn?EdbXyJy6pEGTm2D(jblGU;b* zAY64j2rWE;;RZR^HD>T|Jhd`eljd#WJA7$mE_bN5CTFG7>L7~5i1S;JgJxu|A%t%@ z`QKyGoMf_SmysA=9h90$q3a6v^Y60t8e^ zgv^5C7_FUVImsT{muL*1U6{slRHGuzMIs{&NE1fj7OLm%Bad-LGYyqFdYkCaLDHU_ zL`_Jp5N~g-cJwh48*Fq~$=n@Hg+xW_4a6xs&<3c}Dv~CE>}Xg(bk)Q!j#K}Rni>Id z+F@@crSCY4jQ9E%Jv6T#+gI`i04PI2e+0-eZP1%TYq39r@V}1sN| z$f>^+Nt9Rn8~1mQ+WxKKO9}=q&gr(aw9NZlp3&@O@;j;P@DW{Ou9It_VPSln?pT_6 z`aYFwaFCcLvPxsL!=SpS>?elzie{7}C_Pz<;n>v=WIe9K@{FgVm5c zZqVJUwu@n!V(b(3El-kTzPjMu+39JSzZ30NYvp00UO?6sjtuX7wUWa!+k90rW^WqQ zPcBi@&ms5~ekdKeEykq>>q0~|X;5b-NapINPN*+#<_&;iEU zuwNIh)3NN7F!PnGT-Q+SYHsSsJ#AroGq~Gg{dLI;^(o1!5SdM!EM$<}%f51Bu8vk~ zP443xTCsYOx^Fxk*Y5_#zgW2!7l0-dC=g`eWh{GZrkwBs`6XG?XeNGVH&F`#)^r~S zO1*j%x+*B+Kr4yJbqR`;%dgv{p5{f3s-SipMN#A_d&A?)Bv1|oxCaUwKO87@05FW)ltD{eP`w%7PsSGU4J zY>uzpxt^jy=&2w^xN^eC+tfB=u?8powgSG6*VkR{g$PDP#CYa~8n?pTLAs6q5AsKn zM564=TSI>(xM>Qdz1k1(RCv{Muxik;vgjLMvqyJ2Oa7hj$VPIS7 z!e)KI{!|9?6xBU(?7!bA_eIEcI3+c@3h6_G<-&(#YO6TwXtIVkqKtTYZ$&htJu(vfz%!`1axgJ>`Xg3qFi8H@Syfn~WEG z3Aqrp$-&WN7VTOf&G9mt-O3@T|2uQB5L`aOy*wGu=I<(IR;1`wbnupU>^hK>401+| zvtyWraMjk5D|5)Lp;NjQkjdsMF_BmVAvLjSu%4-%E2)I%D@l*{AT=JoarmOo+Y1P8 zLGq2KU%bmtRxUn0eKQ}GoJt<(qWha!uOqHy)2LX&Uj8^k+Y!gaT(1lRkgj7Uy_WdIxrcG{E zzV2F{o(=Lp@wis)*8oJCh8z+tQ8RdYcDBj9JA8Y>!QGhiA&hwkwcPIEaI?xZS(lW+ zMzOF%MB{j{vzgG}Q>;a!3+eUeDOVH`YN)THwP5en(cRkWtJN;I@OWK&FyHXZrKQ>0 zD8M|}#h8p5)!Ht78X`{T1U$E zfP&%)`5De-OUqgWp$Ka&R|OZnR4(>wR61mf*m%z=i)?IR0pn`f&8hT_OpHQxSy@?e z6-#20n1`~l;Lc_6^29_6sRwCP&&QT!w@gJlJ8!2wQ5I?CZ&+_mPUz;EJ|*a+nQH6k zq^v*b&#BvHpJ^hg-22@gNx-deO6v%6I4h63j%4V))K5)?qOl*w35zs+voii9p>}fe zi=`kXiFH$s78?ywS62^`Ec{IJCuLRD;D0&)#(7A(7nWfDkWGGIV&kU04;rqORvU%J zXl<|yAm^-*MTuV&IZ`%Ke*~xT_zyS2jCKL7=SG*8myYwXa$F;E_~lOXr=$=4_QR~u z?70hIG(k$Z{P7DffoO(;xGW{xoypnRi|gYNiVw-gZr@qFt1{0H##@>G{{36tvfu1` z(B`?+>ixm^%`8YflI^t?rC(!h{Ceyu{p*SQ80S#^KCm)VOmN#JknoFwprvR+$#5(e z(sAB_JD?*`*GB%Zr&Qt&SU6)4*rX?V^(T`CtcodmU!8EFgf9kgd&nv03DeGf{{a zArsn*Z|CVBj9dbO*QIVYDo$&A*wnJEu#PxL9}?2eY+(g-kFiD>TAb#~;+!@Jmwqho zKqK8Fx;|@55g7ULWAJQ_(BsV;)lW6Qt2rfUY9?=Qu1xjoayvSfqsFJo3{4ChuDbAf zZqLr~$5(MnZ9+M7PhoRsA zf&3H5m1P0hmJuYk?h!Zl&0&O8X41zGAAL*kae&dq#kQB<-htX%;rEL(^BBaMMDU$X zcieic_r~CpbDifH+T4fcNxil>03|+{Z(%U<#+Py^XoLZZIl*b@+L-*1Ftdb6SzuhY zqUdT;hjT4zWi(e-V(}(HF$}UEg|>piL{m0rU}RTPG;$GPNMXtRp2XIZQs*%-l|E6( zQRcy0x%&g7YdBr9?Jug+hw!)P8)?@uh4Q8nA3rDm?lGKzzk}S=4JNL)vpi*fR(&5& z=$lUS1lV*2Q4@2T$_&AHKa-0+wz$&ReCO$}kGeTc^-rokN`B|+tR>4a?o7c%-_pu% zk?fk}9Q;rbXmOHENs1oBX=>bd-pcZRbL2$);4Zb}a7bW8`)-lV#IPj;aY=M{@ILjM z1kW&>lqM7*g9!WO5r6rLwspD%02X5EN z>Ke+I&qh!o7x)yPByhDqZ~ZCW>+pKHkENS=ma7jxaQs@aMQ&ea+nd>PqqT>acTD%7D ziK=iqA=+&O1f7G$;%nRb40!EN<$C-Ka)r9}Sw0I6IX!*xSzkv7#8JIK!(fwy9qb;A zhoxFYTYYG23_{U7L9>SM{Qh_FurDVJBlgzuuhm`#NE8_XPJquYHk^o=(d`PM7}{t`!mfolbq#!G7^n@RZb4p0pO!+8;dy z6s&Ntvj%KWxc^1kfTZYX>f%p6YSKoaLW8aSz6y} zvI`5JlM}!HptQI+>eoiSkg#kBXF)2L{*GwuxWq)!vyTEcbi~B6FLQn3uRp2X%7>Z@ z)=tIa>3pdpmq|`Z(b3ihN#5G3jtDGACng@mU4iFX%@qhTOsK__6|g*rl;pQ}5Stnu z&9UlAl2*`d&Ht)eoU`iUZ>Ul_rKclY{Q2cVyZ_Yy2oibtGJ=Zm^yG|!f`~?90Sz_4 zslxrf&n+*Mm^7;ER#cl0#y4|AVfz1j0qEkUr>9#IGNVY@_ybD%1HldnP``Hf_lKiT zAi%4(lT_GCkg7@UHK-BOQ&WUcXk)qWq>iqB>WN8hSY)_D!cPOvf~7nrYdRT7Lh<+T znAOYzhpp7h4znWAoeRmH34)4ePfGe*B9ln~^&7L#U@4?OEudUARz8%0+0GWm z$|O55Crt%nXR_#DIXNtJcuM84YDVKCgL7JMr-~=6*+cf7E1Jq)b@hCwF!2eta+N|1 zdK7%tGa*C(Xj@-yP$cRrDxBc(VRi9F&x1K3o{`MkVvwKNn`CFFP=uyfH~0f}omfk( z(^6w`MF%I(@;$SuT)4#PHAah^&*HNnf9QRwzJ#TpR}qn`hefk z*w|BL#8I$frq3uM($Lmc*3i)KrIwi_3g!h3bE^459o4s(>Kv>f{T9V9%k= zT(IEnJE#Sf@PZSAsyVFuFanoCbgM6x*1^thcYBYA^U-@bM%un7#%%WUZ8cG)sAs_U}Be%4)f#R;SDi_FxM*3f!>co|nm6VV?Kl5)h$g2TSG6#Wo zR|3{UaDKz}OdRP->mM05+5V?RQa5%^PJ1dmZ9k``guVY-_PK^nyC1G}rlzJocHfj^ zO!(Ie!W%&Z(nuN~6Z!i#Cl#>8{!VDoUeBRrvx7Aw*O55)uFw{9$Y7gdDhU?-4Y$H2skOd ze;gdCb7?E9UoG?J4B~(LncCXgOmB8{mnZT7q_6K);O$mm!1X%4X}#m@VH?Q02%=tX zK6y;xPNhDosJq?K?XaIe73sK8OM2dK<~4m^z2DTJB#r_`dz1yEJrdV{YRkDobm=tQ zpY|g;?7?~Vj<1|wIqW;W!m9zo(J`uduNfHl8SR~(XudG{@;1d#+ZGK#n|KHzQI$h4 zfHUsy0`0yFENSSgcr12u|cMlWj$7UrnF-Q<(ag>y(vg z{0XRuaaR$2PWHkt=NTt*BcItWJ87!xG{riTiNyAhMK78L+u-3o{{uxv4FC-di2V*T4 zNJ_!Y4so1!a(4c+^P9O0L(1GWw@z-OeAk|UrZNyQHaTHz@*+LyBXyMgw_6_$f9Cl1 zKekd+6VvlN!3vqx)eDyxzHxL>my$f(w7S|fG+rQwJ%%r5$wQFFom&Nphm*?!w=jr! z$NgSD56nQgW=7talz-0VYCq7`))v3~o!9Movq}{B`_G^2#e;yeEvY+iP#)jDefz=0 z$1Wh?HuB_pQ>4TDd^O@;Za+FVbF>`=d&8#`8MN81m1!)e_dew)85`b|ElArb3h_ zj0Btt^vctvqj32A@doAnVCjUzu+bl0+>OSj(rbkLJ;uJSAxBPLXmg}TBG*K6tRfMshpGq=xmB zc$ll;XE*`%a0Z{Z^c(BKxpW?$&V7y8+NuMR=-b_2F za!$7y!mN?QH7sNX!)*KX35pn%Hf=SHgusXywic=zHFMHgF-I-&9d>>malUA+bvTRd zS}PFVp`G{KUuwGwQ7P#*rN9M(HDoVsz`{*;B^T#w!xeBi#le;2Rx9Y8=;AsqHp{cX zpV#Yr?)|l}9rRe8jM(?8nRt+-ovnZfARtgM$cR%-7aWV)Jf*iy zQS@$#HG5rK%-8Y7NYpuiIaSPNDxo_Dhlnm(-c4l?k0E6$xacK)Sl%7PHN^|*RG7OShPx4?;W&Aa9JBd*Ks z{vc<74@lH6nkMPC(O;M|2B>`2P3-B5hv{4-SeQ zv>v;;-@i&rN<_Cn{*0a7UHlL;5Vr`XC={n%R#3s*h9K5B;oEzPi00l{TCq0=OP@Y| z^j&>RQ5b`$cV66Sb_QWo;&jW^R)hIUNdtp}ySuv}(W||Kga2}alkdgfU!Y$Yk-Tyg zr}H!xk&+4=$&vtnov@VZvnh?ZmkSsRrdomIFKQq|?Lwp7L?P%<2dl}s^eW%%%>@Ss zFW;UvP#C{{uA`#^zqr4D)!2*>5^xGT&5^zTR;d2T=l5tX0kv>rd5hz0wJJso0`g{m zp}0=c=bx>#bm!W)_tO=oAn)iZ=pR)-3KIZNo;)!LygBg_H!(8u>%^h}f?!>)nV=6o zIXxZDk}!l+`JOp5X7E{n%V!XNl#-G?*annOZDz^EBKB+u8c#c%#i+>Z(oaW=B; zqY!okw@*&cX81nPjgayT47{td=mS}kw|;!2aQ^e>k5P@a8VnOWJyGJ60W(oa&4K!Q zVUB{S=E_Q59v&hfBO^n6gy}Q*3&b8M1SFPD!r=My)#jpi`m-+TcINACsPl6wD3bu! zOLj)abu~3^p0;y0a3kxcO~f3gzETQUt19t1&DCy$H~DPIw(@f4fn<&(R<&l3h7DX^ z@APzA{oh{{SgbWbB6a~8Is?BY7u{J1@={vn61T4^mCM9HTkna}&cDP&^xgv4*AAXX z7+*_2KH@t0{fz!{JFjD=*1RbB7TNj{_Ne`Q?Ok;uTi|gi4!z%DJH2?N$Cdh^TdP;c zzjd1QWD?N^nueyP^jzg0oVBAy#(j>I!%K{c>D3&|AQ}U)SZ`coa8yS~!TafQlOt3p zQNZ2RnH0F23bBH)F_7jI{Laqo>kYQj7i9+5xlfxCA{}P&B5Se3vkq`f7)heyH)Bbg z4!f-C>U5;8E}reT++}4;ULJ2{`xaMBuNyTIbEaE|nRu(fe1XB~)^?3XZ)Fa+O8ph5u8W0abugJ++DJd=YxjC5z2d1?5(Ou1gAr9!9 zg0(Nt{O(?HhOXAi76Cx7o~P#-c;maz^9wmlB`1^VB98p_9A}$XQ&Jq<+>cq+ zOP&^nBAe8m&CPEUmE`&Zj8s>Jx@eu^0T=+cO5)HoH*Encle(sDyX7q)ZHI1!$<6&hoUE-fgSwsDs{^7CGw|b}vE1I20Of&5 z@*DvO3JWi}4RSw|ykG{dNA9jilAcL6fwhvryR*Q9{e8l~3Irrsv))NWL`3TD`uND} z+D7VX_U3Fk+q)W!7q0eR1@2x2fOiD&M*9OyqXQ_Oz>C4FgO26n));D$sp;v6>47u< zf}bD+$7}18r?8OFqQ|r`IKKuf=+IqOwwwA@t1I~T`i6#snJN&eao&qUAurjZcO#ZJY3h{6{!Pc<%tWtwop)rn7V9PzS#$3J61pbdzdkNsTZ0^f%@WGRV9NLm#P)+s2!kJZK&n+wnuy2%P{hM^ z*K;H2F1zV(Pe2zDNm|o3IuN|Fd2syOh?7dRqxVpOPIIXL2nyF;CZUb{P zU7QD3?NgT#Ao&eboH#nb11dboAH+R!+}zS~06u`ok{1R5s_pV!H%J;+ZrlR?z2o{9 z4;ZI=dUz}bTSI*6a9W3d)fBk)83%n(ndS6%tOCcDmj!28H2Rm*9 z>*}yfjD9`M+?mVhxQh6gckuw?wK{%mlPPraqv2HE9pAq1*~3R%uv8+735C;s8;&r!DtutPxhB5}Lnt}nX?MhZqYwyk%Z@blD7N%#DwCjb@3ux&@fi5u;gb@fh=;eEohBLFARCYy4ay*E-`H@DtTne&q$@ zeD}0blR3=lsatvT<<5~ujD$bNx_wD$?i-i=Vt#GW$0WD42?%T{v+lR*DXh33u20{2bG4?C`A8K!5Ak%N;%<}Sq z=nL?;)zwuUB%J1w$H&)Deed4k4dP8anFDw|b~eC{#-*j(%*@Ot_f4@_3o%A2k97?H zr1(6;cv9E+@2apc^k^hgTua1kdd){6;rBOr> zSVBaQ?(PujMM}D)OFE>xq`PbB7U}L#x;NlvpAFvU+Hsb<*w1p<00ERDWBM}i1Ko$P}x3b^Y(~(!p%gYA9 z#_8I%Y}XDx#~B<1gMZHeM-Ou3<&D6=ZqlddIZX;*>H+Wp_BAa8RlEi<_~Hw2oQQS! zxHlts^rfJ>nw30Sra%=U)(3Wt_YP+c5RC@vk&{AaV*p}3_q#ng1KT~);MUmQ{`f8L zY6DQ2m@R+DIUsWPTUoM++Uc-y-uJR~-PXoN2+V>4w7#=*z1rSFtqC~G^w6(WuY$e+ z`wNVd!J0$wql6dA;NoZ@E8u$&i-8Y|1s#K6jF@Q2c3ysd{<2-GEtsDHG)sR2!CZ~Kc|s0Ffed-J_Cld7C=F8 z5nztjRhK^s&=GF3_3Dox1?Kg+3HUEFur&3%9*6~!6*-Lu5nDa5=Kx7B1Fs4^6cx`7 zK-@YYx+{nk(SgCZ!N>Srm-yA$dI7WwEZ@VoSYHibR2Q8Z$<-|en9po`|CL?Adq!*bpLNq^!ZwxhldC7MEJsg zrx0EY=)@F2;t~?h0;z6)0Q=s!$p`Rm$N8Kt(hr0~$rkpS0HFW?<+q!n_nY7mKVrB_ z-&mzyrLwB*E$IN;hbTNKfCETBrZrK&p(6sk3($(dl*kFD#st0)NlZaoQxmuZz~=yn z9$uQ4mseVf2@wz!mJTnBvpfhxL#ZnZRS|OS!Xwtz{S3|PE$q@US zM$r)KSer_`EOG%u1jCYnj4_&QQ5tFVc$(;XZOa_C`rb>ZlU@Ah!n`)P4kw|U#E*db zpT;S=x$KyQRFT_Kv@OX$6h`3ik-9pyw*ij2NDkE0_+i^S3!Hn!a{S$O%ug*}*Lig`DjSGqJ|Hj*$(T?7TaT#AMq=hz;Ar|L^H4ByrCIY{*COBcfa_%6hIunh&R8# zK$lWW($pkb;Zr^BWsHH6BxvlS5`6zUu&9zeDb^NQJer@|vlsxJvUmAZ@` z$z-Jp4$Rv3L~2ZmK~<)<(oz7Ml6H1?`Rwo@CfE?nxOX#AXUy+VKtYBW@_BA!5uiaP^;FGFI_+~%COZQGO?ybhT>@v2ud~)KT!>wmFzq@v_=Fa&3%YCj}|tmAkxlb`d}?w5_4mKLAiy*I>x;ssH-=>$sS+~!~` z{@ZJyQoR2a?&^G~U9=imfndIfe)tH{ghQ6u-PhfR* z695XqEv(cwl9UYu2DB`rY8*Ct95#V-0U>_RP(dD6RAOCC&D2>N zuzr(1N6zb46K)KOsScwo&5G$<5Y&RDEGQ_bsi^^VVGVB~pDek^nNrcv(2hIPq7cR3l8@7b(?6>% zxE}U}CvC!6Mv*>=?K#xGf2lAiC})kqG_^vM4vJq!x_-(L=&W(5=@2_G#Q8(%qR0*vOauKAs&rSV}$Ph7e zM>^`y{uZFbf`rkKf@`|4u-{fjkrRjS1(t+EOp~SvA%Vld)X%VVf2hPvVUn5-(-tn0 zzcVG{1SWw>f()Hnl=g``LAaJe!CZPRTSs0U^DFXk$5lpx1U12!q(A7W&HT+M@)Fbp z(wUZ>$ICs?A~1Rkqx%ykA^&a{($rjfkfGF%8zNOqf4N*jxtDbPL69GL^8Vi=kXrzV z&%U=!b|{>uqWbfgMWDILPNBH@F`@WK)|O94BWOiH1|1(Vd1XMWNvdjJp^T3>#srN6 z57I=5g=`#yM zP-41SpPOVK+iUqR=t&2UKLvlFR-!Bj1VG~f1V`0XRTErER6Vy>XMTWt2WhI}7fuB< zMK13z0l0Gqlqm?SI!~hQwUUbxBc!006rQ76G6TdC+=-PQo0_!vhnz) zYCpzuB;(>7vz`eUL~s(o1~hOU=Z<0@bPOVhs-?R7C9B(H({eT;_|zoldZwhOdZ9_! zeyt5KPZN%roj0wWUcd4}fg0_)Vj2higB$g`O7R1A zZyq2WqM)Gg`s=TJKmuoTh6k%4uA|0=aE5rxR(KV;o{;l%{Jdd zdJ5QlV7Ru1;@LQZcRfD5W%GF!l*2NLu#KV*SCf7qNz=L+Bj^jTS+*68G-!F@=jV^v zbkCk&TNCNKWm1>HHGz_lkU&1|f8A)8l{!2;4EuG{VW#~J2%jDT477gPYXL7TEUd4e zK5M(A@!cc%FZccZ7n``r_a4f4e%Bv2nYt1S3PjCPWc#`w&@gc^<~!u9p$+e4Um_Q= zbVDk{JRa|Yax@}6$fwUlgikF{!!UL7=YD-re7Wr~i0@4kG^ge;D)THXj*yTV#njLl z2~`Ip%#t55W!HitOw8e#7z&Eij94M}E=A*<0utM(F*y(PyZf55AbABn&yUv)D>F*03-5o`+IwULz)If49m-aR^TI8Z?<0t#7?&F_3!ekuMy6^ zC;d+z{+5VFOF@B~01PZ}l7MI3_?Vz}@%L}gJWJ*}15x-Cl=^mMaZy`CqXF#5?a`Fb zfj!_)L;!&SND*PXl`ml10#`A{?F``qKNLL)SN1+l$YEw?rV#bL1uVfP!iyN$0+*^b z0+2QU-viI=gHWzP0kA_lc@vFu4;vr@5i~Q%&;ZWC7ZAe?%GqteFM+B1cA~C zEF=IJq5Ee*?{}#u7^iU#T&y?&CXM-I_FZGO&mn@J=}j7*68mvbKM8y-Ako@DP&Lgn zCN(oXOnR zgXMSszZL)?UoVEpkNi4X% zi*s{LU~&pbw}yz?NlW){rx@G=PHY9-2#8L=2(16sI}ALy-&=U#Yvx%lfcAzO%gbXyNFF0z&xPElF7Kvdc6%6k;eWNB60Ol;2`JT*64)rGZ}E|O@Uh+C~?@N)d@({b$J+YP!CgDAdpKY!qPK?fAJ z5<4$&M4cV{)>9`FCWRkXXk+#2eLKn>f7S8cx`~D;$-Zw-W)B-e+H0#P3+=0buXzc+ zqnWnemzPj9bY<`2uVdjr={pER+gmITYscKVCdc@cy1)*Bl9syZ=VfOxzP-|BKqjO^ ze>EdSM<=r@R806h98;%Lax0ZGS225tkdsU`@hP=C)VR(Io5TS(E+7{|=!K4S@MT8{ zQ&YKA;6h_C7FBAPA6nYuWx=b#5r`?pj0`<}t*f&%PxUuVyl|}J;t(RXNBIVq8tRn) zQ^SZwlG?(ompxERJ`Ytai6Sry#jp=^{_ZnjeJKYqzy3nK`(dLjAWXau_-mWW9I728~HEnip2IZ`TR{kUxH_R!CE!>JbECc%c~l@)%)l)3}uvMz|!~W_#l4!CBN$RZ znYMys)A_fEwX&*e&3RH7;Pl;SpgUjX*8T=|+14V~_Gg71M} zM_edKl6M*|~UokJphf-vTN;l#(D^Q}@_9XCfeAa+4ir~pRa8Ptlz0FDbpLD}A?^2c|&Yp2Nw z&iS#)DOj#eK)!%WESp(Z6~4+N%iqsnr}BBgL|>Y%F0^4S3fCYt*QZ-JFlx0j<8J6t@zoJ zj@C}bK(|nlf8yiLYT4xNwvU!<4|IIKYp%bI#nk8u^}BLAzPm;77ciZiz0bxeZoLQ! znn!Y~@H^*x7_=S4Cl_{jct_>_@WjtXq zn?_z~Ybzryc`w;|{5dNqs2mSzL8zu3nP6rgSJ|RO@rlIRH{4&}=Qa)vgTm7OE<0Lp z2IJ&b7-zq)qv}iJv=F%m5F7A}?S=}3fL6XLGPo|dm`ap((VsW!@`0#@+CpakReFRHvWmO`fO{B=eKRc?O#Sxsdl%*Q7ki%rI zHASj1F)|g0f(Uh6J42@vb30>Q!u@v*M$lT5JkCbT5?*+I(V_iIt{)B?Jo$@s$UiS= zmw3!1Bzj(9THSL#iZWZ-h7G)OQE6yvy9ET_-=raa8XB67M$l#^cs8X+)}$z^jKmcM zltT`TY2F>mpKa{XI$~g9VL`^Ob6{a#+WXrY5?(L;T~wOzh+I$S;PqWpI9xaPYQLK4 zoa^0HJ~WR)!K{5O~zw6rjBnxUsuIpTsCfI4Ujv$Izgx-sgG$5 zd8Py3E{@o6e&1Oyfzq46gM!{6%`gz?;6~sp0|U4#m>dT$3>&`js6e) z0#DH5n92NUodpJ>F#1SO=+`(BY;Or&E97oc=6pm}hJ>EMKk>X+Hw|H9RRhaX9v1!4 zX29-O(sDePskreYBE+jh`9SlCnuaD14HnGQutO|Hjh3p>T>pLD4&Uk;j&jf>8!3tT zfkZ3mL!StSm^@Ni2-XTkJ3*?5Dr5!~BWMmuF$qFnO0JxjoWT=3*C{Ek0DqKKd!n4B zi^@!fJkyhJtxhQAWF9Sst)daEW{ab;t21i$RHpo3upIyYml?i<`#l`e_&?V~+E zdHHl@u~kx3%T?sUkD740i~?1i%FTu(aGh0{#pUx1TqJpRN@ayj=~I6t$mq>(Rw|SV zQHd(&JKjk(D<^`50=JnYA@Es2PA*k~_tV9PS!w$ZZd2;b>|?f7G}Pal{E;DyZ%Mtj z2Ry~a3niG6)pl?3$Zzg{uSO=%j?v_xkcE9(phU}{U#F|!()Fx7{@956HBT1PeC3hi zxV@;2tZs#UXZ-K^3+3FmwyRrW)F1Mn8!kP@Zl%e;7*bgpvdz$^{r;Pt{N1XS0L{k7 z(CBjF^rSo^Bv({%{*CgAih-tNn$;za&}h&wAEDF!MPEv^i-sV-ilrFRIwReozS(QHKA zV62d9Q^}(u_!c~~B17}Xysvh7_SMGe^4S&Ab^quurY*P^(W3`c?}!m? z_jfNMKJL$+1WY<8?BJ_Cp+BZZcvxy#V|;sGSzY5R5!(dAg#CLx`5C3oJk?24j%TZe z9n9%(I5YTpyr`Q`OMb&5#?Rg^PT5?K|6rldB(!f@iB6oxA+)@hzi?iH<}B`JOpW+G zt0g8PdQIeP{Y_{Gv$tik`asbp45ih|KaJOT1soUff<%`cph+Sh2_UvFlCuoP1V4c| z-GJNxwG>*_(nsGDc;cxQmV+7R`s?O5KERMV6#WV09&M^;H3UNi3?CS-!TV^8-fh-J zeRHLBb7&FYBqq|gFO4<}hmc774@-rIRzWqP#{O`97Q{yY(>0R2fj2f~xbtpTPdga~ zd;hWJzlHRTbI`^;t=h!1DikCqc75d%BTAdkJQ`;<^V`Kosbb8=72~CxA7XFrqddl# z=P!ZNpzf{&ugl9JUY179P6(?vU1@q3{B+GiTXUImK{_a05b>Yx?Oi`9Q@@EviE33n z2ET-b^^SDd0&y)ID$9*T{)<29KCiON3{&wSe)bVLG8X4kiF+eGH~`?y=W*VTUn9xW zD=Z`}#Nei`eJiE5Jwk4Sf2Kz~z&2#dP$5e@-33z@9t@n~RD|jK^R+waXQbOJH}HK8 zf8k>dntZr=Yv6yIU|wh`(a~!>XHmAPGh4{xbZ_W?*7BnRz*(<8EC0m%{5i3vb;^b| zyfnP$y*=Zu%_FJ8MHQZR0nMVRmo_&WLgv18b>`Vz2D@(-AAOk_nJ9Vix2MQR->S#v4=oFnb`Ec`crs{)@BL0$SIA-xT zVgOgYJ+5B-cQYOFUr_XvQp19RR{eQcrw%lismz~G*vKr;i%kfv91Y_=+b*wW8=IzB zx3CkuiqgaO6(cE$>`u-OG=5G^`3ZXQ2lT+TCyUwMAG`rsslDBd|pvg zuyw{x9(EAtE6DFA*W|2V!yv2w!4l^Tf0uaDJJn-5fZw1g?ujCs!L_TXPtIpOMZ0y2 zJX`0~QTMygYfE*?Zb$2pzwam`GN^2xupTOErd<9+b6z;Ta+N(foP4s5`GjS&iC@nu zu=(8^8__{J5W&(Ji$v>YyG`s%XelZSXuWQ$J}l=kh0aVb)*Sx z!C!Y#iN}UC+%}uW>Ipk7tiWzOK~UG~Mi4jes_#tpk~4ZSY7b|p#*EeeouJLMv94x) zmXkHS3 ztfuW(%fj}`R%4B8xRo_#O=tH1?N~ZJG&;mlG}5&xGwCCHix$lehdV1trHASsSvId+ zPrj-hPxjn#PH-Q6e~&xw&`o}L`%&iI`XYzN8#L0&)+zIvtk>)b#aZ||=>v*+y1uC& z@&|DH#w44pdu5uk`j^#U%U2G*qj*c=Evrg?%T>b7w*uAiO@p&|q?swsGG+DIS;y-h zv*d!Vmr)ZfMMQ$rOS)D)%iQ<cb4mcSEVviYO?Bt zeVP(cohfVI`&bM}o*mtCaOdpaTCP`hEMu`5DEyx<)+hbHyK8VOm3b5<=WMw$=X5yF zAkuSdzC>hrq*3XyAQGAVZDCiGi{HlMzNOyPpZ}wAYu0tL=(wCayIvRG(!G#*YQWX^ z-Pw>drshtbL(b_!&Y}jMbU$KA2Cs`}5oObmVChKe zw7VNYb-Tg*_@K*jJ9jls%ZJnxmdI2;j%u=JO*1TRkIiL1Q^LL36$E+8f7vGWE>O{W zF4;B~HE{;=5VNoQa7K(rG4M!I9jqXyPSd#Ex1If4top@*mFv1W>4y3?t?nr|eg;aU zUCNbr<%e?h{io7*0hY=Q#k{P1l{=!7g^SuLYyM%2uM>xHdD+*$Eo1Q~oI*qQUDFI4 z&=2E0bPrgbq+PkT4q*vSDj=*89o=m%!mP8_w(_WXE2pbdZNVv>=;S|NVus2n0^mvKBnRn%4KMLAV zl=p9JzDcdN{<^*B`fDIjN0BRgj+0>jF*GSND=pDuc=vaz$4|onCta8YGfvZ}GlnXR z)KCpcj9}_7R2jMJt-0;$mvL@AZ*3N?FPo(gCI5q>ic&%g6ESXaDpmH%6gj!Eks8^T4?Y%rMsm~!UlL_C>O^XA*Z@u3|W zbjmzBJxD{Gj$C^C$|A>OD}FHW4~X70jKM9ySr_R;XA)FCVo6v(#_b>vv;s#9~jK_l*(kRu0nO|K;GF_ zOLxDXrS)a+W4}DCRss{7rX|e?ZTZxeAT&!%8dGg^*%Q|z*=ZDybaWTUl+tmg^8^fL zM$~lvC*()XlMHh1#inu-Zd-jU8ZESE$P!YS&dJ{+>L)c>%j3gLwb8qnMaVmetV0>_ zg3V@UM)f}g*^`joC`=c8gqUfk-!VpzQm1uv^+iAGFUz?}OhoOSSL2Y9E z=Sx(Ja||jITm@!skkqY{q@9Zll!rz@1#UzaQVccC^@=!uga8A5m_$-4OasEkA3;bx zc#tYB88>tw8AW-VuMxvJ>q%Yq2@`5Kh+RAU8eZ6k8vjFB5*GCr2!Y8_68cN!Gr{}? zC>hWa4dKFiq#K;Ze9@$YulNaaaY-2-(R`^OMrm_Km3k@9k32%{gj(w;D}@~*W1g&4 z>kP9j?Zp&>wK-Ei5>I{F$F8yFWn!Qqm6+)~Wx2j!1|ON2x53nq$}Av*4)O0sSk?m91tFYIy}ynAt=OTm2P zv$J&;TIF%Eld(QDHWnrhhVlugDJrIb@xAT(_+5p}7sufb#~l4*056GHrRAwZjvQ&JzN2Gi+Tb&XO+k5nJeUQ_zpHp@C-E1|@+Ij9 zzX}*Dz!ieKs{@7dtSl^9B0ip=w2hC#Re&;K5bg&ct3|d)@$%sSnKa$x8MtkbhDZ~F z!Om~)z(2OPw>d2)4nUHHBaJKOMZ&NtsMg&)aR-zeg4W6o?KP^N#}UsJ31R!y(%5+B z_4u;7s`^k{kFS$w?5qQYCM2JX_0T}X>!RYEmQxo+6NZ+%5%qQTXlW_E(W0}Hz~rxX z6G*}W;uSm=YfVj=eMwnWIXGGV(CMlF*!E zre1P!xXep|mtkNMr8%u%ZDDKI`!Wbn%l3MT)$@QVT>&?4$z^=3F-sVczfk|>c&1GK zCIw$9LUn+SNT`-TVAZ!|-tTu&LPzIi@GMhZC{up~!)|N^1tvU?g7uN7g}$fJLwC}K zL+X`2OnQIto|>w%5)a)Aa`0Z{-}h10$Z0s7@r!TslhHvj?^gIdPuM&3ME1F)dcxE!j`7S9zzq&f z1hmpLvInUkxBXmC+w-Jo`X;$bn=0BXt1Y$S_|Pre<7n#<@A`F5S;__T-*RKUw*$PO zCeMxPVWP+I*uCNF)G>TucEj?dYa>P9+rwl1r)gUaxE4jqbnKxhhLfD8<#=X$<*h`i}QBZ8?fA^-~n`gFLIkm`s zMOD>vK!FE8(I@-c>XGdxxM<16G-9a!a`KFTF34%}=Nc$NdwsOX`}C3Eb7=h8(N*Kg zhIO^y#iGR})dKJH?8_bh{wi#zA6-c1h|FY`^PR7sk5Bvjev;WDTauaf(R$|ts8tj8 z9?v_oF7HSQmm63#<>S07g3zO##7Lt=&AcBk88kE;E zr3(LmMc%!7Gnpymu{Ctwoc)E{x!`=(859^UEG_*3Hpu<{HqGzf!Nb`-)m=01y3^=9 z)$Pu;Lt_QD?AV0hZri1_Dj4^Bv}&#M^ZNQL5wl1@ElM$6Mu!e;)|BIEw2Zl+3M?t> z0zb4@rXDnL@|UwlQ}!bL4&COkS&P66dA3n zV@B#DdyydDyv#D{B=mfcY;e;Nv%ACdIHOMS43~yPnw>m4-PvpT^76*#&7z#h^Vnx; zEapLBsXGSAMZyg~)1Mtj;iW1v6z2fGwcrgLu47=p%O9C<)Ha=(%iqTEc7%FUin`HL`86n!i>YD;{~H@Q%MRcmcfii7@0DI}&f^GUy^x77sX=lOj@=jiU#5$`Spvxy z{iUB4s8TM|a=)i_B6zmqeB{wg;bt&% zk0)JwOEsbk2^JHm4EZOPtAf}t>7hMs&3>k#tJ!m5oV$}RDvk+tzb-6&d{&EPUR+MJ z)cwrIZJN+>UQ{_q+&1O-?KD2ES? zfwRX)5i@84fx#9P8_e?H@WZ261Z4wAnz>Wym7nH7J=FtIQ(H1B^YewS;Lq6DQT zucK8ok*OPLEdcF+%s zP3$j48lQ?3B|~iPeG-{-ca)&qx%-}q?_?ljbgw9s%J*OSrLd>($Gi2r17*>Fl^C6u z2g4{B)%;F(-)1+iE1M}gPZl1vI7@wkKc(bi_*tA1@N&`_>sy0$LL5)1N4ae!?3o{` zSFdFqBxmBB2 zJ%T;JL+!CgcEPrTYO-0$^vj4IMV5-b5R4B(B67iFb=>!z8F>Gj>0|jP)cb3j%4hW4UeuROy=EY)jA``icso8# zO<>rT$g|kNIc|><(X=QZbSOQIIRlGypV{h3;n+=}N;0L>V|r?_;TE#MGi=P48X!=1 zPLNOA<>!>ZR8WH@O>)BMO`*R&p5`;R$&xa7td)%nWhTt|#J5&pil;$_h4M929EwOOy~C?lmjeKlA(HT0UZ zIoO=eU3RY1Ho4|odwoof;)u}x09l#_9iuqv-I}3~&%$pv3CyP!P-rbj3RMC3vz!#6 z$+y`9mxKK8NX>Zn--PYukyENhv0r+?l72qbE>Tm&K6I5Uhws0#)EH-`kV)_`88zhW zcNaFFs5{^Y3mlltXMV%^Pe)(h&X=V;)j}5|^6h^|i4v-T@AH#*()XyIx4J4?@G9$J zLv*0Ks|+K3N>SHvevuMH>Ne3VZuxMUAbnm@pX(wE<&J-#WM=)w?;*u)^)ALjS%e>q zsJysn-pX2A_uHYmq!RiQAM3r92Ws9zsqW@L0vZ2ElnthU1QRUm*D$N3#pAOOSzfi9 zZ>ldw$yizmLaD(oUPhRr#9w-GyWw<&MXg(~(X;Z*6*rgiGs?+BQ{S(5Twv&TG@|6FQIahz~m@xd@ z<;A{iBJPCe`(We=k0&M#-)6ZAxP4);!0s-mCYky*#|iF&(HT)|eQT=n4)}#DeF8z_vg1b4bn{BhItod9z>ld$OynS_ah~A0oSSx;67<}&Jtj1{cJqDI(!SfM zTK!63ccNhFCHA-A?f^@}3m7TJ-E%GiNi=AF=GBVyM%#LL?T7#+I*pWT402*&f`vHK z4)Xw}YegCy@7jlv`rEcPs=#X1TP{*ii)gqj1^2Bscr0C=K}!@yLz*dxn-znS5N7fy z#@P(N{<}I_c|fPvsbX1Hu69Ynph_;E-(7e68vBj6Q7tjr>X=0gg&---&RQ@1(n_T2*E_qYZ(b$1 zB`UK~AGp&0dakM@iR|zF?MW2x)J@*bUAIks@@#fI6<;+RM(5J{o^;RUlnl;1NroC{ zwa{Afr0Dc1e{tPR#dMkxU6%9XiQb*}#3i|m5%)dRiF-HtBu(>9`ZPn=?T$sPIh36> zn&$1n-diCSlg~SS%Z_~pw7mp)*-0$Pp$MoUQ$7BdZ+j*mjA1aH{P|o2%cCsxG2UFWVpLuSUbn9QLHQuI}15;YAWdN?DX@XeD4dfnIW=neoC5O+iy8vt9rlu zu|c8nP3>GwK*jdAx^qij8_6t44T`S$V}FapqOB|)lMhQPf*1jA@56fz!U#;p7Ep}y z=ri=~#<<8w3Cj)Nmys>96NZw>Z}_~1zLtz4Bp}5icizR)3%0yY;{KRnV&zQFsfnIE zHX~G?-o9)Z7)=@EY)A5E(!lTF>{9s47yA~bxzLjAtHXzFKcTkj<&Pw2xQzZ-xR`lr zTOue>3bD-XRe}JNOcRD+TEZ>h}jG1O1Ak72GYjAVxNQfN}JPh&Rw6h>-MLKfO{s^Tv$p#(`4)BZhB#ekQxS?g|j$ zfRnYI~)`20kmes1` zd*7zwUpuQNQljB3mWs)kN#*?=mwh-dU-vctNWrmNexBmDA$i<-7d=ljQ_J)BC;A|v zgqP>Y-LSHIcaFSN3>W!+Hb#(kNlu5F6y>05`^@-JK#^>_-bwNChzs&O|6<$1^ z=Tor38)2P*Qp}6P)z2M0^$TTuxM@~G_hd3-Wl8W}CQ8QZ!!GS~D^0}+L(>VZtH`>$ zm0`IT#=>FLo&MZRa(9<67+4SRay}jJvV~MZT*r_r8|N_>A82x3OY#U$pQR=cEwawDXdu z4kUzCD54ANtIF9oQh$G{$Cj_ZKqambrec{a#)O#vo2qy($ok{IG%41*$E`_-6zT%D zsnYOty_LD~ZUa#?L=uZhLZMxsweP!i3MDi+m))%;tTcc6H(MTdJlU9y>J!^uTb*Xo z8H(`c$>xk4^1zD$lurJqb}=a*>rea&qItC!mB+<}d2(ubT|2p=ai$Jtiarj~6q}<( z+byo}S$=Qox0drCc;0P;z2qif_dU5JKfTk%gmbbol4#kL;E}x1V!pK27@2lMS%T|s zQ#5%xIXCKCXD{hx1C;4yiY#Z$cn*w82paT?StIG}J)s#C=8jJwL2#^1n5NhI=$Syl z+n-#*m;^sG=SQAQkS53-)Sq1MjTj#Nj6^FPacmJ@R9z9%)ZuuB7VBgrQU3(G}@n(ql}!YU7}_F^TyKJM{#C&THiQ5VH_WLW`DZ z%u`e(!A}rXF|N-9GncQjabG>rkgI>bYsiZ1-pAMe4@QC-osT*=?Q!U>LUywwTqfgG zp%9@{t68c*SGR23Ek&)Yqh0N2-J=kNEWpcTpiim9WR??LNB#2h_&1fF{#a_-w~o1n zw|x0NIr-TBX_yCT5P~rJATn;1%ht)tN3a85pbYs2v|+&K_kDgzQVBTx5EEQP)aA(nWrOx(pJUMF^xWs~H>#UjDo|#0Tu$fo zA1Tc6U-l0PV%R*HG0QcZ_h+a(Gg-Q^!!oNK8BWShiwy4@K_&FBvuLDcpQNq~{LFK$ zWg=?RAFfc(Y4<82+B3F{MNAjTE(}F+@(hVfcJOfX%Rp{!t)=C|vSxoqUo_bv>bNdv z2UfHYC&s;PH@Wl-CeZdxH~C}hDY=}p+{nXq#U=ZTGkW@dsv&B4`j^n7rOci-mWK9c z5`PYI3HxBoS(6aFE%8(i!bbF8nM{h?>gqeoE(1}jlG6&}If+jr2$mOzJ)o?!Hdb zi}7tnXduzk(`2wBe`9tYSYhuVW27 zT)54LJfWwj)3KeKJ4t?*-IxA``p+S$i7FVpAJ=64E&og;L<>Z+4;ON$6;RV(Ece@t&sUW5m)G$bwI# z!n>cAlLU=%rdmzlun06hEsqvd^SW+h_*2B{^E>w8Uo1k`$>46*pdIuPieA*l-p$$H z&B=;hf9t&8@4QD8)q}2UPkY%q9damkeRTDmB6;rqrMhn51u3p=qh9zMq?R<^J?H7B3oP3CxvOw?E}Lch7#6|6s28M9XN^Nk-47rdm2A<03GV z_-Ha!hpXsdWyw~p%-2|li7;$tsNf}`%KT^m8s;l@Ohb%w6`uErVTlI=>YvCWN}&hL zBZUyU5!_i0OeEEC?KCmC!_yJCi^3W|L75t1ca}bw2!i^2W`j8-+-WD3G2-bt@yjse zysdU(=!Ttm!e<7gUj&2{QTCrWax0#bP?9J}5RNFqdmzNJ;i|)4$zPo@x5%hJA@S%B zElF)0aB6QV%DzF(#F4`0lOQ1IMp48Io6-uFQ(SXKP3<~>_`^%#pT+34{tXLoydXr% zC&#MjBi%;Bmr0L&Ce<@^81C$!S9zmCETb++Nov9qo>*$mi`n=MBc50VP0`Y*k6iD0 z)@z4Su6IixU}-t?r~&YP4G7_o3>$_2Ld0Wql%I@W1y*fB4vAQuvaZAf;Ub{s7)U3f z)_nQGM}ddf8ttGG`7TiOUm!?%vaGAzX9@8WT9=+NL-$BY`n9na12fR$z{+ zLWO6yW^r6GZ1A;4xBT)fvqyTzAwILef7H2%$UwZ|+(JE{T=K4|B~)91_pq!oH69sH zahKuWgqyNips+OTiXet^sk2i#hJ;SNfV58Z^^*$A)_DqQR0h~-4`sgM7nEqcp|Ny5 zZ7e2SSO{cqA)|4u;W716;RA1x9$jP5+dvFlf*|HLq#!L8_Z*L^@Dxd!^DujAe!;HN;O=DAw#PfT+DIcWMf*-y z7p)A&`5F!%qaLS*MnNh+vJtHdOp=WZiA4@S$+!sz86(S?+qTrg2Y0-E!w0XfJH;y!7g{m>=h9E^qtp9?ijR+lB}K#Bbd= z57ozjF^=s0ZE5s0Ygbbt*!Xd3O!?yF26w>f2<5_aPLR^iH*yJpLa5d04^kb!%C9B5 zzZ&=6<$5PG#Dx%dXbirh<=VM}!EAri=NUpHx)Rm}&kRIvin{%KrBxl+Z@;;5jK?$wTwgqg`Caa&g~y8W zZTVsi`r~^7i7*umYz0>~e5C2W_;@J%-GU)IhDch{1x|pZ+DgrrBasSwAxFwTnn-}j zS~cv~ap~OA{8Nu%a|3_X)uzR5bL}-_pd8l-Dr#44*2Xh?B)zLyDOA`Ze9d2wdKCV@#k_hEHEMw4yEhH&gxmryp{{uVMUPvOt6=}Eue`>`+0 z=n`tKe=6TC2;bPZ$G)E+sCm-WLc5v(4#%eXdvo_rH*QoG48=7>8 z$?c-=12VyU6I03yd`Kl(pK2Nu%-}-y{~<58x9RN9Bp+nHwbVp(h{N%EGt=Up^h2~V z4G*_xhie5j8Z8HxC2B$dsSSA(ii<)UO;}$<+J-lwR$3SmHRjh(a?;d;X^gW^$cf(7 zG7UM#u4a?!wOe(2!8+mVSrqN$ufA!#7tc%K5Ia$-k33S#d8UXV;Sixs{9XCZR- z6n1w8{l49MfBrKb=N#Y9{=8qW=L>M+J>lj?4giEFm&Gn?0r9}gzf(zG%o3xHwA4ec zH~E&^opMz~nscKw4LkC&)!aDd16LUGf%)Dga|@=`sS%m-u_fh6at+* zReG`QcEU*K+}bZ%I>+i$@1)Ym-Prcf(UQ0U^FIC0YMC@O6k3WnHpXL&h~oIEiR?YJ z!bN0?<)=-1Bq@CR`{@$btTgwS97|rqeuhv^HJ^f2U_jiqOCamJi1LFK?XXXo&f*~@ z@z0`Ppd}ys|H3&6U=WYK?gkUyg069CZ74 zeit6-f+^yvr(gE%7O=q5SySCI)y9?EP=24=5LS=KfQnhdD9Q7Y6sDt|RF)wEs$fep zZ3enesOV^P3(b2qV=Ok<=RhKm7b$iqI4RleMHfm~^0guyt-vJExpnwOo?Zz19%qVs z`<9H5DihTHbD(_)r8+&41!c*v0Tlt}7{B5yS|e&}aE1QvD)s5BZgMPcT)C3#p*!t2R*PA|oazDoii^yugQG>J}NrLRI0 zVP4_b)y%IsAT$aJrh5kU>jV*~OkNpI1q#@A0YN#$Zb=N+!!_P8mHc^Dl^mpHm`vH| zo};~Jl5NrcDsIKDT3Z+%grc9mAT)}m=R$0~I%WHI<*K8ep&8xIzIhgxKy@WoB@Uj$`_@=u z`s+gp(s#f0dArV_>b-M;vYw;$1kJc#d}De*BUr~LI3QNtP&t~esOkp~$JoSJ;Ss{b zkLd~Fy8<6Ji4ElGqt0GVDupmxey+^2jMW8gBXyNLM||aQ3lz3OuvlZdbR&Pe0{fIf zdEX&LZf5=rU7~yi&7OUMDsoVN96@ybdy`n?yow?rF{5#W{0n?|EAlOCy%px~W8u3> z#Q-$lmnscWC%>(`bR=ieVNk9TQfB^uj zET~^{`R(zrXo7Mfus_UeJ7`!4x(2MSfIeXfkQvR-&wnyY0A}lOv$!6h-m-5~M-Qo6 zmd-IXCbO6#jCTw?nmtn>U<1LeZO*s5N>+2B&Wz9J09@xfsyR2<4$E- zM@KkyqAx0}CUC2~VWn9(X}^pf2{t@eo1`AC$TNFH-t@Fo@KMQACA zXzJ~$%_gdNW=@oDt}a(u>e2cA*`(kU@!1eWegQvfXv~-}i1#cFt`j?oKT{Yx%#fD@ z6tnDbeaW6+dANtWg>t~x+pJ{cUgc8=+3aUJ;?&C|=FQUyRTFAfNVtU~j6*<39KS2O z5Mf5>JNNBTE^qYL%?8Kj$N^U_*vz(n41&bEbXM`4IO-ely9U1wkCxsPruL>W2L1S~+cKoZANMn129Irc;m!U`;bNwr>Z*DcS%A9RYA|@Hzke3dH{OAIuXM z!JZdzgd)!Qr}6zl+Y&EnCz4!-Lvg@^$M))j6{_7N00Ug7&NV!(ujd%&9W>n*%W)aREu!}I6Qzy5sU5_mfqbGLGq`x4+p zbw7Nwzwy%0cp=$FZf-kY1WBoQU~UjbelOTnM4Z}+a5 z&@%p`wavR2=)Kuz9PO6}DQB{m-&9SN4H@?s1I`Xy0w*5QK-bGYqPVsP#G}dIckL_c zeC|x`6>FgSv%xwYXnThZqpQe`H#2}hFm9AgdM#Btg&E~3c7>GD%%}CRenSXcE|%sK zdXqmI2t0zrY^5rGm*4r_&8bmw-b)!jd3=-SxANk0DN)?~MZ@Fh8oto5j3F+YxxdNq zO&V;$2ZAhT2IPf^?0XS%LZkW79FTn^g+dXO03U_qa2=s0hP`^XR159v zo1;nll>tK%;j)hyl1t{~hCj8S!kfh*B+tmkfyi63Y+K^`mw}U*PvsThxQeOi*+%S4 ziB?I!vcr-c9wA5jo~T6d^XL+h1CqCAR1ui1;-i|b|JMTC*Tb^MD^Wv=3wjGES^q(= z+LKO1V4sACS&4CkLT$Ctx=9d2!_8VC;xWglI)6^O&GyZTLz}V+J`VB zZ`^H1Z?;DlWfeXIipGyzZ?wD#oG}w6N>wxX7>(kp<*o&jd2)Z}s3vZz|DdO3AqUH+ zlWy^YyuDs*`co?7e#hq(U1mVy(y=oTeAlhvFZtc(mAqaGx9)ogB@8KVygxsxb2aMv z$WY#p_1TDTI3c!aNjNysw?{{UBO9kx*djIwT@Qo1jbNc=@GFJ3migTc`yQRbY^ba? z%xg6dL@uYkNIL!-6|TZMSN<>M#Fsr6W|T*(`JNPskt*gn}9zE>{q;eD?Y9^8rtW z@5otTkeIK_$}S#=NnIf7>K?ohb=Z`_KAM~XXg%9}_?DQ%hN#~#?jK6O-TK?IJ!;nC z>rb`NJ-9y~_aZARt3TcuKQhw*u1LtXoBcwJAwA!z;$a``$=)RA7+Ni0NBM zct^I8?1S@?odG7n($piBjBT9G?EX+Bw*WS_+?)OEp;8+gh#Kc+#r(aS0_O$rH(0hz z?M=YOW(U;rkPGtUk{Nb!P7ALagDMd6_kk4-MLfE~v%^Aa(IH4pcNY@u2iB)3Vk8h^ z!@0ZoDbrHO##)6-VPGGOhWFApR(pBL3v$K=~E;o4v%<*i;)!eWdI;?j?u z!b{Ti+|ZmN;w0FxI^A?#!?~0Yes}C&&m^y&J@NSfN&zzI%G^glEUZG7{n6h@ZAdsm z3F0eRH1-pv?F=+xaS_?`4IHi5&&icVx@oMc%(ePFXMf)Z7gEU}I6!5{doNSU+%?C9 z>QQ=YZXbJT3OQZ?cb}%9u@WtGtivxN(0s#*T1}E{Mjy?v9Lwf`CR}Y25^DVU9Y^x_ zm#QYrDQC-)2;B5qH?E%a$ua+UqA^3g*s^)@pEdg-7)Y2Z&)p7M$fZn)WG;IvWj0J$ zYl220rIR0tWD;oMNCFY*g3yLiV$;)16m4G3{$Nfna*1zB0|*p(`jqDZYT1-k2tyA5 z-&?F-dwL$)6`R>bmVs-xq{!hGT+SK{>2tX0vmi^&u9nHTsIt(#i03oDSB~ri^9nBl zt&@lk z=JPUvNBu5s?kDq`|BwJFyup{j7mRnkhlhv3m)b#?td-ko(T)>a^9#w2i(cNl1AzE; z05Gig_6iC2qX?_*GyNovm$#c2)n4mD_yq3)8qfz(b|P8g+m^9SA;^tJYX}h&+NKu# zt%g2P7}?-_{Mget?dKmc+a=Ljpmk;d9T1@P3=UrL2Ydw;o#LW7PlswKl6E{y0Hq_q z1&#pMD8dh)PYAWWbdkuh*^#ej=JPb;WxYAW_5Li#vf&t)-)FoieUXEeoY8J^hIs#&npNvF`F zLXm&3B8n&iT%>Y+Mcm$qWc?+W@^Bk_9HS;J@0J9ju)^svea6&F!6de=U<}d^=2QK1 zXf4pxDCJjL z31MRVuEah%npHl_MDT4a+irl7R05Jtmk>{oT8ZBt3)FfB68Q8HgNC!9*xq&t9&fms zX2nb&f8?%Pp`$kBw3o^n*6R?`07!M+w-zE<7X?|vCHAJPEoXg(hUv6&Kil$#>9(_( zg#@W6A(kt3oZ)U<_d!|{Uw?dZP~TbamCVYUZEp0h;`T=l^uhEfmLpxC+p0w#bufjO z*p~?63B2#w2PCB~I`z(b;^=(4Og7$emNYzGSlJ%kc*z8(xDAVz4O^(56_F0gA(kI2 zbFQna>-N@8nuSjg3<5_@?D&Y8>Qw5?>xyei`mwi zZ*YFrb-2_bDtUq{l7iyWQ^#!*!tWzQ2Vj;NV5InAf9mS3N1D3dR%AE)fchxF^(-4UjA_NatCfrUnr#I7F#=4 z#68sD+*SobWb{9QTIx~|@i#!|i&6_L1jT=Uv;}ENy7$B;>+O=Db}I0XP$ntlUHQ9O zHd-rdP7-f7lzQ;YXN2XOWS#ZLM_XQEp-^;=6?@J0$tc92g0<;a{ny2u8bs**?Bm;Q zV@~G?%4g4CMI^8}5sls410`4t#Z)|J6hBx^dM+Ji^n6V|9Sa+hl~JBK`2OC9+rI#s z1PDEm$Q>z}*s&IP8=uavti~C!D%|^AR7tm@vQm7jGbgJPNNRL3ZIQ_u77-QYHU0X# zdOH`O0BUiz0k>IN6Q<1`gZ>==(mg{H1c+;Zfda_>OZ9&MpNYa#*$|+Z=ADo*zKoFb8g6x-4`kdaVWKfX@ZI zJwV#<2SS!!R(-ew(D(2E{WCz+B;cbE$gma-ukdqv^X6aZ0|4^|nA+U_Ml&b#t~bA3 zlMlAhvqHmt)73yyhSU{$!r$M&>yL+obamhnK#ye4n{D?x>Dx)send~7PgIj9asZt7 zs{*gIJH$=Q9Suusw>Ab-0P1egtySLa+}zucy`onhQmi&x&w9kYZ$?HQy2M9{B^m3_ zOjs>sHF~`XzMUG)mA&JEnzu?D-<^NRzgNSje{AOyidXu z?t0T#xt$lhc71WLG~NYZv}MfwgMRPq*6$Cm(PxxUWC5%upoMaS*2@>pykc&DcfKIZbG^V*5A;WSu)uCV|sdP^D(t{p5M_(TMPR3g8JoG-y6T%N%0>n zS`QlIT{_%P7u|US)~^rVzTMSd_Gb(=#zp`LmWPhlpCo5SfhH_X%~Vr_cfY#p(YI~C z>(kEK^@*)EsfsO&|1)~KKZ?Jj6z?gWl`U2ce2$x6Q=@^WN1H>1YnMIWF&+L@ABA1N z0G)JB{P!{=Lj(1SUmGeK=oDnr@8Z8!G9ySu-+k~V&Ar)Qp}mhk?yrCR`l5Tr{BBYt z_{M)F;H0+0@8?$iKc?MDSJ$%3?R3Z4NmX#*UX#)H8mB`MrJd*kpS?=P>m6{ebeq@q zDGCS0gV_5?NZ8 zVJE=q#o=vpIgz(Kwx$M=UoWxG{BsU)hVvF_oZ>F2d2{aGe~`I2m9!mNM#vHU?llS? zMw60}eX8g3k&XE?+Htm&(rbHYD%sfHE&?oiI$EU@aaMaDs!aVi1@rDETmm1TU0>W zcdqxvJq+veGn?riUtO%6i+fn&sC{2Vgp|!&k=L}%&(rPL;_P$^2s@$$@w{vWCUZg` zfsEAGWeX*QH)WP=1Ox;CSo-=O`ON&Hryp~;$nf`Ft+60|t*vzj5JZ5ZCsw%-*Z>$#t*xyA82yW%0C)`m zDg&JP>3=XJ@VAxK<5&NkJI%4VofzP$H>3>cVZr{J^u;`t%g^R49zg`|T1p^Tr|jkE z-KXG_I9cuI9+aQCOI!8i{H>=ODW9Dy!4ZG*?gsBJfAl9v>VVD<^X`6+-u)(%@%;It zxvo+1Zcaap)dUO%=2^eM8gDMM)thQ?&T*e> zg1(4y*8mMX6Eh@Xs&me|DX0Y`&aZ%p*sm=jgh%pnt21Q3L1zZoGR0I}T^PYD_A)bS zAIp0w4y1KvKVXui=6+hI>O6**_&``I<$dVBh$h_AY`bG4m3U6!`HV1#d;Q?mp+xEggLyIW7ni zd%!1rq)YN-`^&&_R;(Gx?~|F&x2x*y`Aa?ya=^oo|WMsxL>{W9Ea8 zHn;Dl-S>Emf2UJ_`6#hHR>pLB8*#d~68r*nFj&W9eOWG;b+@X)uK0t#r_dt*ow6#p zUWq7tUzidVG<3>4R_MjvGsGe`Ras zelEE?_m&wVrVQzuRNBMkg$WjRBUk)>&ObD=A=t%U-ydlTz9j1aD)MI_)wz*;gcE-C zn@Zx~zrz}`V!@v}{=kJ0lbsvWn83{kc|kV%yT-bHIC^|6`1;D3G}j$2!0fmz`7u~? zK`n4^Dfs-X{d`XFVIfEkY~`_GNJ$IgR65^@`_pmWDBG~6R@6D%cK5qhJ7{Z;#J2qJ zq>vsJ!=%BKoC)>F^1HjMmA0lVzg@rh&C@2)j^B%yvX?o$Is!j_DS{9b%z~vN>Kr_n z?z=xOD~tAv7B}gW1nfiSjCb=f?D$a5axW}u)CPUj4(?9ydB@1on;4Vu*KR+0JMJ9w z{0>?0#!BLpI11FK^=&4axpOkgv0*qIlI&dYB2I~I78L3dmM;Hd<}+76e(+`C!isnc zL6{bKlPAD=+K}}*nMz-CJc8y)9WccnGwzJ5|sWoN(?QXA}ddA@bk_;RfZoAdS; z+3o7C=(xleD*&^ z+mCju4^mzm=12ruex1&vj~~sxpuqx`+@%i<=9jbXqoy4}H+=^=0O0P8voqwCWR|b_ zlXDRm+k0*j3Z*0i17Wc|!!UZW#Nd$)Ux;wx%6s<##fCOsTx8QBW^Op|UlZwuPVToY9*mvW6-7MbLlzGBEIEjIJgzsa9lTHhN$93t`JZzwXra za#JerK~T>TOjf~*JAvQE`=-IUR@6T>X?D9JL{%A%h_=fG!)d|y2bzhg;NlOZIMOpd z9utmv$uD*eBnxG@T4;5W*3@XiEP-9PaOv{bpW&;Ew)=rkBLyQ;7rdNg@bA@m5Y6r2Df5V1$_t;F5Z3G^_NM zU9LxmVnm4z6vjdn7eI)}N0m6hIYS;RNX3rRKgfX5_+kw4K%gWfs6ykZN-FGYfnFHL zDzP?*3yKXds-p zE5tV-`3uPSi$mwo$WF=#2g_|sr>?~D%!ZEz&sq3|duq6!sOci2g|y7lSh0~D%t{bB z8%zL%4wt%B^NI2+e3AI_C($rvEJ{qErYt@c17>-8?7?Lwt*S(x)cm=egTA={N=lIeX;9+8>XehJMV|PvZjk2= zL?cvdpP@QSh{ssD2Nd3+!oem@F3GB#_7fZFq$-GL&{t%5jqm(;z`baGY&j~?7AMGm zE+!sV{Qe+EU6~k?P$6=X?|-{H2V7Y&5&VH22+^i4f z^?YW*dhn69D7F23(_FZ==np!h6rkCbm#EzzAZ#}h_I#1XRLoLBI9q*L0G?2iKq!sl zf}W@Hb+X3Sfgu7!#@0upH>TE*7e26!!Y6j(QYamBnGpr(09?8wX4~kr!P)&NRLP`A zX)dDIF;K>y3gU*}6A=EoF;vO6=5L~86xoy`TGL`JD-qCxtZZfuJ$sAMcgV3Cn!1_| z!%7}n5ml5Ez=c!vWY*k$r^7U4k8_8>sQ87A#yM141! zK`t;&B5d^Wgy*kh9daB546bW!tDrXQ%MJ@isM|OX^9__qCcEg}YEdhtLWg2|@UEY)A0bx^9YEGGU)$Qeq@XWK}v z%mzy)T=uV=l4DV3aIFG`OC8}J)BAI>9?PhR_0c>*Mp=(i_vhPJ{{(c5;}po2-VAow zCn+XeK>&74!Lve-BE7GbLjd@9`G_*>+$Q)-%HNj|nRmbHQ_B0CWGsF@rB8(>hp zNC;2;^j2&;QGBXAWZ*t}U_dPyDW)Qa>i|mE6CmYhmls;?tR*aF-c}VJ#xNyHL&uT` zf$yU!Y7upqN@~{B~DT(=zg=n*t%L z+r#yJ@y|@bk4tq2@_0%m%v-y7!-*tJ7zFa(GKq4V@T_wm8P!aGIj7ymV|F7R3WArSX+``6|*aV*G2 zyi7~0FbZm`5yUp=oTcCX0z!yuDMZZ|RSsj4*ao0O#m5{|XNMBo**MPij~kI@4Bwwc zM0t~DVebA~_WVF+&aI{NUoiB>es3>}Wj1~nXy;GcB z|J7;c7&!Z$TIXvc$QKH$5mqMHuM5ZE(-i*+gVgtSCcH~Syi)!S@DhYY`eRPL&wK@{ zMGzr2n8ShypEvC-77-Bw$*DAW;}Ki0@U+^PRGs+;)j~t@2q*55y6ZmGkeCs0vlPf!m<&@XPs1hj~)P?{(W zf3GC&*d(v(qG)|?Sa!EBG0`&iVi|@H+iD{i>m62^LUNWIwxTPVz)s=4T{-SePYJR6 zI5xV^R;2v@Y^}K-8%zjQ=bj5)v~=7?v=guiU{Nyl^DASr!HJ%SIHac2+(*XrOf*|p zL<~=MYE09;{_Oqtw)k;?kKG41v0@6MkIoObp-N(?N8J0aNE(H6AdLZ-v4^5x4~f7s zxj+<#Nf{ui)uPl__&MT_2+M0v>3p`aQq!^cKD3qk-caGl!Lmys@^U7A9}g%ZSrz?) zAftIU4D}Z0F^p6K{oP3+WUV~gX+!ZX_s+rzGM}uRq`lywCt>j2?M-4lT)+|N>JEG% z^s@b0DQi=3y)}RJh<2NVLJfk9>gogxnygS2kOgqIyKgZ^M~W^h8AyehHr1a^Z%Q9y z?^}3b-czT5XhId`G*IvMiHx;qm`1L+=XeWZ5Fn5%=`aG>9O{7*BKtKkJ@1PL=h*UP zq%!tOe~!C5-Qjz<443j1U06vH%*wm%=?@(;JhfPpt)bUyq-o|^e%L8UL$h&ts`1hL zUHfaP_; zXN@3I=YZV+wv>yY6!>8_`6d| zWAS?7h$q0cmlNXMAy5sM3f@@p?!*RI(CVMM;yG=QM;slmEAFr z-G<+sE9PZfiW6pfAk-K&IO_{i#NB!$M->xIo1*S|W`yJA`8?zZl31gN0|I}<(uTDL z?u?u*H%UtDnEjre_VL*kZ6{Vopa@gzb3ac$_K-j#6WO!bg`oqi0+;EbfWX#HfLzkYq6yVS^hC~qJ#%jVnpr}43T}Mqis~pjjsWlzW9d(`#Uo7^t0!(a0}I_E0VMg1&?|+PZq3E|ChJ^yok*S z848>qQO2O9P$jrhx;($4_M&1jm0DumLu=FBAxpI|M8@1vhRkYmPrv!|{?E0xJwGJO z>F3ZDG2|dndSon`eTYGN)dt^nCFRg|e)3!gJZ$wMXbi{e2#b6Cwm%mdgRkQ9$c8P! z^ijfo>6)U}en_vowa-DD8?>Web*!L+5QLlANKd0!zuTwl`ZYr80rG&LEB|Z7E9S~aK($AOIGBj*Gd?Is+T~U`+cAmW`LwG(?CjvX zx)>ic3|hjWY^VAosXLXJ=RTAZ6sm};g9FFLg@Isl)abJmMlhtMI=_}j{T>JrD-qL% zB^6rtE7|!hq{Dk0*Nkj?lKM~eWIrK!WEz*7j9&T12jm2f$Di?`^|yP_NE~!tc2o=ic$PT+X4cyKxBVtUcE*;G`9H+aRszBq*0B!lzuG91n-Tv$R zyWNZT1|_C&Y8bI3k0}lJ`p_lBBm3hijpsj)5EXB{|M!ee6t{E^6z;8D*@q)#8JX93 zC7vZ5PzLRUxL@zDgh#0T*2UbCEh;W=dtQg-y4SN(%fUn$NeuaL3jC(?LztmMMfbo{ zLKz`MWuZuTw>ABH6D2-u903K8T<%0Z^Rc}Rz5_-yEP)w8HcB(R36e*Gu%A+`?P&~e zZA-2X{O+O#4R=IolpI8MWcz07WB8yx@W|N?|N9^i6r={1H&_KBDm5wz&YI|7o7jtK zue$aOuCFO}XrIM5)Nh8(N+sRm2>nPi;SLULVkg5LY{ej#ynD_&%`e8Dw`WJPgcUP& zUBy)13pAlSIQzAX!z)ULhOGNHi*pD6vDFQBdRgQ9_ORj-EVrC*nQ5S8U^u>^*lJe! z#{Ykh$I~)NjQ+Ux7)L7dSkie)kX}mSduEo$W13v}Qr%uaz zoQ(cD?9|KmE5ig^@O3+r(vk+@Mn$qa);rbZiMaKUQHj!bz8fQjBS)*|f5+EEmb%Jc zP)3KBVa6|-WJe0GIrA6TH6T2yMVcjpZF?T}BxvWlb&$$HNK`gDl71){|M-Z& zs~8O7rR<;}q=8?SIi`2m4Dtc#;C`>3G;8S?cq6W#3h( z&)=CsS*h0f4^~ueA$mR=d?p`SneLI~tjK%gz7EXeBY18SqA_!x?v=3Qr_#5-_J9X> zI%1`Z-T`FSG=i5{uJR=PL8eB6%%pBv#*=kKn*S}+8|eQZ3z-u0#)rlu$XYSdvG2Wr z8g@rrr|By!Ol^cpdrUA?ffPG~%7)6`Vs>*02c)QoCkFuEnS+MDI#CMa81M=DeEHj1 zaKn80+Xwp&@#i$e=%7ETIdVZZwil8{cJlib2Lpn6}Dfive7c@oW#NBsMm`zrz4 zl`qaRYv{yOae~iVf-(1`6Zo;{#3Dh)5RiZzjvlK#g`u#fusxg*Aub5bfI)2@F#+Wj zFg2uh#PYJ!XPGfBayp4KpNTdF#*~P)8Ly|(eBTZGn)&1XA*tyt+k@F(QtqqCV)-^l zzYQ|6LU*zaaS~~0io?_RV0H=`plB#QLRoI<)v)IK3?KWaX$%z>;ziJeCDpR zzvMN{cl+o+P<6~Re|vG{Z758=_@(#MH-E012dBh6B}k_Css%2s=dgocpr5ui&ggFT z9X(c)UJPwMuysrLj%+jc`Jz`EM)v<3@&oP@EF>Y(&a0mT5MX7;@sB03ji3y=_^leVj>FhS zK-e4}Wn%|&vc!KU31@LdhM=j3*iu^5S;8n!D~$%0#z8Rcp7%nVyrtMe(?g|X-%fdq)`hZ9vA z$OJ33!L94Q9{IL3lxFJ)WRVGt&Oi?6*^bF=aeD+6gDl+V@s|{FDy?LYplJL|@h{j} zbKibGgb=wt9Xq;%ZewTf!4b-K#~=^p17zUsZRjFx7c>1JwbZG6A?5}vceGa_Oh>NS zrEjJw0R)5M2&6OP2w~@cj#VPZ!$xz`;Yw7Zx4sVqu%?G_ad?eWo%$TC{$fSTHp|)} zkTIGBLs{5cWF@_$V!`UK8oGHQL-B_uGdr4y;m-RBpX)9@8|jN3sau%2Y8Xwf-X>uh z^@r#$22gB*{^!qXX2;>-cHybQ2p*?bFFlTfG={qEEV+oAx};L0Wzw z2OXatrNq)_XTz_o3q3`q>ybm?6iKP%pbc|smxCehdmsbPacD4|6-0^dM<$QoHpdJe+DoIaj+_oy3p@vFT{*Jydj zU+bHrEkS{o1_jRCObu5i7jfs6%^+>Q4s|ZyQ zxXaWf`8FshVJ%w$adO)0!HxF;4Q-{V22;LdHl$s00%UI%M3nyU05@0l=}nCp2u;ABI7d_8VvE+;4uEm1-67_PB0cf)Wn#w)!JfIyNp|THrtszgad?d=jlr) z2!6TFfUX$Axi1IjS629)N+ea!`3_tY+3F6;@njr)dsw9A2C|?igi@3|o$7=VgFuB= zEc)_rYitE57;D=!cP};BoyR|J;~x9I4=;H!3wkvh5ayihx0!RZ8@}kd=IsHbkcQ^r z&7X&AtUE=p1ikhc`O4vHmJYr;6abl19QL6KNeG9NfL^`fmlGW9bFvx9VS+Jhx+ljX zEgdX;TQ*VjovD!$d9VhB$>AUwY!FRZMs#R~uoeyo5PB(Cu)}N;4UVRV7T|`$YE)kH z4LO*eH_P&spZ9vdAd&7o+QzwlhH?A?$BT4iD7FHL6+d4CBr@aJ8CT9dO~YUy@YzJ` zZjGiKDaHN7K#t+Wf!Cg}JbrBwUGE7f0<6%kRFsNF`@7`eJ z$CNR4Q0$m=iY!UGo-)o5cb@Q0^hF;YNDYd`5rRz{ngQKfEPaQBa}zsQfcQh?8;$?z zE`ZLwrpPS&F?~*sDr$`3wQXxcLfuLi@#E{7^)}BCvI075C>^34o5@}?_?-8y*j)B> z)BNsx-ZduJ1IYg14LoU_+>gTqdDn^iZQe6)4!D^oTR9&e;_bLD<_!oEqJu#7`)>p` z-AAwrqR+wix%*V%BTaZy=3WH9IP#2dc|g`O9njMlZNUUQ5M)r6?>O|-Rvjoi7^gWe z*yw$@xLzONqvoax!dy zW&7PhBzKotvh-GJA7?wf_Xda8F~Mv4ZL4~Z1|>1iwe%mu!#CuaqTy2#M753%e+UZ@ zOo<&Sbru_B_SR$ zlN|{NI!D3?=>#qkIRe?OuqHhZvOnn)8;U<#5q#WoitigGP;2Y7kcONm9KjM~2f?@$ zT}QAGXW2byP!|$fvXSGG^-DTM9uS?~&euJIvxHBo{!ZWKcfo=Tx~J~&BgF~^t@S8+ zuX$cA`x`1*;`VT(z?4d_Y&ey*>L=^Z7$AwNS~bs0Q1OI4d_(qdv{Q6Ow(Vva3I&YO z5Q$!r;ZE`G*1TealS`U_*zsl-vVr@_vFV0Aa)a_|ZU$4&Yh7zwbD{{rRjsN)d_sNR zOFkMVp2d0Y{nHWyGIg5Q5qp|=LTI>o@%=5S(;-U=HIX&zWOyf5XpsoTM|(YE35b;m zt?Ylt#re=`H*yS6B6Y4xxAOh_8S{W9PL!sHt?l;Ka27Kr%f<^(-LOB+v)OLHTf*EP zy4;<5w;y9}&jI)KpzR0%UNdh6qFDjqL}WJ;EJ|)GquL%TpL>XgS$w)7LnCWUX!zT0 zp7^T?Awxqz_^>GRqCt_+SZhFe>0e>|p6t&WZlxmoOtfB2P2zCW1p@he##6-9)-o+& zQAkUd!nkQ5yV5=rtl;%wfH_fb_w1^6&gp3&XO@~R(B`O;9K&`U4N}fN8mwrPEJK1K zp%w`&nLLwLT|iJs$FN^atD0o$q}xNZA98-dYDO|ywQC0#y2M6X0<2G@SVSqxWt1{)Sg z$S%cIw z2^9Qf%PDN)^@fc&Q!kvxs>1PYEWZevyF@pcjj7Yv%~wRNo?D|UKC!yYB(AQPrO;xhWEDpUs8be(A@?Aiw;n6%|DrsKM6-wUa zAp(FboqwVgma*rON}U(%Nfak&>fKqG)H&b37SF18CgxOBcQztq}S`V+w{!{$tp%O8Z02QWN=4 zot(ubQF6c9WW}Tid*^+m;`vWSFH?57i{S9ujK5M2(S+HSu@=YyQmgQty1^eG`3mj5 zWE|+^G&x7U*HkR@K}5B>RY}rNEHDRk8)HoR@I0sL@5Khs2 z0O&^pCvjZX+n3kFbs`FIN0=LjWh{Rmw+NP8Z1v}l31cGqD)d&|fY?)i^mA@KMB$A# zr8o?dF>F&!nZ}0l#jtB}$H4lg1zGKDzv`U$O$^E#r`7I!I1`{N^C@{=q&z zK0w|upbre{kj>BpQoDSl4p01mu_Q!yfWe&kwK>%f9e$tK`3oR*wI(J#b37ye_((N6 zG?&;<&&;?0>Fa>D?_cCH5ZMKc52kP+D7_6xL|%3k%O1A*5A0pA#sBQkRZNrf_1i9S zQHF%Z#zxFylOR3mLW5FIgY(SH%-QMbv}pX&T$3<>EA`tAv^A6g@(v@8KYV}Li*6c~ zl#~QMf9cOC=4Vqnmo56V(ih}uik-P3f-^6heD}T&OY*e`y6w&0E-!8823`U(GMUt$ zJJw_79l{4vr)_68t&NRm)WL6W=PFUsi-SQYhK5Ukl<04Y_F{8w!sg}FC!>h?tc)|J zDX-K0xppUAl$GS8%F2WN{cOPa+qMLtBMW#hUl=Fp_K5WTxxEDvY_(6Zk|%2i?Zncb zmTF7i^Z2;8Fky%oYga1V$6eYPD+Q&n>=?)wPlYd4-el|Rb-ZwN4wp*23-Gr zfNAyD51()F+|O~R<}v+xvd)>aXoUnN8lX@BjrBby!M1+y?9Hf@pkOUO&Obrtito1G zim){aU9re#mp6cQIBUkG&Q$%*V>*kN5&Yx)@El-Q|Kxh}8Bl(DZ32I3$spLAUC!|4;qL?fY=MxPgJ{Ip+qj?g-&m+$|Jyw2L|e-l6T+s8PK{+sog zoZ){Qj)yBZF9^J=00q)_BTut4zfIMrrmcSdF4`zmv;NGK#VTs|pmAmS^rUlb`EcoH zf8*zuZI?azr9f-?y$-JEjktG}GC1k-#^#={`pznpVYyXLYz( zrRER%F`(;Kr%=*70ou(wZ#SpyXacC~dbzl`SOq$JpM4H(J715n9nF2BErrR}kGl_6 z_$Pgn#F$D<^@~Xl$Up%IEFd5E_rE&r+JI8dRIR8s(|$A*giA?DwfbNV`}3sT*S_Jw zR5_E5ZQfZ5GVJf~PtI2nd$yOAPIyVQ1zfn9lhT*`Ik)h?>N${crUL zfA*$hw`q;){fm*NpkFhCma%{uw9N;C`QfoQ3&`?j0LFP65Xy^5fEVq4m?5)}$gvb2 z=n`oE3*fIm8dsdTJdzEP3jgAML&`@Pv66!pX?U6=?N9Zcz3ohE!bczX{Lp*le51C1 zx4R{RjFZ(owWY;dn?d%iqxVYXBU$f5Q)3x%5u6_IHy}UoW63=nF3xwZQl>8$ z0fl~zU8eEWV^Y%7hIp5M!ySl4P8r;Y*v@13icu*2?~%Wi0De#^>1-ev78gBQab-Ar ziOsl3EB><(^{AqT1-K_8Q2ro*_wi|U&WN8jY5u;!idP z9kCUj0D-ct?2xE&fWcmE)ekQ!Q&$9NzsO&q<`3gEh1^R43^Jf?3kSEJ6^;{vP$;gU z8t$P2j_3l8Avb4d5&&2j6u&S!FRx2+6C@k1L!lH~jpF(jUI4SS3G0G}y8_0}8g5`B zy1KcAQM97CY=B7*K=p0|`U_B*!!+r9!|)SD!hb#r0b|p?T>qN>067TU!7v zdP1aO)0I!IXWT9vF5_zDWXi-)M(ocsr03rTki_HSNbKid8vgwbBYVnF_K=`vrOvq5 zuH*sxQBMXt@Y<_AQNW*oe!Vx0&!H34-#4xX*cTp>QCw|>)W8c@>@j!qfK->e^7meF_xJ?); ziRZ)vFzV0?m}-?dWwDZxp`pe`b_^VDK=Is!HabbkeI%+lRc{Kj`6t8T8K?i7OrAK zwJ+z`iT3uMGuRo#skPC9!T}7nE@go3dk`o*_9@FVLw>3c$y1(Bo+jpCIXOAq$H$pp zW+07(8&I{+_^-PP*layue~MNBW>|PJN}z!36(3FPv?;Lxh0^Jqe9y^=Ckf?LD@0wAcCmPNN(^CgQ(8!U?Yo7hwUGh9=`UoPhK`MBF*kqo zOD}KQ)!cU{ITftK0X3I|_Qgb1a#>BX04XZdP_rY0=M z?2KZ$R)n}di-?F!2fB<^H8eI7gkix1s6le11nSF}(YoVFKEUtruDhoHEgy~8HedvZ zOQbE|r!@2gI({3`s7-ARH|Mm&>7>4PoN_y3XYB)sb$=}IUQfWMGf#6QPNs+PqkjOq z+_`edDb?!`wPuNe7z}<0#u*L!&*hN0 zkY?e{hv0y#LxXwijvLFnj*GKKUnLw_ZW+`(aJH`a-9BJ{WJvS~BQ7@RsAvzB0?O~dFW+~nFN0LGT1Q;uvutCPGqO&fdM|iPURCLD1sGc zVs38qvwmDhi&;;IBl;UR5F!Fy2OoqpW^;i zC+!`w)5}-ck{+ckY7$F>zFbq{-g#{^eluUr<}k-keGjmBfnEPBy7K(CmlaYv;xAkO z#=)V0&T)#o^~^dw|G+D2D%MXdETw&BF9#gex!;EIkl33Mh1vITZf)v! z^7CC+j)r+IDHrks3HDP_GL0j(zsIwpH7D&^%f^HR!Dtj1ICvv!m~3 zS$ZuYRnX1c+;Itmte$LCklgUl5JK0y9Z9`*9%l9RW-Pgc92^`-J;Bt$JZK=+eTBM! zIwXqvtU<i0Yi!dn4DjyHdxY&8SI)hxtW(<# zRcwYARN!lg-}d_s4G%|iCKK+k3CXrSP^4e-q20(d8mtS)G-|O9tlu$|ry%s>@$>ll@GyK-NULz20`Z4qb0>p^T<)ZN`OEaE zW~3KIh;a?SpdcSFl1HO>C{F@CMqnIM(u`yC(;r``&&3AW{x~~j1+307wFasKlwMBV zHhMzn`|8JR!Lf-#QsSKRbIyO5^mH-9LV4u-C@|_A{S^T%3m^2YWytIaM##;f)M3Qt z${-M#0tSxhWE`&^l8`K^)yNwR&H+$~bhge9bezDtr;CGLnrf|T|GV)W0eWPxcQ5*9 zZ-RdHlDXx^OV=|$a*}>&a7{-Sxe|VTyR<=)4O|KmDh)K#P_wU^++haqFYSX6zU((4}pb0ATB zh$u;#g0yflSf%Me+;SJT6Ogom{8hI)JsG8<(G2H>U9B*HMmQ^E;$wVRo6ND?opjFYGrh-(nPe!xgH zn&8srMPj;}{7{AYAd#E<>{lW!k~9(!@WZu*eZZ$lDS&gZ6GVouO#yfyFJeZ9?Uf*2 zQ-if%a<@m}afq!CH0(c)tTVy|3UF=5&t@rqh%oa85y)qgunVrCjONNSnwgpj9jH}&MN&4z-8`nU@TNaI8aU8e)kt71ze5# zxwr1bqP$-;Flc@Omn?Kn+^vfJr_s&Eusp6Vljt~UbQmXnHJv)0>YZbie8LE^W|Bf8`<3l$z7{934C6n zaJf9C%v3l!PiaOpVtTQ{e#0hX>4ZoYWmJ%ab2#z^HeEk>BN&>V#ZJm1vr-dr;JN|n zNJ#|kZ5#4hV5q69Lp1DKa$SuuXx#7M=;Xm*6=4{pLeM6$RIZw%R6y-!J|mhJf3Pr^ zV3~LcbM8l{T zz~c6lN1&*qCdR0kj#2L<@zeDp-L_U3ji8Y%k=A7@nSlTD!9e=*0`3kj`DworAs59+ zTpEsfuW(Z!Lg;NCF|wOWWH@#rVJVbD{nwm0q;FKhhjNd(AFq;@8Qp8kw+lRhA!UFc zhv6Wt7pk_*$p9AoLQG--jVrdrAKqR-A)pL;>@^#MRge)!L;Ix4m_V0t24+grOOE^J zb^FXW@ZYr*I^=fUY(xBuYoLMD#zS1l=Z01r%;km2%MpTaEGK6M?ewfM*0vxk^E}@G zNoh%c*lMI0KY2mW;|rcRqjIU;*_1d7u8+T%{+k}jbk01*u1fJ!tc(#}5GuhQCNUgR zUvrV5fizi=Yle|1*{OLJcdR9&J!lip>pX>kDB5v^7ZnPJhC+i^T)G2mrqJ1}j=%v; z>f=^G8b81X(gsp!b9+T=gaqapTaZ}GjrMsI^6Dyy&$b|DJr!^PObWZscORE+%XUM# zkm(l_?~idaSQy^b;xc<|8aEpq^h0Obu@D)*#PS~Wk8O(!8b8h1zau;S;2nf`1%1VsQ z3S|+<8rFZSu`AIC;9#D5QzDILNz8hz@95b(Q;=+c96(|6Oj zaAILszTd~FB)ryUW$@1HP;3*cVBSL-;H&D z!Chv{J|umeWm^j4iw~Q-uB(7xGYkr0&%awAo7V|5rE;u@U6EhkdZHvsVJnGOIwo-Z zMb+pLA@emHX*J=Oe%B(DnThcqe}uHJz?%K#vGx$v_S6n-bSr!Q+uJYZ>tJ?fv3@4j zbQLTcb1K%9=88cUsC+8V!NIKns)dpC!_3#f$gvr(VGufZBThO4{qo`MlxvN@WBvI+s~M zOxmGG`+q#fzx~*|J9s|8$MYl<*M6n=VEb;t2iLR=13g%YVt0w}0r6CxJ?GoEhsf^R zNT4YggQ5c4mBMggQ!7RDO6JA zA=k*UakF>Jw%1~l^f(i5Ffd)S+4p3%+5aGW`mFUK(&x0xY8v~?)s_Xik#;TC{Smv< zS6CgjJTMkxguMY}4qE0JsR%mZjcqT9O(^?qW>u?#pX(8>;eev*&Lv{a;2a|9OuT$D zcP#@hxG0C`;v#sLE;5{U{a%2!9KCClr*IdtTDHb*MM(sCRec!9OSZ{=7dx>0-A)F8ZGgZBVEEFJ zDLixM4waOZ{SFmP?zfP|ZUKPfIFU@bO<-()hKgG%A<`v@Q9jB=jSBZC+ieWTw1Z80 zwv=@B`I(uS)UK-{lgAyRny&jJftZ7X1E=QmQ0Z~6hy*%wJjVq)T% z|4lpl1*X^@*6V_UTS8lc{9;z!bAcPV2?jx2D>(^gHta1@<7^L$p)gxLojyleK88)a zf$N~{uN;VuHjRZQVnCrra9OX`Pg%ji zFgkXxQ2-C^3%qnEaLILCPQ9yY`~tk#6VO%u^m;2P8eb$heR){@yyh}|_Ox;KM)VaF z_v~CTe-C`rdaLo2W1uw~xCAAPx$fY03>U9j$KDv$^8*V>Lp4U|TZ9$YY*<6-P-#?W z770{(*igu}eUtjLWwrludjS8A>3SgV<~wBD>tEr=sZV8@kC$IYQrm@AAwU&FhbT5>NOAGmd-2L`5Os=B=Ip-N@DrUI5Y% z;M#t9IQ`uHzGm^|Y4gQT+C8BJ{+D4godLU`ntJNNtlt(k?oH|`BOKcyHOIFSX(uqu zz(82^2)A#lm41`$T=Dt&`8TI7FQ9n*daNEcZn~!Z|21s4UIEO#Goa7A#qD&d&H@O* z%z0Ql0N@Ze03+c|4{$Z9W(&(hYP{zwgtDfNjc?k%Ikp`F42DJnRtP7sVSQ!r0#ZVa z--*50-KeVQ?N+eK^F^wSjZJVtVB^2KVTx6NLZ2<-BYM+1Z3JK>h|&ZEu!VJ7gMsbl zj)R&OqXh?Q?ooJ>Kn<{l0qY=@^)XVZ!O1h?mh_JKOSJy$C5{a2H?-SP`0)!IPiP5N zmpkamco||AfJY^&Rk4nF!c7dlOv$ zRu08L$G+s5(ck=j>(i&H!%ty0YN)5m%atuBd{>c?!>NDjVGVtP|0R|!NAcFLEHEnG4F!*3`O=gTx9QgG!X z`N+;O%X8w<4r6>Cp}Y2JP8o2k`25cMx+4JS>9Ps5-IwpWFJHS}d275TM@B{>T6RiM z1K*cvF%jj~l%VRT0HLB4^Vzl%Q&>$x_nML-jdK_o5 zPR*b^F2jLRm}sNgJj-}BFo$&CS9IV1ED>$=f4W!x##dx(P%-~X|9_pjUg^l4Ksj*p zX?;_B-nv2X){>ZIa`nVRs&1oq2)P^WO(!sr0}zAbK>xuV{*G--%ICjdyRVAa0pRYF zcKdo)Zm^iFp<(4EV$Tul7u3x$V3H;kF2j3X<|{-)sYviFe5<9&FxJGtcC8{}kM{5T z_n(@4Sl`p`v%lh^kD!ZJ3aP0F=BlxavI`XF8((Od;(E`mT@`wXy1*E}q1v$7MnLS) z-BSq0cR$R6%Lh?0)M!&-?c~Dspr`5Q;+7XT1OXYo;Z$lh2-pPl7BuF^ouph1k%ygM z_bG(KDaEL7$PI*j9aQj*VYp0n)UpKvqL581buaR%{!y91bE)K#2V=m525q6c8i}Nh zK131IZg7=J=1nm}`-tm~UG}v0R6)2swB`9s;EpxIy-W-1GYN#5uIapeed_zB2;W8Z%{Gv~VZU~{LLkpuTqPFv zX#GM5sEOe6h~|FnD#KHbelzv6OMn=pH(A19_eF0;-$w!_Fo?`L8+ocl4~ zH#sbSx1FPW?4>k(W&gg8e!%2lNbJQ{o&-AhYBLF9J5(1&4}%eo7Tjl_m?+)R(p6!* z!&CI9HVWp;%E`&e%F0ShYdI>f5Iql9HFTTg-8OArH8L~=BD8_DjHhFh7vMgOvs$hI z)@`zsepfHgn=cP1z+3{-EUm>J_gDHJ?@N$-#oi+g|_2%mmF@m`o6pv0><5Eq0|3>($s{r=-T5o#J zpv_Amp(m0(it^w4&CT`xll`!dsUr8g$Ok~&)lkV%|c7Pq-3rCQ40S! z{8a7PTTL5dArOU1L^f(Oll(S)$H0H>>N89*xksbs2sp0aY*|BfgoKP!Z<#3B@X{tgDOMcz1x&FDNd;9n>hHy}W|>wM+6> zJ*_;1HYUz$Lq;Yq$-YYs5wGLxP4>rA3x_IR1gcG3mHK-78AJHyg?l>e{1IXt>Ht)f z`>N?(7^4j82raWJX*ERjssz?8YU5~L6=5k%GWD7OH*=*B$$oyMd>9GDfk8Gz{4r@` z44gWMLWV$6z1C*oRXF4o;l;3-QRzLwl6~q|vX(sd|RaZ&xO_<=CqZMro z99w94AG&NS*GZ;@@ju6&B>R1|B>sBMw~JZ`rmj;YWRVeOI)P9~STyIt%1=SXBwG2U z1DJZ2h6V4leq~H?f~i*EEYW8nF!%hEEr2!!zd>`0OW=T|HBbD_cIy7xTO=m2_PA|5>4G5*)WDS1Lb*9WKJ3Cjt{3_} zw`Z#VG!F#DKyc3T!BeH#xUT-3oU;jJ)O7q}b>bWf=|ckmFE21#ZO7H$GBQ?xEE;b5 z9blX8VhgUj>aL+M8XG|Oh>~Sy`2e{p=I^xK9g2oA29}0HF1`R32(D#6!#>SxvDyg8 zwDCCuUc|cL?iC#Iy0WjBKQej#W#WJ8ma_^Jtx{Ou)6>&$JpXGxTWLh^`ThHMJMeD8 z!^2;Z!Rx>*T%_T3{C?AW*(w#bRHx!~CvkOk1yuUK95?#|Ke*Q+9|k};nc3OK&5lNL zk$+_Y@_4k&E=gLhTd!NpyOA%>$dhKTJ3LzuhT{-1iZvDmzl7Nf7=7TXZB{G?S1nO`aHpTHDHp z<;jRsk{{;w-pe?n2c1(YG6+i|=k0ejFr5ay6v7!n7(y?`2+T027c6&(ZFS^s3Hkfu z%$k8>^FpH{f%?DM+R*Q$`fy$nGQVA1KjFC5x)|yUdpWG$qL^Ef;6}0-MI;K0*E2?B z>hj?ayJT1m`B)^Z5l&X3SzM-1EMpQNk$}(CR{8;eX%iAv9OFg>?|>nQNgV%IZx8jk zc8VYp1m}H)^hIbcnhc=`Hh8RlLhGWmRiP-~Yei9GG&LDB5^A=K&dcJCHAT|zLLLdO z2T|s8ZW&rf1==~}l}qHIMSO=^VnvU55)^0Bn5u0lr^VBbX5KhNbJ8o%QEBADV35ts z#$-Lb30cl%bQKv+_74R{ySz0=hk_A2sH7;jeN;Tp8SnT{@#x9s>dPro`zV~i#syXZ zPfD^~L;l+q5aVx831%eq>_J>mP~(DN$;O~drWK57G@@SKgqNf*yP9;0Rcn@*ysI)- zGY5?ts{w+loEa;2rX+7n@IINeOcpjp6e1D*z(7dmTho{*v*E!7F5|6E8x89i2U?~L z<_1)ksiGTLcsS4Vlnd5)C$b&`80c=xfym99_u?oMT7UI_SosKmC=sYNv=7L+bL|RH zsAS@)LznHdk0u6q-G95c%O`M1bwbo>!9z#$;i#y*B$W}`yElAAq#qE1hfmp z=OlWVy#`pFG&0?|V;3{O-YNeiz5ui^{rU|HTNl)DPWl_HkAK(a-yw*1*x2_;v4!{|63!cpZ&cVd8eF64 zSh0PWhV9%CJm|EEA)8+*Yo)QxKvKxY{aj+$Q z-TOvT))kq&l+C3mTJA4)KVNUVH7s`k8@c|2*InRtKeNf*m~Piaa&W4{a{aG$z@&Y5 z@NMI&_;234-P20V6KQ}-30}BR+q_ub@yV66>YzwE2f z?_yADcPA>s$=hl%jCJ-@M9Q7kKgs zrFMtPMh1uvGW%<&tAJ{219zqkL4;#3FQ1BJgaoH!WuAlUH*cPA*!`cloB!NRux_@TC%y>g#4{x1@|7ayR?*(0TgImkkp#qaH=`W@0sNc89Xw&`!WaUQqUXrT~3giyS^4U05iHgu%~ zGkB^!90qW_a6yZk3V|(?L?Yz}F}%G51UT?`y+V;WE5!BqQ#Bt>SrEyPshJtI8U}D8 z6|y&;NDGhydTX^aNaXUyfwry2d68yS3c(_E7xOP^%77A(NJFLz|zlTF?tc z%DG%S&x0;Sff4*=d>sLyg-4O#s1srM!Z;-i$Gv@hM*T_y21Fo9p(_cQfU+jgn(Yh3 zL=Mrwb$oU6cX5eNM@_OWyU7kPs3KkP6ZaQL{R(8gU9x>Y>p(w2U=|4gY8g8aNu*m2 zqdd(6Lwv*p+5W!Jk6Q@jBQ*2I&Bs~jKI|;bob&>+9)my3sHyq*Jfdt_(UoXQHV zoNc^5iX`l^^ee~ZHiE^LFjKNZ%Ts@+e)d_X?CB&m-Dg654k?ItXHl&Z#4^GZPg{T} zsFg<;xv%)hqkUVaenDoxqXS9uTmI1?`Z3)Hk+wobq*pmm$}mJ=(IipvEY;#w0ybsb zy}}?XUo@bh8CIQu%0bud_`bQ7Sogp8As^PyU}Is?vzOARqi;$Xe0X)D{+=lSv?)O5 z+UgDd#_t5k9L}A_IcaHfMtt1d7Ext76^fA}_DYt20Lubf`=9!!hnv`_C|39O3HnK4 zSr1z?$Nu|pDP+o=%uK_~Z~TNnsB+f7Js?uJ*>QCZSl?Q=m#AbNDS5<@ix_;2u~xxo z5E2v8$VpFM{_Zv28B5-@JAJGkoUdcptgkBilw;!g^m5Zzw2N%c2Pi$xQ*Q(wL+a{i zjvY?qGUDVr>Urbql94IAEuA8nGVhC8<7J+fCh*AkOguK9ZfZ82mkq3WY=fqBAeuekPs;a24UAO5UE$6CNPzs1P--WWHb57ftN9O}t(M`|4 z1rhF8CDkf1k3UQ39;d!nGqQ=a8Sm35$+83l4uXa>%48?b<7to`JFA-QclDe+=zlv+ zT3_}A!ml=oy~IBu^OOOStwnXc#IA76{la^vtkuR1g|_b;VuD?#Bk?pR=XHqY3!7^Az0+q{!tJp)5^vP*ak|+p7QQQ#}f6uDIVve5cBWQ0boy7ZaY8!+)t+Z?aIb-G&3ioCED_R14h2}g*v@V z~=ZX?^-5W9byzUM#lxPaDg`GE>-mJ!E2~d1mwC?2OW(TB*Nctvj zx6dx>Q7kMYPhTm{CILE|J*!^(`l()t-&RlHIN!(RFZsImjul!=^zyTJYymGfFOEJ> z(?(ufbq@)JOyK##6c3+d1Fly8x%C?{Z(8M99;2i|y8;OakiFCF4spJYI}b3i31*Ui(lAOhmIX{#ga|EuVjn zx6Z@AfE z{rR>RelniZ#dblF-KTdtcxxQ1D&rb3HKs=C^Ui>`s(HiMN2HJ|A6&<4*@M(nCTAN0SS{!Od>=8>T_V zlBUu0`Epe{M3yedr=CFjI@RavcBr*0>aSGIe*>Z!h$-!-r?M;g$x67|Z|Xu>6lG+F zjB3cFCBn(XPoryYGI4ekI|} z-2c4*F67)64!#OFu}c{rl?Iv?6?`omz~OK4s(6Q?#QAI|yhrLO(L5QA);^!ItF-K5 z@TliPTYcxOXbMh*YzUcx7|T8nG3*K$%XJo5mJ!j#=O`96w;&u8jPQ^)>J)7g?#MLm zWbtK8Vv_NFf0xBLe`tI2JA4?p{t6VFWomSe=b2Vc>IOqK3knK^#fYM5(M*(?++r#x zHJ80&0qd=Nfe-}zDt334dZ!6QmVxS6e_O0$>j?Ss)}t5 zs&s~jhu>E%+|~{V|$vR{?kU+;F;~(N<{j zSPXu2Du-mTr>t+Kzlxr3A1~$jHcaxFsf5Ef?;0HUn){RathbfQ|01tjwc* za-vZ|8^ZF9vFwvj*7

A2Jmf4Kh(xS9gBylHQz*QhqeAU7>CNv0{Pi99KKRn4gc{ zijdlT-@8GOk57kt9a<6g$J{;7xMtC=adcF^ibu5!6UoD@ej<<5w`yq8+RfX$ZQ0>p z{dd6n+P+R3@lL)-LlCs~2mJ<~;!~};%8U4IKL_Q#fYYxxS&P>pQ!5gZ;c%`b^a3*h{m|)o-hB;}S z2rZXCv9zOSxE{$9tWSv^)e0Vb7qc609gOkb{v)}(k+xsb(x`l5F-po~i}8(O*USe! z`^BpFi;m6Gh3Yld`qp6je4qoXV3}4Z&ud7unvXO~#inx5Ad>fTZyb7VAn|=27MjEi5Zn zQBv{{qM3|v7p>B%z{A5!Hh|xmb*wRH?0rKM0mcOu0#!N%^LDJ(4KxK+p`oFS3L2@> z>O9rE3o9P&AHB1oz=FnU6r#?<#Rc3k^Q$Vu4H6<{d>M@`xGqBs2+3oT)>Zs6y^x=F zO#qXTro5tXC=F1PwVCeh@(sq(`bFdE@)a6|goIYATdWKA4S`2Toi#e&HXamM^=l^Y z@ni|L@{Tf(ufNY{IPi6*XIE=6g|)0ZGRT_?gxf{8=v3%b3`@`QSm7ZP6#_0pA)&T_ z@3;(L$)ReKZqbNV565Ki=WnW#L2f+@Cg z3Y-&fobwIjFXW=wrvX7FZ>hDuT1iQrn!eiDb_8SHo_M{gU6K1Ofr`2dA!Au7FU;=8w$Ro)6&r9wesC-$aPJ)RRd3dM^+%fcS^HcThVzEjjlQr2k7VU~F?(w>n-_<#iaYy*37q1HXy5 zrJYOOcwRMpiazykr^vX*#AUFpP1b5%kBTavF(W&hZ-H;v;1cUwtkp2Z`z=NVpXHsM zon*0_eC0%X*a4fce2;d_g}6pec<%@wY*qtwvws`>q|sIHn^ja*hcO6v!!q55euQC? zMRAsJJ#TbTz-R+C5f<0GU+-2=Ed3s&O#x{ZSI?cp9yu4=zfihK4z*;z%13n;^>D;cw4af!-}?J^eFxEL4X%}U_r^-rpkRsUVlEZcjUWB z2aI*~;&EB|jsI%XM>2jD`YwV&pk&JX+Q=XHb0Rt1L}B!m54PKB7`;FYj7aAL}h}du2B*Y zc8Zn(;c5d&{3Zs5i6ux@xJ#`Sl-iiZwRk{UVT7pjx3s3_^_ZpRmJ}`;2M%K}2v`bv z&)i^bAkOnBS2eCX-dM43*g`P1Wo3stEm=5H5W4!qD~@9+-nsWh)`x+jfDit0wW(_? zKq1=+E-fvMDzssL0MBbFhI7cq-__L>2;alw1#yUoj80^!d>tw6tB74KcAZ`ek{$UR zXVqC(SLcqGSxJVcX6aDET?~da9c-h%s(3aO!h!i{;pL|roedJ=B_tQTD*_iA+#hED z2AOZZUFPRMMq_vcmfOlIIu%MvX!*eVAc09kn#28z5KVc1hU~o|tNxQUg3I$PTCllR z6P1o0ia=yhJpkBIn({02xCcPfaIZy2SPcCT>M(&fW4_2tl8~&?(Ijci*yw2GPeYx$ zILpB4Ay!me*XiV({eadhNGUxeNVGii&L#@gYoy~w0#8cqUsNDFZg^w}i?M<;M*yxY zQy--8@9b{rQ3tUO_`-M;)X(DSdzL+Xc7NWVNn1EVxIe4O-F-R5@AyGiI#^U12i_}# zA4xoHz6Ua6{&|$RLEy|`6;N=d;Nf^Te5|<;u(=AA3O5*BSePo!Nx-ByNh7Yrx@rWa zj@>1UHa)AKU-~-~uhRL0tF=8XW0i>Ggy=gT%YOgj$Bc zEgu>w>^osaAv%_b(>5|t9;XI38(F6_E8HOUS9F9H{qV+@enLyf_xn&A3wQim<`;GK z{8*F)J-KWTPTETb@O)f(PqGRcgy&sFqUL}pyJ%qqM~cK>3Wp2gXW{8kRGeGTB)4+N z9@Y>*N;OEzWNArSB0M#YI1(28$|-xDjim#6!E0Qitm9Cj>vZAuVtiuQSlD@UI`f&HB1>%GW}MHAWU$ai%i;!Rc5mW!!8Q7j69NsLIGsavU(D>=Sv-L zhEE-1VWf3#oLLZ(53LFe43va0)-a>PEaWa810`H`OM38G9-$efo_)iFY`l8TA{)>S z>cbxQvxIs$gp>D7m}HFEKtX*Wenc?UDxG^uhR=bUL2g3O2a`hrAIWZ6Z%4FO2#_Cy zvp_RNj%SCt*gGTHHn+2G7@fu*yWQ(;wM*_B-G478yC08IFaE-Mb^#`|e$r?uVRVUc z`;wgbX04QZO2#${g%+A=5$phoDRj;Qy5lqiG>HUSG{z2UTwHdJ0cyH$HxwY&h-Mmg z@!Sn&yoNw1|3XjrO&AU6N3eDPDxs;1!}fM%9Y9M^z#r>MlvrFvl;8Ofg^zyJqn$Q@ z&Vq`97O0V}F`Z_3riCb|m>F+it}XW)0|rDw?^%Nu5e^*%De;eUF_bd}LGyM{3BBrg zsCNv#@NjUr{O+mn1JUVdw34C0D+ME=Obp-BrL`a^GPEUNXb?M}7i9vM$l zi?p8)4lD`DhaU#a;GN8y4dVAB;#x_+X~4RbpGCP5A!Zk|@VKsMrR8-^OSE44fu?b~ zh@7E$p-z!wq+XMf)Zq?)!aHuLO~~+)C-Bw91n4njAw3RNbYqf@aEzI5VJ-L+BNf=t z+VCi(VNdYcyukvvgp}LoTzVcJZ6JjD*v}wjw{)Lu0J`Uoxigs7qllkkcNR^J17Oy1 zaf0Qy2ftcA{8}1kp?(@oQX?NgcuJ9!K)!lQrj1EJqE?B>sC9igKpQIgO;yvlhIT^R zD-DB;RRPuOEM3`@q~it-f}tI~qlbLj`@`rE)r3P0+!yBBm<5$&#khvEw=^|Z#;Y!;V+IXKJp#^1%7$Gj|Knf}4YS7GSkb`drhqR@srAhQm1P;)G2pZmy z%Br{a5XXTr2E2$Io-Op<^Fp4E;srI%*IXVy2lAG4?&#!7!b^U|2cdXECuD`A9VglpL{x316K z`_!E<7l2vl30KImOBHytDZh$m2N+=Q$G>%A_hLD;`6X&51lrg4U!HI8tG*Rym-FQe z$~F9%Gr1j_!E3Ocei~ypdcqYveNS5W;_m2!V#V1f(1JWE&kyO!n60VHzg3N6m8FzA6&tge)hFOQ|dV0o=XMlk}`g%ovdey4>G6L z={wr|*2{2qnB52A`M^>X*T7PG4sW2w`8mW;gksMnu*V81R`Y(dmeD&UvYWOectNWj9urR!~GS^%;Qd^^tkU`&jGYdzL z(Z${D#V|Ga;7^G9bA9O-lV~apvKJ{)n3#W|EBGylr?9Ra`e%e+n8y{71*I6+_U<1t z>Fb^~UtH8CYwL1Jl#q;%^;`7@aV)~u6FfAiUj1<8ynoN@V9Sa|eM2X_D`o3^gS2-w zW?*Bd-cuy@SKC)vg%iQKmmiHprC@qZZ%q&tj&{Sid{^`y7xpx9?5YFoj_Dirt*GWB$~9&W3Sxf*gUVnxn22 zZqFc;1{%uI!AJrMW@$hz!R182H%`XHp`x2h*BOKBe#9@zedDm8wOo=Cu6B&i$H1-Y8r}TERMgD?qFYdT+E}BLGrM`6Y@M`Ppr)h>_yV8%)m07qRO*!BPJ*OvAFc`urEKq z|Klwl@?<8@-*Dz81yS9e9_}hju2lZUg-VRak z9q41c@Mwg+{Bi;3QoC>rfQV2a_(AB|2Ho&xg3~3vATg5tg9AX_eAprCZdrB^ovRl{ z6wtjlO>28qzy0O6xa*%P2#;{E{&3>K6W*%rCYOQa_@6+^;gMQT4D`)R!YC|?7-e1WeAAOxobp? zAuzaIMxtZf_Qb&%qqdC;zap-B1Q`!QdCA12VoUCh@wglGpG+?Y?@fD(q$$ddIGxFVM}mhY^^d2_odgR44eWop&UHM`O{+Fk`E`Re2oiF1Jd4&Y{hXmgeTtixC5oH>fPHef7{_5UqJN$LwAWLvw=~ z$DSKSgcJ5^gvW4k6ewV#2@rombJAmS@FVu@*U`Xc^qR*%>g@}#8b}_1Xx9@&RFF#d z(P9Afb}`rh*j<>fw7bAp(MZL$Wl#tyh93$WN+H7NFE$GAF*v#HiRo4mJju8p`dDwD z-}CvhMuphuoTN;@H}Ny#6#Qj#(!j&qP5RRxnNHuY&n~(RKLG8cU*k%{LT@9o1{#Oy zk%^B$g-gnuyHL@miuu0G-r>E8 zH#N5cBZ!%fRKY^W4%T3t`goj@(z`uF{ z)Ar>nSKx0ivTlwlCLG}fE=BDNnSE5jEGIXEW7)O^S0b_yU2+o{vr?uHakhQ7Em7Q` zKN*__B2!T@!ZXjc|5wNo=Fck!6iQtq_j#i3+rd}IwhK8s3(K1Kah0x#pL?zR>!Vj= zFZ2T-rvVO&PELAYo6MjBGz3t#oVFbUy6$s2V0j0MTHSZwy6*r-@+M%Gbn;nU6$Lz` zQxg-OXC{}xcKm+6rfWCm-D?I@*-^5t@m&~TO>6*i!Ed@>{H(ixm#Xf#7_;$)o5Gyd z?hZ!3#Rb}Wrg1aTt!n#tis28R+!PzZFRCaTk~9HQ_we*B-%B=Vj{C0VLSeeYU?lH= zsAn`OmJapl&~M_sBpfhwqq{h9uqyINowb^-3NZK}9W&1`27v-ZO>wx{1Ob#g96j=W z978I49ldqc@#IHKffBwiaEQAORsvbV6|A#1>$mA`?=S!KR;%Dei3i``T|fgQXGARO zvbf25rgc{4OhYH^HK)GudvN9XkAhxXCvilJs&!^!DHHbM#6jMw@uMlDWl-*1C-Ens=GBgMlaB``3D zjk63$`7;Hwl%89#FwKAw8!)z*T$k&zva!L{E_9uIbn=<@*|>b|L;#F$b^yiUQ~%@R z<7*+msHo`G5&W7X2Rx(9zy1jT)Bx^dApNZyum}SNQ~T%VvzM;b6AHlJCiZeER@3=! z#d)vm;ne5MXVYh1TleV>a0B=C^>M%Z=hoRB=KtEvf)McdlnT}9sAPNihA>9V6Ml>~ zZHn~Eqj~mlG0{DVL6RmEhnS#P(nc389g`Y_4u)QaRq+;q!& zqbO8Llo&`gj=W$Rif7N{3TICT*xAM$W7lysVN;YO6Jclidb3PBEOuL-Am1?Y2Q|!^ zq2W2iL6E9{FnreVUs>LBn~6qtfA(e4(!IAx(`I7Ap2{fQm*&4OVhsNf`u6rucwI8= z&R|hR=Z|R^(pw^Udx$hHrXQCHRGaUP19iOV2@P#a_-bHYHMqBicyIBZX|bjMdnK-R zB!ofBl00{ZL?a9-bho4OV2fO9q`)w212hqV=%-PdB2T#}YNo9GTvog*ISYcH-vXjg zXzkSs^FEV)Y8Ipvi3m_*K!QKjJz#wTrJ`jcD%{}7s?^uDe%yW=1Z_H+*J=2N-y}Fd z7tI1x=vICnesb)(+h={>1Q@yB@UJ=dPx5d6$%LLaX1M{szV5ha@OldMR% zGXfWYoJNi1py)@}k&34Gb^sQ7lWiI^+4}BGslkM1-c8n~Wv>GaP* zx*Q-fMUL_TdR&hm(0~zym%x1X`3~H6qHp#cU^I3R7zcEK4~tWVi}&uFlT4eS2Ao+7 ztEWv(1y(QWXfiZ$p#qa+=sll&a z%ogK_D0O#WbBoKDhMQu}M5FoT-wg{Z51FJJc?Z4gO}5z4vPc%GbT~r^E}euzOR!|2^$-M{ zf6N1$*hW%U8boY*;a=6Fw<&2oHc(D4EN_WQOa(rzE(gz+a=J}Xz_kVrc^0Bv3F z6lVLvb(3vG%Z?5kIR*)lJ|5@yn%enxuACE5#U;JwB}JO_2aqXBvb}T^B|9dt0IviP z!>zB$_HQFWZF)UT@LLAS<*gM17*ePoE{9-E+(4UIE^dm1Kar_XUXg9Hs3|DWus_o4 z2R>Ap_-VsdUDl_l92%Nl!bt!bm`EAgU>1xWj+ge$7gy6JRDXlb15wdL1NHud46H#_ z{wbA(r*pc^G^LXyCT))CsoKb;Zwogie^U*)%)A_pn{t=M;3k_kZJdSO$Koc0?NM_6 z%!{D^#pE!@!8tG|%2ogo&Bm;`PI8id7$5whsaC~buUiFG>w>FN7vWAQ2bX)K<#1Q& z>#2cvGSpS2DBT+GEH)f|=2Lmjr*q==uL7KS{S2MTeal*fq|>lNpK|^3@i@2>&Jh?% zY>LaJ#FTlPR9?&zTdOsr%L3UlYqQ7)IFxaP6C*@4MO1U-Q4+15;UhqOluy&Des`yS zoyG^agzeuu{>AXGop*QNbsP0@+1v((wU;Ely8ZuaTzNGj0&Nt#W6U)Ut4)i?B7b|} zfpTj1^Cd7|0?jOn6u@fYFie;ntETO!yx8`&Ct}@W_2c;XI6xXJ0dOnEKo{8;V4A$0 z1?E+s?i(NA#(bS4^^F(ig4IwhJtysrHF2+0&>#K#S~u9I1=f2pxP|flS}vS5JbCM! zx)hWN*sQ>TxF+v<3Sz6Ou>h@jHYewu=dCBy<#K;A`WMjq#O7$Y)KZ)4xCg?~#CZSZ z_m8b}YCL%Z(H3bPN1tb9vIn>it5_9FoB}Fb^A-Z+XzT%u?XWE5qo&qWRw!voy+A6q zmb2iFeN%XMv!GyaeQ3|=NGm}ZfUBIqfl7nF8swdnnn5|j?1LS<7x#go0XZ z^HP8w5{}k%ZS8rUXcXd+BMHkEzS4H>_&cMK2@M4Tbp`nlO}l_DCQu-lo8!QN>`SkZM=yY>ZGHwuI_p7tlX@|9@$=NT zB_GdUXiD#{h!4vN1OOoX4BFs1L&l7~QEQ@(jfXZ4O@ zv4|T#8qHfM2MR)6`M9yD3zI;MA#n_&r6q|!*3y==df{?M+`w@Avx3rew36itScH7s zX?W<|u2ZMf2Ww4Lk>AqWOG&vK{yGc%`P430#K*f<7OJPc92Ks`TQs`H5A!1v04=)3 z#Wkcil<#LAho_BUz|~s^1S2fgHN?D=!Gtmn2`H5vc}N+-|H$W3YtA$`LXGTqQ(&tr zEeh*5)BZe<(bp<1R-aKXH^arFj20Li(zthd34yG)QM9gV>BE<%c%7Ep)lyMcg!W8i zx>X-3073CpU=Ak2aiRI>Uzs8Z+IyMf9p#Y!(R9{PQE=barz8YPDd`rZyBq0dXpoRW zQefy5>Fy368b-QXQUnGN=@Jm6LqtLlc<+4Q^<(kZEY`4Q=FYw6p0oF78+t&YuxvT5 zVdJvd`dP$RXD)Y2IU-d@YcwC;6wQHa{V|9YR4aD26-uVG{BpF%Wrf2g-%lqT&qa$7 zjR@kFT-9C+Kbd?-8j12ghh>5RBU!8;4_c__5erGysu1wOk!yNV&cWUi!Oj2`X!B3D9*ZE z;+jD@{w(C5%!m7fHrn=PoZ|(|lB_lFb2H1UMs?#IvE;esblb74dW5juUGURI=yjpB zmzS5HpC1^^@c8y~HurP4(2lAzM`I?Vuz@I6F8v z@KTrqD;fyXJ$<-8T?fMDs)G;zMn80)c-6f)Euh!}g_z7mmA2IV^%hEQxrvDhDm|mj zO^M8nPso)I&_HXk1NZ7FD8@uuyS{hkX=0e><{rj~I^i=^=6#%(YnL5b z)5_ImZ_bt9h_NGJaQk*7OQiC$L>ChE_pcvRi}KF3E&q1pr70uI@bYqNjo$`g8eBy% zuT#Bb<(TZGp(HD^>qsXbbjQRjkwwbjJtIoTw~XH3vd)fMTeBZrUAzzoMteLf13 z*;y#A>SHrJ;a8?*jb>oVVvQoqEyrnKjoft?Qz|Q9gFgJQ>(j7>RR$y{zjJ=G(t54) z5$?q86`kV2kN-_LA-q9RnK-W;ct+pM)^Kbuwz}XIv`%fc zi}2ipnzFKw6J7-jkgz~g@C*ouUqT_1D5F5a8rjX|UNJjQcdY7b-eC&j|C zchi^q8UQj@pO7IFPf&BqlCOysGDk>Afp5GsCll63?)rF;uf{DZ-t?x10I2U3NG@QVEGf!X};tz4)8Xv!Ak{rQI{9{hk}q1(j_ zS6Hp8)(Ju*;m4cRppTA1R7;_Rm=p^ub$F)hlKax@J11XKkcQ1`kw?$5;c&exQ&CwcB542+lk=o>zau)cDN2>tf_R+i- zSAmwAEGMEaeVO{u3R-@ED0}v^Uext>X*t3?&^qvd2pum!?e{WiSF7a!+SC&$v2{l&A1)(_Q86VH zC3?>b*mr?H5w-hwMqTycjo6eQ{ySt!Eh2C$L8KR4S&%~H#`^kSPM!iyrc$i;=XdbT5;{FspTniJY{q%Iub*k#uVgoHqwK5Q&!+?rRTUbwJG=fkefAeM zpX9O&L(fg<1{M%6O~qk0NtXDROmnqA&C%ZLkDV}Jvi5;_tU*Bpd$>>-ygdEj#Mpq_ zCZhua$@hJhWF#(7K?VUoj}lMjTWjF4^;He=s$Xp5p}7bam6QVJ=#Gz$*hSQ>IqVfr z<)6=6FtT69F&+bXjfXqm7m1Fp5ehksQ0?OJRbA%+YKh0uD%iXtM1~g>!(r*H?MyFo zZ^#WG!|CEgLb7T~Xrp2aUNwdq|Ji;Dn|@<}My1Hi>oKW21cEh76&)#}b95mY0V}Oc zjEqo$@y7yn#eGD!f>Vt02pljQ2uImzbtwseKpgkNtz0418X3{>PVaXkVnU+`k4Z*7 z2p^>*tu}`U&%7^@?mKMuvizn1&e~y>Xc>^$K^dv=6yXJFzPKkP?OGXg( z;UyB{H0dU@PaiVVSNW*%CDwxD^#otJ(kftBMOH;I$3+{Gc#Z-gP&BlGu@15^I#bJIqe|0~y`Eq$!sFJgL^lAzsfrj?17B?7 zvsEVfK5xGaFL%f`31w_Hf(Svb@-lus5r!l;s9>}F=~I_fk57rt{!iRcs?w~A88M;# zIU^hXGe4F5ksP7N0>8ByNh&mzH>36=+-6dY341j^I_~EOrC9P%j#a7M)qT%g-N!mE zW<;eJM9rEUUGt*hj%($n!)p0sox*t@8HAcPrmJhwW0Fs^o@;nnysYf~^~Z|Y?R_4J zA~SsQ3vtM`u917~!u~70Pv{e-MrXuiqJwzrkFpb9xp_xcA`nRb@YwF(zkiW=+CR^c zw(Z}WNc$Xc&Md6|&TQ*03v35gy0IwNw%gXWo|?c~xZ_R7Mmf@LT%I>(PxQCy!%bDi z_u^C1!m7?NN@(^bT9NC~21O_A&ZzeQLLhzp3s43=JuS{+6j<G1Vke%J!3$V=Y?*CP~WWP6s+j==?J6NAD+B1f?w7NW#@_6m=yd?N7 zVBC926tudas^^AzCMG=(x0=s3na^jJ310O6BUwXR1$T5ju{2%{^mHi8aI~{y3GYnw zntntr6Z~&zHSo`DVk9n%Dv4IA(_#E`|C{HGT=GufFhk%OMkKH1m77>tun4tdmbbd> zlHZhtjxXa_yYf;vFSnOaR(IS2K&4@uvrMnY8`q-sR<1Bab>dvT!)+WDK8^TvE7u%M zX|1=jv$Hi*c_NpdD8;|_(4Uv$5Bz&Q%gG5KAJ)DVH0>zHw?vm(A9#wZs}FvU z)O1pCSus?+xeMl>39Uu`l+R5+Gylj@U0Zv(8=yI3P-LlP?bTwpV_DbM-2Lob`Zue0 zo4-V{^hA6J7~0=cj(>ER`0-UZGlTR%oakphR+zWL{;z-Ug*El_r&d;h>E(DYW$VQ} zPtOFRFbIH6e(@Cmfr+70jOI*qG|54yINQR88HSqQ-LVA$5jL(5}hW78#gG^q2(mqu7lMF;Jy!k%re!{L5%iqFHr zx~;3ZFp5-`C>TR5iaI3nK}93(4-OnxTKC?NE};qp{M(30fYJP(6{b9qB>Utw@o|f- z(#342R`Ux}W@cvM2Nhw->0=B=N7#YEg%xi!ad*=mEo_o{DTjsvKPrlVZdVMWsFel+ z$$+uOqV)B?j01efgd%;25>I`1w})ix_MB_T{~ zNbDdNmqkJL@LvEF;^*acQNFu+1V=JkY~$~O7icu1bz|FLV1+l^}e{ zv)(%`NaO$SzkUU5EtRKLT`d%gO#zdBEhbVPL!CJUdr#yi37!<)1$Y%)q5?7FawQ z*CgnG?t8+_8&9M6?l>wdE6eBPfM6AP#$bP})b;^5W39#OtRL&7>j3VQX_%=_8*5ns zd=*yXg%iV1-$K1CPS-Ye0MmxJ?1l9i7daIPV zx~8;T>wu@?XZFcL%v|(4=tY2frAW%?IOymrQB5cKn4FwR7FgIZ!JVZpkNh^pFjEV- zwC{jjLi1UHv1KeDw6^rS6%@$6+9wC0;Cck+Pi6<^4S4g0tn4M3!HT`mOx|M&FY;RvW`?%@SN^)~oQ z-G2THhgZ{dba7-FW*H_*>bWZ^68rH|a5@_!flY}n5_D#hF>P1=QuegfHMvX3!J7q@ ztC+_|k>%T3huq*bIy}s~zqIhlkTqCH+~0J)8Ns`Vh)uZUpRWp6S1v`Vn^s<1pNDTx zKRv*mF2UJQ`nY9|3iwCQHj@hH4=u`I{}q&3pu)o(gx0sWpXGtIpZW2_2m;yxS8#L(O<`aP zdRtK8eW5svD*I_&#&i1@DKODJ*kaWz|5>z6@)GY-R&sJ~wCj<^v`gg4~ z7dLV2ET~*&$QRz|CE_UzirKlJwyu|76$rSjU~R?dShPWxO?B&S5BD7rPdaFnQjZG~ zTvp1{D;u@q$HV%OT$q`RJi4W}w}$7@Mhh{SerA1V70sf?ORb&%H0eW76iwEq(Ll zYVOUWY3eHjEs!14l(y%{VxhzDi-#o>qA~u%;X%t6?NNQ z%%sUWU1>|Y%__MrEHxOpZmA1OxH>VGaIZAGGBh$G7jYH!{ncl+YezsQxw_PRyBS4S z3%7WjZQ{Ps8HkSMq#U*xnUF^p^6$(-!kbp|-!&kRCJHu(JbbIHy1`x17kKuw8h)TN zgFDBNO_?Il6#De(HCCR|+el==BRPFI|8RAB{~q3PYhEW1x9HE2y^jygwvJ?zv+lAt z6c7>e5f2WmsyzhPAa9@LhmAqxknTcc6|6Y|Deqrr0GIE&(#ifsFtQ+;@CCypeAJ`K zeI^osVcbUoEnprkPjKUyouQa*Unz~#Z}H31V_E!MT~B_G`&jhU%p{chJr#9b>wU6O z>SFcn`|92J`GfmuzrVGaI?5P;kAxvkGXXKPiKsS>+WyfhpUwR>v1Vw% zb(u$;a&Q@-XfX14En;gd@WGmhJ^cxA;&q;Vrm9H^2yRqz42bnUGJRJLRsuS^yH>UfihnOH|b-?q_ z$5eGa-rz+^kd>~OEjHT4@kUo>S0U+NbgoWwBuZ#LSD-XNvODr_PbQuAFEWE~$} z_~Wj4)0(!fsb79b68=nsnl1L(cfxC-;RaZNAsJuvF^O<0Yy2Plz8cb+JyZYU_;e}cDe$wvr}({R!S#E0eb6AThbu^u@^DEH zUkkde9hYANpWlavf{>01hg^=!IE5J@k=1%H1-i_g8{7eBu?Rxy&fyo-)3^8{>d=|O zCD?EwSf0HK>|aPVXUtmzjOu0z^70OS0+~=tLxMUa5HU*>QQVy>}~BQ*zTpcVV<|S@Q)LrkAHsN8maq6!;xgLu@^os zwdJcL!TT!fay#jA(yM!;?7P3$MoWu_DgPX#p_BL5{H#?xBH@T~+teixKvq~X(N;U- zKCXW)7k=D6B|nJe3xFXXM)}+v?dkZ^r_KGB@aMmS8lv8gNC*Q}Np$o;+evpkd$?Nd zr~4()U?GLH5fjPcZvAD36rs)U|50Z0UI=cheL>F@t~2sj1Ac&EtIM^zm6FXRL3H8Y zW0^EeR0@rzZ`W6LoH&L9uynd37LF1xeerOF5}H9o4n!Zj!KF#@2mf2)NOH_5jiLdBR97LKLbu4ngVE#Ju4nbfdbLQE>(hjzBW6M>+_xIGy7GJoU(TjBb&HxuvEHy>DU@0GFrMpFB^I4SIkT(+o{lJ7 z=j0iFl$o$glpHW>V`KR^>Q5ZNyz)OJA)J>=i6hB*3bn8@lv!WYYLo*s8tZuONFH?# z%@$3!~{~lVg9dR^;wiP>CW(aEZ8&}ubl^R8p=$MXr^~x8(s~Q|k zt5iesdfOFx=n-a#5<59tfIW~_N&#**L5Vq0f59{_s6Cn@(H?%XQOYT}k`BFQz$i$0 zeLor^WtRBTba#Fjfsf@*n8^3OIyv>K)FX^UR#;>K_MCUpcM=1Q+OYd8Y?1{p4;z1| zZ#!Pq#@j{@g<@r513 ze5I#v1mv+n6~tp_lWGZSKiSVp2LHAe+Y z9(|$>d}URqQ|W2QbhxpuV)upoYXVss%y7alOD_4E=+dk`Nqqi?2oVK zX#6N!aRP|~tvtQ_(zNHByZUf6%+;Ld@$b?<4{#{5VuVJ}{Yf{>qY~J~)K8GdW+)S~ zR)oIK0)Mhy@Xk7a&_-N5Z6}Fb3A^8d?P(DLqj0-~jL4|z_Awjc8XwyJ+Kv8jrZ}-NC($XAvQXGOocM1JTmr>Sx9&S7^g6V!axPuMjD=??>&pn zv|r28zDYlCe?zkxbayc$TsUtG&DE%EYTl~~+xzob>yu24+5FYYql^%}!qU-@io`FJ zF6S3*A1*hmLkhR{)5OhXBhb7C4OOINcT(`-Yck|h$3cOD{$_i&*cME**Ju#Yyh<#mg z*K3J-wyo`__xBi02!E@#qcV%VU^x>vL#aYMiY*(3t?Or?S}*q67ynl=O?QEft=i#i zH4A=*_tjbXtioIJn3w;OlxODL6D7Fi6O`y*)qUz4mAjg$lkAbUmp+Q=bcd_=nPkq5 z@=O(#8b9pb{E4;wxj-VyQ&=47`@WEJ!SDB>_}u7Hos6>76v?45Cyc*>(&z_X7T(g? z7Z2Ce(Xu(3X!T3crau$E1h)VN_8S0?rU35mC($&u@@+I8qDJjlc>x0mL~Z|nGnw|y z$SW{w(N+lhlm#v|?{d%w@C3}MW37a|rAKCmx+W(@9--n@6uZ*%5bvj9Q?u0!Y5zG~ z(iqGB!XPSyG03My`Vd~cadS|}P*=!Nk#Oi)*m^^Z#g~D@&21VR?H-xLS0Etz6Kz~3 z4z29ZnUbPm(px(9qb*mN5AZ@;5pK-w3%be5 zUhcllfm5!y1ICXYMcRQj8IwxIoKpg9qdCvIaP`n?P7$Y2&xei*#)9F|pIyG#IUVn& zehI#NXNs+rW$e@Ux{2flPg@40Dv>x~0l6ek5TM0f&&b@(oU`xNcAbd3ZS>XMAJln^ z7a&Q&gg=5mY{@632q3i`2)Bl8%`8Au-bMwj#Z|I-?96L+nn60it zUg##ywJLZ0KXq~**t5b!KWXn9QB5%zT-v?BawBlzx6c!Msz$aP;a%Mw{Wm4(hJjvB zc?TaI&;S35F#P(nNU!^Xh0mOq6gB=~Co3c5uItlnS6%SMN5nt4QO^O8X5Lc6Y%|e`ftL#;hT0E*v;m{biI-y4Z@1vZixzcO#y)t*9w^!_mVjsxbUMnr=p?+4hIxX| zkU+n=xj7`O1N1Iy;Rnc>8_2l2?>Wh18{&MA?K>9Q3r<@E`iG8y_@v?9?^b5L*_NC1 zFN*N=8x{_y@I2;a07HMb!v_ly=2l#qU3` z)$7@|b_X1CX4ibF`HiD2%lP)=tn?Sb7RiBs&v9r?|G7-g*zGuPifKpb-~1It%P*Nc z>~e3+o$UFK`=y}_-AHm%D!%!j=O4^Z4?h z6@H#I*gbrg>j4x2iSz_7HE#W8z70*(`-nmyV8eB|y)Dk{jjFm;i;t;0~{Ev}(H=HZWA| z#V?3@^1AO2ovho!%u~V{lCztz3wHi7{Vxf6+Yz`O_cp=ehZz;aoEjk>J_1xEYK5kI zs^)9vCBiRwR-andZToSL$N1P%;n2g4ZnaML)XtO-Z_ zg8hnoe~X=Cl=wY+vo@Sf%#xnRs^I6?pj|a-Uo)A;J?NEHYld54xbtt8#8%QyIkeG8 z+s_dihy|9~TA%p^`swyeU12!c0TvMwXW0d~FUX!DiY0*M(uumE^dU#rNR2f3f>0*B z6x+=|2iNI?&hOxw*Bf+u0uB?x0RTh(2O4##*9S(QZVFBVcacJp!%pr(v{w%|3t&La z1JFNU4h4b=!O4SMA>gyW8U6526$L1MsgQlo+Ujb6X+TciGR<67+1J2VFAARq**AFD zlDYpMpL_*;b{!oZrw${MIEB-lVHfu8$o3N_JrxOKA?XPe`txX9i$#+rhh()tPO&%} z12I_swlD^Y`d`{As-X0@%(O-_ejXp6O8?E;B6pK)HGelF4*`zm&9eNNZEjk+e`}+< ziR_?62 z?8++;M7=R?e!h)9tR2Rd!9Zu^mH*l1sO?FXdV77K?^@j zJX)ifQ|_JC6IYqhpR%G5CjLUL8HRif_B{L@@d?GE?-WM1&zb~-9%s=~@xTi2o#~kh zhu8}6JQ}O&UpYG2=}bvh6&_3r(mwI=k*>nbO~-qlk19PHtal>xZfQY#UVkS(tHt|f z`akAGlLe(ow>A&4{x9XviuSwTm*_-X`(|yO(HxF>@+a4vZ}GpcKAq(MWB0d-DT@ZB zUFFj>T_uzDj3C|Jo^n=ZCb(w(LQXG&gYN?@N+^TBG@QPNY)!%>y85Vue3ASX==Dt*Y!z}P= zN2sm?a9?fWArL_Dc>pqiLr9;?N+yARgvTh2rSwO5l72?gd9;XT30!mL-&hq;{{LFUe=V>iGcj2}y&qEwd<2ak|F3}CEl@dWpoz=I?#y*)w{GRyB5~no zkSirt8D+b}V{8w#Qsh-YQ&kmxD{F{JB=!hB2hAD9N`;x;2gYxY-K=Eg-V_V0|IpBE zdDJrMAL5uBZ3}I4X!z7IC#9P8KmL~4^wn;_!83Wi@=%d+MX#CaXK4VCBV&UJH?(9PMd-ggA1AaxfTA;+0SsWSC%o&Ww&v zW=Vz<39PP;WV#CRqT-K54`IO2nF-M-JHl|_c7}r!F*IL@wGhmCq=MOGLqzlvK#3A%(rFpS1%>Y|B^Dn9BqQxr+BbK?MZDj)xVUV z@JNGK)Gjl7PM$t2?>&Z_0VirLuduBMl>J$-k(=z8Sbe&Hv92$lSU*A|I($I%NB=wb zb&zOeg_A7nMniWmi@BguW~PC?lY@$ugUjkK(#HAi#SN7*|CFqo04pXKgw~7dVPY&1 z_gjro=a}S|Ij7=5cGK{ZIF(vbNC!-WqT>h!n^0?+e>k3Kg<{tqQ7htYbGtIQ4Q_ih zn4)_Sret9LzWPM}3n1Tb0nh$d9RMaGrAQsOCtVM>ArGhadjH7;{a5Aa7HN-ne-XMF z@bHO=N+QcMS9K_+CE_&mWTWY-_U_fg;UbHxeC6J+Wweb~~-M~t7SF?Uo0~*^- z0KABdQPs{DMcs%1l@{3lWqP++c!*L0PC9mhHi@m(bQR#qZkY(Hx;m4Hg}vn)Ja(%Y2T%~vRv5fxDW6?M^72gbXtYka5zwU=^#0K5 z8eIs4^hxssbjgD=@#%1-8r0E*#enh6(+2r(&RT^nkeYD5Ikk3)07Bh9#D-NU+Nhk| z#v34Az#a(C7ksJfMHFg6#4V@dA{;?9t1!n$U=k2VqTr@hbvh8m z>vO2*#G2uuV&JFhQI)h0TFBX8Fina{(1SL~1O7M}$5@Rn*U1+#s%Tr4Di;s_%G`H2 zu8d&N>*GTfsQ`fpMZeZ(qmWx$B|@{G*d`0loi%{eWSYgI7?2jbO_kFZqwq&5gpXIU zOVYpl??BN8)5b8}ikSDS2P*nUC9GW-seYd88`vPL_dv78RcuUR~t? zo9rm<>(McJeLx54rs$orNG6~W|Fa96Jjg2j8i_eZmif{EhX>Tir}jIzAt4sb@IIxE zOY{WwoIe}+*PHd9=R$=&UpK&1Nu366nuj^_myQc6N^nA3{2#{zPR5*WB9?&O`0c~x z+jW3ZOOn3XLvmW-aFp&Xn$v8M$+NmEodpX9fi26&-XFkCyyx%4+k5b3Z346x6RD&h3O^71!Rv#U-j@*NyY zlCW%wXqE52Ke79%SQVkODcF|OWC$}z!Z)G!&)N^v=5%8==uu~MFpH^KvilbS(&-5= zQ4*hljn$B-`KVSkoLI^0$A3@SF>IiykIwpX#4c}+b#n2bj?X?aaZ)O?W)ezvP*NP_ zFnD3rzQI7bU8+F|!7W2v{q%e8z-;+(F@N zfw5P9{Ksbu&yo!|$VAa_Q3s&(k67rVqQ7E|ydL3K!Nvpuar5HQ?AY{t`kGHIINTO; zNEy9EFj(bLNV*(fJVnqDW@eL)$uh$+bR{1%h{q+|nWPg%TQ5zhC>rqTT`b0|(JrGt zLS@1vTon{(>LkK3HebV7`r7Gvn3VpnOQ=Ee3 zM~dG}_jL`i2IZ@pSg`xjN29ZCnem77p0n7IK?z}o1`uaFuLQyu_B1V3W(y6q`BosB zQ1@)zdh>`^1YP~Vqny#_^Xx*93N;;K6hb1P2ZhX;G^tdhykUKh zz=+F;A5WbBQR7FEtBU_x?Lh3UB59RNBxEk*Idrm!S&cz7tv*~9<&oah7U81>*-}}S z>52BoCMm@68+xH(46vj%)H2|`z^X!UV(NtrC8OF2%VWz$Sa9GvqvEK&OpB+W4L1$r z%~xU=eV%g>Ktn}=Lv6(`K&VUDo`-?fhf2(WJJ2u^zx`TKjovL<2-Q_gtzHjB79zqR z_;?e3a$ysXf+FD+cW*t2wB4qE1BWrL6*$6?fj9*)?#{3ursnkF4}X9De7KSb>$v&$ zSRE34WO-8;lHM7Bqdwt?3tPK-`0%#i)JMC~3*}?Y9o+}9PRT|$Rf~y&!TX>W6INXI zJ>kRLHF$;#k*?(=FGUyyU8MOCB}Z9;%1rs2FBB|Il`6Td8%DAg<}sOk^rhG(aIC-X z*rN9g-LP9zy*4#vF<0yA>Bw8IbU@6qHaN%|I~7K2#mb6e*yj0oz3PX7gK1u(4>%d^)r^HGR;xSU{>dyYKT}T}QlnP6wJ~oxeAM z84=`)Q7ybW|DE+I&>wUb?!8gKW^$K8_ctZZY1oGnxlJH@W(>Xq$6e3y^;{LhvBUb8 zk#ATSTc*g{r8BV6oi^6w;ixR7GoTTx;LxWaf2rDXrMQCIeg#c$5XF#@Gu3hrT zGm5?)2Rz)t0e%7oS!|}Ni@i)!t}2JB^;6}ZMvkW6UZ)AsO?2l>jixRbXbxVus@qp3 zhBaPqU*@;(Dh@3LgxuaDqD9#-zmh$diyC8nzbX})FQ}7-Zf)_R15=m%b2WF2ih)!P zXo2DCs--IqP@gc2qD9j~(Z!=2Ua8rCv)_!S@ZN;X`Ld_}{yKE*8U~fG=RNlnr%8AT z-8o@NmU_wF@d$+o%?h9V&%udwt&_gbdr~17+f%Q|SObMF+q4%LtJCD|%4Vix7rdzy z(fgO}pV6D5BG~h`iHP|0-}DU(p*&T#DW@nOU9%8vDPT}%A0B8qWUM4(D7Kc^g}SAg zKcS>VYwi3WLiyOIT3 zR6w7eQ&euE2eCt;olK@bsF{855LblZ2o?OJAuh^-Npz+oN2Y?2-MBA%`0HJV+4>bN zwlcAGmot@4pvs-u`rGNxu17X994OV&h!5(2LoZVWD~yaMSQ0-Mh6lJlVt`0VW?#6)E$rs6^fh94_>{+MStcPZcs{6(I?+rjrA^ zOlcz-#s(Sxopd$Rv0alY58LnTb^L7CI(X7koQaJiV6TP3HyAay58RqWj_JcU@~Ka- zpQvHrViL6Jo$|h1KdjH;E>mK+W}(*pD*yM}&>O)4*(5YIc0@Hi%hKOrMo^pi&peLu zXZPcj)lxR0B*yq|#XyrUX&u_$SGpDs`?rZlIA?{K?Fav9;Et!6g^~Jgetebe%^mDf zS9~}Q$+D<4?F^=uWgvn_zy0L;{l}=5eZ$5tb>0p%?GqNyyA~r0_)q;TP=5PfqTcsr zaY}XshSdKj6{~LfWJ47}gQv%H`&o1U)eUWLxk*4#=H*??H5F*Xr#Q4{v3Q>Uf%xF zkA8x#O{J4=qMGSZ+pS?;Q)+hFrMa5gcFmXM3Sp6wd}$( ztu|TF4Rw@$PmXw%q>~s~9P083sP4Q&cM}lO8FPJ;iZGJ*Dweg!6bh@P8u|L29-S&j zRggY~YSec2^|T6CdbkcQDk=e#-uuP56g_=wU-gtESqiaYN~&x$C0gGcGtS0W71iuy z45s($e~6X3L_gJi{qCXVCY#zGs?V-g?kqSm?ZslWy*T&J-iAvhhZ1k3J#!R~G|u?L zGe)-@Z)xYgu<-Ck<8^h&#baLsp$pj@Qhs#})R(o<9&agdu;uB?W7$<0H+CeAD)zdz z3&R;y)rk!730~wA> znh>hSS1X)El%_YY^d|3|GnJpDQ?QP*=UfzEXRBh=V~f0hts3+elJVFoF_v9@jvTl; zjhP{s%#1HooF#v4$zjG*j6&3?z9nVrpXt_yC%6CZiMePNu^0;hZ)h|J>w9J2VZCEVA^frba#OP(Mbsyw{CZ>j)UaX|mOywE ztN*ROZHpeoP!cD~BpYYC(zX29o5Db9)NfcnQY=5;gmZvKNcBl#>xVkH;lz#Jt{4G1 zFCw`q4^!8^Of822WWx54GGZHXex=_$k{v51i?o8WMZXgbSJ{lo>ErcQ#-<+n@0+q# zIKA6v`Xpk(R1N%C6;U2mO37c?j0kxWqruK8;C@WU-`SFctMH?|AQRrkCuSkEdylql z4n6KaTSWb#(ZTRi%fPheV3`IrT%q*fNm-OnnOvn;#+EY!XnzCBV3bSbi)9w#(Ouk5(07Yj8Rv^vjgw5hpeEeh;<6lN&ze9ovKx-hd_j@WiR zZ%!azE*PEH*xlV}PFL*iX%chY5kKTo%IUv#ahS8otrmKE$h&{@gT)BVN*LEVQcO?j zah_Ivll3q=P7BrX&d#JSpK`M$adGzCOU2nN;hDg<|M8#gi~A*ccYSb94_?-aRnKN8 z%E|cKp}TTinx3EQdPvz~ik z5>dnc{0cu^3cj{Qyx0FxV3McIpN9~&JGGyIja0op<}c4%5iigztT8urA~MwDD2KRe z*c}w7OuO7Bk}`jj_E^{S@pO%^A8nrS`q?+%jAdm~&eE1=Z(ETLqh5wrc>8Y(!UlVs z=yupyjMUcGw%}T{OZrJWv!OAS=YuM3z1pArb%%(M(cu0+U+5`PN5Z12$#oG zClT$oG^o9Oh-P85zYD5p8dLcBY|~V0@d`D(%C0fR*+9H`S`Jq-Sz_i(2mXlX{D~(< zP1ghjQ%x4SGBeTb?i$SSBAYrhym8U9_?C>!htL zpi^6;LfeA9gjt>$WcaHdheK>erMlW^oQ~G>wCviPOH)%%GvSq7jh!bE=ta5#QVtc8 zncp{9ri4Y>SANqFZN3rd@@|x(5qa(v`^_O-6)u?`UCt_TxN`iN^5WU*^KR#Y7RoIA z|9U;s+iN-O9=j?+1gpxoy#YW8kTUkM!>H;YsK1 z_qY$iqa8K-$5+zbtL<8eQ;@B*_MD7~vgvPJbiJD<+9AtpK5Ooq4HYgfE@BP5r|TjQ z8zo6nw-G!EqX(!aHno}LuMZn;CndWBulBdF@M%`Re+L50I?yAQI9$y)mFfw+?(-(k zs^-*~r!$9V4cv@=KIr;>hGq21dwQ~CuDpshZE38C32B{!0HOFTjSr2viP&9V&xgczf&?=U{o3LGjH5O3f-6TCw}w=CKOx{bYCU$i2FAeXrc{QS5upqn48}Wv7Mwj zx^_2*a0?R{@~S-(aBMsMJEW{-80_}9Pk}(vcW!PfcrPW2e22WN_iZlpqnBC0UgMoI z`eAwvAJw@=Y4_s)X#xIRmsBhmY4=Gjc(D&dlB%gYuL=WdyAKYcwDT>V(JY?swjYMu z{{7lZ_5C7|C*Z7wjV{2=bzK_QHyqB*ecW~ZBTmNioa>@jAu2C;nKtQHhuEj%%&VlE zri{|#ngm<&YGkUh5$KzprLkR}%G677UD2)QvkCsNSl~KNb9ZiAIrLczP%anD(}e2^ z?I}8*p+^y{-fh_O`0lTZ@f)$;vDb%d(sgca>c4OwWP96l60soT{Vye=!(HO|#gTVo&VXwK7D^y6#^I0OoV|Lt6HE%5m7 z6-p%1N*DL!m?T$pc>b6@h^q}6PB{G=R@M;~q`SG@(4>=f1z0P+{~j&WYPD(6%9PC~ z<#yB_0!%@LyCdvn+RVA1v=Hp+cTT;wpq&!BUccIy-aNz4Hd(4)9G`y?4&Dcjx2{LbxEbuzLYWGWrDSiR?U!&U`P&%eerf?$B<%0jWP z8Z$5*Kkf>?I$p30+F#Du0;ba8)s)G6G1vrT3Tb{KyP^xcPLwcwIj+AVH%`v=yPz%j zjlujHblC@#Uou_?v%}<4$3sGi_fkSi{=i>=-XK3@|l zSDBtDslaI)x7Wn3s&MK;nE?mP2PzX{8PKyV3cc;PKDN?k!yE{cnk>Xz30>z=YdyBgi4esuq zlmD!9<}NprS(EH{_U!$A&%eSx7n}?A zC@ji%t5X4yEJJXyNOLG2r*^e*q@Tg;Sg(!(I8H$m9rmTdSgpTfD!~*pXgQjkMUsHc zZUV6UmVvU{Tg7rSc8HZMtLk1T5{WvpCHOK&vh^8GgiC>fXXX*_#R&zFn10@xwB+}c z=1|b4Dg5aqW#0F;RgF-K`ik(O3d-PqUA@x8autq);fYRMYOCLhh zGw|Biic^kF9t$bDgya)=xWCc#X$;AxgQ zxC@9LVVIiHOW6oJ%KgNnFZqTo5eV#~0tsxzJ~WiQWm+swdA&fubUbDSAo>;ZNm4h% zH<1L;1qs}5E{zRCv5Q7|Wfv047?_-lDu*ISg3Iq?wgbTEM#q4DLmEiJjdO`W)7a3g z8$>??5HeU?Ndk~&;&n-woE#e{|H)tQ;dx4*Z^rl5Y1mUcy>}t*PgjFahX8&z@M?P-EUq+ zOU+GAB+_Afd-a(f$c@M-5$Pu4-FB@-WB_$W7(i_tj;W+1WikokAeBnsRS0r;9eIAf zE;g|_3p0c+4keU|5O>v8asrK;`n4Js4{lggncG-_VovwZ-fr}u7lEpPUr|l(2b)p9 zEf)8Ms4lYeeMYVO#0rudrFut%g@hA>RH-W47dk}3Llq+RCNALYN>U#vN=KiFMneL` z(GNrBiQ+{07M5f>uS2J;LtS58mm6QYh0SmUB--P2lSCr0)1~FJ;>rk*_SyYpBRzqG zT}3ir^nnf(=+zg#F0*zL2y=FJ{ycDTaj}_y(_i`|1;4yBl8W8Wesn z)Fay9KMr+Qt9;lbrWoO3bE0@}bHb6G)m?c#ZfdZMoS$#|?BQeD>Q1%8?4;yls;%+T zCS>?T$jQt9QjcYG=ekq6QZy|V5NhtfN#p!jF?-v2`(9*enpx~t;w5Z+yq4!IQ`Dg2 z>T(V-h+&dg_hI8F(*@!D8`B@ggDWA#r;83~G>Psq(Ep0PK3w#q@3tJQbfI>w;3rZ2 z_U`elO2Xsf)PKG^krdr6vQfy%Twm2A37AF?jSeBE7VH78rb6kP(5P_%0>!wv_}r3C zeLEC6zxPcuNFaDXt0GX-oGFHC3@yMdI#SMM`vipsTmAUNDJ>Fw0tK}CvoU4pbdU5X zD2+3fWLE=@cKF&=-=Q%z>7OMxaP4)A7z(3byNX80nx)T zOf<(;f=J;$)Jd8?CI+fHU^ks4p`I@EO7pQk(;1TT3)b%$JnoLYDHB$WB8g868(>?SrtgEu#OU+620sWreSTfQd4%Z zHWL7a=P=?Lxu2@b3QX&Q5qTN!rnT9b4DM0u|`wJC`5WTK;T%ObNQrI_*P zP4^bes!Qlqg}R7R$piIAw3t-U`Z}*rylHBsrSM6Kc>kW9PQ&vl&aTFU%TL%*? z-}anVb1JZAuDm`o*HExRvK^trplYVWt?&72q++fo*w>yIP0a8;g#?$@(glN}$KM+( zj~SRjnt{X>?VNcVQ^rLDVH>7haC!$)9gIBoq{)qB=4e|31qYGhjw!S0@OK7$rv2j)bo$W@|#g`1iiX zPg&^kmDd{m%ACleZdMODZS^mx8)LIChA+bw^Trc73zJnXZZL`9$tf-Jk*5)rT~)`! zgpP-a-LuBVJe$sA0X0#0*v?f^(55@_%iy(=TIqQYF?dY*$UgXf@-y*t$H;iA&D9FW z0{o57v~#D$ogBYWXK3)Kt!L58Qx5GiKX>f(y&$d3gBRHo<@NQx5Y~v- z3UodmdAIw(Lu*9aG%DNI#%%=`dx@Dk`jWH$8^p>1R^pS^z5ExK@Sq3rRJ2SJh`AyP zbu>6qsMnUUUs@9V6Lfi;K9jG`hY57L6fXs`Qp83rUj5+{4eFj$;pUChB@+jeK_tf% z$hs9oq2$;^(lX-oyk^VZmSQ+qNZ(U@Tw=5_aiHo@&ghl5{543Yf+@Jrt*sPBIwB$- z{PmndoAlnpGl#%;KyPo9-VtTKZP7hwX>-(k&#L#2I5PSV+*lO2TW|ZYzE_?`v|l+Y zqC-LNQeuq;+~cd$7`v8<1U^eibe{TKVe>&}q%GMQS5<^WjaI}89k4?L2i5)2z`Etx zmNf*%xiJ;Lu9;qU$d#1->CwrRgJN;I*XBPQ5+xN5QPsUZ>^5yhpnIT0vH z?~>DFjZLL_p({{O(KlmG`HXk2cP-R{VWKn3km%*FkBl;-*a!uNPzD_UPZnUd9)m#=}W+t`{`ZA znnpS8dd_d0NVh54q&Jn3-#JAFG{;653-#QsFv1B{zDj?-4orr;e}hg(q{Go~PE{qu zbu7CU7u}%(bR9wGW_nL;?pG$aijMtz4)O1L^KmFN-niz9rFNygT*=zvAb3qwy`}N* zuj^kx$jzl-qecD<{hz-y>AJDH>Su%G+CJJ35}JMc%Y@y^DTiV`rXEg880n`t_5q0w z+$ZZ|y2e)%#jB!-WxuqgsByq*V1Pl@1?^QErCLnYi%Y?8wiPKGAVoE#EM$PZ-b;); zUjy`VxxD#}r6gr!kB*)S#ZA(LSOIWBVW;%XJ#AI?szpC_H4@XS)na;2*Lf^{)Q_^S zUM%)HKMbWdwmCa`{)JSxRFKxLT*aZOIv?up_QLhNJuIwpKOMXMI%}eqE(WeGkLWh) z;2S>t+u0SAI;^Ntd1f zeO4d6wUbxXoDa*7I)2R4ds$h}_fCnjx_H^OzY3XNTC@Y~jfrfO{B?2d?|~GxOT3U@ zlCV2YiG+;KMRkk5&$tTmlMCMBW9d9=!R**Ad=yw*2_KJD`;5HDJ9e~pmhC)plvn%g zqUYQY>KP^NWer%Z=G|xvxL$7zI9^xSg&*}l20xYQ zV#jSKm#zF6$!}_D5HZPqJ62Wqm%*v*a(b6|N)1-`BG&1Ta04F=ZX))gPYpV6B*qpO zVsdjyLZVl$$wL1IG7sac!uuYPx>R?2DUld=Pos6c=f@WXafggq9+*9VOp$19ZFSnnSd1ROv{QP(OUa_#ZX=p=QBpYYp#d08``erQP$lWMsNVuWR%8)3cGyytHL6pZTH+kf-|qfznSV3c;m>C%abK!E21EPe@9bc z3Yy$9zcO!|OFwfLnnfg%px73~w!k zH)mmx@XUNIB3vtPPR1OtsVeKw1L^mpGxBb4A2c)Yq7|8htih&vhp6l8j8>U3w6^G~ zLi6t;?1gkrwz@fgLGU7ea{M6^LKhNcU3-JayM=5%VeT=ugUW#6_Bn?X11cEV+)B%C zrjQ|Ni824JTLfPw=_fY5fMg<2z=}D#JG@IvvE3k*1z>zC#DFIF@enei$rf=23a3+i z*O4R|ffr%zs6dDxov8zast(460l?usT$~q!fddiO?Fx#4Ri3J>wAy7Q*+r#qvZ$D4 zOG%+-=9uQVI8YlX7~Q<7y?^AZr4Df=eyyI%bq7oHP>2QrwVQsE){x}lXtw^A(Pxyp z5TR{X6IOH*6tMX`|2syq6M$f$kz5x6a6@qf7Z5%8RT6iN8d;8!#DTh7o7ycRi>6pv zis~(@BoafsBv`3*Bn(It=AQ=WtxMNF)(Lsh1e;ZUkNk8?ToPgMCHVPonf2WDWXa1k z@k!^)_np_LqP6n+jXuxAX~7qNu6@6!xwEbX?!xLLFP z<>PSG(}G;bBb^fLDJOFN<>Ci?V|%#Mb?Js|7_>RLe5A9l|6 zjA*vm$*2@ueEO$XAvmV zsY%>h9lhW&3AQvE3{auC%gi2YM?}lG{y?z^Jf=$Q>Ew~YyV8rJ)hFP<2p;9_VB$v= zJnT-KpR)cu+Z~}%L<`_FIe%xrE%LH7czt~FUFna+1z}Xj^?ZUi(fo&rfN`bU;Q7-W z;ji~KbHPVtdhyO_jUBx}0ZX2r1;j=D&y?Ytr^b)#91_){ep3cfSyv@#z)PRa z)-lnh#j?Li&-Y6v)mP7_g3n{{`|r16yn&k{<87Du;>WkAi}zjO)1kcQdse=^BIB&w z6w5WpyE~YxK}a*0$uA(%`d}Nq=h8ULO`>8yRmLW)vcf2H-$63t`|osV~#=L1o!B4 zEB884e$DyUnT}%^5}} zss<>BlF*F$Bg=;{|WZ zM8DBVT_*1%%5vlP3|Xq=Ys`s6J^|Ac{a%gw#1G+;pp559a-kxtDN6xDyWYsUxD+c! zq`U$!U>AR<_y+Pq_C+~*vXew9jkR_>{gz_qDR4P;s2nYk2VcRCRN6*Qjse}MI(T52^$YH99AF$t+IKY0!3{V(`gc6?OEwvd7LV< zQ&iwC=|!hdrj@)}#H1xd#+7{xD*%ckZJiLA*=1z_)D#4hUoA_;aUz4)J}8Ccemf=@ zkp|-;zuHZ47o15%VWQLVjsUe(&eYQ?Nc}n#w$_M5i;m3ncBUf=fo4RnWkEH={C~#M zPdoi$!i@yq+M(1?xrc)p5%?}*Pwz$-^N<2;9sss#V)t*2Wn&P^^pqZ8ec(oqbJ;CZ3Z&dC;?9 zzBx$?6F`$HA`B!G>T;_Y`?KBg)&#wNVsP~00VZ}G=q&NjIO9G)&!{EtOO8T0{?;!0>p`W>UXw&<64$eEpRCd9X_4>B-_p zLqPniv)KKS_`vyKvGWJ-oR{^^KvSdh&-wg8h{z7wJ0*MCJHJ83QK1yoOZ$6)3G=wx z3tK+xx=J|7%vr6W445sT4A>4ex&ODrvD|iETh+Qo3@^4oq$>Pr@{2pqA#c#bVFDT1 za22fO+8yTMVZtWyxb9BOu`QzNEg&KMco%accB>YAylMCYI&Z@JV9jCVw`s2%`^TRm z!^yjWf3`7bbX_U!GT~)#;WS|Kh4Sel9DaMu(XM$vX#tT-H^FTO6XWeCVfV2w zoj8@_v9Lznmy_CC*HTbpl#iX5k=&I_)=6Zkl{tna|zEB8{T_!@DAuPJTW& z-BH#OPY3Vd^Lk`{rtNL#3A&xz&6pBbrQyLY^JAGYCs!}U42vc&dw-@*|ztVs=XPHx<)keqxrm9rt)R=`XMP#@k_%x>R*uUH>M>X`& zfr+7+rpjZCD8TL&kd!oMU13!={p-NHIV)V0%s0?wF`S%_Y(jKUv@u1XrJ0#a20A9M z+uJv$W;(G_D%i>tW2|hrh%=8!li@<8pn+9PTpHA$glEKR6khRx6F>e6u0`9{K2B>8 z8i=FKL`&2+8f_{CRhxg6XGBZ(rIu7uU_!Rhlm*s+eq`{d7ncKJuYYzcOS*8@aiTyS zVSJvOAwnn)l{ue20P*Rk<1@6z?jZ1UaN zt*}A3Ygi1wC1swNJ}IPrC8UknkfD7=r^xN%htG%vjd0ezCm7}cl8(@UQWGWv+a>JBb9^y)s6RoaeR;i;BpBEEOMiw(zCqGoAN`gHm z&8j?9-ND&c!C(%gekGKFf}#^bTj;P}=;6tCKnRtm!r<(qVJ<=K4==K1MJ$ACtN`#N zBQ&60(y3*oj_tN~3e{6|L;~TQwJCcMF{LPy73nE)O&QkFwBVld5NSMQ?YfaK+%raT zF|lKAZ*im0=%kAc6y9c$H<@dxFyVE#>(D4LNgue5q9EA=b4qipb9GX|BpT-OgEc5L zbY6!w!>QD<)gj%PngEJV6QI!n&mB#SZ89vHZz(yn7(M7CR(TnZP6iC9Zz8(!3Mk~i z3V+GLik`Ahb!Q5!EaSAWiU@-!tl0h}0Z~bv_0ckYdn>8<(?iTT-9T_mzK+;j|Ut7U3R3XccJwWSuTjR*oj0GzF@#s&eNf2lUOJwBN>y$c5& z?Mw=2wi?t7=$MB^?)35Z$!+zjBgZpt;eL%0>F=R)2lVp|u%ST1nNg7A3aS{es6wK< zLF)1{W>(a{^zlAZtwgi)LqmeIm`9~U-3v}$E2kDby)*FO zpf~~E&yp5=a7uBXd0Wm#S^hGvNB&Tfji7?|8MY?23i#yv{@4BEhnj#vO;m8`E~S0Y z&b!@?m(suk*L6+5S)Lu{0%Al!rzSYtMR3j)HB6i#o)Sndqe%}1?sS-Xty$c?hZj|E z-unD0ICz6r8tzW7Y)$XAF5P0ugyynq2Y;fu?hHI#l>R=P5Ffi<>?G>llr+nhTcWpL zGF9)B<9&umI*xXqx+*I`I%Vmp=t}$1#(C%cX&Ev5PO#7O)L*r_>DAyfXL6E`r_u5E zHhimR{>8*ZQ}x8W3=P+-JS)%k&q{gx55I^1WamB~MG5eWJkIU1tzPJ}#G5?-qkokb zT>gG#GToRvXj0|}zTqM*B+LN7NC9(wo^oDocy90Xx0`yr?F_i*czZ_CaaQwxUr`ETh6`?-*6mbQn_zy^hj$)Qiq_FG-OtLT3xH1-fhKbS#xyUU054? zj%MtRlrPRMjU&GzahX*`g8p!_@}&8+7pwO^1CQ*e@8-ohEV!3#m^=Gt%r_386ocfq9cKMqn@AWtRL22lR5t6T^1j55HlsIOI$`yp*c;{z58bBG zGxEGH=tV2DQy(K^T*j@$PQ=6|%-+tS`KK5{Q&@Br%9{bO!6HIO)J2<3PH9xiM5C`A zS)EYFN4p%7^^Lqo&Bv|cX>sxoY)4?j@+rTl=885~w{cP=w5lF5xAs@hWw!v^I4XKa zS(TXWvh5Giuqhq07NZgq-i%<$l2DaKLVsJPh%*S)HV|DeBZy%nM%_&Mg3BsD^t0)@ zF+oo4KMzJ0t~=&wqBxWlmM4F%AGOnq13@?(a>DseZ(LYY6eYGw2zHYtDmSsA+I0& z3#ISQ_PmkbevPn}Pk|ABcL?hnqL|43b<|RdfVEJ321HXcD@FU+@9l8RiUwuf?N5S* z%p-BRW(SjBw`%RJC4B#i9hO-mh?ZAjhbB4h%!~Bc=JW~Fvjk2Q^dk`=(dl?wkl)ju zDk~sR%@Tl5G(7_gW!lNzztw5y@93{=6#)T(-E^YtNs@42^1!#|E`sloYr36B>H1VImUuEA(`E5oOm0&(ssV}GqQHDS>shposVgw<#nm6V#K&G@6#9D z_p^9dJo0sbf~V)}5ADAKa5*}n5zIGfd?=KtlCOs%4RSUogf5KU#3Nm-_hk z#5hy=4q#(Lgleg-SKS@k`_};HI9>6F#f?aK#V*HKWzfde#o>=s$Jar(xTn3r ze9dJGYHy!Xy#>VY;44pSH%AGlqwtx0wSXrYa>zweaZ%7E@+jO~?PRl9RwBr5TU~Ag zah48iEdwYK%Lo$XzdYZA2Pq_ag3_&Rh6}o>jiE;Y)XJb1=MT`OfXC zhSDK$$F7;gMcQm6&t`c46M`j_<($cC+!UvgCXZ^|qg0o$@~fI-_ypD5uo1V~Pmw~KZo2`58^ zfu#ziaaF6=e}6nKem!0JnrT$u9QP90`%1c8sZ1@`B=ANN9gx%IHv68a!qji}LlfbV z-3^X61AJ5I5`G|g>>dB1Ce#_(`7#3Tr2fC!qTGe#;Fd0D9|E+Wfj6Hyj43kBXMA=e z1qX1=Hp_gGVaH8c{}|$)wi1HAbtK0AeV?2>J)O?ZN2rH)q&RdX{z7pUsKHD`UX>6D zPuqrn5yslbexLv%|v!Qb08;AhHgv<(1Mq&I8_``t{e6nAx zr-b|My}rIk(1u4*LqS2oADZtOrff%DxI&;|dnKiGcB9<9tV|M0()>0)q0St6tFL() zU^K!I{J*SOy!v_BS$;diCcc+nwDhW0_6|>lgPqPEw$D5Af_@}{$iG?eE8-W_;zo5Z zY%+-76bA?GjP$P;*gJQ4d3^M(D6FT+yz*40kVJvvU8U?$8D(U?NWfP(;P=6g&iPMe zYVa4zm-CqE-9?d>CBrO2AO^TnPdqvz%yf1>FR&YRdq1Y8IR9n%kmg4}USpjn(<}M& zYC?4LT|kYLkA;op*2AdctoUUlhn=+=nMmds@BHjMKGUZ}5CIbe<3}m|hY!a0BfFhv zSJU|{>5A8$D!&5J2Ermp&?dN&r6a>)rI;w%-S+VjE#Ilb=_bC{*Y)O}cZ)WV)DmY# zMrb4q9QqjrurajxW4`0=eq2pel~N?g&gSl*XJe`;bkv}Vl4hu->N^N|_~K~98qxQ8 z_`_n~$giT#Wql*EzhBW=E}dGk8i|&wu@{XGq8$HawaM#wakj>=k%*qbnuu8MV!=QL zY6;BHr~!q5nF-#Iw)?JMoXuQSl%-dx#i{5q^Cy>Sbf7_hrD(hj$?;?dA&Lo8Gt)mj zExL2GdE5`p7Pa(TAL`N5Ga&S5grymg>`2h)uC;QAXz$%rgg=5ZB$3Ksn*d%jD_PD&@;A`~o5JdGUrHQi{TdCM`=FI?Mht{zBD( z5)`NK1BMtec8KzV4mkWCTVSHD7oSZ6yevI5CFf@am;i;~K5B?9{wIwd9ui%c&-QlY z!h$(i>~ZX~FdGcmX6C*t zkZh7p9ZDSb0hybOhaeY`(+nLiJ(pE&URPf%tW(E6v~s7Z7G-5$xE9G+0#W8TbQ+S% zKm+L=Ps`_xs^hC!f%pA-RSBwe-1~ph3=(*w&7+`;LT7QVW;(tHLuZ9*0UOg&Lfo`G zJhcqt#;Us*DqkWqIB3G+BME@A@x7Y1*BfhV|Ms@-wnj$JV`BE-Z_{y?#C;MZNC7a> z4^y?+xgO8N;ExCFXZ~<*lZm_6e(0;&yjJ;AqKpbA*%Y**hbDpwjF>A$uV<#m#o!y6 zwc!k^xo$t-E}NBx(;l;pR>O zLc^=wuYFj~MjRC~7kiQ|e8m#3cH0jQcQlU|{!4hlZsyxhqZc@*W%m;e%5!=$Y55XH z>E|Vu>)}haOW9A)$1xm6`XXW<7FN=p8gb@yD(>E%o+|Kt^cb4BeAk~{=H+a-p>Azw zec8B~Nhw&PdUCAjIs4XRGhm_J+x=$9$j7UtrMWx!bVqsdN2s5({f|zg^-2Q^g20bH z$5Yy8>(BQlEuCZYS5NBaN0!@YH(TOOVy&9n0b$slwCQEbSpv5n^u)u7tGW1uVrE z-f*sJPW^eS$P+@A0SPL z?CWN4rDkvLH!8lIA1_1>;A|ih6KnFa6>ciyxi7<+cecIi^lSFHu-e`TxRX>XWh=Ih zJt@YSxtjHD&3e`xFzINzdHBMOk2T|KupYR=#PC~l`?2LK^7X32WNtP#wikUP|3k1} zz`aC!RSBE(YLdlr7mV1<^I%Hd)}f9ai$-Qtt;0kVXS;#-)VUk=)D)TYUzZ3nF0KbC z76j^+#YnN(G33#@zW!1Ymu;vo60o=Gp3WYZkl?(uTrAloqzRUbf7eG951{|!-0>); zraUq_znsI$%a4PN-N4`I(J+ftId4kE#qt4oaWdsS3){KC< zTiWf+4RdrDv8F8)0z%)&C)ZHXGaN^ry*}4o;%hZ_bz3Be-fUZ&GzA_1 z*>TJkdj-G8IOe(3UaCCAQw8RJ_kSXA&Ku(+lK?>T1gfFZS3Aa}8h_N7STB>bq ztW|p>_9N*PNw>jVY)U?gVQzL_v+MQ+zFL5dQ;E;cQOW-P{#eJ0;15o0Xk0>SE=><2 zcjqb$pP!#oOIgx;XiguySgJa>cs=eB^bwC;&P?Fr{4AIi7d7Xi(qt7QPs?c z&E-|-)>-3qydfvQ-c84k87T)6#0p$|ki~4B53c;}@@Sm$$5_C@VWYKB4}O z*y+;p9CbusBo<~?l9g=$G5eKBrf;x9%RbdM?%28cawJh?v;SAfKQ4AzU#3@ix;QBn zjiq{cEsAAoYNc6MSH~+Z-r)=r{~tGe1X_}MbXTXM$0Rvvy_qjelT=l zz?|yyw34th9n-&kLHWGEP+a76?b%2x)<2+#FXF+D7oGB_e!Gy^B%nsS!Fc8QLk~`c z(ykrp;Q_uZFa$)?zd#A1GShAkdVUb|hOJEed)Og$W*g@yFJ~njF7!*ev%GkytnxmU zm6cU29D2T$@Ohc)N7!^-Z2rnR-(1%LlfO}gAkmpykSd%#v1K zyK4%@_p_xIb^tXVQw3p_NvqfPQ2pTkLOw!J6tLc(&TicFZ(-$!7+sGf08}#zs%~N| zCDI$q5%t=?x_`u$$S83Zzyq&u3`w67#1{x8 zUgo{$Uq)Y_XnRYzKDGzlOe~Q_2&4Uo2Ty+|Yka&O`174W zzgNfY&Dh^2_f;5^O^-m1Y zA$6U0I0yRwI3spuAvZsAR02p+mz?~wdl`Go0<6ttJtuIC!PhF6E7QKT{W*0C7{A8m z*GD0}`yeT5^l3N-@V9#&DpfWAj3wYzqErYl$p!(-*Q@#<=6Mq~ z@iD&Vp(X26OPKCj4r3uo_rk<<9^kiIg_xLH+wBTp{p)9uMrbr*#VR?=7{nNYp^mOZ z@G6h1OZ`^`Vo2>D*`C6LT@Ls-z8Y3geK%KN;0ASzX^_a}iC0RK4TS-tsu+}M}m1Z9^eWvg?%2t{*3WHC^wNKSf+G8;#a%Mwe=aVyh_tjkwk$O`9UEtun0IkvJ!^-BLiI_d z!Q9Lk($aeehxs`f#`^ku2L~;_m-IZhUbiHWb|=XAp*;`~A?Y%mMlMjiO47`=y0Y33 zI2@u%+YS}gF_V(k=U7Z6ur0B5ID)k}IypJ{Iq|0`ZmpfP;`l0sOF*^&}9Fc0T(**+Rf>Tknr=Gu{Uf!!};o2oBPlZ z^OGdd!ol1&0(TG?R#{O2>pV3rD&mLD@G}brc=jp%43#8BAtewS>%Hb;dQA;Y% z#F?s?I7mloKD7*FMQ4A?(qI? zm2B)Ke(J$7rJ!fPm~L2>!^7dYM6#lFgTo5+7p|m!;#{*Fma4Bf&-N5wHk#jG23g45 zm*eAS!$)f?hUB0u!JS-5f>#FjNUAj76&rZ#Z?D-AN|4wJD3RCE@*-l$T`6o#2%1f0 zy(f4pZDVH>H2)6g^98@-Dm!F|=era&X6e67^)5(x|8nZNhjBDfFPJ!8w(U2*%H8_jWs* zzwPS9cfIg%J9=Ay!cl(ji^#mUKnF1&rnAMn+Un3#;FHQI5=Jjft@f<3olr397fKff z3lvuaH2}uTTkm~)<^1Mfn55WqAbDaQV?kl3*@YtV86(MQUUcs`SC>M8!4T`1!F{#E){k{2k`RS$>va$jk#g!O6qP)PccS*nn66c_rx(40l zR(pTrcLii_js@z;3XruH@{qnv?;}Y9T&Aq-T=d=pgOXouGl)sb8#NZBrcHe{GDDB= z7P$P2Rj5*hMwuk}zjTKevdC;CwR^s&njgwjIF- z^JK#YM@I+8v-S)sW&@_(oH@mig=R~Lkc5DQm;2Gfz^EZlZJx7ViyvM`)kb6_h&Ea> z8hrWCpE{?Q47FJuKUCq;YeawXBmm!WJa z)9a->|DM}%Q>b7{tthd#Q>Mo=U?6fgg2}~R}P(w=CH-%UDl0#bYEP9|D#_^yXPe?esZAwg&|hQ40rr2+&mq8H%kK?g z%S$krMD^fppc-}Hp@ez|8XqR`4q(;ic-tXpGKX`j!5e8(O(U5l-W7r>jF6*@-7iD?4S}aaOEu3>#IxOt90`s{DP?ApH{OuWu zCW-9s`*&BORa^@42<$sX*V?}t=t~i*lS8o)TTvlVj|i>C(^ktDu5YUAGvgH!YDe_M z?w1&{9XooaG}d^FAu&^N@|W5W#+gw1za0K0efw6+&UZR3^n9C6qqL#`AiYM$Xoezf zY8Ht#g0OLQa}$CuX@kLR}goIp6!6jSHM*gwbPeQ-DA2_Y#g|M-{vrlyf~Jn(osGSvqDf^6^| zLASQ}oACMjO+!nZvjYL+6bJ)A0;Dp~M_39ruBCSy8XAgtFCz=q&j$zdR90jG|F}W{ z27hI#nRVDIUYoql%gnJq+$%2`9OYORc7L#JD02MP*q?~x5=n@!jfweLpmLQr=yz+Yn8$kGXiZGb`EBqT8o|3oWS0WYZ#ViOppYNy>+9M0jr`6l z9dt?hY-s6~%Lv*L%-@Cq0OI*-1ptDrz`*|g?fRJ=i-(j49D-(#{Sv=RV?OC@b1(oXhk< zUha+y@XZMD@_KmR&dtwLhq=dvK#+cM#?zskiHbE=Zxw&V5p}V=+zAzk zrx5dgkp`piTgs3u49Fx!(@5i@_n3Nm@+HZOUhK7IWo3Qv-`<|A!PQh`dIeD|;k1Ne zg-Iq&8R&(TQZ4)MowT>!<_LNoj0(V5QxzSgP~`i=>|&;O7Tij-5tsO{!SfJ7QWnSc zMNnV={P~lj8G(^hH#PU$-Sky7h%9|RR&{Ig?`k_jHaKmq`k_s*32{(77hzFhM2CR! zKw;@5*(9e&4xR9`_Cn45y~!W{wenN_mW0+k(XQe{Fv9F=j4tqAUY;MlkN%x+C~@Qp z`SXL2V85thOU)!hFcgwp=a7(bWu)p`%PtXv*?mmxazw9)-dRS2wg+h=helH66F`O* zi$zIE33nI)L2vQD9Yb)cas^!>vEM}kLpo8lTeM4gd3g~YMHA-Spq)%>C!^N1!Sc_d zr+3Vi9OU0-XEzQG4p!S+wMzPKj+ajVlMD(tr3_J*&zm4#s2C3m{5g39YIiHe4Edeu zyO7baNnnNs28bI9H8ne|n*)Fs!MLfKD4GNF9(4_GED*qljZcVfe&qkJ1^6671!1B~ z%l&-&Dtw}{vZ64sstg;)@8Fr(I423g#hGaDNLuAZ-7VU-NX zD$-C1Gq_@o2ocL9A(fYv+1nq3yAi4cMKI&5bE3vgJ?a;m9?tRzDgJCn8$0FV+W#(G zUj_vrJ>$yD0O=zjY#0ean2QTFYY<06Vxw7IU9~3qBJdZ>xQjp>P$DBJtfnT$ zt$7h)Tc4X;om<^{j3odgfsvSz98;vUCAU};;#JC7*#-Fd8|rxL`2}`=+nU*vBlmGd zf$%uk3hPanQ`xbx`FZ*I>l?jpy##pYU`5A$R*8xLs+04A-N!*CJ$5$MQ2{=_#zxN@ z5AU7J`=&@wxwA+D4tc7X)Or`6Jv;8)l!Wn$iR}QtQ7?*DdI=9 zv$rp+s5su=AGG8)z(-GX$(h6egt=n>e9xrA@!F)s-oXaZ0BmEkw|}BcclBVf(gnl8 zXPF!iIw2Z{Th^B7JSvTk#Iei4sYL2S{|f@R%bl*y2+X}L{J&2yDR~DGS)_7MAYs!RvPHn8HS*sG~y?w3Z`>(uXucrCLs3YrUIS)N+$0{W1~S z{(-p$FNb5M7|0f4qk@ZxM*_nKf*l+k&jULPD|(fF#uazGOxcUAtmFYv%!qOKIk95i zvmmWY7r1N<-~xV?lpu_la;w5Yezv}JUYpidkg2Q;pn^PzvEA|SYN{P`^3Rsgph*`y zoAR2P^Xw@W=-lxgH1sv4|JBM-_McCSj|t0J9KD{n5DSXj}To^Y{n@LReGbr^eR4vmtA z48%oefu+geu&$x-^9Z7p0@wO>3< zO(`n*?;_(+*xEWy81Tq-#a2{9L$V~pr&UJD5w6j#m}%nieDbT5lY{*w@3oV1H9QOe z233zRCHX7-AiwcEv7tMY;Pd8s^X7?(hk+lb#|Os-`Ts-HcSghceqE0m-3+3OF+_{# zy_Zpf=%V*tLX;4_GkOHkJJAWE*N9#QiC#nW-g|lP-}7JZe6h^3Sk^t)xz5>ppS^{m z`#!Q_5`Q39eA=X8U(3TK1320}|FUoOKEru35k%Sj)2t>s!L>kQA^o&{(eI1;c)w%6 zl&U!2!@8WtUp!tcLAA}{!-wN& zlShr7$??Ve>wib=B=%Tg18C4aX@(FGQ8?D(#PSUgfTIaZt!BXj--IVj=vjm4$bz8E zggsnf{`!l6m8+*zG|d^ccyLW<;hS+-4=Qt1B`Dn-;as&Xk{A4k`5m}^Vr1P zZ4cO|U+DU;wKx)7)*JqDggPKV&*} zKI=k|2-sH&Dpg2QkeY(mh$z}ADT|UJ$0UIkk|ac!QKQ5^<+>o{vxJ}uG!5*nK+q3V z6c4s^5+2>S7)*DFfxIzMW+*9j?i<@ZkYiyoXULYoyBx0aWg<6_g zA`d+QQGiHDmj0^1LO2^p%*Fpfd8m;9@sl3fyQgviYP>^5&a1IlRLYW|j1CEcI6Ro! z>L`M-IHSwM73qVYle`Nb6vTzwBCu&dz$CZ>hUPwB%hlIL`IJTtPNKIFl?6p%z;!>T zMFt{JsJ~lz;6|4-CQSKb#xi2y=!MLVLlU448$lSRk`_VqWGTKqiYny+y*-I(r0*EX%(O-t0|ZWO#|?rK2{}N{^=oig z6NVW00$~m6g?xHUaD8-^1_nvYzltn~isFaRH|pdqp~ac_=C#=42hP1s9`cyL1|Z1? zBIVy_*eLG4p)Pf}m4VNHGFz%LB}neq=CW1lCJ%UF(}I)gJBqX1Ku|1L{$~X6m`v3y z0U{ox{hS)a6sb1tM`EaqghX@=AWAUkexN|?LZLSh?7?eo^tL4I010$9cZe zfWQfXFzAPx=L{f0skjPRUPYD$2#kngPtf>jEff)|-bIH~u>b)h!e`fmUONz3nmHuZ zj4eV5~kovng?^+m>qFg9LRrE(( z5QGs2bbO}Y34TBtY|%bUteHn*a7S7)ZiskDOQX6ZqhP_51HTGoAwM)z$`;js9-8Lo zof0BNr?Z+BLU$RFbEw2Okk5`|m8x;1L6^nF#}`6Zb-<#>1;K6g%nvzvzPt+*?BtXe zHpB4cNLC;(@LNTI)ASr-5&Sq^LHy}5RCOJ1UQ(1rYDrUsf!eYqQBW(AFvm^9MDc!= zg-Th~uWL=K76dA@akDw6g|YNhBO=?Pt<g zoIJ&CTacWi!X%{-3Z@|{2>ig13r5l7MW`^4ZrV`9a;MJ?e&%T3!zUNMy_}x+vA?K}D2WWoEsY8_Y%~(Q;@YPG(sZU3$=G zeERozlAjf>lgqNQT8m0Z2Mc+H&@o0v_A-5b1DOehBtalnO?)NX@?kyB(xfdrNz{-& zSpuw7JqMFK+LqdP^S0oG-i-}7EcwK(Lmk0jp2$KA>K>;Y^W5+Lo~~>wwFzD83Tr3< z3l)9tB{zZpkls{)2yG=zLvak(y^Q(rQog>cDFM>edn2XenK!pYq$Jf`HetFb=YqAk z<P`rro#;Dl1nVtKOm+go(n|0BPC7Bsi++F$@XB^u&l7qKm;Pg zp;#l9Np9-o;SRl1T~fk1szpTnt}dw zZ?T=vV2hK$6ETpn!Rx9D()!EaX_+~{;eo79-rRvu=C=xPGqqD+O?I+Z&sic=Zv5F( z{&b-Su4ne3qe!E}p{QFhbDdHx8y(j5oBEp=#m}e^Ya&#b5*~DKh>D>I%A7JCwGsH9 zHS3bdZiV^hg3xmW2^Ci`=)2p#A&K_>kUltJaNSi;!moH0&_O;wTFMmS(ev{wyvL2e zC4O}|Hdb*zn|)79W8i<|ePe2{HmPN0%TE$SJC}7gocId6n+JE*aqyOsZ1@l$8hk{) z=zOL3INtfGZSs@j1xuUro=B!i)BolL%bE!h;L7Gdj-$(Vz~)3@L4`O__^!Y=)~1G2 zIE-oZDnpxn4}du9JCTK>V}i+pTXL;^Ou`NGlllUAn|I}blYb_f9s1)8-=>?1p@z-K zd##5)*HEj9!87S_y|JI$v1AVzd$_H-UTFUx63OM~mh?!{_3@pD|^ zG;!bcj>}tRLnWSH2Z2&>mJ3g|mB9}GAx*H@rOvTS~^^0NE%;gh#@9=VH-^BD5Lpmrw-lLYc3 zA6t?I@(R>P9=LrQ`)Vs9JSF;h;sB7XR#M(hhupk(=#4=z$Ev@iq@)y=;H4W9=y$H~!} zQVkM5Uf#vJfX;Zu&ornM#JU;K-}8h8Q4sJJp-WUYKjtiJr4A`s{0j+w zF0XP*1<#`{KSHsjH(vrPu7Ww^1W-WGB8Hf74im4P`T|J#y!091)3-FOe?)~5sK|mo zt^dr-GUm7C>|9aUhE2!qRBy5dEUn$=sa>SeSv?A@XNOZTp2~m)O|_KP)3MxB$q|$g z6eI~-{5^H@*MiW-b!S{CM@zY>aoXNOFb0f)@r{wmM9ACG-wPwwbA2G;wO@wlTUZSX zi&|#H8|HmA^^bOdFP&zHjy!7k*Uh+RFFxg#iid#ArR=~^6nOW1a zud1u6v>qG}|Nd{UX{4CSO z92KL^MhaH2^I-QdBX9fgxW41I!Fo41@+)5a_uTUCP9qr|EJ_ev7He%EKzH26IzKsh zOne#)dYeJ;Vm>~t@aIAn2Ly!<7Fl7VtfiMlP3v!|D0>g=497@`>(5qnb9u~f@rD+GsoivIf% z1_4L)y|iBTrz_%GCb8%seK+Bh+}E-GKE_WykLfe=!=0zeb0*>%{aSu5TCheH(}~bl zePY7PV(})v#N%z7?CfQ&qbGXWvH#`*{ChO>0=stLD^HIA>sIHK&Qtc$D^%v5Znivx zwxTS*zFs;Nwdk|_M#ts3>A5t;B9H}RGf0x!xIz4pI2xM5ZX)irt1R!J#Q3$5t zSfE6P8BZfJ4M0T8%gYlJdG&D-$UR!5cbGH;1P*+SpCfKurr@^q4M5+OhZsah_adD@ zH9%L}L7!^2Ta4R}pEy}n4;y&khO4Y>)kW&$iVf64>4<*hM06_ z=tX5yr;)@=j7&^-x3|K8tm($rHx&+r#T{f}#2}#DTwEvJxEzyHQx_K(d;$UvE5y22 zsfY?qMQmyEa0Gh(JDuROt#A*gmHLmvUma$umeR9ape6VqTMeQbtj{nhGb|(B77sh- zqIUYLCE$)j;v3h3^3}oA-$O1`h@ogGa1SegJFC1lyFU#^KDSPBCcxS@BTvs9K0;Aa zjmvIQUunIfo@p#oW%KNcx_Jef<-4a#BAY+03WmzLxJ6;mC|O2un51WAwI5~sq*G-) z;~-c{H$e#_=n*cj_vl7qV?(1+SlO!$JA9iPi=Y1fMC18WCm>%uEy3=ZYzTxt&pkdaxsIop!K)%QVV?}%gW2t-gDKy~#D zJ6t#P-Q3OqhhZLGLEnp^5-_JA4E!vLsPGzY)4l-MrSoxa4tkcb$@{}}9f2Z%)&KLKQ@6ql&-ap+&S65WYu3 z4OWip^Rqpb_+lH4u`AvmS35guIh&~uoGwJpS_O!*w`D*3HVp6aky(NL97 zGidj?dbHdozj|o`Jdz7sq1)plSq! z13I!)-(n*bIGnC$K3EXd$SysrJ$c9{_A7B@AsW{EbuZQi!)Bw1{?%Q)5kym4n|`I% zfUP860dtmaF~i^Y*&=k6OhqW%$M&VEZv6ke;FctU9xkF(P}|B7C<39`NB&P<9X+|; z)rv30IVx=yMkJeX(q?a2&j^RZQ51?ak`;To8%y~eD(m^Hrjj*6=j9+QuE@k54AyYsp2I8tK1$60@v zj?ArBMi9Mw^U1@b!42R(;dyHGFdTJ?Fgzd~1**PI4odz_{akNN91{$hS0`6OXtr!;LY&5P^t z^c02zPvFTWA|*n9i)D&IvfACfSX5^tUu86tnrdX2o|ZAn->86Y85o9vF;mF~>5`SQ z+Mln-4N0jorg^hb7i5r{o~H0gd`Y|jFZfBq$9bAT&owL3Z;SfM$6_#Mai*-I-Ft;< zn^BUDfe)%cMPOTK`Ni%$H(^JrQ`-6-+v3}^w2{JRX{0>qoRj2(t9ZQ_3<{vpLrm|= z_Lj@Ck)eu_Au;;3mYjlTodVpoWi1n7Vd&~7dQZak0tu zWUWXk#r~h>KhG4PqRWLxWV&&|^hdHtfYU``E>PydVJzyob02nB{@*LwGlkcih@Axb zaYR;tJKA&6E~0I-%A~_%wL9$Y>d?p2v-*!-N256e73_xPlO~9voClryUe|szxDjoG z^lNKgN|R{&{^JK5QvQ!hC_+DGO%#NQGU?QKR9)qJebQ{;>6EQ2VpL98SyjBvQVFD+hXG>OZ_(uj@GZ$G@&Y&ZP^dJ6E08Wtxcv0# zV%hIf?`yS_qhl|*41D5s_?b7Blr92meCblf#^&nxO?i&*=^(IS(X+qZ*Y{9UBbRrK z`I4A1^+FfyDbVO-)b4)sJFIf_qIY4&%*pR#EP@;g!%vU}agiuj{B89l<1q3)I-PR( z7MpO=oZPBZx$0e3it>-dyeR3kPJz#`+4bPSbEUntR+NvgzMjm(!=pA`e&{+#jdkB1 z`WYqK^UzSx)6C_>qjkwCmcZHZzn2%O#jCdk;Ypj8n6JC1_EIG7kALmW98n83w6wbg zI5^Oc`5``W&tm&uUehj9x4Kqm2;Fu|({w%En9#H|Ev8X^dD=0kqh)Up39H{d{cZSo z>UeM|cT%|(A-^Z84*a^A2r{|*GoBkC&v_A=kJ9*KPs2xJ_#0?Uiy$<-V|1ziLaG1e zv=BbcZWnONpL#t^&<1REPl+hTc}of2!-x3hy1agW&xfEyH+n*SkDj2=|n)tZ+ z7ZI{4y)VgJ#$cdSJ4gIReVJcg1uv5H=?fAQH7&taRl{HQesIENtd)QLx@h}qbAw2r zeevEp4X`^RAt}IQJj&#eYpl~rbaZ!zXYt8}qX>v`=~eTnyRSv%B1L$tqB!a4txIS2 z>g7fed$H5A*IMm*#AeY6X^H7@Wlq<$KPs)pW5wUL6lzOKrYL#-B${#(YkFa&g3LAO zWGC!mm3hPECO`8mn*rz`{{3*44Xt<$Zt5uve}R4?pnCI+^3b1Nn&X{ab% zyD2q16MKkrXr$1DsHoo8I85%+izOMkTW@dOe=iLLK1}cHpeH&YBa`eY*JTO zFzJnKAqXs}{+m)E^Yh%XnnlwTj$DBS@r8HY1T|?K9ECFqV^$ysUyWoH-X_Ydofi@zECOYHFnmQ5!$i~8n_KcL_@_oiP z-3}4)%Ea>A7SH8Tdq}#>aAI3J`~#d^Yo{wd3OdB9`rbr$atkjqz!=r?qhDg8bA{*E zb=0xz@$-u&Tk(~iL>8-3OSo1fhA#zG5cx?3_zBQcYHk_aOKaK`U12jK zBBT73(iTVN&2|Cd<>loU`F1k*z~%RfVG7g}#y)r5VYoKPOg+Q4*2bAR!enNi#Jn;t zbXm(yxypu5dq|)Sl@Ryws9vyI{oN)Bhf`KE!-#9yhVA*7=H}(g~vVJkX7(H3$LEO#2xVm~c{a5gYp|r5ea`Z@oHPqL+f?H?g7PPsBiBJ0$x> z>gE09)j(mtIo;TssXp4@2S%yn|)74=G>$r=ZZuhVd3Xr z%F+pxli7qkqB8`Xe2;%V)2TA%fWbl1joXZAJb3o%1s=FZe&tgw08f|3W1}&K4~A%| zGifWs)k(s%^KfhcGSYMPzMg8vVn_A$FHz;;a}4beEG>(ejEoFmnc?>OUtN}pnRQe| zh~8vAQ9={jaBZ)M0DGo{&rPDkOYKL0Wv`XmNQ{Bg^pyqRS^Vo0IcjV551@M4-vLP$ zg6yb%rmT2Z{x&9lrTODsyXSKIhr`8bAY}DbaC(|sT-qEqWW&qFNJzLN>Ry$edT28{4=&uhrW1 zEb@{%UPy!L-rbzTPIt*xK0Qq7Gzc^vvQ_iySLS*D(Gt^StSDO(BF$Sks0CTet7czM zRR>tvo1gYgy|M&SQ-|G-YI*VbJn~7+mG`Ej$4tC;dNqqxflZ|1r5$Q9e`W4!ItCt^ z7`{G|kY6Kt0I*6Ja1$$#QGa`}Cy;M$W+tUQY!5FiF@G~TDMVJ#YwO%`v-zsJtrn1+ z`d%#qyG#Suy2ab>GR%97J*fyxe6Hcs!N^izch|++`*ePaYVCe;RVI*58eLY+8WWa? z&GqxG@>{X1HC(2+*NaX5ADye+_IotB)Yx(%THhX%8p&LcUPAtBJwUosg4N+jKW#&} zd~vZ&T5l2_rbg<|RD}^lT7REhHW2@u$fR1e)Y(|q`qB3B!{%Oc?{{i8P-;TD!sYoN z)y~^fB|fIBchd$1#45GAg7}37gIX%Y}74&|28lCHqXX7bwhKbev_Kj zkWn(?ZEZ}JY61o$wPDwTMbT$x5&iv4KG=%?o#y}ggFk;=LK2<{;r{pi7+&}Qv+)zX|d{b+YgcV9925^+%-i%2mi}QIdFcu>)p7BEd8a)Qw}W2YB^L)?T`X- zGHrdSpXRbAO);de_d0K%{Esi?HzT4e_=Ls1wr4t%1O(HCUDQ&OwF#qP>EXj<>`#NV zPyOw2m{nP=4d?YHcXDFSh}*8zaksEY;kxuSWADhwIv)<41AI3P+n4v@V(#bbgNgkS z_Hj_L+7KrJ1R0%-JFPzuB7Bq4+1~JjpNprixgJmvYThgw(ueesN5e{$)nn6g_1&ZY zi`=|j^+`FsZMwO=&rADtR-JD?RKfTH1kaWAw7Z!$xt|KSy*~9q>Z=p9pLb_eOGqT< zw^qo%h{R%*wk69u3!(Krs(!p}buh@H@6WkGnmj%5sOE$#eIyOVvd4^uE0%>`5B3f} zT|GTUC`DhLu1+5>wc-}XjUkn5_FQde^454mue$(T~<@n`?)d*VursMAN89<*}`|-xa_h9cL zjLS^P*b>sO%oR+Xba8lky7BEZ>J#fL>rwj5jl zZUjqu`k5xSi^j%nz_uEE&%jNSxDSeo9r*bZODatr+e+I*1%~ zmWSjX=1-YYoF5yXHamGus#vtmFUw3>foM$6W&fjtM)CQ@-Nh!Ct@+BAmxr^1LS2)n zZkS#9I2quefvs!8l_z9hpZ+`Ao9%l(Ab1)n&>@Y0R`*0+2hV9V;V6?i8{bVVI5!qG zf2VqSX1KV3Pl}K_rP&V_~Xz zKhH3?wY>(8Yg~@+=JMttyMRK^mKOrbLbFh^MnH~O@~E8t^e@(gA}zhu&r{4HMv@w2 zy?-~aEM*F*g^@0m4yLW#wHG&-H#N6N!*SN@+4`7aq!4;GA(^}{&3}qjIWk3mPwdZM zymwJy#pmx~=OLz|fIy-Y$~6D{>Adq%HEKT}9Jrozg3|YtEc-AE^-u7If{I3b+#B;Q z0Zm7}ky`Oz4*}>@92lDp3lbeTWF94}uG`2X60n`Il6lnQXvc(ykN;BD5sOY~h>+g? zr}9XJT;=Kn5W6W^~P}wnYvj@x-b3t82ZxLWFF0PB}$0;5k z8bcF9JN^vLa64^$-8<_ytxNnqSLbeH;tz{FY{xRb>~+T7-j zo*n~SE~beJC+6I==TVZ`-@_#nA?RGfuBsAuBh~&^9$xR;E#8gUFRAfns{Xi~&@!9I zm;E>*Q@L7NT3X+}bm6u|sQQ|B4v=owM_(?8v z53{^EDOG*GEyffFHdH%5V7vENIm$zuRZ18eA0Hn9%40^NkQ87O6D5YT@&NCw7`JrR z*RLCTTp#-uOhAL(P^B651V|~YxNH#zqGNLM@(~dcN6YQQwI^#QHW3DIxq;HYCB_pm zd(lBUX};~fRpB_001DQDU%p1Rj)0c~iF@G;UuX`cSzL?Zc%K z6Fal_u`0^xTP`+V(T~8ldl#EMJ(KNA?SS}{TFCc$pxf|hUe%6APCZq4sXg5p#+n+D z@vF@H=`p>QjoRRN`PGPzv%1B8lmhP*dHWf&bh|Mv1%;m8O0)Y(n~R&JyKd%BJao

*)4@p5o`CZR zt=_S?Y^8(AIdK|`9XbUhJ`T^M#oNtl!%3WtL-fvkFjShA<+MouVB`gB{k&Q^Uu{FJ z*X4fysCC`D^5k<2$DII*VKmTYCKU}$GL-;_Ne5mIa01e%cp3)2ceENl7qsUV=B7)V zi8F5ZZl9p8nzAno8JGZ$q-h|EzrHAY&~2B;e>eaA$mcIhgCv&r1cCP3KNf(tA|hO_ z1sKiR!{z<~bDgI8xv?GZ8tZUZ6tMTJ0*R*4(^h(zM7W` z6FJDb_;~a%c@1y>GF|&*r7N_ z9D|ex>HGFI*1#mZ$JA6`Pk(7)LB#)jd$$kSz5&Ee+*`L}qOj>RPkQmAMSo97IDGF^ zwbCgeB=qL1P{Oeb!@&LPyyc}&|86>RTmjDcOxCA* zX~&%)NATN#2Wg7UrZpJ>4YKDsW$J5NDR`XhKx#>Ad!m4xKM+SH?D=tm*=Kdq4Hws~ zOhMcY63GSDYC|(M>vzBEP09B3I{00gd{fY$^uIYl$RV_w3|3m5H~- z_M+`q{2cGiISct>u@JgawQx>4RK&goLYBE(r{mnAzHfc^;jZov4@c+y7amlS7^evW z3SDZLc?`uH8@Iii6yrrlPmU$ytW5Fy)3dS3jBJ{XMNpH$kGdF{#Xky2p;$W48=ZiE z4wWZ0mC`xhmtp_p3CUXN%6SqgxuON=>GuzuY_cPlBLAuS-3&K0{g|h=Yromdkg1eI z`2-q=|ewawh74*6VKDnx)s^EN(a9hd;EwzA*HsQr*Eqo(1SB+3a6k;Tu;-Tsx?B zHapDGnMr}w$El9`Mj z@S^Ac3V==;j?oS*wVTfYa*)S*~^QSCIO+2Clra)=@-e&iWH^l)BkE27+s&AX8ScE+w-#$3lDWl*}uvDnY3Qb(MY+JMG0 zO9w!yru(MLIXXQ65j(_H+PXqE!KxlX&?UP)d8Y5_c6QWx=h=C=XF^3mBSLL&a=V*i zdQ70MoocQIp|#Kn4V`5(?)X&G-s<88*5@m-}Jv3wPb zOIzEVUw5;P99PowYW}G0Zej=E?^9Eg*nD>9bc_zupnq8>b0nFi6NGHSmRtPYtbp~x z$VB9}K*#MxWZGb^+{@P(JyP_iqR}M0q*q^O4i}pqCI>Y~=4Lu?>k}g1Y`r8I>gJpu z3#aQ+Bk5(DsTxs!8*H~an^2tXS0v7>jEcd~`(5`9_8UC3B_pGo>tFGJx}X}bv2Tk^ zg+}CrjVVM*?~i(^uU~#o$H}7)En#fjT^qlU(9JpS*rdFisT!+uc!dHV4IYH@osQ1C zuVglTec}3}fD}MySH^;mL+$f*B)LnC)M;-Uf5n%c@p^0KMr*+W=Ln<_W2X!IP5w*;w=vEDn z0u$>WeHS&+)`oDrEE(no24-t9)kpp;-1#NqK9?b@!a7 zE+VdoIS`kOeX*rZci&N$zPNV8_lVn?n<^*$1qFoznGr~20T{i{ejzWvHOg30YWGHh zsgkgI{4Fi_>p9x=NH8GvB3TlTi4rSqjXm<;_`1Ew%s+J7qib7JP&&1rpO$B-l~ABa zTt7;%EjOL^IdCMTsJUmlsUSvlXY;>Ym(GPHoKOV5vAn!oOLMakIWX#GhP4T5O;hMv zrZ_;1{V(`*`a+MK zlGeidd3r{N=f>_uR_ung_>LPbnsN-nd^<{k&E3*>t$t>OlP6^gIOo71*j`z0HBArK zNGD9Xq!or&PH*p32cQJfi#K$fv^NGcwYx?$<{Z?FVt)xlsTHLX_PTAR@5c$Y)SJHD z{ufP#>^!-}{hX;e(h|hNB`(JqKQ=1R-#;>tG(9~n4zNnG7e0S@{@MRb(8Q$+RVM$5 z*ceH3Bdapb$u_yJlej~wx!D62DApbo(@@FLU^24URBATVmd3gh!Xw`RtM^;K;*qo> zF1u+q3p_kL|A-3=*`?>Jar4V+nm+C!V>1MPx?bGAP2ub71I*z14SvbkY1ietJ7lQ; z7@fKZ__X($qh8|nSHO(ZGrsiHY@jL%(^I8o@dtM)}%F#zFa@u@V z5Qg!*Y9jtO7o9T7zGP%vK1B)P=MfU);(HlG{x~ULX1pVk;MD(OKJceo44IZ@lt& z*?Cv6!g9X8qgn8;KvVM{oun>yMUCl}8OW}+-RE&+E@O0aXlOTz${>C)|!pWc+eQh6HtykdQc+@Z>Q%qrBzaG#hwe`RO>s+pUSF zJF7_6!^zzGavi=pICknMSXX$ zBA5Lu^5ssGyJH9lX2 zYL=k52#;*wm9d38tZcAu8xc8MXK{3@|9ZIYcESP|=u1bf3Bs`YO)2Y{46LnP)_lKi zd1c4P#=a2emH2JXRpW-#su`oVg=c384(?s(S8{2UTSaUVynP#2AFgj&mpaQ>L}n=k zM+)U^#BQp&+1eKJ`QA=OPOBwi_beW`gE%1xsgzuJBPx`!t88Z%edG6eb8|a$n`&a1 z#QmgFmfgm$yHiuM$~R)Y>*nlvGYTpvZe(~yy$jxrg=PK>6~nR|*-xD#srN1rT0BL@ z#sO-W(UDQ4AC>uzG*RDdFVv$yK? zD;Z&bG=U}Y7tZ(sKKw3eIz^?-U5C}1OS0ySfJnMg=0IW27m97JPh=ttDA?TgaUD4G< zAou)dQQ%frSJqb=XVlxMDhF!Y>Nb1kte^i-B0 z4dCgMtU0u{iqN(_{rvs=^zafneR(-rR1`)Z(JvR?ngzxCEEkJ>GjSmN)x6Pdwfjbi zOk!?sX<>H0#cR*HZXz{1eehIEhe+#7FgiKh(#~!t;wa$5-sReD-}F-J@RHNj>>#m< zDA%W_k05K-{RU5uWuK=4Dgo#Bj*it;OD4v~G*mQM*_3E8X`dBK^f}m-fF9cKajmzv zH5%X<9US(uoUVFKh|{(-7_6;Go>7=C$9R-{YPF1!qB_{(GVa~`gT1qM^)v&jt z0|U&m0_3?KH@`Q4=e^X?-UM{~EiKbdjayrUd>OGh4C{ed4}6qV{}q7$H5H)T1wB!> z2Au+zLlb{oJ>!npfZM&Nf~>^O9%kAL?O8W;oWFo)`%}Nf;Kh=PE8)nnk}}8B zf(@SAy?TwZ!-Lm@kc!l6x@WxDl?svc9+lJ39wM|V49yGJ(z;{YDUZ~IhW^duk-?hq z*`e`Qquhx2T{(Y67iOQq(zOF`??!1SC_E{ZW5}0#<#X4?to5@^;Z{1Oj^16{j#mVnn$@B%e{ssb)eq67+aJY=)6>Tg|h-Ywndf!|QmtP2r__VX2L zm{+yfrfMZ>`CnEfly+sX6ydPR#Is+j>F(@xwIewR+%@U0z47BB`2uo0n%YM%`&_*W z6UArU)8TyP7T@g|EJ(S#1~f*+Q1$SDuz1c|r(%a1P7*pdWL3CAz5eLPspu6&k+C*4X}h>X@gMc65(R7OtxUJL5<~qWI^nk-G0KZ}jTS$^ zZ%^BzQ?2yq6V>2j=$i`6=EaOJFn_di;>LIgFb{OWG^)2sxwZu5h*gxqD1l+RBsALZ z8$*UO*wToH-1tM%-{df~$_fnEE-fu(Wo7BNQ&_lrVM0BPhb&>TgBFUQmaI6r9`dYV zHu%d!QdtXIX1669+*E>4RBAk~{<&Wz<~KxNC?3%3vdyM9!*LEf6R}Bh-AanWhn1v3$dY z48|-sSb@5Mg_`a%Kfsk#Q#Z(J^>QgBOAf;MO0fRO9#lp=!ge>|B|SmlK$!1-((`CpwQr=2#9A9J2`cnt;})HaAE zP*n|)-5@m4RntA592A^5^bIXKGYLQbi9`v;rJw$$k0{;fs95R+f+%3#Z|MQ?8vH>T zbNqp+N(W2Ik=J?cJ|3!Xwb8yb;H6##N5MMCX4IbRA7Pm5VyVO7%sU5$Es2R5vCHa% zMusFmn`_xEgpH1hC-)xfz;t}simVL6SIZx~e^rPl(Uim;B>V3lN#5$JC}7dm&(#Ss z&?J}K_X(w(8%P40MY!qL^Wz~cK%z&9jX5+#9$vUt?0xk-;-!qbeYdr>HPR(!B1YnE zjl7+P8HkG&7mM2bL+#Vzj)nIAdzQ#X&nk@ve=JOd8ai`wEORBHVo#((5XhX=j2xVt z`N@oHc&}n&1QrdZQx^tnI#chvNxtbG(49WOO!zV*UBCal?tGLFCCN%}7Z6TSfD0Ho zs?r&a1p1iSMjS~`^B4ow;2vwrdb%h_7~x~2W;xKmI>KvDSvL=Hs&jqkSB97pXp(^{s_txEpV8Y`A-n7RqsGips7=q8;s zuOk_j`i6G`1*<%Nx*{w$(18K1==r)ded-R>3qJJSn77S3nsi zq^>``dqG|h_-B-<$b7$i`5k4@5D9C3+q>adnMuZEIm8g2j;u~@|2MTSY1fn?rK{=I zo3+N_&qqKi;b>rLQ{)@GFaQRxsDd(8F<;_G_e>>A;#h2D5|i;6A(JOQ{GI%7xciS{ z2|_bNFXX)0Z+r?m0N%T?7s07VkzSX0r30ewfXtmHEL8D+@xTqDOvTafxa+ zlOC7WZK7<|w**6)l|h0^Xi~hy<}U1E*5JA{bzVWneszm%C3wWoG$trH8~OzjZL^I- z`%240Yn2@8-a_YAb;}Z|E~SQxjuJ!zfkQMe16jJDYLqnKKL%k}9o#|?b-PlQrQ2_o z>bi&oJd%-o1iV`s^Enfp+)20oOK=c?GI>0w-z-r_#7>%udx~AWkc8yZdvt^HSrS8Y zkgDf$GZ8NHlAj$p}gEe&-(qFLoE3$%Q> zv0&HnWWGupd{9ghBGU%#3xq=s{8JDWr%btS>TP#YkClB87T!BtWV6;j%7%lXSE42B zTOJ0rp56JzTvoR8)GM1@?$*Hafd9z?L`ykUcHB2Ic*}`W=__=w4j|;BLjMf~(yBs! zk^xG_GO4xN685SuC&xMuhCSY)QfQRAS}7iNso@e*TNSyw=F)6t|1yZqzjlAmQ*X*b zN|wB7XRVFbO@FJGTtQg6E+yQGV0hSFbvy6a_fwl1@;J5?>LLGQY{zC-KHm@5+|B>? z%`T&(n01Q2`9Y~1HL#W~^U_i`ROKkCElWL&}m^p&V@fCPrrZmfpYU$U_xYHBT87Ku1hWnJ-A6QKrFvHeww1n z{&8x|z@yD$ZX3q3M%ZQCunCnXs>@XFQAZ>CO1{DJNu}`un;Ip(LJ3~#k4Z(&fNr)4MwNQG zG-JMR;{0%hWByLNoG8gWGzmg1H`ObvjsA{1Q!;W8QuyVAdChAjp?woOHEOP{(w8)~+H7qInK9=8!=!*qEDXiVTzrR&&%UsYbw zYc{O+RpDXYIT`y`yr#JiFB`LFd7cwy_&YaEmM;*YAQ{8`s$&bsA~peQWWOCv>pA?v zV?2AaZ%`;3mZq8XiG!}Q7W!dhNU0dqrL0m;?W6sC)&KqX2zOIgzhX-q9t)3W#Nf*X z)hD>&5ucbGJ!&1$w-5WGgZ${mv`wYv#32{tC?o$bofKm0jHoAD1z5-doVh&tfr*&N zRMROc4c5TysumQW5Tf_KiYAfju!MPl2(Nx445Mm$^Vb4xdNk!-CP*aQ1)H|1Q zG&I6jiQ`G^hRDvFq1|rRYMBU|MFw+8S|MiT1f_%&FIifk7LC|xj4aH=;QjeZGsNVK zEP3ydbj}z}wG8BdMwkP~5S??X0mv$A0>z->eJ_0_5rT%IaL$o2jH<*6WtW263ra=* z)S{|5C(IVrNrqr>Tvo)Wcow4u0NzQOvXl~nDxoHEE2Qf*t#%BQD=9a7l!xU9Rc0wVU7ux+y(K%0fJ@z<%nZF)7}9hu zabjkw#>~Xkm9>B6_O7V%dQUgB7(=>XBO+IoO8V|`l8()s0~AJ%#iD97sEK#`JASTh z&yLXhH^_V#V1NMzc%osw$hglPk2bI!3^2eG1ukRmiIvhVgV>TDQ`s7=$}mQ9*79R) zfk(c!5`oAil`_%$0bq8?>zIzE^s1fOQ4{ecpCW*y7Ev#n9%XEP`L4~JqVa`6&|pag zbk0E&c_31hwPC-v2I8dFvVd7bWGB7$%d8GYMU$S?pTzS|F(%GA>a|uzarbRYy#XX- zV1kuC;r{UZeTKOzo4V)Y?eQ%3OVW%0qdqzJWY{BjDEmgRnEDT9hQWKE?8!`JZK@gUxkwGNf%lL54rCbamuoFvZF{z&di%LvseGoy3U5{6yOcyFm zYss>Z<}QTbT$Z90${}mHQqye(0J8@`ka8I*LC7MQ8PfBXqoiT5ebJ>7jKWOfEUGVg zF)BBFX&SLq`ys_Oz$~hI?~9`2y|<_&Y*E2w&V?z6S(r6iN*Y2HeM3~*#H_M5CW8P8 ztHS45nK;8-CU~WOmb3^5xJ!EBJY3cAv1N;)A7b0H5 zEV%}WT@lPVGLS}wi9i?vBS1h}XyGISEJiIk?RrLp&$<1KUR4>tTxyv6-<0p~4}IQ$ zyGLJUeHBDceLp#I=qbZg?cCqy!Pe5}GHBmWs(IDU6+7XrD2^uRX{Z!4-plxp6i zgtOm&RMeFHKc#l|)1(hdMZ-)eQE3uhsyKz4e(%BADEp3ISvQq zOgPZyBbs`IO!lXYOB(^DKH1*KubS`1C-n<}1-GCrMgb1UaKpYUNAPW^1l=L6e z>r8Lyre7Z+nF?IdXY^*jcP#d24X`x2GJU`ZWR$`=U@?U^7$PN0iuQ;s00Vj!5kN?g ztOKOwg+Y{zTIl5}FKbX^}zn6giC=}I|vDqX)OJyM#*%QH1KK-Gt&dY-(Rp* zR!nc{l@nE^knF!)S!w>GUP~!6lwQBZZvF3a*P+ZTTCA@V7NBR?(r z?@`#7fB8$w#4$3kfz2RhAl2%oZM_as0f5W_Fzx_p!MWHgl!ItyDUQj^95E7qC8c>) zhEjP47~r1{eYUgDwH;u90X`=PA#vz{NXv(;rMx~yVho}HL}Eyah5U@h1~b7+`}_p+`zh1i(>>|IJ*oV)7X(p`v2Vfm$Kd<~@3Ie%_YwP7 znJA^QMhC|tfR@~aj8ccCGMuFB^MR9AD&K*x=z%{z>)rdnv65I74|a(U{`t@t4{oWy z2W7~Anv#PzmIuz8=nnd4q$j{fp46%aKj$6b^Q~v<^_%q3jrRW9CmeZD_>Zpg+)E|x zb-S96N2KLE*yyL^7d@)${emSrK!Y32Of`s@8JNv1nz3pq>$9LVVEvq|29N0TL*Fm~ z0yDDyAs@&sOGGhLS`(5{D6LzGWzt8APm(Gq7o;V*OF9D+0EVSm9^ju8Kf&{KfC2jP z^M0TC=L>@n0YcCsbjxbnOhgt!NKDTuR@Y+5Bla0|<^$Wo00aCI;z7>8in5*^MKcZN znLUe!2(ZsH5r$fd@OL6Hnj?zQnDn#hwH|S5fQ$|LW4Djnavy%IMWYv9{xfg+GtTv6 zw?HYM$J*-W-18^v|L5;X-*`V?%jHXX`6oTi4<+$T>$&)KVF=u!PYYI-?Iz$%WFG8iF+ z{iEN3e?Ve=@~^@&daJ0n4<7zr`&d``VA}`o2I-o5RF5BARH+;ZRSLVQ8SQ5t^;L51 zb;J5ck$xg*FS4Pu8uU(W3~+gUm0uoM+hyX&{@<0fOOgH<6{?>$)r_2T1~P*YleiR$ zMx0`6n3#V?HvQd66P3F+m5do{}*je+f8fB}9<(Vt9Tp(r{+l=<`qA60{~?d|PZBgd6b zR)<@w#B6XZUb0jvzvY&Qe`)NA-xUa~Md#+!!_8%9I-5;aR^_(t!>W}^E{^;>O zU^}b&U+#NRl=v|F_OMUwWvS*Gr!0IcQ(Gbc))Z$zMiv=>vRX1& zJfagNegDBxGm(K{Z2R9UK|ra85A-wrYKn*a`=te)e4_`m*->(OLvg48s| z(*N`G@i+Z!@aSmZUucu^&%0;8P?Pn*U_Xzg=cnm^e>+t@$X>f;+Iz2PC;+nkz;Jqm zPR?fWaou1^KRIAK_{K)S97}l#WUj z#J+IAY}J{nE}B_oE_!$%584qvYmWLlnTGgqCzGw@q3;uMK}t!m-m!fRe%jhP7*mt< zY1@}A!+M`T1O4WM-bqsd*B;V0RaC-(FVj)|e2@u0!v{h&t&kKoK>NbwDr}&P^aYW4%-tXxqH>&wS8RsyIni|LA}B0(658`vm?`FJ$|5uZX$F~9%={4>EXny2L# z3r3boBSAyx7Ty4OaMtclN3C}{!fK>oGqV_@i2Doy4QvMk4Dd?|>V?ei-vFF*q(m&~ z%`ngN&}}z_H59hFe#q71>KZzoEOR08f0u5&&lyAhkFf3G;G4Jc!D_S*yyE{N^qc`T zaFs>>bJ`+R-tm&xPypN#=kdbDgGZmp+UqEzVm+`kWGI~yaZC7)mZ58Dnt zb3{g}RJxiIhvELUYe_jwap?!H>b`v*t$g;hC-lm&rbd3unmKs%BU^ry2f8OceNY+h zo1@+tAMR!~-bc1v+73zsiUE-7G|5e^R66&`Ds>V4v#AgEd0%MNsQ2aYs3G?ciZnU1 zA0dH99*TYg!NYf?e(e8xAYY?mP$gp{Ew^Qi{o`DT76DEs0#!}*ARZ31>6sWxgU&wT zZpw7|+20>}N`D%1&l=K;4oI_4rc(AqEFDftW+~jDI*M7PTK3@bdJH|2L`qhwu26z; z`2X9xe;i4YDvsm7_oAx08)-*a7)<9eVW7omN-~>nr2O%y2 z)@r6J<2{UstjfyDs_CBXrKdZ;pO#Xk>a5Jj$iMO8PZn9mCZsk%SUVFxgDWRfrc6I! z`q<~I&+2*U`<|v$Wkq)5S+njxL`0PE?fcE)B}t*ra#>A}3< zWGAJO^K#&`r+lr`Ud|c6@i=~t$(_Cx3G6XT_HopV_QVh^S}|G9bX|wCeOfCXv?Iio zt~Q>2@6piOF#GWUJ6o@LX4pciW+z+De>>gYmNRYnCu3El_ur0Y)ys!_dLQiV>?{wD z`B&pvaLAwO)aIr7`LB+j&t~gQ0JM|?r`zt~^KI!%n=bR118t|YB4zdL?GCcnQTOl7 z!{q6fV+Z$MU2Rf^EhKo7NK+s0V$6rh7Byjq5Ypi{^Gnc`JvGmblLVZ$eVC+k+A5@v zsbR95{%Lkjef%6$ReB2wwAeu@rFB(kom!`j4i13>caMm}G5_?}hcRQ@K8<50cnMcp zHBVDm$Z{JYshWqZMWagYWue%GnXHa^YuST>;VGq8shXQv38ewzbb*GV_#Iu_9SO4yd zI(D`nYYZ3H)z{emZ?o7zA8D^$^Tz=SzQd7|uBCeH+4hFy=OyQ!@{4sTVJ9{DOKVwP zrp{|3=E<4QKii`7ucxEjT{n*TH;KrctoJmv$DPuCbu3u+cj-wXrS&k0XYZ#TlUTr* zstdW1uCd;G{6`$qnQ3N+9wO0aiSyjKvZoev?67r{MV!P?CZkdKq|T`C_pn&ncS|do z^tNaLf))$NOr@8Nxow7eUxzf$?dGP&KEqm!Aabzw64KM>!zb^-*0y;ZV<5)SE8Np1 zk3-WEMT;*~Q<__BWKs0NQ=x5pENpLzyCwtz3Ii|%eR@;wL2gZfOVO? zCf!oEyUnhs57AvD-~Hs*zfrB~9TN`S96}bd#i!-Zlb;q6uu7+`PnNXfd9ghCgvZar zj>c=Lz1;q=l}nG`JjQIagGW>xJk|O2z}!B&>>NsTi=$|ql*S*JGcLtReBufl=Uym0<<-RwfHn9?d!kmkni0jl+(}vrFj8+10001>TV27R zm#9|OQv*1lRs{e60Kj9dE_MK{7Grk+0002^G{g=700000z%|4U000000KheCjU7Do ztA+po0001Zt=1Yl00000000j|>;QO$Y}T@7@?sHQF#-Sp0N}BR9f;lwSf}Jor2qf` z03L?e0kAI9U|9;^0nui0H1_w2>dDjL200013vg+6Y)vW*k0001d z)T(0#O^Y97rZR~p;B{L(#A$s10002sx)sL`E`$k^2m)S*rNfw`8vp|iWM zWhygf|FYg1f%;gy9yUe|h#vp|004ND&2uN<|7{EgR9R74rp#4JF_X-cX=W}xMG`Vq>pnB37{5tn zrd&!nO%L#b^|1`h+}*6VuQ9oM>a4j900000ELvUcAXBZ0K}JpoiHit%f7iXqGP5^P zs3D_>g%>H!`VpU*@`z}?70hHZnYGb97%LF~006*stBW0U>1KVf1DSTaT`4wr@suP_ zlN7x?Wi;N#3uR`R>E3!S$lZ&%#!(d8f1fvn00000UWC=f4q6qg$@=Gzx$f@n-oAai z_ZttFRMcY!nQ2Dh3NO_(c95BGZmJha%2X;3tqn4hmInX;006G|ABlR>sokR_G5`Po M07*qoM6N<$g1Ye+nE(I) literal 563593 zcmV*7Kytr{P)Px#1ZP1_K>z@;j|==^1poj532;bRa{vG#)c^n?)d2*Yw4DF||D{PpK~#8N?0p4b zmDlwNqDCtbI;xYbshwd=O7v`7e0r!8Kjh2rj#5Gd}N1Ojn) zmz!L-PtX5(&-w1nO|Sp~LVF($C+9mZ?|II9&L`KzLTLX`8PmCg+bYwMoVX}|pCuNl)= zVuBISrU;3`H36-*zK)g$zBXvb6GFPe*Ay7|>iW9k2k$F=;J(7|->028McmNV2#LbA z0Zo+wlgZ@s`3$eNMo1K{B|sF!8gV&rK2gxMD#q#=t7EKzJ6zpf^AyE;$!748&%y1y*Q|<3LAnIaGaMFlv_p~2p^Sc8kJ)jkr@`9WqPoG7=$x~ z^WmX~9x_~)jxf_rrbts*IKO}$e(?FH;dv%$@=BZVX2 z2|LhZ!VwV>Auc=Pf0*zj|AWsz!@Z4YA}#C|m%Z( zdaK9dL3xuVO@dujRrSatk03IFDl02dGndN+$8Uf8Tljoc0Z~9p#W4Kzr$3!GZJNzy zTfcrie7^CGZ#bP!_{YS=^y$+FT>C2&9S#1jZ5Q81a3 zlap_{=@vMM6*%hZ>YjY^$(}uXMny%%#l_uz`|Y?qb?VeV|M}0q|NZY`bdDW6hTIVJ z;fEh$jNpdnd+)useED)DfhbI!I`#ab04BI~O)Cyuom_E$^h+p z_~D0*i%UnC={A#LzzN?pnGSJX;S&2Uxbs`HK(NT}Pnf#*4>AM8xC8b@nr@VXFo~%} z4u{QgQLsB5PKV8HCmWYeIKHB$dFx!_5>hHp1#}d0;PAS9>l~U)R#-D`Tq4vjz_|I_Q#deo=_%_IU6>wt?x<$JD*Asas#T zFNhVaP7fC*~;&|M-XP}kUnn>ebb2XHN%~Eek*lwf8*kk(M%K+u}|P9o7g*u zXJ-z)@Iu0~FSofl^4!ZupM5EDP(M_{;`CZvSOQ&G{M>d69H+~N&ok%U3P!^Wu$_)QNI9a z9t0@>LOH;ynfmm=>_Po92Y)Tiz$f#2J<0o{4bYqwG*(_-nUa#0dMYh7H61D>#%uTA zUob-377#eUD2Rctz31NI`|dBjuZN{`XYLuoc|p3i;k;zD)D`rgC#4_Hm2}LEHTIp&0d#7wj81_kgMAfXzoM zOkJPEgpRm-$X|y}hctvkN}~F9=-$`Vqs5S)#dI4oCqA`9)DxzzgVF{+ec+kF2`iT; zu2=#4;PT}OE8$py%XV%=J(E_iIypGPseu3pSGq#b~^!5pZ)>YriP5K>nx7mn7k!fC^47+N)g9safB zoCb`-V^ZYI!OuVx(1|{Cd85UK9fVI~dk-G>=uFa7RYAY1R-dz72#KyricixNzSC9> zPaz7}gy-cJ7iVT==Q<@RGqYG{UZ$8e*{*AfqWNT%PGqn&E1K+-++LZJ^Ob-m$u9IN zYHoK)5>r%Nk`y{QL_>5YBSssE!ljs~CQ(2!@oQK6uw&8OYnQKNIz8y!;ITB;RyI`T zWfzo4zN;<^n$PRD+bo*TwQJX|V@anBZ!QYx>%YA4{P5u;HJv%!mWh)mefY@?=BukK zNL85+!~XG<&nxTePi5rAZ$033dzLL*am8f8qcM-l> z&3*bsMm-sc4F#m6#dx2?_(fsw%P$&5U2A}H0|-{QX2H@{t`N;>B`XZNrQ5G=>H0HM zx8CDE-*hn3^>Xx_Qx*CRUHtHe$j@e)FA(Pgmuo|o z>2O;30!^;-p?ORwA;LlTVhI;JQG;25!=I7(3%m7IY+LBEeft)1P(*DlTIKIIjd?e5 z2jRk4A)*^UMd(4#qCwq*-bbd}U~%am-GTfvXt2+1E zMTGMLokIPhqgzNTQ8abjyD{&-|Ka=ZzyIEQ?@gRMAy~p%4~PO1N|Ll}*)s0IYbw5i z03$>}XV4pY=#_)UY8P>4nM z{^3z#YaoWX72MDYQBa}rLdzvasP{DfT5i03;?1VdI^MkMrN3#4>hw7f(3@!VhykYW&?!@gr~zSJ`k1=)4X1;q0d$;9C(6B>4f)wjD?|a+)>*F4 zVN&cS#TL$Nrb#!MVoYIk!*5tEgkHAIde2I{BANC1Gbx;M#iHQY}kLu*7yL5ShYGe07 zI}*$PIPkv^h{Ktd6WNY$_55@6ge4Q^u8-YQGJD0opFH}Hb$g4y^Kjq)8}#q}r>dIh z;T-04QP7#HLl2;Cr8;Y}WPe??MkrR3Y>9L>c47J+=CT#7T(PM0Z9*CrN8HS$I)CS% z2|Uba`HyNPNpjbjY?j9uE5HaMVfm*Id#8|as8*9|{}@ce(=-Q-BN6MF!U&``g1!_j zHa6Dq!tPyHWmQ62?BV$pJ$VIUIC=7<5$Ey)RIu0-CK`YR!ZRs?FOI~q-iAl0XZRB* z7bXfFd-i|&wJCfEF@F7MY3Rb2gS!Wr?&@Xg+K28i-8}?4BeaT}?rojscqUdTs;Z@1 zBzF6Xl}i}gi4kIUlcVuY1ksq%y>kK$jI7Kxb(SWW9GKS9S&wW;In;JjJ{FU+@h)96 zrh)Q%8>-GkNkvkH45#?3DXyuJp2;R@LT3{7=0nA=6bKLa zK(av&zKImVp9f*ippVE$VVc+eZA8Nwgjv%(8@g5$>F9eO_){9<7=RE3S(aNaR=h?= zqN@Xq<>bi{l~0sbcf@Mtn;oiCs>kgF2jl8OMd7r8ymWIGQJ{+Bzjs2$Nt0&pK=ar? zU_MQHZt}6fnocn#n>;C8p4f@$Zs8dWilFSpjF%h3RNa^y@cnRIv733Ho0t^P;$#p@ zqseDMZ={?)*pRvX@6c>UhTwbQ83059LI6=nNin{b#i3(8fntv8(<^_sE*MSjHPtl6dtxtH5r?9IGk9r0wWQVB1rk+n3=ZwZy zf@_X}@jiz+yV{7lDwZ3eCDOYd@%0Rsbr7GbEWr_y1F2&19c#EjqDpAf#S)j zYre)G)9oEDq!-ExH0qtZKMI}T`aA!0(>?vZabN$mQunT7g&ptyPpJm##T0L@W_9B8%(CX4Nvfkpco6;1XSZ3EC8-8$t4-y~Dn zl&Ik0Gk`H{ybc5GY3SomLfQXoZZY&YtdkfsKI*jBa@9SEn2IIbh~@{n4@#r+&;uQ;&Cj=kZ!S+f??g)Ws%eemzk{YA95zWOE2Q^{jpfGF@s zSMGkQbJss^PN;-75Z>hp)7`zpyYz~@n@m{OUgYzg$0F`}oSsnX(x+p$Cmww4^=6}f zMss#nAcD1Y#^S9@3j@6f2Q3Zw6YQl+p2;`(CU-9S>=ByhL7-TqDBPq&6dHfdeKZ;+ z3KX-Gk1S;Zqj~Flkn(7`jz?$)@T%+3$6WmehWteV(CP={QoDA4VwsD89SoKGdZfZGsf7X`r6 za3_dCvSPlVuf32G+IDow(4KVc9YWB5rd6X`ME{) z<)y{>1r1hLS*@j{sMu_Cso3C7nn-_}S;v5|1~1 zIZ=qhXS1g+TsR*N`Yw*5e);9*aUV`Xl_yS|7!woo#{d2c9&*^NJ9g~giLM0DIrB_@ zlEd;kIZT5ZO>Nb^mLD_4$0ecFqJWfGAj0qNOS{Kb7>aiHz!sioG^Vb7Bf9oYd1}ax zm!C5VYXa(cRO81=s^XzbIxLjv8&Hr3dW?a_om7UJZOUYm?~^dDU7iV=5411a&?7~( z*H=8#J{gb6iQ%tlu*#}eQ=yDP+ENvJgwl93W2b-r3^Js7?2Eam2^loFML>uG;9m&* za(dOFv3aHr|NZv}aiLDWL3T^Ljy`AI4^^pFRJYZvps@~7f2QXU#Ytitny!PeK}{;C z+x^mWK^+@_%v_zp?O42N{3%9L7voBXe9K;GQlw*Qr|OTt>u2wl00*j#-+<<**dujj z#bt0=#&@$7r`8w_@^D$Bgg+etD3VwRh(#eo?y1d_HX$Gi?GC(c+=c~*f3~1m@btIl z0v3qy9#1wS_BJ$K2c+kbC>SNRgk81KQ8BaK#F!K9py`QW0iUZfD~|4@?N=0n5!@}!yXXQ$A+kqXe_tVBy7f!TH=j)uc!f)uEs`~o zKwz=(HAasdSLR%{u(Q^LIy!hI7=G+>&H$l&Lkj7*+17z+4;ZbUV9RICx88O_=e zJ5{CO4!N;2gaZ;FHHIk`lO{WPk%9?=fVD{jPsp<7!D@2)cHr6&g|p)t5CskljLXq@ zrw>DA3xhzoCYhwkChtU(Z(?Nftlxm)Tgdo1;I4c_wRI-_1A7xJJyw%s4P(|wcjF`@ z#+kvnq2*j^g2UmU{o=KX3wU&eb?AB77KrnU0tSFq29@k|uWNY0=fA9uAIjuv&eN@z z12LSiVJwUt@YT#^EKz4}zJ`dPiv+z`!e80D7Gbs8FF+Ko`(7)~i!RP|>2qFDI5W5e zw3-gifs2=b0I)z{Z$eq2Le1*b2AN+0w040&)7t)9OhM)%MWH=`L;<6Y{e^#vL9~1A z;6ikTDw^7B5|LBD-+w>ec^!ZTNvB3CYQ)d>-!=ukHn-ow0(>Tu$Z7FE=yQvT4f>CVM16 zW%h<@rns>ioVzUEBk7wquBkUS8a2C8P!*PxWzMu{Y59`VCcVAj(3%W)UVW2DLKGk< zCD|u6m4w+NIqXiG!|6q}T`rdqsU4%8u>vPmKJ}Td64m;!mDlNk6nX%Nf2N$*#lP3T zlE9b;h8_HH+TBH=E1>@L5EPH;kAB6gdQoVHx&n>2s_K&LrWd(1&60ea`?q&+Q3wdj zwTE`6D*!HgZNiD;PIKwXjXR(i_>Lu6AQg0b&s$MaSX^b6Wm!BYs6dHO6o3`!RyJ7vR;)+65m6MZ`8_ad7nK{+vWhoiyjkYs9 z&eV3$YHLe1r+w;_1*sXiV*Ep_&^9K(3LdZImOZK>$ug7$+BLWi9W-h{2&}tTeF1J+ zfmVtF#i0L4E>6tE*0U{|b9&*(_53w5(C%~vC|#g_i`~PRSJD}npXDTq=AfeiXb)%W zaS{fKI&+CM)AZcv>{v=E;iLuJsI(p_< z^FfoKx5lw@U?Zo}GtHjHN~X)T#f4|+vQ`7i$;NHFF_d(3O4Gbvw-3eh+*&6J^yJOI z{_!j%;L#@@LoR05N()=}>9&`Q@JoYaEBlb+;}6~)_woC^2E6e2lYjQLttg<0SB4c1 zCnhHyI5_9CsZa*1&2(tPvJ&Zm6wrezVLs6~W9h(rl5|Uh75XE#8)R$r&WQ|vdaVwB zAO{#ZAC?%}-eDICAyU1_M=FCJGfH=M@EnsWL0C^(f4ndTeh>R@zI? z45Ur5W`lBUM7ktsy0c8Us2-}f?~s>J!*kUs2cy^E4P&*BL?7@OkEeN5`2|Qr>k4iK6q!VUx`Oi4S^q)LL-bpj zcY9+6>gD?S+Pb=$va%e9SEg>tOfo8Q8iKn%aOf29JjcKU2f;1U268wD_zfomE#kLI z6m<2?*PfT5A#i}Nyk5!K?6KTSfX<%#$NzXAiYw-_lzSC=hNCrTU#wtsG(T9x_Q9+0 zXRk67R;^g+tgnJkWlgcqZK*FWUAbyq>Zvp+mBq!`tJcO!F3Z%Jv*S0fi;a!l6u)im z-1#e3u3NTr)sk6r6O&IaTfTDXoEeAqC%T+gtTMILX2t8$bqLPBsJ_0wh@-Hu(C%o_OVQcf~i+I=`x!GfQC3d~0fv*N{?3I_xR zLIV|nj+xL@{!9@R2HJd*+KB}EEEYO!hhrO zzw<$nJv=KOU2l4fy>$!3Wd}_n)QhOj@M$I5o34N{B(2cvqqj_{RE&_@O&x4>a=#(}F&cp8y-Yg--gH3@a0ep55pZ7t1j;(EC>YCMOI*BY1{cTO z)EjhYg?*DQ@z-T90PT$xsAp&)Aa>K}83kG(5?3r)?5Hn+#!y{WG-dWI&1shv_otuE zUbk}Tr%P5i>uT4oT3l6Ay>#KcLr0IVUAJQKl4VG;a3Oy+tZkvo!$*yge6GU$g5${v zrA4{x*2asF^NIpi7RBpXw0QZ!ZJRf3j)x|6B4N+kb+M;X(iSZ=hN1PKl5|y(eVNA( zV$NVYl2=p;SzEgkyB92JZ{QNeb9nuE zhU7R`y0d|13r{F&LK&iScuxGbK6l$1%sS%_f+JK{B>9ZYL}-7kz`@%?q{p>F|7-9B z8U_(+49S(oSqp6+YU4Tk;Aqp3d_QDDfg`F=vQ+Lgx zwwAsaR8dh;c6m_FVO(4mRJ8Wt_bbB+^0f@Gf+R`C#kB@S(JtUUh%2TmKntRM7gjx@ zTfX>-L;3*watAC@fsDoRoNHv;ftSpcwLoP!ur%0gHd-LaUubg_M?~ZbBh}DI6clQ_ z*F`?!%!&tHPR;jhXlFYJRY^%nIhB?VMHeM%DwA}%vZ|)2pcuVO2ZGo+(|7#nN>yd- zH|gL{g;ZY&QQ)Q0WB61zI>j_@UWg!w0#tMaxf{!|??wG2x*LiZRCOfe2bBEVeSD-9 z`YwQs`lA6z&a=VpnFIvW6cQpH_q|L|sAklYR4a~lw1XhEQSp8J@%YzYdj)-#ot^D+ zH(G1U*T%&yUbC?{E7j>`rL|^yfmLzNoH=uS?DoczbXQqH!l8X0|C7*{6&RuH?A#-V zPwd#Ux3Z+Lw6vTEfWr_4jlDhg{R0OMpf*W|_N3>eCMO*9X>8w?ow)^-`wtwA-@MUh zX`k~_rdf;a*pfBGL>|0~%R>N>;Ou67W+UVPRl=^BJ!1wpxI0pd`!05IsMfmR9* z5wltR%ZzrWD+HF_)_|(-w@=3z{m&Np95_dk;2^jSwedm_h<|#*b7yry1+_AA`_UEn zS66iP%h=de>o!6r0Meegf+KD|2^$R)4k0&i!-sE&NDo2|q+W_>vbZtbl#seaSNXGJ z^ke)`+=z}TKK>#tX?En|U))4)NJtUHJ5Q9WMqlFOMbl$)L2qjz0z`o(I%9bS*#)&0 zDvm?cP}sr|aHHDD1P)<~oCSj8<1!E$@PQ2DWzRq~P|c%!|?XcQ1U_rnnF#dUYyOy%<#f z_@fW0KiH6m2r^P@%7}G&Xf1R-G02dUrSbbHbCrhQ1BI5Ok$#Gcm&gGJEfD+)HD$Ua zhDMYtz-!TLjD7v(6dPyMXKhr)8pPg zbT#HL_DQuK>O{H?qbjRTS|Dd{ug!qZh_wY6+EMXk$aBPoDhz+jM*803@HP2JHFVZ4 zxOXQPf>-8kJ`O=>aDyB)F9ZYjIDVok7QqvR<-$kPp@DxP=BC`ia7yNKcNoBpSQ;+`F zbsuCDaCRU2Tc+1^h{8i-N~&tTtrvylC5yQvwc>|}FRLhI6q4GAdPq(u z9TIS=6@7$Rg$V(OieeI=gAl;qs@Fb^PeH$@RZAGB{pqC`Ih#xyIK**7CUjOV!H-SZ zl#1CHo8`f(@b0=Cz%=6nwJxV2%Z>Fh4#K^{I0+ zS*0b|tut^#y^nclL21ScqQXq`+PqpqQsSvor!q4$VP|J&CncRoN<5Z&DkUo`3!Yh7 zIfaGAiN}-D(=#(O($dq@5vQ=Q@W6os2+hgK$;->j&&{i>s_7IpC^D)qQsw98!yj>~ zD{CGek^I1zf`Q``Fw!u^C6x$54nRgmR&sJOMB#y$qNJ3fCQ+c{&LH7E4aXNP6ppLR z3IS0-ryCu5CLjo7jHwUz8;cVVds=)ZVy9Ng7{$X`6&N{402m(AQ?NoA76_G1+ISNE zur`%mtcY2WhU6p)y3Sca9~D;%AHfP(I3Nnc=InucU#1z|Cs?7@Mf8I_>17?pEGqNx zZV8}C6qxMt(Q$$h6nF}U3n~aCnb zdi15xKoEgyC0L=lLGIYo5CxP4y8@Lyi$Jti6o4xr3XlV@SF(AizGCj9Wwc~!^f;4G zSCeb$fz{!0RfzDvg(qN7-<$;o0V}}&XigQBK?ew&lxX_OE3tx?L}7AV3UU(*L_ic^ zkBTct5m+ElT=d2YWCBr;H2uxlyAX4CS}i($!R92St#Ohlcr-&4gs!l+kZ(uOyE?Pk zjUUIw_{r#atP(PmABC&%w7`$~Y^_)IK!Z_zSj}Wb_FxC$L?D-b3_CzB?&ew%Sz_M9 zGr)_`jYt&61EK(+dO!TnCUgxI$$dyV2qYZsixp51 z-BD2ahq6`XqT1^*8}r~fd=tH49lfy{K5xZVVHp0m;5gbnH7*_Q)G8mw=};z}1Pf6> z4+lg6wVxc9hF!(FGzS)lF{?6=aOB2P*cg5k8Xa2`5QXUVMG%Fdvv$J0C%q0D=%O!A zD3T0OKs6u-Zn`rVe0zNz zz0SqF?z#rMxxTixrpnH@Bq9%>xf>cK!$^0G8en({=B%VI9-z>ZP<;3w=n6s<(5PTtA;1cy zZmuhAND-`n%&~(&R-`a8P)-H>0bKzl z?kF%m=z)P~w0XtCq)DE+>$e|CK9yMLEvWFNmDG3aKKQzC-gY$U_=)33GcwXhL(C~E zZ)6E+MGICPT(J7^+$CFbb90M}i=j5Aq@<)}r>7TL3(I}gRpw4T26pJ)7fA{V3ZNSn z6%|!gR1+(VF6cY%Fmwe7N_j;sluBrt$Rsl}J0*<-1)^{;AuD)+0Daza_wNk1e`^{* zJJS_t5J^jzxuXi>6umkf!#q5WIDG5|+9;0RR15#1u@zht5;4!FZcf2UnO;f19(gpQ zlxaRE1_{K#DFKX7?x0_3pB$TvY&WDdVit~Gk%IX+I<_2=HzuwEQxBqmA%_pi+}c8n z>(IIT!Q=`+|2YGjH(*j|)8fqg=Xg+!F|IeQLW3qk`eav*% zA3H_;IX~0nYUm)2861o~6qEgf=&Xou{_(o*Lpt5@D|jLZ$;qL~501)tC^`q56s!)N z?iql}i|I?Y#(ol$^*~JFfDev*7O$TW_A^ibs=*mMe`42}Ime;xUtFPl;olHL-Nr_ z`&9nBSaiTbH+E_J>4B2LbXiuQ+kps(e=*GHJDLG}<;EBxA;gGMQ=>?|BOc~`h^+9J z)=<A`$rGxvKMK|K~vHc$%q zV4!OBDG4z?^ap|q4@IJbRQ%(SgFr**qXiK0(KXG&gb+w1(v%PPGG@ZL(H>a=FjwZI z9Vd<*M!5?=n+bYcwQ3Eze((N0BoGG^(7t0Q($LuC4D2uD(u#T-3^(Qp4HQi}YC3)Y zfGKXp>$BF7?zwf{8ce^{%T^(5(TWwAeu>AEz!OP_pbfCK8)MPOv*#^`9rxu9#DDL@ z8M5YCvLX)Cw5YfOed_SInc|>x4bA7p5P6N?)j;H+a|HpVz{WNtl#d;MS7Et2Yir@e z^~X5lXesH=!&%yrjVH^TY~lL!ooUVw;|mVt@sTy4NnSQHHY;v#{%6aQAlt$D0vK$l zEZdG-^K03WQe#6a;PZLBKDKg8yjG&!nQP;Ar{%0w6pkf+g3Dh+Vsy=MLKx!Ab6s*v>e-Y@CVn;(Vaf5 z2p+f7r%6lZEl@S@&M!A1;gV%b5&Hb#moRb0jvXgU?wx!0V5fgFEfb-+dBvEc$5V(o zGP1FQRch-RF@z3}20=DC*301wNgPCWyaBQ!P7ARWFTAofDfy zgW(S~Ql0IReCSmsG^(XPjEHR5L3sun5$ZRX9Kn~T8(8gy6|#yO_q_N_pk_^mD6qLZ z*e77l<`b}m2@0hdEEZDUnFJb0L=q7My%Iljx8V&pWD!QBA|HQbm(5NN;Y$JBf=-~x zq}-@ML9H|`>U=p3BrbW0@m}H8))k8CnA3h1<2=phA`CJ)J)hG(1DC=PWV?j_nSz@6 z`whi+8g`SzAKKoGs2<1F))gQMA+!&)h7}$+bsKP*Oj>?O6xs{UFA5=Cb&$@|LVIXy zgyi5F0G&N>Z5N>Pv1S|Bwn0b^t_f(3|M&;9S((Sfii&8f($)yc!L@;kS6+47ZR9F1 z3#|)ZTWA%p{YRriBKqa?kQ{t{QUA@`O76e6=)QZ*-Fnc0SX(0`2iFD^Me=&RpMLtO zBpDAzv@Jq%aLoYg!nA4AjElC$dE@{~lAWrWd+W@XzJ6Zfj z79Y3h->;Bk;|5u$=X=`_=aU1bnnq=rMrV^5RbU#GYcfTeLb$R>8PX@rWP&l7!nuQN zaedKEQw(aoY!xoF>%P+qiF=7M;Kn&X}ue<{Li!Z)-?z!h4 zdE^l>u4QFqu;KIKi!YXzmiF!2H~Fc77{uFezkS1o4dIXkk^^Hn*REZ=Z{I#Rva+&f z&z}ABpZ^^0yYIfcM~@!g{qA?4e)?$$1cm^fqC{N&>Q}#l19DJXTWh!5SFc`;%k$}p znr@1rCpBhmPgfWV8<{JFF(AJH+znjbTwH$#<5hNgd z0OPv3kLcKxA^mv>t|IwzAnYcH_yGtX5d^?3XdpOf&YU@50$}07h2&$5_gSE;nkl+4 zY*dU+D%bQ?FfaKp8d_kr}#KomFK`-ioS=_edcr_*uqusIwqZabXzua^<62JDy8e?d5(9AGWz#^s<* zO?cOS!f|PGKyX@ZSmf+>=hw>ExN$fwHhY875toLmA_x8M{moy5+u?F@={`T4c8|;9 z^l$@*+b$-Ajn3Qa>sVdwSxtkvrO#K!G&WrNL=w0Pa)1mYqMj0NOk|@X=Yz*#XFGN< zo1NJm%WbehdZ(}4G$u|QlRn#lowKG$&5BjNO> zk#=&(KN6mOxvkAhNzcA??Ad>a_F!@go`bQtTuwVy{nO!Mo8qy5dFih&Yno!u$%Pll zM6);pa)8{hDa91=csv0K`|8O-eSQ6m88gt**3Y8zqM00cR5|VTZ>QXGd+ImtD7pP6 zhy;I1TT`=%Hb65uKo>KQ>xswyq$pC+ ztt1D4cnT_D0~F2g1BihU?$$#j5ORP9vDnSb?P6{(b4$+rBBOReaN8|xQyiNyoy=#S z*JoxUtymWjYDXpx7bvBL112^uKH&b!7|}o*+I_j?!0lYIVujD=E57yC@JQ?}J7B2ntCb?CbKA)Klc)N6RgcaDydlEtS%edva#g*4;0^b zf9bvVoskdDh;#20zVfg;Ee@yIxVSVllLIkF{UA4(z|^&msas!Dw|?PW2M9+C6W;a0 zOmHgf6tM8qHo?-+*x1-1EF6EuCgK_as(LkRduEz!HL$XzolH(kOKTwqr$N(AQT@WA z2AHA-nz|2!gWQ3WfFSpUnlRYi24E@D8GQtajLu9Z`i=yOHGD$mG8^J#uJxZ+4j9Jl z^$D9kn!oq=PruVK>gk{MecjZ3@b`Z6Pg9Qp>-QCRAo=KR>eeSLYEW2r5Z!++)SK!j_; zBtZSQ&{Jlul7qjFS@{0+CBGOF{kM0Q-1*2eKYwc6e?D9l)}`S|tY&-M|D-(e10K{z)h3v&Yaz{htpKrCu|@TITf{4~|L~{FA*`2hBEjAOt79 z7SSp>2r_(i@Lw8Z-@4&%Vfb1u=b zoaU1yujG?u`h9x=Lk@JQq@Zxzq|bfy9VGf$R{C(0Lcd*)g#05;^lSFAuB~6Sj;TJz ze;4YqgMWnqdp}k2l@tqqAqT4BjgF2PHTGRi zm)`y0^MvHoywX}#)=G*>8_Eip>cjwiwlr2{zKyY)_HN(qmSmCqGJ{rsugd6~v6|+h z@4(R~!yv34dS6naW?hgRVC|29hTnaNnEf=Bp%xGg42C132RXvJ_qiZq5PSgrfaHMs zSxh>rI{ghs%j>HK<69{~fE;){o~9adhqyXRtqm>siomF?QCy%@;t78c`u+m=pvQp2 z84cmz?G@4O@kgHguc`ZxhaMks{X>7j#t(YpPkImiS+CKiu7e;h!6SV>6D$YUBtTb! z53q_|qafjEy&UxTzZb9X`n!k!@cOrY_{{Hz{BQQ!r0vOdk3Rd(^<94R&*7hU?DqJs zEL-O;y?)x~&E_M0E)%RD7-gLsB+igxB8&j2C4SL9FZ>Au@kLtWlBP&-)~!RZo+!{% z3f}++R2%ZY@cb_YN=6##T^!I;pl=B`|G48R;l8kS0UCY;XrIP!a9B4i0W^yAY#EK^ zVD3+s5p>x!(&sZ=4upPiexN<{89R-Cq(31c!D_WyEEeoCTCYRWty7dmgMr)>4AcAX zz4JcDd+)sm&$U|*ikPiOKn~{4ohy8hKNY0Xy|>w4%$+f1I`y@tuUoVB%8CKY8WlrD zbI=!q^?KpPh0it7a9@xd@Ph$9#!wE#qlH`!_;7Nu2>3(^aXG&+_~6`fV0@~~t7{Xz zjdv>zH+&X;-KXFBHnUq0$dk41Rwo7mdlFf5H$Em?ua~VR`?QXYQ@`n5{|tTJOp&M% z#JccptDz^V>ej7WKmYu5?x*eCv2WbCaUXv?e!;x?Gp9^PC_F1GD|zUZLqha$kIg22 zI+y>Fm06+B3{sEE-j5s(?ndAR=m${)JKp_=$S#9TU4}&V92nlUFAe$Kz2WHC1A5{B zQ`cT}THK{KkKA&|&tlFm2dXN28-Ao%BVbf(xMDNSH+7sJcEbwOO^Z!8RBu>9-w|yE z6m0Ao?^3NMhy(r!iDj{-A{J7t53(S{Wk1OPR#L4U9k6&Kfc`mrS~eGY}kjZj%Ilx z@9uS7mq+jWzy5bU*mqxMUGwoivpEAFprSOrsfMUGeJR;)!ti7KB%4WcyvbM!t84h= zo8OsZidY&D} z_w;94WJHI-KGU!odZI3^S+mApb48Y1x=b81Z_&cfCeDz3^xN{~Km~p7RV2IuNF6h} zsb|p1T7%(cn&kW#HdW<<ta1Vfmm4A&OXvDlK#!vXnYI0%+Wi}oZ)!yGC*M7n zilE8N+EFDMKt5$$cjN6B4jPp#gbHa>>Fd`mK}!nFCZp^Y5OSa>+847I&6{WZxbxP{ zhj)ItYuM{=&Y3fB_C%};q}i-nx30LjP(-*gNFO~`^SOL7D1kVD$@H65qWOwzlF{iG zBnM*dHXp^NQ)Ea$lP8(eVxGyINk1Ur<^8SA`n0E7AFevX1KJJb8RH$y-}=d!@??`| zvWcnGl9u2Z$+i(#1@uOfrZ>$7O;fxi2#6sx$7&svU@exmU@!3Efa3T7^WihAA0SBLa zdP6v~b&ws=O<_74zB(_**)$Z0Xr0i(JH_Okev9GN92jra8i4`!ItIWkJY|)+6t-Y* z?c4E1!UxKO$NXbjI2s~2L$n;cDL3C{R1#9+FI~Vd2l|NeJyyI!Leh#F#meJ5lPd1~(U9Bj z?|C8H3y

ToXSB0=MO z0etXU^z@E*|0%pnuZZq_uy+XW@eqgh1<%1Cu<-bovlsUSjZ6>^N*DU87SYmA*mA zL=Pz^qyp8}xY{{V=I`B&PZ9!h|Z z)(Fs$!|8TAT~|^X(qhJtg!2M*CNb4Tjp2kRyFMX*m9+>a)6hUZ1fvP$Q2|a8C~NO~v@pIJE%CpIO3nOE@+KxLg;% z9h17GqT1_mRF>se6jx${otst66CPx?PFNb0)9(c8TJ_ZL&71v2*2xp=WB1M+vq*B* z@LwM%7;>Pp1@l(VnKOq+m)tJ;9nypQ61<8$bK2~sOP4~Cj3!P*ki7{YeSv(m$*frj^lPkZo9x-Y1fhF;R`ef`COGL+Gr# zPw01;+;kuaHBB6t!{TpI*e6}*oM5V*^eyr{4VZi$%Pl&#g_cgLOur+qdNs^!Me|Mj zbP`4enbSEN#IC-R+HkAvxWPzBR$x71)|w&WX}Qx8&<{xSpqm{Wr;Fs(z{%004s2PE zX2MM*AQkgpE#ckmnk0TUsI_u{TufaDi6=|j*hKY<=rSNFk$x85C@dK2dS*7!$&a!d z)m2H5gMbt|tDAA3dy2_2 z&vMYBs?9C~7wCgl$pO>&LVns1wuw2r91t{!!mX+;QtbVthTCQHk7_30ZJ*phnh*&I z@J{Vmy7_%l%rsimWr==mleer1@WAfTZT=UdL&FHg9--MHl!iN0%WcRLS_pQhU>#rM zI6ilR()w8ne^kxQ`M}4xwit|d%?GVPYx&?R%7G!Z33R$_C2m(7VZI3_IyjmVZk>oF z!^y|_?CA-Cp>0&{VcteMV20*MLIBCIMM{k~F@}yHZZIOA5oaj_a^Q42iLS0qP@}KD z9CYn_ZaE+r!|Y+&8rk~y@_A3N`eRu6u*mU7G}jwig*@h3$-EmGD>pnY0cJD3PGq}g zL7m$=Ik+s}#WBqJ_~4v4=k&c&XlQ5%Y!fc78CMytUKcK>9CYu033AXb5F`gep&&PW zh;pw9v@z4!V z@2~u4%9KwPl{s~f+hP9uU;m-Y_Fel93dv}{Xr&xrY_5PDKp}^XDxt@B?Afg-%wAiz zd*>e6Qx7d**@7kcsR?W1cG3e1SA3p*zU=6MOv$UWDeDu*Z>T7!XE8IkZa87=5riCQ znsRW@&YIeCmA)V0kv(o~B5d{sr|TRC8|?$_N)D(x&{ zczt-it`1N-uRzljha3o&g1`TuseKbb3!t*?Ne<}cK8^Jz;r7pt=475c+nBj708TC09iq% zzNbh0Rw3OoQ0d_?jcz|&MjZk~MXxMsQdxO5XRnYPw2={VfKfcOZ})+Hhx1Fy>D^XM zo!PlFQ{6LWEwVLMuUfHs$KHdR)~!2o=&+*62`7@b@7z{eP*RXxxO~lurOOvpR+KGW zwyL}&f9diiKJ7A|?$P4KSWQLg!4t>DDiD%`wlP8u(7({F+%8%gFu7rkyW#qPCgA@| z;O;=bpK$=L=%`$X9Pnsp01Ul1ATyPpgk1(uzQMhA4zw>hKz%gOx*}e5$5mS2dt2xS zTtPcC5OlV|2&B67Su3&%wt)-e1N1uCXxfRgcV_N-;xg$#kb|6@lt3lVg?7dVy4UNr zJG`hBL;-w|(dQv3vY&oBoq4R9E}>y3Po)!CC>}}HRh3p}S)~`weX?7Zv8`iXtS+ig zQ}p-8O^})7)996No3-BJk&dKi_$2!!i2`P@vmPD$`R5BDu7Sr9S|tZOGNe2;zrgEr zk_Mx*54S%!X?N$=&f4=pd;0Hhe8}1)YJOh&ougq1m8Cz20aPE6#hsL^(w|&RWu)MGIfatM)Pqx(I6R6 zC!t1Q{gz3K)M2}kiAqn4h(=umRHpf`l|hCYeQTH=bh{8eF?Q(;=(|WVV8}CNrG=~G z_IR-@sC;R-bm(mCltsdciKJ<6I*e1!@Giy~&`LhIGIGF+!i;O`mCCq<&Gh~j-G$5Z z`uK4c?+eG7Zfv%8T~M`U8@Bpa0f>@&#)8e_;NjAN3cNkpkOQis;^3R6R@4e;B_9A+ zMh=pblV$XhMqd;_$I`mMdmVy^cET18@-kq!MUZd=Ujm4az6L7?2Z>CA-E=AboCi&7 zInoM8E9C&Q)Prg$R3!j3HgC!YZ6yZj*`#))ABeS9lYHnbFemR} zEu-&`yqW}}Kbdm8zRt3G+2X{+dGJW3MFAkqLwPeYfg$tH_K6ino z(G0~RKfiG5r!ytRGHb^4!zn3}&$I2&zLhH%&RV#Hc^X$OTO1$v<)TFkP9z;iOlTDK zm9_I0Ekt=JnwolcAcE6ei?lHxek$qS8J|rTZ>qFf4(N@dqM{-+0d`SQ0WEWF1j+4a zG&jHmP+#wV#r?c!KXQQn&?Qf0gVpMDtEyxB(PNV0$?W?BCV6N*=1V@!YSo8T8S66E zerN^=k{K3it^r_4fpVbH`=%Hao!*m|BnTDlL70Rwrn72{giHqIDJqf+eL@g}(bRK5 zhdM%f2b373RhW$A@J6S%Mh>nFKrk0vm-ZtE7&ughPUlJe;%|Uphdx<`4RnJkC{H2RO0#{QG{H?-YOe9HDQ?s+3#>087M!S*&)O^mIIX0(H zk$uT0lECoL4={_xOeM)^nzDS6Za%aK6>Du!w6+I0#&89pHFD4*0&mUf?YaOU74i&D zjtTVXw9i3-m`BaJ=DcX79H68tAqVswP01%IitG`c2K@ka!~$^gX_`ZS*#zvKiTJOoIYcg$8B%Jr8fYGrpIDlym)EM zM>D-X=lprI#pt$14l*-xm#<#4YJEIZij_;3q@6fXQ&IlvzeeYmmJ+jFI3V;VQqsL% z?}^lm%*^bn@}d*R6FqKcT1u+Z>!IJy$jePSm04ETFlExTqQd;l)RRWa)6u@<0Q&RH z=}h;?UfZ(O8<`@f_q&hLBF-O3;R}J_faVT`2L;}66}@_%QMp)9=9qqd#oQ>RRqFz; z7H^1flX7A>dC*0GD$|sM?5~c|QBZ&+al;L6O$~gb;|xHG_OmXCf|}LT>pl-<^3dQY z=Z=1v&|3YVMdjMCuBT^pL7AiO?L-c)%J{Vv%w}_|bh$djU46W zdC9km02UcXr1r}cqlGm39ZxcFzjaeUuMvmO{?VK z%Ip`43JOzGPHM6fn?Q6cwu^MwNBu(GN8eBtCx)twy(JwWDsEZ!L6JPG8r-H3rC_&) zjbDqK0+0iQ(%B|9Ibt`V$*SU^!$-PDs?rA)P*3_S1}cv9bpMl|MQYgYtFq#e>8=B% zLm`@ROnEsF+=?dIZ72Ex-;X{c>k0zw0o@lgCuZf!rfRF=7>cIm? z-+6yLsxx!u0?A{YHFN6J&li34=@+vXFG|lUR5dp3^DoBFnlpLs3W>4tQ|GISx2mo_ zcI5&Z6_2g3DC>B7){&!oFJFVuisIs8)Yj|vq^0NheEi0AJCOtE2Y$Nbv!AaEeh<`9 z_z2LP!yl{~G2WP<q0BjW*yZ|_#o*7@j-EZPTacqz{jUB!-ONy#qfb!Ah-*}CB@g7N7lr$ zji$*e-GBz*g9v0pEkh(Eg+JZSmazO_!Xh#~00Hh6$JqS#G{4nJx$$x-f+&bm(~k@` z)lkR*dFkG?{2Z@J-!Fv^Y}%Fa3J4$JDQwD$-z!1{aVdfjnd14|81Mu{Rw5K`K*SM2 za4Vv5n&yLsidN8P0jL!`?%C0PJ7ea2iCy1_wFRJok@NSXt478f-$}=akKRw&2Q=uTpKxGzEkZ>EP}sw7?t5TN z!DFL$M|SITUDQDOW+oMNPM{nI{Z7l(l!LIS0erteops&{2Llv>LHc0XL8i;2*5;!v zF&pWK^u4ty2pthugK7_3m5a`rwKW-2{IyAO@ZXzFW9FbWM6>WO@Iel0@L%V0py``3 zT^OC{<;RiXs15XsY;VU`kk95?6!`weY>c3gg8%|@0ASn&35iPpZUN)^d=N1qH^1)v z?_c(Q{YVOZ_OZ!d*Pff1^ZbmQe$R}+Fn8|S7oGtbLMwjw*8T@a7yRk%y&byuHRRxY zpvQllHe_-&*9FKy0__)6=JCpIEZ9^nvEY$_^Ty*6pl?xOaBvArXPVoY3x$K#2Puft?|bA1Jp$80DDqfFY0nEHRF#3R+7tUAQB@CU{r4OkH%169aa zV~h3{q7=x1$Kx8YB!T#ULoq~cOk5c#XY^Jx=3(>}B-f)iB6E5kP9RuMtf{TnHD7vq zdP+*l@#Du66BEtm#_a6Ow2aik!hBpNB_(BN=ccD;=H+JRX6K;7Cr_Tt&d$!r$SB~b zsHix0>{wP-R#=z5Aoewzc2`zb*3{G>LS9~8YI+)m`N7dekNp1mPCfc}?9v~eD5$Ec zs<5yyH8u4|!ww+A6Ym}9bkBfJJ%acE{KB`~r$fjA9PL651dQ@dgI^#drb(6PbDd4z zf~l#GU7ZPm8M(Fq?on~{v7?cjYBATz7JR_;Pq*bG@xLa+qJrdsJIKj=iF znxCeC4-gdZ=K~}Wd;mE>5zq<|N48LiR?M>U;^<0q&X1!gVA}AgI>=LBR=RpK;$57#QE{?gOGzqNAC*n z*4vN+3TEcBzsk_QRie~sUWZrYbadwmBfAsXZW{@{aJQWx05Jq0K)F2jjp zM=VXm(hL27iij#Ax#A65qHTOXYlLw%9K zI<#BSyk3vnhPKg`Nb#WwC>oVP%>{%TIRkKah#Ckv*mF1|5Ck9}$ie-i3;XIHi~tj8%J5APFMU*OB?^6O!7%QOdX7oCnXQFT{?86;D#PUuJ7I-qI~GUL0xit9L}T14whDx*&NVQ4Pbx+ zHh_G9>%R9C#u9QMJOzXtJTRuH|BEp~4vYW+o&8|wUdX}Y@9xLC5Ud}3ytz)56(%=8 z{@(c4P^z9$9=%D?p5#EtCX+WEN=1KW)uNZQY9~D^?%}^b3$cJ4pz7d#*qG(0*qF5$ zxPTm>IgkT14SWDG5AXq!3qE*d{04+#T|g?xfvie4ndATx1~~w*E}-}0v#_sJhb>D) z60t6f-2|G^gdB|AjAezz#8siP!xkn`GSsK8Qdc}FC)1A}II?{4qN1|$;=Izu^Oo9N z&V4Cm9eWJvbXPxmKZo}^0S<1kRmKpYu_%{Dg@gA3tpc?C_ZYbENIE=`C=kcb2V76= zKA>4zO?&8#J+xoo`$j_!xLLhD4HF-rht;6<@RtMuE(fhUPekl1BL}Dz9PcmMfxgJ9 z0oN&&4(tOpFTIUGYbxXb9aqI~J_!9_^qO>}iC$L-H`WE%!F&My0Lj4z$PoGgLWO?d zqWcpn=4tk^N(j+4rkPl|6(2b&s~rK$3mmFbX>m^Ha*@5puZ`TUp-w9y~6338x}T%8X$ zGzn1jzo%?K=$>@&ftT}v*Fo!x4~q`u06|Olmq90p%_4G$S&;;v=ymyE`?2v@{w3Ns zD*DLHwU|aDv6E!lTT2Z-s53)PG*oeZE=4NgPsXG_6qA22sjySjpuM}l<7@2j%)l7 z-#LWUzl|ijUqjaiE52d@v^1{>ObAl?+{a83K zzlnjNg=s20yc&iYdIom&(A6Ma^dc00DM~_FUdcnu3=cY$QQfkp$UYx!U1_~w#GTZO z^gg{p^9n-a#deX&K3c4pL{%mP?-x*QPV8#0KBhIR?pV6yA&f+y$2xj#VS{>q0};?1 z2pUKTS%BAgVKhepVr}TKd@JEb1YQmJAc#u{*FWe-La4K-v53PXh&WU_uPrinL(q)~ zxT022&k^WB2kHq5G|=wk0Du%MS-BPhe&`S#G8R`gs=6JcSY40@p-)acic!=g=ymGs z8MCmP`eMds7+L_MzHG@-bY0x~4QS?uxHYOSIbA-l7vqbjvYmSlGToPwT}o;kM#^r6 zKa&~}c)Me361D!4T1k2l#WKpN#Rq3n3`QFKhDcwu8K~%*<@~5bsGI*dB)+ zw$)M(mCe>*MtrNep8BP>3TubWV#N%wHUvUn3L<#5|)9Uk50@KyVODuumY* zCZFaGK|I3eET*;l1>myE!QljK(#}*@^n+hM40o_kuz#?RF#gEAKk=XMF@g-02omK3 z2oJhHD}pE$?;CN6KBCB!6Zw-dd}ye6980~K9~bcW0mF3&EYDt*-pg(odR`;y-@@~9 z8I{@TS7@%X98iZjoXlyzvIZrdvrrc|Ej-VhaQ| z9y!4J5&=1&ANFp06Baedc#t9y?@>jxC{px46zy1w#w))#;R~sQl2qAt%+Wl0G_UugdbF+vC-v;o9?2P0Ix@+#dR(3GG4^ymD%S!3m8EYWye zq5UJo2qA>f2B60QG*(qtU;fJ96najEKj{FYNvy1zB_&-W#|R-t2qAy1h2^-?SYl{5jzi%dO+>o>()?8j?L~8d4F+vC-v^`W+4GRmKHf#StU3OrtWwqO-zcGQ%F~A7(Pa zgb+fT;DHAo2oDc8F4_U03&4(y=$!G?vt3N4TTP~Km`rz&9e$h1bUSy$hX4K-o)M9+ z3PjNXJKzZJ%!Y=BOVklGA7i(SJYX7?bz5}e@5k-><0pIXi`n`6aXWtZ{+3P1S#Ga?i~p5)1k?%lgL%7Oz`qA>0ciM{#eo0lwE!rK9U2}3BV z0fp_DC_3PIU@_^)+mdI__u3f+UGTl!A6Fd4x*B1GSa^L?z=bLbQAm$0qZC) z(*&Xks0Oe>4PaG}0wN&oB{KrO{U_ft;!yag%nrkoJB~QnVZ_N>-cIQpbG-AIjIc2| z9b?i=4-5?Mh06r=0@`C-gz%Nd<=Zt}5+cHrpY8>fgQSrDL*}{hYY4#p7Y9X}BK@IP z6QCGy0aOEQA7Wx+z&pbKQW*gXf~rfV?oXP!KW&N{Xo`B)6!o;J+n}&+gH1gL!eQz@ z$kb(ESX8gDs3%~XqWZKK)4ezB#MA=lPL2?+5kS!s`XB^i~p3qJlXUR!T z=EMn>oXCzRvD6bUU=rA|1a|TSR%Rg*?F3&7MhJ@< z6w!_BKRo}g>8{5+d~b;G2O~IKZOjNlA+%U5tg@KRna92em^p0jEVf{d(_H6--bkwi zV%ky$_x4#GL;v^2<4-=(`=ZdNPoH1^`q#!q2<;viFW8+rb?|sRX+s7$Ar0*bm&6Df zqYpd_MhL^iYrm!swhR&7`?O%Lqo<1OcC6NI$q3jbHn_ZQtDS9%V~zBC@w%@2d_IkS zu~sek!9&*UyZ|HE?bg&GeY_U?TSMOr+B;k@;^N{AR|xGAR;#tXzTUXtxbx0$LH1Gy z_rEGC>N#*$MxYO_$zF-M>FdZrAjN>c7gs^@$4>P+%~M_w3yR0ZUvi*IGFHkQ#@;E@Or&J{pnA;ckj-BZcr=y z{)2bWnJyje(jj!Xsdq<{r_u4&o3Haynt<)hqmMpXR8;iZYp;zTKmLw8?r^)^P(2`9 ze5cb4Ax3EDz~o=Ncronk>}-r6eD1vSyR;q*?%QJAuR6}IBj}nU>4o>)!#wWb7dbJN z%5S~J=cVt8^Up;o`(A#Ye@9t-Ec6;Ne8ZD9uup&yxDM}fJ6)`-r0Q3{s{G|Ig{k`G zBUQinW%aLr?y9ZjG0%f$jL=A*cousr^c7I@;KLOsPE=M_S5{V5RlqJ!dU~Lz(el>N zVS%&)kRAYvr62;c*$hc)XlTH;6aGddKSGSqZsFn>GGqwck|YT_0Io$wAQ8^F|NG42 zBGuO?FJ8EW=90$pZ@kfAv(wKZ@K2KOc=>tQ!kw0umY0|J@WT(o4fO%G_}NY<7l;5T z{P%F-6AbtVA{btm4`PCHWCt+*`n#>xH{S#!5G4h4lM6C&8#lG^ z37K|o?)vt(9QMYHLDwQ9xSf*Z6{{-!Jch;!Zn`NwH7zqcD>XH>u&{XhOMek5{`99m zVYZJNH44*S_+UYUyP~2ZF)^{Ru~D$YAO7%%_uhN&%{Sk?`|i8z>guotV!?zaOmpuF zyeM{FMpzdIMnK!^YwI?}#)~?E5$t(+Jmz`fayTtC>JCc__1=OIuz;BPenvf+7GJ?ibU1bSB{z=m9-%9%SH;;eo z+b}1-eP`0Q@5uY+w>&;)?m~9D^2x>r~!hj$`=4)bX_6AUb?2~L35`y-FbDS)4 zwLttz2?6>u8GcQ_7RdwgU*7q*zxw!(mihE+!%$UuZL!zq1;^r7{90&*s0qX^QF>*6pbd z-Jgo+(l4@W{|;TAjNp#|(6azh10s414C~U@)U_`zVT+j=(XBsh^0@*AC3fxGvBx0T z5k1KUDS#T12lheFu=-k7U&k8Etg+5->RD|qD=zx?Z+^qdikP`NC@5sw!Zg&9G1pVK zQ_nZhrKP@Qw2-;1#)?tk{Vz*&+mPcD8G&v+Z2miR1Wfh**MD!o&D|fnE$Y!5?)rZ> zeXln(gqt>9r4Ty8Hhf z%dXm;QhV2rpZ>|8p1-Br&rNqfX6iop^w$tB-t_2W>e2uDd!Id;XTPyW?~XkN5=V3& zkU997#N$ajpMQ>i`mh-;|1FOYI2s!pp{#nn^z+pL7_vzS4aDUIbo{iHE9jRk{b)l* z7}T-Hknpaw?04?j&(x()Sk$1f9{o*S21ed9n6z{(%M`6Yy&2iHw@6~@F{JZ7L&CfD z21gJD@WmXnm(S$3BZVk3Vcq+XN)iPw7)TmQ)WFQa&w>$lzxcdh1aX=O_$AVKYysdW zDNTYJ><-~l07k&xwFM&pOBOFIDzD~h?U_m8Y&WV~jMUc<=$RHhaIOx~^wbs0#VhW{D<*27|5;`*!ZV3UCk#f=No|@jXW5i@#=QOBN03EL@_jsRLRxNlVJ7|Lyv40e zoIVF}Qqz*FiqbWw-QsL;Ru`G=)}tp=SFT#aW%O&lrcoc#&$ZiZ4vTsBt^-V$3vx2+ z>gpt~uhHC4SXgL8^dp!NbY1;)#vIB(S4Mq2oj?EPjoTQ@H0R{WU+mv|VEUZ-pUs)? zGnbc_RNKuZ)kWEjja5FU&0Jr*ecPACU~ZcjLE8^ zDqi|6cwJIul3gV9DsagZ{M8b=ivT)6k$sq%aKly=Nr91M`mr;*SJkqEf*C>fIOF5v zwr=0HW82Ozx5QKDOH5UDS@F;>rfD*CHlHTpTEjTdl?HtRRjGTBe_!*O|}f z!`OjVWL09!hXNF@=PNWs=ug;CYi0B}`b6O;go^6nFVN`RSMxz!(OC?mz#j)t>A69A zY5;zsD=s4=L=AyL9^SPt&9@$dOx^lm2Z5bJL>D^Vrz6Jhq^_H~^@heC(e)|%>G7WZ zBDxNSGEXtPJrz!;eU!w1+}L*K2*IWWBlvd>#JKbY7{d|5me;Tgh} z1fRi|jS(Vy_BZwDb;I4g!n+Uo>0_^$zDp+s-+AEAk3T)?>DNXq*qk?P>bhSK7?qaS zP*BGnd-3g`KKaiMJ%9J^=WCDU+CUS(?f2S(4M+E-nAh&j?fE<*>*!99+Xax)53c?Uazm9_3E28Trr>2S~B zaCjne6ts*1q-b0YHR0^LhPDCvoVuNM)S~+XgMc9sV+l8Gp~sCG{$EMv87hIGy(On|B$$mlJ0^Srk3vN8o6ND#okJTZF1&_nD+#ptrxcfO z*UDD3KDk#c&b41%U~`WBhWLQ*xzFBt6;wdK^5ZxQpECr^9_h4KnvJ8Be-$_Vfq zF0^aE0thgID0(>46jD1(~`le2q@vm22L*wSppa1$B z|C>E==KJq|s7P`}c`3Hgk|co?aA~CeDgsiIGJ4D$lSxc(^c(kv3!*1UpLAeaJ-VXF zA7aUvyYWY|>myt=Bizf!2z;9Hl^>J2hcUgw=sBgq+zp#%BR4$Ma0pLvNsh26QVqhQ z_|b#li*9ZDY(iTxf;g?kj8;61?Qk^wRI_$gEGE@vQY{@6o5^c8O}Wvu$aMXJu(Wm`Ah60Vs$sMc`BMg|VHtCKt_ z{LtS`^0W@VNhbH?Flkz6^OQSTSsW+~ozRx`X&r)f1W2mcZ2tW7&u7h=70?=lSR+Wh zCWpWLeG^rdVPyP;TWmT=UDh;26EVNSP-QKBO!R^X=m>IIVLAO2wV3<50zr0-3uCO| zlaD_mt≻+u8UN*)h)Ls4gj~t?$TQCBNDOOiyp3-oWWDQfT1`FtL@ENGti4kU8 zXPRfaaUMv)bi+c^4fDgUTM*U>1TiP#x&;xPXLakMx*W#9Tr$7}n)7{Ty}{SmNwr3R zm>8!g1#YW}StE!bwqK`Aj_`gO<{Ka3ooez2 zJqK;rUlMWWA7A|6w9egn(_Mq8#}{qR3ctJm$SK=a?#%zifS69-`hQ=nON^Pay4%A~ zO!)x4ppz+TRQl)@iEilr!3tQ)}{Z_odth<{=La74&QeFpT7O@fY^OG+m2-% z$ZWili~vbHdT4KP8M;a43y)v&BwE?Q28wsI=7_|^0}H@tHX;SD^(DrNxVlYSTe<@T z#avMpNvB(7UZ45P?K3;wyu{Rbp{dgn)6JW{Z}Lv*Y@PBA=B>rv!YJaxK-!=Vxv<5M z7GQx!z*zv4)EF*1Kfqc++XC9lpb-k~XCNB7>cb8PZIbQYqM>R-nBX$X0X*WoPIfKQ zbRTD`^G`W(PQhJVpp=aOlyZh1uh+^(_ z6R$8lMK2f8i%q0L$& zXN08V$)_`dc+H#o4*&gK3n8Q1+sx@}xEbreZo%3cfk|k!{(z}AV`7N7d;pBm692JR z*D#RSW8ja>PJZbbAL*Ic(L2TDn%KcLHQc`Y9X`+(2Ab81Pi^?F+z2J56XvsKz20uS zmoY1^zi3ooR@1YX@G_bTZ`yY1H2GPb%hDBF9>q>N4ved&3zJ?FtkF{&Ny)6d zlx~lsl{~05XufNZ^78U#&n7x>x%{P5XKM6TIvf}#>=@uD21OJEwj&QXjh2c~{KtYR ze7<7v>1xK9x93NMZ&8&Ic-r7snrtQoIe{koX2cX^hmICZ?U@ zi$D`_NeZMc6JtsIMgkO{)3i-eE43}EowOe43$iW3-FUOc9F(3@*|`A)Wa=%qA9{NX z7d27CK)*G0;OS_tBQ%4E5P)%Quq}7;`!&!D_!S}Gb9(Zx5}DoWU5 z3Sw&MtkT9x6ecmL&-jx*`V@o6C;CBlk zw{6=tckbK;3l@k7q#&s3;)RO}^NY5`Z|>du$;I;*I2-NHKK;yusS{_-m_BX7w2wae zYH(zCY$67P zcO4KJ)i=DyQ`k6kxO+fH`gyp1;a!IC4FYW+!n+TmorQRup*x*Z^4&!9>3tFAB2E@b zUq$~`skV-R3FC9b@Gj?zZZlx{S9WK~6$*WtRaGS-pyNr+p=RI@+D;{SJU(3W5b&zeA^w{YgeJ24DgwQlHhSc;@bHA4 z+uj`d9@@*Lf`}VE;+hb~yydFh>LpP^w+TYm+?I!Zu21SqPD)(Zjd8hLjL>y}>8=6) zd3Wj2T+h%^Q*P|h`_6|4V-6>zHb!)Pa?_#w0WW+sX2SB}6Bhn=%oi#7p0IBZn7HIn z_#MA}HTsi*FAd$cr|{jW>wfg;tA~@#qo%EY;k9>v{P^qNxbIKBpC5Ltuzp)|<(>ET z{rCIJh*N^+_QjbCW(5BZmZga^d`uO^8o`v+y!nXGO!%myb>`Eg*dukLS0>icO+90@ zg268p5RGl>jlPKyAO-J~@QSJ3F#%e{YzYL57`j`rTpyUdp2jEW;NVQjp-s$KpUQOr zWz?$F=*1Z$mnR&`Bz?rFJf)#ZA_uqmfk2+JC6Y1kx$8sIk`z(3Z2En!1LH*x zV~3{NA~gq}Ew+ws%Tr<;jGhew7e?AC@Jz*!7}6|29yF{Plgz$}k-n*6$|RF>a%A?r zL6};`95@SjTFMp6pj_XR7|POtcK+7u8FL|w#+&{_Z$`!Fz(5tULYLy8g0vVu!9>js zp+TwGQuwSlk`lysB0lpEXhs9)s1Pp>Gq8Hv_g#nHvAS%~eIzgKGnOq|X2jqX*uHh!+SMB>E6cH`*uU@a_>U*Wt&3f>WN~Ur z=JZeJKJ(nOW5$fh$5$XKA;D^qhefFPYhrXP1WLtKAQU50gj~ej~ z#souUL@?Znt|^v@UA$9Go+;QhgweyNQazuY=VAn^51(ChUZ`wj){e5BKYCyfb2U7N zC4$}yRMptHc-3iB;^tzcK3FkKcPQr?~o^kES?OEjv90t@?Dvyz%2c zlIcj3-tbhczmOYE9@2v%R7WSqj-qE!);a1USWniq^1Txr#fQzc)_RLoa=Qu&OKTdc zJuWXQ+R)H|KJ@uKJVi4EF#;8{W$Wg-a~95>`$a)Pff0ktIyIKR)QHA=_|u;t8s3fc zt0Kl5kZ=Jiqjx1`1tz%9ze)hzr;U!8XA1Y!*36u~klO5rrc3UL5zJNm+FxI!-Z46W z{<<4}D7!w{yJfY{SOScYwqyi4wU*>ffBpBSzy5F2%Wua1^_noK>Kj{L7`pE7Z|->N zFNukX`(Ajim7;@X*fVEq%zgym=wY6$^MwF0wQBa?W})Uv37u(pjn_Mgt_XvV&_kLd8!G2 zS{182uZAEJxG{gIAV?9v{{*)WZpH03e-}9@W|QW)e(7A3>i8_UHb_qS(3=?q!AUEhugIo2&IGGypHO9qM)91gqNOat^Dz>^x1ze9ts9E zXim(->zKNp6l3&8(@bdzB&3O?dUTh=KJ6ZPqRBJaBv0(%oMcLRy#sTVip&MD;CVbA z*v9o)LFYJ3UL#qAx z<;dZKN6;;So>3HS`Qk-Ym8JP*HK#KIR0(JOPZZCmL^rAir9-@N#1FmBh11UwLO4J8 z!(c(e;U5mZ8}wf_jS)Cd%{D!=C|M&Fi%Bxy=yMHbT8hrxv>4OfVWvqQnm)cdmN~ca(>r}rI(jBW z_$EeprkH$_JG-Vv)@~XlN#3%m+FF~#+Gr8K?1-uK;oEP!Fz!^ZrlCCpu-NMolf9nW zUW$_{BikYru!F^<*&?*YyAz zL@4%-u7+3W%u=JBe+z)2#Cd)TMxX-=MRV2u*3md^=BJbM@^Yq3oBglXUVrL^S0!<9 zadw0l;VL7<2!^?6MxcoNpbl)T)!G|+srCq(g!~=^pJ3t4LXQKh4wLOulXs#?nndb= zG?5-U@J!~99!!LG(214q#xjbmj7dY8`ezz<2R4D?&*=!zJXvsJCi}L?4L51FNYn>2 zoTfVGEGRW(Tj}Ks3gVuqBxr~bl2Q`l45KZg z=4Y)x5MqR@j1VIj=Hhh(KMbLV0|a4b+CEo9AITMoWmYKO&>-y7Ouh+Z+!MpyQ%v=r zTwfFa7SrwYg)vIYH+^k}z{CTUU?*u+d}|#w_bZk#(1FYuffGSEe>E#yX^ga0{XfaG zmN6SPrCjl$wBpYd0~o=vu_v08k>a zRp%!N(B5_WT}=8o0tM33e*A%2o!;dY@hO^^cjAuVWrEQln&;S7sB}cnH;yW|#a9pU zk19pcs6rRn2bT!5*$hU&W&}GCs%HpS5DGt=Y)eKEBGj=*FM1fE#guE`hQ7ZLHQ-Vi zA%sgtLqh|04Uo>DTWB;Iq4BsvXzP0ogvjns`0wyvW2OZoU@^xsB~~h2!WQnpdAk5E zMUX%sf^Y}o2+ywxL{}IW7lHsIkn#dclRp0V<5AIX?bx}GZd+)QO0Ox{jM1 zTt0lvM^4E-cU9cT52k_EYYH*sEVfYQ#jHKuypYaIr(U+Ppnw5 zy>wo$DYEbDu#U-$Zjp*UVXE=aG!}Du_8z1vZlH=jQ2CilbA~)^*FaBK)mK-zBzhW@ zp16S*4USOb=(Y-RtjMHkqY=WzBE$&6=4|H(d|ek$F7rj6izL5NXo5qqzpCHjXltBT zMG}kv>Ldyd;YuUK2+d7%Mi8{1EM2?=BaZOkDC@%i8jXtw;N8hmo zraKc7j*cAjXld%uuw>5ik7j;$B=H3N1*HNZM!3odF+#9uv1`Cy;PW}l zKcD=ePjN8WOFW>mZF`Sy-+!>8wt;>}PiNCQcOV@>qmPvFyZrRS`{WRNT?jVc36op) zVsEU=5-wF8`wf*p@bBRp4tnxm^||SYf=B0SGreVqn3x-M06~v3D*VAA+Dl)9&`^0r z_E6ta%jn)W`cu64AS4F}F~U_wh!KKKi(Lb64jpkpYU#yW%tlR@`2iu;bJ7u@JJ{m zWDdj;HZ|wULX-=jhN8CcMBPwH;SaQ^TbnZiI-Y;H*?TPE(3@`#o3~&-bS?g7DpW1S zE^nW>r_+aDb|}=RFF5utr-^m~h>*;nC!PuDAMCW;y7v52&rE|3+lI9cF+#9ud9ui8 zra@d4+2>V#vgD=x0DXDfE$Q@eF@&b~eSl>hXUwH2(ypz$4<{xkCL}Yr^~nN+`J zcjA^EyWe_iEYeN=e8JAW`?l>md@3#f<0+rpEcT?t!;JY>uUWT!$DYcn`kgzD>6&@_ z_N`;zov~v18d+5;YRx6tC-?6?bo9{Pj8i9e>^+#6m|9z$Syfo_=BV*AX3S4Mbr5?Q zNn<%_X&+CXi`;hY+ppVd%B^1PJu-_+>Pw0~oHR8jFBcQ?%8NTEHp%C<#BbS@pLTrj zfunnm9G^dLU2$HP>as6fwr0zYJxiCZ;EZ6@t!)^A#)h)gWap59eMZELe&zKMG>!^= zO6tVH9ozRGm+6ZTm{+dP;_m%$_x108`3<{jF^-Pf15gcDdCbK5#w7Ds z9`fREdp+H|_mk5nj-yYWw3V6=VuWDRLPx-y+;{j`dUjrZ_Q~{|f}|q{F((%;n)}g5 zADSENh=EOhdcXTvb|RN&$QVz@4c$8@n`b1lqyKb4TMT;Gfxe!M0WgBZ4NdX30l7qS z3Km)MC`L@~;`cj^+n~*-I(dmqgk>PuePw_Wsq&1gOyW&$f>Cq71vJ&a%@~1>Z}iXK zA8C=aJ-cFi_v+vG$zB6r{4Z$?2$pr9?4I&obdAj`J{lp6|4%yrM%Gz2cFH2-(txq8 z(KTQH!7nt`xeXCwgkW=;jsTEN!bxrO`}o~%*~wB4utqcOAT9zTTgt6%;Lqujx5I5( zr3=ceO&Ebv(tmoQY)Jn;5?t7B^Pncs&+{@>^9_6TFK(IkXoi1#0DtGqR(9&~{)2i4 zp;zy|eR}on(|2IsC;$9dpZ-{a=zQ7`%QixY5rWMb&JmclY}vAkioEgTCsx$e)S7Kh zYsJ>BThj8&5Jh8Z26hcO$B8A36ox1VY$0mcJi{HhzK{|~x^aX?5D^3dZX>=Q-) zL#C@L%Y7a%CLG+@)TQ))fMq2!&EoKC83jciyLsvtb80FJAl7l4*H@Pnd7brh7A$tv zlr3GkX6x3it2b=gf8a=R@+s^cQc`jpb>+qRd6lJEo7Sx>Ey^t{HSal)R8d*7bLZ{@ z2?ye0x44|v^&8@K=FQD3TC;lj#*G^{Z9lkc=fR@lT;_2pQseCTvp$?Wuc5(Gl%G{w zQL^*U!R_(89lnPAtn{kN2CpW)^2%EiCr#VC??82J)%?ZlHQ8QUU3W4esk$<^qP%9- zyd_q1skx@Os4#!iy4doX#?;J=oT8#2mbfIKCzI0iw(r{Sa@wmZ>le>k^2Vr7cJJNM zP*a(fosyHDvVQ#*@xe8Lwmn%CnGol31Uv(1tAg4bLA5%Ks{A2DV{J}kAw~!`r|lZ3 z$FbpWXsE}v%i*l5sLsmEm3$tt1WU4-+5aAvd5Fdj%b`fbxr98uWmsEH+lGrLxI4iM z#l5&&p=c=%#ogWA-QBggySo%G?(XgmJJ0*=y?^9Sj$~zKGHceY=M`emGLoP|TWgN5 zZOApiBk}Eh@FCgawV~o)rN`gk&p%IhAwQq3pr(3l@lggi*Ghc9!`hxh*Sg|?WbuVR z1~V|OpZ;Lmm0mT2WHE{JO*gQG1%ypCC0dHf1m@x4b9p(!7pZ?N?S2>F=`X%NVRe%K z{~t5!8wHTDLBaC!bGCWK)se2hlD=FR-p@;nF~LY67(n?1kx_ZpoB5z<*+~Eois_>3 zIpSVt`7I|n?xLE7;gF-l~p6UmD#-Ho{Gj9%%B6G*aQkY!SXn+3v z_qWWvd_u*=YyYNbOl9~|1>2pErRYI#1B|5?t;WANa2$+)lXq7A2z(#+F)T?82fz=?O%%P>`^eI$bf3R zD>X;Pn^hlBP5Zc0xvL)Wj)4_s3+1UFk}$h3nA%d>=h+V~Um*yUpAv=#!qZcL#4<2k zx<@vpM1Z@N9se&V2mz8Gc}E>J<`79Ra7N=lbF)DgX50T=&fhdX zzIWHK=VY-PaHzL>1k6;mpbO{2&}{QAs4f;u$qZ7b=BwLr=BA8t11*IA>%gRrPo~%A zHv5|yb)5lj*vE|il5_cE#tKgO6-BeC%0p{^kUBnkO1tGi%oyDvy&T~OYu!K2ip}^` z$LT+`77OQEjmAZmRSgUCR^jW%vmIl}OgFUd%1)Jo#*K?uEbGm-^Fw!Y6ok!ZIqka7 ziA)EpStz3_!<4+vxVT{72__?%$G@u0NZv|3YW=*ltjsSlt+ELWQv{3Kw_qb%geT8b zQ;+c+rEK_qNR{U-jo+fxncd3Z%DU{fp3C8?xNjS#Yvgd&h zc$Y@5FLC0FcAWQ=+)qKac%ZRUG+^8KRSGr)<5T0dlnLXTcU<>u3$ncRS5|RSpO7YriXn0njw6~Zz%E-s@p}2$XQaJFE1xh=T_%;IFY`CW&7Oz!oF@aoYP|b1J-AE{JwEy`AR6Rgi z_>gaUJAbqo`N2?Io6q+}3xOz_) zyWb!CT{gMnJWpn)jG0oKmni7c%k99bY+!hz_HXTa-I+I0K#c5*CAeh=)L$^n_@OT? z?H=FRu~#oo{iDv}z(k4v_s49-B45cVdz1i%9qX6nwWZvz;l+PnA4rNHT}*jq9%&$z z^D++iZosuTM|j%tf5uY>*&N>=yD2y=)eaMi_9#~Qi95MYL)R&+G`is|Yt6mZ_R<`F z&eqMcMwFFX(3P7Xox^50tS-2w(U{ScUIf!NkELfObLgGi$(u09{P=NO()DtZo_})! z_ha{ZFA$qfb#Z>)tZvoBOe|Yq=o`alMLw6y>=1`_jMZ%PI^gl_s?>5eU0EEKMzfm_ ztC>ZG|9qnK0m+fRO)S1+badEA{o$GKcQxU+%hiMbxfnyhvId9Yrge`8tJPYssf+Vi zt+vW7hf{)7zuzTElwsKn_cIj5S7L$`(Nw(H)x#7s*BC&*(mMHvf8oQFF(Cq7Vw~Z> zz@V%z)K0iwwz3P@@&?+Sg~x~Q$9opAJCKy2AdL`X;irWedJo_~v&Kc1(|*`sA-9P(`=DyjUXrXjpb z?jc0}HBOMWIPupnk;*Y9`dH8G@V_TF;X4+g?QS7TqRcQY1Jl#DGX(r>IavwR#QWy| zGoo52(cg%LAwTYse~Tb;5DTHThxt;IrY>z6Y>%GnLUBb^cJr7nyg4*r`4j5G5cqGQ z1V%7Islx`B7&Yl@9>$Okg$@f6iV4&Nu?SsfR0XcO4)x{;Zl5hT+2D0zt%>-7&lr?#7g(RZ99Su2R zj;~LT#8-&VEnuHuth5#aNlOq22(<++VkJ#{xOzi>5$Y3?c>=oh0DzM^z8LJ)VOO|l zc~HT)k7AxePXJPXsGcu7q*D-EZZD(cJ6jmCzy^^(1WnQ{3RbM_P$r_pTyCfja?v=k zCxGQPu*FZe+4l;54q=N12}TFOr3ZykkxPtf2LtHbTtdvK`2>-_ZRHyqjb{1p<}_Z8 zh+0DEhojSWe(M;{M9#-?q*=XjSQbQ}Oh*hQoNqM7+vUF=rO;ekieCeMnyyf`3XC6N zw82VR$tRCit&Js&=TC>gWiS%02x??vR!IsYK$$MD%4* z>5spH(xxH98OsT>GD1mj{?ub1#NE-eDPsr)heGf|xPCh)a8qD+~yQiD41J5;D<_d1rtcPg+3aUN=_FD2bU$uLgd$raXnbHlpMk3 zYbs#57yKiR%oAc8ZonuP7)Kc2S=#BdBW3bkTT5c z;&B6(n&Mr5=Q@#Yy_IXH{J+RjU@?RK?3Om95DJvO-!q@FK^5{oCy804m!l9;x&Khhq`QumFmQcniP@gATHKlHM2geT zw!Y|}fJqJPp4v3-(BcCot;3V668JlUl&RfSA>##{drT|#GFZ}jZ&VCr#GS1eY4EjF zq@vo*wDj%{l`V_5JZO1o(YloLzhE%~f3IGbO~{dJ=9X4eqnY+k9SyVlybb+FIN;}^ zx&*L@$3(5G>ODA}u+%8Ubb)1Yfe`_VsuKBrDuO602Kul&Jvvbs( zYuMer;ug;#Gb~51KV0DO{0Q(m_m;N#A{ImbN{2GLIFOSESO-^6mfGcK7Y26JR$)yf z92MN>_nTff99y0pXf%M(?)^+4u8_b}7ca6Iy$T{gfU<S52~ zketSmxqewwL9evJ87FB4QTjxDh8){c3nAAC4-07rbrXsL%U0>_sr~iG-*ZqKCP)jH zv$}FEgi|ue|ME2wXgR;-W!BAyxcAf+2$G->QD#ntDfWsoJ&cw^`)l_e)fraa8aFau%v-?cLdnW zY`2~QyO=uWYlnMAvfp`KE?u;z$ovo*O9&x}(?52%0k9N&?8SRA2F{CfKT^Wb<>-II zNNi<^se7;Elaa+;5`+TS4-)>#XYqNn(|Er+15IU>oeT^L)~%~6D!_d%PEJlW+s<4> z#`X9p<@3@xcNOIUGAT((VG5LBiEd>9K|4U#P zukj^DOHMn@Y0kJZCDWaoguNYgr>F<$_j7p1u?4wEW3}9Xe(+I$Bx+ zf)hz=dIq-kEp-hQ7JX4=*?`KXCa|yu1s>$7i<8wv;{C8>6`dF|9k>a>q%~w}T~kvt zilD3U=%`l2MBU9u+v+~GrB3QclM=GU>Bh2Fnugluh$f5q4{f)s#=pA z6a>loPuD@258|Pt@VMETf>Im>A;Q1*#{bag46&oS&a?!IE|L2vGQwIEq6n$BY%zi~gi6d(ArBzyyl=$qwk4Fa9nFE<$0m5k4ID92&S-^YYb|5`z|_ zf~ba2hF^fLzQl;U5|Ww8+1Sw3I6s*#&>7BtuXQmU0)9SilS6~!{m>b_?UA(#v;u9HH61O}u#Ij;S!knKVakG{g^rOx zkm%nfM;wteC>&vMI^UkUWY~-**^hvT%|z7Hj)5(#)5v@?2+UA4Ald){eorNiYKHm} zElJ-BHe)*rY&mIMh__=i(Me!%itm}*XJ?Fo3(-$(CRbz##DMfHxj(vSwzaG0Ll;QG zPrUm7ekSfK=fvhYztUJ<*^-JW91Pgj^5X7dx2_)Hb>k` z#*d`fq${uh%bxukQb0!kM?jtjI0LkJb#$aXm=p~L^~#yRtYpM#X4F(3m{eO+fooe> znhquZv%U}|dg6WW4V2z+GM2N`lOi~%85kG@1-olnz8<^UyO|A+?%nzO`!^^_H7XZz zFQ-XSE9C(@y1!9>X)Y|QcrtbGy<#Ga{$qlTi!GzmYA}~_aFz*Wm~ElgpIp3mfNf}G zq{r`La-Fxgx3?1?o|;4xnw*i95}(ZDY;asLuc@f=+xiWl=wc%D8uDUSzhBV=4mBiZ6_zUvE9&Dn_(eeRA^*!;MqpwHn2m<$m(5EQP%b_ zub6;4c&>xxVrzFcBW@S6z4fr&YUhDF08*>boAO_xAny~o5cFEE(hixmX*vB|cLh_5 zT;A6wv`M@kZ;`?MPCWMX-29ytW$B|R2M)$2CX;G4;0uo**PO3k7xgRZ7^wCT=vVpP zKj}a-Fv_UZO0q`v%=*!kox)K>j<)+alHuiD-p+^|{_&D*{%C;Z)y%tE zxC_}_!_^HG?5?lQpBx+Gzpa8C;P(r9HpH}Hc z35=qomd@(mDGS=sD5}Yeh!>ZH2SI|xxjd{S%#%=AnB`_HzDtrmZ;iD~qt{4F4llww z2KI169Rtg6nR7?HcZRTPBJuQ&fYq{FJWv)ql0s}lmR0ulAV@113Lpp)+c%nY65YHb zINDdu&jE(rNvZg>lF8Y@ON6AA9-apZo+UxjieBq(AD$NO@5oR*59gOJveaF{Cf`l0 z`#Hl_Sj#1Npz4J7vS2s1BQR+4NJ=oANpi+DcAeOX)|_k?!i&aFYq*M}5(IMi^t9aN zB+T?y03@;u6HIS=3GfaF6P2{|@mQN{ON9laU$QRoBhA93{PAyw5|{d0Cn=tz4W6x+ zY)M8Md+jI}z1ekmGED?yFV}J`xD%}e)5A)|ph+7rOr1N(1AVhapnI(#tKMg-Ah+Yz z0YHhCi|k%qm@0z!SeT#ifOqf6s!uK|jvgTNF!kN@*a!rLkfcyf=sT39^uGp|+%A83 z7)ya?+cn-xnTENAkGopU+B!Otw&;B-|BCxd?r>O?9QyIqkdoC_(-XOqDa7GW9hCf5G_ z$HD&L%e-cy2sCZPZf9-d?`a&wDU15`C^}iqyRKCe`c{@DJ|-4cS=v^nrnc_;+qLtJ z#-=R`Jne|>aP<@L^X#kR5*4E^E7}J`!H+4RtftN$tq^xn&kmIAhEAP~&TBOR z^XR&bO}#3Y8XgBPFH!Bgmpb!|z;O%nQ%UQJDwmcCr~9-dIT?)#ssp$&lZ;u@_*t4@ zryot!?i&ITmFQ_5t$Ry;XA)vU4+Y<_Pfe*8sfNPi z;d03UEv>}c1C=w2z6oaVk*)6tDv#pM1CqzT)&h;EkK31guxi_nWdP{o?qOrpd0D{& zC8j#R`C)i$CQAr>=#L*qZe2=~L0Yai*C~*;EC1Upda-93A(tdxCsn7Eq?+o|i$kEjcQxcqSl||J z9z`zI4w0W~*8gr;N0@Pzr-CRJZxCd;n2==2Lqo@+FK~xQ4=lUMPBPtq?HDa2g2Zq@ ze+V>LL^nqdAK{goMXymUXITumZLv0bf}FNBl1jnC=MWbNKl9k?Zuj9TzT22_tMOr{ zzyAJn+iBgjx1;MdL11iZq2kipbn|@}gIHxf>U*@4=9;wQ=~>rN{;NLgB`C}3vS$2! zxiPEz`f#LV>ec!-2wl}^|ruP+x*&AX{-bcTg<;SRTAJ<>O zKTH=V+^*y8?`X6+A$2VQ6KcL5#@F7>lD2O)3*Ma)6m z&NeiV57U0EjNB2X7YOzVm45CcEubG|vrYL~GKw2e(RVkFU5-Q%J-z?l>n~7PhuF3T z$4A)H*v<%$MpjYJdy{qlHto3JS{9VTgFLiTuqL#^{nH%}VUuwidN}s)jWTxz^g{vy*R$I)~^`~`e zns4_g1Q8oWi+9eWw;K1@;@s1jaW-Y>Y%>Spo+kLJqi)(c_pl8@(4I(Ofzr{dgc zW&MBvC#U~z=w&=I=Al&F-;t>NV!<;BX2AwerWo8b-*A}Qn8*xhc7Fo>wx^1OMzB!( z=Mrmw384?!&WQO7xZqfvo1%ZjmJck zup(6Eqz69Lpd-lV^mSbAd59_Ba(4>6kow7WyTw!-U%;~}f;s4EBRKUbm&S@pOyPO{ zsi-WZv5w!wQ5TtWrbO#u?*Km&IQ)I3rqT{7pOa6JTr?@v-p|8##8CAtnae+~ z<3|lpH``A`d^{Qj>kx#XG87F;QO))X|K?&!Y3HYvC}l;J5Pe;-y?!CZp4XJ5pd>er z%s%4LSee0!M78>$Dc;0Ep%k%eh|9Yc70i$EbW{)ukX!)>{p+EK5TU_#5oLB|)|VO) zJID+QOvF?UhEt;S8`Ol;j3s?6gZ$bE$hEbVgGa+^ z2YU>QP4qake;sNeVEdeyYe-UW#y%AR4qfomh*yH+|X2+rX z`{A^vHk|7QE9qTEw~v}!lq~hFH?6YpmS>Jvv4o5ZsCy(HC9+C5D$lH&sW%;;Ce#%4 zGLACVBXH6+#u1x5u#O0%GniGVqoxh+ zy`0UC)@nL~?Q?~VX#6y=cIL}k=*Lv|XMX_@JxRyyUR~}sRej-5#}kq*+2n%YWhLY5 z$RAp8UUODZ2dbIM?Hhw;oBgb@Aqqx@fYDCe9uXGwyY9ceQe>16&0ryOhm`8v=4{hm z`-=4LHNSZj@*{AJ(S!*BYI!~ht6B{+#@qmkZK8|Jn->P_wzaCl_3yZm*6ekq2A9du zS>v2k8{hRhDk5TeX&nIq!Qu6dleTm8t060n+ZbPObsDh_LpN6{$@nX9H7 zV7`#<7O)W}|N0em&<~BD7u6xX^NH^_iQc%~Z1wa-TT#w%^19qAG#IN;Xh#IAbSvC< zBS_Z92Qt0Q*djmwA9PiUKloXRuOFD-Rybh5``cS0^m|Y2-VDa~mAY-wSN~#Qp(mVn z_6#X}3PL|=zb|winq(aOK{gQM12SNG3js!&J)Tg2@`92LVPduT=hx5$t8AFhJYoNg zujDcEPzciv7;g5xn59=bSkkSE=8OqTy0?_JPfDU0k5|@tf$1j!)FME3tLBW;u&M?>CO|yp2G&38xLq3`)aZPc&D#)7<0M$0OqVU>3{f_dkSg9OZqUpk}^KbmIB|2&-X{Oaj{`<9N!!rlj-2kGtL$kCL< z$K}}PTSTh}kH3!O7NQv#Kc)+=PK6BD`41GfO&9P(9|po>@bZ0o9{iffj_I%D~?O!-Ab$`F~K;C{n@nohoZ<4i( zPJw6Dw+MGvl{fy=tbVJQllNUBc|X#|d-l}gxt2yZ-+EN)<{{LI(0&sAao__qId)>8?^na`R@Wk^E(rYAp=CFJsa^6m9N-ba$C*`e?@g?2_ zNT$W}w5W6ZnsbhPH@N#0MQ_a?u?o}fJy-{zkTpMp!@(Wf0fWBO4xDEV#@GRER`IaMzQd5aP(M%4Ct^$ zfGH>yZNcU1qB8iweGh~=HZ9yW6_smL9^X3q3 zay=~v93ks_2IFTDfhvP)OC^~#NA$Btma`*{m}(Hw==jBo&jY{$L>av-E?g}P5DX`2 zAX*jqByG4}vEJtA??9S(oltnD0RbXmyP) z#d+oG4R-)-nu^@KY1LF(9S3U5+V2WE5Du5%%5qysJrswi9u~?;)H9A!7ZJvjc~J;b0ht*f46_wf zL?m&b|67OBQDx#7A_LYgV7{2m-RXxiEr&!1a0c?c2h3D*9tOD-78Q9tZHENFA;0vZ zdP5L?c)i?}R#XHQ_-q>`G_~Mg_Z9SvMd-VVve6y0(E?-s z!19rAT#R6#mG|Si%WY^NxacOsy6yPm^-?ku+%XIW9#w-Wfod9YghyKwua}6o)ou_8g5;S2R%EjCC``3RrGCY79W)i6#uz5QnXQJGb$H=H0R<0T2<#0KO@xs{S!cpE|@$`5sCd zF<56dOQjW#g0M{hJ76}I&5uUb!ctfB30CFq=>jVidpw+lwIaxmGseP-p;*A-Ai4gO zPJoAJnL^(N{}CX@5LA+Ab-%FxNLLX^BpzqAnACE7S3S_76rO=tUUxH+soVK2V2N=m zN=ni@6Tw$}MsAQNlMrA8;o)E+qn|u-)RPBfXlVE!CbDE3%nl15>;8Pd+$zP@@kF=A zy8cU7{kBIfs9t9n287K9OM|mlx?FDP*O6+@F;i3jX=uPoQRA(>q1etBkFX8%UaB)1 zJ6o=2SrtxC%!amuU>5QA_Wt=3V@-d|moy#yzdao2%uI{B0{Iz4jocLTw$BQyAu6X^ z@7t%~!Gg--fxcfqCD3o0mk-{5sV7JKdwYg~JXvxT+qSvYEXKCKl$HG?v)xZh!7H0L z1V+(|jm=<8_XfgaPKSjiWMv^|Xw3c)ruBc(RD*{2KsCVd$mD3*Pz7DGayHSQAL>ckLATRvXUOb7@Gpxgj!`80PV zR&jnKFqU!7DzucBNIq`;-3(@Cs%>MIiM}j_rc9ofb={+X>D)PGY#+G2;x~JYv~&(Y zqYN3VD$LXm3%O5_qURpT^vxQHkKa##FB{WqZatR^nbl+a*#ynb&aPIeLO5KM4RUqD zS?J86DI2V&jL2~!##`w05o`9g?I$}cH)vCo)$J=tf1btDC#{AfMU$gl9{kb|mr*!C z%(~c=muGowuw+fhz=vl9$+czR;uC)r-mN95W<|E1bPrh5gaeC9y#fJ4Wr?VU)cDHH8ql*n@MWLUC+6>xi z_9G~<-!K{!Y~K=%S>JCtl$z#coRgMzjORICGv5EwO+9gOo<-*DDQ9USFy=rIRfygx ze`&^EKdsWz2ldGR50VP7wz6vaG*a z*8^)U*C?m{?$;oT$-K>LRrRcJ)R2>S?9Du!=a@cPT@PSx3RDJN!V<^CVB^;OMPR|3 z#Qbk2I?O{N!!6(BIn1ubEOS#!2ywh~=#K8Wh^ivXtMrJOZl6cpyy&+KelKoxzcU;; zXRuH>Zr!)(aa~~-+d!jABnRCR`uTESi^X{R#3o_+qfC~E6obbe$i4tPaoL+$e?E4- z<{4@Z{9}=bxTR&y#J|O6avJPMCj|H1$w+yHLlB1~Q-n9{Ql3S2Em?2iV;F?QzawN81*Uja&Qo#=Z0TeW%b-*B9y6ye||4E_5+-ma7Or))&1GbEsC= z*B|ZC-Vwq zpFq8&kw~2O0^Wp0;($ZJ=`gPROAJiR86E#wCQ2R%O72*nK@Q34cB=a}iv%D0DBDui zkJKb=`}CeGXbH`it`n8+b^APlB z^-KC0q2DA9_|NdpXU3ZDodlzaUqsx@@D(&PPH1UL)tl+h{Dq;gdu15WPy&2M)O-P= z2tv7KWqD{b%KtaI4L=Q41qEMXG1c(NHi%>2T7vf5X|KnAp|4C#pQ|LF2+*m8CHZ|z zwW6WeXRuRGEHcSxjK0_5Pgh$dW_J|HSGOe%nZX5W8ob2Rh=Qs@>eD1tAhE6MmGj9v z3-3NCG8}|D-Bdo|w4go!vD?V00DmdslTmYd*~)L%L2S!CpnZWvJRwVF6n@)oj1Q8# zE-u=@&wQVAf*4L9kC5~~F?}MPeLlbLY|++}AhnA(#~Ham0JLvXqA$u(W6~|$pJM38 zyw?v2{R%>S$=R=9h`xAZhnvIK5+Nf6ECxO=Rwf2 ztE|pDGoTDgB%lBU3@A{gI#+SW$slo{NV7w*^8Kd_~wh1XD=|ujPGS5@OGT5OKS}M!SyJ zJ@!(b$KyqH_Xkg6ksmaG+&+ewUl+SS_9K1w`7lS2~4Q01oNz4ENnXNUz#0kJ}#r&$&z`e zvc~rHV1p{kb~@abpBs)KBp}3;m7cWJ)pyk!X({-@6&w^C9G&`0qSoxhwX;}S0kBlj2GYQT zz$$azCM%!wB-P9J^-HOZN!5^m9f--P%W6yB3Bq>+! zjzXLHS8eCm(R&tEoJh!bR75dC;xj!d#aj{!N<)-lT-W4Y)L125`%H^VJTd!%0=|M0lO&HJ z5cphI)U}nbc1dvG?oe9ZR(+CPR^<^dTRNZq2(Er^iT2t;*K=Kbt$;%m6zZ{eoQ2p* z=yeN7umA*CO~+-x2je(V{%8}vi9w8%!W?Eza(d=nd{&78TKEk}st+BMY4Fi9jv*QwqX z9@!oq9OfzcPG>Z~=LT6{i2xE>VSVHO)*=kwhLN&5<`({!X}A05qNWQB}pV`Y^KL6Jj|smC08-;>A>z>7Q8 zwHVZ<+~ae!tK?aCpRh?=olr&O?j7W+1=fN|c*(msL^esyMK6UVK|w;S1|pMLn2-4s((`rD zd{G)M)~^Yhtkr~-!b}G9R^;|@uh-a%ZPudPDsk5*4A zbHw7TI}binSNk&=Uw$fc@Xa??wZ+f>dbD_4N@waeoTN3bu5g&QH@PHIURxgJ2ED0G zXmL30s9k9BrX*-NaddW#+c`V-kg(hH_+~c0%D%dEr`GM)k7^1MHIFXjcUCGNIy3oT zZ8mugt4gw4-OBV?$^ZVm{X^J%VQ#TeBy}2Hzli%*q{*bAWjbH0c#0DH?`dI*y$jnP z0lOfh(#hj`IX>8qfmdsx*h}PA(sF`#a#aO^(br$daqIfr^ExdNU+G~otJ7vOvt(7! zX0ocaei2-s<@Pey>2L_dCG54|ToGSQSUX#8Hy-anulmit?L1Wuwld+IZx8nPmuX%E zgac+E=ltkwE^Upd-(Ws*b_DuV_(^Y7#Yn&?uElx#lUL0 zSh2tRS|@VNKvKIdlk>fx5t`&^i>7#*BC)N+KtY{L63xcy#Z%zP0@oBqMtq@6|G^O35|XJQFocl4l6S+~DG-Hx&UE^M;w2M5`mNyu4V%lZB!~?_RfPG^uS#kQ$`QuP z<&;b9{FA{pTw?5ap>#V6HWj)lBO7fD2EH=8A>8T20;t)-bFELa;ALyvoqG_R6m()AgYZtaMsV{Fk%YGGo4mkcC(0i5J||% zSg7#5=W=qge687}KR8Nr>?Rt-onBlj6BiIpkj`g8Cay}UtePkUEMR(Q&l7M8Mpjvo%{ z!`%#Tm&BDZOCgMEpcOPXNF&p_yIZsPrxLRv_V%rK14j#=NJy;l;KKWAd4>%{gdAq{X7zO=$_k#cd} z{&qQs>_#48%Dd-y{?=a%{lPnVe+0o$_qmnLpy?u)%7-|MKhpg9n)6++TT|tcXe5)< zp$@MU6Atw+pX1hU@9x34&etRuq8f8i+FQbLkTC`y0b&Wg?zH5zQ4p--kwL>7xmk^$x`Lj7 z_@T~~0(ZvTKj8)``tzPb=&xy`ysC`q^~#F5o4VlB7&X6B_jZ{$uSiik>6T*XMtfJ>aS zudX0)#Q(FkN3V-5v}{Hc61G68;L_e4WByl)E5#M#^z=t)|F3|GZw>xPtKrm94+GqJ z0WIG^rfInxl~Df>5i8qPR`}2tU!*h$OxLrW>23!3hye>8s%+rH<0%~hCMG)nO_hJHD1c4- zIl|b(^W$DbPQw?G$hgzB9DQQmO2Cez_~M=-m5bT}V8_r-)!_ASAzqNcR1_5pLxX>m z1kJIw@kmBY=rv_^*W42fl7sMXfzXFfJ6y%obS%hGw49e?hMKw>u!uD|KAG`zt@HH* z_FTXQZuYgp!J)F#Peba$sXtBn{e}RENfq=S<=U;9taQF@N6(#Pl_qI_@G^HH!@I2t zezYH-%l}6CypNfM9!$>K)!?(6=V$7hZE?bNCx&-%IBd}*ZsxFYu}L8Y<2y#8nlPHJ zS^!Zj(MP0h&RdTO&S)qR&b3!rkjN+pLC&NC?2HfYYFred-}pe8`EGHe;AIXx(AGKU ztT|@T-hLkDoyD|1HEn+mGa^J4_IW-2Y1KQ#n57Z0xo` z)qdf*wSVXy)x=@*xt9@;-q7~>H~G=)=Ke%S@a84LCdTw-7S3ZD?^G@q>@|o3HW7sY zTmB`ry4&n};r4sG28vt1l;@8G+SEuX>*6&KBRfy}m%YQr-23*GhC{Ub1r!J*g)JCpehpf58A;lQ z(s1{>s|bj6VvX+LR%lN;VI(BwNlhax8_9w>GohQ8G@h(l9#nVONn}vN$-kES-6%bd zh7*Wh>$!aBN{Xhv(}+r*q0I-%&bhfZiZqCcoKTB?D@ZM?jY)~sw4A!e6CozyZ+~1! zEE%#37xQhNQ5I0ZmqKIC4U&Y>4V-O092CNZh?NEqbK2Db3|A}|-RpUW(8AhTK`m(*{Gd^Sfa*UeJa>GBF%0o&P4UD1c z{_58z8x><9F0ROeBUDsQ_146Cy?@kR78XJBX=3#eEey{$v5X_lM!4p~qV*d)dA`1^x<%q7hfax=tq5Pp(IK?fAU4CLYF z^M%&*W)VGrpl1+uWVitxFUC2d1I=JEy#}QzGV>d10E5-gWeJn9#@>Jb{o{K=*HwBj z4wZqQ@vw#hmmC#5pfa_b=~;|zV}T47&SNC;v?-Ww%4tHNPVx9}@Sbbbql1i$j4@-z zELpN-;>3x80BuR8IE;Py#bA3yDM%B%P*GXpcGaNFk`y9cN7X&a!2`o(Qj-K$T#Oom_{>mhLk2pip8t|TKa5h_n|w!1sp^VjhQm~; zVsNguAqnv&QKv_SL5)36~DN{6}B@_BZmL-Atojtbhb! zq^cx_r13`k?5siKUpHtA3dxD)RRaCO_Ma-wYZOmo)nmhGa1XMnBbzLH+2$E?ZN>1r zSQ@L5Yr|#{ShlJ9rgJTQw!op z9LmQ3sb~_1NiY96nyt+foD?9& zkY^r3D+oM-c^aVuzWa!W;1UmS@nlqPP2E9|O9Q!vqyv&5w0eyy^$b*Bt2%75%f?(b z#T^In3+}peTHK}6;w~R|=`~|7y<%2;v$2gEPrUnA%u&Hfp`kSb5@4D?nU?J=zF+lR zs?{_yT=A->k#L&3QDBIzXvlS*FKx=exZqG*Xh@uA&?WMM=a^Q20f8a$9m~-1YX@`Y z%mE`LCMJpq0z$SU5>7*0P!)75cvO{6qw+6izvJh?iwUUj!~`3wDo9zg)vPujOsKPC z!o8Ky4vbJp=5$~RJ$SQJbvI_LB5}d;?}82*weDbR(>|efyOzIts%eXEv~bw6bK|zp zTzdOc@ok@^O@}vhXw*Wi7q*LU$u}d?chks2n-p3+L6>gfD~rgjZD;2_}KY#s?diz8?l8 z=ydcmiO2uK379beLyz{?MndR62|u(~C!NxTb593Q2Ve+HSi0v(uA{)C*=~9qa^C%u znN3?f8P~jhT#HBUeBd?P&FyTrbfl*Vw>$>2AenE`$#yfYKGC>!*M!y`5?Xb7XKX1n(&>_xo#UE!u-(!gk>eX~hhl?h2Q(Hzz|MOVR}f3M@Gr`>XGv$5G!QPKypK91oq1 zyQ~>IR;X*W3kL*)RZRM0#hm9AEp|wglAyE7u%jtsE;B5qvCjz|B(!?6ar67T{`1T0 z?|fqJrrajCJe6>Brw1PYce87LblwGobBCS9r2Sp8_Zrf z9XileG&9uA`qMX`pd{)Iy~t<3UUiYY@#!~Sfv~v}Bu`Us%^#UEow0*VD`dW~l$<=P zOXty-Tr;ETE=sJMF7yZ%8}_=ebgi)^|t!En*y0?eGSy*Z3bR3Ak; zUFoEG2BkNb{?8y`T{@u02RbV+FNeJ#NfIuJIHa%`OqJ=Q2B;|+1vn@wBG4!gt4jW?t}L~#M57dKsoj87^{5ZAF3BVPvTvt8_+ss7#@td z;pcr69dJ6Q1M{@ujD@!CAAS0xsY~|8-}u+~w%uq;a*Gaa?|s#FBGVTd&Jl9lC_9J?%<0z|C%JDh zq{U40Ylf;p?dCsNg<*^6^xhp3`2%Br`}?W3rju<=r^Gj#8FxwelWUa`jeQ$Fpq>-% z451qmmlk)(e!b$f@gmV0f#Hgm?RPR`p8**|F%14vhRz=rsJd)OAr;lpSoxly<2Kb! zBmxCThGl_@*jtgp2^e)}o|AwEmbnBO8DXbgk-FM}R#H+jX3UtpyknCmPY#7bA`bB7 z=U?S!rGp5xunN`)`+Z(l5NWA-B_kA6b8>PfPn^R*cn*3;7<3{?IS1N-O0z+&t^a597=4vEklJ|b1=sw&N#3XKygD3`fW(n!lSKTiM{;RqhlcnQs0ycq_ z;c+||UAX&3@SKScxPfX0#Y{e@LLKcu)3$BfHg@dz+}xb8W5?Fi)R=K}ZP1`0uIh4V z1YTD)ee=WPk|iS?4hy#B@0u%LeDTH7rAuWwtSFj49NN8eml6urzQlWx!O$i*PGIF# zB_%~NI+-B46?E|X>iI7)Jxtq2Xab{f-Y?~0J81{`#WgW23&1(j4sL}ocZh4=zA=56 zP{>|8{wR^&XygwL#O5NR26~!E-!g5-pD%Rbn->w%o<3^Wnpl9p``DTPnv?iB23lWi z5Jz3MwryleSY#f# z#W$dyc7QqU>#x5aKYr}!(W9eu1OoxNaf67S7m!tK(B@8l5r1LW&>8v%Ne}_7fs~Z| zGz)P70+Yw|rcFQxUY{eZ2rRgjVqng7WSBwYS3NgLt~iCJ;zo)q z!O&;ZfUGz2gydnkbOWdAj6^NDl!=;C;S%! z>!hF@6lr=~BPNB(2H}}U@;_DDdUQaRKi{5=BOl^*5nE^i)kTEW3H|{xK`7~xN08bE+mcf90n6mUF9x2`K4$Wzr7-HFq%JSTIa$gJ;bYVu`u*P#eO%GLHN-)Q3k=; z51tOrY~O*HjdiqG$a9@$Z|13PEIVw>-;{QG(Ry2*J|Vf+)Pfq;>B}u|&CH@t(~+HC zx8LXkRdQhdQ{f>A;h{EpaDp~G-nnN4jNzDmIu%GZG$z^GO7^DE@cENM8#A&HRxbxt zR`R@T(ZMp6^xUO>H@(#XaN3!#~sK^$nQ%89?PTJSPiSh2%^yyd#18Dr*(Obmz)qD*UP z2j6TgV6gKkcfSH%I$+cNG399SxJ&K{b6_y$VA#)==1~{X^EtQ7` zCxnK?DFfqhte)^UdQ5OSATa|CRcqcj#vg5f5kjv2qbad&X%MpEK(Rw+GY29dxbI-i!^LbwS`-@O` zLVjiPvZdeX0I5}&ElxuTC)sq9WT z(Ho6=cGr##q#YQX4sLi@tQ5w#?38e`_^FkSwia|si-;}hS6k`3X)QX_?!)GfHg4U8 zzm?F9HW#%)LL}*IYs(i4`APx3_|W2U`XCYy;fs!9-+@?AIDQS{4BQ#h0iW;Dpdt4^ z#RECWp5l&U+F{xRLRMJ4rdJ_B8C9%bQrT0Zb_YmQq~o*$oMQ%)Yew884W>0k9DPGB z6}lYB!8Z+NdJ>^55;Hk>jhHr@)&wY_c`u9=3=8ULmCZitqg4#h0W=et4ckykBS1tq zL8%P&EifJ5xxnoOJ%yJPS57tA^6Tn!P6rj0jxAfZJ=5)l9=(P+ymmEI`-;@@s7D7| zwrl|%WMyUH2x<^4xCo&eQyO2&N-KENqQ*42qo<%Ol~4Rr<$~vUB>rv_?_%B-6$bQ2&;c5hPHVfR z;j{yygVBNxnzZUVZRzfp-Wj@NV`k&#kCRBZZf|S;5FKymY`fv{#x0+;weHgBmZu1>~=>;3p9-AjgcO=1g8cE$Jo;4%d(>!{p>jHhFuM7$7*0 z#3e4!>EXzxI(h2rX`bPaL{19+%#s;l7NXq>s;-1pN zj~_K^RINOtQalq`CLt#SffCYh-q2NgQHSyg^Do@-`w7e96eYgkftpW`Z^B9)`32cQ z+DD37^FGpyn(@D{OzhVC)jsbHnZ$<@52wZ`Q(Os5v41so20D}i=s$tef$47`I%w75 z)_b38eDgzHUmbYqtO=PzyXw;$j3 zaKiP!zx<|l8xB@qeP{d2+B|gQosY%0=y21oJ0{%n#AUa(zv&m9uD`3}mUMgLo7=bg z-3tjfK6cYDy2g{1A(VwW;(ex$lAp=ifoL=gFUkIMzRX4wvg*3jV8Q6sI)J2x)&ERR zgK^8kZ0MRi64FR>n?N#JT~ye?fiM$jDRF3Acwi$Y6-DOZdI@SF?ucO@sClZ6=&}+a zD)rLRtt2+{s9#gmv}#s~D24*%LXt_0&DxQJG@_sdv3Y9#Ib5vja@h$0p$tibnlQu9 zl_i>&giP|BPl{MNFylucA`o~M2*J1(ps*O6Fr25ncwy*$ulfxR3#bniVPxmX=DZ4-Sl`KE`iY~7(z+xCxle5=sOdJSIj=f}GL?63b$xc0%;zkNRL zmd6ifcz*Slf4|m${N*>@-~EHHn_d6c=imG&qsaHm$KQJU!>K#7e1ChUr|lbaIZOs_qqdu$h-=;fdO_Tc57TQ-5cr!PY23VB<5ry- zHGhm=e?*d7+F$?kZgbbCknLca3}@xem<}SME8FkUT#Z#%obHKJoz3|6Z?V&}ZtEhx zX7&vi4fw^R9SbqO8Qa~sw~h;fza}|m52_EY(uAt z@JWKl!GGbnq{mDMyx2UBh)fPrO@nJUe;tcf6Ol7x8@RE+6P*lZuI})V1lmkx$dabg z^G-twg<&TtFdyhTG7)4IgIGF%!7m|&q#QYP7&jGaKY%2cWq09fPa}a8 z5)&>?Ym>C1!gtf1x(559z{ zzObYP$(*GnOwH?Fv3d(FJy5Ao9tdfjdd1QK;BYu5Oq{%H=hg`mCe+e_!Mb*R>dn{Q znKor=NnXL)rOS*^VAHzw0|vamEHTmWfRx$F)k!dgCQX=p=+Kc@UU|jq2|f4JlXGU% zM-wheIzXFDZrp_EpkCL|I}3lRNqmZ$oU3O*Bubg#iZ>U$5JaIO!a1S?`aLE3@Cknq zK=wIb_B*Sm0OlU&`hjQVhz`zp?LcfvoUFK-knDMEv`<-GhUt{s+jR$=?(5roaKBGK zt1K;2TvE_!&nqrhK*zCN2QR(&V|a&MBM+jdjDbNm$LCF<1ey^}0m_Dpv|2^)EJYOi zpz}UlqSB~FS=!c$!V0%1sOgfuqLit@{F3sN)O0XVaY4D;UK8-Ui>q8YX&L^2D{jv6+lsCYO2e^LFuzEJ|}W`%nCOLV9{8{1@vZhKcbBtT3N`=dO0g z5qd(enDl4+!sk(INr5TB$C-&z(hhV7Uyj9TR8?!(ZAcTwU30?&^rWyg|0bHy2+Z~W zvzFx6L@r`JZzv~nI}4Q}!i5@c1W&Y$3(NI#!lrk-{N*`^^*|{m?S(UDhN|)>j+_74d;OBLOLuNq zQRApi&dB9YOp)yo+1VJ1PsnA%&#EY~ zYL~YtFTc`WQ{!?f1`Eq|KI|P!2NWSYU8ED9G#nzt_~*bzXy&Px+lQ@#RCi5A8XeVaP$z zb$m#bpigzBdg%D6q#D-tX#>)M&is=&9W;NOUQBG>DSB)WM_Jv{rC#7!J6IweY^^%p z`s3fSpnvDf(cfr1HAn&j_B&x(bNxJ?K|x^qXw{usme>M9j;_JbBx_b^#h2X34dh^jc6hbwCO_|F?aImYqls1BCEchv>DNS-VyKjwTH$}&y{H>GQYnb zl>I?Nk?BlRy&l)FVIwHHE{A9zf^I-?FvBPzh*QAvE6@s*f{{aL-$BSbRotrB99 zsD)W0x4-Ics5?B!tVR8pvBb$yZz&Nq!ZGR*aq58D&GZVKDAL7`un`*HxEae&E-uOg z>D9KCp_h&Lb@lugdc4wo@ZizlOCCyt)6fefdZW=feDvhHkBSwV97+6VdT4G7v|c7;-4Qr7z3`-w<1HSTpYzHpk#APAUT@g2+}?-IDz( z@y!Lz8?V|MF)c}9^oz!vzMyNE^8ijTDCiaK;xhT9ld_P&+UfrUQB_xm9HG?*eeJYf#$Gm)`y?+H(5~&tX)W z7Qrb2sX=RoowsP71jA?3T{hWk3pwva&xj_*%n36=L_Ps162+tiy!<7>L5+e#X!p_5 zXKkS`ZLEABG;R?wif@z(%>R=2f6N&VQG^Mjd2O=uGN$b&F2Ln_sq3DKq9PvuhRPz@ z+e~xOR}a)08+c*7{Of3a#1?c4@kJAf^i&_aAqy^e`~K0ChT*}mDG&!btkzW`$) zR(CojkU%>sIU7SqfL?958bMbN`hH9Ahu~6VE%(IGRC=utQ8MR+1~rj}HkJqRub2*N zk~X@tp@gG_Ak!DRK8G1}5pvgDD3 zzh!i)Dp+*zErCX*@n)Vy`ZTtw>kMfUeLh|BIO5S#6b(%WWQw<`FLLL%qwlp}@>AN{ z&FSED)(!}0N6k>R;Ac<`F#2f`9$LDqak%lDA^~y}=>z z{-JT|V4FJB78+=CjkqyCw}3C&nJJ*k&zv#2#uxa;WpVnPk%k^9rC)Y{3FD;iIIFHk zn!^@${+0F=(Nut*#(Yk533+(_R3^Gxy4U_I-6=l1E=~5bq=VBPifC4}oEq}}9h$k2B6{10zyIfV zv|`2tX4GI>MnuU_3`ON@;tF%6R!+I!GdMvR(!@X5rVO(Aha?2Qvbnyvngy#tBO5lY z_qe>`$J%5$ymia^f{H36JT)DNV)J(t4}_gp&?gvZzW_?bovX2016$^6rd7k9q&?9T zTV{HR&c?WFenHj&?Kq;xC1OhjDLz^becZ9`01~n)bQT`chdv%c3qUIyfJ|>A>_`bO1Uyt))Z)Us|W5p@suJnJZqVIk^%4o;pdC z?n%HT8FsXg9e4S5|E_xYZB>J>a}U2fIH-{{C_x%%3k_|g3~C%4-Z(h0v3=MrOn1^Z z1wa|JZO1GGBrYp6ovb~+NO?+dJ5U!}f^(#*>zKo)(1yY$%tN~;B`a6Z7IgKw!FP%IJ$u^0nuED3Y6>P;X8fi?@r(-Q}-GSFUt zolWV}CWCC@K{o!{BE7j78e)?N+vKkrRgC=uQ|ZfsrlSl^;g5Gw^K`l!`Nm zAU6D`KPOzjFk#Wb`2dR!zP+(P5ls;#6`5%cPvBp&tBLMQpzoA<8$--6>(cYcZI{v( zqd_)M0Jy;ag)Q_I?LPDjy^`6t@wJ=C%5Xyp0*Z7vTz#tyHNhPxyWA=Ew4AJZs9eis#hy_st z>GSk}uvqsE3VLn|d*W0dZDA%md}m`BL@>}69>||54vQ}v{YzH0n{03evnhR;^mHC@ zo+)TI9#!Y4-|>d#x{6E&SDg6SI5<*Xyz#Ww=(r)^?9W)Hrt>e9Q<8=+%&8I84(xV& zjfL+V;cytXVMEe^WH9q3g$v4k%e8~Lpl9~{500Ao{HBDlt#a_Ikn=z8gU=O>{#*6@ z=gKw>Vsbvy{D{EiA2B25#<_yX8O4JEQo-~?Oj{MMnXEgfGq#bjET&iU($WG2_XvDH zbRZZ3N2m!FzDuC}8<-9-GhX;~@a?n%0p5^Y&?;oxZQ4yOEW08 zVCG6hJ)9RMzlhL)+mLj6rw=o2ePKKQ9si^PYVh6BfraC63Ob+;u{!0uKm*bN>Bko) z9dL&loXy&Sg|kF`I)Fu^(Yv6LRd4*K@F-azIEFYZGzcs@h&a?BRy*LPK0%B|h3~(o zp&9c?9DWfeis%4^U&O@mhc;?a-)P-M$mt-K4pa@cfhL9hFTMP)XPPp@2u(2BSe z2!^Sh>CJH!ZOmJpx&|;avheL;(Luza22nboNlB5X&YCuVexfd6Y|@hgS*9-tMur{j z97HVo(1s2piGEMPkads-Uy-BD$b5(*9c?I}RXh%!_TmMa&d`Die|MUn^8Hj|O9f{| z5_3M66Ayoi%sFS6}q+-&dhmtYoL(otu1M#fI&Pb7oeR7A{=4P?n5s zyALj2lxV(5YT>M4(Luza22nbYnLcdf*g$15#Cu;_jw%~pjGD?c|E#$S|MzB(jI>OT z$2Di}!ngZ>2CZTI#Brd2#MRqBA3kF8%w@VJ&7C`c>#B9Tckd1P9h)|9UA}7NjG424 z2-6q%ZqkaB?q6@5xgu@BhN7M`_O3eM4l2g79YrN>mg{6YkJMEASZZ--+1^s0Y^D;3 zr2`N`pr(KYs+`_{Tu~TsmWPRDF-+Cew1b)&-nf24c|`$}1HPa(Y~0it)2D`su`N0{ zOIUOeai~Fb?EoWd(Y#qo$S+A!d6io;^iKzk(By!(s&veRX;Y@oR26C4_T6(AuTjFj z%F4=_3s)>zx%G=-BhZq%77o}eHmq2aoRS&#S0O7;*t7q@5o)1}T|3Yeed5~c|9rM= z+V;v}Gj}9yEnI)t7f{*oS$j*I?BnT0L+2gzh1iGFQ->rTrJo3iK^^UYUI3Rzj2&B8 zR6b(Fh%devhK7aS;jmXg9do&BYHA!>DCBa1mc71^>~J{9zOZn%u;?J-P=gp_fwl&P zLLrs^AR`o2VYr4h`sN2hpcIf3AKx*GmJVVN zIpeb&MyJ@_hw%#a6xS5Yan^`z0Mw%c3*QSk9hg00(Sf;k5CMJTLz3t#W>EOW!!1)a z#h-$_k1xMMqhBdMDIJI=Hcu>^5_OD)3l@HVy(N(g3>F=j4mGH!9T-e5$S`2dR!OotlOp#xgD3S(q0U$F8> z^6oWj>F3OMBquv6i)C6YP*`rkWSfm?Mrv{jQ+*N|5lXI3HiayQw{Kd{G+9w3Rbfyo zbk&e#5C?IGKdqp$LlZ1%P%S^CWTA#p(dzZM7Po{Iyeu|fJ=$|6{d@3DN*d7Q8W@@E{9B|CkzIE z2!?YtN(Wz$8(Wf-Ty!k&NM`or+4JVkUOHjc%r8IvhzU0F7B&Z3z!=GrS9p-^Du^0gRSlI-^f z9NV^RU$b&4%5>pAPJgbpn2;Cz7fWFg{EgP64g z71OmQ1zrA-uG4YLrmco9ZQXIuV|UZyp%!L&`BQB1h9a+Bw}D9>#9x@SIy1Lm)4J7# zl{JZT=P)UF@W8&sD^@4YU!0YZnVnyx$-cEo%Q7=^^Kw!*tlg5dX6>w5bJnk3lT%!( zN$#~tYtmCQ^79L4%$YxH)+{L`@7}X-&cX#VXHSEitX-3Ip)!GBS4}M}D%rJT=i#)Y z^JdIY!>(Y^&!04!t1%WGoCmP9gNQ>7VvGeS0ik1Q$F}Y}I%Cp;d8^hgT)HCUt2Pw3 zqs$Erm$clxW0P$OAO=~{3|$UL^wm@75t1IpUyNz`fiu$f>08RON}msqzhp~$BN@O8P%vTK?;nW>x;WTlM=pfRWBG2d%dYS?nFw_A0 zmlkeGyc*!X4Mhi>vrY<=$mj`I!!m-kb`Wu>L3HgP(i1AQbd1iD@&c%|7&J1!K#Dz3 znqA!PM*3w$Xuha@WX=B+i~q>#_^V>{pCZ*M5Gy(L3h?bRY(PW{aGK(MPUrybE&gbx zfKjRF4;@ri^3}4R4M}QU=+9DOHanjU&YliLDNxQ+6o)QxF57=NQ-m}SEbSoTP=ly; zK+O$(ObySQpSW=T((QY;Zrib4)r{>2504!?mX-=sg_UJgJl2}&O3*NWfDkGJAf6HO zQw2jDY6L$eS z|91~j0Nw~R`9}TGf&uW0$mfC%kU9N;z3Tt;v#)yh?paym#!%<^tLV6)E3W%=ZR0_! zANXSRH8QL7b5h?L4YPItom7!Eg^E-UC_Hb*FjM{0=FfThUp>qu4FgL%h&a@s4ju3s z>6*e6T{h@*qkbu%8?vI(TTB#Ql3DtATc`?KH*WG&RmfpYRf0>FE+060j3S3sU4g8Y z6cma~hz{g%NH#+BgYn=A1WL%0zGAL~^*}g8pEE}e60wOYWoPEnB`Jh>wC#X?_Y{Lf zrq3%FK@FO&L_g3vXYn%nZ8TXz4=!4?Xz=jy>(*{k3_awvhb8UskyKib1bZQ?hR}r1 z2x!CIo0Cwyr(SqdRYKrT+3zFLfNfBw~{G5F$>4?p_s z%g;Xf@;@(h+q-o$3)hUEH~*Rcb~lqW5G?J$bf`h?+JV94O+~|C=tATrMGa!K$clz= zW?&L#tR%bSiMAMTV@7=~t4?Qm2@8a0O<6c_^kj$AJ89}1rUlD$Qyif%(>#%*#+xM(3}zg6othUHLIdFHY; zThfyEZrZSsZ&moNxqx8kYd36Pm9+NDf#VYwudtVAp-nSWves|gvth#~5SAhb13?U# z2Brh5ExjMC#C1Mr>da{CHw`JW1(8}By^Z2xlWKa+cdLqeRqegs9m-x%m5`Tf3IEiWW z$PqW7sTIl!G+x|FqaQ&9(0}|YGAFA9*^-9LBa`l64zTYUbXOD&#i0FL^xh{gDs)|N zD!mAeKol5?f{5R6+JRUF@OSL^Jd`8cn6{9r@*|HtHhAPnx6_rlVD=M_wF|0YRf6W{ z)0mfbcSU62EYVPO@b{-X@dc_nKThkw#9Affvuw4v0{Ja5r~=}?1M?LZ55a(onKP0e#5F`$Fk?oO@a(#>_R&z?{GT?wU~R6NHimLXJqvODk*s&7Q!x# zgu_xW#Xy8m4##yYU5E|jgWSxa&azj;&+h_CqLT20^&dnXcZ+k1Xd}=vzVPt!M8j+A zPR9nM18Q46)c(nrbv^jZlN~!f(fP?Pon&YPVd@5O1XJAY+ds?cRx}r-5~VpyG$0++ z>pbdT>S8wP;~r3N;OFhxzpd`=ytW@_w5kPGg7c`pA~_pHkE5h&>AvAu74nhHTWD7#S#ZdYdNlpU|G^iV@aFmZAg3}W32BZVrlhlAv z#rQd^m@3iwYuz%yqM~S;vt76U!nQI)8v2PuhaP_9v34w&W75PlH|d_%Ht zLNqxohVWtth!Alp77a@W$V3a({Num<6-GZjD9TU^1BL=)lJmaDpXF~=HW(T}JJ7;U zb?Q{+@@Nt*L)8UW2@Lt~&po#%IS0mILl&K*;ppIE+m%SNx_-l^fnN;Wyk&iMW{##y zyN{+US-g-|>@b?jGRq%tMUi9T3!i`(`heIPAp8Qf3J43fHm!+h5|!_o6$_H2>&5_a z>g6VYl=LbDttkqksYNtfAl4rR!Vt=LOwgP|aZV8H3}IlNLxwsnB}Q(FvT;8Zk8TnP z2O4ti00)C9a&XkJPhb6Ce@8`4byY$j4jrC2 zW#-xqTW8Fe5wtr39`D9&8+`t-rz*d!q;kRR`K84ruHxJ^Yql+1xLERgl9N-{Y}hz^ z&H`oxr%awXeaif>ss+8i)$2D*nLJ)`S5Fu{dgQ3FUw$!U>Wuk?r4{q0PB^lA&)6Yj z7A#DhI&YEJRi2o*VrJsv#k1$ZW?r;-#pKDei;9Y-Oqn)w?gCk3S*e++nK?nPXWiOO z*#*a@&YYFFc;(`i>jw`TJ!#5BDPSKrdIXuQ#0F$DoZ(du)4aksJPtcC_rbfT)S@N%9S%`E?K>0^WL4i{H~f{$U9~F zoIuE5Q(014T0V8sTuIZ{B&~GYtBOl1LX|~o$X{MrGGh4GGiNVPTC?6+mcMKBuDtA{ z%U7(KHajukt(rY=(cHwvd-w0dNKw31WWkc60S}_muLkk0a@6{?9~lY<`Bj~7A27(`1?P|- zIqH-<-3zBUqs3=>y$VJLDZ3QHw;SNrq}SjAWkripnv5G!)>In02VH@wqRH^^yQmUR zt{PB8NSQ|*UcIvg@ezG(o~lok!rf6g+R>@-7G@|EDsm3?9ekfSdpf9xx)Oif!^Z}O zr5!{ZY7o^9G(&bdyow}OS663crei#ZL)@s=)!e)SbP+wIE>16b>^j~3_>T(^#FK5_)(}yCq;tv_|6)`>AtAN)JCcy&5yfden9t0kqQzs1RQS(V(PQ%D zap{6-5ztlqq0$o1h&iYB?%x)aE#<=RNF|JB$UV@(>dbEz9mGIa6iJdo#PNIzAyP+g z!N*se&KazC79tKch+RsgG0A0=MlHPbN*qZHi8rk&7={{P{vak;8q%lkqB>Vi35?P~ zUEr#40#OeT<3IK7fNzYzaeA@N0{jN2d6yp?9n`i2KMU6+&R@t> z>30uyTeNWA6Hou=9M}l803GmohhS+3u}>BN+GT9+^EK#U0Dr|Ovh_IVV>?!Ht=Eiw zdfEK-5;@fBkCmKKW^*zI%TTqF4siq|Bjeq{o1anqcpI|n zxte`KAZ83i5E<%74juuqh|rkJgjhdtic9A+P*7o^h%z5vi+W;z4(Pzl2OTFou|OG! z(;FJ6Ne8H7w3;Vu4V0OTO)WqJM&qk3e07S#Pr_x$=jF7 z_>d%)7H}1j;YEB>J!rX)WP_)otAaknXhB?bxw&(uR=&;ir-k{0;IF&fC@lRtWTmN*?cFiS#>K##8ALEXv2c_9i2 zzoN;SLfR<$nqNbzh$(wmJV8Ei#)gesb8`+$vc6^4u9S@IU}fdT-FqfX7>BM-N?N{b)rR@A=WJfTyr7_9dD50; z%ai6zpIBL0xohu{*>mS)XCG^ben0mxSfC`c$}fNX#gGGs4pzHrrcE3x`91TNty;Bi z`;0mB=gyrCCWSDH=nX;#=&-#zwn(zNZtZF{+Md z^?8}ug+(PGrmUv!iz^&uWhIIvA3mHB^139js@voDd2-7uN(yp8cWFnH zB`H*to0XTB=W=^<^9tN9M@hNk+chKTAhI59(LpU8sQjY_8og=E=u62&=d?~hKe{B- ztY)yXV*Z*C5`p$^TDvm)4-uKXH2efLibj4^NOZVpI=o~ z1F;GDyje$5JZ^hgS%sO!+2M4w16dBQOj^5c)4o}W%MN7c=47Y&?4=<^-?Z&ujonjP zUShYGPM@_x4ZD~o&0Dr`&(VT?`?dvqenk!zmsRH-IlN)jD(J1-_ojV4b|Tb=;_MV6 zGet^1cy!N}{hK!J8#5#E+vz(N9heR^s9ifiiztq&%5tYKn7Cq9;_@~7QnD8>T>^PN zux$%2Vyv^`l>A3;=MNjqU9lVx{OCh9bCuEbn~q?reDs8$FH=$&?>zVrNarz^_~i)9 z94<7FUd8JX9iwIiqi85&0S!pjHRUX9Dv=v?ia4b!ykX6o^O(YW_Bg$@193Y#@-o1~ z3tVdv)CNZU+(T6$g^DaM-8g#W0Bv;_5qLZtbWK{dYH?9%P1FiIBUp4`I@BPl9dHd+ zt*NP^Zz3`!C`;jR5Gq+9=Rt=83;B`$$MiHEBSS&>`6cc* zkJR5B)G3iTW-5wwp@CQG_<|oF(qMED0lx*co@hxEF-oY1 z$V(tHsOXCog8Fvuh5!Kn^hrcPR2_hbS%qM-VsSJdYw-xekR>%1qZd~!Iyftb8q{4% zj6ozMdWD9pCbN)_dgRnNKDU$M^kZIVIGvg`936<{vBy)PVO#z5w1X4leCU6^@4)n* z9UWYR`wmVDuro$22>7hWt_2eft{r?YI2$@RAJA}gaN%nQJ6?Q7yt5!GWZ}C6=)mLg zSak6Hf^Skb{g!s{G?S$BLTUTqL6Rh)9SEI^%;O6Xr~>L@o?L)vNbTT)exng>0qr1E zR#sD0ZQ;9w_$moJkR_n3tgNJ@r1(OEC^L>1V&Q>cFbE;G)(%VuI@tNrv%1~xak-(j zTKLWYjX)fI9Poe?#H9-kqAnLAV5~uit+fNwp$6NYe~NkCx=Oo-EquoiONpQZcmOlh z!gmGQTGx=q!o{(6z(0;=;k$>f>tdR+9@cy>02koca7&37(Y^z-L1MS8n0pN|QX_jv zcqrdlD7<1z2;WCUSH+k%0|`7Zy32^@GrALzaPi7Ov;|HHuz;`;I30+mJJde3qee6) z?+D>IMB7H%kcaZWW@HoOsSPoEu-BNwVwgrYmWdo94Nr*m{}54^ z4oskxcI??bVf^&${370-bSc`N(Ke(Iep36F`+2L@CgDI2h(PqF$RRdKJ^D7!=q}>w zg^Ea(zX{eGjiy5lI34hP2by~H=+X4_)a0Xwby-=wZXM<)s0<`9Z(~QpQSYPx4QpN4F^_j-T^& zzb+aR&8ry*L;=X|lN7O$1ou^Cg+3X8V$dgScnJ|sKNZPKLa(LqlHw?77zp$e+o}?x znDkvoMZ9+*%MnVy5P-r1@Su*UxCo?C$E#023||-4CS}v124dd~i+j`I93 zKL5D;N2AcNefxa?68PkcfxEYF8$Myu@>MI>tlltl#MjNt! z#OR4=>;C;dc2-vn8#r{_*JDSH94-f>ks}APpli~^X}v!hGHJr>;bSMyU%Y(W*AxHw z&o|9a7+mlmS%NDoD*;8Oq@+NyWhn$6q!0grD$zMeiS@xYO+oQ%w1NZPV_y~pcFPRo1a?RP!Sio(KTv&0ty(ApS^hYlTa zySdQ|{94<7Ou1WJ2 ztys5e^^To;hY$Js%faI|?mDPTL6<)?aOeodndfIL`N(#9ZC(pRon=^CLASOcNP-1- zw-$GIcb5Xip-`l_yF10bxVx3&?nMI>FYXj~=gWJ}cfIHLo@|@Ro;7Qpbw88F_3+!m zzJH3HiiRceKE(Z~w1x5+_A4umYw5JKnoV`CmaJVo&ZdcYzWI7p{HtQ^`NYjd*6=U{ z3v!pXVEdSvHL%T4^Yl7}4E6_5+vmD#R zU`9j*OCy`*hQEnLWy%?RZlkU8;(F%MnlqWx+E9;&fedGp)ii4B2ySLJXil@fmer`; zYWP8(X}5fW(JTw-;%};lJ7@5GXD2V*N=%z6Y<*QA{EWw9)a1VUmeX-pTzoJd-emc_ z&VQXww%%pF)Y@k3d*`*XRTPDi7We8srV}#4N6KA6&wuj%E4xyZ;2=L$c&pRS}P zIlFGWg~-N{(J@cf)YeW-PU6lK)OUv=$;zqT@ ztSJ^>LVLmiAmSZ;hP-MM-t=)9YOv=Y-Q%NLmBq?~!~uuZ0zddn89vB9Rr3uuF@^nZ zQgagPpstwPBIR@BvYd(u2eZM`$_Jl)zZ1VbqD-6WClXBiQD@@*0Rc9;3TNIB0m?-9 zniufWH$v|Bb~!@c{r>ixQB`r7IBEiGymaQSt)<1EZ682Utl%H(L4Trin9kN8PIZ8X zN1%j+$fb*IRJWRdQ!0;&N`BSjTk7XKPhi;;XVsKqSt~!1}tKtx*`MAP(ssj@XcUQ#&rg9{`dVn zP63pS-Czp#gA&6zU$;}py+Gi^jF(>F{lp@kgi^r=dU?BMeAd=qlRd~z&VNeakR!Qt ziv2vj{n>ix`d%Bdsa7;Y;by{VF>A3ilYV$?;UC`;u}IGu#crkwQxe(JUsA1mVCb3h z^vR;4N7XV6#kyg(sQ}h{g;I|~dsMPx2s_19XiYM@~Cs=tx1Y zJOHW~I*OzQvdFjJPA|W(ziQ)`jU|TUW*D^c$=5{1%^;w)pdIxuf+NBGHwI(<9_URy zOBbx;FTf)v-vcpLuHD+fm|b2X>J@R<3>hciQN3;b-499GRHj{uX!@I+{lD$~`W;b6 zyodXdoMh(3cQr>uC;yriR`^Sp|Y(0Xhg68>rDoATdu*HcB20`9go1sPIUe=!6}IuTNBZNRbIksIbL$ z7`o?7&>3}8F{;TupZKbgR{l3Ie*XXu3f<)r2rn8IlxPxBaT=r-mfi`0qZ}0%62dme z_aDT}AyuXms~KXYjEf{hi!v(NSnngf$ioh6rKX}lmeBsLKx+or#+$*wi9pAALh$aH z3g(!FsPa&AA}3k1qyGBB@Jd1_G^$m$0oa>Xc7iJnJ^EUCq@UwkUa0j_W}!xxlF1OU zov|m*|9DU3CZBXziu_6?G&kw34xjU$#+4P8PErOcrt54{-{eXIC*UUO;C`(!N^SbG ztU-f&O20zrRT~U-T!e7Ch@A_0Ua_)J`PXp!K(GtJE$0AijQd z3IhY&^ibL2y~PTancYGv(4aOZY!HkPl>`_3tpqD20=QklPfD=WbFtvu(+g9v;OoW= zLhsLz+o@n^PXClOgIqRb)c5U3r=$6#yuxW|jZ3V8)$9E-qNVhVB3#gLJ2~S*Q_(RJ z!-i0V2tziMTFtcx)JKcSA_S819WyL4*4My&BHXYdK`ukZ$&B)A{S_ZK)RjO&35=1X z`Aq>BZfB)O8_lAbLvK&MphjmV`4okzWmv!}Jr`&5^xI4C3Y%Et1K(kU!k2W>*l$O} zL?D2=a^@ht9Bc~+o*wZ1v%jr$5q`20${-GslT?g4Ebfk2!3cHcDaBZnmO2Gg%Z{S3 zH1|5`QKtMu;u(Q2m4ebR`it3ctenmbodQAtmzo$nl@xqoQ=v>GdM`Cat<26Qh=RmI zhRZ3s+L4}zT%FnpR}4Op834P*UMD>kNYk(!jUi@GVmDK{ZFy3gOXzW@^yu}TBIsQL zC3W8nKeO7-pFx2e0e?!zjaR#3yYm;fCWiSKbye}8q6n!Y7`t)N8kN;(3Mt>vj2%@H zgu=HaMLy(sv6G4mSxht>S(|=25+aOn#DbyGKbi8_+sB(j&!yE%B__4=l$QIU1K62Z zkqI8@X@TeoJo!Icbojj1A>MKt6-ETSz7J~iu3kzSW937ulsz0v5$NKmtg-!X<5ghX z_Jp)h@)cP57(OE3j)p9C+&7aM^|5I!88s~{(v@-xpe*Z3T!x!%F}iL>7w=*`1}yxQ z)Cb4U>EOdj1WMwU`-utyDqN^v4Y5Siw%AQ&FA`kP(gj^%y4ip<1%?m47(Ae}=@%+3 zz$--{5;6LrVJ7q=5mg*aIMoB9nVal;r{MG6>o>7C)~7vB0>#!XR^=5}`PN^y$qT3C zCr@b*0wO8#`n&%`z-&i>_xQgR{kX(j@&JEcNz8Ps$8WlLZAB{>s8ZmZx)sLATaH2f zVfB$>PPiCvBI9HELcRF2degQ+U$gB=r|F%xS%Z0PI>JXs+8iuRqU^^PaEY z_&sh}L4n}fo*un%79=}CZo9dynOX-dQng*g!2g8#a7hc`VvK{&Py_2Cx*jHslvk|D z-anj}iUe-Bn&dARo0WXuaTP(8k*E{~o)}c{8LsXjv0gO2v9S~e(jz|FcW0r>hv*q_ ztH>$$_$1udi*0&f_CL#;^I=8!rz1#Xa}Klng+!t(n$9>d>FQV^w}$G`?4fLR0D*EU zH`zsZ{EF9uQcaSay{F}lpGoxC%A}nP4olm9DM*~_`YAtb%Z><~p6cinS?;1&ZjB7~ zbt=l)j5l%`QJP=?acmQ- zHiBr54AUu{T9~&j&?;0c-|{+*w5`p06fmi}<)#TsMdOWQ0VAa;OW7~&gS?4j7fJmB ziXV<3$M9DturaP}+=^^{QTelC#>(?T@d{E-ihX8VsrSLVj7{E>eX z_KR?7`MF`UyxGI4G((Gz&RJMMg_`V}sCQFW$cHOQSnGNe_doK)+pL*}rq(lEa4;P? ztSsIZ#-7$N}1(h#E&iKBwwkhTi(AMY8$_T#R4hDPIRPW!DktpbCIlISD{RVz%p((our z`{zvfX!g}4h7p;kVM+7lMt1|KlSFcwkZD7G0-V-!4I(04gfK+I!Bmo1nYK4MprirL z6BwJqonFqm0C{+spej%WzAg&Q{BqZQ&r64_QOAAM*?qImKM(Zxh|hdUU%Ms>_-IIL zz5T!J$56W%kt9D}T}%W{u{b;)($;hs%vP>i*mb-;*N9tAfH0*f)8K;HT^;WOg=ieS z2SUlSzVojgP9Fs#e+?_)HjRoCarv{8&ifv8Zl(P0IGH7CI=opPz$%&9Iq4+ZbJOv>`%-9pw&r(j z^1^Gk95>tS->Cji<=ubBh4aqI0viem|ENd_%`(r0+MWx_x+ct*P#fodc*#G4K_hyW zp|(6X30&A@yD2EFYHTA!q$I#2aGANpN5c^l+{XEwXQhd1QXVO!xE3WU(B&DELQbQt zb{5-a!9(#IOpG-^0JnGgn3<1wn5vKR=l-CKLK^CQ;VOSuJ-I9-K-^Rb^|X4~tN-KR zByOJ?ni#l!Yova(S7*3mnV>;{LeNGa&xXgQ;aVC57WteN0ZJ+^7Sz4ZjCkM(=J7TB zU2g$Y)6#;c%2CJrg!6=`)I&Q2ye5f^pV_dLC;Wpph-6!R;Ji%=FCpmpRb50F@P%nk z+Lhv@)U@gf$P)S{fp0|C{PrsU1B39cKSEJnkV054;+Qq74bMsd60~|cY&by?$8Eb{ zr`Ln)MfpPtl#PdnM@8g3Knlg8 zH*&gU{qlTB((mAb7Tfnv#^a@@?72{wQecQN;9wzL2fl1CMmV$*&-uLn6{MVfy-L2e zVJXw@WszGi)=m%Td?GZXJSZ$I^n1ReG_|%qf-dJ1v~6rSj`u(f#+}9#hcKBWN~{jv zbCQ!QkhLF8HHyH$k~N4$p>GLgMuK^O!$xz}K3z7=Y-nb4R2Aw0>Dank${2 zm>Q2bSw6j+b$;ScfZClgfVZI5Y=aH$?L=kZh@!$m0Q*qI_+D^NXJ=<6QNU^I9}iO} zn+juXnus|Rl+IaPiIo!$)pJ^0+|+rp_&NyLSsPtlQ?){x#Ef%rW+x4i7I^{Gqsx5x3VHj* zQ_)tr?~T0mp*pK#fw$6#LzzytNO}%TYbW>vmE|)WR~Vqc#lVBZBLNcUQt@r_yPr>f ztND%lOn-hm2*v8xFhD5Z69VhGOXDgAtYw!WOy>~#4+qr1Urd>EZuhe{2<{4$MmNXE|MuMSFfKravZ+d*6^&|ENmG5BIc7fuNIzk|! zNDE@i$2F05_dw1DcNhvr0+bX4UcA8-*g({0nyjbsP27=iCVA=1gx>+f_Ro%Ecc9Kv*ELtYZ;NIRdVOgLd% zTwy$=s4?uUxyChC2+RvE(a^Iqz@9l7AJW6Dk5J6xjkoZjA|nMLezJSuS$?jXqZA*5 zhws-#I5(kqY6AE`S&iN9n4kFP^n>)Zx5h~asOtL{d0AjFnT=p@qz#{vz@{y5Tb$Y~ zFBTkL#{wXY?9cl^3UR%*JA%PXC|(-*qJ98^NNobFfD&Yd865Wg&1?E_h%WrueI^)~ zj_~=uedu8TsE^H-Bjo&Ek~26J2Og6Sl`MlNN#&V$D--kV8 zHZv^-74hRBdh}u9VW^lkiVqERy}X&wQSjPcnxufUxB|E^P^mePdt>mVd|{9hzv^lr zG7I0uzJSB)S*;ev-Z)4Zax5`RJR801hBUIhR*GX_XpFmkq!Rg|s?C?^OL zpB)Ld%0Bx1P%A<&(g=^Rn!`e#pG>47*!$4U*96z3D3^Ft5U&D&36ERA48cvJwj$0i z-I>nD?Y@yC&HqVl(T&v+-wbo?{Z9MHc!w8Rd)!suOIG~Xam7|XDx-Iep$v{Kuogu? zjO}XUbN*dccODPeMqs9|)O8z2`Q2H%Rvw5*T;EilQ0>EUUbF&Rd!uJ>8JDnLWuqo1 zj}!u4H%i%WYe(Kt$UQxjTEu+n(7UcE!Zv6s*7Di7U(SxeNV;>d%iO4G^n0V z(ooZ8O6b}+bzBkFf?6RONONi+B<8+Rkl8iMkX9JD+D2FR<^}@4t8PfkP-4O$ebS}{ z-MRc}J({7wr7XU*TV^B18Tw^q&d{$eK9(8co$}B1LethI;0DB<`)vI#T}1pgTl`B` zfkt3cRZ}@~ROmxQ-v|4OsClpn6PMkx3Iw+JNp!6zI*WiR!peDxwv|*yIt6+R-gPD1 z73&mcrh?Lc{bP>50A3pK+{{MlSR^{+)27{r&l#KuLt6pNr(&(%E3m~*PbYek5#V#t z%>n8P>%)SHiHU&-^m9>93T}R8VQ$;^f~J$|*zDMwrXpyv=)>2qUmcWO?sHoAAl+S& zcW;fIs-<<)6LO03%I}`q%bm*Bgd}ijxa7ZCoZ5u=N06Ut%H<~Mr^d!snnZuyCq;)u zpi@fNh$~McjA&?ZntIkvgYRsku1AJ-JWnY6 zR+{E>+{93N6@ki6_x2q&+U#~$l5&gENCX_~>+3IGhrFJDo%mLtS3M9f^ar#<}ZfQ)h7@$DY+yXN~na%aoui9|BSzYZGc_Vq#L#g3s8Q)4!`2 zMMY?tfEW<&!#6Qp8Dbm^o(~(pPK~p8yOwm21+L1y&swH z4cD(6bebNpLAJ}CQaWBUrOZFX$*XwI$k?5~y)~r#rS`!}URbSCD4SIL>%qrd9IjKX zigy*LFB`vs3POj!3h&{vMG&CyLL|jd&4C|vz2cE&B8~irqAq}83$*+ecS!%crZ1lm z%DfQPi-d@GeMH%{5}7?a`w_j5z&sZIWt2h`uG)sqR2#7(Diyy$JjCS%$~2F$I)yof z?Z;D6j#1^pR{t2a7IcU{i-5`#U~F;!yTi&nlYx2qqEpz5c!(=S72kq+DJi@Z5%XR@ zyXBh)S%1(v%C!xk2`>!syrYu@oA1h%q0}A5B>yHuaTwr@vI2V;nA~-FSr~gnJV)oU z_P{{z@Nz}Xl~?|GL;4W{#)u2Jb7+vJ_Xei90pzgZ!l} z=mwO=XvJm5O-LHln%?ZY4UOiE7D`v+?f-e7l9Eay&+R3Q98^~{7SWH5=ipk*^O-A9 z)YY54pOJdCNw2zpi+HPd+_5*}ce#-b!uX3rmf4dZiU*B72(ct2#^y9IgeavMeLD#Teqrd= z7nAxj|KG2Q8zziYRfTjP<-bv-+L@PIN!ebja+O<%Ow797AM-dkW4mKe9yF**5J@8& z5Csl9suliX+E58gTVQ@ju1g%&Ih);5W&dG!h(AhW{LF_U0bAgxX!|+LvIJUGE$NNXCpv{V zR3FySLJf8v8v67*QZ?G8fSz@#1@Pv&vG2EgcJC$R8@Q#Z}SZ z-zOJ+_P&r@w4MB}pbr6lC*W|ll2%`a6c|THcFQN11zcXHTZut5UzpJ)8M1!)VI@88 ztdgx|6E3BZF6A7pX6~)#?5rm5ZKR$KIr*gdc*J?=G=Ke?_7!TkMZqZKFsUxX8Z}d^ zppN(;jXQYdkF%YE4nstekT0|NdeqqLYi#oGBeuQ2E&&RaGgAV_GBmDPU*kpZBAEvh zwVa>|U|0{;gc<);gh~fryldQH&{t|^eg#n1?83X6d?xAnmxnqF3kQBY{Mj~+A4hOC zGog2#aa_m3i#6~sX^VUBGs#bwjZ^eh)9q$6 zZ5;|4@ORS{9AVLbo}Jr@rj>{X#@WBZrQb$qB6(gN)rb2@M<_h4mgq=fBm@J2?>?-| z-04`_3qEb~z(WaW^j1)7KbER=+G|42JOM)rQR-`6zIT1avWV+HXVDn?U||qs&zgqCehD@<_xSw&(L~&h0YetO4066Wf zQsXY578BeISu_yLpCyt>`_Tj!J+TOe#)r7H0Tx2W3WMKqa98?r4S+r91obqZKf`8R zii@7!WU#yS{XLp9J#pA*s;MsLyT0gNj=KIj{n?SJte&RDb@2?YWW-sgZkf;G>RY)D zM04A|`#kBB>Ol0cl8?n|gc^)UZlVuqVkt+4$W=%S?QDJ@a8L?I49z<0Re}fsWAv8a z<-W}1v6c9&D|VeI|5wOxi;xWO_hRWgocO%$$kE$eCP>IIo+?NnQ0x6Uz&JWX$c+@8 zT*b|umI_!vnw7gAjP5NY(z4p|VPMhaScNy% zzwC9+f`2FN?9!_<^6soN7S{*G_XYEFp7f&^E?JN0p`*7ra4Iky_1fkoA1*xtZ$i;v ztOLcxiJJuZgpLPsLiqU7D{=h!T63g!>D-Y|h~++C8$ojaByhvX5Kcgjx%eEVokT@x zWnQGMv=njg=x1l~7-@BFb%mp1eh85u^5N&??L%Q+G!JMsJLGgD(`{+*?vqw(2)H|= zYyQ;Lt80DTg)=EeD00WitAO;IDzo@+ry?W8vC2;5GqZbnzfTLE0MoLy2I@r=?&8j1 z9;V_2NHT&Jd1gQ(g~eunQIHzM==5QFiMeZ}+MWMzG!6B2ao4g6{@(jkp>JQfx=CO- zz!aS~)rmg80ptEb3r|Z=&eAl846k=EkS|D~*L9PDa9F~{3P_`K$t&Wd{NuUJL`ue$ zG+#BUNU4_^RCxFJ@>_hua=4I&L9z9$?h+zvcDVUPtP;vTwFM^rXNF`mUj&v1tpv>u zTLGbFbcu(ucB^wAHB;I{ACw~@L0&f2Kxln+sd%JX89N|<)!Zt$wt!S@MtXI}dmHv+ z6C7D)5O_Vale9vNF^_37w}DLQ`ooE3hxyzXA5h9MOJ| zhnfBx!XLAVa2gAoc=@ED9#4pzfB81_b~5D6$hq!v@`4Cqw`PFf`*rhw!HInA)5Z9a zQg9IS5hVpB01{cfDNZd#&Q;pCtt&AMz@n100&br{z=*6W1@t=R`61{Z9QIEtds^r` z9CDL+bAqt0(#jDmO?p=MZbB)yAoW{nYOTNiecIo(cyQa<>}#UVF)$DZruG#NoiUWyx${bOxYDvP*AY3Io=wGILbI5t@>k{ zMLJqfF0?-}%0j~H@NbuY_2bkAyVF#2Q3Zd6HK88KNF3?-^t7n+uAH;8v$wavi&tBw zG?H{B(Enifyn-SkV2L}5ti4{~NYy0OX0y=SazxF9hV6%|WMOH)%y019$U zNBlAa85eY#-0jR7W+wYS+s7!3h>MR;EpKGB-tG6y!ND;|&kQLgnH(LhbhVxN1y_!w zf4|4ob}3#i5ez0fdlFqgw$fpDK3Xbv^J&zei={BS#Cp?&c{Q7XZG)0E!6F}_sF?9e zNVgTMIFQPBOMH=dZlWdjQ<;yC(n>g}OcE%^@_+!Ww_0d4ef(-90%5bNblrJ2D|z1ph_~% z2f@*-ZjSj?zka+%Y3|!`TrZSnQcbrNT0s+Q|JiP;t16qGl1DQgDjDCNVk|5r$tv(q ze?Ce+kil2J=^8Hnf^H8^>-@%_V1^tI$?Qf6#u&<*H2-vxN zpX-=ppQ$MYy3enCA26wzetM+O$%x@Nd(`%9yl^44%;=?sba7tO(ThY2xGK+N-~!pd zsmWOZZ&YynmIC{lDFi(`Q83aSj6}k2cL+TluL{Ly>RvrS{#fr)WAc z@BVj)*2dkwO3&E#s;m7%Gt{y$=f|&O13gllx_YWoIVu<=aZshd&U9>t&%s-@@!9lK zX@J0e{pr&)i#3|{iP%ct_xSuaGi>K5>|s&s=VV^NfOXM>DSs~y)X|rtK=Z@BQf4wm ztJN?go6ee5#n%RNWd>nI6AK@$07D%13%Z5!=_V%_qWMhW-;)SdWzHn0*o39 z=q9b8%xo3cQ63qiGKv6SlzGCk08&ZzV-Ig z$w$9~s{^xU4XY1MaNs3kNE(|>b_@MlsYCAuN)YtGp$c@qc|&bLl)rS*#T9<|*S`%u zn!l~#;ucTa%CskwnL_0L=y~J*`}sfsuQ0pUCr>z#%wa98VIDx8Sn-7TY$AV_ zYcLB|YxW;kl)fzzGvy=wvr&vXWb#~li#$W`=k&Ya=YIT)?eK}{#_~r}Y|F5C?v6dy zbguK89ot%+PLFT{Wi*}6-KMaU%UG|lSW3y*=Z=lPo<19e#&?X}K4N`_!r*Xr>6T+> z>wmTBzs`L1pj+kkS;|F;TbR}}8GO>JZ;cLTIp^9hS6zQQM42947y1-yeKs4Lb69NW zE@ydiSfMi8TO)Wg20R8t3gRuKA5{U%tSGx~i_gnyEMma)=Hk%wmSb=ERr~i-5x|U; zZz6{5u4GVq{~xx)%_-Qn9)bkF5g!Byt8c8K|A2Y=&RI=fXXkt}x`(&q(20~7*h(O2 zpHW}Lln%06j4)R^kuB(OIy)GqxY!bKl9~QKXTEX9{1dPC^zq5IHqdL14q8jN2K8nk z$rz^1By(4!Oie40vwVnnw#t>L+X`eE#En+4p@c^VQ}vDDm1+n_ngHB5Wk}?yySC+w zXV_hlGAT-mLqjTw(tIIO!N{i+QY;v7Rkv8u{{-pkjHQFQW-4uR?8<)E@$H zrnRC1s(|-_7ZkW_De+nw1l$vdT=r~s+c-~h&|$Mufb2>wWky*%h(S}Jrf%V>W@vzW z6)$$70@{_W0pu1U;U1|;(195IdN7s6$aN(pn$Wl~3mLvB^;pGF5N2NP)4~?@uw%Gx zioD@|z)cAo(}cC|9k7ICY&eyTTzAy(tXEd*qr_<7iim#Fu}sHnN?iNi&&{)M9W@N3 zBh0g&0n;%@fnqsa;RDV>3JVEmG-wEldFMZ1_Euobz`*}FzmmfGgJKu*R}H0!#uE;W zdKO@*kejCR*la~3wVI!h0!Pl%Dj4?%%#{QM$koV&VF(<*jOW}`eEGS1k)Jq2y(^C9 z#SWqTlhuF8GeBDL^H2ccit#2P*!R!YpMS0R@dhZaDbVk|N~b%;646y@mFW#a-jmf~ z#6Yx69{LCl^Y{(D=?&VTU})~%H8WDdqW~#ysvH?E8;#Vkl>isA-8if&m1NSVMx#g< zFDc51K)D!AZ~}+lyaLVsFpk-r@D|K`{`p^OfZBA(H+4@e6&v0Vfy6t|)kG9y#Ws~? z7d3J|yZ0Q){0Jt$$zX2?SrKIrUkVa!*_HZlI;8uH&)22{q^yXBgh#>gy1|=0TW_scDKk5faQ>^Z zn6&qA#x5cMW;bOUYYw8@W6JGZv;anMzSf-CiLCQpi{iALBbX~egW8sSDUKraS^mp! zteVS+%<1wJd%JoEvCC+%^qO7Bkrl&hRd;jaew7g5Nb=*JXZaGhwNt~i)a-_jWfoah zO3GA4S8|e|tJzGZKnwe6{`Zbdoo)xVLHHK8@1|JCM=|OFwaQcNVsVpfx-Isi?$RIT zT-IAqzDPS9SpWf1P^0e=hY^-CQoHav1-bfDBAib;ldh78_G-J=$a)Ac@~0O6W`%3( zkuq$G({}MuhsUX`wRm_@IBLW5Kc){LJGdD;y^s8XmlfIZj!;XKQDR zntK#Sow~HNnS&yUIQiyS2wWtr#BoA+p=9_`Bdt=DDJZZ}1tziWo8IIf;0mqOutqT| z`92fC66M)P#i#;u@!N5v;>m*SWemiU1+I$a5e8zw9|3!+B}GIKm@SLa(3^Cy5PvCx zS;UhCq6&s96xV0co@@<-+1Fkf7Z>Ou(1Mktkgx7Dm@kO{Ll%|A-}S63Bu7-leRr{M zpn7LfG0E>KRuxUL=NyISxZc57$}3DH&V1vTkzlab>0=v$6n48eli*kFS%s`puD#w` zzhuiPS)9Lzhlx$rKMw{%RM5RiY12T zj-PatGesgc3|0A?9DYYDUj&2GnDjlFdQb_&Y2OFs&DZ=jTyXgLEdR8^G!gujL!*>j z#~O4h>LG(uM;=dNK`0;z8v;_bJ&EB|aOMqA(wm)1ure|t(Q|B@zp=6~MBs>v%*f1x z9SA;S;{*QI<`PI91umU_Vbc}I{m~-ew${C-G5M=<1h08j#QVJ^pT2Hv%&)p%xdY1) zC6`;&=D2;AA#Y3wu_|d)srNgh_9whA7B7G5ekzc={6rpQqbxa&*YZZt;!wYNY{D6;k~bh0D>28h?slyQPc(*q=XJ z`|$dA(<8vmNl~p%SFN-?e-|7zk(Of9yv;m_QnJa1@5Yu0@!OZQnjPR z3w5}@EQ)W?lIh5;@eJFM+}AHPMGmRGaj(`|1R>fuCFDxj(7Kaxys7aqMt}#!R62RU z$vt8}O??6BY71h4da^Kv(wY~{PHea=U#r~#qCdGIlJ~)+BH&z%!{cO$&3r-Q@NqNN z8v6r@3cpOhb@@-r$@05UxpbagyHz=)evF_))f|E4t%5u`HQM*>5=FJoIO~wV&*&r) zv`C*l=dwtBqk}h>zA`HS%!BD?=i<8GAL$rUDkpOV{N`7b&Fa6CUc0R{VCBvZ(*Ftp zxe6~LjG3>xEQuOD`zfqA7LqgfC=#{T@`)j{+l%MOFqcW3GF<+owszjo ziy-A-L~7tCR!Bdgue#%mh?&&ax!$^gllQ4yB%42QU{a_8QJ|^n$0wP@HF(*^L3eet znM5asKaf>|e=_^@3o2UmW@}*eDKLDSoQz;xJYhEe^>G^4>_>cq*D4A)ea;zXkwq0C zxu#i;u3!K4ZXtGApE3HidSd9VgxDtru#^5(RnItEXKMe%9cq1vrl3UodU*2xyV#^K zJn4S++R)b@%R$NTyz?3?9b{1rZ}h%MT)=kpJvHp{-TPJ8V2Fm_^kwPjIxU!*t=^~W z^^;NeW88p#-J2kceZ*z8+OzYe% z%J*2VM5|O1_*Z+&Sf*l(>NG@`$M2r;safbs`2tBIckvl!CINKwzI`8D_6zyi_4gd1_?Iakpp_fSz8sFE$N_z<5UuhTWLFv+f_Bhkh!BH=SRzuK z9CblLvHB0#8}bU&ur!zifW?j;#2FYbKB*1#oq<(WpkWN7ZECDUBBSxz$5a7}xLg=) z;n#sEc-Nolh~ILA8seTI!?0Ts1yWApx^ys^u7xJW<=))azeksQ3*qL1z>rQsaUf;V zX*;;G_Sj9p3IVuds7b=@{`nVo1`aq42Uiltiq6Mi=cAH%e!;kXy7}dH$rmQ8_K__n z1}XtDK90-hR~n<}&)T0<)?)2b`_+yx30I^>4^)(uhaw}$gA~(gC;{1X>fAnW01LJ4 zX2gkgOQACuPSrc?w5b@xM$?zy)Ool7B)(8_zKzlZcKZ@Yy+@4e#S_0~oc>%o5n>go z!TX{_+AeTVF*Re6K;GPt-(bfojAEFlgQ#pKkagL*v*Kar$wgGmNEF#Xb{iv2zlA|I zNt0D@G!djtEZe%Y>qu2_A)5>WvLi0{DkUDObDrz$A`S!{P^r5xUu2-}BU#WU&2;^C#ZBK7|GkCJ8@}Vh@>&K&xLWzM}&ss4{e7z z%WZ$>J6ub_YbXMnO0o}Iv#=ytE(eONY|E9jt&oMC zyPc23Eu-Ml*i>Q&B>M0xB;AZ9w7)yPPh zl4sD!?U@Q0g9dq`%b%gafQYtCysgHxQL=YtStMuefuJR`cUHw<$o=Nr2k0)k#x>y3ESwok~XG}7UFC>Ldm&EO(e{=V6K6>y^}BND07eT zC_#cE7?l07s)ZmSW%#gX6_HcM->P0;ZlZOink>3Vl9z_Tn_kcU)mgw zJpV~My1P0C1)K*mjz}nTq|!n$eWMSiwm>{m-Fl3WpCxd=3*k`kSn#rGNv$B@Z_I+j zzfR0-mmdMnPBlx4^`#QFyc)i|M#ru7mIdB$)HLiFap@nMSJR&8U5|fW7YpUK+ykwHK*s@ zP`G91zGwNZ%IE6r!Rts{=jS%ZlYz_H26lrZPyG$_T`)nP#wZXq;N_r)Qe9oo@8+0M z@%_SINo?WGa`#vAdpKH%StkvMZY^Q*$Aq44G9k^ zA=mxSqlaAsBt&5fpI~dqL)-lGiEoN{8eOM_drHaE18u}Qu#{gZ{*Bo#b$4w!@+Ad@ zK~>`a{oTho^urO#eDp&Gl(6%z`}krKh>_Hj?Gf+*{C_uRVuSxvaQ`iu=y~Q}ExrFO zE?$z=0qnatevbbR{k}3{>0wrX^f+hjBhn2Vy^^Sn)e#U4;lI6t@bE{4oZX~S>$qH{ z?XEpq=WX&!Pw`AV8_E#H0wH42Mr19WLeCpRa{$zBN`|8W0`q?_7e-U0)FZPZx-?Bk z5KrW4X@BF@d#)~^>+;zB?i*J`vU7x8@ zGX(PA3mHis!e*61OV&WICWDcfWbq>!;3;~h*WUjb`vx!&x311kk}+`u1CkrK27eQy zpN`-Q;eWtGLsx$5@D1eK*{saZ|I@oD@ao5STx4PS9!^NT6_u3@PeHn(k>9B)00B z3Wj&hbxu=Nc)rD91L~J?e?0$h2;aE#a+uhhJ6!kApFh6wPq6%JCVR1lGq&+H#@#j3 z4Xx|T#TYk}asQH$XnPkvcBuE5U#zYx|GNF%c&j1{s=$18A-bImc82NdbJzK(PlAXw z99=>F0znLdej}&8{`I?GE1mA=4K58>?JE=P@*5$YWUCmNDF!>snoJnry8zHFc`+qs zy|#BHq^hO$zSXV_75Ny72C<_vfOCU_+Qjh{0KdZAGOp>WH*mRfFHp|@ z;m2O27)*p(DQ~3k#z(>M5w-n8Mb*haUSf}6YB zv>k+I6WVD_YkCf^z3z{D>7R6TTfziOEBrK95N-KIy zG)jU!7?mMMU}3sr=>FdIBhR;`1n5y>SRAXP77t?}PM&F6|8TQ*uCbdjm(As@^bE0kWPg{!N>1 zFxzCUnJp6q@E^pH#iUXR6U9?+#>};1$c|3XrI7l9HHn8Y)9W*%A4yWE1VTqf%1^j} zlLKr6N+Lm2aThySvw(}3%BUBo+gU|cY0yh+v{<6S1ARfwOhH-uP3uk>1pUD!XeGQK z^D$%tN~!qeb#0kV#Z4780t8%$2DDX>Q`FF<>9uA&QIT(9F1w#BUA{e^p?}X4tmV7F zlXwv)<>4ZoRC9NN6$NhRDCIMen^%(t)$){Bu@Y3WL88L+L1Q1ti+e*d8{;$ z6|8m$k7+l$z{?J~vDY4M%j)-1CT3>o`0d*AyG7%GF5AUg(U&cB_m0=fs#@sY zsoz!@{>m@gvPy;(i`ioN*QeX(*YkiLpL_c+RPtC!CJMth@vuP!{7_5tbR%!1oeH;q z3x%Y0&?@$mlarYu*#UHuO_AF_nyNyVgF$e>K`Z~=L|FmXL&t+0kGs=Vd`e@#+j&`X zzdvQFdE47&gYP4vZ|r_gH^y&Q>Dt=bJx}v>jz!RQ2+S75dGKMt5K?hL!TeG_Wn0%3 zE+KLQk%Y?eK&W97(<09&F|6I5hmZn&`!Lcs_MTRAgpya!5u7 zOu{wPe|O#g*$yKHS&=MdxaaWKGRnc3N>MBsI&=20ty8 z@6Xl}MWY)$&exloxTOBgmW=1UzZ_^+eJT**`+f*)nV&;XfNy5?yq%FHNBFVk|9l!R z`t|^AwzF-0+1iX+>Q9l&`ezYcic1TANVm;-FFxSK9OwM?enZwn=;dMnYSt(|j!wdd zaZS4)mq;xufe9;GG_Iz{#yQ)4yPyw(U!}&KEu2xSpRdv>lAqx|1SPycjf63=(PC;d z`JAY>&1DXke|~*`d#&rb`<&r5`XVd(gjtI9C1$wiCjfk_3j!-&UtXoEyGZarH<%oz_tP?J zCfLZ^om~)91HqO2~$B-Wx zs|;wef4lVP(G8;nR8l%eh={aGNQVfBbl2z*q@`OBlt#KngLE^bMmLPk4gP!H_amQn z-#5Rw&biKYj@8?@6fH~{=Fa9<=mRGTZ!-K9MNVj|=TY=A6(4D4P-ka6*|#F}f8@WV zi$Bn*n3(^ru+#G92PYjF4`&fk$=`oF=N1WH{hfVJRuzoB9o0RM24DYn_AL`QsvDM&()-UXl~&qaq-dG9bq!7uZIH^Ce# zajQ|;X#Nm0nLroASz3^-JN!dDk{qkWexdH^G1eV!heaxuJsXa$lA>`RaV(ZqgVGJU z;&h=ck}ZI+@(`W#zyGn5>qpu`dhzVL;8Qzl_P&9P7#gbc?{~o%A{Zh>+fMGINl(j``d`*TK4xXBz0T%=2+u^4AP&6`u^PBqK(yE}Loj>4L2`DI0zBfG@ zeFR4i%026-QGdePWct_X`;#A(7@CDYm`8D@9Yo0FKazt6eAgtX(=5-ww&UXClztP8 z+-G~kx(=0y9R&r~K-Mr{dSASy!ViAsI?UG?HJvPLMixX7s!G*x*&oZ8XrZV``Eq?y z{pCd{CD=?}QaRC*2=8TuW}38E-{E?;?fwD}tzj zo&7MIz?m;7cwQV79#uHs$%E9%{Za@N9An^ z@H0g1X+*G@3QD6nb^NOi0G7e>;-z%0Kd!|VgLsYL-T1s?#sIuAoD<&FDppS>}u8Qb(bv!Hn$bW8jglV%D<^>J4fyZs`i>ZYYr zS9(-b2<3UABdb*ICSpH#n5e=+FX7DkK8&2>l{>mJLYG+7Pb)ov+; ztB~i`21pEIX)vu4DIV~}9BHM*?r6|msMN$bw>inC!9uUe7EjW$xn`jOqMy21v%t4I zJJDV|(&{ro5lNuOp5`lChCMIG_q=Dv2d$cYk4sxMye`M#z9k6s&G_)oCU4Ca{YH3^ z^QQpyYzgubGv_EZntjZdoK3bjHf8~L{{Z)9yWZs{k>4D1UbNJKrz+H38@b~>58Pj* zEm04Uo_v)3C)#S?$T99dWcS$lV6%Jwx}pEHNFluxhfmNzf(>o>bjmhxFLZK`f?q#i zXZVQBm2X+a8hZVyKen`Ao}4RHGcMC~;cIo)QjuUZ*$9#+0-1d}=6%gVXq%A+g`SSD~aODI`fzA5T_M`(ca2Z)g5 zO6fIWdhyEcA)2Z8j!P?>imyTMalT@8j|a>@A3a~!q}e$YsW`Cn`l#!IsGxsdR?>Wk2riN5-MI`|(e z#o;S(OGQkDHGomp-{+4`melBd&kQiEuhRzd2b2$x@Mp343;ctRw;3d$J|^H3%GLpn z>aRgxi+#Zuk<(gS!SEy3rfkkL(?MFj?76!x)syyp05VG@6*3_oC%`yy6%vP5xif*thq_Ny$aA2sxSPtmcMzrAS+igup?J+?i*5PLck($^!&uz z7!%B_Jd12A_Rqr^7^T%gB_(ukP;5cMt8fE>D#N-L< zTJ@C14o+A+`efaQrWR_42=QB=cyXiIIb+_qj`hR|_PZY{jbU@lEWW<-_ppJf+3ll) zmvNK8rupoS1AwX7yz*iPb`m4SaijFJ4`*E$Wljrzs91D~zUSR|xy>jp+Tqf}H!8lo z)N&YICWgGMTAOk`e`@s-Oy-O6xuV&4aCzY#R{m;xg3Z@GkZ}zy^4)UPK17i1hHnk0 zg*J@1{r_`PIG>M-w=CCL<>{t=xa$&M_nQL}_XI&Enl3leXPa=1ZAfdE=$q!WPG}Wc zd+R@g;QL=+@kya+-p}?vQ(WPY)dCV}93lJMJhH6V@Mgpn&fzS7gUHi^%sjyowT%f6 zW))=}!PM1)Jk(5jsi1Dk`7!ceC3xjv`0rOav+_m=>qThif~W;;W*2H~QP!X3a~#6d z;>=rSIF(OW>pwDen`~Ody1$l(WQtfXs2cm(znr#r?fI zZ^IKJi$6CCsJ}p*q74E6SPu(VwM92)w^VjNjmAmK$~s45f*2taVfS5v2!0_G{-zDu zRzy2EJ@H5ZkLf=;v|E_~Uob9MzVpa)@yPRrnG}FU-d#oM{CN*x6DB+dyb;DMrhoAm z@G0lf@h#^?nBe>3->i=7j#AW#E~TuJhqCbA8oyjW-@kb*^hkroam2yJ7Pd1pFHHM5 z1|Ut`(lOl$kn+FM=Dz8;Q@a;HAf)cbfjb`lA-Z}NZ^P_-f`&na zzOr&1lqCuRN175Vn8!f_)F{Jj^qCZ=Zjn3u#ZL>TO`e`aSS=Fh0@^i8^!9D4*m ze&~0;JFFciTl?A3Q9c#aZ63N3H2Ir)>GquYdgWkj$W8ubt``qr_sNqErwOR|PE4${`=Lu%A)m94Bgf_$KIhwO z&-lB5mJ~9$VLfZ_+{ls)?$CUe4R+cvZq91W081z_Ug%4EN-lMtXU{?+=X22AE9RaeS!!TP|D4B0xzE;7&z)UAyN8hI zg9`!Cn<7xcC)PR~Uq1!i%hj7x`#hi2+mILfqP78aFkYBEDJx%`-N|r-;xzZdzn$^J zsoWF=G4=X~U!q;yKQM#Df+&-X@{O9YSPoSVp7I3M(VdcjZ@g^?^+yqOQ%Adz5Gt}_{Dya2G7 zJBEP}w!bklG5zIisU7q5`!|Plqa!e_M|8}<&Mi$8+Mr*o7uZwL#C(r&t>UOVm^2Ol z68ec#`4$@-S1c{3=QPlr+kXu{@YGR8P+FFF&t};iAoHQW2 z7Bqwz$q8K|%DS9}XB8e%rnt1bPoT-|mfuzbgj?z3G(T`8I(;h6S`?8Ddtk1vWAN zBGfNzJCDWr_+O{OpGe-B)sd_PP0t8&a|24Wsk$u|DskE|OB4lhR~s)vg}XBlTALq< zA1Z2EYmaaK72H4cD`Fb1SeI8<3+`U+CwamHfIOMchArsI@QRD0_uD{^^Yb+vyFeav zmg)xmWDl5f?~Te{VK?IhE0q6-V3J{nVO^#{qJ_eQa{$H z$P#Z+8mu^EX&BFpHlJyR?}SB}QvcRuz70{RvtW0SkEGlM$iLTF&EvY3uaudc^=z>9 zIn%1NU=cTDQKeQcUwL;u_@d&dXZ(Dw)~Uq~9tym5bF=&7z-nIVc|Vx161-IX_xZCF z55_qWr}}1}a}Pela;JY30|t!+TN;d6@Ve7tJw`(@IGW=75DzvmG2Zo*R?bQI`Zsxo zwFX>c&+X%pbm*>xLXXa>9K9fb*WTtxes{c`vcAOPvymJY%@6&)?2RH}rA!0eDOkJ* z2Su>X_bbYZq(g$}>935ZrmTgzv<8?sRVn&J+zUXPW-fg}9SxsC!9cg^IUas~ z$THZ}7`0xjP8jn|h=8pT&HAOLraCUSP~WanB?owVUZH>8#Y{+T4Zr>rjh45tfif7P ziX(5aEIlJ_&?MUHxap3E%c{vv111ob3>sl8;$n{E6ERFa%gmjg0-9SXWy`SW>*~h- z21zj6@}EL6zKba*f!ZF~G=z*&b{zHr)i6eFu)L(8o04*Mk1g;%N3*1G3c|~A{kNdU zIg*q~#{VSYB#TYunn|+lakVQ{g&eYKZmQ>~5!-X5Fl!6@_!7*@eG#gp<#AeNM19ec zFL!bHz>ng|j)c}k{e{zOE7hgf|959LV;2!Ot>H}pWuRzI7NggE?WKefYV`zlU6T(g zDXo0}KBdIwQ&F)s6-|oyg0_gRu&q+F0ayafybMvRs?k&#)V#3!_lH{k?Nq75qUWan zS=T~Zo{hz6LdYk9qV|nAX+g@)#|b51`^A*nNt1EqK~+cYRoOXy6UUnl+e!9p7Abf9 zlBoC(m@Kx$bO1p&vq03PJZrV<))4sNG(JiO&DN_U|C1XfHQG*MNdeYZDb5bjWSp{c z-%_(1Iw`x4mRtcN!|WtVulpjq3r#L-8-fj*c()ev1gqXnQ%TfSGo_xzZFwEf|ICFX zcx=Qfg5}@j>h=VAVyF9Y+GP$b9g%8d+R=c=CJQm0(g_jQHz)8nS1(#%K&tV1apywW}Joyx}=D#rphN z@ik*vS8zVvLF-5ES4!m|9RH8gjG4tl{-+rOYbtI@d=(Pt*2Ml?g=u3Xgo1;LIC4vy zhf_7WbicBuPz-tgge%kRc_RtZx}nh909 zK~Hi^``?_PO;L`QTLUj9Rhmv)JPyd*&=%uX{olG~GlXr{sq`3<%*)^F>UK?c1O|R= za#$2&0^h8LVq)WsWTIK+EZ8}_d>u>i&f-3RpIeGnby8clr9<{}@2)}~P%i}O5cM}- zg7z-h8_XWHm;Fd4{FKm?`;iGN<-|Mk#d#s@$Rk{aH3WmgTb49BfE~4}oi=c}Mf5?J z`uT79(CX5+dLIT$%RVUgdF?o>tPPG=k<_8#60EwiEjuN(=8vnM&fwWut#pG`$`)%X z9ci65z@`#3fm3+!EEJM(Kb<#=JO=U#=WT7)hA8T#2U>cG6qcX<{4(w+DGy{Oel`6q z{g+@>7J~~CkPHZ5&fQCpuI&0HyPGwHwDpcXz)f3 z6+RyJasKA)Ov0y$T1+_$i|DlpYM<_3u>wk9?UA$-UJ+h)5@rXZyMqQBPaj2p&|o$v z$6fF(eqNq0)tG)>DB(vAkOvjeoGls z*&plz1NMv>AN%HhmsGqnyPK%Jtk{7_baT4zV^hMK#l@EzCykFOgwq&IgVq=IC1Mft z!*exGjZVnBZY7{_n$lsDx_|sULm(bG9)5NgT(o{{5X5GCAHA?}R~2~4c-jz#?vf~r zKayhkbR}b#Ox9RNu|?2X+UlCOCBOsbM4xEYv_=z%Pd$!G7Z={bciMSxK7An7|bN_19oEc^40{CP!Cgpw+Sm_jgsZ(*TuLzy9yji~YarH2@3%roclhnV_*&~ydGrN zE8Q~Su}clF@lxbgLvgzw0kHin8y}3HMm+640+T-ZIB*}ZKyJ;i#`(!| z`&@Jf1nvDuydS&K9O-L9H`Dr6@=;sB(Y(uU+TD`t6ZG}=dj1M6K+fIKJa0rH;P)e9 zGW2%0l{)n^=?23Ywp@zMi>KE8+ktJ0$e`zvzaATweFG#A+8s8pDi$D+qqtgouUymG zjown`l2ixjtIgp-ad&3((4@jh@^%`8OuchYq7ig){(}ik;;Sz)fnz&r7bMHxuXY98srAPH{$y#T%$`;+%SaFGs~laPXgbsjK1)Vl{do z>oco=Mv;4SX+uRD?c(kS@YBcpgC#y%r{kqUhe&Xxl)>p}-j&9o;yd1KeKx_HuE#Xd zRg3NO90`xJzm&iu|3mWmujM9o$d4NBu5VRpNi&O;S@inIdOQHiI@y{fi$}#rb#10K zDbh)3l3nhq^NAqB>lZj+CN^-2ajni@x$uXCTKIvro^AdqeF zNnTiIVEgoW#x(?n$`F?`t_ByL^)CkcsilE|S=D5B9*7Ji=yC5<|J6vx+Sp@z!G_s_ z`>}!>FoaT`Wct0zcSlEDu1clxFwFppmMI){e^?}XcRRxNjy)UU@M0x_MThH2b%Ma% zPPdh7KR5=MRdeDmF#k})7jO23wwXpBw-_^H&m|GMssiFjp4|GU0ds$JJ&_#&vJVU! zzC?d60Sq7wcAJ|T4Xw;f+U*jTSt(2G+yGGO>MLRaVbtM&#t3GazYKhwJPLe-z?|~B zYo@DMn$OeXm+z)kHd?N}9*6{`q6=37U0Rs6x&MHvLjkQcFduM~a~wm-u~+H8)}6Dw z(IQI+YvwlVgb&ZvbGv`^PlJlPLlF_Jz6(;G9R*f!v7`G1sSCTs3N8OesEd~+z8o3T zlL8|xu z-0z1-P&j&J-AJ`U8c1a+TP=9h%SZ?1pD3w%9jeIWQ@)3oJvgHZ!dji*#LucevN@+g z36}A=-1C*A<_wyjHz|Up6zx6t;;oR^fI5XGX}?J+m6NY=K#K8Q&Qt_RwMXzL+}Pcm ziExUSniQ?4^$B%LRUNBOEUcM+W*G%5^mp&)35RmUA+0BIq<&%~?hxs(1K3i80+w4u zHwNO-c83>p4$`ZmX)THrb_ML>GVX3a{*_lZaKiDKg14xYh?x{Qf5d~n#?v1TA@fz) z=|1bGZR+ZM|5;)9!eZ75Cep!)nREVwTS>MJ$W1O8WAZ`U9N%E# zaD`1KmF_)+KYi*Msqc|GW>T#<^;czxP6@YJNLZRZwmpp#yeulDH`6YUm--eT&8NS;bc+#aeM_n z5P74CeJ9RVvC#7KJdzZ|JxSvn zZJdU>f#)S^eg&u@ zlBMs(dnenVKjI|9oNQ{&!;*f-BNSDEy`iaxmS5cs~&OJ>ncYGiePG0wIRTw^LX> zT(2-B`4kkDx5yRY32WxPQT^}@s`?^|D~!0d<)pjr9}(%{%ER1*4q44m_j!phAysIF zp^Q^k(pGE37jlrTJZ=`|^|nb?+DMMu?%xNOcQl(e*;z6Hb5pu8HX2$Le18|Jt-yDG zeh|@1-dZaRCbyWc6cpM>+HJ3s_oUILT80jVb^eZae?Z<|Y;X_95HUepgt-OqLbRiE zg?BXXvg?(@ty$uC-0z;okNbH)Lap|=qlt#kh={xqF!szXz`BQkceuakJDU+oty%X3 zbB^Ab2y)eF-DEkr?%T3Io_%khnCHnn7X_EC_WrwYp)AgLh;Uf+a)P({Zq66|jM2lR z=HkF@=CYeI=JYr-@O9YhYlJhJnY{NuxxpPJ<~40PJWNy)ez(nU*7Bu)7UP)Uq6kbR!glkYE2v* zDtm<3T?cc_>}833+Vl$CdJ(mDj`Oj9e~wi>fhRB0L3Laz4OH$`3#2)o_ph^&k#@>E*eys+o0`g;;Hvx5~1NbQUyHLn~gb8Uy5=H}#c)t4c582Ui!djbt^u_uh1+&A;3R%CUfh z+9po$v8xgeLa!qn;Wak15hQdcJjFw(z3EtW{f1*OT`w8IG3mf>qUL%JwC$%TU1JW| zqkluclaowO$o(6tF5e0Ad8qka$?&jRBVr+*YG`=)-P>(+khQl=WgF5Gdv7pU@|;F= z=KWZ%+}25rFdpbW(YyC#E4&Zbi&Xeq)cj3G10GqL0?R@*R6 zRqcL!Vr5MsLwTZe0A1g(I#JtYe^$NjPZEB#e1|`>wX#5t`@TEO?))j^cVW+mCEO2$ z-b+^_ZR{rc*N4ka&!8HN;^k(IpW$5_`IC`Tz_HBM&Ua=|Hv|hu(PCNIGKr|2k(X~y z+z%w7Bxeao_UXN>5AJQP&FJ4@0bT+AOc`rKQ;UqsNvbF|KbvurbO`cfQkeejL@SR+ zjsBT@)oVE~Pf`t-^{4E2p-}7JzZs{*21{Kp=2a82E)N=2o6b*W+=(l&f00`7uCbMn zY2+vEGCUKu#ZrZ7TtIdW*gEmvxl=lduvpzF&_#uju8D{&SB2HF3a{Zn-{6siz4DAE zZ0Mxg57aG|Pxqky`dR(SD>c|pna*UhJl7zlFi_NzG6#BV?{2@7G0PwS{F+vidF<~~ zOlGoU9bY_%ZNZK zD09KX+oV z&|;y$SHtb-_UHrJ@)guGvVtz7pLk5TovaUN&Pge}SP#YW*J05Qu6qLx*5hJ-IuGbv zp0j4vk6t=S@txc6u9P6n_rhvE?xnU^ZzaulNVBzOkJohK?}Xh^;CN9DIEPfg>pFpd z0Af)1YovVP2V+wK9QV+ff4!;FeJ6d&=SWtr6Cr;evNeEz!1`q;P|DSM?zg^TajN54~dni_5smqysD$-B{tA)GY7F_x&$A%bV_y zFs8tQiOXIf#qoaHgp2%=NxKT|#bsT^MIgQ!HusxWd9GLGG zj}JWt#_x=Ih#C$iS{-)$oo8|@VZ3f{(e0nmb9H*2-<_~ATQT4dC`Aq!F~?lI|(h+B3*d+o1f6LR-z^I-#gNT z0A3m$dbSQISqjKGG7{r;QS4f0(OEW?;^SbY#ug6lrJTBad>eMlIrZFL#Kyn<6kCpd z0zOwUum~E_%uNx4Tx|O6RMSf?&8#G*}_v?t#{D zNr1@pn)-FHI_!b>z95F*0OE-lZdgPVMiL#}_j~zPYwWP(6A|Rx$y+oY%?->!Z7kCO z8`4*Ch#8I=w>&iZoj+~^L)`)&WY&Y5NZWaw_3zp&nCM>Z$T_rJY3|N*RH8z~-3xb! zn(FW=1+d)r9a}@kP2F4IS2?EczB{1~t=&JpEK7pPV;2`jQ*IR84k(T273)^sYz*Kx zZJy{#l5-gIW)OlY3;KH*zgFX)G+0r1agh|zF;s9BR;7JS_%6R$Qjgh4>%bmlLi;?I z7l2jaw!Zc1AjNqYDYB2Z)&(0aaIWt+{fqSm8%4`Yl^TslaTykz4Bba>~P{$b1gaqi4 z?ZJzQx%!TZfOs*l(<3VK{CB|JjvM~!36|j>MnY0}h@c zqbn$Xi2Ud}=OtF@9g3g9)K)!JMqK=$5)gyrUu(%@-wboT&nDMi5=?yS;hT~05!+Zv zKWCN}_GKBAf2~{TXPg0w;=ow`2FaN5F=z?%qkG@Yl-)fA4zDZkwe+z-yL%LA8^PrF zP8bT{G={lNO#FQNih^QAl&a4n4semmz1rIeUFRDcJAHjMna?ClAKF9l!_xQE%QSDz zd=xD&7gXroPSW0o1ro9D@g!%1rdo?vDQs2&;j%1zAae zVWIzhK)pU7gLSf3gr$gjETJdV^KD6E;Ej>=W?u)la;soQL4GM68_uN0hgn@i>t?F~ z(lTKZrJ^OAhytI_(c64RF`Q3dTm5?8*lmwd`H3e~uubQn?s<@c!0IXH)8o{LOS(j7 zB_ragR&5dSA8aAz_6m~DVjJ0(yM&2YkdAEneCJ<_!Ks8w#^gacauiymy-zW`9J)fN z?O=M^l{ALyfCQ#7z(rpS?Ks*cYysV`FVWIcRqZ-OH~!ewsd}HsZ6j~b^~;S>*W9@m zfbS)FzQ^;4l&kL^z4x60{Vpae%ETvg2^B8GOU%5{B1daUGzgnPYt#p08O4Ql%~D#} zclF=y2pD&GE+@x>$xr-rY5~`vpa8^ifH^li7;tqY@QkPExr?O=?Aw|YdWMuiO8kq# zn^wl{fqDzwSqWSeWdK#2UiB+7mzQW`-rF3Jhlm#4K57XD7-v~gNi#{9WbM;torNx2cl=NWR`MeSD40Ihb|E6bI5p%&tjwjN`rc9|vG3)8;)|MRy>a11agohN|3?(LV&t!`yXM zIX>6NKnN`1N@Uo$vy}A3@9*>wPD+njKDdB@B30b(nC-zcN{$7AZk%rFZD0_3Ds4Ph z*6(nJ%?0q)&DlTL1cca5rYOM1-Sx9+==#3-hN+kfk@xkO zL?6V15}MsZG1+mnoq#UVd5rlM0WXhSMh7mXWFzu<$Wl$wBj+vmqgToufZLTGetNyAsi`vo8Uc+^s zjgX0}?Eo!VN~u_(?4rGk6$aUa)$w&|C?>%kY}iPt48s+jH&&D&xPS&q5oGp4zyIkq~4MKrQ%h^ptCNrB~#deZGpfRb0H|nu> z5rE_S8C%obw%3}R`GcY$hNp$X=huWK>x$%R#4!5TOyAs;;Mt6zMxGjy=T(AKl2$tp zQ|m8Mz=)06XfY5esd?DPKW7;ogq(f)0s&FsOe4gcv0A49^0>E!om8eHCzB6`ZGb95 z5oCAuBC#FS^ih3%ABT#%_O1~VXS56_H!c=A#JRm(OMR6H>+edvG^p!3=0K4M&u%$L zw8!bURAsuKa|JJpsx#l~NxuOvmfq#TpOazrh1Bg|!*lIV1|#^Fm0vp+v{UZ#q~n;7 zOBOIi#5z;$Me&9oRrJ=iTmlqjjs7qYs(xc8RDJx;(DLlc>2qa+Vvk)e&N8iy_Xcr1 z-zFYkRHQQ93HF|CqpJ8K%|Ga$3C|wnP1be;s^8oQx!GW*R#UI0(dJP}QnXe~Wt0_u zDqb@0n4W%<@*RXMGM`i5F12R6BO?`!-lh$!$I{kUX!&3h(f>a4{dXE1lk0Hfqm;V_ zuIN51;edRs(-BHq*V7~y?h_6jobM@uUyOc$B`YC^8p01Blew0Px&B=gHSDL0J)F9{ zd7CX(5c`7PRPD`$#f2<;%K01JQB?JBCwX!qUmnsQ6NWLn&(?;J^0t zo3)i;pQE;4=<=;fN$abE5M#@D6!8`_!Po=0mU>-sxaCb`^eY}W*k|mz8Tq9H8ngAz z4~IvKSIz~S?s;ZEPNiVXVEi(JOoG?D6OGeOc+6uL(5yPvj;aOp4ZST7SitCF4qqjtIxr9f$M;tSio%heL6+deLhBX!F!xF1q|8nS4DXnNri z;N$-AhOC`MM@>vH+CyHw^r%?b!BNvOtGXD0J)&dBqwosj<@RRntwbCOc5~I6UaMOi36yD~2R}I)Pmq5MJXXy7hyLNfdx^_40v=NZy3ngqs;gh zG?CUW^-)wS0lN}OUc|NwD!yaU-SSu^WXFi-!22j8$ShF_Mo$gb>-)o42y*7+Ql?_B4^9nkpbD&MMk4LQ0GcswWxaNPAqRG1)8cfgj$1Mf!| zWa2&xeC%Ph1E4&<85W1koTLBrvKnCVdguri_ke;Q8vGp5kr7VFeAsBt{nFKRa8}&x z(#+{`TnA+7>IfWgbdPepJr2!zXodfkJXrLEwrZpS5_^m~;Me_?%N-9JD~*s2;4YDV zXT_j#`wr1=Lp~ploE%Xj7x zAZ!5BIdiZ0cL@%4s(G?}HabbrsBY&r{lzHjwxJ;(Hy@wKL1INv;CLIiAxl!N3HMXt zQR@3e5_2F?7v~po&3GsAhb*%y)0%{*3W;U*iySfCuY6Z<(;NZMQq6VnXn-1)ft183PkYJYD7!n!h@1|NBzjmQ*JK3m#RJA;q_I z-71FoTO1w$n$Yfuo&^c;+RCnut+QsSHkvNR66${~|?7AEP?gn&2 z(15(v(aAHfBOu*-2eDHjDdN^Q8Ay`jx8Zf$fWv&>yF4omwSrq`jU(5uwN~aIpjnQO zdB9@F+tcN71o)k_-yRgEQe^<$`hwJdG*f67ayT8MSBodj5=1G|d9}j2m zA&aQKCq`o{3u}!=@u`PWx(PQGk9Oxrt>TBH8Bl-tg>|IU{ll^wj0x2NQCeTPZrW-^ zEv!7G4Y3dKE&AMdS-4MB%Ncv%Nm;(nsB7~6S<2mc2Oz! zq`?imr@Xm)oG=v(eZd*0aVHfsyy=x-PC(fZ{kR!pjbBlg7#B>q%_ zg!o#7=<*k+kk<_tGVS@14;Spj$7R2flA>X!)Z2hWcCyrlC*9-2%R zGGUy=v$bRZkJR`0HRuPso1bgUEN>fy^g7kKh2KwWC*boL6}h1En9pxt>7sk9pEyV| z_V|l+tB2Y}?Q>n#58s0q`}d)$Ko@7~qIe<~D_;uH5|Vy*F5d&hguj(WAcdvnR_zTNJ5q;vB34X{%p#M(ZRl~R0KYfUM2WvxzI!2-+?*c^%mpR5tyfl1 ze$g>%86V&8=<yaszHzN80Z7DiRr1Y~-ANe$*%FNCs zh$PiTcAY`PgLBHP=4_ zqXjqZN~D}fXO;)P&wfi`(cdgOEb5cq0_Xf9ixS;PH2JEIh*j8uy}zbZ2XONU z-?(zN1f1Sv3D|Ao{cF6#BFDhX!GN`z>oO3XYUt{iw}e!N)i^-z^VAWr-*0W1u{HFy zW69K5`(M56n&dZtYlwR?d`g(Y+p?7!yv+;JfAZ)sQk!xr*h`Reo}f>_Hwu#9Kr@=~ zj==sAv_HoAr?K>`3w4K zr(ABPByZRR>^5hNJA=qbbC0!)uC!Y~-u{keCjmY1zw|lo{SaLg&mbBt!6d8_ceA>i zh~4gcx&N=$FP;Uc2b*IRK7duFc^E=Z`t7TxL-3Rzc527%=Ul_-DzUXSG78RnBF62~ zBm~%UQ*_A-U?ji%9}HbT>UDl5YqLsUD@v(;^;*2|4san^_a-88r|I|xQ}z(C^q-i)zv2M9!AX`5o`HDp z4d7!5lRi9UzMtY!MwY1+T}hE{9$-ZABoJjpg-7nqNLMOp8Svmr9jPJ&qG)NQuYT&Y z>_*Et1E571ocY2);s(rZ1*q&_edE5CJM0GjlYj&{kaCBvF|`Eu2e$Fe1h%Ej=9TYzTMk(*7cW@0_-E5!OuH=5hR$WY7QmgB z$9$c+ky($Hh6ARRM_mEi1rTFz_05<$L*<*V(J_TTev?jez2z>tv|FT-d$Sq= zTK&7IfAcAfn;kzi@CO%L#(tulfDuzt|Gi0L*~K%QS)y@lvx8ODnNFQHg3mpp(K{Nx z_@7_vF`H1IM89%$CNiE~Ck`m?HUkvW8tszan4B1`ihHC?@PdPoiV>KNi?a4tb!abx z(Y(f+&foxH8_hgvFUQZHOQRO?O;)PO&8sj@ zT=x%|V5iAH*3ZfIF9wBq9!>l_g-xVAc$n2K;n0BBIB}~_$d-^uiUk|zk!UOI*iwl1Btn`u9n2-S!y=*_pZ4>Cd{fA(|pe%1Q;Go|kzt$w-T z-PH3Q(Wz?@yN|d(`-jU?p6Qik+=Jh^E-q}vzi6*47P;O^i&TAf_mVovTs0SeoJ2*r z^VAKuPEIf>BfN@)v4zw6xbFwWFNkoMLF^hn8WdG~{OF7D?+AuAwE8aE9)u_qoi+Q0 zHgG7>K>v|{@a>_1QKNT+>g_29oc?R76uV3bRw57b3BE;G6?GZW{{US%4q^z{6bb;dfk>P2pff;yi2syd#p*Qhpkg9rYLFX@+wuyz@q#H<9t)w{k ziEyNAhY`*}6cB<8}_}e_AZSsUR+IX8Xf!_DilWqF=_~3*% zc|v0O_)e_;A}LO;BY4W66)1ZqwBXr*{Wpp?o@NVN@${ymm{5UwcEzdAgn;9_Oj{FK zXM{V%Jx1kB@FafY(Flj&?qNfYum~k=%`xz!41I>72lxlEgoaMYfEj*g5(5!riMbOr zSEAx+7i{Ru%p&TWt`@@eg?peSdq&{BuiZYiP224wMzCOj_kC7B$PZT&Ej?eLZZxDC zI*AR!T)cQOJw3g!uuzBuxGx2ZfO1cShPqafMS316AXoVW^c zHC_=UZwN0oUFHzYhyvnBn@(_6M`3vF^F$g0#L)UdwPcie`5aG$rqwv#8 zZ^LiphHq$|$;>SI*T4R?bw~P{>;ed)3h_Y@5;q(<==}QP2QhPX&DC3<*a9Nbh6;^z z<(i^MjP0#0{oRfu6EqAVHoc@0Afq zCk2P`Gwln;FHPMmdQg5UgsM3}>yuV9oyxZ7TuHYY$??)So0b%>CMALyfGEJwd&WuM zVa|(43U^}N3=sbP6yQ-sN|bs0hMO^P&Rh5Yg*@$`kNKMj{80kEgJ5Hx#Gw5aJ@6`H z<$P|C2X78Yi{CaB4lT~W4;)2Bf~`?cgAidVz`KJ>Kw5}{R>>I}br7L!pZfvDiCl?C zKa?xZTKKw1SG-)`gFoQlsqu{QpJw>t$Apz9QKyk|L6iwB0#rU+bEAwzn2&)Livp>I?>X|@JSgO)xZEX%>jIi8Q)^TL z%Cr;7%UY@R#Q4FN*<7Xd2Q7ii8drJTCVu%~^n}0R$028&;y|!Ro2WD>3O&YGoEMzze{M(Ezxh zx7Z;QD2pMq6`n}Z+J@vi<;gcF6XWPX!+2Y80__SQjg1c_*(%51#-vQ>Dzqgl@_z)L z2o(smMcgMn4GbwPWDhp{3FJU_BxCdhYQX`3FOIllPS+OnO8StKA#ai{n!LF zJxSDnDXPhQMo2bkS0!Cj#N>(3WK}Y&)mf1GkCv+#g~?2GSTxlcax>`-x#4SupI(s= zL;-b2n^L&wjmm)ic??rfcSw&IMPv1Sni8Y3;Xi^OB;WdV@Pk9|zJsJWM?;#Il%a@# zgD{`&qCiXhAku*fOQd@h^3bGTZUUYql0^y>p#fwOcVRIP-czGCGOA4b%W_iG+j2uWea+2s>{ZF3A)4PZ|D{Z9j4`kG>1#UNw`Hi%>X2tk4-hrtFotO zo*K2Kv_xTcg-za8^XTmJc69W#$cK{PimIuIM?pt8@M}YtSm_2|(rx<0M16dsOdAWv z!=g^GNfT}EQMS^hk2BrQrzrkYG~O527AB*~XWY2%eOq(htU2jv3oSzAIvB%ra0SJA z1Cy697Co7k!~W#9(sR$`NNaa2TjReeIe*4KMl00tVWu={$yEzxKy!&y_k|U zd|kE|+2Hz#r_l&Xi0Xn=8wyc3-A3>^&Gi+XuSG!i=)sV+Fd{*7elrwYL(4qGIER-x z&*-Otb#sVMt0r~94~~r*$!Lc`4b%rEW-!I+4bV)z=MUtPo*{DiB2qAghujQSk~kh5}OgvIdP$0wb$t z2p3woI2AXmDv~Ly6UQa{y*vt^pCB$G-pvurOV^8viV6w}($mvduU_5s=|&9K3ql$s zHe=Yka}yKh#@kqB1<5W=Qwr~9z}r=*X8y0}`%G&dV}^ssIHv&3LCoW#Ayi7vpP(C& zgX0);ULk!#j30d2&1d|4fy590Tr@ENB@4|5&ygM9Hav+kt$|N8ouv76cbkyEP0;%- zrmSZnC%6PjG>vFUDe=Ub1NosTVF1Sh0ruDA6NhVCCyu=DO}a@PpAZB;NU}+^1fh+Q)J99P)sFv8sOFR?5OH(igj>#M3%E2# zP}{r-vy4FP_jGpxbH+0dtw1CN?4re+hO14$^8#Zv{F#F2KAOKR=p-NzlohB;T51t` zDK&5LSr4sS<6OkjG^QdM3RqD_343hXF$Y3kHaSV)W882>=qBxJStmJvt2z@jzEF|T z%t5^BkK+#=Y+lDeW|osir?`|)p5iAiAHd2At{ue>j(jkZ$qiGIk~eJLvS{)A!|BJz zOrA7%&Vmi=S3mLCtH-u)NnJGWUxP;&Aeo5TYyo`~uFMY(9y~aE_H59CS+izkW@gTu zITM!D)KrJVVFlvQO`5+!jIm?KqI+$quHU_F7t=yR-+DWwsZ7^4tzY-nYp?rVzJEOV zw5fnoX~CdBC3OxWzVXV-h&nZCs^rl|jT)osw9Vp&AAVR`T#|nD7%0VtHEVqy`b01C z1DYb(gSc)C*BSWostZGgrN*~eXiH$_6=*Y8lG_li6GEG)OZmMr?grpM+yC`_;(`8-DJs72X?Q~9Le@rY5vLf?Q;egFQ}H{butS2w)( z9@FGg$Id`&N|K|rtm-l15LEbxrmLx9->rK^^hl`?{*V`pQcoQ}5fS zm&fIvIek`Tc}+!0sjew0^X4Gh`@`R1iaCAaR87%Gj2KBpZWteY@V+bupMU;&M(dzgCbZwj4d(K&RtjFJm*}ik%15dv5>-%51xl8vK-k<;U;JLOt zA0ST9v7hbR_uAUu^RH1$M$g&)^ZTBEe)#JNMh#_l&!eJ0c2w>j4Jt zVsiysr~dIBd()=QoqB*nv}xb_mhTRDY4pm!JpTRe8%e!01`1$y69MSba9O3&;}izMDPPzaOaMvJ^oy@y3KIk#FP}qf(XQk zaJVI05eNvQYR0H_#iKSB^G_9Fc&mg|HfC+b$gR1c2z1#i@(hcSa2pprYFhe^SA7$1 z3MSd)WRL^m2U>ERJl+PzP%`~DOs?iJ_|pxF_t9Bx4x-VLC7gkv;(ktd-r7Xt3Zpph zW2_YXg-8s)97PHz(Hw}J5tlI7iz&H+AJDz2w2{Ns(}Cxv?my>ZZUemtG--JFfgf&* zPMGYx3{h4FQ#4AsK&tn%I0WTKP%cp#bM(+@D{!c^T=w&vfy zwNH98(^SQ8=qmqklq#FLWN4-;=_);cHK35Kcfd(&0wT3fge%M+X#C>~NVck~YR{fM zJ9q9pdh{p)!x69og#jW3M`VnibAkOCd=)AOEy>3a>RHZ#O0 zv#jv2;L^CRSXL(N!d+N|J%;NJBq5Al95Q%byM%dhHdbD~eeFtzqw1X@<4uVs|9H;{ z;h@K9hhLNSwD!G1us4I7L)BSzMn*IFHoZ)$>A*s|Du0`OO@>WmF7y6 z1LK+LX2H@?vr{PymmCDK!c$;=!Pd(U=n%yZXzu~q(%?^zy!q6d^Z)V6v|GFNe)xrP zzj@&0AOH5zAK(4_J4wrb@~3CxI`_1-?-767pEL8-#BcnOb}{PIXLEXKpFytWInfmhZ^;de=YYlzP6}@!q!WAA01UqxwBRmcGC6_1_%NwEyGH z+&`4P+7cH?Te z6Q>27A8@UFjm&4f{s0ombuHPrhy&*p`;WzDJAxmG8EIO4=lTlMR)?6+iehQ>D|LAg zU>YDo?hR&_*gt2Tdura<-PLSs343E{Wv`?|l`5kinJ=%Sml&^*nrISq6z!0)3(1~| zUy&xn!GIs|FBH&P1n`5333o81l=6tAc|?A=QdXNsG;1Lig`+>%Fi>~h6w$TOMsjv% ztVCm^S19I377?GeA?WOtd3h_(duRa&RGrFFcX^&#P`Iy-9j{~Qb?jIjJ8EaOLDEWG zp(2_v0=%oB^tdBU3&2tsX!v21915em;?2Nv7LxgM5C9!hB&kmVevdHdASnliR6V(? zmJ}a6G@6-yo*DQO;X(Syw2+*rGNGf$`6oq7{NQp1a7A2_A7S})`HA6+4C=@X1{nkK zmSExgnR0>Q(^a$@AuPwF>8Zb?7#h=RnOVnl4;;uvr$?(g+JY&E!viF8Xc{4gG%fnR9^G`JZvLk8|2<&%%H4T?>HEgO z7pA{Eebv&f=bm|c*}p$r^2vf%t*uyczs}R?iXm zMt&cuSCBqm<%G?;b-yA54b&p)}pqM1N;qQj~mWZy6HbKYz zj8)M5fr%QSi(dJfxP4NaTFB643H*q3KgGa6Q_`5*WIpOJ$OIU}U_XG~f)7S{bt6}z zAR@QMUp+zTp#LGK7WskZY8#SQheDuwJgW8csX(hKDLQcy-CaKAyHZjj@q>_0WD+^y z5`&Ce*Wo%D_h9K}-u->z%U^*X2t@4B?!q2Hgs;#vFNqZ#_!i(TgtvNXnsJDL>LSdo zxvyp6USZ(GvT-yyjiHr;?_a2%82V1qO*c<$dlM@yQ58QNArEMbQ56j#=UojNgGrA~ z3se5=9DiHontw7is2OPNL>UH%DGaTjf9;KSLKBHL zks2~ z^2ZQ710DN<)7<>Mhrapahrwg`ha!0ZT!@tMwKkvm`a~{sB$_lO&fO|i$M0#YM34i{ z55k7l-zom#^t}L%u&iDtwNXH_B*WCLQYfz1#Y~#GC?KwDW#dZVzUWxdP-*WPQ}e9o zql|A$gkXYA8E2En#f!NFIXS*^(SuBD2w#`flepGLT;eiN`S7?Dk78@ovCHE$$8BPt zX%tb&l|YLVd09!W4op89Vw`DN(Zs>j=)Of?08mNGmrb4axWtkC`Np=yxAE$B{LzY`X^C)#9zmXzw6g6tzd5ETeaQqnlhP&LiaRQahV{;tZ(l10laE32=3 zcQLdoKqw)x8AFH6Ytxq2CstHIl6im0E0JUf;Gz|=lOSu=DgTS1OT+4inducxO^7yG zL`XjGCcrJUKGAf>>%p=7`wQVHVn}2K4NDG1ZKdlIIWFf1oq9s$L-pR!^&wKm&}Uuy z(+8S6_NC_nod?9jowg~Ym4Kw}5V%WUq0Xa?Q1)bC7fPK}V;|b|FyhNy8Z8m`h=~pm zIkgP(){FAowNG5PzHPoY06E8X6T9^n`ME6oH8P+1`U5VrmRdrW1tn&v(!W&4*XavG zmR_Nqk!YJY#eVmxO8w zL9ZA-Pf1NZ3XPV-=_UpfxNGPk-Be&u6jTPLLc8|Cmwrn^3TZ}`HsJ3^ZJ`ZG@*JCUITysKAjz|9^%bZpz|wdc>D zKbKolcD4+vEG5eTu!IZvXzhDA0dA^Yp|0`wV{jJ$q$Y z*10@X4pYrx!{5cgQ4LD(y*GmS{F9SsLS_dK9t`0G1yLmVU(Y{>az(Wb8uSQ~M;p^#fJV)R0bl#>;5t)ccWaqun*e<-%_91Jys8nGWg?iS6=kmU=Hi0mA)Q z>*oh@%Ir({0jV*u|1sD=)U>>qFo+nT^P&TMz6Of+5);|5`LdAL*nH;e4_fSwSofNC7SY8Ul|Bt`^d;iug$BrEtK4zT1 z;^J$s4^CaYYVW4B8FLnodFS12+qOLQ{4knYr}oyu)GN6mlQfl0Oj>a}Q~v0t*#et3 zE-p9$hQ56auAnE|>L+z$?p#u?LS^#wuAIj!!HP-Em@XcoJ)I=abGqjy)0v3E(ZcUH zQW3f06xTPIu@+-vgy#BR)`}mE5yu7A#(tf9}kX5ff%jp1uFT(dCO4Y}>l=;lICf zDt%wthArh4HGg|-P+67J?FoV~V1!EdOBci?rBLwgVC`4r2C6ms2DcMAjA!Cek?Sjl zJUILtJ9qBXX*0^pN~TPi0%~&T;4w{==ggkDcu{I{@+7yLhK8{z zgzE+1;b>Ig2lRdC_(WD)&16Z8j!=i1E;Un?XcyoI^ZrLpw$-h8f<7Q;f*1rPgLpqW z5_Fx7O^=H@^}e+KL6{$eoJ{qiViI&`JX~XbfYF~cXV#{_^ZgG< z>vLrmrQU=-<6l6qyto>siG*vcjA;%dl9N`DpO(yLzy5#=oS6HDHYE#*uRL0IenW#U zaq{mFMzI9d*+vVz6JmC*%V}PKH1;K8YXO>`KGkCeUw-jzO=X_S;z3V6t?Hf^o_Xf6 z$DVUKgPWGGEGa1&J1)7p-hl)#P_|-T21*|PM5bY!{tf-4@n2KN@y(Hv+Tf@s+4PBt z%Gd<|gtqnj$1>e-(zb+xZBR3cr0|J=QsFVs@OUEp^*L&WMy1#OE6tGrLZErYHx6u? zCth(SXzsXR!?!}(7Tu80VwDihOQUG3i_Y%YwSCC&k+N)m^2sNu^q4kz$a_OxfAjUh z!@zj{_1tS1m+srQtxvDs+qUjziu%}N{ofrtc-+hd3m2~R_!YOic0m8WBPP!%D$MQu zzyrrmpPHOJ_Mt(KS2wtD1ze8uhQ35sH01-$ahv8!40#g`Ut<2nw)K_mkTJuNpn7kR z>`&4T4N>=ntbD?P34_QQ$qa-KqiY88q~$Q}3}Y^4$Qr$b5$?12FD+Q%!U7Lky~T@^ z`bvX7Xi36^9}*{;T)J|WuCzW8VyUaLs+3n$tz5Zs$)d$;*RE9*k}kv&!NQ=cP@z%w zP<})gtU4EEBG#{PyFtrBVF8`sws6sf4-}pE(bg>sU&;>6wBdv&E-W!zR}kwBGlvgb z*!G6h#6(t6dMItZ%T@E%>mQ=iq9;?0{D3S}-H>%7P@VGM@|aus{s%eFKK24rq?g_t zMK3pMUPzCS5FQ0gU7VH&>_5X`!{P^l>g2gg`Klr`aSBY<2uJ{1B|o69A7!R9|E#Im z4?i;hxA)KZeXm*n*L}wCV0y;P)iTq6-+k8q^_u=Wn4WY0x97Cq_nrL52Uh;(cU9ec zGH>A2sWXTF{_y@M9%Tw&zyfKxM0`Facn|B){EwNgn^gx!pB6bFE$E{GsN!j-`k`Y= zX)sNa&3ns;?1r;}WYDG3Ls|5w=&)7Vd=M@;#Ze&Q!eb&HH5G0F&?1Pk&_jA!?x&$$ zF}1!v< z{6P1%HC*lZ;tcD1NT$23;l9c5{JIgq7@GEf;=@f0hxrcbhDQ54nTkf!jIyDtnnIf; zzzg8d6byt%ks=Benuakxe^8HtqJHOqEgwzoYH>9GdTGUwvZ8 z-$r%DX|8zYZmT$L<#}JvIU8?!+jy#e!&t5;R#9h`No}p{#yHczH$4#x83&OZFlzguP!}uvkRa#P9IM{`q#&H{q=FC z%ADX{ogSEaQ&P;8s(%0jMR3_vcbx7{utv#ln;vL`L9^!mC6hOs%!lC6PjqcApJL4# zrwpGQ{08VCZbqcZTMjyRc5#k<%ANEE;~4rHlQhwmGt_qa1)DD^fmSJwZ(FwHVWu~T zc6V8ey_%p&7UCcKC5L#|L#*YbC7dBI)UeF}uky4FxPHSzhiO$oi0_z0<-^CSXxP+& z(Bz~5Ppx@~8wuY|L?0spYLQiK!a1Ela7qkR>utI&a5 z#E*s6%MXw<`RuIxk@I!gDBNr2_1U#4JdosI`_Ew`wwU2 zHkf+o#EJBSj}6-U!g7aGz?GO zHwIn*$Jid-^bv=qxI(lcsZE9TV}VDf=EP_nAa~(>qh@c-_)bz%qB-eic|szX0quj7 z6z5N})sFeE&5zjJW4`I!HjEiQo{HG$$wEX=MC;)HPP{n zerf($CT~KBR+uI-N1W-5WA3(Y$KOJ%c+TvZhD=WcE(gj4Fty;k*|Qu@cgR#z=cW{u zSL-HCW;9!3m+=Fqzu{N(%q2K6WH{j$kq7F#cuy+A0?j7)@$r%TAch#OCN32#$a-TJ z)3m#@`eGcpg?sS{fJ@V81jb|N=E#Nv1+t!a@$g{tkwLaIyoeS3H96Huj~--~O>?yK)qO7{k7TTXHcN(Z zBQjU>pFB^rnII_|nu*t$R4(s)tzqJ~JQHkEavNzvoS$fcO&w1w69Y-{z6tU2SX=e1 z-!7T>x}gL$J%~(S(u6pmmS}$7pl$CozN;NhEx%6%-d;6pND*>No;MZef0^EP-~=?0 zKrcPUGp|iU5qT1I6rKMozJ}Wk<#iUyWc1a6kI(1$B^tr)T+y1eC&CFm@T}^*6GQ~O z4dejz0;8j*yf)^FH)-xCUUJ-ND2rJL;ptV888c?oUy3>oXjzaBLk(Wsq=D zle|Roxr=2bh=nHf5;nph6bz|Q)j>r_WYIR4=hQ%N`Q{H5<{m?+uPL1 zzNcm9*L7!Gs2rWXSZKY`K+EH4Njxpx$M`kq>}Ur6!Prj5>>7V%5%Nv@0ho|-jlZH` z7^X}w`52^Mp*7$h(qv6hxp;$idYS!zWAQ!iq;Khyz6vT}OiB=YAJG>YlM}sT62S~S zqiyEIb`9gdRlEB`rnn7Voi{H<)oDc>wJ<(6E&vC=-^*#Z;;yMZc;XZ-QG=G^P4UwK ziSm?D>Kc_5eaolN*FYb=q^AtlTZPth2PkaQlR(d9d^Y+jroDqw`$wiv2c1I6pb%7) z3FVKzQbDBz+F|eodKk^4n=x?-IKn`q;zlko>3!Ay3(fuw&D9nZO>@VgQgAt{4*mus zoq{5`<5b_*{Bl3dQkQAkc4xAPfpwER053vhU@NZt{ zSD}Y!oJwCTpz-*l$lT{oqxd)zntNjLe&$H`-D%2*-<>cqD4*f?Wsf|_Jg=xxRX zBe|__tgU{+Z8aO-3i;ji9br>ZND^69MRj3eVL?%0!KF|XDd2Z|-1hp)$~9@5!68Va zTLt#1^b=?9_~j~9(`gD2I$dI+oPcu>ed5{6cb_EkL?2G%EGnKk6PPCsDqQt|F(iiS z6AkCBO8p&y`k%_~d(^;Vy7Go;jy6N%L;5%}+WSm>CFt%ax&I)!zArhy!CW`f>OY@N zLV`3y0Fy|??z4y*Q4?3Z?o5XGqFr$!}8og>r+ruiFrqG^oe4VAC;hYK|yoaxE{gjCDgBZT- zi1CA%X*8ef`~ep|{L>HFqfV=sIw|PrqIueAP)=Y5PFlJT#z3p{#AlAfV_BiJ7@u$8 zBVAfFCm(9(PPRUjpe7~C$?^1p;)J+RQbJ%NaRQC@OKu~!OqM3vvz)f(aj$t%sJQRte1%>%Bz|#dauqFn1 z>bQu)Sh?o@P_6IGJSd+y-60kw#1nZ!vB0?7P$>zGjw4y(X+x^;0|L$}M92gxXHPsW z2=yf3D9RJGfQdo|)o|J965e#g3WwCZC=+4^eCYs@172=qw@5=c08s~vPoSKMEBL5j`BRK|@fq$w{oRsp9?i|@ zG-^jB8M;KT9x${~UW4IGMsj~OfZMl9K-ggsM)*KxXvYI&z$8ChJ4D~erXMSW755V( z#t&lnvLnV1Vy4l2uKeH%pm8DZg!w~pTIg5Fw5@*Uvwl}+#oI=;$Lr97UJRY%X%k{k z90t44b6lUnse3NSu)IWVoNg1CQ7#9b-Gyx_qFa~s?4UB)Z%{RtYopf9Eibq-5 zE+&^VMM48mOqs7~5US;}2GN?p6%|@ApG6PVGxLPsF)Y~d8_oW$kh7iUv?;DQ)!Bwh z$!k$7Vgnv)-bJu0a&giO0jL8_7`SLBMCNPDTsJ88ueD&?1Bk zLhb1^7Nm#nYRFV*{~`!0z35+0A17s}40*bzVNlTiL)mqU>P|E~i7LGwX@dzIY2%p) zW{{wcPf*6iOGyd7a?Vq0j_^uzgVh zen877qX42HEIyx4SYn9b3kpBvAC28K&DPEj+H`v`j$XrSmHQKak&NI6oqAu(`2*_` zG_l1WV+)bgtw-AA3oi%-v>>gwr#0>L&I0T{#vF{*Fr%EAwPXy~9keaE0euNor$EEe zddNl%XFb=Ts~~xLf?(Yxe`tL@sX$PD{z#tRj&)Nw(8>wiFFmipk9G4<_i3?!t&qi1>*j>rSXo)m2RKjHjLT~fPSs;aHBay0)>f=%l&a0y|&;I zKN0wg3Qg0Z`2kJRTnZ~(3^9CBLBk0KevmhyckAK@lrR49Lkh8W-Fnc_wo^YGo2s;! zxrzqG+r9@ZiFXaSrt1%4h~e5J`uPGzRGe-S)3Uq?=r6-vCT|*`n0)3ba{6)jQ&b`` z#L%ih{GgTYpJ=r)@Pjs89;9(?$JpY7&&zb`eeKpC#1KQPK(qXSzq@LIpX+=ZF50^h zC-iEo)rEdpp2EcNMMmrA2Qp)cogavc`UY{#d=BPg&L8l3)~2q)F#^jqh8V6Zw7?I- z@{HC%Z*ve2fTOM{pbGp!S0n^FQg6>a~4Lr4J9OJB{_>66(94;}!s^KUuYCvH??3eCPZ)?|5qXS0O)O3U2G` z_*^{r=pK@4F$lid7TH5I?Jq23r*}Pgc=~S87i8<%XSZXW5W3Qz4R^(5RBV_Jgsb9Ud<;J!3~tL8jey2Q$^po3=MJRE!@pkr~0% zh0FYs$-FfaX3Sf#U;*;281#|}&mr1I(@r^t7(OS&_(9AxYg$}?z`Iwb*H4+YP?kc9 zr*iH3Rrz_v0k?fm`WbY8w7-HZ$3qjS? zfY0GMuw(0-MQe}lIe78(k$H0$u3Wh~J1Zk){!-mEc5L4oki2tKW*3)KDk_aNW8~m^ z2S(Als%2M)=I?NvKIeRT?2d_B?MwDoPg=Tv{DSjRh%MV&7Svhl#+*ZC0X@X(oowfs z+JhA=vs|CO`)qnKtEy*%rym)+DgRsn+j_EOPj2W$2^+m4BYACZi8F8o`DmUWz$3)> zjnQ0hzWPdP>a3^#@%-$$3+K$8Ic@yN5#uJjH*DykBWr4^lE#m9HhA|R+I{k5cE<6&6Q;~4EiLtWToWfvlVp|W zBE}D5xORx~gP3X7v^;-68x^S-r7OI{#$;rw%pB2*7vl-`{9+~M%enAnUhfJlk zq(G7VcDr9yq|&k~Xb7YVHGyGcMM?3wQzt8G+|F9Np$77Di;w|blgcXV5D49P#)WfP znHMfx%%PloUK7zVe1_nP78MzU!sfjJ*$oDv@Qcqg^2q}bQ$OF>0b+n)rz==dg%&Uv z{}woHlnnzvg{Nci-7{b}X#%1}?b{+hu%ejEkjiT+-g@Pg=bn9G^{SLsCbamONgtZx6KY5*9E|_-H%qyLg&4Js;o2j{4`QZS(-J>GZ!D$=XdyRk z>&xgtD#m!|_4q!1=m#;B7uBcg5=088hDJN^pg$L#EY&Lki5c`D7S@m{s}lXHEFcB> z69WnWNCrAp>OIk!;}jP}&l%!-?BjYoDv=Ug7^euMsazNE@2y$6>cL`eH2jMNG#1Y&BaxNZi8DV+k*jMGizj#)J(r3uh~5Q2}Cz;d2LXL@|C4GfmBv z*C)2nVZjkSq}BIXVMHYE5{^wv4Pe(*jXG_d^DY}bsu*&`5JPJ~6Mmp+L_h>chhGZI zgTr!);VMBeGXcvfhR+!6y*B@MhFbS~gs*wSNs}B|tkAjiV z35!8bC}^J7FEL5eB@L2CqbqoZlZYXPYl~=p;BvWSSr(sY0^k+H=L3{Bm{|mtYYd+; zQ0g@Q$|nqB{2*qUnwIAeEJ6VANm?EKrrYHguP&%cz~OXz{0b-lPU$^wEhy<20_eVg zKNvKP5dT6k4oIe;U`pGBl!Qe2_%WJy_`;C`&WB>SUV&b+ndb|!I=vR~`~8+JhR+kR z`Gc5g)_ep%usTUS#MIQ(`Lkxut*@>+xc^X2R_?Lm=@+vyckkIJ$@G%9>Z#p-_WbEn zCq}+EyvDC9s&44;&}flXQU26+i3{QqmGqM#6_Uum(1?q0hzkJXv?Yix`*M6_#ArkZ zjp_ekTpPsrLCiF3uC)HZ>LEc6 z=vZCfKr0YUrLw#tD=W(%a24d`msFHPxHR2VwSdd*bvhbybFzGzA?pT&41sCgSy9Q9 z8{5va*`%Y#nW{4um^^v%x{bS->3em^XmrH6x!IW)3l!Cxlb2mvTkUn#9zK3HDEs#8 z*lH@l18PBT{{<(}y-PG2sS}jXHm&>InO8W7`*?FZbU|+Uo#nBU| z{jvs;~inhu`6})ieSKpi0SF)-S)Z< zMooa)fby6>cY#l$8(EvSQB?wS=B5OLeo0o-(l$wooRyhTQSE^4QB0Z}iQ)4C6*fIO z)zpfLf(sXOa0-54x@vdq+L|;qC8Q`@*KA=@U258Pug9@#_kPep+I~X_wv`AW#t&K# zV*KFRfEq;X{e_sh%(OIrK;K3Vffh&=r3JH6mK@%@-&0>Yck#--d-pC|vfR~RpSOCQ z*XPK}$*!!lAKJTp(X!=r6%{AWoy$C(S5fN>fgMmUOOFy*ap9C3+s=;{>kqV$E}_DM zszD#trB~F<5Do2Uy#kIwT}3x8tBOgdD%gpxFhvUnRV`%d2#L6=Du+}`9tqHvb|y1r z*)TBBhZnur2Jr@!34zK;L0yMGyWWdmbK0q8@(-hh`j}k_% zh-AoMk{?tlwLkzgW-@q^Zb7(ci+i1CA%Y1Xv(e1R&3UNvBv zG;?n1o=v+ljvijJc4JOy$&vkgjvYF@W%t37tnBKl281Xs%AGwcb<3_DB~@kas=Atn zdYLvcFfd%BJroM_C*Rn1L44c5(ZjT-g26Y8C z<8Qs|^ai@v;W0$LKK#gmCF|I6ZKl92 zxHO&ebhz3VnKVH)NHftDC^0w@m!bef9b)*rfU@T0PCFCp^z1-5^2!kP1%^j;EvgFs zqM}iCLNIt3{Kxn~>p_ekTpP4%e!$g1j2~PRbLI7kLJevPM&lT((~|`_VoXM3YW|=B zBX4xg7(>(ZcZe15h``8gQNP153y7MkjzyoQ!a3bf+I47@o8ZB$}cb z($K#u0kgty7PwhikoiMQ(L*xL=TX>Cs|Bw%t~ozwEJj`?;xz2?iGWcNV$!2Wa5adN zZYt;=gftL6us+{XC9H8CyEAB0;4e)tsbk|m3(YwBdhUr|z+n^&Ayc=7m&Q(5_? zMo85(W&N6^$IfPK+qNSkBjapV0quS(Ivt2wMefC3KdO45Gs`_qPwV+3d`dVBq8GeJ z2E@bzPNM=4H4&+Sdr(Xcc)$^eJoOi$$tj$gK$BAdfr-Y1Bf?^NgdyA!F>-|C<>>&; zIsy@Q5my|eEztoqjn*y*7n~w*!V&?zaHItrQR#e1AgT$sjN2DCj?xfiB~Eb^JH9z`^KZ)n7ZiB%aIFNbfgf=2UeKgPOT6>3MDEHE0tQe5R1xR|X-{}l z)>YL#X5`>U{{9l*WS+d}r}dy!^8;R1F@A7O%t!MBYAWcA^rcIeLW%-`x;3lT*H(Kn zvQHjPKQ=#gjbEa<1i!oH(5Z}+l-aelwW~JoQFZJ4%cRe%vU7U=p!&fsEb}bd8PgSL zIw^>*z>juK~bK@p%H5FqjnA-rhc1(jAaATA&h5tayqi%1GU zcws?8io$0;co-aoJ1inW9C?2DL&84?}aZc0OE>E!-Avm5=U8< zkrP-D3uWT-`Gh-SL1T%1<;10tB@qjjFB?z@q8vntiSmh*2HfeZ-@GJo8mVOwMj$$T zG!VG;^8=9^>bP|!=&gJ8rDq=Oe(&Q?JT>C|QE$BVdapjc?|ZQK+6~*dzUK|ZYQ!YU zb-{U~({7n_w8!+FKbpAn-g0%`w5>l(-rsKQj)6W_&l|W1dhKz|`9ZieG_V6h_Wt#; zhX?iV^YEa79|r?C`t|Dvd*4CNm6R1OU7r?GYx?!-K5ONMaid2(^4x1mQ_b5t5aS0i z)2z7yKLF@a0x3vCm1%{6X=u!ZoxfbbOhxrWl2o_=T98(T84Ltj*A%oeMWt5~sGqIK zyV&a|72Utfa?T;ekmi~)mk6}LsGxer{gDj_q3)ELv`_saUvl*^YH9 z_U%0->CDiayS8m#y=Glr-kEVQO`ZiyfKsG@r}mVFAHaYzr8msZT1m$G=l+^swIn?e7SNt2f?T6pZ}$xZ7v9^A8I z#P~_L+?=^7bLPycu5VbgYW1pBYvwIoUR73n=In)cKNtm`f?j^@x(#bqFCYH?2-VlH zWy_wR?3*!t&c?MX(@&l|vU}h1Ws63AIKl6)A3pS*wd>bBy#-rbUDJh$(>RU0yEGmk zxVr^+f=h6BcXxujy99TK-~%Y4b{eZc8pgG^J|6vOlkp^)Q5 z!QiMSvvz~ib7f=Ygo0Jpa;?rwynj!KTN(XHhx+7lox%OQ&7kFJRcr`v0_ zQ@FofDW_SdVJc+X-Y+)^F)C4_nr>3iGDRAJ05R4UX+ESjtSWF62%r0MNa(64)ZN7R z3T=&Et^YeE-&C~Hf4BS*9`$Is%sxK%@$q7_)36t^+tBy?yivzJ!8BxZ;EzK5h%Aym z5_h(T?cuWu*F?LpGzCK8IDa`~?l(qZn+&0R@DatRe*2p*2xj)w>R`#hmT3f|Sfiw$ zm+s+cmwqP=foOOBL?!`wpBE&nhL5jXpMD=}C^D3rr=KfL1h@m>8oDjt=ejZKI@rco zCsSw}N}dCb>1fmWuK1u_$de71v;9}0`DoamQNJ7 zq3j3dMNu{&+3k4R-1X6i;zr(H7*LsM!#vT)1psIi$3RgOdNfcJd4}J>bC?vII>&~5 zR0**^R1-1jgwN<6gA1*V2pIDcRmE>!J z#f6Pj+(LEL)x}h&i+w%axt`x6HYmrxcI%1H?9SeBVh;If+=QbEu29+@Lb}v6O9p1( zfCBv2pkTsksV72vsn!W*D-X~_KW^gp;MJ14UZWV4T-V09U+%o;#SDkxLs-;Ng=|x| zwWI$VP+Eh{h>LSV>^P2Y5f{yjImJ3>w^K;=t@p_B5zmXOtF|El3h^iE9!Fq`i_%mcwX#lpOMY%@mrJ{V3fe8aE1?JB;c%nTJDn-_SUFc!&7^Q!B z(2cxZX~C?TEtPyk+4y%WtewgC8lyKo9;aI2>m$3iXoq}palj3>OkXe#U9x#WP?2LL z04gE0Q`Pb`Z9J|pAjg7Uk8C|26^P_6zAAajq*XL6zRp5bty`33+a;$43#6%%9FVUC zY8*L)NcN6U@f~uDQ6-A zzgK+AX2{{XC6E!=B4I+L0g>N}@Rw3^FK>PKxGPKF67y|mZlSMRx%Z*RRE9eVz&q#+FEIq{kw}Z1x8llJlbs~EuCdLzirWwKm zJi&CU!q);k{*_NgfgK9M7ok9Ec7{R;0qK6+{3N5$S!z%pm?);ZiP$Fy0?jb$Xw?a{ zRV!U{6`}NBMblXWxA(;f1lHgGA&C-*9-}#JO!poy9@5X(nQ~uc}$Au zkds0{m7xw_I&&Qk(u4z$`n6x~F8|uAuR%tV@LGPg zg(TVJZicmtvdd^rq|3~*6CT)8n6!8}y3H6Q43WkBu0yUf_!c-K+PG&!H+}Nw{UZGH zAwD+iS4oY2i`nhS)RYP1N9zxY$F$))VWYNAl|GwRDqT6BE0? z4|W*!xqqpG$RY6Mj{Ie)qAj7Q7@s%$8oOFX79rk<-x~!h`*w4IH;#zZ6=FXm5#twP za(Dd=ofr6JXLL{*aZV-EGH8tY2?QBofqD#03}qfbB+P#SPfO zm}Z`j3yF!t$ibT3!$J=X<#puhdt7`LMnyoHR-V}{j^(+V6Z zvA`+3qqhRLX*{QhI%h1Rm+ZoDbfhdrQt-Ag;(L# zP3Om6RYLW7x_>Mihx6Ts$uHI=t$lwJiJ*6VM!SD|r}X!4*i>TVvP6^w7(|oJ<5U1* zA}p1MT&DCt>w1NJ3}>XQyVr-s^Ot0SI$T2AKfx~=8)Lyt(uAIGa}e|M^V`*x7pc+d zmw)~Dc0-#g z%|3Z)@{_7G3bnPh`}z&2UgT*!SLuJPvLN-;cd{`1;%MNd?l!2YsU1Y@K{DSoG;q!` zOLx?coI-{w>dE-mti*iJhsKlBKn4dWvSE_;F*`lmj02RuiETVk6plph7wgBj&qk0( zf92O5r`GQAh_>hJ#Y`X_aOWVi2jY;$Z%BP9uQ190Be#+bPtir>`bf0~O*>7@*842~0%DL_YH{b!r_osDWA+cF8I+B`cY&K^eyE#l43ZYD=>&<_aX8>4f zBf~&RNKo%8s%)a8W1+S#oKxbl#FXZccIn^?<^O^H-ihb!q+tIPN3?Pi-z((%`TpqM zdug!E^2qOS+5MOt`>%&?{r2$nvi&gk^`e__Nf4UU&wC}@jysjA0hY?A=HjBrVd@$3 zNNra8VONOc^4jQev)lXOWUkZyQqb26obvFrJmiAljCnK0fm|P~1*KTI7X>RtJ3R57bQOe>7|2gq+4&N{I>tgMf?<1S` zyt)H9(DyTP^WYCUx%EAoT#j;me9I;Ee2t?Vq5 z7x(O9I&BWuDORdz7c1Q^$2ZzYX%;yG51V|KpRa%1&r;2F-AE<f6>>Sz5^8FFMajBPXY6H)lE%w*kKnITL1fyQ!4>v*%FRR$oj)Wb>JWw&@1(=Ye6p z@%zId{QE`alvSr@&02Zo^#17=Qo;IH@GHsC^Ir~JE85%fY_7n=S|r}fmDaWn=W8^DU+CG8~mI?qVCMf|WC{?E1U^}JOo3<`zi@!-zf)7+NbV+&Nq5( zZqBGPN#yn0*|-ly9kpEzG-wt-Gu8h(a18yFHD;A8XvG@PN6+~ zoU=821WdxOMY>sDPAgUa;NC8(tC{{>Ddli+v(O6B(F6Xu@bL?}E4l@qsS1$9Tf;OpI-T8v zid9uNlvOn1rn|v1kb@Bo1*1zmNzb4c&00l++QJpwqXW?)E%1XZloO9cA`7ap_e-ev zUBfW$WUR*)Z=IS5_3S#k4d&G9h&WMTAG+3!6;g@a>Na+E<1wZZN)HbA)ztscMX4nu zpF4E)r*|0$CAqdkCsDvtE2*0ibF_Tzlv3|@Yn|M8#5vHbE`RLE5mZol7fi>x3!uZo z#odjv^A|>d*-%spo~&SRsjY?lQB_=AUR{h)BgST?daJ3?!L_QXX+JvFmY<(rT8g?X z^2Pc@fKEQ8kU+Wd=H^|*&nL%UL33KuNm4-Mvk#K|%VW0z*obOxl%8)X8P{8ekV!COHX zn8H=9dTj`l)l%a!)xA(4m0EtgDk*SdvWxbA^$5tn$Eaou8*?wpUv=#wwJJ?fE|=Z^ zx>1-cU)IjTS7EJIph}}U_lw`+$vt6#)N-xCVP)NFyYp+%qJ&vVXor$c5KTHKDy$(Pg9bW)$|S;PZ0kVpo;1NJZ^evvAOz{=D#DJB*Mlk{Tr3i%DEsDtHXxx1^m$w{OF;hiFsjC&~Fi9MVc%6Z{MURW6LBb zQ;eQ?@9}m!T&&57663H$^tjJN6X}R$abV?e`Z6)fwoU)>79^w<2{+^Ra+;0EQohkJ zAg|!|()A*~>pq4?0Xjqa2X74%&src55>x37)Wk6zpjB35_F@kW*VE15#Z5a59ZBNA zu;oAa8u*%EQow3Hf||8RX>L}QzPg2!F2xrk>k^4}Fho#UX)~wEj>GhuQA#N_+5HP6 zBP~ah7KiU$*X0WasWs<+b6@bhs!K3Y9EK~nC&{loC!;%TOklU!^ROM8Kjn%pg&{&GfX>zn@%b&`wx+NspAU&Dwwr1CSN5)2PP;%M5uI} zshD4|{%~QY2PXypb0p^UG9LM4p=|3on?lp}IifYU$A4SM*Qh$odvBIo$u#|ndT2T8 z%>i5f%}ChrDtI!Q_KW`&HCOs|@Yn}D%xOC3*D0Xza`e8w5fT}Eqp0&uA@yvbyDIsw zzTl{FYb`9~he{-+hYuOW$IFK7e@CAEtWTBPW7`(X-yJNb>(4w+?7!hf72-XA~f2~@=HxrJ< zTzW2`R$Bl2F^QUf@^dBU%MBI0ainP?N^V>mxUMDNn2L~q+194%11auU6{Iz?Yx)Clk*O47bB3In}gnT!IotKCaPM?Mrl=*2F8Wh$>?rr=W} z%Ka<~b5oQXEuKQ5eE94rE~N$uLg|CT{Vw7s9x#Iq)|*%V*ZCw3CY}9&2Zxg%A2Yd=Hbu$tXZDweL~_En;6gA_U}XNe$;W0kGZKpIJ3I>XX@>pmkY(_kx)5DVYGfxFeF1fsPZtq#!IPD!My*uEyGODt^ghwWdtJ_!eix5ee< z+h`pQ~PWVf_owXyS9o(?$4hHd{H31sJUNwg5>h}TyY)ODdzE+{HiMC+5O~~ ze&_(5ETw!3BXo!B-C;q)?YrY9tXxKDl}SA(GUK%A03@YWU`-S$S+AS-`%q+Za#E6v zapc9Us)O)4@CFX4oc97)w%g-@MB&t@N){ANqpYSS6YcLvc}Htu@H<#v-3*Al1FN53 z^@~6c+b`gCK!8NRi<21)rybOY{Cr^Aktk8dpKnxOtE55)aB_0?L5HH#!_WQj+!$0S z3mqx_ar8|^g!w7JT=tM16rh97o4@)E5${7PIlQ2zYJlDc#-kP)*(Bj-GOZF~y0oI8 zrUN!n7MLq6J&1Y>_##c9NKrrBp)d?>?lp=1yfwrGW@MaZtk1q=TmT46!crI@8?URHEq{wJ=c%n z-MW)Gug_MSXqAfprI`urRZlb0F{S$4|9vFRO5t~1EgYsCjafFG+0+l$tk!C9nCqG= zq9qmb0*fcbKP@-Ah1J<-#g3S1OgfpIRyWhN=at4}H}GW(~E=!qhB8 zr|ARS)VvuUbq$S1yQwc@5aPIR%2b4qM7j&Nu(6?*n(-2o8aM~0(-~g`JlC3EqJkDv z3G;V;*{-cC>nD0%EH=YN#}lppyX}}eDpkmAGalcalfm?5k9BspH}rncqd_zU52>7# zgFNDi)6X0im9iVPuDu^f_^}Wf%9_|)e<)1yq!%&haWoV7So_U-;LgtP;1{7->8h;? z`p@a4clzx#rd~7-m>f3olW0nK&ecDTbXv>q$`W$xaoU2xO;MMl$7fyeL>t<~v=SJ`^#hb|PZRfW13@e8_ zlhx9GMW`6O$582Pr8ny0g`h?uImgP*j zthPN;HzmIfE4}np4?+B{yLX{T_*SRCL?D)GSC4GV3AkNB=OUBO>lV>+&w*Ma#IgTF z#nP5YXX|5Jc>lJ0jyJ{<=D3ZnnuIqYMS){{mrHHCG90Z>FE(s6>berLbPY9|Twi}R z(V||0E#fx^sJ+2OZ)L@Pu;VVGxCEoKlh<4MZeZ=5uZ0BS__VdRz#ZcogY|h>EkWbf zF;ZbxZ6y;61N{TMZwJjYRVu!hx~s3Eii-68@=CYSZF_sWdg?tHP3j-@VY5H%uJ)CC zw+GmJMUOumJYChRY8rwkOwDlBxOwJ;WE+<+5Voz`5VmFhSmC{L)Syl{z`J=Wo6VuBsm=AAn z>jdez{Mf;w5?r^pw*q!rzCLs^zSRpm5~4oY8_m`_XhMAwj#df}`}=#|zU<<^YJYX) z*Z*D&YHoQ@?o(HCIv1#6nNsZ>4SJ*gaS^KSCs8;j6FWSWz%}fA5we ztf8UkOKkd0B9L?OkLL2?pES+F7;Br#3E3*En>T`W%jhSx12lrsF13GeY*P(IwAia? z-9nB|PLA5ls_&QadCCTAUwqe!kDGAX&bXc>Qtx8r^KOTZZ|_rE=x%qTFv=DL{V$-9 z;hYd}Sj^3pGFfYCJI?w7|Ixi~@VTE0dMLa7$(v#TcnPfX;)2JUKiMrr{Ju{=Oj$LV zgOshPf2pZwsH$6}`(A((0zd{W{hGRhzAtz5suo`SxrK#=KNl>1Z2W?5^tv0ef)UJ1 zZ1GfGi)yY3g)I^BC%Z*%%V~6etqr|BkeAVhdI9T6)5!n2F|}ZT2@`w|Jg1e}D(@N1 zo^N(I$CuJOtKu^F9j?`M>OEAd;^R`w=rozf?m5>f>B2h-xjeNk$mM;Z_N~rh2(wY= z{n_2ACbSZ}pMy(kusvQRV91_?^qCZzdm_;eLDjItdkG-G1ip)^HOBTIAx*wvxq0y| zd<_j0djb`q%P>Q2+KEe(%vtkLm{WyH2b9j4JSp|d@qDYiJCe>uboc8TGJc2JNg$2X z;PNNCsJf0LxZK6SC2HeGvWmw77;(XT-B(P@nbjf~SiV8@ZiNG1Q++_*?xfJ(yXb)s zxngJ_dsrod5`(D2)c2M_?2|l3|g6^@W>r7AhpolG49Y z_G32iQVxrq{H!2qJ=y+4;NKtG-;L4o|F%;8aZQtZbxYeoR*#I#v<0=EVTG-!(^VhO zHGA;LWzgd&#Y)BV3|uW!i$j_2jDS(46Uy!3CWr*xC#eu{hK#t&>4}RhXcyknC3?p? z$oeN@8ZPKkt44M&r_%xJQ$ydOwY;eQI$~gC&eGoZ4Wd=vI(U+G!%r*2N;Q1shlE*z zuBR2)Y0=(q0!>5Y8V;(g{6X|!-nf0_Y38|~ntRw5#;$$OJXF~cNqE@yS$qO9>>(1@ zZBmY?hM)n|?>h*qsPWQ5RDni~^dj?C&R~d&fv{@X&!Pm`$5K;SjIHW2&>!rRmQRBX zrXZYuw%@!AeWDjuVM7d}r_G41n?&rG6sd#loq1~~UWV`l*(lxuF5{^pWI1c;|G(z2 zj*h=W3;L;riRJ$P&yQLDc?)PA0+VDk2R?q#h=y0tFM`REq{9 z)mUhigFxZFukkz1klne{%ZfoLqq!_Y@~Y5&5aT?KH+PA&q^r+QWZgZR$8Me*oC#6n zVJuWb{DC|{=m9tZL;ydsJ~0)Dm7)!kwiC;5H*7xB;7pW`Xoh9yHtg^`*y{Lr(6+T0}h4IzYh z?w<1Bl?3{+B&wA{+Q17^>5!#X9eSX<)F90KPOP{A?l8QbJ~HeWO5BH)m;Xk1h0h}Y zUSqQxhQZ5JBzMS5oab(QW03xp+mcdNKB#<4V5GT9B*Gty_P^mqMf<=9{G!wVMY(7O z*U{T4Vsqi}Hlg=5D+S;)GL7kbSrK-?SxN%LIsCxCB#upUY+m)OES(KRH* ziG`Rw{s4t6W4A1J|8MM|v-z1Hxf05JRj9;u9f<3tc@ac;FYGIICYimt~c#PWd z5-VO3&q4Irt$d^NgHW-OPtNAF1ruruhre~Z$Xw4d5I{0)qDzmS<5{ht^?Hut@LZNT@uQ>cz*qRNl2!0^wq3bXTZ3lt>cFRMY`|!r^f%xnwFLCST zDkjt5P|}yXW9LH-_L;ot4hQqGPBG_Oc0;e1;q)-YR8e`ZuFR(GRsSCHB1195?;cye z_8}XjoLDapU8a^D6`@b?WQix0T#N#Cw2BVHFJH^5pUgr9hmZ>kZZ2s>6xBJ3Z4krW z0V6GZ^CdMhC@zDgrG)Gl7;Xw>Grt(_=yhqv1!1$PO+y?AC|-6eLA)+!*@YD?u5k&a z7#smY7r(c?OK(`@W@*cx{|c}*lK_V0ZAz78)VS3II%-7~vfhgFjc4p%#On&?iy+qe z2?;RSw&k|4>|@4S;nL08d-_FcrwSzeAQ0G42Gv9%Uxf_c9&bOruD4hOJ}=V^eeOeP z;qEWF&ENF&kw6Bl+;szr1GZzH+GSv{WLX_W^H0zwFH+h>Wr!X*8o`3uZmT?k$N^Du zX_+z&`Ld*u=nd8;$AV^vD}Ity`H+>XzSv*m%35XKj72JXtP3qo^4B}KMjE9I_Ki~) zESyv}4puXB#CZ{qbrwWa32{Rqwun<30)l+SJgP5yF$-l~J$(&D@X?c14)M*rU!4lA z7B|&XD8){TVqmMlvOT@)0ai|9mOD=zad8h>0fmD0h-kL)=(dKzsU}o(zSNd4QB^E` zEZILD%V?9x1FdKnJ|DRI#1i?eQOW>ROapR6S&-=i0HKKUIwFp=_P1xKKX8#q zSS>8Po^W?`pN$-qIPfmgnFhS>$YO_-yR?v|>onE`~dH6q7Wc^%j@99ln z_!FXw{5@v+ar~DL7%7R5gYHo*1r1l*)%j2n1cX(on4C7#cbZ}Sn-@mPceqXmb^)Qs zq58z4I8weAqq&=j#&xS?3tqj~u zYo}e67cz>uVma(sh+Nz+@jIDN>PGmMAfke2YI=zMB@R38-Klr!X z{js=K^MSo~JuA%T01C58=k+!#hkk5RbGTr3cAuN8iyB>SQr@4F@>VB%XcoWq&KF81 z<}o%db69Qc><&Dye!TERs@?CN4(7Yy{x&Qfcm0=qn0jzHW7vR*WxUvSttfRKm-Ct; z{603v5l8%2QyJ`*EN#g{7k5`QdV|=g$&$&<;%fC0X>xJXg|Kk&mvJ&Kmp}Tgi~UYa zW=XS7X9vkzM1ft@T18Pr+6pg`Qy-z@fW;6Fhx$114-&3OU0EIv$rX>3Qsy-0R=J}p zF?FbgVvdF{%BPnNXA8I3-096@sYQnD)l~l_y|vN#35qMq@XW_4^QxLAlkVzvJ-1rA z-QS+huC8qQY5XQ!8NtW4NL3ZG1zM#fsK%}E9{#Wy7*U=`q$+DyS6eZ$jRG<7Rur%Q z2L%!Npi~^uTDx=S%ptGe+X}cYqE#%es`R$kj42VRr@^gRC@ z|K4lMzRO&8tDE1eS~s`n?w-uT!Eq9c=lW6PxatOECbLnc|Kf^i46Z)v&E$rU=ked!%Z82iRZpdzF=fp3 zKFg2^J0rc{2}!|MHS~NYM))TtR)8iWu_l9D1Cgl6Dj?vyT&qtKf4bfd&Mvb}rh*MF zSYKb?=yabkY;G$o+@0;&h}N)Q47xxe{8AXr=X2C|ykJqI#xn>AMRv&qdlR;telx7ug%m^DK?EI16pESj&lvF*!~}t(!4; zUw5AI?zXnIz0Pbo#ZJ!Qcf_etmf+%#!pARFIPg#zbd zY&Mv{?>&Icwf?qVrcfcoKr)-X{!)-jtF5f2``cu(Jdv8kIn`vhp&_AyN-F5_boE`l z6~j8{|2UYYQ?w^1jVnl$LDUH1AL0b8Zo6{t5%jZ1h{QY<_6Z2m=~m1LtUHR>6QtYU zzDXk;YdOayC~Xug{wY4hr4hRvlvp~62Wmoc%pGY%+9T`&gCi7@6u!6|k(U&=L0uoo zB|$uAaC$~V=9y1)j1=i^s47d?%+p;~24#nHK4WDrRy1{lRjINv&nFJgehpw424bV+ zo3lBL0yWfHOC2GFTdtoS0JtX!*13g|j~Mi@B&kElQjIN~H4|bKEtAiXriq+H)Cw>d z{pfg8kTP?cPYImqCXg66=mLj9EKbqV9ppAfxqF2wNWys8%0&UPB?qvCfn}7SG1c8? za^A2V(V4nH$U^*Yk#&8j3e(PoSwk=$Jx7ccVf44pN$9l7ac(oL5Ls}9j zNO4p=J4#y!Qj55mFu0zG0dQjKSf~(vAf|M({}DQvtA^TV@mTL41K9nrQNg+tWeP6L zij)S4A3@QL_ghcxhYqZb{eF?&MTS&~mH;U~a>mO-!xqJHMg3X_s7wW_uv4T&1{%SM zs*eRV#!Dx$^xNS2hjxovz3t5~`Pz8u#>j~S1jCAo_6ZfyAuWBxM8?zSgkw!1@d0z}j3I|6cqALL;k6QO$R8{+ z2{$nuCrgPis}jpnHg&VI4xsrRHls3;c!(KcuuM-}Ly%LU6xVn9TUIF^jVL}vx-DJA zEU18ek$cqVU$Z&!6_Humt?F~Xzxw`@Uu+=s<5*gS$GcvS9)}jQ5OXw8myY!^x5h|% zA~W+}!Bb0{0*{k2gr97UlwM}A;?9(}Q9MDkh;Q)`=-Psc*SD26HE#hQ;Q8KK20)1CW{>hODKVZC&$@xq5C45| zt%H6G0|fgSsN6YIac*EG-{?bcmb1zrp;r)DH-h4#^d?F{s+jvH_^PzV~egsF^Meh zXd%KRc_DsieCFkb_k>xx<4Vz3V7H*MavZLy|LodL40;B)FVfBFxz6>o=E@T8INL} z3fn`_>KSl?6&H}!6oSLHZNWpa+Nbv9xD zm6V(|wS8!0LvS@qzuY!wIlau|Rd;Gno6~e%N_VkTLXaYb!llK@FxZXb!yJB$<3_X% zLMeZM4Kcj(rOd=nvcCVlC*Nr>ULRhZK)I{`$I)ZiRy zO0(}G9*$)^*q~j2cv2JuXn>I*%@A*{0&-v)`il<4g=Zw6S&pHK7K}%^99dx>qZ3x# zTu;4t7f7m^PoFY7g$KJwVOKI7vhchxP8xhHqz@l4mJ0cSAt??|ago@^Bk8?E=M-0Tv-{Ub2kc-K2g$ z$%JuNxMfn*?>4#Zkho3bIn}G{d6P77T)l3x2xj0a28S0;OiX}dmDb<7PEJmOf`Y)e zcv4alI9hgP2Z?VzIy(A$c+rL(3lkF)Gjk}P-ZrXX+u{CxYHDhKcX@evX(?Rf-rioH zfr<*G6czS$D4!3DURyw$g9yYEBHug~ZYbr87tbzM0AE1cl_)D!sA@5^sf9%}go8MQ z7P{sh&V@tBFYul_h=Flxni0eVDyL&%t`io9vLoV^LX^hTh7zAx)oyD@x>-AEOuA_t zn137S0#od7ztx_DdqL`bJ{5Eh%~W=VIRSKiV9XrY!Z9Md}Gwf8o|@S-hP_e z5>ao)S2jo6(nkjVG{fL`f55x#rZp0d$x?xw%G8kxB3%FFAkD?6$;4bsyM^|aKW4hIU^(?_+nkb9Hf z)(evg=XKT0G=$uJ6A}% zcEt48Oj2<#H%17on);)_{LY)cx%aky{a3Vf^>jtUU#PYc9EBOZU|XNx#X7Ib+||H2C63Qd5ClFxegu;H6Gd@7B`|LWejGUGh^4~L z!2yKr0U-AU5u(8bx1EB6U?u0V(j~EAgef2@F%SlD$rAwqtQ5eIAt0o(Wg(tYHV>rK z5XSL;2V!U#$Q7r$0+d_lGL~qBVUrYp8UP{`f|MPvhV}b!fk5G>foK>eqRD+x+i!$J z`wmpRb(NytB3Q+Je@VG4^oYrK0MTR6LH($P5r|9?(a771j);7qzzYde1f1*vRQKWl z{%xJnc+ye&LQ0{4G3Z?iya^gU+&^iCDS4@mAI7m;caYNSMl2w=gY2F5sYrZ zNyCYKBm^sQw^-l~e8YVt8>TH78uVJoyoFZhz*_r_-CaZli)UM4Ir~xDJkETd6Qo>3 z2y0nHg$c>I69ltEc$^X%T@P4d@&V7Wl^N3GR)&BGl?>-uj04+rAo4hAk(C|P&Wsau zV5sI0#Q<42|MQ3^Dp6>(H2wt;;Jz85Alb=&`ZP=*M?jjqD&sldVB&v($ z%U6Z_B0s`JJZH5de$i{p(jKY#QXrq8;;39=r5|dG1hOBPoDJTuQhrIxVFJu5LhLkD z0}%KinXH^Yy#w~oUfLT5UL`B^&y5aBEx^^@e}`E z0ny_C5Pd2`7#F*0L$*m4ZGh+q)IJJPL@A%9T#T@gP40h9D)ZMXNQm&11Fd3glK4g8wp_8*2nm@ zBZBd4m(v&s?s?7&LGYAd@wVl-MHDHh&QewqgxoIIojpI#7Lp=QKVN6T3i)w8mWeg` zv+^K;9#J<*jjER_T07q_-1NO$P8X|eTLsTM1YA_p!|hJiK1ZgZFY%w)w~D{SSiZJE z;XeK+?n@7Do}n>P>vy_^(uu!er=jJ95@HLznm)NS2&$6FK^0nnMU>QBukh-!G*dUb zM{yr;j~Li7k!A<6Gv^qyuJ&|L+QF+kjhPqFBgr&>rGX1ah8IWC6@e!*WM&)oS%Z=~ zLtUc+OhC-*f+GLoF+9xuW%+#S*X?GeH5Hz*hyvoVprtFy22V3b_guyInECwrLbUPh?QC(vpQ09YPm$fo@~awWsvpir86EhCB-B# zSb^chXbh|(lft9GH2HN zf}WC4a~GZ;+Ql8BQO+$?P)}G~b_x0C<`8v-WtRg-yDciFo55Vh`5 zOgVFMlkAgwTG+C}N16F<&c?cqMrUhAlPdr6T>XZZ7@m*@ju?+r9aUAusnzN*zn))A zKAeo;MyGv~M+b(*qXG9PfI^BHN+DGlYE`fo3F!na02e5d5x?t+4^n4Q;Wr}>@`wSY z@Pp4EfTw=Jqej`z6pz0fLkM4k@$Ys@Nh1bgbKp1mw#_(|lh`uD8^3h7jcmV5|M&o# zqYzA^{T{iGM6|+N1lTUi`qm_6XE)o9KA=g(xbtS$^|BS`7rtyaB+m*5jP5^pf|Un+ zu!u`O&&#_Xou(EP(bWJw*nN&3(KiN!0TCAgg}dS_n71NC5Yoo-AlZGdUB!FaGG+a=tHwoXDFRv zVZtc%;50cqC~W2aGqajPeoXFIX3$DIgYRXpf1RN2$*X=BCNMw=yiqR+*t>`KwX1`l zmJTtH)rk3X*lk~uD#T%KJ8RSvV2C*D*R2@Y-TC!!iuwL82LmvSy@;}{k#>~N)MS4f zTbm@dK-WYEXE!au>5aglI0FQrLapcFUpZ> ziZ;SxWw*dpLPEmKj2ff5qN1Xzs;aJTl-|e2#%3p)QgMe`ksO*QEhVK7mV9zzA|b_N z9hI+;k~n-YFe|i9nmwZhCagL69C~}wt#>XCym|{5iLG3 zIq4X}N7fh!0Tq!nvy4aX2!pvgqP`6qy#j*Tr?JC?G;#zh)YDVzO2+5?^*A`bj)=9F zuYlq$ITV^(>K!Y~UOlDKaxtzGK zd86@5;YR4Jrunr?R_@+c8{{Exf{kvrwd+5Gd8x3tjvk(9=tw*+$sY zK;x%d;m_-HZ^F$vVE%MSp{=GEP^7#0rz+tYXd%x0-0hUNEL`Dl`ScXXeeBa zh7>n|q+fg`%0Q7tzL(MA?J*yrij-JifH~iWvrTe0);GEGx9Y}F_op*Y6GqXuO;h=+ zSZM06SX57e=^#a0gw7_11e8=9<5VS3)|dO{y3ON!keH3u0e8$8@^7tH1>n<>)I|$&5T-=8uBo^kfhf1 z?q40oBL~h{_$ro;ks6c@t!Wm$-93#fRzal72n$nt_9qh3;aWGQ?w#A(g_}s z`sEhE%c)%r6rF<7Xv6(z4%)>WekOuX{ZB22)MJDKb@??P{pWpY4)G!%8F;HB#DSy% zD=50ESJP=PCa`W^MnE{bz>6Rx1PM#jD+%eN44OBH#DsTgJiSbAm=0DaQD??-u@?du zYpr1c3PeQ-SE<_Qz5!Hm@BV2_8bh9epgsy8&h2PQed_gUho~ZH$Ov&<9JMHEZK6Qw zOn@*pE(m^wvLaGWiiyGzC=UU0h+m;hldiYqn;`viM_vkft)c9mRFE%LKod5k@R5o* zfyd0rhV@gE0+O5}Qi`22Db^ICEDVE_^8*&C1Bbdqtl81GcpRm+?#ABj&ig5q@Up8D z?2kjc`7ruq|G9;db7|xKy20)CbQ??jarGp$rOpNCMvs9jMTOb{*BLMd;e;VrB8x*2 zZn*w;#*oi}SLkWHzR-JX^^jXj!gV|B@1@m3`!Y&S1WvP#pRlUiofx;b-|Bo&;5)@7 z%N108BhEi~!>`az0sn>v;5h&Oqg9mf&5KlGQY}eX!lDqj6D5J4KKEY)zd}s>hR?ndY$zvSH}DBTEhLl zSb9#dImH#_JV}G#@Z zB5d_-T3{7Gj>^GhD8hc|=9(M>I7&13jLo#I_JrsS;}8P_5kef1jffN!nJ_0su2^3L zJ3-KS{2#~kRC3K^v(RT z_Gx$iJ=od*OEpC0i-i~>DS`LM=t?kJx6`D)?_ammLDJ7ho4+kW zjfpEYO2%cmGhJU50R_T)9VzGK3pDvO!$ou8j0(T&7m@lvOTVk&)=1F$=VoBQxb;cu z(C5oStoyyq{+qC#4rc@A?V;J@@wktjqCa6E1e@R0K6?<+c80d8RM~o)zcH3jU!Wk; zXn50+n@n`(BDRwl*@;58(72{}62y00bWlJ&k`$ToVQ#uOFu=scIaI$*swmRrj^4}8 zWh?r@Twx=r*W(c3Wa4=RZKG4^{{iAa9lxRJ=r=ahWmW|++Qcp3?qG-?tSxwHMW)~f zlnM=cjD1Ba_`#5+XKCP%lzAV4fim%fw3?*{a&i9uvv(bURTSy}g#@tc+3x-dgaFpl z^DI~NJiF3sXrA@XUJ-#1P_O}lR13ZLmPSGdC6$EqkluT*ulIdr|G#f$^LT^=K@pBaO5dZMf_muj!X?W63%ICP3+_}e!%abDApUPSo{KOOIoBCE+{pOAIu7>0Y5ld zsfK63j4&LI;9Nc92a%i~P&SE7 z0W`{=Zb3VE_}qr4gdgGGb&0@U%>ZD7kv(kS2bXZ4u*VTjFtD(twgzyY+yg�fS@i z6M>Ugx1ih&9NdEoJR+BwPhh}XhpSwGH`ftmME8Wg&Wbi9dfxm*uiKc8^cjD7e-bEc zul}RG{_nY{)Eq>DkX^yDB9Y33!#zeRd_BY{32?8?jq_SYqqX^kce!bOrTg0A{T~59ey>(Z0cKMWW3bi|y;svZ(=eKLn=fEwtW(a%41>sKr@ryF@p{9;{iID7hZREk8FchSokd{{%rp9h)V#AeL~XJoZ3x+*)3@mDe%msq zhBO?_ZPXiBIU^*aF{(%pGBIOEj>ayU473V_7B*PT`E34R`p&E-osHgCwOG_zm0F`) zda%+jsBz)G6Iv6k4gpZqRXU@g%ZFmGFZiFTau;()Pf(F1PAUKLJ+Lxlp4#dpsJY%YS#pvpt2PN zsvHJmcC$EbPl?~&qRLi&e~=xs-e{P&KW|oe>yn^cjhP4yj+ayL#!Yn2Jfp8EY5{64CNkpwEF$fKpAtsYRyPv@iY66Rvz%Rtn zl}IYT_J?#XCm0Y5LgsOCa6gC<{wXZP$(S6u(d#sJ#Z8ZR_N6%k4C09y41|tk3cK&% z*u*@_sau#l1Q-w+Y&rlDkxzk`8w~4WTL1QG-aY;$_s$~q+%Dz!`j?OVDjxh`*yN8r z`#jrwz(`sZ=tFA*p{;xMAKR&d4>_? zX>!u~gS%$3sN4C$y`NNpF+Ayi1iGwIY4iHylU_a}dwNTA7|1xMDV_2IuwvXUW&`k| zkm>_>Wi}kAxa)-i;|KQCO&d!l@b!ruW4NUJfTc#}2Nzk+&JU>f!B|XmSdFwQ&}y(y zp8*{sSZNII23CEk#Y(3PFz`mj8y>(dIb0r?-&1B+Qv}>k5x79zj#IGHs#4l4jZSP`0!F)jxj)i&{y-FZ-uIgMx*u%b5$kSUDd zXY4JVvb*SbUJZIKc(&7{WqVweW7__TIeT*SHa3)Jp$Ja#%fO;(K@D3Y3t4MNs_5H& z=q48&DCN%=kUnGqfd3k^ICFpb)SZPDtv2elkzIu2aDEe*G4o(6cnmGNBP)smS>1h7 zJuR^EtwliyklP>%bn3Hq=FB+Q5}Du3i+(1TuB+8jb=qv#(} zJ7ZTiU*7=miSZQ?H8X>omIkLn%Tn@K`PZ4m>AMU30&6Rj%%`0ujBweOmEYQO#E znN>8lh8_FDycm+J_X}?L@Q1_v4Ga9^7sWqwN7~214Usv`$UeC+*PK>*zAz)WdP8Um zRVx-FoWKvj8)ob&1UX|MH~xHKdPu`J0ojy&Xm@&~AtEC1gDC+upKXkxofxRfh@f$5 zhd3vYR#u)UX|+(TrHl znqak|$(lvM3>%cLDN(mQ_c{NOV0p^?Y4cunX49$*Ks2$?-pC2O1D2M^B9`OEAw@PoVkOWgUv zsCfyfO`~6$*}MPH4*Y;#IP@9&`iEcJ*qR7Ra61sb`zgR9Z3is)y`!pRu#5M67%9c; zw*CN&;kh}{;QDnf7LOYr>pf`9WdnTAjUR9`Dmv?4aaXC60F9x0$htZ5!49sU3kIr1 z-IpJ*#K`>MBFowN0lO`<;tZ}-S*huuZBWm|74t;~Iypq&W_Bc28xpHcRV{kzG6~e2 zYMdA-m%q0qxy3~3c9C)L1Ha(9>E{YDCzKWRF^)*pPlMtZ&gdsrh?eEmUmUMsA~Hw7c{1HS%%EIHiPA2eaaN09CX z_`%Gu=EZ?I?8ebLG^B*{gJ~fRb2mg&$|>t)@4o(kks5c9Cw7;+1U!HrfCO`jKvlh6 z?R5gXX~E}Trl)0x9t;bKOx7clc4^%ozr@A2$TNd`P#uDGzmVh8H6fcq(>4VrYzjNM zIV^2kSkmT$Nn1iww}z!`2~C7-4NE#*QqGhup~<*vGlf8bYzj&~mRzg_Gh{lEN9Rgm zha_=yNEi&R0e}lGSMIqT?ZGlT#Z8Y~F=$eU`GYHN8^`Al`1S4yKr9^+<~ni%>I{D1 zXH&fTuQM|{oj({o{{(8&n3w%8A27TFKe%Ghgv{R?o^I2U1LgO< zedOP7ZbE2CEh|p+b?_lA54wOrBSP+Fejv*!`4N7=Y9x)tFa{HxHire{QKw*a*!iAy z?Hwo%Tz(R$9k7uH2RCy|gwGA!32hR!7%FO3U^&#%fustIhbUSa&^v0OI0LIc+;p;y z@dL7EvN){px5E#dr||>cgehp5ADq5E5%HoMg~a5y&DvW$ef@DGOEC+-BdAQA&gSN3 z&JWaT$|Gu>$IjF|-HEk2q!38u>sr zc+E#3cK>BN*=1G>b4Mk&qSev&A_n|4!ZX`5K7qGdO|Q`uSi(D)<4n2VnRnl;#hX2Ir8L9h834oW*Ag1AtWk3TNrT@)-vj!4FUqaBCP8WU*O?5oJt!#UzmNMF{MIF zwF~yl>2Qf@Mqt&)8J2C*wV8HnMoj=+17pDv>4HGtKwvOAnX5yD z(nV>bwa}@P*|1As1D^;4M_i60JfMhhE!|3b^UiK#w*%=!5kr%rE+N|}D%`r6%eGkP zp%2=EX8M<38C6Z8p&@HGZqW&Lvqhhg8n<%YmZsXOu+YPmb&XcR(9qJVRy9{tlxeIc zn?N65uo+Z8Y}%~TX(}tLl?E_ii$xFvjuw*Ep~_2eSBLxvNN&tkGP#+#!QIIPSi0<~ zX|uM*UXgWr{psI5ea2$Q&e!NcK|({*D-8XHM8@ZW#UOTg=0^@5lq*1vQ%D1$?+X)^Wv(^H%uxY7W_S=J{~3}jF9wZNi-jraQH z{N;J zlyl$*=-BLPt){uPMXS}9m6W5}lvP#pT1H&HeRU5&R_MaRg=e(=%e43*_n-9~#^8eRl`up%_yh&-`Yf`6qT&e@kYJ)j=^fUJ-n z^knGMF*;}bAfcd+2SROCbVQa~W(L>H+HulI69mk`;Y8#6d_S#E+#XYi4jn~7*+R$R z5WfyBn-bD&GW59S1xf4sM{u)&I(NQ4ZE*(q)~Rzk0L234h%wQ--k<2hJl@juYS=MRYT zpg*M>FHYZ@j2vO?PBanv4}8R7$!>A_1(bpxY&w|cx%) z-!EG{bLMB+StlDBYj*G6Z7`w@A-TrzBgfG`4uv0WZmKIO$Vkd6OpgvvN=YaztJ$_~ zTUmbQfslZ0JNG#(y5fTDn8b8s0oe&YnnfihW%?Hd-2l`yHa{kEe!x|uiyx4o?_lr) zb_357Osk=?fghYUf8fRs`16I4FZi9w4-h-Z${SOp_Zy`?fgOJotdFBip*e#ccFGU# z_AhyEPBhwbU5ll|{K1d#1L+j!s8UpmzYcG_XJ+30Zw2ZRF%2mMv)yE~n^EQHGZ3J` zM8(LS3^tS9M6;o&cS@z&YNKVju%{k^gm@K>@E~QC{g8Kt?#&NaYGi(Jk>$tu0XtAV zmS)1Kb}^7HBq~5-V4UIyPRzI96l|?fGka3!2jrGP;RvYftVKDk0jUlCL1pi6NUg)z ziUJn+#sdfP4A4D(YvV1fhh<$Yy#o>Bs2o&oipU|RR_eeHJ`QdONi3%} zgtV~~a(?jP#xy>Ez#=85Z$k5DhSc-t3mmX)v(o$ld%l2CC~NfyoIPLg+fxdDz@INr z2xwY%0sH{k*MED4pKQ+v=L?Z}=(l0X0-}*3_yO&&9C8vVmkQ19s5FTF0Tl?m zyagF2d(ICQ1!lUQFK~8*P*4c_vUM|ptKVK2M1fGWbcyTv0_O(^7&i;{36=B&WcIFn z@B`M=0h-UqYZGS%)lJ)xNjpEX9KjNXC1DlF{<45%lrx3Ru4picGj|vI2iKRj;2fUW z746R#X6!4Y=L@i7>k|QK|HM^C!4D{4R!^V~{kEqfM^U*gbT<)>-QnT~GlDB!`yUY4 z`~l|&O$JIH!htmkeNjlUUuYBf0m_qR1W@1XY<=SQQ3xFTfW}j_EQZ2Y+N9?TiKX;~ z2nwI|dq>MGenHjKHYF4H>Izi1>}^fWO090es$HN0R;xDZSgh5c*|K4MMI&vLDH_`j zM?{(srCo?So`_mu!I<3XFyYT3HrADA=jS1j%BHr~hBjI#13oO6*mDNyQL)8lKvBy;c}nRR}Xq-_7A~Gt;Ip_Tv!}tYG`zOz%%HP z0m=rU2{zhFl1hv9{vb2x{84BQr^PB5S*wFP?Gp+h9Iaj47M_riQEy|ia7sx@NlQyBC@9Fu$-yZMM~)ofuE`8=<=>Em4gcz6ettfD z!cTN`G%nB1&dkoFYqPWRtEy^x-SRm20fy}E{J_h5RL?%o?bv@TFTW7s@NYsQCDYxj3TJ`Gb3AmQ7fkmXuq4_dk6v_ZjKV z4>%!1V!#hdO6dctSy@>KAK57^EJPL#9z2LhVF{=5@^Y9FV`*tATr)BA9*xh7iqF2vdnoR&YklI6%^$!(X4Xup4lfFAx^G(E zL+>9_!wMD2+V;w*i3g9JXsM`p`Q5kGdee8y=D$15zaTGv!Qy2(Npa6UHpXx2jONPR z|N4KvW##rY%jVCX|8+*fiLd7RA5To0KFxpkuKfs>NWT;%Ya|S4L}+^Q{DCZ|v4ySETx@Kxf!@HYKHfqs2 zSV;6R0{lQXE4X6nh8U=4QV$4Oq|c*$5mW>%3w{7U)I6vPi)mH*Pl79e!4do18DFA^2j`MelT-y8RrM^M*S~KPgI%Jefxa5=emN;QJrAo-ZI$fbWmQ=MP-(FTeaOO2e>m-Ok4PmY^N$zgV<{9%Ptw zQHLW#f({%E-oJibfTpqOc+BCA+cqs;u?o?(HP#lEm*?e`Rp(VyRGF+wy|_9s!DMsBBo;wCLQz3skk0TK2a3?!XZ#iY$K7zpFg<(x zth3Tn2^g$45p@)OBbk|?RB?(N;fMmkKo&M=GqAyZA$tdTHw_+q$Vj zeEL;+Rq@=ppBLxmE?n?~vY{$7Ir`J3D+6{%*|h3q->xbz&YJt_7gg1@i@sjC^1HRf zo+)MyYM|UC^8;Br%8&2^x+xC3jkX+EH1CU~Y51aJk>U zvU!^#sD+`;n9b2GVWxVqS8&X3l}CsX=wYC(3MgdXpPRpwU6Q z6MnQg1N?x-S^V3|Y<=SFu%;zJ*;)$)4okFQjKoNW)-aF!-a-v`zt=(O=DTuBRZ?uf=2sAK%swF>-vaH*4k<69^D5*{3g8e z>_vB9rs-yjt(Yn!Nvc>c971kMnRda*Nv{vdvaTi!%_UvYH`rgVJ zyRx;?IF|Z2l-P=hnyGthz70-;{y^H0Yy{FGh|_oEP2XS5_eVmR5Ce12{>uJ=)nGQM zrL;!@>?vl4Gc@1mf1qjF>SNGJMzaCoz!f)c`VN{uh|Fn55mBm1W7Gc1e0}2j1Ie&N zB2fZx&TS=PH#@Kl{D7$e3-S&ReE&rLe1S$hq;u#Q|C_60XM{FO{D5T%w@7INKPa0S z#MUP|DcSH2gyw6f1y)X3mq2CP1&Gr+Y>mxzdbR3{?{;XRjh!|psv>%58(Wi$RzP3z z#7zbr7R4T`MwRHR{m6Z8?yJIvAH; zb5*}l&>T>cq%eHOVwBmt-xx2SkvHBo1kq68(lRwx5d6q;+65#J$T6bk9wqO{hU;2x zfM3bY<%xsUyfZ-es4LLjZphdWzFEBoIF7pTM$V{wh*gspa<+59!zV6nC(T?cG(!hy9`Z;f$ zrKlM{aJumW$=(I|`NHo`ev}`e#=r>*GCAQyRat3tWQ;~@JRBLLHPVc-*)Dz?RW~i5 z`twakG2B6yX*3$OdR@Iy#BdPmDx*?wg~qg4O(r<$cP2K2AH2OGy;?1p&9tEqSc2JV z3D47F%=*FVD5!A0KN38vjJD4L3ZQ+r9nDec=>tNvnU2X4SI|5wuM`=7SBXwMw&@_6?#B2*Cqif3W;O9#RM!q!4Pg!Qhy=D+?+-p|}kRHXCVc z2c$%4r6mI32ZvLObb8u%2vyT!HpW)cV{HHJ8PLA8OB3y;MBjXxwd3T>(3VX{bMz+K z#|f$$_F5}_pJ{q<;}3ypZCcs@3aVG5Qdb(J?=KYA87wCH+!Uf#D^&~jNc$sc1<|Od zO@ojU(4OD|Gx))~OAe?_cAY`5)zWvZTJ-kWyK<+6HXX{Wwb_Y~@$WN57V2o9gPpl* zGb=-Z${bDwDsfg&-PCOvEd~b)3W4hkS}K-H=N2k+4oqxP7 z8H^{PM2mh6alxnAWJs~FxVmEVNaa9}bNQ3);lp9ROuY(F_ zg|~tqpeE24mrMxAtTBsktcvjqYnih?%E*e#2Gwh}G#Y8%o&*9|Yn9Q)alM%^9VevT!6LP~(_&hAaF0^SV9{QC|o>54J%X z1R55?wQm;yeWZg0Lr&JMBLLRB6I-Dl#E2lkSK1XfDh@p};lezV{rQ6R+w58=Jujnk zuJCAhPYjZjsYC2_(_>sIcFGUVmm3feI_sJ`u0L?&2czeo(09!bdV7!N`~ZPSVV*0f zNO95m@`H1GzQ9Y548+StarXSJmk$_zUEjy4Ac>v2lFOVgD7rU4VELB$!9|vHm_OhL zfcH?;cL7wh8JAvuv~FfdhZl<#mZ+E42fmxdRkPvOmyN72>(2eWqOxWB)^x((_3 z3;ufw4D4MD>29&-3;uz%(|2a^=LF-23*ZMG-fvtKQq0#UO5>noRgV4 z!C|&rtPZ={ph0QVb2lW$A>RAy=KH4}yZf!f_fI)~?}yQMe|Y5HcjE5(Am+i>_qJHY z#O(U31`WB)N7@yj_n;BI|8PrF=|2*p@4oSmSJ4j7%DSAB@vU`bdD*c#m6E;EC+&&| zMo4pAs61?@4F-)}{L8DG?|v`po)6;gof>)9`$zAd68X^7xO=8V-}%uDd;8 zeWuEK{pEe0qnV*I_`$QjAN&YEV0HMDMLT-=jJToy)8v`;M^cq^BEeKRt~_2iCl^ zF~gl7pe2AGV9ff_y4W-M0aUn)AHWhJb>Ii&7b$FiztP1HsO=$0caN{NPw#Q+xKQXlVa~19dZZ=cC)=cY&wJ#SdKjAHcFxegG#IKj6<7 z04hoQkMM(OtB-Zy2mJYh`}zZf;^GGzLQ}{ehf~aH>3shK&JPyt&+3#P%vm4B`2l5B z+W(-`Ke(|2KZqzXp$vb7AAnIg9gS^G8m%7WK&=IRb6X(73&CC3^B9ZOfMSMPbvRAn z5;iL($0?YhLO|T^`5@~4Ipudv&A<24(z`z?yn9;lUuIR_Jv;ZlkB+wpVti(0uYSYW zs{YYe^dEP*&&ZyG#{9`!p;O-fiJwBP^v*nSQ%;(qt?JI?L`7We134KXluQN~==QQx zs0SocO)uid4*awP5#2kp;C^VVIl1?IS`KwJ@ZIBag=i3B@0*_Tf{GeA5(=_c|FJy> zjq@5f_R0a{FT3%PW+iQBg7ouX0fdQ=aY`k?jsUj@V8ek*U=s!3Z!-RhsAuKhGo$S8 zSw(mH7vABY3zd1-jKX=_GYt;W^ZJLc^zrS{cZ54X0AuLYcPM|pz(a$E<_6@8M+Y;{ zAUC@>1X?7laN2SG0TaGHan!s7)TSX5KkBgm0bieZS^qKreQzFx%YayT;G8S)Q^W`} zPfR(CPfaJ+sT6Ve1cSo6R0KKGx~;g=faSFYu~M@l!-FaFMK7v48sY z_RIQ@xUTQx@J#K{we10=g#EGtDJdyYsZ`A26ezjvptLhc=bb_32eNdOAK?d7M^39I zXdYIg-%^CxrP;*(X&t4lnnKZ2&o~64g~&5K%rk)%dX=^CQ?7d-{F=~XPOpJ zJSDUtIIW5q!i=uj@apJ%* zB%%aacGxjOV%zM9;_ghn-@(TBmWGj*wbMFEctBt8w>xWQxC-M!-o4=8;uNB*?9+nl zr|&LMQgOhAIv;f3MLKbMNX_)!d0IOyiH9~rc5Dt|aYV(m11&3p(IfHU^(?jasTN|aPgrIAuhwgeo zoUto&N@#Orek*LP7FuipZl1G}D!Od6{ zUN+-k%YxucEv1n11Mlec|F=5k!{GY4>!YmHOETC6jZ>TvTt4lPGO0w`RuaAu+L3Z` zYEb>uof#-PDfBadZV_Re`}Z3$ZZ;T@5L<11m6g4?$ZiBR8k*s^8&Qiei2v)GD<{2w z*Om9)cmJ%6`(~BhH@kA6U*3JwqMK}Dd|E}XzJsBydkq}kd(fy}H{JQl%U4bquK3^o z6gF*NYpa)2bEQLnnMJ8^=z7>S*Sz)mAL%Byrw3`{2G{^7pF7_=bo=a*+ot8;NUcaJ2(+mINU%Y5r*&tu9LBo5a%m$}Ky$ZdtK*jY`{6o|`)1zf%H(k0mFjE^@&n^9Y-GMJR9@`%tef)SraehHY zO6rM(<6o`V^5u@$&(?)!jaq-FYjOduSoRgVl zjmm}Fq84mAl#-sCnws9$)|Q@{mY9|l5SRDu-uU@zcBf_LBqbit$;vJ*E=xF(x^(-o z`CE=HTeBk}IV~?AK@}p6$J26F~?KB-xvAG+HeG(o|YAVJhq@P z`|y#d6Pd+}cSp_Ja(Ms2WBkprgoMNsiOF-9Z~b~_+;@AAWfhf1$Hqh-kIT!;DJm*D zlvMcTmZS4m?aRw8PE0rvcRV5eWJXxT;e}fx=4?K?Xw{~~q_n);?1F+k*l*Z-1c9vB z6;bN zmzbWOUzm3+>TpJSPHs`fg3V!H?>#>MhutSLaif#tlTu5|suGe;F57+xW&8cc-SH<9 z($i1oX6Gd&#(lpf&p(mJm=e;fwweQKji(ujki4XNAHJjy8W+;zJKoh@Z*Ym{_>|MhrRIB z@OS?`kt3)|A1;sl-w#Qzf1CW~@}zf`#lP`w>>DdiytXXv z^+i!(v5D~sDUUw$!ox#ecx3oXj|_eFUxQzIbm)r@4|(a)=U#dIx#y2Y9S;jTaQN_1 zgbyI_gai~I0gVy2W5KB_-wN=9ZO|qxGGLi=DG{ z*UO)WyzoWP^IwL%_(kC4&ky|P^WYcf2L0!=u$e1@6Vfw>kALauVJ|&C_+`ZS$k3Pn zJ>=!bhQIjFA+J3A>`QaLSdy1lfL4a=AbcPtB?X0v%p&`UsI;^c-3!dfY-VOAs%v~~ zN@R3YWK`Vo=$L~cflY1Z7v}Do{8ixdpYQ+AXZxT3EMU^-0Tbr#dud+qn_q1W2tE{d zJn_+|CO#`k^|?PpSHe;-;;kk3aY7 zbHiVDpzEc*!9<-(Eed9^Qlm+5ScQg~%7#{zN>5+bXlXLSNvSb9t@`S!GL25FGg$?Y zS-rlhs>WzRJ?Gtc=aBh*apx5Ft9%VPw zCYa3BmC_Z&g~5%@7KeawDLPjKM!wKQY!>>03|-E?ghczu+8s1j<}3E?0*zH^jer9~ z5e$Dp@I{N2<}t{f!ne^%Z?;5>4RqMM3y6W{8fdjS22T_YO%l-KTO=EyVZ@14;R-Yv zBYfb;;>0-LiUBaYkd98;50XeXQcG8}%|@J*7Fbe>*kDGmnds{&q62B8b41EEhY(Rn zP7C4?5DQBQ1tp-w3`ioiK6n?*HlA5}nn*)9+cmOio}P~s_>*>9Gm|w$cyM?JyZps;CW=bym6*2^BA8nyy45EP@&K2oHT6l0o)V zm#AzJF-iljRx`>Abw_YojVuIq%WSYAKU7vI0=DZQ;-cgsNmQOl2IUud5CqDm1%dL? zpbZ14Y;oIhEx$)}*%|1-4}SFfOsJnI0V*;Z6))Xcq!l$B8L`tAN|Z+%D!*gtk`L?Z z?+Xi5l;n77nr_WYQfQPn=bltFR{wd?!pU^&sXDW^W~E(jjDq3C$=8_F0|k|rsP83e zyv$04MdLku*!55+G{w~pq>Um$ln#2gg4I`4G$aCbh*}|)zMVA(DoEPf38hajJmQ|W z3%uBna9r-Bx{UyN$Sej4?x$2D?O>-SYMu^@-AR>$a)LGi7c>ngwQ2-TlV{XCX%kW; zS-KboWSUZjqN9m@9)4Hg*SG-}QIPntI1PemLSE=z!6Rx83IdsNLS@pE2sWe1+@20}&XS5F zeyMxmDd_@~K$#!N;x6Ytf6xx9f^eZ;2O3OJ{qXI=Pe1=+#hP_o38B@YBI;Y4H>_O# z@$_klsrjriQ0+srt;tW{yl&ODt-G>{Yp9|+oMwmBYHmq8k(3ml5S^B7MyC!PgAT#eB6&4|~>J9d?uH-8WwvGh*b#|GY-Z zLuw`t(PS^oIQh+jIR_8Nfd-KBpypyOOwYo=d&h>g>FGt_F6_N}WJ&+s>hJgL+p95J zb?676*U;3Feus70f_Yzj_W6?U*XxNxh(c;wxrx9wB(n85G%$qlF z&yJld*Y1Rk6C4Q2&uP(UnsArnjwh7YH&G_3UxR<^iP)p_zWl1SroOqc2{uwm+Lde9 z{IGb%_e)o-q&Ereb`x9>oI(5I*wMp=4Vk~>2kBYx!NQbPym#YGF>&rSVzb@AV) ze4wzXt}`opSlj4ffkWeAQ7bGh9#g0OpVpv6LYWZoLoC`MrX_|fTJ+$EA&O6Djw~vT zM89a@HGp~KTATxBB$AW|6#`EbQoz$h*KjLJ5>+i;w)k!L!_wTIO=fw1U@E(?%i9Q zTbN%|$u{64-RTsKE0=#8uy6mGjUgENvV9RyS1lEJxmz}GEXc{-6A+F-*!TwHLd(Ih z16ww%FD)pmtg5rwO$eT%aHy9qUmvi0Yj{ko34>L7`<&XdXjHHIVfB$?hn6hch#aA( z!hi<)rY!el(4IZD<<-YxlHrTC5TH?xX@5}IwyhgW%L*!L8{wUp2QhbH$yW=uZ`%@j zB*w_552(pei_)xFy)ir_a8GbJtSFdGqPa^M!v>`n8>xu zzT2~PPib{EO$^v*Qb91QzF)OIH92j|jzFEoLYwZ}pmX(wo5uHGTGZBLk zxL9JMk48tw9zAv_ue?F(1TcKC8aAw2m6MUWHy~VZpcgRFePF~XG}Rr72u)5&*t!3R zPQZ}G$a-n}iRhrX*yy`K&32Zo84lvI<3a-+cq5t4%r`k)BsW@V1!45 z?AF?%P1|tgGC)V_)$8fWp!WFbOtML2NQP=FtA#I|2hE zn$*%#m@|Q5M8|(V{Gbc4)Z+kxs&$BUt+i7=d~E%gy3tEM!^K|GHqN<0eRali* zzx8@wjK8TK(IqHRs5hE`K;blA zCdtG}0Lq*Kr|ON8A`>+Vx^eUwXha5AT9-$~P05EVE~CngaV^UWg+zzW!JMeo6L+_f z&PRHTY~n|1Q1D}Sl-1}^3#dq$u0zU+zfykzu&B=x$5|jkWL7F+X5-!aa3hEim6UF_OR1eqVm(oudQKcF6vrnSk7&8*j{n$>E9 zp0=%r)|VQI)zs9c*6G=Jf-!5FaR| zotxEy2BcJJGP!?V8!8~P=$f1sOG~rLY^GJ5=;$d5Dob5e zRfWn(ofijb7>83Z>07EB=<$ct=diAj_LxxC*OR)V?65l}SdHKhsumP2X>&)n`oVn_OjT7i zts2@(m_>+w&SImzF%2qJTWyny`KCgl=NeWp8BY-U4EZ6iHw zf^wpgVfV=<=(Os_#%5M|09L#tmbSLGdZh-m0|kg=6F~$7b47K7)?|f^!%DLx)Kl9m z7M-E4uEAg?a=>c~VgMyFYE{(@ZScne?*uG`7lI$qSIMXtD%!-g$Er7kcPOV8Wx&!2j9QC;Q0aO;6?J}K{waNob)a(61GexCbU-T%ZhD>_eVE1D8+?) zGGnX6gyNQRmALv)eNM9&SD~T3-JzM!H&zscl^*gHtHjJ&6{1|Y@o=SH+!s-}`B2gJ zgO$mp_RO+2ltWl#X_Zzis1g&4#qYzj*Bq;Fw1^?GHG7kk8{=EDtHsdR(rpQi)q&Nj6x}g4;3+N0iHkTKaVT1)vLFqh zDHN2`l${wLaVRwCz#+6mo<{~-eC&|}p@)t{rBDv3UuIF;42g-6;Ri#*4oA{5e)dQM zzO5F0YC=Nj!LWme;}I??Z{*yjYi+5IJap*bp|Ha0TJpz81}>>6%svvbKQcT@Z(y^* z@b0u*1Zzs_@%{VvMjVSag8+bVBAbZ9qK=I^9263KJR_Gre@vgjq+yx5wIwbhJp4#x zO?5Lmaol&5IRY;!N(tJt??CuLHJhC16jUas^8?s$NIuRDReB5;y7xdutbX$VH`56IA|DTUg7CTFJDE3A6YDt;9Qn%@rmnGt8j&@WY4du&rSx< z|F|simu zNkX~3FX{{EPL!RLf)PUr&dF4pPaPMi6V0ruo)bMwvt0fpmWZG17F?G7+-$Cb%-p!i z_eptDSMHb+V6jP})s*529DM|`lDmFHTCz}a6)1Ul3v)kp?kcbr{;~L{%9p$`?%70@ z5JKO)L^*?$pMSM;KNO*=9J$E6^|s1|x{0HHnfQY);f1IHU!1Yd^@ow(K@-F0T_db< zH^wmz$*@Z^a~H+NnhKK9J%t>VM#i7}hpLHYmSt{raW57oRFe|tpXF&`{g0Xxlp{QJ z;4s{Ix7L|apZ;S13KM9nC_3q|pd9NdxT&mcwiACYeO^ENcGre~@2!5Cl<2YZ?38k= z4uZ(^`7XDQz^cWSTHSz=QCG_>nXJ6ty1%jFO2gbq#D-2n*9-V@cLaW^uFi822)OA&CRTXD#yQD8Y?<8 z9e8MkS5hHr&y9)wSnY3efn{y^m6oh9U1UVQ+0T%=(j+v`(RJ4UMbE+@EchTDSzVI; zxseG2LecYCGbJ?wB9&tW$5T{Ld|nLI-rKs)-tntyZTfWX02Xv2o0?eQXPm`|rsLvu zmRIFBamc_Cb+l2kyQrZHu{dvXj>IY8bg0q*ysKV}=ZtPp4X0w>#iP1xzr8ZGQoB+T z$KnIhWYRY?PW5pP6F;r~?ok`-NATc@MnlEKj5E;>mONO=Bc^4@a;7WPM(ynElvq-x zM=?>YSj>{y3M9o@@9f>c`)CxJ&}+-I1!MEBpm19Na%GCB=s(%rr3t4yz(~R_;7q`k;2M*mA`T=p#;QL}!ERP8cNZroqYhYO zMFnBYbAB(COEj*X#RNx_&5C?~A6bw&)GMaL`NQaFzU7O~MCR)f(nH-q{ybla1*)DN zq9(i++_XU%y9ZdpzVr>s)0winj5=+^pu^xHS$_k$(0LTLD`xAPwiLP?{AAupYXzOU z24R>T6Q8Rj{s5Y&7Ei1Q?Q#HD?&a)B$55D;l$+6(_80zl;Kw&|tSDp&f<4^q>siEB zEHRUVN9x$o%J_w#-{PANXR5N#eXY=}=WUHUyo{XNa&12xS25An2`|dM{XERg{NXdx z5UF>F@;0_VC+dcwJ}JWmKB>ten%@rOS#8Xf~+XW~@g>9=YK@ zS?i}3YnTGbk|#{rH$RFx_d&Y?v1fT|6>^!1S|N3Pv6*dAkzDgr9fOyhZBeA6mQ+3R z9`?$<} zG2QZXKa^uoVZ~i^0)CB{m|5ow%3P8erbpoj*eSVDx2{V=wi8>91fdr{b+Tlafkz9> zo_`W6=I&XjB*{~(m$H?|P*i7((GNn?vcdK`)NwJdRFiw&i#p+(;5{3W`|+fLFt+6# z^SfW2NKX6JeWJ>5uA%}anvu33IYFrKCy_Tl2P7)R>~W2>T$DA>Dc_tLG1@?A+Smj? z&Fnhn@SI9&vO@W@30Ve%9TJxcr09%TAr@L%875Uf9gPU{6`_1L;skY){Rz3Bl5{Ma z`KrHh)JT{BVP9Uz_=OEcRYSZBi)Jew?{8WYU}A0$=LA5?#G_;{;&=y*CQh&sijA-oNdi&tjts2`Y8$ znIiPdJQ_}oyehHm@oua#-OPM*pi#3E{iN$V;wH!ku zE-ABFa*CVNjGljn?i-g<80(K|sr_&YU;990`Iit=^V_$<@Nv9X?t_R#T}n%Xj2v>M zf?Q+|pRXW`=yxG3=e;Q*6H(l$BYgSZWfHu>zAZJ!9eJT<;jrSg1$0a;u9@G2{oj~^ zRI}4AH5KD~G`@U`rHhH5+6i^sZ`dxhLaMxY^*g#W4W;H}ms;a}8+4<-EPsCA(_ZC> z$G*X#FkX4lfOPznbVqaXI-AVn6>{MSL13m#2bTn^M=NQ(|I3)Wdn5kZWEASZRzczj zb!nPmCpQ>(b&uXjQ-B`-jN^bTpI;JZFs)~Sof(Z4e=Zw}x$zeAn+QAaSUSHV{!d|+ zZv+ioxjK<75>HqzZzx!7!ier*GDaJ@@tDsFG|G37LspV1U^(7)*bbp!RuK%slr}}; zzD85Ns-4#eD|F#cN3~B|#wu4~Uyzvh_PTVJXpQw>kMt6y7SSnRJE|uuHmP`h8Td=a z-rZrB)%01^Mqd8}TK*H~Uc{EDypHaZ7-^va%`i@i?@w4~TkBX?x%`!-P0 zywI8onF6}nJMIJ%O-6rbWY{^x~o&hI_1&q$;+_CL681g^KX$5 z*_XSRkzP3F6@6Uu6P0;CDQ;89MX0|Il`Cz5zp|h_MXG%xn35?8|C}dM?Raf?)7|}Y zeQ@Iz!kI1J0PWquWyIPx(zlaryz|qV4kUK}Runke4JU04Sr5B5{vK^a-IueOU5fqY z=D>S#Q~NB4@w3sSXX$#SR^Y17iyF(}KfAg|qHpUiK~~;eHIM3ytBIY3<>h_&m%eSkD$M!`}D**|Gc{)^60?wtcCkyAZ&1v#v&_ zOPjGR)ev|lPRk@=7rTxX!b^8oq>^T|`%6bTOpPLmAxkR#h;7rQSDZA`=$F}|lk8AHWE4#^>yahPP{E?~=NVF(Aymq4Cb z^dI>0nZuNt`Dxf<|3~Q&PNf(;DnYEXyPjiR`!L4;{1--=RmfllWTn-kH^CUJ?&Rxc z5{-RnScmWA|2=F^$SWY{DOuoPaDGnz`Go$%j@qJDrj7YOS?%_Ao4|fJjY&z>w9WSp zh85YjN~ohdU3M&lbDS=7E08c1&{XA45HHHVWNRxgjug+)LH}0BkSl+9Ur#J67q_N9IMFA3&0KNpgvw{Yx*|kbw zxGg*`QX!{{LX(YC5?{Eq_Pyt1r;-Ez-(%pZbM2lPOr$bovH2l~xksZY)q!u6WXGFI zj^Y0vLT$=n_)8ALikR8mzfXxQ!idm zKZ=JOyedSuUr%=l4IBf@j`yRFID*N z&no2E<4GTW>K#xzir}a8ndf~|04=0UiInvxv@@1o76Mv z1>KO{gx^@4u{4T(X7VoK#{hTs9by(zGTSq9rf`vFx z4};Nb&)-B&hwikXG^fh_{K=L9$Ho4C+x+Z6yFE{voI;|w934__SQiaGn$*)Y+SlR5 z0c9da6jtoYha<)zyjcG?VGPM9;8LZgr3I-3a>KCD&R>cl3@0*~bg$CTf(Ck`Befy_ zb3t0=DK-$;#L&j)DqpIZMRc@iSmOQ5;Y(v1NQ(d8L#7)*|K|pa0yZTLMccfdjWf;+ zxDDk0PAl3Q+twUy%n(=Y%^#-mZd|vlLa|n!*$Y)khcLQfh3r(l!*#u;=H_@&^CWp2 z&&<t4I7?+cx(Te{Y?O3LFXKQzI7A341i-5d;F zVKD@TY_6xaHaCmYnM{9^8NF^#8;STQMTXnXVb5OKSYyh0W@}@*Sh`*q&&55xP%TgP zcr&knK%KY4IE;`2&q|*jo4m|pT#OU0o3g*t9^UvLA>>OV?gp8563pS5HW)1IqQ(rS z_$^v-{!M`_yu0k~Xo-n`-OPW^jWyu6mF!Nu^6&1oGP7Z%NC(x`~iiQB}&^pNqewDk})l1s4K@p6bu zs`cwG-ozym!mnbCB8-eLZ9E;WOA<2J{iv%ANjJ#A6hKDCf90C%0Bpj6ghw<{x7^je zvVyy^;&b&Up4!S99`2{Qn%X-*W@g4_Sh$7Cn%-B$=o?#DR2$Qv_pJGTFU2Uo<64h~ z{r9w8Mb7N{&SQLmk{pQ*KxyZD3&F?Ck7RNRnWf!2fNH&B-nbEk34_ zwKY9EICKjZl6I;k|G(F9-4v8D0%V|SaYINGfL=CV3J!Bv*Rvx2cc6o{AV#o+ghbPt zd`U%34W>le9POR=fA{K|4B;vYr)_h9Yz*Oi<=}lH0op~oPM9geymI*<|MH(~9<0UR z>66+)4cj|%7N)jJC6gSdZKGN4dHOP+B5>M@*&AtJgd|nTTd53)OD?S-QAy?yO|-?8 z>Oe0~6J=Y*#5^jG&$&QVtQV&fHKIf48mkMA{rlM`=uH%2#gp&_Kdv(Fd5pY@pNnW$ zlBkz)Od$hl@~85}l*G(2tCTxfc*9m*d$nCM$HyNkR$4UhqQF2`dAXhlTSvkSG+T9; z*>h(?^r{Kw`Q1Dn(uO}*H57sPQ9lF3*5eG_cToen?1jKkO#fI%?}X#p#BO)h*^3$5 zM}C&0Tq^AFY@+bKB(pcWUgEvP-s|UP!+v3P@!dh@(yldmUTcd~0%)>$`sbY=O$k&8 z%)2#xpY=fg=>spPo)A{r+OA7;cb0V?d4-Fel9Tgic={ZgL&@sd{LFg;*y(&S4ENvr zcPJK4qvK<(v)g>$9Jku3KBc?0M254)=ul$Ic_xPj*)HQ|lv=-j7*1TzunCoY)o^?* zXIUv9Xzi}qqhtbkR^Zz+Gc&U?)pPMZ4UHcy_sAXBkg(8D2)yB{Wm4 z@d$`cZdD|@>ix4`+fA$4LsF(n-?nrrMqnxekI1vabU%Xbpgi0155}>yu<;dFPG<{B zD!m@P#Tyv6OwAd>36_IEqk9S5HGw-Nu^+W_1l<;e z!^6XA83K_J+_jx={-Q|!)YEuw<4P#uDR~&22FG_wcpilF6_wztWiEYodiBYq={T4E zIG52lDicU<*mQjS&p97!4S(6Nok=|Vl|AF1jg+AUh4xAzUN4etw|dr=YApq`_p*gsc{9ibXd+N z&eu}{0*+JYq@ZYnCo2KJy^3hRN5A>hz2lis ziuk1;7^D;vE7uez+wY=!Szz-)uAcE|H%P50m*M7^FIDCw=-_vELb$iW?9883>A#yq z^UIe`(&^Y=i3i3bX+ElOO6#$M^Hn;GqY`J>HZ%DE?5KO{!U~q|p?&jX644HhJbk3Y zQ8~Ic5SyV&M}zDHITgb2A006yJA&zX2=bO1a^Mvducf}x@~7)gl2E)y=Oydx>}1m` z#3QbIIYv&~Lm-cVAb?^@%(uAFs4GFCjJoA|Mc){>^G9pnSMkZ_L#9`SI>z*6^cUKw=%6()nov%yKY;GCL!J!?QNP;^gAOz z-iILhNd(MZoh=4ZV-*qN18((=-fGxz$V$c)XLzr_k<1W=MufVzFaj>aJYd$7Wk6bM zHqC-iS$x_xO2i*JkKb4E9+!yU*Y{TbP7xQP;;mE1{vISH*?bUla(cR|M<|cg#w00e zUN#M2n|E*D!bn_KI>?eD^tkRe`NCIo-ZZdP?j;fg+x2`KL8<01j*h)C)zyNyfnLEH z;e}Fhww4NZ)$*7$Ur>`)tIC=W4r7>UJxX)nhAt4ZnBcl?wsLox@xsEwPQlX=lI)vG zT=D4Ei~YI2gWyUyfTRETnMWgEtTid=ABBOAdS0%d9cU8cwYkZJTt?-D_}r{whP87W z-_7@=jv-QCscs9l0lDQdNr|8UZ=~}zEx!+Y(uwEj#B#itF~xE%>hf#UR}y|AH$qCD zVpAB0_er>S#I)^QV`QSs@irJrvA7a#Bx0bNDofatN%4aZzTVzQsWXQtP93z2r(bCc zU%)VMca4UyaJOQ$#Ug1t`RO-cGg!Tq5@;Qof(^odrUH@Tn=ibzAYr42?a5;_au|W+ z-=fA+L*A2GhP)R)o5~*JL|`K6Eo%-WQ2~DR7xvviiW(z8rxX*Tz^sdc zg9*sV$RZdJqzz}1UT@n7$Xv*?0Qoh)KwMDog!G#U zW0PqGBb3a@cN4UP60q>Ek$G~m$+U#Q@f^j1*VkANkD5e71Xc&-kYva+(ks+R*4HlA8p+=$vp{MtnR6PDVYWe|a3xo&}U zkl@t;BoO3@>nFKVZ#M+=BMZLR!wAXJYwP7%(T!d^`f~hm(nrwFo$o2#_|Ps5X!Z51 z7%2&)n(z&zno@_D1-;2|9uQYFm{+1>6XG4)K z55;uOm>+b9jfyB@Bc-5#;{eQ9iaU^6;y`aaY6{S4wU4MZ#zrf`N9MJLC$&Ve7#XhP zRx$adzkx5((O;^Wk zqeF7}TJCO@0BGgrd4KiwF?oHeM5!qBY=nqK)zW7|r0wbokf;>~Wk+3C)(-+xVfVMm zbW;8&$R0<~Cr-@AlQLJdl8A%^oUp~IDNtV-UffQ)8odHJ^l^l}s4W&G1R{tf zU{Jln&6DuiD%Ns!a$2S5SC0n!2AEp;y)&;?O~v_e@lEP@8CVtHmlPYYc73q5zCNrQ zBJ=9mGvYUDmm9sWAj9Wn8?cb|Xt?j$nTC#z-*ayQUIc-d=iKS~(ATq3ZvMMNkMKOf zmpFJeA?R%(TMsCK2z-?~`NxO*$G^WHy+g9VFtyR=6v$7YJFe>urZ2q#RM*i*NYMjH zX7F7)3LdC|ij)+c9wg+h?Bc@R3YI4VEtAq?DLk9a0yVuX1EBvn*J-xZyi4#PL9=a* z29IxoN~xJ6iRp(u=49J$#?1MCMTK#a0fJO>QX#G28w$V+u`DfftL+VYqfnsa1aP%= zi)8QbuYRl1<%+nFTec^N1q*tt`7KB#(WVgI1aug7AeHWWqHmV2GIKo0# z&QXN&YX5)+0K49kv;!RmF#tlYZui6OzD?k2v`Qj5lMU9%#heXT0`{s&9^P{j{&*GM zso5UO2FQ9F(xVNe+~W;_xeWC&A_8qX4GxF5Gl0y&eIQERLTT*Dsn375Cg8-c51Z$H zh5bGJ`gnirIJZ*<6eezHY!m>=tEHw3=gQrc;VOE-B6{3fS1$Vq!e*fSHHsv*lV(Z*qE1c zT)`VO(7G7MddN{bxV;Z?Tt7swl$BW6_{xKC4P{#!07Y=QQmW*hW!;QJQt2>JN< z{0>|PI!c9wh0%z)cW!1{^!E1Z7yi9G%##b34fZ>qL`vdP@b+&41%?zN>^9=ZP`c z_{zuoa<8h^du_nS7Z5f|sf-+W6b4`@s5(j}Mc=b6&!WY(=g^|j0iVYT(aaIr|K;^x ze{(|w2kN+L84=k*e>@4-J7?fl3{w{g$%`O}`gG|z6}|(9ynGnN5oI`{m+vZJcVs`I z|D4*#yo{ymmw&_02GNEc&w^|dkI@RDm%&oU_>AaL??b~cJ-a3@p+bB~r!%_zY0yG90E4<3QBv9Y*= zgF~sz`bWjFUQAs_#R@$~pzUZ}N7%&=)3V@_u;O2i!qiO~v<6jErIs%z_=cj@iSaZ) zyct^h`4baukC_^;mxr5M>F>}4oJ29k(8!21rE`RdR#}bfEiG@GamgkecjGiN~GeYQjy`;3fbbXH`3Mk zLt`I%dlhM4pq+q-FggU2+z5FBP;GkBCx;a|*Wx^{k>HgB;5OhD;P?O{F$GEZc9C}& z>w@@HUDey^c>;&mADeW<%jErbWjY@S$gh!k@y`{NrabeWBLqjv}P@?RJO4w zrV(U4AbRX(43Vh7o*PdIy!=U%}PoJua5F7*jj5;=M=9Nq2SCA$vGg}hj8Ec26@e~3@W2@=yi zzBY@PL*vleSp;?j_om6b8j99tT#;4L?72xwsgin&AC04%91^2xV`LQdH!2g;^m=>7 zkwd}AJrD%PG>#(SnRc9ZfNsfGD#wZ$E;AD|goB2*-N@8nk%M0yEkMU7S#n_Y;+Ya)9QL`r&&Y`*&Xf#NDxk%(0)xJS*g z#5Upy7OkC&Suf3TK{3S(EF2ugudzIggzv#OktCRF|FE8_m-yK($@_>b15+Wep6ty= zo7ei()!^Wus#zD8V=Di0~%C1hl{^#?g)9kCo;0O%796}1@dsU$%LvXYJ>jWqg&FUdK3QVd|2oegfh{1{?Pv| z#UiMU_!HfDopQBeOV6|?`q+9>ZA}g2${Qe>wHynun}ah=gPATe|&Xd%nc{y3m`^oF|U2%sBSUhK#|oR`Z1 zrW=8)-O+M;9Q8vwaT4hE@(|Y>Bq!Y?tqpjhEz#RD(2~^HwX;EJi;R-CzBB&}G!*q8 zoTSH{e;^%1N$w@$LrGLX{o;SCYP%x^2ZP<;3y&{ZXo`y+v9u0scTTI~q%8A2x zAY$yG&=rIdIKV+_Nt8XET6#Z$ei<-&l}F5XF^Hnqm(O=hADZaXZFf?E#(eouG|h;I zgwmbh2^7oUp?`GFKM=@XBVS*wfZs&uzGE(xEwX;OkzQCp>!|{3P#N`-7_aTV-77B& zOXw{Aq8flhL&`HN+QbJ#SJEi6P#uwHVZBLL-+VQr>sR4EkP8C3&+1=eO z9tJ2~@vyTI_PEnb3-^fdw?Z)w#kg%7z%=`f85uah*UD%5omi^?h>Dp6K*l71-o$KC z3f!#iOoBBEj@lE=L0d>45PCkXrhl`vkb&VjIy|iY4Gpv-LTh1ejzp0+ z-uQtgUnhUX49?Qil4R@}Rj-p6*tr`tzx;$6{*}mgb<7Umb%-?$uGoV8j9m!K!TAj) z9+<8{<==>6DN1`sYD`P-xgmnB=3luH#qtS~a)S2Z+abzP4w^$7>i3|KB=O$(*vUhb zEGkTTqHFZjUW`Ia%C=XtqO|R=AV(3glU5SY5&R>84j#ane5%z~KwBJS8<_0HE7!Q~wK?oZMu4wo*1@Z+yv+XXORfY6`ReEA=ax%dcV}aFXY|%spV&K3XMCRf zAXW>B5Hiu?XXl=1AT5~1FRvlGVjaqFUIfx}ciu-R;*A{8b?;~#BuejiDld}s*YzgQ z10!(cOJsCAoZc&SIvRk;L1Ig6R8PnO1TO^Ag|Y1P0++q7w->s#0VB`}dhfg8e9erO zQ0UvW;)E$-R@v(zrj4q(4;`j31qIP~FvRBtX1@3vLV ziM8ngO6HIjiUkHw#Y!yUQhwM(@d5{UihY4E1%Pl0Xe{a5di;diUX~;2L05)hCHu20 z*vRr_y|A!{^W7P%%<(RtHg;m91LQ~(`auB$mB5|(pKk;W@Qpy+vD@-iBDT15mZw(D z5q_fupfDWuZ7Zd-098vmOOyZ_cYkoJ94^qCr<|L2uSgfSF}A#SU-Y)6cla?w7n>dj zZv;tVs-V%Af~Ws>SzFPxk?)E-_%5Qmn*TI|5)w_3+Z034e59}nnC4W|;{>v!HCU zh>ge7DA4Hd%mH89e;jQk+}=~wo&p&|>)vvjuxTYP_9doMHpy26ob%gc*;?$V#b52e zB5{Nx@Vp5xN{_Q$_`ni~=z~Ri&xlvq;izf7GsHowo|(}0naR{FJ%fMNHIS?VMgtLe zR!e~7U^#~9;o*S(T8$s8zxZz(Ra-yL6QcpW=AnTEfaa|u@U_^Ms& zv^y7?yYgq9M5dhmvM?Q}{sPqf%*dMfwkz=E-21C#ZO(JoSmg&d42nguAGadwK;uI| z;`)-@aSbc9f;21C2!cQJzu1}Z9dv*|7mP;)*ekED5R7>|iwxZ7dm0Q*ZwHe%s;cC} z7ypo+~bCP z<2gIyJ6yF{lc;)2&aBP1bD{B{7=#`d^!U_CBlUT7Le2;4^ZUWbypLz5R0e3*#q`Lb zqr}E@B5P~w(C;G`j(hCuMm(S0e3}16EIHCfdfNLkUI$hpvK%1#)`tm2kNGI`e;x{@ z&slk=;lm2O8}THyJ!$pj6a+9JP`llB`pSf6&JeHIwAQ*J0WgR5e^xJb2K{+e^m^;? z@O8_{6XVyX3W*R$xP2PhrSTv!!B=mBN5Sau^r3NALX3g&Q1dwcs%+UQZEoTOQlS?k z`3@AE4pWi+c^~PG&)Wt`^6S<3a#Ps#@u7dz8;Z?+c@LhiU=%X~qZP*uoD7-K5mw{P zfHQz^dH5!m6dw^wiRIaqvDcU^!41K)I*?E%24?-C ztI%T6=&q=++7H7LKTF59s*Gg22XLS zBOFs7%7%Z%T8i)_re#?;Sq|-C1g}zr!6w-f_`YL(o zlviaEv?eWzaAsy;CaikwJO-txF1FFgK-O$uydEW z-Rvj4Me;K9G3AvUgmvxAr)266x>d@t4&QgQHSu|VOiVx>xnAet&)m9`1dU(C>>N0I*2KW#R7iQvl$WOAZ**jPD(F?e4Dtjef1vcD3zLpc$P-skKAR!KqZp>dL|3q^uxJws<=@-JhOQSCqM^JL@ zdj{I?xvk+1WF$_JqPQD*3H+`bsH!}5t|28D!|Kk)0@!r@8 zU-KQxFV7l5X8~#cQwP32y0h^f50zzxHhyn;mBk0d2RIOBk5o)=6KhAqF>bZe%jh@F=c3ylC+yyHu-{!7mgkN>n+E=Za;~@8qj~j4>zje0?V2 zM%|<1m>ywL{qxf~W}<;zovl%^X-`Z5L~xlY1OB`8oMyT&q;0zzPSz@0z9VEg?ZK+U zgq%NG4bXxh@EC);=$qtgG32H=b%L9TR5J`b1a`*7_wd=Or~7~Hrvp)T4|Gc0on*{p z0~fZ3T9xB+=RSVKXTj(4)bAmRF*NqxCl(}c-)Bt@kA=pp1V3)zzj&#Pdz*qt|46ua ze^)aS0Z{@ogV~Y?Ee$z84kfbd#ZisedcVnj!}RfEJk_qP!>8=@e@Ebse8XN48*kTf zJ;x*P7Aa`?=2_GnYyov(2Yr!88 z*AZiXY71!j_a4{NLR*z=F_UO1nX-}R6(s0-%Mq_sat^aRQ=;SHOWPR2`tr;8OJ6!RYFWom-E2%OCb<^ z>eB)CY5Tfbf?HE7b+w%1OPZ+Ng(GzeI_hN1$~U_I*bS=)2jUw@k9p$)kFZF8_l5b* zdFs^s=8rflfI;?^==6kse^-XO^n{Im%4Mn!+5gevr~qUxpGxLVw{^5oKwIZLr89y8 z_LWJ#aHTN%Pc&tJm%mr`pWm!c%RUBt)_Z)L=fT;z%O=3CS2j&$^!{OG7^SNY z`n{5lofru1G$&g&?^WluR{n4L&j*ZE>*%ny`2CcPM|{ zro9&HanyauZ%B(`#q%3k)Vu_tS3sA#d9Lxxxa&>h=RF?TqHa!|!;043_rp$N& zNgMhGjDDnOk+n@qj3C*%TyVF7sMYB_vvlnw0)J}LMo-0oJL z74pH9yH0CPt~8mUg`f@ju+JxDJE|KnSsIQ>+B;!|_Gz^or;(D_$vXO9eIe&`Y7Fg{ zvVH78C(Gu-%HMkgQs^0k9bV^gk(-07+zD-&$hG7&_Yc zAfJxurPJR_E^^#P@ZudiV!zmcb&H_h2TDpn_Zn$XDg~VY#T~IFA$-7n9F0MQhUpZ8 z?<4Mt#1zdVLsj$yJQX;R07)#b52ygIVgMWE>)K*Fg}(1-j?U!GkER_K0?4O#qY+z5 ze@pg#Lk}UC|6J3zVy*1B;_m?5ynZ(vkki!St-$HNaefOnpg75-e@LnqWYee3Fd;2gS%!>|Qu!ycUzYy`Ixc zeSR{YjiHxpeKM>5ocHZ`cy7vXX#wvCA(rl7hx0pjHJ&ixjEgVZ*jRhsPn z;4<{~{vOU2m;7|NY0+`H`!zRNnxH zkS&-|2LRv6V^?g+p6W)f95o3ju``N-*pSM#$)JjvOl4BnQma{-@9ZfQRig{8QSbx8 z2p$T3{TjjtO8Nm@3}^qhe9uF@znd+GC8x;B4Le6FL*}Utxe;Pd>=~qD7sk(Dszr!h zP8c>xWEj}lGN@%a_G6&yF}|&ml90zh6+)Z>{^vse7rg}mzit*@6=D0+6iE~Ze{|*k zvem&(hC?t(4^y1(Q(9Fd$X`8oh_)RuOig?mI;z}d_t#-jPQ%5veV192TRXcK z+2UTzt`C4OskNzzk!lA995P5q5)>+$qm5){B-tt7$N?zkVNS*Gx`1%6qr0OEY{9h< zph4g{J{Rvr!vi!-K)#$ral2)CA8(uk+|24prdZs&X4{u!Ia293^)=d`D@iOYdKim~ z-&djy5*+aF>5Qxo0SS_I4u5cTefJwI?4v66jv8C+#Zh;>4UpmWh zhCI8Id}mT?JBgGcE5#tDVJ!IMBJ_O-S38&Y-M*eYpzm`U$}}Ykim~{o>@dt>jQP0| z`YrFQUmwbmC0J)&Y(*i3y%D_Vl`cQ-weO9zei-Mx04Gb<|A6wg z7>MZ7i>At4n!Nzjfl6Xp??j%MVWo4kn_JT`QBN1MH)%jZKGVpdsx>-cH;c^;#ktHJIu_P;%q zdUV7nECc*TWdgEwBqOjun02IBLJ6e`MR(s>7bobQ$DE$L2-eQT<$w@_9Sc@=5q0KG z=33-W#U-40%oA11-5H(;>D10pHh!F<-C6bqVKSxjkeqrGWN}|KUQ14^U@p3G({!uv?%k z`Xd`54Jn32n)(K2&khW@mR`R$ zV9DdOkvgP}J^-3PP&SRqLQ94?|_qPm>72($})K}ylgF1jbk0JuZ)OD&F^~0&-&x}XneHszWvJvG}N?y_q zRgQ$YA^Or`@hV1 z?jr1jx72#9Ed3pq!U|MI;>*vE9Bz#N1r!gAme9n51v836Ts z=3}S4d4dZ#$YIv@iD$E_GSu1DpDS?=_pJi{6xlMg$sP58CEu-IJ<1$Cs5KnlxZGTr z#ydH2HUF&Wg4PP60=H_GR2Q=BJ-X^C`Psi5ZKL=gcfUXGLybKTXWe28UZE(>g~tkkVccLg3GQgZG|nZ0{@slIQ0E z4}3ReC$#19^PF|i#Rm%O4Uhc3l%EKyBnhQLZra(e&Bhu8h?Nd+sn8sqbKd7JxQ#D2 zK(A#(62|Y5Z)Ma!c6ob^&J}yHoAr(#T483%$a&}afO%I<@1tD4a8lB^OyZTfh+1&6 zfM=t00TQV`dT`7TN(z*hM?xB!#vj&MAtpE-uL=jc3jhL|ydh%2kxa*7svqD@5SNuz zdUb3ug~{SMc2Fm(I(^?U7YSBU=qW)#%MbYdq{fUl>`P?I?`pH(0)@o+iszEC-x(Y%|HRrEl(@>+&p(DX(#fv5U0GX(bS zKRWuLW1x!(i{ko=CL-$+RkgmQF}44?H#av&Pkh(XSMJ4A83Y*ohNFoY{ab7`ec}?u zHkYM~vz3NG$y2$Pqoh#;G?s{h&nCf1D0T8!%k+rNx*?)WfF~E&x6t$YtjhDPYxtof zpV_6-`IrjC^Y0gC@N5mJ;Afg?V8tV-?@xxAg604-7V3B;(&XUU!=<`oPg6kf*}`HB z;rkO_5T3IW5$vPNho2N#Zg=}|FMt3P`}aa(ZG~b8;ywE}v+VUPeb*1E#lJt{_kV@e z7~D;&{LEXx%*ljlLO@Ot9r2$~wfG7A9mTY*!==_fwDF^TF5Z;R)7wX1bNi;UE}n*A z?-F#KB!6iEN7_$6=Uc6-@*kM|aFck4#YrflXzR$p`oGAlR_xm^6I_ZfGzKJHOIO%( zKQn?c(7Ie)TqaaA-t9!ld$19@ma3A7c_q!y4#QtACcgCz4!)JST85jEKQ%|sd(ju8 zqNcWv8o&iofe_?#w9U%ZL<1I&ZbGDmcN?!XuI1e5254En`UhZ@f)qMT{4S&r!wm6twuG_}S$86!Olo;|}TZ@mqb)@M@XP!5$0QT3Uc#)#74oiF;{c-$&Y z7RoFvZQhajNCpRAhHhOhNu{AxFf0#*1N=Af%FmyD@ize;UdqNB3Q_OqO?D!$$^27lka+(ZqM0Avv_{>4ljn{d4db*PX56>PR9-dDQ92h%cG#CaC zmT50BEG#T3DGBQNw%cxd@x>R>kHhlBi4*bh@tiAg9slP)|Cy`sM;>{ktgLLxlqt9h zgUb&;{4hE?`nl(xn>~B>)~#FN;oW!Ng{xYvMzTNn;Dfny=Yj|9+O=!iv}qV0uUxru z`t<3DW$M(aa79pX<-oPSdUQ<=kma+G1C)$Pqc-LjadKd_nrQ<|bupOH-%P($b=AQsLOz+S=BlRI6Ha+BSoZ zUUuq~9Ar-%Eh-x{Mld1O@L|t=@Xni4KKSs1Deu4g{#zGQ?)l4IIDYuid+wI9$Rf)H zl=nV(SEZtbiq5vS<8QxJHf@RqT^+iW_WnhNJAM{9D8BY;7dg-yb%n(Rg~dgMMI{z1 zjpM-&h$8Sc2mSj*L_~xH1qTEK1s@0s3JSp({lI~+`lO_zqlb2Qtgw0W=2u^R6&mQs zks~{I?u5dI<^1{cK@MPWO%mLF_ub$k7|z~s!wtCK&{|htef8nPhx7CEq1YaO{Bfhv zICSVx*uV46JMi}CqmPaqI~FNVO-;30t+WP05aQzEU=N=-BIFGlHdIzt{&tuF@RMc^ z_+tfka=@L{7X(4+@l?_0WC+6aRx5T%mI`J|Fja=0Dq=H-q>8dXcn@bdk*9v zJv}`yCpR}YKPN9cCnpamDk?D*6~&Aj=}r!C34DfzhT;S&ys4>a(4avGA1om&D+`ts z0n^-f+;ImCwY9aYR;?O2awI%ocG+d92k`L58*e=E#1rr{X3Q9<`~?dZfIYy^uwlc% zCo(cJ;OCiVo&hJowJ^Zv-~RSD#IkPPy7KaJq6RWK=tvGkPQ^f~jCzC3YM(S=vRxoD z2T<6*6ge;uGazz6Zx}+O>vbx6g#l-b5TJQ;1BCl;Gnn|dp!8akT5kdkVB0ixLJsVS ziCGgTh%K#JwXUUAsnlzm)vac;_2LgCP!-$S+M1i2rE?iFWL!{imVl9l$*dFAt#NO^ zUON2)HJe8~%U4)`&-mFh2laLIS~(OpjVap~2Eqq)kd;V-XfWpt8InJsUqeF!x_R6j zquF4@zrkQKSwx*KejDo0ULAEIJleD={tA1z+I z7_ofu#TWDE&yS6bg-=9*Fmd^oEnAdIB@h2Mf(u6uQ2r=4@Vn3FezthglER!K+U1gg z!u|!w0WE#du}?hk??2&;y?3CZ?T%@A(V0Sf9ctKS;sXn);Kk zzEb_syKLqF9iV$3C_}>elLMw|Oct|v;zarN*Pz5f2e`f_fevyB^gWc3$(l8EWRCZ( zEltg!5CT*a^b_ozYy!ZbOP)MlY-W-D7vJ0y0#=74qqqQN-L!f937LXZO=>!b;|S)fqh2mA<@ zKt#=sV2KXWjcaYAR~e5SX=!Vv{S_}5q~t-VbL~#%vo>bexWC=N-ePhChUws`Cb-AP z*N+-pFm7bd*b#-kqYK83%JX%}NLgf&<+mhg>G@+vWRD(OGJ0J3s9}}<)0Bob3kDIV zbq_Km{DheUQZr_gT}(`Fyz)vhD^ILy5UZ=j%JR;ou&C`Hj};FX)T(SF0>D41K6Qjij`QF_7xF3Q$3`VG`_UX9T+wmV(Uz8<<@>PL^{K6gL~*^D-wv$(Aja zzRKuE4y5+M_Dwc}9AMB$pJ7Kfa##i78;A#{igG3IFHnp|7 z)N{85xF*DmF+_a>4JH~IrK3w4>t&HemfxB*)QhzZWT-0@8){Srov~G~*2?Ul6Z|A{ zAUXu2O-M}6y5^d!Km95BravX$d}GQVZ*rH^Kiv$0A^qkXPF{8O(YtPMQ8%%t4^~{x z2m;goMs4b(aWt0;9mC0i^mxJwgVkzgw)CDP2CJ~KSWGZ;OIglEBtihQON+CagRaPd zQA3aRHSEI*dbP%wQ*_XKplR~+D0Y-T#ASfko$N6ZkE6A<=IYDE!-t#N)Mp>rcL%V? zj~r^`6xpXYH)WAUmfy5!v~4)3^*WWRP1B~-E46x~K`k#j=nUsc4xj^|aYVstwbm4u zl!XK)ZCZEyhgC@{S0$}p$t7{s4-jrh`r-S;<=Px zYj|M-XdSI9q3Ih6i&maG9b}*nLDM57QB_xY^)=#=!)-0ye&(QkF(aq}lFG%PqYq8X zB8x1)VWCb}M4F2}*eK&dLm~$xbilu0=W7md z`_Ci?I90Qy{@@89*ZQoJ5#G0GufM6{j=L)FycaIUm-*s2@odYZGyrb&& zJ6Z=0EWi3{G5kKLm!O4?M8f#|MJbV`TYYbH-Q}RkFQemr{R#!EOiRMZ$KkRCWiAS2X-3x)3Be`6EX$QA8SM3cP8y` z7C7iS2ZUWBX)O9?qdH~sc(JL~B8m{bT{MfbTrjaX>1b*<7#$*gZNe@Vf3pgf@_as81U z+atH_JhpxNksX^;Lqp25b6c8KDz+nGw}O<*)6uD=3>h+hqcE^dkf`B<9H{jMz99OZ(w|7Uym8`9h7x!!%By6)D0Egbv;CkLE3v&ul^ z0H^e2K%G`a58%;m+LTIVX<1%=VL@I_Zb4pter{fNW>#!;Ob>;Jr$>+YxP;v7yn_7f z{QSb=+``iGGJ2+<)f+V3?y-W42cT;>eHIZJ??h5wA`w`AqXZ2FCW`Knu= zoA>O0(kG3A3fHKWd>atfPL#wI_~wJ`!%JGNnn6h$BDE=DYHe+8sH@LNN%d4HAbC0Y zEltg8RU5gs5|e-*T*lg=3>n=Sr-N4>*@K50EbPq3v|xj6d*l7 zy|*9;my8?`kRZMG#PiSp{hB*Tdx0E)6SR+d*(sYF@E$JBC2$+bzTKNFKQ1E`{l+NR z+ziV3%07eVKQlSocf9DZTSVHdnpG5lF9hjA_-YXck%RpFd<8>ARi%p@04$JpxGt1M zmP;sIp@TPBWcmFFd$EA`=}ytcEEq8WQ*ayCUCNmQN~K<#_@DnsePW4$dJ+Pfljbfks;%^4^qEQ+H;8NJP!2wpp6z0a@EXmNoNj_9)s=-axlVU z0Gma?sn2Ky%syjD`i)ccVXAJx7!sOk80|R#{y`K*!`{PZ421L_9Z3;(Da><6%U`+l z7&MLwhh?8~$IMiKJ|G0FU}2_*HJltwq&G;N#0>z((@-r0_Jjd<+k@%FQ@Wo*J6-xA@G(8O zf9~fuB*+?-Bnro6=`)H-so!YN+kB}Q+sQ%N^P_AIJ8Fi*!L~jWakO?db3kawJT{Y-;$ku>OUMTjKbI=rV3 zkpRiE&(Pij$9WAHPfr&5QO1cJJU1a@@@SjYE?O;OQ?uCIB(}7PEiGb;N>nv=Ce30S zyfxBxRrR&blj-k2@%TIc`j?oMDK^%K$|kY7UTkd?mCdK5V+gXya;ZhxAW2&jeI~xG z^^_>vNMPVT)lDR>3uTezHzsP-f2F8mbsnNt+wB50f;&I%ZscIJ$AFQ&ZXbQwpy7YK z&-efSI_B2Dj_z~cXdG|&^GNT9U+&>Olzc+TvB?8z!r<0nUj4^F>$8^{X!Ok0Bn&wA z9OO%vwDSW{4fuqA&J`pL`Wq1B4ov8lVZ8>715ZN6SwXQmm|KP_`oc`*h9bI}%^W0; z8zY*;WizK{P8gr-J1lF$sEqL=vL}x2O0p)6&hj0ZIev7~_|b<(4&FET$)F)m9~(U) zeZuIIlg4IE9Gg99934+d#}H(Z<>Cv~+jhyEIEo)3*=I=Bgpo{O?ih$Hvi!y*cjA~# zU*GJ>V{*rjDxU0{_S*lPv^ZVT%p8}J98gm9hEwE#iRYlP_YRxx^T_`eY>1n`AsRAo zebiU$V-{?P|7>+s&whhF298zGvx9M-w+>A$HQ)Z&tBQVukL74R`;VZN3b&49iy24u z9x!(7>q|Uu9qiF(tY^Oo>~Z_Z8}IhrelTano|D@T<@NL#qVO5(1v=slC-8=m9zMgQ zk^+%06RhtK#P-otzL9XavCAMSqY zb!6YuXM#unQU4e_{qYyRq}M(AvSj$HnM%=kEe;+Tfj->2=}ow|E_ z;*M=eJ9l&@+aW2t$egfaXVlg$ht{n=vVLvs*3B+Ii96s&GBcq|WRazNO3Ln?QR~+x zY}>*me(Ppb{?t9Y;FL`D{4~$WOp?AMM?L$nxDOo_(KK zxi4i^Q1WHoLtmM(LDA=#IV%qI@*ceHQ0AN;4k{?pQ62+97bH!r=>(*x? z)0(dFdA!UZUOn&;Pw&AX2dU+btNJ~q=riIfpE2vU9E#0syVB>m$`sY@RoI{E+Z zc;@dzUR}EW@YRE!JDiXg9AA1}-@mTjpK!U))0f>gR&nbHMhlqG8p+eu^Q9G<(ipDj zhZM5oABTbu{qe5HzxqDnGM`~Rya&_67rsi7$iWbhgOihdPmzPR7OPEg>-#zdTu*tB zsep`MHBk9mT3Wyi_=a&mN)ArhauXfT-d<$L=+=-{;M#=n|Gf-yKugX~TaVcN$bpy7 z$Y)+%c;Da;g5&E#Pt=Ab)`ce39Z0MViLc!o)1dGk0%qXxrxBNXKbKwOyu9yIZ_Hll z^N-PS1+8DL3BP{8!`Jp1()*UDzTJAXSKrZ*S*@4%dF1lGkFD4mb@gq7z4{Cp_xd-l z&sg58&y%y31%g8y$!WOC=h6IX>)Za{K0Nf*D{grV{x=3E_3r!B!4sJq59VDz;L+Z< zKH9rKMcQKkn=K$U%!F&@?jg|nv~ttOSJ4OLV5FkY7-ZIOX>jjbN78eX{-YFqh#4?) zFzU)aLl!=B`pki{6}Q6au)#*UIi27%a=;-o1R1|xw6?Z_6L5Zjqh#9!SWRd3U#j!G zEu5vj$dJ*k0cOC-!NLE&l=Z@R_HLu(#L>;jfzPNO1BTx>{G&b(`p#Oq>+^4Se!gN0 zUBnPy~ zbU$CdpR_c+;XQ#?PSDiLzTy$4I5!ZWmm10iI#z zr>s%|=SmL9s|*?438<4G2mG0WJ2~j8u39V>QMB3VTeI}|4GlrCIh+pq%IS~76{dUO za-)!O!NL3Ia|CK2Rl;_1K#vtpzq;Ga9Q3?x{FQf4?%99%tq;67@ZnbnJ@Q`&40rwe zfBpXPs-pi$uYu#}UB`YSdk%uyBjxAi!`@fyGums=NQKWZ_@Q-$1IN%R!v4cOe1_1X z{Q(Gnm|`FepnG@^zhc01;2DZrhxPow5nvlM<=$^d4_xwpqdf*p=;1w7(Qk0iLF0Pe zhVVzy4gr0K;#zP58h=w#rPOvKA->{^w1FG3U60rb30fqHZz?%1-?V5N_Y*x>g^mg$^=D_DN~35}=& z&J2y4W&HNwy4Pp9#V*&g_~`)Yl3x)ykaj}sGXg{59#G8e?L>w5$e#U2D*BG~7%Q*0J{d5|6Upf3+k@|t)Ni=wfH9u%+?Np!Tua+9__EcA-ETo6vM^u-UkpL7 zU63VghP3tm5}OMJ0z=i zaGNvjWyrWBKvg`inFE_(DJ#sbs;JzvW4p;A3O0uYE#N$74gi<=9NPlCxgc4!!`+6P ze?I4s@vFv}mBfWk>knD}n#civU!Q%BnO-ksbLMcRNB%zJ6@7;ExD9?r5Ca%6LD6?O z9S1`9^Gy}$D~?_u3LpeDRWOn^74AQV4WJ=o*>nQ!ssx@vvGg0^HE=Y-R16$V;d>(l z@QmSzmv#-J7aIAFjr0(~!)F|r0oioF#|jX}qFBP{l}naLUUb~jjU2cZB%)??HFH4Z zz-d*gnwKp3X3?TW{|FvsSECwd@_%p%JT=mI=F5Y-O)2{oQvw6JLl`*v(sQ*kX*YZIRNkOj2xVYa23dO zAx_&BHdJ7{hckq+gi{_!m9ncO_HZhY(=5*vcW>Q8y2v$~NT8<-+(2Jm;QJh$oHQ0S zW7YI&Ig`e?lLJ&G)ED}Ar`^1J)7r{Lox#wudd&tf0)h5gMwOyXH$|thxH#J&h+4fW zKIY(w6Y){8Nv&<#)cC0A_$am7Y-UtK5G)`WRtHYZjSbZ)nWgmHmNw$DIqYz=f`uT` z>dGpEL$I1L9<#HQNT4+`GJeNEZG`^A0NqKCw=5O`BXtKVAZirZT1+@a-NFe?ZaFOI z>rgr2*=jZ8msjadfy&=0IY14!+AN~oq-n0rEi5W5EG#Z6C@#xSIvzRY?I|Y=FnMfCIm%&wZjl~^nlt(DRqcKaY6RUlLaQ5 zQLtNWg2imJ3xZ&Gm~o2O?dYE!4rGFDS4W%DAQp>YL_TWE%aLoN%?2B4f_95lsou72 zht)xyI!Y!nF1l4sc?OR`6JrgTGDHVvl5y!F-4(hixXq|(Ho?R!X{HuktIcV|?Smsa z+wiD7jX)J3J-g71ZqjPCI0XU9++>EU;4q-hm<&dksAm>YA#7PC4dAP&XL>=01|ir? zR*L~WEuug_jE>zc4X2ZX|4i&=!;LbCA*iM{c6?}omDgm4!uzaN7^XEZWhd{8B^a*$|yBKp^Jvy+csE4(WEu*-?87| zu*{u3s~L5kx;E5!6K$>`7+Y(KAU(kF=RldD7Fu!s@SCEo=mH#)>EfyFzb z%65bn`>l;js~6)_DvRsHH3v%89?sK>;*#}86N|0oEw))}!VON*WOW`&tkOHgBPp%% z)wa?ak9W-QN3%g-xYx_AjXI#D#QUa?Sb7cB<; zn(x$xX#%ghG# zimw;88cpA?Sk%y}uB&Zg>0mX4{mA%Tf;uXusZk3Y4fVA(H8pK*ZSlvW>RTG}vWv`C zlT|R5lokZ<-)A!0N=u4VDpf^!DKvL=WmQdGZCzd6St<~M?UWn<#6|=|MBt9p5ymXNgHhkVgWB8j$&Fc_tS5deQR_&nyU*!!Vae<=N6abHPqGb*|VXns(JPI z-xX9;w^Y}K2W;OS7*SJJwPF3*lER#{?CK>8{NvJ3#zaOWr4&RR3d+sTONft4P0N@+ z@5@%TPNmbcuG|qHeYCm0X5r^^R7S_Lua`IJX*B4x8drX^FeW8euT<~dyZi9bz`9y( zO<7sOu|rMG%B9Pf8BL%stX&d#e}8(fFXPgH)HCbbV4!KC?SaWvqPTc-LQsBCUZNX(u8$*i^8cWm3f>GL@gDp=9cEhsHiBdR)0J$ z(kPgc5;D=3Qt%eq^jR-&7rcv8jZ`>)+Ep|l?Xg=R& zIvl*GuGNU~H;urlPqoHHg%;LpP^&FuMXllUPy7!b3B!1O(N|y9v^JzCWi(dgM;|}2 zV#!yjCkuD7r3o15M}_QG8brZlUj5zjlESQodNSc`(*u=9a}bS zj*CCOch}}!`-5o?+2OR=tobJs4o8H4;XhUF5ZA8w-hjk81krBW_WiOpov72BckbO& z-&DSG#p8;||Kg9m9KR>fkTz9ZAG_`G4K!VODF4=T^cTj3-fhxC2j83SC%C~KZZ#h~iR(b#IRI?zw^FM0~Pmd1!<2}YyQpi$2G z;+ zwsGwTQ$Ll&qzuA_Uk!% zyBHY}mYrYq`6n~A=x+sM*#0fF=0Gs7UcRKVC@V3iYW=!3YP%>H)#3X>*8H$oWp;v* zAn~Hp*x05ybR<@!wFs6~-+he+_|;s0aOm&9`O1hkLGMRccC6o^wTe2edVgR5n3LUN z{qCEuk3<|UDzE-#;bPDNYR;#1^r!dwGA<2p7f#&>)J@zeqg^z!quwbR1W_l@LRY<6 zRNEvcy;U?|+~uTGo85_{!EDz#okqcFG>I1KX&qpUs2c)3gc2dR9D!&owCk^T}EJuS7N0+J^h)TEq9L{+u}Hf!LH zofc6f58x$Iz93QiB<3=^uGSLEwWy|=zg4IUegE?$afmSQ}K8Ij4q1K^(SfC~a z^nvIRjkFliE`W<_b;_iqB$~2fohIsZS3sy;kpqnN6C#fsIB-CvY-(&%tCX#6ZEY%* zrlG0+tFPv_Xu*1=`PqnwBcKRrX(<@5YqV{ZmDTE&y6?XGE+ZqYroIg%s?vIUvW|c5L6Xd#6>f@7b|^^S0eqWW{DiyC^Bl zS-)jRRP+%rf{N0Dz`$UO!|ZT~Dai@A9J$WROfN4kSo!UD<<(VLIoUeBxwTc9lAcQ) z{b@M8*Oze#fLp+Y@dBzrg3W2BNhrIO#3=~0myFY5N9Rd9&RLyiRBL+3MYWmvv4JRq z6a+o(HR!KFt?5X6iqMM}f|Z7VcBx^IgA*3GN;KI8*dbGb#Y*{v72>noz&BV6f(2ZS zc85i8Vlkkhp-oZgp~bTPzRO~eaWO%afo=u69k{~t+f2uRh3pQ5?~ zGCBAi%XyLmb~KqaO{t0TTB=^mj((XJs#Y}VPn8^1lU&=WD5^8Nr8MXVqeZ2KC40$+ zcr0HN!zv`|H>;I&A!TWwuuc|VBe~>DJlhq$6OLm4j!+JidKd45`9(^S= zr4udZEJAymLl$pL9{3YUyHAUtMEQF0q-ZmQF4c^7(9iVnZ*5{%o(13a=* z9Oz2cC|H7sWK%L()1Wj;y*5Iig*;@5fB0uQfLzFmH8=7@s~^bS4jsX*s1R5*HoJpS za3)A0bK-!FjBWy{8>BnNZV**fb}y+e&^hV@I0AQUw`@P+R<_&ln+uPUvgh}me(3~N zj*JM3J5dcK7uH_L2#^(Z!l-cFk{nRcbR-8pw9OxFe(W<|;Vpg6fVTJX9_!h6jHmb5 z9{tCYo*OulywNs@xQeMg=2Jlz(mqIR7oZXJ>OXCPFvg?*2(Bh+XG7YefcxS8*(uZ~ z`K0ZSSWx_wK2^ZB9b{i6kWx67*{}eA71B95pbsyhW~`nekptGpxvB>0Ea`9e+9ZLU z(xD3{1|F0vH12Zh)E(5%y3irOE-sPr`@?B9q3h~&eif#x1&JKgZ=MCr@eCi7fU{o4 z;Y#NzLzh=|;&A5W05{VSSDe>=!3=Gjf2$o;hCKDh6A*~Zl@<;(zy&7zX?cv59=A*+S*(*2WqvNdypaH_W@}TC_Pr-+b5q+jJw~O z13q5wH?lW3?1Kl;JBUxM$lsdZ_?b15Ww>oFZQ7(nCZhv;0pBR zAyVgF#0O9N6gLDXsb9gn%Xu7^wQVoyw5$+W=~{`(p(cIp9u!)Jw^b@mmD1 z;8f4u$wBv?IT)?zGg@)Wh~9%nBo}C7vs>eG8;|F-#^=<>=C@qtJ(NDL+-Epc-DS6p zeQ4wi&pyxM!pjB?zvqe9JZ~A{IbckW0TbvsLcbx<;@95y^8d5<6@YOZXWOgONtP*$ zwk271(xyr2FT>ZSK{JQbP}?*OHq3GC#2_*=GsesmGutsU$+BhPF)Z)R|GYDM=d&z1 zP{)yzdoGToqcECXJBWp`{^T62Gn_*pSOEo%AkG-DWek@1Kkc>p-D#=u@4gn zLB{W&y88BxP@hfy@2Q)9-sz@aJOgr&oYAWGtq<@41>z7;v`JYVX^SS2+L~{^j2zI$ zOBH43&N)aRf$t%>(kBQ8AbJjB{6KV-C6K_S!9|z1uN5JE4a0F+^&B*6>1f>1(e!SY z!BQKvPEEf*IrILsMt3e)f3#Mk7E;5Oq|q}UtlhYEQHVYJX1~7QI=&zq1_O|2_*3C zv2F)_vOxLvz+1sGHU4Zx6n?_JBXB(VsRQ)b4$(YpX}z z-FBe#<&Va6dg`r(>rdCt`tzne#qac+@uzk#j97Bu*R7tNz2Vq^sT+RV;+dyAPlN_d z%WApxh`&zLyFUAT|4&;y|I+(|CNDa4XUA8^FFLq*XW7-a-hZHiwSM~3-*$Zcd-Jt| zJt0x_9Plp`?3a^30^fJITrRMLU@#~cgYB9?0^b7ASV!#&@K(Fs#J8_i1L2eJC`J|$ z>cUktu6{+IfbHjU8dk_`FWubAnRQo4V>v_S};&^{CXS`F#(6(DKo@>t(eb zFlOf5)dkM<|9ktx!GCJ=PP0c|I%Bd!#cc0sRxh*VkurAmZOuSCQnT8>pEGs%^koh2 zX!GNH|NZjEd1orv;ZnBop#R`?$~KYk&HHBa2T&h$-NjY`#j*f!JFi zK@Jl5A)(5z6%t6`+knv7m0(}19?;)0pmG+luT_JXXZyT**nZ-B4r&ZJsA`=9n2a{b zSw(wP(wi5C*-!6zcGZE>)Qpz3nq2n73VabHkc0CVL8=LeO9|3d$s`IiyK?+(&iJ2KkWYT63wJf%t7 zl&lU(8TU&KS|m4ao!q#kvvK>RjFwWP=E+TICV|wbm7@vuH%JXy(nQ6EEhU%XjPH}5|OCP;3#qfsFWds>1?ouu6*lHv>K&h*O97yTyolQHWHffoX)gq;F8)xHoP~lL_ zsTub=8r}m2K>8luGRa#~lXi|lCJB^mM(ny@rS)C50B71 z+8T=ZrzJ$6_gp=M8U=>D@HRgTv^uTfA2DQFy`R>#7GYq72l9L#V!1>OR`NmZ+c~qR zcWU1v43dC5U*^EmeJME*@*^?yZ#A~abrrzd26^8X&P^@N zxt5i!=0ZSXDK1wAoM9-)csU>i-9Kh*CtstxS|BQl?Q$Xq4WZH7CS{Rg<{uC~C}loK zS83S;uKpXffrh446w^TnpzWabn>*3gZ`_*f4O=?0+R!(RS)>T1bg>*l8yu6H&NFyb43Eg-4RrTPT+C@-WPQfg+jT`O{ z-at<6lH6-q#ZnDL^#bI;hRpPlhR+cyzm1av+qFuNEFrebha9xys~NU)KwI+}f27nK zQx8A2_`wyRs>Q-bu+S-jh=5}K#F&LUWjKmfgd<>V@FcS2zLsIWPp4i zk+?NqZRv9VTA>D#gLCfA%Ya=Ka)NEZ#(UbJqBLmrc+xdxgg~VroZLweGX55D z!Y8%BlVN`P>8F|j=~GSJ3V6JO1`I`%a2K->grAtDprByv*s&AFjbFEBEyY98UH-ZM zg9F~Mj*2PInKnUk4rq|Yx7oT7NSq*38uc8wa;|3OOF>hqRa9C0Y;bwOzs9sNrq3BJ z|0!d;ZPDW(+qtmaFB@_I{Y@JtaWya0Hfe65cnAp;NR7@_!iGQ=JE?ZgotC;|Mc*w{%V>9R1FAvxd$0LGxcH`LYC{i-8{G(Zjo zXc{yp4)v!+8=pgGX%>C(13f7A&YLh{0$2RD^b7EaZHQC4i=__jmsc7_PKdk5j>1xN zAZP)p1^%8;weUT&Y0`j2k58QgR0D~s!!R_yXDghLCmK|mVygZ7_eEI6qDCmSLn$I; zBJHz{%o4dIKv8h;Gg4Hxp0m{MUElWO_LaNVFF)YHsv`%GC1B^yokNEX9WrFdfB^#r z4H^W?h!G>g;qZCSZqe{?#LCIbedd{eE}A$0jW^$Y;o0XQyl0Lce)Q3Y|NX?1VNcjF zWrmI4B!|@bU#K5W(=FBmVi!KgN$8$GZ`%7yk47lYf6A zHuV#UeC@xl;++C;I{StaxGX?rC&E;jURkQa4?06CaocvC{ggp95A9kATBCOj7SFG_KBZT+RjN; z%{G?}IXDX>49brL9V##a9zcECrlo2utg)bFg_)s}euKNEX?j@IX{%fqD7r7c_@c0| zP{=)C$5<6`)iPCG3v*2=N*a|%im1ksgBYmRAR~0YMooo?AxDgIW)`x@QD*LBk&Vn+ z$HF^V@G#R)GW8@gLOb_tIeug}jSQGN!qFpBJiMoY6OMR@tUCu(TFIZLhEz}xKGJYm z1CLW3IlvM1HQMWA#*7(0eE8wRhsTc}FZvHwuU;*x@)#hilot`>qt2foZ(n=)C0S+% z_wL)WX)}cLbm6Hp#f5$Q3=9Rmixw^;iWP};`Q&3o2}7QH<@NR!l};Z!4Y%yycL0R^ z{deC34}S06w~^Jls&)SGV=xbt%_B#SOc*zw2%osA_(|aM0f|*u>7JH4CQ0houp!l5 z{5^t(Ld^@QI|nFoC}qaJaBiK7o;R|x6^bb%l;8xFgiw@a&NsA(G1~Asl!_lSwhaO! z%QinaF9?YuUAmme0gd$YT@XpJiB>*W)%G!JxMy2WpKth8?tzm7GEv9#y`8;9j2wu* z2eNR@N?SDXBYEcbXliS|xeUnxPl*BAYnU#^_OZwUW{qKH?}+hAB>V^~e`#f}mJ1$# zc=dD7YW@LMU~jQ~)tcJm6?q)V+%%|5|}c9k1x| zUvsh|3OiN2%bHRbWRcy>oW}w=n)msj>wZt^&x7T6s1U6$A2WbekO z@^392`_PydZei;`WJl*R&n~8wL79OcL^B1^RsX#FzNmMo=SD~41U7@}k;@!-`&E(y z)S&>X)WL%Xj~qF2)TmJ#H*Va$d-sqbL*O!N)-2&I9+WA%+@(u4-p&Vay`>xM$btP^ zH*Xm_c*v%;8#O%u#b11?aL?|8rVdS@clqQaO;c1Yl$VnmDs|1BG#f!c6u<`h^y;mt z^4}kSbU?rUz4Lp0_SwvksuUESeCM5akn8qvLjso}sN5=Q&swPyB&lD6MttaqgpJoi zbOda#0=!d!nY#n|sTH|5v(nXOL^E`?vNr*^*)_Pr$$_L$&%rhjO#$+9UO>7f9BU*w z;NS05F|0t!nACY@2WT>`hRM*5N~Gap6hZI?8cN`eesL6vFm_6j&{vC@V$^`^NIR04 z1uBy)=SC9Ktaf@FjXUya$%Wz}cfPwLPe9CbO`MDHRmg!@1gVl}d<)=xUtGPBpc)!e zHJVJoo35m-6lw@FnX$u+O*Hj4pz{>hFBMmo?7B&FU8A|LG(7cKS>rLSq`@h5207{s zaFXelc4fcoukW38%YT1-+o`eRtb+%bp-|~VfuSM+-G=f(UGHGm;wgFKnG~J?IdPn| zeHXypiJefokun^@U@dqK9Tf<*4D^VO{5i#pF=6kcvg_AMd8Y2ZUiVz3du!=Fhwhb7 zFW|^Z>zDVEg89kiJ*04M+LFhmlf5&%J+3OtzW!9t4DX1$jL+X>-c3vo;4a7+W`QB0 zS)%GR$bkD(cS0;RG1!^KVLM&6z#~*i4n)f=91af~HVlMd^ytx(Cr>_c;>5s#1Hly* zELb4C#lV|u;F#*iA9qE@eemA<$if5r_HWs;<^A{HM{HZSZOqTlRaLoj=Pn=ztCp|$ zwCg9t5)3UrJI7b<`fSoPQ@66SbMXptb8{6%0V63WC;)+&GiT1>!-tU!=nwmTJcaS6 z30w|9<3k05>|VR}aLL)XQ6}0xTi2}Z{$W>Wdm0;!)>KsJL;$AKaFur0*E6l8$JMNO zsjjONM~s{|e*^c2#*gq!^%z;~`rC-;<05{i>bi|ZHWU>e`Q+2iE0%4-b#M!cmx55I z1zANo7UZDDErNuUo!@gnYCCS)pxuJ!jzU$Fk|WPth1)uhYiKb=AnG43P~LRP^|#RF z6ok8wPxy&-6>txBz&MNWZyO%u90Q+%8HjD2g&K|zQUgp)A_stwOAhLu<_BGis4$FG zFg9QIKNa@=R&{5oJ3e< zJ-Al=w^)hAl*u%ezd9qC4!I9i*(d5&{r5- z;qWOG7OD}|1YwGJnXy&%z8WmQL#w#K^wu~0PQ#xZ@k%hJ*TD_42oxcSm0s=bD`~k> zAWy33S$D}3Qm}t=sJEo%N?Na4N{-~qseL-XVL{(tvpqwYewu$m4G{ouc|1FF=-9jjT<)(9z1yH(4mtiO%j$tg9agp@Ky=2_L;_E@Q(`+j|FaLXsFhq z>2XS*9*{Vq7KSvM;0KyQ-;aPC2z}3QZVy5uq==KQaR}lfjtN{&KzTx0_WOEWkv3M6 z`Zh|ZRW4*D`>hWY5CD{Ns+EAVYEsio4I>ATPFpLJETf{+ndPUh0&B1me85+dVYsg{JW0A+(mayk zC(Re}I1F!!-7NM?%yZM&R?_g~v@ufcF;e}JQr%(BI^7+0K1r@KNJ^dRtUF9f8tilq zsFl|1s_T|L^Q^jS2h)O7&*F}}Gmq}f%_Vx|uMVUsnj(}A>cB^X!wfKUxmy0LulT2C z@EXILY`K%na%aTl1R($$sBAnS2UnKmOIn^Im|u6+-=%Qx>q9wU21x++KncHQUQ#$; zf|2u*lzfNWyS6L)3fF*Nu#G)gXuB10QDX(|QYawQW_A{RKY?noI&uIt3=4Ggnl)=c z2!;(ChU0(%1CAX#26u5a2C81UBNRW?wbA*E0C%Tx1n>h{4#5wu(js@L$aM|%I}Ee| z3?FnRAP9Um~D$Tx;xz?ymEiWsX{@Lf8vr{SMp1CmC78u!-$16T(xZ-wZZS<9& zFb(CMw?09&clncpELyk_>XsBUHT0>sz>(R)kpVp|baRK8lIHFHHWV<6uUH@);XkX1>k9O7@o|HOVN*O7o4RX}Wt$*$0maWun8=35( z_2}sCl!_YK{^FC>QDkYrg(*z?!U+5~Q2t}RqMqSS1w*nz$)-OUw1C0xl8{#>8PRj# zKweoMiIvuM^^*KKsl|CWZGEGj+QXsdNlK4YHOCpuNiy=1mF#3S+Y#(31^XuXbCZhl zQ-jBTV<;ao>i|u1v}mk{zo73e@OahDIlv{TVV(n#a5!9CTwGRGCNwkvM`5u+@??j? znX0O?8Ws&Zq1{o-(+lOC11@5MA-uvu-`y~#8DI+VNu4(cB}jl^0QkkJq9`~5a1`zd zTwcIiR!xH`%F0i>Z|VH$_CZ4}Q_xTHSPe`?QR9j+;89HhDm5)SUEpMhB^3N7}zJvz>JFeNqNo+R<`G znQc;VQdAT-U^Q7GlSMpqQsE5mb6YH zf~3RF*Iht_NLywrT0=>=z}TFi4Xv0&=3L$Uotqlgb3iqtg-TDg7*zE25_s&3wIU(@&jS0R)%)k2G+!U&C&EB+|E z(^NllMvNU0LlPv38%M;$2>~B-(Y;BOZ-FFMQP(|Ks>n_0`&UUFaHX7=B#a(BUth!z0aV$5?rVIKm4+Hf595rXjGr$) zXQ3G?O%$*KOq1!uB3*&(K(@I5n5aa>iEJi|=%%GG6T>Tbv!rzBX>bB)?hZ*! zX*|N&#p@ZXQOVkik^M)08Tk5oBbW=S) zGhB5opVJJ~LYo*mk9nP@2b_R(Va(8}mj>6FFA2JkmESO_r8GjSH!?YGoU{HwsrDeL z?rlRJPRDI8d%Nim#438vwP&iNGJp`0R$(&2^Eb>bxQ7ahAC>&YYm9Bo0l9wX)x=+-j5?29kKYJRL zw99DD0cQp@1OOe}=+}SmJ8{JmFXWGyK6llQ{U7$5TpJp$VN23>4ex(5XX@KI)9W>D zolI)G1=Joj`WrQKHfsIUdn12z&wo>!JU~7(pugKe$J-k+K|wa@BsFXHrmW{?A05a~m2sGP%c;0fJzW5ius^-yEibdh4?{RGf$oDk6P zfrGh8)d{X(Ye#<)b6+>Er8H8iH(aVST&g!Lss1QO9S{PL0B`~vK?pz*Mkdwb2A0}5 z9hO>em{e<&v(~`csh>alPv&)7G<}!4e`^$ID8bwuEV;)lyPEk^HBYMHPDNHwKJdO1 z(NzG0Q_3sqU!k6Zh~EKf1w$;Vq+WTx6zT0W@=}7`B)J#ZK(e0e(0dUxknHF9#@UGtROtXQw-Eug(ywF z@sjLL3zh#r#&*#_759m&;zyhcKmth!FDG)4*2u;?cRJRZ$guwKY8Gc zeoxyMhJCh9y0!&%6{NS2uKm-(4aaWEYCd?%hAT7MUweD&I*prM`J?97|D^TpfBeVj zIqTCJ-FelI+FbY3w$6t4*1xsYwRg0so7MdKpSDhGd@uOKwRg0;;pZLsr4~2+k}OyM zxcyDP=uoRsvwB&r8~&bt8edg!_OY7mGRfbUld*U z(|haP2Kv(cnx8%5Y~1XM+uGdl%Lh|3nx)bHPjQO5CYXyy4p6TNe1m!oL3qFri>wT} z@3Xvhbho6q9fm(y^cm>99n2fYyag;8!JrOkH}iRjhPRgKX(X37(M$f{fM!yUy7hae zU7hQ!J1{wIlp}Qn%`l)If-ztTAOup~u~I#p@{xu5G&{jjcc@frtaQaNN8P;CT4V3} zGxL_w$nQ6OqKgPBqc%bjZDF|L&&*vv;-U<}gM%9}KCmJT=n-WO=z@o6ljTcR-6>($ z^}&i?2Hovs?+ao7+p4Q`;evm9=Dkol_36Ule=F(L(3gFqlIPTVJG7i+JtrlcD+OV4 zB=0ndm8NMf{sE*XHR6^upQL({^@=*7;`^AnTJVFKkV_XAc$VtOfq-~qxWsZm9EGaQ(**$PveGrp5Fgc2%g%rs-34LkUba61tq>YZNj$#Cr0x3(-LROd z=BA~NOLq2e)Ch8;s~VqVQgy9MV+5wbv_t-!dahnKv(jaF=Ok-9O!Vc)!jkB4#jjfC zc+;QES4i9)WdkIl#YHgKig%-;{AVV{o=3* zD{ue9<6~xT>^5-W^|#)?w`}L0{{qyFUJ6 zw*^~{HT_N7`PUZUa+-5y0Mx46g9_O%$@^FQG*(vQANuY z@K5c4_D9L6>>wu81JRZCe|VHG}BR9w1b(T1*Fa&P}>uPd(aFV!6^ImbBb zjB=z6lTt^fTronbH$tjCLaGCbFw9YFSW^A5$ybbY)ajopEq}BT^K7O?673{Yig_N` zeR1C^D8G4j;a2or6P0;2qRbCh{6>SycPB9)?^EGyDZ={(R8Nu~bcQP=-JOI}%U3s4 zal0?@G}A{jb0do!V61?#a>hJ#j09Q4%_0@dtYBIxbMIz52A&+#t|F&_+N-WNSJL}A zf&(R1aIIiqjHrg)Z9_d1ZYkogUvct}jIFV(AnGYJeMD;ciVGJBc7_WpnnW;k4rjUr z|KaT+8yD@qh^iWL0O$s-r%if05?Quv$@uZ(r%s)^ckf^f zI*#;CO+z<{fEtRb$RS7>vhjnDKBQKlW$LQsD{+k;Hdf>Jq5%i`xWS_D8)?o5b!$=M zk6CZN{TBQ~P83D?=Rco)=z)htV)zS5;4%QcCpp|5857CY5wAdz3!`;w))xKPp#Wol09PiEq{1CsWG2pNTd7Bq^tkB zc>TfaZ)sJl!QHc#AFZEt|J-#YLnp2nGI`x^oByZp$VG2|I%)Evje{qy`ThO>T)zF} zb&XqY*jLeK%%TtaOzA&;`bR1dzwB6In!%{bCe6p&=^S2H+V^-pf9|z~*|)IL6^K?On4%Jscj*6H29;N8GV%fmWuP!+iO==_baxtk zfZ(ZR&%F@&!}$Sy&q+kesk?60-5re3a88wqm=%JqF)cN!(h##wu~I#viAjZqp}`x| zOIdJVaPxrEga72~Q^#7JB9|s1&xwMFfg8K?CRuYyU<_JCJ%9P#%v?*InTCprgkpsu zjdgJ#BIF{L2%sxWl|>J6phR$e*4g;#4Rxm;4CLFh;>a5K~zNDjcFtDJMt_SYTWnz8)Y6`8H> zxbq)NHlDox$8Bn5-shlC2HK|H+DU43pOksObo2ca79VmpY?qqVe(e0C^=@hZ%NDPX zoxl5|fr~Q!@I;ScOKOE;g%cnkcW_*9i0h&6RCqFNz zSKnc1BayU`PUV;Qk2ng@GB2^J3ze9qFt#q}{)_Id1(n0Q#FO}UTfr zdDV48rPMJ}trb)v#pg)U#JB-P3$Mq+p)2u+LAKmzN^kB*x0m zKFYTQlvr>bF@6Yjq%vcZT=r+(m!iA5Zmtl027IW6@`pxPBAyhz{0hz0Hlj{v>_mhG zsWp!hO|3``Wt)gWBmx!%11>;qOWc5VWx}Z;8xajzM+8D;q0{=2QRAbPy3gSQ^a_RoqvGD_S#ll%l5390g6hXmd4?33g`Ny-mm)q6lQcf9yrX+b;(2 zG}R0%P?H^bH)F<(Awvd@7%^(ko_*7%O&Ky|2w1|FEn9@Qc!(zc3;%f$ukv3{KNSq9 zTeof8yLYeR51Oi?>dMFwV__NEeeC@UW zB1x~~Xj;8{<+;i$!r|cH!GrO(;0|&C3yRf~e}7`diWQyT{~!HfrZ=N?SHVx6x;Z zP1{N7?P@h{PM;5Cwn=H+islmDd|z^ddmZU5lhRw)%4}1+=>tiPnk8qnN=|RFW?#8an9N8F-TMljKjT$ZEBvsDPE!%$Qt-B7Wh4v>6M5U$-} zRdsge)cB4a2Buv-OiCH;yn?=atd-i|Df!-P5bEjF>03TY$#w+u(hleSj_Czd#Tz>G zC>0R8V#c)Sm9jcPlS1C zPzT^zlsD)_n;vH<{FFKL1mZ#L%mVd6;Ya>Z8-ljIHUf<8mxEn`Wj9%V>ZKqG!ifm( z$cHWH6AAj3#C@H=;$e%GgPS25TDD5mY8MCRyjfw19-@do2tCS00y5zOa}I*R;D7=B z1`X~vderzivlq;mIaO@TICt*c^V;jk6cSZhJ~?7_{oo_y&z{}ew{G3Kbn&wOy>iPc zigR;%7aTcw^l&j)ES}-xuAL3qZb$#5%cqLVH+#}7(5=3Gdn1Zh zdp~KB0}>z`wuFi5nmLZkJ1ui{&|IriZ9IcF(CJ0*R3qFgVx`o zNsK1KqHdrXC)(o+*fCr#Aty8lep_^uYk0&G=Ob=-xwRhh>AqXK~*h|-SRII2;aYQ8x3lIv0X3qS~=kwtG zlEAUkvi}XkSC=}*W6Z$kAl*Z4(^Sk zN0{l>RYNv;x5(MMe0u;dprL0Lap}G{Bd&VL5Iw-zl4!(xQfO%h5A_-7{(3&w-7K=) zVqTM})X721?C|`dq@I0uc2=BqJbQ^ORQ~BI6=oom(uK;d4h23X`bDiBTG!8x@_zPh-#WzXH)# zM-D)J!r}0cp##Va9x;F3;_07F9?CI$_H0VeIiR$Do1G_DcxQ~Cj)%|7%dyEpB+|V{S0qW( z!zE?K2%_ue3opG$k8fI!JoK=xDKn={FFsR_?4Z1%1X zLt+5X`a<#3x&mC~Lo1VsE=*L(0`@?vy&YK^w;}^d0hdgK?I>mP%@>F_@DCar)8~$S zO(cY(MHtCHA{V-!QUagN_yUeCC_>PPbROY33pLglbFqdMNQ}T*BjxTQstsv^T1?Dr zKwxPq0LP#qgZb*Pex^=P-8Vz=fX~w0L+UE0FA<>m&`MT4Ng>}gA&bbw z6p(`)NzHMFd!>1LI>Y%=S|n~z;D8heFcGpAz!E` zm?|cYMDUK-D&5y18X;WuTo-!WHV91am z2M->k^uz(Dl%I@!zH&9#-ijql@nTEMihyvyJ%0Se9lJMf*|G(f4({DIddviOg=@u% zWhgulfc5Lwt6txMUHkBaYu2p7eb=p9W8z0wr%ahLdi2PnM~|XJj2%06)}%GH-5a)~HHaEDcVxBU>mLXY(DzXA(AjX|3Ip$)J1H33(82x%}Lh!q-nV+;0IcsL&>d; zQ`iG}jlqXT(q2 zSkNbwd?F;s0g^!$SM5;wgN&6&blNELVnL)3$)dy<2J?B@+V!C|pM%vIx@?c0L?7oO z0^(8KoCD+!t%5A8ZmCb^0S$r~6Aq!*yf=bsrOv3$ZH zgH<`%Z-fmtx?fI_LKjieW5bRV zgyXUz2TeNC`a-miQENW8pnX!-1GJza*KMSyVS!2}13R}g!BwvENl6RChaq4{DGJZR zkfx-u2~Y=dN8yJ|J7)&*32_VFg%I8LNyJ7$hzE!p(fWxzPU>KwV>?PG>=dvjnTynO z08K)OkY1n{XG>V+AW?om7bi@}lRdA~GCqDMZL8=_W@5^ly#}H~4_+;M|H;@%G+_~d zYE)k3Q4F@M^E;d)vHVn+vw$b^FM{xBU!15P8s-RYbBk{iJgIKY(_IT(q0+L@smL5VfB49P;c;l*tHZuW_y>yg zfOrU`iI3FSKqUNOP$&e!~!ZZIIk-HcX#Q-;;85?WEu6C-s7WE&{ z01%%PNvlzj-SDRd${R9y5M%)HUK}7EdlCsxpQVSktm~Ux@1y#4nW{vzu$_MX;B?Q6 zbzj6(ea`_+B!?E}*<4y$ymsx{UAuOL!(jx0cvsfPlovE`Oo@a7h~_Y*lzS9!4gd5( ziOq1JJT zP3iN=hg&yqTesmD7aC43>17HLA}dw7+TK8)t4?)q$ja8?Qdv>y^x11Uo!4=dQ%dqL zB!X8dGBc;D-s=Lze_-aeg|kKo z(|swRCZGsn7>F#q3qf_Ks3mu@$O#p#5V{u+M^SOZ#lVjAt3$kBgarAqw9uN>V!9!Ep&w)IF)1?=Q^Q zW<^w}1hia9OsfQ(sr^V=hz_L1NY~o^V;nlQgK-^tqS{B$G=(8mrK^ha8!Nq1jeN=M zoucPDlsu=B@6hrj9Nj%@6;F6Tm&1sP6s8?iJk&P?4=Tt3JpoD|Z$2V+Z^+wI_gn=Y zAO`sD4g>H5wA4Md!tP%(b0!+}qRCht5EtUbtHjfplqVE59I5&c^ZzLEAP$WDM+TifNS=4RLW2CB#+pEq03qXY8kD$w| z){d1NxoIE=e!Ns9ESh`dkACet#&F&veKjEF3rt89M*y{I%q0fl^UH9-tcb>Ofw<1U z*H^xE0yPd0AsXcjxS1Ma0Y9yn#mAe3jM3FN;5DP5{yEo7O;p1)WFc_`!9$= zCI0|oqv0tki2)Wl$k-8!QD2wfwYY^qya>TgrPLc&~J^X-xYAQ~zvSNJs|VHQ~@ zmp5T@!%3qh(_cH{t84m`blN$P^dIRMZ8U@xzDdp7YM@H+_-SSuq@14`s$!U$Wonv+ z#-(Y7WLxXuKnl1@;5v2QB8o3Y_;PB8awNHDk|t&z zfE|UMJTcC%(gq6bfUo#>x;Kf1oX8W#Tk2w&BgHT2zH5wdcV>lnZ!(`_Tn&f{n7Uz+ zp*|R9(Vmm2CG-gHL62amv{nSz4pe$IPbAzCi1($R(gLq&ZrT`H=NmeZ;nO5(L+wDC z-+d2@lp7I+y2R-P!th=RdX?4Y{{;}G6nGR}S-lSAAg6XJ3k8s0#2C1bC`GV^jjU07 zoaJi(k9+}g01J)+!UeJ_P66SwI>gdOmKc?>Eob9_1r@hIm2nC`!hg(C-5X4xCIjz` zri{3Q?_Pa zH!0=x9itJTX^FZkS@Au}SSjyJqkc8s^sE{}Jy4$jHCGK7kHSuenVa@LHTgU*`bLLt ze8J@NbaJ0+Y59as;oP)9wiM2lR5D57yd*6rS<7{Xvr{~CpQbW)F3bKO5X~Q6^6;E| z&Txn+vrW&HN`++jQ_(u7U8eZD(T2wn4kXKg-!pbpwP-mb()zqhpei78U5{A2$)JUG z7Nj}J_(!Wm#VbXya)X^xXhmfOid^X0DnT(o{TN0h$gB;D`!`?)cv-Z#vP}-C=K!a{ ziVS8hpwAj3Cht3di6!rX@1PpQlLL9x+A&fR4J%Op4MDs(VH0^6v(PW$8{PCm!wUQ+ zQHxOCqHY!79;*gV71CxWIOa9_6jbR6HP634w@DjLMaX#IM*OyCYj$z8FDGzWfdn9= z<=3h=(ditS)f8`E#jCu~%jEA`IpEE&U!L8N6@L!T^pSQoGC)rBFEf3NS?*9Pe#SRm zA}OLP9ON$!wqt@E{BX@zAqVaXUO9cEN>=M`GSuEO6uJOKFcK z=1#T(PSqua%bGH_N;89e$_<|`Pz^aiR2pX+u$h*sGB$Ig=dmF>I`vrf&q2F}Z}RzY zKeX`?+OA!zjfeZ-%P8W$MeAJIHxMDnb?Uj2_;NwdNl|+y%lVF?K|g2uDP5;6A$aJE z1|);J{z&fK{*srNFNyESTw4t4Ga6rzEPqPab2Ez!ibQ142-8w7tkGd~jfE|?=z#e` z|8-{!rl`cZkovu+v^PfYe<*v?Lp|0%H*(j^BU;D~M&QYa2fYg`qJoP=z}vv>ymd5M z&QfggKs^WClB`!;r~6-Lri>CC9efcP^$oMjR;6g+n5wdR-MFM=P7Wylsj0*-(VOKD zOQ%F+No?>oc~=KczxJ*1_|;8Fgz^?gRaFliI<#cTlGUqMpFVvWse$`>`9?0dBti*0 z(j!iVi+B(Kr+A>nix;CEX@VKRXgd9hndi}}S=>UzscH0Wt)eKgTO@E90$N>V0fn}F zlcd3oZf2&TMhj2XK)E(7CLa#TV5pt{&(!H*5L6zyp1@Y;iMinVm)KiGEuLZwtzzHm3-9M_lzl+Tejo zsZrt@*WT=ztmY=^xlXy4grkw;1WO3_PCA{_keyr%MRg&q{FOn87f(m|gLb)smLiMn z3zhy7gaEo0S;Q?g`;Sk{a4N1pF?I@N)h@l&~3b2P{#o+0&PEJbGveRlYzmL&?sivAN6bi^jSf#EH+R_jK zw2%kYo@~;DOCcmYhOYr+U6tejnS)EnAGi!3K781)VS@$@8ai}n|Ni~K5`==U1o+1h zOd@ubUJR}94Sqo*Uxub@imDmJ19VlRjh9SKRb^)ALAQ5cp8+}rHTb8Dj0Vee1Ktn> z0cBY(C@45`aM-NxkK?qY|xi5ORcE>5MI*4sQy@d!h+F#E4_Zj?J1i3;bZad80@3IXaY0-z1Y0_-;WHbV4>c=$D>B9bxClQDxwz zlccG;LwQnZ?p3U88Qy!w-{%%;KSuPu0C z^bt3jjEWJk*qbAF4O~Y(5D`l(s(9gESNfC($>T%32GdTJ^!*8~lbD+%=Sy0y6wXW5 za#OUPlDoU3a7+g%D)^?-Xg{AFiT(SPaqgp`_`xX<^mnt|)J4xcG(%GjP}7|EvN+`O zTbMO3nk7QbSCK!WU;}vMAg5S+3IY%I*>Q%#pyA1=yBd@rVrmf;cLmpYz2DYxduc9( zsA2#+t|)lZUvzb<)U~61Mq6llXh1la4Lw3=8Qc}ybdJ+Oqwp_L9}xkYvi!^E2qn zfXAQb%osj=_~5~V&tEp!`hPx|Qoq#nLt9)9#kvuY31kxp&I=X~@OAUio;8 zu3fw0?Y#ZwTh!AKmOFp=5m*J#xpQY6aqC#;L;{x?Amd>*r&g_rk~FYU2FL=ha;pPm zLG&XX4CmA@%ch!2KooKb9blRdRxk>w!CM~6mRw-GX9E~3!HJQ;-YTPk7i|^5p)jp|dd$Kfz z)}&h}-6B>+7%T|xXbMH!Dv7i#9C4{_QWIKxkt<-N9C5-TF4+O2r!o7b zHQ(}_10D)uOr8H^NV@hZo~H4m)YL4d?-Y_`_cf;R5i`Rylnz0MX5*?QsvfF_$so?ed;FKvJ0095=NklKs;Z2sk|HmT7MJs?14JdwMAlhPsx*sE^weO_<=%9UtAQK1-7g%(~Ff^U06Weiw zJ)FPmFs*mMXA1CIKs=Cr2m2N{5^Lv;)Lovk40?Awks_TUshYdK?tc}HA!HHVj>p2| z`TDAhvme|{)Kl{6)sq}jUfnbntO%Bsj2k_z!d?F1hp%tlvHSBitG931zG>5zO`8h( z^!TVW5E?pU3ht;O&6Ts~%YoZnfE>VO;6U1@85Cju{P}a|&K)^&c61cp8Vj`>EYSkYr zIeRzEKsnS+S~QcF9jZTtotGrMVw@UioiO82D5tikR|8hE422D%#r^5TnhH?2X2PkYDIp7zfsA1#)nzd1D+P|Pd^R%oM4Sv?P z!5#PA@bi`_>1|SR>E>qe;Aql8y7~U(CT&x1eL$iOklI4=CpTyhi?eA5sZlFh)-bx% zv7>4G+P6Lk{q1b>0PTQ~PRc&z$E{Nuw{bM$gdn30?XwK#(YRx+tjB1(riLwP6(-WG zP^ej_P6qAA}j7jjEzG8YNXQL@J~N6Rd_zQ{DT}&%~((# zc`$F&JJSm$tt;s|@yJ6tTMvUM8#>)oC@1=_2D}vEfC8qdL1qTnp^1T>DYQHy|4xDC zB<3fny^_N@j?=vwGtU7Y86Wun-^c+EM32eiLH-;HpJ^`CZ6#xPYAgN+8T0YVpJ$GJ zM+#mIxO%oC`wO+d_uo}WrHV?wp+!`tLR}%Jw;g4V=5JVZiZ(?cAWmV<{sQ6}5jEVM zE1`mryIG|a3WIdgQpzBCv4A!?xIj9q2CoXK;^O2^@oZVwx$YIOTy-_`xS>Ax?mCDZ zTfBI7QHiU(tZ4j@L0vj`-M;h0nx%_8vbt%*9=ss?)qG9htyVXzfM*9cnm&E{h!G0Oaru6IA52xF=Zx?<0aRA%WfNr03$7|^PPG?1DM-Lp?ux@?VkGq(LHh6Q)4v_wPRtapmXd<84lzI{Ck(B~xD*#GuiZS;m^MKVNV4lT#ZRcOI(C$@TJRkcp#Gs> zX#*$08~Bb7t&*E|qT~;PcwtaVxELVK zy24DA1%gbGnH*C2^lUIcK9iJLdhnf>|JAc+PLOZ8AR~MDEr|f}m-@AU462eG2xfqz z+wC4TYSd7UVI1Sfk3WwY5RlaX7@CgOUXW^SPyx}(Hw-=@5loFMb)4Z2iV{Xe3}+%X z22*AD;ng%=JRds{7Q~52hse6m+p~+y=btuZ z1;kiYWg6?G(!>iCUNQ`XO+Tb$r+EI@MYDwL8R7gqs;hE%; zL?aN<$DtV})2EEvm>l?Q+VI_leompOkO;&7FE?@kRhrtQuA)5+WL*!*Uo5D@0OOhBsK0-FSEt7Zw~4)Y}uWUyv<2Qdnvs|YU2*S zZ~tDyUq74-&XL}lwqwp{2}@EVzTZ+tN4OK8$ZVAYTF{_%hZp)^b4SZpbLJ8uXxL1; zxfwj9(7w;DrF0s4uzMY1v@odZ#DD5bpHoJarVNj)Dtp!lb-G-=sbuay5JUf0Hq z?!KNG{cvAC`e19kXz(h5I1Ri!UJUU=cj2u7@m4?|{LpBXuS#-vrZyl){GnPg8 z;kL>VQ!PVzWzjdJ0T$|CDTPtv2$lUF>;amO2cw*!s47SIC4hIT+IZh5B2Z0Q^+lQU zkCK@$GoymO_oJDHs0L-+hQAF%Re3jqNj*TMFTds;V?ecdft~|_a5%hs_wJc9XD(Z| z?9ib@xCCvDn+k6+Pz_6|#5+T_>#>i~;hA5zpxxm@-z!qeb)16D0eB=qBXlAXL`vX6 zgu;<(ZVnPxehNQ0Qj`f?ZlIT~$l0mRF%D@+lZLvij2w^;0y%EvJlgXB(rgzZyD}4D zn0_>nn_SZC8dg5H{Pf|&+fS@tJO6ly##k--j)z2rgoZj9xISe*>N)T@LKS?@fgW11 zbn1aJuvU~aDl0JDKmIQha`5{rZ|7SfLwk`L9yf1SlV3gLY}7KTQLAwa_M|pwE!}+o zT@StS)awJJ2CblyYh`t;-Kg1ubwzbE@6Gt>h%i_jGurZo{@chRpxP-T%Di_VzdZqU|-e z-t)}+!~W3bAC2zlm~?Y9sp0)uzw2@*94B|5ZO~bLFiMUEQ?VjlXy>rBU;1ZtHOKuiIXK`-3S>sPmxqZ4bwj15Ovd zBl9g!NaO-7qz$#39${`Zl+AZvGO$p?DW4%_1-l9!+`Guw+$% z;yHAhJv{jMDHMJba+Bs6beplW|0X}$-PF*gFP)fTqC!D-Axb;H;v%-+Bd>ALDgi(6 zN5Vs^OebEbT>cwQ4ydZ3EaKy!Ul#}>!UK>-is8&swP$i+P9`%>A`L`)P=7@<>WAmI z5j7fe1fWnNEI)oNAb6GJz>YS0j3MTD0YFdyF$p9dxMbU4rw6Kx3;93Sp1|b_R5||8 z%U565<=QJ=YuJDp>fqja&pr3N$D^x|?z4bhly@EEm<10U>3PS#{NJ198%;}j>7W04 zhz{j)zkHgL?sPX|nI@QZs-1=+9ferEWL^-sT&^N*Li z*3IlFU3bsU0$IA@FDY3aT0Z*rOYipHa!gOZqvM`a#)B{Ajhwvdz78L}*=^F~#rqrH z(Pr-26HR{I;fYuKwtniPN1yAq?Wmdln}_npu4(?z8%s78UeV;wv)7({J9p-Y>1$r? zHtn8=U*B1vHTq?%!)2__t?i|TEoq^5Q`Vk*sNWX@x613v+3=0ZgSp%Lt*xM)`}m|Z z+B%3#^{{UT5RqnP(ed0SVOj*qAx0L|Tp|Zx34y%2zIo5WAAdBPYV)w)Ad5sKQ5#}Y zKQ~|}pkAm$5@gRci6S7)Uwo^mCS06`4}Y3{71 zvp|^EPd7}RHXY?F9dX%?N)MgF$_YIr9-+=Kvx1qLiO?#2y{kqdI`t2ptv2Dv4QfBQ zLz0iPNFm4sD2NqNbwousghwHnwtQ0Qy3EKyMw=CT%CEkq^#^_CyxL{>q|eq(n6vI5 z?+m{2CmjY)T$R$em7{6i0h#IA?u*A|C#Q0<;L9+zt~@4tS-{MPJnN7rZam2c!ug+$a@0j)eNmKJ?c3Z9Qi0 z*mfG?&#zLe5)yC4nxWOf_8=OmX3>f4EI|&`99j@b@B^Isa_d!aa)8)*%yblXvVKj( zYce7S+FGNcNmR?8V~89?2EY>@iGuJ@Jk8bK7hb5?8)iXCsN2M?6{sI@i->u~6Z~+@ zmY2qCeQVUNH^=UNd&2fN$8YRBX}yX@2MuSFA0F-5nEBoK!{Yw*=QWi9l~Ncrj&S+! zm{ms4V@F`uIA0%jQ;EW((mTC4oSS+kyD`%W(GaJ60O%47>QT`s=b`K%{8fH^AeOH} z4scq@b5 z|MtHv6$){nIsM;$g=Boa9d5(_KEP*>r84;!Ji@ylZXGv;tSTKF-{v|XGKPy4cRtOZ zPA)RuE)2!oep*zOR;V03d%Q`5dB(e1Ztu@Q1q@t+%Dl8!Y z*WidaW)0BJS(RjFt878a)w@ykM+#kzH3HDgI^&TLMVh|W8kx?(QN9WH^^&e37EQl? zRzoA8YY?VPu%*oee((-3G&X=7xwCyl|J?{fa8NM6VqK$=JtN;BWj)~mI5VuzR}{9J zDauVE*vs3ABZlI6KuM4B&JFdkm$x1&_q0h@rmf zM*PIu=^p~k{eU$A3~;|t2N7X(Fp^k+K0Q80eM4AkFS44~SCSCZknb>*5^Kdh4I~i7 z3LGGo?7GyP{-$jC5s_N6X#EQptu!bKjuF6k1r}_D!cN%Lg_m#}xhmn?GR zG1erxj!&!PxUQ+Tc8^?KkEMgC34G2!L?rq{Mxqk4b7g3xs0!zr>S|CvTg}$sr(`zb z;b0-OC6?NXNvQ=>5GL9{T5>K&DF)}B%qRHT5=7AekwsPaRjE8*oKbBP(BGAAqJGe? zz=SpvK8ROn9xMJOn5fk87UqU4~$Wv)(?v?|8SVw_>xTX0TL%M#+(FYxf$~zUi!pV^L@=%hnshm|0x^6ffDN1>oCB_vnbVoGORZ z3XY_*R>#Wzq?lF5bW_}Cz@L3g{~?Ij%|t0?vK^JbinbQ(fB9%${$U-b%3pl{D-fkL zXIK;(l)SYqsY7bEAg=Jm8r=Q|$w=;-si&~KZ49udsC^!$lqE(sBc&ed3gd_H#}Wa| zxuv%3?GL__(*;2g@00nIlA;hifLiuTM;K`uT4?w8#_S`&t@7@ex|-WwswG(5MMJR! zeDy-ZAm;x?4*iF#s2CumH!_(H4ajA_)zb@Mpb!aqUY;!eY)$v<;k~<<^N2SgSbTT1QEau^t39kzyc-XDxe}w=L4(q{Q zpa-febyUJemGZOS9p}YQ4<=Xk)vHMe&mke_t^h*jxCK@_;aWf)H@*f|x9%!-1UKLL zdH?(6zR?o@6bTxF86q1MV)d`F*LUiV6yJ?wkaZ9FGB?RGA`yb`KEd7V`){vjDP6Pa z7+kC-QuDcUS&I@dLtn-qOs%ZdC1LQI=h9$@YrcX{Ep3=wz{r$Ag`qmt$lnDs%TA7s=x%E)g1reLJyq=GXV@{HPjFm%9+BJ0ObQb;3mTMzHAz>_r*H3$L zW{}ooe(M?XdY;5f2J)7J%WVk&PUxqszrQ|STW=sl*2D^8vhGbUh_hoq0%}6P_fti( znT%2nhZ_;;QD(rq+11WqZRg|X0k4yhMAmp=W6^FCsxakD9xq6NIg1gZ4sC_VleCTe z;0;XX1~?4c{rQczR6FumvX^6tc(`y84-RfAD3f~jVX>8T&+?@Aj3G+t5w6w*-=PgE zHXoiXSqXlMx`E+o|?g?3x|-t_!Kl!t&LWT{F2=(jGa_|EqLHxxb1N6OiNjp zJ7n^(G+9pMBKWjtFUx5#5Oko^8^LjHs8q z3!6MfvMWTPZ?Z49Nrj_K3e#o}D{A;FH-o|=j{aa~vj@!|?OU&4NS{;T+7FRkW$(ur zHuY`=p_SFoNB0SpY6uZ?oFy!4yzlBexG+t4lod>NKEUICdj)UHsN}@4+evQr*1jD+ zY3#FFFHsTSKfSWnF8f^n*|vaCM8CFy>#AU4olagNy4r7`K@~|ra#4uB62rUO{B9>RCta2_ zgEc%4>q_I>*wrTME)7@s2=`|MYIpFvw4Siin_Zn(U)?lbF8eXoYp$DqE^ld_uRRSy zZWRaG5b2chCo(wxnfK1_N2mGCmHu0(m^X8d`-`Li!%es_TsA`fpS1Ix96;aI!HG18 zNpsPm7p={$DHaS|V43VnN}ZC)T;x6}{>+l%fm52Hy{fq%)$?lo035Ms=J?IhXI6Fs zMc|Z)F0OYp!nP>uY+TNKBoYo34Vqm-IJ2&WbGBjOwuz+DcKBVnyU{|Ceqmc=1kf`< zQl#M-a++GqGVgjriiA z^v;)DD~y3`wR2y)`J=0fy2EBYX%c`g&I?>^-u$N?6_3Y2%f!S-I=BBhoeUl=b{}Oi zmHN4a8c)GYemnA1KUJ{H*V$e@q1LbDMg^~9y;S4Pf815XisaB=-BWqxX{=5HYkG_2 z8dJl{Hg9!;P4~P6JXAUv>$qUZ%b8{uFd|v)b+S_?T~{i&vRxB}$;8Ij`O%}MRj6h+ zpzHklr}quuTj)4~_KzVzhn3&!wPzcr((>5kqpMRuCEq=q>*hAGI2?mCq)o{2(pt3n z_59il5HB8rPb%WvHWQkHRZmV>pe<&ISf%LHEhpG>Sdf0?{+V6yohMPY^i+nqA;~!l z!{ajD)4ub1F~}G<>s&tDFW=zP32pA_M&PK7(7r|I^$VL(E5*Znymvqrr^7*GwSIH= z`;b7$^WB%e(mQa~bz|JLgr7{{?R1=RSl?v_@RZpL&%xtVn&^-pH2yocJD+zm5}3 zZZ_^?I)@z>E(JVmm?Xa35xjG{to}jLIH)!h_PB3Y%;v4m=JOv5_;@pz&1{hQ+fy*h1!Nc5iqnvJEmrV?Ti`54Es~xRjH5)DWJx&iy7=j$00}#G` zvtsVm%Bt2cbX;7amkX<4Tp{kMqh>}?c7R2j}gj^-w03=xTO2cN#bKY_+q~qgL$g z<*qlxeRr=wCEtJM{nwDFS2J#f~1fgRic4v4lz@Xm%b z_iCcX!Unx+YQMXk-pY4aOQ6r0E51|**yf#d=D9FtfpLU+M{oD&}!UjpC3rUKAFSpBwEWkEDy_Y$OT?P zI|vg8O2)pEcPjMbX%htEc_bTEtCgN{DFShZUm7eWAOTFOb4ID72VZSVA?`t}9hAuYdD9 zi$bIQYH9J@+Jcq{hlG}pxw;)969)u&U7H(#RCI`URV>W*UXj3>*=TrRXKYSIIC~$0L-aL?w#7;=(Et*pCnh5V6hHqGhH~ z3}Lv5JtYwr4~hB z61kT3orYdEFPYm}ATCF-B0kEsl?)J8AHl)r-ek~i4Sc!}$NSNERUBnx52{Lg*F}?6 zbt`~Z^(mUp$tv_`&~yiw{Y3lf5lrk7s(Du}mz-57(e7TQdly<-0m}DnIXg-$N`A@S zT=u@+^Fn+u{<$=`k5}9Ij_!9NeO!BwMX%Ko(NM@V@$0wX0}*F)S6+TqAlY7-^^@t8 z7$jNp6%>gMjsMHd248C3%>gRFyp8wHr%R;5PIQ}gTuJWhP>yw>6+_n)i5;}g% zCpBi{Iop7ng^Fp?_Wmlue-83=eL7@%h3u&ZtP5Q5S`*y@f^!{i+5IvYESaFQqgl?d z1OJoJ;XKdRQB~2EE_b&Z{D;>Uqv>>})5+z{pf)0*qJV$*xymga4xQKehxsq@M(Aq+ z54pv|0bxgKpWGCNB*NpFK@v+6xth^8_WrgT)~xG8hhx-w*+ixtD&a zIg%~ktAE}r(5tc(r!+KO@aPkj$7j>!@q50VrII;Y`6c6vCdL3l*-I1m5JM1mxdCi@ z(4dR$ih1(yOpU0wtm1KEnfhoTvT6%rk}4&@HaH^$Yd9aqO9>y(jxwR8U-}m6J3^vP zpr;(y3O#slv6_>ChURdHc%s1S`-d?^ ze%|%W_0x*U_}`(_s9w9VhVd(VTfo-Gu)4vldSvd)u5Fd3wZ^HSeY(kEum*o7LiM^f z{ks(*%ACvxn7)ElI>GviTwsUdD{88W9qqh0PV|Y!tF(0`$z;)POz;790t&$+STXWi zYIZAsIBeW8+^Dj-DJf|b1O8WT&>Ai#3`pkskT2#xDa^`<)3Zy?IbnQI#_&!@3nqNh z&!F|7x%}|Xq=PafKuiE);OlIM+(dR|3-Pff*%)k=W8iRV1tGLh$vnfgQZXnZtOgMF zKpc@n(P=RYC&eY|rcua>yRK93YZFhpJ`|UYtI3dDxQH1~RG7vvsVP1YhF!S6KJ#5> z4{H%Ik#ZNscpR@HjS25Iu0^5sm$8HVc4D>;)TqnjSU^8z`PpFw0_DxwX|3kIW|*fI zWyH|Lv;>~WL;7#CQ+jo4BLNIYp$C|NeJi!&Mr3k{N(un(m2TwDQ&@2wVtWfNg!RkM zHhKuk8H8u0xqO4BCyB~DzxdjIE;|a^Nh9NEa#i(LX&&bFJE7#%yU7hf^b?+JG}~5D zm-ks4i6VHGSN{IB({8B>BuwVl68+Pu54Mt7xH&D8W9b&Oe@#{x#u2kssda-g1vmQb z$8WfOeEx*g;xcq5^7^2jDZr}I>!1VRy>zmm`!~sLIX>)1two;!Gv^kYEAaJ@=k0yY z`!Zi29fJH44zT0g`#4`&X;_bo!zj@E_i*sjhwR_TSn=MLg6%>r@-sPkgP^8A=M7Ef z&I|853-B(-hni^%)hCPn8<3ORU!k4x(0LrIsSx$kjOVK?KXz37bOJzD=6d~PptOZC z+ca7_uq^KriKuRHF!kG5+?4xW2Tx8qaKgnF#0ATNYMDTH>}BI!qq%hG4QY-cgX-!* z9ORW@-k)I9UL!l{!ktea6S3G6Vj?Bl;`Otse25A>e2B4Qe`4+S6o68}Q)++(kt2xO zeL1Pb%3p}KE5NLrx}Yc5}C-OGuJ200H(Ba!UW@GKKkx1-4B zjl+3$OS!9Z+63etj5vx!BKpv>UgU)yIqWWV&?M7l6aW6$hY^I3J!MJf*uyJ%p3TkJ zgyQ_x{mbuH2BE&5!;e5WDE~3(RSVn@!`mYdg6l#}pk;^RY^l1DA>RCO9Hq-=$KUAm zbAiZj9{Cc_{u!tOusPSZwG79XZ%u>xC+5nOGTV&bvGE4e4}N|LJ1T9sU6%$&;{yjM z@vzE(!foSc2fr%4T%uooMJFblK+swV6yPSpN0ilkirLRk{-p zB+)eWhhgP`n&qy)eR41m#%2Cde1rv-2{V_11#BrU}izEnwI3S$B|0-3*U`WY6omOEY z_KUB8$NbDX6^)dr7dU5AgOUFJ=W;2SNcugHa^^8wTb*GTh@iCUnNn|x<{Dh#DYgZV z8~0pkGi&KoS&UI)4TcR@Ew~`U8os($&7i4sNQ@83 zxo5d6rxc>8S8w#Wr`Yn4LN^^|RKbzm`Uex-FCtd7&z>poBBOe2gQbUr)P`B4td#Dl z`XogXHX(Ycc!#MVKHUztt;%2fluE0dofoa>Ibpq+w5 z)dy}muCIrec{*Okvd`O2%3f-}d2TkLohxNTTh|;8ewGT)#Ei>khR>2T@+k>5py9*= zyy2bp0kX^uqZZ9g$VkH76;&h(+q(tozS&|H#eeXHgupmyDCZOUTak;TE(wguB|&@u zpBLV%I`<~q^)8Ze#}dc9c}=CFTl4mhpYVIf9ZQ%`{rYd03hiO9dV}dg!wh{#X!LkE zPTQ6=H;vP>HJOzZ_TnXC!UKkWbVPO4pp<;kq&)Q8`m)FAza2MXoeKKKw=lQEvG)793%P$N~T^Ef@+l9?N3h)%!oiFFWo}u2$4i>bnzEu)uL7B%cTK) zS55(*hJRc{0jU#u2H^*yP`*?R%u(aLN)O}8_Jt}1wmo7FNwUL+B6f|KY4ZG}S8@&e z+=tdp&>XG%88_uYWeflQ4QfC%ae>ddXFe`Vf@7th%}vR6E^G;F?3CW3DarcYpwECh z8G^(;l1*doQq-VTl616m1^+G43MBG+-r{|4|2GTB{F#EV%Z3dK?3tx@Kk;IngZY>< zNIG{aq8S^ZPEg(lWY2CAAt(!%GScZUsgoi@;qI9ydq;t z1OurZkD=-*N5u=bEF@cUSa9kF2{2O>uJP@tdzEEavr>Jfu?Sj8eu0^e^3%UG^rZT1 z1%i_smuHY7!S8PO15Aby5O`XtMX0q&?>&;stfI7xjI<9Xn~Ze!p6edVCmjWuFYQd( zjeDGbZr>d`+FrKfs>BmQD$UP{p=~izGUC3+*1o1iY*JW5XAN4D5pUr3Yh*uT`&Mj6 zWiy{C`H)#*Wkhp-JV_sm=`iY~4biO6*i2E)8*VVDjQG`*3?}_b-uDg9k;!JDe@dFG zJztAc_j*^t>kQ}}>nbQ?#l@OT5kz4Wf2HTj;d?W}GO1Md3u_Cg+waP12n~BWdm;>* zE`->?*f*|zdl_^1ocf?sg6Sc1*8{>4%3?Pnc$G6Q_%`?*HHU&Q{H}-7c_q~pgdFQ} zgDK!7fR{et%OD%MGd5Q}dP6WHlegGOm|Q@%*6eaUAlGJsm(O_gx4Ap!K;!~cCzOkF zg{YMn0?T(u#c*jlYmSmLto8L{S6}oJ4kWvkM5)|h+;rE4HuA9oLs^52^3Z?RS%9kr zn|>OPMNf3id_adRP&?^~`kO)^l3&gTjT%tIFRJ(c?yPOKdk=xdvG2^c|7f)i>#{tB z+DXlkBSG+$I!sfacX!MBJqN}bdhULDK9^aAl#5a&cLU&d=qOMn8^uf>@DQ3JNoZFK zdss`sEa=1{Zn(mWxhBg^wwHuM=!LJrEg4v`7%aYnKx}St zTto?U%Yivm4a>&D*)Yet5C}W22H%NJ7djmI^P!8R=VxYz%5!-&!R3>8ZBYwcEi#aA z$|nSVvJv2AAZ&Xx8WH=a3#W@XJ0WlL8?<10jKMc1F+p*yJ!1^h`NuW*0VF1+pN+gA z>S-vrGKktS5-M}Yl;)O~#15VWHdXGge8KpoAiBbY;w^|dAnKs&^XUgpw4!NRI0EC7r;-~KV_>VG-!n!zZ;hBdj|2;gmqwy`gco{#M?@CCCIp1ni! zGEt@ya7=I76EFcIx*)guZKnONQlfe@hKw%DayChUF=_ zoI?uVUmE!tcyxo{_G;w>d;J~g$3>gxSj##8p!fdm(%RGqIgC43bqBF7&WUA-MrZ3z zs@39FZR|Um+Zt`YR|iEFLQZ^dZ4TyHlJJpfd`a69y^|}maA%jc03N%riN^@2v)$=& z6D|`Y5=1eQ16dlDc_}%A3W0JIP{6E+%DBE%nv%1E0o0i^W^Ojs`cqMJkbzO>w zt`soOaOfz0|aN{l@E`?E^LL|g!gN|zLI4Qe+&}5T};$afOsmUB{-a!zp z!d*a$qIato)dDPF7F#CEtk+xa8`0xhEle`Zi{d;i0)xRFIb}^dk(xAu1x5iRx)luT z-mc{r7u?|PY&tsmfQ=h-AN}0Y&JwDg|sPUBgxw&!xALICYAoWz7-LtrsD<+k0uqO(*UYHa$yyv>GFoz&!nq?Y%bQWFa`yoJXGD5nP}{I2cdIU>d}cC#mVRcmFQ^hdnE9ckXOMJ5ck(Uh0D^+*YB+DxV{13`5b6JeoZRY( zdz(sCDp+*&4&?}c64i`@K|(a^Nbq71}xd(dR{EdNLd2cQjM~20$eg_9n_pf99YMc1Za^a!%;M zAl9U%ID>p*H)kaQVQwjTVR7DYe*0bfimxu>uXhrzX`BK)a=c2kY*<4d*O#ej;W>Tl zEbSirBW{Vu9`>a{-UyBg0uzF9ye)>dkC>S6(|% zlO`GRJr^gN0uDPFNXVq9Z94Hh`rV1nMG0$xQerOIdJ*nihyS(yb{m-_>AK z)VQ$3szlBxhD6VNJcNGj&}FrU+H{To`EE&Sfdy_h{t=oeL4PRNjM+WKoGDF7=|dPI z?k958J`ORk@;uS?{i!H9(or#?@M09(h!~8B`6V{w5hSV!Na8Cg)e#>J zFDX@Dn5t6zq4^@isOaK5@(_)gpF9oLRgC`V*-CLYL7c;tnm^REStJ>CH7ZZtC~JA2 zMtsXA^!t=O`iE%fp8a?JF}xyZYJrNmBLt7dRNqB{lazt@_2&9DI~b(>>;mllK3XD$ zA%>C^^Qu|eZf+U9f{>J#3p{0o_gUm$ec>J2o<`%UOl5EUG)H&~>5ky@+?wg_mx&{Z z?1vl|lvp>A%5X$Y$H%$P*Vr^_Y>W}k)9ggpAC#SlW_rj|%<|%)r7<_@+=c5oPk%%R z$7og)B8P|`nWav|$tm~EEo`#>wW-=9*Zqr^FQ_hi{mUgBr2{gL`L1w5I=c~lG(EOq z*>Ly~Dum{$(iuS)Dolwci@Z4*bj1OW_R1`3h?~ZS^n^hPsay5oHFJ6)bNb2_O>r$! zs!L9f<+oy=Mui!{Nnx_`RaVO9ewdO(+Xg;IdP7W;zMJ0=mQDUzSRA0W(Y59-(lrr^ zkk!mm65n*`0~1}e7sks=9t50e2j2eQi}~+N!r3D?88MJ|hPt%mXd;7dgD#mS;5dY5 ze3!HxRZ=opKNJ;6Z4FH;+W3AV8_y`E*S?%y<#|$hp51>wRM{T+^~&YT{W2BRuc^IF z^_+aQ*`I2<=iGQt+K)H$!65XmUzD4&40O7qiF>~Pah_aA_U8T)jwpS((TEjp@>|zX zM(;|_U9koG&zaN4>Pj-Fpgnitj14Qh;9kO3YpH#0^O{HKUM^Stluh8+blb#@gAvTz zLp&J~skhJNS-6XN#c{^Dd2GbtLGndR113=$tGoZQoXFP-nby7amhM}SxjDMSgG<(a zgTLhRbadERZ|!g$a~P@L>*$~i>7=M;lf2c!tam1u7() znIfEac)wmt;;9-LL;k3-XMLv-)`I%F6B=Pl<{9r%3Fi-q4_pT{%k;j?M9gg98!Hq* zrB(b(Lk)&zG}hr)j+8v+ul@wcBEP=;2aBWti5vV!{>xwJM#TCOT7UE-7j>tHER>UQ zyp6$?O!sp@Z$^}TYg&LFSME=rxXx!VO=yf}kOQCd~> z2nHC}+p<5*QPbzR22su`)_!@JMcN3$y%diY`211lL9Imy?8}PN88#X6BF9Mi=x`#EK7KtPrb*Yt+40LVbvBfx^h0SpqE6 z)`Fj^F*-fFzILQ#jrA(FnWLj~58JG#aW zjS-GJ=JR$=h`m@CbJzqkSu_yMM+80H>Y5D^e5{fsoCR8##kPBhRtw`h5p^G%qi^3S zocfIL1KSIQVEl}o5x52Ctux1{?zZd@d@cyNWVS@a0P8PUi84s`o#IkeTXh3l5$lR6 z8I8L!@}9U-dT-#vKChOkaOmI4(z+jigJR3_aHhJ^!(NNpP;dXpXnCl6sgh9k-6C9kzA)OmF7z6Fdcvzk^8H)#i%SV`b=e^EGdbEN55qYQUz>UUH) zmJL>fFrR<%l0t|MawS|%SfUh`MV5hU?RIs1PJM?>7%%*jL^khp@-dETKJ0340J(fg z6zVkiQ>`p|P^P>?x!eqw#2V=(W^CGAfOH1RRdhbMD)c@9|*Z z)5`1N?~DmalECN$Qq5@Abd(&Z38+g?K`y7y=)OgAFi5^4z3GVC5lOIIh>UnuaG*zu z%!^>4COn5d8n|&TAI~_EB&u7b$H!wvgAH4Dk(KDXKhmp~ z8Au-bNFIDd94J+Wfm7lb*MF+T^oJ7(pJf{BRIA(b(qVmE*y24z(L+WPC*B5|0gGg} zgF@r#hK@bMb_5D}}hdvf!-=ef#bj_!D0VguEE|AXCf=XL@ z+$0NKHQYbYI@q#XK9P<(Vps)936O|FqKq~HwhewA*iD^_m7A!XM95_EolS$TB9EZ| z+-MY1IrLjWRNg8HtEG!9WA%P=AIjqog)OZ+qT8BBKkENsV8u=+ceabTH)9oLm0ii6%F=pcYteZPG5uR&^P?I!`^@Jrb7|UN zGTftiwVq*S@uB|s>+C_{#}8921+l7-2VDp-GOqD}W||;dU_Bkwq3q{Te8WH5!E9-v?RQ)-KUZRA`}^Un?<{pY5bX6h^r3%FL$CBhI9&cndhe>O{y$XHD-z5=8G_(Isop` zxgY~KYO2=fKhPs+Ecih?Oler=`!OU|OVW-Et+#m7$6pE?@+1}SD>J5crg>lBTpk7E-atA(b z6l1D?;x!8={M+{jMuDshZUf`RNOLUT@|@s4=G{yzUnB?UsJ%V%8}HYLA^XGGWnP7% z@IYg-B8!=Czr{e9r{`wijEkhq(bOvsx6YGRI%CUU4c_kpnV1(&(7CJQl*Bsbgc?>S z8};&|?493rsQD5zQ69(C1VEX5{ghu7CRnK<4S^D;uYA!udz)5>&RbWWrh=k6|2h5{ z6QsdmKfY67iZ1ppGyUAg!N%F!!p?-)D|Y3o5dK714>rf_HgG}lD)|Zr^VU=2)ZYwS zfX|ur+hoX~kuA_IODZbEJB!dNLwBqZ*%Cf;KOE2n3uD(N>NF$LXq>}S`ZDlO+<&pl zM+tyE5vhFpgZLc0n|Sn1;_BT|d>+YSD1nYbk8fomgW|WNWEZ)@V1KfReIYEbP!CX$Xqzh4g*f|1axFYy~xKhF8r z3G<U62nqu+ygy8=T`p1#2>l0AQ}IE%Y7!R&fpz&cfpDFF^cwNQ0Ev*^({uUWX+ ze7i#jWWL_eAF|N2C)*9;idKJFe6Hxli$h3yBgTQViap=PYao|wn+`E z3dhw>Rf30G>H%XqNLtnfwRs6+!o`QPMgrFt2cunhIr)Z0hM^y9CfyDZO0u{@fWCV9 zxIr;|{iw@+J0m6V4wW2vP*$+~ULXcj4%O@?H>mDU|FoM@LWqLZXNK_ktTpXqNM42H z3wZS23yeZIQ5FWlx_?!#JV6j3gXF!UN|Gr+Fn2mo@UnIa$=NXy)e3>HjHiq4zYrp5 zmni|3ymHl!2a|;|GAXIYA}&iAy{BK`?WPzG)FLUJ5HfV8{`sOt5uJ6NAAm%yN~KBz z!sOJ4d+cDz?Fx=8@SRb|+?wGk4?PN|7e%6WY~A@x0nj}YMK2lpkJ>et!3df2SRnEh z{^cZ5m~@oNbI{fs9QBmBbyhh!ppgPUUzDZo&tnij-cB^sh-8Npxf&NXI5W^Z$&nTk z7!PFE3RfAU%(P<01^W4qUXg6@2VJ059)ltx)9~t#LZ-oG*3azSDsZOke#@S^BTfIyjv8~RpjM6X#I45W~af_UfLX0%2LQ`BggxXlQ)$E9=DsrKH#>j`!wB17Q zp*+tJh1oFJ%0|GF7q3wQ2Jr5|Jt>SZxojdZM9kJ9%Kr>2Iri8`_X2YnPZEiQihHaxJ z>t~FFJm3E$6jH?#;0M7*1R-RE0PdBtxNM%T_wD0rTS_LBMabe2L&YKau6Sz@ED!_+ zZp#QBH$PY-QD2q@J|@Eb-wQxVgslW}k1x#PX7O5`Uvf|l#R1*+j+{J=_W&aN9oB2z z;5Ai@D25F_iNWEYf+4egzI)<$G-g@oR+*W|O<+o*T|Fo*b{O>uT%`CAM)hQSvmN|L ztZ$s#ftO&l-*l_)Ct9Vio`-PG1Y2mvC@T{59 z>jjh88ojA_7aEAY$|#@x7p@RrhYEy~Gn`Wa{`1>^u!Y0S?|sV(XXwEEf!}efC$AIG zi;RA{{`C}{Y@^%iv;_%oBal8&@Xh@ivewmukrAV0AyKztM=KPF+z+j^+S{eggA?_) z={roUt`EcypwWUeh4(4S+G+~8>9^Nd#!yz6VAR;iRfbcJxyX413+o!FE2h#@OR0C{ zM$%;O?oJ?O1^ayOdlecGFjM-semDH9*Z$(UVfzowBuz||1emqKnZ?Zcvbo?Kl*ae3Q-X|4>XIC*RLL)K&W zpV(4QB@C0k{elq!J)zgYXKGUl54b;PQ%BW6d+wvy-0GEh%WJ@k)_(Ra-KCw7woRYT zc0Y=-GT!_Ok)3F9Rz-5{1Wi>ZLH@L)!2eBD6lq+x^I)lpQu6*h3~s=1EtkiTVzav< z&Scd0cb3$s@e*5D#o4WD|5!>Ta#zY=w;7Gn8c%0A-C$WJxKzpGv)dh-j3UZmce?Hp zdfD_jOTBUtrZdHy^{bf=35#9p@ar}SJD36QKaI0!cG;>TnEdOTNjWkyHBSLd*~L84(bW!Pf;^)P-@#IMYH0zBLPK!!>3OHd5SpeC?I z?6>RC5X)wlxyEr2Rj(WAZ*Tq4g;D^ME03MjRZHsdyMV8hS_Ybt<7MObzHe%w9H!fe z75|VuNSN4u|9M^Xk>JnnIGXvLymWFm91>IgScLf=KC$5k-cuMcgU~q1TR-n3QN5&p zd33ke>9Y8+8FA^kAWBL$#9a`{=4;cD9vnm6K(jn*7}kH6JH$X%$zSWfNC7gFaXUXY z&?vmzpBWwS|1v#Zt*iAtZ3Kbc(Uhq zcE)^5!5T(Hxmf9H8-UNQw|tt=y&>S3&l0o{wEfEE&8#Hs_kH@_3~xf+ZN1rSd5ZO- z+vwo#d{e*0@qOT!lfc5tN?Wr<+qY{h;m*b^{7F$-0Ma+tLeYsbZXgjB*EhPhvO7!9 z%)*}~VErd$G#}o4?e9#}Oyc^Bx9i6Ov84-L%th*^%l+wKtCx`QhwoFSv*u=RD9Ry0 zo^ZYC${|H4f;~Kl{7HH18vX)7r(Wek*z_eXSeils9Nn0auZl%Bz7X9}99N)pD z9%OkOX_{{U*1U3b`WFIN8*W%i7+x)>{ zrZw20D7A5M|^jXMfn1qo4x?cEz%7-aA0{Dg_SHtnf7Z0v@M^t*$1abim7T zlNB<=FstbtZj%AkN;$WF)excf!!{v{WI84KJNR-HQkv`u4QJo^Jc&xnSyZ+%GEhhN z<;?7Cao7{?Z{zD9^;8I>L>eiV*ZViqEq9Leb;jEhb*w+3z4lrncU+L(F_8?0*fkIC ziD0dOFUBL4xpcvQg{nUGSmr%Eqqu&%tI!uTs60=JxMsx~skQ8hl{>(BncEw_m&8GQOSaT`Ya(u{tN{*G|35xEx$-dMUG;cTZ*C4_3g_;-yH;L{N&Z z-&-RkOZ9r~Y=4+xwzLiE4GCAya5zA8~yF|1bzr>uJO5L&gY=hq+!WCIfT@18^v@1U4wfK#PS^u}BcGLcNIsty(7cRH;)ycv-hkr|x!*Tdy z&ejlBoU@LMV0QDxLQ_O(I8z67@Lj{WuZ< zEX3>@jZktjg|r%G2GFi^>Wc*qv&rVWA>R2lO*B3r7&!wnK7;$MYlIaPeddvjiER{}AYP5D{uH>S3*GnYtquLH~jQZngzE}j=aeFbX z2l~|k7-aXiW&vcvrVHKgPkT%selF8p>#mXSW_R?if+KK1F-NiLisrs9{A@A_fV>8FN4+y{ckSXgiXw8J!g$`r64zt?>cQWPLlIh2uJG>5l}t;wnnDlgZ=(L zJiTR9oLv(viiJT3cbDMq?(Q1g9YSz-cMt9acL>4V-QB|w+}%0zp6}lCcm6zU?LE7@ ztGc=i|J>6~yEM$vky1Ncl0;nW(azdR^{lzWf{q8;thdX!K_TnAj48s5bsepBlO%a- zEJA8aZ7+f2qs(Av02=f>MFu2}Lo{E|1e&J{Ra2=bhe+927{^p1%=r9uFtX4ws@5n9 z`w^n}MIi(xl9IRl90M90;9iy zwSS)VCPKKhG8SFBXjY|&>|evdB!-{(y9~U$C??bjt%FMcrK2D@42cG+l#s!k5P65n zuYjUvHbu=cD#B0PAX{NZvD1#kxRo|@cD!1#JQcU1W!NMUo-NFAf|DF;$dhjqi>gEF zD7K*ii@hPg!X-NrccQZN-%=#W@iAu?%{djsVbQFiOd%Xc++d0l$UJFQzq|)>zsT-3 z!a9jDAwC^WV5E4LvTvoy)>;%^%La)NdT9k!R-!7GTNOHceT|sVPi{q|jM)2?VylY9 zD}tn2h#th4TIKvI9+fyw{m+>UbLCe{!6n7$w7NWLj3)$T)GeXEC}A5#pHNI56*$sE zAHqiEg@p31=m!#_mN%DZ>dUzADv{ttOD2{t$KOg94FbND`vks8SSJ^hH&(F14Hsm4 z!%T^^N)ea~K(!ONVPAbQaYTuEAuz4y4eBxv7V$loeQ>Fxx_S>Z;59hva!!?Z*xB#5 z^iYSa_Z7qqUwhxj_gM>?ERdePC{eK6!1&EaQpE`7te^<1RU|;A^ND+xbAqI zjg8P{5<^Ie+Gca02{gZ1Ibwc5Nc6r(mZHCpoJh+rdEV_JcS1^Q{S90}ewGL0o*++W zR3zAnqJ7j<%de60P|fO4IPklAtgA}!zNhv4c6J=RGD!6L-nUqzqFB2`RZ@$HQyhUQ zj5eJykO5pC5XvkSRU!+=xN~Ig9E4R1h+tX;KgiY_h~8Q(gBpAZ_uo-fjBAJji}Km> z5VtjZMZI^rrwxoTZqXdacPQfZ_Z-c!8Tm;}OmZt=Q#e`WlfXWzUlV&h5! zzex6?&7!wzi2OKpsyD!RN-I3&5J~&*F|GMZI`?`Q6&1z6Vx2`7_1c1UBnkLeUU2P| zuB|nGc8psdofap6%tU)kL88Hr7o z5W4_(91o~;R8+U*hyNHM&s(ertm?>8g2p22zloOkO)JTjp(sRxvU!Y(a~cM~{)F!m zNMG!k1|V4LpQzyjZ72Qi`ka6j0ia=HWK8ya|0_Q+u_XOv@P*(9gNZ_=-Zs%GDnJx3 zAbnduk#GkEYFf~D}oRcmoEWM*8Zs5}m-*fziD6R}3$PKfkV5QQkv77h#y`60np z*GfQiLGagn-JDV3ytl!4stxRY`0?FVGR$W%QZ*zTDf}Xz#|ELs>wD;M9PwVmYT`Dp zxO6Hl07i0g-?3tbRDO;Q8kXuhIv(J!+Sk20H5jK>$6mQeuhQ3C z0;{*<^rGZX?PSktczwReNt`s#$f{HcNfG^MY48juD&=UO2ULeXxDN(KoXiB@cG<*I z5E;{3?qUpHDbl!nhJT8`D&_L{`Ht3am&uJEPG*iU=wf<}52694e_m{N+P_$(gfyk0 z{enkG>*w%0*dZY~Obj>YvaAFylL96li3GyAFFddS3QSq8^fb^lwbeFgSdd9{tLe;! z_5SDW^|nNt9rB{K9C)nJmV{~!Yb~%V zF3h^#n4Jh|>7d>V@0p+tXowgqY|-(0NoXnoRtHcwRtdF-pA8dXhq0Y!#;6WbP7=42peB?3H$QpYPG>leeQU^i@zDX>)v)EehS(r z?gsWBk)9Tj@Hd*%v&jlj)k-a|ueF1T=yRW7gvM~c94R?~yLN}g>V$H_9Pn_tbu$F4 z8@Zp0Fi^(vK~yIEFg*kgp4HI2`<{o3M*#26wtp?2(+m1J-#+A4nzkAIvs zWt-5j8HoxNYYRo)56oQ8Xb^Xc8Iv;}3l5`3Oc1>SZ*6TeS&;GwyZp@x&2_oq(O!zUuw(^q{zzGNDKyw3EmPi3nSm+p3(;CV^QlkFwMmfa6BEg!1q_|-&ZnRu? zf#{>GANZ9e)=l55`#c)dMRATWzP#j!{&fM~ttAMulF_ca^hOeX-@X}24DyR7+B{5O z+dRhTs=TprZ<+h`+VM7i=R_fnuu<=|6ty>hnCHC*sx|NxbyF~8=Iq}W8B2b4@g>7f z5?3!(Wa4ou-j(?qj(mzhzj?P*T#{|#@Iama(`U0v%U1j> zZjj$dLhecG26HifWpykbH#VU)sPqqye}mcOQv*oM`6}dbN0L}feu!HJqZKBw8b3T- zu10z1?1$hjzsHB;bAQ-x>IC@Ed)Wmmukq;g$sA#KnFm!Z$D>|If1QZk=xJ!CZL1{k z`NI5nzNBCxtQ0~03op+r?Jw;~+$qLX!anE%e>}flI8iY~B&*KXyt!?jw^yl7iS7WX z^L!XF$b1d7s+Y47lEZz{n6YxNxSJbwyXD%)v^>JaGNZPbsSK8O@_l6MpfQXH7%Z+v zqdHVwe`yaAItF5H+hWTjGwB3^%$-y7B#*V5XZnK~y8Db6tEqvC0< zno)lD@0(yp*1&`v#=B8^VWSvb|C1)2SCq5udfSay9T1S1X}jaG)da@la{K4P@1C8y zYekp+v6NvO>}*!|vlq8)6hfiGFz8B4BoeL*g}E`tjmK9%CY^6qQ(3>}af7)m`z2VC z&pX`1#ey20XZphsli)*OAGDC>)tYKFpwfX&u?;4(?usDlSg~bs*kuL-0lU4(fwCB` zA8SMA79Wc`E|zh(?9JvERwgN2o-h_AZb=yX1ybaqz;2BHLaBxclMK+2^xV);7dve! zm;&H_u^AQKV`EK?7=QL;>d>%q|2$qo!2LaJ&pfTs2{g=Z0jY>gv>5>7fN^e(?*x%M zd&e8_`3gg8qatM{1l@brDvv_Uhdq~iUnTq)y7t$vLn@xgWnZFiT~l5qBt1Phlgs9< zXlMeuo!4As=NdGEldi##!@EVGLKREQ>au>m@{i2k|VUQ#aUVfkP+qh6+O0=fB z)wn;S!Au&6NHg5pkm3jV8QLJOgq@eiXR^Le3kr_zcI`{9SSZWobD7jT$h%(4Aw7R9 zxZL?|KN)(BXgQT);Wd0WBb3c9z7YF-dq^zgY0 zx^ELNrBpdh)8gMa7Q3ZlwxAD{H5v^XajG+8kUR|jIe4bbmR`sReOVzf#6Yj*hjtfv zd06@+Bx8oK$Hk4?DYp2=F29$uhu$VH2YZ`_QQoCBV5%6hWZ!bra}fM zCrf_DxLShVu2;cHyf0Jdj+Wv#lEE@rbmtUKIO+T}FV#+c(lLkLB*!9Y zsJdpst!C587|}g!rF%CC#fisySyY;CQAK3=ndXs&0XB&!t}%C739hNIEYWpz9+EY% z5oC!rHSan|vTWVT2UVi9A0C#9sztD$QVJdo6H(;m)I=FjT^P_XR1hy^tgbNA9T~ul z%xumb{3?K|maRgQjw%798DJa@Qjk#AQbfmBkD{S?{fB%c+%#EMDFp`wZPH60@_nHm z3hYD3O!xmX)*zMP$!#gkDZLfpg?I z>!@f{XwqS`z3yGi&M#3USS5i*Mf|fhM|$$@+?c}piCnmW!zv=UQ(Ut~Bq z#C2o*|MH%_DX{V?9c4c23w3;sz_~7q+smX)%3~e_6EiaryZLNvrb`#3#qywRG#V`} zuc71H;CzW4l|nYmmO$r@NG7%lmx|=CFEf}H!x#y%^6p4e?O6MPm7qvbr&~FQmyDgn z6Nhp==c0{UgWT2!NeiWTm?XAHga(Awp$f2TX$TuhD zE2&&G9%|vep8_!ia2@r#P-_f(zyf@pNR_+q4`K-ds3jrEy?)e=HX;sjA%otk>sb;1BpxnR!vf6t-78+|_Se;m66(6cM5NDkR*G=`jBPCHJ* zoU^>55lJo3l0)}X93s6)nUw`^){PtwH|Ck~1FrjIz4K@+ZVY{6KtBpr^Z&-rKdE*uDU#uBT>rfc0ip^nZ0d z-DG+)v@PlFwC@W`P&tI#?-0~kfuP7>dFz@vN(gz1>!LaWQriL;zId8Ljm5cgL|O(^ zV?&a)8o0~IPdZ7Uf4AzG0%=fP$VBB~fm&1~GsR&dbT;gj5IS3tM7DWZz{|IY+H0fG zO0>!<%R9osMvjlCdy_{c)qHHpe&sVWWH5sK-%DZs3Q)xhS}(hYs|eTz`_oBf(I}k~ zCsG#T&T0$Q(8=T?EygJmaLy+};GM-0}_bA$84%Wt#L+DnjG>I+cWValq~CRx2cq>|IVgT0X!mip+4MdL=I4SNOaI$hb#CYcS6O&s8Q-WomXOu zt+*=QCH@6!vbRV@0r6t|)6=LUzs~E#@Z$@VK^2~xDik~_6M=KDdZ>7{1_Fitbo&Cz z<0L^{0R#u+sM=)Yj015He7*BaEjzh7bDqJbokUPI{C=QSHbjX;j+8++Ut*2v9%dID zIbgAX?ksE!5~zyTz<}{DjSq?Z4lStAw$Q$#`Bn)6-FuO(2^sPid^p>b zn1l?zb3sw9C(yjdaB=T|DBx4@jjlHt- z%kGO%4y0ANxc$?Dm@;mz5*-vxExR!4F>#aq;y0?f5D1{O0c&hRqquPhzo7y?Fj#{j zXOb=C4TxI^9~^etr*IIIGlhO^#CM5GuEbsC33lB0+%r5pX)zeBd+d_FAk1ngF7l$X z@w!sJ-m_1!dk8-SD5QuAsTknlV-c#NsnkIuOI>ZuQ~AiCwSnkxbOSxZ6*-GgagK!M zvJ_h(oFLD6%&;%!nn?>v*GR~nnGZ#HhKu@be4CcmKxCU{N$L@DIl!2(U_??T$USt@ z(zTIIlc)eSlV>s!f$wh=F}{H@f%P$OXiR~l+^>`;(hv`FtpZe($=!V@*ABC%k&;HA zd$dVP_;bJF1|wb7pT(}pfRK>lr~_lB5O(&%DwKK_%=@^#X=G@6{Y^P?* zVZ_)?4lJWO_mVXx!Ag0>Nqo7I7u_2YZ6GDw#=>N@6;-@{R^AEN5uD&6E~w%}a?kot zWVtt`MGnxALF$=Vs*!%gqEGkda+}2203yRmAtO`_x59&t%_QUrxZOjIti%Bi1U#-1 za9?A(+4ogPZ{{}BXPT@#9~*jDDpxX0Gfd`FVLCLN4B!gP1B0BeQyWkj!t1g@< z5w&2O5TG8#11aJiampah$aPJ>e*m2_O!>LATOPG`7ki3OK@21S1MJnD_nzKnXC%kHSc*8slVA#FLX4 zOHW7YN4G)O$1LE6e#*5nj6z;A8aGj8z+*hT(hbKEJT7Nnc72@K8MM1@x7x%An~yd% z@`h%5LciVo;YPv+Z#KAGBSuW=U{-#1HL*uT4tha%M58#;l~Bz<11sT;1nky934)p$s;)a-9?TowFxzMRi@1@4 z{|PK}%$UHIF0lx3Cts&DRU7SQe&`@8zurqrcuuoB2VmW(o4k8Sd8Gu15hP`ASa!Yeb8q8oK0SIh}bO}mNzG8KlP-PJq z%m)&n#KCT)KwpI?Gda5xoi-+e%K0ea>d@D}WyurIZ602Cgpni*^^3iGVGFv=ogH9H z;kxbz_n8YY9DEox@Ys1h3-}=TR#Puk6*QMsxadY2j1{kYb9#aJBg5~?h}WeNo6yTj z`8YxlNB{Zy4eb4wDc_N{k^!i}+lPP;Ec~;MJ(a!OV4n@(Z}KZp2dh({z)QFmlR$+L zpF$P~^O-KC)!<5-Cn1Ui@p6Zl&Y2gNjdkX!bTwv0W{RUjp#@1%45)Dw1<>XVc?3;x=_DEh@y5qZf{%^F}gS0 zH*aR) zKG4)zGm(@1ZV5KdUGgT2F@R-Sh2qim!UE9~s+w93e_}b^A7M1}i)N#UWv|IG;Z2|- z1zj=wSw$!AC=;xK5na_q`s(j8IJ~MMhWkc+3S_T|kjZjhX4-bLzMqu1abP@Tn4l#D-V za7~ghseBmT{Fqw&Jio(g27ed9H=jSvYfMfHNK?ac6T=X$)I{{^oPK+IJ6W&HdTE{< z#C^@#LpH@1hxNN2N$~Dtnz)Vt&H@UtaEg8jYQzClh=*1`Rbh{dXFh*PUzR24ecAWx zX!by98%$4@e5JKUY-=bLO|x+cKjWUNhdtsayh~M5d{}T{;7E^zVzz4wvaljl88`LB z)(MkFb$$8zJ8)6M>i}%t^*DK=RnJkvEG%ZHX{6$R$`^KM;j^=_R$+sF^?0vzspbdR@i; za8O3neVQ~9PQ>04aG9^H)ncUF)ebevK?)LyV*$pJN-gp{@fd0aR71=Atkr4d2UvKNL)sH3Q=yO6PJ_yTn}D0HY@*GNx* z_wSvZkft-CpeF+rm6WPDD}OU52M5u5KvP{+S4jX51!qNh`BSf+o=*frCa;xJ?l>;d zZ$jbLo?U$#k57pA{U8S>E;3qvijw+r&z<;{8KX)%+AhZnvFpF$ua;Xkh*etH*oHh# z0)@@(RJ63TUpWiAYN*-SZ{MD8apcEmaLm*7>Ga;Sjb1q>*ZuQHzG-Nq6L^?^_jR24 z0Kt!#O4YcqzM_EJT>PHKBxg`aeaK7yhK9brK6Yv98ZIv_xxFZu{P-r<_q=!Zrk-mb zm#O2`wIx_*ua7c7#?Sg!?0PMckWBJ=>3KdOM# zaOTamBZ(MO!LhMF`Y`YLFADMVKNkW)^NW+{)zuq2L+vVPqCbyYejC^O6>ozIGLeE`|hG*rs zU&ixa5>X?*%MD{-!pj$+V#}L*zzP_jUDo(qU393=E5E-*Npsr^%U};vBUFTow$JET=8TB0ny=B^c95 zE=D7IWtP#ODea5O%}jgQO~{9(<6Cc#Vpi96^H3i%jYxP|NS<{YFlh>7d!V*CDxi2g zDDUShh&Ge8RaTmso6jF+%PP+#Lf%8q1S9}I<)n>4{Pk9 ze}!OI+2Y~Z+Yz*?Xk)<1St%Vpv#M5I`0;b))6#(%@#|*;f|c6L+!Vur`>@|77A)2e z7n@Q&@FlW(hPu>%yQWs{jXQ;z-u>fPjKk;?rX2pQ?Ij-jTvc<2g9_&i&b~n1#1yBO zyW^V|;ziilkgZo>n%0U*knhX>^#SNb%=9&UUUwq4x@vPJmGgUu zO!@hiNWmHVLi2&JqH8Q4bd8@9&feou6!k4qHEBWJQ3F2Q`CZ!T>IQjf-isuQ9jB*< z0^XZRA@K0cFdchji(YGO`nODIt{Y6lN8{_6p}D+nm40>mr@|J=oefiB7MH;jM#Enm9O9 z7*Xf53FtO-*A0?g3rQWEoterPEQQXH^i4p!@_P-zt7fxrBMJF3a{ z8=o&b0e@XRJsdW+cUBf=x3kmJlG9R&NJxZvIbE!GwkbyTEDbK8ecaQumR2}8Od}sV z2>IPFlz52sJPVI@FYN0#?M~^?G1T0@`)r-6bK7g@XJlmLdz3aba2%*?28Bdeo!3%G zyC0h4Xfrf#<{<5^8GVc+>Pez-asMnUHLuqFW9#Ty5a77Z$2UJG*!VB5hPJ}yb$k6Z z!l0P1a)LQmMy5?$Eh#-$fQKi;m+jP5^oQ?W)WN|;U-!eW2B$c;nlfiKwT0W}uA9o0 z^R>3a-qHGhM?vDpnRx6Nz7Nx&(1~5YGUr!h+%+Niu4jn_n)f53L#cjuYs(kh2IyO zIZz2BZVg369bFct!$IB{uZR6?k+}Kkg-(Hk4aGQS&4)*|Q;$1N0S|2m*DA7wDAAD~ zn2?&^FnfNNG{0FT2sw`swFth=LhpQTgNHpmKXW~{{n>u?;uN&tyJ{AZ;4E03=}J0{ z49A{mGB*EgOT;qB5RxJ%o?^gY;0EowzVvNewpytbMx&F(Kq?(!=+9RLI*iy6e4Hmq z175Q)+deI-)P7<|B--Q2zVu&ATA zDZ}*<+C=F4VA4CqZ{mqjV-rKjQr~iA9|McYIlo`-deVAUR#yDjYYRZ{-M06sEpxs| zX0myRDmjXc<=E{HNj4yh(%f<=&kF%uKfTZ;(?Bw+UN@YYaq&XDO<*_DWap{-8e0?~qOfiJ``SU@XnQ z32c?+fbpnYvSb}>Afk>K+;|`%EcBgO@=s)Q78zwP(Fhptb@>=imdG0a>ju2dS&t$W zXo<30%sV2uaT|ybBrLQc9K3_pL}*wggB4?eS$LoXg0(ACpYmBj2w*K)W0Bu9Ec?(5 zl9i_*?}$+_E-OzL!;DjxR^pzSE4e^SBXcn58$*+>adA$UC)piP(@J|5H=ctM>#UlO4YxfSP4?p7j>^mCtWuFS%k@M^j* zm4qHw6R;%aQqVQ~ow)2@_oW{->#0CH-8n66XK_S7@K=!2bC49M+zGV{+rZ%wY%~#c z_ERDqokm8!l=^S9hI2Q~#c0q&UQp$HOv4D!N4ziTV;XHkTUt8TZ63bJzF$e5=%6z( z!F_|{^J;ks;V^nNFg4N0^lx%7OR-cU|;d$oX1gH(`9H>>Puv2%1p&0FCX@)*f| z{Fhf13MDK0BET&8wcr-^#9H~ZNBCpZO!ygP6$+g}SMmDUW=F}I$4f=^C-#TBux>%- z3gW~pPwQ>%>(OK%RIUz;MlLJRQKDzzW%lv&T4MN1t@^J#$!vs~#(~Q~r>j|J!&rO( z$&DKp2twX)?rZSz7`&Q@u$RD({^PvnIIFU+!-F}Fo?R(sW+P?^u~P~O$_ikM1JG{Y zyP_iUh$+U+O|)hzP(Fqo;YoZr=>8&m-JdcRnoJ)_nFDztaC!_rolNQ@EQNI@=I>lA zTR7TOjvM^`(0)NB-73qV@jaY)-nP@g&1ep_M0GvpFLriG1v*#*{e4!x<~dCk7+fKd zL9E(H!c3g&bSgSlb4QwipGf1KG)XF+Tw*gEl#yczUomKtcSN)q>Lre(;q|ffRrg0Q zgDvpjTDfh5s0B9hkWCWT%s5yBqjgnopL*Val*z!}da#w9N38Hw-Hy^|H%-JM@5t)y zY5x0Pag=SZ5kHR|_Z1Xk|Eq_N3uS(F$yZJMRySVEg0Hnwh&q~X32sY*&X-#b7rYnZ zJt7fO#xlNs3L28Fo<;4oW;zsC9X5oH)L;R6z^oNXz|$-E3v|N}0QO}SX;xB(v-^oJ z916@XAkuc1tG`ALzgUUK1dAi7YL=Ztb~sD?;zu4OmZMyDb3ihjRM$V{pL`<5Nu`r zu7hBehs<=5H>2-j3Syy94rUavLX0-a!j+8}f*Ugl@YF?DR*Q|KG!beURPaOeFh^Dm z6gA-ujtGk(Rhn)sK??PNLsD|4z>N)+Ar1P03!4B*k($6HAsAVT8YbDLx)Jp-VBadI z2=^nTk;u5Tw94wS0Njp&z_cKbm_!qs=Wd`Y@w`;65wJO%d4x#iRCgHGRBW%bXFE3 zkOuchZ+`=lq3*Egq3g?FbP?a_IANRg`C%iAt}Izp2JJ&2f2$6rqm=+Lk8;?Z|Diq6z~6<2ED>vnI|m8^L>vp64Nq z$1S&46yndNUKpYXNvndo@Q@J7NIC;9ZP;N^)KY9eldmwRZ%IQfP9QlJjDNTF zc)}5#>xl{niN?-8H&2j=44KyvaaOuJnK?r()`>*SzX0Qc&{5=1gS>*EkQ=HzA~+P) zI*ix@_D0uSGB&gQkUVh%=(NSEuTijRJDJe6Z;or?&Y-Znj*HH^>IHHj1r7coQzv2z z^Ko}32cgR$cEVWKQk$3`puz79;l_}!D14WD`8M&BT*%w~ z%Pg%HQWoysk&9!i`a!AGW!G))XuIC#on9rj^;mmcmaVGNs1R@{MKH%el|MDrF|DyYKx}!Ff|FZq? zg8#VvwASZG52&`|vimit!y#ZdkKbs=EwXzRulSH>xIhjX%<_}0-37IayzXmk z$g>t61y<-bqgYd{FiC)<_SpI(;v7#*raE6bpQao1N$7VI zc*qMTqNF{x+*c^rg{l=T1St*2u*^zzIMc=NwBks1Orqy8Uw=LN1w8)M;H#3M#!aV4 z3vmj(Rshm@%WQuh$a`%2jSzq-l7IVo^rI6!1VE7XiB$ zS}i0uFs`!ds)t1-5@t-ovl+ykz@n9+Q~WsSShi?#uu$Bn-BmW(H)GdCC!gO#Dg)6K zQ|_kY zUA@-32T|NJE3+_KdAR~^9CDGgaj}|&*e|Ga7ZuhfS@ycR|{LEP-L1hi0hH0z#QI+47vtT_@5#!@YZlj{(VEvLtJ zt!+mNTNz1pvW$3fW?|BiVwC^yC3{t~)D7(;w(C#F#{*+~2E@Vg^2_71lbvp}iRN>M z`1sZOt6Uc)5`K4M-*p2mJv5iQjL-w5xe-5W#p*U`?z-kJclA@V&%k5+Vd=nT;1RtD zl4dGdz+8dIIGz3jL=qBJQuit0Lv|jE3{_2oL{xvFlvpXp!T?gMMZ$6TXfY`b9V4j! zZ9hvDW=O%*h5=9RX6kmb6&Y*{U~ai;R_eyvTTerMCKX&98rAs^de(7RC=w?>tW{vo zEtCe6P>sq^CSt`TbhNtBsW%n%IAJhZQqOQ0@+*N5CMmeP-oNYWjAOkcVv*i#T-|EYp~UDm+ik)@n^Ta z$VtTB6pC``NB%Z=slJ_^i&%e>0YC73yNjJ$SQ-eEKqLr+&pMEmm&eU^vdUA4kCMMa z48yScWg)nGywlw8{hF>z{K=p3k0C+V*Z)2^KH`De4^tPvlu5r1I!P4b74kv4eZNpT zqA4Ug)HAktR19LmL<#&`dLL>eOIAJ-aR^+XsnlQ&W+tog9HTKCB5970x3ti@3flbO zb;$&UR6nNJ8=C)ug$UeE7BK|zO+?$3R*s6e^C)0Sije&2uPadNUwPENA2=vo<5ON0a73iIE*2N>KO*Zs8% z>Ly@|tp4x8U$uV&iL6*!S>Y29Sgh@=Yxs2+Si4R(`pje>uX#bggZy>W%$3#D&RVxp zbMvr$1VoFH@E4HI?N6fFnk?>D&s&;=U_l~cC_zIkHbhYg%7NAmjb-wh7A}7PR}2&4 z8AY?yaoJf}yEh3h9`5e_6np3imGgP*y=Y%FWFO8}yBRsp%`LpJ6uot2mV&dyQ1GA5 zSUV=C#2gVbi4)4o%Ok&-Hi>BzFRichvGL_4Wg=V3rEhx_={FEMI$LT(=`-O6lCsq2 zi?>M-etAASz07j*barlJ!p4!^Q|CmaT=gppQLyjO9eP`R+N-T9);n?a=v{1Vo3q5%7Ohuat_;=mjK`>Q3nTu^_gSm zyHi_(B7Apr-r{%paJlo4d+Gn_v(p9gL3{Ft>3*$ieZP3@ex32ybUOrNi3Ar(EObAq zOkw-*el!W^3AhQx-=jTVqMaN|=|7F`@txsLx>qQ&Mh2Udf z+iSPaMHd*I@9sT(0Q?;(}*wfL>eZon1XtRFs`+O zwkObHEL^qu=0a7&q_i|kFG<5=2RUu}1Vh#OQ;E0yLdRDgG+dcRWx&s}W1{V$H=m)kSUWErQ3sQ2QB%gmQGmWGM> zO|lz)>@-+>7Orl8c1b;98J6LDB%kfu1#7ttj5SD zSBV^*`0esb=@oE@5zqr8-i-4yGjp@DoF;iqjxy7d{-j*9g1x;4`4(r_&r=U7@jDVmNV46gkdZu= zxSC(PDOYfcL4n_{k&X4SJBr?w8~s^^tG6XVeUpFahb)K zRmR!p`s2p8nHRj!wkw>O>TNs|pKiGRwz2cpSX1HUI*R8bz*+z}e`pwQ^e&#A)8`l9 z3Njrg+RXO=vp7e*veYWd@YJUE7{AP*o3oPTT@1S#YBdm!r>2&w^8G4D*wQ_BAr5Zt zp1=auAycxAbrp+yz;6ULl#6Z4->r71r@oE9kJOeB?ehHpElt(^0M|;C#d1+2@kFaF zpWtOO=}c+uTMJR}vK{Vc7Z?Av2B;SNL)MqRbvT1!?6d^TJf6{kMBi;s#ucNsp5~iV z>9q{$x>!KpIHz2W`)NCjNKPtAa+e-1*3WNR^FPkjPmK(X)YP(n;wC_nf6XL@pKIs* zP8i9ojr)7?J}9Y)u*1j2Q1##Hsr4*5wNFtb;9;!g_?9|n#j`rBXhKoY-3nh{N|P5vJnyUu^S>x zwu3VbRIslZxETPTz-2C|a(eS{y9|RsfMjv}o4K9@+vYrhSAVBd^MCoax)2 z_2GzQHFPSgviaY)e0uo!di=@pB-Upq4z}Na$158O-65w7JoVntYanDQV$X1 z5jQBU2}V3zxR1T;@2lAP=&9RjDJi94CO6)&-!`(13{zKsv$J=bdMXEL_rq(1?|XbD zQSJ+#WaCrO)`o+XnHJ96OT4Qd#AqxXArTf36y%*3)>ZenS;i`-;osutSYG~?l9sc` z4qj`3A9InO>C3^%>1OQc`q{m;K+H+O?f00ST}HK8qG>@q#NHEN^L@O%;5-y)6y4 zhJqjwX?}sk51GFyD8)5%EOY#Mq{`=E`|)_b-HlbMW+^v58#=`N1zcfp*yc*aJPpl` zxKIYW`&1;Zyt+^DVtg1)X1l+o|xcS z=I2u!i+uU8ETYRfMb{o^zIujWdcbgTrVPFRuv9X@loGr=?TS z3bS`qsZ8_(df&7iKE)P5p9N;tK-=c1A20W-i9)<4_ts6kkm|;c1tT~JO0fxwii%V1 zetum79rva-iUAJ!=tz_6)PI3U$UqdG&EH^Q#0+04AHR2qu1K2imcct$%o4M_ zU>A`K6Un#vzCd$4l3;i-={2YuV~@w53-BS9>wHKUUuY|{jFR5Z&vTVp%=4S%DuDw< zzpB&`L-m=c6$mq^D);OzkFv6I?!EP+t7rI#5d6x?XnX|E&ugNK6cly&*4J5KTB*v+ zzw)qKL^v5|A)aMpj>G z^0PGEETYL8;4cf+U>oZEQ61%`sil!$IZ>X39tddE&O_LPr8S3*kYfBUM7E(Q5(SoAKsGmQf%!+a#1M&Rr%SE+@t zwDNO=NH9p1y?hkhI%acGDjIWITSwfA**#H55iqO#u|aZJ$igP1|$cwF`Y<2^3h8h`6J8NirhRM5Hbmu zs-^mm3Ga&zP)6()#5NsK9HM@? zCJUQBj`A1fMWEXaMY%bCygYWz8?`~5yu(dSMx6m3cS@=hMKJ7nCdp*D-%HY#Uo-`- zo-KVvKq(5mvv6xj730-#jL=t48-oxp8f8N-InF2o(CFQzqZhZ(JYy1B4vaM~> zcCM`J{}ymp@WeU{G3>-z64e$r2{l>QjwEd9M@cXCFHj0V$hu-WST@4~(3sR4MB!3E z;DA)48VbV;?x#8ANS(j-FR~+x6k||m4bD9SKSnUt|7j#cO zWJ0bPCX>ZOhKUWU$R&d{98DL0Sy6<`w~zZFOw3w~Jla&+KZYSaV2*(L;89<}?m;_=V9N{aUZKGCw`tn=QJ4Q<4PxEb zIOuuA7iIO~vsikF5#MF%KhJ^yK^T|hboGYD*)MC`$6UHTV?iFM9Z#EZ0NwGKlr7(VwI zvQa=n$Z5`K+)KL?a$f=_$=LG<#XHE@giHen^_D{v0#LXk4~G~lc0?#riI*Y9o>o0@ zIP7adjNFsr5rcYWiF5kIl;)7pEq1K0_f6vX60$W~dBw7ob1M-R)o#j5{w01Ii~h(} znV~5Rqm&$)&;yc3#noj!=yt_}M6ODr>Ki?&Eg`t2%MOC@ znloQxM)G6Bpp=v%338eiM1-ZWF%+Rv&)eotJLchXV{0gW-kKvZPjw~$vw>Rs;Eq$^ zVxA=#cHk2&Bs1`dpgXE5A;f5s(zKN9-&C~1L0l)zj-h^+?0Z}wfBmRr1!`XD*d>?ro3 z%Ai<+8q580SIMYYJzGr3S_p)HKEIsEX;eYRnZ|3lfNBDB!UBMz(z@=t?$w#|8X?8Y&O}Y|FTW-ql1u!`IyWBjScJL!&0b{nSN3UHx1k;)D{~p?(Rh~%CR5U+m zpermLJ8Yx zUPTbOYCAhEY^{JAZcYqts}{TUw?IQY(>8q*+z%Nw^Fc3e^mKJx#G_ks9Jn4!hFGlb z4z>A92+DC(94=gJke|#yXb5`5f0^Gg+u_x*DUxr1*0c$@(YLLO6Sh=NRMEi*4oZa7I>l%NBE-! z5gGb!_1XiWpDWObwAJ&pnX8R|msscfV7i_x;otzDU zLPk7K{oEwqqlEVg+H-f>3%EF|mH#sJCl9vtNw4tiuCtu(Z)r?NM1iX*)ZSqEYL~^z z#@o-k#{j)=3lw(km{)(6b9z7>Ep^%*eKoLVkDYnhsp#njL~yjpc5gexUam@TBP@^n z#ljrl{wL3BuXGZD`z!(NHJOn%{~em4p5t}&u2Uxb15NP80x)KRlf;;4Xt}2=4Cg5Zv9}-Q5Wq z+#$F_aCd@BAOV8AyURCu-n-WQ-90_s)zzm??Y+-FJESq@P;-Qmp*=GSnEwqq+K$n< zMVIWVB(yQ1s=B9=>sM6NHP?$T#)RdSgsJ{MeIJhr#DcoZ&wqQL_Qg>D-t{Hq-JAr6 zwHolL{`$&0QhDSl=S|)D-%8Sv#*9)xTOG)R`YNgm!|Trj0f;Y|MRz`*bTf)v zA5AgVom~pyW>Ne+4ydeserc&a?mk(nl==`!7jOwOs8V%*2HgNTb&__+R3I)T*Yt@< zlxmB-(n+fn+4JT?w)>!cH*mp$!f3q6pWe*{4Btjs-5bHl5pPf=ti1`nkG58xbe=8s z9~iEvxG`Rwv<5gY>jK|EnBBEMW0Ffwo3e0T*Eil~@L)P*Mw_fsZasnj-MX`Wu`}8% z*7$}0(f9P^WL5Lwle`-*a|Qv5;l2B!E%skRf`T0fHAJq0ds?T3B`FmMcJNmkM7g4g ze~att2;0wMZ_z3Lzyw3`(o5E5CcV-j^(VP4kjUt4vMrVn6fLi=~tgJ@GfhbVTN=%2AR&A!rRoeicmf##DE&+*K z_0T2A1Z_F*_QzCZKy-fxywOz}a32NQ5GtL)U7jVwN6&imISpyWiM7HZR z)u&H)x3_8+98X?;lhu_6rJo1|T_!8$>5hs%gb&sR zvzK)oUT&5~duwb3eP|3tEXl{SyvB)rWO72%4G?r5eWR%WjgYtj-wf!BcrwNiEU#Wyhlh-8G&sEEP&;lkX}n2uO6O03*Y2~ey6DadRu z?a+WG^wz{ayy9cl333+*u9yc%s|6*r9}38YGy&S=>gZFDxCIO~5V_I8`I0=m8V>Re zR_Irza&Cy^3%JJGc)(kAq+-1>A#6zRQlJkMAvD5?R>?h7kyIk=z<1y0LMmxA=c8^S zUTRBO2vpK!eMT?CH~?16#2E3FjOzI`thBDE8bImu5~0QZp-CHCkZ{`~SV3ttzVi!8 zC8!7VWy2X=8#`Nz-^GcLY+uKtgY?$ZlQ>Lt@7I%-HFeh9TOlmm^#R;Z~P zvl#~1u9O17B*KxfP~DgGGfq@96UG%*g|0gD}RrmY|} zJ_OeUJj}DaX5Y#_Da(UZ79lL%!N5%RZ#b<^BDhfHL4I<>I7YCTR6?B)Cc$HKbxiA0 zJ3)wWv))#@9sD-2zU)|$9vs7Pp}M^rB-*bM*klnMcS<24o0#2>+K-)!K5QbP+F)jlsE%on-mlOm(M? zSDfZ7ax)y2k|3K|2R&|H*AIu1zVZtu<4{Cym!KUMK-446dh+q=!ai50nki{= zAYB=uP>znKr|G#!8|d&4%+Fe77;O>a224Zf!HGxhE+ZgZlVR^|yZQS1N)X4v%RI^~ z&CV)u`$}%W3a|+P29f_xFPoGw#enlhRR0J3(iJ+}{5)~g`qF}EGaN}$y z{G$5$`nERc1zN^=j6%*3pel@ZCZ%FqY<+bcK<3)qqV!_rhozAb9M&9exu>vWyP>c( z5Ed3pn<(RG7^R{UtMDXQ))#i+#7ZPN)6uc2FXq@v4p5e-Txa`7zCeBI;=c^Q15(!w zZgIOGt0^lho2nve1JslupW!jE@YE>?ba+(34G>?qI|izZsY>Ceoo9=T6(&=x*8r1!gF8Da|rRyg$M~Y z7H5AiD*2Jq)m0TgSm|Al&02j?1@OOhb23nhtQ_U!q~12y)_yH1nFJe6_`LRKT_=a_ zG_a*iFAhq@{+yY6k*HKt_UWgilVOpveABU%)08pr(A#d1DP#If_W?G1St_Oux37M1 znoJVt^z8U*e1R@v>3DT`qJ)-?fwJ1!FjZ_lwZuhCNhE8(W+dx^Eh)P?cCM! zOFnnfuG7;=<%CJX=hKbA#3{JSe(H6)AuBoeqc6N|Y-BHS81t&zCavd!q%Zp_^K34z zuKtxmpD6@bSgzEZ?eD(3=7tV733{8j_!+s8-;b@gg{4;Cifa|IEjSpn8afuLdvA|ode<<-Nl00TBJ)e{mEOQ#N z_S^vHiIuJ`E{=?9O3TuH%X@7L1yO7@1^BbGZB`ssFP*iCw!lo- z|0O%MCWKM_NmTwVKZXN@jw%nsL^2JuOY-|fgi6+fzTx@b3nN%{P^LhN;8StC4+}KA z5C0|#l;r~^=a<;_oYi$}DI4f6uN{S|{c+u`nIhKTc%F|PkCxHhSX)|LWaZ~pQCGj4 zkJ%uW;cfTasI8QPN$FA2wDfh>{{h6)BAs{w@UHXdnPphMuNlAB2XK&yd z8`r|xQtw+l*Y*x(W0PXp=tv%&(3ym!T6=G&wUd|8N3A}G0&*JssIcl=!(+zEdCy}p zOL1}W0Qc;D&r>7D>`cy2x93~?Y|i145q0(D^9^uGMp^gk&l?$<@gr;R=+Oit2xTl9 zj;k`J|4|dznAFDcEF%w@aJ_Zm zU^&@z$MV%dOU>0)OC%P>F7Keb)+;a$(CkDVbbfU8cs+X@{zQResq5=+tGisQ!1P5H z@@2?NSIXDh+uvqh8HrD;mT;}z-DaTM;n(rFwx)$g#KKWlRx=@gTW@=JaYgs)Sz|g@ zuC2rQlq|1BZYB*)cbo6c#9&ITY2<@RxRR=RZd#_^#+rt<3Lnc^>i9~c=Et!m8>8mw zmY6{ITO`VP!rxBIF<#$yHw)e6%i+eKJTLOH^IMByVM#O(Vg9T_7pF#smdl4jh$kAl zHA^LrsbF#X$)lNvWDFu3h0Y;BLxL3dLKc+%_NRn3Hr`{7cOHwFuqdcuXzYx+5qc_^8kTHEnG&1tpj!+8HO^)*OvI5;M z1OtWha$KwqxkV)IUR=H$uyeFLp!9KP93SCD#|prX3$`YATnL*h9H|MXAAOG3W2!OW zIdc-cIjtj%@hBv%t8MA%YS-56u8_ft0j0Neb&N2g;rkwwyaRWp@78uRmOF`*s0_8^8NQ zJ1Ny?rUYolZ5*bxwM!#K?9jwbc<_MziL_HwD><&~O_q$5BP3x{$2qQsU0x&G$!-dY zf?W@%!!hSyC1Y1Ttq!R2Wi7Ex5>C@8hqnqhiV>uV-69!uH@cj9`gTx9hy~aWu8DZv zO1^(L_t5w$D|h9!cSon$spbaUyWHAg$6b&$(k?%Fxzh@^s}71OrKjch2!a~61CD~ziX}PaK z;9ol1gX^2Wjn$8@(JU|gF@lSKl+-kq`Pgw%{iCm5uA5vf{GQ`%Tgoq00yT9%cGnu- z*deHhWukcM2>^<=sz2oT-@Gr}UEJYT!P-`^jN3pC1RN=gFC@ApfWu7N0svbTUz+=; zJ>tfi9P(H9YM4ZrXE~IAT z*RxBOH5(r$H^qSo)>^2Qu1z>XBgF-rY__-+Rcs5K;i(H7tE*=zufYX&4RQVQbN=hk z_lji`Tb_KD-Ib$9Ru_i@myDf%6^MwmP+*Tho%4UzSy(ut|E!#88cjZS#kelbE&Yky zH7?=nMp;>cgARrKbCx6d;mK{+lgP=+$;-=MbR7KkzLaK_-UldvIhO+ttkTM=Zjr7X zt(^%iRQoxmrZ`w#Rb^m8UYq=fr-u=FW@cWq0#BkwV4x6@bFzTGzCJV7Z0=J70ybmJ z1FVMBWNgztJW`t#3{N?qg(Vs*_adJ~_COn_AU~_k4`Ckc{MD0`=VxG9S($NuA&k0u zZeD|kTxnSj|6jxxBgnLG&JZa+UIm?Xo*A55{H}lh{%yp#^(7R%>dZ}Ej&?ETOg3to zI8STQC>Id*^?dgQ_CXT&C`c&9^7b_)DfI-;K9Q8YxZl|LIL_4fYNzjc z(n(@|(jY$Y?sVe;CB?!0C{2pm^=h-Scw238Ts>@7WHQ9u_au(WV!?$jDJmEQ*()=- zQ|avb>LmjUPatxa1-6FScCU)^vQF0xU0+O$oq8-8?z|kdz@mzVr9Bl`zSU9-aO{cq zwx$WtudAZJd*bh0Ujs*zc^;+(F9V6zlgTz=Ka*% z@5Oc{@wa_nJK-0!G}~$WjKgB6BSx-2y%XelYxdph8Fn#^1VeoLd&zj%vZcc+s?D`| zkP^Nd^{(g+r)Ww@YS2#;0#nRQfe06qD3i0TDBe#Sx=pR+Xq4%6uErQsN*d;2C7pu~ z!wen%0gFW+KQar9M(Q>Q3;g6>pNi9m}45i-rVWDBfIrH(d^TJM0+aHFy4 zptikc=zKCtq#Mr3dTJl63+y6~DV9Ih~J|l`S33zle9ia+H{UxY?StF1zD$hBvEHP1j zpxE*s!hPpqiP9WYTAsC0CzICTtiH6FgylWJxqn9!pbl;pAUIBE9sK7Ho=kF|b;EDU zZ-Qdb$e}&(xi@!?Z}DgMGaMh6AHPBwkA3BVW7-7~rO&YjFiz)jB2$}O^6q^~CUXm3 z!%R_YkLk3a&me1b`7c-(bOSYx>_84W zYCnBEsvB}oczU{>AeHYQB@Lw{_|&O6?3m0BnW3QH(OuYn+ZxOS0XU-1^uLEn#%|4n z9}XHql-uBVV)>4`B$GaKJ6cCS!!LI!<`Xh=#|sr54;{QD>-B{JC1CkmtzIySgazFek|GX|a4sI?G${l- z;E6Sy8217DO_h>94r}-YN{xvlQTad~{)^XIwPf~u;FA6pd{bm-&?UxHpWh$@$qs}} zjM`koq)N61llpL%34wW;Z)i#^li!UyIp?wTDvZ8b2)8SlgV6Ixur~7+%b_ufOBe~t zuX<&fQo=>d1R@%2IDEK7s^Pt7BEbw25=2$4Ar86Z#L08^7 zBmM?r4Y6^Jkz|PC%lxmb0ldLxe1S`zU7{0pnqmv1z{8>@oP^``D|mJvFP2+J`!iRB zsz=B8C6_uDb6W^qOPs}_F8NYD1ZO)7ulNz->b+&4(XZObLoe zJ74BChvDwkaG$ zF^i*2+Kry@fF!DVmSBV)!BqY$SY<$W{ag?a5dIBoMtIqv+XwfRJZ3Mr+__#JjRU0? z(W~I!Ikx>^B?5#xIs=9T76~T!*~~-Aot^Z-XA~`CfCYj^OFf%>KxOeOWnhE^2#69H z8V{&jmIIhCa<>r|%+v&28X|r*L61Yw#0CLtgq}tI;YDuxJ+2TO=wihMlIX)yM0SMS zxr!j5lQALl9Ehd(5pCTnKr~muG2(~q0^XsLczYT_sXcopS2|s;%mNZjJ4FKP zb1xC#`{hHN6!Yl(yK~j1$5^)U}<7dK{&ArAo!aRNPjN6|Eh9xL-(c5e*vF~6w?rileqE5Hg^U z1S8=>gY@r%Ac-wZW8k8<0V2&lbxiyFYoL#D-hb*4x@#RfLL}trc7A4*eZm`n6_&E! zkkJazj0Wz5d7;zu}&e_wT44|zObg{MAFE~eV5l9tW}d}X8p>KOWoE@Oz$zJr@BjRp2u zJ_tG@G3fp&)G-Obg424yq&)xx z+;-ErweO%7q|!Q8A32;Bxi#5=$TIHw$<6jA_}(IlrTnTWoJ`sIce=BB{~!fC7^dKv z2EL^>90K5dCd5a%H+br7n*w?_E}Xc%Zu)kvK#Sn}@Cs`E2`1SB$XI;v{{1~C%49B} z4Y3;9hT@qWLr1n81q;D5YRXW-1lBp0fPxo@#x-mb#$J>n1s#DGHtKZ5k7Qd0_gxpo z9My2BU*1hFObJ}x?G=UC@E9T3Mnz5gj@b_}iYy2Ig2>m*5OopM9FDxZUP@Cbtvx(& zMj(YWjL2)ghshV#wzU;QxDgW+fe`p-`kra{#W6n=$Qv>{ zXrJ{TC4*ikQR}wI;GT=x+QeJU;X`;>7mXm%%*^5lQ;5lVpQ|%homyF+jx?OMKcL_d z8z{lV1&m(nMNvdNwaE@?*FVPXA38F3#~24tUlxVT?Fk|_dg-$gycgbz0}U|wiL*qB zYnOZOD-EL$$FrneNw|r9bwVZ%_EsLkEV;@SkjI!6#`=S~_|%4kb`UNO&cml}gW1!p z3B?69z`hrkppW3dqz$!rj7dRF6}DjR>SiV@x*O!ADVsMUD`w zM``^EAP8e$3=cg-ftbxV#N;O>xuMZWv73kK~7JT1qCUCn8hNxL4M&^Vhjyvf(o6MFpBJ3h@qYm zBmTSB<0d3xU>LAK7dXC;y6+Pw#S^a=vcBBZ!xzfX|ebs^_-AeM=_MGZz*!$6jISx+6fBqDr zfC+6pYV{9 zXky1@=2Qj6k*h$NlwfIp{c1A-XW^=(3$IiKFQg`+jMXgo+E_WsMF5)^WTgsukH!N{ zRAhM7?t{tnrWL%19<#d)KzNQyOz73okUh;TQh~`LNDO>AmCas2yc0{KmMAw&%uuH! zR#6)sojI0Z5)PbCj4wC^#6Qx=n|@kk53jK==eorkUc?$xlGz*Q4^o*>dky+YL|Z;q z6tw7$rGR3US{|H;@&k9&v5i*z0fR%bLg@javNEo@Ka@b3@%fIZvK(y>xcAKr)$CX& z=$QkK_5%Zhg*=jWA7##xjJf<#S?)Fm-7ae&7FLZjqxkQ!Kd>@YjrujY<`5AYMFNo= zPW(Q!wi3i#5eTcVa8dL~%wVADo%z=;eNL#uSLy_d4&|2=mHArEREN2J!Vv&rXA6Ax(xuRIA z$dXHgVx8!`jl`6`XnhRWTH*H zA>w1n((zqZ?~#nKAtPe0`GR20v=OHK3u%kDjqEjz3-4cAtFAX!n@B* z*EGU%q#6BiYi8$izqf@HnmQlj{_{skX!1e!eVn^Y9Pi%OpNI&V;mm*5Kt(P!qi1AS z6Cf*mHUFxx3OEE*mOdw9r=l!yP60DEIrh{%o|_l+b@a;1gI!_pOjQ|Eq0*r5NU``x zRWD|ba8cTcm2h@zZs#R3SamsjOG%Mr5{Du3#qWQVKD9AHm&6{hDyJ)GO3^nV@amxbkm^RmZr$a_8uo=`#}o+Zj5v}K5VPJ2 zjwnDcBy)oNI-oy(@h}LMBRE}T0I9|Grbqh4dc9a|2>r&ElSd%apg<_hslP`eZmy@r z>|X;id%o{w$MCdW^h*){ZS(kbqI=Jd#9L@z8OV8b_?3gn!QIqK1rUjP>Sa1=P&Vps zw$YC-|2ZFrrPIx{I8U%t1Gx{_02ZmW+G$gcG+Of z=s_0jhP2vx#*5J;L`H_VgKvSEr95OHinWZ*9y!M@X)j_*Wbw1KG-CV+ep0XI%$_qF znSuzy4I5*;hn5FjVmps zl39KumNGC{|1Ot4ox{JxZv@uo=DB*8mPzqDbhmVMmA1UUwzC&-)~y>aAnbFZkNY?b(vAHObJI}&;+CTyba{%>iZndwhQH?1lalst2HX0Y zAyj2*Xz2u8IU^g(o@ME(8rhl{vGVJJ09_V%ig+#0s5>;Mlk%SAzDzypLv$wA1xg&0irc(OW-{V@|sU+Qj${tm>64Prp(` zKG;_3B@%NnpG}PM^87Z?+~B9NK0cpf+Rx+l-cqsGHwO!%45@ju_0@k--6#(ws(D{c zUM8AaxbVMQ*}3}sKSO zUlR@77#)2q&cAU~F<&ag-{msZ`nXQmR$^U05nVZF(&7l31yW>&caz1OfW1uhP2xf| zU_XsV7BUEYHl1X(%Xd#t(^qQnLh(AWB>;od9WN1lzFACZSkqHKcPKEsyK5+l0pGBZ z9TKkeATX@5X+d_jw#8@Vbf!tped50{&9Y&CHD%JgY2ezz%fS0ofgyJtekGURv>;Co ziEp1CmNdCe1<)ueo`oIt0|EkMBpxn@f*32bGmlgayeB4@j5uL*jV=7#4}RwiJ}sTU z)zp0J_W#O3m+xWSKT;`&?d}d{jW`dkIeuxTrgHVxU*W;u@S_#{4f6MW7>lv|FPNC^LDJ0UVHHU`(le5 zO~7&zg_P?2SFYxG`Drc1z5F|w^S`UDE4c=4G8=2R4LjD|`Zc+O#l@zfWjEK>3D9q{ zu^#0QBHc|+i?7+z2H29nAfv*dy2~-qQ`sR0%h2Ynk-YJ-0Vesw9y=Ta)>`B zJ}yqL%d4TTSMC~ESt(cO(1fxo{1G*Ca709iPkhX0=;km&qluN@t)$0mpI=c?slK1z zD~2Q>l$Dh=0Bt*)7Gh0E&+Cc?Ckr{Oo0yW8sjZ}=gP=giz(CWk<#oAP+dpUhdj^eG zv4)i9qh;C9=G^Ygj$rL}ene!Idop$5$$HP6gJyhmHF6|*J3;zTI}2(r|FW+D?sV)%*d+*$E`-J~HQ-hFsz=xhAsmArf_%B;J|sc`03ktL3gwv6b&_Oq+T)@Mic|ZDL+Fq0o^E z_8(WbkJ{Zhc1K}H8|vw48Y`=_Aa%zdU&~5MfBn)V=69;DYWm*oJ9&^#$JE|zIYSHr zmfwf_)2{Tc1C0}69Jf-}egCu8pARFs(V}eB@Nb9hX!dHi zYwhn{N`*T^-h3{HY#CX>^}j01ESqZVAN#nPgQNkbH%nk$5Mz&8W_DUVxZ!~+%s~l+ zHa0He_2+#`g>MUAO3zl>&ua96IbVo~ODcx#-Z!;FkH1Z?GL3hP=7e#E-C-{R zb?DP>4rbE7>4(rb?N4UL#2{#whPsz2=F)a4Eei3w6dw9%XpAi8^mZ2xuo^pFoKiEi zhe0NV7bpy?YQfw*55O##(1S6j6-GLP39FgXbi=G4Uwqf**K!8W@(`gHtzQ;b+zGne z)FKR!3zF1tdhf4&w3nBK?&LKu#%7hIB>Z1us{$x&pGV^97#OV=5b4SUj)e_B+E2|0 zSj%BNy6$b{bWJzf-hLo61y8ZExHOcodtB(MGG6rkPIR5-<6mLnWX;Ogl{dtJ50B{N z3wWAz4d8fO&3}J+99nx~i^iRc$ z(u{OW?j5XJc=gB7Vv2$GgYV~-i{CryP~Rnn_sp4BA|_~M6NsbjFRUsZk6TvDSoFZ$ z>9c=E_hETrxxQp`V7HLb1UTz6XjAe!n*Y?hVW{M^KM)=Z2i4uxg*9}XHPU2xef=f3 zWoFXdZ4nt+;ohw^U%(fqh3TkL=|UPb^gljmA|9~LQ(&spSk~NDUw)})Y`oQeBT+V! z$D`@>zShnLsHJs+4R|l)oHJVh{K=V!>6oJt~!&LLe~Rr5122#EZm6s7B{eM;^kR-^Sgkz4Ndn ziV)`BU&}bepurtgQkK}F6_u0mP9VeAdz7nIBr@|Zo@BVE>(g61oJes&C}X&w(STLJ zAYgMg+lz>_Uq3g zG9MaxYr@T5O5dzwaPQiya81Ji^95U7gMg=DO+$b01+W*Y@7pg;1MlIz;et;nY{D`e z<3|}GS(OGt*2ObBcfR#nB!u|R?Ps%Ahg+ahw}a|cmg1;@Esx1($~wcjGWwLZa427Y zjJSA~)l~cWn0NCA6!1E>kbqfT+h^T652?^QFT}iiH`VThnaJOy zCDqP~vxRyCvmq9AybDNjg&+yGTzxe}_~^785b|GMn7F>Bw;{-sS^!s-5c|IBSN#%bY6xQ33oK)zxP>Mv!lk)lS{QEE`HS%*#yMW*W|VeCgK zG6gdH>`~5GlbZv_5{2o7M)J_(p_xI`MZlv14q?kK>(rvMj@xFf;^H~C9#~n#!po{2 z_-vv8W0KjXK ztVw+l71>|R8{RCL<}M{#`R6PUbaeP)OoaG0j^nnnn}-bDPy;Ju6B^6isF| z8Y{JVq3#&cr(u&ViZiU7FtqM!Ia$QMVW-lnTh@3lUC6-K>J>NP0KRU z=mGu!=wvd3bO=CHKU%JR5HMHCjkeLVKXi^n_=tKgG0qB$OFE5RTds&AG^|+y7?IEV z1xD46G>ZO6HpoDDb6%;txQx_s6MlB0h*}Um+Bx8-6gv4n!Oa~{v5UBb^PAL_AV2|7 zARj#XgfO$9pYi?Nc~F0=~C|0_+JN-l{?DOopma?J)bkuSjs#)(cGCRH!) zPfAnp6YJtPgX8@hO#r#Zm>jB`5&}sR(vK#=Y{oiVg29ID0hQzeM=pc~11M|bAZ2al zt~#|OjsXo{kd~Vd+gY>IP5Hz+DKK>IP6y9|Fs4P3#tB*Lc!H8TWXMq8EMwWK2Nw;8 z?0-|N)svE8!rkq8J5(??rL>h)7SOJodm2cu1c+UY4p1%qAT zOt`Bepp{u}w6N%6%tOXF{j)h^{;?p@w&QF-eltDn+1z0<$;Tx^e^47oC?ko(Cc5e2 z>!!KY_x`?}^vke@k|MS_r%X+H-6$y3galE1YCnl9z62-C$OHWr+YO#tJ3>$l@CW>7 zGCjyVRhZoRS&B!B4BTN>5JadYnR6bL66yd+ilJ9VN^ipuL_#?b-G~_ziN`pG1_z54 zB@@>eUy3UnPRWz=0%^w2id&fs!GU{-5PClajQ9h%LaorZ81YkZDgF@*pK7Id3icu& zu2vCB6!)wBK1FRx=Y4;SR}bK}3Lu16J#46GD>OC_XvRi5Wubve;`M!M8#KjS2+x0C zV2Ce_fW}OhN-%jc6{*6T5~x$Ws8;ZnhnC+Vy|#xT)=(Ig4tWRJNM@U*vSV<}oA<(T zMC{bl76OXGo9ia^G@LA z+yo=`+ifYv`#vgIygOhELk&7$k>E(jdYy8tUfFCK{0Ezc*fuybv(>;19i+sUWy})v zkfRrT`vw;QHJ>6O0)JdtKrrcMf+V7qrsU>xC|8S)j{~;@ffXtZoZ2j#lk@xjjTM&Y z`-T_!(~zVLoDk!+Dl0joo~$SwW`gN(Bz_pZNwHtD*-x@jv;f#|;l)x7^!*BPy=!LG z5L9jLG6WkE6tKfPtI|8*)ho;G7-SrY_1TY(bl)zBy2Nq-5#ecgkhO!$MENuG+NGI% z&ZF&oxSTW0Tohvn%L@W*-q_$OK$7$g_}C@_@%Xf`crU_av!{zld3I_8+urU`Hs-hElD) zdK>C{dsJcTTU}4NzJrE_{#WUwY6m|h)~qvGC}sn`>q7x{Dv}7?*$@{GxExf4M}8;< zl_WX&>#8M(ylR&|m$B4p&~pmTk`<%$(w4o6(bBYV86*(12flJVWb)>7rW^reCv! z|6ZKtF3gTFp)-n*Mn>K?SAkoDIsurH@-{NNeez>Q0q^(e0j;Yg{!NmU#%$_v7 zqA95V6DVi(f_bQbZ%Ld460zc7f{mcm8T=q;9()(%8IE-I6KHW@1}`bBaD6WKpD|Dj zf1(wbNczYH07|%?=kuqvc3GTx_KG9Nwxyo`+z?*{jJFfgKXs4wrnQmiz1P9Sssyf1 z(m&DeBsa)!e>3Z`*U=nUMKDV^Vih0zv7LKuNTiwM;m_6rN6$a+uiJI^=-gUu*Kh^v$_RrWR{dbkg}Z2V6+;QYO4-Vsx6Dzu#THX_2!2cEtGO3XbPH5CJ!w z$pJjI7(U-gG5nDSc*flD$al|-T?~l#?8C)b>Bs%Bw_=^#r=_>a19utfsTXhc&LatU z*jcW0j3f_qM>r(8q~v8$H$gjlS=!nc0`Zdn{7U2{9 z6%ut}D+`ILZ!m`(7E*ixW|I1n$;4Fr84`t~AB*iX74(IlUI~;?*{6YnhNyv7C$f~A zLB<7&J?8NK05*gs2^IMO=*&3<=FbvnIaB~HDazh)(~eVP;(IpI*-HsHc1T4u2|J3I zBjd{&I720awzlv~Y4XrFCyEIZ6LcYdDuNJ@JeD48M#>+?hoH=-CmbWPOQ+f7Hk_Tl zRI&VL90k(Yd^_fBfJhR=o(p-OTi>meWMsa8{DE#tBqV|Zk2Oj>v;@i^sYDdU#zO8F z9jByx0f+^PespE{k!}dr7*Ir{el1;)D&+uupp zz8}y|0l#O6>x0K8Pg!%J!~0t;sQE+WA;OKH(SPRX;mmHauo*S7c*c{2c%wXd(j6(7FlT2P=fg zBGE7b1$obg&TogUEG|*RMB87bjHiCZlM!SCl239*msJ)oRFD5z9+^mOj*b6yD+EgX z7((>Vpm!F6MzKr>jmK2z6O9i+|sD6qM_!Pxvrxkq57Mvr%08$x>tS|2yBMy&^NqXd4E+?By z&7xg!gbxXAFogv!z=JtgY5RcjMnJuu#F_?Rt0{2{O#%|E%qb8Ywk+%Ow-JZ? z7}OJ$bd=-+?gs&VgKn4g`H%=r4O)-N)|YI;#_3I?c9(tO`L^q~%;<&mk#B_I`fD*Q zR8CkoIE4kw!a#ZDOXf$MoJk}hsjyh3QoyAv{iPGVg;Dw^(y?8vBpfvwU+&bSO91J% zM-n3MRji^YZ$eMPbdVBs^h}$`jLeNQ%UtXw~pcgt9~U{ld(Aa%nR3 zv-I2@tU9FZPw+B9Aw3sc2e)JN2@lw$I*Vjg|H#6dC3|jLbm(yq zefwZZW&QmH*4EbzoXE#4nt}t3j0&o%s%mO#+S~D*|7t?by+oh>Y2ixL?@WL-b7=X`iyd{45n_;h)FI(>P4_>`3gyF<~Y%|*o3@WWiO zAq&K&XJ^sGw{V^yb)_slu_>(a_9Y5 z+T5+649xMC7UJO@9^2J9T2^z0KExD3`>vC&dwYztQ^5vG`^k9 z2_e1-3y~6m8h)dA4hIL?z|Q+OBYYrZ`oslS&-o~3D5%Fh!>F(TYG?EGh&|zSYGzty zhKbuygCpOV2YT5AsZZr?CN@(IZ)0q8h#ANAf{aq3Amb|s%@ z_V%P3Il;dDaW(YE7b5!r*3z@_LF6hE+Su%xVv41y&aZ-3li8m9@294{ep}I&2EMoB z3PP_5>03`vj)qRYez&GAw=9}g>5tPaH1qENxy8xp$>9S_s+fPOdt0ouI1hHj9>}3w z1Xk5H3bL@Y9}WyJNJw<~a6&fWn|{ub7R$3TJ|PHLptVHRb2aZ1hag51F|NuFmFEnK z&XG0Kn}wXktD6+^KMH|EV9R(VZL~eb-%OKktB))G#qa83@q3SYci1G@ z0|(1YQ!IahhG8Fw+Ib3@^p*&L+bZ90)BK10#}`@*^x=8_5?_FiNRzqw$e1d8yw>_W zzHXaK(DmR>>{w&Oo)?@PH_N3Fc7i!lkRA=bhJg5|!rLU9wUfpW-)~EQ6T^oE-m;iM zR+k|p#tb{__cYz+RtOaM{)fR1ULqPlL>0N}W+O0alE7Dd z3ywU;L;DejIEY8VVgUxAVyxH$lYvQ$GvStkM;zqc*T?UaiGsS285sg24?l*47>yK8 zf;GDZM0McNB!p=_Wz7JJASwMGbb$zK6iP;h5($osz6_0o6k5h$b1FXq5-H0w3x&RI zqMO8#FFXW^V}bKSe*VKkD5$Jm)T5)jd&e64j}u(j_vi2)$6A}0k>j+wTHE*Mo41e zt)%^^1bTh{kUtzf%|AS|SZ+MG_*o2N6u?;~<`7@XObep-C|}Sf^GiKX2$}%DSzqYa zQ9vX(t7B%%K*4qE37^Q>XYiFDm+xojBR*dTuR?5#VKQ;408ME8)=TCjJs8ze{Q1|6 zYbzWyOorp&y}=pA4U>@KC#XMYkG9MdZGAiB-U5lHOF)R?UFYDO%LrNg7R z?JLrZ6#|>!Mu}z$U+&c$a$-3L7T{u#-~Vdqp+!*lLO%R${T z>f7CO4|poQ#s0|sa8+;}k2+6lCV98pv2^S?XbSZBD0A%i7||u^+A1YkdmMgoe4Y32 zeK72?PcLLMZbJR~=u0FbA@=|3!T+fVWjIl+f};#dw0&E;d^Vpr|}L{D6;OeKHAB*v|pMvThD&X$m;0&GI$zIG^btOeA9> zNK4eSlKjCl2QV@j+6Y%MPUH*Xgc^fpDq4^=4!BYFqsBq;^tI{H1LCjUE|6gp>enb? zs9UJvR|!Mq-n>;z=DuQ7Dn8V&qh!ISz*001zyE;tQAks$eC`gPShnY9!@p``-#53{ z9UUI@08fi|liKsw+~1zRs5}@>WP1ZohYkKdAN=^Yd3A{JzK}`&aF9vaF^p1it1ABhO>#lL?ad7b-m7&2*1`?2DFu}w|BHQI6){GLFq%0Ij^DTc-J^p>??#Nl~MyE~PVtzWK6jnSgJrVGc z0P>MbC1n-d!JBdG`x;&C#I(pOy$)|4XVR}}bA4(*UsH{}b|hEJ$0WZh)sCCR8hb={ zs}gUV%o+vxJ(62EL%Qx=f(%`8H&mL4nsz5x4R6Sk-Z~-+^itcGMc$%VW-*tbmhQ zqxzP%Ku9;9L4VQ*En3LEKHOF8JFOpPZP|eCoMv0IPUv?!20R7hdN*DUmjoYgS-k*R zj=CWdLSJU+x`-&(g!x*v9qvXWs#@u_^;?47fd{lxy@Uc$zrd5~8LuEm$#)%I!4%A!)Hr(jF< zy8bEX*T-b>AEA5yrM%$!Ft@vdeM1O7p#8B@Dy9&+XeUv?4zli(gz>_LCq~HPX4k0^ zHg2J4dN!}aZyn$(veUyR;1;OqNk84UPZhK^QjW@&Ps1+BhZi{!b69pDftVKHz#x=} zd#hDDYE7TGk4copLgNgsr-qICeDc(t;&n^ha(e3In$_?PLAGhEAwq(5kGNCo}>f!d?b8%`Iba zl|hO~7sK}!=Sbal{!x6SJz5Sok1E{Z{)0MQn}$#dS-xg7cv#D^OL({# z%2?`;9B60Fox?ssfEA%VVb3=>ohXA#DNl7i&v#~-2Q|>qg0-FaY4;I+15GlhrK8zM(fsXrNL#GtIIy~zhu|oE&IPDh=wLK!Pu!}K!hvsV;G%^ zQDSUdQ0({3;);jsqXb~Hs71UtHats$toMbXCA`IF*5SF(!o6@BQokVF;ku?*H$BBZ z2XLgn+R;c`wXBumo_@2}5HK8KIO>4Ho3D~Mev2pihI^~!j=pc|s6X=*UqFWNmtLAW zKC*q*PA}I&54Z@n$K<0%g-e4KoFmF9nUP64yO3f3wP zA_BQ?PNL(U9#_PSeqJ8P{B-~A>-Ng*>(t$AP*X>bWpu}@g-VY(5rXB14T(2m=fEqC z!snjB5h@s*0zu@s9w)IBIr9IDR~Z-th^eW2A9I_k zN;-mUx>~A}mLfpc0n`!N!(4iZX!{>|u$wnJ9H{bf)KsBFMB&K9Do*?{8)T#oRO>?q z9H64yFkhO((I%qQ%@~$X8iGH47HEit+K6jK@Rk}0${B>_`eU8xB^*!zi5P5e)*&rg z?w|8y&ldKo@pT*q$HS!daj1UQ$FR?0mvakFybDP@0KT?y5|hlegwqejd1i>)U-mX~ zzFBoHjN?d2?$&y$uy{i>j)mb|q5XMHc z8MUi$_daSL#4p&)#aIY0(;P*N9GVt?cGtrL=;UMZbrc(~r}s}A?bhff@xlvo$E}rE zaxF&^Pwtgr)$<*G$Xws~)PGnFT5;Dw@2@IVk$O%2VWI5$S29U8TS*Sr_v|@*-bH;mN6~ zU3WchM!!3#G(qr zRxl_HgTI=Ru|Zu?v3wx>?D4=KZPcIWkPILD2d}w6wG3<*nV3{W`w@+UHbzS*joodO zWpEPvI+{0#z6vCe75WD4L=-L8;d0_f-63IuCr-3e{D*{|;Ra412PuO+CyhX>m*sDVAbylFo14ns-C>4I z$iDFQK`5|wnMR>NPu?V;%hh7qMtr2keL5izjN6JYeQOaeLH^I%N)=~S<)*vmUfxQn z3~snTzVw;8ZsbtrtsDqyKwew2j_*p<+)e*JHYSg68B>*&oqzvuWT|!Y0A4+p{kvgY ztzwe0*3R;+uFL)Nnn(mVX(F!p%76W!i4X{PUH|+lzKFokzwa(+`Id4qs!-h`VC5~e~eV(14-{6-vmCekGquXlD`|xtJkq46y zDN~?EAH}HhrNw|7$Rii8V9Z=d$Z_qUY2A)mk}BwSvQzC`$klQ-^0GTyevUh`MB_KJ zV$(ttppwaEgpTNbX^<#&1^--_UD?umhShKSQN4T!LC3)8gzm@`Ni3ye?u7EdmcX>P zvqKKdof^g&jf!Fy7M?1$L1(KUkfgyRZU4pmf*u8<1|U*3+UF-H^d(>%2Sq7EZ?O;( zs23pi3^c{pR2ZS6`8i6~RFfPfHp@;=>Hh z`O1UU2=ifK=Vu}sDk_+Qg?lIz4KAEiteuqn7!0NM(1}$9MC2xq z4;?g@o(VRsy_*k00V7H_v>^e)ws+veIb-z<#>oPwyQtq&0&%a$Hl0()bJJe4_zGX! zW#r7O{R*FHZt#(r z>3+)5_s{pUoQ~48gB7X~73xyU!^3i`<3X3B6pgOG^mv#O-Rz?SzvMufdvWQ=9iU+i zZvtAZ$>`CYXehp2>p+*#1lccgFgu_K8jCjz%91cdz7FVRMOD#j-4I(XF zudx*h;SOC*?h)}by&LT5ME zCb@?u$~-(N@DYXzpMKz`hjH~M`D`97>y)9@DV<}LQ&z<8csHx+CmfzO?{1SY9U;Ir z!{Q|27R1#V0mG7CSL_!Y)d+eo`V+L%8QPye1XgwC_xn^SKS}A&3GC^8#VYR%4^8&>yim(7WU}{?KQ6~yDcI#+6@GwNQ)d8>)7y#>cm#%i z3D%O9rvDgOR>Z+gBd0~3ll2o_mw$E8mslR8OXNgYne}^Cz{=SrK|VtN26GrzBO^tA!}%)fuV3zh#oJ z_ft+x77rCg{jv(3L2UaOpH1S)%mfVa%ws9F*+=?-uY@WsEGt0mw=Aku|W&?xd;HcULNdp*oa{dM{%Ii{X^uC zK2xC@#VD8=gib?G3!R?#6;IJ|3)pgP47BBOm?<*+{UC4cxu zDUYjmp?zeT(}1TSXTz^7YA7{8d^|FqB8mGu#=T*xRZkN$6++O~WXkDP`7y!}!cpW)d>|KU97@mVK*u<9Kf3od-d zLC7Y{=nL$zx{{huOXeYUEG}oWR4xuDGCU)U4xt_+i82-k634J#B#5k&lwcn~WnrT% z#~Hp%*>KHF#naJ0Q5Zy&LIup&!PUq%kehn4WdEnj_uXaD>&KwCq2u>!jl%a#;&+Hi z&}GuwX{6{|xk}*fdf|g}5GRj3DWbd>hftnR3e)ktjR+@V;DM4h%>i__EV*1=?(@ys zR$a}X7%ucTbEV7HC2m6^x?eA?K|vw+s69+Q?)6;>Flkt`xQ~#TppB;oj9(Arw8(%m zIcfXuyWe|V-9|)DG>bC<0_VcXXG`$c@gg%h*GexGVID54kA^fS0wDhKei*_qyXy$` zT|E2hyv8LR^;~25HYqDvOl{6CcU9+KXMjg{7|GQ*8lEbLbpMR^DBhUhDkX#h%69O6 zCrl=mYTOB9SR>US``J8!<|RO3gp};}xTjV6x1Y^XLO; znts}AGi85V=W-b^)cq>H&41D)$>Sy~AG`|;K2;>=P4Y@vU_!)*kozL;qT5G5b zn5g|vdYP)-99}}-ml$Mp&#sc4K3Jm{C^+m>ea-U$Jad4L7?U4FZ-f){J0{YzT^qQH zxsN=maN>V?92HqBJ&8#dYNVws&6?T}dDcyn8U!_>NS85$Bbp^RPW=hKD!ddK1D6f#-0r$0;AW~f*7ejHFKEO7e=CtJ@23gifv+<8f8tZEpy%DX+yuD2W zWhlbEug{$YZ|j`}$R@q7_uVR+Z&%L#n1sq^YO!S_;d-`N9kZ3DA|f|#!xnzNWI@%> zbKRSwp`CTF*WLM7FP46icWi%HHm*$G@0)nHBMt?Pc!eKUS?73>|ATxB9|yc@I3u}- z2MCjcd^%E!La_M7Rd9y;0R)g`jsIc7^EIgZXODNdHl^s(9b=Hoxg_s~8>>2CcLOCr zp|+k+vIfq-4Smy{uc#lU0u)RliOcVote3+pv7j%2^MAOGLxupsTm)J-pq(m;F7Xh} zGQI2zWUi>hp2LZq#(jHus8CI~i^0n-z)p~sAqVD!YJf}dGw+Hi$;*Etc|KCQdRGSlQ>G2s|41TGwLNA@unM75#x6w6OoxcOv zSx5PTvFZgHuHE*bVu0PUTi{2~7N3~aDFqMuQW+3X@$;ZLE+3}WfD&e>m^5N?P8iN8 zRKiL&%a#N(gN=2esz&W{;eS59vFe#kwZMitFbr}7YInXOu!x!J-V65Ok})#TAjp)? zBz#K#2HDeo5y15 z;eOr%^0%WieFB6NeifldhIniOgo&3)5XL!dE8{y|(rt(oaNJ@EyI;9>y-h6tm7e-0 zI{j|hWJ?nLQT63}epo$u)#S1pf?G8_+xW?z3kdWJ^^_q4hYqL_8Ot}$-k>E5_?AcX zi9Q|%rEIG_G4F%>B=&H~YRZ+D3kyW^e$*K|w?2CA*K=W8GERKhZ^C`R@8*oOzjNmS z^tIw*lUi(yKh)xLM4sANzlLd-cp89b^iepoo3RF1^f>PgfrEO%_}g|xI%4rFQ#?V8b*Ca^H8RuY1Jkv zVQG6%m|{EWopn-C1+1ak=F@D4t+M^&-gnAId?>n`T`?8ziJjYzF`NJxs&z}!{eT%l zKo)n(>i@?nNNfp*AwQeOdy9wJrJpYg7cIW@^u2u(PVY@ajGR?+fcAi<+ZoH zqt*qn3isu8=5;fnRYY!^h8o!R*F+y~U<%s~-&6wL1o3jC8i_M(MJAwFt1D2vt~mFV`QGO^aE*HZf!;4mct#aE`;lk|?zX1ILR zgf06fEd9~!Sk^HXN+!Frje+leh(^9L#M&c>AvD$%+*uN&^>=Y?NTwkgV|EN#(W#@L z6BxeOP<UA0i%_oU)i4&CB7m^4|&s+8ISJ5#IT{W4I&Zexv@k* zgpWIyt=4(Ud9VFaySV?LpQ?~M8|H4Ue=hGh;-HGV|F_Z zwgZ=5Tfi~>RY^0b5N{hEV(;U=PG@WyNwsGJQ%1uB8(57ZF%OV5RXao}Qt6)+8`KtF z6)UEK42B&B74ipH6%|KF%r0bTRT}LzgvNzOo&3Sz#&ID0cViI&>}|p#n8P5-REOQr zHyN3U93}z;QcC<1hF{r$@)W|b&(+{6`E5%%&)zVX8~xi*%v11qOoz0SN{ezo{L@sw z`6n(3l@%3kPc0^&Bh$dy(k>!nNX%sTw_m?#*yYD)zGs>astHDNNxvMxThW^5^fPzH z)3{48W6#MFyd)F9bVc%*WgxQY4jx)znD@hE3a7A9-3)rNv56W^bE1Syc-*T_vSm%H z$*B?`h60J%v0Y&}s1+1i_Jmn)2l)RHN0*NmQ=)CxM^U2g3xioyr*UGu+t20OZ94tP zLU~G3#|}_T+lr)t(Gjxssya~Hc`N)ykKPvl3cJM$DW2l+J9_W^w|RL{-+$+Hlz=wt z&U)WR-d|R8$@kg`@B6KteRrB#H-ZL#h<5EJ^$3dajNAol@=@GQf?%W=4B84-CG(RF z1u8UWivwT3&p8V@`-5VDEuxnEVZxg6L2U1XO3%}(0oltY$N$1w97Uga$xf-T{yX0A z<6$6NkRBQ@^iece9By#uW-N)Oe_&zBlN23~CbD~#VtK>P;Z}qgyA(k_8QEVys6rlS zI2M6iLh2`Q%r_?nC{YRVgD_26QKhOAHF2XZZI%vB9p~AuK zW)_?+uf*t_tl?9KhDO%fsg+kkkILjPpak9UtlkHVm4Wb}7QboTp;MaFQ?Ml^jhGaZ zHCYf}ZII5s$YXziDMtH;gH&$lBJMk4%_O4nTa)Z0;gA#xjAMe3K2;GJWeotVJky1%AJ%W+Y~hv#Bh~6u_Q~oy910 zRH?|Oy2UMycglhAA($AsMe;=x1?M$yJGbpsV*&(!FqT?ZN6+5Dtouh&7<4W+Ej)>r zPbUxA!|AJdD~jlHH2GksULv7|UEQy|*Xxq_n-DcRZ4-fenNQf@PE}npouLv=gp!M4 ze;2|cv8@juZ5I~q=i}1pzs+jAXHBhbZv&x=D9h#z-rdG;%sW6GmntBC+XYe$F)#*a ziUH*lDXGz3c@{G%1Z7|N+qXf}zZYkxFJ5^T4TR& zXb83xi9fvd%9))LPCq;x6E3h6efh=baCmqaaDqlg!aqFTi5?^n=FZl?fq;%ZLK8XzUcfyO=x*GsjHf>x#Dicc-abi z6g3w)Iu|K@J2ki*p?(F9m`im%cRf8qSP5@0FW#HrDzUdYB~_TTPttJFP{=4erRV}g zhPZUPLn z6KX;nL12WWB-d$+Sk^=2lwo zN#qg~H<_?(1p^q%m*rlskKFc2BQW^isG&qdclvb)ajqsBQ9lD9 zdv<^D$s|VXx)SSb7<$r#WFdXBkki4Zdj+}7o$|~z>&-V(LQi|;FU~Wy?(MIs;hGy{ zgYe&|AWi|V2}{?hyAAu$p85~D4c6_A=Fk_|OenhDg5 z_)n`YTOvxFd_Xit3IGll=D+*rhE<6JlF&iNJBO3^XyxVe_GM}gv(ym>itXR;uC?rM z9j~n<>Eos9f=3$}&;%u4bo(h|lC+{RV2U1)4kfe93q{<<4z)1zMfi(Gzy9reTD-sG z*N%qXl-{;>p%CqIhsr&bSP!2CX%^4ye)$bq=Pk%KbZ=bvivkwl`1trT`iEHWN4-#B z&oiowj2#j~_sA|vPtH;st)Ks8HrdcWZ#Ld$Jm}Xo>pAAJGS1LPj zS2Ggy0`{GrnuAAZhww!1NDS-RRvww>VHY_t{ECN#dUhR?%_`J#KV|h(uHs$_ za_@0WC>ycFuXAimEXf_K5iB1gxHqW8fbSe0RI{_&8 zhZGo`@Q-QI{j@jorUHI_NVcY!EW$NZy=6K)_h#xZ7nwm<0gE}w_+FCUyu z-pE!?Vv~m@0Hm}D0e?q`Qx%tO$joQ^MOVlHIwzGELbOfH79SSr9?(2>@ArNfwCVCe zcp_L2Dl?IE!)@ET=VkWty)`HcwUB>@I++AN#2yBanup$ob>N~YSu45`2?zD`yq}}= zx?laigV{DTGO#Ol6Ml(HU_)_wxOrU$a>5T|8Wypju<+-1RmG8_kdFSL-CB7H{@1&a z(+lK?*Bd0~Cp;d#R4%OlyoeSh^5YN`~5aDC|(N8nxtRM{_%e zjkR@NG5cC}`{UV%X$@g}w{l*RIx?cdzHwV$J97{J8XuRZRwQO!n_|QAUHo0q-0(mfz|751GJCi z6j&kbL+$b2`LdOPDT$(@AP`?tPc6MEfJ?e+P{^I9zafKbMJhW5NkYfh{8s~jAo*)^ z!W_FEQxuF#t`oE2uPqQ-rYAEJRQ=O^A$lqzulbLT<2Et|4xfII5|Tz;H8fzQp`eWj zB4`QQM2jn4ExE4mR9IP??=GBDv7w*&l8*9xip%?lmOz_vPj%e8;YWsMO-xKi_%lAS z_^enn>@_Svdjj#unann0NRR`)8QiTC1Jcy)uN;fjxyT}TA;|=ZnofW5M+vtk%0b*k zQ2hLYt0CyWh@q7rK*3TPB~|?B@>uc%-&M_K1xDPZUuLEWOjki!2oZ`61Swdm6OaN; zUslw}Y;a?^S z(YLtu6ov7s-wV-oxwtdL%aCK|VwS_}k%-(o;Yg_pV*a z4L}7vPCf6#qL0flgil$>rnI1F%LIe_+!!}_#eJxwnM&NuuMpY)OfrPa{~dNq ztPnVgHns{a@&HkUY89pweEP&$op|l5BEe$kCfRU;A}kAI1f)18rTTChN!uD6V0W~o zT2h41^`@-n?0o#bac!jM*}NDk5OX*Yt`fx44%5V%?}K42iGD^m@uXv&@I&72dal^e zS0D6Qdij=!R{Ky{$h~w_MMfy>{`cu~f3~D_w{Goh-_UpBUwb0G3fy(}U$Y5Z%4lw;J=(K#q5_MFd4fLu>0 z6uFWs*|d8+30Ir86-+568UNr|ioalRx?>iRaGRhX>N0D_eC>tKCNCaa@oOi%R5X|4 zN>O6MuuT~g>S$3PrEH}fJ#L2XLy8QdV%5u_0;aU%WD-W`9?fJk5bl5*pxh9m;u&o= z>0JZf(gtJgWuv_0Hm%pU9qSM#P)p}KkJ%pQ!&qX(DH}#}Anayau%Y`}1F2y?nl!ON zFN*sep{I9*!e1sm2)_TKB0f0NJV(9s5i62`P5DV672z9pY8Q6eLX4of4iXgrO?{9P zmMTQi7~;+EBPYaCvUpmxcw&trq@H*aQ$?OvNTq<|R^n!?j>S<;2y8%ZAms<7KF3vMPDN>SIR138g$!6VZcMgtrup&$tZ$G-^g&bss;oh4k|k zJ)vOSW%(BJ&&94beC@fnkc*P+9j8a9zF*LTRa3+<>G~lS_k8d<#T{CLU1g9@H(MBf zKllPM-ih)Vb6OCA?wl@}x^%Yh2f~A61g`uaWl4Bf3w@AP^>LhWZ)QuqwRHxWd;U-p6(?Jc#Ot~3((B504cDUR8Y+Kqp z*O?g9wQ_$-Gr6Nf?Mf5O2@n7opyGZoa?+vE3ZM5)9~`xm-*p-ESE@Ir;wJcH&y^nF zcOk5IHJx8=!qnA%-Z0MGX7o9#7ob_StRgDD74yglCdnz;>Hi@gGE&+ki#;Nz6)`>d z&8;X(4w}Vj49x`odK_OLStvOe1+PAI42~549(3C0KYub^W)F>;(!_ncpCO#WGFS@E z04J~Q;C#977f3-7m%=V>Yl4`*tY*qMV&g5Q~f*{Q3y0I@0jo84~6 z5I}Q01GF6*df)5H*Scixt7FR#T|ZodJMbLE0y!CZq{(kjl_9!M61n|~EN{7rmxQ;{ zN&i!o`V#MpaiRYh034+e4#3CdO;sTiPPmtb~&F$)#XOR2*O%}rj(ZRR~Qxvq(S zzF$UiUgm_$4WcEw|8^52a24!{hO_eSn@Z1f6Cz}N&HzG!Z#S*CI$i5ox(x^rG>ueI zQAx{Op+YnhXff3+l^1vB#psCw)`ITX97gw2=EKArxyxxDRe!w$jU2=mVqVrhlr!w3*trsWRmIjlgq}s{{3&7l ztBJ;PbKFY8Y7;+Gy-DbYtY0-thh+Pfn0LyrgId;i=pfse?SanG?*VoogwkA%}r+r;ba}O~u|3?;pdU8*pr*a_s$6p~~l%sXApEyrd!t`J@O*VT!I_4?U(m zd;h<)&52|OL%>BfrMMaL(a?rgSQUqg%?PCf(h2oXrLPUYNGbGcLBtz#ycKZ(_8wBO zfvfk8ao>IeZ1Z9nazDds-TGsObStQekRQK0vH6)OAq?!e#^OlQ=k$O`i~w<;g*JTy zZu({d9NRtUO%D9NwTZtYKN=LfNRp}KQ#YNw_(9H;jCF&6zfBFC}XO)OfID##U}n@^%^a+J4L3+b;l{f7!-Aa zl<*$iET8D85TM#uXp7iB^(fhZP$LcJ26A@GNyBxoAxvdc@ex`!K z?L0y}dB5zq0cX`B?M;7w$obHz*~{}Y(WI539b+3 zyHM1eaBSXOxcPq>l5nT*<}gwWfiuGZRQ;&(b}hPE_Bu*I2g<(Ky^Ya~bXgT=w-5VN zs@^L3#WXzMN#`Ug6ORbNWSbA7V}HhyI4?gh8}!QYNBxB`wdW@%!b6hw2Ml>oyz{%e z*6MbRy`b?Cy1Gt=Eq*+)nnPTV38Id>$MJt{$^bx;Y*fT3j;h{B9-w{O5#RVe24IP*_g#+3U?OBgTilTa+91J&a+bw9q79IP?++>6zUB!ThOUH@&pRdS4 z6j%TqZKIkZ`Gh#XN;U~R@@#}~nuuZ}l;1s|rxJC4X`q#ivoo9u;K|s}qwYhcONtNh z?IeMv->$It`uMy*h6NUb+cy~2B5n})cYrqwIEI2#xOv_sX>s zeoX!p`k)buTMh+RGzp=#{(CT7Do{nM_?sXv6yzmFfbjBY$&koK4hrfE1HJBjW~m9;t+=WcKo7ARU+LSOnoF?rT$lB7L9|o z!m>!!(Az<|POBmcSwmL`nqEp3eSk^U2o6^(XYkDE#-4KtNvaf|!Hg~LTeK>cB88?3@pi1=xnyI#Z)1J2$*FrSJ z!y#G4t9H2^8dpRrzTw=+4fXBW6%eM5zL3?#f5Ms?dOA$b_zNPqZi3-?20RNEo1lF zva0;(TK_<~Jgv1o@Guyi}v7t-(YU+BMlJs%tG6K;dRmspc9Ko)A&WvCk&GHI^H-9&o z^>Nh6P;G4NY3dW=M4jAW&}%K%aF1$oLYUUae3nJ{wNIns*BT76W`Bh|+h84KZyV(B zB>)MW>}IW~8dW471C@C{}AZ?*f3D#xH-|tpqWbVQAs`Cni=c!QkY}6kE%Lhe{Z&aR731QV`6{y~A#1Z== zJ_VDryvRYLz5!JYeZN{8<@$R7q**Lln-Yk4VNSjkYj{BK zc2Sj#ywX0D`>nMT53Q}@SM$Wu5#$OGk>ddLsuBG-)Q3TqUlQqCHxJhn09)mRgMf`- zbG-BK?R?w9+}ILeTZzM6G4)6uGGU`~SpLj{J?GRNNK`ve5@4Q0_AxyHPTm0z=(rSP z@kG(~mX&)qv1je)W3G26c`yMs?W}Is;hHZ)3wvnGq`^L)=oF6VPPdEyr^u`)Ytw} zS=Ccn_7e+hCS$SNzw3*;@;k9B&<=&GvDDD9cD7cwv=P~0?d~{3-ICq{(OF(f%QWQk zyZ4Z`7;*k$wJ!a%5-HpucoPb{53T5v67aQl$4i0ZP>t8yw8HGUPB-vPD#kA${8Q8 z>TpkxocWGkr*zt(ySy-~X=1F;!_BRwwmn|QA=2{hAZc;?*mRsMeDI=fG~zB#I#WR6 zkcYa&y~xY^Q&UF=Khuz@^3u3axSsaMv6!8!v=%=f@flG$X>D_3!FCyX?I&AiXPdgp zN=AD6ikjLAM{?av&ED(9gR!cyqYNI)&hI~3N=izKN?#s7v}9eHM6)t52qa1H@bW%W z2Pw_KmTmp6G_tPlR1LXn@jRX>?A6tJKD$Pt#{${~$;NdJ42-r{RJT^p)=v)In`X#9 zR#rN<>l$imt8J}paP7_)DA+|!HFI8*P;+r}2S57DU-vf;aQp1f6xfL9=yM7Q!2YPH zp|5suGIGDb#``C_?%C1UfMBQLU0l)D*5)^QuP^Yr0$IyK(fZwj&uUyz!xV*lXk23g z5ZC)Vic_jUT;bT*7?6LE+IZF?h|QZ)-FCrHpi)B~2|IE>CC0ZzQzoXoj17S5E=={3^#g2R#RS4|&+l7uQ|mZF%z#7dLGV z-s8LY_(F#xLvX%|%Byo1du=tyZ6h2C7M!dkV^u;KMj6RyNZ*I3N=T-dlg7Gm3N=~| zPqIONefYD0)XD$+{b?cSWisgfp8V}!(90m}3*!c$j0g&PLV3SB1(Xw&u@oGZX0>g9 zn5RgOKd}yz`%ip_`$xKRKG?`pq@8B$@+fiKsBXRK=KoTBu=wF8p^oo`L4ZX@LBH#9 zGc%*GkGGAfhaD}&-_f)Mc-Xs~3~|L+ zK=}eFE#hPJ{*uDDnz{u%#(WT>F>xZfn(qIPDR@|%`p3fYU*m@wNJruIMz!D*yNLNi zXR50yFfaA~FircXp8z8fy!5eO4?t)#R@9%AcnHqjREsxhef_j`pX%XF)1vB^g3VY? z*$gdHD=S0@&Wln4WXOYgc{1oP%^hh?HD7=k-uDRXJ7wbBN2XP>8z0Rs)~@wL%v zQeZzX_X}S!Uo#cMH0q5p30E>#?3ZzQq96L)*U;1+MjA!sx>P@vVFk+WdXQoQXGuNQ zqSL`BoUaPjv_x}o^^p?ED{*yaUNtifwE}Yocx4?`^R+NbW{emGdg+1?F(8xGlUJeG*2H7f#U3*D(pTC49e3T@7n2U@A+}b=NB!frL3aml`=n zep23-gwKPCoAs)uE1zQb(at%dSkUJB6|2bEtFFAzPa2@Lz`{?z>zOnq^B306;$7dS zL3XJHdf^hrNuS1q!j z3}abJ)ga8OzvPGE%1`xNZAB8PvZ?l@&HZFq&QUk}CJxglA+d18 zI;voyC+&APyERvfTUG=UlI1YX;{}U}(a26#T;kiV#BXz>xT9c{h&e9TnEk*uzzSvk ziZgGf=EfdMfu@fZr<;{GiaP?+5G(yB(^Ciski!M6%>Eo}x?Be9b5`9!MrlBU&iWVfzQ zR}Wjf0#UL+UP<|FBT%^q!9a&V?mNpyIGWr(cP|d$-gz7apJhzE^bec_%m)5P58U-n zc%g5#xCXDuFnQDhW1%!mv$(hCK2%8sv8?IbpF=<8FmFZ)2)*^u47L zQMjTVsAycx>l9Ur5JAg=g+0-@_^|)FesX&M^W77&&qh2mX-c8V4WJi2qQ(Mt??fp= z6+&A{!uYI2DWFb`4YuTbp5W8ScX>p5<;nAFZek9H3#030ewe+sJ?B*t>DA5{!d$HN2O7yEI7a?Hf=_tI)wssj?HF=#Ty@V zdBOX98zbn?vY2jB?iL}aN(i+Y zCxl=iQx3YO*`xZr;3BuQQ?%!?lXpX^cj$Ii)bD|_Rpcd`RTPq)d+LQE`utrG<;fw;WKJv6CcPTDIe|3|ZLL3<(7506^>c^= zVhxRzbBz;zFjpXXv^HkE@q1WNNe&>(_6#+HiE{c{74{g!<0B+a&^r=tmVcsey4=D5 z3|e<#&sbKePa}{S(b;p=(y0cdX-$NO4L~b3#6M~d2qK_tX|Jp(&_NZDhq}6$CCe0V zKli?WnLGX}`uM$bij~@p!3C7su1P3=J>bzV>nj#!t~%p%!}9+CA3@;0xpVN1RW(IJ zltUN?@9aP#xs)I15pJh7{cqP*eQRCUk>Xi2B6|5?XWhlZdT54oawzNUC7GTCQa_?6 z4sxhCD{Ic7pxS30lM{2K$7DL7&H^&^OzJE&O4HyY(h^CEq>cNiaS**0UROPkC?Ezt z+=~go=u6OS43uIVrSpM9%BlRP+4@pllX!ldA8gQ-3o_;pI8B?zq7AXgqS5_Q24dY-{QZrUyNSZRn zkFK-Zu)5uQstpuYY&fQIK);6^&O9dm^oo8M2Wyh}$vwv11;)Wsht5YD2Ut4OL-(xV zivxZligF@V^KAv%ArO-^MG|i-n8pG1b5U=maqwDtBTrpO@p9vU{sZD|1vU=oxV}+^ zG`OE{n?#~3lE|##UX4%)VdEgRa)LU)s1_s&I-fa6t+Sz+kOCsog>gVrZ&G{YuQFn! zfpGw4-Z=m#)r@#jzA~W^i+ethh+LETC3b688NbSC7zYrA24~}7&B;zg#N0`R5)B8d z2*Q81>$J$ZXgKkT#AeZOZ=LQIr4fmS=nIMT;3K^U#TRNu76uy!t8*=U<^a*bP6^Y2 z#7WS9bFdf!NjPMQLjW&kc5TcVO{o~7f?f$BRhE1XyR)TtXhz0}D%)plLj$9h|Bt=z z0PM0j|NkZo6%^c~D%*vl^WR@>ZMCh|$zI}KwZj2q2e9si6H!3fA*_&ugd{-7BzusA z?7jE+?mgfC=ec|H=1UlYwXH4p;kev;(+pF~5a z+XkKlNif(@D7(jI@>noEX;xy9m*}R&w33EHd6oGLB_$6w%Vt(=#$M^78UJIyw*y z0EL2ryo!pdqLSjg+@r6*|K*5@v(BG3Z!EuKz)N!g<{&etFefh;xqwJ&YHD_Nc2Q9g z$_CWb)F2}ihW)&ipOTWo%Y&?wl2S6VG7GCaZ+tqOZ^au;nV`qMqNmkoRO#>eb?{U4zfjUB5$`FQ0UZyt_}T=o7pZ>{h@T9jSdVffp^ z$Nu`)r+W03kKXvl@)be#&21lj_;E)&ah@zM{)c5PKZ~CgggM@vhB=Uj5gR0YqzpdN zZ=akwAh8W=F)dfLJF$RmR8?+KXxWlNrt&43=Eyl3!&UVh-3Gku?YGRYq1D3I&nZBIuO|#vGtj@nwCSIbhAg z8fNf7VrX>BX_y0$faGPdSqC)glG?UjQg=9X1HJj#6$vp>W}7yp=qSeBf!({pBM#V| zj(>#u8;$Pxm|Y)y_>ReDUAN(zg9(Siwyt^O-4CnE8xBN8hllO@?2E5cQj+THszP7; zM_X&xzMZ=^ZwfOz?S<9d^=eWITt4;Q5mRQL$Ihw2K5yD=Vi6|J9)11&@kIl%CHjmy zQ(A=A^F(PdR?5ht_8m{V`ds@0@dX%H=| z$qLW3YJGN{J*!e*Q0>?peGDUtq)FBe)I_Y27@xt|jltQ$AK~WO1?*w4@kn|eI-^Q% z?#Tf+;w#Z$Gj5HzZPc{5s{Q??)Or%fYmR6bQ^)h7!sh zHV6HbcEeNKPsJP@uBYFId@jFhnC5`JG%*MMeHyAAz{?MC%BVHZ8jswQJ7iC+L*TgB zuSK!^+X^RKpFDkOc4il~^rL_I2OWnz(+@9^g9bF4qo8SO-|)4&L5d z3=xl-@Y|S!z`eC0k@Y7s2mbpymu@d+yC9D&GY9^W^x-A=QK^{?fBq^Xm;-76RwLx1 z+;ea$=74&KXi$JRb3jZ3V*)sHz~5FlDRVG*&w!aOObK98jhn z`DX<%2XxJY7jv*B;b_qQE-(lE4pu_O93a!U(q3=P0g>`h$ra`RM2P$eKunAyo5ijf zP#>#l@1~!EY;K1c%t2y&?B;c=^U7nhF-m%rhg?)ql?_D#DSPU%p5+y`&JzjJ4FWMp(ka_Z6IdepkKLD!&1H-I_# z1GWkXlow2%#Xj~=-!dLKVa}-Q9>}WF=p6Jz3F4zHXg<^qEeV6F**s)h-4cczd{9Ap zq;{rX!O`7_3{OO`xFxy)i9I4F;bnjpo47)>e| zz#R0O1uA>`w-wNaBd@v}nR+t^>V}6v}|zP9MXB4{8l4{=7&$l!}CEA$R=o zNRdYkHw4$6_$uR%0}GOyi8*-k<+tf4jA_JZ8ZpBtW z{6XG3F>T3pSWp;oHlLae68%EI<)}AvfHo-av4c4X+F1pEEF-K^bjjV9 zhw4INd*0Ytz<$FfPlwA1&SPnK1@`r71B=M~;Q({6bY}%hPP-%fWf3((Ixq*=zd3Wj zfl#wY`bPxaqy*-Gl>S)esEpL+$~_0Pva$FG>M+r9za?R%kWLUC1xFHWB)fCl{h~XD zX%0XH%t2^O7f4apyXY7J4Ez<%0W}rVAt6FBn1lW8p?m06Mnpq-ICJnpOgVU?XFiF? zK1!rn3DGQI4p4HgIlwwhnGR|W{B~E-H4lsdg+F$?tp|$yV%kF@>ib#$B0uU@_9`QY zzqB?T%|di3j5f>HqN{_Vn|Eb5Q--I8(_!iF?>$!0NXI{24y(~nQdD;^Ey}-eT|H6Jd$w%Zg^Cr|s_Xmd62l9o{%*_-bI+SR|AI*iN0L}MW5kr1V<#;b zbNvH()qQkOgB^a9+X*0-Ea`HvAOak`varz@N_?~lwGf^tn0}tH(T!nr$pLmvj1QWu zY+}=>rF7J62&F%R4r*JrDJoDRpkwJM98n<7g#5vz(e)3QGjydGd@x*d${Vm9f(IHy zHz*Si1Ot8uK0lhyKD@+Y$}}0M{0#6{AcwI6ptKlQm|Vj(2h1qU0Sc$O{LW$DR)9^# zxaRlD+X{@}aRpF(cp1DsX~AJ-#srBf)Ze_kkud}(VGhu|PyF=_)Kq4M&Wt%A(8NHq zf_IaiUA}!$PkUcdoc&HABSKL&P8*&GY2#cXnF7N?)c*4k7FZaKK$^bEn&MhYz@cY!$57< zv5jqWe!ms72*Z|!pvgtd0aoe{_Sdmr?!kG}W{;IRU}v>obla<6#PiX}b^^NVBY0<7 zNKAV{2k{ozO^Hv(veKxpib*FT)7bv40hWDdbWor?thKe(Bf|!HSF00?3 z*5wg(;CtZ7-&TMm_f=y3vWV7q_tFK=4x22gAnnUrk1dO6u7XU71;8P1?HY#!xp`@L zd2PRhJSkJ!r0C3na?b&+k}O{^2X96Zhp{=Wg?Alo`Al96-khyy4$vYfiQVbwG}9GB zemg24pi^HE4?s*ncxE%0gQXiYZR}hm4}kxY%>}{H9V^1}(RS2aj6U{${wiZ;E!{{& zD>jI`U8OxX|Jb(W5jDhk5z|0RAWHcDzH&6zQy=XIbHIlLvf!G7kl3!ZhZ|5lq+m=2 zojCw=@XGem1`Qj8Se;!C42!TsB}<}OR>rjSvIB_@8*NJ%jd7*@OC#IVsxSr7#L$+ZEoeYCvtnR27`a~`XoV1SQm$gE4rq32nrmd0hkxW@K#2lP0kOURO#2J3( zz?(T}B+Y@(6~AWOz)6^cu0HzirA+aR!MI;40Q#GMTR~wCrY|324*08#U=Dbdm5RfG z0-TmPkh>D2+HRLFp78q%C*8Lx{2*j5_)-!c>#Ped>KFs?eA;q9{6xydFcM`ReKANS6@F}`i@+xI}Q9mVr8EjWZ{c^+q%^o4i;gf3fx)R zt2g!ZbhWp3^s5JYbjHZswwL#`yt4jqzs@)?ph0=m1AWcChL^s{3EJBjRoL0l(S;oQ zP^+H4yn4EoZ&`S0r@`3|!Lz@otEaQOXCS{x8?YCmb8U0Ky{E6cr>ooHaCE7S5RQXm zx>ttf^bcsdIyylF&DGLp0)qwSph7EY^*WtKkLGIc>}cpQE!k22T5QXa@?MbD=(KvR z!DMsB9c>GV?_0XPxXl^6k=s*@Ny@od;%RyvYMtgtn07^)g&ucWzeVULhIYIk- zHXmthZEf!E=>u`FK~-I5I_|fts!{DiE1`raOs876HH~AeGb^g>rpH`<(jZP`%~7|{@y-vpllO@D7MMu0lCvU6#4bKs8h<{quyXz1@( zYX;P9{kpgJmY~gFSbeBl>p@ z4WQ6V_xx)Hko(vBa{OaELLwWgx~a|4CLq$;JAmyU&GP5Z54ZPgsCRl1*x#ZyzaCTT z7g2xu1BqBMEfy0R=jgH8b{p|ACZ}X{(d|ZHHNZX^o#fzdvON^4wUca$ActGhJ1B_j z^D&#SZ=rF(8j=s(F3IGk6Q-#(y$x!5<>cbYzrA46L!+lY%y*0PCeI%|dFJTrW`a>D zEbBl~F(29SQ_Ms@5l>lo0?kt}0Wh>Zb3YDw5)V>g79xQ2@M0SN8OSshVr<=D%mFD9 zTvFk&_VcIC^_>d-V2C*&$K;vcnK=NkMuGD?J#&DL_}-ZV-n>Y6D&}B%NQ1&0e1}&V zc>}_YvVj#IKk<)auD@^djzh#B(=?vHl<(Jp*%~Gdr>D(l=C$1_K1p zZDoGZZT{;Lu?w2$t21Vc#fF`gYYvXon+!U=*-GCy(VHz9wf%w7?E&FsJqDM_Y()^f zu_OAgI~W|_2j-wxXTx4IX<{&7dw#_P` z7yx}$#bDcUq#FA=m;=3?USp#hX>C@W%^6eJ<+rcvFJHtPtPX>LzJ+5n=z5JV{r%mmAR=ms5RFY*vNd8LSYl4q z;fzXzCgxNpW|SYwtBKF9K9E&(II|)#yYf(WOt zwr^qE!2WUdZDTIKa_oe=OKZERNTl<}B*PRW7J-$LtdjyOC%t(o(d~yUnlgWhx4jBXgHve^=-q*TjyZ6nZ_Yq-@Xs&@NN#mX7f!hMqG>a>>_|cYsgs7{f7kvx z8N8VT@w0+3L*`qV16rPFRHA?A*Ik5S=)gcOXw=^v;63vB^ zA4o*SQ2;Op{KHEqAE;2-Js#zr1FTc@Op6BnB*1@G2;5O=pmyXeKb^e$@=#sSzOHxo z%5N)hfH*&pSgE77rE&o5`s6eD@Dk!83x4LnKe9DEy9;$;eIyh2{8Y|L_uu!Apo*yc2m09sOBcC5p#}1fBT;E9oE6;bn!u*K+@hO={`e@wKdxUMBebvpabKYpxJ32aGmzI`S*R@v2#tzJV$u)+<7!KLVbO0WhDw#t2S6( z-<0Wn=72K?x36fPzBGGZnWMd<_n9T{@lQ6N_$s5;%0@rUJQ{xZ&l~`sj%3U(Y3$?& zE|~K0mK`bJBzO!SpR_U?t<{)4P`zj+V4-7K(W)3)Y*eCrerv=T$R#P%Imoz_M!~gS7{mGK#AHSS-%ij;*z9a?a z7fbVg@@nE2aXsLTuDJ0JzSlo=-lTouKC4abh= zrKr0aDoeBNR)@`Drn4^W-9i8bL#^S!-hi31H>czFzbD=La_aP#l5Y1;`f)(U^jDI8 z{BrUwFCYHHvOQ>!g-`j9yKct$6Cb>A;zMI5%o#KJ;W1Mm9y9r&OD5m^h`pI7t?pTs`M_}fyOH*%sIr%5Aq~HE(#_dZIfAZ(A z+e}hkWfwNcQB&wc$==Mts7W)fzkQa?&d#e2lI6J|Q;Wp{8@VX{+zs$f!SKTbnfT}? zY|P%w0Swn19IU0uGUBS?Hze}66~G)cwyHr{rpC5d*mgUe^RUsmXBoVy5ya!5I3)0U z=ym9Xa{Eo8#F}_B2h&3uZu85{=%gvN_^+>DFm2vR-&Qy)=3vwIB=}=mP%sU6_LC4R zn*w@f@OGaehEn{HnS*)Hzb2T2f3rDT=70}gj3-25%t5>Vwz6JqkBGunYD}!tFb9g} zfI?Uhm;uwv5!bXb$}3k`oYm=F9=w7D3+30jCU{o;e7O={k+(faOT5 zCf6K*ISAfGmmslX5E*aH!S})(^plpAnu{;n@nr+2Vh+AVbHIydGY@FgI-NnM)9I~N znh``tjxr3SG)Fr)Jx;65>SVWlc$_AO1>Nd$TCE;w{_;IPeZBRj;F{@ybvLi5y>&&y zk5|;+5?ue&*DF3gWVJb^D<<7@{)E~5&_4Ez(NpG+zGQ^H>#iM}RRKX`KVN;p8^IT+ zBu)-lri$Hv^PzoTcpUWFu$(;#Ft|^nqIS0wk=1#7P~(ju4Yvf>-V{7REZ^_sR3ssY5jGFQYT@g5S#)zp8!98}u1Aq7X5bTA`W8SVNT5)tT|W< z=HTr;bVDN5l&wJub5Nl@rRIQ9ri>Nl!24$fv^q)%<^V*tXLTYrB7*`#6z0JDhD3y( zs5wAnZ{`5)PlTxlM6syiz`e_H{g$oqyw6p{a| zz^_lHUIy6D3fm4AAIBUZSN3fMm0%9SGa9I(Cj}KxGTF_2j5*Nj zGzP04Il`Z6L@jWfL2MTa;(}mnu|u?Wf+w)C7Yi7Da0zZ{R>)55)3*oL{5Z4$`}A!q z>aclF53RW^sBqOmdNX(2b5Q+_%Zl#_ zK4@}E4=)TrF1}MA!OjF(7P}N}lT+u8n>6z;uYQ0AV6Q7vyRjUowfW$r8Zju35a{6m zC~KR&-67rNS28`c>b8)Y+kzXXuc*Eyv<8gAtwHs7yp+^olyZ-?j+?UJf=P2phW26( z_<=-Fqz`ql9h&FDb7y%{dEhh56OXXb7zWSqPd0-qBAaOr68R^aFZ&g$45Kgyj8~w0 z4%)g57K;Uxxwe4U2*hFYM{dIhHZK5k(5p0vXmv^Zk6CUEq1?Th1Aapyzdreim);sV zku*c!fjI!c99%f@{xOpu-W-0I{j`O$(ThST1K3eSK&hw~9FDB4EIjfOvZRDzZVvhR zcno=qpB04hHp7_%<(>mFG$Q5x8C*LYSQ6+HKA0q~CY=7D}&JeqCn*mh7DomXG-c`Rar8clPT)98|x@2q@1x-F;8>UNuv1km&yZ*rVMLSeLGe13}1xcDoZ( z5Vc*lId5f5TUxaiF{yZrf$Gppfe|eMTZ_OPATFQQ*r_VJEFn=~4l1z2VUmH}$Nqt7 zy(X?UG^XdB-A9Qzpsz03vC8N@(kokw0{7NcGX4dU2@GnWb4fwFj)m;4s_u1zIOrf1 z_U80sy?#-hs1!;?ufkLR&<^qTZsIV)j!-8V7{&a(9 z^4rt4Y+K17b3kh!*2q1%?E#UU%h)HI32bpTyQPru@)dDiE4SpL42VxH;C6uZ3EWc~ zyr=0%gWk;~Dg>eEW$os`ea)de%D@D`6FVp}0VnZcOzE3- zczJyawJo(dYCu=dzZOyPT5Rj~>?TToYVaEpbp(ysY~;%*w@-i@;~&d342>MdC)u!9 zfW!0<-+-FVS-$(0;QAl0sQ*dO(VGKH;P`Q99enNxt$H`68*wk5_&eIAradxx(wqx# zS~zmjeHTr>>&{>KTJ+PNn4>ai&afzG->gE&nL}=}IQZ23Oy>{MhY*)wc#5`+e|1jDcBCtQ<9QHkgA^Qy-**4wLy_ zHD~Pg5C3(^hg2tG>eyel9dZZ2CL?94_}~#X9^q|u*}C1*?Ln1bgTM@dA-FNL64ksd zsPg9E@>~CYu*)jtmb76#r^-&C`v$-UVUI-aBPTv`?JbY+!yUXXN?x!5B|88?$dUiX z!3P;UG3jo3dKWfha0YZ!VQ>SO18^tUq;CtzPj4i?Q+4I9*tN}b=m&)+P?gQ4|V$9%8FW@&i3ZYx4YC`4u=8s3_9~bPiJd$3)X41 zUf0`i?dWP%>rh_#vvWf=8pM#tam>MS(FAjFE}By^2Q)U=lFYz{6t*~%THDvDQDa@e zW0h74+}F5lM@2WDXh2I4r0|E`kl4E_p#|O$_-H;e&4K^!GQaq)zka$O%PQ7%_+k=b zj|tdSwLG>vt<_<(S+MycFNepS)2I%L8{k(AS!shI;E&&iq$P13%XXJ)iQ}gsY@rw6 z=>oo>*#1xVm(hwt1Byc1O|DnM>-=LH8FRp=HeHLqJFhV$LF2!(92*slJ*O2p((ZV) z&wqdS(shT-4!YtE91r57gnnViLiTs0)SIoeAv4mFr_mt!Mfbh3r3@tmWuipa12`)B z-Af~SA>D#GuzTp!l!$L~Nox+*haBjAdv6JdlJrTnr^}9(?5+&n*Ho_MREd2->-0LM z(CC(>J1c8Ybh`h9>WK9$xw3az3|$;aLIi_Da-je#_tpmP@7bB(jYhTGELe9?BaKT6 z-j*8_-;H|F1^*uUCOpz%)qZtv>#|){U=Gk1)GjW%Q*TdR=PP?VmTX7|pTxEcQsEfg z?Dpsb-79w&(U!~oT~;)U|E{W_n3mK=y^G%F$LdaZNEEj@{9?O8qw84jlSm3q1q4^c zR0PC!KfflCnhP~Tf3OcNz7=(B>He-Y$qiWAi0g9G-8$fzmh5d_8c|cJLj@r#(=rYJ zuM_joL81Gaw6tH)P(gf@e}AcZNxb^`b!iwO)DfiKpx=W+A{)RPh37QGi#OLvVYSkk z1I8Ta%x1bC2cFzM5sbrfo6Op_j#iW(+q1lwlDExhwJm-<@@Fdw?wC7w@ypYvE&3Q+ z*Ytqun?oR07Jrhgv$=^mfIxY{jr1|b3nt%p@zp-B1zmXCG*wmA1j%rbq&eTCztExc zwW(DOjc;@1&HH0FqG6CV-zKRHZ0E*Wk70ma3dF%5+_9W~S-3T*0h{!#!L_%))^tzs zA&l^akB44({T%kI|BNwH=E5=RhMDKzFz3R_kG!ztU7AK1y_k+(;DZnWa8S4x;E!zv zHfBe!B;6WNc5`SYa=baD_Lh(eQx;ux%i;@eSU|tN(+}{A zMopUwcHyd<|HQJE=~F)r?$AV>bvgIvK5)Z9#ldiO+c1i5eL8}+WH3f6noxI`+g8?3 zU)lEKpkpaD#2Kru{LO_^7lRuZapUY!)8>ttGW+}+W{j9JXUz5Yb*p7Ii}GWz+31ES z0IkY5QGiOu05=6OHio`&fwiI#%t7mID{5|A(Q^CBdX{zbEh}1o99Wp#NY_(7^YVLO z4n|FzJ^IEOCo z__3$jS{t`*-m&!6C79h*^uh7tjiFkK8xn=_Hm79{jst{dyTh=3_qMH(kv5NHwYh6G zQpnzx;9ZsNCiEW@%x$DqSbL}<6wEx~VlEBDTQ;3y) z4r#^ive#ldv)Wt`#YjSS(w>~xWDbh%UAE;Iwpc0>`~DuOxYr&EjO_3aE7oHM!I#O1 zC@}=nkl3zIB1+9HrrC*1U8u#2n@dBZ>C6FkVp^K) z4!haXZVhL{s!((i*j;uz-Q$x|*106IJ!Dro);?kwXlEy;;f-Bo!I5pdayqHs zAY;+RK2B`0q1%g4qrC;aknQOcktE+rohB(Dx@B2-DN2qd5B^LDmUd;e`9c2vI)j=8 z&BQh&EK>ek3sxTJ3Eq~EI9O59n-0kVrXeJ}9J_CNExoPaMkhO*2B)K_)rGbNBZyML zALX&R=&q-a_LnbUe* z2GF)vx}nMmW7%x)6&8f`+gdn_LtE6?Z)3u{q3~r z%WJ0xRooa_dq-f=7b$ef=G9a09y9r&i>Ayu|N2KRnRNG4k56+MexmKYwyR^bTQ}0t zt8!~cy9^^8S|7Lmg1*jMfU#p|_~-n^p%-2^d+gMC^c~14b1#}af9&Mh5TnOUdxTv z+}y#z_Z8&Gi-ESWTcmEM^i%(Gi0`+&)^gkOuG>~NVw;>ATnjn=XMaoVcS$*gO=Bm{ z#}3E%lG$UY%p5xzoAk^vlV|+s*84Hc_;$-TW0sFxH4X&f5jHxAXALku-i8r!+q1iV z3?3-7TK;tM^4eQh*4(zd`KJLzsr4j{s4n@%MUxkfolN}Dn8^#qO`1D)>Z~!-7L2~? zk8Rx!yWP&u9x7SmQOTW(HMo`X2&gyRX61&&Z^!zuyTFD9zd5A(HsVWaZe0N$r5UWr zElaXeTWKyo_WU~+PhNE4wE3v)g_Gu?7%<}}&K`T!-D(p}B3ej5oE9F|31kCs5R7)| z(usctiLA?XL&^ZNt`$Sw&?Ze7vrup>)^gZDo~pM*7P0P>sAXG|a`f6@>9NXUrV9?Zmy> z!gg%lwkHxxu+?hr(CFUVn)vpHgvf;Cmgf4yi3f{|3Xi1cY>!KSb8GUu8}=VgO-o5U zd|-cEZcbKeX3qOt4!*lPYwfP2eX%jw+1Uq@4({E%H$E}tgH183c4xiz$;OnFwA$*L z1MvyjIeF;?6(8-*cz0_;T2@|SV$$AS;jyu?X<4~%eYNxL%}MWk6B~CZX@Bg#^whK? zM>1n$<38LHwQ5J^YoBa7m~aSmva>Ve}~TOt$EQj?RD5@Yx6kJ%Uh z+1EQ(?a26iXHt50VPZ=1{x~UD?`}(6vtf7A!9$su*@)b)9ypv;^pCB{A8bFAo|TJc ziH_QvlyVqN^wGA&H#Q$m$S6bEj-(`KWu~PhCGUxiTeW5X>st=Jxq91<9XpcJlaCxp z)9DPwm5py~-2eLe=tF6cJ+coUJ`^1tot&KY?ibtN+>(gyNJ&dQa^whob1y6NKw|2f z-^9GVE%B{&yHk#&$3*W-KAe`CmEPW`3;kj@O8D_N+tHy^)AaO+xad`@x4pGB`Ry(7 zyJ8aR>S|IDJ0VV$x8oD^rp96(|=TP^!ycW&9X z5vvxM1FY}#;$K-wPF`+aVc82IYhGNP^#AU^UaR@(%9SH0{N~Qv`&>7#G^rO%B& zAN9N6tA2IY{dfK8>0kfxh2Q+?xnKWb(Y^QIbN_v+ma01?<0W>D%BuEtYDa-Nu=cBL z>QRN+*L=C=^^_#~NMK!ET}eqvW@ctlQBhS@RYgTbZcgEwAB8{rY4&qp=Dzr8{$D=L z{>x_>&#%t-^XIvX-%fb#>(tz%IS)PZ_+1Y?bLT^k-TBZ{zkcwk-#+lvZytF3&Ig{p z`~Iii|7cx9Q)5m}R&H)SdK{F2w6wIOq@oPBLhDB z_U*$X=Hr0_2NL2Aq^2Zg4$ zQWWv7`{v($-;<~>6@XRz&Ica<^#jlS_P$4xlGAtY+=*(UzQ_WVg}c1G93uglV$+R? zh(PrLxKTXRHz&KW;AkNl{Ah00zdsIcg{vJ%_SyaQ<0tA*M|5gCs)72aypIlJ0GI4XFJIO^!vWm zZFjjLn_8SM6A2{8QY%;_pa^JG2T4R!4pb8L#*jd!b{YY8lmQ+j#1LiV z=5Sj;k*bLSgUatppKrO%q6%RcgZl~Ku!^2@i6Jiumi=n22V~>8( zK;b1RHukHw)(5MLFG)_k&0zY!WiP4h+FyRPR;3=e^QosMp}*+Vh~!2!*)KSjkKTLn z!?!NB5q~h+s!=)hBV1~gqyPN49pkJf`V|GGqOLj~tU*b2M85>_9${{@s+Irb;i7jH zse4GVLBD>nqaGdWK!|vh0v4<;aV{9_iL|HgnlX zV1pi6zz0Q^K#GE>Tj^)C<3P0<%-!3q06tV&C+P-Yc-F{5vB{Hunxr|496hXAP#8YE z$w5Pn?l0%yIte&9aqdunE{6{*hSTY>(kw*#Icff&vNXB|>kb=_a9B`HHg%8}wLHs| z%D~*z>~06vA`qt$#zz@!X803}NFNiS8Req&nR~JbG}L%>f(IjjCLv-_CgjWJBy;15 zrDTnE3Jiq^=0F&4b6Vzr1~W4R8p!&%t-tvANPqaX95)RWZ!L9ME3O-ipRt zrU8R>hd2imlJ;pf6+jV7E-e9U-^1eQWXJnZaCp%{LhKV}J61!d&2FOYoJFQQKoSH% z77whDuqbOR8c2yvA6q2zLwv+V8xc!DjYF#+ZB$r<;L8px(CTNUx*#(0L^|fl_C^$g zmyXtDI_rQIz_yBKswZo9R2q?~VQKAyltFtu6$+e*6PqMBCMp%JaTFgZY-kQr0%N%* zy*eY}lCX1fJ^*VAvLJePTF}`kZB}1wu}&*7C#ZsX~FJ9eMH5vk(0UrnWC?d1Y?8!m;tJk92vm_ z4MIEy4FY(h!ql^@B*@DJjs!JCGgI|ZO=^4k#Q_~aYylk-WFrFu(@u>*wWac~s?mAV zQ{t?c18^jWfX1hNnHr3pprI8SU5`GX3ke){v)w!}bB@Yvn(*#Qdi5YVUgb7kos^_< zn67*04PTvcfG@#RA2bksCBktiY2&`#Q=R&eZXJw|M?cb`zc6~wC2CzSdeVE-LfKGR z*@vbA+6S|dW`zg*1|}SK3u0Z+Vs!k1=Y^Kz{RjguR({fM(?;*LJD$`=&8eD$z&b!@ zRWa|eU!sXYo_dgG0Z~J~tfPrnqjM)1-qfB9j0lE0{U%0V3BnW7oC*~Acwnf39t{P_ zW+x_uDn)}CK^Q6Q#~ln7j87ttHHm0YHRY^PeN=}X?x7^dgC@~nQMnHsypS{jQ76=m zMlQq{8i7QK>P~9~g7}m{_O$ndVFe8gB9<=-#(IHrr*qA;V$vFQ0=OsgMJiegSSjGi zNKx03jsIw1ipo|3_DFGthAb-^SZb;WXHgjBP%jMm3Fbf;Z*yAa;5cAl4K5#;D;U`{ z6|8POO+JLutJs*Zv{}${K)1xQ*@EfhBB7YpY8s<9Oe~^}$xPBA%~(dC97(1MD4)N{kffVUXofIHFc0QPkS|`MQn=`Y!hEZP&F$OvdU7$Emm|Z zmM+GEP*u>yY$re{ZTdz=fJ7oWkVrX$$1%LD0q2*Q{BP3)O|{Km>^Cp$JG1E|MA+)nYmu6v0LZO3)723^7na zoNe2U^FU$-YKK$d>@)}1bmVs<+Ett~L-)=S2&*2JahA<#^D^n_A2S5p^%cu!y0;Byw9L-Bj zg)Ty?vc9FGpeQ)w322Tl8xfHwn=-6bsi%;Tb*^mFUr?YdC>lMZqHGzY>QbjL za)^!6Vevy0CCA|y@)Ktcgz+|K&KxlCaZFPldqY!Q@jLIn{?(=}g~!S<8TdfN(y(t= z_@^Je_u;2s82NcWN`Yx&S^v>n+rzf5{&E9J_n1*6zFIWhjd_{*S=qU*8WYU|2#ahpb)mP4u29#6^56yxZB^+B|>OgFpM}|7GQs z@{;q3acJ-UlH9D%SAVQA(EvmFXw9@3G7qPH^3lg1y!DnDBBmR~frM((XuAIP%B$@i zT?Pm72OjL=*lwJz=9;oEKK^*^x(&IKxY9a{hds}nW6EkQ0;upWz6PJQj zg4iHR<=(aatF-jPpRZZ3H_@7f<=6y<$7aY%ivRrcPe1~c7l=4)1Df8YK|x(z z9pp*7F|l9By{z!advC8?zd53~tO>gp_I66)usWUE)gOPc>}9|FV^zd^V41gr$uZSb z6@2sc=1m(mm(_I8!h~(l15wLx6rG%zlbKt9{T^jQdEjp~41D~-yGN4K6C(E^FS(Cg zc7wL%?RVaLYt_dUm9^Mw!8l@}2cwu2y?frwhky3V|3k-NT}GzFK|1YuSw}W+So_H* zpV%0K$QC!7!O+#v*7W(upM*t3VI-agXTuyYP>4JiSR@Ax3AkwK_n0l3*^i8J>F?jM zRh5~dva5Yux{;F6$EH@<2UJdjPfycL?|t+N5@UPgc_2gVYLwn)e)z#F-+t?cIgebr zdBbv>s}r%PM~G>rT?(^??=IY?^`2&Iy=7Qj!Llxl4=%wSg1hSwBm~#s?(XhRkYIzm zy9Srw65QPhZoxCSeY52|_w0Rd{a8O{o>|jftLm-lUe#}*rG!p$GYV`tDZ?n{{Iays z^(oZ<_VZY5%V;EmP6)cp8qUT%=z8p!#|_i|&S{qGmdcVp5`%&^m;k3GB?Lf|tH7{+ zvi4|ZG&}2H7Zpm8saW{;*9b~Bw?AVN4=&dkJ~jdlGAxpFxsw-o?5{3L5F%9KhxY*; zLh3906e(Ga4`Y$4gm#uLrX~rYw`WH3s5)18)JDM+D7Uf_SCBKvR4N>RkB!1K%H2?_ z8xmp0X#FJ86u#Kou7aqG23G&{v{4eMCNksCCO~Uj#^3Gkf2Z_)nTRs$a3~`8q0(3w zgk7dDj>CtRez2nPGG-FH>GdYybO3z}H{z~7HD$Edm6~d{5Tkxdk&>ef%!-^0rH zHia>#CF9JhvDFCt{+hlIMf8APR9f3uRMTF4YSeGM7L^_EE#n`>;+@~R7wfrII(}Y$ z)!_2+c{{j9x3$Hyg&=0-(ksO(dQwTo`?-1f-tM>gkX>0xEO(xTc%Zw!tCFLXw>dlm z(yGg0-KsAz)5CF6mFg2%~GC4X)8N)R5tumKq*5^&b?Js`=bA0_-@g5{HH5Ruib6rOq!Ry}w*(u$Vk8Y#5s& zdmyX*Y7&t#2KFOWyF?M-*YK9GG3w>Ie*+*oyQ=JGTMTGNCrqkxq^; z5i?6x4Zu+5;<3fMWTJKDOipgroD+9%MG7`35XxnBm6XVqHMh96lv;U#aTGJWUwRUb?=RQCQ@UMABP*`D8n(|0bE=TTtu}EC#>Z4EH&{bIzy6%no_5<;J}h z$V@KK+2x}{SHuHflf@NT!(449oRH}N{q(Fg_$#N?WYH{pqguzA(S}Ky?z`#kYlNI8uPfi zN#lZ6#C_~AvPwt!=X&IB0@@vqmcXO(F#IMG!UEC7fmS0gY1UJ3>`+W|5gRGL(QJ#a zVZ#fyHm+N**)jBMH-Da5>3Xiyq(Jd9ZDwShT5ERKRPdLx2w+j*&eU>V0BuIb03!jC5PyZNZ;k%|!|6+gI{g<7hq=^EQYWYN2`kxzwi z;1P^G74&OnMOA1gb#-iWd|Mn4*E`Jvg>BT3bE-x?0Z8*K25h(py5lU@o+_7gAFR@UZa#8F>k5>VXry5rqA(LrTIU ztP`;@F%Exj7yD3LYxBc$w7rQ2clh4O$Ft{{) zuTEkb8XA%w77m2!**@qD)shO+TaoFVMPa_XyY+Yj>lYNMg;ibF%RfkcJ*3>xXPiHe zn$tS;ntvi_^z}6RtmZ~CPjZEI$eYzf-2GJxGNJIjkWV7*DdK6WEc8t!ZlXMJwXn&aN#oMe#0LRI|E|E z=1XN4*5=cSYb7oKYUD*hk<$vLJ37N#@1ZxB`ev+%bGjd?PKthwi;emPbc)=ctgL|B zo#Id2hIUN|uEI!E*cZ@fuTkR5cR%YV=ar~kvg$~#B6IM>3FPab=P^67*G-C&$d0ww zZjUY5p6bIfzP2D0(pf)S3Vrfhd7x8a&K6Aalb+#QwO*nZHZ%LPpD$dDBv+=@YiyI_ zmO*Q4Y2w-Yi$dxO1y)kfuU9~b9T?+U(3My!n2MqibBPZAbn=JcMY_Z-kI}at#mKpGwjj~er()YErJ*lK z983ex3VVoe>xx;7SMbq4;3I!a)x3PftyOLV z(&fxuYlZ@PHN3|M(CU6c^T@1@rg4i7uRUs`QG4Qu*#KFos;59r%S(UAX{v*~XhhBz zayvUTTyu!6>2&1MlI-hN5xxM@!&47^iZt-+Ey)jYcr}OofkGb9v&Yqyf|jMcoRc6!_zG}TJw_$dR{)|D)tt7la`TH`-Rg6N#dR(d+x+hb_Yb3ge~S|z&V z<}Cj?vE#6vIN-q*kVt9p8eWqsx`3aIp<=kT|0El2-0DzW^XJ0qM|Ewhvg^!GIeH*FlL|H5-^H>P=F3JUk+|RFQiKhwVubwm zCl%IJ8a0d+`D_Mb9r)7g%pI)`A(0!irfw_Qcv%_efFGw({Yu>rZub|6C|w4hMPf~v z+&ikZrO>}!TMZs|jWsxn@49mP^BOQS(jN-V<8D{&!2m)I0WH(N^ftQoZU3dc5TRp=b<*o5 zuKU7J;Msrk3FS=Z3P8pDT9k+$S5-dI^pmuuUKH+JEjyZI@v64h$;jd{}8{9KDjL#{kW!ahq)_>KR zpnGD8PY7871ZGKYuFX!PD;pbdy=HCh))71dz_b$@H-`~#6mG!hXCI$M!9?EP7p~ay zd1Em@1;ZXm`{KXrM%0n~42JcD6#yS_HAS{7oedtdNtE~e>}yseQoj6m zJPv8aEScX`i(?TPs~S;bg4ONNYSO0pR>i2j0d@&O79BrpyUOx3@SbFXWTHlv&KDr8 zP40KPGt%*D<*Hh-8!at&w9UEPw<9R~Vo~UiK;~OC7U~2ee^35icI7s+bIp57xj7gL zPFttOMI+Bsg!boKgeqJUUZQXI^^w8;T_r{9y^6n8!;~dHz}WLnib}C*czxL^`z6CI z<$SK_E@xYY^vuprx`ex+KvuR|3>#q_oNZPXeq@Jtj0*Pjysa?51s?Qjp_SEib!{3I zhtf|ZjeR%Z%38G7?~0yO?O*Mb-*kzl!>emm!q&OtLdpyDq1W$q8M%{ zA<>5L!@9Y}ZlR+w?N6yts( z#gCen@l+-y_13eP=dV4tuUI)(hRcoPDVrymnzC?z+dym0I8QmnCufVh6ti)$e zTFs_;B*UM^)5rv<=n>=l2}{F=CQ^=8OSo>b5jQ&Xvfypsr3?Bv#j3$%SaK)&j*f9g z{}xJMm3mZd%f%Rx^n@+C$VPw~lfAT!ek)biJf;2A@dK@3Pk`uHm8S$bJq%r+&YlRY zIT}8&{)n!Pzn|vrBpCgR!B<`j+?J?ZgI5QA(Hjua|@o z?iu1PQ%eH}tS^GqH~R-4-H%I~^DOt1!GBK9KA34&*BMc9zv=^9A}o)Nf@SD%X?)Aj ziIqH_b{6)N$HpY@OkfOujtFD^Cd~fNkVX@_5^F3iCt$L!1 zn=iBP0AJ}5-t8ZGyO7yC(T=ok$MNvniVOiaAT&#k2J0}NT3RWoA`2@69a-b%WF&nWA9|TKtpC}>#pwOGn9F2DC$?> zpRA6fVzJVq@HkxQaTY1T7sUUYzc0?O?R2v|{aXt8%q2$8$-ScC&>>1>99@d5f>pZMz-N%iS5rDzADc>F_jb5H9ki* zwjF|wNT4=n>*L9LVYj`?y1HpzvsB)7kejr1b9g6fMZQEO{U!57Y71HQIUGl61YPBs zI?U1`)V@kn8Q`zc?}D{m4>_5nCb||IITy`T$*5@u`>!4Aw<-o%zM9<@jw-Gl3Q;WV zcF|RfIweIsb8iprWYJ&{o9i7ZDZldR8m?-xGR^sqcn|V&d#(=NVNcpL;wGb=cs2y0 zNecNdnG0nIm8iTVcC~6=)kTYpXwoV=V!x-rQ<&nnL1U5HCUA5VF6k~L{) zN-@5X(_efRREt~kEBy|%t*ht-(}Ra4P_@lmQf4V7$gN51q<^AKEflR)oBBU975DR6 z8|v8GR5h{6pdIF;#ncQ0jk;;*qtpc}TnhY%W`T88^{TE~peJRVP5o1{%!flNWDz|! zV^Wz}qhcM=#8-PXz{aKWr$i$OJozIevU=;Pd^a>!#Tta;S>CV?uUJCor=-{e*pTnr z(IMK3!F`?7MO&OruO}78N9@B0cJoP<;R;^o}k}$$B0a!s5Qde^hevH=5#LUEG&nCF+Z_M6F?eo^h zj!H7JEG#u;_XiLPpf>w+cL@DTM(igdqE*?)oVfmth3YdsAN!EUdh_2W?0-}-=nfBY zgFbp#X}G|xE40T=Oq|WNYcRt0OCQ7?gAF8o4riChNJ&|!$G*TfY}RkYBzK}#%R;Fq zc(6wjEKPumUrgF*37@m0Phe;C5L6wX`t}nWY*eymHl>Qutt%?zfdqL@{LRxwr6uT; zc74pO{E0Z&J&qzBHab%Y-S!D-3irb_r8HP566^Sjl~o-)G}of?CN|#cTs6m-W%Us& zdV`M{fZamuL@rdk(ZfQFwgkyRDsvh-+CkbOQt8I^NHH--Ejx{lW)Z6M-fsW;!GlGQ zRMHXCEIa#3MHyi?3XY5)$dl8t}nK-5EnG&m{h*FT{B>u9?4Ya({BcQI(tj_drX zXum%@jH;=mr(qH|zRy6*=VP;D|%GW2wj?JxLMT-u`8 zM5du+r^8y-Tw2IZNy#eAu}c4b5n3QEGP7TJTtDk;y8E4nf~eTBj-W}K&>66cZb>$2 zE|B{Ha*$~X&*>R8xSYUfgm|F2UM}`4>QGhbSItES72WKt?lDP7CPp`CH zs;6gV!D_SoGb^?&Ud7N!xWpX0%bo-^6jIAR`J|$YLmgTO3cwhS3dbOar}MM=<<>to zYc;SM6-thL0>?~LCC#Kn5ep&|DSTN9iWOzLw)Ja^v`T4Pm5sibOGic`pHNpAb=;dPQZ0p?xB^PeqfMWu4%y1qfY&v%rvBu&Q`=r5qo1>Mg*uN^vb!3nL(G zAJb;y9Tm=%Vq$dCQ_xlPNnak;Zs$*r*RaUUrLx7F5%S$IRoBZAUD{Iwck}JM4uYey z+iFbvTMt{n-DNG@%ng8C5{_iZvT7@kr}t7?5%!#QrJMxJ*rQz*a8i<%`Ur3QXK+aZ z<|7_U$GMfo&0ch#*YoD02j6#I?ppTtPjRGK!ht6TB^`V7^$q=59%7@`tr;2*Z2q^4 z`35MH(1;C@CoXFML7n%T7uUe&b-DDe^uLi~-5WM6Q~X!IxTbqvM=fbbel#)6R%yqZ zEZ014m!!d9C%Te2c#y(QnzgPQ>vf&R_H@3O7<*%ojb>FM;guhy^oWo@fjnctRlpnp zio*fxsw&2(KYP12BBphMip+I*&t=^9m{n3cfjPX_nJz!OE@YTnqF+ehb zAcAFnXx}toLPnv_YZdZ+R2Hk*zV~iIdGBCjsYo%lI9@Ue3&})QSZ~Cq_7hYNwx0F* zxdIm3B@^$^k?YO2;!Aj0$7n7`{?v_Jv zvG|{5dlL3}rl|>H=)2UX)0kiTk&&-Wf-@i(^y&oKdC>sHwKT)P#U(iu#1RV5j>(l- z<*dxy7W2Oz6Ovi6Ka5K~@$Hx9vcU_#n!bg)&+K zS7$ZibK8vvJg_a8S=uAd;BH$^$2O>>cmox5nWH|B^L-%%l~izx(40HDC?b*K2hAvX zPI$`;x=X6`$L09i>ON6mg&^o!ZP31oI(Y2z5ifZ(CaFJ6EOPfW!nc8v^BHloY3-h;#)CfUN>BzwGF{oae2!(ikSALMz}c`g)r zKYcNKOt>kT-#vUTn&$dcYbh=4m6%@4(WPaM%NO*qYoeW?O&glkE#vtL*SO-KviiAE z_|{l2Qj{oDUNGH7G$T{(((DN`@<&eeMuT~@k6lEtQDW*JbsKcS=k_eVMcDEyyQ>hLWl48 z?&5OTYtC6r_p79MUaG`8B43w(_7|QSgOE^XNf)Rvhv+woYj0M9{Zn${7}^;6sF8cs zR~BweB5YVWnCCw~tmj0#TiZAB5~WU1%rw@x>sn`q>q#O}KG-cAzbZ}k%ZBcM3C`&~ zNVeyxqrltk zW8ZB@%ZVw1ijM0V!iUJm3b-b*n-JE0Txnq`*ylIqA{!)3Du_vW#Y+ z&Ed^=R^ZCH9eOR5@=Ig}r-YwZS%I-C~7$MKMY>HI*IQ0FifETyc!k1svf-GnG zY~F8Dz2mZ&nXty4XpkaHaRM}3*fb5+bf()|Rizok)Uw|)Xy=)VX#)=G7~tj>ZgY!+ zcmzT*J8A7$gdEANoQ%cQMR8$fBwD~Xsb8QqVl)vQW@!(%_3Fdmx2>tEyO$7?vYc*y z#ptSa2ae;#)3w?T-F@#R>wm+Tje+O7+Iy-RKLP1L4Mi1_ z2Yjb!k%s#Ew(L3;)af-}Hom`-(R`0tiJl~GrZ|9RA-wDUao7F!BYlM*au7dIsw?FB(ER`@z|y#$UT&B|pIHuejJ<1=3OP{{@LKGFFszphn`0 z^PH2FS?@hf3;SK(My*L!+iR2!D7vJTNo{u7A1$#h)m|Q-nY!T9U3?D}BEt^keoxmJ z-hwxRUJ057`re(r?vC@+==-ZVoc*?vETdv#a5wbYFK8PeqC)yr&L5Qea=Nz|=zHPF zvly#}+a3|Lu)Ow`8|ut)*?Dc@DhEIw7%?Sppd5!+<)6fkm1oU~)f{(l=gNb!xrx!JQ6IuWJw!ixjuXPr}|5<#fdNym-i> zzHprVhY>R^m!tivusD^jUCJ=MQI?W>qw(LjG1BV;!@(t-<>Q_x*3%a02o+gA5@tai zONV)xortlb##3EDv3-P2M{~M50YUMNF^kX_?Ep9&rNI#+EUl$)l<#8n!cOs7QFP*W z*Dg>S{c83%L z`M-7~ufLKEpboJSSDNu-Uz2mtN9^)KNLX=1g!9@R>U2m#1o-jMmPw4h)uLT7>2n*- zfj@9fJUDN0(ZLjr_+FcF!j2xeuzzHy8xrOt;f6*K>mi$&h)2t(wv?fd{XmXB1)wkH z_tJ4xqTaWL&dnT#j;DGh1Org|bFZYQrQrdul?p`G-VIKGXmQ@KdQPV8RR$S;%;07C zgq_|Z6MEV`7SZtcPG~mJss(o@8UjAA!$T;AMBREe@2hAJ`WZakU{#p%6~HHS(4>SI zg`W6D3c#;tQ8R1Sly#ObuC2AY#FWAEi|k|)XYjjyW{K1MI8J7FK+<;;73&=ZN)!c*He3X+0cK5N%7keLBPW<(p1ckO6N7Gf~Z~)ko6#ik%jn$!&KxL9`e`J0jwj zYX9jEU{{1!n$>YC++=rh{>s{~a_~gftIxAc11_e>3+9t^BD|L7>H=}MGQq?*Z`X?n z)jm=c8V#a#G_lWt91r|Qv9+S;*!<9;lM;s_h$_H@w*eNyCZy^3!yr8H-cj^F88uJ9 z8Qk2Pxy`|H(fHHwuIx>-vrq!x3+zp2jIh);wwx*2ormK$M8h?_X{0%ZhXsBLD3Fvu zZRAULs%@F?A(*m?Ve zH4iY_D_Koc-!3$z15Yfi+sP7S?8ME&9)EM$eaQZW8hv-kWtaE?{Pa+kM~^4Mgg5|+ z9x<@hp@s;oEZ%M{+%pOTFtDLRLr4S1a08xVD;os_=Hljmm?J*O8Z`iGdbZ@)<#^z7 zm&Q}~m}IoNx3n>@M*KS&{*Fvg4hN&L%{Bdfb(v8OUZy%2|L!zEW*!uIMg*g7rWG25 z_u7D1heix)I+`_*4~`Kril{^cKYwD&*X%x%f;M1;GiE99t59)DlqE+6*t+sAYfC0i zh>IvdcHKFrkx>BjKq{&C-f}zK@@yP8(Dc zAp>Q1Nj63#d`7s%j-#C$(qJq@{}`VD8yBh<@L?wbWjyjjeUq%Y*Jnpqr6?+FTB>IZ ziJkC~I#dMfM7Hs`Pw49%T`K)q#DgH4v9_c=)FPx1c8x}fO_BWN5Wbl;<}Du zo#>&8?XU}j1j2N$k>Mdg{TH+F;S2&4G+PNBkDIOtX@|vzEVsa$@IWx%0naN z44WA`p=Z0%!m$1E5FEtAZ9VR^4Z(SY*-4t3Ym7?27mkWD*ecvq#!H|7efdQaJRL>vfhB~NJ(TDBuce8Sq8@*%^sSyYWm~&fgrzUwF z=ZNtm$gyDW5clYv?JO3z4_L^ejGENn-dDK`!p5vl7%)>~1$rgU69qYQR%bg=*qZf6 zft2g$z*WItG?kV8z3CbVnuL;I5cQxJXAUL)_AF#04;1DUg~x8}SZHMj7WKtbNqp== zD^?vA`K$Jr1PW!L4P^U=-Z-%j4!ic3q*nY3a~A{TqK~Gd0#Cwj3&j4wyeuI+)L?+$ zg%w15;|cM=(;4oT*5Neo4u{1HQ{RL^p@$Mw;}^Xpwy=i!_;onKve-3$(@b-%x{(t} z2Sx&Lo9z6zIr&9jvVzS2grxf8cADw;R>cTo9f1iCpa`Obv=AI^s;T9$#?X#OB&WhA z(t^d2yy?yRklC#wad3I82$5mQaWE1_^U{K2>%~5*kqNlXC|jGiLV7vgco0{kV3?Pr zsG<#7#`O(>krUC%>X!0!pg>N&exx`-!?iDwM4;Z-#8Ykr2#zH1RLbz6U5R5CD0JT$ zjv)tqWYNY4kG1F1gqHL(`{IJkL@6n@tMY>!VahMVzv3MRPSimMe&AwW>lv*pXbU*0 zvV}2ReHr_$f;Y+JV*_1*9d@{#%^M>^F$s;Nm3U}nJf01(wG>g~2{hh&$w-MN`=P_X z=gWm+L24Nu_U4&6CMGor!#N-nLHMOSM~V026~B=Bc2V{+`*fe)N|7hDa@y)a zbUe=oVN})b$QRqAdO@GGV7fAwG4uF8CCPs5nb}V4!WopvjiYr^iV7*Vvq>LC3CxbA;a^v@t!&6duu$rMNwSOA1R$}D2#Ov^PSnPzlAmMK( zyf7V2GaB;aXB6(07tHumG#FiADj0uz#3z=Ije-ZMP5r!F*$`2m&Ri6H-boy`oQw0z z-i7Sg9u*frSnOYnaP-kfi_>BxN39ZLd`7EjbRh_&OohQ^_18GAk&liNXr+h^7pm+K z{+JggP``3zJe0*L(Dt4`&F*SK*qM|!g=#TO?p`ZuT3X6;6n-7l?6V?k`x{eB2zN|1`Wn^ zSZIg@tA2(Iv=D0|I0z!W*8j%N(OMAfKyw^ zBU|SX51>2gu#$EP@6gb;H&`Lt{{+0s+G^%G$I~7{iTMv92!E$`6}@-xEf$y#FQ*kQ z%;X<9dLpbuYE;KILithv<44(pNBID7$Vr}y+$EYi(+a4+ZZ z@T#(+`hHc({;tAx4w4Ia+Li-1<3GW~?>%qI?_>Hh|gwPnG^-rVt4hbIJ&q z@uHX#4gKT{+?%GXg*)#mRyfuyI30Y8J1Ky`g#suos|$4km~Bb|Lz|C7iia z&Y^YRMOv|A7<$iXbraRiGCiyRp#z1TY+9SJl>Vx1TU3Q}BF`=r__{*`d)G%;rbhrB z{4VsLH!{Ku9fNgg&moIYchRCwi*14@18wdUibg)gpOK=Eo?o@KX#`&cYudHnr&uE^ z*3q;x=Q6;PB$|~h<52@uv7P*(-{L(&Y_YwFAfrV1&zlE97YcH{u#Nsj$A}r0AP1#P zD2^H>E)Z21Qdu{t1eO(_q&__#W0fkg5Wji3aEV&v8=jsgEI3hdCVI-XLyuadkSMB1 zdP#eVIx-`61^-|AqYz&r>b0oFZ_7@cr(8W(>{z62Zo$>_jmLMB7_M=npQ$V)uj_F)Iaz%;0 zjYI0%dU2dbMUnXFS#oyiY-csja8y7W1POoPm77RT#+rd zMc(_YGmX~u9T!=Tj{U-Wf_)$kJX`?Of7#n!ABdd2Z}Y^BIQB4iD}aINdBr@fDTaLg z?Fhdl*I?Ab^CwNmx@oh(ek(D3_d1pK4q82V!Pyo}>$vs3mmWI)Dp~91p2u7bfHrzz zE|cBeW^gdgW5cyoO|5(h(k18%cE#}^yz}b+OVz2%*AWIJ`RmA}=xMW75H{;1PEOD~ zX*!D{oxe9U7O4eLgnHXUK#w))3jmKka@M(T{-lYDwE|8LJ!;QMPO@=fEs@>6p&B?c zeNKGbyiyIu0_1l5-%dd>pzGNi_~saEfGCewQIqlqeeLosM=gH2 z_M&ms4&s1U1K(yy5&xHrP$1>K6DDuzvw{Xq{+yg2wTB)$n+h7dpq!vHYqTrPp3}lZ z=X`R?a9f)+tj+Pgyv)nyJHqdIDA}?z-Iw;&qy|{t{m>Bi`&DsloRr{L)eZ165h^b#x($FT0R9tF z|9y$4lshvBd1i12XgsBVoF{GD-mazNkM$XKu$^Fg=y~s$-~aeQk?sW3%)~8o8`TXE z$p$fZ5q8AQe};*Fgo=L%s*&DFfu!?YY)Cz&Z#5MTvrp zMI)1N;ApEBmdNrnm7GH9YJmYaE%n*!NuLoK@|IEe~K&E;QzE0%=Ee5Pt;9& zJ-RMHn&{Qp#pTN}eifGk^H_ZSnWv+pk}a}Pn-UD>x=ZGfJRJgVaZt=|yqFtk@}z-3 z$79qeSqF%r*j}*PFrIbUtvfaj*-6y0muwwYS$7{H7gCI{Slzp~vGdg1`v>^n?GJ+lbLAY|xg5(a^caDzk>TWneAUp7hCq z=DnU%!Qav0;vvC`GI65g0$4=cZKSc*wAvzpbLf3e}TapEFLRAG*U~L*jOi)wb<8s^wa9 zDUQ_8d+=cR&8_y;N@hA}Y1gS;$U*RITk@;f0X$nmP;VgKe+FQR(BEHsA&T?&Dj>BDtU1>(=lsx&PYJqNe|jaeMN>>6&1T zj;W_kc4DX^Nu4L{uRhpda`gWUo1)N3YX^T2NLcY>#vR-V+=jL;x(|m^$HvAA3(rhT z!r(;%oC5+V7KHO>aBtVbqmX_}3X8oEaok_gbaawPZP7;V$(f^lMp@P;K(6)HCUA$M8@n}{O z#~tRa&m^nFYL>GWbdr2T%a*PF(I%mmn4QRtmWqt~)n9*70S(fQ@Tpvl%1^ycDpt+^ z=DPB*wEf4_-PV>vjYbt85!i<%Msm4!7Bw9e!f_kRtVdQhJaD1EPeTbG?qw{t9Rc&7 z7{+faI&!4Ep;$I=#_8_qsi~n+sm4f7PQKDxmKU%#J6kY+f*Cxl$$s_~f`2Ig`P&CP z_Jdv-3IJCdBqEJ2EH0{l{aQee9yBfdTwPP6P&Pkm{jFPcy9e_>E#m4^?}1Ckq{YDo zbOZGD>i)zwpD-vJH}#a!_#UH>NHWpe=RdVU@!dob-0Jn%t1zU1pj`yj z6xo(ThA&GUTFdaSyysuZGs1`-KQ<{tA>nHuF%*cfZ_&t^3!) z?)HzfJJW8K_@1s&58iLY#*YQp&21J!{RISMU>(0t6C%4Kor*0au8+Y_xJb9PmyTh< zM>h}Q2hJ?x*gE2S#6}uJOFg9e?PssCY=9m-0s?{$b*4%-3K5YW^YK(?@^AeS03<{|CUzr5guuWa%}|&$7VQSR z#qnC&Pw#fKrYH?Z(-Z!7TM5I5B;IxgLwhJ(dW8&KGQ*t6A%nzLl zj^7QTiob~>qOzw09;P=w8}PSMU}&{4y3m8P2%tYO0+!|Z>xBA);jzW~`ueW=s5Y1@ zP|4nl*@&b|-*x^C0QTRvGA>?b6znr2p_UD7nn{+w9aptGQhQISRBUzI`Mq^& zGoTzzkO7}mJ`hMc&q6IBk{fE6wfT3^AW{lu?-@CcqQ=4)8vaiD5r37YKfI^*)(a5< z&x_tq<-9@T2Ti)v6{?B3&!tyU`F6kKiSptR(y@LYk>YDnrkk!M*k zq%}8r<#=qer_29Jfk?upZmtRYV&--lE<~&UM~PcP92>2_1D+4k45u>mX-0r?LA@EU zRDi2n(h8NFqas1aWE-$s%IV6Pz+$5XOIE<1`q?6EsY(!(NMiKK#0@9G_XpTMva?R) zuTt3}yCJi}M}0A1QVH4bSU3~KuL;7HUnf$NdWi~dNO??}swu9%>KCef3K$)>{MeUF%n89qDCMP3yy5;*u|zx`XDiOA`1)?M57&Fw{1y}Gvqe&W z5rsIRS`+WU$ET-)%Wi;+J`}WUhtY#X>LhA+>ACr=D7J6{a=i;|J+y?aG;~t6inelc zl>=;*zF0?g!owfCSmCIoG@=uX%F1C2b2}mNK7+lkYEHK!+sFix!8m|OkBY$d(O0yg?Kl$EeId=cFo-fS-dR}aG5#K?26MLSmU}0hPkwV^*t~QvX z>@pj4daX5Cr|G#Ml}(>G-B-*kFMBF(dG^K(@43j4VFNv{z(f7l(1h}&%2mije$PQ& zw)x1_1kDYKxLQAu>51zL<7|;f>N^#2b^bIqh~cVLAXgI9cS_>woe-;t+k_l6Q-xOg zg;x2cacx3(%_`T-koXk^hooN^#o7ECWX$`U9;a&XWri=5Dh#i*uVg!rgy6Ly+IZ!E zkd@tO6PhI39&=(qAS_VbGnA35uCzjJ5XC}mGH1v0uY!n51*=LdNd?j1fd?DxlK%+( z+g5S7#1(qtK#EizmT>YQef;1^z**tf6VSArugOk73R@e_4vt{@7a9154d@$~BdBCg z%(mXZ>p{qxZ8y3~vlbl#<9CZau_mG2Y6Co|!{dCd-JMBjr_ppcuC9*#0SYmU_~GeK zt@!89w2IjyxBz5xN29{)pB@gU=w@x7-0p)DPSA7Lv^a$+qQNkIx0MtD-q3`3`IQO5 zDM#?hdIWCZkMA4K<1Va7BVAtBOXgyaX>j|X`{|Amk<0#|&*|5}@K=OKd7p&Y$vN2W zrh^H|<6R33rzFH4i(rvg`@ZSqZR_NT&autRhHghOy(F#t43$$V11f_PCMJdcxykpB zGy&p0+lH{TbD<19VkL}v{8esm6PjheT}otmGF|twX)NhbjQF3YHpTZaSRE9R$+)GD z+N9=SAL5i_NeXVd)Jk;N1Jve{TvhT&=150y_`N=-TFkIq^MT&}bfH33z&UsP`}oOE z--{r_Osgd7F6!o_i~OtIAnv?)&b)jV^{afO3L&R>Q4J*GdNF~@gT=~i1a(aL6vnnWy5e2VcbqxW z82+CZMs*$gQilWq1Rylxke9PC)yF)t-;|^G(U%%$%XYe6Lnc%$<3 zlX`HX{hgIz37SZqA7HShkc8;|OB_hwE8rCS?_91{(=qr69f1SK&0@R8nQ!+lvlFYxVgDhK#e&90S|niM;AI)-VYP&D#zoyrVw0Y*--!P&rTt`j0HLZ z|MkRPTDN@#JbOLX_IiI}8EMgj-Uov9ssqLP%-ZQfNkYZ$h``C@Q)HdZ2N7K5Q;}Fy z$y>ppA~#J?pn*RBPO9F%O_vx|s6HySZtzt9i#G0G@_@&diunEMGQ&qdDU7!bDQacp zx}&;lDDiKAW&~ju%2C&EY^ZzJT>;A_M+s*)614D6$e|0EQ6zZ;z5zqK-h`mhc38v3 z>vq_nK{YZE$`gJlPZ{d!9~>hE*4Cagnkyx!J@3Pb3}QY9NDU=G6V6EidSkuCe!bBW zgA4@)C05cD!k*^i<6~lCqN4JF1Qr%{b8{0y7Wi@u{UJOotS|WCg`gh-og}1X@nc0o-}P6 zW*m#6F4n{CZJml~W>O>=s%&*5dVN8N3W_J^`wpd9p`GpO;X7B0B3H zo;JLX-XRUkp*q}{HfvK;E;+Vd7K3Wn6VRJ zA}g7P5g`c2;zoRii)(3VIXyj1ppxp(!yqN%v1>kX=HDJ5-Fl1CMLKY6Bi?o(L+1OO z(R#WY%@%Opyc`u31?lvotD^&H#1k4Cx}!vhk+`c&mO!!%iaIL)TGSQ_dvGKc)x*bg zVbEmtRaI5>%NIBzJdku@aY*PchZCQjfyI|A^g*hie391^C1+=6dJ#rQv4^3KPP@e< z5gDN5fFni6l^i}BktC|;gKDtn2QqC2g1^Kr^c-0BT9W_DiQZxPyDp%7^BT;V#0E(G z0{1Vl_n?IOy^reivb*jyE_!oOhGnpQxR8SQ$X#|7CwFo-h_|$_sJDdaiRngG3Dj1z z&_NjF7u)dRum?M{IDso0eVZHPqTC}N>b(8-cS)gn$-FT=q3B^j1D}kU7NFV$yciu^ z0YWL?zC?<7tJ$HeL0|7|^Vag`D+l$=oylUrT#*kMQl@-JQWfXb^K^3S%f5N!O5Jjq zSC{wfg>yH+r#*K~(>xcA0=6A}7n`sUqmsfDz_lhE354@z9K~{B0D8v1J#}CE^vylIj)*bcs+TMqpU=?zSjq*?_%bUl!*sQw_%iLb4uIt_D(wsTNXKUud!p z6U`Ca&vSih#|Y0-5{iE3ahBF(eRKi}WImp^7LSipkkede5f_SyR!cl1u7 zm}3id+0L*x=$m&oD@di_WzE0x{rD!r(W6YvpFO_6U~{Yo@Z`SDA5;Y;L3}H5n&j!7 zUoMoP4wzfTfypC2C(`G`0^-@ntG*{vE|HsrsV__7&}1o3F}6bsnwtUZ?U&+S zro>@KZ`Z(QB=yM0K8!8wAT`189qUA?*|oK&y=95YjfL)O)qzDMrY*;f1gHZT9+!^6WT$T2A5nWf&FoglCB$;KG@|5`-wK(yis z+G_5PVP=R0k!4tSw%2O(z*MnT`_o$0XohAJn~QxGgju+UYtoc;DVm<7b_ugT5*`2D=u9QasI+MfbcRR@LUOr|C$ zYu^l!-MGDbx(ZB0ONC+x3yGMRFsxtavK64Mn+#UGBB?&<7RuJi9ezonY?<1 z%4ly%l9T3X@KMy8yCFVZw@CdKm@bp_Iq)6ccH_n5iwTzj?17Py*1vzseO`V(8TBv_nk@)V1lD>68Yrz9dO@BnTb}*yTMAnO(evGZj3pJY z9Ts)n8pwUTU@c^nWbgv7I-yu<$_@BkE!drwzz$os)NX@MH~X#o`~eKQ2kf9x>go(d zrw_PUciHS?pCCc!<@V}`Fvdh~VNLr*jo_i~peIDqh~I~;hm(gus%mxgo?$;?L~fvw zh$I$S7zid1`=_2Ewj>WMCsLJrUb+UedimbLB9U)EL!Y_3qc)mAq7Br-TY;6x_V)JU z_JWp{mJ*ck!79lhT4G}GTYh$S%!&HCJHjLaC%X8}5s@{37vvgy!Hxrvw5&2-aAG6y zFD>nD)W=)m2fW@375~Gi;7pvxdS25{*L*o^{4zTz z2qbNabm&$>QvZsC^qE4%YozL<1v{hno}kwrk5(Qy&-V~c0i>z zj}aRaBa4!6&(9?fj2k{WI%)}1BLh%e{enXY*R`Cwg7!P4ehrb8Fs^ZB1F4!%U!MVk z!`xOp<{0*-v}Az5wWnbdwoOVZSH#E18d2;f!wDw3Q&4&N=VNY2G z3YFAp^!L-|MPTX{Yraw-_x|b+v4t?$hpdIN;w$oh<}r)Q4zQe}KGJyf%W>o4Yy+p{#@fUFc|C4t#omfxT8dUdzdKu6V7D&`)Ss zyoIbI)?O#Yq=b*8oGUjFq6DBF(){V7_aR8neQoB0dPsId&x7(cx&r}3=)iSCg0SNV zlb9T%ANGU>3hvLopvrZaKmDEC+Op9j^K-DWVr&qC-|pt3E60CUMp01m_pt%J5jXRK zb!Y71@%1$jq2Dua@!#Yjy&R3@X~Jj>%0$h~&dj_6DqI~RW>zYDS^ev&YzYJJ`X=zI zc?S?G`6J}z<@wS0^nn3?`2cy1y!*Z?>D0m`$NWw%ov=t@*4CoJv$hu#!%Vl8cV|0i!vO&2eOT1oo(*mZe zDVV4WqgYN_)mwn6DJVLYyMI^emjhF_acUDK&oH(O6rA3^4Ti;rN5@tfbn@HOqy>=_ zkCBszf}{z=_>^ikl@t{6$RKAsna)-Z(6=?eExtkF$~M}vMismSk3azaP{C{Toy-{3 z6$w=nSD1x?&7x`JqaD^Uk}BU6;%4!E)xNvVBWu6Xt0#u z0pLrp1HK4!eE?VknhQb$Ws0WrIQ%5oVW0^~M5d0=Baq(Q*yxC9dAM2vkY*D=MtwxE z%G_dlV+L4}xIp3sg@qsgylxM{xjpTtm*0x84~BdT@g^oF4t*|rw*C&AIWjKNYT12C zBZ*%}S2yrHb1kT|;kfCbBj>wGBhecWc25R zBI-X$tL;i)`z?xbXwQ44)5p&D7$hr_-#-zZ)He~AjzNGlzE2UE8}OIC2P^FBv4GuZ zm>`lFEkA>Fo-uy_Jkd=4t$E;s$7qUt94{y5UEtHn(~9?Id^+BkdXx!v_z_{)7KIE@%gDXY+k|9V#L1<0NdC)-zeDw^C!AiJ`wOv< zq#L_Gle8PliD$q1m%KcJ1@V-~L+KyWP4>)jh~jLjk0Aq*f?ICG+InPD=;46?R`f~v zn#NBHum_=^(IMtGHa2+{Nx+D5>+iC(gv5izn%P)}Xq!k-p&QRF)ZghV1Zm!6Gy}-) ze6R3n#V?xI9`K~?ZM5YJJ5sE}z_ zq-GL=M5jYz2Z$BVLk|k)d7lcv3Kki&M$3*w)D@RX^`=6wUr|$yzy^pOHkL7Ya$)7XkiRT5h{7xZeVv*NhJ> z=fzc#81YA+HfBl}c7>sK*eIpR+eSD%tw++ICG;5drw8T5-WD8wq!=loW8w4arq4Ig zjbf%K1%}ic`0y9;mqPTcg}ZW}6=KXEm6esj0iYepe^@>47D$I)Zf0yueZBnSE%DZT znt1@_3(1%;F}I7omvM9CX5L81!fU3W3J66)(py4Gw@l}A5Qdc#Tk1=kB_V1Q1mzlux!MOtd76? z3BW%*DuVb>W&_%BX*P;kY%b&U)sj3NZ_okxV%Sp)2z~FI21y%^H@#?8!`4K7oM^us z{E7%S;Vlgf4Gtrlm^~UA+T-83b|t|1mOcqbBOopeiI+kXpg9U+*=`C2Kqp<89#0zf z5hlG320Cgmi)78D<)$*(0LBXnMzB3D2(Pf?|HE}7jo<(%K_-N*GgbcnU*Q7OA`EF= z=)>JWKVfhKZ?Fb5Pd%`k1iEGN^s8R1YWvI4fO=S+7c>AbV{i{P4jPCLBS1SlKW8`( z+C@_i(~ByoMpub?Xe}y=SThP|M#rOpOGpRVC#gb4^GgB(0)RUT2hhGjYT#;%4^W|m zx(7ed=0t%JUpX$s;P`FGy`j@Rn-Hb}umx#DI&R+YsDE&qZXvim1fLbP@y*B=A%eq` zrURavpfNe<4~~X@AeB(n5)6F?S?Hp~#Igo~w zxNYmaJ-$6CyX~GwMmU&!eE=6mP&^@OVb9Q7U=DBpaQSXv zGCeMxN+p4L4|zT+VuO@~1ooB&RJyombV2gr$~o|k`Y&F1q)ctZH^jI+KD$(c&*Ib+ z*buWzvhV0$*&!|s0E8BvJ@aW)Fo=IWv`tnSQQ_l?quFZa{5-?T+FI^@h_}7Rf?6g( zGDQ0UkY`X0^2beBfh3Ux$v=lUx7|jJIVFYTzTCK+Gw;7xk3l0j`KV0SS)n{@APxyR z^&QvNjj~Obv*#a2*BE$XpgP`yAthBkD!ZfX!}p3IsAI=U#t%L=rd`0Z$8^Jl&82~% zNU#iG00RC$2M4E7KR_X}!J$*ZC0#$MTa-X**muj*w0v2AmgQja6%rVQcNjc41G#_F zlE&r#A~$UYncB*xu`vGJ+R62n1RjNOTSK?pnxRGNZ5kO(azBTvaKqxtq=c$t+TUk) zVR|F>&;HaSh2xZXKbKZLj{1@-!;Y)79&ARp}E7Qht=7Q1;B&Rj~h1e6o3fW88Z@; zMk8E>>c#8{ zHXH|@_=d3X1ELeX<{jkLF4sTeZCuEyEfPGm7yAWHOwTI@faa11e|seVjI%6b2prxx>V`sU_&1T`Sr<)t^0mT6-bv)5r zps;;BOKV?l50se~j`E2m<@&NKG8SPWLi+^=vRMb~SDlH5$3|Gh&y$#CP z*_msU)&NE#e7mE%6Uhm;g4PD@2k8bPHx&_;EZ=3=9w0SGi-_wW$)5)Z3A)_`Z4k!S z5|&!yCUOz?PO!(S2k;Tyk!wwZb%d1d1b0Bk(Qs2iUq>9*L)Gov?*w zo)6}~j1GSjgj-rsSQtK(;f<0O-iMEgiHV1Yb|C8i*Bz#BzZw>XLLf)$BM{OX!g}-U zTgZ>-SzmyY?@0a1cON9K5?lxMVG}^x^4htkg@^?u7i^9f@9|zN{-bLuJ8w|h(G&30 zjr8+6q3S95^r2 zEUw9BkSOP>?e6$)D@BWMv6INU7MMONl!s&K(H((HL1)o8VU!>mjH7gS0H!|x z^Cy<&R!KBJ&DtPtuLQtWn$Lsdc!&k3O!|n5e?9(CU&n-UZw+lP3;`ksOCs8Oh!)mXxRo2aL%xJ)#&O3%r9#t*h3fs|aegzA zs*vm=lE|cZ`Z1*RtDPxSHB!EoNF#=&--ZgMnfa%9p;t;1@97I&)Ys2{3vr0MYXjN| zmo5>iMoJ^XlJe?`I0U6wvgCwMo$W}M`-ar-uLJ=P2j`PA2yIJnv< z#!Zy5EqeO}`=WN2xIcp{TB1OPB46ibpvx+y#~}1NHsfd|$R?^SnXuIvNI;2x)}SOpea}?f z8I*C1`GAIogiF*EvO20#S$e$6+wR3kA?#`GLrMW#i|{T#B@UEed=OzZYF>w1KNiM@ zy^^+keD$nFx%~S)LQ!K-phL%edG!|yk?kX#ObJjDlty%%OOlraO%aL&kHCKpMd5P0 z|A0!MEc2DTL5+x7lCDua0xYc(OD5}+L{PZx80D!{gjoMTGmR&_h%1k5Xkn-zpHEoX z_V*ouoVqu%n%Muk^p9yUsuiT=c>*^#H-@1HfI8b=67=+p>LK7_c!99bdXIjSfY~wf z?Ac=p%tUfvX$StXl~Ujs4AW}+)ZKaghK!N;`fA+;WQHy2nu|Rzf+vfjy}|jhb!dz> zs&6F%=D2Is={xZ5qAtJOH>Dlu@JsP-i2eur^`p9T(r@W6JACx39Sa&mD?*rQL zj&L$ls&Z&1`K!U$$PdI@@C;W7<_0VTtK}`Q6PLEy$EMH_ejX`vpI=gf0ZkQoL$WdK zfgY4h$g2f|!GIl1^DhRhPft%NJb;9uMC-d0@+yhcme~~&BA;kB^Tg_bo`qLc1tm^| zfn&h=t3X!=z8P}|V;nXv%3}^rBvP*N5nyyjZdSH__0Gj%ZK*e8-l9g<4nwV{?*?29H^uilIK1sL-!A=J73est{@9VBrB@ z@5ql+1%&^<40|>sc#6R=@!ti|c$plMsQb*d`-pPfzdUXb*f-VI)&}r$Jqx2w>RVR;pUH6HlJPMOrG7({+yh;`+Aa|C z=(~^CcT2y1O$+NqN;xX;L)p?WAZl$-Y%7LC8S$SLOslKHJ*S4S*-1?g@JQ;L_FNSz zMG?aKs?c$X$Y!2%t#jN;1ZL$GW>F$n5@solpWXVT+zL_zo`{3t1~_>i5^Q-Mc3E(^ zQxJa#p`vTdj70vO3K!mBV@gg@M0o>0gNQcZ!!@wriCCx#x{Pd2C(PZ+oRmH?jChF= zg})`tj|W*9uJvkVk>K!;>-rdHA?ymE8^k;0)msk1MtL7SM$QI6Jy%y($KQG5l4!~A zV}|wSncg5W-YP(G2mO#_Ku=_n!3pWVuJe3NJ3M>zh7{%_O5`ua?=S!d8h#8 zQJ(i>R*X;gnqkr=zuNNPy6F_qNQY0p;HB-aEbQpmH20wxCI_ELs__tqgqmjWZJMGP zdcn48P$?6+jU+v}_VM&w3vIl0DY{$~bubv;n@I{{@J39oEbA|ZiDYk#0V_#2z{|Lh z+GGOlUD5tG~Ul zAHv$P+eXx*+L@~xk*TcD2t#Kr-;%(QWS~Eily>+%TwVgABV9munpf*&yCH#aNK3c> zovE6wFa!tZ0@1=F+IzWo6{r*|4dHfxPdqd=mUJCxQ(&S?0{jlVs)g-a>Sq~bgxIb- zI>Ao1I<_oN+6&hyU)1d6i|L3-m&b*&q<6WHzbzpgC2<*F&cQKNml6$jvhP0c>0%q% zP7fmzx!hHB6dF&vyB+)IXV9p2@TujZ)_7G{lJ&Ne^y!Xi$&-q(zH6h-mLdP~2Xnj% zCM_E;JAEuIGu|y#GU;FO+A$Y2V!}zDTFWRLcF@#vE5kKoNYom>J^g+S4s-&y5Pvn4OW4@%b~Eptmn_zu|-!p=2ZS!W_0M2+$fmg08pV ziGB{SBauWe4&(ppa$*8q&MdSa@A05l;;5Q&0>ir(iFOIj8UswQ0kbC*8))dat;o7! zE>;PKbycZ$uqdr;fOPQlKpHf$Ly~;f@GMz0?~{+x9DfZ@&_0#fJjMY^zPlCmCa@<; zh$i+xEqiTVI!Q)jq=PwWN|F}B(%gob_xXJfKMjfWmJ*J5QXZ8D<`k_B*JlrOioLe7 zm##)?qrvH^`lobQr^uwX1hsRgN!Dw_cmX_dS4Tn?gJnJqOhrQ?xs}QX+oO^S_<1hSv9OhFBT-$6FyR8z%~U9Ye}l*?in&`6bU%)NYIxaX>`tG-#Rn%~SP*tM%Yb z5KS(8k+9Q)DfFHHzPs#CEtT$p@x^m+f*IYHz|+Ys&Ig^!vlmT^GL%=OFYwK_)4V?g zo{>JXzeXvFH&1qNG(VepjI277ffbt53=0k6F?4-GisZeNLAeVlWN*vgE+f6nljJC| zvVmo2!J@~`e!l?g>;ZvV+^eHXQL?imB{s}VlqZDm>3L}M=60TdmD+e<72$v4^&9#w zuPMMJQnhgbwlLUZXX>Ul$>mku68R?tq~kD0z{{tco1lf_iJCM?ML{|tGFx1XFI@B^ z9?<>G)8&N1DkNm{)3Fh)3WXmozMkvmq^I3n+%J&lM)rR!duig9UtI{AGq0W;$XPar z2U7nojd@?$xC3nLFacmqrD-#e9qMbw1YO^BuD1F%LM=J(s-XZ{1cqxj%z_>}B5e5 zm1}cz?k1LXsEI1^ROzC=x1D7x;Fw3voBp z(dC@xhi?+}0ZCs0Ukv3?1jg$!JuOq1J$xu8ot@?&@ZvtGU>BV%4tJn+K*l#K zQ1~$Retnd7SNTfu(MKi39!O8!bnK7wL5H!(&--uf%xbyrlHW9LBA*SUME)g*tb0GT z489=N6B*TxZ!+4J&@609a#)KUND{WJQ1b}>ZO29Fip?}Uh(pi73QPlg#l)Aym&I3^ z&L9%9RW8W?M4Bn_Kl4h!fOb8%^BusxwcVc$b)InKAS2u1#bu;~L_*uX04jZ+te2OF zR^vdA-Q22{otlFxGr{#T*2>nMQhL+on?=mn%FK(s#L93(zax*>DhcY$VWC8GUt9+# zIzYj~8sNS%HD~f-=PxF9Rio>p&}&KG%fj3h(Px3HSy}ybrta&g>Z)j#_?y|sCKk@3 z9g*Z@x)v&c@fsEZPiwXu?(QT-FYau-9Yyvv?X>oKftNP*CzbiT@t4zIBCmAqN{gh5 zzWg3eWlguvf47J{gB$y5ithCaf>}Uo$d>BRPESNq(e?{4!aDWc*;E<3B=Uxg=G#-1 z9Ia$uj*uLNT-C&K7Map7ShH$j#P+3o<37_~ z<5L}z)mOK#&6eo_iT>Z2!aGKLe{pAypiw)e z459=^b|X>%`1fU z9(VPQ-pfBUWZ^gjWMuU~|FNx2I$N`N?%=1KmIS?(N z3|Ze2vnd*8?zU#^+FB?ZJb#s9F?N+@1oOJQGEiISZN$4j z4z;W@T{tQu7a0n|Iv+DoGG(xshS}rCQVo|azIDQ`eTV~dy(;K38NIneJ3*Piu4g|PJ@=&L$7 zE~zUuYo3gknf{@ph*V;t{{CUWAFZ!&qG86ygi0vRcnW`W@9?4{{B~w(ygMvnS$Co%kp#Y+F0+$M@sWxL@_!*d!`})p#L@Blr-z z!%w3Xz;m{;GIEJg+$B~jfl#4K%QQ2DO~hh5{jzaaJ%76Y>qC4TIn4WFUl(#EFqqrJ zH%Y~J1cIt6%T6}m4=@euXjn$r++}d3zNG{-c3XkR0xyJIgm1Mnv?f@jwj zUI|*X8c%Vk6tSP7!uSIdnCSxHEZb&BQ@7>j)W{LVzI2|TRwua2_<{d9P7m~A|pu+@p&Rl0}&GhkjZv zp`bH_)1ae?p&)JBDc*E+qK2hF3nsDv{~5)6e00!@qcOmvJ{8`K;C{^x@a*x zvJ{q&juDBiorK;x@>Jz=0$h7Pc3PqXhoxpKM8?g+<59~)Yhf1sR!Z=8>K;!V7rE); zET)gR)`mD}DOLl@$Jd*Oayt?ItZb>Rp<#qd6qdkCdSIxSF~T&HG6Ts13oj*@gp5o_ zjqfKa*ads}83gfN6u|Q8)_j0`@#J<65dEh=`7pVo?=ov18XCIDc6ZoMrVn%=f$5)- zM5M=U`u#6ppgeNQ%HXG8ir1N03zpz2{ha+a@nwDjtwY%%fCG6u7z7dwj`_;pzl z1Uu+XH})68-HchKgusLgUYL?)$y#gR0>u{h07CSB3z^13RCI~K!4lhez6%IhPg255 zS!2t>lo$F1t5y?~4ac(1)As7(xJUQjbS);_ZKc@pekk2iAirRPAh<<~J<#bAmG|(% zZY?v2*A(E_POjfOdln9{w0JjZ&zIr=e=rOY08Bq*$)2rv6}MV4GtrzXo~>V{D^M`= z-d#N2teF4Z;NDNPY|Z};40yR+r*b$k`c4`lg-qpe;5R1nmfJRdp^V>1=tHH1Mf)?1 z-r$Z5DDbZ}fh_}6b`(~S1ln|W#=XQV18pu+#hBLJj=%-1V>JBx9|?6;GJ_xrdFjI% z{H>E5N`TKtu6m7gYsi^|`q6@UZw{?h$rWy;EN4YoJe)wILZY zPMf8h^b>7(V0>TW&{z`)3GW2w-Ki2aAIDRTr{13&d0bz=_z*fR0l6%RRL@nS(th#I z_V3-dN4iq2|DIYnw}a(VkfTQKxBavaO@%qqrQ`{8gLxk>#7mt!X3BxT_(J?VXthE( z9o<=ih(MGntGo&P>%Zq##pj?tN+a~9=;RVVE(d7C&9vuU46&{)dE4A|M&!!0;5?Qc z&@=RQeluh$9x0eYpOfCoUS7gj=?o-jDQ)K+P|(6Qbm=%&5bT&OXvZZBo%lMH@zbcl z$dOCR6S3caPBtc0>+LzYu~0fD`Q_qpBUFn=#rJqHwVz(Y|8U}>H?dGgDPfwGj8#gJ zV+v?q)+38Ry%4-;f!0Z> z*YYx#_+2H%V`SCj*xQ_#V?A^|)$}NAX`P7>?|zz?o$sPS{8S@R&d(_{#9LL1fBw0| z%U=DQ_L|RGf0GHnY4w9C*4hT%(pCaS-O0kc`L>Cs_vQX}>6|pSoWE!#EV>RQ>i_?% zXS<0Z!?d|fI2!MGr$1K-dpqXTu+r?=RPV>+_|Ww3G^A;vF7y8W+bSL`q(^0Mn5=cd zhHq#&G^pd3TuU8fL2|Oi?zK07k&};ufTb;7km2^Zn==tSKEwc!7}B?WAC}KqhTGsx zcYzP%EG20WYvB`pxLK7*X0#g=8>Cyy^XvV^F> zi*-Eu3JJ#c1-oPJ>#b=uwW^O_I33Uz8WRL6XXl-4;;q6=7 zvLtSn$Q5-rY?=$XuyJmt3^-9eICF%kmiF-dr<~l(9fQBP0u-i7*troQF_~D2bW1<2 zuPbRKf@zyQofZJFclBLDwq4s{tQPJ+)iJNCPuC;I~7 zu&qFy;e1BQ``kd5_E%TYm8Q^oFwS47!+3tdmvKk*rX$(ngG3^M0;0OF#IuBFk@A(_gtP`qSm=9_o;!A$753iS41doZ9K}}zq{d`cK2ocvB}!r z)lZjSRSE5G9)8_3E|>>YERHQqmj4_KYMNP@8KViLA2>NRY&jR$59?nn;Mt=o%(sAl zt!xNnK4gj*--W{%}x`+(xif30}N4uuo04X#nnBloF! z{_Xj)E1qp9(NSGBCNb{vYJ84suO6IT$+}TaI{xsL$n7gpDKhi84$ zyu}m0QHzPQdmMf?tY}gzK0Ieo;Dm>ho23ibCA3+{{dXSsCXhbfqabi3a2VJkxT4%- z*nOh5!nISZv+eVSzi9Vva)3KyBVq3`Y8GuHk@sd-`JcWLKo={Q?+JtNxnx7CU&c}<1#awQIJ(^eD| z4#-O=RTt`;x%AU&CO4#EVcceaHQsH?i>z5WW%Q}DwC4uuecRzA;aI3CG^0 z^&U>8tg%|{{J}nTq)*rN%ar+aBW+cFJY-DjdKu7=+!Fuy77};ApCBV>pcHO%e;$-Ml&Q--6tI6E=V>~Vl7hc zwNqlTQD)vzRn43IktFA*ej(X3AAn9cxFD2FzgBzA{Q7;l{tlQzxB;(X39pjsTf7@- zHi^TdB3O_c&HID1qsObynTNjk)jsEGg++9Y+bnKFJHz$}RHR2@Wbb6Ip%5|ln6G6V zL>*c#WxR0ffKRu2JCXgxeDb%^YpY(s;ZZ;O$lUEv59No%s1*#_7JsJ*h4^-g)rX#6 zONg#{TJZg;2d{YM{rC0>FcQtac-QYBjGcm{IY8{plsXa11dCyAFp1tX1ks@=F=r9O**>78eg_<7K{$=*1M&9>jeVw8FAJisJ zp+nZ5kdB?|^!&(XjoFwpo!#|NhxL$WUe8Y2OLN3pQPEC7=;;I*sCutnlJGG$V4QkO z7APm?@L3|?M?s&PcU1i)HJ4Q+3Y1miJ0BW0@HzBqmvP_JIC#2*7}x*y+)AIY4+BBS zSTIa}9?9l<f2e+Ti?a`Pp@BJ2KCBFSZ{C3@P0%;NQu?UISn?q$cz|fNC=Zm{E9p?w@vynip zwo~U)k%x!l%;Wam9dxR-`(LScwxW@;z&r(rXD98b1d4`xa@=4$TUhIM4 z-8X368Ef~aHY>)zR-gEcTPA%FQG*6=e;Sv0N{r|I9T>5EY@`D4OupRgGqdWx_lYBvOcRk{{ zSx=DSO8+O%$!Ty*?rj)PqU-Bh%!eZFwyLdb5^`(j4xpGc@n zI8e{JsnMZnTUkiLLHSqpmlZR|4aZl1uuG@%S$g>5g6Y#N>I^tJ;}hhS=R?AWbae5T z=R3ZvCTFPI5F+m0{y`G4EvwzooesUjmppebc5Z*Tie}B(ySdP<#d4wyD*sE`ZjO4+ z{5bd>g9~o0G*!CxxbFRsDg3xe?{KU0UQVuXA}>3~7}j;^x9(+_P1n5iw)h%9>T2<* zY>?S`1=zcNTv?w{zm1)dpS7^;R4`@Bz%+1Rx|${KQ8x81A3HxAvabXqD%2;pk54i| zPBZFTComTzsM3YYLGJTUs4#*t_eX5&L`k+GOmNR;!i0-juGkBADm=fF1g#`v zlLNBVKRA?-OF+@pll0oeWV!6sKPSrO;X)k+7C*GKEQSyU=px0$#DHc5lqxO)_VERd zaTl*rx5TkMo02Bs(C|*)5oA+gZZ4!AoD5Q=q7^TTrng>2B0R#~(eeI62eSH$BJltp0dZ6)Bo?tQrc+4}OT$V|h9A zv+h%=h>*SjX_#7-rFnqx){qvO)~(;xg%;Y#!PV`Votb26Mt!q}FeguEx0Wv6A=%`! z+f?BMHwSbC_R6ZINU(|UV$7JFIa%J|?KtcH_vR4?uXG1ZW{5<{3;VJe&)!BAiR}*@ zl9q3%;ES|7@a0JD@0Co57ZANUPYdBtm*`fUJnn9ArI7RJ@-M)aJYQoS^HuV4T6fGn zV3r)=Yg1hsv{As0c~iVXgaoSzO3a934LrXi#&t6B9+OIOtCR6L?e%JIy?(qq`R5J* zBv;ZUOU)<2U8j$}^zOdb4^Ash49~LgSN(TWey#plsIeYfTNdE_9)6m+U9ntZw9-(h zlvdZ}1Tb_5-k*F`Wfzd z$S*BFD&4e$fjssPE$-dC4StEk#1xUwW7_o3V`w$djR?!f<>`}XxV^pAl05B6e)d9v z%e9k~Zavbs@~DGI_(b*}YBFosImgSZ2vzy@8d*I!8UJizb)8P&+#qAAciC(wB z3}dl+hlS*voSe+eX6H5O$f44|{`o%Wuj;|e+9{_OCy(A=JL7c$g*K9E)2rlf828^W zpd@TMF`#fJ4o0J7Ms^k=^wbv3F!y3+DGDb4#jX65A^p1{ZXTUJN3!CX;~y=Te>nw; z)N2eCT>o|oO^5Jo)pN-au>3;v*w8T{VvQ?K40`!siBJKOFa=bZGTc3TSO2W^fN=QJr%#Mw3fPrf)&!D%H!wipLe6VOLq$x84Iz6A!vM+!+BpoF zWPtSLCGn_Y94dSLs%6+A{i+JRt?{6;&?WwL&ssCrep@eQJUI&sx0E~hLMuSIa6wJq_eqMP4s|7b%E#DMyy@eo%8^hwQfyfn+YZGN%-@=I}U z1hm)0%;^v0hD2tr|0dZQ$T~di7!z}fQ9G|E!ry+x%cZL-8Ga|RT0FO&bpcxn?nV2A zlar+B-F75fv9vpjWC_9GxEFK@`f5*$G=i6hiR`Bl%ocoRHnH8?B)1VRJo3Ie<(L(Z z@V$EzF3&H@vhq;dmC%5zdT!cE1!8(2Yf>>xT;;)`nR45wg=h>3}G7NWcxe= zaslWIcV(V#$ADlT2GTPyNYBn*0XC&DcU<=M_5FL$z`&zFYwhiPWU_QkfO8a(L2h6f z&w)CCTO;{H$Hk>)!NIJ~7Ppof=Z6hgk%5fP?C1p9X72w*9IRm!C{lD|KxQ$jcetHU zrq7o0C1aq#?M-R|>Toh{qd0n*9M)on#24<1I;e!m|GNZpej~`TW!UU|(#{b0>D|Qb z!bG>-BZ6AqA$5IJ!r;!cVpI2b-B`((bgAS@u+*ID(M9Uwsp@ShD>ysnN@i*B=|cDS z6zw`A4MUq<4p~6MW3dFPxb#qtcZ`SqYeKJP2H_2RHDrkva~BDcTrLt;aiL$-7#sEA zk#DkuJek(ZdyZN^j3!FK`=`LU&Tmoqv!h^Pu&+;U0EF0<`q;_)W*ifhr8>@ zWpH-j`Ob(&rf@dkJFzkcvPU2wzf>_aFu3{6S#=NGZK;5J(Jtqv{UUbVB9v{q%uWk} z5JELhUf!oaSnje(i_F|wzHPvZ(J68K4%cm&ft-c9WD514;K={7%s zl~S^g7JcvA*0Sx#EtW!`tVr!LrqoVm({rUw@p{p%p09D>l(lZ?-u9S&iS{Slh#@{_ ztEf1%h%Hj|IG~HyvRLvm9!VH4m#ig)708Wy!> zkaE9bYXxe)eh-WhV7=j~88^+uj3SrMsg0OpKiZWvi7il>xjq9P)n4VuYy6StFwu`g zSVFi3X+!o_+i0FeQKY%Hb_sQx{qv_#&kb)6)o(HZU!w4|YBv?Pc)2X>wCY^zOq?zk z->T&-9XvOTGx}LcZSv3pcIzmn#Jk~U3cDKvuSjp?3MO(adqQ?-9U7hjroLfD&Q>fm z`o0bbcm#|zfE5c_+z&y(MuUFcE#?Y(iaZTOz=Q9*?)`x|4-SKxYdM)t2I6CO93JVo z4K&55BC`wImzBCjn!EL2*$eaukxD!$A2Qsl(d0!MPqwHF<5o_FfE}GoKo-^S^?!nj z5L9e<@Vws3mo@KZ$}SJ)(o$20)A_CcUhJocedaaSr2h{0rOXqo2}9Zsrw_+oz@{Vm zf0%l!pt`oMYZrGG5F`PDy9al7mk?Y6!QI_8xI=Jv3+@^S?(Xg^-1VP(@As>7s@4Tn z6kN8&9~%M$RPvoV8TrUd|5U?S!!KE8`viPTX4d?hYUhz9LT!+7sNw2-|Ktc8 zm;L#T=<2eRy%#t@40t(mCccgH`q{|QVKu}0!+kRAt3QXpVuOhX=f-1a8?7`kc0Fh1 zbFS-XzK87G+EO=f6#R2BTl0Z*pzsl{#^zhKb3D_dNh0UqsHrs;(S|ap2>|r zzQy_YkRkjXZ$!kH4h6aPfOE*X2`@VNS(2a203!q^%GO&}m-=?tvyZw)HKezx!Pd+0 z>+?hgL%=+0Pp?s}->3v8HOxaL9E?_Mx0!?=;M6qJ(ypd+oLMBal{+UJ90mB*tXi|Q zSu+-=j>7A^adjo3F1&~qz4J= znxPGbP+|!;pNOhR1-0Y@q!9)zQZ9U0+`T7~5VidO^&3QxhNB-uNkGgc4Emiq^eSBL zSL7gOyw)|F=1-fOP=@Ew)eCgJkVXf=nb27Os}UAfT_BbgCLW%B1=!Wql2}9wZAXd% z00xT7A5>l53cb(D z6bMptU1jVCe~k(|1^PEJroVxEb~tzE>ZmJ_=q_fWP%PBnHzBvs zwU|TbP&fvyD%c*7W9qOilPL?a);;h?hK(eVG^RB3>iR31cac}cRop^49#@0 z@kWxYKqlEKsF&i{u^>>q6p-Tw!w}@&k)e}ffVScb2w}qMNmJ>X(Ma>`5EOyo zU=mb6QL!)`DKzyUeFml4|KILD8Dw?xsq0JlP%XU(1T$)Gd%F%wn%}2in^2$Rwmt^t zAfO48L;Nd`1z8H73w5!8yBedm&m;k=T+6*)<%6oH%;s zG@8lVdT zMnMJJ`HGVkvH(VWc#%4}hIM01<-52HM#+=WtM0vknf8IVPM&EGM56Q*4{pg{0v$RN zg_f1M{RVmHQsAHRQlMozHPP;l3IDl6aX`6(Cc9i(MKfeL=IlU zSVN5FkcNtBoU+>;=be}>Z+pF@v>L;cG{_wiBBJ=<+&V7A%JSe!UBTEkWX(E+vrO1) z}2SqVX1;EY_EESY+GSaDgm|6x#>=4sn*zx3z*u3G;Gmq&elMXxz?YlVb?HsTUX zy(he&`rFV?A*9BBW7g+UlZ|ACww2v8%S^CNW6-x`&(T=H432VS*GFgTbx6(V<|BV< zl)O-#Ok_ydj>9W+AFYqaPENnD)Y_?#5T}d$F$|U^u#l`o=Rf-+Qm0 z9qSaj=7N)^np)$sRD^hPY-x`sl^Jvd8=*TfKh2_KBPD4hVRuysom_ezrbkr2pEp!Q zT1E6zVlDXT-5l8o%A%p2>l)Sv!6I@nU|?=;4!BT2AiipJbQFND zQBqL}0wAXgPOC-q&^Fg|2|RMpULF$sHya_C5FKR!M%++4@iZkD$N~%mW3)#|w_XO& z#aE1;#d8RQDTE}yc=5+P4L1mk!kuFHvkzU$J5MY-*rjqyOmz-r6_dV zb@j$<@bg$3F0E%4D`ryXqasAH-TH|RBB|FCJaF1Br=&Q4VVY?(A}Oc7O_P@*UTy*E z4uGQ~E|Z9E!nNs>265G)GrPl5Bba+qzntZJwiN7muv8j0X}7CK*>QGU_3!8GcHfZx z&x7*;LDS{ZPx3b5#p`s`)6r5?Ca3l66#MWA-pxNAgD%}MPKPCMRlF;ZI@7A(h`>x| zaZMHPcV`8Ev)kX9ujusT0}HG9;LN5WktYd}>eUU+`_BdldENh@w&AbO=es*f$LEpd z8|MEYB{L)=%YVEd$G{nq4v&s5Qp~tU%j5)THO7j9H7%m$#){4eOQ15RPgSm41>5a_ zBr^o8iQ(aZjlH}?kuf+sU8Qh2${E%PzJ$z7@54zFjEKk!;tsc4Bx14Tz4-X}oq?E- z*w{b;whah%BzrpKIOs=PxigLkzV7ZVQ)XB-N`J-NjExJqn}geaKG~ojUHocd=-m9LM2zrEtWxEfJ$zjRL8{hr^bnyRSmeOHsX(YBe01x0valZ zF>N1c*f4*BjgUUCHZdr;JVAlyr~t5BK9c&w1g6Z*AKtBG zs9}b9#;%zd79qJj&Hg>$B^n&#dYuP+pA)6#X?y;i);a>>Bzn&ZlaUe(GRN9lD#eU~ z=3PHDix4y|xDT-(%AdTD7{r7ORrq!E)O1{O#3OcYPtI-JR(RiEipiywG2*7;l#N8Y zeVwp4@nXS3ix{M&c|ngkL;UxnmI-aS@^{-HYrwy}{aI$g6FJ$|jJ*kHNC0k%Od`^c zC+N>V2n;$p%jp7XAdT4@Kzu{d3@jAe>4G7EZPicW2b0SNQJ({7inaiysu@S;HV6?D z$m>QI%BH|+`^EPVK~0GH5ou0OPkY>-F(APNdCb?F&**h{^aR2{@JT67rT9_fa-Az- zA;(Y~^#s5Y@VfAMKe2(t31HkP2^Js&GQYLO9oF=qUxhwh-2Wy(c*R6-gr-iIOv?R) zyyCypz2&%1puuoRdnn%irzCv)+c)>QGHgItWKNZHb6}u!j4)vs@L?V=o>YtWQ~OgU zJGD=cQL3J@51?UiYYBc@=&0MRSSz(KOZ`EcTi*SRo57K=(nCcobX&9rCtp}JTo)2Q zW87aXqma$#{4^W(l`1BiPZ=QqJ~SooYcaB777awEz&E#jv2V$F3B}`C^kvjlY{_bP zGQ)CzWg^C`YL_Y%&=$Z<7Q6`4EscS?m34QGLr(PieR9SK1#9#Vqk&C&=T~zn`mOZ! ztWX^T=+DMihJmkJ9}l4bXY>?sMz;=XXR)VG{@Zq{&h!Ksqc-Y!lTbw;!LIAV&^)NC zvDsFDv-*!2YVADk13%bTOz`uA(_u4 zLc;+WwF<2U866A@IwTAsV)9wfvld`m7sCuN&{E1Uy(Y0Q=(&@E`L&*UteUr2|5K4}ci` z$!8XoYOT}T6Zl(+$WJwPTfM8RtAN!2w2QY4>Rq7!ZpWg{fQ=2eeD1dbs(%I1 z|BW4j5R(u%%bUm$@NN}tyX)#W=X`wz+41t%O6E?W2Hh5Z@1MwY?Y4&hD+B#kL^1nrX0BFa;EUQ4ytZjeGNaL7hm<+9#x%2r;E_h}gGNoq z&NTjm^3=K_U;Z7s??3=ce=OtjwxZf6j?MF|;z(aU(Dd)Z%vLDfOD@d6`xwx%5KNCQ z>4(02DuVTXy)h~rmuLkv!C_i7ELQZex^5wJ5ohN(?P8qU>FT{RMX9UfTPi2vX<6xGH(L}S=L%nPt>b*VJD8~EY&MCYNCGw=)))g4PLd{a3VG_p>|Nf z0A9>85o*p5NzEl%Xd6uHVfKEy`A4D#LimR2P-1O5RREBX-D36-KtgDDc-$f(Au0J5 z2-O#b-t$p-)s31x@sCvFrgW)Bd0q8uq^@+76CNIH^} znis)@2UNTR4$DAaAK%kqKCo1U({65VI=!EJ1OHk9j@SF!>sDy|Mw_dxD#RP0UggMK zk&fnByW9%v}vAd zd2@T*4PthU%QD$V?j;aJRY|_V=#4bg+qZ!42|O)NijHV7sRS1*X1al62DM9%1wkV% z#0Dw9H8LsFXAJA6U!ZtX(Ms&vR!*JpbX_76Y$7z+NX`hVr;`@wfwF2TCEfK)Qi3UQhVB6~MnFoaA9si&Jm*YSO6nZB}@S1!bnxRM|rBPaGC#LfY^1lSm@SS0qCmf#gk}px8YHQ>{;3N%A;cJjv zFgroW1g{W#&b!c_4`7|;Gy%ND1V${?XBvBAKUNV$0HqY@@eUvZox#i4R6PP_sCELa?3aCG!^rZ^^#`hDx+YJ|yj^p`&jz{QX_t9;)l-MepH`ESAlueV8@9jjMg3P? z@#szzd^b8EPmi+sQMduD`H|HSmL;7b+Tq32ufQ9$oSowHQmL*fUK(7j>1VZB>u~vx zQ&>V+)d40(FoRW+U(-`8?CImM<##yOg}t>r_c|0-^GfC>@Umfrd@uO@{6Z{bR;o08 zq#fy_!f~iu7!&^W(FSb9Yv-Y1zUN;b`2)~+%`v5 zA8~uHp>qGk9`yF*<}oIH+%y&F>gB0I-fTpe{=C|d1NMs!425VS_4L=9rqykWk$ail;sVoD=uCKZ(NZY za@Bf}gL%3NnA>6xMM0gT+;v{8v}uDD%P^|F7q6i zkcH)n3o{LEq_w1B0Ae&HIhe^0=E8kh5-0 zlKYK;V^qGL6PG;fckj=Fr?ciJ&R-&;TGmEQet@VPo0&uuCb$cNc~i&6BXL}gtqf+8 zgBvV}+MXHTLr|6W*A&o>s3r}5DHWU)5jI=xZ{h`Ip|Rp`Z7sC zt9xR@cBMj1C5nN=(cZXaZxDmSb)9o)2;R1JXr&dEHT^Pj^2di&odkUJL9~x(ad;VF zqG-f~@`8jC-&ErXzg%XhrJ-?HIknnk>Y@quCNnh=(NS~anaSwdDRf4kL!^uZdmhyD ze#X&)HQ-FE^t`J&zPZV2bO)51EXg*l1D$Y}#-VB5wYmR3YbWz-b3B%=>7#342bU)6 zwz_ZWx|PeP)+;uyEA7_Sj*U)cZKc}kbE-zS8o*ZsX2? zL9EB-B`h;tHk%mLw5n<6_$Pk()|IljnX`(HHQ95GML|{#LQp|o-zaBTDauR@`ZYqd zc#YNMCc3dwP4JeSj;T*bO>NnGXTxb_?XgYwGKY_erx1z#V&ZgY)53eH>sS*g{Hm;`I9 z>6!Ctbni22WMstqURR!RfPXE0PUGy8hupp2sp>=yq&Nph5a9Iv@yoxp#0*~7UOm}X0Z8iq8rS=^6>%bTRmkRS4OolW9>*-yo1j-bL zxS|~Mug#=Ehc%Kh?A|YC*OZboS{XJo``zVC`1fb@rS!pNiq~h*O2@_qyg7Jw{NZfg z4$v20QpWgA`tDp>=y)6Q-QgYV)*-V!Ahtu`x+aSKL`ceLBkbJ75K1Na*e$}I{ zT$I-&@0@-z1ImLGLhC3{5`x4|{HM%@bgp9IBq{m+SMk?J*3xf_s`dp_nc~itGn_gp zOikEWYIr$oc{txBPzlsw>1^1gKak^fJGYn}z!uMh*{zP*El4z9M4+{nxBc()TxSmk z)s5K%)Ju?n@ScXEzt?EX{j?ueOBsOE>=q|dci?pfMm&#q@K!)U0uXCURPZl)bLY1Y z?Kq*=MpH|#@Mx#29Y6M3vFYZkUQGJ0jLX%S^j^lovCES&ll5i+bmJ0`Ult+xhfP=K zaU`>=-|EnR)ll99Uha7Bj*H)xiCC(n6~4``$GFF;xSZFmID9Rij~{R){zNfIVsFmT7jdYM3UC|KHR z!l8+yLTCgCSu#Ny8ioF;GD|~bROijFMz2pRgx*1wIyOvP7A5penq!8{UD4-I#er(< z+gXka7ERnb3MAAQu2^1oJxRL%D=?>zOocw3GY@MAXw(1r?5erOSPpMg7yIkLZYm`U zgQDm&DKKy}*Ar8-0jX~4g_K~d5Po{eHF#rO!Gw+89T^2BEd01HB}`g3MUvN>DLT}p{w&`Eg6}{&Q%?a zHbOowKE2|%Qjc3evDa1Yx+{gdRbV%>YxU_MRqB945Y%iM2d)^?UL(!)ZdEWTH5L?oj#9twj@7<1NA<6V3QXKOqtzhh{jso5gH6pOAG9Z)G_uD%1)+OuYh^Dy z(!u-YYA`HXHCkHoUNBQ)+9&-z*pZ1WN|+Jz3FeT!e(Z1%x_nYi>#Q()Mo>*KyQ-6u z2=m*%d=^^w+ZbsQDM+2>LLRS*4ThlFbKYdnkx}ATA_`ssg`AnCcQiUuJxS!xRDNR? zB639!Q~tU(w{|j#iUFEHRyGrk-cOmj#7^b5Du%nA*(V4BA`94j>ZII3J{s&n7h8Qt zjmv9lW@l-4KWhfQ|0&t|@~M(yKp`1Wn_o^eiz&U_ohC0j_&vc#mycOzYg=cpFOFLq zukNl7uFmhLV{PX?fViP2EA3usf1FaOZTr5vvzASwIpNL!bo$!v>T{pD6Yi_SA4uDGJ%$I+o6Pw%)L_Ta#ZXZaOBBKDXU>Q3P-b z!V#pQ)%#j##LNGu%mYH%8B;fE@#N3y;BH$NEnyD$Fn2Fa(uv}o6lBIb{SRtS53Tcv zBB8nHkQh)p&mA9vr^jzy{?0zamf#F* zIKrC3d4GNuRFov1mh_GON|bXtdb*Uy-?)mINat%|YGTiJRq7i+G@v1N>0Sy5QNn`5 zMn?U@Hs$A;ffJgpU7M*u_`?`M><$9r{YF|$ShY@bm{x{Pz7Wn4u@aw_fd(#IMrJ%Y zIVmwEMXlR$Uv;V!vltmfwAOAvGRC?70ULvWMqFGfj;Z6JYmN6lgU6+4*U4U7+Fp~U zHi=l)*xub;8L*MKW%7HYuqo5$jF{W#anR-hXe)M9xE4r-&{_O*B7|@Jk3THy11OjS zLn3|R1LtWeu3X@RH|`jwg(G zEC%sz@5{$`oX-MUYAP1&+Oe==e8?0_1Y6`#qU1=k|E5_s5Cc5b2j>3$xeL8n7ZkH{ zcFpx#yKsO!+2`$1tYACyI!eX5uZ+EPqPhy|r+dcgDw{r--lRq9Sh#gxMo!Dh zmmkCM4Tv%$yzEo;XJR7tbA`At!!STc+{8Eu6tbx%n(vbZp-$RbguM{CYH1E_ELlNzH|#QhQn*D8fT^tDbKl!YG4WSWxHlO?^JH0 zh_Z?b4v*uYORUGphKIoVnN&H|eS<}R1&I3grHv}rS#&!U0^@!Y`KOrOw?1*HPn*4n z{vW$fZq-y(KXcjT2nWK&lZ#K*LmvT}xq$O=;+zFG&e%0^BrKFxtkB`?zqN6fL#tLs zitfKJNU=V2@Y@l*0m1t=s(})+U&{P*;NffT7fb|1J{_!&TU}@F@OF>wfn(qmrqi3J zjgt+}Yl0XNRI)$9lP=vfvNGdw@k~w=6b$x1bLvQNnU49kl`+D&i5Zp}$jU5Y$0MeX zJ_^m=*OJDwaFYbxQwIfE!S7C4!Skop^G+81X`F8vH9&^(DjU{+*rAzpgCa(Ow>f-v zQpMI|_!%#8_tst6`7TczSCHJ1Hz8Es2vq)&kAr`9r z$4=fDT_eq35f8tAb8S41j(A4M>y-S8Qo{MSSiJbEGfm1HB{c8e;u`d!F0e6>1Ae7p zX`MET+v)~k(8mz;;#jbqilFtGCLo&TQ}iawoIQyH9M{L~BEOuTY4BaL`lq`+qUNo? z=@c|7la|%(_Q!qZ>0|qGYeqY}`Zm~m-HKF{94;95)20jm_NcFOEdg|De_m~zg6sZg z*qk|^eRzQUEVZ~QD<&9;M)Gkte**6(6aG)Hk0MP3I)J%3A4_F4=>?NJ)n6=mnY3%i zz7{Em^0N>I!`^%jTS=cxm_iwNt!8$)ep$qk_K)E-Al2uuM?lq{F*N2C5cS z)Y+6(Ggt5qH2g``abNgVOXK+b_jC8o471yFY=*+riFMsd785_O+1b5fuIaCKHnTO) zUiMk(2!|Ok4l>8;EHM!+!V3E?tkn_j1fwSsY>q>tI~2aRx=Z4_!iWm{7`rAM5#=|hm;Ai8*6A|>|iCbtpAbJN_6qm;CMt{N~Nvi#q}OKSdJnc@%@oQ1!A7Yo1j zy^-Xjj=Eae>V*b|h^8Cj|Mf=K&df-Iv7=y}!2=Z@3_e1}pdWrYLS6dK&sfWBQ;NI< zKh^#IeYR6BvG{SnsMg{b*QRPEEcDn^n|agvDGLVriu?aImBdY|puc3K%}EKJ?%0vx z^AjdblCm%x5&JD?%K|D8fe7^OJfscFPsNW(uw0vKgJn%ehJ-o0J23Atn&g~5 zgi|16t;wg^PnHy7rAR1W4yMayf866>+ATaqT)GWt4CHTV;ngx_Nlz$^o#5}dY$@jGdUz@NsHgFMT8E$I?lR&yVe7foAH~F1x7A-<9q{&i3fO?Qhc76_ z<0n}s?Pre%$*yN?)jvYH6`eoLpI#b_rK4EiJ@`oyW~}nKUOHyt2+sL9A4H$%dzq{u zXU@C$Al1J;D&X6xC~!TuIQ1O;ci{7+biUda$5Lg?^WWdJ9%O00ztkNlQ``MP&J-pM z`XIQ00VwswLb<)p|LOQk7{9o8k8daVyN**$)dXjxzr3(d2mp0_@$H1m^6Fy?c6H~l z4#(UTu+bMIWT*7TlSc^j)y4jao;dGLZ!c|82~<%VbZh*)4} zU$FlD$2I4f`{~|Om$f_{-Un8j=j((n>!-h!zQ-lr)&89wDcEC8s^koDmXUV3q7oDZ z=6z%6%0uo_Mb#mOhHwso9Ze<#*MWmD}B^&(Fl$%w&G3h4W}tVT}6o|!4LvNug_ z@D2!0w%qA1DI?+5*)n{m~RnrCAxWcQvya2@rNo ztLFx``A!hQubv?zAd;TEb>2~vyMy^Wqy5=Bp{42DQ*z@HK5zZ$8#z{u>Qm;G42Be^!fFJ{Yq}xOUdtzd5bf ztgJKLH=;M+FmVoTJmIZhx`1g(dmRIwK|nM)_Lb1>M*U?WMzMN6g{e!`>}SvAhP{lLkMt~Yc?oRT zc_%ATgHj&j5=NVo_aMI-_nnn;`>l7iQ!^;yi1d(m)8lBD!Ek#}L+CtthcHUP94}#- zg`;!`dQ4xdZsg)7{f`ADA5Q9|s>LiH2V=g8ii?~BNdH+##?vXEGN!@Z)iw9z476K|L3~!rndJ`bOW&~w85^9qM8c$4N_HzXRvK28&cehDMv6jliu#|@W_an# z+$s6l-DM&0uq+7LblN)NaPu;k&pQqho^Wk?B~V65MLeovD-u=`AmPHs^2)f=*U z;l!nlpRwr_Pz<;?)f)=_t4Hw2x?P(tJ+Oh9oQ7p<4){SE*MQFe&Fm=Tg;LH&ZBaTMkBhxvpj<@li;YmvnOzf=Yb8gb=C)SrCuTG5-)HX5Z5b;LmrdOw=9!qZ^cStWGg`ym z9}V}*$daz0xtZRohA^$)pWmuPt_K2(*YB${&h$suboXCnuc?;1mg{8CQ`tYv6oiZ6?LTBaKKiraDYCx zFc_=yNcq#AArH?~tf)ZR-kd$&F(0p?`4!DN)TaY{;!JfyA-GPwSF<7bup1C%s(14E zEwfE)z7wC}-Hq)EAd2~Xrm0tiALBwdjtA$o{3iH3YS~t7O<1?m!_sRFf0E^%W(6NE z5+gq8g8r0vGAHEODT2>t+3EFhdKtE{};J85`sc|2-r|kO5*?8sk3@ClwVm3j7`;-`UIoE zrx;HHJdW_jKt3Agx_y4@w~R-hwkFDrt7ncb-_xXtfr@i>7v1U_%cn?P!?Z|UmmC9vKcj(f<^b6`tys@?$abmBC{#?;{a5$qKfD!*$9hY zKE7Hh4W9H9o%}4v(a)CTFQ%*89gh_LbI-JINzW2iDwv0{Q(;H!+v($)+HCG`o!aLX zYWP~-`N<6`E300%CuHIk+A%c*dQUei(8<0=uBEv5lTl&s0$P3RFW;?F&?K=nUk7N7 z3%FJLI8HfD_^;1+*SbD&ou$LMHdJ80Z)O;;q}VRsr%-}FT61e^3?Ypy=EisXvv9cm z-Ny@y5g*`;lF4Jhu8$&NN8&IsBMDSU$=eS}ej2>D)PSI&Ry2i~GNJhd*OTxrK zQs=XSqhHPM)EtkRd1DzQ-$&~hCv5{Bm^la6rt2bx6yT)hW*a0gOkFnz3 zscj~tH5WTgVA5%i6jQses6JB8Or^~};#V{L3Aum{(^1bd;(JNTg-}P|^9jXUr9!-f zGv=EX)7!c8&YND_l%NF_A6DutTdTc<7}S-C7{_o}c;HitaXDjP?Q zyHoEE=1Vj%jp-j#+ZWG$WJ{3dwEp3<(lgouVPn_2_m%9q_tMcA&HLz)CKM}>R-keOXQqISVYRow zUW|Npc1z<$zQMKr%Xh;A8%!e0jSjW#9d0JC#;2Uyd}T}C4nYIo7SEpKz!JL=(S z)w``tSgED0F(#k)hjL{^HUj~b=Wv*f9UyMqfJUkPLzOU&6>vQ3!u=cn{75<^NdD7R$ zV$W2@^I?`g_wv3c*Ia;BJk|@_7|5>ZO1|R1fUi}jByVsD_47d1bC?kcOD=LmvEV=E z#%DV+p}BVGG?Q+FrWFDZyiWNX9xy*hB4mU?qAvDD_tU#1dbR-$E$N|Tz=$`r+<%-K zWOP}<1()B=GYJD)rU~F~^BF66l4Nh@!^S|mQQn_YL-E^bl7&Tr^Q99&se8{q-LmwR zsCwB{%Xjh$3^`L2NF10G1wSIJ4Z>Xj(=2%n*53KCpX`ySc+LE)CuWoc@zF4*-_-W*qC{*v@;7e@?dE|pGJrQ6p;B|P(@}EJ<#*W*=BNe@ zFw1a~!ALqy5|Nz)2PN<=sf8-1tSpZj02OF_e)9S@QeY<~C-cvjvNFDbKZxMGZy4R-1>BTK2gs)OaSYW67P3#%t$WuD3kF|KzG zNiMAKk8F7ud6kkqYF0=R>w-j`Wl@sc78rso-vJU*ZcbA6(DjRrU?X!r+61TsM`Z^m z(p0LFpgt5N#nG^6TLNcOo3X_CX2vHkQA0|7r&vmgsZc_Tg2t-UWrc8C3W}!Ow1Hyr z!d380Itr5dv{;RPvx0>G5)Bb<0wW4)f3= z)NLj=(J=SF5@Uu^@1Y(OoSNkP?XdDVKPMt>R<*)K5uDEH!`Lq9gC^%8>~W`D_u{7q zliu-M8?aC2!tfe`WHMa$cI~E zq{c#zw8<31O=i5Xj9YR^U@sg zk!H1MxtTLvBz9+Zq$TCYC}-eOQJRlOEDJSJ#ZcLi*i#ffk{!MqaUsYr2}NAOk#{{9 z!a4(YOC}Q&j)&ELHMFT13X{Rw52Rh`3HGGW1I%0lfS?KeEvZA#)!6tExaV0RlgIhx z!M?dTVmyO^F<1uySNYalC*~pH?l&x=q}DE4*k;&&)SiAwN_Q|&pXI^4lr5NRT#jYf zCexSES8MP+pR}-=X3#PUDqH;K(G8cmGieGpWFCI`LUaS!Yx${`I78jho;nBi^{{z% z$+s6s-2fo9=CaUxUcT8u(i{TE4A+N1zu{Tn?FyT0?(G259+SxLa?O*;(ti}Cc9z*Y zk`MZ<;YB7C2Pp&Il4F6FC!}7WWd0_EXlVKf8TqD4Ae0^haT4x2XF zdKo>)PIX@~zJ-^apesa9-EiA+_GzaydB46AqYt_wVltLIyrtDQ4(a2;WqEcPX;pEF z-)bp04R>bPEnzj8A8KK>-T+RWCVH4jLGLXCT9uF)o!0t?*_TH!w0)q+2mM?jpD{V& zQx=0E^k^fo++?a=0+JQ~yQsgii=f(aU@QU~F#yVEshSIPx^{bHnyvV1F+ZNU(qyy3 z1>8Z+x#8itQ^cT9jdG;K?HWa=`I+sCB|B8+V#<>GX;B2?Ad!0tE-Is#8M_8yUo%$y z_D|tN2nq5YDUyF#PRkorDac}FBC7vVbYqc+sJX&c4@)Bc=a0? zXm1Yk`=G?v*8~l4yV~TshP^)N3$Y;)XHd^lLTXWeoM&04?j8VDubHrp%LPI;NI_`~y-ZpTfEML!5FVQ4lqE`%*a^p8YEnDGWL`wCdIL+Q%KtmiBLU z9>OHVAKCMdzpfHeSu<~4cwm=7BP)?eMdW_HTeQY$8w2+fYqC$5nz>YBdGk%@?sy9E ziMf?D=g58zB&6{ep7^m$l9f{fn-wsGxeMn)`Q z_v!Oh0Bk;Qu@Ld6@=H=Z{%imvy~uBpz5>1rC`XbIJ4N=&3%^F6Ael-FWR%`PS$4L6 z?-!Jb1F9lfNVGy^}KZAEyZ$hrkg9J*Bb zU2(4Va#LuX<0$C8#xJFMXablr@!4=QCW) z$*S(U>*|CKjm%{8ei{`oR=}Ca z=Zn%$Z$d44N>#Tmq$-MOeQc$z^4|nPXba?O!LUX+cC3ED1OTOzK}2;f5ZtVLebAT7VO z%N~ro6^WL!Z`jxaFuQ?5i^OwB)}{8ta;A;Lr>SJ`fz=n0o?vX1eE#rbAw<3YKsZTa zcE;t<=DHLbY}tMJBYw9Ej6jHG_=>d{F7C~`WbEu;ocHO|Ds=4Z*W0_)J?HrtJ>ctH zSbn{y*_QAXEV~FimB4&6n@YHYfhf^iH-DonN&{UWvDm^k5%9RC_c01Nw!dR|DSx0S zCOfw4Jx3dL5j$IEuBZ7}d6iI5=5`3_tYR3-<$j&uxzTFv=x&hhTVRNcI1Y5wLaWbQ zEy*9sq)%q12nErQ9d7&xYW4;P^M}z6HoI_qDlz*UwVOkrPL|H z-$N+zB`dPe&BW+SB&LBeBb%9!`&Uyf8Jo+HM0^|<{L>red5QfrE%6? z7|Wh6yv9s#Jmb~f=hil1DzE=UuNH$s6D7Pm6X{g;@k5q=>jhffjd6X@YsxIp4dl!e92%qTyJ|{wsmDeu;duoXIKe|#GCRI znlK=Pw_d8(wfA5!?oap|^X73DK;yU%B4TxTtQGebe7s2-XYzW`jG59`V5Fntb-5V? za$?Un;0@c!$qsmsr~-B*&cChFci28W?oEm{J^PP@bQ-`cI>2VSJ6ln#4l-I;%EP2n zXVR`Wx@@d$TV?#|w5gl;0jcWvTFAhKhh7$kiJr?LLoRnR+_)drcy+t z3ZjLH(s42LTkP;zqMP7fd5ntTB&4U*&A@WF)FT-Fa&#at$M3ovw4mo!b&{T4p;I?f z_P|Fj+~%#fv#t3gHEY>DIg zT&9N?2GCDY864&kdtreiALY(Dt#3Rb@AXRFWUySses zf-$3B*M6qI_cw%dw&!seG`Ydxiqz>VA@i15+C6c+#To*BYgwOO>8J$V?qLNqZWoB$$Z{&k*id-FZwk|^>DK@mfT!Rp_+^lb3$vmU12POh)G_)599~rhxR=krCvRiBh-i<2c z>tp|15;a{9#4B?eT|UZr(mv)G);#`VaV#^CAUWeOTFPQ5Y0A1se778~`>^gMT(ld@ zv4LzVUXw@4^3-3Dc3B^ng`cb0Vys7a3F+F?Afi>1*Vf9NwbHmiiqdj2J**zWLVtQE{j~8y zwGMiy{_i$nK2xI-gh97K{~uN%pWvO&7HEHL4mD&V5N+G@3Bx{;Fxj0{XGEwv0(Jcy*bOt~C+y)q@ot-1SX4wV zB;tIlEgk^l;Q;VOPZaKWkRcp$|F@9BK4)%WQ!eZB;r zfqTc9Mk-o>w57TP5T>_S#_NWT-RsI zSJ*q7DQgPE$Rjaj;R{&Z^wsUlxl?z};#0kXd@eV?y?ytfRrl{w&=uP(0h9GOrNUb{ zc_dtBPTwPvI@y*9#1cS-ijlk0?R7Gt@OIDVb$&j?fhP%%t8DA2FIyn0#-u_YY3BWM zIqV&i)A(%u8sNH-@eug-RL1Re-IHVUO9;2&$-Xte)L!#zx=XjC0Bo{ml|N=IUyN!Z zyR+l|-z*BaP;RsS=VqW(3?{zh8xl6R+i3$1+~G6=if#WK{&}{-6lT`mZQ6AC``hN`xbBZZQ9MoAD9R@%=Vk_!QdhATeVbM zXKIRwE0JD;t0oCsxH09MBRAQ+K|pC>-xdL|fqo?tp8D4yf%Og{==zv&nVgRTpsa^BLngy@9@!3-;S;^&j|!QoUJE=DURnokF)*XE|#4p%Hpt3opDR#ac>4k zL_%TVrjyh&;7u3yg6ZLKQZh;3k?GTEYqVSR2mHG5Tx|JuJ#Lq~1i*!^y4ZZLYHuTA zJ!4nv_O55&I}5)(=+zsjC>5VryDK?3C`ptJ+T5t-(BcbN_uT&0wxLZVSs9(`d+#KB zMdEfmhnLHH@YH#XC}5)kETvrbBWaM48uOJLmYDEDYVR7r1+kme{1*J_#`Q!HvLor< za*ETW2G7GyT6#32aVv-4y={MD^x;fhJtLws!tCg<)6<18sA@guD-L6(k4s$QXZpmg7P@n#(N~UZ-zsctJv0RI} zSaZ3kWY_GPZwRcYC-9rzg?(wa%|Pk(BJ3`7e0i^VgU9Zm`}!^|t>tc^WntkyyMo#> zI9M!hrjVS?!wev}bMJ8#6^+Tm7o_GeQ?u+ z=?x4#TK4WY3GujWl_sy*ZBOr>to-*r?sVVjCW7sEieS%J!qtbzVSt=W!^lKSz~y+~ zHu=ICr8sfntS*ns=P*0r9_nIC#M1Kh=b~LcH61W($pE5tjkI%ls5>6nWV1&ie&&ZW zp3ZME>+N6EM4;x9EVuv)9XKtXOuxF$0WLn^o84$tqfj!6-)H-} zt(eZ^>3qIkqdT8$2w%WQQpsEmk{4gga%Q$+sOS;?K@!;3LimS*A^ln?Byl$0HCkT| z6RQa&pru~(t(zOwR4Vp;%P|a1&1QMgIOlVp87oi+Dcwi*K+2o=T+&hJc-K^<2=P4r2Lp{`>fj^1_Mac%rvr{HpP#+#dN3j8dtTcbdhX-_>jd!sj^7y3 z(!yIUR{LHCn+?SfnK{g?D*fb*pzi=N?&*$=P)^%wHU2zLZR^m`G>lIMaigH#PDQfb zSUvEqu^tuLH$7jD|ImXc>TsGy;bXYDZL>Z|9Eu_2bv92Qlss$S2cfwZNhy6cS7K@S z{QU#-;qvn)LG6dScYFDjS?>E)x*6Bix=%w(gZ9&BX7hy_|Dzn9y3c0e)qTy8-Acpn z{~8|p=(@GKtY^y-&1}?{ zfJhwmnxC}>ldI8qUBT7`&;JsKW9YTpN{_8^u(x*tr7#&ZTb?s1JRgbdJ?(Xs;w!+H zm(?zkp(U$IZF5geeQJv9oToJAH_u)dxqe{TZgiO}b#=A_%}A%`m2IE=JK{c3(3J1- zbyw9|*Tq`1-BZrTBauKq6b2%$xczow=Vh6m{C}1_8^nrJr(Bwmuk%1852P#*5=}(6 z$RBV*7oRJa+3oZc!F!=kZ-(zh7oLwby0!Zo&21f@i^Fe7xi>sEY$bB%uRBz9!1vH< zwY8c&E+c=Q%V*@(Eg}|;xXQT1)c$0>##y9LlhF4eg>(tHstEZIbLe@r`3;|ElJQ)* z!;UKCGacqeVDuEyPMxruZFJv!o(NS;r?%RDzm;RqnN6oR+xdQ`L<6Gytl!%+y)Qpf zp3b@Udv?&+t8Z@lj#Od@S6T9|O6E7iQpqU4`ex4Uy~Oh#&<>yKOz&aeh5=ZV4_P{bs|e6e$CQx!Va)qKDlF4h5czb zjI=|GOaO~>_ig}(lMgz|mhsC_&{C9B@S|k0r@>ibsAgM+UR6RSpU_=&L7s4x2J!~~ z&om(2r{@Ea5eR2gDVVDlb%g1ZxM?-MyD2O5d^($V-A%0*JlXX8OfWg%tU!~6r|EU< zasSw^C;+i%F|;or)>0=)ex5yX!gQ*ZT?U;8bIrfI2QG`C@Y zGFCI}ut6qu7E@DyZ6p}Y{X~XY+zq@gvq&)uUCu9(n6qNs4EUTg{D<}SK(?U|E@&} zB@uABoxgtpVtE8SPOoL;nZG2!=9O@<+3pMY1&N5q@VLi^sOziuuTr8+lr1an_Uj4Q zj4*lkJR>-3=fLp8Sb63n2ZT|oT1KvdG9SzUdqAAmRCiN9SH5`5JcZ}1{=m2i(h!*t z4JdiWxO@%REdE}ks8yy~_vx*le<3>3)@2HWlSICSDftH-BkfG=S|8Lm!_Rk41CU#> zcURBj4riwp3Vc@tqi=J0xCI~5bsC+vv8VTn2gGAW`(lKsH)V=NA>~&AbAC6GV}C00 z1`(-|NmS{p*Y*Z%Bs>=OhFTRBkjfZ}2J`B^hpZM-Vtc#QBkR~wqwXGpsC6mj&OUS|H^d<6pu_`VipO0gaNVv%Qh|hq?~@mI z?bm+;{KZtsLxw1Zh#kNK^$E+Ne6vQMF^F=E<8~iu3a@v zUzfITOq_|z{6Uricj|)%XAFh_#h=CF{>vnurfUhJ^2fwY5R5k!lG5@Bp%e*_|JYz!w1o4f64d5aRPZ1Y%@q16EjJv3qd6gMID}F$60geV~p}0UgpqL$5 zz{EH-H3T9;WTli>$45jp=s#FSj2=th3JAN{F8sC*tX`nPRoBa_FXFE5fJ9@gHB6b@ z`F?Ci7Me0~XTUCSHHjdvMW*R-=*e+=8DQxp2v7DGQmU)?Hr5Th21*gSUm-kRd?sR} zDiJb9FE*+1U4x1&{8Y_2BU>2m_5>1FhS>HTX$A_KXCB=vk?tr%HA2jMH4M^8{kTA|1NZ*FY4t3}`n6vA5Mk&bSK6kM~n7HtB{&$~w0u-Xwyp&$IZ^2tf z5~PHeB`2<*APBAnhv>2{L^l_bI(T2EnJs(N+0_AD@s({a}`8?s9z!rVwyQsEF5dbNIok3 zXozie1w;$~q_y)RGXy&QsiJB=G1BiW`B9Uu?|v{4*-# ztyr&J4~V;_+UTn9^_8W+VU1-sco7z@fEuh$TqX9Ay(b~A@nA>aI^qv$dumvc_>6*H z1@{l>C`r<5jR=VrYISt50PN@xSdG7p`JlsbiAuyg{4@tkb;`&v`{c5B;PUA5#YzG@ zOJlu6Oj#k|IY|>}&Vg<&r~~e-S&VKM&govN#7KzlJG2P0|HS$IVnv;O9iR)qsI#!- zMLIC3@ncR4tB4vB`wxN(6S#?br533h!V7499jAM z(jaQ|@0laNotVmV(2;zrqmUKuV1#BkiZcM<7L; z0@byEhMRR}HSm(@_!h`&*po|4U@aN|KuMVumOLnr^6BsE?L(E1Q(}mS|0XD!UGBoM@L1W?;9qR7y z=c*KQ7&NKGuv7~uIE|K0b8{-`;^@Ja#1O%I=%ndk1@+gcExC+rDl*p6p)e==l&0o1 zDvrhb>VQ0=t$HA9L=h%S9A*{6f&+yEeH6gn+h_Yw?@oHEH3e?iIHqqPR@d4LKPvs& zTK`uo=aV@Rci|_lHYGi1gbG%RgXoLhK-}y1zZLuM*zq;Qb=&3?#;6Oc;r}UT%@7kd zTQB^PP5DNA>l*)CUNlhV&mw;TiJ-!(HJH>%#%`#At9(n-!H1GcGmmKbBxd%Ldh@0E z9TJoWlH`XHl#QrCQN*wcQxP&FVX`CJ!FNs+hcYl(EjdgwF$MECU`js9R@H4#YT|RK zJ6JSjGPtuOWgok7OAr`=nZ?P8%e`c>i&uy(lu1-I*k8iDxL2Isi_JbY5mFwCm|BhRWff{tMrubVZmjJeq64?FjBsr;X8OMS-eS>lL*e>Q@r(r{y7Fv*V= z&|U$b&~`~UxYB4<{ui9KurnaWHgrL^I6V0-JP(`T*h(VYQ9Zr=%9G@q-(f;(0!W*~ zf>PpPaEkn?jAdYOvdrg1j72%aa>EqF!lt)LMA?=aJgQ{+uzSb%L;O;x)5DT{WoW2* zNvL=QnE=%yuSifFs{)S7Tp$`w>4ZLaE?iut7LFol7H)CAhcot;jEprJ&K7LAgg}|$ zjUj9Zr#~rnj@$z})!f*ABZjzKz7}SSUI|eQBf!DKLynbj`)v*N_S3A==X7)ikfasJ z(A6=5t-5aOn4|pf`+of<9VxQrzhaHJg1B9~c5$sqkC{47kwD@dHX4acA_}^z_@4yI z`CX?+%M}pH-s|99kP50*>|JaXu{aAAA6WV6Jbg8S-2R&^wgTxGrGcrwo=GDyuaXpDV#ZGX+<-^ ze)A~*vS?E9QFhI8< z>Y05JWY4M%T|vApQD_gl*shcD1D>q83`pt)npS1}D!#BbxYdWk8Xwj<>Uxnq4S4)+ z%k7}zKuRAn^W&gFF-m%DA+y1$#1ykFLM^&{301P=Wi6$$s%Q3~MK1wS7g^;Yx$aRx z10$7G!p{q_X~`jz@6oIUiSxFf-iJA)zdwf(UBAvC>-fkUl6Er(i;QI)7?eW8{_&S7 zjsG0Qsik3v*OdAGrO{3}{?wYue`8@Rniv*z$P!&&sLcA6baP3S*tD_nZet$XfFoik z>Ac5JBPhVh!^g|=E8<6BA5nJFAQgQ>5-w+SXM0sr97b{+Ce9WsW^&Xt*zCW+pa%6C z_%$D8o5z1r>zna}nfJ^8lBJrlYFoM+E;&q9ewOqC4~()GT$$4RNQhh^nzrOXi4;|S zK5JpZU0&UPe?HntIy%FGGgy+L;Bt(w#OC+w=Y6LQR3>lJ$`)s&H57))#Lo4I?&{Rf zWDLaBlmFBtz>&=&d2U@gOEy{gFUkE|{R%!Sevp2x=6@V8;EP%+`|r6IGV@Ee=+Z;B zSK2yhTL&`6#QgNmUB)l^UONIUcY!FC(R5`n8yxJ!8CXl9q?gim!jn}`)#3?D4w*=s zf3%d0sf)zI20x12-)e6dKCfrc;1-F_?uVX#!r(M2Ym0csexD4vB#58meY|{}h0&_L znZ*65KIpCAya<)~GqE=J{Ap&iH)mNQ*!KC?U}vZkj+4;(ecFul%KWjLkWGqVgsA(u zXIQV&{JAGFK78_Ypyc<9^<~f?q!AXO+s9pvc7w0)#Z;n^Sv4V>*>F(s+tw*Zp-aE- z$IjMt2bca1(fno-?uXfVWwt`+rtd`G23iV{N8MQ|o^K*vdPI2>_Wi>n6XrSg<3k42 zS_fwK_4nwaLnADF+~(u$8TYpg=gW$Vgt#Ovsz!;gS~#<+iSCE5pAr;Y7GIV%AA@5A zzN7MPc^_1PSe$luA{Wn;PyF}qrLFB$K2GK%Q5#6jZ_fa(^C9crW?e6*Ix*pMAhTbP zpp*WrXIjqW2{*@-$6z%5=^5j;|XG3;Of zO$-Lvkfjlj!dv-C4F#`*4jnY?1Lap1=??XuN>`$*<-$+W@5g@@ONUL7wxl?e#D8sv z8y7|Um@Lsm?#)Zs6{!n0&)=&;CapLumB^|geeJgRDXT3eTcmux^xI9er=2f(%WRcx z<gPfZcX;KU0(`z2{2L*T`>bKh5J^RUr<3-gogZo#f8*;Y_fiR*KkYyHh_NM(4+ppx)=@j!SzC&syg{Hr}1uEzYm4Ht-O}TzJp!rG4*U$GvXT&9vKXy-a7_ z))LaIL50vsO+NFv2#@e5tRxyIjjIp08I50WvcH;!lkRh4lts~OJGSw}{@>Sim^&0* z?zylPCVFrtZp{Ga|5}r2v^sjd7E@5aE!@XwNfIsHuyJvqB?Mr8kOs7!$lGrA!LJOW z+q1Vi2%=FeMGJ62Z=k#gQZ3~~W1bRWNg(gL;ychxcc=cWjfUX6biF;rz&lGF=K1$3 zBD8bhc4xr_F^%@x6|o=#Y3s{XhCsKA)NHTlU53r@(m8jn>06l^-;{6#R8`;3RDj9a zqYWMP%HQdvPt{mnX|3PpRU-4HMb0#W1i=I3dw<>gzpR=|f;#VK2i`Kf|2lunl1Xeb zVVzg!KG#6if3=&Br+X55-2~>3!_h7?jQU2~d3|M3tPM}B-p58^aT3zoz1<$MlucT0 zX3jrvO>B-#fjP>}ijc4>`WY*!HiXASkP?7yBwn3tyk}=vCLxyXG(RMw0H^4Ie$J zK>!F3oS`Cq7rx)HhC+l|mP)%I<^xh~WQdvP>G`}9T#H4TCS0@-Q=Rq$ zDCA2l?+v5PryAa}N@+{|{EUYVXsucMw1Qno+#22KO!g0f#M}^*5233F$(z&ff=ntC zvNT4HG%B>|h9-ipJxq6&$c$q=O#MG3Jn}d9R6+kdgHulqc@=879TY%y~=t68v@Miwk4Ud=;&#gtM$7D!gx<(R$AHyF7$KL)iOuF9HaO9Rt8X#%Q!P8jHd6d_naBYFYnPg{ai@zQKjRRP8E+#g3G5CvEc zyAtzKDdOCS68!FN%&rYjumyzT-*MDDvxNf$!mmxrM{I`xB-dOB=u1%ZZ(2il%$jJz4o z{I>Z((?&ajW#1m5PtMzE-}haGZlcFjp(oFK7MFsw9SaSwh8F)a#~x3@{#JfPT5QN@ zQ*24^xMc7N@5h0xFN|p44r|eQ6*R|))JOf0U$PtkLGknng%4UZNf9Ba9yx1rRI`}2 z##PNF8NmkK$ja=%ig8$W2v(~H)6i-QRF%SZB`*-LMlyNog>nMD)DICWR7>`Eytp&TAF<5 z{f5-11C+TpjD@nYq_K=u9C|KJI%z>2nQ~oG$Rw%q9jVIN_wcHsBK}XCk%^I^R#fMa zef8PswK-QzB{1h7Nm=W(bq*EOGP3j31I4qcxXN)Xe7ulKRRfaY%3kt-nSus1)V0KVqe42|DPlN`ijc#h6nB%( z1kd=2ZYTtY?ZYh~LKbGCJPC8%wPd%uTA#0#3`Z>Bb@))y8Mn=#o<5)WWj+IyUHI9+ zO`#|Mdz9GDQKy)Z)OFZ$WIiqI$_zz?=*T^}hpZ;?RnxISfD@R#m=3%1h*-HJO5JSp*;iJCv^HUb2C(NJNbeN`bYvIdl&S%`uXCh~;3@Hj|Nc`0y}viipF zWXy9(yVkdQLdQe?tP_exttgYYYr zwU)}3_Iz&{O-JDt=SIC_FS?`3V=sMG)vj7@!E87T$OLbYDWEL+Ln;>{ek7rf=q(8v zx<0+IB&(~+Xg6g2sv0z7{reU41jtzbshjJ1T`2N59(gCO#lbBO6En$N1l^4$%ptm6 zoK$h7uutJVCvwkk=#@wO*@Sp5j~coi+iG0GX-v-eD>c?#JcB?LyW)kaw2Uz9i^ z1#Sw=?C-^`ks@vA;#j=Xv0Xv+k+e#!0e1F6Ni$+^u9*9F$MbuET9F#ss)xZT>Lw;L zH;JH6m*v(_el2@DKI`7SlHx7UFfY>nhtLn0IS-;igrKJ!y~w9U`&DD)9@Ty$efcJQ zT#=a2<}?xnifR%MHwqpC?GqgoHd30itNc1HDM`P&@@Q;1=(?`jWS^W79;GDO${$Jz2<5G7NbiGL+Hjh3=yNYZ~3()i3YdA+hC zJBk^6C?5;2wE*LCNpaK!2N~;_`nx##Iz4jJYb)_a?U^9BqNNk4BIY$vu1R3jMuZlS z?$<3=i&Zq*67T{C`$KXb&1-!DOf1|U{njbSy>SQ1@Z)eY^JpTy-g>3382>s5oMb$e zX$g_r9=i|F4sT;(VR?4yhBY07OkBAn6J+w6UjJ(ykI0@7bNv06GXK;euB$9Q#uCg% z!ZmB&Btu^Omkjibqf$`{2njXwK8cVa@mL--wXn0<2Xb86+97L73hsD>NJ!mW#O)jq zom&?{OIv~rD^-~n!3v>^Z(@QD)eKOqgTQm{TRu{k_%;I+FGiNXG%IAqh zouLXoGRza~Z;yIbs`=*m50S?~B)bhu0U(2<5*tn<%zg*qxN+0T_5FNVc0fZ8%TPHA zTD~ggien6Qny&7I421*WGxEG3_7>C-eo&LaaC(3BdkcWba3X7iUC)Rkiwq_$cQ~Ghn4a=Ko5J3DwNsgYj0NUU1JU)pU4t5_6M5iMbWK`+Cs| zpa~3byyr&O61{8{&p2uo-`V{~0*i$1<4_PMgg(x(Z2Xxl)wa)n(bsAKDL4F}%}^{a z1V8%=SRDxwvwzwXhK)Nypds%lj#RNHMsGfO?A)@GQn+G6hksM%1L^8M9P`Vl8@t~0VQg}%dZoeQ z;ZW|3({AN&@L#!^#mN9_^E*Hj+id&ha)#KF*?g<2(PtV1Kr=7aI}7JDQOI&Tq=pH`QHcnp7*Y>|I z0bUX1Ed&iea7e>zUcG3aX(ikR5cyGjwDMD9w+D3%n+Q|a_8h#gMVgt0q6!PV+=Nvz zB<769_&JAf`iCPFlBsot+}Mz?oD!7yF#^OeAa`32s-d6S1g^JP1{QW$6>%TMXrOfy*O8*t zZkQksC`%$x|5s0;Ssy2TwRSSd#|3M?W02v(9o%pnmwR@tQ#0St9!5S_;m#VLkSaZ< z``3#$A~)&iAo$uCdRCcKha4^?Z-vZluv}DhR2-U0sqe*>IfZJb;X^UIjAN=6(OyWj zk5Ro)KOjkeRMlNxdfm2QzL9wI_U9F<6(+S}q{Op{HPovQ6jtC6(GK`K?#;Fvv~+YVqIs;?LqVtl7LS&u$Lszf5$~bq7F=6Q~s2 z_`*zEzmFe7L!~m5-Y}9^fzEQFC-WjMxx{7Mll~ORQ$`}W73S)dGo2WJpYoeN)rh9o zhkqXTwk*?QVa`o1WBkJ%{x1J#HObcLo@uzBD4RF+8)wj~Yxym2`}3!+!H(9-p7zUR#I(?vLG=Ll zfk2n9-j-lz51v|czp4&v%TW(Tqwf-nGK2lgan5*F={Ps3*`6)XEp4AFLIK+!S#tAbo_bT?nTwCx zIo2r1e5+xk>6XnmfXC9*BlZmiULj++{w(lGs7B4nIePgf9%#Y~L&?eivPob&hbKdt ze-Ti$1cVd*vjp%VxZ81Y`@GNpj0TN9ZLTz?*Gf!Hxm^H^|URc`n9yTlV zLv-}f>#4%*^zSLx{O6y|>Il-vvXh@YehFZ&O=*S;ZHI`%egAZ_1OWh(;~A^$-s@aS*|7i7 zvkB`s3h3@Vp zw$yR8Jk#IQ*zLMy@B10n<9~C09MBWqIK_rH{N($4YNR>s4*4#HZDpc^^3SfgE#~zM z!r>aeU&E;d(61d%6`;++5g{g2kNg`llkJIR44yyzIN}AllzOm%0viEa!L6ey00>M% zj{75kxhV>l!}5B&H<3y~5HJ@5MBr4$U%cM0&f;=u%m(W%4q*f=h67w%UPhdmOjQ3I z5%3hCn+b%op6*XquKHu!6788hD?{pH+d7+_PnsG3eK&xFLh5)^*Dwt6vD1<`iJ4r} z^V#ve>UuiNwCi51{y_V9MTq+~#YPn)wDvOCFBQ|iq07v9{1UPIyFHu8`}Py?rOirr z)}aY}ZP;ER5ORl+gs%vi_KdjCA9@G~mZIf)-D-VxftyprgZ4+=Rr}N+;7`Em)a%IgVK&^64-SkunCE#BO=mB=j*FzBV@`z?5ReC z`&@{70+~R?9oIl5d6V7Kn7XYewsbx$X}t>&I_;{`HvN;U3_oRRw#1a#i~r@BAl)io zYe59_2T8HPYJ4iiJhg=ROx86#LiiKHONsh>$6>jzpTyv2zK>>@*! zsM%83Gzzk_JZtr-#!Ei~Z*DrXNwn9VyN#11$;Cz`WUw1nkfB_3Hc;`i9#^ z6$l!1Z28piIT~?5ZBd6TCVlJ|Mm&TiA`+&_fKV5dh)YaqYf>3dJ0FE{?QPrq?Vavp z(?W3Ce()uK=`mvMwP-%;jJ2p0A=Yi;$+N246%TLpFywR0*yWKaMeYkbgVEbD@?W#< zq#%dYeYskp!p5qAu}hRG?}mKR+{gp_l^nyr_b}$pPbx71$lf-kB9rmDrHdz;UQ}uX zlO6E1!}*NerQo|&W_WX0+`Y!ayTo9_R#SO4Bm!f~yqtOxV&4M?#0IU+dK}(%+WKE6 zNW5d8yOkZ&MzZ#qwvL&WZ464~3^KLirHkLYIb=AbMkGhg5;RQ$d$m<%hjuTg|cqQ6hK!bAJ z%#I*BtN_pKUr|Q@ZJ;{R{{64V!|6_cs2I}MZY0o=;jjT<872JxMAkqIH*lo@7-;_2 z02m8UDg{6q9)K~OkRmH_gJR?J2)4S`d~R%hi3gKUpgRq&02z`^)PVv-Mz8-IDat%$aG$3YIbjBh`FrvJ$e-CWi<={Fc~0jClpo1&pwq>>xDVhxf+&8#EghpO6?Nw{9wBI306>11;~25!pH6s=`(As%sUD4ZYgQv4_bsGeh-Ey z%>iVjkaKfzS5tqLC;|iP%;|1Lwc(cR4eLKHi(^pPf41mSR2N(_rK%4dc^xFx`#D{$b9=t!&P;yAsJseY&<@BCFFGOc}iochmgMDL69>7>LJiNH{&IRgVL&?=t8AFY8k ztd{t-j^zSN-t-$Qv){)alE%Q~{(E1e)seVOLGVcndjP|*b`;U}3$Zu%c5y3}mk=0! zL79aKY*j-N_{71}8rUZ+CO2GTz$l%`n|bICM=Hy($$RE_(muylQHGULC`+UdDda@F zARJ0toc#%fSlo=SFtjlS0vMekLLj-7&?pb{91r=TK;@s-(0v@$ujBSctj3f_mq>QR z?iCSjE(w|sBOPzD1Ah)3Z^QFW%by;LY!9u)ULzZ3RDzBk>QqOMD3!(pPFSq2Fe;Pm z7=2fN8h4Gq-->lBV_<1QRO81&PF|q1QJTBBUt6H+b|QVOgSg+6FVY9`?_THtUa5(6 zHmPV_iU}w-(+O^XUZpFgU$m zPf7p;T`7Fhy969&VaX`r!Hj=DK$u#LA>dO)Q{5Y-;sa=%`xYam*E7zvVpHA1L|i&AO5UC67( zH_*e#YB3#M%c_AqTD~(go4#OD(YW>fc{CWUInKO2zt55q)Khn3U?C!yn zKeMRxh#iRZs)@s;##t29vB6*>y@_|F%H8~fN;kuP3>hn=zc9)e&!9lJBr!`>Hy#TL z`jbNvwDgz=`SnG$%FwjzF?INvNZ;u*^6MG)&W96S?Gk|v#= zc<@E6y-#HegquCJHB@hg`AL7$qhc6!Q@LS)C`rEXWl2W?gi?!o#-rR=q~i5ln5dR8 z`c$(9{N>+~haIQ+V`tEtwHsgsaCGH*9a&F+-1lq}=jkXPeb%q$*d=$W*K=khpPUZf zaJlW~ccHdltow$X`a+RZe2naS`pDyEvRaxwbq zdwk80x$O)DNr{DY>OuKrLn`T6G&0MW*m55Fa>=cX-$IpJ`se*fRc>d|1;I|!5TQk3D#8`EZ%SE*NWDmnjDr|JJ^>{{ znhBPUYQ0Wr60XRgRJr@7rw;cJG@-eh{3*V}oBYWyZLEs}u@j4hOM`c=>W__ZrBNP) zBT^E-w}ov$eaZego%@^gEr>J@az1>R<3nuSQ+OQILeoQ)_6k$A^}rTFJ>T0?jM31q z33pUf7$eM8<6bDp1WgfP>t*TGNLz`o`##d+SzMXnX(+&20g`tQ+o_R;1af@wBZVFZ zs0IItD`E)Xro&Lk0EaZEL0?cjnUp-h4Fno<`&fJ)N1O_Okg=dh+VG_7FelJ!#o;}w zU?`I7NaOpiTuvUbs0jw0BpD_1CvoIcrn+n67R?MYVTxCYour}Riz?_6))Vl^0sc`+ z?1tpL@Sxn>k*fy}6ja_K94IfdI>kZp!d^1VumMsT;v`x8Q^4XC3WYGO)79%_T7Tf` z>8Zbgi)L7KqBN%|jcb2oQ+b>;Zvj=KUv4+eRT1L5yf<+(&q}mP{52cVUJivWSly)| zFo6G#JZkJ=&@_*{bSlYhblV2>5QF8t7;8VmFxRtg?b)}EMwH`wPK2k4wkziH)O)hv3eWG; zv{XI!TC-Tt3Ju%(wUc=i#kY@zMuMIlga4*Gc`gG)9Jrq~#(dD1WW;|^?Hjes4-HAc zTYEK*lL%p+4P<_hqM%BOBy$Upwo-JemOvCN&v?3-kBd?rMew4Udl0WMktVEO-;)MG z!Cw3-Lh&j13sHct`~dk2yAQlVG)TlhR56_!z9#wmkhWhc)4f-?F9|BieX>+gWUL}Y z_`jdgBZdViOV$m{g`dy!sxv{V zGd`l$xQIFcqY zX?OVt1{zB=5_K32JPhMAO)=n|$4DC%$Xf!=Ns9R$>*+_8^56N)jbw8zk4civ64ZXL zQ3}{%#5|OMF`AicGII@PjzG8ZSt1phWpF+rT)2Yx424KmUQb>m83sx6@F@3yXiE>t zG4!?#U1FxUl8Qg6qYi4|>?OJTNP&U1yuBh-P~S*bKgj{=D>?gtBAtCAkU;Jq=^YT` z85rXp5a}5h(pY_V9*oH?_3^X4T>mdu|&f9~A5vuDp-5 z;Xy2-DF5XaIqT4&DY`y?6%-&Hu^ zPlYpIVHKO1-z*2bKA*Fqyma8eF$)*3cgr-ZiqBRM8!LntE+h<&a{}q57K4BqsPuUk z8q2dymG{{VzqM4PDXy`M?F)EM@7u9<()i(X=X^bQ(1^(sXBrF+Tmsk{eLPZ>sg(w3 zoG=7%Bx0PLv+1^jYC^kJe4x1Ungvqwg`Q7ZG}on5TXM}gTT0A@k{p@XA}Xl( zCS*q@1b0Rh$-=a55h7wkX@m}09haY-Rtj)`@KCE5KamL3+JveqC8VQsa?2sU7SQ3(LNUvubWPnq%hlo*0proK^4F;X^t6jO?bJaM`9cq zcOA5WEj!5Md8+**w=v6Yyw_{Kfh%&7Vvbf#(W;qrHpNPF2WZ}S@LjPCZ4lvRdK*md zhqZYJq}?H}n28WheBQy$-c2b}(xriQY2Lxah`N&`no}@=uTvNmQ+HVGjqghl-K3~~ zH5!bJsy9YLn%d)}nqwmBeGyr2d}RFzQoYGi{mD|@@lx%H2!R_>7l&{sMARJu}vS}HMk!;yq7sEnQF&q=T<#jK!!xjha_r=uwg~VrGb&2OA_==3a&gW z5DUCC%fQ6gapqm;H4k)Dv~pDb)@i=QV@02l{2&uL2JKTo{l^mQKSA=_h-fAPdJZ=^ zaf*bWCLjdYFK`n5N>X_@V-a@m;TM`SJj6?b9t6UrL>wXn9?@Gw;6(tDolH_lM@L93AWGIs(B25r_eXIktP)57 z@B~OqE;M(93pGCE!ElDs1+No(6P$Mlz8HQOEQiVzrw~A85C;z>K{VF`xTossgyBFO zqGCWODpZ0F9XhTN@UVFUv=CKR6(&QmcQT`enVqcM!YXa7%*a$QE)}Y^>i5c!iJ;Q^ zhK+gd|D%1=2Zg~5H@^)-Hh#m$f~k(KXcJXYW+T! z(`vJtoemk9myW&K5P3TikF@im3Ni#c8#8&P$w|`|+?S$-@hFQ^#vZRJ-kqJD|8sqHT$bw|Zl9EdX z8c~Q&mm=MEP%VIU(n2`ZZ}qV=V8H?ZRFA!jv*I7#N@z;8WK)FK9Obn|$z0VJQwE^C z`K{5K3db!7BAng~2lc&RN?|x467$bNq(d6{gavB^GdEH;-aEOOG@!0DI=b$-=sM#f zYmASmF+Qs1_?Y^mYuxy$6#JP}YnW7TLR5qC5w*rkH77>Y9xv4y6Io|mM4d@eoheeC zX;MAV6r_>rjhE_;iy(q$f(+q_=Q=)GgE!FxWrcS@wwR+qgx2bzqc6>i`nf!Ju zWLp|oR38nie2Buh6h55jI1d;@*5Z{WC4u7JDGo<-+zY7A^bCtB0E39IcE_E!5|>aOCTPo z+YYW0+O48S!~d1{JK!X&2DDxv5BeB%_}KWY26tz-f35$D-6b!+Gcxh_&7XX!+s6E3 zO|xC#FMPCw-o@{VYLS+NO^*J+#)5!XU$ zlpPV512vCq2c&i92;G}&-5HTk+8aS3ZyKA@vgTbmq=7@XZ$zp-PY;#8l@y;B-MB3s zHfkv~Z3DXrmhKTm^`Ch%*-siE5=1ZP2l#5_uj zWZZBdC1y(varSg6o~A|ANKK1PX%Um$A~rRn)?Ka8GSZ!C$WkMvEiOuGm=%+pCpAoq ziqDL=vqcQ9C>|Baj6z^Sc4QK&P170pxlnQjnuyNQs3p}uK1Yfpz4x3Oq0@O3W;@_r zmp51SYzM#m{SN3E7d#c(j)k#fj4e^!@3~Bmx()HFxo*H(i&=zqAkt@!QMFgTL4A*} zP7j!45JePRkDzIKVXB}gfiGC7%B~ve{d2$;4SkZCZj(3NJ+-+sqLwsKsy{xm_V}op z6Qo*D`^VuhqQL}i0zmlKC^8w0lgOPAS$iBUXQ)Ni1Ww`*G$xX0Tm)GbLPWL(sU~tw zkZO#RqQ^(Y43eb2wWCM>>At;vKVt>^=rfQqeS3@#8fY5r9i5Jgg5Eu1T=hFupOfCb z`*-{7V_cOTTxGxWnQ!JhUqq92iT513*Fgh87@Tnq38JRkz^(yYeE?D zjC|SxTp}Ej1**J(Z)vT{{*q@-{QYal{UbdCB=>+wcmD{vuO#=Q z%?{-L+|!Rt3GRW2rHvB2{UpzTNXNh!b05jwFUrwJat@W`c@jHOmsx6gO)*|u6j?Eh zl47RiIf^yLZm8if-flPi(`9_y@0rV3fiF;@$WA<2;VPMqp9OHgt|QyQj{@{kKs(@9 zr1`3cpZn$O(D5q)O|OJXkLT6q*wO91k80KG8523UX3Ve}wLiJ_c6O$SrY(8hKA$2M za%$PC4=y$lfuG<+w*4o^J$$Nn-I9Sf9_|x&a>f&^d=>Lms7#f)>W|8VbDj%;sPI_$ zX`U=Za9jaS!WTuJ_50?SDjv2OZ*x}OW;guH?HtU%^96x6Xd~bVdU=`RAQ%LMc?rbR zblbsIg10QS9sj?g?Lb%!pfHmfMiiBp8I_P06QB0imTxTDcIw^!QyU~S=`n0Yk&P`} zw`;@h!ijTMOj*2U`m&w({O7q?=*ErGV^eau!krgk5?XwJG* zX-{{Ly`yDq=sAa8$wEulFapCro7eATW z_&+a1$F+=X*gPVx83^@>OdyJgPmfJbM~H}xO>7>M&@_UmC8BWZ=;Vx;6lm#>M<%uq z6BB3(!<~;IBr2(;6yE}eQ3)ARqvp{`&7_8pps2|BmJxAj(D`GMX=z4eLQ`COWLyR= zszypi=70OoSaZDd2O~RwFuK>IwQXM?9-G)Ks!=m4Auc^8J|i|EJ@U>b^%`gX_v5dc zKh?8lBGp-H)QsjqBxK-Rs8|eHH=3d5QlrPBlbS~*;-pB{BC26J&O+7}oi0P)!**~@ z=N%ARx&T_-wS;yi4yJt@uavQTzk9sP+}dTlOEK1in#U}$iZRM#iX=_RLDL7I_%SQ3 zLE!p-lrR>M3dgMjAwmLSQ(&f;fKh0M{M9j61w*f$WfQ_{E9SaxQ*D>67PBThw)}p4 zn$(Zx9n>EcU4KMmJB%mfs$ztjCPv)x1ZWs-=cvsw0~kcq?ypS2pxiCVCC2USngB z$C%7Y{$O36dSb{8r~5VdfA+ouPKsjrfA;nQ2Z&h|xI2QF^*#0JGbfaEaLm&IZ3zX z47|-TBrb2zUADn@I){{TrcrPlZ3$l4gmZ%1oGh0!SUM*U_QGDSAGTK!*5>bLH(cAw*u-eaRG){CsrRJglARF$SUx4%N2 zQk5H7?|NzSyp2CD+Ene~hOxIk-7RU#9DkPTmHCNTVHMXUGKrao_4W=xytfw1#dL}?%8^u{jlWlvfYmPoAXHn>%Z4$+i`96e%GA!CthvV@s9iIc1!zp_Nvp97wliWwP@DLQ#D)l zh^_c?nfR9)wC%m_puBXa=ZD`;zR|Mh{m;HV_Lp6&_IlSHl)g)vRjzW)YEQKpF>Uj* zovxL8yo1K9iixXfz55NzT{Z4{r0MW!TQ(e4?|QIq*@RcXx5)A@m#tbS{)v_o=O0|Q zM_Rno{q?|UPt<%jW7djO65Eq6j+wjexn^Hx{<^#Ir^906Yu)*9lkxKpcOAaq-?cv( zK4a6Q#fN6BI=66#XUQ&Cm1kNw6K7)apxtBF*g3WOo zHoKDi?wWDYs}Ro+VbDBuBcK?Dm$6fftyIMCJ+_xb`&}TO1^9Aw7j0_jj-*rc%^eVd z6q5f#6cY2eLIGak`yHq*5E?BgH`=3Qdnv_!lVZD7wwL$Y<9)X3zM{u`1^@Nszpgl1 z7@qe7QU_gX$GqRLbE(@$f4HglXIndWTKD-k%Rl&R;hSw|)UG%D!H0U5E!V$nxsIWR%W~5gq10F*8m^p3cYxXibJ>DW4yP>$xEsO*+z_G6B%$nh zp)@KK(B)0zg`2a5vZH~lv7@46het&wm5m(y*xh@Ebz$z~Oe|oUU)OP8F|Huz8OU=M z@h3{^p9QQl=RpeuM65r`0@>NcUG${nye;4=!|Yb02+!Am>Y;jq^@KD>s2boqUy!A_ z*1%1x4?GsAHdy6w69k${V2`GiGB-<(JAJl_-lF@wg-`nJudD7B0qJ9=^<;q|jE!Y% z7Gp~oTf^8o#@4gI1}1N2;x^{n#yne@eIv82Ww}e((Wz`lDqGuCnbY1rp?=Qr$Ihfw zI-PP)UhI-pva6qY(6r%&7Ki7R(77If^DC0sJa0r? zx`u~X$`zv>e3AQc32$ylK)GD2?tt$>2xK-6VaCJJJ4u`|*^}?VWY`7z; z2qsrC{kjO0Z)R4L|5$OXDFlY|A z6=f+oHD&VDDZDdMG!PxYnr6*FDDV;m0z+?zKA55Y5?u}uDs^oXE&zk3Z4|iy!0iF% zeGp)C4tFzO1^4xP(-!Ie_hHz+bc`S#qIt(bioGn~LfaMl4H2&>T-tc$^! zUP%N8#`pwz6D9_?R5;7DiGCZN(Wu%5Z^8Ytm`u6@x9J{;UJsZ@AQ6h~FAZctzoR>V z2$0ju;Qz4hfS29x=??fZexXu>m?}-I73)|l)cDuyA1vN{cGa%JCT;uNl29}1u2-x4 z_nk4n>{+wlzi88$b^GkommYYfb}Jd)2PIXKQ{{ zu41iTX*0JS^}O}TfENzJ9v} ztM>F5IN{c6iBWgI((uDh%lDkE^56F?cZcU4{2twCx&z`_vM8yd*HFEN;Xi!h$o`{8 z-F`fHMi1>=s1`5Jx&kg9X2A{cWE{I9mqd1n>@^^-JjP1pP`iw%ua2o*;*Q(J5d%%lv0E{9P<}PJ$Fb8xUPgqoC z=60~$b8OFU-^|(DzUexnMq=juk0sq&e)#R>2S=A3DnyToEHmC3J4T3xYZe|^9Gfka z9UpNs*CtGe#MuhtP@7P8Tx9InsM1*xWwP-ohf+Y<@Onh#*iyo@io&5c%Q|{jJJI)1 zY5rFzfBMcrc_;=-2ox<40r`S%>tNWVx_oz5Eae9_fK zEc&l%zfHD9$aX<<;0}m}ozCVotB|Q$GIa-Fu+tT{DnQbpzjs9_c1yrh+HjPS3(H6a zcgVJT73VXWyNLlchm8oJf?y+K$8nAfRAX#_IOf3d4H~Gc!dT;Gjc9`e1q8Q>!4wth zJ+wHe{u-1VV~WgFJ5x?G_bxnZdi!8`Uc3CP7tRf>oc$lL`LFyxedA9&`=512YX!d^iag zDjrXr&E{COYSpAklZFo;I*gE>o}Q7BF?#gqp+krM{PWM}&YhEG8N_KEpF)+r0?M1n@K&#ZXXO2kr{I3!@D!0S4`o z43$t*R2{dtLG1uUqfg)7qsNYubxl?!1rMK5v9W;P4*!%$!zY_I zZGoHvf51<8E0iJJfNG2|!U*F}!|cuB&+pyYy?g&srLvDWFT@5Y!_BL6cSvqb<^ zvj&7)U!3{dpKrH1v6C%UCg zT(b4_v$ej6y!H7Hze!)dJ-1fNugX98>h1Txa_fDsR(Py&#>{Qw=4^|)=ZUg$&-WZM zYsr?}hHbk}nzwPmmXnXZ()QMS>pfZPvsapR8u#;-wDAk8Jk{Wi2VcMI;kuBhml}Tl zz_ZQof2PTdA}Vg+Yf%=rS@gwYCQVFo9RCVG`N%&9WmhJkSaRy=>Z<{Wo9H7U7j@sxgn0LN(`+aZYW&Av*5TM14BY5@Pkoi zE@SIeZ<5FUyx)1d<}GWuqt5%}i*gZeOkj#e?&8S>=2UH3xqw^Nxp57G>Wo$GxBK!c zNd=GT&e{Qg2c`~Vfd!21XRLrRKV%og7UHPu0T^oX-Enxd@go>gu`psXYj6TXSK!Vn z{=*;{Y-Q+)Fjo-ZQ9xFiq_VsMam&`+sWaAo)^W;zo*!{X#i7wRjkK1YTKbN0bQS~d zi9mZCj7J?o>_nk7E@Tj*Ckmye;JFO3T{bXdXkSu< zeNdT`gCBA){EFqRWpW`D83s)n1YV9Nag;Rwg8`Y3CBeH@AW9clN`Zh6=Nbg^nYvQ3 z_jDCL;dPYNT%}Z}1u9R#Q!3z!Rc%qK&B_m4q~!@0)E_!J0c30kEkLkGDz+Hac9ZI; zA$j~4zK&yL?0u$PxTrDUfd z*#+i7Rfwr9Ai{(|qIl9=k*XsCr%gIc&04^2fiz0aQhsL@PhNe)HNyCSMC@eayOic|4UfXy=i%a0a(yA%{w3f z8-oUdjLzfnZQQsyBO_xJAw7NMs8LxHCr+L=ZOWK2S))gf9y4Z4c6K&A`uXRd3kwV3 zWeAS@a!GKOXeurP`ryLMEMrXegkeL5FPJyq=kxXH z+xyF}I*y+>VRZJWv>~aTJ9o`Lo5$pU>ulkul###wfVu<4VBh!c-=RZ?apNY8A3r`d zC8*!Wqz6i zHrl|rF=IP-`flF5c@rm2oHl9lniVTOE-xw^f(Zv;%MNySVT2LJ9|p7{U?Rw(p+TLm zI~Xqrs5^irkNvFy{Ur@?IIgZsBIj^Hq7DHSsp^58tp9paONlAg!qhuacVJt|0yZ3^ zQddDuJQPsLTk2LW2H2Gdh|Yo}-GS{1euR@$R895uFW&Efcd4dpF!Ry1nGZBt211W` zl+i@MXdvSOo3QTSYGIZc&$QoPvw$ZQ)UWj1JEMNx`Rm%#iEVn8jZ3uLUZeW6Z)N|y zdDV{mR_*)WQmuZ(-MG#__TGk3@Jgk6d{;$*&NUF?>Im_*gnJW(ggQb(qv)zl9(=X^ zqi=i~i`yAC7UG*&;_64o)w%cic2!^O5LpHHGA#FCi-%rmU#m^8S6lXYu4(tXo_zb} zhnqg|%7<0{`&OyA+OhFJgzW->A&+d4r@lE&E ze7Hut7n^r~G2eYxe=kJWs?Z1n~a6>8pof4vtQfBRCa?yt7# z^-}ZBRiAAWQ{}blFTeM4%dY>a_tj1J){lSst>>D2`(m?iUTgaG>&?G;;DvXePWd^lx{C4 z7nYZc9#-A;bpJPu{fL{~vV0JVFb14^&__7n&A@6wt^+b?mH{2HgMhq*E(8)m1OR&+ zA7c&!p_ntPa-_nJ~rKHw^2xbTogl&BpR5}4uEf+_>BG?fLYLEw@$Zf$6f)SP_J zf>KJ+EpkC6wdk3E`$HyzT)mpHGXdtqGD05Cd~rF4NjHbs7T%IgJ0IB1EVJ>eCI zGnnuxRX>x^J8T;oQ}OF2=?*}G0Ut1R7!nOJFc_UF9wr@SY^m%^l02<_wkO2=JDH=5 zW{)Pd8YfB@X+v~#qfp$$QS%78H@L3BffIHN)G0)2j?(^u>aP5E4fzMg&gx9o4gP(Y zXL%riXM|EJ@cxDZ#3w|>7MOKJV89<{Hxe4TGj1|(2qBvb>~AnYb+{(o0k#kXt`qep`ov`A)t~7>L zBq`lHfA`tv9Xfo{zHyTlX{p2fZb$Cv6Cb?Ye%q!4;1y0pgI1y9l!TtWdt{Fphcl|E zcl)+urx8QaHJ48;aAl=s%$_pK?^B=&_3YU*H8mL`q9_v7*wmDyzJ0!jVn1|n|5smr zzJ2R9h!|h9ux{PD&%XHF;c`m2bOU$&m_B{_$De-U5%C}rOp0!F`sUkjzV0ZBA}*#- z)LAoTe$wI7+}wP43hffpOUVata~NTS@n?WNBmeVzcXdPE!RVOCaS_58K^Ptv&(7pR ztHh3yw&{UEBzD3y3gw`#@=D;G3dhLs78un-Ia$woQcL-ht@+8f=gnxt3YRmzPzfNn z#33Gf9vc3g2l9`1DP98J_EN)7f7^2I>j6Jh ze7r@Kr&|5I`t;tj>bqYjgX}Hb^GZZQov7-~ELB?x3C-bk)E884BvfgJf?RwfYeHjd zm8OQK(oSPdWg{Rq*@*)EdOs6%rEZsKWZFgQ!?H22VhwdHV?s zEEVfn;~GT7;Q<5@@s03I$BKCVVq`+I$f_;y%tbKc3X7&um75E3c(NmIvQV*+wMuh5 zc>(uR#C;GW;_6!C>%>-R2!@!1hLLoxft7YH#BCre*Ndsv1mY}IXoxXK`#MpT6Tz`? zPi?TVgic04_u!y;3?!;TE!y(1sZgP*HLg)~l|~R&bhUdQ{8-)vdGe*MhsX}N_WJw;9jSCCNsk~nA1 z92jy2OYhS_a}l876;0|8T} z)u}L$bTf9!P-lvsrtYG9l~Go&TWE(Ig_43wOk{}Y70q0LGC@b0p%^+I?W>9G%&8rH2M(+LaB|G88Byg%MV8Hq zC^Iqg)@-5l*yxyyC}Bj5u;gjM-tkU0ef&C^76sR6jsVG>=`p>$frI?!# zaNNP%rJ%y-E}Wc?D->wiKM>R$oI2>jtpRxD!TLkG1FS-hSjBa-x2Tf4=qbtb0n;bZ z+`?QV;4+v;XFdpsi!KxgGb`y2Vqp#!LfK4aUfF=~9_j+Y{0q4Yy+V(`F$nEIGLoS{ zQ=>PLa6%9rJ&lC(A#)g8Yv@Umw~62WkYvAAwU@%?P~ub(T(E;1g%lq?%G(q?f(FI& zggK)Fu2{nz>&m;YsHiK9Yyzx^^j}bWF-ACq;%U3lfKf6thsexF^B;b68?-}kyWo=` zO4`x`N-lYLg8?eu)$0y;EyZy#8Q{gGOP3BCo|Zi(bL_a$Sy^M!hi9e_&swx_>CvNy z=ggfwW=z(I5hKQp8<&xhk(rq}Z{9pU_2BZrY)ADg-9R`41`O)ge<02I*X{Y|dUo!* zVD4HK8fbv+*}bh>w=SDDZ34#hNr#VTOr8oATQ~e#KpH!4!tmiET=x8vM-P4Y?nnFg z9LE(8)YLTEiJ)ii9%IIgBP|9Dx7A*~`V1XBj7h5E@QfTZZ1$9&BtI&n`}gmknwkvB zR1`_mlp#aX`u6!AhUEwL@9y~Z=X>|=rF;Mj2|Q7C1qSSRkD(aQXSM&hgHM*A4<*UL zNJ~lW-?tz518u=j&ivjzUAqs6F?9!H zBdx>Y;dBY20bB^bQIMj6h*bGOl<+?k1Q<$=1Wet5-~MlfI$VFz{fZ}vv0Y4e zK)i8@7w{Jd&tNbz)C?KBU5FS(lza$+hZY2e9@ZUPBg}F#3+{@#0}#DHc#f`ug6=~# zKK(X%M#c}ThD==8s{3X#m>u7aO606TgK=Ag%+Iyv1u{OO+;g z93%G=4_u@mD&sf&h$;>F2@94uJo+&rt_c$O8P^aATw*jD3h~W^xaLAUd6JMQR89l~ z-}(U$S&XlTk}5okgBS6%MQ~%OQWq1BF{dRPJTmc(@D{kHhfO5`HXPgxY!Se1z;hVjrVdWoxqF8!t6+f&S6qeb0SV0z`-_e@#G*S<)FD|8 z#2fr-%0Hjto&^G5xd69(VmWhJ)Iy6~Xw^M2vMbhGRMzXLCVK1XYH!AtvcO5*aH4*i zkv138Mk#|UNd=HcAQq8E02w_!D?#AwVlw~1K?wvOT@0{>P(bnn`H$wNYnW)-HcZtR zj8U;uk`%US>)Nk74Xu8Ea;dVTqRV7O3gd4RR=-rr-K~;5=vFssR*?{Z2u0n93%T$V|s}TA9b zsHJc%iPdmM13{Y#&e_3fJ20RzHFR!4E{c|Hl|^R@U7Z~;PBLA@73sRDG9cnDHy(KQ zgmM*!RFt0v6dqN5t^hIJz(cGIMU_)~nYYa6ocF7=|on#CcdvZ!z&t82%+J{E!brkmK(sj{-wW)fAwzsV4-B1`%v;d6SMMLD{kV9^@)zq^NiA zo@27cf+sN2h7f!9?2WnuRreLyMh_k_d&*Cuh&%EO7%(6?c@V@zg&>)Mx`V!b;Z{-o z8#b=#-Mja+Y15W0S+wN01;6|O0Hq}orUMNtXr3vIdSd!-4YA}fTie) zX3%^DYWqQO|IZ78vj=jeGL{oiC;4oT>z*jx73nRwU-Kp7yaVm5*O@!}=b2r)cJJA9 zz>;NaZ9Y-d@q-W3@%xj8Gkj@`5cI1gpceq{gjWbUtUI_mnB{aex&xBFa8dv+K!^j` zyIxe~#OO*u4Pq;|u*Nq9(HCSh6sIfH6)M$>sn#_3B1&;6HiH?(U=pW`i3`Tyrm2w7 z90|p5u!Jj!%|ZPF2<;`@YR@Fe{h4GWDxV3;^Hc$jb zUPkSXkGS#wBJ}})^KLMheg+LNpmcl0=`b8z`WtXY)ev!GLbgD4e<2lBQ)mIU?zSo} z0SM$7F6QBPR4(l}`7(9>#n`IY1l46#ys;kF&2Gn|is!?CG?uXgy6!?vE(+SC=RLP)+Gr*@&h;vUC(>^`@kFvs5tWs#;CGx$T&9*w^d+@ z1YHCcl?(!~>}BUp=lwc!+$;ZDRll;UYnV`2oPCkcd(?mEkO8;b-X}~%C zDxIW|!{p_vy{A(6FU=Oq9Hk6bBvuu7r0j}Sow2;mpyG*$ln5k6+anp+gS6}sL|<92 z^AXwIj_FgO{xHMAbU)S$suNIyG+hF51;tHHrXqn?CKw!WBAZK94(#O3ZxP_eM9AUg z2*L=}Np8TSY>`%=|vI#INPJtjJV|1XBk8!JIeS`;7)D^J~%_V6I^E z$M13|((C$>BS)rBpT?Ibj2xMnoi%>kxCvQVqu_4Ts8M6ajLFK%f=8=YuLiH+l`F9h z%6V{rycU;qF-gWl5Ht;QSl1*CWO!n);Exf&!_}aolHyOpB2rXQ@!%SnfQIW44BU+n zm=)MV!GQM=dC}*m2tf34%R{W{0ZqmUYgEdLf=vN}M-5Q`L-X;I(k&&b)Hthks$dx}SVmNgV<*q*9`B0zb4QODeDcgupQ?WRS@+3P=YgEf zKicD0EoA=WmkDT_yt57g`!QrS3|PnBoH5V1Q(`@XtOd#UTPA_0#OO+<3Cx&DaG}t`x`V3& zWFqAwW!mrWcYtCT|A5cs=Y~SnCM4_DwN`C_yCKHckF1946e4iZK^=4ul-x>q!bNV9 zu}yiHi+Lr9T!!RraCSw>IVAj(+(_yJZi!SJLX)7M0aqAobzS_IP?CiFqK{fOJRSON+NiM56WEiruPu%D8Md7v(=F`9EX~q`t$< z@S#|4hKWOeBH+eBCWyNU7vaDXk5Tl!rw6Q>{u$3{q-@l8OiZ11TwyN=g)7QzPUQ zihrc?feDPA#BmF*1;B~{^%u$q zf-6~tuo&^j!Hc$p1$R+=4*&;zU}3%6@5tqw0e!;YI^w0?!c26Ub!Vt^zRp!q%sFPp@45Rs6lZZog+xLVU-Bia+-s zz(f%%5Gq7K5=G92Y>MYLU4q6N6u?WbL3dy#N`-+kP1MJk`cQ{NQ9g0v#Ol?nCrz3( zbm(xt$HCyisc`-A#~+UzIpXvAAQTXx$(PFma~w(lYbI3?{04|zAH${U3RxZOk06)9 zI@Bqk8|+`O1kH(T=-7Np&gd}|E*@<_dRFut8za4f4v=Uj7uZlRrskR>)ID+4N$?Il zG|Qc<62My=YEz6r2!SiS$ZfbK^{QmzHbMP3sYt>IBaFWWnxRtzG?>S^<=amEqM}Dc z2%`ldJ2pD0QU!M6l;QO)`Dw=Zj3Gt&XQ6?9_Id9KlNS0V+@=}@X7B*zZEC96TA`8h z&Y`$1^F|CUR|&{W+H)rBIa_jRTR&^=po;l3+OonmOf58YiRq%VpeQvZd*-Z_BF#I% z!(#$Cxd~V(@}A53k1P;kLiTjfxG~vP_=M~(qdLmEav!022OD+&*7RZBhmRf)oapH8 zJtNanR&3txpdp8jyT0P^kt<})Ab7lkK+YD{9b6-Vg+!V5d%6P<%$f-aDAHRK8d@tg zi%e*N!fmyNLRJ3ly-7s17D8MTp$gbHv4EV0x`Uv^i*j9%Oq-y<%%wXt^XUNKVI%zP z54Q=4B>ZzZFeH$Z8P`X^BU6kIdX8p#m-`GNJ)aZ+Z_y)?D*3{JpaHxkpSeG#|2#?< zE+&?U)C9pK&?D|i(2@rV#BaITjI9MV1r&-oRUs4*P>I-9!TA(;ty({V#9&e}G{sDa z53Yj<)8&Xt;Rewi0I*fjFb)9>6wf9^$qDVzOZbIGQNX$`8xS!y6WmPWzW}XPFht3- zYI*jo>4}bW4K#PW;=qmKWrqbwaYisl>3|~&&!Wd&4^YD4Dg%&zbT`dGa7M|_(jMEr zinlGDt$2!QxPBF4hC@1t5szWWfZ-!JPp50pF6033DRn^RErA=jP0$`Lka9AHEb&Ed zH5!-3Vq)sMRq$jpCA-!aZMsb&$U#Y)v)q-1Q`_sI49q*TbN5=PNV>rlS6{B z3zzqUsI0onItwbg?G2coiN`DAL`2LKC>rdrg9V2*3cH$6Op0R_szp??V8(%q`IJAn zB+N&=4)9lipwP*HVhsAgU6Hpq#loySFr2^-Gw4mo1rVO~7?43U0&DomhGIbeuyc&9 zR=fi|wwK(6cWSOuIM;yZ0}`p>oVY#+vIW;};I0Q2c!XLxSCs6winemz-1~G#duFU> z%&lsE%8DS+RGb?@1e5>w00Ig|fpQ{90X$<5cNI~+?p4c@%HARacu#!me*DcZQrpMXpCWLEkU!K~p{XKkB0`H0m%zD2y26Z8r+$3TG5Iye_!m!S z*Un!!fZ294)rIag$x&D|VZu)<*X+ji1IS?v9o5Y+{4j?FCH*%8#2?&;SOdhTNLQEp zoS#e1db+2HX#Yg_&t}R&#tOam(_==BY~SJYFFFlcuwuI(wV^r;k%2)&%y7OaaW)#b z@lc9^%qOfnxJH;chM!TegSrcWJUma7dK<9V7#Ym zz!Ke>yg#7+x@^JYlST=y+}kx*X~SCz6$f@aKaaU04Tqq+Evi#6Xtg#7IV#OZP@EC6 zJw~!sksOURDJ@`ZHv$el-~~Cspy{qCd=W78s{urf+`@&X)&`>uMoJOyY0wEz2U)^c zm=A|J>n3}+Lm3YUU640_2!hH5$#Q6TP4F*Dqshp7kA18Qe9R)EuU)&bPrMh zXCk0%jE5;WV?_I1e)n^d^o<@^sYBO}Q>J+-UURWs7(=)LKd=E{J2WjJAt=Id|IMU9 zJpp+RzkcE?@B>TQNdesQT1TbzyWq8*14axgZca~INa4In@cx9RO%wg?J&uPYS2@K& zJ1M$w6$3UgoRJY!BJfoVsHemALAZXwX;p1eO8x_SQ75J@W6TD1h&KnyDj1qTkzrbR z0>}V1LFFA@t|9?{1t7HIundp@an2{!6IB>{HsuZ4-rvNft|LZ0!1;y_m<#6jecI z_zFnW6m2ukmHO2t6~2fyXu&cG5l4}ZkX zppJd=pnudyo5Pp|gajp(5Mb-SO;>T^F zBs(*lOmi^Z%XE=xbW*a8%4Kv#p>RJrSG;l%7zVK@a)t)n8=FDT>1IYD3*<1Cr!%J< z@MyXSgJJLrm^lOiE_wVz2J!)czFY*fr{@@6Sa)!BF#8XlX<^+#nEu)HCv*p!HgEl3 z>ka^Bdpv)zcCjU}F_32Pa7Pw6sCrZVMGgG+hjwieh7J-A@48j<-laGr1Fl%PkPgyw z3krxaAo$@7YAbI1=C%ghk(#}nXnRQYwqyD#rlWcoxF;^grWvd#@54aBFlaZ-HN^hk(ulPdb#Dsz8^8Gh@+fNEh^KD5L2rpCE_ti`eaeyaIv*h!aS`57E~K z>P1k(M@bOkpck@&1$h$^bCb#|LrUvItWuI7r&!c9D`^lcN@|3Z79kSRiUuUG@ePS` zBwNLyWls-%Slv5=Nj9eWahE~d*c`v+U6@Ba2mW>hgQW^%-cSzX6)O!8#FlpFgbtXF zIS8C#`cKaMx7_(vRA)@U9Tjlng#6-V{3rmMGO%j5;DmgSMZpyf7QKXwH-= zEO3Z1ACw?;v^-n>Kn}ngAa{bCszB|-p#>C~5-^~ii=yIDG!ZQE8!sgeg8+k$F6k>U z6gO5SL&E`tqRCM4&<)=a15$n!@xeM-0yOr3K9|(_4#cpn=k%fHb&CJvt;Om@B z@2KhpZO%gpOG+j;{%wFLU#so_$DzR?FTV|00=PYY1Q~aMGY;n==5+reBu?^;Xb@Nvc~ld`!-99Qe__ zEkoWp%DH*8bN{c*dzcw6=(us_8cuLhHQMc)hZ2J6+l9a`gLj2QV1_ZGQ&;yYo~g{2 z&b-4^&jeZ8tmDo^z`F1qU|f8L7YFy8rv-4i;LwsDB0CN14z3Pn-@`L4tUCzPKbtPr z9pFk3^XUyg?*PEtBLxRdGDJayENGUgJAkXdW+?9075hzGmb0IIWXK?4%UVJAmDe0) zHG4EjgCGj(Zb9|n)^0c#9Sn9sv6b@W|6B79Vr;7saA_d7n85;*H;25}4vajHAsSH} z0%;QW!~$Ush!oqnhn5szFeC@!GY(MNgboX3MjzAtVCG-;ixZ4@6u)Z(yb8l)2m%Ef z@IX_UbFaSWlbqDJ!a=3{sgdfCQl5c=Hdv5SaEbvD?RP)~W;xmFPL7a=L~2QbH>LEU zp^vjeAbndfxRHRx(^= z6^Gz25)5w?KL9Dvg>1JEMP1jci*5hLLn<4 z2n}^x#a;MSgJKIEHGS(wFX_ua%5N}yFjN@jpdJ9~6^N)^f@3+Ek76olm1Qfqp2V}38HJirmQE*^dJE#Bt1cXV6APqg8epk*;ixV-*=it#6P z2i%6s+uSl_4+j1yWCn2a9|pWkblLiF8Q+U@m7-Sc3d}rW9Q?MVgDV653g!U+Zb{xC zFh@$<0AFMaDoF=?1P&>*8F+I z@Kxy8k1-`nEP7Ne6tp53#6F^mDU9vLN2I^zxYmHsJu)YFE37-XTJS0Zc}M?Y-9ecC z(NscrK$8ysVY&log~XqzRq~q>#Q#wq2Vn+dl*ia?(e;j}FwSsC8AX7 zsG-8zWgrLMq`R#KPC<__Jdq&V$nFT$je?D4zs;Nf3R999+h;(>f_pK5tRe$Je?vWq zDQ;tQt_~Ev;t?(88pIjo3Y=nqU$hi8;P9~n`GF<-+>_VlW-U26eO>P2-Oio)fn1s4 z>N?y}97der8oL^j`OM7t1K`;Oofe9IATW~&u1s+;&mrIH6#J|l24Q1u@}cr`T;l74yx{S&$$N!ZahFiDza#<(yB8SgkGF+fQK(y`DO43 zTEL~|w))*=J+7*X{~Z=s!I(n}_-WrGs6w~_I}ra?aE&Dgj?o8*A)iM8qY^)KN{k&U zFqZAe-EzFh0hQIzY5R8^C}?!dBP2=DSb?AIIVUgLT{v~^DX3awmY?}ybI#HezWpwi zuc1GX{9t}uH7Mh#R`ce7kCMdjUjwV9I1*b!!kG}8iV5$Pt(cF%J!1YWGyl$n1V6oFt^m}Sr; zP2GXCYHeuELUL@W)jfMK(GT&4Q5SCn!FNr!h^p9?WnTd`=u|}Dm zB8Hq9k7xz9i-#j1uO{NLHNE0=d5}Mt#*1|arYQ*YGmJ38_&WeB85PjD9jaH}`)#+u z(WS>(t&;^|n$|M{b>RI96%m$wSa%Sne=_}lqC22J-ZZ%t5eOI18E__t^PJf( z)!jk1Js`QtsV>~GjX9!qn^kv~b{3Y(J7*C+r6pISVUN&?aE3Xbd9FKRRQqkR<5gXp z$keU&?PiT#TShg+rZZZUMjkfmo1O3VZD8SPewyB%=Zlj5V(&S7+a4WRVEAF4$_ z7^A(%BwYNbDa>=6t?65o{+K(tEUrx$9Id28YRQpmN`#aqh=T>NR8!zKQcaH1Qle$t zJyGzb2=3(QoFVrXF7C=adzj&(g@V{a^Pp}xP(kw21bH0F8e$6r1+3KU43oxs@*1i| zcLkg%_o8rXi-8&fbtyFE9`^#Il?xgkD_{W`ShflNqWe`}H#{4O6>0{a zLYApG8wMvt;K_3a^9BM(0_r5mQA=^$rMpV0xNW3)d}By=!1GWAA|-q14Plgeqv}$cyxmzb$th8n! zW_kA>%!dnTajhw~d*mRTi_nM_RX|W!+(&o-nFt<%IiM=oDs=^{A#Jp53D5t-M<(yU z*U4~w0r`GSx&uBT7T$tP0RtZj`+UA#yLQc)GiS`0F{4M19!1E`&K^I0{M4ya*Q{9s z{)Zd`(4)&Eh+c;x11K3Eum?b7WLe&}ZQGzhgF1Ka+`D&g zxOVN@wR`vO%a$#JM-VQ(YQD>_VT2LJ^#L?mV81f9QIE8{OShy_v16>lBtaN!5k|yS zWT#I;>&8AC9P(ys7O-RpxFLzK)J;c z%queophW0Hen7!54LFn0&jPC@drPUPqUMa!T>_q`;KYdrA*}%riMvQa-2qUn;;g8+ znlgO_Gdv_80;r@g?ZJ9Ox4#SQt_e^N0g#Jcoh{j0`0=ns4ZmObLFUf%RqmgTuumry zv>v*9@;1*o7zLpo2u2AcZ)%#MF^`YsIE);LIdKq!6%ZaM0aeojc9~6HEwxJ8&^Bw^ zPlq)d3=D$XL4g4){}o}TgI7I%L#+dH6PqGLfE{FdiqG~kEnc7*JqMWd`C-3M;B#7 z!fnuTl@~Hz3>seNVn6x=0s^E0n!St)FDx=6;P?7?SlkTk@pn z`(@ui#&*K6(Tv3(0>?sE`e)Oh&>h@B^A7l*d85$> zb7Y(du)+D-g^bOy6}~Cj?g_YQI@`zrjn8 ziRRnT37`}t)3*5{vu|^{cB5a0G zOf(Flpy{873iNj%7-I0|BHck~-oest-!Y$qsZOsgH#>d8)QLZPCDE@rbMue%?$c%Y zs?A4F7R_6{ETt;s->m@Ufi{7*ZA?{Gcz-@v$HcYGRBS_`}5B~Z{EE5=+UEd z=FADrL4ZeaU9@PC*XzAPeM14C=K{?s0GC6D4sFw>&EkcNpjK?#vb9x7&tp2`tpHs(<1DiZ|;>46GlW_Hcs(2jsp~upxwL1` zp0B_DdjJ0YU=oKw7-59*=K+H|l-L>b$veB^yo2n>C}7>=gou%q;@OF_ zyaxpbz<2*pYs3KHMG~tuChx|12PwGrvmp5v+l-bh|2JmXVH6E59tfKJHMV*jokAB6 zJP~3Vz;VmjfI7kJctUbTs*Y%X(L*Zg4z}Ybr$5nQV612$3?YWsEL3Bp#u^~eEy-zQNC=rjE-!fZLgMaAyaH7G%0-VZCLY9jp`g%M*^FM$hhjIyw;*H| z+n6$ENXRq^ZFn+6HstdKmLa;FeTYJ@|E|jmsW=H?x)S|`x&wO=gE0{BtG`!wK;W&? zB;aZw7QrJVl9E91Gvq#Q`+rpXZMekRX;objvO~ZF6r53pGaBcdJ0c7leoTg2uvDBD z(OJghyjK=KVEP)Sfz0E@;~1Ha$KH^TkJ1=^_QVi5@z`8FcqBOH0&e1G`*t~2&*bK>rankwRXLb`$(k3K>n z;D>U4_XojK1BB&?CRNu&^v}+Y&p4U!f^+a~(BY{m{9pwENKHkeGZ!Molt?WlT1~Pl zgV2pHIm$Ea&iqNW*qK#$E)f<9`bmoyD9R=1#sJ0;N9;f-n-ns((ry3BpI;f30#s*E zaX?3Sf}ks#x&!)hj&%u-9@OlSs=butc$_r-TbW)|qGgcRW`ZHFv5sC1u)8h+MWvk* zD7s(<2fAwPJtKXTwWrm{JyUkMPw6;(z~>MkRajiSpyQ?*x+X!*F#?KgND9+Pmv};8kbHOV#Z=7Gzr{4jli?@Yf1>yt|RE+=x2Xz%r0JV@s{;^F4Fhndb00&J0aXe*e98DXBwKh79fVeUH{{ zT5Q^~dCRU{!!k#%T)Xb=)@`?K+zw^5XV1Rw-7~gsIKF)L?7p2oJ9XyxS%)ii)Re3V zvvtTw;71@fLy#qdzn;Kaca8fUfFKR^2g*wn#pTPFj~qF2)TmLJnVE1MGiD527cN|Q z`0(Lbvu2GZWD&sd%P+rx1a5kCDTHbouWS%RYI4f=-+wR5c($3(>Fx1dw?zwnLpGzc z{k!&c@7!hErj3TK?%uUySD&6^CyjxY0{N|JO0RBRha{x{&-N9$GEzs(ocfdKmZ2IB7%*s1a+0hn z8pcIWNlEG5yEi0%5X_ zt^jz7``|!#B~$0bl*9R>U-l>6EGLyNNGfle*@hJ?V*w}jTfly}R@{8i^!YqCf8GrN zZE*W7=Oge_3j$N-LF{UYYLU>;ky;;##V18B-9t;5@V{j6cQQPuLqK(HKAc_wHB62jln~F zy>eZla-ub%aa5J278EkU!$k00h=)`+6DrjK2bQY!Lz2I#cYp|ko2vDMDnKEn0MEC^ zmIRC^BrUQUM71tbn*Bua`9l|h+lld(dm7b_K2+&t4V8vS`M^nX7L3ftMDbTd9I~tIRPnhTS zG|wD2x)W`8dmXh|U^s4bfU~~wJ12&Qk{1OFM8N?#tEc!}3rf5TUZQ8Z0b^59_Jdq- z+Q)v_sD7ArwDzDaHNO9?_JE~z`mbt`vZ?L3!xQ$hleFCpjMG8tgJk0Nji@moPtaH5 zRM!grGQN-R!awRDNIxPgKFkE&#iZj!s|TD-jgx3*flN~mz+jSjQlp@zS){ZGd9YO) z9OX^6c#v)0wOVBwVs# z9A{#-KewT3gDMoNIln`iGfH&a>T}g(+8oqAfH;D^I&U2m5Cx3EBESa64CdXXfPMA( zfEsB2qi{x*Q)By2YoBEwXgzZ8lwI!AG-U!^;2cZzUKSNyqqP_T1uGuT)JENv*I)-u zu|bpeH0rnJlSzly7h>&#p$GXMB#JPPamX07;0PuSfVOxGZ{i(Xzyu8wbKo%3d%Fss zP@K18MmaFMf;)^{mQ;JJuOMD@yvy`0hA!hF73eEOA8QRF7!|rec)ydMe*w%8F)WA# z5ZqB#DTeBYL8f!%@`1PCk{um6x>QWJ=;)PwdotP0B#$#UZ&=cZ$rFC`c=6y#Tj7bW z-+jJn)tU{Pcl7SxXXox6V=}UOe%p2WIrUUvYFv1XEZ46-!52(oc@cJ`=IqehGvF?#gqi4!Mg zW@gTxKmX*(le1^f&dA6h?ZN0_gx`Mq4SY8Jx(p1|oFGB2ga3n*hV<;-OQeNH-a==u zZ+py{vjoaTm5qHn_jc{vW!sjm4x1e$`HdUa!Q0ptbamX=?DXM7eIBpN;r#IZc5{E7 zrzrs)_&qd!$q&@4PtP&qvL#)HARv>wckY6^1C6=!?HNNy{Pe?*K93*ld-dv*oSe#Y z0EGXPl$5@G`>3jX?AVd-zWa9Fx^)^&j*w;CNCevg78~Z$iWMuGG-RK_(6sL=!YUy&rgs_J~)2JI9^ zUv$1UFe2~-enBz;tr+_V`j!RU5Z&R@0_{*v*0a9k7&SF2chIeQKelGJl}vL&1Vq0Z zI2$;VfU(i*xGOdeK=EDjn8r|Oq7J7x6dXzNo`~j(<}ziHzqugGP!tzGW&k&~xyLK%v0J^pgNA3!U)$OY06OE|*7GcW@=$0e;V~ST_bl z_X-V#iuEmV^bU#8$2s z1u}3Y5}QH(=L!gr&+lt$y|tz6QNSQsOliJzZ#KHD>9)TswXNnuqHH&h_4@!kZ7%3FS<%2xW%xlHnGMvh>UM6 z+}+qxu~}q73rj-Nh|0}S%@L0=#8=`Q2=PrYi%@X@kqM~}Ak&%(m75C*&A~tl7sx3k$zhh$=#l@pBXCvzlcFox{y%^LktC4g0WsB&=cU`IPU;A=hGyW z6*$<8WhdWD-}p|}?s41H9WG{Lc*3NQvExoQeS`7Ih~2GIH;hQpZ9qP9!5qs{Ky0o?Hc~j9hw+Za^6YH!CR^9h8{bM@`|S@0 z*Ev`Y3|UIXBowz0U1S{uj}O6o5NtJY7tnb;89T>}>7t{JY^!uZrd@$FXN*{Mr?0R+ z3#?)R4~TW(J&BIzhghtRx$dCQAap*UBvt^SV|!6>dWGyzPaiopX-fXMNd@C4=g#=a zvuig~WXO2@G_7ELfKrh)C?eVKb80&CNxGup)C|RuZ$EY9)S&}2r~f!8HS_rCLM%QN zclpL4Dij=y@`w?^4@Q+3uGx65FQBzvz3u=2?xDm1To@Kbar5TQ zIC}JGZk{kQPn|az+DoCrlyS=J_6d6;+3XPn)cg*C5og1 zkIc**os~5P5(~*xRdwvxvFYi`$FK z#q$a*;RP_j?UmCWMi^oIg}`wb%Fn=Fy*s;olN4ha9~n7C5XJ~XM%6fW>J+fN*}@6dWHSuQR>Fwu?4MU=B592m?Pf!3gM3-e}Yv_);Qr zhuoh3Q!AFg7{^zNI(O#Op5J~suxFo-JA5^J(OMWV;baF0hxU%4XmU*ibQ=70XY`N9 zfrmo@0xQlBs8jfU2bwEFv^_+#Ah$3j&k$XU=T7e2`O{v5h8;fZ#L**vG01axl+By- zfo_OD;Z0a~aCHdQ1N{H}c?TeVM^H)UCXzf{O=7Cm72@6~eP4r835hXr^~zLlQL0)ikk}z65tZs& zrMB)Yq`6DwPIpKTwRpL;VI2iD1Be6hzfNf z8nKn@mZ{p{mIpB)OMLC=1QM^tQzDhZq;kcfH>e3TfGPzPsc&=dotg!-sxsD!!(cqOW8 zgV^fzBI0Y@^k8E!M^aXFnWe?k+-NVey6XBop48PXjDryij004GJ`ad9M~ zxFT>KwKGPt{W~D0(!Mf2{&AByCI2Jd&A9<*2%)Ff0C<=80eAz<7&;WmFbWiwzA(2< z+J=rl99Wf)+uh)i{qzA@VzLC%yTQ)d*youCS`OJcVBx_%A|?_)pV7xR@)-V2$sBL5 z8r1PnaxhBxE*dF`{Hb|3rSFh9`@O=Xdwi*7#8eAc5Rl4%Z+3vX1Fk-RD?F9bBBa#F z{N&qDkE_j&|HRZnEGF_0y+%zx-tb_9mUMI7fgNpeQ1};2EdeK=2mDOmqPxFQZU52i zw}eF5-zC+4yHxZdlcB3Vj50H3Bnr<^E~F|lLoq`yj>Odie1IaRf(H47FEG^Efm6z7 zS$p0}-|@rt!n34rDi$*h5Kdt5p-Ni7>1Ue``v=U}_1>@*J%2qu=Qum1Vr5go6>bGb zt*2z9z!ahq7MB7gjh>Mk3K&N@vVprBLYy5euw8c#5DV|SAk(f$R@ENsEqH-x^H{)c z7=FsnP!y=(C_Jc9{yWk#vL3*o2TI8N^F7={%J< zVEr4?3&CCEyaOIf81e%6s2Z;D?)L55r%#`rnVFfDm6ef^F>>TcFsG-dgZby5f6mFt z;qF5|Tn^|ZK1ZJsP}MX%;RBeVq2Np$EDDN%Dl1%8$GHQjhmrk$sPBd>i(CT*_5kou zlDGp^m+_zwcoUi}cq}R45~GB3XMn)pV6Q;(K1%-Z2e)wLz-I*V*;Jr#8*TP%3mUnm&D6 z_Q-<5Gk!(w);VR&sGn64hGnJ)=M#8_jD@#hxS|1m$V+fMz|IE7cV$fxz4dgz)IfO)VAc zl>*=HdhMZC+NaOlI&sOtw>u55)2j2xDeIbim{k4Q){8creZBeDMW$;_60%99StaI=(?nT)pT@iBXjr2zS>(NgJf@@~{4<_UA(2yl)u&VP#Jv#- zRIyf6rP}4HH~g^2#3@S;KKSa}!d)+djkRJOYdlU&KuV|;6<-sC|A_dSq(Nv1>Efck zHLd|FIN}nc;?WI|HKAr?LS1+rq8eSX<}Fq04$NM~7$>)<%1V*Tj2IuIoY#ab~Da?Fa87tHw!!J-KkP_T?l;x_-+sD$po z%$a|@?f|7DPAISiY>e%ZJSk$)zYJ$7!(}a=cVMayaG`ZbcK`<66{$I+bZ2SV{wz}` zv%skUuG2PoC~`{-tR!nJY5pSs|FC;OZ<(g(`Cit4*724pYy16jVz-C6P(sq=07&hI z*YM%)-Xbe*syDyeRVF#AWQKD3aXMYX4?f_>WBnf7frBn+7uJEQACh z@YN6@-2sIL`3w(vmj0<+y*ii~Pl1R2Ob!oajnf1I9;U36Y;XAss%Va~7YVeNCD~qH zawIY>ld&@}QsD9oPgE#GZs6wN-!%bzLqDNhXfT4=xBryhA?s+X5eKL2aGfFD0e%w) zCy-X!X5J>V6$kxaW^H|E@ajn$T*qY)<(Z#>#D!n5MGXX4+};9wgF0^x9RTnbq7oJt z!?dSAxKM$jx`gTvNN-^F;Lef$EPwt(kWqXF5ZByYks?$_q_6NvCeL83$T0jM5MnrH zBzRVk4gZ<;*9+i1g+~Ix42hu6-5zTf&;KG`R)|}`2*R`N3nP{kcG;+hRuzC zz^4vL(J(k32e{IU2*`ZY3m|txfB~l>V{^h};`s}-CksS_&t(HM#x1}U3CarhLgzNJ zg4?t66mj2p=saQo@PRxJ`bKd8_kfZ%kb7VQF8QO->tTcu#&rj_VPfTyyscZ0@5_`K zRyJltDN9yaYrhJ2u>4#_7PqWkmfWZN!F@aP^9#TDr0arT*Qp|^j#U{OIQJ!Z#a<76 zMB@DeSdz@mt(4=ZvtKJpz0Hw!)0rXhCw_c~IaVhix?7&C#nf$;wf;BQG(@zsT0eA(3bq7}m$`Z&i{69~3@ZXys zy5sIQ1pLMh;ueTr{QG$Wp<<2antbuw)|{{UOf45z`;Pk>L{)eL1ZK-UwVJdaIBns+ zml}16u2?%Zp+Riry3z5kKlIYO(--dTnl!z1#s*xD?Img|H(_Y<^R0;%N6|%xb~h^ zzaQ~asf3r_`X+tRw$qd6ZCtzCvHvU^HhIf!_cyWJ{n{h1fAaI{(;E)D_ZP6~%ML&E zT8D^xYCQ7t$MZMYAr9M4vq9rm-T7d>`fvAMus(OmHruL$;&;R5Jo5TS<9^+-?U=ap zsC(ts)4%OJSN_pAYP9M!Vcvn)TK50A$MlsuoWE_(-Fkv;Il(%m&MkLu;%)cV>oH{R zJ{#L|O5U*FGk;y~+ux0ktWrO^TEjB;w-73!f`(Q@@B%tdcfj=vrv3jN`U`aj|ATWD zAQa@4oX3^mZot)W@J6i7&e#swH&8BmlsThmc>>8He9MEN?jT5bXusyPYR(wVQCe}l zz|@&|$PM#C*8t2KTRsnk0t)`~X#7clCorspaG0pDRR^@Mv$i!$UH9FONA|cuPC^OL zr8BpIwC4otH-7J%!}hisvGbQ*ZYTd-3H=ImUeLjqydENJ&S27ORSj0B+!>d*0f)-LmKi}XViw>eKz&A}YzgN*>Q``Ch= zp7xpRT94hfT%@%yGU}dy{J64$i8}MqbR8g{9*{t2q9C9};kNLmiUMQH?axOEd$X;; zEfq1gN?s|!3m57R#8JM2hp#?Ap@nLW2(j=9-8+@BA{HPit2oaf2*_I?;s$>U%#;Q} z zt1!X{<9Y%=6&Sd%iUA!v<(Rj~JNH+%WD#4uOj@>zdHwiEl@y*Jh z#i3tQb%i%n)MlE%?tmyXrb7KZ{G)0f_fg7aM`yFc zkpoNS|90f?X&-gslA#z((lqF(!NU+t{!a!nn}PG7Wt!r*i?L~p4P|TyGsXu3TNo=e z3_tF!tvVczGe>exLywPKlKPuqm&$pj*_9!RP1JK;QFrjWLcsr3-2vtuTDEqR-U39<1Bu(*cuy+5AG{Cr`Zk&a`>k z*Y0t)_$;GLeC=)nCe2%U_@S5D3Kd?9sDe5O6z%S=5m})|=K(*S$YC|=d>nE6tCqX# zS*td-RBJ3$ZTN6v$6wbSuhrzE+6_Khz2R(&w%>o=CG%t<>o;WbTkU)HOP{%PTW*b3 zpMN_bWA_=~YmGiHSMm8SNt326+IiQ5b?Uy^WygV{wx9NozVnrsij5*GG>y2sPP2CX z_MA0ZemPvIR1>6boGeiOrPrHw+6?TKe!dAsc0uaqwT>StZY{4jrK=K&Mutv&wutL<*BTr0NxbMJhbx_VnaymDvt zmlNOZ)~H?IFZ+$(cS`>5`%&+F(tqi;!hgN-iBSHPU^2T{;e$y8VRffoJPm?|i;i>%NP(=ePc>Pg>TjwLA0fd9ZFw z`Db28d~e>`BW=56m%gt-L|kns1zgt$t z-{}shDH3Z7ayQf+0Bc5ol(I|pCdow)^WE>cj-Z6@0A&&qOZdl6)E(%qQktWz;&`c~ z?tqvjt}8ZqKu|Oa-v1GR50F_T*n#|vA85g(8qBW-PCEiq))sy}VQ-uCEpKLQZ8B(i z%hcs<2CrzDva)&V=1(Ua8nw>8$H$!bK^s5d8_?}>)=v^XctbMVABq@dBc(0`h#uwu z6)l8!j_po6mR!X(xNKad9|fP zPGZ=9Fjubu!4%?u$pn)bnLL)bpDC-v!WNn>L37Yvn^#AuJFwSgfe|1lLvPA;2Q-l( z7#0v+NUSfB_NxYzI$Ux7qK2P9aZ-WG4xI3RHhleCDJ!O|Kb1#Q++mcU`Tb~8S-yj1 z{Cw`6L7Q6++1NB~ZR@nv?I%ouR*dGJNieUB~>I zChG=2#DP8nhoTyyk}z*6We7?oIRg`J4hON&bv#`9upy817va2vtELFu5hWJ>2XzO5 zLL5!uhgm8n6A(R2ZqVX_xLptMq?xJ1q!Qtv3Y8>2c5ca;q1CZnq(tT<#rswbWXeev z0Dc1R=v;$%3h)i!d;Zw9mGvz-ek1pILy=~fDcR1mZ(T{WR)TYL?2F)6J_T0 zLsvs<24I9M8M>rvlB(*e5}+AW8uaOk>c_z$R~!)E2?F^KaUrxT?w?>-p~GlTW`+$9 z|5gi`W@Cz-cG!jRkzJ_@GEzlTf#3}lTpPHn3vQ-UGKioV|EZH8^#m>tB!Z~B19}eb zF~oA9-wfbZK{$B3F`yW>v?mcqe?GH8(%D++CcEnB9 z>qJ+o@oeIkzpX#}Wsk8@aWyRQbp;UGL4J#`kJIlf)rz?L0nvZzkON z@^`5}>^P%6^TyX@?s~n;pcy}{I9C0|4_yH1%O zcFfp*KJCcom>8OU0K|0)Vv5z7cGJm}1l!z?nS2WU zfgdMQBar+|nOVXf!@91(PymqFV9>>&zR^$^bhPqXvEXg3=sw+f6R#&%L#FOPABpo0 zpl8N|ov4hcf(Fxw7f3$gn$t^tJ=PiU62>rmdA3&$9Lx*sJgepUaKHmkF)4Wta}nDL^{RmF07DVm0%T)b?MPtQY-77@tVqG#mZ0`a8m(19pm*m}2~djY zAM7zpgBBD;xS<)Lv}WO`A!YaqAG{#bu1FDzJ<4DBwC4MP1@Zy`A7(0r0apwt7+CQC zx`Xl`n`)>`;U43IjYVdvlbv07df5Hm)MzC+HYcgFe{~X5PvLwH?$B)bW*(Z+Mh-)@ zk!(U~p)57Yw8tNsL+#WY%w11F5Pv{-5Q1s@*8uYnGX#7MGUQ?&g114NV18aJ$cL+g z>6GGgRk(VWVT2LJbq6$GV5G8+8?Q1|+%Rm&kXK&Gc<$LT&ptQ)rPl_(QJWR!!N3xn zpcJp+(lSNDU03;t*8mep_25r2%K#akQwffZ{U5o2j#)f)bXJEm6YJznNIX8F#i^zJ znQI#}XoFZ>kp?4JkEXeCha&n0pcuH{6^6z;9S+lLe&IlN$E|f{)AThCTPMHsO`pA` z*Z#Fn{K;TP81n>R%n0KJok_X~V@XOHzJ?4zeXGv&^XA{JsAQx3RF}hNXTkfs( zaE*2k*7)$T*FH#is&%Pq4Q_p;W&D5Myz~CVJML=`|KvM2Kh!+7dfhu7t5f~O=8wMC z_OVw#uKd)8x7^qKp2u5Oc)azkRa=y)*s#*S-n{quw_~c;5h}e}{-Guhz4XC7Pqv7? zKT$}ii8~<1)rqWByIj>;_dVPC(O23&`s#=GzxY193$cn!sC(<9&F*>XtqlOF z>(Q55Re!GKJx{$IdtZ~X_cprw@z&)YYJA(nO{+cq&dpWpl}bpw`GLk2{?q*C2Wpk7 z@LK$%&F+8U&4*uZ`Oaqp7i~D(>WdL&A83S|J|rYYff&rUQRD|bo==p|Bsu?|qJO;Z zfMB*s?+Nlw%7)EwO4%89xIZ>qoOA=Di>qL8@m;CwPSN_61qjG8k>wa3c#=b1K* zu``T;S3C$v8lPH>Ve*dQPbHRo!7hvZpgR!JaOEqXHh@A2NSpK+9sprX_$#P3)-*%b zm?7f^hLC!YSm14P4sQN9;C)CM{9$pL5uiB{DCGmBlWbGplLOfD0CqarS{{$Za{9|B}}9!l`;Z5b%xS2}z*N5t3`>0@+ih{2jpbn!!?D4iK)`?i%8F77{!>^y ztwh1}@_UMeiJ*(~0S<6n0`_K`gL_>>m&f?$u+Rq!Ra;FlBf z0&z@CkW`gh2-5%uyUeu;00E6X!A^O{Z!9o2E<_YIQXi}MOXE_T_ z53BA?vx+I!v&r}PR`+G6Jyc?h@k z;Yh=^{SpiUH5EW5XTBNqpae>I`-cJk{~6r@fLl^?I1l_OH$x)10c^NGmjbV2l-ZOr zstmvgRmfBz$}!wTf~jZ|^7CTgv-4rvQ!6kTFYRu?3Ce?9sYGCg1{Atgv6%;33I`;D z5{E6Q1hDkEV-E5Y_k$o5AJ#~>27Tl-bBU54Mi^oIWq?KnOc=U6Y+qjAzOKEJV#QS(}M;|ai@RkomgFKM?jSkQa_P2O1 zGj^J(ljXuEm_3R)qNRcd{O*3V|2K5OH~`~X3Fxa(V*(MQ&0n~O=p%V*-j)EmAy$Mp zm)0FX49Mwa@PBaLfeD^>s5=;)x#7*X=C=I`_e#8{25JrXGMJI#Ayv(qELkwI(z~ zKNA|_1_~7uk#IZ425`j_5NPv4+`llPA$JL8bXnqQ$o`T9PvOcPbC(y`Z~`-@kk4=p z1rfTvm~dl7q(&CVlS=S9lBHrjp<>;bgv1(e4H!HB$S)i6f7y^beCGP6>VFwkwH|JB z!1DnN@%16E(9H8QOn;&7;D51KqRHI&AMr69o&g_3;H@5TGj>>&M=C{6GFxnL%L8-v z0qu_nq96(?ArS>^RJ%oY;5iGrG?e&k5%F*I5RyhMKX?b=H|JShEx;?_vq2Me06js% zz7Y_63JPs;#0h`U0Z5psp->=cysyGHxg}UZtTeO0jAA05ZY^$0WpAzDm{i`h&3UWl6jUI$pm|7xK*DXn z5y9-%fCDHZBm=9Ca-!qmfcyp1ci=QgL&1~e@PmaJhzT-b`9twxaOO}0N>jy8{^Z~S zGT#c;L-=8YiSQ2op!%TVfN~N+DW#egg84E54dz?mkaupuQYdyw)?}nVh$z%n(*ZmI z;*U!b_Y(~0Er@e?Xg*G!Wb^#C57eT{m}9&#LYBID8;l4zq98w+LkK|L5>dm9P;8}L z`7blJLJN2yufQvF_(GQwfdVi>+;sh52E_wK`4aO71E$Kun3J8GcXrrAQc8?6B=St^ z-Tw81m~$U9M34g&)bIrG;1U>rs-mtbGT6}|ks^-85v(dI=?8RG)g`zF3|a980wQS- znZh(Lo-U43D9D-k0=|rI0%;0z6R<~H^ckPy7?-YSd5wT5UA^uAB7t>@Bwk1$?-~G- zBIo4huivm~(&VY>>FFazj2M|dVpK-vm@#AK&!2zbzyYVziQ+PUkw^X#z$~KE88Kz> z)4&LWZItbCffc;#_xivU&c{LR7ymR!ngzp)&?(#0Pgegvbz!mSt5}JX0r)?f3nVyj&lIt|*d*+m2xQ!!vLUufQE1(}21;+{96p zu?<4>;ED(gP34wgcd;~Bp0YMx1$In_4)Ar#5Tlm6YniM>;&^dB~(_u%PYeLt?j2Yv5&xPDZ^>wJPe2)fZ# zn+b8KfQYEtG$_=Wi}TH07)f_fQZ>MZJrV_xxXgUsE!QlRm>B^Eln==qvN4~M%kzi_ z6ju*k;lv%A?tw~bE=njeiaor5_*_ zx^iP{#l)z%M4@8sm}*TiXov=Xy;35NJeQ5b^jGe8@ITNUKnp|-E*ec92Nz^o@Cb*h zz;bcd0|ztaD~{IB%iv1=X7|?YC~FsC=i3qPvvB(Ib$Tp?YgfqQy0^Y$1->b4F~;)U^r1S zAsT3jcl14zh8|>zLl7u-$b1?`z<`40eo%2hmE;paOrOv(N$H_H#J`~brWIVMSouS= zAP4xhfd`9U9f%2nHo&%R+qP)I!Xt+cPn|mXhaY~}ux_*0B`sOB z?1!n-rce7}&z@Zn0dVPYIA=_qHi*L&_v&h%+BrcRs$w0q|s zD5B&+DgF8l*s*Kp)TvXaj2pLY!zR(Mq832*9^SoU%ci|P5zlDcym{l2rN8YzxNqtY zQzlNHuy*ZQzuzBfC+E(b{b}Z`3F9V$ClC{!EL9UHO&&LR@LUW`50!n<aQm>^g) zDv<7gl(Wc0pxJ?mnl`=(X1wL#mShhowg-Mo9GD&=<5CagWIgLiEhQ&g3zBawn9+h2 z{>BUkL;#vKFf`!)H2eS)ash1b@aTfDf>AEED~?XF?f|-1!yZvWci?yBq*m(!g0xzvQz)x^= zuo=z>#aZH;6;B)4QBijW_qub1&S>Pq3C%k&MZPHA6%DLbvfbgc)nM9S#*V-s9y$yf z*PC3_qGw>%I~eUL0@ zDM%`64I;d0R(EQIC&lVZjyjiC`Q*%xnSCeITu?@463!1Y6b;knI)efV{e^-ya~#r( z8~forkUXX?@#cLl7e2@wrI|DO0yO~_Zh0*-zmuaq&9QerrAZ?g+aF*q1tnf8KpqkX zhIJS$&DvC=^+4_@nEO~scqyB4qnruZfCG}E6(}3@9IHS10}jD2T!VmP4swd`;w($5 zA4Ko~DjOsa$29Pqyybcv3U;=4tLLx=nUR$sTBNs5=NYL!7vQa}dBD2xlVT7Ks6eRV}*1pZ^>azh{B{ z*sd|@7#zingW^LW{w;v8FfYvj=?^ZLUHGpu!^ci9%o%dOf1t&m6nkb+CHKlMOx?|N z7f9I|qtZKd?Q-l?0SpTv%VeK-?yOnge)aXfy@$~^N(+t~$uA5^3Fx9K736pS>WhsV zH#&Xt@pCq>pTZNNi7KQmrJc0EN)PU*MXUgRU`vIIcBYRcNM9=;$FE6u0PZ0$RER+x zP}zY4hbB#$kTH7rsO%9VMrMwmFm>5)>kl3{cIxEOpJ&e)GbW28Gc$A4s8MUytnvBi zoRG_a5^E+0e%aZhKlq^C*|RxNBTk(--M#aGp{ZH8Hm}9s}`Tl>I3wDFX%!P$Vc=_s}6} zqcSpWg?8knijt8rqFc8fP`bcY3k%Ne+qZAWj$ONU@BQZ6F1>s8&&w@>vJw5RV~6&? z{bs8U?c06+>1Tt}(hnUxuHniBoQ(p&%0ZwU4kL^({w#ng0%3cic?Vo~Fu@{>vqX-l z6pw2bbZmXx4g8Qz08tN%cP7k+c@cmO6Y*{e+$%?NvYz*(mR3?Ci&AeZ{IMx3TEqfH z#4))}0G#m`p+|-*fyTHL821R+IQD>{-~qwg^K=J%-ht{H$k;X(u+vb3fa8Rq831pB z$M`<^Z=$4`B9DDNISuO$t_eKveouGMP^b#Gi4j#AMpbESsaP+jN;7L*BWprq6m+XL zB4_o<&{&AWSIiX(@eOgVK|&KeP%yp$o}|G2yhwL&fdn2hbHfE@ye&!e3OAp3`asa~ z0y8*>s7f&}>EQS1JfANj^U?VpmULfi1~=%8e;cQ~HKkmztdDt8wVn{4XsOx|2yU(S znu-HXrXJyfa~8r>LU&+h>_16&5CrfjP6%XL+(h5mfZ@XJVMXfUwm&V|?$YehKq%>f zh(aqA_>^f}$L)_gC>@$i}%C#6* zn{ed2yjxJ^faW{6Z~MzHzVg(6UO0U494@KTy&Kmr`KoJ|HQTn!3?xpP?u#pJAyH;O zf@b_6i68V}9EsDKHC@u+U!f&)DlT^qhH{lKa}g4OofG6FmjDBha1A{Lsjz^Zn|FHT zYtEFrr6eovZjc(Grr_2FVj2<{v{Z|hA}A>WPDU7P^`{B$6v3BTCU3;Q*`c49Qpj+R z2FN;;B+XDc$Ut#`7;ySqKtb|22hiM&Tt_&TtFmLRUrIijYN~6H7TItX`SE#Y*bxAOK`$pq;=XLaX}@) z%A!kT$@obMP-AqJR&t0*aulgOLqUF!xY>KpD#w3h+oNjC1F{$ z6uZk-ke-~{X2GVN=g~DZo~Rs zy?Qil(ja|s@;h%ffA9UbyY=qg>aDlC^z2jUN3kAtKN<}9XwFJ;%&!)Z=hvh=AYcWD zyb*oMiWRFyW(>>B8kRk7({GW zuWn*uV*N&qn$)XT@AcPT`{<(%IXS4~2(FS)Auw3r!% zIPicUaA@jMjer7OG+b$vz(<1IFYpuifH~~MP=g`!a4xxKfpiC3nPJ1(YDAbG98AFY zf(9i(;2*w^;h0|0EqY17G=_Bt*9u-Uc-}Fu`%1b4kin{gObfRliQ(*eOF~n;nr`X| zRq6s+fGXD`q8IU9F4u7iT84-}4T;eIhlpojbD?rmBAx@6%ZJO^hp7bpg}Q_P-Cl{% zAgN8l55gsm#jVf?KNxJCV{D$I=smwZ9t9F-6cTQBfC3&DPLOCa0yseRffK~SD8o}$ zc06VHN3g&?#vCx}MnMJGENYsGuFN2>2=E97nzG_$x@Yf}wI8&4XGBuwTdmrU&Y0+T z*>-H-)VW{3&3pGLqJ8hSHG}%~?b5ktw=Vr=OrCXk+ul#wezao!R=Z#R^@nL4+kdcU z@AiYIj(`4bulbAD(oANM|3Ku#9te5`&a$orJkzLKf*d6U0t{{OW2SSj|L1p#QY*NJ zly&173baTe2@hrTr&_#eaJ7o5xXpo>WbUEpPZC@M1?SN6wyBL+&N^m*M5@rb;oui+ z-ceB;`9I{UdGq%m7&;-CYO=%i`M3uGq}{``<(|U2qWuodX=QE!7vwu5vHo~y`vY?V z0+zgs-qEA9i*gU#VGoS+V^H*m!UBOaXWwrhG<$jK ztY3B?DfsG>@49{2xlfOtAAHa*C1s@Bt*L%30D^`tfxtOpK;JLhzLz~R^Se&nzWKK6 zk|j%Yf6?MO(_gPqyGxfoAe-&lvva|Md42l!?$r6a&%gdQWAub$M^C99*Scj(dUWsH zvEx@seFuKn_LJoFF?P|IHeo{Z#Cm;u_8*)we9w-p(a%r z2F6Y@b%JVZDdpb-xny`EHCn0=a7RF1;Wh_OE9wqtFA~FLCDk6TB+~5BQo&=gdk_ok zV9bU2q~ZVt@{X!2FF?pyEIBg&9WcY?!6NH}XiVXucThW1U~vvKvziCK;7H|Y3HmyVr# z_Uhel{_N>Pk_WEdxL=f+lAGVHecK&dRrBl+-11H?WyJijPn5=s3J9n=eF!1}0 zo3;$k%%1i0Pt34y-moZnMEZf#XLs+}_UY%JY&mq+#jBhl<7z3)x@!jH__fYE;6rN2 zB3ab7Z{L}nJvwXbh|H|?%u!jHnd37?Oq}!U!XtYOS{-}md=FL{8dl4hK- zVZ+jU_wJ2lZF9|;_(S^8%mSMm?1u~)(xpomVCj%lS(PSCnDG7g--qTMj7%SqmsddR z5tuBCn>TNT#_o1GP8>h#bUIaluB_jOtVKJ7rxnCILnF}`FWKjoJEA6hfp8m8F6QygSM z7mCV$94E*D2uH##vCsxPJg}r;5)D_l=YSwfhY*Na0rNb|lu3TuzhF$O+bm+i1G1+- zV_WcSNEp!ta4T70m@*7aRQg82UoMVha8?~67z)@RKZgrExwP(pdcfd&m%{()c?Xy~ zUbmDr>Pq_^1c?*}T=Ye{;AxQfyL@tiIlrKoxUh$G{wx2N2&dKu^(;Z+qA!t|$w>b< z^XHoBFWm3oe|JVBF*snLAnpPM1qotnaHS!#7thI4#(E0>C4)5LjQ~=eL3uAI_0a?b z6#UFbZd4*j_6nlCE(>Hbb{xeYKD!%ab7BF&L5Yd;h)|5K4)8K`IjHGX6_7FZZdw1{ zyPy9uXSwDp95t*D3}NRiSlE4F%Dw}8kFJ~l+9UC;-);A4*MXmY_3am*wBNRN*{rFP zKK}Td_3L*h_ZiUr>yFc={E$32vup1Rx56aoT3CQS6hk1ysjhyMX{LndB&HPas25|J z$XrLHRY{KYNBt?KT&aS8xF8J{)KmfI9i&8xX%W7`5mKso$bvp3N=deg0|kAsU{5J? zZ17`jTRM}@LH~yd$IU09)JU%ZB}Ng13#a0nzX!!(@lrGk600(n5`E#vYIV$zlAU?a zNzU7#hR_BFq=9l3>kjaMP{`$+L zZ##Ltdt7Oa0095=Nkl^g9UDMcA+JwNT#>qx#A zBooPF0|6$vf709;Gr#EY$?ij^6rHK|ob&-8E)6O4vf-&&ZJNF1@+(Ddch64WG2o!AGtFL6EQm5(RwhO&c4%mrhcYxeXmQjYY5xdRBA|B9 zZB?DIvc0_INQBo}pum7pl!22Ykb?RrN@Aov*tJoa!w!LHz;}Fr=NY5F(k8Z*ItMB@7c9)@08gKa|`{a zcO4kkv-fu$zZpDaSjMQ#JqHfXm_29Ns+GE0v~SP)8NbdwnOC@b&$jdtLk^uP@?oh! zlUchkw_#K) z`NeJ9w&diUQ#2K#vSH)q#lJ0CzI^$fJ-g24oY}kQpvNoW#uK`9?ri?zMa!2hTef`J zZ$-Iz@X=kncIdLi{9@j*QwR4SktLk7vw#2oZ9BHZxS4;4 zJa+8Z?%lhwEkL6V=nk8G&6;(;{kCl7%9Tr&EIN7Wj3`Us`M$lo7cE+{Y}tw>OO}8S zC@*N(U<_UMdAz?ZUb15O(xtyG-m_<)&nH6Lg3L5i8wBQU7-59*=Ro`%xFXHQ^7;34 z>zW)}YD`r0Bx}StYt-P16}T+* zsXIU`?x6|N9pI=B*aBXBcubf&S#mti*DT0I51DHg44a|)ndB(UIeGZ>xgr_Yw!sU0 zN0=ax5y4&1qL|O{VH>gcugvQ0TVx@p7_g-L6kBIo|C5hYrA0x~YK3St!w?cC7d351hVY&kS3Ejbs zG4CM6-M|2{F7j@Ei)vlC5c@*0EZ}EsyXN{p%&#UpODkT~3y{1Q0Wu7qDNVDc`MPU- z1Vj@MV*Eun%k~<~n1Rxx;U;+!71R&}bQ};QGHi@UF_-;aQ0IXx1YeU~yEm+A^X7-M z=dE;r4piLffS=B2(Nd#;d?^uUQY+;A`WbWVV5$o`C+cO*!ZEua zA}~Ry6ayZI(9QKji7djfierLAfY<_b5K#k8rf>D+cXbuqCpvLYP3DX)sXKrw#Md%_ zL3KsQ?g-goRx`IUc~E%7%h{wn{OOeK`l#zT4#0Uw-*z z{k8+|e)Pqx*>eJtGw;-)S~U}=|2PNabHCqG6EjT|whZtbSI4wtCQzy37sqqkdaT)RrvjkVhkY}#}5)VaLm(8+=go7Vfhj%}MZw|%eO{H3c!keOA|9T@Nu?(6_91%6nSP+mR7*iW+i zea&&NYQqfOtHk)KHiz!59@& zfbZj=lUf9{G6i=}2;k=|o;uTi{4oW5WxO7u4YDBo_6;|b4-g;>*XRj~uK}uE@B}W% z4{#(0B?FdFnTdBH{Q-av*P=V%SK^o$Q@&(I^ZI@B7R(nQ3W5GBQSu9+fdB z8&w8_1`V1ybLP2o=P>e+gEU3|GJy0#zL~8Reh?h8RLBXG-qC=W3{KDh8G;oO9P)g? zY{9p1AO{Ajq#%}Kj-fqfD-;XHoO%;;NF5v!!ykD9|KvX)=qJ5~9GFrK!Ga5j2Nf9r zk`J#_2~qUO9%G9U1;Y0+qxc}6r-rb9N^GS#A7S7v%3V(w^^Q4`*F9tSV zZsLs>LPB0-NKD1omj|;p-`Qyfp8k#Z5 z?nk}6p?a}zk^RJvID04wGav{g_{h{9_=+A=off`VBG(-Rv_i$_IKFeu#H^uxhmP8x z=YG@J-DES0aR-mYAwwPFSE<(82$~YfyDkGRJTUL-5LN z(9M zk?hBb(F6oOn;K<8ccfHQ(OuM#u`zg7KMW0Vo*K?N10D_odf*2%jHd`7T@L0`iXn_H zH7(#*4Uew-3`O?2RYk4>~*L|*1YjzN+B zq z$i4zu79|)bNID2(TEHu-POsMsRZNwk=TTtfp-bNHzy5Yu?*WdS{KCRQmncfOEWoR} z9HLtSX&oA)ri&0~(OZ~v_MF4+1$hJ$CQ72SAn)AKW5@QbS+%}r&jB;%|K^7VqiE2f zK@bqNfFaAWtDqq7*s0Tbe$k7iCi-jzx##kn4zHq#jH!N??cAx;1val&Vv?rg7hSB@ z7^rH9B;i9<4B%#^tdOzAlBbpAsHPR&tlLm=pt*6ug5imjZG!A9=Q>xZ``5zK`GV}Z zTd_mN3aZ^A6^oHc(WtuAxiXFq58KE1)f0 zpK^ZAO33hYHTr`>^5_vvUubOH{7^YbqQr~r^0NHXRW zribSW=?*aW;D(wQWd{UFvx~tD#Y1+%KgcTJnDhu<;_qO*F$^%^P#C;|Thk{D8bX4g zNZn^z@kc^HEMWV96NVhb>;m$A$#1=G`lSiT=wjiI$`WDI*bc| zFJlWWZlpn&mK?!H$he@3Wb&TeQP232$|^~>IMS*V&3KdL|H1+X&mQ0T`THG@>^Q?@ zaoyULUwzmATp>>D!_Q;7-%v#0P{ikmjhLaqW90wnd5}#781(9=m^#6o_o!mW^T_@A z_sgz+IPZWt7>o^k=TtNhay?t1+GTON6}>_a1-YjC7_ zi_NVXF|Q9qf-Rf2j_UNy>UUdgYf*2>J8!b0LI#2keu+Ub9dRYr@pl9HT)@NF5n0Oi zJ6@9PH}l={Rl8ugEPP*gnk*f`i1@T~-ECEDf?)%JFj}(T3NNA<5IDe?-Owfc_RGbF zVlH`JSAl>hCh&4n0RM` zCLTCF#JJ!;H-%zliaq2WKYN;TrtD?D1In_l`RV_1CEwytjr69)deWk$WI;)y^AvC^ zM2k2y8s{B=WlE%)92H28)&>dUAi*`b%(1iw*^VJhIRlBhWIS(JP@Tb#ha3=dlz#%J zm^{v#-^A~zAklOK+BL)6FC#>J<$~-KBz$Ux`lCBypw@Yu_xgQrF=Hvy3$gR&VoU&P zf~@M$d}u!;+^SH;)A&>k1abO^N?S4Eu4!b1UqI9i|AGB`PaHXlo{&G9VpbayxT0HE zKz7%0pG(?16aHkc*SmZ7?q7fXb@uGp>o;t&J6y7&(a;2ALPexQ5U8P`UEgrGL?p5Y zhkUH0VGJQ6kSiDp#ue=Gzz5t+F`#GxNi}?i0mGN$Oq=9)wDRQNp*XN9>5eGHX@T66 zX=4%Qh|~-DYRsD#{36VpBKQmM(CpF7A0^wPWJd*$tq}{XHViMXo>vd7;QX(onFucC z2&qKJAXxz}r#C62NT$=6wm95Wtdr3L}g#!nke#HUk4XH6X#CSh&3FcU^A1 zt#53(v@*A(#@^bkLPb_|G9c%l*uQOfO8=olQpS!S_kEwFqleF_3NBkfovz9LF9&!G zEFYbMXstkh<2!kJbYlLX_?)Ep{R1C7IrCFiu$GBAOmt5gGp2vCo>(_VCqJ>LE zKQ1+cAh0u5OdBTS4ap4`@sT;Mi#l0bTOu>~56M1r2cW{k>{4jfWC`IP+6=tFCU^~cE zjhpUz`@@Z`-d)%Ht*vji-TLMSn_9fL>CG^O=?0~Zt%2SJ!`7DX18sWq{f%$J6>i_# z+46&}%|F=C;=^^VKV0{A+x2bU-qx)7{zi?@Hfg!J#oNr`1&*<0+t&0>U$1_r)vlHe zSGIYR6@+vL#4?DhoX2neci=-(l)(%b*X{|(Jzzku6x{*>9twW6MIw^Rg3HwT=52ib zIiHE(wJI(_a#=+8t&;2ChV&&f)-v4@z{CH6Uqd>9C!oB|hq>?z5dj^T#?S+ue@rs9 z0B8!D0U-Br1Gf)>Tb6|RfPlRGyj}$Yh3IiIxfT)F^LZKARr0tITO)fs(h^@$R6ic% z*J!ds&Z0kIXO~HwfIvbJ*jknLaNo9TFR3WqYN#Dih~qE8zN{!V0yOJQyOK@&F!avZ~0627Y3`DNws? zEU-oMCHtVc*>A$kp{)&YMvv2~+VO}J=7|P_Vz)rM^Vy~?VO%c&n}I$?!<7p-5ONl= zf;`;g;LKT;lgIM&nJVF`1Wi@^o+4YG%j1?M12;S1+Zy6FCBFmcYVi;H3B&M1zsyAD zIn2a^%yW>5$C&>lU(}|^B6J~spT}l%;35j>=gEIygh0@9kY^WyM;~Q=(jCApbx&%* zC}M%#jBR9rjm+4?0tL`F837qr{~2yY^?1B8vRLjbzKgm8x}z>Bc*CD_AWtUFjSj-P zgR20@MYzJ5&xFIFmCMU~YOhuwJXNmR<7MuB@}_(LQ}*8f-u&RxW$u4E_JL>0JoI## z2me#{{{Mup;p+`~ee$OJ{!{k8r^_IL0dA=d-}h9h>d(YJ_)M8co+UWo3e7eL*#;E{b|5+&&LxO0LGeV&Zma0DNY1JO&nHZp z&Wt05;l&elXc)|O0VPJdzpiTvz zk`ss)8R0pJ_nId8nCxKk5#N?!$A&#-Prg}7vKq;PJP`LXP}8i^V5>LH;v8IR)5pTE zjfJy41$jt}H%U;_EXt5bX>gP?*;0^P?(E8(OCkjVT%kkL@kl5xu5*TrllxFS zr{NrQ6{aNzaCKzh`1$@aDB&J1G&z7~_EB%a$7%|#N5HNC{(?R$3Oq4!1-2RVoBu)V zFoN(Vw+H`-aQZ?pG+K=XmJl2VcZwIVA~$qPHpRd=gmnkk1~XexAb@c;o@~Kb%a40U zC)5(+>RPHb5^(4L7D9YeTsNLjUr3-$6XP3&ui@(rca3ip5!VEWY#Kn-MZzsP;8Ej< z%FQg5nhN(cj*4#)5!WobdYhPPbvGZ)0Ujr!{#4z(e$AL~zFyI)#m+aI2lqQ5-2t&Y z;85C?naAG?U~@D_0AypYfyedl(B?!KE`4WK(c|bA2B%wWCUm2G^GsJ))H$D zG3@J(;)39D3xVIF4aP@S6ml9JgViKOks3cpYv

K#Wy&@ zng5e!{3ld#oGbrj-C169#DXNu=Nj;hGf*~mL>aC~&0#Sdf^MgoEFd<6 z2<@Vs0zG9swp%>*XBqB*umR_{2XG|O2{ zC~!G|OYSUW4&7b=?kA*^>MBKqz|H5`phq}XplIt%cjG~ff%%%RgTLqrf8kw9QM6i! zIs)8Y#3kUt3Xnw}L3QDR1>J3BE{j%(XI>h1)Fb$cqW#WUiAH$q zk^nav9r;WWJKTYDB=Dd5Ba$n*9eG~NIZHCkD=|;*C%#C3NHlohkATcq@rK-hZ+IJ= zHcJkQ-N3uS*UtyW!Hiy5cW^bJj53L2BU!`4-`@P<`{-(KSgO_+s^aGV=GKNFgW)aT zwVrQ57rutCH`29oV{1I$T9Rrhom&wk(tK5}FC^59h_7!=Xjt~XmSw9ZZaq}s(@=8& z1My9pHjM1})vDGlcDHP{?Cm$1Eg$zv#MVLV75^^5bp9s*9)}_Uv{+!=xpoSNaErPS*MvXLH0Yl0;1P5ZCXu7-2p+!qhb9PA)^VdW3>z&FkTtkK9hE}f zGwjT7+QJU`!|t;smGdP>i30^K)heY%ifNJlREs}N@TVZjDHdG6kS2JB-@L6;xpB3G z6TM@-gKtt(O1qNoJUikgV@n3}<2-ZhNKj|OiF)75fQxPB4FP*6Ldjch{-1z{4t*|& znN*9;>Ed`_!JA@173M6Xg8+>=>TrfJ-7#H2^_CF+m%nluM0Q?QBAyaO{g+*aHH zp-5mZD>O6>4KcF)PM7T|N$h-J-_+s5laCxdpzA75oM{Rvee^A^eq7hhnj zSNuK@ZXxPAJON8hCJUcJnap(ua22c?-V_#$G%*=FR^U5R<=T-a!~)gb~IK2V})W#EnbH&)5&*c!ocO zAK0NO1n!>GB|yHSC#D0sHwkSZ6b=j#?96~n_w>r|gS+Ho%ixQlP_WN|ZpHK$FWep- z2UYW?4FLTi;{KcmWa(ku!8L)aYA|!*pH5bi0_>g7`@~dv-8?lAzu7j6h-+qk%T2h{ z_ulX|e7zB_eBJ@xLPf0~5swsAsR58R4sEbXSFSBoNwidLSo*iqR@t8Uo z?Sr6V@K3?SwULN>0R26{qChSWf`^JT3UnY9Ctqj)AoYH4 z%1uhLMN0*;ipkMZN{pCl;YTpaDHbK!3IqnYRfbvIDS|t>oFnD#te1ps-`-L*?8$;j zZ?a>HnPxXszp6rBqf!8}0mL;kR+j=e34QhDSFj9yMd$1A!2tFl%l`$S1aWdZ-**td z9BUq?tY_ZO{rUIn&YPg}K*i8J78OKdpE-L4gyi62CR85GJSZ z7TCquG|Bz8Xn#a1ycst#a7Qzzl@yrBQe*4W<$%9ggY%XXJ2lnqC z)UVHn@4frQ7hfGYc@`3Y+YivhgizhP8er3+KMuGJnxKd-p*zr}p}60QZigVC3Q3x( zY1kB1SwVFM_=acm8MtQz@>%qWr$Q!RqotzL3O&UJZBeFDsEFJqFunOxAt`0mOL%9hh1XvrQBs8#8g*sdpsanHQ54A2`EphwN zd|)%2C2ZKTbwsCcR=4?o?7atI9mjPpOiEO{!HnIM_Qo zZD(g^&YW|0X7-W3$L_2D+9Pz{0oo2shH@UO`LzLb+(@yoq_`2BhmbS6_`{IX46pzpCy_X9CK5LH1q1yBDP&A*mzgLkv!zD4l-R><|Yg6CNxCKJ+v z>Yw3Xe6J60k$`?E&Fsil3+Y-O% ziu<^K+d7<35O*^WwH=ry1N{DCoVjd4iCZV*M;UJp#;ytPSR2C6G_DQq`mOnxzu158 zZ8bZ-PP`*T^@GZTALqjjh_TLL)LI@XF9ME2)MS7P^ZE0}!40|-^JJkc$$tw#wWAY8 z6uN^k{iGt?9q|!kPz@aLJO4B2{yoWehvvUo^Q{x?peM7956mV+=O9FuHbfgzq>X8T zTLkY%gYLf&yk9q@L_*FIVkNpCv{2kU(cB6_rR^4L@^Y1VjbJU3(Zzs=1{b6kqc;mp z2up$+0fy+D{0X8p8bWN?zuxcsxa_$DcXsgNCm7Kp;9d*2sr%4;0QV>dZdLevBajU`6$yI{H8?`4f!HlzWCiUSP%t>cDeVVlH(?k2 zl>x5EZ3i4295)((OW|vI9C*M9oEJq6^h8J0ZDOU{#Fa-<>Tjk(_i~;r1n>H9zS7f=1>r|;<-v0(G3E&oi%x&1G`c=E|ddLO;F{%emC zw`n_|T!-?SUso`$O*=BaLDe-YA^k);EO_q;IR04leFXFz-Ge(FC;=o;ehBWIkDKR% z=7Sm_{h%XgMEH`~2cGMQ_g3P$U2}g#bbcb}_@eCpDbX?sX(wb3R0Y$l%Xlf}$aMZ2 zGFL_vl&f4Gk!a`R(!MM!P>?`%S3u)bRGfW|V}z^_DNJMs@%53uqt5&%ExZ51zV)M? zm^H!ONdBE`g18&vEn#Xnkaw<;sL23n$4wGlun>e}>`kG#o0Pq`i@R=>c71d)=Hrto zUkUc-mglErX5}bCnCOzMgcMa^Wno(P6>c!16e$o>6vGP(b3Hv>=DL~qZqfW}g09;G&i|=|zE0F5L_0yqI5BLvoB==U zh()2T7wR)w3+#zswtC+SmrBlZ#>`DnI~X+PMf$OTN-4C>?|Lxc_%qS-8`%DFRX;B5 zr_&17Fr$fi*Kqr^5}2U`_c(9^-9*sPutxCQ7IuHqzx3~t_ZQd`^$?xVfx0xien<$n zwzgJOR5V->jg5_PtgEYQX=$0Aou#TZ{bsc;i6L)sZtkH2@m8lt(&!dgLh#gy<6F0G zAD*6LHVIVMsWy&}^_oDVv!XK4EF!i8=ie)IN0p%CuM}Yi(YrJq8nt`>{)0KW`Ju3= zL8F&LsuG@`pM~4(?;n%|5qi+X$S^n{!jjeH^M`}M;L_5P*B5~DLqA})1M_;nLcpDI z+W`j$$BhUa1nDTxhFSQh)&%rdnd%3G5m&N%6D%5|ixH8Ffnaot%0e_BI7B2;Q!I?c z#3)w_Gk^Gp0WBhM(!3(s(o9*-^e2)%xT!1=DFgbLX`?>oDFd=}({=z!6>dAYR$$%8 zggo_wt?NFse(h%;So5jPYjMN52XM#4Pv4Kq*afN@Cr%#K~hZ4M*9!hPZAa{##Yw zM?;Q3^gI7i@_pA34ie)Ge&wFH=-XOg>$si`2r84!hjyg|@8{X|(Lmg7>(w%NqHEW7{09s4_>*juESHAt~HhhuLN zcdWy$4R);oLc_t1HA>t%HFlj8a}&miTO;pYqwYd~8D}5dBJcdDb=&Vv?)xWK!|Nn4 zW+-A z{SjR15?HITsVj8Nzu~!sc-JwFdL_|S4A`9T%Z09pr}q}g^SgrQuY9&IivebhYQvof ziAyIworJL%SOu(BQ6gc@ffDnK2mz5ZR&sWN-n2@#DGnjHyA-zq#ih6whvK0S zq;S&jzd7g3O>Xk!$)3Gt%`0ox(0I|!)f&cXqEZ-RKh4wcG0O7VD4`W2pKA9L<4WdK znAeV@yM3u8o8|Ow_QpP2cW*T|B9{U>{rMdk8=DHb zBduIgBgXB5R^D^$q3_qpM1cun@@r{=2-?Y9{N{n@#U^3lXD!CD7#BtHnaMhedIl=B zcEb&d^0lqN>+i`Uo#*vErbfp4S|Kibh!!fUEDjY4Dx<^QSi0UD#qb4q9De(cbA=Y1 zAg_+|@TjOL>qP{kKpThNlJoF!BEDOmoi;=_ksTkp`A;q){cb8!84Md|d6n9_o`a4E zM%q_oq3aeAYm7qf$i8uo3aaoC&?OcX1OV+%`6xD$y)U9I@|yFla>mZ20-4U{_y7srZ>vg^r;{Uw9yirY}Q`!Yf0AnY;;H;$ z_Yz-0Kr2cUE_hT$clI?`qd-|z{M1K8R(Otl9g|FjbDO?mtxRiON-|9*5n}Tf9ip^-()Y4bMTKnK~r<90L_Oc$)DnCD|kL3+%B&j zyU%f_--b{(>SEoNBB4tZEzV`e3zvbjc0=r_9W!7d4JovmG$WfUpL*Ui0o?o1xFa0? zBMY?TKao!WWx)vI)>({`-oFdc>?bh_i-=WkcqHyoOA?c=*0DNeF_G8May#H<2i{PR z`CMa*RshWgt(j~JQa$s1aOZ1CK57S)?>w~aJPWK|dv5x&4UphF$GtKR^{GR0gQ%p- z!*BL7)x-kmJctaTaAs?WxOu5I6rpyJ>WgWj&K{Y7?Mq})81@TIk8X+=Pws&`o$t>V zt<>+n$!=00KM>1A@ymlO>Yg#&Dm6aY7R?FnAUbimnMqMG3L54)L|2Ee-ho<3%_b4D z2kVO@j|k%rsh#32pG;ac7viRB?Yc---}l&GJoA(Mx2~QTIrbp$XNRcb)@UCN z+fa*ejQ_R~z-Se6laH|OE?PT@OBZN>NkXuw z1ZH{)Nr~w$#0_qbm0G`^*BF=Es?T|=%fh{h_D4+fYjAtGHhpnaPm)d4BG6Rtq@F*||s&@_UK5z26q`?ki7vhsz*|Y3d9*Nv|4Dk5OrfK#7&dCSNho z(=poi>2A9=w6@lfF%!!*3FSULJx!(%VVt1dk6K{RoFJ6KX`hb&fF7(I2V=m|@h2he@s&`%QRakyD=}*5J>vVj-ub8IvZtur{f7 zMEaIh1rcNshArRDC&uqRZ|t=LB=Edm>UN-c$APJFMzRzGa_AifG;1O&H#nOuwplq6 z^Mszr=ep(iKSXR1b7XM`i@l-(ukiy3u?~*uTOd{M5jl#`RQC; zM`$n-zzYZS?6OU!mI@{ifAfFHjK_aZbR)5A_wYWET1H=^BuV+ z{I*;5?K*xeZumVjnEd*7zng9U1N&Ks{FOM$OM_;do|CYVI^9wsulirxpo>co) z>nzPJ@Jls<;&(KKb4CZh@)@b?C}~DEipL0i4(9&30EvjZjrp&tmdsNh=&}zHH}LT-#Mq!hNF5Zq9|2F zA9mLz!QU|Ur!a%N5Zyo9RRPPaZpPjH!n;z^#VDq0?egGenigu;5lydSjGvPOb|hm1 zt-y#agxrFm3k;dLQUB`G7qx+FruRn@m0Rxk@GZwAd=c*<{m9RnMXYnO9PE`eRU^%h zr8Y~?wuL;-5=7yxtkiZCmg1ARtwdY`aGCE+X;bbIy5JD9(D2^i+51}dh2vw9h9A<# zd&>(o|OP=*kKa4hqM26+c?f*Z}o$>;Ncsgi+9{8=Lo0CCRfd zWNW^k8z79HM`|EQb19$yKc=vqWW}y<-U^v~bt*}{ z!Zy@#)+yy)JVQ5J1Z47C`l>t~{v^93(k~>rw4|>FQ3n&X9dw;Ad*MSfYaQ)-GTMkp zROLoe+7YC=M1~oS5XdXLp}3o1XriF|$0dYQ0jComcl9YO9Eu}qxL;r4LGDjeApk9{ z@uDo%M(#KsoxYb6!AKE^oGn*`4(!Z#4kUD@wde(WJT z95MmE)T3?P5vEX^*CkoBH!YFLEYJikB6k)VeKX9i8O-E|IKxkjOrCjlR4HZ-JfKZ& zkM%BnY1kJ|)9WNaoKj|=PN0-BNkqVkD}Z;v=aF%wvvQ-zA!*}vx&oa~)sWC9J+Z-y zQoyh-Y#6pmew}s&Tp|hvdauKmlcl=d{>A>P68A{?88Wv`u#hQ}?Sb915y9L4iB9`U zseaF0x-LbfV0)>Xs^~Y72cys?6?WgUqD7^O@vRfe%!{&wF;JJ~YDPIveUzxIZ)?a`En4cQw-A0-5GSXy)1Amy;* zP#0cleAoT?!ZR+2#1fAMM$Z!Qu?(f({eeRj5DZ7{I!=yXUuNYNh;6Sy8{OnQe=5$- z(s*kpCKr>a=#a)td!a@3*O*fOjRT}gwcH(~AH^>p1qOL$z46gnDebSyPfsp1>%YCi znTdF))#Z1LQDpyKk8)<5HX)^l>JurUyAIv;`IT)q4Agx~&1N9E5;VYuBhCtjr7@|biW()UV4QU)=B2&E+FDo{x}j5x4w z++y6+VYhhDr;ZriW&a38h_zg4yCj*=xZVntLveTz;T&TmWtH8Q<4@smg|C=TIK!h@ zrk+fQF48{YD*Naj$+@{T4zH6$)nm8N1H^>U{{%hq>NjKa-_CbJ;E+lGF(kzKPo3Kl zXyc29Xj5J}UJ?u1s7VW$cn*l?sPc33| zDFT)wPrtW_mo0Nk+otqjmGR=Lf-i$$x2D^(fs|1yvq;g(ef9!1C&lg7u>F29;dw?% zvWJpOZ8m;AdFJ6~2C2at(1Lp4P&bq(jbULDt?VFZ$k@Vi){lmL?VA%Qw6mWGyX8aDQPnc8ZSDD6;CBNp5H?Y z4d&))+)%Y+9C_FWO2@JuD&!I)e(E1fdQlnqFcoE%V+I8~?{z5mjc80@2p7xp;hqA0 z6gCzj1ToLQaGnutrhGhqW$uzF?Fch~gu&Xl5v=;)=K!4F>AEWr=C|g>3GH}A`vKNk zRNGH1?LJoEv%K4=JgSoJ~r>n zhbdi9;V}U2O=pY#DjK3m3NpzRud9%DxYJeqsK8Wk!ejmOJkDoNZd#QdHf8xvPFd43 z;I?LR63`g@whVwU4bq^ou)QZf5&Yt?Mp%$WCD`CnEW~?hAq>)kEqee=dHTl~+(ZJX zB!$vpo62Um&(In+u}ZNrJK?C5GdwslK(?&>`%=ZA!uHc#{2-9TjI}~C2A4Lb@Io#u zfjM6J%0z0p4~3!-Z?lgs$j$zgq$*hVNt&mX9iqpP*nhWTpF`ZtFPU0-riF!thj-7> zNp@6$zkNAYev!4_&e&l6sfEITY7AP7?%;&C+U(iIlwG-J<^o%=%*0qqud4viliZmz*+M94?c zVo?Uq3LVc9+s%kJ7O#Gfq)WW6jb~3zado7Vqvs!a6`B(Et za-$ZBbrR{DeMN!pb0N+}ShMGNCnbanBLrH9EOKPTvX-usxA9Pg1*`SM5s5;>=8_iJ zMdR@Yhn=Df@Hx(w9FGCliAlr*-m#}IuB#8D5#RgJMK1Ls-N}@NHbHacWC)zkQlHUW z0j#>Q2_~UUm*TTT5Mg+LPNCyO#Az{TbJ|74uJt7le*BFqBBMUR=Z{tsCFG2|I1<3Y zxEqqkO|7_?4V2Hb6-VWR)v_CyY)v3RiQ7z6hZ7i19vB#Cbc$flU&r18XtKkU5Ex%H zi#_i@p>9h0oT@eVM2Ozp=L3gf$~{W_TC^7xj5&@Yf`!LZ^O<%vfbF?124Jh5bWL(P0 z#jxg!(N!Qc1L=r#>Z1t_@kNS5!M1kyE8W>+%giH=)Ot_n<*2N%atkGe!95ZxnvNPY z@@~)=mo6EH0d!(M?+3(0L5zSCM3U-1d3TjWCrR=drdLJn4PlNio^Zi|BE=j0!DAt- zMr^JC;qjzP*zK0<@c*zMZu~m-^w3RE->p%g4C)`w==^%=?^)9ks*#_x51CQ1^h7>{9=z%y<_WU zPEx=q=eT=;!E*O}v5t{uf3-MuK1(XoFIMg&YWUX6EFx~Wel_1e;rMUUpLddEat!b8 zBX~rWH$C}z9-T*YtOqyx2Uts-Zd?a>dxnYn@3^0T!}(~k#kinH&!_Ygm?jI8yP|@M zs&Azp7G#YuNL|Fj_CGn4yi47(4&DjC*@3J6T~!sI!|8|;S}M%|jYpAb2G-_RtOh~} z=l(kMKNixgZ^z$B7?_43D0f{vF{k1}<9-dDhO0od=DZuqoW;=SVuUA;?Aq6 z$pp4T;^zQWBD|x9bLE;%J%0O{(J=Sd)Zq|%D)rkoif}sN%W!yU*LS%etsEVHjKkK{ z!1eo>&E%x*7VP53#36XC|1@}ye>m$4OoJTg#u!1>Ixo6ZU!{l)E%^;gMtE*$HNQm#gC`>)9l5K2kzDUZ?gRC&Hhm8}9MJuPMkgmx@~{iZ8hb zJI0F|OtC>8CPAy-Y=WBg#qLq@PjvH@CWqL&=JC>)>$#S-crrwcvl$qQT}wZ@jz@9* zHYvBfW5bSWr&oNZ&H7qfAooZ9&p&RHXE-Tea4a4K{!CL0Z%LYN${N!K8h%C6()N&f z7d0lVPHWEyPbiS8OF-LC@r%tf&zQ0@X6y#Oio(m3q-LBG-f6Ua3f1^a(cC5fR z%gZ0V+u8_Jggx!j#o*soso>wZw06k1QVWEf@*O1BDDF|ZO_u`nGndNAuQY4ooU7st zLN9}Tx6APBeKGm>30p^BER$&L$=1-UFz0GzqB?10zQK1^o#e=(^|8d|8qEG+b&--r z+5vO?zVRKr{*B|%LbQUt;uDnt7goRg`#NApkpm58XOfdsxdrs}uOs%qo+yS}!;|86 zobRj+xB~LrG&|MTBNSWn$;SLVXfUEVQxe`)`Fex_rQPu*nntYVl}yWQ;n4)t;H<8% zn?J^6rYcDrqy1nqCQl1f9WMW}GtzJ*5t$r@DfnVA`;aMhbR>N-gI=KFTp+P%N@ZYH zNPXAmmH#~4|Ki&w*0-1ZU^bJy?LYcALgX$?(CT&e4MgHhGmB>hWJ1C)FI5heQvO`9F<6!3duF2U@F{VSvs6-y_o{*djHGPj?Ca7d+k@d&*> zT>#;2K`(E`+odc0uleK#aMi8VDAoE)U_)1Hjwp-*vLGK-3V?qq5Q7FWI*+j=$DuN& z!R$ty%18XLeH-5^M9br^#K1#+B&2XC`4xxR=JhD`?`yQnE4|?>jmxWoeB@ps*VwiD zR_P4j?0%y667QM=Jd96Qn2Pe;fJ*Y+T_!cvQIto8Hd}y@g@b{a>*6GQi&;-o1Ko)> z0xG%TcU7eD({IP?n`F+df}gOZJ|bK|Anld5X5;_TqRc0_RQkCY7tepP&l)y8qAQ?1 z_^yDz@LSkPaVoPQJA6znz-D-7mwv@ zgT)U|QBVS_X7`#ToOC)^CAob_{HcD*L_<*!2)r(GK@Dz9_hA2P||Ln$4 zv^k9nXX)$L;_L(a_Aq$Q;5gh?3OG^9l(3KI{RD4Wx?wJ!@@s}XQVX}ozY!d;a}7m^ zNTpZOjr@LZ11p*X1lJGWBPFQ0Y)Sp}YdF-&o%6eLtO|#T%;h*NwJj8yqd_wwP_B^T z>#D|J3`RPeb~#_s5sGXHa;?g;7Xo(5fIXr7#N^L2ED>Z()SCJEws6Lo%6xJF9-BvQ zfK~Wm$~bxcRIfiTeU4idj~lkG@kJp?I!rXspF%05_L9RY)gB%+&#hr-dzW&VhxK+Rnbe z+o6b)`l@6qW=|%0Vih|}i<%fSX6U^XP*w{G7e9FiCHzR4O9LA=l5sEw-|rkZfte@$ z;1qm3)(2V<_unq~dHgG5UUcpx1|SI9(OC_=&wQ_&~BDqlcKqdc>h z1C9a!kHld9;DTQ$kwAx)_ZkVfkdkoj+_@VYqJ-#_jLfNNZt8_!_q4pTKZD7<74@ z#cQS5fE8vKd^@KGBb$)`2l&uUImN3nse>!2Xz&lw7*h)Bu8NtiFf2Jy!Gx32ni9if z6PfaUls%XM;k5Ccj0+<1?>Z~p~ z)jK$UErRa{UPAe>6R>2h6b+kL(PIEol2jryYEQ5K){X-_J4Lo=E5*)3sVjh5c6KFm zz^Ro&6AhD9y{OAl;^nNXJciMd+?K87|N#7e%!a)ID=>ipelI4I)8WwPPzcj;_j4N^vp3)Kh2}p5c6kgO(yj}&tQBK z-ev-S2NCW5Q*=6LXPqq9uzkSFJx19?HAY+pvgVZ4(|(rvBk1c9mZ=K8kfqwf)rNV$ zhPwqEuYXHfEW`?*d@ink5>WW^?`6P7ja@LX4Y9wJ@9sbg(Wd733o~gfvfRiQ+t>R< z2X67yjelCZn+Gi1`G;zf#)whqObnTD#2}9xg}t$%plfl{=Bpo1bAE8xFvZ~Z7rotE zN#kF=2RaroZt-u`EGFH%i%3@DGxb(!S&4UG5}-z;Gm**YW73%p9l@Rg>W*SP8?fIN zRUK_ak_NBF@3A!ywH=J*3h>`;x`Ma>{N0jSt@8v!#^Ok^iMb&IdMntn&zj`_`}Z55 zj=**J&1Q%f1Y30?QfZRYa)&dY`Lp&qJY!jI$ow%79)*gU^ncq&A7YZ!9hz$imRFpP%Rq1oB?P_ltWu+KppcS-l4EyaS62@8=AI;UN34`D>tFbFJU_XvEwv z`kJ~!y2Q?9+$+I{4~z`x`;nHawgRAgU9NZv^63b*(wfOfk^>A$BH~c)* zxY!UwD-vNDua+`Uq789}hq@)Arc9elDCNQQOunE++SJ-jur8^8*SbmZIl~fd8{f_a z{p))^4UYydb3C>v*njUZ(zm-{>$l>`YJ3Yp^Z6P@61AH?2aB~(F?fo1$=_hclD@1f}qf* zb?vXXy}tg5K!Nd8$^oD;%w6G{R>=B zIA&_HBWyZa|F7xjq+EwTXAF>!&?ZB*M)!K7lupih1gnDRKkyi2L5lo>c0-c;jTAn} zA{t2u1XO~bqZWr|HP)fe)#$&OVmBGa0@KGOHI1ZaZURU|ye?VvsLm%n!pmgJV% zXj!8BV#NIqN}Tcc)BB_zYHf&i;*uADGu_X8Lew!Ega_Zb*SGVDDN=`bdjDQ4B-;fb z(*7hI)*>wG?cA*uuqe#R%E`-#UvFe%dn-X*h2UW^{w`ty%rCzfSB8CmM;R~i)1#)b zx$C#8{qJwy`Cwp9PF7OlrWl_nd42E1#kbQ9%>%Ef2#GO%(9~h+?%LA z&~X%IxgyQ$@a$}wOssd4mx%D1-612A=S@)q%AeDMPgA^N(oM zPDWv|fz-)&6Vm4t-evkIz$0qL=ZIibV~M!%v+*NDD^^(S*(R3x{B>3U=4%#Z^Ez_87-8&g$1QmBcr|;v(uM1ZkF5 z?1t*%pP0+qMVcPya)i&6K-Z#Y8su6$Vl<24#zYyP4z;|giNot%vkKzrt?>7zyt^NE zXxRayVN{yZk(6=4=z(ktIap}IE}GgLQoH)`N!>VzeEWti3sH}?tdks7D7UVvaYAqa zIBZ&OYX-Y%D;+!3@Zj0P4?IJ(D6IW0SvU=pP-Kvyf@`aX>~{n1=0RxMMje@fyGZy1 z4V6qS)deweS52&|8o!*x-#HbN_F;;R)<07QVUH_1+o7%#1!e&3;fv(;p0Mqrs3)B7 z--C}TnZlkwXSTum(u9R=wD&?j6@S#z{H&>!KucpHhtcFR1}iX6SP|GhCcS{*v8aNS zKlaZT2`=~&E|hF6t4QZT6I}37;3hiK=BUG3bkm zzT26D228>@F>E{h1@k%p;=;EucAz&J#4xH?+HlGbLn@^<5SQ&G}<4)ZzaU?x3iRHAorz3b+th@*@* zyfXMbSfz^i=ELT@6opwnJ^eg=lffc7dy$~vA}+VqQc`JVOzB$c@U~<)7E*P@BI@I- z_vK;&Vh~HOI(}3H5mSvKh$Dk=xunqQ2J|_lKt*-DA&8no5d!>Sl9gFtU`!@?V%E5R z!dzPw_8w30H*Ga4$G!l7$XSep|-rly3j+GN1nQU95+XvB94QBTFlNnSe>LSrN zn99_LNG(<=`vpr&mvEMeAz$#hX`w!r9-L_7umPE>EzLLI)mP-IKp7e)(;RA|KkYQ2 zrBq&^jER?UQDj9+7-st1 zAVpmbB#@?gp9bqffX^sJ5rqKe{1Jn|jl9Wp8mb4W6h>N&>eQe?;P){%YU@I%+wu$F z$Zhg`_c_r)x?emeFu=fEtCdWd<=f*Lsl^9xh079*jvl))2a!Ly{Y{CzlpqW)`$DI&fU+2zxcULUf@J%t6SK! z;AsVioHOnET^v*8var@7Mp|M$c6JzM`FAwjeWAKk_gO95-QCkD_)Qqq`)liEKdI@3 zJIHVznFfjBjm%bKM1*(kIfcDCm3W@6KbV7_wDuFzM00bkiZ`KN>4EKHNYBt8U$q}U z6yDe=RI#d6FLDj566BdK$k){s-@# z?-4o+Q4;ukl=SfV=f%&fD6bA%Ki(f_2w`lI%nE3szv?eX(8pU@F(x6>7HyexpS*=r68xh=UG0XoDXH!XW*#R zPD*!arTg%VeZFMI#i^x~&(R5$XEEI6(aqoLQldHhSU(I-GdmE$s-w-nU;-mpy8<*Op6_W(U}nVgPJOB0eI9Et7P3WO|v{rVLo zu>*ltvpV5WC^xJfZc;vVT@Lf{=h3IL$3CBYTScoRq3nxnOYGMUwUeGKkkQen+F+U6 zx9neD+iDZDJ36^*#!Et);9YFs!tI%^gMMCN6&8GhCUV>ScJJ+ zNK2clo>kZPhMsPOTj=|KH_}bjHuaY7H_;(i(J}GARDR3)n}ReqD-R=@U+Nu!9Ji0r zf?VvTwvp+UraAxoW?Fv6*HnE{?H`pf_y;7F_9mzJcbB58^GlloYwH4B+(Ns4Mk!Ph zUrh{cePgIEEoUus%#2J7PH+Nch4=(SLcoNV+t2EE-egIobuAt8=aw3UZ68;W<6Sz0ao5Z(5qsvaxlA8PzpKnbF&b zwE|q}s=yyhGPNq^+FmaEn@L;aEb|Tw92hp^(marvudOrcRrGygE%gCS&dFzE4oc#^ zh7xKyM~a0}E3z`ZO&97YRQjZRhp8)V@tjN|o2nIqViM zl#|8d?#V8+0h$l$S?V00FYLS8ORn=S{;UIo8I+g?ENg19@$=d>lv#jXWPwdCn3|iLo0pfKpZ~i> zWZ&a>^5hWKjFLhqPgwljxtGZ)Srs;=VuFNEOSd2!i|5Q-Ql4CHUsu;t|4UEmJ0YQO zy}z=C_F`2mrvK-Hk@mX+mNA=ob^rjmRPtHBs~rK0y?=g~D9jIo6GF}Zg~rOyMP`IH zCgnW1)p42-*k>X4Qd})qtha1qBRL6|0q{f&N=J@{RW8v%W zAAhU#be*Oq9^o~U8Q+4c-Cam{a9vMU>hm9qm|H*wC*04JR4tmGj?*oF@JRd_$u*hI zJBbw0ECm%op8{ukTlwvltUeFcJ?H&QPhi{#lKf0mreN)VDX}0%@a9UM9{Ivd&N-g* z*Aiyi$NlJ%O>R$?Yk)cQB*mXX8Io91+15z?$6>`*Xv?tK*JPvMZ!8WYeWBt(Ou)WgB=d*%{m!Bp3bO8K4zq3krCu|HCC1iDkGMtEi*aD{? zJ>1oSo<4nmgumL2w*JF4)WdSAbTaT~I&UIA{BD}ka@M`#pZ;H+18v-iGt{5VFd(6L z+KPsZ7t}1(6oRYb5?l;~{K=HH$4;cz9jIvBuDXlep*?L=ekFn8jav|P<>h@m&se1p zcj`Y`wZ~rqyk3l;?r~x>q&PC#dHi@Qt^*aJ)!*CMcmq{lzy{HXlS`h${|jiz zsk5jkdR-ED71<~|aLH2v{SGjdhnE|Qq5)&+OW_(W=o!sbz>~$$$1zl)Tv!y#6nJ#; z7`vQM_DZIrng8rsKmT(~a~j>j#u2NvkbD{*Y{Zjv87Yq5d&Ls%iLGxZqUwE3A-5 zg#id+MJ{$iWTM-#@H<<#Lz%K=CDmTc7(I%)UN#$yJloMWO2PMh_ji5kO2M_#!4jhs19hFc}6g3XKAJBD_bz?5CWb|7F+ zlLxDB5CrB@amPybzz9IwUj$~;EK%0^aG5ayzFQMu-Pw`sDjKNwkL86?ssBSy$VEK$%8)##J+aTRfq1ewg6dBgg zUf)z=1-nef1m0vT_ti3buG7~4Gn9FBq-n#-fM%vhPph1bldR>o(`4Ls8zgaCi4 z!v()fk2S(0j+w-yO^N%kD>E>|%{7uBI{^MqFoa8G^MWy07$YIqyCOny`A15Wk8@mM zkEAJtBYP+pa-P^hHCd7eaL)BrlC1l@|`E_<&I zfs-gS3A6+_rka@DL61V*m^`+os6%FyjSU1lF+l*pRMd?pOc1i*04+xda~2_J{PA$g zkLH}YH8gek_!qB}#S7=EpMqenL{W&+)@LVi12KS3y(RMJ?6qSr8|pWpJPJz14|Gzi z2&SD%&f-!$M8~@^Zx2rR=|XT);wr-wR}S(x+YUTZ`B{KjhtoRz2BYmP+gl{JZWc=` zO`7x~bRdQr<=F4pQ-okVFdP*ov!;=u50-07OMe!PSLkHQ;m`=tS24jkx5P(@4Ixv) za7QjiF-y@$86CM0YFcy3yq3CS-lC$P_6(EKvYw%N7&1ctbWTOCUX=%Cm_SG|IUa{e z%5`@27bbGybz-l>6Y57y^lQleT4pf)qpWL$Cuxo%M9d)noEM2H#r#aGAuR*P!#IW{ zDoI^-c`X?;4CP@gM-aBvpl02b)eWSuG)hRYxEe8VgSN^8wP~n;#qjLSAm-U`D1sm0 znh@Us{E=P+@!M1A{JJ#)Zfd;`_mZ~xnx}5}-KrQRJg9yz zvm2C3Ypmq)hFw;R+q*_$jC?{y=q>85p;y$HvY`Nd99?xsF+5VF4^|Ew`l^Q#apBnrid4m3cwI@gviQG60{2cG8%bAP^DUu360lnCP9%SkxCD;Xg zA~9>7Vk(@Z%4<0x<@W`0k!e^&K zSxAJXV#5BjJA(d!tRc*&#a*j)cwTb2$N`Y@QD$RPqcqQK$z=ov*vys{JNcD!wk(8Z zk_$VT4A+irxnFALt*Zzq9eOZuL~->2kf)CkLfwYA@URu0H5uH%Q(a+CUzm}}Ra}c| z2A|sIDa|cAi)ESxDt_h|PaiCMt-i$~k?mgvjNN(o!G|*5;2C-TQ|^sT-L~MV3D6r! z^oZcHIADhg(VH_Yka)AA_F~}TW(60&*1mpHXM?fP>Ifr~vaf?j6duNMx4o_a1LPd+ z6+AA=1wYHfn7F|C2h_~S6D)~C(HPVn0`yoD-#vZnFAe~GwA^)PX4Z?!ioH4vA2CFf z{}NiwFyRt=v@{J?iAtv`CRpo@%b@DyfT#6<%Qn#f<{?ao2|qU}euD(}PiI#Rg_H0R z=7Z5WV=*7XwkV9gxquIve+%)NXpk7AT69wsPViypim}-lr&4Sa6Qk0oc}B{$D)qt- zWw0>#cu?NA318@hBNZhmZ-gqWuU3NRzeVn5r{83k?Nv=Aig>**GYn9jNCF)HXNhom z3av-v!p$%San;?$p3^dZqG-P!gEIUu9W^ zR~8sC{*Q4QGu*-s!B?!R+2=AM5Xd3+P$l=nz8S9Sk;wkM0w0$f!u#uvS9a)a&_cS5>V|OQbO?0ky_YHazX*%klZj-T6#2)k@+LfMu*0PZF;R?~ zk9Im5BTVzxu&<(FL=5GS3svIhcNai#A1v-8>YS$#u2K?>P@xsja|DE{P*7#%_0_ME z$)t^hn;eD-gul_n(nR{d&Z1r-if$6B7^*3}P_hX}?5;*cF*)}AvF?0+F6t*wPAWxD z&P@H({bFZtFHqost4k}T#MOrIKtdWii;Iqu4OF7p+dD{+=)7FYU2r%4>;qAIy6o0* za%V`8ZWjfWT7N8G{skorXCsCcQoMoHz5qs%VIENOBI5q(fA}R<3MR?fiR?gN85Je4 zuMKg{mU$%!@ww#d&^KLEQ$bPDsxji4v0nuj$LYUg$5m=M|vpOCn@0EX^bR&L0Xe%ozwL9AX^9Nf^V|s-HLc*eCvi(WO z=W49ZtV>%v-9){Ry_(sgVU1pmikw_kUEMDzSU8l@lqQD#ft{o>o~iT6uBT{xzNs@E z>`hV5>+P*xK!F*RRJ}Kk@{C$sH=mDt%!;JM_!*x;L%j2{%{SY5xunjB=rw*uv6kX? z{g+QwB;`^I&@CB+D`#8HB%6m-v@5W5vWp6XE~Y;3rDL?;qaW7OX)!m^!?84>TD2$r zX7Z3m0#4!c4(oK#=Ige$c4b*fgO|l{T)Y7&#wdBio&`q_Tp{qO8LZVFI2~s6 z7nO;jXMP6IOwDLjibx+j{aq%>sPk^6JtA| z3j|on#c==2d@H>tZRa&aTvle$-0;xya<+)GxRF>Y(NXL~aVUfFAr-P8n2@VJkmUaj zmdp1dl4?8XhQ4ix__#fB|4n_T-8#IO{6@bbb40FNqT&!k=CZz)&b9~_`VBJ=&G+Ty zO|7pM1%*b&=32bXf+E6OzVsh7oC1}#o#X@krlG?GRrTm@yI9vzTcxL`gLg0D)e?p# z3t5HPW?ym(GP2hMgxRFFb+wfB2{&ZZvROS?BWqHBtnM=Pb>1hNcuo!G@S_zzmIRb- zK0_lJ@u!Zwr(CxwpKhuzF;zL44R`u~8eVFIUSC8KO#zzdHRs4bdXM3JLQefwMBG{9 z0G85iW05iBMj~|6<<>1KYTM0U4x7_8Fw@u0NjDP}vS-kS?i5gDjH*BIZ;VDTBWT3~ zqwyjM5S+qm#=y#Y2=N!lKiYzUawO;9Qdt&B`dO+G-1O-ZL8?)MDcrtlw@(FINZKe2K!1zH?9WX)-jY_?BFVW0cSCi z8-#F7na$iX$M}7~6LH{6AIQS`5?LNzO!@QCVT|@XHWp^`e7i^vGxCJW#Ho|hrrSMq ze+9Z9UBlWzgz010GM~=Xgyj))vw*!!;f!8{(*RT(;joLKa{^K|#U`uz=kR~KeXztN zhm~uQlf(MoVhifyq*lXLJ}|d*Vgi*WQec6i)M$*P#Oc? zdVeuIv5N)SROM8JD?u0E=exy6{C6>F^0< zn1kF+0*@RdKU?`p>J!?cP9QMTTDjI0>5C>|0-&m5`#eiUS(%lcRYO_*Qg~TOc6r$2 zQlkBPp#ot>Y)v3#Jb>))|4MQQ258S`KU7M7rZfWTlMc3wIL zHa0pAvF5TiZXhc1=0#4zO%DK%7m{#FMrN#DuyQxO?%w-g=V^PeGWl~wGfazd-&7U9LXN~-6^dOhN^j{e z8*&m?Koy^eNM3e^s30GTD6UX0D*+*abRiyMLDO#c+G&oZBspcFvS41;*8)t{y{Tnu z)MVcGv_k7qUsj}#8tNY_mrdu+@jfnsG108TMQ=l<0 z+!R)W{m=K`QB3UnpH0xZj%`UU_l;oFr4C-Xlm{3fNi}$XE@(})3A&HnZ%`*N${1{l z#vEgxr%f^ueos!3r>pooN+YJW%CwO6EfSJ;fYkC* zB!+iXY;$w$5j*wNWlCZ;DcQNG|2wh1ir!y>*8w>0o1xuBh%NV(4=0C*RgpAOYOzdTk#+x`yw7kqGg`YN`*_2GU>z+&55&~f@8%{NM&O0!%1 zXx3x9@v-V>k4W$9B2(3=( z^ZsfH9m!^o&Plc{Y`0Z{b(g~56nM7;**mgWdAzvz<|rZx2nbDwU*yCyI~G|sHcxl= z{&sy59mS7~tk(Lc)?U~G`e5STLq^nmaNbetez_gy;Wyy-Z1YqUrSPm??)(1wW2SkS zx5~y+?Pc%NG?~cmT@t27S^56b;=9HN0d&XqvPD+AC6HyR{tbidI}cwtEvjyyFg+yu6oU}GfbKEPQD*=M!TCRAy;V>hT(GT+y9Rfc;KAKJ z0TveA11y5OySuwBAh^2)5AN>n1b64I{Cl6ObL#R0MZp8i*|WRH*P~5Fpp+$1oxI|7 z?Unsm%E8t%Vv-?W@ToQRxX7bRdGZ84tlsN}6}Wl4pUK?jNpA-wje zghv}_Zgee+5al##D89pE?R=~>H_&nT^mk3%W+i^5Euu5tzcYLow!Qx%eRx>j%H}WP zs3h_u*xchxFl|amkb7=bJu6jRMT_I&Iw>V(px=g!h~VtxWMpWplBxQWUJUeVGY^Sn zdX|>__!yA?y8z!*dW-Ag!qVH<7`CImbh%K0$@{3N7}l{Ecaq5PE4g{D=s*dow>}A{ z2lyYtyb2Od&JEl&MW$JQPcnhF?r-p$EY)SrZiT%GCu>>avS{-ODG3>Ac0gl~J*U5= zNmNflBob6qdOFP?#=c%q^xMHt>itqUZ*PHt5<)JAx0k@hPNA2{hOF`N&ldbXBP0mB z4hZVxKbMTs9tI!0+ zT$|eE6n6F-B&5-hkPvB^&_mnC<4SNG}WXY7+Gc;@p?orVil!Dz@I{0rkAoqjNcOUl8NBsZO z_WxUaT|xu$d^w`S5fw#!Tt6!YU&*4vUx&-5IpOi!32V1A0Tn`?E?l|Cc5u`MHPlnTtE+cBEu_p^ABqa#Na)9U=jG=!3DB_$l#_RX zoO;^kc%}@J)IETUn3=Poj`lbhEyuzzA^Db+uap9P9iNIvay*Pb&YFv=^)ego&1PLd z%B{qjc`Wn}L;Lq3)X$BuUi);z0hEkWx!FI@-FrbxUhv%8;&VD@)rF_R)^w@MAn;n_p6wd{bL(1x*8mjvpJlR6!)!28C_#cbh0E^6v(}ES zQd$Aeh;WkSdoEz7k~~R8MJEMxN?|UVMO!m zNPOs!ri=wvYG{h?bN3E5J^O2!k<{%naSH5c{^A+(i#P?vH^(VKo5RPkrQgnCDbu0_ z3;~lD8F~%R;+ki|&DQo7kk@!iK9L!iNWoUzgS|Tm>t~qM%6L+-eZq$|FLrg|pKif( z$YzJBOgVmJi&RGui+}a&n3=Q=vsoB_1^2^p=>P-}0uCK|Scmev4w zrl)HE30HZIw4J&eso7M#c{(PaX^@VLre?1F9F+uR779Z@s+yM7gvxuI(hso`#kO-?cqE! zI=8tk&m?~fHG|2g3!>kWoGFqzu{3kQLitYkiTM0`JA~?sUjyzBs?Suzd zOs=w<64c_JhMOdg^ri_NHUUfl;CP9JMh4j@u)0CV_zm~>P zuq5mp0>J}03?kebfWeDM4h0h_JW@#XEVbmbRKF>jT_6AkHG--4^ZbE*E@BHy8LgeO zRAD;~VL;fbtZ1R=Fz6FGnQZ>dg^Vae7@S|l4;qxG8u*w@RUlFrAdT#Z3(kiMOOe8S z%1Mm`iNVmCkO9a}I0suosTt3|0Y&H$MqdI@xeS$o&oGs{_?go(LGrGJ&q7%1sPdYXN6xPf4i{- z%Y{s{hEJm9Ce>f(*#EsE(5o`UUW)ZrGyYo?j>z58hJej@%W)C77ec-E#8-QUa&lc# zAMhUWl>#(n$BOAk%hZSNQMcNwj_<@MLx>m+&)A)0*J68uiaBKkS;|I{rHTdDl9#VJ zo^}fJp&X?#{R7g}d^^qWsD;ljiX-AG{}MV#1xW!|R2amVube&b73A#?=^H;QF)roC zzsD+(Q{flyu+zaNc^z2N(o9oE6DRhEY!p{c8giN~P1sGa-xuj}5b!M50(8j0W<^DZ z8#O6n&qTsF5}yP2XNHQDW_j{8ZPPgRBuArraUb^daGoJ z1l?wQ6kpJzrTO4kAWeGgVvaRGaiaN&+!L*+(vOO>Kz;#salCy&gcXvA@Y4?n_QXl>BHzai;F4u0NvAhP?e`D7^scZ^10z0=}gGvgt(U z1gx2lunoX(u?EN!$!dzENov^LeSwj2C@^eunlppE>%NB1F9fA;K~DJ5O^?%BKy<#F ze_1Lpgq)M%l&l~;k+UW4ut300uj~dnGEjcLEYcFfFQV{+oETTTg;!jrNhgP8i4qOm z^6R>#V{e&Cm<7x#^qfSH7NlqPn+<<~^APo-r|WR#!1`BlRme=m7<1cNUACYw&cIt7 zPTMmQfJawDTu@*6nd*Ivy*z%^#@EP5;01qEIDi&Dl5>R0xBr4xhyeVCWFzp%C9&tP zhv3zlB%x9>=pJ5dpT5U=JwlwKYCxGd52n!{o&Pu_N@cl*u()Zyy6b`40pP26M?M2* z^n3r`O$@5C-0&aH_8*0y6N^q|aUHz7!9dO`i%PWhw=4F_8j0DI>@HyV3hLfv1O_Tj z6{_ypi$KZ3zeic8PuUR&MXf|}qDmUIrRT?#33uKU(*%UkQ+|cg(&cY7H+Yvo|1RWa zu&hDK^6~zVylvF*SyT)gyP=dgIyW>(?SiNRZp;IW)@(fj0$0(5>C*y#g&(nDe%Yyj z5DFy!31^&VMttDj>5hQTwo%rCqriz6W#(iE&BG;_2UHr4>SpSUx+ME;R71<($ZB!` zzHDM{O;)N~5a3Q4R3_RS1QlHUJfPzCV?U5fjhxdTQp}(mF|tT4bX>3S&jeo;b0Y!;~MGmr-4Xod5NR#0)$Qb97IuJCIC z2Bmk=BrOY+2RSp-c*{iSr$y5ZNsL-Nv|Hw>%Oq-z)slo~cvKfLdU3q!hRQ?S9Ss3Q z`~sil;rADJi!`1&qvOpxV7}Wy=)Z9aH*lrVMXc){WthjtsfQ8ju0KH*!>9n|1~~S~ z2uY?jGc)T*8iE@P@|IUu@p&HFB z?`S@K6_hBdWe;HK@APx5=B;m&H3h;$fwkUL<8ZACex5PXlWCz?PmENaKo4avLdE`Vb8oBZN5A zwUq^s!R4>bqvXpSB&4n}AJLmVHt=6A6|$*2xzdB?Edg>-ipbvrrtfQpx4+MC9e*-~ zemvzC0uI!dH_bz+u_cJ^z`mNN*^%n&)u8tF() zf{~+ClopnW82=FYRfbyxuSTgz=nn=?Gl|eDKWiN^9VqFY7Q+AS_k(9pLeQBLCjS%Z z+pOWoT6>}Wn27P4so@+Q>wWKUQuUvo7~AhpNl8c+)G!o|51;+7ERB_XWqjl|<|<%C z^dMgKf?w?`i^@iXyUM$Yg#_rp%bF-bN0E_{;fSF=?>8DF<$rZ4#QxwhunB^OAt+^{ zMhGVaYNDdg+-g7kyP9mCXM+`TkG!7^hPMdl1$C29(@KoRlctA*+A&7ac>>h zAI6L^%y0vT9Qs=Dr^!=J0<0)Fk!JrwgY_~mJ3mb6b|5eat3-(Z9S~vTAD+j{&d&bU z4NFDEOIZ>A2~N^@>odKw6_0|~BGPk$ScOmJ)8kg`ZiGl}S2=r@8%uWoxUB62?EWU9TxCD@)Z}agtTj3ay;}>G_#|CbsB@ z`9Wdfeq)2nZM0MW`LYKm7tLpy8&P8ijZH&YKTPdp>^MWIRBvHMj>6WP3My(fb#)Tk zpTtB&0tpE#0^E#Z=WY26P)Ir`0N$fo@iZnBrGeKL-x~v+^Uhg^2lHpL4|MjWm`&gx z0viyAWm(iUv7!XXj~IfysE?+AQn+sf0V1rIvR5cTGVKK$y=wwL)fr^R>GPg6lJoOXL&LR0np~bY8`i5>04s@`SkO)xaji4MNPveeAp8i&i z1L8~fODkdw0Io1X5Hf>Lny4Srpm{V4z700cAgMZdBYP?$KDh6hkBt&6jvMLh@zcl3 z3JR{}_;|RmP^x;94$>TUArA{N4P%ZQ&HXaSo`5{Y;89se`m|Psr|g?>;5QVOQ>BWx zT>JUIO^em;#XjRHCOlp95Ke!Il3jl*-wU)8ilk28u*#8qT*?oVoeJI;?k2jU^`jOL zcD8T@8@P2ohVkKpqf9rU5exul>AvO(>@^r<|6wWi=QF4UFZpw`m!ILQH7rPC`%al5 z5HbZnfkomamw-_C`>b6>p1s%4rQQ0|aQEHw_RiZQ4v|s;4yL@zpBs?ox*8DQ(b#cH zD8VO{KP?#?n$d9yV^^QQn1;U3#g>{r45LX73*U{AvXJab%Jc#at~Qo*>STpc|X zO-P`Hh&~`kq`iT<^as$5Q;5oP_#F9bS{@T@$Hdd`-wi4C9lOX)*Vi+N3aDVg*}Z>% zaHZ`CH;kO1U_{|;vH@YrWZH#|jo>Em-Sfl2{;e2yadY|Ou`6+!6yFF1@mfkw5wOQr z;tV75&@D}Yf0zahu_Np-9=0?t*aImXfRSHE?v|gAAZ+*JO6vy_KD$DIGU|>5y>5~P z<`zsxf=8Mk0O|4%ctL_VRY3}xFsBX-GE~|jqamEGd}>SptUok0#Sk$Ie8#s16bvN8 zVn#>9Jd`o`{GPM!c=rHkN{L>e_N71YG%1*U>S)xtaR$|}7$Z7c9|9p5bW~W-3OR-k z4s!*5X%&WX3?4tiicHZUB+dAs)A%6rr8vSj*uO$yk|VqpeCg?V&GRUDXJWjBC)4J{ z8VlWpgBDykN(?TJV*We>=;>KOB&I-EQQ?I0<3faxG(?4?^n+GR_iY&O#thJ$jd+%< zH=f?YmzpE%-Z3DsQwHao;6o}LBR5xh4AR|hf`S9`22grTG;p4;V?C^22;B@(#agYr zcBfvfxGkpgSZQ`$Rkfe5v|Q!Lkb2&x+j^T1o_5I}WK&pDMY%c*L{TYZ9zmDTRoVl>+{UH%cGR{~7+W~H3 z`z)r4d?cIu=sJ7Y6`uL+B6Vx$_hHsSfsZfY|709iY5!9@39mxF6e_~exghkpAVyCIn^oh)bl zd3QV7x5Mcn8~MSj>06Y6Bl4U-xo z1%3d9gNlKDOFGTz@GF4Z%=}O(*QVdql=m+VvP7cEvISo$7v#gQ?x3XzpubkroWF9d zo!u`1Q*o~n+~2rn!Hd#{@~;_i*eV$NHK6Xk0ISl*#owk`(fO(zs3aR8D}}*KA|=jx z&*CQuiml3LEWcX|*E}GYqUJ3@7{+op;Cjs)Nq-)2z9C{<_gN* z)arU-X6D5Md@(I;UT%Q=WDx}fxo|tNKI6Zm)^pVk{4oO!EnM?9eV z%f|B#rNk+0C-6@*_ zo^&?d&1O3?FZ8>%ud027go^3O^M!<&Li~cMSWOS0fNYnR`mvw1bZ^OoRqmQ~7=0L< zt`hm)Hq)rI^l}yx33=vYy0~T7`OSQ?G_OQl7v9g?xh$KxD%{(zADY#L+`OvTM2Qnv z42#TSh)2QcO~lZd$zRPT5?LQhb-4j71NW`>7jD}%rwhE!$NhE)gZG`(YRtGG%$Ba( z{dR)9m#+rhC>PovG@?QeUA?zO$etEr875J}x>c#XuZ`hlur=w503p|u;CR6W zQUo@F3(J4gmqr4h6K1F+S^g@&Fc{^ytF4VDq-(sX2z4noY(TH67Lr97!jq`3@(ds+ zMBmKsy_DVoUtRJUQ)cchjCO=VJ+)f`Tm04&_0d@-jC?qRfl(6r3GvQr>Q?MgT3Wi_ z=BEID_Qt#T$3a(m*Wttys_(+fAK$nhN6AlO0US=l06m+-vAm8e5)x>mXJ;!)*ai^Y zv7NlVvJ@}9bCc^h^NJWG*Pfx0UIZpUq8H2J}SX z)9zpf5>iANL)qcsA#@(7!jc2|s{);lgJYfi*9csuNb<1NgTq)_YNrR3w%>VeD<-oX zj!fiqiJV`ZoGvmY$gyw^`OA^Y%?0H4PP&^@ID!_h@%}IA;6% z`wflGFun4cGjuXC6OGw6e9K^s>AT)Mn}~TZe|l!Njjh1ESAK0vLrKXmH@6?(Qk=dp zDa0tLeNO`aZ1x!`LI`zB$)p9}@=8K-;_}K=T#cix-nzw_2T^W;Y(q_6h&0@DdD+jp zYovD1=b)O&3&-#C^DZtA-3rM`Nl}xmNM#go&`rz7y#d5iiOAPT$k$&FteY@8vt$CH zv?T)GdmOW+T0zRGraM*U(6+etm z=0!zcBfo;s1Xgss(H3i0q-07A2%TkY?0a&u z#GA9Tt6QJXFhJ18e6UniN{e8SkkFNm`f!mLzE!Me(V>N)b<_0XFEBVDIW;vFY-Ojm z1_8|g2vr%)8yOinIr*uDC zd^7)oDD!ir4L*eKfUbC*BN4V#?r=gj$^8ZsQwWV}>Zo^7!i zjxiXD-yI;TA%jN@b9GyLZQl6~JoT60xQDppq70#ZS#9pRIdJuTJl}GI*b!9?lFrG_ z)>B>O<*@|&3zS}89s#Ts)Sc~(w8Vzpx{cBqNCAJ zQ6X24kN*m}ROFG12yk$8bky&jww~|w=8s%Qz?MU=;7%MB9zdU_bzd&^8iK;I93lTh z6Sc*T@%E;t0@WEtfy+G*ff*6qG;)yOt@Ex-EX+$4HzwYdV30y4lV{!gq3FfH&3$mm z3L?pQOQVjV+bytl8$dVH;is;E!*l~}|D{^+_OdAYLF9H#sX3RZp${ZC&rR}(-+)68 zh1SeAv(wb`2vF-|PD~tp>FlVyeb}h@eOH+w;!%7}_7!fE81q^&O2o6}y}CJRqp9)y z!1eE<4WG;Cy$P9T`>CUr`3C+SI-H!WF%`eC%5M@UM}Xa`7&h%H8xf-DG<5wu?A4~* zssG)Bm5+(ivvC?XKv&sL!EX(FPccbM3~dVZxjcZIWygv{bqhP|{;FC3c{`A3LF93W zr|z1eU8&jYBi+`^r*Busg-%}htGfP95j?l8$4^OALSp`ZXH~pCx-;;AD z@Gz;pF4;Fu!tQXbqnNE6*!1g7;8S9~1VeiBx8fq29Km&p;SiRWqJfu<@O2K(*15H* zxOjY9EzN*(Pw<3{r>nC|*74ENQZtVa&`no8FkowVVuY2oy4sev$#PN=Af=dXwM^#A z%f(z!T+hWrW%|QQTG@Hpgzq;`Q(IX-E7;6U{cD)Ur;6{RGmlH(BqaLIg=){v22-q% zMIMJ!>en6HD!xUbkSb0PlQ!;|rQn&R_I4ns)Vx?(nn{mjnIe*Y17L4ic!2i8U-A^o ze#XvgELwRUo;j}TvBcIFJ>V30I z?B}JFDI3Zl@8Eu^mwPfWGBr6eIyu5@FCdg*PH}j-LDG&+eV9bTOiz?;@JoVGk)OP6 zPm^$RT#2Aw^A)bNM8tjP(c*CIoBmARd(Og1+cmi6`o8FNqA6kGFtdHSMjSeb%mrtS z{|7L~0xagu5yxMP&r$melsfRL=`6-2XAAJoc^ZD4_q+ccngS}iXq%fK{c?Wo^R_0uQLY<=o@d{iSRR#zd^>zjbsB{W6(d7v}5ed-6*$%xQEz@ zDJhf`#I7ZXI{#Hp`tSWY=`<8$ofTnZs&VQhbRNScmcx%0{I3H6AS@YxrDg8pbo@$J z7~|7;%gLr!!K;bw;>Z1Jqw8<=_VcrhOnpX!7ne6%8;jSu`?inF#kY}fhP+l=NrD7* zKU`&yCG?09Yy`q6XWqAS=iye+%C6D9@3zM?xkWBdCX)KuPF~}uETO1-)Z%ztkfApv z^OV2c5$5Y)smlSJg?RZk?#_zI+HH4>UPzxjekx9vny62Tyo{xud+*$xy@Z`Gjz)Jq zypI!+xl?{=2KJmS*Y9TE8N64+=lWD#o$_v8Y%%yJ-;my*ZR}ow4SfC~>da1hmbh^} zej8})*drWp^dNG7KgA%&e)|a8b95<5oL~((v~4yjWVZKSb!ubTkN^%ob^iK=sa|;i zT&>)+b6j=_Htai_SzttntzB5Yyx8Sn$I~TFo$M_J(556*qLiL0Q1|;1+Pg>a83=j~ z@T?+3DTx4|bzDjy6>RDcl9{zf>{~kOUSO^jI)r=u{?+EE!_6>>JrcsUKrb)OCtz>sLecPY`r^i#fB+sGrn8F!16{kJ zn;SP*D=!V7K@$1u)IV4)X-}%1G3pbiY<+;U3#S0;&+DW?*5OZxkFa3}E;{m&4p=+r zW_!2-LPn!&r&TSL61#nn>WIT0yws79N)EmLI|)b)BtXd&n8_WOU zm1fr;Zd1mt9k<$Je;U-$o+gN^M<*DxH7}8j^nwP9+>6aZchE_W|B_Oc9l0zw^^=S+ zl!bEBlq0DL?WOzN4uywkcMS@&v0=2+9XlPe31TYXs0~kA!S8e3QONbXf3Xutpy$IY zL$1qE%n89op%TZ>AytF1?2vS3ipInKg`zkCIg4eZ)hdKcS3h5Q*vtnhDon$O`dWOlDEnMakaG`RJay`YqiXM|~spp#Udcb)bg`W3IDGyT76UETA+S3jUMfBSqP!Fkj1V za;}im!#WYSmB$Iu=6YtFM^U}2$A)pE_E}1QUgtYUww|L4-peK1gt&15-U36TO&>W8 zJZ!4TrLK&+#q_=F#^Y7}q~LqEH@dagULJgo&voYH+ifGyJsmA~4lqYc6DbUsjBde} zMp+#o4L_-*3>ygA=PSu3Y_J*^c3<3x=-SYKFXj0v^6t_<*qr2TtTSvt3~Xul5p+=` zK*yAT`!3C6Gv|cKOPGNUk}N;&>7;8pBS%WK-V!NCZ6HxQAn|%;e6ZdH06O#B_xZTGxrsD4}Gy_oDJHX7Y_*;Nx|<>V^|kM&B;)%GA3vOJUiM-{WJ&13b4*DKK^Peb&-;v0%F z^gqVBI2{0_J>MboAYcz-{y$`9zx$*G#2Hi{iAE^AwFa;m6$9vj~E z>3W!3K8MZ3az#OKo6O=%PR`cR^JQY1bp@22*0MI{3abM&y-xQma>@N94<4SSLqhay zSP@*;g`mCP0=GVwf1)o8p$?YtKfqD|BiZHx{D%j4BrJ5m8md5{6sgdBDBlH`FKk?2 zz+(dXTH2ff9C@YG#7T+^TxN7+mF1NzOiWg`7s)toY&}g)0~HOo&nqTU{rky{&fpkr zPNiMRao33I-r8?Ic_+Ru{zXFU;&>skwRIWmO@hNjmAhR>4OO{ULobB#r-~b}hU~oj z>4&B5W}KSw4Q#S`Eo{^f zGQdw%&~Hzzuu_Fw$X^u!qcWjw#l-_#wc{*HZ7(6PVwW$v<^q#He*7X4vG=f_F7)fA z31&(u1p}7(`DL}!T3VN1jV6ydtYL#qv(5Pj;6h$)@YZ^d9yR5p?$YmtrDzo+3-j_D zT51poD-Ez|6jG&1>+il<80ot{v|gn@O)tX|lqJ|?fEW_6uX*Ow4opp(8=Y^_q9&O6 zKu~#Xb~1p2^wwk8zn=t|OXsmN(9ac~|knPjTN~SvKu#tI44FLBsql#FJaZ?gKhj@Ui1C$NLPgy6biayecWWm}j$j zd*kJNxn;Xbfr#68`^Ht|BhjFt;oeP>8Ppy32___nMQAwlYJ zgFG(IPP`MQ{KUau3Jw)}X|n8o^QH*(2iG zswx^SS$PEkA->b27o?nK8mVpBXG=bPJwO`Yp*G4<{-{N6Zq8?x>I^+ywkUwDt*4n{ z>H6n@H5|Lvi7czCiVBw}QK-N#$Wl&HiS|V_H5_f|WGiR~(q_i`r>nObj(6&C8O~*cmRO+Yk|3g^iSM z{hT$$=0cM~jHqyo5AhKPJ#w+tyJyu3OKSvr0+5+`4=HS2% zA;Lvb(Qr_)fw#cE2zkW1!BSfx z0q~;?Q=;_KjmpEx|rc6>xa!Z62KY8Td;NDs$n0% z*?%*pIc&KS%@rU9xrh`ay%V)-*gv`TA=H`faf>uBzqTt7j$3;e? zwsJl~6*faNGsA~{!Ld%cB|{)SvMn-oq5(ft`xvEi_fAvMv3O3ld(xm^FRwAvdetHy zmqG@eha0v(QX8Koqd-&OjktPP*aQQgN$AFhk>dT*86&6}jU;fQK%StxN5)Cti}&ci z7aO-*1qQw@i#=3&ZxTMr*v{&6$M~Tx5FQi~@qLi7j>m4+$K@h#?^x&?&F@v7q#r8} zu?H!uuWkzQF=}jtyBZ`Q_i1jw$!t^}r#{?z8d0i#TV9BsC7WkGHd1>CF!lmvyLk%x zIQdiJOMoM|y<*_G*XhZ<_5!X;f-(M*cE?qr@^WVcElYgupUz}4?RWfPJ|$lWaB9s(h$4`E6 z`O&t0+_u0(zC^^VdynX!U!70h-1^3}N5y-V?9SIwfF&F#o1v)jxT}L9L|nr3`P=Z= z*%9elyQhJN$_&`TjkV*}*v6uj3ZFdWcMY2|Kzm7O$~4Z-TS7`&@w_*`vb58zrE78* z4GAhcyR_G?s@s{1GX1Y$Eed!;7xx9obvBpP>T$1kVDe7*>f*;QXu1Fu95gM`6k<3^ z`hw4(S$kOTG0%KsY&UU~Tcb`p&cH84r7_Zi1$`S1OeftZP}8W0kUeu)=iPJ8r4>pB zVfCtlqD%}O%y>A+(26)V%HN%|p!h!hBEZH_<`64KmCeIID5#)EW(ovCva#OgoIKs~<418v4RVgHq4Jueo`}2Zuf--h+B-{<+%dBX~1nzL)z;nwnXr`*>VV*+hZr|9xQ>@F&kq) z$|CYO9Nhf<5SiO`QEOhVh#L4E8q!ILOpohN?N!h2-F!IwedqP{SCQB4*v^M_GOr8I z$&T0SQBM~e-v@A(^EC7Z?kO%MP73<|cJ9WS!bzq_axiPbXK@T1t;K4=Wrq3wI}ez@ z$-m+1ba6jOw$@-V+hOo>uQY)=xzj7Srm7ian8hbW#x%jx!%p?LC}>&q3P@$FrBZ`M z&#P;-?Aiz>qr%F$Y^rsz1jEr zQt#v99X?l)k^dmEhGzz0${>!J{aiNG^oDA=A=@C~!d@3@Xui}ckPaN;xj^du85Hm0 zZ~sl@BkIMT`N>teRqawjWucajDMo2le5KzD>zz5RSj4Mo_wMT}P#m0Dy9N9$-MvGl zGsDx(mtOM3k1GrIbG7i1PLRm)>uR*@#=`ES*aUnm4-5=|(RX?na%)FNM~U6=jEt0& z1D03;h=P`?9alWVI0zyAc(svJ(emgOw0A3?zQM!ur*D(HA0anrYM295Nnw6K|I*jN zKc8U|OU6{A{NP`?d{ap5455iGHBJK4GYW7*SOcF8=^Y`Zd5EjU>edSDFWs&I&tp_oCs>1sI;!pDF;Fr<7S;sqi+ z0NvT_*>K(zNYP3{(-X$HVII<1hx2J#%1nGT9-w_Kf=Lt@(H}SNU&x*%#{~0pj!fQb zAPA+6JTiG%lVGL93*@?M>w3~aJaxLVE(ZA4QVRM6@xK_2iuNBdjP@mdRQBG63mWpK zc|pIt*CnBdnEj3Z^9wXhIqnzCG$@7#x6KOeoKA5N`}8#%gHImMWH}eSrUcpU;94L?OgDSLg&+$sMv=Z$H#5L7_ti_7X zQD@mJAXdQ==h|4)ABRXru^|df&f$7Jl*)9z21hIT+`(siV+k)qEOQ}DACdQUu0vR( z011)?r42W*pCwuTV1mIYNh9umiHkkrDrDGqaD%8fST3a+);d{lIEVCO-8TT~2y>6T1b!y;2_Vn^D^HF%# z{t&;dm>;A(6zBjo+LzFWp8PR2E-FJv?IKY$DbMpREiq0O=Eu)L)Nz^Xp#B)VHcpRn z3xo9S0!7qO0&l?VOKI0J7T=fZNSuIC8qR0JVTe){)yq*VhN{N?mJD%?gL2A+AJjZ! z(C-#-(=Yu)TRj16aKvfrK~UcLuF-}zH=G{glT=-_cHMcYq5;S=uH_A4lKE1v+o|sP zBJU=c3X+PG=t7%=PCbzFow|Ar5UEg+enx3Hkxj(2w}WOO4eb2w4erLcR7kS|pW1d# z@CJSpYpQSr-qbO&yvA1`bbMQ?^s<)$^3rx!n4t3u{&$?`!%#9m-v`>9z%u{wF`M`T^}D|t3^+sLBA=N8`G9kef7o0d3B*SWC$iXp$wVyIE;(KP`bbh@=@t|z zrWVn@)oWq#Eyh(i`A*0h5RH+gk_f1LnLEHY?&&7zQO$*mrU;#zjHj zqNMJmW@2h`YXn=#cysva9N~K#9}8lAgl4}K1BOtl-t^|tBx(rbJ;Lw(8*wdbHh%Qf z%eHN!g|X|(UGzslcuFlh*oH9E*^SvSwS`dEdkpy>9t%yBFgDmcMh0S-ii*sL5ql7x z3hMUqUGR6!?R?mH;TE);q%v5|{?7In6SjosRWS}>L}UWb4{HqRj?!srPXj#+8I|!D z{Wtr7FN!zqc*WA-*5c1H<~5v`0jyZT2BW^f2f@qi?9fOneS#1nS*XGwgV&v?r)<2K za;RpKsgN=ZXr6^2aQS0!WK67w&d}3({rX5pwqZ9JqF{S2$bV6MO)%m6n>$SiGDy0? zx^^Q3`;9g}FHjc`Lnx)=;(doPlgFy<<7#ZjBRA?rNjXn(5LSQb3w2bu5JSc&*Ing2 znj7w8gH|$_Z=UbA(vJ@r_&>fN!hluC8v{9nm2!x=(3~{kM>Br*`s{;m=(L;W%9P5G zThRScj}izhdH{PoOI>${K#BoR;`Ub~aFZFi+CgIunNyNH@~J zS`Ez06fN~E4WcMs`uhB=@jXL`q$V)-cBAI%of*C!S6ouG zLysn+cl^siWv+B*!$0Kfcf5j^RT5`li=ue0%5b ztJYj=vPOhQBPvw$3yN(kq2Jtt^I$Uo41R4iYQ2Hu{Hc@fK>$iz-K*mrEaIluPUrZ; z#?2DP-7Jvc;ISoNl(0^k91lfkCu z&X?PQ2W#D~-%TD zLv#DJo`eay6|<2An(c>HZzmgV)=rZ#-tW4C_tAK&a8%-HY@Adl21&dy(;~+6v$D{S zw?A(mbFY^lm9Nho1G3fU4}TdHA7v7`6@2=JAS;Y() zJWw~G51rnV&+Xuc5olzcDfG=+HX{schf^JwM(ex%8Hu+Jl9P~MWRK~UKqPyVE3C(2+786YRVm%!OH9M#^6UXN>gvY9gGoEthKrV^CupNts?&# zpEwLNKg9beeEZ+0}a_;6#43-<7dYEg6zsFMS!23(8r>ZIZ zA|fCMT~8H3ARgC@oZM*p$&o{EX@EgRa#qA*5d@^DdWz3K$|sbbM~YZ|ecl4Uz;h69 zkn6&SD6DaW?P`Nh3W}3)aYcy{rMp?^=yj(V(O$ z^~&ceEJhE!SMer#&Yg5Lc5>`L7MY`R0*}$v!d{ahFWf@6^E^!#=cMTz5nGq*5G^xj6i{h|rQa0v@<;-xq<6^9K+AriN5XUB9&JS^uc(MN zOiM$@`x4MQw8x|iq2ZyDO;9b%sf@O*Lo7vIpUAPQPq=i;bMxT!(`>f5J?Gh#eNK)? z%rH3ki>y)R$E?0hFQ>NT+E|aD$_7#%*osagdTZw?7cZAR7x@)(OQLwm=zSUxI8yy+tDj zs>)8;1*uhvBP!sj+G)1MY^4NU0CuW-A8??bZatR>zRt_D^k&3vO=BMcK#W5urI6(G z>OV9l(o_a<>bIOHh7b=UYK-<`oVbpKbXx(c5Q4$Ut+fbgZo#`dUYZHWf&|@+^5s}l zhS*+^aOy$p81MG)Ol9txbdT2re3&~4I72@Lo&ovx`9j&jRo^_tgfG9PPvY$8LW1`( z>9gfBQJp|`B@r3oUm^zseGYps{nJuOJAB`Sh;mjwr5;@F@;LOCF^T;p4=G`&qbIPs zAh9Bf8zIiEB6Z?ja9XQY9{6U529*MX$m;VzM6_VL@wik^qtHQtGtVF^ zmCRU=SUE!HHvSLrZ^CYH2&R2jvT@&EMYnmJL?ycL-N_V@XXNKTLxD6v{`|>$LQ=*) z();j{zk36k8A~?-lT+`ft11`Ro5jDx-_NnCj{HSHNuCBJ?f;w>E zQ&CZAvRTha$+fC#oNyjoTh|H&f5`Ecf0=|Skq_t+H|(3T$zzb!v6y3rQ)q->45FJ5LA=t(dnQ(Y3JNB(WL zg5?ja*p}fHq;ek28XhkM=g9SENwX^>;(mwT>?2-O9ODv(=Yq$f>w@sD?j~~ShX}9y zmZd~}yJf63JH!JC2@EFSes*0b8rlJ({nDHm{Uj`2_qF6t-VF6QNC?;42$U^-cchj_ z&Xc~GI&EXa;%NkwGzg^D3X#6}?^N>pob2*@x1+e6X#oR0HOR;{pES@SaHFK!fAn;7 z5T1?r4dKysbsriVMh!*#C+Ze$ON+a^71!eK7M$WzG+2<}cJuw+ckcUNGLxC)?3}arv-h*s zXRRWt5l$->!(aol#D)4t842J;7z@DcicmvJP%G$%pKT})buf#O zV|LrZ&x^6n?w;Xb(=^pn=-1`*>yc0bROq*>GQR?xMg% z>mPJbOR06Au8)^jtS&=iLN)27(#Q<6$I4TE_90Q??z>+N_jU<5@Mm`h5@r!hFI0INV4bHS-{V0l z#w8EwQE0$0gwF@v>?9*?R7vq4u}JYGypfDj4m!+HP4CWc3o;#ASXdNpD<$tKZv3`Z$){h$oZq&%c>m7t|%OCI+t{(W`GcAJ%Sfc_<{8=YcmS4k$7fSU9(3M|Y9C7x9G}@Ly3F*=n8;ZZ!849j(59d@5R}zAk7%HI-gniS{ z;NIiVq?E4*JJE}>=9Vg!DRLX|%aSG1liE2W9U-XlOGcdF>G8ORh*jbj%CBB{;m3uJ z#ID9-?h+wK7KROl9b7+OpcCBku_MmgZVfU*F+oG2r(?o?&KMm}dbYvJq#ur^zJ){7 zwBz}78)Hp)XJ$G-jpO%I&s0l%V%c=uLC^h1)!yB+(;r#^Qr*mg@BBS#8P*2Tp*Uh$ zQTOmrcU;gFiBv*d6yv!aS@gMF6i23Rt8x9Dr$e6`rUwSxe}p{^CBcV=KXHW6-$K3# zkuOAG7bzcem~@WGvSl!od}ET_l*6a0v% zN_pV&xUNB$ZE8R|Gouo4FJ#j7u6B^C;sNb}td z@e=9P?nC}}9LSMF@Sn&g(9_7DRyMc(+3r@hGLFq&YdF<9BBmzLium{KMw!LD(YMO3c)uz~AkafMPpa zOa9U%4kLG{1z!1OOcQM&e%BTIl%;ck^@h@0&bwF8+wl=!0RAx8Dxs zqLudx&8NE$Du$UWR|Z^6tARr|gBqn2919ET63RoVM)5FD|MNn(Jxyc<2xa8_^fE6u z7k_ZTl>w?Pq2T5VYT^_k0s=&{Q==_(nwWgvA{6jWx%8#dOSIjK1BsUe6>&~{ZV}WV zAQ1)qgz*zuG0($JbgzH=KE8RoaBguqhp?c*G>f2=Lz;w)oP>x-f;zG)lxx?sQ+*aQ zj4fyR3Y`4tL!w2~GL!|eIFqqpkL^fYN@QZ|!820o+@J~n!N9SVRNxdZ}p@(OMd z19^G1tgL8VL6Fw@EebvZw#sKHUhzkxgNac}8G(@Mz zHO3w3SOae7*JWi9N%Xt4No+K)ld4t4#4r}HLphO9z=)c_Gub;kLo<1~xf!S8+WOo! zd+eDatw(KKSpT%5#0-lF6zOrLo-=gg`>tQ`rZyn;W}Gl|=GL)kZ0nL(F?$@^dGj>n zWV7DZee1k_b^i_=5e}iuJj|)BqFbaa-pFkf_Cu3p( z?-jFR7{-6YC|*y-WBiIP(%}eL2-I}Pf49F^DjJgP2hh!d$B5@f&|%51v4hOR7~ zP4eH&CITk^1DlZ&;ulzS0Tn@AHOeI$mdq~FxjLT%1RJIHLzsB3(vLi^F1^VyCb$8x9Ls5F@|x za~4Ix_WQU0=i%_28MLLxf}vd6Gc@nS$q%$&!ZHL6 z*=!`=U*_gzHLYiylb;<79?aJi-`7FweTt<0=sk$d-Y45KdIQR7h;#l~%aa(e`##%) zN0O491cdz#dG^QRBP{6ktp@T6{7cJPFC0HkiXKbfd$E4apdmM$H1cVt;-_n}35ElS z1V$od&~pOK%!)e8izw^ozI^EkeyLk&4h)kJ{$lXmOkHlH<2UeW3(*S=^-eIuFo>Y{ z9sVmGVQP8g<}X;r>&C6Xp-al&^+NeM`MvxQgKtY;O^vzRfVEL3>*OpGGb0%xX`qcm zuG55Q(4W9Fc4Ib{>THjw_|gNuCEgAe4cd<1g^s#p1N$?_ULZkCS6z(DwZ;$E)0!>B z)02FoE`!Ki(>c7W)U;y=A5QzD|Hty7(!}%xJ0p@G0ZBD-c8&py5`gv>H|P7+ zZ=5j%KR=BWKw7S=r=RtJxp#X{U1VfOOG|8LC&Jl6 z@s@L~3%`1%2Bu+d72EV`2YrwqU@x;E&Ue4H#~*vNB3&iVSyf5ZxG9cZcN7w%qGWN$ z`1d>@NdFll_(tDmCv%I-Br!+*@9H`7B#Kwpj37l5pq1Q3I5n+n7YD#Yn&5xY>R}|} z)mGnG$U^=8!(t*iCBx{Ox}9F`gFywxMZCiFbRI_a;mlWoku|fAh4=Og-n20ml=p~; zrD5vmigE-xo2Z@D-djx@(CUe}mfO89C}i=-NjT8UKdOJX?x7dpY|0xrBV{-jva9gu@ixAoM@enJ z=L3odn_?ye)Bq_dDZi$wY>v~LG`JzbD6iy7V{7-v!B{#Tua4tRzZq2owl)7Qi;)r( zaGoLAOK0bkh$X8Fb2M=X&fTs!u;=n`IbXv~O)46{uO;Lp6f{h4V4N%2*`FuE1#loc zXM}VUpiH>#adW*vC?bJjS|~#!qSIlpaz3A-T*a;aVanQ&H!fC>!7EVOw3AwnY=%_Q zkG(+D%WC5A;)})g*LEbB5*rpUlrolt#?yvC4c?vC!Rx zgbapF9Ud*IgrES!^C33@Q=@sr(C{!Oqfsx{vgdAYVKHEQQ~kmMX#Vlxo|x})1a8zYB$tO(RPC$8^gmEB2lTL4 zCs#4IV@qgU{TiH>EhI`VSBgTgD=Zjfkd;G4OZ}$L6FD9P85*n?Nl;+0K=3R*q)6+0 zhzX|O?~zXZ%}UI6xIp9W9`K4X+t<$R{CCC44T2%mhsaLl)x(NIygxHPhF&JNRhNi} zzMDd-H}F44S!Xjjo%&*gH>!vCAs{OmY*UTkdAh||&cFL}LgLFm0t6W3D&&Mje3}v& zkxfmVH$T@yY>HYqTK_Z_RdyB?c5jo2?;~hij2l4&J8FjWe1a5hFIR(MI6uoKieh3K z!AmW`-uZ(!xplzZv(<8Qi>{IG+`1PVjeU_?VSOJn@G1!cA8eziJcFx(0lOwxUCmwc z5fkUwWWbokh(G0N>~HM&SlLftN9ZRH8nMn~Wvz(@U+G$WeV(U2q+PC1^-9OZEr)SO z2}@qzayuRGZQs5muUKFb6F#4ZmsGbup?-8|E2QhPh}@Nrq@A+<`VCp7M^9B3Nj*c^8B2(^$Upt)vygS zuB18zwkc(Zbl%L^&d%-vxL9ik86)%xbc_V#ARA}xZ`#@`kHgA=T2iM;xYbUfm?Ou3 zv{JP$#WJ^pybQJH4rG_agCDXk{O|ALRaOb`4V9GGf^`>ScHPn~t$Oce4R!t|o|~`$ zRHmmVbJ`GDl`3yONkE)w^!K#o0+G>yBs`+R|H4dH!UdU|W` zkx>>F2;aX*3h^KFgFoI=DTsytVqpwHM<_9gB*KW0lb2a`Ulx z(*~N6WOf$0>I5s0q=1C*QbAFaU&tm&I6BZU{291!aw-E&dU1S*(gwl3EuqLhz2fI;99EkC;OXLHep;oo{ z>tHv%#Ic;Tt-D|v%HcUm4AC)z6gm+KTkHfGr%^N-25aDavak8;uyntJ2h1ZOWU1x; z|3TiulG6Wgdm)<_rSkI}d`hf$zj}Jnugdq3uD%yX83j8NPy2~S3EK?@C>RrPbSX6fL@ zJTaVgcg^=tbzva`z0eyNm|h6yhXSCc(vH=P}MLm#C#H#zTls3-UvY`>R3 zdoOxTVOf|`$<&K9Otia_9W}W0+6}c4sKcEa!bg24Z#2c&Ryu)vQdG70M@=i;AT=vD zDS1hh1MXc)N~(j1@kx(Spo7T&pN62H909?x(l2*z?r-k5TsBAa_!sG`J=ci;Qhwev zQME-U5%*4ntcyMN=pQToZ;gMvavAODv(4?KCAJd+GbSA$TY zMR-e!i|xJqqJAt4E-Bkv1Cmm~3$KGUsj1t&(9vUCbGopdhO&MtkWGoHJQRLe;fyp` z(8i-V9vw{;s!!57p)-_+TOc((8Tpy1u()_|ui>|%E)MDSiti7_@)=v9wIaB^O2NUJx zvh_Q#7=OIm`^p>FkH51400)PMWi|(vR!4clzLOvih{IDS^)LH$N49GI@5q+nwi4~02Cz{kf=Q%*?0`lR{xT%PV#Z(3PAr)#ve zzRv1k8RS;iSw4KxD3Eu*lscXD+xIhyNS+g()(lk^VRn5*^%KAFOo-ZFwLD1hK{q8c z>yxdd{rqr1;e%talrP?iEzWnXNc6MUg99H4Gdp{IZ8vrDO=}6eGH%N6U@*@Y zUbyb~!Q5%?87GzK`tHs;heG@yR~SX$^T52KM3tKaFbRLAZDQ%4nBm!2}iP@QOZQVn3dGfZN zc7_L2^Kbrg4};Szn}Pq5B5K0IQfiN-6>y{g>m%$j#i%P0d`^8R?RpQTJGu z&^4`D7PLYZtaHOn4y_?}_$^G8nbk_hQ_>2~r@OIK+NW<&LZHdoy?aIF)j(rOxQyV z9f)|Ko1#Gwx<=UQk|C2m94I65^=~We!XQq}k*kC@h~5Sr0pd%8$;NR|pLQD&EONZ6 za_z`mqNs}^=ziYh-zKn}>K%E6dd;V+b z0+0%+LoqpMZ-+T;6Sd@>xloW^R#(*&XUg0uVa!I~8-SmyQg&CswS67w;)$@21Ut zFWf)%Y)64^5zQqCZ9@?KNjhre#et^2TfS$l1y3MLD66aOTF;m(9$L-B(1v-8Ux7~X z_3V;F3on<8sT!H#9$_irrxJ(eS53DU$xUZyHjCW_Bp8XuS{I{I56-JHR-dNo@PK;x zLiTFn%WTu$hTq2zV0ApaP8hd*ktg~Udt2Zm4oWR=b3_S*$cH~z1VZ)8bP&r(9{M95ZEXsVC}XS5=v?72 z7)atBmP9`@Q&sY1qqot9Gl}oxhmOIu#xb!8!{=rfkGo>ovf2)XdGZ*vGpyhWJ84Du zg~%Z=u3>%K1LJfml4h*;$4T;_RY3_tVQ;dFho0@fL$CT!O7TeVEjJudp)GwDW|@{4 z!KjcRpz4IG&=tjNOXZ zH}PzSyaW^rS*RggcYu7@l+6AkWhe%O82BHkUs|8(e@v8_<~hWUiXxWrHBH zN%Q`kj5H%-V=>WILXtLKcD|DC2JlwfA00kkp>VUrG+@_iVI3T+Qu72*;f|GF<&W2} z^*H(OuNr1dQM#{MHRvIG>K+ zzJ>ySU2=5Ikgh7T_^n3u{IT|eaU!35rc4;4L&!8JK=wz~~k4#)lYRa4`mRzOA!Iog;#KJmsc7kgo@4ZbtEd-oDl znNMO?sn0zsp^UdUAnJD`G`N7v6J`{VMTc?3f)a#Y$RY3vkH4i*G4BpUjK0~Mi;NTL z%MJy6tiCpjE=BwSa@3EHtv`|~eq4sDpz-26sXzB3IDyQp{u%mC4)(3d?0S%pRojit z+Q3(qcu>9>kl4rCz%z=uyVBk0&j}FoB|rjoBhjA%#LG!!ZSd`7aHH|@%U6h$JS2mr zko48Gp5fUSCd^4O%T%BSoc8FZVt%MR%epjxLI5*M(VoU->mH%S*|5)45;i1t+-WG1 z&)S{~Mny1BZK$pe#hkgDK)E@$MC(AzjBL~Kr23E&&1J&xC}H5t-1<_{g*Z(E(OTF| zqvGhBVwTPX@QxlnH`LFd>M$6zPp8I_ub8FDJi8puFp>*xn?{~Fgs)%(~D;U zy9JJrjqyZ;X8NJo;2l+Ls5KvzeRWd20L5SZnHIwOEqmrnJh?9ddk{QamWb|L* z7zE%iWc*FZjlS454ejOZh?eKzr-XJmP{|E@f{?w>-Jmbu-=GRqv zBLR!9ScN~>;peuUl9qI4ggo6Ll9rYR>A9fYX%YR_sW{pN0C4!|1*@E7m8czIS< zbx${+cucczGqQWLOnZBI8Ta{JY_2UroOHJy=%C^kFSm&@6oPugF8xI{5QdzZY87fN zt^1$^@5xeCwM3w`t0$;@fIVR0iT=ayl=}lzXY)}as-_B3TLRww1qbV`uWER)=(MC% zkO>#e6vAy>Mo3oUc|C#IoxG67J@7|=Z-B`t>)R0;zS2iSy%i8w@Fkai&~s6|e81(d4y|68Qu}14%V$ z=lj*2vHW5v5)!{mT1S$EsT7SV=qAkD->SHwb&$lAcgaTkP69;Odm{AB2pd!-5b*90 z(uOTUiB*QO9e$b(-<8deyE)_Xrrh09!bFo|fi;mrbL5eq*gWWny=ziFvzWS8DxUME zIJT=rt6A7x@Bb^NnbtbC|K{}L2%Ui0Y~QSqM0N$r1BLHLIg9Ur?J0L$h*^#7(={zb zgyZ?iFI5gIkoe}Yv_kA^f-ll3-Pd~>D9tB%Nz3Evj*W(gud59wKV)J0g6_Dg3k$is ze115^EPy_zykTj;hmXE|nqr57l{fb3_>2-lql>Bc0p(}OjXxl%{43SW`bq*hE0Mt{ zNmU$+L`++){zhM7%lQR8A5PY0jx9#iX(yEIi;9or4zxAGSM>Kncqk#GY!2`+uL_Il zBtDUL0RfgEii{+f*;AK;fntNY1{2Em$2A|+V@nkCTU-7LsZ0s|P#U3A6EM`ihT+xY zZCsh&l`ZMC{~jfnUsvu#&s$mlYXRBG>Px`kaZv4BLeTG*=05$0^N%IOY|jzZ4}{UD zA2)?**tU3*UJH^f6L2w6ZV||mrk?=Jhu@^RxT04Ce!8ZvNN5fzThrNDXnlhllDEoZ zMrDg9k&PKeqzqtI)Ws^CRBLl(WL8#p1`=e(Z2pxcO{*BYi#tzG)MB9e4HJdgW<`r! zGmf;ul9vUONRxokOrhJaX#vKtZRVn}D_6v&BGNXNjj-i6{=C*NeT-X65meu;l;WOyC_*rI)t?4Fhezyq3yPX8i1pESSqy8)D%06NhY)k(l^~u z(+e@Q$=Lbme?a|FalDXOCm}?aaJ^-ox)Qv_|4d7;{zQASk!hdXD^L3+>=j0zFqFKk z7$mxoK|9iix$+N7YreQhmxq-0SU8>UnaXJ~M|E3Um)P-YiSSL7z#j|^bctF zx2Y$BXy%}O?P@QqkYnr>97u>GU#M`xY#Ph>3x~#un5Ctg`KT&u)7=0szN#(wUGRoy zaW*f-Pv6=civ>{)Au;P;ASaAS6qFOEpEIdoiQA0=Gv{+O*JG8U$yfRU9)bas4mfxH za5+@oV!4dFj-bF!g95UJ3c9<-Pa?Y&IO>`))n=Fs**El-Le98OK~0hiGNedzI-{&a z_&At$?&jA>Pdv6G)aXxYx(S|PRDUGh+4alh@gZ^a7}t1&PmfYJ*}gQB96W`8mXhEU z_APHy+&Rq}TsgB7N=s8pq0^HLwH?cxqeumc#Jm>i9Rg%}Hrq|J>8 zy4HAOVdH%y+BbB6C&w9>7$nV^IT3JjjRfrvjSK%U=hKzkGRB)J=W``Bi)LBcA;XlX zB+sbAlJYiZe)<+HwP2bY;);q;pdP1BOMAt!Z{Hk}_UpaoA}mDUH5Xp2eoL;q=;AA`LYSton)_5Iw}K;;Cw%CjYnb+l$M~1 zRY9?W)kwttvR=ZbDo&Kz&p59Z3b2bcLkZw2iMrr9#NuOUm>HH4ij1kKxH@cEPKQ0lPk<;%NxmVbFhQPydJdhe^>DV#9{9%IPF1stBDGPLu~koP~)4adXR$j z&?jD84EEW0uy*S96F{uzakQ5kFoN0hFZzqi&pNxofYsLD?i6Z)DiM<&^B_FI(C=Kh0eWE$R3z?R18vff~ zRe8ejp%N0NHCZ1`aQ6d)*+3XOlp(#1u%{oex;#btLD|o>@C}4V$l8ynaa5s@rM!>c z<4u$C!tkt)nMI$3E3C5ZsDb_ekE_onF|{h{S8U~=E#{d-k#T}5$}U;*Fb&EA7LJ%l_S8X8N&D?vxisd zkDl&a5*;@3^@n@V$2>*v<8yDm!g1{sLHNP#eud@H>zXu*2jHk0ZfbN-s=y z=Pi0G7aXvAl{I22xi^FQ5rkQ#I@55S0;Tu;e?=EUNv@gWe=FKIAJtj18dKhIWt1nV zlVgO5QA$SQ1V+WoK5xqSeK@%OrN=JVMz{$LWl|)t5kk;<2p0tKoG4pHO&QY*Be&yQ za*WEa6T4F!O-ox8br(}qx9{>d;AM9G;|Qbk zXbg6ruoV7G@MaPf+$2bj;k&g+WJjQ(0U#H?0@#Q>=zKsDd{m-QHkuLfc)gu>Ozzpx z9v-YJw#K{NuE#gnKi)r{>s|7Mb_6b_6{ZBcKo^1aPX3o2!H*apPY->4PjQoVRJ2J~ z@hu_`wd^7FI-|SPK9V65Gg$91ti6)nY4*`w1fsb(^&(yw+ZNeq2l3 zH@1yw!N6N{`Pks*B_peptk%MLW#6dOn@UaO37pR3#pRG(Kx$R!{{?wuAxKTdSM5D;u*mEoun8i#T5=) zVEr9DUwXv!3j8&o8?pVFjP%m+@%6YbJwGsdJGAy$I6mp=chXvxZ|Oq)`|wGc?kCpb zG07>>*_x@tPqLct=G9Hz{32h@Z)5_%{*qua-KJWw7nS2);_|2}oaM69&Va@M;jbgq z#{WBzB9G|FNy8yXM32(KohNQvo!_ggtC@)xsjIMmG5^|rI;}$V6?mfco~p=0fejZS zV9%SF06-cTT^iaV$9mehetBjbgrp>7b=AGz&(qgcM|JRh*-1gob*Gnuujkh|75bfs zLvHTkl`P62=RFLqgk+FuckpTLj7Y&t-tXDh$pf3<+I@qMub}D@cJ^USzaXlrh5Ah* zlkdAG-wq1=DU}#mm43n$T7a9emK+_0Ih<-p=1an4}=VbUvSf)-%&SjJv1st%@b#mII%cP zW1D|ti#Nwt;hGj22hBpg7KZvgi%XmaJ2Z2oVy8)uFHky!7fTu{qI42Zoe{l-gW|uE zSj|;wK6KQG8-&6twIUJ`yEZG&>*tRqz0m1EN%KpZ6&ed){u|d$>BNw8x(und%vpA6 z6I9P1@Z(HNNq8!qUziFc6Fwi0=m!WzbnSN>NZ)7;p%s#uzX9uRSrPh^Xe^;w zp!dQp<}o4ZG@%^OaYrM?)7^U%#uaqLht=EqwH*L@vy%jrwjh4Y77B zzEI!T>v%LW<@et@qmEoIE)ZH_2>(+RunVO{gua4jg-+!3ug&w=y%X^1b|>#W#U$_j zyxvpzB^Vg~-A`D)bx?v-66@*OlqCy%kTc0{*ns~@zrnJN7SVLLMuyprfDKdsps^E) z)x2H*<%?d9UVcy^g?^Sqb?bODVeLsGv?lLhFYJCLrA~|5h@^7aTo4vlyCQbe+$8FV zek#6;Gn2Ep?!F5`@sYwAXWA%li*1N~N{c@fA{@UYQi@DsQgJ1#EoOH)Hj0yFT1!PJ zDbji=MQ8+=fW`2BEZvS;dkLD9fb=Hq-j zj72h!2~=zVHS?@AX1gTRi;hFND=rQNS0=oy7qb@E4W2oe`3r|=>3XgkJ}bNk0%Ykc z5?8Xz+uJ#jIR4C({xwJ#=`HjPAlOv4)yeXXpv2yA44jnRTKm*asJpx+*W{Jw@Wulb)5fxVjW{HFtfQJ&F|np%$6aP#z&1 z?~pN@w#*kl+r?(mYnWWHxS;ECw7Isqp{0a%LpEn0!HY~n{r(_4W5`=Ndyjq*+`E5U zko&x7Lnr#6ywUt2Ls7YC0qy0t*mv1zE2$aBq||%(1kYC$7m$SX$AsDDyThj>Ei@fb zIKpZaD1CgqUv`=L02KiX&+f4WBqBY49xH20Ic2RbLu!gGGvyiE$q(#ZWh}=R$)XT% z&O)Y6?3hLO1iGp!e6*5_6FN~122Zr;?%Uf>GAQt2m$dBJ#Ik4|xOSoCYEJ5(12gG8 z?6@)w*|bQe4;Vsf;hmHxFeG`U1y4*d>5(;)PgOTGZWxhtg~D6s5i$%^?dJLw=lo@7 zep_#1U>-3)X}hNN{1}J5!BNXD1_xYoHy`1#ZTwa)w(qGe}6$I5b+3| zd3FeA5(H4vIE74`5W+EV-kENPe#*8M^U(fkQ*~+q?F1>?MCQIV>LkfS)I)KQ1UU#v z=>9%hlHQ7V*U3qDBgIH4HG(+YPv}UtCH+a^v5Cmy4t&vgt?j6V`(|^Llr8=st z40U+_V2kVi%D%G{!p-=!YDjWNSZs^DbC1j}at+0&AN5w8y4V8aN;2$?<)E@j=Em== zk^&sUc*GTi5l!K^QVJyiL8t3Trf@&ZII*TOb<0B1VR2l#R2od);UFHh=qp@q!LeMV zA27S&;qhgD&NPL~?d+cLkc~`AKV*rv9X)CJZ;__l8+)je{$YB$tBA$Y=@^hiB9vpw zL)=e?s35^hKJZ*>VTNLFPeZ&I{0~a_bhDYvt)YuH($Tb3g)tb5$%cNA_(yD`>)$G zv?8^cdDQT0b$R|7+$(?mDsYsGHL|m{7<4VE=<={SnClP}BudzS31yQgPjjAAkdvQJ zJTw3&B0MkV`L_845x+wCRopst1Fl7_;64Uk?5n3CGx(hG_Nu2IrBG8sGQwfr(qS#y zh6AHaxt`uUdrz|g5h0?e5cpQP}dXD8yipd z)~3QHk(sb~5pX^|JOKN$u-G)u1I7oC%zY69>Fc8xm&Nc`;Yz9k_^rv%5xw?|@@fg# za~*7L_3zC*%Bd$f!x!{OUKk5^E{t6T^Ll!E`06T9(a?(2^w)gcxcTs_uQAinNW|1l zX_y29DSnb7W(LOCs^yUgUfmo)Wc&e(SB^9Y)TJlcePz8j2Eh-iFY);pi?aX*epx^l z{?XBqtF%rDa@T$;ZM}`PAGXE&dK`G;fywmswU?Gl$ZX{BZZ86g8SWP`vO^}FnLB&u zF~KIF0|G|%?gxGEIO6OG5Oo(Uw9aI3r{SQV+5fLXMQ%xTO6u#ZdX=4Q1p@VI_!^=) zYIUm`Fbjj{j@#3IVn+p{M+ck?!Doyex+lRhAmJ$Imt#mpG&(2sah?nsjAu_xg!wL&I(?JY} zzJmqtwoWgsX1JUMu2fxj_v>UDvrEt23W-a1Qc}|V(h@Ez;>q`K;B&E=MIU7p#BQxL ztCAEA%ZwAYTXmx5ObT;i3X+bXH+u&I!~x%^^K{C&9RI`)Mu7MNZp(VZES zLbyr*O*{EBVb|B8BFef?$rY81unm&&^tWat^Q^0_Oi5}=N(SEE?44*DzyH(?92(=! z!qDN?VbYZ`Clc2&9>QXr>O)E`V^egv4R6!vIGpVf?_DpmwW8%8=_C&E{i6$v@g8%W z2`i;=B1Q?CxdLw1<%f_y4!8;Sy#h&ug`NJaC@Ia$q5s&^BE!#^+eUkQrzKBKy zYvtsVke_A9yUn23PGY}$=KY!`Rc={helkdWXvMIAycERpIs%#wIKlzUzFLF+epGDl zi0|nAi1M_YAB?f}F>^mzxE><=%Bq!iN6)^Q>xGDSeqKVX#ZVN1FN@ySv;X*{1iN^P zW3dmRjHi`ZQNxChjEvB$?;Z>7>UWj<^MuWcY z2_}e@oUZ-{eidU+@Wo(RZ_z+#Bi1=%S6A0Vw=V-b2rxW;l~+8dVN)L)JIlMgOki2@ z@cqxdr}w3ZYj;fxU`;5?>wZ(*WJ)pDzNLvq`- z^-slBT{JYNBCFfhyPh{Tvg0Y%cD6RSdA{W5=rp+Ogboat#eP9WBM%k^JFfbegzy=1 z-8E3hKWET&F0zxdvvhjA%X%3-m@?GyY3uB?2k>&&AFKjz6>U2zdN>b{;*Rdom2Vd- zR0*~^M1;gLvhqFJ8hosa`-+=hUp5}LegpNqX16A~ASU(t&en_F4(8@xL7Bhj8wVWh z;J4mz0`q2EdjHfGK5kz{P;;{$9+I)AX6(3tP6T{k7s79>o0`D1jL)k4AkbHm1jV0+ zUreWIb%F3)D%;WZq^hO$1fY8ro?y1Y2GYZmiHU`n} zm*<0ES38AmfXrC{l5mCMYDFsE3*R|te z_zOn|cRaAn>fxezvn7=oVk$vH`)b2prpfpH_a_ldb+wi$PPhGk9Sa+@QbRb9ZA;Ls z<@3z13cyxw?zJ4u0I;!WU|^tVZ$6cz%{3PFr916`qPz7$(z{^sFtgYF{^YF*nYF6g z_#miu82I{(zc-wtYW5M28bi!b9YA(>78?z|7};P+Tklg%__pjZDC&8RrL=*;&M4P zIX$b`;r4!#v~q+$>rUBs5F};M+;q+#{F=9D131Lr>hQTX_gjw>ICgYh)6p_cO3BYF z&N#Oz?aj-{&&y8N+L}Ap!Cfb_FUlnLOo%;SYdTzLC20fcpn@O1Xo`)` zOixbC^yQ|b8&tI)HL;uU2i|Dvdy!WK-fxzrr+-;(Tv<6fuR-SYapI4c3~#HvO|6yR27U)s2u7z?>9g31H{}Ou0P49nZ8B(gYA0yq zo@{kbieft))W0b)8vB4aS0#&rNvEP#6l^~CvGzzo#(#jgtd>gNWRu|q;}G&Q!Iq^+ zW}m-BN{@y#f=Nw+7CS+LLvrPp;?QTJf5B5{R5BP5z$7I<(UeU@urv&jAg3jV9a9g; z)bc}VEBN|MBl!6v?{%}!;bSFu{)MFRkwgXPLqmSQ-RWib_fM@2AXmr>yaXVtH|$Mr zs*!f{vdOR?7TOBFy#aOtf)c7!sdV+l^3qG5zJt-DI@FvS&eg1${bhHXn_FwY9Zxfz&p$73lHPvSGg@ z3eKkWSRx=!{l&)c+^p~Ds>&E~vuwWMiy}ir$Ly&0U(&UA1U#5Grr2r94X{uUGme`U z>MOQ8gHD&S006*rY|dX7L&mB~FCSQ|HkS$$QL)vvm6a9uXIc9|kU0N8Z=nhof{a`- z?~XPbHT8Wk-bm(A78yTy1@Idv;0N9GN7D;((!U#|wuo^qR2X5#&#FJ3HFF!u0Bq zOCWctammig{?30yXG3Bh5p_PJ@!tuv(B(9J3ZTd-}-sAw4}U1-Zfvupc^ZaJGM9FM9n6sAV!`Q-fLL>8g5BU8e9gx3IP&dntSlqY^o?e{+7ek^| zi{9g_GgMTB46(j~Kxfml14*V-#l!B+Al#!JIj55k*Vl0o5tZC-paE|vYA-}qz%YJ` zt>NlCzt0qy!h(B)D0$3o#Lm{au`%y{G(NC>nSUKaM0lWgtZch>S9lJnef{UwmcZ>W zMCN3JP6iRDBxYv|ig0c&Z+SibOS^{m_6U5cRibwzFQEti%iiE_1J&|TY_fkBw5Fq{ zA1f!zH--DfG>vwoT<2}=v%AHFWZ#U-+CPxHi#V{Q!JZF$9>z5Z&7jaw!pmi?KTk&vfs|+NN3N< z8{hjlsylvv5#hclBWN@3^*IFpE*VoL9cP@($;_%{sqb++T-oX>0|@Z-F-ef>&&OOI z^>qE23(uO@l`wuktM3jtf1D_xS0xknq~YTp;ucBG@M>;p+LB8!Ve7C#NFWu_^J%+x zw+BQlhKmlrl3lu}s0#3keM!tnN;A^k(*_^fT5_Iuxl`|7=DCXylbcI9n-Hg$mzwr61Ca_5mn(W zivNW(f)n00A&nAwAB0-o*d?LL5uZ|3vY*YgVtU5ni4&s;D)Sjt&BIa4ze>n|$~ z-byzFo3{}X!axJ8dokanpKaccs@^ZD*>DC<`6`$lu{ z>vh&_Q1L#=M}_Fzk3$$lt><+~;Q;2te@Pw$o5(%$SV&I<2^3=4-d%$gg<5VR_?ZPK zeQp=#8V{J-8l*>vod&9;V$b&*{t5ZQ>gq<3t_yKrILEx5Y{cXxLQ5ZrL=YGF$ANx1M9MfH0RaakiuC=UGI~pC|!Npc|gE?8O z2JY`~*^cK+zFzOZCN3jWda(KK6+>43y#X-D7xv!jDts+v%^@HnIzA>5@Vul&TT^Ey zzVV*OYZDSVbK~E4SZja0+cc{_6V1sp-f?Tj4KHC)c74V5_{B$4;P^Ni zF=DRzw}~vEv#yDPSb0`+P0;INeC?7wkP^JO66${6rSF)_@BY*ksX-zcl541Z-u`&C z#(S45=x_by3j=o4lqGqUt!cVh#rafluPj=Av)kdUps(>H>n{Xpw;b;(BmU0&Q_nk) zD;sC2)6)42z{+$a844PYj<#`f2xa7^w(d6?M#Pi0Cgut5>mf1w3S`*=Cg0b0Z<2$m z`9!3oXkPoZ$NpCDiOT~lDPC_k<-oS?0np-YyWGg6WLY_xJ_LrbHv7G$800 zOx2O{6*B815`(BiDq%xy)%+u(Y!vF7<>e>WQWcxR zpEQ#O4jyZujtF2@xC_(FHSVA>2B(ETy*hTfUvvqkR~fE9J|#|9;Jzm@iaz_;8`3bD zOKZIfW`xV4=kPh7yo6PnZF54u8Uj6nJomB9*@eFgnE-&Cg>`kw9c+>h;)S9d_^YwLX4yOeGSjpJ62Ho@k*=HR#kJe?C=rUJmHfspkF-+!%Vi#@qEZDpfTO*iHSDeM~ekD5H`maQ#Gd z{==ZvZ?1d#~Ntr0NB|>p6O*;W(}o z-{{s5c-~?U3wvKO2sizSWsb`ez6LS4wX6ufV?Um(-1-28;YsR!YN=Otg*4wd`u^^I z2iF`e{>He&r?IGgV*4&N4fiZyx4&tkBr$SW!|KxrLzZx~qM}jyq@cF0$NN*PP`oUd zs<3LHqEeexb)3IW5s9&Ka#^g*9P5zp=wi9X zeQx9tm&^Y$QMhd-TVj~!J@}|G=&%k#j@5Sfv5U9v%<4s~k!&?VJUp)4??BDT{rkZo zl`+U(Wo28x-Q|{c%+lPtwzK+p=y6oCzN#s00xKe}i(01mGA-*a8}E~w#iNn)*)SHK zjI5>Q0K94*-^-QYAZ~H%2>Jk2v#eXCNKL`hUr~MV-}rD zl7vh0eO~`>iUDC4Nwx*Ghekf?!x9Nb%lrABXzq>1oqmOtfnP1xR+pzCqWw6j1~>JT zr2K?WV-NWswiHQ_rHT|Gec;gDFnl8i@~_M|rv zIE+PPe-sE;Sx1%Pp5mMeQYM|9rV4wpgY}Pu>i=@B@=jfPlqmF@t&Hajz5JRC@q(ER z7qRM8W%$7%;sLk}stm5f?|VDMNz-P&bqXG}Mwhh0PIl2(wQ$f>&Es|j6|}IF?06)j z9v6yHM)8djybnXkg<#y{V_=<^COjAFG2C2c&Ow97RCHPa9ck3Sw}$E%QQpfI&18$X&UYKediSgxP$#}il_Ea6N$fcZ*q#UvONyS!mi=(C1H&pEA zNKS60?=M%)C8ddr&~h`_dkP`Jh1ecBU~AlZ6wa`c_(e(|VW2kKTjqJbQ|?Z zq0+BU$w#uicO*jCv;8+=RxXI@L8;VjDsX86sWEs@1kqATn{-FylDb`c`pR3*b!H8H zU7@nQTri71$?E$H`V|bqjf0j+D4ca>u~gP83IbEMh%29AsB6=adK&I7bLYM=2y?+Z znR3xDB8nXo&+`tMHISoe-7pdOZz~F&tA#pCP^J8pAVg^&B#A<`J`AT)#|fz?_OVd&)l6&YBu21(T;)@lurHG~a&Xy^_1d zH2FneD+c&9y0Q^QOC?0em>D2Pu(7ipd_#H%NeUIgr1j`=^~7^Y;IAtB6KTDy^*@G5 z8zZ1bCBU6fq)P?_#(?-DFC#yFb(JQZtx=5x$06&NHe(uG`Rw7X097&S)tHLKdh;ir z>b^r4RxiI%NZ8vShgjN@;+=!LcRuOtQ-`({H_$Xl_OR@k-nL}$0O1x z_0wv?7kAtAT+Pwfr`s@scf(!z=X(3%wD4H=*Y^h}ZFTv}#Rqdr!V_!9cJJ%G2G^>l z+FhTK@fafBH9s@e`vV;{56uS8z4N!r$4mw?^dnATEcm?h*RASFzq@tifIHs5pi9{& zF}%mn+H%}vD@{^t`>~jet{+TjF61>ercB;5-z~oJIzA+$5?nJA3_I??G6zFIYGMV~ z(fp*o)QzN2A!~oDl4Ab;Bh}fT!J6|pKZW7wK;;ulBs)FwS4mPf%+N`TS}tZLY~=~1 za?2PRSZv-ROJzQrojQ@onuEE7lWTK>JRGI3pi>f02RqGGo$A$L~u~Y$CO#+;504^wHlEQQ(j_ zd*WCx*AopX-wmZQJtrRh6?fVs^>W^@dS!hO2xy`R!?oZsa68Zt?VJv|^=}ZgC9dJq z2L^rN;RIv`WcKlJhp(f9^w`uQ(Hl&EjQqDP{24b5dy8B=7p&YluBYsGOMJ7v%+ztvF@45|L?TRv-eLyJ^GlC+E`MU}OUWxP`Ld)DxJ#CAQ&P_d% z0l9MccQThBVv_>X8hUP>2?MImV97Yf0VJQVo>D&!3bC<+;b^r66pAztFl9q=m8E8N zs7gaqyPyFAy^IxAQL;(+*{5QRE-Z%ZCYK3@~FVI1h zeWags&EJzKew!pHaoGEFU}4J+fe5KTe^90en_Uqoi7)D5j{_66YiADcFr2!yF3%h- zd5k^tWjNvc@K)4sBMWVjT|haN1T#hgEqh^2n_1(5&)6cJO3_aya||)e(rsSQ$Y^f` zO3c7E+`Q- z2thztP=bwUAo!4M-P`lr=Sj{x*e)$!P8*$|R6R)b2{kV>3VDD%@nKsc!#)Lp@H&rw z@zF$I8Y}nV!!{-p51-}+kzoJ`9NGxe1&!cGhHr{`eU z|DeW=Dh?UcSgijFL!kc|B+?JU2tMq2Kd?Mz+Thx|2!$Fqey0Z2a)4FBK^4*HU@@lJ z{yOT6V|YXtxFibs3@ZiLWRRNDWb$SDv0DE|(HTBikmz<^ucJ`n+#cNFdQ$@ZM$cz_GJu9lu$#Ymhs#hB(Wtk`goCW@FY%CYREk>dOPXL)1V!e z#x-UrDF&*Ib&ZhDDsb~jQ6TSfgh)k7Vz9WzDF4u0*>S~8uI!@Wn5X`YFcWb=`H4_P zC{YfrBm*{NT&~0(I30m1P9IB0`E1rli)xVR+|%8k)yeqA2cr=q7h*Pntg<_qn)yYp z$|Uti<^qOMLY8a5B3uzMfIM>Lj*w3>Hl2aD;N`nA zl{)x>qFs++nVkZ&jU~WNGDeWtM;B%C0iseru~r0MDH}yD>u;WU22zqGR=v`vyUcl( z6p(D!8?+OBq8AfN6lKBES5B)&i7cs4kRhxoI4JCKmzJqvpEsdxD9R^}{o#!t+kv(p zFFsX>OzA1Gro$ngZwX#B*OpUjFx)NVP`xwhn8khQFM3ncF%|_3jm+`+?H6lIdu1>I zuoaca_F{5Ju*P&dAJTkIS$33Ry_>g_5(GVCecCXmi~Eea}Ge|6fO9VzwRh>q#fer;g>PY>nXBb)aaGC{FGxGsMC2Q+_s%bFtc?CzsogtAc`rKhPT38qj*F7bpMs!?{5r z10}fLX9d@``K9}42FR^NL!P)8U*l@brh$v*vGWTu$?yvA{(>N@rIkLqd+C*ymiB8O ztqvJvv}zr*VJK&#E0dHbteSf4W!8;;FOre~;V#Wk9B zm#%%|J3=Cbe*;o;3E7{72yj94RVt-3+m}Pza1a^uGw|Ie7+mHtLbOS@z(+PA2Ka+a zJDZyiJld?Am{>!2lI#~B)VlZY;i(c49ut`t#59jv-Dd&-f(EcN1I8Y9)Kd&3bKMeh z-r6dI#W1AhT;HCSzm4CMg| zfI8~{X8C`UsH=OCp4J-@MsW|XJ(-LVLmmQ3PS0FStnT030PZIw(>kQEGe)WB!8H3~ zz}bd8@XaQo{~8FG^X-i4d4gpx1I8W!r`PCjZ@T^gD(LWLkzQP+$?LjueJ5nr|87hy zIz9^4q{EiENj*Z}7j`=`|3x_trorI#bM%PbiVB%x^(V*+cea!&4cmWrk!NlH`=I-x zI}>Dqb;P9CP8+87$*W|Ixb4DYfG8XK*`lADQW1oE{sq8j`wJ#;F8ns0R|?`Tw3%@w(fzQ{jHHTcX%ISNLHz zfyw`t8S{0>U*Wrg2TxCUL!KMX$64W-;^#&*h)Cv!|1B2qsCI{lGC36Lmn6V)5w#!& z>It%C!^h497K`H4m>>P2!1MIKXMtD;E+=P*eTMgfZCxB{Z~cyhy7xpVWrLvtsxC2L^vE!NaDMdE(lAA*RDHKWE%j6mzNAUD?O;>Jgb z@~Z>R(9nCgPbYgd$ci0cF?=XnxV`GONDE(vk^NY;o-a2)%mse>HSwJB_YWE)f2?2| zh)`6a|KF6Jfy{It^(-h)`)_R%^}NvO>Zwhv{|`NWmu$+!~$jtekt{+WcL?8!t`G`w1i`f zrLc@3yP9bFe1Js&dr+m5fUf;D0AW$*OTJH%#UV++xVtfM>WXJCW;?&98@-OCu zdx^hk1{ZcIP2nz4NzMA-I7iibu%U{=UyYG16<9`0%D9W0F=Xknew zr}wF;=BVVI$cK7T28I!u@uQ=M6UqIkBHt1eTXV%wz{4pR%^6n)j72ryusV{=AsQ*; zD5!$dx3!WUHbi#P6aYWufw2c_FBf?to;UAAA+_YeQ&lSz#gCOpnAf9CBs^VyXB(r& z2QLHKfP$dcbdgnup~U3(|D-H(UXGv;oKGT3w86#A7ZvE=TxM9lW8XVWA|N%sXO5%&{cT zGy@akkcMzq_xqsLC?qkCJ@aVL9R=}e;hgTq3PR?~m?q`gAhW|9x;n+Ufz6~ykt9Pt z0Hwe{eCW;+b@Fu2vs>D*GteE6c?)N6|d zAsoqTEOy>CDDqo^F~n)TJcqDZ>dx7rIpi4ZjeluU(P_toux0Mq`F%jEBZ8V2k)MuH zHA9y&>^U*##-u>v}{Dlc?^R4S}M6Rw#s#dZhD)WRZp% zm1C4!Oi`V-t4pe>Py^Pf^;d(2Tn>ZC1OrP({UzsYR4tcIdB24pR155~Y{&H5% z!%p-}nt!yTLzOc^EP)R{(Mjl^|w?7}6|+w9UaDPlwC$gq+X;jyG-F^{Zhz2-0PIe$39F^e&v z(&f~ZG|lp_$3*PWh#igugQ^|ODv12FABpC`CQ61* z%2{YGLMzD^zx8fTk=-Bhgcb@EZ)q_@iYbtBn>eteY_f3cTvD||Jtq(2$9Qohf*d@; zWS`tpW*3(32C|>0U81d4jOrE$(H?&gd&d|&6qp?7*1E&6p&~oFND(JdJHkQSC5KRu zbGS%*^e&jd3|maimli5Bh!qgleSpih7okss=~CdR@8iD0l+Sil_+mQWg^iqqFOp$| zh$0!HE+DIGWMa<6>BRMM&W;s~PsE{fuTb5i=|3HR=y0NO0hP+jB^$=RFC%DbqH> z%>x7zat9xK)nE}D3+a7NCZ|;%AVzV2YH-DWYchwjXl!Gfq!gh_`Z!tB3_OE2XSUnseNRp1xo zX(?OmI3m>YlcP2a4Cx~G2SW^ah$Fr`q7!v)ps_%Mi}SE1jMAk2f#A)1ikIB>(H zx3nwES}`+7N$FcWc>({mox9bot*vi8IZ1zErD?)w`n{L_sGKj|zIeWE=Bwni7|l#= zqxU;S#g)G$eS2A0_oAzOc)R%m;bEwr;-wTB`pVW{s0Oizv21$w1vaF zM5xf|y_l@*@dGysQ8Y+x_A3{rOq?9H)+{E)q?5L*yWzD%Cm_>||3d%Yo zGvJ63J_i$e=yAY~@lcSIK;(%5hXcnK-u69}UZP1eo=Slc4MDk^Fc>oEC#3u|CtGPV zm@@Kju%2XIU77h9_^zpBpv~fbRndqGkD&KM-3vQ6pUAYa?%xe$TQzaXuyvSV9C+an z8gcQ!f}@uzSL~>|vd=nFMY9?S;+UU>SIARh8Ng3Cdtq=TBBVql1ZDJ{5!_rD-T1|h zi3RpG@AOc*H6@jWnBm6;i}pdRRpZ5f?}50j7xPxJj0sPpOAvHf-8INR9k4SxM`Gq_`) zr^5y0&V^ADC}NV0F}0mnX0lF2)wePMDuW1XXWd0D}e2)E7_}O!P>2ldf z6|g)xAVrG5L+6?2ZFF<<{kAEFvb(iHh9di7hE*Ipt~}0cud*+6*H&K6TkkqOI2f*{ zpC#~DaK(YQiRmkFqFHl-Y(li7?{SYF!}Q#r{mX`&%xg}q5=W2yRmpofZP=C8CGmiri zn%yQDaSvH_Y=SKtS9}K1xg;Hu{vC7oSDyC%n>%6IbH88Dq|>dO*BUppsA|3F*#L#9 zo{`LI1*sL-ISn6R`sOOeQ7O<}sk* zQW)eN{F({7Y|0+t>Fd@sc(X~LyUUi&A9bzyeez*P_B&n8WO2vpbe(8uJ;pPJGbPP6 z4%i9eM=q(dNKS88XyLaeFX|XhVzO*)WhM5WhSZSFev#=zH=}khcHZi)eck}9&0&fx z^~b?yv>zSR@}DDZVMf1Q8!3UItCCLiBUE$Fi1IJPdd#1`1>`#-?ms&9;h{~;ea1dp zzUdKtTNUkidSV}xkkg`i75?pO^ta=FBXJ&dNv==&>*G#-WcXjgv-e#*5#NJF?}%)) zWWL>SO`qN`Tx|I+n#feTz6k$jz6RmNsd>#`ijJWYrA$C!u z?s%of0=^&nNxmT+nLh0cHVWWJ0$e%6-341-!l3Y{Vm^Wy>-=8=dcSPlqV~^Z`xl*o zt&K`>)zbxQiXXqAQ9(NqM%@T$JBzT#+aR9dMmdIWS%!sz#9cF_R<4T-oR(TP%I|tP zHas6^wD?8%!!HI_k$}DF21cn@#X$%h68bxWeF&|1v(19w;5jHWYFruh9jouhJKH7f zShAhT@Wh@B!Np!|+XJyT*}QCv2Z#}&B~lVQsa*h(7Co3V@p0#-q#t!;3h^tRkAa3} ze$?9>mHHiPrOqB@h38GI;p808U4gg4lwk%y$1o3`$|^U?Evn|h&5{>}ONw0Oh%uvE zjX`O$VjvXE)F@FY{4DNVEROY<7Dbx!d{BJw_05jY;S=WAlwfYo##t$$f1I~={_$6a zSEcF&DDa>0zi=i)#-SL-SY_Fo@6?);hbA^n4A9}EaJPW2o6jV*%qdTOD zeQ}m|C?mE2Pp&`bIu7C=n^j<2#R^xu8CzhlmSe$jrvIu5*^&jxbW zU+x1gUe7@Qwsq}`=B~n8dGk*B#HuEN8fMr_psi}u?DhE2lH#h(@yf?->&(2v+Ntk% zxV03M^U@I!*OCrxs(gBUnwLu~2}@f-%X=EIt)kml#gx7}?t451j@xu*E(xa!AfBy_ zn2_syygEB|cXzMAL~AL%@2oxEX;I`{+lc+O(h#F*;ce;hGB z&4sk1k+YXm<3Luydy&^F-UMs^PI`H3BCWwWtb%K0S=({s9ssIAShtxd(q=(!-V>r_~=qh_&&E+CEKYD`S;22774poZ_4=AEeGGYfxFr-{MRQHp$6C8e9_9aR)xfHHsKyHan&|BR~3 z`Fc*$g@)N>UJ|mWA;A-^cGU-h9)V~J#-d!7-Zy<;$vv6fF0GCc^lyMuyOpC5RfH7) zSkJvdIEQ^p$EB;Q-Q%VEGp+H7G0E$j6D0&5Tz!LO7F)O0`P8`ZX~XQ!`#nK;*7c!m z_oo(Vy{U8hF@Zqy_iV?rPM>NI{QaxFre(!_m2?~&D}zoSll8Y3Uz{ov9W5x&C=S(J zp{&&8T!5+i{5kDHDeZ@$kM&?)ak>M}dWYxsz^!m~r)%dgD4wRuO4CUqS$O!p@HQV_ z(f1I^L6tqc^^X&yBF+z8kE7ZvBKer89v+Q3f}RwjqMc>*$0v^(A9ed(*Dl6(h7PID zf2=A1w0@ia{@Yj%V~ix9%2K3M*Z$=2P&=UN8Eq?*?)^P?|8`jYUQyP-fiXij5TSCi zKBE&*`m6b3++S9vbWcGM$!HDqxKW#YKf>6PcX+jxgXhs6up?pPJe+&eKqS~?-|71Y zdq3bx@Ial0bij%ad#F7%F*`4yjqS8=I3z;Fm@wCQaJInJ^5J1=CcSE%X=rqEa@6{3 zh5grG0T!e49o3-Enx9rUxd7+Z&imXyv~&X#xq_Z|Hc_mY;O)d_OdSu$F&y+8&T`|7GlBpqoYXd#I!Jur1Ja>m@b`Ub!BNil*f-y9tz& zl&0ZBCwe>ZllPvqO+)?oy3Jv=^+EOh;`MleGisD!`RN%TxT}mi((;py3=+JbW@{O> ztN3!xq>XDTj>KgKZl8f{k@E8DPVWX#xvNi+DAnl}vVK!O$nCm21TH3_=;c>s`o!M; z-tHdu-OUX_yc}B$RvZw`=GcV-g% zt~nh$T`>gXyMw{q-J8L|!G(p1KuX)@CO9wdY3=T)s_Ez`>e;a!#7jft>JeaS3g+ZI z&of3FV|nri^W8=6#0SaHlzEj_=L-UP-KS2n4l4|N0b6!_4F+1y=d;7EGa9aq?x+!Q z#3BEcsr61h}|!OmlJy zjY3M@mbEd7?v6tbhVMf!)B_1EoLg_hwG-jY*>`BlWx>s)k+N3d&lAKx#clORV~X zaXVO9f%4~FiM3L|XG6}*;cBF|7m!h~$R3cXv=SO+9f;Jv$Nrr= z6*okW@C)-k+^_!Giu)Qc*q5#UXO;^!^gxBdXkqs4m5z~t&@p|7Ot`@lj1%M^JqTT~ zC+fU4lId!_h+Tmw9bLX7SfB;naeSzHX-PLs+?=DJiaFF>8{+rq2}o7YIfKW73S@jk=L^&p!+Q9Y~ELlaMekh za|a}~n|6dy*cs)a)#-*_-GZPgOca?3lJMGM8U0Zix3oUu)Ss^2yyE zcl$F)kq<}wlyx`PItFD2@U-5#Nq*7YI0^2`N=|hm-i3!|RgB(&E?wTmv^@g4`zv)> z;)^PSQxpdQ<0(-NcJG(P#;n$}1l$Yh6;6%%j?>jtPsKRmwa)k17BIi(6VN14A=YY? zqAuwb>5V#KR}C0B?2w({hq^I#n=NN6eV7u2hf?J9_h)t_;p1g%;+vhhe;O6ke-8K0 z%KIK}MHe2IC*uF7sHpAtVc7Zm_M;-N%a!7ltHWBe$6Mn<{7Q?qC@-(`R-fQLi}CRR z!7X!yn(GrDnVo}@EO=%cYhNYT&Ze9!pP1jp#PMmIs8ltdgdmrRz9ly`lh81SWqg#+ z>8MWdM_UP9b&k+mL2D#KNh`ydWvBm(%cN2e$QW;@z&eD zVC1}@ssV|Pj@atXrv1Ll`oqVtmi{oe6EO^Fpi;thfZ+8+hF4>uZ+07BziCUcuuZbT41<^|!!9zN{?la z$TkBPE_%-C^YiohI&1as-~Eq)c6L9Sn%4G_%PN+qr#02pKdNGy_yb5iBP(luUY>!0 z+j^U4b#3hj+J(cM+Ysgb()7FT9)7HQ9abN|l>wFCNvkHFulhWnzAuXO%K(4GXlaBr6z|l!p-1(_uC|AP%B06bqujT< zXm*+(g9q@fCec7Mqd~eo&K7Uds0~nzO5<4YzwY%r`kyXQMW~w16xh^WMIH6Z#+x7q z+^cLBzS8aGIB@S(*);y{?K|3Bl_x6lON1UJi zZtQ-vx^=Q`FV9cPMj6_Sd%_iyzPIQ9(Q(nXqS;exOzK6 zv^ZVPApAjqXP1yLSNtRCUz*Mv zXvLN#*a$S@+^mdH{By0MUy;?DjymDl=vefZ0?+Ic`K>UW_et($D+u$Q~wxz73j=3}#iFQyO14wj;MfenHVUSQqF!q#8%I7t*!%P%Y}^PE`p_$JKZr-6{mhCA^; zL%$d;)Yf7}8r_eB6Goo0Hwl>Wm3q>fr!&v@mEw-~VhhKzDz~a*s;ElDzRwq9W0b;3 zc<8Ev1FFU?23p$Z_@paW9f5@S#KrYq62*?>WjD%iIzrg7EMdKCK($d{s=+Xlh4XZ$ zmjaUi5PPKXATAHSOdh-=6*ltfbm1?+UQrOdyL$slbM%uZ@k44of0D!kxrF*9)hLObs(972BN7UUvD@ zSqYKjV$nM~&QDeaQ9-c#^XVYp&MHzOZ5Nu44>1ghVgt98f2xdbBP8{hmi4qe&khiO z>2`;%&CUCrEp93T3QoR&lEAUxfQrgi|C6ptz_LM3=^jqgXEE4EbsvvDA)287(JEqX zxuvBY6efgi>ZraKi=6Jr@&LYok&#ezf1KkSWUs0&{h8aE(TJ}kRSddJoW~lB=lSDS z^oB$j_95!jo$HgfzW342Be?c3XzL!f{m`0!f6_=I(8G;~RKU&B%S~iV`8#+aP{JX7 zdv83&-#7j#jf)`shed3B_MbD9BmnjChsv-PJK>3ew)-{tCo~K~rV$7;t*-|tj+AuK zE;I~Te~jYd;wx@0gXd>oMuw5JcG4Y&%3tLbwtX&Y`qw5dHf~N{2WuT!k1hR9i!*CR z*{S-U)@PMf8KtO3M~&!%uMQ8bH6g;HRs*zwYO^%l)WaOsY}@ib=i;^pw3RAu5cC@v zXv;$-pWoRHcr&l=c)A*G^90?_>jQCe0lRa;tescOqt#njZG*xH)u5-Vv-CfmPa|>Z z#%s5yWJ1QDfK*3|De3Bd3Fizab>^7yP*T+KaV0<~xp>jPO~G8(zH!rSS+N-39|G9< zlv|gEqbg~-kE!s?YV&f<^X>1`S{c-%X){G>I5{oh9h?zWRh8S?+1;={&3@DFqx-Ykqg zwQaqZR`&*Y_ECmKhMPN`!5a> zG!3*RT+OIvs`???4AqnkZ~JiqJts}yyV@jrP)11b7kv$sk#b06!+I!lOl) zd3kx+*iho%C}JWk#$MK1=PZ~I4GC??jjdY%yC&e^!iM1OdUUYsPbR}ASnrPSQT)@jk$X*RD`sx}{qhU>)AVR=jDq4&+$$qCmO6PqAs zV+|Xxh=_==;2c04KO7_qJCb;`noJ&;$6JzPU@m?!J107`{w?f%Vsd|guZM~HFbznn z-7CrE2Ddia&0falvXygRefo^u1>a+N??J8`7rV%GfIiJ->&iWX7h?g63i_08(rB^% z{^IX5TIpIlj*BX{NV6|H%}nJ1#V--Cj=l75|4eD>l*_uIo*1L9Y`H>l`4{4pBU--=8EAbrtDy1e2Veiabrc6(ue2LM$Ksrk`weqVji;pXs$x z)Y>Jg2Fx(K3YW?^pTaAydFx77#C6Q*4}Vv$KVRjQFTwtT=9^AVrf+I*W(zo*-sN2r zaq@Z>TwpcolYb774#7k$tEdJJVE#U%lL-5rTy#rn-KOdY3_km+k^xjjPwBnDz7 zsaKUjCCksGSwQ>2BXs)Nhi~Wl5$_t= z;e4@Uf2W+2@AIls%O%j=BNJ-4AIsE$el5m#D~m&UYXpdg#pCqYdswD68-hvvPRb9K zfo^X2gT5J`of5DqY|n`a2@%5%R{!Yel8+hlet+^)r0NZ+0Zg?1Sb-y2j+}eb;wHx1 z00CMFZ4tQZ!pYO#uzrC^rb^9;V1$m24mub@Gg6YkuL|52#9;T|$^Q#Q?*G<2)1J2W z^B{lt#Vv6C$(}3x&8(QjoU{37@u}>5)54nJu9HG5HM1Ke2biHz(LpD)QgkK8r%C>a z=7gUS0mFIIf3qHTRTJXnNoT*24r)>Ifsa0^qAm$a?Kg8c3T3Fa00Z7S(hV}<^$0Vn}g@p}YUpoLL zCAp7}PrITxzShB}2peI<-UU?1-jpxR@Yuj^7@u>7KYQbjmkilpS%hh2f&x!&01?F( zCdr{O56q5WnA*Ep?HgRNMP(mPh+9nmTFR1wh(lBOT$SCMWUd<(vK0|*`bG(lR&h;p zVn)Ip3&UP}X;kp_jV9Zw6#opAn`150bhUH>I={Fg*?c+M#Bqb3`mObD5iF9d1IGfA z12Hqb&O+Ivj)NMF9{7MJS}qLkDG}1gI=#YY^t1nO~3cBoKw z$Q3j<j5Y>KEUHYndeay0i|afBDD&OJ-4%05 zK6qy-{NB70IFu|nBC+|9dfDOTZX*+iN`^oUF9h6(lBmZo(uv|Sh4P13K@3Wkd5nN+ zBM)Xp>;IjESPy8F;Y&R?U3=e35bZ@CvKk7_lc5PRWhB1;EF?kmB|Er;J*j_0QiP#B zucpVD#-<-dGT|LIiDa`MmAZ{0KGiEjSe8kK5C$m*AwYGPQQI5f%QzQ7X7isMdhOFF zd{-p+aL|@2S9*#v`Uy$m)8@`b7yK|LvLJ21E*{?vq&-|WB!4+S?l_wWi~%S1C@ayR zP4Joo2|3b7yTcfS;hIl+dJyWc-c@vI^yAIiInhl)DHFsBKbe`V%^VS);xyzT5Sv-0 zvY7sz)CVuNnrFDKKx7hT?ZMbxhvL?Eg{qm`ma0+F~Nww zEm&KzROpE?-!&31$XS8Z6dsn2luB?7+B#q)&W=4{QXtb**VED=@kF!kMZ_k)7{mT# ztA-MnKw2eatv~Zq&Jxi~o-%m^Y5dzm2uBgMx8x6c)22lFA|+SWtsuKTe6?7{^ig{* z$klN5Qfe^$ZA81%_ecb6LjQiKK3<=o5i^imHRPwEPtFzf-G6MPclA!URHKrFaAH;W z2ykjzqg8~PuL2>Zg3uLn@F>GohAo1N#^|O5EPB2~1w`uI4*>#7X7gWL458$iaBLM} z^=~%H^t7=V))$BkOU1g-w9?7fNKB~1V}n6`UN#zi0D_Jf6VMN@aghK0wMy!rnSG+w zTY>A4#VKu{r`qf9Y65`cTo2y-&)t48elROxj*SjC=oN;?sNsIgzfS=uh>J4$!`q!u zzLzCJ%Gbqu`T0wkG@@AiIWlv};3$F{Gq6m`Wa#+fgkt%L!%Aw^WIZ;pmPR~D=bFL0 zo+)IHgb4nUM2--D;E1A}I85N|Q}Jgh7ffR%d+g5-FV@}dRR2);;cv8rd%yUjKUfG_ z5@KO?HL0R0V*6v0UldR1E;H0w56Za4o_Af5|MEWT;$nxYlKjLhUey;fq#!)5xs}l% zrJc}6CzrxE0DqqvR3rl%BNde-%v%hhyYYjbKp9xj(U7c z1pa{{ag9&zZHn(_vw9?eoZ2u?o6NOCX?+gLQ4$y z{r}jX;!r>VfWNK_qzFtT-Xqlt$8(F?B74WQ|BQwCy#J-r#(tTUL52)N17$rpv4&ET zJzPAS>Cs>l!@^&W>>N@Cl|U+6U}1WoJY*|PsQ>dr30H{4=c0eN?l8!*QoIU^J$a8l zh7sTtXh|kfCsYaJuSg)~UE#wQx-LkDX1<`5v%`aQ(vVC(Mv-ez>!y6oFfbcue_-lG z2?5UQvp4{ugkDY3=oalyLITvdOL5)Lt`PI}lu>2QvhyPdt~gAasXtPcOtP#3K5$x( zSWMfJSA1>|#?Dzt;@Z*1Cd7`SdPCyNB*6_wIg&E6p0b7IXC1weevA2pATv8;IV6N6 zKP*puH7yKl!O6{wSWi}40;eP+;8SSh&ZOiN{Z}ha#gIXQ79_zgo zXU#{O9#wHm8@VX4;Ji;YY`=Mhr;|`a-RDOgzRLL3RX+g&mCHKV+4YXI#`#of5V_4&@M&VRD_)VU*avj`6Q|`C`miZN;C2hkHUDT# zLt<5M=Kf9)A14jO;;!S?5U_~z@&Ayays}Lws(=5*W~85u!%ZM=W>4~r-lth6{&h9< z(6`K4$fasAsUk|@Xk`3futz9T2}n}R2UVba4*G&+`DyM6iZZ<#4CqQ9IQ=HAP8pOw ziRPv=xxbY`?>5KeHnUoHGC;C75HV9^wqS}Z`aJR}$c)6&zNsYL5-!7YBKL-zk#pFL zQIw&P7c9b?0&R#1{b?UL1U!iK-VTLMNd8S#{2|*5m)}3mcSW4i4ce_oq)O`Gq!{U0 zbAy1jJM!!b;Q(;tHQ|qDhFWN3*B8DI4$9^~m`zAH{wA7}Dc>brWAf~O`4Vzn+|4(O zA5pWAG~>_nX~J*dXQ%t$inM}DAa|X-hBdUUz;bg6DoF1E<@jPRjK`%zFid~|Gb1-n zG0}b39f4{*{ENw|Y73h#ZHp}%vz$7lD&8!PS(bjkE?3?Wil-P8?<4am7#)oz+zJHY zXh%W{A!AH!fE#y^Ebc6ve}shP_AX_!dRNGVk)MrUOP^=wMB8Dc+rAHK9w&5Eg|{?)dvbGE*0#w1^Ah+6v^sf;Z#Z~Jy{>={ z$zxZ~Hj{Je{ybnOTnJBtVu4=$KRPWf~pr@K2^s2`-k!v z@brt}Xj2RAq5bkj>&&NL=NZBGBI0;x3e#v$pOOpN*aQCO{ICaWCMtq*t5py)q`2E2ECHRyEzjMC>=*qm;TKLME?oBzZk$hzAH%v zu%o$cZ{QUfLo=iPPT2qcG#)sU8G!%KK5@ITk$c4YedLtW;8eMemivEJ5T^dtAGpbI zYaB~JH4U8Z^FM2l#KkbJGj>aYH<0DE9sVjp+iBYBz# z>-NHMZN1<1I0CXC*~?jbb@Tt(W=P@;f08a#as2&nz5O`;hV*}r09`v0+{`xHLJ++Q z$=}6cfC~oS+~35jY7t!4+k6tj7r;BxJQw&Tc)q2z-+!jmCB1cZQ%8ao*CB;17~Xr0=%b6ADV2 z$VCW8On0$OzE&hb0%4GygVgz>>SlPY<8*-j@uB8bG5&7EP2iC;kCEY zVI&?7z{nY+43x~EsN?sJkvCtB4jn43LNW^LhXKmQ@MUj@7J3&45Y?1%y!+ZiM&A(NL=npgDl12*o!nR}Mm89IX;2F`ww?Mi!n# zpJa*k??)QY#M4T>27fnNjx4f_FCY&Bp>tN#lFI%d8gwyS{2dFN83_7=&tS*`FzNw> zGylX0LJuPg6MD2X@QOzOrKM}q!C$JDW`}-IGtrX=aFP3OfpX?}QM&OJb!vvnNecn0 z#$0^#oplf?M;(ZtZbj!BKNiXFh=91GTp%DCrkDg!Im*Giw+th|Tnj@5BS)dZe_6G~ z1yYd1!sDZ~@#BVDe%=Btdj1>Jt!Iod9KbvUCqY_a7b~Xiv3?noS}qi%n!^;CZv-X~ zPW}YGW00T3W#o)28b~~%%T~L~oekjSdXtDAM#K0)8h#O;d1JsS0~FAYAY$GP=2>1Q z_`sP#lm;oxIoT(P`W1@xc_YTi&h;Z@qhxP?5+_Pl&nYkR1Ci=l`+!kFGkEQ2263Ry5*k2vNv1t=H$G?xGl;FnBMghKafShq&ycqzN2EUvRRRB1 z4I_(7x8y^CBA4w326`eGQ2EOuFn)E6>d&K>L*okigMeU_qou&#po!9!BwF4L=@Db!kQYag2H<4WBR|i6%8sILb3ql76jwinwttR1Y zK@4n(u|tqE`%IJ`%2aIt?be%-)I>Yk(<8ts>WZw+OK2Z9F6<+b;P%>7Xnwck^ znjP-cw<8(6CnEt}Qqdnu`=Q6kcXxd}g|5<0*QLOnk0$mgPyY4>hR&YeDn7c=sEGb@ zr;c<)(`JkNq^0`hufNRe`=Nj>{N$~=5qg$3(^NN=lN62Uk=G33j?5xJRqYy>ihqO* z0aV4R{01XNN(jOvc=aHraItSF42(*M;mnMwcEvSj1T^3t(=J7;5P!-MRox#axSncmjMez81zk0z2kF4WHEifF72>424+209G8;9f=;%O$C z32#NpO0V0KS+|)~<`$!=sHo7K<|dEh$3>!Y$)m--^%KcgK7lhP7g?436fx+M(~-k? zp;1lf@r`JJIyedi1znp?b0T@T8W59@sKs8ocTA^2dOuxmWN&IoA(4;ct%SjBf> z)SW0@Kd>21UDJUKZh`1`KSrr~}0S-dxHe8**u0v6A6o(3IVAShv&mAHJ4G;@D z2gGr9E9pVdSp>?XY&tiP8Atu9Iu+k#U>IaDE9pHUtkZ=*)2kHvKl2RPM4}818Nshw zAvRfYYlK7MoJIxyd3evS5MdQYfgYL_e$+|@Rk>njjVLGk>88_HoMhqyh44+_8|-n5 zC96H!hh}(r99K2#Ha_WPeOL&$xRxKjY1|56#S1jvGz?dT$R8?EFd==;Icg70i-!IbTYRY}69CR5>wGQadH5(%kq3zqRDi zqhn)l)z#HiRpDtwaLl`!K!}0@$@kXzj+p3ZdgAo+bBA#{*uw)Hd@nCA52v?xre|cJ z96O5wfxuu~a>$Rgw178vNJvQY*9_<|`dDLD6hY){a;nhZ2so~F;^N|Xl+@HoFh6<2 zaR81p!+~o{4k3BGoTUcr?2I>Ud~Pn3Lpk(QajdcCFI{&wA{M7&5CE}6!^sL$m=#lS zF!&WD1a(~{QkJHq3SSl_TLXqHs8t}bM#m!ZCZ)3Y+j$@encMsskS zFh{#4;?J%6rt6%nKX`nzN2`avics%Z<)Ow@%E+!9k@-efY7ik=y zT0C`hXYTv?iMjVDGaS#08Y&N4j^tiC@o#?~I7i<-TI%ml`OOzP3Wxtw)BdChq>1ed zeE4{P>`TSoB`0r!TiA9_HXIYJsdr(KVax)$d>ND$9yloTpQCoabC@q zC@%3vfG@&mWK8V4*AUs*=4ddi>u=ineOgZQ!t?&Gn@n^ayIv9S?a<%VsdipTF^N}# z0z%>vqI?2EVxn($oQI=uZs4bbj6u@z1I4N5fA@33tJmWP{-y>OS5H*u`1G&&G>Z?x z5zz_SG3ViIQ8jSU8_KQM+qZMwtxk^4JtE@4X*jsJ@|#AqTb~N)dHKSngu~-wNpjkn zOyN>C=eb^HlBLm;cGuI3jZU;g_1Kt+W4Lug-Y_umY0q~WR3_WY()WovVb3+x0(Du8 zZ{H8KZ}`#dr8D=lk6E_e*A)SN34ud{&L@|#k%mSg_a}d!s-2xa7M2jy2VJH&!oqLF z1SI(dqh5*rWI>G|IzB$3l;=)!+Z*Of!*BBzjGSQjKE)@(_bTKuVJb!>?MF(pib^D8 z?QXvRXqd<-NDNcrqad6tJwpc+e|4~ zjD8o3aVeNX9x5irE4b%88XFrU!rb?%HNGOiKX+YS zWV$E_Op}fLz1bw4tkMJrOEWXuX)K;Xd}1Q6#3jUs7@bDN1$o~DI-Jc(0|7O_i@Px8vHvl*U^JgZIdx_Y%K zo$LWl{uD7G41B?;!-#5Hf+TgSGR6g|d&tvxN=*vc4lM|1fIU1zv~fASZ1YZSO2l!- zLRARl_i-n2Bfv|LMD^G5RB#q>Pe3 zCWoatZ5)D;+nx9>umZ0gA`f-unZ+@7@YQ_HTY%G~yc!^HQdiy5Lb(lpai&SD@^gt| z9VxqjC9sQ*KR~?#SBstpsiwA;FjzSwM{NNu21^nGCRt+B!PN(+MX^rjhH5(X%Mhq0 za$ie{$43O@OXxXe6T&n};CWTNdQBaQ0Y-|soRC0u2ml-B0Ns5YPo5+(pjC_ZAc!1T z_S~~ohJ*>b>oI%5i(1s8TN2|J5GFjx(1h(WEDQMa#jcFk^46BQMSDI_<(#Byycj2H zeeU+2@|RM8jPD<2I7W}T1LYxj-CG~7v(in{GW8kI+v-2}pUzbYi|&xJe0r}Pvpu17 zJDlzd85UW;iV`(u6j&kG$5XM?(Y`VuB4H`nJ5MpMpHH61)WcekM7Tf^Yu-0N0ee#Nos-NS zAPg`n6Z2;TLNy#@#5mb)*yYYbG;6xBKvMjYhup&0Jdp%H;GMI^JiQbHs;a5)8y4nvo{-vJGd ze0^LAvb}K-XcYYl8RG@os)K~>Z?u=lN;gS~-xSTg4Haey7b!d0!*q_h~XS}R9(YA<{ti+63 zs3JTV!@79wz>i>vyNV@)*)7g@!Hlug!mr7IrV> zul))`r&CD&fTXYOhjhl*(VkS23&ETrusq?tsNO3u9-DchpG40IOChYj-|b~%F`}DJMvmY$2nowQkbXV~xgu;ML>fJs zVM^AolQ^tbC`xxpW5Ul79$4NPaQ`U96w(s4DDTZ+n5`TVK@^1H7stMip{T{`$GmA7 zEvCd3P0vR(%SRSKwwIFZL08x!gKqqU7n{4_V@Zt7Dt8rUIjJh;*(EzYeYqtFPPpgy4a<|2sp*ZrR*I&!zTxVU^ZM}LURa_3dU)AmE>QR5 zz6iNU!Hh)vkE=Lo#HW(YLUZe(#Kc}@0jWGlF{*G_E(^lGmN5zm&=5qbX5f^z8PTdp zj1BlIo-3#WjWVgB@gG+t01t13sk5QX$mp*Prs`?QmD}4VIXcL(!y$)=@cm3p-b)T4 zKVSi;HoVjlpKn}`#2m33fm4YMEv|$?nTaom&Dqi0KFJ!5%c~AYbG#{nw7xL{P6KwaH$U(v-`*N3~BLAOEYoG9?L=)|IGphS1N*ek-ljC6!o!<;N(8Y5QKz zq=JD?aQegiP#aPwawicVUX#$8$~Jw7&Y5PBrIb!0U`=ru^c@m+Af<&N2mRAWY>kg1 z%LPyZ6f>Y3X?=`QY$jW5!l2dPB8W+3Ql$sPlhy--n`$BaXz@}~S`{;w(u&JP>R6mg zbsk0L#Nh@Lnoc1ws{i>Y?Sc{N2B&Z8w)M zI~~v60$KOIkG-EIZiZhT|Ga&yH1*oKec2Z1c!7ucKE*zt`rci>oWwqF_eow}zTDjU zt`qtKc3v)1S6}}4US>Vd?Y5s_+Eh2ilo-VXrfdsWsgiZe{~vjbS3c6=Uu3E4Ja~OM zORUo&7~Yn&B*)q0i_TR1nL#sQkR~&a!-KL1KoZ^SyXVUJaNXTa&^PF>mO~I}5u9%o z9PMvlg-Rj<2$qgCj+cdpQs+mY6CyM#b9Y7r0HElY259t*`m);*ayZDKE(M|>SvDCh z2Y5#=CmWN8E|08o&wpkIR}XFJ}SVhe~Ek69}?nRWLS zGJqGq9tzEavg;386e_c6V4_XMsqG1iGq8i%D-zYdT}9E4y34Y&78 z1KgTfg+Fy~UVgVvbM2nA+rN1bYl(^R)IiwE1~SGcd_t9pKI{rIS*WezDEHPr*}8O( z`92Aw!Qx@_>OrKl`xu^!Tb&~nltyogmtAR*eVj-Y$xyWz!>p*&$3KeQD-xZEPfI>A zkm8+>OHP;eonL5a^M#_YG@? z?|>bnS-8YR8dG+Y?KZ6;gJZ$5;qiXc%|tl<<=}p);=CEn`yA0zNEFv>Rmrx{Q%b12 zyocCR-HMqQHwhw1P=I#AbinW{kCllgFRhjpsUb3lDKQ#?R8KC7vBA+)hx? z{zY!OnUOhtrap=EH-xBGO;8{xlV~?uNGZQkD)0zSTF3DB%Ot! z5zJAuNmG7Kjb=XyE}8ZRHCxbPlpeyD3MR5xwrU8nzU9?}PKW95xa=Q4t+#r$czv(U zkOSZKl`{>+3cI{6-Kfd`s@IZF(XB*M1pz~hQ5dk=jkyr6Xkx^}Ft~~pKg1_71i{lz z{fX$Ca(f;RxBmcrh--(jWvj6y#kKe|X#BW8)w(qI)n2LUAAyYPS}5P(CvU z==hU(un(){w13r=!C$GhK@1ukc+#YSUm0Y72$s( zoBjOWRDCa%EA!=S<7st4;;MK#p`+R2Xs!X*_hLJIbw%Q4|Jb4<@GvHR)!Y58( z&QRXkOK-#a>f+?N!XgJv)FFMDu;y}ew)dr2hO1CpcE{ly~> z=>neoi5pR=QN#rl3rXt8@dk0_&w*$SQS;1`&-g80GW9gSuv>k^2htU_6tQtRqR z(K*S%$%2L}!VXNj6>CVd7+k6dxwFJxP!%J#uEgyG*@PZWgmDHscP1rEC_;=S0vBTL zAVZKhw7PRp&x}v5cASJzpH=D_9Qmr*=z@ga5Sd_GHh>plydMWqf4oKvKbV0I z7QS(w-RH2Tb8Ub&5@BslBJb|S{jq%S6*Si$>|VfW99(6MW{~Fa5n|$7fQ%T>3MCPMj`sE(E8hc59F%!SMnB;G)7$F6yM5 zs{JMXV-oo4W31iK-pfOy9k#pGTN!dWs+mqyV4GCz*TY+}&#s^AY}r!0=zX7?Dc>i_ z=s4xId|>C7!oasc+(H<$7wf$Z#iGbhW=1UMlCdE_cXhL1UZ_&+VoQQlo<5O;|yTlwHGmz!u+lx zl#QXa@5q1EcRe&ixY{wA{9m$wiaKd)G)PX||i+cTr1F1HWnlQ71+;lOe)Z5b4dWG^8 zbteC&tVso+6jW%R@1Y|a{az~lh+Nz==T`0E2g{?{rV6#TO5hZYX^IzCZV!bBojnS6 z;hrVaoBrm3X&r0fWzUOQ5Co0O8kTWVKyBsS5@C$?V&7Whpo;m&#gP`|&MGTn#;Phh zgq~jp-_-h-+-`{h`q1#QcP={<8l3F33B*-$|1cP^3cjKfOe98L;_o-l0OQh;x?qn` zTL&kiX^^W%s{4gt1V(K7B$vW#9pm&x05T`tFL@-i^}KF6kS>f0z@_ici_#y%k&-Mu zfFeB|;paje=J#)c(!#a}gQ0R^s6lb1(}Z9LEkTH7BBvg{7CC-ZPg!Zd!JqYrC^`Ud z0(vCR1xXMtvl)87E;1OCUKh$bP>#xx%~=G>Wx$Ow=JMmwkB{d7@C~pM$_^SOkQOJm z$_At2)mK1OV9L`Ng!-0BqmTl`fdyGIDB`%Dym5Rm3ktqgGQ6BOW)iDdiv)nAD)Esz zmD-sV5C$Sk3xfWJykf1U^MaqGfNP{xI8&{d$}J{6hLxJ)$~#2~f+xU{W+Mb1Un3tR z?TTUL85UVfukKoSVtuT4JME4sVAD72tAF{_PXaUYvKCfe_Lq@5YCZQF-L8B+`o@2n zez`ju(oLFz@zahJzR$7qzMaW>ntM6k&AMM2^Leb5dPz$js)&e9?=&&Hp!Z|y_=?T&$9M64EFLNO*# z7p0ywPO`Dmiy$%Vq!t-cysL>AZr-Nf8948(C~5qrn#tBt|KzdI<~`6Ut<}rEU_W9p z=!phAlWUuKcXtNVg;13+0j-v-@TMh7%8fNFo*e&7tIV~y?TWeWh&5W`9JiV*N}MD; zU^7jp=En-=K0`EFr7{8?2-Zxb7vt51x}Hs=%~W&H5>;rCD==dPxJU}}*vNEjIkE$s zzvnbK(LbxJKgdj+`FR_*j2fnsT-@ zo%&zMqeW{@-_0)W7vD`O$?PFeYmDVz2CC7l&{R=Tir%%px`Lm0I_Z@A+*9RSD-9G3f}JI3@{i_moTnIy z?WHAsomv+fVV^p~etgrZP&ntp9#{asQ4W^_VU`X2P{pjK$u$>;Cdg_LQIsiwL0NdY zc)S~jW~}eA8Eu8Iv$}ik!D6 zRI+sX-J|EGt3pcVw|90&6fYyx@F$)RR-7Tz(O7@~*7dud>H&gL_?4ml-MiK0%i5O% zU#}y=te1Ws-}v9(eNOZ{9{)YUS@$zzFT<5y=>91k7x%GV8%}7FFT8iicXzL+{W~nfO7OUqN8W3p%GtZO<0_t3T;~x$ZO7UO$YIx|vf-*-*`T z%-bBI4FFY(bDG{j2zvl(3uGZTw?PF(nKSE)P>CikJ6DC9eo2~ss*A~x-YI11PA{33Nr>rBWjpoxo|WSUQliuWHA#NTYzKpBFHA^fZ&( zhCI)7te~gw@Nt4}kdJ5O!3p?@2(gIkn#X%clp!{BEi*tqyAVnnge)}$X6h60z6^r_ zkRnbnjlTS&ql(V+k308ThQ{ZRVbSR2wKjDA%&feNes9syZgZB<0`#%j?f>Z-vlekS z@SdR8$A+a_IJ6pGLSOXpeAiWlt|CyRV-D87T=kAU`TD%T3*t!yNvU;@?~XKCNvnR;D)_jwU8g`E&2^OT@I;AjYq>zP%VGhWv5Nns+Sx}V_u zM}n8f3BlGjX#c-~f3b@LaU9PwmjqJ~hDPx%E`gGnm^;-cc$H+|fl@DK9+SkMeU z3x<5Gzd@SU%no_71s1K}BB05PA`6FD8si?op4R(S=F(n&#PJQ~OEy_Vc~$L)7G}2F0H(tm1`$?l+!JigBcy z)_?j74{gORJ~!-+*^Z_!`Q$Zwcas+U9qFdZ=kGt6yB6 zR|;B!KQ*l=o71~tru14Roz7V7gJb;GT3BfjJ7gV9@-c_`{nw}CM;feduHcw*k%UzV zj|VMH>bt8Z;CJwbgQKA0>s&D*n*1x-z}#GC?wCiQ4r7Vr^d%%p0qK`dwwb-t?A~Z@ z>WCFJuy%2;m{5=1DJcJ&pTF77?@l)3!U_7iAAiOp_T}DVwm60~l8m1Ao8F!51F`e2 zT(QvJs4vE1X~tMf=9~h8Ea}&#KvqX+_^}^)J}jYnXQmFs2fMQf-a22qHQb(6&Nj9D z`sMKu@<@MyJV8pn!N)`qb;y1lTzm{yXbo0c4TX{pjHni_>Kka6-hO7XZKdol`_o@G z_>y4O_O}!Nhn~~?{gU3xsrbve*FypFSBQb}0l z%bI|x&nV?5N|ZA(8x36x@f;Lnq!{at_&%y@bQi4KfATs4vfqDog(z3in#iZ+u0JWBA0zl}9zR>=(B@tJL2GKQE}ux7?A?&(;vvU zq3hn`dy9AcK+~avc1a=wGRPqA>nJG7aCzkE-ORFf-Z z+=eA-PHWNiQ?%U}*{XLrSE+|+So!x5ll(d4$&QWqB;5Lb{D?yt71&Lw(Beg3Bk|am z=D$CdkIvWCd-fhEl&LoM#0eC}uYwqJX@7}F1d5Lq6v2}=3gvwG8Pvm#y(OCcgK*G( zz8XFqC0j|_olg?K4zwu9`wCOXK%B{9$5~#ABO8FPHSTN$A3eK>T988AOeN-#f(6{zLzBn72qLB)h^;mU#Dk8SN>zrs*8l!# z;L{%}`f1TEaH<_ZA+F@VjCCKLPXU3XThAX)-tJs~8K7A-7VcnkgPq2%v}sHS5$NCJ z%!~QqMKiVL+{HN++jLKfH_r<+^NJ{#5D*Q$8X;rX7`qPt(H?kyEO)gt)F!fw6gf%% zXy=6b+OPx^WeKkDB7M4(ae(9ddj{Oj97oq;5Mc*>x9YlrQOz&z-azS~--6z<@>^`y zuX+$~Nvk2u);Y3*!h8z}si|7J+79cJe`+RyGHr~WCV$=bH|pEFDq4sO=J=JLDBL)g zUwcfW80~*u;5B!?7KK^Gr@v11F0=i%m!O7VEgr1*_U7@Z!|0sa>nN4yshh`F37&+dK%*4* zlfdWZ`}19F`(x|tp4C1$(y2dW_UbELS;-YDiW(TcLYbJwP?l|w<^3m^q6gjM^z#Y| zHD)frp6iqpYM~iE#gV^iPOnLJr+-wM;BY%e7~A>)xVq5{%X?U z!*sm0UJIuYz}?zIgWQTrL!#bn+eSvC!>ue)P6&?j`)5joF|H$DhVbpX!V&too{QbA^&36qxVsHFuBFiXkd6;8MzMSrKsB+G#;q>*@ z!USoh^Oup#r;|TBwCSuR#~C>U_EUS_9(5R(l2)3TA&ii}8kSQ@$=@-l-q|y^PUwjg z!z?T{3g|x=F_C_kdwCrrrHM#o!KEO#r_o1T(4c8zG@sKtg};(86Posg!(cvf(z_xX zX-0eFSMG$If($4YgUyTK^ZO-+VBh#>OITT%zj5O(&6=ZDpIwC4v zMpGq0^$Os6UgqPeH(5-ZO)6+ZF2sYb@{E3H)mpRZbg7oViJ7~`BcDY|V7 ztEsgta)NvsZN9o0onEFU{J_}B>{u~cInBk!TZTN}NM!l5xdpTvX^0oLrv0rK`s`?P zGJG=JMOlwi8K5q(i|IypLdI$-)#&Vb#ieiUMl$?$AS?Ld$dy!m?TWy2`uk_jSkZ%b zXFCkA=iKUDyXd2S({Cq6eFFinzHB~H2w~OBaSNuRBB8cc$lNUi#%GYryt~K{UYB%h zuURE8^u_1sO$joRE8xM;mWb;x;)4fS_fm^!7v1k%ty8l_3-6W+6HIB-O%Lpm2b+{D z|J5AG_3tm#@nBnP7@i;sOT@`FqN}s?^-EE4aj~cmY-vD%^z!mFnP|D~+sW2nCl)c(pI(oz5)`9+ zyomCuYHB<_IKtp`ujS?Cq@<)KJ$?P#n;Sh{-RS7(^@H#Yu}& z4gkO8aRR#WWU%GrgEYm9lXT>bLMu9ngBgfnn(0&f$o`%V4>z`Z$k^)*vpdN<^2YDp z6-&U`pj_q0F4xg*;(;@|*BQsu*E71})ER2n(b+jpa3)So4We?Ko3nFMeOp1{FNAJg zT=pLnhwsvieo&-o5<2TE=zBWZ5Dq56vMu`h`c#ya?cYgR#APGyz0Ust$w_$fk%W%3 z7N=Zs83DtCKQb{op{ia!k% zqcJfJ7d0(1NP*N`)e8&BT!|_ETm9=(kM#pEYfQ=O2Pjy^foNtoEAukWRtM~mKFjLy6yItS)x%Ml8F|QL+-|NzU zT?jbzHtP<$uSYl92j97kJsrMW_nEq{P%;Y)B`0828gQiuV5p|1N28R^)TNL6#KTEh z(2f_IAvZs!l_%(@D8Ha)T!n;Ms znwsj_4`RU|;n}~4hj?h5D+cLR#s~&+Rj|Qd!38*&lq3T7RS_2M3FW8|%dQXr2f1ZL zWTYlCwA24nSy*#(v%w_Z9}k|vkHo_R0|>N~vYesw2xeTvV`JZ8V6q1lfG1+Viu_*a z8|9$U?r!P7Aq+fQ)xZFdE0&y`ToLXao;)|_q)8>|yVrO{A_uX$B<>D!+-TX(TXGrk zq-k=fN&cvH)Wz@*&hJZ`znAg855zdiVyBs&o)yy7otv8#O4QeBaJ$_iB64+hk?1VU ztJryd@?6e%?`F5Ue`L+Y#&!TXEc4KKAN@wR{#KcTA;Pt>DLdyzO4sEcE*Pth9OURf z-KQyHt%RdMIJ`Bq|4Jm9h(%0o?i{5a8~*mamLKdIGQ1wK71F)FJ=OF+S!y|S;1PU1 zV;-7nXlx=%wBlH9`}ssL##YR(;Z#_E{1tCfTC%@uP8Q|CxJ=z5D<}ItEg2g(o2`u% zPlu_do{@yuaZ#yVg&m~0$LD7Z>_AG+Q2(>165sW)xL{dzL6!O0ymw!u6(P^3kyfa{ z&7}WTF3>i~C0bVqVzqp{L2wjALP9b=53C>2eR5(^_JFr^MG)3cX$I9eid$c@b6XmL z7LLx}kUunu@$2yZg26oCPt3u=0jsY@i1`~a$+?A<5cP`UQd>xOTv3;r!b~xJ zEv`f@4XZb;ag#TLslx}!U+WrM(|bG1-!-C!z^WU6zvs5wTXM_$uv0zc`Xz%x6M9E+Ta6WlENzb|YT7PQs-}*iJ<8Ru^Qr~!>+&4Fg$ua%8rPcYc^ucWGKG$8`|J2m# z_jottzH30NGGoa0n7jp!x_t6msi?H=?Cj(m8sbS$N%4HpSx7FO5yND5BN1s>hLlno zwkN&gKTiLVp4qtve)|C)pm=Md;Avx}wt3&(`+fAg-4MlM`r%T#!1=Mo?eqDyz#rX_ zd84V}<7@{BetsQ;l-Mang_pg~+-G@@!_1A;5yQM6U+W~@I3+J#kDqEVqRv{}>~61| zlag1;D;3Jw-z^wT+0A_sHI0_=y05ss|FPVM0Xz{@6Krrq{K;BH@HO0?Y@oeyY)kE4Fxx+ z?X^t;tM|X1a92dL45y^~KnCbnsOmpc@T+*MaI3JY9N|C7hK7d1xY?^cmv?pFq*oDo zR%YC?|LC|zm_@2Tf4rcJ%ZvBw+EOFB%dJqO&`f2a@xc> z*cZesp?Qsg3r}AY5Tna7=3c{4H%R*|^1M%pHt7?9zmWb&m>|l!$ zyqDv)a@Zpb^_dl<&?QE3>i)L(mYIA(tpxAwo;kKaD1}@_b4pAz&4$~ymWrYfQ%=Yh zrP_Gq;y54PVBQuLkUFMl+Ve`@JWZKDr)*H0&vGixT`TU1=#;ucAgc4J))L|Fu4Se7D zHTm($6xVk<^8M;#+Pav*en}`iYxuvEw7ekrX&Nv?=CVeb{!OnNUi6f2_2yNFpb;?F zNSNyE#<^}IDzyA~>q^JYm$so6&iXt!b^+P zRtWq7oP0{qnjjv{vtWyJIZCu<xe5qVFLjDc_O(|I2`A08LZl8A! z!+0zoQ;yu8xeK-!^HE(~WCOuG2blO}=sUW}*l$f(ve>fDGp&nkxOu76i%j89+(|7H=ce&WTFds62&+kXgxZYPzMao@ z+N8G0iC_KknI;s`s7ukaCb-HwuBv`46GMY&5_p5*+#-);_le{d;DLyp4|2|QSAckus(iD6mCycx%Z&bsD@Vv4SGpdb?~yU& z=5kl@6gjN&o=oTpzu$1SCJQw&tu_~%ofQ0_-hSeS0mYWR*{So0YS^i>37%6-gecs( zN$64OhQ2)?=h}o_83mgneLUTcT<%%Khir^o7|YAo8Q05r`j1Zb)9T$NVs@O{bMr3bp>Kg zey#C&7I!D+Gnf%GetXb<5`}|4%p<#IaJ-l1H@7<>Y+X+-$U$?{}P*o-90~kac zK3s-ob_iX3xVf4w%drSX3XJpsOmWMbzLV0hZx5TC!qY;FrnZz-*!NIm;wG9J^^ zFMJNB_#<9RBIt}(MD~kL)iz?v47f*AjozJ+yZfQZ*UWT+|A1SxYFusCf;hj3$hbg6 z5$+6eJrOU#@&g&O1*XbvB_sqT46`tHelkTH9TDQKH4yEJkIL3Op=gKHLJYfukix1! z=q3?K?K ze8PTZ%!CoFh+=z<3u5}-Z{WVouEfAdo+AaH(zu$-Nfn)tpl_O5f8Yo~PxQ4p^vu=F@1Vo%ch1<;&AarSI-`rO)n62Mqq6&+c{Q z%g9Lw>}JUHEQpvaZvqjpU|VSYUwA_;xQ!nbUmlVfwTAaLf1=a{m-2% zt?ZdbRp?xe4K3d+DH6GGHY*!ZUb@`8JAZa}{`BT6jSnW25Vl<85a9M2b;l8oS~cfa zikk=XS|)RwC(^3AYkJ4AZK1j+^^edPnMmrMQ}z~)ZpxV2l;hZz+JCN~1Ii;bsJNqO zgF?b+G=wJ<{dno{j_mPmdCo2A!*Azw4!dx0rDj4ig!xMw*qhRJ5L8Kh|BbTl%-WH( z>VZ4WBh$-qR9b|oCqdCDmY^@HdUmIOOXlF_oQa(|qvAWjhFVr#1ljYUK4=b(vZXx> zJ8pJu$#-rpoPQ~`^L{T5>~xZpn~5SgBaJ{TI@M#!p6s42*%Lbp=eFGFx>e7=Re?Jw zJ2T2b+hSA+w<(Bo@3Ox2YTeeH$!*2tm`H7MxFXzdQ~}D!MbHqyXqgG1=?SIK$*Sz&UnP?(EKd=l9Q)k9z3$`5|LY0jfIk;sA(y zakXM>b4u$gh0ZNG)0@+Wciw1f=PkK z18A>FQ(4y+qvSh4A8y0lOzS(C(>>&-?&ANWqta3xnn{Rb05tXtrQdHYX>;V(k7rc$ znHG_pWbw`F84#ura)kf@+L9DPkSuA*gRm^HL@h#SKnPru`IfLG z$rVfxYp#^R6tD0u~*AToReSS%G2jdI=CCfImVw{De4Mg!%+r1Hs5-NWd^)_Xz_b!4VYP5y2J~T(g2ZD0o7GlLa~h zf-@*M{DLb?9y}Td2tz>{C6V{~A15#P%r`%^;{Lx`_0YlrP2azICND#sUIgR`(MiZ0s5HXwx zXZ;o%J#ouNQQF&fdQK?qoxC%l@um!BCdiIi5H7GC+?sB@Ym1GqJNW*V#s+@Q0wxcG z!CyS_r>j5r?IkPLFIl~Q;i`4#?{_e7JNO_VQcco8uT_}z`h9(e4^{ooPu1(!_WtN$ zVPtT|KRq+$g9Bhh;6OJ%9|n#st2x@bPoQ-N<-M+qVna%Wdt<)psa+?URhZ9^?SS&c7)(P9$|13V_Sj?& zCm-z1D6?f%*fMkbPZ_33?-eUQR&VHCF@BpzgcpisX@$CsGE3rtjwAJ|2_{@T8ZJ?X zi96_Gwu7xTrlcYpkm0t2*j|Zjau%Bi!9(i~g2J08^~gD`!j+V-eZHjMI2;Z!(nx%W zT>58j4rIPu+5dD-Z+ew3qg3{0okB4xKrKh+3>PlIKrYJBakk$I+L zeo9}Q%twEK`OKVfLhi}TlS3O!sqrS{^z;1=X#N!gmXO#49=2J-&z8uuYg|bs)~q5; zZkr1{1hDB2D;_}Tz&{Hl6(d5%kxp8tPyxMHn%^}rN^h^|F(@T|&>WFw$M|>ogxBh< ze6PfW9Qm7NT@!4iqii|qQS3>)___o7Vx?jrz1+EB_i4irpZN1AfEc|In$mIGK~{w$ zy>cM6*qE8q)o&SN(@fw^=}-!OI0=YfrJ6}C(xQU6?VwdZ=3{h;^};BilyLpF$+VpA zluCO_l_#}O)ub8*!;v}3SFBFSG24M`P}o|jOfNMjm%C6$zj?E6e@!>nz)38 z`Qs5`UtQm0Z#5(om{Q8@z3TKGhLp3*EjikN_Y_BfldM+$_vfX`U5zW&J72Y zEyawMa&C!)Au*Qu0X&@Fa?b|^G2wZh_^Vh7;KHXII98%Zd~{(<_&+E_Q!)_MIUWw& z#0c?RqGT~oJeT6*0Ql{NS4wyBxN|T$536&Kxh%vd6uE)yF`hE)L&2~wI2Xc*v;WM%iXXlG^_0%r zQWUqP$ZtF(cd*gD|x zqdy_U;_68Bh{DVvUL?fZ3oG}$aGoXWk)yT)gwXFCt?Zkg6Dp;?D_M7NTc-JrYzy5c zcYZIszR?!79k{%KpFjS`t3UT`(7R;y`bDcBT(r zplLI^WBu>haPr2&k$1Ffo`*jlz*Tfm(GeaUeIz7={Q{KzNXS1Ez+;MlVEUy>VQ+nD z%pM8R-iIlL+D#S136&#Bc}l5^_KKrdtTZ5?hN(6&E915UD3;~DuJj^3w8stkil=rR zYgRc(2cyA*>NsXQpcjmo5Hy-X+;+hCJE%9#Adp0XL(GF;%=t{?!j^K)Q>FGzRYOl4 zmL6=>Px1&rBSs^xC@6m2L2|KOv>kBup2U)2!vP*dHnDXFnPnC_FR(!OLUGJ?0Hz>Q zHl^VJ0zl@ra_xpAq{n8In%}H5K_QR5rY7kX)g&Z?Zzv)Z$tP1wbg30K(RKhfQl<=N zhBrCL{iSRN6fFh}FQNkMYPE!(DVAkcIaA9WnT2X@I{?m58xR2u=Lt|0l8Cm0^a{IZ zJD51vcEG3vDfBPe4(KD4nC$@UipQA)YTpxxezQQE0$!QzASI`d+YVBS41C=INhw%O zdNE?f&RLk7n-PQx#Z*e6CbgU*Guy$$S=#~X9Ek{hCSGjaL3(Zvw;iMxYc6FwKtTwX zv2zyEN=y(Hw(j5=4zX0&efyNbovp~R-UI|1Zftj#x((SMs4VvMJk+GR6qsaz077Rgh0zvi} z4l0!P(WExb^XGu@sPEhoqd^R!K^H*uF@yM9{`5jPTZ0S`!mpPC@hNA^g>Yde@gd@s zL%g2@&z55aPrT{mJdao}7mWZA?GEPwPsno?Gr1H{f{Ve0kK)ZJA{FBGQsE--2xqVO zWlexd2>VcA@eC57HtM6a9>b`~7-48{2(aHzl$92)lbxW2%v}gsr zgoj(a{6Xl_i?6-+D{I!CXz8Q(r079H$eA+dIK;E!Qos?rs3)Er@fv-I&M87e>sVOW zdwTe$U*_JGpx&=3`zxsv;7p!=2 z!I!@C*rpc;ywm7UIGOQ_3%CcsX^AH-K1957xI{R-)H$PX<6Rsaji+;hKSbXwaNEJn znZ{ewqs9Vq7qcDQo@Ex-9h@>pZ3j-b?-x(}Y0($%UbgCC(715bx@9XLncwf=Ljy>r zv7Gzayoc&+a-#dd{@P#vLcM;ixZlC$Z3jp=Z#$S@cQEh%pKza8x&G6)ty7xVm&xch zBH_-i9{$b371$1Xaw+O?sh26^H6ZGPdr(nNbq89X!4Jc(cku znhdiY0I}IQcH#pmceHA~(G*HL(34SS%Yf2;q_^HU!`B@|sbJG`ju#L#jn6$(u6(-O zno#X}`bhubCJl;XXtSY9baA$Wm#Pe@rB3>YJzxD^Mc+kj2M}RecMuTXI-$!fvt(4b zlk>DM75AH=_s(L5Leb8^5RJ+H;n+P%`|#W) z*Bx+1irAwr_&E!r?Lge`fMpm3mXN3rZ3pQUc4*)k1*)9Z0kXf~F z7L=nx+M)LNbq5pF@MumTCXbqCybaNfEDATQbuFa;EC2W;IzeZ1{}4x^0FmpGsRIUuprF`bdylU!j- zs-P1(X>$Y?PVz;f$dG3Rk*KhB1jtsj9qg^`Mu~(BLzo<^C?r9A72=o5vMMd8(DY&* zw;doq2E;vfrBdS89i-QIlZ!OlN~F3W;vq#Po-_PGFIrPXmWVVBW3vCA!^<3bAfav{)1)c-YxI)_jiIXS?9B?PP zIAC`XA?)jKYkcd~t#7>X+JS=ng35}Xo}Qz1#}Ag*j4|ra@dSfG>Q7=B#1q8}u_g;TvwBUo`sU4=n>Ul@d?ys<3_Tn>q|k7Cy6KJ#3b`w(>(N)bkL#mr;(qYs zjaPl{o6A8JTG0o?wZvPL3vrQ>e0n3A6@wQyC2`Ub#w%yHX#*X zaoj_paULGdKR-F|>E*B7Lp?GdTUZ!f(9bd5sCd0HQ!+7Ur z^IfUk-^;E)<7BJk=7hnK*`NL4*{eVI?Q2#)0+JW5T6YcVos0$Zwu27?AekhT`yrsX zf;*EFUHkXd{OafG^=oOrgUK=aFqUR~m*dd_{q$|?;@2H~ zAlm`W-D#^KwtXUo$uOqCvtjxQnHL?-yts^SmPu> zh8%c!^oEUa9C-MJ5RDg0cqtHbh{nF4AOH{HaNaEk1aj))pHfOv-A&HYeg_E$qqc+0-2Nt$AAwv92yG?_1ejsZ3g%JaPo=s| z#rEWK*T%#BIgPprWJ@ANFX#RZ_1MA#;RB6FDS zz~mR+I;PGjHKv!-Hw!No^_d1kVayWIvon5@lrq_a^dXc)JX;|TzA0o zq)7}zftm}DhX&qe4fFjD(kh(k`N|_L&S{Dkoso04kSx#^l(asdYzO;WQ_HML<#uGA z*XbM&k#rFc*`|g}x`+z=56lR!9IK zo?2>udRLQvkj|4t&V&SKB4Z9%3U;w?7W(Oo#!~xvwgcXx5t-W#5Qg}b%4z=1LVBq= z;l1d(1BN-}3=iuoLjG_FwJfnuW#;v!Ryk6uy-=;=YzJguAdzAY1tDBENb3lI14IjT z^sCqFc2{?Tw`}1FH%SoZImwU~<)H9Fu_UY93^rzzXty6#xhA=g6Ecu(h7$1;Y0)TN zF4qtbYrHAN+HECLjhD6^rJPYI3|QtQPD5t3JGs&YY02JwYJ}{ph)*q= zGUf%vzFDZ24rUap#XTn44Z}WWJ_A04`MH3Ccv*17gbxeI3Rj?Uh5H?VgT%ymz^&-w zfZc_Kz(h@P-nJKCcxT71ZQFO`7L^`8bl~8@!_86y^e6}k@qu>p^mq67IozI(u1h*d&H5!fG-QBn%5KnPMIAWSi zrmn6o_$3kvlHd`N^!4=(3=FtjE<`{ep7!+gpe&h8rqO5=3Iz(nBeU7u+1ZI4kQNDX zHJN}pc>M`K#al`Bk6!k58?BbkTJW#`I)Sd8QENXa|Hvs~%pm z`o9-k_sFs@-}~4TFSWMFj0PLnYqQySbD%nAzy%&upnkceLHvTjAP59Sh=BO0aR?6= zT^_<{q=taBTrg0>AYUTu*XyYb>U0K#X*AT9$0q%Q)50?cTJKC~yd}#7y5KHlJGdW6^$VA;U$Xil-z+c_(g(L4 z#2$Pg;E8DR63gxX7695}e~zx0uHX*)W})`iztB9))*Ue00X@AeasSWR4x+#-9}|mt z+rhm1xI6Kig?QTmTt{d3``Zp!|48#l1Wim8>_1RiR^=WVJ-lo8tIs{(+T786rhUh& zZ{_Sis8DK;o@{vGwKpn`o$!o~`Xi)2AOom0lnc|xm?A}fT+wIIibU$%qcdZ~6mL-? zp5iJ#1&EKhhuU#0gc@_)3lIR0fGe`aE#}I&#pnn>&jDAaZbh#s4jurKh^hEf+;R^$ z%)@gwEjx0FzRV0mhY!KSJ6z~ZL1;p>BOT>KvJY!oCpH4e$v)cpyL6(AU|POi5Sek1Vl+hOEI@C}sCK3m>wdqrj86C`Ljy%1 zhf2<@Yg^GHWcN&qX{SdL3%F|I1^fHY$4X@Ws{;6CAjW?yz znVKulZFZtK8n3|x#z2;oOYH1KNYIW8TXK6ctDI@op0omasbmQHDr;C|kN_tUjU7f1 znehcY0pYD<_JjgcR`n3s4k~*fEmHv!V=l~`QjUo$Amnw}lk-){6$4pS?%!=cZX7~w zP}MV`LR?lsgcga)p(b z(w$afN_g)i-|v9$VM*^5nGk~K$iWvDlFD4l0>Y8w zk|*}GWgQzy0vpTp&+Ka)3X$!Aus{RiC$IsZ08u&;CfmW5G6OJ25l`=GYSDT@5s(K* zn3<2*4#DKDm9WHI#g9H!@XS+#%RN7{W|d1F`c75nmt#VyK%%GVq^O0Tqh+LI}U|Ko0Oz2@H4$(z0|E zhv&nwMOq#Kex8b&f3$lMS#Uz2mo( zh`{rKA6LR7h8`b|d0O1EK-y4~ksD1;O^g;;2@;L-lVALg#j79ro11=e^>xrBA6j*(($jftZMcM?4%M+y;+)=xVj|cPSuGt5NB+YFx+1MkIZN0K$<8@sr7w*64V;%Zftbepx0{D%3igl)gdGv>P@e(XII)c7sy^IY}Q(b&YWqn*sT3h zdSyqopw;#C^w|bH$%1fq@>y0{ztY53v_4di6 zTEj_+^_8QR)KX_kg*zozne|RpyWA>M>l7+_B_i#YfS*G{LkgL^PpR*=OuuzZySdU1 zjXJ%=l(ehiqU&z5MPDlnzgcvA}%@06aFXf3Ea;)BiB*4AdVTcmOc$*0z~@0dL0aA#)C zKw7mcJztsM>avf9RBA19gS3EBRE=Ctul0;Z{h4lwd{B66)!i$zjc-5hNGvp`mAli5v}wC)n&eik$;Mj*al>HXQr)9a zH%Lq`7qzAos5h0^l8dby_nhh04a<}|pD%z4(r8o)g-nHtSF2PC)V}q(!>1Dt_GFgZ zH`jPmiVPdytuH=>Yz)Y`r>6^;bochCbb7D|@!b>Qa@oYD963K{;SaA@y;pihWA>nd zpcNozNQ+c11JCQ5PY+M{_m(%M9_dO!h1LwF6e!PVMjJc&2fV{WBg36tJyNOMX0f6V z(d#sQY6BRaaj2Dc%B=QeR68Hremr}7VXxAn))+u3_}tag&0DlqtuZ==_PtJmr1t)|s% z>FSgA8C+;Jf2=g8RJyXN+?)0`zf*WZZ7{3RLCE?|1|wt`k|U8SA!87Aqe0i-*JXE@ zTUwiN)o2wFT8x6eoaTR54qR2hbpJ19J0NA7J_CXagve3`J=Y)fh33eIKvKLTfpEyj z3^l;y9FjlA5061kt>;u_Pz zf_TKypkS2D&XFaoL<2OEkc0X{c;lHrOdFKaNX;nav;#P$j7$n=2-71T2Uh@#7zG{@ z4?GDxc*^qua3;s+#sPjF!mo(H^n1Z(=T)XF-uOWa=MOxp>Stb><#=m?yT+L!57<( z>Bx2vm=*5-N%B>n{XdJA-@|MNw4UNZ+X3x&0RM`ImaKkw$%^$0zxbcO-SCp#HAzwu zqmknY5YYx8oP=4#KaL{t$~|H}{K^53*cHTbYY}1+2WTl7)2%A{rtVB=yfxbl0`JT+ zMk&4Yx`VH#^?WDeM59fZjtIe!VE6bQ`Az1cYrhM+u3qr~UvC0`w9-GE?SKIf5!(@a z8V@|C=$P%0dFUEV5c8aym}SWN4T}F)2eB$W-*!;*tDn!?4lV~#W`HTohwfqCb};Wg z-tNQO4hS$bu-6^rB5Jv;x4Q?E&ia$5j@KPiD>c%7S#@PqU0t1Xz}+ub6qc5C_4Q8& zq6fUwP{R8v^yBQ!8#i?$Q&v#43?7Gv!^5xQ!~(Zs1YG%`E)MM+cpM~&&q4ICA%sBm z0C*Ark0}->PE7ezcn~7``6GTsZUCYPMX>2kcy=xj41@3>W+0d@vn>hXK?s0yXQd%4 z42^?=@M?u3tj3UO(%Z5C`nSJd$RPlpF!hN#V_7`b~MtlrnpIiT>?c z4U%J$j;s)eqeK`od;e%iC~7fg=E_6mqtQ3RVscbD zU}Qo8Aiy*({Hat!>jEm=8xQv%Y0%EFp%?(3kc0p!M4S^)h;J^s-$7!bHL=v0mapDj zE#==VkW2!A46piGT7_=+3-6pXWHRj$_`guxZyJOQAR4`$rq`aRS$0q#;`;>QjVjsW z`+7iTYPn-;rBXRYa}>rwa$q1wiFxUa#vUB8_8; z)*Ymj*wV_~$@!``t9r-StOtP1MbX7AG=KrWP}n_?R-^^yX=RRteJy$~2`pD!J4_9~bOy zXfupYGZ|#lO=?^epZ4sG0CkCdDlMlwxx$uQ=}s$BH>rlF`1_sck*?9VugDrXOFVPi zs#F#yH9dZ4xkB7|y>wg{qt0GOaq`5^6&kXdd;y8yj!R4e&jiHOX*M0h#R zf&4VvD>0$KluDd(n7cJ2Hm#`fGQ(8?hM~h#mqGp4^Z~zn$#j}CgF!dg2FszZGZK4*V_)yxI z2Stn5cn^<2*u*@zicjAcF3b?XGvNTNP_y9(kcULFl}$_(NcO1G*c*OCW4b-!qcY$S z#JfChCFdPxv{Pf@;uRs(J+dwu06ziq;|ecY0j1@itB{!S$_1N(vxF7xluO@Bp(&s{ zoFzwLw5S89u(+%&5eR?E=^}8ca1q1^@iDnyWZ-$3Tq@7_RAQX?$YO>Jh!Q;Hd;?Gi z%lO&eZ@Bu}Z!Np&NBrA_g)1JsyzOA&iu)H`_k%C3xxc;nF? z?yT+Lp_e;OnFMq}fmz|c|4#bk=l^ZV%KI2y7q=Zmmn5uwnC}z0@QeTXo2OrN4f?o1 zGCHDY$3r|V;#Gu;2A&78hsftFKk^q{&s}#wqc?Rl ze6EjxS*G65D2oUPh(vq=KW|c)0I`9dJ&7Bh`6z{3g1BfLE;@$sD<9E0h?$7D+|NDS zA0HnehVyH@CmuuuIPf@P{_zlx1N@+xzI~@RR8eaPTWmouPr$cOkkn*Mnu&)LA1P@C zCIHHYD=fTLA;~OMZmF~+>~G(7OyQY`a+q~cNP-{YB%FIjc&(P!9b{HR$=AMFr5t98 zA2)f3sNx?A*pOc+ZZ&N#RMEHe6`qtFiNs0oiSU%Gf;5R|xdUfl0xT=K2cUbWRC%7x zRXx4)M4M)SP+{|E#H3P444@s-qTZ7_U*e(O%qk}xm4B$a$>c{Se9pv*V94MP$pyhW zCH%2O4ZSp@W+)*?dgzoIQzFn7cv$B7RMs7T3 zQ(-EEfR>FT^BJ-oWR+WK)q0WPE$Eb7C_a7$kEDWSiwUk80kb>sh;n5@P}>XhLPww3umR5{eYawFnzO-kt>5Xm|X4I znA2CU@*;E0HALW)q7-1#Y6(4Cs@PoTNhqZ=8VlOobTSf?5bzvmqX>v>I<}HJuQ#Wp4vNXMrM9 z8H5zQtwp0_`yCurjARt5kvZQhvC}k)T1Ml-w3Kq?NKh3~QdBdtg2N*UX62KkTt5JC z0YK(|p>+qOHOvLMBXt;kVNeJM=luQ|E*n9p=gf3PJ7S!RKEk8E81Rtu5a72LKH~oP zYrF>_=6_)-4v?0x0Hr)QN9Jf&W=2a8s&TXy661z-NJ zYj3@;u~m*fBie18i`%6T=5$>G!*hVgLE30?c45tc*o79oyK(Tw|HzUx+EPy~}BVg`gwu9TVXs?H_ruE#N zd9uMuJt5fW91Q&A@n`wEg9R(sF1%qqXk54=TH}Ad?EtJ{QVwJ>_`uQV84D!d0SOFk z81w@XA_q0%BLdOr*m@Y2DFep6Xelw@*{6R+AXXiXq;xxPJGe54G9y;65RrM?!Myu; zyFbr%K!9J|$Ho$-dD8rurhpXxV!&cv4&t)^i^GK@Iv($eaY46(IF1Ot1|tadF$h#(d4wJ5RKz92iJxzQq89u=zBi)2;!HrclDcp7aWP zR)sAir?0^Pg@bVBs78VLP>f|VYCA}+^lUubFWL?`up~f)=7{(KGIDodYmF(X$cFg* zjK(Q8s*_lv3{q+c;6Y@YPk8$TozY0zW4`tUcFqF0PE&r$m10JTm?e$ROlLG^RM0sK+;)KYgesRS`tX`W3+WKQN;xf_vyil_zC}0cV_EWEh{s3f zA!a`4w@s$ybn`PB(~8uMN-{Jc5^^I1@XrYrXuXVlD0W6;r7NY}`kOcF_SbaB+YUqz ze8@*Uqwzf30RxT`;e%38++^&GMs7QJwM-s8WrLwjF-gXVCm>y&|CAIT8s3 z0$#5--gdxYdU~3WGejXTvb_KQ&L*x8kvD4pnhpV zRv5}Tt&RcTqNK1Q&MSzoif84Yeaf%EO}w(_(S)K0Ao{uP1mGe3%F~J-1i~{NjOd30 zGUt@WI;JrV!RhQ1O523oKA~|;=o}+@$FR;mq_q#J9m87NI63>M+CF;WRbv}b*+#@G z4~HK~)b?>?OBu2&54q?SNi?=WD$YKxvQDb(%-O~imJzjO+~k}d91RA-kX2fY08*GE zIFDrUmV?Nd^B_Jvp2OmbJOGb_t7u9PISJrT`6FH^LU^g3&H5T2Krb@hT$ofq>_B zmM+p)sjI>TfDva;)6nXlAO32(1d1`&ldr^fu>Pg?IxQ`I0xKWH-Ve*n5J zWjk1~`~mW>fM?y`-0sHp9AK9}3ILBrF$?chov$_zG^15nwJ(Rtg!y!#ltkHU6jQmCu#* zWEJ*qDeQUna6?VIYIKH8!THEa>7ru{W)=21;e~RgXgk+X3avl8x z9`X#?Z`AXDh3x?0$c+%dKPUMACffn8A<7n=CgLOAMQsPjoVB>KSaZNV9GHNnjSPt! z%$*r!a7$_;|i+WVdf%gS488P)p$Z` zcMuL9(cxC*3c&G4+|O>q@s1@YciwHxg;XBD$`e$&=2R}=K*gbGr3>+e@;-#ho?QO7&Bn{*g1J3K2L&h{z$yW-vY#(&jaMiOJPx{ zI*@?nO5?&T+EHk>TW}n6+b!fwG64KCtr!}VBHI? z$JrT;;KhCaopjabzPV)OeG6Btz05ZY3zk0swvZNm{klche&_cI+Z^sG!X%DB5ohj+ z@jS-r7>HzE$|L3}=EoeG5?v96h5$jBrqg76cWi1{vzdL5aOu4gZ_l#aoJt{grFQ?< z=7xF;8<*zhu#@!`h73H1FCOO_UnygU_6?T{twq*=&cA;fBuMlQNSWasxgxDtpm zgN@|?RQ$Z{VBUSa-JfMUpq`g{8?+SC2M~;*Jsd)Z1NCBd79(zw-M%9?$Ub@WjN# z=;$b4bTBqH#@8JnChy;Psw;+w5SW?py7umTZ`ZCpogKZseX^bVcI`g6-#Ih|)`5^f zgl6QSp#Rv>I+Mv%R#w*E-(Oc(*WTWK`t)h3RC@I2QI$${?AS5j*4oxeIe(T;iX6QaXlXgxM_ z9B8~?NA&P3+Ajf8(XRXSfd8J5edPHZ(LK4nmL*Dg~9rD+u9;%r+?PKrKK9kQ*<(y$$hEajk9boyZdzwzqbj zI@x42niDc!Typ()7pz#nboGz;;{40+cd%&X151|Q`<2_*?mb*lSyiJ{X^x*ffecZ4 zPfrg>P^;CYrKP|PSOEdZ280lWDwRq+MY{l92;|}56-OHsL2N)pNlA%JCPN^Y19~}I z^jbq{X?c4`S3^@H!kc<@Kguq+^ADx}m?h^Q{Kwl45W@B6m^*7bczA2)p=Qs~Gm?{y z9oOFcolk!L-ZSzTM>9i8-yM}GB8?mwos+?+|2US_|8ThooVr0H)>*R4rtyXV={ zxgBGLRm~Eqs<^W8iHtWFe(~-F%hz3V%cEBZ`x2I(T{t-7fn!kU0zlNR3?BfX!|w5BTB!3IW`Rdd{^S z%&$9mABZv|Ry(Je8+#E>IP-9H;J9H4qv4c}<$zljClUzw(2LWfXuVLc?i`s;eIwV) zx_Xu{9GsmA3gN&UP!7@FgtPw0tRG`sAQBAFL8K^&k0wBs7TggPe4G8K4Vt7Dx0IgF z0A>d$umO}gdQPu5G3>%q;@>Bd3U99V~o1pKT4$OWwg4}wQfX_|VCC8v7E=Y%OB zj}{l8tu&}?2EYk8zymZG8whZVD<1J%&LYldcz6>2G(I`!Dm(~;2f)+9!$WvvUJ%a; zfIt8O5rIb*9|3q09w$CSkP9!b5rhzKjCK^>Ew_B~i~q53BsN#mICD}TgqQ98#TR~{3<5k?4)1K_tj zTS6bAk19jO&dp)u+TA#~@}~#+Hw#z3-@$_~w$+T};*x{|C0++Eam zuweNEOIAIyXyy7PE7r&FcOW7UggH4Jb9ewE<^bH{%0oob#48V^c&z&P6#*fme~G-XPQnsXk3OY(|!lPJNwN7 zZF#VK{YUl9Li7g#H1g2o4nG0(jX<71ouy+Yw^a}ROIq7MW@^8dCcEnoReMj5pjz2* ziU|d-Vafps*x~~)3;7^ZUShPAc({1z#o>x00-|)iFR*%M9@bZ&R_AR89|U6chnj|< z%-as;-N)GdIkp1~H|Ukw_wnqR`U_62c&nbs!U&p%R*u)5c z9B5v}=6?*RpTmEMx;>T|ZG_8RILN+rG`(|loNxQR9Zzg06B})8+eU-7vDMgC)7ZA{ zq)B6=v2ELG^4_24`+NV+TFK0;%za(wx%WPHa9?ip1WDh_9h0S^I(bA4sA1cHY_H^Z zI(iy{p|0#wsCkHQ$7xot}ok6HG`j|^H(dAcE4%G)V>n-L`e$8f=DlJl1vtt96qyrPt$ZA9X0 zD<%9?%x}WwtBEChUeq^ExFS$FC=vyAY)6@}bREnu=JN9+MJA~-BXM^t#j@;%W=Q!d zU~v?-A3>HviO(lO%DUvssJSRY&llJ1h(tFibp!d{gZ{xBBkOGoKYCmcjRU~eF-*3N^Ixedr zR;SRbCO_u$`kos3s0a^!FZSjEmTM-P8L(R|@o}99^a!8lWQhL}GYd}|A^!Vw${qC{ zLjvRaNKx}St-=XHIeY|!{*nf?tOSFUxY&;mcgFxeK$z0B1Da>42UUB635N0O6x?O7 zEthLmY6wS1Y2~mOzm7cDCm?b!i8V!k@m7+e4^P8)PFD;tm&aM=blwq{`jpiGaTl0( z^eT(Xizvg!DQym8GXbbQPBsj6MSHTh?Qkj>`Va03CPcyM&~mK%>A20LZh-fjjiKW| zJxY#$D78^VfvkT<<-Ybe8pUDDG8V9M=VJ!L7>m887vgL^mY&@N*sw`z9kR z5HZ#-og6=oU#88QB7^h!+fPVy5q^s?<5e-=8L1|&_EWHGDYf%MA;Buv24qo=omR-G zD=I=mai>Fj^z<_wat=ed0E2f+H9V(5WEA!yHrwWln!Sl0j?aCcEvU=0!}Yrh-p(%p zbEwI3m*{3*jVSoZ6dAI{(tnj~ltA<@z{q8oIuocx+K#<4%cB0hl&%G=pc(x-#LBL3 zaEH$P!{stQ;;KR8vCnyJokMQfvegc;^98_b0m{>Hci0Q?T$HPl(#U?FlU4AH-j=v> zWovoFf@8PAl8L*K=qeiasQ=2;a`cUqn7L?3kC-eP6tGs1@6n(X-YKTsOP~_$VqDyp zc-e*6g!s7Fj)~Hc6%-}C*)`mb7N?kcET6VTU@68pV)gbKux$<;c<2lSNhR3w(`e27u;TLJ~Y9i?q z7)isk8>aI8V}pAWi6RWbGlLqAc+qw!_2I8$CSKAs61M7CH0C#E`zri=pW-)}`Yoqh z%m^1vveqxR5>@@9BSM`%l+~(V&bpX&t|1CecbbDNcvg}8a~iIe22+4M2SpAqg!BTM z#J^xieV7Z-l^$w%Uk$N4ng26ABl2Gd3*)oo`_j}(*7df?{|UyKE_h3*c4Hjuvm?v) zxKmx^q#0fZ=6>$3J$RiBHk#w#x-DVqSXUu;#S@{mP52EuzraJ9phSZLNF$MPqoWBE z8g(zb3b{7pir;iY-zI1oT)AVESm4y0ivOzXXsC>t@t@&!e?fO)3Kzur$Kkw-@dEP@ z4Pi*kti`e37vv?wbP8|WIvsL@Ep8<8b#%EN9zAT3aJmjDZ}cR`U%5!e1UOT)q5jXp zaMGX43FHjjNR1y4mrzU1x4+`N)Yl!C|H-F(_J{&k(JCzvMID&u{8P7bTv^(3H}z0- zl#}`)+0=7FM^|-}Qo+JmcpVI94donCh+60S>pO;61I&05g>y6>sqfa3bAr!v_qU@S zRXk8Iy!{M5J-rv@fakNr6sdu2+I{vJEUf8-rwpQ*f2+lHfB}r$m}S{(Q4q@K!)9T> zqq~F0a^ybeQgXe%$u>uF>?>taL5O$!=aowK<)ZRJ26M-z*D~?-=f9qOj%jk}2SBdG zAmW=;-6vcuo?{U*kHfk`Zx^)?YwpW=zf&e$ zXQvxKG>)_KD@8tEHd?wvi8VA*7C5Q77bxY3n6EFZA#&O;T7||TEJ}TOe; z8kO8k7(#hVOjLNuagcD?IhVg`ZICk!mk691mMQ@3(peGE<|BNhhR2g^=<2Cb+OyX- zv%GYF5hRiJeL9JW6^T+kFJMz8zESlQ*RxhAE1H-CY~BH8+DRtFx5mS$BjhOVWCS9f zHo+4*?x(3-1#_8S4j>NvfP#o<^xI(v{}}|!nd$(-2&jXaM0wyD*WtKzU%+>cegAQN zttvqlj6jqJ+l+k|L%qkSK3a85{jw?aeGe6J_RbTnfm%!5fSeM4gbWmw9>*+sGRNR1 z7sXAl>l}kSuK3ypen5S!HURP5!$-O}Ese z;*S>$A9@1yuvYhBjwz^^!U@I`N=&tcz2Xbnc;1lR%4%iptOt~@Fo_zIU0&{q=^+iV z1q%)MLY}dX3RjN|!ZK`SKbpSZyyh$GJ*{Z&0}&z=dY9C$@~E~b_N<%&uoSi7<@VG2 z<;UU8cCQF~z!9{a*q0@{uVt}C4?C*PhQ>e_UM!mhq+C6_M)^=!G`M(%Y(XlQvlTX7 zzPm@;#{X0ldBw?EWO_G4^LS)_%~AeQVfZUytA$#Kce=rEc{d@kO6Uhd^@Z|kwcH&4 zLIwEl90$4w^`GTKd|nK9$nzl$X&B-h=+F^kvtZvwYqa0q*MXd$%;y>NbH1M*v=jj% zC%U~d;!u(Ahye+KDka1dpQfpkmsLvq+z(A!Ofl1fFy`o{j?f9F2^@19r}GDUn!fYGtd=WhQ4?Xp^36XuHr= ztR_mY&JXczC7#KlDoci~wkes8XWb@Jt7hAT1$_^aZmOy;u)V>mI!Ul?)g(Dh%&}O^ zv|7xzP$%>Kn$p=k_GK|o+=Obo>?9Q$)#aRF&!Jx2ukx#O3pjoEYg+-hJRz(6Md`jw zX}wM>X?!c&U<`T+9!{DjCflOA%DRGo`m4{MhKS!M#_RJ#FI(j&ZHzH4npqY#RhJBc zE4u2N+Nz71y0Z&Y6mc0K_RaD8+#->gvR)PPJn|Ng!|E2d{iL}p%UfNP5YWba+I{TF z!9(<)e4}k^t}dd@6!{x5CuM5tR6E#N8D5S#S? z3;x_sq5ETUydaeSP9lsQad#MhcSg^N>xKeTI*nc{A9(vkbV6w;+T>7(CbM#=OBOy#XU|3j@t&L1bMp8fnc z_Q3W(TE@8$;VR^dlwWIJTlI-WmCvx#*48$df1{$bl!1Z4bvLu zeQ*6J=1xH3CSG$Wy z!3-*zN0Qplzb0H($Yup7lTlhVa`yM09a2FPW_9U`a1{dvEqb=DDZ1t)*{MG~q-`h2 zf4Ow;JB}nF7W}oWZ&z4=%-RrO*;1i10qnC?Z2x}D&n1h&-tCz)*k-uqEc?kBJ}4aB zdp3MKbX@`oeoGjE5on^Rm^rInL>B&Ty{vKJ-L`anM?NC|`~Ke`WWg*-W|nK17!4`$ z-SEEJp}(H(4;(HTEY~@+L_)05%qgV=#}~$xNFTX^A^w@wRelzh+-b`wnqNI8fFVAM zt?5U+4X98hX(fAQHtkP=l;uNdQ#xeIkO9Z!_)`!1uYr6OdRtfXjNTWitp68v()xWo z5O^UKGPXwyM^vT7cm?-7=Fw`}mek z9n#M*Pj&|I7+75Br^La7r$_w-)c3>(4mrYU7W_XHY2j4-YlJR zuj?y>4ljLchy^VP_H-0zyArLMAG{zA-GYS^i)qhIo^2V1dg??TU~-wfuJouWh?tINl60+_H#ihB>7EL#{}rcqJpngPTT zmD1Nn_?4*+%5v8Qvr7Dc&w>=gCJ4*mm#Tfe4p{(9G$ifb&@Mq@+Mj{?5k-%PNGo$7 zCx-Sp1zdLSilT_G;3>mYIB!!NyfwL$sBB1FdR8x>UMb7qMx*%~%kc#*M?w%e%?8Mc z!lWh2PzCjUQ-RDZiW#<)4|qXQ>^JRyx}*`RLkZNWsEFk?;K+ zowJ%ZtAPDGXVqNFw2^YV8jt!|gq=nf5t|&&S@1makOO#FI&f^w(QJ z;uIC2+Q@nJdeJ^=HR}FWc)1!Ck(8GHTEThlz6JgI2UR1v!6=E-|T^l zk5S9aOpF}eox|O*yVp$SD7}&fv{ubm;}_FZ?I^rZUd^@#I_4e!`7iH?Foya=Vr@~T zj7=La3GCj8ZvWl^!d*^sX@Uh3A2v#Q8RLOA)3_#VBU7<>i7Pg!8Wm%^7YnFwbs~rZ zB*>)HeD*{-*cxOKbUCkV)~~QG7Y>OpSy9}XwD`+6ww>uU z(;>s;OY(%&O|Q=c@-f-;>j8HLXc8FtmqXmo?WleabU9m2X)G)5%R8LmEO`3jx-iSZF(5ZiW z9~ip~+h}s$UomAQ(QWhoH?x15TV zTb;2}8^+aq)4~JE6jS;i;_!XnDX&K0o@J=hDJ#e`!X#`#Q#gReE>eCl3c~f>e{Iw@ zs=!?9(V$Ad{Em%ZUKxk+j=s`S5@!E25a+(yb55YkQ_TyAmRDQ9Y-v%bZcEpigymoR z58uH?;}84>T!DblFTxKGGRO7376#Um3LOGSs#L;O2D-&xtQGbJ018o;4$tX-$h&OQ z-^{a({}&m4Y~kQqnWzIZJ@vYkMgS3bRpIOH$p&!k)RH>HUtjaXKq}91VG7{owv;5C zZ&eS;qh^w%1u%si`#`6~Qszxn=18MTc)u@0VEfpSh!h{;rD{STv`&!1H_U$tKz|vF zMZYl|Rm2aWW1|_*TQ&&aV2VBWO75D9NO$iY|Azio5vHCh))YnLA+!Ngsq5^*2BLz} zy+76oI9*RsH$eI0;n&#rzkV3~&vQ9=0qC5y(QplgTQ;#-_2}s+1?u8MvN_PPvYP(Y zL?#*Hux6B3WSoBcW8bFgQtay($@n6tjje*;sL?znoqdmLh8H57#VnGWeoh#TJwkM_OH^+k@!EpOr>>PYMh*UEMSm2O45ir&sUebMwAWdJb0+n){5t<2HsM%ljr0Mu;r0L~ zg5{t6Xq4Bs&C0|pdt5ppaaj}0qlcH{*$Y}U*?KDh`jB*6>VMwRW6Sbs4JmNpKVRcw zRc6e_$5Uvqb=Vm?2w)LIXa!KT&?(5U?xkHu#}DotQFgybK8kq8VaRcQcblqgRR24b z4{e~}4in^CDCsO=#}R^wb}x3R$jEB@DK=|HQL)anD44-(Q*5A?dlj8vtnf-K1QpP3 z%bfc1Iw_;96kd8bNl=2Qf5cVsi~J}>3ZZRn8cfuZY7X5ah6R+Ah0~c)1g#GnN$Q)S zaN8`54PMJ(rUt5HUd-DjU?v2N^!_6KR1lMtR8e{8a8|l*wcE8!dE;q7>i4u&l~pbR zF%IO5UPqoAOoh%}f$>s&e-dl_U}vnAe&Inv6M2r@v<7=zOdu7NxEwEUyX65e z2Sc1z@CwV|I8C~VU7!pw)cm27MvwaiOdaV7+_)}yHu8yz@Xk^x>n6KAz|$GtwbXPn z;8_BX4um2zT_UwgOO1TY((T!D8nfbKHi@wapP<{mi9iXpE^`sNDOr8ph6HiEo6<=p;P|E3Z(h49-8-? zQiayIk@^Lb|0%F+T}MYMK8MoK6!M+^;*ZczpsLuyw@yjqW`-r74iu)Ey3xhtps_|4 z7K`D%nHo>^v?J6pQvO}gnMl(!hcKHA2?@_(*-aJPIGSC~u^>L9f;pDl9~cT_BI6Oy zK_0B)kH%!e7$epQDIGT0(ULzq{6KL%iO4Lt(AECFx>)JCb+UhkEIeK1Zm})Lw_(q! z&VJzUO>cRBWKDHHyT}*EI2AoLJ%a#DPU=o*K3%&RJl|B^PfQYo(bEWtgw(&A zFVIKN&%4UbzhA8_`PY>j*#EHXDNE*x+Bg6cSCp6Y)tZ~{{!AC-->l~Mo#SWISNWo= zrgl)DwlbN?r~6gyOX4bJT+Ad)4~WO_i^Vy6a?S}jCyEWP3Fgs{GFAZNWo@z|?KQ1- zJ135I1$9d$XbS)H$KT$NQ`C3vC-HcNqXc7Sx69*gq7T}`zAFCi?l7tQZe?}h>)(DK zx&K|4{2zmZ@q&*2N`nOC7q$j;3y9u=4z=w75h?)Qd=bp?WyICrCNn4iIGh5zBG1V# z@M7XZXrK|&u^RhHc-S~*M!AKXAId!*s zLkF9Pi0&_}+(gJvOWlO)n6O86km1`yd4{%hPi8G{nECXV(!WIvUn~`(caUV@ zPK|5A2q1@+f-84{h>E4lIpttVTC7(4b#dx&|6Se?u+8~EFyAmm}- zID6&F6(#AZF)}Hiovze&4Du;?!u{ojr#z{*Y!TbymsWp}n>Ufm-qK^CXF{{|As?r$Ke9xA0$`t?g(v`QXKpaY`IJ<-bU;6K6D3R7`*WRMi$w1PO4 zVKDk)Km3VY!vR=y3W~l~p-X*Y>NF?u~ph;{64v;mgVTRbE#GmFIMsM4aIRlwj zKhKlCOamz(3$g@hlJlgc%0^1kUR+D}iNb^FEf7vi4}S1Ns;-&hXU-DRV_TMSg=vuY zv?YmQj}^S7DuzvsL{h8vPLDd`9HEq4e_kfDcQEu#UXXGsmdGD4E zU5q(NG%j4joDiXtqTlKJm1u03_k}A>H~-f~(vxGFT{sJ5FV)*0k6OOKDX|oO@<)?{ z5m9=;#xAO8ZWm8ip9x77rD1$`FHu2#r|>iLL5Qir{D2knpzfxCd%QZe*odBwyt8LZFH(o4{Q)iru?sQ zc`s@xbB=s~3%Tl|JL$~9)?_IL2l&W*?Yxziw925-)GO9TB!L@-+MLjmqyVj%v@IyM zQ6;#OgwMM&r-mQm06+krt(O1~3L~~qO1)@=VS=LBF##Yq)qnVquC>mhYthK?J8X__ zZF=#F7WtjI$f~iG$>Bi6{M#=CCu;#3gg=fVnAM&WAuR1+SF|Y9n5Zb_(Z&O9SKKxl zn9>~sF6O4}T^eOEf4MZ2P%+3UC6@p?Y}{gQGkAoAzy1z}E)kt^On>e&&uZaI=of4t zuq;l?Nikn~jl*e|XX)J8 z=$z@Y+U59>Eiz zR3r3K?avX+Ya%*Wjo&M3_L)+(qzc{Kr-#M15}Jl=bGcS{FK2H(mb7h%*yj}sEHQ#P zguHN97b%P%?Rz^zH=V@gDi%vdVnC@w))n!Crytb&d8OdTe$HFJ zxVJ7VDgrMwN$;*hm%Ep0c+8|fAMp;p7tG4`;X={3BHQhzOZmBG%0aI6(eGg{27Qg^;QiR21j_ zV7Qcf08Ro^Ok0q3jy;Ag=<$v2`ef42dL#mrTp2y%MX(Av-FdPN`~B(RlFQb`lcf;d zh}bYr0d?m*Ndv1yHL}}&k}Vh+R>7laE!>sEPeSsVS`e$nzVds+vKWln(dWYS+r0;- zv8a*s_U130=?k~(mFgwnxp|RNAn2g{-q$ihfnR;@BeASw*9`}xTVf#y&&L#=h@N`Oucw^+F{ZdF<8i|q ziA5mUZ!0UK>mf$ZjRgNTO#hR)tl>mw2me0d3NQazhI1-Ph~z%#fi%r|1yH_8KK>3S z46UMp$7iju#T<;fP3<&G1>bp_#5ULG94jjud4z}9wsIH0vnOS@By$wZ4Gjg~=1KKD_YMt}z^ct{N{7)F05|IEXkS5OmZ|<3F z1Ydo>`Nl!DL3*#6f|4uC#ZJ(T<;2mK%L^G~k)tF##rnefr$7)@Dp-50oqJy%bBt*O zw#^pDDhlL;wV)+CZD5-c4=J85nRMT(?$~1vJh4ntRim+lz)GE^^q!wa!fOPuZ8J;ZqZu(r9z&*{PB|)EPp#z=?Y~3kEZx zyc~R%>A~vR{-x(4`fjlr+xhH-PSi=~G%t-Al9V<)JIL%NZ0NYn$zyrG;-FRM+{bgm z=i1Msy>wCinHHFj09LQb)3`ct6?LOB@Y4tjeZ<@!j&PPc~9(Dx|kL)gm@@? zUEr%j-p}I!8_@M36B!M3JV9Z1uzwA||3-$6-QVG3YmS%V>)=H*WP%%3sh@{Tg_<7R z;5g!PZKI)*bqEQav6M|VNk z=p<@asQ`C-jeZ4H1a%-%iW)OE*%(vMJa05j&1`a1d%vZvI9x2<1p^h?NluI-p(hQ1DXQ5#IB>02{mM>}EaA`qOiz`udd z>&~Q(NOoelJl_Rn;~1r|IeGgGf~o>No5{W_5HK-lhVBnkiIb9Guf3hrky-O7*A#|R zB+~iu)5s!0T<%KiBvnapW&rpRvj!(!c$m9{8D2TH60;n|?66#?jhMBd1yQ(elbci|axhs^cccvL%@#iJN2^v6)GF7tC~ziqa+Tu0i2a4cyHi3R z=o@27X_hW*Oqo?7iT1M>5Y?N`4d>YykX{jMv8k(cRPzO4mT_O?^$%&rd-Of}jB$=l( z9?c|t%eD_`XW7ST2Hz}a&9&YScjg~`9QRiwxrG|9Lhn`BkD{pCXY9@^NdI`=L+5<) zAT1+hT>RSbl2^od@vl9j^ZWX_rLAsXD1ThmG6H}l9eBx;kD2YNm zJmGrLm~X>aoZ-PT(W&s6X=&SOL{U-_TRNiC^~+2bkds?mEc+LP4(*|pxBwaNsV8uy zOXvE#y!{(FpfnwLEdHw5nQQ^Gw7B-9d|1yfl9mb18#n(hF81LH%c4Zs3m`WixVmC7 z2dptX(8@rEc{sr~gfMMR0g4nk3~O967OJp0cz+k_kU2=45?GAK>xBkR;?UW>ZsBvos`a=>n{ZEf#!0`uL?L4HNDb8bsOC&92ya7=+5FnaC6i5e0U z5EEV|>3x{@A^ocUcQLG!hNbD~!1+$`KsJ44+5p95<)D%UZn~c;#4h zn}c=o!76^Qe0;M?!nnLDz$Qv>xsIj7B91ka9EzvL{$RKH@8MzHHN$OEul?K0>@WNC z)ut9QbGVLW|1s`ku5^tq#o^&Hfw+W(7W+%P1Z#s{VfKsW1suGOz3Gz3bk!jJy7T3^ z>;uBG%F{#oNg0rL`}frk&lPq`Ek*gUy6?6?`H%VsD|3g%mgj_^`jV)=S9j;FO`BLx8k6 zql`;E&s}RP>P`PsQZ%b{ii)05YvhT?+wAv=#wzQeOgQOSeN3MoXG0P63djgC-QsGu zOAYMK2WT|;=l-TYF^_tEO6?4w9<&}>`|WWhRw1RKm)XeDdNh1JqZh#atEkmi z|Hb8a)^ghb)^j8j+nQ^vzK!xHx1#-uU0aX{km5x2C*h}E`e$wnl7(%AX1hrh0MfA^W;p=A z1+vV5?g^pp0jAi(LV z>u?k?JBmuh@_x@?c_7I%R4~N2a&RRP3+=F=A$!t#=hfy^sh_I0qG~)^ zfRTE-U|MzkPlR|5?En`ziZ;YR0Yaiq?-AmvT>N&4sh zPQK;UBCtJf=CaO8T}7j@pXo<*eRh^+hZkepV{-E)@4+=JM}$GlbkO+Pl$M)`(p zMaHb4+mj-bNwgZpN_N~fK`T@qjY=Cn{g(a%dlh^YY)nK1z171E;hT*UGe~*m0MRvo zqrAN>c`JfJIvsR6J|2mmW)3CHya|C5E4ttlY}S`YMzNhYwNUaMs1?d({1jaMKDE7f;@9B;LzsSD z@;Hc*G&H&c`Q%Q!^AYg;omb1Q=%!;JK?o5mLkwlAqd*|6p`n4M0#_TH>z)9cA|++4 zQ%IFt!9Um@4NtjSX{$)GF1dp)+rBcrdIdL=SywnbwZ9&YKvBp8)9v4~bbj@=3y%lq zf~W~*u{fHc{usY5(_`(R>gztyXm z+`4d)n=fU@E@=+k%Hm!&91#l^6c$3m`!`zn}S*Dt6#LfJ)baszL$ByVJKR(tfK$4`ZPx>Ezt1om*u0L zpB1kvdD8tm6TSR)rch(S)9~r5x42z{=xGU;C7kE#XQ&-0 zlsVY*Eon~`LcU|8-TDb3n3t)10hs-lZVsxekVcqt-c?U$k_%uJeUhjhR)#dEN%)$1 zE74=1u;J+^z(qpT+Xt#bD*hb7ip*u(^Wy^$7k{Z)U^MCI^#y)GzS_lEV0x{RPpS(D zh?;a>7-%QK81;2w8+?&4Z;?R=iJGtwsGejf3EAJ_MoLv^u*y5)KGn7MFbA>=A=&d`7OrS$~zH$L+8}W;nyqM*E8JyG^W{6lp zh479aS{jLu{h(+L0z&INIfD%fyvlS=jo*PeYPVFg5gfkBgieYcS7Hc(v2%(FgjWGp z1wI6Ggd)O{r6X{v(RBcLP?gnyXk>{c%S6rcH1}1}Uv|!LI1=zdSQ1Q-yW|XwIm@UP z{P7IRQii~LrZfFniaiYJn2a)ETct6z5oWXAW4}>}1#~cMk&FsWxQdLu%iFHGqIX@8 z9h73TSOG;6B5!8@$r}_h^!Rn%!9YLCo=0<#`6D;VG~6na)7E%DF3iv}YG`vJK`d_- zzk5sBy1$mZNqr^3!89r4dB_4d(c1l&{K}^4l$l|NmOk@W0v3tzZvRQ)vmY_h$iRkc ztnmTQ4cmRh9qAnX?e@83=;31Y_;Ow}DT5GPZ;f4IRqlErU_peBmQN~W`fAQ_IA(D$eOS*T%!QR`)-FJC-?0Oq@&6?=ZUdT`k z-PsXKnh2L-K3CUDnZu`Qn-L#C&AJ`#d`l=%3hIL9vUci|wRF3@0DCEcg(*`2B*;3@ zr+xPnKEz9QJll19fsujtuZRT)+jB1HwYIY7w9;rbr!b5Q3sbv?L|K>%{chmIKW>JsTFRyR^!|Eil09YVN? zV#PN^Xe6H`w9)OG&Ytvnz2}}GRZFY?t;QqOp1achpm#V7LSCwj6iN!NRUC4C{eSp(Sn;Y0sDBSeyMahv{w1eE_i;`bEuUHCq5ofDy)_Z@<4 z5CNt+69$zmSQyqJMn(v9Ax&0293Z^Ud*y6F=ia*?W**A3#T!~RvoX?+nPE3-&>wLD zwc3-8JX>`f%Fmr~DR=(>F3=UWl5 zB`LzO#Cpv3xE85$v%}(-C(6^}(IhXEY%aDNdPO-rNt?W|*+z$Qn6R+Y5^E}% zVAIvJnASK7{oXYx$tq^BBfrfW=ke)MT7O?tqv#Mug0zBV88}q&@o3>kKg0lzmRh1Pq48{>=h=ekL-i4`7 zp!!Yu@*J~EXNzBv4Y7cd>g?aW#~jy;<6IlG+GeA|heGFWL2XX=_ML3X(ua7Bb?il`~s=IwoNgtGvuw*w8k|}_nlB?(jK*Y&~>B?16Us; zSj3-s9)rR-kGDa2SZJoHXhpo72^a)jK(Tb8%!(!f_;2vn{>(#XKSK`g5S7)kZ<=-< z3>9qf+4@DeNTt0C#nPhb$y)~EH7mp5I)4wo_P5^`W32Q9U=wkHkwca~6_HV4_hgz~ z%66SFJJd!dH_$mwh=9~|vpr7nRjdr0{~p$I%C8tpR_w$E=^spvu!~rRUNWA? zyx(YUuGK_&ui^#_a`^+nmqC!sybzz_awmmZx0+)jkrkt&MfH;3Uf1r2g?u>MGwI1;330XuF*;1 zyWGcAD8#+7v4UqmhnvDniwE!$;zUgwz!1^p6{=B*p+&)Bvr4s${mpsW`OvBNT;I{O zR&6NdEN@NS80L^|j-pU6&y%N|=&f11E#gGuXdW%2lj@Se+alKZ4Ec6!y7h;rlny(1 zr`usIfB(XgunjPc{J41Qz*M}ehNXB1+zQn%YutD>t&cvB{9DC!|JAj&J@Eg>Yqg$| zMt&zlpCpAaha&Uz`!ox|D*Tr=4b-yNZKFXTm06$tlb?$dSjLEWC4MpcPs#G%75FJ! zaP75x53pCt-B96t-+9iHWL)H!wclv=Cu_kh-=f#Ukgt6isAGAm zwAwt`d~~u)s^&xmn$Y2*&uaY^c;Vf7{to)=9Yq>QO|%`o*{zQXVa$6VRRzicsz|pU zx{BQ;;!uFylr)3p_W%X z1KbQ^;k*nf+1F2e^=#k7&SBV&T=g3OC!|~)dDB{)L#@46lMS)lXGG}(1;K5qEA$xU zC9NW0IH+eFx7T2hT4Hdn{tD5$ffO2~J*9xCcYpjmQ-bujo4CB#**{Uc6ODxUA=03=?LN9gZWhQ>n|NkKkozQC0i&J=OMZg$8KF zpu*Kn7`3?l0GkS?1_T_g)r%h`2nJC>rs|mobC)MAH#&9l(|>;z`_W~ZI(JMrfsAD! zsUcwjd)yrV9wog;ubG|5_IfJq5}|4+Amd5Dc#&_fgs-Gd0vyQt?`C)#@$1b4#(x4qvichwq6j7;^0w!CEJwUTC}L49e-Sc>&%(@5O`A4| z0_sfij4h&Vz(x-hK9`$NRgl0jFj!!IE;Ba+edeLXEScYO^#iaYuGqxl=GYUm@=ofA zm9y{+X#k?o9;Uffo|&}E2bG43h6TR5N2t2OXISN|S+Q>wF7gCfP6(PFyV>lz$`G@Z zx?lQsM9fq;sS+^Q*w1UY0g(FyP$jG}#r z8AHodryN5aY41)pJ6&vmTrQm$Z4YaVmLSA`=2$S0fC`z)9{{dzfM)zfuiz7g6>AJC zCJoGX6QQwgS`g|0)65^O>Z$x738gumScv)&JVQ7i7Y2z}@Y_Mw%UwZsFq^qq8okru zPs3WIED0(o@&JF)autX|tfXMvQJ`A$XNHdE2JNP;)jUc*MjV}(Q4b#3gagQ2#Z9_t z)~|A=M02IVI@2=D%W(pqOm`Ze6z0p{AYSq=KQo6VegOdicGjOtuLEG%2TM%(2W*~P zF3TIR$@leFGg+&Daqz@eT>hhCMgEh24C@)!#)&l_$Mx~6pyNYJEG9}(1$M$PVzJ}s zgPE$Xrn1{B9m((K6uJrTiWE-$pH#8FD;s;%y0 z=jf+f_<8=j$!4L~l9bJVWv2_wUr~LG&jX1r!lHXLel-=kR=eXzf1BKpc|B*=Q7T`g zt$y7o(ekd4KZYWVtmuYXVRDb`{cOOt6Mhi{S)*~nyOW^a-i9q<97v#`y-iMWRU-3O zFy)7NKnhOZo*(3dbWoC)l7T*ayT7hghqE{zGJ!Bmo}O9z3(^P4di4(6+)AIr+86X$ zssX)vaQ9aW{-dtS)psRk2d##4pxHq?q=xT zh(4F0JY3ujcUzgzF0sGrS5+_NTv0OP( z3(Wo{OXvX-N=m3Sw^((%$+$TYvsCu((~nu}0aHbvuWD6e=PrC%|2ljCWDelyr$}%e z(-aKtakDPcF_qHI_-ZsUdR}Ft^*GXmSk%_uK5JIz>g;^v3>P9tpCZqnI2gHpuTw-* z8c3fs(J!ERGlBJ$(97B@L#{}*VqUJOzNJO4hMS8kyP5aw{_D+d`f(%_Z0ty-qZ#qB z_jWgHkWXtx0TvGroCQ(d`@8SY!kX{ZM{(8_eD{-@N4eD{+GsR~!+@x{QN{5%GXD=V zO|-<`-nK#aFEg|G9O2iR(bk5>#GT(M~)mLr)R`!U7;O_1Ohv4q+?ry=|NpN>*+-c^%-%Qo~0qCyk?z_)E&$E`18;^gF zbdj*l7{y$5HF1LvX-PG}l8jNm)@bD&A^@JleS6VvbIKREJ zg)1jJyJqEm^@V;I4_s?emB$dc!p=Nid-$l4c7WW7j@3sdc4~9 zKV?vAYK`2#0<|@WXCuY?OqS3RMnNK)-BnOrb(TzS$YXCt_QJuo&?< zPraNJRy(R(rI^8T$&}D?lBQwCHDupe-01nVjh@f)va_Q@r({0wljL|BtJ$7%+93Ow z4Fb?C;~*iD9aAX=+i)#cpIsa`XnrqI;9RjzZf^eEq`kVy7(78}r(sNZM)4w9WMx$S zdakV(Xe?OFp2IzFTsQ0Lte17pV$n1D!}k1WQM=QkX8+aq@OY1w+NVY}cXY*tjR=XbX-4WC7R!sy4m;tU~6e? z775WZD6vX7HK;g}VobEDzA4nuSE?9U{crk_V?BD2{6(pt5 z(3xww;9jxeUaqn_Qf?ZbG+?N9T)N%NIasVU1-*rZr2cp?ww2+u20a4U|H4r2P-RIw$I zxr;TPz0&L!`DLQOxbBaA;9idY9ayIN{Q`jgG3dDn5USAUuY4#=p(BCp-EA7w?|9|t zKk1o&_$zqV4$1E6xG?a-L9+$*et2(i8i~c9`S-GgQ((^z~SYH?u(8@S`{6CbCzez(bsws#^?`-_5u0 z;ve}C+?xMqmRunbauEW)<2W8%Z-|a}%v*&&y(9NObOQ!Pj7++XLYr zMY&w{nL|rNnP#9?K9QI1=0F4k>)lf{{?c>*r5i@S%Rep%O1BVYK<5Y*H!a(RA+))M zPz$UYnRaGzR?u2=uC^HsLH-5OnOP>yftfveS8pbCU<1cDbjStW=1PtenIN_D{Bh?Y zWq9ARG9+bNnpXQaiyi3k2gd#v_HWNw|BFv|bttd)0RvesgmUR`?Sl`ru5duEpQR^< zV2A#6NZ|ZD|E4U>zV=d(xeM2hN%Fhm{^k9iM{Y-G7FXwj1&P2R9G z(B?;jEf%W<&dxoat1Mr*#8F{59D(Wb62Zbj(3tJ}LK)TkwJ{JgT41r7>pqb8`iFp} z#Yqqy^muK-M9n0#`q+{&)ck3_!q4|sGkE7M=dG2bIe_N0~Q1wsYVehbG9<{EWjZtXH3cVpG&*4 zO`)V(VO=j|h+%qqQUu$LOY7`iGq6WEI5h^rAG-O$CCFBfnZ+B|cFY7^Z8V4{iFIsp zW8bhbCQDY5->xL9$vCe=E0QtPRb}YYC-A!{#w+g&Wp%4p;5 zkF`bO=c|e2)1}vf+E}iHU?w^FpvOb{#*eV)VTF;}lExF9bPi9-H=gmdHW-5wWRu_0 z5b)~nkYv?+Wq0_AJfiFuOD`RRVU~;4+vY0>d%UYm?bN8dy3Eu@@q}%nQc1Fd8%Gcd zfGzdTBYu>~QNLt6(ub4H(k$g~0g4z=JHc4{#opQrvFhc1ZKa!B(oHcFfMx&_`5?5^ z!-zKgQpCllXMHwSnNKh^C5;1IM)DJUjs#5=8%tBZ#w0baDauujH%hw{cxYh)s{rPm zx5X2uF9?RQVZzY-iZd89Qymr6ENNOtR8NO%eCj3y^4QKj;w;WJDV)>;tFvO z3cZB2VME|zp<<%CmCTA1cn6f&!W!Nf7wJhcf=YYIFzRiG080|D=fXersRyd^(d#jTDk4q->2acdWont^!4}U`-d?t7ZyPa`%)b?JXHe^ z@Lm>D6v<*cED!a*-=M3YH#y@uXPt@FMTwoe|5Tf%FW5}O+YJmT>;-%OJKj9jk>wY? z7Hx~DR;T`&o}mei1S|^tq7&dGuK&S!oF0@aK^R|`vT~iG?ipq=n90U7Q7|TEZ2r~^1G5ASnsAI%xW*FT>Ye&ZL+C4vhz3x0?mV``xG$^Fv}?3wOoUf7el z`y-%nI3+r^K0o}XI-s$T`So!)0pXdmTkkZpurmJ&5mAIzI<;T5NuE6|n=v#xQEOjz z&8v8x_#PIzISK}Iib-e+uK{!8C$X6q535r%Ueo%igKQmDs_*mq1=5x zh!t*<`mMdwRMY0#g3vaA8#rXN%}w@bDMqObeuZ(w1t9VM1OR5tBI*7X>y4y2>5I4| zEe#_x&o25%W*Sgxkvui|hacr#BlUZl8>iWeNm3S5;PFl&`#qq| zFzjA>;)fSyzA)n&U0f5XxFW>JWlM%%L+^w1092IhH+~#w5_YcKU-quz1!PqNqP&bCvl`Ltk|QBn zV>IIHF0AlFb5VBMX|}6CLvhLwxP&|Z!aBQ(g{v;CgpZ3giDNqt(uMkDSX7)co8JX# z(H8Ic?rn`Mqas~*zMGn{)hjfWX{S2Jp^za9$8~{UpK%3z4ztd2*cT;Y7B5zxrZVih8JKzU5bHEt zzUE?l6!r9ak^5|9rI8_Bb8!wf4 zO$!#7W_bQNmX}jZ^my0cVTHZ%vc5D1e!s{X&aTnVaNa7>x%N%0_3;y1y((r%aB@HG zc=}uU*rMQlY+J0&3(O^7WIIUNcU3C7eHQB#_#p!>tOf7PeBOVfi7Kk~d>75CbvCG) zI5}Flvc%ger*r?FED}Wa{hOaXc33ffv(Z)qju2|2F5-dJRd3ErZ0mnFi&V#eErcp< zljisH^KaY_{Vs;>q=(si8 zn3-dO!nDe~yXWIL;eERiNE$1brLg1ZI!|&eUv-kZbuJ6UFhTnkz|JAbJ z%Ya!AlFdy*&WncorTMJc`_qZS`t>SxOQXvuJ(`(>Mu&RM@p-~XT$VDD^}ZuFFIITa z<{T}37Fvt2>`a(Ww&VK#e zys^L;3HGskVQk(LNNju$#g~9wN}r2-d-1*TKJHTJeyI@n{KjOlsi2GoVWS7n28jqv zjXdo;4GK*0KQ>IbZF1{wESKP2{_c8Q2`Dmnz2B_#G~RZ3VC>q?God5dwxsy`1*qE3 z3>OOQ+-V7e*rxl*py?Xt@M%5LfWN*z^M+#pmmm6{wFG zQN3~%i!hW6nAN$6T;y=Xyw{#xW>cAfa-kDTh@I<4%c?>SKOYklV3v=uFWgy!E!x7G z`}K7MB{NP^ah;YTh;VjCyog{gM*b|)Z4sYq2xCQ!2~J(?|!!L-@t6( zWi5hhrXMGhl6#fsq*ZJ8+tvtmnu)AMhW-OUkT;nc1Q3KvNlikktxr%Gpz&v2W3`XN z0fwaI?9)!pnjoW8d%Fre0KL_SG>9W0iz(z2=7t2DWj40kG?kc`ZX@l?@+QkNpA^v8A zU!~95nqk8j5`j=J6hW$HEeE27F(p$S-1HMSG9Wu>J?nFj#!Qgx0l>!yH2r{-s2T(~ zPXsIX+~OLVVXrbj*n&tQm}rS;MY`eVP`Ksun!);Gu279-EI`DV@Cm?76(;KVy)4zq ztf2jKdjbCBM!6cG9Kjd;kmbFA37{x|Dq%jY++prr*8T>8SJYWTih@YW?3E8Q>Y1aIYnPHJ+u6 z;!M^`{VQwj{Z3R0DVP*9SXK3tDL;#zY+tRvvr@iOq_-VqTFbNu3M6(^Nsowj8n0cC zv+bf3anlKTJw+n2%S7?|HL*ok=LZP^e}5ixvykXY6433uR;o4`RE-8wr#|m?J=amw ze%s}*T{&1(-OR>s;(z8fe4fTNC@J1;XjX=_Q2)Ce|Tm~o3iP;L!B-;Nm`sfq?%M!0=(7EBr8aOCd8&cvyH;0rcD>zajP9cq@GJk% z46l(G@d?f=%(y-CNYSrwy>EznzE|HA#{0RS42`A51NMH7H_@Px)k{>KH(-`jn(bJP zn$1{0)ko5d;x+(3=DA!3a;Hy_!8QmBvNYzV z>LV-ZDew9Nc5+gLy?vGrTI#3T=1Yi$?A5uv9 z4%wnrTMWCm! z+qO6AE>^bf;xgQfydj>2$Qsa$yA*le1h+cMW0g6`pCwjz+uhJ_GpQ0JIi6smiejwF zgLR*I;6;f=b+jx5pq7eU5CjjDPtpGM3XeF+?|fb#0eoCagrc}+pb?saeY_L{Hz>E@ zW>|_&plY~tOU`11td|-g%CE}#M`+^qxw5+|DSX=36;gDbT`Fo z_zxgog2JWZa2|p6=A4Y1BdA2sn$?<1PO^D>f)iHlHp?B}(7?c(RPtMHl8&wez*Wn7)N)f#8M>Kh2~@gRH@-VLP{o!!T<*d)af1iB?at&Fk>wGdoh&rhK{O ztT67Up|?MN@AnEa{O^G#<9@fJYB4{eJ?~Bs{vG03;Z~Cs5!m*jT8&ou+FzkM8*Y}U zuk~CuY(B2fGoreiX;@cnxqC0Xcq=t?k0Ak~P>ZDf-yOzPPuZOm`mC%jJ`E`fE!6>Sh{%^sK|mX2o(llLMY$ zBE9~b&GYPN3(n1ve*q_I;reZFel}=9TiN}EbDFYoy{k~Ii+;{5pTKJc`eDhzHj2>Q zco6Vx`prH!I}VApmTc76xv#%&Fe%J+fR`W!whS@Y6jo@C z!2yJc>AK`qJ>Uw}a;K=!O6QawDNc(= z9L`tN^tg|t`3rMha6JqY1jD{hB(xWV3JDYAK7BIqZwRZiO^e6|%6h;&Nawgku+sPc z?Koks;c&d91QP*Ne^P^)dfkOiVVUxC75pRjp!zs{%XRH44Ub=iwRQ000k1UP(az=h7kP!`*M*Mt zM7(V=)(EiJ3rWMUls^MEMK!s~Go{A^AxyD)^38#+UjEhyzrO}?Lr)U>6aN9p0Wmx( z3!G{>gm&a~XBtdEFp$1Ks*L#~^^*;Pv!GEME4PO7tZ8O`)KXr^tZ_nt+@q*DI=uNI zW76IH_&*j9%ced(`6_fl;vu>}3Ch4CA9<&Kf!v5%u?DwtWMhrSDAOo>eBD@>>rL3G z4MK3$v-MDaqobQ80}#Gn7Ko7@gEa!h$u$RB{JvU;1t<}TA2}obJ=*GZo*I_%?B zCQ%=%F<=qp(02O~zJgZ%Qk=T+B}9|uf{8Q>8*jz?&#KGw1Qx4-+oiWsjtAGsH6;-e zl(bZ#l1jsE6{LA?12wcrG5%{5P?S(Bm~e$6wJ1_0%cbEl6JkkLE|jjSElfG`>uG{p zDTql&uuS;)H3Gkn6k)rB;^Mb1K8r&6E!Dx8{I_Erp9RdHlUzWLA$7JLw&6WZ*h0LB zylfynxn#t~RsI*%lB1&B?^C5PL}!L#Pt6gk)qp5#gtqHHw!mWq!)5kWiXh-iBFsbM z<%yDva@>DS3o@YFjxjfq&Kg>FY78=OG5ZvsS&{@|5c=~MmQr39NApGQ zuMyd44L}}|E4l}_GM7^YicOG$NlgS^e)lFcaRIFZ>aZ+RYcBVA=Y*@Gg%m?mz($J| zFo~DMAqlCTk;n1?r;`6H%5ybecAEWx%#zP7Z6hw{2(NqRgB#dkHGr-wtO|s9qaW=M zkjno9aM;qmK5*37|yxW#Q>A zs0lRq>fQGX{#VmDk*L;hf>>5-1)Q8-7`!gq@h9D;uYyFdxW14EBN+BB@P)W1Vkj8} zg<}8VFV@-CeGIl^?7k3Er6gn=bsRc z*y@-|R=PeD>BcKYzP`vbaxa}IVs;P$8%xClHqa^3!ahpUj~|DcYzZV-@iRV)>+V znM$u?PQ5C=A4oBJwV8!W4~>c7SqA7mNY8tF>iwRpgXTGlS+S);?!TX>DZQWDAB%HI zf|g_AB^Qo=i|4Y@adkp+-U610zU$mE(R1WAf44PoBqqU-B&)lObn^pmmq@_Q;!~l* z{hqt=|LVJxg-QnHvjsoPO!T?FnfNIK=RFu=ygc?I(C}&tEV<$7ZXHw6CZDNqX_q6X zdlu%_Mw@$u+h-nYAD(cVlhqdC`vXWPQ)y~0&(@BP+_j`U04Cp}ZGTXjLzX&)19v_h zT$HTWgf32&)_lN>YK*li89A}Cq4CdN+OHo8?;budlewHb|2GJq&N8CDPcNh8VK`Y>XEN$% zBRBYx|09(=V~yElNT0`m&*i;KrnsjV+UzmY!#FK>xTma5B^9MEv4pca0{ zOF(OELJuk~?J41#HlLf)AA@GP6s)r3{LQaZnHP95hLB5-o4q8GBO233R^LUO=cO{0 zN`gc*6pjjtHdRl>q9a1WnF`8;M4*k+3<=I~N?2bRagi2|JpOjToCjh8UJ1x|_-fT9 z_b#1Ui-+ljeRv{>)dRA!H+ZK?aEY02(FE}~jZ*tdL1g>QC%%l6y5F3XB@mGXu0(S! zmdr(I%x6vZXy;_$v5>2d+uj__Xavm|=3@K#--=Uwp$#dzaQlBZHx6fMSxSDZqa-|0 z@U5xV+ZLR4|BbR-LCfJfi{#fxwXK_`!o3gAehk6&vOB?#?F)m+8}{R{iVc1X^O zd>-wvkfnhJ3qBptm{^7c)JzQ^O{F+0850+F~vwwB4C0mg%z6ays)ZkGbMJkmCm zrC~4G8*9;^>tq!ro}sFqcPPSKz)f6NBt@C(RxeQa-b|szf^o)Dyz9Z`nzo|Nr*3B{dImRnpJkT04W)3%9#y*>vAWtXCsXTiq&p2yW zYM#jc(hBfnXG(%P!3)DHrhpxFnwep{85*m6k|>n z{?+$=i`1uqiJ6(17y)REwq8H-j^e;ruHoh~*m-(l{UJt~B!v?V5G#e}V%QkLWJlEc ziZsl=h0v9YFN#`c_t|!H#@Q_SK6-D8UEy;zMCv|;cbmTXRotIxG4Z#Xt~6KoK02tCZO3U_2E z+t`F(44c5b(HgFPHogQrmg9=L`Q!!{X_X6Ee{-5u*iI^AL>-@Wu-q9;!jpJ*_q26u zfkGf~lRw@RSgIjw>yg!7_I(j|Il6843BSdkJNaZ;Rt+=9(RWd1+0*|ZXbfBL#cTsT~ zJYvr~?x@CFf6sTFHrH*9BS|HiX^k3fAen0XMZ5L-YtVN9(smr-l?Oz=FqhT4oga)8 z1iM1OPb$7RB3$j2x=G%7 ztd?=#Pl2ob@0wRz`58O42Teh3r_k{vD8PKMeb3YTj#GbzrjM^_H z6wzAGpS`8g=-j8n*Z;AA^u1y4h;!N?FJ9=`K__T1K0n{B2N>Z( zi%?x+eBI9Ne6MfA#qo=wu^FuX?Djl@hkY9wNc|=Rymv&!=0d1_A4g)8>kSstL&qbc z`4XOn-$G-oectv*%K|Q@o`D6i#$<_?Jh7d}Rhx}^S2xq))^5+sBIEnvA-Jo<%-*~* zm*zcG;0c^~D{!!{MhJ3cqoh36=z+X7On38c5#$qfXg$Desr6g5^42~Z6Q{FnxvHlU zb_AUZ8qbLR0QQIfGeD+xpaWWY-M@X%>G-NmKbY9~IQZRfHSYp`t(B|XE%p5*_`$3j zOrAP+N)>!A7oF(1JESb5+EPc*MM!D8`9-NeCrS~4v`NuJ?YG^%zVWwJDUfA_XMNx*pvZ9J7Mn)}Hy z^=lq!019?eM7W#;MfhNIBg^p68&MTQy}gnDz(Ten)CMVWI}S*rbCRXINcX`xj<3n{ zDBMS{tz^+?#z?9lUkjJ8AYQVUqN1NCtM)}yJ&HZ=Pj}s18*@ob<2)~n3y~f#Xx-n? zu~<0Rf8$GTORi#k!q{32_|)Stb?BVh1U8W6@~1{^7}_9;sCV^$qM4s6-OP1=5>zd{ z%fxv`s6M0UYz)u)N3UAEe?OSvre8@UQxk6UQc0t(lBEA)$U`}~V@BQwMT;-Rbh7Tt^$XAR?MHDBjr$FCOynoA) z{!0<_8-G7SW+(*qBJgUf>ZiCrR%@O)X_2G#?$=U!U?NMuTw&L9l2iS9&03Vx^)O0O)#3Kzs5@=h zZu2gS(fid7{M2AJ?hf%-N93JgwA)I7;YZ(m32qkfsNYNKd=ev3&|`O%^|@5>yUAAY zds~`*9jDKEEqQpI<+Obp_#5!5{7mwCM-T2e&v<~$y1#R3487NPY%3@b`wS;fTJeDV z{+hkVZgz@uZWd}yPF5CoiO!X`&cj=Nj)Ze2Gjn~CSJM&PXjh1VN7l6Qmma|K9Q zW6|nIPV{vAM1vE|r6AYcxQ<_vgdT}-WR79F`H~bcg7QHp)rmXuWR5?+-h_}^3W#6K z&J7AcGN`D$D<`OHNQxn3`5M%n8FV5I?mizioRdJXg zI%yoN1Tw*|s%C`LpUE)(_Jg!RRyolEBuEt!D^Fp4qq%OET?+he*B(h~av*CBB7V=h z!vd9zbSX{PpA-aNu$4o2@WdDU54ozoZZl>TjEo*OZxt>d?!5HZlhV_l&)RXv%THD6>*Xm1 z=ouy&IaK$v!&fg~S86ui-WqrAS&t75+qLDALg+8cX^WoITO}` zmE5bxfpyVbq?qwN=)t30vkzSr(U>=k{k^_PXZh$smbYFUPo@pA{BPWhPmi(e#1 zji5D#oJGvkdU$l>rAj`f7Jd_ZJ>iG@#QUX4ss!Zw@M)7ecOtaJYjgdKLE9Fd&sE)t zV|67lYCW+Wm;XkW3+?>_L zA117D7T@#wwAQwo&F(DHb5snUJA%$=_Gi~>ON5A%&m*SNQn0?{NS%0obvZip`iPCJ zosuP#q2il7ckH-anVWgv(r@edJjO$v^DnFJYuVk?z(vy)(KJzwEF(ClHV-iE4Sb6@ORhAD|& zGkDD0m#W!U&+w)F@mWKq!j$hhe$uMRAB}Uy7IvICMa_vDR%WR;EnXg@mLuO+82a}^N7~>5zj+Ktn zWys_A{)^%ALX1_dnd%ibALiWttslKHM|KNz+_eQ2mtd`AM_c`i*IZ<`XtLl(95AfQ z_3SvxlViR$i?W}#~%el8RM~ds5Q0%c~%bl4%x&O_Y(4D2&+U5kx z`-M6>=`&kQCD-c+@}Q}yGv6~w`jI0eHw+HnIAd112Sc6B`f;?G5iN`5keqEdUG*|i zI*zJ}TJ9l3$=~WWGy3ce%C|C+5B4i0p;kmHX^L|K4QDV-uD@YHiM=OxT=Y~{P`;Im ztj&b~($*oy!t*Qh=efpa!n42RB)}p-T^cO~XS?14DZSZnwm3PD{;kx>XJ`i5!YAeo z^q2Xk%abtP$4jO+Tl7L`zR)Q_DpxrH-|D+GqarJ89l&%C|D40Gs<_VAX6Tfs->`hr z=<(e&blIfY>s-BL{9tjqgb0PC{iUG3bc!iY zi=@LC4gQR^CXS}VG!=HdY~oYB*?T_>0_HOy{6Aw=|FeLPg*u{HE!>3H5aDem4I^O&OCX#KL?sSFHOk* zT~kL@ZfRR*DET5X_M6~9@A+UJM`1|Kj%yx?&zrrh-f7PC;R92V;M)&fL&bs^U023p z%19l7c%`TLE)T0|XTIcxD_P+i6)&ga^Y+Q(lB0=K=uVCdH;d(u<;fb>o6Z z+r;fSU2r+27E&|6Aw;@&h-Tz3!A(^X;xtWZka<*LRmqbUdvbq5u=X+au+LxMsBa`- zFRvZXj&8=N1v%mO?WM{UOKp^bGRL=*j6#&)_A;z;C#u z=PIGc`~EdYAo~_qff_Qn0z9MLHYLDomuW8s-Mcy&+1!cAdZ|fi#2KlXPjw1!0-QdV z_Ybd-&CVNgKd;l!?&phD2xJNUecg-yzUg7(-VE&XF2N6(Ww*-FoL_zZF!_2ol_YT4 z#=ld)cG9$#58A8(Z5(Uq@3MBm9%*UqHg)#f=@o$Nu5@e{^?C}dNboM+-iAqDwnkM> z-=JBC_zFXXP?<6uj(PTLL{+!yiSO6 z=$6p{IKeg=w zKcAc7_xt3{mlt-Dw-q^(mlb-Fw+Xka0HB6lGGzg_?d*Af`eN(4ffKAy#{JInNgGWr%1d3Elk8FTG3ICW@ zKzS=A-|#ekK5}{Egn;$*p-1()h@=2~0=XR>TFoi#c)NNA5nFZd)-A1)Xq;)RUx^N; zWS4ip9k+wBD}&h}XK`Z!?=7sWSYP0AdDUC=mHxII@VWVSJiI|RH(%p=I`@tIK5W=^ zMcpa4dp|Przozv}eXC+`<5N#TK(5Kxjr+*c2in=f#l)fIw%2}e-x4Or z`l%&`@e5Qau@}fCm^4WEXHmR=#pstIWBXmdhlro^bo4t!vQLAU{(a1d(!jUzRwgFN z=c+DZm4u$0U!OtKb$GY)H9>+7>|S}T;FtZ-JM@ZtuKqm{h^bpWyxLD9bl(CWl#_K5 zW**#iPi#!SsYGD*bOXQsGuU)qH6Ytx+I-pM^f|J#d+U97e~hz%?T@ro!0`T7FGPRz zNqq$LS0a4tGY|4|Z~YFYYygpNb!8>#043Bh%`cP_EX-TRWa?BSdAZMmoTl^@e=Tl| zJ~V07{`%f__c)hU^Gb1p9FrV)3d*MG*{!=4@Tf#_d`uXYzHsk^`@IQq-%lZ~f$SKm z8F)7m3P0WqPx<)RtOWCyESKmIb@#<3fqOw-n+BaXA_gY!zGoG{i{9LDTr~(Zp^QN6 zej)dJ0N&a`i@1d)4u=+6tO?9@LQ?NJKH$-=8RyofmN-ha} zxg~|gW`&u=B*a{`yNeRO&jo+=z0QXfx??@_PR^dLZECEuvIsNrN#0Hj))P{+Y%@rf zJGbKwm+UgM?e)*>{BE~HeV-z8IG=q}h7NDICXjJi<~jL#E@maN z*Sf$*x1CwTt%AmQ)sFeT4PAjpZGkONB6#_t{zn@^pX}T_`MnT?Tm-Weihm-u+b~RO ztLc5l^{X$=TRuR&4ER#K8O!-;&u#@2=&f%PSF)7O>{Q^|GnKORrk@k3qRI5>@~V<6 zgrZ){h2I{QjFlIGZB)WBf|lEe5apQnhlb0%g<*c*Bk zlZA$JJSO?(CqfSC%^6e-G2%II`^4Wuk80>dfB4IzSlBLaLk5(3BoCr!tb-W-%LRYR zUUYmeQU2D%-T9HBCbHk_2Noo;9h+BrE6|==} z<^^(%XJy80as_g&%;Ui(A~=G4IaR^D#0+UinmGq(SFG}+8Sz(22SkLRw0~hguH& zjM($gPjOLqp^vJc{_GIYuOsvaxIEKP{^Wt{j>VUb9#eu#fhzrod#5PqB!VKOiU#s0 z6U!!ba#S1{C#ZxQ-HIAs+4gtH9VxKUMbH&m$Dd1qt<(xvI&Pak6!HrsRQ}{^4>!iV zGxIWn@*!}4k{|xfmN9Jm=@WB&FHcx#kXmSYdS1kJp(0vwypqQ=h3AK75ZVu-fpcd^=$2X#(3aVeTVl}ddn| z<#&b*X*4r|BD#O>z=Hr`km7(((03x># z;!?>+6_>;iEdtE{a>fvI8YXd0ZKPUWM8Z-oKd}K#2JdPKh#)wP2n3gigK zTaKiG3Ro{>N`^2de8eMMM}z>eaB`Ne$1;r-ln0=YMyjPc&M{K00(G$p)&JGN8pI%h z?x}I4d33(V!>nRsh`uu`SeB!RlF0kKlIlde_{%I(?j1z&2F9!1 zJ9x8iC0@cS0hQ3dSdCsE(&$Umu*P~!zeX%_pQbsHj;T(@h=J|t#p+3S3#mv{t|KyYu4YEAar8u4 z8K}Zc&F>%}&Si=WqjG+oMy5?TZBEbyuNICRU)|)3*XkgQ*1{ul(S)MkfSWuF6is-->WQ)a#wuHz~s$%bf2DRMCD$b+JKv0F8(q(8A#a$k^ z^sJDfbjIilKlezed=ynkEDydp4+L#&9LPG^cd!N^5ISS%Ss%YDB+WvD;DwQF^gX*D zbfY$SdI7BdJmJj)<5UTBm=*{)gFzQ$<;nI)ErS}sH@u(f0MTH&AQ8I%;nCO3g=MU7d zEa`;a@@)?2oJa@vJecChF!fyHHV20U$0xjK4plf}^45>+6HyeHV1hmj2k!f@Z(w2~ z8%Rah!6K)&p+ljNv?h_rj+HLs?ve~WcG|UoGAq#quiraB#A30iy#w}< zUVn%}6Io#($Sk17ZIJUUPzF9tXNn4=7EE9klp)M{3}YAS#c9DC^7y7MHa+~~KRkZ? z6AtrNR%SkO;=mf9Y4QDT*GIcrKJwDDYr5*z1Z@9ppyzjw99q-fyvFbTTub8}zx>&| z3JZ>bZhjmGREb{+WkHQf^4!tJP{TCo(h4u6{N&$0n{e_&b5o!8*=`Hi-{rO36mZ<+ zF|YAi-l03*>0e&sU0kDEe@C}|IzR10_uu{T<)t~Q3ui&jLFDIhP;x_r>KuL>nWF>U zhbWz4h!x6=sQ@V=1d18j0SdWHP@G7C;P~1al|e*GsS;2Eck#!Sg`S&Ap<1g;qR}AR z#2iJC=^P^mqL)At2}ZSHQ1k)3(8}zdy zNG;b1kOL&wyg|ndiMS^M$v(_CGT7%|YSJ;6i0qpi&~BvKjZnVBC{}2+@ry zT~(+O*~@g;xjjVckj`0{Qx;Vh3%m3nwGKi-2MQvA{VN)eOFjY#XdIQ?C`T7^My9$# zY*@ZQ9weYtgQ!3WL+Ly(fy@Sl-~#|m%o=J!h2%@buJp?Qm9z@g|5bnT?Pte?Of zl-sofsxl(rikH#7gR28W82BeK$UeGv5XBoCe|>ug3NHaBY_1&wn4oF<%Cdop6-6;M z0Xd6GWn%4yoNzs`s(85y(z2GlYR$*@UojG~W=LM7!ySUtOB2)Uk@W=gD3(u|vN3Ei z2g3wcRyYCnA(k5~6Uai~3IdYQHoOb5OK6CLH*SrC37B)RCzOjTeg(~XS-L13WMR!x z59}8*&EF71yQs&_58$yD)C~vE8*qUmI3&mmzOhoWxcmc`%2(yu6ZCoLez;`CBr&MU zB|aM);jTTFR=6TQ_0BVE;RhDE?E=9f0aXDp^}`*dQz2AA;6kd=iY&(b%`@D>@(H_z zOL)+)dHC29s}?0nQ86FgJCPv#Clp6z%q(k*>RCh}N95&WR`w446&DN$Ay0NXXd2MV zL_=@}#k>`6?;~)dI;vYvOVl*Z=95^26*)toRT6P0l zm&yL|#@ zKXeNE92|$W1#&>;%z<8}t3uP3b{-Xl-9~{RMdd+V#x4)_77_7Oz4Gw`QCg5n*)fNY zzaR)}8I6iT#qtW#*K$M!Y6)800S%?l3hJO7gWSpjWsnqw0pUaH{6ScHv(ya|O=F$= zSyCTn12j&KAywGY9C0BJ)tQg^P=xhhPQkR`)qGxVlaZBc0roV?T(`Xga7+YC0Ej1y znBUNG3L!C$atMGUPKiG?e_)zr3%c^fs^ibAui4 z&rex1*>|hk^g*xX1Fn_#+GcO{T7O5gzt3)dm$v*)zxhM%rBCK0|IU+-|5^WFGe2e~ zN@>g(R0t8hCXOA4CBLR=bIoU**>?Y(Yuf7nz-9S}W_q{Ra+7;yO~Cq2_u_APOdoZc zKjpCg>FmV+JbL&O|MPF&-#^j|p#USYS`8FL7$}FZ=LX&}GW^%o2q=p!1RzrZ zhqIteaY*5C@Ia){Qj`*x5-J2e;WVO@g;Ob!8mp>|AjK*eo|d`q#ra2C;aC`h9Wx~c{{xg~PK7Y0IiWRA> zZWXZRw}MD6RK*a&iGJ_kYQPYNbP@nPfVCyMcM!!J82@8?2X73k=P5O90T>sgizMs4 zJh9YVuH|LZ#DaNh$+?`7f3|aQm}`lT&;R*|pAIREO_$s2^wKMX|E=|Px75{EbaZqq zTkM=BSvM9sJ_VIFvCyCnxX=zg;IJ)CR9EJwrk-kOXfWBFa8;aM7%u!h2DKJ&2Of^4 z-vN6RE0ITo6+%PG;^Vj6urzU&gd-{E#9;Aot)W@3IULJN3yWO3{SK3LeqqtXjD9}A z5rPE~g!C2`r_> zIn&I%87nC4Ye*4IpnZ`fSO&j7I^R|YuHki?%!?PtM{Sx<`OC-*p@_9jY0KkHug7V# zn@yU>H8wq-pO-Vx->cSXH!{j1#9vvbB;gZlC^b4UzOb^4TPT92Aq9={!&=1(Y4Y+> z3MB?!AbhvOIXyXLF|X7&Hgpe+*uCOIf*KU2=t!3!3V8z_*X-i@Vhj(@?Sos>(%g9ZOmabC+4$6=6HWx`0<%~|$s`|i^Y{awhru#qDc?(gF3Iz<@Pz8ZmZYlbZfSS>2Y;T7b2!eP+s=LM2x!2 z=kNv5P4G9l`LYBJvpKkZ1>$g9>94RO$n3AVbFMmWT-QImPKEhhMgX?d%yy$ZxBO`5krzzGP9u?k7H?h&gQUV2z#8a z#o0N!$|6Me4?A8ljUte|&868OFLeJ5`pC@hK|=88M9m+9-XKm#4r4#y)_r!Ja}gbT z)5_A^+>FcX;fVuwCu-y5LI!;<2ns`=YAidU9*;IS*bkCiUJflPgrY|}2%QoLLbYrQ z4$HFB;dT338(JzVtCuZS_~^(YBEJSuvor*9efAEJU#xBM*<=ndiW?)H(#33xE|POG zOvDfoA(1HbC^up}K373O#$W#T4?q61Pi=VabNAl$fe*cZ&4YKZx!C*Bpy@-p&=X+k-c*~0AZ!Nal=V!m%RQs8APp^6CzBS*tYt4^;{N;mt zpXu#wG`W^Ej9;Ojp#Z55pL+*@Ymp+oH2@+^fd+8HRkq9lQUPLDV3@%0T}n-fNV*U7 zDjk&?h>-}>F)@&=cg?^v^PqrY zSpwdr2FRLo2~asoVS>W4g&e9N>Q_xDv4@*`V^DXE>I78!YKWvq!bn7V3j>xN%8nof zOl40QAUSCoVPa!c$wztwqkx-eoW3bBgBa8cq|~7Ll!G)U<-%>_FWihVWK^w2W@rV4 zLfxW3a3QrCMN}Su%C0aBl(9-;iAV;yM3=Ees*@rn(qgz;>W3&&iN z*sI~{6mg(d^*9oZ%nBF-c^n-P@)(9euHG6V8QEXFjGjBVIxvKRe-cCAME4G&cw^)B z*gLo!jCmP#N?CC;u=?{UIb6q;`kMUI_r>l1;F+D3g?}E#%agK+5fXOSw z*9Tx$g}j<;dGX+mts_0173HNT;}dev7sbS-PE46;7XcJiToy3xBJ>nzCZ)z4n7TOZ zaJa@sC-?7_?k1ym5`ptt~4KFAYv-`DmFT8jn zDPv~Yfu%UiApYb(%j>$`dvfoQ69*2Sj*l%Z%+$mSd9N1^Psnasnml^gEhuDPSf?&Dh@FiTJ;552?YMEqnLwKVMjO@OWZt&xrI-m{~!XL1<{IzdwHe{+7Cim6av4 zZ7#3y-1ePE9d@;>dq56cF1~IMbSqP^v8v?fKmJ}^?1}hO$%%>Sd3hysvnHqtOc@?! z4+Y(RdLuMeyspZUg75w4yN8Y+JCl-eCONC1plV^+?v_&?uw@W(-vKh^wR@t!`QXkM zySh3`D{HdTGY;=Rke7b}ZStgsVv`Jth(bQMedYZ5jO?70clIOc0MUFj z1PK9v~^_}!}+-vUMnnbb$LiM z4~c~2XosI4XAOiL(-Q+bwr_rEF?molH2>-Z$dl@c`0c*hVBA;IWxz66226 zRhA9+4Wl#KJ)r*z>66_>b;RbK#I)XkyPXogg!$=cIRTuu?;`} z(Z`27|H{7fd5`lCecGp|CqFnl@m|-;y8`xGeb!sGr8TC*WPNW@VgTqUVgjc5X-guw+ZRq^nC0d*^a7)+QgxO}j> zfI))-Nm3FKq9Q2*5KY~W(s>N_z!KFNJ4ZlJYe&sC?C@mr& z#o?WlAh*f*q@9ONJo3mL%M+bGdX~Z0@aqVDvL8Bk^)X-*Mpk`LD@oDg=!}eR*Ii{C>#ahN>r$vOhaKJKzWdF z^>rSAx`ucmIhIw~Asq_nt>9|1MKY)eLeMRJVQ3_YM^717st3_eq$iSyp+t6|tEwPw z7`5_0IKY%@3M@ek zHTeuDfEp;HK@&nLt|&3M3ui?=YLFWxjbs%I6Dx43Ir*>d8MjxZ7*W&!b^z`h^^5RNUV_V+pJzg6>?`dT|W>RYC!rW_uB zN8jYsoQ0-%H+CBu3HCWH)c&~6>+>a4G;85$b$I9(NG)s+n$c6fKl;Pa@{1Ta(R zgTZljJLcwQs;a758tNS;%ktb(eQndiqR9)+;Cb-?9`_DJAUs%s8hW}1YHI4*S{o{= zN^4uXMy8fDx1!cqYatN!0RG%I^YnO4Rc&>B!~D|Z(#m{EakI-QrX@r!<^mQ-T2izd zd~WmNL|<24R#s8o`Qfhq_NI=DlS^)8uLk%r2^cVZ>PvJ6yw3iivC5j}hK4$)!)&!I z4UG&gnB-UYpea0{;bjqW%Z(C`%i7h{a3L#uaG9mo)KC8vl+%+)1U?N|}>MJE!fEJa$=T<}mK{(JcA$KO!t0mQtu%W4y3@Qc(swp1{rHKPjI7k+@`{0r%PV$P zPUZ7DVLS5p4r#-m+hv(-uDuX*@Zgr0Upsg(zM-Yp;`V|sR4>{{g#iyRvI9JRqO~;F zoz2Zm&&`-E1MON_SoB(L_7(Hg#O&bE#TBcK89_365G3&^@ACT{)@9quqIG3u2_tT5 zVPVF!qJdx#&Y6m>K(}bPhde&N10Jv0JY%uUH#avnG`3o;m?8{oo=V7_MorFR)3Nlq zY#yg=X5PH8>|9z{oSmF7TO1;a5S%C(&fFxEf?Ck$a69HL%M(LAJq`6O10zrt&5jYL z`sZ3e8U1MBy6qiY1E5|^ao`#)fLWQ?eb9V#vD@nz9%*^)wFiIl)89ILnP^&aLa+`t<|i8iQGpokXw|fn_E=eON#U&MltK8a>4iD zKM01h;YK+D7Zev_qyf!vG75K)48XA8$RPlbK*gz1+~@>BWS_H*%AgPwa%~Eag3FK) z&UI~Il;S^eZRPknW+@+5k|4(z<|QZeJHWS`MDw8tZjaxIZsLH!*h2d#&PkNC@N1eP zF!lnZA)A^I0C?m{FEHid5jZXYQUWYVCrj&`KzMOIAuKUPq$DAQ{lbZbj8i2L0ps!k zRDQ&TZ#AIzRYwMWUYDu_loL^uwXqQ7gLE|}_z-nY9N$cH-JFh zex6BWG{Ds)Bwtv-Ek(HkMKgDW!s#F$Wg{yEu2gSwbjgejEeJChwt|p}7N0PM?goDV z+=5_bFk965|2uhKqMoSVL=fp3>e$+sCOC1V6K=Vf&7;Of8-2L4G5 z+7{hAh~kZnztOz|&gQg@WH%i)iqGS*_V;ye+qxww;dEntOI>YKeM`sOvY7{!eHv^< zEH-LgfuVqTJ?Ng#PCfqgQ_ojbwbfKNG&D4gjZbS>qu|ewazzs-HWa~1(^!S`?r6;N>|#w-b?k{#&%d;{u62}C zD5wp8p4Jgx%-*@n83$qhRi6>iI znoNreIT@LU_8#85>)_P%JP4Ju*`%NL0oE}1R6bL0TiuR5$LE*41Kq8sP9E5C=-}DX zYQAn^h@G~E*bKOY9pyg0e^>swyvgaQ?A(l#r{dRd++nrD+T)4{n^mp2Kp3wcx1+PE zCMPvB_bwuGcp8(-N`RN3f)l`Km)C_&AF zY&7GYZtAhOz^txq# zCkU(3>GxRDQj-oJIX*ZzF+Vj|T3ohs@3HQoN!YIxA-{adr$4YfVZ(uo*^8YAc5Nst zFPfg7o*EoDaq!TY?6Ve+d`p1V3_6HPD_r>8PE%P?Va(BE!-FH^j3I3RJbCo&9#pspHXu!J15Q~O_e zv9!EsY-VC|iaZ`XetK-q2120WFep7C#dn!Jw(YbpYyPN$U8qbb^27o+05LF;}~aCDQT&PV~#IaT+~ET&QYP5q_+E< zRmJ(o4<8ul>YAUP>S*hJZP($ls%E(_Vgbb>6Lb(M@;RVgyLaw66@PkSVq$1)_)K>0 zu~UhQOJ*NG#HfjaiIPJ+m^l3I@zH^;uWXKsi)(6VtgXXb(Y4~>3kkG_11_EYLk)ut zfcS;+{-XzW?cH~{yt<{jssVoW)ZDzr-J(^~mq8r&D2s~Y9f7`p)iYvmF*H?$N=)Ad*AZ5Ie_+-(Fo& z_{_6U=jP|NG&R@PHg)!lYV;Fm%hGw}OF;Y$0_ox4?9|2GuWdVYFs8Agqq4LNMW*MM zpn}}?qWw*jB3}5?Q1znx?Dfw+QC?Qm*wj*8-8wWnYj?xBico&Fpyp3#<6G_>091Ze zcB_Z1{`ro*Mby0cTQlDFW^civ9q_ zaW^h8;-NBaeM`sl>lQF)VNi)9Ey~ZC1VT`@G>`&OiXN6H{`lA&ioofKx<5Pb%rEUY zkzIQ-ud#7t$;{T#uWo3vODIu|DrE*$iZEOP;SO_|kT%pUI8tbWm$)SX-Y688^jP% zNS~S4a*KQ7GU`v~HI_9ESv7va1WOLz91Am!S%^P`#383o%~_JpH4My$Tyn+v1}@&c31a3)L}c)rol> zCo}7-Iu_4Y&lK0qt~kjQx{2$T5RdNTx(HDO7_tidNknx$^4kM?+wjz+)uldv60wxn z=5=Nk%8w}?I^%F-s?(QT-j?1GvzhA!T882&^;0S*1*8iUN*-pD_XIIz<33`FO(1W{ z@e`oR>BXg#QrDPTQ9nh&?I$A-RKn!bduJ_meKTfF@919~UvOhM+eKWm#E2*j{YMKR zglq4x)Gi<8OHH0Dx(lF97&l+#OJJRlrTVUw+Vz z$H-~=vo*DfU>J(C55O{y()5Yp_|c?8ehQ$A>5vufL28r;ijZk9T6G0|E}qo~3GhIW#^TJ5ob(%!5jF7ih7X=k&|{ZJ zOg@Ma_5{Tk;NAgPE`d~$*Ujo1%dEK&RB^rr1@!YqgpO7XuvC9j0?gGf{8-n z!7dtdLptCQH6u+(U=K13>koV(=m0!!FS=dhgE^ReVy8-PUQ#pK0q7^E2USw+UMKp+ z6AHO}eCh`|p*fl&LAqn&fWZ=g!SB@|JgZF^1THT(MT8JkN2#MH>8|q~TJ*ak=(R4* zPr*lWXnv=kb|*Y)C_H2W^93!E9HoQ!7tjK3r`ut-S*&OgRl4|zH8zARw1O^2g!F?V zk6Uxu?6wuS#48q_mB7j(YzlWov_mTvLVy_fCXL&s!D+KN;X|Wec@u`RN7=m;PQVwW zgU#M>xV_F5^RmO`^vLfwLCe&a7aTS_ofR1i&@L)i2y(VV+Gc=FV|AzuN`gkYM<&lj zAwX&v*a0P)X1Cb*`}EWX?qEQ>Cl24SGa+}h)}u! zl<;$nA@HFY@gIp72QK{`a3Sv)WRm;i!8SneVD9Tx86@ueJ}m`FmoBAzD> z_~@G?K?CUai=uN=34@5FqQ~)v2<&Fo!=H-aVCQ5*edBH@XBj9DnBm9m?}X>*nUd`Z#Xos@*{7G) zckDQRc1z6J!uIKDpN@9-#h30pQMhS;dRf!B)vq`Ansyw|-*lp&q|dzI((}r@Hy_M- z`S7``-!605=!#xh8Em6sM7xfKrv9pYLgU9RdHMS1;_; zQY+^mc1ut%s@tDyxC>V&V+dbAK>e5~FoA0UAIyS_ z7`a)E7*PBfX;@ZXy{u_+=gHC+kDWc5RXwucDX3~IX&A8UdR_PInY{W*n_k^L-q15{ z(l8_IcBkGkuyQD|bkotyn!ZK5M{n(3*`H9e;ZW|`#{SL)=h2*own?8osCNu5=9Tq# zjt7orcRslCAoI`T$lB9`Q*bdoqq0U`OdVKi-8B2 z`LQ|}A3m3*ue~unE#<_ig!G(qBNNl8+}Jya*kqW+XtSV{*JWBN%*#zkPE9zIUR~1& z{|eQrY=~e^lNr!YUpnY@JFNXJO}VE}pGio~$thScS>bbnfq*)fDKnt>LZrlPU+HdZ zN>9y7IGvT8RXDli;C*-*;*;>f4%b|Wf!haOmvgAEH#aBiRANF}R&Gc4kOtmh=>~lK zej9v+5YK_riG{!5*DNdZH5H|2PA8v9&L}LbTsAvkyvPC6@JUPBVPShT?V+)5$4kFO*6@QeZO28(%SmKLfwS z>19_jBno0S zwekT5{3B3Ar;J?#naIlme4zuCXJuu?B_t-MogElk;IGZo<<*9Xg93u-F`xv7Vb?B9PRCcmU+ z(W>!jr_Y6cWOmR3pAEjMSbFeahkCnC9XWdV)xF6l&kT)CQdp3qkS<~uKJgDq9`IV1 z=P#VkJ%0SyfrCfSoi8=PwPps=OpPLoJa-^RQu+Ob{_c*$hY#;Ncq}0~cj)4R(+#%+ zlBPjM)$Ny4rOMXU9ma&I1BzZDWr_HNU1b#dY0!$wu@&{5PSkhsp{FG0Dne) zXwIEpGEj3--;py?JE>b-@K2_aEBbrw{8jnt9@A@QTPAef!6Bl4>d(&=3B(bp=1>j+ zq#6MEpgUzFm&<_6VS0D3FXnXjiTsJp@l9vS=I4F-3KB0`iknyVW%h1NX{#~m7rK3C ztESCvePZ4no7y<-(yIo2Nu?tfdaXTXJ*jA_anJ{E(Bab?y6xxdZRgv92}R>e9vz#b~pG$&u}brvJl@}sUq;2K?#q* zX_(cbQea!}%>L7@>DAWkhPm#!5SE1ILHqi+nxvW~i>CLF2lnSp)SGluNbj4_lJYy- zr}TqqomGQ+TKRIzhz?b8`1ORdJq1nfk|y8T(#45IJ*&8_acsrLSvov)*iodM6J>;w z>jq(F6|0OxzvUeTByjZwArLYafPxltdf6D3HcwD5Y+O87H)nF_HkY1J*4H$ypKtc& zRhyP9dQI2L`jd@&ixv-^A3KoQQQo_PK~Xzo&TU$FIiWwM*wQtxrR=3K&hJAX6*btkxy@GnMf)fp3?OdUGEt4pDq{#UvY)A z`R)3#?D6E{#iYXd)Y9?c#emJv2OC(Tx`w^krQ_$D#|M`6hMwStR|{j$jUBr%x+|;o zT%W6KSU;FO)H0=~mtBMc#N-U_NbfmXI`>*;|Iz%>_6a?$ptpBIoAKzU8%!sw7NVc<0q`Rb<7e){4+;rl2d}U2*W5>YMlKK#Un!Grh5sl`s^0`|ZYM*)H z$qN?>D{JfehA*1zE+dcRP&r8?mS(@lxv~^{aNnup$4iSV+S__;PCmbf87G#XvLN_m z(!~YNzcM?1Z2!)`Sabn#T=c`ZNdp*uM707uG(Nm66@j+}+(h%%{Eqey-1OXCN9B z4XH=^9^JQ;5r6R2*Y*^YHB~pXEtsrKH&`@yR4W|MK6tgx)|#E$UraxfTvlG)(mO;y z7Iv7pMQ~=M5cdw;9tWHx%gTKG@uP7u$I8pgYwH>&=T;2skCr-pHhG5Wfx{f|yF=c& z&gSCv>(}R;D=IFp>Kz<1JDtc(64<^x4d!S3X(&K4L9aRX=$>7>b`_V^*0l`Gt~fp1 zR^S_kVe&G#FNFfbyY2GD>nJ@K*RGvPC**r@cA{r$B~tKdgu06 zO3F$L%PL1E=14YOSuA$&qBSrJGU(yMlk__#$NIKx+?bMhrnaWBxutU%1{dmu2KxBJ znN&sD)PO5H+}~4nKJSU2{wy;+BO~YB%iDK%4~<*B{8>2ig=WaCw598d%M%qPxrerG zJ+^&!>Di*KFKrDva7x9QoQp;>5& z;t{l}2y_N$T3KkRuim)f`K^0)=N6U6#3ZMlIqT5;JR1V%QMS5xM8hBQxx5~SwY#k$ z?)bsypL^9olWWSvFo0G z?p#*>xy-^{+xCr(&yZwfQoYVX94L_d-0XB!#koCuH|^fN^L%01?nB3O3rp;LeU|$N zU=XTBHISd=z=#+bXg?W$eAAYfv$8Tyolbdj-L@4zga&%SClDe5K#3v$x#_Wr;({Ho zyb^o(XmxqT)-BtTQ*+RJ=pKlJV#M?r;+HR=Iv%HOtgkjTVgIwwJeQYOl9HOf|L~FF z$$9yOi)#a!Yu{k+;EHnx$fj~eBG&^@FOWk|cIyzu1U+KXV=`(cmK-j5|J!O0N#QY9Jyb3_if#jN3yFTrUR-YE@QBy1_w<=_&$mpQ z?M_`kUo~>BbiA|Io0Qg;nA>wAfAHl~^(~8f&4B%Ub>E^}pEP;ToNbu5=@qTxr_R+M zyUL^LT&4mZu9B+B?J3U*TxhKy`0)|w$EMCZaH7szvS^Qdjs`dmV})C z(-(%%)sGJ>STW8yp{ZRqnF*Dq2+L$#aeM7R`9u)P5BYHA59w{4lY8TeW3yXN7dI9) z4R#G!3d%zP#($MXl0 ziic}^tdom+S;NGur%DqlCU<7_oG2cfwCP!;T`^g8t>b17=TIl?7MVrB_4Ng63s*Fa zr>Ok;@M381>6(2h^~vWu>KaFu&HCxW&I4JEC-Qm{E_5}HTc!ef^w0K4Q|iE;hH%Kes2h zemH1z=-s`hedCCC-l;>? zpEz)SSiUiVuJH5oR&EaGw;4pH^XT5ewSgfF{F4}TKe~4i#Ty%cqvs9;;g`~3lQYP4 zfr74(&oVvQopdVpXzYoY#I(W51wKoZFXGa6RAp6jn6Ls~w`HX;FDEuO_P~*t@|q@- z-2?yo637A#uiWQ%z!~;>H26zt3Gs2qlTMsWpIBI?ae~^gpoP51Mjwps68sgn?$t(n zyUwJYJaqENiKMJ~lb8Di0e)WxEyLS{cLGy`AO7(YXQn5!volYeICUa`T!qxA{H(k3e$5 zAiIYVG{j@qy35hu)|ixh?8vEOaVckEBuOsH+0ZoUP_p3X@r}jV(c*&KxcHOsV_Q0g z`87T?PFIR&$Qc((Xx{S;4%@|^-ZQZYM-LoJP0OBGSmM{GkPFT!?RoBZ(AkGBdR%(I zQF=b>(6N}J%KE;cDd-iPx2!o(ni~{$t9h!btoYcmBQ=fH0~be@?ff;$FsGvAq6!!tPynCHHqg^~3xFcant1tV(^6EUvpauifEckPfmzQNUCV=>>HZ3IhAt`5%5SqoND>y zQ8vYQbNsIU=GM4kG?wq;+8T(Xb+$n4cD!Jxxx zTTD+&i93gNs1~tSwN)>?L`9+k=L&|oGarKgE7YsXXRvf_YKd?o4I$vnFmt| zx251-as$z;LEyUIZd;ivE4pwzHom&4qrP*<>gDbTh8RD~$FJ_m%Tp9gAn5gY9M`ob}1i_km($pqHiIh(QZ(dnjPCS*Eg1rySgKsHLN`Z){}6w(9WC zRfBNKDdj)QI}7R$oTx4mWQ1FTeEZ7{6%Fz&ZV$qs?(zlQGH3W)0jI-*>6+h0m3==K zw;FUeIyAhq!_b4Sf&4TmJ6|J`ZDLf8D)5{8_3cJ#V92?WqCx`QNz z_YQEA1V}*ylVgwW?fDXPE%6FGS`Cv<$I>Vt#&D2o_q1 zV3TLTq!XkJdr$&U$T#dlK`{ux4kl}kP+sv8{L65Vn?{5-ooErYUv!52hBK+*gX+Ah zZN&Zhj46~~H@z>pdc+ps>qxK*_-jd|LI`?$fpnKdAS_-+zjttTUMBnCah1Qgvn zh~f>5zsbD=H63%=;~dX*jMe$wrp2-13+YAYGm}#iW79H=>Ra9LwdK2mY)9x(HQ+kn zard=1CdM8JMsaCL%u)EIStpZo?0)`)1bqg$F=&E*jL++p1+L-Mjyhqb$g*X9Wmufek~T27+mOL!Ajl+WaCdhPGKApn?(QxDf(IC!06_)|mJr+} zIKe}3*N?n=_I!JGpI`l>yIP*Ux~i_a>n>J=-i0I2-MsX|jQx*s(+95J--%QiKkZ;E zzgjT7f63DvEW}FXP{uT&Ni(wJ`l>8HS}-RyCp-J@=gRzG1Z#ZJFI`}`>>EiceY#y| z!Dle44CdJs=9y-yrb?FweMysR0@jC3V#;JD;vnkYhMSJk`=zv)$&hC>h3d-^O5r^7 zNT^I|h%w@ATCLI7`V8uhp8b8f2h;{`-Sr%=M9lB%L0xFL zxo(1^Tb~@4;r_p34HBqS2inw%P_EtHUI=PU0-Ywp&rkZ0?f$HkX3rUWd!N-T*Blwu~lPrY?n9QEDY+mK@xg5+G`SRL%|MBv3 zanC)emMV!!YE_~MXrB9Fi+x&9Tw58ilc39MztVK%WH)=$V_t?Mna@8_a{r2lSHTbD zwz+5z%~n+wxEO>iHXY4(+0R8sWFR(Dq4ykdwI?9hl*W#zng|?}7JaM|UNl~)b3RKZ zDlgYhPpXMyFB~YqaCTas0Q?k_we9&lzeDBkadp|t{A1@OW9EW?qdUhr@*1~mS#;J# zQ0wvi-fIKs{AbIn$N9ASpT-MaYp=xdh&j7oA(k-sxaIS3j8irQ9>H;PJg7y!*dLWM zKy0L!{hkmlA`C=kXmz+E3Rd44vyKkWUu?vV3AgfGUYGaOlX+p-FkdeELEr<$pd!ObmcE(91NWpsvky;g|XS5>Sw%F~D@YsUnQf#x( z+mEes1dK&$W-5qf8f}_yY{a$Sp>VPG(XhI=Jl&UKMtMLiq9bIpE}#ZK5QbJN6sS(L zf*O*7yhL`1c2kyK3f==f$K@m9@0B)MAV6iPp+ZdXa8U}Vt;Xb7%y8yoOo}Y7_-79-!ZvbRtF#|d3MUGa zy)OY9MJ{6W^8HH>gosYEgvDa#X}rXkAh@frxK&c1af+EC{tXCqB-9~Jo-m&2PL{Ly zEKH>|h~H3?T}hUcMVvtLvvj;Uj=4ZQ>wU4ynONmu2n1I1>W!hjK1bOr!vcPt;90(h z$?TA5Q@nkZfHKrn_QQ?`8qQqkXHR@#&tsB*z2b3y**m^{oAE_6dhvqaVCoS4%^U9L z+LLYT_`$A^@sOuj{vF=<|}sS2e*2TbT;thHV=@M~Eui4rYMB3xL-VsSYs#Ik-I85)vPRu%CQ zayGHUJT2hsDI?jyNm)FJQUWgq-n;!9%4 z(e(1)%xyY3x~m81i;H`!>-UsT4-enpgafrOSJv#%9qFl`$+UdGzAt|TL0;H;amuBs zX_~5;eHXE$C)i4#;+ECY{}^h%c7c0-m0>sl5zNob&&_cYxNw_ANtJQMyU`|K{h9<8 zwyAYBFE6P;x*2-L4UKO9S^iwsV2R(EITs&ra;A-PQmKw?TW8P^f8p^Wf24|uUsuaV zA3z-^q9G>o`)k?#zAj$qcF9c&)(+wSZI9KUwG;WaW$gKBs+wbL-JPe&73^A`_!Z1+$Lru*ZWVO)PnNKcrB7oF`WU|}K1 zCVWrVZajYR(Bq3{LQJ2`@>Z!cYoajw)KpEw(9q{4KY&lT!KB?w;-N@sb1|tqX=+AI zgOmS_32)9dGiK@-&MJP^xVT?vZesQgwtgN#@%JhS(Vq*3rq<|{+0y5%&_50$6~_hY zaGInxD^@F#ghIkzN&is5^7~(s?l@m`$`-e<$XnkWBG~t2QjA&C|#9#W71v+pnuQJNZ{!WvfZxF#-+&v=M>sOvp zTB4V8&g2(h@8MHgQuCw9gayKsmA~^HT`e|(lO_+zQfK=`_7bkIqw4q5o^vaxtfK#y z5z`%F;wDdyaVtgAS7LRYSvS!=MSf*NKj$?Td6&lULQJIwERqEHLn@+|W-%qWvLXAo zf~cr>GPV`u8N(!KZxYA})eP9Kuy+AJK6}8c5BnF&R}xCMqSt4$Py74L+hXyO`Q^o` z*Lh=RViP3E@so!B*jd}=W@qJnq=GO*W?R~#yX7nsv-*#2I1lc<##F{!jwyKa0qPqMRUF(JOJ zExi_$$-#lBAMdgMVv_p#S+7vjiX+Kk({Q?N`1z7-}uw=7m`eg{mFwl zay4n_EDaa!ZH`Qs+C9I@=hN`7BCmM(qM?d0(Y;_&{jVI8niaua3WL5uu&rW2Vfp32 zPez;02emQ4mA2m<^kU1L(wJkL=>1@lzCnDNtpv%IF-MinsOUA`8L2VEL1AgjNq_=( z^Bw9JWF&J^HG=&6M#Pw7rSk8##vHVt;%hjoBy@t6j77p_yM+c)YKgvlt>iAy>Xu%p&f6mb-2sG;v^7#v1g`MQGI2BQ7s)U~AFiVIlD(9xlb zH*Ifz)|+G|rF+AL1Q{IS9V0+{@TeTI;ZR3!q&7p;5^_l{##U#nOyPTr$nc7lv%7?j z%2}Em<2Z#`p!YFoq0x>bOFa`FOWdT$sPhoSuqXQmognhf@HTK9AWw@oxxnNKI<<6; zu9T^^z~T%AnW>Z3hzUdvFjp6=G%OsrJTsYsXzOW-XSKElqVe4&g7DwdQ_9hS7pyEK zrp&O=G;ol+nLpCiu1aR6Ik;bA;Q1_VFbxW{IWJ@7@Y>&PjpZ+&o<25mp_G~@epA&r z?svH^GDBo7>ct?Rwjqn*s=BD%ZK_mx zth4ShGg0)5_3tLlvecc73}Qa& zWa$e=wt32FNsp_+lV9JV^L3A{?qjw7mp9e5hpa5MJl(n^l1aFA>s-k9OG6kqZWngT zb=GHRY_$(JQ?>Rhh(F>~MkQPv;@K37k(HH$!=R?L6_<_(3+&TwpL60MQ@ie9w~WnPPmY{&H_8-^=e$ zW$mHj&~O94I7Q%u30?EUz`X>KUW*V$PWFbS% z@tcuz5h8mLBQIPM&}6TW&-)yZ_xW8!1?A7u7F=du<4<4ac9>G##IxjG6jb(cC~j@? zE%D_%@2g3PliB&8?>RtZ;8Aw)A}IqB6}NFAquvxX>%8w(tX4fx#G>%dSXY&}_}V9p zREZQDvs}H%t`EYwI?sgoJ&8tF?p}7u!8V%f68C49f4)Oz2Oy69$Faq;$@wp;^~`)h zJ)PfdT3zLz9|yQpwF7nx{@^X^9)||bRL8hEzMq?DjfK(FVB#4jdm2Opg6+iB;Rc1i0)y6;NZ{9BI4+@a zj<(0vJT^%NZ+d1{(B!%3*vrxcXyY?xDr`avaxp%M@&A!x?(vCx8;wchmmC@e41D+5 zYwIo~Nf6(Y?&7SF^!E%BB50-LK=2IPKU14hx7@ea-$YU_g0IF zpsf)%3tc$m8;@p7W$#T-lH2pC=1Y`;b&_D+fGDjdIynFVH&JqY4tkxeIBLG# zjl_M7%m=$-QxCWsGQo>`8RkSO@k>s+>Cp)WEqY8G7Akf2i;$TTyE&vDLFogJwu}rC zrBd@l3cV2mw^oV@HvAMd#NuQ3AaEEEIfAUiTo zYS!I7mwor*;1Lc6efxwSf(}!|BjX88HtZ50b|yA5?iOB|)^LV9KT)jATZ@ZK!kk2s zkxab(FOs))@{VL@hf0;%Q|{!RSmWVTfdeBBs6h2=Rg5`pjAH!oW*n1*euYpVnk{3Q zkjU%L25(iqZ3l|pcL3VbQ%%hfeTkx;ou$7J>d^OQM{A+b_DWAT^(xu7Kb8db?xeOn zscoL-d}BMG3LNrw#I1Ybz)euMD4CNkX-u*ob69$yG^P+bu*`t2#NhtguxECd7K(87ev&M@>+Df6z?Slcd$1I7O zV2hCj2Bsc!YL!8Pb>BEk^P~Y!^(4RYN#B3FsN66;C8sz!X)_G5*a`pxer`q5CL;zk z-p@vijvc()h`hr}`5@2#F=|k;tcs!&nVv~|VkbOIJu#(ya(~8f0MVs)B*Pz3MlD<; zWu`>Se!Ydl#}YEhb49_ot%V%)a;poW$gNV0%SO^!I&R-zvI&7~p*;dTB(Td;{4vg3 zgRU6BT4~54ui+L$xc!L;LKX1gLsSJqcVdzB1X|gP1=gF%7|m^7H%X1OrE$utcp3w| zeWXq1%NbT+&%kU7U64C7Cq35?O?X0U-AmOZ*mle7^W$IO0K9C;DLdu^00dcE0ZA?s zPZHz_7OEK7*Qh{aSjK;e4hWf!Y6ONbOQZ6s-(!Rjdf*&|rDB_9zp>dRw9WXKsikO* z%Yyi&qLx-^k2!_-r9rX}cVRa=Q{aOj7A9R+1I=WHPS3B0IVw!sK{4}>^{I+9VXVKh z7nZUEP0S7@w8w6K2Fs_e5{}!VRkynLx~lk35)ao>4l(_4B<0R|xZP|wRulPP#IHBa zvC6sMYBgzqR&AloyKuh$t$eyDFD8M%K^bc3G3Sw>&z{s$S#lzjiLJla$y>lh_E_2z zNd34kP`tj#q}8xB6WIlCB4_Qx1V5p)5W^I6a(8e8j)i|M1!HNJAG8w157$OMLstGV z1^GGyj)GoRP*vF0h+ZFPrmyYy4YkTo&C?ssjF zJYrboiR$Ct-O9Io8Moe`a znAS7U7vf|>%9*}d5trh^oE8(8l=nJ@2EOlySxpapc@o=8^GCsV0DKA` z&dhjK0dfu3$K`S`p(l`DFr=qkV#Y3m`AB`DqeFJ73nquy093@x6XI^29xA}opV1|e z5G^!rz<(xx$w+;r5y4I#lB?fmV&MITFNJSSpGxB?tq_7>k#TQ#g{ha$D*dafbu zl;{sDe=fIEPj&*XLksVYte-9caLvy20hHSd+j)lnejouwKiOJ{pXj-708n_PzZc>q z!8DcL)VSYut9$y>ZT0BgA>?)za64IbIAs#qoxy35qy0<`N~36ObbTq+e|LfYMc8tiT)Yk+%$1Z{=C0}WVt&}~nF&gRsBt&4^z|sKF%$AW zRtCmRNQZFsE49R>X@h<=k+Chybk8mO8MTl>J^jlo*elL$QGE&`Ua(w9WqV1Qp{Bq7 zs3}elaOiw@t6juG`1q7zHLm1S(_R=v)$}!;RBa=MI9yk2fF*7X=LBaRC;M&&v@n7Z zvBYZc?QCuRZo;NXPst*uze3_7n#7?~Y6a8SsJE69SQP^ekd5A*L|5x0=S6|h$nm-; zU|v0XDfNyy7M?x`rpYd`IUBPyX?3Fq5^q;LR58hL#5@7jOM@ygR|8;=?<>x|jS#y8 zL2F0Gzj1AUMbEb%1$th0`ucP}yk0it-VS6na>RUQd;AB9rk3`AWU{%`jn?U=J2Xxl z$5;_4=V)cO^0cW5Tz&NT-Eo!Xw?o^}X;V`69@cF8sm!*$*3-ht%fiX2qASp);7Ak_ z(!|>bsW&1rR-ZB00QRpE)-pY2cuAi$_d#NwexAf^uMplbqSnIJ;|Uh%cm8%@tE3Mh zdhoAw_7ju#VMK+q(Xz6wr)!so)Y=|mwpXD$nbtYl!SLQ8Ymb)mN_+~fJ9!K)55Rs7 z=?8a52aA`k={z&~L-Wb}VNP~1G-TCFsCYv#fdcUeYRvq^ppt0CzBb>&YOG>9tY=0p z}Zrob!lWrt!%iiKGJe;X{4 zzZj3+e(^kJ6DGpy47yKnW1k)$cd}b{-NIYuy-Z;-*b>&cfl`KoxIW; zA7ppOe6MB4wSiEhv7DK227S~BV~@zNNocKT%IR@$ZS9$Exaf`grD`-w&16XvFRnB1 zouw!Oi>aPGC|UekW3STLovQH69psSPrzj~!l1u`nR$vC_*qn?UyC@JFSLmN~Vrma= zy*BO{+HWnQ6`ur4m;}tetnaB75|>g-iqd-n#0hVJ?}4up$CXhII{H;I_zp=u+epjnZLE^+BMTSJ5ORmDbaQ27OSS$D>pM&j{SrY^^YtMQf=-JSr|SHk0$ z@oj=#H}Ru^9c4F#f(F#>l^5M@Ph7OS-ry9fmaD-u-XYTdr^@-uuMF)QvtNoTKK*)B z{KDO(9x)>)%%R0lMU^rsBNfs1lPYZVDRRa*TW`6hXXq3(&BEE!7sjE4CmFitG@wzb zL6a#Mw?yH38@6;{zd_pYVCSq99wukN*{6E>|~tw{AQKZ*~g9c8y$ihDi{ z70SJ%Ko+0Be2f%I~1+^bA84~3l-M#cW3dKRaPF+w1Z-|}u8o3zIvGa+wkK+ees{N+3jo|2d?#_9^>&Qs?YI)&t+`rvD zKMnpw^@)b6oIa$Y2?`D&C_u-zl0$Ib8@c;=*j0NGe3wm)%tFiMIwg62SUDe`l6uLH948;ril7YteRlALIvN!YrvFS^NU=gUFN#^96 z_^?+z-txlvTCNeEKY)v|wDTL}=D(u;-R++d>tz4FHwn-BbA}US5p$jO5?nW~(mue{c9_61^6mqXJ(yT9-qb+tL5n@?YU$ z%_l43?8Mlp541*Ddsp|z;R7p(Cq$k@m)+?ide09g6r=D5Vf4X2$LJnEd?(?90Doo% z{?EfJa+>+CQzu3b-xcllPU#5UaeO8@tGb!a-Cycf&Tk=a*(SQG5g!1ctH*5w%KLpU zJJOE2R?ffKj_h<(ojW$A8OSF+K?4K_;enRH|4aID#_^?~X8|tN02WqqM<`n0?Z)f; z+f`eUv-lhl<@PO2Pk`gC8*=>l^M&amS-B^*IeH!Fg-7=l&wr0xxL48UNGyR0`CdG~ jy@lxiEd6-9;P;cLm5vTbsgL>=;rWx7R*|ZaFbVm8rJc}j From d7edc29ddb6261b0e1a58745394a267c6c312e12 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 22 Apr 2016 15:25:36 +1000 Subject: [PATCH 061/439] update image to new dashboard update image to new dashboard --- ...oard-windows-advanced-threat-protection.md | 16 ++++++++-------- .../images/machines-active-threats-tile.png | Bin 18095 -> 20868 bytes 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/windows/keep-secure/dashboard-windows-advanced-threat-protection.md b/windows/keep-secure/dashboard-windows-advanced-threat-protection.md index 4d303a37e9..71d3f0b9d0 100644 --- a/windows/keep-secure/dashboard-windows-advanced-threat-protection.md +++ b/windows/keep-secure/dashboard-windows-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- title: View the Windows Defender Advanced Threat Protection Dashboard description: Use the Dashboard to identify machines at risk, keep track of the status of the service, and see statistics and information about machines and alerts. -keywords: dashboard, alerts, new, in progress, resolved, risk, machines at risk, infections, reporting, statistics, charts, graphs, health, active threats, threat category, categories, password stealer, ransomware, exploit, threat, low severity, active malware +keywords: dashboard, alerts, new, in progress, resolved, risk, machines at risk, infections, reporting, statistics, charts, graphs, health, active malware detections, threat category, categories, password stealer, ransomware, exploit, threat, low severity, active malware search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy @@ -57,14 +57,14 @@ The **Machines reporting** tile shows a bar graph that represents the number of ![The Machines reporting tile shows the number of machines reporting each day for the past 30 days](images/machines-reporting-tile.png) -## Investigate machines with active threats -The **Active malware** tile will only appear if your endpoints are using Windows Defender. +## Investigate machines with active malware detections +The **Machines with active malware detections** tile will only appear if your endpoints are using Windows Defender. -Active malware is defined as threats that are actively executing at the time of detection. +Active malware detection is defined as threats that are actively executing at the time of detection. -Hover over each bar to see the number of active detections (as **Threats**) and the number of endpoints with at least one active detection (as **Machines**) over the past 30 days. +Hover over each bar to see the number of active malware detections (as **Malware detections**) and the number of endpoints with at least one active detection (as **Machines**) over the past 30 days. -![The Machines with active threats tile shows the number of threats and machines for each threat category](images/machines-active-threats-tile.png) +![The Machines with active malware detections tile shows the number of threats and machines for each threat category](images/machines-active-threats-tile.png) The chart is sorted into five categories: @@ -76,9 +76,9 @@ The chart is sorted into five categories: Threats are considered "Active" if there is a very high probability that the malware was executing on your network, as opposed to statically located on-disk. -Clicking on any one of these categories will navigate to the [Machines view](machines-view-windows-advanced-threat-protection.md), filtered by the appropriate category. This lets you see a detailed breakdown of which machines have active threats, and how many threats were detected per machine. +Clicking on any of these categories will navigate to the [Machines view](machines-view-windows-advanced-threat-protection.md), filtered by the appropriate category. This lets you see a detailed breakdown of which machines have active malware detections, and how many threats were detected per machine. -> **Note**  The **Active malware** tile will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/en-us/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product. +> **Note**  The **Active malware detections** tile will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/en-us/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product. ### Related topics - [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-advanced-threat-protection.md) diff --git a/windows/keep-secure/images/machines-active-threats-tile.png b/windows/keep-secure/images/machines-active-threats-tile.png index ec1702e6dd450b62abc8cd3ae8a3033af2a9b6e8..4d3b54e48149fd38a03d3b075a83927ffcc87b0f 100644 GIT binary patch literal 20868 zcmb@uWmJ`I)Gdq(xJ6Qt5D<`*Zjcm^F6j>G?nXcX0ck-%T3T9KT0u%u8YD!dyBof> zpLe{!zVqvh!+3nad*AH)igm3u=Uj99?uDWh7REyi6ciLJ8R_RLC@43@;pZ{LP58gQ z1KtDpcE?d#+XV#$`v>yRjd(_E61aHVRYpPL_8(LNG-7NDJZ<&=E=g#)in_U4Iyj>g zl=e!)B}`Yi^xVwF#M#Qx)ylyh<^CN?D!7h;ye{tG=;dr>Vd;uejMK{xSF!)Q>TLEB zc`Jphm7N(1_c6{Lc;ycA6;%gwSC5y@W+?iO*T~!N{`clqE+)1w;Z|pq+HY0Sa2bKT ztohQ}-pbwrY zD4(~6=ul87P-LEqs(Gev%y_)QAHCw;;WV@GiS5ffzIg{1fjWpP_TU9qXcqo=B2*?W zQM3nmsHKZxVMFg9drAb|eJm|ybu$y~9)ji#b$dk+HGaW?x-=i8{Uhij6iLkqF$_Zc|iIz6Rttrg-w{Cfmaa%M4p) zOZ6MLZN{EUNsW(<6{<136?3|}IQ^9^<>TWc@V__Lvg`@^AFhpl`b1%9Xz1bLQLRJv z-~kPywJ(MDNtpA|6wIQ^OR+3Y=wMKskk#N~S>(E#P5#A;7_m$~k1ahNovE((R6;^R zX-)3%c)RrBI7}0!#2!1I-<{m z>n<)%_lZpM3E*+hQas3Y2))upod0#ffF+b07h1Fusi;UR(k4ibrHlD5( zm8A>&o^6-4+Sd{i5KP(f1ig@uXb-w`pMXWr^H|umuq^~fDUHAS>({SOHN$WV3k#Fk zO**1Qu1=&lzcA@)X<1h5Tn`!NmSz32e2&m&N=V|g=>N#xX3B9n^Yyna^ ziZsg<<>hTtX9ow_Y{rTM0s>%XLV|;5O(x}ORbiMj!wv46vcrnxJ40QaopkK%${5?^ zekb!My9+5icE&^<^Nt@96XkaIdCknsn$EWx!U|y7-0Z<>lqje7e;7_U^*M!nSWYdf>~Y-lPTCfTzyX3d8yh?(Iap zF5HADJBBkE;!kB_{YUr+9z7C%*@{}N<2&DqRy1l|tNU7C)6=i89+tkRev;U;oi6OP_s_?$Yi=Ck%YLR_rp%5fg#w|{ z5kuY0*6aI}&zZEdqPR*cP4T#c#Np!7>`EP9f*o`CBGQ3Np=WVV#7gI%SGw6`%Ty3! zSk{bv;w(*KkD>43Xp8O(6djrfCw=|2QEM8Rp_v)|>|fHuk&@Znrdjkq+uFo)RW5)1 z#zMa(*45UQofPJic&_o}G|u&1R8(nMSw4LsL>K_O^z?KNcHP0j0W6s$zC_U|zw64NMTV~if6V4o^*Y4d(5~y=ziwC&+Bk@A+x4-M z01CmqE~){MYe7+5MvdZ6^ww)51-G$Dr4=~qOxXw^WKj~o4;WRm&bD{@_CSc6_YsL=B)+?2SXmlCm_HG_%yyg z=YQ?H8X-y>H##=vcRb?(s~varFYE#1+S(cclh$ioohI*U3Pc>8(rmd&Cu_?^mP&zT zayq}8wX3VEsOa~pY8xRz!Jj{W{#{srSfz_kFw<@_5V4!$T1^@JP=yb#l3%X zvT`}m(69XW=9@QfRDSR6E%rbigDaDDF3a#=Sk~8|VPQe^9FC|e3GV(7y23!Qd<4aF*^8H# zH+>nl>*mdyY7Fu1#s!6idj|(qzc=CRfB*iyMVIjzf}4xWC_V$=Ox zsNbPnE8TmopsTA38NkW085xGEs+>mOP%0;x$iDpS>A8*du*!4yFHBgQpMf$6cC^y( z^6bNh4={IOC}!>r`k60s^79QL1ilBL?e6Z*z1r_P-CxENoBZz!ky%ku0f~u{m36!6 zcvenYdZNl|I9DzaR}6V)?VO*0{q)yy1D{PONKnsQ`AEYFm^qT<_m>C!*9!8J2|iLF zLfV|p4y>$F+sj(6y#IB*4+yv!GzbT!*SxaZwBB`91=bSs20AwB%EAICB=^}SpGqcO zb@ll7@7et>PTt+8djuiXu-)8X;*iSk#z0B=a`$h0cXv0`H({S6Cb1PbWm@nSs!BqK zTMgUpt3&ObofZcxzu*A12Hkn`5ztQ=!Ix@PJIva|aF{Q;&wGCizq6ACROPkzcPM zBCY{O$iz;6b;_m>BkkP$U0arwWeoX1Mn*;|`qAZ|K%BGVZ4rxp((GR+i;0Fjc7YEh zoaUN+i!@4PWn_|g9Uh6%b8@PlCBebJ4rgs967jqE?a%_}a`OSB20eb*zkjCHI%%n? z7cjAMrUvWLLP#~uhhw^Mp7vmg{jW|fl<|+Z=UQH!?*04s&tuN__`TGlU+agkUi@kH zD}$Mku*R*c$4m8l`uk~R_TbpLEcYwO%fEs%OQ(>00EgURrv3pXJP1}_$G`w~W5Xid zYpHTT7=FcE+Z`sFnVAXEK+f+;IIb= zqbHa_xk`+U9jbMh`}XbI?n3AB#^kUO8|v-bkPZ3i>FH@`Bv=yXzB=8a%y~hNkAWs8 zUFh6&@;4lENm=t*p-xGER~OsENRjJ{ea-k2^b# zB^o_WsbZN#!mm7SZEYdkeplPjMTT3!dnucAM$J@OD8akXhruCrb8`bk=6iLz92XmV z^VTgxuf+$ftgK2(O0m?JmzPbAjksd6x%VjXNl8;bd~n_QBdUzw)6?TH{goZc2OMwM z(!SKEmB_bk@Q4lz<9At-AI{7tGKrMrw4L|@IggfxX4SPmC@9FF$y-8F5*-y4QV2zm zn7DYpLP|n<`V}DX(5#P%iJkj`GOTEiYF7&(B;kxxME2)Uzw0R{O z8rmS@ zYR2qq&(F`JiP()#cIN*l>~T>k$uhjs2_@dYBvQsl6OHM|&Q**NP;6x)2lw>N|clqX8+(rz9k#(+4WVn686D3J)_oyVJ%*xkBYretsR6#6*ae z4Q={^K;QTqFgLZEQj?iHBTyR(-|}e$!%wZjYDEL1h434{rof04K!b>cT5(q51mi zT*&7rG|O{+jJZUEG0fQHR<;@gRM{ZhPAC2}#d^B%s$02AlSXX486t*7qct|;Q7?(& zx_5+(4jbx3`W9zC+RxA$&phCJOCj3pr<0rhfd0nal% z@vo|NI4=<CfxbR6KF2?wm9ueCN|eOK#eIE+L~#ua3;@5L zm2*A%n-e$Ek%T7txwv@5lB>D7Ie-EmA7A>KaV9<{&kD$uuI~EMQr-*toVAcq>-cU{ zm@dq6h-BO3{D-e}1pvY2#YM^>9*5ZrI(3OyYRH_k0GJ?9eYA^R2T9qCz5#860$wn@ z3I+Rxj!qb^F;O0@*W%Ck0m1!V#znwmN^3y`yALDqc|lJmoH!wi6b02IwDPjeFutOd_(xRSqo`2y8+ zYHA8f^seCbLbM3f8%_oWS;*T?<@&=2TS1Mixpn*AfdR{z z-Dv0Vu*sy{L-Uo1u`zHoY%+diR0FG&KK;Qa4=DyJ2zv+MjM>>)kK3~L=mdi8HaSCu0Mp9!t+3KX{>|9Y+=3s4ID4Y9`$M&Nh3smj%w|5B> zn6!uBC!m>Jvzxh2xhm4nB_xD^O$=cTxbmmD*8KXKiye}^niO|X7f1ah%vfGt-q<+H z)%?@&DjXSL%_JUC2Pqqn;4CfaJ5K7B)A#rG0BpH8Tt*$;kJz1QP_quQEr_LOgBHpE7Rk{Nx(&o>!yzD&Ux5M?!-r`LUV)i zx$*~dDPk}D73cr__99g$blKn%FOXjvA#qLBhdV8UB{UJYMkU;>v!#z1X#H(Eru{nL_ zoJ5#+?%Y8jk;d}Be=qQJRSK$fHs{+ya%musUF3!tQ6-oK!dE~5oOJJ_jnkbr9FMgT z8C=w&Q5_8p0(^Wf_l*fk@!*TI^|DBXGz4Yv%SZkfy8x&R>zrwTQ*m$%8LAV6Y5NXl<4L^QSEA>sU`ii$8x_ zDHIJ@a;T}>ziU~==xJ$#^Q=U1A9=52BFP;a+Y5fv>)fUf85!gR1bL&@0L=kR{JJI| zKxDdaPNh9{=`gQ+8xn#;%E!jY$jHfA35$gkGyW_rP&EN2J)f}|Uv-7SXlrY$+=0}` zuqd^F`7n}}jqOXh&o+=g6`X{S5GhzzkWF%NN`dX6ib^kN-U)~)Jwsq(9vmK;X=~_s zdV2DS;tC53@v^JE(aT;1R-GVcaB+>8SAzUh9X8h9+S+Q?li;>F(HHL-BM0*Tq^rpL^;T#;tVx4LR zT3T8V*r;WSMrD;p0Owu;Chkw>24Rezm)GO(k9Ua7j%KNd@=4nSmg1U8+aZ~%wt34` z(d5Z_#~A9Q*w{UQ=*`EoKJb{jy1D`3b6Zc(6WBnahYuMNdt98IY2`mUO4*{KqgOC7 zx&=a&udl0{fvk}k@<a&{DwIDDCM14>deD=| zI?&Zc&&XJ*#l(}MP@o3%cQH;$*lRh>Q4M4=)735fW76%{S#Q3=8lzY^|fwz#DC9qMXIs{zp^5O!N z8XE4t@T`fi;nK14ii+t19$Qeu0V%lvhgexzAvAndUM?`!*JlS=6}a0OP#-vlEQZa+ z8by8Pm0TKr{i#m@J{}$(_H}o^3lC4>b25JR?3tR{2yl4-+%dpD01_|*j}j3v%>D(+ zksT1gXrZGCNDH%m=bJ!8Wo<}7NB}@kX3zwsMNd_Azn62sk(5qf7|H%pQ&XX&f-sW_ z3E=bR6~LM~R#W!1DShUv)bdlL0Tjg=>oBr~zkhQy%vR`bmBh^0(;>vHH{PTFRK^D> z35KeeU#SDq4HtHw6ry|4IhJ~TeI1s76gvdsWoiP7{;bvT~P>TMYeL%`1r`I|LpUY$=%AY=cI#cg9Y{^9%w+c!hQxBXrIVv)U3p_F4 z`gBU^)QDD)c|o;;(*wUSq*~~et|TXS7lA-vVfFR)QX{h9@B^rY7jc9RVn*2F6B3pd z7VbZK6op&wv>>UWkwAffx-A}p?Z!t6#2Vf=i{5>0WHn0oK~PMedBdyI3WKslofj@H zE0#4g}GqTp3XM#Jr6V`Bzi z9lu+0xo=Iw@dBt^Ycq~b`5`XO<#0_seYvTr>Hhuu#KFKLpZcCvLAd}ajTOR1r2t^T zYut+8n;@ef934ePMcM0ZKn&#A=L`-G0{+gcejK$hG&Ce8CI%JRGrh%gHw%iXr{`A+ zL?Wx9J<~V9@3OM8(=#(vj~_pL_^=)%S;(7OT0|ryMH)pC%JK>d0F$up+?n^f0^Wcs z`lF-crzwXrJ||?}%1SqW{pZi0D<~)c+=8`LQi^`}&g#{)l9$&hV3*wB2GKzDx`u|i z^0x5sa8*@RtK_YT^6Ue4nYpCDe~nj5)1B*H!3iC*(f}E^JC1HMy*RU)-%OJOgScD9dhNckz#x-b*B?>i110r zP<6;IG49@l+Fob_+0cI<`vHU#N79A^4RKFJ2oAZh`-awnTeH6+zC^XoCFB;KCYRgL zk4SjSo>1SMldNqbZoI&Z=2yE!9XV>mh7O{_GFz zSWI}JY7F%gH%b9tiM}t`@Y~R~~5&_*RPb-#s>g)Xl4THXhnBYi zbX!pVh_Q7bD3hsW!rN7}v{pt!I^iP9aiSWQDm^||hgN|a|2exQT>5tTmc6v7sEuft z$Rs)M0fvMeA+k?+Vq=-yK@_)A>n@4BsapCJ&4dsp{r_^f|EEc2r+E2-j%cP`t)mc2 zE!JhprBk9&r?<7b>UG@9)HAi|UZx6mnqq8$ufOP& zF!i`^&+3`;i?mF%2TiYW**u)c$m#l+@HlNS~s(xMI$Af&u~pG&GB#{u=sU zR)d^FANC(f4WLN2U`%c$s_pVlxzRyHiK@FCHgz=iF3XZbS0W;{){DrbM3N@^Nq)%< zK8ebx6A*_~Q20orpalil(+|W!q#mW95UF+?YcAk_b+Me`4{Ew~lfm_M0bzR}|BS z*_~9zJ!C`vRaw>Mqo9Auq;-B;92XH)%FJ$iqs)xSJ{vL&NXyhG;M5b2GRsTCkSDmZSilBryaJg2KfaDEU3{#wxpd89z2+| ztyyAip$}70C|77Dk|TeSLLFvIGRrTDo1^^Q?j9?`yr|^+#x%7}o5&_lu{JbBZEFF~ zHMr6P(I8p?xL>AQ%OWh?4CM?6*2Bo9KHj+x-KHRJ2ZnpA3qG-ESUce8{q!07{M9F|2|itf0b05wZXMB}J~^;&-|7D;rp#f%j@IpkSng zz|PLzr|k*BRH9l*o1~a8;QS9ECXG=TEqn%CeAU~cAdZQSPO8vKW?$rJ!USqNwM;Cv z7qrj{(B03E>{9xGNrSeOQn`bS$o!=(x;PH`tWoRhfBtx4D#0_mhLCcjCgDZFt|{AP zHe|yW_5ar-k0b17_+Kx;|I=Rj|6Ozb7qdPL*mLj>5%&aI5Uyk>H3Ccg1@*6?x6U-k zKL23r&xq-w1_pMq#?Z^EkpNMH%>#Kk!k_WaApbwRd!LQtDe9B%5lqTI2`n*1Zy3-z8y+|$fBQRSH_n}UuJh7&7>`1?*>^23tfC6 z19FZQTct@UMs*+KO2P*FjW^_(Xl@+EOu4aL&PA-mYx+DXaDAWfYN4XFg- z-njJ&1qCO9-2cLoCkg+wmOiNmBk8l2nID%=aOGmwhhl>?}$7!41P(`3y(lVu(z=R zKC^zPQ&3O<)a%%f8U#8JOX~J3)&Vym`-k35SIrM-=hfF>>&nq2H z&o)3OGY)M_%N6KJAng9Io1Qw2&nOVI+4N&2S zo<$gMM0mJ3!pz*f)Ud?>7ZnF58W`7q>S4A041d%DeVF$`BrhzTj^lDwDfRknlYrRg za!NiR8TrF9Wq|B$c}P06a#hGc5{7&qcpHZn(Q3(6-_XG8B1MBtppcfA^sFjhY7e)`UPM)>-T4)}eERw| zijvX*P(B$M_kUe@b$V9^!%F1BuRc%@@^t#lDa1 zRM4j9=8j+Bi=~bx6R2@slx>)4w)~X^(dZ8CIbf!5-@X+bNK8m5)vjCu;+O=i3}Ebd znc+1sUg$9~>DDmO(Bwi>5=s0{7NX}o7b2nK1E@A9Cx=wPy|}%T1r|lTh0Kx~^bV)n zlbi0b)WpHvJv}M>Zfgn5y7gcSG3~w=-u~B-FWE~3Bj7cAb0>>NB9$H4z&^7+ZayyR z4PZ&M)IL?uYJKCOe;7QqZ_W{uD>w5{BZATQ@?=nM?pcj^wmcG7CZSyO0E&dSQ zxMJeLnB84nM%o%s4C7@3DA+nc@7$PcY01xDzRTLk1~CJ>4t)w3gjx0y*6w5sEUe4Z<&4~M7#4JFhEDVH^DWHGa!0H;=I1j08*OZ z&+2eK&LhE-w}b{edwbS-O*=k1Cb3C<<^}Ux(6H04wjKq-3F^4>#mO#GjLXdY4((3} zrwnlV07pTp7D^u^a*A%vH!gMKwZkB_uKh?8<7bL z<;3RE%8Dh}r9icT+ip@K#qpqyBWh3?LtZH3=Mv{!=hDlTjSG-Q!9L{CtWH3eA&Lx= zDFm#ZzyEbYNm6w^H5DQY$}XsI2ucTsZKS+0Rb?d=MT*n{q3VLwfRKbl0Gd4@i9lqW zot`$GtraorLn%4YMUB98$D@K(Po_lM_29n(Tgjv?0cs{ZNH&*)o7-(DM+QOJFk{b= zgb3K#--ni?@T(I?ZS6@Qu{k%KK+MyrbIxry2Kf>?Wq?zQL4TjLjqI_twERY-TcS}p z8NqI!8UU>gki!k|+cgcm%wT}f!(Ic3A|dg%-Pr5kmsATVRY2eXS3}dXpris#d4H+T zg^#o(KQkihGaNf`VaWM=`}iPl1d(R_SN3f&P^MNuBhI&)8XxzV`0^6qE@*rTHb48I z=dX;v{iu72N4klLBdIv|?q7U6pYDl4W=0f%qc19xR^`JkV8^IM(z zBdCHO*WYIFMrH6pXQ)S`AL&i|9mIR8h{V<^6@!# z1mSP9=>HQ;BmuQ1FmzrQfBIyEl&@$NVufRuP%lkOi|icqe{az-mK7&)S*QoLZ#DXH zq|B7Bk(V894D}QD-0pt?Vr5*no+neq`s`!igWr7rwIZE`C=~xg0RM+1{x1R4nK?8? zd3{X`OwD!lwu@jF6VLf+Pc5z_k;&VDcbm9*>a~40J}cgoL4Wp}GLh5AuP(+=hsq-L zaJWX`>lQoS<)bL4p*?bWb?)F=;VX2L-d*EQEz61fbZ!v{>s7J3d+^XH>?HXkxwZIP zbR5%M{ruUyADLJqi7{o|{ohj;jMB4r2(ntMVH8FR7kx)^RZF=qI#0&yY^to^#%Vmm z4N|#*_3@M2n}4@aUh^<=b8`y`HRa09yCQ+ppPQhiaRMg*shKy;vi3L9Ol8(X&@gk= zunk9|3@XVO6Pm5e|J)2cB+XL2I>5E7UWKvH#Z?lyJlL6U^FKiNKt|KpZkxnEh`WLE z`fd#L(#y*sFqjz_FmP}ZX~CkVS~d=?i`7#U&=kQjMzjDH5-|RB@PgW_sjd!9pKjBN z`uciM+(7Yi+fkZPZp)7R7xI*&6zAjw@-ySPTNlY9ERWkR9iaiYtjT31no4mgM3|LdVAZsCuW10Xj zBcoihLaquFe#I1?lDs^0N|1^3Wa4NiZF$m{k%tQ`K?(8k%(^ujkRgX|MM4TYRur#6dZ^q=3E*#^jA<+T=Ej8rZ$C4ipT`^@VTPGxjU8y zbR^huAee`sm2UY>xZVw*zJ)`OPRLNW9xt04=l6CfJNST~SwYkw;JkO<5tEGn0Ms{- zXTVx0FDG}tk{u1CD43l9RWw&cT~m`)zy3qkXRx)wRoU&oe2Uq>02AodyLLlkx5!2wCf*5&y;}*@{c%1aNu}-+yQ(uq@4w$ z)?ryXzZWPeyT7GbCQtjG=%sZtWT$y_Qt?o-)XTZLh-{Eh2C-KN@LA9$9k8Mt1GdYe zzlXXD;Eh%5ixKQ0$m6tPUGt7c5l^E)A903y21ZH%@Rb!6fIJ?~y~TaVVcG?U5z6a6 z0NKv=_7bh~EGYgvf4(C!Q+OSq7SzHj10z8;PuEaIEqhx5B*X#j1bF3)>T-j-frl@c5#7YWo->AalQW)my zs{rkN6Zi?>rV%Vj;6lm}NYI4K@H<-tyeS=fu(M-CgiZ-Y%Fu$44g38Uz|BN#dfSZ$_%lDQvP7Wy!>6a0sbeX$9c-841)P#WCxg~YbOj& zZvD6Ml##NTF5{n5y)@n4>Mb?Cy)}45O-CnZf{!PbEfuXOE9>mxA%(yq=Ewo7jco27 z*dGnbjo*GZ0s{^78y_aNSpIsvSKGh`)+$^RrbA?FAZFPMdTT+0_mu?k?%y}5)|r`} z#>aT8$0CJ5x>_*W{rk;s-MlFbSQki_DDDSYGfT^!)WEAd$SPpz_4VCcTIMR^Zt%+- zX>r7Vz>%iu=otCsaK_SPFn2NqzN_78#e5t7-!t?7HaBMul>W1LyG8#Vx5pWeQV z*u++>Cu|N}{FHH61}71C>C$q^`C8kP6%oS7Zn2w zO_uw?#oogu0{ie!*)jT5+Vl zCoRDYzmIqgSL_A*EtU|oNl5zVr>ERx^8PJ|07yVev8K??E2`(-5rVOlgo=MV)DU%@ zWuBqGDe(MjC99(Z2r@`p@`op?!PsQpbA%=k<7#OijTq%8^I1!mRI5=2v`OH%Nx9z!}>4uf&eb75-Y-&Oi z1*vUl(--u8AW9CkztKcNe*6f06wEwO#Gnlg1`dn9WH6ub*iVD=o4o`2q@c6`BRmJ) zKap8?X?-1PB2+H64(yNxD5ZdFpo^jp21QWqL5DZg()#)zYsz{-&qUDE!`hPi@uTPJ zP%bj3!^DQ#27+>*^z|>H*_bR(8!x*Ejz%cz2~*1dsUxzG8^G`G3l6Avp`m=x zxdxdET2$Hzm!NAx(}Yg`;~z&p$;gLp(9(p`W6=ESDF=r$YzTIU3DgVdCS^-Tg0DEq zBK;}I^Z@dZ4s|F!SmeTuH8nM0Oy}d{6A=)WWl+BR)P??!oe*Aofup(C>>D|5%{Rz?Q5Zv-(^}+T+F15zm7DraEeLe zORT;#2BjACV{kVr$jRMD{cgnev2O_qpn9$f44#xS2gF=&Uyw&B5Tu=yL2MmJm$)h* zS?CBNeOi$rf#_IBUkTKt4!*~avtYQ0Ob{Xz06xl}mR6#8-krwKG@h=cZ_-tcAFbcrYEJ8nH=j*PpcD=aOQMEv541nBV{+RFuMkHC=!Iu0Te)Lf{-unM4RDdUrLrhw-SAqEztXV1Pt znJ-df0BKL0S^(I2)b^HSVaIc3IJb&l$ng-xx10`9xXcYSHxhe`D z*!G%EcumzOWTOhilyMF&fAl z)U>n^Ibddpe#l)26dbJn^kAx#m;dKAYh3Q>X8DwI?8I2FVppPfuV02p< z6!i{ufe($Cno^6cOj=|d9v}0j^fAP*LEgf~!GU_5cvhQ}UV{{Ce*6G0JA7ONG|}Wd zX!1;COW_1ifLUGmVn^JH$QNilz_Y!*JvO9O3KEU^YGDNiT8w8+bp46?~2_^XK62fak^~Z3j4-mz@<$e`@H|Dk<5T} z)o-$ZZ@j(+kKf=j8pY|eO?W=tEXGm#g!{54j+Qg_>3SvSMXqkhjmJLSXi(r zbADOo*xEP&2*+##6E&E(xEGLa6+v%LPeH&(*40z6C!^qpgjB5Ss3=~%X zO2sSsLmkI>b#WzfQ}I0eU)J7LSWDx2hpMFzCpuZXgEkauFlN%mUBIeNuB|HK)Z$F#W{h8^EjhxdA!T`L7r}{DyLd$ts zYa4&Z2hKc>T*lOIluRGWc7ENKYvSSxj4_bw^Z8K}IN(3|fN@|XgR!QRY`)BVOEBqt zxm+h(Tr2jU&6hi=p^c-=g2tOhHD2o0WOP{%Q~qR9%senHd!cUq#!i+snl9_Qb36JM zOT|t1*}Mm1F09vD!uc&%@7-HCnTk$*J*)EGJZO>LiLJG%kKs**y>GHl^4Au zU(6#GG;;cB35dQ9gq*tLsKuZTJ-I%=QU9Y$zsz-~MYAr6w@Yp+JR_~JL1$}%Q+P#~ z@R;@Cw80FcT9W#r=b9l+W$?K$Uda=7XE~+uD2tivWwTNNL;u2WON|PZ`zOvxP5rbN z$J#0FS(LLX3q5<4hXtoK;`ak}>!1G-_IVa3uXx{?xI|M~$$f<7srJB~&(lB3`1CvP z@J%UQ4T(QOWR_^k6QgO!DmG8FiPKO)?nt&1`=prn0k8St*(%XywQMKr(}WyLg%7;@ zZR)Bq4NN~%wEgP)jR~t6)=v43rIjX|ZCwi9_mnOEz4?I3q`F6OJdxz9ql4tPm2E@r z+}QWt+_{>{GGtZD7sRnn`N=3CgKcq#>^)x*qFNABY?xQ-Z#!x=uXbKZUq%l{J^;P$htt|f89U68M z&mL_@@9$WMP!V|d>-Eu^)bAqVra*7`Q%by{TZR?6G?EQ}O7fzYbcT9txkMwv+}8in z&3RR4_OnbgR4d6IZ2aka&n_3PKvF=3S3Uv2Fdlj>Xf6(#YgOlAV6SNn+bECg)YTr04wf{(oO{DT;( zzv z6z0+qzqjK0=1?+z0p70nmWxzp&GPq6x=NRCLGY+x(tntg@bg!dtrM2EuT0h0lvV5AZ7IKduxB|eKJd>9 zsrfcU$(?#=o4=*{nR2=sY<0G^r&F}!mi+Qe=|N+tFV{%1ulk%BQFddJp)*shjrQc_ z*P6-JFbxgCc!yn&>?g4&tCF|q{(ODbUc;Cd9W^?l^H%%3NLbily(F*JEIA>)v_Zd9 zVOlvaKF%KINP;CHX+MOsxSD%J?_jQ*XSI}$5j41jx$t4;!6OW7sXVKRshhFSsv<~R zngpAAo3|QY$_3w{JUH#1(mrRz6Z_4nK*I8H&w8@T82GBOl15u+r!^Lj)BOA7QxQ!m zFLn(ArAc)^j=6__MEyOBk525?=jPS~x}IcpFv-uTv+t!qBg1<7!9N(SgjAu(Q)QPw zdD@J0bHZAO9nG?lsl8>(v|IE7nx?9QL8;Uc?z?@L@$3ELQeK=yng8s}G#N?HD|<6C zid{5c7(A3MqM#Bq`>8RQ)*DVlb)btw{BogPytemY@RVEAeA+E_^pu_5cgX{aBa)|G z54hM}92Vc}$?3f|-ZxuF%wK0o6mU1NTlq()`7>10pQ)?{@%>SihNz?$y9aM6|E&(o zs{!?O7NV@iq?FN(gA4}Qh>K-9n}J4*hwo8PaCwpcF2I9HT(Qby&Aur^?b&avawX?1 zZS+m;M)zsAm|BzRvscU19|&0u5@g^ z+*S3^Ozo-+UimnnICklpJ#SuZa)x6jGRGmcmgH~9&U{tfp`hqpWEGjZ_NUKOv(jM; z60vc$_Q#5btcgD(4JWtqeV(nGa)j}{H+!_N|4#jzO~$TGzJ-C`ME20*t|wyopA-ov z_)j^qLXBT7wl!F)bL>53`L|>O zC~(i747+aRNn}5+jlz14P>>lM)k3Y*Cz>+w6`a$tT5^+hw&ksbbARV1S-sT~S_Go? zAFkoXDtle6eS6Z`-S(OTVmw)5c0O57OW&8WI1P$2G;V{vYs&?yv1Oa3o;BeF?e%s) zxfaKr2i#m53|9GKZP+Wd80l(FiB#{}Ivnki;%4rtC}T<-AYztBDo|UuFq|zvEaip> zy3bj{&H4hZWxAgpS9cvjU|-=e)Sl}wFGv)t$FLr`Zm;xte*Wz4ZT{V;jQ2>R(DYwn z{^isvaWb`}n^VehXrlNxoU&dKr{4@zcYY|p45VM&;19Q}~` zIIAh?QKoEtFMG38xX|Ebv{6I}sb53J)uC{@P#}KU1`{jKp7(>%QKemHhnapGtT_uJ z-YCq_qnE9fBs}>fd9*7U(K{|*vZT1HFKnBFDQ`;_GBG7gJxcyQ@H8QkF!DBC@Q<@@ zI>CSJMt1Y>^?Fi#g^n#!1Wvn}MnAlLuy0+59>PbxR+}yoz&7=kp4H4a$NRv zoGJ(r6znlV5oFDLQ|6PeHr9DXAD8F>w))KRt>92R@%vEx*_*Ge=+_@)nbM2(#pvJq z_gK<8cx9!HBIqA}=1XaVi-9;%z8gJHIJyEQ5if%-W=yefQ2iAdKb?Bo8?Nuw;Q|T1iscS)Ue|$Y&dP?$+e{65k2_f`o)q7B z6M8#L>v3=o{o6%ljJ)DKvHLXYvH@oIWK|1dJ)hGfC?De85DonF{03FnNZ9KyObr`C z$MOTN$3CYf3GrG5M6Hjp&(ANabp?ipn}lZO{L1{d-3&AIbPI00?rSi&ui?$J(yMtJz-X!`Vcw1y7O<4}zbi1ySzoR%#ozXg#WkMm zJ_z_V+cKki`hEAHe!zr$EdR<;wYy?H%&)v@Q!C%=oM?MY{Ek9iZS=11uTsJ4*e2%@R9zU0@EAp|1 z2%`>XE+zM;2C`~Pts3pW*vu%Mt0fBDBmRDaiA7%E*q8#vNAaNo`#J0W&y0`vUOD@u zbhrOf+`lw=g5v4q5QGx(#3M%`z3465Q&VP26uxH(cXbhEffzS_W7Ang?+CtFpF33l zThZL#EPPtp!h?h8T3<>u95a+lPQCl(YgZaWAph_K?@q0`si$T(O9?{0ZkY}F+i^}e z@|gQSF5srmj1oJ`{fcO^b_lu`YH{*r2@}Ou_=Baw#5j&qKC}H)Yp#lJsDj%a6w7zI zx053uCz?*R!oTBDQ6p`7ibLHIgfdJ}SAllJ$oYLW8p_8SHoF@)nOK}7FBs3PZbbGK z?iQ!0*0}qfRuqLLG>tc}YpwN3Jn)D<&X?~;Gi81+T+8xiTT2(-CF7aGpST7pXhd2g!}dCiq1usWnEkZhdwoo^P2L`teOPBZ#X z8!`DcO>UdU`1I>a~IC| zFx+Z33S0AQYWqCv=3hwFWIZ$g@KrroZtcmf1GMa>r_jDDLU4SRVvX{wckJPss7LD9Hm+7;BTcT zR>`?qoBB&vTRX~4jHlXLwyU^Ww(Y>-ygbZURHfkdZqnuTkUl$m^f#T&^yKf8?;-bd^pI^O@mVAuBj zqo6Lk!h{1AzlC zcfa92@6PPIJJ0)NXBW_Yjnld$_eH+VQApIOR*MQi^l6XUa8*PRWAqj?GTqw#M>!H$ zz~I?W-+YFmT1!kXy3ALxvJM)}n!V6W56>+cK&gbm{t9Zkj_4oupo_&2!Q9}uoRzFi z)HIajqY(sCg3L=i)S_i ziX6>a-g69=jGRBD_uz(i7iR;AJsDt?pew8Q}uKY)|5d+a*zoixyoxA$=wDp*%mkp*##`TwVw@y6hl7SLj zK<_eh;X3EmNh1+z)6L{m`jZ#cH6g)=rR&8Pef{*JYT{4Zt3756LXLK--sWnyrnj|> z8HPZ-EKRCTPy6$FlfaSo%e(G{WnG_|0(1Xqoi*EKDX|$Tyz-<%VJx>^c zYXh7P_O+~c?qb|H+8E~67NhTLmHaeti1fp(43pU>f7x6rGAzV)*Ui;0Y}qkd##--* zeW#6N9i8s?b35$F+m}(C?3!#rJIBUG`Nvh~AMLR^-?0SWV+=yq@ng>74qxX*Wqh28 z9uiog;MfH3$x@WkYF+X6exz{gi_z3t9`I^anLjqu>(V+zJlSpz6W;-U$eh*2y-8bo z>Ku;6pJXvH#3e}zB!C)Sz1cn%jtIHYTv>SyyJ<>4;t^cs@~+hA0Qru6Vzx>I?qPCQ zmhaiKv~jEsetW3beLGh9)`vzbhNwMtFq2i)uSZFJ9T_Bcp8 zpft4y0KYED9z2Fdf3aI zFYCou$Gu??A_{)pNCqRPn0}?Z3b-MyhmSa6BhLS8s-Q-xVvn8=Jikgkvl{ctgO6+kAq9qsRYt)G rV5rF24B{5FH_cB)Ae5)Q?6%=w86*La*(Fg%(qc})wIlp>^+57h&X2AZd$*WhA;xghQ zpFH%BvQa+aX|$X$WG|gu>)5X}s#o32wjNZt&$WKuc5`ZVexUL7c3m{b0)5Wz-a?K1 zI!R@i#raug00v=zDrTJkPXa`Q5RNQ6BMvte1BXmMxYdP@+9R?a(6fQOljXHm*{+n$ z_kce0WgXY2^GfA#(Ocse$^Li$qi=j_q8d9-`Bp`Co606Uzida6Wf+TmZ(Ce*VuCE? zxBG^^V@4K0p{-b>RFP;?sNkGS8B@7NEnLc8$naQd?6Suob7cIyC7TAG%T+@L(~xOJ z0W;ieHOT0`1_yewWBhbp%=my{!Szq5enP`OOskZZ5<3wyTj=+u7Ye%_zI-1T52 zw`R{Jc%i2NuezS!Mqg0z?TzXR(GMhzAKv~+`z0SPyi1buLZqIyssFjM+ &P-IY zLH@hTBA`MKdy9bgm8!7EHm9*tC;fl}Oba5P9K=voP6_toH#QkXjO0#eeXxu*cYV8x z|DP1OvQG0M`ixXFG8j6zm}HftMf(+5`BWk1m1*kryoqshJJ0o!&^s z!UVUdBoS+-Hw1o3hKcTD`$F9wD_Uhpm+QXEPpNJAp;-v9IExd?H&uyfFMQD-2f zmsDL5rtc48RxWQbyE(rxF6{^Omm&>btkf^pwQLPzqOZAU(&>$JD(b{19EViY_!)0H z<2y{QlULv8gX&<@`^Rz+Rgb|@-_=xiw^xMU?#v30D2!^+3#-a>_07uAf0D+OHMpQj;kZTcs8a>D?%q<3)V7VYq zJm4uNby*BqY*+}aYl3(`BfevxG0&Tj=03$s+EBMmv{Rp;iu~P>GV#fHwxAXs<)-YF z0yT_z*{hhxxm>A$Cn{sxsJlt)o;VAfzI@|~4~DQ~aKEtq?moDciem4k_(qg6A*p&% z2Ek{oS~)bui6j}KPAuX6C@*uu!IHH1{|2*}2`6E7&!}6z5igIRa zh7JV5w@L8>n{~mhB-0$_#$r=pHhp2$P%y;%1I}{SWUp zUp>m<)54aNh(_gVz}^pp&s1Zh+3PbC{tf)f%(Q8CoS{lFg|)FfdSW(%pYTP?c}~~~ zXb1ZX29ZWp42HWFz;g5~b10^Yad3UF+dBnGV?XT5v@I)R<88;E97y2gpw*rH`h4nH}R? zh?8`)_UOU7nJq`B`Rv#o%0pO$_xxNG-ALD8uDig~B=hEry?VK(N^#L~x{TNQ#uvRL zOIJ44raLmxS3O*yDnH3}gk5uzyg)FV5T#<6pP2-lFW0+j>&xe34a>su{m$4TcjREg z)-dO#W4D;fri5>1T3vRIm+S`B);x!`OWX_sSM05kW$X<_jq{wk6E}n_l`QbX#XwPWt18Cp9INk{LS!nF4J z9@cu(y$HDVZQATr4z?#JP!3IdV@arZ5h!|f6#eFqM-?I;M{u0K`QoCG4TeM3hpi>G zUC!2ZLo(}TN*vMd*5ezOoJ=DsA8JEU?W$bPx%qPPl_fy05bI;^-Ou%hf45R|@0P_$ z4!-C$H(SNsX3Kb8zb+Xwh3E-ZnKmMhTiZ1@g&!S{)C8<-b}ySZuFt5z;Lc6lw&=Rx zK$tjOenCSFrp*z{CM9^bOh04%1~Y)P{GOwV)u2_~mlytCFvb+WlS*=ELp@Xu^F6aR zp}8u}3Vyq+yRn*l`UxeJ#+ktqewfSX8eG&Owt zCtTWyk)zZ6UBl~=%2`SgzlC;&Yc@~eg&9d_w|Y*hO8VrF4=}U2Daz?74j8kr#09_h zZZO!CfBvZN+YVc_MjDbcA71n}TEL%d;(Mmi`uvH`NCVHL@D46q!#50_e)VdBa=vhk zg0Q%~<{9y@K`b-ix~Z>aF4O$wSX|(!tF@ z?^;o9l*xkY2Bc&-|~ zVyi7s5S#zPkNLCT(e)pS47~S^q!s;tr*<-CJtM~ZD91daSD%QkJSAOir3JW9lZMOB zrRfIfhjTJYGq7&^ye8!Wv49ipUeheGp^<|He2fMb@Jyb3=fv3=K8iJltz8W{c1*bi zo_HlDRW;FV@Q;@BQ@$iRFBLCwBy!~5^)ESdiH3_rnU7&CWk?aldT1Je_gMEd($tl3 z4yI;hUouN<_*POM0F#C-k)2psl=nTYzl$iZG0%S23Pn9PHj5}tcb14yF=u+}y_%2h zPx%~4LZTvF!zvk>yA9dnoFhD@Y9$@aQUh$JEhOkWpYS8C3vyq*3X|LkX)2F(esmNk zfc=PW>HS@p(**NIL~#Ehg+tbujgsE`no=oQC0xo5@bi(>vI~Lnzb|9B5FpPV%Dnz+ zgbVyEfahnVt+sY)?40SvydZYNDD9XOe6%cHsp(!Ya(9>isYgKaNMttW(A(Twq`_*v z9^G5H5#}Cl3D+9di;3oUNMy(3K3`G)=0b3ewbJ;BNM{u3kcfGgKbrXfjhSB_hjoTE z447=uXw|u+Z{Eu735v~rHx<$OcYByJ5=}meq02GWIDYLPkY4{#li!L4>NK-Q}%`}JgsJrzg3-zs4#WHv+X^Fg|sf84;zcM?o!Ab zN{`+{8Mxgv{U=P7IEnolh2HYXW5Xl&&deGSvl)7sK5e;Q8-#eYB;%Ndi(n%+W2XoZFM4KEwt zL!B}@Me3(0H&OCd(?})5`mwb}=2+|WdC0q0@=@gHt3l8CwpxPweCLHNbSDx!{B`3k zSnOIZzBHtOYP~`hekJ3>G*?~mSf~yc5C15g+n=0G3tJ$`4-fmKhjrV2`aIt7i1DLv|VNyP^?!cDA58K7h=Axw7Wx-jR|cf9$%P zhjfN;*?{JdAsX=l%noZtk0Y-_=XPvk{ZdnO7L06F3X?m~(a2wIwcZAokuH!b+h3D-Kx!C>Q?Q7tk$efSJDn00*3 zD;Y7L&w;~!E>SEacNuqI=^EOK>5S?U)^V@4%f$0aG@wtG)?hU&p&_o1!mqCuGuSz@ znmae%8zGunGe2P>+lJ(fJI8f?0j@KpHIhh97!ehVuYB|N$`z{7=+p7THN4r=J?x;B zi3G>M){s1?)cr8)kG+FCl*3Vv5Dft-$CW@{V?aNQlH`a9yF!h4s8xWO(5u+0^^o;E z$nY$oT7dMYvFxa?8QppQJW~Uwbk!o4i!1lej(TePSV41APFQo0Tl!C%z?3W-e{qA^ ziu+%^<-Lo}avy&)qm4M{^HuZ2xS;N_vU?KBL$^k?EAGB9N;-aSDOJpBCvH|r$`9tC+9f{dftb_Lx$sxUU+ES}nALKD~X zYF?P$VZb(NS}%^v{=%tx-$%MJTob`7HUHKQ8-7E155k#0rDSfqEH9t&_S{xXqw3gr zxl)a@Cid!2czAS@(4Ysq9sNxOkGIvX#U;d}LCja; zUdkjU!exTB2g;ksiT+GL!~2u}?xk5?@ImFQv$eeV;^6UUq_ z$(+#fQ3^Ic%1}GglhJba_H-hSOy0K~Y&jds_wEewEz<%&7WHvJ_V%v+IrEpr8C#C$ zt(+=GV+}8g3usU9lEjL^fw%m7PXl*6QmcCUDDO|V^Mwb~8poza-pB8CveZ}l&1e(j zx?ie#`eh81lHD$mw7yTD$JCn-<}gK`8NJaN!}lG!vGbK*q-ZQH);5F_si?}1?*i1CNKhI+9t;s#X+~E$%xNNfJ!MIlr&Vrc zbI)VKmprSPX-VvyVGmf#fEPtyblqKfEzVn~k5-kSov0+&n@r}TJa7Y52re6h;V$B& zLo3IU3`d%g7l}J4ZitV@cOx;c^^|j0hj}+0`YgQ}mKCf+Rzqn|+N9-vMlNl&?+{Oj z)YiToNEX32F@Q}~ofk(gZ74!27T>kGJaD}BU0h7;A}T-j-zS5>VPt`Q&ZGyecZdF8 zbknL&=S%Zfc&$5igbLHB$&feU?OhnXy-cp_G~R3$xSFCsUmNX{(29hi1wElv9m#vS za}7aWP;K~~AGmCpf_5S!ayOo2Eq5U`P;vOPcdJ#&VPG0!IhRNd5_V}ysN%aga?De| zVvbADf@T4lp}?$a!y8Fsm*JR!Ev3xCew=cLGDAiYm^2t*liB!K2IXMTr6-V6?lOG^ zK~Zn|WW_j!nugksgX=)pr5S|BoI)g5+fy6_g-6guWKA^;l`HO_`mZVaFMvB$`N-?n zN_IQ$zE*zXr)sPe4`Tes85-=XaSN>tWd2_w@ zKf3Kgg0cSNw8s%7^;?kcySO_9zYnTJ_v!W%M>StWdgMq)3~n1d%wMnx;xN3BUOg(7 z08ClSTQX%2{^1~`@$M4y)or#sz{w7g#t}0_l%reCxj&J|vgcD%o)?Cd;LmMl$v6z{ zQqYUT$Re%ZKm?BGy4PArlWo5jfk7-~Hg*M|7Tfl`t^$t=$my+-hF>WKt|u12~0~wjx6-0xt0F9zSiIGNGh%qHhiO9shukF{-uFR z9XrJI1G8A=urC^!?$iwR>H{&nq%Duw>>>URSl!DE?Qm=hp^^NJcE!m+OkIcR;xp4M zn>tc;hl@6~&l`rA8_)~nAfP+As{Y?AU6$khWz*F7!RF^kVOLq#fY(ponj?=?+!u!} z)mlsDQz-a$&f8KoKlVPonjDToy6N}j<{=SXT1c~`{xAl!OF7GnkKB!v^Xz9miSx{3 z%4_pCSGz5`dE@o_Lm0|ow{)b^dz=^C?_Xz5lkWkJOWudK`^ULaUc~3|bFJK^++5if ztUCL4^pUjP+|Vh&Gf7V%uz>s_5V+N5_^UomXCTPot>f@Gk9d4ze`Dg@m|WR|SqzrJ znU<5*cPjVayM`zN7{*kj5OX`4$z*um-kmF#q`>&!JGi$r>e}nBj0Ee}6@UsI6;_eXnC^MgDM2bmdhxnNk&9g# zP}pzlnVOc5hP}!!gCkawciPaVZF1b5Z ziVy`K0D*UAiyT|zLC>m7}*{kkc@r(Jnr1{=Es2U!n1Aer0GNG+E+l1O}2El zgAeI0W7+y8FMa-B&^N|k_7D>DeFnB)o!^z^R?Ax;BCv z{gX1a&tC65Li5jDSEqGv=O5j3Kei;Ps1?6@i=wtT89qthXv+*2tb6Ey-vV`m z==zP^v%Jr!E&~73iVnX~%VrlARp!p^R|x)-*g)o_fRQ~ICYGFkym)4<*X1t&m%x}L zr~@{r0eH&MS?I|}FBUICRlO6LoEo;|B3utRd&S?Ci8-xsM|NI$5FwMLk)r#ePh!K6 z#A&f;7NGislG}y^<~?@&mT%=D)-259DC1MzCHe2QM-k^y zN2gY`bQjM$2Tecwv_zLmk0}oFJHDS)UtWDU4_k7;haE%aEa=>9&(uQ4u)tR+dh3=l zJsXDTX~7^PCNH|`p5odvj2c1M4vrJRTvIN*N@GJ<96&B}teykosHd$oc?7TC2GQ|8 zE!7?0CExdtQp~^5$G)8*mY=}jtNn7T)`;oVzGGLR0jB8yVsjUxMvEN6B&BQZ2rFw^ z5V6i^>JPQhR^zIm@9*TAtngcv8g67{@a0SqOuT)cQo;)?FYm1jn%O&Ah=)~0M<~G* z$MhL_@l$RBp?3u3=Cb-1$!!hS%ZXXn`pq3q2^N-bH1w0$9uO7=B8&DoPeI7S!D7~R zYFs1ja7^o0t2S3qsqxZJN%cpSL5Pnl_c*8VYnoX2cWPLMZ`{Ar=WiP85dSFGa{Y54 zS*VNCTxv*f6Hv%BB8)%F2In{i=NNLl8$nDTYY_aKF>{g)ZXZIX#b|;h_=93F-o(&n zl!LGM-Oq}R@>e|$-xO@#Mn`2BhP*OoTZcGUN&P;NGqkV7lvAhKuSYsP>4+M^b} zzu#p4__zPl8EKEx8|(P!__Y7)!tb$>#qA%6}ktBQ$yCCK?{1Y) zt$auQCs;bXw;)$CulMDg1RibA$5lxgR*#|MlyJdNW@^y!A@%vUo&!rA)x_&*i?C*a zmt#2mYg86r^w_&R$Pv@cd{)Zu4RY?^rPJIf`?1XB&whl5nyza$f$6c!w-+sT&;zzR zj#k>#nU(NgiPg=1n?d3eVg=+am#3$mi03GK$~-SrZ1YnqKG*D;)nH3?G56e#5FaD` z0y7b9m`9y=Y_V+`bspX#X@UFchmfg(@)*+a(Gac38mhQRce@eB5Omg@x_bgTF~3XP zy_va7MUUwDtd8w2Ug&q5bF1qOPvL9msq)8Z-;XMgfjE8{u&Zqr33yz7m=rUCQ0GRt zpO~0Zr@J*hu3j;A6>WiDr_Gm`9*4lL#O5uAgv10(7zKYRkuE7j1YsRga2Hm0L%gOR zZ-Ms)V%M)SQI|ftq~+YJsU8|DesKLyg0KG1J6&8v8zW$$|kCfpJ%Q1)W*8hj$S-;M1Eq5ph`c(^do z`yrt^gqSqxdJwbEvNYuGCjc=+S>JhVmNfkFo21SFKr58z^8SHj>d)|BYK(Uvi9vxx z!PsJFEC^6=v}@e8FVo6m6X>!|wvH%IXlZI@ zy?6+9qi*%>J++-ZwM%D`>IZIWNL=M!z;0%CyV=a88aqoAAKJ!))W60BB8SL%v#v~b zqGlqO`j@FB8IGHo8x)+ixK!@W4lr8QiVpFr&BaWcRuJlRhVA;+rdMN^>kMTOizW~3 zLuL}P?$c|i-kWQ@V=hDN40V>^sYqe|rA!(uVWx5ub}{t+!_VM3Q=59<7&>caUS5}D zhw+)2|t?H(>jsfw`M-ME-w5|>>$K?O~;-1KsXCzW2EkEp0e3kV;}IS>%})l3mYrXTz_fca;WLi-z4~p@${LXClI_Hp#h$K{M#k7RY+!+uZPTuJ|ZTnM^D7O3}y0G`~AN?>f;2}nu zL?$$y^|b1A3f*+oPW6^Xk6*;;U{hFJlwS`EM}g#8CZ5tH;A^iJQe;s zjeNngVaoGL*BWUsCL}-qU$?;ZGG_!jP5^&CflJ4RuV>~2{fZ`fN=<;1KTJ|oNr8fn~S#~wPYPN#jRiz*lt)r zE-)9+JJI>UQnMswvElCasICDbHt-wxjgjwvu-#3cOpv)VmtK|&lch z@E#TyggUPa2MowtvzoU#H>89X=&3JeIU3!cU*_ z1Ifc8iE8M4wWBp=79^o>>CXtdoG5vU6h7e~9ZD3x&DdCd6%cN80m2SgV!p*WT<&4` zO{s`02cG3NHnE6W5cNHrf@|@vb(ScOyXtNOENb$A5|sH5<_;gCSlZ88hS36x(Yv5B zqqFN!G#r^c-Y3Xrpa2)CYT!Te0^B8n`*bXar4%1|#>XwZd1zT|vBC>e7JSFGdlGq2 z&O?3r(#mc6ZJtF4nZWftOY0AHWMqhWqS{rs9I5xGw%Y3A2i=(>bt1L4cAfLaI#27} zJ~%S#RRM?QBv+H}N7Id%6<^}6CzrhnfJmM`#Ukre<6$Z+bG?I`~V~; ztp6dCl&b9l8c7IJS;Bf=f8c)JQmo_fA;M%`OuG5E3ji9D!VQPw~fK4`Acg z&8U6eo_+NX3^k*ffydji_FnNPNfqWvy=2J(Zb7mfZFadjFrkSTe85_Y;z|P=b zvO?1MN)Ri3k8Bn^Q>E;*7W}xbuS3(i#)QW#av}@RzJs$@7G^yf3-XHdb4jZmPM6dc z>o6FxG+q_oxyieB_D;gWZ|24FNhZt^SWmo6#>PxSC#M^qex2Me-J_G+xw8~-xZPDhrw z0DKMLFVru%Sn#boy*tH^9j}wY*DO^WX)(p$5LAguFcDSn-hIS)bV~^X_uI-@imeR9 zzPnTQI2^hUZ^s5FvntHTt2Eog9BNZ5=n4L@#Ew|@`RH$h2p=-I!cq3=d9OVjesv(# z1m(n!u91zM8+;u%j!LPI?tOu>uMxXFxku5dSDYW`xb$&R`3AJ->ACm%;roFiC-INi z>8M(3GSkQ3Tg^sf-iuMJDd(AzU}izdLniQD`h$D=l$l`askH<8M#{}r7!3dq_}$|Q zN`&-=O;shk(ftY@4_vZMX8+eZ_rWyT3~Z!-ojsV`m)spY4p%y#=!sO)59X)120rDh zPyF(hwZ~DunD2ruDr=hc?&gKSa!SZ6nj2q0E?S)P|2dN#n5Je;q_g(LxHo6dfvEYo z_$6R4h`I_bfq&=eLdoy)mVs%tqo7BFRJEfwxiu5!0UIQf&;<$+3VWmUuqH&Q`XvG4 z@eux@?6SEA5F%f@xoBf0M+9z(tx2Cl-B50=fG$ijmvLR49e*;QQ#j>=XFbWCmpZTJ zivgI#_J@V1t)UH^da_K7h=5jeZ9uh&Sv=L8E&~4$WmtC#Y-YzRz750@4sZumu~HtPk*OlV?h8lWduHQUR)si zAc<&hxRcd)aEiX?4(zGY=|=}9rQA>A@nq!deEpuuh0T*7ctTis9|1(Rdftpj-M+HD z?*@I&LM9e(ct{VTs<Wnn;K`S+ewu^*gtm9hPbIi;{j0NXOCZgeo1I(7;NAbG$*VT z$o$Xs>EoyFOe6X5!jT@>Sl5GnF2e4G`efiP|^Hm|lhJ!)|p| zHlz)1J|Yok2H^camLOt7E&;g#t}SwP(psQEOOC_6PeUjxT_1))V8tTdXO!YCow2#= zrtG@6kQsgPs-8soVeT!){a@WG(U)yKX&Y9tv ze=Rd0rpQvgm!7XMkKtsL&#%1sO>`3yNzqM$SdSbME5o#mQHs~o7(%u_ zIjT&IJ=n}h_o=n`Lil?Ftia!zUsAU-S-Zv+I>*bEb+eOn;sh#zeANdjeI{> zbcAs=OV13<`|V*JjsxCQ_bPg(-?0NzorbS_YrQ)otVOxIrZ2j7*{WeseYdChei*|# zNmW&6Pb_{I<^+e4#-9`EzP>g|xLc(km^}Sja>lHaIR#)zOg_foZIoM1EX+1k7NZ0= zmmh*OJiFC-se~4!VpJ0Y_r+L}pF19{7(9gkri0kx!Ddd5r^hcfY(W-jfu|s^$wwQa zW@UZj<4nRN%0qgjG;c@GSdPmNV6*lj>w>oq3yH`DzKA^o^AgTbESGXn(lQd9_3JUA zEQVlV(lZcc46d8n< z0PrC^%|QC!12&#BQ1$Hg{%i?705`3THOJ)xVcQDeY)`=c7vuz7;=mvtCLjVn8DSWv z=or99p?6!if4-0mfS{0ZBr6;Ps zb+PiDd;Lqb^L?G`64uII50)?`&?#p_im+89r*7-w51QWMrn{MZI_pmR*~!l@cb=o$ zi9hulvNWAd7oxYS)Rhd+?;VNi zglRjb3})d8b=ry}FEeOuFoR!>@2A^AEOS=dy#qsTc=D_rvL+>I`H`v3qd&7WLp90M z&|*>Xy>tSNuao`<(l?oQ{Yq(0J)5e7-HX)cvWC;x&kh@ro}{(f@kK!OZfg^H+HVWS zPx%Z*HTjXEEy8whaF7j>Jg3QpxQUXMx=lv!Hf?ou5;A_Sq}gKY0L9%4^-OzdT8}75 z>pVoxtKaa!Wd}}+jHW8hiL?R7NjKQ7+xw0D*zgISGio_Gig@3j9}2yvPgI0zX4d2v z&VBdv=&*|A4E(m2bDENWU|6n^nhi_U*viXLB_uu*@}FN9KRSfIKXCOIOmQjFH<*rh zXUyJOu;>&$IjfCU$g16Zh=w#DA6g)01$)y#9MCBSs@!)ShiOzIA??l2{r%D{S6L%{ zhDm6%ntXj z@Y)gRjEUMMLWH$ru*}SeEmm*R=9YDb2*~8pM5U#p=)%CGMQ8Zoh0(nBYBK%FGJQ)a z5OFh?ok`QfOgujS-<8YJbqB1Nv&B_d`3eJ^X_3dm*y54~>E5R!q_QXJDQq-cb0suc zRW=Dd0qx+SLePk>-q2l8T}5J|O3D;>&Vm^JVY8aY>30ezrXo25pKYt>KP8xWIC+>a zgXvmnjt*{vmnp5^kAL;--`AeE*yBqndT@iP3UbZg*s>uK@c*pz@cy~nIhra(5(&rm zt~t4v(`hN1L>qGtW8ycz3K$w=q1dW&NffzZkCv+0+vRb z_wHGrFsk{Pzo&vUYzx|`EW(KiA#ZUSvjtConRuepTkH6HFhOkQk37sj(SNJZ8S?n) zW@j>|E34~@6ol?9ztZ=CIaysWC{L}QF|}mz_ma(9JgjWn`sU=~Mu8*gsb>nk(s{>& z*)MwGIE{bS+OZbhXrDwsw6a;gw|Nb-Y)ccp~ zKX>d+VP=^4Tcd{YY%wRh7)|GYj=&CEILK8oNGxd*!Shc*e|QIS+v-osjL4tb+&4w9 zjx8=ykk_nb`4Zi3Az;1JxNW~|pyxEtMWo6#7i{Ia5=bT;@T%{g??@D7aEVpT@%+dN5Ox{*=-OP@m7Cv4{0p=3^EWT?bU1Du9J_#gv{;9Tm zdCvMZQ^|4)CAW{OrIE)}g*x;~e6*8^0mPe71LQ_r=#g|4R;cb6;Idm}&NUGET$8q{ z&|UUvh71UIXA}}U*(S;|sr*gzRJmoIhlNY+5+73n7611EvT%cjAl5=?qzwfG%WL?$ zT(7-U+a9~`-sgL?L|oMO+Vu#)et$sz2ZU{dn(i#nQ-vh3pp3U2#|S=sW8K8EVUkv6 z6MlblIWEgyI3S}kaNk7S~GT`lr5F<1k52|R#ja5>U72rxE+8({uZ5WrOFQ{Z@s z_Ltk;z;TM@FE8PNqjV>FbhMT~x7m#j=y3(O{PcIY+`6g!^NOZw^JBd4C`(W37^d?} z>t9DB8B}C|XvRVFWG7D!VOUMCbzP<_k7<<1@9sQqR?%s}}lb>4rMw2Zkv*YPse45ith2uqDnaWq>N0W;T2@lT~ zBJC8c=3I2AE*QzZTm!YkSeB9PY1hw){?F0qG_(*az|TUF1^gMWMfSp-fatL=Et~em zVKv!N6svJD$U45zsj>)119eyS|3^9Nnw~zr+G$cu=Zm?dh07j>A;sElxVlw0@Dz*% zlwlZ9ivjeGnMFInz&%sGVi=R^E^o-7gA~Kg9uLvQr~?O=jWD5D82`VCQtpr6z#LB3 z79$i3!bt|1GzGJj%mOF#;QulxFS?8~8AL@(C{0+Ke&X9|JDE5$)9%ky23kMqk6-^6 z4-nqy`f43kn~<57Qvfi8eMK~XJJ+Fx0ZsPg^GSbKx2AM0`bB$g&_5Fgp;UG-x@oe- zvzhHfpVe*d;%`^x;}bxY`hQ7J`ES~-LFgmY#asENM3GVuP;sZO0k{@h!H!=V`f5#Z@aGi@uEQ%}XrPH}>>!to>MyFR$bzy@mm{PlVn?5=PfRPXYgJy&= zOFwzS{YN$M(r9+|&S z6$vhViLRghP$A81oj7Ctg^CKB-TgULwZbe3N<+=X_~Wzq85=&QUe zQ0a$?gpvO@TIg;*0#Nqz(C7-E+b5`T$5Ug(%grrIs@M6a><;>CP9rhIcaDc-nI2~Q zpFeW(e{D(vrJ5plyL0_;Xf2m@W`=MAS!6z4s!tKAjO_22r6A%{J=X@+yHlMJ;AL6k z7NGpeq~-@Jq4TVNo#Tybydc|RCQx%e9M?bUZsk8u#Q!Jhf-f2L;UB$&8U}r5i7Lj9 zxf`2L^XIhcB@7+s#`QZNCN=PMEHW@*Ocy3}p11y$?o6mk5!WAqE0cIV`>5c8`zHX2 z4RJSf+^<18acF2V6IHm~g%GF+`jDx4wlMkii+DfTICrih7UA0lq1H@v7(Kg{{{tV; zR24b(!Dpog&vyQmF0)In_Dbp1mzm)jb5B`Ani6iyJ8ATp64274`OyTWv5w0;4WIbz z%c*GqdDj8zt}?!(s@u|m>Vu=7cF!~lYV0%ma;}}_47?A=g4Mjvb;?Th7e9S1HCM#@(!X#%zWEw_{(Yx?c~z~ZcxH4xmkG7`vEFIMDWwRu-{Vb^5~urq+?Yet zmW2>e(ytNy{w$MtW}BW2)92%X#5O_NmJD&O`t=s#q7txK2{`q>Z;G~H>Z`^~8 z2;#20cw{$@YoBY^x=Ibh*03Y2cqq z)5%=c5G1tdXcU+oJMs-P9@?fm%W!5oNhOH0e#etH!nx`bH&baB~Aq zDN#rKFp-GSuBt>4k@WA=9hUlk+MVcGxOEn73WrSymiJ^)L%&osqM}y8$t}+-#%;GZzQ3-3!%x+>v>yhx^ z^wkg{8(qXa?l$v(jMMn$!5X(_s-|6iyb$sB-~0NRVn3~<@8t139SA}1x=@rJg6$E1 zr8eI*^c^dSJk6Mj`|T%%BBk6;1*%Bhg5(?)b6OU9zF~rw+u&v(Tq#GsW^K7swDogT zx`~$ThF6_`a3*7 zu35e)HZJjh&D#yHp@`4V=tu|2f*yh==TsZakM;$Bc?HwX?y#UMwfv%Q$cZ3%E9IBW zEe*`#OnkOE9I8Z2WbpUJQx7xrJMy*h=MXk7lmBHp!2YodPR(^+N9>Vmibw4k1wZGf z2{~`OYo#V(2KGVpK{grmS(5Yz*xHR{W4l;M2s-C`NX2~qbX;!?XWZx@}; ze_Bl5e_71Y+*4rVq#UTiu))Jwu3Vq;yPxTp-}xHdT^)@+`1}x2eP$mYfF{{_I(>Hn z=Cqoj1wiPf^v(_I(y2B(_@8x5kOut!g;Wv3+9f>Q#m+X^;ZOd5@V=RZn)e5YPqNM* zp|Q}Ji=2|dVN6HG!+d1xaH9v@64U7K5wc>0Xf#buHJV);reQ!@f@yB6kq(nnx&P1& z!TtJ2Rqv{g=~sBOIcLaVZYX~YPB(-%xB z_XAcwi&6da5mVPsGv9#|hD-cpP^(@(DS+ymR=}pfswLGA#{f`uXi|P8#mh@T;QwiK zVKj=;Gw|9d{&_<3WoO$Z<3m^!+v>ucn#;D-{Tl-tLHE$MH1Ro+%t1k z4k)r1ot^kbE=6Ib+ClKtqh#7mrqtW{Sjm*K7_HY6Vqsi+E&AMwhcGkfb?A<;>c@qj zj4lb$kM2rFEQA88H<9@8x+8-g!^F>GaDJ4k!-{^a13|feW)Zl{jD)?7C6`WU$ftw3 zHqg=Ve6`VpBt+1Z|E)wDDe>!ud*k8(3NtL)5CPEw?gC*CGQ=NnC1g&lvW0x`Vhmcq ztG2vl=~r@g{ZN%c$w{?I3{Mk4BH0NgcX3Go00>X6-OgQ7RJ_53oG4(}l6>#|=l2Pj zz_6Bb&C*-_0;55c%^$M`u|S5f8hJ3WO_UR{570kscocXsk^TUn{*yj83~A*f7z4|Q zpm?$xC}7p#8BOKKdXnP{~U1GNnbQoma*xY-5>6`b`oDK4C-EP0^6-Zl!u5#<(^#UK+-QM`zZ^FE*Zt;3yz95HSziGwNU&S>ddLWzY=ZSKA0bRMDf$dIp@Q z(Q>pdxf2G%HCBKB7CMH3+f5H)3!Y|-K;-}v=@|HYy@&B^EtVG>Bc0n8xLJDp30#jH zgv6$9kl=r0I5`&+)<1dxRB+C{srPWAPZqyF_FrTR6q6ZMJFYz{o%)QyrNxi=U)xqr$NpN3ENk zIA=z)bAC7ezS0(ysqHLh^kzegPZQ39{oNY{3{DpNCWVgS73GW4Kg};Wzl`x?KE9y? zI}e}JE=qB5nx)oYd}*z5(`y_db-?BCKi4g@&f^PJJwIL>Z+|WFjq&~2LeuPwx{vi` zn9j#LYQkFA%8HacTS_~ot;HP~ zb3Oc`V|LsXB8h7y23rjF-Ae1@X1$AvWo7>0ijcz{s?s+5B)yjP-&2?$Y$@($Hm5La zv=6|B*7!?AdGURuX^8v5K@qZbV4}jVW6dV21Iz`jR#)p;9COX9y+c-W`#cS>(rxBW zf4_|u-iyre4X>%m3*uTtryc*NK!XGr<*Fl__I$HZ#f5exCk{lsHX6$~ge*4~Sx;tO z>?G|Zw|K1jS53J-Fhv!dzkj%HKDwv$rM7{JpYzY_^q|SVG^k$~t)y3cYKy8UT_Gse z6dx39Q(%PEXS=%>ETZ3~pBGQR{`#KKLne{2`>INBr$&8$svvqn5`x`lLrq^#Dkp7o(eduJRdw3ym3#pQ5YnpC4?)NoprO3wci46FEA_Gxk39qAy}g~#*bQp{(FYBS1|N2MF3 z-PgG!b)sNGa6pQ{g+)Dz9pxJ5Jp_)hzcW7*+xmS~Gb?;{CveL2B=EeCK}hPE%g=$s zCZOT7lfa((1;wMv&z{B2?yx@|jcV(|{&UP)I&;V#e3XjGuy^cW-^N zGwbEc;(wjd#oxDzygd14>UA^O{p%)dv{UbY4s Date: Fri, 22 Apr 2016 16:00:53 +1000 Subject: [PATCH 062/439] update to reflect new UI update to reflect new UI --- ...oard-windows-advanced-threat-protection.md | 8 ++++---- windows/keep-secure/images/machines-view.png | Bin 70885 -> 113086 bytes ...ows-defender-advanced-threat-protection.md | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/keep-secure/dashboard-windows-advanced-threat-protection.md b/windows/keep-secure/dashboard-windows-advanced-threat-protection.md index 71d3f0b9d0..76131653e2 100644 --- a/windows/keep-secure/dashboard-windows-advanced-threat-protection.md +++ b/windows/keep-secure/dashboard-windows-advanced-threat-protection.md @@ -58,9 +58,9 @@ The **Machines reporting** tile shows a bar graph that represents the number of ![The Machines reporting tile shows the number of machines reporting each day for the past 30 days](images/machines-reporting-tile.png) ## Investigate machines with active malware detections -The **Machines with active malware detections** tile will only appear if your endpoints are using Windows Defender. +The **Active malware** tile will only appear if your endpoints are using Windows Defender. -Active malware detection is defined as threats that are actively executing at the time of detection. +Active malware is defined as threats that are actively executing at the time of detection. Hover over each bar to see the number of active malware detections (as **Malware detections**) and the number of endpoints with at least one active detection (as **Machines**) over the past 30 days. @@ -74,11 +74,11 @@ The chart is sorted into five categories: - **Threat** - all other threats that don't fit into the **Password stealer**, **Ransomware**, or **Exploit** categories. This includes trojans, worms, backdoors, and viruses. - **Low severity** - threats with low severity, including adware and potentially unwanted software such as browser modifiers. -Threats are considered "Active" if there is a very high probability that the malware was executing on your network, as opposed to statically located on-disk. +Threats are considered "active" if there is a very high probability that the malware was executing on your network, as opposed to statically located on-disk. Clicking on any of these categories will navigate to the [Machines view](machines-view-windows-advanced-threat-protection.md), filtered by the appropriate category. This lets you see a detailed breakdown of which machines have active malware detections, and how many threats were detected per machine. -> **Note**  The **Active malware detections** tile will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/en-us/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product. +> **Note**  The **Active malware** tile will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/en-us/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product. ### Related topics - [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-advanced-threat-protection.md) diff --git a/windows/keep-secure/images/machines-view.png b/windows/keep-secure/images/machines-view.png index 5b5fefb5ad508a644c7959d7ca1008316cf57a64..0c908861225dcbf35d9c75bd8fc2c892e61f280c 100644 GIT binary patch literal 113086 zcmd42WmJ`G*EYP6loaVMLApV@1w=p)1VkExkd%@}QW_LRK~m}N?hr-kmR3L-VF8lg zT)OvtKjRzk^XL8Xjqe(JD_-kb=XJ)6<2dHzxt6910WLKz0)Zg7p{jHnfxyr~AkbED zu;5NGahgB;bw5zJMiMF%^(2lg(A{oYs2a1RUhn69l4E4@$?h{m!0AV;2-$?-PvrvHVDMclY$wfxPpD@{pB zRAvti68esj3rL$yWZf23(wjb`v4i;e=C52k{KsS4`}SzWaE&bf{Q2DHc)!wJXoYDv zr@@{+VU3ab%S*Kny=jd!@=AZNJ$~~GD&yPwHE0Z$>jLd(p!O+}X4&@kn zf?6X&9UYw=B7~ZnT1WHE*Szz?xjHpZcOOP1zc$B3y%jEL;iJ8uffT0R#F;8FA(fS` zfl~z3!Z?9g1Q!rBb#)f|>k~EJzXjoP+@6#FR_A(iOO#)o>F=vD2#fvB&l35~FR*DQ zvxi)%qn7gE$0DM~zk2m5t++ErC=o+f0++sv3}HLzKeJoy?~0-c_4h~Y{T#}^9zE9V z=XZE`IQM%wRYhGLpAwt-yTUm`SbZ-r16U}(8@fh5_Ykq!q znp03PY$N-hjToMH`8kOBWch1wdHIw4lx(kq&F!6?*16WeQtKf$U48v)wM5ys zp^{P0#^OHNmq3`Ea-F(P-Xiyu&)#_c_bV#{0x(v?(Q5vN+nK(p582bFPsLnUbpxkL z9{#)Qt~jU12cfTDzy5kmMMY)4K3=*qRb6b5Q&m=W`NM|~A3uJSyM8@bvwIh24;$!s zdgL0lCf*zR@2r9@lCZUW{i>Pm6M|25fryAGF)1lx{)VzLmfFpm=Jxi4a0{PGP$}DT za$>@~E$AXa(WAb9kHE%VR8%xk%qc_jn39UBbzp!PUMc4MJ?uTUnw}ncWMm}2c^ih9 zghWP7jX^d&C&^XK4%mg**RQjyqNQ~VwVa&=U#hVxC@2{IIJ|iAVxgzE&D)3wJWfu| z*o1_U8I8Zz;rU)_w^xW#*eX`@SUr&+O+-XQRZVS>@};h>E+YrWMfi8rzVN{P{xo@y zr8kd+i`FX4!(kX0n%A`H+nlI^2QdlB(2Brer=cV-FRvCmDLW_Uv)j2ZPqc>$3Jc-G zz=8tq%42<9-Qk%pEPqbbhP>9OXjf)wX{pBL=j|6$#&s?i;U5wV=RH?bhie*!LO86g zt=ZYx{Sy+%U=R^|A@4&+gnwgWV;55BVJ`wfE9r)hnA_YWe4`!$+pTA{)6OF(csVyW zx1_pS#oV0fG6_jsVq)0(`eRZGifZ@WidU~*VX?5V;L}OymPuW?g7KQq)V|V0(bv~k z%zcyg;n(Dg;D)r)o}|y8KUckRL*C8JEk9X@go1)1S;mJNHqg#Z6DFUr2o9;|Ki2`!opxQ4-0eaVvKCjzH~lE+x}z-N8YiO?RbefHF|<3O%|eMtNEM| z;j#PW+Q{hLd-oK1UuTw;m9_Fe_*UbD@J9s|6BY(yG&D3=c1svB%iP=?!ok78!^_KZ zr9a*CLm*vLQW8x;L4o0qahP;ibTk%%+o80yh{fHpw z5TU0(a=L&2zSp(jNmX#$g~dguvy-O?SJ__|`_6ywE)z2_%$nVDVYZP}3?;l?Z9ly? zsh=dlUiWp0CAQ~2rRd|t$zPguSy$NDE+E)$r4&?Y;uttPJ0s*QW6-_4ykKKlL`AE} z?)~1zyLd4mJ)KE2Me6y<$;rO`SH;fBNotyF_85qUy}_I7NSIDcMQrS)N~YGkckhNh ze{NlJwUjehAzhSI4;kaSJbYbQSyb%1#FZ;bMpqw?^_!lW{q)JeMxUk*4&Fxe+hoz3)0i_DTS@q46Y9X}YTdn? z>tyumQpw3~>N$qi*sfecYAORh0RgKbw=h}Q9blQz=keZ0t*w9ymK?e)GqtPwkm?kn;t@AF3lo^I>t-O%U7#f`}&9wR~WE@?1G>6 zj}@EpRWY%#WevQQRA{xBuX)>Wes;_+B&6u#B0M-aSkd6+%FM#Tdhi_rw+#cc>r)@j z1hoRwW_rZjj~^d)0&}y*>=hKAO=6p+Z$_;8^zR+9FlT&a5f`VLpP&EO(-ROALv&w| z3jTB3n8bub2Kx~{O1X&8)YM$?r4fCMKf3LJrGden|dh1pwM5nUy^3EC2_D~|o6BG~;x!JsL z+_>TB;?mLZboa^_=aq5fkR`l4@y(m(-I33qxAwjfVqK;ZdWcU;OH19jKR#~YeX`T- z_~eNqxabTdI^}ALqMqSlU1y@?z4ZQ@bRcY)vKs0be8!hGAsFZM2pO1}$%0yAQCYU; zy9?W6w$*ugxIH~Rh}9Hq*dcrd8KcGV4mekVob`$FY|SxM@N_~Lkc*3}$E$&nn;YNU z+&nBYl2n$ZRNt}tgBH8i?b{hnIAukyxNqA#J2B7B&QR`cU_j}%`E6pZO45B(2~s4y zl7ktPZkEIe}VmS>oFE|c9OBV@Ba2Xx>phPTc|Y)4zh#`N*6T%@a-LI`L=;#gFw zdTMii{3OXj$hoTNs>`ys(zEjjm9L)8C$82mk5vp|^ zzkmO3?d`>X^X3i0A1tI&p;BQwEJpUsAb)pneS*ZYJDSWkIFe41JRu>$(cS&^<7%4` zPK2w7G6dbuI!XxJ)V9tLpuT@oooL4jl8kjMn?FG zii$maG716H#m#5b2>u73Na0fbD&(%b!KMfq%^U~6M1=gn`5ipqdoYlY*@0apUF49!;(^1 z-^-UTRihWbe-G;DQ2O}8IjZk>$8(ZS)5^(T=;Xx2uCx%*f{b`W%gf6t-@{9CU{pfF zt`upninH~ROX>Q#+cVtwrrLC`n0w>1B`U5D^*%+0mgVfP4hwskpVGfWhO%;y;`Z#2 z;bKB691a;@86-@nu({{x zQY9)vYXf;H-d5{0Wn#QEXxZ%N;D-fKc&-1tckjk!=AU}&A~&Y=i%(H+&d6W}NY~cW zbHlFj#S0QzIy!A#-S_T&A07sC;59cE4VkvpN~(&vt1O>RzTFNfpytPE)D(4?!JjLh zxtiyI52yw3Lw_CC$C*Yi)+t=miaY4|va+&pe6Ze1QzHvYOQ*dR?aIZv`g({0a+ZCV zfHHLT^uil$e(mnYy?a+UirzUhV{#IIQrVI%`E8TGN`J?Kcz8HJ%(F*uq=ZFK@U|U$1fX_< z@!@aZjLM2?YA6BIEgYKwZ2shMpW)Orqb;LR4FUUC?en4x)ldv}bL7Z>w29dAk+HG1A@DB{q`Qf)dB9WBD6 z;0^0myLC$i0}JN zwgjM~cFK0F=%)znnz^}InxARR`}bFj>fH!{>uet!gl1=7m6Dd8-`XOgp`n5M8kfKQ zR2$Oj)SMM!m6c@xyNdUppLmp-&_KLC(@4`|>Z%*$$AZYs4y3tidrs~?Ck@S@P`DQ zEa|RkBg0?Dh&P z>+|_Awnu#_odtKx5yJ#SwNH1m4(S#^L+A$776-$i2EJzh?NT2rJ{raMrKPsP!OL>S zB?HB#vJHm|5vm#**EKbx#V}SH4`$jSvUjX$YG`x<%s~0V4Ts2($%MCWIY;NF8lDO* zEG!^~ky1ws5qy`ZsX2>Cp5dl#mhT3jW1}Vv6LOLSQczP{Yu*#jx)8Gtm_klX4Hp7R z=1vNaNdu*+@9z&D8cEk2x|Y5qxk`*SpCS3)XJuJHcn40)FDTeH<TjNb) zU@(e{-(8*;R>)acUJgZBKjixHMz3qY6gq5g7xoNXn)kI{b(@NV+yGnie9=L_$mpV? zV!LwpCN5kZ+p70MLPEg2$k$RUFz0Kv3aNBV6&ER>S}A5Bqi@{9JVb20uDQ$))HgF z;GL|>EL=IN{Qy$KeYqs6jL9K@&U5SQk#KlwzAvc(D@W6cGf%j|Q5>$9_g(p{t4NSu zA@Au~S5uJ7SAZ$lpgtZEbBAw6(Qu)?CD2U8+K~jO6RbB_(mq@M#=uXlL9?w77pC19G9% z{pMw?Pkt0iO2a#V7D`7|084}x6jnOUx3SG0z+uJ^(1=#7_EXqR4qP&}Ef-;9 zWyOTq(`ESQ_bZyCNJ<$H56iJ4V~>r>F$ALCZ6p5V@XB5aP&JqOeNEz!9T1hwz?6YI zb%VonAR9fAHluupJlByFz9anY6BBn&GHf7$0+L_&%-0MIe80=&$=j@g5#-HcHl!lX zNVfvt>j$4-nSdLQiQVrue>bfx=4)9#???hqi%MktNS5|Udi;2^{c4W_Xhzk9r zi8%+Ve-!i7$-o&X$r%&ir5`uvg@xhVAhl=2gCFoxeD?3Y`-%k9&gZdA{FMzv4J=ja_xBgniWuhH#adz&=^drwRrb>; zGz752cq78`{{8n|6W*YT;Q}L#5>dZ=`LdanRgS1-%huN5eU44R#UDYtf}SF?7gc|_C;(yH%4hYCAhSVxD_BnvD`~ZB%s1f4~3mVSZ&G)1cY6@jE3G z6VvvuUv0pXE9~*K^ba}*2DA%fc@a^c4L^sIam@kd3RVb!{I%l?K&buOH(F2@En+WI zQ9Xy7kRT3^k1adH$?QfoH6o*;SWWSlza(J;Oxtk+4h{V53fiaot){708Xa#%Y#n!( zG=hSI&Ec@c9On=a!@^)4^FLmjhA5=Vd3#GC=0L6|Jvau`IXsC{jV8fh%X^>dxNY@Zm&N`jeke3cju` zbVe9D*xtV%gocjAC@X84P0vO~Mg~k+1cC<^o*`SrTfS|6Yr$<2U|E0H= zG_>35I3j=-@+mPLT@)lw0850p!584mD`39{CBv{=Wqr2AjUjM^7?_x??d^&MLW16h z+gOk4F5=;}1I#mf^eB5j<^VV{4h{|qA&9Y-nL#u>oC_rC5Qqhc8#Tjs2Y6!#h;wl- zUIaEYNP)CJ51Mxn*oq;|Ywo+x7<>=WAWK73Nfx7j(wityQdZUm$-l#n0-)B)iq-mL zC0+zM&*eXImx)QrAsfdq&y8ERC=@fElU&UJ$a`B|)3i;iRQ$jiHmJ-r5?7y#r{}^83d)3xScU z3j1jZU|T5CK+DN;iET574{9(=qmnGlawM zGH&_>Ej(fjg~Y+PI!&0^*qId-q)(Q5i9`E9Mq*}UloPZo1;=6d`t>W6Ra#Jbk2xx5 zEhM>Gj@>@jushhCMnxg@=iCr#*nv({vWvJ9Lg^EuD~2KFQK}F5{{H^L8PF{1gIhOm zw%_Dy463vpYnz#&2P6sMQb|*j@a%NU@8%>K4NU|{NUBw2MYk&DO6uz+AvU9GI-n~; z=30a}-@UWgJ%U^H6Y31)DJdz5GCmRjc7{XrF6t2EYbqAvL0Sj9Y?+;9aIQ7_C3TgJ zEzkAK$lhD472h>ZI6mN83qIe<9^m=c5mf;sN7Y|C$LyV)1W?q!oaquVaV{>n@AsY; zaVaT;j~*>!p_7^KM?s09Fq(#zwqQq^kC|EFwyDyP+uK*xxZ>2fGC^|b92z45+V475 zw3<(&Dl>Ckj~-)Nx%<$icSUW}h6DwLwI@J=?@Y(wYuvjGU_18RI|2uXEkd0G9uW~T zz@!RhW{liCJUhQW^JSVg`!2+Uh>MGR>~vD>EG0QufI+hJ@pVI9iJ~y^K$AT?Wbv;{ z5l3FdOqBI&s-e%pvkOYUin_hjm&#W(RN;5}psoKMz@pZnA(G?$4MmX3j`laW&Jad^ zU7QFH5SWSS>3KC%x%V=P{frU(Ui*)4Y{g}v_)|C(f>6L~{Wm=YMJNhL1IvfwN6i2r z7&n%%sSlD2cAXzc7bxdy;d5}1kbTfm$kolQ3q@bS!opb@_BW@wetv0w_=OtM1qK#Y z+r$JF5DMZo9Z}bUqdxi5WmT>7r{2RShl??W!GT#>Szq$#bWKc(TwB*ueUEM|I#Zpk zdAFaQ>9V(nT2J#M3=TJ35p{h_EO>Wrc~c{c=QWC}=E?u<1#nOtMnl!+0Frp#>b|a| zw8u}}WMs_+#SB!nVz{u4NFOCpLTL>4y40-oLSy~$P`mutSd=KtA5?}IP-5CZQwI3M z&chQ758l?%>2&>a+Ir)Tt&xgK6-bE!2((q3Ja*D>J&q{37*ShWTW-UOoSrwf($dn} zdU{z0w!JU{8ylO(nIsP{Z`ajS?`KfOzwwGIL5<2Q>ry2e#5t!N5KM`4bvA;j7#R2n z+rNDM+67(@HJOp`{EW;RfF4V|4(y@eVdRZJjO?P4@fHL9X41#1uU*qs%{*fXa#%NC z^T{)PlcygBHr~?c+0e8li#aLqs1ie=-v(Xbju)Xjlyq$pvzWM*c$j#2G?EqW^rs9l zkZ899eR?+E9$NjI`wsHQj~^n2+sWp*+FZnWb2NWT%YY(JMgsrTt#gP$3kQ+{T?Qf$ zjYfIxJhtc1;^X6~-_fV&u#i+TL)s|qcQ`dw{9ET%HHQ2@I5aecJP9SFvvHw;LVw{E zPywMp1hRp|ttU_tfNS`T4>(^umEqJUprT<8O~12xHY(_sGIzNp{ldj==Z*RPc@CZw z2R#b!{CA%pQ2Ij$JlXRTAyn~lZM2ZB`oWifE99$=_S1F25MeU`B7!j%dKQ8F#SCRQ zB6_KQ8?XO1956|HY@_H%8!$DfbD=@Gh+Nv&#DpFqc^Jy_vQH_qAQYf3?a=+*KG{V` z(H=h%^dTJ0tiSQyoURZ3{{6o9@kX^F!CG$2e;PAfJ)mr=0HnL=bpM|EI|;HrsaehGD@$j`6&s((Kvm^_L6XP1uR`NjWby#I0gf3~pL@L^%qA%!^j`1H#j{o6AU zNBEzeB>w6DpEdk{db^U{_9otax=9S%n-Tl=e`lthk6I{C*W}=ZpHA~)v7WfUgRf21 zi~rrs!e=nkN*pHD39oI+XRjTsx0e2zLnSpVe)uu|?Z3VugzD`1(#H6=@k9b;>hG^% z{oTxADgkJTY2;V^(^!%5H5`Wg$ttjlPHM#SF!pal&^uI%&0vK7oUFM>KYkq7QkA>T zUoV;@MSXJ9cV0v6IK*NyqEArk?>L&lsBxkK{w~8+*?6iRO=-`OO5)*$Hu! zAx-G-OWF~0u?&CuGFG|a@U$a{FOU(94U|+>Sp8=ka0z#rGRPB5JxCN&{jwXA{`NWz z+l&kS+k=DC0?;S~bWv1+Ey}+8zs)&~v%bd!0s;c;0E=L*nE|-}?K2t(?<+EjFNN zH~jj<11n??=D4?i$}xO!u}h6HyHNz zmVslHsD^l>n672^>w6EStZzfj2|!#_Xa%SvbF!`282zP>YB+In(y;MBgrDCZ>MD`a z|JXy0MxjX~^=n?^w(L}2TvRoy4%JNr`5hPnlU}h&p?jLb@LPj__kU9T_U+3MZxj?2 zN1l-e1O}qRGf@z;pu_8Z)IHT<;eQuD{LuGgM@2nFs`uq5PZ!7h zqW7K}|)M%C#du)9CGbm{| z-F0!P`2O1+dS;4?9g?Ka^Ogzm@P;I`21Y?|>{tX?wa7z`oAv&^m3I?VCV7qPhMAYG z)Ne|wG&MCD)H<`a-)3g!0VS)#og{1+)n%6v+6BC7ZfS|_H*>w!Kn8RW6dKo)qu#ys zP?#NB4IqO($*1!J=^0v!tm7G6XXWBVO4Ov`Xn(!1&~8 zAF}QZ=E%O!@!cXAagD0v0G)0qOT+fpQ3ahv#usshJ0xuCas~#8_ko1agDIEX@3~z0 zBkv&JmoN56F-132H@8T~r*POWIw;*Buek6?u|;=m#32y+k2I6T(r3RgGJC3uOGqq$ zLTYH|b#mwwNiC9>a8K#IB+AH$h_SJ;q0K=>P*`<{KOjE-@=4$MNlaJ&6<%IK*j~&0 z>PitYad9Tt7$6JOww5>t3dl1Yv@nJA7U0oW6mRLa$3f}NY4&;qxjZZi%8`Ob*AqfR zLu;h?`7doX9T#p}h6$aYJfS)5G}YkaJ1D1 zx8!^VUupiP=7Gk^pcWGi0u)5Q#dz6BL_=M z7VFH_H7lU0HpOIj^7=kkSPylWY33x91Ce%`0yZKb#gw7h*WHbMOKJxL+OHlzxc5^ z@_^`uLJJxA_9B!3JE5G2h5-AC-*{|i*LiNz;8A+T8+LZ6hE9vZLu7yc3-ox|c^NCI zsH~kBffxlUTCFEC&!o|0^`K%v`PA#Z&Bs`#_-<@MT7Rgulk=HGLPbjdws&;FG06JTqMC!8o!dege8;1CSZydFOJ#(rnwh12 z*Wb*-3Hao-)fftGoHBy);VoTV%IkKFK^z3ZC@){&R+F19iOLEuA}1xScpR8?BNdUw zN&rPZOQNW*XW4+&p&ttkVmHs^K8QbaP+FIV5|_;Jx=_?qVq&7|=G{|j2?f4{(f79; z)s*(wBVuAu@(#3!&Ou!kV&e($(Zi#);!Zm#4wO31E1+L{B4i-6!woy*Vo?|A3%47K#wT5)qUpn@Aj=ssCQ zZqCjMpqZCPbT*wG{V~ZJP4={@%g_rojGKd-rI8eplf!=FOAL4h#5v)kqa!HWK+j+Q zcj>T*2-}LBGEQ?gT10%h!G(Dvkg`b_^3RT;G#LHecj?EE8%6o7I2$(WuDbx?%a0|9 zU8#|Qq-ne>&}rM9t{B?U47P{GF+5)icy&OrZETDJI(H1fa>ga0--`$;+6lwIJYGs4 zua|FcZ^v?zguFnwG7JX2(ZNvY3+j_O#z#2{#Y#&{i*l$v&bNjf?<;mU};dDp8Y z(sU#ed0k#U;QQpaZ{IF4FvLLLQ02$r&kBfij%38D=LI@3M>%JPfUHn_;QLGv%1~lS z75H>KlfDAlU1QvNEG#ThN+n2TW3QBu9gQV{-N%#H%BwNath()rvpQuF8cEf|k62v?}O9}J!3J1rLrs-N? z?E{Z!J^+pOtw~&kL#g^Kq(>>NONb)iF!_Wwo#i*mBRxwl7`! zBw0Sn`Z<3vrq$o3?VL`#>AD1w+beOM7b^ZDx#5NVjj1u9I5r~dZ~l)>_x}sOu`0b# z!Mmtp_FF+#>UR)p0aoJk&*i&C3**Ii4_6k8V@*BEKWKt?{JDmC-%bm40(A(NwvDax z5=rrHyL{EJK8)|+3?E@YR!ieYI@9rTxogho_La+3L8A4o|9nwtBloVf&WY5!ot@Bf zGz6Z$5|hQTFT%A^SKSk-G+y^^p$bR<^W2?l$!BLI9++n@8g>8jfv}bID}i5xKgdWL z-ZNyB=A}iK0Hy)LwvDsY-re~P zlrLkn?H_b$)Zn3A?DNA}97P5^iFPN*e#;;>0!a~J)32lbS!v8tKMIOc+$0& zy7Iv;Qu207g`KEmFMRsuQ4`59FeeIYPa7}Ky8d;{XtLt4m;>!~^{l3Sejt7H~t+sL#Hnx#tGF=+qUpFOJ~F7>-j z{Y02!;hoeRh*)PalC{^^%xnEwY>El7=h4sZnpzeZtrz$GWM!_}3hf=mj?N5S9hv%< zb*NH!lBJP7+|VW~^^tvcCPQ{-L<9$KN3nl4+oGM~m^C1Rv3Z-VY`4gwEz$g_(l9VH zyNuud<-0>M^PB7q-%^Pg^2tA9A|BW`+&3Me=FL=@WOhBU*(qI%B#Lu8N&fDg*UiVv z6Z$*xZafk;U{1_4=g^})dh1eycf_HXbEgr;7tgzkM<2m&%LeVQPPch{``j5wE*31)UiOgkApoMK?t3=>|KMcWx7Zu>RrlU&g9F_AcTi9 z2k#ylF;`K2p0Mp*7iA}F@el(;;bJ7GW^zv)J{`6FHA=yI3<%fxj-wv|7KyiAoI|fP zEg{u`w8KGTU|MDy`1Nx=0{1C=AacLu! zh&9EBw>n{r@y4wZkK*1V>de%;43(BSRrM?PKa>8rvdV1`6#3_z4WG?mT0PSABHZfR zeZ?Iy-o(IKy~T)HJ>TrJ@9o*8qI+95$3>o74)G>5h4MI}{>>Ng)3x&9@a`|05RZBF z5xicn7i88u*?RXpmw(Nc`)=wx_d8{MNjF91?1e6YBQoCK*ZpXRrS>(|?S%I73%`KS zHLIu%)T=r_{GgN`)N`gEnGv*AJdcJGywZ42ck0GJHe{!`#sA>Wcl*jq(0=^x@^&5# znBc&ulT4?~^$r9x zY#jTO#Zt%XFU8hkIJau&7X-loC;1tCtZD3ndQ)&8*h{(jCb3l&`+EEv)97B9n13oY zE#Kb5nZg>&rjx}6_um-x zLM>P1_Ub_-F}}|k-Q)3{cki_dMOTTAi68Q*N%|5_)ao-%%X2Rs06cBGq1kP&liw~0H z5_~NIpUD|kVY1n0hVtHSs~qXK>+0&ki!15z*4cL+q5nhGGpf?Z9?O7&6X$&>e8I$3 z@n~mPBZS$yyAM$O_wZU&ID%mN^N9`0rm{qMd3p3{x)z0fa^LHH`WuC`jJCj;zf&R) z96k-`+}(DhqLrnwZ|#99W>3bY)rV-P;K-`x*m2%$%eJ104tQJH%55iuRH? z5TnA!79siWnc09Z$4LM^?&b72%U0s5Wk9N@z#Vvl!y9zQHV^~ZOrwVv@5D4Ft zuQu&Qq+X-{2u!FzVp8szg~P1h8+^{ii!#dfhJ1F2Rpj!?t&o9z_xaV@a;z^ z8i$2dbpE6K4c|7*c%&8)#PKX4;#9!AmmmLkc_=O-xvw^|m}JoK{Wv$Vt0v@R)Rpt0 zLMbsrA8j%usBmf`KJ@SJ@Gvv4I=;R0ulx{}Q~tmF(%b)%fB*k@J4VXVa*|zq7|Yi1vSd+hycY zcI<>sTp%52{wc}pf1~e7Xe{IoD>ZORzNu!aI*rHT) z%BQyD-3Cx`ZD587L~nO*JU5X^6DEzD_t<)hl+p&P$8Yj=X%BoD1tn*?+#6xMKC2ZE zL#?D|HNa20v-~@K}jBD(s`1BU=`vlVrpgPm=f1_P#TnN*w#G6Vvd9mRjUNfGKhMj<&S}DCx3$&2dnaNQdt;i7 zZo0TLs_dBE&mc9{%Uw&?z@O&F!PLpHCsO^!_~r1JYgZXJ4#iRUYF(}!B8}#hWHdeQ z7!`vBq@keTLy=makL$Vd2upwx9enN=?=T}7m1iJS@g-H4+$WJl~sb&60!p2BjW)!g$Z6{%K9AsHSu)$NVDfxdR2Sg^Q;oXbc^G9v9{iJ8BceWw7WU-8D;~v?M!nCeoa0`KPKfM-pb&|TF%W2()HEy zTcH{C20l5YUpLWrY!;gn+|Ex@R$?y#klQWtn9W)=EP9@MGk@`_eF+P zqFwFvyMeIb0&}Y4mnY|b`**Fipn`6Vwws~plhJgI_$OTZ1@iC%^;)M@dU+TSai?w4ZGYEV^a!^%H*$0T$!hGy51<71yW4oDUlN56+~& zd8J`&&L~feTuA=X6t-6O;t)w?DTcp__ofVYjPJ+7!-UI?*wO*5S+eoD#+bi=R)-XB!=6FkK7U-FR&^v}L2}+QDNCRB z39-!}i@5nNav(F#;Z5b8JM2xyfs%KK{OO}QFVcP9SPM?1xDyc2hwRS&+IVhc2xTy? zowNnsJT5M6&tqP7&XI#cj{LR*S(DDUyK1^pSZU-qJG4R9LiRf>-wwt7uW??BUU(*hjO(<36?^-0Tj&5^DHxQ8Zraf|7EuF5Y zviAAN-GxO!j&oZ-Ce1vE_YQK$OBN+dDU>I7p4c3dzJ7IWLb9u%Sm5ij5jn%!WRkKe zQ+f6u>?dt{`3w_|Jp@>eAzl0DQ>vP;hg#mW;8Q22PQ+f_mwqbhr2Q=ksRrK;DT<+L ztw?3UCpb6s{=W7>bzK1Od{G?3xXw*6W^zsJ!1!{!Z@qtb8=uyTjYA*nPt{y2i<=DX|lV- z`-~C4-ZU_$_`K!XqtA18Q`oPGOy&0)>BSCWQ#eO43t`M{rE*;pXY&z(|ly1mwhb^XXi#T`9ue@5DfFRr!5 zl;Y#3Jg1|FJe%$!EhWCv{e2}-mk~dFj7~maT~kLywAs8I+Yi}EWm2U;r^3IFxL?+M zb`Lqpl}Air>fdJ@RmzkmyZ#03`zy0PSJrSF#NsEL6VG~bL3H$S!gWHfK*MC7hKS@= zawE)tdjWo7i+Pq_cr_}$b3c{0=1D$vc7&}{a|D|5y#xQA)aBf|J5eN^L|RjsT*{Oe zrt91S<4V!$(AXQbgN58*YAJ-6>q+-F*W*_bZNe}3ksqWfxry)(*Whg`UR*Sp?yt|s z%MAKRL5>P5s5dEf_nQ6oJ3X|CBgrmH`v>=qAa5I``$+hZ@SV%c~m8EAQivvqhs+eTtUJQiq>Zc zB2R*roOx%L7aZF8C*{hWf%Q2nf*8>bye;dy57@m|H5!Db=nr`5VJ>)%C(9<@Cx_Cs zhR0}x-j71h4@e!4XEY*{8^~=_UqoNx=g+xr{ZoU~)ranU<`nIIc5}xNp8)1k72VvMVz!h;eV+AnsLs6Oti^7u(Z+tTe<%B@14zU?^{*5TMVD8G z=(wb?THC9NMm~8}YPkvc%b%LiS5|s#w;+t)im%?d`;?~p=KVz3tZPNaIr6t#(bX9; zjEmp4^{yS}HAsr`QTm&=X;cXXrqVf{+mpFnA)VWGMjzIl2|TsJD=6Oz-+097^y@3S z(NQfjOpt-^GaTxS2|T09Cr$*esGyJV~hk9P+*Yl37}*2|15| zS2Vw^cH1j0;G=QC$Svz{z59acuN+F>V~4dMx5`o2H{D;0Fbi2$DvWMrk{&h;@^jCv z*T1>?hxxj?L0FS_y~}%hv1-9(tUjmAsWU#H%A>&R8s$gf4hlgk#{9KAj>z?k$<1a# zXSE!vJ($j)pTs>f@RxM2Yi;wsz*d*@+R($1fnUJuaiXvXH3gbjo4;`iV6H3q&E&3Xqd9|xod%JVK~J8_v`Dwe`rxXXlN^c!9@i!!P$bW*-{1 zw*R6Zy!@neO^Hk`bt`~kYgYcu&g^lY;mIp6hEH+Q<|$q@lAof8n}=!9*QO;N+!5iO ztqC;=)G*sOnEr$9f74rzS z&XEN}-Fy2TS_Cw+cl26^(;1?pHV8;fx+TwRgSS$spZPTpQdBo{x9^FMdi1QwG@XkR zy^-#9JYmRMG4v)W-e`KRqc?5lxGv$lZWCG2c{*_XkZLBT@fn^w+TH6S`?NLDZC8&L zJBFKL$)*(?zY%m033en^Vbyq=Vxddo(Rwvq+x8-6=Dm~7Vk=P}^*Mlb_*1->d!^Y~shpIr8H{jb}T8JkT>;pDUE( z)9U5#KPWOrPi{z=k2e0KGmJHP?IyDQNOiPmnS)}IQ!&yq;c?$gWl`MH_Lv^(3GN4;9v|rW<-nU z*HmYFASe{8V4_Oj)381I_Ko^4|JWe0E8~P;vMgIfH>-@k&)i4aAl;5RwutU3R6Y2H zusk^~VC7qTY5cXZ?uYyS*@oXy%vl3hAg20J7V+sWdLXur$?;;0wcXa{dE3PBq?6v) zHyt%AXXmf=hEqlI9;OY3doEZo-2h|wOp8jT-XxRPuNaDvW9HyX4 z3%k6ux1X!O{nUJN+*ixHlet0jj59gGd!&Wm)6YfDDG>)Ff1>J$jC2IS`aDwmqSzOa zm5_j}pUKjs=<123dtXGflWP{GFnZZ&CoB`my;*$y_;^J z>+iYg9&av~`P8+6Gw2x0DzWuJ;KzW7HY=>FgjT{tu0n(8ms*W8GshhnRbzT0ZSM;| z?UwYg&sNSH3+jF-7asAOW8-ly?&a`)t2Mzm9nyCG^5Db8!V~j%Z+^0T`<8ez;7FqL z@{QR8$vfBtUC~i&@rZ81ilK)Q_a6`c(8R-NkM*=AXs-|r@jKWqG*{X7Qf^vU^s1O+JgIn-GU)a;kUza8 zYGG@s<&5`bhe3!~-}=tgKCAIhLd{1!O~HOY-0^h!{MxRr#6ROe52W&WZYFCdbd_9C zm@C*p=GSrgK2ihuM!a;ppsHZPpiOqxZ^*heC?KEs-OYQCh^TURPMaOPkk_&cYtR{@ z6vT&yrx-eO3|#f%$D7Dpv5NM}-9G!;H=5t}J8n9d`=U-I89Dd~E6rW0_xxxkqx{pV zZQnWf+B@I9Nd~`f=Qa4EAAVNL`mI!$eKI>GUT{`ry#B|o9*3k86Q(rTZ5JO%%*Td| z&_BoIubqBR{?)AK#q7gF|4dJ}205)EY@XKpf-4t=oeGLxV76PNJ-o(BHyx?2(RE#z zWVtnUc1Fdm|I2G-Hu;)__D&IlP$E{o8P~6IkNQ6)V|H1}!ZLZmX9cgq$ z>4GCyD6^}Li)2K6fdMni(;BW`KDWwk-Kf_cnAVY-#h<^HXzx&Z-5amJ)oy_?z-`|Z z9llUD6z}H#OYM%on`!L%B(1Woj+pL`#Z$wCQ0G319Bs!*eCk!j!+jY+##_8ji~Hmlk;2hJp99RzPaFU}yLAs<qFOvg6J3B%{a_#Ic)e$)Xuf`&u_WL;FfP@v`y6&lhP*4}^R+720Z3eJ)Ji^7-)L z)~6S;zG;4BsY0iHWz|-8Tl6l^m$uGMVouI}S0C@bqa@2`|9Df@0b%u}>oVBIW#vvz zlwq7cy%`yP=dt&WzV|tW-_f|>%k|)jD))m_OWlH1)3+XGmzMlqHFmBskRDWTr83mK z8Ixs~DJ(d2Iv`ndO4S<;AG@}{b$-ToHax4BX)$v5v*4}9Q|+qPw6Yr~cwZ)%gDxq6 zA=Lz*6^V0gm4Wg9q zZ)9cKh5jGb&N8fyW^2;~hoC`%6GCuzha|YWySux)TL`*wcXxMpcM0wg++jMeobSxP znYrc%T)Ws!cXd^*RkrGWq&tK}_1Sa<2R3%exJ@E)x^C5+Dm>GTGhV%)cRG|dCq|9! ztj^gsc1kUpqsw!sY`v^M&!+c0zg+NDKI#zr2OEE716N?ZrIFRo|I{ZGm9?#SY9LJ6 z>b1In8vy5OdQweKW!Py08T&n8?3aKc7#$cT7o}(1BYK1mE?xU}!NH@0)|(q=2ca<$ zs|5=EC(ezY>-0~!NF@$Ppo=vTWAc!oCeZdtuz}3! zccJC`;U_fX#aA~kg6{s~bk57kRgtsID~j+gN3Y8x-9^mGiy2MY?ST&ln)+({%0BaR zFU&dHMLyS0HbM#Gn{1OkRm4`#%wtGqH)Soml4a7D+-nPe}6DES)e%BD;jlPP^4k2`Y;~055n|N~>=SJFBi{Br$ zr!@>4)v@$CjpjR>c$iMq-ukWtjkDOnbhB&EVZZXQ{7?J1zh3-Y1A5+V>J`dp=W!p_ z^jP}oKZh|kdu)|QPXzs&{^5*^+;f))XQefX2d!~C%Np%*?Kp1Uk$+J_S*9GKrOIdZRy+>d zeY|)*EY22I=HG9rR_HvVL&={6bMyusIk0$He)4rp4LWO`f4h4Wm6YBpQH9u}14%^C zhHd6AEH~{3#_k9Q!YRAJHRjN#XzUC?-Ot>{#>JT`oFo2{de;XQVjy6^G%=U_uzn&! zZNjYRQ2i{EP}ZA|dWsm8(?d4_c7vPRX@-pv8WY2orW z%xP(c!9ea2WH)qB`Sz7LBR`3Fb0+hle$b`~%iYt@0;q^^*9q%)K#W2AeG>8)pX| z*8SP8mY@1w#IwA1`$ZGyV25^z0`A!po0H@JauN3-=fA_B&p&!nzcj!+K~R6p-ujB$ zL52K54kO4=;G!%PwXF;5d)(RKmNSNKsw}F9epv8kjB&<>+H!vd5)_J`Fl%)mv9j~#eS zB7zyU1ccV7H%ta`!3?qx{Y14;4C!D#PLpL($&Q7w1PiprW zb{LZHxLFB61d>5Coh`?1E;X8DbNWPFL&FCSY=Kio$x#hg8v}kj9|i2a)8l#Em+#Hv zgYtb?*2gCb`cW)d*{cfzjVTqb1(<52oo0^2Hg6wLdnuq>8dz#dzYSD^Ty>17(Rhry zeXUsIO>z;VjZ~;7x3n)A9mF03HP8FqHOh^giPE2wE}^t;RR0VifO|tOhDr??Tt6SH{^mf=b&;;U zirvCAgFt=06@tr6jV+g#ogU2z?#cAgBK%5-GX?=wZ%+CHTqkVU=+;lL&{a0Wb?u)_ zqI?gbtNlW{W{aGdn7Ub`8(Pc2K$dQ&?y%Ky*3zH30j{U4`B;;nrC>ptCJ*r0zLGVoVh*)K`|l|uc$OnvO8pNzCW z>!lxWx=KB|Yag+vQkGrI%4pB2NkxABO_si)==+u}&QoLR-!MjxK-=Dzp&#U%b$rkq zRc?Ne_}fLpBkkLA)T!P`l$;uPhL_{kvTc)hMv$(}8Q(hyNklZHU|E)z@Egug<6VuF z`?DPDbiAsXC+>I1r7qj-nwv}|guh!^5F8{)N`v4^lDVZj=n))Vz_mA|cnA@D!0OU^ ztY1MHe3#x4vG-_6gyv)#z4_0gF%9j|}kO#5r~aku_#*BRy!j%UC%)3`0N?(}H`YE($Cm+I-f z>BetouZFsm!v>n&$L@BwsLQjA+s)=1QX^8qYz-y+42Wj2u`YZ(tAj2B)|>+zU17X! zA&j3`_!oya(p9MOs+|YSOh_vQilL430d7c@d%G{a6YYsbpv2!Ni1n3sbq$MY+>uYl zh=#x9XXrg<@jSwnwHBpY_`53i>CbVU>0iQs1EqAjqow6q@G~N1pOK==G0Go-Gi+lk z4}x`%n>le+x{QHxt*nkY$fK~pGsntsW5t}}E<*n`f*WW4EpiuEd z3~NjBQliZaN`0y0$n~}M^b3@BbE2R&fne#)YOu1U>QKf8mq2$f*Zmod{$SbzMmq~> zz*_9rTm+bV6}1Pqba&H_RSTZMT=@bXqcL8TPUS}1T@rg(mk~w#zK0=fGBq)rXW&@{oI=qTu zSb9e7 zt~-W`-qEdp#p=@=*mb&Ha4Z(O&WwI+HoLXZ5O;cw+(`lhcVKPE3cisafIL77_{y*y zVx!*xrk13mGC=^@Y`qGOtjy(D6q#W_%V%mo)x5=zUfxrlq&eN8c5>j$Nuo7 z-S_?lTHdKhJBP0v7`IdNt5T`O`dE}^jn28kgZsh_oHk8(Nj+N2$v8zN4b!u0{K+$s zYkDY`?iVmD=q0ftiHLoZu)&VZJP|lb3`?mh==kV?l@rls)msjNscwXmux@RT-JD@_ zQB>Wbsfl^RVVVNOR^gFKRV$ikTKE2=1y`+eO!G7LkP_5)zYh1GeTYb=H09PlcDLjooBvGS|ODTMd0EJU%j?5L(&v}BV6-EVc>^P;{N>ps_vFUN`s&;pwEosxX09H z0w-NfUcx>xjLC@os@;tc?I-8b-8!F(wLQseh)e%ib4G4{!^1BDn)T{Lm2zMnFdzD* z<()&V4|WfMxR@+>D5gj%AB-Xl)1+2SdSXIZ-ZbtfN^{!x)-AreLq;An$11N+V+!|v zE{p|NyA@*vm6lxIs*VT+1LB&FJYFPes?KzqkKie*W6#`j5-O!i7EWmGQJSq)c08JA z)X&0Vh4l!V{ZHq+oNrcI%Wfh4^(ZCjin3?TiEyX`E{03$CwzxMY=sX8Ut@~trW#W)hVT2~;B#hU)pn0r-E`F(|En1B1*+!B@?u|QXiTa_ zA(`%K$M4e=w8LVLXydmh%Loc&J8$3Nqqz#ZFFO4=^B3rAgZ_8pq-#dJ-e?`LU9t{=7}t z_!1xCTyqVp)bI|)tkA$&68Y>zVha(G29I=dl7Bj`;;O^zLcX0B?$)a^ zQLRGiAqb;YJGN6Z`Z&+hXsDiEuo+?0=O0(uObZ3 zS9@`6vWS@Hr;azDK+wDTiWPo;zENN2^&D;^PQJ$t>B{SRg{Y2}o?!jeaiD`$sKe76Ku-n4| zPwv^#wb{nnk#Lalvxk!VdO2!9Jb7U1GYnA;Zg5nT_&mH44E#-A{g8U@NHtZ(X{#4Z zN%8oi`nyB`4cwjofWcLwNtb{vN}^BQIqAp-MH3MX!5j7u9Gm$7a_K3fCLbiy zzinIf9#Hx4WbCLCDn%fidP;s?p*3(3#0s8NnIvIyTG#q^E0t~ajMU+=Mdm@#9v5kj zJTt904pVXR+2}Rr`7+eoFsdcthL9jzonh0G{cE26XTJOO4jW;iACb7Ma>UYi6FhzB z*@q%DWRVhQkB8As?ztKG=B(ResY4J8(PYH#(BTB_(YB#vs(15l-A&GyGukhH){?Ui zzxym}K@tHe$kT=BHpgu3Bi%&|_eV$M6;(`6Q-l|%4;OLPTEd4zC9*zFVm53`)>%)q1uMA1|bM#8#s_l&$c@a8XPsnqbxsgU&JD<0Df|uHIFguJg z8!Uc3Y;^Ejj=};*&bnLu*crnxt98UsS;N0?<)+;4dD;&tt(cmf34})X6$Nm3=^^W~ zd_B%0#yfOCGcPha4O$>K71;vT2;VzPg>Bu}v$QreUE>VD>7sDDq$YiP1p4n8_Snc3yw**GGP-&jx-%}&4a?ncT z8O}O_Jp$(s5xFTSBUiNa8+ZfHU$@{0+DM}P)z>#g^nZ&vKZnIEd;!c1B`8X7{4?7` z--W-stgLAvkMEr3S6waWEFD9-jg%#Fh7QMeh7$;|0i%Z(jrBZrC62pmH znzI76t7o-9!W(2Xs6A3>wqbE6tGPx}7Xmw@Gp<$Z6Ey2Jspq z+%|JAJ3>XT!6gUftA|F=eeo9Kj4>76ak(7CRUG`0OAgO89eVk2aA=zEhkfN>V!*^&{09lOOxSCF(EPOV3CKx#o8V5mgtf3 zT9Wf?&}M&T40Q&R)VMx%m<+IW&MlfTZsRo!%Ku1(xxNG$z!8{OLaK(3iAmFWPp>nJNgQZ&2p1WSd3 z-!A0lgtu$sj*cXab`z-yxylRfIOdSftSe1zFr3(rf|??68DOxbrha(RYPTS)fu*Tv zn{U8m+RZGd$$&715ABBhPP6N@R<~*~)Pa+}m}+Sa>5ZLh|?S3DlY)9OC0_6~c9U zuT3Lx)4EQAz50;}k_LYi((59QvXYI%lCjochr^Ak@?$69M&})WaaT`SbS{KfAGgV- z{$@r=RcS=V)VohIeb&7`CFRKf{#5x9+(YRa)9HlAkIL~2Xh>9IbS$^7*v|-p)0~nW zJ9fZv<}xJIDVABEG**tda*0L-FcexYqgc2;$mS1%5_+gZwwkq$!BbKSGUsBXbj|S) z17e|35=08x(w_=Z&yeh@OP<8;0FyE0{WDlZphrjJFObT7d|0!fqa$&tO-ZUECa<+H z7Nv}X(St1?M1nomxsa>6m3%c~(k;}DNRn8^Bt&t1JXFJyxQIw*i#aV}m9?{h z4C?dkgUmV;LTZ1)u_mzSHGrSSlpvWf6Uw?P*Rd{!!WTTm_bP)3dl#1NgG5RqaGW*P zswN*%e5ezu6E}C;Bw~bpbVh36h^EgtrB|;@_+xBAw;{{%HuD&V{N*b9t1LYQJoNRg zqAWegVOHinhH#YZ+^>Pkk^p|&Tq@&@Xc-C56$$ner&{Tz=q;QqH&d#m&hX>A=`G|B z2UDSGA3n2MGCE6G@Aa{aJXAJ@kld{aIYAy2C^g`mJQzz4>Tfo9k0(Z1Zk|(V?T#J5 zBpKIbKAKa!4%mq?lN{wZWAy0^FpE3C;IK4pnO&>${) zLKs~!H99-#k+4N2F_=6!sNCGd&H9xbe-aVOy)f|9T-kQgEVCH8JgzE9?OiNfY|$Od zbnacdRkAdONllB0gP}n_1=w=FgSMk z#?3u7jQ{mXn3N20z@N*n<$we=Vv(wB@BPXqR@&I7|oc#o(Fl zkFH2)D+sC6kcs)bY@2hq%|=g@>J-!EWg8-4`_iJDk)9*WL{z<^*;Q>+|%TZoPP0F@;S<{wy}qhWKXr z_oxmQt~$0>dLU9%nU3OO3g4Sx^%)4gXT97!+CLn6L*h$G8y))j(bX^o8RH}7mFTcI z4y^HxUSH?98&72chV4utPitL! zKzS^MhVi9r%PZo#+3==%$33Q~rTfFNwlfOS9S#43YwOZvxG1}c*nE1`+TH0$+L z?>-1}(ko$WQ(bKqcXRdMxe^1W=bf-hQ|qV!DqJY}H9g^dv4Km|-2!{&YkN$95LFxo|19nK?G}iCOG>6 zq8E&3r0slXq)zSE=1QeYJfAP*=a_t*l;x>~H~-Fix8_ZF2oVg4=Nc_@AF)7Ui^1UuxAkgihJ_E~)M*4E z?103!c8$Vx30(>|r!}m5dO{Kx`EEB;g&s7#SbfRk@$fb*ZEZ7Ce=e9%fvhd#)5Ml! zNo4-0$^9IEq5Rw?s6lFtwi30VD~paZ!dBUgfZl--ToC$#i$worJmTy;x4izHqB!xa z+_xIcXgV889pgIxp<7u-@3l`%bioQ&m`Ik3q9tT8p`gPZ5bl&?_~H>{r+;=8vr79nEBClM|h^;Xok0z#U1($wkH+r3}^noGY!n3eJI!GxyTF)-*k zw%#VJ^I?W@fZ>Pq)0q^ESQ9ifgj%UroOH2a8(W+4L5C;BtTbK|FBMDmEy;r+W{8!D zm7+%x;JU$9Kn{k5R7Bt>Mu$aFaGX>GfBm%C{xt}P^xz6rN~EB0@Yfuh@|CVRs#6V= zvL0uX>kxv*y&N(OT)^Ym(Be>9rH`(A##Uf5*fu)X`~jfUVDMId%ASmD+gKFN4n`x; zNqEwhqJIzo@eaJek2(nF^W=8VM{MEsLCD+I#)OZOrw0AW^uk|$Dklk!8YeGnepB|Z zWt)>Tyz|>EsH=kOV2aJQV3Vpz+i5h5QaaV^;6Rj?rjq=|7HUdcDg=@B!|jNHesY$+ zI6ng(%d~KlUQMQ}NKj|;yJVeTO;Zd~#rJHuKkK7MZ5;BzRe9$lhUe$Wv>S|leX{6j zUyXT!!y0sppfu}Z4_Ng@Sxpw3e7DHcG=-0U8%O6Cl*BA=lO4dT7o9nvfi|JT@s(2p z&vI54V^GHqR=;Q{b;8cbDs{sMzwGSgXUYu3n7xN1{t!YD^5y)O6R%1=&Uumn!q_*x zSD9+~_t*_*gsru95HrFnljvljP5eWO4t_vk%THKqzDGp}c+?*0-H#~$fB-3r2+;$J zb`1l2C&*Gu@B0;HtWqaZynkz@r+y8_)@X-*T)z8}ZKIQq0;8cXjEp7vd*alSSLW@< zujIdk&(-%;l;NNu0$8Y~##N$bF>C4;MMrM8ncd$5$M5;Qz`vbFV5LUkz^4y?gHj{^ z`c;_$Xi>^d2|wAEWTwOHyVs~+7Su(cOqRxK-X0K+#llQG%qit#iD^`85F3gI@jXd{g%zm?c1u~W8n2>A8Bas z+_?0Rh_=;H(L@*`5OOQs_84n@geqQY+eV3+y1Qs=fwu)m$-g|^zaJSdt6k*^4V8sa zx$4Kg7w*lOP3^V2;;zo#lHo$GDsq8k!wjVFe&?r)Q5lo;GpJ}=@@O=tiKojy9xEtH zWOpud;)*j?WL7cN))iq)>hl(krqReB0v4ZF9xkvgl3~qBqzz^+0e#5Ny~rc#!p#~K zl_aEwUPwgvEj+k2bqYbeUe?J3H<+rqN+^%fqMM#E_NV9s{omY3vZ zt$bJehFO(isOAiH{Ue&dnhhU6&B4h*Hxjq2F*{;?l{5@=5Fk+cN-D)#KYdv9gWKqf zs})%o=I7kyP^pj}%LQ3}oV^hCE&a5l2$ZZJh|*&4p%=8@PZ60}9Vd6Me{6*k^D^MH z6lV#$h=fG?WQNV*OKa5P$LgZUv82k{3ba`4pZcM^#L=&njWN$E%E&8=I|_0oR4p*j z5(`LPSPe@#Z4Xgrn;gh+CySHuVo#oIn2c(|JccJ%% z&7kqSKL|My6y=mR$KO|lH#$n;(5fR~b6828adc(@w6NioDg&b!w2YxiBCF!)^Bo&O z62&_FB>8IWWStzclTVf=tfENo-4>+>L-a(XIHxWh-kzuYt^-bTcZ^WXk+$!+M27H% zzXpf;~J5|=o>087kV-^3C>dsgU)Sg+S|O1&1nV6QFS4Z)KfTb5EPx# zeLqFfh+mbP->Xx1e^_prS)L!3yl1s4%3;vUQE?)8Pwn75y{JoK`kj}b$Mc0nKXm$c zgX8vi`tWQOg@baOj9n>?wFA;N86q(cBc}HN5fW?X?^K1)^qXSiWK2UrYeuB2h~u>} z5o6H<`Q%@Wkb0KdqhFpV3(Jc$`K3QoQ8nFp?opy4K$}{3)JAXu%rh|Z{-xL}Ix*mo zy>Jv>)4>&he*;*vO{v9!|JkFX6$3;c3=Itv9nKnUw|%5PNsj__;v@jDAo$h_024lH zF2qXnhGvtOYBXK84p^+WKG-!wbplZJQQ*g8`~{$KJog?oV_oe}@EN!K!J}uB12d;9 zK-%SwG!*^cz0qE>Jv7{4ORRpVx6u@~^XenDdW$8FJD$gb8~}~3rS$O8>|(1AE2t|1 zn~68}@sS(AigLeP&-kCIw|j5^#5oc&vS5IUWcEYx+kZAsZ8^%DF(Lq<`2awugvLj# z2GAcs%6X{Au^ba1l0aiQ1dIcm!7+fa{-nw#`tP1*qmhPV7rIZLcw)83!(~l9AAqv{ z^FU+E^OVP#JA0!~`POC<8xtUTlgIp#)TRo659lo>sm=4}CCl0Yq+rHeI`B99GeVVx z0m&)VW(NuYEy!)Du5FWNojW=lPc<|$(vo?3b$RJ>IYc(mOzPTq0X)+ofEe)@Jv2OgwDCvQh6zB|BlKjJ zmPP>3q(^=GdH_8SeQ&Zn1H8Qy7cU)MG>Le^^*PKV1Tz2u{Q{uyUY@+JQZ`a+(p77W z(i{;1PVL}yp7@08_@BB{dhqN@0RE#A;LN@11E4qfueP=qrk*WV<6IM}?f*6rTbf2n ze+odBOb5{UD2V*2@~1u$sIjl_0h~y~+Z%9`cGQo57$_YNW7bk5?w5na(bsR@z|}AN z0BN5d5F;rrDVbQR2N(%6dr*j_9*04P2{ZK(#2{U@Ix=Ie^s z629wSN&$`q^>5kCU)w^GsT_5A?d=5YZzkbP{xATP0#G$bzq)5Cm@_amyn(R-@&%O4 zn5iW;yV%~w>*>ZHbn`^AmOZU8v>5CZWWE}uY0pSkORe&hsAEIoB-xvr$fDQ57t@iw>e+X!0yQW`2 zTfLl>mqu&`gbiSN=pP}7fwu<;iCd|LYXDRQXfm;Yb%X&}nlyU@sf?@m1_15|-0lw` z9H_0sj&z_o0FoS00|f3T;BMr9x5P%LI@@0_Y_8tsGz{_`qn>OL-A3Tv#w;*S7TvhX zqc;l}nmVfAj_O;x!tRa+TX&VLl7B=V%UeDvW_oaWdpBS$+*j1t*zK6Ms3BJv&pkq4 zo;O8eSE2f+6Id1MY+R7jp070ej3DHntTaSdc-@o$aLEurv`O=~>-IqO{zAtq3xFo_ z-(zo*0W!H6N|vrOmdpYGcugnufyU~x%$&|7>;X6kptPPr652z9g9n6?SGE9gV-$cP z%c2JY(4zD!oUtSZe}Jg;r`P~n7{|_i2dFFL0fqvA?d@+J0ZcOhNQwX`&aa2x0cFO# z#>ON-UMZDTP~;z%Fuqg5)76iNyXe*!%uW(pR1-GnoJ5~u$^Kd6!0COy?_E721a#Yy zrH;wBW?ZRCYh#MdP$oF6rN+4E@nd|AECjE|kBZJ{1C-JzmzGA)0S^XAPn;WrUHF96 zo=m;#MK^?2sm<-4!W2rlQY|;x`Gu*f{XRUvy7;j*7S_V#w(U??9H6nn0FX<8cYChV z-kQiOEDUi!Yl6YzHa!V!1Z>jvdP*3?X1&f)(D2n7e7XIZ*tmT5suxY#W`gIA-gG+m z^-~Yvs~@T!#AxS$(gDCt?k@M6!A}*cfZz&1*JO<5z8o}Nc>=)Mo)#dW9CrV(m8^MV z+db%j6py9Da3?33Wb&-G(ndXC7Z*UQ1f+yo#gA(KHnJ@>)GdSEZ^do42!uF-((2g4 zQUQa6rf&!D>$7zj{B3_(zFyVoaVp@Cg=Fh=rLD5fjvVbCa~zoqDDOmF7=9hxMwN1Gdd_mp=P;|hLzxz1PZpHs#0KSp z(rTm1);MCP{rfJ4;v78n21es=@NAJISYPfh`|O4|Y-PttJcfzWd>5uQyB z4_I%(t_60|gaP32330!GKMMaywGKnRCf&ksq^`*(2XsJ7yuAUM@LyL7fdHyL&`kr} zv3zm{+h^L{&h0NO zRyc`)_LcQmns^(}&?W0@{POoqZSWbiJ)LI~29NYy!ndb_Y+!2a&3EKM#GtrdSc#yh zh8gL2f}X@g+TG);%c7MVf)%qBSsEks9^Vm6N$CMwDdzjEn#lQnqbOE|9M={TPB~F= z0rc_aScl%Iy>V;LVDID~ov)7PHst7^XPx3ScWDfy+Y?tR#QlG=xgMK9F3`QuB99S% zo2#F*pgV7xRz8w<9wL?pob|&^h4&cW>qYd4Stp=4Lwmm{OyIgxic0JcW&fCf*FL%N zls}hhT3HQabv$BwX?u!mu>!h5rhd}%mj}8xc4Jrnn_~}o$MMl3J0rq>hDdt!r-&Hn zgr=Wtj~0?xNknee{p0X>Mu|Krhv3P5`YiT-cYU~JX^3Uc3IT>z3b|yLw@;3E=3&_@ zx+I^8GAQhWnZAheN80%n|B4VLW$BSJ$c3_RLoVYAyDt@?_D4jfZ&f&7?$07c49^QY zO*xV1u!6MRn|KWKfJcBRW!>t}*K;?eTgjI)XwFNRMq+zdFx;}N_<|*8OWM!$(%%$- z@jic)D3?-h{K)ZA-M_0MEiA^E;0yI|ZD&^ZVcybrU$1!BOlWDouSU53n`* zoT%YXrq*agl08NOF}!;0g8Ek?+39sKPP*aRy_JLHc%fASrn3}r-lmyd5{mp(}9e#hznw#OC7TA~x|PBJqD286XsAd18E z7)`jUqY7T#X*MgPa~D<6`Fo=MfOr(WDPI&_Nf;=HIcXmaOzKup^X_@gZZx01^RSDR zyA3K@&?0ZLoi3#5Y6Hk}msDt?B~Zg1f@@=Kc(2UKNP2|$s2I5r>!2CR_yqDYxI91q zgx)ZrCm_`oVM0_lQ7ufAAt#`@aH%mYK1Dh++0P+prg6#W5Yeg-Cz&g3=R|;#6RCQ` z8imgdJt`+sp&?;<-9pzT6;81%Z|8JDwV@{6N0XlogP|uII6P-olhM3K^sF1-{1fB( zH3|C~g~tqGdkjan(}{#`uHdBl!(_TOeAvHZ5jx(r6``?q%H|WCxnt#v;4#u`8!T{L zq(qBP_SM)m**ajTMrc7+r0!b~+z#%XRyEjYnTgiBAU+HtH<=Ra2|bOzliGrEysgb{jIjgC8=b5IoQLw`8Q_rOfA$ z);F9GCVq2p-@jyB0(wIsgl`90LM<<|1j_?mJzBMugcW=OUT3h3*~ILXn})olrTNX( ze#JqU-@jq-p!X6YWMM<=bZ)b(h$CZmCep`y{RBRb8d1-GVb&%oYlbM8;m?N9ILyIjvghv6^Ji|D zm$(0g0&{n|r^6p|-KYZC&tmM*y{+q)#goOH?5Xc8wXmi0zQ z9H%d7N_27idu`$qHlrRXhp5$7EdK2IMrZ!%6T4Yd)+g4;R))jHWc5Sa0(uVfS_G-fq&<% z<$b7#gUp0~55fVj6cTQy3TN^^Gu(2F9C-WxpK+*vPiaGD9*&n@hsCruG{Pqurz0Pp zWAbADeQL-A8vl0h{DNyoZkSK8&U8<}7QBkbipMn1UNl$CH2%5Gr?{b0CSeVOJW5M0 zzMYqGNUK&|<|@pOL$3U`O=}<6u>$@pewSDJnjSG;*pxMo(eg+kUn)hazUe1Mhj#*^ zq}Di(j6hc2CH>QI3T@Hy*D+fs!U{4lotqylZrp-RQ;Tup$Ne8ckV*ggYanY75>9NU zJp)XxcC=uzLi-o<8?Rq4`t?ZHc~gMhyz};Zm@q1S0Ru^+i_`b8r|!OY&Ka3g8>7~W zd~9^>p`+t%t&NW~Q4Qq17-L3<%K3UMzRODE>LuFwxwHZT&#?V@&a&0}kZJe>F0UMc zEgj5J30sJ@5ul;fXM?zOJuNpQp550^@1$9Q5T^JlYywK>_OWI)D%18h^bFV-85f9# zbw&_64Bkp(Y6B}_)A)PIF7`~B@%G8iCe@SYEp zjlr)-BX@o+;~>@5qELIK>F+U6tHntzr8~QvuPIn1amT_vU<9~bs?Zx#54GFPx7S79 zmV&68c|i~SHzV11*W@P3E$uC zOy8cpyLW5c!vAG|m0XP@GJ*cDfox&wTwe?fr1Bf>8GUftlWW=NnT>SpXL6_0K4p(M zyZFT7@39n%`z@_dN6y(}$QQwR`NmBA1%+5^p!MO%0o>S(U1aPk$1{U~8BW0j9Y3(g z;uEngA#HtfuK?6$dPd;UPC)FpERziaCj+6$?V*;U{c<@v1i6mqG|z&G4~Hi~-V*X> zhf0ZHHH5}a1Uh$z4jTG+CJ&@>gPgsOoNFifEt~%p8NLdBooWHU${k`;ZU5y8{dn&= z_>|AoM6k)=f#sb$uTyZ8Q3C`HCZe5uJ=5EafS2sa;`>wfxx0Orbi_H9xF4NcLoy0A zOq4*}8&`5q5XM(7KG`th4L=+dF`m1hrpi2RaCU65sj<~2dHfuzQ4UuyN`aobR8fFzT4 zjqqGt+?a`+vbZaxBsOM7&`Ac-C#)FsJKRh><#jFeg4su})5PwFlM7MG%=ixw;-;2Q zPZT~(bAAq0(AL*)O`^t%WEkp?93QABJK+XLNZLB1N>bjB3vwp!b#7*|ck3v~(BL@v zqgCA@7;20tc&Y!!zw*A=K6Fp9EvgH#B59CT`FCa;&?sr*M8$z^nwytKM8o2XD86^` z1VU-94bKYlhG>13XK&o3XKlexnS&04>&w)0V$hl3?OD3U<2Ik|GZ5F4)?>s>!EafE zE+%6!W9}Pk%up<0vteY3Wa%g);$^~}TZ6lth)GEIpMy^x3(|xr5Mn7(1ulBe`ZFPU z_%-c`!_eU~D>>N5aH#M#S-ImaEe0g~(s>WY=^Apog8;0wAsX^8$NBXKk%paIw{&-4Sbs$SA%dlu)Zv zV*;?;3JQQEei0@BALCh~m8}L#^a^Rf@^`0ok(l!lIb+JoxPB(?H!{^P;WE$J{wQc4m4k1oDFea&obUQ%4y@EOExE zo2`iW>d3GepP-(stmDjtk++FYTwEyts8v&b*=Q{J9i#ETgH+gy{T%W_=xvhyJsAav zelb=VgdljfC&k?ytOzW+q~2V;bg{tnFY#6tNjRM5~ zb}|I&|1lM4rj6rzU8%**TZub`+SS<19+M6lDTjdLew{}D`Ex?a`QqPYlg}Pe_ z5VtKPp%j+Xx2*WPf{Fd5&>2xF@q**DNYKT2;Sn`Zy#I7}*#MJZB5tb3jls-BI)7BH zn+YxdU0+vxe^rddvTJ}9KWXLGap*L^AgryXR6#nwEaIYNeTpW=KTCR&xi|-q!e}tSDRP2t4Q9rPYn$FkSjRns=WQL6F2>255kWGVb12_e_r~*# zb8sTiRjJupDE}ESqzoD`>p8Pqt?7t8CEQ$GUHodB*n?1nk-Nnc%Qbx|q#AdAt+icU zC{qkvz${(-o`Gtu>Fl{M`f!Ihaz1f3SX|UA0G;^qs=R1y`&5jN4IUPjZ~9-i7m-E( z`o=$8oS-A7;lBkov|I*5>sG=1gVAvQ!xoy<)n>q^a=f#L9=s!GG~_tUw>@cGXU#4j z?DMF{5lHm$)1}|_A>r<~_rxg5j|{g=GXtOHZ@mn8z7H?R1DD>qnQDrA0|laN*nIh|S8;%Bj%!^P8Lsx2*Dkyfo)I-2NM%G*YWdGAR zPy$pZ8(leMRF)-m>c~Jrqt1^$IIAwd$5&;EzaCw!ZrwtYXRkIhQ&sOH%dgbwOQ?Qn zmt%{^&UAUx&;D-ZqWW(^3ph5P=?uq1 z%Ha$M{qEo4NF5o}-G2=bQ+{ZY+f}}5lFJik)Q%kXW1frI6N}F<-}|1|Qy{jl-!%Q= zY1CaCuB6bMaN9<30ax%=S^dv@E0@!gAeu{I!b3YSN1PEf20|;VySjbjbkl_nlha7I za_IY|Dv7Lp!|gx=MGwZ=Z1t5TDDj!LcUNMU?5IvU+6}C7DzP zG3n(|`|m?g6GG$NxS6#4I_R4ENHAC#&}rKhjiP*(9Q3eC z=^G~}rqB_duzgDZE1t69oN0>&@J$2B9B;JlmO!tQNWHB#tx=x7>yHNpbc5rCSvxpczlM6^Q|9?p=%rx&(U4)N-5~-yqY4LWbsdeh zH^_Wln@cmc-7r*50c&?)Yx~~vmb*({-uNrcZ<)>aIt`ezSo0ts;r5DzYKPsgUEkeaqsC_ zvL6LhU_y98ZT#2&40(uN;mb|O<1mh$uNM6^eYY@l2nZJ=4?=X{azn&!urKDv%Kw>9 z0x_{Y8uIjc4%Kr51Ser7;b?$I{qF}@T2AmtOv=)>7X?>f%lwUPqYx!6Txg6lqpQQX&JLm4v@a&ljPf#95_Zl|c;uRa=CxVJT@tq*aEaPy## zgg{hY8~5hnbPe{}&6&WoFCO&c*^)}fV*QcNGMXsurdir+{TO*_rVm{QUpD_!sx*Dr z_{!;rUPSIpCo1=JwNPEcopDT)H-okZLq<c)VbQ&l7xZJ1|hSSjvMytq4*;_mM5!Ci|x#T|+j zcXuaHBsc_jx8Tml^OyJi-gEZkWV6Z4?#!J%GdtJsx^WyV7p&(A1-%o$DfU3*Y!;jN zutw#|dXrTk5w_A-aE*>!s};POJP%LG*sp*Bs|CLB()jTVycw;IGxnxTwIYJ?3}D^) zE3nVG*X4Na!yUQvgZZA<#1hDUYnZn;p?Ym&S?y`0RiojqC1KGVw|esukoTP^>Q)b|{1 z?AeiHV!Ump@n^akiT_a9{WOLJDqq*zuVM)~!`Ikrr(6ki3GBDHI|~4?SV+!B|$_VY>l*&!$MZ4pFt~4Pp&}&WWF=e9WuMWdlPx2u2r0ewksGxqrzTXP z`1RA2-obn=_K1xCRy`I3Ya$P}SOwh46kh|-J6x(HgQY9JIt2l1p*=@r?)SC_4^Y~t zDqGpgh2BDQKG3f&IsU4(1Z@HiL60fE+t}cD? z@S+v+Y0a2Ddd}yTuQ?bm#(mh6ZOR=h9SS6MeuIAH+J_=$XrE@89~!ErhAcw@tr@OB zJx)$+xjtNB*T4A=*Eq6*!6cX4L$=qMdbL96hwu0DdzqS|QnPLO#GA=_h)Lnjsncecn8Xq26fyd3f~ng{DT+bGP7yP=SFyRiZVA7AMKmFH`!G zK(#(WI=32h1i{-sRR;i1IG$8ad{HxI#Aq1N;-yEo~Gt<{^4eKKE zTn&)3L!9YkEb0R#6sgaiybX>t)O-8bP8RFaD}D{Jv(Pm!j*G$_cl)Gz0<$B^h`#5@ zSScXUL5}z1j~9}QUvHr}qV00g52m!XeLjGW9qtXWnBWN9ULaG`g23^^A?<}ws(!*B&+|Hb}1d#}t zwbTThGbs@Xv6MqNmtw&F2!wvsBdy}B(Lru;#M;|e-@l9mrFJ9rnH9-jNK$+OH&7;) zFR@sN;Ym=udgD9h@7is%p>we48{p@T-SRj#2=#ft^fh=2G4?IUH#2T#0=|ifPv(lH z+Sxw~krl@Cs)+J=t%XhG3?V-AkBnlp`By%{vHD)J78tu#1!l(wad~rBYML7SPc9U- zI|XQ($wacYmF&9Fb71e1fS_*BAolC$IFvJCC?Ip}8m7Wg#xex|aC9F!+ z^;~LT+sE~?-*)nxZ5i4WrbIPY39o(hUR=BaUmwe26RAL!J7b;4L)rF9Cw5*RiO+rO zb9TP^8@HpGoNT*qq5Nt~f0KL6T93p0yr)6(#>)#ghrCncIB)yqgi3zk+{nHzWTL>J zu=)!1^=YY@aQ1letw;&k7Aq8en6EP{ZfL@o%k2b~nZ+mm*XYngv)}H*g$JS0C$YB`$T5?pBGh1la3%h$rn@U_hIE%xl)o>5j!5^r>vRUQkv$$#0H5)e#)hI-qGt z@@X76jW68>8D1zdo#}&{t>qv+-xPS8?Z&20pLnL4QPC^C**dZbEZ(j2>|vV{oGW4) zOyEbFT;5wb^$h>)gv6&yH|!@g7Y3s_7qS)nVqqJ`LZL83E=q#tG;@ggWzrATqtbAy zj-FS5H$lDkoA%}hbw=%Qg>vtUVZksx7zE0?Ja`)nw|EJP5UYK~Yp>bL(*bbI%st3F zq&O61kc%UZtxZ`Bjhe4`zS6Y63To-rL85lizSc03faNrlxh{%HBE`Q4x^gF+M%oa_ z$z|-tNpI!tf7DnCJa=w#uK10GA`K+M&$3*E7+JeJ?k$4q)9r=cfYWRg&ps?}7-Bh8 zE3%;pni)fD$yb_3vq?F%79&%P01ljP?lYn_1d}OZb4LA$N>hTMsl<(6TXxs8FSbBY z+fhw^C;`sEHnGvgb{zb99=Wo=Q0SNRCJ~t`VF$%G=Cljim!1YpH#-f4 zXgjfBcaG%Z$C*MP!VzDl7SFj!EH9(r=qj@(#CH8qA}Ftxa)B+6-I{nXR*g>*e=_{w zhup|dT?zgT9@ zhph8id*iE~YS$^Py_ng~-V3z=*DvTnzza#xP~p3GG+(!c6KLIFcg})jK)?~(*?m`d zjrdR33&u#J_tjsaTnkB^#o8lGF9@4zoxJTvlolUihc`3%If~Ip6cekF8{=KHcluA1 z8O_E69C>VLp7ICFXL{B%+yNvLebZ|g4ox<1?5Mc?ycSF+2e3W8wqwdIQ^)Wy@lV?< zzU*CztM73Z6Yz=L%JobpZx0H@W!utQwQ_}NSv3Ay`MKZ`Ac_CzNXCn&=Za>|sWQQ8 z3J8KVbH9-(z)sAc!eXLdXfR;($CoFJJu`MHV>ln{n0xnq;f?&PpelDLPfjKs^6KRi z7Gr!O6!zK42P@ISKJQ1ht3aZi&}(0Hd*0pX+i#mq{8#%P8QaUl(GrWW?d%sMp-KVh z@4a9XLTT=wgCAhq{kHn8+AX;~kWCEm#oKZ18^-7p(CjRFmt=XP348nX$ioeu$rAl# z^XJxqEVqL!F377u36+$@Jd2vcc7sJ74|ve?`e^hi_%n`s_Db})&vUL7Vfkt<4lvs2 zr2hu|x|{m!!k!sE|8ltghsB8Dk=f>HkRS7gcv~uh@ zglyfnN#v~Q{oAWOk6Pc=GIf??h;k%p!&xPSA3zQKPDpOm&+g zIaO#H6ceGR822}xS};a)%|-N&D^!M-S(ndkW=Q2J#DA_IkebyZ1juQKm2m9DPA5|K>@|o^;9?0tJ_yI>h+#C zcxRShqLhD0$rDh(Ix3Eoukoe~%$&9vNjwuKZEX3s${2W&gJKDDo+T0H|P ztuaM(^GfZ&&)V(WHL71Q@132$*0_n}_Y2f6pHQAcbAK8Ex%Y0^erqLDWNE{7WEd{4 zd6py^l$2B@w+?GnGAyuL$)tl|1&QRWQ>paKUnXklc_77KlCw zjlajcq^+ad^*XRJ1?2WSqg@+K+N^Ic+&U5;;D_Kjd}@uNmKdykNrrEAzv$-qyqLV{ zOQ0?gCU+*7!X#H@E=j0=ChkPv>XAeQG<3Tm1%-WSmi@05Ks`87#uwV;i)I^uk25o- zqo94!X^UB_O$m@z6+mf1Fq7jQpdX}fQQ*%f&OaH_bM%Rw1`s@NCutghfqjg{kJwJ! z^y3m~g{7^G5*Qr`1_#La35Lw+Ud!#)D4R~zdhw)=+wYn>^;3d=#QK$I!<5Hezgx^b zQ;5&ndW|%<#8<}-nPFv?~mNw zPUe{*pt)bS{^{7S)Tbio! zL=I^%8i_kBEXLXJx8+*aTfRC{xtpFu7;UPqPbWL z;G``E{TdN&BCZ$_n0cI9feF9b-B}8vz|{VGLtNwFacnJLD9&PNYp>k`Gmft;#FRK_ zb8BeF_6yxN!w5P9wy@6Z1iLAFys+r#ho+`V+igpfdM^~bQg-0s^@hl`-4ret{&sp> zi~^VKj-@)?mUIrTH7ZJVM&sd9GgGB@%NGwPo~W5f%eg9s%D~FS+v=^vf?}F{RH_0D zMn*n$@`>uw&e#qb|rrG}}^y&at zJh6L(;qYFS?M6?!clbP6hbN!c&5^7wiX`AwAQy{0-{Ogz|C1``iR5-qMEzvVWzT-h zZ(LQ?Ri%}Bkq<6JlEPz!-nNkbrX+cs+$dQrLvj~EvK!l8A@UpG%-GfoW}d6t&j&NXSyiHtR#R; zD{-z%lvGvKBo-PI7H+n-Ck($=o=ny*(Rrdz+GQ=hFp&77EA)5A6zhefU(ZyealtQ4 zY#$f^lbO^HXi_~A>}FaFO9~<-RwttU3dqD-ftnZN7GuLt1fc6Ow5NrO7ycMV`|gSL zS^nDzoxWy+UK0hEGF(O26Hj2;)9cd-q$?BWtTHYPf}By6C6q%W*rZA{*45bhRtwK_ zdsNPUk&XVAa^t`z`o(UZ%=wi4WD|4P>Q(n<0iGv6PaQRfUYX8^M zbDB?O!XgXTb>|U&rRO83Ka>>JV8!SJUr_?8Yz!6c$FB@H;teA|Z!vu@m^7w5Jy4f7 zUE@;(MOVHDix|;6fVA?G6n|$v0>i17?RDQeNY=+u{Gbidz~4R# zD#^ikJFs>Tv)XG@F_drmAi#_UlF^^=b#q8)1h-7M-o{_8( zsccg+Tjuc&!#HdXC^-CpOnmbZOd@YIyP7*~dB7J3M(RY!Kk zo$~BZ;Rc^E{sVm@7%Q{?=eV{gS&|MGU6@J)r_VDv%`y9*G{+`$hZVTSGqkXPw`_({ht^6HQusg z)~?l#u*?#(aunjl$jIqPGK&fR&~>&o7CVuS{M1n;|C;q}`8zP9A=G{S3DqWXv*TIO z<~jQ(J&_npCH-^0;k%iY$TLFuWnrmNbK7V9rBHdjOhtl{^Q9mZrc+ZLb=1yP0Xkcq zh9?XC2M?@G_wGI!0TV~IK)D5BmC2+8Cs){ZJbvgG1UCrn>*S5d*z>tW;le9C!`zSQ z2~!nCRY`R}!FiM8^!8=RObhMFnpnQsyRDrZt&>HsG;e%%>J}G@@ZQ8<;aiWhrTb!k zC)^{}U7`~`yDuPd4=&#Ac(CA7Q%r2-v|K5-pIBTtSCzhOMFD|uZOZe@lFfW3w~(Hv z{O=lA>~x4og2r1+>DQi{L}#&AzzXigr+x}SnTzc~_>K_}w-mq+Jp>Hi!2&zDchzZ8 zMW20`EyIBtFqQ=acZjZdChG)m$A#i`ouNSU)nOQl^~+>yx~);ba2R42wE8l<33dh_`3R z1z3nD+TUv9RJ5w?nA;V;BbClIzK z=prXEHF1YKqeePQ(oJxA4Y?)l#UvZBlP_SlVq34|4m4Ocx-K~nS=D|WQXAayp_VH5 zGk=M5M)0vEb?vD3Wu5eE?8Ietras5!K|pk&oNV9uLO&bBDA(y}`^@>f&_c3dl+vj! z8tL-t)?q8CHl}QG@q4Ev*O2_G`aF42UBlJ;EN9d}Vf(~%=LQ&69N)>jx;w_FGmwQ< zoL>L6_M}nB)YDW?!aZqahqrZWTPc$<&ei;))3K%eH;wq1Jk^99??hk+M%H*p+u3&| zDk-4CkE=QvSVA{GRH)SeYem|2pKqQCrTD6SFE6$BJW?H~ET6ukx2oHB*m!N&GWrGX z)+~P@w?t*v6H!u=60k`9BUl`=Q=2&P_t(p zu_soIZFBQ%aH0^yG8lXP)1osi^Sv_lES^bTtjG+Fkc%!*S{+~nwiEF>l48B=bYKC~ z4%3P{y1}Tr$n`5dPHM3js?OGVhWu0QL~|S}Zgk!~EbgM?7Bla76rZA{8~gar{DA(= z9#q_w4n!5KTdHhv@)8ebHDPpY73RDgH)O{6Yy2xty`07VERFSjlm5|b2vQ#%N4yFu z0y7l%@F+}o4|B9QxmU>9Aa8~U(2yMmzK0O|@{$2pPoM-H8Z1>jQWM}VMX)5RA55V3 zUjC3U3Ubj63!KWbhOh$M_~!3>#c4$>ayYTx54f&Gatou4Vy=pgmq=91ryq+Wf2XkR zkSve;4T>j5({t`)Iyj7oidQMu?BtTO)&H_fe1Z5I(YUS>9mo^6@ajE&T}UAWIohCZ z);9iymToi8BV7obTE*A~$N2C%!vO9CKr*YNuxI?fC1y^>$0MeM!G=A5oAme)knN(J z&BTtN#8|YjB4!qt8Fg)tFgl_@+Zs|4H<_VsRnH(hY!oZ*-^l*kFuep@bhp+2-;DxMkwuDth-|JZO=sACmx zp&{3262Ogzjyn<{!$XisJH%0?;Mr03Dt*FP;hFkG$=_sd6c@ z&1a!dPgkY2V^BraZw6nG68;%KaHazDI^m`2#b?@6=t3Ssbh&Mp&AGnJ=2PmgpO~*t zsfad)S3J|ImJn16XqWHcz`WtAmY-Dm5lM$Nv_Nj?9Fyk@J$5rAMGPkPH3Z|fisG3V z6F(i&jaGld0qAHg(fOVl!|4-icZf@7Z_riG#1w4TXw}kC_F_^-{~_YntTRUeW{RTk z7UZX8UAUl9)R@x)io47XkLG4AwJ?^uC@Yp#L_MVN-cecG^?u%ZJrqYB49na>=iQ4f`0x~VFL*~JvX!x2w}a7@IRll-x#?ht13Y%ix02QK zdjfE-&!QIEwa7mok${QtMuU0<)8aH~>K3{EPs{R;_chy%U{^EU2YFr)>NN^CRvyUk z`Of!*$OQ-O4$6@MrlR#)(p1MER{?{@4B6jRCF*r*lh^~#YK&_&S<+UmrfOgfCNjns z;@28bcn5!)@ZKDS8uf%$va{V~G+6KSF6ElDF)bxhaj4!h==GibzUALY9Z1RLa-6M( zAu2#l>x@ZT&AzZ#j;jeFc{d|*y*N-NptK?vvO_EcFCrkD!*kj=`bN6X1V_;kD)0YI&+A`gMPpGJRj(2KKc%%Jq3+IL!;WXZsS44%mCfv9sf#Z zk}lL~T&du^>rV&S{hpk)sTubVtdO#wYlyTVUbDiXPw-#ZHHkLB%Hif+nF3*Ck?-@SAET41}HSJYe%TkBjj zO%U8~0e`2Nu$leq;TdF~?q4Q(v;~$v##PwK5^@miPAPTxXk;f4z!9~NM;2W_$$jc( zFo;%}toPV2N=UQoKT~wLxh=R#dz*4>K*{_ge9I!32|*ue6u(pj!BH^!gg|s&JiSkF zkM5HRD>I17=ORUzUIm1Vcnm5zW{OnUL!UqHfmXw`{c)!_dUUG==0RMn%_NHAG=Pt@$c1*mloJnU&U*ZhQxgqA zW=}As9IT%V3dH@yKUt-VS>9s$y?G%CH=Y$c&L+FP6F_y?gciLT#|Q^Y5e^)2t5(_IR_>ONelgN{_jNSt*nw5gnNKve++(CK$bfmR$h zw*M=J5MyMaMCVL}u5XIEZ|1hsX!cWC9DB(7jc#9FwcwFmetG2fhM>etSO&#pCX_w0 z%n`|bU!c3evGh1yV>fQ}iI*0x1G+DQIXNaG?^Ym=?RsF@2QuWmWBDmGVCmZ1i4bjY zb#M{q%Hu9^gr5tTKD_9*!dF71>f;)CUA3mV(1hR6tA!o(Z#f0r> zWA!p7e)D!@Wn!o^as~AC`16b8^5*=q8Dir9l&CX8PB$0QGyIud1EXq)&*SJc@A>=z zgj-+p>j02#Ik$`M)1l@vh*#b7T^EyJB0k&0%>^~_Pe=ciQ0w;Dd?1i|RbrJ_;Zk=> zb?xC?b1##S`{;TnW|I^=39q@yXLpb6z14^}3H7p{k9Wx1t!q=b zb?zJJ8*%OB=mjH*_?z+fDK1H@ZSY^P540~u7Xvc=5tQU}Xac}=!58>vxX2sJFSJxU ze#0_vPt;eoo}w;Z8GndGAgGZP!@$x)i=Rj+PXhgk4xXoAjNZ2K5mA;vRU;q`@uiBUr-@@uR8vomt!%?AbojknMFSpqUS z(hG$zFXNgI5cajP(S7g-z&$+NmNZ#t+LPyDEB{)?E9#r%3}U$D=yr9Ba`l~M&RC9W zo*+}qxkxxP^=c3zifeCUA&Q=_2;$sIuJ`A(i%*E;!^@p3gE_EKCjE4xIDXJBV_sXKH%FU{JN+3 z^f?%^vOZSsbLxl|O*(rPQMz-%6~?(;3Jkjh7dCso>R=2}-9aXt(J;2ER3-P-$?;Q| zOfJihS-#;n{fOBZx?^=ZDPZ^8kUHao82pKQf{(?I!MmLPxCBo_ktqPVg2Az%*40g} zYf}30wFIjYWA8i^OgJ7?Eg-QOmFRgxLc8M;HsgBXynd~I!(=F%mG1SrR6jL8;DL(kKs7F*c zH$K|yS>8uadTE^JJ#jp47CE$|Gw0UMkqnAK^(T>;=&G*Z(9rEe)n~3H+5w#7wm7^u z8FclipKaM;theVx5cL4JIM&(?jGSENSoMP8S-d+OD8x3Pm`|3?3CKsDC2tXU6hKk&%xkvm=bir;O zfz$~G=9k?$`vlEPD}2U;LEBY!`mH))ffhmSo@MS|R0RD(_D|&-NG>_az2Mfp_PeYL zKZEZ$5Bw>ETe9D^@c>aqUBD&e=(LLo09R?t_ytx>4Ft0PZN=?EB-S~BxFdZjti+-# zC$6F0bw)$ngN36CuT*3As&c|P%U6FFN?X$$0p<>4e z0x@iVT^NmgeCThh`p(={FN7{gbg!`*AdZ3Yr0neRS`%Out=+pD4b;CBN27{WmWL*e z-b&@#0zW#1>!%EC1T`|`SroyHs;vfC+%?#khRs1Eh9ynlyXp!?HM?TfY<(rV)jMe} zHPy1VYK_^ycQ4Y%zB9Umuj}`9OpsQG7(0!@T3yFXnbWJHW0!|ZriGkOWslTCRAo~) z4R&hlwa0Ghpp#42u4|S8RVRH_!0dWxcj57K>>4!S?xkG1(HCeB^Y7F#02zJJM%z&A z6Xo3v&VRu&j&}cs_Eu7?o$l(%?cFH%jxd)9jiF7$RHN_BODaJFWkph5az)?l1$+v;~Ufy*% zU?=gvS$G(g_Yb?#CmSi@vK$Qu3*2NIQ!GjraHv5J%)Cakgt)8yWtH@UxM4>uuny4d zS=oAusvv7Rg%v-{uTOs?BYuPnaR?Z#{f`iMi!=WJbWS?kzw#LVODMfn_Ae9C|6IV< zxBt8MjuiX|*U|2az*LC*+QnDC4# zE#JSJ9Tv0b-hD9KxT@;X_BW1VhyCy4PmxFZx9y)($^W;-alo%DbcESY9P%C}lySe> zy=M-O70N65m-j{%x#ZqMc?i&`h&heg{b8oOh<>&0i^LknZ;ub0^y)&o&;H^Z_i8ep zTer?4LA38E!*7xD$Kd&keh?5Q;Cf6qVP;yZeisTPo90Fyh4CMXK}oJ69gJC+J1C5< z?o?}Ps&4-?h5xz((1$8unFCa;HNCnpzi8POTCu*uR*ds{o}=x@pd8O!LGrb-&ysi^ z_I&RUQ`N~`;ZFTE9t8WJLqoObwpmXTH<%3n4R!=a6E)ds!&-V*@BX{~mQ}qg=G=IZ zGoyE!Eg4RkasNr|*rP?kTO74@zieNDmPmcpsE4j%)$8}k4SD$=^|sD0bLVBp?*H`k z#(Qf+>^ZL!mfwjXECZ&yPrGr%^HChmuj5HtGJwnxk7E~N&;Qb!?-f4hRh3%&eTTN* zJCN*rMF{>LFeybUkZ#KAdv+d&Ij#7eJaYerpC2u~bw3NV(#qz1zMrGKT1EL*>ebcN zr0{(27{f~?kfpf&u+$%0Ce-aSk17BDp&CK*Q-zyu{CNM-td>AZ2h3GjsP-IjpqkZQ zX50c^zH8$GJwhPqf3|Ket|VD2!Y|*QtcREY{5%{%Lu4No8tl%iP7yAyjHk-7yG!IA z#*_uKn&C;6AqCxPi4?8)@8%`pzyy4^QyBWYZSZ%keNMn2eQ3UU0r@MTqRNs8MA5k`o z`MT{G^P}+Re{aF-Q3M%mls%xRM2otz*RC2H&QZ>j2e9XN^R5T(0=QN2nX_G-_sqAZ z=o|a4dUgxMYt8~Gpp3q=AZqJ@htt2OD_kA!F{i}Y&qi}^3)I9FS3V*G56*V;u}_tF z>uQuD-@N@)4FFz4D|0Jc`Dk}B2mR5l(ypJ0W1Yuf$Ej37_uG7>)4M*Wc$9Vj-q;z#aJ;^O zc0j+X>(iM0V`zJ0zW#r;0QL{&K&#oZ6l9+h#|*}d?SGM)KqKRA;}ATei^D0bd^a|iGPO|?U59)m zZx6|@QmRWLr^Bvy1JRECfm%ZChPZta|w= z7sgtoS%YW2bro%O>UXw-ib|a_#oTASmc`NXO+DxE56Bdap-pqZ=3Lo_1jz%`UZ=G9j04geI z=RUC-*+A_@S&~2N74vD|`wTuZzsB`rLbUV6Z|Gc)s;lSI?64HTQ-`Sx;~$1;=I8{I zy)Y6Adg0%P$dGGjHyNQ}P$R#LJShAVW$$mzz@Y-&C6xqPD8h6-Eb@-VH)y5fm`d^6_Omn4dJRAk`0*zr`TmkDHN3DTd)A-Ae zPic!CR}L}2GU}V7v3t2yn_ z8oSLTD!RyYPLqSXl9FL>{Q!h`?*>t`0LV|~MPg%cxpFHYqEq1U4*+Z?VS5``2fhlh;?pND>R zdM|%jo~LvnXGCi29BeXg`K#>?Gs2Ont^IR_fH*EMS5Lll_%7qeG6Boy7cvXF^>Ix} zajBQ~bv=&+62V6T5(d8SKaqZA6Rus8cgcDqy2dX2S95ef1G|eHF8P^Wi;4)%s=cX4nnGa;p9L-NrKJMz++?5n1&ntwdIK z_AF01U9z+@QqJ^>`4Xx6(nejztS-;_X|KD){coh4x6O6eeWThCr<*3IdY&WI zY(>(WNr2_jqPg4$Eyv&4O|AMfi$cVO#a4??n%;d<@`*Osx7+_W#J8#?(=fybqR#katjT1hNKvRPOFcQfbo%6s{ZX?rJXU}Ofo*Lh+%?t?fMip3lVs|D^ZXk(}5>c7_zQg@^ap>`$fO_cuo05zY26wv4ss ztJChuG+jaeSG@V6Yw|8DT#1zN-OO=3Zn@t3ZyYq=oY<=ZRVsA4k!`Mp(r!hc-?I#q zBBNjXx9~9pqI_p0c;iTZAc&o!W=(jBQmzqOAD^{=&ts6?&Gwfy5z#it_tN)7sRN>x zd7NePr~k~GvzahkcbBp>$=Rz`80_DT>9`!av*q@pt^}07pzLqR{zad5iV+nf=t22S zO2he6>U4PnCF%4f8mDV%;MG~Lr9K&gzpf_SGDxc${H}-D@z%jW(A9r~v#(elJM1I= z$Ufki%$GQBAa7w-1{>7;De*QGr=%0kP2M&gXts{t@h~lk?-K2Hpeq$fGExcJpvb~W6D`Xcf59XaHg8n`rYNUYps~>P|o$vYl_qD1?2;B7hIWQ z2njcIw$E$(z0@i5CoFcS>SdOB&9?G&)a)>DR?CJiGHeccR1|gp2IR1C+}^#vE@0i+ zD;1OKBE?mHjw_|rdqOMHDM4}{)Kihl>+>4>+w2`#%YHzVWRtgPpwQF>7S<()SNY?PdiV#wDzg?2F}BH(!P8hD7* zoM?uWe;NSc_f|lLgStZB^J9&xr2dP5WE`teCdtX+(3(-kdV-K|I9`SrPSz)f z?C8bk{`M|QvB~VZFbr==5CL|BeyKmT8npj=IbxYuzV9lIjg=Rnl|5*H!-nP}W@lyE ztgy}ZfbCZ5jA-!-L%=qs%o|rwBc9nk(7lIGBgnnLOPMxABK>WU-cPpK_!`g~UYxrh zE6I?Wh|T&^UWrL(hHx~F!L%YlEkr4X<5uf!h0im@&zXa=F=+9)1x}DvDraV7)DfHB zWzD#23j-1#N+>q&*?NX8Lbm0lujRN~O%bW{C0K6`mua;x$#U&^;@oFRiTxhmkvvlG zH{0&eEM)+##>?x4>rX?(O$aUvAg(>~! zM&5}7-zN~TU)wx1tqm>Bs>y%OHvb2+fX!uVjTUW&Z#JO#g4Cc}C@TAbwAB~yVi;+~ zS%>-1MrfmZwAtyeWB5qq>BmuQ<>{G`(R6Y1GfgT1zTiJ|AY13e^oNmVLVlfKg+$Ki z$I;PiyR*I7Kh+TT~bk&;k>!DEpQ&6i#m^&Dk%zI$O}Tmp%H z6#4{~Vj|N1VlF0^ZzO^kD~%-abn1z2yqQ&ba=)U`;#)lFx@!9&3rmjkl7ALQ_+9Yp zIdfQ8c8fjMUf@61`!L|qYH`;qC`~{4>32(ih5b%2n}n_APpcIAkre0KBxbgSLQc>H zz?bGN4W6aMfbS2nJSANo-YdFew4W36Z6_O8+Zsp-(=t55{Ui3&jf&szM)Xrap42Ga zX&VX+!9##ZL{jPyV=-5)WA>NJwXF_-pZ;Uzu>%$A!Ho4XDW z?{Ll*Lfc*Vw>LiKjQe5HTOz?xsa&FpB@>hDVHVN*Z#8D;#@^E(ezYMED%cHfexRU~ zTW&5blV^q9z;YpMzMAh0{t|plS;`*VRKf30yE%YPDaf!qU6OYhlkk&@=xm2cK!m%+ zh?83P49*&%#W@$T`gOMu1*I6Nz*SNp&{ZrRI4O8xuy->fY zs{9T7?vF?%h?>!TX8=E5x>gkBX&uj%jF*Bj)>_QVAg!hKWqaM>r;`aoWUm@>g~42? zU;oH)M|f9vrb_K*k$S@K&3T?#(;chct?iE<%X0G_ZU!G~=R9bKzNp^%loDCotdT90 z>+F}{CyvNxF*lUC%j|YlcCsopPbkU0E@-I5sVPwSLe2(q?VNqLgvF7gtED@x&z54* zVYaLJZbPe7K37E)e$SiDpGu-uR4u#omxe9j(8f%F9-M1~Gu2Le_T=?{p@~tdrmQ#A zA!ftLHlDQ^>A3b3AG|>3ss_nhyzi9F=uD? zlI@PFs~O+FD>%~B08Ly{_!16Ld$U>|QtAhG| zZ}pt}H=utQ-F=$jo>fXnUo=HEAWmDJ04qmg? zg(2PTw=GHi`h76DV74SKZ}iVoTl&m9j!d>n$)&Hi4BEpT=W)~YM!3G2=~^srY@E5x z(EINz6HgSa%d9>F4s8eTV%2jpoq}>t_j2a!YV&ck++qRpP-^Cuh`{G9WkxE7jUcVe zNgx%o%K`IJOY_wf*C>t4Pt}Z}K>L)Mb^M6~zgqUoItPcTOj6~uq!rReU&sRTbZ5>@qH+pg~iS&B%3+tgUbC*G}N#sdw zJ&r!)BoixvRilbuLft7fk9!g_fu#b+Y3o)7FwOsR(dWHcj z*x=}Za80k96R9|TA}cI>Y11d->-I{lwKicuueD!o&Ej&S2$bM-EFAneYn)cJ`ernQIDqjAy9;A zK>xLUHqf+VAS;#R-Ay_y?Q+-r(%-2?ns<4gIN$EL3irg#DcP-|D>O1u0?)vNc|Pz< zq$!F~_EyCCBw=zTW*9x06cp#DOIuPa$()-n+d!d#?dl2YqJv_#g{o=alUE3IEzxow z4ei(Ujb77=v`n!Nf^CL>=_ySusOrtG+!&JrO`GEr+tc3!9--bHI^jtw`P91XBgb}Z zqDy?gp`s>dK*bS*jrW!J1l8?V#d736XfAd+5&?gBF;}HBq1yQ3SQHViBt$n>aKxi` zpX0@T+-%;Xku`cPM{_cFmF#EKTZBM3w4deT5RS}f5|7T*WYqK*Q zGGyW!I`+>H+u$p#;SfQbQ6o=PdziT4NpKmZU->cH?OZNHyYITvW3+GbfSCOP4HHNA zt^6q4Ue(@>)b=kB{q7D}=BDaE1Exe zIu&DX?oNNUQs4{T)jIHC8?EJ0NmqMlzS`ZX_0&?(i}eHfcO5fv=YYMO6bic}#2sMNvR7WD_$yJdiKW&RM z?HjH-7~W}bj#F7OqX+TxLJ25NSN&Qr082k+SJHGiWU$^4MdPLfAaZf8?AXif^_1?d zTpfzSdBC{*p)p~FzcXdAl{EmwNg4Yqk%ZnJ#YWQCrJPZ8j~a%~r(wP)v8-H=7e}Is z_79k#>M_eJq=;%9RWObr7-fsQWr{1dBU351-8@KJ6QxNG79C>QIg3XI+WA7ALS=V$6CmrmL z)3I&awrzIIj_q{Rv2Ckk+qTUe+s4WBe*gFU@5Q+|ck5!Wxog&%Yt5QfW7JR|Ut-^{ z@yst-3pwK%+wzGvuHt?=Jon$`h*nC9*;uf2X^Tw=vvfT;bBig1(^Sr*;+^_nKD;{T z3l71H<7n~zf$vjs$R8a=nA0g4u@RE`I!NQN76}}Q@>oX~Bn@b*<<6x6UUS%Kk*4+Y zPp1En`z-`g3h;f`XGp#oPpOlyy?J$g8opygCcZPj+O}8sdG@p;1~w)m;XQ&g6RigV zgs%N%t=I9orys=-Ti-$CzFD1Xlas5B?~QHX1-Ek~eYG_CW-9oUsf3k=$nV8NSm-i& zsXLTs0*!~YmHcyJD!Ib|E>i+DCZQw&kH&s3)e(u3N_$TxJqUL?@RduI zNpCp{Ui~QLl>f>%mW!n~#N)0#;&xaH8GU6Wor4h<9yPu`GFD-AFDG2;j91KA9I= z_Bq)oi1wP!Qusbq95^MK7)QeAyDB{6usn?Ej8l@Zo(tpg@}L)<6>!Xn<_pf?Oz{NB z+mX;xi*p_cS>Wx6KC>({;YBBr?HIU$Ql$Nu%g3xtxyf?EYe0w2glO6rDZNcC;esdV zJgL-H=3;TJrKOKX3P;zXCzjP>q4SkG7tQHGXquDLTqLdS<3hw#u!k&yE0C1H5T#RZ zz=K4iD?-gNUr%*O1VoJnMz{WH&m$sgb1o=5bQ)`Pnm!|9&JSeclX{c+09SR+y30}U zn5i`)NdyxO&~7MLIhIb)@Et$V2Wk(*A7Ht$57EF z=tk9La4QSVXY!V=Ltu6MpnxP1!Vby-9Uj>W6c$a_J1;)~%mSJU8n(n{=>hgj%E-+; zx6*^;USdl_pF{j&V!Q1b(vsnmsv~&jGOrlO07s_kWY*pTryZ9B15mGOL)Vt-H5!fF zRUDCl3@LijYDud!byFx6v34B`oF+;OZR#wFPg=@JLVK0D(8 zF)=8);4Er}lheSZ8g^p9qZmXz1O8!Rf^GzxxZzEui)u{zc*N(#zTxzDJ+EE(v}cgy zjr|dGNk!GFze+i9*TvVW^c2QAY7jpDnaBJ$@T*h?KkK~6WMzrn?+_u`D-(N1G^S4R zD`~Q~jAdNEIc+;7llK&kS~tPsWkLsZ;mdlZ<&|J90>#TyDiaWdqQ&*y;#f}~;+gfr zr4%c8wy)Xp9x=W@ScGi?jMwP+p4}Kfz%~n$lf&ZK5Ngj_YHfK0)+q|vViq?br?D7b_pe9M*EF{pc!5SfA8&h)=cBGMD%b3_Q2E*PdT^-} zFSrz4Dnn@+E61I)Fak<>CpeDMf~dp6q$$E#g_HEN`{X3uCwXM~4%ZYu-M;3o%c-gFj9d~! zzt7ssNG88Fb~NtxPPXX2Ln$i~>&e6AuS^y-)}2@-4bWb7Jy*%))Xi{RrSi|3^^T;TC@hSP@2T8fa~TBf&igXg8m_N zbxS-=0brPeO(8-js0T~g4Y!6|2#kXNTF{uX4?ur^KS*5=O;k<*jstqQJt3M?BJ>+( zw76JYy<3oZ43h(;lkm?0S^`a_T;`PFu@OL;O8=>t((?{}f#7kRecQ%74%fw?Wk>C< zfQ2HRX*gPgl-NT;HVL8RFdo8W7>>VCu28WOFqT>`c_^}=*#U_XOv(gt(+4_gUk|); ze1&vuKbt1G+za2*iR?ECgqb6>UzmZu98?e?2z~xHWeFPK2bR#=!293qdwf3Uu5ke) z0==LX6p%z1T@PbaA0K}T)Uq&RLDleKJWR>lzZ|)x%OTKUKA=pCy+Tr%+uHW~)K)U! z)TkK~v;t%WZ>%jOD1!oT?IZ%dK&KriP&Wn226J9$9ludv53Q%dn+kfPzKs9sT6XtX z%bsUW&^PPDXh)e-1E&XwPX45x(EKXD=bUqV(-n0e+Uc|ANENi$94n}_GotO35gd_&mnP%OU`gB6 z&AtvOB(7>_iujY>NY+g7mNhbblZe;3Igtj;AI&Klzn&ZT_}=~obFIe#{dsB$fPX30e|H&l?F9KcH|0po|1RzLOU8$w(yK(KC~|IP zpE)DK=D4p?m~;O&=MDN~@sRA398I*2Ykg0*HK`VhucM08J*bgu|75?SLM=Jn$c*+b z5*}DFv|4SgrSsfXygJ(@O>xQUL`>}j0?*!0S8AII@`~dkhR$1=GCANHD`u>qrxc@rgV5RhD$Xn zf3?6aYK{544=g%)bI6$*!Lst4Y4p_b%<$q$jMv^PUTCXf~ zz-xjDxs{T~Tsf~?ZK@rLoZA;Fyw8_DWhF~XR7alLP!-xOc)l`kNZE5Q*CCxecQrUMqXo%Y6m;j%<@93 zIfl)5zw~rJy@l}NG{REe@(2%objlTe#p7W#V5#^P#dsJ* z{$w4WSTxfC1;f?jDjm<5?zmEGitI3_pcTSKRGY|t0=HE|w-K?DF}WC7S`T#^xR^8y zkniX(W45C-ffJ|aI$rD`-mDEma)c@@RLclXy1Up7A+`9CE}zDjtur-90>?<3Zn7#BQPL1Zs|s@ZxCZd#YhtIh7fMwOzGeZqT_f%9U|h_2gncQOkd+3?T$nq}g? z=$3=EJSFf3GAY%K@8N4qRn9B44zL|M%#yd?oODUHf*05t-FM#ZrB9&XY)v2llo|S) zdZw2B`FJO+bsEEH92w1`toOzlQSEhmM`SZ5a?S;e~6C{1@BdSL{HuT2Aq4S}ql zbOvmfW~VPsd0I}r^D*J%?>%q3y8nDKZWr}0fvJGYy`#ZY965e*2TMrusRY-wC~G`1 z9VhCqoTgC&X9}BR>{09uxtb?N5&;Vjm_h81dM?M5jr2uDAMCmVv|3o`AZ&FNX)U&g zuH1{YeC?O3?e&0mD@SBBYl7vbyh}49;&<-nn_;W{x{wH5jGp%jA3@7pHSbP6t<7v4 z@5IP4^5D!jdk59%gqKk|+40@-NX?^qs!fl2WPwZve)OR|z^>0TVlFmWE~^_bzw*qs zJa6Jp2&Vl5ZV|6Nf{6r0fc94eS!L%t#O?mP^6i7!75dS~vOsf;?hXS-wp5U$oHONr zu>cSh(`oIDSSE{bjG=x*-u6;IzisgsUtQr~rq_}}$@BLe zxqML27Eims=9I#UD;Zod5>k`Eu3qrGKahSrKC-)A!I0D1T#Aj!L4jLtG@GC=#v#q4 z0g5JF8LmrpihTJ(U-=&g3ZhJV#l4RcuUMu~At`b`reKYMO|ro7zfKlLk%XiS;8xf^oBirGda*1buSaYefa zhd}ciKPW#c@8*jyHRDgo;)*i!!)T(%J@38KKlKwJuLFIGU_*(f$>WN%rgrl`+ee=u zunJ}wUOt_P9-Y5~v|tqW1V(FXUo+Z>MF&z8O}_ZPv7QoU;R6TtOmoMzf*a?&-_B={ zKHjfk{!;pNS99R`coW#W@{S3+&sp^|A7{JH$$%a%h{@SMRbt(ApD_236I??h#9&3QNlLNT z_*(+D>i8+#_q-iIx&B%a6=UOi{aB22rA`&gy*Z^nII+`*K6o3uD7JS#b=w4`3swKO zpr9Eg1RF&Q|LoA`=b*I3xSE?C=eisF#iUVHr%1FQg8kG0LdyGm$M_wT(R98t2DbkD ztDun4RnOk6T108`G<*1AXo$n}8St>#HyD2P&g`TB5L&{hT^&(y-{WNtYRlIEAK4q( zM}>^W8(~(=BlG4RZNIaH&v2gmO281N7_V3Cn-VrQM3bOJvri3Zp|A5A9P%=4++||R zdrdKW8atPbi8*?>iqG&l)#v%_cBK$rV>F#jzk^YAxc-T08Xhr(A#wlee=;X4K?zkX zD?*@kFKM@5<331&WJamD-LHlb#JA@Ej_qhk7uEz9c~ zYWFv`n+u#|XwOk(awTC`vT8lX9V~+06L+>;J3@Ib)H}XgsCX+|f7(vMA)B!z}u*)QZ&>dG_81uqp{ z9)w^sVFS5C=LhsU$GHp6MfOwcmmtPW-du_0p;q7)FJ|#Zu(FcTv<_!(+<75NqK5ql z0j27ZEFT6dbhoI5BBO~MX2W8jBm$jgq+WivMcq!)ymB)g~}K55C^@ejv-{16{7KKghNw0yMxg3`ETw!Rx2>$L3JAqSU4<<1-4T#J>1uUHf| zm!K321w?ltq+#i&FwwQ4l3UhmIX58NU|QMp6~bc%ZH9m-Z-hdw!&83=`z`CDD)Wry zsGOE>GB-6O>?%>?CF1GxBU6oT(Wfhm<GAQY=(o)MVpUer`fz`^ zXHAqZI;uBt^p`6a);yX45{U89_qpd)3Dw)6`O-V!7S2(?Uei-mD zb+hxh%!r;^(}s%i{*7T>s6#0%Je zjlRK=!*wF4RF|<{;#TE_et4i(dDZQQloqnjYO7U(A9TE}K;(in)mWMH!bvQOxs&>$ zb3y_ZEGri(CF2WV{``QtbXu*;Eiu8|3Pt7T6--ViDzWq63ICW>1fQVusrvC1+}}2u za-mW|eIwwFaf~(-5|YB{yHd$lBTE78^D_x0ix#BLK&kR_F3p&EE=!%I^1G)ctvJzK z=0$J%c}TB-lTO3L$v@eZol&#Ucb%a3un6Ut^3O$D?cNQlzGZL=^z*E4&k(z!vg+aD zxr@0~Xzfb*T}S~1BITbI2V)fSPH*$OZP1C8tFHwjR)0J3QI9&nPVx1~Ew12U%WhLT zsd{n;_VO#toU_AZ7d*TIDjV@hRJ4S7$&-;hvdjCGpP^Yi+F4$>E>#z9J&-?M(iABz zaiX=_-|L-6btx}p{W=efx1<{2jd=NCr5ZX{?Q?|8Zp2(0aEZQu1HlTQ2Zd`uxml2a zu5aBcQEY(f>gL};_ZJFp`mET5IUL*&Y9SRw4CJSV%kD(E1^m@E*YNnAF24PssKkg` z`9HYRE9xJIYX4wR?W8S7bZy%m>H_`;zS&F~`fT(smh(oY<>(33}kRQp9GH%4i0|%Z#%#I zb4nCP`7a9h>taceMET!a|F09TNsA`MGejvMyBXkYeN63O8k+q$1M|9JH(Om3){i40DXay>zDxLQn2;EOm z=tAFsdh&G-5hl@p%_+&JVGi$QE}k~%mc!ILG{UOqZJ|NuWXE0E4jHoPE3{hmi%j(6 z#wF434jn=TZ^o+R-AN+;FRu#WLPtWPLMI$4?g*7Gd@Tn{g;T*oKy+Y%Fe-f)8PY~AUh!lOtA~8a!xc+kuq^TJK=Au!(GE0tcL@@OtG!&H)nQg zcEPZxQ$C3sVcQicIud5;E2g30)LECE^HNB2L>xg7Kq6`oX%ds1<7+LwwaE5#J8|-S;YYs^iv-@ttqJMEP3Vs^^rBgDz?`TjE(_ zqNjR~jMa{aCt9>)&mkJERIzhGmPEV34(e5=sIKoc1(o^(i^Q5G-|{ec*!wvTU&mK$ zzCgL$v@}@`=;bbNcG0gK@kY&$hOBpCJL96-4vHAib8J=5`M%VOa1B=m-Ug3 z+FtM!&T322wK>P>kov>PngDaHLusn?0$Vi)f}x0wDv0+>9I?Zg8}>~v7lhNs!kAx; zK!+o!=<~iDp9)4*>R)Yce|`aO%vU@?D&8zr&-td3TFNC^wHZYpe)h-MfUDvu2MuYq zx`COEQ)xM4k7x2~&vRx`a1IoamUAi{39h}kkilLA*6gy??vLB}Xf&jIH6iE*N94(; zuSUWwjb$bF-k@?1H*&{f4>4Iv;HRY)1Y1?_v6Oe}4}}V){#gcvJzokA{?uf0WIFzS z0?+%W8N%1&#Au4AJ8eOm(`aF?Y)d!d4^+z+IJuJI`q%B?1iaAK+AVIs?(OJmhHq;4 z6JPo&!Re4OXEtf~a(7(jTP&ANwpBJTG=&{`b9nl)V65e4bS!Ffx~G0hGToCf#q=i< zrr^P3GSdFm7iMa8S5A?!zHpN$Ymi}lA(GH!>o*+R3YsyiQc6oeo%_*lii#iC>1Wt=N@d|>Eq9)5iZ z)~jYLh0M0f5+uEkWYoPPAz3%Gwyw3}oM}Jun^y2ds+}Ha+^|8PDc0Ly2R7cc_It!$ z7DpZikRbB{9`h9M!G`pP9||3x9OfA7u^>v@nhe=Qk=E9ue|uY{a@sPdN-5}Zj8w`X zM6R)si@5HGPbDRe7CEPLc&r4+%RE@i52DPZs`ZFT(OVl{6yI`Ylnbk-^+s*Dqz%*) z_e+B|bF_JLUdpA9+L*Cy7-<_Sfi^d{+fruxwuCv7Li0$We@t-AwT6ab={FS~YVa7b zQPU^o+-s~fnQ=cP>4w7J**QHgjq4`{tM2r;kVW<#f?4=#8$~RHc}`XsPCgb>_KAHw zzn}4C2#Z+bW=yK0MDX!c;l})zy7#-%dk2%*2 zaxzDb%>EcvR86Z1D+PW|uPZ%!7 zy>qBQ<4Ez!YB>}1E{*P79$rrb$8#jwNHNVywBbmF(B-mr7S}2#)mh&{oY_!onmxuk zlm(U?MLnGoeCaN1>ia_K(-Xso1C;X*>Z4#Q8@JZaUT-Xl#wAJHFEO}O#>~c|#?CZ& zGHu!S^BI>p-G6c?OKVMYae?ESt=xUQ(nv1lB~IDfX+s`du{oI=m%YHpNIPo2zkh1f zmLol%M|*ug{V;tucshPxV zx^_@}wes09^+sA6c!w#KaCzTR$xr0^0d+9->34pNr*Z;www4iQTaFh9C^he9S+O0o zX;RkEa1%ChgsCt-L<`IM+V$T!Ip}bS?1$8(WM%?AIqh1<@YPFLIO-7M9a_J84`bwk z+1h06v%H;-EV6U|vD*77Wk}~(G_Vt$?s|}U&|fH!7Y4nYsyEm)w>u5o4#Ff44TmNv zo0(dAN@q%AIF?PR?=nHF;6nZn()tC#&M=Rt{jejVYednw7?-SWAbvb;7Pq;d9iN7< zN*{Z7?URnLy(=Z3CbD8HGiL(1?pd3jSd)5d`%-)H#}<7YogkF}+2OK*OXkfq(W0MF zrRHW@NBXZ&3#YfSLz$B=MpB5nyGNgmhnQ!4jRj+JUe~Qn zZ!jJ1(Yci(l)v-27nB=G=*e#@pEE6Uf02w=5WugHGHgXpZ`{}8!?ViY&a-k(M|LkkbXa(B z$3_)+aqp-#8}1%nUk%uk9T)g zdG*M@*(<1VsY)H35Sm_SC9+Sz+x_Z^e8l;S4tZ7h;AF|&3J5(38(HMoBiAX(YX2!- z( z1Knam)KvBj5E{DC^2-`_aO)HO`Z6KV*6G_P2C{Gp5?zINB>PeYc|Jo_bMTWTUt9RI zCn~J(rL!1Y&<1|TuzGou9ia=)1U3=5ivfZopWZmU=MS3}##L=1$4|#~<05NW=o{gxa*R7Ym7Whba+!eL0&h)NXgcq^~bLG(Ig^?TR&*INAfsfR{tLVyw50Kom`*KI!rRunoO3Ffk#`T2vAoV@Ym;E zXmPtv+xB7%d!^UwKla0|Imb3D_?7l>dsyc{kvQEQ2neL>AT6az~ zw;Mbk624gKQ{kw^H~VJ;1v(UifFMW%z9h37EuEzjt9m$Se@S9y*%bS4RN_3z;?mMxSvfh=y8|ay7aSG*%oT z(=t9fVTnFS+@Zb$og=lTi^}-mimn)R25e9cZqGW-h}yOJ(-Oo7V?Y(#y*U!k2o21= zwWfWATv5bLYc>qa|BT7nh*4=SX7Ml`pM;_?IJ#YGVmTiPig(?-Pv?3fq|vSqbq4$z zfq^fwGJbA?1^pFzyl1F=qB$OBtaeUM=yFA|%5o|qBl>GGgGZ-u!hB`^`(Cw~5u+}i zPp%vhDZ4YPbkrCLES6M!lJ1ehb0A-gf-)imo0V!@-IV~+nu}yViIaet<3~>%rPLkY zFG)8C788J3-KerXJ1Bs>iOlHi1tc22?D=(PyhFyt9HUR$Es-B_HOl3jmV{j2*gD)r zbq%8FRK{)}KTYgNsDq+m)n7>p2G@-puEi&z$i@pFp{$2z1_U+Xw6@pzZSYys>;IZFn%X!Giw z9CFvoK3rGsYgAk*?z{8fkL=_U+*Y~nryd@OZ%SCiJsX#X4#hl+ax2=0ZXKkYj*{GI z0X65iPIr*gKYYdYlf2uqfs-7oADm25{L*I-f`}hDBoNSr@D*Z0xwAPl37^W;r1e_3 zQbFGaSl45zC|s`QbIzkdJLtxTS}1O z`m6Q9vGG*2p;`-j)zE0_d*{I%JJp5%pgc$FzfhieqByw zSlI7F#g-@Nrlkx88ZgqNqYVKAdQXzdhyDldnT4&(=-zikfUB)Msm^n9unom*R(I>; z1K2_&FK(nYzW5K<`ESX^7uUIXU9a)++ga_M?$6_#?+?dOgicX!nKg{TU#sA!n7vr4Socob2EM{m* zF_|LoF9=V!^8?Lous;O^k+cu^r_4+g|6CZJY>_i}jSTsH1npHvio%T6kf8pl@mvAC zJ%>h@L|h8FPVworToU4Cs|X2wg7zo+HfF2{dulWxn%rQT2YY-mAUw;*GxMU$BBZtHXU<{cj`1dA(ktLd~wv( z{cbfRRWn|!3XjuT_lD|{b`3!Q_z*O%QTw|H;5wXkb~KuXg@; z<>7bdl#15dGjm^VJJaWRpVAa@d{I_W`P1;KoaJG~Sy5kYapH7f%|LOql})4_;Xx_J zp)r~+&p!}B#s3ZiLn&oxd{P&ms*Bm1zM0uxZ`>Z*;&k~{`@Y~T7#xUATFK1XP(rw? z1o@u8^jvjWy((iQ@Y!iRE8re4w?8V$bGv&cd~+Mko{S9An@F8{H(WPPlT3MpKa`aG zG5-0!WpyS?Qy}l<7tQaUS=c5dUWx;zVXitcPeu+r$3Q)dB+efwU|e3T-fI4d1+&km z;~~Xmy8I@UuScwrkDS1K<;-HZ`)1saMPOJQPMg{g&i(^3CvHL;YX$%Nhc8t?n+As? z?S?1pAU3>WX`nsn>*`pUXf1#I;wsq*EkIX1!sKjPkAsL-L>5Z&+aCpeWTB*8O83*R zP-S23!p94`utFbB6x`x3>s4Iv1|)%jd?PTHilNZv&brJ1nAXVjN2m9tkdQ?(-}&&1 ziMp-a$ljp)6X~{M#!qlYf(rucP$@TPvz_!Pa#q<_@7AvYO*5+vp-e(yU->+qzJ8TdAyJQ0ke&bH!bIFW8kP zvspgt4l9x*Ek+6KOEHU@Q9a2Ca>4~s=68qFLVO;E{*mpk%jY`$*NUAn;&x+&=+pOC zKjtqBYD?3aMaXgI@LD>KMdm4F{jX*?e`@hh^0|UTgh{Hro_If!OTi$Svq71VIKh|R zdB%rUS>)cB{g8dR{PUkf6pe)6S2lC&YF1Lwm_&283)3t%^MsTfOd!{+F?nt+0CwdV zH-8v4&g*L2)5NQ$=0~w`VI>k;0tChke?tdgh`pG-dWgO2@}uZiQ4&N-TWeU$SI)kv z?a7#%*z^7HqdsKqu~vort6z`!jWbxMCqmq2=o1?o)5VS|2QHO&n;Se-D~@7P(B7Z? zv2Ns+-ND(aiD^-5En&IV@~BS-f-5M7g0l!B8H^Sw}0z=Sh!VK#jO6Vtfv7 znFr`PUR-W-VH;cG!hG!S$cTd$NiTsJ)OdJ6PjKc8H}iD{wfAEc*-zT4GQEGAL0QS@ zFMKo|e_mqhOz-{PA^5*o09fmuTJmYfD+?W$RJml{<-=A+$27Z%6m-56&_xL{Ogyd<^@A~z#;+eYLRP>|7SaWZ@S;qTn@9Pi-{ zptk~4CT+RG?U?UL$EL-D#HK9eW~f2sku%%uf*YA05u@ySJ72&0yg;X{DFNvwt4~%v z`*)ZaHCd!|Qk}6kG%)*BwOtdTWxry|dnz?nw&rRvml5{DoHR#qctpn@O%@!A+(c)f;e8It|EA@)tQ&e1T#hjVquz*X7xfc z*dKn`nkx1rQ6{~J`Q$NKsruc$NV^_D%k?OxMr!N?U#|_vGS|I7wfA&OXS6>j?|9$v zNkrEP7^zTv^Zw=KIF^&9DbLrFJWFwb9}jN|5k_io0#I6n!_`beXmu82jDdgA6|>ox zTHR=~zvoY_F`{*;c*!Wq-eFKjjKuC0wozbk}}yeEH%J zQn@f6#uxvQcMq(SYfkNY^w*OFl=bcCGP~_A3>ZgrWX88PY%EEm%bFB%{o&V}PiOT_ z3p$RC@;7kbB0zf`Eo7TE@_ceL@td2(7OgtdQlocIKP)1@K4lJXxoD4k^SKGodB{z+ zu8K}VLBHs0cmAU?zMX1@7UR6jn=w5APh$7x+(p>=H=}3~#N@X4YRJr*$8BiDxWAG4 zK9P1$ra6?*z3?x4WEHP3+%NRDC2L~OZg7usGE<;hQdO3`*g;D(F1*Y}Hwa2MgA<7~ z*Iv+{O`VCxjY4BMu1KPVe)G*CvoW+-cOCo;Hts>e{pD$Al93Pn1<=4g<+G7H3@*s> zl^la1A=9bbShpPpq-Y^4WmOfKz5?P(3oI@Tq#NH`wKMKNX^T_E84^rkM1;q`rjSz` zFViT;{(NWy{`~wZ9Pq=`5-B(RV#JqiT#ozc#OD`_YUr6%w=!OQC2_Z4h0o{sxgU_~ zX1|6*BtB*kvgsA#z2!bUHsQO`eMFe5 z-8%4C=rSvmrje$*cV2hz@oW+8F3u5?gA2jiPW#Yz?nm@lSdO@1!ue`6(~(Hj=^x(_ zUCflKn(DGNfpB!Q_UN}x_g~I*;@>bgjUzMyw?7=Hn8S|aH}z2M&0?}Q5@U+&w|V8M zJr|d9j1i1~iX*s-^Ne_KF38H>;qd*v{gpAF|A)w#)w7X(Zlfv=DOpTSNL-LDHj(2c ziXsmPG`*wCS?jb+6B6)b7?^j~p$v7RHs?-ZZ=(jAJQ80k2_vw-Q2FZthZ_?ULjpzH znvTnjb>zOfJV{7TXN!Z_FGSQN?Xp$|&FV=RxqRelXn%-^Ag?C>@`SFSl+~}fq~E)F zxV3Wwqi66G>AQb1=TNeyFKYF;11on@QggucGbdyMb?r~^?Drv-JM$Pcf+)lvvcyO> zq_6>zSfS1&IfP2OYNu9S^LwA3^)B|-Mq#-)$C zuveyTEGaC%%D8Qb95OU+FHIgK8W?G=W&;YsVlrUEFJQi}&mR>pdh{aql2zzhntY!^ zHLKL~SJw|wvBWt0;+3mMoRMFy(tkHs{r06vpY~1Jnw4X^w6LvLhsQqM5@|=F)}6Li zP)I;kA&X21o#7LbW2~tj=G~YO)|#ssgvlzKJ2RYSf>2g_Xd)ceE|;oL#*sNW=jK{6 zO}@?g69kdA*l{D-HUBDz>`dYIdbY0kzLV5`M&TXXL5C2v_YD%y344r+C-D}>e;P}# z{Sl7u)r&YNc||decTeAi4>;rkVOjn85bgCm04djU3LadHzue_q!{(dX7rMoz55&YjRIMm%=cCF|sjeH`786gnSuPzwVuXKEv>2?wD%M zXjAr7R>K_#h?FIbH^1@iC>Q*Bjm`7+;Ng+&$q$^u6UczxCh2%&nDuP>H5WsDy}cK` zqA-^}DxYN*eroK)nTLI`N~;kUc$0{{+Uh}9MH}q^L_TC(hZ+1he*3UJ)mZQZ4`qYU zjDrV9A`LBYqtA+}vFu;&a%0OLPj0yx3CGw4?>IpAdECZQJ2cCsMymDN#wHqJDuv=Z zW1FFQp+ixJ1e5QG@fUdCMR&iNpqHSa`YDuM)hYIJK{F>3hmZgYBk|{U+xfG(*q*;p zLn8@d*59w?Z&`^2)Kg)$w8$|(vMZb*qR-9v%Y;m3*N+={V1nL=M6geebWK6dLE+Aa z17A4*d&ao*6u~KX#C4_?_Rhx`fVmc30nfn9Svz^|`q^G4qc&ttUgAURGU0PzX^y$X z*5VZPR<@ThpjAp@{7L?G)qQ8yD@$+Xso}jdcB^N01=j*I;R4=ahf-e?wYc8DVu4E? zXJW*R7Dn0X(x~#q%pa_zi$nn`O^t|59JB$6Ma3aI3r9N`)zLDlfrxDB}4+CF99 zXa!zxqKe>(>G86~zmdSo5*IaOa<@$cjj7ClF0e4t+){KsCn)gxAeCVqH;>lb=vv=u zWT>`ex+Yf^j$d=T&?Z8$sw*ht8|)+7^Y|R9q7<%ya$n#8vP4;YBdC=@0)r`dJnr?6ytPFT7KclqRC@fe+4s`%g4VhTP`!@OX5)_bQHMx-ua4+e`1Vi2thRKaw7JP`1NZT$wHX?)p3^Xykb3J`VKBl*2IyZ@Bin!Qci zgy^O%X2uF<(`nnEmm6KgEsSq8q_YR;6}&=K zmH=FQpq@?Eggy44c**7jc$AXfFYzZCa?W!zm@YtRi6Rf%k~%u|x-RhY6#H3j7N~*3J%y*!`V;&}*I7E2=@> z_OKC{PT(7%zT{;Ze=-3sSFfKD*I$$I z>E928LX0*ar@@VP{FH~ETx1ixQZ#ejMlM?Cvm8Y5Us79$6!TzPIlKArh^Y?RZW<7ea zeL2o!IDD&A@zdonP;_v@?C@z|-MuU_GR7GYlq3uEhLah%U*l~Qq0(%$XXVTV{LmY+ zdfXTb!Cpr}c_h)g#Z*3QD#X|BN-0Ez_O4~3%>H15dBDI3?)eIkO%&6T18P`wjOH~t+?A% zJUISzBvD@Pz_#M^N*~yV46ey$wOXupwMA5|VW?=#f%%|=9c86>HHW4yU%hEJm^`GZ zhb!VJjexr~tJAv}8Ll~;9ngHr|!tHS6@C&j?OIe)3p{0*iU`g^B33q?&o4^o@QFSy!hAEnMehT8bTPMl- zIL};Xx^|)C@1W;xMc9kGl`E2dL)-M&ru%3h5VHAMLOhE!Og+0vat0ezACIkApQd&DH3!&g*g$65 z@z9>4G3M99>)IOjjJkur-W9d2>OsPR35PQ{&Qe>CV)v!;W~$J6CvNdSxT-C7S7K(@ z7SuxbF?_eq90EUOJWcJ&P-Vz$(Fd7Z=@#Uf?G;*)Nc&ft zD`>TI$lk_)Jwr`Sm3Eo_)az#K!vCycIx$zc0_j@><`;1*BQ^JmWpd;IkIfOi~&i&#bV zYMky>o(>YJVY>OG!CIdjr>tASWoC#lRrBRato4f*)J0$iy>^`g7BD((T|p@)1u^8k zYO;BvFW7sJ$n%YYGM1ma`>5c9@uN9F4-BCrZZaowrl&DR(9%3v)3)e_U4>s@WcHVS zK}g6aMWt-WbQ=?@y%xz+2H9oPNOLJ5Yv@|`3I=gM22=KTX3B3@eHEKMh4c>jBk?z8 zu>1Pb5#ZkjH-@4odCc3`0JGd2kpW3!e0wQ4wV&*Tt{nOs59tr@wx18#vlmaW^y}(( zk!$#HVH5ts=jO93N6a74gM7~%U9D%#d9{IYaZ^v}J`;gHU%H~stZ)1G+#Hvf{G2V` z6ga8^%VbT(Mt!EI65?VFoYh>us`kq&G{V3C&Nbg|N@cyg-gJECs0<+_O<4SSh|Id0F=TXHWbvs(6%vYfHO=KzjN=gF~$waQjf%Q%ezSYH|{ z+DH&JsOvs`AuP#O1#q}Sndqp%D7t*FLmMxDj3n#63l55|TDWxC{qCX0o$7`LER%s? z-B?EBVLl@wSJjWitt}TyJuFE~2jZ>_H!AoxT4*^#}XaS`<>8c&65>*D5!L^4O?9q(e)a2-Tv6|?Vg_fMzKyt$kMmc%NT`R z#|{~}EbE{&;Ks49ioT%ynE9OeW^-Xg3mr?uvw~>g}Gd?=ZBo~PflXNg_DNlJaDEVXq9Zz=%`Ytcr z!_R@pO=pb9Eg#NjeNEPZ1v8$d$gLsdX#KHQMtsd7-EJdw*g-kw@=foo<;gex(YFv4*OLlUe|&bt#7ng z^RO@3-n>nb6FDY}e4`H|BCwdes}dt;U3L?{&1y)d^9WxeJ^!>-VF^u5MlVYM$M3;s zA(c|nm-%w8mmQ8el*p{+Rdv)Kai%u-{kuZe3m*B?xi7h5jSKxrt9bjYlou5aoq?ym zXucV4L^cpYk^5&Wrv&C0fkcXpa_?|UUOOU#Bv`eIJT^qgzOkcO7QP27{7cBHItBZg z{S62ivPDagXXk=L$ih{XW_`bP_fYT2m<^a&+guehG5g~=lh!UPwnw&fM_5Q@@{6g} zH{8gDnXH!!m7A~g&fgAPldsg~1$&mIo9}CLpZ1ZcTz`=(RKz;;{vX2LGAOR5YZne7 zK=9x$fx+Dg?l8E!&*1Lv?(R>p02&Rr@B|K zz9d7}Pn_ZHWk;>EW;L9~L-)^#)zA%Z0-Wv`1$plFaMr{Di6=r(O?$wPxQjuS_2EM} zQxy#Jm4^>*-OuP1*b)k7kogva$=c}ePU?Cs*hdk#8Uvw}&ZQ+`p zWj?K=GlPP)b>OYAXSiZ-8f)nlvx&WJsYY0yFtlj`q_T`Yp10hZqk*aac z2{ArbW{@y`AFO^HY8Wk)((%1I`V_L_Ymr&$?^Gx@X{&s!wFq}2bWMDQ7-4&_t8Z#T z-;E4lVpxdGyg&NR2UM1E^M9$d6TYV0a*{R_FR!65r9p}uSFm(-)Okwy@Jx3Sp@m(~ zl~P@9WA_lF8NYxHZ5Eiz}{}5&F1kG^^#V*sEk_?p4h1|}X(=(N_SO)G= zR>|-Xx1DKA1~D{dqM*M_H0OtHNUOOJDN*Fk0eI_DnIox)Yeb>gq+G<2tCSG4=wjy@ z0oe$+1+cVq1l@@wQ{+&AXn1LxVS1sOWf5O&x7S<&Y!Wg~xU*YdCtMmg#qroR&PqAU zwxoy1*se}q+y6+h^?Yu9@jZ2nPJQ~2N{8011Ld4qai>JmXis61hvWE_iIYD9W|tcxTJ|9`dFsF%Dj=C6SU&f?{Ov+{nWMh$r(cz9$ZRge9?++ zntuG6(l}_{Zvu`#wa`hZDi-iRk_AkB_s1%*^@D*z#xx_-%DBpb!k}A`6&Ghf8GPYyoUJAWJSkdm2pl}UQPvb_S1Zxta{{|-@C3;)*El* zfS<4{MLvWqxB-&rxYuE@ITfkg(H*#77Rbbrqx#l@YNuVNz^u&(M?*XnE|%m_Iw7vE z{L{f}_Verv?f@D|+|7ZqX`^}tU4;b)COT_JqI+^`$KS7?K0=L*jQlP2iHeGXLVM>E zY~fz!1knUuHZ(@y)OcX;yo9ygu2quou>FJdW;yIeE+M3Ob79{5{LtKkxmCI+^-0B- zk%i+Q-oZnL!G;*^6tX$?@<5s=}q^ac>nY4lHp(F@c(Ji z+d>-nfAAnS12xAbzXXF;{zhs8v?ON#knqs`xAluZruZN`Lp!*X_!boLPgxzpu9i@{ zY-5Ng=&b(V2p^!9RblkreD&)i|J|f}@||TsYK-$8`#+-%04542en2#Tt})4!yz+NE zaNyCBJaI?2Y0xKhrmw7dVI;ItRm19eCqo3kg<5Fm2>$yGdK1WLNP#l}ijnXO)0Iv@ zb+1ba%eNpH$*x!`qCanir8jlw&(=8qJ3{-i=CdN(KAuzV2(+Hmo3EQQ8`!9u0Pj-2&yF2z(jHN0tj z%_l3L`0mb(b=mlKNZN)LfVs8$g^lxFxcq-++8gnIztTIk~X&+Q8{l>(KZkG%BJrt86kwp8_4W!a=dj+x)Hx3ZdVnQM8@(Oe`BVF&iSsFPz8FUuG+%I#!jUGIT1_g z#KFQtka%PQO$xZzmH;`L^r03&xEVfkL2_&|!g*ANi_{Qnr!Cjz_z$Du=m-PMM-REJ z4rMm0Rtf54D~pS!Dc16x@&q=e4AR_~1AO)~@v6KirNP+I#@;q&Sf!AVsvEImF%dN5 z(0Nx+`gj|ZQ_d-}1ks7dx?T~HCSH4Ko+_oTcM*h;<3G;&1Z>y>mv)=A-RoOI;#BC< zwE%cUhezEr|IG@0U81c^$9k5MPEoq1ASrLyO>a6Ax6w#Z9Gr6V0AOoM+tga?n0ws zS6%&sMSMw9dRgkHou7hlxI>(9wxwOK^mt;TMuqJzbGDO-$G>*!TQ-@DgZm`!y~=s` zT2IeRDDj_!kC8UHMnBG<_wK2#PBgr8l&52lN0uP}TCcXuetpy$uxP5tE(QVW;L zzlVqmYT}oB$h*N?;zcX$y*yG<+~AzdaT)3=w;3y;uQc+=>!0EssPQ={qO@AQ5ru(Y zi!a>=?wvqtMvOxRcT0Jr?P z4RByXb8OBUahqZERC>mO>8*mx2Pc{d*L*7$SxjAD)UB=`)W{D*6T<^Pj&V~1S8Jwf z_hbYzx-%ryickD!aaY*zI_C5@7!Zfgdn}iJmCi2Ic56{IOgcmp<%SS)Iy|}D(P#A3 zBX>kRso=8jTR#Et#crWDHMCsv=WMoLAAgivIV5t~1IWWnzBh_ZQNV{mkb7ROwWq|c zr@YbSqGG!!v<9OWYHf#ErAKt8klhEt!2eFU_E5TR%X6)2OkVph^>*;_#GX9y2n!nr8KUO6DoP*u>} z3=vEqP%0v~tnM1t`R6bta=lil!ernXk*3N{JZjQtXlRF8zGWKS!pdB_A{uRDGO~EJ zu0D!-B1Y7zd-DAeUO9MR%)`2R_SbC67Dz%d-Vzdd9PG+qGLrV5-}997OWLo+i@Ye) zDarKgD8gGC40Xsfqs_lMlL%xB`^?lq{@k5d8UZ=^1PJ6-xoVkqseb5SGY<69WX+{a zm|S18I=}qE`xe^6pE#Y>!e)1ja3_Hb$Y}l@Nu-P@!ICdY$teDuu#x9yjvi@^R=zfN z8e&xzgDZ8^g~#jop-mv7)^+z{tlnDGc6lJW+@QV`kJSrxueG4d{zSO(`z4_w5%EVI zGd7z&dHi|ICnSQtLq0Bstvq|7fsa|M65vgqeMar^zu`e^1yrmhW(cWQpsF9axS(nb7Cc#B!L#Y4?3Mn z_0EGnO=D>HWK_*>d(QgfF0Q3SR~D|@v4I z1J#u#xV$|fh&TOphQCwajWO=c=JRrHvtgul1KN*eNX2qqZL7#&sd~Mk2mDM^_wLwN z;9MHR&dsvS=cPn*2A$sHk}q6(ew&B?cj%wFEs=gi!G-oUa{;902F z%X3V|X{FN+uvyVbf(;iY;tsaMxQ~eOpl@;0c;u()wzWKVHO<#VcN`oSg(BN$s?OUQ zh4LwH?qYn-^E-#<7|@Wj)fvAnW^(HKnAaJ{#yWYDWw2Je5e@?lmy>HVT*oe;)d|I} zlOx83;&F|yo{AD)(?f%`WZ_zKyt8D|HwCNti0fp63S=Z<+ zNP|&RtdJOE?$s!jXtRX5#QBVuo7;&6nHqIB6yiL$j~17wDPvo+9>wO287q+{m5A(4n^*@4 zAoT{zL3-@7s4qBG;G?wFclosO5Rh^$0cFaGz`dd z#aL{yipSkBs(oC0K-NurQa-H3Mtd?1Q`h)M@`&mLX?1H`iSBnd(oSL8W?LgC=1{QH zc7!Uk-6IM@&17kmdzq;b{g-{>J8VXs`CG_!yPz>+pk*GNhx5}bdzWqhJ?moZQ zqgF#BHkj)t!ZG{JcbHyZd9&)L=J>4ECP~jUo3?m!7s&HrFlJ&ma7zF%ynEGh*WlrY z>mPA&Z({ED`j$54Mr!2to;YBaRFV=X1r|^z_CDgk!V~PuZjFw6dpTCp95sC}`3|a9M8mfSfTiw7*pZ#tliW6_ct;>k1 zBHG-9ti{~)xj<^Q77kdqb&T5^fYSnr>8mCq(q*tX(TReboo27eBDSC}R5qU<5s7j$ zM}&%qxgd(W{I*|>mxI^hj0i52l839e&0n&yInu;0_$}NgveL24n=KEPkyKLqMM@Y= z_HCUT>qC$fvlM&L%ub~a^{2ufQ!-B-uICBcht!Rqd2m_ad}@S4G;I-{iW8wUPv-E( z(C`fGL}SRAYhj}qB{l;3v>bRopkoJrnv)(-1msTntd_N)lIsIqBk0M>=z6(wJ2~Ut z%a3_CDQs)=b;Sdpfqo!h^6aovqRyTTt?G=2w>vej`FzY(O(Ib^VXxT{qt4!0x8|Gwc!j)B0f9OI2nJNT(|MiwwKdUP_00yMAPLu8YniPGE5vC*<6?UH0`|=p#%>SJi zg(i|BBlsh&2dHK@`S~eGo7fG;Gv2fvxx;pUFO*qF_OE|^XJWCE`N|bHCX~qF zJf2?xrc7$~$aq-V$)0i{dHeec8uJ2uBPZb}FzGw!eAy4PUR(A*x`;y1Obs!1+i3=x zn}$oVN75Z3y}NbzN<6KOic^coMxm{6$7yUlCYx}`6;ZU-jxN;AhR1_3i$h{&Hw~}n zI8G5h0Z(f_vR2F*LweJ+=6S*+;x;D~U5J^5colVxb_qn-2_)W~@YStMIi6up{d_JqM zf3GJErp7fPo7Enn9!_vG7xe|YuS@Y0FGp4e1NL`jLuCShCG!5>&65;fQ>oOD>L9uc z_j4W)l24N1=yUh3-HmC3g*6K~8(5@{9A_im1kdM!bwitQdv22tf)!FV=DRJt@oEiA z4yP~kb4}z=IFY=Bi+Qs571_zR1h~IOoTNiPiLqDP*mtlz434wwGMog@nEj`tb z@4MyqI7GiUw~15bfn9@*;azbGq%neEIo8;!4G+nPf6ic+vsAVK<#P&Mo{(}YXm*J2lc=|>%H9^8(+d8Hq`xwj(X4(#^cw!8#1rJY47;zYjuurbBpMeq!eb!oRdB{!JcjG_GPF!hmas?3 z`OlY5+;4NXOU}GMf2)^tKGM+LiveRs2Wy9i>XCsKCEx`|ZEM=+W*bwp$ciN6u>6ag?Jr&|VEN)Hf{oWz2 zKzO8YCWIhZmmV6t{1mqP;uft|I+2-t#=~)xH48W&%25&52gR(G>#J3g`cC@j(Y#Uk z1HE4k{Cui4IX!}c`Vtt}(j#9OTXzATfT6hyoyq26FZ0IvI`_Od_yZhrJ9_f$EU~@p z$I7a>L>+J1gB*^)PYogI6kmU^CJa_pu4_s!r4CIjJJDRYka6j&%HEXLu$Y)|IIK%J z?0bNQZ)N5xU$e0|TqC0-`wV81)=Uar^;zurn(cO|$PEURrrDzuJ8%gl(&;7eoJ@az z!Tx2oIh_${N_HD@HT%^KBQj1JmbyBh|w6xHh6 znzTIGJy7Tf=OdXjJWTaxz$_$AghE+DqO{E#xnn*-S1nsgHR#0%H2mZUrQ>!6vbS}s zT;ZtHZvD{qeDvq8pSv~2*b+ZC+8K5i3}T1-+_5cnkrCR~oLE~u(*;pfj=>$TLVNj3 z-%dx2PiDjpAoMR6cR08+%_lPo){gj1UhKs<-K1nZ@1?0yoy2zd3E>o0sf(^OdVDV< z5#4f-5~B_s*ZGPgdhL#wuGfeiL$zb@oQUES5p}mBY~>@3VZIe*Dn*k*Q=y>-fmXXI zPPq>pE9r8q$sr~RQO`^{fmZXz+{rBsX#ik683k&Z)X9hvr)Bqz&w&Uv#+;>)ysTOQ% zQDJCvovll8TH+Q?-Qf*?e32ySE0H4zgBxqHwHH zaa54#8GOzwcgIVU2XkwSfkZV-An2e(%UeBd&;t4w^Eh;Z;Ap?%I^d2#E^}VQX(&eU zYnH6p$N3)8)KZeZ*h$ib8R@x$uN;$dy5jLtLu9&Lfi4qhYhF4!q%fmGY|djrLD>?~ z`I)^A8v3JGGN#J-vBsK)fIz#09nG??U?rP$Xi~0J5 zv8FzsdeI{lOZ26AEj`BYKAGPT?n((gf|AbGU`C2a_GUkKA%E*i^;IsGRm2~XzW7t> z_Py^HSK|E&>%gPt5B$$d;SzCE!X{Y7#mP-p46wQE@y;I%1cG4i4WBDqP6Zlp^h{#N zap|5M;??GU`!?JD7|ilR7thF-+{W`9kuvqEPt{8h@odL>&<~S%Yqh3chW|Hq7bh{A zp4Z`6+~(bhKtMu23!Ym5!!cu zJ1^8-c4?#&4TFXby=VBIm)UI)pxh9+ax#KeD#+qgTQ^rgS?-k%jV^CVS# zv%7lwNsNR$71k@35jlTxbCI_HMfyT+k)5|=L3VGzB7)CeiRo@EeLR|pF8m@x(pwAb z`Ifp%ROj*K_8_BaUHr=5yHf9c&nhl2>uyi??nbTY3$Wy|_vm#0yrrl{h=NMo($zo} zMZtT;VYd^6vjGa&FCtxz(eKJ3a^YFm7Tn!S`$?MVVDF3W{(B~%@m#03s5Etlzy+mi zCR6KrThLrLUQSne6!kt~2UBxkT{aL#Z5Bqf3cCv)y@shTm2|2~1?kD4()u*dO zW&S#}v3h!Lo8X3y;XyrMJn2_W|1WDzjjHAW z_zZRyG9e-X*yjG&G}yXz3_ zFZ-WkVxVRu@&>W``jX!<9OU>gD(j5+oIiU+FGett2_%io*mOAkhPqm8$%i%iBb+9- z9um3#poA4UlsdN24Lzl4eBXICRVybV7>x$);%P7os7`h&xL6~{o9xD#9-p9J0UoDy zu~WZq$=xNW8b~^Y1!s#DJ*RD(^p1@>xFlb%ITGrKOJl7+XN@es{i5Fb$WbcL5v zX`l@xy<>Nr;jmm#Ge%-Gz5%t|Eal4c4M6Pweq+PKG@G{ImTCq{0SzBA4w&W3x97P! zn7h!qQD6lkQap4>?j2^7a4mlT3|Y$tt&!`pU5!RiUL>pOp^4fp@uWbRNMZe37~zr;-`6 z(Q9nf{^Y0F#$-79CScmES($$74tt_VI`T-kZcE!zqPIuy-)db}z$J@2-e z`uVQmDf9wf<_jo@+k(Jyw!$Ag2 z*Lf~@xhjDa;`gPRLcd`GuaeYQGe&LOf|06XTKv2O_|u}JAuCPcE1Q$Wqs?D=`b3Q#w59P4c1mQD9SW6l#jkNL^xiWZU4UF2zKMoL$5$^^L zN{{f$sdwH9WTD3$Y;5WRQwdfyUV=zoTwtu^iAPD(5ZxT1R7`!+WF#Nzs+#CkU%_{I zV;-A%a%g(=J`b*cZ>Kww<(`Q9_;M1^=m2}u<9p&P&qPuO5@GdPv?EKmhwXm*EBg{aX=xKSm?ERq+B;6; z_7;lx3=uLXzxR1#Os&ivyfPa%y-Qu6Yn0ooK#U`gRUX6IYm{#fw%SJuo$=J%_V3WZ9=X)EevGI?3U z{>nb6XlD5ZqyZJT?n^#U)%P%W-ZqZ6P8x9LP9%?n`LhhST z;y4byy7a62U;(uLhbVUP)+i(hxB6Z7NU3fT$mvNMjXRBLOY5#ou)o-0k^Y1+MpZ``p#Mee|nbIF3m zk}ewzf(5fA0>MzR@qX^!km8E6rPTFVk*Q``djMGL?N8yvU ze>n_EJ4s%n*_>S+63o-DtOTqUPw7%MSi9lugaU{#%Z|FbwxD0$SjNvyP+AOj5K-3) z_p1l0UT(t%rfmf}zTGT&!xm|cWyg<=!4Fe6eYN#)#%a-;t+5-7cCfZqK)QOp0j3dU zH#@qjwbXT-diW~8e%1dtm(sjV+!1nXvDbfqt&&I_W)sY^jesjaA7V0%kZtma%Uu+% ziWMl$_`T#7LMVti57jv=wZSu{7_Nuql`u%y*XSHl9ZPz?}%oy~9RlgiA3l&vah<|&!q8XLQ5m^_c z8_c`Hvg0&V?|N-3g9u$JODO|CGflI_fY-z9LDxaYGjwBBL}i+owmtAUqz*u!1qAP2 zfrdUG9omv;1tA_8tV+qS4YehdeqCk1DlU!ZD*8YeK0IpnFxG=44f`<%FbFo{I&ns` zFk}Fto4TVG7vCcB{r$wcOG-q95ZD_(xmC70TK= z%Ab#6O5*T7hV}gb94MZvvj9O`gs4yhQ$M@8{05jNt=zKc1Tu!o z6RjrYwXUJVLion3rK6l@NnPyGLdtzVyCia$GLxUegMlbZ_`|t?<31jvr%R}jy1HVY zbu0iNc^BYaz2130*}@#AJH9utJf}`uRuR1@%8pBj3~4h~ik8H>J!fTSJ~Hb|EkEH@J}rUp3+jCgDy*dlkM)+a~{}62HxqXU>M6I zLV+U&0bHBLfa(H!W0Cuezo>eONo_~3)P^si*K&+(M99J(CD&$4qzgpu_tKgsAZKXB z_5K#?kzhG&Ge;^K((AmGRt=q~A$l{Q7%v#R_4ak znp%*g$Q;22D?*C>2lJ472IxlHA9agae zl5mLU&m2q)S_ApLvqMo%Xw^Ro8~Xq@{kV?nUjqx(M*P4!oR+ds5Iy#E43=`w9b#L* zTcQ__$80us6dEw`w1YU|s)VvZY%cO_2uqR+0u+LAoDldX-H9}ZsdZ>we}Jjz{x zakL~fB*OXNgi(ViUJaSy8`@ie>EKH$`ah7BSj+n3!HUg(uhC{>a5Ts|fMogZ_ZhLj zy0R3mFVbK;N9D^Q!}Ub2d}#9<_b1H>qpULGiq%-Cmm5r)q*-AXy4GZCX-XVsPiquyA;>q*(6z6kiqdX{t5D8;V(O~&bEcCywwyr90>*1o#xeO9AKE1p{Ry5*K;FQ7eQ})ls5fN$$dqY9R#3-OG z2@Yi0)%VE-r@;PRp?+yuNr$!jv2@Il`F8vZ4q|!>?`cS|ug+OhKlWB5xf{(u7 zaG760yv>(8L?F1@(fU@G=SPL9tej-y7nls3&ZzL(+pd3k@y4jQtl2 zpu}Me$Ve6XOoS(%m~iqG$RNCJ|0iBXE0ZUrI?mwsN5NyxNZJO|z=tX9NsX_JQUuOPvVxJ3*P zv1VuJ^-q%Z_8l(|HVoJ5^UZaH1mfpE>QV>^-{J24=$li*ifW1+DHBh$BgO#vvel7M z5{6P%0jWOMkcq+dIriXXcR$(|1GXrZ*PUq>#D=D9jScrywd2pW59eCRyALe9LBAc$ z*M7#Qk?6@C4==Ks?NiUpG3R{604h(fAvD9BH`{bxo~~LaL+p=GCyit?qiSupUA%yG z>#A;_;74g$S+TrYlG4>hvdKtv{Tx2Xi2&tGxoIN)Xu^@3e@Wu;A5+9aZYL%hTI?BA zkoESDC+cUWP;HUd5J#LZpf5rF({L^t(Jq9mvcN2twC-Y3WR?>+S=*bQVfTs5`7op95Y#?+VlRkyNM0eftk zDDs7Q4@;!uO-A%G!qcLSYMjbB-@-9#f(twBGho|24&N09D!;5;quh74hXvxj+fV^9 zqy~PeR%qVuOVaBsNoYV~_-tJ2OFg;HNY*BUM&`5K7BrQeiTV(fJGRMlvs=;%qiR44 zt!RJ|y-!GZ!>5MBKkhFb+?mt#oft9TD2<(Am=mOAq$o;igLU0-LieaR8Av#OrpCrH z0vMpumLq(_(?}CBEfQ35%*i~gv41MY=VQxUmFXroodt_vTSfxaTwrp}@cSYg5=10- zei!-(B`RUUbu}dA(}iYFV+?t}>Ct9sGpC3FVy&46aMGkibBHtcvaF&tHMW>^WQ&9%4WX={t2JHOre9_X>&4ONX)x0%b! zf8>89&+}G0n_U>(1W3A^0EEB%+ylQm%Jru1$t+LBLx8iTtc74wXt)$bW%Nh8sr&#W zeAe6@Q(2LX)>xA)Hw@>FJ32xW8-sb8G9C6s@t^$Uo0Ape{y!#lutEIn<1}w|TR(#efNE*Sdnnp!j!FD^7yZ_8~c-*m><| z@kI?wQR`}iq~r}Z=#+2rMHwuyu}3uE-(R?@7)g>!^9I@uav-P6rK|;jxV1(?ZNc@i z`Wb0@t*@HR$>Ma{cQFx5T|^(O=|>}xGI1Z#SDPJFahCfK!wm%UG&B~rZ@oUBYL4iv zQWzsP053DUGNC0knux4{gL?6@y5r~qT3RuXs;OER{vXY@`J*R&D3$x=2AdOf1lu&Y zN<#ThL>pS#FajhK3wxF2Dm2mxph>Tq%VB*k-|no)`^|lfnml0-cy~gA)r~~~p+tan zM{I}{ml2TGanw~nvomI442X1Pw>`{zz8^y2q8W*Akua5{f!MGZ9uT`D)}epO3!BNC zV)Rp@Xl}q-QFXw-N67B$LV@oFh`V4iGepwpOd$yFwyXy$hqZy5~`q~)g8R9 z+c~bXT24OAmgA34_&8TfHGlg9`LWdq^v$$F#%XYL$695PMHhSO5@w#+3YJ87BDu75 ztadE5N1qXSsK*$Dl!|gwX<|W=7vgX-kyIcd;-0DJ&X!92@e||K_K?$|=mG#G?6`w{ z?NkhaQXWrqbkM}R^9Ner=X&p35q!sMJWb|wpcavLyE_z?4ff!<3B5iIo1;0gmxjOq z|GmK2u{I7ysVqg~gHP(&Or5sd&2R+~yGdGnmi07-fiq$DVJlH4MDq5U>fu&YL23F+ z?^=Cg%KYz$+o{GY&_;C)6-df&#>8pUu&cRnrI+#Po#c z_quMA?RQ5nFSy4Y`D79=XiKINx~Fo}6SVes2=TPS#&kYW!-B*YAx(}*xDXRyP1CA+ zxYiurve}T~K20HummZ8a=KzKQDoNq#3Jo4FX1vjuOXI9AG6XHiUN`W1yrK#o9Kqab zCN9jbl<-bALlgTULGL&%bs7?N@acEvyc;Rpp0(;d_CucIZ`CUV*X88Qu)lfW4;pEg zAgq%yaQ>-w#GWvaW?(edv#ESLv>D053f(W+=8Q8;8#-(wWOgCbBG}wpS8yp(=F+M!h8}2%Dz>X3qp%`%V7w(Tz$T_CG?25W%4X z)7N!ch!DbK-t{(!_vl;g<4cDcY{RO|SJW>aX;0VJU?5;BH)<>|c-Fvqn}M>XfA33l z+?1$hHQXRv{>uHF-gD6*|9YpfCA-lSE-HEUrqI^Waul6n4KML(2XP~TuF{Crgh911_g?@(6J8egYRgf#}L2>s~`rge(*u+aZ%DeUjH%0%9eM3%x222WBm zM9_WKW{?WCe!0&MPe3!rD-Sh3&U@O4ysSurNt1m&LDL1iv}x66W;eeB5n_3J^Q-%V z#L*f<^T@P{>(|YfZ~i3%N$XedY3>GrvziMUn>&xj+ok4A2X?*3yr*&4n6YK*%xrMW zeS6s7(VjX6BrQ;X^hs;yvEAC$tBlkF{uS!a_^j&O*qN?Q5PE%LhV!(z>f&3H7h}f< zn&qG)g8tKsNnp#ZMy9T`Hn+`RCq^l) ztz;8VS2gJlTkmHlzIFrOiRW`Iq-*KZMpUGCZ?Vp8u`K?3qSfZBU8L=7nYg_kFW2}|4;-|I^9b+OcO||b7+`+bJ^AJ(!k7p$=6yD}`d~T)sC(d^5d4u? zO8hhQo1a`hU3s`wb@q5ICYL(W+y#t21^9UczgKlV383la(1q(*0hij zi9WQCoq?7GtOG(V#hP>PhsHs-&qPnOqlXgp0%!@ z!GJJxOIssIz2N0Kg)ac$=#oVw4vR|zCst9()rcuDt=h%-?GyXh6FhvrG_`z6i zbbe8DfK>(K_GCWMb&5U+PQG4D8MTo6$vwl-vz%r|Ix{no($8XM037dr8*pRvjwwfrkhbEq)O2steK$n%YFa$3hNOY<83nTU z$oz+VwQ;oG2Hmm5Y5u7AW$XOJy)PL^^DSW1mM27(*FM;6)seZ65jM|(pGy62q@ckY zXDn}m(Ja%!AkA|67WwM-{z;$kBE^%OV2YDf^VO*W)4qq`Zfs|!l_^pWh1TYNg!di! zwB5qA2lBfu$(%i{{vQ7b#6g3bT z7g`k zjvRX^7<~uhlA2PFVVr$cfK>%lw{mQbFbbe7`F&reS*2!OUDn4;WITI4JT6VTrYSy@ zBH@@#Fq|;e$r|t^O-p+WFU^`8tQ(1_GA)~P7m82&gW&TwR+bDH%o0e!5PIygu!{v= z6BJ^R`?btd!nRu7EptxQc;k`)t1?KD2!>ZxVIUV@#FF+=i}>R>Q5ig5QUBvtO-U^e ziYh2L1zFZ_uZ~jD3Gj1j%60E~9c)pd7G=Plr#3We-EjGXT2^(lCr`GfGR6zFssCV! zE4{(TatB*LhuufIM0#@Gug4?O<(7*Pa!mQ8T*%`n#w*hc#;k`#F^#U${Y6FF8Xe}9 zmcb9Q+l`FJcXLztoQJu5;>zelG$TSMWgt5}0;AbjOe++36{letb@Lw=zj9JTCM^qG z?HH=QvaP(rsJanqy*?%3Q=yqJjaEl$f3&2392h8aCz54j^=|;^ICCt_h!aLcIG88G zR1gdtg6#%4Emw#dclknhOACyR@5auz{kJ7h=9TpI#eclx0aV8Fow<5yWA;Ou`8$^N z)&uwC3jMA=pmPLOFTmpS(r+uzMBG{q1$Z{6s?C^qN{!Ny3XTWiu{r?a0dQU4Q%YQ= z#^ihHfWa%rWr#xB(g>FMxicf4&V9Xi#mbuT3W=+f;3cWVV8CkdN|wb*e8i;GAo;4# zqI9_eVS8mV2db&eHrPlC{sI&MGpw>_xjwtph%(&RFDR&b%te@ z$oHD=-Y+*3ZL`A06CF$`s>oTHajy`K4XW=9jZA)Jn20)UY%p`eL;i~4XDRS{!*;dA zFsH_83<1XzUWj}IFXwkv(YY0!HH*R9vrqsf7QeawV3{3tMiAzq_fBbwsQ zaHNBgZ-e|b+Ck*|rjz}n%zX=}3&@`Z4wjoati71AbbL(sD3TaY7}ngLqq+cBXZ=nv zWg!*B$O9MZ7#Ke2E6`sDt|n-#hwTD?vG+Qg$`1H#sQg|^c>4fUR;uJ2aZ{fnRFxVz zl6+fp&lYm;h6)pm5~Z);M{RLoK)LbV}(Vcpb{Qrt*W^N)m2oamjJC#&AL0St*pMkQ}nu} zL4OXX{r?5~L%tM*Q3;QZDl9{&|AQy@=X(&7cFC}C0~fJySE=0jU3a7UW4(9R4MTxB zegz2q+`pao;)S`T_U-i9ZWCV7agrs*!~Lv zq$v;PSL#HqM9k|rj;FQn3WtP^=A*GvFNvBhoTAm>fAIk^y*PcKJ<*Q zM+|)&-k@`G?ujD_B0t#wxVQNHEym{fumls2O&k>jOn4SOU#En8o2zSJxwW5E?OT6T z*0sfyMe2*5@ZTmKrp+9Uq2=XP|C7mYPF-=>Hm3@Pr&pn}7Sn0?hF-B6QbPM%6L*U_ z6ziJ-qgwCW?GS&tWvd=7t324p=j{eSLz{_Uy43GT2%eA8fm)w(03*lAP@p^4PPq{E z9b@^&>626-m}(wmX@&5pY8{dO$TiO}1|50sdZwwZF~W@bEOrD1msn88;(giVq3(7l<$sKg-+w zaP;sIP)g7QPI09Ts0>V*#hq{7$-rd?+}I^ow}IFlv`6h9VG}AV3yP06@`SL zH(PG&Ld5N?|E?&G5G}t|9<}ioW8;4J0ujp-}}Pb z=I2|eQ->td#aS5EQ3{Cjb^9f5zw{#YXT`1D?Cp=aEd>=i^U3n#&t1*K0@7zkccDPI zz4^hLVqw$HIG!Vk=dMCVJl6N^7@y6ptWAk9;vP=8)=_|5l3|3AjQ zF*=j2>o)1w9XsjRw$UB4W81c!bZpzU(Q(ImVmnW48#m{?=Y03Q->>_xM%5mxs`lQa zYVS4YTr;a?SQW9DVDPlb|NLhDB$?|_gOd??i1|Ugd-{ZH&Jh<2JP=BU=EZdB+M#-RO&AjcYt>wgLZ0itXm?@xZ<_=q)hVf~7!B%*CvM`2C|<{g3$c&$Pq<<^|;H zpX0GE%l};26#hqtDn7@m~EPG-$4>yt%E1h}q)NzYOtgzMOq9(Xrxnyv)So*?kFJpxU%5FE>ahudA!eY17iw z#Qn6H{7}Xz5Q~W}ywk0s`yc5qUMDFG4c4FdKQH`_nO!IQf#51wwBEW7-WW@vPG@n4 zYY%a=Hv&SBT7L=F{(Wgq)`KxbMz6G^u&uDm%}>Xf{|Wbb;05}3`eDY6^rU7c>s#qv}6CvMlCl1v|~4CLdRcaBO<$>+OIh3pu- zeH&@jT2akH|F^@tgzIU6UJ}69zuBFeW)flcy3QE?KH6h2Hltq8M`IV3(ckuL|D4~3 z`%3p;V;1Q3yy{u{i7>GmFv7%hyW<%8yhQLzO=^9RE|g4?v>DV%XW1Q#qsTrh=M?Ux zj@5#7gHb^;PT#q$h4~64qdt@JZ6A{Sm-PLQP`XNu=|cdLeLuV8P^PsRKsF?`5s{ofk8x(cJ&7n#TKa=Wb5~Bt|?GynC=_gqRQ9 z4HI%0B9fpdRn;vn@kfJGz|;FSQs*}pas(rW%VhGI!!hsTDvbg+ASC!Uwln9Sv?`$I;XZnNq;M~4jyppql|s@JuC53A-Mni^}Qoc8jlU+ z!)J5VN$EVdazI2#q8IewPkw;|F3my`YNAm*WVE4!J^)<$dBc7qb7md`N`P`IF?~;hl)#C>okN+!d0oQ%ZK5j52;feiuIVfTa}>6Gp6 z4^a~j#CD%neTF0@#)<73Y1pP+&*jf`_680~A7FWjyA5!XQ^kUT*)9w4N4*}|L&A%$?E&CXO zlvr%Z`tEg5rk@kGkAh}t9wzJ;FqN6J;2<4N$=Yc9d0j0!=T99f)yVA|M~LF#fYtKA zD0+rDJFPgC(M)PDDWO^io`eUOB}PqtIoM2uD6@_Dg8o<{36WZ7^4`hAR57U{uLp4; z5`9p#q{|7tO4XX6^^(ke=t$(m3w3r)?lj*mAmFVcr-_vK3Vxsbr zV0jGdN%G)se)wVPxFr_e=5on8X z5=nb|Q-H~KhOg4|gcaUPs(4=#WN3b;ObA=Hoh7yC7zVp?zx}=Kx#1S5za@oy@1HiL zYqzEtxSAIT7Fg{i7d~7a?;wioiaeTPm{;7R)?1!TUVij8cOKhu&tPX~_FfNEl|+Y$ z7SFkGf4TrWF|Kz!ESJWcHnc4a^G(_ zkeH^B-b=K=b(ST5CLd!4*btk~zP8(N2y|ZwU++YR>t^-U^HjLMJ$br$>$50y_&-f! z*mOOS2On63K!^J9gjocBgWiPon1I~K_#j~0O*rCUIvYNS&(~*9nL!qao&|6v#1~F( zAgZmstl7|a=lXrL9wMt>_|~>W@bH%co5$dmK9GMNn0}OQC7(bMv~^fnn=G*GfsAw2 z5n|$JpuGLrQH?n_0-npF7_6^3p42kfeh46S6UK}MYQB|wbUt6XueY-9;a=+H!wKO5 z{)Y>|3-m7<}_v-SF3s2|>)`vo}Xnq2ipj}b>KEt>vgbvjpMQps*_Ig)r-;c5j6xi%fs9`Wx z8=>lVwK~Xhmt*`mL!Tp;?!VxEWSTl<9pS%+eZLL#@1Ggm5%>t|?ye2*elwzO-|rrY zPZoMTZ6j1Pus(?4SnD0D2)P2HDlRn`@K5r-Axd$uD=_wiV5~QymhP;ZUKsvzqU!cM zr=3A+0d8xkbUwnzbT3vRA*f3 zuK0a{AHOrL*c~U0kuDbk;^6s8z&ZZ-_SMlPo`$VmZ&|~K`(LZt?8y;!jzj|?&oEE< z433j84>OuFy$(pUSSkC(d^?g34!no^b;rqHLKki5M)}?R2DB;cUPw|D@w9q7TX=^J zrAn@RS+1j<40K7@?@kVG&Lw}roxgEVn6k25P;guxLQ&X%p!YpO@-})={qvuxXb6sF z$QYSrFfq`;D&R@Y{|#;J{R?xEeH!Q8;^uMB-hS~8EN1K8$>-i4?4!exRzmIdeZ;|K zu24P`25EeCAU7Y)$8jQ;By|JSDr=obwV?=mj?U72M8Ka#7B5ok9rdFk42gbhaj{UNIiD+<;AEy*EICA%8}1 zv{HE#d1`}bbG{Sk+u6siJ=EO5WpXbqYU*Jx++?-c8s{evRSrR@NJPf?{5Z>HVyAGs zT#z=;&^bIa`prJD9>&S-62CmSY_aa~Y*Aes`44JFUt*dmBd;Qvd{<=3hK39-qU5L< zfcFKfetl|QNpj$rI(=SL+BK5gJWlr$ECqh zlZuEfI{a5e8CCiqdPz*7_f}OB z)g0fr91Zxh@waPmwaMBvL)sm2qY9G!-Qd1-PR!(7}cYeRi~ z{9p`$X|*M}X%18H+{W~;OPdX!J@4juCzOPR7%GYh13Mg6TkT=Z3xdp?1?`HmL)K}_ zm8I(=*|k{{`)MpBn*9kw^QZ_SR5_ECAYQ~xm>u7}DV^p3SWD&sF-QfgFSfloSp$csm4~`I&oQGUjrH-hpv@bSOB|6>KCIb~ zpNuDH!dm97F~UEsujk!6M;w)@0A>7CZBI3An^>NABgj%e?$}w`(cO1Bj%j9Z9Bmo$ zH&d;V)NO`ZW~|8lvEni(k|O-R*5~L+=t2-RA)ElJ@#kroxvp1e?PT<)Rud%S5$sGB zZi;%Xd$qwx_W)y>u{0uV+D+s_yHlg<@MvQVCqurtIW^eL)MfS_6YHqN z<-c7I18$ZSO0=>)u&wbU4HL#^7&wI&Hc-F{{4t5SQ1(Q@?=Ms(;R6iSdKe^`1NUI(T>cm7C-IHkQ0*RI~c+@A_0k4M^~)4vWv$=2wKUO~MX z=G3s9HDSr%xFDndKpQjyA!RyhG<5TP|6JsLKRm$rUK8+lX4aZWVmLeot2=nL&n5ggr%Xo8f)L{B-;zdL6)*^|?M;u3>`y0|!+xEHjT=P*TJ6psk-x*YmYi_6Z z8h1C!Y%OIC0`oz?59@r>)pjuktRrgc&2Qn3&T9~;#xGoqgo+6;LC!u`4-<)tke=2B zs$+>@Gixp5M9r?f`Wrn~XGTl8yJiunzv6v-R4&X4m+oiK5?lA>Upz>c_1OWwp#ltY zTa7~Iq$Qu6a)zA&)9eBvIT3c8M<*Q!CiiX=4-3=?LeF4RmxY9#h(5~I-t>EqYm?u8 zAUOcvAd1D`l-wpDGud}*4SAVm1NPt<8B4!ih>9TBe1O=63V;mX_83)_(Oo3jZ)$aE zA>6`iPC&fi_J_*_Z`XQieRANeGqtPF@J`j8nd_@x7}Z&&$I}Jx!%vpFk*h|VrM~-# zqD1(t24A>9Jvze9TZa8Ab5b&P#K~q@6$Jk1j_4@frw589y}elm{QGL}%=PlVn#r_q zofjtGmx(dEQ6m(T2&U6c+H6mbi&YVL{N$jG`V{Mr6{&(39xXPmk`m8=>8>=)i{BA5 zua4Lkn`80LF;lhqew9Cd1^>3-*XoG8zlCbmH-L3M(b*4khFMeK4DU~t;r0Gdtb`|v z#nBvEV6zEEkj*L_f4xogD&KU^ zaKES&m6RpxvO!&y&5`!+j*cPdj=@ZZ93hN_X*zK$6c&Eovr>p;^pEvNKg@0F#7~(O zkza&?ST#R^cUDC%7^)3___#u2SO6b!;$l@+MP}KRX4c%lxzyFoUrB0V5RkB6<1Pql z#=p31dHGZnvIKgWqK;kA7nxfjHscrD44Lq6G(+j0GjNhu)NJVT1i7*)B&EqYIElk? zQAPRCVKh}`3340L=0j5R9S1d%D~Lj73HGN3@^vI67?EhdxxNx6qH{gFQ=bq)A zDrU%Qgf7T1IBp79v>r1gj6?+D!w~}Sitf}bzMulS;(=nMV(c^ZS&P}e8C6xF!#IE3 zHwB`+7_2m}&|EvVFCPSADCSZ1_A-!eHau`$rC~8MeIZfnJ!1;=XX}k&GDcseyNuB` zD}RFRV6&ZYiz08`g*aE9X9#GCDJ#RiAHhs-{=j5Pt1CRKDx~l4(hJ`)zCPjrVe9x! z4*!Cm?4i=}$V;f~L=-nR&c(sVRpE+B6u81RraqH2a5w9K=#hq>;f&W%6IgvWd09+P zBr@6Fu1hR&qoOd)8qr|{-K;d*)DXtLy5-IKd|J;<~uJI`Fm%*5P5gJ8?imsM_F!J2%hauzb{)wl@2Xj z1JIMGLlp`!kAl9U%y?exHK)0Mv~m#TQBqdsAKdUh$F@CWa@ucvboXeFA^z0h0L>XCe6*^7o7MG>mI@@RJ>A)Koiy#ckL!lW*E%V|E_rNzeUB4w;*SzP1X#p-zYg>|Iw zm2t5cj^K#FhV_TZM06Z4?~$m@NX`DQU?yI-Sv^wfOHKvJv*DN4yXz_X7x_G^RSMcM zMrL4|uY*3wl$K~(TRcA8Lj1NsSV~S;I*6$|!TSYlbfh%-(m<#Vtl?o~MrvH)-VG1M z)p4~T|NAR)eunSv^bo(%%Qm%WkZ9&v!Q;|)LZuuLxl%M*1#>!a z8wby+FRbegb>mS`bwjjg$0AHRg7TPpkjUJBkx8ap|&4W=_h= zjX$@bn5HbN>4ql+R(vJzC)w!um`G|qWyX3~1bIz;BhDOxy!4YH0as#@S}+`|H+A@? zamBjH1*uCy!-*S0BsptL8Ld6Cayqjk-KaUsiYor|J|3(JWa!53bD9A#b{m$;QY`A& zA(wd9NFMJ$23Ck&!ME@h4HPHqq~(_TUb$i#$mf#2$$-vl$lZQA8#E=`Zg>Q~`E;hS z(54%PBxG+16|^zFp<}GEglExIVF%%(?gKqmRrM>ETb{|lYLA< zE!rIrbi+G)7&lzf${4qc#UOp4#~CVH@jWgHkXu2!`coNZqOEjO>hs~T2dX(IQ6bb- zWWBRre~RNYYQT)xhz(xB>Zvyum=y}#yW|vaP%-@nSEtZtJS?4D|5H9d9{y^a7)>D= zh2eNk9^EK5^Mc9B&M;za^p*{~a8Y)s#qONxkL^z{{bC{T&QTQi)#3T+7u0W5G;J3LmO4a1b@P5vtOXd^>Dk+m%Q}8fEOg zVRI_^_EdQzyz{DVMCz3lWaLmx3RXVDs{Wx;yEDux9s~N$;s? zPV5?^=ON-x2I(Cr<}=0V*ReOFC;r^r4c7ES@(y`$ZZvTJg?xe?zP=``s6#{s+Luaj z!n@=JJW5%L2vm_u(LtZUTh|VvcY-d+&+;zh`+k&1V{C2BH-Z^WQfS!32Q{nvmU>!n z7u0?P^AJNy)L0;ympc!^Y;}#rEo%MaUhZ30aX`8WcOX^xM6jnDG!s|>=w)~`(b=fd zOaQ0`%yoFbis2xnS?ttj{X!|C5N1h<>`O|3&h6tP6qs>od2pf5Nc8zVn>(JBOWx$; zPp8-8t}F9fHULHER7RX?48=_W*_!=>La^=w*g1n$l!t>99xJLT|=tG5U z)aJs#iIT??{Z{+Ah zsc15(CkQUDFD5E7ThyG-hBfu%hT=9FNor=(TaEw>IQba-=E`{Coxr2BF}x86hK=mR zou`ZxU!6JNd|t7fHXE731g}~n9PV7*DspRJkkYF1=McBemsP&S|6}|;fMH(TL{4sC zog!|eg`63CSnHM8F{LX+><>^2jU%AD-?@;T$?n=4J`+Cb2+n;ctVrCyZX63IoS>FN zNnT4^X6{!Xr&!e4hi7?szPPwX*^OHQDTg#UUv&vC!wfj{VR<_?IO~~CkD)Dn-UvrJ zk66$*(EWYhXcJE+8_|AjW$wn`Sc9AP3{_GKigPBU3yVqKk~}&Z2TiM=uEIHQL15M1 zt=^wb@!&2o<41got*0yP)3_W8rNYAUjBUTDJsjy)yL=O@lg)V_9`p~*jc3PVt_MT~ z40b3`oU#W;e2|>Z?IXMG5rO`H&?m1SF~_Fwp!e!q8#ZI4loQYWwIl*lLTIY#4{{fC z%QJU*nYPc*qsQ93G^cH4lz+@VO)VNk}05VqbcZ$Pt zE<|AoDv(Jtd57`F0%8QLNF1&iUjdh+ZsqzsIUloGtGb-SrT%&2Sl-DSvpaYmET;P) z=V`~OIlEe1dv=9DE#$2~B}r^q{>fzXCU(up6tzkO1g_t4*vR)7nTyg( zDi@y8=wyxpl^BaAeMr+5UCcFJnbtNQjdCTCUV~;Z?%LH_D&~06KvC14Z!Lxwht9dI zii(TE6>^Ko1PC6O2srIoHfKHYkWsQBRbyTdSXx&O_I>l;h$Ny_NGw}^P}k1~H;|UP z;IdbQuQZv^`BRUnjYkXId2o11pO==CbQU}a4fQ47?8ZeNM&g{Z-@tVLf?cXqIrS4N z=%X|@Yr>~V6lLB%D)>I#hMdfuhI@Bjx$--VBnMzDv08OIm&UkMrQNI@F*1wZ;=)%t zQ^)*DO6L(6RK602kFX9Hh`w$lR3$*tC4uA<7avxk!NBzksEDA*4xg_3Fv4yx&*h_# z$-yUW6jkM|(5&OmQQk{uzV>#Cq!Q>cjp!~RU6Pcl3obskf*qyBbLUDGv+as61To#J zstTB=!K}}t4=8gT*IP=v&o`slS)EL-Yaj}4i8dr zLTo0S#YcZ1U9I)PwG4?9;YNcw^0rQx=d+3kRp6c#gNEWwRV7E{pB%|9dIJq1_ zu=R^dvuU#Zb@cd9qo%RNDE>zm@j}EIRC(#it5R`u8*meHBb`7>rt>Mtse3Nog2mAU z(GI?aiY-BP*(coLm0O@wd+3VQ<*8cQM2H3q<&|hTYk%+_z^fxuLqUCrH<6QH4j2{4 zg(IOFK-ZKfovltAs8nBcIBQbGTBb;D^|LESJT>(6Ngz@0#aOVd%5xn5zUXD=^jQ@U zC_r6ao_~D%qi|rW*$_K|C6lMf0jdH~%56|=%etOq%%X+5yS)6HIn&@1Fs<8v!qXD8 zcK^cEbC5q>OQtlLgf{Di_$1on>ncO|egL|cXActx;=mDJkO$6KI2tXX5r?=jmwmKq6L@=M{DGnf)mV&O?JkR)Cx^uLow7;igNn zSg(!Z)UmcbMCIP<$L zxuwyYtt_qs(b`-XAWF)2cybC<+v|?tFu_r@%e$>=M%G#~GFdcy91j?EQ3BZF_Esg1CJE2@UhkWW%PNR$ zP|0;vvw%dN8UYM((939jwGRL5s?AtqNDZWV3um&rZKm}QcxN7+$e=;7nT7gvwh(+i zkI@I)ZzRJ>Xb;sy(WqlCGQ+0v+W=myR83i@- zI5LLHYS}2~IMH{M?E_ERqSYqmfZhUc&Q@mb}dz6BW`dzq78a+>TB`<;_1P^0aW zB6DXCRR)Vl0t&|+=Iq5a#wY&V3P2J(v1DRLw@sJCpz}_0sb+@VZn%`68*6W>D)Wl3 z$JWbUji=wLVfrNQ7ZqxasUl8xTF-2UpcG)$-d1jCKOusaT5n58Tl#S#yB-h);kQq{ zdxP(r4-ROl(OJFp?Qijp$%oB*4kL3Kz13%LfHy3JKqYazM!u?Bk6iIf(T*5WpYNpP zg3*`8T3c&K2nAZE_k-M_Afn*B00*be0rVpM@v}F+dk%d%{^4zgJQ|UNakce5Z-lo z0aRlb>00iCsP!y94tnvM{XsETFsH6}*O6joehtOoh@V3V97Uj+vF9nRpWg|~{R^Ob zgS1&LuKxyLzmHL|#X%Y$b0D%+mx*V@{>j;D@yN>+Fb)dHlYz{}NAE#9xEA6AljA-Z zttlZMW4B6=9x_$+(B(>d{OB6TU!)b9v7CAqvA=R|NQ>w6&tRb2tx~l$Cg}oy0pG&K z4Xvb%_Bv%hy^mg?KyP1P!Iu7sj$JVyK2M()))mTQvUj}@*iui`FWA2PDdV%C$IUE^*Ilie<m+!YWN^FCJ4 zxVek&TbiB0Jf;lAO@$CLG5Tu`H_%>HtIJ&$2-!aquuv%TmMXJq;8fAEGuD{UWJTi6 z)UveQm6oF?40@~mgJ4`4NlXboTyG}8k1FhCG6y$p2xCN>^;%rV3695dX-s23uG@L} ztuZtNFs)YX=-W&&VBXo;eLF+l<+_4vY7o5p-E6ujvvX@HtJ9JI?Vnq%JDm;jCT?Md zY`}!MkT|Ph3(qJ}?K_rt$jjB~0aBbcb3_JxrP0vJMd*bmm?5Oj7@MKae&>*_UY$%x zh$mXY0WTo6dwe(lkE@%(3N0((TFYZmdIw(KsKub^i02{CpoQyT7E}qMeIi<$pQE#a z8%tO*&13zWPP!*Y!^ZU1&SpdzOUc)quR&76UI!25ExQUUm3#FtV9+khgB!N0g1brz ze~wFE?O84WZGj^3k;F7++K_hZii<3BL)cnBjjY&t>K(sZ(=A(Rzw_-&ofGF5`Cq?T zy1%_^@lTH|Su+##f~7vS@QAlNQDg3RjwYz;2KIiJyA9=O^$>rM5J7Jn;|hYTNhQ*9 zc4vpv{T+Nko89R4i{)k?yU@)wtFVy&QI*0$Vs~mX` zx&xd`y^S_s9BK_wn+4e9#tS5OMmC1}VE2da)61h;z z^AXi@Z6G=>TO>9g^2xSHN2?t_e|?sun$Jo3zg&R!Y=1=?BZUjWAsRorDl{bwU>rMg zcf+IR#|6G`l@rm`4lY*83;5(FGkR8UQmxNytEm-Ivsd84nK%k%GP|^Q%~m$< zpAn4@1ZACuR?eo#qzm5B@IF|J&gfWsRr|5wY^+EP$k#jaXdlKLTpP8ZmL?RoEoPhU zJOTa^Zqi>lMG5eD+Bd8u{eGz&7}T znQu1WVE8Gz^Kd(>TchG2Vy+&YH*?uqQCN0yYzPVNp?rC2{Rs@o9YwBKXfwUpZum~Y z2PU=vQVCP8N znJV!#q5qnb0PTk&w4|`0;TrE`2%vKQ9`I6 z9IKRuI$!xjOgt5nds*7q9XZ_fi_rPE7NvMaLo!lMcsWdjDZ%@Nz{KTK%3wW@J2|2$ z=<=$t@OPCu8_8Rhvf(nfBRjE#OpP4VFdaQt9-#FJ@YmfV(K?gxryD9auJ2z=Syp76~MsR9l=Yd zS2%LI)y85}VYK)eLEgg)M+h5AAf|~)nTZ9eO5?l{XVujH%otv6$O*u}h7pJlDMqnM z6l|JS`YGCWDq_{j!7XS`1Ki5f($FS8!ak8SRL39O!V2KK)hpZGdM8n8p=@>k6_=Rq z7lS;m%!MZ{(8a4)&5)lj6yf^=>zv!Hj6N4fApZ+*>?vJh@|@lSJn_s!rCfnmrc3z4 z1yTE8q?{7rb3cTgm#u^2cc!GfEnH;(km|GzL(OYQJwJFm*f(HRjXNWZ|DFI~zXj!2xRgsyMyyYvIpsXSy7Z`$G7II(Kd$f|q zdT+fn5PV3H4yEi`wDYEvlD~K22#S{?1xKG$&4_OFX6-JPV+ki<$Kg2~ONP!!8Ve!U z*WB>-NXqD7EVn7A-f{EhKQl9q+Gl5+L{L`8!9+$5c6P>kWB+2!IHRoY>VG)?j)VkL zEAPC^xNLlK%@qefl9i zzkyB|hYSx_<*!3>*L?N3ml#}JR;r+;Q$nB9gAV&sGG;%ck|ie;5q)?Gt(Db2yP+Ur zFT=9Y%kBn6f?C#Tqb6o}H@*7vj!cuhgpNx3jveF;m=ub5F4NG=s=_m_3xq}b#>rFF4-`aI z4C^}gcTmObDe*p+(DN!_KfOg!UZjFg-(=a?+23DNWP8WPm^_pJ2B6y?ECZ>!1%`Ao z*0vXKRh~AvbjRLIlX}}ZI{jZ$#M<8Cw{kvy|3wYPJ7^4``Ya9!r3eUMfhmUe-u$*hlo?k=-h?mA2emjyCv8Z~Pofd3M&S`JolCI(^zthPY0QxN5%3spAf z#~d26&%a-0P0W9vBS;{0aBxsJb75=@?teL?Wg`E#I~%wVC)oeXv$li$Z{qx?s~mi2 z%V+=E=~Psff1fd{TRrP`{`v0}4SlfEsG{o5_u zEu<1C@z335SbsCP51M*FayEbe4;B1%B$Vs_GTlET1N;ut{`RcQDIf~m_g|lp^^A!Cs53$o zeVxB%5-0FO$lwAAJlKr;%&cwS{y%}fWVOSP;6y%tn~vP*dt0lPzX;zwj^5pgDzq0e zE96#QqNoH{XP#byA8IMS5YQ)T#Bk9@vz4D6!S>r6A}|c89p(B zFY!BX?$`T;4J};_JsP?{Ox$Vo<6s^$8rKDsR?4U=d(Y3rYGYRIs}R_6B*)B>yr5z4 z`n43rf30V<>eYPcA59{aD~P@K3bSsP{doFtiNUtegb-tHD07U`*HhpOzA1kimOjb@ z+nrapLx?U=6{e(L=T|kape}Ay7c(=WEVgM^&#NkrjjU9ljSn(4lJgLABTVU*R#ry9 zNg#YL2KtgD?bqYg$0W}dvut56C-83*WaVgBz;b%EhGKNm{N#f|*>=~uzK0#vjC_24 z(mSo6JiGfndWJyvmj`>d{D$@o?dy)37B*^+ewDE~i-{ zj95_+G8z17Vde1!)guAz@Lm)1$n`(QH=lJnO)M%#%Pi}1iJd>>XSVjyf5diE1Sf3Z z8o%Fd{6xfPuDzP(E{={c7&P-8t~4AiaR-4v#vbmQ^#D<^@!f_-k5Zw>#+J1IIU9Bq zt-3OrnKbaZt8qs^``kr~SR0d^%$$TpT<(`?0`1NeAagx+hEfa*39T_`Vmh*gbVNK; zcq@5tUHFkUl0z@-Pk8UM5_UPNhDKa1Qo|Yn0*&AvM?5Vh&DuNr3DzgJl}&CO5sT=| zM>W$Fkcw7MwB9D5&X|*1wyL-M)z=zB%}6>XE$UF5 ze0Q#>)*+Fvhu1IN))n`}%?$6bZv$69p4vaW0vvl6`p@?WuaE0x#KA6z`RBwfB~Y{L z>K@zPy{VUE^`f&@T6=k ztBrepRusm&m{8YaHP#iOo!OJ-e1|Y7<79&4YT5K+I|(_ zcJEfjuq!Uu3{p5?EecHWrRFcZ4XYCRj05tyHO3)%Ut$g}TxCf%6vd?GMK{u4xUt!& z&pg1q=~E}xSsVSn@b1%EGuOPe0u*n?{gvqBhgT&ZZ=kC~Y>wHP_ zF{m|c%4uV1AKNbJDAikW8Bkp3m}-=(-C;=l9toM$d{w<~ZAZzg(09zSZ*N-rwB!AY zi-b+#vlkJ2>Pu-#?7!a650X8edV->VUGJ|K7sFwEt+hby~}oRC`!u zs_tG0(_lgB)RXjjvOoo%23RaTKKi*@p?)(D=haM1*pLxPWJQd$=?WJn?OZ-xppVau_8P9wX6D?5dsVfVK= z)8m)K=4(k6T&Wx!ke+xMV=JC7Ny==9PP_Kk&Mr^U zLnAFGkBt<=R)zRk1@JN$UT?Q+4}XNHajMqA*t(f=Hhj0kHcB3+4#S0NgbKKp`{G~< zghE6~h(K|o5IgUEZ@0- zIFI0%X$^D}u8v=F>?tPQOVj7gk3qf+Ta8&*?Y zFbbSx(__N7v4!sWWh`U{W>Ck{%s=X!Y(r8SU&WY19 z@nj=Le>J;4#nYfNu~(^nNw~nS+l%_i4Ie7Y=B;YNdv-y-@ajrFwV+AS zu|JKVgX-Q*dT36tJ89_PBtI-1nJ+iVuYN~rxpN8G|Ni=Lb@24M3i=8>R=Xe96%;*` z-tgRWI2FUVzMLhzI?LUVmU79KkB8qEr1yCT8ypbsyLW%xEE!wovY-TlAzmLakkPANBm<#7#LZ7{HL-kTc2zZ*trHu)O)vhOpp@|dkPJrr>bW~p9#>8)bhG;O*P z1dxDue)>Pvvyd}S!`qJBEQkZag&$hvj6!}G~A~U|X(tLrJ=VDU=A+l!06%;!=$-q0675Wu~E^PZ;+Ufon8tJ_B$^7cZZv1CG zeJ25CL3FyqQtImP6u&6&t7|UbX4aF&~Qlm2i(i`M0IEIL<2coSm zln){*NQ?~mxCpBJ$^MEvx={`0cw3Z?0E-RZJ7tBl-Uq!sV%09491*)JYNwd4?1kRYnX)y&a4el}x5dIff^c+~hzSeC(GZbG^(9M zi^PM;O3C)siT&Dltp`A|x70`vP9AOa>i3mZt#o)auc*SP&%;!7r`j6C67dM}Wjc9qD5ro~{VHzGcQ?b3Uz@a_n8I`{Bt}chK&PS7tF- z{Xk?sr3N{~>CrrVmsYvj8dDDm(>=^88Z9%3TROP`D8?5vpE3 zjzB>rhYI285Z8ITOE{dXK{z}tHH4z}JHmF+WNJTYJT&5SMSd+6U`;Ip!9!_=JFeV^ zuiUoFgnG$en>F5{q3{gpR~5RByD*Ex9LK7Q%Upk>fQ_Zz9Nfae{Sv`rWGj^~82C8d^QRr1hpOq?CG(0+vT z)2@v3$82hz(t*+rmlgK|XE- z<}&0^VzKVTuga-8fG%o?yWCmjd0B&w)fHx1d1hxYVpA1M?B-VV$qU(8q zl>)6kekT(e?!bWiZR@Rm@Se4P+5AG9;0#4DF&`k5I31UDR%f#@d0fr?ean( zt_~oeU7#Q_XQZIE2;wHMt`M|XtC@=07BgY3!X2Z+5$i;a1Lg;n?O)xhhNgthO(Gbc zHu}o_O0m|HnHpu((g@_t*MgSC7O@l4A)>lD5S_QMAKk*s&3sCCnLWd3AaameiGKzMj*Jqei8*I39Y-c3n^HS@a1VJb zIO}kFXp*+UP@kNJe9DJ{k?nl6zyX2UG**nIIU;`Y z`y4?Yq?6oDgf^B(9!O=m@Qz56t*8sM*)A^|r)Iq zF;m-zGR8dq;n*VRe0JD^n~=>LF)rS)oM~t@4`C_ZIxqDieO8nYYm@zr~eZt zAK2jho&rgOo4JG?89w~u$*}~tyDy8QWZU~J{HhSGAG8-W5$Q6JqSA6|+iKuQCfP9qy9HBhH5q*T!F)DX zN_d#f7!K9olbT3W)_h)jcQ>t`CS3JUv1K1EK6ChMtcHvgZ}ZWHCcFm5;T!8o@49rJ znYWM7iAfkrOQ|j0!0zUDX3v^Hj9bT3qDtAWPnr99KA!RYacMiiksmUs7#2WfX(2~5 zj`GdELLU3qz4Y=ZVeNa*(Qw(PJUCG$Z_U@dzHA#!S_9tgWt6xLz(007uRr`L?IU`l zx<=8jZxRRAywB^4EAS4|VQaInE+ZGsJ$EtCw}JH^eZiu_YTT@D_~gh$j7=medo}OQ zT||z}3zN5=hLRl=`rpq@(e0EL7tvhXMnTp=aw9!xJX%g|dmU{@GRW)Ii=ipUs!Daa z8+hxz&&gLzn5yf^s&XST(VMn!Ugq`XwcX02z56Z(1XZ&3jpx{`i6%TyrlzEn&HFML z>fcJv;XE=jR*-9alm{lIapv(96?0Ang`trIIh)wEfnmhf+9|1P0s<)7y`1mMja+td zGU@xw{PdaC%Kq(ng!m7}RRe~Q5nOZY2*_E+R~wYmxaQUIxNA9SEHRqBk_rgP$$G4yEq@c~4nBf;QDcPHfo%4BSK`l2v{~nje zb*a(R=W(dK7_Uk3xK{5Z%izz%C|5^4+s%_WjSojFn#kC{oJT)u=7s0yG014);QG(l zoM}g~YnXEBRSXVu0mTzf?FO<7+87e!268Jcg?ZSlHf(U71XH{jboG4FM^llQ`XM0V2aL-F<0Kt7|L1t-}PYX$hVcu{3`k-D6CuX zAr&nuk^RRqZg4buYN;tKV_W8%kQYiw>>wtNPd%3OBrMsx$<`>04e>)lN8d|srZ0_b z_|J}x@DBi{{^PlE*xP*f)I01CZ=+t@hw;;g;NSIl*7?$Z#&z_kfz>-#Vn4-L6Sd?Z zI~rvAr-Y(I!BU;e_N|$`?r|8m;66;5IE*0UNs|i4v9}hoW94f0*DKf>;<)ni3rIRk zk3h#eTAG7jM1Mk@C!lX&JZ<^{%Bz|o((k7epQ+X|@{2W1%@LdvZW z@H_AA_={QUDX+BAoDkmG<108Yl7QS?vSpcY5k>$+FhvlAKM{>ikKrT_MJ`4?y3-i4 z(QcKgDF@#WxFXhzd%iAY;%I+o&_JfPS?e5zW8kgnvAnXY{)BYD)RJm5b7l^347VvY zlUM0@SI>#%_;r4IyN;7tN4sh`G4PV?PV=T}>cG)6CB2^hy<^Wp=}tk?pjBl|-Vt1K z-~HTIy_{R8Kf=1dzRu!j@58+P9qxK%2U+IP^w%3Pxw+z^*FfoJ-v7Fei|5W`as-%j zzT)8>ORz{9Y%PcR>b?C${{1EHO!I-dT|A%tDAl%O4WE+Eh}2fhH_O-1I_PfRyfzW2 z<)a6mV`p9(X-C)a{h=Ukd*?xV0*%Z6#S`21Gc>9np5fz|^GP3~fV@xs#;b?+P&qn+ zAHQ3Ra^-yHO$i6Nj`|jF2K7|Q+PjGXk3Yyn->%1LGyA??z_z+UJTiAWv4FX>keb#^ zKKpVbhB0$^;f6FMVB@QI@Zo|VnefC&TnsAh0RwsLk-Lc1LFL*E%;*RoGLw5phC|)= zJUDwf>r?vDV`NC@gM!Xz#NO=3uv=zxWpop7PM^X%oBqmY3tuF>;yY$Pvx1%3jr1C5 z#Kp}6lSxlo*;bZ*y_J9~9_7UeAz&>gx6&7VvyFDwK>GjnAKcv6gp%_$w=d6O6%BG5Ch7153Kpy82ZG+jO=o_s+6(*{ZFavaSN~CH4pqp4hdI z+A)0yGo5+Mout#ERb)pnK>}nM85Nz*fZCSNl0}7t-gH018yB*B_fO?yBlGJQS$;Hz z$(IenvrA*G)qcXvQ76$(`qFusNS)M0-eG`69(aOl6fdpi`;!)E31sTaX(pQo|przl-C_#dqyDv z|921ZDb|oiHUIz@?MXyIRFjxBvz=tWu4O1^+58X4a82Q!{y|W$qCr8icSL6t?23$H zGZPSZ5w}dW65*wF%$rhOOkuu+Z>T>_YCWx1FoyTz;>*`C|EVXb=^22BOC5(BH6&}# z!&X_Vm2MpcBrRHv@TXuj>S!$3 z$+}g3R0k+19Z!^!26OHfjy8qS`zKqUv?NEFnDfT&&Yl|=q@-l;L93@#Ia8c_WTb_e)$6>%}$m_wl@0CN$8EKyPQwD9qHY98Aob$!M#%sDXLCAL5PQ!}ZtT4*oGA@C7eaxF7?C6?+KWew2vDa#I zVv_SM3wA7KBjNEQxn!hsXoznbqa#;SRMm)$W5E=g*+S&V!K8&40WV@M=uLn3(S!r& zeF$|4psuYIkdV+|(6>^Nl}^1jma9fOBZ-CxVk4mHutbPoEU8hBcItx6bmX2Rxv-Bj zYNrWcaAE?52hypYK9b2(d+_CJ5A#ey9GBg4BdIMr*xTmGph;usIHN*R`_r4R$trAZ6Lg^Bc)>Wx!L^#v;JC>jZ= zvqCMQHMya)s)R>hKuYJ3CJ#nTf1DB1p?3GXJofCT*t{Z`Iv|i?)9$6E_A7SQw%{8S zOjx`xdaZPx^h)^&s)C|ONLuMwkXYl2o2wR=)9Q_(VzpJ#=6)4V|8pFkSlRgEgM7Yx z1EZ6!CS}5Pq&P=@6s>rHe=Pri9|u0mxQOmiw8o58eE9KdYGbEz{j`e-`k7nUk@au$ z>6Qfk`O?#b1DPK`#cRvk@s7WdRPWQP=Czk^=Hu6wa@1=qcTSt?d@GfNZ`vh1kah_G z*36H&`_YxG?c0}W1A;`Q>1XIYlbAgFX(pqRz36eC{$Mdm&}~eJI{OomtBQiAOXNh7 zw0L^B;9@w-Lwp=7JK;RhNN$)+CX9dNiHTJe1r@c+{Ya}fp!fE`RZN(|!NZOo;^Mj> z2*MvKB;=O0?`n-+dBE#?K<7{c1reT=~HK; zugvL?kW>ZP>YVgOZ@}H(6Hn)ZmSUH&OB#-!S60$$(ZI2B_U*0Ix3|zLY0yeqwB2U* zY@?yRl~(VrEix*Ks^a19j<1_HE-oM|3O&c(La#nv@S`5L06%;jAE3kx&)wz=&L_@E082PDz+-ewKhAp zTU9%jYS0II;j5{4ey(D***d$;J7P@RwJPvH*Q`6WW`R$)C-a%p{i<^?a<@q?}2xg6^j(a&>L>SYWRw6 zxx4xD6(0~efkupks6~%rAhE?w6qfb^)5vB6X6H90)Pba&` zO3~Yq%(-SVaUH!g%r$IW^D*CKxiIOrI~kvFh7}o0IUBxS%F1jHrrdKgW8<8^vB7}1 z-9STIM>tWUv?dR)kYoZ*c7S&5Jg*S?goP3Bj03vI3?RO74f$ZpdNjYu}LVo5uCGTtiC7@B))7?sfm)-kpa>QRWF8|5l&5 z@4Itf5J0w>8n$2N%}ojU1W7xU%=@FOR+$C%hgOlC8JQbpwl5J;Udo1}vE9Bb$vkYI}5!PbD}mjKr`=rZ0V(<;$O8#j?dba!)pXtq0k$(a7YVKg+W#o@V~2ShQvlOJ6f( zg;gZnxrCQqTSSWaI2%gZK?jnk#>2-SfY#$1_;~duP6-K&9M((zS35XcL8tHZ30i%J z5@)Pq=Z?~I0h5xwJ84KsBS9@AT@*M_q0#iy)_#QYQ?8}0HCx!+DUg~JjHP%BEB~HH z8-jZ#jPsmM2M*`uDt0)KBp)IYQgHMXu{p2V^|s|Cm31bplIo&#?5IJR=*su9t+?0q zhS)fl&+d@;Pj@YCLJov)P%*%}-EGmkyKrg&J zeFzH)K(9H;&NZvpS>8?i$vn1iHZuL^%da4i;yMVn-eSI7`45WPpsVx?wier%^Zc^& zffRti1ajiFG#vPv(@sFF=Bv&1Bt*r3N8m_LWJ)X+({}dOy25o`<$06`=}7gy!cLD* z0z-nEs5nrF5r9^Tj+POV7L8E7m31Gkr=}Mg53FOGC5fk(UJytDh{z@7Il=iFv?f3Tg?-s$9Crm*)7 zMH@}_SZ~Vq=TqYZI8DKx0|=Qz2(r|%arMV+s%ZO;x;(yQB*t^-+%>3=%7fiB`y~?P z(?(Tw>$xRs_vTY(8b)TEmiFS$SoOsYTDy8Uykjl(sSjRpAO&D>WIT0y%5h)1Iku~a z_O3{x!#mmk{z|?+-1V((762S33U{t&zkUj@JoSx0ip@sD@hZ;V-FgpgrOfFdH74@L z&q5ktc1r_A`4z6~DA2rr8#QfC21Q-t`Xz43p2JeK4%pVsCUIApJtYP)bE2y5gkh^-f^Z8l`yJsf1-M@(Jw|~d$OA7F|=?FCB z@W4y+cxc{K-dgnziwkEY&=@YhSh3!k5QMA>=vwAcT_=^uv)ALk`r)ZxAf89FX9vp#Oc{P8ti1_$82%P*N;|7Ni5bzU9-dxKsAK8mONKd~Qz@&vwkn91HWXEE)BD&83 z&wvaPVn5-(UU;2Ti>BgL_!%2c31rV4&XmOqD1ZAuS@KL2`Zj^+JLj`-{sf+$d4xCL zdFi6|ES;8wj#{i%3pVlW`Q_TDXJ^%MN>=);_NxxA=wnAP_or#R{nj!T`|1$%QOv$? z7Afg53`;-%JM75opjTA$(A->N^m(ja_Z|e?MS`J)ru=-?zV zC9ghIjE|3#z>I|~7!!NJB~?bU^yTd%@5;ck}Po`A-7&knfmc}C#o&Gb=Rrn$c zGLqd++Vp35bb2b@u8ksDtyqxGWfvt+d4l44>($%)Jk@gc66cjh|!n0rFkYyZ_L`3c*EW2wcCwBjpRjUL-B`aoh zjG6T_vTw|T{r^fOL&=xF<}V+GvB&uR%ggxG(}B)! zD6^MNA!-0d`G60@=PqRU@8958Pi?_d4Z&%1cw&6aO`etDLBf=~nbznz7QB@?MOsc*(xNgjJT3^NUTSMP&_)=D3G_fTH*vDkL}=ze(7U{W$Mo`Gm}-WZZXFf|;bP7EU} zF$}QNP+CA?O$Ta~3XML7tUI%a(t_A^f`Z+pw7bU~#|*oZ>;!K*YV$cz+KlK7B`QXT zSEPZIuoz6WyEs_ciBQ$|5Vk#L3e#hK#`k>%rPo#J=KM zdaRy=CS))=I}R@-8jl{J_(UsqttXKg6B(E23)pEtQA3v_gt$TBcp%ZR`F-B{*u<27 zO~ZPk7r{S;aTA6SricE9D$3gR3>_Jd&|FS^j~CG?@%U;SbT(Adrj8*k$`5Q^RM)hj zii{^Y*g?aw3dFEX62o+WnX1Bllr>n;=tIaHKL&%YlT#HYLNW#seD2Axkz;%EscAPO zd4-TMdLn~ER3I6tK6HqR#%`Qmfegx-#E@Xub7Es%F$G1n7}Z+*W3#zE%YYhinwu$W z=poFIOr)P{FhdUnU zGxa64NFj+N7<_Q{chb;w2G6Jr!o9)LR>QGw9qEa&cwY6>I}_FW_E6f=PiX2m#tt)F zGNh!xy_(Z)0+A^x1n9asSyTftnHW6VIey?6O%@w6t}GovV_?LTk;Hnso}oES&6G9v z5N1dr(ochAJwr`N3w}dK5@N5T^vH3}m>swZlFI0O3=A7PnrI*BYbfJDK_y0yFtR4) z5_i#983$c;rL;N?BqW5LpUp@zax8xvm2IGp%VOrJ_{(=foJQ))tB}G+kQjRYnP1=O zBK8;8VpRK)nsW!4VH*0|s;O=ki5@%@kM>fE%TLkOFCz%x5N-HIXOcZ~Fo8N~FWbw3 zs%BKdNsO78O{g0BS}Hl-A&{1mg4}k5yyAN74hN3FBqod&$;2^(xb}loZY=vBdXlOS-$hR#c1%RyGnYHRSbOn8vXiFrofOxY zkQ`1tV$zv7deC>y-gG(Q?$;6X-bCdYh-9~7iJna8BOhP7pskg{-3O@e(Gfc$hcT%? zd}y(3-+;sPFbDyFh}9N?SJ+Ne>d;G;?QcB9zM?w%bm0semrK%3keqfU99<_VIB9Ezi8Wkks#A zL7`A66t|Eo3Z`5`R~$^a27X8|MRD`F7QvL8C$ywcC=?2X;s=uf*&$*3XE#KlP$(1% zh2jRH)J#z*6bgmnmZc_Q;{E(G^P(Ap6$*typ-?Ck-$MzeC=?2XLUGFy(D?-ueT$6! zRwxt-#Sf!ZsnFo+G&%vz08fjn)u<8Fpi&E{)Zowz-1Y>W28|9}Q<4ejoB}HKfK;(n z+@zFXibA1KC=?2XLZMJ7F5%Sc5d8cQ@I^oX5B>MA^dpF}22taSO6`rL(I5%~w>{Yo z4$&6`Z$QE>d82WNsN8d5i$>!m>uCM1kEaiEzxk5)1ic5SuaoY*^o@Nds6l--C5f+Z Z{|E23?RdIM*^U4J002ovPDHLkV1fax^0)v1 literal 70885 zcmcG0WmJ@H)b5xlX@Lj=1|cm{0uqXXNJ%${NW;+5p(q%HBHc*mNH?e`C@^%VbTbk& zG@SkD`+nbd);a52XPtEpKi(IandiBmeebxgYwvqrKU9z=Bc>rnp-^Np_wOpBP)Aiz zsKfFnj>BK}t_e$^P?u0LcWvrS!4h}?em#P_Kx7aDqIZEtDzN;lx{c+qR z?U~EvIIIwpqcw5(pkvNA%r-g&R}=oI+C4k!LzwvE%PD&gXNk-jR(roSA6C9Em;O;9 z1iRth)XK1kpRc;<&oJ{_2i@EBvPl?|(7Gnv5Z7CtFtfI@-i8Y@(9j{Q`-Gzp!IH9~ zZrXi(y4cs=ft8?jNUpL$ht3@OT)xnYaUbgH2!waQkD2TVcnIW2S0eK8pI?4GkI|_> zE&xBvvqR;Dexw&Z`uL!nmWTRxKcu`p&mHZ}q7d6QR_E`uzq=(R#BGS!1g^y^>@=UU zvs|et=|}n=gRu!5#LsujR=eRt7+?DPTTVAe!5c!!>2GD|RX&|tooYgtKD&PG&u5F= zN=LmarGhSIDkV!rU4EVIwy~T$Qti&p$EV8RwV6a%9?r(pY&T9#oJ#xi0Uvei&EI2h z-o8~ySBRsTazQ@+`0-;$T=fQXGU1;rxA5?{189mKDrYR7w@WcwyFO8 zm1Mg?d|zosOfHc0&r-C*aGp5#?fzD;p2^#9s=+Rn^#K=F*Vl6#biSVZ^Om+Oxyb9c zH-?=J3KN{0BYE(`Hr4)Hx{7l+glP;$=PlE!UH)u ztB?s(V`Kig6{XTopRVgwyQ#f=`I2+^kLk*ihMao!=DV{aWOo8C3Mu#I>2)p-SH>M@ z(!l66o1NJj+{5rzh2G-9>r5ORa=jRX-b|Hri=p}x+#Q{rmZHZEau!(N z1%Vj(^IW=Z_=R3h?~E7>1_Q6EX=={e?s4gswRK>RfO&k5pFDBG)-@qduX6s|>$6U1 z=kaeR5%WwpOi+LNw4|W0P)$`eWp#Bm9IanHH8a!H z*{SmE*|YGe*RNkgxTt=>(?kn9Wr^*rtH>va>BWgS_tbdqgvQ0?4h`v2Qd08&6pA}Z zLelyEs&r^rShv;8QHaD0up?sMAMdYD7hIJNy2ipHZD?r7*>?lw=e4&jW@i{zQEcNmpI9aw6a1yFPI7N&!&!4AuP$_P(MqPHFW-o+ z=fWXbJG*>Fp(VRh=gxs)?X8C^icjkF6PTEpvn2h=g&k+#J&={vsSvV$1N#>5z3(d1 zv9~d*h+#o}CgbGcX*axYYiO8+_{^e=RjWy%5b4X}gXHDd3DX6ERHfF+CV z>=DcEzTSOIs$V^BwASF>y?YPt-+u@JIX*sq?)>@mjErkcjEor>8TWTKa5nEt_|t4^ zwxk@Uo9!$OyuH1@*Vk8gF8B3miXQB)4HTJw5U?Idx%ZZ;{1z=q8>E_ujdF-$#%{|r zdLvpR2928{UX|o3$|@>qT3U0Cy5Xlk?T%4+zfsnVS!Nz`%>nj2B8elMp{9q5;ND;oaN1@LW#wU97TXf%6T5=<8X|#(Z8$`8a}EneEu~ z)V$^b<0g(7A@IC7Yu@Q80;Dk~5%-#!n#RV)0$uJH>~s-rTE4aX(hafZI6WKFg~bT@ zIN@%qI#>eJPkY`+R+i1aHEwu|LbAEJx#FH79%3rm2B&Gk+O0syN*~E+1+IyU*T!pL z9%ySvPeor8vi~;5+!3}h0|8kKpOaAr3wF|~nBs>oiDF$f6> zJ&=)6f(?dzJUKRY8Dh)2zu?~O+qZ>Xem}}hhzdDJLu0XAYJ#PaxxqjynZLHSHZ?Yu z^y0;fX%}t5fEO>0t_l13`^#p{^H_4c4GIz{t%m1T$LL#^6X@ybu_MzEqu?q~5t^z- zxj8w*Ad^9c!!m3gK71HL%y@*NSUOmIzf1r;)OpwKiph)yK! z$B+AaQ{3J>-sh~iq}@^u-+g}pZExa}(x1c6# zxo<3osq%kEtX5D^z`-C!kQ5H!PK}R`-^OFSbD>@fU+nGe)o>>)z7Gx#e)Hx{^N7Ha zXgn$nZ_$Yq=PHr3lsKodX@rby2>3)oA^(Vk#!H+)aE`rLKMy5MQHUNt?@(x zjxiIK=~R-<1@!{I1u z=%$rG4CF43gcZNZ$tO%KEbN?|*edCd8nz3@h5e2zr>xtREZ>C8a}g!g|Q@ot#Q}yg}^n}lNt8zdv33{M;Lg`ImU>2ZvPk@)JgDI zeXTQNOO;l%5YHMC8WF)F6V7D^Syl};O7-ExOEPTNuGwBwwd@LXnT|4@cZ%0Rm*1=N zBjdGvNlGgq2Z{VmKtPdIsmGSRj2gexm8(~=71VZib_$mEDQRhq4Gq$kJvmB{WmBnS zpfG_Yn(2>oSFeYpE)iN&tEzPAgdIQajvJlpL$Cys3?yd_C<9Zss@*s8digi8HeSh) zZJ|h2x7^9i%*>nz>{!Qt|G@)ge{wpG+n=FWV`pr-PQQkrJE**TM^aJ^mJPXphJ<8h zW(KOr04bG#&4^V=Qc+Qt2Tm2I^dT}bgG;Z%Y=^K^T=HdbaB%8yA=E|UlPB%UnCsoq zBUP^CJ6$t-7wG7$M_yeN_Zk}NDeKp)@hIoguQC%-Ff+>l*P=Xi>eo6y1HVP+R<^ps z$fH9j?O@1-uul@n(!m10q2IpU^}l@iWR1*~ek)Rge1`DH%^{}Z zMc@0IUAz4Y`Zner1>6ns^l{z(O#M~@O)J&{F%YhFetl&fy}(-k z3}G6maxH`>?Jl;|So3F1o+q-JH6%Fy-ek<};d5b&p8Pg_%uzhqq--OQHt)=Kco z%~7m<>RLN(;&Ew^h*S#mq1dwb!FI{U>pddh+S*zuH1m2#p1_`mTL*Fv5DwKtX@Nbw z1hwb)+oqmeono6&G5-lEDXFZSoM!XZmw+oEIYd`mz{3KXnru75bnV)Y-H_eibrdm8 z2x@L@d{791ZvVD(jXsGvL|0I;YM{p3kXr{%lo=&XW*8xG;A z0HX>8@2fa=SG%lygl(i%o%z1`E>FzM3F>voJo!X`K2M$t;HB6a7PvR0iCA*W?ADz^ zfqM6isR)CoW%~8g3Qgu-p4ZRloyl#lEY7=JzZ@xO6K{O8 z@g>Q5K95b?rW-q-u0rN9ye117TC1-JYDTydpvK0Q76I`Ma5k{Tqkd+{GMDcXpE&WU zC^;kJM}fTFl9_@^nw*lWt84abcYCgmAdoH{FH&q{qw>b`FuzsbbpWtx!(Q}MlamXWZi!p4trf5v zznhwp0`T%74-e1w_5udKyVh#iou%fsH5I`R2~R%$RzE5E_680!*O@M|XrQE&^u?Em zots;cm6dh+6b9UvjE3+2TPjXv7Z;?2W&k8(WoDKVbz8sg?$5}?lvz;Fu_|f-kda2* zs|xO$4fJJg?;cPfdE>X6oDs;5v5^n?@Bx99*SlDNn?UGUhCHu=d;#Rf z&TTJ1BH2wbYP(9@(x}S$Jh%R$ZA(bV85uQ6uPj*wg{O1nhfrt^fQZOdWfO>SwFfo8 z{rYFE^A8G2opJievPjNzIcl0jf?1|p6KsT}pu`B>?TtVEmAcyG?Af#6(}}RpO;5qE zrmvrsbagGCis<3D?9ue1&djERN5QINQh=x`_@|b>0Nw%2YpzpKoIe6M=mYVspNh>p zn6|cu2qV=!0AdU-hxsD;own}R7his(dQ!^s=h<0VWtfiO`5V%>fAk z2x@wIg4e(pbwdzc=TNzWnyzlnR8vH@PAM9x2*ppAv?2b?A&N|HjyLBUHSoa&Wz^~% z0n*uc`Il{sxPuhp3h$X)X<+CrcbI8*xFGqNj72d%w6wG|CF@Z#z@G|S%?{M<^zre> z4ky|$-g}mit-Cx%AYh|~9MX=H(L9+8R8pw~F4#=t0a33eCFPfr6))|*JHZeZ8u}!U z_c?Lq{K!_E^N5nZemwHNB|s9Cr%xwA?uZsIXpIxmC@(LM=C=&*v@Ch_}eF0NHwNH5p_9>a5*cvOyR`DG6EWQvfk&94$S49=)jB zEPS{E5OSVw`9}zz*{?52DxNMyS5;TzCm0U;QibE4igQQ!Rn)~bH_m6(_i^JTd)XHR z5Sis1C8aUzL*r2r#=lH?nkb^({i>i~snXzB&cZ|M`8B4}3P?C+fH0#$tU{137&i+D zQ)+7J_H1%+^W6c62k{y{V3@!r{v-r!OnO<_O<=cWw_@v0s3CD|8t*E#HjV9s7z#~D zun}X~iN46slNV8lF3o+7HBkYmDzyK!zrc9DElD!h$e9eB$HYa|01(YXa5Sxh6d`KN zOHXX%yai3|36xpw$K+(E?RE1ALVvAyZRh1|GUL&h@h0wC$AP-9n{oon9}vFKbCnmi zQ-_|m&St5$Nb2rgV0u5sHtQ!?Rnj64^i*yd9_7MYOFP)%Yf@Re`JW_;@!l;?5ptL| zTc2&8?=MWBlFkGx%_EwLRVD0C_2&57aAQJ}pVGi1$Y|3A6*Xn*6!%)UcJTju)QroBs2;|h`Eb90#p!)fr|^{?3+Cn=Oxb^@IF0mw9f%CHX~ zCRX`=k`b$*pMYYQ_3`7!bEi)mQZ;3b434d}iVN1BqM*Kx=nB^ME?=RTBNZg3E*i+y zI@B7OZ2>bLFV6QD{gbGNEjuCMns+b)vu0&sX-Fc-dJf(&YrDj$U!_^Qg|*=jJSQa| zMEj+}Y2nX3_Q9EQ8k?FH@cXRn>s$ALRq;kp|Rm6luKMydx2 zjNf{#en_|@-MmM|^*K9wA=Z6^@w~ z+-{0E%XiMx-2Ql4S8b*-e;^y7Gh8?$4~k)6UAee0Um}Y6!d5XAfG;}F8hZ`Amp?wus_D{DSGNGVV^XS=teO4gzIVD@6sWmA%reIU4>}om9>3_scblHOA;y=@T{^S0 zlncP8si1auiW`)y8zf6KbLn<;SFT(EWb#|v@+%|g8P2#7Hg0ZbZIa}gtPQrzR)-tZ zqP_uK!A^EPso80k!;wfF!({?5@Jc~Z0I;6vj5(d`zGCCOGw62U_E`0!O^bn!t|uo7 z^)AaolY01I3G^{-3!gqB)~iwhW-B8>QV)OSkVjR2{dxy-kx&;;6Bg@KfoUK7M*Vn1 zb15Tmg}t`$&WaR8^!5XJc{PY(^*r6Vr|vXwd5(VH*B5|vG1C&)3CIKCWB~D6Rwq=< z%`+io4n+$T^IWKNIZi>Jlaj)it5?}GCRSqF8Xw-!ZFxnY7|=5?bVaCrh+2tAn7@D9 zI#4SDFP#ENbg+**P?wQ;-9It0fT?|IR+&^#pzOIraMA>|+PSpuYO<*YeoU_3$Y?L% z02+ODS+fD(x+OHl85L^~>Q?8k0{$P}YH^;Y3(y7S69kU! z7U!DeN?grgs)OhL)(m;m36=fa#6*chhYnRt1c}7@ov7E;PqsCae{CdLwca5MAh-)6 zny%(VdTOdr9M%+;iqviGI!1POS;%p=kv#P${Jai!MnxPAIj>!7^Eq_n+_`g;4|%_7 zUG6}9$!VWK;_>5;z~|$<$_4Y%_vDqVTUkX#hj%{-ihYull(ggwi3U^*FnZW^CN5lH zb9>ujcXOqBGXoSe{B}!?zQXBZ_2oV zEg04I29)DgwE0x=6zc=}BnAcs{{1HrH>j!7uX1TmeO_QxA7Dp4-gX9&1VG_vGIao% z$n_v3JUk7W5b2^8hyVr{|97&oiAfq^X>djv6I3yv)N3WSwY4=+YLkHEW+5qf9QY}M zh;}QzmzA}1=FFM#hxau?I*sLx=Q>gmdG0`8j4 zk0XO_Zf;qSZ`e3FoihD@c4up-X=`VJ5;L5-&Dt_he?7rl#P*lZojZ3XCni*k4)r~M ze%Qf9&eNO6_8!EAfK^|j>)JE|r~nsq!pFP8n+qSALkcxcNZ6fZL8L9npXs2!L^(-; z)ctTmPVnc?p9sF*-P@zvU!lKgD*lvrOOrUC?VZtvl|ZGxVyudQX{-TFbus9;u% z&jI)YVCDzN+|EOG{@^AT2S9neQw?HJG!P-^dZ2?EE($wlARc7YK<+RIc*+6_43c;0 z-4}TrbfEJ9mxyEtks1zxL>qazJwqwk5el{}kC5{P$?ve~sQ?kdAG9j`#kM9tM8mzM z0%=m=sUy%K0cf++r%ywjDD3*cqi?z+!G8Jj?GMcIH*B5+Ai^BP#*?Roj?xwuS<1@F zpeI6vaX^bDn)hrKw11FCMhpgcegTRGGg1QLFqyy5NW$d0E&g}rD`auHV_!qAwVj{ zUVFjz^YY#6)P@gK6t=?Oy-S3~m3dE&*7WZv@Q?4`ziXv&3WSD-TL4Uh>e3Cq)oe%w zka61I$+|Ul+aJi{ARm&OLVx%{>PPfG($INf|I7URYEZx0hMh+tUte-K`1tWk`VL52 z3;R2`-o`L!1D{I)P?iBD18%d8IoRfwtwgFN(%LM@UD;hEIVvqB1=6$Z`}glb3RH&5 zHsZFxxinfkn)E0}1bHvQC|4(c!mIYw+QxGHR^nvE>=mu2SRn)Nw*Xomy$(02wZITy)-?~XeCe2%$iL*asHH`I132uQw`B%qWZznhbxGi1nXR+}rc5vLPld zvF3B4${GmmT8E1uyKd6D5fDHMut5RoVu3BxK*k`Vclk_ertdmM31Mg6mUw%h!YMoT z1X@}7Pp1`{J%RM1+Q5CCefj79odu}Tcbj7>oUDU7#aX?jk)wGTB)rW{7v!x5p7=1W zgn~RHHE*)4S}DJI%tYWc;yW5Q`yk~V?rt$oygLC0@(W5d~9m#3A7K&n_h*Z43KU}lDxhA>qIQ>@+-Hr z3qhTXI`m3aP35~uA-|0I(V;#MPfvWGQE<1A!xGXboob{k9W{cU$UOAo;tmv=nws#7 zg{?>rHGB#>vKxt}#BHQszkY2_(ng^^zxU*BZf=%yphhbxy%*b_y$Yu779u@i%M2NL zu*AAEgh{r!L0Qcv_Rx{z*O-~pzWWo3oCqq!N63_*zCjm8lR|9sQSKl=UrvtA35Q>w z5BXpE4wDRgN0PHd>-12ljHtrP91=zVN(9p%@)u36H=ryCWBv>XCdP`%syRWDE2g@| zB6leImC~_Ms7lZ~XvAWtG$@cRc?MD)?d|O+7Z$Q{UK^F19e&<>3kIOaI_GxQ@$%nj zdja6M`A%)OH`$+=iJM@t&UjIG?e$$4MbOV3gn0#dMo0|MTY^gA=o&4FT-U5s-+hU{ zi8L2G1v}ntiK$kfd5Wi>o>=7&ISAh#V=5&eZDH=gM;nf+9Km7syHDB zsfqf)4+#kd$@H}_S^)gBV+U7@>+pKP`sc=pYCFGtDI6z%oEF{u7X-Juhi4xX?j%X{+*b>a~ag+z~dn=L|-?2zFe`u<+RX)O*PW3a!~>-CE~p7$bOgS z-{}p330Se)RG7wkBRd9R6iDTATc1^05CbUQ4KoygUk0vOUy}PfiDKOWt$atM7>VQL zv0hStmgpl8@Xv#NKK9S5QCz>@jixMc4xd0}V8fova}Gm09EB3hfX-`u>XP?wUj~=9 ze|B}-?^Ci%#R=M2$nit{c}r{cB8yt`B3Ymu;~9XH*@%(VGq># zf1VOm=JUU<@4va#e~#e%?=K~hyoz5=`?{h34&z)Jj{Y-s!*>$y8d%?38AEuIG8^AOeFCPL zP^cn7cwtED9Wn=$D0)Ti&@Zaze}*uYD8VeHPcR47jV+;PQ;_$XIfH@9nAr9yR_FTf znai4%I{q<8qSom&l&$RC+!_sCOp46Luzcd5%jsQ)%LyE&L_WLJj^!Lip{!$0XDt4_ z|2{=sPcju~*WbP3`v59ak>lC62cBzKK{U?2Q(jOegvgNC=eVWpGh&9UTxn40Tt#8+ zAAU*m@i76q@Y_O}T_oK?T%}DPjBmy#m3V{8&-+G$zUA)XB+!j zsWE@tO5QL2ud|~<041J|BCZ{0`!{Nav*=T(RV;g{GX8b-rqq=+sk13DG1W<(Yw%A_kRE84YQ)y7f&yUcnvjedtDB=uPPx~?_M z!9WMddL7pq?$oWgf$eHU@m(qf{Z@!BDiuI&$mI<=EcC;NWRQDASH7J^)5YwNc0nhz z#?E~-23;Yeudh$P{x?MVveV<;9w38Z4y~drFy7Eq0V63EWsLi!at%IXJ*54ktAXxrhb`kFb9&P)BZw3z@>_3MM^bd26TK0!{d z4jRXZ%S51w#f697V6L|28#iurj(XPT8zhRD_(C`i%ay6jExLfah|Mrb!m*P5lFqwqagGU~s|4dwFtl(v64>j|Z9=*?@zpn*8!P$i4~& zHUKVQ%#E*6$f8pdqXbRBa84a5O=1+@7AEn+(T9H_38~HGB2YD8K;hg4!J-7sY>EU> zPcoq|RqV)XQDj(m+!M--{L@_!mDv!rHV9Femj+8kIJ}pNd%G|OwNgUT4z7#&4ZtwA z)ftW-mXKXrU$>fLMv;TRCQ|bFJ?g6Wdi9FO>RS}dA5;|Q@vjjGdHJT#FGCHlUoi4s zTJ-k?27HW&D5fqaK%b`D|C}1G+ORgSL||%q+M**x#!0Mpo17=JRmesa2AEXs?F)>x zKzHfE7+_#s!W^Zw`rYo&R2f#Eh^I7q#qGJLZd*Pf{a)a0qsDO9q&Clu77DW?0D=v! z1aSl`#;H>x2V-a%1YI8_2OUmB^_K@b&hG3nAz=!A{+Bp@T2+Mj=ZV6oi$J`@E;K_E2vO=P*%*w>dx zW~nPdny8RD=T2o%8;pa7OgpAkM4D`J4}^C~?hyFE0_f2ErJ$=M33+_aka=7ND_94r ztQ}-qcBRg5?9f-Q zTP$vTL!R8>2}};ouXuyyEVfpsrYDfm4Q6IxD-F*Rns9rC1Tjt-1ZW_B?NFVNkdPWk zz$JsT3sq?>_SbSDyx&(SS-l1LZ?iQtx8z(7Cl0@T{komPdsC8AyC|bxA{96Zv@eNa zxCIhxO!-TRVKjQ~I8@KBQX2!Hs^3yQfry93#OUBINGu)+V@dGnSPbk4_dVyHt)8n4 zTGaFB&mDoLWCOYhNda=$^c0+d|G@pr^JC$^|McaaDy#ic8^p!{Hm@V(!8E6D6XqVc zech=DUelJc?uAr0#hC33ufRq8TxY}TCej6h`35A-feJOG>`|HomM@0!4oItUVx9vz z$uMem!Qa}~*OwE672O!RDkE$+{-Vy(471IjyM)JsMyP4RV6S!{Xn9a`#D{E} zMjg#jyp(iwxrjEfuz?%JK-U-<#Z|nua+jp!T*d{!14Wmiu!I|wFFZcVR=bbK@Ed-8 zLCbufXLD;Ss+ug|dTQFcOU%smvG-)MXiAhc+PlFg>#c2%l%M^~mj**EHbbc3E zbhAMgV841bS!qzrvWKIZFklJzyZbG7&8%Y#OjBv+Y2j&vrMSb=CKYUnQGx|P7(gy& z;>+j^C?wgiF*17%K8O_pbqaxM;MjjuH9WF zJDqZCW5^+VJRTA++$ap}eIcid@5vvI!o3UcvCo~^24y}ATuGMVh;teRIcz)x0IeczlEuPRFqw^fhA(_kl1iSElJ@o-OD1b zP*GN1A92S;d4u;IWi`XkMnS^53wa%uPz3$GLT8wUdkv`pojGN9wGy%wKaBA<-7vcO zTGi=;NptMu>u$_d&{jeQdAE)Ui;30rB+*LUd?ao)3;tu5JzO8aNyd7I7Mkmb@bB>U z)vJdfs{$2+F>JT~6PIFNo>f*;OmrS`ZLp_Ht?(xW-IGmBOdoRGbP3Fomy(v>ApTLI zd_oYeU4Q8-NauiacnxY{NLAafm-@hD5o3zKQWQ7_kprYK+1Mp~&s{)Juva$> zE7a|zLn?VFu|_*f`hk08tB)lVydshptb)w?Kp4?hoI*wZfRWO8zMdm)`vVnehGn^{ z?*^V5`gBc#1Oanqjv`MN&7fHRC;a64?^r>b*)g*^DblWxEfuE*it4G(3`{>*=e%nsPTni`I26ZYc_)_6%+m=!s|cJZ+8+X7-gC|OXiw7 zXZZKyleQh5qYHYN_{+Zh!Ivn`%-f|- z6)L|}(4TBEKU5^CK`g-EXa{vT128^cV}6@$70du9X4)n^8}I^ue5NKua6v~X|3qhi9bjqY|?|FumIF>ZcG;2qsEU@s>?VmAKu-(#Zc@apR0sp2H zc>E}EuutFM^56nH&6Ee3S_0wEF8I_>sYjj>c$|30@92E(K1(O5GCY1adsknDQLsIM zzP*U3Zb+#3&4ZR7$uT&Hme*E4;nUmi#k-Kz+x2QLMO_=+g|AGAWx31U8 zYF?RlJgX}CbMQ~eFLIWU($V}H)uHz^VpMy1Hap^5jA7$T$rz5YdwABE4`&@t&@;mGD^Czh)A$Y^GfP*jkgkn7YpoStVVBOezhs%p z8JGKlX(6<5Q2@%NZaId*Op*ajZnbz`&oCc)Gan~1874_}+X9jNvTF<9zuo=RVm9WGOu zieTe=^3b5kbkM{c{EK*v?Ij?TAX`Qrs<^k{!p2tuJ3rQDDcE(u2sH+Jg!2ID$esk}&i=8sj=e_&q+=UXVxu(?MYILqIt6Fu1oD zsx%w-Dw+tBuGwjL)&+ixI_tRiBu$|9y-f+m&E+pS)@CXF8XCN>oFPI)$hGs_-&dp* zc74Bmuyq5Ls`TTXglucjr_)D}Os0=*be>r!hbVpsf9I6jN``3}CXpGVLa7J%cpg9S zgjD{Rk)m^1xxw>wUIG1YS2w(~K7KG@{ftSk6FZ&!yg8m1{(I4HQB~Z;3GB~t>?xCZ z<2NO)V%k4O=Zn=bZ2Zt#^--thpjtTniol()->iyeR+^v6J&ZeA)l}`JbetFMX4a{s z?E1H4dv%D1$$#Ul_cvtOXS4|U)iqyN`?~cnAMz6AY!!uwEpQMESMBCahYW0dLaFc7 zvo~+5WG(m0I_(3Z2PT@Q7jL~JJy|3tVl7U4>fc?*POG?WS3#Ol8j?IcPA`GqzT3b5=)uFHa_<7?H$gI;?7YXly{byc;O^4-pDhUyXR3G!t zh~U5%gq&V5@K|}Nvvd4!t*l$>_h4iN4Txl#6w~&U8 z{-Y*hEg!a?ll&+7AT9}+j;&TT>D}dLjl(*LB3`qc3G{lZuo;LcFU}uE;qSHn5uXB6 zdEC1ML}6W_JSd z-bgA&wVkSWKI@kD=SKh6y5hhwBZ~>Yzs5qL{x@Rhf3vv%dQ-v5LY496lZ^v=`41Em zA~4Q^_kydlZwKBVE-Spf^B0NmorfIIEj!Mn_VQA@5$*;j3vpc>NWt1nvK#&sF5QU8>1DH? zTU0;0j#@5TA}X~|lzJo8z}(ILaOE#%8K_xEHZh|^jLR1+pv7yfty+c@NQf|ej8Hr1 zrbK|J?uS&6#~EtHe|i$vW93%(Mby}RPt+IL*~xp;0#Y%H{@1%5mjS-K?@}C-Of?#p11q8}Rw|Z(i^E+*YY$YWp!h*a zX1AMuLF135{_^}ZJ%Yjjm1NFNYD|m43Z1GpLzz4>!~nc(6NedOT|W|(<0Qi$ub5R$ zE~oVK0stHX+>Gw#2uZlZAix38wr#b!>!aXJH2hXRTe}Fz7%5557(HCt4U*~~>A9@E zoHDJ?`}HUwx02<)PBXHsrr%%o2i$*`ZMgtyl7CB#;i-xQkfjaqr|`TK7@v;7TC1vL zii_kbb)9orVO`75t~MVEyXo*;_~4g%6Td;^s`Qk#`vX8ZJqy%I@10pa8qZEoAQlCi z6*`mtA~$_Td>fJ6eF%xzZaD<9nD&@N1p`PBYK}C*tWlu5VRvQ$psiuH3Fi+8PH{7O zYYlNod4PghG3p{R)5zUxS?N<#-38TIc4w_bR1LRA{Y(~~kfUK15Qxsw@x}h$hbL)y z-d#fE`9KRego=nvjONhN)GjoUPfoZB^P3>@S*=feoVx|0taiD*@!OIwx$&$Ba{7L7 zkUao~LEtxloU+@2893W8*n6g*=8+F|xZl=CiZ(OK4VwJxE^?^H@w_>=s_X z1|@amr-&}jq1Ta1Ci;e*YIV?;cl3Oe6Qg>_67jE)$KR$A^C+8Id3RZ|2t6#Et247Z zQULSdBvc%2K-;2|U2}V0L@1hPY-|+o)(o)tm$mD{5L;@@Fa1b+aEF@hg?lm`8s61r z7xp_s>t9kRJ#A?qm$b6NVA{%lUsl*CNAd#?TSj}@l_0=kJ$iOjk<@jsruT+iBav_d z?`!6c1yhQ2#mvgl?4x z)=t|5r--vYe~y->D>4p#65H-~WHd;@#XAVIJlFfhV`we&N?h({IvhS?aJF_HdzG#4 zGWIeY{oK9I;&^mH79cPZX``n)|h%e3%uYIo{Hv=m|Et12!AW|e9g32C5J(LMBp1k44fYDJ#!ZEvSf9@Uf^TKisi;G(*vfD^=#;0DuonU1>Sb{C!0B4{O z-~9x0=-JRTi>dR0^8x&DieL@%=~LT~7s&76HG#-cVrc57&%o$HOgYA`8UEp~5Bft+ z`}p^_#nyuY5q?B^-flj5;-V6Ebs}>sbl&_C6!M~(M9XDry$SS*8#9~p;-l4x6bh<6 zJ7s1UtkX;y8&eWu3O7|vkCL~fnJH)%C_w(ogp`kUy9}wLSBUe|>94ww;{hXbILWS- zh^9ie?{y;uZUm*@FjM8RoV*poSD;Io2*M>`ceaii&v;k~srM%Fc5M-rY6ley?F=3q zi3B>@--FP-G-L9(s{3FNZ34yyO9lRjGLuJ+SIuW*kohM#8s`(vZ2*T@H^=;oL0h5& zsT;-}x@jBd6zl;1hH~u7pJ`uAbo=uR)7$RbPHjh=hqC1T_ovryE{N4|1dq~1 zG~j}=XH@QmJ2Av&WT+4J{5uQ4*Xz2wTt;sri(S9x_)D9Xf^2oH;G*s+7A>Ngk&(v2rFnCp$k#QeM<33pden>Vl~?aKk4( z9z651UFpt2du!P(88gbBT6)$xx{SE`ia&SZqGqQt*r-RuULEjLVP&R|< zHWS=A87KPI6UL0@FiVUaK}v(^P-p`iAV&h>e1_|-owYKHoqS?Z+lJhbl&>TQ*_W$p zY_vw}7EBy|1XqJMShOsdHebF251%81NoaqF%i0s9+m5NLnA&jae6e3@F=INaP*LF0 z>q<6<_Z;rT_}1reI#Js{u^DcN;NQtpAaCLg(r=HeuHio58giM@!H%S5gnU# zlX7SqHS2RBeQh}0i?iPmyQ!4PV=2p2ZgAGPGpTm&nFyNSH@M%~se@odIqkMH!d-}) zPeGo6h=mPO7kaua3EAMJ&Vx31j_5%u{moIDy3j#%xr~Z|Xl^crdrZ>}Sh}S&`#F)a z>D^kuipFPAyH(~W%9IJngKcD-FB@ULYrm&)h z7;WhIO~kaYp|yDL>Tg34Ml zCi5>6_W2^lSdL89z{ItdAHK|uW9LpOtsuIn>)r+E{XNBvGYi@G&Y|^;g*-PZd3hJUXtN~7``8}BH}yRZ=K@={i$U} z{chn}SNPovRL_Hf=xG*HPjV+%P~Lu%LIs-6-zKXB?O8CyWl6tCUfj{+$1RZaI}p3r z3$7-u@p`xk{A@eY;N;&xng^*5mqJ-pkU8;kT^C5R@{1&&xkjAyP1*M|k-ZY#6E?e# z!Nn|y!)6PL9}LW0Pkbjdl5@>o880^+%_(m`upGNwE7Pk}aT@h72GWmC#YrULG(e8U!_l&Z&(Dsa zVd7|09v^>|z&m%77H#ChI1wOlF(W$43D%LF-ixJ~-}B_G#l#p7BbfqOld>-1eE_f9 z+8PEsc8}ns%gBm$VUZmU>sdsGcUD)GYrXb{1`c3aItCf9FD1YTZw6v5Yt*0V1nmyU z*-*~q!%H52ZA$N|TbLF&8`)*@?bYd!6qt6aEcP~f!HT9#{PRT(zobmp@6SO(`}92vwK1{oWr3~`OrghbrmAluu%A??|kz#HT5i^Exrf2@cQ(O!2%S*Tsz{)66TvX z%Ti}|Dr z_rP?nP6cq=U&rkoWCh{>6;3|Hv$d_r~+*?)&~9kGt@1mwWF@DyCnSm82FVN%pX@yGdAe<~}v_ zITLy;X5bUk6ELu|G*qr~mRZj1i+WP7`^MYs?eXyg{>JkWGy4qg&h%8@!lKH2#I-krH)-6xcwW(dxKE{eLy7tHSu(rj>l!!2-j{v<`C_JChIHZ#_QkJi zF6-FHfH#+tqk?Xt`(7#V<#L2vBYX9c<755iPO?fv*2t{M`Pzh;v6I7UPAxj!`Lk{d zRp|woUt72J+6OzgH6G6mvE)A`Pa&AD{amocO^&yX&SF_Gb*;n2*j;bKeVozv{iZil zSp0Bu^`OV9@G3j{%fuMDeDt>g+nh7?SqwbIwIY6aN6Uhzna0Z!0h#v zTeqr&oMV<%cGfK4nO0@qr}B16%c8t`#UgT)9LIddkDXxP=blc!tFxT4`$h*PH@ZZa z>HWQV8pW*g>Q%J-Ck>WK-6FZPSdQ}7m-i{yM|Ljl5W|Bomb|^tp~mrH*$?%JT8eE{ zVf!n0Ejtt0F><`S=8zsg{BBb>qNkyjPJUv({dA0?zQ#8e=W%7arwO@Km{bu?aowHM z3Dc^Ntt3oOH+1bUZ;lOE!%Z?ZHLldg)Qbo#`6nbWz`*Gt6g-Wjo*rGi`?3(~GmHx- zbY-ym4JU%VqvC>CmMh(S&)Eov|Tvy*S%f~JkcK3OfXxpK0jE;m?`&l^J zI~hJtr{oikQdUxW22ItQ)p~HwYU}&UR|CcSBXNoBIo~OIz0MhU!QNcz%RZZBGyKw> zBaCZ(uMvD z;1A>3ylPa&r&+kVS*OzmJXR}i5`n`$up1E&H;qoH%q>>5ew$mH3_V4y&@Hg`?Jr@2 z<7v-gGOtVMDx2m&HRHK0czrGHG@B8 zj7N-)2q){9YP@HBUsFe&?WM|SfNk;s>zo@D3AxyxVBo8e$2IQEtg5Y^+z^!@Wo2cL7J72=c@DpSeW_ohLOp^nor)CquE9>h@l5N2nphq2op6d`Z2ap7CM8Q^h>41i+AG4XE@z`_^v*4iF3hEEPRz`#oMN+yT&9`Q z82b98xKfkZzy<5^NEoMN!VN`-f34UO!4vy43 zFLfZth?sYzNa4exqu*TMHPO@~z=YV9n|&>1+04j6*%&*%bU60i94mAd2xq=#iR+q4 zbBrJbTXZ^JeVhfTBNxM)L{FL}T7JXSw1^6Ekd zC4Z^c9l}eUH{S~Q&Z~E06Mma3q<$ouI~*`ji}*nMi8FK0X;4EVLSEcDG(2qPvmTbK z0-6E~7g^0aMk_yT+IW5EJhyvG`<}vsk)92@Gzfs0rg5pKbwvFdwgr=E*GNhQ?B(O{ zzYm~LH}v)*lg=ng+(Ea5!fZcG@*g3hpf7T%8i&J?-&YA%K+PhB9GGGD-{O6;Cc2Ejfb?K`#7yl2=-U2MjcHbKv3oK9?Nu`mJM$(`J1PPH&Q5tEa z6_M^1kS^)&QU*jorAs;$0f%nR|54Xo@A~%s&e_+QYhCLFnVILAd+z+ze=RvYoMHYP z*Y|6uY?Q)V1{_JH#KfMT+YjnaGw6wNr z)Nw=|NsG-J-BdCO+%VL+LmSl*%fZ6LbeW!4Ner|*N*hlt2<5@1)HS!(@H1)=I@Xuz zf_Rl9I{G+hF@H#-@EN&u?%Zuq(x5rRws1U$_-SlD7rjkHi`!K+Xx(#smp+vqu2(2O z1hb&iSfoOD=$DzE%gDIqAf8{=AV0a}3)6sJ-d>oI$TB#bika$%iw&{C0+n2a#|05; zRn^sgb71Y#_M(daxx9=6lW+IuuJ|q4{_MjNd-f<8#2=?u8uHhY3O}n%`Iv1-Utymh z9Nnv~rTJofc+5?`?L#=1*mu+}%jG(z9cEi>a^&8AtSh4F-tqZOA4PfzCA9EWlLOjm zsq6h*$8xjlsRH|yk~-l`oJlCnp8V27DeI6+s>76rckVAV$SJnAwCF+Dfj>Sm^KF`- zkL z!R#!t4~jbhk0W9583e$gB%lh80jE&{fH73vjSUNHF1eP96*^CYv8_Dvv2fz(o%Mws zKoe~3{HK~Y@75T6D3;;WD$DWlKOP*SLMA_h?3y%%XwrdRoTnXDe%Cg8-1#K()~@Y( z&P8x#FLP6ijD&8^Ds1MgmghTw+KP}?yL0pzkG!d7r%(4KjK|P?b)ReGx68*a5$4#N zi@q@IQ&{rK1=^$uzJ9v5(1vNgt}?OLPV*X8X|;sP6Va+=PY>&b^tXpik*N}PamZiv zV3+FuWum)Xd=569cR!J z|B!mDTXpTT_L^dQ&jHJ)qb0GJU#`7eS}TIw!+u0cTiLlQ1x#(bCc)Y{#>O6%MQnQV$-4j;W>3egMyDek(iuqx1^MZ@@tIzznQ? z{(LCCt~b0x@P&g{l4!X-B*|4<3Ry=%nM0#!*f0SLCmPO>){t3%m%F<_XL0Hl26DBM zz^|02UWx_N527(LnDG7cSm6gd!Cf#udR0*JnUi|%mvv&_xc`0+u6OE2)M%b|?e7GU zuFWo4O-SoG-NZBUe%xW+eiUYS2eaa?4%5A@WfmDD@G^p}DaF?adZ)n{;-qZ_@if~f zGxM;RJ@c^|A_$n`BarSn`m`S%vnxFcOZtP2L$HU_a&r@SnxxB!i;LHDf{YP)lsg8o zuUET|sdTJ%5;#LRjz8d^{O=}U1=0hoT)^qqRp@baZ}ki5O?&k9~I`{SX2|X}t8)OI20@4~R2EJ}mVW($lRBXcV>N)^g zK&V-?dzw5^-UpPy3Uo@HQm!CGW|==@A`eMVcxfg-!>FpwMJN2L8Q(gcgm!>$&#Znu zZsX@L0eJslS5s77NEU<5eU?Koht12=bKu*-9P#G6G+uC zvk?jguyEkKiL`@#lR@gxYX%i0AgB)3j##ipjh&mFCCGgvmIJQb@n(?waYBq%*kfsk z^Kcd=k&=#>ksf$odQHZ72h_dGNqZn*+in!_y zK;&m?hXTu96Ubi3#&CakEId3#w>Q%!qCw6)Yapj5ugSTg*MtHCFmDZFghw8!dpr_c z8Hxm72Ohn=^XFZ~`^N2zmr;L5jPDAgT;}D!Z+A0A(MVKW+(LW2@=QME$>0CVTm1FK z?fjlXJGbUA=D+VCEf7q?_N48zE#ZwH(n~Epfdc=y_@(O8lI0E;#l;=Q*bY+5??P9E2mU{w^8f$-V&$&= z{Wvx!BcN@T`xvo5g@tJjkLZ^%pUJTIolr5i-QD^?B(S0VFrcOQ@R>xwrc~efqMcwM zDd(L7(u-Kdtn~B}#d2A_{iAPHb0xr`=VWn%l+dDYPzQeQa!TKt>&WLMz32;pXf>?t z?DFR1BqWbkkKio=HqDnqRCCKmRpFTuS}EDK@< z$~3)3nQ9%#nbnQdjlSJhm7Dq$yPJulqXlOBuGgNZ1gB1q}+V>*cCz@wyO zn+BUVQ=h55na`6Kw9s201Nxb)lmlve)6Iq3>xH(wRXUDYiWa0SR{H4TrTc`6>wA{P zHR=(fMuV1y%>`V>S-V&D{i$`H_mCF~e;+eH#4DEq(?qQB^O79{Hu~xep~kiJO1ow& zQ6+KwD_8vB7$QM~js}ZAD@46cyOnF?FDlE(OS`R%R$eMDE;iWpCt^t+TteHJh|7U$ zTVk|_av040edN@7GIg)Ky_xq)k!Up4eIDJmgCTLqKE;;-TIhc6NhDoP+=#-Unw}im|KzAWQ(nu0-{w&H z+`8fL*%{)e51SsiVb8b;>VF8RzdQ?k4)ruYk>P~5U;=YvkVj(f?K`h7xrzu~-&)#i zd+4<4t@EI|dity5L+KH127`McOJ270_R=Cs%p(_;#)hA`eqQky_a>{Wt)$SrV1+`3 zOFBHHyCZt@LGbL)+#4zrco=EbWljxOz8=2%TE~`_l(7d7G<+V$8J%7GK{qfafWgCS z+x5GJSpPg>Ql**ea0ZWX#*fMzKK2G;|GgdFYCz&!v>fx@b5s#ga9@ ztUe|x*6Ub>l|hH~>Nb7_{oN1W?A|Nz?yCRH73nz}8cC=*vnrQc=HX4*#96z60e=Uz+;6^d^>IL^If+4qHF9oZ&pX8 zDI&1}qz@OCmI5FROx6FRXfVuIrdTdEEXDigI5H&O$##losa8#7G*kx1ZdZOTVA3Xh z`6I(Lvj1E2@smd=RKeg_v%ldWW+c`!TL%J@Q2ZCwH3O-%wG``Bf*jx1U#>5`2;CcY zR+!HAs=&ckyANYxmzsp8bYdf{hkpn&E72J3%ho@DXXhL~^xba^aM;!_Xua^EPDtO> zgJ|BgZgOcD&&smV*KlIc@91W61(#Pa+<)`f z7NQqwe6`=sa*_r8!eA8hMx#02_$G8yETmxHHZfra3o_B_?#_;YU4uCevhMKG_J5$9 zoEcW^yoo=%^!gREI}Dk#sMrx*@0b3X28S5Y#9!}?IkLZLahg1Mgu3NgbxFl?TaufU zWi>yErzF?u*t=WDNw=4Bc$b&hI!{Q&5BXZil3#x6A}S2tZapf|WMaxMz2ai*d0t0b zaI%|<5|1qTP8Z+=gU5Y(b3DoiqHifNt;g%{_Xsi-`Ck8Ux%a~FZmpmF-fpem*3Y0< z)(*#vxXTO!_Kvpbz^2bI%VG1{JKkWN;SzOgrcOC=T|zkg($iSU&{tU5H)xBv*>&pA zXr|k@ZLD8jiq@{R*j5{|$=JfJARcd;)Uouv(ofmeQ1~I?OG9NX4&F_vnx*Sw&&&C) z<#BgPSr0`-M!tfKPQLHn$`GY8l=LuH70zZUiu;B)NMWucvdu8&Awy?JLK+U7xCdMq zMYy=|VYi=}ep_&B4WE^H3rJ&HUf%L?MQ-us+sa8k*%qc-TuEn&l`)?-p1nG~lP0_1 zqi9`zzIuXqI*MQU*;MMGkdwGL+cNC#kc~J58$Y(MPSXv|y14whF)8nT(Q&)f^w3Hy zrh^J*6^+Q(f!p6-ofzL{Uz=;Jt&Lk7Tch)=Zmy4P_mgt56K}rR(b5EsKGaxxaVUpE zRC~E4`z*5`-a*Wr+>Y(fzuMCC>75R>a112vt-hwe`~0&}->O@m1YRyCb^6--G zc;+LL{cWPWe9ejCq6N46j$x$dF}7Z-wF|{1Wd-Bn1bA_3YHidjpQOe!Th|u zysoZg8k2#?pQJjbFN>L-$6dm4@|cOKa-9>@iK7b6YJEK&u|17<6i?qZEP@xN93CD% zIW_eHVlXPYEponT70>lI7*K_=-o>e?8zEWRjtS_wO#LNz$i3?1vEb92;pr(2jW(n6 zB|j&&EW@)}RX84MCXzg!{%XmDqcTO!c%5^rm-HlUd(g+7PoJ zD?^Em>C8id#1$Kh)BaK}-(){a`;k2j*ATxXXht#xE*ernJLA%gn740(;oLN;E#Cy|e4pr{27Wlf$ySaC~$$7PJlK>;fLGr0>jC4~;PH*`)aL0EV>g#Xbs7 z@xBJwI8B1x!hajm5l6of_|SE!&X-#{%x5Ns)My*e$3W8HYe61#yk7lX#M&V zQ;q5`^NzJ&d+NCQpTH|`0A(%uv4zhN1r#xi>TDLd~ov0a4lYaX0i& z!tom&x*HiuxU;{1H(&LG-VLTt(sqKBuyum%__cwcfB@SnjzoEE2($^PZHI*mHe1t< zyUHecXqKc|PG;uzlq_uZQPtdjjmSj-c)i;FS=gk82@jW>#ia5`IZykjG#IWj-|7*@ zn^(9V9u3AQ|He{yb7=(y5+fCONBDk%-lE=Sm-jnT(Tu{rBn7rNufFvZn=RfftmYm4 z7+Fao*Y-$V3e$?;8|t*n6s0S=&v10Oy?sMat_$zFcpn4A2VeXmvP}WIv!4YEi!pV} zJ}gBm59oEsdvTU;srqX&XrK%x3+n+Gvrf+U!xo>$Ix@=b zK6fXsUXZf;5L%9|QgXp=be8kB_qoo=*OWirhQfYs|9(2}ysO6?Unb5f1H%h9pc9-N z93*VE9%5cm#)!RbhOH3F6WQO`@@6U#Gb{eu3Jy5C*qzf(b>?7i<~rRn`v|#-6QWeN{cu20m|)v7qGeQNx!nHsDYIW{x*nLl+e1%l8vmTm zo@or1kM0a!>6H$JLx@vqqYo2y`^Ws2%^IP_z4cy8IDuUKIEVv#j(~|1z0y7hJ%XHm z*Y%t!o)s0wGnt)R8oQz`Damjq#~&a0E0Zuc)q4tK&bkjL;S2m+mjS8n7+Mm^qok zsjP90jAbj1Qs|3fQ#NfrK>*Hw0#r}P;_$beuA(O64JR~MBk-A-Ou}Z;wHK^L+Qjn^K3+W5%$%jf2o$)fRO(l{D=mDxrGCj+L> zx=bb|4J0k{Xdl`6tMnF^U|LoTG^lo^!O=^?!PX~WgeY+46mHAoFeh>mQYGqQ_C>ioqH`odU=hB%gz~%3A4H@{#n-d zmx&$z`;opl8-s_qvCHkU~zKwSE=b79z%5k-l+nm>y7jN*2 z4oCNAi|%i@o_?#fK$TE>< z=K_`Jl+rgnD$Qx3J7LdA;u5+A;wsbL&GPyEVx#@B%r$BFY^nAeDOrEb6%mCPhG16h-=iwe(V#ta8+8AVM`N<4!|5OpC6g|(J#60Rmj~P$P7S$m3 zVHtc!lqR4gI?5*LqsF~HIPcD>l3n9&Bk=h}~19=UIId z{i)ur_>3T}RcCOzu+pf5D@ z`DU(AW>yUO*h*yL=dc~`U_lSnn=fp;x$!t1K3=h)JwMU_mts1bl@0G=LG7mjii=IYogPZ+#pGqK0l(VJ_!ygetv559euSG3=JeI8{5JAsY5rzcB}x#>%6l&e67{*W!VNuknaj0 zM`dG`xR5lz$QT0UU$DbbORT9K4#%k=)U9DSuAdf+G{;|~w?#Ib~`+@L%sW+AAXlO3qBwmTItD#mCDx)7o2)5a&mX->AW%t}V z9tlD>XJH6BG*(ZDwQA828wgj0zOC`oaV>Q?Rm<4^hoy>E{!64Q3$AU=W!zH|BYKn@ zT4!A0w7Ptzmu+tgxsUybS*HL-(LbNM{7moac=?VAi?9Q++JP|76PZKuipX=0QDSMq zWe(z9skeVI?D|@xUE;GJ8%LBLuf?v_=lF$u8sDQWC^#QKvA>D z(NeLoijdy=$r9&M7EBYcqV*DB70n?I6LdJ70g zr4_isg&wJ#q%O4dceAb7fJqX0WV1bkrC2^|=py#Oq~zHBi*W}o0Y(;VVR!OZ;rchO z&UOALvQj;WmK;)>6D>Q zG90^*(Rpvx>Isdv?;8ojdAaueisW;&zY)~bimP^d54LRmZ)x9GwK1Nl|v{ zblIPdtfFCYQsdA2(xhS&Aza1A^;|<$u?0fe1yij7LfBFzg zjR4#_oMLZgW>##wATJlkb!Gu_(C0r!0-#iEGxv#jdEGsu_xlZlma`Z*n75R`u>sAM zDF3vS(yMv$YYhOh4x{&EWJ<1FLK&B9plvjZ;ZQpAQ+I?9Vg_zo$F7MQhN}=SUfavU|V7z2telt%;m95oyT2fQ_nO0OmCQ^#+T>SK25>#0w|9TH z1N(bvwJ`Yj&!nZS66eO3AG#k|emr)&`qFi*#U(yO2OaB9g`6nimG>>1O-;qdWdgF0B-2#;nLHH2d6S)o;Rw&oyE{r zkbou*JS-fb&^KK{Z#w<0Kl&L0+sc7eUFA9vRENkv5_p%nf(tn3`?-*(lWT3bj%7D4t7!`|0D(2X^YkM*B#Vfk|%_)B&yqi z^uV;guqk$LbiBATd#k!Dwt~9g7W|TGVMfnpqjWB~?if&DSDWN-292m*rr@}xfEGyG z*HS6lhSzm_z*GH?@+nzN$a7Tg`Aanv>>df$h9KAy%^V7_y)F(reI~X9O{DEs%;U z-nmv$T2fMEGba<^79Ne{4WT?C*2jPOCuQ2mhz8pIV~9_^KqrJhA_=*~%dwTzL`3w{ zXFLHn%+sn?+9-v{*aT5GjTUkuqJGv4rGKOT+AXrQRI?CJk(s)gg=D#(X0M*k% z?YD1dqSytH8Z-P<|8Lkok{;Yonql!nS(gG*5d8zfpb|)A)G)PuB}8mGM^HedY6)3w zi^faozqA5_QubKbas0#Fez+W<&}F3(9XYEBeQ(m&tL%ZHoU5IA zLXQ92;W`ST0sx`S{~S^B2lv)EQXX`|FyjI>V z7S8^#5Eg1V1-F6B1gaFZ?9pyE$rSCwkBSd7bgK3jPN@CCl)DFuSC;^lW*do=v6#(} zQ4;(O`oUXGTNBcS^VM z4-rY|hC2|}=m+->DP74>-3b?c?U9a7Fr4s_5?UMA%1a-&>u==k@r?k=9<}|+ zdKSZOqI8@xkjs=t{Sp`i>D99)cW6-ol8LJ7PmnvxKp zoKv5qJ6D}@6&5m>e$c!48crT`au~0WER)kMeMi>`Rleabg#fAxEY$6}dH;J}H78Ni zAKa2{Y|$6e>QSiHPcBQ0K|imLd+3*uj1SsLIW){s&>?VA;xi6_y^$y8&eRt-{#31} z#tmw(N8oBPh z6ocm&Xn!X~HTiHmBlqwXMfBvfLn}JBlJyj)rlXwLC3H>Da2xc?*!AJ>(ZfXem%8NZ27ohS*F^JR5!Aup%bixzFT!p|-38>li3(AioVgM#)W^3a{ z=#eiW*eFk@o@{)49Ig{E)b>Sm|01AAXD?mCMqLE)FZ{d%*)}a(u)dOzgh16EVN`N* zG74T`z|#pz^{2GlLM3h9Cp)L?9bDCRZ@FaD)_ys1md zV|*E<2Or7_%6Vbn<^z@?|Lz8qC2(?ap}l_nJaQF`DAbsN-e|p8C770;-eOSZC47!1 ziTt!@m$)}@ZIG=rU7xwrWBIlT*coEXh|E!J@6smf!D<3+aLb8r@h%eApO(ZhL1Dxu zSUHxricNYMT)i5^%tRZEx zB<|d9_@+T_vq_l-!x0oF*Mx;BpcrQAK^uH^FkVXpzvpaRk@h2OhX}a>X{C0tUf}vi z*g{O1f&B-@pJe@nTKwgTYABne4~nt-g4?(LN%4#y78A8W$eg&)+U#qd^HL3N=H}-0 zX*RQInw~CgIyx`u(eAMSg7R-%DR(Xrny_c?eLC~~sO6lopYLO+Z4&|!+6D;S9V4`N zMjb{FTj3TuW%XTXS?xuDdCi}fa}2C~xff(b=k^SebUh{-a*c9`{7#&ws zj=hpJL?2E_$SoJ%*;MNNh_^09HP|<1vL)_ay07N2%*SBG)SCODhDP6ixyIczc4=@~ z%&*KT} zKMfA5o%N*Siy*XuUj-?B>c8YvRH%k+@>?M+E;J#* zT=7X-zbVj0ONm($!2ZN>Wy9L^bF}iy)TZCcQ`mola$-}SYOIIMMc!0?KoUDTDyrOX zC~pdcKB-9n%|i{-Q;=BJhHP>-+tfk&G0E{|SAXe?f){gkmG`r9nZN=y$B#Dd1W$p7 z%pu(@Icl-zT=3EA`B*?4Lh6uyfWETdVX1Fdl+%*=bHoDkaRz3&zLkO@LnHQ>%)U^! zgNdK#<<34cq{+B)kxG~p$?q^IQF$KM4k2m9VBnUpxeDq!;0G&6ai)BsZ{JGm_Qhiy zkkNSa9;)Sp#l@M}8}viG8c~wRQT22^%sLbhS8nRHXR|?ygts?=WTGX3=W~mG{-q`! znhXf@^?z;&TR!C71G>4`x-{@1sr@w6`LcgUX{I|8B$=ih5hRCXO-t(7kQ3|KCeTjCLF)ijk0r zyC*Jw8mi|q$*4eifg;#{uY-B4AlFW_eQ4*N?V}mR@DR7*Qc;?RU+-nUY{dixC&v_T0>BHuxVm~ z8m1X6uiJ`}slDF`Ghn4+293}uy^(D=NO5BO!FddXFLy}@HS$#>rQ*bhK5EqU%tW2& zm55GLDCC>~-fASlC8a^2lkt?iygc!G;z!2hvES6yQ}B6CcXzG{4I>+s7e=Bd^6L~p z+|<|C_ayE?Og38>!xPKg2p0bNguZWoSSuohhq4L^R^01dv9<_HqA7HihQEsE#6dGS&hB^X?WWtvH#}7SvR$% z7z$-gO%_SMs@ht^kD=GHb8-}gIT;~vQ;r4=@k{k5V`1&M+)_zB|+B9B*c9E zI(|gqr%|reT&NXsV41JI?$9{_)e`PlTCxLLBR&BqHN1#{*RNjrZq4pryj2_|jH|hi zl)p$2^PqylH9Keycl~WrC~Fp=#Ng=Y2qj4*%M3YinH@}~zrpDWR97EUMAPqCowV|dIuUt0*V_1fU6FD`<8t?Bq->i zu&TzJ$bp0nU*qRm1LLRUNWvh*aXJ=G?SA*{PAJEPln2l-f1mzHo9w6YiI0RNU^{an z|F~!PppJ%9>=CczKUpA(k#RsV(tdIaIlN8tRFt9^Q4tK0o?ZBriImozU0C2Z9)&88 zCy=>eM@HdBlOvQZ>@Rt;PMr+E^F`>?=rG(jQrWvU%&HduiqR z+Y$s0q8t4BSVq>^oGW9PmnN=9=?zWXdt`y6(rb82$@$1IF3{RaN}=rB1r>F-lVQ4* z^7)r>5WK7$8$q(hvhZnK$r3j}=1{S}Mg)|+12xBeai;lo*k=6E0>Cw90p#`dT~Y4& zb{)B-cwfm55A|PU?mtAGuNc_Yca7C4c+#*^V+u(CrADEEAeb^RIb$c)h$fePvlAx! z`z_%A*z)d$Gj|X?F*vefNGsK3oK39vL;&!G^BgBoR2P2w;d$NtwRS;4AJB09uH(#^ z<%gPYQZ@gD2oeu2KK|5rd_*PblY;@yfmN*rkAyv1Q=20>hF_H<(JP%lm2=83WoNF` zim$@#&&yI7_zzdc25_4hLJ~pk`qGVHWTn_lCg=_K973j~9G?Ec~i&2&R# z?Hp$BJ=z9HO!g;r7|}cX*pu+gLQd`9GzQX;{#cC4(TtrfK-uWX%QaVMW3xrK33KDJ z99=fV9Ko*`8-w$3lf}aNPrUZ1_-(EtRKpI^PN?2GHsD_T>{nr$F!hV);AbuIwFOXI zzS2;j2n*r=F5(GV0VM+X{GB>J3bizW@xSf2tnJm|I)D6x3z!X4-Y}&kz|3jpnWRp<=WlBuS|!KLE3Rn({-+l+yxv_R(0Q;afKXRsn}8lC`()Lo9)ns2 z;AU}|k+%-qR|@yqcmE{?##0P1{rWL7BpRIp-w`x&aWf?cGnyCqMRo(sv8KYCYQ$bt$bXwcxr^ zlH@CMPQx9Yx*>N#MUk~vtV%=6Q5zP6x<}92uAToX8vCZJNF-SlmFI)|oC70ppk zsA*RKIfC#{bV_b+pAPp|SN-M&_K-$0HiRZa+pL$+?yfwB%HA!x3?N^v`Z73i;g{yc;mA?|%Pu_O{S zk1#k-j+_$=>L1}Nx2#?ftVgfS`<6C{cFpKCILAxBmZlY(4T;xDtRd%48qk~XCCif^ z!?~q?ezP?k2S}PT2=iF1s+Eu2wZHxJQw21LIM7=t)^OSZ*C>0HGUiQ0I-{DkV)-my z94Bhqg51N70-2fcZn6O}kh{U6t;^$dQlmOCPO1f6l>h3l_Q=22NN|3ZjOP3ZpO?%PH@zkHyQrCd;i#zX6ghqg!hI_0&>Z${Kc;#rZ7nGk zTweXz(CsijT~20P*Dd||z1cb5zvFkd4vSuyJz7<*b61}w#egO3B#IWxXVSpL`@msZ51e_)CubJPNgPTY)$vT8(RTP_-?C%^mXS3kRB~oAQttX1vQ^J2Wv3 z!YN$l4{kW`ZWYBzpIe*@`g(NYE2VuMq2wEaSx_DX7*)K@qumyx_Aud``uTDwM_%OZ za99bo$vED+Kt@Z?YV^%x$Z^m&ML#ZqKIzMdb+2vUpj|xeL!Y$kHaF(2aM;E@8`pZb zCyN_Sf}lmI3nagJ8ODN*;MV-#9-GZsu)xjJ-MD~{M;;Oi!V@$P5bleU%#xe{$={JaZM89}QX^b8l41YZvx zqy6y2uMJNYh;l!!WT1aDr;9s!dfk5__ptGO_bj|8N^VX&*nBXQkDPn@dwrms$3 zEvv;De)jym99=zL&=sq?5SW`aSSL1Oj_=HElI6CCe-Bg8Taxl<@((FUTmIF=1(Uxts@AErz8516Q_O)=;Nvn2D=B`4l^z+Fe@|#8X z-md-W5aNAGWShpb{}NXfZKjD`g~ddz$c~m>i?y=G@)m~`v^h31d+FET?)12GiP&VE zw0eSVl!>90{?FuTx&)S^6LROGK>ERX%pZYSZU_l=+&USYBp71r9fOLc@(?z7b{1Jf zCCAvJw}dA_?a=)Fxy|3E8wr`Zi7d;n%H`u( z37+4x1Rmbl_8Yo58vT-2|9W{XZayXI?;pDlUjaJv_wnD1C;y=5jFr#JEM0EQ8Jb^% zL)Np!+IPeOjH`EWJ{63q)*2 z#nGg;_I$S^g^HCsVBIiKmyz)|h?CFCtrW>u4FK&bW(4GQBiV)Z@N+yydbuM;6L_@C zSFV`Yt3x9G5YS|w=iPZEDCRo{1HkyAxEDun{VL`0i2lq9Bnxh8tl4wa2tLt&J_6f1hm8#IY;M5601@RF8PkdBy$Isx{Hnp~zN zDPESt0dc<1kq^0A!owF<<7Z!mJZ*atl0^^D^98}CT zM$Y%m<=I`ZjchoJ92^|5P6vQ<1Z*Q?ZpQBfX8&yWEinxT0p-kuzmGunA3l622BiBUwP;;jT8RoELQtxp(y4Jf9*`lqx5DbK z#nJ4Y8F;j77wnla`l5I4{$+c7*k_?MZ4n&21Gf83%TvEV1xbk{AQvFVE>Eq&0DXRO z)45oSEDZdz#@!VFZi8ZQvvqJtU=}_+KorH0bL6}~R%Q~>KXgJ5pgSih(c7|wphr+# zyv|{MhhR)0VVA$JC*dYZ8P9iN_QXcO_ThU9go0TE7dse`14Acx2=AtKs~uuCH|?{3 zD_VhY1g+!?;1Tuusd~L_;WX^z(k6j9>fDq_Mfh@jpdx*%n!k%C2Hm|L9}Y!>G!I$+?fTRU+H;Rvz}+Su}a`<*ed_z4u-L2LSWA- zo43zV-t<0{7zbKXx$Ymf6{P>XX@2`n=BKEpSC7Os#HP~bQUi{mIJ>2v{_rn|8AQE{ z^1!Ns`SvqlR)G5p1~3d!?>7eM6;WEJcTv?SgX~{ux4r{ z340Ql9I&vM+rN!Org(welcTynyx|2168!C0yG%{N^8eGg!mj2~TQA;HBG`kyVp(wZ zg31*5R8s31u}9dGz(yfkFy2~vR~T`_986#vfJ@9^LhO(0Xy{0Z1AG+Vf&n!<8RNoc zGqv3#v@r7?wWV*EfYQCtGRrM17egS6iVHv=tN;`|g6D0;I5+18EQ@`BuD-M6VfyvU zME*G6C{h@6#+yW^2?#rc9E7rLEGw+-F-amW#K1T*v9h*6u{u<&%u66xUVD0?65tO2 z+d1vd#b5xMyUNIj4IxlS4nb8_VNTAAtSm+-EcXmT2qCIP59rNQwj88y^7E5Gkq|Th zp9sxFant5B3V59f=WPq96#|zbbnAL6Lhi}@A`GnJa2IJ+RixA&2b_==!8mW0Q&7;l zx4DFO`LZXJbE$)38psVOYH9{R#G3Ce7s7G|Nh+@*g)>^jj&~J+rbKQHJm-KAR>N=s zFBFoem3k>BkzO|XD%=io+dzB5OM_x`-PP%&LDS+56+vczm5>Bv9$^X~QP9^(Dv-3B zbzKj54zD8VFGLx$H#P*t(|DUq3(DX3V3}V#cy-C|@{u>cMB~$&VB_ z?o;}(0j2&v{a!>Kd+9(Dp{!=rDfx|L(_q`%%FJwR8SpMe37teS~U#$bQYQUel^Q4!(_KpUGc#IxTK>XK@Cav#7dgeCzE zyu+YbN5j#c8Eh+kpUXg&6;TFC*W-{kQz0oB_68|HLjBs>Y6X9PG0@+fsi#rMU%;1- z7{*b*_Ld4EEr=X;4DVqgRn*o7()+YuNC-k*q9${)-U3ZWV&1w973GgSwpPU66;p7C45m!Ych^!qc~*3>Mr1YNT?A*7wIp3gIXkTLab+hrM~^X^yQ0- z>(;mn(kos2ht7>*x!Y0O`}T+uA4;NJhH%+inwpx@GlDj=XW!-KLX|?4P$pKgWu6;yI{^%d9&8Sp{~jqMGiPm!Su z(rMlB4!1YRWhn3i&@Z8M$|Z1ariMVN-?GX|Lty83hQGKo{AdNwKcWKo099sK$6=Eb z0)d*ywPmAOn~_UQA7Vm00$;y=9XfA+_1>m@x--huTkXR&dX76eQARvu#UKJWkuUN< zRh6L?3|Rh9m0Gloz>>nbzTwLoR#R5ufSs|^4e|RaYNMXM#>vGfHoUM-s4a~7o|Tje z2=JzprY1R+`_7c;sCp!skJ#I)m%GOfxUV}gYP*$=w+SfERA!NkUaFWO8IVQQwV&Em z#obM66L(n$n_Ug8+*?|B7_zDx z7wElOu75~kIV*OfL03ZS!xfLxUauZglJSF1oH5eXcM*&y688CS6Xtn5k8f7>IW1UO zSp8sTYr|l9g`?Q=$no3_UTiWU%(M>4#kd*Fx3qKDD#iLhEU+UI_ZUKGX_~uxdJuve zZEf<<*Y##$Bn8ZkCs6$-6FnVeKS8x~KpF5+{)yM{MaZv|m2<$`3r|&j(Uh zKQMEgxwMq2x8Lkg%uC1VKzIF;<75QK!K3hv!I+8D?va*b+yvOO%)DdqcK$U~;cdz@ zlL_ydlY$*-)*W?m)I44g9vsoUjm@~d&9M3jZ$gTyR;2!&HE#MX+m!i)Ua#%Xx@eb$ zLjT8PsJh)a@@$)_*4*vXqfR1L*Fv2AM+_5v1d*@(3koJ#>|H}-%Wv(?AOZzLLt1Ec zBezH+ANlotFzwKnoUAOV zu#N9aPn}slR&Gd-jEsc7c_YYlsLo0ZE8S@k#2+^DBkERr(gW3+odMj%4n1^AW@aYC z;sE1rG}W$Z+Osxs@l$5Wg=bDNb8_NAO~D6s^LBy{Bj)a&sNB7bcS6AZK){?&Q`%+v zQK1fHS!|kCYiF^OTMqGRV&i#~@k-Te)Xj}ttA$t6090d#UaMr_UWw+e=-J7N1`^{5C*+N^ZQ@(xlc_cFOgBb zSsAOKv#32sxNz%&5qsab?M%N5k?zt{Gd-OIU-H873(#X{Up}{*eb7PpY?xFvo6zJ$Gfxv73X6il6h8Rb#k z*3tf|;aH9R;SZL+o6aDPgAE6(Y0oPH9}Q|xM~P4HHbnN85IcwnoErPNDm5G&_#Bo; z=v8mV$}!L}GTzPVZMLjrIgbHi4y{TU(f$e&aYFY?H1dJAac5!fd{U~`O`HGqtQ~E5 zVj`QW+==lPw`_$%j9cNbxhkRSW>8L}^$u||j(69Sby>ak3tvx;w^262ZerT$-o18D zqCWc6qv|-b9zCRDQr8m#1+IvKsbpi;7v(n)EIoB0pa}Vv*4(OL)jX_GOOCBQX!*mB4gT{ht&-i>eV#G!Jxvrj#^}3s z?DnXtYj1CW)JnIWrW+#{qtx~;>7)rJt*E%-l&-riWx#3(frOsNVV8YNaPXabWAx_j z{%vbM)11>8y*uUOwc68NU%ol%td4z34I)2-a+>oBh;<#zJ~3KT;$8s>M_Nu(J-nP* z;ruoP#lPzL@Sb|-Unu0D9HLKco=+rDOppFX;BEc;EA{qemADCGU z;6|(9&IozAXl@q{f|u~Bm>Be?4F9qW2|zgD7syJ+UwEXVvf-lXHxfbbTCK&d#!3wT zLoXpaTy}OzP=aZ($4INDXJmLk>}UbN1)uVTY5c_}6b&co<6MbINYav%Z*5eAH};x~ zvbbFq=|{6>J*Y^03u=Gw@Qd_$+@;k&oyppO_x-A`@5^fIqYu(Pm-z#9O*w+ zEixU9Z};4pb7eGZ%+AG`lZ~0Ipkol7bYfM;$5uWh6=k9vK;9dXimr%; z?}gKHV_Rk4#KHLngP=^_%X7raS1lC^)!d2~N87geVDp&SRr}89{f?pmi^5?XivjPa zL**#+lZ@?;UmnGmK5OL&v3O#`)9R|}t4d}C>)z{iOU`kaXH`ZczeF5-aZ6;Oj#<@u zC6h0rYnYn0$NEi3WpiW0Hwp)iq0Nw6GwD!Eq|lj@pHC$5n46m${VDwITPhxYeil`| z1VQ`rpr9cbm1ozgy6O+S?%Hy0eZBU9dcO9AgR5@sv#FD?q#!^}_cjzv74IH_1S24J z4Y87)LWF~F847~J4^cgW=vf#lG2dRuhL@Wgk#Rq{2>CeTLe0~m1~KOswl+4B8yZB@ zMblF&OxNdyM9ZrgXvo;N0!gQ~NBqg}&J65+nl^DS4C0IZbr>jt=PM}@^yM2`6eawO zj;r|ev)whL1W*|0t|p3kh$5+^#-yad?U9-(MRi0lRI78ME-T?Z()B7Qn^xT>IfpFv zSrJF}^hfS1Rig&`ke$<==-D0_|ICL@xvI;@cM&(5P)NzVEsUI7+FR4g-XkoO@1fT$ z=18+LeOVsCM0pN4A+3f-j)+aV?mOKp`09#-jEcs79MN3kba?!=O&uWsyMMKT$h!Lm zuhx?BZ?goBqbm>BUkFl>^xuAh^QZppU(na<`WG@8m$F9snAb4(4K3xJXTx_LSFrFO z{Z}%N_rIfaQg8e_I)@MoIUN6ay#IG}jv^^S%GTub9&TSQbol)d#PwyXtu(~tP3sxS(=-@IqhgQy zP2E@o4N1jJC%dz=F>$p+*q+$I;tbKZTcZBUsG|Q>x1!U!*abWcN55hB2*Pda+-erf9mWBhA`ydg) z7*&pP@5XmFv3k1bYdoKB!>EtVdZF8e0;8R9!wr} zl~5gXQs5RQ`x`k!>dsd zGM7+>P?Qu=rUo*P70MJE%_2jlN*ObyQc)tM5>n>*?0ePk_re2(9+gk0ZBLZT;Ndzniu8pt4Wm9Zg~|m?q`gH?zVzY z$&lRdc(7plLFM_nx@>WOjQIJ(1*n@bS{`ze0)$#Jd;a}q_*MmM0@=4@8ipm{i6EQw zy@(J?+8;@KIdnThrTSw;x$Vo^=3S9hs_C2e4Ig_WZsaX!6zg0{5Z7N;H zG&X6it%h(^`tkFp|6qt?+a`-lEDEI;uU@SOD-L|1*CrbA@2k {Le3(%LsR(SBk} zaFwN?Y_s?w2HK>3Xc!6ikB`%HcqYqS9+6y#_IhyRCw*ygss$r|nS59Hw_@{QKbw04 z0~Wv`{Fe3ESXozI)0g4)pg+VXyE4%Qq`T5b;+D+*cMoB}>RZfkEoi)Q@NukWzmNRD z`xh^ch1p?W@<9et{#^4G?OJb>mRf;#rKP1FWsQ0qfV~1D!$7LaG~8XEKKH12VZj}5 z2D{gqAm#R8jd*X}gj>a3c~b{C=m31zK^9c0gj_v@}tRl`|@KO+G)JYd!QKGCC_}3)8J#rzmDD#Z^a# zNY|(h*pPf2mf)vGspm3Wv%3BPuC6oY)>OaR@?3=NnVqD?SA4q@yDFFn(c-(fqHGF+ zHS_JBT|CTl$4qf&SsK!tDHP0C8u2HrJbY?Gv4+A@*nX61YhN>c5_blQ`E_>?wWod*1pevK}q@vyYKmUs^|5) z)dII}ukz@n6tGg}mu~-bsEI&|H}g84O(;HCH@AvKP~Jnzp1k_q`}Zu#n5!Nb>39HF z1Pa1y(HB(`PR*U}vDqK#oz8TdNHFgzDX)PwE8}(x)$f{5r28cru48$crsxyb(zY3D zuCxPptH$#V+|`Z#C^vausXKhhqkeEwaOch&^%g8b$LFNV<&XN;Tinu3IJscdV3Bsw z(lYSOi2?WIHDL{Pbw48F)Kye&eCxlhC0}TN4%^ALrp6}!5LxHq*|80hCQq(^_v%(Z zjXZ-v;vjWZ#D%AB;dHy5MV8(tts;H>*{?vU*_|88;5)2-@T^8~S#C!0dYs1)JpP_^VeYZ|a;wV%Df%qDUoAn1_*7N*w{c0TB<$sDDg__w{QR(E6@`an) zE@t=FRu6WEF-tKnpKxVREST`KzcR6~riK1$_`&KE>HhldAJt19^a;kP*LPO9nk%@4 zw6nR)t7UfE<~VX{R&5Ey>xr75J;A(nh|xTPamT#`enD~=$6~EF@eecod<#WamFtvK zJg%I4QxcZGTDiADW*>tkz5A{z+Wl;W2yJ0{Kac!;z1}Z`vV0-)RcX-NKE2UTRBV)! znj)-iC9FcREdUN9JDfHp>I%u8y4Sdh^t4Iin+esl**rv`pvUXwC>Wx>qiiZ8Y+Ji8dC`{oewu~l+5mdu81 z4=zGXj`0sJDmu_jBHcRW|5aYmpJj7!)ku}Z(wQh1kJ+P?nKV!7fvT)UGEsiuYf*am z<~sjD>On5m4~HAY#iV3bm}@?KbJ+dMwB583Z`j^btEQLdX@GhJB?jhE1j>R-L5Fth|$q)wOO0@l?ON&MI=)_4m{NQ#8_CQVBI)bo*^~LjJNfZV-7f>zzMIG3JtKA0sl^MD! zk6-~U4iE}A4#maC2a;1@44$&{d4YpqUbQpJXK>UB6HA4?N;`RkIVCo25I&;n7`Qr{ zRm+9QP?UOrXwRUO(Ka?tx|*AqNQ;3&cF{w^DnZ3tH4O_Fyrig(_PD%RXvul%A3WB= zKBi9=Y>gakQ_o+hHjmAl9X?|q*Q24;Zq@OxIFm}2K>Gg)XDUdgRcv0lnxwf>a@zWa zp#JjM{(4>Ci7PfH4l!jz{iV%qCT495BaCM()Dm)A!i=-rIpw~84?v(T-OtCPV^ZH` zCrP}$0tXrzny$aV98F_O3k$U8ie#%lV+R4Gxu|PGfDv`NjjP{XowT4_K#v6*gV_H4 zYdJKZN)kF4kdLt=#=f+SJ-@AI<7mSnyDY<4KU;9j&E~^%_ZMl+-i>-GSC>BVGEr*_ zbx{^;E478eRm0tlp;1!Th*o&vMKLpYdAp2N2zWo4hAMLM)TAL3=PkK6kvs!_b5ZI>iryrpBVF(7m(SZ#%X`Vv@~DNyz|#pf z6`2+N{Y(}KdMmek9XZust9QN8j=afY<@OJLK2mABWaxZ(e|7XqX+!d;5hWSpQrYiF z_uX>Me}`X!Fk?Bix$?mQ)?|_T0G?O4Hbb9(^Q)(88CV>QylIYnskI|%w>_?lMHe=% zta7h;KMGa%+vU5LX;j|slC{v`w|t77&*R-AVH9mIO;@@wk*Z}LU7LI_4*RqXH@%ZA zT`p!jx7S^_X4aZ)mk>}$eTp`>S3*P6Ohf|xPpEvQH zzDDcCxBk%k_g~D+o9O856)cUL=WR;cRtx)_Gw;947h3es?K{EM@+(jXRR)Rh_yuH7 zJ9|ln_;ocGS#)~6Gx^qSNvnjBlDY5gtIK((FTPD_FtAH+7%oH9Ds8xL$LVNP9MYb> zZSG<89+k8+{qH6uzsy?;<@fiO5=R4Mc^Lj|-hIPp>Wp@ie#>={f~?@u>2iObw*^Z* z2h9`}W8#MIxD-|SMQC(4&QVCY3A>&&x@Ek(*qvK(O;0w{ufjQqdPXeTj`)x%yllpq zj_O}t{RnE62W+Tba>{hDXi$~P$^YWptiI&_C!8*_Qx?-ij0O> z)DVpHv*1!VGOcAG%K9m7n+`;PKvqQVBp&^#eAMFDnNQ>`VRSeA1RreamAmb@&eXvu zKUh=4P4C9-z~G{eN_L@iZz4sDh-d50_h?oJXow7}E8E>@Ve@E`qh#-dAoV=}3ZgPQ zPFqpA-^;zkP<<`cm zG5gsng_rIv<3R`RMiZ4UZLSROv6;Mda@p6+EBWtS9(7ngqvdy(GuK`ntF7I=&pCyj zM9<-`CcMHh-+eP!G=q(95S!BzL5h8?kNMu8x`M*C#5%FD*naawNxfckNzJPC8+>;b z6^a17EcC}MANN3EFG)E;cyX{dKTykB@2s@LUl;XuFYHpN7Y8(OD&D^5Dwk2^`gptu)aji#``0qF2MU=#}$HyM= z{eF<+;AqXq-+$qM|4v=|7LAhMKVe@2wn*@B9y#>?SNX)}_dlW+|61i|yn5{0Z2vT6 zU#;ne^_3d*)SnGjaV4WtKy|-Xd@aiQmnfLAOI@_Er@9@3xYYWj{czB44`LfS;w#SB z(W0kUb0u8jCmv#Rkh?qEoio|pj`E^8^HkdtW3(H*Rvvw~e1dI%1D)~S(krtExt2o4 zXS)4``m*QPhTtY2 zow%YUrDf=F^)C4Tm&1F0WxBZ-`>L{4r1S4j*-L8)6AYBuem>sb2X@T(MA}0FMb{>YIX5Eo_HwCTLur^sm0z}WuL9@;ozU{s?%UtbmOrXa?xfUZ z9=;uL(FJc4^~@0kg*8Y;)cBczB)oMVF}ANl`bKg|?njzOb~6DWAh>JSEx7aor;oDS z`|xW+1Ao4VpdhFp@|aCvB8?=PEDZzzrLMvTD9p%iNErbWATc?bs;#9(imY6ls5{7J ze)#Z;)YH}&$3=)Z!7Gx@pSaq6Mf3KBx?^LdUO5pFU_9H&P=1Z%Yo|VFP*O#19^l5?P7i?05 zbfsoqWBoof_!T>JK3<@26V|u(H*#V6oCfp#jM(q}lr4Iut_k{wwY_=*cOpEpxo7S5Z9OU`#^6iIRMxK(i*1d8wVe25PYMk=*N#~eT%yqfmj@$*wH4e z?18G5@c1XYfR|ylKT>kHhZ!8MPnh3rX9~cV4TNLI98Da$$7z}!OIT1i??M^ZKv2-> z8|y~-PyblY-r>s2UWH8;X3g94Q4~O%vs7mMCi z@LBy8L{av`9I~{pgOjgKu+q5GQj$}cwt5WvjQ`whmoL5Q{W3rMHRl}V);>X^u0|o6 z*_t;~ebDws+~;qBxMWfJj@Q3~Mn z_j;Y{_sryKN#?<;OE-q7^89@+>}-)2w*A3xrsl|8`@&-MM{Y`Np5n-s!N!o(H5X1V z2#Qvr`5jZ#u%`F(K09)J_$Uw@(WG?MMhXrkUS3wTCV>IiTlK~`-K{esYUTh*K2+=g z3N%trVf{RCLnLIODE()NJydNd3&e}Vw!o*>gAP0Y4ZM!gs%|e@Ql?8kdqcHu(vs^B zF4{*@No%ab`!tBja$g=xVa661LIai8D$c^B=FvdVGHPg1+ji+vOPD$CjzFUk#m=ve z0uzpeSFa8`IXN{^nyvODNX<<0mKqouzRA9PG(a>;*7;WxgAQ3C+cb=EbFEX9)@oHJ zrIr_Q4sls0o;41lXp$G!xoj!uIj6=rl_}3f}3_l*^{mn zy^+Vx|8^n9h171nkFlG+%)c>0jyc3+u>9F@lot#~CLcH5VF^KHOdL0yvYNxuh$cIh z2klsjXh(6IbCCR}v$Uc^&kEfv=gY`_0p4@(jxqTD04#S6 zm*AR*dp%4y(@$zc{_rD_Ya;o*})t({gzAxy$6?oMW-GG|Q_C zQD1PpxxC`!C(ZRa#e$c2Znu9?;AuQLgRM({#&}DESJ$znRo!8t-@I5<_S8x~Pux?n z;tnm+2bBaP;)`-L&+V06-`Sc`ar?~Tr{2A?{4>4luUFx67`FU%^K)BZ_i~3LzVXo? zU39sbjkmhr7e(^&3`8Qd)yXJpYSO>T_Z7J`um1M5fW=74cdLN8T@ndz-h4@3tL9b4 zi|zj{?z0DGU4MEz5OVBrXfJL|uIObO4L(4S)ux9hrF8Z6UpB4WzC9C@Iu{4ND6Y0>M1277aU7R?6HzFc|%huAexR_q9^@7wR^dU{#m~qvv z>{i_U&&oagKPvaY51J3xgP~za@A78&p}(nsWF25W|C_$8fQ0Nc>N_>drNU-&lGnbG zGg(tm;D?y?HLoJ)a>;a9ISO41_fl4Xo1$Hx-3*_ zMoL~iWX_*$^fGb4PLjjZz>74Zp7X6=9$bMA+H806K>4LtFH6m|`PO2tN+~OATI3>< z9PAfgMZ$PIcy@V(G!HyFq?>HKYw1nnAOyiaWo2ca0vvIV_Ibdo0q68!y*XrQ{Nu+J zUJDBgW^scbX$%k4V!G6d)n{#X(*Q!iBvScDdK|VZ+u1D;LK2%v+I?n5n zmUJVP>3lla!$|iR&*3R?@I=F!FPfXSTLgdHr5bV+y9|<(fF>u8=9t>p+P{i-Y#=}? zW7paA%Tgg@E(av%i>j50rk3e4GNsX;3pUz93R@(oNd$cBEo&`!f}o}>e7uEi(`82P zu0b%cYBz3T6?C2bISXhrBNRmNY+ z#$op(BI0Mh>SX)SH|&pt1IzTFYLPVtuaJ7GqeC$N*k_{2oTQ)ac80V8=1rfs29)En1K%K}r%-ZX{?q!{hBDsi;Nr#O1qLVg%Ishl@I0toGwdI&QRH}v zq0yOZ+4A<5MHvOTTHQObYdT~q__1lBZ{SzrEB)e3gUtPFIU{39vC2qC(Cq4#zbsaj z>Z)h9VB`8Ovp?DGe5`)Z^F(osKR_AL1R1`h+}FKMu*yIakeP+W zzww8`X-o;ejxZ8-HguY|_j1;m6n*^1oZJgDBk+uonG&GrW58vhG>Iza_v9|cCtFJt z0!E#h?awUkx>npZ>XseizA$!xW&|WH~tI_IpTLeS%XwQff zS_@=n{k#IPG^6io{`# zzp#l!fyL)QaXy`0zLCZ(TeTf{L(OAv!j#6;;xuFQ)bC+C%g(g2>;E6x`?7%ZZ7kK7Wl9nr|5i_HH|Y#VvW9s+ zpQk|r*O$)vDp2@0X42*vH&0_T{`aJv|4N?t$4ht~0VmmF|dv;H)=)BGw=6`M@(P8`Z^KX3`{{u7Pf1oXlE-FzS0?Og+ z10#cl>g5G`>~J2c^D-a?gK7BIg+dOklKVrMp&@}=SBin*Yef$dFjg?pyZ$Gk;pwBt zTnM*orHx%PS500>+F-E(h29CS;X^;W=+GadN=ue9a(0%$WJK4`^NERxu)9!J>IIw2 zv?f+zW*{MX6wWA!blvcs@#cupadVTx(7~&!^BgvBbcJB^UK-J6!&VNu9r?j`E4n6) z!-ubvThEkZoY-I3#WU7$_MEoh*49?p?hUL|-Y+~${^kN)dukq0zWJp{n#<22RMI(>c=v0>R-icNenmvXvZphuq zHt^)3H3y^aS{FsClmJpWtM zkP|{l42W$AGhl82wrI+679kO~{*q3=9!N@nXa?%SNVav_>9EI-gE*y}NF?ALpxr7+ z;Q`jx*0G5wVIdX+4m@9q=@ooc`ywkb_KvLs82(=XJul!N`2wAmKST)ITOU>4^`|>q$sEqS&^#Ut`$PJrCAF3e}icLh!L$iRHm38U> z@yS9+v(Ww`KHhw|H4CsrSRTOyw+{6? z3o}qZyuC80J25dqB7rS-jdsiaGsQl%i=LWVz*KhG0pb&!ZGmhp4WSK4~6 zA`#A+E+%iY2KxK8Z!5}*6p}};bQP_^G{1&q&W@=F;Zr>1dp*SL-PmZnl1_*adD;nz zBK|nsE6Pz{Ur!KOmQ(KAkkKC|3EHgt12lBnNiHJ=Dpc~>&q^1HdxxXh^IG>VdQ2qe%bs@t!S=bg7n2~3ZC{N$;5XnN7+m-=q?^z-pq3$Z6XffBxGA9CWwwn$4$JA;XfFulAEUq!$4xFH3d zoS>i};!f>Tr~Kin_1fkqTKR=AHG?_StAl0l-t7g$nbx*oF@4jsW6utQ>xyLiEnZJ* zdOCS1qoWLpD6Nwxx0^NPdq@!y#)byn+|eQ$m#Oa;YQBB*MxE?G#74Z2iK`yb4kwL_ zf}l*Q2Ceqc(W9%tC0#@EDC2HyZx2Qi1GBOK**K@A+34lXcwNMB6})>2`q$lfTP*AE zz{i#REJU`b#kL>_Z;+5-1+wm9q|i+;PGdUA8C=l;jTo0nwQ!#Jn_RYalwScnm13Ln z^Y6I=*b?UeAbcF z2=cz@6Y_<|S!+1uaMJl6P2o|JwTW%H_lJ|hCrlu%Kel_sCnIze6NJY9&Ol+J{g9Km z-NunQN~HSGG(V@|u<^o$#}bEY|IY*zo>{Z`ft?LpGwi4(33|U7h$*;vI!!|bOVaAi z&>t}UABg-`Tdf^GtUvjg{?a?FOOOx`OZRdVh*74W=R^;a4JAi;nEwv!xImFRY!hj{*| zmT1wH?R@G0YKZ~}3KjkPT#dbMFKr3M8k(`&;JbP5+z#2irJ3%K6zFCNwGFfdgjq1` zV^c0vbEQDRr29tyIvh07yd{y|dM;k&!U!G9;(#8s%Y_hb`XLg{EDB`A$5V;q&+rg_h#mRm63~9a-H{XOO$Ku{JSEn& z>7GrYsN_E6G?$*)a|WboGAQ|81^ShQ!i03l!C@bsWe>($Q}UsCyD6;)9vq}au^n3E zQ1q8u!PWjP(mQ+ZTufdbCvoLfdrs{Wttt&p8$v$m!PwW-3qn?l6(aZ#x)lCX%OK+OX4yG0VoelF;nt0Irr|?o- zUQe&}IISZVzx-Z8}PqK6Lbk0YE zxMYwhwFqjQb5()g0FZca^%a5gpLeNFL5U)`G)7O1GiCA!nicA*y#NtPvc_1rm-82XVUq0mi zH=CcRGO)WVr9?Y`kABibRW;D$y6Wuxhfrk{uxzcJVxJYz(z%RjEo(_9 zELBLK5(Uw7E{a}W=zU629$NWfhSJSaPVCR|Pp(pTmxq*ZvCZY4yKiY@vzAnUdM6?% z4>!+4QF9-jm~C=N4fzl&rGefJ#V)Uq5DmyvX7ieY_DV=9U!4v;F?WjacLW88rDEr7 zwG&3;dM+L#ghFX2=XB7n@hy&Ng1slZ!ceGrd2k`RC8u82fM~M3w75d=(S#yq(D=pt zp#iw|+Zxf!%+Wr3}5$MKmwqu^qHj?ewkM^4*cc{nYLj0$Cay&9(K2|>7m^ica7p5p*@}HQZ zO-_OO&DFe<$+P<_LZyvmp8R1G62hcx(RPRE)po-zXOF#&O&Sv|D_>nbPIWM&z}$UU zdqh1A&*!!H@%oJplalDb7gQefw_YS92)*gnVSFmrj_KQ|L1SZL2*ZPyuU{WAGBRo! zQfe_;$x=5_|LxneM;q*O+71`c>%GkiKuC}p$@PZCL?_bsTlE&DxXI+iQRr!$-~DUw zg4BaL-7AtDbfpbj!HE@gXIDcXQqW0IK%{}%C8Jx(K)>$J8uS{8tj5H8TR+pKSvP`M z#N%~0^FKsli)LB|)FYR(PWCStZGSR_r8{G2az zLFRf-^uGIub_Wj*Cgi?k{#W)rk zm>k0jkfD5q?NA6D7tIifP1%I4FI~D0??xewA0D>|`Q*nhUw-Wi+lwft7A47m9L`KA z{44^XrzYttw3%>+%zoRwV(y7h1reViRu(>;D)>vXZf>1e73330DR!Ny!I-V|=kegA zVem02w{Z-8j!@kLV7Vo-hhn7gM;iBkJ5(%okG= z@v}b+uKqB1^23~3jL7a!^VCd_c=FB4npz3=4<6iKX9sMP;To>x;`8rsrCx9Ze1ACF zk2^xtLD<;jH6fo{NkXHBTQ!~`K`6a`zENU*Iigo)fstz$G?4R@-O`ss%0{HotSzUs44EVtg^_$JARpSOF;Be${;agP`Pm3%pEZ~CeMyTC<~d9l zal8Q}NKKhZW~h8d>yB&gNRJ?PJPb{aZhB<4_u(iEug%7LDi;StVA)9+VxKy-8MQ#m z2se@Dxaf$9RPI?x2~3Oi zyidF?i(L;5xTU1F5YnOb^kDcxr2>YJ_C|57yYhJnzN&i6=gzC=oB zTI~x;rMoPM$-wcqT{AM?=-5h>+otetCeOpMd+pA)%c@7@vJcsu}KmF7m`Hd+|+sVDe`Jg=FYHMqIAmf&P zQ39JB_CT|iI`|MMXd86Q9^Vq(9M!SmUvWtEw4lNrsSq1;;KRaa4P1j&q?4PEnhj3CElvyk{FgXw_d#k2g&kwdq*+etWU9 zprt1ka_EtjedJo)BFr!DF*(xWi;$}u{Y5Rf?13#!jmo0LAMV$p+!OZrX5U=(jw$cQ zNS{AdQ(aRW=44AfMz~70ZT`PNIziPD+pwYh?59L6{q_I|DgEMSCwxzcH4wb7*gb=G z&QDXAybku82#=5S1~X}%B21m`fF{P@%3Z-spoH1p+e?E>#;-1){W3J+(wX{-yx+lU>H;#zz5=ZGWjq74-I{%rU?i;y`2FuHuM__aC(mHr8l*=2 z1AhK3wi3-(fV{*{#hXlf-dgU}V(G6B;8%o0i2m*PNZGFu?N%tIgPoy9oN*pP&CC3;QRr%JOeI+Zes{ zSmzs8b6D@`n%^AAvoR=uJvuAUgXGewbk=OMyy4#<>%aGD{8Q)l52*Iv#8GXI6P4H@ z^9ymsn{@s={)rx&Ho#EyufEoir=&cwG6-(h=V&81PGN7baV>!TEH;mm`XdJbv%(5Q zT#2Ek64GK~wB%+f#?H$be8kJs*Y>$qa#vUxF?QuP zN^2Z4cP{NTFXwqBh`bac;-_CUZ}N-03hEjm^OdMCJJdfl0sZd+)22IsI?;2q{5t0h z&ZqBkw=~fy&rVueGw#_E04%1I5^Ys*?T$Am{FSG(Z}5BiJR2UiiIR35yFU%@3HTG- z39TCH?Vw?os<+Cb7LqibZ4(=Lqko->yS1_lPkGN$6W~L}{$YFE?aU0n? z0gD1`dEICYav8|R_QTLNt>oW#WBZCfqAz(Vh>i%+mnR|mq5$wJh>QRjTI%K=f>G;~ zC7`9NZ*NDN8^<9)9>w@$94T)GQ?!pp)I%R~cz))M>rs4r`3Yvo zTV}N)sGMqkO>8(V?HpjTG#2qPIhnq{6^TtNR^^DIFQP9bGT}Fr~is zJAzJ9bcD2VJrURKlQiOw!ia%`&euc=^d$78$nz-gUp~38KN4+j);(O%5}A>FVw~Okm0emiUckc@}X^2CTSM;Okzv) zTwM=9>cyPgKY0~w1Ii+y^L0Gvoo>GO;X-p*OPZzL*KYaZAT&V#MJ)ze7kO?y2?pJ- z8}pU=i2RahX8a~jk>vvO{}88;H^w?fuOg^y3?h$@^~;XP>D2C|?VrRdBw+!QawWcj zOUWQ7EaQs<%IHj0~$F7E?GAcGR^2zCOdA-eA$NyhhZXMr#_Lt6mXNOE@HAxN4Nc=4p zMW1`;{7WhHWbO-}x}hA-&&|ub3d{^z7k4=96QXsP7m!G7yA3~JJOLr=qj+A540X(3 z_-1wKq_3mZP;=Tv+v%m;A1#4#P9Vid>g5kS#nm&CJ5G20%L4{GLm3&FfP9>tCm68^ zr$1UEY?}i&ZG#M($t~fIza$D~X-U7~bC1HFm$0M|rJHqM9a!85dz-gTL#GRz+*?fE z!GM%)G^qivD538Huy)BS19$zL0m*p3J2?QG1;TWloCa;;;hfE=dDicE$lzCb{wTZ$ z$>IRL$-Cf&m)T5Mj-W|S_bQs8O~q-#^)zrZOixc=cT8ORrWH&~ZxE(Hw^(>~dIG4)D zK+YV+9+yYJ^CMNPZ=Z^Vo1dar1S{<-Y`mJN48F1d{L+DID>(&2u&08Zx{7 z*=UI{EeLnKJDm8IUXAetd-gMQ5A@B_q;H*Qe=B?ZJHMGLuLJ{#@PyJ^pf`wRNakus z)3wE0QcM4xOeZ>pn5zwD#Qz{$3$qQn^RJq<>(c+PjJjRHjj4i6hVd=QRMxhFQrMO5 ziWhxwH1x}vVncyBN+-L(D*Z{s6VchhiShxgQUjttV%z21~aIDU9^QKK7p2)au#B*0wX;^jSbK=4Q4fq49qf*vz1V!kI zO?yH7q(k4&V9=EFgytViSbK21-4JtvXU71q*vIPR|bfMMozm9`tK)CgAXa zY$9YpWkmN6?`OA3{%s-O zP(B=;FwZVCY+!iUDX_8QN62@pwNKw{?X*sKRc~=cbw=^nu>eo($)hMg1j!T6AstV- zqo85z_7hlIz`dPMnkoBz5gPi2ho=S?xgQAwD8>-DL`ia(0EJp9p3C+K*3 zq^w>%U&-r@3}dUL?K)22&oj#f%eOM*(w<4eZwb$hem2*2ncgS^mpB$y(x@X@&A#$R z-n4Y#m!+`Q1Mp}5?+@t60}CZ{pW1yc_(MzfOvE_};NzZSLD zP;qnX-ohc}X@e47L5|jAH#U<`w*(o;_7-ia?^q;-yo@)k&hlI+?>E+8>$7p+=go~w z^it*XweyX3F~z|V?FBx^_m9}CI}$?)u+_q60&lbWqwPy#P$Ks0vuDq4(?K~@uV}zP2k|^7ZRcfTduWh*ODZ|w;`{=eWc&8DJLhVaktx0 zTH{7W#v5=r+y-~J5!($I)1|Ga=bO=fl?La=&;hgCV51`eKo@rn2?#2TZDIg}=XwH< zGE@DC#EV2i#~9}|6IXM0mnM_R3r~3OsjR`6?YT(-I%Q<7M6!m)QH`R7#ZGKHTIgaC zU@l%96^VEwfEw^VS(B@)s*d3luu3JIRe|<1jA(kz9S5RX&~ruj#L1KX%{z-LFpS38 zIm2vCKx!#}=oSwo5cIM$A1)Y$A3AyBgkSSo)RKaNf}6A#uc1VbNk~xDUahAx26ef% z)C#*`^UwEp1=u$H1iN2eZ7lBLv1f&_`YIiaE4h<#Ru!cB#+$SZL3yzCGq2~~zUB7c zT!7an)h-5qr7xEv@x=Q7z~~O5jbPvRl{=(2Cp&u-H|Sfc9+f4C^qwzWW^O zlg0V@r_^*eJnYuFX-sxT9J}!Nwg7K@m+9oR#Ozq~QSZmIHm-~x>hH|otMI29jtoc_ zX|?^J`Q3(mB8c{-wx@&C#zQj9JNzk~k$N&umOH;+d~-FKMk@a;?|jWECF4#HmH>(C zw+ku{`qduX(!Nwjr~cBRzG5FK$vtA*SbafmrQgPm4k4Fpr_8L;9(mQRR#V(j^Ilvx zcS^3Sj_NP1GT$F%Ah{~6>$rBL6cv@+aH+AmNRNVAad_Cbl@?w+{e69QLOq+An0OgE zuw0asm9?WHbZ>o(7+0wXgJUPjZr;a)Y$s{g`C*0jMJFr>*^B`t;PYU3E^KBb^hV2qJA74qbBp;iI@r1tP$*c5n z@&RWlE8bX+1UU-T(*MIv=9^rmWS z4$}>s$w})U?J7nR;gr*UQH%^o6quxc>Oi?ck05+(W~O3`3nit*4#nWrMCqOyDU0cf?m#YPb2c^_r4zOb?{J{E!KP15G|4A zmFp8Ne8RMorS}s-0EOslx@bzEaV)wGIOes zd!g2abH3+w8Q)Y+OhL!A3TNZE&aTifd}So;7}!vr>LzF(KmIJUf2(?9vdQ$-Dw~Y? z1sSdU9zjGG0yjsy&Dd-43dkU!yvub;y2Cow_h{I}=3$wAW_AaJ&Ulv zsInFv@z(Cjn|HOG6A5dpq5Cc?^1bG6#$#+=iK!}w zmY{qeWKI*9JGH zSC2*lZ{HVh`)=<0`O%zw&GGrpjZ;yBdI}SxNhHp%`!7sK>;H>y5 z#Q0dB^__;Ll!cJ`rWF034ufAVN}kK{FXwW!F}Rc7<`U?TI=heUNh=#;oYE7cKD#B3 z0dDT`_T_m!>CFeMn-aB|>S0Z4H_@m4$C3b8~>t&_6mpurC zmPwaH$9>zaQ^MGu%79yB){5XuW=LiaDodoRBD!*AydsBkY&&EXq-vcKP_UDumuI8f zdYpmpH@!PY!?Z)JUs;nOeAxgbkcWG&DAREs6f+H!r5Zc1pTUlxv0YQ-a$RlNm^3+` zQcnDG&7V^f`SfV+t&A%_@yk4AUm>OB=+0jjcC1m>Z=38tIUP?)+pZOFB|*^~Ne%Sm z($*|~G&1o1W1@j9ld4yTf5AbYQ9R(T_$2rC{Vq-Ar0T#2K1Q^8Gh@jap($1`1Xs?t z6to|inb>w$%(y(^6@&h={^}PC1N#;a%aoapR@3%qDt zKu?6gDi7eRw=pP>LJMRlxHHBd(CCzIq8YQhV5 zAc6;lmB~_`VfCFXzPZ~U<(##3VvD&Cyaa<_*+Z-`v>r-8H2dLPbcj8{T{=Hs{eF6@ z(lYB0uW2k^vp2j(?Q(8YRtnO!lKy>egzq<@RLme-|7>>YLr4P6uZ055)p~|!$<-b+c%rF zYkl|FI_wR_w-CQA z!i3pm=_C2xsk=0sPVVhL4eKv2zqtg*vv0i}e)WQ%dv*p^sw9V*j9jW(xw$|(eN9c_ zy2Yf8iDK>h2cNpUvBL{_q7l`fLdcH2xQ0*9W*YVuu{BP2T{<|W6Btm&cnmj-T;u(>^xhQXL5V7Rf$XZG?R zANE-|`q+iceXsi7#^SJm%xsl_hq4wzN@ed0D0c6j(|hIj8S9a^M%>)NC;-S<%wF{2 zWvZoPcXqV)9F?DtuyUF?k;181b(}V&qN&40=~2Rw3E^p$?X^yXlA7ny0s$63ileUO z8IfF%5<i>Y432(Q*epdd&+>H1HexHelhnn=C z5c7(EIE;}9=e4$PyBDI@FZD_OKA2j+DAu*RHrdgu5TI<^x3a;b_kW*!Sf+OIw_C&? z;Qqh7(%;=y;{GtTzrLsrE?=cqkMOSiAdl>-Yg_q~H~U_ce(C%$XH@aJVr03%ebIlg zqW{ZF`X4@wf3S!DFWzq-*W|FTjO6!PiFVVOI$UK-F&fFe3Dpy^{o}S}(!sdE4Ex>& zc34Z;#LTIU7!5AlDuAg58vF3o0<30eDJk=FV7Wnn^7O@vwZMqY*)|0|KtmNvx^!z` zDNohr4QopeJgbqka>Le!ZI0|5SQ>lLJaYowvvkyd z4SeH!QptFax!PO?JzW>l_x*KETK5?IQPDQP@pc)lOh7Jj3wuaY{ns@{pSC?&PPwXP zHe;}N&z@^2{o5x!x3II@VY(gu#k!>#LKj7B0x8^XgGY_EV6y5oJI61L~L zQPA6NPm>j3f)_IYZw^`aO(0eQ0Gl);;wI z&1(2x=6EcjN%-Z7jDexa$&~uje_(Ks#a;yD%doI8 z@Mu>7I|dA|b^0`Pl!N<;ufaH3Zz0Dh-~9jqfPy}I+u^K6?FC*EIKOA3p4s;fIatL$ zZ2HY1jxfr!Te0&VH5#s5%le58rs2E9uF7^iFC0#r4mmX+vd}}lG`=9=viI^MNmkVU zWxZx+n#8E8m-T}(YI#$Jel(i1t_sQ{hC&jt&`1jAt5_#++294&8XF-RHk-TG-2)>X z4O<7j`6xBmi@t?q30WBl&YZF&KNjBF5t2N)xFx_Bv>>bR?-at6C@%oG0?f842R;MG zwe!jY@ALDG;kX9hEfAD?pWD89zWPbjL{Lh`P2U83#!yhXs@dW5+DY!fXp6?P{)K0* zeYZM>CPeu-wqq3X#qE8WWqEk+Cae9VLugh511fR*K`h-AGv5yi=7#=p%+uI;XFPB3?HVxp{5`{>y9z6^~pQrFq6T9?T5-h3M?)jctzF+&{L}NpzqXi znY_CTUt3!-(L)VWKdA_T=e<=)y}e%^dZW*QeU@|xf&$Rgwe|G{jYX`P?j%LnZpH-z zH~tjK40!)eOh_(!e#~G~9%A3H);`gFQ2P%CQZfP#rEIyrw)S=GmJH8QcfEvHp1ona zBEl5pf^B8|kLTM)JgG>67$}fDF0O~FN|b9hcP60tBq3t3Zs}9u5R*)|<<#}pM&6t@hWMyekd#~0>ee+7nz3Opr|xGKY|3|LHUj8y)ATc-cWx|_Pvm9G& zi47s>I@2x>NzV$p!Q|fJxxrceg^n95Bs0>!L~*UgUFMxEv;ZR(l8;@u5$9#MP9b{2 z+-*#4LvHM06{|h>m-3mWZ>>h9OKYqi^udQcQYrrdVq}YkXV6f^KKuDeUy6mr>h#A8 z&E}8qVtpV01`eoC6KC~&r**4U&e$PGL!zJ(feqCOPuAF=)l7CaFakw#l2;&@4Y<=!brhUL&d?RuT7JApJV5FV^Tl} z_xpbRDgpEhP_37;01X^!ZoB^l`h5IglBP zP^r#*Hd$I3Ua=ZTI9fO>KfJa72ov6IARiG7S4^wGY>LeU4GOk{2c@LK!o$524Ke~& zSAckHk9~-EPLPozL`=%ib(PP3hB=lA37>~r>aZQ8kPjP=tiIMLudoff_=1K-Ccj-A z%cjc!4U%BXKw53Msw^CfI~Q!10Lc-4>{8Gl!DhkV97|OJUK&Kp0jQp~YqDRN0TI`p zJ!2{VvHnE1Gm(pk`JC{YUM26NS^CX?-wH|FcA5rx?!B#9&0YTn!c1!O=rBoM)_x$F zzm&3WL05_T$4Tqir@7`7!|^2Uw1rz1@EIN#C)b7o3>m6oNB@3Qqn(h#$Q?e&^An*G*-1 znAQbm5Yg@fdJ9+I7$N;NgqFbI-;cHmkARWb1I;$AYq4Lyw3IOD@cbhO9~cI zF}hNgEd(2_udi>Ey#oqR9{_!C^ix)X;%w8g=^zK)uhuL=*%lBfH#>`#c2}iDhrGLc z?xts_6OW-|3k3=&PAeq!a==0(h_HV{Pa=IlAeM`2v`}&4_k6zVBol0(utic zbrxxTjnR^P(AemwUSzVtD?QdyP9Y!xMRR z#)_hC?I*9w$ilQ)Tb&x#_kNVS_wUC(eR@W|`#YFb+1c65{`@;CFhX4Mxh}j!k`h#r zpAm$()2DYKa}*^$UcNgsOtPjq*@`2xvscK5@s1iv@# zw;8ze#~0d@^1?;4-yuUZNl5N`|HR;B<>T%~YF3>Apto*&mDSX4E7>_ZI%X!$gr+yb z{@h+oCHUseo1|-vi)|?0sOUHjAuNzCygQB4p0Zu$ z2ff;ed{xEipv|oV)mV>^Gd-V$M*CZ3i!|uD(9VWnRg{Lk5Z>@n2W| z26U%35rFRUlmDl;D-VZ4?b}n@v?y82Rw$K9WXoDokxE)9iJ~IAh#?xK5<)mCDN|II z7%6Mk>^dP?k9|$D%bM-GAE)oT&h@_Ux!(7W@B8LzVa$v%o_U_%@4oNfeQQ@!-(jp} z@EuO1W5-ql!`v^)?`RI?+TxY`ygw|YP_GI&58OEO_7y3V&LJA?6lxv5bRAW;8{yj& zL$o8x+UNYN9bk(F9{YxIh+}@|Rl;gR^XaU8L1*FO7EMPRlb=&O-+b#npNnh5XEnA_ zi|Nk0mf+|Tl5pOFQl&LatX{|eUd2ONddG-fo2|If=m}m*;dGnS)P?6unPO#ie3F%h zYLsM!S4$XOjL%PwnbM$S&CWbb7WbXduR^f*XUE7zg=zqCDA+Q01RcU#m84VG_e{dY zivXuO+lb|i_!`5cI+q##O$N3cU}_*=4nvemZ03v{R_bVflYljEMx$7@4a-=g&jy4y zsDs)AFIey*6Wb$-_?k{Byojj#_;q5b8Z+bXzFgc&zku-!iLaU;F$av?2>xz-#g+B2 zeMsW)p*tewN1KT&<&vxv+s<>+!PB*DnRvfHc%5CeF} zg%_f5Ud6`Nmbf%q0GtFS4h{1>!eh41L_|lc9z6K*jmK}}<5c93Z2F$12EV`h5Q-h( zQ@AI4Z`w%fG(`#=is#kh3s<{`D^W_@>~LU;ivG~mxD*|O6f>+M_PRZAR3L%pWhP|u zI$<~DI-y70L5EseGMZc*w+J)Kdc8a->i8l%ve91%Kr6fGD~fSzBRzbvqmu>1NuMtL z;8WH=>7@5=*iN8&e!NhJuIngr$Mlz}zxO#D71^pA{m|qsW(dGZ9INo$0$D@EBgw-o z1S43`?010wLv4cDG=#GF&m|;QsoV=>rnzQ_$Jj|@wcEJ+i`+%N-;LZIwrcO8)!*r@ zw(=A|*m%%4H)`ztz%RIyS9+|iI3X;x{%U;wrb^d|YSW8@wKwC{EXSC$!1F=CdE2!S+sw>$0Cmk-H<*OJi(z=H{t*Nf`wVX21jz!6*1&&blIT;>gv&eh z-GWILP8w2#pfqTG9h;$Y>J+yRzam0;1kEwpj2;EDbyZ|q0aPrjsgdpZzQ|*^;tk4i zg@G(4oFY$4Q=(AHV1DLNCx}oAx3mww$g6yv7rj^O^!>(I%(1b%xVTW;yk&A_dH#w` z78-2}O5O9iQU!4fC|g{AoH=*7!wnO2Ak$g+6*e)HoyQ06CV68h<9v-(fQ2-VshL>= z|IReDOBkv}l=%v1m;_Jz5oGc($K~iD)dDrMVD9C2w1T;4YRnv(>TA0$?;diT=Sr~0 z$y=%2SG{^|Up9*>L~(SzRe6Go zLAB3?dm*)P4aqMz4T<{s22ZtF%jSCCLHZryL)alE9Q@XTAwDftX%gAD)kc;VqTS=s zY3M}qAjrzK55OF(mfgw52WAFP1R({v_ha2hz0bvl5bmUsrVF2J<)zOWXRQpVzPDGBzasV1 z+3~Qfus+RV9!*S{aSy^-CTAY01Ou`z9C}s1V!~aH@CJjDbieza`2=M2>7+%E4tN%I z0tcRPE=$kIQQpq{7cnl&l=rV>1*@8#fk^6}?vQ)T>F(O+go{r)I?vat_;k7L&*b@r zWq$z~yXHW~;1sTXcQi*PsF&x!!rgQB%Ib04TL=tSHr^cOHyirO7sOtwi1&6_k`ePH*;eK;nLz*Z^0#2+-{EuN6RXM;d$VVQnk(@dv-CELJi!0WK2Pyh90}4tQ6l!+6otZmNL_W$33}I6d6_??Bqbq; zYh{epVVQy*an&!ct@W&`suK4kuiHj>0`vB1!Le)KZ1ZQn1Tem1K5P<+JV^s!jrtAuzU(kiJ1ZoODzR{8JiNI2jogHRNPD zG1P%-LBBI+M0es5@l~*~5@+h`59ppMD(JA#zq?U%qRDEa^LN$I>h1<5k&R1%toC#^ zP$yfcu#1rN10IH5^+Tr=KsKD(4x2*>0a~^q+i|$NwxZ$$*rz3s zckr}D)Pq+BTv^b6YE~PmSC~X-2Dy*yVEhaahh)LvD_07ArCKLjAoV*c0#E=GP=N`qR%=PN-5fY1#;WDYpgDEs9r|x=s zUhxuxDj1N6Qo%a7XhD~N(}E|rhK-F4m4vE9F5TW-ng?DPgyKrFC73gWw)_g-2fj2k zc%!rR?L z3$U%3Gj+rZ{0}fD<(vSoN|%S_p@~Xk0<;}<%64qq8uR78&#bv->M2LUr--G~R%iz5 ze<0W$;JIedT-Y1MJ9OyhKfLC|V&`y4n>@b~(A)vNOaOKGpup@(@&pQ3-QzYDX~et?o~!BVHCL8Eo|^6rlY;)l^|RKuwQ7toB}iCgy#7)Lyw?fL)W= z#He88S+@`C7=c!ba-c_1NBg3oxyJV}r{(ByU{KKJ5^$+x6qjgPG1CYR)Y8bmWV+8G zlZk@a7|-g7$3hqk<#u;ga?Wds!ZC+wFk7>NglS-jtYQ>2o3QISHGCW+hX8|Etu9^q z`p7&GsCy1z^XFx<0d%Ob=FBHEVLmy<5Zxz?DuIC8f_|-sVL}SjvB3wz`+f8;#r_q> zXo(Wd{}3$U;^6pTF75T>i%gZ=(~=mAE*>LI^%Xi_#$V1raYdFFbOSct;TODR2s%r3 z#wzr@_2pxrXjx@tM*^Rfi)n&xp7%wF#NMYi1bk8r(E2;nm+9xB=hHhk=OBNGef*TD0%>%gs_eoITL{3L)-MU!idpgI3 z-T+8a5a@iYl%K?gBb6d#8r+-O=l5CU?Nt^U6c49uOiWBQ?~GUCdlR*4Z(WiRB(Z=MVcQj1vmKZoQ;fEJ5AhypfgjB> zJZt>n+^+XchxZEVKWviw4GlxT?KSP}cxbR61T)dm0&oP7NSsUr_gool-AAf*;F9F$ z!SNJ_c{A4jQ`;<*X)|ecGLf*p;J3WKf1cRp1vW!P8F>IDaD`8RCvG?%Ws zTf6@8Cv3As{7RqOtOI-;0^)}(Lm6)yG1h0m-0ndr-B9rtKT`$Pq1O+Y>AOR1>^a9C z?V$qRfRd%j83h^9alP3K?UK>7t@DBNM0>7eqO^za_p}gjwXM6SiniCrdD@6|JjR}L zZESM&f`5e*cG+G%2#Ak$y>b@Q*x`NnaCCOkfI4|x-gD=ZLF{#Tvs3-7HMS+Ef8!i!7L`A{gx!f*v32r>le1Uq)@pkxItC@L*= z*Ns_3`8#~^`mClU zn1GFsPJ7P2WJ%3o5=u8PK&=Eip}azhO#9NQh(F&cR{w?6nR80GP!V^2ymPd958Y z=v9J`zx_oW{UzN^3bkW?*1yq{=66$`6uG%qHZ`^XPGebN|24Hk zouZ@Br_*Sz41IIFOG^kh(WxDml76;-Vq42@%0knZ!uf7i`XkgCH{-Cl@9Eon#gydjPK&GiD*`F}c4%PFZC=1~k6ggJ~HZpDY6Fi+p6$gZn zM|il_&Npv%&~2|L6?Q*W%QJcTbBhqdfu|-obr8d7F70dD;EP{m(%KzDYkU!4RG|Tl zF-O7?y;6wOJu>$KT_j4TX6^p(MG{)@o?la>r@^F|;&jZ<{|8Zk4S zT=#R*CAPvwQLJ+Q8V>-$&ydOmeg*(Ne04m7XUgoRe_oC4gwtec6H|wokBW*4ygIKV zRqyLU#(Pw|YUKjpR)zn@ zlUc_b<~p0u6xFf$nrEC8VvdFt`4S0e2F#Vk;SNJ4sh5GxZXfiWa~~U>6u(lm>{4@a zf)=&^dlJPpu`yV!G9uU1{p~CHYdzMdkJC3fnPLYGv7P3pXM}<6sS~2Pi|+2;vR-@P zVUtxy3QgZ)yJYw6^9G{>tRUYfZwvj5@%|j3ZwjN&Y)L>${+TCX#q^Yc;m4?7qQ~Ds z5O{KpA4OBEk=8i*Fd;2@bV$L$m<4F(@f z4T>aO`gksbDR9z~tz^|KN*zFTURFp4=F-)==oWFR?KjF2@DYU+Ve6;NHRX@|(YLk5`lCJD z?C=qJf}+zKFBb@Xzs$ev0R!qxoI66ZN5k*-HW#Gx>z;VbCB7nct&^5hD33+e9<2q5 z!>TewAmBTdKk-eU(pn_@Qsh0+V`_Lm5N1<%5%Pcrff;tc7+*%kG;~M za<{bp7P4IOv2$^rn&SA^lcXvmC1vSod{~Cjs#&3nSClv%v6BD}ufc>faYln)GEX`H zrypr6as0sL*!9D?tdghlaj0EbM?^L(1XGCs;6$yMN{Fc45KI0Hjew1f4LUm#iLF`> zMFGVXplN7a94n}N!ok8N3HwqU9zFA?-}kfV)WbqU4QqA*)MRx*D-QB*g2R1y0e|!4 z*d8bPi|`fmh$~VYMv6$|F=ma^EN3HUel1FRn}Oy%TJ05Z_?MH@RhZGye~5U;E&l5l zxt*`kU4JEHsrvkqoAF;pH$}?EB;{t~9(kiXvx1VxlBDl;o55oO_`c#s0Zd&!QybMV zddQFhMi9O>5D`4Gddoh4T((%FS8dis!S37r0+E&T`WBjW^g>0F?4bZN659l zU9p{zZh7!@zkx_TCwmR@W{Vyufe>BalN#Qzd^yW`lw9BmRx2}=1hVKvyLqa-L_tj@ zfM=EezXUvu1bA1!7W)Mi;I`vwzo*=6ojF~es~z&HG?VqU)`Q}coWX(mLYa-_PZmmC zcQjuX>c;x>?0VhHX;@#67`1s+`akI}4H&&C`8}oAB>j+>_J1I|Tr>8+CA$oJ85MO< zcnv9S&zQBV&!c$$6a*cH+!=@0#p@e}ldB$!&+$E$1^CS$g))WM8NrMWg^8s&dJo;S zBi9c@gH=$wZb&-ao5MA9qlc)Y3!5ffFgN>ZM&$`6JPiq9j9)sN@l*tgIQIO&atsC? zI;3iEpZKjBz>qyZR9oPklI+o|wpOz}xSOy0OJF!j>)tx+AX$6nkBp*6o%ZH`stlPU zo)WcFW18czj(g=V%(i%*R7>vVSh;dBQAr-2?;si^@dxmQT(*^w&YU~> zd=Q*-^4KRkBEELlsSiqRXrdCGk+OlE!Sf+sjqKdxPXWZ47^aqA_;_k<%!QAS*4)NN zJl+?U5<`RO6~TN;9AYL70pib%kfdWdCd2RlHENaO@6*hx|A}0*va>CkV5BBPMgUw* s{Qawi=M Date: Fri, 22 Apr 2016 16:04:20 +1000 Subject: [PATCH 063/439] remove ip address from image remove ip address from image --- windows/keep-secure/images/machines-view.png | Bin 113086 -> 101469 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/keep-secure/images/machines-view.png b/windows/keep-secure/images/machines-view.png index 0c908861225dcbf35d9c75bd8fc2c892e61f280c..557dae17f96dbf36363fb92dffe2e9e647ebce94 100644 GIT binary patch delta 69031 zcmbTdWmp``8mNmTNC*<#0wDxSJJKR0x|CqB|g3B z{nVDZ+YifPKk7Q#%96bFxT1toW!XjDLgWcE= z*6I*~if(<8lL> z$4Nh16&157)d$^bik~&c$qWf*|CHYl3ip2K5S}{=tMGn#C-?+4$kRc zl>QyAaF75L8%->)nsX=NaJQkB{^JHXiT=RL`$+otRy~Tn(pnBbE`6RtDD%1C>LmJ`-*F^n!GXRx^Ms?J7``yI^DP7aN z##i9Wt(?ZUzdHY`_$E2^VX>MCB?*~UX^wmUdW^d@jLo{FYH*Vu1RBw-ySwyv2TeE$)q&Y#!owUHl$Juyo!fwIytz|lszB~m@ zUPU76JL!@ELNYs0RJ^t7RiJhk>dQ^KRK5Bchf%0Dz_ zfJnhYCR;kLWZqpyUasMiQ=GHGovu92>D*PNWrRu7CLGo8?6~g@4GooxE#&3bL%zOS zho#ZU(Lf+Mfv!o3{6|Z7lL|Yxlq{udWkaw$#gex;5KXPegT4a^IUgQT>N)RZH0 zrnA9%=&=)y)cI~Pap2aRrMs^Rc*wsl@SQW8fLrPR8W@1qiSp%tet}?1@c*}U)W&*o zr{L-8WQzK^%g4sn=?ficY8S<(%gr#}moGZi&MyBAX2L<>feJpQ0y(^{DWE^Me~{xM zbAB+H(TF{`*vtW_LbT^6G8rBFC-D7qanftdpxP9_Hd^|_Ka|uMkVr8K^DdS~=D@%9 zQT{z&M%qyCy;5Fa2--%(mwYYJaZ{#L>FMQvh4hte!n9t!Tvgcj`Iu2M~YE$e6(7VmXUEq5l2Pb$)FYb&F-MbJ%I<%-XhA7xxZIXH1)DaW+{r}zDp+gc~ zf`AoszQG~fog4V_v@!t}i$XCXBckxTZ;<3H*kk6)!>y^(K{FP?Ewk=Wp!3p7dFZR{ z>;ZVT$09>Q*(K`uJX0^T=ebnY1z@DaFH<#l#|+HXifzL;l#M%IKK~R2f-FfD==(qVN%T1JOp$>|(3*=e*@y zYgMJt{|43|fedhlG~UBEcpU;h@8v*!$!lpU*`m0#s0Ncj<20FXZRXW|kq4ppjdA-* zy;;2g9hvc^^rAUr;3DCg8VC0gE^{ zB7^67C$TGQjGXB1=Wg6w`Gh4Kl)^PZ?rlxwJpvGclvHW;Khy7z1#@a@b11d^04*t2 z5T&V6dnvo1J-gRcA3L8jF%-KjZg36)CNiImFNc`>#Q*CNcci~c`{S}B9o7!zdTp;9 zgqvGG>SXYiPWjbYri!zejQ8?{e5aXu`bTB}160P-zF{HpnbM*>cN zdq@vxk%8D@J~}-_B&6*8^QwIz;qE^VyOPPJlP%rLfk^g-FS0{B$@w>@Q}dzQM5UIG zvNaGl(8PJ|QoRvlN;Qc|h_)=HVdqay8fLNVqlSEd7~;YWxF)C5*L0e5LiO}SgsI_c z_}|zC{8ik!xZP|FRik7cCIuFEgVpbg@39tx{#Qw57x`k6&k(U{8|N&>M4G>SjHj}vX(RP=%=~7zcSS_L=~dxFhcjQoKS=^|(UWsdlP;G2oG;PJ$e+}fRJ#8i zAmsj_c0w%>uVTlRIY6xwbMF+Fm{%>HJV4DgI}{!gD2FxLr#S!Y>3UJdOhc`*eYX-k z*Oa$P_iv{;7Z8U&wBtlN1g**A#JB7KF{^!c+NE)a-%N{EB^5y;B z*zyW0bokn);|3&F#}NVd%Iwj=#ZWh1%j4=>=~VE7RewN;*0*1h%6G@lorMtV-HL`k z)+xvvG@C6V#?#PSF2@&NsfpMi;e}YQnwz@pd0w4-(p=NBfyzo=Lywd};@0NA>Va+F z4D#9kr5oE*&btNhlU5}(&0)QfL~HL6;o~pu&E#7zu?}FDj?rV%zlC8jw(W_*DKtNY z-Jp2}UCJ1THu>Wp@C0fp*|ODn_jBPuf83%(9<4_Ga|FIC1;indepufs((Gc6E-FSt z)CJK_rXr%xh3ZQ4Br_Q@?j?!Bx={Xt%G2vxnuZC8l@?1FgsM#xQ_8wZl%D54B+Q@6 zk@Hys1oW&BH9~A^unbPQ<|RfXHe?fG4wwCTg_fhOJYJ^Ba}Zm}*B`w%)Jn$6{5Q_s zqD+J6j!1m+&-y_1&Vp4M6|Y4%VTCXW1YUkcE!4=D_qksbL#RIZ4$$^3n*CYCvJ!wK z0@_TrU`Qs=bGN$9PD<@9l1$bF>T3;SV09reA&g)io>CfwIU1?B!ppqPli{s-6BaWHt*2ltgZuKM%B!wu|s^pkNYs%WZ@-K@2O)&`PCi3}QO6(_` zoh*^g@bA>T|E)Q`M1LM&gNS*0`OSYzjg5+8Mdo~$nrRcF(}>Vo((3d6m~W60^*`Tt zdmaOO{g;ARu~eU0k^k5K?nIuDWmbrN!GB{5n()(im1dI=G-1fgSJI$6fs*Ux{sL#B zTgRU~hE12v`(JlU@q*a=+DX4ByFjbPp7C@hTk&SqVV*4{<3fy{=UnU`2cdK~f>i4& z)wTl`GtcpP*elms+)aQC5V0yUa#QcmOx4(O+%Sa;~^OB6mNu zSr90I%lBB|C6S9~dGGazh5&>I;xu?6PUBbgJUq&uS;aKtMLUM$5v$}xn^{y7CI+_((Nn0D) z%EzC?UQ2^UIBGt>!VE8RheLE&FxrhsRy`WyX{?AGJVDHnjSdW0mka0lN8ci|v=@!< zIO9wQPu>n?JQGljpwtmvk;^%i28-;+93^uEW;SN5rvws*KSr!?pL`Il+_rN$pQTlI zj(hS>xpH@6<|74YxLvSgoaxpJpRwI|xxyY+pr|bFRujv(Z4ue>pkc+r^WB>a_7z=C zzVqywvu6x*#LZ4mNA->IFDQb|R8|C5ca)B)B^&oz|je z)J1WR+7(C6|Bf7}iPK6drtfUM;az~(wct0$HsMdlat{Lbg<>4n9q_mV3N>b{%v;<= zdxNJvE{E+#w!mXmuSj8sDspZHai97iS+Y=fL{k6ufjC*<)!pk(4;l#@^ZDrvc6IbM zLS<1lR#kqvoOb7Tpfg>x{tu}}a;BqGifZgvHi;ofrN~YDn1waSZ`wIPXY#Fb27ASa zD{?Zhu?n~ziU)xNiFTc>jb5WM-%n5Z3{0+lTnS4+K3prPtYF7&zFX8#eKF4YehVK| z65T(;Rr|e_4^hdHZQqJzr^;&mRo#^>h=`A89lO@=boXQ}i*6C zwxl_jDe8;8;8QDtQ~!4+rN zQYf{Tb8`w^TL?(@XeA@^t}_r|zAdEVtlyKk4M4GYd7@$O!v<`PZEePtb?`Zox8Wxx zTZrFwm%R|bCc8srI`Qp~mlK48n&Y{kTb(>mDeRZbp5*1+8XR_qMqdr)qdTo5ku-N1 zPk}~zKWCR96t863^ar*;numD0Z@aVpuevJ>d|$R<4DHVf&1iX0kBQxa3RZT%vt1KJ zLn~$uIS3#z5n`e?5a0gCk*)58}2LH4cNE&TO8pNeRVCc?_2K^zuIa3&l z*504V<%59PB%^6C*?4ZNle{tW%@^!^PVh3Z**4~4Dua{9=%^ihgH zxXkY55&or)Zc|er12#Q5-I3Qc#W57jlN_(*pS;;}Se zB}`aC=PsKYMHr5=&Bhjq&*4nht#KnhhJA9=!)N1I|4XX-_xm4YH9+L45k_cuz(EiE zsOUzRzq3i79V-dEHwj;-YfkMCy?dqo_fOe2oh9tZur8&!46bmb)_{`_l+JKif1?X0Xp+7e;|{bZ1US`M2A*OluE-AGMwW(WBEe-Cwm<| zZNH|8p_`Hfs8JC3pn|ZK$ixIt)B0F?IGRmFp~jJx?m*eN(v)I$9%>~X2(tA38E0Re z7jV1Y^)r18ZM4z-)@Hhz6jjB#>m34W%C4~jyL+L5l=OF48dPi7*=hk7Z{{>b4 zVpjPSL#R;b8sX{^D$DFfv*r3w0nX`WXQ($e@7`fIy*d&@kl|u9a(&jIbst|PR0PSm z)^wFk_;6OFbW;B5C%aCBUf0M+7sp5M!~kUv@ky#G#MaCs$*e%wD52lmR73N20pck$ zdaogzgc|$LtJ7Z_50|#Ff`V`IPd7y>+DGLi zm%S5lseX(hm`B<6=635Jm(dCFf$dKxGPfbc}rkE3fuR=(qyroQj zzjw6S)tfeWf^7fYQP%e~`dG`7DP>mYNb)8CxI8^|j#3BK#9K3RlkSduU7+)h)`7{k zoyH_y&;$E#1`W|tTd0~jHfv~GV?G@HNITkb!P#?b#u#bP98^>qceRLE8?R`cMm|S>{j*nG_#OvVp z*Tf$q+v~ukpwd$;+g)H>Yj@q3Q==UdmU)j~P#m`l@4cQs!m&E6JuOt;Z5`4X9(Eio z{;ZA_n`HVEe079*`k{{id5d_{J*M6epJldh9e*B(-KF3cXCeN!bj}t!(#(7}p6%D% zv8^p|Hi}m&!GyIo?txa>Iu{CA;;Q9Xjf`C!U7OyfTEUx6nv~+-ygYTXo9;(+K9y~` z+c(wV2FX_vZKg65);!p-kI2&D-j7T1Vs40eZD1RF-o52vVb#6JdQ57+0QkB%TaN@h z>aG9|db}HEdVrLz?4D4-%cm4)h2&-f;f324YMo5(4Bcz#SeudsQHapW<`YC>f^K~dW)tAS1T0YoeH-WCpT(Dx7 z)w5f<;YU8^2q4Yng_vb6&|Pb!(_PHwFYXA z8~?x?2LCzh9h*+WP7QKdI89*A?_eew?wU`MjPokvB~Dsli)(+(y?HIgDVpy)obX~@ zzKw1?y!Il8-tkWiEnHj~^+m6+leK|uN8%c)QRS~+Qvg;*Y;Xf}Y6fv0EkZoF<57oU^s>~La~ z%be88c;7VrKr5<@bSe~wV@c z-`geH$_9eN9(BverhD;f&PWk=ErD>#QFYSsk-BG%0o&aOm z><@R}^T=u4Lm$^N{!HJEw9#V6RQ3AvcOQQMzSXTTbM=Pohod{*_`u-Ct1M~3j3D{T zb>;g=Cz6*XtC;JEI9@sh2I7s&QD9BKyrYH9>@&u%X(6_4JFiXJm&a#?l(3{f=9R4- zSye1U4^B+Qc3_MTpaBRj$ic1f%vPPIEzH3Bt|b%HmNr-4eiITdZItt!Nx=xW zbnb^rrt@J1hoFnj6x;CbNqF^YI$v3XzO%2ljQVPFMh|j`b*@(E7^^PfBP4zI7QJp0 z(+*AyPyPn?sAm_eEBgAGVw~V&!@|?`OJI0IE4`!Te8F5A@W_FNZ+lM295qItabomc zWXm=#g$^TR@>!R=DX=vBa{Mb?_i7UrP5z>c+!g-y{tjmd_5EhKMCGM&A2;O;%t%FQ zhlvz@0%&x|%>3KisVAu?X3w|P{KI%G`?gDJo&!y4*lT0ADmnx+aV+pSwa0m$;8@KX zfG_U&61p4p0Z)8Rne@eZuq>@+F2a2B?loS=)_?ieNS{4@r3 z`zIY$9aYo$Vk~G5F34Mx`+UpI`{9Ge-f{iUQU+g759FuzzxMQuV;IQtbCsZE22th+ z!;axzGL=dyjAFtj@54!h_}gXNe+u~$8U2x(oKLa41WwMIi#6wJx0z8{%L8K)MIvIc zDEe|>bBdbw_?WhKV;zrSOh(eky5#3_at{-##_KUif8G1^hm^oHjlJx1>}S)OT&)SU zycp4zi?x5FLH#(NxXId&4$$m{BcoKUWU z{4m_bWjL-iZdYnzW@JB13OHJa9-p7Z_A8AJ5uo49|I~v*jqhepVTAKC9FFti87Eur z3#mb!;}3Lxu?2ff|7;9+t5*DEsZ?H6(KdB57VD+0k+n-rW0KiDYyefhz)B$~L3+7G z#RDeu{ZXfUeHU?} z(j1cC%T}K%)47e}f0c61YDUFrO#e*3DxY)f{gdUf!G?s)hXmtsd;r;WJP3{puWZE) z(*T?uhBpSoH`XcO-->Zt^C}5f&Nebt2F!<@v=ZgWp#7#|jSzBh_27inWb240cgZ{2 z9ZUyvx|bslho0bS(5dp8PiH^={#j?XE&RLZx=fZXOD6E94v|@(yE>U+L?_4F^omsW0QWl+yH;R_@m9X9hN_IjCD-W;?7m89V)PvQmbWaOm8FzRM-Y8IZaX zZ1uKJb2Ffzz(_F|0*7>93LOW?6iqiFVuvShA&Un!&!j033y4XHXNk(V9lat^+>kLl zxQO8U!`HlMc&5yjhmz9!Jv?kEf~m?sOWhPQ+Fi|(<=wIF&cE;#?Y^(GkPw=A>-BKX z9HA{$*Y`?TsI%JNKiC?qOj2hA4?Nr)OJ3qf&DnkUvCUQ>*SFKOYc}V~7$1vMA((rC zk?HK4Go7VC=g-H3DX3Bns^4=|ofx&y-MkTmlRFK3Z3A+1C53imjb*<3WpCmJusi)GgvZC4+Gr{X!9ps4 zLDsYUvDFoTz2t#4w98&?m!Hx0N+exA7+RH+H3^+p{n*DKf$A2}?uq72=7?IVCfl{a z8@`xhFa7%Is2I5f>Y9BHx1EnrL1H6-E8g1yK{ z{IMX;Agy*LNAD*h*7L_Ep z49u92&}nM2wiK0lj<+bTv^5uM(*wQ*!1 zgp-dF1BsD~0}aEvN7-Da$}G)l4qtD~#e@$;d3i|@s7~C@e(U`yr!(v+AzoG|1D=}#zU4V|#Vj1d z3Z(+F*%?5i)`YGeIJR*saTt&Y#&HYH@2>i(Mc-#E0>~qEhBB~Y!Kbm2R~TuNwpdPG zGc9D-7av~HsBK&_x|rEG+Vw0qd8WPJKAibsGlRnZ;C(OO6Ir;p*H9kGFk^mUEXG0*cf&KnrY^hfK8h_w6$Qp#e%Jw>pq-M!F1mCy> zqMx(}#IeSIE5*Y3!N423Bl|8aBB!mM-U^D`W&+@fHK@Pr2bbg|#UE1a8`C5R3V3i0 zIA_ueTHerKBQZ-z59a^Qit?hviG{3=3}h^)C~+q1cCh6z=|yZ?X6Z}M4N$!51Xb^w zuHdg=3s9`3gy_F5rF+iNol&=acav}I|06|pNX$f7cws!>UFiS{S<9{Za#-Z3Jwa4} zBN9+t#3uaSyO?QBezo4{S}Vt=<*2KuQbnyEpVL(0GY`E4>w#!@L+>#;JvsDz#WHd5 zr}NB6ye0sn4?ffzWr$Q|^k13y)AxvQ6^0I$)_!G-$P-$(~vnLZ-x8>O05@MNl zrr;;Z#G#-2@ajMbR<7n#hgz!wCgyZV4#=YQg4S3q?aAYu@|Nf7C0j!Uvs9mlL6uD~ zh`7yp`(*R^A0K;6i+}Rtqg}%FwSH8%0<8tlt6y}g_^#{=p|dj>^vQ)Hx)@Ue<2ovt z?;Yen%4MXv2g$voeFNWwwx%-0#oQflHQeH|lm0BIFdFr3H+9MZiDPPa`{WNm!Cs+j zKzH4xoy=+9UM?=_YLsXtv$2RQ!O3;t@;cvXW@t_8Oe0l^S>`Wj z_EvB@XBH*3n~_i(Sb;vTJzm4oRGQxmS^GHut_pM8ds&|?ATpj)r2Qcj7F z>}Ji-5~KfZxUj16YlqPWLw*cikw|XJpTPl<%>y5~B$k6>ml))=T?E};z;t@^WT!vd z4@n)7swI!jB)0IHgu5G2yDg*#l)p7*i$ywHb7`5_ZbpS8F?!wo-I|<%hPbC6Yb;Bn zTs=fBRH1GUGu%>#q!c8oP(e(LHFh9;c0Fr%)`_RAf$fx4l~S!iNBK^j7JJBhW;!$l z-`@aHLLHHoP&!`CTZs585EO`4ZqMoY<1xr;l-TGT{JL&`toi;7xtoP7LkjzB7DoL~ zKlG}1%AN!Fl;U!zN*Oj*`A9Y+v@uguthwOshHSX*AL(zOm!Wh-`^NHazbF^3s|%xJ zgR6OdG84M8c-(S>#>2~kmzB1Cc@TiYY}3J4y&rNFwaU*xzb$T5=_l z{>sn}O#yE|xcm-lZUPFC@iFW7My!IvWvb2Zc5_@bTF$WLSdnTx;SW7w5ZN?2Q|;cS zxCnNzp``PQnS%9-dU@^Ms}fdfZ5bv+=kC4^(ga@PUb6gYO6i{|u0`0}^v#|55N_G? z`J-Dp%G+cM4`D(|+Sc9plA}rH5+=Av2&(!)DX~Uza-!4bo6QrF~qYqTt$; z-uua2iFf89ug_`Hj&>Bk`|)HpL?=vzkk_uNJ@aPvzBZ}GQ1$$!N}5KuZ64;R6vLyh zN{@xTtoS)loB@tx$2Se2@ZDQ+POlsE59OUy&PmomG^c#p;Ju#-?e9x1-Oc0+H%RCz zh5)c@GaZ%IeZkdO;^B3CS+0%QRt*!CN?XeVwcTdJc6|Afy^)!#x#2oKWY;C$dU82e zp9znNQnVj4pM03Rxz_klb%Z1QQ>UhHj&pYxmAALXHDJ?v1#8}Dku7$pkrYv>_c#tC zoLbu8CS8zYmFtg{<1w>*RW6bV#LbWD2Im+K45d- z1z+SRbSqu4UXLMTP7+qyXAuPZhv52E%g=e5xUPtra|8sw01w5GtNZ;%bMakEO%z3H zW4G%t4nV85gtqIHZF9l6d+3z?U0Iu*PV4urBaA6=2|9S2BEoNW^Zb)Fq5gYJTxl%< z=jp5xwfP2nQa(+mJ}SC^w*;}a2i$4ovf_8MNes3h@99bL535q%i^e+ofY|jJvE@FM z=(73N7nB!=ZtCFkg!D9`5+0|-F>;eSG?kXS5mIq^F6l@GEfyN7}c^18N zeouTuO_>?9@i@khc;mFiwE70JGdTQxRn{S5Y-24S@>2exz2LgI*^XMk<72pcBR3@? z_|DZDijF)W+p$WQ8M~p-hU1zO{QG{(K27eXgU22A^?6n@M<=68=_5A_u*{8Z8Mb!* ziwH1G=aZ1V>Z-Hc8JX!pQdjL;p2^64ImRW-(q$xI#C2>qMF{Qp?f^YP=`!OpE!gLX z{4SMnCMtU64sFvAwK>%w)M-Q_?t{FSyf6}96Z-U9bb|c-hF^CU!{2#Qgyrb1A@Tzc zBJX|qH|xcHEfAqYtGjpcplBp^QDeO%!~w7%&SGsdRq36}5-7#vip_F!)}Fmz5J!No zAJH~xNVU$5Pz`|77f?LBQcYWvxN9OJOZW3`9J=5mr29aZYB&cFsT#ZX~{PAb|7f@ zMFinjT}BrU!TFrj`WMSrzxLO-k+s=E#_iCX27_3)J%Y9jVyV<>1JjSm(i;`1Tn!!^ z!w-SciB$>L6b$403^M%-7athP8!ujHDitX7K8C(W-jkP-dgx~>W5Hys)1zAmkkj*G zz#xysivOb8{)+7W%yTh;QGOO(YYLD+G47KeSsej?efUSrP{%C`WS=JxCfF<80<%H-qrEDFDS6v1xKo7blaaIKr3P zUWXMeqt3mlsBFMB8G4*3>KO30HhtqZo1>|UZvxZlTm5U#cAW2bC~^1}Q0diUPIDQ2 zH15y7oYA=`;-mo_h_(NwdCPKtHyKPj zt6BB+cHLJkmq(o1hWCLOX{Z9bx^Z$E zm>Pv!iHwTo7*c^M34X{Iwc zR`CR@U~raw5D;y9^Y?In-T9&EJJK!Tlq0bT3)@`Oo$l9e;Qt2JOnRgEjqocgM#;;% zD0|zNA{jZ}+EgJMF;9hMIekPXX`|m`i*UJ{{k^AXR~AV$x|Z_BtvQ}^o<+CH4^5#j zlAFxSkxc`q#r$rw1fC)jL8}JX0!NZpe^X#e9ddcoXmF)jIo>u%DfVS_?XvyV-=Apx zeaab1WWyQlyxS50(}}?3p2hHR$KzMG)?*@mFC9iE8he z&D*v9P#Zuuv!z@<&8h8StK6*|UiYwRB9v>VvaY7waq|43MiIueb$H)9T@{`TJiaX* z_ZDfjl1}0bAm?{F`IYVXHB9<^W-{@tqHPiEHaa z>lhejrtB$onXJ%SA~yt3?y$}fV)+zv4>-oz6s?{&n+mp99ccL#Z}av)p|^BTDp&hc2PH| z%vxl|FFtF7t54ny;vCzr2j+m7{F+dYT{c`tXp_Q8S8)3aj9>fqnx7u+8d_dFy(m^o z3s!-ZzPjfhrfIEA1W11>=doT3v6uVlmA|o7bjR?)U^4vv`m+Ny(fh}^>GR<73aDE7 znP(5R?CiA2bA+Ts$=H~DcO<=3aUPpa18Rar6v7B(D}(k8Y=Lo8nxuFo`$Xg1N)TT> zU7;zJH4gPsr6MivYvhM14n_xUysX=yA!u%>7axQRpLP9|@5AH5D$epY9R=er^M>iuX>7 zq6{I73W9Cs#g`mMq%xrqEEFq@e`psK(*D0Z>_(e%Xdp#c`H9#+XvY zADR>SKR^4=jiAL(|8MJmKn!J9T)YUh>L+Aa-JyX7``^4%EriO-$|C$TKD3WLis8D$ zaN$^tIU4oe(_ZJ@p5l--kAGR3fgrE_*R#_Vd^%Zm#tj{SVxZ!@?izk$@54K8aR*f- z?#2`d1-6%xYnutp38R{pmZrc;3U_dIsGkc??mjKoXSqf|DEEC;r|%w zocH!R{Hn1ZC|edQ$M?sZf6X!JLYK@#g(%*sk7skv0W=wiQ@rnPk(E`1#+&AekZfuG zZs-1|CxzahYAZWOG54Gs{?UX!#3$m3_dgcsGR#IDhQKCSwl|#?tnz3}(5oc1$LLaQ zFCk>RuJXLl7;w1^BVL1Jrk=;>a!bGoh}q~Nj>!Qu=^cgN1|gPVqY|QJ^g;NVw;5Xi zg!Vl#=KRm3Ao|xI`tyb1_#O5;#+YytzOFWCWUeBv{vvGHl4>X^onIe)vAo&v;$VLJ zfvTafd3rH!Q^7IPuCLSUVV*S{BeE!jeCfY^;uj&LGR!CH&q=D`q^>*XC+{JAX!0en zzWhqxM4;#Yuj=N4#VR54hoeI=wH3^rUF6Ebu8YWWgeu1pH6L}smnRgmg^D|TeWxG+ z!6xVHw+t58BaI>Cb{JsIju@;quuMQX<(gXg(sr{AU-Llz9 z-dP11@noJ3ZkNsrDr~QZI(0PjRW!T}AX{QX_vFK{Ko3`V7rI0`@NBj%+#hdgx zKH^$e zBQs*+Uj$Zfz@j(&NJ)n7KVb$U_U`l&2y&;C3I{O-`E|qE_~0oD;il>5kpB7FhIrirpN_B>b$*2fb0;TqXrd1TNc?$(HtRP>JC28syCM}%@z!6 z%V>x-&;>h`CXpR$TvQ)lU+DK)WPC4)_)BuSJ@@K~ll}O?Z;lS3pBMBoiE9ZKv9La9 z6^z7KHoMtmSQbr(i&TZkWHJ{Fp_PZ+eE&aEo&}VtlF=2r5}*4ItvJ(kQ$FO>0o;G^ZU}`u@I|wiZ+Z5{&BCLGZXJEukro2alhBb8km<`e zx9U+(jzAD-4Yr6f89N%j+ooqkzzvm$u zwG01sCj{HdqKPyri2S;H$>xcEEU~2;9o{b45k*0WZN{@~cmzu|mk-1QiGG!hkCr`c zwl1T`>HtJ&VAP&C&@RMlaaSr0ijV(8c{^&N#=9;P9k-|q5iCBx)QL72ezP5oj2V>q z%XqIp^Dwml6cEKA#}U1|zS#N>!B+zz?Ec(BN<#FoHxuzf1KzE}4+!IJPJA!}f)+|fnSB0bmum|2+l8o1rd8Wdth``ox)!P!NE#XfVSW?PPkNFHh z@IwP8O$bYLxLz@3Q&C`C)J*vOmM!##Yy7&pZ}0mmI0au{eCMmz;|&ix#n#4r5s%#a zBjGHOeq`w{C)#~CQaTO?%RjRSRzsJh%3f_z7Ds)hVgvDR_h6gmtupZd&Q>qzRcnDr z9koEBT;hD~DxQ$?s%XFTQuVe6Mzaz6Hw{1-4p_S#I?m08O@MxWSVaw$`#q6dq-mdG zHWGS6jX*hEIKga>67YO~g<<}^NtdEHf*b$VBLdnIc07?fx$7KD;CwK{-mv*zvAxeG z!&JMgp}m^GOaI=Qg7OSNTF=gAm?&@%|Nbe~p#5p6mo#__e`w1+;8K27$RXkaCak+G zxi5y#HtG3r-24wl9m<%h&DkYa<2DY8;dG8>rRp7*H`o2A%iVG^5)R_Tq8ncRCXRJ_ zEKHmYIcfnf4guPwZ!sNyY<0+T@4b>JM?<_uPcpV*!JMFSkxDTD+9}+AdrTj@j7zwr z4g2^JIoH}#4%`b?+v>62E$lhuOg$A|4$L&{hRvQ{&U5b^kKO&rqlMo*S99%-%TY5b zvn!CyZ}c8=ltyptpkf{RK+)6mdpYD56Wjj>ZXFX1rQ{s$?G6prxW>UpRCM{OCTt>LFka`MHcbC|rpc^-e_uO$ zXE84{G3*W6*y|nEva{{$>r1D3#J=d_&}{Zt^;q+3vM*tZOj>TYC0`}5wx&>Y@*3?t zy^S(%FqtZ~c-%nlmAMbQE}S^R3p%>gOyYOuOC)TyVN2J)=g6#OIDZi^W7X#GcZQfW1lhz&CoPD3K9ZvUO~aa2@X{_~fNt+< zZ9r|!ubn!<5f?7~z#PGmQ5ia_jcB+&>5s_ES9W7Lqt5)qZ~+ysElx0dN? z5=Ya%G~ayNX_+GWX81yJ*tC%UHeEy6yz2yCFee49}?TwCjs9UoB^e|mXT(CXmY^g%Dtsp_S# zb}IFb#9%RAU`S(gORn@K*A<|hB1XoR9dYwTRVB{T92`k|HbS*U`FOu5@DhnuaW?H& zUBF%7RSVsA*&+-$*HK zu*HKhHBIF9#zuD6aPR-j_hHD#w|Ut^yD+o_N<{!gxMyWH>RhOiD3e5)SegUN|OUa_qGPY`Rbyc?oH4n%0SSfH}`N3qMCdeWYpk0tN~m7U751uQVP)v)mFK1KD_ zNF9l}>X-k-FHPbFxRh$lWi}O7?hCo?T3tEvW~WwPMLZObJCEf9tFL5u$#vK7egI?d zh-shfS6uaDo`E2gUoQ`BEZ^Tefalw(57axCpEeOH`V~ zpdVUBymtj)>EiDD4Equi?r}FoVWIRyxndX~V8fF;sjrY8sNQP&!RSLVVJb_ac1XC_ z=IK^Shb6!Wb!V4+d0On@Toh77q>aEZgOM@zjWXYZA+tpwo!D+ky;GCrpaLE@2DCQy z@V(_`T=EDXOaIZX&v$l$O;MyL82O3Q1XVNvJ%K2ECmZ~Tp%pD7y7*OgMEm!Hl1kly zJzL{4v-h0aw5z03)lHzIa!L&6-7p8?H-h0wXKg^ThokcHBxKXC5ge9!`YUCMk#gw* zD>Ndt>8NI%wNY^U?|0xtG$Jl(k9we-z4AoTDeA* z*7^eIrvHTr7$Qh_!D{!jE%93qPG?0e0i4r4H)({DAq7!tycv(Dc#@$He2W_v1+CXy zixH~2QU|}2+MmK-$}#N{J-gvqW;4e#I*%{sl6E^&PYnkHEb2(f&!@&1vD+T-S9d`D zEl+S2#F?U#$h3;KNAm+Dnm>q+@Bw^&j9E{p;!B*GT^o|+RI=;^=PI{*$OJEJyo(BuN>q9=aUR{=|e5u|U$8eJK>eAP(1{ z&#mMf=|v~*=X?C{kkn^4?=8#QYL9c@rHLLN(=*4z&<8fdr%Bg=p%(Pc5dpwd7g_`1 zjhTE=FuJlJCACU@u~=Q$Ot@l0RD!261n0BAof$<0ii_=Y>O*Krz=jy&xXAI1nRY3H0L8(}IB&in({Vc&EvFlXlLNF)0wJ%Rt$yf!_GD()tmaCSK=IaZE93_Dj}oROF1d!} z#e-N++c7Q;p07mkFp?N5Z<>froRL?pyne85vPZ1ARhESES)Fob_^nc;7#sxqvr~CW$mp=@h z%tS8lifZ8$V^aHKR!EYkQ@vahB!<&Ik!cF>Z#LJKmnp3do{sPsbk09o6M4xFvb@IV z39uzI6gJj+IsJcpy>oD;!LvV_Y;2nw8yg!NI~&`!ooC~0xUsRZZQHhO+qn6jbI^nAK|sQF~MTqj`I__EzW-NsdVyqeF)Bqwuy<@!i~zr?4^ zm-zTS>EeBvJE?4Aps1VA5{%KO)y;4Y*djb!dnni_Bz_}_jVNQzUJUt0rD<~{PZ}U+ zCzxowSDO#H_Z3gDj{os8KsdmgGCrn4E|ZoqnoL>ivA6znzLy0((~~iTS>ANfR>?|F z<9wHKj2lrfVR3MG{F{q?T~q!y0h#9`&T~LKibS?C;n}H!bP`V4=Ahkd!?3ZOwl^eF-<}f5N#G-X z-@}&dCq$arZ(t&+20-g|*34)zBdlGO1A~C@?_I8HX z&=iNmLmU^#gtdw}x$~K+6WTb5EEYA^*SM{<@nnjna$f@ba;x$DG3Z_0mdubFJoPr^ zo!R93gVq}dp3oZx!^`Z4*SjLf*#J=#=+(L2$my)Aew#UVuedAa#8$70w(!M3 z|JPYMI?oTRDNh<+Toq^^w<3Czm?I~};WFfexkzYx_`twc}2G2zR=X12!eZN+{1$dK2t?~#$sIR_kP`&Tz@xBeg({Sr{PdTHNCILMy0TmRyNh;sSz^y;We29;1&TOoNmTLdla_7zG=p#Bc2 zK}C}AtSJ=e>HEXs@Vc8-)xJ|mx(Iq`>if10o`RF{mzI`_4XRqRtTH5LXaDVW;WWkl_48_AXKkvw*j}NeF&n5=$->tpm=;1S8I=~=FvYA` z6Z|6%sa>YglI(Nco-#%GEvvOUoP}~#)p)nUQr>ce$Sass=t=%I!R|0_(C#2rE7Le3 zAIVLRCoHcZRZAi&&u0?UxUOdBf&DszDJ#Iy3q06f=iV&~(YqDs)A>DZ$UF-R9i!dTx?&~pgGlv7`aqs;ZJ@xSU04RdD|#?oXnB@!2jpsI zmI50e!a~uhKCHTC?KVByGV6N%Yt$No=2YV^Vk7>+hqlr-oZ6I?*EK<+@V=P)5NsB11UEx|H{S$t#p1MNqcjbTlmR`xrpWN|t}A7!i;R(|d&(nz;b?Mh zKf<3C+aoCB+cTVUGO3am)g<^QgsPRbGneN)I5_lvjRY8Jh<`7y6**;t7s%NJjjC@;loG+<%|J$PHHh<_<7HgyP$pBdEiM}K_$)T(iKbW`_zBOnQuW?1e%s&70w@+Nhau1~c^l$?I=tde0DE=HroQl|W${26R(V z+1O#L2b6K{fj5PpoO(Y zRhU9hhe}W=#(2uY;ec@K2=GnNRg>MLkOe*McnOu4p>H}*bxlwC>6-2_*(u|?gq+#L z3h6yKU4&Zl%Wg8vKQHEVJ>?cvq=ds*HekUconAZ&W!eg#W1Y;we%xC3bFMGEF^aUM zS~4ObW6a%@yFY`%-YghqpUhlE!Ey#hB|(2GWRpH-Zr3$a_8JWj36N-iKJDD4qH@@x z;vH(#>*&H;IBe$V56mPM%0Czt2=x!!afwZLfl^XJk2UJ*aKVvY6k$2rS7g z0s5EKoK47Is*2ma96eeuqH!{~bK#=Bq%e*Yz`PV!e`3|KXr; z^Lo!`H-#w&Nsmr_b*uR`GgD5aDF`;CbXtEn5XA?ZtqDr0VEjYH<#R5b^2>0v3uP2S z@hn(xcrE-M_%cY7*ury5M$9Q3A33fIdOC;JzLFVca7*bIz~PF^%V~w);Bu6OQS_&B z^T3Mzi&0@x%EQ^YnT#(jbSFmwvFPg}b0b|>W+({TyQSp94o`Csemz?TKr)qyZk8|l z?RW5lq-wD0BvR~LS%G-@cW(HC@d=aX3daaYdUA*=nnk(Fh$a?))ceQ9a-FBi1&!MA zbZs8mhIGSzAW^A)HIk^T&@Cic>``%Zc|;e>Y%jI40nN#3(X-dtH~-}K_`6ZgmH=B} zX-UpWq_#iO-<<-5jsjM&wevss_dUW%;Aa|hC}F+Zy5>}VLY4|SxpGSn zQ=o=~tO%$chU;97BmP`8*Qjq9lW@oxRK-dk5=B%1%4x zO@yg17S6Bj8#*Wzuj&n8zH~vX+FR_Yf=7yHbX2O$L^_a)SNR10lH#OLpdo=x) z;!r@70br=GNqQtLQE=M~Wo0Og{w5gX31VOxp_fPtf##jS?f<@{8jMn&xd@Xk;sW=K zgQx;S9Y@`n21DO>=qk+rnKe;=3zo98GR5ym%~fdF>^Kvdp8D_|Eu{13`dyq)*T4np2HPCbo`OTe=VNJmfk%Xt2OU^KMWwwMu zD!U#TbE(%iIykDZzEEclRt~+m4j#OUoHAA+V<$FwA;!6$b{YgU#omWg)Q=+5Ls>;J z=7jsWBoLh_K&3T_vCt=I&F4pw=+W>a4S0-#WiA6-|Ig3Geo!*9W}NA9HcrHp(6OV@ zBVhD32SStQ;dbc(A;Klk5TVjdMIn8B4w&3BKBFRRF@mPI>7ph_k4W5Gc`wn#`RR>5 zKItj+57mBDWWd>I>*%}lT-R1&{@UjqVa*`o{>?#QkUb*(cJX2-!noa!3an|dE82g= zP0DEJs^87$45Pxxh8MmyyQ<5R+03@0;R1mhU`o$InDiUM(;{G+&AJ}M*tXs1tY~Id ze#4L@W?**h&lrjUx;gU6i2<3!CAeig4MI=?ZI7r~mw!y(SdgYWZOE`JO*@I-G;x2z zpL-$Z@NI?CZC5`oR^@q_Q51Z7f9^$>U+_qjd=Sltk^k_oDu73S2Mx4kAF1zTiUm{y z8Z=l@Vw0Kj2PzQ@c<)CJ;g4q%kV-bs@#pmQCG&B3c&{$9G3h~6(C!T?k z_g)8vCz=Zn+&T)&BiT`0EA>vSq68IQdGp^44m3-B!DS#J{Ap5{;xACrh9#;s9;DhO zwZL_RKu}#u2+G?oRj+-iu1iXgY}~11wxVB0gfa?>f)E;{Xm;VmRi%O6*?@-&m#7gb z$x5IuUQ59KBLoON73jC_DFSaBb!-EZXXPhQf-PFo%4~G;GDw^ReFf22_`v?t7(@)E z3PG8BdSaCsLsl(nY8r^xlGRdT3(`Mf^SLlZRAIus|8`+*-PXgvCc+Hy8Nj&9!*JnU zV*irO=_3O!5rT>J*!A50mcacfERBSt4&^Th)>QQ#Qj-UaEbxh>Wbit2p{&7{*F%vY8aPYr^q~6@$$*p8VuiId1yW31<*4GCSWN+&e1vJDA$XK z4P?jE&v*N;;3@{t#FiCbOequnT$VAe3u|q|FC-!vPdbjKJ*AUhz(O{4rB~K6LiiIHytF7;#876LtK~G?c^=+3NJK( znYlIU6T(^bD2ez+yzPLgsCi(ZG&LX%w5Qy;^GSG?QB%;B-cY*;)j%wH{Vo@yJ+4+I zNhLQz3|w^m7>i;5)&#&jVfYK-NXGv2<{|Q}g7;cHeOgW4=vz2&3yCAcSyEGmCHp4i zO0Xm+qfL=G@G?*H8`9_&Tr(vy+0xcTGY9&%lrtgNEq)%Y^l6cjClt?>k^@mPm!csz zJd|XD(xI#kwaTwDtUcs$s_jP07g_2A+qsXbF4ct;72Ui$SARkpD6)pzE4VHNbwXh)^H3rl#x2&MF=IK(bn8?6 zV$bGLi2w`zh6oU?^cM$K)XnG)F}|(66_8G!j&# zPtlkqG&P&3){C$IuI*mH=j9c!pQ1MDn+cWabD19E1=GW*HheL@%5`Qvn0;aM2e#25 zJc6v|fUzf-p4acr&!-BXzb`R;_boN+gR7sAu$`ZlRT-d|?A`8}f~PcEU0SNjrD8=I zx!f9ir;h*V%Q3gj5|->{q%J)?w^~*Bb-|UZo!f(O|BzpGSrqeugVRAL1dctJUmb3?EYxM=+_3t3A`o|Ss}@5~hb2Y<@15ApS%7uq@T z6VPondcpwNg!vRH8X-L8IrOUe*<Bo1=Z#L{Fg&&2#P_a2Qy=z;SN-S07$q-$YXk4Gbb$xEFdcbY3 ztP0c^Yzr@>F;cL+Fli-?nYmcd6=$$W)^Jt5Vvx-K`cteqaJXqbsCe8}?e$&nU7w;u z$*L}xIIOdRk2rU_$Xy#TU47wKl7pCBd4Sh2Ngn(uW&s4!i0rVwbxCP?uX7CbpV+_vFkE zAbMlN1KU)l{W&H@^r_Pw8sCa-dZ&FpA;O*TIq|v5v|GXv|L8EgtKOdEiL2X#!!`hn zhL@58d|oEV6)i>1$~(?2*J-O$k2wopcS9;UaYAz^MQx^AGrm-ev$TzhS*N)yH#$Av zX*uCC+xZlg{mfEqa!fT{^Aj_g?*ouuzyjeaRd0Ic%twSWc?I@PZC05dj|B7b;ocb> zs+=#r-4M7&o#~Fm_-NKJNENu>Tdi^Jt04C4^y9IZvAl1}-;Oy=It~s+IZt5st#iQV zrO8jS?XE>tUFI#N4gX+9@L@FU{O3cd(MU` zM@htUO}GA)_;AYir04OFoW%s-u(?xrbe%)Hdn12#Da9$`OeciXoh+U;V}&NBtga!? zO=95un%QK6jLP+ZBK_HqTT<@OdcC2DspGF!S-ETk2psU8b}CdUJLFh z;EKhp9S@_CPDW^N0#2X5eY`)KHEsI{lrx@7rd9O*VWy(81aUJV=T1VhYW%*&Q=GiG z(Vlg>5!qEDy*t41GHdpvvt|QCsu4E-d5jd|rGNeL?DvNZ&jsD63)etY&&#CLaB3ii z;qoBHtFu3oh%En;jn`QPH@HOh%aC4c#0M_Lo^1h|rqxa_7m+{OEjR`=lVmF5D`2RNSxVnYz~`?5K|gI-ZHcM~Eqy z!_%^GWfl@1?UjbD5LTQ%(bT4Y1@CghEikdPoER0c1fyWi&38m6GSPle==h`Ug(k{0 z-Q(&44;~e1Usq*L_->ml!3)e{#wUp-FpL(G;YL3I08w7T@k6m4FWuoyN(4%&T%qx%s7{%u--|@)LwJx##Yy~Ky&SHT1NZa^u9W-`#sLVI z)s-nPLxdY~0pQ-S+v8pitGm%tuQh2+FMFkJ9LKl?%c#v~3&RnYil47S!gdV?2-qcq zbJEFx=EGK0TA0V-_-m7G2?{s--tns)aelXTH%)AJu+gAQW=0)$d)by#DOo|}R^~9r z?C#1c=k=soisNiO@@y3IqdD098*CBqE6|`ESpTF0OSRx^E{6p|q{+?y{QGzpT;C>ZP@|arP7WDxK@2XX z&VTQ#D!)j)JGd)j`jvoysoE_J`+^kuw=Plm<J@o5ohU13);quRaDtR!B+d*@6y*$fApL&(9z4)HU2~2%-LZt4wi;JAm6oh8XnKf+G z?|vY6X&4laROYa#SEmwZpD-Ppyb&S+VR^m!QzXSg-nvLfV@GV+H2iBF#GV15<#eF1 z6*aIW@x!YO@!=mH027gJpmQ$U*umCnW8{f={Q=C$n;Yxg<-W z^b)Wn?FO<-H#*xRXtDzHm<__~vg3aL4hajBdZQT{u+QlgE=>o=Akvjb&RA9l2%wio zq1@VJ^_Tb}F7P7pEYWH|k;9ZTr%PB- z&7fa36*;S-D3IS7#4K4RX~ORS6;y*b(BB}fnYaIOshckm!Vn+zZ`W~N&M1xDEBJB1f%P6kmq8c76^OY1Hu(UjRXP>0`n6mGgIZ@rLv06qvINv;(oXNnx) zQy!ObR-a2~ipp-#l!c67NoOqIRI-phM-Hzl-?3__V}DNu@K}HV)o7jO-bQSpi>Kd< znDu8eytc&deZqfv@JXQjCW_{ObXtQomL>H=?TmBu!T?HA zih0K`t2Hg~bFK2Qd(d7_4ZX7GU z$y$B96csjO%DDajq#$Wyf>{=+Kab7r+N5yd5nxA>Npmf%`z3PoKPGD+!|5N!-mM}<`qG=}O3S8=EUO%-u=6A^ zcXH*uI*o1GTa4lFJ;h@e1a)r7>mZG6%!FoeEbMhE*-%`7l~}r(X~zSve=KMyUI(-b zxbz~pc+&BS%%UP3KX}UwyoA$mp`)4RK1x{@I~5kuFmZljBV?5G)l7sI>+Z67D(T>n zAwbRomK_la*}H|9n+f#;o|kcu0r?*eUwdhgmA_4H28|HSYrv>r1tbKtbbM;)gnvHm zL`I}9^PCfqFh@8L<4!`QSk+ijx`n-?=(#Ik*(hB(lvT}$gYD2zfRmzdHZb|MP70U%&plk38WAUGQJ8{P&B*pAu-f|AQq+2SbrT`Ckun zLK#k=|A)$dwQYFc5HuvAY;?vgz)6|iAxNc2MefTFTbY(UIPL6G%nz;Vj}Pu$B!qx$ z-SQF$7xljfGLs+_fHhj>tV>q7LY>aHid&#;#QiOYKyo}b1S;@L#Bx@pz$V(-7o7|( zJ9|+hhHP{a6D<%ImD*_Tb{+a_{aHDLDNY?}|2=Df7`g|d$F?ypE$y{*#MIRE+y9>E z*V9fU{?z~B%m1`PL2#x2wXpvW7t+D1Q=^HYKj)(|ID^Qnu3vo)TmKJ%baC9sV0|Wu z)4f27O6mU)0-h={F>s>DhQR~6Z`c11izY}VV-@B<$Nc+Al1ZR@fO@9VXK#-GVPK#D z&i`ibL^h37K?+8S#<-ZJ2f@ZAz76ySgJxk3Wn$)J-KxH|1ah{@-vFh68ZTXS}&xXpEG1Ig?6ql!5^5oY$twK7IKRP1#)iVjR z*rdpU2%Dr&PmuWk;zA&c^8UV(FBul8X`3>ND{s5xsZwc}Vz`sScno+u;kN-yS#=F^ zDlTGC5MO^kb>b=Kdl)SI|6T#`-@Ke4KD{@OnbsGU28k5f?87(_H2YQ#W=V1lUREb0UDj@?4n-nhX{rN0r0|fa6>3!bz+B{ zZNA7|16SsJ>4s8W*ol=Xyg;AYKVYPP!TLLmQF@RnD3fNrBUE1PLOdVhy^=t#(S6n; z2yD+zXX26eLBW>k3rEAb_-L*8YQ5Z{LZ@99^h*hwFZeTPV;G?|)=z2qj4qs{UdO8E zgm0g-F8KMDT`6aA2I!cqhrhrKzo<){pCK62s7meK=l)d_>|m0WIPdnZeWqFSJE8S< zTC8#R=DOFyhW|Y~p=N*d*_v0wZ*eIi;^QaI5_L`YEgt`Suxt>9x~4JH)y=56O{rSr zuf78=y<4M9sQ$HJP|}c@`jid>jE)}-WzR8T$+man5?gg<5Wu$lcv@$M$L->;qx)R; zN#n68-?};}Sv7-w15EGcWUzf2>XZO%_G~cO&)U7Mt(WzqmOG05Z*RvI5gc~3;g}VB zp{pXRplUy8_&&Tjj*&!-zl_pVVRjSkQl|^TXrk|AjmaqP8@*0Lgsj(%{mW->6_9U=ZxWm9na6Zx7~?{!&a2eztO{`;m`U~n2JgD&G9$aA^F5>7IYfT$$^nIXBPwBKyPUjr%R9-rgEyd&0=a!iI}-VJpC@ICzb?oMn8d@ZNGgNT9~@p76)V4a4K(4~3We-L?Do zXzf_ciGL<~ic=Sa8_kq(oPBB09b=DH+_Bsw7)s+XR6#N9Z|nng7Ey>q0MCYZVA6rf zY^gNhh*e=o#Fz5+l0gGMhr zK~J<31odjbH+tG|sWY^*%UuC%LokE~Bvh`CQtF)_)P%@*H#_sdkY;Ul8;t+6hnp05 zC*0hx+aEx@{~@2}8u9T8xX+}4?pt|yjx}NUANFPcEBuWb;u6e6tkT%}J z>NjA~>$!pjM7jNiHy$pBH}EF!EBWQK?2+Iyn-k>KF7xbO2_=9qBYW553{5b@+Qa4txh7uH z6xxJC7pzTVqQL_4?QVZF2GcQxn&>t%e0|CyHPBo z8Maw*b%@g}^bu!^ z8;@7Gepf~ucG2+G+Y{QoNY|Vtg*TE@H()hA;X}qKmwYb=m>hcGCLE_r4bbj=}e!ip();M<@L0`=&%^2bhH^%fArraMs%s~D4UmcMofhc`|oH?oD<*^?cVPP;$@7A zF~FPzq)d9>)tv+)y;r~@W(CDyW3*X;30k3Qtj`rOIR>NRMN`kcY zF=A@h5{iy_%b6|4V8{4g>WhPX0mSb{Z8N`TdT z1#fe#=L_kk{f}CxUtQf3vf`3QGieb+Qw~Qnr5yBTHm0`?QSp8K(|l}q^go@&XIdfE z>rbf=xzZrCXolOo;R!Td$=f~cE^<)6O(fP?7=VT?HO)9<>l)1V=Njv;^# zVD@^zG&trAjIakGMJ0E?3>%#6>I&)lo5Fwckvz4jLVTL@rkxc2NnICRXfeW>TQVP?zG6@L0l%Pw8OuwC z+rk1z{T7S)J{*D*Kv$q`xY=GMswLSJX?z%7iomdbdGYyp-djYkyO8np#DA9VI5-b_ z#e-K=;1$<+8%XnhvSD!0S)ks7UtvgCXc`U`u8C8SCDTGF{HCygzHFcwU0EC`4K z*h?C8C zu{rsx+mI(=WIlmQvH^eBQ8528NihDuY~9IjCEnQ z)@p6_G&cbCavb5ZaC;XqyMiuFvd*<>r7OFjfn~J?WS9-+4@;zE+({;OV5L;RsM{f# zvc;j`Go{*uU?jg?DQGGO(TP?)))qFMR zNY2d!lntXN4~K^z9R|TBZ$84Nsyf2jH^0g@q2AEoMTr(IHHY!(A`z^Ri0GIm>ubBqTYvHXG?P2k?;tD{Vf0(efqL^g?-w&;{ z?P<^Asw^)17dMp6Ae3Csm=c(s`>c<4FTWe0wTj1InOx)-S|)7c0J5U8WOo)x>fLDQ z*w-2M1D#ATmTXT<%*mYfM=ag7^neCgzlKE&NcKOU*o1%cLcw{aY;l~Hp@;z%wN4rx zrTDo*(vqNMBlWYiq!nKP)9ZH^tHr1Hi-CreI4iUMM5VGN#}e1p>wx>ai>uq`Ix||p zOD8?Xs$)fNtXv21f|MMj>TykA`8oi7LB}%U=n?!GI%!oze=JE{u>Zxoz?Q|9OKiUa zvt3nLb9xnI?K+UpGWlpR(q1D?OYm@I0QM}z8X-q`9PXMIsmd>~&EXB|&gMc+?OK8{ zAJiWrKlNaZZ1<1TTDLEb_9iN$71V)~?+1I3m>JgNe3b$+o%X~{c#nK`H6A{MIw3er zUvZm998q|-=8=2mKbP|+m)-LIhR?UtX_d^p-iI`oq(GLq?k>BAlGwfTtougUX^jln zhz+zoG5y>Dv4bFIAQJHHNMGCAZu@vFtpc@lqj!^C?n$hEmsrH9W;-3qSK9!3mQ;WI z4Je7u^I6!}c01QM^wS9*Zfk#mLVUE6FRV&^F_uA*G)8C+yYAf``tgyFCO~6!H+71W zS~f*upNzwUw2hY>sB1?tW+;>kzSQ7I0hNZdp9K)ea&Eb~Q@t1?2qWD_4hF2)?Sv+%gA? zN_RQDJ<6Nz4*Y}1VM&j{y4(@$&)0Snl{bd9uUL|^$SQ4iwg1%~C;Z)Q{?OW)%yD<~ zqClK;t2BEpWfJMqwy^0|h4*;~BM|iA!Z*|X#OopQOb9L`s_4K1K7|SJiy8j$(%$Q_ zo;e)Ap)2pLA|95R+PwfKs=YyzZ!uvaIAb|Q<2TjDikeLY4w4}kUTDv9djQd7JW`)W z=p83YGcOdrGBczJlLF$h4GIA$bfafVY)&s$dz>iSw(OHyqnw92c*0zk3-5Sn#80fuD4d{K2k# z45BVn@dTRVGekY1xNgjfvi9}G^X4!#-7C+n{!$>yFwaSA7_SIzLibqr7>v;WjWQMP zr2LUh1?msfj6LIGzl)Ro$4B)>J%pPQ3ucwVqeM>mt2j+iX<>_}A%?G;J@1{c*>k?v z>h$S87*j;wm@E#ZI zG19KrXZPo-Y?fO*_Ns>KjaD&@P{5z6#Bms~s{_EPEIa-Ebz{5Xon^YncO<$cw2d{u z2c}tstfA0#n^5`(!K!$*stRa=ewRqvL%FaJV>9{sOFhM345<$!T#~=Cgx?5>n#JXE zn$3xQEO+!AVb@olG<-^sz49@PM6hkR8xilD;bX|ujTF2IwJC3@B!=>oYELRcx%}8A zsg;4}_qp{$2S;mhl+-+1=kQYBA!H#L;^>|**pfIfe}9bId3L=P7n==`#Av zgBUhSM`R77T&GHBOI=&xL1oPhs=OT7BE$l4Fi@Fl#X2bj6;oNMf2SBa(2*tf1}uaB z5?^3IP*G#awjT-ir~ds|(c{l{9SR?|1k(nJB>2{NEe7Z9(jSncEs zuT;*)!%d%T&^SL1=qfr-_&hhRe<0~>_{YW-+Bcj_syfR?*OTkCYAnS8Aa*Lewpm%f z7e&eSb77-5qX*CX5a!CImAd`bP5SC_Wo#mT5eXSzfq0cV=OK)gc|5D9HWnK7X+{B< zMPx7UB83ek`7Mu|ytOPk^Mrk1;B_LnB-A%-=~ee`g(XF?%8W{K!cpPfB|KegjU7TG z-pLNvm~!V(8i~`H3#BRn^ZQmrG1F4a$-6FrjhEwmNRrmedcnAuAy)5%uBk>b@|Osz zXNE6UmvOnrlNr$w#B8{n`N+yDc`Jb54Qi}hI6s4bU#+fo5qPP8vULWI^F8Ox9kR@= z<79mKR~+2XmWcGZt0nT^6Mys);~wkKKK%uhuS{Q$A@v4;FNW#x$UmP;`!(ZkEWmDyEPt6FOkWc3C_~p)+TdSqnX zS5Jkbe`MtMQ{@Ub#a_<8V1<&2mI1>w$QHHwY*`)LDOab(MJ2Gmbh@+`ET;#=Q5oJf zNTdYh|KqrB+JcaNWHQ@lFbABtescE_Q-k`mb)!oLG`R2{+|z2bZtgZ{Zw4p>o3RcH|)!qyqm=dTJ9Wjy+{bTm*jY0rnd+9>g!(pKR1zMzt(~{9l3`t6+Az ze~u$f?!G5hr{|a=z`fUtpSh9;&Zw6l9RTi^?EnUqH(jey~^4MPQ?>VAq*R?Iy=XZqk3S;&=3_(R>tdXf4XS8 z&!4SY)CU}cheoG_)u322WLoFZm<{}!LcQ|a_sE6^NX{atm_4jf*0^r0q*dwE z62;jCL}$MG7066MSi-FEx*P{>ZzT#a4n~vhF@c*r50*iXnQOPYnT>WEAr|etmS2i0 zY#vT-R~6!lz??jr$~CeK3K&$-pJ6Av1Wbgv)%ueV3Xej(@M=YoX9OLgyPKWd=Rc(sW&L5i@O`KaV!Viwq< zs!~_t%KF$f$G~`sVPjHpzGI#e+k&Nvt|oFn48U|-p<{ezX9X1ak>p#mX z^gd{47p+Yv&*#0jL@dfn3j1{fai8cp!va zho8+=P=;pu%3;TjJVwtcbZ2R9e8t21-Qf7e`w;Yg-2JO?6foNG`H3SBSke|oOb9r4 z0DwmHybQj|#=Hnscl~3TGy~v@(Ydr}aiK_pkLR_ilc3tg+^elD&O?pIo#?PTz-)V_ zFalRYJw~5%8;3BqUIn+>V4?R3N)cj9GxK zudBzIH!8@4Xem*v-_`QV+5dyv2CvnGv=XTLGf{(veY84+Ch&Kcryur3M%45S zL~Uv&PB(xwhymze6XhD)4g7@?A8eju_?O_4R$6@Ucr2kMCYM(a!CzHk#Cl))%PeV)l^H{9 zDnE!uk%}gTU5MXr;wyH|KiTW(;YwRI!n+*s@f}#TMrrd9Qu~-w!rdJXAgy`EMvxBw zLYpaipRwA0p3d@KrKLS}BP=>iQ-dApu*cs{^2X%M$@03bj=$OXM)Y(8M#G3UTb~8ITH!ha~t5MY-`;_X(7sC#{;Zs`tTZ|l=-L0+JruWthXO5iLb#YX3 zC_1w|p@P(d2(VK%PbP_TOG_$n?q->ypSt@{>oTx|{98PG1!f-94!1VCdfGuYt7V_& zh+1K@*s+dVFr$N4FoUx|wdwauYwNxm&6G||sD*sfjdu&p0-6nGKBQt&ME&Asxk# z#PvQn1v=ay)2z7FYxgj4A@K)sz`V9mhK+h1z{$jS&9a ziGw^e?o!AptF+LpHL7S3x^bcR!ylh|G^+mr6I2&w@i5XJzliRN z&q}v^Ixjr=EMxm-zVA=3w}BXH!rsu48)BejO`%p8*ysM!A4TpzmoD;)8S z!uQg$fH2OFuv~;~%~=f!qqlsQ^INAK{Nh@3oWT2u>cn&D&q{}%L)2-44WO!0mJRBt<%pe_CbdU)0KQ zNbzoaJSg5JSZy)L{XhHKz`V>#sf?qT?0$h$$aXkmzU8Z&zYR>F<(4Cng5G==lk-Dm zgWswIKU+zvpR`i7%8NMdyLRR}(tnD$b5q|(Nwfw37D@lE5g(eauAWZU_uF!UneFp(WTO*)pYv$7a z5^Ry>-p+RhGHWc_*BKcm!_V1|9 z#y8T-?j=xM1#k3gXGCs?t=eucDKVOyTzGkG#TJtZr$n?~QKk!UA7;Ol2IGO1)5b}5 z>#?R@>M4&KMeB4gyS-M0iQmqiGUl-EZ%G6;erjktED(OUFFty3q2wJp0Ebtv;o@64 z83~O1eGz6!3YU*NCvK=flLag&818Dxa(!un9Nf+F5NRWSw+~7vwh&~7E1Q}egYZw2 zJ#vBEgK0g-ThYnsvPbeGNxma@JER0JWy6Lr47-1Z6YJXipN!BDWA1@Q1sfC5 z3IKr$}*kd4P?()1t-Q-5m;);_mM5ZkN9A zId`4A?w{|+_h+x{%Z?h@EHu8}- zM`OON!bR}cC|`axxV-*%k7|nqMlZ2Vm4`xG3mmF!Z=T+!t3sUWsRZ`#bl0f6Yd>2< zzL4AKLTqpymuC%Ei=f4(W(3N^`~;<0r>#lT0c&a>lbmV;y70*N#v$T&1gC4MnFWf> z1Dtq^^Eb~$8;hW5VnoJrd_pEwl*KHuxu`z7c$+xfSMl7;aK)lSa>vNpyIi1jq`^k@9f7P_45mIJdiPK-k%}PYZgO^px=y4k z0PuIud&Q#JHU6mmvL3(vNvv~vR1l#3@EOr9jn%C=>rqywtg7EbYFI~7N2vG-wY8+x zk(g)Y=O;I2Zy=f|$85tvpWm1qq%N=r`tedllQKNsWJpP?;;`7mVUv9jYr31>YL5!$ z-*Z~Z4HOv244#&<)}^v%`Ei7d7aB#M0to-`(T1Xv(RCI~v-e$>rQoN7iiUN`O-@Nk zke`Mt)gW3=3ggB8mG_Bq;tMnxgAiU=d}fYd*yc_AhTy_!w$*~=?F2f{dHyvu+w)i} zE7Ob|2zEsQJ~1UTrwCLlq{-K4Sn{+W1`7dLx|53UP#H8-r-GqHY&D+YLwz!0H$VQtJ_`xB_P+cVzIDE z*ma~+Et(!gTo%$%Xw}Lye*1ITs-=tCdM)Q(^A5A7vtjeU6j;yB?`)7 z6VzoM6bVlr2FGS*#Ep%&0j|?ZgPwN;GO^VAmTMiT`H~Y26CR{(Pi%9ht6k2fS5MVU zZ+2zWUMSBkUEis;S5fnc0f-FVBucLu;!yoR4K(?*Z(ym__clrn)s>!O(>UeSe>38o z0)B&;{-z$p88??!UkSNnQ8yX?0~*i|`-|m8#b6fHIwbuUpPB@v`jq(}_`d{lM@3+j z|4sh;6oN~B{Yw$}7m1|%02!+vB1MXvou4n-#@7TJ<5&iDI6Y+J7k`wY0RlRS&pVlb z9H3-5xuvAdIc$O(O(Iy+*wKlm^TF{#(0MbZcvC6*aXNiAz)> z9^{z6o09*+-df4}K8f=GEnF(@>cj7UoByA@iCuDkhX28r%J3&1mWa!(sB4=>p)U?I z*ZS(B`d@MnnC3uA*d~0~MNPDa=3l}Svnk~a_^eO?&&KLvf63&Iq9b}<2mQ1@jqsjV zjiKI$=X63Dd@$6j{`0roua;SvcnyoPLp0hfU*7O1)PHP-u(cot-&I2i6c>9IZNKtk zi@}INK*v0(gWkBOaLihe3ewtUpa!>r&gQUzj0fF^=5c4;f4b*| zS;Jt%vX9X6K;%&-Z8+mNt@C(hn08YQlfEJ>$@@>vw_-wg|H}X;^qy1Gw^1cK{gam+ z-Vl?*Xo*@}zzxrZ3w8ruxU%`Fkm)t7dfgpc9eweA=r`0};4y8LZjjH9fDuwS<&u(AwGeiVr|Y;t(Iz* z7u%O>2W)x9BzvnT;)$c(-`GK)IEyu+$YClwN8ZVxj;O@uj?(^5_e@Z50ntPxC?vwD zki(lFnsvj>SlOQj$egg39kG!nA%NLvm@qT~$ygz@d83^F_S#=I|Nna#`Tr{>sQ-sz z@*ieX|CJL$%{S5yH%clxHfYUQbi@sc?Q0kqfeQAI0)>m*qcLg;!-43-gmn$jZ=RdM;7pwzn~qi3K7pqf-BAc*mZVyX2vrv zi7idP{P-zTzp>3tSL*_bNdyGo_Paob6>py3vrlb(H(~z5Y(P@`9H7AdX5-)2e!uA? zjs*|>sSrQ?d9Z%NAR8g|gh~XSs{u{4N|G8A^l83h2x_MW3nSb9aBWi;UZp2|)H3s3 zcNA7AwcXsU;Q9JY{A6mCoZ(KEQ4M2IuungE)BMI~D*K<$L?~je>o@d3(mLpdg7eVr zNiX6A#T+C2m*gB}lRI=_5K$t83A4)>Pa-wL{qvc-j_xW_svGr}B}|FqtI|E2Cq4Dq zdrA>552udA=EdmQA48&*o3U)$>FeRN(0iNHEg_{ezCN}!(vk!M2haZh-vfUARHA;LT3?iblxi82?(^CFU@eJerK}JA=H@6|v$fC2IJ0&BS~F49`$ z0tpde54V2o3<%^(;r04;43nQ32+~t}lnZ0Y<@-Og*wokglEK zlPXeT#&r8$4{-(>b6*Eei>bZFvAI;yOXfR&!jzbW%+ohLCvmyJ2Z{t1x^ImR6G%9+XYZ?sY*pZAadoS>euGir#nvd7)342g(N_#qe?&yNRfe0EU zuQx>@V+Ed)+BkRvbL8|5GnfOORom3>H~yK>R^7sijU=?^o2%lQXYfBM-hQ|)czlqfCpnzj?RXNfV$+4T4+vYQ7qK-fV!9N^LY6`Vz3TN2?O_)Eow#I*cBd0JXUflfbttB9EQe)lOoPnR!aVLCU z0vNj;KDrw5lo|{y-QJsp2Vz(m++N5+SF}W7J=~Hj@h7UMyGL=WLQHsad$ua}KlX6$ zrEOAVip@89qK*n&y%v(WQ3*G(wyJ?qx8? z7Ouu|S+whBEYHsn6bw_s7?QU-)MUKR1=yqwI|5*T3(gRUqTTp3k@5}?N_U~R<(jzY z;oQIyUB*_gF5|q*cbY?&u~=u8g6&6p2GZ`u)!oz4w!V}wrE-$RVCKng3`m7BgyA%Evpq3RavAg*+@avJ#2ZCKD7;v!)K`Iuwp;0!LVJj^}y{I0xQ$r4QsAF;cpLB z=7kvHRPHqDT)g84+ya+ZHC7?u@nd|ZhN;-+9%%*?hF={ic*n0P#b6BURQKZ_5*n4L zN{$=MdUaT<&b%DOOOb|NZ50g?K-k}j<0`V?z$V-IP!j||$ciJl3$;9UmlyJxOsb_k zLygO2jKmzt8D`kys9^^Oe=Xa5Dss;a1zs^PGDdD!$1IGN>MDN_jUM{$`n*@2-rxmF z)*qyiqBV3^v}S%GT@pbg@d-scMxkWWqq+(+S<+)mG0G+!phb!zpu&{q0V{Apowm~w zzg;BoYSiWX_Q|cf3f)Hx7a@-t4N5bk{HH< z!ulgE=FM2CnurZB5y-}vb4#Q`7dJ(4a8t^mc*gCBdpCP>Am)B`8*E^tt*kynK>4~g zrX}TNwzSo#C^AEb;%XU&&RIxCZva7%{P zv(cx67Qy+mr%~W81Ll;&OvScu=RhM&Y;lM55}a}%AEO=%Tm?1 z@vbGX&HBIxX?!gqgyqEEEv8dromcFm{M*K7x(asNm5*WaEInnvFv3K0WedJd(0K0B z^~dB*alWQ6CZ9i81d(l;E|xfI;t~Cpm48X<8b^G&%lQhN&!kWw3pCL!t^k1@9nAre z)3}0g?&GSy*-iFZJQp*<=_ZzY4&JZ*MO$W%DfhoBTT&p3SlP--zU~gQ_&M4DKIYrB z6|2`&dhYhz1|&*4aWiuV)^%OCu2c~G_%sst5Oe2o{T)LI88wIP?z z9$S(WT7v;o?_2QBix+{>sQ`-g@}j`ak&Mv%N(2_64=Oyxn2wNVkl+62klsxE)n)u>{UbNM1vpOsw<8#W`?3x4ze^QIlNn(wSP3FMe$`&QfRD?ystqo@8MendDh zcAKD)xRP(?a^u-n0YjerCuEa^#UZS zx=J^C2-qt1B_bl$#Wap>JU_sd#-kUWkb69u=m7?_gN!+DqJc7?OX8@*;{uy&fM4M0 zK}ie4Oq1%v?$f}PoU-{sO#+Lw%eWy|wV8a(zA2jMb8eiO0WA0FsFAbs&u#-c`yJQ* zm>s7Wbj0FvOw0M919=`y?umJ!UD4u)^v>yB)STx?I(K6+5{9-uj_n~S>>%s|^^V~S z54@hB$SiW%9Ir#qbPsokI{VZqpnVf``JEz3`m0gmvFTu#btCN0&R)~&9Gi1yleVTX z@nv!vBWhD!XGj=UsPQWQTfMa2Y?NdC7ond{=S9ee$w8A!U5C-5-;8r2vvWCI4xDIj zq)jh_M=!6IjIE@Pc3%2j<3u^7Z;rCvM~tYCI6<$a>sxz>QJX#(=p(=`1W)(WUa$d}dsM2&cpZ52puAa<J{u5Z8{jbE4N0)@ z2YSCi!wKbp@c^AK%5&SF#`9EC3!&UUO zh&G)Zn|E)AZz{@_RB6B9<5bloJ)M7kUS?HO)x<{5_}DZ^YlCx{CKV{4p(yg4D`Q9* zxxTAAGRMMJB|zBg^wBl>Xi2RreNTb4O^`qmf@shQ{nP$|g;-Bs15o*G8nqe@*;q0k z$v_*Km^+B3M#x})0o}6a%{&R@hfF*a@gjqt+?ATjQ%z+_WjQ0UFYJx&OvDr8ee~f< zI(##xw-5tr{_N%p&*_I)h%nKYs>x)5`Z%D~*Z|4*#6em6oR#fZC7J6*V+uFEkT*?% zzKNwwgLo3xEKGE01{g?n5)!_#(La%<4c;#oi)*h7uv0*0%cG);JF2GtBwB|iKgz81 z3H1hJcbJ@r)PP^E(VimFaOlo@$Re{k^TM zEl6l-0-l2Yc&nRx3&pnNIKhFM!Uly!QwEM((yZ7B0VF zC;AJz@D{ipN{n@TT|WNZ_CD0V4fARL*-aXBbTg9+qv2yQx7I?7ElwzguzVjQS5qzK z7bCDMY*1C1|2}641pW+N8d+L$V6oQH#hA^(f~*`LPk3=#TJX@Vxt4VV|4K!FJ+aG7 zfAZU!AR!19*s(pzRM(67sxyJbb|W%R3dedld3`sqM;`0uCoE9spLTtIVtj{P!_P@m zL+hcC{Fr|ZZ$Ed+_^;%Okfw4Ua^(&ZNvgHLv0VfVMeR@3Av zfwW19t9*KvA3N8!7txxI3eU#51d0jmk0A5yj*X)ufN;g*$#})Qo?$;Wv>J>OUSh$J zlATkCQP1KQYpUKv;5NZ=r=@l|mj>3HZ-DbX!d}2@>l-9R6XQ*n@U2VGL=)&<5==%W ziItG<)k+7i^m+BMS7 zR(GE&ao81$uS!unyYjcy|H&77kqs%3E{@xJ1#&c`i6H*^B?@3W{0a`_`HDL$!|?I6 zR)HIbUuR$u@bdYS?Uu+DDJ%mFR^` zh@1EmFOPaEs;D%+NU7m0-X3LUu|_Z4W^5J-wh_F~6^5ErEf)4pHZ^ILr*0tY{lMx{ zn$nw7k>|MB}#O^wMzFo}V!rFL9)e z9=`K&i-tOk@3Y23&T||!Om7DWy6g)kc?;5dqhFE}?(cKI8E>9wj0|$7N*y}G6(k%u zkrt(1pZF7C_ji@rWU-dSDE#iLVs2#s_OGlQ%?=_k)n)3L!KpCkkoj`B%$lT+S9p*H zi_}&~SzrWB)zYMf@TIs-c$lT6Q2YcIJDBHMuhxj@4Zrw7M|g8oHN({>S_C4M>By6X zfjIX=dVHS9?`Bl0THmLRR6L_(Wi-AO;Eq*QCo}f)`Wu*6mB?_8J|Ra+?q4+NuH{ zRDvh4g>Cx#Ca|la?rVALD!n$9(!uqi(y-sx%`Ip;=!sNt7CGSa^9|uXAGUlTISQ#EdFAbbym4h?bK@?cVrdo8jk zr{H!(HV+Fkvbrh^jc;jR7Qf!`x8)>bGP}aO}a3gM4>6*=s_AiT5hte7CFBC_h-~`uZ=<%fe@>S zwcUT2>b_>`b<5VlGt<^uO&s5nzBt%iM%aJDgQmUXI~jrCMC#IpIxEv}?_@(rvQhll zppOu^$a*B2QrWT#Ht;rbjoFbj?jerKz8^T`O^~*2OVY`S1R8+Xce1{mjfeG<2$)7M zSRLDKfna=YCvID-BGYb^*PdQcrApV4f*ZgD-Gz9Mkb;H<08Li3gn36+*!T3_R$Bi) zO}4*;PJw-96Haf7TsYvFI7m3_%V%b7eoXwSxEDN!`C|9Hs!^{G=S2s$dz@e(@nBr- zuz~Ip+7KlMwsvFivydJ8v`m`*R@Y2XPYd|mZsfLVdBQyr$aAOdp> z3qEEHIX9$#LIcCGJsU7AUdpdW1C2hA`nMNw_s1DR-v;-Pi)TDPaa}vT?DjF-QOQp6 z`Sk(YWE{51sqv@xEO=LlAFW7$_H$O;3gXdR&H|1yLp*Nl{>x`1T1-Qtnd;-(sHP;Q z(L<;-5^7?0Puw4;g8gvQML&VZGS7mK6f+uPmW^RBz}JzJZic6h)r?i$jMe2!p+kC; zKY{2@_96%ZY8=3j`nNczHhQ6uvikx zKE7y)Hr5qwDBD`pK_Oo3Q|cUZE-j9Bf4p{yYPtqrEk1K0p=v`wG)Kp*3_S&(Zuswr z=y=|1D4`%NLaVa}G=VwL1nybOH`z?A++n{wb#ggFq~LW_q`Q*cafbImH324`9~foL z=s`0t!PtXub3F`>FG1w`-3I6}e5EU%*0TNss-)@S!K~XBcjV%zU@W%o z{sBl`bP|WSs)7v5*Jyt3lNcwL6Wo!P?Z?2*YOFc?A3w8p9YxvY?4!E)vh+Ww-J18+ zTLKP1s=ZGfQ-h^hrNz1fxL?t>BofH`C&l zTOPbv9k}65a_Z{b^wGY58|~&d9j`9bY?BhB<)u;8q!C0asAG8QRo4go(_->E>!CrJ8!ELC-G-} zXA2wF@OI0@Xg7-S`+7fzkOb8dMlT7oiADvqv?Zb0;nlh<+PJACAdrvp!h8Xx2|A}= z7gSX-M%!&oXQfQDZ{3HvVqrD%PbP-MRh8g9oNp?}WwE8FdT0)Dtu@NqiZ^|;>Pf(T zh#-&V@Cw={6uf65@jefRPCXn^6Le^p=$i@s0I5)(Z6lU(L~mzE-S>77lzbxFZ! zF4k|=949CEiT93*-{~O(^|pKOFwrX(M8$@NIr<}WeV~EZLb1wBGN`A~>LR{yWwxa5 zk&d>3I=qpMxzlIAlK$IFb6b}6iK+-z7p&vG&*!%$d+2BtN6X@t(zN3Np*U!h21t-! z0+P%z!(ApwInJTz`B=-M(2y75w!9cYxv*XCW@lzLL9MeGXwl{j%*zYGc%2IHyw{R z+UQoh3GHAKuTP|oNl|pw&pq}KVO;|^bs(;yhFj0hu$UvT9bd{4*~=60N}prmE7yBQ56wL3rlB>a{`eQ&1kH zYA8@tf`L|Rm2Dw~YXO_|D~7Z>9weK7W6e_=3Bncn*T2SP=;5=eB}a~r_}k+;avsiF zCgI(zn7dvaVCeOrdhjxH&8Ypux_Fp04fyEcTv*HDl^_}J1Rw%HT*!v02ujj@b{=FQ zpQ!+lFT_v#@v$wkp25c3ezfYXv`FL@LuQ6APaR7|aaY4TbEqDf0ik#|yPuhFM%okk z^}OH!0}N9#tWTku61873)trg?2x+IPDRtv*-T_thQqO(qj${T8SUqV1Qkawiz3__Rs@eq1lsEslTjwZ<4E%PT z)G3I&`QRs=5pHKEgEfh{XM>VB6Yp&#jn6|#Miuu_23~<(|J_1;8TC(igvn3SPF9@a zj$S0+j~2TiIb%C(A=Y~~r#V#7cpg_gX(TYuS_DAr^dyk)Rbkle9{r&G_=;0nt7Lv{ z&NYs+U=7+UsNzg-ci~ym?ZB%s&ah<91D|Dq{U4V`DB7p}ilcRj>`H zuyK~RX)&W{Q_C30Az7bJ-g#%F9ED8QvzI|NRCR`>Y82jK6ETre;KGSP4Ig(`9zV;9 zZXiIDIxUO--jr%TcZ5zb%5v)Pl@@x>6h_vdPD6OyNr9y*d!zg|4X`C7O9J``V^01) z*%O$du^+{hRj>u_L`k_CQkUM;ELpK~^L@RZ0*9jlL~SV)<>V`70ZCBB#pJ|jHW|S_ zgTdK_A@ZyAbW8!+)coIF_F1`>+`J$cqv9(+a;sRusjz5f%s?GLkv=hax2A8gRHv~^ zX^>+RH4H|ta>UuHlE7($%z%UO18pgCY?xsz>bxxf!tyL4zO-v_5i459-wn@)Yq*kb*5mLQ(SMV|8uB-UR2iX5i%0L5CJWI$hv+QH?Y0lP&|D3$t>dJsB%G+aj6CSY?+9VG`Jp3+RhwS}vg zdnm!Zcz3u(l$Q2(%H8m@c-=*-P~!o^k_hpBWNVXPsRGUG;U?#6$CmtRyVoASJ~oy- zfq%0Nw=~ZY<$(){lY>g+bF|!efUKkLMMVMLy=GNbazZ(8e%QtsrrgW0z0*l*iiEP| zQ_TH~as@X{Ga%8cXo-1bAwyhG`dS9m>t(o@1clcv@`W%UhHX@qzn2j)A+!jVEw%K1 zn|FiS>?a(f^dyWwQBOu-ATY}lc)>QBJKy8;-^+}AxYfy*<^M7MjL7hNq`>(ZHo&f=JHT^}N`kD@R-%Swwve>8y4Uk*v9*ikaM@65WgTUsO1_)CYV zboB6(9m8axRoOF;&F+8S{Z{kXrpa9FuzA}u&#`Nb>;8PjBGXGnOl%5x`()FD8Bc()>|9rcy2qgaKR$hB_{zh+q>0Qt zVzhmf?5T6wcWRrPZOGE%DmLdDO(Wx*uHBjW6Iy%4BYyfC)uy4lK6>W@!=K=Lds_4^ ztG@aSC_nvHFzBwKswqEB|J3l)wWFKYiQJMm@U~~UbazbuRU>GpK8dcGje<}aR5L ztJ!*SE@J^#;`l`oo)}r_Au_Asl}Zm>fhl_U?Kr#1sUD6V-xIZA$r(+!V~2S}VAqKj zh@_|OF#Ukl7ey&t8;J+F!o4<>1{Ifu-@9e?Y=yHLD72&Tr+l<;Qs^0GepvJ3xe@R! z86}WQNGG>=JGkPD?YkE^FL^aSu}N*S{AxOY8XRBn_1AAwSQAQ!Zjpig-n|u4!o;?& zVl6oJNyeR_e(;)9!f8*UuSoFA)QW`p?}>M`kq~t}F)Y4nHXRv6bqc z2u|8gG1O+7K`u+@zi>wk21cM=4q0)_<~}KpdSic^bLz(n{OE*YWZ~wi!uCwm0eIgL zxN!ZdWK5`OB@_@rlRd;ebMX>vg7S#X(R$=3654wrm%^mxlo;%VsJD}4;uw&aap?g(I>1ca2@YCP-aX!9##e5u0WPd)v6aY)SC(>$+k5Z_-u zpgZhe=*)?k{5_-`rs#0 z+IYDib}|%s-Vfb)9-aD55~1;K8BN;F(!9C?y+L}j9_f)h!0Wf?Yv^P+@T7CSAx;{> zzh&a_8<|Fa-KBgt(?fn?=a!9u%u2nm#Md zNZQ1A_1Pr|u{3AfQJZmO*4yjC&p$6s_qI@3yAnAAhz$(2j;%DS{Koe13%qubS@~Sq z*UwD1(tYoJ3&luDl=T|!H zb|dlP4Y)Q=0SI0l4g%}dt8PjYQ}&&1q@r>l4$PJo6}R4Xac#U1sZ0=qweCN=x?b`6 zNZnNnN}s@LdI(qnuyKFbujehgU96`zt?grft_i*{$8+o}q(p8>cs3wIT4XhzJD-0# zeSHoJO9^k>2*9l`*OoQ33gGPb%owa+?vDVMZ(ldc(W{Ik3%}qL=-6R^El7n6g?3-g zWF9iIHI6Nu;B#GLX3$poV|*9J}p=M!btvcR^Rt)|w1=e-f=H2ZR2Jt1uNEijFk zqJFSO{|#;ArZ@^Y9Vl^lFfr$yV(p-}RD~Ix@6)sql z=Bk!#V!0(s_ASr+3_CKk=MEx&Xmkz% z5{sCChCSZ1d`A%0?NeAwg*(x@oYC6WV55zWeCb{6aO3>}IyEL@Z@m2W&lK6#v&(R| zaWojw^0hz8uxm<3wwE7;;1uc8ABF{B-%cv}(D_Zgc2@cL`R!Yle;HQw$Y=UgW;@l^ zjwhpgs$B%3XFmGn=0V#PW&F_-s3pSLXA%_wFmR8{P@EVUw({=LKV>#?Wpne->rH;@ z#-L{iKEsd7_D|N2P3op{ZmzO*Er;3P+ zMzuGyWtZ^UDP%t(ygBQm@;Q-sb6=*k>}tyDR>X4+xH1$LdItC0doFDLPe#`Kxw&zq zz=hG+$O#I6VKmK|>26#;cnq1>7hA;AnbSgxG`UFcyBiX?-ZqBv-r4JJ+6eeP>6OuB-2|bt8F0f@2@Th3v=ik2VKOu32qo=3yTfIHZW3w?$e_z8{ zbLqM3o<8uUJ8REvfylgc7C|!>G|Ut0tc&LBsbxj678iYy^d30zYuRjz2s-1y;?@*@Q;{s*Sjg zjllNYLd%o_6!BNz>06y2&p=oqk#<=ch*A1KqEg<6g6{{0a!NaYr5Tg>P5`Lb< zvP-gY;vCbKfhntt%I68JY;^l{d^~kr;{W>_CGoLJqT0mPwSfz&X{}f+kPsh`Q*o4;9 zX_umMx_68o;NVxtEPDC`F~@7tKNd^)v>+p;-y<@#pU20M56^t==)Az8Z8@i{BOY%; z#{i}`S7Z#b@hq?nKX&17F2^E$*+yeaO-*HBW`5E#jvy5zjL{E6-vFIO`Z3(?idD^9 z7ye0f8b_09H{0`2hstGh0<0YhY$vq07cZ8}8~ldXJ8kyefEEu@hB;z6;+v7sNg1b% zp#0QA9yqxIs8q=OBBP`ipNLsg16Mu;jxn!hAPTbu3z=AEp%ms^df1)0M;r=u|$T zjG&!2Jp;d70f`gJvPu>Ik%osp|FIl#abWo&euCfdNoN+m8#hVs2_o~Q0rbI!!`#zl z`5vL3tb}u;0!s#<4Kb)x$xrg;h7o)4Vs`$p=VR9iV7KNp_mn1tOr|#sycF^9M|HXe z7-oZ?A7_-N${);9eDgHudFWURNMy)T(2h`v^5uI>lL}qvSS9pHi6%RDr^kjxrwSY$ z1c~;9SSpX@j`qx&ee>q*_>Smgs5x!C#s%)RXn z`So_YmT50#N0{yyRY#7WF+sR(<`S%AVSL;H_=-*W+(3g-YXZp)wUPCU1^AKCO8K^2GA>WH}cCjdAS$kr-b zd=Kb)*oLiN-rTWb)0{oud5laHK)3VWLaZw4Yok`j3Lawp?mb)IPYB&P_M~yw*R1eg zi@8?Zt3UoSdt>gq@WyHVnYweYf%jtqHaD}C>b`JO)4z6)k?F~{8jrRvNrB1^{^QkE zq1IrHeTBzzaN7;=`nW3bEg3eY0IF=a7>-(K?sog@w=7G&D;okQ@2|^p$xu;&D}fq8 z?XPzz#G~oulbykf%a0oSng%tCLU^B?OtUQ0p>`}zCOPwNZO;@_cuy1}^kzp-dsWHp zmieb_{r>(ZKEc~}S22?b0cFCRFK60zuH0eW%9r4xo&HtofBi z$cuZv1agn`to~sY;`Gw+p6?-_8F=SOU+aX6oB-86$@Yx1%KdK%e~FFz7ae|<$CquM z2}x6M68IcV5It zd@HQ4z>9@sFNrIK;_d@b!&Ew#*kY7e%`)&gbLSO9#2BJaBF<+ zj_}6VV9IV$5k-4GlKy6Z@jt~INvf)r+M1`6A>_kTL|Jl-WAry8{s*=xfdxG@iEiWO*R1j29p)h_@~7jh2B>*Z z%gYRzP|8KV{c^EMimqmxsm^O8<))0Ritk4UI?rdt$BUh}X6v%~jrN5-kwulC`h(Ou zg6mRUCdX{h6Osn@IH*E^lOHQnmh)9sg5YI7HA%*v{wQkB30M~6Qr(6$t>~!iVtO8a z5es$%s37*ruS2d+KXEn|b9hgTmluw??vO)>I;D(Yu@)aM9JtKutaPfHLct=rbV>2j`u#{_XO1 zJee~8VlQx!`Heoq!Anq}u>k|4LDhaPT|YXtdhaQoydc>y@VyR!_v}j5C`tt8K=b@* z^GLEa;zNf}@}7}`e~+os*UBhv9D;9Kq$T=cB7-B-Ltal(YVT8+l;aV~EX2Y|KE6hr z3AM$(%p}3Ks0jn3oAPDdL|fT`XhqFesH}W~X=@`$i4`emq|XemrHwvt8I5U*k47YJ zsl^)4Gdg;!6CtA3*~a5qp28iG%0WSowhv2>8oaNXFU>1`+q0wV*#?5z{94bX2_27o zWaSki(Pv7p>*9U@XK+tXVeQyM(6U&fQDSx@nMSN6(o?jtk($l)6F0AU$x(> zyayz#Y%la3=c<~RG@IIdYk+fh*S}+5cv*U#uHy1ZJFn4Cdw#LB+I8pjZXiM=;AQ|6 zB3|GAfFI3P+Jn0kX1w_M-dcFGyLC?pAaKc=#$&(Tm(Wx+H%P%i1~KRdIe(cvx;{@Qe)D0PeSy}@xb&cYk43U~+sEwhcA zZ!xc3dOCB|6Vp(J-16Xkl1;yHfGu?NeY=)Nj}4@yh!odZNt?aq8XBI1skpwAo1(Km zRuNtkevzz1D(G<`UP=P}7JS6pBHh$dvC@!MoFHCl2O}yBln8@kn#rEhKM<^cO}=r< zbUoU6#uKJ`2`jkUoIgKuKjwJ>YR`0oqMKq3#$PsT%|~4lY>TK(G=4*%z_sa8*epf6 zeH#IF+h6Vr@0?xmm*6M3;>MP>-081KGru{AQ&q%5a3*ylDs0%#m1|4sSQUt|OVK=! z)^>Mz@knoUehP0RR8OoN%!0OhgFRXSq;$WgrPpOliF9*kvV&NdE_ z^XJmsTv*p4M-R;}NEi9M!9SOPH(^T3=p)IPxj237!}Ra^s>f>RYE0ZTaCX<)hWsaV zbL9}0r1!#ugB$pAW2G+vHRtLnXS8FkW7ntucB_0yyEU1QCG2H$blneO;3cR)ap0ms zSYNa#wejqm)-fZ`G^*QNi#MmW3(@1vmhxQg`}K`*f|8@H$V8#6Zf+k2PC3(W4j~;n zUTo5OcRrr7JzUBkwl^FJ(ugCriwtKISeycAD^KI)8PtGm{Ad5m55{&fYb!avD6e3D zRbv}U*u05x!q30Ew34*AnO1;clwMN5?n%)75)yv8RY8s!_p5fTuL-l2eNM9XIzw)A zW?Q?@2FjyZnRfkU18dmw2AyWhR)h zoW727WMS=IG~43vEy8TSxXs?<$sfxrzr0_0)aOLufm^RKYSO=f-gtMVHN)Z_t=ghx z54~%*5G_x|wgA)aRhsmQno1~xo&Eo?_Kv}kM(rDCGO;I|*qB%oYvPHMiIa(K8&7Q8 zwr$(CZQI$rf9%%or>(91)YaA1I_LCx`ds(#zOE$e58<#$Se;FvWihGM9S$l)kGhpUwIPYdLfUF$^uXfzvR#N1|V!Dvp7|sUX@su-6QdMOV(cnef>R=nlPrf+A!n% zg0^z%@RI(HIsl(J$=S#yOCS5scbD!%jcYqIaOt8))l0aS%=`e^RMk9rvn^9U4j=iTkZoun3|>%oq)V9L8;6uFS}S z$Tl5}<(E43uPtG6gk~Tz`S)9uJO@XWv}mb#6i@Qil;-PTZKTWS0&4UdiAcf2x*TEO zwTMjsgLV%v*QJF~ju726(*tv!8-bHw$~wipBPl%r39UPa)%)dljM$Lq`sW;oo0PJG z!C7>{v^x=E0`<8~`b8AkY{n|*AOa~yVQQvkrTzL~OUyK>D~a+Oo+ACLT0#F$G?>+o zCQ-5-_P>6)T0db+X#J{Wp(?&ZRal0aXX`8}AOR!FBFm4DH7cIUy&w3P>#hc21TkHg zMg}0*Y`jr2inRkSvGPBuEjSo7toF~>I;!B;jbs(}4G*wX=akuQuNOoh^F(bn@4=ui zl%S60;qsh#$OmV(=bLVa&(Rc{Tlc5Sjl?UN9xLsl-VE_}V8$j`0}w(G?%1oN6VXQk z)&YmTlO? z_vEU?{RvxnR!l@k`b}%wlC@zj%BBMKNPD%%$mQ9Nf}>DBH_q}Pn?58d4ad7RJ0m@l zKDP_X>HX~64&@g^gm2Kz89&x7*A&`#3rs2@*?F?YZdd%p;Bh55&7ClC&kAcC!kLWQ@W>=S$ic2n6SbAP+qygMnw;FcVG&9xYHHSM=S?gKk*)p*tVkk}9!-(`pDCj_@s=^^829L} z&^S!#djtO5??azO)`n-5GLqnpndzdp7f8-K(=2{r9I29K)MofUvpmhQfr8_F*GEU* zae6Y+cWG&{V^0W<6q+`-)1|~TG4r@jR2FjYG7;aB0#?H4o_ee5Jj#U737cxqbf{B_ zTQlAF8-bWvX`(*J2|t*(qZ=66E7nh&)Igi@Ql0sm@jQgqq@e|o5Q}r6{QhnDITl*p z)PZmog|Ch~UMF&wq%xNiz=gX21sd12sMvHsn(u_yBc;=Qq@K_p)|J;ThrQhA| z+UW}@m-DeAl8AP%xs6yJD^0exG8p_H2vJJ^RY`6b{FH`{;oQ%Xy%Z>lXk^gVM4m~m zQd5RAImxCgiZ^YcGQQXWjkfof*E91IuQ;N&r^Lf(Ecj=$L)*z#07K?OkNcV*ugvYz zgm=Y!2R2l1f$RqZ5lfyrgcP<@nZB9M&sa+w|1oSrA(@VbZ@ez&Kv}UeOasz>NT>`M zTaDESRRtXpxr?sy6*m=YDB>%=>B-8rF_b)K31#UYaw4){SFKo*_5$A-M<3*Ncl!_u zjK}8|j_dAaF0g%Y0fJZ&a}!YE0FYP321&!L7H`^` zKEPl&(uB5=l03e93%eYL6bsoso(NCOip%+BHzpZQQqYzTaD@b$*hLq0L_&Sk@O;(McbMv=fhws@B%m$Jw;+O{>6S#skJ88vCu}gqY)% zw4&LG_1d`1`G^gzg>EO9FAbq9B@vhmq#nWIa3rxRqt+QIN3vDT04q_lUQL(TWtRHg zkG$81&YV&TSiMqmgkRe2-o2``2IiZwO<8K{WS>?8E)8v%$ZO_N^|9g4T;@}el zy>$J!3;m(m;L5~d1ioD-8qN7+?s%0p<=RJApzrw4l%?ct_(62y=rjKoz zC2k9N-!#OaG5woJtNj{oil|B0c`@fbW4hM!LH%zy86ELJdu!6H$cJCrZ!S4Giz3rs z%e%l(n#8NkL8x8Ri`MD$xP+CpUPX6Kpq1{&OZq=98zw{}XdRtwcF9=0%(gCAGtx&M zdonTLx1I)i$VtH%hJg8m>YB}Avd~Od55V33gVE@E>Af}x%#;`K;lg*#?6Il+`C-m; z4wHB_*;?o|EuF5LYcmVG@jf(I2SuU{kQH(Mvx@S64O0K1Klob{>4=@~j^D@sz~GDxM2m{O4P;KB$x1 zSD;PeV~;z==O25Vf^>=pZ7tNY^SROC)zb_3$L&h`oteg<2H@^J&t=L^M)qz@(Eo~L z)QZrW{pt$?tBrZ&wSLiMJZ#k6W@>BMk=o+WL^R>QdB;ses+TS+Y5FNLfG8?b zYF?v6`gai&$`I`l#>%T{f|aU&+OX)bCrVH3N3&fVCd|X+u_J`EbFyX%%uT^H9~U4( zIy4l0Rf4MZl(`jtp~+3hiCV_-(F4MYvgeLPR(Y<i-`BWj}AVyA7@9ma{ zgEybeDfZm-7)oPDTmQ}~0NgxtZIM1`?zK;GO~1h;JM;(o$FD%GI``=huniMyR9F3uLen zK%u6AW0>~P3B%>{L4&Z?XVOul8<>*=DMA)2%8oZa#}9Fg*G>Nw4%Ehca|*8TmK=Gg zHnoBXrzP_16J>l4?E$pVPR&r8YYsH+*T!($4xnLtfyvpH0%(1UuKRMK zxw5a@BF|UPsz@$BmH30r6gz$G9oZxQXPWiuZ*6F_kt9)vx`zm4rzC%~SXx0ew;_A4 z{5yw%B=!KN9n}X9s^nkmZ;BTYmE5GAFr!S2^Omvt)U0QW)8MV*DmOa<+#JewX3{j_ z_l~%T@m0Q3Ye07V?FRE?wZ0Z9^TEG<6PImK$J-{7~~jAU;RX>y}=~pF;kTh1Ax_klqH)TGit-@6udf7 zBm@06pP6!0FI`H%2Lj=PAL^=)!&FR#GQ<@3*mc@q&n=C;L55gqp<_r?7Q2K+*kgZNlG{BKpc+MiW)WKx8~`mI`@5 z!Skmqy16(?a_{UA4rb_h4Q7%Z)4K>fQH~)LCvOXW#jE?Tc|}2$t>b##?5`3ZNEx(1 zFWwXG2V`dPsrGYbTeCSL&3GWxw{=fn=wN6v(y`CH5hkfNe7q{(i(Vt_FDounr=4GG zz)^ZT;+WD2_KI=j#YdiKKXP8qNlPcb22OF#%K1~BWhSR@Fgz^LQgPPLk3tc(NFj`X z0}@$On)N`L+NzeuGW05Vu*$*D!d_$ndt=OmeVNNkk0}>sbaofCAC8G37q_@q8Y*5g zvs0jjri1xKb*~S~;)(*nK@EBfpjxm9U8S~%I8Y%KA(tFEM27jVzc#zbrEAB z1|mx+m5~olcS;<@LLY-;%nxZ%@5uLio5vCv=Pq^r(MOj>n!?_W9=lk)pv-ny0BLE=9T<2L)) zDOr~AFd?SUqMn_Ay;fwB;fXDi*)VicWWM8PAY=dKvjXWmA>AKd@885t)HnFh{fvbz zA|y-g8ovESb68@RtQ1L&l6?qyCP$762TcZ)4u=PP;^(w9_^r&Lz2GSURu`90%cufD zsQ+-dlq>ZeOqdR(JG}@bu}7P(QIi@*(fb(?1<=?(&!CSX>eRJUY-8-CMsJ=)Lz^jPRf-wj#+zS{;lw zmL@_gH##6VURW5JTjK5k{?jXG7bCmZ<>C5d57Tdy3FyXeU=IqA2#5oTNyBBMm0Kay z6?-GpMhq@OtYAB{MbEmZrJ?F?!w;SVGw}}g;VwrRNFSE%BFb-rJvB5mt-g2B?=Y&j ztX7stXK^PiG%MNPqhqBNiXwDWcv9XH47_!FSqLM7b_~j%+VDYua%bk!Mynh$cC^vd zNp&Qip+UEvVf=LA(+ww=Pq@!D_BaaziTdy~KlTS2_t*(tvqjG?TV+ha7g5wOZyg7E z#cqaDl?Id4&%uon-QgPAxq-~StSQ|M*EdqIk;NDkg@Ijc`V1>iAI*XOMr*jH$@toc!Cw%$7qR-v{gBs1L zoGs0KAjYZ-I{vmDy#7T*g;A&fCVXVxe}rm`@?}*JC4~_g+4QypMiXUXVd?DA$Q;3a z{RIr})~s^;5Hzl5pkH6Ruw{!`iRRjRg1+*3=649d1;(8Et75wz;2tg!FM8dv;9W0f z-ZfIbL;~_agzk<0M#PT9UsjKT)miCGL(S_K-d}R)7Y$zT5R*~FMl>L)wDoT07TVr2 zHBdk@vzNIA?RK@`netV-or^7qr1!Y^_7<b*_Z;L zvSce?>jAZz=KCjBCFDEQmE)Pg{EXBusE>`;VPeNcDtM{T&l!6y<%v15K8t@tJLw=6 z=4v(R?c%KOyDwRTezklQQZTyfGw5g_b(Ti^E#pFnAI<-EHa3~l2n9JkEZ zeR3{iadgsbvoiFvqS*}W_u?t=!(FXgB9t21cDea+B^m@O@0F8oEMo8G2ivt%B)_-- zG>n`#Z$WW3&k5sg7>yy)6J%}d-AJWfD}ZRUzDkdSgSoP|_d$6*2JO!4`KO2f@Za+R z4Sa8)%(?j;B=g(O@!s1mvSo|=m%l_mMrwbv^7>eq_m>gwGa2{$(>)DEK;Dt_7cRgc zIhz@IA-Kqu$*X$QvVbmGEeR$yJ7o`1znQ#dFH9t}>By5w&Sm2!FwA@ScLFau2$)q4 zD==YiUD+ZJIOr`*_7jOX98vGs8s_`(Da|>{gO?Ev$NbZ_EqFU$+0&mdV?8;)_#N3~>PY+`r_@v2(wG4u<%iVlBa#jn z?t`_i>5tpm)Xh8(EgaJUQcu@)N}$iURJGlh5n1(+fsw!a&P1aUu2B*!bD9HfqUV== z-EU?5(Wz^f_9Lpj3Z*Ro?b>{sjWp_^@Z0Jg;MVzWgCZ#Sdizi2fP>LNR8mU+zOwoLa_2`}DL|4ddvcza z=0>>~E-93auJO1ys3ky^D;=@_v3Q~V*g@U&aA&$e^Bk2X$G1Iaqip+J9C@|I!?!J! znSND8Q?TiYRH$i>Wt70(`#Ik7jYT%|7VyLZOOq`zGv*at(y^P-i1C*`y}dgT z*^&Fo;}mH&`WRVt2D^lKnvRNLH~OCOD`C{r0hMGjbNE;|((aNhaTnfc>M}013DDP7icBsX|owq9pNAn72XVu~N zqt^iiYV5%1ONw#SwR%F98%mjOL{jzpzJpT}^20s%uAnl$r35>LCosc)x~2;mS9_WbbS?A3Hi(|xnjy(w zN3tl#1ebZ)bwHe>I?Zr#^b!J6eSChBTr=sHqk)nXf4Ye6Un*pNs;Rz`;Q zTSu$O4r5RZz}kb?wcMpuYePuble>2zQH-E+v;D%=Lx7_ynmIr3G;UIKoGpvWf|4-_ zdq)xNnrXZ?>t5!kf{!3?ER2>#e(?#}8>Sw9vx2%JY;|4o;B3p1QB!O3eG~%Njs)?C z`eITtQWWz=lX9v;fk;vcTG;YzzZ*xc;o)MxCGP=Z-c_}bNh6eaUca_Ap|yN26Sxae zQ+HWqZD2-Ty(@v1tZv!dukVo2@((eqWXdCYmE9!oT9MEL!SK;o7qxjAMhL5=p;fB4 z0F4U;0?BZ`*M4q(iH|r*%vs&fGp}X2?gR_}Iw%7sQm&+f5XgUG?_#h{UX3ZVskg-z z%rL={22)l4ax}JzDYZuzHts=X^e7djSa)XRVSrje^>aw34 zQ4j2W&9yj-jiC!pq-j+WOh&?tjrL(4DFX#I0ZCWR?FXfi+fhOrkn0NakOuU>r_&6y z06o$?#$?yE?;rbTyK2r8$}$rYPTue(S)2eRQB{7P>~~0%{n9LLWn>mSZ;%v|ZRlVM zBVg$}ia?jV{7^!9e;t?JFb-Ep9)4?2UVe_32zAC@oN-$EqI#`w4y_qwMWc1Wo{hNX zO*RgZA=kW{1f%Y^Lr`o7;npP$72iP}3T`vB-I}+<=ECZ@8ctuoF;Bndul(X5r z;{tE2=!v84X8V3O`0$k!CiiTtJfS-=GpV4oOHmzQgUIleKx4?YR8roI~^U z-J?F;sL}&=H>b7fx-Ac=)YSN5jgI!Kd?-byb)e)Ud`Mslf>0-?q5lhz^m|(1aCuqS z9&AC;>b+LGyrf2NokdIln3P>I=>Chny8CbJiJb^xYv=VMAnMO^^^gB>TkIoyAL9SH zCE|dNj6G)Z{|~kG;v-r6^MA=EXd7@+;0qc1&jbJUQsDYYk^gfi2n^E_iC0oV?K(T# zsp+-pH+@1Q!q<_q5@&QVasODme#Z*MOht)-kiG>yP{!x~BL2R!&_u?K1hWTsi9%JA z1m2sth}#3^?=r#;!rG56Hl$y;l{k0EE>xBu7^fpO3V`PFn9lAFtIACJM(+0{T^sTP z_mt|tKM#@g_x}tjmxaDQDdGPO&_e!y4`{ihMt1M3uk zf$9sS$Mrq4N-DqPdG?&0{7%2BA?rU}u&rlz5`M&Mw|6)D=Grd7zOT7X% z**nD8{z|ypIv(m-B$#CE06f`GSYZSKhkFATX@F4pYvKPiC1rvOU`Mg7`=4p}dh-9D zNL-%|qw`ZeF?L72{pN4Lh3m0R!SB@z0^8}$Y*DU!^s7{nY_kYyxK{72_`IHox%U2# zm-%9)YaZBqIk)Wm?;-IR^DLwOnu(p&oxKknNc{G*k=0~wx>OG4Y-U+zpNAXT*#^L#AW#$wt%!y61>XZHjsVOm>cSR~dOpc%{kHyurf+l|}ij=N6 zct#6K$=y##Qen@~dOltiL$H2zaoO2`XmqDDOXji&svD<^0-`3qUC8`x?h1SYm!F#t z5W)zWKCzGtzu5e<@JDGmO-FuO)yKvp3m8YPo6pF}_dICqJEQvtjS<1iM4rTV@=HnK znHtmBWVd$$B%uo--yAQC^Lj5xiS3|CW_nr^Tu&cr^h7BwBD8A)!bo^>lx>~R<1OfP zzXX4W)k9Z381=@4DZ^UiOqQ6mIa$|q@7KnTjvzx($YA94(}HTNSEYvqhb`z(3b!l5 z9UnJKd5`WNXT_$1wZc)X+6?cz=^7I150(a^s$hnI@i(x5gXpb1s99s(%R{c>yAu_D z82F)4BFZ{DFn5LXB_aNF98q&}-`g5!zKRG6qL++mwf=~6|GFb`p?qd@Sqx;4XVfgV zYO`DE5-vhkp2RlKYL69(-=(YL3+wT9%Q-{1>~Up9f*Re@G)n5|T#c966NiLEPVBxY z0uc^Ce24shR{E1>l{@~48I_6gt#0<+zoH^PA@Uf^AKtfFo#Bv9e2sy$WEM1?rQZLI zM&X{BYY$Khe}%^Xf3B5h8ELkkGI9V3h?N8BGM0r!BkQzC;anezV-{@iqy@^!uZtXi zJZqT{JLKgBv6k-x!~On_Rk z7`qm*g*wbk3o5n4Yft!cABzJLq;@MKH%5kz-iJNP=gX2m;pxlPpc<6ir+1&{)3g}r zDEbK6rc9SRj=rL6fxo*w)K+^rI@3HMk1Ri`-@*@7tIEKg{35s>NI&dP5#YrTh0T@+ z)F-*SSE*BFd)0#oZq+T@ZD5PHKWejzovAO|u8bTDG<)eQIb-(-K|&imQk~r{{w0(Z z3xql{nJl#5aTzn@`}(kyK5d%Ge1GdreBMX;7LA=7&NF&=3*1Ri7g@UnO{DeBH$K1@ zs34p=@A`jMHPm^tM#cs)&OV(_8b+h)6qXxu$nf2fuAb7YAySY?wT|+>u<-Of#0MgK5K(Elz2WFy5q`)Vi^^tZz6sz` zz=yYIz6Az;0IhhV%OkwBArciWzSI-L7rD22@jP%DJC&6e1A1l@KTWy$I(9`SE(kU# zK+&~Ec@KCz_~35UuT<#%4rq?8FHRCN-t|S4s9mUGbY6p0cBqF@^mQe>vUYav7s5-v zd4k6v4my2SNPZF1-^#xdAvv-hR500%3B6WM=hKdA5SphtAH`=`4f(}WBB_5z`V2m^v<#Ce(jI7O(DQ0nyLqLLH&wr$PVJD9FLcu)nP-=%o?;bo4CDlA^?f4n^$935NC$?L z;GZ4*L`$5FD53i4RkC8U)RCWBv_RW-H7JvORmsJ{cT}p(x1ezNhpyFWPq}g_QLW*2 z!jPbFvpuTxM!{IKFY}|xC-&2YkMD^N_bY#^$NIu>;&?SYzyprJNzi|iys@hPo$2l${>QWajttOzqf%ewrta*M<6W~M2NO7LpQ<9=qO?(T-2?*prW&N<3+;lmA zuYS9TF=y>~Vp^4_+if2749eh3+yp+K$uhQ zD#sBq$PXg2D;=S3hX9&qp2A$A=j z`kZBn;?(gbAJ9;-b?L-CXje*MeTY>o+FEt_J#=OKvU-b|p3n6NNXt|m1}s0wCf(WN zp(=(1qqUg`yU~dH9{o1{inLNk2ODX1`++0z_I@_&I&F_@b@|Yj6hGp6dcwh`sz z>FR4Q|3W=W{HV?@^NsSf`BmQn9jsUd zf|kD;?)PO|Eu-2|4X$PVv$yagYFq3hQ@ON0Xc7Yuv1tvDN{db6t>%;Nn*Gh-OA+HVE;XiGp^Xh2CY(MykbD3>G1u>>u{mnLr?~rmB{&z zwoZ4P`*T>vW5MKK2JF?21pTK8)vTQ;nY2NE-m%H7tXSyuimkB5Ru)E18f51>9BBzy zl8WVG#`ZioN@sb!8Qpns1yOh#w-I&4_Hc?VA&q4T>typn>3}=NYz+cy+big5s^IYJ z=feb7N6E{_=cJvJZ7szz&L6_>f0q2nV1o!1gly)h(2IkN)h$koO6%VnO!4Z~>ZuUZ zf`~DaYv5s`zWydYY`ATDOgz8aSTX1n5psKCOx|8Mx$JpPJclv!9%f9Q-g25Nhl@^|CY_x2%pjDFK+z9ZUKMG{re{~JqT$^)i%l_IsdNcmor2GgOeu8 zMLPoS(i>wl%lIGlOrvZ zgOA&QN@%mw+ zObS###=66vU@*{#KWZ#bBB;}HsA`0zGKRCGZ>5jb!H_IPxx_6j>ws&PAc0oL_V{48 z2_7;s!V>x&D@*ANUI@;uilS7=&!Nfop+S7TC9IE^_^x+jB53a6)Ur@$BAcn=Do5#= zk=?4xClQhopF?}6l&`0Dd?pq6$qY~-hW z>m!5ag^aauOhf=l=5==h68)H5rLE1*tg3eT#S%>{hA-|A*kIdbaKpic@;3d;8Qwms8q zM*+?K!)oF3xZ6#D+tWrf?0D#K_|O(6oexFBgXjF-jeW+lrxMmU1^bVk2TMLgzWH$ZK{VgSxbY;XW5s3$1@W;*Vp>nF~Yhl za(GI@DYBCxA-o`@=dA+0y<;4*oDL&ki)q9A-0qi2xq?~HW>Z~Ol#MVw$0mPrsCIjY za#vXoX&uMgWQq=2CJCZ@j#18hj$&$M6Ct40a7b2wdJBkWG(0ggJF;MtQ*;lz`6<&P zfn&nvq)kPYrF&;wKR-rGh07 zg01#e3oz)U3b-PSZfJ3RIK*Hg%gU@lMMpz(mu~*h@oXjZw_B9gr!kOH2oym+yOflJ z@<(30$g0SNg3db_GHhTwQMET9es0F-Xg9jIyVHgs0*$qn_ombT3JWYxK{Uv`zQ#Xx zoY^NU$N-`|m=8iIIrJ_$yXOnknY3R{f6%@om0Sbr2ZDm#^*F zZ<5G9$1@&Hs-uDLF#|oNGtiv(2y>W|GY;2XFbh^pB#7`muA`J_qPxY#+NS|DC6c^- z(ycKN!Mwi=+J|GU>H)jeP0ihtCw`KY3D^j>g`IXn(8dLt5C_n)NJqPnybH~~Qg=#= zlkBY{LwwE6QF*{EBG{FB(6MvyLjWp9us^1>!r*TbC@Fp0oZHW0CPt10ygtvD66&he zvn76Hc{H?t>@TImZ#xnZj^azLJF1TNxFVWa%31Q1<@CLL#6bLaWvDwi@vgk`oa+1^ zIdAml2JZ+83jrwh<%y@uMx=yuc%5MLzg7sZL@m#qH&nPx%o}F8xYN9uIca`|blupB z3q@NCi-4dp3iI=CQ}~JJ3K#P6tYkL$TA!-*AcHp*n%8IbndKo2vF5p?3GU0ln?zsjBrm{Eiy8#F=mVnlw;aI^(y= zXzGSBCG&drPQ6)*{O_J0wbj1VnJy9i$l8>zNl;8|Ism%D(yR2%c z#M{Q0K$ChqCXtY=X_6$<NZir2v;XA&htnVmfaR610q~AGIuevxUo`C zRT7E5T&0KlwPL%yF_XN_1m`s4Ev+oZQbcA-53qjhGoI5meM*sG^OV|}33PGQgkCbG zw0aO+H5)v`5ISM$JWSjT`(uEk+TI*?$3ky?`b#E?%H{fl;z{2KVmHB|%1xblHp4Sm zJ=SXiL(M|!?9&-;@U3!hnU9_Vr0DIWlKbVYaLmO3Z?W>96gd`6)3MG$zmI)0MZ*Yu z0l@tLa_noVoDAvsX#_SN-FUl`0&{ef+uVR;wygPaZ@|L5(AGr{*=Qt+rDt^`R5|PQ zs_%JwNQP;vssB7qu=P9yJazuqrChIy7(_gr;WeYt8L-Q2M*U?v7juM$3jP}nIeOaI zeyBj4)k8(&pK!lojc)`{3esBC#v|9 z?SmWiS96g*s2G~e#rAhR=#p+SRb+!g>a^R)u(eeYIeCbPUeLR`6yx!+0&$Y-Ko?X- zV-AF6D#UOz1Jr7Jg8Zg#IEkq6fe3Cy3S2EVlgmgcEVl&M6SrJ?R&VEF^--c;(Bj zaSHrG3kAZA07Pl~(mx8+wKcG?zR|+WcwcmPeGBUMte%zC(0CBK0OmB2a(;~b*ql;Q z&L}d_`TnB>AM9{70Ti-A1FDHnG9cdCgg%tINVXILJTS;lo*hFNS*)oq@)cL^zc1+E zuI&LAB{Yuji_rff$Uo~TTpFc9i(5hts`SC@yP8Iot?xnyUFw`sm^~eN z>`)YBXG7<8`sY@`Jblw9Y2$H6P{h<3<3TIo1y#^KT(sm*@y3B3)m#n1zrlGh@-VL1 zLE<*pHG5(wLD3b87`Q65u05zTs!12N2-gxihI5H?b@qCPIE?+4)nApg;JEKRTT*9f zjCrnOq`1FNC5nim5asy@39|$W&kKv$Go>AH7YkbBgfzfykf&?~2>bXV_KZnD6#bur za%Y;&%OvXMA(#M@KI@X(8xxJ_iJkpu_q$0bXIp3PP|MEny$(rRNlnRr458lm=rL&{ zn5=*QLFGcAI;JAXYawk31DO!1#<`t8Fy|oh19EX`VGO%d(9(EDe7B&HN^Wc!C??p; zc?kA@Oi$?BpMVrhiuWTiJP$CM9UJcqa#Z@fR{c5KM?nN$y|8U9hid%t{(8j9%jRBR zcV|`VZMJI7pgJ-mh2x7%647#|!%i~yKRMJ@y{5A*$5Z1Cd{`mb;6M;SecHH&4E8H^RJ=l^tOQy-???$%6sPn+HV(D5F;D(lrEA zXTSf#KvRrcgU^XL{bEhNO5z|*w>P=be+dyy?)bJ6*)~D~EPJhU`RtqUOSXSlzO3+( zm$oByZt3`uJ!LDxg(!yj^bpo*lBl*_Owx!H?DYbo&$p+Ugb5Mx{net@$XlO%gZLrz4Nd zU}XbF@1Arfg3!!2N3_)y^rjc>ybpT?RySBKhut=tr5asXH;{>p#wL424mat8_a3J_ zVmSnvyf#GU1|3M>d}xSP{_$JYadLlayRvOJ7DGf1%-Wf2s_{_^hmC?7Xgl!a9QU|` zqnh)Blf+(RnImREK)s9M)dNy{+c zh_n8>Z13g{W;r633kQOMZgczI!W7j5u3_gGklY4&6BwrN4w4oVI`6HSvuL!pdwQuy zrelS910v&{xlNx1{e4I(Mk*^yt-E*)XgDg?gX#Zx-*BOr7DOJ*-{R=Sxm9Z(62~H( zH1yID2?8VNX1&sW%5ExoJN+T{HfrIAlFo2~*6Z#0V}0y}Uu{Baf0;F-ugkOv2ue=F z9{Cn9*vv5~`|yd0iM83(1zSEDF0_`0$$U2ZqjaKq+Pq4UA~gNLT)#T10_TyTUSvf^q`M<-khwARA1rE-CO48UprxVUgWdWquv*9lYOU%?88mwgTX zZ-m4o9nn|Azhf`}tk8IBK~=`h8D!cBe(rNtS2E@nPmKc=78W*<{XNd`e7E#3-@)gZ zD~1-MZ*r|6vs=R{Gj%$LvgT-wFzWI8D>|026a_639XIQL4x(g81RT%6a#iDb&b;IH z6M?$a~KVVI`cd_?7oVmI3>^sMxc-86sQ4ZL3Iq&a*YQ)2V0^OP$ z#OZ9dv^4+kc!+nP-a;<}$UM44PU{|Qrx(qEERE&b2S?jaq7cY9XgxkGX3eh`4r_Lc zrk0v%0m`>Tjuyu{5AU78!Qx}tehW;r@#|UAE6(sF75Tvp*Ymqx>7OI&t=l%GDevBj zfvs(X-*(-H?pH5A6kr&`2v(&A04K)p{Dqw@VTO}(LiY+aZj05iK4Kdk>vQC!D7gtX z@W_Y?#=pqb)a*Fq_SaVbwuG0Tf9u_SV>~q9-M@!2=KpOM!cHg#5a-x81mO`Q2151f zqI_?yS$55uPBy12EUNhtD#+4@%Vpn(X;1M`O;Wg;tZk(aX!6cH*}$8P?pp_EB(qf< zAOUTN8WWJV!8S?jqNn%3$3Wh$)NP!(o!nLJgD{1hEp}}GBV5-=z=LW+Oz1clq zs;$!W1Kab_Y_2^3k;lYT=S9zo*9}kTAg3i4h?@~0I<47oXpdkL$xR*%a<;XiXW8sh-LrG za~It)^C++W4TP)lp=#@+wKFhkrww}H0++S(4P%*h%H|AUZa7p?eOYbo_)=}$^^$PQ z^B=Yn6(qdc{XQ+riO7GwsQZ!d5Wz$zxjEHT_E0W5q_KCw@Zt4_Z`w`mA`8X|GpdfM;4$@S43sQGv|YE>o8K~iM<*h7h0tSApTZopUav%P zIR=6^tH_srYx@war$D>YDB*hb8WwD>MQ-5_r>Ua4T*MDHdshDFRzr843|@Ph3MZ9H z>YZyddY)w|y$Z1wB@EOy;kqFBdw$O-P0*;dSW5Hh(;h zHtRg2zwO2+syL{GZb%7cih`F~Wd=bZmSHesgsvOt5c#eIO>c-EydqVVHUv&M;!H1= z>kce|sA+9><79%zdXC!HePtEv?N%jM8*7yKoOS6o5VDj0?lHU=)UVma;Qiw7 z6BDi`k$}i?{!Rg1YlE1m3nIq}9fqGSE z`mb=6xAe7mNJz+=%hXA%OdtfArNghUt=!hPymy|il8yw1gT-nN5ErVMS1$3tSAZV0gNlxD)X5J5rwTaXP2%sK&kkj6bm{eQcF(U8 zodh!(EVsK;a^C&A1EvH`ooR>m+KPC?I@z1LTvj&11RN0tY-BfQd>6X)g^2tFBQa(e z(F~kE)w!L=ffi6JM-8RTI?Iy8cTmnAy{TKwkx5nLC(KOFkJXzsie$tgC;+wx>>{5t z7;2kF0%6X&gJ)WJog;zXX(|B|(fc8I1KZ!s#!NPRQ~g?{KAj)e(BeAFC##r^N2UdQ zk4%wkQNDqJepWZ)mZ@kQN6}QfRVh_VconY_{#I+G7!#9+y`7sq((Xqy*s52d>S7OE zsT>_a<7<~^xgb=01vIKc`+(WyP2jwGl!IekcCCutzVR3o{{C*b#Zx{#Szd=km5UvW+%i+Xk=2N^WX!y+56bKj*H8u;QcMO)@fkM4e&(I%i zZBki#S;do*Yi&5H42GDd%iYo8GB+RIA}=lc=R7I@1JUQh z*KX&K_qx=1$&Y1hLlKR%h#ed!veE+l!(*sR-Q3im2{SZ_g)y=_V&`WsD9TZ#n47!U zw`=89Yk6N_=dWcZzD=+?8D>zj8~UwT=H9(S<4r^*dhVv~g$l#VPG7+@fiR)#u&`R4 zIRBSW(?h6i`NIE92AEMGu-wRBembO zUwRob1-OR@CZA=w9pJD9+kXeytgeK7cXPClRJ=r>d}*faDSQpY-(T;rQNv3`$%3aJUDMJaGmi z161JXq2%yk3hO$N+RR`IZ*GqWHXu{-H+WP~DOA5nHfY!oYWEOQ|6}^cWH=dL@f7EAd4}H|+Rp1DS zB__-R$<$75eFJWPp~(ar!Q4{H@lGA1Vsml z)hz-c2?_Y6`s40vh^6Kt>W}bRJ=hojQ?l59qId&F5fd5j}<=QfJL1YKX6l zNJr%{nx!yeVuHR|&B)Qi@r)f5wSYbmiHc>?MjU#>PIGiC}Bx>_^l3Uq>&E`Q=>SQLw z`JAow3JRATU*B*C#qYg_9$#$q625pDmw)!|(4Az7`V+g!Dec7}N*E$WGh^Zi&d2G- zzUOi52mX%A%@>Ewf;oIPfj56}`i|CSvi2OLrb|bEl#NHc0@B!>t ztO2+O?M9^zJZ)c7-C_1;SJJNwX6&??#Qj8!)5MN)G7sj`Xw@@f>Ozu-T{;p{cX#)B z=k@k>+9fGsih_c|kDebYrYI;VoDB!HTVCU@pK4k6+De9hcLoIo1qFql5Z_Boxqy6c zG35e(a4uqs!llQB5K}H4X-PprK|w)5;hd2HS#)6i|J@J;1qB5K1qFrwA(WUY3JMAe z3JO12)C`+(Ef0(tvSP4;f`WpAf`Wp=cc6$V3JMAe3JO121aw~hg#Sc*zZDb|6co-4 ztxAOk=b%vnG#7bUT&+fppazv%K&1vzbMfkb6LcChI&dyYCZLl9RO*Wo#a7`GMG;dJ z6ciK`6ciK`6ciK`PD9e`5WKt)@I*iWgZ{fS{Q&H;2D`=+mD-3yqrom*y!vDth;~m9 zjDQ21!-z(-qf)!t($jNV9C^5xCi$TLV)1z5Zv7zg1fsk!Gnen+=9DXaA!h*8Qk3+26tZaJokOh z`F?(D&Fblz?x`);uH9AD`&vpt=r~9CCWZim(X6G2TO*SZ2vp_DlkhyG^HR4HsLH@1 zhbUUXjz`f(1k(O|TZ>ZmE|)$sDj;IF(tgU|RSis}wzB%Sk8gu6mib?OhoMCNW~h{Y z`y@^IC4?N?@A%*kJg?<4+es>Ws`obIg3kTHyS5X65Y%k*M6M45^A<)%Ttq$3&d8s5 z!vM%LYT9@>TL5G=2gJv_y(v(yH^;AzU)}ipS|?j|Jx{A8mWJR`hG2;zy&Tr@jW3`e zP==Vrw#6HdZPnJ5-pLsE0d`+zqa&W^W9VDXV86Kp5|PYeV^vST!7pf@^OrVqk62WO zptjq6H&{y>9_f+uJpXKR4rFyJT(Zz!ySG%%6ikh2K%Y4LT2^-G{$@ymNRHJCxrdqL z=*D1c$xfvzGn#7WL#BTbr)+l|-}IE$1s=A&>A_izYZ?d~_Ez zpppG~LOej_a2EB5XX<*#D+_&!^T)TY^+9FzI`)s6b{_m`ysaArBv1A3W zzguewwj;Z6CuAf@b=Y(rZpS1ecSR_rU^+;I656_Nb_}eXUIHt|8Wpi<d)$iIiE+q+`R(ow+@d}-TVYd?8vd%Baq-5m$f-biWy-&qzsgKGD1K`>o)Odcav2eAL zrB5M5BKQCN?7?ab5$c`0AQiBk>^GD9tn`@;Kb@>~389pR(}tse$fGd*ZEYW$n3zh48Qre%V%zIvQw|88$Fa%NXQA;YS z2kVBc7-Z$ser)4)v@W|LgqeekwC@iJ8+T*OyZEmf(hZPbbpA1uMdDUh_Vzy}^ifEC zDaW~=Yj&ks@HjLZDvUAv<-WQm(*E^~J(o})36uwljQ*{y_7-cDDy4S z=ISC*KD{>Mr1%d?(BwP<%}<=ZX;jBCghg6jg_Os@LGDmh#>}#1;Sck z_&N&(=4L^pJZGJ)2=b>$c{o@I(P(#fX=wr3+aq^nbV50{vCH-7#M+q1iNLVloScK7 zNkh+&xBUF+rl42@wRww?v{!7Fk^fBxqDau4JlbM}4eFh3Wp%g#SuSO?Fcj{4jjcSw zXhPYR3r~Dj>QE&dvcS_g?)UEyO;6~5QrLeE-0BTi@~HyOuPGD> z6-9CquZsZ4&fM1t8AZ9GgUpyzD7bi^;l;!MD4DCPt_S%s*6YJ+W2IC$tlPtmQ~0XC zJ8_^U-frGI#6j#s_4>iraWM%bX9LBeEHM@IS^LIx1HAwKzfU2b7|kk8(o6bNL$Zc_ z_YW;8OtbDtMm$)$ys#^?2{2WC^D{ur1@;f0c6LvJf@xdOQ7q z4BV|B|EqpP`foFi&z?LEOUAPINte)b=xRG;8%_gJ^@>zB-}%?IbjG49-^|GWk?-d}A}8ezT6Fc)k|0rj_XF_Zh{VFYYxMQDj?*#M7WVkmw}# zZs;{G_$a0S?g(*c9xGBff!^J0N*#k-@HW|s-r3g4)wOv};~!`r`qhVC*FSY+eR8gb zTTKO!CsNpKkt;U#f559|rLv#{MoK6sRqeJ9RT#g3 zeRJ!jkBemO`Ygv?BKa@8eHA-lh-wJS3$d)d_tn-r@hF07vTz@_X!4JiE9s;XR2{VE z^1?4gl~O>PU#UiMww=wUCV|@P7tKSnSgLvsj`XIblv2X8;}Bo)5m!pl!iV`dl6PVG zBGBC1KI0yPWT&GyUPEo@PwP0x%emTBfVrUPpBc56Td#bq4dj3qmuQ){oZTBNgCCL2 zy$xjd0``#4d74Z$L(fd#1vgjemDN5n*`J@uHZd|u2eWt0ppxBfNYE%?O; z^oJ|mc{KF)Wes|mFTTc}9=`R|nMWnl;Y_?3UaW0f$5G>{wXxCB>!&HKHttWVee6(W zjqk3v!Zk=bDa@4m1Izgzn}L^OU&Uq^yc!dMG#&cKdPkk?+lhfh#&iMe?R8rw*B9r% z#5A5-M|lcp!?ftfBXHJ-ZDzKkK{(I0HPruNiJEx_=A{Fq4yP#jQOJ7x^NVP&wG;n8 zhEYoLC0O#m<~eMe$lnUFhE{rVF_qD%le(zs?s$R({{-RbeFW;KUcPq6C^3F{rHmJB zv;Pe$0e)v69i@!3?u?hQzjm-?n1f-ua`!#u_v+AiegYqVF#ns; z7Ev62zphV4&Htgur}t5iJ=u~*v9s`#th||1DCIjcgf^Ek@un@HifA2BNgMh*fP0a9 z0p>K)Ccn72mp%^^6S7j}er9vSFcM4D1>ARkJec6C1WVjwWorwF+g$ZDL=(>^g!?ps zI_E}*j#u(iqf$9sSrcet|8}(JV`+L9?G=?$jP;^csW}ojv_1T%*RyG^sDqczzwssR z-g0dGC-Jo^F-Y=sV3Rik82W9p^AsYhb=$1ErFGt{S|G<}6!RyDV=8`IHZj|FTeP6J zNOs4xdHm7eqNhGeQ@thWs+}B)T=ZOB`;X;Xl`Pcgwu<;D2yPtF$K=045w!HYeMIR6KQQ%e8O*Q%+4Si70$d&_RRJvNGVBCe zdeu1}X%w@mKAi1$obIJIqy4%D+bF3mr(Q7ZON48sdPYf(C6DB}At@dF;?ojfC~{NP zrNyw*x7X9)DzV=ipWV9kY1X=F_aC}@$r9?cM*q#`(4897;j#x@z3kAMid2$?2y`l= z;_0(PKu;)lcf&%vV^_Sp$bK;8InIV&uBoCYeu`AegNAhOh?Zx8WF%h2e(UQ3gcDJ% z^24{Y$6WUrjlqMzBj>LOZQdfc<)qT`m4I(5V!oP4Sn7>u;LAd~Do8|A#8bt{+mnJA!0N2>*VivA_0zy7Sz`x&QDTR;4`-_ z=k7Qxt>d(?+r^JxeyGZ-cSa>`9I>n>er!5nUuS$tQlK>6XC`0!mq!qg%&?(5u3wq8 z6-)~A@>B#D=LmjT|0%imK$|#1rIwm`k8|VHbBeNH$W#6|?rP1G`&=VyRWT%M!%=QfRZ=KK4`ftod2*>7@(iYPaMgo&0ErfRF@If{_ z&w1*W-YETIK4?H-7}^Q8mKy2UpvZrux z|2qffDOS4L|JeSk{t{ETdu?vQxd)NHIb`V?W@!gdv)`Hv0LT_vo`1I77&qao5KgBC zN_A8v)w&&sk~Rm6KoRV4bsn72^}pI66(^nbWy^U09$cVUvev@-ku*-YO6L?Mc{3LF z4kPEWgE!Lula>39j?;qZ;6sz5lIjyb{m&$b@(HEV8vFzA!1H`I*x<`Lo-sMaY|L(i zF>-!{>?IL&dZaSwpQj#@bFaP{OMzSM6o~vVvMdVcCAa=Z0PxRT!QLM7WuuD|LG6(viDnyBV!Wd`IxAfPiU+=_=hW z=eSsbajx|b>Tjctgqc3{A7He&#SL73m|Xoc7hxonNlmvVaN5-#(z29qGs~`X-HSLp zy9)M?6PD~OY+8Gh6bgM1*fUKcgY=eJD`k<+C;vt{GUyxIs?$kR4_?N+exDl&dFQ?4 zhhgJxJwb`jZHrHD@fda63NRLzzLHR3O^Zn(SsaOi(5g1jhmABGlQlxeTj|hJJk=o!$e!!kWR3M0N6OEp)>7uT(MKLRsvQ4P=i1*Z4HM&)jz&9CqQs<+Gnvp#V zrx$r})})7i0eKHN3=bAUJ2opLVg{y8+tUdhmb~Zewoq-*IeJPh6jkWnM3ClES@(*f z8|SE}RJtPm7u3@Oz?;gq+}ZsOIiYo3N$K9-bVGsNcYgl1wy4&$&T29=Kcci!*)!{d zg~@?hDsZsqmE<5GuDsD|O>73c1YX0-KHJL`!__IDY;%PHNM;j>sSy>%vb@`_wq$Ev zVmNm1u;MW6LM=nl7&G+w*vf<8yO#bA5?oizBINp3$T^&> zb*BA8U4RXeGz5 z6B)_Nh{R=pa7$Y6Wl8hqkhf^A{sFP$>5io1(SxhbGWo&po^i$R5ie?*{9XI5#Z2vw z)Fub*w*@{Udah|A&wPQJcQfyKv#%I!&(BF1Z*F4-81(&9qSJMIhpGvjtY&PcNrik9 zJ}P%X6>Mi4`SFGnO1l%)pkM7|&k-7&xtGfMw0UoVdsX}=hdk>U{)m$Jku;(Sowj3+ z#&nGWl94n}?a33U$FP<;K?{{(aR!I=|0(lXKTB~^n07%06N$FaoV?|A-JB&A^d6no*4Erl(G{~UL1 z=>Td{@N9A46YWhqCNK!JI9eF~B7jM}G?jTgBFOVF@qFX$37y;MOCuV-dnAlMI?l}m zxXy(hG7L2Q&7;_~Z(6a$+V@aY0p2IE0Dh+q=-GNQ zyY-dk56R43QcDZS;d9N6@>T!f(QWyi-D{=j=O3IPwlP^lp_%}}B0u7ZW<5{cn+!8x zY*=aTyXvuVe|PhxFm!+bbuLL;rsI=G58E>F-RqO#x!-d=>oet{Uk?{E72I~1+}hdG zeiWdlHsA4JbY)eCDHT1Tj2Y}s*WeGz0qb>mP&{xBe39B*J9B)sgTdZ>1tmOv(fJVs zR0HchD0j2H(Z7q{I#$ulUMBn;mK_IJyu#NU4oIL-yqjq7^<0m>zjc1{e7|kzTlTE6 zn*_V=dDKn5l*+U;|HjLQPS~$GZF2u1mq)RBcch5$c3ZwNd$?pE=&kEB>=XA63^`-# zIP3JlKot#i0UBh(cn;}uabeH);|{<0$-lSEnGrHaakepFcad&TBaFTGlGcG6x$1%= z)9W>_$>T2<)E78Wg*H z(HAq*)TY+;%B^E1O#<+0*G7{}9EY3t*+%Mg(2ny==JxXWG^NCm8BFX7`38RNo%Tf@ z79wvpu;075kk7S%|K8XkK)CmL`jwiZ+ILWA&!0y@>-oJNLkvD5sm5xdvFw2{2Wr+_ zbq{8x59JGGXnxgP8CMoPBu3TeeN-G!S9&?ix*#cKn&W$4qkTY2v%81=aJDYB{M!Hr zD}B@Kh&aMQr(d!+DD!J6*{3WyYb8{A=)q3>!AxS&(-jP-O!q-wXKK?ni-DE+q3cELeot>j50v}W9JU_|lmy>VDYw79LFJW{39Ozb>4$0) zMtyk#;BHO^^%hv~o!XqTks=eLw2=WLxV|N$AeV89;8qUY8H6${d8L#eH#jNG4%+zo z8v>;i=rya!4{WG_u(ae1VUS!be?pNkiN z_L*7Okw-FIH|8e6XiFcFUZ!;>K50JCWP_rhM2BW|GhukPCAg!4&ol``FYxbPEP$QH zNw6dcL=RM)Y{n83>kcMX=a%A<3k-dYN!2DzhR{$g{F$YUDZ$Yv_1Ya}3&}>Dv^dK! zJrsCtZ@M=3rRK)_)1FgibnMg3hn@4`suI5^$*6Nd#qZ}sTUw+Sv?F+QY~#pzHDtlx>1 z=%+~8PrLoxM6o{@BjBUk_z+H2@ zA9OFAVL34>%9TB=mpLQ+kY*s0>J>h1+EolVduGCVJYTS8`?uHV z`#&kV(nv2qaCVXn_I$T6-x-Jjb_KJyD})Rg{7&Gu$-)Y+1qN_>`PK5~?=EdN59dbW z1NoafMWC@a9QIP}bLVr}-z3wk(`F$KCQ~N|$o303S|gE1J*_^$G^|S}J35Y`H_R5* zD;D$z5>AF6Y&#y&m)fZ=54<&zoKo6gX(@7Powz=qdGs?rzE5{$2x+nb6rf!nmH3+M zhsTfZdB>VCuq%Ao+cHTkliK?o;TylZmdDhaA`UjXy*N7gnE3dR!mmR={0l5M4wD5p znl<8Vehbb_z6ewyN{aR{O5N&Zh;-%h)TJI8`!w`U=BsgAf6> zI(d%CmXS=y$Ss%*zgC!$1dk=Gep|P{n0&MYiQ5fn3&03+1+_>F&9)K{PxC6&F5z9z zI{E#P$X7Uam~>+1ej1VK?wyD&c$?i01r<;2i9{lX-i)=VF~~KYP;-uuOp%K#tbAWE z%_jUTa7ZfrO?C|+qf{qtd;gIo<&^HRs~*?GUJEJOULwSkGqLDyA|Hgb&!4Wtdtw^P z$0Rhg#NrLLTiKHe&Z(iEVb9^PA@7gX;Fl&Ijo95MA9SnJ20NWP;mamuO>)A~a#;J) z9A_VzS5?4`pubUgMYK&7a#N2ZSP4Q$%=Td-WMq&5?VXlm&Ni4BT_XgGKGz%tn zY&4B|K5%tBTylK1-l;66E0tYf?n;#rK3wTgDDQ9As{ZN4m2C+H@FQOs;69!%HKzNuf(C$t-O2^8^RdCP9C9vIk;3Hwk@ z4b3j#IJMb*@uT8)a(>~uIL$dS=sG7|F}MBxP5uS2%iz!4k~;qsX9-43;8Cq(HhsQT zA}`&LU9VBdPsyMKbaJ!j20;|S&|uo5xA&rU){!d7QW6A;H*vF?F33SHki=?gm~Yf) zQs~bc&XFEFmi9Xr?|^6P<$WF1ab9KiK#qc3D)h<6FFfY+p>Q~siyvNsrDKk0mAhbq zy)f|9Q`MStJ@ow3c8&PSu}jYGY;UO8GJGTR5mmTC5cX5|oGGa+&zJsJ@T~#sz1FQ( zJYHy~M#Pe>gpT#Y4Bs*BExYIC`Jzd?dkv@}j2vI}Z4Ho?EoBpcqD>BaFXx`Nk{{eS(j%rH_f`s7 zO&IT3+)j zS>?*vB?(F25Ozb0Zp_bM*ZnsLS&u~o@E?;^AR_~d2i^l{Ha%-(uG+poeOeRvT>!?- z=2jCX|3zz$o;vBG(c@3u;IIO@SsV|7;Du(B26Y#?supFc4`C@V%%t8DJRf;$=5U&- zPoqW8F&KYMx?#1Lqn0I+7h1O`@$lMh7Hi5oY=0*)C)1)~F82=I+>`Xn`y7FcDc*qp zc_#6D79D;qJHzaSXh8PG`^UQ_NFY!|Q}^L=d}-r+LbJ~MlIYm#O_b_4sjRxNIyISK zTE5B;%nYHSn`W7-r)zm;x{u+yQum>nyg=1TAj)!yjjJ# z#O70G<_3R~Gv8ngK67v6@Uu?dM6ci}>%nefefpeW^ln)E4bd50E&Z0yuCtWaPf zO=@^7>B7+L^@9v#>~Z-P68@%1{@-E(&5#5+e^}Eu+AR+JTnu7gDh?@? zfz+lX6Is52hQWrGc>uqpz-VaKJ_-k|L&&tfv{@hy{sEo7|B<#s-vS!j;8c$YYB>P#2d5IW#G2TlM>N z6D|k!h}vN&JN8Yf4xXmg1nZp+!+>trn5TZ0=5Ws>T(v&C?hIaEjpmpmVR~LP7q;zG z@G9guY;TEB&Hz82O81Cc(kU9|-HSYnEK+ztJ$r~w*N0+Jn$E93?wL`{4l}36zJXxG zrbRCy}A_Gi~k|+x0j&XAHGfI>tqBMD!)vm`!k@{}2IxqcW?f7IY&~eB`Ox%85Qv!UP=b_rOH4a>KMUZcUB8}wb zgMt%xV~cPR=Ubce!S8W(|6Gz+J9!=0DCSGD8rwPQ{(>7JRuyJW=(oKxwrBr_?Vn}> zn+Bg>Ykr8|m^qSPurI2ut=4k&D@wB)22mw5XzyZG?81JGkehfTwIxQ0+iufJlYU(` zi_iuGy$VQc*qd)+uF(DU#><5_Y9i8Vs*qZ9A1oo6(fC7~&1(qx^@KbSfQZG~b<9Y5c&ek)GYgBZ|Y7wBfFB;!zg1h%KGV zh%!9_8hzyJ^WFwc99{9`6D1RK$e-r?y8-Bp|5Aket2FK++MUf0>qe{3x^`lI5~`~&sVvrs zy#n0GMvS}6CV%rh(9=)Dj{z=@u#Fwzv7%G$3rD+&k`YIwEB;6nD+3(1_{v)fxl6Ti zb2x=>DCV+f_`F48!*c0=W(uov8i;Wc{xOiBAN`1?&Hi~h`uN}$_qk)CFUOpM z)qXp!FPd1k`aZP42G`utc)stXrk23DuSC2)AhL;=$LU(F zn&Lht6jkBEr%IR;;ujYdG=}sITu32AO?AWibQ1H4)H+?K&FKwBa?Rqzk++az+3JpM z&*ohAb?4zH!!MzA_sMLg0}CmO%f`|;MvYAOp-1ulDT`DgiRo_2F^k_JW)%b%#VUZh zx`xzD!}poX^$oD`r;5YTnt6I}>{0uS`A0?ye{7}R&X^*D2<(fA@)T~w8Suug5h#&a zbC)*R>%0BLFXQ68NU0@obU+@ZL^DYHbi{J__dN;Zq7?If=JZh@hRLxLyfP_p1=j0n zGU_%}aw{cNhClQMrQAQ=A3{6Q34r5@xNs<1T4jcC7OhaDI@xeXL-TVDBJb6HnZRi# z_H)vu6TA2ui^-3BOVmteXXSDyV~(SZEa6M%oojhS-U7U}G@J&d&RAtfm=PAVD5WA| zGZ(cdUjs@`29HEllr`Wb=!Krp11oKfl^sXUjX2|tBeB+*Kjn>nras!$R0PcCc~?z9 zDqO>$2u62iP<K92yo1R`Qh|= zBdDeyx5{TtIa5U*fg?S$Z<0gay#*gp6$a_Uhn_ztyhOOTUZ35#HgJ^BWXiz5(w9cb zJQyq?E?mW2YX#W}-DHlKj`A2%&FL9_;JzJEC-!%8j$C-`Orp#kKVujeQfO(vJJ$E|kxqe(__^&}Cz*U(E08Y#YrgM4Z!&v}v_ zoXR~A(?&$GS3~g9d%uk6ic|j3!=n#Z`^x3_Kt+4NQJCV~XyLSo&~WghEKZ3h{*|1x z!pzrc4*kbA=tu89GIg3TA639h@_Cdy``bZVa;jMXg_Q(N(rq1j^3Ns>Vqd&g8xWl&+3BW!gc|hr&MlZ#NA5Nt5XPyulr$ooW zW@^gn(wYH6)20WhtqaoWmb#zi3RhqFE@zQi0fzuewObSHd^SihSr*^&4I z_WZiy7Mg2zp8Uf~b07X$_&w5U!mNH_7DUO~I= zb3bX}anK{93VmK@PQCD6BRh^g2bJ^8-uJ#2k~`h#M{FB}@W?m>V294lZQ{*2d3Mz5 ze26}NHCajk)Aw0^4zx*j&O2HwbTuLzukQ*2nXU@QQLbB{T-I-nq8dCxMq_?_x2rwg zcs7=9^o`^^|l+Avd>;IkHs2bU#Z{;GFmXXC_V{Y(tR4x=->3C zktqwXc#LyJ^0RyE-d5$$HX6{-PRQm;bAr!{gzQE=+Pe9MVKRnEq21f=f$L|!rF8ue zwM$Dh>e=~~(|T}COzG_Gr*>)X0mUWFX{v(S`tz6d&ybPQ#-Z8fB`B&WzMW-hYnWfJ zF9Q!KO09cWbJ!qk=51ym<@sZAldpMwLnWOl&fVg)-T7D9Pg==g#SdV6K5$SQPR2-R z%kd|b4>BMn(eqk4cv263449=r8)dpyzmMMEONiBb9v^EQd1cx#SW!M~E(ABEjFhKE@orr7CsEds_rEHG;Q-L~s%O zHD9}H1-UC$gMDr7xF4L4V-t$$8w`eGf8Bc6Du}BE9|BZlGSuDnX?!3*_UBE zYjmB-6F1RTUgD^Vh2A*)%d7XuCB#K|z$^+mS z`H~yhyViw4xY&lQhIjQLQIasi z*F}*(lh`*Y7DfX4B@?0Bp2TWAc)Fs)i7? z*|PR`jbqp5!B9$$eH4vhy9Vz)HnHmO=I8phg=F2<#;AzvtWye_xe^Hd163&sA4a6h`RMR5&lb7K_Ka(d zJK0F*ahVoAn#wTP>kj@~hS!@IBy|_wYI|V^!wM%?1eR45DpJg!Rx>^rx6NnDN5&54 zzS{?dwp`_!ctz`&Xmvn33BpL&h%*TqA{6aynI(UPog42HPoW&b1U_rDVgu4GV7JEBaTdBwN4E!bvG_` zbRn65cC7_EC|w+TD=#-C?hIoAa`PQ0KZ#@ocbb!dW8(--5KKw@LnoMjxZKHM*rz3p= zCYfu^$(R6i;E`)BZxC?rz_l`ok#GM?@nN50j*Mt1xEl~kiPNU7o#g?JN^=i(v|CN! zm(o4^c^{GLwDMOMZz+lSPqu}rg!=7w%g`Lm#OriqKODSXa_IlenE6Rvs!p%w2S?Cx z_2(LG)|4gdv1)iDaN5XB{Bk`yU;h_VzRUeEldiA|4)*J`dYjGe`D_bz=J|vVoa$GM z20h0=uLOYAgchF1#no7Rql zF88JJNXFcQ{z6{4kT2}~sIYSP=O*JC;vq0LMmhi=rRf1)9T%N4`b&+l7=8tw!ATfhti%!CK>$m(eGhbPy5clFXcXX z2o@H@wt0gHCT0TU8Snf@I{ocTt=733!AntVKS#j5t1b=G&aO3T=7U21duro4TSEEc z8$@6x_c4>w?%tV8cIr{`fvb3yX$0$|C(LTXq#T2X>e8M;|k&Gz6#HzU>VVUxp#Bbm&1-xTjSHtDsP808&V zpXoG~`{bJy@C&}9X;H&%uesJu+Z4(3%HhvAGd>GYhsY>@fAcuXt1CGFIGCS?Jmq=JxgI^eP~?hL zC>@GD*dTeP4ncU&;|P0ry$x9k z*98d2IJ@+#1g9a~Y)xwKMKQVO8$VRA9r%U z^M}u;FYBA_0J8u} zg5Dq%{ZwezZ!8WioXP=yul=K(hm%_fVO{mNU58AosV!{3HVwCaBA}}4lRhp9I6l+M z!wn;$u&wu8xOwAvItWCwB(=n+bf!P1zI=P4y`4_VvwyJ}vlE8(nagQ>T zA)kdQmZw+d_R`m9Db3O^ch_he&C6qiwVtckt8uMm*m;8q#B1?4Np3&bS`gph@9Lh3 z&jzLgNGgh1w1IQ>&4Ax>&-XOvcHZJ{K52zyVo;38_rF0U`IcW$ z(eDL&6K*M>b0m=S#8%WS)^?(M8|I))S6&0BNNV;h(=4124>B;lr^LnqtWu13h|<#| zD>IXpO60p{#|Kxm$jeuZBwEi{xfz0TS+XU}SXn?uLAH1Aj5(sl~|a z{#DtSQRR&G((5xFXVm;>Q>x!7JYRQ`cixOS5awm?DTK7brVNF#>Gb3lYv@r=Lhusy zLo7d`msf82VgV_qD9BX57upy5v*4qseiY9?O)_0iX`ol$Od@rSyasou{Mvr%(sGR3 z@Ra~L)NK%rhpjQk<=7XQped&IfS&IVSG*<1Pv)SDE5l`eN6whhZzqqxmTaDKhjVR| zfWpt_@|(P$^l%0~TtmUGm^kZ|>e4%!RK!Wlre|dbtiVU&M$wqnfonFG!#s|FRheUc zs8M0uJz^|z4AI&6>v=@l_vwPrb2tJ^8h!o5+C~-8cg1)WINK*-bEG4|Rf1A$Q3>9c z6m*+j;S=tsu8RcrtCKRAHaDd_{OQ#Tkm`$x6Kylbcb$@?O3{9?OsxIc?StxRb-|~) z4bs=By}(Sr-+_Xxu16&U*+M?ns0}TZQad=DqV2cRwo?l_2`C~d%LyEz6-ZGk*IdaR zNt8{TBkt9j(>YM@gyYL_qp1>%3eL^dfbZrnI7Y)(BIV&;Vd@4q;+T=0+{g58D4hR=a$X00dMOX z*|}0%bI_lufElLY);|~2_xgUy`g%l7)$5Rpc`$atN{uQ(z)Ypi98?*4L$7g1R(Z$o z^7NppT8DDGi-9-~52~rOw(^-Wf5NK(Zjdn`S+O`m+Jn@G9f-R^&*`#_0xQciu7(Yd zPkfE;&m!*7ZU@F(mU8x2aee?G*s4su)Pf~-Y^>b&ibMh*(1+8?C5HXDWa!FM`AF)9 zO8*qA1>x))`H`79Qez6Lq_eNH7=ig)yL2<8Txqpu>g=mhrYk7gE>bsUWGkeVrpT&1 z$E4nDgvV2jk89i%JZN0pICouD&ZJ>qq@HQ0Lceq^%dMea+ES%8`3Jauls)jD(C>d* zxv6D_Hao@GYxURYJEzMXofjOq-JUVeWTBMa(FlJi9lNZz*I21J@JNLmp1F5iu;!_| z7^*u=u7q{wA3Ve^!#Z3)mdQ5wgB;=Byu2eoqI8fm6mPH#!#`BrTIKprovpL|e@TLi zNj5ImbySWX)WCmg*d64WX1ZwprTvIT*nD`|Ao#bgKcejKcESH?x&9?C{kIG`f{`Zf z9miWTRO6AsifvfbQPi{1u`$L_D+%5ytt1C{Mgn#8>ReldPh}lvefCm8bpICOGpX+E zbz+Y;0MrN>&c^+D9`X%Imc=s!G!Q2iK9fmO!lmBQ3Wk2d@O@TzCs>Y*OaobP&Mz7u-~N@W!S3)_RU z+zKxNJ>bxwj606e`D&u9fMKcSjnp#EPp?;844T6F4}c`+jfR}}`jx9#Fx?AT;-^^I zUC8ulF9ZY^crgsKtx*UN;x1;=~j-ZlS zXpIAgRfY0}_%dRO>9Liwe3W{3$=r6=eMq8GjwK5G$5|0JxoOda%B;o%fkabgrQ5LR z#!j%oL}eqX;6!-{Ei zad#ax4V|5(`%5c2fC#%Om^V4FN>lS4C1fB*QxRl}QqsS5sQkS!UUvt-AM9h&g`?qo=q!Q$7J+_=pXgrGHB7BIIvPxVOS# z5;08Z9-A(T{0v|E>U)XO7e6Mpn;hF2#?7J5Xx=Tq@P1?U+^XcT~{vmHo`sS01%>c6lAi&ERJV5zsrr!Rf@(Ahl{PS38W@oX&?Xap) zMiWBGtyTVZ-q&a=b(%RgXimrr+*$4FiB4bluhA&LdSU@4$g1aKmserUNjxuC#P!|E zY;EesBfdc27g?y=Z=9Hx)+j80@z!vb8Id}FNUuv3x~w5aPH3!1(-eGOYvTmuv+uNH zxZY6_$0rztO!{$9Q9KhQkSiMBO@h3hM&>lODhsqm`jEwl9ydG7=1UAM#(R1HZrSnC7#R(g4wQVicK1Y=!yuIlxZA`sU zhNb5^s`!XGDHA(s*fCqRmV>dpE42AEp~^U+bLu68y}-0yVvvH?Sh0ojDP-aDgP7k zH~NGMqmdnuE508e+Uk=^6HaMK$CrfR_JcX+v1B37t6Y_%>mHYQ^cA2xcEUJ)lajB6Q)r()jv&9nbgfCo%vM8u1^Sw* zH8i(UrS=CEJ${`Bgl@PHW*(z0?!Glly?r@>gaD}Xvn6iq8bBky=74hY|AFn#uYCNX z5YARJYoP7_j_?OdT1R|GU@(sDc8wW?NMFRBP~a+{1%bY*_PiovzA@=>+v0+PRO%;! zelo`CWt)3Ooi?lZ)oNDj$@?Cs#Py(48gs$cba+(mcyrHnYhuWwCnn|ij!kx*5u_lm zl?OPq9$dxfMxR$a?w0Ut-Nu^Rx40k-U`Dq0C$4W_iK?yR*KV^CB+`Vd2p9Mb*TmUA zNBPJ^D&#|a6DmigrQ2wNi9>_-IC!h{H`HEE&F8`dJBuqwbkK`bodTJc_@t%?KdY`t z_+5(sj(P9r@E)9P%TCi-Jg|Z|0akASCKwpLC0H^~m9X=2<|zs`guiijSZUjD4qE?z zjGbjv9nI3Hkr0A=aCdii2=49>T!Xs}1b26L3lQ8PxJz)ijk~*C-t&Fu+_TpGbN}qs zd#~x9?&{vt)m2Z`OyjIPJ*O_VU)x6wmQ((%+VfV|kLvnZV&%cmYZh5QFJxNiJqjs) zeDA;7{iWMdJJ5wetN#1+kJi{-27b{+hEuAPyl&6*YZ@mt7;BkzN{z>})-O)#pT~Lg z9$Tif1&O}CE5X3lj^ng==Q}Y%N*Cv6If7vsU!qGP#EA@y>FRMy|J@&J&R3eohl~f}ym^{z~j6e+_Ck#T)*+y??IY7sKi4 z;=!8+4RjhkmGfJ?yb_z!Zj5V6ic7t=ZRokj6AC=x64LVu`NPF#;jQ10Vj}22JbT5p z*%8Ba%98CTb8mjyN=d*s&0OqA0;vnWyg2KA{GWn0PKY<=Vk`G*UT0F$9`+<`xRN(w z5tJM~aas3mH}mH)3$C$7yIul)(wg3+3Ro$V07gvj?l*7#w>L4HcW<6!M6Fmm*Y91B z%%|GOGgbXjx3Xov4)ChCsim^AvuAnAX_93f;c_O|OjmH#SJvt>rnPxa&wE{^ZX@Ax zUe-6A4-IMq9Il#^6$9AVe-Fx?%2y@582Op6%$q8_k+K0NSG8(nW`(c|^X+EuRJ~y@ z;P<0jUQrBWN!yEqR8hYNcbZR%%>zeNuJM!|vTSh>Cx_|veTcT=b#QF}bxzjSE~O6W zy@G9L@BM2wD9=kr*W718^Gp-G;A^7!-XLP+=3A#fd$xXhYJUwKX7%dI2@mKE0UH4e zfkL)5xXVjj5K^2G%`+=KBRQwpj0VRIz@DgX6JNi*igkLSO3{|xj4<~COY?p`^SrW+ zDN;C*LpaeeZo)I$pQhsxPXr+b+;{e*N8ISYlq~VD5z4>CHpXYo zq4Vfvce4OlV^M8`d{2E3gxWy>vE2PEgD=fLZ_awcbi+-`!Z>@cTA{ypH>&+=;NFJI zld{sb;uT?kQ+5Pp+A->z815g0Tp}tCf2q@zO@zeL*GSCH<-Rv3z2>^4OPmcg;pTp7 z)xZy`X2(kh?TfDd`)9jfD`ST}1fSUYJd$`5#tr1nP0OJInqU*|f-y^hj?b?0Hfe*V z8z}9M(~>w2k=zOIF;G(Gp&ca%oX015TP@A*_HctNJ=pJCw5w+JwQpI254QWnXQ5~Q zR~m=$mxFGi68dJYzFFLYR+OqVdh~G+$e3&4V<*;=WM=~IKNl#YDwx0Rc<$_A{%ut2 zb(7Psv1GhQIM+M>U6N)82*~^8EVwX6;o)uSfX-`rJ=MwcC(L*M*2%2!m~Q9msQp00 zTq_^ANVh)ZR#DU)@yljrzq|kVT)?=uQz{|Sg^Q^~jwz$odqyhKDTQ+u{L zY4QrMVLQN2w9eZyP-yI264oV!RzY=2W2Hv~R@+(6*(e#HQ0IVyk?ZH^3>X9!c5fN-tI}|5F@LAS7oA~I}`{C|BQ?b$XrZ5D1S>OxQCf#yxO7-M^ z?n>ASfqc((3@Z!3^QDC?ppV^}>LO}qb=tJB)#rfqPU;MQ5tZH#gf8>W8PI@j`Y`DB zhgT!Ot-w>6I!Gezy`Rokw#n$mwmY;WXFpn!J|*ER%WFj?I<4uKqj5CGRS8N#axqNT z8ZS#6?g2iIY=q5z^QY~lcv+kYnle8wIQTgH2Kb1=Znz` zSe>`msgZyg-dVqr3nGIq!HBF!q81{~*CT*M&(jJGK@c48B6%sfipGHS-ew^*i7FVa%5tYgFEm4myC0KT6 ztBt(r4VMP<_aBS4Yrb|nt7j{t@ID9=VBt#iBG3Wx%q93ly(OHC&NPGqXsZo`akT0Q zt~?o4d2+E4NO8>`w4F7*mkY}d^OD7j!+g#-bsX8u%)2G->#xwrb>8&Y)LLA13QE(@ zzWQC#Bv3-Qvx#5T0BWV+PehnBQ|MXd3fTb{wmwwvsnE=&2E4@t^5nF6*l#Efk-m;h zcO3xhlD5?#Ib`$DFqcU5sVfDa@9j5OzdWf?+S679D%?ju(Xhmn0frLJ8i%Y=K|ulf z15Cp11&J8@k?K^!gfZu~W8r09di3VoQtSKnNuHtX?JuqOp)~KjOz96p-|p}QMx}D_ ze=Qpu-wZK-d!YGkdT!)34KC6O->>kae+wKSBbQrgDl3;~f!f4y#%sEs?+8QYjbJ`tsZ4w_R75{C%HdHYRL| zj5m5&8K*A;p?6+b}yrXg1t$cac&EXNh*Ro#&ywVO%g0lhcpab`t( zta`t`KYA?7#e29Fc&wfMs2%*Odgon+Z+^Q@yilRDUy743ET73#U+yNe+gaJcqSQ2@ zB>T3Yp%$a2K<0CK)|d0c$!A+w96l1LmTtc}TaHG71Xc6i1y`vcSA`V{<;~{*O{7#* zEx!V!p-S1c(c>Zd=UP9TXs5n-@Bpt=QA*Y1b>DReSTVDVX03XO{qB5r2hK@g2uCo$`aR*?6EKD$A0y=nP$$^)9BlguI^$(Jh|YB z=$s2x2M-4+aL)Hucl4#wGs%@RB zzA6lg#CW;(r?zo$Hrf1>jgGJPC%>=`3_WLMGCGkovGtFGH!0!7>d&fCMbuz7a?RsE z@fm|<{Ku(nFIaL<_dtPph|q-1bK;?sD`>-st2cyvYN$2o(7-)f1FO2PLcvRntBvZ;qX^Kl|OMB;k0s|4gLlai=s&(3h17kbZk)=K~h=@t)U@-(sM*GTp z0_t{aV%c)wnv0zd_=6&zOjRk2h}J%s=0$j`@sSO`*yB*T&atCEZ8hyt$r`>@AUU0r zR@aO#Mwp-B3MT}o>qu@%9NWGgEUpI5t^aZB!83!6@cHXmLEHJPdeE+#3Jb@)ag$+> zFl1U(2+Ri14^_~h*v>w0X4w&Ie1-I(SyP-$+%KNk?%e7~yBsif2_E}L^EM!X`aXag zW7xo5)fOWD{UorQ+_&PG^=>YQzRhPt=_%4DsZY#qfr^p6>rQ@@b+2mgRtgk5Nw>SR zBy(GJpn`3_%hEfir=T-exmcg_k5-iK?Ai|$cd*~-{nOfRDDCZsQ*lnQ;LPo{V?dWW zsp9qJpMKu%Eo;c-6)Y-_RB(b?qc^2 zv~j4_&Su&D^x+J9q^YqEi_>3f#A4AHj*FLOj!*8wyY^W>JN+NbwcTw&yWs=?9tI2j z+!3vUr|P^CkTKVIS<3`+#~v;22j3O7j6b4=lV10vtKGBD8haWw+uva})Rb-D5%G0R zot)OiMIqJ*_KHTFt|2PPZ=0-v(B`m{MoI|UsW_iDh@lHuPYGT5%woH$c!OSdR>?2f z>Bek326of@r6$YRbXseoEnx{TZ)D!7k-)+MPbHO{^vI!edkjhtITbx_Ucq*AgNO>h zC94LYb^0PAaj>J<=^`jG&Epg7$S+m}8k4_WFSrqaI3Qz@rPlkf@uXXY77TGB!J|UE zK>BAm^H{b>dp#;}TrLdIb(!MZ@@PH+KJi=NsEY+u%U(a}G6HB-jJN=0*3f!_w0ch2JAZS(&$x{(rQWLyp$e1aIkNnpOE zMa&v8)HHFz2`^O6ziDFD@gY$&);L{ij4g2P)_4_^u7sTMjc)kHm{jvV?4SB? za>Xbo$F9v;xwge6hFiJqow&!ABWS7Q)9_EevF=}-3IvA`#B;Uypb+|2?hD356X$kH zMXrUUJrB@1u0(-`qdiwKg~0+w**sT|GOyJFv zzM7vi*`e3-a;+SnJ=@Fnh|aqs3O$YfmO^F#;kf_9>?)hlauB@yR>rOHVVJBC&uB=% zU%AKcuo5x;FkQL?BhTGyemrcf!|R@ocr={oe*pUQhAJzQ{c6uH8g?M7=lae;pj_97 zdDi!rYg(F}fWG;aj_^anu=@~qXM!md!?d@aYPN<9EJk$1vs8-C)Eg!0soYOFwjZBz z3tiCAL}~V*Em5^S#4E}Ez?m`d^zY4zIBR2gqCuI?wr0=a^Ac z5)LfYzO(4u8B{IXo(Lg)U_tXb5-u9FA9jgoFU%6;2a6J`UT0fHu^zK&D&V1V&pFA| zBnq*>P4N+r?QT?ejGB!7RFr_953}f`kZVS)K=?1-Bwv7nJsCZ%1owf6CBc^1BikYi zK}<5mmZ3X1RXWN{0d`gDRkkxh114-16wtIbTy~vS%7aMMc~qsN!o%iPOV1dC8iA?J zNGhkz#sEm4isg1AHO1p%^3AVl~Y*2|9Wt zFs3!MJ)eZ6&84t>-+8prdFq6OwIGl~K>9`Y?UR~I_D!y$=igdmvLr~c0G)=yCE!pd zQPY3KBz!b#ej$TGZWOvYwWsHh>(94lBq40^EWz6TDBM^YhD5#Sx=dabk=ZQ%vQ;RY z4iu`-WFojhx!^;?JAtBN8TzLcd(hL+O@$2`;?s=K4ht%1&3xA~1C-w43xn^2g5u)a z?U^!C5ff^|1QxQ-SZL5rEWcCOdw@OXE!RXtaPQwnZY{r8=rr?|@xJwEN;8uGmanX?TIa)WOGF=LsI|fduKd!Y%F@-CpJLcXkrSq zP{T7G&qTPNl&BZUAz^e?<*F8&F&6ngzH2n~Mc;cHG5rxNWo>uZLP|-k`j>Jp z!ez;&8Y7j7t~!*jf7YSk72-0D;rBXk3OPAaj~nFAoK;CZ!G?n@&OAt>BDE?JNhC(Xz&)P*_%4A}KSElml5g{pBmW-j z%bjKTI<(0OgTSLZ^Bd%PQA$d90tZsjRt;@vG3c<&i(0#Tde9OXDv)Y4x>Io8Wr$_Pt~`fArwph3B(3XfTqrHK8$4Sk!8%lQk_X+29*;C=XcW8LDq zhd$qJ!BtJP`%|9bP;;%ygRc|L^1+Y`;kNO6z^s%^W! z4gy9(jl3^W^!`BdBr!0pc$9H+o06>epn#^(;g%|(*W286J~{b?nMZQ)=Sh1x*~G_2 z|CP7BlOv{gU)q|?W@3Nw!`?-Ub0c0w2Xatb%~Q6%oNmg!Z*~v93;RYn?1z{`1pEq7 zsGEort--i}I4RO?O@$Fq)2M3Bl-C8T{n{WNMwhe^aM`>@6aa{n5%mpXYFH6y34y{L zZHtgP!9Cf^uXr`(L*NwsSAs@We4!0?cY`#9zlzBVA#lMCwI{}KONK#U$4H3B*SiN< z#IiV2JBxnrrzg@<&SOm-8XbmCSM56%SAN_gEEGPBcW7Ii#p5{}uCU=JwR6A@-!01>aK0aMk=zM+r`h^oh zLcw0hoCKg43beD}`kdl6H=NTw35}_)E6+&~10kg>WC&|8vGmQMdU+w|dq`hP59%LiJX1XWEOF3Xff6u8FoI+Zr5u$Rj{|gl`3cKjn*M;M ztSBAU|Jhwsi9zCuG53@ULQl+NaI4pbD^1vPeYCL3-k82qR(Mz*QHDYwlP!H)FXu9# zh_t$$B{DRlk)oOCC3|@2Dv6+TeLNjhFp^t3b~)4k_NDy==9XQ>e)%UWLA@h0ro4IF z(k}qtzsXTv*!qt`o|q3eChI0r=7i*~V}U%I#@Yzu%hO9f|KHcDE+?*6JUH{WsNK5a z*)-9j){6mQx*YbPAlCPRtsAF>S!>be+cEF!OPowc&+*CUlHM1*HbXy>E%uz`H5zR;`&6F{-6jvWow_o{>{oCd$B>%-=NQ!Bq-& z50!O~v_k8pz(3ZNUeS`jIZI<397?(4|F1KA_R+@?_ez@CRwx3zuU{MKGl2Dk7c+BG@Ver|qPIv*9zw zL;p>Qal#s%?r-Qi?u;y4;M*a5fycR*$MH3kH@7j4%7$k|*u8U}=raKyvmsk0L^Sh$ z5aokSLQ?VH4j4F|Za0|(<_xE$S~E1q8Aa_74wBj=&Lf148iuvVB_MNRKB}x9<~VRZ zc?epeqpzIRp4t>af|2KNzJqkVHVD-Trl?3gGdTI?Y&(S95+y?+ojFH$a)1nhnZCd( zQ&!zKc;r4lc%YKRLFQPi_41QhT^hd*ry~bVs%Fj+|5Ya5lLIrRUiZz>G;CDEKWl87 zh4<`_JiOI0kq?LkP_7%>A=I3#npJG==h%0grfk1D>XK^xRA^^>+j+f{F^-P6F^&YS z!qnH)J-O&Fz&~!I+Zayg#B3gIvopqw;h@(uESEWvFe5-j`d}-d{X10aJ!1sdu45Rj zcV)U01eWb#|0Qog)aL1qtg^ssdJ#!l=3@!aFJ=;a5~eZ-82N|G?ULivHATW6QNv`C z?bnaQysu+F+iDG*x^7twotv6Ec_RD}8HrXSGsTE?a-`&q$u7~eL2tV8)DI^zdT#1Z zY6xWaVld=5H$Q%I&ewMCnT?I0eC>YO*8AttaXoKv4oZVQ-#Hja!;=@3aJ2eNIhp8| z9&JM)uImiYepo+^8@N+BoZ=4Rt|-;Lu#$<`_#h4AQ0jS{Qr9x(m3(pQ_P*A_!v^7M zsLE(_+;!!htrX}yU2Lufv|Br&eYGK4Y|1}3Hzs}MeY_g7-mMFX#K-D>t@IVP%2W60 z)Yo3m!ShLq8l?=*dU0@6i%EPMVUQc!u87h)sHXweJ?qhgvK$352X~;ieIJqYa4GWG z-9ZIaCw3M2N_l2idYA8KW_Jut}Y@wf!>#_9%p?`u`4HOg>EgAgs8Q<$2`P=O1nah!S;b0jDRx}^jBpmX~Z;BZ0(QExZ_36ssp-<(T=A^m1hY>HlxLssY z-HQwbPmD)!2&|yVoyxt+c7en~GvTBhz8I?@oEB#My zgBxdjUQYj_zP(<;{i62!^P7vn*N4c#jek_sW5&9V^)Sb6MizX3PFz<1^DM@*V&!$u zXhD@HVU#{aCPM2cN-FORX5j3v*W<-_Qw!i9C0=9fzPF@Q|7A9Bb3~ba-DBLsQ(k!G zD=`*3W=(RcgXXVN$YrN@(cZ_+0P5A}%IH{Ix6Aty)C&!oINtS1gMsm_Ud(~(xOwrN z)5+^57(JN!UxkIu=pnf1+JqKgv#{e0sIknPepE}OOkVcNVcgz>&RS9IUD2gwGEq0Il zplcYV}w*@JRX(yg-h8J5og+%qyXLm_#c_ zU;1PhB`icMJg8wjqfGpcA&Xm@>}H7oU#Y&hIgjG<*5Z8s$#>o z+y{h}w)9AL#!thL4<+18+(7Br`3Aenb?SG-OKw zy|$1I;8Cb1O^_A60pb;6MX_L<$v;U(RtXf3E^j%L3^a!sPB?humqW#&hHOvNp-USq z=3xJbY8euLO@VIc4%IIck0(>bu}@rzWBXix6#f(eM+G=ZN=ow!_=?Y>Zq_QPs{T~@ z95j&uR(+)=&u0tmngQJ)tP%HxdnA)mpr8FlOZ*N|XiF*g{;I!F#cwcZ{77i}V2X;L z%Lb9`NB^<&QcVjv8xDfB)PQM|af%w2GmS|JLWYh=#awEHK6e*{?=qtZw1T3|S2N=D8 z|N5@eZ$(xDm_NpYHVpmLhnE~>_A6PEIQ-g45cZ1776W_nO63Ud9=J-hRRl4Emc3{3 zQwJjkIV*I0ennk4V1J;p#t(PvxiTu=oGZi_f zYXpLpUdsl*<~UU1vgs^^p!e+@1Dgr--iy&mZQuki7-Qw9TF8q2AZ0rt`jr|@y2Y&B z4jB_I@w{21t4r~UPfM0X&86riA^|a7Na;8RsVod_7?f7^+Aa-fw%FDV0!4_}LF*x4 zDr-R4=T$^nQ&ZDLJq#7TkzCc|ignhehQw`UT7o1313@&JkqyQS74d?Zg80!G$hJ{P zX#{-%0ab&RnIG&bs@iWJcem_G3dINYhED$S6{1?F^e()WT)N@mpg%#C_3#yIN^=2n z$!Z539ZXjJ=Rx+zD<1C&c<-(p+AsEsA_)MBakKFwr%R(#B8HOkULR?I@_A5>l$&S{ z(*Ast{n-N}YzHAj2!eHj@29Bus<$XpB-b{C8083kpVu(lr5aSXVMwA!2zi@3A^2_` zMXF<|L@pU>I)>h&sqNGKfV;`7t@}l0%(R*|46IiOrd5#+_4S*yHk$8pt97Cu zY=WIo)SL{>Xt~SWQ5?F3v&OtjVj>PaI}Zjm^Aq&!=^ky_lzNwYQlf=5y6X1}xZF+* zQkQ`v!BOc*0b!S8jl&CsUu|?1B4vQEfidXHBvyw76;<*0Rk`#d-=>hx>4~JWWeaL& zpmaqAk5=p~kCpC1#m&QlcDz^~>%0%+>}T(QqfVowiO`&?&gf~_n@;dsc%%w!g~wv; zcAo|{pd4Y2ahBcv5o%jZP9s7hZ$7X3YrAqm7ivJ^w~F`5y-_L!=a<>-Hdr93YWcbF zoAs|wLX3kB$YVl%O3MpG`10%2PMYq#{+)tKbC;ZOxj9eofT~79GF5F+e##V7&zy=r zl}A`M&vv#ao^!RiYfrSdr*tK1E4&!(_Sbrs5k2a2Ils<5lMU$xL}PwIc$(ocDaB`xT<1Vn_qn@lNe_5r3J zzM`R_Ay-<0jFzqCc>GOj@E~Y=BCkZhlC5PlTW*pxlK-?miz49qsa3tZbP6;OZ5JYs zu$-OmAvjwLE%ifa%aP?PUIG=|S}R{#ra9-JLHx13&!V7%^uY znbgpgUETMZe*}9GvS-S&dh)+K?nj*jl;Qt0`611ZvzSAQK|C2*Q7t&`P2zjoGzk?> zIsZrgs|8P4T>`iTc|7|6j6nn+`t6CQM8h}avmKtM1>1$Zr_Y;kK*Rp>HSxsGq|$-6 zJ@4tFNE=Ad(=4E#oVRI{!3Uho?oUwfRtUp)aM&Uspq_Ho^BarUfBI8eK*t)?EN0tRD6O7={r3#KN&a_V zkUwqlgqr-XAc23$v&RMbzr^*=oD%)lt^dE~bZ#6`=%3-*;-mx_mpu>7H|^hX2y+sH z!Iij@tK`Oz6swTda}xiw-rqL5!nxan{##<_2H^s5(jw9hHUX32=m=})c+%DC>zuT) z!JuK&b0oo7=REjojt(q#u52*VTLj&m!ZWhR_^>LUR%F%Zj^CzrPU9kXnUJDwzI=RC zpR-ioRDDNqI@dk%(u!|782u-RpR|MYOz;=Sg6S>Mtq?xB$!+@E%2j03b2UcIS>Gj8 z-;)3WTZ}hfsy%29TQkSDAOMmA?M<~)YNr8Lb-E3SY;mz;{d?x$PRK{v^rMdhF{NBqyzkJa_ma@2+Ae!!52rpnP6>x*QkmVwVr6*oQ%R ztp=qb`&HE5q`0<&Di-_{SIuj-H?1;4(~SwOL;>saHDrdq=Tj>8Z!7YZ8KCizP3x$`>oOQ-R6kmI^6$9cHn+?|rehpVSCcf(Er(-674#XtZ5$$Flf!X1TMe zxciIAE4Y;pgjb$iDd5inYqmLRcgJjfH5)R#n~?N^Bl8t9mZRVnMzfQ8t}u9q8hPVz z2U)Bn3DeUGgROt>uvK*FrMg)Rc%@TUvG!S7luPArFCju81no1s2@a>kQE^H; zD3Q;h*eLHGoWzZ~+CP4pGtqW8J`}S(-qAQFo9a%SWC@LeE4(wEh;q0F;DE{L)_@I{ zdAF$DXbdJRaU3{ctfycW8DGgasg8{~g1Rnd!Q;iPKYjEHitu+aQ#eXiudN7Ji_P12 z3SP(b=_2!o>Kk89bfh42#5kp2C1RsrWL>Isec>3c?tYj}WU6H@giN=}5hcG4XVyKV zqS`dGx309}o#@;PnpN^esRPG*npYgKCrb6UxPgsVt$m(x=Ot150c2?W(D(UDw~&MS zLw7|^4~{d;^*B&vZB0fTVyG*tF+Y8*)41(e)1(#kxrVD`k)l>OD8ISwMocCrjTF0N zaCt5TC&=E}C=8(gO;hg{mu9pvIxD&6&a4nsOYezZb4~BBC+(8~Zw9#9e7Mi$Ge&I9 z+18A8jFiEfo7?TEbAXm`CvsRmY0S5Ao|)FLFdT!XqJ2$1V-8xzaxOBEJRnqN-ag{Ws? zWb1tYay&SJE6G-xWm>WgPdbDlkG->`RwcR4<{Ik6mR8IB9*A=+4=g>1emExjczMLS z0r1&?krXikTBTsGJ{rENabxx5`O30*Op3hy9E(SF)O<90^hA>{%Z_umfO(PI<2!GP zjP?`{&nJBIrJJ{BI;n;Hq)7*RozHt09L^RdxLT*1;ep@{ECR>To=d-Gs zsFV8m&Nu61g2sYmSg!hGiCUT7!zpI?H5XrIuL;{;Cjl6#%0ZCp)|G8^4Tzt8g){=6 zuyfFjI#)@T<=yAg`0~3pTuEMU0U{Upcl7&>nNc{DH~TEQi5aa7oQ=ld`LUn%w4vZ|&b!K-0|j6lgODn=&i{maP2mDNjgw0}|DPe}Gg`6TW89g$tbN+u=v6m|UxW9ifQ&3&ANbi~yLxZ5l53P<7jn{I*g=Rv>Th}I`b$SjPVSBFpUt!{-U94*3}fryq`#w)_QtJ#*Z*d z=ah-@(fiX==kf!Z8>_aji(5J z&Xb6t!FIOI`b+PTJte(kh?nuE>@RIz>vlnfmYe=K?V)FEqtk;0^@i7A$!m;Qc`$h-US7NAQ9!a%ziqzm5#O_ur@ZRq{D`m=;%dt( zdr$8lm^o)^>`&6UiZ8~$f4K(N_5g3uao->B_wKR-d&gSD3Yn3sc1ZAWQGEtH3$Atw zYh0_-2F69E=2}S{5(&0H@;D!G|6o8{7Tr5q@URBKPQXVMJ9W!`)l6V=U;yS9TJFS`&+Ymikd_nTQ;OJ=o z@yipW)G5y=dp>_D355IDyL^OGfElI!qxGT^SQFT)u(l!)$TcBTG5`vXpm^n|+tRU~ z4m0UYK^3Xupy3L}O~+PlpQVvSf0P|_%sTFdSams{v=67}O|ys3ofKjYE!6juKVQzy zbsQ)he)%cE$wMM<2&8IwLjS{i9!XeccG^^`hx{jE!k}WDc4by&qhtIC=1H1wMW41A z^?#^OK%XZi0-x*#5!B=1wC31=PfOk^2lfW`Kj7y#0?YV-wkOrTu;9+Dmm%6>!+2_2 zT#5T?^9AxL{8cIa6=psb27<}%Anz+t)D#==`a?Iu7_x6k8z}U=!};8BOWB5baR3<( z03{vt`FCuiEu4omyLn8pJsb2B|0DWq5&->p(qWpZ-ekIn20GXnL4vu^M7%uh`WnCO zyy+m$v{QDuin1GF!#%oQDX6@I-`#>y!A0@>*ZM{@^5ElzG5KRoaV~^DBLga?5B-he z8oB*g+LPGcht$bqIirne>hSC1*iRRr8{4Y9%}rPVy;#XOGE%7fZAOLY;wVgXa{!;n z^cCjHxy43ce^doHglUUbTqa44pk1h?ToL~kqZHZI#5-qKx&#*;-|i(?w2UlYr8#_v z*!%EY&_SjBhV6vLdKrcHrvnLzd=;#v%=&>@Mj~hZ6^7mKcIT_Wn-P8r9)owm`S+eh z0xnm2P~c1kDepA1Gk$kn!LpO(0zk4yzbaNG9-yFTM0_8BRXNt)6 z8sD2FfTJ-Pfl+d`d(vO1OEo}A7oK;|FWOXWZ@BN~U1#BzbLOvtr zwOpf6+;i5R6)0%B$;+MiIYbi7`v)Jd(Hjdi#;80A@ZswCnzQ|S79!#JMR}@;hy_<__u)!9AvUz| z(VhZC+|VV=YSxS@LPzCn#c8zWv-wyKkHXNIoZQc~a9j?ACAzL&r}Dgz(&<+RI|F_U z!yy)1n>;qbgZ~IS+%eKQ(i#glQ9orQcDz3?4^1AzAN0@i9;!R#62Rio;qhzV1Q@b;VVxkIY%f-07`5o?7}w z;D?mEBbzC-dEJPL11C5%WfO(*$rD%%V)^6q)>wzEs|8lCj(d_I@^ZB6DLombfr(9o ztJ(@w)3L1mE@8U(0U**r)v)ZZEDeY6&WTX$D|TWakdj{g5uq^2V4@5*4Z zC-O{0r%t~fEF_D=)$$Bheijf02d4P92#`=`l%eFG5!d|o=>LoP!*TLA&ZP!f``M7T z4i#q#{g-QWVHUB;R9!tpE)3*nv5T`fHpj73%QL4s)MLOV9?+IZa81e)!rhm*V&aIg z_`Q`&>2}_W@5XzHfiKN_bNch1lTwn`I?vx&i$MCu0l&* zuZ=Gq1kumF3dGS+xn9ibooaE=2lx4CeF}W|a3JGtb)rJgj5c}r>f$ELMHnyDV=2#E zQ-clFU#t#{j-`DathIDd3yYz>bs5ODSDX76IXYbbL5^yP@qT1!Qi)Sl&{DjbH;%jc zaXy)8>97kESCOcfo;nz4$V`{M?ut9uVQ{s7z?^9qnzx zu$tFh`}#s}AXAn!(wm(9E6n;=>Dfn^b;+uJ<2}Sl?Ty~|!`v@-44O5#UcCfpUCF6^ zeW^x~^sZq_zd|)*Dew>RT`grc^v}=Mc~0*KzY6W9U26o+*439{a(s|an13b8&E0;$sZ|tT-8d1VNHXOA{w=s3e#rNFR>Fq+ zoxO7F7IXc(ZBT?ie;e|?jZuH1#^X${O6l0KjFJ)!25ZShkGW15o--9`Z3gxvKQMWm zlNiU7OF2K{=5ezelBSg)UQNJlqjyDfPQQXA1iA|v)2#hjjCH_^dD$Zj(B1c!K;O!S9=#f>_CL&RW2dQbHHa<&12|C5X0QRFu3;GM0 z7w3O(G=Il|+ZE9Dl;$y8e335DC)F%KOJu!pVKdr(G3mo0GAfCnPiu(aMERT>Kdytb zMEKSq zb$gzQh}onHT=qZWUpG}6IUDpITnJzN+iW|tB-Vdz@95a>{emE5J2!DF^h@j@yuN@$ zYq^}*xH?+p2V+YbGn%eXOKidl*(tW{h2W4Ny%{2p zpTgk1T6^!JQki5qFmqBA93J5RV(rqkKJtBy-jWG%*toC~q@TG8DpiSnX_(H1xRQz8PMM*dOl&x@zJ zf|p92u@d&9MVM2!7bvsmg|%hr&EF{TX9!w44!_M($@yRW1-QR!3r+~QeS!*?Qhh%1 zxu=wdL$%<5F(q?GEW7ba2&=ZtyD~?SdpZyO*ZGQ0((l9Wxp6TqrDQ^;wcUkn9+!1Q zP6;WLXWp1Hvl0NmbckOtgc0w3G3I6JT~mWnB3e|1`ZW;>>#tx#2lOCk3Fq%Y&aU&f z;vdDyP^oP|Yk13tjlZew!GxF8>vjLFK4j&-R+aK2fsn+N3uLDkQv7<@0|y7o*_Ij? zK8;VCJ0eUgo>FqqPH4gCAGDV3f$NLEBbkB|q6cfu)nXyH?A(@`QdR}!yk9S z<=f6VGgF}1?hNnG--La<`h^@GhEAREQVjV0GlgJ*B1}PXmn)Z-y>$OTuO`QtL_O67 z3CZ=Y#KY(7=F=rF>{IA5xj;Lw>?DI^)=gRHvu3uZn9f+*sv%LUiIT0oCh9e{ai)qu z?mBvL0WU_(LR#eIZziXRR{79fhx3bVt{kHaJlOYr9hvd4-!e+!1~l*PFcV$4Bg_F8 za0fqt{o8KxMzz`P!(a5J%)X*~v$4komd=cxFCD`Fh6&(px@#$?oGvVNT@Qx~!Eo`B zE_!-APVm+e1UjQZ!_C`u*xn;hy58zE0a^F<<6Ssh=QpF=9TCFOoe5I7uE@O1xNU1u zlOSPc=lO}8vAbV0k2C!HThKj~;IcsaVx{|`z=N)Bizk_FdFs_*gX%qZj`JT!SB;T-SVbH)T``XIgOm3;o`IuQ8LMOCO)vBoOi(q*?7MW3pc($SGy%nBh7VO z=8NKu>`_~_tihxzQpc+_Iu{(H8LTZwDNQW1NPX!RHkH8lb(!PR zQ!j9&4Y$t%L`>g6c@kzyo)e0WHXNvRu-v=xGF&AQksUj9*$C)P3u+&co=0-yqzRgJ zmBBNuF8n;E*s-cmb5qQ8%V$!-{)meva&=X8!C>?mS#G81K#~INbsb?<5SJ(8HBVFFrrKoknxhwG;%pQ>LlT2on&^pu))w zkD!(35%9H=ky>5EnPU;3^u%q~CYRUR9Bu{EYK-Y!E1xn;HfpXPF!qtp`F>~ROQ$Bw zOJJ}S@#o4LKQp$>*Sl$y6*k;rJ&1uxAa)ux99pz zB0I7YS{v3DWH9ASi+Mr?^=C8Kf%KrmxM+Vvj}4-)&m%<~Q^sBo?xub-6S!j4C)(5iMu!Q7?e+Re#cseVK<`xlok z;?7^0#q(gM*CiK&<~DrpgTp3$jjXpx^gFW6VZuTU0w1B z*kTkj-cy$-i-TuSXm4rC6)^l}Fb@&jr*b;{7n>XE_i~;QSlE2>Cf;L<2{lgGT18D& zwy%J!(h8Sb6ZIN+qkhU0p0O}loF&N;NlJ2LJBgOwc#%Op8vdpO9d7us(;xs>ORCaj z%S(x1yp;SqZ%xGS{Js~I?%}wKPbx8L6t>|L=DX=RG&&Ak z?>;0+*LCX!>aQF6L?#Z;yJibzl{TPQ8tfQv4?N1YH`}(Q7N1dkKWB>Y(MSn7a@ZOj z?}bLLFjO!j(~&XQeX2-QqKg?^7eXEUTg>(=`e7``g<);yNcbWrg07Jc*xfs)w|jrO zfcZDU8HbA-$=5;W062>hcN&=|VVrcf6322V8ha8B9M;20tE#Ck%MgshvS^Qc>GZU9 zWsvxcvtb&o8T{wXiH0@uC~-p{!_fkiyPgaxa{R-mKJEL%O982?6Vl=g^gpZhKJ641GD|L1Yr`#BBRKWq1utdL(4@k_czKR6u9xEPhc1F z<$Q6*BPYQNp~P_a@!{3tJ0j>xTTjMJ&k$D@;%sePe5;FmX6eS2#`UjE_#>G|fyv{e z#fwS@C&S%rL`6~zq}XY&-T4Ld3s?1F#47SES%Iyk`{h@tZk>Mi?EWSuo}A!VynK0& zKWytRQ@*j{zb8ZfuxHNEtODxN#bJ<)*2SBJn6`7H^A||DRY-sN0 zJXnxco2!{bC@Pyfvs|V_&{ulsqMcSR7ORiP(7u14oo&emnth%LAPymKao|C9Xtphg z=}hDCd9o$(PV#qNOgcs}tVa1#Omz*4!wCGleXI`dgx#UT>1v=Q9id zPbM=c-t3kVIGe^ajy=3S=rG+vxdZhysBzUh_jro!&Dt^9oYkh{t)fma5ELUvo@jXu z?D#EYc!kINa_8lh>n*S|Nhp{F`v=f*&otxRWIGF@z525ox2!muIiiqb5p`nf_dOr) ze1%>!A^18OZKc(Vp^84vX$S3qc@1vx?davr{zP*g==~*v@<>3d4WOF-`ZxfUW@rsn7um z5PaRn^1K{pl%%3D6wa;c6n{FWn-xt!N`ios48Qr~`rcgZDA1^>neufez`v!uti%fD zp)glQ6nG?n=8hnQ>~}r(G%lOng>tR1lcYZ^8S0lOQ&W()U%2(=#2+Q_nl&afNqoW+ zeU+_^xAis(&0344NN8l?s*^f<_2?*@RU0;|Ao-?!k@P;WILlgMZ*_ukBiG9u)G94G z_Mq^*;<+{BlcT@<(D2$Bzu7ahOkjnRbdKn>1*A66!YHl}sF>&0z#kvBpodejzVNFo zYd+P(adJa33EelYqXVrK?3)_dtqKiUl4Ad)PeX=NQqh8VyNe7k{W)N4`6&f1OhqVV z)trqD0g?`68X?+*RL3kxP(O)9Ot!jn3FcA6U_waLRE1V$a&egzOfW-F#j=+n=!w-R z1A37qv&Yl}hN0R0&YIC|hj=nAYlvIwdh!h2Tfecf6Fsce2KQkq=mtjGXdQ;e77_Uv z%NoaP9^kD>TBG%VoGkmq5~|^YVzC4Axh|IouqpiK)9)K?G&TLp`**Hrzhqc%fpA1u zIyEyEFnwxxbOA%K$pPkh9rHhy9K3cMfURc$7n}hMcM6qeSDYw*pTNcXHm-^E@Z!RV z{RwBd$Z`30K0>XORT}p&eJ_C2+lV3tWhYmZW=Tjj;uS#yfsT$}*=Kse=j+%agkna* zT#3&Bcsa77hHRd;@sLr~X^43?X1W`yuE!)rK0nkl+@t1^nrl6q8_g`WmTdP_U}fRh z6^|QzG7P(hq6(4G9-1Ss-+>x>;VJ~rIX-lb82cAef3&5}D1=I`!G_%6q;oQ^4jw@q zMg@5?S4jp(=&CVvDzod8+&an=cnWM(RC-m&@#vgYQ&fmYobc^(KPou+s z$sg6a*Z(Y5?7CCEwtkeDI@WlNYus2_@Z5%+yMgkhI`LdCY#+1NB}qRqRBhICFB=zX z-HX!#%k4zh*mX8CPP4&|_L;Ek4;-tkiYG$Mpt0%2MYBmSQ-U8zts)j33FsIx{C8OT z9DaYWxB!G~Q=kT^>*s|;C}QtF_(%ujjL3If4l6*`&x$DxgWLPitw2cIsI&w zPHSwRBdX$#NZFPQ1Gro4N0}g-K^rSMJ3A8Nl z?%tXA!@)2hh;SliKz8@C$;z5$eWeD>Ga6515q#taTra|)TW`V4gobbC9DjZ-VHqOj|Q?N2A0ERUl!OM!2!4(?1^`syUb$HRyR8{O0(29buo<ga23IuY`VhkVcMXv9 zc9y-ya^=P#(80*pinN<>BVQ!*g1O=KhvBV(SlI48zTk=TrpH2uDVlh+Xp%TBU0R{5 z?dA!HBOWYw(KSLNfeA)94qSQoI=OMn#Ck8dx1ylg1m4}PQz*2~n(yq0*c(4+CS{C~ z*|4xG4EUJXjtH=FE%FucaZ4FM#^7IgUX-9!ZoB`nq{T6d-@V^*s^sGpS{A>O$@5f#bw zx|zC1MLu z165*j+hu_+cl*S+A?yk?|Vn*B@Q9t}bt(-N}<4PK_s@aU*%_aTaDOk(~TK_~LJtR(uEBD!*0%jNB<|T|u zN(fW_vlfRp*1V(dumb-G1oQ7RPd`;6NC8YI*a0vW@&;@2_sk6DXnMK_8~PT#$jhj6 z?Ck#14;%{RgqXA)g`Y8|)zeBUe}JDQkXha6-c5L#E$&u-}J+sw?};-YpN; z1&+Y?7GElSHNho{rec#m^Akx4@rLi!+(0$QB~?0+!1CGVn+@rlr&j`??4^w8kkJ^U zovCgYV9o)jc3jB94OH`8Rd%*_hp(hxLf#$0w_G1!A@7>2b_5w{w6l zQJ=t*i(O}9La{+d>`ktGH`%>$FRKXG&1q)K&vWXWmOa!QSG+H?(9VlzsqqK3D%R3V z_>DohAAT@8s9$R^*8KW_VQi_^1qcM-Y%GkOScYFd2X;OI*eN!B=Uh}>wFsGVd)?s1 zt?GsbT(f~ty?AERA$}85ceS_V%}qCIeOxIVC$g?A4;sWa0v&K`b3(2V*7{Iz>%qgb z+5uXuyO9je;4M;)!s0HnfnEBj0pU9(N3N9cmFJqfIFd4IoAVB^qRsRC!rgKDH$%Zb zAavaaE)|_T2t!aAaTnSN+wTV!q3_7(#I5?Qr7_utt@B1H0av7uZpqY_h)YaM&`KNkVR8E^hnUSInU*CEGjv5F3e)? zs7lu}`$1P_{MrE!zOu`T_c2|64)UZ(kwB;a$tk2qOfSN@GS6!fF~5Q2lv+&JYo40- z@$Xsmb81-dTe0Ik{XxQ6V~OqqR2<(84!hTv!V|^Hu3Ieh!QY}Z$JCoOnY-UK6Qm7K z*mByP$rwkVTFw7V;`g{Bt@T~9RvNEuP{?#3C!{!wfia@vv<0DLTrg0OsWKIlz&B7^w|;}1mM;x@!FB10pmw< ztbqH=0*h#Bx&?dL{S8Q2az%?Vr)NT7G?A)Gi@rd;U5r}_RwGvSHg~0Loc_e`DXSM1 ze}*^phS|tve-+betb0(3u-GgWsx)8apS|q6r(UYh3H2<=G~d?#eAq*!akr&ZtcZ8& zP1gki#pvH(cGTLdR>P@1b^o4N58d#@L+g%_ljUp=XHFatdBFx%wFdl-yBK6%A3lUO zS3$E}dHCes^^97EDXwq^o^LXktd9QWtga_T>3Fke#(UlL`;n=9#`eL(uEP(0SfVY{ zzueGyiEAV-fCwgJ4&}f>Zckm`%i**AlIasL+eH9va`?Rp)8?TCbjW>vfUJY|WeeN< zEaPb%mB}PnTL;D(bA~haroNg^F^ka0j&g+g8N^jx?-+K$QZ;g)dgpGM9vlSG+bs2$ z(4(QGX--*dG0;4qfIIwSh~8828ReL!%reryFHtZbiEXXF4Wl=}oNYN|@j#HnRk#8; zt~nvf>&9dvgxd$DABPl11EF+$uZ}u}p!ix~QT!(bf>qi&4`VIDg8)?%mp(?w!TajF zn&2-ZgRe2n1QtG@{pJJ8OSt%u%k71(DYl%Y4aG{U=!&V~BgYkfxH;)O#eaIHJ&Dl5 ztmRCuEVZ?Nh|vTsU_x31<~Cx$$#|Rri?F5@I${%{o&_~7iwhFBn}Sftr?5ru2DfUg zzGR9}ZHTUMF#W1v0|VL#k;-gPt!;k}xPT7bje{ZUEm`!dkTT&#GnQ25{f+!-`ID0X zj9z)MY4n7-I%oJ6w!yfi54(WO|d6q{MZ>x3iW&I>ut= zAA!3R6*Am}Eoa&iLG<+*h^Q|Ujd@`k(rT^*O5{0n0G^r@rbtS{DiH`)Nmnt13MIHq z+Ss{zKo%_aPbeB%ysiYIDKdya6r9w}FuhRCk_cqG?KL+5tGJ9a_UsnPglqk#7!I4p zSusb+mh=!Q>($9?>t9LMo^Q>-7r#@d=#-~VDYPhEIuI@yWp_$M^$z4_2{;#D=;{}s zXskaUri9QlB%hiZtg>v1hwq0n-30^i#c5-15$eSe=(=m^&@;n!|FZEmHdYqQ}1fjLWK zvCk>5B8zI6X2EEgHrzkVl8v*4$?`g0E!}=fo{tfAft0xgCB(;Wx;f0upH|rlC9VUC zEl@8$(c=>%hj8T*k!i~Ks)VOG=3%AKGGr%-BK1lw64JF{)$FK_J&q`!?JaS`juPLdOUKCz@<6O|F|#XA_Vu`1x75*|C`3J#{_ z519jCZDr6LYxiNNMDma%N83|@iwKJv$fJ*C`YSB!**HvAeEU7m1f!oi_P)5F>B5*6 zQyO11W16QOzb4lY+Vq>5f=;b;;wuXI{f}e;6Tkd1e%b-QLLi_6El9P}ud*S~Xjf## z#OP5*<$l;f@n3m8R;TE?q3LY;eT9bUwBkO38%tE z6CH~u#MG5L9ld9P-)3j92T+LOZVr^q>($F>%dFVZQCZp&Jd#q{-blWDh8P(cc`Npf zii(0j`Cu$;VP9qkQ3qbu)kk1ed1CIogtgqRl@oEZet^V#nGd@Vitwr5U77a2Jv8>9 zZx!!Jeo^sbU}pb^*zl0hOUI_`r$>lZgW7D*i#LZ&8-=VDa7IDJJEP zu~hyGi7$Xjn)ctU1_3G5NIBm9e?1c$YGQXz_di65k4%UXzWpC+g%4c*d)0qv0)dz8 zUe+KgiYY;OxQfEtLqbJ3lMtQN6!W+c=3n#@S3pDNYVA*OQ`NEAc{UzWS)(CgQ;VL$%lp)Et*U4mMeNi_`{aiO>Ee;->x2-7o&=VuNh-t)|6< zw+ay)fWgtEyr2eDE!T-$SjmvjzTDgx+{E zYGSFG0L4g{h3RrN<94&O4teWA}lk;hYo znk^AB(V3DOc)xweXooN5WNU^E-XIOWuzF9Hg!QnW*1-wT+uVCKjV1&=gfy6h=+2mK zH}0Aq5J8e`h`R5B%E~>F1T`iw0($?uR`G=s%(NTN3hes0Pq`vcfITTmAqDt_Kj&-V z$DiYA)QP|E2t^tH*|P5Qiyi9$Sqe6)8=^oT8Ui42!|qg3g8R_^3H0C9w`Gl942kg- z1Bn7Na@NzO7+vYq@TUGXkF<2+mj@HZW&QghaSKWS`qnBkE60cC`u{Yx58S`Y1pIg6 z|3_2*zi;{fj_QK}Lmyrk|IuQ>xr|bS=MMQ9N`Xp{N8b7<)3v7fc9gXkWVqASe*H2m z+L%jOcKEeY092tSzi{AJ06hpDp8?5jKsYKmydS>v9?qRjifY(#>7k^H*qGE)QN+F0mF041e*QiT3Z5SYXa#)t)!r5cr69UFiG*} zk?1c{LTsG3+?GL~M#E8I2bhi?a+)1WY*(%0)k#+t7tNDxVloxzGoA9cDnP zJcz}?n9;^QwiX!0;E;+N(PL3z6ywl&H!nJnE#fK16luK3#A8jbuy6y9gEV)AQpbl5 zL&))87kxZdOd$WI{bqI7`j(&=CF*oF07lXAQTGfXvhl){%bbu(8B;QnAayks0|6}( z$Ka6@PrfO!QN}tyq)(I$QYJz1lz}()t|;;+3M>)T2_|Y;Ur1XWU1+%I?Hw;cl7&p~ zzDs^STFhWIh`URmvXSw#IGrq4zR|FouKvLyu7o+AERgDHr&Hh^dx!(tuDIis4o6hP zD8JQp&TcZ{xO=CzX_L`7xKHBVyOf)^`Si?;0{2Pi7=Dv;^z;0A@1E-FMBN8FdOG%a zWC{G=9oLpc_h+pEyQW{#KCdLiQktRSbeMfyP_#q6?~)1ef00+4D)W2d!Ju|gm%bN5 zR^ng4m7r7Ynox5K#7DjvhkTPaDr;)gGQDEsb$AYFRBTOM(OR^>7d&;f1oN=9zDE{x zbje3N$6TSeQW6mjoCSWLH}#i`h^<`9-wxpx)Wk0L5O#yN#0pl}dbuSfxlFS&#$~7~ z+-Ix>NvP!!*1v!psc_lJqqLfR;Dn?|3NJl?gLjhyr6ZO<#TV$k!q}f(Ouq;96vyOi zgyOLl7)kq+8@c1DR%VXYCY!OX>H%)~a_XQ>4J|P_s>E!EQB&v`eok-wynJw`o^Z>v zW|l?Q^+Vd~_)UfIFf=hd@cS4$C2+NBs(Md`KfNnmT&?iLe-?X%6{l@Ze}f)w_`K%_ zaH+d^cA>gUi@a{qF`6JJ1fRq4$@Pvdy{8tTE#gT9n{D6b34kkl3%RMG<(fBVyZ!q3 zyVTk-fzts%7H0OVUUZ5aCJcX)j4WKOsg0tVh!L^wn*2z@DFvDijCtBr&UVix zZ<&ZIf_{J_kAvOl%|=o`#{Jx-d=d_8AmJBfS|ypD9Yq)$gP}H=MwIzi7b5;FA>WxA z@ZY~J^{s{eI~uSh`nS;vCac26F69{mX(ukVnTlYT4LL2%%6 z=Bl{qCigyr_V`T8&VxR6eQ4KYRMj5`j@si6&ZPu5 zX3pEOfg3W!qM=Bs5;w*+Yc{X@cL?qvNmP!3Ji9aHjZC(X3MsN7d{w#OZTiDbAK2?e zMf#mIKNAWm*xC>N@oWB~=iX~Ye{oBRZfBt2A9)78HY7Ld;L_IkAfB|>8NPOXcZRrk z+i%M`jfRmnbtu1=!DY+2)y=|##p<<&o-i{FUAto>Qgf;FJ2%TR-2-RKi;y|> zfE*nJEGc$@$AZ80z%!m7G@{Jd@x`GH44un$FIvjGVPc>vdmQzfKI&TXhewy= zx*G%EOqNG7Q=7)v{^sO+L`E-9^K(W{KTlvuiqu)C*2{BD`f0iIj#Q(fvp6gE*N8i) zHsd}5hJ(JvP2-VH^KBb>%t~sK1P?4MSA_z*XUg{5DuvQ1AFe`Nj`KUm=NOYA7wa=V zJM^TK^)aCL8T-aMS>lgityUu}dTLH*w?^o;T|l!lqJ2Aij4S!$8gDHnbw;d}mVdBu z;y3lmt-h`Ld0KH2mc z%v;SdH5DS&9{M6B-jJ`FJhnCKS!l_Sz7lCx4#(!aiE$8bqF(o7kPh=K3K^@y^eA=J zDiXLc9%7h@w$MAj$+COxrE1JWlndi2`kURWEm zl_V_9W{BrVNqOj6ySyb^+apcfpMQk@d9vh9Wh9i;x{2|lNx!diVSEabWRhen znAs`Uq56{FV@~R&!}&a6_mHyDnG2n1nnwkDh@vgbU3Mav>ctdZ9~z#HnP3b)bIY%{ zpumJhot8754`|!Lo#vne6ab~TlE0~CE~w=ALRJZQu`sw@uG~(}c=Yn2-%SeH*^;by z;?mO%1WcYCwu{#|u%c9)ar1PgiLa|&;(gS3aonPd481cnZH;6&O0s7(TW(ZmiR7iip98K=uza&}W0BAw zx)4X848h!gy(QGo>_`guYNE7Go#pbH7=4TurX&y*cAnY$@)+X6_lpOSI+8p+_%n^C zN!4!B^HV(OeD$9yq^lXQHO|~*Uu@id4TujLg~7_ z@E^7#e&SE7qheITvQa22TyYv3k4a|ias}kg)uRhFv*939^umys*-gXiIrdZ7FH)yf zpIORgjlsRCTJzlD5pkOnimn8V0uNaFIXt0V`pa0{9~=}PJo8U4?>j0KGY60M`L zpVLAEDi0hMsu+RBlCgLu;17T3)T8zW8|?d>oFLo=CNedf^tyzi0$E-H5%5YnGr>SQ zSnGbhyMzIG{R!g!)rjHd8PmDP@T>ha*PF{Cal+KYbxWA%Yt%h8E?4~9ISW7ViqFlZ zE2ZoG$y6DF43`2w(ohn0h(^9HeddVh`ntE!#iBsi)U4xC`T`_X_F}z?ome`67Pl-o?njS9{9Dep}s|*8)F~vr;hd z-_7t%pj>;Xaq^N`?+cr>nrVe+@)!=s5!bAseJMtT-5wM(o35``iE7*FqDON_VGi`V z9r<`wtFn6p1oXwxFr`P38Jc$iUVx!F;Dyd)W1+WY{d|o_ZXC=37MVRASyra#Ue;rI zMO=c856wX~d*GM4kTi0V-z@Qi73J%i(n~2r6U)xj7p|n7`l_-w#Z}B^X6%mZ;*R^C zCd0QfbLFpD80>D5Q4*lUys36yh^nqGP+5tPPnA-Z`_rd-v)LsRkEKQ@=(|ozpwqy^ zhALzF$lT)6l9rkU zu@p=+K4$=P2ih{XJ4@m|y@iAgqe4e*CL6A1t347zodJb;)+qT7bbOI?S`iEf<6Ae> z+v_pBG)=};;elgsx&~8zx8eOZ5GkF*_e|*VdwQi?_DDjD4U(lOEu@Wh*H`dTRI^`m z;__tIK)w^SuSE9nFy-F?i;y^Ba%FMx;uaf(w)uEnwJb^1pcf;P;U^~u9rrU62Rrxj z74~xN=1(opM}P17xte2)f8gdsyFl%lny^8CYulE*NDpmkOsKA$=>RJ#17onqD^OnE z=vrwBaY>EX0Qml;VvYxQ=6R$>!P*gj$O^p~rW=%u=e;#mDic``zrdbCDRs~mN00BN zC!qcqq(G}d#df)3k6ybYr0q3gLsM-VJSQMOg+tmc3tRb2ZJ1|GkwV^}(2#Gafv44K zj#cUl%|g5!Yj%i^NYFD=3dGZD+?aea{0un=PXU8QUy4KtFST7qUwA4_ZMI&-eHxvr#)rw`-O}H^HMn$?wayiR zW{HZU1V_){a$I>hU79^u+E@)FsG&=l929B!sHYBEL3T5ZL&gh?_A9Of?(pO?=7pVy zVgyJsWi39>_YkKP1Bv=#Cy5tkq~{Ju*eB(5#Xyonq`Dn}t`jJ0-a0zOUq=O5UB-ff zvc#kFGI|{~^hd8`%$0FtjWrERVPj39V;u-$ln%{VnS2R(5qUlqA|gK~q|knMR}+6- zE!QWEHT8Mb3mz$%qc1J1>ClGvNr6MyD@Am$N;+GE>B+)bz|DTHe7@$D%Bvg<>xjQZ zeV|jS*1caBS7QAN>rzLJpZK1a!o}mJgv>As3zHhG>7jDiKrWvQ_=BMC4WG+gPxU#nSU6wsE{hB+Y$mQ}p76y;?CI^uxs8n{B9;Vg7{) z#!85$;{iH;*YoJWj9j?07})A{Y6b008U2<@APul`xvST_7In5jf?tirr0~&%5Okar zJ?CfqsVu6{Ve!h zFFgcq2ed&5U3@$5v&K0lL4~`6RCQtOE?3Wr&;%@Sy_1!ygeP(ui?z*4xsAy^$<$0g z4%i^_AFTwXnHy`dz~nTBmDg5O)VTFSQu_mjhf)R`AMLMaB1I=~)`A#duGnmzqTP!o z#P3`vdoazH$226VJc4gjXw%vNvFXgtnN`tj%enz~iFO7pu`8 z=v~aQFnc+QKF3Rucb{{3)&f$tZ`ca$4<-S01&1kBEzBKSV z&;40`BX?ricl)cSPC|I>sjyzr^vL;(n~T(aWa$gJMK+$c1=+m;s|a2PCC0n4wDD+0 z+VG2X2_G$t=Ub`{5uL}E+k^Cmb+IddpK`sAA6Q{&Nmpx{PZv^EU%(G;2hVnoZ(E9L z_=re^O&xWVQRF;V?DjiBSQ{n*`vpMaW7J9w^$9WxnP*V_V?x*$1SX`0v+jP`dUNSJlP{b--$1u`|Q3%W7lbP8=TvU%#3 zhgYbg%AH6V0Ii|&CN2eym5t8Zcer2Qqj`pnk0OUOx{x(Pg~q08RI&UzvXX%}_n;hi ze7`D4dQ2fsx>J6nfceo!mLHDVLb!edqH(ULRVb{2DFh{V>vY*&0a@E{5pau2mBA4T zF<@IWzJWab1mH%+ItU% zj%)PmS6HvHPo}1&v7s~s20lOv`LO7KNV0LE_Ku8>!kD@K%w4djLmE^oY5ehcQA=lh zcHyYU$+%bL=_-MRFWR!6vQP@MEMDh>2mD3RJ9tAcY*}d?0slQ#PtSeRw61MBe>5oZ`sT(MQD!hiaO)KSAckX2N_Z7Iav2GJBoGI4( z$cx0g>}|21RpWf{vi~h624Y4$cMzkmFX;mZLWcWQWt{<+qq9fkVgwxlPr}H8RfhvO z)X`)|HmuPf;XJYRkihj9F|5F`*r|nf=qXj>*Uq!KS}6hEXtc>Ljs_FI>SVius|^Ck zY&X{Y_yqL|@HnlDnF9Q^C3hFEY9Qep7Mvwo@SM7B);l)p=$drB=0w2z9P3{gR*jFN zkR>u6s-}86lkT+ti8n>0+7Hg2&p>=-3yxI{*YbynScILARK;;*xBX zl9V!hNIzhbFWsK!Y-8#`&vPv-+Q)CTfslZ(=8^P-c--x`9 z+%GGqc2B8L#+QBlhO=2x_eP$msG4rrhpP{K`l>!h+g}{BHzN~U$TT5@v?O6y??ipw z)iKTvD3B#pN&wc-e+Bwr3b{g$SBwuiQQ-6T{{>2ZDvVHIAVe`SnjkrAeG*3++vOUps_yvvpvz< z^szWof-9L3iuo$5)LlqTb#3u7LyH^~UOqspV*mG?Jxv?d1<4MU3oTDQm6A-uky{$yKJXAKQx8B8a2}F92RHQY}QJdYL>W6Gdfb!(Puq}Ub$5{30Bn~ zdxAdkfDfX_JZ zIg>H&E>USY9<1qC$8=m(&^MRy#2`D%_PJDt{^jS6m5Lr`~?YpNSfGu(7Etm4dgT@e)Mz;`-HEo^X^n70%rW z0;po{n<^vmP*c%Br}}DompkUUnJb5)N9X(C_I5knmL&H?*vFe4k3tK;N#%@57`AZS z5eu>L`0MR+PzqbL<^b&+8shnZxxMTiByh=EBO2c$8@!Nc=q=Z~q{B0zygo6|7q8?L zJlik_w8YR1DBS(|0L7%>m}+B;J+C{B0G-V*!JB%L4AmBUkT3g;L^USDEZ&Ruq-hRN zUGHzQF98%kY{LeVWwe@m$En@lL*bsmf|g|WzV8evBn7Kov$KCnXl;W_MOsXmmzD1HOw5AdyUKsN-urscD8H zsCwKt8GV)|-V_E0nhd-5F66!e5%ft#{JhM}dEPFm6$KtQLG-9~(c^(V#309=^r{S< zfJ;M2iQJ~x8y^jNwf>{~5>rvMt!~})=SD0lGzl@Ak;tBut1)^iw6<{p0%TWDsmkH3Hi`0e75Z-!Jl&sxqE*NxBH?| zp6PJw&C7jHmH^i6ix8^;YC5rIZg>SA7tB6xH2dt^^SLZiL4UQ+3accjx+%6$2XWqV z7a@iB&AH;wi)5_~KNS;g71rXLue-sg=OA0J>R9TuM4$DAvQ!r&SDYB^g(%`L>au48 z8sKIVK-JTbBy*a+o6++A#&|Bt4Jy_LtcTbb)Hc&v4cXW9A*P7H(e6Snk1_ES8ymq9 z!ioBxD@~zkn!UR3T(Lm~9#SLc55CQr2gMry6A) z0H#`Rrx@>e&>NJZZ??l92MHW4aU}r2c@vv0#msnAx!$_+-<_d=)DQC`{sZx8snsv&1!u?b+2K-aOsPO2BI2lrCkRjXTy( zD1ZRH!)#&7=)>PAW>glKaN}~UHF1c}=ur1`)YOntQ zQzd~g%r=;L8y1_NF2rmaHp}c0o2wvP6(dlZ;aAZu7+(N=9-@6%a)WzJFgXy#ksHeLFg|Bhm_jJ2F_6lwloei7zHuWxFaY z25}aA!Ve!FwRjloftQB*oDCQ>HR3#RL9sHVmqIo7Kq@S}h39?y!m>+DK!6xQjU%ay z3?1<%_Ii1QyrDCk0?PaejwZv(7MucbGzF8q0qZKblT{eAhAS!eo%_V9n65^0oq_B1 zvKeJRj&PaMVP4n1@Nmb!3`FA|Z55U&YwIX~JBBiEjzSzI5r;))ffw$PUx9@3`y@3` zI9Fq30%;YZLM4^*&E546z&vr~mRTo|Ayl4VH8Hn&4HXK^J6VOhb>i5kx zf!&;m>=edS3ULW{I0tat$8Gd<2>~3bsVVeb#{dA5b^$(>>+ScGO-y0B<9h?kbLuoD zWzmZwY}oh+;1**=p2nL~k+>SJskj^amL%%e4#VSSW3yw<_HHsH-*A>UWk09=s{#-F zztw0sN=r44y3G9zcDq;4xu&)b-petv5g`kE6r7t)k*;95KTB(xfb5|axBFX+N4({*&1}hNaIec!Y9(ZXhRDr; zB1j;1>$RI@MAK|ZvI80`6@S}g`^wYUAuFhlIOS)eB2xq_lrS-NcPvhCI#yhy&vHYc zx8KXB(T(Mi!{3x>j3MvfMBo$q9@i3wWNp2@pw)2L-7)d34AV|Vy4;zt@<^>@={*;vIV~klW(wZvXb(s znaFY2sxLxAPB<1%&3=Ep#r?`$jp5+!0pA>6S{T;t=PF`Pn$JZ0HBcLhQs_49{`w~M zAAfo-d7{IjS#FmlnFR7vLsp`$+b=pVsW)xbu>%s&aOcnLjPzOqdA+kkQO+opzw_(+ z0JiUvJhZBwlp;6Qm-9CJK!zBi|1n&D;pxUDdDuE82+lbvR86q zf~-$DR@b8MuEE+8P~NniwS|Wd8b;u)S+gAm@$RQ_v;-tL!sXzEL4yFKhCu%v<^8Am z;7bbXKfssRAGODWWt;upqm9O<(Iz$lM9X)7&ItY0l_jzL;0IgT%U=%ZuP1WkLmS_@ zzGzMuWtI?@t;RyU+?X?R3N$B5k*TEf9Zdy9GnTcTjLUuCpSM<6UC+}sd_^0*slrZT zUGg~H+?k0N1GErw=0(6&LLuipjX1eaHt*bKZTIi^A zPJ{ULFE0#0BsUEZBDAt8%#_2kaYTe#{N7MdAt9p4mN+|t?CM7Yo2Eh=lw^a>h`m({ zCJ=Emcn+nL;>o|J>WHVPt}(-oJlO!ya9ae_f*$FNXb;0p6uZ(b;H)jY>V6~@St{{ig zA)clV@aX7m7TAMmqYT;`;v%obZ>fRT1G@+gExwHX2TY*EZVX6I5&TAgBbE?<`6uos zuX)`xnm;|N9st|KU^Gs9e|7Q4HQHrh8v*LuGVv&C>{-v*4f4)4i4@C30MbZ2ycn>^ zC|OOn4DKtZer}Li$g~`Y9cL6uD`K~}LBp>*NMIvw5zSMy(FJn-i$twM+slJ3{k8gh zV+}r@*!l08WPJP&G<`qn=9G}4nj(Ah#1qYkF+jd#b!3!?zL~MrMX(XEwRc*KJ>Md2XuIl~;W|W471;e{3F-=`K zi!+mme~1|?<<&~gbv+NmzYNz znl+6!!WryyD+#3 zkZ?T#2qAawnST8sGNtUvEKh;JQnSS@`KH8>(8-F*sE_tjc>(aaEIB*ovcen9v1Xa> zXfADcwD@MW2J_ScAFvbxgU6t)PWx`;LWz z`>{x}#lus(Ii&Qs_j!x6#efNEx0;{zL7)$_E)KlW)*(45(evtWVv8C-L~JTy6O%UF zA(Ow$7o;=C#vW0d{z2xfU?55?&K+nu$OfM-7qk2X#I4oiYYVK8)y_!MX_06)CW+B% z-^D~Mbr5{Ap#zRa!e?MVqOLYNs$wno!G#+L+rx2CEF$xARcw_92yPbndzKki;}F{s7n)sY%D#O*x|MrR4{?Vd!!UdJW z6|ehRt@7G8Tw3J3{V_bwa2V?D1YzPeY!?&3OoXm`+R>?%CDZYi)vDpg;S?l|;pgty zA=R1n$FkL$K!jY z_Tw85Rj&hsbXyC9+k?T>yN_Jf`@Lu^C#y~VETNY9+8&hM_8uw%c!RrwXJ&h`h-gai zu&Jt>Z=0zNKf`fS03)>gzw$B?C?oVm&xN6XhLG#?<9ALxw>Fewj~?qSHwT;ygk_VE zL5V2TO0}3o0kj=((+(Q(Qu;-2ugD*6 zg=BtBe(PGPj)|Y$2)>=Dz0_YTuOQbK1Evh^*LAv|;}O>-+lD2CX!TxdQCTaVlEQDn zeJ#0E>g{-fiG!kMD5&hdL5XR+KFl2cR?8~7 zi2C$TSitKlV3`Ko(Ma>{vWGkwM)6q@$p`MrUw8VgybZve6k8h2#weQ-c)=!0;R)oR zl2}kSDjclT|87{XNp_hemBdQ&$C|Mj!{z#l z$hUt8d8-mLH@%e4HC_*a55Plg+b^{0;I(jTwWcovuJ5;}jhc@={m)UiO2vGuQc}j~ z9In`Xx@!5bt3$|Hm zj(M^y$LJ>p73N^CR|+G<9D=p_I!#cFUS>4r81zQ&>c7XDrAk*S(`!2+^RVZlvD0^t zdqE627hf(eWvB3_pb1qV&)-!i03R$&!D< zZsFGTP6^j5#VLw~DTrfdJ|l*B{sm2v-9(_6y4v<{tGlULN#bC4-@iA0^?ty_aQ15O zZb%UAgSBlz^>Uiz$L;4dX?yR(dh{yy^rA)t{4GIp+<861AvVh=UFO>_xND;0P_vgLZ3TgC)TM zET#*C^0w-brjBPMjB&?lG-;il(ol9w4LY-9E1H7)iqeVvp1p+b3~jyGvI^Zq|FMvCPyE?Qz3BO+KSJti(x$X9j0r zUl3o~#^myTKW4Z>$0Q`N`0922g~J=j?~Pr({78P+a2ymJk(gXKmESK^rdrUeU1#0& zf=2Yr5~im88}6Hf-iAA?XyH}$d%}(zTaT<)E?<9&&0$|6wnwFwXGBc3wdx~R$0R#U z3M?(Z|vhWb_?Tp>zQCZYJVu z6db{aS<9U)^E2`oZf2y>Y&HFfzMd)sCJ#$EU)uvn*DAi5bSWejsrmOVo;q5B&d|Wf zdrv0u;$XaDg9DysSR^!gV7FoPuSJD^_g0fe$L%_1Lb&1LO{y!4a#(q;!>F4^jTF=Y z)TsK}cJ{J_tJ>^jH)|D^e&fR)0fXzDh103)?+z^|{QKTshKHSF4tGG1E=FIE>sk8} z%xHk5>VbWXuOy}bzdeuxkjkPi`fXmGHd=|wro=p?8ziMCk}(cRzB23wGzKP?s>B4! z>=$5!_sr=hJM~%&oq2?1YBLagph}lDz(5gc)rqGk7Y=JJ!v%BtVD9*CO40pQDp&bN zrpq8Mm!EkBrf4gEG61_WOKpu1U1j>oaapxab+2^#yF!yc-})_sy(T)X8EpS(^Y7`t zJYA@-X&Fwcll-~_S`ePr+N!2dhOjbCf%49;DM9T3K49N3?=V8T;?M^K;v^n#3%>^WGM}$@$@8^EB$C3=q}z;8 z(6t}J8o~1hm(UgIo}E|hqm@BAKbefRognua#9htD51UH0vrn;fE+!g(pPCwr?_o67 z79Z_+?{%j00K)TR@zgqT%lS-^De+MXa$^H!zvVV2fln@m`HydX7pE#dDKOeyci9OL zy_^&dsvxMLdq(KrePp;HUalRkwnVnex1T-y^Rjt%?9v@4PRZdjY{eNM$z|hjylltN zO$U`}%R{d87Q(0f&KkiLtvgM>-$%Kav`M_YwRhYt0L+sprO}c*la9EkKq0-_waZXQ9Z(Ow!%$~@`i2BRu=TKWaS;U1~ zei^v!eH2Q{$P1O|!GGNQK4Yoz04pvQA?|JtkuJxr8qAB^FJMdg+1%-u*0iq`mlz#^ z>EfdSDbPz4kh-AQp4vwTZ7s-o2!o(YnKAM?{;pX>(2gdUl956wsXhVf!Z`XMmJwof zrZ$y?j0EM_-extbfPRF0mKq7cabju07d2BjM@FFf6Z2fXkjE!+TQBCN z#hNDHr>F=%TE8E&emPCS!OkXSRwB|PM5LXesDM>=b!%K8o$Sis4u)~;&g4XD$)f5n zsR3{f!XUy|&;&`WtTG&}6xmytf*v!P@M|34d2d^)Kd!G3j3^it7cZkFjVq^&Q&(3; z0aMiD?y!WtEQ|7yGD={kOECu;AaA2wP>^ZTjxsOvg5>q9mX1tdhe^otH|`5n$`mci zfx>PEJiY0w!BL6tD=NYR@gjCtstK#2`Z{17zt2@zeWh0{G??1T_8493Cp|t^sFL~Ixv4>bss@W5 z6jRIV-8j=!&mv{-+lj-esuB0L(BC^DN5mZH!4&h~W_L2qet zP7ic|7hdZm(UX_ArQBjtYUckSxm8PdbT>1B&3cf*Ei8vTKsm&JT&QoYiK9CWM4*}@ zxX9ZN{!}t4IscoU5HN0*?PN_`M#!}E3aQ|XtNQvBi%pJXvM^j8qV~y*=CQXo&jnAC z3FKWvqVB*lHzkZ49BgY616hpIdthMQ%WAfSSG&U`LVTmte>&e&use*jzMQa#O*#W&=KM^$ChohHhfR z)Zh6={jfl`BvB;LZMpIJPGTd{UDV?KOGkxp{Av=gW?30iLv9Y;U3Y)vRH9^JmdOkj z#A5tOmi?DfO^>63$Hn@Hmp$htiezw`OXFA&jec?%wj9GqFdCqvMx&GfI-i$|N-Tr? zN#wRx1`x#RrPb}>(j{oH#Jvne3);#9m-3Yajq-59Eya8C_o8Cs!_=#ZAdpjaQ`Ax! zHN_2j+`rV%$r8wk%Se!{v<9W*OLrOV+%MMSZGoVo@b)KU<)zGx*_ZG}`joZ@hQ!^8PHbEK20gzEz9W z)i7dll0DSuMC?!l938A$=UOD$?ZFURU9TGHE2RC9k0(%CNukT8xCTkqw0K{UvF*x> zF=NZ8=ud(%QMf_%&FKnr&{Y;6R4e0mK9o#@9CdA-2Q3+zE8k@xT6r~SNBl2ymxGaH zFR&)Ru@L-=zaQh%Z!#rkDq@!I2i>(p&s{+~+s8 zs5lFoJ4cKd7B)A1O2c?5|5ZQwUpqgC%v7>qoDa zKPXVchA+@oAa!=vQLFS=?a_8kn{9$!tdD$V>PnJrLdRU^zQK$$JuxYTqdIBR#Ec4K zvD{Nl93S>E)w!A3fJU-AEbLcK^Iuqf6=?$=#V%%eNq`H)6*pW)2!ZTmP#QmgVUiN4 zAINA44gFEzf}9TXs@S?Rp@{LfOo;|xvw)k9lU>D5BK)Yk$uVotVT7Qb!Xh2v2lWK} z46P@tlIm(k!bAKaJWZtUwO~@XM26pV_UnWR=&IXC->j2@7ZOEGU8oKj{^MJuzXU4I z-%6T%1r#(*s{Kq;R3iLy%uHg0RoJ2xoNu@ws8cW+@_+PcGCFoO2bVTQ;}KU^cyEgp z(tVYZkH#gB*{}2o@GmxPWG0s2+YV$uLRQ z(?4|EaZ6NOp@SUpoNw{-&o`xrz~W$=1Z>l4*W}&BbZ|J`#vh?cu%r}ocS{3unrsIV znstdxtu&w|zv^K{Q-)~LVLVIK?yF!n`(QPxx)1&82Tj~+-TR=O9cD~xzTLzfi?NFp zroc5&ZGYEI-OPC5{AhNC_|Bp@ys$oNbfSXgY0dk7t`Ek?<2r`J>mJ9F1m{<>1zLzZ zP!g~nE$!R+o%iXHCBcd2%ZkCGtIy#egWHRm0SrxSScH5e-V;m-ZE|fR24RQm4+^<( zpB+8_^7dfX>|-$5y6lCb@iyGE+x~JV=mz46mP@6}DM; z5xZG(E;4?OR*$-Na`q_8^ICC87NJdap67hw3UbUJ82_oJ%F9xsFHyrSmqD@*=EKT7ea_$XO7+) zA`yCYCUOPL`#)6dzmeCjN%3BcbExI6qv3Y*fB&*B_#gUJloWcHySj$rKV&V^6`=Lw zzjW@uFx>+(wf}*`p{qU#5M5W)>FS6WT^^QnYLNne;RPCrLC~#8eT<(xW6{B&kWW`( z{Bk?z-KMlRk4654t^6mR|La1&_?G|V&Jk_l10zf{yA!vxwj*JkWLjJ&d#|xCHIyVC zi>ZkN>>e@R4ufqTjpQK>?u$318jYCMH=%mC%-A0tszfhjU%KW~Cy$N4bRd{@NI6^)F@yVWkE{Xgayw~Yjb8nY{= z>zUU+t^Ih<@3Rsn4dAJ5=ZU`X+u=0&VC6n~`kGJRLE~S1+<#A-oq2y4fx#pBFnA;Q zV*SHF=l|k;eDDDOr#`W6QcaUR01Bbe>;5m!Y?(g*8cS55|Mst@QTyZ(&hlh!7N)n- zf8w_9DoAxROF=yVub!DonFSwbKM}O0_xgRXQDaFt9qqr@yj`%GX4^x2`{f_W=(>q` zu&uTu`hSn@ArOl}=kI%MJEp-u-gE!?eiQB+?f=|1KaZzn_rj016tf-!Obn+hw!YVM zDDTg4jdzl{0$`lDNv}#W-R4LPS^7yaGjBI(xDuiRf)a{h^44V~7!XK6c_QK2JRtrb z^1e$TMXAF0-WSm}H(P&Wpq*E0+;k6F$$n>!z05E0umF-g-ecl=}80t16kQ6pa4 z`4mb7=l=rRxIb=PZ3(xD0E7en+j~m}$XUOgU;(>+LUB40W$pX|A5=IwT%GTORo*i} zhcKczj7A@Ip#NOlk3j$!|DQns+W({t|L+za;Qza`4=@4pe<}O_3Gi?KzmLHG{|HCQ z>EQpm4-Z2sx_3$mQ+q>(HcBhXQ9cZgTtkNr#xaSR-gjs_8`m`^RGQrp5iWu7cw#Hc z397LvmYJ2U3c4FfRq$gsUW!-hL&QQi+bQ(UR_*t^zJZHTSfYTJsFg)O*uJ6SDm z=GrpL4USs*G_QMCf8zm#QhE&-u2q(u+$1L^{#sFezHRfWlt8~MkeU<4<3dFYxAlv? zcI-%sxdl2paivWkDjr9vvI@w7;h+nulJAdlo4B19f1HZ9FhBY0Kq}AR0WVZTG#|KD z8;f@AG_hic6q_-Az(_2{t>d|Dp)=g2cmkWk-fj^Xi6`#W`sp;jRHZ37Fe;d2SS%z& z^e#q;-QVXmwtesZq%*CainXDiftf9PpQ+6XWq3Y*@`PllGynDR3jMNh`Z1j-y>n2q3%dEBjZXak#Flzw0I)~65d61gQNJnV}e4d!! zdx(dnG4?rj@7!yCd8F??v5HzJN`)cCw)^T}O!c)spp?$Mn_-&*lO;jdwF=t!W7T$( zQ!mWI1P5#rjKcaFk~6Aa7c z8r*#q(Wx7LyT{1KQX@m>y8~07qTkC;Er@#fXR(=5X%1c;abJaW6zhZtKhGI*-~L@! z?J}Vo9_!Iw_Q}u?6VS5AN+b=lvCGg@3GX4b0-j8eT_xX6njMc70Q zXOw;T<&OGXwo`*iobl_kVz-e-2C4J%&gbn^%v1u=LQ@v{kymH}FSE@{wyQO&(9{k9 z^onBeH(U4EE+f+&15J2+ms~j=`D^|{Z35jU5Ky3{GkZsuMuLIDO^oR_pd-PBv;OXl zq2&^ncb&N{I?eKZVC|3f#Q_Rj;nY`+gua9&mGYLtq_tV&0x$4!?l*k*^zWzXcrKwv zSJUcrxeTm5`S*L5Gh47HHc2+ABgNFfIHJt(Sy9q`xu2A6?zOUt$diz?jF?dW4u2X-u zwJ3VF?HBS*4EZQT&g#8$7Zn%N@)MOZUoYQV9hCh}z{}GTjEhe`i}giM$Naa1?iolf z%C{R4tF|+hyr)x-m(7+F(`XxWDv@DyfK{=__RjiDe*@gdoLsiEs|oSSr7jY#;u(?& zR&&9L2S>}(pFE=^n>run1?RBwhAWMm7p=*a%X-8;(9w~#(+x!_&Tcf4PFL=z{ckba z%J9`Z{^nzYGm?!D)`!JSvpRb_NrcWWm6nGN9X*R!UJ#dT!mRBmZ4G9u3p11v&_QC9 zR1Gm(0I`Q`jHd(pF*&-diBm{?5z}KFu`zk$YX~YU&ns4R z9a-M*jR#1o=RjpcC>L+xcKtBi!aLHhedG7Sjf7)p{H9h5OQSiaU9b_3Dgq3=ROHvL zE#=5FgY7eEWWCiD`{PP_>vulH4uZ&GKlRsQx3;HC*VRVmU7QP@95?}7VC?_I1l-&1 zs6cO1p;nvkRamOasq(Zpc1GJJJv08hy%pz7>Y?>_rb@pCf_ML!p9DMeOmd5lE3_|8 zZ#eJ-_7L63#Pg=dW1}=nDne5X>jG%dH9v_ASDIdK^KE;OceeS~dtxi-4OIpydz>xy z(_Lj4-cQkH$RvTDbIu3Gi4*2Q-aFX08$X|(slF|~cmIx#%8-s%1FDw2j=`7&ftQme z0(m{l{YbWz&f$`v%WV|-g&IBHaqd@ypKPph41a^rS8GuUw^ohM^#dFzJKWD`rVtyp zH`SEd9^fN8>U@XDlI3T_NPDdw1W)?QG@Foh#iz**q3US}Az_;Sge;dQ3Us!Rsb ziD@DKhJJ-++k0MNWWZTl@eb|$atoP|#u>mAn9)mr&RIeZ?T+!5{>~TYve_hwls;7!s$Zjzx2=wi@bQinVaa}!Ya93Dg;DpU$SV(M_nh&% z{ob3?ELiQw4G}Nqe52uc3O=)S0o_%!aVNnmR~we_AwE~iR=Y9;ZG#cpP^TCtJbFh7 z7r;SkU7E)}u?90mk0{U@zrXJ}(4##<_WXO^igt+C#k*IN+~%1$Q65*Lv#o)9K>ugK zCBSqQ;h?8Y%zAsge|;tq0C)DvMsCc^bWYB8aR5zj`;ONA0L5MFLHVDDPDxE*6n*O8 zG`*3Y8fGq6Qcm+1OV0p|dDcnnH^A)rVb|7n{uUx~hVA&S@r3 zHVp=GWVtsh2i41dG>bTC4csDql}owi57rE=x#=LE50f-*n8q8@^_sR!ZU%qngFJ`+ zN4d;SXSVX7&RM06Tuj1(46ithsD%HwX35-i5tYK}iim2-i2q^@7PaMWFF=kidrD`p zRC*Y8VufIJw&e%3b+c;r*Vk|u-ARfVyV(lXS*$lkd-H`CLlVdnk}^C!Omi67$lWaF zCePBh4NMJvxAm)rad5f7D-JB0uX;G0SJg!7LP_n8OEzZUmM4{M4@+EAlfpre7%~~- ze#Wd`otRaS=sluJnH5nw0m3&=rh{@VmW9~KeNrNMb>(ZM?+Uj$P9Kon*tX`moNDaV zDG6C3LIOgIC{y~-3L^77FGE|~>oXp_V%ZO8Z1bA4%JfK&Q<($5;t0p!lrG)2UJQ{l zAF$dAqp&+Z$&QTvTrhuJsH%s*&ng<>t@oa@gmb-4zh$Pzt{T+m0Jd{r^1zb5mcDFA zC0L#FU!&W0xsuDq96;rU^wPJEH5=gsea_KgUnYoYO2RI$)kO zUs||2lwO%OvYo_41gQ5$^-aS=2~lK>mi)O9)?v1Q-3hIFUs!WcqO>HW&fi+Byb6_` zge$1PaPc4;4r<<~Z#CfH!B zG$u~+YK=RUzA#r`L+asVLM)nfq&%AwgR77TLp29^r-e_%>3J^R>>~I~_2kKJv|@U0 z_*Ja6ilrN|fJD%xK3UYqEUf$=i7*ZWE;EvPuh6)evS`=n_;I#X4|sx=<8iUk<4^Q$I0fE^)Y;&@RNfMp|AL9wWwQdV{b(b75bad%eFF&K)e9-%{PYbGL<(N4f|&WbULrd zD6G}FdQP*D2xFDnay52SnycpC(ht#Q7UMQYIoB`Jn8`T_-4tghoqid^ zA0h@-Z}Kw2k2bWK^YCZ2j>3m55#0$ z^efvPK%*(O{5v)o1opSP5GCmPEmVD>mHdZOCsI3GcZ+Hbs3&QgECz9dR`<#uIYX^I zVhQDXfL+ae+K4HY?VObE9ktH@jD+#9R^P?_?IZOSI@m`Ss_^}%h-*nGJ`fU#*%7#0 zaC(0ye%YTjK$!QAX}CT=q&Imw`mCmNV+O=CdWm84b$myhXxcopoT)!dV`T{);yHz` zaL#JeT;c3Mp01>*_zK$Z@nW8>yWGr2hqXs(ylxh3ZMy=4uKmQpKp-Crq;?!UvYsVxMB_PJjOX=JsZ{cnVHLh___SubOQ5Rqx z1Ag<-%WTvNn35EHDAwt>dW|!31!RO-u^$|?AQ@ddjNHsnLJ8ahjh*IVw?exqmOE4K z+^&q8y}>fa0DtoNW(rOtu&IpOm746dqF&q2si_OiPK1A;R=l>c^5n)+ftE;RrJ)@} z>F+94$w8cgD-PSZfi3qJbDqxCRDdqo_Ov6Fv)8~@*{zB5i+3>PX{p=eIrsf9rmDfq zTC0WbyU{;!@aZ)GoSzOYLE8=eUYRKgDJ#NwJ*?7K-iX$SaPG%@@&%pUX?nc7a?iBY z;_iy^U!So$Y*C7#=Udf2}&v@_p%N?lYGL3&2rO;O;xw zo{Vwc96I%4k9EF29OD={QJLdi`XeB)*^F1CHSF#Nx=~jT*6~6yD)6gx_E|i%OKo*h4)`PL{_%`e`Zx;U87-kqM_EKyPwSqxI%xZH z6X#L9?waa)UMeCXP1B=Of3-V@$#+ujd<7Up|#KG0d}&IiZyL6e`glC z_+%M72QfGf%5X1Q^t!TieojMbtzEx4gE5ZT(c<{*cUf=?!`U1V$UdU8z?<6g)4mo6 zTta($UEtY1&h?f?vo<45w#ponYn_a2*N~FUMBoh|6+tAPN(Ljv;WJY z9J38(PJ8{=_%~)R;Dw<>d)b%G7}lOHN#xE)pYq{}={n`@FM5Uxt3TQ*BPprh$sQub z>Kc5&V%BN)iF~T8+V43jdi!-gv&JL(*uhXgJUD{w+dsD|W}i^T+GDmwNkmzvs?+B) zfYh=w@B!>D*LA*d4|)srOH}99&5L`!Nb*?}o!wN#>oqqVz*!O&BMpE;sdkUd)t#<3 zgh?HGk!&|aT`&Cwv4zEQ%qfDjaU0}VdX~zkA*!ed`*sL3x&8x#F}W)5v@DOVr(Gvx z%kb)u4UDC=nGF6JFTqWz^?{o}(Sa~}c!YzEfuqD3gV1k@Wmt78zV~+84#6!MFVzvZ zroylMcKjkApd%C>Z)wpc62DfGn`91cHTY7mFkM#@%(}b+Kxnq8s%Zt^_gpWsc|?kM zlw%lAsts|DlTkx)9#el&P@E#{jp93%qo`R*;Wj)J3QH@h&WHJr8;tojpL{ycgcuaiS%v;VxRix*rz(<`0?Urlk*H8b30PC zkf*sxXiIa}HV(e#A6POor#PS++&KtHOAQga%24jsOLbU3aSnw%x=&4@T;qTqkJ7-o87jgYmvyebKXg9&eH1;<&NxT=^P_4TLQ~f& z!s`)&mzHPE-J`!t-m@a48&w#-Wwt#dROAfdu)n3N$FAIHiC294(#8e}4!2cKBz)3V z)lSuN)LdUzT0(J0=Zh9k^;<3vPcpa{bM27u2AWQG-dmCUiwWOn-)79vC5Bb zKjUyxgZUl59B{|D2X4?B$OlT@4iVZ{;s>RKL~_^~H_xmDD=2W^HicMAOu1R^0X1Kr zrxaKcDXv~MwwEpPiwRr0koYA0Cu`y6B;7PO)+?Ib1|EI!HJpeDPYE~_;2U15n+;K z3%$R!VD%5eQj?UmWA~ME!w4DdEQ8Da>beudxbPnw|cV$6Rx~ zjiI89HeN=YE3oXX6fb+yFR0|S7$GvvLJS8QnGXX8!<<=xq1wH)|eZf7l9rBp<(89 zh)J$)<{rY15x;QSAvFa^m^txg=H!zVrPW<<1t9V-WxXY8?H}SuOeaj35B@-1QC*9H zf{+$|(Z}M5k5lo7V0I=AT-PpH);S@zi>ooiTSDDTq3g(bsAkK z_&-&2zDjY*tl&r#QJZvS9FbFrbolyTb59>c4-_;qMDJkIOYZBi|CTNhijE)4Dxq2a zr3f?HRJi{0)Tj*Pom`9}=uoMfHXL(%A(YjTv^=NUw)^`Hcy%9Zw z?j39OTmz7fu|if?1m(2|Nx{35@Q=9{Jhl%L7ef7%ekN+6jpD9q`qMdl$<0ak%;OO{ z%%(Q9wB#AYh#=0>uj7H9)_zSo$-VV&IfS{71V{*Lb0xB~W+6cqSD2h4mOt)fzPIQ5 zrWkShQHG2Ly1RT~gvbTI2#Fv(9a5O`1y_T)3h7bO?}IXln)n#8_>(XQBq5%0K{2Lv z^Y8!-VOUrkn5Q)uadyYzifiGNJ^t{^;pM3P()5O9jJ$0kHCj26{5qF(#r9qpY8vlrT�U2B{BU+G>YPDTnkVqjlr~nl{&*wu z3AUK9`|>z`Oh;fb6-5eNtii|PYv*mm2H;e=0MfmOW7qF%kxy!PZf#Kau~I9#w7aR! zYx@`|iwe?itIawKlL84S|K^z?rRx7*n3s>v&eOm^>Yp$Ox}oAsFIV4m1ki z=;&;Gy%-A4L8amK2;-_*dh3pYznd(no=_X-Rz>_r|<5?Avt1VYDL#Bu_SDg zWIW{sIP_DWK?lVxSf80swf^c`19aJgY$;r#{@=m(_P8UA+!?Jzdax8ZYnw6q)@|v_ ze$L6y7?I4)$9qa}X{qhkEq@p(XTJJFlzTRM&e1%5c8VN1~>ybYdg14F&XcHoh2V7W$tKj?AqjQYanfO6~wco`y`Og z8rjq%k=C)#*YRH)vz5a7#5d zaj6w62zTn$LvU6uS5ksvMEpdI|9)@KKR~})(2qj|kh96Ybvw<}vg-$rEB_T_7MzlUu!zv>Ye7A0F9+GE; z#l&s7_X7Rhao0OQbl5={_6h4XOh*9hLaEY;w?J+;g{es$9(9}uX!9^vXtD_@fioHB z_N;WNIhZ(e%usx}>}DpJVWCX3UNdxX8m+;Jr*NtY^g=@G=I39$6piQXkE9k5QRXgDuj0&9+)V*pc{+qq z^8Gaq?I<8wkoZ{@n15seJ4A!)%8?{$-5!$%X1q~W<~vJ`QJqcaTjV^Vvygn3V?w>P zJf2Y1L>Op#uhpIPWgl|#z&Fz(ulUb4TOvi_Kp#0fP5Jwmp z(q=CPBy^}@#dPt{W3_K-z( zQK?ULl*=bTfON8E9TGll&`4bX^62+B5>&No(7*+NKQyBaf+?~_mbbEV2(nmvLp}zD z_XxZA#f*kDY0I53`QntPN)Az4RX}xUNw(KufLW?%7@Hyjf^}|pvx&$csy^3K)=6sx z+~NB92{S0hx&4#hxb{fD_-Ke*a*)OZ7>zlUMq1ICHe@eAI`a1v}GcjgN_C^Rc@C}qKvC4~HA$BjEd~KTj zm&{I&<&s7M)DXxogp28WeRpHrT2d9{R0p`DnK{K{Lws3q#FV{g>arx$<;lIJs`GZI zb@G^tbJk_q_9H^`9ySgiV+*(WsEUhoj&6SB^={PbV}$}t zXA2%6c>LtW$b(0PVVp-bvFmE+&edR@8eC;kSa_drb&M$ zI*xGrwoD(g=Zogy{+E#rq4yBCbOxE=V0uDi2*q62u1 zm3!P~U)#x0d2bwMxcenl!l~^EG4_3pUAnJ~Ah#Pvxc<6Rf@r6e{KS!_Eo3RMyZo>- zs=Oe(BfTy#xpVrEA=Ml4J+*G|i1kJ$=iUfS4srsYKYKYZlj-*wajH^NLj$B${{(YiTbJZy1z zP==j~UthNOD{7|QKPTq7$lBY$oVPwRVmZpT8p0)?j`7RPIw|3?hdEaOB(2NU3yn;n zO2&b%I7(G@Bneut1z0r{v3;l0G_nZ`$t<-UVj5=%RUfXyg^ia#V@XYCbnch4ipWIQa zDQkX(;js^=+%_?;XaW&n@3QU`=YQ5l_OqUTrvonW*V@XfveK;l%aP@xNA1b?a+q%M zyLq`vL(0(Ot;SR9erP#ZmDi2+N)>(e?9P@;QFW{#dp@;Av53iH#qB80LHD+paZ|CRsQ>Yh!!e z4Dt1lV$l&t|n;`YzapEq!DewR{2c$~1F z+(pchqqVFqVM+c%!z!5#nWf7PZvV|?w0kw@*HBH_!{4&_<0S7;V}<;SA1%Sh2HDr9 zS_1V;m8xixT7Hdp?GUYR3#%IYWyH14pRvb(d@{gMQfFyV^76Aj;?ZC?LuPtQ>3^ml z(eWeu#%2#NY-a*VKgm}A#tT`|T>z9#~QF)w9RNs+}SutCFHTIex6=<1Oq~YfY?0RwN-8MG9W{2J zdn^g)7}?3`a(2;MqG2Ap(r}xX+=7=iXwa)Wnou^Y^7BkH{a6~m3@lgyu4;QBOWH*X%{QLCpJzlle|)Z9&0SyL zGeoe)Wn4P0U^4pbO>Z9}oj+J2ovGB>}u8r{V1#f8zDhB^G9Dv}5_99>!A zw3`FZX)GG)0Uwspl?UBB6ZX} zsK1}%0c8$^ms>cPiO-+M*FgYUdS`s4*L0(?1!C>!@k09*H1niTQ;y6))r}KZ{h0mV zAE)hzE{2`lHz5hEFmm)QvDDKqczEY0q^LVf;;Fc^WvF$FsjBTPzkiZxiTn<#8Bf*g zH)|>~&%B=iEaf-LPhD5mC0vw!;G%m|<#AFSle7UJRKyRx17tb;v9mAghjS zKHdUOl7P%VvGBN>*US}OTLGzU@nmHLC>6=01M)X-Pj%eHWOmEKL9TmMIFE7=YdnFV z>oqtSUhY0>Utxy4~I48Ot&dvMaZ@SdP4B_-wkc) z#tK|@XaO_g;62a;=HzD793!18uuEuB8r;E>Vx&vsU+&aEhz5Y{(r5g)Uq7G*YsCe6 zK4TVAQ{^Zgi;5*-a4t$Zx*~-*e-b$R-k=a8uTM(C4ljf8b%OtH&M$89gd$MK?N)|x z;!AN^a7Yd)&-;fj52>sg<#3V6*DpjP{b(jc#?JyFOEfOGzlp^51J`EpGQr}9PULC{ zVf@|9JJn0U`i8P%ETQst9@|#j`Z)9tzX%Zb`9ZTq|;`MD{`tsc96zy!h5i2xMG`a>v z$EA2jB8?~l9JrEv?c6%$^f@^Kp}-H!GftBtx-4wIoKM_QC$w=1GdlP1L{s;rGPxdU zP9gW_ge`qxG71DwJ&-mY)^_$njPbV{I7mK0<;hdTz28tpy{mj$g_;yn%P5L->$G#f zez%oH77!7oGgGH+Qlx$O?7wY1MWk*{F;>)zn*O^1C<{v~gVg#@8CY<{sq#K4H-vMG_Z&h(x6VobqUtY}=jBZ=Qr z5{3du)fLy=eI$DtJE(J*0QeQj+~o>&3Qsizd>?LGHL zLWqbkK&7nX4#T41t;*yU{x=~tv(HdjZS_$vBEf~fZDyJ+5O9nB77tKlAl)3N^BcE{ z*2`%shKmMLUeYiwXsIYpAaq+6AGljdj;b#Og{JTC&A(DZelgg)SJSZowJlt#N~6pXLA4 z*jonG(R6LwSg_!(A-F?uclY2f0fM{x03if-*Wm8%?(XjH?)L8My6b+w=Y4*C`^Vl> zJyWY@cTaUq_d3>j8hhUZU&OsCr)3{^X>mJFW6$-KREuw19dipYH5I=>_f0h%FnWf! zTKB{**1uwhmms^8B;Q|FL5)6dlj)aI8chfdr``pSul!N} zxP#UBCH%hk3tK|5?ETM#$?^wE;xfiHz56?ueD=f`pG(*|HAqEoKpgEwCh+u4o{gRT z{WVd(Yh;AUGvVL#b<2b0FX|3~0ln1Kt%X~)rwuOskvG%$t`?3qzt=>Grni{Q%#Y@O zm}7#2T7PPgf+dXdxIYVAJ}kg%N}5Cx_zx=nI)UqU;% zcc>eti2WB5|K~i*{{o^-1rb1XBLBTY{%b>ORo34uTzs`t>$3y5-&iU#pUv(H6I=k5 zl_s4`!dVjnRYTh1WB4HKHTVLB|4IF$yA@ENYw<%tW-OZZFw)(&1x)9w6+?^1`f zuE@n%H53mOS6t+OQA;oBoq7t0@9g`nP0M>mhK_4~`;><=cg-aE#TPM^3+&gyMl@&x zZtM2{2?UYe0!NA$_V{%wY`y1gwfy@<$nJ5(?sj;ty^s-a;t2~U1a%CD0U$E%Mr_iB zG9JLG_20hxr$%A?e*yJr|GFRkcNqVF4bDGydjEM^LEqiD|Lze6%#hqnAGpuHO-#SR z=auok1BzeHD7_5!vKnf}Ej0CX<3{2nTv_&})~tA@@6eNhHrD`ZkOlMe!OTa)3MkY1 zZ^(nB^9BZA(BWl=;pWl`+Jv4MshRBX5Jz^H`1q*-ItD`LWdo8umpyK1l z(FAg_lEizLFzZ&4=+lQwB(8<_Ckf`7BFFF_21=ZPH^onbvPW5vyK|a$h!HvJ!c+`v z{OaZ1u|)6rI{;}suwPA3 z9hoqb&$5ZT6wAN$B|THi0-n>WF$k-TR*??|ZOdKf`W}8*JM8iK$>6kl;_U8sZUOdm z_8b~Yytr3V@XmOrk+y!SL{2-5P=@Y^Ngf$#x_=7$?KyaFKH1jAvUjS5Ba&Th_NS8h z*vm!?LkNWQOm@s%$HqpaJ`716pu!je(J5yT5#w|$chykB8IFvBE5kr}0D7^Ivo$g; z#pTu~I+sjh%U+LALAO>dcHvlB_OIswiKq9MKh+`TDtvHqr(&%Y?{PzC;cO}?;Q>(Y zPA%f|2N(NxQur?F0^2(~aCgiG=2UxTK5*gI>=-RyE-rD<3?aX{NEHl^0T@Km1%;Z> zAPFW9^34l}RcY;$!otK$#D}aKQ%mZfuHxWlSoGjiQe^3NVXm4I%An0)QhvYnLvRfI zJqg!XZTerka#mW*#N#i1Rwa3d-}yljFc_-#uj}@Fb^><{sA;?V@JOb+)5hwZJpQw} zRJ;>=^quR1^Y5}WE1irafZwiJhvTwLr&g?-hYJ_ImMsaoC+ePeG3_Ez=(3WKNx!0n zl?Md6M=ZwSy*Bod>wk=VK!Tzs7A3<)mQ{aAoIk!#Z|-A?Ms-jI#;)W4e7{>)M8c}C zyqe<9j|esFHvXG$K8r~hwp9XN4)!TY$ons$QZP6nHQpWim3EjEE8wbQt z4zFK2tV`}m>KWhR-}+Se6?PBwk!@ z&7)1S8{OdcZk#{iL+-2*bbYpD!!5zOTvel0*YV^5r0$ODJ+zI!;CFarlHsk&UhM*_X(`21gUFS`*Gu-ydsgw_Y5gwu+C65OkEcU*-vzWDEv=oM_L z$s@@hTP`VR<(tu|FkI)@8dNJC!N~j`v1v4XWnFJgM+qyicg#_5Z#w&QqrD3YM0IPw zfLWRHt@`pVj6QLrd5d+x2=mDrD`k0AGTny{S&yASA;;)o9@}cWra@ith$*n;ONQjv zzqKlrH@_0yO|&u3@7ZO$a+0nhPjJ!C?R9=?Wigmie%62UtP<0rqc>zKPS?_!nFTrw0T;|7GHT-W~%9) z3s+-7=F}PgdNNN9l{~&sczmR|Qlfb?_t~qSgs3JpjM$0$ayDYJUT_VXofRU@&)D#Q$9Nh`cvVjUBt`SUszi(aM#P$j`XjY|iuu z5m$dLt%fg?i3iphBlpva2O?gTO~=#RHqhB+5cW9Z9OD?TY_ut#1CBVtU=)<+qD#jc zDG7C0a)k;c?>a4sy}SWS6N+x00^T1J>K!Ih;Q8GwI;&n~v|Dx$V7r}m?XR6(o+1W@ z8crT-DF>}`3Da{BE>7$H~JGp$efKuBD!6xE!HB z;-tjjc;QHG_rNX6oL3Yw(Ms=T1JTy>jhc%GZgg^QIMxQq^g;}E=*y#WLp*7?@ zglDGH*Fm&0ddZRb^Ymg%@DP#+l7Zg8~ zUH9B`IF-P}n>OVWs?0K)zeFjO@F(H9cFs=IM{^~$lBa3V3W9%$rOc}(Q~bN!Fq)68gQ%&K)+ zcsSy1>N}Of7>>s^e7RxY`gvEG zsLvBQ$JXNp78i)Sw7=KHVAsu;gyKif~ zSu@j1iVt(j_!K*V`OjKmOQCCBMYe<~h#1|JiE}bc&V??~Nt{k1p>kJ{yl#JH!dA+L z^yERM(nmq;pt@)WVHDQs$Flm%RR?u=K-A0xBkv@T9)to$AG~!g>vVq%i+o=AWPWvH zH>z08(Dns8CnCjRF==IRlHZRK%A$FHfn)2@=ds{@yr|w%W4g#QnQlo%+$6b88#$rv z4}KC)L4)I<0)q_ud|Ipe_|jhuYTD8K#nX@?FWMGqVH}SoH#Dc@QmwXBXm7B$z(`{9 z&QDE1RS@5&@Bj&N)Z;vu;wSqn?uc3qxZ^Ex`Y$+agx-nEoYg*2&@{SLKK}>dDkwaBbG%S4w5Gkn@&_8)PM7Q1U5)J;u$4z*n{ncR;b4GIOls9($YThqvW z;-NCbA64xkRBhU2Lcip%OdoC4QhJ8=Eel%1pP#{Fj%L-zXV3FQI!E0?2!;h*-}mIM zH*r#2_J7pt`FhI0?VWAuaJ|^Nol6#sIp`R6(l;ab;^xw+$k%Fcapq&-}5%GKkrEl!zOzPxF#_EL>$Ne+vX2=^Uz4)I>7PC zfdz-*%>7w#J5!8&-zEv++vrGSM>?IiT3$T4d*?npI`C?^^`NMD!? zzw$;63>8dnQo)eq;a6_pm2$N+Eh*f%p>~HeTL)GiSIkaAkC^(_Ra4}L7#}?GVzi>j zFD~~%c}~osL-FasaTb)h<4AtdKYDM$q8-9Z^?WLKX`O=@U<%MWaozoWN5*loB%ITi zjzbe+bxCbJ_=h|eoK<+8wDDVz=ub`qKE(rpsCGU&P~&Mj3MS$Js$Ld44h9@bcaY4V zYLmCfxaAmFjvzDme;4xrR!o5SK}2G~XNt)4vS1Sh#@dt=mWb+1i^cJS52u5BY$Rq2 z11c8r%-WKXWJe?rFX#yNARF&)BDB6V^gt%hMQ}uxU`3Oo%XWELJ83h5?&0PP?RGA8 zw>49YPHSx%4jBHpxW-Ou8Au)R=*~*NI~`vUldh#@lYplh9yZl&r@cAH50}|8+4qhc zpX2z59ny0?eSW3q|H%K;HxX#6hAvUfi^JaciN1_L_kn?kfjeNWFQ8mQ=ILE{o3W{M zBwQJCv2e8pR9W?!0U`A(wJCrQm;ZHVs0ylK_i}B(7Pwh!cVVT7-wtoNbn*-dRYHh6 z)9c6Hh}*)O?w%5%rDFa_ZD9<}FY z#fIzk+U3QrF71{yhJ!S>8Ji-hGVi75>B>=-L7@Xej(-x-^E*CTmIj7l+TKhBQnW(% zZ{eRv0T<0q8OaTilfhCr(lSN#Yn|u&E+!Kxf??VN%GuIOTih}bFM z0!pO6QlF7}|G5Mn%UOvp{0#bIGj>8ywg%?mk@@|p2!$y<98T1zkw zp3H@2Q4bVLJ2&CGowQ91smmr6p9~c{kTOrD*4ygs-|f|{4d=AIFhE18R^NvoES3gS z0KDJx^K;|IUYK!@H>Ah6c$t~iqAb1QU?}qJ_pdN89pyj$&WeWON?ok;`_VhUOkHFN z0YSCgmUb}`uH$0QeDpH63Kr! zKsQ3ch);rz-c1ae=Z|@z=pQmA&%a@4eSqk(emN=TZ$euif6ep3McJS3gxqX!CtVY6 zEIFu&QQ$fbM_>?<00di~ecvhPCP?4VT;jYifbAfL`k`ASaiAgdJooQdYSI=q3-wZJ zNcs)v*{A2=|M-$P;9N8{dthJKic=wV)u?tsHnKUig&m`R;-2#Sc$GoOcsP^#`UK9f=JUp# z!SP^2{OBvqGdWeM_9ZbUJx%o60KjZx$Le8GL``R;y`LI|EiHNal_ElcFX5JqZmDHx zo+=FSN<>&pCM{niN)y$vGjXSsbr)i+y z`L@7sjz`^4picw6Zuct>p7C=*K(+p>G8Os*Yao|OQ@NgN*CC|m#W2ojabw%w|8p`_84lU=m7~fT$>YvGWsN!J%7NZKF zhRa88ks*sQi1Rhi;8afmHt|K&FdHcU00*A!4944Lfa#=Qe!b=iL7>rQ*-=$%b;)~x z)BmEBj@;BIg7+SseLPwsVl^dNEI64iV@~C7@-2=#r&!3_GTz&aCWMdVg{J?i{*+xu z)p6K(TUBpM(=HI`ZtiFw-!{GIX?-I+_xK6GXzowlF5ojYHEm}v2p*ZNe>6vg9*i3~ zKqWc0Z*LLGR7&Dm(f@fmZhI4beGS$N~msq%b%lc~Lc_8Eg5kB(KhrV*p!dgs}v9*(QBSn<$+p6&1U-AdI z|IWqjPt>6u>agdvF9!$H6!DB@3w@_DwA>O59w{&=x=}u0&hpZ(*IC~z#LMi;UFF+U z82!C$zVWFnS0}#2o7> z5h$|uz{}~$b)x({ZDcHY@XLSPtalwa9jMecas26oZY!VJ&6D~*Z2DQBtaY2mM4-k$ zeJT7F&#bp^3^GFp!KW?Wm-fqE9~`j(Jw?Mbws%dq%YxwZ#~sn?>Ow%w4O;`_ z#E)Iw3Wpv$ z__4+H1^7vg-O7?`&apO*RL^vjB9V*&IqZg9`m}=c+}jg&>d;smSM~m;P;_elxnhG2 z1(IF`tHEGsX%N5UGp_SOi4I86!qVZ;F&swx7t(5=-N%fw-O>xUvZ=SCFkYrVnf2P$FV?jf_#*oKN?tBIT6)^R#;@HSEv*x~sn{f5hXz?;6c%wOC0^JBQh3i#+Akw=<(4n^+V%(`zLRY=@XiLI?CVK(RpBYJz zWpN9H2A<-?;2*BYSJd-S;_P5x*k@9rLMpLIY&Ge|9pyi%OqX7f2kqpxGTw#0S7Zwb zRk@0qVw{GA8M2_GxS}@5)}d|XIgh3)>B|0S53ns1kh9<`Q~MV9u(Lg~@a?0Bvgioc z_m2$WAAB}4%ZVN}&60Qj_$^Oc)vQ>R-Im>W*F%x>0J-NoQDD3_cq?ilo5%nNxW50(`Ub*L~UlQu3=xP!&3nb}IDM<-^p#Km49 zXu94898~Z0@Iv7^D^Db@i&GkH`=R`SuBKPhoZ++Ccx=V*XMr6Z&@zrJSg#7#sjnW~ zWgzJ;?qB60RuZaYtOwhsF|~)ax)bOF9hl*_13vWSxk4rJQK!uC5uH_ZBUIBwUM&+* z|7Q0J3|NoN=oW#YW>p^*7%D14g}4}K$8)R*_TN)4l-ilKWD?0qH~r`18Ti<_?v6V- z5zAo>f1;Zll{Bl1!XoG6whU*lcI6`6Nh1^zC$?FB)lv#?Z zw9FU>i6@M38XlaG?(gLc>^A&PE0c~2<<082OY7J$W{sogEJt~# z?@%3D{B#WTeN-z!%ZY&tuwNA1_D7SELq)%@vv?`x6qHr^4p*v>m5FX#%`A0XOMRKZ z8!haR-SKxr#9%Y3(l)cSf!JX9H8J+|+Nf;OdHcgDY}gJiwD+P@Eu<~G(O8zzG+u@H z=jJyEeLmrKUINvtzkp%P4gF^qIup{ZE7B(8Tt_n?$QCb$R9#tRE-2in3nO(&cz3WX z_csnWqankg9Pls|0D0&Q>kRj|ybLocYSLh`K`A<3zKuPhM4X#6I1tv5^zU({XplZ# zkz$0)vHz&kZU$*nWh9G50i1!IA;fQ(>7oq&m?34)%RNiv8(Cq3#5D)fB6^<1mHnZ= zQbvaWXO6Ja%S>v;5RIRn5(w9huTP-pjGf0~QCpI>WSQKDVn=6*VZ_c-9%E7>PNE6`x_nZ-~R@bY8N)acil3Tgf*BoBeus+<& zdckrc^n-TmWdi&9%?8rwqBS11O7J%!Zrw_nu+}f|^hBNl8<=@PN51fCq8wX~xUKcc zYR50G?RR`HFn2#BH_cg}ELo}I_YR>q20zvoVG1`>DT%hyIc3~RKfx9I|5NjDq!FdD6Ovkjl{j-8o@H34 zI<@bEsqo=QkfE{kxc$qk-3u}&wwwa^+3lRmDdB@r=H>^`efSc=@Q*YGoh#P%hpBo! zURhWe6*#=rhQd83YcEFM+1?x_K)pYK6v-izi3IvAM^>&PI-*rBW=i(!5^eW)77`t1 zE$Lk4Q;)r9;{$A$$$6t(;K1fbBb#2P;!Dp~63rp~Me~kK5BXw~cwfvZa$EmV zQR?lAyRT*uGe@||Q00*NgCB_fxfYP@_S%edK%{k^iZ$~zRpms%?~{9B9{>3;Mt^~~ zxfQQzh5KpgjC<|QMf(2dk+Nw{#pqE~l**^2T1&# zQ=L`z_h)6Z4Goht=9AJ|wQDB#RykSi@oE?4^vpCN#oJrw5f!N%AWyZgwD5cb>%tZM zdY3t08o&g+2#EgnBJ9+EfwZ%oFkCautZExY=TP9QmJh|kRJHy3b5w5Cq~>xi!3&Gg z4f|yDBO)QMP4r-XO|EYSHrwbDffgSllrAbn)QXlMi0WcPkvzba|~Hl zu|?w98)w(v%?^a{1QmFOs+tz9nwO{)!6xhy#%npxT# zv(E=QQ1yH-M?vj7YTorIx{Mi>0%gmf^wdi9Xp;%EJz*QmD4Uhe4bz5k)3>8~9^6d3 zKula2F8p@A;bAM}{8dL5qn)&lsxIG#H9-+=2~NfAS_Z3?@M}tMv{tY77_9bx(Ywiw$4JsWt z3_Is+zTs>+89hw9zHHnK^B*YBh9G&s6ow#+f^ras;2QJ>oL#3SR9(-A)^tchBwaX< zZ+PDnTvZoRi;s(2JD%G*)Oi6q`nTB;ai>7LcKR)(ubeM76ryv=$}2%hgn{BgKaZC_}K(FGNzk`~2fO<4Su#P(oNB-5Ev zbN%lKEDyg#8HB9&q$0(J%@aFQ=02U79Z7s^c?|Xmu5b z0#--)%+ryO6@RarNpxef9v<3cvv3DI+S1PgmO}*F&qP{FAl1rkiUkR|Ej^bxD5kS@ zm`2lMQ3pynlWXG#%V{W^OnU)G)A0UUQ|zaBdM}pfr{$`eN7ua3_lBMWy_0(KnfUCUL({C*WGSJgThy+au zu)D>m;;LA>tKTDwccv(fInH)EEfh*V9Db-SYh1VsTpVqWVNN5JK$)@+5SjCEAkrIU z^kE~?1#Oh0Oi&4s!f>4ZoqHoh?0X_`$YojttG?MbV&oAcllqwU_T*t7R~Yp#Xo4xekyUtZVo2jUR?@CzQi>9V@|O%8a}qP`Y0- zc1I@K2S{v6Di}-CVa>SQ&o_5F>+ZS7!5m56wRg)$DnN+%rxtR44?^`-3yDZTjl~N8 z-WKmnR9=vejfY%nlu904kf?_u2_7^^L7DGI=otcTSC65jvnXn4!n+?LSNeQPd%QwF zi$$<&wPdZ`hvZV{Y#0>0yM3?eW?Z#yNj)$vkg^|O*)>vQ2(e`G_o$SoiCl}+%(P0|wX zw9KBXvWvqJdmyPMvuO-QC#;=2;&*J$UurcVV0jzO|}B~ zY}WG7V!Aue z#9VgVYq$8A2@ej2b*tO}n16V{Jq9-_KYNSP5NnaM?3Jc+W#oUS!tjN6(t-#;lHa$@ zo!)O`z0t#(^x%woeVZzQaiA-Vh@a56(OW-Rx?8uwoifSNcR5fSM6y!DcX@bSs8;S> zHWiBjFOck*^OuVuK0?Bh;~!7K&NPwng|TNsBJkOA(jNei~cl%ip+Bj~gN7&wuEzpOukW!=5(l(}&;TUS}vxW!cu~c|X~;;EnI04Q#HIe-oeii7dVJ)B zO?&;i1N{dD*W~bR&li57K{3b2|-5SgXeVc zP%sj5f>01_qMo81?;Ct~rZ7S9NzsWw0- zy!I}k`l(F;hiywym?zboW@#WrJ>^O1L=cVeF#yr@eEU;a(j9vLhdp@(ze-qSWNc^H zZ#o=w&n|LR@#;GxO!9}PJd$tb2rLEhS3{|hRq0?Jwd=AUi33Bh%{tuekS%!=cle*a zf3jaW1vF>dS`zf>)`LpXr^Mw9kHVbj+&lIGfwQk>-2^15#axQIqa`EA*)zUoZ0P)k zNRh8j+{&40LPPkpno5u0W>886bS54l9A_sD*AL+q;$dmNZHFL_?X{NxZgQFK8t^Ky(t>{9sT&lqkMA5&`U|=#wqo-Ge+@S}jJ85_BZGjg3 z?7`kv6C!|{&RIt@J8nk7>&z&%{#~y+`T^b$hl4jgp`R2Z{heh(^^xQ=bIh9j@~x>G z;N(HGULH=OS*8&+{u7&A!QKDK`C}}URt?42y2mQ?$MZyf%QJkj?cT@(zC>+Tx;ov5D#F`}a9q;xHoRFp0s@v0?I!sN6jPGQM+EY-H7 zzurEi$wh_|J3toSzjsa!b7rzB4%YK_fqul%_Rq2@UD;Iwk8dL*kFzs=3aV^R7m(V4d?rF#n)^0FsJ+U)0 zAh>x9QTnUTJ(!$U9%vR@2-InKmngfab#}~e4<3IH9az+>{A5gd2++CkYZuA z#&d~j$*WIiGk@b{fX&sju;iW;#|eVF6=dbGubvh)+c)q(1DRMDkTG*7+vy`}j7N36 zd^H`lKq!)eI%=K#1cgd;^hXeRp#H3&ctF@diJ2+G&&+upCr0=i8$pgd0x2yMLgmbN zEx{jhFc$If;rxN6JT*bn{)^83fd5)vZOZ_`076UbDU>a@#SPc@<*-8pavJeJ>bZV# zl{m6>Eu0!l!K%09#Fhw}!R2Yr$|A(>%@FKtbeH5j2DWi62BoKi9RUWI1Ng>P(jp}tiR2gmLd0k}ALF)cH ziV36=ETZxiw}{^adwhQw5SK8Haa;%V!fu4hx^ToQ_b)$e=eay4RyQBa2IJERO9S z#YB>LTH%*5pNO2)XCDy>G{cIV+d=#BB*I4cnBhY&1O$AZ6f>ejOR60~A#(A^Z`Blg zXs%NlxG=iTd9~b#WB^$}dghoUvjZJ~A8-9Pa>Q`I@NvXdI8FR`q$H|aA_~XjJz0O_ zh~yr7!BFKTI>iwt`3K(fN^y}5R`3^IjL3VXkP(HcIYv_0O%&@#anl$+hi`t|W{fK% ze#Is#T~cAmNpgjF&ssEG>%>tBG5)JA0j=8}r${gnon#bYgn(a3ZfI;^%o#xui($hH zN@9FZVJj02xT2y13}?%iqK^w_*tTx-wVZ6S!^STTl%fipPEz1BeQrC_ES9Y~-1 zk=1mMVciVNybUoy)N@W#f65avbu1?Ag0vJ2?i;+^-9un|+DqYyk`dGQ_#+zDx9W&9 zzU>QwTu7gaHXtZv&4HyTj-sRad+QfvOgdJG<-RKZ8C!uFX;fTXN@h zYFe7y_@x`~VOD)1JT-4@oY_Q;yLzqK++<0_SAH%iLbNl=2)o+m-~27;;J5`d!TL(< zJ2N><>D-b+nk?BO!bIsqy-c7A$zLiqbT336F~!ImVt~R|7g^B_mPDQo4bLm#>e&42 zbc}_hC<1w2!|7yBk4e|@btkUv^97K^r|2GT5U4aTI79Z3lt>?>dl}!o22*%3g~~(n zhp9-w%dE<3!?)-58!WhQ&>WV(`l7tb@uW<`nJsT`dp7s8(-z3-Pi9&!D$RwQK$nu5 z(=Nay703`WGL1pCzX^!)@bs+k&;y%;oEMbOmMMuh**ZzAbb<(2OHjwAgPxkA+0ze=AAXE!GiR_~$Gp~I1Mlw;ry(;#T>d{wGcS99YGLjH~T zpTG=TvnMF8uPB#df?&vR4;8nhLDkTTJE78N;ki>^;T0eo_?D26rm&%G1-lvCbL@i( zR~>(Zitmu0n7x%p79cxxJjFafwZRlt#Gbd^hI>;M3VE}U2UpmBz+BXyxiw2KMSy`m NQeyI=<-!L3{|6)oqu2ld From 71f1eb49034846c34b23cff168e5cd4a20aef3d9 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 22 Apr 2016 16:15:36 +1000 Subject: [PATCH 064/439] update based on UI changes --- windows/keep-secure/images/alertsq.png | Bin 101134 -> 101134 bytes windows/keep-secure/images/alertsq2.png | Bin 0 -> 101134 bytes ...view-windows-advanced-threat-protection.md | 4 ++-- 3 files changed, 2 insertions(+), 2 deletions(-) create mode 100644 windows/keep-secure/images/alertsq2.png diff --git a/windows/keep-secure/images/alertsq.png b/windows/keep-secure/images/alertsq.png index dbc6a72a8eb0f22d17b0109d6858a2fbe6b02e83..a537983efe35912b0e997cefd6ad82c91fb430d3 100644 GIT binary patch delta 25 hcmeC1#@08DZGr3Jw4O diff --git a/windows/keep-secure/images/alertsq2.png b/windows/keep-secure/images/alertsq2.png new file mode 100644 index 0000000000000000000000000000000000000000..35f0a3836b783f2b10fa5c6fd707f59e577ed06e GIT binary patch literal 101134 zcmd43by!q;+cu2bzyefE5ZFqI2#Az`fJumeigXD`#{fgefCVZ7N;gP1k^>9_C<4;W zP(wEiAq*YwwRG?Me%`;I@A$rNj>GMC&5B=KabD+ju6h4hUW)1{-BAh(3Mv`t`%ft- z4&o^&{^~k>2#)Ao6aNl>9kG&DLsL*t|3Loi3*w}vhl7;1GI9?nhYp-QL~~$(4p;U2 z&;wQ5J9f6lC>x5@tOjW~blesW-8Vq%+n89{nxHHxXpdZChT}((|fc z+E8FC^8MiOVdSuiu8pOMr4dC1{e%}Bqx^HdosGT$1$poF?7yeoLs?iDSlUvoHUyW$ zu|vpd&rEF14JcCP+t?{6{-%(*f9IKF+MG6*5fTXK1_FA`0ptG z<<1hDbT@ffm^iUT>7vzmeSgEpilN1#K}&+%?M#1- zXV?ehqo7!PeE04vLDaw;>AKbXrJ&hr72o|+A2GwE-`^ttG3I2!|2da}Li}}t&_7>P z7->%Y_oT8+DL+O!LG#e>m6e_GQZ#7)g!W{Gh<2et*LZ*bQ=J_hj-@>Q0~D@p-aKU~ z=X6|K`*i=@$X1P@iT0TP%a_J1Lb3uAdAeQ7|1>>)x)-Cfw33q2)vH(A z3N89m%+JhHrX49y3~%&l5p>+~S>?OV4<0-)S(_*J;$5)v z(YL1C3jaF^i_14|JcZH0s%W;ekq#a_I32S)9dr8Jxnzd{Cn;7|)=bOF+rfVxK;hwS zvoRiGHuB^BW{CSnh@h-vU&%zc*~(aef+-v<+5T0pp&1fA@XzTKemlQH$~!(@;Ny2* znX)JPm6w;#;}*oV9Ef(C?J>IvF__KTY3G#{#2=84QxH@$UH}D2;e2zb@qe z&HYfYTK|0fSXfx5nnV}o7Iy}mCZiroOIwvRB>rOSQn9o(^U4!+W0z4EDZ^^?ZHR3Z zXw2^a=dw~}nCBYNA%?K(KIpbKJ=Gdd{aWK``@d^96g+@;;pF9QC6P+(W|K}bOHTEg zWe354SyI1zxntB6`Q*uy&oi^LL{k*ZR0OkKRJJuQie?;_`*&oP7ldsRzJLGT-U-k7b}`@;v@iG~XY4;`Ax!p%P&EOR58@?E?3h*`=vKSD|Y_0RPl^_%3` zXA=30nv9#H#q7mO>g($}Gc|;KE($+|aipcEqtk2FQl7*=d-^mE zmg!+!vO`2|V`EUKsgkLwDK0-IDvFpzinrtCuC!)i z2TaB1{bd$HL(i*aDuXo&;Cw%u*VfgU=J?2prFJ~g)6;vAqxwukgEPI;ROpKxm~mZQ z-3{89LPZOUOl;+{Nwv$J_SCerhiAPX96QIoV*l>X5-?o7b*rCb@z?(SAkHML6bM0X;{h;9B ztD>T~%GI8*^OMAzYZBXwujAt40)vB-e*OAoI4JvjS|Ofr>iEP&T7G^8$FT7SQ0 z)sG*JyfU?FWNNxsTprwk#QdTEOjyXt*0j} zjV2WpRU;donVFeYCPD~hS^l@%kCo|mB`vMYOZPmDr&_)|eE9I`)2IH2s4q^nW(!8i zX=+BoO7$j^#>QS`s^;AF=Qr!R26lK=L_}RiM&^T`-$D!erg`^QLme8eZ{Y%F4Q7O! zYdf3dc5sF>jEq^YUj2pgItRWV z;>}nedLcm#s-dU(FKSPnId_ip@4tuQdVBIs6eIFq%hto{+Ck)S$pp4Fi6B!7AL&%^fc|sHSkZsEtEyz4vT=1J$xV~WwtPYKYHZIQYy`D824?Xpz!dS z$KrXVrJ8DLYTU$^CON8+!PoiOsspV9KYwmDcWUeCc!mzk(MBt_i+cH3Sg@mlKJP#n zQhM^_OBkQgRbJjFNPL8q4hjuTfg@>gad&kv8;L4<%Le-o9dB70tzpP|%__sTQdgoWEX3%9UAIS+N!1=f9aLq0jQ&eQ#?})^x7cj8j-x z4Q6Ja$QnsiWGKqR$yvYsT2n`7(ER=3_*FYMH@sSQaY6Vu7(SS0Zu(MxzT2pub91tE;zDOsB}|3lRfnsQZv$MFKi*ilnFCy>~AtD$2s4?AlrHc8&KR?IOJE z*Z0rNxr%DQlZ1tPK3;;S`|k{SRF}Me|K2|#Q8px;_l1E$fhz65`SlKCLRfMPMt$GD zed;-SZ+|T>Yu$43xpCvhT$7B6NopmfkVBS2dS@D3_0azmEo~I$ysbUS(8x&Cbt<3X zQ|nEdrmS+=+MTt*Y){WaJ{S0^EitC1X%A&(8_{~2^>WQJ#>Oec;`Hon)M_N`=T#vg z!u&04$5w(#UqL}Zqjrd7U!e|TxJwjvwKvb8)Dq^?I5{YINMT?NHn&9p+-fFBMY|Pj zhTnSR{>H{eE!Y(kX8jAqglEs5b&RZCllkE5D~PRcXb5Ck&UsSE5B`q9V8VsbhTvJv zp~C1SCq{jJeO7^i0`mshhYxQMGBYzf+Y)6-P577?9j}_m&!4}5jTjgiMF_`%k=f05 z$w9>66J31k<;5u~+P6*ZBRN{*M_3%L6uYW}Gihgo$T0JblF7D+`VbXe!t!LZ=-8OZ zT@CW9H3KBU_w{vjbWGJSxj!q%?5JyDb;>cDOEpYNii)GFm=cEtZkdt>5|`UgnAYi& zC%-`az$NH8Iu=0~&9^71Bd%QOMT70*zI5r1|1(w9sWuGweFs1d(g0q=pWn3O3M(5M z#HPM^s=>m*x1T9yx-ugs8p7hil120B>FCnHv){gXlM)yAeGV_~xcD5-2ivLJ9yi!p zC4Kntp-taU%+MjjPi!@mh2z?_hAa|{;^2V;p%#V)1|~BdsrFkJ#9fO#sTq1la z%Cf=No*h+kg20QPCzfe^NlObvoJv(ym4AXZ z-noEI#SBTeXE>FA4i4)0ci!WLtGcC6wR_4+!UC&2!tbm+@g*^&v<;eE6X$QaIje zd7>xN1x*%X02*XbUTp+)+v@}stjh*1qE z`M9Q$(NVCXq`l4TJsW2W02IXS6DHdyZPwgq!1T33s`Q>nOTQzo-K{KjTINR$+%kCa zA~c4lm=Cv{t9nhuZ8N{!CThNG5q};qK==)V4*(jG(=yfal6ve28EWxyahD+tUV)r@ zDdfP~HMQLP-@bjDA!Nt2zu8z{8WphUpC3>B%429ibja4j+E3rWVGMnvv0< zTOrGQVSFa@tcs@fTgi{-b-VU6^6I^zqobQUCGDSY+ zF|A9NF4Z+ObRY@Z)L?RK>s{)b#WKfN8|+;p*E_Os9!E(7gUitbp)R3pcCtpBTPfJO8eE)?&66$_M9r zj~qY#?7@S#BO@boz9eM#R0;14sy|+!&N)CyIs1V#>#@0ch8B!z@K1E*(kyyBJUmP% z=A0k4C@&{xcjYZFdg75q_t)V#S?2Q&t8_78KDi8q<2Oys%t*mKP3W%Ryi-ht4r+ob zdWj~&XT7WR2xVZX06*`UoOBquK7U~TFqk9wj*UpQx>SUOds!D);?$HeGTW%8kGN)w zg@hQ0$-+%tfJgYTV>- zMIgWfjhBlMl<_B)CRxz;^@wZdzIaa*lyi}*sjA|DJia#Il07psGdCgu@Esr;Qss1} ztE8u-NGsf0dZU%mo+Out3%2OP60=FXMW=Lb-}Znt6fkPKh}2_{k}L~|D^AAF{h1bn z9aW6U?9IvPS@>0TEcSCkcG>1bI0NSP)Ydk?@)t}Bpkiuap|Xw}IY?^DigQ}btlhy< zu4jwqip$`yR@o{;Su(zL|gEMto`)^o@ zplj1@W|NgHOTWHG`55ucsi`UNw0oA@y7@a#9{49c3cH+2W|I4;Ju&YHNHtQM7M>5` zN4|ce$i}VkN0Gfsmgclo*+&}FCQB*xGS}i}0tafdGMHsq>J;;|*|tdU3XLQ>J2Oc_ zGa(t)GOKC0fJ?^C&W_qa<(aaw>3Cg`Kc-Aj!+Gy>LViBK%njKMX&uGK+_cZ9s1NVox4t<- z+b~&}lJc{(Ps8+)2jZMU{Z_BHx3^as_?oA7w-y|XYkt0mI5X`@Z`tzhBy$7PJ@^*N z$CLne1pvSek;3S?-XlkkwxubhH;n7o_;$kHAXSnvc!Tq7CbnT6Lf;)+e-#8R0ppgx zmzVrmW%JE@Za^^5ET1iPSx7y0A&R*|)qXWPv ze@xc0MaQxrH^0iw*-W#*Z`bP#&!3BXB9c%{rpo$ZJ=e{Pi}u%XU3#l^xqY4DD|k0V z*U%#d)03xoJfVhy@S6gNC0^nK*c=4twojMtH4Ky^;7?1Vnin93@J^yAghYTLpH|Sh z^Lp9`xU45PESex;Ms_**LO}>+PM^W^W^g$GLpR0TB}a-)n$ap*&B5mhmg?%^mEt}F z&3I?BO?Q?Fhp%kZ6YRj1jmrYT+_gV{KDM_ntgEkw0@xtrW-y)X@Ok_q8jX(X%EFG% zy&j%!PmbD^Zqsx+G1^2kN@(sHaR2zmw*7^@jZJQDUS4A~E0<4}=94GGR*kr=GD->x zk1P&;{%0^)t69+>Sz0)Lo3WpQepQ9{`sazbGbc{O7NaLc8u%WC-FT2^*qCd^%+6kO z&B&x)I+&i}#ZyH^q+WYZ%ifzQ1V}iq)bk5CQx@Tcp<$BN$k&3K{{H?V8PWETu0`cI zDgjvnJk;1)TM(M`p%ZwxHt1fyvBL^!DPGd&MuiqTF%#t5l7BFj~dG~+9*DJ{qJGEb;0AS&N)p7bKpvpERA^wS2kGu)y z(cw;A66q^OC%=0AS|h^&4;Cf1v(j!TisWme;Oj$FZD6;oGDs9gd~x0HqHr87yZqG8 z&&<>$YIqo8y3ww`WY9Y$B_d**Q}HDm6A=Q24d-#A8R_Zme9gDwfBuxlH92Nh5uRyk zYNlJPEes++U&MYcw3rB6-Vi;PRoxX_)1%y+%m>-T!OTq~Cnx79I2G_4DZRbwQKAm= zlTA?wOM!482O%l0_MsfiTyGoY6hCWsnO^Ur)v?IY+GJdl8Y@)=3qzn9eSSrugDwVB z2CPh@#92v{ai35?;d7Q4&GCmfa#I^4gvCn@I}Q+|+5Z zWSD&fb)A~zWhiNYM+q!1clWmYejF0Nq5mLKEyIZTW_cYBj23^*G#Pk?whMQyjlJ`_ zqow6JTcU;83l$ZW^pXHCY4|p@gH&ze1Q=%?k!t#{54iPu@@nGnf|@C%IMUUc?`iqAv4J2 zE9u}s7?)b^kGXHxWZ2~+Ke6~QimCfQd;GY?l)lE7ArHp}6iEtTFSos&wTaT)+#5v9 z7Ky76y*P9SR|C-1dFUmjExA(#>)c2NV^Gm{O5EsP-9pROoC3s(RAtvhZN}bZD5ry2 ziupDN6{=)wXMX>F7h!7>67DR-GdRLys0a|m9ud)}M~Ms8n{C^#_RvQlotBms$Pgpy*p~dYMF`oAKgNf?z3yyj zv62ZkP{rA226Jf`mg&Cn@-mz4%Jj#`zoRc_k@X!H`l#^(>TG`9?+1`d4$Q&i2&IbN zMveQnRAOS{^mKAe;TE%H$H&!!3#H4x0O=a`-S-g^Q^|^%nK1>w;}8(&%$y|wYoRUd zZq}7i%%XG7;u0HM^~J}X&r31$<$D<1m>q<$dloxjRa6Wj&yYF+02$mXU$5#Yg9N5j z%W?yqXf7vvmRr-9I=DCgP>84uLRSvyLFF5PomF}E%(ianm0@Fe=Zr%lumD&2`0})5 zF-51O(ESXkG**N!13EDI{NddE{Ad3BPy?a|Ae@nhy_mwsCB(NE@8Nt6su|{BPEm2# zHIIG!VSi&G>0P~k{V~9Ra6yZ3Z8x$K%Bw5mH6=~28;@XJ$N>P}fb4|=27rEn`^W8) zb@nirLyQ{funr|(CtS`StA201N#?v}4 zey)s-pTFbcV&`gM^`}oK7)0$GzF-UUp7MCY)1-Bfyjv=3 z??oH4)cP=PRa4@U9IoXnhbMCUi|m2R5M6l_NLPNZw=1Pk&T-JDo=dxYv_pDIgkGao z8Spv`=3=#BZ;rlKyM<3PQBt_8@IySSMcwjB|yGcMUr9MGtlrtb5>zXk&`%dl)kSA7Y=Qx% z00Uk%3d^LVtQ_3Vl3^`wA@MHX_7O086HKb3elKioZN2fz?d|Ol7-Az(Wj)-UEiI3I z7(@%Jx`_t;94#Gy2Tq?lrN>6rVt8;1!ad?xQ2s;miex)|4_L7uUs!g=dECKjWo;F! z(bhTPyB;lV=##*bU(YS#k%5Qbx$_d(;KJD z>_m91TsS`hz$aWZ%(9aoc%PN=KYLB}xlsAEz{0$j@;}TQ8Nm4r1Q$!HN5Wve%Ujt( zz>HjBWv!au(uAej5EcX49g0VJmy~1x_P{fJsqC)yp+^cAtg{UEtQ4$YkN!XySTG3~ zA>dgG%$R}X1wIC+8U(I#)}^+nwf0tpDXSFc_@Q&XE( z_9Ja>I)g2wIV=oVcCHEPF;8=)e*OCRss5{!;(f>K>*^YWC{^6$?4*F|R@-v`9|6-9 zpnMl0?pC7JbD$C-R3XeKCM2W)uZ{3l9!{`sy*P*LN}ei7e@^Hw!L0K%lvP!c1PLTZ zgqR8y0*w*w)eSlnR{z+l_s1OtPGxL>v3 ziTV(p5TJ9EGgNi8aWFy%L^jgDw9}y0)QeW|u8K=byNZ;n0F)mCwyiX4T;EsY$Ovp+ z0c0(&+4+~0jE@1qISl~HMk;q;+(QYz$x!$6yKUMolRrm9r0;C4)ejC14j;RR&Q1p8 z2kESjmF&Z02^^_@wU)N_{A$Iy=+Xsf^~Rd17uzI8JB}O)nKu;>*(%~&G;ooDMvJ_> zFGRf;1?mO`>H<*qG(xzC6lzGc)(_*oP)m5ZpAzv9`+EC@0n%f`MZFO#B_Iaw(Ib>1 z6o`EWiVy%BU-CsTx|r#^79@fv068ZK$+{IO0h^qf5Uh`&Y+yq2?Pis;LkxM(zkXT< zG)As^rZbqM0PrJdCn)0Pi$r~UGL^wz-8O+H8p`~{Dnlc-@(I9=-S)aQpOe{n zXg3v__l&HFP5{A228MbHIBUa&#XO^C$Yo8_xd4GnwDexo2Xl!y{Ys!_63-YJ(Su5> zsACmM(1uw@=(vPm*L@ZC#$Kq<_hys#5+vf;xt=`kOqWp~p&9qRHTQ_jVWK}I+MV@L zzmlbDdM))mIAIgqZ*O0M9^n?dISZlazC#Tz-YF)!+4cN9Z>D+YWf zZ?eA=-DL|A-fr{a3nL>97>ov+Y*?n7dj$5+;nX-B|F<;t5jIS z@JDE5d?1JdDj0>yMGg)3>BUxVz=>?w5 zNX&h=w9;YTq&>+=OfV@p*<}Gw*aQp87XdwkDlCqs`kEdV>B3%!85|6#;mR!=Q5Pg$ zH&fI{^(T(H;0mG!^K`If{+TM2IIQ>(D?q-Z$Bv3lA{vPKuFC)|DWVkq(O~@A z1n-C5O_wJX{R-4!5qOJp+?pv!+=s%fmOaMyyar`i6>+xu%!LaV5QZC}61%%qfyS9` z2;)PVp#VIJ8=?l5GEMwODMTIuNRM`&;ULcwZFYsAcLK%Ua*?JjI3qM&24>6>v$Evf zw?~-}Vny1Yd)XL8p?Q{;HXd4$4+W6HRXhOXr~=yv(I^f&p5fy(5T8~c_Fn<%fNmsr z#Tn@QbwEp_q3v%;8&M7p89=RFKi<=d%E{2i@})q1rL(t5P_9qYoTCxVVyi!P>{#O) z?EN-+V~6S?40^JOY{P;)$!c0wLBRp%$v^br560_jq!+PG35nY$QZDAQYP>k~&3?4e zsS*Mz!yz8FX{!AF`Uhr_^5p8(hky=-&ix}PS^o$vD=28L0=W>PgDF&y;X_ZSK?7rbQ3V_6`&M`L-dg61IT|0&XEj#qU`y-yk>E9r~(X<68aMeYy*Kp zU|`@F$?DI!9`-qy9cNN^PJHDW4m~NKsZ%~MeIukUVjV;nQlj#M=<4|Y=wqS=d-9CP zF?$;^{&bv7wr`px_B82*EIZ(66nApce>64vz_WD%-}OvKC;P{bANE87XkG$?f)YVB zlGaVkdz{V*4?ai7g;5NyO}I7MN^-3a1k;$u}cpDHB+ysVdm<>m%L+ z)PDp#vGp6<%gsvAkcS2?ClqzCIvWoP*7kM>_Y^HHvji=AJIsXxlK%Ug-Ub*VkWGm| zGEYal%p+Qev}iGxlFn)PjZ%}_WB!GD6KWY^ZK?l(2;P-a7oS{awgNSX0aD_*Y znp#Idk%JVOa6iU{kpC!&VznTifHorS-YVIfy64!R^`)R-@c7Ru6-J-_BbZq~EH2*zK_0Llm zFZ@?1^naySbb~Qe(vE-b8p{XQRxk@Mh$qj`+Od@WF|?LcSgxVZKcw8VKh6FXnDg8d zd+*OT6puojL@6jjlIrvY=-d|auC7m=k%_AjYI$J0FhK0PgpBBRgs{VWB=+8IQP`IX zeU`G9S?_7yMoEF53xEfn0U4&14EW@-{b6JFK%sqBPd@%wdn4*DmrDC*Mve@y5a)b; z{Nq?6$6&{L54`_JcVv4A_Bj6n^OBp&-1WDI)>iCq{<&=G)%l;NZbziuQjUL#6&og9 z|8uzILF<1-Q~wJS`bRL=Vhuz$fT%wc8Okj!y#@WHI|ycfd+eMo6oNBQ0(K?H1c3f+ zmbBP%7jFXb4{@JOJ~9QInv;tQ)@SbVzcag?3_v&L${$|MR@#vsA<03ma!&(msidu~ zO)2%R>Epi+=^<~>S7<>eYHyx*1XT%u3VA+E;>+vHm5IOIwrI?CrB!NX0FSF=kpW^f z3DQj#((3a!Y>v)^=ezK#Bcq(ZdgaPvz=*Q51E7ZK#iDdXrQXOML44CnW@fOwyeUf5 zNJyqlQ9&#bQbj801_r23z=gNHimirUfswG^{nx)MSV?u9*(>&kr|$pu^B4d)4Nut{ zFF+PiJ7oYGw#F=n%@q^BV8j-SZo+Voo~P`r`n9t}Xs?qlp5$gl-2ZmS4cn>5V%v+A z_N-4LJGaH5wXE$t&6-?G@)O^b7Im06UsHv9cx0K5{rn8ftlu+5#r6?rNW;A)cIj+# z;T?BA4?n$)3{2DC_oA?#(7Qy=*Gd>z5;_2+NJd5v^cSPaAPp4B=!13?e)0P;>h}xC z?fq>R@N0$No*>I(We8LubZ7{W-6P~&Aw8K5lsZ9&1^O-K$d=6AKmn0XG4y_SXDc1# zR+$#St`vZIDA&iFH>Vv$6a+oEh&PBQw3H!)D$vzPXAcnu&g0j#5gw#R4zMF430 zZA72{F`|+{DJHjPsM00R`dRw-3&QA$DaZkT0z-Zth(b)3MykT0a6&po$Ui~3r(R$h zRNMqwLji|*O~4CHE-&NSf16~pv+bK!xZKaShNt>V}E`f2Si-Gsog?+WK2vx(MV5d=`&7JI0IsC*%*Eff9{<*hf%G4(!r{`%N1goHX?a>gI9MiJ{lOhxF&d z|3&)XHcR)^v%C@Wk<@x;WfrFvToW9X5=eFv|-~HE=oHCL!?UBt!J|3^V=cgIy z`W1tzvN=%1dOF*CUq9^GtL`l=P5LK1xG=jy%AxbwX|y5@Mt_-eh{jKO{1bpFjGG>i zSLEf-XR}u zqcJl=-)3q(zkCx@T5N@;N9&sS?9)@C!n*m&*W{n{5Q08LuPj8*oxObyon>Bty+`pp z9=1sY3Fws-gLbeN%IQ)}Mt`v}8Q$WmCBMP4WD+%Fr_p?8to2iF zoNcgjiRoFm#X0-ghgxyw-dYhcn2#5G{4@EdWL5u-1mN1}wF3+)%`9@uy~iJx{$3fd z^B~7(11uB4mp;%5KF&K^YQ|QYH|V4+Y9A8DDj%L_kABH0{h>8*i8ow$j{&=;Wxev| z(7@`Ojho~zF8Q{*@!|gGWf!a|C`4{U#sPd`zP_>HBzge3`_!{r51pH1f-+_T?Cg)s zGvMlx3m$He#Ohp8vfi}|9p?r+TVG)dtX5CsN(Q5)bvlc9VDxpW*DK@igUH;93cLGz zBSb{~>LQMpTvDxa7d02+aqB#*bW!XJ)9#j3qpY0rhEaV4m*`Wc49PQ63dUoL^kO}D zMHkt+Gfs-38$~7@fk`>t+-B-oFS;dGu^RIkuJ0_i3aWesytwGK^UUH+ghM_aV1MO{W#{JmFy+0K8bp{^ZjSS!3zYF?Q0!J6U{8G}Jh4%no~9_TGJitlj&vlM<%f z>0H{G4V^Ke^$ML)1!iX2rn$xDD4Alx-DwB=`gl*OKo)dV`=HKam|Elbcnp_HMS)6K zy*|4{cA&}V+^If?Dr&xvX7$Car%66}qAL3c+KJlx2tVNw4-_^XV7u=-&1x5VyVR|R z779E4GlwDOTZ}(#X5I`=P1pF(O@JZC!85Mce;k|V?i?|4pZ!XT6Q&7$Kf0=?vDSCR zNslFHe-{4X87be0`T)aHJuK<_O2Nb)VQh?Js5gBsSmmOaF1C>w>~CN}1bJpE4KaQZ zL+Bw%?A7no)$XLve_)v4FI!R4c;+xs>baxuj@#+(x}vi^hbq7(^k=zxTSWddHV0DeC%6a6$l+#&JMw}znkG%#4_M=?xf=xP=%o;}R?!E#d?&;tD4GA{# z^Ew4!RQC8hi=b`7Nw2*=#(TuDW&7Dl_u@fwiBfkau$1AJ316bYj5RsPei_-}rGuI- zLEpF5OzfGEmHVDeEkFS}CxqQ|)UL(_VYKOv!jWCGkYY zey_A!U|^qx-iE!`i`QPwIJgj=c-x${(XlGhNG$gW47`txwJz5YK*Ez&utW60%52+-mz z9kes_u}tOFCFZ-z!17_!$HmOP;gIp6ojSh0w71|VmI*)*umjkd=YwY*wvMcc{7dc=)#~B;-QSPb7PZ1*m(o2-oIHyXCfIx zn-OiPSwi+ZdJHe$K51CeVJ52o?RerN`sBU!b+p(z3guj)L80}tIJfiPI+7yf1O%`1 zr$m$U zq(D@8Kt-Pd5tRQ=vP&76I$}_Ut-7|fk0L8J`JV;sZ)KA~RetYLSZa2hC?lw*K=Gq5XfWX0r~%?x*kw*0k$X zYUCCLvXWBrPl4(oyHD)DFVc+WzTDYz6#Y|i!5DiF{EsjH=UX=a0U;FYAL~mQ;DwQy zwDhcB0BnALre6F%13v!0D2$650(_F>=;Hf{1|qve6Y@0i-ctN!?yK)Q>Fu>TR{u;8 zU>_qJK1QKf;i-PE2>&7qGmF<9oskDW6l*dMEUR<-u6=ssqpZER&PcJCddjPJ7jP3kT~aW0un z@|$A&<#UPI?e4DI8xPh#Qi>d79*)A{p4D>52Et!vZIdYq3ycHQ|6nhzKq)c&p!2l# zjuVOc3}j-6)>^hB8#+4c0UEP|w-U;Cow}F=SZ>`{kf$fiY__xcEMags9+JbBUq{4D!q%@7Cg&XZD&oa-*)lp zrbP3mK5pfc6hSv)QBYfYazUNR4HkFrIZrP}-@vh0xBp@@ zhk1pmz;a7@0 z_ht?)ueUvApWR8^lXSCoY*72&cY6ftH43XcMm!g6QiJuN4g|}y2*`|aRZdV4=QPdp zP+v}e>4xm)#Hibr-xO?Zgxn1USe_kZnepMr%0Ks-Nb?E z=x{-kk6H5rjq{P^yUBj!-8Of{F*#lC0_&}xhj*4UB*Oi`6coRcJ{zLY6%1UgrBp0s ze*pUs7r-=p?G+2X?%ceuRdhWn4hx3C961H3y_3s(gE8qSyK+gc`PZT$1u`_#?MBVG zd~IWC9<6qK1ogb;L@Vawk9AnN#(2^`jVzY`abGI9FE%qeTS&#Si#_IyNxud2N=N09 zb7$V98;HQt$l63#Sfmnip9E~_Wej|kO&6ML)8G-yf+wZsZU(j&t*Jbded^7s0^7k+ zzUWcEWofD7&%atY%w2GYgEs%IQg*W~$FRlqE)DYLqY$0RKMq|{wRmOPZM`o*L}?4p zGX0FSW^W+TtN3W_IjLW9;<5S*i;4CR?=Q~TMl3XUayqZaddoZ0?~>n2gxP(IVlDLf z#i7W)T|F(1m~@nw3W{yNLX6nLV_JNTfJ)e2c82(Pi!4zY_8(aR;w^m;U^AwUv)md= z^NOyu!qu#T8PBxiq(mS50~or0hXGr`LxJWf@F@;(f@qf=H!lOp_W=+KF6!0t+=@-5 z#ps8uxXmWkkS7a7)jw`+p~*Atv+B!By$#7hk-0xC8RAtO6v20GAsBgmWBcuK;y3Ps z7YR+OeW00H{e05U6`ZoQ@!n=StY1Pk;{WJ~bL<{2v7iff&lGu*y$vPz93WKwZH zPu5vflrdHyI{3<$eB_-~_=wc8DzDwJl5whIs{shyy6b#?0-@?GNp=SPXY=glFZX;Dw-(bf_(DU*Y zC%$CSY7Lr^qsQYDtH1GTW%?YqRf?t_`49uNh{@_)&(&+!R_w3bu18XhYZPg)q-l3; z^y!B)2x6O=-m#f*9-p_I<1pVoM&QqsqK>s_4CTFd&x=|K+8Vfw!LWY!y&Xilh7baz z$G_KuLWIiCf1t47i=Vqg_`Xy7Y_Fy(XFdhxxSqZ~p5Y-5HJVSFUP*CvnW6a9dpo6O_2+?i;3R+Kq_N(c9f3Y*rN1z9s zdqNKj552wiP+tAh7cQjo>Q`Uk;%dw?e`sx;bD5brf-BKKIJnDvWT$|jtq9W3K5I1~ z!raz~{&aq5cn6}l$U44{B>hxQ&Igt(=+mcI&>KFGl$=RTj<#`bf@6*0#BBU(xRW*z zOGcI&@Mfk`x^kGGQA6l(i)6bSJm2ZGC~$Ql>x(t?c2A`&|$UR-FAXbbNeG38YXegJ9qAE&gC^n z76!z`44OyH0-Xh~z~RoQz$g(8OLU>MJyOVKOnQ8B64&Y5+6By+-BimZMA;8F+=MrE zPMv2#w(dK!mx2S6SiRq7=}>Aru+XN#0nGav0#ny1<;lik@S$ zK}I?Qgr{W;edK~!5=QSf!%4?SJoFYOD) zpweJT!%uzolSlqY`?nQ#{#fshDylr%!j9;$>#R(`YqsutvOzt% zZ7+%VTq(He>=!S_Hc;D!XW}h5fjGU?3^Krv(WJ^tBBGTA&Tu@m04n zAM|&)4LO%E9I)roAUt0wDnow2AbfKxHW-5eCG67&Zv#jPx zxOA3?!>Z_;%3{hzV~3}uE=~;Q_dClxf>8m`O#>Xx6CGI4FdZ)oG z8Du&f92^X}gT5ncxc!^k5uVh<FY0Mmq4hu_#_bwp$R9-yo1`<{EQb%iVgGcZ)0w#qIE=O1@9Y z&85;#?h(?D%=-#%?C6U)?Yb9?&mN-6gd=)6oeevKn} z1ZhQVYGy+T;^Dizc880qd=I~}z1+s&AZ;0lH#38W!1Cl6HiYU5r4$b%hDMJn{Q{B% z8J~hMKFAQwZ=r$I2?up8BjDw}2+NYxs^%i^b3Dr6e#IC_J7>AnUknr*yUq`kxw&{d z*p`?MGl-G9J!#c#jg}L)7&oTgD4!M#Ry^M|xtDUYpd1|3xSnvXAwdZ&4Zk(67Ud}3 z-!JLE>$+g)Jeh5TTx#f2h&Qru87mW;7Qq*+eSGMHUw<`fX?b)uziZ)nsm@l za*~5Yc=ht-yYQ0{$;z4P23bb^@3-Jb8g4R-*3uR>XIc}t_vVOhwi=yLLYpY{DcXvc zFW#~|y-~_?fVVbpJ5Dp;fyv{SO2SX$JmtMk{%Fo+Ru2q&aV!7boeLtNqC%e6uV`V^ z)502lTvy5{&}_-ie@uBHozr9JMt`igo)PiIr{$+VPt;O7osy0XqZBE2FLE)8iAS%D zgmed&#}t$Xvob{G*)@ry%JFLprI<0k{<38^HOe1mIZ>jk(bc|Kg)>y1z2}UL3YpWVPoH0w3WDdmKS67TF9}hO-=HuSR}4{_QWYHNZjX4EMAh2oNXXK9&~BbmIo+`PnAu47xQXSb2VURVa930exM(nKDw4P+r9s)~2e=9(nw2-7c!e?4zzndZMRyMMs2 z_@ivC^>GRZ6`l8)O-?t-xV@_;o2^e><_QEs$WBGwz<~C;t9Va$Yg=2~1t*ORUqFA2 zZl9Vb@4356mlD<5oNVl_!z| zt1^kJG%>`WrxYnF`k1zY;+@HL%8nvK5iOu}Q=k~SqVsj~4oiBy~71LJA=*NG3lYH&fkGt~?=N#86(Kq+j z>c1}cDOcKTyY8`j3eVF-Z4a(*>?%}eWRwf9aCG%QV^xeeT`#x09_=@_;Jks)D_S#R zGS&88nDKieT5eHQeJ(eAuz2ZhMiO`7YP5&@xOr*el8CCI)+=N=Y459Gqe`xkRSi!s z3T}xR&K6xf?o8X7pKI7i*Kglvaro`sr1oc^!i#e0HO%{_moo(D@Ea&?Kh=+a1uf== z6UZ>lcNCJ_4JMa&0r_*d_@29339o^)5{X*27nup zIo6_=6NtaI<8YtuZZ?7Qb=2h{aph=ypK18Si?#BYD&@(y+CveRVa%_Iri(XRCXQtk zr#?KylV?WsLgP?&48AYzNHEjhn0Id7=C|qQ<+>g)MyAN!(lMuXm8LRd z;m>4Ye7(hi3l}fmXF0|D2z7Zv=Ur#`V7h~q)rktLdmoCj>C->&uVAuKY%aOa=RD-@ zd=`3&1Eo9P7ATGj`MM@!1R)eex)MuA()@$lyROq9rhZ6B!$skF)%UQkT03Wi8zDB_ zgIJX7uuKTis3#8Q9?V%to!x+t)%8d}%CA>?~-P>*WQNR1Ld81iQ^Q_;K-Jm>yn#<3NCb3^3NU04r zykp#n`z$F|cDmOW&AoMMetPrq@<8*N`zv>%`yts$Ox2i1qOLP-c;J8wnTfsRFtbfN zLj?T&>=h-WBL#HanUKzZWitv#5-f!upb3w)^J5Ey;+cHS}E+3;YTs0dU`d&c_CKM<@oV23A=TL-7$s5<(R$F=colx*9k9(EmhRPejU@H9n?OR>V=L}pKg?cUj2ES@-{ zatYGS!0wR4dY605ThulDUkkg#o!sNX2&i0kwZK`o+VqN@3>hamzD3#!N4qNOQ8E z#R8bD^0zOYnAZ{3m>5-l9UGTyFAPEKYP*7}k(U3tH~A18!piRMn1N}%Rnfk@f9ch3 z!Da*-^Nus4NvsN$tDj1R%W%+WyGoB~n>XfG@EVylq&}a0^Yqp4#7>ow<}@Q+l7gR) zS_M4?w-ZWX*emp;+`9{kdC5X+$*KBKwyxKgZ_8Fv3TLV2`~?J$-*_K6|&yyhY1wY!4Z9JMSL0~>gi7|c4?r_$XQ%| zcbdI?dz>c+l#%Vz_lG1-9DZ(Wd>HXrQ24)uYW#Q7K;F@Lk=Nt@7by+iYp}JqkNfgv zpI`)4?Tb^?Ui(2Hdg~A+<*=>Du+>egksn7&H)qlvArgFrDm*v%4*w0M3Nm5;{{594 z@^!NRhqSkVt9tvsMX@kwR9a9#N~BvtY3WizN?KaFL69yvbPLEP6e*Do4Nu<>Yo zf8lWYH6O*Mi(rz2@7mg0$xUf>bz(Ad@;OuC^ukForc?#`i*GQfqk=rxGRA$cU>V^< zFNlTPVaQdB{0r^HyQ^c*j~YY>zIS2)t}foyv555O+AjsAEZ;gdQk(5p z0xtB}Z6s=M8*HCuDtj>hzSr@m-yFq*imynN_8sI5x^o!LkR zxGXEi*8i}#hL04_Qoelg0>%gmOFK7OM@PqSpZw&3=}d8x|M(%srvAZQ^tzs-xfSSk zU&RNOu^Z?dA^OiuHS`=7ve_H(sj7QDOD^fKh;=%C&c)FHp- zLX)2sy~>M5LBYBOnogVJ_<>iQZY+Vi9R{0r_m-@F5($9Jb zK&A|5I5@k=()1}K3qPvl`wtjY2IIHm!!U_~-mAN*-Oyu^KOU&^0~cKPyBnbhdAMoYv$|!`?=(XNgmbrBNU{Q-#C?Q?A;LRT{^icd_Z1n`=hk5%$THCN(KRp6 z&r4qlsgC4Sk%OkU6FS|QJNdl5N~CVR(o(t97F`>nkX=GZAa63`DmYe4zUktFL++!D z?Huc}N>7~`MH0Oug{x6pPQXC zTkk6?UBy%1epiKLhyoI{KelTW@53i!<2m8Q{W?@(>Ah6j_mjLhhnIkW;8_jDK0%pWi!*BHJtPIyolg zA+v#iC(pi!{weleDkcT)5w}uOg7YjNpZ0d70iWxx=^BF@l>&ekiif z8{el+LLmCK9GGHbgM#QH^Bm3+WZ*&SzL#*RC~GDzoUKjJRo(jg4dD>G4)4n5Ygap8 zqU;ur_x=5;=x;34`@4Ug?(b6$Q6_k@0ZsFUU`&IqI(LNK0oN^ZSn9jZa9h5j%p%af zJ5>a)=9oq48Fw#y9{P)n$ME~?84Wdc(w|J!iw_Sy>VjD={∋@AB_MuDgK&#&rz* z8~$_^wErHHIF~XL-69S~l=S5nUoF3Zb>lLE?3#_E3#$Y05hI5V*cl z1#8exi2;8dc`hyW>9pE0`ZEofm=T;}GXaY@#~trD_W_{0vbX z{)8TSt__=C6$D^V5${@k!Hm+Q5^e{Dum=gK zlVdKdqu&{Rx{T3JISu!oD*zz6U*3O>0A;kf3hj$cEfOKgN>K{R4uu6!XhEzKO?P|BpL4d(aues zYng)PhE38R7uUypS`5#Q{ z!9Q=L?Ei6bm+rp|(^|IQ)BEp7Zu|WX3x8jZd=elt)O8Xz4O!7ZW%x~|}k@fGdXV{pve?<=T zXXP6FkHj{t=)9?O`R~Jo8Rv_}yZ-(9@8_5>{`bH)Ba@+v#_$oReuEzQ zFuq%p=Yg)`vzxt^qCk()FlDPfzyWtJ{PMpSslNw|?*ag!B^b6Of|N3W+v52+7udgk zgX|-!V-75Xe2_q7O%s2)JY`Gb=jUf;VUfI;iT^AG2##s65V$X24YoT!pp!C1mWwAT zO$67bli9;w^Q?Fyuq}GA5l#YrS|u5ZQ78!@7Kw4L?DSj^Ntm*_Hi$r{PduqR@M{ZjgE*`V^6agIAI} z>Ga$MDQE5YF&?v#yhW}IdQ8l0HJF!~w|`F0X*PJ`>|8!2&~qN3#$;S!d5U5`zJr?3 zG`oY9D2Evy9-eeCus3;d9Ho$R0Rw{7!-o$Ma}`6@HCvK!7xEz*{IJ^GmJ2>^Abk}HM!+S0c=}9LdgS~8>hw&Rs>N(qTqq-thA1>6 zC+BLOnhd5}vlj_&Al&j<(M-Ik zv$l@gX*DTDAg{pFhw8mWn2BWDRy4W|id&ad@?x-;LzbG4qoj>g?(ASbaElw=Yq3OS!ds2gywueM#ide!(8pjHHu z%OI6wFNEFmbaiEgd}n1=jp-TJ+hK#VrFIK-!hZ9XdrjPkO05;Y6WC$-;GJk8HvaJZ;h;b z)$3uJ4LVX=FAs=pz1Z8(3-ifsoa*`ILQc9OiMPia$2oyMcoOXP_rCBp@AN$_EIv+s zB^dq5tdvp6IyN>IjiA?KxFxEt9>02re)$vlbL3R_6GF45wDN5D~a4olsy=ro3W6dFg=;b<|^f`%;fFfLYSg zC@~s^bfKws*0i&;Q<|30bw{bY9!gEH5TJA)^sItL(ES7!EN8c9PuUMQ za;i)^!;u0v(Acwk&aOzSAi$V{f+D7}=*^UV-EdXPwalFILuex+hqlAF5fQlHZ+9Jj zZG`^C&CN!uvvLM|X zTHA8znV7H{@ew^rN=hp7K0ga)!IU@bbtjspUtyNWIsO=L=dz#LuTj22@^eif0AQ-c zj3U%A3AcEPAm`?CpRjuk#399}? zz28DF3(5prE)>r{#?}%dNK4n&4~~^zy!g08nuD1&koF2DQ~!+guJ}!%TBZVpK_oJ( zwpQotyPeir>9D0PUUl$$Os+7JE8*h$rW}Od9%KdJ5%}~W#d7+C>*|C%-C^#w&eVg@q1QF6>{uV_Wrya5cxpTk(Dyi;$rg6f}SeO_nO_Y zF4#3gCBw|n`#);|?ayR#Wg5&d*{&?mt7wqiVHLNnB#ENFM1p&HC6WLPCK|viq4x+I z7nhnaxb;0kGnI^jV&Jm!g`GY8$d+F4#&8(+Pw0FU-*GQhp<_GWu^P;iO3%N~yzX>L zwge9>x{hRNT3c`~qj=OBe!=9?hNm?0e9u^ajlY zcg%^>5|Zxir*<`&QS}DhHR2#0CSh6rT6a%1h4a*_{+9v@)0jP7n$}l|;lps@paP9~ z<13EDnDA;790UrN-lQWZZ>{-~>1JPm1^Qo4yigz&-Ff_c*)=wi~odw#63`9n`H~mQOr0kgb)zIk5*2 z3zlGMT7W?nbdopfdZH+0mpQ_6cUCqwkRFKocb!HYNt79=ZBm_GGEchp1ce;*a&~g! zRX;zkR9iGys9GGR;-+6?u=kG^z$ky>_AC7`micf9EwC_ib8~N(HBOQADru#6n+`Qf z?xqbMFh5^O^r~J)mgdr!D{4QkwtfMNW@s~9`PpzcK8mgvXE2#$@?RL}d|VNo*ikQV zUKVVAxA6GxU2jvCcrimmXrE9V-`=f#G1z;_dmQHRHyp0kP#O;=Shso_n>TEjU@8{fnM^2f-Aj=ty4WXff_(sn)Wxyu9su zxa2?vY}n1+#igaFTH?Wp2VU`257m~#%X)<^dHxWsS7_$B-SkCrba2kDZ9ID!6(&yY zTAN&}%L) zz}Z2Z9WJN9Icb3fjXB1%`pAzhEXwtR+hI~NpJWWnM`7`pv)J?IeDnA&D^-bBx(sQo zF;`?1a6+km`;oGSge7Q3puZWY9!6WTmj$j-``+S*V)*KJyK ziIyVx>Q^fp5jtsRx*H|^zN(5$w-Ct|sZUGzL{;^sO5Uws*5x&%eG3U(%Y#J0;zorU zufN&EICCV*ncJy+pV_MMNg+}A6xaPpDmqDzGgfA9&)mw=GG>mjk{`lIjlO)g$~Im1 z%vLLwx+hBy%&nuuLu+SeUf?EE>eGa;=Jkeub|Xku$dO%-%G33@#4yxY)Z^q_seSG8 zMZ-Vb8Z8&UE=th3g_M8&YHr7#Pkge>Bb}{+;8$;Ed&#Z?8?$CjAe1a{cBsjpR{)W~{VG`VxMebH^pMY|tA6FD-HuX(V{=B%9lNI)QjlK0{p9|V1E zMWyTJqK=iIc5^q=%j7Q)r+UWjgau%{g_lMR?9y|EirXtOUgl|scO1KUviM{lo3mm zv_5DA5eGVkZ_tJ4P1MT-b4rW zAKhnWR-h$JfYGO?zr14+Vt1Xo;=Wh3#^+v%%te111mN@A2({hEY8^T>F0QH0r*d`pq-jvTM0=pSeE7B z2tc8kq6pdo58?D*3a6*1N#8G@x)Hwd*wf(P<1<+Ei3on zZ{Y;8%I3yyOP=VSrXEX1Pp5a@0$bKjdT$lcfMM2%t?CVeA^aUG`Fwwwm*7gY@+4hB zoQpc-eVKAQBYVmFp?&;sdRc2^kcDQwZ8s>My(1gm7Zvs$*pBV41rr=QC~u7KkY6c7 z9s!Ecp|J9yejOxJWXk;CUjR-8c8ft^XJP>6ix@uOpVfLGL;CHdr1uZP+Ok2n9Lz!c z%9Q!TPr@Hca&qW5P_LL(kZJ;_e$0cOw8@?AD_UDQX;OPQCU@@K36jhT$P)Aiu?T-j zY0r@)RTxt5Q8M>eNPqf0mBT327Wg&$d*p9}0ImskfC&N!FlX@#Aai(>9-H4@uhm*0 zmX2m}OS@w7WIiVy8Dlh*m9jQ3O^_apQ)2CWtP5M2*Jg@;a3)@8&oS>HuvMCVDrb)) z@)I4KIWoHSKz<^-T#K1-RaFu-NzKjeJ1mhbTx8_1&DLI+2e-T(Ya}UFGreBr;b>1! zPf*&QmT|JX2Ev5T8_`~DlY0lpYyO#m!za7>H^nL?__6lbnEkJP-90$Sf=Gs0+hmc^QtgUdxiN%>=TB~t~)Xa?zl##^)LO9 zt$q1Lk1qPDI5h#O%QIDRFpo?^9D!v5ZS>O*{jW3^26siF{12#o*vu|Q!3v)}z2)*W zd~&(Ou$Tlg_9=eVRbq2%{bCyk^YW(=l367ulCP#h2;OK#N$GjM%huBEEqWNCj6$VJ z)6z9_GVj8TC;}*j`NdakfcY+Bplc#@ zyrqn6`NEziV+f-k`B@TKN3msk~>Y@3TPy; zmKQn%IP6&Bu|VXEkGA@{?Dx&r8x*#eDcu$`u9JJR*PHY8oUZtp8YymQt;qd=6d*}^ z%*3@?YC5^YWC}tfXX?|$`L5JZutg$o=U@?z8plH31v#`Fr%yjJgLe9ov=blPj?u{#3T3T8?eSOq61L0p& zqg0mTdP`sk;Dq+XPaq#OH1A04v3~)XFly8cAAuygi+s7h4=@N``5;Rn`P9=qx4+OrC`v$f zfVWglQ7r+v(hR3yOcOY|7PkTt7)3TL{onx7*j!mucUad;>cJ>4%5VDkx`o6LbdtVn zIXZ~lL%Al!PMDOwQpw0W)`lodC!v*x{xs0 zw8qstFtY(#ceJVr#0l5Hq9=jZM)!>k5psAqG2UAALpZ^J6?0cZleGMtc6 zY6)Zk%VtlAAy>`>&Itel}zxm|$sr++3 z3KqtO;hr9!@82c4xVT!ADWhhbXvHHRu?r4-3e1KIm5Z#?UFqH3_Do%EaJ_8DKs%&#@ttbMMpSO?VU zAo*dhs)D!J-JhjopP)_p1iSSUPJQ$Va}gMak=$g0W7N}l8SZZ5f*VA(dKDe)t@-asBWyDp<1)u`jM+7~mA4aOPbO2+nTD}Px#>z-Ma#k=GYulqy! z(J-@R=B6GrZZdr#lNvv-yZXV~#;KZ(OT=zQ;PuzIu#<>LV|ZQ;@=fSlN^|a~UamRg zy|uDLM@ho897FOw-3XS6T>l2Ri8Uic>e3eVGU`e9ZVp?^IqhLoyF4dr!^g zW0Ys-!p`ka_NY@5w)Mmn2Z0^RK1QiwzJr+O>6}hsqE3C@M)E_& zuQs+*~heTbD$dy6h(ZRl8<`{+#LsuX)~i-ZMsEbxW*D~NYme%o-Vg)5SjML(nUj+ zV91k_hM?>vcl^Yrh_KlG*yPm1HVjPW( zt{t9v61%0|5pudnPUT6rQJqO46`9(w#F>7v0{;W?H^+^U7Z?~57As9}#Hgsh7z?d- z6vpo;yQd!4I=3!euwr%OekO}*u#p-hc`U9Ps;Ow4MA_6>Dw!mi^KMD2yh-fA10j5D z?Zr;LrTS+d>|Wk=I(e;wrqZIKxGjE8o*Zqh1?ogSvB9X=iJNnMvqXH8k%DjcW!p}I z{orjrVTTdhv-)YIvO4sWyQvd5IV&$sGf+c?WY=cP;aY`4??i8YmZr% zt9vwreA&grv#_zD>c{AJD16b+c%Ie!Zbqibqlg#}$&IGtan#V>wV&hGEq@-BzFwYDoHI2~+sl@%tvDsKof-ANpsG z!C>3dOxG(57W+cAmjZ>~+BZhS)xGTDo!>c8wbg5iKYGfuUSsS^TK_LK39GDOkNYh` zoAp5FwTDTQy9b`uAMj3yuHt$I!CN%-8q#liroZqygQ3B;kpJLDm%7Ks2IZk@=P`_= z3)mvqs-7*&|7r-b4ZK2EMe^Ee~&V^@2_wmPHa#$3}eP6=e%hC zLX5c4YOT<@QlEoqU0KuSsb;+ZM_lv2WbxC8C3%(-DV{O^X57*Ow4ViPHFWv2 zKo}m5Scq(V!HG4Y9p}9YED|lMMgv`(~Hz#=9%9~l>x*V_F|1{GXjyAgfRyx ztd~g7)rygAO$c=+Y6rW@k{qlABhf}s1l#lj~U4U;q z`LQbapzG$e;ux_+DjP~JJ6*xM3s9bI&a9o1mYKE()m~{(P&(XM^!6Jr3B7ZvnPacM zv`2twz&@eZZS(ka`?Sr@8vh@9oCMnd^v|$GQtR<(mE!~7Z+C$cwFRAOgo|dT!t#oA z#-3_BiWmw)BO8Z4*d__k*X=^s{P0I%v}&GOuMbpqY5T|pRrKaQ#nxj2f@g;_SI&Vo zSGTi0L0;|FANy>G=Iv&*QBg-0E!vnhExpif9S&>y4d~=KsCbATGMUs+hGC6c%G3Xc zn9Y___?wtr?o6yw7$E2LeE0bLthr*zk&glnqiEO?(I4iR6^J75NZf$lQvz&ED3>v? zuQJh5YfOxcm{(XeedWeNEw0EqJ0Bz*yeG?3Vt5O<0;FLW6-88`cf->rHh8fG77qfA zI2b3AWe;lDTod0wHM#xE&O=_X`b$Je8DF+?#i&Po-%&^2kvC+mt&u@;;0`g&ftNK-N)< zSXfy#Pfou7Bm&Zb-I2$iR1vz2@<0OY160%7{GQPS1WmvNF&>uN&9(nAKe&7HdKcFt z1Yj$Hu53gbx^o?L6f*)$KEH41^cLTz=MUWP%W;~Fj=^*Qu<<6Xl8x?Q@~#?FcI6Qv z@7y$^yl+{}(^Ci#{5hLX1qBa}ssYPk9bzK@4!Ebk-w@?W9o6d23hMJzg-Fw4Nx92c z!^nVsB1fmyLQo$quB`OeKtEKVHcQTR9>A#@!AVIhuO$w-A_12QI|hIo00cUPA^W9& z_V@;g@Mn_2S{K0x1OjoLA*xt(h0Mo9NPU`p(?FJ%5Up$|9Gp>CRE$JebMf+$|GZb$ zJ3M9E0Lq5793CT}Ztlf*kj9CnqKn7=V8g70NWOUxd$k|ss4)IW7ZI^Z10QV-0L`Pg zG2n4?-&{a_IoQlghq=NhoT~4@UoiswhRwxvnPNFCeOSLlKxu|uv|z`NX6ra`adFMv zsH(@T`yKfS#1(C}%ArRVjUfRRF!bfsO<)59tVX|1!CoYkuN5}{1sgU~($RT15!q}2 z1ijrOXaRH84Q@67`q{2}vD?txFS}*tiMMzCt4lX-=R|x~ItZ7eqakl>HpB50L-3iR zPQ6@DdUzQ^kD%;&D|$~p(z|s01f&W)>v0@}k5f%E2<~$6i*INKrGI+hwRWz~I=8v{ zD5uyO$^L275xbz49_ZT~*8;+gLiklgF6~FMdhrIgkhgZ-LF4RG{;|@Hl<#`AF^zc9 z^mAWOl*`K{-kzIsnk#Wl@LzvE(#1^6#BTKscp7c z=p_^?kh$M^CQ9(>V0Tu0514NBrsx_zCWxt!`qE-{pvX%SLu2wxge6|Xw|glw9u)j^OYe! zcf#EDJI(!{YB8NA&`UwD_kx+IUq2tzSUkxO`RaiT1?+Z6n$EYQ8Nk$GpG3e5$-aZI z#0NH+$=vz7*Q|!9M==NUf1*Zc^L$=k2zxnMM3e%{RyszP44wyV+jNB2(K-Y`>-#Cr zJB&+*jcBAZlwICD#=sLfVZ(S|TB>@6XGZ=S;91d(cb4MzmD)k#)LG+o{ZId)V@daV z|Dt0J14$(EB0j@P5s*r>i__k)xu^i4RB9hWOk$wU8e2vh9t0@>Q*fkYAWZD;?ahT3 zNz+9qp?b&1g&8GZ_qNu$Ok(Sf*y5o7p-L7u8)wh^YKSh(gPa8CynWc^RU$ z8>YckeZEN{_xbp_gU{-22|;JC^#9QUIIjvloVfaqn3;H7WRD+XG8+du`FXB%b0n&J z)>OWmszs;6bP679sJG)0*jMO^dDxHhdv?$gURP6BZ(P|U!_5Qa$;{kblqnVj;F4Tq zSKf*I`kAZ#f|f9<)&K@J~Q;q3R;jz6 z1fzcS_A2jIfGC4YXh}j}X3VtNivTwenr~ncy^q`ig=Abg)gy|CnzTxT7a?;YlJ7x} zG^|A9YiNQa42y7F8|ab9HBQ5G`1cfuBk8;of)41IJKfD`WEk^W!{*rut*orB z6kd_Z-oN-PG8w3OF5{4VKp0a~Q@6{iC}FFJ*}ZqtcpuhR47~T;YI6$;V&{NkWKD3g z%!FwP+!Qpsz66tB44>vu;;j7q8-N36QHGZR(N`02lU+c(J{Qw$H_Zl#F)NNGzhz86^w}7?r-H>r`y1|l_I_qAg$WSUs}pvujpbZ|(pNrHm=1eG zVAYYy9|+=4d9h&NiaR32sqLuL?h{_`d@YUUYZ0HTDJ3e&*<(>{2IK6Eyrs}r6MRu%Z<@0Un9{88i_l9 zJU}ZL?`31!h_gx5Heg};C8gCaFTmBm>7g7rDFB0Gs#3BxY+ySW4VHGW!nnJ`un4udmqj-Lc(X^Ra%!*MY`wC65qiU z`LcLzysys}LVJ$NffvO>t2>*-O%RHdeNg}_P-W>?kLnls|62p+vr}*^Y zZP~mR4Yqic@g1>9KVC?Ck~_`khhdc4$>0NQog+^dy^Y|9g-@4wRDIyyGRjj8JNRmt z%|7fzjwxT)Ys;t2WlI*>va?+F-m5%jCctX~xlua(2(?S=5Bbc(ol)5KcFqpiw@4WN z1A~KYo|zsuI)?kZ^A1ma1^oK!k9m`s>%9T&Dqx@)JN)sw)nBrzy23vwdmgBV2&gV5=fx zh?UOx17tN)GO^p9)nhEk8K8edFul=AHN{IkT$>0LM$k7sP3#{xC`Kz15;#q9K?r{X z1EdLg9yVW|*z{&R#-~vjh#)f1xlb5ebL&-RMtANvjworivZn;7l$~X-q)wAL$AUxE z?ktp{l$6v}K-8xg6f>%;Uqq}jJJj`Fo!M(4Ep>};Gmzs7FUfcUTUg$@|%KfavZIZY=Cv;=^glCpz8Ki&~cM`8B$Q*wVzZ z8=3Xr7_zOeQ#agoD+{(Gy74te^s*r8_*fY-NI%`_G9@!TW$$>e#hNp^4yZ>WF!A5W z5)?7;qzFW}-CFfTP|}Co;jOB!Hl~zQ<|(ZypX0K1sU5EofL4RMNIl5EfMlUds08h% z?_Pr(OFXC5D#1$os=N6Nn!3~80KGOSBTJCBklxe`KRb}mqCClb{rbc1+_M!|m^9Ui z$Q%YnDKRlWMDG(Jh1(yy%_}W=k`Yr~W>gew{68$eycM{Wc2pzP4cc(ubCkU=2|rDj zgye!Th`%*x-d;N+yHfGzRMBd1AylfaEibbiXtRp-zxmckT9zs^pp^pL*KU{>?m(YV z{3-J#Pg6fA0|;UbYxef{(K>jv;M-|+2sG@liJV7a%ohohT^z^E@~>JO12eB!;`=H5 z1_IUgcXww~rM^=;b~>2+%h^sJ5{664M=pR07%~nt&GYRwd;ZhY2gbJoI!!ohe-dO} z+1r_u_KA7~+AEL*Jb|7aA&H#Yg*5j~@U)tqeL8dN-b~*Awno4StSzRYGXU+j-eN`i z7i$*T^jV6_8(=urk!@#TFA>UN2V_O3Nbw56r&`Z#5r&Z5KF~{>U2K4is#5#&hcro$ zkg{PT!al@@O>DHltm1lgFD&=fjp?n5m)+)BDQV{TXnNQ6$&1oZ@vWkJr(ZyE3_4;~ zM$?>L!SIW0#5)%P=PaEA8!v#WG3kbwVl4)18GVYz0c!7)q6GD=8`Hr)UpnTP9+bai zbnGzGq?VA(&@Ray_u)%bK+6gW3-NRd)e$2~eyPBaHEaqmgXGC(6Rlwp8+kVU#3VD` zF=Il%bXW%WR-D~0rT!sU*ZMs>KSg~DOX?DjA+Okc$G%ksYa$3zIPi5@vOFsO!{Ao3 z<_me14u4|Kl5U~(oiML+<QvS#7s&97UX+LJ_zG0a$WNW9l@Qj-#UVBQAWwj=FOKx z2d`@8&)v?d6vux)(He~w68I(W{jY@tt?mj^{4gvfTTqYhzIQ#$=fezkkTt)fD%A}6 zTt9)CS`s8*C26tmb#Ep++9~Js>P6-)5QjE%Oh@54RgV?@f--gpwucLvfBIdUg&6b# z_XM|^ZbI>X#Yub3(&%^{+X1OY>I=7u7n|R|p|2)nS zHWi2_Kyx(}UG>zy;}`(nzTo2(WIP8-g9`bWi{Kg0>kI_m-59dTTa5U-l`o|FI0-9y z$kldZ*k|l2K}IG|#dF{K+CZr6UV!EYR)&G&=Twh5ZeT(QBQI>cHOcjjxoFO=l8ZRc z-`b%?jB!-Q`}G(S$-91moZIX@;VZsfSEtb4gLh2X>bAvIv28}%?F<)br>EYbu1?){ zXGqdgMDL&`G}C0G?w9&_=@>SsdV|^|{hU^AR+54T+>5$8I^kwqOdYhoUXnNz zP!O>eeGoS4h2+4zZ2n4J(PinifJO(jZj|Uw0IHP997_5?d1;uMO78l=T z;WshlsO0VpEZ96p7co24b#=PYR22w>WONCbnZ(4zYiA2TE-NnXwY`JUh{L<=U_Nf` z7!yJAMBSR7B|w`c5H`4+g5C2tgua0`z!o<7Rqn2aqRRdRpK)uKF|vsrtnQxvB=|KL*IooP;V{^GkVsRP69xnz zI2(tTW*2%FF1?f5fZzmk1=>mOpGr^@Kx^A!X8g|n{rD_UaHGM4+Dqx}Y2z51(T+sB z#^D8U{b}^lZ{J7 zJaF}UOjcgrbqH$z^0kWyl^EH}(jaBSb|Q@(h2(ym8$=7xFSK0?5MbvQXqy;MSQfcy zY$uS)v5j8nna~$(p4(k6Ed0S(Z zhe<8&(`#0LyTwQ4Vm+k$0MXiM`jce?Hn3}adt>E*8@SY>uB8LRNl_t?DkN$DLIpYq z0QY5) zjs?h{KLgPE-JVHt>U$ja9BG7i{^qyB?uVf2>wF?>}WyWQzTBYi91s zYuIH?qt8J^Q{81Y^lV48u-+X^U@kH3Wgg7NKZT&Clzrx%byW9ditNaHjjAudXO^SU zsbwCz9)o%b^W=OLPvz>+R43a)dk6Q1|JP4}z%g!@0b7=|v{7SR>2X^7RRMU^dl(HH zwU@@r%3Hhpu6lh;+~{iAXz9gMoNN}qA!2RyJ<@B$Z>&&fQ3t`Qx4Lu{O^;z?pe{{68hDxsJkTFJ%162@W#*@;~RSfe}R0z=yqxtk}`mR+^E+rJvuuSw|CK zL;ZLS#|{0P?i)Uy!;agW^#`~|LIl|Amu8D|s2+nbLVl7Q1D67Y4@dtPwr=OXV1B&4 zVyua#+;_hnYyrc10sHEYLD&0ELcT&aR6QOF;%ZE#Y3*D>L4uhuD_L6{3SLZSz*b?` zFj;oz3wI}$K{OREN&2PoTE*vJI+68sXlo?^^SHNzAJq-P;Bw|`81y`k#_O@VOQ!%7yq!p|R_22N=^ zP6f|;ZQSA8+sYX_)gnXx2+!wukAuN_Hh&(w<7U*agQl0~cc>($4_{l@Yp(bPA*lXC zTn{*4HrSFS7T3HD zS>madf=;-S@4l@xdvl#AJ>a$qlDXV)vzoH^1A%6pLq*w>^yfwg7Oyb!b)J zU%OMRKBeQ1g=VPNk$n}F^Ozs->hLfs;0%F+6zsSAQMqkLak}|-Ug-2BI4JB^yQg%l zRZaP$6{5drL3!@mH+PBP4k^uld+u(DzFu2%QuGYM}NTK z*;>1(c&YD}=(<^ z+n<*FLxTndwQ5UX)?T=~HShJywZksacXqM(=3({KGc`_m7-|@em0$KQY(*+~UBnpL z*?&`WGDcqKNxom>+2Al-ttV>;;)==nB=Sv#^Or|nQmfC-=X~>HCw%2bGgL z?x81PcqO#|5WLh(o!Fyyl7Cwe1pTNfU!amnTK`cVM^Y!UqAvBlgzuk2<7#_m>2~wq zmr*Bq{T~yqzuT4xdNmUEKGOV`e&eLe|E=BlH#NN|((s>d>Ha63+xM@Cm_lz9lW4Ku zoqyP7dA$GD&I}ZDE(fg%N&SYP_v?-)|D43lkpBZ}$^+`UQt+Ts6ma*z8kDPfu^=*0X6bj}<8!gO2p!%^b(Mmbxv!*I)F?E~iE7)BoF93Xmq{aRBNbE2PBU_^6=q_L=kkTO&<3pBb{FG#Y^~WBMzNW_KH<0me?!4S<*(j)<<2Ucou}MOr!RL%ljyO^npG@1)4K6iA7bve8v;++@rL*uJnng6jOR1sdxf zNZ5#85uJI@p<5eYPNAMN^|ri{YNoq$<2f>mL~rkjm4nSS96u!+SQy<2HmAUHRtbAe&W&!(hYkYW-F95tiZ*4B|n zDP??`i=gf^!OTWaIw!$yN0q#R6ybOixpLg=1Ty!@!sCMRpk4S3x*-r&QCw7jLuz{N zn`Win!1N2SnzY1+i*|IIIi@Oqdglmwau*(v8ezhuN4KJF03@Xn2H*i;_VF#Cya1Pi z_CJ**jG<2zng*NM%BTQVr!FWf_!F(%s1eQZ@epQhM0@8KT!QzyX4cfcw^sd+FUBg115?#G?3PW!m;z!5QqWN>2Z)BqWF(b{<@I@+3tQ zg>10bclhJGO6-dE;YGVd={nU;FQH=rwE9CO##pdJoFNr@OT5zSNc1xJSyr_TrOoQYwU zG!{Y^9{)JRpFk;J7hy_i&=cAc;1LoIAoj-5U)8a6^H|+=ezWa9%#MM#?k-Dt95{7z z`{0sI8t(b-M)d3RWA;!7X$9&LkqG(7$d~pTg(6koeS;68SUr8tYqm3A#bG7NGq~Lp z4Y~rM2gnQbe+xUet|5XZHsa?N90ZJAf4aHqWhg!7NEDojC-|c@8PN5xurM>Pj)fg# z*(E7SN%OC>HY|YPB{}KS$<7dSfP4cw?l}tK9l38JP5q!x1u!Vw{cin`W@_kNn01EH z&h!&n=;3O2Y`(?9qG6W{>WIZ>;qZByA%88w7r^;2*n}C|)Wd@Uxb=`ElRXCy4{e&v ziz9Y0MWK}y24a5x8i8nS@2r6!WuexWu7w@4Vj=L{tE?mi*y5RvNP1X!c-!?qfO#!0 zW{00&+S=NVyo5rqqvSTwmzJYnaWHzI@#g%h0#-D1h-tkI-Tzuvb{m=t$$2ajoXEOO z08DjoG2mk7wX-V zAk|*Qk2|3Qn?jt&bkJQYBI+1XMrk4k*{c8lf>VZPwi zZwH%05942M5U*@C>=+)7($u$%zfd*8& zsKrBLjq+8|#!b%ui@3KAt8(w&eE|h&1*8Q;6p*e-Nhks;-HkLzNC}9fK}xAemvl@( zx=UI@q$Q+7Lb~&e>3Y}uuHWAK?BChvk8`eTU2DNylNrzRjqx4hbKj$0kp6R_j6c=h zo8yVrnJ~^)`0JT$PWC481;&j;%TNVli?i|rR!z}Jy^1G$xNqgCQJa&>EkGq45A*6~ zGjOS`m>xN4;rhN_IDy^6+=0FEVn<%#phEmF3RraHnQp`6bw0^ptT`H}d zYT#R59WPSxL1{Q4OeC`ls)%@)T2?bkvxqA1l-$8%Lya=G6&LP@{RXM6uqMtQn!j;W zX6nMiuo@lU3SLfB7E`x2et)@CZ$P0^Oz!mh11(mhB_FHzdjaH8T2InLSupVe9%Dh+ z^AI_W`R3jWy}7|0xxs?mW@1kol}isahWQZ)%Zs)Sb}*wd@*zjs`Kre4@~*SQ`AODp z$CC}yz11a5#?rO7WwHihgF5!*<>j3snyQ+TBZ0z9p-3|;b?+T#5H`a6XShaaJ;P^Z z64FRVOUvJ_Tc|aFt<&h{RJNQm!b|uh$-*H)TPVv}wzTS&1v%{Fu!L__AJtP%+gEha z6^-(1%zo%#4qo~`GIAReEGJSnr9?<2DH=PpN_@dAgO{5lk$$i?C=qlhgFzZxxn-*F<38|w%TfgMPetT0@$Iv zZArJGKiI^h>rf?F}bXHxK#cTEnaSa_Hy$M#$uy#^i zpilLRUlxAk5zHv=gQRxesu(@3B$@n%Z+K}2Bb zK5E=%Mj6-?I7~f~gbpRw(H=?OQ)A?wg~S+wASp!vLOb-{X>u{H7DG9kvYU~{Z%tC} zUnTTMXv{*E9i*PI-+DJT3X(CE`KTgjav^v0eK4DxxH{?V zM>7kA0|qk5UoL%8mO41%E5cAeb;@}mKq93M;RWAJc+X;gnzl_qTHERwdiWdt-okaz zE!f1S-|&cAa1?^V^Xfz`bwgT38m>8%Y2dvbx!Cdxw_artQlRwCxdWkIg<2oyP1W{; zx0d#g5xY#`Uq7j_Jla%cS1q&*8(~3tU1)1Wbcj=hSS`PdaZWhG$DRxTmoiB2KaT1) zM?@Nc-v}U%RPPn9Dc&SDbCzRQ_0$4Z(H?B(2duXbYo>1ox{9?FzIufYDw>qaO6?(1 zWJn9z(*(3nL~4U>Pzn1~h*s*h2lcFyUnJ9kJ79a!xa1_$drwb1LY*|nUL`vpE!j#Fr~;-8xMrJBRHjEQvt0Ata()FLOG<)(C%$vXBHm9}R6NSDV2*F8fyk z?DTqZ0d7o3aWkSH;TH`-U_vb;kn5a5Vx-&;0?HtCHwz!rfbCtcSor?$FcikNO&chQ z|C4!lXGhHg3tU1_O9X*q^-p#2V~wQ&pa%Jn7z2XMZ+)`Y?l8=d%(HB%5*!_{rh9{T z{>F8fQuB*Y=0XIz_q5-6>mDwki2)2Zv!NrHPE zp-EL}-akvy_;G~rUO-zLaIw{#f;Q8++Sjhu;?Sqbz)P;?B5CMrlVpqMn~rX^!B+E~ z4I!7=@7Kw5e0+@91X2qB^5rH#8^7rC$3?s;lt}(`XzNqp$X9HS=rn-Hbmd*nIpA}k z^3LJ^eETXcGg(mVDK$#D|M0_AMec1ZN{Be=j-sgE zr#6@uM~K!-uRS!E0Mbyq9%iV#t}8IQex3yM6|qK)M?pA7y&MoOEYTVzbAvG$90;cx zUR`jVd;b6pElgx9;N&SIQer1xejrd)d0kDpR*l8dqZS#bmeIe&Bf!1YnaA?m}gy-zlt5=wo^P+GltzN6b1Lxj+*EKNib%35SM$iCbkC(3I7DJm((AO1f=XEXxr+;j?IwOzwcX#20YMJZbEd5}_ zX2_nB2`!{01#=2NJ@!LidX{IXjx7D-BI zRzBOn*Q=>j7LkfZMr^sNJ_p%4$mpjW8MqcluaN48&s|(14<8ILTpW|Jm4+*8M46pZ zrIWcMW-_?N86op*#$8>%kY2+g%h~M7lXjIS-1pa4G}HTvQTjSx7W$){Nf6}dv9M!> zXv~!BwDQNvGjuGkyzM>ZbzhK8|B!p*ofWAJb{0(3O8DO zRs+KzTTMbNX?V_#g_W$m5&S+r0S@7{zO=+`gK{)#Mffih=2cgZIi>rJGFlXCcl#7o z5!neR@W-!`on9M6Xn1>jtH*8TIKcc??UkdrlC>_uy_5vI0ofSHt0IRQa_~4$t206A zyeeu@;->Jk9fbIoV52Zwg5qV)8dY=02j5md0_p-_%X4+h3E_UCqd~(HOu*LPfD`I_ zcd}Y*l2jK_2z8ppxC@yy%(9*360YwY!fu>^H^k#Y4|-+DF3dku&9-CT`(;@1xULnDv%JXVLF%Rvr3&a9S)Prob=A~(Ti$z*qV5D_%{x+C+7M0=$y zu#wtrsY=YB^707aayXjMs#B2VlQ$babm|+N{{nZ?HW4ZXAoVvCR3c5dRs7|B+w7N( z4KCR3O+{b{f^$V|w|B;C^|MG$16xZ=_Q-ER)_Db^YMs;epWvjJ%gdgR~ zl}1fiOQ9`b*auwUm-=W)ZsY~?8&-(<&s8~)f$+Pq^6i@f$Vp`iTc3<%kKAo}m_}ZI z2?M?9Ahzr7I)p!Ke6#2kwl9oNo%yt#0=8$x|IiYbM6{p z--qNxa*SNgP`AIBT=5QGr%kV-^4LW%6t@>->-+*dW|>r@uv(J$J%lapTVUlT9Y9xN zMvk)`ILb&P;(8_Nbk)LPW9lBnxfkIy9jE*Qz!0ib?84>dRa%JHAuP}pIt;T}N!F0Prey?MFhK6$#^dlKDBE;*3e;(Gcp=D_Vz}v5<0>Ey; zYh|mGRX=TkqLvqKHjQ%)&4^Qoa1wqRE&Ul98;#|P>txfR#Ofi^tW<2jj-Nna*Oxvj zF$dl$P~gkpxY3;-gV1>F6L!AhVB_V1kG9bwuAfr4Q@1^;cw_XOk>AtlBymLp$N zGL!^-Ke#wE^FjC}bv7{Y64<$H$M-~Y8*1)p?Mz!%kZHVd(US&^aXn~R=Dr!ryg~OT zb>~|2Czt4qmC`wq6d1$(hMwP82LY_wMYz;d=$2KH;t?nlg0;1wk4E6S1rStbZF3o% z%?q{UCKv`6-O?=-^*-x_;0CFre)(aeeUp;FRlQU0)fHE%>Q9NBT-M0u7t6JL)+SO1 z%Y`7*@5iA%HSGdLbB01sT0X`?PX+h_to^J`FUYgiVonrS$5$#WI%2ZGGL}#Zi_>!Br#rKdAk1H=?_(5HwdUl$?2qePRvrts+DCBVS&LE9&>%|Q zl6q2j8bA)tsl$OHB5Y8UEIdbAt;!%RJ~A@0=n-Y92cYeKpxYI?msWMa9eYCjOCScp zLx#b)J_5TNVwxghYE0Kh=wZk@-go`0&B;OR%$!BrC3r{4K=}8kCQOYv78ez%STT`dmWG) zU1tJkXTQ25wp6|)3_lj0w{Bm(-y3&DA|qgf8mXg!0~C@umY!3^fI{^0W$ge(jiJt? z&?s!p0I?QhWd>YzTsy`?5{H#L6)ZXPG1`m6Y<4+PDa&H_t^`WvP_f|((9Gx=y|Nv6 zq`_V7-HEJc%ZpTZcfSM6i|Oc~Yshk$?P zE2>N@f}7to*JZC?DY*7hCjyeuA7zERb6r5Q-kR`+*`3}dXU*RSNrA8}#<@ON8muF2 zY@%3;Iq!t|O9oIJn3N%RphF{BvvHxN?g^l^kWu}*18bjrwc+k6dN>INB!luPh?a;r z44QMW?v>hxu=K(ekLonDidh1BdT5BTA1O{Js4w0%%A!26EdAd6Y3`FZ&D_QERWBbY z>lj2yj#{9?#Z6da0dA$#xJleA!g=JVl*F6bJ%dfZNH%%4SH5@$C#_XW9xaCEvx`bQ zo8GBpk(N=`gUR*c*t@Zhgjo|(liu;j`g^4)dnfk#goxRsI;o9@S=MRSx;e}1E4_Ob z9vFz@aeh46He7$^47#=9o1sz_C!Lw*#0{C8x_;E6s?UWJ&&wHp>~A4?17oi^6521f zCoU^=vGJV!3!gE{JR`J0HvtOecnhcF?G~#w~L8 zJ@mQ+4YkFs{A?xHX(PF7cWk5c^IlPJOzn+L?VS@C?@zo%#uKvXIQPe=hg^{$!+?GA z)!k24=RcnLM(AFJ)s6u2ruu_97lGlud;RVg7`50jOwG%kcds{Wq6;lnobHWn#`Jh# zL193?dnOvO&!|eIfyXH#l3GzW$G_fgSLG$j7)q0*d@$(Pw&#<5@L1L>zMEm7uou#1 zapSJH4I0307eTs$LqDh2U_&|Y0cK!IED>y;d&Cm$YQ5Fx*)H2PzI^mhBAV+mrr#~> zF(n&y^?g^F5&2rc9_wg_)-x}lG-|96VShiydH4RE*INf8T{L4P*v>Z1@S9o6vAV*g zweig#BI&_bB)%!+5WQpJR(%zSK}z3@T^xds^QUkn6eVO=N5Vz(xP#ojGh-{AuKc8> z^uU4NVDA_%x5IKf?coSj#l2@9)>ByB4%0)D8*rTsT~|kY3<6aj>`lRcZ_nPY*(hKX zV?geeKVIS&&2KfE?>tENK+kVQ#7@$Va#yaDMdQ0Zd2q$9wohOE0RA14NwOaq5!gDe3}7y*Y7L*1a@l-{>7Q)IDo6 z*@{mksej-0*-`i%wNQW*()RV(xj;q7(z}@=qQ(wApVB?Y>V*^dM6E&M;@872WP19G zCsdH{I?K)%*7p1s2w@U%EXc*z3$fl%sWWuz?(sUft9>AG)q8XCQh{x^%!@T=O#yVY zlR6~g#c}nz=u;}Oze|0nkK83-k@o8}VUCx=GcT)9xXvt`n)B@B<@8~w_<6>OLBLGo zYayo<1)8)WhLL0=mw#i={C=+R zB(#mrTl(#A=Zbjp=7api%m-0WUV+{ot=V{MUyzUhiu< zj8R8p(dAqbXo(kexd!iRMESn&!nswf&VUuLXmSJ zoYKzp#S+sw1scAmW}Jg|6VoPgcrsqO=DCgHRAhYxneGLFsVZa~>Xtn5J^5=MJ1mB_ zr4?AuvsMq)eB_+MGpKCa_yM!01%}0RGR-|x)jQk{tAZS-HvX1cimTl+y(hA^nc3;p zpHy5q=kY4mmKk&POEFNlhpoq2-22v0o_65DZ0l>`f8J2GtLCOlwIk07*6Mys@He-KDm=$UG=q3zy(oruzdmhr`rX7{rZW4Jb$D^NULYy#A~;i9}Xdt%Q{;~ zfr-9~E8Mf8zj0t~Az5CD)QRkU{-MVZo*+`fpw(+EdT#eX$)J3o@3n}4;}sa%K1c_G zL~jR*hBSBb`gN<^+HqSeDTRL*m0_ge`C96_+3o4SsSoqzItem})#1>kXDdLT?Pfww z!^P$+%1(eW_~dqb4mF>bI9cB{_Zjcs_p?kGR6IFlIu~H7=^XVZa=;b7K2S&`ems4l zs4M^UB;vsCd|rB-qQ+pm+Hj|xI?^b#PD3)w#6-$_tdZ_8as4a_JRuO@)Fy*aO9~UG z_Ki+n_|T{Y!s+QhXRQ!JblI;{@6+M)3zxjL<0GdC?3xE6JV2U5d~4Rd~pzT~tVLH7&R=QZJuS4dBhNw^}WN&fL++C7S~qr49XoH#tz z=v+`k$vpn0K@?-b7GAl!*!wGv3M!?S&$@2RPKx$h&HU#&w^MeMu-AS*U-|ums=}xh z$5pu4yVdBQV;7sg0iO-BVx}BfqkX9T;P1hMw%Gj~2O>auieX=}# zsDSbJQ(+Ui5Sy>}^hG?Rhv#xXshB+Y&mVpx`1NlP;LoG&+85a24J|IkNVV3xS7>tn z`(@fIFQWd>-`D^=J0795!}yQi0SLH@inadp^6+Y?IQ}1hWI=$+^8MqF{y%$>Cd};w zw10n=F3}MiGBhZTqI}i=w9;Bcd0P2jrt@o?MMncpQ%Ifxu4-|3(%DXC#X_vL6`9z7 zzRTRTxw_-ErqNPsWi~Qy@bFBRjfzZoc5>hlFX(^)gaA~h556jT@$BQ|y#{SC9C+ct z`t7+2*)=$s0F${@4a&(I@3XW$pccp<*S+-^5CfECaBr`1+J1nI-5i21h_j*Mpt$0u zoB_p(NRoRH#DIq`C?5LdmtPwi8)IA|yq2{*4h^7^>+0%SZ|5}o9}I;}G)IaTPb;o; zgn7c*>Pfv7X8zfLM_LF-qw0_KA?BHENDUKvI|hwF868l!@Ev9VRP?Q_StXLcdoZQ5 zNM>?Ib#`mVLtiqmLF;Epg%czka8cht#(!+yv0K;wR8ErpoHr24w&eKBu&<$>Eypd<#|WVpB+G|J3ZA<#j!xWmWFq>0K3KiX35)bioP_N!^eK<3t=$JQYj1*oTsU&Xat zc7jG3AfEnKarOfkm;%dwMo11$Y}J4lz6lunBT6R{gcfIe<1`1jP8^j_zj)eBA2zL{ zqYbfDW8V?rXlg;oeTix47MKi%79W?OUH7x@nNPo91~X>8;cM_{(89A4qJZ~=1HNX>B6HTy#5%X|GA{)tKF*?U`n+f0CgvOOCauZQj5WXECrr8oDqdwe#A`uZ>cy=mzJKYvL76xkz}o|EEY zcBh#D*#b(3lH`b7E|5wrT#M?&3~RekKBmt&jw5Sat2GFxz0SKyiikXrSb*z7JV&MId+J0%~Diu({SnI02Xhv+x^Geg#sXC^66l%BvXBHnLKcfa=^YRQe0-07MDO zHw)#w^7aW&!8{ELCA}c@*U5Y+1g%g2u_+VD1m}!Um16r5UPlbOlQ#bjPNvNzS*ZV7 zb7FGcetEvXYPaECEzT{Dqjw#381YE?K&?&uKa~6-^|YOk#*14&$=M0&jgGC{(kXrB ztMB9($v@sArFTQ+ws?3_4%tCYs!bXi9E|GK#1YPqgfff#9WD~qFTQdxc)@d_%NpcL zSB=PSz)Xgm38H+Dp_BoNU!Yg@vIB0zSQ3;^;P)yr1Wbz@qbivn3ky_@Agid&G=TFS z&VM2FFSRM4V4A22AE0N^Ob`we;O__ZWu6l#>dkjXMftwi`K1h2c52M%hK7cB8B*X3 zJ-7WL#vhtjF!Mn66c(5mJ9TDf;e?DAAUNTvmoOZTdet<|g>SOI_7i9Y(rvzBY+1X_ zky2}NlxY@p5MkFXGlb^4KTwarNgo~oZcITa6#AF9KY9hFu0wZF6NBP6oEsViKz@am zHA1GyW;ex@KMr7k*YHozViV*PTlh%;9Wckx33Da82(XKSAX@mkfb!7HKCG6|mBUp| zltXDf>Mwo(Ae!zMyz-fphaR+$+o276Q1*zW_la6K;rla{>@*yMG#D6GTdW=6f%{(x z0&rcP6Vf;oc0c^@@en!OuQNZy@sr-w)46Utfh9{)@bP4rcG`VM;@&d{;7IV}+`UhG z5oB^TVIE5tP8K7`Z;L1TbACRqIB{8=r$ZJ6x637?X0ST2Nc8OQcW4CEe<_?7|HSh3V z6Un3AR77mG>->=BnzsJfz(5*NMN6%Na6)WV-{fQ%>LwSoyf_k0_VyZZGvjmRf!_0i z11AA|Z=Vfr^|n1ljoGee2xqB}30co(Ds(b5b{`m!LuWd`IU1)67!^|ahnP>G{Lx=S z8YIPsKzv=7co>&gWwjT4VRTVj&q9OH>Zc0kL&pW!RiOv*je1DOLUG5uI9ZEL$B#)* zi$Yrj*P)WQQ3{L8QlI6b+`aqvFSNF`vHJ0fiG`Z-Xz#7@2rH5*qdye_7!Y7Sb(=O! zi7Wxf=di#b$?~8gENv6kHVdvCLnTCb5rDl2-GiJr7eBur{0zlkg*$ToO-9;fuk8hc z0RTfsgS_1QdBf84w5I8IWYfkU3jgpgDs`-ZWd2RB^7Hd=@1|p>ti3JLVCpw6q(D_^ zu_UBV1)WI)4=4sN80~&mpw%3!FObPh1kF0r!xJy>nE9fr#=9QPIbh=s3L4Ea+;qst z+Zb~vC`9FD5M!abXn+d|G-hK7GSEs+!aG@e6W&hiaXIX#Bjuh~A?;-mald-eE%()0 z=Uedm75y(rdIv4vbN+lz7y~b7EqPu^zMV>!!;~-e>u%9YCKZ>o;0h#)qhzVj10sYPFnQv1RN>nGeA;KVo- zp|?n+*p)%_`{0ZFF=DhAEO?6I|9~{mOd{h9Ha8d@LhWjuYBr-LWw<+`x)Jx&ar6oAp%)>YyFO*wf8KgJ1bRzy#p>VnniO zzg9WeBER>R&Q9EV%6H079fbN$|btgW0M!14# zjGQ#@y_8mZMvIK)P`PHN4)wWAs+~7}5 zr>=#)6bM6acySQB@}Xa>0MRDaEKcLL?j$I9IjNYFAOCy@F|?%AB*wG(Wr=UlAfP2k zVMdd2Xadkc>ZHeBgDZQgsIyJZO|qaz);CHS z(hRn&%^#(g*Np!FEA-)=-S3g%wR{@Mr{pn*>2u<0@5N{eF;Tpqal$YmnbmRTQm`^4?Rz|mk-&+ai zVa@&T@C4pY5mBqE7Ghh&B9q+6RPdV6Ql<8_`>2ReM5VO7K$Qk|IDjw7YX>-G{|8W@ zLe^V#FoW>F(FF|WUl3)H$o?BpSlK^D($=7T$6wnap=CjB<0K?_a660g0ld&{MYg6^ z$@W%@0uj6wleM!7W3R&=6&{|s0POfbF$($%glNFD@Fv)NU%X$TKymF_?hlRZ=+Z*B zVf>fQV-S9#95wP}@}jNuOWj&`ZP^BDexb&6X-SD%$=NLn#uVCs=N`|V@q%~%bfxhv zDJW%*JWIiC)!5a^6(%BkUmWbi%V2Ma!0ze3po21Ap;p({vyG`QvCXxxEVtBtrDm=>ekJ0v>APqW z^ZvWYpT+)1nP&5`uwPi6oyW|NYC*4Mj1%X6;@MeNaem8muN9fO&>G*3VmlqJ;3VqR z$$C1VEU-bcXHYEo7pa;fcr8$p@6EllHe0Z-^V=)p>ei&Z;>aBPjErKHe-a6u{eTesO(b+K z{zW7d;p_j0NO;J=qZu^u`;|<(#b;1g;@+3oQLl&CxKd3ApDM4}t~3}N9Hc)E4wI%H zTkLfKMxp(D$GKibH+_Me%hn{5cY`$2NkWj9WC@@c^lgh8HI|sSIB;MG)F-??J6G#E z9(DE4ddFw96EREZH_}*(b@d!wZ`V==G9w3NUu^K zpIYuSmgm1bH6d?rT0fn>e;;pcWGV&kThp36Yr5g7+E^w&TczTSqt9)H=j{%+yTrW@ zL`61ghUzP(zFDsn99;eOqW2hSaLNLWGkiXK?IICDZ%}c9)~B~kRu6v8J3flShM*?a zy17*j1tAhfVL#AsqF_zC5c9u515^R+h`CwOnYbmFFgh@6@MHZIa~SH`pC1|d z0^%vx;!ynR?TGmk$b`holc_tjGw14PHNSloI`LLX&QN|>{ylVsk*z;?yfi}c#^?`U z&_U2PP!i;3JMVUv-2^$`2+Q|sO!^?23-9pIJU_wlVtSs zc7l;l^N;F(TvbS__Z9rasM_`qKxP%XgKLLa6FOgh2lZaneMu`_z{C;AEGV1CKa>YR zjHR#E@v;Gm>-HR-G zv)DBRidMmfZ{;#Z=47c={oN8>ybuWX4S!ZSYn9v5z}XK}bb#)Inb@WBF;RwnHn(9$ z>E8x|*M_tz-qyXgm&zF8c2*At^+W%Xh{gClIaC&5FA=c2qORsUk3Ur*)R?MvOz=+4 z+hP4HAb{A3l)ZEC>>XA4(W<;a0t>3QAk?d+SRy`{84uCr4P1uWI5?G)5|Hgo2b>*9 z=okLqGBVpm7IQwvOP*pHg9b0pg|_0t>XMp!f*6N>s7lk7Q7$I;k6riOtS!%Pc1Cix ziVo++mz*TJ(!H3ETn8z~KKXP>b>y>XP>c@qd7yZ29(l>k_O7j#E*Z7bM&cA>*x6|= z=3I~#1#FJ0oVby*c=UY&hx8%X!ht+#_#i>`PEw;)CDmk{gjT;@>uoG4Kn${~c=OsI zN$@RAnQ62uv;6JZS@v*1K`_=-&fQG%8lNniviGX#fw;Ba8qR3hgx}R!l}H(o>WCyb z$hR01!2s`z9fsD|SlCCxXj+p|*&n?Tk(F+E_ng1O{>pdZlSHy%WudyNYPh8iAc6=Z z9PwYJ4NFcbKvRX6!$I8X`Ey10z^9OHU_4!ZrU8RprHC2w@U%jMEU={6l-p$g; zqpO8diwISk7mv)zFe!^kH|E&~UKc~H2-`WE-MSD4tr4?SYH0;PeEu)jw(vC^RL2#Q zHgj9Ck)J>FmYA?LWvyOhlc3tP6oIp!9cZe|F<}yZ&N;W|=m*cJ>?BwOVlAv7=7_bB z(l5;x3qn26Ej4JNSdqiMOp?WlAHuIr2KH>=#WS`ulJqx-kXA(jC?sI!JR*bFTUK^; z#3pIOGH2!zqc18oks_DLa@No9`xC-p2Gzer92l)oey?<`_C#e=Ofe3Fg*4%?b^8jN2G;pVCpZ? zOL|I&Pz9!EX|&7Lip{~50{)UA1qVszOo{v(Re+2p6uH^-jNXGQBO*m9eZ%~NI8ix^ z)yky;2v2~~icBylt`SO5u>6`@rFaE0%sChNr!(%yv$B2nZ8u$@9!J62LpjTye8g8k zi~%mJa-9mLSws*Yh8&pP!Uj!VXTe~R6?7HS)s2&@ruwY>v$!Ku*y#GqfMUw86;S;b ztd8sci(G)cHn{*uAjFL%W_QSoT@r6ReP>Ua+WM3qJ*_HIx$~jT>h0yi1J5c9r&~T~ zISOtiB_#kS$&bk}Ud1(n5tbo-1^dY;Ceq@vpeX%ytdJX`#vhB5WNs5eLPl!x87EKn|Ieyq&UW6!cWH_^__!KPH)e^f)WNGIQEoH=iB zmB83p6s;SpLStAff)p)e>^5oX(;OFGgW`gPaIk}Gig=om*I)kPkM^u7%OiKKQ0tMY zWcsmGN1+>8SE%N(N3<`J+^&Uj&TYrJX<7R(7Q&mqyD!=9+3q6cpuXo1>7}d^x_*!F z|1*+hmaDx>+o!YM!>W$t9yYysyl_!w6$x)pu=jpJ;2m;+ocp@lZNSO`Iy7>z4w3&C z7(x?mFu=Ysg7hcG6~{H61OkZ>a{9l3h{cP|e*qCM_C_omz~Eyl#v<`cYY4S9@q=#m z+Hx%0hG7ANFho+>tO+@1Yjfc&g~u*-otNUZdXLj?od=453S4WRw!eM_y8(5a@kEeo zRZ5}CQHGF2RL_$EeIle1uh!rQwHYP(ygR&~TZexU!-MRrP@7qlz8|OOl5E9lQKuEz z19|pZx=|vi1~LE`@a}Nw`h?qY`N7e`O7Bh*N82_h;p|cU#A9R@RHtxCb{O$qjTG$c z9eP08yT2?a4HFv>gW6-d=@kDz6{vU5Vqya)P^H~3zsu<-PTAIeh%J4VCH+#r5#hcu zF24GyMS#AU_}}VNn0clw@tVk&>tj`v?nz^IEUxFP{+It0hEFe%Ev%LNqi6+egNW4) zH-qCtR%L_otKR#yndlUF6PiLa6lX2gPbwYN2dBlL@ShpF+Ut?1Fn))1DWQ9VOc+Xu ziMu>E|M5!ieDBIj+AUfz`mRF7QpZIOdt!6VV)HaJ@xJHJzT3W{M><478b5vh#Txu@ zIz6HcDw_=RE!eL-)hbzLgkq|uG1;Sv;}cWK;hn2dg*lT zmh1);nq!qIEHL1beyX#zj43#Wsw%JI?Hm96HX~+3QtRDy*7o~P1!mGc?wKsH``9^~ z$o3%E1rIuBa$9N<_7@arM&9_lTttB$S0B4-(Ymih*e-p$f5I^y3)O!q7y$4L246QK zzXKbB@#{@TBbVtK0F`*@M6&fg)NpY41a3_GEUKz(_Cl#Y+jc6m%8=Xfk?}`y(L?V$ zH=2qhoV~Y(SbxSI3_rGQ%UBui^a$e7BwBpy3il$Y5$|$T#ATuF1D69bkE0?p)vAU5 zDE6lErt$%1segQ#Co$^1?#1g=C!TCR(*`Gf-`x(N$ll!=3Ag#+Otq(*`J1@5!|e&L zMW2Oo&dLPT-4HxGi9=(=oF@17x?8o4#whg*RfmR~*9bEQbwN=-0!9!a*4}dXe9aaA zvTeOQ1DV0R(^T7t2-Ko+pk%J*DQ`RX$*J2hqCc6ab6g>2YSTv{s?z@{+_v8=W^~ge zuJJu^|GoIR88989%di!j!EGacfiaFqJfDC&7T_+W^Xb+yl^AqPxBz)HUDhoy@p`O=cH zCcsPqHZ%NjaAI+9R@Rp3r6cq=_4pR6%8p?CrQ+iv$#B2+(=e0Y^LuZH zrX!*SUGzxS$m<+00}x>~!-SUv<9j3Zm3Owx0om*QFsw5(8Ipg_!!92@bB1>^ugibb zsBi(;fr6MyF0KRYgvjR}KdZkz#-)0C#>C12@(^O+c{Ty-LZMxJ^+>V-lD5#EgIKuU z^Nb$=Kyn3|N3Q=FFe{P%y~B+9O(L81d-T9TpfHAtonji&?R|iF;L=e7p%DPQnIC-V z#*i<^g)W1*Fa`1gSBPp6Vq7ujrAUn~H@&nnZ1m$y@d~=(aSu+f!=pH}MWu~@RNl8+ zf~D52F0N;s?^rsCeQeaVJ12vQpu(u4=-WH|w(seqQh-?GUKC3+aMzLzs|79N>4(`< zGo1Kp#!bS7;c}ZJ2vHJG*h;`jeJ~MST+zO2bjw5azr4lQ;PE&$R#$I!;x5-4vxZymHnv zd1dD0P%9Sd;sXzM-J8U#r5kmruPpz_B61vDu~?ys0OkpXfQx)p^Ep5{Gc1|+ix203 zOzWd7Qx=g9$AiV|AQlhQn!l*Iu@}#C_V=fR-R{|2%Sr(u)r)ptP<+t9dr`BxhVBY( zS8>#WV`BwYv*{jRctV%-RBtEbP!OQOv?oXo4MAgUv6!wOYwxKfg8TIvMgsI9UH>-M z*W)skr&)zq%%XM@D->XDy27DpTXlMVkH1v)@iQ3t9UgGX(P-W}Qhc(-uO7u~YINh` z8oWSZ~~Jglv&sKb-Z}w zxx9Shp_PCJjo0o*ZX49F{=NrfwDOwyWg=qivVSJSP(23jgim~R*FLX7b|J&x&jKzK ztAA_hbj^L;?E`6KM5IZxRGW{r{h8Q4@M0hUqYi0-NLG?J9NuEEJ=7Rz&!_O z*>=K3M~-*erYCm{<(o) zjLt|GxVxhNk4pe7Q<&x9f5lWJ$Zq`q1)=;uz+v>bCULI+eO=qf!@JGV(Lg_m)co8^ zs;Q^!@(pFP2EEY$2S$4da+Q8Q4OtP|wu1vfaC%t0bK580Sx!z4rNB~8s0N7(s-7(< z6@k*n_s0F$vfw|l)ITh=J2AZWTQjd=Fex^ygb0m-imFj`fBelQT30ksrXvFXq;LKV z@c38Fvkst6M|=5)Sb5j>4}L=lyUV;7{K~f6Q3Y*2)&F1|knORDv~o3YCE02iXkY~o z#fI)(KtoU@zKdrxl!u}E?PvC>=RVka;vyhXcrhhbLt> z)BexrbVK?2LB@pv5QMYoSCy>B&$fllHV2YG^hZHM)1v6L6>iybYdKBq9C#Wi6Qe=1 zgDbecbA?tN2JfJ?cA#WNL|HM7r)aKPB=0Q>{6_O)ZH2o5i{^ESfTR0|hK3gLXX{AD z#FmDjcpcC?jGo0qpCfy;IR2-NAopVL8LRge-&^|`WSw7W9;(7m^Q|pa;B)lP>unP) z8Rw$Pd&QI5{`IyxuSFTwr_SBy%h6s|1#vc?uar-R7stKk4IMV{rV&5e3@Zd&2SQUP z6d3jFVY1S9{9G$k3-n~AXa_++ZopZjV>n&qcFb^P*Yi9atT*8Pxt$RF7LI7(1aYV! zt&T$BwKGO+Tt<78la*ffEF$mae53gm$^Yh^4)m*l?+fnIY2Q(0;YpS3n_=_YFPdDy z+`j!82m<*Uf1}(w3PF5Ll&t;->c}<%uMQB%LOCfJnps1VxGWov2ha)Wn(CR`vFop$F2&IgHDtn5wj1QDdNolEt$xyxs?JOI? zPdWUn+>&sq9k{!JMw?}*68dagHog8bl^fi<@aA8Z9$qYgGZyTu;(m}D5;@&uZ%fkK zdhi3b{RV&6CP2aX&4jYZRQ>@$ z4$n06o`P9-T4|a3{|gZ0cCa}QC2%P(P;G@vJfIk*QUju2s@@LBS&3l3*MKAwmzWr# z;npeRMVHcCNv#yHFeC<(^_H40ayb5iwI|rbd;xt45LKOGpuCe-RJ;sYeZY7!ueE`^ z&NQi@uu%CdQ6?Rva%Oa(<@y4zZIZ6?Xo&N)TB~LlRGfeYfaq18N$H#O&MpNrXU{WK zFNv{sUiFt^U~Te0J9>mX3R-GwQ}8Bdu8*R*urXCvK3C{XAx7^lzOk^hp?EGvxnECL z{Lp{yX38l_RYbwRe|D5=&9Xg(Y;y=gPBU1qZErdcFRAkhWs@KNHF`~j%X?T;72C1S+HM8O#a zDsiovEDoDXel1*{{pF#@pK7f z$Q>O+0iZTxe+S}7#8CST7~T*rl}XpEK(ZW+mkN!V{BCFd)`MGRxm-wl+QC;#ufRpY z7AFVD1ghyl+rTV_^9Kn}La_8;TDSNgEIoiQiFFG2hpETv2$>%p)Xx*w9V_7@gZ2aq z9DSc$b7agLiocDLh8JC$Y%(d=^Q$$;ZM)DDHf zR~ap3>ri>zmUP_^42@j423JN>}Sx)S{J=(u+n zrMF4eO=g}4ZD{j)Pp^9gi0gQWabVf2&Z>BL^ggQDTKT$?D86&YqyIE8`zk}>OH{d{ z3(fPAf?b5oK&2{CLNROu(2xh^re1lpv72zi(?3^77Bj9JtNQ2TNJeg@{!j?B>%(7iN z2A}OZ#QCNgJi6X7#O$#v7IRAYWMvE%W`bGhu?|p}irf{;D`aO8So3fNUHZB^GzQ31 zD|Vb8rs=XXrHU;7>Vde3|VGlS63}B@Z<1<7BXIvQbO2;5_9Syih2G==z+0V zr)V+;oXw?H*Ji4P+f^@t9rEMfhFQ>#5t7WY1tFuXsRbd+MRgPKp}Rem`|~6HkE*dX z2ZS7IW3g~|eY)^7`vXDXbf|wi84NB53zxM$y^tfJi2G)*0L-TOOQZs=E1ID22Ld4Z4it!Y>)kH2V!HT4!8IJv1aPCWRv*hXq}EaH@Ze$mUr z5aW)&7gEbVi5eJ$ii~Mh6s1e~>8NqwxZ3GYhY~9BcPv)^EMUq+9Qg1&!mGZ%OVNxY z>OQO`36E;)zhx8Rh6r20RRueY0Tp~SKyJ-0K}7-jL_O+MfgxPTo426bY^ml4VHgx! zcx-w{)H?gyf4{BD4yG`CJ308x9?V^wy28Jvbwv%YlwQRKL>J#+y2dSYY4m#_o)1bpRKoFBdt{~Ko- zB-*aVmhp`0Z{EP7Zc`q!b>rR#;8FX%B9Ex;*Jv|UZx}5dUDAi-uC00Si#6Rn#DUjb z6eSL%s8U{DTDk`TwwXxE<>az^w&m5!7LzOqZXifDSAR+6ul1fQ!Yh(0iCME$Q4PoQ zB%)6|>DqsT8ffdwr~ENhdg?A!^V#I!*D-1S!IkvM#H048@<<3_ub*(%x2$ol`20R< z$*TW#RYBjLKA*psQ2c-8+R=<*WM)&=rSSVo_8Et7Y1XKN>c0S&$hsn_%*VfX-~e!& z3!0gA7xlo%1VJ_Iljg;Yo7JSiL?!k^f1SF)=6755yi|Zigp3w-CC-oEpF8C_gl22xV_;+g} z+u4RC(gir8XI_Xmj-_lU_mKUn_y*b0`6(`34s( zIoON04@ID1m|Q={a(;z^Rviw#!6&h}BR6!p2|D^<v zkE7tV*t#K<*7qr~SW_O#$?c~zBZMg^Q<$nMVW3;E&0I;H=JBSm2 zWjA;8_mumWoJQQM>g$v8<#W=Ci%HAWpu%vK+|JT<-eVCkAS3<^l)Pt5;%)qED$EdBLq2YDOR$_E?gZ}fMz5p3$ ziag(5=&o4FujT@uNOv3xck<&_FYnRXuX(J7=RYvFHr%}rzJGu1&R_BC^>%@K{}KU9 zlGX9mvjG`HI(Irc12?0X(mhl}Mwj{R!7wQN$fiivXNTJqjb;SuS+~`__=~+x-N3ma zJtHnj1$D;9Q)7L=8}zi-NF^^fj8@djlAS83h2`xBFuw7NyOSNqN=cxET%y1Q!aPmt z87wnbbFF-}>q0s<&Mnr@QpcFrJvQr`!iZ(GKKT9M;q$%t;3-BCd(J|c<@YEXhG7iE zQ@4YTsUhjiJVN=f0P<%TUHz6#84ayPo*kJ*e?!x+nf!IPW%Z(; za2~dC&M8kPkAPc!9i4e6_FXI@N&E5NE{c_&++kpWRQXMW_A+=>%-3YZrbmA@W#dHh zSJTH~^WC{d2xm1Efu5TyhZWgkVz_0P50*5U!S9H6P4%J7@1Yr7XKlWXYNo_THE1dd z1_6{C(2?uoJwI@d1DX+<0)5>zk~|g5T9GACAyPJiw?a9%nG{cMg1`cd85PCAvi)$Z zZ)hmvHc7I|g$JNy0RVZcIxmtR7C3H^Ku!h1x2z37@I%OrSLIMR>cSJlM-ZzHJ-za) zKsBFH+J>55T#stsgC{+75og>VfwN_JB}?n|6!!Nqx!>-yWkxHUk9y>Z{u~<%f=cZ) zxDvRYY__4Jg^8b4cznxRb4cDvmk(~0US7O#myt1mm2U8d`(+BK!$igQntR0&9k zS!G`>p5ULg;euRCIN$Vea- z5Nx(*2efCNYzF);$vfNM?Aq+k1LTp;h)Ts1occSM9wXO}sa-F>zhF0oN6NY(E>??w z?wIv5b{el4W%TjGB+LkmK8lB0F%Oxbzbr#aFr2~sYwm?%-;DV9an6)B8^U|DCE{Xq zWlPI!BYku3jp7j-u)P#oPm*B_g-uRZm%49>ueG%mSNKW-;i;o;-hBou^LLcRyBVBF zo^XKxqII(1Gn0Suv{=e1T_#(OaIwT?=`U2oQ{b;SyvBcvcj;UFoQ)`^PJ~ z14hms)r+$(EMuoU3xUQX;Br=j+YP2plMW84;$Lj&ZY%KRfQtvDS-x3In~*td%btof z${FPd5T-kp2!NGsWCt;H z-+}{hKsgmGbZ;dGY42{M`8*Wl1>@mN$t(dZxR^q)g>JOUVE;&=B%N!+djiIf;Pk&7}Rd@v5{1ZURMwr{X}Wt zV|hg3%aL<1cbP;)`&)Hpbs z&h-4jt_nyYQaKlSDIkt8DVjt*U_8F|_{O<60~X^_itS2Q|D<4gn2kXSN=oC>&yruC zH*JP7>ATnYz+{#7>Xq4{LZgy*b#qfki>L0bmY}nDyIJN@E@69Vh zHtT8ohL%_0dAC4;eF=Wz*Z{tB?YA8z#O$QUhdVSWujv z3NmHnWzbI10(BDk(eU=0NlT6*0=q?bZ7Uzhgh^|qp3n2H#jnehiq!O;xR-Oz+VaI=$8yWvsiUd`?M#@}}G zqD!VmzYh3ofQuo~ZIb+xI>`@DnOn!b7~Ty+YuOvp@4(Yn*m)0BcfT+7hRU27B8R|4 z2jP(~i{hd8?Hn1CSQROOMuqiz5650dme_+a#GQn*nRaXpIi^QhB!#@3->L1okAKkj zO7}7~Wrh>hR6thNxq)}%Ym{%l#1@hg_NAc%!E@#|8yj?_UEf^?vzA)dyqrI(k<~_z0)b`j%a32hk3r-7$umG|DdnX7 z<+Z$;7F$|cXy<5fS8~ovA<;DMPg|@pg!AG^R-bia(wu_Nj)WMy%Vk4(CqBn*-1B)Q zCz;T7f^NS$m;iWUhLbh#kUCmlJcs$_?6Bi_!->5ya>+W4T7nwr0(z@DS~tMH-wmC~G zUEYuW5|M^2@Ek}(_?}0j8VXjma&{6&t+|iP*h#I8I0<(y z&%4tboM`^_DB~)X;E1~FkdUX*)ltcBSvwx+4{-6` zqrU>2R1%et%f{PUdvQfyzhn*3musomG8Jv{;0P@L_z%R&-H#I5X^N`(UNhtStWFfA zr`MVKb4_TB&R|oq0#kM~V|)|;cE;ODSpqe%8~tNFNZlsE{xDaJAa$n9>nEA6x0m0P zV@yrRk9$!ZUB$KH&-uQ!UThdl)Z!M}D7GUs>AJl9XY3x{zTLgsMgFSXb%p%X{*cmz zkzbp3k}rd3e58=(G=o1`6P($#OVrN)BAeFuwPChmHx3tVJ@IZ?UM#qYJW(q1N4oGl z?e8Hw+x1yp_3KcL_tiHC6QKDhSjM0X(lKO8vynakc*zOLW@-GqROLKnr*e`QR zw&xpbisRdDjlHb3lLEtkOkp{p`9(yb2rIe2QnJ0$iQ@CLF&nptcisO;xjAE{vVlcO zup0>0o`vsH*GwFSEoCkb(3jID zzllp1Q~GE2q};ur*6p!VD92+zS?=k%9;Gyf@;Fo)73mF;IMYCreMq71ZOQvx#D4Nl zBv+N=W19tRtbAkVIKH8F!;F7_4<7m#8&s7v--yN+o}ELVM_V)15_J3R{plDy)z4vO zzdoig0<1R;42Exo-*#xc$wp`RdyMO4-_oP)3HZS4Jog(4&(?SgEUHvknKpRypf-Zi>(GS6ao-BmayF3H5@y4n}`Hm|g8~ zc-P0|>o@ja`w)-*xNIA1?{-dH;Gw7*Gd5~GOwmK}Rxo@{kC^(5fxICm+I!l{0iIoK z^F9}S=#uATAeLu!s36{L^Hj)qk!{Ab@P45vT90|idkLo!+b`iba87I&eJ^&VC+sTH z+htD;Hvv}*H+>SA02JFDXXoDm!O`|+c6GqzhNCQ`BTPE|vrXZabvma4(OORT73&7x z9d8#w>#4~{r9qTxDZD(c zvtHJFGKvb8MRjFbb#w^b_x4xlB%eI5I_yK$?+;l8&GGuSTF;eCu?2biBs(t)8)~1M zg5|1-S^QR=X1M-1lB-v2b60{x>C)cM?Ho-9C#?<-xQK8t_DTLNHv2EEt9YsP5+S7@ ze5m}dVi`VSYDGLsOb98<(EqjyGN`V|G&bjdR?~p@p~*1l+MkzowFuX`eYfC8Qt;AU zg47RYDH+_nhR;aknl{8SH~b;h;hLGSQ2sD|`2e@*i2SuFMHxM7FUiIez7QR5mW%%g zQ>>a!4~I$mYXT)nKIZs{cB3hBh*W4IOi}bR-tDPG2HBp^nNw3XYX;x;zZbgIQ2vRB zKnee~AHFLwwDxa1mve#Hb6zuLJ*B|jwF|Zjn zKgch?GG{{J+gd32x*8qrrpW4t`e&FQ{*@JY^VoTQniG`yxjxY+dU&>~GO^RGX5VM; z>ge`91Et?!2_|^EHPt0`r|ZT~yZskDxb7pXFy%e_miWbAO3euF2V7S{rpb%lUmE{? zvMBF-T!0`=|+Rnc7}yLtwNZ^#>OB? z-{eDAS_q|=gzc{Ygw{*_T)6GYN8j2GPsLb%6tzrT6HYe+VMA>cdA2!eFdE-pfdI*`mHL&)dFf637Hqs!ud0)OXwjfW7>4qV^3Bd7KD zMkH%r*&K$PV$h4+9qdP4ez4DquFH@Vqw%_qC|_-3TN&u|zNn$^HkDga9}CmdOc|u6 zuV~^}Ksw|)=^*q#^^hn+bqMRu66H|}HUT%nS}T6a>cg`OeQ1(j_2dk^k*nWAB!QFQ z0rKI%Za^k$%)EbH*vS~n0q+7Sf9OgNdl{w4&T@!D7Oj>*ZS>2&HT3Ls19`;qNZI-G z=T}Rf-^o33HwVi40^M0_0OMz7Wl6)?5Fl3~{vjc7F$h#!lGD?ho?`&|@91aO1mSX% zbaQwQ$iiPK0>>EuIfSX8Q)Ig;S}_Bf7jI`Q{QMcoED0bLVCFwW)S(y4qA%534{Q;4 z+zkxy)hC^U-@RkJM43`kbCuW(`KsQq1Aje4jA)h(6bx|Vkgqtkq6K=wU@sgW#snCX ztt3<3Df#!(&CShIo85T49U+cgf-h3PmAS9VQo_d1;abFFP}QNYTSOr=ANHXQLI7<6 z{=M|d&JRz|<;Vd_*V-Voq|=o{0;)*h@O5%wA@LDq=H|j#hPd2#L0xYWp)H{EGMbP2 zM(FD=zN9%Kx`{f}E$;2_*H}+Wdwp)GChd z|1B2ssUe*4Hy2=M7mZ|5hf}7tO^zE8=+^_G7(nskLq=@hLgSU49Xj3zh5!z9_S3?k zpbaiDVpc>ygWjW0?j`?8`3?-RfiNO$2GzQ1A&i+1SF25m0c4ii`mkS!BQa?eJm{-U-xXfU=dGe69QZ z%^4AJwJGzuP6%5k7=JM2j^@h;ToUT%Z_rt2iuswe_ciM_3(Y*;OBpdRU7-^icykp> zPXUWokd!%uK3L>Iic;vq8)jm+nxKD5TM@_#UqS2wswkk=@#V$pKzRAxCXu&FKeic0 z6BcaG5QkR8EP&Lw2HH`+TbJ?;)1?eBzY?B*bYbNX+81%ffNE!EXN#on$33!aGV<{` zq!q1~mND!5{yiFLU)O>sng7S<`>Q)OMJuA$rM%Jf*4B zy;mk#1E;m20yolj{)Tt03Kt4IvVq>kJN_9i)_-p+{X!cZASC8yweUX%IcdtfQ zJ6!Z^j6mI7E~S&pjuYRu%=7ra5p%V$kB?TLywyP#Fwndv1Cj|-;yjw=|aLA>lcOT8d{l&zsKdns!u zS%Tuh5`43VwR#{eZsXrNUArj@4TR|?ffyF& zYgbOcO;>$WX#k{**bldi4zC|^cy*Z_*a#5v!s{!6VOMcZanJb_u>KNhG%#7r`qL9? z*0A{j2|+HBy&im85QrT0yw61E7L(Qw7OXOql$4Y4M3x8eKEf6>boH3$IdWJH8+Q3( zC;`ixUdzeMkrJn=f1(i(F3fP^xm5{4|YQ(jklKA3U=+HCVYN&jtd~_Jhp#qi+*?7eeBoo+wntaWwmwd zkU)sgtQx=jWhdicBHS}XO|r*r+4ZM@u4C){?_Rr)7YU0e_cE7{j`HfIY<>N9=;7H~ zaz&0)m*0WS@}&s)>H%LBH3t0EqCPTWF4>*b_qnH^NbLYNZLG+jw*`V2f!YC1Oa!2I zNMViF-s$8sr*oerogfL4v`3 z&%o3TD4OwQmvVC!x-%C8-C3Pp_})s?;FE&%kH5YW3Ug6dXmlhy4$nKj7UP{YSb9)$ z7s8_!sT%H0L3S{>r}GcRxhJ75ZEa;4&k${Y7t{>4`0>&e-z6G$!TTUx--0Pr3fg3? zDZbj?b4Ox{^p2sNJKIp_NncuU6QfrU40hkC)eQOaSySR*MtB*de8cnSDjDQZ&T+xW_0|kX(u@^*gD-LOzUhVFi zVZiWGijh@Eu7?D)j5`YGq}mxS2+X%i$78I>*}E- z7kI7!$?lCQHZr-o`U*l>U!M~dXZuwL#muGXnQhEcV5^d)+F@64DHZhaEP-d&uQ~XU z8yHED7T%k(9HeigDe!3BAc0Cud6V>8gz1Uvd0q< z;${O`jm!&=IU;x?tZkg$0TWadT~z(x!2_tEa2!H;k0KF24(<6@QQ9wqNDQa$YkCd5 z-uAgF$7-PKb~e%r;X36+bQgM|Cn&7fVYNK&!{EKJ?)jWvLf<*`$DUGcb0x!kbx8a+ zc20t$_6!Y&J5?=T>*nanuvK~Xq>&$;*@sZrJ%((naKB6jR3rXc6A&JFGWVkDXkPDBXV0wjCnCoaD5YxI< z)zvL6E!5T3waIecMGjeC)dp^JdW^~VIqR+mRU@atp$?Q6DjL4R8ZJ!kwWbDBqSk|6 z6-kvkY5fmDXY)QN+$s2;bD`CmK*sJG5`< zLk3x%pv932evrd;kFV@0rg?!@HzXzUEUB#@LDp)OF|D?ifts2+-HT=@-xXCptaEhr z*hW0sIyeWcR)JQL z2_eS6Q+1yc3g8AluGzHeGBYVqAW~>O;q{4yKE&!(i7e|n6#Ck2OWW8ff$CvQDZrfz zOi|(5G})<#>8ZuV{24N8KoH&4c_LH|Vjb`aZhl(8m*?xdeC0~dVw?=_IU9(+9XKZ_ zKG!WIVthz2x&BabrWNOL5%0)URA@5= z`1xDjO~caD+OH>Rj~X(+8vBSP3<|~R0@w0RXWoBwI<)r*dr_yUkRZb2CQNL~@lRo;?>C6#6GC3R;@?Y~V3>hX*KU4Saz8_5TEm0(T)VKfh1c>3mS5yj6%0 zD6b((-LK1eshdOTbl41J))dHMFZubG$`~pnywz0XNjNCk(e?m#+-0l&{6^v_9Wr-B z9Z-phj;J7y8b8>elFVge#4q?%68s>f)O2?;ZH?yxY*3vUS;>kOpsJ>L3j?BR6&O#X} zTd(JYJ0w64Z+zH_ek_TKjlJwvGU2JJqT)xiO9B2hY?qNf@OSy{&nh!#t@j6KJFo7q z&8@PO8N4i{(q}aAUPy2`#aC|jnHVpx>&R5G73BQ z_Hs)xcPuyzFjvY(-Pyq5M8e8O_fMa5Oia8?ZRQ}w+CsPPFZJ}%qeqIRYQY_Jdm+|n{(_ieTEdM363@`x%A&C z74-Z8Vf;pn;=P;qeTBg@(a#DZ8;}GP7(H(TNxy@j!VtGa)#K|7g>2y90>d(0a=x`l z`Q{(WH*b(~AT9#!ud!dHLM{rjQf2QB*RJoQoOGtfx`q zFvh^>gy4~mKbs5-PXeX1c~6psy%cqqH>N#{n#-Rj{kt6)z*Yoj?E|aid4+EJgxA@z zGLegCx--{Ky}k=SiPRwJO#AYd3cI^5KP6t2=CB?9fhak`QHwaV+CH@>wDlCR`~%-S zTHlOCG7V>;%3{{OF80z3Ey1~^TwU+Il8-A{rSyGc*h5{9Qm7UU|-1RJdx$u9tkn- z~ytGPQKp z!rr+&#Y@`940@zgF=6j_^o8aZRF6m^vEaF)F!bL@5pyPwI!mEBy!oKpXa=%?D81RfM_hL5g z9qRQfnH4Y1&)D>YKqr{6Ey@axuy?%ow!=pqz^|@dmt38*iJ2>2W-06e3BqT$i#b+) zxrt8VkB3`q-&gzlm-pKrBbGZJb_WZwe*vtnIg(ZB2%=4cT^6grrr1xD;THVgs1B^V z(rHNZfVc+%PmeI&BZe2g5J1whRA>WaPPR!Do;&#(j*T7PN&fgNmK;w9yHPDs&Ac>= zaBAzaA&0*IpgQnfNay=>A&qg}i`#Mtq7eOe0U;r)HWz?zXs?_m^RpN3-Enbp0vL`K zxg5amp1MdQ{=$gp!-X9D4O^WBkgYIZfYRc)XT_A zSlraqBE%|4<0WX5BdNccJ&Y477dX!(tew2&B^(80 zgHMYJ+3Zql$oA`nElWvc*Mj;Q-)`;7#PSI52Eu#dRFu+=_)IKN5r;jNYh1T~ zyfs@2Ot@c8pjhr~ix2Qe)_(8n7_)4QC%0`-z5y7BBXQw`$ZWU;Kuz^ z9*~hKHvC`lqAqv;RYs=Rvx!?XmE^zgo1cpN--Qo<|BIAJ_w!w^xc`Th%MK_(a2)?H zdkZ89sIZ9YF}*N$4YVb{KNI$_{}&9LveySrT!Mkt_!5%%|KO~SjAae%4xKpok1H&u%#&M+iT|; zUxRlIKG{u{FqmD9e+24|(jY&6=Sq_wm4v^mSmN5&m>(4rn4{5$7~^6E?w2u_KH3*N z2a3m)T_FJ{wGQtB54>GAqg&>ADH^SGFamgV(I8TczSCp1e#to%jkZ%fG74ezUo{+e z6k!B_4Jd_RJ*GgT_uJ8GKd3gij9C`|8-0C!UGrdyA~46>d-g`DnA-)(?OwW~?+fGm z8e8^c)n;8p&eKeyhi%`HQ3R3ewEB(V2KdQpDK2mA2DM#MCjXcXd}%nz&~`Qvn=F@? zJKZGC90xQAXRhN8;3H%JDz>cW0_xy6k&pL8by|ZhJV0`_mgLG4_Y|1#)f_G_Uw z3Y0HYDV#fti+~{l@O7sOWS*f}0otOWu=gh%e5~Md#7tm|5A576Wct!v#dvtG5s&qN zGo11h1-K@54$d!=b~<2GwX4q4k(Hed>fR5)a2gOF#xsC08g_Wr=-WxtR>8I42|*`O z>2LL5*dgm`D__Ol&Y5>{UU*5N$Z)S#WXZ>SHkPSVl z_#Qm#oB!If&!9@W=l%eb_oKr1OKrsHqlRKMYsXC#3=B}Z=otAX?uWM()jzF2&i{** zoa1K8c?7ri=yt?iFE4RGmlVow#p-QTy*Hj~ocWP$O4H$_VSXC7Nlik8f@98*`^+<2 z!Bu`4&RE|#O=yt*5pxpLWW;kPq2pM==?yV@CB>!|IE?`V6e%Un&mZpaT+ty1GDm2L z?(OXr`*kg)=q`L1G;n(A8W?bqz5&pK*acq#RT=Q>jZZ4OtO~ZAaQs}|dc2>I4}?K*FzoP#r{VB1ek0IsORgRK)AyHfuTWArTZtyGLw~$L$^H8+$CVh0Tf{Ae~Uwg zO{D(Std%q1t!fm{IjRANEtmthww81aiv|FlvT;8LRaJ}kq#s&uz>Q3;Tc*6bLrWdh zsQmOPcnwCZT}JFwZd>3(8551KpD8)!Vm(|-q?`$a|y7=+%>z1 zjXQHT2Gj_J1qOTkq&Dp31n6`*SU)Icm^w!cn8vA?_T`&*&Yv?z9MhveIjNtWQ_HW7 z54nrAhG>w4!RT*lgl{R&Jade(0{wreT?5prTME6U4{tDK&|ot-%eqW^39D>IHCi4>bXV%v3_TI$BrA!fjnsFu!zFw&#w4w;tL!Wuz%F0Uh8Z9&{GlhQI z6TfXjZ|O_@N&kT?KoWHSgwRK@{sK*i_w?d{L?4MJ z9u-q?O?`AG$JYnw|Lj#jtxmsHf31|HYJ`*T^Zl&%aK4Ar9UOsaMw(x@+m@w*%3kKg zpYW*K+8$Tr_bv&6+Z#MkOdn*RuIJ=x0%i7SZOEAx4CK2(;k z7VK_D5K(-}_cg&j4{Oui_SWu&k*qN6&7V5j&(-*INF$}f{n)n$2mbX1WhC-s)lr-h z2AE|_<}YI2W2bh+ppYlXbY!~9&LE%@U3FnspOEUA2fM7N_edJ?x^R*Edv$y41NQlU zL94!*Ye=VnNhtGOIqp`Y-|Zd)t3{tM1X|)UOgwp*n39}PO4;JH8R&^We)Qz+2qxS1 zl+z}SQd%`1wTpXudcwDoRK*R?Hq>WaQkG>pE1a|l^6`IR@*q4wEbkIo(}%<&I;pMr z3oR%3;(yoU!P!JvMJ1Is`t+$&*UlW*#6S(jDssU5YTzO#&luETiRa-vS9tm4k5adn za=a+KPZ`)KLc{z-W*186=M6QuOqb!K?p%o!Vt>ll-5{M&9 zm-^&u%H|^w)?P~0@nbzOk$8}Egl3n&5QRMLV+hR>OKPH;If$5FB3sEYGBjkIX$XLh z5h%~<)*3BdYx*%Sa$&jCgtt&8Uirxrk~mxwTM4^=($eMf4fMjQMYbhHA|404l604E`R=b$BFGn-+?(9%!|6v6` z;2nU2?FhkGOe}eOkIcQB%Zb$Ur_=CJUUMDqsY3Xoy~iD$olFOebW68A_kISuaNpS! z)c4-Ms(>tuO}?t@LpY2urTKv?!}BdRt6@3AVuys)sEDD7-v+#(BDKYfs zBcB~ps1=bYU59qdUkF}k`>?i_@6gdz7Y7Gm==V^VRtL$5?3^49JZVzW;wKnBT0?s1 zVuw~wlfW!#o$GKL-nKB$iaPEa(npIatIl+Hcc-@cpF;z*uRunqt3v=~WV*mz`1v(# zrY#+T^jyyJYb|FKMq%RyI2V6PA6)>i5!lc>%$NuJ%mx?AI0PJIea>e<)T)m86G$?o z1zhTWC9<`(b#rV)&0vQ@uHN$>)P-JM&{(=)uTqxv)Tgtf7#J@LPB~6BIOq-lJsrCD zB~P<@s1E}i)-FMooJj_m3LL*#k^ki9znEl1YV8M`oUkO31`F> z84O7zMsP&F*IckF)D+_kM2Wfj@Z(1>x`#a|(vD?fydx-xyz?m`I=V&FZhyC@nW;+J z$1qQ_ydV|@sU?)?9Hyt9-!YLbz2kdvKnC=E*TtbM3nPj_mU2QeH8lgAn-BuQUBQFN zTvSaRg?1ge$tHulONztE;X@~AWVgfYX zt(hDWA7~JUz#v@D_GCy~k}3`t>A>_YbF#(y76(To%$#Ycs6J-94)2OZglAIZXVjj^ zJew2Swgw}}1(^v#YE){USaZQjg2m3dT_y%o1yz^+C_-EUR9%JwVwt&`Zf1i{Ga$zo zddnO@p!R{5R!lA)wH)2Ny!8dZzjN=$9eP4`p@>Dcj}7);y3EZPz{}9n(=+z7YPl(|Y*hQ}I$$nvIN0t* zdkbL2yR-35SA_Bp80klh!a_*KuFG*X(Am+N*>(Q$fq7;Evf?)9EN)`wMFbnEYCDmy zGzLoXu&=t$p)iqS^15w0$8((X$SlB60(?rxDqRV3M~|H~VP|9Gvz9}xJZrFIyhZlb z@>C6MtSMwZ(21$icGp1to{1V!Q#;8Hvjse(icwr&nkLx`2bPs`z=oh+M$}C1F-&M% zo$XJEjbOKxK(0#|+J7RVpj6wv2bm;@g7z-+;;~$j7w2x^w}7ezM=)ag7-<8%xx(;w zH$$(VZt9V{cYokg!71(D3;~fAZjns3&7?Q}<`TbL#a54AxVT6Qy-*zjpXOtxf%5@5l?`^r z>=(nP1RD1Fp!#ARYk!JptV{aBhr-Z)MCX`Z#?yJjd`MJ`fx)O*<;($v5i-R0QX4wZ zFrt7`QJz#h)Zx08?I6*aKI(ToGmtJnXDHhJSQ1dVy5}Yz*-*d*`D8C>U;~`eBd1A| zDlGCuF7|{NoDcW|i2*j_a|W?)}Qr=rGOJ)WcsYEqmze;^!#2GjwZN2hhqz2c4Tq15LaM+_{EW&deyFGc4m zC{m}s%XE5st)_Xl28sO&Ss-n>x~ghRy&DfX5@so6T#bvRx=Ki2r2?_y5(K_zOZ5GeZ9x`Pc5>-u3m+gQc}p<+32i^ zYtq9RcO|JpAJK+1|FEx^+?QYN-4IyNNY=>C0>V@}eK`)vmifNyan0k_Y%Zwt2s<_R z=EOpyAf?al^m!+FqAB2iEoMAh>DYsyY~MBx`pn(`QO$^X#|S=MjF*GkY(RdgW7kQv zAND8vQYEK^Q2-+{b8^CVL3xF}C_i|U^c7|lQ*NZxxx8fzwM;&SR12`gAu3TxuHy%c zc5ls|f2s;qL*fCu7X0%j1=BabENo2cmSm!oU@lJaghtCIpvwb4{<+JEBQhPXNP2rd zUalAqWJ6{NP21}3OE*wezubN)^t`u_;>E!D+LTp@Z9y`muhwp>HxYF;^M1&pTaO(! zPRh6&gbIDCwqDsWM~km5_!j@&LDiqY$i%w_T|=K);xVdzB6olnyovy) zdoTimRSj-{OkhJtAA*ge$|e;AM&I*0@qAz5bPQjZkHe0MOd7d#q=~%3(x+!D$XSLg z_&`c|{lOXX`nzDoGaRlWeo0VAc17FDDu?`=a zx)}U(7KAQQT3Y7ktbMJ0P-}}L+pL>gl9deZV${;pfK-u~$`&h2R>679$}gxB;+cMF zGA7?Zy$j?1C<7$yU|H?y_D%`XwLf4w8y*>HDdACawP=a&5@j29xN)n+l1|009V!x2 z#RRA9(iumQsY>3V(jHS{8zB3G0_(Mv!l%IN9(XA)G;MVU|xIeZsPRc&gKFd z14rklUnA(k4FJEn9TD5l{HH(i%UY*oNHCpH$KW3AI!lV1O}^hK{~ADQib=5@^c2F} zxsuQB0>1o}+QIK@3`Xl#g4d<>L@o6b_hcw~w`vc)Jogt2nzt}p;?Re86<}=QF}8~q z5@eVz>~hg(5-i|c{!+@91nTS}8Qd+h{4Nag$Mfe3MasESuXJXRk z{{Q5~iB}ar5of#J{i>Gi7iatzf}P^#``>_ShbqRJp#@l9O^*u~)+&SS?3=O5S0zYRS?*Ox_WyB$i;D7fW(3$2}mR0 zbzNSY*Sjs1^#6*(@1-YMND{h2#_ur@zOrwbBdt9MTic(TIX|1BD{jt|e19o9)~GSs zI3aY1yRvTmV*!>qN7?YJj70a70L%Sdr}=B@nI(gE7jR4wQups4b6)&@&A`gSqCQdF z1A&MWvJ<2{`V(Jku;wWz7t}t!w7A&Nksx}?KxHl?sCnWh7gtmWa9E%xngsD3<0V>Z zJCg0@V`IYs*;)EB!7Va8oalg zCJ%B}IXYt;aRU8@&F`;%2k}VYR`a70z}_-2AmD`c_fI6CW%MsN`rG&K{=o7?z^#)d7GTJiW>0F0Dx^yxTkK6-s_p~o73 z6Ij)Y14U+|o-;uk@GQyT4ckDZu@xSvJ>0D|hFjk5$&iR}Nj$XQRx+paq!?Wd`ZX08 zWR{)7$5MRoq2lM~SHR7B)9E?Q2UNnizd7u&&&HEl=j-O>=ixCyR|wL{Fh@g2CkV)c z!WH02l&y}nlZZR)Hfu{BXzGf0R{ z2{xGNJ$dpHetjnXLIphQ0^{b>!f!4vl!1;%-K6vFzJ=M@%xAu;;TAulZ$@dl%$MGQ zgb5ly?1za;dcvamgD~ho9Nb(Q5=t|E1Lv^{A3lON9njuly=37*{j6T=5I(W4)ZZ+5 zK=cRJR#cfK3~#P4!?t^0(`{gfuS-CLLio!2>Y;8&V*N4vt;9W6{1|efFYo>_-C(kh zb(2ZfFtmL1#p*?tsszfo0cGnX;tj$(igaro+zON7aRVPqPw~wMi7Mm6gZ=LX#^laR zgN?omVmt|9R5CIS&+r&8;$)hdfLmPrUO-xJ$jv$dKd=*^{Fx~|1y(Rg@C3=Id-s!x zXLJ2HoH1PAz7kXih^hXHoSU04jQ_hDkFB;HFo*p@I;vsdCBTZXkv;V(2Q*W2PJANs zleQi#Ci)^@qNi^Hz1H(P`WutJme4Z*Ycev#u6jk5C|UiKVm)xK9noz45C;lhyk zfqqcv`JQtx2X-8d^iA9;V20d&e^rzS3W8_NxQn$nOGeEa~UNbu%NE%`?E`u1d-2HaRyc7gTT8TP_3>A2_<&49DGy4 z|9N=W^Omc}#OiRri1o!f&V>WNB}9|Jx_eRd7kT_1-!EKn)EMf`=w}M_-Z2Kuy4c>T zB%Z`Kp3qgX#b*Se#6AWB$s})w z^H&I@sVON&(quI7^qS(WOF;3T1c)xN?_y~TJb75J2T#Lsr0Q!|7tcbB5>)L#wH3Oe zTACr06u$GGXRbdsL4>^&+_y_mV^D(&0eQ6!LcU3odp0N# z@sspr6>|YIR*Q)&TC6Jxl@SUt>r2u;e1`pzg*6533BX>I%Un0Kl=`g{(J>`S(qhVno?eRHWe5C8# z<+kd@b~x>Lr`YD#`krsAVcFTU+=pE>QJ;0Z&mL^dimsN}C>_!hLv1P-=ly$AjSzXQ z)ccMpoFY;LSRlfMs-!C5JOi62-uUtIAda$-yN-V_;u&%Dn?^1LZua!QJAF>bW>8f* zvIC+GQlC&Cg<)XwxP^lKp@k$xQ_@J^h<-jvEf)=*Kd=Fii@N*_$6gF+CfcX|U0e`x zRVV*$>C@<5M1x4Lh{~(9C1{4E zpbf@pHh*kU?-bhC7$RWS# zdjuhUx@@CzAwNud$dKFIm0BMHB$R#Ri>ha=c7lnn+5n_P>Dr%=SPcz9Ac+4S`yj_z z&m5)u3aVxnI3HKnJ2MTfU{VF>lRzyNW>(?)AC;$}9sj|D0*4tz+>8rk8nJ!XS(lu} zdMEybIR#*uqBlctK_8?5PjqzH4CpRj=B>8B$B}U3;GLqk|5G8O*vQDpS4!ugzXe@X zq+%PSQ)Y`3zLpf(d)6oALeRqt-AefSpas;+G;x?l(okW-}ZpqUtY(B132-t$V2YUM>Kuoe?R_u!C4!wS~EBOPwr$*R7 z9@1P$HSyrEgsr2wRg!MYc*=AJ+rGl3q5BShI44f)SZlq)B;47l?{HRK-x)*M6jso$ z?{P{=eB*+?$5M%w)nC~*snI7JCqpJn(?H7eMSQEUstZR=A@!-IRVrv7RI?+yKKLys zFYi9|{Ya-hZ3x!td6|3ZW{#80eI3Zq3`XVI1>_#+(If1o2EbdXRcslwiKnE9;eKhT z4C}`<=6Gi0rsgfnfWUW~38F4Wj*k4Smx zb;=a=Pv?zNw)vL_M2g%bW05p?!sZPzw;Uq40Eu&ncaFrvB>ndsym>ORm4ujK2pX}S z!;51DV2_>euriQ?%IMmJdtvI&asQNRTQtu1MCqKr6Y(RDM2pQ*$N0^gG51AXwr(x6 znJZfD&(kr})QE(7!u3t8K6y?O<_?L~g^x6~BWr4p9-WBf)C)|Li!uUo2*MZmNZ6T^974vj#0G%Lpcl; zQd>9qsLV443y>XH)5J8VYl* z2(FEWfcP%{M)T^wh%XGKg<%BB3U#Qczr=Yu;2_)_bZhxwZn5t3YF*v z9xy5$CFwC$<|0-1J8DTr08}4h1Aj;_X(O>P`ET%lfY2?8PP}o)^;gm~iy1i;J^x;= z%n(7|W4|;F*^#+G5#8R?>9Qkvw#yUb68USZ2=+{tJLCvqX_>M0VAecE$0K38Pm9LF zE?-h7s;4c61wVe@9{J(JxgDL9Qpt#(Yp2Tx8iWq`=c>eJ>XU@@C%mAXFRqJN@=RS!*XV*?1@(T z-K?~ytEO=|Jvmevs~Eny!$OzZdYgo;m&-l}WzLpa1*!f=mgWW3Z#bH~W$H?a?Q{C% zY{@P4D!VI~#(qHVau{XPlQ#v%gp;j#6ty?4Mo#to(5;FV(Xy`OuXx5`J$*Ze_uAu+ z=ea&?P>@%hX|=MV37=H>9?f|5zVjrD;?<$8V{2mW9reQGjQ0aCtnas*Tc08Cbo&)A z>6(al>sa2KWR(mhPP5fkCGWx?g(&#JRFJ{mcx=b0lf$n#$p|W&8ug6ZI~xm8cN5EO zG1~e*Ya;?W%YAg{$fe~PS+vIf^^CHz5YNf$t7SgBWf1c{O>lkEUqNMp|K#&n3)*4& zpT*~<^BfiVN=N#t%F8u{jw`2UWGuXD)gPv3Ogr+bL>srV&v3Zid}DI!F_#qX9iU^e0O0ZMs&Gah1i$cTzr)!B1g$2YXk}o>j^ZY7f zpg+B9%&mv*j5U{|qtVONYl>RBy6f>J=IEI$m5lNYS}C~-Ag@min4x;naFO}#-BqZ` zVWAv}IlkR+UTJpi(+>9o(KX$D__5BaYEF+0lN`wdbQP-Ss$7O*f~CkWtNdL^>lKdS z7JKZ<2?`)hOJG7jX72N^6m7{3vLua|mov#)s`)0%Zq_&BUIF~0hUKjw{Bo3%*Src7 z(`uHI*JBW@A9kBbpouVQ@_spz6|xV)f?A~k^D2oVPLJt57J0A|NX0kcWaGukU3}}({vgW_Mwg}l3W-Vd4WvL8r8?$b-yw%y>erNM6&Z%Mm1oDi;Cxj_NS0CRUe-Ux5K3cjj8etYy$CfD^a^kc0L~W(xo8vt@ZrrfC_77@X?hx-0Ac< z@Bj(NDF@Wc z8Dcs_yub9$&So3s8wKgbZe*lb>(?5XKO&o2o9C!ZilD29)9%Iy7n9tK8@0(D=f&u$Pp z*_D?pKx;G9gjZ`TQA9FMwT;t*78)9>Km+7`oSHrYgHXPxacL!8KYRrj7l zHk7~QK2}HK2J67Y+B)~==P&zPcrHj!!bdYy8EAgO2&A(<^Vcn>ds?IJ#qMft~J*dVAoWfy>Cv z!>z3YEy=poesryN;=wi=JumXf^Joo8-RsNiF@Dv=o7eYTx$kzki?@q0b-#6FG;qjW z?e+zSx}mPFWV{CH_qPn*<&hjauoOVwWCve(?d-GM7S!aV*>yJZr zwR(x}^S7{@0-~c^qaNtJ4THlH{kLAoVIUq}14>RW-}Bej9P7Wi06hoef;xj%va!O( z%DD9^IGk}vTb$jR_-ygK5+)pWF^RYqBDI1nWm7Fxs4od^QU7n4J`LlfUkIkX1<=SC4}ii;arm;>+^Zu$u>Dy zd;JBld)eomGVXrg+S0Zgf~Q1eiBIrJP0$FQ&x5utXNd2^U%6y6ji>h*=`IZUJ{8so zHnuBNhvloO^k&}(IfM}pwIVG(*KoG6q#%oH0vqr?CUx=gschLO=+7`WH;03$AtdBF zZiS>Z)KIw4XuBpBLcSGrCOhr=uEA9mX69A)ntD9DYHj7n%9@x->B0BIBP#@6LcyDRM_{ zr>lZNq>6J=&E{~rh@J@xauWYbJ}`6gnIam&m9iawE|H~fyI^;A(-l}2zP1&;JuCav0S2Hs zr7l1AkWxKK+N_rbC;JR4wbBCXA;d<8k50^2};ZS?`+x%B) z4i3wKjFo|mqCo!APdzsNxFE{(T!@W>*Kwk#11wXq0uj>!+6}S?Y;-k*WPHcd0xg#s zJ(#83m2{k{O=(#o-S{cYk?{AOv-|iKo4GX)i2Z8j?yKK_`=o+`!tAe+r#QRik9Ouq zXhk{bQO*qWdbb(4q~x#xjgry}Kc!l=y|B((O0gB>C zpDX%Ir_w`ayc@#AI5;>2MtxL~nMf#PoA@AW5!3~!IB0s>7wPKjw}&kZOCoNC+4c1y z7aZNl(_y(ByycrXtc|8#{i6fl!zCNf$<1T#l*|c-ay^!aoAf)jslhvY5`bi1M>AKm?tedseU8e#gdej*XqwID^}kzh4Dp~$FKWU!$=o2& z)%)tVt^c8)D{jw2OzpUA*o71jyg1&t zaTesb#CjJV=Kixza1qiobg0v?w;u|K>`nMu@3?`ssn5a!}zz zRe5!xcg+4EE6ueSGwN3?tIc!RdX4Pd)O4T`8yLO(*0b;uXy#|*OF}Pb&Y=jciP&Yw zpdW9!i4G!g-|bP*tlU9fkf?79f(2kOL4=uDE)myuxz@TV&;Ll=m8}oo z?|#}M=;da(7;5|1$L|+-y-I@%dJ90LS|b{P_7C;g)azmbl9^;tVb0t7AkPIi6TW=j zn_%0IN=n+r2ldZWzv``};vGP>hZWtwzpLVIuWIY0MqF4eEFVy>wd4=yU|DoT{QDpC z;P})+3@ICl_Ad5_yBx`_FTm2uy?P)HxbhZpYMw)sl7(eYxt3F7R*hR9a=Ex~k)S5Ehx$%zSbV)LdJNe(%< z>f53othz&a#ET9ms64j=@U_Q9X$84)p_+Dq`p5T02Mh9_GA$8+Xn76YT+;11jK@E5 zRGnJ}fi_c{gMXPmHMJW{DdA*+ydx(kXR6(O?^k2v&!<7VxoRsFe^{7@b_O$`$)e)7 zKLIzJuE|P3$b*}l8o_|zE4dEPCT3>(-qL|%W+S6WWCCf-pN-6=8E=u#yGQYV;%4xsLU zPmazlRC^l+3#A)W8>&IUq!y)3cqk$2H z6!z0@&k1ZsDD&K+z-m+F%vw-qmgu1Ri*)m6$mi~tMJ)9?r>^{{!pP>FE#-p!rFk2) zh#SsVP>+VQ3fw{$xll3Zd^Hz@$WZ=xjMAj(E8;X@i>KlTPCKaE!Hx>n#pVwD*4@uq)hB?f~1udNuL(-jaR+xge&8l2(lkqj(K6rb(akV|rK7 zgGZo%Xed`F`vt67um)Fz%CX1s?vy-t<1h#islH>bCBdpy55v~3XP8m-b#-B?mA!PV zt|hKA0#d z&j6|ZOD*5M`o+bd$*HNX5~xvhJ<$uE%*)FS&OuU9QQgvmZEaVe>(x%$8zYBDk9u6H z>IR4~2D|S&BQYv;|7a)}e*|kn%b8#}*`bfQO;{IR%z|lwQT~MT;3M$Wo8SBbW`nP< zue^$iq@;eTxi<>Nw%sQ0`ba61?p3MyE_dsrd*>q+E_`?q{!w?$L^e@k_v2O&D2`m< zmcF(kAF`&Hh`Rz!1ljY@Rf#J8qK=(qEsKNJAQB=kj=>=S(zgu&Y5$A9OOsG_0)!2m zv5{<|igAIMb+G5^tjMvnrP^h-R;@{FghO=bq}ceVoZYH`>S}X<>gscuSw?zE8*oRX zB8#Lb%;*FsNrY^5_4sV$9AkBA#maG^k0y+hTYaiB@7yqTBVh$bpg56ow^2C4zFv4` z!gSGcv2b~4L_KU$EO8@)chohO_AdJZgg2&{rszph(8E9fbhvxB-dAs**OWb8O`H$Bo8n9j2O z6NxxS2nC>=L#ARLTDQoY)%4d{fGY^QDvqT%_h=AzQdFWkDb2c`KJnrzw$g zpjb>!1?r_>zXIPaiTJCNZ|@~<&238A|43R|dV+8<>sq5;uS_2-flKUuJ3^|H%4qJ$Lqc{!7u9 zO5LIXkn+Q_r|HqdVU^8iNP3^Y8WS4_o3!Bm{pG^9ruqU)e1>BQPyjvL>A`;aI`#r{ z1+Xw?$j6&sy#GwKVh4$k#F;JkHT>_BSQ|^#Ks)^;Hg<|Qwgwq~nci4buai;Csra(p zpn6?ehDMUYk!~R3wm9KD_mLA10%^# zg>~>02lg-;^yRQONu=o$nQ?d`R6c>#hs_#ga%LA)O+D6rfExPY_rA&u7m3B1kPnHM zuLKYLB-2JIe#=taEEbJA79lY^rONjlO}+khK~~0WflQjU(_dRYr|MI+tj}h~Qtf^{ z3Dm%s+i9|K+x-W9(ySwT)o0Hq4v={xey!-7UF5FDNd{mqt~u+~E(*F2nXA1-Hc17ALqG3YLkI}XMcZM^fpTb_ z#j(tCESBP39S9A4z==>N^B43ZIlk=#XeDt=ocHfR`Vt(TV=iqum9N$e+V)`kEVXu! z?m^&G>^xhE!O)mW3deOn3=ULlU2bn8gJv`z@;b@wmnrTYArcenH0G!IODFjnvNC_RUXC z_e6*i_s3W^RqVGP2;H7LqLwZ!x0MvZXw}=)T<|^j>e=4t3jj!34XZY<4$?ig=0=MHgtxP0TTMf%nt!{zYO6b{ z%0A-qXh?B=`>!=u2ijC>!BoQ{E^zeoPgPuSO3?K8)!2^Nu6GuT-&CJdEVJrtW}plE z<{E=_{S~kRl7&A@CSX-FX9<%Ml(W!kt7-a!IjX3g9BE-&3)Lw_NAw{gS0=qKJ z%EL6*iZ0Z9X|op0d>&yKeC;1T{3BbYV>Y3?*aJofO?KaaC&{cKc290VDdSR%(XOOv zb}muVajXMeFoLCD?kgu)EAeI%y3Sl^^iL8yE8(?IIoi%);nf6F^JD8D7QB1CD zW)K6P+(kAV@RMt4_Jw2uc@qBD%B!!iHKwbknWY5pdQJ3Bd)M{r*Zt!T4jCPnk(E^&n{J_w18xm!;-{_mIl1@Ch9GDF zm}k5(JlYC5m}%}tU#&Ps=SsA2m_2x9`eJ1=);^(^=owgMbwjZJXqf9R>!xpmXliSd zmFcdUa5M6+s6vYqP5eV(r&}J#AS-RZ8x0x5J*8Z=S%~@|pdYsX0^tH|B(yW)kcUAr zjGHoT>3|-;88NzyTIx2KNt^=f4Q! z6`OkSio&+^%)IJ`{tY>e8hZNfHL1+xTHaoo(?H~22q!UFX8J@3-$6710nYpr6{V1N zne3Rji|k4pCkqYV@B<};f7kF_0qe2n((+h;AeqXxP6bibjblE!L*dt*`WZ@}X4Wy3IV zdo8zWjiuUt{O}qMy5r?#2>mLo2^h#h#ByPWl#2hWN#Wy;BhbIGMZV{}P%k5($};}( zV?!F{E~5UGC3(T{B) zOL63TMu*V5q7DedytVo;cEA9LeJ*qu2I{!OPA-)59%8-n(o*{YPyBX1NGxVNE=vPE zg(z0?dtH1$(1_D?ZwgS~XF^H|n|G;lQDyYIzj;{u8X6;uKh<2yL+-1d4CTw0gRoyU zAw1sFLb$0w!3KAW8&Uv;mDoZZbblX-ZVyI|pMq6%V ziob~GP-t3%C%?;=_CEQqGUxO?Icgk+oT3KjJd$B;?rd};2zd~CCl!;xP1s*G>Z!2m z_n_^0W|BRr*@Jj#z4&uyuZh?*GhcymPyE#jgk)1@k+D>4mlKQxd6Q~)v?zca>RPvb|e{YbfVCNy=8 zUCd5#^1CW}+GubxR#J7_eJ*ov} zZM9#_Px_|bB=li&9w>%w6*nbjo1Yqc{rPr*Qe&;5@i_|?VqcQDPN$jt2yVfS>F$ao*)(aI%Q+Tf_yzZG0VYxg|(w-i-;pypN%9`Cc(}$AA z76_`mktys-ms)I=B-=2qa@O>ry@J^YRlAHRVQu(jpmN!lwfm* zqkGGjv8pw*$pcBcM`Sh>z;K4lvKpUmbZk#MwHy-7;a9sXww=hg_(PxRi+-4Vuuv1- z_f4_el)9{lL%29_w9^3?2I>iZ-fi%>sIQrU+0-(cV8heC&t+ixQC!BU$APvf~}Y#uBVNEaog4&Kv?5&FwZ#WS*Qi{Z^L4d~2r!hnJ%Qcf%E#q&@ zm4lFyM6>vj0p+9GN4{|H_G z=g$4Vf{Xt?+eF)Z9rnIaKavR0P-oC4Sy!} zzXbfsD=A6X{dy-bs$;kG0=U-VHnsI3(d>8>oZnzodh`e){5IhH80dTLWQ|7-L3%S z2gx?FZ_r=D->NM2AmWB#oWDe;>S^uMO_6WwsQ3U6CoNL|Lcu75pI8zvkbt(h=B+7?$1I?@4<){pzhHT-x0HA>b9KCfe35nuDa$8f`8>a}Stzt?I7 z&Pp3_2IartoWRzgDo!B!Bjl}@!H`>`c;LlFrb7PxRMk^fj{(Akd;R_AsR}pcyiiTK zk2in5=00VvA+_s!z;aRF&ssiXv(|cCojG8?7y`K>Y)TOecvhL5bGj?|+d%>iy*B4V3AUf06(#(Jx}_LM+zBL- z{h_3^GIl zzZZVloKofFF%DPf}i-T8Mrbf8*YRhHz*4XXF8lV;xmO1uPF;ecQq5!gqWv9{&gMeo1D<^u&iE!>2u{+A=qBK5 zK*X7#p)amfoiLySfDs*$l=NSOodzoGrrNEotzRPQiQD%j;QV3*{J_CpqE(FNAwtt= zCxkoqGK|a2D>tEm;AP@(mMj1g&$AB@W8nB8fv_>-tq6nr1JjCFZO!YFgINkhz+VuR z0iTHc16{ezp-MpdA&&?`S-^5&$x;JLVJ@ z08oc4-z>CrXH7!`Bp4UjVYK;o%Bi{)FLIDzg`*3yy#wdYb5Bp{Qald=D%1=yJb(;k(Pu^?@bUFwy5 zL0wh#7*yikNHhLx2j6qcB2yK1Fu2ggdi(e`KrrT z_Qvic;~!FqI3OwzQ1It#&W3#T12020OXSA#qUmFs4wO6=WnDQx=KVtVNVa9sRmdyB zaRAte7oCA5PJ@QN$I$J3;3Dilc5MWs&as5G!)bwzc!btW0PzfSo7 z4ndz*7-$^4*ei+BwbXQOVihD_59wdfVg{MaK$Zw-j*f*>N(g<;qvZ-jhp^a{nd5z) zpqN&jKl8izljxI`2Kj3FjwUPk`)IX4Q)}o39+`c&6z@T*ung(OzG1aWh=*1BQ)d@k}FzicMWzjPe3AMC^jv%GGJ2GikBm#G+A=8k9Q zNAV~HS4+*`pd&y5oj3AlPeH#^qJK3Q23U(Nzqv~tPDP=xpw~RACYu=TCsTBRu;r8uT=D~}|FB9=tJgdjDPLdMKf>i;sH=UMRfH0l%Or-dM zhKu)88#a#hV_GOMphdJ?xuO@P!uctApVZU*!SI5)B3m@WQSQ=a8R(hf7#eB~TOfc4 zQ$9jPM7I=Jup86uPaK7<6yWe|FsyQNa++5L%s3JB{8#+TN=v^cNB98^sdc#h&P9C) zHnhcGk$Pmt3vQ0Nny?>{G$GkTgkrK0NNaAY@055{cYr_I0Ky75F6;`yA!ucJoQiL| z@;Vp}`7^jHOwdQ-)rmb5r$Bn#=YNe;SAl}Is`Y3Y2SP+btfX5rdvGW{F(5d2(C752 z;e9iG;kGRSNB0(}^GpkD9Rd`i_arc!a;G0Zx>bDVf(VwyZTQzCDu%GC?oj?e3bH7lnO}H84%&cYc0lUJ;$=^v2ma-i_q&s;&<~6kcg{~OL6Cr zWIo2sD(~C2S=DdiS@kJlSZU4fRi z*%d+HJKo|b1YBuCryGD;5akdEfUD|gm~h`ku5z?jm1QsQDvlqz9RwBrg%MdJA67Z!_{xOWJOHbnTT}+D`oP&!!qulAeeoA z`x%w7!1+O2j$|T;7gWti-H-E(-KBO7gWSXH&$W11Ny z#aLu?qq>8tVDbUw|06Yf25PLa-GI6i_OpUZET%kAKD7-uILYEV$J`Ksf}}zE%iN4` zOKok$Xmmw|EuxP57C#8l@+tj6Lsg2&(hC5hfDD9CS%Uhcwab$yU(ZyZo(MZInuMX3 z3>$4y9o`D&34LCL_i*o__LGX(1cP8n(V7L_qkco3@TytK-^eB|YW@iCkT_r!H+UEX zN-)WrYr&;v9nz!+b1i&Hr`(o*v{KygbGt=_edzIi2*05s&k*YO>YZqy6yhj+gbkg(I#yU9bFrk+DK?*Zs$=Tf+37O} zGP$Q+PH1Xq$RM$@vNIYCY>D^Liy9{C{oUb;1tn?wht#~=L+XA*+AC+I`MlkZtGJk^ zz1}F|;Vvt#_RD@o2R=%fb&-$UJ+|QHlu_*)asYKbeBdJUn!+mVF`{n(>iv(9w#Q`E zc!9~kL)x=5$?K4|rnKzdZ6GZ9qUzcK4FNE$Ikjq`%~8Nm{5z^S{tZDjN6LSrnx#~I z-sjmABCu=3fs8Sm8-IhE_rUmWK1~9+#j+jD&lmj{u2xwV)t{J#4y7OnSzKIn*(Lk_aIo*v`(dnEzoOi*VkBd#$TXf{X=mars@ zXJU~R#@4u*EK>#huSXJ(B)lI8CP(Z^hA{|H{P&zMJq;&=!2KK^)s9t`RSoHoQ>5(p zro8Cv?fvEF*{Ygl`2L{zFPBo%V?c%ae+$tpfcmwA5pyaL6*)9Sj^>Kj^?l{Bq5@vp z#FygYItupqvsruoJKWvPd#Jp`x3=fNfaY!1_r9&B_py-a&~lAT{|35u4E5gYl3_-s zx!|H3I|j+=M{<>|JA*rh9!~jJ^w`^kflUN0V7`uaVAqz*z-;RiUMB?BQ+wUV+_S<4 z^|M{eTtQUAPB9D9)*g>BRd~D-js!rWc4BE)WB0^uJ5%z( zXCWWvSzKHkB8 zJ>5Vk%&FH6d)8xltrK_OIic%G=qN_n!YNp5`P;&k;O`~_3+M&xkB6iSqjVDs=6kUw z3(Yy^W=KGS`1l5DnOs5NZ&}HW3aEsxMWiLJEq`}Spq4fvf)R=D%Eyg0+}iK_0G~kS zS8&3xbh1O(Wc_idQykf`Un!*n(ieLU>B-;f}NqO!1b0YYnjme2lR6Vz9-I z1x!A;;c*SdF6)*$D6L|JD#9A86II!}&)foRC$`1&v}mA4ZVE1Bb6lg-iIkSxe~X{% zhPbuW!g7EEW@7rA^h+Fv$-YY|6h;ZVNoXZh8DiDD&yATf({Ykc&d!OAJh{qVq)Tao zr6|JNl_&h}z)5e^{9t@%=%LTP-RmScadu?mpH7F!I2Q1%IHE;4qyh zT_~4&oKqDm4A54C9WNC@S>dmM8RAm)U|!?>YRp*ycTVF3lyH{6EE#Mo(l9Re!aQuq z&n(_H%7Q3HEv@?Hh@zoYn>UD}gKMgyi9hrE=+y?Q*Vu1}KDP96e>e0%np6~!RWIO3 zjkXy2W{#T5)$ekvHyhFSbefCooEZlFa<7AI97-elXn{kk&uckH>+;Hx3-;n;A`^h51wv&MscMJEziF=;W{b#9X@1 zxL`BKk9W13I5h<6^v*{znJ{`ED|wVdZS@M?YEINWdJZ&X$` zn_Dc@aHeL2rxvQ``rHsbCmJ3pdR z*F?h?y88ZBOw<1QC;0kb;NJg9?D#(iOs|9L2-NH~2{|kuA7EPL;3Kj4m0QakgNK?2 zDx`V4c^+QSKD>9EO_$n64$E%Dvgh{=EewTwhCHnAi$*Ma4^+7(;t2#C0L*UWhFTBQ z+&BRz(_U`-!2#?R~ zXj@LgaAODt#nN^1Wllr0I=#sIHM{-_lSfr zPf1N=X#VJ25DJB=mF5Zuavj_k|8(t+7JLF2AON#9)7+W3o zqxlF7Igy4x+S-7Jjxg@45so?ixVRFl-soH|=d9(7pq0HY;^ML6O90FPKbTNQ!hwx> z`uO#Kg1x_sj4IG3j15f0Fv_Kvti?t96XuxEEQaqfuzu44k;2QX5+Fc}#RmQdz4D+W zo&Bgb4d^bQ+^jU6J;ZVs;sM^wH+K2RbT!dm`2m8#9GaWc5IA!8(F2>-6Rf?_A03%m zAdl1xSP74~&SWqcnCS|@T*1S=Quh98wD;`jl>v-r#`JJK(YF>XAI`>#X_0%Thp}2g zwg8tOi3nvoEzUE@m6j$pN^8y&vs;GjivJhdW&v0yKw~%j)v0LX$waBk`CLvOkz7ip z*EwIr_eqLAwe#Dh0184dJj8q{E{BmI{$1^MLl3QPFQ;e~g+!$8^-_^@v-UV^7V`Cz z%;(KtXF*GpZFqEI&KL+rct4~`h|(E!ehaXCgOs(70xH?O#Ig*@b%k@&{cgt3b%pZ- zJNV4Hd|mAalnqNj>cc$^W_Y@KdcET5!_0#@&?jl<@L6&Vfs0s=#7~MP#V5~ji zUYQzAkkZ>8_6fo#Jp?%SOtfnDui}rsfB+(p0RZr178;`H`cLql^~G;!)&kK-{NTu}f;@VXM(Zv?fN9T=SBB33v0t%;X$ixkP9C3Gu4YgmnCawI zgGS?g&UO_2XJygxAg=z8vgq&MG0t>l#_f%IN{_B5 zlkwx*dmnJ(0h$T<=eG_T!N5h-4#OS~brMz6{(gahw676>f3JqXbVk4(JbBGHaEF?E z3amB%tc3PZ>kr6=NwZYUD>+tnpxiGMD2^31lB!nlA+1E8l6 zJ&e391#J=|T61AF*ly(H_;@UF6itcHV`(TzBKZ0IC|X`=Er(ilWhIQF;5%!UUE%Mj zv}DcrVm41fRy4VVUIz9^hPrJWRw}I*7tUmt)E2WD2I+RDA@=UDCESa)XEdWWDDinu z521|5rBgbtLfi@E-neqsEImy;MR_tn+!x_6r-X+u!VjE9rP%@))}>8gWQLm zM5Z~9vcq3#x)z^rROSvEYi>DBP7&Dw0{%(Cm$u`_bIa3Mj_h!>(^Dy@;SSb`wc>UY zcIr}t1@}hgnOh*vP1x=S^Hu2t9b5~;!^st=V;!q zshPt`um#=Gyl0Egl8Pe>h6c>TMA#7^o`Z{T+Myc*75yG_3EdR5it*EQAZUU`ry``@35@9CC>baeY+L`Nb1 zOpQBJ+a4Wt?$t~uGQok813Jh7AX9)wX?@W1cI3g@a#zs0$htWI zl^k(>wP1b^&XwPOb!x#bZj_ud`iqm~SQ>(UX}gNj?Z6&`nr}vmN6p2E8O~2T=7zSH zOk$%i+mu=_zOBUoAP(=QKJ}zX6Vet@;Uxr69E#0_(abAS@n6DSFzN(p1C@yB}R2 zFEp3FdP+DzL@`==r=c-723p2a5(=OrlWq#ds;E1EC&0oIyS7Y}n>cs78RVjD#?Cvg zQ&5xGl(cWam+Q2I-o0xcQ35MA+`MASSt`@mUwQ6sGOZd*lves&!Mmf!{rgmiqr9Mo zx!L4heAq{Xw**gkfJEzTK=|+YBd@*M?!&d7)mNGska-?BQv|@IYO&6TI^KcWuom#+ z9}Lty zpHfe*_zXqIz~NfOE>Pb{U)yjLbE~6h8o(NzGyoC+LJ9kp37d40X}1Cu&PBrfMm5;s z=LyvmyxanVU?#Lr*Ko(ZdW6LlnOoAkZmjPXC+Oxj)-YoH32~|_u89~y4)2uKGV-&o zp#j%;9?1>6c&`b#!TAZZC51FrE&~4x^s=5YL*6 z;lBp0kVSR*>yVXvf1^o6C;njiP{_A6by7(pkrLWcCW;N3^H(D* zS+Fj`EoTj<7~)oOIfCp_F%jxud8y+3Bk5ojWrT0wPn zb&W_9eF~{)XCri0AfByCj>(ytSYU&a7aZX+_-bhGnK1C#sYOGW$I5AK5JkG+PK2AY z7)mbpm}{h#V{UWL~t(axQR8^YO+dRuZ z*I&sH5Z57H+We`*2V#Zn)v>~wixrA#fMJ9kuO*g^nO3jd9RjkZ7}TbHT#TH;F8Gs0!G)sz%ht+V{rxbazJoRIoTx(B-6tV#MQ-pXlSmr zOdw&)bda{x3f=ROhdSowe4rUQ)Nds~nNv&V>&5yiKBQaT;#dlGEX6Ycd;&nL48_V! zimdX4jr2a5d_C=irI!UIMY4FXB^*vvU`NCEAsonBzpZk2F4-AK~vo3Z%zdU^^8l46Hk!ZQ)e#l8WzB zmJEOrFpmifGGd9Kdt_vh0Z1Cn@{&SS8_iR8^ZN)GgRaTyp+93VRPJ$d`5TpM74N>y zfN9_}1bPSEb`;3^q0;q-eW#CKN?DPb?wIr&gwGgwjnd7zVd!(?#@myG?5SV1!w-gZ zTMUuVEb<9Z6iQ-GYQsEpmHmJNf^4dG?7g+Qd7hB*F)4|MQ(uc;k^;cwqvx1Q50>i2 z>*(cGD(h?y%SJ>+#KY*xOf*4#r}2=ieG+cab2~3rWN`&PP1CdFAt`V#p9qK9+n(Gj(_L`J7lJI%^j?O+2Z9|DbJLOw30%HY%8ZMc zrDOrxH1DLJTHjE+sF)ZeQ@5_1h3;{F&q6@oNO%b%3`9``{C}NBYEnz&fNhnf`}@xD zP09t7GuSO099yqk(LQU8=z!X{vXMHRig}yVC5frGaUMZ&@lbC-MC9DPfp3!#iSuTM z63RpsIM}|)${KlLdl@V=moT3cPo6A$Ul4Wb{lb{l9Ft&P20 zsIkz8QBtU|1ToRfA$>hP3)Y^wK&;`>9-Gwa+$;B0K-B?brjF8`S5hE44f^66S9ot5 zWFu|1S||~|HXg9i-opCA4SFGeM}nycUu8M-#CXj(qWid>@gb*zy(QzD`cYx%bFWGd zvd<&1%q7tvZ64uMpS=cvBmp7#X>n(QTJ9DLoyJRc&x=_?eg!WU$X+qv_u#2wBU!RC z6a+nZZj=0Cmd84Xlgxq$mp;|hVUPv;KoxQA+A5p)8*#CZ>cJn457*BAvMV3^vC{*< zS&&_wR=)>KjV~Tos1`oQ)*2uQ*6WYUFQ%ZOJT`>@Z44U%pBYqwT?r{?QAYOWiXz6P;?ateP2!TE~7jU2G-&#b4;2Yl~)>p6Dt z=2ZOv&5>}U-%VqvDXTRKbpqY~k0IU(8;g_%dPE|r#K=wYre& z*uch;&x`07TmEsuM%&PR-y`J2RzQt6$nodP5oo5zp^fF_zA$tq+i`P)ep9@QxWbx>ieJr@9Cw9tXc5p0qNZA z@&Y_*&3dX?=RwJK?>5Rr5(A<_qdLj+Sqj;=O2Q0dMV^WOg=}lE3W=w+ZG(dJTY5N2 zBpSQoABz_}0W~jRuqeGafY-M?y4MGP?M}cwh*~w&<3M~4@bhbm)nw+0bpRH`TrxD@ zQZecmlT`;RInySsDUfaS&Ut6`C8BJ<2qg*>RYvTZ=d5M%OXblCv60^sFPXIHl4 zwXq<`zK^Hh&*M`43#CO2*W8sa_6Oj=I%VcPoMmvm;Lox7rVU*sir@VUgW}z}T)_*~ z0T?buiqsD$**(y=oDTJ!+0ZFP=_nuEjqwVnSzb;vwRqO~;kP%)n;kV%%{xW|Zer^{ zg?>(3Ob`C_Xyp%6UTkIJtIiQfF}0o&nwRx{v9lwRSPef*wAx z%5319(@%zI2Iq-~4RBoKp3vF)|(f{;Ia|g!M7OPZZLigj-Xfj9==M^-oN?DH@HuGVfksP(sEq7XAvlgzA1@84s)| zR6%%au*@tCBr*u~tPA+Phv1xnx|Jm~Y?s|16P#lRwG2DuX7ZysoN56VNf_sGQ_MBU zNPyV`S%}_>5U}pR+1SknlN(2fNWfmsK&hfqSDZDvt+Yo=78V^`Rt3~nz-xS(TtIAu zKTc{awHK6d;sWDCzwTia2TE`>cht*?xq7_)ZqgaSTe7@2S9Hg1MnirlrnL*dm;ZFk z#Vq-gCtp#n^BNn&#{Xe_4kSnh!{a8B*LHp~zPgcF>H9IgpxGMx$egRn#Wc6^R<7t? zhXC;ohQnH6au_u1kb`^`Nyv0vONcNJlzMaNy6PKH_Vc!1Tl|_pD-#eg z&Kn{1`4&ZEENGpz6oR6BDT;ZyuCS?-WvTTO0gtiv#iT?s5U4;Fl7Esgol4@KE+|T6 z#Uo|27C*v=cMIBgDZIzz%z6$G1L-x}!8$fyz!Y+nM`r7%kW1$>KzsMBrdL6@5 zzosyUmj?&{MEiiag`2T83)|tsFC{6`(ynGpD;%YdM?zR8*bmZ8kY5J}RcZ7r8L#XQ z)56RpxTxnsyze&0)`rT>4*bK91z=!L%aRYJ?@||NL(f>wDC%XA^#Z4Ak8J zmuyA;D-gIj|F=M5{cn2|4vv0~e>**}NLjZM$+1(b_;-sEiPCYFNIGK=;xV#6ZF>Fm zy&MlTZvFe0WICSc7CPg4)Rwv&DC)KTs@H{su%50zYTUqCS^f7B{(i+;xwvUi-BktT zRDZwnKRBiQ&p&B(EnxZ#a=!M@uuP4ncMusVzgf375$gJF&T?<(x{ST~&vg$M`}6C% g_|k*x-_gG%rfKC!?x$PE$TwcOps!tg&i=uF14DyV761SM literal 0 HcmV?d00001 diff --git a/windows/keep-secure/machines-view-windows-advanced-threat-protection.md b/windows/keep-secure/machines-view-windows-advanced-threat-protection.md index 8616d79e99..707b3e172b 100644 --- a/windows/keep-secure/machines-view-windows-advanced-threat-protection.md +++ b/windows/keep-secure/machines-view-windows-advanced-threat-protection.md @@ -30,9 +30,9 @@ The Machines view contains the following columns: - **Last seen** - when the machine last reported telemetry - **Internal IP** - the local internal Internet Protocol (IP) address of the machine - **Active Alerts** - the number of alerts reported by the machine by severity -- **Active threats** - the number of active threats reported by the machine +- **Active malware detections** - the number of active threats reported by the machine -> **Note**  The **Active threats** and **Threat category** filter column will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/en-us/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product. +> **Note**  The **Active alerts** and **Active malware detections** filter column will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/en-us/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product. Click any column header to sort the view in ascending or descending order. From 46ddddefd07e62a5eccfb04450013e36a1dd618a Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 22 Apr 2016 16:16:17 +1000 Subject: [PATCH 065/439] update based on UI change --- .../alerts-queue-windows-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md b/windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md index 1c40e5b7ac..dce5e7c0e6 100644 --- a/windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md +++ b/windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md @@ -22,7 +22,7 @@ To see a list of alerts, click any of the queues under the **Alerts queue** opti The following table and screenshot demonstrate the main areas of the **Alerts queue**. -![Screenshot of the Dashboard showing the New Alerts list and navigation bar](images/alertsq.png) +![Screenshot of the Dashboard showing the New Alerts list and navigation bar](images/alertsq2.png) Highlighted area|Area name|Description :---|:---|:--- From 03b93c69aecc80334d8879de4d97bb3625d4c8aa Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 22 Apr 2016 16:31:27 +1000 Subject: [PATCH 066/439] change domain to contoso change domain to contoso --- windows/keep-secure/images/machines-view.png | Bin 101469 -> 81784 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/keep-secure/images/machines-view.png b/windows/keep-secure/images/machines-view.png index 557dae17f96dbf36363fb92dffe2e9e647ebce94..3baf15a05f785c6618f1b6f4fd77e90cbb37975d 100644 GIT binary patch delta 49184 zcmbTebx<8m^T!)PkU)S04IUss@W8<}cyJHy?!lcUxD(vn-Q9w_ySuwP+|B#E^84%F zs#`@ZXLk>?J3T$$>Fxe3OL4Hb&u@P7!xFxUn$3?Y7s>PhAd$=8N#A~YOCp%o$7^<|4ARb$c@amF*5|1K;*BRsT3Fs7omy)}rP<-@RLj@ zvYJzO;)Shuk}gtQ=sS{cQYyk|4isf~!nIKbnfqS7`t(XffLA_lLaN+yLeTc+C1jV| zQ0Zdf>ugtv$nUtSTOoGUs<^@ggE0*0zYT+mXKL%lH~;aSdzP*YBROYh^5Ua#k0wDejkP9ky5twCH!Vgge%yT``9x z5eC73-7UDOgUMr?L$7lh9qkiPn@%-Tf26y9GHa8K8X#Sn*6Q!k`%xYz?g7&bV;y;2 z4m=iC7RiXmAxN-RpKge!dxV}_>Yb% z%?dxu{l}pGiNA$h?x-3~#PxK|0P5qGu=TCDUqOIeMhd=wu%WOtqfr&RTC%MgHN!6< zM59q9yi=qj(OBV3_?t=348a{OvaLiZ^XfIvZ!pY@r%%H0WK|7I9pui;8-cH`;o)l|BXdY&er*%Oass?==9!clufA~E4{ z`c-p(3KCIfkEn|Fj`7f$(A@Q6w$_58)qJU^d`paauKY2Ai8m?at<85<2RP6EC~VuN!?9ZSyUKWq_g!mRDjZ-gb=vz_7*}fxh`YUnQI2K`pTs*!O*y(&;vn30j%Sm{O9%D3}XY zhAEZ|daX1_X3F7_QNI{!!mM2rm2XO~TjTMg5D?@Q6y%i=jZx&y6jWUFFHph#ap+TI z_s4V2j8}nIF5@YY*WR8vS1PqcX373&9;(71@ZZ7!Z*?Jq&Zx44F|#ersA7wOE?qS* zt9eajDm=D78m-)!Wt%9PAO0C5Mlq@aF7Uu;RAI7yq4UVa;2&N2>tWU3fC!5J?M{8_ zL;q*kKo9gc`K|ZgOA!e$egEGKf1iQ#`F{chFN0Lw!gM|x=g!Gdg%W}bySBeBAoPP4 zE|m22FmZw{Htxs5n$Lf3ny92u1wWp_eEbV{Dra~0$a5_Yu zX$q)lS}`6~Eg>&5{?Nv&_Gy|O(&%w~uF$PlXA04#LRs}0o-l|c)vUZ=l5 zJ&ZWCvjr_EDt-U@1qYzU90)o7x1HBvWzk`zUm}#MBgBmt#uGlxRqQC$-LLOT5W8us&(rEmGbk!PF?{4tzOw_yE?TIl5aXuoq7tWd^4vSV_ttXEBg1Qh0 ztNVUCzEyE&aof<)mXHJQKi#nM%a4XJdUEB2GOYlhwFW!m#Zzk&hRqXa(I|AuhC4@k zB0bv^P=;12c0Nw*6mO?o50&P(a%&tXwZ^$im@gu9cVBkQEM%$?XAO{8E~gRvPq9)C zQpBo#sH2Hb4j7 zH@K4>>Tojqnn|0YWtkwDU>S=^JD&?m&$Qzj2X|s*c{-FdwM@5eeCk%Idk#?Gez`Ikrke> z+e(pZX3&L@)KZ2o`?HjrR@nTNmFx%Wt^=bfsU&)EcnMmE!U{MBrs40h&s zc(kb{)w3BY_<6Qe;c@OW*n&CFNdW@N+YJ7~?rVF8?(R7>rvG(#6KEinD~b7DPKp6K zblZ76+TjA3RB~fMH+@g{rS7-X?>T^KLx^FIRPBq?e3p!!!A^9-Jj2t1g000u*0_D@ z?n*K^cPm~v?T#teN65~)ZJ>{Ozz@-)Wb(DcFW^T{6?eO4D zsqd>4&z2>^IRjNN{Zeub&_febMz=jXgh^l$?HW!lT$u;AnJe7e@M@m}4@>R5C}NG#quTh$u3bhKvj1H=Fqu?1_Ve%(~# z;|&UgNp6I*xbifiNm2RzOC>HKLun(QU9l>q`tnp^h`;(Xl*%_jg=!;Pq(A_3eZRyw zK}rFQVk9_qxKR$k{Azbxpd!XBzx~){+s#$?G}}Ne!)XIHx@IX| zVWY4{JF$JD-aL|0YM`7(6mhy!$gWgDFlc_hrkl2}XP|j32gD{VC6A zC)u=EZXA@{4+N<41)4QHbV}v%psGcwFizJ*O6prtimHT!>?s~M@g#q3=T{_bz#7~XF<1jAv%VTb)O_=B7M^+^wdPkh=3~r{Asb={$c^gmFPd>el{b+h=b1f#i*EW z$ZqLfO@>F>n1(w=HMUe6d$us5((gU4j0P}@$)74lueE{&d<30Uc;ww@r-ov_e_&Y# z6~Jh@u1&K6GpMe4vOA;qU;SS1uR(H2i9|G5^Jamy&gWUB&xm=EHa!aln!>COT1V>~ zbs5lQlv>H3rRWNxl?v9d2J59fW#PWcX5Dl!tvWEOyr=|_ThPwU%_VWWH3-=)RGY$0 z{!EZ^1irstp`MpMuKO(epSc2W)mSLQkew#2X(6U6lJ)PU7mO?=r8Al2n9VqPAzm)f z)A(8``15|P71R$ApTd_?Bp`_0?o^(3}J7&r@8__HI4ZG;lF3ik4DQO z-;g3HK4k((|GTVVfYBIy-de){iHIBuaKgmFKeP%#y>PPRN3aYv@)pZyc_)5L`Ky&@ z1wHiuwRaG}OwsM!2q~D;P&mMLv@_wPL$VNw{1jJn%h-xP{95ZV5`TBTs2jhPjGmtU z9RX*o`;$rLm0m_h%621gb?~-Hv|ch9_IxY0(P-h?xqD>eZb#E_Tv1bcduIat)V8zKLt7xZ6*W zTX0uKj4J4YUc)kex&v@`52GoL98@){NlF~4cRa^rQ&S;n555rKES$OPB%Za=n8>DO zK|G<6oGUe@clDYeTStSvBFa2I-F9ygmaqraZLZ!!x$^nbTvvGLnB}>A={;*qNneT6 z%IU>+q}usqrb4Ss@E*R(qXst|=7>StJU=?@WbR8PT7Ze#To)v=O7|_#5!1v@evk1n z((l3h7x%9IOdtc8Hf{S87rTqUF5mE@jl%uOfEibEOPe11i^-@@tnfQh;@&&!^v8?G z^A79r4uZ{q%)t7pB= z)i`^PIoPhvwmc#Y?~ifW19Lg1i>Dk}f{HQ=;~<7?YWnCPwBBRhU4t-4z=XnN>NyBhPX=VNwaS(7E%iFD_;JYm}9 zPo@!ZQa7R6)QO9~^dm`b^(RCaER9f1#XcRBMtqNF&_{TFE*{<6toO--$@JgH=+C}_#5M0xzrywd^p2$x ze_CJ(p2UQjJ+91{1=qU$+%5ygcA7Yyi3e^BwW@$xC4t3)m-CbQhtoY&!Bmarx(C`D zYnHUw(8G156u9E!Fyew{IC9{bZU9+@hilmK+1Ck3BFkEMvb`8E*xRXO`~9QuimHF} z#)t6h$&9+%AY8Bhi{ordQEenBy{yHX$QLMSn11?jT| zDF8SqFs#p99BrP=p~eQLN1XC42FSZXoxve%n=D3ZxHX{uJX3Ukv`6c!z6;Xf9_dHX z+{{MVsW{=2q=EG;%A~qIS=V*6JsfHt3O>Abr)*88$eW5|fqwE)cdh?PkNxZB{Zu2= zTSV@iT>QB_mIhsx4D? z?(tenO?JC|?~E_v@eDq3aUanIi6|)pIbWUo2L@KmBs1uXS_Sn92nvR)@p9BOY;=c^ z(9ryXMZ$?X*)34mx|fUQR?#Ix!vHXbW;6i_=>Tp8rBuE4_IA;$=5_0t<=Vi~)Vz|6 zMWyTF37e6~4adv!Tt_EqRmqe&QP&C@Q=QfJ^e4RUNW>Z8Xj{i7Arxj$Cd@%2szzhn z?@)Blic_Y2P9>iLLPHHk(|*0%b;L@jS#mV_MlSlCz<%pJPU8HAB-K4w7!C+o+bVH? zyni5K=-b}()z!Pb+@6btz1Yor$t--aaOZJ_?Ip2qqsBbyPvgBXxIJK$PD-WE>MnPG zVBWvP=^Gf~?#>(=6JRcpvoNZ%(Rzczh0!s=4-2{N!}^FW{BA!*@Aox1;h){cT z1s0+=8RTv1zIBt?hoQz5JqXk-nQyv-TQxzoE_Q9K-@?4+K9~C{Bgy;r&BRUrL z!&C21js2OVqDg$UI(adup&g~CuGYCYe1S@#l)BxjYIOKCj}3sjZ5Bx58R5Kp(;9P?Jg<&e(#F&Fb)zilUDOo74VH7#Bk*uQ^T8VkKebozTtEHWB!c-ihC)(<^9K zDkZSvvg>Xs<$PV$a(rNgvb4a|){zeHhVg9GJIH+6PC}#1%;q`dLc6Xy6Qm!>F65vEi!D`D@2R8^xS0tl z3kcD_IbPZ;>)7S)_wQ}!9Xy=wk|+}393NuYvQd~$%dT#F071F9^HI8olXVjfc4Bz1IQPez zC0MPu_yHBWqHjZQ`6r^$T9N-q4%cWHhAsg65JF zU&+Vq2lXBS!|%X(9gDRX&(ZYKZA}VI?ld|j~>k7K^g%4 zfc`oG5F9U)r0JTt9lQS}6YONnYR(3Z;-9WC4rnu2_xgOXY zI8bCJa;+aXNu#EhjQ8QwMjH;e>IgXpwfk~r|0aR048i;$0>RGv7 zg+!X?Pckg;E0u(4hn=?d&-_o{77EB!T)BWR1m)KL-c@|#ky?9uW(`%yUt*QM%xNr; zrO0PxFo;PRUOcquJ?utU&S-9$iFRcQ_ZJjdRJB6n0QPTcve60k*1ANK z721^k@Kof^v2Uh%m47B$iXf#A83ci>=A|Kl|LSC?&%)y4C5CJEOr10fXVOoAZqP|E zj_OtmlDsrTmydAdV*6x26UENmV+!g4W>O-f>kITcaaX=DMrZK8+TwDy^ZX`f)p;Gx1U; z268@Tw0ujMf=r^B<&_({I9Z9uZ5QL3=@~iweSD6z3BsE2OX`WxrY5~OI;4rPhC8kI=yi5$Y4IM<&E!aJ*bp*N9BG|bI3#z(WFK}I`ImZEQ{lt4&dO-6q z#Ag$$F4JZT9k@3BX*<0hktzkO9VN+q#r-l~_^~PJ=s=Z?t!^zMms~h{X|jM7A@b?_j^^t;AZlkCG@8#qx=XBwnU?WdYjyf+YJ&+ z+pvOMO`h>_WHe07?g6@1*Gw0Zf^TCcqj?4gy~r@q3e+kz$n1#mvf#Y&AbLed_Vdpwy~=d^4M& zGHO&!YC#sF^aWeakM@QdctE3NNIMB~JxzlqpLTB>tmpZ_?aa!19HpK9#f1YxPQ$n2 zhR(0brX%_)1fhVYq(G-FxcobR$1vTwj2Ps&1tDjm^=yC+`SRgV=2%qS8wTdUS`hp2 z@r;VWD`kx^68dZIq0SVY9DQT(PCEBS+>%1uOb-;?i16J_EmtoUFdAupsn~M2t&6uv zb|G&{cwMC4(enG3xXY)w6^DYfF`2|j1n)WwHb>^{m)SmBn!&ZzbHdy8L{1IId^(4E z`85#*i6;z_&*(5A)1D?WL1;wMMOvR5kK6ll_>dUrJ6GW^vD zxH9QHmfzMUD1`vl(8dB=WjxoyeFDURV1;gBun%!>Hz;_9)7HgUWo!%I3^j-~Qb&F5 zGy7l=KAc?Xf=H+Sff$`b|&U#Ez%t%a5uki?&L+G0N!FqE>1OZJY1}P%Urj9ns#e`W0@!S$Ww( zWN1H5&&>H9HED(rh)^Gu8n$-H9D_HxHj@wSP-_J69;Do$t!=coagnzT#eM<^@v75U zolqCQ29ph`{v6Te-^1Pfodd?Ux5oH;M^J6YU7o5<%*Sr6;uZzxJWwVW}h z_p^CyG^+ON<-#uMQnNh`8~H2^sxy)@((;Ib1?6G=ki^BG*B3pN?IWWLekL+9)PY=r zB_7cB`@!=w;kl#_)H88OR_Hm(+wCVbIyvDjK%(4xU?0H9m)^o zt!6Hp?oW9)8)1%L5JGU6GGsD^rZ>zNP_eNCgwN#eKadEalM9zDZ`P%7owcr{US8S~ zlaSEWI?>G6=1=>k zl`>RUb!D^RQerX*mVD*YYuVuo!w-zszK;`dYy}^Ulbr(8*`uZvL zP8fL}mp@9%IY0^`;YuVGTl$#Dx^23D^LrVDlns5BrEx~EzS>>n8p}RfEv#R#!u=Y` zlG%Qwe|nh{?uF(;`&ozVBMs~|!K@VUt+|9%5nUE$bZz>p{~tFp@tSaEBk9R?@bDgDEXVDe@jrUo^42&4j(lUJI$`)ZysI67(VSj=7iB`F* z#3a@xzo-T-_%Tt2E+HblQS(y(sDHn1pF>97>^slaS@Ia5@29@UlZGK_AXlFo5GdsL zLqg{Q1@7&~$1hJD-qNZQu0CLibMjH%J?+~o%Z)$%rr3klo+rRM6Vn<=|fe(x@I158MK5|_1dg8bJu1kFxynU_P zx#HO5_KBQX9556yzh*tcOp@4@-(m`Zskv6J8yd)KGr@Xh6J&Y@qh5Sa#?@5 z%m_r(WCyw?>9{vsZ9_%(-X&Nvua8`#aUh8k5&`>AumOy3jba{ZBw}Lak^N4zHwoc0yEeL)03EBJNt~p-|-Lz zHt7YWlB~(M-r|i^Gh6uaGeSUU%I&=;5LAgqTN3y*|D_Gdcv305B^5U`Gz9x`xe)!? z4d$vz%ovs@4%q!-y8k3xBsIjx;0aZSurjx;J#GD`7&O3iQvEwg@deZjiKayy-inKr4Q3-}r9BuZYSS6rm@UF84JK4L5)iF6PKJjE%sl26 z>M^~(OdgzZj*z!>RRN(JaJ63v2$+76TOJ4?cz7BPz&Vw_u;sj*n0Ln~?LJTT1n;}J ze3mW2`qyagsW0@RyHKf_pIK#7F5JNrb!zffYt`f#Rn6l_aTGb3VFY!_5?>XijhP%i zmBkI^8I770jzOk^=UxYHBLG3nn5h?AWr1!pOw#3XGkzG!p} zHzuEdqGtxLOJQ#BNCnWR?N~C z>))yV+JM7DGs#qL^~{DNV7?k!Z|MJ058?kW)Po+B3Q;Ew&6+DJP6(z~+yCVZs@Q2T zD}B1t+o}n~zNF`zL!lf`AwS4-z~|8~t^H6bWyBIMW;_@|n; zj!g1D^kORx0ipaOlE;;CtI&?e@K7}-G$t5_rhS=C#lR2LHSdCWs(4&2epA3e4{3Zd zBq|a5KgOE7*m`Z2LyghH|~ra?)B*?bxk8@%1Pvv^yJ_%qt~h)#4U8UV*Ay zz5_UkyGViSLj0P+a=X4>`z~a<_Q!g_!ib$jj(8$tAVD}yp5hFarX|WNut+K*-luhO ztQ#E9dg1Jg_HPG~5qqaRhpv~UodXYDzYD1}VM*ggVWN9GRV2)Wu1(up)TJe;CGt8O z{%c0UkVie{M!>?5ok&g-&+%Ig=Y4=kEeW5^b{!AVeU8tyUGP;qzt`Sq0sY9k;~})C zM##nkQxk`N+Z8<3zXvZP#t6^WXe_Pk15KzA9-awX8fKMbn%$dX7(vy&Ys9z)f<(kEH>Ii8LJy>q~drE-Ov=`(O)WnSb zht1$-boWKw^l9OM~(mM0!BD019M4TFfyw%*QXX z|I2lOA>yd?tuJ*?|0Q(xl8Nh)CcB$Enl%jXKfvFc7o+u8k~d}T~0 zb$K#;=~P&Vk()umK$^Q0mGoLKv0dk(^hlwi7;Flx2>(hbs~R8sdQ)XN?5SBJf4dBp z>3e(otI5MlFe|h0#kk8`HDwM#CPuWHo;gP||7JjvgYxbf04?mlz}i93VL#M=O~uJr zr~c z6fGKa;!N6QL0BmS)Cp7^3CHi!^?C!lAD#|RdQv4S$kh@qT?0U*Co()5067r#HKVwK zO9;qq;Hxl|$ciUIxe?E~+(tDAhsC<&GweO=%spg#3tfO1h%2|1UcR@;MK{vni4+L! zfItv61_|e9|H)u6kRbtG^#h1Xo!xbYH!&E;G;1gbP5p%zc6WGcdMK0)&BS>?>`C>A z`9C<8KaeOGGA({~b^VEZE#qkik;9Y!(|=u^<(kv+dv{jitOfyxqIzDP6)-J${yfIl6g}!6+Qx3gnG+!D2m=g&a6b>vZE#?=}`rW*un>OB-DvW}|Lz*kh=*K3m|$VYm;MtXm*V-D4}afZ{RZ^75h$<|ZLb7b^qc0-Gy-*(@kl zxK2SasHwd@y#Gjd-SGJ8i~b9xyIMu0EsInG7kdo1M3SfvEqiTzGq#=aQ~`wsa%`9( z!BeykVol_FR;I$F&AUT9fByUgCp_gdG*kOzvYw^bZMPIHrJjcCixABhw1F2^(Qr+! zW5Rpl@NBsL*K>Fp7Z6+knJl7|MP?VH{pl&Ao}~#{>yyP5XUw7KpUstEINx`fx*jzV zL7KgL5~j1UHdxIByB?_|aS_)SPfeO^v6}v-j*756_wR{HqUEvHkrf>6$uF=hRx_6U zvw1&v5V-yRS=#SDQj(gb%fYJmcH>tgv%ApQs5%>4N4t3ij;Dz-m!DY&%DN(R( zuK2OaktP>G-S~c0j&m-*E#!DyVht>n|6#HSF{?CNq6MADrRz#6M*^p7cg;6w3%fUZKCb{^m5_ z`Y0+{bh1W24|r-GJZzHHcWYX_GhaxT?GYs#qqKR}an4VLR9GKPc$v)Syr1b$N*!K1 zI#4QiWovyr7t5as#Gsn3dZA{!$6XQwiy(vB? z9wHSqTibSmYQp7}a@=Lu53okG*Otv(T^Ctf-N|eefgag6S}mQ|cd3w#SXNtZ?psHf z)gl@%C~#ho_MwMYmJ>B!_W>t_qbDY7?E%i`hb$au*N35cxI`u=&aL@Gvudt5PM`lY( z+zlHj;Ctv(3LDQ0Z%Yu$asI=t#XRb|=n7`K%5a(0GDBz<``XclS7|IcE%G#Lz(ecS zMReoO%d=mTJW7mqM7h>fEsxtpj_%Lvb}dRZsp4p9IBZqgBtV1n>c$4|e2ULtYGu6q zM)WhPPhDl6@9TB@=e9mR%ckaJk>zJ-L||4B@Xcq=%&FWOXoWbBV-<0v$Rz&i<*E!Y zwwXE0mBU{Q?osC60S-l)o-A=f^8Ml=FSytGb*mdT0W_Mxa4Fn{jHPXl#p@3=I3LC` zWQK%tq8_c^%?gXpqN3>w=gp#0=sT3ZML{AXDU1My`pZah=WE_I=ZsN+D>5z9{kk(y zd1c<)aU(xJa{4<>bVfd3q=_X3*Kx|arq%0TG#Em-ooHur=Wkbkd>03q&54w+bkIVT zS9KXS?Qu=9Tq1&##_#z|Us}^30e4NcL_RFSj2V~E`p{@CqN^t(EL}SdZx}98eRe*c zIcA#FD0VsbK(HBC65@5=Q@U4ZlIHTx z+={);ikHL0>4M+5*WKa^@}|^r;&#vd9qcQ(eganBV@X~va1R;3bbL&8Ju`*u*dc(eh%v! z5nNa6b2?Dt-^G~l5rQiDhI7D^(CcszIzhsjgBG3}6f43aZ&aKO^4I@b})lYPwnuE8@6*AHos+4A7k(p&f~(BuGxTr<7=44*7Ye%ma-Ey7Xp*RA6=~qL>4wU_;wsZkms|UTc|$M zm5pXiU_<i1R*ubAG7Fg6yD}%5X zl#5#OQH!4t6X0+tL}z_uc7@HofJjOT2$C!jns#T65L`e;ohqQ3KVbO0F|C+6@H;L- z#$qT8TuJ70O{4JAWtE9x(m>4dbB;V$WF3S#)S(BtSR@weU^jF-#1t?Z2f<&eWE@6t zWdkX|f@UUb4@)3fmIuY@mcWI0|6lx@Xa5u!ewH_jgDjw!L}`A1Z~WjPr}GM$%)ZiG zYGEPsJbDHtwV<-nBJOCpqUQazOPn7et^1XmKU`x?=KxXaql%lSEJmoS?Gh?Q_0S*h zA>+Z6zfj16^|czNl}Pr=iVXvtgW=uG5B~zWJ~p5sRZe4RZ?2o&jVw)9s{KkCk1Ns> zL8$_z;;xn_Z=!@}P0~3yJA%R)6(xnJha$p-q)3yN)8&ec_~vykvfAe4*u48$tMmy`RBrKuyp65@%ds)B#L+*s)-qzXaoF)Q2`y8 zmpglULpo)@G4$+1t%2*ON%NIhA!MJA)PP4uHm?;i%r~o>t_~iQ%CqYy1X2Mz3U=Yw z9Yq1?y`;zfn5AXgZ>D~<$XI1RFQJ^(j%Dt-)uISR*2lbty33ud97$%r5z-n$WXf{W zLz}HmMXbGmXX2;qkM;sv8|sv8Y`j)SPnxtW0h8deT4daSN7 zEa|TzTZ?3U zxC>lt#Ycvpo)V_W<4wlGYFEzVRnAHKb(kxh1(Q~YXRcZk2jTDCa||?`qns2GrFlk+%e_ZsCqU}jdN;^ zoc4()7KrL>etcfQq}}|LK}XDV#Pa-f7|F@C|8l!NGcj#yL*e&Mm<6vX(9+2c`Bp_u z`r_&{>9O_{A;)*R@mF_d$}dzs2lo0#wd@}esO~F%3m=}iP*59*I`&4(^7Ab^y;Fv} zJwEzK0Bqwk*V}Dmlfz24)=XoLJ5E&DNU8WW$N_n!Tjbilcoh`~tDAe$k8`;lbNqfT zKQP%?9*NXw7%(Cd4byv9I#S>rY|h#tB&m!FWcRa^M&gqoJnobMIOMdjR4hitSID_j zie|kMceDKLBj{@qHhOBxve?pPDZ=I3DEj3DtdI6vL_V`$wA5$ z2uvu80`W+U<6Yf@T=T@Whyt|2EDT)xi{sh!Ye7TBzpVEBT{W)7O6Y73*u;@s2>8Z? zL4LKYS>uyhA9xq_RI_12K|HUDCK?N5OUcYN2K-5g3ixEu(d8-c9~HqY#ljHK#ZZY9 z3{ZNK@&0wZH(cznm1f^RPGAD5WY=$O&0$O5nfsQ)&E_2FEg$$v>2T{#lS5pr{RT)R zQ7^=*3?-ar=kr(%0vHJH#JQCJRP^D$I*?B|!kC1iISG45$E8kQzTQBQzxNJc%@Dw~ zD`g)tG*~;z1>sBVtVwOz;)sO}c5Qllyya}2vPJ0Htr7O+*(#Or z<8Y<|hP+Kc%#Z=Q zofYektAG8;(C6YV=@iQ&&pWBnd@W`ype2tIGYCpIo$skvMjU~DT@y>Xf#G-s>T~wa z??}`UIv)34tYgBj?42;e)JlUjC;*~?{NOz&j=f`OK9K>=J?}N}j8wF;F19iP`@T+} zN9eI%O_juoDu>=M*9T4$moGE$p0*QT{6HnO_gPAgMQY@3skOo}-uHvlikQd7)WNip zIl1gBbQ<jM8Zk2uBK+2FRH`F?e*-)EVL-Gw1bpaUT(9L*v!uk7m9o&CySccv zA2u@>scG3BOzx=-nz7mB`{5ISnRpL%%n1K_biAsC0|m1bMV4pOUbwhx#%uipmEZU8 zRG+!t#-t4Ah#h!Xiv&a*RhzGi2vSm3UfMFZo`}_i(calV2@dDTGdO1j_wNfma6qnd zp#lAzy-8`S_8eF1ol<)JesqxIqoxi9DL?BT3_&6?vTopobygZ|p=X+C6 z(aZey`_CZd@T1@aBNk}9Zc%W35~$9nr0m~Hv{m5EKk#cj{>USl=#{gfbzHjfy<|BU z2GO8WC8vQ2(dG_Tig)bIx~fzV?~bR#!SOrSG#0me&aR0Y7QLNve7()6yHl}+fytML zDDz=x$Dp>%jF4t^h1|CM5|k^-C%$wY%E{HEnHWF=I&*g-7ln>{4tK^J zT+o!;UWjt1&yNo@BggjzyPIcGG!2V1Rpd?in(9QThuPKKn(|MkJWfxACaqrMH5=oN zg&#LNPn-mhV~@8W8v;whCM{^}5&`!fT@y%HQi`vea7Kx#-zZKXyT_fOao=!>u%O_x z31Z4ucUD(#mH}r6BCgko5dLMCkmsZ3fkT1M-lObyV^ubm$0rl9L?~68i!C%oTr$-U zk%5-trB;afpQ-=%DDH{{9RGj9)ti#pj@F5 zfyuF#NtMAI)B&1bjYM9fK8oX5$NkC^=eFT>S_VF~J1|pzD_E12h5z~`X`mmb>5ufEa)@yL3%&pkOb zNW#(zf9fq}jMrD^A$I`9iZ#Om;IVf$+{$fcza)214Wb*6N5(gX@CR~C^aw>ZZ&0}p zTMnsOa*2Oe$BrNtaH1@5cJeOWQBQZ=leEhJ^K;9j_B9IO>x0eTPGp3-pIP(g)L3o8 zI~!G29XNK-lhn?pS=W9i2_dgSC$ZVZZKg4M?_2Dkm8O_Bp#FW`il2NKDE~QsK%L5# zzKBCf%2c#70w(vASdZ+GlUWTlUj!DF!Ca4miOV*)z^_J&R2Fb8iTM`{Z1tu9Z$r-c2vO25dl7BO8@L;Ye5CT=55> zHj&fWdAl%URxg`mdZgMlBPAc}AV8-wv(ndo*Vx-9qP=h*VieNmZ4V^fw5E(C`knKO*PG?K zQ+tWnohzIlkQ{#dtOUdvw3+{;oF4=<9lfI8{Um}yuNO1roN~3cvF;n7>fFT< zy18E7wA385JY(DJEY*Lq7bb2`h-!$hij#;t>R7|ipJBzTtcb}z*y!!+)1DzbU|aa? zVXr|dyot?LcSioq2s2vjri+Jo(c2e{N%-zxECB%iXM(;b;QE+@JCGfCyfrnbIWd^v zM=kKC^(GjTL&w0yEF%tF@1wBq;&@t`yE--_@4*_A6A+Y{+(4I+hQd{Mj$BsdgEvmB zurqK6%urELy}uK`KH1qQr>wlVb6tj1R6r0$C6%V}+oh88b!nKtu8>>=^WPNvp|lxu?yX-N@sXCueN4GOn`8+VAACjA1C z(sg}>>3n4-vYhm?F}x#GNxFrjk$9=O?7T&h;(m<{Qt~9Z4$U5omMz}$HDJ=g+J2^XcE=;cZ+ui#AP}AB1^BOxuuZQ49_tFIv4>uZ+1$wvJt3$JzUS z^|xi4G{LEiy5@@ZOiTP+xL&0@`#^c2E5VseRIAapI|k^V3L__6)+Y!HzXLw;PJC@d zUaP@f);{#&cN!u{J90ufJ*8ifxqfZtBJG~V&*8k* zW7}i%=LWxV;T*ZLi_f}KmDi4Fa4|r{;Wo46SpeQ85{DAi4yVMqJ@@^K6RsL3vdKL{ zzT4Rx0cj}_)Hx7$Jxzb2p(AFdrslZ&mlw&;!H)5C0YNkud=qUC&gRT{M3_K$xw(_aO+Y~Mg-|O7lgO+_=o65(rjmu9TO>eSt=r* zIs1&hq3gifdhM0kX2pZdTZMJJ`*7l=*2SRW@x>!AZsFQK=zO^s(0(8zG02@)lCyiq zqK~fR9FP#po&5zXwcGhLnthNy8(JiT4wNf*3^CH_*;orWU{}Wno09fd+aHLG-&TL6 zB1A-=0ygbU{LJgOYt)d(8bdHZH-|SQ{Ao1x#!5)nc&x^>P*W;Q4t51jDGS7OJa%);)8%Nx?SX@CI7A5Lik!YkPGuyE!*zff!({BUljztJ?TA<~(2~I7 zdSOfKbz{(GB4@I&GbHW00XdG#>{l9&J&P;pu!CDZuT{Br)-B()bdeb>_~4^r-PL;b z$~CueBml6C?$5KpKYXHwKU!G1>~Av{tRskp=wVtQL}nAEQpNt&z+<Z4R5M z{%t?Te#KpmUeLuZ4h9<*;hKm(aPldI^u-8`tr(#kub`qLLYHf)y`N1+aV&~zE?f(W z^`y9^B%#KfjDr+gBNCxVg8YCg0;_#h{WNH~UnfJ(?6-*1K-@to|D+G`)lY40StbQ$ zP(FOxtVG0oq!P@kj-*{FN#7PZ!kamp=w z|4jV_$!AtnGlPmJRiEqYUmuX$p(>ZAeTnZd!b%nho!KaaavBH$Cd^DsT#V_4jhlgu zrjh$VuE#MFdny7!{OC+qp@cst!xo2vw|(l*fy3d{G$;lsIot*z_gvnyV3nEe`hfk; zh@%K9^iLZ$bJ07w*)yH>fEg+xEE5~Ati>w^r}2T*O0xx2yIaD&-DQ^1#QZ+62dN5~Eqdeb@|^kd)Nl8|6EYT|HG~AYJ{dHq-z|#_?rptGx`=(?b{w68Cpm>c3bAC2)V2wEg?!jQ@YM zZa$J8ZIY|6eE-*35n=deNqAj|M`+)e>VjATxO zOKWg}r8TBstgz{lz<;xP8Wm`{(wIaOteT#RVnu-|9~7eaZNYpF5W3_-r^+>lkDLOsxE}x0X%YHek9wMwE-W|( zzXXhW+WH^MtRvS<*BrWSTg-ltpTRiBf-3w0!QY=KZmi*7Q?93>@lpSI-7|Shma6iT zw)&)g#?9>Z{>n8xJzLPi-)h;6J@Bc=4-gQjk-wVt-}MiP@vlMtJ$(P{zfi{a|2fwG zYwP;y6>h1r~k8!UdJcj_k>W~2z%LOK|Yxn>K%O-aEeDE(9aQl(D;~rS^fRIi% z<`AMQTyfj)`8HNKX3sxGxVjAnYTrt*(uxpuPM?IQgb?^{}fu?Vx52M3O%erHY3R|xfX zWPYQdf)N15#ymq4yUn0ghK+irUAqDb%}Iu z6$c~Z_-&%8^ROH66ar+RI|66~$rHQFYOIfU%QhAr#$M0#;qzyOY%c_Gjm;6o>&rpi z;9%(OX;17Eeg$bJ0Cb$H%(x`%&fzd!gcc%t>eIvg0gV|#$)vJSo zYi~)byTJ)4*eou?9v#vbR%>C2=?=@ho`Sl$3E82ljUD3=aG5?6K)U*XKzWN=hC{9clw^o`xkF1a;ljarHC0s4#gJ_ z{wP;>%^K9xKsj=Vmz2P6Mz54BhhcsavYct zMit-;Ac<#J#7dt29b@`Xe{*t-%Xd42eHYJ0T~4^L@F8tZ|4^ImiQ$g0g<)sr?bYPR zok4y~9IT%T%CZGdk8Hh|)u}`CBM29dVT#ls8Y+7<4Ox5j;y zL%Dhxp!~atJ>kpb-z{H^G(ym`Gn5!Cvr`f&m+O`7Jy&#cun1IkraT?xMJu zm{_DiiAT3VbmiGKb(C0%C%vF|T_|$%Yj|;%n{RQoX^&svdJT8?6?2c_`_n8yw_^UM zEfL{1rd=I4lN-&dPpWF}9AK4u&jfVR`Xf>WYe^ZCVbE?)2gbV}7rPkp&ait6iMKllKfWT4yM4 z4)1GX8{mq65t52w)>j!U#022j>>o1<{#6XR<>NlW%W^-lt2&EUFISPgY&-O<9~qVb z++w>0U+J0~5w1?(y(zmbiQ-Kv$xp-J9-bZKu4lHJb=97cb!@0B)O@F+%89+=sItA& zlCz0q5ghQ=t3oO5>T$X!#IOA{-yT@`9#_`g4w`%$%Gb<9VWgzRtANLA1HQNZ>6hbd z;qO|_DXFw~@`(oX;cC~{gw8a@lT(#LeF3QK)csC)zur9_ZTRkX5IQ^!ESxK{dXjp{ zl3$dZ=?u5@6KS(N<4oR|!*Wd$>h+)QPmnnjJlb(C$GZg#wY|~W@cdsBT>a)2+wCc( z=Gixk_H}krsl=G6tpHwVNjPz9Hf}va9G2 zc_HDmh0s1ZlPc5Z?tJI}d6#tgy9Fu2)5=Q8CS2vcJ<(T=Zg*n4N%4kh(#`%QsLjJr z@wn%5BH9H~o*3~`Rn!aaxMYrXH--b{?5B%Y;~^inH*5VofPFD|bUCBO(H{a-8gF1o zxmg%HukIo@b|o+nq0^!Z;uC4KsIWCSS%Gi{pHR| zc%9+Xb5mtu$r4luStUCWOPVq{ucfPc5ylTE#dQYk^YA})a)N21WZQ8FOSNvd`1VLx z9+np4-Mb9d-F2+B#yOuEGCSxke&4v&Adwp@1c2U(%W4JDv`jneV6H96)c@0Oh`mMg*b-?Gl83IdMyYDMq znv(Q{9*VtQd0OROW$JkPd-?!zb`VuQRVFR#!Z^7C{}3khiz2cDwPu&kA_5i*oZ|r6 zM=2K35Od6Of8$IRiFt?*Co7hHUh1@Q_+~4>*j{#0&OJ|b#mzxBZ}u`qbysR5?=XJx zxAgP`*6O`jxaz|6pM6|daqydbb5+aH?FL|W6(phItssuW7z;;`Tp)(6p}W`n?vpICdLSU^ zKmcXskM9JnyJ5v*j7}nEtIb?j7%^ez!}11p@XS0>GJa`U{uxL4X?=49Gr} zBLcz^H3I$wvdu_qG1bMmLnp4i^_1R-Y^sBg2E)V-xb@58@F|Pr^1g%)h{`lVPaApA z4w8Qy(MwAmi$s3Ceta}hYoy?e2{3~q7z36!y!?|i%#F1wWNsY{Kd&{oGt>uhFjq-n z)ehy_a?y)`$6`+ok(!!{<>B#NrZBHq6rWb5irhr>w5fdF;jl1yF2Z7lI!GpqQ06-! z`Z*Hkiac45eM2qr(m?ERwB>r1USFJA?bh#8LJLc$Y;ik7%1tkUtGKueMPM9$E0m(L zKc|N7Nw?ehPI0d!v!xdJ612{>lPe&-`1aAr9G^K6g}GLHN(ctEW^yX6Kg>-~h1}3V zwLLe6A7s>R%i5C3&8qyTNQ;s0&EB3(aJ&GwAxt&C<1k?lE7oSo%*j~r$;jy!F*T_v zHT9>jJ}B~RR=~!QTk_`JQ4GpM^C%a4q zEt1Yd&&sL{W_#^>B~zxX1TVVZWegmC+-!ATT>}>zAs%j5{$84{^B-XwA|cl~oS~QE zI*t*t9*(_ME`PChyuQjpgw2f^_Rip)(3f&!=bGMH&cQ-C{x%JTVFF$W9=w-STH4pX zcVohIGn8VIB4d5g?xO;_lQ-}A$6St5SDd!l8+bfnZ&P+KchS=~a_pDLlBp7XD8B!& zJN2DL%9Ai*=)RI(GKcNC$emw}S8R#U&;I77&UY3jqb-MS_bm0Bo1#uaT%0loODF>! z^Xm^x#mYO6w4%I{PlSLdOQBj=@SYh2{%N{fOTp)%KXi@u=;D$6xURR|8jsd8q{!`o zP~1!&7R)BjGNtT}#qM6K%d`CHYFf|Ii|V8IBX^gtb^c!DRo#CE)QFB`-4$J0>Vy>t z5#QD&1Df94(?zM$DNIQ{{=xI* zuDda5!WcB&t&mW^M>K@R#9+bs#)->FQNkqs$(jQ+$M^$wiTO|nZ%VV~$>V?VNHz+VmlS%a)*8T#SK&-mXAj*K z>agw^5KOFl!q`RmKbv90^hLNUrCyVLyx9KL7(Y%UB zP^#}hlO%Zphc2$s9 zWRv+83W#*eDSn+N!!45}YMv^l`^WMbzO2YzcbZQi+pvyQyZY&a*zCts&3<(8(dld83~>v-txsA27kx8E)1@;I<%hg z;4W5^`0IGaD*S>%Oy^5Iu1bfPnFQ^i=5tu{wS1Zg8>`T4y*hv@!-Zn4%S#r!J?*2E zGwy{#u^k9OL&W2*D}(!89opE^l9GWHv-Fxg3{_Bf3%qY{q6lmxrrT6`bi+o;%mDFb z`d=g)v+O^aOQI7WQwqFKm{9W*?=4YU-&sK`Db*6%t61P;?Upx{s3wqW%2c>6XM^}r zXy}$zeemLi7X2D4oGJ2&-8oeof|}pXtvF2g?f0`8i>*G_$PF^dU>4RH!+^|tlF-GU z^hg+_BkZ9}P7XC~R~sE`eJ3e?^8*v~CWl7*4tj0v=7Q4@3H}nFe%fu-4H~$pnN8ih zpG6Pp8aQ(^fclbdZR$o22eM|8&Sn`5WZE_RXSIB;b~_#~o~7U2k+gyq{&-rm1Zj@t zcvt$oE@VAYA#`cTyu(ct$~9K0v|g_n-2~HqC%E`HuQQXVN)Vvp)kE-352p5-SW^yd z3X6*>(O)r<_LH)i;IA^aC7peJ>)>=d@jnllupHTtMG}O{FvF!TQ%IEN@O@C_B%aSL zj}O(U*5|6WXVR-ur&CSq-&T@MjF^fYVj>~!mzemiGm=0u|8)R#bG{gcO|LOkcQukW}um;Ckbf#h+7|l)QEgKA)9u^+B1-cLyR`dUXhxF zy9Emz{@OPkUUJ7Cz_BOx#eJTw4id@~9Az{1b@GCfhy9Au8S1siKk&c?)fYsOPyNXx0{6!~d0jBGIj}88?ESD=2Cso7 zTFT8RaeuaA+lN%3l)cilR_p$IcsNfyT8BZ0+s^Vz6vys*teUVj6E;+4CfW~lO5v?T z+7(8h+qt~B!(kRzpPGuG!gO42g6DnAB=+Wk?XWMmdxb&KcG`k)|5MYA zez_xac3ic?ZZbl`9!O_xHT(s^aGL&gGm5gH!TOu!?V@h@JnP|V_2S}>Pd*Xxm|_dioe z#L*xPob`rdEd#znUrh2A8!ez(%`P*FBzRim{!U9|?0CL(n8F`_TC%;}ATC%!>VoZJ+hG(qvMoQ?U91ayurkwvBP3#cXIG<=6ZYRSIEgT z`JQg@FeO;f)q=~LPkd;fl9`XuCvf#NRYpwXl$gmv1*G2_8*SHUxZd4aLo^N((L{mG zQHfcE8oVB`($%pmDSKN#!Zzs*fOkSJ#pAX&JSG0T+J1dGNTTx6)0b}3rDpIRmic>x z*O64YL=(T&nICQh8CPCBebOaGJ~ps~wu)>}y}o%Q_nE{h)2WGdL)CzH#SK%u2sL{# zdR#&dxEeC?I$4gl4skPz0jY$TokI9$mSkNQA@UCcOww@xX_Z;_m zG`hj-fSaWm7#hxmO@8eTH^s8ZJBH24acAKIc&Gd7xZ~9xg1cjlMz_;R$Q;}1ts-^y zq=l12#>9(%AhK#gi& zK^bM9|MH_quvpd(pTwxWv?7SPcOC+i|?apUocG>e}z}6%oYHpsBNsi)yV*ZUKN;gQ~h9p?8_vzL>xohyfBbg~HyAqZ5u<S5o|WOQ2v*|+S2r5o63{KoXbBO{`{D*x0NXh#GE92bDiT`{!c|J%Zx{WuGj2w z2t%Z1yNr24b$M4Gx8r)-F!5;<*{qfuqRopMB{5cBS3^G{EJ}CWwlwHRlKF9e) zHiy)mQMc^wZl287SP1oUx}bHyi$H6O4!Z7ovE2wx0+I;}0Yp&Da^%b2QFXF z+WJ~ecIa?OkGR4f#w-knenoj1ObYA;v8K(0=rk_X<|$DnseS*qFo7e2ifuEWzu;N| zn76VzKFio1(!k>{e%2Wpv5=Pf(WLm>ihwC6qrkg3Ww5@f`yIgk^17$Ja8Y{`KaY3c zBXrlExxk~{FG$>i7>$LDX;SZCf>wxTI^e$cFtYs8PB>i23{EJ(^)Z@;21%ahM#o+6 z8SuGI2V<&E9k@T*o*gEO4UMi^u2!P|QTp5?G&km+s#ia#{{Q&3Obnh%M!Y=WrsLY{5jd zn9<60+0$k}(r3(>pt_(4Mi&eaJLHYbf#PTztIO zinUWj;K=xbsgA^lWp5!Af|1hdHC(Ht8$iuS4P|cjpW5GXABlt`ogNlNvhZqMODL0(Vz6RuZ zwGT0}+EEt86YoPv_ZGtJoG?=Ar>PqJG)=ozY}7%L-~2lkF#0Rsa6War08KJ4uXsbW!vhx9J+DIt7Vw zC`xC-$_bxj@0YcNy#iOouf-jIMR)kId`=4^>!OjNb$=24AmF(Rd$z!38LMw^j{q;? zC>@@@)1cTfccipmM^znAbM%>pJ(G(!;1z@kN6G;Vgli{>d;j3h4a*8IGTVrdq2TU` zEIi_Jd;t|gE5WVdwnrr56bC#CpBZk8Z`WeTg`lTtxzWECd#hS>U-fpLFn-d<)xD&g zWLtbL-^2d&{y?|s#+c8u9UAcAA^n!j?SQJ$h0TBGbZ7u)CPYGl0;KVNQ-t?~-nm05 zzvTlk`RbxqC7l0g+~K+BbQGir{B~kz$0eJ{0KchVU++LO%f2mEqeStC*`SehpX1*iSsVEEoFO-CXj{$sn=)1stH&OqYJ}SQ<<{m_ z{p8BskIksb?)Y}>lGLjFp$!-0b7fMqn*9`jiY6&NaoiL?A%jd=>y}xXUCU4@)=3uh zNn<{RKqb3)#+3T?pMuulG%qbSP59D=3Ik-R@IH@=0qt;#PSB=F>l~kq>0zl_{Vbl; zE+&Gq%_kY)FhHe$DXVXrGJD(cQ<4=_b{)gtLU^5uWkMD zSuX>gh@iH1jyh@?k~7C(mXCUvrs<}Zi}F(?Y}z0%7}9#6*t??{IPe;&!GrgrjThwBAzZTSO697k#9ehtf+YF_T;6~Y^0v$tA!aFGXlL6X5-bTrXNM_H3R^h|3V*;l$+CMqxnEy$hl#|d(vtr}{lvK|6*Gk{?+8ybO1jeNC`jAaP13) z9PIb))+l*0IQs2+`=Ql8?G}Ec!RECtuH14*>pizwnJ5IE4VZ=B3IFlmO@O%-<84|; zn1&7?3!T;r&Dyv1sr%aULuEi<@^1^X`@{rRMX6t`p`Lj|m&cUmm!`%PN+#F=;=!wR zGF&!OJ{%oFvx_z?iexam!{1KF^BczXMKe}d+=$yglJU*KqT{JKo9?sG3h=)Eu$;o& zz0k#VS)zWqSi)+si?ydspZB-R}cLOUjo|#8n#N}t%+_hfdcnVsXhWl_o>3&(z z z)pccL$rX{WXOl~O&-3Kj=0onrw=v2oVN=FvA z>togqEuU`9!j3p?UCB-|-jM_=*S`Hpm!7z0DE{du%VdASTBv?v3g>Nn6+OZwzm?;3 zU(a`i&jikv=bDS%>t5PfB zL2fG`3|=`o@z+_Rr=Sa-#|LM1!^{b{(|G3FFpK8D_msnF;eqP zOWZ@09M+9qb|U-P?c(Z9nL!{F+wI-V8k${PY#j4NY~x6Rp?0{coktb-=}{t?q7pEK z^xCe*b1b!I1eEuy+NX4y5)G5Q_ZoF#46Q$5=uD)^)w0J$u+N#&+x@{gqR zMIZ0^#gJ?w=ITW6>@tl6anJ79$^s^w(Q?=BD@t*ly%sFlxVfA?m!DpmkDsv;^@!TI z$-B3IB{1ebHB6A#5gJLn+MaKYO^6TOst7roO5Xzy(wK<-o`? zT`=;{AzUJY(YWuvo?G6Q#AR)Ppj}}tCls7O`nEb4Ct-6jssBCfvexho`-<+KsYQ;@ z+$|ueBl0I3@7qbDbjAgwg}*GFyH8=dy+rFiHo(&HsVAPTJV!kv1w@egbVx9&hGZw> zH>%SGHNT1yGdmZBK3N$2i3LoJ+QQ6HKMAl0jL%N+=ro(twU(P}tu$^Lz4om+7~iAL z_vrOaLj8xcE}ed0`g0cT$*WFelX_dV8swfLTukkFK_i>}R3hW!v~%$v04Jk7gSr}G zfm}wbo#|{zp9AJ@CNq`UJCFuGs|#?UIuJz^K7UNX${L@Mk)giasm(|x76I{9t1--? zsx`>_^=b3g9go+U4t(_2@vZ%=lFE-FYHCS56)h(vrNvr_F+;Mp%2(;813Fvs$edw-?0bzKP7tb2;-JTssc%N7k608~R1$h!8 za}q}rw9iVewc$xG>}+;Xy+zMc@qK&0;eWY!`~1n0A#8qPvHrUcek7u95|kdNy~r-RKL(SU?VGMSAk*EVEpm(}&OapQjHq&G)d??YgO*({k*_o^YdC(Gs3hPw}c04xvCaVJC4_g zA3L+=^NOoj=L<{n08n8vwc-@ugmt^acj5jw8Sd{{5qB5vV|#j>(`2Nk%h*>~RW5r;lkkqQFtPM0mL?jJoNMpMva&Q2C; z{U`HHek#c==B3=NA~Vf{pldbJRAMsvMi|Pqik7 zqcWw8>s|!Qs*wFi&NZ%K+-NYo3W^nv^Uh%U_oMQ7x5r(l2hT2@ zmGcDy-WT8zLtILf!q4W|-dS~gtCtuax-Z5~OfW6&(Q>6LJ!ULa`-W9&e^kuM0iI}; zRA|=QkG)rK#jMovconL-8W-RSnz@romQ4zh16eU+M>`#(Wh;?!=>G z1PY)ZBduJ`(2vPrw0#BIJ@dthHHFEEauI|!)63*-@-&Hw(Nc;O(lXk8n@x2UsvmphS8nj`P%BmHa<)~&F-UvibV?YiMjW}6Q8-H>&Lgt!c(n#03+Uqz@r8;ayDirnM7BY8ydM~OfOXjw%!%uu)Mr9 zJ;alURNmw)evd5<8R<0JIW-f=nFVAf?>~P9$>EI`x~z&C8&g`frTPSeeS+Pp*S)XV zRI9`O!DXs-8XGenvpzJqu=q1GbF3FFmO}e%M1CFdwBvL)@U9c#HoDRZXgZ9sv+wb6 zr{MynXMKqzf~Kfr;%xiZ6E0JY<#r3N3|$YA24SbR`*Jh>AHwud#~H{uTVb@TqtHUZ z$&wti+Hc;a**WOO(|OgY7?$I|5TvmgkO>un{YsAmZax-)LOJV_DFn~R8*dj~`JH=n zA<$O)vA2s{7e8Y|%P?32%h1)vsPJ~SZ`4GJvr(WX|3Ja2BDZLZ&|4DS>OCq33gqNm z3?{OIe)eKRGe{34oK;3Vks>heYcYVq2Ci29hJ+KJtrApJQ1@JpgU8K?V-oJrVrL5W z>-e!T$R#Dike}{ELqeqn^;9Nnb#3&i#*;>>ZUaxES$~H(8E^uQpVNfGit)N$gqkYf z!DO}HCI^RBwmUeJ6-J**zO?C4P%C&W(~K=iTrTc+3f+KRg1hOdgP9Wg#m zASO0xxlb20_&8Z~Z?8vN{?#*^gizg`=1tTYASsRRt}|T8AxJBzA^CA$BHIxM>`mFi z!vt;cbUe9IMV|q7{h#j4H+v3d+wAa(1Z)ezVxeyaHs6r#Buvn&OK{tQcsYo=jWA$D zVM@&LXR`F4=6_&e>Oi)-Nsv?V)T%l;&PGx7h-sdAf09yCpYJN|bkIGZ^HT})6-U9PF3sDsulaCOX6jfra zeKcP}ZP(eY%+m1NQv}s=u4OBrjI1RoIDXWP-hcXvgwbaQJhrjl7?INI^3= z(N~Xv3tXE9``?};D9+9oNu=xxuJj#^;d?Cw9$VHw37EJ`9`jWVZ^B@0Hb ziS#Qz9LL=Cr@Je)MuSebXeeGy$}@e2BT@M54lSxA&kX+zgIF@`m2a2{qo=vKkuY{`_$$Q z0NqrPGEDH3ow)l#?oR`jRR(O=7JG&IV!~c6 ze`vGVN6rgPN9-}bTmmIw7$p7=MSe@TofL{l;hT&LPmAB|h>8w9$VdNzPVnd@F_DOIkFK!-)A~{VW@Ltn^8Y>Osu{0&-c?kvt zY&wXIH-~Y(#X2J;2Uo;wmcVcR10+hb`J6V!S3C9$U0i;3_6X%F)o-(U>c*qG{UK;8 zz&N+((_t}t5W;I3u9pDGv+@^lI-4|^2e&Pey83#Qb{*kC$|zqmU1~TWnD7g=X()V) zC2#8EIQi#dl+8J3nQxOdsuf&BGv8s$IZ&GF#yoF&r99)N!wBB&5dhQefRIpnF$$Ym zL+!VHkBY%n}E_|Zd+kjDjR*qzb4I1FaL^{-oV`(K?W)qJjoo>t(-YY8Ax1}+qDR$VE0S7Y=*{(08xsE87hMSznG#n>a8-Mkq;kE(3py{;hpa}5hQRf>) z(r^e}4?!eNBoG>X6SVsHu#&gO1$pQM+x@2voG&PxL7{qIz$5^tP6gZTyMe6;R=G7% z1ZfP6>y11l$`WkaxqjCbr^*Pou(-bi*@7bVlY{4ZCWlS;-qOy)#idAI%A|#bgOOwB z*fci|q8Tr`H{gxdIZ30I$ld5A(Ch&2PR3-5?6h2a{w9=kg)+!RtZ7Ry+o~!prjb;& zIf3b>Fw)T3vIj1@Y4@fm3by=N-ib&>t7}C~Ow553dAgrXX{p(^&R*k3q}PoiTrp?; z&zR*F9q!n0MoN16$c7Z$HpjyWv*JuxpUFmAevdnHdVmtv1{Cm7yj}C^bw8so1a0in zy))x^!@t3N_9$hWt<8Bi&7vyTN|euFFsjleqUf;5WFjlWA!;9IL`9Zx*?!}zb<1WT zS<^IXZK%#jzal1^IAX0E#REM)c6s2`tH;98kMHAJ6F298{#~?z+d&nt+g2orTFZgO z8~2`85^#!yfw4Vc?UI9OV=z1ut*U=G9O7}70~C{E@`r3Oan)RU2oQ89?1aDdhma=6 zq7|dVA5n+Fq^|~nj(+{@@Es!Y8Z&RC5+>=$4CkRhM;5hR$|T2gzLI=_RzmplW%=Hk zTmTfV^3y`FJHceNLO(7{W~E%<7mzrT(NWmGZJeZ@McRw}mko37b(M%E=tR($6gg zzblsPGe11S9rLsQ?M4y(^l7M7q{d92hp@#F;Vw_XPxX)d(9o)^wmBg^eG*1pvz@^| zb4`Wj3z0%|uMIv*ZuAH5?~Co{4_}5I0pIOzZu-u9Skhb<)DL+fCDb7>bUq~(%35|R zS}v1L)$Q}0RV(EhY*j>P>|uF+pT2~A2)kMHknlyF^5C}G8-3l*xPktND&^XhEq757qs_JN1(|O z(9$l}o1o};UW&eozW1RBN*fs&y#hsL8_0wm&u8st{K}4k+U|#iPn|+wN{n7ryDW&^ z6cx;$QB+p0GoSq;@O;7wi)245h|euKpWZOt!qDPR{CDEQAGTG#y1lCFd|=xRT!J@Y z9x=9DMGLe&IStm;)#0-Jo;7a0CeqM2&o+hA8VpR$5lEhzwt>>2oA_l3R2bj4DJiNv z#WNi!8w=d?y|WvzaIU+P83a?Hlg#@w=PQJu@C{JaXKhW7x$O{ZP24pyRCQfj!wx*> zsS#0QBLt->%y~7(`P->n{;Ety)w9=C!lKirG!Iv~zFU6-m0{phxd1~0bU5=e?eUw; z#u>3o_+Hks%|8YMha_{ zPBhxXDn23YUq)7}>g(FRGwfKWiZ6xNFDBXO?HJ|PR%-POSi-3Tk9Kob{6Z3%Bv=dxN@Ox0mr_fJposq15=KFiV#}38QUjDL$Yt9rtck)_~uH9uXWXxq6 z=PDk_DvH#82Fe)(pjEixOr-vX(#R2lcdlyJHZbzYuhVkTE9G~Wga}t7LL=|UMEG9+ z;c_5kU%NtlXTU978Pk(-z22g7uYm`eDf5u#0qLbPsmOkzzcCv+E}mEfv%i+0=NNKh zW3(eozC<53k+4V&=fEC!I;`ANJJt2p;SJPndbjrEdiMG|aE%J_?G4+QKcRm>yx8F8v*X$w9Yt_n`;4ZZN;|qOYK8klv-#b2_n~r zX*`vCr?Z(V7TlTRXONEEsvsLaqu{$w6ou_!apyZI=Y|RfF0W z04~HR{^-bnX?_I_qOo#_h{<>*8pwX+mmm ztNoNCr8at~xl^7;?=jC=daXS?sR$8~D6<~RLu~V|(waIKj*fZBm5kw3wf9J(mZu#L zgQc#PL+i(=?lcb@t^vU;z^7UfYSXI<*iwns6ptvs`ygl~CEloU;IWNZHS|dEo>hyu zN*e&Fvfg*j5H8$Up6Mv?$BqjVy*lexrCadBLHF4XhTwNxPm=rS^I*}*KRm}*Ma~M} zGiJEokv@|0An{xLNUv5>QQ6+z4IDGJ==Ax}W?ooU;b$H!t1(2-hD^B*A>{W`3*e?1 zF}4}dY?(-Wn^bb#-C9%9b|en#@%h&LBgQTwJ`wptUfg%dkp7dpyf(f?eOOyXte@JI z8zjWO*`+~S@gP)8;hfeWKMc2o<;>f|{V?W~2ja<;@=w3%OMX?gtxTsO3!uR}!m}#; zPz_Wur0Y`0du)A7SUyVX_8Fp$SpfR2MWDaTVDH9dCdyUP_*C(Gpr7UEmocokl(3tJ zU6+!^#Ke3Z4TGg*j2Jh!uSbqmDK$Vo7V55wO_Bd`e7)_&-(%?GzJ#D!`N47e~5J1%z3E;L8EBgv9vg!Jip zPXC_3%DRNGFHqkm^;`)w<8~Q%_@%x=5EQRS&Gp{bqDJ_e=TWVUCQ1nkRhBx*p@Iu) zj}q_01*AcliIvbS}#m-*$QCyMHsy zdX2^e1^g)g>)I5%P?;?EGSpG(qfm9@HqQv1RwjgW6^yG{_cyAK@}-S|e(NgK16+Sj zZ;g|R|FA06Tl*;w**^x7qM%@fsyGzy)g&2KG{;j8w$Chh#5$o27 ztp<7k73V|Qv~STfS|a8Lpo~Zfh0ILXvEFF~A2}T(FAhH1;wenZX+s`st1Wojeql1< zdmLQ9p6QDxiB_MP%SH{2Yp|2vS4Z@)Ga;u1yD}t5G%Z$C)Y(W~K9ATOA9HcmrhS!+G(If~9nE)6i30>$KmerTejT9(3>iNPag zst5nNr$7hfxdJOU>z8W;x?kgo8K(vwIsW*Nbs!v%PDBz3OD^wb*i>?xbd8DbjPUGAY;2g zP@WI$S<7T;BlYJS+5CXfpT-xFx${$=Q3u5e0+?#GQKX565!kuEf4gDKK3u0h>#^WY zilpACVCAj)uWcuPj5siL#Rwgb$b)>Wt2#kFNXHG`gGh7-|JF~*Dl%?rj8{LeH*sr( zB=o97{hz}-qD3Qe^Z3av6{O0l@&fkieeSR=Jt^YPW*ir+ow%5na%(I3Ypg16Dh`S< z1+4Rs@Fsl>=hGqfHiCENSqJGyUX##}3fJ+k6=!*$T#W79*W@cl@f^9mCxfx04~sE% zA_qe~4h$m77Io*9713{|(#LZM`gZYsUx}-Lr^%Rco2u z4|YTRXKkg))c8>0U9Ql7&zg$@q?EqqFs4I^;gGxkX-sXZiQ2j}fZIEfQkWYGk~sIm z)qMWsW{7%<)jAQ31M74G-FG zZru9%`U|#=Jfr`*z%ch2x2R5GA~|zcS5VM`8h%A%Uag8Nn|IK(s2*@3J`Ig2X)t;0 ziHcDaGl;hoR;BoJ)+3Dj5Wu_sO{TuWIDLGyV9PmoDj?S=1FhuR8!j4fd0U zKBLP>bxqyyMcX6{%YVG|o1sR*=BjG%7bmN>pN=jlppOq85$XP`@h@Zcmp@|vHfwnP zhK>aP7+XIXivU%Rby@xdsJ@EaLRCTkQmAyX4G$0Rs~Hd+qx?sfQXgdcA8!XsqxF}< z_-pWd>ZMe_OkXi$^A7N`WCSj0Ta#J_p+vlgfxfS?L~<9+U2dNZT3c~6PG7!mVHNX{ zeew)$59r2Tp#q0bNd2$kpaT{gBe$WlQ#4M@%mbu#%u_{H;cwmtHt3z7iZMws%j&j2 zxa|HENDh3Bz^817<9QepbFAq4;lEXJI&gR%84ZaE0ZuLT`2$aC;4o?bGG#v_wnWVj z%@4IAoOG~15a1N>#9)578Und>@qcA=|JLJBEqwz1dokazPv3O^FLjoC9P};!pCiQu z{_o$6--<#o|0=&}O>Sb+`MR#D5Q7v*6j?%)LE^lg>Mj{o-k9i@oOf{J(FVZp;t~G7 zy{t4%eE6RoA)KWa?_?4mF%>e0dhzhYY~u>F)>%e4K-DgjPNn1e-)`iLTw|vmHEa~g z4M*qlRJD8$lbkVxdea-_%m}p9{KciDwoGjKY*__|3Ztcp*+{~V1=72vKM`5!-IjEG z_r5KZ)m#ndA71Q86ViH51h)+k^E|$OJH~7s-(rLo8d0XiZ1fJJ{Trl4_^ghZe`GI9 zimqb%BKBxxN)`!cro2;@dFvOJ&TwPtL8lWs8Bc2EC&}V5qw8ca-l8gA5Ny9?&+>+t zDailkh(IRN=#^9am(kkAS}&0T1&p3Hm&5mdC^o_!x}Rg-Hdd{U3^RlQN9?JaVB_UX z6&8f!5^~!mw?I@ABB9Wje1}o#Vio5ki#oSa`>Rv^J`9rnY8Gf^jq_Lk+kiCFHIp^$ zguk+3kilIyW=P$qvAm7`nZU__M%YM4N}jzrCqf~8yI}YggU52( z#o7yINX_h!9+qGaGkm)KDW6PC?PHnZy}J#S^^dFshoQndZ{VUH)S zc5sANr<%#$c~yZAh4{^kob0kkJOlrPffSMNxd{A#a+k=jv9wq=w(b?CkHBSunXqVB zWFWNz?`R5(>0+zU$y!ac-SUdavd5{>s7KCKf79_$sbEGjm;N(f;*5LjhVF4z=n6@; zKP#?HBq5pL!`>#EKypxloVPV;V)oL&^K5^#{?z^QirC*RB`-@)d6|Hv^nQ6MVQ77)!f$*s5FGzP9rU z$imGayu2elul2QHPah?$E3)did$;a?^ExA`EbaDkx&8K$bOn%y(;pXT+^@UsZD~(~ zptLCxRi~~H(pT2{wTl4ng*7I3PCfRo1~`8g-`is{I+tds&NITbY$>u{4CuH#02lpF z;VdsP1p>0Lv;*Ic@0TN8(w^=FA^tv;m`wMXCU=ra_=J)PEvLa6UVe8v?Jx7wc&85` z@`HBRA`zi4@dKoF2K%!b`g`kGs{?8p3L8s|K0KoYueY`e+PI>es2_eqZ}la@{i8>^=28? z@8ccRwY9iqoGfruGu=wVcZVjTw7V_jcA+N>8WLW1k6o%M;HU=d`?q;^Ql2Wku6`I` zKN=8dFBXULJB+V8A5%|+bNY5Pe z%sfow8?v5H+N@&B1R2kqm$O2=E$|EQj5Me z1eyXk*70eIEh>FaIMX9As@f6>Guk61l62sG%J*6`S(*mgrfV<&I_6V8?3pq_*SK-C zSZqEa;mdo40r$%EVz)O8B<_GZt}dF}^UCp)#GH9@<)XN9blNXi4QH*)HaWW_SO*n! zSpV@g%4KPS=jx`_b4v@-_D}etksVPw)q-Nl2UclmQ0F@9i@es-q)5%{yyx z1n`Pg5`Qi}g?Um07Fc{O?zU~$jkgmRrDpJd6=CH`-uyKEt#Bpq&hwh{XL2n7uzc04 z+D@i>WNknd3W~Q9Iy?x|1^k;hdk#MsM?YsdX1Ql&ThwL*m zGe-cY^guLe=##$(_ck<9YgI;a@}5imOrmI8o8r**Ve0vSZ~Tw&E6~Tpt@F)Rvmae)$ctEtW`>TAJzi z5UWR59&rX?U9Di04$V80`ql}@pz6$uGEN{2MYd=DRq_zdiuXLZE(TE}?h#0jOyUt8y7ff%Sc^gB1x6_cO7*{hHEZ+nu zcY08r>ORXg}GTfG}ec)#BDlHt+h!)|v(9u;K7+7weNd26isJ z#VvdCB$#&c`PwTv1+;&*TsX~HYyv!vFz_i@%E91dGcImai(AWc;}Oj3-cMMg4e{fP zeJszh(8|H0ieLM-mzh81wb}Nx=%}isTK**qPb_R-N!(Jjx(dgO4Q8;Wpv@bb#_YFD3}O9sA=BKNM*CDAX;MXZ zcQ?Fo9icKuL2qNrhd`#G=-aHnTe)l;UUechbVkoT*{T*sUt5poz9kJ;#@OfL?{OJy zoKdh$O%w4Bl#z$yCY+hb0&Ev+gBkQ_sZE5S_6p1~$E{Bz<@Uq!P*F*pg@fe$HB_fI zPsHc=rnM56kZ{miG0p2*{f|WolTKs#>`6k1dnwG(@tjU8N!#igSEAXzf~4Rzx>vSS zK~Yi8uI8$rtpUk+1b(FF##iK_-)`m;nTzJ&`ud0VXJ@2G;*qQuU}4FhQsRk@hMGpc z0*mH{RdK+usbra8UoIlzP3of!OL+aXjIlJey8FZvt*qkRb}M5D?_&Pk&m#+*&n3pk z$dlK4Mp$QLs~AzJl6p|*&)fH^^8JRED{Viwi7ibNe>hM(`6O3+K&a=+j~ zAt31*r&6v&m0gUVH2pse+0xj)e^++oi`9N(y}*^-?m@CDik^LhgpP!3UXVE!C^tg7 zzB9+L;KN7ye$%<~gh7j5l&fgtL4Y$=dFbuFCj~coJsH#*8rYoCy}iyaEP+BCKdCEi z@u_JNLu4z^^xLMm2-CZ#T3GY(;U)6|b4&k>Kc*LManNNwwNK9c>Xb%5$#_RPg-XSO zNe~%c8|CH;ZlR>@;nsDdyg;IEjN&G%bvH9){F=XsNbfcH#+RaK9txr0v^ZGV9?35O}{ByM7 z!`0gmbbfge+~1QvwiR8mxgAgvWpv6i(Y8N~o(qApYP(#{AfiHwAr|y1ue|TuqV2D) zhG+pYpoJ-oGbM>ODD`GYNOzX@ho6DJofeb#zTTX9KgZ$pA-XKgl^T~TdUU0F6aiXc z+{d@ewx7S2T9Xa%Rmy>4}FOPv17%|}*yI81*CoK@uh z>#1w2%2R*-CfBO6)4_`j$k0W`594z|2n5tm7e6f5#YMpRBY8hjMOA!jHt*m^#wip! zNPBMMJX@nBLMD4T;?IWc$ja#%x70iZPj1iXRTh5L?f)b{VL7v+@zVME+xOj^RNh{=g z8VO1+$LeG>(ZP9nhezQ9UV~UabZ%u7mTZ45BB;QK@ulbkgeh>2Ve{urQ~Otyb}3l$ zMq^X*zRp}3BuIad;b0%5h^2rRy}F^Hnopv~=kiklWzyloV>O8n#eK#D5?)3;?`d}blRXzq%Kj2TncH>cYeTlZl}9o+{7WnHG#35JZPtvBb;{Fk|jWqTU~ zx3+>fy|=upLkr5iMA;mHIMgd5^z^+%?2jMpTdnXWqK_9nFYqk1;cVP2@qBnRvogv0 z23CWkv%lmie^CRi6PT~Z%Q>Z0NOZU~6b}vHdSIHUI=q>eH2>NV?Ub4GJ4b`_tA6x| zHQ89Dk>;f1!M37WFtnEfH13kQwJ=?Oj-AX#nvEuV-5m^BoGvw-ZJP|%Lf0QV1ilcm z?A$H?o-7@&?+w+e6}Q+DH{4ftKV5RWgTE^OnszumW9ci%&7G8HGI%vio5Q8WScVCJp7&j;W}ah1C)Ej~?$%;jD3h>GvUE-><-0FhJ!$ zo^zTyLb<`S-#K1Ies#8%b*To$^rIyP;RuLVjX+>J{G8rS*73W zq)4eIkW!P|9MxCpbXHw$U*Pxxd#B}%%UXj+rCmL5UbhK6WvP1lPwL-tOGV&44obOx z280Hp-uga$Q71zvHs2osn=%f+3-{R>vLZk4THld6sFE z;nW2}X{_JyfC@}-`I9roS9ZTw?9%2kjM)!V_o9sb|iQ8f;!x z3)F94-82B1R3j&AhPUDKO|usEy4-xJJ~>NB9~}b-trXD>r_)v1o3`-Q^l7qN9N0ca zdhbJnda*qU&UXxWq8C0JybTiKFLd&kA7I~27ccY>8ExyVu$t3f^~#c8q&*|s(^@j! zY+-zxy2GD6!#YEb&^kq<@Xmfy6b>&qKR-VN!yptur+WWB7-lkQ4QedDjS`dDG7POo zubu1=pux7#W9mD@ZAoV^DfemyDYl{CGLc5p@QJ=wgAjD1qdz5mo&&c%Xsm25dt>e~ zvpL_tnm)joq1K2aAJj>)X7fmHQtimMPBLQ~rr-Lp%R2zOZhudZLH5WQy zAnFKpnk-jk!MH@w&?QkQirCXSKPVUOd1Os7$+*Wxncdwv)gHEqHM{sJE#_v8Ada;? zA@ZEu%`3NgG^XKcex#=fH|E;*+$2X15U-ocxLGNv&blBI!he#cZUOI6kNI4(bT%M= zA;+7{0x1?bIOfUgraS(GQWUot1FE&h*RE>@%}K9C9Lj$RdEIPggk5}%IvMu`=@IJ< zu1nK@(F_RRuLbeUXRu4riX1xMSZiV`S(yq@*@(AD;ncVNPA>ohlx zPdXcq`5$f}OT#avE@JChl)=`{p|$wf5EK19&09Ry;YD20=lt@WlckAxV^XT{Afi7) zfqRQPjh(V*nJ_Tq^U}~H2UldMBX78QK z=tDK_?Ip$dCuJi{g)WvpB=@1&bZilw2~LRwH1|K5uFWb zsKTEgExMi(ZWf=rpa>{k|3fb)-#nN!Nbyx^ZwR+P6OIQkBh$@s=ddoOpOlum27i!( zJ$2UUI;df(<`MWBov&uG_cHpKBB;hpGP>j9jR015pEYLD{stA7*MbIZp~h~l$0St* z8NqAhXquLXJ;1li5Fa1kg5^)hk2jz*t-oWP=aVc4w%z?fC{956wkvnjiC{mm;%fV$ zAV%jep|rnM9!O6(rG>1*5^#s0BEIiJ6-Zw@CiRNS-<7~z1S0FZG|cL@@(**MtC=vy z@*l$C|K!k63W0x7RR3Dk2mR$_{)cc_`osgZOZ#WLlD)eGDm~g0#k03A1PcJC$j&0mU?W#A6PYB)HT>)iP}9#SO-&(?{V*< zq&18$Q2Tc3O=3=d0g&&n@UAtL;9&3*DG(xBwjXh`Vnnyzp>&~8`On>yOZ=A|$`Y55 z=;xouKt+W!o&4WCN&NpcPjbZt^=4w#{$xZS(H&M=DsrpzKl!&ssDio!WIb?5@#i-G zO>h;`p+>+(T&cv0|5FN=Do_h;i5Djp^uPH3y+mZxtA~=%H~$n_^U%;=6Z8L}txn&h z{bx;^?pLR$T7FzMTS6h?x8>OL3(vMc@XlUtbiblm~C{n+150;!h7APxVyKhgiQvi$#}vBZnw)6++0 z3dm;xZ(%6zME$}v5)I9HkR`zC`Z7C~%D&C?_>Ua}x%}TVJE{Kzw^LTEc@0%;9)dV( z8a=za6CEfzf0%fgeM0(+wC5K!)@&+mYj8n9H*Dwz$)m12Nb~->QLa{vG2(O)eSC7V zq<9~U9L?`o9)^ECsmpEPFO@E;%k>W~OIX^nLL!N!Xnt94#FWh)SEbI2U=5vz%AZqg zLf4~iXpwZAg>|4O3dyB=M@yTSk+HnhoJ*HqSlEhnwlaJ>Z!ifB=T^cCuCM3%qN1XV z7Yq#}Q^xrC{|48NCNlXGb8`VEXvP?AOxMF1f^Gf`_SUB{i5XAC?_dlXE~TmZE5vIt$FSiA?B5sFCLPWBUPX*l zx2034kH)keR~Sq}^C8v$&hnF{K};GS+}qfJoR;f!B#$p+DX+ZME?0K8Mb4P3Fd84w zGbP|pZ`V%iNRhYEs52V;gi1bs94O03>vAkPSEV!BY8N_OW#tQ}aD`=Sw3No8RuO znx^E~BOUAB9Qk6}>W`+oW$>wLKB-{sTS(bwp-{1)w*HosHliq)b$9(<$jX4^8oa0}LOA!4HjtXjWuOwWW z$odEP0tRz@6B1c%c0GHqa>8rk($a>dD9Me7ust3^DZF3l%}dM6o85j%<-^$<*ZJhi z)eKMP!Rfa*MnFuDajME`zq0e#Y8UO&$2l2Sbc}JDIZL!^=kO2a1$~RyA&|X{GoGbl z;Qqo_-=9Cvh{^7j^U`;4?(T_pB4||N4w&$2zv-FBJCd~Zzm$8qOD1X7>N zkXy_?eoj2g!cQxQ+}II-9m#BdL~x&cfq*WFZz3;ym0M!_UG#S&Z+D5{7{a0a{iGmd z1HTWkdH>H%UG4`{URO= ztC0&vO_xo`G&sBSE!VGIZEzTc{jy^_M|$?kjKWDL4IuZV-VzOuW)Hc4T3!&LEpaF{ zz&c6*{3;rqt2Mu6P_J-)d9L+={T5xN4oDOiOg7S z>}>HvbqNK7^LlU}#CBL>Cn&tH$tWAc5>>BO_E}oGn=-&s5{RW(9dY{H1$HN3kwY}R z*yz3?g4>wnp4aWYN#lftBELV1>P4ofp)r@n3k^1eUKJ<6Omh|rE={IWrb>~5-Rn61 zW%kBdcb!{{yCVr}YjJQkbJ6iWw2D7Mt9YpS_)b|pc;Vf3x%2qFn(HCO!I${dS-{*suKL=D_OSx{aYJ^Bc8b=rs-7RTg$^D}54 z9A)k3F7?Ai4+*JJJJ%W-b>U68Kik!)=CpI3Qxmjb(|Y4G z?{Aw8I&PWzJU*Sob|ki36JD()Zqw^OP>jZKkARf9swJGkU29Z+Yrevs9KkCU2DSVe z!9cpu7_h7Jd@gOWCWYoH)If-w!er>CFzQQ1#iHI?x`j^sE6<@__OV^jYd86$yYDr= z6vKz&-h|usmJK=+Nb-af+Pb;*Jg)EMGzicAb5B@gc@pcT{3RXa5n{pQ4Q_H3dPH>L z-E$MS5TX7c(Ux3onU$sUTX;Lq%Ykj;5g>Qz6bh`&X}Rkc<$w-92@xAOLP@IVBxAZV zaN>C~v$1shcY?uFZwXFWe&my{M-!TJJ;8$$q)WdH2MDnOxE)_p8c#D;1ip0 zewVy?YL?4~rEa0>c=%(8VAPVN3E<7Q*dTr?XZ$_q6@9eo{>BnI=O+^^;2Abtbo!B5 zPmAJwua8~@&d`dKP7^|o~L6Vr}$x|Mm5%?6VPead3!igt0lxQc+ftFJU%4L*X z80eWmE(b?i)qbLHuNn2_C~-$?yXACR1iRUawPAdI3#M}w$w{lJb^YxjXFaP~hHQ%-qtIwNp?n%G#xxnlrGhD7FtFwM}>87pxC|vp~?6W3U*l>f$Dz1OT@?+3 z>)uham=vwxlkLoMvVogX6WCXz&fGPTgtaE;PL+o~KniPz)cgx#u0Rj_ zU@Du(lmw^*W10TMgFNpE4uRujsk0p7%lf3K@TRqFx5s^N$Y^lSIYifqco^x8B}@v& zdH=I~8yyL$l(14_;t84`A(&AW3}WNVNTRPYC@HPvgP{;88y@(b9HHy?e)lAqS$U1Ph* zF{w}fP_EZD=jVH(*=W1?r7KkGs3&;E-{(=QAsZ~ zx*^8?e9%D6KJ}WX3C}spnxv795BP%&;>w0vRC~+^Ora!2u^YRV=Jks zFfRzX+9HcdZuzA)nw{iuy~OCi;ZQb_Pik)=p2>@V^x9IeC*F2aA66Stfp zmF8wXC{nnyGx}LZ#+j0m;~Ny;gA*hz_KwK@3pOXDlYGski}Jka4&j*`jH7~j1SO>o zWGprML_wg?A)D*L;qkm38L880!;0HHn#I|EV3fQrUBqzMbOAR4E*Ay{c_J_zsGrfF ziwKng-wLxtHW-PVg0yInMSQ-p#?r9g&EUb2u9mwMGrPxF2Pbtz8W>BsGpR`3!XyTM z(s1N{d|hG95b@JV)}2ewsi^|y;6SaPY-D|)v0{+V|C#TYpkvr(-L`v95-Jn1kq0$6 zTP`rT*Z3_{VD6LAJ{?#KX9Cwq%g&|Y2LfN)&fAlOjiLwR1_=+(tJjNIn+#qfVv@tN z=vuFm9*MeHHD~g?Z8aEmC|vn08aLhHAft>qSa(%2O{RKe_J=Rv{--WbhjnZ&B(`+T zdZGSkjHyagO|)BC4izD%C(X3un(lu$1~K&Ns|9xiJ#rAsAEcN0X9KQQ46U-=Q#e3! z1Ww{~u&m4G*#vl>f`?fEg!u(JUq-VDr({rcG;6N_rAL><~4mq2|U;A z69Q|#*W)z1Lcw$l4Aup-puBjUMzK2oXHtDqfFs^j5ihslGSe$ce%W3hV!LeHkQ2Ty z(Ac;p;w1c+#5A;gMN20s*WK;ulVv&{x~@d*!TYi*l0L$0&O`tY3#s7BCAb13A2KZ- zo1Va9vH3eXJ|*YzDb_x3doit>8=ag}Y+RYXF^~`&G_<@Yv8&f)LwuNDZ?GMPQ8NQn zEsdgD&goguLXO5+FWVMJ7n3-`;^T|5T!rL`9PxLINSs(X&&d&X>UPq)I4lnJ_5Clb z?T;6WZ5QqLy0~NY8gb-WJW%09zrx|C{G_6Lg(@jxAcvWCZ?7@kM!@T}wu5?;BhtW=RP&Rz2D`3)+gz$)VKW z`#tw;_S;SO;2>H!Hp(1rZv)16DPv?6<&=NJU+G^ETb9A8^qj4TT(AdR2OyvHJ*6x< zke&v;J6wFnqSmF?J%LtNREd-dG_29b@er}V12|09&}=<>K4!O`AX5XGb8#rsN|Uiz zkPkcM1BhJKRZgU5Qq)Z+iJaN~nqe+(Rl-XBmYJhm9O)#_q|ty&JDZ z2eJpTa+u8z<6&rooJCC9eA;4lm=MYcMr@A1$ly6ga-u{Wiiz8}n6HwN;`RP$=JQ5q z18x;bBx57+O=ssgYIk|+nbYvw-?F|hFjyrRHo7@oPVw;ARe|-K2a*^?2DUU(9N)RJ zm2|a4cDjwCJ^Nm;y3JuB+c4AK$S^r6Bh*iuEmV^dk^2PZrO`TJM)u{qZZ3sdI5U6j zmVx+N65}{sy6zp*QB7otP9D?7w_D*nIgfmJm%6okD&>?EvxqxgPB%I*xGC$YiOlr% z?zVsZOLUp4$0T)YG;n21T2Ql!az3UpLx8rX0I#2fsk-thXscFNW~*14>$CmHug_jJLv3~*n$`QdaSL3Yp9yj|QtcCDp1(wLCAG0$PEWC{N({+-N zY2C=;Y8#6e;R}ptD?7)u+{Azb-x*w{)V=p2N^3t&w)r_etFgChw{}AUciLI>7a6Sb z?T^L5+5Q$@!1VTdbf-}Z*-A4psFEGgcD*6xoA4!_R5IsFo&;G%KqBdWT~GQLH5NB& zK8!e)iK!^&dc_)S03*ODz_Xvg#TI`QB%5~qFrP_Ro6uq<3-0`M7qnheTK%p08&Ue& ze&t>$mb&vwm59mG!h%j%WPERW?;Qs6an4FglRu&qfTnj7VJF~l>g(F&ivYXaWhPG( zkR`N!N+WwJ)1*$_wm-}m{#`cO7VMA957P*RPwUC6puDKw{hGh9+$K5^k?ibr)uK9_ z(nLs=`X>HrqGO$D;h)2?OD?K!FzANtxaD|>HAX0*CnU@~XjAxOYb4f6*!lx8x@gu$ zciUY+-{2tR%OGu9sn2g$oouAP{ml-V`chi zXY%<%dr;u|H`V=z*8bhZHY2DnIoK(gn2T#Xc-V&RH{?Us=BI2q?D6nf^WMWn$6xw2 zp=O6@M8c06;@@}T+kBYMAs!S4>D;PCA;1n`Xzz2OAF|@fnbO6T@sidF4*-Nz@Mqg= zIC>=VB_B#V2r^V|%WHVC69fapw?VZV>!9ic!;x`+xzAv3c+q8=(3K9(L-aoVo zq_MG)%AwuD&#Ru!=aTIl&Be?XQhyZL-5tn^jN1NWj@aTV>%_v$;694TVR#jj`Q>Lf_7LY&NJ7~F2p&5ghR$;@w{ii`j9I)ij~ zuG|=Kd_l1O}h~WdD)o_4UVgxf>sk|`qKY{13IqLla+sabOd(`2Lako zVf$rR21ao6i?&t%TlD7}^4_|QQp>%Y8u*uvS2fh%LM1;Z@mx6$uloT0(>i*(=a8hZ zvx351=_4>w&7!hoQ6d7?>{j-1p3easM*6-|+RFru)_N{S`{Z3`x3)KmDo&g!cW12Niy2qP zyF5GFEy7Co;IQ-pu1woJ>sT^{Is$v=yt>fC=E$ImBCnn9Ra`(+TUU3*alNPKrsdt= zk$q#wIMP2fSl{ES3Y!_)sta^cPMiAHJ*VPT;Ys#X!hbljzL$^x;ywDZcjLmwIB~Kq zZvDId6|>Wa`4;hSU{siptdVyl%31u11C($$PRz3+$|sEGF*JS9ULg~cI{X0~qRJzW z4y}2PaIwjKHjpl4vkNY?D2S+7DEM!f+S{O04rP5-R4i0PdkytL*$+t4y+MWhi5%z& z3_jcZDAfrRN)I0+#2F}iWpWRJPT6+})3k$aLhh8A3(f3kJT zp%lfur&34jtY6P54LYqb3YGeRlodoNn(wO|z3MLK{Y4Nz%I{jbtwSK@J)*>?H+`Sl zGxr8yS?tGL$J$tummgP^P^v7usauIWVTRoO4dkGpK0!%*6;ht5C7h4(JI#JIkdM52 zsyR^e3V&A^3ryLn5{(o*cZ;0cI(H7OwLGBYfBZIvN#chli~#xAL>1gS32YR>#=~;x@25!w&Zcr z&s9amY)SP)x0&K+jdL=?g!(32gSR+SK_9R_1ZkcEY^)IxoFJ@s5yU&XVz_NOE=dno z_=j_Tan`_=%OqA;y4FP~NbHQr@xu9h=Q2B%P(resY|w{IEfSqbhL5=akl(>M{fp8+ zk1HG`0L4ZV%d6(xML5!9sHOk73D~Zi(9HT+RNS+_wWl`@4VkfkE5j{|O84;I`Oybl zh3faES@%`{B;K=^Hq{bFK%q=~FS@nv2S-X?i&xs~_u;pjXAY)R1#~!oaI+FppnY@x zd3@w&PZ^;dn+Bm)+xax?{&~egxVaGjuf_C(wQcuZ-~l?-+}XJ2 l;S*DpLS@P$9 zpKsZhb@3?ixP&TtBoJj|mj}R=3uH}uKAOB*_*v&<2PNt&R@&XGAg=fmk5xm^x38q1 zBZuzQS;%t{ zG5JDNeSK@O?RSkT@{BeVa_QZaV8pjDn39H*M##rqYksTa74iloS_!nbB0^ zC7Ui2lH5@jn|%jx!*$t`88thrZRtQenYvdY+Ia%-gfN((=vuqz9w>;loC$$ON}iZ9&8p0RZTY+_oLB+IrKZ$mbk_(b4rk zTdlA+^y49#ulXCda}la{#K|n7+N`hJzFXFuq~uOoWaHy(yfI<7;Q7`%lSyBmf+nvd zayjaF%vGvLQ^Y=dZAiPJ!1}IC>iOYap{liEcSU;I@MWG_N53iI@z;lZbw%YL8ncmt zg-o_|TtG7K9wRT;NXZ$_`Ot269_LK%n$ilwlxY)=>UVbB_lAas%EcD)@*5#v-)+Fs z=;UZ1keou-q(uHlCGeC2Qs9`nir`z((ycx!aplstp(=E4+M%jSNhR`h*tFE9jvAQ1 zK}Fy9<}@$I*mFg!_oik7glpAP3wN8j*euT*6j~22u^^cw2#%4BXef5 zTlCOlCmpHt-D2We+H#h`Uls6>e_i4`XEp(M(*HUbS{KR}NLT>>?Peg_5&SLw|0x}} zvtEJ~JYAhkQ9pP4*w{LKp(9Q0rr2`19l`tZMW@=?<=@UsIH+Z?f={VH4zGK9Aa`Jh z<1!Oi7)oX|Vh=7ha{#Ik?fHpJ#>W5C@%`t+Nv|=3YD@gaX!#HSa8hGHBE=ZYyI2~T zL;u=G`S*MoX~TW@N_l}HXqypV^0h=KOqo)pXIB0((pR=g(|YxCRbk)f6QUujfjH-W zRHNR$wtRG|EwNj@yKLM=z6XH3CBZ{_X?J4y-h~iSp+%)JL|}WhDdq`NM@-!J|8H$a z4oP$g0#?lV21jsUx0b83$^=*}3dM+wh{Er_L6UPV9qo3RM)n01E(otIb3 zLtky@4qN7WEixpOU7}7dGW9ZhpG#$37%B0~RLva$4$=QAq7aTL3O&6>mY^L&H9~+* z{;lDJ=lgE`=GVb6SM#87DgDFkiAEJ?3lHWA?S7cK*iSMtIV1VF%CSe5mwSnSVoL9_#$tR|!U)*ZW82?BMFgqoC&yMxOQc62Pweq?G*etu{ z*_KzPnxA)e25Qf*E(UKvJ_wWr~hk(y}B~V}TMw&{tC@w9k!6eW)P3Bv>d3Ar}VJLoM z+<{VGRv#Ui@s;$FIRJTZk#J3o!~2MG0?1iN-RZWZkC3B!GVhQh$`?F=lFIT5Z7F`^ zxtPe{1>Py_${Hgly8HQCH&;Gk$p)oxO^|zgQ+cld#2_VAS_9AY2jjt3ppRyR6 zt1Z_g;(~yH zTSIz4s|>^s^U>)cCLv|#Ur_B233vZ_)SXN&oowk|4n(pye32dAP0qhPn_dXrAu6?e zl&yh;fhNvtx9Y7JQ>sZ!LbPQm4Lg5w(g=%XKQ-h4;)sj4Ej2k^zNRyrld5N@B1{cm z!~c!)3voMOE{3X6G7pmii@U+<_vQCkiy?Bk)Rtd^Oc1f8UWqJ|E-VkYGtxP`Z(kw0 zMP(!_flPc*%!3Ve04wj4=6Ue8;(*^0T`j~M`dhIF zFS;0-JlWS#shjKo^MRSF#j@t1dii`)qE0%H0&5gVwPL{^>lE2O;73(!$!9A`Zr=y- zl*mHOVs`1Lb4|$8TP>vSs7^B1NX;yrPH)rI<+bw~z5u_B8FQr_$-XzlOJ)$lN{hi~z$m+hoW+Fdl7C z5EI3GgqKyB&uAFQ9Xb}V@Yp~reoNEHWMxPkaCa2+BQ&~kxx>s}jm7d5^iL=Dw{37? z_fbVbx*lySC(Lj5`c_5cn_d+@bUO1T{A*}EIp;L#V(HKM5^aq9N$p9c2j2;~Kd7Bj z3jpydc5Io0)H*TuPH~BO)#Ay6)Le7J;UR%?SY!Q)3(uaemu1W})G9mR)!_N2yfwOi zD$TjPj8$SX))o;84Z%uJ<*6VMatbZn&ClK~%%$|dP)ESP_dUUAMnPOS5TqD z*EXFnAh9}$2)I{fkG>r4!E1e71Kvufwk%o=1cYdP`z5IiK6&mcgm~|EH2jH9LEezr zToEyzhTcj!zW8cQ#3l(Z#Cz4;)MYR7>g1E=n^p`|R`VKqr3@0cw+>VfZTn}D&;K87 zY|l8si!D!DmC!Ut^+pnHeaD24zqGfK@4Uo1_vjcsru(p zV;tJ#kAGSwQA^2ItS)+<3kL_{mL&3MHR_)u@Lee&0g3d(`c9E%4|8luF&ZKlM4e1U zM4wC5)#fQ?GGyE<5`_(+{6&?g*S9nclMpX0mM{oan=Gc3b(JW+$bCpyIFlpivm~Hr zg{U|QFxL!~!710g#E8U(Y(WC|Y9O!Ba;%NV%QSf&;w$<3WA}zy$yk~H^mBJ8Ga$NS z5}*9@eo(!$V3kJ2Yte03Axr{+mtRpUHS*Pc?ia-nst>+{wEatFf0nSU1Rw(eZ6;eV zWF*jYx4O$tO6@C>OxCQgHH?APJp{HV!Uz`NDWyS}W08uhyv#dX4xb~6W5p8}Z~OH4 zyy(Oh6TZ`{+Uc)ATC;daN#w@5e;+yj3ryU=+)INOk4caz?Omx>?AfxCt@hu6GiWU` zXCf<0NJtZ$+guvjnSg@^$$14r__nApQ4S_xR1IAso3tU>%*+xUCQ$22e*YFO<(7Ww z$D37$dA5>F2r+tIaIt?Jg3{d#Qmw00+X-08yujyS zuUv0+H^~4It0E&e0ewF+Rb!9up;p|)HWiWSig+=qk4$RGx#IeX-2KqzK%f9F-xGnC zL@u6{{nulb_aG-?dc9=gp&GNy+EWjdjFE@)u0KEh61i93rfGM0*CVp+-+d+SqIO|G zZ)DhutEWHVp6Q-(2@k(|8NDQhW5uTn$r0Mi>dxNiZe^;Y0aj%tZEa*LAAb^iEe{#t zsQLT~GrY_l3DIG}=rAH#^Jt8xu_AKt1TjZ8Ixt{eEnegwe~Zl0UNQ!A#+eSCz8%hZ zCZHNcsUx~3mvbr&7CDGHPUZ;AY|Pk52_z1GjM&&Y{UBPoW9M=)N2~4}_vD>&?e4_P zM@qx(f*s>b2W%8RW4rNkg*~i7QCWc363e)45!v#fVa3Ap-J1*!6kSce^X!?kXN+`$ z*cH(hBN8)+Bx64n9ue&5={`FGz0>uO`v>v_a~$=n75JyB`!@$Wo;I{<^W4tN zuXl^AUVQe*EZ(!xRek9Pv*iTZEl&BGkpZT%01*Y*1dK+nDl5Y&t~kTCLaDu+n^Wle zVnDJ-8yS&zoq+)JT_GK3{l3Iq0E)%S6AgPmHehRPYcrv&gU^w?13x9%O8mB`?1lI> z*&Qm=iSJ;doFE+39M1*a=H!7&VZUtlBroUI;IKD5_G+*Y-DMq#q`Aj<)@bkN>=J|m zcqP-OKd=STJjBy|+ne)$)m>fW`?3RLXn$U4M$3bGLhKe)u)6o1?S>#CFP=Uj)hjLC zd~{=?3etqTJd@M_a7#k#UQrBo%TH^8q_KviAzT^+hMvr5&>zy&Iy!k7fUb~+vuO89WuW3U+L%%x#@8952sGfK9QrKFrq>tW6AEyX}%j{hp<6r6M zHZ=t@VAGS+oeQ}+p^{m3Dtj%)2WzY#w*>y3q3Ox=p}OG|AMMFOJdx(Bgb7RN+GBI0 z2*Yu<+1w`aIhyUhGj7DkuupD!_-q{Oe?@iw{@{bG28cX0!UzrTuor$zbTbU_cQ)y_ zVcwQ^R|@9@q_3X8%=($lcdLDZ}Cj<7s;4(kIisDS+CobnllP@&Kb z!u1tYmf5Xl>&=k@oYU>@a9?cRy~AF5btHx$!{u1y#+*Uh0lrG82$FHF=^C5x(VR%> zl>F0AcAW^l?$M7fj*s4n0m>fYQ&d%mZJEcCS%I)oLce#Yh8OGt#8YPVUPCwuHTVbj zUyuCwOYwrwT1P4=9)R&OsdeP~qP+fNBk@*Zna|pxc3-Iozh{0MAv$BezTl49?%hUh z-x&8VG(9{5(U>s%xa;CP2yjHf?XWSvGQ&rnZfMwGq;ON(F_C;l3>p1-J}SpZLW#?f z)wcAuplq$T*PIXWeU*ry6pT6lBSR{SZ;=`gmPz_7icrXo?IF-emLwc_H5{Y^wntgv z$*i&1H0m$tEjf^X_i4@D~4N981!{b}wbBay?u z;}S}G!0nB07clMy{v~o@lYTww1^%*oc^QD&{*pCwLqrkWOm;{k?S?t0;5CfC)U?NZ zB25J8$KGPzqAh%v{XTyAvR^dW?T9|akm`0%O-gL0m=l4oLP(^%txSHuf4tV+mo{{Y zZ2#R+*7q#>M9Y#XWlrZ<@-_gtIy-ZYQePKu%g9Xv1INBD(0Rujz*PHgV-hduf&Djw zhG?lRRLwk_HMFfUAC7*c9qokR+=Vsc_`#>l_B+_ZX;Ziku83?)P!6nJ%=NfLm(g`TrFw=0v$3M@F@E<8u)$0|eOjh2qr#2=$O8&`r# zPqA!ZATX}2r|!#{(XI*0g2yi?j=RP8Ue6!lSRK}%7AwKqM|6fqorg<5t7FBcnEnJ` zU!|(Qj(E{O8rP7t!vXHOJOM_U-@@OM8SPLvP#9y}t~2(96APB3^Hp9c-Bmf=b2Dp^ z20yxf=qEtlCf;(7sW-%Dnd{%cUx?kK;1_2h2EHv{u!W8`GlM6x{hB*>v<1$`@Jc0^ zu+}F$&??*JLm^XKwH#}au}fp?GdonPcr!^;Qv6$2XHIrA1BlLNvaR3)Qw?sAd?nFV zDnnt-gAMzrEFJFsgcL94rkK|zwy`JpEe{K;?q$|vQpY90*Ui~>EZ|Xh%|VZM%S;ad zq-_$0|VuQOiaq!qTg4#wS^*HfIL`M$#mFV*GS=*GiqFLCId z{KU}0#g$QC@(Md$AKY;yuAv%JzW!+b`DU4l8JQ3FX@8_8fam_LcBJ`4%w9=9u+WKR zc_`szzHGW$r?(**>W=U+Rg~%R8d28G%5dhFxr3`4t)&mE`jy<}QAxZ@<3YIluF9~g zH(D1#b1mH|BbQ%nrW=-Mx!ekOgw_IEC~%_SVmtlKL(#6Oj2i3OhS}civGSPrSng5B ziW06CGE+_|QQFT#*>wIoYluP&$RiZZ1u!!3^iF{%>gI6qIl0b{CdatUsUGQ^=eB$7 z)}t7Z#b;@_GZC|GhY(P#_`h{U^?hA*|Dxo`q_sPpY)&cjC_e`+m~Hk5Z~M53+b^AN zS{!fj?hhj|WQ6k15z3v&ox^(VI2VU@;12A1Rm(9K9D(8x_JyjOEKhFrsP9^!(V)YK1r5D+dDPz?szyG*0jnwR;T{VWB^Wux@`t5wna-RO| z(Lxdoo-U2&#>9&MxP8`Bmx+QAt5poLA~G;Xf8~u)60%NikydDSv*1~3{DQ{5$(C_A z8^PKjA3&>+o4AY`~mn@x53QU8?qmb?Rw)6ZNAEq7R&;Ivl9mr|_peb~&G#Uk*)>%M=7_SdsI`=qOJUex2q=*FAe4hoLy8=kZ z&&oT-`2ZS#;1V+b*apvR)n(es3~cOKGC^%?bM+rIA>qA$z=bDNxTaAJ7!H@HVV zzg%0@*UuE=Y$-M@JlnVeMmDw5J6kUn&80nZpyAt}6M)PyWAs@kM&Bj2Y~xbsFhVAu z4Y}I_OT#ZGzruB|w@}gKFU!bX;a~5;IK!y#x5_0duax__DQ96uD^fd6r05esW5Z_V z-`-9?Nj))pzOCjT!DBhFT~_lPY*NEsAHP%4A()M0fyb#m$@6T9)vQ6@Zff3?_h^~w z{16Ef?*Y`leapf#SFvF_5{Ns|iItn3Cgm2+!j_X0ba~ekqvV~R#=vg>q@${%YPwL2 z1VZGb(F&U`(P&L@X9Xe-3O;QPVyj z)AnAh;|Yw(Xc}3!{CrOCQ9{*3JqGEod!K=j5}2m(mjjN2Y+94+b)nW5BieGYj&C%m z9~Tn0xSZHCv|@d7XTRD#p|84npuuK5(X1Ue=}ILfG2hlYZ8;rYyTvq&V!v0F$Vadx z6?p)>jN2}8JpUEP!u%2kjbfxEm4$F;`o zPEE{=9Dqq_iPoXV=V!6~N~1%h-^~Bii$V?HyV+A1;k=B5`od!3nF$))`Okl6Sl}l-|PWUXDBx zdWx$-r^;(Sll}PnXPw!O@bBK6GFiGTnZVmRL}q>N>STsdog8n|Yi{wh^z_c8{*04S zO4B=9xjVC;8Q84mpdNjhov^-S?DWT}N*PkZ;R_FrJLU)aZkHTqscXSDZ~HXB&47Xe zBgJ62C8QHm=p;a7fJ3M(CSv;tDHcf$8Kuk(JOH{_~_!WubmW4 zGi9zkl$74@;bBv;g{u6s)NLW7-Sr$<9+-7+;f1eg?|q$xgwX6;uZIif2yLml{#U|6 zowb31p|)UUk~$;!huag$EBq*6-tNPX9kv3w{@tcMvw2s>_*k3@!Q4xXOlRMmnJfi5 ze?A^eL6vGy{l25>su;Bq|*Saxu}g; zaE|&6ummF$54&sgk_?69Q0un6NYt08vT9fc$4X$#D#Fe>?AL5@;U)rKU-=m>BLi>J zbnftKcVE6vH$}f`UcsG_6xx+Fmig|Ny@eaV?(~}w9v^FZv#BHm3#kAGS~zBWkIdZ1*N_^eUgu&e83= zc7C^OBH#P5#`He}EH*npkH+rsJwn?NJnzDEpy!d-h9DTK;O^b-+zPd+!ymryB$89^ z)A?&)RMX7N-sqjRtA#W|9o(frjZr7U9?-+b8oUr6F>}%S5>Z6edParPnVjak{yo+7 zoU92-N>v(FL8PJ*tUCPr7aE}$D#-FUG|fF6X|c(jElKyVgfk0(y~IfTu^`SMt#&p? z?TAi)8!QWSB+kqf)Zba$8LdzDFsSRFK05vj6FA?t&~)nz&YFp!7pm;E~qD2ShOW>1?F`B9bF zETDz-{OGE9@yDUREaqo|^)`^*MCaEF8lMr2?|p89<}f zgsvVqzIi8c6p+}0;})9VQ}t7ezTa3x9;qvofgKBgPh%smFw!P%wVb|TTFkC5KDwq+ z+q`0QF|%>B>s@L1795geTOg*MWm!*|nWFc`jV$_y{-ojzNc8N`r%`T0L)Z$Mgw^AB zI+U8X2cbiSZoQ(5Wn~tW@sy|{`c?4$%J3|9_~_3rCEB-g40m0z<#o!N!}2XwewI8G zmGWJHrNalyF3<~?h_kDa%WZ~jo!+9hljQNGJ7>hyN4bKRlYBJz?SVj&0AorR! z=(6EaLJ>0Q*Qhh%A^izNFV#1)rCRlC{DIpbYY+k}+vhNvnkDNHeCra3e%cWb#~S~w z6bt7E18?ZA?7Ogtoc4NpD=2cCNv>Ff`m2E!pd=?L{)pnhm?l9`z=LbhIg?({@|OMv ziCIE=DF1g>louUNEM#_MFk>Y}i8EQZlP!lyFJi|sOJ90^km6M*sQSQk6@L|5fMPu* zME`9m-E)rath(*H+k9jHA1SKCVkW}Eixc_oN{3L$T5i=>BO=Eg38DfVk%~*$gx~v? zfJ|%h>y1X&S~)%~M_omgDr)ukoTd_=1?Xj14@A3LdXK4@sp02qmdV2>|Jf7|MFx`? zwWzWBWv#G1r>gCs2q%Wd9ECap*7NPn30J~p=YUmYO>|{m%aB>$^{TGhuXA@_?#C&5 zPWk(L(|&-T3boukrhQt6F(#N(j7RMRaa9#%sR_}FT%^@g z$NgJrH8I{vLJnlg5EOWEJ~hBO(?oRiZH1wTHb>ScU%xAy?EDjD=+K3*w}LY{6QHVe zeykO|Ia4;jhkLzM_h@yj987PRns6PL8N2?0>~oZaUJEz}-FjV>a!Pz;H*1F082xV} zg;kATJB>CO@?-FdL~>L93=N8G9s0;6u^bk=#2~NlA?Ws*&TO6T4rBvLF^O3U&LK z;g&iir65s-3Swfc@k8PBn>oAlE<9xoY^SWMlxht+%6ICt*u&nlGodN?{sxE=>WH+2 z((!8ELd0K#0`bc2IX!_Nk3m*r#6}k_uN(F!n(xn%dsxUaq_EHDVATH%K(BeH>^pEz zE3Sm9lwo6)k7hGM8#6`4nhWl2%7*Lyk^c611xiP>e?0H*i*n(Hx-dF6D2vW2l0Jx= z{~hSFIvw^q0ZCQX5R~#9U1*1r5ET_ELL~R`^?ib`f`@PEu>>svia&hLei$La1qXBU zvGM)IY)ZH--#eq+C^6ofA^a$wUnYPR)uw4 zfOD`S+OIg?9BSsVJ$a?JzNL+Bx;igtSdI3?!Kg+H!zO)1CI0d$k56{TUm4n=Dd6n~ zm)~K{O@+w#nDzUkfK_m~Otm?9FULir^&DG{6{*G({>T#skxi2`)$VPIi(n@kN;}E0#Y^DFd^`wFvuLzPYm>!YzA0e{@SndHc4O zDbgc1q_h@^d&Wnlkmf;KL80yi4F3xQxTkDh2vonE`|J;IC zI%?(KDVUYa_)QdbP82hi9<3jS%!0ZMn^6ONUBDO`q@jLF2e?EitWVG>z@pJj_!mhDTqQo(Owc@pGU! zb0j;yX#j--dw1fTUbpBU%DbqXldOYi&iJ%j_J1aHyf3wMH8P~s z3$Di#k8a}2a&64EYnZ51+FKu}?Y0_r;>(Zijm%ul4L9&1t1j`@Q!BapOn6L`q63)u z4F@? zR8X%WZPm?Z)pFzaaHL}4M3t)HW{l4CR~_NHhW)yiqgKX7IXryu0b2(y_#!`{+vtk* zdJP$KlCaV~iy+uP1lO-we$Laxbw$*iCm`?zcqoQl-S0P>i@~imQ530-J+31-v|7t( zdrsMa%_ZaBkyG|}Wo>pkt>1T!Fs8&M=q)=G5q@)97oV&N_1|OSN^1!?&t#RTEi~AZ z@@YEtQ_%&yC5W{>=g z;{-qAjng*M+8fBq;K=tiS%--6&Gmf9OZkV6f}7%IJ8A)skKyi(+?0qdU{`A>I`V*Q z$0}WB?1n-cjvLOF-}l@0X>zxnJnpcs&vTMFIvL$cAGuk86>eaF(LP7ycd3LkQPC@R zXuF1}&6x(FP9qX=KjgjSg^~D%&}YD+3*_%N^18be{?3ykEJtr0kso*vdGE`=RWI&q zfe0O1-Lr=WMI*6?8tWw?-Xe&zRNG7il!9HBK`9>BY?fPd_Ur?KI0AeFh_*??s&#H0 zPd=cji%#9!*E;XaBbN!q+C;j3ShJNjtKw{7>{#erx&l~|Xk;6Q$1q|Xapp3kPlX&- zU&_C;Xt*XGiq)xWXNVcnY1dY6iApEKWGP-dH zF6N~+zF5Bcb-c!nuFn-R?u6bp7{t2m6SQX#OQlvDn0`!_-mF07YVhC~c?gV7tV+0{ zV3;^ykQrFK{J>D&c=c2 zL6_}^MxJl7K`c!@Do$(+)ka*Xb7v1prGvT;ECf&HsM)Im&nyDv?+VqPzj&?K`Ln}n zZqlxKvfEMmq1|zDe8%U?- zi-cgyy~=l8H!v|xA3W2NGI;cG5Vr~^s0bbX2oz$F)_1uIOahCcWO^{At6}qe(5Zxt ze1G(t?FWTmpozQ;OnPWQk?F_t;tvtc`zcCCn^Gq9MpRYkdrlLl}o*72L>Ez3Q4DwuXov+C>JhOb)2 zmwBNftTv9$4{*yCz=8^)!%yDz$5UWkXV| zM}$6Vx|}~(BSiU-(#%-*jdcDzhgI^s#GfsvT?8HW_c%YIZ^y|fu9D3TyZYxxpiO$R zS_@zXN3yhn7nM9NfXFddgEqMQPiZe_tzA`atGXjSy$neR6p=YhOZEF;QzWlv5A4_B z0i!N7wI>)D8xms6>D<jmR z6|xcYbXbbH?3jLAXWL}PJ8aS=y z;H?sPicAEp8eqF6lDztx0#oX+%bP}nYt71u_905KFJtRh9k2fWL>uo@&QT&8&S@9i zmSMUOnB21%fCn&-U)_4IiTLGAU8KtmJm0T^=X-EG1%i{3WW0U(2gIW}rstK9`7S?dGB`(xgTi0aJ#G@A&tsLaJEo3805YQRNzs} zFUX`pL5b#lS*6+TU`ls>jgd}Jqg)Yh6@L9jmq`Ch3FsF0jg2L$y=OM>(E3Ad0Nu=% za`iN?wvVj>UOl?$Wz$3`*G^?!O96B8{Gmn>#K-#1ego(w#`EuHWdX|s|};tU|? zcRKx*?fB&rBW7qLUq>RAFgM@WRj@VF^I7F(oB2l~JeJ@OBc<$>%fx{`;@yF+)jwcZ z_<>Zl5g@|Bqjs_4+EI18-XGNZ) zBqd75#^igW>7|Mb*mN3DlPsbTMj%@mbYNf$OqkLn#Vgq-8s}Dm_~PjbO{uJLsFy1h zX>qSE8B>KSXBI7Qp9kynb57zyhGQ`rhTbWgy z5|?9YFm2-MuJNPC75fVJOL;`0kC=TVK{LIFbM7vi|}y zK}(zj>!y36+(VMfhiZXdinO!*xgC!m${0H0r%) zye@h?#UXPZ|FATJL0$*1=Vz<rMO6&H0k@WAH&hj-lK4ys7pjVTZcY(FK} zHWQi?Ml~%hO@WojDU{+=0D>wR^?oJk;gf-YqAN20Ky}L$%q%Qi&Zk=OgAJw=Fi~9p zvj+iz#47ZEcO*bczW=u*ElA@B771;M3KPo(dQDkXod3Ob=3D8Me!Y5d7(#h5vOJ?Ex>G@%disd(c3k43r+voVL^7LzR7+b#=Md9-EdHImvBbSbu%5VAd2d0uD? zxLk%&uc2{M&l7aHW#AOVZ1fPv2z;5X-Pp3DGk8AbiccjBN<)duq)2zxwMB z|M|jj@(%kQV@x;+Uw1n+GFK7TKoK@pKMr2sXJ;ziqI{9%&3A zx5EHycEn({!4-Pio=mf|@ZI#p!0}oU76`|^n;!6APVKJ+!7FB`dFK^m#8Y`XxZOH0 zsIYw=>eSK9*U>2NJ@b4|Y=t+m{z99246i^S`Aye+{q`0QBHjORUC7#2r2tbFDRJxV*W^8%^2Jfe>G1|v*0T=oR>^9f1}ks;#=7aTYbpcpE>}$m zbZoMu3h`FU;MAR3@^~{72pMVBk^$jzzw?{NeAIAx{7bmvH%~vW^Azs2`dh1Z7*vflrZY|%xZ}~)a<}a#_evpwSdRFY>`S-lb$rCNuExzvG#`Ae zT09|(OoO=pP^ug&^bok(gLg%;msp^L0Rjm7;$6)ybHrYVIe*mrp9n%A@lpd+4wIQ7 zcc!Hi;=bz4Bo^bpu3A6}7JQP_1dR|b9KtC>fO#8h?P-QgHbi2%MrOpszX+_}phaK! zv62kkf4doo*?ZDUAjq9kDjdWW5eDWwV=2hGo%A zxJXrqOeS-|Fj{%Y?f3t&@|-eNGP+`SBJkWlx@vn4`Gk}j6_=bWR-k@ZJ7ZTa+KMyH zH048f9l-q;?}kvwgI_fJ_*Uj_-7Gw6=r+(-9BCo&JP92s0hzvhbDJLZ)F=dj)?kY$ zQy$ib;O2U-)wK;FWo7bG#&ZAzKtJ%aN-5BMB3D15JWw3 zsv`UAd;Q-@s1WL%L5U*LxGQdS8yx6v~Xfllo zV!xg~vIU|a%WSDeM|aD1L{Si8oAEpw9>G%0qh)Wqt;^VnI>crzsJ(Fj zXb%##xT}>0#V7xzyd5=B<6T#XPFhul36`E;>O>n1zuAsO#tg~)WxO|@d6-%O3WzYs zaYXNKF1No!@YO&FyFb5}k`O)O%|yJ|fOqHc1HyQl)1bylM8ugu0=I!XbSsQ_=C9+Z zHOrFtRUs*{2i{qdOw;(5R+)I5ZC=o8)&fAJj#?m5E^)qg6;DWc zRkUAvse1bZquD6^n+6~Zr$xI1I?m08O@Mx3L`4mi`#q6dq-nomHWGS6jX*hEIKf=6 z67YO~jbZ-1NtdEHf*b$NBLdnIb|R5Fx%&c3;9@Al-mv*zv7_H6!&JMwp`)6>OaI=Q zg7O?`BRiX6vH)-p|Nbe~pyO${k2H82e|XzH;7Wc?$RXkqCak9{xj%-_HtG3j!u$_L z9m=?>&G{8q;|>mr;Y^NZr7D=qo9q75)m}Ln2?udv(Je236UPQU7ADT79JPQKhXC#J zx0p^pwmM|F_g+bqV&EU)$zMWhE?f*6t!iY2=WssFkXgd~^b<9GNxie0E$MGT>FjSiQA zV~b?K&5BTRx>e8br2g-|ilqmaU)5&)6N+Q;(m5*I!jm(KkyFeymfgN38ii=igE8*$ z20U}M`uBFK6xbhG%^fnN-wbPuZ2Aml9>RTAt0o z;3hlUD=ln#Ug?0F2XfFTnJRF@t%P&(>AnwDwo`?j_9ejok>%pTcBd=g`>?is5De51 zo6`$pd@_x}_&s=i>m(w!;ksD&rFZL?%OOCEgV>|he!kI#TM7j;!@w{@v$ydI*adtJ zeIxH_1!PkDS3~=9V&F#09wX-Z+eV)(asD*c&-L_LUV+ze%$ttaeIpxDts;yVs%rFa zs~#PwLn=}EAEYc&IKoG&7ohS8Q^q(1Ud1YEQLPeD&sVO=dgA!$gzGa*u3C)t81CbRzieeE3BVnJwf#2d7^-#4OV zXWQT3pHB0Lec8>S+3d0AvF_JoU&0ibw9;WqzD8heO`+)IHP&@@7iHXFGF@u%xQW~+ zb02n7IC+d0bbO_m#P7_PNZ4k>mac!#ky*=d@giWxs?FcWAuzlln8L!(56sQq&M40k z4TzSX2CTrQuolV0!qu0~vgB{~GU*;MDWoMeRR>Die%|R*vB>%CBQaF8Ub%oA5{o=S zAhxV<76;kkl5ps0+lbX@`G*u$b$+zyJnP+_a#H16tfIX~q(t^0>V=4OIG^}X_FC8KV==QGG2GrL4+NqNqapBSr z%n=+Jm7!zWh=vxZWSwXqqXAvxugh^U0;rWW(<6?&RPU@YxR^X<3Y)@h<| zhA$LHO^f+&(>0XMyHD{&P8FPJWpeI^YVqb~qlb=O21<|ECtk7x>JX=4v18nm5YWIb3mC?lKBTYHMAx<0H!A&#sOO+8kV)KIkPnRlW4rPN#xN43^>rhBdaf zW>nl*T9t?=US=n++c2+{3y2mL zQKHcDOABpvN_!oU5VAyEjCFYZe!xf%_BwyyFH(iwUu5*y1irexNhrI2_lSMcQ#}yc z`XEg3ZQ-}(+4G-=*tTGg^*(D(Qro~t`^^xViE!=TFj<`)qCfgL$^zk|8tdPDMF3F&eVa$Csu!qtxg zb<=3kOSW7m_&1~{Yiwqap%9W0S1;?yO%;Z9&MiGR0EuEK=Qq?hE)eHkL|1_9vb%(2 zKSqOfAVRaH0+p>lirwbaQ}*P1EP{O1eEduk~4U5n2(^OxL)RCC0e)&)S(j;Dl zOR2_OVN+q{zLeXk)s-V}c53rg#6$4_d#oH(7uDf~n0~mitO#5WN>Z%{}9E9@g z<)NJg`2OahWub#A!2{(?YtR}8YZ=9AOLFT&nCF8~Sj!%x;|6=oyQkvU*W(pu4`r3b z-xq6bQ&P+aBqUMt!g4T7pFWAEeEuj}m0f|=Qc>}!ucosy!oR}BLMYF-&=1dB#-g2^dIf| zedi|G6h(T2k)JqCP(>5a6Ntihvs)f9w4!B1m%hr5YX5#vQmH$%XKP$x_MUf}ag}tc zx(#$xPKn_Jk8luvBN&--)|Tw$sJuE20k-@aTf$P$ex*z^QZ8R&g+`<{9oKBIHVW>X zzHPmn{rt{@-$FakelI+6Q=2PxWfj4xd?B#@Zibhc#CMB^-|(UEh;sI*x>sk=axA>C z?Ts?gW@+TwM$3s)*lvXu%f0afI|~NwT3=zMw23y=H_11?R<2Q{wZ7=4|6vIL$UhS> zM3C;asNK)C#&173ofowRaL)AJrV&bp6hx`y@uZhydE+XW4@KEYKGXNpcC z(<<5?FAS1s{vbNW$LGhG^Mon}u5fDhY)Dp8$+8!ntK9A-KQoJ?8=Y@jqe)-HG;T4X zh@kf62mW%|fQ66dKjT5M9P9s)BxSUArAfe~TGDO}Y*YwV-#7NDI}a)?j!ekjWPXqbmzi zQmfP#i`9kAgex{gC3xB}Gfkt`gq-X3CI1Y9Y;m(P-wEc zXKj$n=daVY@6k5{2wzy_=y5>~;Y{=_RpkC`mbAf|Qs<_vO^X3aO z9k+AQO1fbywiOgOh(&_lYmWHCw;gjec%g(FjeaL*OQV5A9g7z>J zcMaU_-ce*j^_(-4+1?5HH1SYn2vzxNUE(#$z!wf{Tu|%T!9o2M@War_Oymk&R12pV zliDA%N|HR2>gAdsF_QL)OjCe=tGTwkOlfWCY?Q~KYvIwF$V+yJ|2Yd#&!;-BsPScUS+as@*}|##MT}n$O21Cv$z}`bdDk#HY-c`1n2P;(eJr zscd7QsGH9cjM1mn&2Vmu@Nn&+U;`*5ej|yEC}YlE4EaW-X>%k`8X#vUm}tCLn-977 zOj+x(xBhd!mjyl3lQD!@-gMDc$x2V-e3x;I8&NP} zad3D3wRANkdie6Juq=lAw86p~F#F|x(jHK@qBKB%zdCEKK@_LEG5kd-1^BWD?(WMq zPD*Nq9G#3|AP^|g850$)KEz$Z;!Ia+?3w^>pmNqviFO?u5e=_QFUECw&a;DUP5K-* zuMs9=*{o7EnDCXpxtc4u(6!BHzZQuo)XDP;3IzD!XPle5?-~OB?kb0#LHkThOs<$?%y4&RdL;TuB*LX_!r|5Q9ga1k ztLfa(wst0&lBJuYm=+Bk_U7B$w_xUIGEWQwJ7UjqAbtMU9X=w02G%#a&A^)}_5+2s3!)*A<& z&>IHB%j}2OyCTThU_+Jbt8F^y)w$lt>8z@Ln>lu`xGUwvReyx-- z;mg2gw#M#l#eMq7kk_#9k(9BNXOOdzbe5vWSQn{k5X{f3XaP^-I-eqrDEp!e%g#NrMu-otsi@xTD1hXv-bTBdQG>%)9X% zEp_miRwfw&kyt+in_F&+P!0a{>ZnQvl~7h&A$dAm1TF0L6-r5<{tl@@MUwEWDHQ1G z`@`Yzx|>zizEeoL2zqGh`?d|9f|K!=mX?YQs#>$;&@`soG$MCIMbbc*oi?#@I}nYm zG9+hb|Lt|*G{yb(^J-vcZK}H1UZJEhyH+I&Uz1=O5JD>%l@{7C#jIEp{38yjU8d2J z>~r0oGDZ0qHZc(=k*-g1PNg?$xV+ZEUzF{ zOCl=IXA;!7u4dhhrgDdLR7p(#YVojMlz}>Ld5^NhY zF7oOZfYo1ueWbLjW>T>Bc;{U4g`zE-lhtFd|*<>oIdPhXdzv@&QvMeqeuPE|g3AGFMk?nzH>e zkzet0z_{9{^eA7H;q3ZRBa0BFBXba0KZ>#l9C3VHuly5huXytcX#QoX`ua@$$j6tF z_=mYH^PLwNcjI1q5>QbQDmi}Rs2IE0oyME7NZK-* z8Rfb=%^X_0wn=8^NwVRZY6atE`Uf^`punPCSO&l=dN5pQd6sYow5ib)Ea{3RO2sVBmTjMw$e77+LV>oH9?}}Yn&wQ8~i(fYw~2eArkeq zOE2Hx0B(wga>hk%WdwV<=G5v5$?I9j-D7Tvei-roPPa@l6FizLra&VK^^O!p1YY1D zkn2n%@752h!31k|9$xtNbIjm;kSKJ(F--Tn9*hp>FgMwfrdS>L5U3A)3Ya*HuR9Tm zU&9BbyVb0vV@O^Mrmovl*)_HHk2k4cgs8k+JD$b~XZzi3MR-dT;v8qn%S$f*#~buJ zPc+qVh~Z08uX*bm9_{|{M)-aJ{%MWD-;%l+7cRpy@?cu+az&k$bbFg>%+DNS`cI*wk7(drAG zQ)R`FEEPgiR!|oFh7KVbJ7r~}O}S9D#lsiy>B2VLsz;jrizmIHg|$Xim_ks8N>C`q zc*?@zfN<-`H$hiTc8>y(1wHL}36+gu_@iV8J7uUOWnA+6tdzoy@_0+*k%-xi` zKZC;FEEr~=%v?pmat1~vL4PV_lRjo{*ELi28VwIgqW$@_bN4I$jl&id?@*&&M;G40 zVKYa6U?#Cp{=uj~sDIdwOKiFel#&v9tWj5o3y$=n2+P^NBCA#{h5&ORftCQ&f&6YS zQ2@M;IdA#oBKVm96;wVm<+RbB$WDfCl%3|-S@RDL*)#d{kHgUqOIZR5(7&waY(oB0 zRow37s9(2Mkq2kMm&FV`HbRW_I|RD_@8BsnUjy?E14+n*t*Lyy@DNH#? zdUWcmTg|VTnQ|gcL9ijE)B3}KC_dP1O;Ab&;~y$6pL6MyUy7q$D5DUHXTf^IYvK36 zmqMDv7M@!&Vou@s$Z=iJ(>b*EmCP`MTS~t;Tyc3ht)A2@lBrB|vwYESzk?qnRfAP0 zkz(h{3dGC5bHf*mPnbMcI7UFylS5R|EXq|zG_m-j-ajsu>pV>^Xw;6UYxB@Hq#O1p zD%Gz>5|sgkZXwBHkBXbiBf3~-d#RNTXiip(p1sb#`6s`}-;Hv%1lS5oOL9&k)q9M7 zI!(FDJJb}V>v-uNE@ZGw75ScdfTA);8vz?A)(*vW#W?%=)?%gcOv1DJrQiXOv9V|{ zV1Kn@H(JU4?i46=6tIG=o&UMN?-5S^Ok)lutak&}HK+0uvQ)^)m0Nn40yQKo*Lm;a z86vQq$ig6B^hk(>}CGgJ6JzbcG@v7UvkEXS62SJ z!V<7DcFaz2oU7v> zkEA7lg4<>&D??%QH^CTB5ChW)y+m3FH17m%|Mw-;V3hLAMVNFE7r18}L=_n7IO@(c z82Y|LS7H9otcm(tu#}yZDSk(4u0q3R$C=3V)Q9hAA)P-TS3k!;BjoyllH`$vb;|(0 zsq~3s)dmcL9<7AmgG7SYD%;P3g+4)RK0lH~kA@#z~q+k85LoR5j4F`7d1J0MB?7cdx<8_PjB?`Nl&4FsP>~G z1I|WUN8g?2y0#MY*FNtEYX%YbZw?BB>=Eg=ix)c)#_fJoU`>l%(f%WDQbs#h{cb*I z7!^h~yzs5rRb8IUX0{a#H*fZ!45; zyZUjlD$mP|qTti}b1%C5f=8m{gJ?dC{D*&40X+IUXrL|oNPQ<$tZG1m1}jP|kj#`n zP>EQ;dp~jre>|IjR1y-NPNO(cyz>Pz5_Vi4piyi4g|{>~FxEho6PO006d&_<<*qFBD6wPjP5A9y*s*I47= zXAO~1vaqgM+|+bkKvSh?Z;SH<*3p_PJ|`!knb{YH#(H8`h$p^2@eGW-_c|~<(Oh`o z)=^j<$&TV$sdr)(C8+SqoBw8Tpjqk*E&~bSPm{tFe}R%VEK#lTAk{9Z1+F6mg6dL2 zP~LW_dhJVfT~dN%<4zs375zFQlu=L=gwP;GvkND#Dh>3`_Hf}6H6kSeRswbLS_1YT zAwcMf}EK4?O}7V#5@g0~rI*1f6rlO$UjiIF%&N5Z5JkJ9!Jd!V3*xW^Rr8gm6|p zN+P}yZ#!TrY91IUO$|r`?J0Ned=j2z)D(23H`FddH4sZ)zstpFkE>NlQpt@F0~cLC z#$wpNHNiY#_zU4k05-iEdXj3E( zyv)=5hBUeb*G!2_wzM_T%z?fw zt@5i3YY%yxYP(f8W|KH#O^m_qi+2_gEkM?)5KluF^-hVC0+OJhL&6MQlQO&hGQ%3V zcx+B&cmr3+6S1AuRvrGUzF{>ZE@$y&ZN8uCXLuXiR%(#ZeC+=5w+$3c#BVXhMV30j zcJ8C9OLZYdMK|xx)t`_Cimc)G3a(2*olw}yJd}usaf>x*%vg>x-TD;2*t2<5BEUkw zArh_h7YA0<0W-QojBjgi1*FrbBb~J@huF0Rd}D3Lag)hE^E>tqs>jm!Q#57?P0c2% z_2TQlYr7Zld3gowr>IT(Weu^Qpq;?@LVIeM`;y;OZwNZ0DzCRi>Ei-R_x!2PlnJmzJt>saTOlF1N?WB z`t>^-l~{oVUQmwY+z>1TE?Pg#Le|ofXQf{LJ2Qp7xvh!bv5$B3p8dg|(3maGgD`kFX{yrx zV9jJa#ViDyAr6}F%Bin#y;Dwd4yGa||{t@e-rK!m(qIUSoTVWd8Q2 z?!*h>D-cv1QlZ@T@nPofMk!;C^x?*u!>;;@*yU~j)a6!&iLGYdJvs9Oh~C)nz&4d> ze~w8Jed=_F#!i&IVJ1eT@DZ^H0c0U$;kJnYx+iM}uMyf}XY{I3{8l#5sNEOjjb)}5!WBV7s@59-iouqYm!J!eCeqa@H5M%CuHtvimIdpn0pyh3NUEN9I>1B(ko*aYkZ%oK(I*_e=oT^uePyXV=}^H z^gu`59qSWSKJ;a8WU8_PZ{)>E!OV=$S~QR>Z^+GNYP1) znNeTnD!qL+x8N5GNIbMXhqV`L&axWJT{L@t_%7U;8rY2=C94((*p=q@7Nz01+(8tq zIk2fnnD4AO?&l3QG3>&AxXR-&P9%@9*=df8(e8g{CXbC16}hw8VEZnvN1USv4J3p!uLXA$aK&QQj)&1m zCnK~soj!m2cz-klnznre${Eik(<*xZFjG-kg1DKGb0;BLHGW^?DNbJ8XwN#`i0mqn z-W}k0nKgUTS+fBm)d-vaJVpxf(!c(A_WMJI=Ynq3g=-+H=VelAI5iN%aCs2p)!Cm( zM3(=_#_Ozt8(bp$rO3LmL}sw716P?;JLSH-iPo%z@wlOZqcK%$P%zYNW_1`2JVg_8 z_B-7V-5a~ik5xT)T6Liva<|(?FCK%2K%?T6eZ86)o3-^d&@ZzQ zwx(FikU-41R%P3ymT5xM#v-$aIgg=rv5Y5i7Kg5P`X82ii3t(Nk9*yUb5w*9g2?4C zS!QJ*LTd)_a_7m+{OEjR`=lVmF5D`2RNSxVnYz~`?5K|gI-ZHcM~Eqy!_%^GWfl@1 z?UjbD5LTQ%(bT4Y1@CghEikdPoER0c1fyWi&38m6GSPle==h`Ug(k{0-Q(&44;~e1 zUsq*L_->ml!3)e{#wUp-FpL(G;YL3Qv<8i)v-$v?@k6m4 zFWuoyN(4%&T%qx%s7{%u--|@)LwJx##Yy~Ky&SHT1NZa^u9W-`#sLVI)s-nPLxdY~ z0pQ-S+v8pitGm%tuQh2+FMFkJ9LKl?%c#v~3&RnYil47S!gdV?2-qcqbJEG04_i@b zVIIKY_-m7G2?{s--tns)aelXTH%)AJu+gAQW=0)$d)by#DOo|}R^~9r?C#1c=k=so zisNiO@@y3IqdD09 z8*CBqE6|`ESpTF0OSRx^E{6?~CO7}{?*n)jT;C>ZP@|arP7WDxK@2XX&VTQ#D!)j) zJGd)j`W1kHsoE_J`+^kuw=Plm<J@o5ohU13K8Jw4 z&BRCtzZeOe+t#3)uYU`kcTeXW4{zu5Fpm8FgguPJ8qZl>2NZhfo=V3Tk%_|&Fo@2@ zaQWvyl{^^6?V!23UY=#5PrXXlUVKmF1g1VZAyW6;#YN6&3PLmH%o;Z8cR!H3GzKgdI?yPb_3a^ z8=dVDG+BXp%m(3g*>S&rhlGVmz0nK}*yr>Lm!^Yb5b4SzXDq7|KrfF%xwQeZ`b&Hf z7kH8Q@ytP@`fMY}@LLYAfA7TZQi=Jak%krCxxsXK!vb|H#Yv07+jQGXFl!aVPad}v z$>1TuaABaEsB2pl{AoO$I1Mnt!Uls#(wG)RT@>C`mT0w~$YIKv(6IDY~OM zqK{b`Gt;es0wZkmox+PWCxfUQ4Jaw)x)556`jM`Sk--)Vt<(;OFdqWs&PAyuFa?XF znf?{L-*$zVN*+5>W@Jc$s}zXW$tj_!8TdVq86^Z(vKiUl^G9#ND7@yM-BnOA>Q&2i z?w1JXPwh*a&ht5aXljPV>h8z>K%!@*m6Xu5`JGS`s!Scp)L*9TxEi{(z*x$Ph-glu zdUo>qVzf^Osv=}SZ3qI$te!pA>?f6L#Z3gtoIkS;L!qtAe~5NM$%8~dlBRmv74Nw1 z!VS$I3V}q|!Zt3drF9pSXv%CGsKf6(3O8Mqw_eCS03U>qB-e_PGer*YDUZuItIs7g zMP)Z=%0fo4q%)RpDp^RMBZpU&?^rd|vA-t+cq~Aw(K^k&jo5(D#nbOa%=$AKURz@K zKHbp5#Y`tNW|yJ2 zuFKilUR2VgrKG^TA*N8@|Iz{SvwPAConZ;q(tFE2AG~D-Ucza((9ukDAEhjdoeGO+m^eSN5i-j8Y9>O9b$8i3m2~jP5Flp(%Z>$lQO$QkV+AtBKKv8txU@voOX68=7(1G#|QT=5<)<>Zg~lWi~650 zGLs+_fHhj>tV>q7LY>aHid&#;#QiOYKyo}b1S;@L#Bx@pz$V(-7o7|(J9|+hhHP{a z6D<%ImD*_Tb{+a_{#iMMDNY?}|9jNXJrF&%jX+#l+H2{Esj2C=|2fdF)=nh;)c@hj zf0si+aHan-vHuSj(!r`zqluwE=c6(>gUGC|UwsZ+{||w5aoosYeI|+1y+Dde>HiRV zs>H;=i6R4r!2`N)*Z&WTCP*b?73M$3{QF6gNuYaxdZyB6Z;tsu_@cMDcobpxh5H8s*9S(PkUszN>rhUg$YxpeyfGyWc&hL3w{#4o=g&z|dT5`!y@ zJCDbCfTEPK>e}UP`H}?BhRT;Q)3iMlm#19v_(%)=y6pPD0_x#H{tBV;-%IU35+wfrmmu(e`}-6Be;4n{?K;SRNOIbJ zV|X}Uk@;85lH?l7hlF4s)A~K_hZ4_BD}_EM68+QuxAZaHzJeL`m-|c6h->fq-tiAM zy&phprmh-%uKeoN?fl;YG&-Sh^dMDGCe3aI}*q)uv#3Sv4f-Tb* zkcM;d(OU79LhJ3cSmW-^b+3gD|9f^q z&Hm`KHLr%>;!;G!$4{Ik>YDCbJpT7!*&qycO=G63n^AL{QnkikeFt26w?>&z{cFLX zq#-l)DIEqF9X}e%o@2t2ZSTeAzFY8AwcNF{I-i|FIIP7S{F)Q{$S4CDq)qc?MeRy*m zBZ(S+DW$8z>?Yc!P8WpHMBm98lTq9^dYy&{S+5)Wm(SkF5vS`h@eqfs>%jj4hn%^U zN&wrRrUV}tudhM-4++c%!`A;BX;P0gsgbdHv7S})RqG#r zFPTt+n+Vz|@7aIIDLO2L0F`3@>^dZ>-1^)5hf-mvf?Rs3t}w9c*>dKRe#_|At&+v( z8u9Fbgnhy%ZCUTK7p1H*k|#^lZVec`y=2_&JEn|kOlNcA-wEh%ty&G&_}s_yZXkhD z4yuubOL^G-fyi~Xgj8-cFqVH-cEv_@F}&H^QZL|GwG_1;)0-1rP-E=I3^IW>`m`5- zW6f(g=wQr7B>(Q80l_BD-!;wVxe)}kt_QmWhc;`abp`U^3T2(>11?kTCN zSBE!S1LZe9lh6C-ZJY?qhC@Dg!V@T~)s~8#RZxlm-T>dT){ev0auZH`*P8~0oyZgx zF71t~j0w`w6wgT~?=}joNkG2ikN?$S&dWN!_AP-G5~uwV+%oH@j;U{TP?#A1NvE{W zUhToUT1x9ba4!vpQGvI>XpTL$^Gm^F*A0&k$;{Ws!?WjiZgap~>KK&&^-Z>8Q!#YC zI^4rf#%P`&>98E`3aZBG(!lkCkM75R^sdtt#+m;8N`kWHtOVkhYf|NhUsAp2TM*B( zZ__uWH_jQu2|J#jcW=8B4~MNNoqwZ;OT(Y_r7#t#+ODn*5YhXlDsm!RxKzCP$>GrW z3DZ6Qmbo(5Npo(V^F{WD%^UYyPQAS~$o7PhkA)2v<-%NUzRT5-={X{xO*+xSKAw?P z-e<^Ut-(=k)v9&=1B?ZsJe@y&db*;z7D?;-P#6wedzXpS9n0LI++mcS2L9= zToL;D>TvKHaXHKQP~pAhdXPYkkNidYgVW@&)*x%R(>MWuViFh`=1CtI+fZ0-Mz!9s$kccnk?InXO zZt~Pkpv&K;T~gkB;G>`A*}2>GhL2*$gf#VJ)g|m5dei5X8iJl^CkX1*fN%7);ZkR4 zXP3JI*oI&T4@jt7AEnegKd1?j@oskJfg#P>>NXhvXAd_i@J_h7U$;Mic>hB_&o$!X z)qN%nbl=JY@EmESTU8NW^cx@AykpL)ym#!4`!u$fB25_0MmQZ(iCz;-qRRGWlmD>6 z+_b~%DhG@EiNhL}q0_47q-`mx7cQnP11$`Oiel0GoaJy#W|_U!O6lQxjf$9H7Bi2o zH!jX`HB6Bb!zj>ygn6}#hjcyNgONUzE>T(_am`x|#2{_Fh1GAsqStc;3y5<23vWDJ z4sYO1-dFO=XW1jcWi}_st6k>Vy%I_QVMg|@#~GSnhRI(adH_|(4JNFfoR5)6deR*@ z*O8RW?QK^xS)hPQ5J*aiJ=~cNqJ)0JK+JMv@wJD|4{}Ysq$#ushb~x~#zcdaZ+H8f zF_;d3L=dI-xV)Eop}vk_v)nR)@No}bt8bc@wDA)HMo1y@&8O$RgL`gKSB*TYXfB!= zE~~6HomQIcGe<2CWu7%<6?~D2_sqxp_;SlW@Rw;re|Do-Ml)=);_48mML@Iv8HEL% zfsvoZcxx|LwqzU~Z?eUr^2nmeDDs}I*8~Cx5c+EkQL$0GO(w!f{;Q_f3yY`JS0b|p zUG-}}+H}mZW#@%V0j6-a5N$G%{G906=^@Xq{>*+_s_7%n7B?QRaQ&`~IP9Y30UpN5 z{i+I5(u?G-u7(&1!KwOy$xr6+b6+AM0QM)Ptg%EZwDO`Nd-PA`mQ(j7DqSlkOg*99@oWrPirB;)(rCCe-Z)~}^NkfJ~U4aBNJJAvJbY*rXoJ%7r7}A+OS3^_0@1rhN;hCLs%K5$$;KA|b-4XWo zS$U!;R^r+%>(&5k{v8zM3XCm)wx`HR9roYRnm8xGC)&N=55&tD6=UWkAZ60~u7EoUM0&4) zMa&9{!NzE_0u!`C)mWb^VsZ>d#fzq}RXZGs+ZPAsR|bCXOWKC4DkEv@!78iE0y8+y z>I*pjwD(<{bLx#-KAtc>_uDh;^)|3~jK-@YLAdZu_wfEfXJf?Ft|b&5^OiGPjKPla zz0?;6`2vXFeYydX&%Q8TjzIWOge>@>?E-_IU-c-JW~$ED|nk@Jp&igP5U3UP`|pm zCuGGXk7m*$hNc{jW=c8e&1_6>8=~U-`ltEW?&yCyi_f$|s@I=VA#$ZbXweL}dBYQE zx{|kh+Fj(Jew#?FvoHV+TWXq{5akeX7bDJhUli_GuKe*)Ki^X!!dw=7@=P4STp~)W(4j_DUV3AtLzmtG} z-^~9M4Fp_&^NH)!S=v3n)6Qvyp1P1nyV7sB4yQpw0v$sDAHeMOfN5~d85m&?Ldq9> zXLfO@wRAa|vztYlb64A^hz!0xDHI#SCI;^bqfsheiS&NV3ZOy;phVJF?FvL3%ZUAgh#jAeP$MA34Ldn(&M0{^k%u=c z)mVZNxxAhRYaq^D>%U&pmt zVzTh-`jIk6&gGd)xq0_XJ1rQ>T}Um?nLDa>4EJa=x<@k|ewx4p4~`lGCRTh@8kxMq~f7V9GyR_XK-9>Kf^L3X`iKk zx?wE^FNV7}z=_E68i1s(i!QVn;mj?Wk56B*r~H6l(7}x5CBtoDfunwl#e5$Q!HKRw z+iG5K3@=4sSiijZd_3czWVLOLrWc2fgCKD=P4cYrGAlc|X}O zIOweA+J5+(*?Pp1i(WgMFZ#cqZkRnpQ-V?nG^O^RvMX)}bZxV>y{|NK?#xI`hEi_P z6|@zFzSDN@ji=yE*PRNc9biU%KA|XWz7X1l1MoAmvkK7+Tl16bJ9)9|PMFo!g~FC% zkjLCa`LRfiRzz8HJ_-GWJ;M^xqGKW=Egp<8Em*SRIKn@?J0+4dne!LhUK7B6bV z0+ey72Be4UN$zLWNSuTTVujE=x1H~Q5yVp+1rx(Q;{$e*vCG(;{MBv9lp(3zf*8)+ z%2Nj|o6!~#EySh>c+Yb-qD!fMOUn_L9gqxQ%K2Bq^Loa*Fk5T2wtAWyfOjZ9*`T->wui zm4oO+s~&3$n@%fQJ&uU+r2$BPu_0jd3l`7D#3SHq4p~Eb~z;HW-1#-PaX~r1CI`a zV3Ri=VN+EdVeOk=X`4`QXz-#$i*Q8l-&?%G3k0@9q7S!$kq<+($k3F z44%(gpLT%D{f5^}gXXpH){6G9_*!uVAkIHb*jiD{vViZ0R@(NoXK_^)m;H+y%4QHs zu4haM%+7t*N4uBbO=}g8zcRT9@Cz*yws8PiQCYG(izM}KG<59i4EupjCKyY$Cnn}( z&iW&k?pk_4gREb}A_gS;pHFPUzj>kHJX5wfPRmfl0E=2DjgC_MTp?*m(6W*GSz6MH zFM#RwyNlK0)BD9hLrR>L*%#QWY{{|2we>pS{_f)H_PNfC)=MWn#;RilkQ*!40lXk3 z2dR2o6Ii|uKwr?Yj5vA(e}+z47119{5*O@$@h-4svE>rmufS|qRo0wd1zEceghsaMoSR>p06uAwA$?>y_iQFdA*12$pg=Mk=Q5W@E~pDB?s!- zQH&W1<$^CYI8s2RA?;@Y1hSl4t}8IVx)mc68Z>g7P75}Yx%w9wt#hkp6J)%Mu~oY^ zdM9@$=?=TH6VVTVv)mExSROlEe@p>6|M<$)p%#L#>@l~@!J^V#4sVb0rn>|G;Bi>e zW3VoF1pD)~-9+V$VeKoHezQ9>NF&eYo(=bU*QWh&&U5%ZMsEuz*it@{1Y%@zUN4c&uj*2XN@hd#i|tWu|s7 zfQf2v(BxZ8m8&~nbI`6nAU zyC9qp9vtTB{qIs@>EPWKu$k7w7Cug7C|rBjbD9c)hOIqjiX6&FJbfUo=%$vYPOC|ckrT_k_7D<6ZX3spRU=J*UzPbjV% zv!bkheet|G3{CgSbF04;h%(G`(i+AqLYvS%);$Iz^#4Mc3U^Ze$fg4IuNiyB#eNqD z$o^xadZQk~O^F4wO5sr=r~Fl%CaAQq#nTYO*Ug^yPT1@@-)r^-S_yw02suEupfMxx zyu}-t@a!4MOLCj3^decjkG9S;{%K?sIYviUjIc9C{UCUci}e_3*Xy(Ub5%CWEgpMS z!}Uh1m_{hzPgUYL4A|9yQ(1QU`|Ad<-SEybUF16w-4fcy8sG!dEJD^$=(hB<-PGSctKieEp@K;xC5O2NEvHUs=L$ghb8aayiZB#6FfgdXBK`D^D6e zCCFa+7)B!4Hr$Pf_s#GzWa>r=-h|qew^R~Cc}le>6`@>y?2^>V&+l{VhYpT_wKz&@ zo~?6usqYZ7kPLBjPZ;dVV_VaMZTcKThVwaQ6oK;;yS8*0eda+78>J(%hEc9lrL(23 zt?;0-W(HMW4r~!(0XP__OtoU26oQJWtkl0#3?1mm5_Mvp%L$7higo^b103(>CA;v zm4NwuE25ZbDdyx|m%zr$aXutT>t(%QT+9%wcS6@xqZs*11l2Rc7pu#-+~diN=m=sq zT+V!CWtF@YzZ=w8xp01f!N0FoSGx$j)IZre1IPKEbLI|N=GJjCzWmD%ZfHwH`rOqL z`R|E8dWmt5b!ead0?JpUug8#j1Hc!>S&!zpEaW`_DRHLV!(fBOG?g(qPCG92e z8#7$zs_2S~Co3YHO+{;LHQ2A;BzKb?T`&7QI5+x$CwnQaUeg2cQ}^8(52lyM27P2Ijhl3ZTfH-FO->E;ctvdc~dfS;H}DZF28V?(YjfpmxzLyA-zHW z;%EN@2YI|_4t|K{BIVg%-5CCtNw1+_(AI;1$?12>cgf%vxQu zmNCdjTqgoAcF8`?$K;F=-u|bO9DivE`1^d^hIxH5a7XP-6f=>}rw8H&tTv%=H@F^#D8w_e?mF{d>;j@QU;PSXrXVa~ zR(M^GgSNL41sDgT$@ZAQO`ZqKpvTO$Tiwh?yNwWwc3#UbMHMy=C%3B#am6`#HkE5+ z832Whgg}H|V%@FLi0o8pbpg~F;qnOE-M<+89X4A(jRJfB=6_k>e-104M)1y zkN(%&qhr62^YL>*LgJ;mceEchP-wi`#F`*Q*v))Y@-Q(AY*AIID{*Cg?3!a>JjJjv zsW{&;Pl;{8Qbku2xgQ4LxR}AZrjzIM-diFT zpxz|&fOnLGXk=~agQ-R1ro7$2#XUhCbUK747>4vda3Bg3bU(1 zb8;%Odc0v_Uzrc)uA4Y2%sl#SKhhp2%n}N&rf5r3JO`yJ(wf81<|-&dGkxW-V@DpN z=M=iLG&jEdVf}7!{NjBGdOz;|RX7S5ZTS4ekq0bk3nL~3oI3!G=y@4@6<}jtgsQv# zu}qo)aK-3cTC})OB*Dk?+SEx#^X+O*d1WDJyRHgtDzpF&$*357+bG` zTWzq=`vfJTvpAoCMTrWSC9tTirnCA)F6rrRu)$v!y|~&iuJnln#x^5uR-J7eGN2NbU3&0?nO{yuJQ2HUK%R_IN{B3QwAy)8|%@jk~9u{dQ! z-x&CWE_M!=c?|DUE-)BM){A|9;r`q2zumemFExxGG@3CBu=REIIP*pYnGh`{YW2HX zei{3JaNFRunvhlkRevUG(6EnIhtLE*5helUkbIo2v&u?)I=aylKsU-h{lbQ}rNM7| z!dP8{QFYwgPgI4yp*=~ZRJGd64O<6|lLW{4yK>)^aN3BPo`I-M&BW;jkOnaT9c-dp zW4nRBP~wBla}56yT(Z21O1hu?>zCHXcD`Gq;VS#XM049shmh&!FL;inhmRLBuHhGM z#O?LVn?t?L0V^#&03MGew8Z4{>LK_mON?0WOMjUqt+6s=h)v}O(I`^Uq_7L|`%Qes zuK6c>9X(uWt44U213tb3tJWxO9ztp#b4s|o!vUl<&)5jk;a_MoMej3K+t1Tk-mA2< zr*4Err)g@iBOUhm+ezM-oHAw4rU*G|2B{e6dB2G ze_idMip9Wa_1ybyfR1LB7oKtAW0B<(%2Pg5V!36xt%lW~U~_bai>F8$N6_LxaUvOc z`1Dz^9o}1|NCTdyBmJmCqph=pV0EMKjYCaIoi+5Y%-|6PM-Z9hroC@C%ba(B(6 z>FyE`a>^<#G;5728ia0K=>71=ryh;!zrh66g;_j|w8t-^yW+FbEuYQ{Pd>}ozM1d) zQ@sZD2_bT~k9)3By9SM7ADT`?Irzwj01>El_{vb9yx-4@uzqk}Jfr z)^zU^?F{)o*^(^zxY0k!;2qagk`0(7I4-aWn7uG7HSLFaUihAfO?Wej2pIs7QM8nn zMLMI*Oc6e#iqi-jIj?F2jsHlkAv`n3WCbd=KQ`Bg?*0l#e53Hav@9Tu^CK)5VOw)n zgTm-7-{t()X$QZ!)*L7Bexf?@T>7)p;pY%_nqY&e0T;oX?WSBEwUGH6wKnkjj!Wpi z13TeMjL^A~bc_^bJYuovsIvRc`xJ2d96m{r&f}j}+4&c>G8|I8+a3>!cL`Qo408X^ zzBVu~vr;PKC?>mK;1seQ&X{lcD(7zl6KJ{RNTi@Q-^JwoP}$(OD#6cIlIka|RIM^3 za1Uu)(Hye*e)a8J-CwpFOIx6Qn{15%YoNoyApyB}vOV=U64>vMo}@@U=^w%!Pw3=L z+ZlrCOai^w~l{t|>-6Tge;n3cNZ^_>Pd(eimzc zjBCUnKuj%v>iQ&CdVNB(`1iaAopNe&+%4ta=PqM z|H?w`rdN{h$lVSp!Ase&Aq>OrpW(#1HvcChG{l&Dpi#lbL^K0|WY&d>^}qe~`nr91 z6MX|uwE!{6SOA{y|6%Q`qw?yR2aCJAyL+*xXeq^tyHljNyK`}OTC}*kyF-Ce++7~r z-F4~v{=Plmp8adj*?;cIP3BIL$>b)Pnao7Z%G+#8u#JA?&DB^Kuv@rRf8R1NA+>U0 zBD1p?!FWHD$!cVxQaD#_YQORWYfxa(9I_-B%mez9>{Cg+mpISxCueG|wh7o?`K=|ik{8PFlQVluOUv4ETU zcF7~MMYqh?g0DZ=Y!+T=!00HA7=02RT`SMkGZP!x?g^%}o+Q zH3~;vktg3tUYmbjTI5h=d-L=*QyuEmKqat$r@KzwQ}@{#@`c<+7h;3!xFUO`Mg%P` zEi*_S<|ioKI(=Q5Ze8tTvQu3k(2YmFHvy5bBREq>%`8xC9_YkdQm}b0+Effh6Du;F z>l-?yqAX^K%|-Ru#mB_qzMAJ|mMab&k~>z`-sJ+NGaY_v!C+GgDUP_h%Ac;%9s4kk zDOrFLK2e;WDXAI|*?_V-ZB_FgQo}lmI#R`7sJ%74p2R%6pdh6wX9LkhId&Tk z`uxV^AZ?L7$e))ghLqv)CR0jU6^F$h4x8+QSo7V?R!4LQ|DMxwUXZ|GR>+K$wJw!C z%a0>uys&8cRN)`K+E8>dfUdJ(y1gG*mV%!SDhAdiFC{fKQGN!lOoIrV9L|gVEB_Pa zJoS^AgPAfHa zKXM8FBfOu<-Qe&@w=MOpv9&Cx{fLB|2-*`|-)HFaQC!0w339vj=INY#6W$Sw@lOlb zrr!PNWG-~hGbm2UjM+z!HBgNDSmria*&ibFi`^zYCTp2C$HMEUNbS!G^EPT0i;68N zOcvl*&g?F4k)mlhOTV(wGGaL=Bn<42J92W{ZTK*lKWltJWpcxDOpsf8~g2v$3;`F zh7q47ypd8aeIlCoY*cIs)hNZ^^gWtMZEkyklybeR7K@vNK=+YOjcBHD8v|x-H9spP z4Gw!)ALqF-@U|%;aq$?4o}9oONKXylU5by_cTrN;l_)HaOH`M6P$WEg7#g3Q6*o5C z2DnbE40_)Y$iz|aTdsGa7D!GuPI{2GKe5f5u5~+`UOm+?z1fvfd!szJc7LbZUPCP) zhREbiru41_h{N>%G}08%z72K;moN;q`?Uj&A z7Il;He~Je6!~a5gQ!$tYw+&1Gg{LM#sX1l-r~F?8d1E55%Ks++eG0*)y#9mnUvQx3 z02yllB2|im{mT&Ph+X8DJLxVNMFKi|DQ z_t6FAgdjd4!ul{9=AjWes|+b$N*F}8LH2D+RLivOKfirWL!ZI)PFUZ_3q1L?S+~vc7!=g}x-*TVMEZV4A0fZ^DOP z)B-Ucntu^b&ZSl`;Il#nJ{zlx{Y8^EhK}fU9sJY!G}325HI{lGp3@0s=)q90=Fi`H zzglKz;WaMF4%29}e0hVPRR6IV%GQb)a#sT-P*UPmy#30LEe0b70Ui6K4tk@W!ZB-M z8c1uKf!ebjbT*Hj`JnsIGT{v9{xdu;ByV^3fq$FV!Pj`q4%DeuE+zjGe3FR;SDhEplxL`Nn zg{xYgikM!*YryW<>gY@F!@i;RJ*KbG4e|K{1dNcvsh6azyN&RWzOu|2kgLMEW((w) z5@pQ$Y1042J9z>0C0_;-kGU$e1CY=V4DksB73*@R>$Fs}z1hB8J7CK*Cfi#*5lBde#95*dO%7AlHTq5lbyOuTZ;bZ8hG&w3D~5;!g+v$?fE?NU(4re|#>)OQNalpS z;)snj1p&;(z=Wd_NX7}FEg0qgXVm_Z`Trhez6+6~3FoG299|ejiMFdPJJ9xN^34I?JlLBBQ@oIn=vk-wlFsSXv-O@=Eg_}G1RcV@;jA&D(bzw-DgOTVezO;_szib({7 zJKzExUa|?C-?L9|eK%qL!fZfN_Z+Ce{$}If-*La`B#s3S{iz5)<9VoI!ypGC?Sx7M zo~sc}v|5rH6ZC1Ja~Nu;77HWC{&0O$7ha_|V$3q@T~9Pt7`5H}t>8I$Heo8QTF!7M z+o+Z?IK+2=ym?{cGnM_%XCf3aSMUveG8lA2!FdR{J?TZBpqOJs{F0ofY<7n(3MNW| zFkyBX=SiYwxPLx#*U?==N^_(BvWzKld{wq*^Q5OfcTXw8<>Azs)Up&a_hVSJYBP>) zI|Cd+3%$q6rWcd3JZchYH!M&>WdyAJ!=!7FkSZieLqQdGdtx6I(Ho>FRiFrl~qj(w+I4d|N0~e}wo{03v=>c#^yG-s$Ia#gDC39`P!3|u& zs6?L&;L6xqYD$oF0~cDhWO1!j2-r_R;l2Q*2sh9DH|EorZDA~dS3unfegEZ5Iv2z5dw z)H$eF$~5oL)Q+naW=JDJ?!?}ncXpJt(U9;kNn-^jBO%PXic+mZ(*3@hAFL(Otd#Yk z-`pHUXtovk<2Gjc4PrvvuLIlgK98qIvbS`&M1j+g=7Z_UAK-6yfB58_sRGYP8tUoh#t> z(q)LhI;Az$zdn{6*wpo3w+WmY5%LRsM{e!jQ>#b-ASU# z)<#U#e&f1Kv+a9$2`cka_m{)IK)@(uim6w28Pc^YVoF6y%$RQ9`yt*yWB%*lX$iIW z1U8o{dg(&fPnc4(&;|PD=VUGy_#ly>BKNJa;S!51m!tJ`O|t4zl8c9^jV49!b4`Qc zTsxBS6`w_(F>pQ3lKDjKp0EeyrnHyS=gw{j9EjjC@&;2BGS;W$b`IX4TtH6WFq1j( zS+!mLe&e47ZOtvb#7IJWp`|*$WfuRF;_X+9ppRMTzYoNu4A7ofk#-}zG7>wu!b@`d zwKeW$r^mWHpKph_0UTG2&YHASNp5rTVcRRbCTuicKgSLtEkr^=-1*(sB<- zkJN0})vx@5DZC!Y|7_<(X5mKUXtLa+9A#=Zmnj~9Di5oy(o3$`8S=x?q_#+lrf7~G z(1iJOYis=HH*zXt(#6fszB&Q|CpFfc%~|+49e2X#WyT(dkFG{MK$*ed^6kA@L=c9R z!R>`CbY*Ka*268i5`U6k(=km&Lno#`63O!67iEjG_5! z!_CI~TsG+=j(}$XV8IzGQM{XwE>h9yLFq2^wp|k!J)9q0rpw&w(`8(6`A&1_G9Ks5 zQn>wS&p_Iyiv0hGTFN#aus`pEA@c;7U{0n>gy9MV9RPnMO7XpOEy|qeGgmF ztWRx2>r_OJHT%w_(k-C;aW9+PnxOg36snor`zkfLq}5s@5vh zbK)4Esc|~)xmTJ2h2d9cD&FyHYKbR?b(;I}4+)JbR3*m^X1#i>HD_LqlI18v@Ak?@ ziSWPc##Izhcwm#`e5eTmAY{c6+=W^ndn$_fOs3RQpP?q?GDl;Nk;6HsAF^LQ$7L7jHc62Dy}@NUxO`{UP0Gq|kvBqZ;; zYhnV_B@{8R3v@iog6u*iD1Wi|6|~wvBCAM`vl_8g>+#bnQ$ zrNXL3Mu!HST!Xo9%EM&KI6w7Z(5E70js*a-swtnTWriKzI?>_%82YU?Hnezs!f?9c ztF-Eis(|xunA<{sg8EBPB0?j(ogIXQDct$V2t9ggTGrS~dkp4;i=l~wuqSG<{QLBU z{8D;GvyxN+8$-z3j^`O?s|Dh8WF9f)(0VJA)d)+5wzILPgI2+Xv!}7UOqf#+GZnzL zf9F6WTx@1Gig{&HDn`VI3-xyc77xah*y_Cblgo1Tw~6j$PaE*y2WfmQA%vBrzAdIx zW1Uy*qk`L}XSzyu+trWZ@+`gOzc9i@^JELZP11Pn(hbDsPjkLzETx=3SOk-8nl6<( zYT^<7mX&`=?w&w=xy$`}KATE`EYJ+lEv*7Uot-U#Q8T!LaPAYTemTwdT09rC!Wkx( zdk#LY1I1frkE!>+s#;SaidospOTX@pu=qRL0KVqiw3TbuRC@0A+=b63_(Pc)60+ym zKF<+Idy4lIjVm7lZh26)7OMpnRQ!w=r`6hqrnDiK&mLQo71}~feQrH>Uc3PUqf-GC z>y;&en?B>C-vB+(`p^UY8{OsLw+A7I5cOYCpqIc#7}V6=xkF8=v<*k@s|l zy*oX=)8Wc)q3wRp3G56T(NjUr9Eo;6y_}#EDR@2+D!`t(cq->Tf9gRDPDCD1uu4e} z`DbohXBC0s#AN_^aoILsjt}X-S~3n*)qVH+)syR6qHccic80}l0(;B$QX&@y&+u>4 zxopk)Vt(vlqi<(5sic@$DxY}(oXQy?b;(~;(g#&rLZFi2sGz?as-U96^rt}eQe%$X z&RRpts4^kh6plo94c~z^hTsB(x{LkT5D76t_*#L|nx;d%5v!tAHU-{u8oa zUN~U$(Kya*x&KcP*%ZNVqtl;gMJki{_vytl#Cm}e)!k(qy##Dk`Vx_mU@?tj8?O&= zWeMm-C*&TFCVGGY?GR(Gn`n>>=#n`4@VL;^u=_N4C8un@SewWq z?J{A=RbwU}yKjmn`kWVUW&q25I%edo{Ikb^&VI*rAa=(o79Fvq0@HF~_&}ZqlY4SO zXjio4A){+%7d7`eiq73wjD(@RpJRJi3OgA4K)rM1!UL~2I4YZ5HrM;mE5pMbqTW7j zx?>Y``JEyekp60vbZj~lZrud?v#ZbaI@ji$*`&QWTzrL`#)#Tf*BKIq6>6e7;8ria zF9+oq|3&Dh(|IxSVM_3nQukrZ*f-6@b*_faG2BTmq38F*_CF?!P%gM7Ln+BCy0B>cby@NcG(Np|2c`eW_FnmTA{TP~C( zM5lCAQ&fBxTW(Ezp2{;@xf19(*{tJU7V-g2aG-~g7ph+t{0jjJK73EHDNIGN+N@Hi zPtKb;300cT=F|S3)YX%jP@3zJ!Dj=490MFCykQ9z{ve+hXgHxY&_C@TScvuJH&%U{L9Ky928<;OkPNhuiMfMmYK08;7tt+y-^`Oh z{>a3`kuNg%DcxylJT+97RF<<6`@%lh&O|)1K1Uy}q$4(C`-(827S3+I@SJ{#g9sOW zsh&y^Xov^ej17?dP8^iA&so`yRZ_TKG^TMAig?o%=$l!}HHfEh&B8^8X9v@qgoJNw z0R0nb+K~MUvG|VqKsyCwwtOnO_@f&7Poni`@?*?OpHOcwM%KTq79MMLq|UF0MGnUp zg^@!=lYKrYJGNS$6wiEtJ-@?XRGFFJ|NemA2ynN(v2ghXJ2_C;jkn14P-?8(=koFIvG<|j zZJN&n%x%)3qnnvr7>yi@xwREpY;i&{gctZ4xteM*zZiMC!Uk8D2kdi}Lg3HRrIV$n z1eItlUyR!vEXvC9@kErgr-uyRnrm4{@~>77G!VPY4y3&82@-=*cWjTc)b(P4uR4=h zY&Rkcq;RZf9e8h2ur(-Yg z+E}Bmh~X$yCZ7f)${J|yt6Y9TG5F>b74>`@YBNo#7D%6xxGJD$`LT0tdl94QsPJr@ zN1&M4@dz^C?%X&!B3$)&GF~+Y8W{HD!fHHGB1$b7Qgd>PFdA6g;!M?>3EU<*?zGe{ z=hHnk7aHOGj<6T;+WUt{(ZqN&B>d_VHPHlmmIYIgN#Z1=`?NAVSNpwt^O2`4HP5z0 z%OnMZ&I243W=D2y}v7O_r*oQT`y(Y_0acFe<14*ycV@v=^oG zr#w&Awzc+V=aCc5MVDKZpeU2-btQ0`)X*722ZS3ewWzyKmpbfi^`6 zyU2kQ$PmYEy8<~H(nJz}{SpnZ9e(u;;`xd@C&TdZv`&E=hhJxK3Gnv)ljE4IU{U3I zg0x(_AsR02xz0_T*mj8zn23=1I4H5D@^p+H$t%$dnGiSgCtV)(R#sDKe34SaS-L&S z%4UsOyv^J!7HlVYpC=48rCK8FlVWPpCQsc+*7t$cr7X2Cw=&;xso8tsdX#wez9@BC zh$c^Mwq`DTimfK4G1DXTw!wpdCl9;YNbt?0NYG2|B|QoZLet6~5KUAm?3)R1qdRbX zvw7Rx!l@Z}Kr!DD^y;}qvy(>phtpfbS$kpDY@*bWHfH3`*DVI>FrnWX4>{j)%rK(^ zAn3L)oZ>A^?~8d!NxZ+$`)0g(qA@zenI?7U3|E+V;6z%Sc6|~+fIZM%W|PfY8msWT zznZy?VgJg?(d-}+z*LuMVD?OdIfpEe!)4YaeZ0bhG+3gxLdy0;&{Qo;Zj4xt--L%* zP7cFQWU+&JuJdk-jM?x{7;=O+M^!Uid!j`kQkjW5SsaXaKcvU!iTZ9vrK+li7jk1&_9V?19e}=TVLh9 zsg&W_5GD=#9c*qv(@9UHg0sW{Ur=BOH#;?tPvJT5+U%w9^SGABz(uUvsWBqhxz_zo z_s4}F6~mzwP+-^#w|qM#oA>zV!+Be6$~4>O9MM>z3l&yJF-=ZK8U(MkyR24fZz06g z3QX&}hZ6|78MlSj>zWW;YOBs$`_#r+GaM^ z;;Noq*}5{XrYbP`?I|t6GBxkp_JX6zTM+VECCf_-fqdn+V9(kumBOkb)<{#67FZ0w zsr8dViLw^#Y164+N~}VJR$N)u@)?%}xSCM=AeoV93^E&_yD|X<}^;T&B6Nn|j}}b@I%%x783Q zv}P;~wUiSM-0+}j@AyqcA~=z{w4=_+4A?u_5Rz<^JT~eh1TC>1iKbSy?s^*d7`evo zNE-JNN9WuR9`Yti+qNg` z_K7N0xsDdz04C@z#CwDkG%NsUs@%BiMtjua0ng+? z;#q$IGi%FZ(oe;`ka^4(yXQ5H27NehI#0XDNd^)R#rX)=dFec|Z#aQBu>()NCblc*_rx?zc! zmPdK(`1BRtb zd2kHS@=T$|27$iZAw}KaC*;zcZK-T ziUjC5XT_}~9?Rn_Ij)OtPG%ZAgi0r&CT91-{c$Qd05?85D*Q+>t089D6b=J?9X;t`cdhH(SJadG+jEFbKByMS{f6K!`9tD0I7>k;Sg6>l41E7EzExs z0X z=_;e|yF1C^l90i1Y6f;5GTlfOd(7FO(wr0V(*7vAlNC~+e@V%!SO05ZN%kRX^s!U= z*Z5c4QbvjFx=K`4u_#&`~GdV zo8NT4x=^!CNsLvLMc0t($>C!`Qv4orp*x)TaeRJvWbwA+={lY?t5DXgVS4izu^$3$ zfvN+nW+}aPGCQtuW!CHE{z1)Dbe!u^JLzn8Rp-pq{mGFXI%$>0kjt6;o)4;=r@uVr zbjws7mn>b#C@^3XA$GDflvtH~v7xrMB}(@P+eN|w+8JiHjW*K>22R=Fs@xY5+lTEy zyJ3(?QJ@GEr{?7KJJThh2V{CW>5w9|uJLoAy-J)Ufc2d%YwVrrWpe!(6ej z8U>^fL*lAR@E$HSSKzYP(o;ROgu2!ldJzFGAo;yy$YNoU~Z=PGwE*|I~;L>&Q( z6C&AbX;NoSN+^$ z4-wWiXj2E`Dte^t>}0T}F!yXw zl4cWpjHK~-D9NbeKgz%>u~^Q=_>1g0l}e6I?_ZujU9?ax<|+Ey*|YjeJ7f(2{HUO^RSX1g2Dl5PiH zB_?`uK}6IM4h(SNs7}~5tEz|%kc^MJNQCu$oKe9xpu)yk*`~#ercEnnActgqI(g@l znR*mD)xcg3)mYsXo~BWBhfTypN`VU}1~qcrQ+50-E4qOIP3p8F`g>EVT#8Pp`pB(f1*gKInK=t}07d%5;M10|#Zr^bE~P<^P1HCPv&Io`t4ac=4Kh2J zIM9|N#|B_Vu&DF11BxoLiTKj5J&Td)e=0P_rI4{2%YXSEJVKZr)mmg8T6^NheA48= z*z1`eD><)GzLdiK2&1+a(0mhOI?1*cGeZCqlVyJ?U?S8JUzSj@(Z(P;IJ@c8&x|cL zU}p*9XwxLntXRLWtQc6vC`pv5$ih(%rH)X8FIA$djtYHxe*UYRD_boN&N|1MQAxY4d z>mopXe?$`~%QYEheF*J;e>HeKB0keIDN>LpIoX+2WR^-k@n$iFLk`TFc?`QJ3Cgl) zXb~bx@FZ^_Y%X z{u#7e0)BLl@7DE~ zcp7Ru-TgK}@GD|tA~bnr?g{EibHK*6XQ<&z{fX-9wbL{spjopzE{MO<_>^q0WHr+1K(Gy z7oT0hwzeiz?WqI;gcaxdYScXr1^9`XE5lbF_GL|E=24^VqZBWl)BaQ2yc|Q8R#&lk z*BBZZzYOiJte?=@s~!n6*Qhp)JqH4RJ zpROI!3X-irgqr4_Di>?leP0jakc>Q#9G(B zN9Lk3iE~ihTSSGDQLo?|cHuXFa`(Saq)+wuKynxOds;2lOY@nFxDv-Nitxn9N)J)l zjjvRCo|TxQhu@BKnw=Wp=<&T!8<(BYggbYbM+J7BXrt(9J54`e0sYaG!gW!2fGgZ< zV_9%XdBnY2cJEdMtARoX8h`3X`(}mS5$1<=Z=M?gztS-Rxx@@|i#N>`UtIsaz2R1sAQAx z`AoYLv0p!D#=k@k9_l~$G#{DOa=5Y>fE|8N3}7qOKM|a?pJJ%Zwt!rg&wt^L8Vrs? zyBxCOmd}4u9`nKeHt#fm7xd8y#mK_VONH&3sMF_;z=i8q6~LHS+eRoLf+l;2d*1|wCEwh&q!L>Pr=LtJ{KushC znB5Oow^yzazH4xo?%L%4QT<|{9qml*8H!8WP|B7YjaFj;{>0PRw^#NUxNXUsu+kaG zJSC*mUh7pq56~7=#`;l3z@K^r^x=@0b)?z`teU@f(>&9_&)Fo8=)xk~!es z*DtI+EquMdeXL#C+phM0$RFG0XuYJuJmgx+R3#-y$|jgr%2<9;%qUt*lgft$t186FgCB$~dfElAqLcMUnE2yrxL+tHixWY*hY z;pd;1rh8kctldeRfy4%eTE|wJ)&Apq_=VoP$gF&>Z1Tf*Lc3$XdotFCppR#B(*Q0`CQVy19~O1O$R7_yq>LkJbR%Z2j?#V zZWrLR=JkE-&$S^J=6H_%MU=>`iO&XPNK357^XCgsr?1b!;i(Z#8-chD722|fR)L%Y zUYSD;D+7_972DTMa`Y;rDZ(!}g*tW^o))CSMMAqTXEF~SI1PN6sENe$ZemXPf@Ffx zo9lz8LkmeV>)D>Rn{B4nUiU_z)0|6SUp+B=?kzBln4*4&#=s42)TTHJIUOizWGE^3 zsx^>8kdmwN>+oi0(@#L(a0yj>U4!*;fkETgxl9)nV96sCVa`9_AbS3tsmV)&WJyRb zz%o_LyeF@DLy+`kfhS`Mi+TgKdl{_bG$b3D&KH&5O1ASNJ+?iT{q9-5CAbz4$IF68 zk|6f_1*O3eQMZcq;dNM0;PUs6pRNES_{yQ;X_X7sq@}twhgfczl6}joAk&Tv?YWc5 zy$>~B$n3pvryaZ;r|1M zsHRxAVKX*WIOR06A?nq2Y-YGY<^5xNS3d7g88kYFK#3(x4ST$2`OaVf>-H(UwbGpk zEN8U7HPmFIBVTqGH_~)}fKH8x*q0!`{WDdz?d&qbZ2}EOv|{~_GVHq2k?rM2Avi_) zjE4~c*f&i@KRUmO_s$w0KfitJ$}hv}UimEFsvM`fx``BYFSUzc^sGn!ynJZ8;>z0nw@<2A~5O2sP<;I>=IEojqERkH*bAZF)xx} z?#Gm#Q$tzPhIp<4SB}C$&)}YS&xOtZ$;g^NFE5_-!f1T-1ce_cilI3(-Hk8s97pE$ z!xpi0=CsfvO)1vVbtiJQlY{7t9g|H=DIA3Rfxxbzg`1rN8XQjAKVTKIVi%P!f*iE~_A2By3|x_~FBs>$us z@$vL=X~6Gql*Gp>Notc@*9I=ArgdU*i3x$Z^{E%Yfk|7-erK5`I&r3)cv;j=s+tZ0 zLm+;X$`AF4tqG{!uU#kM|9AeqJq*yCSG6V=!X z*huB|VGp>Wa#0i-if3Hv$}12E_V)Aq7WDL`B9{co6z9l$nNpEMzcx7)-$H_MpVx7X zFPC7ZU`xkZ+~~5=P;^lJ1cS>m+)?^2zxGQ3*o4;9>6fB%x_68oo*}Q0+4S^@Vvg6O ze=L^qX+cIxzeit2W|H zWmr^}30M-B(ZYS6q^jm?OAc9(o}(mg{eYHquFOmck&Y^l9M}t*=)B0GZ8@*4Bc5PF$KXkCuE-c{<5g%IaqPn1Qh`PK zvW>=;mX^lA%>1Nf97!rj7^@$Sz5zOm@@Kf)6{}vbF8Y(?G=V15VYcU?4wc8|1Xw#1 z+D>Y3FI}uuH2RN#yKMH|T0KY^=85G1;+xU1DH*5C;DWRw9yqx|s5HoeVx#02-^e*r z16Mu;j&bi6AR4n33zlv$ zly&I0?ebFu)hgV-`0xc`RR&5|y{eTs%kyj>H+;lzYX4UObnquPzFi9Y4JT;8BO#ej zZv-zH?N@X!IPHYSfh7~rh8R++;wO1? z!-zd}F}HBo`?34PZry4ADP0IaCes@MUW$46qq|%K4Rbu7A7_=OD;~^J{qi;FdFWUR zNo2@U(T-4w3gmlDlZ#yFSS9pHiKe=CXU0cFrwbh&1c~;9SgMZYj`qx2{PO4R_>Sm< zqYKFT)V)csVjI9tAF4|c3o5ejy^_@$Az2hWre`{ZTJTnCoJo=%3CsXeviWq-v0zei zOK<_x%LipHw%`q6;pr1^hq8cUek|Qfmv)P$T0NdZB%(J$MB{{hW-1{GnF`XauZryA z@a$4i@jIO~kWlR!=WgrxXv-tred4fDwbb?g%)R{%`So_Yj%hD-N0{yyRY#7WF;TdE z_R>?y%7xfvyqz!DI2%~hZL-R`=VG1_iJgiT{%DzHPAHVC{Z7cvYyLRPlUr_`_B*;R zDpN9~um8$^54h7Tpg0$1XOu68bDKSY;a!o74(sb_VD=-hR7Qn=;ziw!{VuIHXvzla zX|96`5tF2n55P-DwbIxVs(igY?M?orQfj{FzTW>b&_XD2 z)T(QX)LVE>*l1;N*M{G|ldggdGcQSP|%(pL;Ebw|+^edrw@Jf%wvIdwSqHTUe{{`kWWFex`t&7B+C)_nr&L zQaIN>4;v1#)XY0?s z2j7ni*xbxjsr$iA&-~gwMy4m*YC77wB(3V?KVDlC0@^|}_7xs0Jlk)8*T*%9Zz-^; zg;3?YC2-V2^S9eyzhztMUD*&g`FvfGOM!|GS`E?&?s&aJAs)-9nCc2yT6xsi*EFbI z62klBWSVW60kvasGR2vHYkQ`c%6p;^sW&%v+NVlxx57Vd>;LyZ@d@6(r<$2es9c!y za zFu(JnuXDmh1`?q~0k)p5+4qSU{wz=B5zbLDv zrDgB71NhtxwK@8qwt_w-2C-1%&zyAi02iI1x^oY!q80_7nd8}FKhwV{~6>r5Z|kRc;Ro3y{|Rk z5n7WUVTT?ZopvXsjDK0k|5zsAeK~}`q$gn?Y_vzXdKdRuwzXCMPtDa#G6?`ngFHS_ zC#f@mmQ$kWtpsF%&L!FZ!$rR!4tT8!wi06O!5@1=@`JC;-PLr3JYFcLVp$*{ymEwTOB%lsf%Zt_S zIH75A@WBtO%5(Hoj_+Z)H3-Mm%X#%yyg^ZN54+c=*Sh$1iQBa<${03cG$!jH+HKmb zE6GYlEv+!Y_bJ~cO)G0;2_qV+%%u^mQSm04H&cFM0aNvLxrT6uv!~fJ1U+5nrm;jz zoTggg3^ph<3=DqyOD{3)-29rg9=szwM8yGgoHYP74{AlZArnf4$hTiEHpwwHY_m1_ zO{CnEQPl|p=s?%`ocKhE^VVE_4!_a9uotqZ^3y=DT4zXon#(fu1jip@P z6XTV|W3D^oP@*m=BUr4Z#|sB8^Li_t>J0Dl*ksOldr>7+ci9hw%Q%^}CXNgv4H^y- z^54$<@UpSu7wVF(4?D8{98x;}qV6{#j_}Ms1z7(Mc?X_Mc|eJ`XR-N>KEuIFaFDS9 z1EWFpejeQbI<57j=ByMRX8qc#jdTW!RqSiUa6Ix!v zol(lc!H>2N%a0noubM9{tNq(^W8fSEL2Z7mXVS#ZM?SKON|Bf|rB|@HKfoDMor2+Z zz{~!c0-T@o1Z0i#32E7$9e&M_>ZAv7s)|;cgXc1vGdF%_Iv#SH!uT`L%EB?<$k*PWB#k|d$rG?gq7`uzTyI(DE z&hGkm?hCI-gXtfqe;0MRS8xTyWZ#yXP@h8mf)JyO|HvwdMYIR-semv9ykwCi1N72H@VLKR-c!< zkp9`3C5;Yusqok414XG@l<$p>WAPR~o~nR{Q0rXN=3B^Xz@@h_%Gj}iv=osdn3c4}d%m&pIfRPqJGm)3>ti+HHQ^V@Dx|_*7vkk)&~L#< zye-mAEfp&bX~jw6)ecWYg~3u`&)62Sr;HB-;IAn+ZdtBJJI{E+R4?I$cbg06NAAZw zFLh_S!7T?(7!7`JbupdS0nec_$63;t64L|5Fn z^42^3RcYoo2XU&3SP0IfZbU_m`+0Khshw*Av39AN=P}yu4lf=VP0sH<@j3?n^ouN? zFWUa*bUAM%It7oQ^xlmS*nh9k{mu0H?5nDMu$M{V4^YL{&s4{tef9oc{|D#kzMd@J ztqA2-t@(7DeXw4%LgUKe3o{up?ci~$9C8wkQsl!RfDFLp0M@YnEZ%e%P z2!>4au}HxdDBFSqxEs>Jwc*Q5D+E>LXZEe2#n6nvh*iG+@Z4#a>Lzf+KR~2bld<~d zcpfn405~u@S$TzjZM%c8{6gz!b3*NNJ}0HSZI-6Di+1@3bUD4O*B%sj_fjJRrG4<( z#`B;N88ILSrt$JN|FrsXT13#lT|)NyONM7L@YkInU9f0(R%2B+~7K=8wkbHdxfH;f&+#6Sa zJ4zRv&(HLNP;In2aQ<$Myx8!qf4F^8N^yEHmXSHzI7BX(Pj_=+U5^?&G`}ES;`8zR zxeUB9Q*vfMN#^Xu>0>`;K=)TYRzp`~;^x7#yS8@ZKVh4zhp;4l7aknkUv8}QC7|X3 zS1&oE9djMKe*L#w<-^)-DSRy9FPmdve}uu8;6la0i$-C6(c-kGvu|3*j65@_Zu6}^ zoYpQxk2hP&^Lg*V8xaJhM_W-zLfJjsz6_jlrr#VwJ9WI-r1kE6y<~g2ls{~5I1;22 zM{XAz&Ly%q1=3cXCdf0W<={UDTz)VH>}1wgbNx_WJp)vYZ75;$CnpF$|L)dG*5YPb z1wv5zNd0@JK=;c?_!(A(xn|t2+I4;=%vScfDL!C^yq2u?4&M!wN3*KA>IQ*Gq%pE+ zmQHM2E$koC!bX+>;s-@!cB^O?H^Omnb+ec^TX^f$5(;frFh4#hH$6PX)s?vc0j@%o z6z>nI3(`5G-RQXRDvcc50}Oh_F*YG{EjTanyu`~*FylD=9OcNuJG^PO#o=3p*?w`G zy~mS3mREjxzxt@piNXU1t~P4czk%L(ccnGU;vS>gs$~zoYquC9PsO$f)8So~{EC`J zD1)7oZ1*A-IfiJk)-spe>O}$rWH4r=e3dPm>1z33ti5A&WKs9-n{@0BJ2pC2$LhG_ zq~oMx+s2M<+qP}nwrx8%@B2UJ-f_O&amW2sW7pWDs`gr|7UulT=c!>jN$412p0I1a z@?q?AillRva0a?{Z>U$HC5CqPOqem#KoGbRtB-oYPG{?!!1^sX)eM-q8qT{}3?OR< z!K)oNxRn$+v6!wU3nYh*sy`#>LKAxG(Qsm$balBwmgOhNZO&~S(dL=VC5fFwRa)=# z?#h5$Ec|0(X19ayDJeZib8%f--FG9ErewCEjZ^ak4c zP8@{O%AZtfSI51oV~2*4N8)}f6)b{i5i>@EAct`qm@6}~AhJydWBH{{{cB5@9HAMA zO#b~=CC|Z8B`sPi9>tS)Fzrr+m_U7QlYS9J zHk+}^Ify`tQJ9*kS!usM*b*~M>Pn*ghNnpX%2v?-6Afndqe+x(hyCwASL-Ki39Vn1 zEL6pJs0zza^K6|Z1*8#Wk>$t78bHNUx%UGfbKTV-j3B1#(#QY=n~gV0MzMClC070? zwFL)*hSmQ0T1OT9x{<8HzTp9u>YOs$?e&5PWS*$a<~^xaxf$fUF7(A{7r@0db?l~gM8Ih{hwUC26Y|M-m{`XeA!)6jV z(2?PJ$Dw~6E$9iYj>a;0;MWvs-Z$aKR#im*IfL^*_m>g4Q(={>J3kL6KJ^TdQX`M> z0nsR}{RH$WVM_OuGHb8oX)M7-NB`UnIjA#Sy!s6h1q1uDSQ27C0Raw&iqs~{{uuMST)0C}}rE9`U{kvFjgPgiX_aL>>Y|Ilon{-&N>uhRU9c9QWWEgRa z4fUsoIo&C@TwkDatzB-Yj_+=f<`w&7{C-Sqx|n5w$ozzV+uaaO9LH>Ms8dYmi?FyZ z$!TwtFiuZK`YtUkcI*kkkwVkv zcDj_9CT1S@iONFmT_)mNQou?W-BWK>oky7vI$=}onGSU-acidgej^YwD^1h~IpGKM zc60+Hd&T-`lNx9rBAqVQF6$LmDyl2qn$ z;=)~k0*&hm6cw8eNb{ZWdZcu^Z~U=d86Hbx@t@nUqx8GmT|0dN<#Ik&L=w^NHMbGV zW2MQ~RtAIr10hQ3zbeTMgP+pSF`WBZvX=ry5seJmn#eQBRcgv`CMVf+Me(LBRK^!O zpwagJ@_J@|;uS~q_LO)SjRpT~c4#}HY;FY;un((fe@4$xYEs*_SAY#c= zhmgW{D$_U9`59}8<3EN?C?wO-@Qv5y94ISRhG{_B4+)haW2>#7w?(q7;@WDKl58^%XnGTESySnt`?~4y!fr z+8i=JhYx*Zs8!;T=2;y6xqMiYJ2(ve`EqRIMHt6!)Z$HB(+3y~N1D(!Qj*7aZ(*0? zkYXXb#}na+S#dePF|_&1 z1Izm2Dmv-Ikaps+QPtY|`Z$~Ry=fI#%y__9L}R~|oDg%ol2$Z3v0fXOIUlj1wb1PZ z^Q9qlr6dBAfz%^d9F8PbWz;$&`^_aMXHjJOYk3zKN|SiCIS93DdeJ(4 z9+$AP)~o2w3AEDvcuD`qWy6GM1g)c!%`O>>m)X_@YexFWV^1dbTTcT$w5xU$ECWa1gI40{RT6NELmY^PmcRotL+zp0{hiK za`e)V(bZLrv5!##b{>4=@+_c7emo^Hv5Myc7ytQ|tPkqs_7!N8_}Jr)@%hIdry!l; zL0b#8?0jx?c=hxG{&BmKerKjJr~$Zp&vTiwlaaj}6ZF3#8MPv`X21Hvz-nV2d97b` z84nwEx0%{ncBC`1d>+(-aV6OA8qThDR$Fg=r%UIl7{p~uvBdjwsQ}{dKV7^c&1{=I zZTYHLbZXHgJ%Ax`HhYD7HxW(vZ{Beek?N((N}7I(3?Pb%l$zHlk^Wr-g)&5Ygt78! znqZ~spEfKy?1|D7`_XI{hY9mAdF%)w?VPNc0&`Pv&Bq0ZkPZz+Uzwn4J!Ni%UubgE zaiW%SeDuPKvgeLPRzRMsG8vu;*dJW3P_7-?7l;5E%8-zf681Rqkdjc$Ju$NES`EWr zwGNA#ad-0UEb^}T(9@{`Tio(^KhfmBB-GnJqWvDat-rU9N0=mO@GJLDRntJ!)2}>+ zAhfP`&5i%QTIpkugjeLL?u7{n8865>;)MKA2Ehr4D5j!#a0CbnwtZj0{<}|*VNZ9& zhU3$lPR))Rz)DKDP@WGcypq3JPlo@*MoRsG##(Eyhc3aUXURoV7OC( zCuVuGeVCZ=UBs2iE8N>eCk^jtK009z%clw%2QhMzdT+Np9K88#PO;~v$50wO+WL1^ zftzQpEz$=KaIbxeYuZYVz*(b7o_T4!lf4><>f1R1m#~P}raZx>lXBFJ+=qz&hucd@ zpnF54M113*k(RnDSFW}lMQ`tiJ94UwP^Wj8G(sJXULb>w017n?9K*DSP8cqq4;qBE zK9i0b-N2k2ND;DFQFgrXIev&^yl(oh@Y;F zN_4TlXkM1vit$$vM(d4~ZX6NUoRK38pFNH?rBS^yMCrl&XMYA$H0Ap@k35pULsf~j zc^%Phvy+6)wM#^(n0oJl>u%U$a5hmGiDH)GMsV|ehBDeSck;)$_0b&UiD@lVCu+yA z1xdUFfR4%V9l;`!*O2EsmdiDR2svn7EM{_W<%BPiteh-5L}sI(#p>uV*C}1hHy6=C zGEj7tgpsUlmycoo(~zYZ?7koq`J=Z5JzEi`k$YlwiJT<&;a`p&bzZ5S*BBI94nGnj zLkse%(jGty?bHmlx#mFAer*i5?PwTZU~;yl0D#uF=(^qO=PUcVE%JQztcv9FQ;9#= zOtI6~-jO}>f2LWl{?>*@8%Yv%sC$S&c1rR$i=`Dra~rbv%D;0MNMa9Q+EIP*pi2I= z{-$^lQOQl(2{X#XIByxNPtAJ9I1Sz^u5z;@z|Em-XC_S(e(#8j7+>WpwU!-!yTLqJ z4d`o;G9UcwH*wh(b-X>LH0c8~&_;Y`+fS(%%l;buANm8R8Jt?MeLf1Vsz5SNQq)~` z+B$7TJl8$8Co{US%D|?jXZo`eIhz(|7*KWOE!pWwIP0Bm#XBTu#Utu`!IQ?Zg+_-x zmCPAuGi#-@W^cT~nfUqI*(i%rlkD*q7V)=LNlsZqLfI_Ev?$W5KYPV;FC@cx%4#xX zT$>x;W7`MfLl_zzruE&cjcUO%b5v=OPyiGv?i^G*BrWQ!f~>jtqJyfO01O-)2~b48 zsbpWKib0N{^i@xk+8azl9y3)LF#uToC$eO-V@7Rwoq|^ZMER_dpJDL%~Bx`D0u#qMK>2mN$#B;!odt3 zufa^RV|o{XC(1E|;^b|?uXuI;HLobBvUOaqoBfsI11Wa_D~?I^t+aZKq1z+N$qy!gly z?MKebIce#{*T5;xSvh~Iv&`i54Tgs$S}M-^`B5mM7Ab@ga6lr9O0ym)Q(M*2ScYB& z4^}z&S=fs#U~i0>urG6Y=`rQPjLz1wB-RBc=ilvLxUu?GCur6XO#6V;Tr84rt=}w7*SmK*xhZ}V6p;~WN82!@6RFV%Yr#sGsDLfB*f{FteerB2?!>vFd&)_nj=p3{Iw zYh7tNrzneSaX2?Z?|eTVxs;eUtyD1cw>7mLUGs)OY^UOs&QR7JAiP?T>;KX?swpE% zPi7l8oQZzOIr_Q(uDod|EDspI-`EZmLeT|P5b7d))nuh_Hur3ltP4>fkRNEb=H1E$ zOBovfMM?H<*7cnUn69*ddF94uU-L9I#idAh&~9&tkR!&%Cgs+)Ioew2oRsVgCMC-f9wx*TTGX=>u-A%A zGCZ+mG8=|Yip+QX3}o!Td{!WRC#3ts>;0R!iTVZ~x}UMIMTBIjUBkD(Xbwy4l9eK< zQL+yq&*aEa;h@QY(&6xcPyC#g2EUa#v==-jtBXshWmEwm2=yNhmvW`Pg9+22bf*`A zB=%_2HEI$=_vhx*wO%sAGfja^rk~ZlxYA|W(Xtm0bfclH^6}@R|8jKMM@~RMMLy(x zdHSd0&0YTT9E&UBpGODUqI>IC1HJcNixD0)#a1M_NUMX<#?nM+-dH?RiWaM)Y9j_0Ay%-R*`jA% z)Y4G(x8VoRfth#*`*4?|45Sasb`j;b!JZl#npWSt=yw>^TUIMeq_ema7Mhjp@6oZ+ z3Plk*Dm*D~2?pM}y)1+gK|2OzPi^=h<<88djaE4T89Ul&>ZCdn&(NS-&oF+v@acw= z%O~9D8hf0Dfkb_HnjiZEjeG2buGykzm#s3U;EO0~n757ty<#^*sY-)M>gV7_iSBR> z?c6|SU)GfFhU=XPhDF6-6^C5Q{K8j`TVwN6EYd?)M+HM#8J6UQtje~V`(_n%g_3GX z*gzQILTu$@gCk_}mAl4oXm5}5=>nf5GvnKq*CQp_6<@l2hQx+UA3$eY>mRO|RPAid znDTyyrdID;#d&`XIvA&UTO#FTgA$E8*=*FfXPovRXBB1W_EKsN`TV$LOo$I)G|B{M)|TTh?2sHjBI+_0i%gBv9NUZXk?DyzWxFRcWYKTeh3=ZGtjTc zE^OIiR-(DKo}jOMp7|XDaDg$W{;Jrn2e^kz#EV{cEO^(8nRktpFOl*%wk?y*UP< zD$Vq%*(F5`|eBDpkFN? zg%phL`V2Z6NS&q8e#^KJ;y7>hp>$0@v+h4m3y90AmTy@BlN--*L3`Xe=fDhee(Zk| zs%cwi;KBjOg%<{^6jrsW%!uyksrlMYSkAkUaK*Pv+^A;3m^PDi=hS3-z zJwevS-i=h+wIUj=uhQe-0GKO#dmoh7W6iwAe<$#wgJzY(3QX8rft4-tfP>z`WIvIJ z!x8n4tzo_opVFMOJa`$=aLhk#+k&_AHJ;mUeekKh$MO?850N3xAKuF}@~F_)q>Sg6 zori69o<05fGS-vxi{Ft=rjEo9a!NhLEsYrvQhrFyJ|gLW;XYXFn*O-0P2J4%(84ht zAoX-zr|dH>Rc$wB1dvq^85sGy?@Tl*;Tk2uGN(DvCVGC^*Zo$;ADy~(X+NUc%Wy!g zg~Q)pT+|TF$xYbuu6>#hpOr#m6GJjo}A~U0dACw;gUkx=o*iUgIWSq zxzZ8)ABz{-j~&!a4|k>uG|y3Ka(vr!Hp;fo#gSKQJbc?yndw(mGzFWUNQIjASVjrl zy`SSP-&kZbZvjs%ur%2cGh<%SMc!WyTH3sLT};y+oGsIA?WLR?@&SyuCD+_KTjTnFF)7!ffksZ0OJWi2jqmPkQXRu3% zw@K2H&w%Z`hqB#Yd%`AN>?e0l5p6*ai&oX=2~p>XSB_%~DFsW-p4d*xy-r84b))YY zzY<109Z*RoGl!3bBkeB95_jR9rY_@BoAhM0`p3%z$YQtZ%gDp0~o98J!s~Q-o`b&1-L=$9+(O+Z*-nZ#E>! zMq1LE<4hNy`|?X3h%4~EO^kdyjk7g291S(M_k~Z7g80yoilIAqrirf zaziQ8jYz6~-*<3oLVmdC-W62Fx0GO~@C0VqPuFxIBMaKP!{0PC?uO;dYbgr&qR2?k zd>jhly*gIqSHU*Ih|7W}H}@X>IQ`b1k*;N4*ap$FTQem2>qr*mnBX!myDrXAoo2W= z8dyR=s*lf4l4~aYQZ!JK;!hW`{Y!<+Pc_wd5wBi!b(}Oo8W4dc=>tcj1*e#g{_`44 zEJU`;yf7yVgPJ#b?npb!-)CO^=lK;%aX5GvDRPYhx zjfK&&$S*!2d&AVjZ&pxOgsrYi9-M7iGHPl~zK=ox+mRstP+v?+Mv7v-Xi`p9C=f|X zK?_@+?RVqIH9TDGx8yxQ%)6=!LO|G4j$*VDiHubjHf*B@Q(qO9UUyjCBF{SqC z!p1$Qj2@+;6zk56JWQ>i`njfQFhEAliz{rE>#l|8Dny*jDC&W|uelayu`zVPi8QTB zg2_mjvC%%vBW0k#CLrm`x&5Ftayv?B19DwK9@2pR_jHB zLRn@)!pR%HB#RTEB&y2Kll=~fvR|5|t&Gfq=M9o#vJD+fVYKueMW9Pw9vDg}@2}(1 z8^+-Z$-{5$$;;325~0r6i!)A3UsSL4&7n1;tZ1|@*s~GWyvfEPGUS?flVH^Sb_j~? zAl$m7q2fEJL&0r^wp;Ud*j!j0SHtP+H|FWr{N?}M?xz$PfrTqLF@>z}N9~oE@`iU- zVJy@uqT&vE;ZXiRECIl;0Ei$;48k;>O8m4`8WNZ3HC-D2@vLZE;EfeMakSlR-|q$= zzLLV^o{g0!bSGve6?9n^Uu&hkSUR~)j2*5tQ=m0g*Z8?=M>d+%;0*She~wuYOl<>_ z8{po)IP{vZ9(q{|WI>ANn&GdR@DYB5EF#tDlB}{>X4lN~-vC)U@M1`OJ2f=t8et2g zzk|QIJGa^RkD~2bR^* zBACa=$Ff|)^e*sCqrv(m|mxb-Y78I@CYqiTuYV_7w z!~}pz*(HPSzwFiB|6ot-Lep2LruD&jUz%VV5cqJ9ouCue9nqHfJ(tt( zaYh#t_m8#fcdSs%RFoJ9>08hPWqkf0;_o{PO=R3iFne&9C{#5`;Jt~9xIJM0E+gz9 zto`U>L;A&AiF1eSLS^}ZaXM0?pt(Gzv%A9rs?4Ns|78prA(Uh|L&TvxgTU+Lb>X6{kchYnqj!;@@Q5&MD?2Ez( z#l|RY*{B0iD`1noLyYaOguAWdp`Jy8 zNyZLO_7heZK>%>LH*k>#2!+1}{!ddwD=EJ7Nt)q5*GuP0)zz5nB7zF6s+2R2{MEj#~b ze0q#|mQjE8#Lnu@-UkjOe*4+TYBD!nDhG2mvn;dm)Nfs{!NYR{S!vuyO}3+>cqcUD z@cgqfa|#yb#3otwN&kY>lo-ytB9)jNL02A&D_~kdlfM;3N>>~_qXnhp?k6OvuxDsJ zAFqlbSiics>})_Zy3?5@b6Et{jnhQ|Q4`-TWd1gH1wMhx&&>x2VFXQ|SV)FnZ2npJ zqqLl+BR{R`V`Gv9j3d|0XXNC29yIoy(fxzQh~Q-+PvSfIrKIpojcIJM+dD}@7ec-{ zUIN8=y%(g!cF-gA_mYB3TS=V&$*T#;HAVX2eVC41Ff@-T*rH2KFE$C1Rw=2ROA2&;RkM195#ioL_ z!cnZ+4DY+?8WQRcmIk7#V1~xuzyc1Uw}3pTS!3PHL$2bx6BT|K_@PlE$~rqRcZKsM zA^vn6QFC(N+Zt%TiUvBE<#qG#5T`r zj}?jErK{r$>+yBVIYYSYab-n<8r{+~O6urbjhERIhlE5{W` zJN}6om5K4KZuZ^3q9Q*b@)*n?-nUtu;gC*zje)de7Brou-v5I};hvdm4^Rt#na2Nr z&Xs2wX||s-awH&D4y4Oi0)<5*>$FJWTpx;K7HsgO1;!+UoPw`Qj&LW<0t z*4+6J0v~vlkF(*Upy(HV?Z6IN2MFGpYHKY{2)hMrKJskTJ%t1#F=XGt+`f z?eN+YzSPI!fCQ=C%E*n8p`-U)OA&J=9ivIbZx2Psk(7kLtJZL)EG>a3{YAt_RW&`%?sXF+^dr`by5&JwlMs29H!{w~K!XWyJ!aj!Y&C?RQ+p z4Eer3ETvDIW-{O3dJ~`bk-kM^=Z5o)9^T$bP#0Od1pyOjee;bE@C7Oer_Q_npH&TY z-mH+}Dc+zxtlBGRLB_nVD|_xD@c=?U`?Zfgi1S zqst?_v_ObNMT;->#PCJ#ZC*SNT*gji<;8%W8O2XiZoZCPk%0BQ>jO>_5~G8 zc4I=XmDBmOqZ)+fsm@37Syn@SF#Zt9=&y2MSYO65Vs^Ib?!#zcZ0Z@(z<(mn>ddt+ z?wUlYH##$fP0um>eF0$JS$}%x*mb|=$J(Y4V3W-e_}D*Rzqy6d;k;#cPF`Pt;d^of z?xo$l(#M;sUr(oY$jBGEX_3scOH@y>iZ}*x0=4=+5%~H9lo_N0LrU<^4t}B~&PJ3_ z{q!nXv03WKPc2%YZMzzjNxrJ&;@~?fRpwhzIQ&D`>a?d^xs<5Za64g0P`KG1ReGaf ztl5|O(c}~R>B7hNM28!s)nonR`r?)VK;b-P{NUnAx1itb5wz+M+?X=M!u_HS)j}Mv zh6i}S5jY9@Pm(uQ^}jRS{louw*55JKz0S1S?q^$!a$7YKYPd95R;RxnXd^od%NX0A z0J8$~K(G*!X^QK7w*|MEt9qjE+?{s8alShci~9=X<;N$l@m`vUq@+I2P7-VZ01o8M zC_$fWy#Zxq`x7}q1tsa>%y(SxGFln3P^}Lf2{rn?&kwfHFu`>f(|dC_0DrQr!Ee1D z`%tS1=x?CCbvbLE-_r#6kTO!7r}mVjs8ti+!f^ru`A=CtY$i8d&flxwE@I4CJD!+U z<>_{t2R(x__!2iipUE}|_|gDX7jIN?#;(||X5f>}NMCUFMD+Qd`m)M#L`*Vtvxhno z__L&l#ONdrdtZuwm<@5OvTvjq1l1XQ# z5_6+fZ*5w(GX@x6?VW4Y+B=D+b-ya)QoTC)EAn{}NQ!sw*dcZuBMLlcS)w>~yvYYN zRBT;3aSz&+Qdl2i6^pi3U49Q;8NaOFVy5SFJp$4)Rfhq~53)&j_IRj@A;D;ECc*Qr36+kE z4l_mgA9h07S)NY0=JwZZ0@rjwi^V+tzzc(#tyx${r6V5KD))}u;6O_Pe9Rm9A)kE* zsLOb}UrE^LWUZ99;HYZNG54=A9LGK;dn-;gN4^NZICii+Zh&I=2&5ikI)mK}!S07PtB!=ut-lX$E7q`PMSb*%`S{bWYRW%Nz@FhcCkULR2i=r&}ce*|M5CpX!j75!Dc0L{-dqa9q0ZWmho6H z`IiBEwIf0QX+kw?CrT!5ke_#KGAk<orbAat4u{h>y3a(Jp{F%);0>}x5pR#xB$?Tbm2rbd-)dD@PJ$k>oSuYY z!tig|Y>n_4jsD`sKkOFpx7@#fGSh>Qrc`aCJd*S8ihemm6fihxqFl5i;4Zx}HnWWX zQQy?nvO>}DUygf>n|jZV zDJ}{9(a%Z4;lSMxL?6xy`1E-xJsrqcAnaT zDYb>L#X0mcykq`~@jcT-AtP0M|Mly&n?Nh%zaVGnaY``%8V>0GcB(|G+OyB*(;;5) zNI&^-sn~@?%`7^n`KWQp<^IKFy@5SIFuwwD2cC3Dme!^MdUZ((iK9j>lfodUM5K)* zZF&7&_Uj;^(dOAPcR}`-wCd#DMkFoBsCl~+& zjrgO+@+5*fEr+T`SSn*UJNj1oSRD+>Qj|;F!ml|Q7X-wcHo{qn>6;wMm4*{`OivN;qC%aVFqbIrwJP?u$@R0ryaFTjB=RJyf z8(GxQvrGOB!?6%noI_KtDV+&FyhsnucIBHa zpFC{Q;_cJDL`3ZTWV*CE7QAWPRa_I4tEP}o#FU+tIj&H4+3nqBhZp%(Zwg>XD#cb= zPiGNGqiYv(yhK4JRkT_sS?eSor)LXr!BnVVyqu{8C~5fImsE%naAZZ-X2NoF(E+*xS5~HY)q5iO_v1BXcTY zjZ?7y*mwg`>=mjYFb{3Q%tW@r;HiW@bkgY;ub3VK+ZzS|o5x*qpSfsIqkL zj0;FTn15dW-0U5#YzJiW_4}4q#B4&jX75hr zKx1p{Uqylqx!!*lB20`#B*tI1LefkzZ?)=wM2K(movMStAii{M&wi6c_Bo#MXi^;w ze2*FEDV>4lyhoVBoSbpE?t)pcVj@9=?{OWaL=)XDF4jH`ped2$?UQbefe7aPWzaqx zYgKQzx~aK)@&xdcq)fm@ur2Jg6M{A_(1bXEjzv1!h2&jm_LaI*TAXBW9U0#hr!1%MmoWtt`oBy>!cqM9i?!2MGWn$hi%f+4M&CE&jGo;|bH8DWn$-bC?7*+=4zuATiS z_dlElQ4kc`+>q#TCktE*!2=u4h14F%Cuw1zs(mMT3CJU2C?}RhS8^X2H?6L|j_MZ! zjlj@R(va_D86jfTobv2~){q;)xiH(QXGRMP1nAOhPo?v2x!{-^4W6&`051ENNy0zD zG{_XEFG5uCX%DBFiwBpp!EUo<{7f2KRNr-I_yrhjHQUol%DltpYfcoDe#mc!{#ZqH52IKstLVhN@?{VxN0_dh9Pvq z(s`J;8}`QlN432M2gQ@V5yWnSLzSC4^K6D^uzIZ51csW0)Y+#q z+~8Z~-ZCFO1xV4`NhSBoTj7|C0p4QeKPhr7nxS z@zV%wJi76ACk5u{D7U!*$!uBks8)X~T$ zL;0&k1nzS~%o&=cd&+ozHI3#kWT28iww`s+BszD(EBQ?(Q%_X!C))=%=&$A?eNZtp znTzf3c+e%?WU9yph16-ckzs4AB69K&5xt;ybt%Tyq_kTHIOC)*NS1;mneES<5SC(PQV0RkSO7XojNb3` zXzM@3G3x@_Z|G|sYa)J)D_Cs#^$929pq*17u6xoi7FkFHlkv)zTjLb?g%%2g83BmW z_N9LmsB3FrVSS^8neo2p?)nzg?^!)7tD*5AbOFq1BIW!T`LQ{rq?}P?p!5Al2|n22 zY62)^g$7g;pJegYCiJ1yMSyH61bASOpFBH;FtS)vU*s#U-2W`-;I8cf7bP@~?~9oW zzhO+a+SO!rDEWSy$YAPC5Z1Z-rt}$;Jbs=IiH(MHQ1Y%lRN4L7-7P*$evMtOtMtC- z!e%&P;qI8hV%wQ>KkWUQ2P|Eg6FXIf1bo+EZfwHCdcp)(s@(z0Uu=D!UM4Z}BRK38 z%++7hK_C~-leN+O@UOzH++BL+Z>l>~dOJl~ml4f3f>CEnYu|#C7y`FByD$aTlF;*{ zLZG@h$0AjlBR+V)D|iul(M&s*#YI%tCY{_BbbU`0H?<|QV5L4NVWQ$LtZ|JSU0$_f zj~$RAoHgyfC{Y5+7qrc+a!bmSb}EpZONPCm71#_=?W^K~E=0sl)t;Y@J8%7=OA4qE z@A30L8tg?7k;p&mDO?(*LW^5M4yyFQ>${ppm96hW2VLr%QJ6g)dF)UWWM@O?b^7O4 z!90D_CTZhwM^MDn8RJ1K;RRLDK3ufqPw~ckRC6^1{{{njF!C_2*+Jqq*fo1%CqdB_ ziWs;mw5~mEX!pBGC}&$|?oi9l@VyR6TS-mHe+;4C_~TR}a&7e9m zBZcFOOcK#@ro&D$_dhw*RlTOOEyq|HJ(MVp$y{@=!NI!Wt!@IT=c4vw9d_umyI$l_ z#5Yk%0;cJR;f+v6nNUjnRute4j?Q)j>b!a!4uTZ7Mu zIQ?QxzDnXCO}96>(SHdMP44)%64^FF0xWy2bNTF>@JqITSiY?Ak(ah3b#CeSkv(NA z!i6Y?`1BCgX_Bb6T};x56zuhiKHr{Z5<&o*-EBv31VR52NELkJQ2Awd_f5L8TD$0Y zCq|-3LHTLZ-04ceox(&&UYMbK65(sY{KB}89{-fjXWw7xbRHI76*$7L@$;vj} zG0s=hw)2Abk%wT03y?fG`2totQ zH%GM974)VT?Ys|r1y(m$E{EMVo243ESvQc0jK(H=L=HFUgZCb%JYqQnnY=bc<^~-| z-+X9@R{rr@)p2rvYrC>-Hx@%g4$Rt_YpU^43x|z@8fZK48D`4B$A4;m)n@SeDHaB#cyQ$oy7m&$UU+{zak3HiOYcVv{o)?$KXbk0 zL1cB_zQ`AzE0QB2F>@dtR~yE2q$VIJ+KX+}?04Ly9ebS3aKZTVJq=79YfpX#RNsYA z(Vuk)hflH4tTk-hQWUqYl}3ymGF^rgOHS9g-N(zgUe^vJ$Qj$?+Qx32L!21Mp~+T6 z;N>EOrkbMyeMaka0sT$}#rpbt`dbYR5+@?<1!%?-+G-VSw`B9Zqj^i@@K3%T(aF~w z_3z%A<=FONSxRm@I9d1%K~I`R3g4*Wz1%}8$Cg)iHK?+%g{6FTp$nX_oLw|jc2N2X(ic>^Njow-e) z1^s(5eWh#=w`jr ze#&ktc{}|f_BLwahmy{4g4XNp`D1txz+AsNssik2$H`6i@a=WF(}uSYyZFwj zW(3WCmKXJAVEBmy?S-^@j-!K&bGeimQ+w-d{~Ou;3E_V$s{Ir%5j48icfB$ZN?dS+ zAhP0WP)8?R+gc0DmdXVRdYC%=T%^76c2!8H!R#!6S7Eg@>6&4mYk^Mc+@O-!QFW^6Wdupm^2k{ZS6sbvf_vfojCVfdbu{8^q~swzM?=?|6uJ zpx#0+1IRqOL{94-Y^N8^fh>*X+6PD5PofaWIA}dSEN0EG7Y=K7i>8*EX#vW&M2;56 zIuGxi2aAto`zaE*0r77>;ih-?dgx_}EhwfJ| zKNMgX!w6QT1^_3<@BD?GEn$X}azghCHExU5u|8rO9qV)Cq$s%wHt@)Z3dX<4)zs`b zY{vatyy->noc&S zD=ez{5h}>ihs$N(hiOmoP)$;}nyhW54`}kvJlVjTjqY0qXC$*#93TO0h#C`+w!trtarfI=jEK z3wdPw7+VK^&ao0=2Ezf`0N>q^WYWMrJ zEGHuW^`h=a!b1cTo#f_JQ`tkg=#a+V1;dBe8@_2bwTmnm1Mv7m)gFOnC7d>%L-oEdBDkRP3QqHRuXC<0 zrFaP7?)$xDVYW@zVQNA_L+qD*yXJA`Vni`NFg?aCp>6dQSs`Y%qg}@GpE&$E^>mLY zu1+fAr@8e+Mz>Qa)5GkB^GXF$hPxUsnokmv#7x!7_uYdAwXlezjVo3SL;?mYdHE=I z=c?nX{@r;BJc^q9)GVhLhzYo9KqFQ6}qNCey(99)30x208Dy~Y&AVY*dV)jrc|UAuDN%Q}tb z9Rrt%aG6ncOa+grPh+5D8KUjFwch-e@jE&Zu`7fggZdQap!Iqsipz2EW)=C;Z*9Pb zU_Axeokj`QtJkn#b1iZUe>hDQ)#W07u-UWnN4FZf>tyiS(^NRAR8sF;o6++uOX*dJ zwJ4e3%1vOC;U2iIK*!#5>*7@hFSv#>XaTaAu|5k$!$+_YtF!jew02l>x5KPJ*LvWd zADi=gx7$zEju@A9uID=qXtlN|%0-}p_86$MvK!?b8C1`p>^xze#sFkmCQIpe#~tuI96Cm4w_!-!_!^r_D6JPx#g zS~+ScZPrT#NDz4D_?Q z5w}c5<2Z_@+O0~dTEeS%mGHM(BgL4QJnZe#}QA?Dmbvpz!y1!!4fj>B;gs{Ayxw@ta@2b0RF!dVoi& zkBqa?ZiR4FkX{ZaHZz~%O+mwFwx&S9h^Vny7`<$#_je3UuU~7}g+RG}Qlw51W zQDrd1G+pkF4wt$4@D_P#;Xmg|**8l-Irj8iROa9QD?}!^aR7)uAHH@whrHLN&P#qQ zV;hQSq($uDIFXeW;2$1CUFznh22GfuNi2+!-4Q!KdqGi-D#hH~#lBrDuUgCd0y}># zGx2SL)yXh}lHJg6%`*4y9U5;UD$#Q{buUyHUUvElo(Y5rU5AC$>csiK0yRB^%9bzu z&tzs42rTz?sX)NX5@HFc>bG>O@6kHlP1N2HpN&yxzZ8E==fRSYjUeH!E5tQq<6(&S zRf4){@$3t?gGXQmcb0qS*7NxJ4WgbEgW7>%xgkzZ6_T4f<9c#B+4Fh|1v(Q=^wweAya^Rh+txR z#Lb=Gx5H(8u$|Ejt5ejszEUA^q>P$^#=9WWAq5wnQolwI3|XmO;t3W@7cwoIWy@(~ z4Fz+d#T3npIhmDksh3o_`SW(KT|8+BNJD5~uzk~uNlwD>=R!P*z$Yy%!%AHUkJ`hM z47~?8uLBa|XNVxbvk+r~A(}RJjPvmx8C(J1|tJh;OL>`@L>w; zI+5Ic88LYlN&ZgT?w-mVGP5h_QETyzOk+-J7-~T3Yb3w6i=eQ0LcE;L7#&py*_YQ# zc*G?x-nYYEjY0wD0&Y?-YjpWyL5fqj{h?fS3rGe7CCcH+C zC%{(8vD^Y0`b0oR5@mEAVT_$Rk#G;_ug&LRW)VGxe;`t4%_M4wuZ&1X+2+(P5Gi1Q6|3Jj2J3Hhv_&I%v(`$HC%8RQ_>Hnvq7J8v2`x zC}Bhe2aqI{Fj>^p! zhs}aHd^UkMe{lMa)@HKy9Hgd8N94H4Od5Xff3C%{?Q_K58$s{^>{zS;xCiYHM2yqKj&d>&=F(`@Gh*sOl80S75>j_}_j%{__IBDODPoF( zg2IoUA1bCOC@7o_2en&XJxMtG&*oDe@P~wlLS=iixS0F;Sxm=Qxp^w6ciK`6ciK` z6ckQF((4esyb$n2KmddOyEFX&?6L;C#uJs=h(n{nE?m6&WE+TfPY{fN1DnH$Mzo_+ zyV}yzb6Os)*N Date: Fri, 22 Apr 2016 17:47:51 +1000 Subject: [PATCH 067/439] reflect UI changes --- ...ueue-windows-advanced-threat-protection.md | 5 +++-- windows/keep-secure/images/alertsq.png | Bin 101134 -> 105591 bytes windows/keep-secure/images/timeline.png | Bin 42949 -> 40450 bytes ...view-windows-advanced-threat-protection.md | 10 +++++----- 4 files changed, 8 insertions(+), 7 deletions(-) diff --git a/windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md b/windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md index dce5e7c0e6..e18a0ba7b2 100644 --- a/windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md +++ b/windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md @@ -6,6 +6,7 @@ search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +author: mjcaparas --- # View and organize the Windows Defender Advanced Threat Protection Alerts queue @@ -22,12 +23,12 @@ To see a list of alerts, click any of the queues under the **Alerts queue** opti The following table and screenshot demonstrate the main areas of the **Alerts queue**. -![Screenshot of the Dashboard showing the New Alerts list and navigation bar](images/alertsq2.png) +![Screenshot of the Dashboard showing the New Alerts list and navigation bar](images/alertsq.png) Highlighted area|Area name|Description :---|:---|:--- (1)|**Alerts queue**| Select to show **New**, **In Progress**, or **Resolved alerts** -(2)|Alerts|Each alert shows:

Clicking an alert expands to display more information about the threat and brings you to the date in the timeline when the alert was detected. +(2)|Alerts|Each alert shows:
  • The severity of an alert as a colored bar
  • A short description of the alert, including the name of the threat actor (in cases where the attribution is possible)
  • The last occurrence of the alert on any machine
  • The number of days the alert has been in the queue
  • The severity of the alert
  • The general category or type of alert, or the alert's kill-chain stage
  • The affected machine (if there are multiple machines, the number of affected machines will be shown)
  • A **Manage Alert** menu icon ![The menu icon looks like three periods stacked on top of each other](images/menu-icon.png) that allows you to update the alert's status and add comments
Clicking an alert expands to display more information about the threat and brings you to the date in the timeline when the alert was detected. (3)|Alerts sorting and filters | You can sort alerts by:
  • **Newest** (when the threat was last seen on your network)
  • **Time in queue** (how long the threat has been in your queue)
  • **Severity**
You can also filter the displayed alerts by:
  • Severity
  • Time period
See [Windows Defender ATP alerts](use-windows-defender-advanced-threat-protection.md#windows-defender-atp-alerts) for more details. ##Sort and filter the Alerts queue diff --git a/windows/keep-secure/images/alertsq.png b/windows/keep-secure/images/alertsq.png index a537983efe35912b0e997cefd6ad82c91fb430d3..b89dab8196f872ffd08a550a583b962c59ce5503 100644 GIT binary patch delta 88622 zcma&ObzD?m*gcA%pwggpC@Li_ok|*X3lf5KO7|h8q(r1kK)M7Z1cne0ksOB<7`ldz zq2uoHTkn1E@7~Wne+D;H~ zM@#T%k`tL_ zE$77tU)DuRSI|Be+z)hJO>;}i1JPrWuljv(u{==w#b&;g-IPsQ-Y*TU=|@J~w@+lh zmiF(@1f=H8CF@+UE;;X38+|~Z>sKSTzfBI$>SSCyJ0@Qs$*4cGZuDM*=-ejVqZZu@ z7HFcJ2s&3orCJ+0`@2kKCA%}E0*8!>J}elzn%+A#N@c4ZDx$qF(5xmQe@Uj3OpUvw zf4^&v4of%BFr;US`xjjz`}v0d3tX&T3smI}efM`7Z!dEAJ()d0WRtIVD?csDQM5|x zbrunp(HTl7_G#`b;zb=p$WzYw5zM6H`Wg~O+oEb6tG?^me6rCX?7eS`+;MSnneG*u z;;5%|<)Pv@q*V}OU3V1zY}!d=`}@l^ho&Rujju}#`^R}|c|>UKbNLzE#IP_+>5~oj z00%$v!^us5hyCbN&!XEhr&}o>c&xXs@*EOJ2z2Z1pOT8Zo(wr5kqe0J4Vm2v z)c2=HO_I}g3Eg#25?v>jqx+E7=zLnR26Wt?oyW*lz2s+SXV*nsvbM1i(m59!Mc>=o zn-W_aj7sV-fluIhiZkr(?|(C|YPGNJhF5zZYy@{NU}Jr$smZRcuKwhNdY-wCu+=v% zNZcHucyZ}ug3Zahx>@Xl`Jy|X6fRcdS!M4dkp!bIDHciKko-bG&8+)?(?e|&r`qVV}KHc@=_|>vJ zQgxLKf9yf#%%tfOX4Vz!NePZAv2d4T@C3@A@@9UJw-Xh^i&#SDgoS#4lrV>&_T-j{g zB~nfk4zLxBFzZg}>Mt%XHd}?*qS^!Uti#E!_Lq9ua^h1 z-v8uDk=^n}4HkNwA1!s3(rMaPw!9c0kZIiWI}kG-=9un{Fk)w7%8ro#)W13|-n7u7 zN}_r>LGEX4K)|K8Q)F^au%SOiMDD!VO7opxB=wW_)N3~`9l&?KO==_fSsMHxh$1zO z(ksBB&NGC-t+=(jC%OMKFc0d+p0pzZU@!3VjnG5wbrk1Bb&Oje z6zU&nRKBQi9C+Zp_&`auZg!Js{&MA&ip|2+qr&m>VMS9Y*(;e~(JN6!h(n=wg3aSF z*H1}xf4b`;DAWk0pcG3;(jj~fw>b3N`9eS=1$I%2A;JsgP|=?rh-aTt=E=G5dB*#* z!KZ#v_c8(cltOz_mu)qb8lGds|Er)g(P#YicS@Mdg~LQ&i_eaWl!{GS zba_Hq*H$3d3|(wHwq*oP`XStkQg78fEBEBG9#pUL zAS?0pJ^h_)7u{Mc7xUs)NEVwx?%F_Wo%1pYiZ^GuZVN;C#5aN!jIcr9)Cx<8qzca|N+!&eQd0&{<9jGD{a_8Ib!d z(b~x&kv;xtmuQM|K50aUs*Vnel>65gB4}H1<3_jRg&%2Mgu;4#c;8^%`Q1Jf)+CyH zgIpc>?)qlO*H#C+odVz06gS^O=oCPuu2nn-McuD%84fgSLkQVVM*VGsdqn}871urb zVb-?C?D|Sx@R$y02jeV~_hmDs^@c2?AjN*a5a1noEEc9Sjxq1bJ@9U6Q}*X z#dCg74*eQ}sq_6>LdN+z+c7@di8@lrOk!Fgds!tVLR&%FUn~6k8)C+G2+H=^+w&**+v>=}9@LTF>r^h4B-^o?PUy7z* zJw5S}Bp@J|PSCe+tu*U)oNd3>xZ5Xoh%Ses6qz+NKN@IhX$6B@3=R#onpfS9ecUqR zXuQ;yzPz~^idcCA?io(b^4a^qzH$3IEigHaC*8MbGM-K!uLd+VW!+%O%^hN4VoITM zTgMiM7^X*9T$cFEG!gXfRQy;*;zXf1zzw9h1hyKhx?!&@FF!Oj%{lFv+n)D*oC_}B zza%3}mq5%snEJpXn!u#t1(y=B(YCRYz(bJ~!@6;H#zU6C;eFrq3 zu>c0^5G*S#jhARV^J~s~*|y+xGu?UIzV;4Tc+1l6rGa6iY3cN}R!ye$Yd(nib9vDHBiD$2qzD4GEr)eOiJ3XbfgR5FH3mej*qY7e0=)x*8-JsUA* zC|?$vN27O^`&67>>h=<%W{Ka>Z?lA1!Clgvkp3v_gMj%)S^f2@vPN4?#&6ww%>3Jg zMA7coc8UwAHpvDco=Nv9Uyo()~K$W_o-p!{*M);q+d9%4T_e1zE#J zgFJ*g+Hue>-n?y;KMS%}zKinb)0V=Q?!lkI-hs?(6uwKEeKE4-Z6!)agz)BcO@l#=3Qhfh~F?-cI{2#F-bQFOWYTfDJ7c!Oa0e3!M zaQTkO-8YA&ce>8(d~1lshI?t_{R=!Sa}Mpm1YKKwhK?fTKI`B6c|V$0o;Zj@%Vv^; z?&5Lkw?z;X?xPx*EZjS$=vzSem;rY{SQ$y3hUb+P_p|e)9#|Gp(WODlq;mCl3j^lE z4dqxgo`;7qS5}B;Z2Z2$&yRJ0#E&$tD{eQHA|)m4EJ%~8Y?&~7C_iH3^ri2$baL9N zbQX!1m)F4Xupm;7&3iV>&y@Z$odejty3KxPpGB`l<$@)|q%U#{o|%f6B9CExjk|t3 zS2G*W>uafyiHZZn#Kgqz{k&zB9(A_=(4!GwMpl+zdMWeeqbuQi6ggwXsXg)DpT%gR zKu~B|a8j!C7s3MZ{RPsnHg0H>$S-oph{o_ZRvL40zYKA^q{U!nsr|jYa4SAEdy=Br zJ*Jc&-{(Dw=7oLtpHDaB>=|=2oP>v23Ns^)O!?yDp|FC-)=!CzS$%&zc7BCuZ~rKy zq!_n?Z3Dgwvt*)0&#h2hX}t939FM=x2@89?--Dg@W)L{$46bI=-MmS8 z&KS?`b)IFeV|cB7E{8{|qaZOpY?(|TIXXYCumr5{YsI|X&R6XBNl9ZNB5yB5ZtEH6 z^whaseNq2guU5>uc;mF{`YwynwpAhQea)4lyE?S$iU7y z>P;q+zvhlvHevSEj|U-yv{+aH4~^5FN&h=0*|}WXKqM9kQRsF%xytm`Oq*x^c!en* zJ3IS)=Hm!;BcqroTA`mSM2wPYae`)GSSePRQG(+w(=Tr2nm;$qD+xs2*Dh%R&MR36 zVugWfxy02x;M&O$dRscw&Hh|>|x zeO=0ED=u%kZd?E@9c0Obem3cNTXAvwzlmyAR^oec>wd=SmpGssF4eaZG??a|2Hyh(l%^Vgy?msApZ;m8nI5AL3vc>n~&v5ipZM;g)#Gkj3Qvf@lIkr?Xe z2rZiBseQ2-37&4RG;0~FYT5L2pMlZZgSbcb&%_`&YcY82bab22BnzsvcS7{#+}E*b zXnLfKK4S^HSbFSgN67=XXt}fhaj_!v&j2i?Uk;=)=XKq9oPlvLe;@45X6eW`e~l3H z%EkF-lmC4qwK3y?)c?Nxi5rCcvpCS7S53h`uH)}3WmmR-{L6#1AiA_L$kPkmV7EAq)Jqy44ZIAiCXRRrignYyN>930NKhN>x ze|Zj`WhGhJzvd6lH49o%`g?ukpEJc`VYSb_<^UT&Xu?sZk3W=%{@YAj=!}c#B`l)Q zx$J~k;Co*1Vy=KW_|j@)iQz-}yWG4ENO6$0rm09U5CiWOV$?ZTz~PngTsU1RtbOkD zC-uW$^{$5<+;!5o1AxV0CcY60|e$|+V)q7h$N9{89rM7;};}ua+QRAwy`PGmR+*ei4 zvHYhtL&w*LeVVhfE@>BQX}FzB6*l=b!X(+4M^22JX{X(Hrc#UJN>#8BF}^iP?Lp1L?cxWhU7 zNnKyR*i(YyCEe}pKSp+c%RLCX*i6U#5Y~M_t&7-XWXziH}7lTNLz9sPJ1+- zfvB_T(wu-0dvJDC!BMoS)8!48V$a>hnLe@2_D0X$@3z!ED@wBb;R5{pKeDRY;ve6Y zcZm~FH!P>*DRv&275HslU-_2ShiS4@Qj2{CTm zZIj3vNsKGTWB2<@gm$!3)>J6S?BvfxMUoXM2s}civ!0zF`|#;E`G|l=zjJ=``dfS@ zv6!5OP16@bb343T0!o@gLqp3bl(efWI*Bs~q$kaV1XU+ida(3LQWH8opSTxLsVPLzI9RyvBN%j_!UI)c>X#bNaE*wID0G7Ct-Fj4pxMZ`;hGl6W- zA7phwM!v841q5DBHTljN5Y)es8}93f8PUD2d{E16w*5^kzrq|kQ7akqyTLihG7u+{ z?^#N=Sq|P#sigHJ>tt;Ttc!C^o%qduO4|r_SDte)`Z;?N9_RF%5-DO=zc$4ntnusk zV+AH!s$HtkCD1O8hmmpdnvYL{ZCGEghwxS*lrMxWz3=*zr}JT%lf^41UO&C4v{a6V z>O*tI2kjF@h&c{{?yFZ^4Yr<*q&Sz=}(De!jx4p^6G|!b93{w z&+*9#DN(4ID#F$qeQ;nCSm1x;71m)=P+WY!Zq27>F}>Fu!ykDLd1+{A<&FuNR3w=< zDDf-AFvKrJbq|B)*BQR&8&sL3B1|WLi)4V#drPCdyVQ_`RwFdp&4mTS#d& z+kio<@Wrb#LQLvG=xH!*!|<%_tGHth3Ixkg2#iPx*5shd{Dkz9*W^Wz&Jk9n5J6<sT&p=lj$X}s7W=pB_^)4qmi*T<`&ojnVZ7c^s*nR$k$t#pX&Jt6zfm=^ zaQ8-ArLSb>Y5JHgMO0LjrKRPM=NV1z#iCvM7CMgT82(PbXoHFJjpjeGo2Q2fR53-RtwS)$Fvfwss0U zEY!TtmH3Q2X$6IP4_hCcy6=}*%us)kG23cisy&zb8DD!6ejTIT#dPJolb^`uq#!zxKZ*zEQ5MIQ8`~@F-ChNXVO0Lk!BUGPmUAy z6`{T6+9c;B_))*50j*k4-sR5eIW7EKdE=vc8#PT8Z=)?qvLVlRqRcji`*Bp)w zlLcjE2@6+ogFF?4q7r490$fC+e*S#glPSfB#RHxDXliR`S5`W;M>PQ!ve!zOG)nc@ z?!)7|#?^WPt51BSKn6u})v{*lSMD>V-B=@nnNUXgyL^M>ClxwI9c{#+kU%D$`{wt) zbTMAEPs~OqgEs*T2D`d}jHGWs5P1^=nxIe6V#7+UJy>2)w!_!+;ndIpgb?HIj8jT*pMRZemxo4 zZI-cl;*b(e+<*2QcQPLWgmH$Ek@(G#-nujx3}4uD=Pu;7HX0De5=BcbkAo?RJVDy8 zsioDr?nb*PN)XzHpJ*;JXVp}?46#$xqI`;WHu_H*F0#_zCV>r zzSP~V!2szWMw@5M69)3oqxzg2ob+@kT|^?rv?7U_72JH@Q9^ZXcu5%`OIV9v_HO3VrEq54F%7)pD3%K53^CpHAIc?HyK{}o)Ep~E|Jj>t)e81^$zoUG1=}koWaIjm$pQ7O zgm4J^=*vUZvl3hk4a0pTNab3Lq`WNo>n801ZSgY7o`g*kW57YSyi>K~>rN7V$q(|4 zw?+WrKezqEG{B4D33D8Pk;(a7qdQDmBdH(on0_bVcu_}!1)wMCBjn>C^hlVCE}K|W@#8KM>xmeSW{OJiJc$-r*U#@>E7O$NBI z#nF{*kNL{Bna?wAI&tna{BqDE zenCMRTsD&m-PV~8*`ZcV4-4y~K)$gU@^E6SSYq;x4-5;RuvtjokJlBS3e~D%WR!^r z5&~{7uFG<93~V)*rzD|mxAOs}R4Jq{nm*jf^`*Svt10@V;D;7I6*RSW4R8V}sVl0i znmmp)5gksb>W_Z4Npm57QzM&Ivtq}4caK1AB)K%IZD7Ee*Z>M6;2^Rvskb1q!QBBl z$PAv-IZ-v7i6O?uuWGdOimw5sD|5QC>B_HMCrRK=0g&e;hTh+|rXk;3eR6qc$n*(d zc3(ElsTV-5*Qx5ebYfDiVU#Pc29Z0tbp5E+)di)1bK!W5LEoEiIO5)?Gj}Sq% zlI>*uO{~wZtJ+6~yg7GzmSga;Yism22S0iVrVi1a42EjDxw@|Jq_-k5AGH;sg;9*BKC2+|sJ<+#4r{rXtt zJFHfrZS80O90)4i3vZ?1t7(xU>B^_jEM@Z#U*$Gd69A9>cq7@Fhgjh#I-oITP^8{y ziys`kYEEf)-0~jY)y9ffU~O!Ci^bAL+uS!=soE9?2dB;Jde!qLM8uJ5kx5O1$HP~^ zt9+dvS=!SMr@an;FjCT);T6Dbe`65M5m**nlmBzwt=r!vYme)gHqr!@aLWri51(1g zPCN2?L?LtejhDB#nwHkRAj8?}cMe8sP@-gh={a+8QxnpW-~Z~1w;6AOchbNJ8{57O z&BHDSYBC)gI4*G8>IkTZ@_1{qTq1ers*44JFb?$;WoRBIsAh?kn_k zmxJL4OQ+P6hs(Y?ic&AT$%I|aqyRg<^{l!v8?L){aa?~Rrjw<8_x2tb*k_Mz6Ar^h zDo})CVcCv;z7#>p4TNJ<@F0J5Cr-}U;L@(u&P9Z2Ce={ZFmLsCX;xP2m#mX)y)(0k z*PZlyy_yW&TD+6C?b+S2~`*a`_iqkwX9cUeo(^C z8kam|J@lf1#-I%q9@6~yu8EiU=GvMp$PoIM9uP)Hs41b0cvoU=1yfh5qp3IxGB@i+ z=AM)QNG3*NpDF`zK!<1NjZnYj2?vAsTE%Nx=r&)26YId)IF7|Dl}+o_8;TdROZ;E! zdw1N3J4Yy0I!^K>%|zqKFfiA_gfp>uUz&({cb#p|qM|H+7w}xSQ+pRLvyp|%w$5~5 zkU)Ywf+cxHU&m|@yY?B!A6dJ{$oHrnG-Vj77Y>+FP({4`$qA}J15DLK4#%LF0sk!_{`K)FvU97iB(is4d{n3J3}1eEs?ymprm2 zJr>w6yb{rhK8w^sruS6sLhwx*X2}HVmJ<(d{5r>nwxQ>Ob%`uTQZ_O#Pb3| z>gz=heI(nk)HO87eIzp{AS19=Ry;gY7V>87E)%L6w{-cH ze$6v}nxT2W(y}sn2M2ET!oklBA1(JjimD0il-{o(dcl?0_*&ch6coD8`pd}zo*0`ADN)3h4HeMcg6 zWu!Xear!+}>hq%f?RmEb3=B5rKkfAOm1jrL`Q@tVcb0pq;p?9+dX`Ub{kpocG;?qQ zQZM-MaGupwEd`?aoXq^^M|Og#%)Lo^nTcEmMNg!(*Q$fqV;@`o%1%zdv(%HE!&aVB z+fY?S4(b;t$UDg(F;WOU>b5og2&1k5+7?+evwP;fDe+6G!PT|3OP`!btV}Pv(ndJz zg53p!g3+rZAgTW$YF0ZQIu!nLo_!mUd9LYc2N(P_wmw>68tStGPyyG%fs^B-n_~3Z z%11GQEchJyy%b1b2u;%;7!@y31Mu7NXUcBcq ziJ2NV*ZBCjnSTi;7=Pizmw$T;qZ^eF+FNY{juvlTn2rb_n`@H|I=BQq*!m!~NQoHq zkr?77vRhwQ+dT|qQ8qM8jQ$yYt^EGAAlo~T-`=J zLC|gPkl|tNwp;IjreHD;wRhz8bP@l10lGrfp<6nWHop49!*^p2HwjsCeH5m!J~%K~ z8&D9|m|rgq+8!Jku^7d=k6n07N(vzOd)#dWFFB_K8Tx8+c7`!^?9XdQH0pO^!))*J z*jQe_jO|1tK$t4r{HEW(Zq2=I!acET1^5dYnV>xP;AK)4hFk2|vB!-K(yTXr9!WZ8 zDVW>YaRR{I3KcHx+HGF-vKva^6cOUg?puXqvXCCL0a@9~;V(;2`xSbnDId+*PTsc7 z0Dh(4Tjnlyr2I*#FzyZV!=b4U3pO8qx=#!wYBiQmjesHzDVjeOb7?N)t8)H>rQ7M* z6~(GS!PGg(DwNx=^83CjR@E<+Ib$BbzT@Ryyed5@pN-c%YBB!%Hwkn-SaGBjXq&bYI^P|^#GKKJW%c+0H z?xV&}wqd2s)Z60g5#?=>Ryseij!^pR9`jB3u)b(Ii2%IJY;30#B&w1 zdj2pxA3~uhWywVANiyP6j)R9hj#)y`*9+~~pTPm66`ihs$VPeXQoZ2T){6B|gM>#8 zSaoNM_e26#rrP61p)FnbZW8bMQ#wXrJ7JY+>FMW}3j?yS4r(kI-UV#7kgxKb72SW; zqUXa>eLh0&3M09Qev#iekh^cmYl4*cDmQ+rx9CGm&= zhQf_X1XOwc{>3BQe0NyFHyBh+W@KP~Uv&Aem0rFEDb7uXl4=Klswv$O)Ebad1#`j=R0CVuCJp z>q(cO&zC&a^~+0m!dSrgWYdi)MSMr%L)g!8T?hAJ&c9gZ6x*MI%f6@_75;J+XzyAX zl;Np`+!S{*f+=d5e4vn(>ZeAOwO{xMm3lf{w3-T|XF8KED62x7c4s<80^DMevgpn@ z#;%JF_aXj!MK#Oz!aAC_o6epnmD?M$dYu38Mc1uHb1!{*e*3Tcfme2SAU$9pIt$|H zL=+NBg`8w9DM`75g-+l|3x&XBM?T3PA%~}?z4f6WyMA$h5Ed2Ey3_t;>n-_?COjyO z`NY6r4pDrmi?Dn6OE15Fx&L||BAotlLDPbc6eWZKZTidpz9tTTA7TV1pt@tq_{Q2W7!07fv#Xt~oWzgkF5& zso?%YhPwY{||I}Dq1-fUo=gX7* z;P3uE5(9IeQOuvE0bGS0KbXkvU;TlL)nA&czc0m3y9PLBGoZML^!D1ll=$!Y6#E#B z*Wbtg7HSaw!|G#9r@;1)z~P@W%`lYczsJ8a4d~CL|KHRhe@_1Y7Ki+=d%h4vUin*c z!7daoi;V?Ji3;OZ>-xrAIr;$HS(2vlL3kO0CXmC0BZ91_;~BLO}W8oAjRz)*Rw#+MQLg2 zoWTv65PFDn)Uh73BbqRHXo%nw@RHMq-M%5j>|h=Q7bw~|IPjz z%3|36X+YZ-%I5BR!9aFMjXoM49%iD6iaz#Xi34#7jOG(!Wt;2iBhaS+GJX*uvp6jo z864@X0S`(XEC^FQ>FbN-og6*(D<4^<-+mn_uRKUz5AyM@x%Yk-R#sNAnaSyG?Yz3D zh3FS04mlVJ#$M+xP+uG+!$r!ovTo|YLtq?gENIueQ^#!PXZQvN z29-jhN|K;~2LRaT=)JwjV^=4>WDcq=kZ&fQqK{s=0;H(qc@=KI_^u+dS-@ua20h)y zdcXtSsxwwYkEK1TL_d$Fxg^jDKvfUA%C(H-#nw1J{xvoxf|4i*xleNSBS5=BPZt)~S|`)H zPfKVoLYzCtXSZXa$3G63e{Bv$$me*jW=j?bWkmT~Cl5L$4Z#u;64Y$?T^c5xE@-)` zT?YDI+b4c6hYAk z4_^A4E&qcrhyHJbIr$G&htER~0pl__aqDeMKpii4t*91|uK)=WWD06R_*CyJK9NhY z+XI7xZ@^!5n{;9Ds*HYtLByXauN}Oe%i3<_MAv4G!K)?WIYONe6nU1Vs2; zbW+S{WzxHsv(enXD(Fh0~4E_bU*Y7}$ zv3)ofL)?(>4ytEc{(_>S_nQhiYJgh(n$AHHA#M)d0NvJCgT1Az)e!GzAlm{Mbsixr zWg8e8kg8dbB=wmX8ymm6MBYH(d~vqPdrjHG^eO$N?2Tp&XC4wkdha+y@pa#x7i@m@t^1d`v0%G z(DNmBbscM#aLoIJeq{Pb;Uk_6XMMp%38emggr&=*Mf=BE4tr=yeUx0vVHp(-2iI1Q z7fq2&Sdx`o8`&lErK#y@Rc+U+{>gc&ML z%lt1={4MoQ!uhGcNb%3fEIR*)3H~O?y(B?L=syJc>!z8mV>AaU>^C{(5Bg|Ez})X1 zy?dHF?}P51YV>qgbA47~<7%+%eO`oCPKWZBvlamxzu9A6g#kQ3?bx@o2h$&du%H~d=0Ha?1^fQG8f(v zBB9jj7m>r&q>0_}52RejvR`ET6)#Xne9-j*x&i?Kft~6O6JEkRJq`-!6<>1WF3>K4 z35F1=GS$6!j1gP}0WCm2+zNo5Kr_ZIoC!K80cy~;TjD1w5OzJOJXDthK#BE%-F=<5 zNFXQLAU-|=hW^x<03&}{7lhMEcxfgGF~rO*!*hThrC@PXk3F@QnfB36l;iG^kH_hD z=Orw_bV57O!|{hSQSzi$FTcXk^7WPYHnSC0yZKl#_5Z0%d(A#HPjU6~yofkWl(l>w zMlt7{cC%B6_pLhprT2==gkqe_v>yVp;OW41N3Vf0m`|ti_e*IB#KpIg;FJ29n z2C#b<^%bBE<{J+>_pf82QNFtG=0&@QYGUPV64;MrRsK+cFS^ zd<2jhnS$gal|?%LEdPT&w#>w-2E&z?$eN`uK8z2QKfmy}7|h4=Puzgvx^pJK9U+34 zq-=mH6!Ql2A*P+R#=<1e_Uj-f`hHLVJ&ll-*3Aj~+L_P&j>3_7dCVY^0yB|iBE|YD z6By-H9o+VE?7kpK!D?!T9g`fHVh0Fr1I|d_iJ)>%PcPg&ig%~0F%GP z@H9Cvu4F*bHUz3I4wJJIi}d?Dvs ziNAMVta?x!Kn%+ia=zzBbb&>my8lxn?4#f32szYdbe_LvLFHgHXE8p?dbBS>pw6$7(z{XR~h;-6G1|rLH{y_iS7iW~=P zquHw7=ayNu>-9XPBXLRLGd3^2rLFTq6}X<7F#2Gwq z=i)lZ^2otjKr)$<0YfbT5r=a{2@$!QFr5e{u1OazkYBoWb|ueG_zP>|tw8-*q3{J7 zgS&52nR%lCb_g~H@TU?aLr#=&Mh!r~x0J2lqj43NdvE78=q#0hhI$L8ia`?EYpQG6 zAS5Johl(J(q5|$%_lkq!zHplQ9#1bNt5&TV2L)n+1PlrM;{$8^<6xglvC(0Z!P`aQ2@nm1Puo^R9pdcF4#GO-WXMml=4Dx|FP4x zBm47+e|FPH2HK%pR=l#tGCj~;2~&lqgKFFQMSlrNGEl9?JQlPCgb&P@@TaBAy?uX{ zz>QrpI1?UcVM2n!?VG#44U=3WbAW)qjtc?zD2|6cz@Nb!_e7Q{7P^+qjWnq+{vJu4 z#A}KRx<{^J>DD=B`8a%fgfhKn4V_tZe`5+ZlOlPM+b-1znR}BAo zdQ!IQu;xXtk*C;NJLs&&9_-CTnnq364wR4}HLAH1^pHLHqQ;7xZ)qw6zq-i+0lrtd^NmgYbw!uiX5Zn8((1U4oj@ z%bl68S;mLpKPJ#4CT4IfE+P+9e2bnqFnI;XeU*T`_l;MFOTpgn|4X$E3@aoF_lvKo_+JpoI^Ox;925kpDNd5f zlF05gk}vd7lCXzd{Ru2Q8>AAruy&i&D< zsQX0ZV}KR}PUd&`QkF?ZqJq&IttEcysJrXwcwoOa@s(Vo|6ti~t)g>ad^}=$V^SB0 zHs&Ec-7_=LXY+A>0n=_~Wa!((F?GreG`yaE8I)dID)K-(?!0d8LRica9RS23dmhNK zvG7-X*8tTuHL?39lszIs-LRD5 z?FhQ&0Bj*)S`!JlCAfB4oG_Vr(mA!JT?%(LLiCasGaDdN0FdWXbD&~ z7g+~R>>dJi`vMZYp`bBaewY7x%Zna7x`fI}0Dxe~BX$A_GTba%u5e%yPXbN2VX=Nsc24B%-~Nk%j1pC0Rn6|3|Fx-CA+!HjIXzI(r< z#S-QVed77|;%n;deEDfC%sp=fx~5>A)jF>hDaGJFgal+58*T;4zFsJfAF?tG8`4Rc z7GLO)zS9~F zl2F$&?^uR>eUPiW;1dePx9(2OsZXL?i5+ttNRVzz(DRT6;}aaQJq&CZ=G2swJpte8 zbOG$WF2ZsL#P-EsNixZG)QTNIQ|b>SbHi%zc|~>>l2rhSIM3Td0|0=WDr}){Ebb7+ zts6_&T^%$`XwnT9xn)5wZlFSdRf)Kc2Q1BNn#Xy~YahijsFbOVu1xG5OlG2&{ZfWp zc#Xy{SnsQyt-+v$+Pc-~p~$|Ww$1T->?GfeYF}JlchrXgRQdzY#Eucc*!Yn8*Q1F^ zd`NHos3 zzXsUpWU?|n-S8XcEt6;Wu6J3@Z7y9&T5WnFl|O#ho+VCZHcbAk_2yO_~b*+;02m_!vZdG=w~Azi~+Rlzb{e$|3@`|xS)YR1-K zxqOEPltsWY(2l6w?rm`lFK@_NXMgAx|b12P9wIv)?OtNeg_pPQgVR)^ap%5>f*8?$cc8*Mvi5sDnNV;UY}5{* zWquwaPo4w$b%9r&hrD;$4QAKuRjRsFs`&QqX~85$TcDkpgHLE@6VAg^Va;2DVk z8I}@Cl6$venlcf^bgP9PCV{O}U^Myd7kYeVM@C2U2Knw+3b+eiEv)0?ej!$T-r*#Af;j;p6ox^=)Wy)5(+ixL9#otBkZ2I$Sj4m$0hneK#1W%r0W#Gl2TH_ zJ4<^0*UUkkD&cK5L$E&H1xEx3{PM_z6)F60<=k|&eZyrm0b*K8bKh~Sr6`>bb>tL? z1-0|H^O6$kkOEM##5)|EWIVeruZJ{!|j>zAkh!1x2!dM`C4rb~yHi*Vk8KL9d0-13u? z?{VjXJ&mv9phG+=Rwn)1ei|V$48($8tz0iDr zxQi6V8*;IpW^8%tkS=gS&cf#@U_L=tsoYC*bEQQCWHrTfM!=gPP&Xl*k^{>S>?^Nz z{*>?gp~4BPu&~tk2duDDYrp6Hzl-?D-zq*C3+N|r7Jn=|#H{E722yHYJC*Qs7PmJN zO@Z)^75M|e@ciR#rm;?({>}D#xqOg`=InY```h9x1$gw31?BwFuX)hiTw7cFF7kPg zQHUi4q2aLfjqJJrp_TG`X=I%R!-WpZPgPl%QFz<5M+x2p7}+Yw)bMHz<5=BPkdTxM z$^n{k}0ubm2sACc)eRHKQ4?baNR%+*;_sqTKU;(YFszjP8gtz{+{d&t6aVdHcz4=J0_a<~01?8|m}wdNo+DNSe-e+suN^YrOS z4Y!i7IGttwO=cv?@Vk-roOYJ|uP+<8__w_JwX z=Agf`KHl2*ek-^pT3fcwhkA2nW}$j=IN@`)78-*K7fXoYf>|9T%j(^xKzVFdA(5LdHb|o;zs=UGnN6BEx_k0%2k-i@E@`@a zwz97p(b~aa=~Cz>L)|mhlh|Z9RLEB+;^bRWw^q&U7i1egykue(W?nv#Px00r%jY27a}kyf=>non(|G)2Gi?k2JCU5)-XKYMFZ$hHQ|ja!&1lB;yPG7p zbi$R_{~{lJ7+RdUH9a#g2ClaFI(m4!-qI#S@$W27sk(KxOn))wKJan3Q75oq=|M4 zN}wJ#@1AC(|NisCjxD3Y=Jm84fB{BYHyjG+|7IU-F}q{_4xxb1mg)vzb9ltAwFQhh zCPa<8{QXjAz~qDf03V|H{*iRyjQj(Oh~~SZ7hJ>HZU3*-2#D1o{`bMaA#MJhobmhc zcr5<`S^U4h_^@3GxUH>Cvr>C#A-q&)pzSk4RhfjC1?Nq|tuD9+Cg*SPY*hRAJs+a;u976bLCjK1j%2@zm+ zlpfjE2eUflA&`}NdQf%Ee>_5HFW!dzX8y5<7>L&wz5?aFacZJIFJ@U9^ry{qqomX2 zO!631u{bp&qvRkl4upFpW~`X@G&OdB=IIhTAWiKma`9Y%tC~(sPg%my_k-0hCKUZp zj0eBvR31$`>#>K@(qVkYZCX@JyTRZ?x*+xgbB9V;*uff;f?D>`)uEoHy_>Lp%SRgUa=wFe8vS%Xe)XM;z}?Jl$#%GD6(*PRG@>^0Kp zAP}H{zKC&;;eigD`-!G0vuiR3J^mA!S0K4TUY;}WmS4*hDJkh~b@kztSSz8p?_@&H z6a0I25+0xNM8O*10-IUdW>WjST{O0v-#SnzmX@;)f*9b1jf;y@B)^e3coj}{$b&Cq zC6K`L;F=fcDR9WYHk~0%6xjyX63J2|03P4zgNP=#*QZ*hPw!tGx?#k{!I2o150oyp z3?Qndf@EA7@vg(e1LF z_$XB&BPR#E7?j-t;r)x@EzjT?u5b*I4LtoUp0`ozWfpOvv%1+T`4V&?1+gtt>r#s5 zh(W#xX8Kz5s_6T9lW#6i<7xylD9w({?d|nTA?Ne^anrk*PCqv_*n#XHUG$<1elQ6; zv;DO`J>Qn8=v%~yR=#6bWGacT_@k#m{1fs1jPbLTPQs$OhpAEP7We4n(k{Hdi-qwH zl$tS+Ij5*Yc!+@gNm)4zwT``T7CG~#rM~szxwAZrEZ-u`pG(iPqea+J;l2C@0?5iD z+CP26o}V&p5xj7}4*XD6wfN{-1zDBDve(!ud!Y452A6iAVF>#DjsB9RDZ)Xr_Bg1hebktnU~qbI`dYtiZ4kaJ-o$Hd zOi~vTig;4N!>4ki?C-J18!#PRpb>JgzZ)!mzYxxKQ|Nd&RA432>KwHZ9UzQJx)nI-CPFkaXXJ>~A zH&6Br6s$l4)>?{z`5AH)Li0ffFfJ%=LLT`34HNW1mStp{S_GqlDk)a9xK#xyI++1q z#}}1`R>USICX%M{2np%0__rpe4c_7q7S1`JbY{o_juOa$SKwPSuDjytk{nd^;F^NX z4?!?MdMyJD1kf3zDKgD(a)a0Yfx}ync=7P@pBovS1Fs1}=@{hz9tQK*uw(u0`TNn? zdG(Yq7XJXWQvo^+$~IwYLY+cVFeSEVN=B;dZ2iNF?rUS9h z`ObR{g-qHBPV*cWZNCg+cq+>cVn0NYKncm=O4e4~PSVM~o0ej2hT;ukX3{Sg;Yr~u zj-bhiBbjs}_*%4OdQ%N?7oZUOn*Me5)QLQ^adl!nhOKFoJ#5Nz)_W~i7pWhWZY$Wu zopxFp+jOEpS&^R#A0;@MbaTBlu8;S0Tx$z86pi&@Qr5JoeZJqCknk>{Fw6Vt&P$xp zW-OXIlq=uOMn&!Fv!~J24X$aXb_lr;S6!2~P+Q^JQBkYu4RSs-f%vEg>?>Dp5XH|FUZ5b8h1FBs_*Qkzs|FiszEZIcM-d@On@S-eBCXiy?D-!I#9osuBA zs!DxR!2K|L8tV*(fM!nilb9@hH7vWW;kPcA3faFQ)+fXCr!OD;2`b!wNHiM%D*AiXAR;;3+wZ&rLw#={=i># z2Y6T-8*@qp!^{X(8~xck%;9(GLf&uBk3)PcOmXO}@aeWlOjHEBcF=2F5}k=puZd*Z zY}Upbyn=`lI=nU57|Xb=CEq<*OmwLC=`bu-1AwG`R|TAE(ZR7Z*uSfaJDf<|W85Ug zhf9kKnru+r0v~KN#$Ab7YZDj7b;F)J^j+&2aV@Fw+N!;Z>|in%B7s`Xok{}U?chBk z$8Dfg0PghCbx>4PY@ia8Xkp+)J=ct766>ulhMZ?R`$C`OS=0U5 zsqEea(zx=aGpr{>>86Q;Lt-c$};lq6A#F=E5R6VD{=H_3{5BBwbO1!w=`K@9_O5 z9_zb3kT*fb3nuM}btfK1Nyr_0lN<|yU&0NK(z`)^fc!@V$e4&0jzi}Hp`u9}IH(O4 zabnw~B0SAju_&z6Z%3|bAK4(tO>hB-F0StNKcOLi+S_&?z4RucOB^ns-z1fFcz zW-2}67Bq)*4eqpP+JyJiffBf-oF&rR`k?ML;^alii^YJgROsR76Q(pkSL>(Nfnia$ zU{NL%!~8gW7A1ZA$w(eE!pzK*tdzS`0~LLN1-UTB1zRxU!9$9S^il#%o91N`tMq}= zGXWO#CZkgJV)Fg>+{R2KLu+$jLT}e(Oma)s&5;*Un=agP5{68-o20x#YQtHBqIokA z9MX;DNSI-sCFTIOJBk@s2Ghy1J7IS72<3ShDliW)7!4ku041`G;p@ z>#xoI3xY$+DYItSb(&UPa^!=F+tM03=ou$HmR}=&=PvnzOjMmHC;Muvg1_Cu zx^L`?rnYu|MK4Fl1JY5!p^=eXwfM1BNdyr?+eGW7QWZA5IAhvPv?wkmQ?^SW<TQT?9BD*!JOJSz6|ARzp;h{G4zc@EXDsSn2g)ziLBv;~V zlskeRh@VFnu4$N8!9=ST4=H$Ozro_`sJ7iAs$X&OrcL&lWX5I_A&~RhjZBg^0{av- z(>2)A&wI?+2!P^27K{AQ{*~d$?cFGU@kfctse(lddukv$FUkyGJ*NFPpjRCV#FZV_eoW;?L&Z8ON9IbIimmzFtwftOpG$-zX|93>W zu%o23^lJ}hu{1cr&;gvVhnfhHq{cuAZ+xMLA^p?(gRFUy!y~_C8T_o-O=sym$L*`( zzT!!=(g7}Iow4Dqma-ao+_U^|2NJ+^hC_E6&Ga3KW6*X=cV*QFk6p)+g>kkh%v zo#Vsx*X&1Ac*<@Yur7MOi>!>Kz2w_+6QzM79{wtMw-|SQ&Zb1{y{E0Sn{PVEe>e^W zr^hoF*7;0R<}ej%34hU@9R=ft^{)-|LPYxa3RcHvKbr>yl3 zJPDfwi8&-ee6=u?i{tdDb9b$NbLeO?r3C7^W~0?)uz86u`n}uMyMs@F^YV`L5Ao{! z(JM=v`(WF?V6nRj33&XJeF0W~5bDB)=uKJlnI8eF#K^)8we@|VD3w%H8YisAL2TM6 zA+rz5Lk4}!ledLDj>`2dK=Rbs$nD>E8@18Wm{|Z;4V)6n)uHQ zHj@RyZLhnrOa3zF*WDrf93nazzvGA``=2ii%*bTz`A(c{-eD%vbWWF3@cvn`-cDu% z!rO|Nh6nzp**lh|rYv8AGZ@d5HgyHS2DI@OqVRHI;Z|ygX?7_hnvf82RIorrF}Z?g zuRg!HSd51q)j3PAe0g{m-2QqT(r4X!`(cAJ%6yZJJlAW?gksq2mb9F5T`s9RVgPb` zLga9e$1uA?jzT{PhiG%q>?f6g6e9Yk?GovM_Uc&QcCE8%^+XdS8A3aA##C2S`6Cf{ zT7Vh#OFztMZw_^s!@E*ujF^i-3vIvN;kp9hok@ZoPtd<%9>KM?z4&sg;bd%S`) zWHP8ge4!79&#`I>+HS`)J5*5tpl372=3sF%zEe?CGZzsc>`u=HRwr@7GNzK1`&LZ5 z)y23nC7~M}RcppQ`yuzk zUF>FL*W&3LQxy%Ls(j7nkg+T1Om=S?4^k+6z5n+>&!#s5bx+DSvF;)f$#Z~fZ9iTA zDsTCmMC1^?rXlH`)O(2NFt7#vwBUpAI;c%BO7g?(2gacep7AFEy$AD_R6Hi^$-{?% zsv>)Bus2RhN*dRD>W1VIClN?6=1WXpFc?eFf)tvJ$FS4{d2!~9#`L<=kM3?ojx6ce z6r7h0?`%o3%EaE>y$ZXqw&?}QeF}3|iA6QIjJ36*6(WA)=|jFcrTFi$|bfRE=*nX`Xou)g}u(%|eCjqOuFVF|pGpB)=aVQrhyudK)knSFMC5gk0jEL&2m zDAAsdWXlj4M+6Ag27bNRFk{5SEEFz2l&O%Rzp%-d{rQVoX9YN%eu#1Wy?|jd)EJ2vWyWDww9$785BsUlzP^Og(3;>!tfG&Q zV9$=i?ji8S6(e(HV^GA9mekkRpN{oF-r78*e1dv`IWhw3H*uf4I~7~y9GzaJR=>2r4CqfddVOu zEvyK4Vj6a#z(AUyq?74Y8B+=NUBgR+#qo*vSfM^D&SV8;6OfUDSFhVxz9oK6vxXl4SiCD^;} zI}=fb>wffr4Nv@!N<@PVww9E_PIB?We)4T}Yw9^iQ1WcAe0}#S*|$sxN7U7&hrPGH zCfxQ9Nw#4l7gPXEv|z0XEomY#pd_KpgJhf>DoSqn5?LhIhma?B<5a_U6q@$4!S!hz zPpA|jg{ac7wxy+|o}8EDtdR0^>l>jZv8r5uHv()hZGvh)yeG)SgDVH-DAHrC9wqXu z!jA|ONuS9A{%zMzTDGhnf-F^51OB^mIj*Lr*~W0YS)!)S)& zThJ37(d{Z8q2?@-TAinmBW8>vdxN-ZsUN_DXmc03VdiJG!F)VC&-(K;ZBo(>^-u_?qu^kTiCx{IM$`p9k}rH(FLyT4$L3F2Fnft zo~UE|_&JiKu-l@LKnD3UeNyC;)h?1}@Jnbv1eVy+%%~H_th9$533?!fNpmUb@IV6f9 z-zw4e=?HeI#fV>XvjmyAa`(k~MeNKv#RHs)(y}s&m6y;u1%Z@<{xDr0OBEFo2xQFh zZa3&Q8=J~arxjcc%nO0}41$!wKms9zH8$6y+tH-jwJ@>%GR-!xiEB9gD`l6&I<>5^l z$DA6(>082w)|TJ@L zFfp_8sCb_&t2*M9y|M2GrRleXaz&M>-uxH{-(Yk#IXHWj6feT=4hyjQ&Q0g+l0)^v zVf_#gr2M2#G8tDQvJFj0BXIhk!Z2lIjS z&E(P$r-Jl>pr*qq{M#f`5RFIR%}XB)cO*pjw}?!pr=~&&BKM*bk2*x#R-<5O_eCdx zCrksm>SZPi^a`~p3QX-8xeDFnmm#$1x@5wc!pXXM;I$}pDs^Yi$!HDgq8YkUb@(7@xrg@2O|FM$*Vlv+1|C>N@5A} z>F;XIl3j>hsk^1r3w4^p(h?JGyT5!nS9>_JItiv*31`H4Ka4dQFVcPfoA`yjp47;3 zm)(KTAj6X>QiAHO1@SA=;3=@xz4bKiYMV9g^5F;MR$Vj`Krcbk-?b60>5 zE5BdeX3c|3R8oBQN=R~9SZ5(!c&|oB|6_6SZWhp+U>CW$@%=?q{id5BiTkY3Sc7@l z$Qwx-cZ9fX)MYV@RreEpO}=A(^UGlivd!5Y(SD(s#9i)A*Mf=4ULQMQ|KT#Sv7M_k z6}pF0dk$t}?-x@K<_RIx)$OFskwOMBaz)*2Uu4i%(+wFp<&cnx<;m&4a_S;nzI>(J z4e?$Ri79A)E;+bCk(O&AE?x{hrM$ry+`o7e*)N@&e-;j!vk?~n6WJ+Me}E7J4GVtz z#ks|Qx`Wo??0$PT7P=K(PB__0x8Ckmksah>xLMPxdM11Dm{8V8P1`Oi;frOt1uwjF ztlWNTrMr3$&z@+w$NR5|sm^f|A7gHnujw%OW3tznkmoSc36i`Ykq}UXcS1JytM$KY z(IpjjrJr)PacA+x2%d$we~T#T*#X-@vns8t(H4qiYuGc-WL6vcZ89oz{!l+!#FbDH z`zS)2-eFi~>7SJ9Ohr9JedAnZzV(20%T9}7h5-nbicAWG-dL3YXBb7sZ06FA*gGXvE7WleQj-0uEJjX~uDQ@W!q z970kV^}|6HYj`o|cq!aQ0Df!J2t%H%<6IR%sr2l&qObZ#It;jm+mG5^3C(HTxytA8 zoZy;R)^y1$?8ARO4U=|>Kl-Zjp=?I})|Y*J46+3fvMmoA%L}HILq{*^-kOJ5==FZp zzoG7d`88tf#eH2Z)S7dCSI)4Q@J@j7{%?u*_kXy}Ww2}NsD{1a5=6_l@R?gp zypAL!`)*k`L$Ps6cY{rWqs;7Sa81Xyi9)IdO}X|7vQ`p%^vyF;t7+U+;Ap?gUwZMD z&1A~V=7P_XcPY-=j!-&JH@z&f6xy(OeLCUCFM5^PZX$aH%mq_Q2jL1neg4y-4lQ3^ zf~vHed4xZMH=6tln(C-K>VD)u#I^0!&igbv>!LqWw%4!w>vJoom|NJt&a07Ndut*e z#{ox6_KD5q7sVKw+45fw!l;8}*>U9DU@rggo}N)g=ixr1)GUG=#wkYkw@7-tgm*xp zklHOBB~9hbOn<=zVW(3f)u{rKl*^pSgc-rH{AzD!H7+h@v#Cp4(utx+3ELqJwW|d7 zr~H~M?3ek|etrLj8;lsF_wGcHARDq6^&E~RQIABsAz+Pw8#^I)*5me`Qd$&%vq{QJ-h{Lcq& zjn37OJC4{OA_vF`IRO5v{+b z1doH4IC?R;a1QqJ5mylyMETCzq{2II^rPTf!MV;esx?PKg55eCPb}MwEbXJ#^GMK_ zAfejmgIUK`{qvt&DyC6G|L!R=^U4~h<}~4Sk%j-L?PvL!(Rw4)9uab2?RK2qA0#yA zKAx(w4$~ZbYqzuL>2wwEe)j6XNjXDssj35W?Y&x(c_#;rZ6@?7yRczg<%TdKr}?!s z^G>C6a|?{SX>dQYM-QDPbx$;OIBmpgy9m!9W|&iZpkp3wb=by#T*IeiY=>P@>uzfm z$Y79ZepZwfmPZ^-Ls7?=f|~@LAY*v!OEEQrqgq!DZ~lLs;bb_&hn01MZ*HD!6Xn%& zw~iv`BmdoVNc^nSGvHA=?QS^#2bS_;^EbTmugM@(|0lXth(YLyO7M5P%YWZ?M&vyj z6`yPbAw`&nomgn#?=+Fl3eSIa7J;ud8XX57C7R})e)DS8eh#Ab*TE&(o|i;7W%}#m ze-JePB0b;>{(pQC`G5Gih0oGhZvS~2c*bCfgt`sTrQc;1D*z5jzS#n346a*Zpjc55 zn3q-(1YgQM%_z2i9!)?nu_XK*K$7&(VYOx#JT@09G!O!i{#8F3$u|fy%Eo`rR7`){ zF^hI4(VXtJbZdA10i*(Kx07>o&C{~)PC?uP^gp_xEksEGJvNxswP-KC0GQyX7N|mi zmJ~wMKS=Op%JwG%bOg4Udv3MX?phy>A&yet@X575?m!%+ib}szwjfJDK*0Eq56Hdi z?Nuhd%wds{vetoqXpQ+m+U$h=mPTQ@)sXoZjYM~JYWYHkL6XH;)Y$%aM|9K43AC96 z+EfZ&Z$o$0F}kwhg3fq__>ZXhtT6G|E$9L5Tf>?YLlC|fIVqqBAcMT=Ryx?PjO_yiBE>+j4G!GKF+K28GM(m^hM#O2EM^e)MNwhi`*4vf>RZkQR)C4FLf2ZTO9sMVpj`)+XQ&<*)9j@N-SvaL^{MD(P(Uaw zLLoOcdLIo!i4vbf&i-<|;RVfU{|VMuFwOFy4Xq!5D?!5{E$KS+l;{fMzrmV|#6#ql@ zc63n57;A{sF*dS#@cEmPRm2T;_Jj@OyOQXacRpY4y1EKM^HBK16@^C^@~DNz}u`NlfVfC+|N3NYP>`K440PG}C5W!S(Ao-9!%ic7F&Fz0 z6@mABWwQ=vMJ-)@o+W10hy|kB3?*Zbxc&3G?TF}Wn#LfCA5GLi10Zz49}U%@KLbI` z@EOPu2y`X`3ARWv5&DbNf?@?yB9o9V7!@dKBs{0q`C&g{rtV%30l*Cq-~xZ36-ixP zf@h8ZBup3!CT@Q|VTO$RL8dbSC$+xI$en5$7-GRK`01J5SoSeCf^jy{9)qCoa*v5G z8bg*nbUlPL{I;ny*zOrGTwO@$nB|@J7lis$`+?sraD}3~&UnD&CB^U(>KuRy2n6@K zv}@Ch$H>mE+wBma9JKZqPWWD}UNc4ATh(bKx@V}3`}Gj3n}htp6{Pzl^)$@w^hb>EQqASe6o^ZCb+`0_2G-2jRvya`15XKsL@<9{PIkpGHo9A*7a zWMkM#SZhtwe|oXbvhXiv+js<<$-~FM{#Yk#FmMYSjy^Nge-Ru2aOj-=G5m69f`q^uW~3A{T0J}J^wD{`lYr7E)`ng~ z&Ke8*ub+r)Lz4c|XP8v5=p%cpXg?>EXLlGN#bB)=`N`DX)1&lbKkC7?3oB`VV4@sW zM*~6O|M>AEF{^gKT``iQli>6a!6Rzwx_O1A^##rAF0!OeU>63;b@;}pDf!YLto5k++1UA9k;*{ z>E;sNZhE|yKYyv(uu>wukbYDBsHB(@w}YKKZn2?%w27DH`?CCK_iI=^C2?LPQJajI zh5{c1A}KoggmCLb^ItVFH}4G~heidk28j+$29>W7w-!9VvIQ`m!lD5lz!32<6EVHA zVj+!^4tPdNSiFt-eTMi-cObHWTW=K|U(P#hM4aKGUQ)SYa7X?Lgy_#qs-)P-w{hz1 z9AhNY|M=|d4r?femdr;#{o-ZPA@&$uUq&T2T<3iTPXgde&>+{%t$Dj4E}SHn2AI)! z%~Rv&W}#RhBQYG`>2lyE+P)Ji#Q=cs^y`A5w8;-5299?SG?Y}z+;@UDY=U%hugCrN zF9|&CmoUe^O?aHD5RJP%QsoE_PE#*89Ty(*n*+@~w|XO|9jfqcJEH$9QGG50)sQfQ7vIwH|i9kt+* zl;^z%b_oV|HAp~%Q76pcH}+#NJ`Gx?0kMomoK&F!8tNGYZ9zuBRbZg_CqA;G<@-5)7}tOn z+6WQNqUa(E531-y*@KoBe)CTILOkh9!`?+jT>Fp)KR1kSS3vV+$~NJU@)siO!GIR< zOtG1TD#U*{I5`az6+gB_Qy<@X?1ey5iZ+G8X5`fW7?uz~1>B4THXRy;@XUI$MP@&v zt#?|;1bZ)U9RC8BI8K*pcZlz_ufyd<#S6z9{=JCk{+!pQ)#9w!H}jgMGdbmRZf+$9 zjnCGKa0~WiU+~EysCwtU%FU!=fdbxc(fT?n=T$QSenLde+4K3np_nerrAxZ>h_HJ4 z#-{b1LF1#ZdLMVuFkgCvhSA!%l#xW1P^9)Z9HTSnu2Z$^ftKTt_@h|*yTRcjVh|yG z7`MeAAnHYfM(oGu3c>8!p8Ez?DpthOAm$q&&K`9%pdo^!!gVeZhH#S%JUOaw(MbqI z2U_u}*TIZ$bvNq-5LQSG3)@ny+Oh0ldd471O2T8zAQ@-7$Hjm6n`bAHE>c1Tivk0l z68U|J#mqcKz)sGJ*;Y`(Ivd^iT3yt^*cH>CnR6F`FFYdK#5|Za&A}& zSpt%RMeuIa1>aj&>Js2~0Va>py)nZvZu+^41LcsGanYS`vi>)eutD~G~-n5#0jAQ=TQJVrMg)r-C5P+QhPfj zZswR|d(X}c)+t_LYH%LXoPQA3UyR$b)na(rG2%#LWB7d>;tu$28N3fyDDW*>Y7d?q zO_I=9Nd8HMApa*8V)Gjd`9Gs$IX6jZ6T#$;VBqjwjJ zEuRLEit#~4#UwB?cPuSe!+tkAq{B6_;wQy3VN-2_%p9hK4xHc?MXM?VWF=7BW^`nK zr2_i&CfNdIB*E$@W*?Tb=LSqv7LuI}GockQZ~H?5f{*&mK9_bLP>Ff`mqi+>z{X*Z7MF}VdD$Y zYz43}e7=>GRwO5+7*HxwyiH6W&@@MU=}1X3`~9@n6HG%B5&sed*oHfZhq%b4f}0Mw zAl~tr(eq~HStuT;ANB5Z%x-quWLLYiyeSvDH=+yyhCFv>6y_DVGyIlaVY|fTblt0V z!4$#=EW@vm1S&UJmIMM*&2S@oOgW%dtQdY?N1M51-7<-ga^@l~DUEK6?F5TNm+yGI z8m)ECZ#fZQBBcA--G2ZfPn4BS6lCVgaMquxtsfeHtntN>^}AGR0QZd)W(Q;{ZPH4@ zhWN5uq{RFK2A~L%5|al_Tv=dKOW~m9|00{LII*t0@d2ebdWXmPymWqkz5#kCqhln{ zKojbPB(<}6Enf)Fy@MWx1tgANr>dLAw0Fw?;O$p&I{CHX^t6HKwxQkC7BoXtdfjZG z+r1gGmlb&e)_~|Lr2cclo@U7-{U-s@%uTFu;g{@b z6#=vjCk&t>BWr*j)xLogd{^Qep_z60=64}ZE-o(T%Rt@Zyg9MDRnwZ5nsGF6Mqt0@ z^r+tI?5^G(O!oz*ja*~}9{(4f=@VK-_u}TCeTj@}9}e|fLG1|kn%Xh{fqakWqJ7z&R>$q>;Hv)96ylk^yD4oxsL#kgSAbP@4xIisiV3KO|vLB zJ{XydG&xv=Q{OSy%^rT;jvmdUuzBlxm(jAI)52`;jxmL%PQzWUEyLO z(%(Ok2Kd3D7G+g) zUu?GB9%z=jxRF|lJV8J5T_ATCo~mX<#haZvvly^Y`+&%0%)P*J7npQ&D;<3T%UG*^ zO~>agK~!J?i$H*Csz)QSsf$I1<6&G~hxDpiwWw3uaXy+_(ZEPshUCH)Decmz%^!Vo zS23s1=7JIyw$CH|Y!p=cB49E3s#0q>PCUxqIB0iswgB1;OBwH@E3Sc|{7hUFaS(X? zNQsJx!OIU0Z|m-pnv7n6D7sU^FFHr{5)H0%Jrx6#9ldNH71;iz81R(sx>&}!oOzmN zCbplzcsv%3>I2YzL$7P@+7N4c*`w3r%!Et&WLW2WP;sK;*S)?P5XLa~$$#j$nyvLK z>&{tw;*76GJz16UK!U+O(A^zzx8bqW*H4`}bEgg;)i>6rI#d@HQgI+3uyFq+@T?jr z{bIE?Z%fEFeczV~H3!9rFE2$eL+AnYyyaPhmRK;pf~?1MU^36ntgB4;&3gz53F*g) zqkhZ@MdzTh+NQgHWnq8x8qS6*4Kua;pj#TgZkin1cFP4kSg3NAtov$?Ex`=*9<)8&7n zA^4$sShncqxCS&P&<1-6*#%o#?^4HtX3WAm1h2_&qLjAxXuIY~GE+-4aqziULLbi$8lwS@V_?y9yhMe2BQ0-!S zTLehvk0H^bci?`zjx``2O~9E?>dEFMWl+%o6W=qtk68yI`OGRT2O^axuAdou|u4kW$n3$ErA%~E% z?~XDJv9UwIyVqim9lo~B||OHjRTUz_0<}l$rabl4c{5*2(UTq zQUlfCjUyxUOzPH+7p&{`(akp0&S+`SNsjQB=F2i=>KG|F5Jt5(>gS5;_9~-znBtTc zJhT^H+O&U-ehAvi8^=K3DW4N3E`EOg8GX`{;9f`8l`c+&rNd|z2?+^gEvh4|wI3!u zs-0`0dxN0M6YHAwNdJL)OS71ZmssZmiYn}bb`hafva_Op+=}5X)?}^E+njZIo z91Zt1W#LyEvUSH#msg204GW#OS_q3><`9ytO|oU}gQCC%`6Xv5?wfHkQ$Qt=b{j(3 zA9w50QFo--^;&8w?^G_k}Y_WL)t$ zuQnXxXS~3m3LeOB{xa_dU(D{?vAOIF8WwsSBQ8tBWrVQLiFv0lwf|rhgu!y>DSOrZ z%tvlZpKv*BCa)3Hy5RARQ8ln@Beq#2vf|>iv{fSnbz_78y=;C0iU60ev$P@*;4nHg-7$14^8~vkL--!wMl#QO;v>0`wGC7&# z5(KO%qLH#iivuUa8VmJY%pzyWf0{CiG zg%jU*VhObW|NWfsJgKqo9pXqF)(xUp=;F zpRGq8=hJnqv*sPNJt4|kWn_Qqqg}J!_v-6=+|s@NWViJsulkeOI=5ZC-oJHTkZ^6J zU4Ed2`k(e~+fJOJz2JxSwA^lpSjk?r+Ka4ssJ;UiB37UjhtQmG{9B>OmlZ@+27TO7 z-|tnkcSWO5WW`6C`uv`Iw ziAXQbUM7=jfWkY{+yt!|v7pwXoQ!$dQJ2(v#Yb6f%!NQo+0@*R$^KleBLElT4q8E9 zzGvIvp366(7^%gT*5S6$_1H>#QCd;y?-T_(gf90XzKi9SRvPW#MK-zj(;f_g+dH|F+#F$PL*-bXoF@H@g= zDn#(^JtY7rsjZaU?IxpQgU@OaG4K_i)M^wW4s{qLwaKL<)c@aAA##^5vrY8h4i!dvS8!+6!i z+4tX)Q)+_g;k~Ob!uS;ZM$6a6onVUXE55ek)Y5YEh-a|RM!S>@qdMu~-*2x~jyv+% zl_28s+8VAWuc$assTfj6y`1+kM=g}0W@4wzkJL0Pf8TSamN?-;n&%1|s-HvuLpi*& z@EshxQSkqXt7qdnxloCX(i{d98`_|Xl2@;h{7a02YI{mH1)HvQFZC68fm)9RbURfb z?5qBu)rmgE8TTqrf-*+=#w;ZsG50id!e@u`#jTmNcAOxbPw?FL*7X{b+MJlPqiL-1 z`5O181 zrIuOx9VhpL?iF8o2d=_P=j7wM!S4rW>)I=+_}%88Tj|m9~^d*>BNN|)^K1$B}H4K*ET`k_;M+*eAHCmZR*S5HR<4CF`&(wXNB{1me>6=EP=vOX#af8d+~`h zs)9N|KoU~n8zZXkAC{11TorRvkEH}j%f3A2XB@S%;~9DGx4uW*L|44Rw-u3W>ekZ; z4$*TXgh70IEu@TonLYW2mZgf_-%&ULhv=rR+xeup{v&@fU#Hhn`4`qExi{dqx(3w~ z{a4D(e}UZm3xR{MCAu^N?5tI7Spq9U|nKlKT_CNDf28%Skb;Sp-FDw5CQDZA8rh|j`@-@1AJlO4fo$~ zEDm;ma26tf>Pmooio?BsBs56%#p976v-$CZ)1Vm2**>NK#TPpz5}Vf6Qv6FzX*HGAtrhy0m*hB)L5j74ue}ZVXi{4v4z({1wMg5X1 zWkeYa$qUX5K3cj4w0(!tQ=r5sFmFxvb61H+Bm<$qaXO*p!NZ5gW%gD=>OOE6D9?7w zfTAR{o&dT)DBxzi5Nb=;|K!qSF*Zr!D`EfsFD}jcLevkl3LwJ8#E`v+Nj+g>>9R`$ ziXn*NnBjNG1G>*~G$o`nTT7=I0x*Ir9&L=yX6MJJMI+Da6qcu-D{>TnO>!+5Q8+_v zw{t3ZMO2uq04%z@AzI#K1lpb>TbqcNh^K>t)y1juz3sWp5eg)LN2f^X?)Ml}+?IA5 znkKrt%I81^U@dZK!~vKsAQOs|p@mSKk1A6hswjHKO;WnO^E@YXQcfOeauU7?un056 zBqmKQ(|$<-s69YZIb!L&7|B<6G&*KWe48Ab`=OwB?P$;zdqU?gSUf@jLN*`++=bxKi@Qy5lmmQD#44co8(LeSC|ID~`0lv|G>D>II*L)s zXM6k1TFzlNqRVhAA$gBZ;Z3js$IU{7x~KMB&QUpSl9Ey+J|Hqd|V_m=Zv zq?5ujGBbzwfiIgMUqLn0i&!%~QR$L&eh_i(RIUk24e&9V_uM0f zTlluAa@5I@Rc-bn~F0iBzD$omUnJ&U+! z2NshbJYeVh@}&VRiZf2%u%&G)vO;~(-$#L*-9T1=0ZbsTP%Z+92@8NnKJ}#%9!AC- zN)0i+<968+KZ?L3^?!)5dF9&*m;r!Ln;PiRzZ&3_^q}wo$IGmhS>o+JW+>3TGOCh{Fv>e>C zr{m-^9?=2q=F^t}?B23qt<>i1jsEeR&4)r83J)=>^KsIm-1zf*%X_456etVj`}TZ{ z+ft3iBa*@DV!GoALcc&$DW7Z0^c56Htws8Tx}SpnFwiITMJDlf`gw?I`qlQO7 z6Cz-4Z30)iKpUc7nhr?AoF2`}X*fu3RFUJSz;=tz?;YB{xkdhrBx$VyX%DU&gK62p zean*>+M{_5)@4@L|F?jlI;l2jf6^A_z5-;8_{U zsN-q}lwYmB(K@4umpT^y$l=mI6zgyz{m(?hhwDvjj3hA9J3pU$p20p@{cxz zK2b#Yr?kAc!PAz=2{L4ZXt$o2rTPhhZHE3IXhDw)%Z%?|Rqzh6E0N|8H$6*+-fCr^ zy@M(;oW0ZID(6(1VLA9TauH3PTAgj^PB=NE`t>GLCIS!NEqDfQaoF=`8a(w-EWYl_ zCci(tZ?-g;(#N^vIf4)+U9LNIy}d^*^61&KH)~EA$aQ`vo95wh;7KNlOcL1akk7tD z)|UDyF*cyH^US@`r|#K>(nRKjxij4NTdV?9(k;}}e`*)b97qV>Inp*@>eiOU)k^0mJ2DETW| z1%jNXL1|KN41Gpn(wNzV-rZ~B)Og9x$M>D@6+D|=R-03kIMBsY139l5h<0G`s$ol@y#9;`c1jJ zqh(BR4P1QyK?7jCdK~IZdt3yO(~c2Qn|gGNjP2!oi=66;<=j)3KC^RhOz05;U?ns( zG%_|8{N2mtlPKZiAu{qAb~h0X^*F9Y-4iBE9b^}cwn5@>{cQ5qF05UEv2NaO92Sh) z*2`Yo5N3Fe)~LN(I?8lmJi#ig818Z6Ls{ofPI+2$x#u2ZJ%9zxEEBs+;F0IkODt1X6-zcFq>~VNpWa*t>i?HG-;d;Uo{pv z6<;0yYKXIU#LS=8z|;Qr)GwBfWCl(GCoB#)I-upGX{O$kN`(As2yc4-B@J9-8L3e! z>6E}ntA1OVW}eECCr@eyR~K>vgkp{nz^+TO>chQUnAQX^9hM)$B_lN>bP6pB$#-^k zAc1b8ytX>+qxAD{c^MQ)7$rybs29#q4Ehn|jSmVUb$OwbFBAY2xba<_ux4iwuI3vx zxxY!AChl{hHeNHNE~R&{!|;zRSe(E>3O3?AEiaocHD96vuYeiwM5m=$LVz7a`B{^F zx4r6N+A!@I=2!QzW!#JsjnCoR|{hG2DKO@MXG3uv* zh<|v%1*&kkEL`L#A64jsV&4yPL49xkLf_!Tda1@S2)CjkhhdK))KNC1>{1&C&cX3eCRf1I?UzV4knAqt;ALLL<{)^T*x?%~5* z>P7NLA6SG6CWyU=k4B=i&fiW0FwkmDj&~i1222x99(i(9Q3?ksAn;nvFOAY&8Bmpo zYkt3>TD$#A>g39sVFQdCPVr{7KB_qlDR$0lL*AKte5rwfhau7>8KI)03T|89E9idn zlfCZc4nASx9a+mIS}RSSn;5sT7Q6f1gsqGD7bWoiClK}Wz+F4lO1%ahtNk9UL(=;? z^A$H}d-T1eH4Pq~;LwWqr-(A~*GfuH@Mh4`wI`1E-k!N;g`RAZ+2q0tdTm^0318g{ zRW}aKBDI~}2L-S|lv3-x-qFujrKS%*xgt;{1Pgnq@P{@kE!dsIO75Qc#tlmc8kIT= zYip#VW5?Rsnwud<;GQkUS^L@0l4z3)RdHajH1tbg=M1a9a?z6k+iv5l*`$jA-w4HL zr+f2`I)d#2B<|5go%h4q^6P%7qO@*do!#8Dy%r}%2hcd2-N33Tj}(q!NG^=rW7BRU6{3?QYxtLj)k(Nb$6jmbLS;pn8>?YwJ3@3tObLt}>5ZAoAQ=W{kXk zR{IC?HVCHp)#|q&v&VYZC0ZA zG{-VIw$qPs@~J7`Qp0a%p4HJ&o(Jr!Zus3nK|#TijloB)0Qq<5haFNsfMFw}qVATE zEA272sO+uWaS!e5{`Qo`5X`T+GgM*HFU|fJNy#_&_vfiq9@G5 z3wX#QJGdctb0)br`PKEe#eT$mOU5087{8I(wvC-W6EGc(zyDo<&?p?1C+Px9}z zYw{eNrnDD3?5`bHUx>IHUfR00?H$Q;hJb$hc(r|c`(67TBW6^$5eKs#7=FIGYee6G zLwWGvw$1u?F-r41$X~7N>7fIn9E6k|EG*!H^B9l>z@%sq1GReE@Mj9X!bzTV+{ zqRq|DHxDPw(xFB02D}Npl_?tqe+*Uvtf*x#k_fHP8nW@xPcbEBkWdIs-8Z;fh94H( zByAa9TB6P7))UX=m90Vm_Cud>o5eU2vb-TX2%l7I)N1@BXvnoS{Hv1Y)ah{bXXz|O zx>f*DA|C~{nV9G1MdnBI`~+1HBEmi-m~}yy7lvZW7&&g0kd<#cxa>%$jS^B}J`Wvn z;f_oR7}k&x+C+3en9}4A5Elr$KA2XVIR?tFy}fLkD2RG|S{DbPyJ$1|#?*u?APP6d zy&6?LWk>VK`|1VD%#)Z^p)<1uomEv;?+zPru2SX#coRF^(AK4ORbXb{yeyRWlPcJ{yxQ1TJ? z-i9L^@7<4|=Y2Br@|xfAV#Jm)+T5^a5Vvc+hWsI%2jpHnh8v>GtJPKi({nnatVcp9 z*_1DeU&n6yJtx_g4;`gY^VBME@=Q!JqX&-g1yJ1rz#ZU(!Cr#@jZJ%UhH9OHP-aLy{vCauAd=)%VlG5FcLi^5x}ep)Ffrr@)II4NUkA1 zGrwt_)bes!dO9hbTHxp(y_Z4T0>@Fn?g9a6;6htxr^dricV^2>MeIJT`PCZv!Z{Nn zW}|#9zdVBex}y>xc2wsD;SYH4IroHP7)l=0k#8-1be?->+7#_hTnZy!=rD2e**|(c zZ0zhHEKrV{Ce$S34^Sb2m9JE}cVRvG#wjOLSUcdsX+w6uWMO+jjRG8q#WA*50p%}W zg9>-O7li!cgC}XDK6}b-$w&b*0z}9jo}`Vo#h}4!r?8j3bxNz{LqZn%_(*>oux%<& zX*HLXvQ2av1}GQk#Uqr?wvpC?6UR6ZJ2CzB)tR5-QejFM!!A7^>}JcDxtGHUg5_68 zlW?@s(xW^t+E0NI1^9)L4KF7qA5q%3GmrB0o|ILJKUq*^CMB@ebtGJ;GqEB%E?lLv zSGKq?gbiFWLxSNyuAz_1<A4OK~hm-lCi?#a+ zQf|xe7f>C5tQx``ST9FL?h6Sc!i14h@2EIl&(=TnVD0She+J1i?T_n0U5jS5lB5Tj zSW&mPwY@i_sN<})E`8pWl$aL^^}BG%%F-7k*YOLOk&AR9!~W=oZ>=fB}(D|i6FS)q7w_C^aOM^n6$smX2*-wQ*xMED!bwL2qFhmI*M{M zxqw*rYu|eO>+y~gXTmtw^|(ara7LHCyrdw2Z=z@hq@f@a8G|EK(>9b~e^y(_6WTxo zBhs4?wrY4exwfmf*TRjmeGV6`e^#@O&xJov+g(uj;+<>FNwC)=j9RPQWHpaB6eA4FRb?$Zg;2+KM zH@)=Do>GUz1cjCWD+WKX4LPd)B26Apz{0CLV_bl6T0j2BesIia2o?6c6Nl7A{MvZ;679jKutsg2oP}X(So-q6@ zHtPur{!`=%*LJ4bFM#x+r{Dp#GR9@$$B75A!AMEH+T@($_Zi;sXUGGg@}AwsJ-glQ z6`h+r!M%lcIvXmdO7L+{)vYVn2co+-ruEx*QOdlKLh|6dXyP=Onz_V|-^sjdJW8mQ z{Kn_&DC`c}8lk9aVQB#`d5F|>$XZ=mTJndt z*m&{eU08Jwc#M9!48f8dOi8!Qn|mF$Ly3m(bR}2jss-_!xwun0gLx42A)mu`rqk?) zsE7z#X#H0*^{^B45u>X|0q5CvXdCYf&`-}P1nMaKke0rq3m7ff(_oic%?k~;IB#1c zCL(suk8WALMv=6^m#Q*@DJ}1w_98JWIO@$`SvU4-%>PP~dl-=V?~#A0t2@@f9l(9Z zOJsI)bJJpmHcl@{@2vo%{^AoZ%+@TQe3V{d8w=yfOPZ0YGK$Z~oFs&0-7wzMe8{Jn zI>C<_Zxf1d%cx~`ls7BW^g#?5&4+`;adD=mrpwRmJc(TU?MVUaQ*qt~X#Apax^Kj( zD0zHB6*eM7jU1k=?C>s*qOFeUHLi`3(X0vWmW{?wN=xnFo=t`*%p;3OwV8pK#an!OhH^OeRO}#@#sZh;sS>Kl_{#PC7KT*|942m_ zk`UVYIQRXu=lGeUZgW5uHg)IofdamhgqOTzjE^}#w`mn4>U{q5BTKtG=_&xJYBLoY z??NX#0U+iD7<|j{)Y%Y0}@?Q(&;yz%q*0YJc@t$&Jl34_tsY)CRny+ z^F;w-PgMteg83@xqCU@Gtraa05uCjHx|-cMV+lO82Svn69b*Qe|>F!Gmv+Vtx7Tlh6T(5p3l z^c}10(m-|Ja+K;v`w?PfscO2#;EIR!fiVS$6cWibAXC803zbg^l<$3ES(%nO_Ymn; zUtJWVjAQzzZI^sACwA$m_iirV7~X}ETvG6lGVJC-{q4?%r(=39GYpcuwW?=!@ABz( z3ylyVjzgX??0@y?;J3C&E#)N^WUj&7t;GZ>!C?$)pYLJ250>jlbtiT@KKI18{N2u|D5)28ahLDPSTo3N`?nIN^6F|x_kHKc35ALKqxC}X>``N3^NgXvmb1GC4; zrH>`@;6ELxw7Fip!TMvhBFjA^ec@vZw=?ZuBO88uD{kT;12>#jf0?`=U&}GszdT^z zc>w)1DoM|_Y^k{Koe{n%+DG(VxnKU!%-*R%XM1H?!`+b{+5XikszXlw@8qQZ*4waU z**YHaxKykk*qVSf-u{k!b0}ZSj^N*3jTr8~=Up1oC+*FXEH#v!!IaX*YFSG8VJ-0d z!0A0|WVZYOlc*ssEBGN?$@cl56cw&y@!N}-r!~wkm_EZ0GHX`F;97yjqLqGD0beA~Q zqA@%w!#XeY%ip;qPMT5b-*;fBUk_1kEL&OYImnx^f zZQv&a%|vMxzz-~G-QOtbD?UcyHPT)(<;yYdG+~@cDq&mI2bq#GcK5Mw1&C{CQxZ~tbZk7@sM#_8e$QA9 z8Ma#ttzm(CW78K`VpB#%QAd8@d$`ZmJncuy=@LTp0`_(zQCcs?<<*%)%cn{ z9bY3j;@2Y&&-B@;3qMNH_f<#U>>e+d`fP8$Hg)m9@3#;~a!kwiyo6^n#rr#6kCxr( z3x&u$(UI!=f{~L~H94Kcf=i=p`$YMWE!X)}{?%{xO;*l(j)xmtQsITh#=C2*N~|JC z$Tycg%Y`!jy#+TgLr}x$5Z#I03yJr;56@+I>>iiFzDo6DuBCOvMzB#u zR9&T%>Nc&;kg7f5a6D=J`7)^yyi3ev(i^y!%P`o8A7;IMwr$t|BYD}o>{t>OQL9WR z*~L;Geq+6AphjFopEV z8iKD3L-K@n2!Y#XaKe{4yWN7(XH%{QoxZ@L_R2!36vjL=+u;uY#5cFY0uq#m-C$v}_qK|HHvK z40IV~jwykW#bKL6NLR3q%#OzV9Fk|~wzR)@seHR{h@RvFEL_7g3NFd3uf!IYJS=&e z)Tzt0&lPKf<|J>^z~rV~!j2JMPRssyi=>;$V0ry5jP ziw&AYOar&i(VU&; zk^C>a5exu`yIy;(K3qjUD_~V*vsJuuxoPW%Uok>^*@3 z2o%`FH$uW+Y{q8{4OxqnW!QvM-Ex(Pim>{ooGP=D(P|$94sS+>XvMWPl zt*;?ApJ%6%gvVR0Bw=-fDk%wcJ!Vojd+Ma0D)Lo0wf-;!I9zi3d9q_RvBWX;mtBwxVW1c?=W2Ub(#CwBOhBZzFoO%>cHCoIE!45c=P>cQ49Mr}Jx_s+ z{I9$(NQ12&8mxHK+Sdm`&LJx+D?xq76P%?Jpi017a(>jIbbS5Hf&Qxb6^M31-t>Ee ztZ8N`ZnII_W1{hF(Xmd4?Rf4dz#jq#6hSaTm>7-b@&GjG+Wt-A+6aHgl}(;t`ekn_ zSFcsNy#*|d)m~>(K>;Ov1>^wf7K)(f1Oc$JjmuVA798MD=emC3fV(_LcruG+Vm=1r zs8THBQ8DOlW(OAtscG?<t=0%Np)ks zKz2pUzCEExo?wqsN(RYArLCP^T~!r4)nOwFO|IiEA?H?U{$){8(@)J-U54wqfE^N5@H@-XU^IL#^(x$O!Ea zm_szPKa9WUrhYZUv&ZbYEIZ#*0Bq?2D8P`SpGs~HKkoTpMGHEJ0*m&vAf(US);7FO z2MVu0@otjj*`1t-0S^rs41iPNK&n_z-H)TfMuAljWF_EsOryPJz6Ay3pF0+E$SZwB zWprbQ>;)GLEHD<1Ty!o;v{j!ih^Vx|+c$dd{Nm>TgJ;5_9-qbu42$j4+bBP0mDcNs ze+_Y6=qN%b2AYx;Xf%VS1ZFs(_#X`kZF&2dTA&D-KllQ_*p#|R;)_-gG2vqF-OyC= ztu+#FsyKa5mu>j1z8vK~3-tP*LDtFljt-}LJH;>i zkxP#b?2ly{+}{Ze#YDA+V(Zp9I8-ZW-fWOPC3KtaHE6iMFXVBh64{(kUzNe_S@-dk ztG#7u(>cVE_6}cvqi`MH-PeASf0YyfMPEAScq7L=lAfSxVy%+X7@D=a_44$`IA6U2 zelv9RUtT{eG&VbxFLSHY?DU&QkK$_)Bi~L-p6O7rsE*>K!8V?6aRKuz!*?{FdKhxP zmw6U2^E~`^&Q*Zy16>I~!u9WN?Ke*HeaoDl$~5)KXb&>E;~#M^!je5mBCpa0vo*bR z_V`?v`QGf5@w#;4z#tSbkM$k%uYqEq!0_p9R)JkbVsgkdXjJ0YDK>hkj|F;X z&()jL<4jCGd(gDgf5X={Fva=z4IHj?4>-R#&* zF&TgEkEd?ArXrcW(z6>C{YMjF4uB?``J_!DRv@~#wJ2xER*E@f(((3AULFO`i{GH2 zDR8D!`r<9shA5~g+u7xNBDs4*O2B5z@XzrU{pK!~*eW@h3`y4N0@n)Hh!A!tMqGIV?|qpirsMa5(3i6(T0OnN zPnm}M8j*mOi*=HAbK3iWi(+Y+mF)Nwda6yeC>CYQGy0M^NJB>S_+W5?2AJ~)tQLOI zCO=pM`mlMIM|X#2jPSoAae~Dx8AlJOrBYaT8f;QEsFQo`q;4B14{omNTvtZQUvSu# zog|fh&tR|zmIJ4?5V40l5~nu5T6*FY+;>R`mTC6vXH|P#cO)L)uL4cMa@$I%9R>EJ zPFJj%*#3Bn>Q{>(9Ee`7w(OBi?bmLh-#)+7!?26Y(3jhOl(W09I$6BQ@}e_C+^+Uh zZU(2Ypx|RvO#qGJ;4b7BEN?ZjYp$bv+)3;dNL-@tg>ec8vw{Hm#BfuI zIC<#f5VCnGx879MeJ*g~b^Tdg-Utg3Mgri*M|Ix+a1S^V#-^Dtn(1@Y{;S;OU1L2x+N~cQ;C{Wg13`jH`qJY=LI~NcOOmPKoLwhvLxyP*7?B%v zT5H$BVxI*X2KA!C0?-$?n?cwTOjhnAtU%%cu7r|1?w~4G8qESL3eV7($9a&gn@t#J zpWvZhVY>bJgXuYu&)4FC0Poi*kK0f}7_m2X->Ge+kk!uN!kO;0sZK%46R#ybu_Yq+ zQtx0%=NMgqD)n6Typan)Ie^*(HGX9xmw#j~updNy^kAQV0yu^P1R}Qm=Z9kKzUw5M z?*V4p1}Ux>KJnflt=21n=m@ZrO|X6~v= zN`N^$iI0hlJpag>Hb;`w)!XnGM4LHJJ*cUj8ll2PG?MH7ztU+T{|L1dL#>zma!Ir*Dkt+ZfQ8L7}LjehN}~)S}Lo&;>n61&e{*D8-xAuH7k=~ zDhk{|0T{3Z?NwDilU*G!O5s6-h`LE%wNbng2(VA3!A zz#bsR>G=EmPnf0KJ_s`=LNl5+Ck~Q#I0HsZDB(e-1sZkaqG?TEp`Sl_T4(fN#p`u= zO+e9n-skB-NH5EG@@q&nzMt z8Tt9$x{+-|8e)=?)^wYieF6_azT0v-EiFyRByO@zwR3nlk^P38*Vnvh1@S31(}m#i zBNzuwc}Rrm-vHe|cLV8{=ElZh)L#L?6ZQ6hBCrR*EU(-8;(ym*(Omex`z2xMQyx+B zfWdtyWSip48I?WeI@P?-9E_GU>1WUc<&n(v_}5bu!N2xhY#rPRm}fSWN3}3H>FMdg zrooUO`&zahc1ty+w=yYw1SBG}#xLi>rr1mV(@{vR{7gyAqHeYmNAGb?(l; zHFz_A{4SHD$$F`hs%pat;ZZwY(&o50B#xNk8$?b0l)?)%a&TQ!vU7TEEIgg3H#R5rpj8d4kXr2ZgD4{!LYp_r2DwI@l&=295(w zuw;Vz^C}#nIxWL|O;#8prCxy;_%Zte$}->vMB)P$U2l76+o7?RdKt41a1hOJ}WKl;O7Ai(8oYbSC0RIY#S6L!rcg>fhH!NR`ZU+b+?Oj zZwRe%h-~=wvxfM1=2DqLZSLrKUg)O%I3dgB%xolH>$ZKr;lsLW9x<-xDAUmmK> zofc(x_5^>wDw=T@H8Hw*Wq(<5rK)~wOW(Wxck)KHvKoKIff(|CbmG`42VLzr|R*KlJ>)Y!Hi= z^>~_3`|hW%Dugst?QR%&G8ybu7FCK_pvYASPvAl;80I!P+)_u-5E>I9sD+GQ{X>p5 z6MB!Vmu|xReoiqWGVVI4+334WXgEA*f{A+}$#nas?JFGOQ33ZB6>-AhV9wZGdaXgv znu*~yCZaJiSJdln*b`6AkB1n5lvFaX`2PK!Cfg^ppATn1qMi`LHMlWw2)<8nF6<_C zKaHtodtbm^&EVUKnyS`Ft#s(k?fXT~s^)Km{(qr=IbOwyL+8DF9@Rz#RdA+)jcKT& z@R**IFYkJl3}&Mf->bX$g7w~YuxCL5;3qjBNF0$fwU74>V(=j)0qKxc0`?%{nrAOa zKiBZ#R*%zSK9(V6!nE5rI~#@PBJS>AGcD@T%Gfc(OMf=U5?u~wJpTD75r)>SbL!H` zxnPMGKLB^4SN(2+E>UA65Ja9Ovsu{}`T2bz{4eJ&##Db5Rd}5}86ff1bnZh%1rwNo zV2cx;bOI_;XjwtTq_{7b-9DCIfL<5;Ne&#UqsT(+eRN1_m#w>hmR>pRRPp_ZO`l&? zb%GHDI*K`EkhwfMt_O*DXIQpoPq=#Tp@H8o@;h6+0K)@bxzHV9+>4_rUSWxRx#mSI z5I7PUA1{JuCi`2n@Zi&5ng!fEvHi0P>$&i3cvEzE!x(U78!+gxCA6#83k93(_Z&XgzN4FCP;p}4Y+hrRZ|WSu;3ri_EGRnn{ zmcB;uX(y|e7-o<4?uR*usPtL{+4p17f@mRe^2RB#%;GfAtVb=dzP}C2rHLu1m)?*D z&B~^GsC6KJDqc{Fkcb?Qg`voFvFnn)`@=ijI@yuo;o-!O#56CMHrN!B6FbL&BBpr! zMum4pW)zF%anV=TPj=*TYXOP(s5iiIm1*9%z4poswS6_hE}aiyMUk=`Dk8PJqbqLJ zwTCIsYWPPrsouhr)K(XJSUGXi2uj|+$cDT>)+EsREw@D%q+03?hs_)O-&h&|?dA`d zlYn;&QtAKDzI>ghqeecGtTI;*OHnZrP6{_vh03p_nBc?_6nP>v{Os$Btw5_(OtZqh^ z!8>Lami&@qu*8n}VnU)~1<3+BwZ|IgCarJUM(w87f4yxJ71M{W#n=-dY3v*Ch#lKZAU%hYr zAFEyQy4VFzPC6Q1xQYBDdf7trvHmxrmtMZVL@!Yye~Dh6(fz0B zMRDh(m4RwULC0^=%gKs!MRc$1FG#n5ko3ay#32@_GB&y9{aLMh--5#-IB>=N+(FZ8 z!}Cwnu4|dDY8I1zV0VXNOL+-V>_@t!aOyU*hcpetv}2DXnZ>=&pN!Tz%*K{Hfd&mL z4iIzJ{ulMcR06^b>IwUvv{J2*Gn_i&seBP_plNvrI!WUAxzbJl7;ckF-p03G0u1_y zwf8Ud$|g@3>GD$P`T(`6V-Y=AZ@nN=lMmTy2zJqGJ)-N~UVkl0kh1lFn7b3=euiC( z4!bnU`vPr~XKcq+Mt=D!JMy_%m)UAIrQGdZXi%WB_%vzi`6mA{#sG zSL5aQKHC~~RlKK&b{+yM5VN!Y@h`xO=S1wA)m(kh_wnb4dD8Ey|F0&A#@`lVRQ!;| z@J}-ZIvbt;NMPWbApvFZpT^1^;eXT`aI><|tlGanG|+eQ=g&jnxBu2;nLuBXxon9F zuQSD;Uk1<-dc(B;_$N#~sBUY};d_H&4E$DRNE~Cx>%ZkB2Cw7}^?&qbtA4Wo`^81h zD9d%825}1FB|ZH5ub(lU^GWGnp7Q@6-tB*Xv&jF&71rc+CjINBXDM@r9UuU&DViVv zHi>K1VhS%#RfCY|P(%YU0c;i1fqXP`(6$2CUb0k~e!rN{*&raRrV(j8O3os!+f|}d zWL*tbTG~bRv4VLKOrzy!PRvm`2+M`?iXkW z*&=+a=)M5ivGlynJEZ(DJk@`CFck-mU0@EWS=vbG5`ns1qpidMbW288HeVM? z(Zb7WHFr{J-^TBq(`o5sjcNKcw!-Z!8ekq3B%cCSC-_B-O@V?8IT;#7k*;<@{6)>k z_xb$V0>9RaVczA|BH8qd(3QBDG9(RDvhS{VNyP<(wANvID&L^eNG@i3g1hL&6ZkR< zg$4g@@6rZGiN88xuy;lc-B7eAdqRBA@3)v>55;r?1quLpa8oRrZ31o7u+O2ZQEIzZ z$2gIL+&475Y?{&@b?u;8`wWDWez59JF6tc^(EE8H5Yl`l;`EW%KCV!>>$JQk5S3#t z;k<8z>4h$x;$R#l#4ZrpVTTNsrKHsV-GR{?&(O~d& z^QEQFm=@_Wb3!{Gv|#^wjYB;ZPRkGxAJj+5;p~xl$MUvc*X)g#+oIhB*5@V}rjH^1 zHRp(a%s6>8(=)C@d+(U)c^tt7}vS9}AqR3(|A;o@`jIN{5k z0O*eXZh{S^LC8ei3{c|WNL2$B--&l{O|G9c>Io?*;BRu9mHZPT0B;K|f?q$&Ms$HK zvbU|xNX(!Z>EoHw;okWUU~7onaM61n0Pc7}q4pUeaM8>Z1l5dGfjt6t`IGoxUIx>W z7aCAOb2x=}$dWCGsCPK?K-sr_LVN%^x_||Tt`~|I__VY^ySp$@MhjmI?Mu2}JCl{W zzs?Z=A#WX9fn0(51rCHJxc)wvGQn5iP+=-S-+no^MEf>%sunpj8Z9$ERQ(uZ2e7s+ zgf%2Pzmg%Uv5!xXe!jod@vubM#m_}a_ku33I=qG~iorp00yArZZ6y%a(2>+3{tcRO z#T|M{=L&mV52BB-@fG8XP~ospDatx`v1?#}C!*e{0QqX7J5OLO!~om8{BM`@p{Ilz zdn({$jqd&kansZ0vIM^2noySml)9>Cz@aMZ%W}u!A;A$1b*Zxcl6@$g;4%RE?iVFS zPfSAzsX%*NS{{GQ+R_r7aia775n%_K>;>5P<}_IdG%%Y|%oNb&ROU;Jz5UNoWxPIA%w52Lpv(-ywN*V2 z@RffTzBKszpklu63_H!uuL_kP|6odB39j{%W4kY*n-EJ0DYmZfG6Drg@enVh}C z?%Gk>HP@#B_qU5Wkut5d`pb?p=}}7TMCt8^f#CcXF|JirL2^dr`g{I{m#CEG`xKP)UUOY668C)T3t^{c?^ zXVq?{fYGgZV^1O55>6aXdBXbi(7MtwtsRNRZzzu^4LcCxp$zo zr;nl$;)1x1Uz`GM4EblCPnHG%fj>$^=T$lDV%$-=N1&HO%5NZ>@Cv3;fY*~rJEkmf zoFZ>9{G-*(zVXq zEui0f()c+MhJIwWHekZs!9h)*^#=PdgYo$I+ex}4HK-iwAG|=bOhNMa{o8ABP)jR+ z(nA7$KCpVhMNxWcj#ya8f?L(maW!_QMAr%8-@&pL`@@49^u%$;Z1eSkK{Fgn@NSh< zri#h6-xod`e^vMW`|+;$YHIR7JBE`^%wUm1bD@e!ahIUvgo4I@=F#3R)2ZO9G1s9M zF6z8w{EbKJPELXc_)PRauXt4a^h;xHcJDy;g4DR#ZeK@E=fg}jJUUfXby@axNXeO0 zp!*IkWZD@tT}i(?wAE{Ws>F+lyuXtCOsVK{ScjcZ{xzR1Mj3bNz1)c5s)f1lz2zjC zDcHK}i^m8sgiDINVp=M$rLXS~O08vivRsyZr|UKoCPPSo{u845?v&n}qe~O-))B9| zhht&1Bk(T_4|yE^=pSxYAC5VOZY4?N;);!m?Spi#z-$cl>lx}TnDXsZAz8Ss|DFV` z=|UF8V@jJDcS&Y2&Aw;WJ;U6X%=|To$OLaQG+MNv#?d@`BaBt$Wi6ozM8X@#*BS8x z>;wWAYM^X|hPmvYJAoW_ugW!ZnR8WC44$llB=nQg3Hj4PumE9TT;4KH3?$lvwm4vf z!Fl`a`SW^b(6=ZT^Vk<$J9RSHIsRs<5JwWYLa7Y9hiqAnJQ*hfI(|eN9_(#`ZJjM= z0ZA_Hh|w`Xjm=ZrI_phEE$|d{XM4O)vBiuE-a+_I1UQRB5t{%SbK$R zfT>`@?kel?i@R~S9XxdFo<`MI{p7*Ex|s^k&24q{$IufbBIwFDKtiB+1D!%Tk`*p~ z)DZuVAKtsWmOt+!dF>kP-9SCEx+N?mRAp3f2N6HIV;zpi1Rg|peT>r1M7))oM#d*F zb@yVLml@ao>J|p;!PFidY%%LH4Dghp(p%?^Aw&Uso+IvooRH3ATWsYwqJpGTxs+Ap ze2)Hivrw$GjkG9e{j&%4U)@6N8?d)P1u1AxSxJf8tqcax?CH>mTnP%6!DW@Exfv?E z0|bk1L+5__zIon7_Hc!GYBVB$?=U)6+qjS`W~&V1158V0a(hEqT*p3R?$p=^(LsUv zIuj(jxn|!fFT5SQ{v}3W+PnVA)K_%1eSQ}HzbB46ouY~i`bh@OAw zL6me(^>WAKB&akd(;FJ;+COqEcr5Dm+(tN2J7)m$3B)PEB^gbW2GvlPyOfkUoh)C2 zd{94dtlOoyWb9daK)K3Qs)uPt^ z{+xPVMu2)dIy$ym5WESi?t%xMs1ZthXy?EflPRln2Es$UZ7oYru52AalZz5SETr5O zPKS<8`f2!4Xur05mZxEYJLRLzwCeRBFTO^B<2aivTIBGTFJIsWje9`R{Bgqs=Vp#v z-?q{td{L@t^EAsS42?SiI-vpA=cmBJ-fGAAa5gXVug0E{L4n!RfJ;W-+zs!gb_@lz z^DsQOoOLET@4*obnb?q*GGebJ5T)BiaTjXa|8xHifd<~#&>fqKZro97U9dLJ!H1jpW1{6r#jDxsLz69eUrYVQg*E@L-W1#JVz7HhlLAw$D zPGF*oj!sO!KgWr~^f{s*gVS^^GvC~N|3Qy8!Wu!Ff2Qs&|3iz#$n=Ytjz>Y}IVJr^ z4@Btp8npHcGd|R$tCj~w=x>Fll?Q%3lAij(A@kB@xkBAAiK-J(ou96Bns=FT!}&m& zCh9Iyw&gjv_J``h0}WnPX?H7BDUUZ!I6NgS0y)>YsoVq=FP`^|YaILARPT&dsh~BL zQ#e3WUO7EM{eG*g_5VN-t|K=VhZW$p6vyMD82qSKZ%?@My^`ItjephYxp zXUBTH3UZd!GVjP5o@aP&WNiG_kQp_WvnAZFe^sldrR9(A&6nhmg0e{HxjZxXyX1Sh zYRz{rS;&tbPrN!|3Oq14+Yy*z^vlZ1fV~@1Kf%Jp6t}t*dT12RImTAmbBcJWMzH5C z$ThvD#qLA!y>I3JqU|lfs#?E((S;}&goy$IiXw>8-3DS%B1)G?NO#8skrD(I=>};K z>1Kg|Al*nS-QBR@jLH7*eZK!W=YID)=iJM~_Hpwpfi>ql-*=4htMYQbb)%b2aIaF+ zbg=hma@nTgU ziGTT*1j1pK3RR36d}}m6o*)H*;LYv9Py>+{sLgO~ z;a|Bo7lQTL3l^7cA+=7zzu~>tBDDtiits@;A}aqio6RT);&KLAAdv8u0;2a2t&a|g zT~M(Lm;Q;&mMctd!N~_lc*?8uG!LmA&*PdL$$l{z_#!?+3b=>{WaG`43n+t@2zL88 z>8zd}0Tr+Q_YE@XgPMeTpdy9CYp&RKNBQWnGg`Sy86HODLagGMzg)lY@;*11YFhsj z2Fx_s`g`hf_qAStML<0gW0Il=>@<}{o!Mu%-E3Vx+YbKv(($H=f{THTy%_kJ%gt)ek;A8$PwX)Cs3^Lq4$E6rYHFt~*2j zY9=E#&d~Q4flpT}7ynOI{*>_9$HZq|h(L|YQjVA7`Xv68KXOPbl-QSYuX-7({i~zn zmD0rhCQ-=h2;=V>QM^)Ni20(x$CSkaRVYjfwS}r>j0C9tg9F`D=odoHVg=e>KM(3@ z6{%~7o6`3A9`Gv7sgl8se}0~c!ZPEFZ^bh`W8)t|Ov>N18_3Xx0P_tLyN12l$E1=h z)b1jOn(*O#;1(5CTzL}+XB}!l{XWH}2kHvQ(&SirV@CYx=U6{!S_Dq~MnFz)Uw^*d z&~UzFXrpm$3$kxPew4-5$>SY(LA(+*D~Q-q>1ubxXko})CKR3`d#S)M{|^wFR8mgN zjly3%?{FO|yD1cxkV~wW7a*V=*nRwLX-;Z0zuNw#-ZgD&ft>aSLG#Lfe_5FW10yJV zADS@u-|Xv785w*RF-wD0wc3d`@#{xa%>VF(DGlmal}wI|Dl>l<&)oAKmk7EFW3n@$ zu>S*AavyRb1Tjw%o?W7%dSGOfaigI#8F3!eWHXSz{Pf+qA%OS!l208y5)u~1-sJey zu1wADHzNt>wU5V9w*qCT0Z1T_N?Thog}hX!`f+LR2@Ss9F&FMF!}CX$zte9_^ zg?U5q`wTq|q+Xo+OwfqEC`SGf>gNEe&R@ThPq2GqJ}V^AvVJwb^~bbus_J*Ox7RPJ zbt_v?luz$miOccnnXUQtE2L4-x@0g6mq}sB)^LZr*aFV#pSSN=h1jQG_0qjFHF-7r zJZvXG)fvmVhr(XStbCD;Ylgq+FxAF= ztUBy3$DHoHs~+O9(6Jf)cD72m}VxS9`uPi=WW)x{Z2r&-fp4&8JPd^ zf+59&j&#*GNmyswDuFhkHO6A_5735Mr{-eBEl;8B!8aRDwJ3iN!MIr91e$a>=p&m9 zPE$K73RkR*oN9hxGE2U9bbvAINbs;F9A9@uwI;^eaO3YoR9^0t8#tHnI;9Y-|E?Zg zt_uJwmG?0FgMJ%~>0tzkCYpJYrV<*$$P9SkzwZF?H7+BgDYw*{_c*)3MONW6^1Ja; zEPZDbg?EsE7i~0mBa% zz)WrJ0nP2FJ(}bdVSF^S&Q#MbiWRSThus1(}`4y0?wKU&pEBh4$o;}kRI$1@t&&qAo_k3gPU;O<- zTPj+mE8v3&6|nZ8>b(RwrlDEXR!#JN%_g`xU~#BUHQI-25^2lM@4RcGWDBz2D^DeL z{q#wQW?4c&kkC}CLVdcpmGl;!5)qL-OSq=Ia2ck7z0=iEB63C7RDKGUIWc~?KHdf5# z4nbfL-ar9IN>H$VGmwnXkGL6BEy`r@--rD&bpKl_iT@4I;4l8&-=q2eDr#^zM^9Hl zg&R!AdwwP?;Qfs)FyS};>s=halhjI>=%=2H7jZC4Dfw4+v#4m&-Ks#!cO<%iq#&u^ zcdQJ8ickIhE94S=gOTt*A1{axafZUF;e+r$yS2jy{T&164zCjYq4eZ`_+kGKAjkha z_Wx(aQretLA&C9mf;XeoEdpD^2H->{^bi2T~>U6`)_ULkSCo*$QX@wT2J;oWZ(nuiw?9NiHSK}}%SXl1 zT?m${A{8;@l}Mn;EGa=KDS3=PX9D=fCL~0RDFhEwv(+XZgG3V}BX_7M)>K7Wfb|L? z2`!dFUgNDT>R3ll5-Rpc&)2fph??#!;6LEOj-j50JKfus`V40Fst|f&I~D7>6i~978gi$lZr0R9kS5x&&@{HVSmOwye4v?9 z^0W&)EQEL3{J-nxF)L9Xh&XK0fMxZh&w-Ki?Qf5dpVn+>T?_i19DF@LKF*|g_86BA z)2j=EhN{Vt#RjAIvHTxY&$*SD^)|h8kSc373e1oW=(2I`3No0hd7n2QHtvx}nIOqn zTr}xY_?`Q@YVQe~*~Fk@f8^WSkszA={Xc@zQRGd&W5fBj*yf+!bnkVjg~G^%Rzq7H zJy0Nl?*_?SI>|oSGk~uFVdu`oS1yB_0;CC+db;BA@o^8reeoAYMof&1jGTnDy@gKGwCEm7ypSQ6%Y*NS~Vm9(thumYX-*1X(tsX%#MtD>MCt4YDO7?#N@|BQ+P*q@>(xdtv^leJ`Tl68eC@2B5dISq@tf4;P>+YURzx) zEcRbmL$p`cI3}(}}jXx7m}E7YyF{_;7{x=&XXBQBVhjFKI%Kt{*W3 zp*)q5agBfIU%w4-NtN4Ao*~<7Oc*0E;%{kw)IzBzzCi#hq};!P5g$xMcx{(r95e0B zkvm*KV1k6yZQK5QBVMzSqb@1K&2UGL!A8-uc2`E`%#$ZiKo-@0M2wcTw{0>b4-CM+8ZgC$-}(UH#?12=F?wJx(N{Pt_fL>l3d zbFtfWPdo%y;w^$Ygy7F#r5o&P{`+K@Z+r*ldpx^~e~`U3`4wbYeaM>a+U~7`mHfS3 zQW3MF8_K&MX(FqB3D78&FV5Uz{%CZneCbxiF4ae0k!R071yt6+@=wt2EL*9+1>(Oj-!OS~CoU!fKQeicu|PX9A++l4732x(nvoIB zZC()(^`J9tw-^}iu!rVGL^Hg6d0ycR-k5}_H<1RTSHb~RmVP{p7}4PcY!2*Cg;Zgl zdrl*=dBq+6y&^3^2!C5lbkau{rXy7`P9`QMN*Ycnd=?W#u;2(ZVBh7lAkb}&s05!- z-$}*i&#z0rQ8>1@3FJleEW{kfMe>-k%@)9esb+WOhdbE*nmZ{rGm~Ggo*&-3A=VsO zRkB#_V=*bV)MPT`S6L~(8YHY2V6k%8;#&-W6*cCFB;~4s~3$x10*f*lfjSDpGJf^iG_s)#SOqHMc=@H*q>=V z+Q((T4H+JpW>IrX!rBt6JudSFIS}3`cQl%`So|()c`Ryw zgzGg!*-2Hm#U^p}*0n=0QuAORr^nTYbk3#2WSE!X9R3{*eHVIW2eOVP?$^foDp`W- zT=Dq5D=RDM?B1y6aJ8MZd~N{3?7Z!g-Q?QT0o6mR5R%KhS45P- z+#W`c5o(UY>lSHlx>hb3`SNSwT@Gu}y~(6LK0Y1Ulb&$VAd`?UMhGz<^HPcG3j$^? zJehhyna_Hz#gEStPQ}qwJ03GTQM6Z}urjjRO9!4hZIC9Sh?O%DQ_4w==#hY*ps3Zh5T@Z-7k^f|HQCn7D3plVA&tw%p zEAl~7FIXXQP147vLH=mYOh8;5ZPQ{mY?0cn-IJ^2YJa-nNGLAm@3_5~pyWKdwLA(f zdkx^hOFyNZ!L|$i^OjtC1$^b{)2FOy+oYtVNs+uT&=i9q^WFq3$Di3G`ZVu0LBccw z^oX!Ula545RMr!K-y-4PR^XHKPpgq~{Z{u&(=~RK7^{x8& zc(m=7`p1;cl-UdkXEPlKs)m&n<2+z-5KT22}XbZ3O6bDUPKOdZJ`jHG$KEo`JW~{Dn}?C z7nM}^hE3oaJYZUq&CpWXRmFs|D}S};xRiApElGf5to?%V!9d6Zs=9Zs*-Ep|ZyUgU zC(o(rl%QQ-#eBf8hkqqGVFy^?ZNg_VGKee81AgN3{MI}@$e?g@Ci0!{23$rBOG{3s z!fnVXhy&NY6(Kk@dmMG*h0h18`ru(NJvSLBlu^sh82VQ4RoE8H&p?n^t}b(HAIg_s z`9|S4D!z7ybP=+5ivM`P9a8s59vdL!u<^RwA_so}Xq~;2BPH@!>G<`WvNA+ z{MVcj0U7DDUgeJKUGjJmR3ScdV(TSmaR~%(*)x=P()Zvjr|2%HgVZ~xD2nvFUPF(L zcLClo@Cf3O!Q1vdT}*uvhc)g`fM#m?hYjIkKvC zAG;?puP%`!9sL6iT&e~H{-)N+Eez-ARz0@#edb<6zwKs$Y~>Qiq;ObI-=EBbnQOjf ztFbBz^84dPp%=p}`Gfb^LZKw!Q>0HaD zC{0n!gp*3ojX7uh9sUKjM~t^_br6N14-NAz+BbPSuIa~*Qwvy2SZFB8$pr;98EU~S z8pNIX)9|>2wJ6BT)8j{pL8U_Eh5;oEWQ~{)#SKj_EwREW%%ymNcC~Lt2$NlG=m6eO z>=lmCy&1w1vN(YhP~>uDg8|%jS<3jcHNrUBr?Jii>(8{gKE&$8z_t<(p#-Z6LLreM zA$42iT~_yzJDPc_A?wlmcI($Gz0c8e@@NV`b^OPME-0fVwk@}53JiuQ=??#-MEKZN3v92|Q|^NYSu{2GIyG$@Le z3l@ot*}Iil8rMsY)^ZN-wa%@Hn2*(cN*&LzS(}mp#T|SKZjS|ET3B7p>o0=$PabNEGX;LS*{_nI z=ENJh$@GP1*zugd;L7m@SRB3`$Pl{Yj(vPM!R64?*gQE@Gm#hk^BJAII@^VnQnM~P z+ex0)0;)_^vlHm{#4Nw}O47stHDrr&TzQNV^j81MdY8~TX_~4{-e`P>>)cF&r5Jg? zPJ?8^Gd)7a@2#y*l~{Y<^-6vfy~7$RK~cW{gVIDRqF~=?<`wdBFopofq5UJA_?s;7 zA9Q30^D1h5=iosxU|!9$msV6HhqFpsA^$#|{yLs4PEAE6U2zERyUyqLI_tQ1J@4Nz zf)pTZE&$xiG~kd4+wj^3lk@r&HaVMi?imZSJDT~<3%xn?86>nAyWa^xS7hAQMk+*| zRG@5mjxcJ6DyEoB0?kNDB}!8C)GM?MM~m};{(ghPMPVo;Q8U>S`LJ&m`OBJ2BquEp zLP7I2MV6^P4o?>EVcIR9>aIJm>Jh^*g8roZ1QK7Z=u$!rQ+`hdsh&!5*CV6MKKmwa<=Q1iWP8OH{8(5N}%&+#9!+NpT0sx!vb+mxG+CORVSbSy^$xd?1sLFJk_E%i3zh zPZMJqnU9ISL0u+EloQ#&#ifTSRTY2^TB7=Hz(GnI~bUlYNk7qvJlOh zcj-T*$@G6BzT7U(g11$-v}_L9-1GsgEgR(ruU#l3e~k|I81% zfZ8`TH8o*ok%g5hA^r?)Nd<^eKQ|0WYRze6;Bmz5ZbJVcb^M)?Q{wz{Dn9e-Z||X& z472kwOI1tEdiD762{@BDZWK=W$HS~etG7I1Dz8VaszX}jJxHqUl@=9WBe@Iamc-?r zUn@7iL7B$hL5V5fu1)*4T4b{vh}cnLmOP^i2MoD6R?vPDIoO)c93#G+Sw3=B(7LC~ zqL?U57-fe`c;U;g-&upw*A}jv8E(DDAY0-h?QfLVZ^aoGlAB$j z?Uuz=2EW+gJ>#?o7aplyvXP9ya5?yET#(4$p_1E_3_a2ws>Y*lz`eQN%3<%XC=w!M za(;>3z=xlp?z}|wETvg<0%T^9>qNX8eu!HfOOZ`VEc2aSyJeb{pK~V7Dm*9?y4)&C z#*^qC05dMZ&;mH%L-*L(*gjgnk!l@2UQkvx$f_6z4;*4ry6mANEY<;AHkftF<=;ox zjS}b2ubsG=y0T)v1{?XgcQBJ#8T0S+gHZ)cPzrzc-+^k4M~z|1&4C<+Xni@tad z=-%KwnmZ(`pb*k!IlMReqQic0W;r@YC86kULX^yDrGtn`iAGwrNRgH>O^7cGTVONxtd}d~srX$5zw^)uDc!ehF&d9ZxVMJSeu68Tjp}= zlg|Y^rHwzTudn~6+Y&{tYkEl=p-OetGaHr3X=KjYQ!Pnk?s&n`+GTxeCu|`V8nCKy zg^XyFGukehMddwbY*iko3cu$)DBsgdR8>@bp;mvr^Bnv2^XJbB)VICTADK;0gVzTq zJ&UjL!UIuJPFZAK9?AP9dF7LQm*k|CRilX&ZM9+f&XtmuNe;ogNP>voE2~ci-1Ci` zl8TC}@y4_9B?d*z>m)>|N1X0Xz{^TFnu_puZEWYIDlfioy&yM10bL0aX^@XBIYR7}! z;fLDV{(+j1@vE|lJcp)QGTjP69_Tml@(SWdL9M?(;v)V{Ju*)8 zk9q`N%Aos?JOPDp`2G!hsy}Sr{swbon*YWO4u6O_T9g0d^CX0(bLYzgrxgOXz=4y?o|C-z49kysVy!B`5xYlrT@Yzh*l|!a}bQSX^M|(2Am*>@5~l)|VR#rwnu0)*+9sai2<|4>rc8I%^gworacLM=YUKtu zN~RzrdVehmVzv7x4&l(hZdFs(LmH>^sIS`A7B7T!f79Zl@O&5^_#@fPnev`K>8`^io!R39XqR@`9#Colv})83&9!Zg z67mV4m)7B$XDS$Y!)1VUH(L0xZ=WU=TIIKPZuXE?58v;@ACA6*qZx1!*{RmdeUJI= zO&IkCZu8{dO z>4(D32CP2dQVB9B#eshs?Z>)wQq$K9(80j800}ilEb^R~k9mt8fjk*Sn#<>yj)5Kq z=vbI`d{J=K0wF5~<6rw~EBqpmeB0Y;X>2Sl>u#%MIZ>7+woCVPbl?LtO#{&}fW2c_ zi5P&lah{A!zwc{w5|CyFxN9a`TZSiBuTuNtehe+IiPGG+M8T-6dv{srrUX_`f$xv>P~-4Z+h)_@Vo*HN_U{VSAevj zgaXFw@dL~+fVRgA^V1#LGwF@?QI87;*QfkMHGFE9)v)D5s5HyQZPYGV$dtA)dx-VB=M{Q!fp3ugorn?S^L~xqdO)EMBQd)%W(wKg-&OgqD*;x zfks(0ybiKy0yp4}gS^rrsbMQCd@<2R^M7T*JCh5wX2@=)wtQ7B22{&@5pig9Hx--BAZZ&+u zLJrEDo`n1S28fxt8)y*Y=IpMcy-lmtBxfOUcuXH0+VitP3phClj@bfDhR z@J1W-Qd3jOlDWh?dJb%?@R%nJ17s@*3 zQ>FcQ2N9$WUd`&C2Y-18?D!Uez&CexcJ31dr-hRzPqMF7e1>P3T*tHo_#7XGK^y>2 zd&P6pq1p8#Au|uT6jasKSvY($)J_q&u`A4h&Av|!E~j1o}`YqU!6PkPk33Gjm5a&#uRz+{fn!{Fh0# zsb=s8fzAQOZtw}q3EB~H+7Eg5>-x|v{+VhcXhC$U#HE}w>w9l{uW5y1wwE~ zz)Pm*7~CFdmyjm$NV&PiY6E!E;Q@z-eF`k)5s+c=UXH?&J`^ADw4DmQ9`!h)R=(VZ zpg)?T3VU#*;#X!CE+xyy|Je9;ZVzS-*(cua6CsWaZi#lpjqI@qi{#B6*fzvbwLe_i zl-AgleU&`FUE{uaX?MGSu_f{TYijg(3hveW7d-Yqr?qh#L$zqYp^niq}ir7cPwr; z=#{CN^zFWYivpJe7;_v~rO*J z8#R$v%k@5{okxNuYdB=Khd6#+>VS%3Jxc+3Fbq$Y@2n+wE2yecL8!un#q@BJ^JeId zSZ?j)s@_nNaK3)93^LUtvh2(@eCTI}*HqdmT%dH&lz$G~1~piZXZED^{^;D0)ZIPb zo1l+SWXQ%zYAUq}uUEVZ1+zg&=?Y=#Og5S-W&{ zUOGAsm^;V4b(bNV2a6Z55@gSR{J9R}qQxE>z$#%>4=cV32VoY6U>zQ*3VTbE*E0j`*8G*Wp}?jgLnS z0J9Vf9|vBGbKeXn6~1S=CbTyiY*L+LlU`Zi%;|x(o42vu7_ze6@Z;L@9DQ7R0<(2o zTB_84$f1Y4l>3F;m`IDHnk`OjAbZ2SYWtzHwOV;Cl1epGx+!vSdzINx*)OX2 zB)!sIj;hh!>Gn@NvbgCH;L#B0UIW~kHX=CU?0%X-dMA2$NZWx#3p~54gf3!)B{SOX z;G2WWTW-vQ$}%Q5Elpf!%FE7Ylare}jNlKj>)_lP&&3eo`@suAhK2(1i1tm0tJ7f> z5EhPN6S!YysYv94?}~w=5Js?EbXp)g<@AS8F)&~`0?P|dc|Ovd%BTkfk?qIOE}WO z#uGhK3=o4f!Aqxm?MHIF@jn8wa9hp4_8L~!jNBGlj6Fenc#7cc2y1A6K;yIcNHzMw zFjO*HDoH?0pE!Bqqq{r+DR%0D)I360HM*lf_Xy7fR2IESVynPl2_)3+UGr39IR6H$ zPy62=KjQU_aAcQNA4#150`YlpDk5P<5-L$9TuPW?f{CvdNum#rcoSJPQd0>C^ARrjEkplU@9be2HytW zl1EKHa!5KMBfBAyUJ7)ZPsGJLo&+Sz6N8g!Ols;$Z&BL$a#r9(0G4&pt!lIqE#rct zN|vfEL@ER2)x38*1MV#IT3gzT4vbv~Q$~1rmq@9o?g;v|IFC|Z!Y(LeTCk!G*IIBX`2nvG&maUVxJqbewvl*VnTe z#^G{4raYijt<(f%&aYo}62{q<7Zk8N=8h>__lW1LCu+`xfY#Vnr1Szb!u_}egR?f$S3U_qOTIc zy(C0LuL(ZGsSG8K7{mdhzM7W&Y`|3VtcnfA+W+o{H54*W1+D{#fr6~ns$ zc{GaUpxj^#%yyIpFTh+`A{T&4$0~y_F&X6|AY{OV}I02dyL z?98*?$Wf5ZYMb6wp*?`jvElZ^b#~_~tNa-kNziSVGg|So#Uj8CHyL!kJhd)PKW&`kyJ?2|-Bd2CFj$G_{khUEr)4-yol+-!L0Sr~J z3+{1)P%+zk73l{cq-H8GGUMP{M>yW${JJ*tp1)xfm4oXv7D$A-%^~n0LkmaDfcIL; zQgN{0t~#kBGgzX4_uCbU_sz*_IlO<0e{GtAsy>kiU-cx=Yrd9kC}Hlv>~Bw9kO!F3 z*M&OBWq14Gys&i)`$#jQaggLz-! zZl@-gk`)1a5}2gH0QAdz(wcwM*C|$hvjE_kEGxJM1p^sM()>d&=jvS~pe~KMMRva& zId3qjV-q&PL*w{%u*FX=D7?w&Vw#WqpXzGGy*;Mi9jl%B;|t(cfu^VtfaTWuY!a5G z`4G-pokBM^{z&M7K&{Bt_>7G1)N}oODFcJF2{Gw6ZNHyI8yRySkJKv@H_N$xwSz9= zr&jyY6^Wx+R3x56KY-4D1cLy7;e*7D@mE}h8djrB>lW{vTceMMEYKx+i+<5WWb&{83C5iLoWA@T>sMqI`8(xaLGQkQzh{?C{D_4gkTGm;V$H*I~1W-!wHOm4#Id^E9}&#YZmMOCYypE&bIYjm~B*~_wd zEmhLO-W%r3#_ES5THoPHK z^j({|FF_^k(xi2X_AXdKLN(epI7l4clz1XJMVmK$=k94IzJ50iCnVK($CSU}g#pdG z+TM1;XF&Fzdze<71Fca)LIQY5u-}r_vJDN)W&5NT+1=36QoFQd+PCWN?ylFOm`CVR zDuLt!)gE>ZaPvh038AZ+-82ABD5~GR0=q$9*m6#@mVk^mW=%rECK5WN?@$lIM*7lT z6Sk4`e53ezF(<=yr!!0!pveabJ9|w3;Gj`qB=|9bb$g=GDl~LpkIFt644m{LV)!zU zdRopth#-%y>h29B!TPr~TVmLb$M#$ofcY?Bn##vc6|(el5aFm>DG{W-X2A zhwMdXnWFbOjfe8Yg@@bPUO6h3#h=bB+n^8|ajAOArs@YzJx~pSfmIE0M4bJRJHHH( ztKFnlzER-*xGPqcU|FSDpALJU`fgtjpcsDXi7d>_Vo=%wiMYm2PkMOC&i4S>aXaPD zTq9|~TqQz^eGkn&{_kt0ocqGYOc6e&NzOxZ!qqkqQ6V3hrbQ{AUVOQy>FzD_UPppb zylxZ6s~cPwo4WO!b`A9PiDtzqk9}azqd$EdH73e# zJb?j`(Sz=tZjM<}ShBzP{Ofl}VrS)WU z2@4~BU^%Tf$Y93?rFAJ7{@Mb$cr4)n;8fdLrhxC?IyBZwuFj;-ZqDz7AII-A*MqVm zY%%ZKH&dlona8YpGJu@=L0gRTG6@QcE`2AyWl~;bnYv%6YV)V%V6SC-6{_7Eco!*w zb+#PZA|c5Gt9#KkbXzBv1&=uj(KA__u%m5F1XJ<$hQYE=XC_Od0}&IMRk8XWc5=)TY4OLAs5e|nT-!GTwe7vf2ls)+|WC##!i(c;@=9n;E~(*{lHk>^lH zU!tIB*Ru8gbOKrnPz;hVxTIhL>b|q;M=J`5dVI6ZRPc~V%t#hbZBB}b!N8#bk}S~h zBqLxp*+2njN!ag@@`=Qj$&SuP5OM$nj<7l7HXa@F3bAPNkR7$oE3wBJAvjagPaJM3&B%kS)sR&$gpB2d9Hoq7nVvRd29r+o~o^YasxoPJt ziZ`96qg7hSH$tQ2xV40EAO!_xB{xD$8%D5Re`m*5z-fomdAmVf3Yit+88EHN7Eu&! zpn-XO?iVKOR)>^!!V)hpoj1E@Y2&uz)&6{DTJYCPL8tc<9avmH_RrUnh3_!;^923f z>S{I-x)spU?p!(>e4eA?o+zhCAwow>%WggTo@WGgr2)P!uSvsS)BmYgVxJ2XNqAf! z$R^Gmsl9DN8zv2>#idJ^LVC2(X-O`T+36>uIh9Vw5698t+2V(@|9|G`7Vaoy_4mjB z-5?(F-~Rsi-x|aRGg;$%c};vz)s^~>aKedyGszk!Ld7dmm-tZ?%wHdI{%)V%&oZf_ z+86VCiIE7^-#^|-@ZW?l|N6JQ@C- zldVq-!X6M_FI0)V)m>2T4o8EX;y*5G{Qp7$FrHPePZ_SOL(c>?0wKm$kh@h~niQEb&2Mv+j$O7^d#nFPF+ zQy=t1yjo(Tu?Y0!g4Bc`hD3Ct?_zJK^{k0TgHOh`3e09zRU;h@I|+UCAZQpJ0E@+g zMOWCO6m;&eKY=SQ>|q>gK~pqVRA&5uiBR#_pH*Z zi~t#E(izuR%V^RCwkF^B{2Dbt4-!en;5dXx`|(uoYk{3F+%|TNVYp0{m6f^MIwws} z(!O43eSim02^@`kk}|swMIwu7U>U$10@S=Yj*=pv6C#7@R$?9~nUu@bhY7_i>*^kL zyUu|a6GZhA4&);x*1VTtxE|K>^#BKDfjJJmUm#!p4%i*cmF(;w_EqKQw3Wz8*6Lx! zva++kvAtYeVR;s;x~xMJNC=%ba-y5^y~X7c1D>o(s$TpDxQT_Ep{b!!VIBrm@iG0T z_O*2pwc5Gm+fMtd(Y0e^W2MY)JlWT2*}+@_h7TS4$J{D?7lkaRTH}tDCZ)lm7$_1>=jO0QjI}OW|phv;%R){^an7Ok78+-S*zk9+u{VkyY7-egA^n zeOH~1BFMqfd=V~>z9@ASTmP(RENT#%_cXSU*G|05m*%MoZ(dvpD)w}zo15e(67 zx5tBZ1*HK>lYSEt=!eSLVYule2m@@Bh!b~Yogb9dGm!bjLbn0HsRun3SruxQ1U5)2 z0~9TzFurJYq{dWOv|NRWxSgFHZ2!C_TaINb9?10p|x#m*ZPma z!JcqlkVEOJP-4vllXjxaM+)`TFDUNuUJjy3y-y4hO3yBkwNA|L%3@iQR0@v*ouYTU2yR zG{L=QTyi$y)hoQMq=24dO;33*b2nl(?aR#XB-1d2QPn}~$@ji)>B4Fci?pf-zsao` z%NgzbnTqadON18UjG)x!6ql!J)Nv^K+9y5pn;Tqad4!t zUg{*O>)J>i{utuVFO7SZ(~_}~2VV#CG}J%IE@yluC0cw9UMG6x^an!x5e{!_AK|kt zluidbR#mUdIuK7Wr`z4?Z9MR(jPk=GM*wC5T~Erk%FgCAM{maeA<#p2p>v;8DM>WE zIycT~#x?Dihi^!Rv`&A%jEL8qtP|3r-TMA@EVON?IK6geSVvUSFtGTbc>-Za;_Vtm zVK*dt4SwPJ`kF0($8~E(_5fj^*!P~SY)5W`85mE&Hp?8^ej^oZ%)n;^M%5#U;l@WW z1C||Mh>dk5FRf;F@ssb1WS&&}n`;Pkfdx+5-r3U)|HzG;6l7WnydNcS~$ zA`*W>RLrVozkqx{*Md8WDhL;3rH|B%{%RY1ZxMich`p^HtrW4e#4Pg)@4h$D*!#Zv z(UbZ+a0ZhG!Cg{%G}e^ir=jj;qNVy*=6A-SZ78CWRc(TPf*$t&%s8qwo3%U8t=4Z`3*i)=J_RSd13bseC94e&kj$We{W#c4uL zG6Q3vZt-5H(uLvZOO8IZBNo$>*WLty(D!@neNQ;So&w4|8Ln5PKa3tdhjcn<>_Gwp#~;u(S9Y^f z7t`uu+9j^2ggZjg0ka znqZ}pI7V#^*uWD<#bG`V;{r0JZLF|wV6o6GQoSAS@Y}$auaBtvB#&yU)2grou*Fc#= z!Jphv;FdRObpJ7h5FN#G`m^4z`)(2-6~HA3YX~{#{kBvlsLq4&_U+FdS{6mzF;s?| zo0|qCE7j)5+9pRZik-R_{A)03A~ab?%z}LCg-Q>Qlg*lo^zdoekRw>>l}ZULZdmhqqFlma(?h@TYOnM!@nZi zrAM-Asqryr;K~Xgu8Xzf<%_=Sr;lH{A?g*j80YvHri;M(KtWqNU6&Nx_OqKtw0w#B z(Vo$cXVFf8;Ni}7)F_P2?rOY)x%pYhABjBG|3h2UP~h0HV|xA3`&o+Q*W%MIfLfb_ z`c~_T>BgL*;NDUdEYK!inB_82J8!*=5OT0ypkO_mmzVgAOD>e*xnmJF&&{$;5zfZn zQK$Zzl&jNo6gtd;>g}|{*-6C5?$nRTH)z!iQ(9m<&6YB`g$@D#@ISyPVTJ~Q42m(& zSY+Twb!k06Ddr~b)LLhFn!h7l@R-}(rn~nOi`@Z5VO@Rn7mC8@Xq#9)&H%d?_c)>@~~E}FoBR3i&gIkp4m(6$kYM2u7i2HtEb~adj7e1 z=hn=Jq5Ak~YqLpR{0T#?umaHqRa`vt_(tI20tr1LFE@O#?b#pe60kj|+cX0p)nnEX z`d2{BCm4~F8Z!kTscGQMc~&;U2)!BPi3Hq-5t>>a8yYb}YStlUru_)E9D!+lF;(bh zexN*K{2ySN3)4UkEFJ*O&enkNp^+o(-=GoFAyzIUBO+kqkM zI#!DVMY8)?<3av(P@2i%IpiSiH=MB|ulORMX#@DZ$v$4~*x0&#$0z0>k3e1pb$`Lk zi=HHsnh6VCK`Z8t8?J;;d)m#f;_nK6`Wg6odo9Uq^{eX2wx1vMsQ4_EyX|~l59?XN z%OpP2=A!T(VbV%p(X}Y>@zHB)QWBCxy89t?2Vg>36+Yd*BKzWnJCf-%Z=k3_p6kB7I1F+uFq*?AodRh0#ecSzKkt$-^Gr@rkzLd61vIhJol& zWhioWTJ>^zkul`tv3t*33&6uADeV=q{?OSOaqgBs?FE%rzRq4cN3Ya#T8z-S4%H+mnINS0 zrG$h;NYo`(l!4Iyx$e5GJ#I&g|I} z5mK}7GM^pK()X@upJ<$#+C2lM9U=H}cvMO>*0^F`Dja|PY4pCEiWhjVb_5Z-T{ z8!R)zrXUlE-fq-o<>!Bg5)x1(CCmnB7D}edor*o1ZVUz2pcd3m)Pp7(irnF}OFXw9 z+YEvM!AV6OQ9#dOlQ_AWSWlC#j-@_uo;hy{aR93aTcq2L-~!Q|$-`)(c^_UQyc(J^ zy^oBr?0?rP9ss*IsLWhJ;SQU!o)mYAf0NWFZ>L~>F#zJj&b_hckgSNUfwA|^DktZ} z&BjnGdCi(zlTUX$pND=F5H5QbFg@tFYqhkA^_#z_cCbT}iNEwG;`ZUtyJC|bIztOM zzw_kdaH|F^-52Fcw~&@U>grC2G6xkCGfJo?gY25*!mB}Tcwxhf!Gv|-!xi8Jup1L$ zB>KoI3e$$mW+WAu3=22(`HGP@z6nd{8y=2kvry79OBp{UD)}nUiMF8=+{*v~0Rq)G zkwlB%fzzUQ^98B>Z`@+OM3ksqlZwANeOq1&>m?r0RT1A-=>q(dcmlDmbCf&6q%Z{E z8Gz9^lu#eIe%I{jJhNysjO;GJLU^I;ohupTxk_R8>pG+ETyX&vYbkIhp8KYjv<3xX7QBs)d1BT@ z1S`>>50+AfJo*PpPU`v|3~ibqMCKUahC^IpGk9iAu2L(FNXH7-a{fc}TCt3Bl7ri$ z_)Vz&Lid}egY~#FdJV){P})OFN$2JTU|M?6U#VHl7iN2@rKQ!^z&eAUW7U~VnqxN% zn47fV^4k@K;9q}Ce}mp+<)t_x?(;|TVpCL43rqhrtdyxzanT`p{l0IXFGb!tw|NRy z*@w}kN7v)FabRq=;w1O@1Sps+GV$4vYnpqDmi#&8`X9*TZ8bz(8(Xp`G59&MXAe17`dr=b6+WZ}D_s~@8*VHKpzKE0LtGmek+Zv3@ z2CrWq2LcrdGbJS@YKWCWldAJDl&U&)oIzBekwiExHMJGBO;66q%zOybLBT4M^IAO? zMJmvZOYR!#$D~2I6Tp>`d4FzoTT787tui0w9zmt9b^VfdyLQ}x^O_O#-YYs!0h*W{ z2cZ%Y4<2_zqECpg_*}`dXNCCJr@%YJ&Z0FfLEIEays&?bW>{Y?oQDACW|O2kQ=M64 z`_#nG#9SgT-oCcB_C-55lxi#_@8N)p?Bx(JIRA;C1CH!Xdk;iH*FBRj7+YWCKht@^ zbpW~~pldZb`jT|&WJh9JbF0$T(~*4XEW;eDdM^d~jKrK7*k_crV&0v-0fi>Owx1ff zcFVoI%zr`}!uuNIBWEzHW|7WR92VOzW5$Gbk7w zH%o?Vz=ynp@c{qMcC z-n)y%3YS}Rzx#dX+h?D>*;0Ojf*8J#l~F#w4U71W(-rHWZ0Xc>V8Dlj`oV&J_)yax z@FWNc-n<9X51n+IXl22cQU;$NCmSA+H5B_}dxxus#A!B0j_8z6KCN@(_$vz_DA-|f z1DeL)%SM&N2Aa_RIz79~{6? zVwcvJL0M{7rmFY&4x?mEejt!=09emU)P;ms9i1%-RZ8|Dy=_T``}v-Kd9J!Nnig&Y zI6oK_)I+uoj5ec`TEHRBV{O$RGQ$8S4+6E6m)b7Fbypik<&^AfR6fpTP~B(p8#1?; zEAdB7em}}A9!dwmOnLa`M$$sjy=k5i2uXwJ3B!$q1uq**EG3O(%d%T2a3L=sKoCq@ z4%M6*9nDiW+X+$I(W7jQvX-Kkh95w<2>^|THqq}tsyqIC_cQ&~C8Bcy% zjjWMI&G^FBcae*gWllGFQH6}vgSPDP;|SMUQvt7%wIBHuUVXkWm`c2rZyLMZ+926E zvkX-vM(FF{|MdWTE&$lvwQ#FV8T?gCNg6|&=%=@Clm}Qn-;!kxjBn@+40DVfZXJ!* z-v=FF!Q?iNU6Ea5%^?_WS?m9@Sfea=C-Y}*{zng~`e}WaSH>2Ydts7etFV>hKJ(%~ z=VB1oXy%bQ)rI+GMj&XHa=hVmbQXO~JWRaVyJZD?nF>98S7zIS|1P$J5tOxnk1|+v z@*#%*Qlrs(j-~b-YYbdbpp|yMHD+NSSqZZ}Q;0;hp{0&5$3#HeIKy>04nyF3&|i%?33UR_s$`%b z-*HIBD7~H}uY1$QPRqZ2tVJl}v1TDTaj!F5p-fbGogJ7}p9x8~Bf6u&r z`U8MM7+Q&&`U8Km*>yz!u)v-c0mQZTeU^%2yb~J6TYK?Z(7^^->yeD=TQa}!ZN4)W zG<90ube zYb~&*h=GM<<%cQdXJRx(AM3)@#qPS{l*C^9gWJHr6hJapAc~6ubFFjb;zBW2LUxI2 zSoiM|FIXS7L?FsM30h_=PKuu&sm(dm^P2 zc;Vp46Fmm1pNpfYi*kkYuM%*lWI9-TH4i3z=l#Ot2l(F_{vikk@mMs&S5rJitAJA9&kRQ&Zn?ni;lk;Qz*JpsDvV z3ql+k_0)DGnKkL)`RlKH9@ftl=VDNTA}6)r>AqE{dstDm`4TA)V&QO%X0nAu?L55c zpFR3FWSA_ozpy#y10SD;y#zKkC#HU$VlxRDp-KS0w~Xw> zKyFYFaykppoj_Rxgeeftc!|75+M-@pxVXQgqS^wR8H0uA0+;Jbq2l8ho4m4ClY7%+ zRXM)?$lU5u*2me>jzXvT#)aw?ign}2no_`3qh+!%_2b>P19R{%FXBw~x011f^}dE% zUE|y0B{q@)!B~zg?rx4>1g0QTTTP|CPT`H{t%qMi z2gXe{YyRV>vh9-Z-YTAtdh&CS_lKmbSF~B1dd)sANx4X-bCr4JP50i5DBChU!)Woi zpKdGtbZlnJ&ys66#D8Apc;Gy48Ebqx^@3#_IJsK7=Kx=^7iW|OzM64fE@zBIU-;a- zEcyYvFpnj@@b0HlPf%d ztko(1WnR{sDglhE^)NwLb7_t;Ue^wg>==zO8b~X3#bXGSROfA`b}{6fZ7@kka;9&s z_*e3AjpuhAiTZQmYs`>JP>@r-XS&HtMT?}&yjk9(t!-_6iys!!4lC$52ieZd0NR+f zRb9CN=FF{4IH!|}1%S7R>i5~XFAeOh)zm|S{CSz1?xb$18(BeFpXXliK!vxV8@Xb? zp`qb5D|<)}DQi#O0qgO|YNT3o-p|RYVe&Xgq=B{Vj4IK{xU{V75DP zw>F&?o=zVOQumuZwMYHMCq0RtU{aj*y7}7dg9ai~lPT}N#u%ZE_Yj8~UYpWl@T*zk zGT(-F0x;m^k>CXD?~v>WwfGWx({2VSAmQsQ(F$V8E^5R1$Da^(@Xg(VMFLbHxG}z>8}nTaW2X#fGY$&YI_F`B9R0b53l)g4bymS&;@RqOCKB1r>1=&kz zF6Yl&xV5>hwKd)jWYxQ3iyoLxtW0fnj-NwZ5_afc>naT$8TSi zPZ3=7iRX#t<8hA&IezML zU}+yjN-5VXZuZH!h$d6|%rk`3D7>8FjX5OHIlQr%CqAs6V!HY$JlqhVDO&|6WW4xy znF=`%Zvq9UVz9i86?h~{L3mTev`zkKrJUfh=J3v<$6#1ojF*#@jk__RJ+Tb68#%nZ zm8F@zL*wJG043UjRfZF1x|UnC2DV<~c30bk#^<50qtUYCO2n#mNIvbuwN!*Hx1`H- zNSd|h?<$%ECc0@{&F8#Y#OBzop_Jcc42sQ9XwX9Io=d0L^yz^YS*1r$5kI&mPY3oI z3<~rgj?k}N6zv#YKJ8@WiW7HrrNu5?`*;;@#JzlK@E{yNAQ1wbiiA>}I7UH1;mgY7 zK3pmQi`95mr3Onk|MzEJ!DED;gU`5Ey+%xWyD5Vn#ImQz`ZbD%Bixkqe z9z#p~ye~3$8m&!HU%k{fv{*?EefWuq?{_(nJ}EF25woOz5P_LywDj^Y?lDt=vRuGO zNIVnxt+r;p@(i+3UWFe%CEF42tFH{}~&Gp$leeT6`S z^E!=sHd z$Z$Kv?Cg9x^JKb(OBXu52^Jv35DdOHEsC*>fyTM0p~Q6Ew|$P>CW5*t74gL6lk7W8TMW$3hXaq%mElBz?7{eA4FKUe@h(ob(Y}u!T5Kb zeeyu8GHyDVCW~SPb^q;W_c8Oco&;CYdtmN1jE_4v z3F#3>s#{`lxX8M?vtV>b=kF)rw^l|BsT2T?MJRPo76U~@9UU+Rut`F9r}(B`@W@aS zd|BLAB>r02o?Rq!kbueu7FpO(Y)O_c!PwO~Qdg?@vcftN(bPb$^rcN9e%IIve}`$# zc&FUrUAci@;N5DPoOEqURDc7hPQTrI;_X;u@X`=yp)L$u$-auw3x!N%$!%2oiv%Tp z=WTp^vA6u>VvfHLz+Y6%F1VE8nps*x&c6xeyr#?aYAmY)0zk#pN-S$7EV{$!2Ay1G zeiT_X_MLWjnVyB_+oUYIY&mwm$W$d*7G4}$Q;gk>8#hS3+U=qoB6(<4?#2FI?nv?_ zXGoFWaPJ5S3CYxMC@wxhwMZb&@`@ZF8`NBYxHXP9H7+g=g}=^6bi=FhJ#DeC^GtY` zkO*&}w=mY=l9wZ=@9W^|n8ii!$mfXey3#!6#oXLnMM6-IbC3E6`M#c0%ESmu?sBl( z_5PVf0ZRlZY@5+>Obq2(SPE)~pb$sjpdTpSX7=SaLQZ+| zC*fyWrkpKM3;^RYyE_4)|E)3;HzSC32?A%`mAd zbB~u?rqc_?4qt&D$KT%!Cdkq@=tUbi4TkYopIs8PIS%mq&fY>WlEvF)^0R5Ed@JZDhi2HJ~e9 z{hY3G(lcq(oKH2@Nv|x*z0MjXiS3LKPz3?Fz}2~WFVJc6tc_r+@PaOz)Ipu;8}xAstC>n`vBXpCXmgzyZ+& zf(41(xq;FesTv2aG#H|jgajk-WM=RH!+M=U3a?oU8yW7w$j2^@Coiczzylxg69P(n z!_9HWNhJco6pp;JM6_X7xT6Sv#LBNeR*{jB3TkS^yiNTC!Wb^bOccBH$M4wOQbY&UKlmJCy(A&(*uZ{vu~>vR-?H^JGf)L^uq_^!^~l#8^47wYO>xDRb{7r16W0 zyJ$D{()!2TV4laIPS07ryu43LfZ6+iM@`GW%^`em{n6P&&pTcqzZo0j>a~^c!_W(% z$*tCN875!tX$uRtuWxg#JZJ;srpZg&ux%$zv6{)t;yW|zlQMZap6$$D4I@po+84?~ zVA`2bhMg!pSkP==m~*{4v)}P!(x*NY9N{;Spu|qlqXM~(NT>m607&Po&M*ic zc|m@CY-$Q2ce-ct7@(em`5yEp@iUE{Vtrh#oSd9F0$Z2#U#_jKy%QU+Y+*n05iLaJ zhMl5FRAt1&)#;jT`)v;t@HIS;STnlqyIaHG#En|b>XY=Fnv1c z*381OF|s&uFB+l0kv8?cK$*_|){`$xgE2V$I3c*^!8Z2^`c`(x*!eMnj2Iq_(ASrX zxkYm*6m^0^?`nU=DQ=*fSl4{CmDv?(7$X06Be%8>uO*foTSP)Y^al-CEdbdBP`3?Cl9KQSt;1oFxM_DHCLb|aNlN|@OgXs2? z7mvWZnlrx)0uD7D-j&+L=24Fy^Aq~}kDgi2wZ^j(8sTr@8*%EJ3Gwax0#J$R1&oJB z`w8SoixKX)qT=w1)tS`xoLo}8z~LP{NaCAk&8QSuFtj4E!=9ou zXu=z2B6Z;DdugiXlK1ubq=;k|>u#bP7YCRBY(0XSdVJ4eH96dkwIfT26A2J?4+xSp znb1gk-vu)W2$SAs3LSaX&~VOEOb_mGTr>BvPSy49XIyHea(d>GygqrU9A5XSo-tJa zn60kQ-cHJa8HeHr?O+=VJ)7CJYsWRRMKz#nFgdit*4eqS`ySN?l)m4oLHBUr7u;_L zCN`Ic4SlnEgPu5#E=Gt{uwGRr*}31mApR1}r64R+vYU&3UpWoT;MhvCz|R0bU-AW# zm3?fQFN2a2+#5x$X3uy@(iDoaH??qrh^0usa08J8OXWki*XMFv?Ck1_+eVcLOy_o` zKf9L_or}#)vtZ_uR<&iy4lc66Rw1X2KpH1M@J3W&aw8V$Q(ph^qeYc^)yQ32g|Ujf zb6H*N=fhlNwl6v{;!)P^{)Q8+>=C=9N@LD%AkbmSHosyI{_+uRX1=whGhy*$cZky6 z;1G`4eQeoa8mQvAFj&?Is~C#igh{57gU8^Q1<3lEW#ZM*b0#voGA^3=2ne_IXL!&jzSClv7^tXfPXp-TyfF8C@OVe zOzQi=2K78v7i;*f503Ju$SR&BeBWzu>{NizkF%X3rDQ4JS-Rl&aoztw8P~>IzgPcx zd+Nuq-#$OMpDVP$jr`a}{a6yF#Ix7U>z~g2|8j%>!?!2G!EuW84apms?cF7_*_wSd N=gu1G8!n8ZpwggpC@3Y;Euj*kl!St`bb~ZQJP6VPB1ngT3@s(i5Yi12Bi-FG z#8Cg9_kF+jJLml8U+1j#&src1GxO|c?|a|(bzj%DJ*vbBkHPsYg+suWv+vJa{GweN z(jHD0LfdJrkTrZT_P?*nTYLW+Pe#da=-`&jpI=@V(|L4zFxKw!$eP(zkzJ(f^O&WjRS8XTmAao~{`xcKY zS_M^ln5AYo9?Zr5iK$O5tBrX;mt5-HD*@TnBaXIfy%+c<>h`_f;x=0qCqF(+X$`MX zzC#c&M$s#M*iEtW$3tsy{iH^+&#*`FbxGZ=5f+@!kN2-*%?vy)j6vyg=pQSc`@82j z>*!CnY?CdPOYr!d+NFfG9eLhgcI+yP?SNe-qetBiZLL-x_I>m|4|cc_G372Wb-n}9 zx=g!XX(Nxpc*I^`m?_r8WNExK_pbN1CXTMf2p<$aRAoSY8I|KIV zYCyz;bUn>f%Fk^gSVi5{*GB6RDvmk{yF$2&yjbQEYO$|ZGzF*r3?>G_2?oa9kUw-~ z2CcK3R=Y2n{Y9}nH?8!gM3ZC0DC?%Z@Xmx|-@EmZ0=NAhq4(Q}qY|W07>{#y#hwt3 zP^GlAbkrD;H`du`>XrHvf}KJ#?dYv7TTPCb+LVc6O?=x5ZAUsfd>jEL=1rFxXlY;d zn%~nCNKGw@)@0R5RG<&>B5QC5hOif=<^3i?TAo+$yFJt=xH&K}=5dv)-u2C4_q70Q z1sj6>&l28BN)@NmeT=S4c=2nDUT3tnRfoKo#kBUk7m5_r3*3k56-x8(C^NKVxavJx z-qaVN*_J4xw6e|pvb~NyWm*M&lJ9trkL9YNA6(GuE{v+VWVb*MsCsN6k;vHdhR&%e zy<<;_(LV#ff2UKqYv+f*P6? zvrS(th|uBc%(j5C}O9{TgiYqdh>LVc};7xjDz zM|$4d9GLO9-miHEp1<|qZVH(on7kh zTKWinZZwL+xB1ytH-+0#lcVtEQCHFa_?sq&GtWzw0Ff=C61GbR~ z^#^K+x4RTCj#HqBg>BdgqO|hJjKNYbbbBpA<#D}DODjc5!gSTHe?FYE{4m7_TC}b$ z-xbv~)%C^9D4DcIMRGL3StCK8$SOXNhSK^@Pi~%?tCnEas`VEVt5gg~P($voikq`Zn8D}Kkq#(vE z6PApR>Y>z@H_QHdGl{nGOn#G=JG>rCc==U1FLAg^&FV1s?NoQlQ>P}WjZ>J47|*>K z!*IC}TGEMbT& zVg^UJi7)|=Bc$!2Y|!#6zDW1{jz|y45mF#2mALLBV|6&!Ev&Y0{-NlNcAj0A=R_VH zaK`>ouB%&cz$}(xMfX5$ucx}$O8nz}e`Z#(c{{?T>m}EVw{zA{K<*k*fQ;gugYlQp z8oh!X&nJJyA5Y2qC4AdRi@Kzl_OKv!ejxZHdhVD-e@0(5%cTDp^PYo*5j7~(YgSFyx<^Ylnr@w(e%;f|cAq+6@#SNl_aN02Wx z3E{{ud$%lTXTF1xB|yKjZBgLH}DUv*zxdN-`2Nmqsx*cw|?pIyzSU@dAy zJK>u%n=SbHY`p%QrZ+`Ak>cCM7_u%v|7?z;-I!O{A1htmueS>^NY1zSd}rWa>k{GB(&wT-2MKcA%4@YD?ZC3T)#FSPxr|?ei7flE?D<@ z_*#~@-Mv8DZYlt`kKwjuRPV{?_rE6{# z7dSEnk(qCb-@ByPj>rs0WbrJQa4EXoioT9V-mttMHkv)$*!Xl*a~=gFx#bV8{?S@c z+vUkrH*S_>pz|B=Af@jVRf}U?Mf00#SOM$EOP%+3w$4Wb_nbvmtwGSzq#>2(KvcBx zZ6}Rfll(A?m3iZS-W!gD;Q3Tf6^FvTP#Ng^)T^??6mIPHI%iD5ex8yYDYy%EmDgI@iF*UyyV@R)#JXly~-1FKZ3# zwqy0ZMYhFv8#=+7;pv~RX$YhSr#TOp-*%}%kb8IMV;CY?n(Zl zbDj7A=47WaR<^#FvQ&@Elube6{6J0TeajsauE6%V>%!hT6gxNpjwy9mngtD!Ok^tD zjEw1_GaPqi&nA!kpqme6c;kn3j7)i{sDch*h@iIl1gAS`ud>bU-kvuNqtXYmm!R0L z2l}BYRhB*uKZ#0iOLJ-LeiLaFT_=sdczU^0wRA`09;iK27c;KMBT%Zp9S7p-_QfnJ zM5d`xxGP_N2h{$A?L3PsC6Gskg2t;gYylY`?P%wG?5SUnK7wBuzDoBpGn_m-Cud+` zicJ5qZsUep4}tf(ihQQnt$W>Ej`Oc z1f(PO@qKQLZiWB_Urth z#;E1*P{>;><_Ps5w(BPg`ZoKo$zhGTzFf0+o5~SkZyRW^INj}(X9MF%6oaVLO0$HH zvT}@CLhc-Q)t|{X;fnmwEWVm3WG8!m)jBFKj>8e6tq4mgfdCLXq?ONJ-37e%{v&C?qyEb`zUYr+l8Wv^2lS1~f%* z?AgGjywYpZnGLt|Z2ETPc<#M0?T(vRf|Kv&=4J_*oQ4JkH4V+8nM7*gj1+sa63f*O zSd5WDp4@3uzSr@LiN`lxtYF6>xK_DWI*SiBCf}SiNRs?4=Sm6&^_h1g_yo)^5$LrgVnNwX0XK#?W{=*-^T>x<-dIXAjNhi<|wY zj@x07E=XUviHM zfROxmA!Osj`cKivB5#+Q{j^wAwVTAm>Xw;$>`r5cEP7y^fj2xuFWa=h)A4QN^$z9M z3)D8bX#lMHw~?|ec!~o24DNAwVTH3fKP`hevZS>e1eW2{o!C#SQf~26ADQd-mszT> z`S-*@JOdBDkyLNjo$kb-n?3y9ZXM%s)!ya$lb4(ON<$;ifZJU3Q-RWg3jfYp-qAqLZ0 zJ+5$iadtanPYDKELR@NUYT_{2T@aNWi%`B+*)8n~+eeRw@dnzHu6v(q&vZVd+F@o) z&)Lj~@EKRwditY|`dE@hB1|LAtox6(;9#H}b!Gd3fC^8LYkQ866YBoZ2`vuBEJ>UMs%j+0#oP3~V~klbqwyV*$!s_bmqD1o^fQem~GO+NC>8b3F=a}X}v8gRYhHv*cCBpdI zUW^r2Q~h_Pc^dh^=e>2_5NLc(ONsVXy(n*bdvQ*Qd-w9Y<#OR+oqSf0)PT+7y%k|^ z45GYw&wJh60n$#TY;ats2z&8FUF@gISvk1DYV*3aXRS04v{7aRK8?u(MIszZ zSA4fW*1G-@{iA(U9Ka4t=XAr{>&NQPLWUCsHRQ0_owyzk4yZ>M@-BIP+d@kfyCVt_ zqLf)eN}^~w?=CippxJTrA)xV5!FT=Yw!y-f9!VLs|C~^>@@o4UOfh^|L@E2TqpmQm ztiC>jsHiA&HR~N^u_3!!KOeH5`Q2|-RqoQsA6wM`Jfa1d?aN-R@&j;bd?FX3n2BRm z&H-%1?-3fPI7^6xgyeNC?aUF;k#~(G?|}b3Mn>vPNwFs15Yp90ttA>l@p%UZt{mi2 zthar~H&dLh*kNH{_H~a*rPqJq>5JX=-x0U>!S3DR${7r>&@*2%QnpJ-f~yw#=BU46 zOz*JP3D0^NKFE@S<;^WibU0U>8WbdJ$et_-!ByV|2fh3bKfnqY4E!YcTu@O7A2zta z|CO`ouRk%D@<^tHt2NNf{PiAF@SeY(4|1yGAGm&(5scMio)W|>=8^s)?5Q32HvJkh>tP<$f<~TSO30w%y-3aAva-mV?S?V5#RD>uDt*6prrX#*qK)dup;HIX_s3! zMlwCWrF4X8h{4tOl)uZouhRKb>t33))gH;@ZlNYHf6>AE% z{^&#x^x~i*wQWEDXSKk12ZCO!_tRiq>@r-E0O)%w#bZmPsgJ?yK&5uKm1eK(M)c*` zvSeH5*N5+qcixSviIE1+c5|oZ5^xN zbfr~_o3a^XXMkkwH_MPqUfy6F9MId6=A9ZEAzNwQ_-2Ol0fvr1qaPrn+tr;g10e1x zG3`d4{NIm~O`C(k@aEED7(91AEP0i&R77gqA?|?raa%8_n6Vee!g8H*XTi+U!Qr9d zV&~U+E!)2r{I5l?3L$_Mf{dRiX!9%Pkv9J}WH(VsvW_f_b+5T%PVZR-mV{Qqlk&0a zR`iuE%twQtu3-(*&w=&l4>0YHn}Gg~1b&Ox*8Mb;-r1RY;J(z9#rAao}V5^{xi)XcN#`Z8|=ItXAv~EaVw;xVA&u{tdR^*CW4he z*(cMzkuGLw)GU{`vNh?`W^{4#nLB=erH6keB$pB&2K}8TFz;7sG3ZbH?^Ltn z_)Y!ygVcFA<5#W{lZ5&6O=}q*U*zl4Rkc3=8RD-;dT?{f|MX(Y|7m|Ve#7M0e;%*# zaS(rJ5X`lpY{UO~g!5m5Ik8k!_)Ha?ZvHzM^N`8~_~T25^sXn-%ZOmkh8yo8YLD&B zlfeIB&nn(iuzU935#RA!RWw(vUJdUd)4lf3IKjsA#js-kKG>oEX*z> zSU%E>A29I`qP#tEX=k=c*kR#Dk`fD6!>ql|5HDE4uxtNL(_p_*gm?grT`kF|H95eU zaROFvrufZzlNtdWiR@bB=H~W6>UnI=QT)6%YftIt=VxvOStYKd6TeQ1Vo{!(Y4m%b zSYtiP+nxN_HA$XdFd;>f(5{EW)A8*^@pfQG)JoR{OZpK=VA)oTa}&oYFq7Q4wy=J9=rS5A zL=J`CyM2qw8~$4vIXrwlv4>gTLyUgGK?LgwH|0m<`mpEp{BDC~nPumX)T|c6r>?FQ zv!eZ%0qX1~mDcBIo>MyX^jmW}ym$qiu&}U%qaoDH(P^Yo))g#}wH`fs1YfNDV_Ul` z3&wFbUg4Kvv3Ys&=MH1Q1A)B?UiuuWx!3%|zI3=k7>>cHq~C8stf~+fxX))y&u;%i-Mg{WDY}A7E&yT_2_TZ%>JN z7*&gFn~!W#ea;@Q5Wa?E3jI9umIM>j z=2-_Yc2J9bgn=y8lvn}SBH-oo z)u|CnN9gkl6^1tR18MQJ947M6w5%-L9QBttuoiDh!a%U>3udcMV>?N4a`zYbK|_%+ zv)kYQ`HX`S-_o}~7dk&ZvVyBE&mNu5I#hjrnb|))?Ei}Oe%}iaA>b1BRXPFt&NY(` zb*5LgL2LEot`Fd3zpJtVR?rybfOeryi2zAeZl0*X%PaZeLZ+ ziN;?GS#3FulrvVP+sDDd0dr0gCR^-v>T-O3QCq(WjaM*HhyB_g=!iXXpq6v(8Z` z>g5iLFAok5Zl66QzfA#RH+<@Y^83jo`L?Pd{-%m2y%A?7wV{%z2F z{EDH%Eh7@*0o+P};#y58E!ilh{BMtKdDrXXm=8NM+O7>r?rNj9^*{M!H_i4>xY1Cp z%Mzi4V)&*v!RRURJHPq1&BuQ>@UpVXn=L09AK`eFR>(CuIT;0K(PzE=OhY4fgN|h_ z-`u=^|Mc8_{Vpxx@+MJ-v1*-AJmg)d$3gy3lR{>`Uv6#FZD2dr)VZ*%%(LrF)1nZSWV)3i3te{W<5PUa`#Ey_h0qZgFciz zREFMT*sJ=-52eF6PJSXlI%a`|lFJ%&kO0l9Z3PXcoL}Uq-vW3E>PuYi?)>{nJg8Z*PC2qE8Za_Nw$ha{Soppfrp`W*`u{7p)Fjo28@HdPFtB-*EUp zQC<&|HZbEQZG4y!Kt$s68!44F7+hB;(c=NOaQmV|LO{^Pg*R1FTsPO82ogMUj)s{TgMkx#LPAE;;P!9ux5?DBv_sca zuI!_TBiaV~`(HVY`p5M=j_taa3@LT(&iu3^>^8%y-@+Y!~@tu3uPbi^rOn6e|?)$!C{XSYati)v5WWgIB4TaU162Q@f zET&yqIh!rmW;?$FtT12wvEqRY%$KoCWjDAbPkSu@!`&)R^W!OK`tL`02h?qdU^QLY z9_6d&sCPyDZmKofwm6aSsWqtDxyb3eg2iQ1iGxYV$Z$_)Nh{ce@RpVY9_C5F6b}?1 z{hSqBnKJ}%1IqT%SXFzor;}VJMG~Bb!D676wnOG$p{W8jXfE z>3N~)<=1#WW$&+VZzDb7^`Co;c@yZ<(0f$62h?87opDN8nBsPJ=3T$E^a@clT&Pz3 zNfl;LYlyFdV9;6H( zalBcN_pVt(mS!_qD(gI{vDF4OG_(aw{z4c`n6_8@0_>@mx!Q)hdF#)n_caP!*Th;r zFF(0^7c%3Fl`=A75~Ek1+B-mK4-a6Qo`!&$BjmJ(9+)N`wHDMYc+>PPYkX5yjK1#~ zUY&HtK<$(XdPr)mngaD^$P0yd)<%%wHMru1Itr#O#botrXR9f1YxTDEwY5Fp<5eeW zAfk~StgNm^A}EHVc#No^;YEjzsmwL>Cuv4^L?S|u3uK9Rg(m0kWeU^`VZ{Z*tDmmE zGi~F`IRCxs)H%_;2Kza_$@|2@#m`QiGh-&;;wZ*}kWciIs=$iL66VtI+1HIYYU4=Ci7;wn*w2>!g}D(Ln9-d4nHd@C}=+jr~ru18;_rxn_J|z zYlzh_*AlAo`n5m!T}4P?d%S|Ha8{Z>dbL7@H~!_vR28mpkxL19+ zAkPdB4+pG%_%+LoMx*zB-+B=BLNPEyD8AOVH?tDxcL_)-Gl&T5 zc&n#$5u44bfbacqH`l!1U}^@J2jO-qn$`v)*k3prqMf_=N^wzGb|K{HxmAzfg(-d} zDcb;)&@iN)BJivG>NeyZQl@nT@sK@L(FjDSu>0P9OsAG4W--yuO^$)h>~|yOzExLK z>lGroBMk17K2=jAQ_ZpZku>yt#O zlpoWV|2!%|pYQ9-MU<5e_Q7KD)D>6sV6Pxuf^wOva1o6b?sq)85RgtlMjaa;e^)Uc`7+b^vzG1!k@t?@m$jH4Q@=@Dt~gTJ z0#}zB-6@|S8aM!-7-WhBtmVqqR`0qyZA6>E(@`f;g1{yfC;iopjp%yBD|*e0Cq*;+ zCwo_6yKXvz#OcVfvD~*uYuv6XsgFfPL+FLBe(-^_AS$agprg0N`X8I#3DXifIXiba zp8;}jakGsukg3q@$DbI(s&tZUkYfdhvWW!v80m3X%F8N03{MA%CM)%n4S$L#)zLWMTlkmz-Mq|AFq+tSfnOMK+( zFCa0#F)m1E>}Ht+3+c_bvA2fJys8em1a6&uh5ctoEgrgr$!0i+QwvB$#$-n^#%XG6 zTP1i)@pFKUu#Eck`Y7WW;(<)YNAHh=nn3$58sB81{%}t<8vwl~*?HAEyNdBem`;(w z(}9^nFrR(PQEd-VI=^A~&bfjeH zcX5{VFB_NlJMh>9+?Y7qhw*9+xU*MB^SnXVB0#ZYIrSp2DKa+dx4C(NmIMjbZ+(Nc zeX9_Mn~aqYyrVRs9|JP!EB;JyK;7@b)eoMicj>?AKwD)iMgHKb0edScUVAcp`cS@gT;~Giq0Kp1=Zj7Msv^4u}}rpp{5^y z`dvyFV^u4BX6eN^V;>gc+JT-xFmbrMw4k71A^I+1AS9)fsK9KZT&%#H;jU|~ud-jV zcBB%COU_+4N(T65exlJ^flV^lS-Wmxg?e~vuJR(bD@R`E5)bP#l$BNG9335}iVMoi z-*CEKUYuwD_#vySo4jFDYd2lzo1^I4`0b3&GDC(jvj5DqI06q{&AFxkhM=ezmZS`P z2%Zv9>V(qy`FTR?wR0Hh2TznHuduLroO~s%W%AVkyS?FgxYo9eC{_EQI{$%l+G#_ZK@k^CXvXHd-bfBCLVOJMzJs**H6W5~BM zl}BWNlaET1t!s)Pl=pMVYAHAe%d?yQalOoE7VOcoCj#WuZ z$N3W9OR}<9w$TOW2tC8&EpVpUj*kd1FNEbTtE;)(rmZqL7I1)&X zVA3>iTAx0!tH`e*aN=;)AX)Sbqkw?#s7#_nk+IVrcV}S^SoTi5v4pR0Q|nb9jraHW z2c`V7j*&kwl-S9M-sGew9-W#>acwN@TP+|Jx}9$JZ<+(YxervYr3H}%3qP| zU$3khuIe5LQDzQ3dU}vcCRHUPf`{Vf@V`-haCDRbQW_4T*($9cs!PA%^s3W5SB&Xe zgJzfDm^Vtd|tg=xFtQC*;4MIxd#WxC)a0m;Li5hJ*)YJ=T`K-b0 zyu86{d`H{UlIeIuI-F)>f0#zTjvfuQMgZ_!HN_W?52~bb;VkGq-AnVf5@p4YW#;GP zR=e^>_H{U8T_L_gWfj%%fB+oD3_n;B`{f&YLMoB)Qj(f7H^k_51s)gAOP{Gg-42(3tW6| z*X>2v%vy<2F(m-)vm$C66qdFI#daX$E1rkTW|Tl@vKF%;Bpc0C!gNMmF^~KJ?i+3jLA7yY7`*^ZfLO*8+SHbI zva;|Tf{*kOZ9jQZUK)WtfczngEP|!0JfaRupzo`xsR1PpU_k}Hc|-Lmw8qOd=w4!v zDXf4=7H@62OO)4vGZv3X{D3&cZSLkZzeZn3S#0+jJ!~cICXE+Qy`^yf`MRH(vGTUo zxykWR{AG_O@IwU~ht5C+7dEkKzwgBhu=q3uPJSGKpG>qGjf97h-Dr-1G-=2}xd zx?|wRfI9Jn3+)mR5C8-b&=?PgGXuG@sve`D85pGXed<)-s7!-X6=`zBNkVnAb*3Zj z2D0DzNa{7LV>LP89eIG32?gES_rX;X@h1Z-_w3VcZ)<57(gCZL`+WZ4agS+f$tOlS zHINA*ki{pqhhWyFqccvTfMQlyZ!nK|OdfijJT&ur;*n~$g&Aq^N7HkPygpd^tkQxP zl0jeAgK)6WN<30jen_ZPU0FR2x!wZq!GtMrd^2Vpm}Zo@@eG0ksJ>>)qx(MfzGEDY z^rmk#Al56S0NE#@Rm<5)>K@uX;p?<1RBEA`mUF5DGBUG_Rt{1q*O)iw#iXeVy?&9w z2Y9XJ)D}onLr7%T<~x^7{(+(S?KG)Cj28+x8E(9O{W?y_PVa*qIdXI~KGycx_b`$n z8;;)6NIB`lSL6waiQtZmlS=?9STlc00T6UL;87ONr4Y=5+DB{rXhMj3?WD!97%&?V z*(xo7Vu%4PCG~iPU262{sJb&?+QDY)F>h0?b1a?&<{+mH@i5>w`3s;b+hHAdh~i-g z8|RwvD_FFlTtbOGK|ck$rGR#Jg4LC0>P-c@{_s`aY|lF+2ZT0niLh=+ph`*ln2OgU zYmbs>QXtyhvmkRzvZr^>72gQca7Iw}3NjERKcaR}&Vjk-54ew7Dj_`U zDjm)q8OyXO-TAcW%^&rZTY!Z+N_;e+1}Q;OcSlO8^FjXuAJ>01D25C~IuL{>KkOFg>xUpd%S=QYpyG+^0YvblRU4_v^%`O=slqtvTVR%*hU<>@Wgai zd$D`{GSnj@Bc_y4_8trYM=2%Oy|U|lc7@3~m2HIS=bvR+lSeF?CWqQG^GYJq1462I z5(2C1gJn(lT1FbBsVOPBt?!d(2pnVx0&1{RFF<8pKg~w$i_LQ;B-r-PJ8$|^t7Z&j zTjTRuHQ)4q=0Gh#kSJUaLJ5HEw1NUfiQ8|9!%SN!y&$2l)ZTxV0I|7r9?1_IxDME@ zwg?8U^~ZP=G2}bv9o4@G*3f-;hzrm|2@quu@!fj1K21iHJ9KHsKOHNm!*p4AE~RxR zK?i7Y;%~eU2I)7vZQTA?n|HzPyNLg45E|gW6DCU#XdH}JW++ZOJUj1;ZisUTn&M1* zC3pA(5@hPsVCBBo`9Nz80NUC#9`*_t&$>&^z@I;?)1Ynst&n$E^c!OCyzi^d7@N_# zl74D9#TrvGi9%FO*t+Un*p$V(Y{F8yl#EYcH$%DPp#}G-k_1%uFa6liu0<_l)C-ZtmDfA z%@X4dX$n7f1t7ndL)N3dSt&5f3DL-&qRHZuv&!xhM(VtjDNCS98Y)ZrG$)=8ka#!` zncPp0bhqo1jOL$=x1&n^Xm-BVu1Rk8Tb?-zbPq;?Nhxsp0UGCgu7fPANm8PTM8ej* zEd@dEdIm*BMGBj19Zs#ze<|3qdfq1{`MNdaHLlyO36OwQs|nSe(Ls;p`J?%jK$ar6 z0Wpp`Q{l@$DHTLB9dumbu#`g+&JuT~O&r)YHE9@ECcnzmYR{vgG`_|rsuqpL7>U&SN&6ye&wdc}szS>Uxiy20-G zFy#|zwNU7-vPlAcb5p5of^633RjrCB1qf{cw;_~2c~ew^d*9bpNlG5eGT|Ax{Vs@P3ewvr>J zxv;0x9E46tkJ{li#2)A?ZVYbJR(2IlHHYLU zqhsS-_;}&s=U9d{(=muahEXStj{4XjI46(Jq-}+UXG6%(10o_TJ3EF!tU;$j?LoH7 zjDgSdFPlA!D2R{(7{yL88c3#DL}zbsvRvz9S_AB+0}2a@zS15{ogAMF!!|xLPX>!B zLs<4da%HWL#uMBxSV`L=v=fUxR~fNWXwm+)w*|~d6N!(p71%Lb# zt6#V}dcF`&5%~voV`R#=tCCfCeJF%-bO*xiy+44z?UHiKulRwS>|Q= zuj=>`W7df4#Jst#{1@Ea?&P=3Uki<9kP-%8n4fuvgYD1L-LEfO9f~8c10_B>HbsF6 zzUB$#_Domr4ww;-p9^l)nz&Qd|EphunrqbWahnvf+X{5ue3USAaO7qCo#>1lm(VK+ zd`9zt5zCHOs5tWVPC+b>~ao54(65L^3R^RnH%osq3#ix4ojpKfn*cq=qn}LDtBMXOENiZRHxxOC} zdYk!h5ouMIA%P$D?>Mu6|D6`3DGaMeLEyM$T^21}iIz6rK!{(y`t4*^SJu39{TxZQTavqsv>8}bHPdf7G$?k!+&L4b6RdhhwwP~98J$2e_V|eG<2*6r~S_xfw_YP z9~My>79qhmAcL{U{QXD}{8!z@42&Je14gDIGlTu`KXUX917(bR=ATFI-Hla6={sqc zSm1U4#DXHOKv(STvm`)TfkP!d#C}P;RUC2RBmd7w zrmy;o{}1B#|Ehiezts8vT=xGc&O`s#g8TpBni!|XKdZJf2a@vtSpiouf$jG|Ld8If zeV-`#|4R(VXyFQ?fbdR0{w*IH)qOJHzEOyL4ByY}m|f_I0y40{i$PA%#$g(xWzw)P z_;N&(HXnpHtrG)n0Ga7Ny5ur=MI4XioAKA})XS69T?%NI;y4RJvz(oP-zzzQFCZug z&K=Rl-2`?3> zoy(Kaim&M-aA)n^(nGIc0mV4Gu#f>lo_q4wBe#zt(897AENeFvAI;ip(mzI>x&cx0 ztb0T3VK3R7@+5^!GB;WwGgS%d1x(N$U&ek(+kD5v8t)X)Z937dKz^eop>)_Syr}xp zeo^uv$G8F5&guEyd5427@qdJLN_<1$qFz~9X+IsWc7EvFcvln>6}1OW*KoJD=}K$s za%m{FPBaDR7LDzkewS!+0H$`Yu&~gsyD&;EM}5EtbbTp@$Yr(RMnBwQ+euNei{tt0 zmq1_FaIil^;`SL#{xHHwd-FQz$P=qJ9h};>fl1ftFi_%efx|&Zm5(r?n$8G1G`uNm zMHVCIU;Q@oxza!S?OIQKwbBp`pV#LnmlrLStIoo-U>rrG*6_hk&KZGdny&cm!_9FL zd>qhCW8venGc#&VkBwPY+BBC7;GtL6(1*RJ-22Il_qg`2+pysLpe{@7*J1Do^Z7 zu3x~@H8}!+c1zWK^)Av1NPnEMQK^}O7EMpo7$ZLq0y>t7_(pqQKtRBP8EEy=UbPp| zo*r!@6|#DpwvUljkm05qpSGERCfm?%I{4pd7c!0&;U_d%hNxYsL{B#)MZxpTSuygAh9|BX8TzZd5P zkPkorDrKpS06mXU(#poB1)7=pmM;l>1_xtL^3~vaY>GfNI0SUgK+88aQ(%JvS`piE zg~MX!m!;u@v-byto*{tT679`|cUW#sQ~}q;yePZRUyC}oE1du4p~nLSKGX3@uqgm5 zNp}C0o!)TbfjWC;)d{K4;vBr<_nNwwmpCB&7wz&33ZO?PHGuEo`om2EwBr83K_j#~ zV`RGr7qGD>D@B+U%PL&M{X{JRFf#^ii-Xo_Wqp0H7M!vQ)Zxs!DG1oCCfkY#shqYL z* zA4K8syoR!J1l*QiNQh?SUfICttbGIUL2PCT8UwlKUThatj8rnFvm6XI%7}{)UIHeu z&XX)vw(e9(NxKv&DJf0Bu}2DEf#)rKvjIcQ%WYXY${#lEQbPy+iWT5DYAL11{*~9- zhwEoJ=-Tj$mK{Vi3!pbmyo7{=mN15zN!vkZ5fW)-yWI+#aX}2x1jvFvKP||BVi;gE zUOqb;$Uy&Ic^hzLqvo%4bstSfv={;{-{CPhTIQ}7++qlHYKNMYJ|j!N%(nTb5L9o0 zed|tE_>WgdVG7JlG)*n$1YS~bVKel(xBFSY5Nqg(G{i{q@!37a2&i=G3>X^(w_s;kSq5QkLJR5IxX5vx&>VeDDsI|fA+MF)#^xneydj0+Qi)VsS z9phwBA&PXR>vG#DfAW(6-_^EzP=Y&-Db!GA_q{3BKqfhU=`k| zPLi%`=~AFm>Map!%WN>{`qe8Zj~%OMfs1l>*KIE*YkM*`oSu7JLySJ6Hcbr~aS;IY z{YJ|&Y8>%NTOq(d>OJA24qKWuUsof_S=SrVRyi6zxplNK<>q5_mXk|4Ypl44_bLhIm%>W+&&PD*uSUUpfXgI#zwmV^+ zCbuX0FQ-(Y-gmOgk{Ql6&6_UEJ<7V}tg+eCmhP=g4@T6ZdrZO63>JND4)Q^RTwvl7 zOnf9<4|G((^Zt=z_U&o`yz8h>JRlaSTY(Y9r?IgyegB_BY_;V5%2_!78|y-c*PHr6 z4Gj&e@KPYoL8X(-iAHVV9ed2AH!-FK!0r#yUUr$3jv6z`rKz}mc!EVFdB%hX7Qp)6n{{U4ZAesDtptE6T zMF}L;=Z7HG#0Tnba;K#bfouin7Kq^aOOP)PP^iVQB01)$1oXhvlmwgX`+;_Z+YG+m zm^}gJ3th6j)3k8;yO#XQ67Zi8Ty~DSSu_b?j$$ng^nuNQYal!$?y(fRc=SU978i73 zVelW{fa`|%qiNjF6dV*&k|+_ZnM?xY%#X#=ow3Ni1v5pckD*Ps%WM`r+feTyD0-;W z8~tdI;IB<`pY*1>hDOsmikdJ7&{O7?me1I~0wcLBKlSy`k`p7@8rt_sBN2umyaCuC z2%G`bc+bv+n^+3PXEO1;p}qLYi5#ggP`LF9M*yYvmXk+e)U>n%Z$zE_!Qg#2F?#n| zD3^g;S6`n?l5Bc&Yb#*VHg+F5NYqA%QuczAHUWjVn(ClDM)X0-kdOn;8k##bp{0kQ%ML8?SQNK4Xy1# zJAMq&>KOK8!^NX9n%fdlI=%_*;Yd$#gQF_IV4Ere;q z(@$TTnPr`A`Uf=AT=xaVF_xk~6dbk+AV!Rgyy>ad@Hh)bPYevG98>}i2fz5LjKRxE zvled>!a#7I2b9zY$X(#CjHzIFOdDRCQe~(evKS)!4VailUok$CR+0C(C%Rri`RkjT{(Z}QleU?! z)^Bs`P_*<^^_V`48+)41a=zPbUVmHMei)r3ci&i-T|E`G_?rvKY9sw0!Awxqb_S${ zP84K5bS$j}wxul@R>EZu$UeXg-Q!`&^pY*7{nHW;sf~@z^}_2fGY_x6jz|R3KEFvw zE}$Zllau$#s_C`0v=&gG<%qs-ts6op7$Uo%;Oim~C%NKWtkc2n1cDYgPWx_mt_91d zC6po~H}@9cj5FxN%78#v8$iYbiAvXp0kn$IZpDMQ&3LImIp{ge%gOoBVi+I2?p*Sh z`KjB0o3(E?So+yu!`&ayYs=?2fTyxJl zyTYXz9T?OfklyThFNe{3;Xi6(^xfJQoE;UdW|}|T@EdS?Zr}mG?{4Db$R}f>rCJ3-0t{z0-}nUuNH}&E2MK=Jd%_+@}P1` z^%{*`5Ua1UCjXJ>$mZce@qVG5#Coch>UlUVRfP%0C~W*}nn{N4%R`L)@m?m5oiw)$ zq5%&F@=HiTtSy5DAoElSoDl^PGFv5!_%yT^jP?2As+#1GX0$wUBI)9L5m3&9x%gNWHUI*xyi4n{s;N*OoUvW}5$}pOr+)wT1+E2t zK|yN5*iUWqGJ$F#^l<;HnQMZ;+>-#&Tuto@1Y$)GLD?(TKd@miRfdy zz9RjE01!&-v0NGjvF`Aa7?9jqip)`aa1l@j^(e+QhVHGQz0~o8aX;A|e#FRVbp!Uo zI{fz35pDZxW#7CjqUQs=r;*#GbC1yn_x%CDS*9Dew6a=s0HR&Q8nk9PG(6lf)e6jF zAb9TsQ{;4-pcY6yJ$B@$mEQ{2(|bV>4Gj&opJ1RC5ZX6~rl$)n6#5HUNZK_b9soCT zfW@88v=KIgV`hDE+gz01cb8Wl@-dELAVrt($U;efZ2;0+lV`F2F*ZCE7tFoVt{T(; z1;kyN!;+P74JAp}Ys$+<_|F4Y6sLi}si8d7%2et|ZU4^LN1_0!$z4s(`c*FN3vlN= zfBALKt7eiDIS-`c5F7|&aZ|?b=ih;=vH?@ni}=AQ!(xo3A&$?C5LoJOVF7PLj;Gzv zr*;ErPl%b6hQi4Wbsvxh*WQLK($o5~8+jw;xXWIUpp*93yc2p%7o7`^)%r5fM$ex= z#{~rZEUR)_O^tT=28UDK0PZ}hjj9wD+hMFwDAm03)Hx+efM8PHai#y>$7gB2P#_^) zLO*XVI8Q1eM2mkpbFe(0@Yr)@V|y1E+ynqKP-xFv;kvE2@uwKu13KCQGTq++DjAJj zb&47CAmAo~f8r0!NT6=qNLOUg)67wA;Nafm<2lN7NE zCW%IM+}`kl)3b!o302qBn9wVz2$t4XEb`mCA*O0Y!MTOINPPgwfG)!vR|Tw}zNiKT z&R9O14U+ZF4G+ut=lc4oI@`eZ4Sba)NP7qXp4!pZM~WHrXX)?Xe?M4!z3vY7PE9;A zi<+_-wB^1MQ|rxAo7DqPJ5{YM=K3kGbz9+R>L%gsE3X zcG(1&$TgWh-ngK?UioXbXd}1~w6X4O?=qb3XA~PW`qs)?m#VO0oCX3nZdn#W`{3|V z>^TRvmzf{v4@kZm)uIj$F^+nSaolC&4{*a58wGk6M*oyCJs@ySuPE2r9-6n{j2)!) z8wylEJUCcLe%{LH+~Z{WuiiU%Od2Mu7_khT!~lX|q@l+5Jh?BT(tlqVNh?0iu=50F z1k_N#;2Z=tUzS$)bnB5f)nl#hWfMvx2%I^}y%KSGVf8a!*`vjZ_ zXR>|I*krF+wqQRS#(kT+cqgMun)uChdlbfr;FpN{|8^p@dni2@0kJ9DhJJGQoBMID zFix>d21(4-69677N%{Isk1WyIK_zQIKO$$DBD95fE)pVgshKRA08Q?n zI@$h z-LvNs(JU0(^XoKA!b~)Z1f%a%_SQ4{PGJG6S6f&}jO`MLAPmSS{3Ndh->1Qe?nYD3 z+-4&_sM3B8{pKUB?59ybh~}Ahr~;-mMFznKwl{`CSe7kauWQEEmEn3V5cdYCvcV4;BOsqqUw4IivU@ z=O9Cpzgw~uar)-_0!zrI?0RIzbfDUJ%T9(r6P>vd}cq1?u*sl%csPxr^W_2409K)sgm`KD+sf52O& zdGAfa6b2%$ABi+`J7a|x6g=8K#$H$+SjPVRd>dpbuw%gSln3WBj3f{^Gfukd_c>0i{Di zHr?^v+w=FF^Ss~lz0Y{xF}^b#9@xT;wdR^@&indZ*By}zBsiwJP<m=XJ+EV?Dkvh#YnwB)9$^OKY1I#I3lMDVI$T^S^KB}U=LtITC0XyVP`S8 zFh(O6B*{$dMdNtqVvd+Url!iIrJwaD&bug|YW2+SAsaa9KOT%&5WF(v7M_fclY&J8 zZ2y@vu2_F;Iw37{Nj2e_7M@Ro%h>7HHd2j2uo&i36j#l*hSOs;R-<2J-6xuNOl(oj z%Sea(e+a)HpJbk5lz!g*xR$)-`8}Lk*akp3*Ivh)Iu(is8z$uF#cctQVe`MtZ$BKD z5(n5JTJQUwkAo=a#yBsMh$%4UbtvTJ=};~>_2jW_M&b|&d1eF=Cy6oYOEHIjzE8Oz zXz>_%d;_W{`&M#tKJH)RDm@!3fxfZ#WODgw0+ubJVf@sKy&L$`1tyZPb(G`V1HmN#hWdQl~vOP!vO zHo5<>P&cWH<30Drf|$`3YOmlk^&cjKsUOPdaDkY=zgpT;DtF zSgLB;y2Gl>8dkqLHG^wM$*HH^;~=S{jvR7Cs;R=wx=WR93%10Dyc_E z@@`G>1obZRi@qo8>ojkJQ_C!PDt)`pWh%T>K2)f|h@{+eZS4YR@6v1^5GU74KxB)a zM}IV_a6harRRRf?0jmyOePXnvthKA>v?nSG{iOxn(oLc~-Xu*RY5k-*#B=!7k39XK z`e|GSOY^5Oq8b(!f)S6KtV<&!3_w#*R{9hFBzXfkl63f?- z@R^-%WiFynq9-~bLq)l7UMypDvv0j5b^CR_D{koL9z%|6e6`zWcEw4Fv`$PHq|@I3 zwnA~72J6hly|eK4Z*&$~3Se98uPvJBU=;g}Pur^?&SDdt?&x>9;w1i3+=l+EyOOjz zYf*d~zqqeh5?q{IEe<*NClkYvFgmtT12%v5P0IIBk@47l8GCxAGs_{J4JLOxgRgZ0tS>krDhI9naLeH%cnYvFMZSK|B=1>98T5QQb!ehd=a+hI>WmR(<@_)AVy6d)(tpn#L4GW$u>%?fkK zK;s|YaQi~6Z2aq&6XvyQ5F|mqm+hn8{E6DIYf2Obd?b?ojRFbty-ELah=1GZk)|{h zb7*|flo=w~#1ylPgLUyRgrTEifnezANC&(>TWjZgo?07)58SHs`Qn_P3=r;b9?y*# z8931%fSkVZ4PWGk9E;?q&4Ae`&f`9o1fzoGr-y}p$lpqDtDelMYV1p^v!35w+U=uW zPX8<*+o?Kzq|T=Z;|;5!qIeT~HAKl12kYDV){Bn^KWJ(^Xtq9j)Hw`Q8OT2bK4W|~ znr21m*l5>NZb<|4-YWDAg}wdpzSKtEHd+-}=O^j;zVd6NZFlI8`U)`yy}C`QLZqU` zd6Ssmen#?Jqz?iG_!Y1dd7sm1M-EF53_P@_;bzm?cXcxH-NH7!>W%gMJ4|rUykRc* zw(}EG*y3p7-|sefqe~odsFp>Jk`uPZ_qQv?_1yvv0!a!l{}G27Sv!eFXk&io9r$*9 zM9Svq??x|ol!a5(NG@v0H5Us1d2{@qHLP68{{B72XwUy^t@gJ!nzUOxaudb$FH>{$ z$#2MiF*W}sZ2y$3`^S{sd$V)x3a+FXSgu&53SQCvk*XC*{uk3U=+hazmrbc^(PD^Q z`^`U}g3SMaD_kQOivQ1lSyT~^g6R@|^8PdSNQ3bIYh=U!#uENNDAbTN_vg+3Wm!K$ zwnh<&%AAES+efb>@QXjI3|}#2rs$=o4qx6LFpk`*Nhm3{nvX3S`+`X9FCG4o~Ko$)nogI zPl@Fq2$#kV4(H_~I61D*?W|4-+fAOln|e-GPHr_c0XcZIOs0zqwx+46DOlgeqEpV= z5Ag8tyf|_CjJo4;rQ@QCfq}u)d5y_i?u&9Z#_b71E9s6iEj6pJ?1~LaaI_E$i5^)j zOzP5aKHhm88){60m(TqDR_srm3u$?)z>JNhluiaEM7jXkWMF?!V>wqpxP>rq$8<7Y zJkyQ_OHYr#P}p4tihv7rYTXHgBO`=R?W)~(mw12o3f7Iw=U$AV2lZfiVF<<4lKpQ#A3lBSTEfS+3z%4E*`HYs`J;{u| zBatA~+3ue2^b1qvLLL?A09dS8bJAN1JM|tuECoLq+78?KiDq(1mc(vuw`K(|f`b{B zti4KOLxDBHnyl?n=ZH=jLDik*QezP+kK`%Tfp5VAYNAM&I7y*%SoWqEot$Xg1C_2r z2VvWBER3mkb8+x~d>L}=x%8uoa!~JS=fzYj(by0<#O8r&!^*WRDD&sl2Gbw!w18)i zO~ytFPb32PYOp#BT#V$9mQGiueLN8TnBO1jKIUPnu()Y$#RDg&S!%;C`-<6|22bXs z@Z%_HI0$ZTZbNmZoTr~a8AV+o(+l1l1W_%{6T!|C)ZENWl^eH9z#jxM*X}YxeCib> zmjOZte_su|yA}yQ&KkyQd7U>ZP)x4aWOBbdS#IW7%1iK^ldP;P{~T;suPsB7dMJU^ z!#g~j0yL*A_e zU~#z^^>aifSrsdk>_U1Tu@h>8kY_CI&1v0Ywi_Tz397F;|T$0w_tXLu_?l>qM8$H8UPCS zwOgyJyY5AF5%JDq4>ZJ*8a$Yt#JU{sW%k8NM3^d+oxvx)dxbhE+>Zn-$w%O~NPF@Y z;ird+rH;pzS#lh~saLO`j9ZUAfXO9ut)`-)dNTp4 zGrK{}NA`|nxe!P}LlUL%u^@7SnpEIC0YgGpyV&^vnOko~!tQ?FYK3?*uY2je=Fx+| zORTe`>Q5d&E~)S+KMl&?ph(cKaxwx>1b6|y6`Bw_{TlYhJOci4ctpF( z>DT+IZ}~>A&Yz}%EHpImy-;kg83Y*!f&#=4P1dkSLknXCLspvW))(mL(!QBWWvah~ z1c?Ku+-*0$s6ZH#tho*G zV391l$c&nOi@Pm*zW$j+mKq5H)cbaCI?ARJp+$B{mg7`mQJj zit&MgfsZ}g=hjW+=jCK&ElQ_tIHA%P?PSO-KSjw42nd+_dGp{I1;_@?UV$413RP#e zx(xlB7{MJe{S1aY>%cH#B?t$+eZ`BAkcmgZw>|7EC-3t+iHdlUFQJ$p7!smIWajRE z5u|zlXwyvxcXvIeB%EP;xKhDE3!^bB>ldk1b@#Nf7+s!j@t3)E>H=|y|Es9D0Cf!w zeaVEtprFtA??ALIDByvwjcjdghmBy9*j`8ux~CN~Qc8^V6%0Pdr3-m~Xga2GCn!zIzOVYe6* zY#Ob^x3(+x-C78C!?C_<-O9rO8xeP}DDE&Sc0Vrec*8&!!UTW7jkT`NNeMqXJd6xa zPZxQ*SDa;Ovur|32>UI4+Ftp_5n+U;TwJYNf4DQkRNFFoU&|QteKo>4@dT^x&cWdh z{YqaB8*wnUo9yT(u8@SipF1YnWlK^GD}1%W40#22eW2>cajFt@6ESAe##-_5C+N+Y1LV7cR;BqoK zp(YRuSD3}5%9KDQl9b)QZ>U-7y6D7nyVoGO8D__sUDH?gsw_yyDIAO8KJLJUcvT4v zOXIgBC3<~I6%q=Em*lkBQ0Dw>$Xg-QUP@QOZFvY11EynE)MFPlf&1#Fi{5m9mO_7i zcH=n@+Iy$vGzSF*1k6ub+u6W{m6i+D)bA_Aiw; zkm%R7Eh{T)N5r($w4{gpL|KASCKejVh9h_>VIE+*c*b&)-{N6VJv|+rVCVe;?LIu+ zdRK?ig{&dIGmjI@?BaApG92YgDzBJP!hId4^R=qI+6xo5x|FjuwOf;?fPSCDgXANgg7l7?B7`UFF=XY2wZddEGG zS<(wdIC~9uXEB<-^S@l#^UEk~}W9Gsb;~q${&LSi&R*PxX0S z9t;(btSbAAUZ*|trD1Lr6|aAW_6Nw?0Q@e$CRf}%Y5OQXMZ zudL)J;;QmfhtXz3mG2R+pOqkCNK5kSiy@HkNWXgFHXsh%?ew<8>G`6*ed(0X=Rc^* z?CkLu;%FQ?WVr~D$!NfOgMTu#Ypyp%$I3UQW$6ez^p$>h0UDeUR?(@9?lH6WBA{9? zjaJjtrIe=-n1ZweFK*Axo?Ec?BI67d#%i727wlP}{eI?=`gY*j{Pw=UCQIn&59+LU zRuMH0wF2{yAy!PhhK^=fn zxvGPGREMfFtL3ZyxfToF`wDgVc8>*D_YX}%Um(4h8)e$B^0PzU z+!<)glzW+3>_1?31VBzeD#DqB%K`3`@Y|S7OW^;pum-Yqn2?yvpK);K*NgFWW!a0F z6n_ujXbJ;pY959{a|K9{^T_#@!iwG`bVL(w_j*O5w|<3SptyB9KWU;LS2s5{)ZI@( zG6{m2D~Ro@erQPUYtHuphRBb?=@V}B_sU$p&NN9j!@8zMytl)aib#lnAO=^~%p8bg z0)B2?t=IkCLWNY^w@tWB+Z)S}HHm)@IMkS0hlb~V8w9wr;v19pl4SjpOt=h07R z)JOHsvy(aGwADtZF89AzWe)B3g6P`mbw-ubZIHJaZVr#cvPnl+sGfedhfhMD-g_;? z&(9lPQb+5x58}fyr7@-YBlV}p;cF>|T?KX5Env$`gqfI_q7`Rh#XY|2Jng9F7*yc4 zZLR3J;V85Di$FU-ea{^a`2^ZK`3Ng{k)S3zgeu?qx>VxX%F4=HC42_YPCA6xqCG#Mm?=}o>z!x!T+kUqL~?ss~h5` z7$mf@bLfcyByy>H_oswns7O6-v)xU7mq?EsrW`u-WHK%!IWxmG0RnZZw#{^Srmniy zHMN3)EoU*_qZcn;;F`~f!;ZCTxsni4g>#*kAyn9IQ2&{cv9a;iIqogat)RoBVzCUG$zLBw~4+ zTuQ~+2DNmU$VLb_N1Yor! zk1ASSwQK0i$s+fa(NRiWw{SYfqH<~s>Pf0RQaOD-sfdgDO5-8OcCaUX9ZKRFc#143 zI3t(6@ALWOO0#ffBO~@~HLsmaT~y=~&NKqEy%#8r-Dgft;k$BuOeaU~TFb(*HM)?Q zRH>W3fk-^;U*ih9`*hMxL%)DQ(=5Z$!-Pu zRo_O##_|FzMu^9rSm>ETE#VfEFPy+m3GCiG>1`lnn36~C_-<$QkK%=?=%+^h3NiGu zXnn7gZst+aVTF8!yGa$gh6dsyA^X4JVCj1W8IbbN6txUsFPfI~NjZ)LAIv7B zSytDR`~c-zPwox^7LVdfAqK zR;sl^9&k&YmSmNyA98Yt;egmbq|>0H$fayFyp1^Y^v`^PvuPa<(gI`+7z(S9$6YD< z^tNT{)5;1r-2NYl!CV9zj_6J#?WM+1IG2I7xj9GpmjKJ0{9*O>3EK~eiHX^K9Jwe# zdRTb~#^hLKrmB|X6z!*{L-USQnN6LmHK<%8;Oa3`1?JcsZtWjp{U4Q6#vVbpMHKDY_O1A$chR2wPHgF0c#Xdy6@SD6JRiq|I=zkE>w6YJfA=Ep;s zLpPdkr%=|O#=&mb39QfZmdOS@5^TixMY)*sv-Cw0Tdd0>h|8rtS;gHZT^$P><{cQr z?wT(boppx#4QP~z!pOBE-hqeeT8(Jaxe+VDhPf+YcQr~_8?%DQ!>3vM&v*gG3%T7; z4w)Et%yKO0;o}^>zFJEi(mNlkNy|t`Upp4^_ARN1(cGqM>IZhgJ+esg1X<0N$*6vM zKG(8yD>X(ub5Eculo%%(~3EtO*mXKvs)Rz39H|eu-T4L{RVUibuwPTLgNx0tmI+A z4oF(K;yEZ2T%rj0EIQ*L+V!(De(t3@E2d1-=>~PcHuNMd*D#n=(xSx9p$p()q|;5; zijK7&=<(NGd~qD?4`=9*2?4+BDRi80e`6mwFtaq0J> z%*@YUwX#HQEg%z0Q`eOCrqLCXzE#Y3j90ituqY-v`zD*NB4GA}#XVRYpo$0OJh(gd zB&ln2+{ZVx*ny%$Xc_49*YjX`0sU6)Ys8t0E2Sf9PRtsrst%7}Yp_Fzn9v4^4gX`Ub&%{+T3OaCpd@+X zqz5e)Gdf`5?kyA68H3Ib8jjW2k5AJZtE6%!C^3h=9(cxx2H&mvNjTWl*yfetl3}(8 z_!*X$2i_Y&@)z(_>D7&;uy-%eRv2aKpL0z$Q`XDV4I&7*m;C9QmCof0#LgP+3NOw& z%T#@c=i;_RHM%TR^IJZY*;y!nn1EhPpGQne8fvV1nfzRjK(o*4kI& zB{hgt3JUjF%uX3gsf0u-2vo@$BAdCT(d?@G>|vwZVZk)1j;v$?rY;)WIQf;$S=rBf zV|o@;M*=Oj1-J<!(jX-^JUqPc&V>?p z0OwzWUs&X3O63ku^uf8GLQw*|6gbT2A-L5EOi;y*3=W*eBJzXMT|E6p@E3iHwA zY?|uAQ|<>LTq9Wr66SZF1b5q^RyvM^j*fnIhOOQE5;yojbjGrE=~j2lS*bMN6&jST zCO+Uyrl<5A%KMZekp&VRUuDgK_PyW;JS|^|CSz450u2Hi=3O$o#p~s)Su;^ObA#+Q zSu#lr5;xEKNoP^B69~~x>KVPT?z^MOQ-#!}%xGOf@s*7Pfjg+TP>sXlq^qSEn`$j= zKwjsBYq+^xhk54FaKCfVLcE4Vlh+ICbPM9kU$oHjm(J!R7oY2fLFxLvyl7{(6IkY( z<6d2LW3b9v_VGed30N25U+OOj)Ri@Us9cRZKa5y51V1ukgG7=0yBF-^YXcFF|Iv(l?1-z z&PhCmIf}8Pt+Ki6_$kfWida#!c~19Q+4T;k3$=|hJ+MlsqXpLV`>R{(R`oWjX92}d77r|aM!^cM*1occK z*&}vb=(k|8>M5AZcD(ORT`QuOz{1+8*IMQgJNg=YNs5-n>`HE?it~h#!o};>k-0f9XjaCz zM#i^}iH)~M{ZX-J*mWIyV^fi!vr-f|aNB%w9=p$^2*$KAnzI5$<$ZS4aK#X@6Oi@>L3VMfP4|bXPDNjv$`XGo98ydh;`Yt~A|Y%&=L|^@w8F+51gJTKG#L+f#cRbRIdrB@rV9 z0=BoJ95-)Wf4R0Z)ImE!hUaM22;Z3`?Q1BVUjDxNO)NF=tkf5!EYdfuJZdleaL5@N z@rr_o@PDgah)9HpO$`}0?SnQ-+xE1zRQj@mrji{yL4&P*IO28-t#rFX)a5syx?7H) z>a?2}kY0g9ZRor-+-2aWCbu;X|GzeM?c+*5vjh`rtL(wNpm=Vx$xQoBsylXWvq1D1 z-7rtZVre9i^JBTQHq|})8awcJP&(Omc$i-+4T2RV^pEf+g{PAd`!;Et%&n-rEpt=y zs+SehGp5CX?8YPwA*1fBn6qe4&8b&~^ZOOA2eM2MSD}%CrIdUvi z-ZuYcvXHdCP0y=j%f4#%0Nzq_fTZN5kQ3=1K9X_el$(z7GX>RMzl4HVgzS<0Y$ClN z%awaIhOV7mo;x>mcBIZDt8=IGtvm0!EIVomVPhTCpafj@tI*<4s3rbLgqZi-A!L^F z^Du6jkIEw_qd>IAB$S5h=-~OpZm{HW+JS-ZWc^DKhehIV`` zue1EuyMDwe!X#s3XwTPzk}Nw@XMS_AjR4U>_cZKAX<)J5=UNnMiWPRc2rq2pdNhKL z{pv0$x=PbG$bpM>@Y!F!01hWJM^?Yf^ihjlSg-1=W+PGc2MN0+=ct6IFIw}c%N9nZ z^~wZnUj^=?YqpEe*XLDL;wR^kv!(g{Ev14yIvaYy=8?-h%P|!ekq4p`W2e)=vWglU zi&g#j%u0DYytbU;{t2P+N>mKytUUHU`0IMMn+tA9$+w(gs~Y(Do@<=YprU2v8(c(9 zFf=9-X>UGKyUt^`B+Pke;tjLQVo7 zch*nf{ct@Ys9!tUm*a!73u^Z88-3|I`OPk9Y(aMoB{bSoewJq{_!mA*GGq&j;kx17 z&)#(z!VicQGii4liyzy_sTh>?^}IyHgzV440QW-K5yvBTRCOtCl(lG!?CS5<7BWhI zE7CCB2))hkyV`8&zp4%K<~|58h}Px2&%mCKJ=MvAntH=YxY@uj{3Qpx>^6NMeQ$l*cQj?M9m?02e<2J2OZ z8?7|qM!_|j(ismQ${-{4^t ze;y)-gU2UMBRa9+@m5-j$g0o&OJ5C|xEHFX#uXoexUW6Bc?Djcux-Zi^VTO}w>~n(%=KM9nG7X8h zXYG~lm5>}E9gI_B;=LA={~YSp3vI<5)p^H@zrInI8#UuQixwfxM*kkccnoz!>`**= z#F;VNgSj{S89-QbozHOo{tol_n<3-jWko!OM+`g%3lqCaIDdW=ZYU?BbM=rXF0oKc zp3eSo@1fj3zxjpu=iem3??+p8PH@00nw^f4X|8oE*W&v7d0Hz@V*ce1cK|;fE1(t<+bKc5DkWcuQC z&Hi%3aEYZVI|UDfji$;+gvUKS*s+Thw!;C!0Hp1m&&r;>+xR&zoyCw~*bl>Y_RF(- z6c=I70-Wbs6}UAS-)88zgNP^?)4BEl7zK<+acir7!nTi{!xYwIu>1yzLV3|uH4WsA zaI%}Qtbur6Fje#_F1$1}HpV%9=3>Uecj#c1SW{Eed@ZZdXJ;T}v@u+=XhM0hEyM$M zU5{%m5Zv6OKKGO$aADQ%>%%H&tS&i3!hZz1n=;#BPU9O~UmyZ3E!m_Jzq+%evP!3O zMYMP7#6ov9NNDS2O@{3yY=1Ey;jYifjD6>QpF;&{j$=MQP}wnh$%{_CGs6ItgR8sv z)MJQefcKl7&IhI@h;>g#(xk8%)G)$elmgCG%7Ucst5D^`#sa5Xekb{_h#TZKkYNiY z;t3w|LzlhMuXF2(>a5t$jrM2$4T31(GI`MT)!hD@0eNmz`w5bbkNXRI3~a*Xsy{p) zP?Aelg#t0|70(<<|M8Q?f%7bg#B{FEs$M-0OCL{;=7r>Z%Jr4R2qO);sppC6_5rLXO}ukAuofkvw2c>?nV z2k7kqzU?pNN8f;?$v5w1h9ctV+DAz3e+W$o1WHEZMCPWtV-T%A?gM+(!%rSI6T1y) zY^(wHD!l7LoDEF^3ZJ6tI)%mpp)bj4p)vQTos%Da!j;UN@ru9By-u6ZLWBxl6pDZ* zC$u8k1r}+Q4?k!a3OL7cWR+w^cAXK5xgh>r_}CBL39clKtO32Fa%&urg>mJ z3JwY8Wxx?!g3pFDZDTaf1zUCsK6mRsbjWV(=~p*(y1Z5fdU|kx;A!fB-UCn~Dzrt- zKO-l=?M!(Hd<=LgiW9@K5pJ+!%wCLW#|>#YQ8uE_{2gE3xLUg(c7p9U5|jmUz{UZ| z58*D+mH;fFCbyLN$Cg~U+}EBTZ!g)bAXSn)lK6U;FuN4@q<1tr=l&OD0P0igaVdNRwPRfE;1FqB z%Ptw$zk2?S0yE|NE94BWmYN$ z47m>-mSBuJZ$!ZeS2UDW1j@FUN|-=11DC9)4X_`^(qOWJa9XheAY&Am)hJ%GvVznE zCgFDP(y;+Y^rarH0Tr_#5UCs06?x0HG;~1QXK;w%&OG0@Bm?%q6h}A2nc^fcGfKi(p=cr1 zfyr%1bAV1F&I;n3D(Hy600dxhI$ih_(=Y70(?R`*E<~>M4r}*g_0ThKkM3or;2WgC z;ILR@YlFz%e-H!&7=&Snik=qH+!b}({ht{V1%l6$-z13=-qg}NuRB0IOhVxPScp!_ zE&FrbM|J?C5XHD5hus1c3Lit<=T98Wg;8FUjQ8Qn+b=(Gnwz0V6$Z8{Bw{XP4S<>$ z5RSJSv_cx+RIcAiYPfgxJpUXe0WKW%PDe%sER&YL|0Cu={=Z=kGS#z|9t7-cZr^YG zi#mAuA%o2H1h&8v3o2R1F63&0@p#hgEe^^OwOkT4$yPtvWE01_>;sw6?1fMXgpmU( zYM6lF#f_P~*OWx3X6)W-p?EbK3eQ<=I^L$esG~p9*Ox+C-c)TT8W&yJGd322Innt| zE_WKCm|91h*xK8 znO9VqTooI6A_8m!^VR0-OO>_{IisXi8mAz#_tM#Q#AK#*!(Db8eZh) z=3d)O#Z6lFFVtk|H7=mS2)w7H5ZOavM{>U%s{Rv3n|VrfS|hdjchlp+GS71Rz!Qm@ zDXgr&;og`98T4S((JCcKh5EgfF;ARQL{8edQ<%mdkcR>d=2!y^v=b8u50+nrw$izi zg#56-u;p1mMkJ6ZK>Mv3VeT7{}cBgmVj<-f9@PIdI~GHaV+E*Tlq(2&p1`S z*);9J+D>Lju)%A`c20gG$@KuTHENVYhLL1B`U(5djxpw`;`e%Z4<1_MprdAgUUr&A z0&4C1AAa@@Q0Q`9DS5U!hw6I5hOT(|7p1`SoV5J~WM)9?ONR-D?0bzo-3$@btU*#YJZ;Z%l>DB%)k`>}69j_>=h;chO9fWp|{JPx$KNIQaC z9gGl>R`qsutKo;G1WAxX60VWD79yJ*Eo#WjpV9SvC5XyT8uAWi9N`)H@Roo5l7Yw! zU-wC8#Cy|cq{v^g_LCbH24{Hk_0LIn`jn3? zNQX*f17p^iMMheqN@J<6q$%%;X+3eqr@gUaC<|rURld*+x$R*&bSmxYV@?7fw^oK- zGD9T(E4*VBRUpcs9ppxr%$;@%^z$_Oq`mfdf~?25vCGLI(<)Y7VGdT`=5&QH1lc+Q z0C&(!u+W446(dhp;|+f1dI3~G;EfZ`uJcj@rHPFNt>L_(5tbnYKk_-XL%O)Opxq=i zXkn)?5hpu5k4)I;cx?MEHtow*BY>=hqwm@elaK7|l+Q@Ni-(((C399EFIbwQ3!pU> zkDh8zZ|^JcX|+4U>tNUg`kzi!?L^pVp-SRW3bK4RlbRWr&C(Wv6&hLEG^W$3H&(Uo z9uGCjP{#U<)ULd>Squv(*n3B~8WBYA_lb=XNnQ?lE);@Y=du&M_^wwXU!X;zQIggb z?I0{nl2F7YNOZg*FfgyuAi=x(X`a8|z_%$tX;O=MU=&zGnuG_Q1)rLuzG`PxY3jET z^J8OLz>OWu3PG#9iRh-Am|aiSWr~11mW(A#DF$nnrgu`yYKDP^G|e;uX|q@bnTLiX zjg)vNxy8hY%0@V3%B=+1PM`CZy1D)X&uHec>4ZgiEiAbP7&MNRQ||$nsPW{18mw2@ zDFj~CL2WjQ#V9AoX^-*k?WhkAy)2Bbh`zND%{evw2XOfB_y)dqF>#B^rgPSYg~-F~ z@MK85&{m`Iwt25Cpo}Sidx8fJ;&}jsQq=Kv$ovO!phneNv|WYdfqEy1%XcBoAd~+a zaai2mN6~%6`bxCCK}N@lxvP_r5yBZQ%msGielw~$xl+EnN*qYzwWy4ZB^ZEhwz9H_ zEdP-c@RR>9%0Ykj3>J_vd~sG^=WdlNQC+;4{Y^77vZTOukm$MN2&_pl$sRd(b0RJD zOI({bt=aoN{=|&zlHy|Z;-f2O%t>^<&)lCr<%8w}6BWi+WIzNRdYVMgthuS1ElNu9 zw#e@>Vumbmwq}WwGFIik?pMwacxG?~wknvZxeFEP{@^F9ryw375i)gH;dg~#;vem8VuDg9mxo@@}L_}-k8pohhJq732x1U3AdY2f$>w80FP zySw}MuU%#(I0aYRGaVjuF4JQ*1edGoBI<+m3(ut-wwhAB%Ew^c_V#w8?b^+dZbPX) z(*7`S(I{i}?T)o;?1A2n{%0jMEXnyKQCYTWX+`(`%`~+40)y~}X=tDO3u!1M(*Fl( zxXr|?6)^hi#obi1JTP<;+>+YRsIB^eSXZd)5>e+g+LQ!BjD+m_{z3BOeY33&ATe~F zZ8+B6yPrBs$!+~Goo|Ia+(Am1k8B>;8tiqmkLs*Z{`jz=2V^L;HZxoM5+P01k6b&E z#JnQo_4}*ALaxk>&7t-61A!`6AF+zHK$9lfV4RpvP0g{u?{7OGtmAdzXT%m|mIO_x z8*E?d!0`W+dQzkkdI0by2U6x6U-#~29CToisTN9S@9Yo(Pbq;<@6lHd+{SX!Us z@!M)L~zfDp7 z3XnCXxk-U4#8Ex-8!x{HIzlPo*$+obXh*8I`W>33PUTiD*EcpcE?oimdWmNL(0rS@ zEcf~0L(0|$^x?#&XxTkWoONFqDpVk;j9 zYRkvJSS}*@JLkW+bnl}K4q2fAh*zHHCQ2aS6=va}{lUM%Lhi?m{hbIrSms1qHa06@ zu*NeHcyjvnoTghoK0d^!)sl)*(2@9rj3F(rV8IAN*d0P2C`iB;Q3Mad^4k(T0cv!) zz=0O3Z>xnqa5peWlbNob7BM5SY#gGMY>R8UtsK%ls}1!4O!-A(o}=n7RzXD&dWdcS zJ63|0a@>8$Pu&Ffr9ds4Ak#mj0!DY+yV|Jic&;h?Or&2%|NGjrrZC_$^X?dV12(GA zWLNaUf5`MP)JmciDKzX_uV(9NH~PN_9`#pIFjO2w6yHLR8~NIu2lGQ@uZ(^Z3T?zK zeZ>K;)-$d*I3A*A>R~EhiYgnjqAt5^abN!rWFtGH{_6&W?Lh1x73VsIdBR=&oQ*)# zlia=9Z|9W~YQ2R&Fsrrv;cNi2S%MbmIzg6a97*1QR;;!yZE+v?15*K11}Ltvw-tf6 zWBb@RT~kRf4VZDNvRQJuTIT!A)C_HbbS12SIoLE=u$MkVk8 z*`hyRZ0_rT48xIK& zOPu>&FNwPUTR>%V58q;ObWxiCwdUNd!NGF6UEXVi^zPB2!vO-65e$D3U^!n6Cb1!4J(iW4K=k; zb6sE#1&r_|f0oqEJ0t;_6NEKskc>aN(&YjL^aDjg3}*e7nw{be-YP z7o4gDYO=6%ZeRJjU&X(+jsd{XsX8>4{3{x`vf{22R*xUwUf28bheZf;JB>B$Bn74q ziaAp<%|{bV-x1FYwrh=5GC!{Nw<(u+mUvZm$GIvjA%?|_omYugKSFv`#qh1A)2hT4 zk*>#`to6M2wK0|ykqXnIq3OFUsuHsGIktY6Brr3>de&;^eOMSRpJT1i*7k*E`+pMU zLYMI|-D4iMm|9B={rHhH&w{5VZ{d@owDMvW&+vzr~ z+yFSzLDew%r}$|-m0eJf8CdIWvbCeL2xI{1WJyPnZo9RvR{i}EDqgk5o z7!Z6QYr%v6+*vSuKw_*yyHZI8DXbZTc1*6|fd{ZXzrWA|`Xt@IAEQu3ou~Svs4ZR8 z=+b1La?;O5NFB&u`hGtQ`HOvkTW?}MAVmU<30K{qe0Ey0{_u@0d2;g;LF|;uaMkwP zR!i3w3U)jyaU8CAVPz?~78e%-=A<}sm-#$_5e&05$+LKmhjCG6B*NkhmreySiW|R! zzCRY(rKS(3L=Elh*iKc}J*q&RxREy)0CY;!gTvjr`8~vFK+|tcQ^+4f(a>BDj(XCA ztKi?WS9!TdqPNmwGZ4VZdI-JBht2D(OLxSpz1R!8omb2-0c@|?u0p>+^Q!E48xuRL z5=oz7O|3%RT!-&hbNZKvjUC0YI!~2r4r+&yV+D;|BQJT9<-})Dls_8^S#=FzPm*$a z%UqD(PPc{(_w3~Y?K_X8Q}<=s3S22Vg0=SDBfU|SHciaat{aXG3p#({6o_DFPomA! z&AAKx`X1k8=QE1wd)-6-&v=+A?$!<+ul8DZiyAWICLV)ntY~3+B^h5pAhMnBcbyXW z>7LG3D@fFUmXq9U1C;-Tr_jRc_qDALBmaSO)_$2cj#z4llHo6=V(w()Z>ECMWoyXH z4w6R3qs-zzH3!jHo|Eh3s4hEYT{kFX5F(IJI`xo}tGTgYipm|?#H;aCzF6yi*r_Y0 zjFC?oCu}dB#jC??bUXwowJT&WB9rNVX#3OPlNYWiVPP!X8`EO@g!e`(Zpziel3cCmXSfwN_u>&(<% z?dStk2JjDN_{AH{gfE8jH@0@&p-SFcnw5f!2arPbKK(?J&u`u8&C{r8zfp`V{OMO2 z!{{OV@;8b3JbCg@wJTw6E8iuTJ~Rn2G@kq0^9mQ>Bi2|g)N}MmbY8tm_~sT!1>N4Bfev8f10wM1yCj+!hVSJ-RxPe=ec zkRH6$?H;f6{W{xxT;~dfC}@!Jo4l9*C7QkQzM&{>GiS!^y#!jPu9E`Z=<2fB>S22P zEsq~P*Sy8|bV&m=e|Y@|R`}+C9PV8RC>;y&&fl&$)Gl6N1|1fWHR5m>bxox?eJ1!b zuO2+eo_8$WKS=q&Ig(N2UmD$`Pxr{W_j{C&c%I)Ow7@EV=!OHY2HHFWF8X>Yi!DZD z2W9xEcxnjf9Sk`G!oRib{NeN!`4v#9qgAO8GaNXoA8M@4qwyjq#`y2gGh{L# zgYK-cwB3FpG@0st^Wi*)myP2?`7Qwt;hpx$?51h~+Y?H(L$7?CPGVq@^ADW0>D(5> ztmnVnI^g^s4fKEv39GMk2Dl9GP}X-<=3k%Yag;{4TM?T2z=Pdu!r-9itLqK| zB7J9bIGpO8Beky1t6wB_?5>S^&Uww2aaF`&PKfZ)K@1i%?gS;`d82Y2i&^F;M#Y8` zSPvHv=9pr>1P&ogqP1!F*|IYciFK_a6NSNy!+6V(7zo+;pt!4hC|XZ{aOkuT>rEtW z9&=5-KUHIbe!7p1DEPO6@Qp#4T&#LG7gN7I0A@+?=*-27eC(+I=;eSm%#^qiaES#1 zD`KJzNQEl=kd7vNk;+D8$AvQbHRDuHJ=kh%&_9-6gHj^N z!%v49RgdljsmcCJ1ioCv?22fe`{=#n_G>P$5pW;Ug>Swfw(lsdMVYr$z?lWafo`>> z#K>LzT*R?tF_UlEm`I}CJSlQ;0U(sf*KX|wdI8s;i80qAEW1P)sHOHWf@a1B-kCrW zT0IXl?f^>gUCgz9H-EA?S5`XuA>da)-weL*AD!EpLgcMkp4&s)R?p9vOW76!d6-nO zR@xAMf3EzXP&)K=>tV>lUo%_&0~2A9!cKZ*%ak?tB*0WyOtKIrz$jlyet~4(-Jy87 z9dhc(B z&H)&-3XB+r6XUN%QS_0u1b6L3!y%txeg`O%Gf+Vay-$IB3HRw9WY%vGTdmz<0F(j) zLX>Y5(UPxk0}KQQ?*dRBz5uVihL2qz^l87qsht* zHnN{CSx!Ir-JQ#GcQ3|dPG#j^%Kds%pbXmLBs%SQ!`wmQef@o#V+yz&?lIp}_U<0^ z?|E{k1W*_Smm*mvo@$Cg^?(IJ{SaFkrUP%Sm@zms+^*BaK`N4QYjOC=a-)$&<*iFb zSKQV9{SwIf=fLkV>TJ#k$GH{{edY1%pUo_o31U`ZdZ-_6|D{%G3e?Juht}W$br|4Q zpDG2|6dRlbaxw`RxP=HuAt%y_q7|!CE0<3Ee@Wh8bdA#eY*}dTkBd$HP)HT zp7y3j(+gfNVNdx7LWr_S<8W1$S@A@&(CK`4rxh@B7v}f_Ty_Z|^K9zG9PP6U-!e$; z`xng?slx!Df??pKSlM_CaL*)b`mLhfY2e&?=u1__WJ3vI7JEN)-3gu3quBNz)&?^d zJq@O=S$HSY$OmU1z&}=`%4Tu4uzV3SevUlZy^x4CZ;^zP3`GH~?wI+1PHSZ=miOq- z`-FSnQ-AXcArZBcHlHw{QQuo}lbX8Davo<%%*?MqbG!ZTIm+77^r|}%EN`biy8V892A%v~rET@)r<>B#7 z!4kCxPhtGGxx@ZPvvF-t`SF^dMg-p@BgT`<@It9Hbbmt_6Tb)o`*(#2P&zx3zGwth!KJ58~%z_W?c%4;Uq(o=Q%f{B2GzHh)8 zV?75`OfSEtyck`}&WGme=#5`cpaui5T&-}hLOYh)&4<2pdw@oHRvjUQ!>?Yu%NXVs1u!=z?Wc1e;~D)xu6}@V zfiEo1+4U=nmtv<{LZ%x1$Y4cCMN8YH?70?d-gIRlMdBE+9MG7tpkKpT0`KVpi#CHd z&_3KxIxVcUh}J_qTRoib3KdbkX_1c74c|G_ns|WSeS(973k5TErK6%tf`I!821mv4 zQS3G3qOdJijNp@c@Ro6OjnpENTgyKJEORSNgYOB_erZV-%8UGQsb#b&?O0rOt7uHe zr`B5cr8pCM{Mc=#4C{Gi09WJjV%bD!QOrxe;6Vd~R`O^yqyVrVSg$%@7^|nZ6IH$v zWm{l6y(g+f+6e=>0}&@}gQ@qfMGYbq9nW&`PrZVi()GANf7rf39L27ZtOka(*GU_) zavJVZO;mZ_HHW&H^@a9JxZtZdy3lq5J~3osr+md|%47F3FNe&myEHgKHh=3=a3J#6 z|H7n(6oB!YG*RO>7?NoOnIYiI1q~_@dU!)Yxik~D4G1*6gsuDQ3D@ce7jmPt)vumU zc?{7QaBv?bT!Cm9u(EK2&NJc01HcdpB_BUHHpZ2c0PY=7po}h{KwPkFQ#H^83lkkE zd4#enr=A0E0D8!!bAIC^V@HC}zIbR3^9AEuymNjh;WS^z&?B5-cYz*303QKVV1S;% z_C%=1SAel}khR^9^VfC07kOKFOC;dgX@WPb^a;v5)=xSqsi_(+iLyE9+F1`7(4n6d z=0!_vAbJk`;j9A{&|uuW;pM0C?7;5XR}lGvi5Br>^_w)~V3T|e^`rlXwzq()a_{p; z!2kn6P!R+HQ32^jIz&*Uly0OY1*GFaF-Q^VF6oj6Y3bO6lypgpbZzSY-JW{qow+mj zt~-C$S?ip`-t2hd7oQY3Tw`jA(_EMQ4$FX=caDJnZ2ZV$$t@=#Fh)4W@5DNATaI`^ z8sk%l9{Cdn4F`3C0j_$ovRJ#Ocd%G9$F)N57inTT#>R7njH0jsZ5%S?gJWCgB4Px^ z@H~~r8-yy%VNt~)GDTj_xlIqAU%f=O!Alaw4EF|v;<$GNdlQH?_qG_YLlX@0VH`q( zAu|_STD_te0s-_vO!Ic?J-t-fZ#Bu@kxI4&q>O(mDpvZR)g=E(OmfH1h@BL~El!vs z7iEd7CPK<05hTPnRJ31(%`s$< zLTF7bxL81()g}Z^KM6TG0>}ygIZ!Hj6WI9-;y&l)JwA$+N(N`1Atm_6YT?E8lb<~7 zXE`iatr!63C`b$5zI!J_E8k(axkW<9(rJrn#29YoK$JX$AZ6u0M~nDB^j&Cbl0~l4 zRfkFzsCkTtd?A^M~p9E<`|pz)HsdK zpdf%)q1n4!uX~Aa%%%m=O&tT0jVgoD29QJB$f`l{BGvY}4O{M7(K8Vm;6+Z!&WBo@ zuZ1Y1dwHsbc)4KlQ=}*Lc`BxvBMwe!H!rv~Ph-Rno|pZzNhm2L*&~7zQzGcNgoJVk zp`5`6xww~4RQg(;Mf^KxhVBHP3=)eF5)y=z7GUriRp>)7(jjf)p;nrw3rs=~=JGX^ zN#nzVTb~Wvh=ax)3jPuk{2VGek9ianKPeUqV1RCI?e_v}8`B5yV{-L3PeJ|;{z9=t z#S%d45C)a^wC?Sl)MZTsPS>-=Jc`3s&dM9ItR#$4(xAG)6gM>WPM@&*DCUL_*&?(n z#{ZTr0y34z7heC8F7k7b_$?*S@3AX3W$>B7;erDZ#3tl6G}-;pcQC&6eBALm{SwW$ zl{#5XCp!ZstpX0*zai9U->uy-;jmS1tchDk?gs>pQmT*5-pib8s1|TvOqvdRI+}m} zLS5&<)a!~y`s=3OF}$y@a21J*m6msERUzJSc+`gzMRzW(=ubKLuBve$lPm6C!s@O< z%s9^#rk}XFc0a6GUus#372f1`?K$*LzkD;#1H*5$W4YnVB32>hy=4l7F$FLuK*JCw z3BC-yx)nq1_AX2P(dj4@PWh;IC=Hu@Pg4SO81XOJ*M=9KfAP$)m$)za{fu?xV~YEv zXjdUnZGl8o##rGn{0+-U`h1-tf8Amcb-?19lwrDkYoG0wb<~?AorhGd{dBHdLJ^1f zCQHLGMk5!dp2IqKD$VK6oNAY2hsi;s#Ur7YEtQ@-GfgWOteV?i=(YxHpBy@ z4Y>eG>p42Ax zFYBg3=OiG~k)QpC7?M8wFXmT`!KX&KA&+}!F&ZuXjW$Xl1OTg(5Tk_Ug;qJ#}=9({d%goKQ&Zen7>@9TAP za>l5;kjj7|9b6k0=_j4VVmt^3K#v7}E7YNxsp%_}5&v9v7)pL=O>sOIW-nOED zJorP-!|>%XQB}Fp4!uMW<=3X-Mfx;#6>ChWf>iR446N#L9iub1(4wZ!4U58)84t!O zV7LuKvQr>kEK-Sz8uAV>oH4-3H!hzGX~skFdH40|R^@c`WAM3t-n>K^Evs<& zMzv!8mb+5z(0;8-KwbCe-51VEG-HzUb4|#Vr~3jga*j{AyXv0cf9Ia5`Yw(PR1Bpl zlL{F1FKImbYwv#fi{E7{*MvXNo4%umpeQ2m2gf1q)z$5ChRk92U{Hy9SXteXj(^Ud z&lnCYq;m8=!NUS2uOTi_5YT@0u2T zABnEdcwfhJNSb-k9@O%wJ#1j9=<*qm{^IGZR4e*xAX(}V#lQJ710OHTH3_aB88-!7 zG(7;ZfC<7s`I=kqats$*?;l9M7R=YAdk-LnH{ zh$u4BO<+cjug=_MXV)tWlmdsRv<5I=6|!+SH#pDtIwz>>E``7pDt zh$P-LGrtxs%Dp}0_88yj(l0n{5Kd)cZq6CA2?`AO(vfGszY+Uya&j`Uwv^ZPrWBSr zyz@~8?1n3P-I9=~+f|xP*fc*>e+}slprE9T`g8ub0scY1Q+WWwoB) z$l)%)7yhr}L+VdFH8d}7mtDS?e#HEyC~e4E;ZK=NXjT6GRPE(W*cjYlg`PH4ekWX> z;N^x{)2M)Et^5k8t73Z)C=6Ol9vm4lzoSe#Gn|E&4GWHxPy@ZQ#SfC|CSe2gwr;XZ zRRiQ#{#=Da)}TDSwxlDt=tj5$eH~QbC7)6bkh$W<3xeazkf=VM2Cn1vv2;6g`cQii zB-y%idD;{)Vq#2o^1c6WDcb2OcREj%YRIz#VE|u^5tsk28KnG@7ZT%95N^^-UuE?%O zNb-|!Cwim|prkp)4Nr+g8G_ghSDxH-xWxgI?S%IGO6iIpm$O&NV%uiAdV3WgzqYwc z9$D3oF&SGB3Dsp|V&+EeXkgufNvQeqg%30`I9Q*JP}lZ`rNylvPXY8v{rp@9put_+ z%GrM0v+!cjeL3X>kULh{rrSq>gKD+cRT%eCL z-M@U)E2T^6LP@FP{4}Cy8?#EIOzn^y081h9#HE$#fhM`9Q#{oS8%pln1@4E=kRFko z5*7CZg8`gZWRT?Wwdj8OBs(jBLeTUX(>31)dY_Mw!}B(ZKRt?p^n!fm0?9d$uYbC4 z3&YLjEK}r-T9tq6>ap?4QPMEoitAc+T>z1k>c_X=**V{wlC(IH&y+D+{H!a?{N}(3 zE(_<~)`@i}4Bh;hJv?u-Xkq$!;G9g3Zck-; z$MdXP8NG}{_BM7N=jtj-qqZ|5IE3QQN0#m7%G}rjAeE`CLx6$+k}_s0QX-SXTMQUk zGP#lR8&PLC`N{ENABWMmXJtv_gf{5wuIuJNLQbmR2f{4_Ezk+Ls`yoz8Es$+qByVh z83;l`0qH7KjRlLog={;}M?%d}%hprzL!q>#M;D$DK7I=C1=8*x`UT@_;NgJqNI45u6ty zm7uLG=L@*@Q;M1}cNy!$%0P(JhXQq)ok7@m29?n_QYA74Mr3u|V@wT~Jsxt+791TO z_63%A5^@n757wHnu>ypTN?kkBepx4MCd>FWN-WNu6rn+Aycj6^ETjeVmN)h|xq9yi zLt$2aK06Afob5#<2!VXI$(~igW0*knmFl5TQiu(_`-_|sAY0n_aQ6&MN4<)Kk1*R< z;TIk;A=C8B1=E~27r$qurW$L%e+RX9&jH&=N=`lv$ph=4d^!!`B0E{yZr!}DQZ1W8 z2xVp{Xdbv2Esu67j@%e^xa|`*H#)4Etd6~8GVQp^X`QCEl@3nn&d1`Fc#^$anpKr;s>O(BF7^j~3c=ZzlS|_Uv7SXuz3UA;G~v3@FlJ z*>AW&RDk{X*|YSgT1ITE1%u|0&WZ4@#7WV-hbd1(gY4S^XJcdIIlhZA_=h$c+4pXm z8hs!w*h*o^WDnx;A{3p5_%etCl@HArG@N~PxAZ(@mqLwdP7bD31yA-9ByzMpM4391 zv5`%Xoi^R7-!|TgkWR*2i_$ob^$)MHeTX&Pr>=>Hi?~TR+t3E{j3E+)LsDhWqdpZ1Ka_-3HocvqQPSl>#A903on1 z$)X%7$;f&}N>N^eM-Quo8D&|dPItbGx850`>kylbm-t$*N3Swkw0a6)3#FHL7eWV8aPiIv| zh7`xxW!mTUuHt*bf}pU1d$MQkI%}B>JV{2lzJ;4Dhq*W|16J#GLV)0)D)jSIWd$v% zkcm-9S|RfOA#>{+ZUZcx4ZN%O<{`RnT}V*Dsnbubj3lh$IZ=@uLILL9WyvrT_DV9V z-HX(txw>sSI@LQI4A>R?H)VLnKI7>irsNv20%x)4bn-};BnF4D#4oHyF1?UDUegkY z+7paL9cT;Lt-bMGjo+!8cY3-m5fNl4!~Au5c6hi9Nlu z4@v_=EKqFf>LR*WP>6;_gKIxUC3C$w^JF^o!hz&70-pvx^>4l1M6eP~a0pDvq~&Xh zLPl*Ch4`oKVg%NkZ#of#Z!O7GUe>rU1tqR?y{{P+0a7%Q&oUzMjza(7kH0dgKeZus zi|Fm(vndhTcDd^x&Qm|gs50Uf7Dc5H;@(^|M4I5d^xx~0G*~CSPCh@JuUF((voLe2 zaOU26QEo;?h8Wxz5RXJ-^792BY-&L?`1Tb#gBIVW{$+&vCGBcqESi!_McFW9U~&sJ zwR3rBA5f*;mPlz`EH~n^+A{C}$s2$#Biw=%1h9TKx&|>WYLJs6Jr>+f7mqBz;N#ja z5VQOuDIO%MmUJoGy?T68yqK@D@9e!yB6HJK`tgTNuDN7eeHqJQV+7K_R@#S@$MuVH zve1b~v*B*|dSArc<7OlI#;yTMx;3B^fB{e;q=rE`E4;tL|5c1~Twa>6#jWwV`(^Nb zY(7f$Zn<;{?!@Qh$i~tk3Xcv*Vh)HlcP_E>=Yi%FX6vWUdJpCo7r_J+bl62Jc6nG1 zq%yN3R7w}UuS^-lz^}2jizva%gy~pox$l>rO{81Tx#)T?;i4w^#%J-DQ zLdiQA1E*8UUCQypSJ^d9a|wfHA%6OsU-}N(kE{-MT}qH28pH)VM}4gXdOORMoUToh zR;8L7rH^;QQ{Me9we@zcGkqJ9k(6}Pm@4fFM`1lGN&F6W;Eleap^OMgn3;Mp-HfLV zDb-*J1uit>pIBnmBg#wir+VOMXI;V66a-nV)|6;CUR2a2pV&-bt? zenAs?G=X(DhA_>FfilzZ6pb*Co4udXzVp;aZMPIRL&Mv!`I_-gPbV7mo7%v8R~MOo z5`8EN76;ckdIkpYzunyb3GIjoM88(A|Er{KB~ZM8pL0-5JYII zcEip7lM+sK_!!7w7V0Kf3#A~Q{qa*kb@3jFdP%FfHU4aFZYEv0iXzXvBx00%)%i)Y zc@_GSpb;&ysedvv@9PV6gw?f@;q0?tqqgoLuO11g&wv)uXKT2rmKyF<~a$BD3U^12maw#{iK5y;P z1IoKz{MA?DT4w+LdoM3e;>ksp3gOWRf$uNKs@4oyn6(eE@eZ5X=E*1;ngge?Jh(D* zJlY<=_X*H?Q!;kML9w4|IWmr(e&!JE)p22ka)HtOYcKWmoM6vb!(Z9=-D(Cy5o6T{ z3w67ndfp?WF8I3pC2=)vP1x^M!fA#{62#t4FmA(nbk0g-W7Lkfb7j$)Lg#GL>ciCQ1l*&_io-mv zde_HyS_VLW?{VU^!2=RBU)@W*Lsb%Ot6gJ*(FXIr+cs)R0e zYJ2?MoV%U8P~6~t_~fRqvPF!|ah3pDb8~eOW&)Ah>^+Fpvg6Hm?P=jzT2Yrl1Io177{+#k8%RV2ufZ0{%KnKmQQ`;9j7#k*aVgY=DaTqCb% z+L*y&!zWYFCVaS7w7b?B$Kh&WJoOBTc0Bxqw>@X3u+!wN{S`SZ zC5cr>1-m?fa5T*CWpTJw_h)^fHjXvb(LS_`Vq{BV5xfZphc%Vce~|ssmG+IQHOjv} zaEyY_IcFWUFXV1@Nj;VoR*sidLYY}ihRB5S@Y}+)d<+JvWiwI8PQVN5{%t(s>><#! z6zie-40%P@x|Vs`1|;42X--aW%Z!U;EtA5>yamrO4cF3sAPkS-ge6tPbH8DV8c4Eo zRFvIFXbUw-aoQTN$k&0Bc7OV$oNiM|RmxfOTqd16Isrw3p4Z3GktzOMDq&Bj>d90K zO&NqJ5Acf-T+7DyR&E#k2?TD8t2_vGPMf4Lube&(T25OTq$nj#cpH@>Aouqrlqhyt zsmEn6{}G$bk5X6H%`mx%IG1C&F}}V4p^NobGmg(IyPL9q=d<~7Hmqx{AKs`}KzU9_TDL0Peb&qt4qs%`Aqz#|vg;3@ zHn#QQylAKG3jtFFmZ`J6hxz=uTDOPYmr)9l141tbi3Ij@??uk_23>e%V3q>;wzV1kZ{R*$HI?)W=wyIS> zzf~mbZc2r+^a*V53o*%&9Q@kNRJFBJ>u`Zr;q`BOoO6f4rjB-fTx7F|M{bfME~iT% z6%kM>V3VW95-|<@w|gO#fLy$xDd($_3Op|trz*Gl*ELN<4Sl1>V+VdG0*{HIMJ8{H zh@%!&kkQZ$br{i{#*Yb(H;j3Caz-dh2U+2{)YefKh_3RB$p#wtO}v z7_QXS={RBBi5Cw^w;Dr-Px4F$$?|_4cX}d}igSQmyf9<2q4VwVd%ja8-iL7*GU2}t zgOPoq;f;UFX^4C>7To4arb?G>c`y?}O4(Y1;{}hbHH*u@tHz8UT>~9ur$UEg)d3pk z05kdy^;#agIgRg+U?7HY?Z93*6$rHmCdfj|t1a#CAGW9wG=zUYcC|O$I{_@mc zFFntwq?p2k1=FfNW=edAFa;$LxDJeOY1QrYp}D8tb$1!KS>jZ5I>A&G!}#*v-;*7u z)_r5=^MB2>|Mf(Rzz8-yj^@Z0;)&4^*RoZDk*k@^oM?gVpJJXAy&+L6-TdAbo~oY> z4Zgx23CE74FshR9+K>a%)_3JOZ|mc=yv)`9VWd(2xEF)hC(+EA?5X^}EM{iEIoXb4 z|2+;;Cq{gQ9o64IOeFu>uG9UBEs5)|wa@%d&(9jt^A}j4l8kz{<}4>JdvNr*UKut=tsU6hc5e2`OnU z^i_7aN}j*y+W-Xe``OvqvR|zg5aS3qBrPR>jBNe%nwlBQA3_XwVgP%=}R^foulMTP05`=BjM;-IsviT;W`XG?zTry>+!; zgfYvpPP3#Vt{W&v^g^n2j|>k=itMlN9`goPpdc~u7@>l=JW&S+9;_Nj_QZ)3?|LZj z$pgq*w@L3RSBN{G8x}N2fQaA(f(4l_vK}oEYXZ<$kHet=Na3H=JgCOQh*vi9BHux} z!SO&YL#Ca1Kdv3`R;>h;!*x_LM1f;+3}R&Kj0#A%VJiy^#8)r_k>C-JhJL5nYNN!% z>4stzEDSdSmdhfs{%VL<^u%l(j*02>E@X@Y1J03&SP&D*JCu(`3dKBxLu6=Z2;8f} zIcG>yD5K09UOv5ri8Co)0FSTBuQKDYpC`}RLDBK=(AUI;WbiI{fZLrgwSVh}uCab76aty|Q zV|hr(CRat#K#0lBlS5#)>cy4?N~z76Cd{Q6iVkiCwUqsm(1ybo_`o2i{P9J2BFn%t zz8Ge-3k08oKEfzLW$yi({7$M!CU_Qf5r8K?=w+BHBh4|&s9?PaSk<~ibMOZBfC9zz zM9HN~m)47(-_1HJhGc>+fU75c17QEO^mI|!I08J2fk=e7h?phC;j*bXHwlE-B0I^THy#CvN`Kng8WBg`-0H!4zWE@Z{B3*W2O$`!|p;0;d zw>rgAn7ZbI^n1~!rly(gp7C)jbQGfyN2qqo?f!C8Aq!928zEAV@9UX2V5LNQX;Do6YR1_zBh)-3EB7*N?vPJTl) zTp9bgMl1UJMbZbxJuef$#0A$ZV%+9UKphE%x^JM!WUmxH9=s(M4Ttu95nL>Qp*~0@ z+sq~)Mx1}dmVB-crus`vu(zLUM57E_P;-k+Ck!#51+g`N`bP(hTD}95mz7m+Gy-P< zHhVU+ypa42oi_qzm`aAeQ;+W@e8BUAB5+Wh@LIUJRkpiA=*@clr{U%PQ&KUqshT)$ zpSz~lbfHzH=En*Wb>?&Cl2rSntR{1A-~9aiiZ*r?@syHXm-&QupDl*DL7Qd{9VrBY zn-?*)xR{=1h3}Q`-MDm{(NA{Md%{L2Q5=Vr^yd|9 z=>+gwU$KLoLtp>N9|Bk-AUmLt3B7u|!Bi z3VQ1{82Hiq$iD3>w~aoGTI}pcxK|)XEXBFVYeHH4HM20iNWGAa&ae_`d$5yC>lE z%wF^W)=$S@N_#`X7h*nkQaaCU9>@s`4{lp&m(0K0q@W(1hNnL6wMP!-bjI~3>*KoO z4$mL8wKm+(xf=NpGoi?M3Ym$(V6BZ2nP%<_&rA`g@ci^ zpYY0(=qZN!{EX%F;RK=clFRVb9#m^VD7ppW)nsZE6uF$_K7JmBWolwlGcgfwG$ygn zkmN*W(S}~`pWApQbhT(@5iK8gb>qr#v}5%UF3zHN3g}Q^4Al}+KDJ6pPrs8&k&ixP z`Z4Pvu|X#Rj>QxMpDG&r8|3)!QWW2Q(E(jY-Hj3CarG$K1T!|V1Bb3nQ3XP*^;tB;$8OOdzWg$yM6n1#9T7L!Ad>M{O<-0;=B7T9y-)AKUX%xNp-P?FS0$?<_Oq?OTOSBfmPQxUgzm zb|-iFzuWCgc@B7VO!BO)x9l9F(IKkkQ(|>{sYlbnt^rEINUzh1<1a4F7cKX{yX{N; zME^W@khXGaj9n{nr|a9Xi)%{}`6FgcPFn`kmwZqh2rAgP2~for^y6R_m_70RUwa2I z@(>W|M)G~2=klcjc?i@?p+O!ZoGNPw!!*o}0p%yXbDhTm|dCa3ddV5oj1j z+81Hq#7r0w$*}lv@>E*1@#XgKe+rd#Ap49iA<4>I>Ph?Q<4kL3?Qthog+m0Egq*cs zfY1wT18*hH893z8)m854L&Zl$VlYsuom4`-&CBqI=6KHGDChWGQ%g$;s*9MO<0U1X z9nNvlvhPCm`%vGIqWuh^4io`c%X`j7Z5WNnaOT}zAcsgwu3?Peet!f+gu^RvI{cJZZ==qPh9p828Ssvc<{;|rJvST=}P;#zCN&nSjtSfWu# zMp`HswUm^R@fWbhNM=z+hA9=!9;rH%FGZ+mH6HaM*bs%!3jjR3sCRSpE=6XodI1sH zl(?dqnVIZ%GCC@gg)5$jwy)RiP#Uhd)3{ZeE9Xz0;H4e&d-agInfb)XqUxicI}OgP z{F7sSeQzKG<}NvYPkbW0D}cSx9x*J?9|M}bw}x$@2^AIOSn}H1%yChcT^ez>S!7+2 z41JnBONDgB4y!zpB*^PC1>N3&>d+@v&^Ezpnah&8va_?Z8OIcfHR(vGq+OO`3Skd1x3KdAbt!*tL4~BGB#Mwn<5#5>ls&0dCc9H9kXmvE52t(bl9B1q>g-O<0+`L*HW-C(& zrTfyR>vIYrZTrB<1G(y^FO-WF0nxi{3qnlQ7q2oo6I64wY>%ytn3ZPy(DNiS{ul@| z$*^TPYSmy+`YB+t&99o-xigtkabkO&!>BbB1sxTS(dUEy!`q2V`zNipt8Srq7g>mDO=F{X&P$ud9PFz{6IF@4MN6Yl_E`( z)ba_^w$`bVtE(xmT)C3sc6B(%F|Kq(l>Jdlg%<8iTOf&7%WI$2`oK}u3#A!n+%5~xo1H6HU+ zKxhcOg_EZm$niP)uaT4Y{)`ewJ!gPKx+D7-8Q`t0VIM(`K(rY^l@7G;qkYe9}XwFT$emmUkM@=PQSFKUC|p+yXV9D$}=m4KIi8 zhs4Gru})4L{g-HECm_~B3|P~#XK?3X%41ND+m>^yQBqDp(NpB1w?B#B zTduBn=VI?`AMn&3v$Dt{D#Q;*L4h=li<7h2Zx-%AwZmHM_OM}->yZy> zf`DaC;kuEHpLYKteqi5Y#)3{mJw36|G(w~SFFGnJ%GNR%92~!;7_!Pfj@8|wK7(iR z?9{C08klo~S)eS8+bWQ}SJTvn=CSGqV zjUxO4K7K3JJ({4}i3uv;_S6Wu9$w~}$vz0z2rj{%PBdfwoQBV-m*2Y#T912gr3 z1sv#}V8mNKeefepx3EC@pM)5w%h@?O{hD@{d>f?A0(c-54y)Mt<|8*{6JT9Oj3EL} z1}Bol)2moqS0?72sw`W~QPG~d3yAHmnGNJLU^elvpvS5KjWVYF6_Q+|hmd-O1QrWD zPVOhd&}t!~q`8-7slVuL5!acTo*-KWiEpxZsvz*KtOI7F*+t2%R;4ZRup@U`plvzE zO*l{d$-Z+h%kEDgUMvdqK6CBD~mAAW!#Np6=F3CLw1D@!6Is#@iKN{+~1%$bTiu_>Y>5oZSCPlkxDBD5Ef|6Ono)?i(eY z-eFXn)19%GiBP1aH52d_+n4m z#)UUx@S9K-?9Sx6cLZ(wo6<9gU_r9&ZtzD;_z6=r*0I^{g#(_QCs-?!<4t3=O>IWh zBk6G^5gT1U`zUypVMkM{to2?Fam4u|dS4%AR+Gs3nunD?dscSZ%y9$#`B+)0IL?n) zmXOnBc*<^hB*DE0-vP5xw(wH_R%6h$5-3R#=y@|!nvMY)8aWXA>2%ljP#EpbE%G@* zeb_n$>(W3}SKCN^zO46WbT8v=G) zDFLo*P`V?wx|9DwSi$a6FZ%xfpRj_$0 zB~d@E(<`D_74&{jn+I83QamAS)CL7IGQbqY`(z4_9m^pLh)!@<_cj5Ng%<)-N6)xJMj&bejm&0}*e?UCQ??r6gJJuSI zGcH_SoU`Z+0NWX_Wt;{h^w$R7du8FJ6+<2QMT6{T35*rKI@4g)=z0yb~ z^!mXL!}s-pftAB{DXf)_2R;5gjCFwNHHFg3oxo~UVU%c-VUQiTn(E~LZ(<4BebHni z6YnTV?Mee*RVbh6+#A?Zc6>*$U;iFd&ZI!Isv5s)cJi~} zE9ND`w*CL2mf*OY!twcXGS#LVtLZQdM-<<=czDcO9RT7XCCA6{wBhaBbFi}mw2sth z#hcMN>E~5JYduWCn9oEzGO7Va_k0vuRzNT&JRrB#hme`-1z|XX7Mb{f8>?@*>7Fa=z64iuJ$b zJUf81U^;{09sm4!fmrG~UHXUCP-n$xKF;3*@@}J|_V%CrMmO)9i2p0!9>){;zw)|` zr~e^q_%;BH#sZ}}Mxlv`tG7wvb=_svc3!v**dl`Q_zESt-AXKT0O<`R-KWJrgY;%! zh~Dh9379v>{Pr(FPM_Ma_Wv?RgZ#fCY5p6I29p_w37kGeZ-w?;2QMuc1REi8rc=H% zCDnbvdY6H@VXlAn*Z$EBw-cWFh?vXr72B?YH!JC>v0p29#t`2&=5oA0g+c2y;^G{P z08c`Uy&cadu#f1nI!X*f{U5vSytHkZCIGdz-|X4IO{kZr`gr96j;C#L?A2G&G$-Ra zc?L$QsOi-ii2=-j2;Q4<^`Zy2^mdOxY?*3ZrWrYYnJt#hStdD-88S4rcOWtz z;Yu1ehB$Bx^Ruy>*l3|$Dv07`T+K%&1D8cg})v~7{kJ-rq;hv z-h%dAHQAM&ecx6RdE8GKAjO6)4rym2#@D&B(up_;T|5Jj5z0iv8DL6S5-3>G5_#9a zJ|kz`HLlbA9Plz(S-p&5kL@9-U4ru(#(+u>TNZ6!)t4lf4B2s}%Xb5Kc7GuqNF|Md*;WaeepW?lb z6k7;TgbhciR!D4CKw zky=~j@AVfN<|Z=?uXfm}nBb$fuV75_Mh#S@Mk0tHCugwjb6ML=SWbc$yRWZLVD&~~ff&3SxJF$yb#z!x zz6DqWW5O>2CI`m8qqz+?pK&8rgjqB$-J_3mDN^JvU@ybfrG~gll zkhKM#Hr``MzzjdcbhH9f^QzzTny$(gKussI5)k7xv8~+XWJP1{R zl*5*OZwzJuTXywjd;VxyT0j~)R=m%&6Klvm<@S=cnha6Vt_9w}`fzJt8p^}ClyfxC zVmZS9K_`Rn7w6Bg^h}UH17>{?(F?(82hf0K;2p{+XgcY)F)VY?T~QB-W*$?4jTr23 z@9ZpV>J|(FhGpSQ1cdCf_a{HL+=5RsvuT>>cbD{vZ-e}kCs3ytvT+S-@5`=vU*~yX zZ&?rA5!qq5K43K|q%3#sN{<`|25kq>5rc)?Qu@sVm$;4qJGjpx`w^BdZ9=5CXT36s z>FMbapuxIEMi_%Ycf9z+{=7&*bsx)s*lqT-m64dD=wBV9YKkFDjh*9N^Gn+9fvzrXz%2=7P!a&3m0RAm@#o%)J4Jw2u$SV8tU~F*|K@W zMW)F_`%yO4&^~0)FiOF&KgXnVkw_owv=+s=AKDq2)tu_%0b*_DFe=1XRcUXl1nM_xYSEJ(mfE#`}_`7ru*XUpogU903L&2p}QhS`zh6t_#I+M ziHEkAXpa}Lz?YqRBqt{)`%w-cc({Ln*2W|z%RR{uC+3UUF7Twy+usgBFsMJ?`$~W0 zL3N7L!N$EH>@~`R#S5nfSQ>r}t0a~=pZ+F!{5I#g7V5nh?Ap01@!Jo7gv{ti&ul@&}4<#+~ z3JOW2;rJIW+_-o~wF+1lv(P~k6bBZRjSdNh!V`dF`d^J& zW*+nO0BO*Ij~mZ>L+wF-LbrfVH<%N5UAPrsoDo$iO|KP$v}m|a_V%xwdxO_>0tUF3 zA~l?CE>)r9kU0sSn%|H^w)$x-)gsd?m>_n@Unjv?OV!iWrJAev23ra+yPDN{KW{Wn zB8z;NS2_*Y^Tng(A3w&9LNziJF?z)>@9ypf%VNAcCbEj@OLrk#u^3V=%vEoeS5}U$ zmWqc!BnLPLYM%q{o!X-&ujl_Sq!kIR99NrqA#H!AYOL7&aOc2r87CkjfR^p?!0DJ? zc6T3L@LR|X)$&5fR1oAs}3`{Y10Krv1jpzqABD z#Yp{V^*e=+1zOwM)($p0JJo;dbx1))CZLFhaNPl?Q|GUQfdWM(prpNxNg%*Dq-TXl|U|~!thlQ@d2bZC-Yd8J&Po& zt7{e*Fd@gbNIpy7rH{%yuP&=BU$#*wNq>TLb`*keX2~wot`Y_I1IYIwdtdYdj2gvwGcz+-9_#Bidm}GA$Iy&U)?1Nx2PyF1&3utbegaFjcBks5X;F}B z7zy0c)_)fC6)gFHhuxgp{pvTq@(!;3ip7FY$S3iQ@8)ErWMpmSI&ezf-u4F^?fkVU z^{u~HrDJG1X7b$n%_^D4)%4~U^{sn>X>^0VZ6BCOjK@BuE4QSo9{(4u# zxp=gU-p5BNG99CqeO<_UQLEwr&7VICkA@&>lbj{0uz_qAufh(k z;vSXmGvO`|G_0}*t;IrZ@R?J@&Owp|>XFn`ce%NZ?tYF54{zqTI^6GVqAnLjbhCv^ z^CIJ5y$RHw?d;6+y9N@)cRh#)#UYS*QxF(kIH^@e#mun0nwbOXP5>J1EaO6L!mp$p zm+Lr6hcJkv=rQ-7Thfu&mwo`$`_(!13N5@=dIB)|Dcz|zt(R83c+-u}~garkKo@$(PW)JQSlzPk)%*5iT?4avvOAcq3*-Khx| zmO|i6h5>@Nmf`WRx-dZ$D%6(x8Mr?Xp%c=Ytr}-C?Xz*7K`jPUvQB()L_a!pn$Uoefq}#PQQX?odQ+-9 zIPXj^RKh%)h=YLpQ=wH%NBN$C5+(~g-l}Q`1WRROsQzSC9BW&ewNk*3Aov0k^W3W& z)4D!C5EB`~Xeng0DWq%jnGXTLlwh~-C=DAcuf5x(a3YJ(n&{T}4ulfH_6)P847C6m zUVgA2UEodp#@G5*$S7Bz)2uIj?Ios&QH?^~s`c4lG^tK@+K3ZqEc<3J%uy zVhb{eRXPv+QnpAm(0AP{R_{O&4(-}b2!}jbUetydKP{>v^Wnh$RTlArOn$e zC3F@!8DI7+n~%6RKm+lY|4a`V+F?^EONZd5kSR~of-_4gwwq@~J=ip{l7Y`8{nEyDn?v6pdj7S@Ou zhv9lbAMRPW^}1kjK+u0*;)_~wVP9?8H333gO3MCT+@o97?bEZE-EBB&cMhgZ3(gq7-GskoLYr zs#2;Yg9W%DUc08g%t&x1;vxI9m+Yi5wTJ(a{&>39aRB49P3sh7O85LL{}JIw1qEbO z*Zf;8AQP%%-;RF(W-FUwIlGuKfGg56GlTXa1%|O8$AA0etE#c8Qa!oOl^uOxK{+Us zo;4%p{7n8d_L{ZqX$UU zX*ppKb-V3vqY&+P^I3q{z|Q(fR|r|K4q!a=A&~>OKX@6{ZFC9;_>=K;3>}be(j+=r z9h2 zX{TyO5PW~v0rbY~al1)j*$kHqA4G0%jMID(fV9@xOs^QE#jOK>{WhZMjs#_#jZ zjo7p?Ic}hMtlOAM+SSQmwn%jH2OM~#O{@cE4$M#D8w|xCIq)|qN}ZT~*D8l!eI#{`vm!DNJfhb^keY#$!i^ zP($jn^Q)mxMaN$$Q+Y<(_D3_}!FEY?LyAlk78W!#+y&g6nwtI}3S%z*9fk85C}qC@ z;#Lg84o2u(#*q-{HwnIlaEK>?8L7Lkj|*22#R8zMo*r@n;u*#@9p0GKIxQCstVWF= zq{KfHMt28H-J?WzG47ZcnY*BOcE2_;e>Ki6qnj)G{!)0NL1nCAn&%irzG*(W1h+d= z$;hkJSm$$q-u=Pt{643~36LoU!c{Dh`}a@V|NMSK$L!g&+E_ssEUYLVD{j0~zs9Q( zoekGVk9^ywmVf@N?}*{Qprf#m>f1C;$HEd807@9JV`F1|uX5urwj9lHLM$wpV8NEM zf_4fG4#u=RrYwmvzH>i9&kUD4Jp;+ib*9dU7bva) z-KO`~zeB<$$hJA-VxYy-$J-k@YySN+HpDCa30{Bu{@n|tqgXHr#~5i5=O4WhblH~9 zM9xRJlc7qOQ#14O2w_4FrKPIhQK%M-z5~!n=~lmn?e@brL`%Kq<8&a{{yA7+Jmxy* zy9GxR2cEDCdK^pM(dy&g(S$H8XRHunq*#n>D0v#BAZ-5PxBbc>y>HKOB?byC9Gv25xVo z3ZDUZa`)h1#Kv%`!-_Vq{}~bQrrauY#sOk%Obci4>8=YDK#8JWEV>tA@(vrlu>!%` z@8nd5XVl-@8dGu-vYT8|&U zgukDQzFY=}J5Rp}pZEXp_8w48bzhq}ih>R3I~EBjU#?yy;I}kudm)VdUo@B($PdS|H(=vaG@}6`@IHGr9Wj=n|>I0U?MJ2 zNs2kw??I?mjmR#C@gl&YO9?#(_iCnYp+kA=qCT-nV-4+yY@v5$e0gALaTa!AEwjKr zhU{l~mF>!WF?FOaAIMy4KD)1eR+RkBajLgaYqM1}+snq0ELRv_S%GqsGH0XZ9jSc= zu36|6!Y9hC@ZN!?&*6>(waZ%X-c$A3>+5T)Uy+jQ?0(e#54WdIo=A`5(A4z4N^S^6 zXB1@^E^_*73F{lXp+!5EGyN_wO}3YLt0di)3#?zhar&Zhk@$j)_Nk=INao zKebFaBUSIFNFWqhLvc6g- zdTX)WUy@8$ z!~Of1=2`(Q3pM~<1&!fIK#6Sx^KYLOlnQ!P8$)pxtP|_15YvtE;oh*i^FZ z7a0LLo~nfo)eS5fj28Wo^*de3Er6`dx3Zq_8>|Z~8?ZTQdhy}|N7ddgk2n}B83G_f z&yO@j{a}D`hyH)>h~31^x2%NM-n%SUg29&W(#2&uf-hct^&Q(lz;N`vt+GHYO9_iy z)7R0tF)F>>{pHJ3?~VF=ieUb25j{NgriOV7*{m0pmAyZ|8se=s`NXbm)mZ*vxH2B4 zJ@@v#>aTT#mM}Vp=gZg;x!(23^2Y1BztHzXyoZHqLtt0!1++| z^-&+Ca<`w0E4N$haGadS*FSS7zO@YFT%(Pv&R4kUuM40?H(Oc?(K<`{aDz9*#iVz$ z?oO0rAOg1T$(3x~_K=57!}r2vPOxkeVGsE6^xBC*pYTyf>cgdO;-g)A6y5rb3=%rP z>^Ryize#Km6be3;342BJh8JcU*KDo{OlBDuV4;Z-YzFMA{xi=A`(vBXR|dRc4@gj1P;6LobT6#s=9UaW(5W76PnBnn3SOFiLd^@k>FTP9w!sXIui@vZzzSwX z(GHG^M-s|wKB)TaCXgd^08&B3vz( z!}*@vxuEG&38ev_tS%Zg8*9A~sk}6(h;SP^qYdLzpQNm`CGs14uaE z?Y#)*eH2HlnJS7qO|mbjs?+To}=4J8{5T60N+ps?R@(Wnn@8{`OQ` z>Wy%s)m=!o-E2n!0+hzyw?OYLfT-m01ejf=i+|Vb0y%*5=SvXpF}?ONe{elgdJl_I z{Z94_KZc0~n3`UgU{6UexCECiEyZnl4;+xG^ExY;eq`;DURb1|;5?8sexJ;ZpBysRES$*0N?ut^GFKTi%Z zjq59PyrF26v9?|z-qF;e!ArkRaTp`C%}JYDJtD79sPXvVUFU?9J3DQ>IZbT*8g_h) zDlbwgvT{`3d&QKkXeo0%uu?O4X z{x6uqLMxKc<{Q zO+S@{BZLcm^VvOk)a;n^gNKin(pCMh`S{3*Rxy4=Nxvv6>X=t!(r1YhNZDtVeTi~W z8}NS_VJ&fbHoFRkcCqlL`+a|wtLwR*~|KSB7M7x4x$^hjZ@~ z>;+zI)?k&wSx#K|-PpAe?CXEZ7kGj@krLhjUc-pJEH96MfWpaf6K1(nr$D<5xNS(w z?c661A8vccIt~51&$;lJ1$N4B|O=qyLapN^v|k}Zh?x|o4sxG5ED z5?*<((t|9ep;%${aP6S}rVZT=2GXo1;hUV+bYtXmEZG0ZB(WeC@KAkTZjwMftSm zx5a4DLOq|2aZJOqZ*d3yGC`HyrsJY7#k3_neY%HX`Jz%IK5GTMl`O^}cpUfWXOA5j z$2)aq1R4`8JzyF`ZVLYV`p$uDVL|^snwg4p#2YMs5fQSq9GvOanSbzLt5q0-GGCG+ z3||zmg4LSBz?gn|BLBqI;D&)eI9kwAF#Wr6=A_f6#>KD4QrkyYhm!e&;ac{|DO616 zUUH3k@e!{ivYUjvZ2sy@UXJ0sLn@{l!;w4RAUm;M>W_cpmQKGji>%@NobyVM?8uGO zNd=Q5KKA#8KEFum^)2>uK7Q(M{^w|JuRiSqaXUU}=!cblFU?#T5v4@guKY;p81nW0 znW_=b;Z|>wE5@KrC7#K^xi?tYAPa-?mb1OQ*aYfq{W+}Z>fu}*E;eN3@H`G-;=ulg z*thqd{sdYVa@#ypZt@HW%#`mLE%ecotsLyFt*SCp++y%5H+Sl8i_L%laxiD(-3p8L zxmCgSUrjp+l}JZOp`&8b>GgB6!-FbcqoSgM6r%d_xT=pIW-`VyaRX$;oUr@K9>mUTf$cUcIFToUe$tWj+)h;n9)pVYR`qt<^p zC*jmP7E}#PruVb-DDrHge(2;CA))y^{m@IGw?7a#md+i2?PJ)T!Mxa2kUli8d@y+> zL&f)!K=AYlg1V#LJ!sl`8~l#@WV*xGYVTaA%nfywJFqYf4p+lM`fM{5M|MwMyf#bk zMB3VvmN?setNTE}@4DK4Zf@GqFK5JxV{t|ZQXRNXoie3V(Fp12iEA>MR1YNh z?5k7Y5aUB;yffpP1Q9Fsbw+3KS}^ELQoJ*n12xtoq@ZELqy<5}^)sD|YX&6W`61q- z(ve9&0;ztF;OaM;41JmOQq~-KMF(XpFNjWCm_zgidCR5>7ZVv4tB=qY7~5r`S(q2&UuY8NMyixQ zDb;=3n6eKN`K92}FgpAj4#TiNwU+@=JUxz&Z3pjM;>})q14kp8_f2j*myIvda6)fpl4 z7YUoE9R)iarM-n$@51J8VHg^?+E9C0xs|u)L)h4p<}XVIc&v28uNT8Q%;@(kx+lFy zA3;>xnk?%y@{!lWH6Iy6XERb*d)5;iq#|n2x5f>Duo~=LT?=O3zFVb}rNLo&Hk4~5 z$UOst@JjS*q*WEKVZBMHgzs9wWM1x~*2A$(#D=~ZU3{x5w4VmXF_%6&`Ga#pxE`xE z8n`kDGiH7yPTykkxm0D|@QoarTqu)7_A3|$>Z8jsOWGBLdVt1HpYA)Xe{xRq-Bzik zTix&$rfbPfQyRZg8bWokjl+ggT?or`&qVLOLL7X=$;Tx zUddaTSZAh0My{-RSdE#qJzTN%A3VBFr>~i7G|m&Tc#Dj+Us&v)`4U8=H_ht-y6A*(2E@=-9@ghom55v3=f+q|cw9lTBH_-WLq3x~k{FwTOrH=)*qW zBAWS(Ig7W|Oi;nKnHv){>xw?9bX8db=Co!mDf)cdWhONX^gDu3_L zxU62LFLM_Xm!vt6&SxgY8{093|9 zK<(*~^^9LjOLHF7Z1ibQZcI63nBV z&t*Gb;rdIF&K0jX5Pcx>^=h~JulW?UT`atx(V_W8!bp9o2|YK5Y!eBlfpC^n_HCbR zdirF4TiN;PH1*-$UG9kgw$|#N57W7F+g@Rp!j(+BCc1L@oj&A~J((U1c%E1vLn+5J zN33+|)h)Rx0R-b2lJ#P~x-(P{>hu~6mOh>3m}rp(GwjQa-^V=bm>KY6Yg5Y}aHkSc zYoFkimVl@QExv{xG^dE~!k#FEr1x05zr}LBJFS?#oJvr(E-p!=8pXm= z347Nuzn_!Q$gX}+@K+;yZ|#8_CuC)1=YI{y5^PsK*qVt<6~4lZux6Uoy3W8&9SZGJ z!xn4Ji8X0tuGeQ4U2`iw;8mR_Atfcn%p3puR|d?6n}~}G=~G#+$z(?G%&odmK^7Jk z?h!9#bU}6&Fpa%XqXdNqiuURrc7-~6daa@KK~YptF{idRSj)k6XgV~Pg`;#6iylGzf3o*#W!u)!4j^EgE~IKK0r=Qnu34zaL+{t!I=yQ5px4sk&g^YKQuMxFmSirp*4+X+AC2QX9CoBzCTwK3S8Jk3ytQ%PR!q^kDTZu|4bSC$JN z8~;3Ixxv%6$o6SZ2l6)X6@Anrt@^$EhCkEcNN{A=H9t7&S%CVCks`?^bk zTa4^htsC=ZbP1Y&1mm8157p3Y~TW5RJQ7pkoqUi*r~ zUEF&A-JaMc9#2;TMu^SB4?naxJd1?^Cm@rkM)Kg(0-v4 zJ!c-rHRwB#oRqYi6H2cqf7M!v#oGf55HE1xz?ZUs9_8itkL5oD;o3=O&G)z<4|c8&$E8Ia%Egh4Ior5qulq0{Q#p-aAj^-j6{11CK&-u0!Q zH~vQPt)xU@;6VA*fpiQm$GIZq?=y#>gjn1r(OJ-2u!Q}(RsnUOEv#VQw#^rF48@CV z#a+sg*&_LcBH+zU(V!+5z4+Qcx1;8xJGGBC>v5y{Xc?P;6;NE0p)~DT7 znF|<@`3XM`s?A4~zTGJU=L`WN7bXbfp`MwToXkV817#!|g*TlhTRdNN-JBR7HzPJ~ zY7%9Uh8w>v;_jLoRA4-9cZ9lkTfk|%o#j{2u?tbR_16>M9~H#IrDTHT1|NDI(}?Zz z7;I~Mvo-kv7CSk_gN^jxL9IVApUO0(7iK$mQ7Y9FSXanLz84k zc2d5*35WGO0{?hHQ$eUaDux=P3$PDC$0(P+DP(+RruPjMvXn#$lz0MR`$4lIlWpUM z`kmA}GvHW2attzwP*9wlk6$JX!Bt zAqJ!=Sc~?+5P@%wEHEmVUSGcrC4kne2>ErxA!ONK<7sGTTMM!(%84X1lc$3nXWqJe z_!T@DEHppjj}(xZv0WbH_{KPzxj zuTB@U!DiFA4I1DL=EEYly2w-5HA?6@i(`Z_40@Eqr1uJmH1Gy zXaDRp=~G^G&l;v*1S*vVawh+TJ_P|p?mnAGKuMS^W;Iu%rCQa11*w*l|Wfuoz`8|IBG z^hbj3-{R({uqM2{y=4>?MMd?}%x)#a47c5Mt2SILS?7{i{1-Q?qx%-aWwqWv4f~+8 zZY-53yyrnPFdm1s5O#^nt1`jsa*2eC&?k|(2(6+hLQiX$*;Y~nXmTRV|MVCf15yAs zeo#B`wDsfo*|=(+EF<6oDHVXC?6uSzZ#K4@VYe*Ctmj9q7GNd<5yWSj9!By2+~v zt1u0Ph~$8JKE$q;Z*|;+VZkU^85mX#oe)giILk5O5;OHSM++PtlPnX=1S#ppkzd{Y!Ujr)uzKew3p!_EXgfI_7g51*`uPQ zq^>RnTr-dBxfJRYB2Rh+rD@WNP@4t27l@V%$6uOwb30{gZbRyUNC^pv@y>JEm+N(V zBzwUaE;GNvMZ;kdEE|k@F>dxVo%wD*<^tY@s_fflKJ(Z>b|5GyNFozsBv!<|X<#yr zKtb&QYA3Gb&R@xUCh$zYOTZ5x0Wg5-?%gbiWe%qS>0RDhbW9v<+B^pil=5Al?DfZb z4aRgr?e$=XJM-C#7%kc=KxVYy57$25x|e3j4CE&X(VFh4`Q9NdZ7fy+TK1!um`UR3 zIv@Zgx}y<2j)u`n@g;kJOS`-R?K1hood{1l$0W--hUb21<$jx-owZ%^mU-HOygah! z!Opn;_fT8%(xR{x@Z^z7lKWoHC!k-W3klC700h^JpIUveSJX-xU4IkP(*@eP*M{Ve z!$?25pqby}JXq$kG~G9x63eIEMz&`TVt~938HS07|klhvthmnm{=Q0$3#|=9Ano~}8HpH( zomB8Fvw>!2MQI?pr*`<`&0s|f>@}o*fRx_;?JV>$aWF|x&N7+0EL#p90bI+V3HVo| zV`H>N>%p)vD3DbP|5T@C^KwqzEfGA&1JM=@We4o~0(*e;tPQG@htJ0}gT))dO;ehN zZ}IT(JaMj=>=#%{Zi+^}(kW0O*R-stqBmWwqa`&RWkabsafMf|Kex?t5t@v_>Zun5 zJKwZ@qdOJKCnf`3G3@clv~YwXV|gKJ)zXz9=m~E-eR@8`t`& z?pt%CgaGQ>*|e>yE=|R^RYtklExE!DxiAu3RNMM%-Nk-tGA)0yjzRDr`820Y2uei) zr+=))w9kKeYtHzt{Df?gU1L21E$BA~g1oBmzHKdleD(hE*LMO*TpKDip>b!PQR}UQ z(o5!cGEQ%y?FHfNvwgW8IiZ!+mZCm6)kk{5BllrXms`Ykv7Fyr0#jqxM?XKmhmp;T zi{+@#*w0rLtk&JSl9A63k@v;}J;Wl5!kP|OubSqP0U9`->AXgoe5BUsZO4yJ?)Sne zaC54~4GkoMOWi=}u^%0f!#l|`%hN60O>!-%yglbPYk&pV#RoI6_5J(5b0pj66S|7r zVTMde?eFs-nbyVZ&GjpuJs)kjJ87DkOH_9lZ3i)qAhu8h_B1Pdnd*v6Vo6~PFOH>> zxU}(89nA00(*`fq(<7C)gDlD<+4zcjCei;<0J{5t+FetlH$)leldy-Y&%eP&nW3C+ zni{nG1<@lOdiB=+h3&X%Gb`^RDZQoO73{F-tqwjuM&NdxTwUy1eoKel|Dm)_em5eb zCp(P&<(H^u|kO zu7AWVQ#0|j%DN!Ekx-Z2h*iV)ehj6#!O~=RRha3}uZRNk;|*K`ApcwHKRYD9Js=7~ ziQDqID)Zn8f}=lZ_Zj>L*j1)Z2|npi$k4C(^3RdFthC#>)HeIha5^MSS({nKJrl+R?wB4}k#6fT( zm<#)*Sp35V*$+EJph;zuO!rydo>{*Ni}(i*9=wVP^&W(u0CO-=?W{^>r}mLOw{`?z z$e%$O3*uRsWSA>x>EzaRk^7Rr0c>v8r1iX=hZt-()qzcDE_bkVuO zS$X!W+spgaFQ6H;P^|j$YjkLJCCQ&ZAA-%R0sb?Ky%-wPUUz6ggGs^KSRcl@Rhz7J zwYkiXJx@g)CXWS=mf3RbxvDOk%0wImL&@!6mdq&CN>Eu`GB0sVm2|3iUV`R94qpAcMwb*> zvqvL#2B%`~>x%(u05OlxDWlNX_z^1~QZAJS9c*J5Iq7$0qbH$OU<9@)mG%dbsK3-f za~tawP|xfv3E)ZDZnN*8Q;+qMaF2x+TzV=nnN8+091T>d&>MMd>mM|%3 zlb05A<;iyLVk3=#u?6!bR7fR}UULE3dD}ZXUy>$ubqxm%U0w~%y>EB@x=QGB`3??* z119FpNisO&Y3iXtG_m4Uw(7Zj|B*&nZH@;kZ#3|Ssd&FbuUCKGCyU~LjoCIgIE~tq zWi_5Ek{iN$OyG5o1jJ&c58Ij%w;}fAAbH((jOIm7XL1LYU(Mokp^7mYMTe|sFR|QC z^|w{;?e-ee_#P7Bxu7UD^L)!B@%>L-U(iOaN)qF}{l8%VvhJ2XR z5O!9!Wf&gY+e#^gD0J}oZu4!&^UVL!qj_WQryMF!$Mk-e>oTFN$Pv&K9tiGf15yJ8 z3v&T=?&tK>GjW@mrWq2@&{X(*kV<-jMWJKzU}679H@4y~|NZ7jzm(%+gPmW)-()%b z92&1M`pMU?fHQg$(giN2hg|;}O}|rBny&194#d6V9YRMFEZxl) z%a$JA_$09b{+UI`79LJf>^_;r4#PHP9p(z|)l?uZ${E zt_w21rWAyyq2R9RL0|0?Z?>~kdCdX7YsLY(W|)x0Y{7U-k9yxfnQoSE+p@oqtafpj z0_vM6P*%60AP2Z{$M$V=so4dG_vCr8ciXpXp1T0?W%<-vWHb8@JPY`5vBm!`Rt(?$ z7pVAOz|`L#04()?0z`kTn6lo$Vzx6Cf6K8RRAtcza(gGR@c%rAZ$fV(0Fal30UQ7Q zn$^~&frfVrq3|0l&Sb~&|M_6ij+ct)FF_yWpm)Q1V=GMRlU=FoR)4T&EAym@e*wCG zfB3&5!GG}I|6>^azaITJivIiMM4LRLJ)BP%dqmrI`6=XSi&|9vOp8W`qaaHM<|#4~ zJpUFT4b-Ep^Y(&h(4OdX{H%9i7Y4LxaSCjOT9hJev?6i0LOShj-J$*$*aBhv(4*A^ z1LhwBfq;|lj1T}U(eP!E>aZN5j)2&JzZ*MEZJHt)cM*IoAw#mdJNZq66qY`1lnNpB zDh?nm5a3v@xWZeI3#;xTK!XsAqnilz8N63vp$m>U_~=|%?TXmy*iGSYYA9`f?v5HJ z0GWbb2Nw|=-$&}33bA5izlyrk=X-sRH>vqJHF zZKJaIs{b|K8wM+|MPuciMl)o(Gy#ZEcnB8-$_f>6+)*DOsJ#F};=)CJPtVb0^X{Z6 zD_K4OxEI{8A9G4&t_rV1)TKXMn|pzK znbVnv0hIz?6zcdwb7lCkc=Y(0oy5&)5Ukjo+Z@v~1$)}+`eew+zQv5>9qL>9XH`u)GS9sVBbk1*&R+wPj^#!4AOpLWo2aqoBRE}fMNiQK&d4m!+izfaCL6L+L0=}ho3*e9 zVm1i)E!Rfn_Bvi#+Tkt4^`zG?t^Mmz(zb`{6 ztNOA1QN9jIr*pv<0#U(Cr?v(ia91)4sm36zKqMGrpbxNE4IjV<03?Zsiuy8O+kuL{ z$yO^Xt7j+y%Lm2bj8a+ub34NC{$e%F3L zmmxR!We^#(HsvS_g)xHFMXa>qaDIhb_D7Lopr}D268#6-k()sog2eq@{7)gt0cOEs zNd;7xX|v`KoKJZH;tEw5n)Z32;3N&*TRH^@!I#wqz~2D{Fbyf*SyfjDk;ggRhRdO6 z*A{2PjxaNl(%%n@`=M;OUXsIeIAA<_utLa7$cW^$jC^S)I z1_2PN@^c!!lb}Q6Yv3&}^{X8iLu_BbXM@n|Jl=$CTXCNhEDpot!|SFAAn5W&NCZ5q zu2xP?O^pL#+kz?`$azTLt;)fn$&*VtKD-butbWtsEO}{r0-60=ERg`I4HP|`d%;?l zr+V;Nh&on!^mP<6)e*_DD7*wgCukl(PV2GV@v51IYL&mje|}-&8qXb?H(xu9q&5!; zHWT@X5!z9Za4dj6ZT@K+K#|Yq{->eKKDh?5LWYPI5&QT$0;eJCY3DUL^cK0o;G%?bEV-_5J61M4|tH zg}PJ2Qhwr<;IDKITA=X^gph#vXq!8x22*VyMC7br!`)_amS47f7M>cOuTC3RuP!r_;q?2Qq zkoHv^5J}|UAju%8P`CAK1-R+h1I=siUMie`%mY}MQYa6ordE;wy9Qh`PB&Gd1u#k} z6$1otFXDDlh(uLXRi_N&lKgjqFg|p^1aQkD@uLSyYGO2(XwnGNt6i{c!IrP@ihcCR zY{?~l{`DVpox+2#yn-`A5ERr0dC;ceO33U%@xqY<(U+>NM4ISaGxuDu3G4`hsXMP} z&!m+O*ArXt6TggiO;d@4_Vr66J>Eh>ri9$Pv(^?xGxazMK5dN=;WgsSNMD-bC*Xhb z%myVn;6s)YxhKmhD%EQcTill_s~24R$xOUEk8rpq>Q9Hou266`v>lJnj%_H zh9?0l=(w6UuLQkaiN2K}Szsl&@-l!jn3kOUnIVc|>5`fGt~4I5<9-K10G1|%UpLD7 zq#hs%3o7b^{f!&Vv_t36pT_UbIIX*6l_VyZ4b}kyJME@wz&agY8;c=akiLueQ5iIf z@u8W^&O&Ew=~6jQa+y=?(0;Mly#BEKg+d$5tb_FV&63dn#UUib3N}PQ8794W3yH3& zV7u!x?2aFWofW|I9FWm+baY%)0Dw6W>IE+PmJ}C%OF?`ff2nb#_2xM}@IEw!o|C#I z$MUa@x)>wONRm24f+*`u3PGEaQ@kgIBD(y1G5X+Vz<~kZ2nxn1$Pg60TNVCb=MY|l z!oxUqI9`?5J+1_#=3d{+tU9t}jAgZZ(-@>sgaxr(>N))b8Hs*DLH%AQl?M0E^oH3q z`5oPtuexiRd+Pwe96cwLl#tibCm%#!FS@D4k6&Upco<2+b*`z}m;P7el7-0R+q;8} zcWEmz4({Ur3b&+bg9Z<*B9MQB?5Pj=mX}wlJL1RO`EIj~ay?`L8jdS~;CWzY2tNWr z@PX)F+IqU75CF-LS@?JGa{lpEoI~&3)k9Bat7pW9*Rf9uG2Z$43!~EHCuf_+B&O=I z4?3x{UnQg^)8Yj)_A(0P^GTE$Aoay-Fyb_x;F-1fIH0N_y1l4dZ?*yAbk#92_E#jy z57F}q`?qaY_8CVWhYb>mqQK)3DwVszFCdTr-X-Yy$owVmWJrTxGRH7ayw*tUBDC<$ zDGLP2^d<*hNV6t%xB~PAeotp7K(N|s#_R#;jgIoHu;}4(Pzr&FF7LA1U}cm%*WN%?RC_O1N6HBOe9{T7y8o_n5PM-wu1LVFE?u3cOdxdzKXDw*+gf*XZPxh*=yUIEwq zHQPxJBHd!6J6C;2euJOXAU68v4Dt<`$kn2{x$WjK{3kO7AqO4F?%;8Q;-72UXnmZba>7{E2e`+q=Tl0nes6&}Kx+Jmnjxl*OrS{3o zr>9RH%wnH*KCZ5&CW(5`3Qic1+a=z?Fc39k)vsM)a{1Ww0|P3zT7zqT1K_KtBsg!m ziYq#sq`%n6@9rigr1HydMjO6Mo_CfB-!n>gb7Y{$qLwx-II2S!sj6?<$ymiYXo!_-@RvxPr}up=>Zn^N{0%I zinFoT>2Vu%%MR_=%W)}j0cHv_)ihL7b1d3K_Q7fx9vCLoHoI@R#6p|BSF;BV zd_f{=Cw}Tu%w8mJ+bQgOFM1v_)6Y45g?nrE z=hwo*ae>=wNV8A7w9dt^wXS7cS>EgWz0Kxc&C&cXhI!lXEOl>npLQr3p@-bMbs0Qn zN$x}Gt=k|cec{OBGR#nlyE=}ZBCnw_t5kh8JDs(C0a=9lf)TWEf&vx#sI&7M?~YfK zkul^RFbV9XQnS8Lk3P_RTdD){oM!=-fY zHuWGFek<29%ZW{V1+iVZ`l=cFyrGUguK3gLE9)JEJ5C8-9)*nH6wDoiG*-SN^ov11 zjQi*qI{xQ#x*HY&T~i&A zD~Y!KI_=Np^3fatczDXUe*7&E36k&=KB7yZ#6m<3lEA<3YP!I@%K@aONIOM&YN{02vY~WoDQ2-A% z;E54Uaym}b(a9;Xepjx7C+U28e{pi>o7Aok$7pqr!Opxb zXB^II^?$Lv{>H9&qL!_s0fN9fXmSX2dC+9|V)wvhWS#LhwuNX)uq$74Z`qzUL>KF% zuBY1~jD~Y$2W5ot-B1W!x6RYP`n(T_FWuLDAkqGJN=8P)rJNV4z!5ux5*n(N+mp|` zvueunN95lpHA(?}1@MXMxs{O8g7+7>!g3GRS|8m9E!2$ZgKeiw!Ci3ZEmz~X1>nF< zH-IaZ!!8(NFjF+dRA! zk%hqI-`IXt^03~aU-y#K#2q5DOt%*g6= zNRmOO&Qje8aTm;`#{&|YXXN~W=3=b3`V$z4ucllb2S7@^m+If}C-&MG^}&Ir0gOv^ zztu403T<|F7B^i6@GJ<>mrLDQi@G&Ga(b$jAT(+us+?PzX#793z`Y`Ci-nL7NQy3q-UI?!(n zk`xuY0EP9XzV7c|Q+*M3UEv|{rC+i3fu{}S0kz1q?`t>yEt?<+x9C>}winFtU3DM` zKJHeY7S$=HyFK(HcvQM5&hC+D+2~ur6{UqjCJ-3_I%OIXEa&ncXu6PYd{6KqSM`LN zDZyhXWYF1YXX10TPJj_{Nx*(9i|J9^E&{+4V~xA2_##lAG!hbIAmMfO_DNaU>*kfe zNsUC|Lb5Y7sD1hy#x+MN7C%|CDj>|Bn40RsqA<2c@NE|MXIx*ZrgrOi&}M&rf9D0tK#-e4|M^X^MiFy?0i_I()7le-d{~sRA!CfA1*){xf^3IRjE%(*M=)eWcS%iF6ouOtM=&z- z>#ryk7gs~cvflHiIc2^M^2=7UpG_CZsBM#`_srr&GF5Hj@M7sbgfJQtTV2GQ)z7ds z3AS@X*+WrwvyI6c^TOx zrS@kice@_U7GPaPxXJOnUHN@H#{5@BCl~a{mn*IUj0QgejCDfCD@JGG3K06tUiI-P zXkZ$$8DZI#a;lWk(k0*8cxYB8!HjaY%$;wijx70ePOVi|RgG5-0nCG{Fd`>Uy539; zQ73yMT;}~Y`EfJ7mCnd5i^NbtLz)7qWkMC|PqfpGR56{(g=DGSTTl*L7~DEZaL~wx zh5aCA9SI!*$vsw?)q?%(M;!U5S&uTqo~yeQovl}34;*c5IyscezXJ*cCU~CNjEU!# zrY|`#!!VAqVvd9D$kOrkqE=&O+H##a`$pQS>p=QV*zN=CR{l5@gcZZWhRROHzkPeG zQ3-f|idVWHTzYb-bl-(a`Z19He8t*n0|cf;k0!5WMH>Jf`B*3Nrzsh>gGuLLh5y8r z@pys*@DG6j?s{xHH>j!tIoIOztP5Z9bHRpv4068=Jk9qZ~exQ){8Y|>tC0Z zD|=*s0PTBcCce8%3S!mmM^Gw;&|?+$B${!a8N?gI5yeA8Lp9r@BF-SsXFAY@4yioI zA=v}E3MlGSFZB2wzPrBiCGZb{yU{N>1-Y`8zqps+!ezHMNw&G1n1KY6^_^1ok#a4_r)i{99;nS2@53)pOIwLs@OCJ}X zZ^C&X3B!Ou!@-Ww-@3#&eEWh11Kg(v_geu;9iW|g{rvK+lcB0*XM4zGY2fvOA)MKg zpVkQecFiMTEDt8jd03lFDGC~NMP3;zFq62X#OKE^7bUUNz=$0O4RXl|`8JA^I;mvK z!mhlX03i$S-ZEZl?9}C|pPOurjGlG)len6|r>1|0bh~y_NI-xYf(7dh16V{pO`#e2 zDl7z~OjY8E67rwQICgZq{g@1Pkl|4?Go1)%3;lp*JVDVOz|$IQs4Q^!`MR~z_WkAV zwdd-Y5SAW1RR{>Ca*_7?8jil|&?e9k@3YlUQ+n?4#1FB=TLTujL!vGDaX!D3qvOl6 zvMyf|8p75<@8R*zz9~DrF?m3`jpyqU&z(utl(J7y?hN@~%NRQ4rNre8M{(EN3#S3l z(M|`X0Z^9E?^&>C7n*d*Qs82Q&8}90n*VFws{ChLU?R+f^y(PwxLu28fcY1e5#1|B zdaiLiuCAkX!$u!b0j;7cWEefZV|vr@Tuogaq5doyIDX-{%Tt`Qz8Pw~Cq#(IE&!~em zH-y^>Y2(4j()6wN^D)Btg7wA4#Rc0h0(~}tY+n}LZoVv}T|J#XbCd^ajDTFwNqepS zH_r}^h%;!34KusFx2p)q&Qgz)rVO~95>gN773x=D`b3@IH>{nb;rFc0QMmY6KG9#F(OtgtES;*@9P9yeHSAZvC2C(+z71H)e62S|I@%6p33xS}JXVd%LfT?dSMOYizw}|@kTd{2fXGOsXBdegIjlP1&BA77 ze+=Ij^Ss&cyjNJ5jWl`MPU1lHqyyxZB&&H;RaMo(jrGW+!kzWd9fEkeA|?9O&NboBLW-S<}LwqJkaDjh7wHvgEF`#k^I z{Mj#keaFBDjv?gNN<&&~($O}BJB1p0Fs>%}{!t%3xY@t*e zC?^gk$}*$iglO7i{i}^ao^Fb)lG0HyHoE$)(Dyzlvy!~|s=n?>Wh}%!iYKLkAl#&S z0=9zQ?yrrQ3=ytwv^IOJ33gZh0{@z`Ip&V}&nRuZ3Zi~cZ{|L3K7^_==!gt6W&v-T zvOvzuMzlN)vdC z!8y&4Z5#0F%0J}|eiv|sFTe~0;t#)>305nC&3jT|_8e{*N#UNF=9utN=^bbl5EO(s z>-xph&>YX_aWGIOJD&lO1EnSbfuKe$EvYHI&!)n{?OjLMCWU?4Fd^3tupIc;2}}cslgsT(AUWeItTDTx!KcE8ZJ z4_o6C*Td<3;pKVm`+xuL|I;gWU}k!k{j!LQG~el@fshLb*EU=hRCgHSj!O4TSOPL?$IruCQ}3uz5#SEWXOGK-SJ#b65!y3z}V-E(WgSm zcl(LeB|savURhdvH(}4Rm~z;2fFl}ynlkiT3thST;Hc={82N6DED_(2G?lh}nePl; zYh73&OO&}Z+BKn{+j7d6cmn@-(&0wHRzZy=5- zkbaV(Jn0A(75luZphTC09&O!~Rk|YOEX|F(@HglL6^tty!&20W55Qi^a`B~;3oz|a z!h)Ha|2Q=wX&PCuJh2Ij^ZsKMEc_Wp!PGVhj;}=_P+`{Tk7-L zBxoxm$Ak~uevG^@icouTR({Xk4bb)^Ul3b6Lu(C~KswIe6B9xm zERTuKTSup1HA#z~O zM<$|8lQzbe3#{V+W=yXJ8(;FznsJz`LZ)nm5(3G~|5qOZ#_Z?{2bTgW)ieg?8S?!A zJ}GzF(*b)8db=VU(CbJ&a`{}%y#-j1*P*Si#=L}R4M_QhqR+0Gx}DA6F3t2<#9g%< zG~<0W!M*cq;2X0;?CdUZNe$gqE}J<-LUElO`aqhC(KG}q@|?R*IN z=k|+1csa*9K41GxA_)x-uis|g^S&Ruty^7_cKUo6!f9BnArwG-(?J)*dZ@C=TIuy4 z?77NGI1U$Z2faw&(r#m8!{VfaWIf#JhNTi92Pcc*tmuE-jG)6z$vS2W2@)%I6u^63 zr&Drn-a*@Q=*Uwl&%a6`P|uuA+m+w*Lp^hH5<%OslJMFCq5k&8cSYKrVoN(XYAE|U z-EDZ=X+?H=c>uIaSZsX4J!cYs3#1d4YGI;Fg?}*%{zQE=zFt`6?U5Qz{7{HW3Z%;Z0y z`gmQSMJsXdyy<$zog&`t@a8kYrZ*0gDjH)eY%Swb)=1QGFDeT%VCRvIkj$dFnlGhF z3V#$}CjqY;K&%LZqF_hi%^2t}YLR)b30&4T4Z_*{nByXD2w$m%Ex~lh^9O(7XJ0mg zIzlI{yG#m_O*lhv<)j+b5}ZIBkiRoAEMG9r;}>d~Xt!?2q_T;t#n+)R2*n7(yu?`celMty{%K!%jv^zcR2EJEE)UU|cF3_+J<0>EzNYu=EL$|0zeEJS= z`oprIBzX?IFX-0@>W*oSpTN_`Bs#et@XA`)54=3L7{Fo#-LG(B{TCgmMhn$R3wEvQ zXb|*b20PMZ2?c0e8<|E<^Xd~?wZ8O0 zs#IifYB4d9nf!Hp;MQU^H7SpBulw69#lBjlwJB0BLETPPu*Z$Ze}w#Q}b4j-DBS9AztzSuaOkeNu*Vdj2A1 z+!HAhp23IftQD82Vyq8kyB00K&p5|Jj-1O%i8L_!Hg zdMC0&4-g@=010;mec$n&|IT~Pch4DjjGICBeq2vmYp&VnZzfttOO=+2nF<1d(5kB` z=|Ui<=^>C4#IqD&q%`eF6a4R-r<#cm1akg6`FrB+?ei>PkkVKEp)%#q)AW>Q=tttz zgpP-ljeYO>`8s-dLkdf~)xZ#qFBnp?^Re-E^7M7`aEDwvca0N_Q<2B-dw2$UJ2^P| zLW=3SWx(k9<56$B$K*?|`Z~GULBx0I&Ve)M$Y=CC?0o|sd)q-QJdeniQy)Lv$;Za^ zF}TzlQq%k;9t@u)4;wx9c6V}jfHbo#M1e8N-}n1@+t@+2k0P-Dy6nD(o12}xFJz}X z83D#9$d~Cm`MTOcKCTb&KpPmO@12a~qp}uDGnYaV(s}D2&I*q*PUfz7>p7PZv z7INorJ`(u2o-5t?#FQuHyUSGi>9jo zyLx=}4t^TF7-SzC7Z*p~EeNFfg$9+y@e#z6bp7-1BUjG<kdr=wm~6_elP*#xfmR8%B7*(fe9PIda^t9H!d+@2m4 zA0sVtWo1QOyeW3gQU7?s)@b4`x-2g4Ja`6nxd3jctsQ^z*;5J%imho}xKW?{?i4KL z@s95rFY9>}W@E0(@_IsQX=^WI3M%gu<@w8Xj7%T;KZYM-IIt5gWd<%TMf0`$`@zGb zqYNKylYA83ULnuu)uWJ*`Z#v^Pdr(H_XJW<=1ulJ%q1q3DlOJJilmMBD*K*yO#JO% z{2~L1+oSjgm1C6-@eAE)q83q&OIzF9%S-(^kpg5%guHLQp74^iQby{!sIN9WHC3FL zc=1d`3;FKT^zIECDzPxw5(8qd?JHI}=MkHHu-IbE@r{s6qIFW5Z_cf61P%=jissm* zC71pM=p*C5ni{@cWEER)sj3>qmwBEmj znT4g&{nGiUDu+IHHd%j7PEO85u7bhBg@uLUY0-(v$tssoflRp|-2r3kxo4E@9mb=K ztHRs&&z?RBD4#fr9iFIi8Sd}T4wNfRNVp))dLHcYLt`yYj5T<}ewR_xhn{pv2Mfip zNgZBWh4qyc5!B*#@bJWhb1BAGrYdCD-DetX`HhR`2*mKP{pErM7r3ZHoI8T(FaN9g zly|K;RaEOfp%3aFWVK$8YbtgU-3T<-Rv_dChlIS<~iZ&>yP+P$?6 zLS$$aG~qLGbDEfQ6cNE2Z45n|vYA?LW1pW1Fpz03AO#QIjAlLG{v2zduiw4*{PbXA zxhG*h1vT$|Gfi_rv;1W{1`y3#CKI!Rb98pr<)cq(oqY{fTVaQKqshHJm!$ovu~FV8 z4Bl6u!<%c<9@jbVoi<5BM^{u!+#j6T*pNKS-{Te)5&lB$hE}( z`0@H(dir+R(S8}3@4+S`y--Xv6g}PoX4RUgWd6a9j+Z;@)3@P$lCvAPZr`5Y4xaa~ zzY#0`uF3tY+?4OQdW4Sam?Uuez`OisE`=)yL+E}oO$ zU&=8-TvmWvox#2Qt0@fw1yf?9J@2(471k zOG``Z3}_|B3?Au&#FO`k%V~RM7_-h}w$tp>CtvU|UE=1&Xyb|#5*{suH$vKj^wYttz))(}()NK#}`?{Ct@bUx}z zv{FTKWp%Y-xv}P~XW*19mOWk-{LOkAgOM0|{w~G_uj^$9QeF732#(ZenSpWwV6Spi z<5$MYZJ5dmN=voC;)eypH>gpY2;wASxHE|dC=G`o1dQ)FoVeco!uL} zESeC8wdfGN*0d1>ZVH?g^8T@s69d=bSEUb~N zTy9*9zF9EAXI9O}DYemjicXC=<}1@b8(&RobR(#c*n|C11X-+!n<#Unv!Xz@At8-m6{p$I6 zgg2o-ke!va`(Vu9PL|XVgy*t@%BNU`*K)ax0~K&X-HOmiTVN@w869siBRD zvqj)q)u@<=$cMHV28Zds6vUyOdJ;7=nSGlHSJO0|ZEcm%#PxtHKZaj~n6)weIACuw-Jv&1OP8DS+8X73+<%&(1ilmU?qt>@T&bp989X zW~S6u@4;EMm)3_aCFz2e^GXJi}z?f%*CQ#m{1T zi~jZPv@80ChFPrxFk1Us$Nmo)eT%ZqH^`H?EX(=PnuhwPcP*6+%gh%_dZ3)Dz=|6W zH&MXSPSkk7bIZ$Vxi|N*WiEh2nZo98I0XidZSLi#yXzVmrM!6YBER6L=v*IZwT~djf}fwCI&=Cf5e_7b3K;&3T0Zvp+l(~! z#n_F&FF-5bNK$v3t`pDcXQ!dyKe(A&zh0-2I5af$=20)OW(PO~bl^bFe|7B38@Gz4 zjaZM4SE2}c-UKI34 ze~#)ro*)J#g@%#v@V?Yr-uYk61ems{o&oOi3nlzMdE}|HS*h#qKjv4~z?6k#HS* zy(>{tQnDG`c6}%E+Zpjx^$1cl(wJ1IZkouuX-oD=o2YG1-aavmY~QRK9}lVKmVd(1YQn1L%t5; zIr|?u-~Yb&-(L7!Je>H*fy&}6g!jE-_)fce$-f-!xz>0pi_;LPvTkNJHa33WYsW8a zCPe>lI^6$jZuzv`T0a7GhTxoYUQC2*a~A8<%mYq7yeNG`f+ut zR_|aJXA}~0@MYD5I7qAuUB3~G-Ai*C=KymM(1Mji%w*69jqZqirJCeEgSlAS>=>U% zwUypY;rLDt5QmvVESF_V46H2QQ?9o5CJ&Cv6@OKb4hn)UX2U7V65%^Vivr zMMbwcG2a&Pg=J+P57I6JCy|+*U4nxpfT6~9{KH^@w%NLS)V*tM7ze#hqY~3R;=!&9 z1{rHw{v{}CfQf_}qOwYVgZ~agr z+Xi5-{YSg)%+qzo0X4hJOU*BD_&n~!;LO&aqOtxrLLkwy#!KF?kMd|{6SJ(+@k=RLO*3) zeRF#^UVKwSL!$@ZmdtO~J&)XwaG&}ZK}mOuJziTTX11V==93~JEsJ0nIifgSX0)%R z-EaZ0%xmSlBJ}>anUcCX84z7;Z*8T<9yp490{aZ&DAeZGT@KEKm+V1v7r-ePi~dWc z>vi+VX5C@ZnOeg`LuxXU2Ar(t&8nBN*uj)$`xNkr{zL)J0I(AQH(J0 zdKSqto@_B$$-X3OaVBzb1yif^$Y*%lltbvJ%6M>Wq?StW7mG^!!DC%Ckm;IXQsc4qf zXX|IV*yI2Su$u&uQ5%3f-HurZ_yPzX5fNdZIR!#D69EjNlj5|V@{HQ2 zZ^HCuq!n6xkNZRaF`_HjbI-@A-qzQ`ejy#joI|XDxd0|N*}CNgEejtLW#SwN5;p?5 zr{JSl5Pww?zSh>7blMKkaDSb4_w)CE*B90L7BIn5!H^Us#4) zeHuAEJZ(*bxmC+@Ynlf0So7#HTRmyidZg`OzlbfWn|GQVA88Au7nQ}%cTP` z;4M8H^ni>lBS)T9ggqdEOPjSR#?1J_Nx5+CS^;=S^u?o{G=h|P$m98kDK~=_v=^EN zPN{mZDdxPDv`Bu0q}*jU0y3|$^KEyXZx{%E-&YnAJlWETbo9NjkB^D5FSO{oOZ7L! z?L)H>Ut-vXo^$xRQZL17ogbDD{%nIysEI|TRbD*Fak|dW6sY~W`uZ#J?N!dhw=^t- zcLIJkp8(8kx`O~*tznS?d-aM66)*(W{yq8<#vQYJ;1*l!>1(YNU>Ij79ER)FHITBO zTpzLB4WR)cHFYbDcE(W^WM`g~r{>*$evLWyUCZ;$%}v;1rMgugW&=2%smtGQ8U z%3fbxeKU%!GT9df5-a1o^!moU0!z*#AAFCbS+Z5w_VBo2U!7bUtIO%ot$tNN>Ta30 z^X(i^R}y-OO4vX}@@#8Yy1-z3og%wK%+z_(c8YJiVkocr#8y=#Fkze_bnt-|1W9+q z4XjaIPOcd6tix20z)dFVKru0~kLBf$WCPZR0AYN8{k#iS{Vuk(rR6T(hq=$d$l`7J z>QLbZu6erK_07E&99JNII?ms7K`96EECO4s6ddG!z*1PFX*2w ztu-yOpssM|vGY$?_XBAPKoPsJ-m^1#0qH_CG&CJ+{tkQrQmn}WS_Bc1Yr4SWeHg5G zNqvpt@mFA6cMvXu_07GzjATzBj)}#lMSvVy!7dKwH8oiR5d+C5U@DFH=tT#|*F@IM z-N!3#P!%IB4PPi(onouxB2rXoV(7irdE?d!*DSVVky zcjeoxr=zvC^~6rV;nylO6y#$>(uOwYQ9X7B1_mputNMT(gUj7TG0F-OZWFmXJN~qE zbPj7SZnjr*{S99C&RolcouQ`h?y%@_B|9DUrErg(DDAZr#kVbJGPiu${Z-h&%&8*8 zEzZK3enTVqV_8`rYs_`=mpZz-PwYdx-$bu8`wG?3jIm+vC6XPOEy>%x_V$bxTr?`2 z_?E`@?U4=9Pxbr%r{4A!}{2J)NGON%4{A4BQ?K3737W zbC(&VrM@PSBqI?mwqwyfJpB{Iej~qrc_JlVR8)w7{FW*cDycK~fkw%+^gz5x}U5_Q~Q;;@#=bU^`ry#QxM3{Z;w7V-&0nO1es7fO$r;iNNXWSff$t>rU=Oe z5T~Ikj-uFuc{u|=`>&a{JrM@#Q%gf9J1?*85Yf-rnXH9)(nduV_JPX!`g$JCo<1a_ zHaT>XMkPK3Nmr0m^^tftz_dI#&YXPPqt5j~1VY^=HZhciQy}HG4Fm=9(;BB{I_$^l z1ImCSz&}|(?T)$w8!&#&1Jrx86v$0$o*dZodtX?16XWx)7>Ll;a++cq?W!4S(cag_ zcysR{X~MzdXuOoF4=Hj=VAO&jEsw`V5a-{O%x;8q8O)}-oj>G_9cHrm*|A}%9o$$O z+_KlH4|Lo;)uS@yOB7dV3NcSsr|U;Ir+^;L2I7latngXXTAQjJJj}}PWxt-umXe*H zuRwrkvsnE%C z+KIP&?C zL3@1~@C}xOF6=`GOQ%yNw-5sYT?X>9WUmEhR4qUWv;v6M>lU*@_)xK{ky~EO+_K#F z?%$6fYg<&S?aG}dn83*wL!~Ey>mHFTM{2rJLM+ANIkYi~{EY*wth&rBeb?l59>a1H zT#yv^|G~K@f>49cj>%){^nK^icVrnU(s(F<}Qj5@F=v2gJZjAJ(WY&`^MUDoC;T{%n5s z_nT{%sqDJ_6#Fl~I=z+l+ve=$>LDIf>m10$U#Y0ROdT5k1s)(xXqoqyf zi$@SR442Gy!>21&qe>>XMr1kWs>o+5*6$}~h3}kM3u>AS4b7}HFGZxfYPft(cDCp{Ne}m4BJs0d`ll%?iBsoPIKyTQ zj8bFw9H0cjWR)X2vzkI;p}ceioDnpN>mIWu2wqyZb!qltQK4_!svkbfU?Rt;}sO%hEcluvYUO@Wu|GsL6`H zEx#<{JYq@4p_UnUU_XLs*u#z<6D73i^;y2-9e>qZ9z|$;e+m^99{2Y zbGK-+CQ0A6Y9dojz2dYO*D~JDXr-o|vb$aT^eK$L(^B|0EtnB9V| z@ekil^p`8k%2YdscbbRQ)cTpm+fXu5lb`$)-#ggX^nR%&wM3W_c9*3+{ZR`euW;DN zOLOuYKTz7#Z7*PZyqNMQ{d&DMObq$zABJS%M!>d}ytm-`H(~8kdIk#$v>f<2m}PQq zvr%_Hqnm_JBnhW~3mg<@J`rKwry)|$GADa*&l<12mHvIBSWiu$VTB5{mHa|mJ9FeP zaZ1!UH{D7^(uU?-PLbM*F>U0X<5Dg}$G5a`!Fd}wQ^ki8|Lemnnc2h9s?zOjLUmd& z2BEXAq-d^rHvK(7eWLr%qzo(+J5%P;ho27KA7|iu21C<^ez>)pf|q$AMz5qsca<@| zGFI73Kp6R39+t$y92#G|=ryLW4V}%qPhKy6rk%`}EX)#Vddf|BOZ4-}BW^GA+sV_( zcmi2afS7gP6hz|=9KS(Y0AU(`4P3)}tvpR4n3k_f(9&@84_Y>XF~HV>dzu$)|M1^H zTpa(zkI(Ah!RiBV+69Fu?uhNAg!6G4e_kZGgKeDL3^gg_#9mFff8XJ^q`>K8mXT8IzjC}l z$e7A+LjKPkNYwxMoil_O(vfN~E1|gE{T?3Zj{*l0m-?r#PpaJy?nO7@ZVo$-{(Um# z7f5dYmzOg7v_lCxQ5Wym&3@`D{PZL%!w5EiT1k<0Ko%j(sZKRzkpB?c^!at0SVH;n zEbk;3UktXwWwG|7i@!dIKT-}t;t&2Q7&=62FZG||xlzdbH}#*K9`8vP(sJsIyz~c- zA-86p3(zuN$J)-{ z68OHE{m`R*8~8AV^F?;Yd9-25f^Ciz%R*?wZp?zrQ6P??>Q@x*69EDLkxpXSLWGtp zl^rhlp3sngvCMsJb9g`R;Z%GHQyO0;s_u|ulzAV)^3zvntQt2&8biF566Z+&m}g3D zxBFNO(fn)KpV9G$>OKOQb|mzp#Kzk7h9}jeU+v`=Xjy#(g^#S%{(ar2R~KnB*ij05 z6CY4RV1>&d^E)|gK$Cp zwkwrY%aLf4zp0OD4N_d_uk+sO16U4PY_;H<%bz;(zePzL@7&Y%2KTHTM9720t+}He z<*)+;sc0QdG;<4{4R}C0c$2hS#}*8pUqyl+h#!uB1T4dEn{Y#T`nc8sQGRT7sE@py zXhv#RC-$LfmSf_^>qf(B4eROEDzqM&IR23tozq~%xB`^s!2G(6`#KCA3C`oSe3s;l zBl&YD0Su(QP-Ge2hpzY4_L2g$mwT}bY2(z9fB63C^#p#GYX;?ZxBpG6TNpe3%VyPo zEB%&?rymk;yJRy~Ug0`7OSumGmtFqL4R796=@gGsC5ru9 zT+(30ksy&4wmx8@oK|x6Uku*w45p_Luw4A1$MALTv9z3#{)J{2`2P5qCsH5LL5cXm zI>Zs~2hR%2;r$tGJZZ6QF!(U~^`8}9I8aQsG+DY1i}`KBA)jOan-1JYmX?+rv#Gs= z-)+}KiSNT180r|mzSLRNas8OYOFyLCEw;k=>WtsUp}{Jg?YGH*G)w%U(*N#3_5Ywd zq!j;<4Dz2Lh5kqHtvBR1!sZy9B6^GUd{JFp-H)~oA+S%p&p{CxWRO6TwG*>poCV?~ zP^IeHpYqix`zst_wY|NaYzIo@78Vu@n2jz23yVxY4kR{n$vD*nRD?mf+opDKd1!sQ zzK^iM1~S2{Qm@M`og01Yrzfi2%zBByTNkw97`I%k4UYZXw>K3W9BhAROvpG0RUl_Y z2!RdW^D?{YY1{qS?N3!z!|wgU5fwzkc^U181)+Vhh4U=9jAZPTb5zt0C{@cfV>nq;TEe9iEt5<#+jK4DAbB65&h1;>7)OfCT92>Cp?ll6ns55H1i7 zjm6#j~BdtiUay>yujJYRxjUiTrpZ5JSJt%LEdLYFu zf~S*uCANOo;caT&J4S>wQ<^v~mw~*o()DWq^77S!=HI4eN95fsDg{ntcNK;adX>Uu+` zCMMpMYY8#FnOrk8Gn@R{UQ}G1fgG@rS(|Azvn&hvMjcuBKrtHtb6OfY5|LV=0NCIy zSp#nM&b|_>0tyy45NN@&(R93VUS8gyS)jQPx6CdR!!F3;B)jF7<1-(B@Ua3L%tv3( z8{Q!-ekqeBqUAk^>TfhpfHH&$58NjQlu#$vxNY*E0#wjE^Q~cW9o<*PVHL#Qxa!kl zuwd(q(QmV#FGfGldpr*CSD?)3Ddj4FU0MQopSNgSUodM<)5QiE#np)_4S@Y%k8hWQ zcjs>5EkO8~7dP+Il$5K+^#O#l8nQRudOb|LjlIH<4?-p#OUqI)3Wzbktt_#Aiv?PE z;v8mOrLJ&mSFGvhasmnzNkM(}duT(*?z$J^%i=#=k%bzFW+706PW3Cz&*!$O2Z@Qo z6a{#nKT{m5^oLKMZlNkbEm=dxj6rG7_!kO4mw2E~cKcMnVq4U_vR z{p3L1JTVs#xAMb7hcn-{yks(E!VkX^z5;w=kx`ih*4)l6Z~kxYzs~Yrj0Te1V_r~P z%!k8(6?B0dEDs4V$mXUuN(SizQX@gQ08dYya$~+lWyW4Q@It_-_S2xi2CD2#v0p$A zLX|z}yLmxTk&EtP>Xr|B1Jhoab?`t#LtIKKbvOKAf8Q6yUt=8pxiDt2Cb~B|v0Ejl zJZ^F=>oZETZp#Pr^QZNQPf_da=Zwnsr2Wj)rIQy$3!0h~uzprRum+dKB9;pQVsU<7 zFiq3`G#${B?zQvupy)FfHtjHU4wHK7)G3onA^^MPp4xPYmQRl1(Md#lQSMw9@s( z_>j^!A_%lc{>xGDX0S^;!sGRJpw#GHKRr0p-qh4Iqk92t<7KMIuc_OZDZ=l)pySp&0#se09`r ztd~egli3CKO8NQ)Q1LKcxy~@w#(y!|w(+mbr3^lB4gUzZjcpG-U_eCMdeO8|4j=kEVw5W8y zTGnlO+`2X+#s|Y0FZYCmKKp&X?tXMyf`a?q6$^~Ht{$w?FE6$G>pkTASfJ%ZC1zBd zn~iiwRCuWb8%wND7gUHh4YE819LI#{OzJexCm^EtM1LV)F73KG4f@0mmY3A7O(@10czRTo-JF_>|OfCsn=_# zlLhz3GT{}O@ci3&+Xf%2prD`;>YptwE$S8xvaE5iQh62mUh!LUuO1Ox@)`jV#Ia-0!dAkX&D1>QM+O}9R4g^$ z`?&|Q*&0_F37w0t{mihi0fd@?ySWW#Tr!PnV7~V9~gYIIX5uveETIHufdKpDEbUB%Z&fOu^w8OfjObEeC%g+HPC6B^MFJ6B9#0wbddEp{LjZ0)*tdQ3d*jw6V zc#xah+SitT;KHe_gszmw-aO*wBudIN(rkv9-?1z+YO(hGR_|XJ8)n07Ci|q^xYvs{ zx3aLSaM9Gpbh`5}96(A@Fb8C+W)hLVy<50fcAVK?MP3cjpSGXQcs|Of_lZcBqnOOB zv_oBQ01!W5i;_jOx7fapeW|Vn;1J^`e81z6_nO;K6sU7_n78j84nFklu{XB@9w!RY zHW*#{*G)2;UBCcLd@5%Q3mGxYya(K5@Tef#2}c^focIZ*)85m>x+S%Lb z9$KK=2OVm|8!0R*IjxG$l-ooR(quDxy`YkKX~_pRi1fn2(D6czWyEq~g+JxD+Q+_+ z*>F<>z$^6<0JZa^b*coJk57UpLRJX;#Na`#T@H*~RxqZe*F)OA7oh5pZexIYc4DlO z0OaPip6)8)w4&*?tc#rhtOyvqrx048yFhKRAHr|fq`ka&reN?Uuy4{Sb0Iwo8-ez= z&04L+{ouniE=mrzo0F}DKB{qjdw5rq8uMa6bC{>@7>EY(Jb_(Z&FB}%{*#UPdWQ)E z>HYpbmIC=Zg8q5Z7S{N4_rSr|oa4_Br22m?L-ik}v;O~!A^&rEzu$!7{ftDaMBclm zJ^&yg!vK@CzP^4kg$lAM3gTx+SJ&>k(BGh`Hfez#LQ!6xGJt+Cp(ZCMsdbpi>Eu>$ zUlsI-1e*sH91y78z7q}kd8qfR`ERZg)2auckR-|hAW@D7J8LqYKc9l~?VH_j7{`m4 zDq(=xncF>}_CH)-cXvZKWxoFl0+GVyS}B5(wQ_81tZAKZAu}`c=1lxFwm)Wj{|YG2 z@z&o1^?XM#rxhH|NL5ueI|h_TpT>0OKTQAPyR6G5V4{EJLKQ9?_5gzL0bi34**S^Jv=0j04BNn zt~;TZ^mGZ>A3(@1bAi~*JwbX9&H?v0*$x!?0j5+K`U4n5-|b}7XgHm9SbH(Wb$BX_n^uPqoQu3=nIfY;OjXoj&(-uSPppgzxfzQ}|nmkT~#%)l#zTbWBVNFY#!>>U%)t zZ_c}xFLp|H{cEc$mz5d-Ie`Llk0M6(V|Mo4*4EYu0E((zPvBJ5H!->C#MdE2#^vnM zgd-Gf(gy}~Q8MEv$xT@dpFp%hMxCTmgMTml{H&;eI>OfP<-5a^+@z#sW-3 zFhH180ep*JK!6Jfdv>RM;<=V{;uQwSQOfQTCSFnEND)dpge}I3-2q!k-M>6o(BtwR ztaPry{@s#&O8<0A9KZoB1Lkpdb;-=dft0k`zo;U)<)Sqr z;r!W*d?po2f{j~=T+2UOB5v{XR~_=i6)K25AJ!h z7Oc;V4R%gl^>f@89|wX#4(xVLKtv09>+Y?h5mo?ZD#-z&G~3(&00gZ1@+CEF0z{kh zfW<7X!EWA)CAv+0?RUL{LnF{426@5}Es@_D8-xv3z9^Gv3Ch!;pY3hA8(5k2Qcg?n z%T@rd2B1HYQ}?@RK+3h3a(PszaPTfOES-0<#-pa#qxgm1z3b+Qct@p_PcLfl#NcrEC2mN z?@|@y^S|=7$C+bDulAoLIb`xrA@2X<2UP6FFOSnd)raK%DJ(_AU7t)xv3Gu%cdowP zC4np|Xrcri3f{?rtmhq8`xfyJziLUb_SPXbx;)n=g{KA5 zx`~%TtCd7IXF|vG0}z}if?OWxshpUY=w8!}pjLT$oj&H_R|M!C1PHZ{1qG_|^77tN ztN_Jf?+HL`w=PquCjtl|@Zq@BvvoQy%8`?yk~%tOW<{U@4CKe~#^8=i$-iHI@0O!= zOUGqTnM`MQcSF#m1YGpvz9wwlrRC-2e&B0zsRNIH3O(t8;CJGyzj`qmK)gVNr}Y&v zT_1pLes*dBGhAe(k+{FV&!r9|K9LLHOF#=J2$<6krmI|1a?3TJD_ws~!8ULv;x6dR z0wFLsx413yyU0XwhL#V+(@Ke79Q&{PjPut_T~`OnR4gU3^|9!s$DaV6g})`LP~;?y zN^M?cnS-_Uoy0F71qxCwj)cv5likO*62+iR&9v*dlGt1;QvaG#n>#5n7i5imOaSU= zURvGWC;~uU9tKZ6bEQ2h6cXV8D4-je`~{CdNP|_Ujf3$32)E26|92fDBUK7ulR@Lv z$19<*$mpSwkq3#=q;Ix054n@{kzthfB)_&YLL!N z^gZ13@-YFHosiN08n?32l^R|SKuOrAamcN=AhHE<|KLS^&@ciTKSUkUJ9e01-UUrr zz${I+i&cYc-SKSRGhXq9MFPElGeIpiLh6A-yO1#mI!E3=yTQ!-3c=!_gar@}gCptfx{|1RJU;ub8 zi#UY8Mpj%{6{@=m0>a`-RZV}_(>5yS)J=9BY?ZfmcW;A^M|(dh&!2Z@+B>W0>T$>0 z30dqq4h`-x{4O(Rz+VL$0<{l5I#d5$`pABAd*J- z=jh-M>+T$%`*|q5=tG#lK1TJM10ZUDDuj^y<`G8f)bRU9+IA!JJ~-^q4QfPaoW}7g z?u7q=SU{@()cXE!AM^`yz&?mp-x z7%Wb1^_F8D-7h#02S``;sSxu-au-VOPNXp1x_l|daixi^LUr3Rh$5J>L(+uzTugMK)DknaO%aju)J=QRf2R9u0nm;&rF5wx%X`iv&;9sU4G9@SpFRH>a`5iHAq~)a=2HJIvy~TtBoa^$psze>mjsf6Jx8*jgIUV6 zc{3ECNr7=7eEnTDOUym)-HwKZ<*)OEWmZ>91j%I;+j$18dPRLQN3?dJnCT z2XKKZge4zkPH zI=ncqp96@9LKx1}nJAJQZj@WTE0(6&we0&~;5jR&&AWBmnWlh0X2SQMhI z3I?Tf+PfG4<&3Lc$$sg_ni?aZ85e?qE-|gNe>igxhTUT#&ZS%Z2sy>M-+mtst1ksu zz#;gdCb`uQAOXwjCRyu1bI5j*NBA`do$G$}s71>Ub95Hc@m`=i;kfglyxgk2)vIKG z^Q1h!q;mWMnK@$Ze71CL@^Z_+tklH8h2fGFw_t8o%d&3C7|@*%jBjD#Yxf6y_8Uy% z*=-15h!t}134>XHg?AiIVOSbB)=k{XS&!ca-=0kp;FoCtxL()~uuw$v6^JF@+$5i9 z2jBu}bdu}529#q|aoQtUdEhJ4Wy~5+%FwO^u~A)dr_nuX-sb^Su%fZ1uw89hVOzd$ zn>{b!TDkq8ZPVy-yW~ng8PqT+3hfHSt-Ip}!N1IAc)*IL!yiTy(n_IqR-jeFt~ALs ze+x7J2{WFHs2N`=*`ex?C$OBDgxz6+YhAr%GmFQ_|^-hl5@j2ZU z#gg#s$6Ulj`Dyjp*Dp?~zqFn2rKG%Pw~%BYb}l36eV{W1xASLi3TpYhy0q`Hx;gqj z%eiS?<2#r+slvtZ)MCF8(*tF*5c}Q?pTnb;7Ir6>we4!FkqMWQ5^)*^dipv4VdpD( zy6V_HUiz3OHmYVPn;t(4bYDoLr8VV)D$}=MsHfqa%a>%79V-V13Rg6I%Y1ZrXEuc) zTIru}EZ^>x8-EX!OZM8lU4|c1)#2Q45KDi!br5DeG8fVv^TSare`2Q0ojyjnySKLs z5g#94CF5`_1(lsi@pN~r*7ZZqgP|H%iI^wlfdXts4qnUg32@Mt9ZEo1B_COaZYUEh ziiQW8^gzz=2wo{HxZZ{>EXevs?%5}nybvVG6SoF0=monFN=kl#M(f8;PU@sa z1R@@T!4%3|Q6Q{doAEnp+?%oy-9z#${F;cZxwlvrPg*#&w{)M*dZvz!$123wg_p7% zv1!w=2t7Qn)wCl-{*r#lBUq%$NJ)L{|3HtRh{Q=1Cs%5YgOR_=NSlax55@f-rzUpM z%k_J6s(b_@U7Wk43+2lfANJUvO6;2X=Dx%o&C$(7dqABn-4BeQJC+%tYmZCx?uPnr zRz+hDo6+Rq&IjR))@HGI7bGpU@jpwPV+JLw+b zP*_OQulxL~@d{f{M?N0SRYp~`s`8svo)5>pmHd^a7)A${`nljf_t6FFvgtq#jX@X5 znQz*09!+WUQHu4?6bTUlC#6baoX6`VXA=F~-pP>4J!q@E? z|CBoK9}p1M>LQWuX<-!dpa^LdDv;lOvN=$0gxT?vfBl+z(h}EMm-n@$F}1bnqusN= zwk9r(IJ(qK8k?CVK{?pioM_R`RaB^oFAbmFSVqgN=xFc_+XrF%9+Hxh!pyNhmVJ9~ z9D3KnW<8~bU#3V^S6Ank7A@wPmRwIz%P7>#8C-sk#<}=~$g#Wl_4v zxxla}l7qOUn$FWJ zp3HhhlA=TWFAw6jB5Ov?suE*I-#TdK851j${nB_VM`~*g-APy zuT2~0u;#$oDgWN{O9in>Fsm86{6 z4#Cr&5q4_Z?SDl=51E<{JUo8-#P_`4p4`+^J#n}-Y-K|@g;-2i5FS38S{erhTrZcY zWIuCi)=$}^xBF&_wOVjR>CG~Y^UUeD_s6zU07IvxF>xiSqtA;pr$;%5iL2_T z=IC_qyT_S3RhcgN*LT=gPAK$vpJP@&rHPK_$-ndR3xO>nygd#r#-(Wgt|#tVWkZh~ zKHc3fFz_r8pEat;lPlXYGMT-3am8PUE>J51Zu`}=+o)GgZAT=tcH2Tp_(V`yk!;_7QZwpXu=D62&^<8{PaR-Qfd{p@Zqw05ng*sl(N6bO-Sj z)ERgg?H>P>KUX+;y}Jl;=n)E-<;$-jm5(79ey&AyArTqAI~RU;gCdTsQ$q`I--vF9 z!#szNX8!u?vexTy%B|TIj=i;)r^MkUf{lEwpGW$(_8A-5k~&udwKnW-5jLV zt+Bn%jdZnM#3lSl*d7)tmB`81y?n`e9I=lYjEnr}XFgXlK7Ng4h*v0fr(Dy{wJ6C6 z_qZY4YADOm_LAp9!DzTyvUA{*U}Ste`b|!beg@TDrJ4t|=E(j1x=@Q6Y#nb3>e*zx z3Mb$YLX9Ke89#bo8MZZppCyL3KijkSRhlvwj;L7`BaxV1GmTM;JkAorRW(-LlsZi!*l)~8sn{&UwhC%YZ`buN2h z{p(HJW3hE(6BCJOI}xUm$2Y&}q}g3#etDe+Rq+}%KexLg!wTNR!oreuc=r0Y3y93j z%nFr$TIO?z`vI1#dfBV;aC> z5!l^>ieiI*)JZEVpLS}obwD61v_2uGCnqB?Ql6}o)9#~sWyCl(L|sK?B__JhQS4hw z%d;t@7i-C&QlSsTys!)4)Dpj)cY=b;Mmibr_Gl$>i> zP!iz>5$u-qy?^}iN$^7@t)RVK=uyDoB9v4hSDTfmcUSC=;t_(>IylCl9nyFIN9g`l zva_RgMQ71ndy}j)$=^-~x(&k7HpkvKMUv}36DL;mNbhU0UTIjGjJL$M94;Q1zkK%3 z?4mf{44z*n{LLce0o9cnBs)|U#Y0=~T94|PIm|MT_)c`=xrh5@1V*WH ztPWMQC?Q&d9@EgWZcKcb%g2Z5FU{HuvPah56O}Ej?*Bi{y>(F4(f2Nlg+T~{poAzW zAdPe?Qi?Q4hje$>K}A|nq`Rb~yE#fqi*z1o;Rr}K+;#B#yYIb!yfb(1%x~WJ4CAPr z`h51@Yd`CGp0#$yf)C%!)hjxzZws$HNb58fejrO5&MPduGszv_-DpQ)b@0}dDMzmS zrMYO0JUvXpSG*J*t@Q_GkCyeF5f~hhJo80Psc9hvCvE*UHwALg+{{iULlNe(66;<1 z8Iy76&yFy$?nO$qZ)Jzrvs*PM9Hes30K}kZyPCjo{`dUL+`*6C#tQi=3OUNJ#<{-? ze%aYV{ZYFTO_+PQ;)+;X2N^giNj)8~ghMuT=T3tE(*VB^2n1 z1?|B9Gnmx8_UF%c1CbCKTa8|#K(SYC(WAz86m1+D*j0S`tz8^W$^rb#_d5o#kp^vr z1$p`TX6fp$`~4cocDuV}J}W*1_zWFBwBMHt}W}G+V63h*&ePBiGm6;d`wp<8=Ikcn})#M234vP@^T;QP?ID#>@^S6 zAbk<{T7#T$aY8GPFuQ+v zq0oC57`y~VYxvXi8uOlz87cZso%1a7%2NIQ_|$aa9KrhTW7lMp)v9Ho(^;3f{$+Yv zE6jjr-4n{u^ZI>)t$T=^Vm;;VzmUMaB?r)YA^-4iH)(x3cbcEUjix={wUcr3lIbyl zqev6}MhmIxy^NPelisXJh?!jsQ2sGg7vuHIrL2|rmsJAx{3Zrjdj33tJ~%Bdr`@&O zO%OFd(XgfwSbX%{7!^I5_CSzgeN6DCL)ahDBKAtj?dRTI(Oi+{*pz!`GGrHNnhX@Agakj&A`q-U3fbEonxk*wa_=^*q72pOl&b2Eok9j=Ljmo9dovelR zxZ=ChJjlmUc*5-6Pgk<#$$i!UfbwloRqzdL41X zbo#JVXGxXYWH8vb*Zo>=-PRWqy`N_@t5=BI#|BVDqPwtna#`nt8mXx(^Ktg_(ym3`5G^@8Zpcb~ z;HMvqD#*(-6`l3Twz0w5lE}Zipp)CIbov}GLL(o$&F;MFJgL&%^fS!=VP;v55Canv$<-HDTEl3kQD?&K7m13$qVc~TN{~EO7@iAo z|08XII9c%F3Zvadedecfl&&uD$Z@(_HJ3wxNWX?@`e>GZE(vj9cC@UDyq4&kBI`kL zBq5q`xme{Jr;TD2lYVj7rmM>;k1oYwj|;XnOT+L1smrooG!|Uft7;iMT*D3eo5q= z2S4g)A@`uUXcK__9Z2DA3_UTdfc>T8yZUx*9u2={w0BXt%s=RM9w1Irs}C=bMkf%5 zCPOlSmE^Yc@^*tdi}^mJL1vVA<~rF(9xs>$0PT1nO>gl>+FdwZ(>*0bcpha&`O7_C zKO8HgMB20a?|MVNvNu=iULPc|BJOCNlgTOpH`q z(CDSVLay9%fkb>5_%(|gE$-)yU6;`mEotw}Y4qc;_Zl1Dn%w^i$Yim-4rOAuCu2lV z_=b2l8V3g_iLPB_^BWzZoMms*pFeqYgVavDyO$_)>i@xN|({TpU5zso@N z$qWbkr6=>d*kQo&l$UeC&KCQ@oZMLOj)#QzmV5p8kY%Vb`%(Giibz{eR~IfmK7Lv6 z&hD21*gzlVr; zP9WqTBXqf)eHI+#M6Emn{hvT**8YX9_+Z+Cf`T+<2Dcd#XVZ&#>#Wh8&uGI-6lf5S zyWhUa1PCl?7~mR*#unp}@qfmjxWn{m)Rc4XX&iOofNLxbM}b!LTle|`uC1=}dl2dC zl37TC-=H4{$kK64ruTg(y3Br!Hc__8jzX*6{iVf^wY4=l&$rA&i)^!5H#T<%t(vt? zvYo2>Ouuib$f;e+r2J%;P6Dj*-pNnx2X9k194`ks}H;NKv- zvOE)_u*Xd7CIGVTCm|z~73I6s)YR?*&!Ke`yK>?1Jo%00@HN;*QD#_(LV_(Cl3^kw z=*Jq8O)&9EDsEfzCt?zu_f%MNS+5V?4M307a#Rp1c{^~iwG~?``P!#Ny&{{JjDbVdpdKK^0|X^?hl?uwAQQL zSB!{s_3?RVx&?zeH1l9aC@0CEQo#4=IoRTp40=6Z1Xzs&2p$@mU?X+l?9|M603#MK z1!KEuv$h@{nv9*&v>Y$hbs{`u;laXj9(HKwYjv}fYhR%uuQ*ng626Z6(u3X|ee!aH zbG+K}3b?o3{(ieWAAc9q*bi67Yy0I&ZAz#whBw;le|)TDHP8e@60n%;ee!e)d%ZL3 zD0yu1)O&4aYWH}(dhJ7_x~}_es?*uaz1z%qVrLJR^cQPtDN29TFe5@uohHynxvp~M z?C;dnHA2M(Zvy^3^bOk16aIU&w1!^#&ohETC~^M1kr*+#0Lg!zOV91hMDXvq3YP!% z*3@YuBgIet^W@_Hwl|)1u!qNJ*uU$63nG&I|LnW`w_W7_{>Cy9o%0_7)}FqN=ro$M z=R>VQ`a_psU;U>R2`wSnW%a#BExB!Vjd^DrkZi||OOE^v>&mnDPA+8#FccRSmB}&2 zcc-Z_NsJY0(CW>PSaJ)^o30v++2b;h78e?qE*)0iM#%G>{~JPwMI0>7%q)UT_R~!W z#EkZ;#2>Y)7niu+&2|_*0`h4?mo{7k$bxc>ZA;DEK{m3G^W+gxM(wuT+}uB`E4|2H z0aLqs>{UAY4qdacHaPgQssMcz%22Sdijc^){RumYl~RaNeWv%DR5SX`fRh+7=VHds zQN9Lyokl}fS66~X)>rk&P9x^RBS^F&q#jsWT7GvNFfR|Bzw+dT2NJcLe_f%oSTP6d zHQjri!mMM}S}yJd)C(0=HtOVxLnNbhMyA8pG`(bAA|6&zb#)GxBdccZqy%mF)yYiAeF47lOeu6KSXwM>bI#LO z@HE}R#V%sP@%i?3b06Z}&S=@Z>-O?XU{Uf*&++D?e4pygtexHM07@K3@C=-T8%lVt zT1yr`QCCN2hjXi`tGnCGo0W;_YY9_tKN{{I0=Z^(k?zLT{OQppM_?pWR8-i&m5|KJ z%xs2S+jdve(ShFP3&xDse%GDsIraoulr2jMMmD_yCHHc2n}$P zWf6J1A&{v&S z&d$z)`~BwSf_mBe)MURWtyLG&O$}w2j{rP9gZ98p>e{+@&H1>`#4wb^0Ss1VdB6&g z#7v!^mI&7Wq6uOvD6Zqci<;H(`0n%4R^BJ3_3Fhr@1Gffb+SvDxAPRtG=KCQnCd%^TI5YjI z9-W$M-Px%)5-{bhLD!TJj+>VkRa7jHC&kPba=&gSG7BHYf&o(yEB$M`Mm`neD~%;gR(-8SW|z_^S_TLn_eZ4bx&b2-0+q`mM@NmNgA#& zz3*9Prz1a5hcrzjG-?AqSf!#S&~AUS&j(d}NU^`Tb?G{EaQ~%wKl7oa6LA+b1E$0QHEYPM z&+c=OQfOOS+Z)umuhY}1Sr;zw0wFlvj>-A2kZ@QRpwob?nm1j@sh)awyBC2hJZ^yh z7*}SvSvGD3Kl!4J9SvuTw`ZoIGZagkqA$DVd&|XRlBdMYjqeA|xg4LJjE#{kZ@d3; z$xyudb!p%Y$kJbJNk~Z8ZsGp00H0L8s7T#`gHY2~`yh=v zS4a+6(y&f>={J90$U)?-98bLE_j`iCiO!r)h2bW|M-)Gg3?B;%i@u3To01N6gDhds zccwVE-eKqLyc6ZraPBLZ*gm17*`!Qmp0Zg z^c3n~sIuq5ANtL`{-v#09V9(jd9@aPdLO-`?#$J4HJ&H*#Mf-Kp*FZ_bIZ-eg%qZm z+*Avi(}#pvOGifniMpPcE)0e^^>+lklw+(Cw;-gu4rQ^C+9+pT5>v<>^z5hpX{wl9 zheJJOZg8X$Wssrx23=#Hh|2}!usjoq5ZbW$p`?OtO@9_WVs*@C--WR zhqWAq*L0akVEz|ZR?(gR}P%+Kw<{IGU;6G>%HJZ&WJ^D!@E4uJ=3hw{{=An_$R{&I zEF&u1wbY+%0q`|lVR{6>ZeOeMH|dONQ8c!jT#?3ZU>gLsus0%%cRofoE39`>2#5WA zR-$pYu~LC{$`B^NJJ*Ilx4!RQF_cgQ)l^#OT$|ql9U%P|vNUA%sm%RFN=G9O^Hg%7 zUZC!_S*M*js`PTrd{EIZTJy>CG;{VE8g8u=s|`B9$dC(O%VsgnpFj`m7i z%bm2gC@jQrKfg*B-fjwaVkX2~Z8^bKDMRsFPY=F|sw&;;3r@lA;pZ$&Os+a|^kilT z(dHJS9oQ#9SuKzA%=O{l5)Nj(O8A7~AI}&J`!ySLb<= z3|%E^gZM@w*JkJGKM{}F$>XiYQ*k6@l|m8oml9;d!6dKI)~DV98+(dkj_VMUJn7?! zsi~;KP2z!^OEdYn5NG}LqSAkxf@M9AsFjtHTAJ$)hzJm%09msnJtT={ij*3Qe>$@o zkAW_xpZ)=Ffg6q|&FD4raxxw0o_}ekHTPrHQ~2?^)4Rpg{-s~g#&qmA zcFkrH#o229em(1H9iAt2|8GW}tf2G(&^zCs_#%7h*8;I`sVp+3v&H^CCa_UIPPn$t zy%`LLHAFcxT+tJqTk84tpI;GWJ^i0J8KdOKxLn=dRml7QAn8i9?cf{zO4J(hrbv0LI`E90L zMhR0k!)3GjR-DfzsB|gjybB4z1MpYfZOfZ*EA)zi#=lJd5QzVPn?w2BR&n4LC`ZDs z4!dCybRbCTt6`2YtJlm>e3(~Qn4HsNZDV8M9o=b!i+!PYaWMk`#H6)Hr~`Gl)p*Gr zKnDY8Cnjd*;;A3ZAR(;A9KO+fE=W-I9i4|NXO8dIH!`{uDK+1?^TH(y)~B!UC4j1( zp&gVi*CTot=h;t<^os)kvOSlByJ8UfGE^2BHzyPj!aA>>=E-yjeLRc(`R}StBC1ED1rQLPNt240gX!BC8ukz$NIBF z<>hB1q%!8hMcB>7zQf)iRJX8W+z`92I!lwipR;h;c1&Q*x>9HwZq1gvP_HSDf-@%d z?Ym{HW;~{tL%gvs2w~-Qe_iMeZ;@`Lb&u^@xO%vY)gjdYJ~sF3))24zONiI=hS4Qc zkh;T-jKxPL{flSzaZ`1kYI>FOod~A%e!EFJI3i*fYRm0Ww#$E>X%cz?le#6%)L-^3r3H3 zbOcSb7D`Jm^Yz+M0J2!A`J$uLRd)kPD%Y1)kBD2s^?3VG;wt zUS5>22?b}xW)@jwXqKQ!@ZHMoF4dt}{kl|#xsGq6%OaYLX`qS_DYH)6Kw{|+;oU@N>RcgBwocO%4M1YWS>W#&Z#xth&u!G_ zC;rf0@+H;bbpzjttd8sSrIk&SWUn3g*Bw5$nLxTZ6FI^4cZ+Lqz{JKJ<^k@}fd-=F z!~KI{Bw}N4_Jc(-#_LSiD}0!@wwrvil_jJXk5m;}ZziI{{L9PRCUbYajp{Mx1$P*` zsq>)fQVhY`ctxu7b6N1#KA~Rxbj}jtcmPtILVOSN5;;s?=~(0S`aR9hKwYw~b#3iM z#_MVfZpH4Ktj@yM{V`*_;7=B%E|=swbCr2T#4X+L6u!#go$JPA0~;H;Jo=|^<37;Q zowNlX?3V4nYHjcGD3-Yu=FCM=S~tKe(JqJF^ienQ*-3AGKyS$iOHP-_uV z5f;?2A{{=FEkL=^YR=+}2U1X_a~Uo>VzH2ZI&PkSW&fwNhg!WL-_^nk2&eVB-aS`@s9aPj!7Ke229U$C_Tn8FP#hoIAA5^bt4jbm?&ZQudlNM zP@Y3Aa%Fw_=aQ;_TdsjufIeWE`)SENT~jcGQ&myn2N@si29ErAZFb-i1icC}OyFd~Ca z6A;Dv`ofNMx-E(mzY93&&TJY!T8b|KNZoRicSRhM)}-Ex4pkbk5qV1K(i4}}X+ZKD z5jo3SvO7XCG-=BDi#L=6uyov7LmJ!c?T8Nw(&5)JpJez*gLQvl!T1;ZjaJ+?CRQ#P z>c`?*#~b~5oq(u>_ivanMt2rjX^sy`TgZ<gOwd@M0! zWxONumkWw^Su$cXt9^}U<}_W)2AoN}p-@BW^W*sZ$zrY<8o4aE`bJD+aK*prUQ~4S zIWc5~82bwSC3gK5%lL_(IdXjeBBoBFVG!8mCI<9|fE|G$Pnu2==}I-r#0aY( zkr~o;xC-tx_cC>w?G5gycqSOedD?0ZS30y+SOFN72-uea96W|XZ0l0C;yzh5;HB_$ z?y4#XcCTN(&EN{&K-fvFG&w#TbzI|RW>rWkK=g>89vv7C|-hl!2_(>MA_S)rp*&Y-9 z@xr$Km_^ZH0el|;BwCGZ-63F*q z2HQxHt|_1MAys-n+;vhJtt;XuU$!}V7&$!Zr?e}VJ-Fk2jnv0H`%=jBfJJmu5~jc} zuC5LQuZ54#1t11jV&Z7ErUiTJzb=K-^u>PXC-`HXcVY46lnJ0T2v>6<4Myro3NIB3 zqtkq7P4PXIqn%i|#jA%2dvck28L!88XVP7tojAQ?@=lJPh-&1abtTE2NNXyG_&b@qUk1!lNv#K8D3(y!SiWThzgdAVjbTGo` zk}JAF9WnEKKwTnDntCU7>epqwHF?t6HEkJWSSlC~=`Aa3WuEfOd5@RKPY$J7IX}Ee+`Tybh-MPieC6TDw{Q1 zeMN>p_6sHVOy%-KEhO0)Ia(}oPN|Bl@`yyy;Naj585|Kg(q^_Nr4x`qa}N&;0DXRl zOMaZHBb|mHPXtj?XrAf;E;86Z`T2e}tm^*d7S4U!`Hq`%v82J`BNam1O6AVA%;+H3 zwarLIRq(#ae0IYS?%l2QL6yba0F?og`)K&vnx7(na1B zI;4iJLrGI;LXJA@Yfn$8<&&VjZNTJ8pUfH)9UFiLc$T54lz1J!B1snD6jkiSmzUE9 z9ERSw4oi<$lv@~M=mK2EHM2l;DVb~p8w?*z!$o7=gr-4vrF<39!Xkw2fgAQQh2g3u!w{rIA4 z$4u~WS*>%IE99&iz~XU`@@a&Uy(D+`rAA2H=5}V+d2Ov{0A)nEEdTbUzvlavuCTE~ z7AVO_p(5L~Qo>&tB7^cuXY`4=s9^p=zoc@<_ieLkYaBg`oA&t;iaDPt+m>^Co7uCc z==WP_=o@C7lz?F8<{aFL!{GzE6!Z+!@t8v4n@+mTk0Yhrbf}yNe=e2PJp@af{k0$R;wc9~~XNTDP06%rMq4%QWOMWRaIlKP=VfDxINN z5=QD+I7=sm$yLN8r6Aoe9ZiVw2PhaTEfE}!`nUn=_VC?om0YE0BY9!Jvyt9`k$x_O z0{^MHwZhs;X1y+(IG^{yacf;>knC&v;crbAic0asfVH6V_{BwUc z;7pL@=h1&hB5*U{cL|*CAwv=JV$p}@Op~PN-gNTsuN!?G@S8fI^8LD}Bf9ASQ8s6l z|4Z=v|DT-sf6v(bPh#o6QGl%q26HhWyszGgvX=q7<|s38CMYxb>KET)#K(w6a({9) z^3P*^8DuCKwal|+{q((3Hj7B$JrED})f6=$-@|!(HZ*_jbRTZgE+-s-cOp@94{Bw1 zitVO)H0W5MVnmc7vZlyAD=DjI_7+AEN!wek{d48VK9~nUZ^V+dDSMG|1JuQjkh^d< zP21}8QolFjI@4@ccA>sjMQv**Tq>iep#j0-B$4kkYDofoHG~cm{OGhCm0VkGo}KFZ zLBY6Zq+n(fA&#Rp{`Kp6>O)47KF=J0`-X&GxVym@4p4SwIWsPhPY3u`<^T%@g3_r< z^2xkC9}^Q(ic0P|UdofnwOy~un*&xrfWZC?2i-Pj{ZMEmDH&ygNCZVGAcA-95q{M!F4`J%V*^HY) z^w+h9FJWQ0X3a3fx1%X#mS~`@FI18mWepLPG7WBNMEM#%3jFr!ZokzK2hx*t{~Xq~ zJ0YRUs?Q;$khq)bU)`6{9q$)B#Qy4A_ zxcTn}q7gnLv`iDq3=cls`(=#C-PRSVkY08ME@LRS$n#}Zbbu8^IcUII#!u;-bfaVb zk$Zg-9fDdL(I$l97!&a%nd)Rrj%U%8yB%+QYc z_&$iu6gw~`fYkTvXL*wZF{MIUS`p)*9|}Rtw%sOz z#A}eP+Mh1(W&#PPQ%F~Nb3ESdAz6BwCs~N!Q306ea#(>zhH_91np)uXWzQ3uKv)*% zz9oLtzf_jMlia&l&MU1!(|kYkG(aNn_g6x_pd$i1?39%?AdMTQAva{cj;Ztz6f@AY z1mzCI`ZE5EC{?I}=;#Nk%1KbnOL15e_V=-}ESFK%ilAtIUssA~%+0@+qqvjf~ zXj25=)zjUAUs$*m1kodbylH_D$lf8n7J8UJXr6@q<{^MmxvtH9K^VS@ZrI_DPT_v` znSNfOOO%BVclB#6EG+CiWd(tU;xZgfvSGuu0vm3UpaX?u=P=}ZD_8TYSHPuqq-nKx zseN&?#LhA^wa?Ubqm?xTY7mjmD{*w59IS(_C8kAzY|zNjCh4lNk1!BagGCmcWJ!YX zMT(dhi<+9{>UE+i_0!(uM9l*xGQ@0)`AX8CM?dgQAQf{ihFW5!tf+o|zLKq}r8Tev z?(eb<>3^PcJUBg99ZDi!M)}a^etY%0rKRQj^p|-S{`vt=bxqB9bNA;Fp5<1W3!R{U zW4$sm5=S75ie9g~QkdzQBe1|^ckWZW;peIwFmwC1&N5mntnS|4%iKv&7$naS38VMa z|DD_mPW~*f13@01tm75ZU1)H7dJ5@ng_TF+bI__K$_@lDnJxH0KfydH~MyMVosuYW6PBvC>Vhf*_6U&SmM2L2Av^xzTI}MUeR3yW?3SI$k%d zW$j`U6C*>APg7sRiN;pEN1Uy*#Wr3q?%&|$=f8Gr^&=t*PW=Ml`orBs_90<%tR2`H zHoA!vND?`RDF7wq_9C1{6U?VolfIgzYYq%Tk~A6!mWvONPXmtweU>nH2?3<@uv3<> zicI*%%ayOh$vNxt=)?PfLj?o`Hr5bGDqej*jCcb5%W#OL>dewK^1=J&+moL(tRilHnx1ijfihI+W?Rd%Ff+1Wi}x%kv7NN>!%c02 zWjT?pMb%Uaqyt>IJ)+$4kxId069b_vgHW^ae$ke{(S3Ui4 zfUh7EUug0&NBM_&IRsX?n8J+YvoA-L^;G`8{+&8>jS`;d^-mC)^tKgZ<-R~ktZ7># z-1LfH`Xg&ys&@F;7x=D$J=?tLL02F@Xl5p z&m)FQNv>UjC94)SUyJ>e0=CHlw0X#WiW$LIGq-?;)M<{4d=Id&C=#EGi74YnM@4~4 z1Nu)F6%`RMYTezt6(^D4Da6=jhf#c?}O`^-_s`0XD=yL`AwZR5*$ z!DAAIHv>!hpEP*U8aOh+U?uEhS?!o2jeLCovrW5$dLs)F=YBa>m5=?fF4q{Nu6DVA3KYYH<#TPmoZ(>f-ElclIRof1R zi%qdS1w9tiD|dIkzn99GQCBYQUoxdUZ*JljC#+Phwd2^+yz=)-8p|EBG97;~N?m-)&U>CCru`sEKNJV zqyPQr%wwqdnNxgl#d&@JS0utILov)E2s z-h?yyN%GDnf0o zItKj0!}^@8@7mvPZFn8=p@Er;MgdLuFU{~|;F z-=jsBVr7PmV@8tT=o=rPN>Pi&W%>~24`f_WW|lf`SUQUH;YAEIis}Rpj+TZX6dVrN z!LQ&6spAP51vi7mV|ny-0quNUQE+y-rcePG;Ypdj0NRd!X+!|(%XwcW1}Rmt{>)H=Lp*Y^snV_q`cgmnn& zGghVU?0Mc0rP|3>7+ByJelBepNj_9gh~KrY42C9@IlF_v41fj3i<$TuKoZD}l>E1y zqt8S|FetDHFgOM$NQxe+Bys?9V(J9XMGFu(zN?I(Rf|PtF^jdOel0y$!9WS_$10pb zv=hu#IUh?84{{)vvtk_4c>bbTRVxC-EKSqX5bbOJm=g3|5;)tMyNo1f71uo_;X26S zI*cIlF?C+^?1+btM{i?Ye4MD5>=~$6q`!yw@mJo-)jNXDME_Ra6^`gmH-14lS@TuQ zGMgKFf{KhB6k6sepT`0gwzr>Ry;hlF{&q`Px3N*pAoLls>6)%JJ~&R=11lXycxyAi zwfs@dX%9J4cw2JwYUC~2JU@e|$nR9^Hs0PSB1sPK*ZrXk95VW+h$h$W63+gGEbuu1 zes$7jUJYMXj41M%p-@3JO6*8qlgt=uPuX}`i8F@WudnG%aSe8-AnEx$%Lz8zf!Wrs z_~(mPIc$7-c&K$|b`_R)J_}-R8BExmQp?fF7%BEIRZ=0#;^&PPeAT0j6V9y_lRfA* zPnb>O5I^$i`LN)8jG%((^kSIPZkuSw!!AT2*6oX|szR?GwN|NMSBdHeXl_Ev??w09 zlXMZ&6k*IsT&A+RKK3$oV%nd$ZsT9o05PWqY3>9D{Dx!hZKL^kc|oAKa)dB5yIO#j zhNF!FrwD z2~*hKQPX9R9s@eXx|>Cry##Ok!!IR{=XJgc&TxUYXyrHr37GI>HWKM!+`GtOwAs?G zQtlvRC-_(z2@cg1u&o~*!@ShUS9v8${S1j}1AiedhQY@x1nNNM114X`eId#&Lbg(WQ+gEzSzf*m*v_( z2Xkmj0M2QZXwCenBbm}su^i=3`x7h97#v>~gUWRy;F`j+1!UQ4N9M=^(!0h;pqT!Q z=N=?IAIQUa%!Tj;|xx<_Y=qAYv+^3K#@oCdaO@@AIgT)KBi+Evf3Vg3#JUyjY z$P1t{1=qmJ3J)|$PLwn?Ycrym?^|KgCCXfdpLzV9d>rxJ)UncjNlL!JRe+w-W;dst zWj4DUt*eIwr{hooJ2e&f?dD8;zTI`aub$rbQBNQ=eGsi*45(#(7huXU;xSuZ%BFV0 ztO1z1YYQN?I>%ejlH>F&BG?VLa@-24_1b42{?-x|6XU!pK(hK2!82>Zm6Mvq{intB zDiZre>1eYl=g*45LG!VX@^(#`tEFeQIq0irKHZY&UFer6P0N1gL-`u0L3QoKr`pht z05x6_0`Lp#D@ZCNr&1X=+`jneB4FDzd=#6r$TwcWyh#Hd{t7ET{)|3TFyS#H2ezbN z-~p~~0{p+yb+31kYY};-wRtRup=;iRcyfHO8gGT@fb|L*6tu~x2{tuerM5mgXQMqe zHujV@Jj}ueD{EWnv-rS;@+SFan>g1CU&}3q=T21_Zh~PSJzVHf@vpmrfGhx4NIRdR zjf9hjL&;0;_$SgGfu=48%|R?8uKZhovgB&!e1W!I*lF(8e+~R-Iy}fQOkCZTz^TkN z1I4&3LdPEB^tpkO8t7!o41G zMB7kVkGp3!7%R&7?>BOO&}*|Ra|*;db?62j@J|^e(;H2pzO_Hr*Vn84NS*Fv^WE33 zHzR`d+smeEz>9*CazC^NlDI8LtY-DxuhP8$m9z8!bJLxAgJ@q`2>DTLFDy8)pZ)w{ zuOyGS4>?k+JAp$_30d2^>-&}#@s-1(Fy`=VH}=PmscxzEvEh(&-|^4ZG*67@ym|hI zKO9IdYp#R|Ryy^54Jm z`28fO&20N@GiroKq4_DBFl8FyY~)uXK*fiW$oCUwSj%-7DDVtQ#2-{@xC}b@Jfu%B z6Y$U;76*6ehIyP{%@rD^?*1zRCU+<)+c%Tzq3mhB=mpGRnmnvMINT91PDoT-=CTJ$7 ze-tbIn_~U>w6sB-UmJ`PMO0(kF|kuax*A# zWX@d{_WW;0E|`iA419Bhs*f1JdXQe|6!O@S^@-PN7o>|Uk^z=`jtRJgP2YU1v0+}! z;YFC<&88%@OJbm+pfDBXY-+@q`tq`{o*V)u>#1~@`}ONrh0b#=&W%jBO$m7fSWQOn zZjuwStq`@r@LLJ9+ggyD>fdoyn@oVCNn*_NKSHAc=s|)27}ZAybw{z= zZfv){W7iw0Z#@5E&PnDbfrTL(A+a4Ih#|K5)>Sxd`}^>saJG)D{?LoVMu7WUQfPa9Zy?#9&PiwK@S*C#1)$(Q36uHZWRrc}P9$a-Qc=k_ww+n(WmUJI@C zvz-K%14uQ{I|5{)YpY;!hp6S;_Vh=!>6joNdR=d0yrF;TtJCDO^uf11TmW1|;MS1B zp%)For$(jfy;^GH6~*P{4^BhJe=FG}G&O>=5;8e*V>A3}Vuu%ly)6RBEOpYag|l68uIiykyOG6sQdqusP;`GhVQOqNwKKHNo^p9|q~oxLf#4z_(gekel(X zu*WZuXc(OBndh<-(GXie=K+=^Y-d(7A-K!HVl2n<$Fvyl*It!h5(p z87~qN`c|)%&^%d$P4gA(>d+sl_FIqPqokIkipt9J{RDm9Q%-J3-me+h*vO5;5hw-_ zW<%Ct-`T&$^esV?65b7D1o$E4FH=tRPHH#I)KInun_tf;DTdT1*LH|&DVtZOC$@EU zrQbZy+ui$oa{+V{&>9lP@A$_RfLHzydulG)M#N?gFr+=%1zQb?Wn#Z|*FWvv$Qtg4 z33nM88Ix+50*>T6TPv)r?(sNLLJN&KYIB8IX4pNf4vP#L*KTo=@^C_V)7L#|ez^bx ziTrTHyn2qZt)t^R_xezsLVt~X?qX}n_E{j~b$99Z5;^GLpqYW?j9Ffc^C8_1Hp0$v zPvJtY1#z92bv#DRO|_6u#*giKVxjv%X-_-nVsMpR;?6E8l@PwrmIUKT0B0*ylE6V5 zIxAgX(W)MLy{{Tb`?>vZHXdzuw6a-O`G$YGbTy-EepOk=+ZNi10_K=j9`AO)Z&gGTu2_P z=$?*(XG_9s$N0%+LNE)%hVFlHN7^yK=$<|PkDQDDFFd%33QII}VSZZq9Qq891e22Z zpSc=+&CA{O4g6`VFLNvFJKGvV_owkDDbcK$p=`%bmt$b?$f}ha=j+_{%N& z>rv4rXUd4+u5AnZ7<3&H`lI`XgHCnmx-nZe*IsC3%Iy+M-Zm&9v&Xil)g{m zz1IZyg=iz}AQLJ!{Q82AI<%!t+43owVYrdfi}6iUEc&U8k_qs*CQoxga1IOwj_f z?Ex_(+|DzG8}6&wx?<%eEa(-JWwku;9)Z06YwO|2XS&ieANjKr=AE2XfM4K>yA*m& zzJGxiAMlH3KQtSD2X;=_zEpBymDmD)Oe|Q^*74 zH-v$N*)dbjvX#O85}3^xf0xIwlLD-vv#eNeocmEMF5Gwm^%l`!UTBPfm$VAqB}AmgFW*5W&=2PF&eK8bLU206UYFD^-2O< zZ+~VZs0HBx(3o^=`BISR)8oPYOqk?^d_DHs4Rm*m<)CCOmdh|}4>GvxAoLc@XSlBhC|({o&T%US zzK)Ei92Y$8u-OVal`1oswb|zmerod`IT5=Y=FSweuJS=0csyI%6fYEddv0G(F_EKp z2}(;eOu~~vTj_m}M#L5h+#T@faAw`to}A}K(7B|X|K>bzzDh0>h(US-?xq5?drxwCyeamd-ks>@Go~HY3Pepm@x=hi%vk3DXHenl#f`Tcvs7sJ+b!$9|-I^HCh{{+2KUDv&ggkV=q&?Ne zwRkz3G1W{P{v5Jmxo5{R|8dpbLfDl6lP<}h=w~$!bGJe7VBRWK{x#I~Jk%iulN17> zb3!?v6BVbbu$OTvn3NPNCj@qDq0J;H*P-?W?zXH3DjYERloccqxVn~%9lfj}3KC53 z1_%G6PPAau3HMo2Kxe${+Tep2`?~_a0@51P4mm+!U@XUnI`Tn}4mjva)&wQAT>s&MM<~evmUD@SwvT0E}C=RJRv;Si68eLlpqD zy8vA|w1&64FN1l5x4Wy$6xG|+bdYNE0eC>vfXNjhv9jepk)&k|M|M zf%<(3mNzV%9RAl(C3<89<&G11@fI($ojMBNAJ3Rv%gs&GW1hKx65BX)Gm53p?EybF zIFIlF`zIIOp`tnzjs&ye-#NPcYx;J>Xh3}-ngz`4-)J?lrO5t8%(|d#n1z=XR*n(RwD#6weKwYh6-z3zJuG%UmXq znNkHUr6Ia>rxLX`>-gX#J?IKyWjCJ8>U}jP62mxJLIvx@PWRR9j<}p<*}*`K787rh zNv_befVl3=trKd89~VXL3N?L7>q~sX-wr;b;N^B2M>Rbqc~zqPSI*~Xy#$s! zf7k*()Hj-b)wx!&#{bq5rt!1xk78SWC@o{~kB1Ig85^E~4T!lrwLv2GTdliZL221r z&uaJ7**UAa=z05wuRFbz620XYDIfrvjs1X2>F8%_s-VAu9{^l%=BN{XQ9v06xQw!C zz5FbpLk!*-nT(qeffHAnKElM9^^T^TRMMW!<0J_yDA3W;dZst=axO6%T|?}rM^Tb| zvm()n)uvK&g?_`hG)z(KOA?L?arffpfW_kCV#hwQ@@bY*20j>FYmmsSyH_F>qntqV zw8>F8nLEy77@s>SNxI+$#k-&RwDu0>2Kfe0s(OqS1``c0D}cGuYF0pEROXL*`-A!wB;F?b3Ym@e&Mh_7i7sxA+`BP`P<`nS^Z`V7geH5o@_;K)@kH_rs|)x zj>c`u7QFV|=zgfyMsZ~9g?oHI8MvJ{dV+8J-Q(K(lx|JYnkdbDPtiph3g4vg%Asj+ zb{IW(KoCNr84n+|%ji@TK=k?Mq+daS{g=k3CZDa?lJr@(#g<_?(&^Ni=<4^I3!Mby zk>Ygy_o*LdCFk&W^Ip_uivB`)Q5^l+{P4>nPL@MJjzrzc__*d$efx9lmXhwVWVqqt zVOuq8ht*+{6;?27)Av1DGXBCXo6;@0^E)8KYOwkSAvh$0(&!O#ksd`*$gCJ%K%2Zs zJy}QdeTC_s%NZ3br5&k0@b z{N>(@aqR5BS**p<4vXkAzs2)*CJ};X$)uv$;fs-7GR8@Z&xd)dC&;7ytMcM*8C%C0 zYjM||Zvm8!vWYXc)@YiXq=emFF`01P{94_8DpnEI2y{&u1cBpW^Kxar?76|0y_?xk z!xp_Puv2F_o;hk6W&WG?!J5&@JN-+Jzh`IDmA8~)`N8`q zU8(Q8O!g&eqOPH#XCl+u`wKcv;Eu663B-VT!}uEhwqC3CI9h>gVii_x!-<6tY(zbK zi+5iU0uhzu@B2Gf)`>r{>q-brZC9><`#Sm?^Yh~FiJe@mcy9w{h^eUe59PLxzxS4c z!uU8kumhz8_Z9igI~g9{hj+2Cel0ps_`BCn6(*8n1>MHQcI2gCa1n;4=wFeSbKvM5 zTTc8*$*l9g0i87VU4j??b-0T;QCte7__(89w)c-esa(o3V!QQu!J0l^7#eV6oeF>c zcN`QP%WU+_7ybwHc-;ZP>_3mlRD*wKS72c=h_?M}9FK*iyz{vFCl2!aw7D|odC$dV L#R{Ijdiy^B3#+1^ literal 42949 zcmeFZXH=7I*EWb)u%M`bpwd(j1u0Sm1S}{`dhbZ@y@#S=m!crOM5IXxy>~=GsnS9R zkxmE*AwdWs-;VeFyfbU&&-<>K`SGnaE@fSYlnZzVLpsC2<+Wg@6C$ozO zP%qf&X;e|?iYl!XzpYjpir1_hKd<~^Fm`X)NoCtb%1@*wuUX33Svz(h>Ty=HP z>ksK&_|gm5n1xTOzM(yN2G#kr>6}VYAm2haNq(ogs$e@t@tZ*W!c1~O-IS}hilZS@*U<)4Zm*Jv z&+5vCxUNuM4l8NCS+u{&oL21jx8MJMgyBD*{qI~1++$?;?RRq{pxz#Z!EKlMty?^6 znLgD$_%kLpcKI<48*?dX2#s!^S-*1fu>RUMDcJueo2aO0xIqKu`Bdq=57jwN9{x77 z{zZo+`pAnG^v>Vc&D};vM>i+df`@XAWPdm9-yo7MHB7zQkNPn@{OR-O&-;eXy5{EQ zwtA7L-Sm58$#pi}$vL8q=o_)v;bO}$j~HVEgM{|>_EyRBl>5DPPfSeQ+{N|em6T}8 z?yX01r4(wh-EcFP!&F{*I)dew$u9ZP&W>R(;$3 zl$!`fczb&Z%A_iqUvRZ2XuU{7RdpnrrcA+7~))w+)*k>ZaWqiIL1H1P89a4O>Qcy}BhXQE(lFw5mN!c1l3 z+PdE?Zu_)pblSW`?`)_|h>3|wz|K-ON`&3-=i{gJr+vJ=b1EuyGcz-F_mIImOBvQQ zl*tH9e2?Z9^<5p$=)mD{-m~A{of;!Q@;sWaUwo<1DnBGwxSwE0Gk8ClHoX5v#o+ zdkZ10&gTywD07*Rte$WQ!X-@&%zlq9cODay-WvC8|NdP=QSsF!)bg@JSF(iG)b6}^ zOmuX5M8pYiA0NrSm8B((d-tBL*5OnK2L={Vm6Lt3d`57ynzGjAt<6n4{PG|VKfjL? zd-#2Po*Aj#un>h(VPs^4{qLJ1O-x2jrY#7USlqoa;)80g>!CU;Sh`z|Hf?h&eyMBYZg)w1AToT!9*0h ztLgbUdvbRBWl7PLEo^UBg3&HBHU4?#joQHBxbQRw8t^FBtLMUVtE%)XCw!7712BA| z;^LTZ?=I!$<(=!<4q=QabqVn)YZ*R2Eg9-;jDU$ zR8+#t_e^{zG8^|WjcCsv>FkXS56o`d`}d1*o_}Bp8&`+-?rbEtcP0qqNoyff0V%Lq z-WYUFX6DzUN9#8GlqF#xVlLyKo;;yeBrW)~hMmnVDA3i?ioSIC0L6sfZftC9qK#a+ zPyz?3_f5FBv0kbmzi*)lW8~GnaxPr*viRWx)UWTSQ`S4mMNeO!Sv;KtM@PhS{sC-Y zYd}w@!S7J^UGt{8D&vAG5!YI*n4%^EfiN6vOLZzG^`^_i@?X7^_O@YXu&`CpR zIh2NGe8?OOtpC)lcroWho32DI#TxP+krguuBZ#o;Q<#?^oJ+#lu6-`?Tu`M9OZQfj z;81RQx}^e<5&<458-SsnV3$dD6KXCf;MdX9bDV3Bfx+)X991C2AmTbQ(P-VgsG;HE z_@XDQyeud3GBfYVN3irJ2-|x7`TY>~xgG0cgpo_vfRPBJbXUg5$Gu8!W?)r5Ts#-9 z6h$#e%AsH?Yi$13-K|>V^ubd&%3rL0pT)?2DR4-=b|Nlpe-Gj<5AXuZSnObh^O)Dq zrhOAWW6ogmunx68tK&JYfivgb!wXxkqCPz0L>X6Wf~9~}pw$?4b#=4GTRZ80dQ?-q zl*7jCceMVteh$wU%ekbf-7FXIc~3iB8n)*(x>W*Ng?e)4)!eF$FV(nGHm_>9ti0SF z4obl8dYg{A`iHEn%idmIi(n2l^NEfucU$C@MsGhZDG`z;@8TSsontt`pDq>Dt}0cl zl=xFygi=RytD(=k)}<8`6r7U%=>_iBfSfJG-lTsXbJNz^Iww1O;iH5Z{M!)Kp0f6_+TqBI>2J7aRk&^`eCv5v&Ru(X%I%x{Ur|$Aa$!@cHOW@K;3Hu< zbu=`3A7N^Z`7znJPPKt&cP>zDrq~n$$_bVmAK>iYOVp175ZMEEO$X-PpvWBvH#&+LW9A9^Yh-+%WWS zI61XPsKoDJ3iCdGq_~(wVcUoR1j2h`RpK{+vx9*Cw=Q}=O%Qd4f^?p~ZR z8{IQPIoS?&c0VZI(7NLc#b7CWQXWj&sq)Ut%@wijW`Qu%m3YNdW@X(6_ofvTRG+cOzkyrmQRC&fh-VM+_AVDK{H#E8@cE^lyQ0pcBF^Jg8sXvL z4lXWecnqhaOC_SS-~wgs!ow$mo`-t|Q z`u~0xF@jfq;sfT^{a8YR8_gcyy2TbL4?m+IIBOdjNm(T1p-?eB3+IbB`{x{&G@DD? zI2FASH8I55>FeFSzrO`-6fG0HBE7|a4Pcily0`SN_z~h`odZHT39@I7rb=HnQ;y@b zAIaJ(cW|@{^Q4%QxdIE1*aSYB5GV4x7w;^O0r8~%ou6UK*H|mP&jILG;Z6l<~?!t z;WO3b!DZ(KqXw+WQrCLh>Qrhf=>~RN;r&|izz@PZB^%ouE1%e4Ty5%wY^};{qv{cQ z{BNd0CBMRWkCTXr=z7-xR?Zrm;)O1mvgY?jMEvzJRegkdZ>pzZ-FlVixUJyaDOj0r z3@v?H9I~=zu!a0_%8*?jJro+n**I0WvlHNW_>RASwN6f4hMfqHBK*Rz)JElVSyECG z%KJ(4hl}rC2Ff5IU7=*0v9V_yO&X^JD#ud1{Oiasq}nt0DRhk zNT9{8{*lY8ytg?vDE?_JCkZdw^FCt&eJoWvD{90b!V7!G^`;AJ3ti()9lG5y8pHR# z)jO#*22uGzN~Gpz?7{xIl>eSz>!NHzCXd`I2lr*Vd+@?oP3;bNH1$&+gIr z7iOusU(ZKMp$&#ct@-FuZaAhy)9hjQ^G?9f&>!nMSjWPB66_@h@&ruD{-|qJ8&9as z8n;a%$NRaz*SfvtlxTlcnAyQYGaq<-Gq^v^6cgmx)pz^@Sg%fVd33%I;qw@~(y{=3 z!OAPjsxWLfUsLpW-zGOCX|VRnYUl`TVig1D@uLGnL)=c&>|v1i>FDYj77pbbq^n<< z)#o-4Y;voei16m&rB4&6^){$%17ZVVC$7_7;Sdt9ZZWteXXWgC>qDLI149qEWSaT=+tUB)4MNlCJ9 zb(Q$0wo#7{^1_7;*HF6@r^1w!5!%zy(Ltk=qncGyV+au~V(UR%NL+{LPeKm*>a}ay z5D}>#KQiWzgKQG&vqLHJh-Zq+g+({lm#>0>au#@tCnV^ZWg&NUA{uZW*})rnq!xW3(nDT+Cps~sJ zx|J*(F**3__AdskM0VEQ`W=5k{4oA^jvDJyo8-ECh~$#jRxm98(UcoWZWHwENabpz z)ko=t)3J}WV}dSigc^Xe{*da2e;@p3F30`$%ie3k6k|;fjBnDDe0)lZ-uU{06|7H0 zD*d}u&l<%1Y!z0s9w{rjr>_>(f)Gu*QPa)qGKo0oOH(1!qya=4Khi6YEkAO*yHVTEJ6nF0K>u>vZ zyVe3=MofAMPIkmA*bk3p^Jf*$^*(wuF!h(eC;VD8MScTYt}qPb zg++wP6|>TI==8q@5=uahy-8fLf$uQ1goc|(@1Bc@M8m422cy?(`$ zkP?F~+-EF1SL&gLv|@F1N_1w=I1$GAt35Sd@P-%ZeNR?-y@Vckg#o;l%z3?2tSBK% zYKh|8iOmNZGWKFga*vrH2Ijuby1LaPtzps6vO>JvB$6C$lX!uMcW)h@Zueft~!VYPcy2T ztTWrgH#7N6i(yG38yqPsqk)!z@Wfv9_Afk=y(sRHSMcJKAm%SUgw(0k)r9CluTSE0 z%$}v4@M+5jjV5q_+gJ|6_}#sbYUmAEd1Z1@dVc^GQj3fQW8=ACj+}t2VO|N>QAEPV z1bAXt$;{^!k$tLd#<*cGicO*2lB~t8?M*P-IEMnqnzbS9l5T$*PMX=Hl-tmMd}96k zhqdo=EeAUV6RlR0JfFciP`L#wLv{9{KH_M;adqE0e)G$8D=RBror(aOp3V^})za97g#{yNn&(2zKXXy1sVhAM||{f?l_jE=27-bcK2&uS%8t8T3vurfozY|TOPADZ}Ruv zkIDI8$$BB4C`u4Hcxol4^PYd4<4k>Z1phK&l8WL@{AS!S(g-H^oW{(N2O>a?yBzn2lop!zv7?O~=>xuM$ zt)-`TwL9ICYNRJ}c@neW$gX)?wj0%~DU*i2|Ix6I&=E5pp^rZCPB8=W0bSQOb|#K- zI<2(CK&Dr;SzDBh&Fy;9kD;LkQcdJWRAqTv&g$?^sfWQ6W2dk7q&z^SlZ#CRUek^7zB9EaK)v$u%~a0&lfOyZYci%?Pg{ ztP2J|ntOctM(~}e_r5J&(sPI_4<*&en{ffQ?==&9V9KSvz50fNf3l&T$?q|KRWROQ5`39=lfK-f@nonviNy8^e5*eXbjLTP2! zqJ}6d>`P$pBO3>_edxc=NUl4dCH4G3T`5_;o#SpFX?N&ISIxTQLU2K+?(A%c@-p3N z&b&=_nVr421PNwZ_P;ka7Li$5?H$O=zA;&se||UM=VUF-18)8+Zq^ktyPsrP z`#sDEc<-o;+GEm3jBu9DPJRad;twhVgaZF)M0yl%%l_JMq_g1cci(;Lk|I9V9{OER za$AAvANaY6%hIx?qn*f3YN39>L`oB!*wN}b_|`5df-HGGpMKxy!X-iaORDt&uPyI< zIoA9Sc-?gGk_IpF#e{T?gHnYlLO28F`8tVK&_J@-^8n?kq9bNbaJ}!#4l%?S`8#gk z%H4x2+u>O3+pr*+CrLIFAB+~d(9`K_+2ziXi~rQERd$^DoxWRk-Ch2>Xq!ynSLdwc9dn8%1U)!_i7;LCLlHA6m9am)Gp)YAWyy-eZH z4x0Taxb-8q$`#f^PvtvWrPSqzR>O-~^2iK&YG%reD<|Y|lSyT5dGWM03N^~1$W!N> zIyn;ZZD;Ta#rEiGiM$x`uA1AFg?xTepIBWIB15N8l8(z0C)QY%WR4c!>BFiu&HI4Q!#gkk~sJ)%S)xH-K3kZSP z2|;Nrl3B!Gq>V>0G9)BM^wqRm{9mW#ltW1rs2;sJ^sm$T?*Rb2oPTi!s+p#D{m5K` ztn2_U4T4gCL}gGCuFrKH_{P;5L&)ZwhPS?}o&M|l1Y4ml(VyB0k&J=#HAI+vl&@|T z7nLEsM%Ex#tXV>Bxs**7mfz~Cw$R_|_?Pr({Q-|yz8xaB)l+-Nc`708*-(&aZA5Z! z!6n^#S6-&N_yS;v)~0 zqXi$MXk^f#doK%+8wNUzD*eAgq-FAnHh=zZ9F=8;i&|v~KQZjgoJoPni=I!jS=ZX? z_Q7=Sa6wESnii(iL6kQDC_p#1cjO;OAo$#Pgp~5Mefh_qN{X76WAd*9168~73i=!Cd<@g*x^rRio;y$d*P2NOj_GWy zk@cen>Xs#~Lso?iVd1>_OxpLxZ3pUd$wP;BiL&UHN)yq1V%9(QN@dx(dB$(OVf<-_ zo^v=YLSWyk)PF)d=GqEu4rI(wh-~Q|R1n29HW!s?#IyMCgQzDEA@DrV% z69@HLd(m3lzmuN1^>LE=(une{i+|}bs-~*9pDLRa2>-`jT!s?N-ZwR#@0G%SU>p{!fRvX_jfVq9<1x_9g`*xj*=@_zy$=8gtX6^YK(jMOL=2hGbK7c;! z)ZqiaVu7rzno-ysIY=8jwWelxM&SK+stO@xc8jPrDWDlLqUO^xx|aQ}u8@Y8U<#iF z^l86~o}r=Sr#0*_j)|CXl4$()8XXMfNZeP`#&wQC+ib6f2efg+p3FoiX5vWl%8q~i zV(Mw;S9DHNK9%{*@f^ z-LDut@Fv{>SdVH3+CyCUknOGn;kI|OIBPv);}r#|bKw*&!G7N&{1LB&wD%|-KFBp$Ld+u!prDBBV&vieqF3}nxYbDf6xVjKMnqb(gLi$IKIOlIcQ8@pJq&4T-(6|VRCe;RLN+7StuOWZRaY$#wFQ~zJC3hA^bjSNXmCL zthN!TPWyU7K)pxp1do7#T70mJ%j&z+{5=2B0u;?NG20W&jbYxfjNWQx6%~^00XjM{ zfEWyFIyA)b^778~9X~*Q^x2)W><225Q?RVS>tS{)%E~?gHwZ*>l+{6Y72YhEFhKIK z@+@&KH&}Fof=E@z@6=4Vw3WW=?dua-K}HiiuiMqWB-|=YrzB-k{g>&J{@8sDuJUwxbCW4~8WmQE6%&)Z2{ex!U5Ax&nHn6ut zS*3h#7&2lz;}{-22BWy&Yd6rV(=StI`(aul6kEd%8x($@_4aMVLB%M*KYp>@I!+8| zQcxP?n!w=O*S4fqW72$Ljz7DTDCJu)BTbanfSH%|O-)V~WGcs(11OkY8Ud zGs_@dn+~Zyp>Cq0V4OhVlnnluS^orv0AMNng@rrUUt#g}sJtU`sUbFh!v&~2JLzG$ z^xmq&zD}7BIe^kuY^&erRx)Ll6*Do@S+;mBi7ylaF#`xegttYUo}ON|j)7=B_XF2V1yCER4UvF-14qbmzO73z3_$=^4bdJ7W!e_<~Ecc;qM#jQ9tx~+F^5IAF z(C5#0;7G|gV3DFgV}Kk$7wF*jpppG?Etw4slSftKZC|f5_!*Q~y|R>f`uzFxr!gNX zdJ)4J?A>df7_a$YFeCKtzLvonS2_jGT#;YD28V|i|Kz_8g_|AK=mG#g$}NR9$TVmKw1I z;IIWrc6e>qik|=SviGU*`!mlOI4zNpx0Yq6Xil&&i$~`qJbFE~R@t49V17L|p=q$l zcUx^CkUPoix<=0%pq%GsXEVHMi}$^X;nmw1_c`*4lphv!g89=*=FYW>At^weS&T-NNO!+{~ZTI_FMz-AU!2XQqlO z^~J`C{OsIYIx(~EcN6V2Nad2cL;WzO@uli#l{Q7d4|SMpT1ph&|fBBtneND-qWM!;!=PvG(&o9 zq_?)VX4D_<>})3RHv@ufA5pVNL_^~ph&NET0y$2)h2hx>AH;2G<6aK;yqa3`?W8vs|FL_on3xNJ-^InnP&yhk z0W6klZ5ZKu;QubZQ)u_({C@N)?Hu6+&O7x+%$i+kkp zd8vIfMjsIqd-beFKAj$xA9^gbY+pM6RCtz3-NXR|h2-TuScswduB7t7Z4b z4GG+%XdXkR@cRIJvJ7E|aKIlepybEbM-I#1#vtEo%;~uRcS30s@h>YQ8JO z7b4qcnA06<$cZmph@=?16&G9EY)T{u-Wn^T)z#54h*nD2qVbFz-I5(f-{**3(ljwP zc8X~Mk5pb!VQ7uLWAh;rvYXj>pLt>_1Vmun%VN2AOjRxeF9wWQL_zthfW)v-F}yUp`R{gmTvxUlr0a)+jt`vYiS=K-9(DW$vt!Pa^emcBBo^8%-`JcV zT+4ix!8#m1CEu(X7vH|zp1j`k^k$`rWT$u8)Lp`wv+(!o`jugB`UeZ8!vj)%DauxN z%*@QDew_FRa0}xGY8STLo<{4e%-^)QiR)up+C%jgm4DNEw|BVhK*(hcYrK{|JWmq* zFGl;{NDYt;Naj< zCl2bYpf$wQ`E-_jRFBqqdObrqW8S~FYkqR@Qb|v1>wO5NhCP>iZsNku@EM9&5cfY? zcNq?)juHU@$OOoz&=`1=G-24%u-YTjrZfKfPr_KGtDdWCp>DqZ_0uCQSNt}6<>kFY zLa&14#XPWBR-8r3=fUyg#{;$|eEWmXj2Ar&rN|p=*BTH_-u?{-sIoQA$`nD;0?~0v zc5g=ZzNIf1Rh2?l{PnvKW3}bwUl3L&q|hV#fQ)##$)GSBA+@T0_iiXYfJnePxVl!F zCb?J;rfDLj3GptCB%cXT)3{G`+%GXY`yBadXAI!FsW*J|S%c=V45Rgk%K08-q4-pw zR^Rr8s|1hUA3vJZ0o3B(Cv4LRI)c=_-!EkKdl27K>Ddq~*A+G4_)Z4mR4~=Q5^Pf` z+9ytl7ecF}<;oz1QoK<%cr%H)xZZ5vPfZbr+xrmr+(01)%A0bTPG9V3=0vTpBdl(~ zV%m#e&*>;@p`xOq%h9BL;KNX#_KuGJu(QHtjzj$A zm6b-;7BIy(W7K{9BF$_F{D3HzzyYBY`={ZbOSPy@0Y)R~`hlYTSDVFL_q zKRS5q%wme~Wbb4>;s|Y+)~k7js->)?GQ<{u*C0hJx9h#ANZR*g%(ZdC(5FXw>jw3) zsM5~axj7Iz*;bVvr=n_2^Gc;(u|U#!dU)hh-Q_VbFo;+<7I1{>+kx~m43vR^#L%gH z_Hv>#dh?<}Mtb_C)fRGkq|CX5P7Aqf`bD>Deb;=#=*mLu8@K0^+?&%Z+aeT~*9c6! zDFR>{Zth^<1EA1C4Z$8oNlS@|iGi%Gg(BS({wc#Auy{cl*C`yZQrz|je~s#_<-il_ zwK`k`D8cS4l1!Q?o0%sn;j^oIF>I+uWZZ8ie5Zwd&z$5M=al+VD_b>OX%f^_e~Nt9 zOeva8p1IHjH3v9Xi8uXAEURv>sM&B^&a>G$IcZy3UTV~(`WYq8(Q{JS$q} z;hO<=7D1EJjJ@?~ADiTO(h!Zz&f+C`S8AIC_9=@O0r3hXu%`DhF>}mH7x88|IKFK@ z{{H^<@(WPB<^k1-ovcst*hkfLuXT^)>N+icC_uFek2V5zY6gMeL($s3Im4$3dPmW5 z4gmoH)X_aK16HDfi2P|PV~77jVkm*2Y4Lo_^j~=~mHF<4e^99ZA>8s`AWb4O@jh`) zs`cW(P*r>v>5ggp+`qsZ$6b|02>9nQ5B>(AN4@g@JBOBmFYgovX4Y?*4h;-^Dk}Q1 zP7y)_I5CFR1s${TIf%EAilH3=T!9Mr6X=)${yMT{WMGg3Ndw0FFUE1NukK40V-gdQ zP;B2euNL*B+5B_hU*t}Z?Knd1G2jG>q?kph+!SBu#nVtIwzLfU1JwKSK0}p7k<5Uo z2HBGhg~SzRTEh?erVJ(gXiHK4Z;67>Qf}cQSTIF^A+__nw z+H%mnzHj?G$tFLs{M(Qb^C;?a+=|jUCF{SD!TEgw2a@H>`Cro}GYN8k1T7L;k>hUyG zblLaq{vicZir>TsKV)c|I~j{00?5l?@3L#MUiv#BrrL+ckH&xB1-J}gI??&5-Q*8J zS;76`Qy|!eE!g;*z`;*LC^9(>WSQ)q9~s_HMci78^9r8a*Ali)cYqr7nr}HBOKwY* z(v?PxyzrMz_y-IEP3a&S%>(O9&vAy4G1EWm?=zVZ^e?2E!2l^ETR*mceu1hV(7{ho zbqx*;baL3<)rqhIL!DQqj3aSIs0 z3Aqn!y$oaci@^cEW`qKMmYwm<2+l!C6c8R&KHQ7Ubrx`%0 zbvBa)uSW$Mh(2JQY_Vj`>!91jOMBz=Z7-z_Z&ZOENtQ0P@Pl)mxE`oU`gnwwK&n|3 zj29nr(3qTSi89SvFZas9hL)o1g&06@N)h1Xg3j~#b=%O&D{C7M>%~E2Y6j%cxr&lR z`&L}NL@MqORRV>K(IIruQS>Rq1=BRfRbG^JBW8Ch*PqmgcO}Zil3fc2JM#q2$K34I zqDuc*T&w~0_FGP9uCa&sN>Sv~q(uCy4~yZuaSze`Jw~O@^%`pQoW|l81DHf9ev5zz zVZk`pJBib8ovh{pgu@&*JH-)plP1<{C;(PNqkpwO&T~mho@vZS-kc`6L z&(m(>JHRLC-ZjVqI6rPyI;IoYzjjizWuhov=w7g(vg}?5OWwX-P@4qr#!0;1HIKDX zseiDFWa)=DMkqCWk}&_0U`h>MIx2(G>;s)WteOIkLEAdmVpgXlP)AA&wR zroxK_v!W=f^!YeD#Oej~2y%Hb;v-`J2op&YRVE|!j1)y6>Go^5L%HD*U*Euw6g^_! z+YE1%30kZe^S-mY#E{1l2P)CAVl3Dbh$UUeeeQ$SmO;{8Hwtu?l^}MMSdGUXQW8Le zS_W1PG_>8ho0p|r=Wk#ax}}4n((j2HIMxhICF1c1wKhR$x%m|%Q&>4gPA?ZgNWLPZ zEZz+1imqvs`!kS@-kCp_B(ky~KuBy$P10klQw7;6Fq^abE(P{01TYBJ1#WSKh4C>I zsV1>5e#R6esp${0EE*>Xp4K6HLDt8h#+qAay9{|3X3zK~nJ70m zo;r2Jk#3oyz0Cb+zftbB^h!^S>n0Py8MH8{4f{U9wlhWqi;l>V%N1c67P9xFvrnm@;0b#^Sa9`c48|zVCSqQB*Re2GBhuP%M5pc{1ZgusMN8eH}DSfHK&)91{AaHFH6(-Lb6F&W4M`pSr&1+6O#eG#lueM-VC zCmgpo=Fk`jQM`aYXofs11O(D>-lrDD79AyArLLuADb1a!)W3kssjeO|JVSekbz3pk z#>sSLETO&Lzh`YLuck(Fde3qQNQ2x@pWJ3I7)TO!DT@%-5kn|f0IA}rJMD7`?&1Zv z8{2^m832IvJRqZLfUqg*`Hb4^W0Myq%#L~{f2TT>5Cqqc`utf^tJb2}b>qE@GN zAGZf@H-Fl^&qDZc3jl0MNl8vc2?+^G(Z#63JJTzw`#nRpgD)1$2l98vZaDIIdz)M}rbN z2K*95=UBht;@bD&7VHcQ-Tftn@~#>*KjyY4MW61}PjqKwK-_E9cKV$CD;+`b&e(e~ z3qE!Ki5I`iy}+LNt(m4PTzg&~yT(}xD(!csU<@?0WeS@8X_HmENjMv}8Z2WQ)8yWd zQF(Ymz9k-f80d=2JDrkb@j`h*zf0>UB4)x_W!^eW6%Sc}#_{U@{of0UL6VM@^k{AG z=UpQ>fW+%+PcKDBVgj^h46JE!G5m6`@Z zVK!~?pA@;~bX>L}<1aY45t#Rj=Q0uOl*z;W<=-y8848(f_jDo1m2>IGx{O>Oas~al zdz<7Bi3hsfW_1F3{e|(1%rfer1qZzv&qE3Qa?xK`3g=C$gWGLqp3@C?q=H|hh@HVF z=^F18$5dN&ULT2c=Kz7a?)Q~z@`CLypj#hxdMqu4ldzyu{hBIormSat@-sxJptgqa zC$^CWYe|j)AioBkfPbH7>`M|$t0@^4na7WyKfYf(7Y_=%91t1k5I}7>ShzQD2r}0% zrw+d)g@x6N=lLQlp1ad}xh6Kftk37FRm+$~suf$eCl6t=1JR@ChH;j*uY!S1K+H|n z`9~;iJ`+S0XITK;OTk0haPmNF0T~BG!RV5%wl;-{0TKv^U5cG+e~Z!ygl0z+_QBWD zSw5Xaut;=(3{p)7*>f~DL#ed1w11}&a(R&UOI8BL=f#2pK7oZ1L4?B+^DC6K6?zkA zs1NLyUIS+LecKKFEN>Z&%t1EJvsa;a$`jy#icQU!-sadT?S&CIXK85{9yVEh5JD=| zJWf*{+-b50fe2UrEcec8fcg3t~sO65qIolk5*n;MFJ04i`Q z0@zSGDRA{_@9ISDOod8$cVP(05fGxqUU_yMXb}P=A=Qm+gCI)IOCuT%9}bHcHl;>v ztquZ9QWiw?p>#>X^k(`i!AY5T8ke_k+>214~?|m(K29=jsQcv@B0ov1v$9GedchpqmT` z)eW`_L2p04f@3sW`+Sw+$v>41Z>>YWK}iHY#uvf5FbMGudJ^o1-U&zCGEGmJT{7(o>W=HFK0wVFQ6F)(yfD}VYlxNO#?B zc_ZFqFKG(D2tmQ2z9KF(>u&c(Vm|Gc$r(cI@2TB_HjNW`ud^}-jhdWnWm~lwB|T4I zhrXmvnaFo9E;O&+Ea&=34;o2#p1Za=Hxx0Ys zU3_}MJ{J$uT@r7^yz|=gw1%vQBAqF1>)2F`AYLF$KG>{(`&t@nwe{-V3hrt}XJU^e zv0{G^AzVJIm&1V9g5zXSja8dZM*#{|K3VD8u?i4N6qj=T5VUc*_poDz3iSXr7~cz& zG5ai%xu;|X@H=M?@Y3&W03QR=FEOLdwu1NCwfAG#3d3owOnX^wu+ZYzT^vK$gSYPw&l$QAe0A^dQ%6L<~FHZ6J}zwP6CO>peMV%WPfM%2oEX7dY9A>FVID9do_NEu(sK zQa0taDaf8r#&6}ycPn!r()_r*h})A$QRr@5~zjv$C0 z_m4@A`2oI7%w9$lOZ?KdKCwj;wQ??r>b+OP=Qw_0WK%6WcKJVAfMw@bA=?}&Lc-@d z1ui~-0^)k|r3vB{@!JUzgyd2lZ-S#$pIY`xhUH&lXM>iRgB~!F#l>zmtVA3-BZXT= z#x_M5$5bA(4b3Low^=5(1CQI(Zq<+(#Gig%g&awOCu->>Az7LEr5|(wxUbc3{Pcdk zncNRqCaU1iv=)+QXJM-odG__&9dmES-;3g-R^h3IqKseHz~@whkDU zi=K{~nl>l1DR?89zsn#mLK8u->Szy=6lij7bZku2b+Ya$V@N-BgFnvZVCZf6uV1}X zP8+HsP3n0v;}B}h;KtyaUwp;1a8B)$b3bm7Es-*;+3*jAi>InDi;WDUS`_X z@=t)iYLu=%pjo!0nBypy91X=nUrNQ;az31}DYA0LCz5s_2u7wZ6)7f>&Hz z4^F+B{wYYmR9qQLWr;tc0IQhmh~qx)Cn6?x`6fYoXwJeD^6MI|1<%mY`Pk&1CATN3 zZ7t4njaQ-X6Gg{b3(&1SwB!Q%vkRzh#Q78EW(#y7e?mPxx+~QwSTCH&sEp(1#q2;y zQA1pe&` z{IYpieJd#H^Q)=Y_I~NuXFjZ4pEO1}s_fGH7hBuhK!j$r$XxyC?_8*!;i>jTXkpZN zOwObe8XxF#S2&{=8%mKa&F^vJE3XV=t*V~#A}l^nA1lr>yMBFXmj;^VW_Ws+jMwDG zGCiQHLo%T9i_lCz)}#}T>7VF>tDWAWEgHIKj1#Ehg z>p;Hc%-to7vp`>pM52^IcfiElom6pBXL_S0T_7>Uq1;g;=4(BY95g>8M;A_xm0e0d({I^_cCmhRiE^729VlqhMl#2LCnq3(>zL^04< zfXG9a*Y660$80)qqkr+VZ|*4|O9F{QyxUY3wR3?1zVtQbL6ku_Z2ijGk7LLFz-~(o!Kf4LKh$E5G zBi@R(Y@zFy#eO;?mG4W+_Gqr)G;(ikyPYjIV;?Sej047=Ue6$I=LPjO!?G)Lgr)rG zPM}Z#?(eO-KwayD^*F#JxB-w=8Bkro;!Fe+v3HLiR#>R*8MXDSjJ&7zbNxFC0 zqzF)(3_jUnl+$2s57~6_m}^LUQMn&9IqmotjphCTa3`X}2!a6g$a&W_7L<25BqRoZ zm6K03^&_@C-9E46Xqo>6`qA1%87RFqlI~)2qD7U0WGB~3@B9vzb`S0MV2)6AZ}?xN z^$ga+5}~(-bwOgVTujqsrf@t8RYBLy6J_J*?ld=z-P(&U5+(6gTD8R_G*`rOCstY% zt@tZ%r52T%(Rdc%KBM;EoLW-sSK#5H7qeelXTg?Qk+(pQiiwLf+)@m_pk0ZXz)HU<#7=VeRJp;gqAtVe=PNtRwCYnE~e-RmEal2NY z&7af7z$roGu5rc}@V^Y_i$p!;5+uX7Whx8A>5z42#y$GZD>r^eD&b zOLqkyUiMSNZ^8?Ax-7!kf{FefwOD+59}C~4pE1PXju`1)jdkUU@PQEF#6^>jN6MhY zorE5{)~*k%#NYpEywi<*L20QZQrd+86C#mEYROl!a}ln)>^v8RXg{(FpT#@Ge297c zlOrG~>nOcm##~#FOIrzTim6dyZW+;jdaFdEpcJbBO#~S zB~YWEp7PNKyygpi>H2s~tJt-IKHBUGgxa^NJ70&Uw`ua^xPEsvb!juoXRW3^*yeMjH`Pkk6=h1XYlUv>5>0dehi#wSJDOvNb6B){~@BDiz z#&H+Sv_w@|p7)maJ2AX!zv3EppOs-W^1L^By&1PfdR>iV3=!}PsU1L+p3EaY{kFSp z^`3uw?|fKQ_<_6=EY({TZ$VvkDt0uzL;Bsg;0N6Y)pu6BB=7a`ysOZh>g&4$1Siv2 z)dqaSjD^9Hk7P>Xv+`Fvyzz85f8Wx02nmx$Z|TwKmtR=?q%JXn^hk{&=Ni!2M*96a zLc#mvBYyn&!EvAAQ{G4tpHNP#BWVZ!u{Rr<>&(~I;maGYBy}wZ^F1W2j0_A6$brH( z8!A=Iue!PukNTGewAB-Ow{)%hr`^;c7n_%=4g=lID|z7Xrb*MYd?DXx{7GLi`3#q=*oyK zvTF^<|1A=H>BqYe_>LjINYOFdp#qa_TV#-KDRMWV{?D&B+W@707umhDK!ZZ|*?NoH*>&;cke=tf4oJ%$}Mf4)e1Cb z+u$vhyP=|4-TnORm?&|*dRrK27OpIV9QtzmgqdpSIri;j-G{4_^+wUp;VW|Ne>t3) zpKf^}x}b|Ps#K-dljyudY$xl^xRhakPq+LU{r0fk-@(hI^VfHzWpVuFNy?}eaQ+k3 zR?8L7jxoJ z?jF5qo=+-+Y^}jHoXY=n<`U>Cjqy)6U$$I2Q-JFEy{14E6i%6#e*pd!k zQ;?gJlLjn^{k)=Q~BM* zrQQDWV&M`@o`c-WEhIiLt@1P@64SV>)Hzit7M=V`m@ZY>?{TQ(*(X&m2?=P}D zQ}*7ydfxL!it2>O**))rx}8tP@5l0+@T^{vplF{h4PyOfsj}a!ajAwHY&$tP^o1Gz zbW2g?rYH}ST|v$Gd`R9j^hv+7w+X-4R07Um$6r}|J8?2yzXhM@d_R3AP-RU+XM6Yp zS>n#ckJn+hWc43&oj$UIbq&ee24QVj0}1Qe9~r!PX+q#c;Pf%G4|xSON+L(&vC#Nn z4~iZO_huuP>U-LI)fzu@^9oLnS?|(6-NilqbM+1}SnPhIBz|avp!>--xDgq_Capx? zR3m%!iX9H~Uw&)D%st%F7-zELM(BP1V(!E}$v;~Q)=Y@teN8_q-$spXAt6dhDku^P2!k}JARrRbA|)U#H8c!h(IwI?4N@Y~r6S!7 zAuTbCgmevgKF{9Y{e9OuXRUMAZ>{%_^Rm|7Yb0i#=YH<{lh<{9QVR_3&RV*KmL8=< zZ=JDW9W?dz-2M9D4$;>PV;xqB==OXA=Y&xnHm zA(|YEF6|0(K=`xB*R$sz{#Fu!mmj23{s%87Z=Cz5XL(GHLi!&*)v;p{*+uizb6aK7 z%#44(J7^U(k7BKhMhoJ_yRlflbn^dP!^=r!Jw59R2JAmjz+=bcBCJ8=Zm;X1z(Vcb z@>rA171n>=froBe9+W#!x7 zZ~ucoVN;-CKUU8i-tw3$I!*T4{V>_LOBHy=-MzY_y};Ug&pMW@<0w1_(aFJkduA#- zx^90GLw(sbq*PfLQ0)5!g4=OpV^e$ZL!VoWX)V(uiaqe(Wox>ih4r0MRTO`(vaN)O zvCpmXQDa)Xp=j+N3V7-GZIVW-xGH{W%$&w3wYnY+i!cSc zkGI-N1WNas-HeBYy1C{?=3$O~xH>M*-+NDg*x@~M;Wn|mPB$A|JXK&=7oLSV6~wvZ zu3dztx5S4}tlkq05dpo=o(MT#bo90UG-_(Da2Z~FaJQ*6d@{9xTwL)QdY*LbN@opv zDcwM5`*E>$EaN!|JqLaU5)J>ZP#cj4;op}7j>sqcfKm#=a!-w#mlQrX@3E~$={ESF*JN|fuWo26@OKgd8R$RmGI-Z znlUGbEl;_~OWbsGW)WYS$`Vr@@HhGxD(~%=ZPygDFx-L@s3FRj1>paic<6oBqmw3q zJk&D1`dE~asn0{^jf92a$jsn3o~k?Ix8a3_>4~sx?4?dktRLWc$$#oub57b{ z07g7~^ZMJB3>EewG65QjHMv=0G2z^xJJmxIcc1m2;X}{Ryrn5F!0^(LmQ=a_;JRPu+q*OrpJFcf2Yd0 z=_97q^@-3bZ(Pnyjj~Ymv;|GJS>$IVTMQ0%3?^h zjf{y8E7Zv&=G_aS!%o5)TSQJ6DRMb}8w4(V;4bFZLdp8i%TM>7mi^?yr^RtaVyrv0 zbC>hiA*GnO&(0fhwiE!_(yEZ4q&W7M^xH4Wa_lDm*ml4#EmjQV<#3PwD>PJ=ooS7qCxd zN`my6@Pnc!?HVz$^3sF*o}3m{ zUbp4(t~bDbcDia17ujRjYLoIgT~A`%T3tN9d7CMWAm);@*Z7F3n>tJHA>Be@(Ws5l z0sj}&;c<`Y3^Ir11WAK#x>KdrV{$hX6Rt3)S{BwsF?#M8Ff$9=P5lMZkm`%hAee|{ za2`z&8n9q;9eI21((j@sMr@)x6nPwecV8V7M{vN_69Dy0gn}q&+r1W>XM1(9w~dWp zS49*h`$k3{ffgkd(CV}eYPLF?9Im)WMGXl49$QkHi)_D)m3{^00L3ls^n~HkIQEtv zirQu=wIROBfs&$vxt=n<{mkxwm@8B2Ve|}~{@$8Txyat=tgU-OD(1DR>|0>)tsU&H z`S*C*IkunO_ocq9|BS6`oVXe?jhT+Nu9zyH>=3sLfe(>-ItYK6*wpD~g~?lpD@x^E zS-#~Fx1mT>mz%p0lc-%ob>7ph_p`y*McOWhkhIw{2`W3}EY|*}wTYDpw61!8Vnhid z5#uNV0qnHuvpsg@*k7noWyjjjF15YgURFmkQ(YVLX{2CV?}D4y2~c&3z79N9D&ntnDBvP-D*(>wrCj6d_>L3#N=+J zS_}#DTxSZZb>3!(v-G>KPaN8W#xyGb9-r|cugHrXyCF5(b)!Vyu67(Q)h@3(5o@qr zaU0NwR}_-PbyfXqFO1T)QPPDrNdgKkPR@cgJVlE69;xpE^~z&5saJPj0{erVF%&@@ zs5Q59h(m*vzKPN@Bwjs+)K_wmn$#DH(SdRm>M<2Miu*tlh0{slIs)3Z5AC5+nQ6$K ztUnelJMr^dWo0F5Qi?h3b?}K;`9|L0hN*GaG`ZYSSza}C1^wSRqwmEWX$?{OxtNfq z=`YX+s6QQk-*`M=%qQiM`phO{>z1cQ)%&`lL)tjnxev_?VieU`7}@DNzp-b4cVY%W zh%dkmVPbk{M+QnqPiFeL+$(EMwpkjwy7l{v)mer@$ z1(w*-qC&n)j+zR0)n!}5j_UNsbJjkxY&FZYPsr?LPM+@3GG@*%eBNoc<_OUPY@MXI z32`rlIy+xiCg5lQYI&3ud(eD%@ zdrsDM^U~ZChmpvWTqnV%Qm-D)2c1h*xi1xWn#&o7i?ecCVkse?pNus&to#8d1vR;T zN5t6o$ZXslOPOjXt`;Ba@*hoGotjVX5@_ z6+1L-K8HhsFQmTHBl}xTU*_)WE7$z65J!)8v^r&}DC)c8jo|rlOd&hlZ*PpFE2!CZ zXMKQ--*tWZfo9;iZEU|MV)m_kC74s!yCU6f=56xct=pQwW$xXp5ePoydJ;{Ckv&|4debippyQna`YIU+Age(pCIg4!{Lo2;!9hgJg!n>h4X5HR}NDo_JP z)GHIY=}GB)S|-=r<)PKN6M22y1f~8S+tdVjNPzQF)vRbhQp^illtuZEW6&AH5X#(% zr!=>;ut=3+zPhF|t|?yEQ=6EWm>Kz4r~nuV-RY7wKJ*~sl_AtQy=oQ`Ug*8=`Ov{L z?j=2|Z-$=8(l^bPrrg1}ETkohcpi5^2iDqHT4FKDidi`TNc$1#+q&+>QL#^};LO9B zW-`*Z-l8hr-g=R|2iQ*h<`G(vO3b{~1yWK&F9tq;yU%sWM3pC~psnF~QxD(9uRoep zj_q&C^dE|ZB(YadpQ7CeJApQ?N=TVK8ZNsiP&)8(c(EaY8cywW1|Y}8FQXc(BB&#%+AdXtlb-1?oE9V81VGP zV-NOZ0b|jF>P^Y|=xI$RN54qXV4n`!BH>2I;4KYheHVgAh3}xOOz0}cON6o}(*B0B zOji~J?Moks_ZAlq)cACw{TwJ&SR#$_BNr$B97d2n@1nhV%;oU9T8((Zz>DRqO3d|M zjr%q+&uj0z?ynGW+o<0@f4i!Y6R&tt(!OHNFnV+W2|z2+W?AjTXB>BKXZ0+3%%Iq? zi8aXqa*1xij7eH1xr;xQ|K7cc9$qOWh34z8mj^q?m8@<}4fd?F{}FX+v{h~gSJs_6 z65xKBrrB=U$?IeM{j1s#y<{?*bCT91(~4V8{27p_a`|}x0iONLE2}-U(EYPM{kacT=ajNsd713 z+I)9oP7PSSmsJ>orTJ?XEgtxDj*nW-J5@E5>Tt5PXW%_YJxt!N3Ls$AwZT%_F?!8szd}rY2(FTAsfL#Mx|d zqViv$^jjHljftB0G=Q_;Pb^bQj^TKq$J*eOHg^#OL;0RwVGIr2S-;>4UV|$-5SY=K zrit}H!JXN3dvFTq`u^3y4Tg{jat>45l6DObZ)ajcG@GuqL{f7{wgl&cq68SwCmU#6prnG2K5xV z8FtP53?0Vb6|e)yR|fh-mCH&Ag7+@5ZkWnGdUPHUH?N#KwkFQNzz`RuQSt2==-6&l zba{jzlD-|QH8nMA8ktAa2T+ltQ51Wb^36+>CG70MpNYdiFX{fev$UKB`-J_|L4=87 zcK>TP9rGw(4As+@UB7A6VFUO~swr0IJuBoO)6}rb`1p9=v--Ei?rLhTf^Rcb8srhw zqHi~R9!Ad%oO>o+gMnSe(L0~ua@km1FiWIvjQUBgeci}G4p(xZ)=TA@M#L&x9v2nP z-I2RD{W_Puy2<6bb4k0y)~`r2t%XX&=LDb=0YX~vuz zBdwr7@Xw3@G$WO2CnrQO!n&z&4L(?EHHcbb3%nj{ZC%#AKCJlWLyw(?b&SL1n)kQ4 zWke-(84dM#NLl9uEX$`CTCvKt!bY#njaUUrDW770+|+ZT^~~R@+Ro%`h9m(3j!;qu z&s42xZ&{HaUTmYclGPe23E$L_OjnD9odXt8xR(99H8+AkoG=^vEz@p zG~H5r*r4E~U7wf#Jp#W%_MFX$HJsdj@y}WB`E1Z?)6WB2&ns+z?-XL=@hO-;f0R}SDv=07Ibzo-AP+dB|v}OBEwTbtr?A`QRk1BLRdgo9O zRzpUS%G^ov!UV?`DHjHn?O=_E87gX^LD5nNUH^EhwV7}w+RU-VN}ZtK6Bb#i)lot6 z9umCsLG&*qw-!zo*6wn603)xmRap5*?WOxtMbny#$X*QeXH%TVU1bCw{OZ@#XXp;t z=HUUkRncdo)&dGiqONyIPDtT>yIONA+U$Gso5f5z{iA!jv?Z>k9tQYUn?()XmXbQ! z@kM9eCq0+v8;-8<0!=u-9deq z<+b+KHvTzUKS;nKWf)kaZI)mnK)lYJukR2%s1_jrXC$$yebE0|LY)S_0OHj+Oljpn z`#ddodI)EOvfWuHzY24Q6=M0EtKwD?$RW5 z&T7Hfp!-jXt40Qxb{~}K=7@BDoO}+!lCir)e;&(~ra{M!Cp|pRoQb014xyxBHAW_C zD5GblY#eFoy|P)?eE=CW7M8{Vr&FLq?dFpmP$AH(l)P$%^on^glknK+STm{Q} zP+`saN z8U;1;G+?S!=w7%6vu#S0)IS%bb@P3mevJEUb09IV-c8%psRoDXV1bLuUWIklzdrPc zYxLPK{w#U}aXhii$?Aixky1t)o^rz?8bqAnr1gbgaz2&Aca)C;=aGfw&RioJ7fSZM4_Q;ktX#pKFrsN_ST07eMh|`P^20o8lG<(-0~`qqJpvu z&FTu2E9?p&eCUAyx895?NsE<(ex64oZJ*6Y^hb2d|E(J+%JAJfZdT#45~PtTNGot} zJig!q<+kEQmPh5$-2wgldQVkZHO`kA^;l_I^coLHR({F!TH=n5jqS91pr8~3LCvYs zq0mP(5tr^;+sumL_E2XxP_x+l%1RC2Z>urXT zJ441u4}HJ`PYDK5m&fulz5jeHry3nTcU-eGDM{<|A# zhtGPv!lh5eUAcv|ayE4brDn&>z@ow(>c063BTo=uqyzaknD{`ddM02cIox`{V|$`1 zl$uhSBQo`9x9})chfCnY=~q2p=WiTvJph~8Q(DhNV#Ze3{`*ERmr1=kDJ1J@GNzG3 zi~}8~7b?FsyFi7yf&0<1X1PB$7kUWEqSJCLnx|R9{H&AEP*S?gX9B%WPX0T0=4To0 zX>^KyZC@z3mP`3VjpG5b%1QN;JUFzF^3};?JE%ximR|_VyvRxx8ilk)sBihejhH^wnraWrol93?mtzh0 zS)ik7!2WT91pZ;Nb2_tx)ysEDRGxeyMjn?gp_&TjvO}eWyE-iRIB7MEGyIgHZ zlkbvijqkuwL0R_cAt(*HP1)SgTPY-qh}LG3$nGG$b?cS`E>e?L@v@nfRR%DbX&CEC zj+^X_I!}0f0X8pE`WgeeZ$!)U-}cFS^yG;)ZxMDgP^QIG8v?268c9^oNK4{LWU2@`c2d1_Je=6%zW-&y}cioeWV%g zf;9MmjH#?OnbK!LD`*Y%#vi_%ZQkD_u+IeKlUNG2F4C#zxdiw?kFW4S&iVVi{PeE* z$AJe{+H(GalarGL6<0(k?$oSHJSL&iE)v{|82f?X=ioz z2!+uPQs<*1M2JrXiRY(`|ls>L%nF&ZiAR% z?^nW(5T1Q7D1)HdM7A4o97Xi?<-bj=UsD>{%D?!cwExp{`}N*i`adsUUi=@uOuqJ? z)?c~Q|7ziVz3}h#KsWFIl$Y0f%px%26E8!8o2G#cct%K?rxzp6^dPM#EaWu#X7p{y z`o2B0eOzDj4lO|;%18zjxYp;q)D)c!Zc3RdIjMy*(AxR(1*+%T#(9rL>nB&TD-g|y zuk^IgxB;^St)d9I3@*W&1;ndf^KFGaZKk4(gEgN_crVuj#YkK(Lj^?f*r@__Z85$? zO<2DK32GH{;?r;5pgY=EN~*hw^skyw0@~F=i>rR}Q|9Oo!`r~>kfiD|1mG()mO#Vm zzSP0s=-FudV!2c|n~+R2kd<>%QeM4pxdvousKZc%HZ?fadaij%YU!PC=wFOQ4QCTH z+7E6>c*&?vBeYdwQrIckP~bFQpY4c{XKnC;!?>;jlgHS?WX(cy3kxAE%o-{L59;R! z6U2TvgH47?CS*ILc5+;!0MBQOm7lN0%bmk_LBJ++#c2yAAP_$ChjC3VTRHaKWtVf1ja%FdS5nwV3yR3ZJ;fj@iKe%w6`Ok$>=-q*68MZ#NcB4(q z1|YqaPY!eph^UzH(!c2Ij0}ZYWBf7ocW*1gihDlJ5y)s{@ z#(MFbu8sLks!PWAI=F=x=ly~pnW7uEaXJuU3UagRUnUH%vQecT@|HRMd1~j8C+*`> zqc_I?>k9xO6vkU{Qo-)9AcMZxF1sxPCbOp51Sfr{$7QN>NJ~ctq;qBHAVHNIAj_rh zW%)}FEAo8m4aTx*ig#$|=I47OC<_N4Avb(=Ga(vHFId>o`U>QbpxawqogAwpj>AWa z4rf$W#(f^j^)`So+S45}l8d)k_sGN7h4WzQV;0g~W35^4<(q{Vx6AJBr}6t9!imTgf)7sp4hIVn8em>RyQxd3 zT^Ag;$an`0U4>Dc+!OdUm_+9;52V3L9(B^h$evYCPiQa+eQC( zgA0_~S}DpGHMXBaWor#55Fmo%K!8&0Y-8JZ64~jI@U33ID!1yaC z8N&__$}6f&79z!XK)C@fmG%y*nIr{6N)T?H0|s=4gK+-CP|=I*a2O$Co%1_a>|P42 z0-!8B(1W5u&lAqj0Dsum?n{O=VQ}zli|(ZzBd(~etv${Z--ZLyS+7GC6wxS|OFk<| zpW3RC><4Ossj_Z6hCp9qTe}HItdSv-`Yy`uf~kK*pS!&>0HjybTdc z^4)@tVlcub9Ir7{r zkmn*B;pxC4QwjAj9oAU^OCiC7H{Hv_?6o(G3mF{J9Ejb$)2p*z6K_fy6a?`OOCM;%n^Kq zgg*iGprfq#R?V1z=j{6UKA$@i2Lds59jP{chbu`EGTW_O<6uNAM*>0EIm-^52M6L6v^kwV@1xD!%aOAm`3NYWF0;oOoT5;ipI z-?r^p!>>ZE7g~7^Ue7Tg z+5ThN4k`(8fvLO`N;$0YNq2MdYKv7J}yjC#9N$qdq{|@hQF4g|NuJ zuc=wUC~`$(H&^0FmT$}#UU+iLFS^5|LH0dNAi7PgUGRk_@?2y6LdD>~M>`nJHdIhf zRe312TV0r)%|kqqH)W-1WtIO#`)ZghMYR)nEDgy7$i1vS{lciV6{<7p{r>Ljz4VaT z<0MOy*A<*7?6}s;g}!$kYQN=zs|SwQj|=;dNv>AsWM_BtTQ{p-qbEHBwLo3^yd~2} zt!awwMSGTDHwGLAOwFMDBrk2x6+X*R!!@xsmdh?Fnw}b2U^ZNS+X|wvw(ncgCsD|7 z1sXw!Hr}m6(FVW@R8g%sGzF3O3w~l4)1!JPzMsUD1OQbn&wqTkZ#T0Oa$VxCySsjL zzT>JuJvU)~RI5=ecrB1`n|Pf7U_vA_C+-4JFBDmcvv{*D8Jo|OqQ#qg=U`^)?5BRA z72cAp#|0GSV@vl4`KwaQDee_yzV&g0Hi#8;ssNy~a4vE^W?fI$Rj)%L_tY6zI_?*m zeuE4BsLmMNqm%{i>1wlkQS5gpNK2=<%Gu zd$hq)@7fBL8L2*w((-@GCK?NeGH|6sOYqr-DEr#1C%mzJs9)f=LAZqq*R!zM3q7xf zbrTTj@(I*!h2}HACD#S5i7vEDwX7xd?3ONnGk31gVV=PKL9@ic(L}XFplNqg*{l9d z9NuYp2*i7l0dlA)2qF~3Nt?JMVRa)ai&z+rmv7h=@{q-vAP7>cn#Bgg+eN#mX`wFZ zn)d4Q1kq3sc>K*#Yh4z9(f`Lwug)Oqjww`&eIsGJAE#FfXILm2@b_wR(56uwdZAJM zBA3#HKVS4FnEE8h#j{$NHg$BazIXrG$9}q6VwsaW0l!XgSYHl|MT0*j$ueIlnQT3w zc}y^Aw5pw!mKL=-E9&1g9rrn-;Bi6Jx!CH{_pgFS%}ZC5%9LC^uj^G@jjtF%yXDUw zK_BxruM~p`7ZP&I7*(Czi#SV-{(na1<^8rbL@}=dqALv*=4YOvU74C zs_9(vf6Kaf_sU(628!B#4t03YEwe00+?Qu7O~~ELor@9o5QfH#-9F+nyXew*nej~P zdk23TkifGLm9BWsq99sW)tTG}<^wZX?7rxv%gWZ>D_3YwxZIYi5N#$o3!No|#OKO2 zVQR8{vxjg>$@R~fPEOa2sHb{@wbb=W&45tUx!DMV=BoD}C@FQxHk{(RT^&%ddt$pd z`5?&ia6MTSDySgeM%q###u$qGwDIU3ICIV~)ZaN>LT7=-<&ps0R0V8(Zavxa`4h_K z5$D)QkJ|N%ECYhR1WtN_rq9cswCd_nv`8k|*H7_02H)S^IeX#qk@#LlW@%{@1Z%ji z%%b~&zaw9(uw8nVJQ`@-fL}Ks`1Xr&FYN8!W!NXDF9GIK=Q|P!@bfE6O4h%0|LNQI zIF#aLZ>HjHc9fL?sxoHD6gjVAM8Ony)8G~I_4PW@e<7FuM<#v$+{XX*B=y4#biD(b zrla`s3&!CqDQRr#@ zb`{>ZoQs0K#qQudm z=T5&dq$3-=-b%uSIL zFijoW#4q_Pc{?NJpJ}kc;wyH9Xs@->4&Yr)vqmgf## zvf@n8j~>D3iEL+LZf5l_icgxR^sKkA>8=%7czPV|O(4KNfa;cJ-G(rR;(YK4o^&uN z4J)e-!dAkXs7N_w=CBJjUz~itHcs1t3!b8JH8TcLZDfzJhC?w#!B_Y6n|o+MdgdUA zN9VSXz<(Xef+Ldhk|`HpL)+zj1aAP6^nP#pdG^4Qo-0gA`L-px2wHvQAPO`%!=Dv~ zBt(qs;80qS-uRq?66EtnV5Xb5p>6@7#uKlOT@QZM}|eLB{>h^g+EHVGxTL`Xmt26^5AcN$th%t`SAHUoby1vW@kU-bVAGAao0 zATquSVLiNq6^Slz+v2KciH`er;Huz}r}r;;T=V?{N$i6gunzF{lck2OAtQh8ienjo{FY#@#ryzkRDY=*Ol8$;D=aZYPy+0;$j0?fvM9>Lg#!Y+^O#_44 zh?eU>6Tic$_6VvpON9C^a>#n1@&AI`p^mp0ZRA+fk5APRSBG}0pKOGC?!LzQyEcDJ zXl`&j#PJB2;Br`U|C-plHr$WmcXTKGnzw2y02a1d);KSImDfu=XKu;}XIhbIHGb4X=f|()-3Y z;LcpY9$db&2py-Agcjq+k#ZT$a}EI>Gw$FkEnEHEC@ByA#RAYraX^78=_EXA=m4^| zzQZIW2$(F2YxfB@6Fw|45qYy+IQvuY%(u=14n7V6?b^o8`*{v$9kF=ZM;k-q-^2jB)E12VC@n@+(ClEYnY7(`O?9UYhlT_2Vq2|sW(OLdW6kG;m_Xc+xNEGx-#A9E z!XWdpXH239U`ZgDZ#U(W#!tx=4=!Ysmfk@!FezpO_Y#-72_;x!;xYBMlrdgDdY~Q^ zFl)AZq|Y+>HsFF}n40&fI7FN%TI>IT^jG$rlm=8y!#meluvPFq?S=cc4JssQP)LOD zpK+);qoN3X*}3%;*!hEBmHiU;B4Z=zau*WYa1LGQ;zj`>Mh#d^9NI7-Fi1wn_Ims@ zJ3cWnNByKSh(r1(4|zZz6ar#pu4op>3TVXfBm*%Z{X6Lcj(`_{J=KCODmf98Z8i}4 z(u^-b?U5>w5+n4U)9%}|ZijLQNDZpH$v5j5?O-A%{RH5WTqX@d6|8zNtn7)m(`5pk%_D zh1GIMf~F8u1+O$r+vz@#zr}Zw;gs!F7d<|Fn$9`i%21*(>M938dg!ANbAD)uVqlTp zPE7Cx^?x|IR{3A_;0_6qXZhuGlPnvJ>$8tvkCdAmxL;J9`EtxO&@HIP-Y2{6I|dTM zww%WwfqS01q?v{o1qRYHAgGhNdNd!?+%Y zCK+z#1+QuNZ1))PImY+wUCT3*%iemYP1|Fx9)fatin$t(`@K9U0AZrsv93wEyM_x; z37d1UnEgrHQMTz;^968$3NGlb2uLJu-ZVp{PvFqHw#!P6j+-x~&t)TkEG^{-e6viN zGH7H%1vMKKB-=wxfvy6H;LWZZnyGo6`JFAd)M6E`T}(9%Ue{$TSa1+#kCmqiVp8@p zzF)HiIo061AA>sMgJufHIp1vdcHvrHFqUDME{ClPPzCx2^h4k+k5$WF{P`{Nez9l* z)PrV+X~U>}6ol3)ART2-ILj9xG(Jv{Eq&18ya{Id5VET`+T;}K}KRI(lm=ZrsD zqmM(Y{`O=r)B5z(=Cz&BZO#dd)lAOG`J#qH2jkn@nf)I3pC4j)Ip`*B%YRYaKv6-^ z`WT5$E~2kXLeZyrc^e!uc7q2VHk2L<=m(&xsJ9Dg%8x)B6m5U?hc<34uqbiV4~nDf z!A}7Y_-z`g!FA!fC(&9i5Ek7}xd4t0K~dIQ_Um!D798Hqmc;nWZe&AgvFL-*Rq44f z_i7hCG4eUL`I)&339PyH=ui)!a|;eEj>3w9UY^-sFf~4kdo01pQ%i&MGMo$m1DWNT z_T$h!m5vJztGx49ao*$Q?SGwk^|~(aTlxNa#OWj%-4`~QqJ~nnUF}OOEKvANA6(cB zSeY>wnkNuNGF0WQf!ms+!iLM7wACSql*qRlYm7A#z8Sxv4p2=#iMiS2y=(*6|F7By zp4H&FVKSvm=1ue&JU{{*5-dZ`D&9zs5g9i_l!qYNt`fqil6FR z^CZ!_w|v&iM_smJ?(klV(4;FH4VgQ6jJg8iV+*P}I)xp9Cf}zO~_eBQ4mWj7|CfXD^NVxkHXtXJmi;d)=pF-Je$Aw*Dq8%G-fYLcU%q|MlN2 z?LWl0p%|huXZ<$k;Jg1Q6(4)X_ALFM-#&KN|Ng)E-T#i4v`9YETV&DC(P~mGCDn(; zN&?8ob2U)EyJS#LhSjkwY>;nKliik|SWW7KD$DQbyFWoiVa)m3>gdzf~b`toxj z+_|adFc$F9NGu2qFHl;ErsCGa^az~I8+Lu)DC*dZPX0}oW!|ppYqqV;M5>zS_wl<7 z^3NX?ntw#uYeQ@8+|_V~Qlnhe68(+X}ngRtl7_VURZ#B7YqlOM2{qY$Cd zm+i@&y?Kq(8|}GF-FXX**g8?$TVhAgC=c3B4)($~w!J1?5_r9YMPAs!N)rb{*Q2MN zOhR5t3KSU9qxC&wkv`;i+V#GadpT?*J_w(Fzi!;RBJ^mfCE{ps#2o1UKGzkIE7Tec z&VrwDb=J6zH;nCkU)0Ey`R>!8-bWtCAua*;2umWn-xSF&V%%8pai!;d&My*gbrB^! zTcd{?!PvCaDWUDCb5lu7#MG+wtuVP`xub`^?0k`N8x^z`>(K>6#inF!u0G*_27{Ma z;JBZ5oalK5{Ad)=jt$tE;Qu{|ra%scf4>k$&-hs%!L$wR?&gB8s9xGo7>f*7i+ij5 ze;BLC6AkHB+byfhy>>Jf-r#k# z7j|+XwyIs{Sz{8fWo(E1j%gR8wn4$u61idpW2#JA>dTr- zpgJQ%Cbsb|TZ%4Gf6TcnNi5C-_o?4@X6H#5_DOpQPcd}gpsWlT{YOI5`g6AYrzHVE zK9)m>)7myQj@{o;ZPEWyqfGv0MkV(HG0Oe7>2lBOE~RuJ8At6k&=zE!N=}v~J6NnS z@E`mzNPov_SPJ1Sk&}bUO|Ma?n6#8sQz%mwwLV69u?*zBDi;c>P)$$&u-JgEOqz|? z-bkf=)3lvj7B+Kl|JNCb3rC0J+qD9}Q1|Wnluu}vS!W<*=|e%=H}|gA9ZGT^Op9q^ ziwl!eVJ)9-y=<##?UH!%0JI{oFt)s#YqpU6jgAV(3OvgH|7SterE`r6u6{(bYZ*_Khg8{p43KHm12NVp9i8V;d#(ecRNT4_Eww` z_2EqDmjm0vCBZwntAc;Lj)=+0Yd$Tba7UX?x^c$d-&Mt6hr(IUPQxc;Z^Yr~vQ#^( z;uabMtEX0GPBV%}W!DK<4(W!Qci2?^PO7VTuXi*pGo^zTl*Zp_#mkszZ+~E%6Xx8) zTecfC6SDN|`E8KTPkGTL^s&Oa+C)TOb#n*I0Y5=iT|CM}S3*y<6t~c7H|a1ab`+8+ z{}h_937Tu$7EeqFx$g^cEX6khH$JXvmJQt!(ZH#8N}3X$#AW=4Dma@X`DN{p=&9K9 z)2Ait*YXJp(FS_WO@eJr0c$M=w!?j&v!a;9rEjrl%%IRQyy97+L>U~I2)I2z+2mz( zZFbk0TD=jn?cTTv2me24@sD#VE%@2$lHGBRuII(Hq1f-RHTdi1E_NN~w`rH2qWP00 zZX~4d=ZD-@~r8Gy^8x45a?PRX`hhT4d;*EzhlAn*bbt z)>0TL9+3oM7h`rHuYa-W&rq>%6t_OtlnJE?kS2cG^nX-`bH(wr#?A2?4?rv%>IOk2 z1G0-5D`-xnSCo{fFXkoz^~o;|Fh3b?LxcbsB_fFg$Ln4b%-zS}D9XI2dhFbkOO=?&j8&jBJu6hWFV= zuKAu!mgPxc*XQQMyl8j%PlEtPMzr3=BhRfN({)fa>h(Bkq_dex_S`jZGwSz9^4y)< zM|3ejcY=VNrsBe$)p>Cwdu~{L)}=I8TzM4WxU(|34{8`c@G#wYkYL;vg^RwW9R-t+ z2qMeXe4vf-!n+@n$E`GBg}lvvt0tNd*Q}knHy}0MT8O!xwU_jdZpIC9ZkI`^!!Z47 z{S_Kee26omsThImA-uGQo3*8AaZqfE@3O34xDhw&v7tF<K;p*!6OBt0Ak<+-{{ zb}H@4L-(gVblq?pl$AI7HnLrF8?{LF$4$x>vkBKYBYZV*7#ydN!e}4wwI z5B4l&F1*D~g7ezJbEz7Eq@%GM%zBY{{pV|0s{Iva<<@N2E;R34j;*`xy=9Yu~8VFSAY*Gy$=YxNVY6d+}uI zrhkMxVEhoj!8oEa62EV=S==KecsMTvE{t`ngh;i~y!2A$B1nQ5>I+#VL~|evr=lk} z>(Ds4`kfqn1Wb*uhdC*9j9F2qgh(yiKrDnyo>2UhvCp!_oPSs%dAUnzoHfgJ^1FAO zkznoGHoa!&8CNfYD4M`ud8WNJd+5$4#$G;k2i8Bku&@hZ zG=UsS?+^b=4cV`{ybjkL7JuGuo6i0C5mX22WLUyvK~irZSpH?ojnIo%=9vzl4KwE} zv4533%*_1Dbc4W={CVqmS*e5d&)aogjcC1@y)k@1Na4`!qqVODy%9=#iAOevC1nk4 zo}=Ny5FS+O^@GQ-*qZ#bP50I`JuM4i_IZ{^A8x10t-6AJp6l2qYC^O|m=Ajd6jjv; zPkK0Ub?&_VIs$sdKVvZ=Ue$PuumSy}6wUBL#NWIgVO3$aKOFkB$hAK1k!!z>xDPr8`sw*ZTd$+_rCVs5*d%za|z9M0-PgS83{|C3zGA{g>FotkU+|_td)-i%~-oLo6PT8Y+x5Tx!z|{ z2UnS{U$R-3Yg>`v-u71<{P)K%dZE#B>CEOhYPagy1JaR2aRU>ethTQeD~gwP7u%q~ zts_Rf9wADNgPIT$UYI7iO4FBl9eFa(Gm#+E6Nby}(r6+D0bVf-a&JGK5t4KhgR@^3 zh$Ln~R|)dcfgi@8QUo#cgBZX_#QlL5kD=@VoC2`W(l6RfioZZSGq$qu;!f^Rs2`LG zpv}xlllcO)gEqdNB>PFEIsn2+>goqLo6Y(DFAj4m$UKV43)^DuTYgEVX&&|!^q}LC z_KV^bDDd^dG#P$7yr^!G;i-Jxs)3bqKsYQAW~V_T>Brd%jQ&@Ag-ko?A%42pwBkq7 zIRfJ*&A*R*Ha?F`$N2)cgoIY$9sy#PT*ax_0CG>OmWK-Oca7@uq`8 zFo<4_l#&~$XfM&P5%fI?#^hAw<~~2;BY|iIb4B|`IZX&RqccEH?6JB!rP#p+)D;f$ zTW^GFOs*qJFv!hAarjwfZGEOfJTcZ9QG=1G>Qr&WQ9fW$)pb3^@P~HS@sy9llpV~H za{1jH!X%*xbtb7k{mBU!*<_tvSKS3OqaH;@;`OBw?C5ZNH3z$1uHi{0+OeK~m!PlGD^N#J5O!U=hQPx%e!U?Z zw!Uzsw=RMkarCg8Nc2M{h(~W~{1TwOWBFq~Mw_$Id`lf@hgDjG+I7F`Cagp!CKMmo zY*t&&9W2?SAX<6DyT~_UulO(VP+etTDdF(#7INf|-`(7`eJTQjy4NCQwa?Yqt>H2! zpC;}dSRbq$+;1;fMU=i$Ds)_n9wq6m?)ry1;JOuKFO$x%7%8TW?Pa%qkT-Sj^#7Z5 z7%MiUF;tZH7@=apJNCd~HD3ePAp~LCfjc!59wDVnOZ@VhGF?KuXh+v?JX{;)m$D>! z6jI(HF%*yvWlHf0lf_#<=9C;JRzL0CR${n_Y5Qx3vc+-mIl-5C7uuW4&9#-;|ea*{o;Ha7?0NY3Stb+E0G0|#3Z(Pw9iZu4&?@O6o@eE$gvP|f~Y z+ZU^mJGvQLxM=-Mh^qa%ay1JxVeE}x7vM%gn@b9U9N-(~T$a8?mZM+iDR%4Wm*xQ; z%Uqrc<+s?!i;ov!8~O=tIo*Vfhh0f^oASRQmDEOZC!s810)`v(%O8Jtu0XpSbC99O@vMk z2Spv^F=q8s9}o3ucw*euh#{aK-tS-F{;f%Foq(xW`qmKSMo>&Rlu9r8h`GryC!G5q zvSPB}f&af`Mevqv11ENx+zU!6eHK9=?{~8E<-(bQsMv4xB!<3!lNFD4epcL2OBlph z1<$(3ObF_#4c#_!m}qf*A}>_P!Sv{S2I1$tt5e;k!8hB2c+`Ny!5ffXs+9YZxM1aw z5J`7Kzu@v%>J(v4K(TgotB^7#V5lSt7Z;wK3z<&paKizc<_RGoW;f#c{xR z$O6LzB5L9lQv2Ch z{%R|V^_>|!gXGdcgf$Gi=d{0LxBHFE^R7OjRrAN=!>XmqN2;y@!%eM_VQ1!yLIS;e zu| z|4fwo9zy*69j}n}f4PU^3mnYzHh=Eyo>LYvZVGX?uI}X}J0EFZp(4JpySm}EMcZWh z&Fa$J(S(!d&rb=gLd1V_4~q+!3NL$qvcNyo&Od^W9Aq%AE z_c>mr`l)ZDaM-nX;NUBZ(~LKjx`wO9S^cB)V}%ePZY(ZjIp9Xkr^k6z+iT375K|rg z^bVYht4KOqesr3}n&loN!^ijTHs|NSBpCbw>xQ*N*cn*B-2J#<%s5aDc`FnXQw^sb zg!w652@}AuL3tfwlw&7bRY5M=xEi*P0Yd+wrZhp(Qcgbce%M#{P6tF6^TUWBGNP8O zIMa4XN%X2)FfQO4*}3S|ZgiUd`FB|i%_K6QihZiB0pcSNbL?HiwVA`#Mq0>H*D|v} zMc0qf<=1g?aV2eAP>=kZ*Tq4K&{Ynk4t3PkuluyDd%=9~&p}iib;YJ#RP}`Xf~==e z?N1`1-Te?^uehCMm`!>2{CSgNt)6C6r~jvF({DoTtf_q#*GO%Y4xP7Yg^uhE1}{W0CXMe-MJqULDe5knlI=H%*v z%^`{7zM~-bQ4{4CLmv?I%^_my|6>$208wyX`a@l1-I8CW{%YI%B2&(j9i3tjHY0VF zBCD3J2~NSq!Fk#}I0H7dUX5FQuedd%E!Q0P3=Rq@ZOf6szconfO?WI4P}|h>UF{Wn zm$E}grRkqCVw5DDZY5P*e&e}L3Y1Q-uI3)sIfvo1EoR+E0*Xk`Maz13-_=aL)79!d z@}0CRGrU3&CZ(p9LYzJe$}wjODAsG|?Vmxl_)y<{`_izqTch2+=@X*sLzVBun*Xob z&ORKn6jyryiUW6iPAR1n5gkGJZ9$H*!}NZ=Z|w;=eeHi`Rjh}-+kTB{XEZo{eIuy z=Vzs_8P*^Am7g9}7ggT*43l5G;mlW?a%?!dwhuHMTBXRX8M;@>SsKN+qr|jIyW|k^ z6=U*MU#x}Y@2{B&=S-a%qnhi(GzT-Gt@ag$Crg6fBV-B^Cl>uC746V)sJDGaCg;UB zDiCZrY|hZHW)}h)oRKWsxXd;~?*VPw(<(vnVGp9}x93eUVSBI{qJ1Adgq!MKLI%!C zKNq2I>656+t+(UHF5S8ZMbUX@L<#VIoc(#}$?3l}}>ycsRfUx>$exM_Mqz zM}>&5TpQWdmE73WLCr1?_Pn**6s2yZ$#WKYXd3VPbI7?8!WH%5em7_G6JkF(!=x}f7#)KT+c4F+Tn%ZU* z((Oo~d?dl~CcC3CiLr%cQg?6LKU`es=*J`Y93$XjzfK|aNsNTjWo?rmX8Du&eeSt% z`N=7K`UlxkUyQ8>v_98D3QYUg=?VM3T zBAT{c{M!o8+;)!&y|#qpnI=j5a8zO0-j%~M5PF6U#BhYDhbaZap_U)0) zVd3F^by1|K%xag}an8mW;G%f5Boje&yZW)c(awlEB2;xbt096-i*=mK#Dws!;Bh!! z!d$ZYJnL-I%BLjN$J$nn0rSMMBObN|E0~iXdg3cv{R2FpaYrOq`(1;4^W*0wtbzqo zIomgMA#D%Yz~y!!^F#@U2PN8*e?kz57-8!lF@w1bJz@5EYZW}8IfLHK61#CpWyGV4{NDRH88gDY7sp&E472M7DM32X& z43OO!qRz&hsn!#GubSO`lI81Vx%X?dIEy`2UNy!I0_c2S2prCQBJBm75iBGtSAaD0 zv@&?L+EYO8ng?E(zIaf$wjZ!X@qn2~|9NATFJ(Y1uD%m%8%G(e@{<4#D)Brg;@;tc zSZqqlP`F9dXAQuGkH_Kchs+3V&I6RIQ;|sr(LGV1gbhKt(qbLXTFLR$nBKmJS2kbQ zl|H;Om3n%4M296<44v4Uj33m2+0Q5i@3G=+qs;;N+^rbv|T55dj zF3IrSiuH}i$$s|HYxZM72(_)&tDRw&KxeQ~VmZx5St~PVZHN6JFDg>?3v=K`7gf$9 zyDmH3B$3=uYR;hU`)b&Za~gX_ve?TSlBtTMJ?*M8m*w$;2U1t6i4=t6Q2MtPB)3g# zfX{L4MRU`2erAW#6SWq{Bi;O~X6bRg_4wsC)IaNB=LM|argqFSV;!J*f9R?x?ai5) z^<2KMUH&9+{)dKtRU!=d`R;HqF7nEsaB^NW<$I)rX9xrgAx;HkXJeu@d?-l~F@EF=9PSLPFpw5( zij>J@<#^++e@R-eB|6=xI8NP-JlAxJTvi4I?fyWl)`+tYf5;1h6%L(i0%s%01LD5= z{JFud`1&bYFpo9Npb?lKZJMpT=#rY?+NG}j2*g8gvq3IBQBV^IgKhhTsGcL5if)~{&3yV9w-3?YqP3Jf`d<6;Q38u*3e)P{zdHdvV$biQqH}`TS zcppE%T9n0HLQGuT3!QE6WoasPwh#lQhqnK7|4o_pWmb68sA0i-avW z&jDZ3H%=*t1MP?!U_uIZF#w!{%zxI^jePS*Tb_aMZJ|5P$W9IzXb)T!X!lyu4S297C*zO<&z?Oy z%wHQo#MkOZ`nImKnaE8&1$Y_Ra3Sfl=C5=?(DxmUk(h=a4U)IngrB82J5fL`F8)-o zMZN0V+o4~W<>|ub%X$0P-VSUZn4XCIC17fVAw6OEJj#yv&P5iP_3892Dwi8n*c}Z9 z0>DlfE2%@3EBmR^$J)>dFgJrgcg2lIqRqmLS>zid|#|B$5_{NfHCH86$LjD~V0 zPhU!P?EF+dJ3JnR0B%xgnM?XqZfM@n;!qZqY6_Zx#t5uGE!cI>dNtDF8IMD~vIWBW nGV7StZUTth)ngd(Up@>fwHJ6kahUITb+swd-PetNG$P~Q=Q74x diff --git a/windows/keep-secure/machines-view-windows-advanced-threat-protection.md b/windows/keep-secure/machines-view-windows-advanced-threat-protection.md index 707b3e172b..8064546362 100644 --- a/windows/keep-secure/machines-view-windows-advanced-threat-protection.md +++ b/windows/keep-secure/machines-view-windows-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- title: Investigate machines in the Windows Defender ATP Machines view description: Investigate affected machines in your network by reviewing alerts, network connection information, and service health on the Machines view. -keywords: machines, endpoints, machine, endpoint, alerts queue, alerts, machine name, domain, last seen, internal IP, active alerts, active threats, threat category, filter, sort, review alerts, network, connection, malware, type, password stealer, ransomware, exploit, threat, low severity +keywords: machines, endpoints, machine, endpoint, alerts queue, alerts, machine name, domain, last seen, internal IP, active alerts, active malware detections, threat category, filter, sort, review alerts, network, connection, malware, type, password stealer, ransomware, exploit, threat, low severity search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy @@ -14,7 +14,7 @@ ms.sitesec: library [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -The **Machines view** shows a list of the machines in your network, the corresponding number of active alerts for each machine categorized by alert severity levels, and the number of threats. This view allows you to identify machines with the highest risk at a glance, and keep track of all the machines that are reporting telemetry in your network. +The **Machines view** shows a list of the machines in your network, the corresponding number of active alerts for each machine categorized by alert severity levels, and the number of active malware detections. This view allows you to identify machines with the highest risk at a glance, and keep track of all the machines that are reporting telemetry in your network. Use the Machines view in these two main scenarios: @@ -30,7 +30,7 @@ The Machines view contains the following columns: - **Last seen** - when the machine last reported telemetry - **Internal IP** - the local internal Internet Protocol (IP) address of the machine - **Active Alerts** - the number of alerts reported by the machine by severity -- **Active malware detections** - the number of active threats reported by the machine +- **Active malware detections** - the number of active malware detections reported by the machine > **Note**  The **Active alerts** and **Active malware detections** filter column will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/en-us/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product. @@ -38,7 +38,7 @@ Click any column header to sort the view in ascending or descending order. ![Screenshot of the Machines view on the portal](images/machines-view.png) -You can sort the **Machines view** by **Machine name**, **Last seen**, **IP**, **Alerts**, and **Active threats**. Scroll down the **Machines view** to see additional machines. +You can sort the **Machines view** by **Machine name**, **Last seen**, **IP**, **Active Alerts**, and **Active malware detections**. Scroll down the **Machines view** to see additional machines. The view contains two filters: time and threat category. @@ -60,7 +60,7 @@ The threat category filter lets you filter the view by the following categories: - Threat - Low severity -See the [Investigate machines with active alerts](dashboard-windows-advanced-threat-protection.md#investigate-machines-with-active-threats) topic for a description of each category. +See the [Investigate machines with active alerts](dashboard-windows-advanced-threat-protection.md#investigate-machines-with-active-malware-detections) topic for a description of each category. You can also download a full list of all the machines in your organization, in CSV format. Click the **Manage Alert** menu icon ![The menu icon looks like three periods stacked on top of each other](images/menu-icon.png) to download the entire list as a CSV file. From b593977f6abd78b636df23db8903786ef4cfb27b Mon Sep 17 00:00:00 2001 From: jcaparas Date: Fri, 22 Apr 2016 19:29:38 +1000 Subject: [PATCH 068/439] Create investigate-files-windows-defender-advanced-threat-protection.md --- ...ows-defender-advanced-threat-protection.md | 38 +++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md diff --git a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md new file mode 100644 index 0000000000..0973daa63f --- /dev/null +++ b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md @@ -0,0 +1,38 @@ +--- +title: Investigate Windows Defender Advanced Threat Protection files +description: Use the investigation options to get details on files associated with alerts, behaviours, or events. +keywords: investigate, investigation, files, malicious activity, attack motivation +search.product: eADQiWindows 10XVcnh +ms.prod: W10 +ms.mktglfcycl: deploy +ms.sitesec: library +author: mjcaparas +--- +## Investigate a file +Investigate the details of a file associated with a specific alert, behavior, or event to help determine if the file exhibits malicious activities, identify the attack motivation, and understand the potential scope of the breach. + +You can get information from the following sections in the file view: + +- File details +- Deep analysis +- File in organization +- Observed in organization + +The file details section shows attributes of the file such as its MD5 hash or number and its prevalence worldwide. + +The **Deep analysis** section provides the option of submitting a file for deep analysis to gain detailed visibility on observed suspicious behaviors, and associated artifacts. For more information on submitting files for deep analysis, see the **Deep analysis** topic. + +The **File in organization** section provides details on the prevalence of the file and the name observed in the organization. + +The **Observed in organization** section provides a chronological view on the events and associated alerts that were observed on the file. + +You'll see a list of machines associated with the file and a description of the action taken by the file. + +**Investigate a file** + +1. Select the file you want to investigate. You can select a file from any of the following views or use the Search box: + - Alerts - click the file links from the **Description** or **Details** in the Alert timeline + - Machines view - click the file links in the **Description** or **Details** columns in the **Observed on machine** section + - Search box - select **File** from the drop-down menu and enter the file name +2. View the file details. +3. Use the search filters to define the search criteria. You can also use the timeline search box to further filter displayed search results. From 8e82efc3caa1056504a70e67998daa0cead5f6ae Mon Sep 17 00:00:00 2001 From: jcaparas Date: Fri, 22 Apr 2016 19:33:32 +1000 Subject: [PATCH 069/439] Create investigate-ip-windows-defender-advanced-threat-protection.md --- ...ows-defender-advanced-threat-protection.md | 41 +++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md diff --git a/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md new file mode 100644 index 0000000000..1449010c23 --- /dev/null +++ b/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md @@ -0,0 +1,41 @@ +--- +title: Investigate Windows Defender Advanced Threat Protection IP address +description: Use the investigation options to examine possible communication between machines and external IP addresses. +keywords: investigate, investigation, IP address +search.product: eADQiWindows 10XVcnh +ms.prod: W10 +ms.mktglfcycl: deploy +ms.sitesec: library +author: mjcaparas +--- +# Investigate an IP address + +Examine possible communication between your machines and external internet protocol (IP) addresses. + +Identifying all machines in the organization that communicated with a suspected or known malicious IP address, such as Command and Control (C2) servers, helps determine the potential scope of breach, associated files, and infected machines. + +You can information from the following sections in the IP address view: + +- IP address details +- IP in organization +- Communication with IP from organization + +The IP address details section shows attributes of the IP address such as its ASN and its reverse IPs. + +The **IP in organization** section provides details on the prevalence of the IP address in the organization. + +The **Communication with IP in organization** section provides a chronological view on the events and associated alerts that were observed on the IP address. + +**Investigate an external IP:** + +1. Select **IP** from the **Search bar** drop-down menu. +2. Enter the IP address in the **Search** field. +3. Click the search icon or press **Enter**. + +Details about the IP address are displayed, including: registration details (if available), reverse IPs (for example, domains), prevalence of machines in the organization that communicated with this IP Address (during selectable time period), and the machines in the organization that were observed communicating with this IP address. + +> **Note**  Search results will only be returned for IP addresses observed in communication with machines in the organization. + +Use the search filters to define the search criteria. You can also use the timeline search box to filter the displayed results of all machines in the organization observed communicating with the IP address, the file associated with the communication and the last date observed. + +Clicking any of the machine names will take you to that machine's view, where you can continue investigate reported alerts, behaviors, and events. From be13f9fe46d65bcb800bb89fb10290ffb99fe07d Mon Sep 17 00:00:00 2001 From: jcaparas Date: Fri, 22 Apr 2016 19:34:06 +1000 Subject: [PATCH 070/439] Update investigate-files-windows-defender-advanced-threat-protection.md --- ...stigate-files-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md index 0973daa63f..71806ff99b 100644 --- a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library author: mjcaparas --- -## Investigate a file +# Investigate a file Investigate the details of a file associated with a specific alert, behavior, or event to help determine if the file exhibits malicious activities, identify the attack motivation, and understand the potential scope of the breach. You can get information from the following sections in the file view: From d58fa501550c678f1a0f2a4e63d31833ff9ae9fd Mon Sep 17 00:00:00 2001 From: jcaparas Date: Fri, 22 Apr 2016 19:36:11 +1000 Subject: [PATCH 071/439] Create investigate-domain-windows-defender-advanced-threat-protection.md --- ...ows-defender-advanced-threat-protection.md | 33 +++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md diff --git a/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md new file mode 100644 index 0000000000..5409e63362 --- /dev/null +++ b/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md @@ -0,0 +1,33 @@ +--- +title: Investigate Windows Defender Advanced Threat Protection domains +description: Use the investigation options to see if machines and servers have been communicating with malicious domains. +search.product: eADQiWindows 10XVcnh +ms.prod: W10 +ms.mktglfcycl: deploy +ms.sitesec: library +author: mjcaparas +--- +# Investigate a domain + +Investigate a domain to see if machines and servers in your enterprise network have been communicating with a known malicious domain. + +You can see information from the following sections in the URL view: + +- URL details +- URL in organization +- Prevalence in organization +- Communication with URL from organization + +The URL address details section shows attributes of the URL such as its contacts and nameservers. + +The **URL in organization** section provides details on the prevalence of the URL in the organization. + +The **Communication with URL in organization** section provides a chronological view on the events and associated alerts that were observed on the URL. + +**Investigate a domain:** + +1. Select **URL** from the **Search bar** drop-down menu. +2. Enter the URL in the **Search** field. +3. Click the search icon or press **Enter**. Details about the URL are displayed. Note: search results will only be returned for URLs observed in communications from machines in the organization. +4. Use the search filters to define the search criteria. You can also use the timeline search box to filter the displayed results of all machines in the organization observed communicating with the URL, the file associated with the communication and the last date observed. +5. Clicking any of the machine names will take you to that machine's view, where you can continue investigate reported alerts, behaviors, and events. From 441dd021baab2c1593b8e0e20cf6812face70f7b Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 22 Apr 2016 19:19:05 +1000 Subject: [PATCH 072/439] incorporate SME feedback --- ...oard-windows-advanced-threat-protection.md | 17 ++-- windows/keep-secure/images/alert-details.png | Bin 0 -> 73309 bytes windows/keep-secure/images/timeline.png | Bin 40450 -> 58938 bytes ...erts-windows-advanced-threat-protection.md | 87 ++++-------------- ...view-windows-advanced-threat-protection.md | 71 ++++++++++++++ ...ows-defender-advanced-threat-protection.md | 23 +---- 6 files changed, 101 insertions(+), 97 deletions(-) create mode 100644 windows/keep-secure/images/alert-details.png diff --git a/windows/keep-secure/dashboard-windows-advanced-threat-protection.md b/windows/keep-secure/dashboard-windows-advanced-threat-protection.md index 76131653e2..4d1a0d3572 100644 --- a/windows/keep-secure/dashboard-windows-advanced-threat-protection.md +++ b/windows/keep-secure/dashboard-windows-advanced-threat-protection.md @@ -17,17 +17,18 @@ ms.sitesec: library The **Dashboard** displays a snapshot of: - The latest active alerts on your network +- Machines reporting - Top machines with active alerts -- Alert trends -- Alert mapping -- Machines reporting - The overall status of Windows Defender ATP for the past 30 days +- Machines with active malware detections You can explore and investigate alerts and machines to quickly determine if, where, and when suspicious activities occurred in your network to help you understand the context they appeared in. From the **Dashboard** you will see aggregated events to facilitate the identification of significant events or behaviors on a machine. You can also drill down into granular events and low-level indicators. -## View ATP alerts +It also has clickable tiles that give visual cues on the overall health status of your organization. Each tile opens a detailed view of the corresponding overview. + +## ATP alerts You can view the overall number of active ATP alerts from the last 30 days in your network from the **ATP alerts** tile. Alerts are grouped into **New** and **In progress**. ![Click on each slice or severity to see a list of alerts from the past 30 days](images/atp.png) @@ -38,7 +39,7 @@ See the [View and organize the Windows Defender Advanced Threat Protection Alert The **Latest ATP alerts** section includes the latest active alerts in your network. Each row includes an alert severity category and a short description of the alert. Click an alert to see its detailed view, or **Alerts queue** at the top of the list to go directly to the Alerts queue. See the [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-advanced-threat-protection.md) and [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-advanced-threat-protection.md) topics for more information. -## View machines at risk +## Machines at risk This tile shows you a list of machines with the highest number of active alerts. The total number of alerts for each machine is shown in a circle next to the machine name, and then further categorized by severity levels at the far end of the tile (hover over each severity bar to its label). ![The Machines at risk tile shows a list of machines with the highest number of alerts, and a breakdown of the severity of the alerts](images/machines-at-risk.png) @@ -47,17 +48,17 @@ Click the name of the machine to see details about that machine. See the [Invest You can also click **Machines view** at the top of the tile to go directly to the **Machines view**, sorted by the number of active alerts. See the [Investigate machines in the Windows Defender Advanced Threat Protection Machines view](machines-view-windows-advanced-threat-protection.md) topic for more information. -## Keep track of the overall status of your network +## Status The **Status** tile informs you if the service is active and running and the specific number of machines (endpoints) reporting to Windows Defender ATP. ![The Status tile shows an overall indicator of the service and the total number of machines reporting to the service](images/status-tile.png) -## See total number of reporting machines +## Machines reporting The **Machines reporting** tile shows a bar graph that represents the number of machines reporting alerts daily. Hover over individual bars on the graph to see the exact number of machines reporting in each day. ![The Machines reporting tile shows the number of machines reporting each day for the past 30 days](images/machines-reporting-tile.png) -## Investigate machines with active malware detections +## Machines with active malware detections The **Active malware** tile will only appear if your endpoints are using Windows Defender. Active malware is defined as threats that are actively executing at the time of detection. diff --git a/windows/keep-secure/images/alert-details.png b/windows/keep-secure/images/alert-details.png new file mode 100644 index 0000000000000000000000000000000000000000..4db0f4692d9dc757280714e74b7fd718e3c6966f GIT binary patch literal 73309 zcmcG$2T)V}7cCmgCl-pJB2pC#ib(HO1wo|>2uKMc(tGd0N)Z7O=}klkh%}KBx&%bJ z7$6`WOb|i{Js|Dv`2GKP=FQxB_uc#EF;Vg4{o8x(wbo9!j+Pq3VfMoa1cKq# zO%+`PVjmg)U=JREEng>Q@4`QaTyNg%($GR`%jL8{=F#)k%BDvDi1hkZ zgxy8l)8?_iqiQgFz{a6@2Cj&< zvdozrxsP66 z6wGvbz`P7~*kis&v(vit5bwV~v$8^%pUkKK^S=Pc&&Qbm{&-!I{23nh_owPO2U+Fc zAF~&c-v93UPOw>3?%!SSBs|F4u0MYGpK~nX`CO5t+viwh;$2Gz1wIYVl{^c&Vv&BH z_L{1lkvXqsN685LvKMi2C-AF>pYM&2k2fy#VPOg1Kf79Gk<>knl^fg8l3)3*Y{;kk zpZDZ0>%$?7@I@HzE+c^ucZ|TUriRA2gZbu92_H^!mG2_&kD1S8ABsP|T1#4Tgm9K; z(_8`-zatdxW>(~U6iAvqbWI;Gv6j7h;?&w zvwTcpxkHSPGiCl$X{iVArkfnyzo&rw+-F-)h&Ng2iAEh?US1v;9aSup=Bn1`f8L%T zWKOpI_idOlOIupiuWo0*CCQ>FR1{P5gPvvYp`oGm6|_<$ne4P4sAyUjcnXWfej~Vt ztiq=@Ffe%4X?-V8AHi9p9lX0u-G}frOJHJ{uUXcT-(JB<2doKPxNzZUq^d$obABkd z|3UNJKlmP7@rB6ZMeLfc~R4at~6TKmP|)hxc@i*tAhxJ|(~LE7qOI zC17Z1fiHN8FJ!%DeKNvUoL$tp$M*Qx<|y@{P^l4$*l`M5j*K#_be-7S-`~H`tEW8? zZ{oZMaW3{&;BRFf_m{!EF;~UeS3PS^3L%@$M$7YJmAqz;tE#CD8Sh&1Y$kTdCFfkj zd(qB!eQR1NIy?J3Lb#*;J3syM&d#5rUE}n2)vU*lAMg3K?APM)mb>EH6k03olS1?p zv-Cru*n^?iE4WvGBdyR)Gdd?HC;9BzvrEfC)De8(!WX(Lq$`4g?EMasDV==jzKx%D z{`~P@uG^e<=<4WT>*qRk$__Q}k>Q}Fsd=j01$HV5BwX(N^5t5)q?ni({PKlpShsXS z-N;^gw&Z1Wbj3?*Z?FC`mS@M+BPeL3xM*{}x|<~@Nt)OlH182_h5YfQbzs0~`3oJ- z8@nHlk||SDQ=Lq~>)0#NYQHIz3bWC!MaA{;r=2k|%-AXti4@{-f3$mjz4H7>T9`*| zW#z>Lg~g_0oh2nDMED3cGDY4bAwfY|;t{V}?6Z=}%7Ge6-KM~zmJ`8?{su%csM$C6nEtH%uBq4%l%G9TH4n4zD3In zXGceebUMef1mTTMlh1$hgxMJ5wj7x{7OWH!8oHR&9r)F&76RST*?ICQ&(>Q)wXOII zIZ6#qw8Tu9?eoWgiN=3m5xm#EG_*~Nt?OAmj|xd4glyeIF*ow`S6;s#lHTj z?a7n%zhyN>G&*|gi;KtYwy$T7`xka%8-+|OAL*gB1`9LV3BU69JO4a1b;Nvq@90X7 zlpl%@Wpi+FSXy3ND|brY^C&YjQ<D1KnhE9GTePkYFu0Ta0 zB~n$?^~^`Dt+zTlJ7vDALn8T_P`7e^ZhroqaX}mP&7J|th4PAu#cyY$$73_L-k+Jn zzJGem4DUAc(b4qj19Av`{LAg^_dKjq88#^-(1yBHfE(0mLL5&ausUi2cQ~q9BHbFW3mU zPo-Aee^d245n!c2y3G&EsAS#QzjqJ(jd!h;?N}`TR8#X(8?_Xx7G-id?sl^XgENM} zDi0Nmk0r#=dAfZ*^TgkEGLjfIY^wyB^3$LIYL^ildhWXR2mCoD8pI)LIXA=*Lj}5nZGA;>O19g{(Su|ik_Z+ z{4pJOaUgzdOeoZlr+LI@EE1jW-{zGDIq>Rf*Iz+#)zC*h<57TV~jxKAHSJ&1axVUsL zZk|N?ep%R=29EpV2PET+r(Fhlr(h{(vyz?d>ZmHn|!t6rn4 zg+6|aN-3SZ8QmuAb;&svUS54A2_|K=wUGcj0RMEY2CePvplFpU+z*bbN(J z%|;-1w*r+D;K!Nah?7FHif^E<(~_5h#Bg`ILPSr`9Sv=5j;Om(92Xk)Rgwy;1xS3c zw`dzD>uYNnG;yyqE-;Yli4sL$vegslTgJ55^7Ie8_~TN9Wn}EaGyI*?x~?f^w8UyF zhC50++^T;lYB#V;+3KR)htI}>_LPlGPv^#ao}&S*cMfATWH)2=FUb12WHt=zmbT-k z^g>c%Mn($+7FC1X!Isf}rtR@nM8DKf0 z@E-9A32qxpRy33&8n_s1OI!y`8n_r?-lV6k@Z7{1^AGLN7>{XzY5#x#4kq~p1bgHG zI4!HhvkeYx#PvN5d3tDJSy}tUS3NVFjxH`!5Z&eP$Dq^_CZdz4Z=?d~aU&H}7%vI@ z8;R!fQvXHCzaM&e`pW;^%*^b?_`inCX@3`GSgv|WkJi69vp0LdmXCHPd3k4b|EEa2 zw-agLA4sZh;bQuCzjqv?3SXqy6$9))?`t5Y1ZPjhU}9>DHahyE_WpY=ULw_u9*oid z&&U0Lf$;y&PB)ESU}e0;ty`JL1v5IS>Er2M0iPBB?0O~w@fR#o>vy-~DSd=I{aKYM z)m}2>@Y~t1w^B7O#IzF%k`vjgPm%~PA(*)N-l@bq1;>2^Xn9gn#xV( zt>ug>1BH5W=h8>EBn4}iN8AUi>oHL_QuUFmV>{z9Q<5uvLQ`Gl z0h@8YTYaMa!JAJHDy+NhN0AiPmoPq@emp8Fp(mnS0GJ~X1ou-7Um^`ljP@hew^2hW zDX>U8J2eqkFT`HskGl?Fx)v$*k*}_FNRTz6HAT)VW7d8AZ3*V{=ZE2;Vb#zB{rs7H zK1$2tgH)8aR3v<6clRIeTeIGoItPy&SzFbVO;ZIh^(^J)Iblgj?>_b>Xh{G>R|al~ z^2fa(1eDb1=J`ftZCv22e4V2;V>?<`Q9(_1*!muMKIZ1zq9X1182n{3JYl!T_H&kn zk1T_P=DtT9RdYrrCb5vwYbilR4p|EKaegmhGKiYl+uF8e$?h}`N*10_paRhR$0ZA7q)&h@3)cs z&UboNm#Tfcn>*CWGRg~{A(ZTun4725v^e4+IXo;KjCz*QY0Vt2@=NK?0<8FURCKIg z@StOV*-_6U=#kI2&apT(7jVsZ8n1oyi|e!=8VxBl8+2raHVmL#Sn~r>rFp<#rh**o zi~KQaZ3I!#BzkKbn>~ojmoK|lV=yvs8`Y;MD>FFvG~K*&E-Z$Ih79e^ij#}d(7y_} zX`f>eo%d$&MhknHsg)VWxe2gFh%!FOu}e%ziESxD;(2R~3#>5)(C_lb99*MPuT0$F zWge1Fe-DuK3@4-Ig9m#jTnCo41)#5bGcBy9re>A=Q1n#O0};rH@QG5Df|01{-u$}- z1}?u-=BFMS);CSjQBNo5wAK$XOsQtsu>;!V42Uk0f(qK+-p<9atg4QUUHV{Hd${%C zkHxW7qB>7yzSYz1ed!{} zV|nO>X|+s_-B~TPMW}w~O4L{+YL}yMND=PH&gOF^clxP{wTz~`As4vil+CdSo{u|R zs`a}JTb~!@odcGIEEjX+7NUgYUp54&?Lj1D1ThAWEUU-6YVF=;6Pnw~x5E77*o{Sd z7jONkU~AM%$S>LxX4P_QIFZ}1`_=E~I4`d0?u_Y9j-Epw4Dy#Q@MmOEApYCg57^R<(I2qdIeAvMrVt%v>NYegzjQO`KHK5voYBhSA3ZRs zgvU`AgPU)DfQa)W=b!y}J@cqmhN9D<&0@P;k}Pq0`VO=bXB&H&6`LP0LzW3wp`G)< z@Nm=cFehRl=j32O_gU@M`Wr6Z^OJ&sLcy1IN_O@l-cFwoYCdaOgbg*^Vb~Pf;@g?b zNN?VyZf9Jru0M&1s2NQY`_<$ojs~Z^;*vq>i zhUry@es0$$qE=4nQw67DO7MdrZds({mXj&F4hNK+jS0&Py~?1ie_QC28Rw){qn-h?flCp9M&eOkM zV)Vu$woeF2S5$xqvR0X?)QI z8LsxmiVR&2cE{ubau;O{*`HUcOSxc zYBP5Id36_C|6QsFCtQcdiDDb?J5&(@70+`bU| zrN5u`(Np}14(zX@GCCgoYt<|Z-*2Se-&$xK02?^R#PoDY@j2j#KXzM|3}hm?s=1{l z)+8k*1+cFyOA-a5ACx4TjzV2v3wp1}xm=b02XP}!No53OYkRP|y862p*W;@VI;?W5 zpYxgSJbvmvId5RJcdKV)H8Li3b2Yb z+4%YzDK6A<%m4YEwVn{XadQ9DYc0Wug>6dkn4T}>P+!Qr6GA&P_pnRm0a&4L^_yB5 zuNfTrXwkTmR<~r_S46F4(caw*-ivU?Y@Gi-ujFgHlQQjmqx&-QMYprjSj7$is>P{x zI)*JCbLUA@%9Zv0`QUMr>fOiqQG2J)89|+wHWathiu^C3zOUz@r^MwT(~d5G)04&r zv}cx6B%>A9*kD}&@GXf78S0r>Ow-xSw^C-pd~ZE99lX@bc%6ye2D4kR%||HS%q&9P z6AT_%D4HS^)r|<>8ub|SpKRhQYM)*XYnh7QTY)U%2;mNY(LBA}`ozQ16036y0t$<> z@_Nm`s%n(2^(LEjZqU(y^&1BVM=qWelEPAb#(4G>zleCn2`_21w5l22DRjpm|E_-i z-65*fjX!xOGK|V0fM)I#_1VXhn>7>1shgR0$(g#PdU^T+6O_5Rx5fqRQOX7DGhfe# z@XKnl_2O`riMh7H!DHXgn&s(pa(n{Z)@R?h5ai+_-elq(8sD2U6n#;ul~#SW2(D z-d(%a(&GF?wVFEMP?pSDC4fA|47A?IZtO%c8h^P^YLbhhrQOjlDDow{vb?6_)_C92 z(kH^sr0`ki)KnFAZ_&Duc_0yQh$c1hZ1?aCj*6$_`M!OC9GG^era;6AEmaP zB^N;rkEx|LTzhmX~TrVRNqocqB)^$LIP4s-j*ZplN( zGE`U1$hk61+2*m#_L*H9T6o%5zYn1--P8Dw^1kir3?XCxN$s|#re_Y_WkU~jkQ;z= zUGDM5G{C00d#s*jEx;;H94h)9Q%>4G!00SUU0b8C^(Y8Cv+^LtAP(5u;*RtJ_aP+x zGRy9q|Jy*t42v{x)TeW-5vR&e*tKv>b0o;}o=@p)s}WXGqO2n{@m{cSWaK~TTx9dN zRmsvkf1&tzY(vsAxuM~aRc@}|%{u@yZdZLx22B{{=2fIj7)3hqS-Hd zshidJ1QV3AbxUgL*xA@#F|9t=&GU3Tds9V*ug#2xm{U?xLQYMjg|ry*pTO$4yVXxw z?T<|sv`@;Hoe|f_)(r{Qx-mRF8|To{2ex*y4m~EeMqiG}`&>o^ZcMK)5;A!FLjFWE))*_E z7Ul^}eA{I=uv12KatYu7u1@xkhfBjD>gQeadXm$D`QY{M#}5eY#BJ38x~7$&U*9*- zyE_gc=`Q2rY3oC%4QH8^5&3Jw3QT56^7D(K*0k`z&X{972v(mfVT34qiaOKK9{u3fcJmk46 zhKJR%?$Ej&t$}R2WO^Ys`s;Wvb>k0idK@=qQOzYO!S8Nd>3}s!9^M}m6a=_CVJPnQ zd1V(ivoWYpN26Qr2(U8Lx_h6M?G5o3Oc3iZIdfrq4`bn}>Q>UDr`!t5VQhPP}~)t$PWYj&@HLreNTOfaJWCFtq&%VFtD4Y8~HPe{pq8K|#Tp zn44_#Vogofa9AC|T!IB30|Ub;)b$?qZg;5kL!gHYO)O4c%g4~4h;^+pLqpdYrotQ2 zdOpolmVxfT0bl|z@x2p+AQgLgp!1<9z7v~AV=UL(>$lWfLeG7up07GWK~byC@ICXC z<^XQL!xXsjo{b>eu>Ht{m$LUxnseL$b*QYS4PipNOSu09;&C zi^S0cTELBW)(X+NF5G{6OkuO(%P)W8)Oy1YreDSDyTsss6pL5()#2yIbF51T9m{@9 znT$09F_K?#DI1dbDJL1a!uRpNUI6*J*kjE= z&zVIJ9OaWE-Z5&Cs7VPcyz(Gy^G@*>)F&j6;8Ryz{EomcSS8yMTuHjOdrSI%q<42q zJZ{vhwBIW+^XMKgR-30NiRhUfT7dW$NZR7DEZf zNqHY=DS^*=ORAcZ4Of{o>e?)OrKsX*dDJR%Bg16yra>sCUOGy+hGjZUsz*g-WLm}l zr<9ZwSG|d`G4S_t;kHJA)u06c+M;{NHaP^OCwI)tva&MEmm?Fl$<}uIg#`r`K&A3G z|NiCYglL&^vrXZ~-E;4Hm;reklF#g8X71^G)je%hJE%+|el{BUAgS{w;;J|3i!)Ku}* zIk2hJ)z!uGU0?}64MZ&+^Q;fzVPNkzbX3P9ZX_``ivY64kb!%#FH4p`P_2=_##`O2 z9mtpdK7YohtBL3dx0H>W`zxG7%|&A?c?sndTth0+nUomN+IOU5-l)m%SPOsDWtQ-P zoQz~OkVxPGz1H5x2*g{1{8N(`mqPu_iN(g*F*4c}x3!o5*c*p?4vdYd)goI=#{L)t z0;;UwJmyjuo*Szob19clhDkrbILmS;6wxK6@hGS^srBK*Q~CXN?@|p(79~m^BXV(|U_5BHe|+MptR zJv{X0m2u*8Wb&!T6IsRq{{Hl<;W>8kR%!0M*eMSTCwpWFq4pz?;~E+oM*ZE^r59Nv z+>MYBTm=TDH5}&ral#@ZXF@9@+SKW1pa3eD7&(%Hgzub**zPBJ`8|MeI2zFmZ3Khz zH(+D^{r!JQzFQKd_<-gm`ms)*-@?(69+)y<&cRt=WNiG}B78*$cOka*8-*h>WD8|w z^-t?V7R3xEg8QHd_8iNhr0_mZQKo!g=Aq?O1(t(}a~N*(DQnRrasBbejpgYpq%i8a z=1ouFRfW%$ruo#KWMzHT`Vi5ucp?N)kvoPyqnnSKE$KWxJx$nA&O8b%qDwW9JXbb4 zBf;z-uPeaHHO72GDv>CkU09F7TnZI?AuY#sjJfB|dz>AOYgX2{QUq;CW*r0&6sC|R z)9o(x+PwG{SXy9`_;O#zS&u(XfRJnK1CSlE2{4$0{iMl(URe>=hG_f%SGpdi1;*REs z+Jv^~N_0e+vple;{UU(021Z7lFi6D=Dfz9tq$F4wU?bSLCy)5HLp!@etq*lWPW`23UBU3sy$FRlr0w$Y!xjz>?QTJLMDnyF_43}3QDknN z+!kSR@%;^nZm?R`*4BPa2P(Qq6J4bp*X!bdaP_Zsw*3xZ5^|UN`H#rsyjj%>h&xz) zA^JW*b{1UqW6=bH6~a&znXBCgEJvW?Sa=<}ARV2Vc}AJ(De%pE9-XPjtfuDA#NN(^ zRP&I{8hVTnhttrX{5UNA`^s$ZD-K@XQt)#4#j?;JV6ZZhOeuSV2W$xr7Q`G$^-cwM z`6&JK>!7i_XS@>>Psp+#Ilp6wUEJJWvevXEv z#ZDc$`Q!i<$MZk^v30-CfW)I7Hg~0M|MgFKTg<1 zn{0JJ=j}Ls6quR#uXZjjMH8jn)3H+fw0b|&eU#E8dW_<5XL)4jD3r5sfJXZLd!w|6 zqMj!2OuAHaGxfZ3wkaR+l^4XJdu*k1Y(Q(CoBMc1p)ck1_-S%jSX2ZX4R#9@RgxiX z_;Uknv=9eh8Y_(;s|+oW(gsRAFN-{TzHFW)@<@1aw;Pwd)T;V%a9=-&}@&~E5rbgg$ z>(uY_HKSuwkwA^E%efM`Nco!d(+0RPQt_IDUvBDe!ci#=tqtv(s?55U(OL9V2W3AC zvl#>6UK-bO$cj9gQO7Ey>Dz0UrX{qf=m(TjhZD}J7ZcpEyoZ^&?DElr-y}m!HqyGM zW3slHrHhc-~w59RAu=Sznz~G>We4s>k25-DqTe!r}$4}4bm6n#~8stZ5 z2j4i`EU#R^mP70hTighQ0Ok8>OCggbqbb52O6PhZKKp?P&6`OI~R>w6=-h2XEZCG!1Ov?4Xw$B-Vr2 zaf*FLe2)7Or++JeL$9Y36BgLWFtd9f-8Xm6kva`v&BD87JKKkjlq8#HGlFOrd0Au_2Dy08}BV^{8^5K4_yMt^dpcG1`7k07OCDL&4DVS}$d9 zAv1McQy&%`Yg!E7&V|J^^^@(ma#bICv8u5BmUq0RSZ0|! zK5}$dN%-Bla=dr}K_N9s=E_DXMy1yY7AyI3)yOZE0Jy>E)q=0oX(0Yb%g3#x<0_c} z!bohXbhuFs0Nu?=M95&StC_Nq@+S2uWg(gm7hBwcRN!zuQKOx<)M_+R8KC+W09%^&V#es zb!Ez1HSG6y#jZbDzr^J>2ldd6MYaSbnIf^ZVtVno{VASh5wq^17e{+qlM@qZt9?j@PNzYxqaII-51dRBLDUFk*uw z$zS0CrVRe6DbHxDQDkJP;iTCP)>&Jn*N%8csl@0biO;7lZ_rWFq+n&e-^WdRA(D@o z=fC!d*JeYTDxv@Fm16#DTm*~8|DM75|DzxS#$NcF&iZ|`E`>)rwnv;{#8^?@e;PQy3Pkb}6gyq#7nlWy3BZswId4I%O>8;ii@w9JdFHyZFPhBF zYAs`!cON~KH8ty>t!oYx>S4go-)Zj!ljTe@i74CEWifQA;Tm^@3U3tEr{!LBSqfk4 zV7U0t{679bMe`Q+eQK?hP((o%$F{ZIR-62B2{K>{H#$%eWY#jvk(R#CU^xp^q*QhF z*}lzNl%3m&zC6lz#{y8!zpV%qm1QDD*5ggv&PA&Yx1~P|{0Z%urh*w)Uuwlye#tk; zPp`Oz#zE3sG8O{aAR|LbS3c@>MPV6-yBs*H01Nimt{64C#MOCtc+iA}zo4>)$kUj* zf>q=L{8C6zmrSAc4HL#c$Ho#i{G6N^;AP-c129y07UUJo$3BG^zk1%9sWuNj3mY4{ zFZYi&^vIeP@&T6!yMmPk-k~q%J+W0cueYZwGoN5DU#zsIS}h$8dn5>&$Op5?U-mPcH66rUzH%X6Sx&d7Qj(HHntS!p_I6PF)9L5WpHGExrxn|ZAFdw@ zF3WNo0n{GF^x4x)El>ZGXYt36AE9C3B0Y@-g>YqUjoW0M&kEq!zJ2=)<=B6nK7QDY ze9^QtsTJ62QgA90GoGE7oJJTv#6LrRu9WFN@{-{j@YG(RAIU;%u zj`P~b%Pe8>(~uGZ?D>_99QHnP)t}u&MMNfka#;Ith1YyQ=FfUft*y9ucpSr+c6}P2 zH%;k|^iOrhXN|M+Rj)AP<3XzWMI~+tz`8nhQWHmSS5z1OAfct#^SGa;Rb62XQ3^ff z&2QPcd7K1Vt1OD|$E_=RHxjirx&sw=$C-8-$^{IkioWVa?gGp2w6$mYlUft5utt){ z20AYqT-os+$~*f{YMV%$-)=*k`&ZMh08DySGkEw+c|wNzLa)nnOT7;_8P&z=EQgH9 z2(dht#|3>WnCiXmfrXpoW!{P1zCb$^@>+S z#m|WeeV3nc!4KXf>Y===@g+yJ18us5oV_sXD0g?3NL6fcnx5a(8+;8C>kNwW(S!RP zNt@tjXi?QXeH3OLLeN3EbMp$Fy_@vQK~Hn1_m>TORE&6od{DDrArt zi=fcB(@0gIEbj2fL66|L{LDYlc{O{W-*o!J%uoJZ3|B;@R7FH+tbtXyS)BoPHJNCS zbmh+nr5n0t7k?81w(pZeMFe8oy5t> z2ObX}HhBj}L_~CggHw56dwW}yan{FsD11F{0<7ucEiEmCDm^_t_gZ*#enLZWnkcNF_T14T9o?xIDgIu!7wHevd}SY`|#m=OkJJx zfPsP#oK@8Hb)9HjpjKLZ(v+1V4{|ADL?kJ?JJqnMB(eKiaB%%ZX_a=&&eNw)-2*&~ zc#*{IlnS@D3}l6vIR_lEe9>Te2&MwgP{J#dm*bNS`+Q+S;oe#vG9ONTDMQA5D2|Ru z(tLI{9%B}*)jP$-$tiC7bh1h+L75jtB-op(s;bhr%zN(4MRle|Aqy`HZFJ68rnMQx z8Fz&(^trbbnhNuj>g|XnV6{m3)3@e)+}wJ~Q$NXZS8uOSsqLPt#>kX*7BsncT`o?E zUm|sJ(M{PDjQ&m)Qs~xO?&@dbq_wqrJ-$1#7hS6m{Z960A;e<3PR_M4f0;4%$Peh8 z#+w?*lGP(aHxw=H?c0vlZOG^23x*_I2Lj$0%v^4B@)(?i2z}1Cg!wZ#lh{d>o%Npl z<65=r@gla(lu6>%E#4JuXaE0s?pBHvdbK_59T!wH;7dGJR!i-BRRs; zy?RX2Wy*83!yhEqDVFQ~YL`nrRY&zO-=pwAEfu#jTq z%vWf1EUMmoZEue5C1}yXlm$I^E8iNl<1oBnVq)ShC$e7{uu_lhH^OYJ;5E&s&|d;% zRF?-RI-&3$+_t?SU-^NMyu)>HKal!^O9OL2Er6269%9jFFEN7p2{D4bB;X~gC3$}u=1S7*BG?yzX8W7hYm}Y9ajLo8FMRG~GZn`+F75gyH;~Ups z9v&DNcvUL~mjQZ>5Yin5@A@$pxvDQS107a(^GR*$s8Ts+w5Y+|{5~3$qm++NOmN@x z$a3dcty)20xP2Laz>TId6VQM0HSF4PBPghbU}D^w(??ePu$QZL@3@i*x^9>QWHd15 zBQ`w-$ST8~P_Cd;&a|=e^&N2S^uMyNFP+|vvBRtGq!!*dzX~6zmoBbH5d*_AuzpTd zC!#k4=NfnRiAAjd=!2)53PwHocVD-@KQqd!X_8%0l~$>!n|B=Ul-2v^da1+GaZ-d+GzdI_b^hsQuH zUj@nLXWP*Ai^pGE=?Sxmzppi`0a@^1L(=-}YJ?nT#0{rE(Zd#Qol zyf>5Iz~e3@NvSm)tbJdJ4ZPaMkEQ{oiB~{R(V1B-k9CRl?z?=_BQIDP_ zMup~9dd|F--{1#!Ny-HVS3YH)00Tp&t>Jf0BG)j;;-707Ty+laqkEn|QjFw-l8e^P zh+jNu2UBVw$qI28A^Ad0H0!>K0lx`xB#oiRng54O3E)}>?y3VMAv!DzsVR5xsVSoBSMH2xFNyK_sRJj zOU#BAPF&d{0bH&M3QplgL#r1r1DPD9o0t_Z%RbZa?6B1eVCKmph#Jk4D4 zqvV7Bc$#bi&<5W}?2P-HL(Mg&4o~n^D=Pyb*_b3|1BLrnP*lR!$>(Y#;|0Ir4 zDrzlY3M5Lq7s!)Lo5uO=LwvKihnl!wa;AV;0g7L#kUDnq`9_EYCnFHGEeCQpDuK4_ z!Q-c^gzjKIi`}{f!w?r@MdUjV@86qly#>}I&@l=lZSNHSOrwA|a?r!Mq9c_!E9Zsm z3iU7fpg^Vt7-jYa-?Q3rJr0WX$JVXge_~I;U}1vcQ*nRl`&a4B_^1+icUUl!CH2< zg6*Atx1@vqe73;ona-^NkNPwHO)eUZF5ni6GaKv|tnl!auuHaHQMUSl!_p2P7 z-H^LCSm6kfN(goBDBIr=e-N%+9yVR6F$&t=bA=KWRTXHoTKW+)yu#|Qa_kIB&9(Xf zV?gv|8CoNC?0V++PotkN?{+Nrgo!J3)JCzRH7+~_%rB~CKV0*MmTDYAhva%c0I7<_ z9ItKlro=_4KB%s#!HwSj>s%1&jdZ3CfraT6UFwB*^FZAEGLul^B%qKCW9mg^T-E+2 zFJ)=b^!@uQQ{wsEJ%+OBQ63NG4XBIc_ZUO)y5Mr(>+}DU(QV^<@V9q{o%2xcYNjzN zC0Zt>(|`8YF*g?K4f62j2g0;P`?xokiFS34-NNQ}{9bFY-oH*#>3%|^xUa71hBvCp zZ|h_Ox- z@82}DAD0c$?A|>Q4Gl&!CCcqx~0A5V1 zD^n+9<-@0LXX}=?BkqH{Ly{YS|3cbEULsrP+nkJ}jG=_fC!zC7(op@X_p!RT_|eRa z9cWfd;sAfSE79!d)2*7h$7+XCz>Zohrb?3nwvcVmH%Z>BWg}%o1L}uO>P8?}hUQ2O#Yn)Kt$+Z9kI4N` zF|yj3Hi#uB7opEjFru{;KoB#PF&?%1*;N~L`odY(rl4fK)DEbsbD2K;E-ItK(`8do zC1^yvvR`>|@#)a%Bjgp-hncsGnTq^(s9{UJWR!_~pzYnLq~${YBCj`_e%D@_>I8Jv zx<&;2J40n^j$ASa6OR|pEuKVE`2(Gz)bquaIuzdfDmdEN%X$#%a~42KBscxA}E4@Y%5wPg1fhgk-AsyE=3 zTwh5qem`6=KD(q<6VQD?uBQ*HDpz)+hNG;$zMF4ag{$#D&)aLm;eP%4bvI>ybQq)S zf5(09oE%^9{SV>faPWUM`6Iiiy0z!!)PKDI)rBM=fy>8WmZ6108wt`f2Gb#LjI=IW z%uSV@uHt)tt-1%kb5XAW%z{T%VTGw-$5){p8Lla}a24M2_9M@qOj|DSgVAbA-X5g` zl^o>Ul7$Y?#KbjY?LgfWAcZa4MyY|vM!~xJGYHLv)8=!#_Cyyb24&XqH_vg_lMZP4 zZQHZB$#$%IbK-yB!4Q}B|+*ilcW?c%PnKoLXnpJ2AOdw$0@c$tugBY0R`m#u8Dj9H;h$l=*&`NF# zs6KN21Ms4jwdJSDIcJU@WNS1xHvaUnqNc|29&5OYu)MsZG!dw#L{?C#%l%A8TrR}U z{M_7v@(+SBLb{SMY6-y~b8|qE6NB`t9gSLMS8)CxY*X9a2xUWwzq49}YMDCUe#H7g zV8a+v{_(T<|B@#D#y%(%H_$>MDb78=F{8i?@Uqdjbpx@SZ0q>DDhi~bjX?@Ei&hk* zVJJ;mQ3H*m<$$j!$kP0A?wUucQso%Ry0L)q~%^ABFLj zhsrncUeLL~Fa-#F>N&NQOrjJ$&e$-+JpD%6+<|mXMpdoR{F~7SBOv5LH?#NA`A9%8 z2A9 z1Ctn5K-=-5;NN6}+z&&oFV9D(;PjrsAmVpCJ`}{oYDyi4P|d=VGYl{V2(qRtxZVBa zoh=3lA`;yxJZ}*&VO7yY!;*e}_X;ojPu&HgDT?X-@DJJzt@)_i9W7mCKf0e$l@npO z1QeR6X$!F!!M2pWQ3XL8U;gB64tl`l@0?W=fbNc`lbnOk&qs{}M$S_xS;!(ws7oL$ zfJ7Yc$1MF#h*)!o(-h#hLlhw~7OuOi^h+2NnzA~H_il5kc4rsvX8`hWURmKnj5E>F zwOX}vbARElX#;!_J6*MVLEjqDp*>2PJEmo6Bd~p`^U^N&E!-=9lqmVA&g>pxrj=yqU5Wu@(a zst!e}1KyB*8n65Vns68IY~T({u-EXJp*UJPBW$JyJhwQ-Fhzi&ft3cgw3x4$WT zqWG=%DEMN7gccc5(FZq!B~Y_|tnD{;B+(Um++spfrR^;bOuR5=zR3A}@{h(#-AU17 zrmR5ud<%N9HPH;inH}u~g-1$wyf)wzhgB7J;B=LZw8)HT2mQzdnOgEvj!e4urq}Ib z9_d~$^6^VUrjjq*+f3s>Ot;SblxS(0VZYm5pDZ{#=8Z4n5E`oR*v@a6&kmI1rxgmu z=psC+Tst*LF~d|*SopqghWd$!=3lX|fJTKB0S3j5_o^CCETnovAvZFrXJ^ccv^Fxhc${WeQ1G_z7DEh*U0IvaAIp!m46lTI(lQ$B9hQD( z{4LroIG6_k78e}>RsxE&Dhoz;PV6bLl7N%t(bIIc3ZEqK2WXg!xiJyqQIJGd{YMt& z>k?MhZohw=Pzi8m@bW)k6vA^A>g%<1szVHA5pKQ9GOVR&4y#@{!ybl^av(-It`aAf=Z{Dykk7T}}TgMe@$-^DY z*`Z8;RG2FU^$Z*XfJ*4GQrbU2s~$3jaqqU)5=826`aW-Ei8LU#Wz?x|b?t&bicAID zRik8k$LxZNpt%QnJCjs3ZCT-PH97nYHsT@s;h4IePF;E1g!?;VqZ|fz{0a4e!57EQ%v3~@L zTU4Za9F&XU@8Kb6*|XKYc-$Ne4n@^UK*!|4WC-_7VH)}T`WYJAqu_~bTzicIbPk25 z&%TVjB8e{H2dnnznSV|PtaiGA|0X@aLND()q|{$1xc8j3_tTxm98A+dSH}i@@J$%& z*izruXMdu$wzhm`MrFm>KG}LmhmDP`fk@1;I(I8SkmktJx%lwZ#6)~F90}NAFh@CI z17R}nM}&|+G401*1lR|@<8V`KhF?rsZIg+Zp0ka3uaO@(!OtGZIZ!X!xP2jjaG05y znJ-`z9!8SM&V9b+ms@JwBk~Qu-2c8N`x{yy0Uw7k8Lp=|3Hwp>K;g)NvTvct=rPi& zi}#x)^2MmKo;o;}+u1PvNJ)k95&9EV$@NKUDk`1|@TD{Ez61*}!kGYLRpR*4e>O)4f%aV@>lDPz|q&` z4-DKqhV%RE+mRltQe&_j3CavTkHj;EyeDT>wltCkig4HnNFP|Ywbj+u72q&JRy;Qg zC=hSpZW+>n>J9@uA(@?3g>pm@uZs&iJ9SQpvqvpUL2hrEI>7{_GE0$ZWp* zHvxxw@B7Dfa^jp6(xS2yqOzAPV>`;4EehFF#9+uWwk(|%OF{@Coa~I{WSPlWrb0x_ zVK6b6?913?-+u4mocnp6>-YTb|L^%<|Lgj9o%`H%Xnf~8-_QH=dcT(U$L7AT&}a#L z768fN8H8R!T+)<-cmfGjH%pIA3i3lZ)A>Oz*>d?eMF#VekH_tfv%UxC1?_=Z6fR{bAE-SkM1wE!ijlA~1lgceA*?gJ)0 z66T5W@d6qQ20qXb_#*xzVO$R_-T?6hPsccZ2D#<6s4av>%%U$TxbYl(_9<*OSx;R$ zSxq{5`nJ!rs{{F#+8S*Wo^wr3rs#4~9Njp~H~AihHi3TUV?_WN^BWPBcc>eXk$Z*z z_@5x}De%nR_OSv?2@s5ohJGblM=(lJOb-g$ZhkH|XNl4xt^ux)Lx(6Cqt$vLInbB_ zjs{O-YM1gCTB8oBES@#iOfn~H(orS}G2$l|nK7w~@Z=+wn;Un_g?TjX`ghx|TqQ{X zUk#r!nWqzEN3a)-GTu{HRc#pAGknMNu~vcQxNYgee^@fXIkh*%3l{VfddU3)Ktf;% zcQNa3{vF<0qfO)>?$7B@x9W%7VDtq)Op5_aWui`#MC=y<5U%K>F2?2bzzhpd^oToj zL(odNZ&`>jS(53ldNL@v!B)#R&OZeNPG5yqRvrqVDTDhD7;adm!Z@QL0l>d>FPjf+ zAK3|^`xz3I;;#P;Gb6y<2f!?~wdLD4P6p29dsZ4;PyCc%#(;&!8+kXY-=FYoLZ4l` zc54U%{E`X^B7~d7jHGR-kucQ)^2Z4j#Ip;zYv)q*=ys-sSAI2WuXpDV)Jytb*#bZg z?lY0GYb_5QWq}$1Dl0IDCnGerZ_TK-v{{C4+iR`2C_&*!Sfl?vJ$nznL>riHP<0P%#HT-0-rGiZd>)U!^R^C#Wfs16&LenF^tl+w_ zSm@`>7wCnYx)Kz&>0~wP#YJ~(P1q!CdyVyq@uc^~!Bh zavhkmJtI!<>2!@m&{JBLmX_$sTq%KI9Vm0!v-c{Nz;c-xtRmtYt~R#PXa|R_|K{MgO2`y7L(y+FSQQ3zN=n0y|Gfb-FLAH z1fYr;z?$@*!m|iy?`+@n>y@nR#6-WT$v`zOwNs&ldc5OiJ$A77(BZ>PvjAJ|I43Kx z;TYc?uMUaN4Go9J9Ozd7z&0#dRy{{HIpN@_f>^r&SF9!pUcS~oE~&<<76yz3mw7df z-FKOA9`)o7lR8F)|23q~m{(iTFL~s5Kg(p2 ztohW-ImV5BB`1GN^Q*3iGlJJ!C^hFEAF0CC7EQMd%)?C=0Bs21m|U1Ch|hr17#jOI z8Nhr8_%5Nja|Pc5vPG7C^|7|(gzH(h;zZy8--tK>>kI+7U}abxL%l%1o{}y@QFr*E4|6gP{wn1RQ)N*!nSLtNu2&}nHs_V|u=UyM$8s#a{{4vuaQD5Jc!13V zA9H*fZ0Nubz3KfryVA^)e?9B5U$q#i#hJp3bt%p#p zMyRlkz`}S*d>nrmA}S72fZw==Kt=(rOOddMhYMHE|Y$u|#KLKgC`4CLKosLGMH_OR4{Br`mGEzB=Dt)PXg~pfbGj3I!)4mu~Kj9b!LsrS#0y!=WHv z+43`)n(V(1d~f>WrjL=@-1jS)n&sCyp5!l`(?`uUb)GZwNs5zvFB641_N@i4&CWbp za{V03%4^z1;=U(1&3BBOtg9x&GK<__VniESKUZ!9eq7kujX@Cn4_^H!e>EH>1j#Ysa5u{z9&6Nn)P; zdg+3>Sc3MZ)uEQ-1FyvGOpUW!z1}dNHgc`$)EmimudoUhOf-_jbpR&G{5Fz{BvYj6_@0#aQ~r{mi`7ojf6KTS7!%32DA_2bF+;XRd= z*q7(`<)jGz_T$QPR2bXNDn_l?&U);p0Zn-T30iXZ$%IOpF^5)u-< z-n@=`5L;4pRD+IxG$*|(VaJbVPek)~OyV7Hmr8K5@F86;uX_dtMw%5K|79OH%Yo=Q zeMv-?o?%w7)~LH2zzI3YXg2Z6*MI%uQ}eq^xtT+`nFI@ej1WvS$W1y`BPN*je2jL^ z#nqJ`c@XAJ;BYu$4GXXf^YHRs=Dx}9!lRsx5i~Xws^GA@<@#-CgPP5wI$nh6Nsb?b z_ua^7Fzt2vgGWjj`9g}f%XG$SEAcBwUk3(3wZ4?Dr}`z3?2$#9 zIFm*sprsik6zFT0nIS%K#oOq-#8&EH?B+CrF=gC)UOrWLo_w06_M0Q$N6WkaP|9sQ zcmDNT@uw+&C%@7a>-Ff11b(%p-rdE?@Ujm2?@06sQZY3A1Ira$pYH|*Y(sj-Ayv#_@2XSwE(Bq-n9=W@b^laJ*Z zYzXg*!ke45U#Rm}fI(ZdwY8OvaUUWj(t==Boa1HNxdorgH|!yXKT-5q0+%9^lTR}c zXFu}t@HEZtYiwQgS7Ks#Y7+{Z4zyQg%G8xM+7cfnN7M;NfhU*w@g2K$%mUnmvIqhJ zeSm&f2=GI1$N$U#1M7VJ{Tb&J+AZLL=psoSs+p~I<9g9>&$H6fCp82{j-8YvOQEK> zlUlNS?@K4Yh04|G_yrw6ZK$o?f4|gJV7j*U8ZZk0nqY7)gRGofG#H4iw zd`>Wp|G8G;K~PW>$TS^4NDITVdUq4y2`bt9jJl3+dr3Yo2!3TA|BOO0_utu8Y#+G7 zvcJ#8dnh0;Wn)!Smf^=nKnHCp>+n0yL&U-Hafb{AZeHGEOQ8$&FdSv?xv)$3%I9V=8ua^GA=h$6HD07Fpf`M^>_eA#I@CkXC*RzA41dUEaW?BF{8xuxop{{;QYa=sz|o=?_ubLyW7 z#M2kNcDpPk{~phq@R zFmTq_YO*A)ekI@=Hs$?S>~z-9Qha`=<6ZN41@S9sMYK=oz7x~p%s;(q9*MvS!)%Pl z-_BwJIkH%WRM1z%G{zWKypn%QXc>MKzcHPZFvb zZ9Xl|v%UCMi>}js@F`2Mcqf*poMJgJ?p5iU5>cH1Q%+B3BL}CZbW&yF?NGhG>#<>x z_rTGD_VMv~-&y;_h&2S;HoF2pV4s5b1E=y+J=55)D^a}444KwJOi%U&*A5u_vTeYk z8DH`9W2pqfqRoMHY0*%OX!`FpW)CHV#f9BMAP zLy^8;dXk}0Pn(S~x6{$x-0d2s2!l-Gs%N)J&uC)?U8>|O7Ii!RnN=~<_ce8sUbc;z zC}YgIm5j(on70^kGpw#JVKyNPrsk5ZRs*{s6rEn&n6En_-MMBqgF1Upf>R{!veHky zjQfg;ihy#J*`i&opp|Js=X$L7Q3-8Bf zfea%gKeI6Z`Yxtz-} zdH*(IhLX)a%j{Y*Teh6bBP01Z=;6a~s7+9GeP5WA7Yo4Do)XKA8W8R-Dc%mX4m$Yk zCkVUsOn1!(@Pf?;#na(*x4q(ilHezaSL9^48FG<#xtBgZfA1xe+|n_WQ55^bR1=?C z)MKnz15K_3XCp1mug|bpcit(_r!hM<4PP__z-#{0J8drdl1*2IS!nO8s{GrqFtzN` z@Xa{|R_K*3ZQh*z6Z1Ab{c>KBxyW(;+0Da$Zws|q23t_tD zvQfv}cEvaEU2WXn_-yueR9$fnPN2k8H)lHtwJQw0v6BY(t7&}Y+-=W z{C`zpYkY9eZU5{>&88B|wKpj#=W4>MCT(7i`Er7F7Jo}#$WamYlph;gbzV4>`A_YX zYnaZMG3U28G$R@(yei!{fV0U9N0F?ILW*dE6BAn5@L=&3R|=Fjz*@ha^%KCHx75Mg zp^>BcG{cyN1`RIQ{D^Qng~=xd$<(2tdr&FtdZe{rek?L+d}YIlS1MGKZ7J!^=*-OF zq-=oO;)ibi3ro}9s)EC<4116w z{LczhmglGrg8+u;Y4C)3BI>uc6h{{;-h{$1EgMA2rc<=5(p$7w~{$jHdZ;hkcdPmW~}?vU~c)~n!L?pf)sA78|J zh(IsVtXDa^QNlut)IV-olmo6j4qg@zcGh+P(kxW5wcSeJY8~@fts%TxNqe@tkHz?( zIh0EM#|uDh=B~M>a&pA_RK9p9yVU%wy?zoftL(vNp;BR! z4Ek5L8XH&gBWH?i^D1F7zD9Okra8^|p-yR88+wB+MH#L7;B=PZ1w)g`+|)m4>z}80 zuJoS_M4CTWeyPou?$8mvY?&n*xsjdHME0R7YM(yNdW^flv>R!K-qL+|Xo-p1E4yW$oQQ2nDCdb6OIdUZygx<>t>*&-nZ9ZaRbAZK5He~~4* zq(HNeN###z1*->^GVe;u^7{Y^oyrgN_6})tcxC2IZ<`zcpiBD!X zpks@cSSgr2L%3yVZZ@*IDr=}tT)gz`PkZ0#rK1orysH+}bPRn_iphvIf?k&jF}7L{1^T6R1O8Y+=5V$pS2tKy7Z5Uc{5*}%M`ytbdWr%@%mnM?lGuT)Y(^*Sus7`0J_ zw?&$6bQ{eUAR?c@FwtfI2V6`Q7Gmu)EVVCbAWs*G(!>fJwJ}(OW(Q97yCJu$q~}f{ z_Y+fy^w!u5X&V3L#I=-RiDutP*+_*}tu{XK3Nh%hRe3&zYPAib7&Qso(x(o=BLb1o zx_~;$GJfGX6VKo&fmW68#X|x--*bz*s-8OBa~zI)&3ono0gxyRLU5w!_AE)ED4FXA zQh7h*H{7%!A9(URON7ZHC$Z9DziBbM_|ktxrr*|D=?!0KXrMjRM&L9tbCcvrmTd@+ z`-%tET5c`92#D!ex&L=h)+P*O;_ak2ZX8&YeJaNts!wVI^#OHX@ZUMJ>LU$q*i&}Y z(at|`0)bQm8{*RlVYd@1tL%}eZF{A)gSf)Q*;KgtX=H>H>0419MZ%e zhIxOqIWRohoE3{}wu4Tswxl2>a||!W@JF}vjDR9+=>@Xw^lnnQlSJZ(jEbTnPQ#xF zjFEI)9zDFF1gL@GHa(~UPjQADN?t(K6i$k4;<3VDCqDQ;C6MJDBgslo%(a(Sj3ys5vRn9fRln0pO zunBnWt^!Xp(S}of!8S>-XIdJO(%SAv%Z%gCYmKep=Sx@S_?rXSg`3Q^67Mn`DAL!n zjsTwK3@*7W{KHSN!dWS;7E0y9$2)L&0FDz7B-nxn22@^vU$YcT2(Jp_VcZ9Q zsj@GgUTdCYBLTjKaWBK*3}`wfSfGM&PxyORT2_FX%t%JJIZMM1W?LcJeBHt|4kGbT zsVa2Ask6u^(7A>m`b||e=fSanzPv(cQ>f1I(AArxBbsdslk7>=JbFW`%+)angRN z=<0$s&HP1l!|$P?+gy7 zM84j?d=kscs3M??w$5nN+}>$xV-MV1edkpzwaeRS1bSJ@EQl$-v>2Q8#-a#K`Xrz# z0`Kio6`8O@)z*a954P)PTUuLZkZE7gg9Gyv2kB&4S=pCJm<-?GCXq%Q@pe4FaS__` zLSy0il@ahiz(b@%s_X2G)4BQdTR61Lld-WJFB*Vl^3tMZ0l4z<^NXPomj@6;F8=O%M(AoRa3Sg%H7FL#> z8|tpz@g43(zv|Y%P_Qse>UQ}QJHh^1y0Iqh$^Uru#>{TOa@{`o_|C|>3fmtRVmV?m zx*lV`9KH(*tgxc7(LOy2#7EcOuDUM2YQ|T3v~sj2a-%m=At|_ zr(xt6OR{CTS-||#_wsL8QDS9)rUp#-@b==Ff_mV^G91)e@eRkI!mX_a84-cYFC){z0pn+vlsy1Y_QPT$ z6_g6w%KN2Zu>98ify6wpD;+#Qqn}k)%F8u5CkaaFg2OU8UC(*K0HRJ4~MvKc~wG($>%FWXJTYZih!0Z zyD@Ck5uvG^`gvmF0@SSoPgF7s<`wEIioyXvG>&H?lkzf_=gaE-(hm=<74KHP=uKrM zrKXbSh~gz`mHR5GdS8z0|roTcz36EV)tjJJ#kD0XALaIvqXLdSW?<3@l>o?jR?xq$Wox( z`khW@aW*n(w0-G}RR|VEACo7`1>?@{TuN*ls?4A1q!rk3zShf$b~?+3N*+|utaO2j zfx!p^?*%I@%jud~Nd$$*J-vC+4)v&V)YBkV%yvl)%Xy|>1%b$L+nT>5QSl+V`HLNd^8;o%2&>Bo|?srB_!Pd?tU z>-!w_#b1ez*bOO$6-B4N5Qb#;8rl+8gKV?HV87}}*f!kU*z*WJeb1*m7eYPjE|u37 zVda`jzz^p3;K3OJtdm6R`9^oWb8(7AlxcOVL<1s)-XJ?G@bEML1Rnu#8O>newPlhI zOA40d`E6b9cA>G|ZExu3BGmJc7;*;a8tXG&@zRrcG2kHh8g8W!uc3f(5qb7eCRrC) zQ258!f4A#>uCoXac1a(d&-9Bkc6IDq@vAOJ^Afc;Uq7=6h0lrRq?Fd|anZ$SLlYCU z#C4=WVj{_&^MDTN71`lRgwe*au1?n@#6`ZbUcr z-o&Nw#-S(@x|iD%bwO>YvN`;i0oWe~w#1izt!!lt34eto{X57%*Lfo1($sD}8E1Qr z4zK5<-?B9}S}5We+J!S%L60_RtSAV>2a1xrurQA)xYj0tORVX}FrI<%b++}zIMv>Y?;Zos1rk8kFv zcAwt#x3C3F8fhwh=2_-4+^ymL?7AdF`9Cl{8ird9#IxVmI0Y>ie|>gUzjgcI7v!%P zsoH+By%hE}6UC{X34jC&u1dD28gm(ETwk1Jr|3&7FBMgWT>d0e=f$G3T&mI7ccm7) zceE;7lr_?8Ep{pUv~oIo8dMAVL%cs7TDb@zB}*LKDGc%yc#`*Rq7NBd z0a7O6xAq!q{IoXod_cg*)X7I*ZI^$6glQ{W@Ajv2w8_yMwWEng&o>Jw?jo#%TY*8- zcsku!{Z(L4P)v#4GKNNT>ToPCkG(yCkAxk-mn68{2S?7Wu5w-|HcJ4Y2QC-A7nxnB zUn-ov{U#}R9r4J{6jT`a$4O}4P29wipRmR%cSD%YDZwTI!OI-LI=ySNV1DcqWTY$q z1&{B0g}9J_Xfub_;f;v)mKAxaW6q~sVbTqV?uDhF-xW}%#j2C3F1Um)BZ>_W(E}gn z0}9epZ{AHW_38eZ-Hh->X>bg0!|5cCo5T+)=*u%P!A{+Kmk&=C6vT0C=;jxr_4M@q zqAl4T4Ss#=W{Sjv$h#pq5^AF zRFwFn^Q_}e?3dvjZu#|q+{>RyB}Rk;DjOI6(G1r`fh_#W@s~kIOH0I?N0H+u?2L4V z{`1?;py!U|c=vSGb@ZNc7>FFqY3%4uzHpkoHLo>Yzl_*HKKZES8Yakl(urUEmw}wE zx_^1x6hHjyx7N)6cfv{FMe2%8(*0pxyCHnhrsX8A*BXYfu`$Y1qQ-n7w<)hZTMh!A zd&TA?Wm5-q5-D9krr)qzH=}B`Tem?yW)!XT5{%}u0W6D;eNa`*oATDl>t)F0}WBU(d@{&1es@#K7BCwy zr3EkzTmY<)B8m&nZ4a+j@Rmoy4+0QlV`?lQ@=fA}CJ?2*K-&WWCUq(z%kM--RsNDd z9ZfxRYy$?VDggqK0I^{tid>3U{$3F)lcHyr97_J(Z%UV>3dxHHvKEK~=>?9-rsX=B zi5=3$BQOPJ2!x@on=npu%oq0E1=*i|1FZ%?7|rP7F$KV=0eREcUbNmva@cT+MU3a$ z-CSgIO_(fs4=L=Z6bEHwgFN$37M7N80Rk<+s3Smri6$f|nENM@s6#gpIY`C#q~FFC zMYb<6sZyLbUt?k>&j(t;X*|0SU2r8DOU=ZyuR)KKI_5|@v2;RQ->jzI_gw3>B@e?& zO^lFR6|nW7cC?R|<0F!ctNQDFUwTF`rjPk&J)v9a#27~G}01*6y}<|A~vy^ zb4c{k>g>*1kf||0v|ZFjICAqiuaf_5IA*0DKC=_BMZRk8Cj^Nr2W_sp&95!mS4`E0 zu!g%*YYKH%`YOE_((u#Z;$Kv-4a>fG6w6XHybc4coho|q;cYZKJXd9OnHwWnCj!uyQIX3Pi$9wyz7 zS?_0|pBt6VEZG)|KwM7IbMy7Rpq!SHq87j8rzn>P97HYTH=2Ov2c!$n2_Hw2t{^n# z_Y%AIpjpP#)UhvU&<-S_t;ZJ{A0$mk-8`wC6~na#rVDq^i-nt$xtXxg+8oRI)`)Pl z-1?I6<1@dBCDcO8=1*-P7hBty##@-Y_`dH$ef`foJUo19&ma*TW_Ckk&C}9aeqRC| z^m$yEg|S@|y{fzDT2ANJ(D47GPo;iBHU`J(d0v=-4Z)j&hyQ z7AQbtI^qYeM}}edXz%jCTc(t{eD?-QYLD2^nzr_SAEgs4wV^NW$6r4O)&&M)MrXPL zKq~jA=oFs-`@9T*wRG`q6S_;_?A0?2G8GG-e>M=p+|r0M`GTiPfhtvKtnH$lMjY7K zHmnRMYk{waPn7Usao(_)J^u_dA6etd&OAa__@RFv9NqJktjAvcT~^Og{s{ZYnpykn zv0e9eSw}6%x6+*v0#(%6W;@KM)7Gc9&wuh(B*x0*Io{51a^s@UscijK_1YcW*?yX? zFyUJWb8|J_O>>7h<^j#i;-UxiL&esF^c&|Hd}`bRVHU;O%r=<0n*7hP+kku`7~B9P z4D`fj+f8X_!(Kmf;a*A^GLlB=Cx10gyTVFo>=EqpZSii3ij1@poi>UQ4Dqm(xfuwB z9N6TiFI_9C1u>B(1S)mCdacYW`W4k^+Tv+<__X($_K`~GkO=i_HFx2oh66J8|J^3K zJ%K=*Fo7f`>iz@IIrv|wft*aLh~?MeU$!cddo)A1czpPPHM<_{bGa0KR*B+!s{ zOv+*SB1Fjn1#kaai5D-r@`2{u$6!qe)YVm{Z4Yw%1tl<2z;_5~IT?=sn+Ec(9($^oJh>7Hw^ViF7@HGm#IsMyxZlpe? zcwLMz3A(}&mA5p%yQ%cfaw(;Z_50fU+%cQ>rE91Y$Tdri!qZEL_*Xk+B@JYwv14sg zy6V^0YSQE`UL%!dInCdZcx1!*oi46G(5k)i+Or~8RgwNB6LdKYmtNo(eMAr>`XPC+ zapk(XtSb1vB7Zv-(OSVlWT-ULINU{b)v!g7+sk*;=e?@zR z86Cd>!{IoZd92A2EGG{^clEn5hHe+IBwvpD5KdN8O|7dvK7TRNkLRz^ZD>r7(~Q^2 z!_-y#0bXT(Wgx$Q99)eHV%jok-7se_#pEbjoZ(CF)0}+hvHL+tAEBeRxBkU%0)r}F z%RCAVwF=&Cip{jQB5c2pJv#%$`PKyIzuYcNP+0#?DEtSpPp9esoek!EG>Wny(?ViY zVIWEI?>s)UswKCH_Dy9XN!d`A&Fz1#nI-rsLFufp=)V{NK+PO0O2IKCp8u6cI*#n|tD&wL#z&R*d@7n8-Nhp(xihPZlGnql;@?FRk<6j zmwF0$f}(3s6hKYT!(7szC(Fb{MmWG(2COjR>RoEx`6{znE%e!*d%G?a5U-=9GrDrj zT_R@#NNEX|9P|f!aw@QL-szCZ85>c6=!*VL2cMO~#jPoKPRa$_u#Z?mVRD>S0!gana5+1y^6`Jv&SQ9MtUDU;Plb zy17=WLmO&{f^U511M=%2z@%tTrNGVe$B-e6$N0*}5)A*;$(P-{B2eU zFX@TkZZFf(n%CxP{stShVI>yZ0&k9wN_e>90_@ykUf}kRiJP_$%d6?QFb`EA-#U*? z9JyV;C^YHcDHolkqcu1^2}n_U%+%2GbFnypsIWKIe8qs}r7tX>YvSt)BU1o4aujE2 zjXX~y4(_O#cKX{RWhUj=3C8s+;z|uG$6TA!i`rYWLLG*ZYVKcM&NruVi4~iLrxNSV`cKeRibBB`Nci3fNro`+1jdpaf%&f3m4%pR){#@ zD0hV}uF+jPLl+`F4DpUzLSeX|rCu;T>E_%#8FyxKetTQ#rkr&xmFi5S7iJUHRqM_B zWoCslo_7VJ_gTDP|mFS69eHH$W1h2+BQMs({;{t_W@3-6}%Xe_w}qYr??9>-tObB;|*LxU;;&>m(t6u!n2VJJETzqP5D-> z5-toVl*C0KY~Fj#1Vfq(w#{M-dvjCb$y$l;8#M}KM2g<Ag_@d$f9Q!I}5fd3Rvbd%hQn#q!JLKi* zdGzEVbD5sgGMp@TI1d1k1 z-Vd0aG-H#y)|A%cq6iUip=dXE+~dqanq{*OtxA3w{Qmv7853?T2)DoF{tZOM zcR&(!aThw_NL9|dyrn6;%P=SKbNhcA{upIv8a;H%l|vlu@6VM-_UXe+W8rX{A$ZB* zs<5$h6S57I`(5|W^-MWP#qj51TEozGJ_i-2{udK;D%w{ zJvu$;puUR33b+xy91bnvZ8oFo)OxahhLwlap5W~u%;#(f39%B6SXCXv1DnSnRA?+P zEX8vm9}J_>Xp*{Ly=LP3eN3smI=QjJc@*$b^!E1JHa)qnGsmb}`<0iMmwzedIQJO@ zIU5N=5Om#eLB2yM)8k++vUPZO-Xz{1V)+@yn75$RZlV^}>2oM-GA09KB5f>`=x(m7 z@Yc~WncdD!bM7{s%qAIaFB_~$Qsa2BgfNq1E-o$)z1lAzDKRyp~QwWtbtS_QW3TK4vvn{1DTlA46QO$)-_pcBXR*;_Vl}h?+N6hrfgprpbA@yFUgM!}=|IifdaSXmQYO z0Fh@r+6Inq^^7dq-A#p1@u-^=5W^BD?K;=!uG}PV%aZ02!T#jy~}gEVTO9RDY7vhHn-vSR72V<7=&11tSHpT2k%k*hsml1nlw{`6O~ zo+7!SB!*5h2MySQthHl!Xf#R)nF+unM(R=vu#LjP}c zR*U}M{>EtWH72;N9}}?_8cXv-8WmJJ5L=n)YhQM(0T}k4PJRKub#7ER6?G4yNz>23&3xVjDhDT?96Soh~s~u6-m;3%9D*skK*iB6j&jYu=sEZx~Yx5RK%sQ zkR~CBik0kFfNbsC2_Pj4sk1BAZ_?=Tt68<&N)X!z=G{#D@0ncN3ZN3-cvG-8rpIBX z09efFMoAPfw?OAy%7TmpK}Js%!u_gFVeC^Pm+_~A_ffF0wnx12MMB$8&6Lvgr#9hx z2SHzC_%3@GuF@aklQ1}sZ=wO(eOT5oUb_sAPk2k3Xe5H=FQK_mG~wHE2Dlge)UY=1 z?-fNIM220}XxC9LRyf7*ARr(DY(I3929f=cX~sTScPo4A$IczT22CckXTYo5x84E> z0PO|c2~It9U_X#X6@{x>W#Djt39?yI^>yy)89gpIc;trtpcX|x@Ky120j{^uIM!w{ z-vt*Av5bm-&~3BZR$*^3E5vsA9%q#TU6%CZ&th(5}=53Xki>`vL!7UT%$6O12w zP)#Ex7DTC*!i6m}e`*Md0_7leEUW8_*g|I4mNw4Y(i@{t^>lV4kwP}l#1VB!Pse=o zn!DJ^2dFDDJ;gm%mgE+H-EJWmJCTj7(MsMig`Tms2o38ub?oD!!Yxc^)>dwia7>S_ zKR3jO9@=e%d-zh8v$hZQ3IzqxSisKH7Pv>uCz8Rk0bZf2;GUQjY4(elQUiAa=xrbG z%uQ~rC&Ht3D&li%d+BZoe!yifG=XYY!a@TF?l0iQzRR|D*?mL%xdA28`Yhn>=)}3{ zj{sboJDsJit5Caa`?m?-Xf-xQuu?qq)$z`wOwR~#gQ>H5gifC$hQVG)Pc9~;dx%6j z`KO#={*D(r@Z@7tq$h!Xt`BwHf5sC5`}%2I=^nUqB&+XP@1#=n-XhILmmrn|Q>EthSAJA|A+zt743=J%se$rNR@KNZHOzqlPQ{G_$+GkW| z;=Z1x^;6^ll{2-Ku}yiw_hAA>hkHGV&5om474gCPZSwrfzkuKG#?kPg8EK!L!z^Tq zg@>g7MC3Qwr+XeUzu}fBX1&^h*Djh9}!wSA43&wgg66u+tqLl2$cke%jX?ppQ@enT)pM&Zjky%)CY6u=%izJ{Vmv z@A_<241V5W0(}fYq7Ia7qLV?0*4gEBXLwq{Iy&KRNIYcVIw@(O9KQHfN_Vp%Xp;$2 zNsy_*RI7j7+6hai}+>n(X~j4Ag@Hp(~xb7hzOEVJcKMHtF6epqaAVPkaPDlNSX z65JVPn1S(^3vQ%jXOp<2T5Sbk0&qP_zA-2OYkxK=Z_1%%%%h?T03CI9Kd`*V-fr7) zg4glvm14(J@MP2uNW=sJYUKgavbnYOukdWB(-&!{+y37*=X2_e1Q*=y|zS-}_1>R5b6yU5pOl0fYi?N}J5E)Z4hw6z5>Fv$C^o4K^o;97?d@{0<2m+H=k20!k+@ zm1j%?^Q6DoPfu9zRJ19|%WHF8pvw=onFKOzU|?V$tTPFgdqXS3o$S)(_n;B3dWQhY zw;A?8y1#^cb4OWEx3)xtGx+z7jfWLF3aXk-4?$Rj*a#fS8#S z1Vo}v!YOf%p1-|mgqcu(NgYyQ%k0|GZU_A}!FOIk-;0N|V6mH>GEwR<02K%lGGB=E zA>3LSVab_evU-_YaFA=WsmO5-c~&iCBxpoY5K5#F5J@nDl#db?X$MSySqk)gJ~fay z{D-T69NQnT1)D@#2u@$#W;@e@9s3K+sEGR?CjHn;EX-AV(r1iyOO6w@A@$L>g1=ON zp#JVqJ+kNvuBVDr2+}X+$M5qg(pa*%l>n3GH8tkJt|OTONzKOcyc_3LdA#!0LN&U< zm49;LOk~9S{ybxJ4{6&t_wBS}%}_}&p@H(p`C^~OxfsGZtqxkf)6nkug+J~>*hq!V zSqe#n+ubyhWr##(@;Pbfjo^#8B7S=5YdnDJ5APkeYy?{eLr`^&T%wMlyewv+Ec{Et zEv==UBkB9a)n_}UW8&?B&$gG>u4tdEgqE|-|4yZ~5X38l<&V$=bR9>0Q(x#Y7<->D zg``D2L}vwK!=^H+RO&rM%8Y+{wTPA9VU)Qzk{l1l$de^5oa)(fGG1Fem9kVESj=Af z_MsM(Ia!8jOrVe%jCoa7V@s2lKL|~`J{#ABKq}}#gUid(`X5O4c-s3Ooipq-e}w2vJT^n1X6t7*DOwJ$Wvl&QlaYpb7@g0h3 zzZG`)HXCE2I@-jIi-|OG6q-IDp}_hjd@ZgN8&x^#mDxSK#Zxz7Rou;FpZhYE8FhG`=o)izHJ`SyqN+}*YPH0P%UTNo`{e&3sH zP()KlpiBct$7g2r^llub7WKJ6bN$78NI0&kDOwrsD@?{ghDA56%732BjY1}A^C!XE zpvNA|&Nu6tL++gev5%P1iX0e#v=_*LC7raTx+RfjvnKjjb6;@vLQ7O$`|hHC%YBc$ znOOB&n9c+03UuPe+X8L*>p@{a8Ubl`J&TW^-Mk3usvYHKkQbP)>3I+8ti}SnehwVy zcY2CMx>;r>`opg}%NtK>he?)@q1JJ3NQMWKenG0<&4ZVPM`hH7-cCeR(_CklSR zJXWz=E%z^9Vjs^|zIPGA$1s*Hk8A`pVUbDl;l_qrsCTzTx(a_3e<92hKPh|R?*Up( zx9)V>5fn$Yt^|PpMkhryJ;0tK4GD$*;iX_ys7Zj;kiByK{$#2pbWM8}?;p(+HBAY2 z6dYLwjcknrPmGZ>B~qtnCC6qj5whi8=jw2f63oca=2E53*q+9tQu{9x&i@NPjsO`w zfS)n9=a1giZce+}Q5dgfF|xUr_|`L-9#Hp+#J*%JPRq2%`#{mi`n5 z>X1}SJm^-_m;Z){vRs4Ud$r+&DN)@6q6y8gcwi5PjT71>6lis@ZA0Afx_$vK9fe$Y ze1?Gm@a8`_gaP_<8jgYj21=FwFfp7VK{^2tUrdw)3uu)5l%G}pbe999t~9v2(fxOg zDl8VYu4CL|Fcq}phXuJFJTU84a5-O;VZf|sD~jH@$I|MLg{uK9ITmj>01k8Lx-Jp1 zD508$8kfD7-(8D#=}0r%4h5EL-Rycpcrm(bnyf$hsG*y#eh+ItjDfza&4G~tP(0KU z20D!ebBa3VR?yABtt{_t#%1y2ZyKoL#6hSkA3QiKnZvBdz$3>nw?rd%paBTOfu-~m z-$S6WTyWq4<-moD%jn)zr?({2r}u7bEST*eq9PZajG{Q<_l3O?M`$_W-wy z>3j^z7El0_e(+xC83ko!ra7*B@daZ{=L4AXV;a=w4i9y}kN+<2z}Hl_Yff{&DhFf) zN?@s4Za3UR$b_Z`x(HnB0l4Rwy@ovS!k~9AluB2|Hh?Z_4wli#j`n(bV%E=jK$aK(e4ZPXk39cn2G(6|w zkmy-RP9?RBiY=DOK-$2Db9eHv z*%ILeu1SKB%ii;LZ`MGVIl{kzgdx)sc?4c(pIo!ZyG3uI+ozWNAZQjnq6K0%?80e7 zHcJpIlR7m3k>;+b+ype`b3#tsWvdgrwnNpf3vkL8aV%_OZ}dd^Rt%C4(clKt1`Hb{ zTNf2zmjkaG^j{JzHk`p0RxqfQ>+nd41j}3a4yIE+Ga~dEBuj8#9LvpYFO~by-9m-N zP9sm9RMxHLJr}>!*H72mHuwGV^I1NE z%HhyQ<7?Xkit>?<9&gGr`6zYWosiooRo)1gdo)(AoVL}C>+2e>)AXR41CmRYCT#T0 z{@7e3o-SVd_U_*LV%kpcAnhjx`1Q>MV-iIzwU1)|)7(t755d>x!}tvmv(YL)I}YD! zhILMCQ38E7;frm_FL~`F2H!s)?A;>nY({|q+3zzHaeU+9`b5qM1lY@vt!X=(_AsdT z+mGr816S)mf0j12Efy`R@;oCgZQKyaT`Kqc9qHucr#mwJKG$M}^s&C%P5+C%H;=~p z``9oij>e~sgz z3g(&DHc5zx(4Ivnp&S&L^y(<7?BOJlwlRy!mlD$hhV#5QOEJhYyTq8QN$g@v%{^Nk zok02BYAI?Bcv7rY!7QyiD>O9JxJCWkIlVL~v_rUpjgF3MSX?;xJaEEn zNKjNXqtHIYmHr(1>sPN{U7=6HWlk40&YOKix1TOlpq|( zS@-C>`NJMzgRFUT&OXf`eR2z>_hqw?#GHAYTB5E_<31swbH*uIO?^FCSy?PnZn@<) z*k4tlnN8gO%ZdcrT(gscyqZ8){}zLjXW@eTW`2 z`Vg2$HSr9;efzdKjT*3F!v-#4sm*RP^r1j0cQ@a;grke98b91worXRLTGkfm%ufb~ zkV(b%pt%G)LkB);5MLrSBVnm~8GpuJ49rZ!T)P&(jE-P`g_T(|2dcRw*<c64-H#l+MwH#^fcFwknb(t2YZM4)OvXm6tAY+QZXvFKBvL-g6*`tav zRBnAM3i6-$k#9Fm& zK>K8<>FdYi>{oSl^*$I=b5ql*_qP~?&1$$flXRCcFvP+f^X}VM_eLdr@Z161W$lWx zw^u+Drmn0U`r*Uz&6_s8$<5XC^Yc3xR2~x-_Y}LJ|HH_}>st~5X;=(Iyu5q&R(*cL z88lRh9U8YheEran*w-qz+x8TDJDe2J)zu~IgLNs|B*aytry{tvw>sQQ5C3GnVE^%_CCIO^X89{kwmyiJ!FZ-A~ZqMwJIquAIe^wQ|~&}7NsOLdyd0( z;>lS#Ibq{3%o1atIdP>6L;eO*-~cHwkoYw#`rF&vu?E-APIV+MTC&`>`GEVFZ%FSR zso%0ulf*jPa-)|S)wQ(Vq^1hNt0+OnHTp{@-^DRUriu*2cB~ztZCI)#XD8HfMRY{O zNpeN1>60QaR+Et$l;UCOg^Tpf&CMqUQ!07U=TDwI2|VhUoF_+oN2fJ-$iUd|o)9^o z{(*tXpC6eH#gNf#yBJ@H9Kk#L`1lB!R_&0jNxJZH#UQ?t-m^1xiK!nJ?7mKKDH_gH zok$6pm4`1#!*Xvnl1v`Uj>mqDNls3ls6Ne6az%uXm-nn_o2_p-{l$yz%a$!m8(;=Q zJk-pAi+iInhICSGdK6vZh6ajSy)>?P(R3xKxmoA(rAxL~FO!FkNMov;w6sjvuyJD- zcC+{6(=3G>(Nb~o?SHN~Zpv_;6K)=QM=I_7`^9(e-fhX*j+;X@F=ZcfZQinl_rL)a zWH{?&U3)F_XuH{n52>qxcNL>F90|3H7hiQ(h9qjI7&k54N14A{#W-=1P}#|sAI8MS zP8!Zn8p0ub>mZ98DJ*D+ymP3Nh(&XRS#4zBaL!1&!x8dT;4xDMr!e%KMRTewCTPKj z4<82gNy~a{S=W5SpgY`KvIY|()wWMn;o1K8?Oo)q%mprvxvOY-t(ZJOEx8Uq<%h!njBG9`(>)D zj(N!NrRZ6o)bAaI2NR#0rt-vQz3IH_=EGIn@2lewb=UuPR*BiEf8LI$efzkXW5`Ti zwuaBKb>zl^6a?7%+ z@?E;tXOmUl@9X5)zSn5Jz}1d+xI6y^i#Bap|MeFkv|;{wyor~+1{!12p+c^*Z0TjF z!G#VJ3xD=}$7j`U4#sw|20j1Ot(qN*O%X{nQFTdA=O3d932L6Y@NaPjyqWE=#w&#S!VR2|=F}H7b87FH4BGSZaX~?WPlGX!rOA_n4+eys zKb#NOcS(&(XA|bbpZ>JX@O^uu?ejxCE+nGth6sOw#swn=^AqNGV)_Nl@RC6)w$!Qu zyH@GWBkogkIt2xKi-u>@xW1HMmu##(HCp}BCqkNO>*Y;`?4uQ;qNcNR*MioM({A_W zH3_2^E*+Yd`qVX+^%=D-O`VS5+QvED;aAVs(R#kN-8FPv*qf{wjjO}hdM_Z#iEq~F zyT9jU)w2Ueo;^!iXZUyq^ipP)W=?5(IJ?KU>Big+H(utHdB&$^j5?{Wop&+n8J9le zCmN;oned?Q>!V^CHC;R-at@oCJ<~HHvP95riCKoaQJK0?6ASD2qT0?I?3W;&5yMGB zF+$4o&eLP}oY11r2L#Myp9L+J(7O`(vUq6U!F1BQS;Id0e6bDbr`ns-KkK66Emtz= z4LaSz8@nv}oy%2htkgP0+A7NNX5a0%^w}5O5K}p4;z<|X^7epcZLXe|*;q~2HcCsv z;rDn=%He}D%{SP;e`J!XEAibUY-b*KO^Ie!Sn$xxY>-yijXu`+RHPTw_s#2crt96w zLkX8N0&)27AJ?{EcAe~SWkoØ?~!(g}Fp|bp5TZ2**?-%GaO3li9ywJGBY?mhV z%KbI>1T|GSmPfoK}mrAHN+t;;TdA1zae$5OlYxhiD($?zFuWL&m)Rq|i zwDFp~z5lt(3zm&yyY9Gnm6t_R@+qvxPJc#=hxAvGXDGfqZYwRCW;dXLHL?F~F?))m zq-3*iGzp5OnP9rI!{T)_`Ujg*6c!T)$>SxKRNF&K?eTNy)DApx#SP*!^y;q|k`{gP z__6eP;w3q4!{gR+adE)|c=3)HyNQFh?ccrEULu}hM>^YycA~p3XwUI1y29K&34?nwod#Tawwvv*Pzm_tI6D3KrDBa(a zL<&Zg7{9kUbf}w|@hsHLBP=m*HD!lId#*No8K=Rw#S3c}Wetk2AaI53#p(q^t$-z2 zJPW6^8aNLLuibX=oy`SNRW z7wq@3@$T}JfA3<(%sI}@&FwUl*070%B?fVD#`u(Ic_L4+<%y&5xd)(zR|9_XYwsRcLTRmR(AaU~AwQI@0 zSFKu=?4Yf`TU1n&9NSd{?1h2DrRr}>_ZF=f>a|7)-aw1jz5G_|(p#-f%*=1MfH z;smb#{CaG*OVGVq$$eVw)alcI7hFo)_S(+sFh&l^xSKZ@14KIOLjv}a>#e>Pi02uY z*z4dbL?egb-|HnPVQg&XKwm_{`>C|JzR~c(rlzK|^72mss?YtrD`i?0dWU6} zo;`a5XRG(Q$;)cI{E+?z6zIWzuj&!w)vmocTtSq1z!Q8sc7&c@N|$h^_ugWXth%{u z^``afFN|CpEG;RCuD2-m+!l_+)3Sz!jE#H?PSln?5C&#xgopPv1#bA!uz4~x=z*ta z9ZV*{A7oXvw4SZ6*u}}oEsODMADhVe^y$;R@I8r0=YwZ~S6qusc2ppEr`w+!FS zq2B(;ks~qj@!XlDn>DNT=*AIj5Ubbm5dS(fRN9$7sG^|Y1vis>((|3$aO)8akOhCN zHOpqQHe{}@o%_hstDQwW5)!j97I0jjK6w&`p$DgE<3bpt@m+GrR20F*>!>I`>=C$V z(IO|{Lfm%q@7%t9ST@w0CRZsr6Gyy4ppF|GTg=J>g=MUz?E0Vn^(3~la}M?HM@9#& z!O%S(r!HD@G=jDFd-^m&)^~T`RKa{6l0Ap?RlSqU>v?4Z8pO|kB1R)qM5fs}6Z09b zX!p6{1e1hqy%E1*zMhig?@JksgCTCy(FnX=j}*)s;7p}@LHFNsi=7#C)66$>4wC`E zcc7+S4jY=3ef-#&O^;7V&@eD)S8vfe-4vg#dw%}=LqW7J7xKLM4RW=RB$MGFE5Y*j zRyg3!_YpPZP11B5(yWdjzd2kmKNp*>o$r!WT3X6w7xM0IGY}EQaGt-ijYG6_uslacEgwom=_1FYwnH9L9YUBFm z>emAL*(5SWL}>oy*#V5&fv25NCL+3U5OevJR8vzUgwv2uojkdhiz`Cy(cM_*(Za3j zIy%kY=}Q+5a5btpYE-nM*9d|Y1}XI^W74b z{pY1~rX`)}arv`!UGju!7~^v)DmxKwDF7N=y;T4K9F-w&l^)Xo+cGg-ll)>7OL5+j z8ZK8?UvF0C&!7FfJ4o1JSg-Rp5|yYe=@vS<*RRG-M<*s~9y@jew&fgR7#wx|CMii7 zCz6a!O$EUJfj^unkiE74%@i}r`+5dOX2a=6+nU_7dEfk>*(ZUKG9pfYV~SgmVlF$O7 zsSk!U7o?t(eYK|%GxWD)B#w6BNWPjHRrF2&r~4cAe{ZO|2|E+7_4bv%>x-j~sy?>8 zRbd0e1DJ%_Bl$CdZ5oKD5fyLYSc-w0al&-uTildlN0v<#W@JLFcYlAseZv8~1{=c3 zlJT``*8*HDI;Xy>Dl|J=3@dcAXL5*yvj%oLFDxv)cJ=BLtVJ^3?C~n$GG=&p zmP5v#)AX*P*81(OV6!hw0B^9qu)ppAN9h|J{u$#U|#Pk4lJ~e@6j2k`^n2 z7k|fo=7@wAOz7OW)Vx|v*H6o}KO6XV?mWhH6mmm;Ui(@F(LMw!s^;b~=r7Nn5cfI9 z@)t+cpg4*jj*W|xzjNmf3FjR;T%%wT2kN5L(7g?yL*cJL-08k0WZ-fFogF9W80{ob zw5{B2Iy*1qDAm=~FmLsN!qimr`WVJOK`}8Mafjh6Hr5W;uGPFc_3$Z7H4MT@P8m;S z1A~{AxuY_LpFX8V3u0bl`#-+Jha0aagoVA=l8{7ktfH1r6B846E4_@Xs#5maek56; zSbD1V$q2zH-l-ghtf?%Gg-xN7_H@UvU90{JF`PEIM{zLeo#o}V!#)XonW71a2%q!w z^MkiU@^5*F%(Yl_G>N;hrw*WWO;gjooC$27F)(i2xN%lV$x2fSz~^+(x>!4}i8X$pEmXWuI+X^@td=F}e@CAKd~E?^`r4^eL0)nYasEM9hZ?F|h( z6brb6U^b1*1G#0%n6drwc|9IWW){H*up@%7U4NZo{33eo=7rY@<%1CmeehtFY>o3s zUKDmNa40?S#n>ilqDA}o@#C8|Ywp zCxx6Rg`ly9@{2M>nU7qHAnPnJr~%B1vuDqe$kw))%>fqbQ+pRNL|ES+N5GB(LmI%! z+l(Ye`cO+$$lOF!Hk_d$eG<}o7RXqRC?#^ zAqDk1!5!KrH8<)#*~u}l1zyK#yj&FHEecg6#8r;aU9@L7cq98s6@C4-WA)@V2?R8m z@VQnH!wHZ;F#p#pjAXW^F7gP8b*rlv4OtJwXPAGu zy%Nq)ooI(k__Jrs7~eJRmr1ks?$o-+*tjSo7=l96&ok?&yY&a_twlg&Y}^~Bx9uHbpo z{jp*=4l+;f+6tPxd(`G_51L-Mm(#C`KlGeZK^)oXS{v-{kH+#yzZj7hbg$_}qUU!p zHt&Jyv}K6z{C~KX+vDO?H}|Yug>0bG_`5 zBivXJX8Sb@YVLBly(#$9C5XlDt&6MckiJILzo3fPth{tei;+mrK$l~9D%TeU;18*` zr^9r{UoN(`z&l(5ULiZ$MB>tv_^h7zf`^fsO2^M*%(7LpMP z(xtJztFauhbL$MdQsZuTbv;>p?Yyn}^Dx z-!{=vXHScqL$QF7czoqJ3WxUj*#3?PEqTp^IIfC%pvIB`1I1V;(*>gI<2bL9X2cZQA}`W+{ROh?W{PS% z<2hP`#KSt#Ll~=pM>)_iCY6S%&$CzCn!pP=d*+O(dJB9Y#v{h96}$ZE^@Q96;%~G~ z+t^7A920sOXqmT3X8POwLBJ(N2LflgY4?l&cgb!7Kme5F&A*;D!A$%9c3l;if5pNigpIt zizg`_%P=^7UD!g~bI3e=8_i8oYU6o5ansqyn+E${Wd@&;IV0MjuZouZ%{b7|Z)8}W zw5Z~2S)wp|6jJ%-=Orn0ky{K*w2ewf!w{BRv}M<~ciBFNy(_w?t(hYr92$@>SY?AP z3HjiS!DD|~c+qT9({i|L{ZIG=;N1GNA6W!{X#b_Swx+9No>ts2?(7;E5bHm@_sX@c z>qFACWePqnKb-L^C2v@f3D%6&f;FT{99S56sg}4sS6`PMdOuda_CfHq$@x8tD7}5m zW*Hj?Y=70YvH(E6ax^4x=40A0b;_UR8_mSjFvueR<8+gJtasxx>iC7Y*KUCud%wK` za9w0tB$Qaz@WP=^__oTTTN4?H6)fINA<@FdD^FheBK*iXuXZpe2>c(lujaMW>}10v zXdvq7_d*QTw#BV8Wq;foazso%-dH8ESrU#nSuCEs$275Muk}n07k}X8RgZ&u{a(Ci zjhuyfPjjDlgHJS|SukBMJY{t>&@$Mdz2?em|KZN|Ut;4@7j%KE?V!k>Ja&$6WXh6l zb3onqkuI9R7N>aUk_;hiwchMo*h8VL3u_a&DWUJV{$Y_?=j*cY8kz+RYSG=-zf6^2 zKP}}2CE0sSJg;fBh|E#yRi(1JsPh!{Q}i*8ThqsdXvmlVve& zH(^%Yt*m3=5K@R$q6dBzko7(~c8@IVh|BfK&v|8L0o)e?1m7nKoOF1d(jzFMeWjmv zb;;)b*^j9W0QL{YOPb{>VO3EEpz7c@D$O9~F#H1S&8AJ8Z1rav>gqmU>At<0Liu&W z7m1E~vDMWRR}@xWT>q@XzU%BTeV9St2>vRspkRZQ+c+!ql?MX2C`sN3@_{47>bo9= zGcuH&fbieeu>7)>3^2EuLP57MFe8S7c@sYDt`jP2w||cJ@)+h75z&CigDwC^dSb`E zlMIJFoQJbcBaUz2OU!*07#K($p@g<%T_1ggpf9m)9h`{uk;O|Gf4I+2x%)kT9$n1g z{$jmD=-ne%zu$iF@Sz>Nk(QiI2r@(e!ljHq5aiNsuiVIdm7tb8?gL+ZfivrM0f8)a zcz5iwv2j0OnOa0lG48VihKM*99J){j&`6A?!>w7kYSB=8p04{$OUEUsOpJ=wxMGk^ z19yoS9K7Nj0Cd&~-rd*G?uy{pl^b{W)@vHpBc>hFXRI24uS#u5&?k88=FOX5KYqM! z_8XIXRj%XsM7#4yQx0@eRVN5CYL9@NHMVqP>x~MB(eJ0~>*@%#3MXqCwuq3LadG>Q zXkrMrFvT+S+wve+c(e$Pqv6rbYyws6Bs5&hcsMi5rl+4E+@$@`IC@K#ufduooq@bE zbpwM0Tn&sgIws~U(88F61plTh8g_PR6(LfIh(Gmnud5*8yuSlHgT6ij;9YQmVC15c zl9CGjIvCcnL?D_jX=}@SXo&vp?IV!z`L)A|`O`7%&VvVTid)}7F$BQIj4G|H)RdLI zUs_hC4wM0h)2!u?)Wa4Z(5BTOJSUtf0bz-mBEOne?Z8g{Z@?P!vv(5N+pkV)Www01OEbi z-IhNY-$~jJHin^>Z;CtJ`RAYImoH!DIdn*^!)+$M;>D5hW4D%kYg6^zq}+&!5i_)kEG2;KTpKy>H7t%=VtGO&eGZfC5&| z2=DDjR523}n){Rfn;hxrXy+CwW8cGc(a6XzAmB6<5usZFJhz?e{F;BMWCMB#5ld)2 z0zVSGvK_g05>UmlW5=?gpGt)u3q6W3@JQ;9AD2$aKsB9Ne5FG3`+=0v#$Lwho``mbljCGG> zwKW$4^y#rOK|53((gPkYu9GPyl_EFy=!`fN%mhPeXmnH(gT#KMy{*eG;;0zym-Cy9 zSdevwuZ1ZTQ$fUdOa2U+NclolVc^uqJ=-l>Pz^N#&}FAA0%GE%T{6n1r$!PD=f(m8 z#q478%93-Yr=2kE(lTewQ!az2jRb+*bhM$lDt~9%alSeII5Puc@x$StT{1YN0-`BV znFH%Q%yl4M6OI}Jh&@r8jfrE9z~F7izhvx$b9VAEEW@JC^3)EWiF3cKmt{^h)Ue$l zUJH4s{^ni`3GYs%SoR|UWx;kFBhuty!~Y_YCJb-Mt<|4C9)ex&aDxT5%P%=Tf$u%@E7 zU~E<+*BPrb@yg#1*rY6KL9N$U#Cw-hck{-^8DP~vOGsNk$MTaFXX2|m^2MkV8#7Yw z@k~)DLLm2@9_w1=)vp*Xn43(@(qPud>^_NlomEiq1NLK?GbD27_U%U0YvcCqaljgK z*xc{QaTuBB6ga#8&Y4f*Ey##YOfK!$ZFMMFBN|lv*YVG8dPiCu^(H|YT$xnDg{jGE z_js;%kOglS4)gcy2pXSK#h$(U^3M)JNEH?2>c9ZFXL8 zC?PIm_X&FsQlhtHPsooNPlFwxg-gu^N^>K-d~eeFrs6LLzl6vm@cTKDswJ=@{ZL8N zvs&ebfyW0)GqJzJW!y`|vh@v7*+MA-xF~)&tA~BDGt)Q8D(%AhwfvS+E|KX?9uho~ zx^V2hct-I$L8&AL#RA_S{qtLq&~L;X{U=p|L5JH`@nM>oT!>)nh3|KBqNQU_1HzVU ztZlX}78y-BT(&lb?z3q?jLxa6zXnbsG2I&u#wB=1U5h&6lNP;k%ge#j?bms8xQt?Q z>a)cqNPE4|&@<3(Z>iHfpe7F{x;2v~!87o}g=XA`7-oU=44#9hVWAOCyx4z{mA}-c zyzY|h@K>*P5ru@Co10G3`5Sp<$3!Q(0u0T;boDnRhFAipSJd6RR%*qnRW<$fv9Mz; z7lYtc#A~O>K*pu7wGAtdJUj|a!qq}TLZ(2~v#r0~WOw;_Y%TNtckSF^tiLe1;mF0o zGMmA?1`3(^_|V)gCZ?{B!k;KPs;gS?rIO+gE*h&2Te zNx(|z((bM2Of{?B4HTL8;K3SP4(By)9wwwyKwFtFVdEEV!mOy;V)CU!4-W{xg)2p#;;#BA$lQxx7A3>pQfaA~o(^4vEPQS&R{! zVbpRCuEMg_TYCRtwS@Q3y8}C-Yo0y(;GZ?yUbR>i1TT~xiW{n4?L6^Muhd+p)C6=z z1BvdlvBS_Fm%o%~X}|nUOh4257(lzTva(N*>NlJ>WzYr*I$dBj-rVBT8F7!@Ahifl z2kwDDZY&Z`wkbo+$=BP!r=`LV|2;izf9|=djJmoXMr*27ha>?N(_1WS;UEm@Z$UXa zVOfI;&34JW^<7A9jMg_8+OBlA_`x0DmiogZEhY3w2WSJ}D_fg0dluAPYDyFe0e!;w4M`UcPjzm;5`LcHUn<^@xt~!YeGS zj>QBHsv5{Y=- zQ`(1*A6E_!DXXf!!qMulBO?hFlnoF~7~rULz%qbYibN2_i-|K`ZsisZ(Xk)Q4drd0`;9*;w9St29`(Vv^RVG zgUx)Tm*HzuYa(Rhn?t^~i;%w)f)7qwSx1K@QW8I~K14c!A1qBl| zmrY@`G4GV%U?m0+)vc5bk|?~W1e-W#YP`F8C(j>IHhUfvp* zYr;jzf?`*DID-y1tB+B40$`i{rY6A#&w)~ng_K&hqHn6*Iq}cz?2!I0RB`(zh%KW= zCnoAJ*Ix7MruPCk2U@Fv5ecq-A97>~u?3x_*tH+`Xo-d$JBwR^nKQBaQx^_Y(;&=6@d}q`)mgr4`67V^+B-Y2jm=dG_<5?<;9K!$JN!1bsX;|YEkE@;d+cO zbu~2`{VBhKKu{2H2V+A+-|ddb$<8kQ>-Mf%xw0BBRcO(Khg!E`@?>K#ypTVC{&*IX zP><*~V`6x@ckhk?j}1p3ve*C_FP7JkE_}Xpu;kJ~v&JMy_vIBV9sR*v0*5dye6YF5 z28jkyyXBvSLIax0n`(%#1WuqDtN?_0>iYWpP{IKY4hB(%j*!vfIC$yaKTI46AjybB zj!{A!-f@b+6)n|k`I&-wwQ3>nuv`fe24pd9>)AR;Q9#XU>?sR#zDk%FyXT3b9pwp7-n%*4rcMh3ei^UTLePQ zo2Zd{0G@%1km=gm+C;q4+}eRPQP}#cGzNHjV`P550Rq~hUAEXIyW#mEle!Em!=QB| zLqqWxhN4-FL?D{E1!7coBg8l?;`VWmwjUuJtk?AE&*B+O1RF0X;&h%^bNT|W#z(P0Y%yf9kG#Bthv zTpVg6a6j1t2|2b6`VPbhlhB1kyzplC?%O91uJA9B$Of)1R3AP`vunH^J`C!$&hjCW z`rt|%V6goH17oCS`;=BOGHPgPF*oEdz&WV4faEr9~k^jow79_l3pj0VBbfN**gCG=GiQ&D}g1o}JZvG4KNHZP! zmqUb)2uI_9Ogpk0f57C8jG+mumP0cq%@hCt<>}K+!JzGt`x6A$u0GLF>hI#pM>2Qv z9{;slPeVcy5xUL-B@nXYJbj(`a#u(Zg1-2M$b>+6lW>_7ks;V)jj9aBFL)px1`mF= zI|55Ma@oWr!z=_^FytPk`|_e^+Ms+~L|JZSWksYIVy@Gv@YReCS-kw&E~%Sgsebk9 zTZq+l>LroT;M2_33?|A9TF$(qR!_m6rI{Im>H_t0rC~Jjl8&n?P-VZd-bTiutx$&F zR=P~7Dns*{0`n{q9)alp+@(tqsGzn*KHGogbt-~V9b~yx$N8&%5+UtT%!w*&e)IHFcyli1Ld(&tfHWl3GB#9?5kBP7vg7Lbl zs`Dc?Rpp45HJ}7$5%KVqq)<|~V$n<4CDJY8C?K3s)IEy8yzoke)mv|b>i^P98IM@O zjalRrZKZ#MmjD@>veMDf+XPu5l<&fn*3^Wy{inNptWxufO(}D^mS^H0gP#l6@ANgM z`C8C6+92rsks=b?G{-vPkQSm#IKdWeuD&tZ?4n}$ENr(hbnip1%qFQu9e**oWPV)$ zZNAymg^h~H9!yc=fn~4cgcwKQ3pjN@H<|c$mjhb%n)cVn0+e2%ru~H36O4*1p@S)b zsQJ>1!@3)~Bf;14#%7rw?HOq=XxeB+8^XJb+0lhqFnTzk)vuR5m*Ba(RYHlJ|aKaVSt1(wP zRq}xKH$T>?zI3TdY!~xFgslGs=Mh7;;h_UN1`(@&p*{YB#P~AaRbzI6B*s@T0nK~L1 zAi~cIr)U7O=5gzmgldD`;zgJ@`m3&KwHN?vd3Oo+o+z}%stN0A(1$YO1A7gOzH%t1q{;Iak$e)iMQzM2KBrqlna{)Hc( zpOBD{2n&b~ga9_emrFN+zBe7z(qJf1g(?K1LY?~b?Ck81-tND9YIK1*cy8|EHUmXh zUODK8q1OCoyRLgT+vO)fyqs9k-o^lj_(AZX{lXw!1`}yf?o*hCT7?NSU??M6Oqc|)6V2|@w?E6qV_=+^?Lo}Z5OP{Y+Y?VNvuQQWN2mme0*LJ z$Q`gBk^DjLWjQi7DDZ#I3Gt9H##ACIWMviJd8j-=1+<{OiNVa$8#C|9QZ7Qgyp40H zyb0ArJ57$|s_2Z4Ts$s8p#+m$q*G+NTi3-ZHFh?t%U-MPPr+H36D{?IZsS^dsRgaL z+|?uFAIAaPnWl})MV}{NpS3eBj{-LzDkKRD;MP4tt2h1&Uy_6XiTwY#_CtJA{TxIf*GL;AC?lKGL&p|fy9r& zhp!%om@Ipi-m;(xw^l};1#SUq3s<8Cayux-U*iFU=3o`MQU$uibKOW!v8)jmP-nP# z6#K0RGCVvevZ^>c`rnWYLNHAPZ-M*2&1X2wzg4NfKR0izp`|Ml&z7?h3Lt|xn zVa#vyZnja^`G4x)oD+ROU{SzQpNDs@Wl&$GUCD2(ycz#YZllP$WR^hw%)O$U10FAH zZPD4aHb^?QvGhU2qFN3ANJb6DKi!uZRD>vqNS@lMx@=k^r?x$ZAQ zdf^yD#HZrql#TVs(%cb8#>6A>N(1Ul5}w$pmBId6TEQXlh+V@fB9Ads5BVCm>~A0@sIyuCG14itA5a|P=;YctZ)`XG1qb&(7qm>j|Or>ETK9VBKaYH#IR zP$)k?f{UPJ1{QZ#112Qw(4qM7@DqEKUOuhtsYL)xlA`+Xv}^>0zz-4-;}cEKA2~%u z_Q%P&;}zmg0P9n)G#!);JDm!Ley@OlBJ`U}l1cubINY?a{=Tp_a9;oqmCNVA`$ug^ z(j0k560*YuBZ{NoBQ`Sd4(p(~Vw*=xKp7hWITHl-riijY!0(r0LQY-WJT6!eTh9OT zp5I@KB&*40YGR*g!EY~&?2%`fL+5wElcZ$a5g*A_Bd9M?&fc3M+OS8D7|C-?Dqq&a zgSYMevMntmBQ`5bn*?YM4jE2PPIa}lMsE2ozmtbEI~fVXgMhXAQ038$Z(%(1bxE(l z3smyrkeXXQ$OEErC!B7IrSpk@)~NiQ<%#B5Py_dkb(Lj9t&c!>Z%E}v`z72C@ ziOM;&%w2IydpKX#vBWAv_;wBgUn09D{xLA^M~(pT<3s-Z*fVzhsA%+4z+v_>3RoFt zzm8r<#21CQbQYqrDx^22!oNpt3;^tXC>LNy5TZZ^eQy*2BffvSZ+_)U9fUKn0R~Pb z2bkNXpChM^g_V^vvggN-UPzY9Jgg87WNs~okC(X$(Ov@>xHytIcxyu=KZyf2uUTGR zfMKRW@M1T5O32z~5wJcp%9x1n_;(2kDv?CCN#xcI2Aa1<`HK!{>3VbZHJPywU6*V- zP@X&*%|UI7`)typ#Bb%##m3LPN0#@EWv#Ao6t`^O%P@1-%dd>wMw&avmI<8o`KP!e zOj=gvldY`N5$A}~tr3&4`>vj<*s|h%jjYO4+N+AhuAKb)SpoyD)E56cEiO)pJI@

2$gk766t9r)WK*>1 zbu=01)r3gsy3j+2GaQ!toj@UB^iC-$DTbjs1x_hwJfvW~Lc6lxS~i(Q1TS#hc(X}+ zx!ZGBi~;f_WmdO~bobLdNTIXq|FScl1+_7kHHa;UphMB?5ZMb9NxX~1?Q@OjKfqiN zul(pJ5}!Rgfj9^aBtsHH?v4&!QezUe_#o-*xpP-w{P~~=T_QS<@OGi){4kEx_>)P? zjU!qU$cu%AxA-A)Z32d>aCTfm0?`*O=+i6_!$XNX^KeINf{sTonK7u}yXP7@!GL)Xe%vuT(;gYvtEPK((DS<{nkYw4jG*64Y( zb##<1TfKLlRFIO&GWeQCgn$T<&@&SMUu|t|wTH{^!Lg?47T=rlUzg&xPw(?lX!T3Wr-&ADbw9n8&}+goTaNJ@9>@HGhOs{aK(aWk`i}Xp8L0|S0!f~`~ z2=KTIfpRY{gj2!3CrXf&;vf_B_*=lGHz-M7Z25DJH$A&IiG}ssp+nWX9(R7Vw?MfC z>FE<8H1I9_wWhnjA8Aad)NB#x;Oe^3{7i@Qu>}9;Cs0iCP1ni&rhg0_tZ9rB3619k zsz?7aw!x$JyJrc*t7yaWcO0kma_;so|FRP!{};9Wf5Mcno-c$GsHyjIE*b%va-H94 z>$aO{C+LabmGSkATQYF@O8uYEnST$2E`vfI@W6c{0&BN!-ADR1JWPWaF$Gshw~vC) zqsxaCM+DO~H#NnAphf=AYt*QaZPE+OIcy9CB%>P&Lvl}cs)R5`rntWCu=`9T{X|3{ z$mTfdG8UlIV9RrY+(Uw{he(XU=L8V*RR+gpdldj#6I=u&42j9KBv2^?e`ZLRa5H|m zIA#(mWC7wKpf|AOUqyI~`#aHkP82W}E>MV=TRbUH@V#{(0by4pl=$+cD)170Dl1*T zvM@^aEO6*k%$rn;qg3x?wvt3=Jh^_qs_s-~qbZ>Fv|1gIN|1&`vajb19JFi(bwG*x zgMP^&a#%`zY`V_3#x~ijvHy#uoJ(Cc+1SNuCx4Ns<{Wq6hSmc~-D9gojYEvz20L3o zav%hDrYuTnI=`_ffh5b7TXU3;9f2fbdy!XpxJ*h8ZwdAw{;WITKu~zVvFOh z@}XcMo$%1(yQn=+8NN09s+@E|b2oI%y_Hegthl+XlA-ORW+>h`nwHL=WLKF2u5$i; z@MA?0>E5DlR?o+`iV6~)+nwaUWDkr!&3S6}&)wCTYMOPar&>z9ETBuCiDDkKlvH{M zLXPyMUOkQ>BRnRX`+H4S%U;s#-;4u3gVk7#9-|{$$?Q!bM2P@(1)%QzBwhvAOr&QX zB(=RU^v2y6CPm0Qr}ASWN4tH=Os%csaEB~1uyjjiKT}UV2}hQt%eBvz@aFEBhY5D^~KQs=&Io zr+V}4&kfrb>xLV$qaVqu5jVy3ckC707xVO>Vvy?{(8NPDWcHJ@u785sKWZ~PshOrD zReXz~JRCM_fQm_2NfC%S>^E$)w?IvmpR^->YR3_6Arg@CCc?}HR$xOv5qyBWNWS#s zTb;nVFLx)DVlCDT5Q*e4afKi$agDvz(CeSa;iGa1ck|<`Qii!2Iqhi4&%tuApkLP` zPsN!LQ5)fJ6yUmg~L zc8LOYnL8bC&E~FITZR)sLfIgf$tr8BUqxFooe<6-IcufRo!%PZXjs40Ve_Q@n3AYj zKzi2Y{{H-DIO$ps{<(LzFX&uQw6Egji)jSkt9^*4lGau$(Ks3;a?AKOBp~eBypqaV zG3e&3^KRHtEgHF>)Su5y-AW?|+%K-RcDeDF36|3XNrhY~@82zU=&}rOqJhJ9Xv609 zHN>q~=dsb;VHG)R-7M3wvQA zvJBB&5n?Q-;f}=NVH*_M765~o+{uPmU62NW(FuZvs&$o}bDljvMK-RX>UTY*Z zcXjcnr-IP6nEw8$z*8n4ajeKA4PWwG@oknecjsKzk-G)&iaOIWwa4Bpc$;Y{)F1`dXyB=93?WNc937pmBjlUgHCmpbYS43%@Zc!T`eJ|2=TGEN z5G+QTI@`6#)WBHy(^AW8Y(e@|nYbqkxA`G1^YhzC=o)2bE@!mG#dQ@JdqDL=iNn%F z89I@)oj1xB1^l=EeldfKVPYrIW+1R5YtspCOt|UGZ>)U((crii?p-6UsKgr{LyLBY zs-LZ@HW4D3JkO89Q(-GA@e?>!Wau8aqQnltzEe%J?h2a%-ELaK#EF1xCF5eVq2OJ0 zqje+7`NGU=S>ca=^+Bz{o~;fmNv2uR9?d;Gz-pK?s%>jl>#&NDlofC5h$&_=N^VEx zEvD`BZMAfIo5mkX#s(=o^$LX&&LFo<&NySB3&C?3L4U2{Z^k+lTr(jsGT*haBq$(I z2!%$=pGk4miZ-h4uBRdz&)uc%sBlfLt$s^pzt`GVYc=RI$?wpm)+f~HXjT1-am}B^ zrsf(`bgQ(BDUzY0fcM6~Z1!XplB0|3)W45JZkyTF@!M-f`PdpaWu41Bm5m44UDq`{ zoJ>oz70jP6z)@i8pW8k}yJp}KPc5GPSm>?jwdnp-o|{L_7&{Un9+Q)omm=bA8{zZ) z+`4m`qmRk-NnY}o=@OgEBi7UW?Kw^+;wB0QEL*5F?2rC9?6Jv=hl&==?%K02tbv-C zBmXZbNvh{fGV5ga)`UL0RopGF$-!ZUex`})wP2-lVkD55GDSDRCP>U{(AUVA1OueA z)iYLB!3GVOFu1DA#>RWT7bA?B2*n`uOBspoC{|H4MeEav(oIKXb<=%wBb!p1j zKP*af0#Y{^M!KH6tn3z;LK=tKwI*TQN6nbyv4~pZ{r>hE#c`DqYvC=w?vwglCp^`X zf9&jCyZoUyR0I0evMjGWuH3zv&v>#X`57+l;v2cI?sai*-2Dx|9eCEw7|oy~^`StP-Dn(WCoe*39q0x^>Sr zzXSwkbk#9c;JbVzlyW_7uXUK}2!D*DFCj6pS5^O35LlI3U;o#_ zUa{d-fxBhT-Ixc0z|2ZmpyLY_1M@-l-cgVC{@S=0e=t@P|2C@j9(X-V?f!4Ewlx}6Nw#0-? zsjYKdubbyI4_&xXT1H?{()JhBlwT4;Kf99qYIqWrq+~0kUla%_NGsCZl_*_x>bZ=Z z8#D*I*kf}GUlkmO?E6M)pG{cEST?`~a}(&DA0q6@7dCJYa_u^HV~ulcYfgibC$@BN zjSd|Zh_}e{gI8?A6fgNe4yWUFSok~V``k#=wZjjM#u;xWHNvBKQbgtI!kznm@~(SN z^lnNW;TzlqefaKe<**xqmDmbh1QGjtU=HP!z&+FRT*U!LD^{$pq&qZdx-p0fqRv_@ zH3f1rjp@G0M~m-iV_Ja^#I;@Q7_D?v28HdlmdaQyfef=D7XQHXbpbasy^C=@JF4QXy3WNAU21zk+RelJ$P&{xJuA{4 zI9@1MH=yuS(^u-Zn_XMKkj&@Nol@D5AFz0Td~U}8c4QTX_-TK}s-vkB16v5msBFS$ zqyw*qYQK8uAu02E3oir^Ny3GQPzeLVc}mC~;CYsklr$&i3*odUMyWX5k*iV+>i`W- z#PM(BdTQRV)!kFRr z38cHBn`1lZPf%E!W~AYv|{jxuYq1 z1)AtNW^=seWIRAF%wil1m0SO|;2_6)4zW+kE6FZDlyS zfoJ4ufx_>HPm~Cz0CGE*Y{+@%t|U4-v~uHe$Nt7?k5+Q$C(U=>JAMeqa>LOU(ppDE zE#E5vwr{MqEOPBxl5?DU)4pc@rqe$#%k02==ip- zkK#MnO+8rO#X1vD7T5JWLRxMCR$w`kfJB5Mg9d>$*06YLj@|~qt}&j)$C4zqeec!NCZ4(<674?}Xfx2?haO zsU^gJ#e8I7%GG}iRa`sGFl01*K!ofjl4rn*&}>WI&s7;ocl@s|D%9r1>Fv^CN;-71 zHT!Jf1C8%_lsE{QKQF%Tu{L=VO)XBffOS>1Q++nr5 zJ^J&f|5guLsqfx*XlQyoQ%Km@Me>3N;mF8v$s z2r7iek%^R6x1)b75bay~QfM{6wc_Z9_GjANx_DVqKNUUCj%U5ju~@sgoOqXrq*vlX zAyc>1BcW{frjE89>q9F@yn|7{F2!@;R~1~b?A?oaZwPuCfHhBctv!XU% zo#iO}>6Z^6wRUkt3K*ecf!tw&@WSB)|GGWJ3`h*=?)Pa(o!{1N z-Bm-#^`VY-aIIS@LYCh(t&p~+65UF;QsCP4X%$W>Qbh}iwIQddCFqMZU_nD?P3EKV zHg~rTty}l@>zrW$B@?!*qGMKnv@GP%+IUaa{5FLu+Ir3+Wx)U4TIeKV*YnkQWb$*d zYJagpqRs7eGNb%+V_%3HqMBjbF*B6lWEnj_i?Y5( z?dbhn2HF)Zw9H24oA$h*|Ap8TnssD`YqnVzJeMKPA^}YFC~z902*I1BjbUq#g~%;$ zP9C_pW_S#lA=hBlctg%(%rj-=oQIyrUoK7!RX5mMEKNtRhIY*SJr=4F^i7F&Kk zh^l&1ceI`t42P0laFcx&Sp4p*7%Dy-fXB%KJ#ekkeJpj-U4vh(*wa7Ii@%Dhqpl3E zo2%?WUBjHO;N<17GZy{<>k%3^VxtA2LkJ1m+S+P3VxB%t!9r>K=?cp3xDy`;Jr!6` z$fvBI=c9QB(~`B?i3Hh(82u?!d0=cXxwaqkEZ(RSKZ}HSFhO9MPW=G(cFVjZ((drl zVaN+54%4Ejtky9|)N8ExAd;sIDp(YotxBxR;I1h(|Lbi+fWz7QMceN9aqthCx5qQT z0as$WLN9+b$BHa%t^4rI>j|0D`HSfUlo`BL^j>Re_VU^xp9|GC2>-+8;`&uZ=z~q; zAKu)}ol0{ed;@+D8nAnwinu$a8C~MuYGQS;bM~W9#)kN9Ye!Xr2OzG`_*Gu_h>P9B zb+Os>H!QXU(`mCyKDkd^_tj>_1Qo4=Ub#EBCPU4?)$`a$P+jOvW5Ha$3iuh*^$z$Z z`Db}L%|__sd5q%x$%_;2ncjaDAF;l62ao5J>qa~UV-vcPfyTKGzmkY%oaG|x5F#{} zx3T!{Hj#ctzuykdvf9Oz7&GDTvbVNN`M4`mE1voD8~hv01tm<{kqj&m@YX1giHt(i zEdl@rVRDgl9@a(q_LsF4+Gf$OfwOHD{7ClYKAg`t8 z9Xu@w1T1Zm0NuX(Cs;1lwL2dKHk{pcw=iQBq-fZzOnth5;D=}R(zJ(x-&yfsB*`3i|kk z0J2RAPLB0^gwmb@_rkB_YNdAbaReotyUR9IPy_%#zC9)aw}{oLayxbg6JQ;`Hx_R^ zR%^TX27cc?9kLS4jK$4bbcdu@vx9y|M>dhwcg<^s#MQVNYfQ9;uV|kHj|o9kxYXak zPl<8X#hBI1uD%U+h1hT6PV_7OPsGJM6?r#&>5G^;@Yeb$#K1_39P)aHfsgMaQ+*a( zB_fWWnJv$aQq%w;q@2q;^xt7NCWqnW8=u6Iur0V0bv@Fa>~;a6j((zlSAftUvI zlEFGJz@0QHarfci&kZ@@%altZd+^?)82}xG2Ph&$On0|lXqWA`V`lnuy&-NjmyBEB z*4>aDyfyaor>H7^2J+IYncog$&yhi`XptYTXW-oIFD%@xuks)Fonl4Wwb{TtC zq~KXgnrJT_2N;++^hWgW(d_69_-!5;yL@QceY9j^>SZ#mz0Yh;h25F=@NAyMB|%+4 zxuEJySw=l(JrdFOeRdws!$$8g;r*mMCCD;Y)sF{b3}3zaVEwB=hi;c8rcP<68DTOb z`Z>e5$5W%Ss;-H}3S7-KJ%egmBYzJG#YGL*LAZ;%nHV9H06#H3`%aetg!DGlYQ&@T zBYmytwP!z66oA(yBAYqs<2@DQp!48^JJlJj2|J};R+JD6;iMg&5s7ASfZ<=yI&IpN z_k>U0K1{ZDZQcUP3PALV*8Lap_ZC%`@JaD#>5y#z!Aq;0_&y0QWXqpp#y!RpRS(XU zjRkM*WOjR(RW`T%@)pQ#U>CPl0H+vQKW3Kz_tDp$xonf|x?9Od&Y@PB(b_Q8IzZ0f zHofsBfSv{v2wz!w=AP2dSRHN*JJf1{{(%}O5e*!p9=6P$N{`9Ff|>o>myiGQvopS< z^4n@!Y*~t3hwD7OT)6ZKI%eD?%stxtwH=kwtP*K;_O=cFWVp;*XwYSp+x4y#HR~7z)3rHtdPDCmi8K6Q51wyL;@qyL(|P zx8C~Z!a$&AFQy69Y^4j75X4sQri64Q{`&Y0GlDWm?<7@NZM=X~?B5R#M9Kz0SOTze!)!uH>5?o6jUj zWMaS;EnLcj1yl)#D_@@kFU`tuDV+G-zCx}%FY`!D9s`YC6J8xB=#-Ko90&l-$i|y^ zaMlWXCjz>=_7$ea^DBhMq{wl`Z4I}+_|Aw9Rr?$m`8MIM)hFS%TlR2o#+HGMjNUKP z_hW>GKMgA77K+yKTFhB%#~i&OR-pkjRf6-8#Bo=Hm*!D^t-o(*uI*Fk?9ZT(uMcT*|XR(*(B0C0eT(Xo_$-hB<2{W6Sh+>;u zLL9bK-w{#KoLU2Yef}}METi}9moN)$9&$v(l1eYUM%H4^o||!#W|BrTYr=@}r6uQZ^^2x~ZEkD4Po`z- zicqcfxqlXqsW(o$KIq{l)0NU`!(AUNl$R}}M4}jZ#WqZ{e)0Txq&ocr`?$|r!>b1$ z_fNReyWXtaRh{bE^M<`-C{=CKSe_u2$MOjbX`2g;V0)wmB z*93~+S5F!AbUoEkU6MjvO0@Ab|`s~_f2F}PW4Q%eN~k%F8>7I z?WqB`OaYChft}0N#gJwT^+MvGZe2Dzo*=CwtUi}6|MTL0$2Kc76GskH0wE%uxo|r5 I)Qvy?13qw4;s5{u literal 73309 zcmcG$2T)V}7cCmgCl-pJB2pC#ib(HO1wo|>2uKMc(tGd0N)Z7O=}klkh%}KBx&%bJ z7$6`WOb|i{Js|Dv`2GKP=FQxB_uc#EF;Vg4{o8x(wbo9!j+Pq3VfMoa1cKq# zO%+`PVjmg)U=JREEng>Q@4`QaTyNg%($GR`%jL8{=F#)k%BDvDi1hkZ zgxy8l)8?_iqiQgFz{a6@2Cj&< zvdozrxsP66 z6wGvbz`P7~*kis&v(vit5bwV~v$8^%pUkKK^S=Pc&&Qbm{&-!I{23nh_owPO2U+Fc zAF~&c-v93UPOw>3?%!SSBs|F4u0MYGpK~nX`CO5t+viwh;$2Gz1wIYVl{^c&Vv&BH z_L{1lkvXqsN685LvKMi2C-AF>pYM&2k2fy#VPOg1Kf79Gk<>knl^fg8l3)3*Y{;kk zpZDZ0>%$?7@I@HzE+c^ucZ|TUriRA2gZbu92_H^!mG2_&kD1S8ABsP|T1#4Tgm9K; z(_8`-zatdxW>(~U6iAvqbWI;Gv6j7h;?&w zvwTcpxkHSPGiCl$X{iVArkfnyzo&rw+-F-)h&Ng2iAEh?US1v;9aSup=Bn1`f8L%T zWKOpI_idOlOIupiuWo0*CCQ>FR1{P5gPvvYp`oGm6|_<$ne4P4sAyUjcnXWfej~Vt ztiq=@Ffe%4X?-V8AHi9p9lX0u-G}frOJHJ{uUXcT-(JB<2doKPxNzZUq^d$obABkd z|3UNJKlmP7@rB6ZMeLfc~R4at~6TKmP|)hxc@i*tAhxJ|(~LE7qOI zC17Z1fiHN8FJ!%DeKNvUoL$tp$M*Qx<|y@{P^l4$*l`M5j*K#_be-7S-`~H`tEW8? zZ{oZMaW3{&;BRFf_m{!EF;~UeS3PS^3L%@$M$7YJmAqz;tE#CD8Sh&1Y$kTdCFfkj zd(qB!eQR1NIy?J3Lb#*;J3syM&d#5rUE}n2)vU*lAMg3K?APM)mb>EH6k03olS1?p zv-Cru*n^?iE4WvGBdyR)Gdd?HC;9BzvrEfC)De8(!WX(Lq$`4g?EMasDV==jzKx%D z{`~P@uG^e<=<4WT>*qRk$__Q}k>Q}Fsd=j01$HV5BwX(N^5t5)q?ni({PKlpShsXS z-N;^gw&Z1Wbj3?*Z?FC`mS@M+BPeL3xM*{}x|<~@Nt)OlH182_h5YfQbzs0~`3oJ- z8@nHlk||SDQ=Lq~>)0#NYQHIz3bWC!MaA{;r=2k|%-AXti4@{-f3$mjz4H7>T9`*| zW#z>Lg~g_0oh2nDMED3cGDY4bAwfY|;t{V}?6Z=}%7Ge6-KM~zmJ`8?{su%csM$C6nEtH%uBq4%l%G9TH4n4zD3In zXGceebUMef1mTTMlh1$hgxMJ5wj7x{7OWH!8oHR&9r)F&76RST*?ICQ&(>Q)wXOII zIZ6#qw8Tu9?eoWgiN=3m5xm#EG_*~Nt?OAmj|xd4glyeIF*ow`S6;s#lHTj z?a7n%zhyN>G&*|gi;KtYwy$T7`xka%8-+|OAL*gB1`9LV3BU69JO4a1b;Nvq@90X7 zlpl%@Wpi+FSXy3ND|brY^C&YjQ<D1KnhE9GTePkYFu0Ta0 zB~n$?^~^`Dt+zTlJ7vDALn8T_P`7e^ZhroqaX}mP&7J|th4PAu#cyY$$73_L-k+Jn zzJGem4DUAc(b4qj19Av`{LAg^_dKjq88#^-(1yBHfE(0mLL5&ausUi2cQ~q9BHbFW3mU zPo-Aee^d245n!c2y3G&EsAS#QzjqJ(jd!h;?N}`TR8#X(8?_Xx7G-id?sl^XgENM} zDi0Nmk0r#=dAfZ*^TgkEGLjfIY^wyB^3$LIYL^ildhWXR2mCoD8pI)LIXA=*Lj}5nZGA;>O19g{(Su|ik_Z+ z{4pJOaUgzdOeoZlr+LI@EE1jW-{zGDIq>Rf*Iz+#)zC*h<57TV~jxKAHSJ&1axVUsL zZk|N?ep%R=29EpV2PET+r(Fhlr(h{(vyz?d>ZmHn|!t6rn4 zg+6|aN-3SZ8QmuAb;&svUS54A2_|K=wUGcj0RMEY2CePvplFpU+z*bbN(J z%|;-1w*r+D;K!Nah?7FHif^E<(~_5h#Bg`ILPSr`9Sv=5j;Om(92Xk)Rgwy;1xS3c zw`dzD>uYNnG;yyqE-;Yli4sL$vegslTgJ55^7Ie8_~TN9Wn}EaGyI*?x~?f^w8UyF zhC50++^T;lYB#V;+3KR)htI}>_LPlGPv^#ao}&S*cMfATWH)2=FUb12WHt=zmbT-k z^g>c%Mn($+7FC1X!Isf}rtR@nM8DKf0 z@E-9A32qxpRy33&8n_s1OI!y`8n_r?-lV6k@Z7{1^AGLN7>{XzY5#x#4kq~p1bgHG zI4!HhvkeYx#PvN5d3tDJSy}tUS3NVFjxH`!5Z&eP$Dq^_CZdz4Z=?d~aU&H}7%vI@ z8;R!fQvXHCzaM&e`pW;^%*^b?_`inCX@3`GSgv|WkJi69vp0LdmXCHPd3k4b|EEa2 zw-agLA4sZh;bQuCzjqv?3SXqy6$9))?`t5Y1ZPjhU}9>DHahyE_WpY=ULw_u9*oid z&&U0Lf$;y&PB)ESU}e0;ty`JL1v5IS>Er2M0iPBB?0O~w@fR#o>vy-~DSd=I{aKYM z)m}2>@Y~t1w^B7O#IzF%k`vjgPm%~PA(*)N-l@bq1;>2^Xn9gn#xV( zt>ug>1BH5W=h8>EBn4}iN8AUi>oHL_QuUFmV>{z9Q<5uvLQ`Gl z0h@8YTYaMa!JAJHDy+NhN0AiPmoPq@emp8Fp(mnS0GJ~X1ou-7Um^`ljP@hew^2hW zDX>U8J2eqkFT`HskGl?Fx)v$*k*}_FNRTz6HAT)VW7d8AZ3*V{=ZE2;Vb#zB{rs7H zK1$2tgH)8aR3v<6clRIeTeIGoItPy&SzFbVO;ZIh^(^J)Iblgj?>_b>Xh{G>R|al~ z^2fa(1eDb1=J`ftZCv22e4V2;V>?<`Q9(_1*!muMKIZ1zq9X1182n{3JYl!T_H&kn zk1T_P=DtT9RdYrrCb5vwYbilR4p|EKaegmhGKiYl+uF8e$?h}`N*10_paRhR$0ZA7q)&h@3)cs z&UboNm#Tfcn>*CWGRg~{A(ZTun4725v^e4+IXo;KjCz*QY0Vt2@=NK?0<8FURCKIg z@StOV*-_6U=#kI2&apT(7jVsZ8n1oyi|e!=8VxBl8+2raHVmL#Sn~r>rFp<#rh**o zi~KQaZ3I!#BzkKbn>~ojmoK|lV=yvs8`Y;MD>FFvG~K*&E-Z$Ih79e^ij#}d(7y_} zX`f>eo%d$&MhknHsg)VWxe2gFh%!FOu}e%ziESxD;(2R~3#>5)(C_lb99*MPuT0$F zWge1Fe-DuK3@4-Ig9m#jTnCo41)#5bGcBy9re>A=Q1n#O0};rH@QG5Df|01{-u$}- z1}?u-=BFMS);CSjQBNo5wAK$XOsQtsu>;!V42Uk0f(qK+-p<9atg4QUUHV{Hd${%C zkHxW7qB>7yzSYz1ed!{} zV|nO>X|+s_-B~TPMW}w~O4L{+YL}yMND=PH&gOF^clxP{wTz~`As4vil+CdSo{u|R zs`a}JTb~!@odcGIEEjX+7NUgYUp54&?Lj1D1ThAWEUU-6YVF=;6Pnw~x5E77*o{Sd z7jONkU~AM%$S>LxX4P_QIFZ}1`_=E~I4`d0?u_Y9j-Epw4Dy#Q@MmOEApYCg57^R<(I2qdIeAvMrVt%v>NYegzjQO`KHK5voYBhSA3ZRs zgvU`AgPU)DfQa)W=b!y}J@cqmhN9D<&0@P;k}Pq0`VO=bXB&H&6`LP0LzW3wp`G)< z@Nm=cFehRl=j32O_gU@M`Wr6Z^OJ&sLcy1IN_O@l-cFwoYCdaOgbg*^Vb~Pf;@g?b zNN?VyZf9Jru0M&1s2NQY`_<$ojs~Z^;*vq>i zhUry@es0$$qE=4nQw67DO7MdrZds({mXj&F4hNK+jS0&Py~?1ie_QC28Rw){qn-h?flCp9M&eOkM zV)Vu$woeF2S5$xqvR0X?)QI z8LsxmiVR&2cE{ubau;O{*`HUcOSxc zYBP5Id36_C|6QsFCtQcdiDDb?J5&(@70+`bU| zrN5u`(Np}14(zX@GCCgoYt<|Z-*2Se-&$xK02?^R#PoDY@j2j#KXzM|3}hm?s=1{l z)+8k*1+cFyOA-a5ACx4TjzV2v3wp1}xm=b02XP}!No53OYkRP|y862p*W;@VI;?W5 zpYxgSJbvmvId5RJcdKV)H8Li3b2Yb z+4%YzDK6A<%m4YEwVn{XadQ9DYc0Wug>6dkn4T}>P+!Qr6GA&P_pnRm0a&4L^_yB5 zuNfTrXwkTmR<~r_S46F4(caw*-ivU?Y@Gi-ujFgHlQQjmqx&-QMYprjSj7$is>P{x zI)*JCbLUA@%9Zv0`QUMr>fOiqQG2J)89|+wHWathiu^C3zOUz@r^MwT(~d5G)04&r zv}cx6B%>A9*kD}&@GXf78S0r>Ow-xSw^C-pd~ZE99lX@bc%6ye2D4kR%||HS%q&9P z6AT_%D4HS^)r|<>8ub|SpKRhQYM)*XYnh7QTY)U%2;mNY(LBA}`ozQ16036y0t$<> z@_Nm`s%n(2^(LEjZqU(y^&1BVM=qWelEPAb#(4G>zleCn2`_21w5l22DRjpm|E_-i z-65*fjX!xOGK|V0fM)I#_1VXhn>7>1shgR0$(g#PdU^T+6O_5Rx5fqRQOX7DGhfe# z@XKnl_2O`riMh7H!DHXgn&s(pa(n{Z)@R?h5ai+_-elq(8sD2U6n#;ul~#SW2(D z-d(%a(&GF?wVFEMP?pSDC4fA|47A?IZtO%c8h^P^YLbhhrQOjlDDow{vb?6_)_C92 z(kH^sr0`ki)KnFAZ_&Duc_0yQh$c1hZ1?aCj*6$_`M!OC9GG^era;6AEmaP zB^N;rkEx|LTzhmX~TrVRNqocqB)^$LIP4s-j*ZplN( zGE`U1$hk61+2*m#_L*H9T6o%5zYn1--P8Dw^1kir3?XCxN$s|#re_Y_WkU~jkQ;z= zUGDM5G{C00d#s*jEx;;H94h)9Q%>4G!00SUU0b8C^(Y8Cv+^LtAP(5u;*RtJ_aP+x zGRy9q|Jy*t42v{x)TeW-5vR&e*tKv>b0o;}o=@p)s}WXGqO2n{@m{cSWaK~TTx9dN zRmsvkf1&tzY(vsAxuM~aRc@}|%{u@yZdZLx22B{{=2fIj7)3hqS-Hd zshidJ1QV3AbxUgL*xA@#F|9t=&GU3Tds9V*ug#2xm{U?xLQYMjg|ry*pTO$4yVXxw z?T<|sv`@;Hoe|f_)(r{Qx-mRF8|To{2ex*y4m~EeMqiG}`&>o^ZcMK)5;A!FLjFWE))*_E z7Ul^}eA{I=uv12KatYu7u1@xkhfBjD>gQeadXm$D`QY{M#}5eY#BJ38x~7$&U*9*- zyE_gc=`Q2rY3oC%4QH8^5&3Jw3QT56^7D(K*0k`z&X{972v(mfVT34qiaOKK9{u3fcJmk46 zhKJR%?$Ej&t$}R2WO^Ys`s;Wvb>k0idK@=qQOzYO!S8Nd>3}s!9^M}m6a=_CVJPnQ zd1V(ivoWYpN26Qr2(U8Lx_h6M?G5o3Oc3iZIdfrq4`bn}>Q>UDr`!t5VQhPP}~)t$PWYj&@HLreNTOfaJWCFtq&%VFtD4Y8~HPe{pq8K|#Tp zn44_#Vogofa9AC|T!IB30|Ub;)b$?qZg;5kL!gHYO)O4c%g4~4h;^+pLqpdYrotQ2 zdOpolmVxfT0bl|z@x2p+AQgLgp!1<9z7v~AV=UL(>$lWfLeG7up07GWK~byC@ICXC z<^XQL!xXsjo{b>eu>Ht{m$LUxnseL$b*QYS4PipNOSu09;&C zi^S0cTELBW)(X+NF5G{6OkuO(%P)W8)Oy1YreDSDyTsss6pL5()#2yIbF51T9m{@9 znT$09F_K?#DI1dbDJL1a!uRpNUI6*J*kjE= z&zVIJ9OaWE-Z5&Cs7VPcyz(Gy^G@*>)F&j6;8Ryz{EomcSS8yMTuHjOdrSI%q<42q zJZ{vhwBIW+^XMKgR-30NiRhUfT7dW$NZR7DEZf zNqHY=DS^*=ORAcZ4Of{o>e?)OrKsX*dDJR%Bg16yra>sCUOGy+hGjZUsz*g-WLm}l zr<9ZwSG|d`G4S_t;kHJA)u06c+M;{NHaP^OCwI)tva&MEmm?Fl$<}uIg#`r`K&A3G z|NiCYglL&^vrXZ~-E;4Hm;reklF#g8X71^G)je%hJE%+|el{BUAgS{w;;J|3i!)Ku}* zIk2hJ)z!uGU0?}64MZ&+^Q;fzVPNkzbX3P9ZX_``ivY64kb!%#FH4p`P_2=_##`O2 z9mtpdK7YohtBL3dx0H>W`zxG7%|&A?c?sndTth0+nUomN+IOU5-l)m%SPOsDWtQ-P zoQz~OkVxPGz1H5x2*g{1{8N(`mqPu_iN(g*F*4c}x3!o5*c*p?4vdYd)goI=#{L)t z0;;UwJmyjuo*Szob19clhDkrbILmS;6wxK6@hGS^srBK*Q~CXN?@|p(79~m^BXV(|U_5BHe|+MptR zJv{X0m2u*8Wb&!T6IsRq{{Hl<;W>8kR%!0M*eMSTCwpWFq4pz?;~E+oM*ZE^r59Nv z+>MYBTm=TDH5}&ral#@ZXF@9@+SKW1pa3eD7&(%Hgzub**zPBJ`8|MeI2zFmZ3Khz zH(+D^{r!JQzFQKd_<-gm`ms)*-@?(69+)y<&cRt=WNiG}B78*$cOka*8-*h>WD8|w z^-t?V7R3xEg8QHd_8iNhr0_mZQKo!g=Aq?O1(t(}a~N*(DQnRrasBbejpgYpq%i8a z=1ouFRfW%$ruo#KWMzHT`Vi5ucp?N)kvoPyqnnSKE$KWxJx$nA&O8b%qDwW9JXbb4 zBf;z-uPeaHHO72GDv>CkU09F7TnZI?AuY#sjJfB|dz>AOYgX2{QUq;CW*r0&6sC|R z)9o(x+PwG{SXy9`_;O#zS&u(XfRJnK1CSlE2{4$0{iMl(URe>=hG_f%SGpdi1;*REs z+Jv^~N_0e+vple;{UU(021Z7lFi6D=Dfz9tq$F4wU?bSLCy)5HLp!@etq*lWPW`23UBU3sy$FRlr0w$Y!xjz>?QTJLMDnyF_43}3QDknN z+!kSR@%;^nZm?R`*4BPa2P(Qq6J4bp*X!bdaP_Zsw*3xZ5^|UN`H#rsyjj%>h&xz) zA^JW*b{1UqW6=bH6~a&znXBCgEJvW?Sa=<}ARV2Vc}AJ(De%pE9-XPjtfuDA#NN(^ zRP&I{8hVTnhttrX{5UNA`^s$ZD-K@XQt)#4#j?;JV6ZZhOeuSV2W$xr7Q`G$^-cwM z`6&JK>!7i_XS@>>Psp+#Ilp6wUEJJWvevXEv z#ZDc$`Q!i<$MZk^v30-CfW)I7Hg~0M|MgFKTg<1 zn{0JJ=j}Ls6quR#uXZjjMH8jn)3H+fw0b|&eU#E8dW_<5XL)4jD3r5sfJXZLd!w|6 zqMj!2OuAHaGxfZ3wkaR+l^4XJdu*k1Y(Q(CoBMc1p)ck1_-S%jSX2ZX4R#9@RgxiX z_;Uknv=9eh8Y_(;s|+oW(gsRAFN-{TzHFW)@<@1aw;Pwd)T;V%a9=-&}@&~E5rbgg$ z>(uY_HKSuwkwA^E%efM`Nco!d(+0RPQt_IDUvBDe!ci#=tqtv(s?55U(OL9V2W3AC zvl#>6UK-bO$cj9gQO7Ey>Dz0UrX{qf=m(TjhZD}J7ZcpEyoZ^&?DElr-y}m!HqyGM zW3slHrHhc-~w59RAu=Sznz~G>We4s>k25-DqTe!r}$4}4bm6n#~8stZ5 z2j4i`EU#R^mP70hTighQ0Ok8>OCggbqbb52O6PhZKKp?P&6`OI~R>w6=-h2XEZCG!1Ov?4Xw$B-Vr2 zaf*FLe2)7Or++JeL$9Y36BgLWFtd9f-8Xm6kva`v&BD87JKKkjlq8#HGlFOrd0Au_2Dy08}BV^{8^5K4_yMt^dpcG1`7k07OCDL&4DVS}$d9 zAv1McQy&%`Yg!E7&V|J^^^@(ma#bICv8u5BmUq0RSZ0|! zK5}$dN%-Bla=dr}K_N9s=E_DXMy1yY7AyI3)yOZE0Jy>E)q=0oX(0Yb%g3#x<0_c} z!bohXbhuFs0Nu?=M95&StC_Nq@+S2uWg(gm7hBwcRN!zuQKOx<)M_+R8KC+W09%^&V#es zb!Ez1HSG6y#jZbDzr^J>2ldd6MYaSbnIf^ZVtVno{VASh5wq^17e{+qlM@qZt9?j@PNzYxqaII-51dRBLDUFk*uw z$zS0CrVRe6DbHxDQDkJP;iTCP)>&Jn*N%8csl@0biO;7lZ_rWFq+n&e-^WdRA(D@o z=fC!d*JeYTDxv@Fm16#DTm*~8|DM75|DzxS#$NcF&iZ|`E`>)rwnv;{#8^?@e;PQy3Pkb}6gyq#7nlWy3BZswId4I%O>8;ii@w9JdFHyZFPhBF zYAs`!cON~KH8ty>t!oYx>S4go-)Zj!ljTe@i74CEWifQA;Tm^@3U3tEr{!LBSqfk4 zV7U0t{679bMe`Q+eQK?hP((o%$F{ZIR-62B2{K>{H#$%eWY#jvk(R#CU^xp^q*QhF z*}lzNl%3m&zC6lz#{y8!zpV%qm1QDD*5ggv&PA&Yx1~P|{0Z%urh*w)Uuwlye#tk; zPp`Oz#zE3sG8O{aAR|LbS3c@>MPV6-yBs*H01Nimt{64C#MOCtc+iA}zo4>)$kUj* zf>q=L{8C6zmrSAc4HL#c$Ho#i{G6N^;AP-c129y07UUJo$3BG^zk1%9sWuNj3mY4{ zFZYi&^vIeP@&T6!yMmPk-k~q%J+W0cueYZwGoN5DU#zsIS}h$8dn5>&$Op5?U-mPcH66rUzH%X6Sx&d7Qj(HHntS!p_I6PF)9L5WpHGExrxn|ZAFdw@ zF3WNo0n{GF^x4x)El>ZGXYt36AE9C3B0Y@-g>YqUjoW0M&kEq!zJ2=)<=B6nK7QDY ze9^QtsTJ62QgA90GoGE7oJJTv#6LrRu9WFN@{-{j@YG(RAIU;%u zj`P~b%Pe8>(~uGZ?D>_99QHnP)t}u&MMNfka#;Ith1YyQ=FfUft*y9ucpSr+c6}P2 zH%;k|^iOrhXN|M+Rj)AP<3XzWMI~+tz`8nhQWHmSS5z1OAfct#^SGa;Rb62XQ3^ff z&2QPcd7K1Vt1OD|$E_=RHxjirx&sw=$C-8-$^{IkioWVa?gGp2w6$mYlUft5utt){ z20AYqT-os+$~*f{YMV%$-)=*k`&ZMh08DySGkEw+c|wNzLa)nnOT7;_8P&z=EQgH9 z2(dht#|3>WnCiXmfrXpoW!{P1zCb$^@>+S z#m|WeeV3nc!4KXf>Y===@g+yJ18us5oV_sXD0g?3NL6fcnx5a(8+;8C>kNwW(S!RP zNt@tjXi?QXeH3OLLeN3EbMp$Fy_@vQK~Hn1_m>TORE&6od{DDrArt zi=fcB(@0gIEbj2fL66|L{LDYlc{O{W-*o!J%uoJZ3|B;@R7FH+tbtXyS)BoPHJNCS zbmh+nr5n0t7k?81w(pZeMFe8oy5t> z2ObX}HhBj}L_~CggHw56dwW}yan{FsD11F{0<7ucEiEmCDm^_t_gZ*#enLZWnkcNF_T14T9o?xIDgIu!7wHevd}SY`|#m=OkJJx zfPsP#oK@8Hb)9HjpjKLZ(v+1V4{|ADL?kJ?JJqnMB(eKiaB%%ZX_a=&&eNw)-2*&~ zc#*{IlnS@D3}l6vIR_lEe9>Te2&MwgP{J#dm*bNS`+Q+S;oe#vG9ONTDMQA5D2|Ru z(tLI{9%B}*)jP$-$tiC7bh1h+L75jtB-op(s;bhr%zN(4MRle|Aqy`HZFJ68rnMQx z8Fz&(^trbbnhNuj>g|XnV6{m3)3@e)+}wJ~Q$NXZS8uOSsqLPt#>kX*7BsncT`o?E zUm|sJ(M{PDjQ&m)Qs~xO?&@dbq_wqrJ-$1#7hS6m{Z960A;e<3PR_M4f0;4%$Peh8 z#+w?*lGP(aHxw=H?c0vlZOG^23x*_I2Lj$0%v^4B@)(?i2z}1Cg!wZ#lh{d>o%Npl z<65=r@gla(lu6>%E#4JuXaE0s?pBHvdbK_59T!wH;7dGJR!i-BRRs; zy?RX2Wy*83!yhEqDVFQ~YL`nrRY&zO-=pwAEfu#jTq z%vWf1EUMmoZEue5C1}yXlm$I^E8iNl<1oBnVq)ShC$e7{uu_lhH^OYJ;5E&s&|d;% zRF?-RI-&3$+_t?SU-^NMyu)>HKal!^O9OL2Er6269%9jFFEN7p2{D4bB;X~gC3$}u=1S7*BG?yzX8W7hYm}Y9ajLo8FMRG~GZn`+F75gyH;~Ups z9v&DNcvUL~mjQZ>5Yin5@A@$pxvDQS107a(^GR*$s8Ts+w5Y+|{5~3$qm++NOmN@x z$a3dcty)20xP2Laz>TId6VQM0HSF4PBPghbU}D^w(??ePu$QZL@3@i*x^9>QWHd15 zBQ`w-$ST8~P_Cd;&a|=e^&N2S^uMyNFP+|vvBRtGq!!*dzX~6zmoBbH5d*_AuzpTd zC!#k4=NfnRiAAjd=!2)53PwHocVD-@KQqd!X_8%0l~$>!n|B=Ul-2v^da1+GaZ-d+GzdI_b^hsQuH zUj@nLXWP*Ai^pGE=?Sxmzppi`0a@^1L(=-}YJ?nT#0{rE(Zd#Qol zyf>5Iz~e3@NvSm)tbJdJ4ZPaMkEQ{oiB~{R(V1B-k9CRl?z?=_BQIDP_ zMup~9dd|F--{1#!Ny-HVS3YH)00Tp&t>Jf0BG)j;;-707Ty+laqkEn|QjFw-l8e^P zh+jNu2UBVw$qI28A^Ad0H0!>K0lx`xB#oiRng54O3E)}>?y3VMAv!DzsVR5xsVSoBSMH2xFNyK_sRJj zOU#BAPF&d{0bH&M3QplgL#r1r1DPD9o0t_Z%RbZa?6B1eVCKmph#Jk4D4 zqvV7Bc$#bi&<5W}?2P-HL(Mg&4o~n^D=Pyb*_b3|1BLrnP*lR!$>(Y#;|0Ir4 zDrzlY3M5Lq7s!)Lo5uO=LwvKihnl!wa;AV;0g7L#kUDnq`9_EYCnFHGEeCQpDuK4_ z!Q-c^gzjKIi`}{f!w?r@MdUjV@86qly#>}I&@l=lZSNHSOrwA|a?r!Mq9c_!E9Zsm z3iU7fpg^Vt7-jYa-?Q3rJr0WX$JVXge_~I;U}1vcQ*nRl`&a4B_^1+icUUl!CH2< zg6*Atx1@vqe73;ona-^NkNPwHO)eUZF5ni6GaKv|tnl!auuHaHQMUSl!_p2P7 z-H^LCSm6kfN(goBDBIr=e-N%+9yVR6F$&t=bA=KWRTXHoTKW+)yu#|Qa_kIB&9(Xf zV?gv|8CoNC?0V++PotkN?{+Nrgo!J3)JCzRH7+~_%rB~CKV0*MmTDYAhva%c0I7<_ z9ItKlro=_4KB%s#!HwSj>s%1&jdZ3CfraT6UFwB*^FZAEGLul^B%qKCW9mg^T-E+2 zFJ)=b^!@uQQ{wsEJ%+OBQ63NG4XBIc_ZUO)y5Mr(>+}DU(QV^<@V9q{o%2xcYNjzN zC0Zt>(|`8YF*g?K4f62j2g0;P`?xokiFS34-NNQ}{9bFY-oH*#>3%|^xUa71hBvCp zZ|h_Ox- z@82}DAD0c$?A|>Q4Gl&!CCcqx~0A5V1 zD^n+9<-@0LXX}=?BkqH{Ly{YS|3cbEULsrP+nkJ}jG=_fC!zC7(op@X_p!RT_|eRa z9cWfd;sAfSE79!d)2*7h$7+XCz>Zohrb?3nwvcVmH%Z>BWg}%o1L}uO>P8?}hUQ2O#Yn)Kt$+Z9kI4N` zF|yj3Hi#uB7opEjFru{;KoB#PF&?%1*;N~L`odY(rl4fK)DEbsbD2K;E-ItK(`8do zC1^yvvR`>|@#)a%Bjgp-hncsGnTq^(s9{UJWR!_~pzYnLq~${YBCj`_e%D@_>I8Jv zx<&;2J40n^j$ASa6OR|pEuKVE`2(Gz)bquaIuzdfDmdEN%X$#%a~42KBscxA}E4@Y%5wPg1fhgk-AsyE=3 zTwh5qem`6=KD(q<6VQD?uBQ*HDpz)+hNG;$zMF4ag{$#D&)aLm;eP%4bvI>ybQq)S zf5(09oE%^9{SV>faPWUM`6Iiiy0z!!)PKDI)rBM=fy>8WmZ6108wt`f2Gb#LjI=IW z%uSV@uHt)tt-1%kb5XAW%z{T%VTGw-$5){p8Lla}a24M2_9M@qOj|DSgVAbA-X5g` zl^o>Ul7$Y?#KbjY?LgfWAcZa4MyY|vM!~xJGYHLv)8=!#_Cyyb24&XqH_vg_lMZP4 zZQHZB$#$%IbK-yB!4Q}B|+*ilcW?c%PnKoLXnpJ2AOdw$0@c$tugBY0R`m#u8Dj9H;h$l=*&`NF# zs6KN21Ms4jwdJSDIcJU@WNS1xHvaUnqNc|29&5OYu)MsZG!dw#L{?C#%l%A8TrR}U z{M_7v@(+SBLb{SMY6-y~b8|qE6NB`t9gSLMS8)CxY*X9a2xUWwzq49}YMDCUe#H7g zV8a+v{_(T<|B@#D#y%(%H_$>MDb78=F{8i?@Uqdjbpx@SZ0q>DDhi~bjX?@Ei&hk* zVJJ;mQ3H*m<$$j!$kP0A?wUucQso%Ry0L)q~%^ABFLj zhsrncUeLL~Fa-#F>N&NQOrjJ$&e$-+JpD%6+<|mXMpdoR{F~7SBOv5LH?#NA`A9%8 z2A9 z1Ctn5K-=-5;NN6}+z&&oFV9D(;PjrsAmVpCJ`}{oYDyi4P|d=VGYl{V2(qRtxZVBa zoh=3lA`;yxJZ}*&VO7yY!;*e}_X;ojPu&HgDT?X-@DJJzt@)_i9W7mCKf0e$l@npO z1QeR6X$!F!!M2pWQ3XL8U;gB64tl`l@0?W=fbNc`lbnOk&qs{}M$S_xS;!(ws7oL$ zfJ7Yc$1MF#h*)!o(-h#hLlhw~7OuOi^h+2NnzA~H_il5kc4rsvX8`hWURmKnj5E>F zwOX}vbARElX#;!_J6*MVLEjqDp*>2PJEmo6Bd~p`^U^N&E!-=9lqmVA&g>pxrj=yqU5Wu@(a zst!e}1KyB*8n65Vns68IY~T({u-EXJp*UJPBW$JyJhwQ-Fhzi&ft3cgw3x4$WT zqWG=%DEMN7gccc5(FZq!B~Y_|tnD{;B+(Um++spfrR^;bOuR5=zR3A}@{h(#-AU17 zrmR5ud<%N9HPH;inH}u~g-1$wyf)wzhgB7J;B=LZw8)HT2mQzdnOgEvj!e4urq}Ib z9_d~$^6^VUrjjq*+f3s>Ot;SblxS(0VZYm5pDZ{#=8Z4n5E`oR*v@a6&kmI1rxgmu z=psC+Tst*LF~d|*SopqghWd$!=3lX|fJTKB0S3j5_o^CCETnovAvZFrXJ^ccv^Fxhc${WeQ1G_z7DEh*U0IvaAIp!m46lTI(lQ$B9hQD( z{4LroIG6_k78e}>RsxE&Dhoz;PV6bLl7N%t(bIIc3ZEqK2WXg!xiJyqQIJGd{YMt& z>k?MhZohw=Pzi8m@bW)k6vA^A>g%<1szVHA5pKQ9GOVR&4y#@{!ybl^av(-It`aAf=Z{Dykk7T}}TgMe@$-^DY z*`Z8;RG2FU^$Z*XfJ*4GQrbU2s~$3jaqqU)5=826`aW-Ei8LU#Wz?x|b?t&bicAID zRik8k$LxZNpt%QnJCjs3ZCT-PH97nYHsT@s;h4IePF;E1g!?;VqZ|fz{0a4e!57EQ%v3~@L zTU4Za9F&XU@8Kb6*|XKYc-$Ne4n@^UK*!|4WC-_7VH)}T`WYJAqu_~bTzicIbPk25 z&%TVjB8e{H2dnnznSV|PtaiGA|0X@aLND()q|{$1xc8j3_tTxm98A+dSH}i@@J$%& z*izruXMdu$wzhm`MrFm>KG}LmhmDP`fk@1;I(I8SkmktJx%lwZ#6)~F90}NAFh@CI z17R}nM}&|+G401*1lR|@<8V`KhF?rsZIg+Zp0ka3uaO@(!OtGZIZ!X!xP2jjaG05y znJ-`z9!8SM&V9b+ms@JwBk~Qu-2c8N`x{yy0Uw7k8Lp=|3Hwp>K;g)NvTvct=rPi& zi}#x)^2MmKo;o;}+u1PvNJ)k95&9EV$@NKUDk`1|@TD{Ez61*}!kGYLRpR*4e>O)4f%aV@>lDPz|q&` z4-DKqhV%RE+mRltQe&_j3CavTkHj;EyeDT>wltCkig4HnNFP|Ywbj+u72q&JRy;Qg zC=hSpZW+>n>J9@uA(@?3g>pm@uZs&iJ9SQpvqvpUL2hrEI>7{_GE0$ZWp* zHvxxw@B7Dfa^jp6(xS2yqOzAPV>`;4EehFF#9+uWwk(|%OF{@Coa~I{WSPlWrb0x_ zVK6b6?913?-+u4mocnp6>-YTb|L^%<|Lgj9o%`H%Xnf~8-_QH=dcT(U$L7AT&}a#L z768fN8H8R!T+)<-cmfGjH%pIA3i3lZ)A>Oz*>d?eMF#VekH_tfv%UxC1?_=Z6fR{bAE-SkM1wE!ijlA~1lgceA*?gJ)0 z66T5W@d6qQ20qXb_#*xzVO$R_-T?6hPsccZ2D#<6s4av>%%U$TxbYl(_9<*OSx;R$ zSxq{5`nJ!rs{{F#+8S*Wo^wr3rs#4~9Njp~H~AihHi3TUV?_WN^BWPBcc>eXk$Z*z z_@5x}De%nR_OSv?2@s5ohJGblM=(lJOb-g$ZhkH|XNl4xt^ux)Lx(6Cqt$vLInbB_ zjs{O-YM1gCTB8oBES@#iOfn~H(orS}G2$l|nK7w~@Z=+wn;Un_g?TjX`ghx|TqQ{X zUk#r!nWqzEN3a)-GTu{HRc#pAGknMNu~vcQxNYgee^@fXIkh*%3l{VfddU3)Ktf;% zcQNa3{vF<0qfO)>?$7B@x9W%7VDtq)Op5_aWui`#MC=y<5U%K>F2?2bzzhpd^oToj zL(odNZ&`>jS(53ldNL@v!B)#R&OZeNPG5yqRvrqVDTDhD7;adm!Z@QL0l>d>FPjf+ zAK3|^`xz3I;;#P;Gb6y<2f!?~wdLD4P6p29dsZ4;PyCc%#(;&!8+kXY-=FYoLZ4l` zc54U%{E`X^B7~d7jHGR-kucQ)^2Z4j#Ip;zYv)q*=ys-sSAI2WuXpDV)Jytb*#bZg z?lY0GYb_5QWq}$1Dl0IDCnGerZ_TK-v{{C4+iR`2C_&*!Sfl?vJ$nznL>riHP<0P%#HT-0-rGiZd>)U!^R^C#Wfs16&LenF^tl+w_ zSm@`>7wCnYx)Kz&>0~wP#YJ~(P1q!CdyVyq@uc^~!Bh zavhkmJtI!<>2!@m&{JBLmX_$sTq%KI9Vm0!v-c{Nz;c-xtRmtYt~R#PXa|R_|K{MgO2`y7L(y+FSQQ3zN=n0y|Gfb-FLAH z1fYr;z?$@*!m|iy?`+@n>y@nR#6-WT$v`zOwNs&ldc5OiJ$A77(BZ>PvjAJ|I43Kx z;TYc?uMUaN4Go9J9Ozd7z&0#dRy{{HIpN@_f>^r&SF9!pUcS~oE~&<<76yz3mw7df z-FKOA9`)o7lR8F)|23q~m{(iTFL~s5Kg(p2 ztohW-ImV5BB`1GN^Q*3iGlJJ!C^hFEAF0CC7EQMd%)?C=0Bs21m|U1Ch|hr17#jOI z8Nhr8_%5Nja|Pc5vPG7C^|7|(gzH(h;zZy8--tK>>kI+7U}abxL%l%1o{}y@QFr*E4|6gP{wn1RQ)N*!nSLtNu2&}nHs_V|u=UyM$8s#a{{4vuaQD5Jc!13V zA9H*fZ0Nubz3KfryVA^)e?9B5U$q#i#hJp3bt%p#p zMyRlkz`}S*d>nrmA}S72fZw==Kt=(rOOddMhYMHE|Y$u|#KLKgC`4CLKosLGMH_OR4{Br`mGEzB=Dt)PXg~pfbGj3I!)4mu~Kj9b!LsrS#0y!=WHv z+43`)n(V(1d~f>WrjL=@-1jS)n&sCyp5!l`(?`uUb)GZwNs5zvFB641_N@i4&CWbp za{V03%4^z1;=U(1&3BBOtg9x&GK<__VniESKUZ!9eq7kujX@Cn4_^H!e>EH>1j#Ysa5u{z9&6Nn)P; zdg+3>Sc3MZ)uEQ-1FyvGOpUW!z1}dNHgc`$)EmimudoUhOf-_jbpR&G{5Fz{BvYj6_@0#aQ~r{mi`7ojf6KTS7!%32DA_2bF+;XRd= z*q7(`<)jGz_T$QPR2bXNDn_l?&U);p0Zn-T30iXZ$%IOpF^5)u-< z-n@=`5L;4pRD+IxG$*|(VaJbVPek)~OyV7Hmr8K5@F86;uX_dtMw%5K|79OH%Yo=Q zeMv-?o?%w7)~LH2zzI3YXg2Z6*MI%uQ}eq^xtT+`nFI@ej1WvS$W1y`BPN*je2jL^ z#nqJ`c@XAJ;BYu$4GXXf^YHRs=Dx}9!lRsx5i~Xws^GA@<@#-CgPP5wI$nh6Nsb?b z_ua^7Fzt2vgGWjj`9g}f%XG$SEAcBwUk3(3wZ4?Dr}`z3?2$#9 zIFm*sprsik6zFT0nIS%K#oOq-#8&EH?B+CrF=gC)UOrWLo_w06_M0Q$N6WkaP|9sQ zcmDNT@uw+&C%@7a>-Ff11b(%p-rdE?@Ujm2?@06sQZY3A1Ira$pYH|*Y(sj-Ayv#_@2XSwE(Bq-n9=W@b^laJ*Z zYzXg*!ke45U#Rm}fI(ZdwY8OvaUUWj(t==Boa1HNxdorgH|!yXKT-5q0+%9^lTR}c zXFu}t@HEZtYiwQgS7Ks#Y7+{Z4zyQg%G8xM+7cfnN7M;NfhU*w@g2K$%mUnmvIqhJ zeSm&f2=GI1$N$U#1M7VJ{Tb&J+AZLL=psoSs+p~I<9g9>&$H6fCp82{j-8YvOQEK> zlUlNS?@K4Yh04|G_yrw6ZK$o?f4|gJV7j*U8ZZk0nqY7)gRGofG#H4iw zd`>Wp|G8G;K~PW>$TS^4NDITVdUq4y2`bt9jJl3+dr3Yo2!3TA|BOO0_utu8Y#+G7 zvcJ#8dnh0;Wn)!Smf^=nKnHCp>+n0yL&U-Hafb{AZeHGEOQ8$&FdSv?xv)$3%I9V=8ua^GA=h$6HD07Fpf`M^>_eA#I@CkXC*RzA41dUEaW?BF{8xuxop{{;QYa=sz|o=?_ubLyW7 z#M2kNcDpPk{~phq@R zFmTq_YO*A)ekI@=Hs$?S>~z-9Qha`=<6ZN41@S9sMYK=oz7x~p%s;(q9*MvS!)%Pl z-_BwJIkH%WRM1z%G{zWKypn%QXc>MKzcHPZFvb zZ9Xl|v%UCMi>}js@F`2Mcqf*poMJgJ?p5iU5>cH1Q%+B3BL}CZbW&yF?NGhG>#<>x z_rTGD_VMv~-&y;_h&2S;HoF2pV4s5b1E=y+J=55)D^a}444KwJOi%U&*A5u_vTeYk z8DH`9W2pqfqRoMHY0*%OX!`FpW)CHV#f9BMAP zLy^8;dXk}0Pn(S~x6{$x-0d2s2!l-Gs%N)J&uC)?U8>|O7Ii!RnN=~<_ce8sUbc;z zC}YgIm5j(on70^kGpw#JVKyNPrsk5ZRs*{s6rEn&n6En_-MMBqgF1Upf>R{!veHky zjQfg;ihy#J*`i&opp|Js=X$L7Q3-8Bf zfea%gKeI6Z`Yxtz-} zdH*(IhLX)a%j{Y*Teh6bBP01Z=;6a~s7+9GeP5WA7Yo4Do)XKA8W8R-Dc%mX4m$Yk zCkVUsOn1!(@Pf?;#na(*x4q(ilHezaSL9^48FG<#xtBgZfA1xe+|n_WQ55^bR1=?C z)MKnz15K_3XCp1mug|bpcit(_r!hM<4PP__z-#{0J8drdl1*2IS!nO8s{GrqFtzN` z@Xa{|R_K*3ZQh*z6Z1Ab{c>KBxyW(;+0Da$Zws|q23t_tD zvQfv}cEvaEU2WXn_-yueR9$fnPN2k8H)lHtwJQw0v6BY(t7&}Y+-=W z{C`zpYkY9eZU5{>&88B|wKpj#=W4>MCT(7i`Er7F7Jo}#$WamYlph;gbzV4>`A_YX zYnaZMG3U28G$R@(yei!{fV0U9N0F?ILW*dE6BAn5@L=&3R|=Fjz*@ha^%KCHx75Mg zp^>BcG{cyN1`RIQ{D^Qng~=xd$<(2tdr&FtdZe{rek?L+d}YIlS1MGKZ7J!^=*-OF zq-=oO;)ibi3ro}9s)EC<4116w z{LczhmglGrg8+u;Y4C)3BI>uc6h{{;-h{$1EgMA2rc<=5(p$7w~{$jHdZ;hkcdPmW~}?vU~c)~n!L?pf)sA78|J zh(IsVtXDa^QNlut)IV-olmo6j4qg@zcGh+P(kxW5wcSeJY8~@fts%TxNqe@tkHz?( zIh0EM#|uDh=B~M>a&pA_RK9p9yVU%wy?zoftL(vNp;BR! z4Ek5L8XH&gBWH?i^D1F7zD9Okra8^|p-yR88+wB+MH#L7;B=PZ1w)g`+|)m4>z}80 zuJoS_M4CTWeyPou?$8mvY?&n*xsjdHME0R7YM(yNdW^flv>R!K-qL+|Xo-p1E4yW$oQQ2nDCdb6OIdUZygx<>t>*&-nZ9ZaRbAZK5He~~4* zq(HNeN###z1*->^GVe;u^7{Y^oyrgN_6})tcxC2IZ<`zcpiBD!X zpks@cSSgr2L%3yVZZ@*IDr=}tT)gz`PkZ0#rK1orysH+}bPRn_iphvIf?k&jF}7L{1^T6R1O8Y+=5V$pS2tKy7Z5Uc{5*}%M`ytbdWr%@%mnM?lGuT)Y(^*Sus7`0J_ zw?&$6bQ{eUAR?c@FwtfI2V6`Q7Gmu)EVVCbAWs*G(!>fJwJ}(OW(Q97yCJu$q~}f{ z_Y+fy^w!u5X&V3L#I=-RiDutP*+_*}tu{XK3Nh%hRe3&zYPAib7&Qso(x(o=BLb1o zx_~;$GJfGX6VKo&fmW68#X|x--*bz*s-8OBa~zI)&3ono0gxyRLU5w!_AE)ED4FXA zQh7h*H{7%!A9(URON7ZHC$Z9DziBbM_|ktxrr*|D=?!0KXrMjRM&L9tbCcvrmTd@+ z`-%tET5c`92#D!ex&L=h)+P*O;_ak2ZX8&YeJaNts!wVI^#OHX@ZUMJ>LU$q*i&}Y z(at|`0)bQm8{*RlVYd@1tL%}eZF{A)gSf)Q*;KgtX=H>H>0419MZ%e zhIxOqIWRohoE3{}wu4Tswxl2>a||!W@JF}vjDR9+=>@Xw^lnnQlSJZ(jEbTnPQ#xF zjFEI)9zDFF1gL@GHa(~UPjQADN?t(K6i$k4;<3VDCqDQ;C6MJDBgslo%(a(Sj3ys5vRn9fRln0pO zunBnWt^!Xp(S}of!8S>-XIdJO(%SAv%Z%gCYmKep=Sx@S_?rXSg`3Q^67Mn`DAL!n zjsTwK3@*7W{KHSN!dWS;7E0y9$2)L&0FDz7B-nxn22@^vU$YcT2(Jp_VcZ9Q zsj@GgUTdCYBLTjKaWBK*3}`wfSfGM&PxyORT2_FX%t%JJIZMM1W?LcJeBHt|4kGbT zsVa2Ask6u^(7A>m`b||e=fSanzPv(cQ>f1I(AArxBbsdslk7>=JbFW`%+)angRN z=<0$s&HP1l!|$P?+gy7 zM84j?d=kscs3M??w$5nN+}>$xV-MV1edkpzwaeRS1bSJ@EQl$-v>2Q8#-a#K`Xrz# z0`Kio6`8O@)z*a954P)PTUuLZkZE7gg9Gyv2kB&4S=pCJm<-?GCXq%Q@pe4FaS__` zLSy0il@ahiz(b@%s_X2G)4BQdTR61Lld-WJFB*Vl^3tMZ0l4z<^NXPomj@6;F8=O%M(AoRa3Sg%H7FL#> z8|tpz@g43(zv|Y%P_Qse>UQ}QJHh^1y0Iqh$^Uru#>{TOa@{`o_|C|>3fmtRVmV?m zx*lV`9KH(*tgxc7(LOy2#7EcOuDUM2YQ|T3v~sj2a-%m=At|_ zr(xt6OR{CTS-||#_wsL8QDS9)rUp#-@b==Ff_mV^G91)e@eRkI!mX_a84-cYFC){z0pn+vlsy1Y_QPT$ z6_g6w%KN2Zu>98ify6wpD;+#Qqn}k)%F8u5CkaaFg2OU8UC(*K0HRJ4~MvKc~wG($>%FWXJTYZih!0Z zyD@Ck5uvG^`gvmF0@SSoPgF7s<`wEIioyXvG>&H?lkzf_=gaE-(hm=<74KHP=uKrM zrKXbSh~gz`mHR5GdS8z0|roTcz36EV)tjJJ#kD0XALaIvqXLdSW?<3@l>o?jR?xq$Wox( z`khW@aW*n(w0-G}RR|VEACo7`1>?@{TuN*ls?4A1q!rk3zShf$b~?+3N*+|utaO2j zfx!p^?*%I@%jud~Nd$$*J-vC+4)v&V)YBkV%yvl)%Xy|>1%b$L+nT>5QSl+V`HLNd^8;o%2&>Bo|?srB_!Pd?tU z>-!w_#b1ez*bOO$6-B4N5Qb#;8rl+8gKV?HV87}}*f!kU*z*WJeb1*m7eYPjE|u37 zVda`jzz^p3;K3OJtdm6R`9^oWb8(7AlxcOVL<1s)-XJ?G@bEML1Rnu#8O>newPlhI zOA40d`E6b9cA>G|ZExu3BGmJc7;*;a8tXG&@zRrcG2kHh8g8W!uc3f(5qb7eCRrC) zQ258!f4A#>uCoXac1a(d&-9Bkc6IDq@vAOJ^Afc;Uq7=6h0lrRq?Fd|anZ$SLlYCU z#C4=WVj{_&^MDTN71`lRgwe*au1?n@#6`ZbUcr z-o&Nw#-S(@x|iD%bwO>YvN`;i0oWe~w#1izt!!lt34eto{X57%*Lfo1($sD}8E1Qr z4zK5<-?B9}S}5We+J!S%L60_RtSAV>2a1xrurQA)xYj0tORVX}FrI<%b++}zIMv>Y?;Zos1rk8kFv zcAwt#x3C3F8fhwh=2_-4+^ymL?7AdF`9Cl{8ird9#IxVmI0Y>ie|>gUzjgcI7v!%P zsoH+By%hE}6UC{X34jC&u1dD28gm(ETwk1Jr|3&7FBMgWT>d0e=f$G3T&mI7ccm7) zceE;7lr_?8Ep{pUv~oIo8dMAVL%cs7TDb@zB}*LKDGc%yc#`*Rq7NBd z0a7O6xAq!q{IoXod_cg*)X7I*ZI^$6glQ{W@Ajv2w8_yMwWEng&o>Jw?jo#%TY*8- zcsku!{Z(L4P)v#4GKNNT>ToPCkG(yCkAxk-mn68{2S?7Wu5w-|HcJ4Y2QC-A7nxnB zUn-ov{U#}R9r4J{6jT`a$4O}4P29wipRmR%cSD%YDZwTI!OI-LI=ySNV1DcqWTY$q z1&{B0g}9J_Xfub_;f;v)mKAxaW6q~sVbTqV?uDhF-xW}%#j2C3F1Um)BZ>_W(E}gn z0}9epZ{AHW_38eZ-Hh->X>bg0!|5cCo5T+)=*u%P!A{+Kmk&=C6vT0C=;jxr_4M@q zqAl4T4Ss#=W{Sjv$h#pq5^AF zRFwFn^Q_}e?3dvjZu#|q+{>RyB}Rk;DjOI6(G1r`fh_#W@s~kIOH0I?N0H+u?2L4V z{`1?;py!U|c=vSGb@ZNc7>FFqY3%4uzHpkoHLo>Yzl_*HKKZES8Yakl(urUEmw}wE zx_^1x6hHjyx7N)6cfv{FMe2%8(*0pxyCHnhrsX8A*BXYfu`$Y1qQ-n7w<)hZTMh!A zd&TA?Wm5-q5-D9krr)qzH=}B`Tem?yW)!XT5{%}u0W6D;eNa`*oATDl>t)F0}WBU(d@{&1es@#K7BCwy zr3EkzTmY<)B8m&nZ4a+j@Rmoy4+0QlV`?lQ@=fA}CJ?2*K-&WWCUq(z%kM--RsNDd z9ZfxRYy$?VDggqK0I^{tid>3U{$3F)lcHyr97_J(Z%UV>3dxHHvKEK~=>?9-rsX=B zi5=3$BQOPJ2!x@on=npu%oq0E1=*i|1FZ%?7|rP7F$KV=0eREcUbNmva@cT+MU3a$ z-CSgIO_(fs4=L=Z6bEHwgFN$37M7N80Rk<+s3Smri6$f|nENM@s6#gpIY`C#q~FFC zMYb<6sZyLbUt?k>&j(t;X*|0SU2r8DOU=ZyuR)KKI_5|@v2;RQ->jzI_gw3>B@e?& zO^lFR6|nW7cC?R|<0F!ctNQDFUwTF`rjPk&J)v9a#27~G}01*6y}<|A~vy^ zb4c{k>g>*1kf||0v|ZFjICAqiuaf_5IA*0DKC=_BMZRk8Cj^Nr2W_sp&95!mS4`E0 zu!g%*YYKH%`YOE_((u#Z;$Kv-4a>fG6w6XHybc4coho|q;cYZKJXd9OnHwWnCj!uyQIX3Pi$9wyz7 zS?_0|pBt6VEZG)|KwM7IbMy7Rpq!SHq87j8rzn>P97HYTH=2Ov2c!$n2_Hw2t{^n# z_Y%AIpjpP#)UhvU&<-S_t;ZJ{A0$mk-8`wC6~na#rVDq^i-nt$xtXxg+8oRI)`)Pl z-1?I6<1@dBCDcO8=1*-P7hBty##@-Y_`dH$ef`foJUo19&ma*TW_Ckk&C}9aeqRC| z^m$yEg|S@|y{fzDT2ANJ(D47GPo;iBHU`J(d0v=-4Z)j&hyQ z7AQbtI^qYeM}}edXz%jCTc(t{eD?-QYLD2^nzr_SAEgs4wV^NW$6r4O)&&M)MrXPL zKq~jA=oFs-`@9T*wRG`q6S_;_?A0?2G8GG-e>M=p+|r0M`GTiPfhtvKtnH$lMjY7K zHmnRMYk{waPn7Usao(_)J^u_dA6etd&OAa__@RFv9NqJktjAvcT~^Og{s{ZYnpykn zv0e9eSw}6%x6+*v0#(%6W;@KM)7Gc9&wuh(B*x0*Io{51a^s@UscijK_1YcW*?yX? zFyUJWb8|J_O>>7h<^j#i;-UxiL&esF^c&|Hd}`bRVHU;O%r=<0n*7hP+kku`7~B9P z4D`fj+f8X_!(Kmf;a*A^GLlB=Cx10gyTVFo>=EqpZSii3ij1@poi>UQ4Dqm(xfuwB z9N6TiFI_9C1u>B(1S)mCdacYW`W4k^+Tv+<__X($_K`~GkO=i_HFx2oh66J8|J^3K zJ%K=*Fo7f`>iz@IIrv|wft*aLh~?MeU$!cddo)A1czpPPHM<_{bGa0KR*B+!s{ zOv+*SB1Fjn1#kaai5D-r@`2{u$6!qe)YVm{Z4Yw%1tl<2z;_5~IT?=sn+Ec(9($^oJh>7Hw^ViF7@HGm#IsMyxZlpe? zcwLMz3A(}&mA5p%yQ%cfaw(;Z_50fU+%cQ>rE91Y$Tdri!qZEL_*Xk+B@JYwv14sg zy6V^0YSQE`UL%!dInCdZcx1!*oi46G(5k)i+Or~8RgwNB6LdKYmtNo(eMAr>`XPC+ zapk(XtSb1vB7Zv-(OSVlWT-ULINU{b)v!g7+sk*;=e?@zR z86Cd>!{IoZd92A2EGG{^clEn5hHe+IBwvpD5KdN8O|7dvK7TRNkLRz^ZD>r7(~Q^2 z!_-y#0bXT(Wgx$Q99)eHV%jok-7se_#pEbjoZ(CF)0}+hvHL+tAEBeRxBkU%0)r}F z%RCAVwF=&Cip{jQB5c2pJv#%$`PKyIzuYcNP+0#?DEtSpPp9esoek!EG>Wny(?ViY zVIWEI?>s)UswKCH_Dy9XN!d`A&Fz1#nI-rsLFufp=)V{NK+PO0O2IKCp8u6cI*#n|tD&wL#z&R*d@7n8-Nhp(xihPZlGnql;@?FRk<6j zmwF0$f}(3s6hKYT!(7szC(Fb{MmWG(2COjR>RoEx`6{znE%e!*d%G?a5U-=9GrDrj zT_R@#NNEX|9P|f!aw@QL-szCZ85>c6=!*VL2cMO~#jPoKPRa$_u#Z?mVRD>S0!gana5+1y^6`Jv&SQ9MtUDU;Plb zy17=WLmO&{f^U511M=%2z@%tTrNGVe$B-e6$N0*}5)A*;$(P-{B2eU zFX@TkZZFf(n%CxP{stShVI>yZ0&k9wN_e>90_@ykUf}kRiJP_$%d6?QFb`EA-#U*? z9JyV;C^YHcDHolkqcu1^2}n_U%+%2GbFnypsIWKIe8qs}r7tX>YvSt)BU1o4aujE2 zjXX~y4(_O#cKX{RWhUj=3C8s+;z|uG$6TA!i`rYWLLG*ZYVKcM&NruVi4~iLrxNSV`cKeRibBB`Nci3fNro`+1jdpaf%&f3m4%pR){#@ zD0hV}uF+jPLl+`F4DpUzLSeX|rCu;T>E_%#8FyxKetTQ#rkr&xmFi5S7iJUHRqM_B zWoCslo_7VJ_gTDP|mFS69eHH$W1h2+BQMs({;{t_W@3-6}%Xe_w}qYr??9>-tObB;|*LxU;;&>m(t6u!n2VJJETzqP5D-> z5-toVl*C0KY~Fj#1Vfq(w#{M-dvjCb$y$l;8#M}KM2g<Ag_@d$f9Q!I}5fd3Rvbd%hQn#q!JLKi* zdGzEVbD5sgGMp@TI1d1k1 z-Vd0aG-H#y)|A%cq6iUip=dXE+~dqanq{*OtxA3w{Qmv7853?T2)DoF{tZOM zcR&(!aThw_NL9|dyrn6;%P=SKbNhcA{upIv8a;H%l|vlu@6VM-_UXe+W8rX{A$ZB* zs<5$h6S57I`(5|W^-MWP#qj51TEozGJ_i-2{udK;D%w{ zJvu$;puUR33b+xy91bnvZ8oFo)OxahhLwlap5W~u%;#(f39%B6SXCXv1DnSnRA?+P zEX8vm9}J_>Xp*{Ly=LP3eN3smI=QjJc@*$b^!E1JHa)qnGsmb}`<0iMmwzedIQJO@ zIU5N=5Om#eLB2yM)8k++vUPZO-Xz{1V)+@yn75$RZlV^}>2oM-GA09KB5f>`=x(m7 z@Yc~WncdD!bM7{s%qAIaFB_~$Qsa2BgfNq1E-o$)z1lAzDKRyp~QwWtbtS_QW3TK4vvn{1DTlA46QO$)-_pcBXR*;_Vl}h?+N6hrfgprpbA@yFUgM!}=|IifdaSXmQYO z0Fh@r+6Inq^^7dq-A#p1@u-^=5W^BD?K;=!uG}PV%aZ02!T#jy~}gEVTO9RDY7vhHn-vSR72V<7=&11tSHpT2k%k*hsml1nlw{`6O~ zo+7!SB!*5h2MySQthHl!Xf#R)nF+unM(R=vu#LjP}c zR*U}M{>EtWH72;N9}}?_8cXv-8WmJJ5L=n)YhQM(0T}k4PJRKub#7ER6?G4yNz>23&3xVjDhDT?96Soh~s~u6-m;3%9D*skK*iB6j&jYu=sEZx~Yx5RK%sQ zkR~CBik0kFfNbsC2_Pj4sk1BAZ_?=Tt68<&N)X!z=G{#D@0ncN3ZN3-cvG-8rpIBX z09efFMoAPfw?OAy%7TmpK}Js%!u_gFVeC^Pm+_~A_ffF0wnx12MMB$8&6Lvgr#9hx z2SHzC_%3@GuF@aklQ1}sZ=wO(eOT5oUb_sAPk2k3Xe5H=FQK_mG~wHE2Dlge)UY=1 z?-fNIM220}XxC9LRyf7*ARr(DY(I3929f=cX~sTScPo4A$IczT22CckXTYo5x84E> z0PO|c2~It9U_X#X6@{x>W#Djt39?yI^>yy)89gpIc;trtpcX|x@Ky120j{^uIM!w{ z-vt*Av5bm-&~3BZR$*^3E5vsA9%q#TU6%CZ&th(5}=53Xki>`vL!7UT%$6O12w zP)#Ex7DTC*!i6m}e`*Md0_7leEUW8_*g|I4mNw4Y(i@{t^>lV4kwP}l#1VB!Pse=o zn!DJ^2dFDDJ;gm%mgE+H-EJWmJCTj7(MsMig`Tms2o38ub?oD!!Yxc^)>dwia7>S_ zKR3jO9@=e%d-zh8v$hZQ3IzqxSisKH7Pv>uCz8Rk0bZf2;GUQjY4(elQUiAa=xrbG z%uQ~rC&Ht3D&li%d+BZoe!yifG=XYY!a@TF?l0iQzRR|D*?mL%xdA28`Yhn>=)}3{ zj{sboJDsJit5Caa`?m?-Xf-xQuu?qq)$z`wOwR~#gQ>H5gifC$hQVG)Pc9~;dx%6j z`KO#={*D(r@Z@7tq$h!Xt`BwHf5sC5`}%2I=^nUqB&+XP@1#=n-XhILmmrn|Q>EthSAJA|A+zt743=J%se$rNR@KNZHOzqlPQ{G_$+GkW| z;=Z1x^;6^ll{2-Ku}yiw_hAA>hkHGV&5om474gCPZSwrfzkuKG#?kPg8EK!L!z^Tq zg@>g7MC3Qwr+XeUzu}fBX1&^h*Djh9}!wSA43&wgg66u+tqLl2$cke%jX?ppQ@enT)pM&Zjky%)CY6u=%izJ{Vmv z@A_<241V5W0(}fYq7Ia7qLV?0*4gEBXLwq{Iy&KRNIYcVIw@(O9KQHfN_Vp%Xp;$2 zNsy_*RI7j7+6hai}+>n(X~j4Ag@Hp(~xb7hzOEVJcKMHtF6epqaAVPkaPDlNSX z65JVPn1S(^3vQ%jXOp<2T5Sbk0&qP_zA-2OYkxK=Z_1%%%%h?T03CI9Kd`*V-fr7) zg4glvm14(J@MP2uNW=sJYUKgavbnYOukdWB(-&!{+y37*=X2_e1Q*=y|zS-}_1>R5b6yU5pOl0fYi?N}J5E)Z4hw6z5>Fv$C^o4K^o;97?d@{0<2m+H=k20!k+@ zm1j%?^Q6DoPfu9zRJ19|%WHF8pvw=onFKOzU|?V$tTPFgdqXS3o$S)(_n;B3dWQhY zw;A?8y1#^cb4OWEx3)xtGx+z7jfWLF3aXk-4?$Rj*a#fS8#S z1Vo}v!YOf%p1-|mgqcu(NgYyQ%k0|GZU_A}!FOIk-;0N|V6mH>GEwR<02K%lGGB=E zA>3LSVab_evU-_YaFA=WsmO5-c~&iCBxpoY5K5#F5J@nDl#db?X$MSySqk)gJ~fay z{D-T69NQnT1)D@#2u@$#W;@e@9s3K+sEGR?CjHn;EX-AV(r1iyOO6w@A@$L>g1=ON zp#JVqJ+kNvuBVDr2+}X+$M5qg(pa*%l>n3GH8tkJt|OTONzKOcyc_3LdA#!0LN&U< zm49;LOk~9S{ybxJ4{6&t_wBS}%}_}&p@H(p`C^~OxfsGZtqxkf)6nkug+J~>*hq!V zSqe#n+ubyhWr##(@;Pbfjo^#8B7S=5YdnDJ5APkeYy?{eLr`^&T%wMlyewv+Ec{Et zEv==UBkB9a)n_}UW8&?B&$gG>u4tdEgqE|-|4yZ~5X38l<&V$=bR9>0Q(x#Y7<->D zg``D2L}vwK!=^H+RO&rM%8Y+{wTPA9VU)Qzk{l1l$de^5oa)(fGG1Fem9kVESj=Af z_MsM(Ia!8jOrVe%jCoa7V@s2lKL|~`J{#ABKq}}#gUid(`X5O4c-s3Ooipq-e}w2vJT^n1X6t7*DOwJ$Wvl&QlaYpb7@g0h3 zzZG`)HXCE2I@-jIi-|OG6q-IDp}_hjd@ZgN8&x^#mDxSK#Zxz7Rou;FpZhYE8FhG`=o)izHJ`SyqN+}*YPH0P%UTNo`{e&3sH zP()KlpiBct$7g2r^llub7WKJ6bN$78NI0&kDOwrsD@?{ghDA56%732BjY1}A^C!XE zpvNA|&Nu6tL++gev5%P1iX0e#v=_*LC7raTx+RfjvnKjjb6;@vLQ7O$`|hHC%YBc$ znOOB&n9c+03UuPe+X8L*>p@{a8Ubl`J&TW^-Mk3usvYHKkQbP)>3I+8ti}SnehwVy zcY2CMx>;r>`opg}%NtK>he?)@q1JJ3NQMWKenG0<&4ZVPM`hH7-cCeR(_CklSR zJXWz=E%z^9Vjs^|zIPGA$1s*Hk8A`pVUbDl;l_qrsCTzTx(a_3e<92hKPh|R?*Up( zx9)V>5fn$Yt^|PpMkhryJ;0tK4GD$*;iX_ys7Zj;kiByK{$#2pbWM8}?;p(+HBAY2 z6dYLwjcknrPmGZ>B~qtnCC6qj5whi8=jw2f63oca=2E53*q+9tQu{9x&i@NPjsO`w zfS)n9=a1giZce+}Q5dgfF|xUr_|`L-9#Hp+#J*%JPRq2%`#{mi`n5 z>X1}SJm^-_m;Z){vRs4Ud$r+&DN)@6q6y8gcwi5PjT71>6lis@ZA0Afx_$vK9fe$Y ze1?Gm@a8`_gaP_<8jgYj21=FwFfp7VK{^2tUrdw)3uu)5l%G}pbe999t~9v2(fxOg zDl8VYu4CL|Fcq}phXuJFJTU84a5-O;VZf|sD~jH@$I|MLg{uK9ITmj>01k8Lx-Jp1 zD508$8kfD7-(8D#=}0r%4h5EL-Rycpcrm(bnyf$hsG*y#eh+ItjDfza&4G~tP(0KU z20D!ebBa3VR?yABtt{_t#%1y2ZyKoL#6hSkA3QiKnZvBdz$3>nw?rd%paBTOfu-~m z-$S6WTyWq4<-moD%jn)zr?({2r}u7bEST*eq9PZajG{Q<_l3O?M`$_W-wy z>3j^z7El0_e(+xC83ko!ra7*B@daZ{=L4AXV;a=w4i9y}kN+<2z}Hl_Yff{&DhFf) zN?@s4Za3UR$b_Z`x(HnB0l4Rwy@ovS!k~9AluB2|Hh?Z_4wli#j`n(bV%E=jK$aK(e4ZPXk39cn2G(6|w zkmy-RP9?RBiY=DOK-$2Db9eHv z*%ILeu1SKB%ii;LZ`MGVIl{kzgdx)sc?4c(pIo!ZyG3uI+ozWNAZQjnq6K0%?80e7 zHcJpIlR7m3k>;+b+ype`b3#tsWvdgrwnNpf3vkL8aV%_OZ}dd^Rt%C4(clKt1`Hb{ zTNf2zmjkaG^j{JzHk`p0RxqfQ>+nd41j}3a4yIE+Ga~dEBuj8#9LvpYFO~by-9m-N zP9sm9RMxHLJr}>!*H72mHuwGV^I1NE z%HhyQ<7?Xkit>?<9&gGr`6zYWosiooRo)1gdo)(AoVL}C>+2e>)AXR41CmRYCT#T0 z{@7e3o-SVd_U_*LV%kpcAnhjx`1Q>MV-iIzwU1)|)7(t755d>x!}tvmv(YL)I}YD! zhILMCQ38E7;frm_FL~`F2H!s)?A;>nY({|q+3zzHaeU+9`b5qM1lY@vt!X=(_AsdT z+mGr816S)mf0j12Efy`R@;oCgZQKyaT`Kqc9qHucr#mwJKG$M}^s&C%P5+C%H;=~p z``9oij>e~sgz z3g(&DHc5zx(4Ivnp&S&L^y(<7?BOJlwlRy!mlD$hhV#5QOEJhYyTq8QN$g@v%{^Nk zok02BYAI?Bcv7rY!7QyiD>O9JxJCWkIlVL~v_rUpjgF3MSX?;xJaEEn zNKjNXqtHIYmHr(1>sPN{U7=6HWlk40&YOKix1TOlpq|( zS@-C>`NJMzgRFUT&OXf`eR2z>_hqw?#GHAYTB5E_<31swbH*uIO?^FCSy?PnZn@<) z*k4tlnN8gO%ZdcrT(gscyqZ8){}zLjXW@eTW`2 z`Vg2$HSr9;efzdKjT*3F!v-#4sm*RP^r1j0cQ@a;grke98b91worXRLTGkfm%ufb~ zkV(b%pt%G)LkB);5MLrSBVnm~8GpuJ49rZ!T)P&(jE-P`g_T(|2dcRw*<c64-H#l+MwH#^fcFwknb(t2YZM4)OvXm6tAY+QZXvFKBvL-g6*`tav zRBnAM3i6-$k#9Fm& zK>K8<>FdYi>{oSl^*$I=b5ql*_qP~?&1$$flXRCcFvP+f^X}VM_eLdr@Z161W$lWx zw^u+Drmn0U`r*Uz&6_s8$<5XC^Yc3xR2~x-_Y}LJ|HH_}>st~5X;=(Iyu5q&R(*cL z88lRh9U8YheEran*w-qz+x8TDJDe2J)zu~IgLNs|B*aytry{tvw>sQQ5C3GnVE^%_CCIO^X89{kwmyiJ!FZ-A~ZqMwJIquAIe^wQ|~&}7NsOLdyd0( z;>lS#Ibq{3%o1atIdP>6L;eO*-~cHwkoYw#`rF&vu?E-APIV+MTC&`>`GEVFZ%FSR zso%0ulf*jPa-)|S)wQ(Vq^1hNt0+OnHTp{@-^DRUriu*2cB~ztZCI)#XD8HfMRY{O zNpeN1>60QaR+Et$l;UCOg^Tpf&CMqUQ!07U=TDwI2|VhUoF_+oN2fJ-$iUd|o)9^o z{(*tXpC6eH#gNf#yBJ@H9Kk#L`1lB!R_&0jNxJZH#UQ?t-m^1xiK!nJ?7mKKDH_gH zok$6pm4`1#!*Xvnl1v`Uj>mqDNls3ls6Ne6az%uXm-nn_o2_p-{l$yz%a$!m8(;=Q zJk-pAi+iInhICSGdK6vZh6ajSy)>?P(R3xKxmoA(rAxL~FO!FkNMov;w6sjvuyJD- zcC+{6(=3G>(Nb~o?SHN~Zpv_;6K)=QM=I_7`^9(e-fhX*j+;X@F=ZcfZQinl_rL)a zWH{?&U3)F_XuH{n52>qxcNL>F90|3H7hiQ(h9qjI7&k54N14A{#W-=1P}#|sAI8MS zP8!Zn8p0ub>mZ98DJ*D+ymP3Nh(&XRS#4zBaL!1&!x8dT;4xDMr!e%KMRTewCTPKj z4<82gNy~a{S=W5SpgY`KvIY|()wWMn;o1K8?Oo)q%mprvxvOY-t(ZJOEx8Uq<%h!njBG9`(>)D zj(N!NrRZ6o)bAaI2NR#0rt-vQz3IH_=EGIn@2lewb=UuPR*BiEf8LI$efzkXW5`Ti zwuaBKb>zl^6a?7%+ z@?E;tXOmUl@9X5)zSn5Jz}1d+xI6y^i#Bap|MeFkv|;{wyor~+1{!12p+c^*Z0TjF z!G#VJ3xD=}$7j`U4#sw|20j1Ot(qN*O%X{nQFTdA=O3d932L6Y@NaPjyqWE=#w&#S!VR2|=F}H7b87FH4BGSZaX~?WPlGX!rOA_n4+eys zKb#NOcS(&(XA|bbpZ>JX@O^uu?ejxCE+nGth6sOw#swn=^AqNGV)_Nl@RC6)w$!Qu zyH@GWBkogkIt2xKi-u>@xW1HMmu##(HCp}BCqkNO>*Y;`?4uQ;qNcNR*MioM({A_W zH3_2^E*+Yd`qVX+^%=D-O`VS5+QvED;aAVs(R#kN-8FPv*qf{wjjO}hdM_Z#iEq~F zyT9jU)w2Ueo;^!iXZUyq^ipP)W=?5(IJ?KU>Big+H(utHdB&$^j5?{Wop&+n8J9le zCmN;oned?Q>!V^CHC;R-at@oCJ<~HHvP95riCKoaQJK0?6ASD2qT0?I?3W;&5yMGB zF+$4o&eLP}oY11r2L#Myp9L+J(7O`(vUq6U!F1BQS;Id0e6bDbr`ns-KkK66Emtz= z4LaSz8@nv}oy%2htkgP0+A7NNX5a0%^w}5O5K}p4;z<|X^7epcZLXe|*;q~2HcCsv z;rDn=%He}D%{SP;e`J!XEAibUY-b*KO^Ie!Sn$xxY>-yijXu`+RHPTw_s#2crt96w zLkX8N0&)27AJ?{EcAe~SWkoØ?~!(g}Fp|bp5TZ2**?-%GaO3li9ywJGBY?mhV z%KbI>1T|GSmPfoK}mrAHN+t;;TdA1zae$5OlYxhiD($?zFuWL&m)Rq|i zwDFp~z5lt(3zm&yyY9Gnm6t_R@+qvxPJc#=hxAvGXDGfqZYwRCW;dXLHL?F~F?))m zq-3*iGzp5OnP9rI!{T)_`Ujg*6c!T)$>SxKRNF&K?eTNy)DApx#SP*!^y;q|k`{gP z__6eP;w3q4!{gR+adE)|c=3)HyNQFh?ccrEULu}hM>^YycA~p3XwUI1y29K&34?nwod#Tawwvv*Pzm_tI6D3KrDBa(a zL<&Zg7{9kUbf}w|@hsHLBP=m*HD!lId#*No8K=Rw#S3c}Wetk2AaI53#p(q^t$-z2 zJPW6^8aNLLuibX=oy`SNRW z7wq@3@$T}JfA3<(%sI}@&FwUl*070%B?fVD#`u(Ic_L4+<%y&5xd)(zR|9_XYwsRcLTRmR(AaU~AwQI@0 zSFKu=?4Yf`TU1n&9NSd{?1h2DrRr}>_ZF=f>a|7)-aw1jz5G_|(p#-f%*=1MfH z;smb#{CaG*OVGVq$$eVw)alcI7hFo)_S(+sFh&l^xSKZ@14KIOLjv}a>#e>Pi02uY z*z4dbL?egb-|HnPVQg&XKwm_{`>C|JzR~c(rlzK|^72mss?YtrD`i?0dWU6} zo;`a5XRG(Q$;)cI{E+?z6zIWzuj&!w)vmocTtSq1z!Q8sc7&c@N|$h^_ugWXth%{u z^``afFN|CpEG;RCuD2-m+!l_+)3Sz!jE#H?PSln?5C&#xgopPv1#bA!uz4~x=z*ta z9ZV*{A7oXvw4SZ6*u}}oEsODMADhVe^y$;R@I8r0=YwZ~S6qusc2ppEr`w+!FS zq2B(;ks~qj@!XlDn>DNT=*AIj5Ubbm5dS(fRN9$7sG^|Y1vis>((|3$aO)8akOhCN zHOpqQHe{}@o%_hstDQwW5)!j97I0jjK6w&`p$DgE<3bpt@m+GrR20F*>!>I`>=C$V z(IO|{Lfm%q@7%t9ST@w0CRZsr6Gyy4ppF|GTg=J>g=MUz?E0Vn^(3~la}M?HM@9#& z!O%S(r!HD@G=jDFd-^m&)^~T`RKa{6l0Ap?RlSqU>v?4Z8pO|kB1R)qM5fs}6Z09b zX!p6{1e1hqy%E1*zMhig?@JksgCTCy(FnX=j}*)s;7p}@LHFNsi=7#C)66$>4wC`E zcc7+S4jY=3ef-#&O^;7V&@eD)S8vfe-4vg#dw%}=LqW7J7xKLM4RW=RB$MGFE5Y*j zRyg3!_YpPZP11B5(yWdjzd2kmKNp*>o$r!WT3X6w7xM0IGY}EQaGt-ijYG6_uslacEgwom=_1FYwnH9L9YUBFm z>emAL*(5SWL}>oy*#V5&fv25NCL+3U5OevJR8vzUgwv2uojkdhiz`Cy(cM_*(Za3j zIy%kY=}Q+5a5btpYE-nM*9d|Y1}XI^W74b z{pY1~rX`)}arv`!UGju!7~^v)DmxKwDF7N=y;T4K9F-w&l^)Xo+cGg-ll)>7OL5+j z8ZK8?UvF0C&!7FfJ4o1JSg-Rp5|yYe=@vS<*RRG-M<*s~9y@jew&fgR7#wx|CMii7 zCz6a!O$EUJfj^unkiE74%@i}r`+5dOX2a=6+nU_7dEfk>*(ZUKG9pfYV~SgmVlF$O7 zsSk!U7o?t(eYK|%GxWD)B#w6BNWPjHRrF2&r~4cAe{ZO|2|E+7_4bv%>x-j~sy?>8 zRbd0e1DJ%_Bl$CdZ5oKD5fyLYSc-w0al&-uTildlN0v<#W@JLFcYlAseZv8~1{=c3 zlJT``*8*HDI;Xy>Dl|J=3@dcAXL5*yvj%oLFDxv)cJ=BLtVJ^3?C~n$GG=&p zmP5v#)AX*P*81(OV6!hw0B^9qu)ppAN9h|J{u$#U|#Pk4lJ~e@6j2k`^n2 z7k|fo=7@wAOz7OW)Vx|v*H6o}KO6XV?mWhH6mmm;Ui(@F(LMw!s^;b~=r7Nn5cfI9 z@)t+cpg4*jj*W|xzjNmf3FjR;T%%wT2kN5L(7g?yL*cJL-08k0WZ-fFogF9W80{ob zw5{B2Iy*1qDAm=~FmLsN!qimr`WVJOK`}8Mafjh6Hr5W;uGPFc_3$Z7H4MT@P8m;S z1A~{AxuY_LpFX8V3u0bl`#-+Jha0aagoVA=l8{7ktfH1r6B846E4_@Xs#5maek56; zSbD1V$q2zH-l-ghtf?%Gg-xN7_H@UvU90{JF`PEIM{zLeo#o}V!#)XonW71a2%q!w z^MkiU@^5*F%(Yl_G>N;hrw*WWO;gjooC$27F)(i2xN%lV$x2fSz~^+(x>!4}i8X$pEmXWuI+X^@td=F}e@CAKd~E?^`r4^eL0)nYasEM9hZ?F|h( z6brb6U^b1*1G#0%n6drwc|9IWW){H*up@%7U4NZo{33eo=7rY@<%1CmeehtFY>o3s zUKDmNa40?S#n>ilqDA}o@#C8|Ywp zCxx6Rg`ly9@{2M>nU7qHAnPnJr~%B1vuDqe$kw))%>fqbQ+pRNL|ES+N5GB(LmI%! z+l(Ye`cO+$$lOF!Hk_d$eG<}o7RXqRC?#^ zAqDk1!5!KrH8<)#*~u}l1zyK#yj&FHEecg6#8r;aU9@L7cq98s6@C4-WA)@V2?R8m z@VQnH!wHZ;F#p#pjAXW^F7gP8b*rlv4OtJwXPAGu zy%Nq)ooI(k__Jrs7~eJRmr1ks?$o-+*tjSo7=l96&ok?&yY&a_twlg&Y}^~Bx9uHbpo z{jp*=4l+;f+6tPxd(`G_51L-Mm(#C`KlGeZK^)oXS{v-{kH+#yzZj7hbg$_}qUU!p zHt&Jyv}K6z{C~KX+vDO?H}|Yug>0bG_`5 zBivXJX8Sb@YVLBly(#$9C5XlDt&6MckiJILzo3fPth{tei;+mrK$l~9D%TeU;18*` zr^9r{UoN(`z&l(5ULiZ$MB>tv_^h7zf`^fsO2^M*%(7LpMP z(xtJztFauhbL$MdQsZuTbv;>p?Yyn}^Dx z-!{=vXHScqL$QF7czoqJ3WxUj*#3?PEqTp^IIfC%pvIB`1I1V;(*>gI<2bL9X2cZQA}`W+{ROh?W{PS% z<2hP`#KSt#Ll~=pM>)_iCY6S%&$CzCn!pP=d*+O(dJB9Y#v{h96}$ZE^@Q96;%~G~ z+t^7A920sOXqmT3X8POwLBJ(N2LflgY4?l&cgb!7Kme5F&A*;D!A$%9c3l;if5pNigpIt zizg`_%P=^7UD!g~bI3e=8_i8oYU6o5ansqyn+E${Wd@&;IV0MjuZouZ%{b7|Z)8}W zw5Z~2S)wp|6jJ%-=Orn0ky{K*w2ewf!w{BRv}M<~ciBFNy(_w?t(hYr92$@>SY?AP z3HjiS!DD|~c+qT9({i|L{ZIG=;N1GNA6W!{X#b_Swx+9No>ts2?(7;E5bHm@_sX@c z>qFACWePqnKb-L^C2v@f3D%6&f;FT{99S56sg}4sS6`PMdOuda_CfHq$@x8tD7}5m zW*Hj?Y=70YvH(E6ax^4x=40A0b;_UR8_mSjFvueR<8+gJtasxx>iC7Y*KUCud%wK` za9w0tB$Qaz@WP=^__oTTTN4?H6)fINA<@FdD^FheBK*iXuXZpe2>c(lujaMW>}10v zXdvq7_d*QTw#BV8Wq;foazso%-dH8ESrU#nSuCEs$275Muk}n07k}X8RgZ&u{a(Ci zjhuyfPjjDlgHJS|SukBMJY{t>&@$Mdz2?em|KZN|Ut;4@7j%KE?V!k>Ja&$6WXh6l zb3onqkuI9R7N>aUk_;hiwchMo*h8VL3u_a&DWUJV{$Y_?=j*cY8kz+RYSG=-zf6^2 zKP}}2CE0sSJg;fBh|E#yRi(1JsPh!{Q}i*8ThqsdXvmlVve& zH(^%Yt*m3=5K@R$q6dBzko7(~c8@IVh|BfK&v|8L0o)e?1m7nKoOF1d(jzFMeWjmv zb;;)b*^j9W0QL{YOPb{>VO3EEpz7c@D$O9~F#H1S&8AJ8Z1rav>gqmU>At<0Liu&W z7m1E~vDMWRR}@xWT>q@XzU%BTeV9St2>vRspkRZQ+c+!ql?MX2C`sN3@_{47>bo9= zGcuH&fbieeu>7)>3^2EuLP57MFe8S7c@sYDt`jP2w||cJ@)+h75z&CigDwC^dSb`E zlMIJFoQJbcBaUz2OU!*07#K($p@g<%T_1ggpf9m)9h`{uk;O|Gf4I+2x%)kT9$n1g z{$jmD=-ne%zu$iF@Sz>Nk(QiI2r@(e!ljHq5aiNsuiVIdm7tb8?gL+ZfivrM0f8)a zcz5iwv2j0OnOa0lG48VihKM*99J){j&`6A?!>w7kYSB=8p04{$OUEUsOpJ=wxMGk^ z19yoS9K7Nj0Cd&~-rd*G?uy{pl^b{W)@vHpBc>hFXRI24uS#u5&?k88=FOX5KYqM! z_8XIXRj%XsM7#4yQx0@eRVN5CYL9@NHMVqP>x~MB(eJ0~>*@%#3MXqCwuq3LadG>Q zXkrMrFvT+S+wve+c(e$Pqv6rbYyws6Bs5&hcsMi5rl+4E+@$@`IC@K#ufduooq@bE zbpwM0Tn&sgIws~U(88F61plTh8g_PR6(LfIh(Gmnud5*8yuSlHgT6ij;9YQmVC15c zl9CGjIvCcnL?D_jX=}@SXo&vp?IV!z`L)A|`O`7%&VvVTid)}7F$BQIj4G|H)RdLI zUs_hC4wM0h)2!u?)Wa4Z(5BTOJSUtf0bz-mBEOne?Z8g{Z@?P!vv(5N+pkV)Www01OEbi z-IhNY-$~jJHin^>Z;CtJ`RAYImoH!DIdn*^!)+$M;>D5hW4D%kYg6^zq}+&!5i_)kEG2;KTpKy>H7t%=VtGO&eGZfC5&| z2=DDjR523}n){Rfn;hxrXy+CwW8cGc(a6XzAmB6<5usZFJhz?e{F;BMWCMB#5ld)2 z0zVSGvK_g05>UmlW5=?gpGt)u3q6W3@JQ;9AD2$aKsB9Ne5FG3`+=0v#$Lwho``mbljCGG> zwKW$4^y#rOK|53((gPkYu9GPyl_EFy=!`fN%mhPeXmnH(gT#KMy{*eG;;0zym-Cy9 zSdevwuZ1ZTQ$fUdOa2U+NclolVc^uqJ=-l>Pz^N#&}FAA0%GE%T{6n1r$!PD=f(m8 z#q478%93-Yr=2kE(lTewQ!az2jRb+*bhM$lDt~9%alSeII5Puc@x$StT{1YN0-`BV znFH%Q%yl4M6OI}Jh&@r8jfrE9z~F7izhvx$b9VAEEW@JC^3)EWiF3cKmt{^h)Ue$l zUJH4s{^ni`3GYs%SoR|UWx;kFBhuty!~Y_YCJb-Mt<|4C9)ex&aDxT5%P%=Tf$u%@E7 zU~E<+*BPrb@yg#1*rY6KL9N$U#Cw-hck{-^8DP~vOGsNk$MTaFXX2|m^2MkV8#7Yw z@k~)DLLm2@9_w1=)vp*Xn43(@(qPud>^_NlomEiq1NLK?GbD27_U%U0YvcCqaljgK z*xc{QaTuBB6ga#8&Y4f*Ey##YOfK!$ZFMMFBN|lv*YVG8dPiCu^(H|YT$xnDg{jGE z_js;%kOglS4)gcy2pXSK#h$(U^3M)JNEH?2>c9ZFXL8 zC?PIm_X&FsQlhtHPsooNPlFwxg-gu^N^>K-d~eeFrs6LLzl6vm@cTKDswJ=@{ZL8N zvs&ebfyW0)GqJzJW!y`|vh@v7*+MA-xF~)&tA~BDGt)Q8D(%AhwfvS+E|KX?9uho~ zx^V2hct-I$L8&AL#RA_S{qtLq&~L;X{U=p|L5JH`@nM>oT!>)nh3|KBqNQU_1HzVU ztZlX}78y-BT(&lb?z3q?jLxa6zXnbsG2I&u#wB=1U5h&6lNP;k%ge#j?bms8xQt?Q z>a)cqNPE4|&@<3(Z>iHfpe7F{x;2v~!87o}g=XA`7-oU=44#9hVWAOCyx4z{mA}-c zyzY|h@K>*P5ru@Co10G3`5Sp<$3!Q(0u0T;boDnRhFAipSJd6RR%*qnRW<$fv9Mz; z7lYtc#A~O>K*pu7wGAtdJUj|a!qq}TLZ(2~v#r0~WOw;_Y%TNtckSF^tiLe1;mF0o zGMmA?1`3(^_|V)gCZ?{B!k;KPs;gS?rIO+gE*h&2Te zNx(|z((bM2Of{?B4HTL8;K3SP4(By)9wwwyKwFtFVdEEV!mOy;V)CU!4-W{xg)2p#;;#BA$lQxx7A3>pQfaA~o(^4vEPQS&R{! zVbpRCuEMg_TYCRtwS@Q3y8}C-Yo0y(;GZ?yUbR>i1TT~xiW{n4?L6^Muhd+p)C6=z z1BvdlvBS_Fm%o%~X}|nUOh4257(lzTva(N*>NlJ>WzYr*I$dBj-rVBT8F7!@Ahifl z2kwDDZY&Z`wkbo+$=BP!r=`LV|2;izf9|=djJmoXMr*27ha>?N(_1WS;UEm@Z$UXa zVOfI;&34JW^<7A9jMg_8+OBlA_`x0DmiogZEhY3w2WSJ}D_fg0dluAPYDyFe0e!;w4M`UcPjzm;5`LcHUn<^@xt~!YeGS zj>QBHsv5{Y=- zQ`(1*A6E_!DXXf!!qMulBO?hFlnoF~7~rULz%qbYibN2_i-|K`ZsisZ(Xk)Q4drd0`;9*;w9St29`(Vv^RVG zgUx)Tm*HzuYa(Rhn?t^~i;%w)f)7qwSx1K@QW8I~K14c!A1qBl| zmrY@`G4GV%U?m0+)vc5bk|?~W1e-W#YP`F8C(j>IHhUfvp* zYr;jzf?`*DID-y1tB+B40$`i{rY6A#&w)~ng_K&hqHn6*Iq}cz?2!I0RB`(zh%KW= zCnoAJ*Ix7MruPCk2U@Fv5ecq-A97>~u?3x_*tH+`Xo-d$JBwR^nKQBaQx^_Y(;&=6@d}q`)mgr4`67V^+B-Y2jm=dG_<5?<;9K!$JN!1bsX;|YEkE@;d+cO zbu~2`{VBhKKu{2H2V+A+-|ddb$<8kQ>-Mf%xw0BBRcO(Khg!E`@?>K#ypTVC{&*IX zP><*~V`6x@ckhk?j}1p3ve*C_FP7JkE_}Xpu;kJ~v&JMy_vIBV9sR*v0*5dye6YF5 z28jkyyXBvSLIax0n`(%#1WuqDtN?_0>iYWpP{IKY4hB(%j*!vfIC$yaKTI46AjybB zj!{A!-f@b+6)n|k`I&-wwQ3>nuv`fe24pd9>)AR;Q9#XU>?sR#zDk%FyXT3b9pwp7-n%*4rcMh3ei^UTLePQ zo2Zd{0G@%1km=gm+C;q4+}eRPQP}#cGzNHjV`P550Rq~hUAEXIyW#mEle!Em!=QB| zLqqWxhN4-FL?D{E1!7coBg8l?;`VWmwjUuJtk?AE&*B+O1RF0X;&h%^bNT|W#z(P0Y%yf9kG#Bthv zTpVg6a6j1t2|2b6`VPbhlhB1kyzplC?%O91uJA9B$Of)1R3AP`vunH^J`C!$&hjCW z`rt|%V6goH17oCS`;=BOGHPgPF*oEdz&WV4faEr9~k^jow79_l3pj0VBbfN**gCG=GiQ&D}g1o}JZvG4KNHZP! zmqUb)2uI_9Ogpk0f57C8jG+mumP0cq%@hCt<>}K+!JzGt`x6A$u0GLF>hI#pM>2Qv z9{;slPeVcy5xUL-B@nXYJbj(`a#u(Zg1-2M$b>+6lW>_7ks;V)jj9aBFL)px1`mF= zI|55Ma@oWr!z=_^FytPk`|_e^+Ms+~L|JZSWksYIVy@Gv@YReCS-kw&E~%Sgsebk9 zTZq+l>LroT;M2_33?|A9TF$(qR!_m6rI{Im>H_t0rC~Jjl8&n?P-VZd-bTiutx$&F zR=P~7Dns*{0`n{q9)alp+@(tqsGzn*KHGogbt-~V9b~yx$N8&%5+UtT%!w*&e)IHFcyli1Ld(&tfHWl3GB#9?5kBP7vg7Lbl zs`Dc?Rpp45HJ}7$5%KVqq)<|~V$n<4CDJY8C?K3s)IEy8yzoke)mv|b>i^P98IM@O zjalRrZKZ#MmjD@>veMDf+XPu5l<&fn*3^Wy{inNptWxufO(}D^mS^H0gP#l6@ANgM z`C8C6+92rsks=b?G{-vPkQSm#IKdWeuD&tZ?4n}$ENr(hbnip1%qFQu9e**oWPV)$ zZNAymg^h~H9!yc=fn~4cgcwKQ3pjN@H<|c$mjhb%n)cVn0+e2%ru~H36O4*1p@S)b zsQJ>1!@3)~Bf;14#%7rw?HOq=XxeB+8^XJb+0lhqFnTzk)vuR5m*Ba(RYHlJ|aKaVSt1(wP zRq}xKH$T>?zI3TdY!~xFgslGs=Mh7;;h_UN1`(@&p*{YB#P~AaRbzI6B*s@T0nK~L1 zAi~cIr)U7O=5gzmgldD`;zgJ@`m3&KwHN?vd3Oo+o+z}%stN0A(1$YO1A7gOzH%t1q{;Iak$e)iMQzM2KBrqlna{)Hc( zpOBD{2n&b~ga9_emrFN+zBe7z(qJf1g(?K1LY?~b?Ck81-tND9YIK1*cy8|EHUmXh zUODK8q1OCoyRLgT+vO)fyqs9k-o^lj_(AZX{lXw!1`}yf?o*hCT7?NSU??M6Oqc|)6V2|@w?E6qV_=+^?Lo}Z5OP{Y+Y?VNvuQQWN2mme0*LJ z$Q`gBk^DjLWjQi7DDZ#I3Gt9H##ACIWMviJd8j-=1+<{OiNVa$8#C|9QZ7Qgyp40H zyb0ArJ57$|s_2Z4Ts$s8p#+m$q*G+NTi3-ZHFh?t%U-MPPr+H36D{?IZsS^dsRgaL z+|?uFAIAaPnWl})MV}{NpS3eBj{-LzDkKRD;MP4tt2h1&Uy_6XiTwY#_CtJA{TxIf*GL;AC?lKGL&p|fy9r& zhp!%om@Ipi-m;(xw^l};1#SUq3s<8Cayux-U*iFU=3o`MQU$uibKOW!v8)jmP-nP# z6#K0RGCVvevZ^>c`rnWYLNHAPZ-M*2&1X2wzg4NfKR0izp`|Ml&z7?h3Lt|xn zVa#vyZnja^`G4x)oD+ROU{SzQpNDs@Wl&$GUCD2(ycz#YZllP$WR^hw%)O$U10FAH zZPD4aHb^?QvGhU2qFN3ANJb6DKi!uZRD>vqNS@lMx@=k^r?x$ZAQ zdf^yD#HZrql#TVs(%cb8#>6A>N(1Ul5}w$pmBId6TEQXlh+V@fB9Ads5BVCm>~A0@sIyuCG14itA5a|P=;YctZ)`XG1qb&(7qm>j|Or>ETK9VBKaYH#IR zP$)k?f{UPJ1{QZ#112Qw(4qM7@DqEKUOuhtsYL)xlA`+Xv}^>0zz-4-;}cEKA2~%u z_Q%P&;}zmg0P9n)G#!);JDm!Ley@OlBJ`U}l1cubINY?a{=Tp_a9;oqmCNVA`$ug^ z(j0k560*YuBZ{NoBQ`Sd4(p(~Vw*=xKp7hWITHl-riijY!0(r0LQY-WJT6!eTh9OT zp5I@KB&*40YGR*g!EY~&?2%`fL+5wElcZ$a5g*A_Bd9M?&fc3M+OS8D7|C-?Dqq&a zgSYMevMntmBQ`5bn*?YM4jE2PPIa}lMsE2ozmtbEI~fVXgMhXAQ038$Z(%(1bxE(l z3smyrkeXXQ$OEErC!B7IrSpk@)~NiQ<%#B5Py_dkb(Lj9t&c!>Z%E}v`z72C@ ziOM;&%w2IydpKX#vBWAv_;wBgUn09D{xLA^M~(pT<3s-Z*fVzhsA%+4z+v_>3RoFt zzm8r<#21CQbQYqrDx^22!oNpt3;^tXC>LNy5TZZ^eQy*2BffvSZ+_)U9fUKn0R~Pb z2bkNXpChM^g_V^vvggN-UPzY9Jgg87WNs~okC(X$(Ov@>xHytIcxyu=KZyf2uUTGR zfMKRW@M1T5O32z~5wJcp%9x1n_;(2kDv?CCN#xcI2Aa1<`HK!{>3VbZHJPywU6*V- zP@X&*%|UI7`)typ#Bb%##m3LPN0#@EWv#Ao6t`^O%P@1-%dd>wMw&avmI<8o`KP!e zOj=gvldY`N5$A}~tr3&4`>vj<*s|h%jjYO4+N+AhuAKb)SpoyD)E56cEiO)pJI@

!oYS_f6e z9n$zZq@+E~>NX_0>H}_8%{F;MXP+1No`<`;i*83{$}X$7c$8exURRSiG$q;y@yp*z z+(XPyl*&GJjg4=}mWy>nQ|QJ&quz7p*&_?Ew`wlJ;}Qx*W~mkpR4;VeAMl{6TLpow$HEl^r^a{ zyW_Vl646eAVikOCwKLpxA1ov#=+e8OQ?hRBUFfv)04jRTysrO83(%Z-H5{M{GV|gP zz#r*9Z&$sqwY&D&dWTZA)`-kkMfY}he?wpN$yZ)39_v*5hex<%+qqha6Y9!syLmR< z-1GV$^KbL^$-0hA^tlze=phw7m2k5~RUOGM`m(OjFMJa*Oe`x>Rq4@0&Hc;I(w?UN zdN%O3JB48+ZAOVyd@{=`+h0KT;N>Bz)FR5gJAr_@Egu6ReuM4kx@XiP<*R|KzRI7f zI>FQjQ1Y5Q*$|;1!!<6xc%ttm8mB$2m~%R`WvzF?iOqI%RrYgk8aI4A?^(A@m!2%# zEZiR-SR3fGWyJIYd%RL^p+TqB9jlq-x24HfG?KLw>qGKi2^{E7kMppK|JZC<|HOlx zC3uId)5Y&?%~!d;Y7JvdYY#V>XHmBtJqoso)|GfMjDLJ)~ z;$aHlg3?NXR|~`5XZKR;hU*S_*@vRvL`IHzKbUK6ANXUEpLn0XNi=$*r0(8S{EgN) z~7I(b=gr^%y3>eOYnnysNh_Vmby2i&P)j+xDoZR$*uY zLm{UBOsHX4Ucu!)ue{~$7t=PZ&{S^QVi$7J&q38Zm!-uyweyU0{<~AB8*XNpD_7qE0r~WDJ3{UO+ zZM#fv&vW-m#c|WKI=MQA&-ada|0Bj;nU2}FW<$o{lS{LcWdf&doTwAOtVe{GPJH^5 zGqX=F^Jc#Y8+9P7zq{Mn+dZn7{fzBkLs=8&WQK2b4!= zJ+o$Iqeq*^r&78n(U?>xr<+?W$4hePnGsdxq(xw%e4{e^V(3e-Odcb~SBirB>R`1d zHOl+$nZy({tW(yj_Umq&b&SyYeN%{yZg<+1F-v`%jpa6fssT0VTcwh_ePHo{DqX9~ zE8YLeu3sa$#W}>Ds;kj4_tUlM+MC+ex+HX+&lZl!BSWrDqb}Kz{-Wa3MFE0ma=PD- zJTR_rpg3>0;#n zcdyA9#wQc_@4^oOz^cg)UscHn!e^mq{O=)0mK%Jmd5E#a=YJRSzuV-0**IA{G~$WL z!2V?+<&fgBpG=VJDXSNTAZ1teQFuW3{4W}==Dpv zNv6v?i@kq7aCpp|%K0YqUnd~B;s0WmEay&zFNUlm>-`$8^$1YXKzXtz$CGUZjExDN zGuq5wj3@wejG7f$m2X*(mbQiMK%+&RFN!&?6Da=2)yv~%^jtnVN#t496$AN%X3G~IIW$s&}h|yb1!#_w*ZYr zl6FAb5;T~rWMHzNWJYG&4L~e#nZ|0N3&`2{h%Dg0%ZW1~&!3x>UhGhkeKdKpg)mx+ zZ{VKJQPYlm*8>>~<}T9_yzAurT*v&wX#+*Y3gL`%1u=nia30GRFCxkVAF`i<88&5b z709q`6GJd+)>Z09Bvk*bWwrhK?#8|JS(18)@J!v%Fp;D!fJwm1_%;lvBme75WH&I> zdgNUo|6k;aGD6gqCDmGsI(X%%)L1mZIbB_9dgr7Q=X8yrPU;zKoU(uXM^_i9_Q9Bu zXIdB9bi9i@?>7?Q9{I2>0}Gp%QKmkB{(Mi&6+P0BTM@fz2$YzxLMJ!LkXNQssUcx$ zP|+dZ;(%}s_>RCsCXXbidpV0;*uA3~k|dOmvU^86R+g65fd1dKV(IpliqcY5)W=aD zs6Vu1Ha5~e8i@w{i4CzJM-A)gc?OB$e(%9vZ!f+Iz8+x<_G^hX(v6RgH@@UVMudm6 zJfiv_5sL@Y1{N0aW>;O)5_nTZg@g{rjK{B=gHW(ouV~eC>`Rhr_j%%&}#@4xV& zep62%C==SK7&rGRcJJc1RsaipF5R2}4b(MyeOKTIoT6EV(;n*SAE#=Y{Snl2f4{AB z8Jl`*rty;pzx(Rk_c{RmzgZ<3)#nMRY)G{1s-DPE%Bg>v7ZX!jJ))~xuskAVIcOl_5b7=zr#vL}&L2@ze$yEpSoG zVBDhaX_m*9AOBfRS_xMK3r<=LH1kP+1vN`MTO)KZ*NWP z9)+~a+`_^u`z>~VaXiXC)RrUKpRDnC9uqeq+5^LRHc&9PWJWqj(lvYWjd#LKweG?s z`x)->n(4pmaYON{LHdCb0`GvrToj!-tZAAt9aqf4Wr@7cN5v_3f)1G|o@|-J*aeA7 z&l*DVXt9U&TP=o89V^BOZU_eq5;ch$(#Yw;g>N2Aj2Y0(rKP9KZ0C^iUT_Ph?rmvg z&?z`Rb7Khu*)ZhUi0-W~g{!^|G$b})&Zb^0Tm{3#iy4Y(JZnCe=QL@K*GbW{iVIqT zJ#N-}`?9X!aQS&7d>?)jyZZf;Fw@?3avB=`j{9D^>Sj1iEm*ls{oJ|f0iWffNph-s zI7*7Ke+y~9R^|VAL4y}5nP;)rMPmOGEAkEHYY~aU$q)Yn?uqb(G2xjh@7{@zX^)o+ zEcRIR&gMTpOknZaF~8qTof+df(JFBuUmG zt6<{8YQeqY;?7m20Gh-wEU?4R!9*xhkO&-uEqTnLThvLuRN`SlMNHa1JS>tp)UguR z`9vVSm9de&yc7so8jNg^zGsWZFB9b&bwiVhBDW!*e~CCuwI#`x6y`Oz=`HfWQ92(Y z!R`#7MjUghVEEwRpxfQy&3qcB-#*-dZh;0U=g@h>e5~MpPoAt_@1H0VLEoJH(Q5Hv zYgTRR^=@N%v?g=1?42QHX&!Y zrn@}I%3g&+dCWz$UfAR5kV0qT%lXnC>Zs|=K|PT%fq-DTdf=wYv zav#xscE{ZWTuqIO_n8`Wa$Q^7(B4XLi3F!ZN0~zo)SXk*p7&*r?fH`@SM`h6H|!P{ z*A=%PRK_p?a?IASmS*?RZfiUW=ajwPBgZF`(R+KFFm;;@n7V zOER7@hn=Dx{bKBkb#zHB=tRFgVl7ipP}qGK3wtz%6_ytw?dDueGJ*+It>$ca?%bt( z>L0g)zK#0O9AE*f+edBl5a8oeQ&sh8@)oAj2-xoPSWx25#`LD|b)T9;FpSKP)}k=_v+5y53MdZFOq6-^1pJ9@glY0o>jK8Ew=t}~`L6~4V*|uh1924q6_$QiWVVVG; zWzsr=IvZi4lacK&px>MrD> zN>EkV54T2Rog@;y?mSb@rvZL`@bMZ`+ z|H4GTBhJ|38*uoc-jA6`q=vfXk>FWM=AEPCUk(vVP*+{Olc!F20A!p>PdVU!H8o$O z$91@_A5HWqf0&=2zq3>c05R z;T16jPz5|&!s@jE_D3-`E*tChf{Ep)y1yPyPJ3WucOS8t}Ozj&38Nj!#5us~++5 z^equ25)mzIM=IjCH(g1IMD0rPcrRiqJcQ6`)zZZz+Jdjgb?5l_%t(PC&!!LYeei4h z8MYxU_3sXJtt#@<06};O&-nj=uRD^{DMwr;LCRsUA@@nnwBaLu3m~p9oDu zS9PDKkV@j|_gp`hm#gnsx4(sJVap_nWyG;qGb!vSf~bT99Xy*nb#-+KKm5#*kS1U= zC!Do&u&IZfkN-aH@6Rj~xkCuc!NS5N3(wjo0@0_O4+(Iv=Av0-EEXw4+k*;h{JAh9 zGOL%zM@p<)@ws#KSpz+UAJLNErd17^DOV7h>geinnm2vaK86$c`eu2(+n`L{MYP7M z2)PigbLv2>h0p$Hmd(<(2*sguBRfGvtBeTp4N4&^^FR-_(@{bAq>-Q(4d;A-H@3bm zA43|8N<-QLpg@_XRvpj5!8mJJOcMLj19KAfvJRS`AFp$!>;_9L zIr1cE$ut*w!?&_&cp4Q?zHyr&Z6EQ6I(i1XwqOALm~=AomqJ7UM{K?8cWe|{Js`e+ z;WZ~}L+{WL#`5mjQ|wtfJbE1?MFVm7Ss(06v)$V`h3VH8sz6ZK-2Wq3dkb(>`P;UOaPxHJOa#XmRs5HT=-2oB1mN2U(~Ue?f(J% zD4Z&Fi0yZrW75JNgOqnn?LbbC7!)tN_5P~@@4|ql^e+2v#^ArR0sl9k&$W3?%cMJ? zp0=ClRRLFd#wR-`$8IEV${br=iDq5G`-sXQ+HH56v6!5gAlq!fL=z82My9A-fW?C& z$vd#Z+(4!#)RL350fXJ@OiN6(Km>ZgM7U)!M94PMM0e`NDoW3CIc68s9&;rAd|$-9 zsa&cz)unX5Yp!h^Z~q^iocX7KxS8!F{*T7KGpfm~UE4PHF4ht7RYXw{5hDl&ETf3X z0HRbO3JOSoh)4|tyCOqSRH}#+qez!tqoTwS>5$L_m7#_zB-DiOdh~tITHiWnt#kb4 zI3dP7d*A!MueQ^aGdhzgu3CYt*bjW$x7qx-Dk8& zT1JaZCKGZ1PxD}rYI|GH18@tg6a(CPot!1lM^63X^2qJE|7Q2Bn(wKygZjsdKU=l1 zz-rXXp;ah+y5`%^|Zsa|JIxFcu~X7J|tk7#u5G4cQ<7{0{qS z;s|Omx3{FOB`ul5Q16{s$sZ+{D*B>pcSXIu*(MW;a->3Dx%TK_Dt8$*Je3*h?U^uE z^n#+mS7{h&WH`R-c$nlBWEFA4tn&LvAvdYK>{#IP+r@DcmRnD1kUX+8_tX2Y(gMPS zW;H}kDpEiJcjZ&wdb>|bh84tp7}R_YZtcwoWsT^9sEU3s{1iwK!Ga~g<`875zhPR(YKLO1L$|UoCCvA`ibc4{GpF_?@*7I5@a`wkcTckOQ$Dk%qLaFRV?yBlbo1 z-=Ap|_LrI;)?~#&N3D~`zb{qN1#O3=R4_ZbRkCB#j2EYwV7h8RpvgD28&pO%W`Ohp zM-l$jT<;4juB}wnbXVD|(klT0WV$pZER|xckB)meq?xGa zm!ShHiusi)nP%J}!yUf1w0Gnq!!fpwO*5h|ZnCrUNGmhXP9W(vwblh=Q8rJqnbXP5 ztH#q?q6u#kVUYyzh^$%t$RUkAst0}4>U%>Bohp*=9NiMaD{=GQ1SV?iutr9{3AWAF zq?h^xfvfSS)zPN4E^6QuR~psW2Fbm2RH9f^JyuvIH+Ng7F;1J&)5O6QVLcc?qw-MiS z>F}#f)8)M?Hpxj8zKH!m1xI-M(zm^lR-wLfMeF&)?={)^Qck@4FEz~aH7?&KQ^_F5 z+s6~0<(BFT%bbHxxMxsa+?vC|V`TD`wCzrwf0ID%+RcAG!|g}}Mb5Wuw^_2={>Y@W zT{8Yl)D~9?wE|;4mq=-GjUrZWY=7{NN)o;>+dkcBWsSuei@$MNEN&a0Q{)b&rb)-! zauV^tuRnjdhiY&6p8k!;IjuRv(=}{Mw`;UR_3G?Sm2$44pUaaiTQiG=R>V6Bd#$=9YD5o-7V(U7-8Y*IC$aMKlJzbirP-4BAkKcU_p*>q@sxtx2 zdxlN9lvWiXh431?tW||rI^+<^X;l#ca|oiYE61c`ksyMP%9+RXMNSF-FF_*5jb=iF~s= z-ch^QgK^SoVH~6N!|^fO$0NR2IgppR-6uANwLUiDN>PsawZMfS1gUr)4du7{vQ2d! z9FIIv``YAhLi*4kdf_-m0g5I0gcv*Ql90CpM6BJW1iO4=P-C83GCG-!T5uur2q%My zN!Q#?0w#chWOZtS_ZJ{_Cp%eh0Jwf0ChjkQDh97rzSd-sXZM>3nTM1%saC@uh)Jd* ztPsf+C-wF9*}+4F^8?a2$TpSFBJ6sKJ}ySGV}4T4(~F2NTVzDVyiJT1R-OIy=E6uSZ0lLgZ{kNa5L}w zvz8{~ODCoZH$QhVZ(DGtCLz_As1bXtc7m+t`k2?y7ft`L^0)Pk3v6zE4G3nEq7+Pr z1ebbk4)cBD+tV*rnd^7BHKiEu-EMNk$5FX0v#cC6u4JNwYVOXi*5_7|D-WhJ5A(OL zXp?iS`eEMEnL1~=Wa7#MD{6oHTK?!Uqg=)P5QF3}`ud&HPRP^t%CFvmO)R+8tF$7K zf73g>sI`BW{E~!}9Us)Uq_Xa0S*L6(eMc2-@18`3Jd3P58W%+PZ^w79kNjZVAWK-C-h?ihAp7)(lUP3la7=??Ai|;xRR)~TEvZXn~5!dbA@gu1vap$H@ zhsVao+9OE^%qc&lhF>Oaz7m|Br55B`BIU%WNKmV)6dxegB&`GroQJv~u;FX-#XSbkA>9K{riA8F2QnTWI6!w4=lvS9Hoh zCPd3JdcFkP%$RhC zu3k=2u~KoGIZQo~d`JiMq1Pc4JjAAWV|nYjWcdqD!se_Vve^8+pc-HCic2UDr?3dq z`eJ@-mDmvxduxg3`qK794@#NT#c@(OWERCjsiCI@x|jD*TrBQ(vW!tCw(0DEW~hC< zB#a$hMzi~PcJuymo@(f>+F0_z-2>=@a33C;UC}*4P{`MLkD2 z`@JK=2U?Wng!{5jpYmZC){kgr#-=czn+rw0uf&r*R~_gThbEA?pyQv-s73iHO2#E#9ZG z3o(y{y>@lUJQSLBPQ0ZnPi1wX6BO(_a8xCpVnB0~P)6G|RAL)RbAP08aKh`GTf($y zeZ=V1A{J&buQp4=3C>6^fqkYMSr7$D*1h0xn6i_G&Yn%VyLazKm?CU`dS3}s76$iN zLMg_I^TMD+2;?kyO8do&HFxp%Lz>;g>XGw3jN0+(DoxTnIC`%jC>Bpt^I<16AA5AV zb;UiQCAXz9!c!Ya1qJ ztd`{LGS%~K^YwL$A8Oi+4$_`kATgg&S@ssS#!iE-zjBU9wc5GS@c=We44RvCM6e(-Xce=S`tbe3y61mB6PV z?pdK4+XHQnFfDuE5CZ*MsJXw60MwEtdb4te>|3Wn%leHr^x7|byv2L2) z^=Zv4?xM)Q=(oG_hGrVc?X!&{8!j3_h2F%1Xd~SE$G6h9USWSrGVWN=3WNo6CFygF z8*#K?D>JiWWCdS1=gV8lkBT;?^vw!b>+}N4Yh!bkoj|jR^xny6$S^N&_B4(2XflX= z1(1j}0})T2^w=Kk0Lbau^VlyRGCq!dt_5uGn2ObA(7~s96>e`?;o#s27Qs57kXD^onp#dHRc3yYOgtnTRKQ_7 z4|`;B4V)^ZGZehcwS!MSyd4%apUWP2P+b&I^#0K~X8622-e2@NOGX?2c1%0t6QG+e zs0%P7D#bEU_?G9z)c(Q#L!1r8*?*>H68&h7mIVLFAK~bw+@2^=W5r!v^O(!NZ0;I# z@@*Fxd#Wi{GFsl%m%mN?-gGOT-q}!F))Ib@U+q{MZ3f7kz=|OxEk5D5s%MGRe%tGL zwLOj9(i(vO-frt#aui~qUX|r~7LU~Rg0iEJYWnPu8=mtaH{5z&zn`U`C1vDv=%aOn zJ}*4aIqG1?^4jrF@B8~d-zr=hLMuyuL#gJh!r{M9$+rmn<>;dsme~WE*(SWdxTI&Ks$3Fz za$TB+{2@GIRI`Sbrj>$0TOp^Xej=BnsxIU-*Yj5Jvp-yJ3mf@lbCEOD#k8`QEHQ3e z2wAm@y=BBh+v?!bk5Y!FT;uesM`KX10zrEvR#oZ3A@Dz&RTS zc&8nrg8*%tzhZr zRSO?{O;qo|XSJ5`fQSy%LZWHLr&OsD^vf{OZcpY>!#=k3MTx+yD9(98rO}jU4gkn# zN+P5X@Re^zA~cK|-rSU#Zw_E2K7!irDY@PWqu9yicNW@i|Bk=yCz8|jCr*EU)2$Ly zLBAX`Z1~rFw)l%nhvZDL3Ly_Ceu>gY3z9SVX%)r}^A5Mxcq>Z8MTYG^WA?Pb?M)Ug zo*`cIb)8qu6~m$3fwNtH|BnF8uHq@gti-RRCI5GrC@xAA+V#<<^v2IiE~ZUm3`jlM zUp5%l@gD;DzvIUL_c#A93EWSP*?T)~paJdi`2PJ3TA(($2y2Q5F3|i>AYjL)HR!mA z1j^d#>KH_S6Gme&Okfa|^K7Rv-l*HD#(S*Qx{>Qo0Nm?qc&8jmd+7P{qgK7Pk%U zp2Pzs{;O`wK=ukyN6 zVC*lo_EJTW-LR`D1A~WuFIi-fd|HeNlcSojTV1U*25sU9)g04p2BeDp$O>2PISmJq0aVGJ)AJ8)wRl;trY^i z#RJY4kp%FBlQw3xmO~OyN{Ax`U0Zt4+|qotj%+L_3;f#YR(X;wp6OC zrLr1%Hm9>qGy-(jwrBrqvsOgM&Ld!UK06srmqU^J_hgx`lOmXUB(3M-}tMc>-z`Y zRK(LBK|c*i|FXu^77@MY+WTuw=8(QVLU_P|4X1_-DHH`QBE=eLzKoVdva(%bJ0hLo z3f(|R#0XW|6JlH&@kuO3LP3=Xh#{^`~++6oOTW1!~kV7pE!7RdjWJS zM2a60&|-;@+*;_;k}r~17~IyHe~V)zCB4$+>A+dy%ek9(JEUuY^sp`GK}EkWS%r!A zYRtpk_-;lf>@2;y4lD@|(Mk+OsF~Xqk4rYD@Sfe~IpS+)y%}kI9E+x?`g`c6=stD< zmpk9mFy{`ZA@L3l3cYs#HO2+;kW$m7fLX2WeZ$CqAHul^S|HUp_ z&9MRFxNB3z?{jagYCzZY64c|dKmyoqD+$&PBtnD?UL0~8BZgv4DUbK5O+?NRZndDo z07PVmtVsQgV75~8(|O3DI2O1{!J;Pw;r7u8M4#T27EZ%mX6+p~GWodPvCDZazt0$Z zkQj?64-QKxYt0w!t`FxJ)r`3$ByQ<8Z$~xKpK{MX?cDI0=KTzYp&&>biKvfwqhv!c zA%t)e9Mj9h#L`)#V8~Fo%a(-z&)a$ioZp05s0O(LG09Lf%0nyeB2?1kWs>@1v)+1*d6-QGZ8Gg0J90 zbK3P&9XZ;vyG*|gxN|(7%UH}iU^s1wTSD(~XTbrj+a~2{)%&gUgw{pe4C4e-AMFIb zLLOlOkP{paS>&K*juH%0NSxrYuQmPT)=qS!yB_c4x|~TjZ3N`!X?x{5VVQ|u>rQJM z;|H5FSyeNow5J!*_kcv5iul3^BbB zH!ik5kqr#ee@dLsQKfMGZw)xE@e#c)af(=8UF}P`+(t5*AU6I zqKdQ$Jaz78+2fKI1e%|D|61rmFR;*xG8IAv8`=dbtP*m@&02u_{a&8SN|Kw~lNF2{ zgO@QeMfp-l+=p`*IrE)suI^MesUj&M8x8eK|goL~2? zlqFC2d+>h0M~6s%)pRp&Np8&TYJmC85EWO4`fQ8K@QfL zyC`{c7V{!dkeGRSSDssc*;(OSzkUkyj#`pOQ9u`pe(AdKHA?4AA{X(q->Xt^AP|2c z%Atzm{r$o>k6k**os|U4EZjah`#?h1$xg4jfB=O{`ow1J!dCr{6A4*!ntHIe%4k*}6Xz@U!1pZ(&mk6@LkQ6b4h# zWAIp8m~J;;YmO>rn1+}t?-!3>2yUikUv}oePzIF1=(HT*C0BmF=0wl%-Y=fzg*2R! z`?i$>qX{X`{_-f@Jwv>Gk2e|~6t24-`Mn)IDamTzjiunS`AnM<;XE1{t1qneaudJa z-8b*_TvT=vc!G=O_9A=lVx_*dto||zGbbsYWUIORe+6J#8|uToZl#SMJVG_xgC3=A zLDdyF%e?e1;tJZV7cdx$gjsBtS;J!YDbWbs9GR9Up_T1+5gew0Ifw4y;z?HxE9 z%wR8h7IdAHFH6oJJ$f6%BW)ZoN})MIg-)`0M!c%$HL-e2DuIDrsbK^JRQ)3YvP^<; zi=Z~J&)Q9GI1jGMKEHiErobfg!$eFJv!MpK*>jo2`h51zuoMbl(D4wo0@mXn%`DA* zKJ3PJfD5rqvGmox3^5FFMYG-#Fv?2>&{l2mcKK%q{jT)=Po>iNIil109l;8h6zw{7 z@#nUG>lJR$Axv8ijz=O|6ptPl6$WGoRIdMMZCwuYl+pDzqK$hyrzjwv(qlifV+glW!!^GY8aMrWEw zzDWNvS2a54b>h|feo!g3gx?LbO?8VpiYeM)X6kGl0ph!FYcS;*!qRAUV!E7=hs{x@ zHQO`95aL1?apP?Ul_$(8AhK1gP4WmpCEhS`zGGvieEWnhSx~cR$0C@dg(Vd6?$Nv! z5wsMy3w;=4B^3PV*#SiD2B=O!+bIPF?L2Xx8(V1zKU=Ceg}lIxg?KB|m1i>SPN%R~ zvfU%b(AQZ>g5H?Rt*KFIpGR>-YsnmW*TG5bMbxVKKu*Wg1^8dHG$sd%zJijoNg_=@ zo8mC}&y`D~)JV+}x>HkPDMbhTevUHZvgeyjGUQW0j~dc!0ub^BNdVQZoQ-Qu!228v z>~bc$*c|5$J7nN^f~!1*|HNu1ZiOOlAj7d#y8EPU%^28XkAi0D6D!6LG4_)y9=90X z-~}%pfhs_dqY1$Qlf#0_2|P{M*gNToOepZ7J^1)J?Of69p{L~?eyZ*fG7!eT%*d!s zb>t5^!q}r!J@n(pxP4$`aIj5#B)Y59%HQtf5#Zy$5eg#Z5Msn(lcL4bW`3|MSf>8N z$DO*0ueD$%>2kiz2PkW>&CS?BiX&T|x#EUL1`Y!}z(SI~LE_CwXPlMOhMx+80ulgUHUfol3#P=1H UqRv$&6EDy@^5-8(ht6LAe Date: Wed, 27 Apr 2016 10:47:42 +1000 Subject: [PATCH 080/439] add info on threat intel report --- .../investigate-alerts-windows-advanced-threat-protection.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md b/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md index 0a116aa6bc..f3f1f34a18 100644 --- a/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md @@ -43,6 +43,7 @@ Details about the alert is displayed such as: ![A detailed view of an alert when clicked](images/alert-details.png) +Depending on the type of alert, you click on the name to see a detailed report about the threat. You'll see information such as a brief introduction of the threat, its interests, tools, tactics, and processes, and the areas it affects worldwide. ### Related topics - [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-advanced-threat-protection.md) From 16b7792b3f1ea6a0c585efa16ab82346a16eda1f Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 27 Apr 2016 11:02:24 +1000 Subject: [PATCH 081/439] update with higher resolution update with higher resolution --- windows/keep-secure/images/timeline.png | Bin 58938 -> 33060 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/keep-secure/images/timeline.png b/windows/keep-secure/images/timeline.png index e7964a2cf10688f5a69cf57ed14d1defa2470b07..aac0e87a638a8dc1f1cf1ce2e2f4021241deab00 100644 GIT binary patch literal 33060 zcmd?RcTkku*ENU{0TmO1NK%rLqewPgpan$9Ip>@+4T_3N2FU^C1(&2 z5E>fEv0--O{eAP*)XY0?eKj-x3|05qJbj*Y&OSS=wKi{`K9N30N=-^cM05@z^GK11 z=;SpbqGL{HPQwweTU{3L4~e~uh7%Fd`LBfkjzzJbzYYh9oe}c?5dS=R{n#<#<=!jD zj}HB#?tI_H+1$>ND7&Cd1`eHdhC`1`oQxbT?42#_Y>6(D++c*`q=e%S?d&}qEzHcF ziSo$XMBwQ8qoa-{285vu&K5Q%M1ou7B=8Lh;Tt78Q)f2=M-w6)`$NKTvZISzI2lSLA$b@L)&>#DsVGr$WY)ovOi8kA! z(QxcEVVJUov$Y9P7OtC>h=_p*@#wy?`-jCbUuR{Lq~$$@E9V%Zo9}*Q=~J~zwFq;R z$JD=xvM}`QdWY#bT@WU^A~OD=K(I1Dm(_-)Or&S)g^k$Kk6gZn57*)%HD=nER@CQC zi~0Fbg_(Z+nO0B6+rdX2#NawaV#N2-{Oz$T?Rdsg`mF-`onsUc^?PMkt)A^+N|W)7 zUXq<|lAWdeui@t;JSY*7eG*r~;@P8*et{?M6PAmJDC{a>_2B28<^|)U4@4IC!;T$& zN;~yG2Jy3qo**2{2q+f`ed2nRNc&znca6s=_U}nNrgMt(L_GKpR!_rmmyS+m;5@^3 z^uZ6s@a^aWQTGdmql*y9kiGc(91NTpDq$&ARhp+xor+8hwn(X{P@kEZiA+34IHR7~ zxb6PysVPH>D_3q&oein7zJI?V?evK+lSQPYq{=!v;uapUmL9jcxz+C9e||IkTiWc= z^?6pRs;ZQAbqlFev$`LWb&SbRG&#$8@s-qOk{vU4t>*Zb(5SyXwb-cKy6X=ud7MaRTsW@NCO zJAXbzJrf>=l+Rs^u2P$8X}nf+eqWy_OPwQQe}5lkeE#UvARRTem?y~+OJ{fn#aF*E z-o~!a^Wboo*j4kMN=r+3+g=Wrd8At?H1F9zcyiM>d)HrmT2lQm!lj{zTS;5{Ls;nc zdcO0EhL4O(#usU<@XGU;((a%p!-e0!?Sl}!in@6Ymlj9fOt|LYSXVIS9AoN>)5hu^ zA&+jd-M)RzMK6Ctx|NdfB>Jm0E6vyAg`G@WcDBacl24yL&0@VbeV*^+@neYY{(LRk zp2o?ds_N=8@14~&tj#bAaqiqXm88Rlt%8OhZ(KMNJ5!@u zs9}ey;n1%5!ErsXNm*MvuchTNhS$=<0&(W$SNhaXpKhwCswVY(42g=0(kwL%W~7JJ z4>4(JZSCvsp1RA*$;o+=`skJ3RZfS9I`6K}zh84(98Af}%Oe>%5cc`fjorwptsUdF z*}{!ER*&6IFt#4~+|EmPkKsaC>x^Sssq2zv<(RFYpkSPZL^8L5n14p zS4`{7U}#m92-v}^2PqD7sqmdc2VvI6#%zvXowQe{rKQcu$>D2N$JC^!n~aVe8Lixh zni?@3r*^^H7@h5nLf^y^hkGI)l)@U8w?x^-z%byf)bngq6BG<^KQwxxEwITDrldV< zB$V9v*RNkewC?Jf9_}C8+VKXvURYY9?Q!j3=I)mmbs5khY1PEYM11Np z@8;zeqw5qF^msd=YinCDT`m}Aw$EF>TF=T$a25KN8b$ig4>s)%`&T}RU3!~^LMadE z`TDdpADicy)>d7Gi&u}mdvufZmX^*qR-(*0lgLWM2{);)BsuNxITNMU z`{T#QnwlDf#|`f%W6WujTx6RLL{hoy&1jSIDweOALgC5XRKYICr!Warxz3-Ns4T8a zhtS0RSyFd&bi5MS^!w_Oe^pZV_A@B?;1qVB`rv~J$5q*#p~rzL&&sxlHL6{0y4S&+ zX!JPWJi1A_&VIU|l6H#NgJy|8I^sQ8ceE`%Bgx6*3pm`9?RY5<5094T;vH^Yw&hyz zWyt)by}O*=I^m&-4$ZsR=*U`K4xQU8$Gd1?@~EFt}7@clv`P;5dm)#cESA2 z$>UYnf@);YZ%u>Q4LWm~FlzLQ7M7NL{+f?3_lSR;TLag4W0K0FcANw| zRcteIC+husrl3}yzG^}^B&u(+#e~o*vD7mlu04dG$V5UgCQ_QvN|bil`;x#adYy>N z&k64(S@>_DAiDZLg28_)VwlRg9)&JBdOH`o#6=FG*e`s9AjcwlnQ$i}{oT~+zX9)m z3N!z$EB}8ysDu66g|nwso<3zjkOnleadAD7%~;II%~jFWP1T3k^1HNNw$?bHN*n` zXFB}poOIdltEBJWhAaB|``NCLrZeZ81V1zBrQthlc04<(K;J(-;??Ojg3Bbg>Uy0z zm)Ow+qq0AL-uy72hnmcS5w3D06~6ZhSgV*2xq81Rw+S97(z;ol5`5b5XPc2nv!{$u z4u^i)aWV7lMwzUl>`L8Rw(a7cBWFl^czhPr%SNdEaW7-hJ08Rd{DKnST~fOTLHH+EdZfD~x1SupFy$F|CBa6}e@+H!?h&GneeEyEW<* zD*U9fvQo3$Hc_K4GgF$FoUXT#Tr#h&uI{CiBAi-RC*ky@d10YV)@tygmk>R6n>C@_ zeZ_DGk94x-AY4E-UvuW}*7xZ0^7ZWO?5_QtwVACwr33Nafq~rI+}2-4D^pD(u8Xlu z!UgHdbQ9yb*9&VO43%=Lt!eQdZNd60F1q($D-RD36DBe<$+P9;S#YKD_6!h@>*{n( zOiUuua5&o?ZwZ(aX8FR@)Q1qGEx|iHe_4&IlHJ+aSy)^YXtf!uQqe7R)AksHX{SSO z8&F)m%94mSX}wA-=Ke!DXNp}js<~ZT%^A{F*#MN(uBW z@>K;<8Q8a6K5pZ3wVMqek(%y_uJi|T%j-$uzpP*J>ZUyXc9LWfQ&Cj(LwPaZh=%kP zO#{7E;?bhoak`DU48%DJM;QB(tEi}uzIs4d9TK*nOzc-&W3olVsN9&(nsr~zsL=RB z!k+ti{Mwq;I4l4r_U!aEyBjp;Ati~sN(}1);T3#H#IM+xppm6JYd#XmkS%R4jbui# ztHt-9i*Ww+?INdMop;+#$@)fm0jdVSIRa@BKN^ojmy~?4d$wFTN4Mq+8QS=d&Gq%W zqnfLi>k{}1SLV`kaxB~OsdV@B zpI#FTSeL_++7kp2Ga+}nmW8qj+0#-xUA#(1Ivd+dN0UgsHpM&dhz#~Fqw4%txd#K$n_~S z%c5S%+O2bX39!W@1iXXHIzD8>mIC{O*%L0{Mo$!;AU=OfNNAwABS$6oQiqR$fx(wb z8bl5{z#ZG4e_e_FG{Q4;E9j2o`&{W5)9+CpL$R12gWwp;3TYH#lNKuo1?^qmIYE}j zI-k8}l&yk7D2XD|v}0w&lk%@>3(VQ&7T&nsEqZE>j&F~%Ie1g(T)@vg+B6VQ2jcL-`+ z)#{i>hm*yrTZ?nX8%tcJAxz?)bAJSDCl6@EdpsWm-k}lXq+O(2*UjIHN7{8fTVlsh zh~lGEf3+j3=r?g}(dr!0s8e6QN3sgqjn}-K_xJa&!c}1-xFoNsqJN~0IP$eGrzZ^= z**2{G?&iS%Zt_)uOO)aE24o`$uZeV|9OEPeiMKpA#+avOW@j^K?(#uJC|djc`7uuI zil^Q7t*^(b-PlD%wZI8YKglgBdiv_ss|+0~?k7|g&TsAh{7N}|fcu_y>@*@?-0Sna8GYySR_>=y5AyT# z;{~mv=ljDfee;RFsxynS&JDXvjSQ*fEdR0(yD=bWr0vhoWfdf%Nu#dEI|z%EB)VOE z2S@)S0rP}?^Vi_<+XEd{V)N@@6{b(!#zxEhD(Pbc(#R}!Pc1!(sM zsrv0K?!Jl16Kwb(>;zfkr3?s#qLcCE(d7kLG7Delr{cw>w@*Au^}sdQ#olYg(kFE* z;94GEOCw~L_DB|IWQIw89hOl8{~**+ho44%JD{KYslsBOhnK`v z(H3;JTIl(Vvph20H6Cj;I?twHKUwT;F2zgw))@_}Zwcv^v=rb!5Q0!fhUw^h-Na$# zY)4$mxvjY@R#(^2$w=0=`uB@Jfq+>{X_5B*>Xd0 zx%>ti{D&#pc+?+}+QVheTZ>>|UGU1(y!HCUnhe%MB~99yNVJ}~xHwBiAB0v2_RO-; zSrGhAKL2bz^a(?p2_3)tn+Am;>;J9W6Nb`OM)}}XB z;+DZ>psWVCpwKa&?@k{^`=X5!!1zV%f7ZutwNpplr^bmGEMXPM3VZnTS;5)<(em8W z5BmOo9M^5c?UNQ1|FFfS-QGL&~e z@ew;ZE8kA+9?(xrs%K0t3$Z(XWSkd6c>ZEV_hu`ZF(K-hbyW_A7I-r`5mx)ywnMwU z4tdW{Ripa{4j-T3PZX!E<=J#5#bu+(R7Eo+H3rh$#_{(e1gumuka(fPxiiwol+JM; z-Bh32a(_eC^XK>j8`8d(@~^qRgX@l8_?Bpw)3pyV&qc--<1*z_G*!e_{caMAthY#_ zZy6+eEqhx{*47;8#>fGjO3)%N_|Kra(v@myc!SNbHWSIN5?fl5xF)b4B=l#XXS%`b3iN64%tx=G5I5Bbf%V)zS(@Y7?SEWG|;jX@3Z^UE_IzM}Na z4fWi+Ty;xbVqr^WbwM)$z6;I4hGLrm2{l@(zkQZ!2W zXpg+L_)hjv%>4fDyj&~V@iN#1@$@4B@>+_Dm zNPci{NQ0}^=l5@q%s{e$|4ha})$H%oaU=%S&||hf^z-%x`PVDLKMbm9WE%Y+4P&e- zZm^Dc?=-B!Z1^~hYs2|jw$5|046g)rA9|Zi&;=DW+Z9Dix-0}S-U`q2lCHrPR-4jD z6Dd*rXPwy&t;=?a4O#4e{Mkwn^fJvr9`r~G>X{ZDAR3cDdc*Sn23r#cLtQ>xp>64K zoc~_Mf@nPE4~wd@W0vcJcNzHIh||SvN-W~~HU@N3U!y1Tq>-z#i0%$G-GLKZS6OU$ z9a2T5MfE(!_K|aA4}-1wnz2T%Wefr>Nph=_AYD_rgOy7JhjGW0oRmwWjS&u_3P4ZN0s^i4TP>2b2OZ( ztQ4Epj~*@*3Qg?KG^>kX8uK2b*q!{6TQ(^81z zUBlDaBAUr!!x!6Cu=Qj?)Hf{qgyc^DFVjm(=f{|jE`DCL`biG13_0e6rK#0%Dg8_@ za(k;Mpe*Ykt47E;XD3CQR(z!rw}x9w( zIeLodRR`^UUT!| z@}YHIlGmT>!z;;k*_dck3n(eYs{~}7=Clhihi1#hW|T^2{@RXT<2?84b$_iw#fk5w zyPGa*BC|Hzp~9vYzImwWr3|7E>BIiL%Tya&8SS&ouj4XfvOvGz&1(k#?i$gJ1 z%ZHP3zeWw&Zu})OWQrEiQhk!!>Ei`e!Up3|NAAuaF80ZWR+Qbe>tOnIUWwx0g(0!T zb@Y2-BnMy&$r>RM?7nVxQUBiYzmS*TN%qy**kZ~>!Z$EXt$l1L@;$$t$-kTog4wG5 z9{cH_mwz`lL-uz6S(IVD`M(pSSW<5Kk>Z3@sqd{*C$f zqsgIq2G=DV%ctUD`}fWlHH`RquAY$MHyC5)L%N#Zj5tLYJ1Dl|FIk~K;<;LW=-Tl4 z)jIWV-wU!5TFw6sm-F8WrT@X|E^|(s1qiI?0`GH9`%A@XUKIx$L$;}^udlvtyv}}u zy)@0+S3vo{c;Bgr?U#S&B-S1EU(j0r7u=Uz*202iR7{M5>m4GZiYyg1wcM&I&yrH! z%KNY38v-3gb6zw<`sPInO3F+ZEvS0gZryr%|Ni|4_c1NfKt?@&{PTio1kA6ktEzU{n2>n?tov~Tg)bYTpC6L(}2;r1|f1`u_ z9YhZ&8yg=Mm@=COTgNW9BDny{65!zp>rb%r^+hA9v$DR8Zo~UQg4_oHv-7wNIVW%( z-%2~@WVMhE4uOwuwsdsd83@5l^G21}-_4tyolRSls$zk20Jm!|8}0AUfck^%vqHt6 z#jWIwj0{xzb<$UIRRnIy*7goXHDG^GYsBpUtCQhqcIx80ckeEBqY4a?hI*887(Bha zyfnL)0gf7wvarbRFVL}?1$GFi6t?-A7cY*xxVi$o$egC}7c-1?#x5*$N2tk(6Bxeg zF^l{Qs%mPYNtr8KRmxlU+24dECnpQEL$MUQ0Z>)s=l!XD0yQMIwm7pl?>!N_&ft%k z4#!MiTOsE^kS{E=22lQs=l4(FpWmy0HrU?Tsb*(am^Mi~@Q#ALtwzwQKQ=&>;lfib zEv;_JUZ68(fRk~uTDwm#IoSInIyjTr( zI@1~>dhihl$!UYImT*StHhMjdt35hyV2)OuV&C)7uE~O#a^wLtLp`js0*H>Sg3}68X z^?0_|*9on~&R^TnJaCKIq`R7a64b$LLPA>~mi>Wh1U7kwj9*S?B_Ee>mbGRWgtQz-;0=(o-ViQP_O~`X1?;FbK>Z>_Hk|Iao2kf#tUS z0Vm(e@=fbMG3TAys# zdsv~)z1>pHp+Pe2m3VI2O(8SjD}@?(5F!01!AgNpyT+Rjej_?MdJWkMd@#+}3&Y|; z6i)U{R}-4Hn9ZyopP!c}XInlpngG@qXNC?9NlQy(N;%7;TU%QTtTFGY{O)c==|3lw z^k64SO9xDI7WG}~w@vdhDzO##4v>ZD_@(4PfS9Dy>#-Y`+-qfkY#@Lo5wEo#V~86U zx45wfW;&S7y%`xmQ-Kob$R#rb8?iWMP-xGWG|)@=_7Tli8ZZ}Y`$2X#Giy6ETOwY8 zR911oa{T!OlOK=0tCJxY1_U?L(w*=etrrx+2~VfS~dMqbutySuu&c0YKdqOMWtm<~oR&;L4Jg}c{X>X4jS$a~TmQj^_?(A76PQT2YMPN9<-Ado{yV=#w%~83v<^hg)&GhW`F%+Iw?C{J;V~p@$q$_0@EdjldA0O?93KlZO>%01%2=4 zx^?S^l7je*`*Y8Nt%lLj(P!mvvu~>iEqwSu1J3@grZvKG9|qZb@7HrlO6qBq+tMm2 z_&M>Wzc?Fl2{0$^N<|25A(9!hv!<6DKA&&NkWYw^DodXXkhZX}=zbB>IoH#XDB8XZ z>l{3PZ$vT_7G3<@RMfuCWc!N=YE2U^i^}O0=J~(#EMXf)7%r> z+n89eXcsrPOzRu^=z&*_2Jo5H#;3xfC*%F}hr3I ziA}ngtbzhpls6RuA{IEIZj;U#33X84sB@U&d>P05dCRuFB``bZ0~#|n4#3mTxYzx2 zGyG-0fa+8BI=WIYOIl&aM_uO54+{LRStzWCojQK3hgg?dq6n_WB692Y4Sju=I2jfF z-#}f+$_7rqUOpoJ>0lhB3GpmUKxWAii@4UrPw=w?i-$qQu{7ncxIyE#Ss zvR%_=y-3Ju2xO&~S9RQ+Yc-}?fOc6tF=X~s_M+-m(@KyjJ4@r9j_d}p3i5t zk1qmc#`AkWKNKVyZ#|RRKv$%Z(!g6{?rQXZEbZQ2AOqJNf_<{PD|N z>Y20B(jG}9hx&eSQ%EBrk%p*ndD!Ij|4@CSx6NGX>1(H7x zl$YEo0wG?YQ++8z=+2!G3;gh~CVX$#ySfNGnw+o=ujzaU1I+Nk8+Z{ z>r%#3tbbk`nr<;E9Kf3}fuF79J*t{=Cg+TT~U`;Eu z+ukhSgllAM`1^Q5MC>or^Gzw0oB=t{@5umqRiGZzCIgHinge-%>E?#&%ev2>Rh?$r zp6Tfkq-#tF0_nE9yW6%(coIQ^kv3RH6}c_zUN)9d#pMBY4jH1Sr>FCupA9cpBiA>` zJ`;$8A+D&v z!F?q9K}r~eZ4FiGx*fd*M<*wjpY_Mq_6CcMRy}J8ivn}E{-=>Vx48Hj)C@V<*}SbV z=N8{1m@VPLAh&{gBUL3=bsk=?zb%fxZ*cJ2334JLZ9cg8{A@zbXeAQw38a`M+?H?( zOu;yE&!%*AswuDx619uvmq}j<+`VhwpHg$`ry;+^3CU(CCLBlA=QoYR?`}-ZDM3+p4mc8dhNv6Y@ofdkt*9cbdjIyTsWz&o! zf;wat)E7VGI@{ajtM;>%G6@uhv=a&<&)fE2S0eL-$H0D2uqIWRD1{yI8` zxiL?p6lFcccX}G}WqRdz{qqwd9;<0rIW?IO@j$Y!uC78ZF8I9?99QfvoY>wPUmPt8 z1=_~`T4%yaao$8~af=yD4lI$u2VNq|D6(OlFI6jCx;2Ax3BVNYplgTFOrYeiFnS*xy!!Z&M@7yyPyW4rkS$HEea?j({Wf;u(5R5XVOjr*xbu8@3wK| z{Rdh)EI=&Bm0R|)5v;O!UtNlu3#JKF06SG6h^jD8l<*Nr3A&;uC9i_hMwy4ZE)AR1 z{fQ#5PaFyF@VOM-e<5kFnX``^fqJFMu}ieE*YR`Tqjh`G0m$Q_x#Eg4_{! zzkSzA?cq|hP@}krh)a+T2n^22Q3UNRQ#J@|K?@4PCAb0`0k9$VzmI5aAokL4G(1HG zRS^`RP`XO_{auCx5;8vZDDU!-e8}$zz(GXs__%E}$*Tvq2g=#-a1VeKy5b2%aRkbK z@&RNH2uIZ8FhYR?dYf!0x4P}w&mi7Or2^F)#snpO+(vbEH3+N;6zS#nMI%rnGQ~w- zIeO1}i!U$Es`3~Bo)lrswx`NdZyEd)RGH5Bj*cgY#^)yy1W97sZa)fszZ_Kb;!L*s z2>z!(`K9P`Vg{*^WPowjI>*_LY|2k|EbZ(*)%gI(u?(x&g49558j09VeOdCzm#-#53bC*V<@UKR)LS620SPCedbPETZRj3LHOX%zjD%M`*Z8B2Q z2reycZR_Y@di7Op(AmKRo<=Op&kHXL98FsVm7IFm4OUj^Bb5!}vHSEyS62!=8{~;H z)V37hE^TMc%*x)E)#+-6m#~f#i`qQr071EFN#l}egx_F>({4C^8i9(!uUn@ zALet>ey`BxLNK~zAI;TI#XAP~UvD3y0DsPj$k=$k(McVd0!D^JPXxIYL5_>y^B0i1 zc@fdQI@2ouYJ!way>)$aGY9HAFgeqjmyk?jGC4sRbj|+;)mf3#u{3W5KYxXqf@TEO z{O;eI2&IfMgY_^WKt>8nNTo(elH6(5Y<=r*xd^Eq$nr8k8umD%cXZUc3h_QVnhh$0 zJUgG~Uo@L{)!<#5?aXa$Rh^tlp9Ey+u;&n(scbkIUkT`9;bWdy{#`Wu176?S$_g)I|F4rm%#52bn)Rvt}+C zJ7^g*v`nnqP;mJ|&f)4R(=SpYp1!Ul_emn*yYp(YpRBZiuP5)&cVp5^q-TBI*yJ1$ z&#R*m`lMt5jbK;L7%s?IRhdnA%j+G;T76k>JuG_q&}WQ#;n3Xu3x%3xvyJTfjMw3( zRy+K|L>sTZykw1oHPkE#5f8pg$B-JZw%ti`-z=eV_lIty4gtuugo(6TBJiv%YJeOA zd_cf2`<*3ycoeP;7_-XJ@22Ug9Rx_P@5tWZUn;q7*B5m-so=7^e8A1m$+&mA-NRN- zb4_3fpgUd9dFDi6Cn!48JOh&*rZBIJ+C^(V*yNOzZ%FaXJ=)V z@NzV0tfV;$1Y$e}yZ*W{yHAq(tmw~Ln&V%*+yND8S0F8~_+I@v0yzd^1>sq(9%c*B zuM$K(2)DI|l_3I5^PfM+)#A6?O?|vPHe#TiDUx#td;g51mVTX;Qa% zC}T!`5V?~$+0tzSIppjsbbru`YI)h$LAly$e|{r^UdCv)NCp4m9`-d z%e#v=8(ISKmBP>R#F`|P6r*T4Kp%_+rIScVfItm5L6^7Lu4{{M2~kWh%j3=2+LKgJ z$F!7gXkTC2iCY}a5TVSDE?=I2Rl@KVFQ@+ESXLkCgqc^`Vl`9J<=&iG94Rg3F5UZM z#z;4?Z6#Jm6J;&BGKVuP0U_~0vXDeq^`UF?zPMhZM_k<+aoq02az(R4t+q_icb;>A z4hcfTks>-}FpyZ{aX54L&ouY?_NFePkvxvL zmWv=;Tpkn9A_(PnDqQ<#2v?Nkta;K&yYJqM0#=~h2VLch4BQb%A)kZD3bpI1)-sci zchA^(X;k~rr;)s6e>BcC9wgJ4l@j`%ZQ_rD`06#&cpp@z9mVOq<82`9ksHqw(;!Gt zg}M5RLnk`mIc6uVI|m5=-Z#M?jLVl2gjLe*%Q9FFt02n(FIL)-A)jr2e(u!SFzvVw z=|0$Twl$mYUSiErPG{w$6Ykh_gW~Pi)?S&@T*umDY_IP@ct>5AAyN-HLeH#&TOB!& zxuzl99mF2M>V36m=(C#OmFquZmT7oe+qZFB9qf`y|1ezw9ZwITuL_!Mv;>O4NC6@n@e_Go=-My41a0CRj{_b?qD~b=24wsd+4D+sv)K)n|6N za%Gsktt>Lf8~A_Sh^Qf^xM>Q#@#3V$>$px{?)Q0Sg)SUZF|sVkIADoITZA@I5jxWW zdy;N6jC)9psm`&cDQWJ5TuWVCPaZp8uXeOm$U`TM0#lvvl=zsv^;F737sXYnFazqA zwl+cqd7fS(4|q1{sK~0V)d?V{SA~Oo{QQ_iQxNe%T<)kQ;va(k6jo8Pm^6@0Zp;?< zgjlE=FdrPVD?YM6b6@8l%0KCK;sv!+d{d-Bj=o--V4C1kCu)~LkS2qP-g2E~kCd8U z;<~(nTpP3iDW|>3pyx+WdI_0m8W~UoDT*_2uGkSV#eIqM8M8CfvpDdrI9z-A*qP61 zj>*pba~`kdrqu?ScoipW&&d+oL((VS2Ur+ClJ&JG=O{Q1{9`hH~J*KzfiF7@4+ zXh&c3RnIDvco*->e^B(Jt(61+_I-Ft3O5>+&bu$<0wGpcd75`ni*<3Zm~rwDO6RJL zel2cwB*CRux^Zo^sUH4}VdO&Zq)d`FmrvuCeONo=Enw-o`au6ZR~mJYDqBj^xq$Dw zpO1FK#jXwStICmk>L4a!k)E^c{Iz?Lr6gNxZ@ckpT9=YI`;l5E0ksrKFB$5ch$UUc zq&dJF?Bc}c_&X1*tHDw(^&_JCq2D6%NqGzPrjvo)F^8@8Qi{E;xx_N=6;37)O|z@b zny}b`u(suWr(#rS+GKra=W?CI4F&q-T}7PLrB-@)MmDd_85V9eGhNe;HMhBTWzb2G zw5DG|2l*t|CHkZz*!u)+CCS|;#6CN@@n-qVR3!PXT~_hs*79N((+n5Fv}uJ4NyF!y z1KrPrulnj7ycM%8lNp48YlfJ1#2AnJbYb9*%j@x6f)uH-MnAps~LvaF#h~OHe)5@BfIUqg#TPMjz5OPX2HC6;v zIH~}?GJRiim5l(Bjer+}fD-^#0@?oAqP8#e(M^y7I_HUA1zg`tW<+q-^X z`k~a~NJv5GyyjD1K6Zzt@4XiBe(lv}*Gf>=;1m=y z1+P|<`_8HhUCVtTdDV_iG@qWcu74l*Hc_x^N4cG3>3QrnD(^)vv>Rlsa-Ng4j-)*V z9jt}NPn^WQ#+ODUYJYe@c)*(@Ho-#kO&&5uy0TzWdT8f^kv?0ACa?PQQ=n-lkV7u} z=_!%PGI}4nDBKRYcc=OedH44wbSigweO49@f2iSWyJO4(&;pQI%#2qHu>TRVXl+#P zhUOOEeT?sWrrNa*(cQ(;&Py!`jKyxjr9vB@(a+0-Sj*jHi-c@CUD|m%dtnc8Zk$z1 zno1~SwZhq%p~*EVTDJB5e5xqE!b}aw|Hz+H%qg%TyykL8g2iUnf~Nt#BTG0fm!F&e z*d$0$3DI^P;*&hHZyJ~DrVol<+G=mph;Q81QT4|R=%6(Fsro>j#2cmAN@(4HdB*SK zu$OhS)W_$=joAJ~C}x<@VqxM5UtwzI&Li^%BRw3&yP}-0Z^m3AxWc7H_V$&c5IwI> z3yhOTBVO1O0xZd6CU*MZ*|`48gx@NYmImCRX^9ZCVa?hcP%U@AM+ZulPgGmDe&KW7 zj3G7Z+E;CRCPC9$nNYBxiybhMEk)t>-ZtE5tyT2`E^0yhs+n3%#mvqbW zR>C(BSQL|(TSF%<2s9$0@o#g-JELAnQSp-u)2Do`@&$nVNGMeH21x-PfF>1=%jW~2 z?W_PI^k0p{V^CI*L@m1my`AyJdLjwG4SN(sFvH3}K%fCB6HP-90A?@i??G}2v;|`* zr1P_GP;GxV1NjT!tN<%y0Fm_cmcZ-_{T!oW?;Xd;3?2Axs30AJ8|+|Hja;jDE_vyb z_qw49MFF#fafECR+KCiBJSwkpX}do;H3)41A?3~V$o*I2$o<*(0?mc0_DkZR?v-=T!4~&?gt)~y1c>8B5cHXP2*RU6OBBDMtFP3X4Z_x6p?t3#uB7)}cbDcls%(0Cucux;@zaVNyULh8{dr+vwcVUg9$+nNYjs zKFAb9-c2u1dOBw<2MrN>y>f$!N)vSdxH^x|gjNQPxs|0_P3Q`Q#V{pwFP!;0QhhO` z+4F`$Vq_opdTc!gx(PRs@VHu&h~M#wYmR!|(X^YSr9OL%=_W4OLCY=W=8ezBoU9hC zS~Uld2aD4NoWu6YkQvjK_0_u%VIJCxcbOCjS)uc+?C`Zt@|C~6gxc@SeXIN6QZv=5 z;;nf#mwidSs$bnm-g`M?C#3t=#|sYM1F?owf+EAO?ekWrh*7F{}kGQmQV zYt&;dG2~;zWd*Ttp8B7qof1}T?|gS+eCN#@7!dT{f1cwirq2W9^fcas=wmU++ z87{X=4xthL1dL};MZVA8CiH#Bxd3NI5iCV`t>>d<&>U z;POF%&|b2F!4!b@YJXyGjUd~JNQ2!jaxe=_!OkJ1^3Vqs&O0X<)lNRM06myLz>zZE zk#7Y*Oz^;KgY&%P#x6GoG3rH>-ioz03ZM67+BG12nM4=-8jOeiNFr1s%%YUciO-Tm*V=UVSX1;;GT2E$U z$HSmx7+4JKyENIC>d#VdV}qgAW7R0a!<5-udkJ8d6LTp=4NcD;&$aqOa52${ycXY* z0tVQ94q^d$Esi-TLT4@1yRxyi!NOrVd^WV1+pBMDTbow33c4|wQaDAYIwWd)_+>w( z>H!o8PVa9-1mEZ$cM`D>3OBxLb2sOqk6E+!6I63oL>+R7x4SX{rz;#$#caVh(NU*Z zNK;ufCe8hAfZ26%FubH&QZ-W{*%ft<>bCj?w0Q3Iri}r;tjk09L$z5C}! ze))I~!RD{I4L9ijcowJ7uPveR@y3wa?Pif}MQ!7gyC)5u^YgCZL73@h3JMA>J99VtVt64E$UV=@$}(@8egc0E0uUToYTFr} z?##}P8F$t-=;i5yEC`~0BA?@jMVm&*yoIYY)!WDSh|$VkodfM7d8U3iE7QAG$JAdX zAC_|rC@19yyi*|(?sa3a&`d3k9}1quC76lEhld!0JGgvWmnOLHR~MHlwv_!`d0G)E zD&kUA)Zh%Ec`f407k70|l|_tK+J19kWU?s#Jdu3r{M$sAE6s$iPJ&}w%4_YMhq@ye z9D9v(x#``Wbrj#Mb}GA?WJafuB=$F#L-uy0LKPO4%^9hFN@Pz#lG+`94)1i09tte)r;}=*qkYUW4P*7o8$JGw#?gi9td2VWU zp60lC`L&Pu_xy$4b@itwmZcujJ&5}1CTkg#k!d)&!lk^AqTTh|FgpD40Y{;vBtW9Zwuylczaj}#_sn+vzE}jLSD0ViseMfexA)pah%pMl4w_eM)gJv@zQ;AL6VxN;s zZ0iqVsTA(m48IJdje+sikGI{91p!8~$!gSYjflo*mm8 zy7NR&H8tP;`ejUX&)S+pL{u7iqf^_wA-lEi^^*NfjO7anUOJS!%?B2Pi$7Z>!zzDF z#T3ab+3-kmJs9VCb5cf2(MYb9^ieN!tj$mawf~O8MWn)JQ*dOwi>9RM({Hzy|B%s~ zsZ>dfH-0Mhkh%9{?7g2!=V_A~E;9Qmmp58_LmRni>y^S_e`doMdaibDeh+vxgpk=E$bip)gd4KA+p4i0XwN2bVVM_;pYhzSQH$;o|(64Av z;~~e6K0;3J>+S~jnX>ZBuU{X@|1kwZ8NmN$485H@kwx%X5@AjqSfm zQ*TNYNl+K;aCY8W4nt=yxG==>&PKl>S&hFH9e0fux5e_(Np07}aNJ$C!kPo?JJ;m$ zkd{uE)wP7>u>DoXvBs0$QZ7m{$Gng2ktLppPjdC+zR*2+ZJq3nn1oHl#Pw@0%CN>l zNpX~%Ud~x|_cb>kT`Abt+>5@waZYQ`(o4|g;?C=~mW6{okNEkK=qE9a%8wKzS0;Mj zklfM`B5Sgm{xj5c{q?zj@W@M8$!$e35i$Sx`J2fBL-=P!=e-?NqSNEA(H00(vUhl$ z4QPx{T+SKIc_Np<=b(P<^oI7h+DPE}PKF#kpV9R}@i*&skJhd-2Yc8}K3n?!R8jFb z(ZkbJFD_oY_O{flvt|4&@a3@*IwLdYSsNy%rc*$1izNx^Fu?Y9t>$QtCwlD3ncYyR<(_r+Xx zMBF|vUSfY!5MGCis|&2w)Dz^5(9~;K^ck1BmQbG7{PS13g#0R}pni(P{h`m!Ri=A= z8ysFYTTl+VBmHKYtfjlBH8b$-mGS$eey(jr7abOx4!j$XLVpBCjpPKzsWuGXgbs|` z2jmDnTz}3_b!+66mhZm!E)sw9hZ}9=K~ErguNLErGLJP=cQLxS>yHVhi!DTlfS~T& zj^F)c?$dwp{ia-~{q=;tmtc}-ulz2QtshIeusc8H<}~o#R#-gNxbbGWzo*WHoipoL z3UunO$=51M@vFBBeHN-V2JG=0O)@LPcWJh#awa~%!Nz(9Q`Cw-?r)D6@F`9zbTYH* z7gwH=-gsL$NXeM4t2BrC=VV(jui`G<`TDV!F$+k=0kqA$bGx%(azGdU8N;sEiBx>L zU)lboqC2Xpitsy}oDH%sHl6dT1V;BxLPmTv0)ALlQO+uOdU=(YDU=2-6FmuhS2 zNkKR^-gRsHcUNkK_fEA4}`zILk&0*eIs?Z z`;7?qcaIYN?(DE!yco|i_U*$H)`f+IKf_jqDf#*5psGA_-{U;@9|;WiPRc%ilY)4DTrkz3*ON~h zjiiNC+kJ1Td`19o#Sy^B&wm*p{*oHABoCIX4Is!{2Xv3urA2O4Ltg*0Pff2WGa2~~ z9-o1a?-J}k_ucu-6;O9fr-n*UW7)dzKGW2sUQPMms{87ws21qmK@da<0i`7s@Je@w zASR_(0hLlfq=rViqyz*MMY_B&2!eog4BZGwgD^A_GIYmpAHDDQ-g@u-^=hp*Yw1!L z&Kb_x@$GMad!Gv`Dx%W$E7hQVt78w`dk*icTj&rJs(Fprk99?Uy+fi;t5?0^jKWyL z$~}BQpnvn?w1YGiD{DCH8bhm~7dbc>)ppyStd1;L*WZaT+v^WkV*KbMxC-iRJ+Z@=T<)vMD>qvdoUr~RXSd|M|Tdt6lv((CoznP`KpM;X$cAULW7@YR2(r&Hwd744jjM0pR_`nEWs zVU~%xeizC1e#gCy=lIrlSHybikHn=0?gBOOfL{(U?auLlaQ$AKR- z4o4O@e>rRAf-14a{wd%+J8Y&Gq@gxPj8{lmkn2f%**=da;>YkaxtX~zPSAU8ltRln z&BI*u5I&XoVe!YDd!zi0teKks5M4cnGg}lXN3qXp zb*3r)`IT>k*Ii-}h8YS^4FTYlr|&&q)s?+KOHEC!X<#6rP+U}0Yh7%S4h<}eRtAC4 zqG!CY$Zi7W-jzCYaaeCWsoc1mFj|FKyLf~gq8~Yvc(dc9&krOM)S0CnP61^d(I&}E z5ie>|rJ^%2nHbE< zVmG_1KBjHhQhe7Lv_A9lcN-cT8Pz*GJEQlT=N;gqwPoz32KpqH9ZlRVuA8tSx^GZm z0w~o;gCnmKrc}t>nm0B!*rcQwyz#Qsa*Uqegt$03I8p;C{m3X|K#ij2t@JJ-Aq;w~ zs4D($^^AL-b2gG)!^5Xh`9fu`o90p-Gj=fcd}2kcOGOGUlZ|u&*s{{CTc^MG^q9o( zN8eWO{PwNC_nIEprAybuZ}jp1goE7EcXgEp_kb?eVQU{+gKc3g6%kKbkBD4Gmc5$@?VL1Ib@?cnqC z!w(Evio;+^n@K~@qrBfnI^h71IV({?*tnNY)uFiDVL z`S_WMNy}jp@R%)njzo)du}VKeJp{s zfKp5BgNA`@t_pDZr|0J4mY-_jKoxA;CwWfkBB+8tC~Qi^Ds+|R5YxbiH>PB~4>X^w z1_93YT-!x%?)`)-;I&!WxfHHU>uYPGj+)`QA95%(GzVb1f-gf`TRSZ$hXU*(c3e4m zFP5*TyPL}4(0^mY0e;w`$RD{3W+n8-B^t0eWE?=*T7j;!jhqm_0zDXaY~H|RX4#&o z-n2RWP5A&t4NO>lQ&XF2anHQU)vG6%DM&ya-90$S!}J+K{NNWOKb#;jm_ti@d#@-( zpLfj-(0sK>qm)Tx{sw>_NO3{<*I$&?U%EfBnzNr!5)u-MeN353cgx+qf=iQQVP_#L z7bLM}3%q4rk9cX}%BrdlQ1S_a*4w;{?-T4$AxhBT1m>CoNBX|IizK`$O)C27)2AlM zq~5qM)bHd6MX4v49s_V>fsTm%OdC~YPw-( zCk%Cvc(#=g#|bI8Z?L{BR_GU8XdXU3^0I9BDI`mOvG8K!NJ+y4n#tzsR}Kp_vu$0n zkudycOI-8qAuQ;Gm;w=g_mUD>)VlInM^f?Pm!sALvj32{m&${da#mKn&4le6UmDvW z5{Bjqx;06~2+}cFU5!APcR@;ULa!%rpLu$KE3H#UtcGzs*{J`4M+n;DC`y?smJ{%gx0_40eEW zC$EMmAcY1Q_xu+9W#BFlDf=k2)9b7yKbb(?XwDc4ki;`=R#8RSO;T@%zz~S#8yXtX zn`iemvG~5d!&wPzRm z8&+z{#jfkb?*o8}^?oD$SZP`kK8Ho&_H|H?8BoT7gCq5-$%Aa26jB|GV{=jx#L+!JJEE^a>3bSJ$j!fCVe&rU>? z1PdZtYUt<0Jx>pFO0dt8wq2SyHoUbJ zGFH?q9|+maP`y(<)x*V*qfC~z^Rb4odf;v9Vq-GzJ-*JetdkcKm2}fzOjafDP(MlI znuLP@jd3~&T~w2w#xOv#+$cyez z;w3ZHmNMNH+DkQ$qFxdjJU%(jgyT=IG%PlRPcC(Q#_3GOwVON-Meg<3h(63H<{?EW zxUd^&E$a7jRF~QiOYKR&69rSiIv2Cc9~v{v`p;RL7#wWhh+z&k?lCYJoZC_UtwZ?op`Ntv_?=yXs^C+I+yLA;< zn2sah<0clui}S#+;7FqT6XUm62en78*vkjagC|5h>LcwO3H|`}@ufx6nsp}*#LR&B zdHevsSAD_dfKMhi@CWPr3mq>^^}jyGHylU>6~E*x{zOwfs(*o_S`diJcx{DxHrUme-Z{uDUkitxsDLbFD5cN#djoGZ(n7$Nsin zRbQomzz=4FjgM+go>~}K<+?NSGbSSjLj3Uq*9oF0WoGpV%XUx_m4O}30BpT(TQ4VuQ1zn4t#c&HStLQo_6=o^RZ>bq6qifBl;S6rslni z9ifWA+V||Sx?g6&=~wy#OQ2JQaC~4F&_- z)s4E+&-sm}x;VF9UP4AYaS-z$4s=uANyDU)Hs#OKT zSIzrgdWdsefwCWB805r{qZ$O^^3+YwQ78<)VdQlCim8_}b+V>q!87JBfomb`oT<(q zkN2l_6OLH&fY1}?e$~1^?6JGR80O0*F=B9GwdmcX{g*qd&)<7c@BBKc1Lz@LVR=B&D4H@<}8HI*%B%N*%qU*7bQlFzxtZm3M z0<6&yof0D}zN5bBIRr!HO0ugY?z^H7zHNEgDM&a8%PP$9?3A8JpbKFMsrQ|{9s5+Y z*EWVmhJmCL*HIdwHI_p9AQQbb=$OxB|Ad>;#rjiEN5E~&qM-)y?~K&-RD<}$_~M(Y z&1UE3&kHKuu`vpcH@C%3Oz};adD-*Nf(?9hTZjmM{9PI3xGSQwh5FV9)h|tUIC3LQK=|``I1S7vzg*XLCRf+iv z3gE)1sI<&px>V}pb+mnb-zFtd2G;oiX(!b&wJP?BOCvF~`Gx_fbx*q5&dyXgFgg=L zncQ-ZxB9l80D0S^*kzN6_WP5+_s_Tq|9GYzFX;nSUX94&msZ3JTs_$5hNCx2-Bq^Y*gu2ujUG!ro|K<;kp9ge1Cw44&BoRFjHG}A;+Jqe8Xo}DAr# zCKlc156fl@4GmGKvoth*NVkTM&nnbHRmI`hP$OVJ0!l$8B?71eZI=dxp!$VLoLbX@ z=T(#!Wn`F;;{Q1?3Kxp$x}oN@9Q;B6r9tfc-Y;lcf?lM2pzq8ubd8{_KS&?w>kCt| z@-2p}sIIrX9(M#GDTm2V(y^2h5<3N$c@l8KZs;p@5<^%o|?<@Qe~ta=?1l2)c-G;ou%8ms#tH zuT9rJD*zky^4xO<(-w2VD|J7zZRP}O z(6T5w2d_Mj+vZw!c)aC7U*S($VClL3V|kat&*0#A&HlqBVj9!Nr^yF|FEg^EQFLtEtZ-nCH5sA11^#ft4>+eQ!}QdGW9D5d(FL|kH=XIqeT$Uf(x1-AW+at?I(ieUW z5UX|4Im#C-=1F%3zh^zMtbHhD?L?XKowb~#1un@!PxQb_?y(Ttv7AQO2XBL;`$YQs z2bfv+(&!IwC*VQB^RPP#U88V+vFEm%0AN#1ujfTa&o9#8q5=Mg7w9IO?5w`v?$)QE z`?%uL<9iAyv-#3YDS>*SedubMjzMQ0Frw(IfyU?QXt+h1a06?jVc?{WY_^J3YQ~n$#QtqLYe2p)+=nlg>aQx^{9zF6 zk&@II-6Y=x$SM>YTquzuB^m*p>R%7M z0V@O6i!?Fj|Jsb%h9eBFMG2T+;WvYTmTnUBe1WlAWIc6e4$L*Bs;)R}?}h@(g(hA8 zGpHaY5i5TNt}ymkO1a>%stXB%#ctR`4O3|4jNYmj_pBP?LO&?_*a#MXaeGJ;&X_#( z9&8FDiN~dxnr@7Kvx1A~sZj^-8DH-Z?~%@G<9Fqy4%djAcJ47zsa(~Ol4-R`L>hlv z3w(7$4r@ z&o)ctZLS}Qrw^xg^*GCnACMTVi3!futM}i*mkIG?oX-ub13qDGkE0d$hB2-5!9dYw zidjc{^5R3=F+aK`+B)uZq}G{-peAJ1TA$o@C^d|WU)=7M?sB{@xzcdIqtX{41!(1H zGh@>A%K=}vpcxAC5u_N;pL2g9PZNLn!ME4Ga~a%yPabW^U4#O|DEI^0Vv*}I=h{*G z($OiwDg^@XEQPUvO|9eCcs&VXDkd?leiNu+T;ic|9}J1lb3LZJGtIguey}B35YN3q~;+hR;Lym2i8OL_-IeWiRZNgAQ z@4%q4%~XJZ-A0?i5jBugYvs`Nb8vQk3jMBtHWoS8bFj2!u*#!6{=wb5zRT7)b=S2P z?$samo#dreY1hLiLj*lAx{viw?9G+DVl#-vsH zFY9-Z?ewd&ynvl`2kAN%}oZH z41O>Q0t)Xs=sWaZPF#TLa(G6N*?V$TH8q4UJ5%k&TJp&MF#ub{MNRJ?!g*H!%#&)x51c^2ZTM$$@`e?^oSiAXa8r;_h; zA=Jo0Va};^ey4aXf0R(6D>on9SQl_XKPI#$H~ijue5P3a zsAhYY`>jaPWPgjoxVi?nja%1tI_YgPuHk6ITQy#kx)&PX!b+!uHtfL})OfA`nH^Z{ zaj+~ws1=x=saM&@{l(nb&QZsAxKNMiM#w;8O3`P^OmTy$7Rys{44V(R8Kd?rf~56` zR<{!>M^5TFC=5`Noa^b-n{R>~H6#8ig>KSb$A~6f^-hFdDU{F%zvq;&^ghhpab#1O zsMqT6?X>Q$GQ$8TOz+~t+MyLfW?1%~27%Nn)cO^rb^$oT^AlI+yl15?9=snMfUArh z3xcBSG$64rOJ?Gauix%e)A2m52(`W;#Q0K$`lBrT&jHa|__z~LN48n~(|y>jDKC2{ z2Y)JMlltss|IkFgnW)tt?>sAj(y80sXmSG5$#Wg!x@T>%ED?~34LmhFIGXE}v{2LE zOMh_KborUE%YJb>S=%|`&3jTO_tZb4c_JZ^!?_~)M%rbNKk z&_hCcx}ewcB)>0K>X5sz#XzlP@F+QFGY5(Hdh9 zL}OeyPcWEQWDXrXY4#D+-u}u)KS_K)${w&rZ1s)6XPO1_wuJnR!Tcc9S|RS{#Rr}; zC5627(&L%iOvjr4Hy@+XR-u0mQxj4D7f2xqgo-3CM}7V-H68bR}*V8~~mKuFoQI&w#bW?_*3=W0~1G+T5`HOo}Sk=?9LJ z<1XO`pS6o+z|0XIi1yNR#@CRd%@!CVMv}!}(48|tJ`p6RS|5QN^R;7ysRscVCy=t} zic0!Py7of;E=Muo5^)

LI0gD&GUh!?3la$<)3ld)w3`IOY8wi_@7`0u038H`_in zX;kv_!$E*s^et0hpb%sAHMw3Oi>r4Ew$C-|xZ}cF2o#-5Xzy#*xfi1yR+YD$j%G52326l^h&IU$e;l6@BKb{5xI4DNoRY5<%M?>Y_S4 z4K=l4!H_ZAlM*O}K}BmE?gyCz7BN;&t;kQer5J^v07dtfGN*nCM<#pW^U!y_)!_?{e|A z4HZe3Ov>M24ym$cHNTV85*#PGDhrk8ctS;1=SJPVBe9@_nI$=W#q#?!ukh^?rJ!`g z&Ogyf(S7=GiQCqT1Eb9UpwmM|MAlyPceZ$}37)l<$gN2cx%b+$&WJ-5fZx@71BzYS z!K&M5eO`|qE^B;N*db>kHHNHoklE)Rv|?7mjgAI6Bj$OUg3jULVJyojAK#OEo54os zL`>TSFC^Mx5#b0R7D6tTSP3*s)!ssuQS>hdX|XVuwBm6NrT!i>F`sK{GE@vO$#q)LuMl-SCA^<4ppRU^WbCs0G=U3+FF z>CrwVySvBvlT;4|Kf2iQTPp&HAp;S3SbzYy|Hl|Afcm$3^!`Re*I{F0ltS9i*0NWn zqwAz2PcztL=>>>;S}!UrROoKst|yAG=;e;?qjWy2Qhcl0SxLA}mkRR@8ZB*1D(r*f zr^d_Y3zyBi<0-*PbfCh+xI~C%24naDz zHPjt8!GR5cSc9OOEDKKov5OrnmT_LLhsAM$0A^E*i=CTOXjIW^X9rH&9^UgS-7A(x z9r^V635-@2S;?*Gb+xb&9IKX;s4pft^gC~)Ri&|lAX_wM?>^FR0Xj!GFu?~Y~&B_?NMS4B$Yiy5M$32%=AFf0%`YD`zy{x|-RnHqX9k%Tw5Y6RGf3Wh{` z^!TIOchBAcHekuAJiEBT&RKTXCSQpa*Z`;U-$4~LPqV>5g1xDfyV_!Da0&=dXsIh( zSY$1Yo^5|54crfqH8YE9C%fwiP%xSp86QuE3JMFm_H3?MU^?aupQPi^z&Nw|QysNh zj8m~T4J|+NT(ALWGX+{63V|T zWUnThf4@~7-C2!Ms$4YQj?lZ@@smbmA?fH0__Q$F3h@0vCYo74xh8PFKst-`<3{D> z6QgXOTG+Sywo>avFfI=rQ|zk+=V}p>i^3loRaS#@9AJ(3hO=~Zfh8s7$Hf0z(+bxW z+SMfrJlGYfUoVL6x+93-Jtix zyjrzr1{BcI*5bNkkdcG=Syu=?YDWpsFiXGbzWIAzLCO>P?Z&)`c22NECkbm2OwS=f zJz4e_j9Q`t{>&-3=9rf41$>5*J+>^~Y*(r3(|1hvGB)Yi&V!2pyjLm`FuT@Jr$YbP zAM*9i(j<9ZK&q!g@Fvp0gQIph2z~5YI^xj*sQ!r|kq18GKzzvgIk|v3qmFOR_pR@9 zLxWy28|Bw6r?Qz99>-En68W=*{hNdbx;szslN3r#2V%>FC598stX@!O7A+8RV+RsIpWR{Zg(uSnZ)lSp} znhbcXdcg3k<>Qe0aKOMih34Q* z6oFi<{y+8dK+y_6(2R%aWU@9rtY>9AIwfP7Dev#M-g(CE!&(fTvU|lA&J*J*0u2B^2(2ZXO}I4tfWQfl0ik(?${oc@F%BKr zs~G^Gs5Ipz0N{$Fy+uSEA3;gKfi3jLOYqyLoJ25u68|fl=%FKN$q3C=1-%1tyz~%X z28jssooOdcuiR_$Ck|a33a?{Bb+(a$vBb@BbkAa^=%1cI%L+iWb%0OztU^k-KDoS6 zL5II_ESPpQ$esggKh}}*-Hy=T1NTudDgfF3#B3w|n=t*;=;e*7pKVeE?^M9C9@EE6_-E^%? z(^~0HyKcL?X3{f33UyvXw1MYktia{VH4s5XE2-so#t9h&HF2u88$Y!Uc00WQl2))s z$4NVyS8oOj1Flo1-k`q?>#Si&;Y?RgPg?0&(`U~(#l>k2ybi^HGnEez`?z}b;_A6z zX#%S?H4y6?gnFihouCA57*f(#r`Wi9U_Gf&qBoh*9<#Nd?;YRsO#HfpHT*83OAzf6 zA(fyGrPxH_fWGphM@&#@<-zV_qe>&+AhWNTbucsE^@i+hhE+4Lr^#dG1~A&(`&8 zZoaXxy*&kOrN;G6h466sJ+thr8&fI(R+|Hz&Qf*%JX=Qyi>Jv0nHMrPx3?*?Bj$ToQaG#}H(;6jUGmsTeHhJnfLs z{JX~wP*0>$@p$zaY{{JC(+HnGy~UsM1t7&a-k1?PSo9)m{+JK_p7Cg}^FGmZ3eu)6 zxeR~gR?xhQpx@Niq5iGXq3W*lQTpBVhOXXeQeyakzh68T|5axpZ#VoerwF?0`#*nk ztzXQ%`_w<(IV69MN)^U==It{|w-`Z?lwa^K`*#?kTREWa(tn=eh_cIVXoSb}l0FJv NH?OIy{>+G}6-fOMB*4}G<4jJOP^_i!=lQkOeIX))p4(6{rnl3h;KIZP$XvVI{U){0)VQ%kX>1dAX>WFl1iuT}F zH!XWlM{Bf_{YgeNv}b4vuOzj6Gk2GPzE3wh&X4fXrR_tQ@6gyYGu1Ybq$)P)RjbQe zo|05lV7Y5Jcu4vGRA4rMYh|-Bg!0KbIV5Mj@<=Z-EE9>>VwrLEjDBq4(mx;|039_pG_*It zC-r+NLHqVS%Q$Ef1O%6hH#N@z*#F!^{gaP%=a*FeX+#gl@BF!}mUx5r=kg8uUC%$4 zXsnNN?)|wo3qhm&OUAzcOOyXJy=M{_e=fh={SVe+GH^SY!jR3=FUiJ55Glu1*wt2l6cJS>Em#=!pj(As(@e+18Zjr|`L$Ygmn_}=Gv_1E04?B@lwlaom^ zQ~6oJeC`4xEvH@6o;$8hG>=_C@QG}gU$(NXftZ*Hw&JY4!_FgqmgGJTwVl=qvXP8G z19{eXhKpaa|JFhj(k@>d)ns7NE*3CP*?Pi(1d&tuE25tp<-MAO-pT{+`=8C*vM5J@ zr!S%iUTjR>TvutIrzf3layXcalRx~!@1o=)zfrtF+LZmebvI?LW!0DMV%Eiet%yPN ze7oC0S>w)C$XJkMs!Gb~LKWO-Nr)W-?l|S*rI+ZnlQ#zI2!yfmC&{|?@bnz6GL7Emz+%Wo=?+RgIHyDl5y^m%oZXwvFhhXe_niW zQs*C8CQRq!i;=W9Fp7S#JF^ZOR8GX>=Y^(~cp0_Aueo6js`i6yCZNk29Z1lt*_*`* z(4}(Zt-EJvk&O*AH@7r3uuCZ``W#@bki4YRQY?rK<87L;%P-cHW3)ou*Gzj7TRL>o z9^5%1B!Mh0Hd!_4)HrwEAMaNk)Y?kIgbKFnvc+nZ6ttUUSsgD`d(E_;dd~^z?yPp+ z#Fazmd=3H(d{{XqDtO5^1%+Mn#Ohs!>7G;U&kr~s?x~@dVYr>;L2%9%z&|9 zSY@fNVt|#i^nyC&vEy{dY><+VUW2;aDIh4V)6FTF%HB^?=)0X|ALhYeU5#v0%2Qa@ zwq@ACAE|4szf#VqF~wL>F`L+b3tbR5%og-JG)SDL%S$LY#rE8podHZ;&7Q)xO|;i2 zB7NI~-jW3e=%ojSVX@2W?uPDA&+ZVfmN-;(s%_6r5;8e>Y-od%fpYkbygQYqn=g<7 zf|6rL&|E`j4P(RDNtKS*Wjd=lk=rU*BK`$V`TL822Kz;?gOQBWG=~}J5zx?zDCc0N zv$#yF7Niid06jgdOWny*N_ZjYQdzfgNAx6`gIUz#GyBciWm!^Cuv&N4KGDr?xc0(0 zuMGB(^DHpfQay(x_`H)CUZ>4J)NmsvTD|5dTJ5N^n<~D}ynMc){ZiJJxU`R7Nq4nF zrFUMzF?99Tt95&g8%~X^Qx7{~Oxv3;2ynT`qFS6Sz|i%AEK?%j*4xspd&e#5R;)S2 zWs3EnojAU0pL{I$D%@7H$%>ThY+*dcGLw9pj%c8TboziCjVB*(dYV;Kkd^5|~=u2hA-X30rtkB34!kLhar z)!jk`p=-ohoca<*w!b`nBV1k+%M-D%DE0MMk8_Js-&M%Wnb+Xjyctz?} z6^FFftZzskEZYWdy&g%RTQ%`|5R9-Dovl|8Rn*)cOdiaRA11Sf9N#S~BU*r&xpRn z*6R@)J-rN%8Ow5bH!>BmjCL)n3d?KBN&5-Xggn`hTAN1q`FaYy5V zsWlpMu{kDn%fo9i7UptqT;MmYh)dEO@k$Y$FvcBCN>H=huH^Q@zX_Co6zle6{&u*s~J_pVZJjMJ3x7{!JC~B#|!6_z{$cPpdPXM$p2gWJO^jd|@<`a`EyB4 z!V0iW^B{{;H#P8p_-aBXyMZbvQ|bn1oPGrPu~MW><-GGOjx5UnbeUS9v}_0`pLIwW z)tQ*BkhM1SJ@LEQNC5*Jg&pswB_#3blWH;o7Iumioq&xGC+O{4RYV$AE2!@<*ePx) zT=@=L7qOHIN?98+msz&zj1BI_0XSy@`s2}K?*xlBg2 z7;swdSM!tsdB>I4$GX&pRN{Yatd`35{B3#|;E<<;CVrB`^Xm5+ou_-m6dDPZZxS7n zeZ19t*%gr2#W8XsJE$P_T%l{qp$kSOe-fc!iV&3+l7@^6Pt2*^INx`HM0w^%x0zg8 zCNv!UIZzb5iaHEz#$}R7-GZ?Ub(Qe!OeJTckFd&neLn*My?~`kde0x(? zgsdIoG&r$8zuEVZ*IIuLh64_@K)<}blR<-XS2;*!tZUbR@O8ZZ0>JZR1n%!<>Uua| z@m8208nd8$vy|7JdIEQV_wtl(U$!+I$3z2!39fw4yFUYh58DhfrWuCgxISG~2RG%* z(9&RyUba^9@@e^0wM&!J@@olaP*3|LE{;zN!Cw-xXVBPZ85BPiy=?_V5we19BlUKCL%FV zTVvBsH?T_$_Ob}@Q_qqCEZx5iD$mm!DWgi_xc1{d-n^bz^@3~#)CUDb>zJ4nf8X+e z-!4K$JhhlhCY|oBG)um;O=ETjO4B#FjA!#}LDF%NVE){at{cTE>vOugNzWiZh04jS z)q33^u=bOFs@W)(1D!qI`M0&CM{w{bzuHg9iPICCKg|F)C3 z7)3=TXK78xcK1qTyiTWjWrJ{Ina$=V2>UgYztI5|WO9v4!9y2%Z0`6c!XBE}Z4#Hk zkBJYomd{72J*9BREa=N!AD&nmA<@1_-P*>ezA^i3- z1=}EL2PjB8ld!{YeQ)S=s-J4o*qV4K>&UHR6YYf41qQwohII?RG>~-TO1db-`4sDKe=~Q89>p!)9DF4vBU zIyGn9L6euFLHWX$cmJNm-{6z~HxBFnkq6*(ZvK_HLA68kANGr)OQ^_CkF>C&Af5iAD zLh2fA+4x07kNHuR#{L%?JV7kjCgoCN@CA=BZp!!xni0P->UwJ$a*Clf=jdY`VLBb7VA-AWP3-IhZ&jnZh-#H<(rx|Ti;y*E+y?;7rhQfFvM`KT0GrRRL>{W) z$Sca`w6RdSH>Q4XsMMQ}j|EMxX(e7JPEF7i7leXzDn^@3WSP~pKP3v9w+Gp$M5ig5)ZF z_BN|&376f;gkxR<=h)lKD0(H{rV8~8?i5g?$XHh#GiZ^gDKNUonN8a=XE(xF$zh0) ztGc7bpfFmpL2_3Th9$zzR&i6l!sL`Bmk?xMF=#C^)>*H!c|*nqlrZ$BoQ0cyVnDFC zlvdun`8bxokWE;q6LsF>i{xfq>9^5NRUesbDx0N#znDQW5&+n`L-3XvohtD`q0`z zDb2YqG6CF;=#)aFTAd}1VEMzoo^1}C^Bp&oi=F3eKR6$f5FeZf`2m+b4FKkoYa1+- zd?=lO;whL9HMU_D=IJz4s{F8CG-fUzOss1FH1s|3*gZ0)ED~8kZ4n?Gu9A-a-faGw&PF&fR_e0Odw=do{M;#Wn)wi^2ofS5K z*bWREYw{$g-b%g7r$njBfV-OaZucZ03_Z-)KUYeqs!?Y%I>R+8YB_AUU04auC&68^fD!I$*t){^-OMmpr!V4bm`zk zo56*AQ=?+i=I@XJDZa1Ne4(Ye5!dthwCW}AR7fki!$w{5cl{-PZ&9FEGS)PmZU=uo zp~puW*+@B;V+z8ssP|*D0NpglPBPwB`WJ@1GUytKO3yjgSBe{P%YEOLb*~_-LB&%~>eySe zb2s?6K<~RK6;*E8$Y=3ORZ;PDt;O$dqi4;wd)2kROo0sM#DDeMRI*N$<9IiAA7D!M zGEacR_QT7K334|MwQJ=*=clK4=2FW?3*{B}ntiQITN$j7gZc^2{Z`%sMF%^L8~_do(W}7o^@E+;Qyw-k zrAhrK+6f#IgNmbv`^dFWp^*9mnKtl+M*wn`u@0VDJr&=&yv-C7g4J2 zyRa}_h@%`mFj~YSYH`{^XKlB?R2^1a%pz@!WfeW*GCK5tmq5zFaM|O_6;~27m86{#khliDtN%j2L3#tWbhkJ? z-Ef0#RHspVyh^dR_l_l<)7~^7nNO!|nh8Kz$NFs*&s%}iBY6;K(IZDmBb7`^32b-d zD?6tezjlM>2%SM~h_PFOx(3sd8CozjbS&COo2`oaoR-ScD>U>+U#-u6{tWWlzqiSe zQ99Kx2lW1WAh%*`?Q&XDF+w}Pcg)lNEOys`jETiv!Z@LoOi7yz8BK|n-##=A)!>z# zmZfGoxhof}7QMT4)VdP%D%L5%-92BNJLQAvr_zJi#bT6H0h^Pr3zc4eJ?Sc);?vX} zB_}_*ylvegRT|W8V<_2B&QWRMVivb_KFzWS9OXK*JvmXD@8==-l-QkOG|k`t#olAG zzPiv>!rD(o45?MI)G8-F#}tJ8X|I?#e0WVgcs*EpWkE2@``gdRW~||kk33$}dE$px z^y8Tr&_2ybW(06V#M0)Gk*<~VbaVSb-HKZdp8Jj@OhF9e1J^MaAT`|WEdj40vD6uB zgTvp;x%gebF==n_O8gK5-XR`Kx_*AO+hgM!tT=pVq_}l6FlD&F)d+k@b1(Pa*W{aG(m;igFU%+7khJa`tQn&I=Y zlLPo(Ouud9@VZuDttGt-4Eg^4lOBJP;GlRPAZko->#oAP?ITkcy1A=kb*I$&oA}uV zn%$Z`4xf^X@>^Ag^epZ&j#tQ!r(G~)?r_yGjmYm!47ERIiYqCrY-vi7Q)y{2Ri1qY z%?x0MAHVc|A}XTsWv3f1fqZzs>oj_PNsKVyc3|meT8}%QKfKyxP|aAl%2-iWRjr=! z{xEGWI}tBlX_G>Bm`%MIQoN8py`}|D0qIDxloX*i14H_GQI&iRyiKJQEbSEU z^$n~`R_EH?lR3UWWVW3&m2JVFXOIaL>$tR^l(d{amM9nzmRW5I%4rZ+;uMJ;WNMo1 zuPi0iNcD5;(O4Q2?Ax|IYdSn;U$gdmFwLPk+MHpw7Ha=Ed%F_d62mA(?xpmp0&*OV z|2XTPGT)onm|W~}Zri~khA^AW+Ych2nQ<~Wr;YVVN#8IQDvbX4pwfXV)ER*J$7VuB zG6F}~c@Y}iekGl zer;v7KCqHG{@T0@i3?hnWa^h<+C@LQ;SoI?x!>dQqUF3tOxJ_EwZ6rzt~HbapO=~k zRv?W?VcYR02pXdB+Jo+$GAqj}gCU*3SM zEI}~d$19VMQ5hSY-~T|sugdBj1V1q2km4WrALxl=jG4M?K}a|~U_T?wahU4#-Lzt6 zIE|T=IU&Eu#mz8H3HIRFA6?sh#PjFu!h2(6DRMh8l3iWt z;XE^6=^&o-v+l~UuMkN96p#Ah>7knnw@UQe1btq~`3R`%>i{Y%4T8IT_*4azOw`~u zmO-)=9tv5q$q$GPnu>D*BmF|wori?B^;^H5weGLNE4>{6T|>>MkwGmptfF)LE^p`% zlLl0(BJAa-pil{B!O{L+cUy0FnQpV;Sx8h!I~|)-pauJdvA_r=BobnZ|xclJIVF$ z!~auB{{QLW_x}teAmLy7y$mn{-dT?=5d^_bQLp|5X86g83aMLcQ&*ew#~33%l^Q4?5}Ad2 zf7wk0p~Mz&>J;R)Nk)rvE|N<=TR9u8A^+a_-8R&4f8G=@zkub{iv?u_my6314#{q%B>q7q2`3z`|d*mqV)bH4~xUWb%_v;+veV% zf`+G#b*JF6Ef$s)s3>r<3{h-%yEN|3cGglSCG9-63fEQ0R>3#k->}!Ts9NpRyIhmr z*kgoFCEWT~bCCET-BNj6Z06)odW9Uarq^yX)g*ut#)yA}0rzSVVqCCk*i-NSe&Tg! z?XpDnFEHhq&{*~<^mgEf!Qjj(j)E~TmgHvdc88&Z=isDOh&BY=w5J}SGI{Fzyh#Sa zrhr%#qO;B%7xTI49YX0Kcksr-6!tkY>4DqPV%)<8e6KJ}047}(Pt|RrEG;GZ0=Yap>m7yln&uaT3e|Fu!xQs; z@-Vim8vS!&_sNml9bcHl59HY177&ARwi3k9iLn}8rJSnzqW z_7QYV8wR(Mt(=)<;{!Iyh_jcD*ZQ>>WPf?@quLYHT6Y=8!=VdHm5bqv9nJgpnr3S= zJjwri7rU-7YB7G_Zh`<1KZDC3Nk`vaP1q2;@V-8ia~maHtFnBp z2+-!IqJ2X97nJmh_@$riVTn`K?F_xg-7&T+x0B}z5n8$$xvkaOo+1Xh*0G~H3d>D2 ziftskeQb&apRCocy}qA!dC3d;=~z{qV%tD7<$UxXT;F<&wF5e`mZ-~?BGp}P3Ul1K zg4Ip=Q%Vlf?7t*tS(N!0a+K*6k;B`cMVvm?(>AZPe$RY#T1J$ZNfz5hz$lVh z;5c8G0k=9aX(`N!14er9$JHLIsJ=XmInF|#;pgr1;7U;Y>%%2pUv7{6TK1cO!&Cv3 z+Tc|n+VVahDG`)^Nx)hr(VMj}j^mf192p6+))P@300+u%8-e*PmOHOcgyh<^&ZpQU zS-2V4z~Aev_%#72aAUzXJg#0=`CV*0%2T)4he%Efh zb;V;y47Us-p^Ey8>w1)N`x_X?IppvFi*>-+*oD}g7U>Ql8in<~fq1vj+n(UO z6b_YH#_+ai5^&$?+1VMM&o40IulCHXzu}-ov~{c+$}=_HMZZA3`YRwWLPLa3lkF%;Ulz+U`qoP_m zks&*0s4K2?Y=nZP1DOIvBHrk z3zgZtNEEaY9d*1$A2TiUJ8lbblJpMT%W%n!)K43fTBg`Q&aU9tO|R;sdVu( zXvVfRwC(oLC_zk2Kif2`wBHsEjo|RIZz`DDDzINWvh+X0??HK2m4C%8*%0ZgDM^K$ zbbwYVyD#eJP)8+UQ>CSuEAEuvQjhE=0u zSq0qmd(H_1I&!QYYO} z+sS&n&}qLMxo8(S;GDYw@g(V~)IBxtUz1Bc{WDR1Tsl^cT>`{#^IXYF{8C#{3kUJ&` z`2#gIJAFtUMs+WLj7#m`x=Su^SB1`C_IsgbxALJ;E$8f#(Q79&*O5}}^}lVI9WzSG z_Eb>gU!c@4B~Lt_3gwT*)BKxNHc9?CX;6&T^S`c)lUYCJpU2++Yjr`axUfD?Y|GRC ztB#hhGr;62n@!vM@3)yq=8v=Rb6!!D%KY7pm}#BFN_DOFLp%zI{B z%g^zAq)~e1#92!IRjcDA7<+&@ju@#>jF85Y%gxK$Zey_&7t{NVY<_rMmbBl78Ys5>uJ7s@S0{P_)Hn6O18>HLr6T$g5Zz$ViYg#taC5{_ z{8|Oa>x<0Mt}6WA9qNA7XZp9VZ9c`2Vgluq&Ap%MS^w;J#K|w&_M`6TYWfu!^RrcX zwc!TUsA5~s^3(5gEs^QT+W>H@QD-C$KR0Afo-h`_9^tuN- zYYSxp60}^M>xofW?go`!+Mm&AbicA1Qr_~GT|NSt%q0LYbbvC*wV7qpRZ+X5!e;g5 zm8N>`2G-@G`E_T5%lpwM1Ca)o@UF~ppUR-5Of#AD0 zKb+L-#uze2inoZWKGsFJ;;UQ;L!Vj6?JEjqD*u{}P-jVu<9x5dtO3Qv#6^b4HfhjlCM;2?jB`3N zwdc7-yPI#=_;I#jP}@c`(Sxb#IGf!2&G%U-=*t@~ouTTsrd2hvx}Wh=&yT8K!TtFePx05zXj^OIfU{Yi3cRK+SgH+dckk zl=1|3t|Uf`KzVm%s175PygQG3#wcq4DQd{AQuCiTGL-&Us%DYB6ypC$SF9Nj)K`)> zGs8^yDqwlEovAmP*LH+a_`MNJ_PREQ0Z?fT<~IvJzJxzRnoOS{Iv@;c^;s_`|=N{*;mz zJ|FK!!9Jz&)g$WVeaMR+T~}MLo2!kig0{xfCHvNOyxv9m``oL*wa&DgvytrsJZ2Oe zoQ3LC;{5FCgTCRAnemR~Qxr9!-p6o>Ob?pOd|#$EKlrlq=DdNoO%G=9BK2Ktk;L+B z$;~t*J9+=mTGMCtLsQ}WRbGvZUaE1sO2v_EZ`z%u77B->+!P3xPCT!^rcV2OvtEUu z{^OvRivn|?Dg>ENMK8IwGbJmUH0=>pPQ9ueW-SitCR|-n|dG#bo%Zo>ttE!e1!UUqLb)Ob1TqYow z_Mq)TItf+G6P;8B+iO%=GTHsYfugCA3~6Mop{zbWN+7!AV1GsrOxQ=&A7xB-VsW6? zrc?>rC>2iAZOggR+=)_&#|Ug4@G4+0cGH1wdtjU0Tn zOtu7TF0om~{yVH0c3t!24IFWdMuC{dHZ2l?7zW+qg)3nIa~-W^(p6^pZUN&-AJdNt zUGuq169x#gt1gLjXt_{k0>X+?FdJ4CK^jFaXl}8&SbtxFSg-+a1-V}=fp|RG|!I??PQ|&j^e#YV$_}E;=2|Re10Q@f!Er#nrYsifs)R(8FDB)c*6Gkyxt8JuZ=GVECp*daE7B3ilx8~DkL}&t_ zOhYy(FkSPhKZg4)Aa&DCt5c8}YFey(D-5Wek8hIRdpSyamw3y<80SmLPv`mp#iS~5 z<>7jgerL%bAREur0p*3m_7iUt+Ha-9H{HhDd%B*5H8DNTDUL%9wXhge#cG_4_#U_9 z@}`}n%3gETSI(1sZt5KWWW~w)>OBW~!|;i2S%bK#_Z#!aPDv_ymq|~rAA9QxZMc#V zPbLUeDM+%N?Eds}*H@mrAH~<*bVLXquzl<=bE+A+*t6dLo|zH_VR2;kpy&7RclUI- zwhem?fMjb$uQSPF=Wp4McYW!tydPV`Ftpgp2B__uM0%LPgu8!=v-#e2MfTn)Q}6!r ztojp2Kgm29aN2m_^OI2q{V?#(FhsHod?op<4I_=co1z z25hwBqiBThz~EQsHLl8WIs=wL;~mZ_D%mdZDDx{$#hL>71e73hr(5_hQYJeeTdg%T zNI5@;F0q&byNog#zC>|6nE-$c&QnJ_J|H*WGuHO8aDKc{&CHZ+I_mu-?_*ZAu9aBv zy3+0hS8s*T;+k!TI1+oKPo6F&pJb0fq_0SxX8TJ@zEPr(Dn6lKuya=b`T9QBGrui} z8_;aGBDL(rsPWKN7$omUt)2Fa=B<9R^ZSn|M~zn3uC9k^6p=5_D~5ahGqzWRx@Lg@ zDGY$tD!gkFmBVyoII*@I-^*4wB6(;e6>yW3dpjRtt;&kamaYL($BmV z&D%7$O|q?q$PeXp&8)bqVstL?mt?c6H(M-XwUlb{F}h3&d+blw?7SdSvi%R5x=X6k zmp(i?G&c)Q8$Cf%6u#2{wXj61`*N8uZb)g#`|zqzBw~?Uje3k*-N%X_+dYsGHY<=n zBq7&r?~EG|bcNV;jPEa2Zpcl_h!^vviyXG~zj?QT!WN*Sr(yfxf+1~o#p}@$M6F@6 zN@Q)`z22iI@=?gjE#^o}epIoK6{PMFsoOh`c@_~2RDJzJ7yzovFIn|d4&0{f7#`!R zk$F;;eNf56G1!-;CDhg|kIt(?D?WmP8^02NbcRhkuE}oLtCD}KlFY(tH#9n#`Qs&9 zcR7RLu_{*G2qj%Opo=7tVl&(D8LwcpA%K8sCDE=!I3E(6m?@c9c2Tt}fT&4rVd-H|uyFLWZz zNpW2##d3^Q1pN6SuNpI=9iA-NG%j<{ldOJF7pa5bP3Xea4)KCVH!BB!snCTd$8#GC zBQ6WENC5kN>D7MX!}0mujE5`!+Ta3qG1b6YXYP`R?DIB_^erD!UvK$I54_sgx)O-_ z+4HQ%vi!w{K*_tY7f(bn@P@gy2t~fzYfmOpUXj8_rN>I6;q>17cm;~yZt+-wo%ciS zXg3~WRxc&rV=4WHl2@F1I{ys1Aq=|%YkBPE?N_awyx_ujA5cdRFYlzTRz-C4et(}$ ziAHqVw}PJpEC_6ym?OWw#6_B!+d{t8^aVd+o)R!ahhwa>GqcDBLleqG8xkX~)W2HC zUAR!cztBVZSzeDKtjLcWB|C_Q%{^g_AKvXnReF3wj7ssc=p|2&`$Ppo37&%Qh#^3p+AqasR!P3h$086XyD+JK@y)0(=mbeOPR zjmGInoVR4vn%Lp9QZ5Sj-tzH`j4-U-E(BySdt`l=Hq~ztq*^P&uvz6@n%_}!;A_c} zIHX+!qA42%n~H&-3R*22BbUA;Ly!sUVlTV zZ^REQ9W;{pb#k$L6m#dFB&}wb!JmZ2%~oYn&kOe9yKbZ>YdrYAE0hlZPTEGPYy}D& zZH+@Y{*_z#!nBb+ECm0h%X@z@%$y%dtPKHyWOLVUm^lyr{c$qW+TTxM|2tnK|Cdt_ z|9fKKmrVXYf}z(@AJw8j)>?aiUn?7JbjmpJETq6!D)6M={XJ4KP7UYZH5(iboD=s3preRO`*=FXt zU7n($Nqqgw>uCpv2+7kd)u~Toud$7PaL)%JSN$VbfVlw!3#dwX+{53zNUT?u)QaH~ z%z05H%R*Oertq6j+68Xf;K=qr=rz$Wb_8dN!0mVn{$ufq15 ziGntn*qdWX(aXXyXzjtK-Sv29b1VN+6~6Zk?U}{;w!_lL9q967p1k(;2qABu)=B5f zmeVr6=$kDg%C3O0+xf?*?UZc(rhe(1Oin0dk37}yOp)1Bzmpxg2Ip)~$Oo?l&guN| z)zv)9E?=z{Hns zOS|^VqLoZ8X>OX}o52tU)aTQ`|1Ln0&G17c+b`uQEwlOWrjEfj@(y13Oo@UJBQv>_ zVf%=(0@mmj&jvC3*v4_#RsSF^Gzdl+eOVwSeY)G``SqB`Yqpv9EJK^D%}2)W{q1)J zGH%}r0Q+9N#>P*xE&H z>Z#Q0WqbFeoRnoCZ^P>vou{Bw7Eag}Q&iY6BKnHFOd4e{+a|{Sf+CpaL*+I>%n!2F zo4Jz@x#F9<#BFSRsP^YSFFO)YtyIB|TdjP&x3U6k_|F5kxU<_XIsN0q>c$W_%tShC zc*T^&xCiT)uU@^Hfm6sdUvjSaA6T|OU;Wf&c3sRV3KS_a_9K#wb%gP}q=|p%aya!U z0G}gxd&u`^dDR!f`H$cXB>sgbI?>3e#E;Va=5zkowJU7d)@a7u9Aa-(a?oA4D>0)< z=6h6A2}bY-lk&k<(QH z%MJ=24wIO2Xr$Y9mvdCITiPvMpNLxbGk=<(h)2NzBFQGNI|-Z?_A zf6Dx6XG+)^BZDQh+DUsqksS?Pu%~^Gj>pI1>TSmydd_aj2VeN;lKG;iQ0&kE#d_kK zz(6Hp)gG*Vd42|Ef4sF=a=f*fLo_^GG)s@sFLZ*vh@KVI>H`5+8*heAUXQy}*Rhz4 zubzD-h45H4-fsA}yMZGwW_Gb%Z)jul*0*{ezCQWU539VtaxDl7s<`+G+TQ$esdK$? z#qSD^T>a`eWM~)CH5t}g{e!I-KQ~<~Siiu_x$+Yj()(o(0ZO@hycedpkCgw)6P;c*E;Ci)RDhCB17S1*Y!4yamL zPxrd|zBsJA$-;%KZVUls@7s?&PAdX*uKK@Fy`nOH6OvCYk95`#4_4)RR1qTf*fy{- zv)e-x*juO66^*pN621jzht*+Mepy;{s8&g|7sE_V8ttKnBSSb`R^OQ-i-=5t%}NHh z?HYl5{Vc99+j1AK{Z-S*_1Jf?I|;~)`K1p#_-B^!cBD70KOcw{qU}H(2(Bx%W=hG6 zalpRMsBZWoP7m6@ljs4jCzlzHe3^LN`j^6Qref-Zv&5pp1|$&-U@qRw^U#_W!mkIh z&e?2mq~t~RF1mBtdwJ%dtQ`FCSM3KbSOmtp`VO&v)Ou|u>dTIg%cYk`OP*X74L=e( zE$%3}UY2`E^CT;6`zI{>^LuO$Zfzx;AMzJyjR#l6&d7D~YS5kws;xW6zck9-4jl#`Zo(eQ9 z-Wwi$fHqfuGyYSqa41YMldRj)qt|sd;)l+yAOSz8$}`P_`seP&#~deL>>`fEg|Ei- zaHm2v*E43=Qwl=NS>DVw7KBJMG`iF(!0>Z|v(t6Nmk8rx^HVJAN%S zd}aIJx}fj(W>4GSg6_1P8fbb-yufwDa%j_jOT{uI{}XqR%po>+Bi{b~xB2r=Z|ANS z&<3$y)*Sb$ENyd=3#8$+Z#4oqUQ>jqG4P!){J9@0#(Y4}flEwEKuRy;BzbbFR*tmc0ySVQU_H z1A6GwFMU-!2j`H-btOQgf!3-PGsaNW*T8d%ayZy>J$iFzObS_o@r8bXsqJAlLA&VT z4BzSA6rr>@H}$;7$HyH{+1sh_9XNI$$+ovj}0;fBhx0gV%8zzeLsr& zbu7D26-dZ^=4(C)l@Z{Ng1)_l^yK=GAI?ROtwY>khDsObvp+AS+o_f>4)^Y`YDB*n zzO@0|Q%ln;SZy{BWNMH@@RNnV(Vyo%LgXFMtJCy8ipKcKc}m|}R z<-(#BAC;m4KNY_cO+tUWlGgUe6cLjyn<#+ed~_j)OTY>*8~#7odkd$yy6#=Dakt<>8VDLJxVr_H;O-JUxVsbF z-66QUySux)yEC2ld%wBA`v*+TovPVY)T!z|=k%7fmptoPn+={PEyXog>f-hnQqPA5 zICiJ-S__>YI4u*r2pnch)fnt|96d#LE@)CCoU+7yR?fv1u+~CK@Kqku%@YR!7rT=kSMpa7-(3&9VoOb53xwcim z3D_m8_p~~cHKDHO|}m?Z|uLN$Rp`8pWdMB$*ceP!!mAQt>@tJJX5#x zqN_7-Z`y0Z9UY>>(w9|~i;!c(87!9-q`I8ot{S_WWnMOLb&$`>9!gyMRI?Er6I3GmKHcsFkV2pkcr~EjN-uu+MgIimeZ6{M!`vTOgh%k$q?}!Y z{iInj$i^_cpw)lVJ$%teWwpWexIg0YD7K}_ykU;Tz3|yX32ffWfu@~x5@n#@$;R|h z!z>ic{xjpA6J1X{y$7C->ZPUo!}(`!H)ddLSb2Bic{74eb1`h}P2~1cO3T%nHGL;` z``f2-O-B=T`fCCfUiK;P^kzOofeHf0mg~%~orJgDR*4dx{wJE#FWPrOewWKinRlV@ zg2xF}D%~5?;9mJ!botW&+1tCtLiN}9<_Xw&i}~}~sFk9hZutdh(=YMw3I3LI?evF* zSt>8>dOCT$x6lqRG!iK+@Y+#=VAv{{{R;;da6&iJh-+P}Mr%y!kTO*s5g9Tq{Cs>H?KX5ZE{%M=1SJ$-=gO zSz`6g-Z1(c0&?-_PXP&8XF9_K*xxZsu zE>Y4ahc72nSqumQlsIIDj9KGVWF;SA?d~F^N}JqF8Ob=`c>x%PB%CaP@pk>-Q&4qA z*H4qLo@qwwz)m{D97-#%gPcP_-G%nZaBHX)hLbgXZo9U4gnmC$H*Crgt{L~}O*ER* zVf}lKDJtP1-j0(31;bnfZJ260l_7~7 zOhAq>onG8bFdIkSoI2xb3X+`|x2U5hh;empyv)#>8d2j2-51$*KMKdQ$hKO(U|{pf zBy-YS!Q%tl+*Qz&nCUsV#Keyef{}oi5a%x5nvO`59AWIr4A;Uj{dDU;+@eR@SM$|I zFkFPDAhXz1HW>AhS}tR1#v4Iyn6vA?W->m(4865oHein{;Py$pK$;!ouU4HIjassh z`>B3LaWMGvlK{7ld}nK4X7x&wyne&7)nWGPmSO9u?EUn%Nr58*q(Xu_2+~4gz_X4n znt74y2R0U%51l!~!(rU25Fk_^vpl)3Ua0hd!fK}%{v%}1?*)}(>;tMfTnFc8vzm!& z7ZB+;O!9$XwMeX&me+1mSN5t7=l)xfPDsC|4@GuH1}^QDSy|UIBH@PIndyO%%7zB+ z3k^qD6yu-F%`cr>p_uP=cXn7*TcmI2MY*+q_!w?TxS16{A-n~@5VJ2G6a|l^60E-uymq`=?VDe32b4cXlM0x#jJb35(zWE zuXsYK_?a8>Xp+*>E{hyPke}0R@8$~++0W2(e9IVdy-$r1J8d2iodLPuFnu?RERJ20 zy%}K{S}vntzK&h=xL0a3!sp9DSLPtl^W*MHVAComh^M=580<ybFzqaMP*YsIH(qCJqI{e_{KIn!a{haw%hP zr9H6(Ox1kc`#byqu*pUz^RL~E;90`9NF46$!!2Zd@H2Yz(k#Ks52B{j4 z2i%^fxH!WD7#pVo3;!BqPfh_>#vhlE260!eIXg!-wfOnf71AZO0`^x9zREf8nXZM> z`R^|Z^*GPaS;k^R0=~%3bpMQ60=dvrQa%33h5l4THoz+V~8>J%D6zv_T6wg&j zCRF_~@7V0fze8_(BdmW}xrsEU`XhI$RYFnlm~`eI<*^&hJ>TL}xkR>t#(cOqtW=2Z z-nkc1e9c#aKt69mBsuFo?JMxb$3~2_^{?9eVsNH>kqz%=)olkG-Hl7y&TZPx*6rZV zCoZ;G1fBH@k(<9NT1yuY%&zK!>Dmt<(wHNAZcnG8yLn*3-b` zo=Vy3vvDidHHRJa8O3_^aDe6VSZ>}%c6$AMO6v*v8Bi#Td22uWea~bbM(ND4yD)=D zfvzVeCJQ?Q8n1Z2#B+#%W!VwCW$PC_cs@(h!P z>%m}t6>^EsRu%V@qK?PGF~WVy^oT^se%$^pN3N!<(!MI=8-Os9nVrpW#;m$NPrx&W zGjqH1LE!P?Odz(|Fq+@M(xT(M(^f3+&1tH zE6sK8p3^6wZi!4^23thFTSnJ2J)gR+) zp(Aq6?F0@*t6Ev+gl04rRi<`$b4h&lpFe1l7R%2^Vuox=D7tIE5ei~g9-F56wM-y9wPX^Exi~RX=w%wcL{AN90kmy=PZ51M6?h)n8 zBY{^&fGs)wE8Jjd@A#rZar_Tw=-+mU9R8u=Mw-_sre< zk1`;=iOEie`48IFG(U6tq5j^tH|H^hQuen%4)1mtypKmLo4&Ejb$6(7OxmieNM{6< zP2-EPM!{O|@%lQADyLx!=e8OKk=yqZ>#fWm#s*z=*9eL0-V-{ubocFTXgNs_bqH9S z>T@0RZCk&jy0q;r!#v&t&F?Ng(8Zu1;y$PfE0!XySC#y9*y_KyWuPO^959i0ZlwjC z-iy9A@6);WY;YT@F?FRQd6UD!QwrQy>R}W=k>*7v2)<0YV+i1Oo(rkq*o=Rt6UoUp zW9qgM{HSUL$D5r0onYF6kd;ZD&AxF=Bd<5xq?j+_I6i6ES)!gxwL>Cd!*(m64Q3IH zv`xUYD`ne-1Xttnn-D^aNOL9edJNTJ-aSQ?1G+CCvohdh^Hcnp*^ww-t=bMrJ@^?K zjbn>FSzz9clo#?5A2w3^h$WuH5Bi0Lg9N6+iby90bT{{J23F?wg4y&_{pN$7@l031JBxD zq)*NDazZGV!IjzO^iXeSMSAQpb~A;!QPMm`m$yfzQgib-)SdPMdvn$l*= zlThh7BQ=O^CZ^qg3MVyoe^G1JZ*$fFKmg7XCi+_{fX6?_grs;@u@d?oQYneCCLA(e znw+7Auh~2DIPquTE3{b;K~3SAYvlXmf|jTfg<4NJ;uqjz=tDX3j3hOVch+h{;sZ}y zRy!rWNRf{gwF9NJVqn^~iiTi7_3Mn;C>>kEiugHq6gleLcxHa;_vo|Yn|h=3 ziseio<;DyZr7wl5(L3~L#Q?|B)(P1bQ>X?htNA?<%j+S%mxv_CNwhK8!c;x|ub(wL zZ@1`-P`$_jHDWGvBcv3ZQJ#h=RlpQ3`8EiEYgARP(!)N(V+UZwgMw!|*~mR_X4>{M zX;Zn|vUygbRDVh2_gD{JLgClW_UE)JVM2QiE$s|@`-Rb}VD9LmTS;DJi(}~h`>f|9 zzvfXUB~;H?X|7-u#uZkwL_M}U8N6jQ(Jec%NoSMt^KO1Rl^XW9J-1*}L&~Ltxq_tw zcq#;svI;^xYnlOCWjor#JOyn>f>u6D!5I}v`QkKGiKPS}cff_TJA|zJLyI#w%Fa6D zUW6pD{>&M7$C!up(Ga7iqr-S7(o{76*;ib^FVL+QxA$0CE?aav$81cVa*AiQZ@Al8 z#TB1t&SZu@xNpdALHaJ4Ql%ifoU5M9o0SS#NDny^iA;{EN)V12oQRjnEQSQWW@+Qn znzSV+kpNlMPKWRH5wj{fDF0;+$q6LkC!$&Fv~Aeu-Mly`7wzTWyy3%>AO`^67{Vw` z#L}xrJ|pW;8$>6+xs2Jju1sG1|z%752M_fsR5|v1kksM-GvbB_SD=<7~4 zkk0%iw~#gGE*rQ54UdMDX?pLXwR&pT=TGl}i}31XaQDHw9SAdw4!H{RC0tf{RCEFt zaD6Utk76Z)<^6uABeX&71@R5w4wz>F!td$y67Y54O|-kCOIRmCZo<}oa29=CQ3!Mc zLVI4_I=%}OI3S$Ne=*x!JJ%Lu`l-PnK#13@nW*$SX)-M z8|j>dzdlWq!QwmK5gCZF%XELQ-tmE?Aw{Ijx67acn?xj)GR58P4f+Rs>DLjRDQJXd zBLvS9uQqcR|4L9JiQ2keSBy!m6F2-5L(7@}8-+AoC>?iHqjGziA(#N@aC7E$S>a_* z66I%LR7M($tmshPD$LaadQkpu;qHRb8BQb^(OgBOio(!O;CI;w{xl+}n@@=$UOmDc z*!DS}yTpZm*qwpXxBj|!;nZ~P@wiMe%Dh+#9%wl4Yf{lHbMcz!AIOajZub};Gqard zvqgiU>Gp+A@;OkBj;`fO9V0D1f|ZhG$lxw7|C)pgDOQPmzY|fO$EI#uL26!rxIei7!}>pcq9Pr+Mj$2YKIM;oL{8!3LMb_RF1jp2jNg-lGM6Fc+E&J#oSbK zoHSs1LQJ&y5VSBq!Ii2!Y)2>K^~D8mYXnYb7xEKvC%BsOqOxm8P;JxvSfC(O-=@(@ zBe=}6MXvi|+Si?SQs1fsf?icOj~nXtsPcRoe|3@bc$!eUk?=86K`rHT?zd>a$Y~%8 zw+F}go+>9)6;vrBXQa-bFuTQ}$_+Q-EbDc3MC+falhZ2Mbb zqL0dj_KgmZuhM@M;*7oP%&WE-|iXMEh_ghZ5a6L4dB0 zGIEA~a0DZ~WsKZSCHA=Gi?%Ln-_!3>OOT(UL5-5!h!R7|l)TwUN=7@tj$KoMc9xlt ze?zoL2Qz`rZA8nLU6Sy~CiUV*yw=Ek-f`>Z!Z;!_1qtxT+zfu+E1~bcZYk)0l8yI3 z2Eg!j=>hV0M2#~FW9e|hk*@#C1@Pw8yti=2XSv?ZeOSvvij)*^GW#?&u@hPJ=MO`A z-0dwhROZLBUn7S(ZN?MCx62`lE9{S5bi_>*XJbn&E6+>w$JU}G4@ULZqS_X@ps$d# zRC5te3Y(4772-H3uGDDMOSI)7=SezHsoC{TsOyK#d2lQ}4s@p5(*j-=Yc5dzfL~R3 zbS5|sbQR?M>)RFK+l7st|yg? zK`R4Qxp`3Lo4i%!nw*B5 z=RI2|GaC!pw?|mf%*l?HOZ9s?#q4RMaBZo){f;n>Aa5b0p5`Sy9H4RFgIr;dWNSZl zZvMe?AIkGql)QWOOmpgb?p<$LToqwcS_b*da`u;-uw11Lq9q(P7Tr_WrtV(dM-ZOj zNI8|3PNhp;Cw=G3HX!+Nf&ZH<<;trS5)<=DyyH<^MB$@cGanBfW<}{`<9B{DhgaT^ z)!a$_{0B+*`@H3h1W;8il9XqFEd4~`zC!M1CFkr1wFePdVQ;3!pfeBL&cnj+MZn>M zg3LL`lE?FgDA)y1%o!CT_I-ZG88=sscQHvXROajxU1CH}q=&7|=+72s%g~jf&7wOO5RaELiJN}3#I-bE8OG?W;4Hg* zBzb?^`fTLd3fNxrRU-Y;I;I4%MTlqdSXB`l6bIEcVAhU=zSor+cw&M}l$q!6O4dTx z*CRL2V27S1=0az;f-5$kR*I$W_|xZEtRp4XAQL7MI21SUMx>wuTI!)2%HVyT4?~G* zbCzW_Fu{2#G&3-MgyFMXo>_Pg{0Q-Fb#3HPT09Lc+W?_D6Gsy5(9P`$jpfXtx#a$> zz7mb6#m~nwK*75&8s!*EmhS~F{ zo9yFVDcE-oC@)BnH3@5sXwekCevbKc&3lL?aeuSYn+40tJ3ICN1i~AQD3no5cN2cc zIFiB+P-SUM%2I7JfrER?24$+%&g!Q?tu{&wZc%*8ho@vy*Gf#>V*^@unw8RbBSt%@ z-5gjL`!j};Dtf+k*QY^4BUE|Uz6y`^z~6Ip79je`dX)dS(YnbNmCeTn6(aS%+Z^I` zLa;&6kQS^+!jgW72cA%QK5btP?4$9R_71(B2dv!tH~Jmyj#8;3aoG|tuboIfkP;xl z7O5*s=`dREcreM?U4s~$d@T$6LCx(mSE63^?U{|Uj=_)Yh!ABIKkUBMpx6`jt!?3V ziE#3nFGF>0`OuU|xPhha(00hQs$vb}8@tSGCf2edBW{J&asPDFF@q}kJh$&I#%|Wz zGuT*DoO(#Kd+8!6)JyIeLzziA1L0Z2Ik4Y%s(H{tP}6Jo>YUbhvxS?B^!&Op_xkC73W$>>F1rm zsgUx%NQnhwMN0HGQSrL@=xVLZ?8D}bFNqMN7%%8 z{2N>vat)_?78$LOd{^t?D2GkwY_@iq1g3Ggsh7`5R#~mIuU*<3@xv zoz3>Jk)Ee?Z;L%@8;e5)w|WGp{GL z*$z7_a;JB&NS^DUxcRHCq#E1D2ES23`bI?DM`B(VN(8Zi{Kkl)2Q)Kq#{I&!sD3jG zn(|`J03GS8ov9$}0fNjI^7dZ>Up(&>aq8U&d#t}!bT39*k)WZW{gU%sGhKbE$xUi0 z#~V9$m#Tc8@>p}$wF4q!rv+U6mb=7fhl4m2Z*c@`RSioyFu$C?0oc%$e;aY#xB=ts zGmq;iFg-BcE4bIT5Nr1E2=2( zt?p^#A9s#>eM!6;`*;HTN{1Wv)@A!RA;K0uNE##jrJyg8-w#O%tRM*;v~DEf4I2a~ z2fzLBfZ)OXgR`tRdn{jaWuYn=esX6dhXJB1xj z_?{iddZmjT2pc*L_%nB8S|Bo@sKUC)(nzytBOUu2pf_MnD>O9J$Fhuc0fb=B^Gzl1_ilOYItuf>k}J}r zaDS^ox7D*M_!$C*4+reL*ZSx_D}(5CG0`6=`ym&@rY{ZM3E%|H_rDD(C`0IRCs3%7 zh1**QqH{5g>6>_Y^tIjv#iA2FI};cBMhXWQ%KLzS?Pw39Dq}J8{3P0YHNEZ_7bPgE$0jy8kxt|M_M# zI1qj7zuyQ8lm2fVjt2by5B|R}In1iGo{Gz7m(Vjc&7cgiTRxEXNR8mXvVfLvI{Tf? zTSf~+;>dsorIJ6h2ioH`W2f`_|D4r8>^6S@w4?q+M2cQF|K?8KY*GG6AD<{DivTel8wLFqnQE(Xy;a~G%YcQ;anEybP3aTdO?iB5KGJN}7m+R|jb zZL%fExf!11n`&qHauMX&Bz%ytRd8c8J^#FNYgt%jHGDB%&e*DUlisZ_ zu?{O0p9PeR{PtHNtafylN?ajOvs;;)zQRtEEyffkY*ts7X-hi9`P_kW&8i4weoH%M znQAg|K8p_`Q8|hH{m$~lmAAx$Fha`vpcBF!XS3ljqT`{lTfZ{;yu2uzvOt^eH(lM( z=QwJZ-kiWgnhBvo@w4NQtK=L8Va08axT|WC04RA7KAW-f$sx4Wv*#D6r*0q;)v?E1 z25NNB?8xB3sO9qlGZ)E)SlR~15jVOAuy&y9cq3VbP{O@6~14nTC zjpa?!Y4AY_N%PKefrPm#j`T_v$W6ARP%JM15-XmCa*E=PA372&B{f31nARd(=CQlO z?Bgclf?nJ7ITjx{604$%K5k>56-u#1@f}g{or4~`M=_127?S(=w_|;3U%p9zMm$A= zhsJ4O;c#G}w*uYZFrzZNTs^1YTbw=dU}Zi)B69^_}o?q_1^z!qN8v%(R)54&GF zEin>2$oeKAtKfqw$Xj^CsNDi%sRZVaxHQ}E89XANJI3lX+j#)_c{bg6FRhB?8B%)i z5z;r8{66LRBi`fsDB?#I9?P-Ot{r)66P4pQj%Q-n*1aN}r$#PP?=xp7`J+C^&stfq zUY-Vw;Rn-qs;4mN|A?AUIG8;rsNQvf`1H1qwgl`u8N}(m1jpl1C!#dJd>;dZ%->Aq zjTs2-mq|nr34FNErbc8pVUI(~W^5+lhc6aqnex--I(6LRlaG>BXKfBQBfi6Wq@Fve z&Q-vii@#TDc+XO)`r08}yiG?+Whipr6Fn5w(&Xn*9TXl5dXu5CN zXW8;}L7RODDX?;9kf4r1di@+A?+u?is#rCBecluD^>-jFp9WE)0>Dl>NfHD^4BrT%He?+QX`7s^YJ2CZd2kGt5X8dtXwv z(ij7J#o|{9`Lu26$X+nTz5dQuQfp@pIrLDSbD?G*1*nOrS;%NlKMN?ADV0)?e?M>D zC?6Bv3cffA-IX1_ynqQEdcCv3O*xMJS})So~iTz>4A$uhdgoPcTmKAQ85#w_M_iMY%n3Sc6IdyG9Z``)v~yzqKI@M07!&f zj^nVz81TdxF~07E4j4@!&yviIg_IVX5*EkYq~THCEb*r+^+*7?5`Q}N=Sw=evTu-e zzFc?!Q>LLguqBY<;s&vHiso^Dt8f^Tjvt5T_UYh`*(lAg?K8;KelEA`f|0ey)o4U+ zAC_or*1T?qmNS~U!vka?`A7ga;rbGU2sDd{Ty4!n(hyZjuD4i6!dc-oQ)8`KG4`;9 zF!19we!r3cEZ0nZT!=ml*4=G*^i%-<2SW>8Q1eIBM8IT4luL-n0_1dkCFW)M}VYzmQM ziXp~Qq_ipXwQkkAz*A^kVD?px=D(Osmq?O+-{Yt)fh(^NQq9~`KNW40jVGfsvFrEU zqdl~$={lNCP*_~ZhkS+X;*+L={?j&Jqs~Ix|J+TDrOy@f&OnlS_Ip<7<%o%<6q+Dk# zrYT)GrtYudb;FE9B$Kc8$fO(p?jeyRh7NF6jvs1ji5Qo$&m@`$j7aWSiORiYAC?m1 zlh}#i^2;Ps7b@C5(n->mq>Uj8nxXJo$x*d&Ir7gES~E)$%65&&<)&E^0nH?tSu*!S z!*H3`yS}fPYKTmSb&|M4fmua|Pllv03%PWq6LF416=ZfZJ*BlnmxjQw$loz?1Y~Y=DihqR;VBnE2mm< zM6PIxy^{TnG@Y1|$}ZC?H>_*^0#a;BzY?O82LN=42?nW_@xO+1Fc`$6b^UE!`zwTft-$thr@e;9e@MtTb!r3pmV)35Tt%+_a_2vLwT>NyvhN948|0^B2Ni8m@$Sa@KAYm~^3vS-7M zQ-2(q-C!#_;;CgB&Xx5j%9Q%f1cK7$$CLec#be9Xaehpg=yEjD7N-JlyU&Y-qGfHE z{(wR$2t+a~Zlqw|Aw6x9!B*(jd_1lHC<)=e4!_W-PlbvW_^Agnin|Np`TJ1?C_mWd z%+`U5ZTU)v^%R4YL(Nk4gOWCSfK1dM)>I6z4(fK03-(p*cDpk48$kGgpMd%wJ z3RL|!RyLMwYJ9gfhMthieR5`pfH6Odh|iG4kX_4)@E01ikP)f5imCQ;)njW(sGKc|qUkICfY>4uQES7D z36NV3b6`q7>|hJ*`5`gQ;#el1hPprr4Ig`%qT};IHAyGDSvGo*O$rge!BcH!z`7OW zj0^dha&meisQRX5ag{qg11Oxxo0YA?yYt1f;-$!8QyT?tMtLzI;XeM6W&hXo=k)_P zk*Z|3NFL}xG_o7rkyoyD)dvIjlad?T9pB8&2>>#iJ9Zf1ny=7M>9o8bKc?Klr#J#L z5W!hSDUQ4zeYT&4`h*z96HmBqXs0dl)1IieSgacEtppiO?O2&_Sy%4bf+@d5`c&C0 zONEdh=U}D^0AzCi!^IXJ1gwYe(nLOUAH(6~4R)-m}24!t}%TTNpD0J3|d-B=^B{)zOiHU;C>zOSHdkvGZ zhGL&sorPIC{4SN%J+1{lJp5N5^v0Z4r#TG%EZtplP0^!pWO~pdBB_Aet0+U=FSu++;KWgNa!(|230MD*$RALwdfX4YA-lEvV}86%>s}d!1(sL zW_<);jM;fiO;Mrl^TKWOm~!Xj{XkgkKm>H;ZA{r$K;{foBqu`K;_qiU-d4xE_GLLt zSX^+8zg(fYfb5XZn29;v%0b`k>#|mkHx-;RW++N$Xv>%YAMQbWG_xSf30~wsVkBmP zAoD1A6l%=5g@8e%+aPq#X*Mk!3(fgA(OfDvsl{DX2!qd*c3F#w$csu@hQu-r2Wa^P zjuYXdxPu#CzF1YQM4Uw(wjHGm8QCUqjzZzy{EMUCK%dDFOG8a`I%^pV^6XP9&~m}u z9wzUa)>tQBzX4&K69xSJ$)+)0y7-xDxgPacdcLXx9qIA`$ZW*w>o;f0A zaQEclC(v zZr(^e+z&sf`LpfL|B-54B1mNT+R7~3ISI0R|3C&gGeUo%!f^X9hqD;B%lR~_@@psi zbB%W=A7R@U75xwRv7$K+m&*{8-|LyX%)TDheUU@0ARVY=g?2>gJ&6AU@^rNhfAvvA z3H+;bg!B47(J?df;s<>^>_o$7K}Z)lq?ljI{KOpzGJIQg%h z4i1hPK(zlak^#Dc8UGJh1O#3{r2lKnL6`5|VE@~#(EsZ#!NHI?{QnuN}JZ8AB?`NB^lZq990vRLIPG)g;$@xtYtBC!G1&{>pE-+ zw{p@u<>BRix%2q(XPWg-83ILG=z!0^GddjtW-n3GvAvX!qN@dSImPGmaalUBrXq21 zOX!T=p>-wgzPE^IR<{qJdQZO3Z)HgVy)W~J)_tXwS9jIZ=nSg=YGYyh zW6(-XpRz~1e}Vb1Uiu}q%nY=SO!lSvvD;7})kRj`P^EW(=-lpXboxciE-EDX@p*V+ zd*UW@U}{I)N&zEIbAFuYd5CB=NVM~ooyGAUPbck1@F3{W$XU6=egr+;5Cc>;Fme!H z|2~wI(k`0b|7)wA5BogY3i@BEOutlxNDt&E|23ZB%b+&oPL5zu5H6qqWRO263?n-n zK+u@3WcqDun;JlPrCf># zZd6Z0v`YVAiNcsrhfLSQ?fN~`spqx!_#HQiT?TR@zi#V zgMvmr_Rx(+)40?MOrY)F|A6bilNf=+U-)C?x|XNaKss^C?67~DNLTA$J0Gx!H02m>@VZ5*wIQec35AWbcO zX5gP;R-NMnA=1ycO!ZAu8(&{bQ<^)p+obN6 zo4;itd_Dik>CGiUK~k;B!jWqX9K{^N`%NazS# zbZR9$F#$|@Q-L1&)xjC;3YY<#GmM?yjYZ>_T&~I{(1=wVND~y^|2_a_?6Xrl>jdoV zb_l8x<#_+Ka=vIYiAoyy)2lKc-E&vpaZ4{tTu0%6sJ2Zit(2*8k5@%q@j-}i_;A@m~03(N0`0)8-HBuz-rj0;^ z21?{Vy4GIZ01lh858wY|Py4j`w=$GV%a!vCU|3>cK)c0)F@tKXcX)wo3XH!vq!cMG z-isB+DCoJ$q2cx-0%@S~mmu=;T-P{9z@k;nay^Yjq$exzA>J4~$XjHg4}9#|Qhx-E zhC42VW#NzCRFlmHAC@HY-L|cCatc_MO)GihTGbYg^3Qte#6|{pW$8&BK*4y8UW+9F z;bXN-%UuvTBg7c)pxeU%D{DQdG0!uY07j{WVt11lp>CXu6~Dh*NNusai8uIm&_!$|gqa=hA<(P8tyGRCQzipSPiLWPBnSRH$XnG|wG5l2@_zfn zV>PYg-CA+on;B~ASgo&5KK#vlA7cL{pS6xs(rtzx&R5&AEN#dQ7%$KL(k9zG{#rt`YyI_c=44LCz`sP{7N3 z<7b~f*9-9& z@P>iS4G&c3HlR^Hh_ZHG8y8S@H75{UD+;_#jkpy4gNu@g6x|1;2V?O&0zSNLal?-~SrL1;-q z9yk`77?SyuU@NB4QS2{C7fN1qB0kXi;6oS7`g@qd1b1WN8qE+`t`(q7R@T?Fe|`!BRAhS)ose~ge$dT7oFmhvN+4C+6eZ%&wB&0i0_3G z=Q{-us>R8awLk3A@>5v{$@Ic(3-jRmfO1S0_Td*u(&Fp}UB$shOc5y)FqZ@wN z4xwV^#v16U3I0x0=ZpSnU9VPI)c@GUDKlR(P18Zc^w=OCA2QWXQSWb4d??$Gg^WIt z4Oy*VgF{@{Q^RvEH7rWuFcjG5C%nDK4hnKC+v5YXF08d*!Ud(@c4;hh=wM(EF!bFD z6*CO7uh-8wij)`lJ1iKr+uG1)76|x7W79G$@xtz>4Jf5J+gL(8n)t9q-jy+mkCPJP zWrTYb5*$JN=L_frvy&{)2fZb>yetkGNYS=ugK`fG{`j@@!0u0McGXp+?A|dG~iXzVWI)wdU_x z_NOA$SD6Bxq#O``za?F|A!er@fcJYYDKzWJsZVdNtxjU{B>J?@(KOB zRSFxzzmtB#JrbS#lLz%a49t00-+SC9UDFu&2;u4Qgye(Q@q6iT_(I2{;`OmF&CT)Q zf&t2s(Giy4e~M0E&fY)nR{VKTSTMB_s`mZb81SzrGxbduniI*#k=tRzo!jWy6T98( z!H)c5NsgKMHwg)K930C9Fk_SBzjud#G6@nj`i&<-Hj(yB!IV%iTVDTYhZ#P3n*ZJ; z4nm_yNMeSI{E6q3fCbaE{|-SIKhgcKWf1;`llLf$s!tnzdKa#m2m1VIT2rvjuy?I z=)$k#cVd?Va7;M>81!PwcYW;dI&9mqRseQy+4tGt!BY5nAy5pTgAUE~Z)7h+@}lF3 zb$0;>`deP#lOFIsrR@GXTN8ZSuW_go-1;o--g+k++*&qFdGU_MTmFW?Sh7GgQ-!ZK zm#CX{Z^hwE=hgxTM3SHRi#I5AA=-Z?e0ebV$P-U8bavq*m!9sB_-7n~9@5TRDl0ba zCt#yX*Oba1);pKR*+Cl+QU4TgmGoLpc3&2iI9h8Lk$(%*lOwt>o8fTtoy+h&g+OKvZhMa6cY0z%&qA~e(@@F_sF z*%VG!EV^tI0Q3(sb49bh=1^dzLFcjTjV&9v3%X4&#uQ#v(bBV8@(_zw)^3lW&ER_! z9HPJqj)|8PRGCpw_?SXc(}!;L2@7WM-LEsfI2g+^ilbgkIM`|#PAr>O)ZM2nJv2YG zwLfrLTNGn-PxT)+oz2qW_pFQL!qg(2fEklcX+`1BESpQo_B76=QRW+CEM;#HAAO=*jYdBEu4km(LbI!z9YNP*6U;( zX|ld7W~Nr@J4_Yuy1Ov5Ii@2gH$6y;m-!?8fa~d~mCtrfazn5Fgqm3{`XrY|_eNd@ z&Y_Q|>M)MeY4newd1>49I|(Cvc3ydsXAR4nh#`iu2D01rOP1FGzTSS&@Dn345@yq* z<7oCTb3&OmdBS_G@%TK%?58WZtoSfP{Fl^_|BJb|42o;(_I{H9A%psg6tgo8%khw<4{m-|JlB8sv;QEK% zMzltoK4sZCJhkKY4S8x^HKu?x68YaQ&t`<;3VeJEOaH*z5SG#>xK-v-)2OeuE|PWj zjHG3w*_HWIC+0jaU3o$Rq|{(vuMHt=e}%J->6q+7_{59=CpSSj^98D!29c?3;%)i##U_6NLxXo4nE0fzx~&}6V1Atj3y5k%nq;>_4isjMb(!sN_@o80r02{<&5$)4WIIITGf~MSA+8l?$fhm6S zvbSFdrEGT>vtwXVXq!cjz1%@BBEuti=_&!g&uycX;e9;$Eu+~3n#vVHWy}1Y8{w#` z*QptBsDzPVxBLsXSj#7~flqzKM2F}ygan=tSnPJ3aTnt-{ZU{fHzmQr))(xDu(54; zK>6aA-~uz?LnK|>i*vpVEXCUR)cSh&x~xUKHf28wQU9Rf`_NvsaxPg`78-JH{8y27 z1b8$9H{gNYCtD((7}2#k?#o&r{1#jvpeI*^s2SVL2Y~;Le#z(7QC{hLPL%RhK0b)z zP`?oMofhr&-dfJg*`LAk{d#x= zX)x;Ne-D{<-k{m4F5h^Q64|o0B+@SsgY)1&NaoER?s_xc>44>s-L47VX3Z>*Emz8* z^5Nu_Hqpa_WuNG0+Rvya|4~S4!Uf)BI(02g?VawA#;CVMi!t7-Ha2Fk*x%UqnB{d| zc1Yz#KjNsXddPE4F3E?@0JG=@c)6maf%N*O!d@Cr zhTph2E8~x!{rF0o?P&UtLXE>2a7vRSLlijqw!%#bVW5h8ob+aVCrrAEqf;@`eA$0b z0HqRt*wN)mv8FD8VOp!@8TMvAGV9T_&9F9X6pp6$Vj-+u(J~CWdr-+xy&6dv8&vGDq7$ws9DU2`gwPdoOpV@cIT6e70TWJR_f4PDx%o zjY;S>q5zzLGMX4qs^YCuiI$t1d(eUK!+xk6-UpW$r&_dYNDCA&M=fJ@;)~tkAV6 zrqn;dFUQO^^4?7{bSd8@uF*s1j)rt){{rAVZxtqUrtV$yGSmNxLgoB%zWzF9wv8EXS}{ z{^=bErE~wPrP0h1UTl4N+(V29$LVO5uKl=!`ehuCn`9nMY3vDH;P@3|>ZU6)&PNXT zWj?fS->cS+wWD|Am^lk3`ATz}FHIy_YsjBfq?U*G;zJWx^wo+qNe%H1Yt-6eL;)e zf6w3fwstgGNP||m+M&C4)Qpa>0?0UWD*yc&p>#SjX1K{be{WQ_8Y?2Jg{EkJ?CK6B zV6lz>iG!oV_zZ6@=^1&h;6qlE`TG{2+?azc-#F>nmb{MgC~M?b>|Gn4(m`MWL7ADJ z>}&y>CP!=smaD4Al@SF9@P)UVFM;_^8-SeT6U$6@netFN zXTTM&fm)OB3ia$q)9RiDr}8h0WyUgK7V{WA4T;K0P7!9O-CU%v!*VPOztPlI=FD2Od?qH!iMLL#6=%SZQ`;b^^=?Q?Bp0gT9g)BoDr8 zqDwE`_$kBwyMox5O>-JPCU^}8S7vQ{GbcE1KT&wvX2w6a;Mz87)5dtuL&()V9T8@w z`Zu@Ww8t;@vDQwA;FMK3ozX=?(^fRo5k65Xk8l7sN<~Y38F=_f> zzIcd4LSLYkvKn^XZ5S~&%2`@)RJVrLCYm#EHVERYWee7w#tApR+?^aN7;sSe=ywHA z|L_Fe-c2Gm_yo>Hv9b+;{yn58RAX_C?G+M!L#p3p8d=;K*`{%%%nvD?%M%c;r$OWS zz3`TG=|-2$cwe}MM9D7EslwaTq?|+Y~g@h|V z-mL+=S9l-m5~gTLc@Z&rsu9K5eRxdTUbv(zEfu9!LwOZMkJNoh1?Mg2!d*y9Jj@mv zECGGd!!fQ84+BP>hGO89U?o!Dc^l;=RxQwdDYey1T^-=30l}>7S++#ouFCk=U7Fik zS|?%j%3u6H+BV5V4#(xCcn=a5Yddx43A6Owa`Z+DcwkXQSmXEH7OTm>tRzn#=Y*15 zbggT6@Jv2wS(25r8L}Eq5#8_|iFnc5xKuNe|5yw-tI$8g)BfnHbbw4LRMbCu z*DaIu03$sgxx4b6p;5A%jWeFu_8Br^kO+cxA=H>F(-B5)ABL%LJl8WvyBSuxuMXwx z6snNgTzrhaH&&rsJ2|tjJ<~V{;+pVpHz-Xw>o~`_Ls}NG+G=}x+8yPMcHwDQu}5rJ zN$)33(b)stQ7E=p;N0=uyjj1C2)Bdji`x2emqY@3XBd_@9T5-i* zo!B20meua95zWzqvEXZ2MT?dr8l}S8Ne-9c&be38vd9NUj~Pb&1X?Y$S6L$_cIR)0 zJY(f?@L=S=SEHqoF6tN_OKBkhny(-txW!?TTIcHIfY~gM%$#N>Xs=E5k---u4vvoI zvE;ERyJUu;wKO0ppj{BLDgV+~5cW3GDm;rp!u+*KYhW)?s1pb7JCDg9LR0q|GSLV< zGmOx)HlHst68qhqI>NT<*3`^gA=JdKzTAp2KdVqAt?uOABbse|nVpqC@EHld-wEeh zRCjp2m9pe8S4G>B%pp)u?0Zz@P0=0slpuPW z!ogl+$vZZ<0uiyus#e=zRM{&E<1rtBk7KkSCP8zNkL>RujN`WY2bN0-WBFG`DTb`@ z#05%_r=FT(v6n8xfKu0B0iD+jvJ_Nv>0AMgC8w0_=XaX5`W)Cn_iiXSVP4#Y4?O#w>^C2ebcaF}0%#Ql7T~tOVC@bKh_Z8|^ob^@NCkqNhA%HQw?g!f-ew#(Kcak_X+k64n2_tUm**L=wFrHo-t$OfA zWFMSkIoWY0Th0Ba^4kO?gk`J+0c)+5p-E8$)o<~ENlxlL7hz<19g%XnigJ4)q=(I) zSL|NwhAN12A{wf5BCP_;WakU}ro2`Bsx_GSU42e=osS>QAq)|EO3LHA682+5lYuh9e=evA`6TT zr_pKQn|oXds#c2veK4Cc$P+02%Q-7TlQ!)`%o69Ti5;uPDZY=0v(RGq)p#4!SX16q z5uGXmQ~)xgv;_;%zr<(x2E(d7*Lp8pBCj@4Q<#YoMsgg`nsRS2fSxC{H&@>JuL$>B z7BpLboSgYlS2ZOfZNA5G4LrdQS!^9X%{j58V#rs8VAsnkE$U0*yHo*=K|e)3r05xA zAwiTc$=xnKmA@Q^tw)5Xu%Ex5?LEa&`Y87y*3sAY*TR{R;ismKD`K7h(!r6eO^jC& zZ!bt5dMB&;Qey#ue_q$7FtZxZUeZxk z&Zde4cvY%1e@Y;EjX?4hH=bydF}rd}=sB%f$JVB*YSql`-rka+b&vUc_lquk-QhV{ zry?K~-w|1pv9~$lV|@FYwJpgF|WN>YsSuQ`408#pncUhXCmr$0x>r8)lqdv9VyHG;j9)cv)n51K{sYMUcM5Jq>3u zak|PGmnYt0#3dD25e54V!LQ)9CiIHMXUL~*Zz`lh{|VQbe}B}fsJ2#j_kqn9RY^IJLGbOF zEk~YX)egdH;|#HGv%wZq!8Nq~k)jyDvKd!G&K z()W&dfhO!$qiMJ zqxxXz)1bf*&y!~poELFix4mAKel>mrmO*Q!PiDx+b>9%e#AjmbHBLlqXjW;rgvPhS zwe+rH8r^SsjxB4ChUdGvmrh`W+2B9r53H|=`Y)eZ&X9>+8)TpQv8rsC(?Nfm_SlkW zv&EnG=M>6B_rzlNm~L!tL<0*wSQW-FHKr)#xnX>T6!Fo!5kJ+y20EwfiRs1~95`zi z&8VETm$4qpTiQbW?c z$R3UZhBKSJ!K#= z8Dd4W{XKj&gQl^$U*I5624G;`*~iesy$i{pD0N}<0q7%6*Td~0xZ}%z^bZU0LW$~S z!h@ggfoLQy$}+3|{RBUKo8DD{Xc7Bb-d$(dNs@bLrxE<^Nkf9|!Ne2Ppe~%mK;8xV=;BuT%IX|%hjvp{n zinl^ET+1pFl%e8sQ(E}TEnWw;_Ydr|d%#On!f7SbKH>9xNoP!j!_S|4hA6c}u&JdI zz@eg~J~XpIX;F6FY2+!q?*uxIRUJrmJnw$_f@|%li54bBVQl5C8o+Q4>X(MUN8eL_ zNn-S6IT=qyJ3I_IQHQ#wBzov%{i0vIXu_!?WySK$T*Es$pwm(bbRl0 z#psdT%sL+&tk2blzEp2(9a3AL3aIZ9@ERH2heXRDSo{d!NM;fZU*42pUhAyoB?cJz zx1KWg9l=?p@5Z`zrxyU$himJbPE1h}9j)G|EyvPF#7uoQjHL=l@S6F)Rj7&f)B?g? z23GhJh1yWmP>nx&nwGvc%sIp&Zlt9LLvuCB5ov$Cp+GjDt=OGMLqvWgaRLszS- zN&`WDl}VB8mbc3qmn*PQ3n8Rj4?2p*+;LStF%>!B&pMzjv^l?nvp7!O?{fnMCG%2S zY~rNAeLJpMxT6U+eSp0!{~9gaYsFJakP;<))uoi%u1ABPLniz4lV=2iXhy=KXof{t z^Nlr@3SG_<&?50g-Z^7o`g3$}ipGdY{`xH9o@XfH-YYhH`(5Ye$66#EVG0)KtzJun znV<6n-zLVy!~$6ysZzP!J}}9|FS$Q&NPM2(jZT{?Z|n4e#(;Bdc6WuX>(W|{6Z3b7uQKe{nOB{iR6xEYi z&%OQ;>hANVq&lk{A~)dS<`8aNf8E+)fC5kwR!2)r}T3kPj!AB$V9pD zwXct1vdt;MhQ(#X)UfSHt6f1KeY6}FLN$3DlYNi;I)0}klU(O(EQA4Cbdv&3Vt$s6(QjcbfI?B4J_tq zFDT&!eEva`14oW=?UYg)cSI&N%h+e9+DiZ^mZ>xP6lb1z%kyHOqyH=!i*}}~qCdZ< z@9fPR2S*EXU}v(Z!lJh>Sgj77gD~0EGtWF7qLR9vmTeOVgn#m}fUOA)i*U%|WSg9u z863dRo?#>A35!aTsbxn^sZ^JdYnE40lMQD7xj+secj8K4!bd`tp4w-7yYX%(#VOuG;E+#+9*Bw*I=V2d`cgdIMa*d$rfIvBgK$ z#rFz>(p`&4a%)V`6Spk(TG2)`c)^FzrwW_>Y2~X|NI+YKT+TRqbpiSBJ|*Q9PuT3R z{7RvW--G(9rU9|Z?`n&Ps;x+ZF>_3rl2X52BU%kny@y3}&&(i-_*vy*6qS5}7F zehOq&t0A=YQf~UN7KMakxjPrIALJv{N~-y zPmN*x^ZOlC*RM?GNAtZtGM##(5jTaxW?n7YOkMcAymjpC52BOO`Q?SE^U}+b?zW4} z0*Zu-sDbW6lV&M}HS7c1u~MDVVZ7R_@(Ry;w4%6uWK~XUp3_Q^6rjcxV9f(x`VhUs zpWHUBKkn~yOKTdjUyybjG9_w!DxvEVM=9vnJm$@kC7i-7oYkJSLl-=D8?;gCBGgl5 znd7a2ZL8ieEhiKe`0gbB*q?A$KTvZx{#DVk?(`D%smp6ofJ$~RmrZRNvMg%*5a_gT zs{EMQxKwX8G>)2M!@&1u7SmAdNRvK{}tG2_pe$xcUTsMBGVgn-3O~z^! z0$#gyrOwG`phQeKV&Jd`Z9a7ScqRnmvlTU1-==?mS@cN_%yaD=-oBS z$F!B#$O4?fK114(muWoM)Qod3&zK)=zNVRTE0BDDW7#5vvQ)VLHKD^Z^-`6LSpiAV z!G0>4lSe2ZR%lAJ_tR_`ib%o|8YIVhRf(XHLv8JIqkIU3x&Bk5E53|v@8-c6s!c>A zGIB)mmLm}$I;N+Qs$_Mn=25#Xd4|KJ>RrrRRJQRv)2C!uh z;al0s+s&MF3&~lLjHAM5(_q1hng-#b1nPHP*f5~|t182lyLWd+iEW3FkN*4|G51D5 zQt!_056#v1{QS7F<_FK$F#BVM6DJlyl)Wsd*lKo^@MOkn7EnV{tuzjAU5q7Op(%(ECkI{PaRhgLef(`2 z(e&xtSe9XlZB!pPyuFP(%h|TeccS+*a7x&EGfF zb~hFS>%tDdM+B`}OCPDr zXsDR(9{UK*Fdufx>JBH5(bb{Nx(xVr2ql=#=ph9^ta7G;^wV{)vcBmre*KTx;?$44TsoCS}i(>(4kGOyv;tv@eHC{qY!TZbI*gds; zAb9kqixdmhUzJG(J}6oy;{lA`w{%)h=>?pWmAa#xO;ru*qDYuK#`jdD8IoS&b$7D8 zcBKjHubxDj{4Q0Xnc+7DG?#=;0m2F1AwQj{5!hjj_;YweI!Ki78Zk;>0Q4w2vfo*B zqB;fEkSPKiItFO2w(!`&Ch|i@1R;_9${iizlyc~B&m;ywj8(U<^}SgY z&m_Crm;s~pOM#7z@JN^<`!;RaDdmIpRD;qbhz{XKG&Gv6r3%_(Y+t`AT8S$bcat^c ztfUZlKJ;V{<%XYF`+t(`8uIesUc~liokwl)<9{|bib8k%M2jGew9Iyda(-jAU+=I) zJ~hMEECkj3s{2TldF}94C@z#I(S}E6$U|nXKR$}a$TF`HhC|g5{lk5xK!MTnODe!6YKt07I^qKd==U9}2X z>u*a$A1gvACKI5+2H>AygJt%3AoKGOwI;wjako~XVQqA4_&MeBrS!A$P>_3HF7r-& z3Xc1*%m*Uio3Zo_%c~a8xhDn_ARi32mw)FWNGM->3Y-4ED<;v67^v!=*dPD=@g>Wa z9A%Rc%pj+23q%n~F&VO&vblk?UHF99(yaXW9al&O0lk~=vCbKX&`DGoKCL8SeN4SS z%NhR!I3LVmHQ~5xm8Mr7qb%|G&J zf`SnNy~K}BvZ9>Qs@sF%#T6-f;+bi_sxl-C?z-}Ct1go#E(2SpDxd`9BRoY9W)sWk z61Vcf>|}4Lo8WM(vq<%Poi}a|sgu$~aE__FjnC&m&CbZPwA^R>2pb$tfL-HhBEtj0 z#(-MH>mss?t=QV0 zKQvWMKE=^mk-x(WtZ0r#je8Lp-KyR9A%NI{j{h_U3r&E_x_BHthDLr}G+ zDXx|69BckHE{3r(I`3$V-0qxiFO`TRi|hTX1}B zYuOArc2pMQ_Fw@^tXD61$z@OJfVMkE$MlhKkh+L0Pm!~L7py#&v}4@r60LKfw45<* zVTNl#`e$hudQC)!aa>7pT_yTXMtvtM=~YpuUoMBlCo42F^?KbUGK&uhJJU&qb6@K^ zSDd$Q3s0OEnwxD>zV4CPcS)cZuX%7mdM?Am=@ttivoTgdhxIeKLWJYP?QZYXEM#js zBad$7ptpTgWPcq!1dR!X1-BsMHFOyREWyq(Y-Vkz&qu+|BV~6o8SiFCokksMr)lP6 z&_XVYIW-yA+&r#`R#TM@774JRx=jF5B@^4lunObL*V=_!O#R3eV*65Y|zt zVJESehGW=W3&E2Sb*_NFmf1tJugmxHk}kHJ=`NYDS^y)7jjGng3#CSi0TZnxKW4%y zD4W6Ui)$6G9A$)(kmSB!$_cCY$sh^IahC{VdIF(?&hDPk+4lLlo5+$g`3Kl^ZJbZ+ zTz6K{!%L-~lm1?2TeGr{^zx1~Bnn=|e?NUrvU-8`B;jW-u--7E2Iz9W)oUc8Zd>l-nA0C*<3u;&L6F=pyH2*W_5e=cBdoyv z(}cqC_Dk}(g%15T=P)Tb3iRx!%Uh$?b2(s6F{k?e^NWZFZcoR32kz1|w_~ciBbpYk zz?2Y7;^SUxb{f!%erHoBb?bJDq@5Y^9_>eji%!n*CUKQP7mc?%TL$A@8czEss241p zUlf9R>@p%nlQWxieUc~3R2X|_4MMSA4vcT!CgP zUI_e8h&JDB_DnjE&*jz`DM7wEiU$&(T{7|M-$BCuQdr43cqm~1s(!ZpU!2CNh&0!^ z2a(3(Bhjp#{z5N-M^%EtKK1;^eiXpt8A2+-WH1e?7*7LFB%lw=chGbHz167`8ImLVp9a>uOrW~1WpP;l96z4i;}nnGLfW)l zj@al__%#_h^Xf+E{xp0Gz;Oh?3a0#YfJ{u%kJbfXdAUSckwK{ zLG^@UV~8@DDo2e}QQ91YG|4@u=E`&4xXkkW70+F_Z~VAi zYdb1XkF|5j$hq>nV+X79W`mvgykz~->r9m!w{t#zjQAH>^iL*THf8yPU%bjtd-&+b zNb`El`wY$A`pW)hAbpA0a|3;$xg>hy-OW^bPHoYgKJ@h5bu{vb5aZblW#&6D_e#1Wy+A8B%r*$tlB zcRebCUv@PWgYQ=ixP(+JiB#O7fZSlYnJkz^Ec5T1^w->xb;*>{3=P(x?msvP(pk+d zDr?j^1P&v5W**1Hu3^1?t%QvM7?|+v#J&0YjX(1lctEqa!`DRsA5~tp2CuqkgM{w) zLo~{yNOW?NxbUe6TArVuQbS!E&A@opc>Bh$eht8}+BfO;eQ6L15}*3IqSzRx@wS=p z&w0B2jkNcRGV~*Ed1=@E8g3_R80`d`GG|4=I(wU0YVU-^fm5&wQ?ZY_`S5SE%s+Mg z_m|GQh-W=uQ^z9)@B(AamU;c5pIOs7i1%#Eb%Uwp&Z~EL&+ ziN8kVpHBGu<@cNkp{i)Njcs|OMR4*n_p>ifiFs}+msh;6$wpU?Ydfm}hQ+g+vNT%K z9hTkyDgZ?6QR2-_zv~fX{C?VOcj8`(LD&6~Tsp~l60pfN{}I0Ve-`-Xrv)a{O#J`z z&37OYC@S{fh5D}p{GJ~S|D(Fls&fRvX#K17f1haipT6c3vg1E>{O7)v0tEa2-g|EX1Rcqfql)zo7y-1nuo9s8bDsWqeF6R*i4J~KGI_JwZJ{9#aaVWS71DHZak=}#Dfr))a>;>f!>3=W{8%eE02tzAr+qrVT-Plb8Y^`)DE_+WBkI35 zxK|Ie?8}bv*bG60CR@wTER->d_A`9)zs}sioBWrZ+^5=^dH|MF-!zYZZgzQ51o09J zt?U|v!7<1oLOSxl%elB*Yb^iW`zxRD_W!%@Gbp*u-JXkdE~kKANnjMCn1v4P0)t2Q zF}92kI&>G@ZyB3{%Yl{%gi^Q6jbte`c~bl4Tp!GU6j>X?sbHN3yLzMzCX*L=p}P@4 zcHmz&+6C~1!nFTif|P+mfn03PbO!W+ zD9p~K;KF~*r`~bq@=2+sapdl!j@OC8&`V9ePtF9)8O&hMDE(fxV}W3Js%BH#Y4_s+ z2YfLn?}$ldd!J)gFw!c4s>d z6FQjWjF~`5u+13$=xVn*e!qJ00n6u62Yh%lzlDoQD(C(e`zf;*LS1^*moNF5z^XKT zS@xuh`B;n1{mXJCk*+A(D%>D*S=%4l)8iG|f>xZQv$O@UU%mtQ_`URXTLI0p@fL@3 zm04LJZ$EZ6#UTolmkgy;4xm7VAWI*tH&k(U;M#l2GXn)w4(so)e9~_zPbd*)h_}n` zfZKA1WAzsa&>bswq!L+9NCJ>8k3NXQHcyxwKOOKsJFZH3n%uhXm3hU+!_gL|Dh|kb z^C7K0!NHM-uT)a2Z22_AX3i+@6q+3bpAcplR6KoWbAKTi?}` z82Xq@obgJ%NxZMBBdIYQnqR)ej9y}irMh>!5XU@kVqtg~CjUEYl{-ggeqO>E^4{Vj zP2Y0#x05ql(RTMy+xe-S+pp{W6Z&0mm)&I`%FJP9p%>L{<-6`)>{zmItHJKv1R!%Z zE9FO-MmL-FfDJy@$TH+*Fw)#v*zj4}O^a^(9dl|5bi&jyodh)*t*~LC*|eqfVh%qr zy!X1Z*>~SYdyDy$?8kVM`%{)XqdBhT=Fnyp?)QCp=5*`P26V`{{yfcm%WZ2#f!&vX z1N!W34ZS+dk|C1LUgyFl9Ll&|+`>7yBcdTK#oWS#CmtJDH}IM>slQmn?JIwk0;&Q7@Xt1EYa0x@ zmN)qv@LH<#WKPtl%-iE_-s=(EG1jGpGHSk3&*6$k(?bW1|au8$1@KPznYqfc!|c z{$PBQZcm^3+3~3^*iOV=qVn$6$7+Lr_dKdSJbK(On~hE#?c8^6b0taZRdEet_M3@{ z<_Vj?Y%oU%LCGV2;-*yMF$0sSfn{~E^jpxE*56!#iM0blcO)l_Cf&s%kK^gc=I?Et zIofgce&q1&Lq>b7EMW!b-?ug0QQiC@qj5e#Sgzc(EY*2L0N;GRA6OvQJWNeunb<-H z;qgtt1H0D>YT6`j2$%eauf4Vs^j54m9HK(Z>3Q+qMQ_J2kgZG}3szjejM{o50iz>AQaQT-i% z&K1Hwee0Swy%S?PX~f9VBSHo%X7RZCo>8R457G@*Z1e;sT$(DN##3+4+Rgjx4*XDc zEY}5%ePh6_Ak4X&}_yqzlw`3n(KV$=-;No>lWE zblLNY8zt9R^ww}b&Y1vO!IzUT9KC0#1UDX)X*m+G1!w6bN^hx52dTUe@R~4F9uCI= z`C$$v54dlFFI~F39kKESppN+m-)CwKv>mUyE7|7vkq(Q{}1?@J4L*X zw7}PVJ&fY)VlvC=&4Ya!T^nH0apd^AmS=o1g86@Q*FXQk(s5b{mt4J3O4U*Ggr?V} zI~$oDRdB8BYgQF1D@*@j0o1PY(S8{?rHdVA4B{r~Tm8%dgln;}@W6C?1j4jIaE?iRZ957<@a`K`XO^X19!1%6R zt`Rhgvbb=L;BlHP{?Pc^g5{Hhus^@yfC%;#=nK8%Ql?%Q!40SPUC-S>#}UJ2#~p0P z<1&>fveJ6{E=~yv-LI0A za2gQ{KH5Itp=7h+B2F<@YteD~>mwcROm5KfLSGd!|qf8k*Gi8v2-yjF$N1;({iMg8uC_^&Wv1m-MTb|WDEo-$M0%JxAqrMU75%@6cSr6@1Mz&RF&jc@|0d_+Bs@qv8>Gugr-2FqGgJE zlICWK0HV~ChsP|NKnQQum|bG+J{m{f^^-R=R2qR6#@`W|(&ub@-3DoOsrCIg9W{&8 zo}PJkB*RBiMdY&<_U&MBob;rK}+cNAEIsZ;;FWtE$J+~As6b3lu z<9j@5_U`gVwuTCMDX@?8e$$HWIH{y~Nwu%d_Xm8HT5&&X zTXA1Cq#(=KN!l{0K;1c0BY$I@aHucGI5B|F1c1(-T7zKG^UuGYZn3YS-$Yh#a%8I=mAnZDok1DclW& z?YaU&d%k8HpviP7U`MCxHw>6=gZU&MYiy9WKYkr9Ut8$SHxe3jZ1=1zo&DILL69od zh#x8u%G(xVj{y3O@+WLw$wJ{Aahk5nkq`VEI;BsBa^PmmPzmAkxs##Mv$6;!C&|;z z29yt-6!6rq!EG*v(cA55d?C)oo_4@Hngi2)jHIH0u&wqeLlh5}0w>DzcPsT;uP?Gm!SD6K`G0H&xrCD zKT>Ki@QZHG+8mx#374EtYTjZmWGzH#aTSA?0Y{L2HGP8^^}~pzh{lY1x)X>Ax9sh13S9M>{jHaf2UsD?Jb3ho&7mSy@F`DrsWLVQH}y z)ju6J6>IjUJLg60!msdzPg7QMrsj%6aLt1$AuK5zu=D7d!quF3eV)xi9~IaP%+eG7 z@Z)8GQT}GtYKo_}x`vaH^Vq2SyI z+vaDWc0yOp9r?v*xoqq5`mX7E!&KC3$ILT*hl{uM9q9Qzd-@!Hw7MHm!IR4PilHU4 zz9y?NQU69~fm_BXl-_Ekcds%7QJ~Kq{ER4Pw_d3=L$NkIuCq2m>ek>eOy6KTeB#Di z4L0)jwjrr&39wsNVm$XcTfpJeC7>oMM0TIR1R3fn@y9ti&CJd!B&`c)?b%*Kc@`Ck zcCpF6@{$rniEbz*ouVKfRZZL{3Y?N92y8Lk$&&&{L-#}QF9)dtZQK*9`eM3x5*q4L-5aH zK8K~EodiTfMEcri;(q1utn0*P4HeG7ReX(BB5a1|E=FW^g}k+rw$E(-wX&i~qeLU* z1V2Po<+1#c9Q8~9>gxH+?5NE7KkzTgzs7B6p-Aw1_?l$%0cciCmo;19SzmWAyN9!v z@0_OY49hz*C_SB)P=bHO9jlR3H!5WZrPqgYzkGj@eVhBIofIl3fREbKeZt$ zZZU(9(jCosO#}M=&UD!8jW!RP@%dh(kjkGZT??1u8>6T-bHa09G)zRLu&A~@5>guS z8b{Nxkm_xXIbA-Afmx#IbMln4xfZvH6?PCZBiV6cttnNBy4=-`uEvsT+hnV&10E|O zlm$wg?2V>$Yl*X8x<66hRjWP*75lH zo!|(waE1o(be`(EgSR_4uf|M=J7p}vDteT_GgbEH3Vpno2!a@cTfIg8)(iST{-jJ* zk1d?7^5%^Du62jWkVVZ;TOdANF4mVDWU80+En(meDDV#0eLpLu*_w(XCu3${o1oz` zi_u&Xpx7~~b_DQSOvjN~YlXeF;=!_41g9k7GBmdaPJ(2)7Blgj$J}=bYG9b&atUWN zSR%l>v{C=fd4sL~C+9t;VPnpe?Kb;9PsYPHIw*O?&%V`751W+~V2H%w&2m&5w2dnv z=|i0HJ2!mU zAfqs-rh2A!x8(XB`t;q@Ilga08Kyg6Gw5!P4IZKe&;;7HcQ`}vL>T(y| z^RgPiGs=hcA4HDwXNDbKuj_5(Q>S@O5ECZ|mc}pU#E|DbPU%HQ7_tisgP=g%W*O+1 z@Z@(nkO;IyQfH}vDtR#q8`^Qj+-;Hq#HMT}JfW{^mA@rTf3iSchja=~(YG+8OX%Fg zw5MFDq(3R(GS1Xb5KUv{Mp@e0^Gm7y7V_4kn$%a<{tQkxry=FigN(OpI6a`1F7>?|uL_{IkjMyPf+F4irp_CXJj!sk5Vz{6bzq9ge^IUW3*Up!qc$ zV;gNF{(ixS1SpYP;z*H)_YtoH_T7Ku-S8(b&M(_^TP~vM?sn3&# z-3?cA?LbNLvbWy3ZqZ&>AFDqwiq@W`H5vM>p$L4`5C6Z#c`vlr-sVrWk?`Yqm2fqs z)_I-esK_)Tkre`e|0m4b8PmP=(t7W`X1Ec4$$TmWYqC~|HQ}tep|`LZveHZG4}4@{ zfQqF=M&`h*6&pZgbdY}(jbOF3*~*2OwF>^I<5CF z%Gj72&&bOZ~4oDr; z?Flw2Gk0n;VJ|o4Ok4s24%P5<-wL5mEmUG2veKIy9UMJJ9L5 z)QEw?RyX<4(&hag_K4Y_b&W6_)zv|+h;~Qk$JZ4W;R1cV48K=d{vg~RS+?3Z3!}C; z7|Bu}@LJ(1#2W4BW)nU?6oPR!_lRj5AK5euW0XK@b(UXs;~Nx<6aacCqiZFmv>z zmkzQLa6C8d&^SF;PPYP&9`k99kidKvhH&D~>{Su;(W`v2Lw)~mmG=z8VUqK?L-*$- z6t$KD+@=}z0G3_^$CCyYg0Zg(zNc|X@emUd4ozg)9_}z7_1E1zbsEcT3J))*={du4 zD=94%ay?3qmqQoeTQi0^ou;?!vi7*vmSapTRPME~83C;T(XO{a$7Yl_8xxfZ6$+ae zYG-G^9Cz!h0oC1ob?;v#=r5r*Fiv{{pH_6(*C* zoIYK z(p{}e9wB7SUfjhe=a@WRoJJFzJXY`wd=(QG${!?xz-@8bT?_nxS z>o9SyQNxk`6Q{M3M}_OUK~`Hrdgu9HF!i21rA_1e`UpPA@t2NdFfBAa;l&(;cBP_N zYtJuB?rg=7?TvM!%uA4>E9qGh!TJc-+0K#wL;$de!O))g^WHu+^oJy=yiPq(IjC}~f?wo~PW z`l`6b{Y$Vd%GBk8dQxOT^F*;or0ylC>y>C;z>iM+MV?B zZ0ap1jlKMdliRYU6mgwDh%^J4c=kdv4#L%3PjW)|Qh=QUzL0w$6!=lc2z|sxyp58i zDX;&sWZ`BJEZ=e3_({TeRh_)c&6k>_TNlSXSobEHy1b9%8_rqLGDovef!+eXmeVeeM+#ut)i8ZA20Ug=ycaB5LhpSJzl??O4>!9L`H8TMm=TRo_rb z3E49Ua4*z>FhxgF@m7<&ZWuVTAoq~#=ppmwK;F%xNy%;j>Ww*#NMAL zC%R->GLXE!)ANOz&=A*B)p6ZZ#=l5uSw$*^=^SooibSK9p<6C{66@qiCeo($$(}K& z@S)2vT)VILL7%+1PQS;^nixX7f>8V)S?No^e^}}71pB`5d)1I09^xxzQVHf4=Wr-z zst&#<47#tWFNuRl8`k?qde85r9TNlM;AHuq7|Eanv=hr^02TXaKeB?IjOwdFwc{ey4lV++5O8=qH;lXh<7rptpCCSf86mlY6JrBl?}`#LgF9 zVbL~kwhOW(FBPsN7kFZs?tYqE_NZikH4@zU|CDx~QB6JD0uL4xP>S@>6zNI_kuFGY zQl&@;NRiM31SB+-CQUjh2uSGC2>}URq=epk6G9b`8all2UwZF-Z>_i9hj%{B?6vmH ze3&_B&fdShcZ;`5pf`X^YY#0I|06Z%P{@RPHGAgUK`d?fSo{w6 z5~*jxA3*a3ZXPF@EBxH!)85EPjlW>@SL$hfGW`Bh5e_4a!$1@p`f?&(_JLI3YLbio zvhSu#d|z|cr1fjmpO#vRD7Jsot-P=qZ%0%(5JjVl0+O%LH7v&8`B_>Pv(KQJ;3#>S z03&AuzE(L;{k++C07YcwDA~R1*G?+wrQfzLB`JOAF%l9^C8+2aI4nGsIsL-Zk^;#a zI`Ptae1&Ub<%%fQ!sAU-D@0&At5Z+B5KlqC~vY7toYzk+)rm42tZqc ztepe2RhsWPxcTL5URybC?P#f*2URf?sBiYaSyl|ga$tQ16211_hsUN>M=@ZE-xj7 zn~IXlNX@-@qe`8IA`)%JDJ3ee_tDZWfnkdw#^1@43lQ&P#;>OR*$Ty+Zxfqegwj`)J;D_8_phqZebAABpRd}04q zoAj)2nFv`NF8hozW0gz5j=Xt4NzOw3l-d3s%%-~xH^m`rv*6z(8U?_HvuW(ml= z0VUEtDLXr^FQIQ_Lr7bW%p*!E*7{xdPZOx9>8)S9t3{^XmOK!4U6ZAgF+_||r{bzY z_}@dkd&u}$tw$V9DffMtyG5(ISr-vT6>@`YWUHzVc34YZ#2P5IQgJ&dn{c>E5qJzK zEvp)4$;kufJtEZ0?5wYfRO~;jP#N^)uZX)(glG@l3#*W-OvDC$Ui##=)u)h>U9zS{ zfRxgZ#ed@IwslQEv8;t35XModQ(f!b-$ffInYBp#)>q9)bM#!1V+cWVXNT`3Md>kz zvvE8MrIG`2L4x&<&4pGGr;e8T6)&UhT0^)YS;1)7Gidpwl~>4|Ja=*)QOov(1^lGs zF?+y=*ZUJ56r6Fznm2KijIhEec)Q8tRv?Onk63*W;)4O{qeLOu^G0M078bNe&T$nx zX8~y2J4u!l3?H<&14XwDe>_6V5Aw*))U-#vpC}+cP9@ao{b$>jTy9&Vc}8EE#E28- zpY^wphIK56zBZdX4ePId@W1{jXXw$~#<}`jcJ2QGT6-1%LYJn>Vvdf#bjB;_j|&Dp zHA^6WB#G94mEX_d7FQ}$d*1|eeZEJIhL6=}Alm~6=4XA^tjH-j)*i-W!!c!)ym(l_ z7P|ceZ#nkWBejG&vGarwQ;0Ynj=3Uul^~=DU$>dZHOq_n&+%b zTDX^=acz+m0?%687?!#Ezl@JkT@g)}yaD&$?!n!rD!?dr#|noHf>c@I_e*q5P1irh z?}cL&oKBa3G;9t_tFuo>$B{q7)1}pE8 z=gvPK>2wC1BTVIEr*X+EGm_Ltq?wgf=?HU>ntb<@PrY1G^CdTjrTJRco@jM8CsBUs zGPH7u7SqQP{_3wNzfJ1wA7il8B5JqO`z5~fF%^q%o}Yh=RvHKKsbZ@i-QFbA@fyGG zrh&znLxJ!6aPK~Coxt;v2k6yghw#|03beqeQ4ZpJODAw~QA5v~eVE4Ak2((f!PVJy zYn3vbC+<;Y4fVT-e`3mU?&ZCz@@&BMJI9A935r?*VJ#d@2t^VT2(9-74DF&ekZ6Fu zCOdL1JPb)qd;9@j@k2-$1`o86R`8ZqDVl9IvRmHrd>dzzq2%#4N7Hur0PmO4ZfoO% zWKZ01=T|!I=I~V&9gpo1cTB3#tq!@y^aJnsrMYyE7o!gc73HcSnJ+kacdqRV^8y1C zx62WZEUz*I`|q4z&GGKHJ!bxv9Z9SwyPz=};8(-)?(UDo(uw6}I{!tgVn*36SCe%6 zj3`yhc3v^TJv?VE<#+9~bkq2f=TYGisK*aZ$ahQ}Fx(rWQJ2MUvK7QBxGUpVx+f6D zdv@>q=}$H0@8BI!TJ4-4bBB7Alkz*Df-J#sik`!LUR-rzOz} z*Z3fD|7$=`0wD@H0?nINI_ZTWG#MCSi}%8^l5`@hjfQBcbtV)u9=Qt*#+#Psh**X5 z$PxTc+?pl!5J`yTs)UmL8?{#Dg4t6~Zp+BG&>U2zOq(b{&yyLy;~kB~{F&_4RTv6$ zQ^Pz0-ecEC2jzHE?V$AgD{+pq<%=Ii%(Wd2?1)m=`i(xkzW>M82Q%^XBYHYK8tn+ zPq`lh;D>hS1+kQdW-VN&-o{RA07D)faV}06K9Z;U+7h6AP zl&L^uZBat>ujV8j8i~((@~Opz2R%MKzILg}SalQTj(nMjT)f$FkvGT5l(@S7me9Ly zOh%SgjSqAEXCY!=`uLys8gx~$tGvZmg}A!%I9?}nrgs!Ih3SN?9Is+>%h_&#Ey$jR z*S5shnrT{C@Nq9x#u|R?B?agC;Y}ax;xfed^)0g}a#-#`sGOlp3%ah`)>eTX*m&(K zQJM)sY0e#KTSQlq+{(x@9rne*PNi;=sX}ml1b!AN+R=L9bTu%2+Nu2HZxt<7cJ2hU z_#%GN9yYOsy0}xd^ojG&X6l_r44>M+MuM^q%rnfDJ({RI2HU&lo~zgg_Te*>CF5^2 zIWg>S5JgUKeT*DVlNOC;t*kWv>8I+I1S zXp>84Vl=9cd)`XKYxe`v>hh+=LA(H-B&O$!wHEP;in77coV|vymDZ>o&0Z!$<9FoH z0&}#WtvzQe`;6WKHwsxwF5Pl=miwl@)rWnREiw!w=21?ku+eGz;`_Sz$X&d7W_mEf zjaNSx%2y>3e1OrA6-wFJpkm1ZX z-hrDeH>Oh@f=1cCX!~?yG{X^Jq*10m4Zs$gX4sLLOZ?h)G4s|rhNm7L1W9y1jog?8 z%dOt<-0i$*-)Pe6?Z--!K9nttD^W2&n7Bt(DDKEJnUDOnXZtAaWq}5tqlk)yk;5%h z4vo_<;l6Czz}7j@N#SGr;Pof$WhQ%@1EPA%i71p(pA+BZf#+ll*`m??SOu|JvB?wa z-W-&g>*(V)*GIc-?8i)GKx2|NZTOY|)D86;1-revCK)gDHkX!A<#x}RHvKu++ml7l zn!Xi!8j^Q2jF=}VR$1pBiX7x*TOUnPp!1XhS-NFCq6X@*vwMWl!y&5O>GG_ta#iEI zFhfh^Ot!&DMFj*bnbmGy|K?M`{hKUoX4v;Wvi@nyOEYy$=F6vPzp9H(?AQE4 zh8}w|d80J~>Wkb;FSfm9{4m-~Cmklg&I(TIekj{lg0&mp?V`>{MfN<$DsSP|xXz5& z?Sn+np=XOcQO_Ys5_TZBaHo`Zj16)eXy(Cy&F10Dev;E}XeFg5@+=?9%_E>V5Y>FVGj(zm)lQEr8AYH#rd zf2w>2DI?>y)Ie-LOD@@)d+lqZy{{dUl1IDrii=G~t)UyE>!Nw1%a^1et@00 zodCp{{j$rS*#iK+Y~(%8dX|=&TNig{Z~t9za0n1Ha{QhaC2EVR6w9TBPcZOkMt`pI zy<3&DsiQuw1~&MmSIzG+x1Lg?mR}y12w6o7DHgsTUN1XaWX+$)nz26w74H#{>_Z*C zojQYseE+Ma`DzqPx>k?t~-ayPxs1)s$o|1=f-R`^>c`Kq^anP zFJ?Z`gj0bEUcqw|>5m2)k8>g_EqyipBtF8PmlVC%X_`6;JA?((D270=0{p8}6lb-A zh~bnX;;`|&QsgfbrZbCbRzBV%e&}T-yd90+$S!352I&HE)v&pdm z&41xZ?QCyDjb4=#Uj>1D3y^#V4)e@npA$Bsu_8t6N^MO&piIQbTIbtPlWL#fG!m1n z@iW|mbCQBnGqY@Lo{p>M9t8n_Za&-E?|O2yLEd#rU(vN3h8pH%iMqHn_nKb`zmsdYq8akgHXT*fet*Wl|Osewj$)Ib&61BhyTB2AKdaT@V!EIseU)(83E z>H>kHT#nw`p6%qSjTWSwc7s~7-IEHT;sC(6p08jnFCGWAT^SblU4MPO(`>i4!U6Jz z9LITC1HKaVgb+XH5##mEgux0n7%AryXUL4@k}b?Ny8cCtsXeJi-(-sH&={H*1OT|u z8Akd~Y4)~(NAyyjJ@EVx1wUIxBjJ0$Elx9EY1u>JL1CI8YGF(sybkubIEVyL@dAf? zC~5sW(|HOJM8gNTeC9T_D=xmtdl;;Iu1dl6h+rDtwqIS^`9y<&Q9Vu9VuXeY=QSEnk zm;OU5ZJ@J!iRQs_uYWwq$v;2+6=&rB_E298==b}%Q;93?e-;L~ugzbq8-EisGF zm@NO*|1x~-)~=&VWL&om67}8quh>@4_UD!VW3c~aorknQ;Rd6b!{=`<^;H$M6pH1| G-~AWLF>>qx From 58e950ee2cf89d9f937f2f20b14f940a66142a7c Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 27 Apr 2016 11:21:29 +1000 Subject: [PATCH 082/439] replace with higher res image replace with higher res image --- .../images/machine-investigation.png | Bin 126857 -> 54481 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/keep-secure/images/machine-investigation.png b/windows/keep-secure/images/machine-investigation.png index 1bc19c1c26f9ae03a22a9c74c8c40204e667e30f..df55bcf3187c016df3e33397810257c70710bda9 100644 GIT binary patch literal 54481 zcmeFZWlUXP^fpML1qu`??pmxk6qh2!-QC^Ytw?cqFJ9c;9g0KIi)(S`;>@A#@1Hl5 z$z*0eO(wIG3uJTdk+s)e@;qyu5Ls!FcW^jx5D*aW#6*SUAs}AULO?)T!a@Tx3#w{2 zz^}KqqG}Eh5Qx1mpH~SV5pjV@7)LRwFEDGbabKY$A$BT{{h9ir>d5cpXli2*QB*!6 z3QQq50#iap4hHsSwvJ{t))1&~iAjNZxR-fB8(TMfGZRxsh*G2xPGA=C&#b+X-pipx zj%HRy5TC$EZ-M{3eff`qjj^MPp1l!-mhJP);qZS>ZsuTMsRtZt57E$B8wE_mzD%p= z*;|`gn?Q8p?gRmIFn_=AWN%;uarNwf@ZVvAHda8J0r!(N}(UW`U%y%pOKyyxPXXkF~&a?cjKQMy-4VGks{$?nW zf5RHB78&Kwi20WHJ@CI{$llNj{T+G4RHno)2iqqfF4$5G(`yFIwIn}#Il#!A;2sc! z1mkJ_I|T=xJHgiQ^Cd!=PIK1tO%&mIkxN12EeQKg5qX>BUc>Htn1g zQg1yJw=}s4ftSl{+0Hj5P+-E`Y~4B}b2=d=(cM#0*mx#d87$MI#N-D1Vf?w>pq`LI zhJ%jGykYUT3pHLJ>C^3Sqyl$goU4j9!vdb>o;Pf|UCvJ{V7__1)uEB7Ck-(9#Ysyt zr5cHUfcWRp!X-|0e%3v&etMYB=ao)}u4s3sp7XY$s(FR={T^n{!NCPrCvtf#&!l}^ z<@qU1@@^8d(Y7B8tRa;5)inQ)cn0KHDi6}B#2U= z?8%^JJD4Zsaj#}8Di^6Ub{iAR9wlqlpNlgN++m6%>n5Jhy)_0}@YvGrc4A*0c!vzG z7yMnUK|SUa?33izsD%th#gAv3?AH4dt(V0K@0ltyRu8!|U8FgBhqq&2x1zXrQ&lg} zELeux%H*+&fde>$?=Q$U@;5S4X5OAZvEvhK#EO~V*{Gz=2q#)D$#BYh2xLh>pF(q) z$ry$0=66TKHoqq1+{{ZYk|!pHx)yfvOz^PC7c}Z zG^)wu%Qhw0II*jkoJrhowlY9O8>0Kzg@=O8_)oVY*^vn0=yv#?_E48D>niM~DXcf1 zvz*^0(ec(QGnb%lMKHwZLv#yLzV8<;42|3eo9i}Q^&;CRiv1BD$R^lyksm(e#CX32q%^Ggv@uGVbz&Q{arMe`;Tb25I|FxS> zCEE8NQzkMB5?6MdZUT;mHHMqWXOT14H6)v9aCV_DnvCb{qi=I9H~YBKE;xAbaFfp(ST^}QQ+npzn@D)1OZ3nh|Ngz(*SKst6d6RoH zk`akPFOrZ%0Bh;r*5%crDV3+)mJk-~@Qho85C>)M( z>VGy8p7pIq<87i_I=G8D+1kVPE@+c`4a{VLM!y|pf^9yQF3~Tht7=9<%1Am zTdTm6J}Ib!m@dI$@5S@kXf4MNh5XaVk;VabNeZNaE*7vRMmInGSiCnDRJXLxyP~l7uU)^Ni(4mLR<447a&jl#3~=o8c)YacA&O*Qzoz!NmW%b541*7XEV2EtBEMnphA1}jyEEHaAM&uP->U4;QEJ;n3rVz=e*Y01PWMlT z5yN;4+wD1g9?J@oZ;!2(ZqG{8>fCgHPa}S{QNtp|x3e5bAyzM~izdZpbAb=JEoDI= zmFjJJBh1UcG%HMpO%cNeOJBmu2(F^BjE;;yxsH*5)`a&`J`I4qyCC!1eig6DB)gQ+ z)1-AUVGtbS|dAO)94WDku@X~v^2(&6#h|_*gk-g=a0SKvUPQ*1zSEq=;(l> zXj0%jW>P486+eksZ)Y~o(nN(;ex}(0EW-i z6XyQ7AHH=AVrjJXm=M zs*m*OxEFl#8g|xRKvF0eH|h%F9osE$ig!~OXm(-BG#ys>>vW4inIkHVJ0G6|?PlK5 zfU`zh!JQ`!Jc8~s8Qjs&AKPtDFi$g>X4~TB>Q0ch*gCpv=%0{ePS^G9Pqq$wZd0%?wK3Z(F8v8!z zzG6rT%+|Q+)c{v=GTZigP~?_8cR1Uhv3bjQAbH+FP0u^kbglfxez;@3IOwauX~jtG z_jg#!B7EebSZ#_MZ4v1p1dPrgF{e1iT@%?W8{f$TXTrJFJ3LfNow*9aA;vl@N#0$8 zOU;h9(&aA}+T|^y_!j4qH?#1EwjTDw@HExn1=`qs^M-pnRAv-Dq6~)n|u27F2Rc%KK_UhXH&SMQ)!dF^aPh=9%#< z20h3<#|Y_yX-&t;FRga4n|KzFxGob<7ksf?x9m^%7tlKQ6GQ3l8$ttesBR5*Og@ix z{;S$DFueh_k}$UTkTuqr!PDXYA=%HO{5hi`@U&7RSLnTwEwm zZwrVHwEOk#4Ct^saYgOpz0!$90v{jrPJ|+{^)cK=7*QAQgC0c+BtE_N=iez;?aJ)p zhYr*6NMZ4RU??K<}Oa*_Oc7=X7)J82dzb+-ed5a5+eb~%tQD3jZhLj6_?(@ zVgmQ&Vae=sf!!?nM^(<%wzG4CuVyB8eWCgBh^w8&^9F}BTqVwF^((2niC2>g+HF=q zK$_Y|?B90{1ITxio_pYy{?ZOps&C*JXFnN-mA8q|ShDw4Lw6G%rZZU`E`W|b;$Guo zWcdl2i+$27wqyI<@ljUqX2baQ_}o@X%krbU43@%zquzQ9`SH1xiNKB%tF|{um|M!0 z0t|b_6`2O|wU9tkYgZc*LM6)2lOfx?7GQ~H-+{IAAu57{MK_bhYR)vYz3Z;!D%u}3 z!go>tNh&=iM&Pnl+iyEd(|J4?w%_#86R1x=eW-0{xH!;R{krO7aOUoyQo4rOfz>OM z8g|@VVvHJL!G}xe9p{tAl2TZ1uHSDfow3l%26Cyq+qF4QxVmpT=%&h@%9WqcKTvmH z^?EaDs`t$X8bZ08CkB1CbQM7$z4Of^It|ssbGA}CgAa!Ub?Qo|LPbZEY3=EV@@%?0Mle5)IxDxEkf9K(d@W|lw@c)}4C5=7|D^GVJNAiCHt)bwSRUt zg_mKDD`|c74;1nl6l#pOKR-adM!hW_kCS*0>pYbi`k7mFU6wRGhxGN(=RL-Uvuc@Z zW;uG44MR|~rPnFyc>ig_)i6=|KGBw)_Vl%Cc16Zf{*w`KO62kS$?XVPJR>zeAPVQ_ z1SvSq(>f$xc1)lcSRjL;8=88ikrF-Kf+ySKl-I#zkpgF)rF^$ zlmC+^YLo`og?vB%mleHnL(P1P@{_i0E4kC%1uA*>b;JBCC1sdaNg2L$HZZ;*TfH~e zE?B0j9j2r-94qooVbz}VMb_~ihSvib(%dcHstSeF7Wef<+*RdGH(zxVq58O;X9qod z;_L<^>A^}r1^A*joNB4UH!v8ljGLIVI=kvPaFFt1V$qu^>uy2)$@)xQlMQyECNb;r z&~WiNpYf+{A`Av%VcbId@*Ua_<$clIgIk`n2coRTQ?!*6<$6QdxJ7B=1dms%iK`A5 zful~IG;Fm~-I=!%YTB$dI^7&5Qkyd?y9;og(3$SnO2#^}aIzyhcl=|i^>I37%llK8 z?-P^WQ0&xPde!Ke(Br}(S$Rdw2~QoAS-1hgbutg=?B*e#Moa(sn^F|Ey?Q7V))UdgTmsE;WYbu3& z<0z+$;ael&(w&^Q0jw&&ujN^*{5(-jbDT4XMAn zgsc_Im^_p%`TGZLbG~_8;`KyGxvkt$q+4x`YR&SrG4AN&oL}zW%2{qe)CvNgj0c~( zDccDTUxj&+h^C7ct@aOU$6@Ml!7@jdrH)k^jDFNy<_obwz*arnyc^*^Zt3Ouq<_|= zz)s&$5pVqBLT0_955_nG6hmokCP#%ZGPhhkyQ*p-mn#z52acZWORjGw9%)}YtmG>K z=s*ngX45|N!wK!`+Qq7uAI}&Cn7hk`@7c<`=E1!j=OVdp$Wo^%HqE-(?AL+BlHEW@ zrNICqBpX49?qE#a?i`G(>$xFsjbUC1SwW@YilOwPgYUCO)lXf+{R*?H?4*p5f+kC` zK2K@(SK4(skhscy!DX6Z8nC&|sO;Io?qW3c#b{d$ghofXiQqNtTm>8``-NCPpdNCu~U&VPPqb5UX?xtz9UpD)YtX9G>Vx;#!mZ7@k z+&eK7t>xU96?jc4BH*!)9RykYB$wKmvJEd0s$OryIN)^~=)*q<^g?B=WQLhshm(W=wL>wdcVz6L8*qa)}(wRCmt_BLe6 z#oEntfhNz)+beu8A3|4&KJHB$e$q=Gq&cbUUYaIDX`PeZb z#Qn^D6bW9uj=IzUUdIVzi~&?^r%i6IJzPAnzSyCsc_G_xUZ;Efq-2^~&WRuBy$Fht z`{c&h@NjyN-nNIqyYY7% zg#O2IaQn~No#_-LORu9($=BBDSumM5$7ZLC7EW)dSuc+R7Dn?GW0Q1tm7LF2X@qGo zNHH`*4szak;Fb_>3e(yph9)B16JB7%9Ev)l!pn zvOMEjOeFOJ9R!#RNPLc6O{Is)#x{v~%H!M|ZW|5?Q(mk+;%Qtpe~+ucKXuh7LvNmT4oH3 zW@W*!<9SW`Q#KRY&fnc6wcI?OSP!*MS?VBYSt8WQ7CD5Gq-a0O=p^Wzx9p9!R0vZl zJZ$!bHPA%l;W#AtPp+u9^EDKPV4Pnb7c_F_7WPWs%lAzSog>#>z-OPY{twzYeP9Wo4k zU@PUclfT{0qX=uKyD)O(y5E70ZGHt#g-;firnPs+L3*Pd=WX=WHTZZ$!jiYpv4emO zF<#jSh~@&BNZ>v8EKMdP9jTSg)Ous6rB)TYA~>saoSa@&__Wow3^wYQI~$!dwt}8c6zjoayE++&!B>z z(Ps~Chu*37Y*9_KD#snITl)dfH5Fv7712H#^T88??y_+uZqF4>kPlqne)D>JiDshL zoa#4iiG#Oval{sHUES^z_)&aYn8)p0`c6tiG!>5g9`92Qn3NAuXNddnguoJ#zstjA zHC47_o7xE&7A<6SwJ3^b^L$!=UQPP*d(7Y(%!Cf6nW5qDRHNmrh-!`QqAF*=2Th5? z`J>F3p4U!Ull?v%LpeVz_-HkedA??GjwM3Rms57 zYunpi&AglP2l~m6JQY`Y)$R0%QrpcMV0`&91e6%YIEh$sE)}8vU>CQL(lO-oo6>~T zwz=4`%ooG#?WaTnPnvH=TiLUrk9bZ z%smuL?A{-WH$c}n>1)bmQ*PkB*SBkKMNu{pa5eW_*?8*|{Z6f}Z0fDwN`R7&<;Vqk zq&HNH>rGnLx<%S^D6T%=PF7pZPZdRk%bM-U*E;Pxq}?+ z)vEOAc5g)L6EF}CCP zL!)af_EtjW^!$L4z{4C$VwWp&sq!Z^qAF1PWnJckg|YBolnc%67WVBqlwO<5DyExGn%d!8WQM~g3y zEj3v^4CA}lZZ;NM*pbjOYx{lWJL8O3)<|a#1C3(~Gt)nZsQfrzzk!V}46@W3{yA^Z z>O6}sq!JGUvy;~M(U$Ji_4Z0-Jpi@%^?TMzYU2V2p&(e*U-b!f9gA;`ipXZKOSuS3 zQk9tilR%gJj?05hk#~VXddsf~)lL5%SBd%t6Tkr0AG!7L1_~tbz8u1xL!l2Bj5;EK z(ce$>iXeEXe;bv6aq|=N%v09Y?P_T>?&m)~D)Lzv-7LGm0I znMeSx47o=a>&27Lf+q9vNI13JkdP-g)tR|ALTne2?P}p{k)K+=0)jnef-hd4G*qWu zEV-+j*{X{#>DLc|HM`ypnh~_R(383=sHLOD)%Ok(3MN0(mSrD5DfCl!jKkN_p;aQs z)yjDD`s7zgx!l3PH%rihZ9b|``sQoLHl9)5p2SXLQ@gMXxRLlGW-+1ohCE8 zP?a^CvQ@EuT!NEu9xv1~-$o1W_~wpif^XpH7IWfx0)1`G+4cQAJ45qh<5@ohL<6+H zQ51}S1Cz-ZULso3)D22sfZmDkYbsHb;X@+U4rr8JG{ak zh+C~;GCjhAI1>BDBAA7Lpw-SdCng~A48O$`3e!kW4)iQ5hx z0Nj(mbkt1;6%~{k`iAvnjNPFH$+o>M;tIsUCo_uw8cyk9*nS_#mq;1}ve2c;9LLBq ze|r~k`vUPl2KrqU@N>c8n%^6~bgxP63(uD+s0{lG-6LFESf=5Y(P>l|O0N$dji zZp1jeIwuV~2OX1D!Sp=xN2pCoN(m0-{V{AmX1Boj3->P))b3d0)5l42uH*)4F&_pR$Mw*#H?6U>>#g0m>Arai zz0w`g@*w|pM^L2e?W2If;z$MA`V?3V*=X!8>87_{%{ViolY}qq8!_Z{eB~)56p0}` zUoVkzG~C|SeAP0`5PrV;Sf{#|Syzpl(NQRMKLYEGkafUYm_Sb79ANDie6(bO=I-*O`EwdPnZQj&y=`*?#}f)fxkrDu4l~Buexq$pHTjx;^6mmjPQ z+zz!*6_)iY)@Pj-ltpl!?_;L-7l1}-RU|%<><Oh^4^;6t4b<3`@Ia%G>=2Vwh%Bhi$I6$X9f3&g;T3*HBU> zX<+nO6>etg^}Kq_;l8ZGxU-xs!nxMbPoZ4d2%>>rkB3ALDo-tY?d;DQ9n1(feg#aLzGif<{jDLjKtQ zwiko!l3uhzHLhVWbSwLz$<(=DfXHl{8L|;^8Be|t`3z9x%zfRkanz-%gCE|$9wkW( zTm#rLqWJ}F&VK5g3_8zBU60ZM?e9#eeYn}xi3!7>MrPu?Xbxc4?aZEK2liKX@rF9h zQ#s9N7OTe;D)k+YJfp{HKtGLo${Z3yHXippm3^MYh4%zqINm#-=-+~$I&&Qgt2urN zEh~vRgY6!XuFrf{E~M{xnMf`FWnq`l7z_&7jtzbd;yffYA`2fJVVMB3lp0{{o__xNM=xDWA6o0uW?A0ZI z6o3pBdGGieta(4XGzZJa>QkK;WZKufpSkymF8DbYWv$V~Ylb zvDUm@^oJn}4sOjDy(w9Eu=nPRD&O0+dAd;Az|}U|k2hfN3ngi-dX_o#hF@WHBVqGC z;z5taD$+|0){zH(^+4@d=4rsi}>>7d6!l7 z!;I4;^Kq=_eJQ2vUlJXl@QTy!q{Hi7^dVFT)+I^`{-@F;@Bdjf${)(@Kh6uqO!OZu z4FK+foX(|OL@$cQM6ezE$}hz8)?YYTQ3O_Ij|j5s^|lChfC7F1_pgDKZ+z0MJ0E$H z0JY1**AktSQ`zK*{Yn(#nc%Q*2D0)T^H}4|`{}V8Wm1JSy8l|v=Cug@H z9wH#yWzL7*e<%?Bxvbwo3{sn3y8^q?w!`$QJ{MbqOS!X~kZk}Htg_<&a~Koyg+--V zXe9J??A0)DnU`VK)eBIV^%{#ErPd{8%B1{To5QsDf&;68ieZqlgE^`wR>fR^yAW9* z1EGc{cfC7zbe==08~h-aznt~cQBCH?-}pWg8KuS!pv7nWp_enZUXkK8+{xR$7CXoh zW|yCI<}`vP3++PlX>Anf#thqZS%NYF0a13zkR*VB-kic%%*FpObE!y(oDxveG%{wM z<&3QUF4-;~(En(Ml>NP_lq4%SjfyFS(s&QSztTy;9#F}ScYQQM{cQh{`z`XEf{a?Z zr>>o0a~9rTrj#Fph~boCLsFdxEsHSG0hyPoqwWP`R+P01%{U-_vHS3L-XE#&``hS{ z*&lIoYhh|mH0NY~+8RgU@;IZ%-S+X0d9EjLIz~?PLR&uy|Eu6pS`37G=p813CJ?}1 z&_@|+T!mx!mF{U0EIdVL#ZjJ$p!yZAm` zKN!06s@19&*u6jcuB(5pl|8Ig?~+F0DE_ZT}UGEws=UDbX-K!HU3@ zNO|^dM8?NJl1dgUZcpdy76#)T{Z9cH(`0pgxMcR6fB zGzw7lG$fgDhh2{rnc0ql(M>a3{=2K~twH~`xmFQcsdz$To|S18Cl@pn zj^_VSaKL96Uk&QbMN`gNFr*f#hOKEf=}O#J(ivN4t8-6QDTvv965?rzQ`7^!>1&4) z)hkh)^H#x|j?@^*=|w@Nf@U5elC&#~b;L}m?g`bX2ydPE5zK=2Z>fdV%Sm+*3 zUxt{a89qQwYgk2UGU;LWs<|&Zv@s~%L-mo(x$*0ajZvpCy zCQs(8j(uNj@?c|v4Duy8H6dGf9;dn)Yr}PCTI77@B`RUg^%ow`DjMcAfb4py)#>|q zv)QMJ4jvT^+5w=5ZUg~9xkgYDPfq2cBVDQ9+5D(V2^34q(I(kD_b>@ia74pxAT;Ul z$#pmp%CnQi!UM*E^gllk%ue;UWCSqIII;gKBmVD~J^UZr;D7eu|3CF#VT%g>e@!4} zpVJzSuny?{K3_P;zkMVm^gs2Y|0f>$eR(4^8sW zIo$8ZXWn);=OaIOrGeU?qQ*Ui|y)BbU$c?6!D zJUlvUd#NuIp#UDF{~h2TvOM*jj%27F?Wz|_k3N2Bq+kk{xeEdi#I$_UE$qPheZ1Al zK}^!LBV88jxWYPof0iO@dSkj2l8CIeAFbpDRDvusl0UDtBk!k$;J(7GGIa|l+^<>m zAYEQ6@h0tw`yV)P+`0QEl5_h4NeL@%4_mW84(SUkG*xtl6%9OBOl}6SD>p+v$sOR# zmaYi?AeC6kqCl}cHCiCWSp|ht2u&c}j#($YHH|zTMs}T-VODaY z%#HYnqks3g2gv-TK=mNj{$BoqdUz~j_zqv&{?s1ccpg5k zamw6WnG>J+;U<}q!h&0`^d6|SyM0}vHO71*XLD;2bC3(e*QG15?a<;ev{`6-u#anz zz>@Ahpmg!Lm$+llHi!4lIOlpm{ABx_)vNaQf^5k;(JTDZ-G=*ew@1+pLB)gjk6n+Z z2NS_MY zk@6!+Hz&|l@2z)hpwPsf;PSM1%cko^9^F*^P=>-wsmva6dNu8V4Lz>})7pnAR64qQ znLrP5Kssig2}~tiW(`-Q=>1N0VkX>QYMeAjV0K=A5Y6dJG)F!B5Ie|KA-iigHl4E# z=D{7%xtQk`X8*!!yzHoh>wWIXX)RygQe(Mcm3iEU+vQ9vlG>O3lLEG%SYGrC(>dA3 zE66TwzrK6x=*Y&`R);5XK#A?3?ANg6%bo1}qROXkO*y$Uf;Y(v;p?zd+s#}C#dRDzAy?xL3#erI2aZ>T+fgC-27X1;TPwE1dOTVM-(Sh1n zRHBl<7QX;KnYKS?jU~=Rv)pPlb-<~7@TVvefs9izQwJ~LJ8po&HCifx{8x4%%OW!} z*xB^Pv@T!R>)LwuC&%6o(Q|^-+O9fkd&+>5tneC9=1jj>%0xR``R*2O@Miq?vj5L4 zn6t#}etKXF0+D<;8$gx%YzNduqMDgkJ+c90546t`>mERyv&7C|!<7)E$EAmJ2-?f= z4ZZ~6H=Em6xSqrovC(Q$BsR#A@#OC^W%F8DyJRH zjf%%lk|+?x)strgQF<|ML=FnH4R9!}2ohE$595!1cq=r8wH}{q9jtNZFJT@GvOu`e zFWSE%`ZoIHo=Szgbx}KCuI9GNTq?cA*j;~r{1yc}=UCuRLa%1ru{_+3WsQ0k`aR9f zC;VEO8~qjcN2|QH87HO#-r4TP!xJS3&FvE(q-;^FTu-uu&4JQfl!mfz$qR=!PoQOq zl@t1oq}hEGX5&dIla=pnGX@sS%FV)cmnFnL7_yQQOgdS3L#~i`k3rnD{7F?RYVQoR z7fZX|(|bH)LcXRNFwf$q?K%hB8$0>6qL9nGlcvl$W~SK?|Gws74Fz{v(X^|!?wb<< z7KZUf?-6eo5!-b0L51hKQt|G0444|VT)bst69B(PUvfUsVGz<5cWdU%Rc3^W&z!9P zEY!4f6K<!II#1Me#vGs$Z5GH{F8op!o z-?b!PdQ&SGb<)f$?9MV`FYBo6WC!WC&^up<1@ zm95sDBR!vbZ`8)PbCJ_l5g@piSav7g%7C+j~^m`U9?p(F|%%h_< zX!w<{*y?82Mf-Tdbrh-x!IlS@yRRNf21WbADl%(sY#@=|U~l8iNHVvu7a`k-j3nv{ zEq8pofDR`yKw6(0!B9kfyBv5B;OG55hK{K!!|3iTqS}}yLeP~v$=;LOQHXP zjAi8qNcm3R(2LRGgD8VvLt({X-RXb=OQD|-!vL-Sagh zf^~36onJR&X?oL%d3M|mnE&KhzmsA6m1+MVxVi;-P;>#8(FGn(uT1)_`(6a5dEMuA zFI2S*V#5wK!6zDsLF9-$Mg)gCVXxIRW&Bv(E7H*fYV;G?eXp>);eHob;dKJV0((H3 zgR-?#0>a~+6}M4am~U%!MkuVMDy>1<@b(J>L3uLX5PJ4N1SNXk+9xV5W+!FnP$Rf;Yj zW4$g)Pg$kBtXQ(XR^RH~xLMqnk8J#bnde(G`PUgZdyG)E@_O`=(%mK$d#b0ms(TdI z5@{ud>0r!K4@(I~py1$hbC{uy%-&VCynb`6*X1wOW!+i2B1tJ*Z^GI8Hsv2w@AqIg z#wmhT^0peo+th!CyBUeVMM-Hs2S)+) zpOUNj#+&c6w!rFEcBcEZgDDd4Poc%uD6z~kPDXsjKR`v|QIhgvjQ z2H6p$oGaTy6a(EbSFm`1@@W+*rkK9q6L#$!@1Rf+p30*q4LoihY2+LaD(%c|rE^hH zX_{<)AN3oK(YNl4P8*sBO(;}o<}@IxzG5kPZ=<=hv=e+0@o4llF|tajwNYO+&KRN- z%2pg&i-{$xyguw1+X9`Liy8n9nL%SzAWP>e^c|ijRa!~wlSqquJ_oxH>u%FrsttKA zXI$wq0qp`+Jyn5wluJhk5QY z2cw259n-YQ8tGMwPk%b>9GOf1=Bsfl&#Uu*-~g_-!mY^-Jw)lDn@GanIHxrqqy0WJ zh*qUNu@?cI3i_`Hltf#WfCzOeY%X|B%7sIoy7cm^XZybR*WwBhkt44Cu)e)>VeyK% zzYIdnj+xU%0H-Jl5!R)Avy%6Qk}K6 zD_xj;tqXex)Q3rv6%mEF#?Eed%*k;7NeP(0i63=|&~U}=dIH*f)=Hy_sA0)oID748(wga##UcZjTpy&zV7Ml#Fmf#pqI`yv5l8 zkbq=SWTydJnZ!U6&@=%a!&qFm&C41NmnUv%T1&9q-JYwj)H3Mzj)3}6;fU&BPWMLG zLXFnqp|J+|Rp;AQb@R++1qwl{lsN-C#jC{@L}LYyyk5(%aLm&u5<2y-9xQd zr3vb)wjIy-=;HA6@>I{U%C*M$_(rE1ulfp~x<8N~y`*Bo1*sTJkWiL4cR`JN6h4O6 zFk=S$k+heG-hl$9dQ+_o;0Gc@^m#n%=`=C#bM^NiL{%h7y}J<%jFE)_)aRx+7tbxO zhkHJ{BGHf7Ho_JE@bAG%iI22~H+O`@j~8vW4&C;=X?M_O7w|DDwoyO}_@v z^4B!bzn@2~uiM|?d2ln!WXNHACbvdUARX)Nr0#MY(~lWFwJM}AVq?vB&ha^-^4+?n zityG2AdUa9)B=;9nWykJD5#-0)4(NJ|9 ziLQyR-M8~KJI(zWree)E8_`IvdJiBlEdCRKBL0T!DA^i=T{QEPYt!opko93k3P7~(PD=r zZAGB7EopD}o_w0;4V-hB)!~g(aqre0X@M}~i2LQgEl@&2z{!h-YE;ph;|P7YI;lFJ zR@;6O;sv!{PZ4zLJ}oV3c#W_h(X+psznHR!G>P0zHn@f=M83I>YGU4^oc}|Vty_hx!WV(7f&rFdn{CCmH=*_(AEmQ&gWb z%Ru)QtTWHuJ{OR-KS%b^%?N$2BdIzGIIW*3*~r+cN+Pv{|H|0V6QF&*nfYp^#V*<2 zim1iR51x?YXg+N#m9|_k8FNKiYHgWdRIUf{<+P|*>U~cm{4nR>t9FA~$C;TvYUEOG zFq1?-kbJ|%O0Il5Ic!7JWQG~4^$%(C0dDftQrvbl^!1J~0oytK0cWr#XH=2(K)Vms z++AT$IT~BwiC&yRN^fVm)DmiY$S=C&I=Gvi7IP!lvR&)7hJK@#%}@j z+~|KE9~=CiiQO_iX8~(IQ5`Qkv9dk=hIy_2jonk1xuiSG2+%z!h2-|igbxmd7eBAx zIofy!K6b`~%ho(XwrTK+2aRQ5vK~NOuEw*U9)?pb>>}*KQ30S#cfFOvVENsj3&k+z zCtxs1p6vRoq`%|t5sc#Hxm=IKtmZz0_-NA_?>0cVl`x8XvnS*8^V?{J?dgr1ru(Ki z!4C@ESKN=k1-YTpz4~AVoI3wBP74W14n#V^Z2g|LKa;0>IA$*OIZd*>>AhED!p8c& z%Lb}H-}31g+Dp=rCkRO94*T+zzJ}5k_pxJPbfv-9Aj)K?h?yGB2D0+RZ1!>E&B_(# zE|bqn(MU1^g5_Eg(y^ZyX7%MpcB0E)=?}Vo{~n028Xk7~e1%{7JT!iLysNVl#8p30 z1CqRgNWMI2Y1)M$PMSfDOR?LxH2!7oq02lp?j6}%4>b!&j<+W8jl=a>uQvM=sW)Bm z!XNzmrC&@ODF!8ZBsQ$V5CdlZHVb#Y^&UN$H!e_uZWF48!cJGi&w{Thbg2?FTD2cH z7d!9lD^|nTX#}K>4xFvk9?ZB;4iqrSeF>QKb~+h~5)ca-kkO^gy!|ZacRwRjL3T z^k=NFqSZ#Dn0H~?7tx+QTx|J@m0g%R@y>OmNP(iZ5A64tkvp9n&nL|_;LR_T-SOEm@poZoZ-LbX6n1*w1BW2AE;sHYg0N$ORM_M zXE0LZMVE^1od8|a;d>0}AQghvI6_CHczia4>y(i<=Nb*uK3kl0e^2mE6u9^o(9IPy zM2p(9Z0s2ABLW11<<9D{cvaZu+49Y&c6X4HM&xoV0_ktL)&tq?!44Eb}T+Mv$09`Q`~dBfL^N z;7lBrNu$mZ-ift8=C7WW?-CTWj4!e{g?8l=awUNgeCy%I!}r6iK7^WV)xeOBGhOP&kw_7*t8-joo}^*f!`g)KCu30KB(T% zZdEQec{HO}wFS_&6RVe%dr|S-`b4Hbbx&Ik_lsB~fnvsUzoqdT=uQsll zJ>SIQy}Q_cLCsT(9zAEOl3&H+6uxwH0{JR?{`bD*3uHK;FIri_LEAb&%&5lDO6M%` zbyp8lHW+2tcn{W1xUddrXK*xsC=)&H8#Ly^$_J7CRW(F7br#4M6g;(D51J5QwTdeF zIj7dB;9j7<%&}wP8<)Z!PqRbU0a`;~W-}4LvA4b2R0*pZyXN6*oB)%jloC5+H{ z8N-|aKy@~~Q(~VYiDtvVFVPyG84Je-$}G2&f&c*9Zyl+%DN$W_3F>$ zeEz#UOaK##GiaJ8y9MCIEv3oH3znZ{2zT_uoWrY?kg%Jlpx2F*$mfA>5(ZNnrwVqp z@lRBm4eI>TNdmcbDj(++gn(xK1d&>n1Tfol0(5RlO5`TD6fG&|*wEZgkmJ@-jZ*1f zJ<==q{)H49=w4AbEpC$NN1h9i`#5Me zn;JYXFC?!>=f_~`ER5f2mu3C~%+93~4!o*@7e$fhZ})SIob92i%jd(9UlBsoLrgk9 z#>5<6x~4YkjSydIK*}ygt&~y!7o2HbX6oo$YXNYN6z|of$hV4OLzx1ARahiSH=igI z_F}AVPgX-SmL=-!!6`Q6r*RyV01q_IW#Gv6vU6OxoS|MHZ@* zFc1++#&cDpYbfWW3MJfwr$=^vsuMsowP&K>tHebYOXh&kSv}qJ~;ZwJj&{S7d zW4u^O7&7x&eUjr&A6ISm(qor6Y^O{m8#_&}x`|-&5V=2rk9yaq-c>b8!6A+)gQVzY zZOqaBZPK?TQe4KjuQ<)mu0Aj_EZQEC@_B5ga=Y+`u~SBuzo)s)Am#I#XdrA6>+ENmWfr*+3k>R~pq<;^_;%^xKJqSpW9=rPYsD>rz@9hNH ztaoev{)d3;b9T?iI32M&>SChfG5FF&1RIpsxJ0BuRJxDu=wbf^Q3c#6-0!Q@>yroN zyFAL4+%wasSowQ*_T-(KjXM`@ekTbUO@kZaP({w%SSF22*PS`27kYmh5Q}M9zxAN`>`yFr~PX%VcEfNIkFz#g3!>< zf5$E<`q+jy&_GM-D#@(O)1U~cc;US8N*_Oc-Qlm#EaRd?3-qs{m3iXCxpH6RK8BKT z0=$bL*13jO9(zT_x0kwtOXVL__1H0b=V`Ql*h9r%qf1!YzjI-D<5k3Gj)!_Iwu3ZE zoPuwNnS&xIHLZGI`FYD1NWJfUR<##!H8jCRxmy0?ix+4jZrY@{yR$_yJrJb_%q1>D zrE|8pl+UrlmR(fW1`4}K?lXr|&F5Lr@&cFc&+{{#yhG3?XA$C`I+{F)nnDAVUlA9_ zlQfeJmz7bE;3)XytxPshm@q1z^U)_w#^q6IN;%jhvhw|oM8mTuP-PfOy>h72%4$-i z%J9p}wFu$)Ke;c=K~@v&F}6G*lL~CMsvp7he<#)8hM}^MK@YP+YL2u)N0%nA42wj` zcEnPz^T>HD@@I@MM~VDI z$&C(tg9L`Cn$|E2ceWeII=78NRh_vb!}YZ=^ogyenjW(N)cF|C}Sn zn3Rj;!Qd@2PR7L0Fy)ies6kK9Us5NSX0NpP(-@WYhxas@^my!<;NBhTPZHFfVqN~q zdktqnn6i+c3^4^ss)9_{vIj%ZkokV*cjD9~LQ#0UF?tfIXDVR6c= zUmmbiYRGJo;zbo^`K?t`UVuSEllOrRsi9#A$V7&>+Vw$dE+}X9BDu$R@V?bh@w*@S z`5NMO?%IQ#RNP!d_S;O~4U_mEI=}g>hwrC@x92eS^C08&8$%MgTSPA&4i#wsnMUqv zO}wNkE~#TzAi4eXrM;(qoTQ}eO3(EIqie+X=I=kJyvY)=kY~XhevAH`T_IjVq^PDV zya8?aF`-|WkbN3$`iD}9T=%*yz6$~_n7zBZd(B)X!S_1bAy2Lp!NR#E{E2`9bMOuP z0fCLee}TRrN-KuL;d3T`TdZLVqP8g>A0L0`^;iFleZ66r4Fgma{-gbR?5c{)Ke{TL z7Pye(#Xst5`c93cR-EnMJBmWHiPFNA|0*p>ev@3^X|lgJ<8|Htbi>Bq_4J=_xW+Z6 zZTXL)D}HPfSim&-cYUjqy&`={^^dj;u=_t7)Bo+_-!CsGd=0$i?4G;-K|+3geCI`wSqg_obP$b^oN18#`Z}_M*9hOG z3IN#&_^TZL8Ka#c0T&ZgQ|OLvaY=T`WY;2+MhE{WHh+(!juE_Y2Cx zsNCXLSePY8o{SZ72LHm-s4b3nij={3Tsd=DG;f7#V-B7fG(SQD-G7&_1m8#tpML#) z?fde`e8rP|+%ZHRC6HtTp2PW6-&{%&H$eJ2q*5cGWdkakR>aT0gkOtKEDxi*+>ROi zM8+PUU~cQx8_Y5wXjC2jeXMQH)M)Ni!1W{NC(Ol2kNU_+Nm*GLxl?+HYy7dZMFDXd zY;o{g#g>3pr}A;x#cLl6DZJk6xXOyFh5XSdRYH~5b~n3A#vj_38n(y_a(RAaz3nts z>|8RP1exG!Z&1?$pVl0ved2B|QgbU1fMFE> zyC+j-%xQ0}+!DehJ?#tGVS$e%+2XWX%bNd~E0Tk+nHZO_KL#LjLZQS_r1S zxTwc|2W|cgNybckm~{6>R_H!8Z`xmt1)Xfyg5Rm}A*@z!aFZycMirYxcNTBI31y;v zIY^>Io${KNJDvWmO5g7k0VaigcsUC2&T4Y#w>IEZ_iqfM!9PM+&LHRe9}cUH1)SJ^ zL=4=IWV3vd$VS~?aq4iJOv{~ufZ$EWzt;bz%K6dwH29a*=9F9VkUXeJZU$A(vt+ly z*J(QuVY`Gyq`Rw6bgEpIG*9p-P6nMuy29JsFTvvbZ!~-N-8_m-XZYZZ)6OV|qZ8#j zomSx|FJ27lw)gicDFy!0x@lh<8<;Jw@~trPE)S`DisBPGTz_GLeA<3bl8$P5#YwKN z`lHqG086Tvh6pp=-6kqYSDwB!ofdCyE2Wgv-0+Xetjs%Y>sl+Ccb+^C^Pu_?3)e zK9_iqik=BUUY2sF+SaCt6sjp%;1Z0^BdhpO`Fx`e^PiQU0}jxnrqF7c{ar=2_2h&o z&UnB1P{OO=N?kKMNX z$wIW~!R1?7bN%7Q3*f<8JfdEhUmLR|u6Bit_1l11U{Jp%1a`SU*grQ0vdvCk<-g;% zt8!ZC-=Nt#D%*{k4l}piCSyH32z=8={cEwts+oE?eR9i*a!u>4Oz7#uA}YK?;LSYw z*J)s}eZSj$=wx*`_4@#93K1FFGu=&uPS#(RBe7Zaa(nKn`PV10AxV05M>_2@mLbyk7bXl&N}euiJQp2$#b z@1}9|+bH<=w+_IYYshVO)+NLDhV7>pcHr$y{P1mrr)mhI>m|-)QO#!} zn^{nI1)wCXOu;hhLg@ zd)y9F8U4&wOcmzK#f|FhhTNK`YT5Ew3w;nPv+e6dt)~SnnMDt*M@!eYpEA>)ebYIesV=ndIi5jltuv(a*;D=XH=mE+sUb+q@4iYy%!n(#z*zg2 z2qrI{_WUgv$;~x(akSB?0tDQXpN8x(j&Hp@RyiHp#(1n! zp{Cj|mqI9-)Sv#1ag|^CPi)=JuJ-WofB_!q9~3>d-QP0_bn?aL5D7eb+i|+YOZV1! zq^Wq?3CtAv62j)LL3kxXd~kVBqqM=XHq?uLre+S(^mBj6LjmQWBHE(V4R@Xlk6F&y z$~u+H^3#xKOncILF&W9QBzn6LuiC#i;NL$jJw2By`DXtmWJr|%6pBzn0^4+iH0`)X z1_OWj2@H7Sf^p+B4f%|XuX?(sAm+$}N2&0-)#Bx+nM)xU4+;!#%Q&l?k$B%8`5iVf zgmK4>usaqv!f9$jCo$j+4~4K9OdRym$rpili#vE_#;$f$9v_i&x?U#NObN;mXEm!K zA?`3IW%0*|*`8%NYzM^1y$C0@!yo5?BhAq*N>;Z(dARl(?KTA-``7y- z5cf@S@Yj;1WwQ%o47mbdH{-aKj^4dg*ie#L?xcr2#{WVoF^ns#!5Rhvn`k~X&0;}K z@N8a$UAHn8+5MEHg?G@##IA7#yxYtUkQvY(X`UJ**F}{au+oD+lrOW{S6Y|r6s;PY znQfb7ipm|7l4+aHuYQy`p`ed< zjTfwxB8OEoOKnnKFRL7shP-uP<<2@tE~9BImVUm>q-iCowCOFRb(_}F%h$ooe*V0# zVYcPgpBhWMPVHEjo|(_OJ?fZ z-$MmTT2+u|I6}iyFS9X}CUTYSF2#e8bE5`&|W6D_hJ$1T|Y72hdW-Oa1 z*GmNd37GNDbP68Y1AYg*|bpnkhNr2Q^-@>jR%a61~u;v6M>OEOWr0u}wm(~T3|Ivd!@9hd*u}GVi`T zM{BaW_=_r&CkhsISnOB1T|qqx!MKt#IGEwWCOV2f+mS18UD-N>(Vn;P-xe8y49guY9v=yf+Df{|~B zcL@5H7bJ=zlHHZk3Y0FJWILqdUmB2p^+F#FsV16^a=4E47`~TLHv2QEcNj8DW%z!N zU(wPmNwrnE9`#^4D6Lt4`tX$&wEkngZ>uXnAI?Z*UFvh0S@~!q5ODHmKi9Cu9UU}glKX)Y} z4K=m!KtYFikB{=a1(!Bz0It$ikto5*ntHSdAgMBb+x7Z4SK1_vW$apPAA=y{uA42m{jP?_zlYBxdM{Cp|PaUZ2jKG6EH%Bq|~+eh-vr8ylJrEwq|I`U2h}R`Jy60KXPfL*uoD zcHyTg@kb0ZyLrW^$fkLr$(rM~uVpKGTQ9dXeU2%E(3_i4bqldoZ6mD*wR-M>$Tt(J z>^$%DqV<%mi_+RmFUYp;DvQp#%I~XiJ)D9T5ltRr=INW=lZ!1CT0HgBmQ6HX7mN$& zlp{F9uz625N2}~b*7Fo5D)>`4k7}QtFK1f4@h3EOb&9?aE<5-FuSXkB_bUqHhZrj> zpcK(3=Gd7QG(jUKLz?B6|6<|mnd$G8EI#fn<d34MCf(Ii_c4rH zf^NMnHN2p9G;B4?A5_vMuw7ZC7&@{M*Q-5UJsEzMYBbD*GpQXNm3XaIQggh5z0l7B z)SN4j{1W1RV&+|0CT1d1uDyP=lo9-qb_Cksi z6Rs>o%DezgmM@13{z6aiKvWq`e4|H&`%aH(^o$Gbm$6m*qO`+xvuAQ-_VLsinn$O= zb3V2GQ;R0LTPm^jl>hmgx`ko<_{C)41xADmrDRKer4wDI%ZAY zp;jz$XBlrJGeNb3ZDu-X+s(biXrE3md71_iHG%gf*XLW_>#G$T=}o1Pyg~7Cg8KwI z%Kdl}9pnwLN@Z}NHt|30c{7KR;A5ZK0|^b%0yw3z!M;Fgnx8xkWqtKkMYYrART7Ys zyyNuZib6DEjj~h(w(lE?Q!O*}$u%S>w0lz+w~j7)`P=x4j&VA{A4V6WvG`?tnixzSwCF5Ybw=xhCRDcZtfe&gH*^7VkylNZ7YH) zk(hLbCc2M?VUyRR*Bh1JteX}|?pPb1m-^4xKW$Z`F{#r(C{#;&skhtg?j&=tRqix- zDS{3*M9J!!@D%(GgH!}waVr(Lt)}W90l)DhBmb%Wbe*32wpKG`CW^1l6K|aG(hbsc z`?)t_Q|S!6cF~CBthbkXF*~O%Zov=2vyOdC(z$Q~?&US+jRy;V7?!9O3!1BSIecwV zVIHNKGLQI8gIBfzMUnB~&Zq-{sLm4SeT{mRR!sFzM?>r(XVcLN{b`49-y&}7u|i1A zu_kqhkKMR{hn0UhnUb}Q>)YRuL2pWv#r%g`QW0w?SybjyadY(%xoIjlrhYCM#h_ps z*zh3SZ~6SgGrwI*E@MX(=9C`|a%cv)YWiyZAFEXQGM}%%qgp&S&W!A+`aKo^5#S%` z_u$?UAw?1+Jgo#1=k*N)y+)F?9YeB0caPueUjKBkzOl{`1d7B6 zz8=pXJ>V}Lj@`JWLw(34R*m!M22<^hld z?}FgibcV@_ydB#@yB(iVjotKau(y_MZ=dSeO^LIwv}v~LHF}ucKPgldLLUOTH$^p= z5uoy9)8&GdWLB7w5_j_~vl~I;Z96SA#VMl%NP{Lz!br<6S#yh6V(RGy2xf0bO)eZt z2j>yf*j`wboln>seEFwi5i%jbIr&Dlds~rHLz`ZD4&{k5D0HTRZKApDSI%Zob(U3S zh#h1>*Zq;W7u+!Y>>5n1V4qmjx74qu`b>ud`vj6p0%XRFecA7w-m1f##M^wsolG6c zcLdsVa7T(r=sJIGe^%Gy0g~CX&cUxK&W!%UGBos@841WnefA}tnKF3E*ecoF>n4!5 z=lK*aoSo@Qjk$84U0zgPEAh)?+rIC!)i&FYO)BP#V=87F%Q<9pNRQFj&VBPjUCDww zg?R6@%xF=|B^=9#zCJ;5rGx{52r_>_Z$z9Ijx@CWQG$C!5zZOF!_D zo=~XS^|JcIiA^CYIQyNBg$v}7LRt=-ShFcdo!;?3Hnxg8KgrH}+p_eu$9X=~JmR3^zy8L<{uN~q_awc} z1=3kdudc)-bCWmg7c}Q-(883?@q+E9S2=xB0rb1LOPYUZmcA4AfT2%t06PzS2g0+R z&N3F;^SX%)U(v*+L>={?bX!VD;!J+IcWmH+hfN4(psth!`_L(5XWV4S%cjA*E&o=~ z{IU6Cif?yW@L>#+PCkjz{+VMFw!uwO?DCfQn6=$bonQ@6DG51LeT&3^Y^|1@B$bk1 z*VO&bpwhE9zaG_JtMaf;rLe_ZNf5-bB6z6@|oe||+ zC0#g#_n9I6g|}HYYm*NdC%MOP#?_Psn9SX*r{Z-o?H@LYY*$iehP15hOi{`saH0Ff z^Q~IH%#5?iMG7{CeJ_a&z5DpUuS8C>Lrfkaa7LP5^r1~dx&pKBp4pKbi_JR%lA)q7 zZ>A{9Ba+=%?=X$+toAU;Jg2&@V=?+MRuOxnc%~vYGfKVxdy$D)r7q;E*LEBSA=o;7 z#CdkeV5SW;ecdjR=rx??Rc%IgTQR>@@sby-E`hRPZA)M$%pO&TZLcr5N=ec#vb|JZ zW~5wdxHCyCTSCRtdp6Q^pifqp>NdfG=xm4EY_rcO-lsAkqY9CKXdqHMv7na5k{X5; zZ7nvNRSGdxca`W*o6z1Bc3Il>j2q%O&ZTlG(S03xEQ~+==DJ zL7ia{cOp-#E9b{>8_mh58}5|pvvwQKS-wSmj;c?W=oY8yu6tZNorW{LpWw7J)3tKF zeUoR)qVKT|P>9N?F=m@N4DD}kSQp;0Ag)JVF$(9=w-~EAiJ{fa+@i2fmo1MetV(?M zt6hh)pk32i<`V}e|I2%`fBo<&l5lUA9Us4w`YlafzPDi8=WUR@7L^sZ1Wt>*UzN0u zZi9KN6Io@r-qdpoVh;}8UDqW+U228ae67~AGVhWHhQ=4A?UvT{bY(3^9=l$m1nYzM zHQ3d^H>f7Q67gx&7nK)Yk92}D!N0w*hNr^PU!ZVFC@0wV4sq z4X~;p3W6FTUGghq?ub;xMr_{6u6I2yN*v?9YofNPew+%vTua8BTYF;0w7fQ#J*?n5 zEjao#p3O17f-F(f%&bq;W@T!bB1JsDJEmmfxS%ZhCOv3`M4p?3M`~|j^yV!Y1SUxt zuAiB&PMCeiw<4K$%f~3{jWn|(+6CKbx+b~QRP9SJVbg2~=nGLun8!BSasIpahi*gr z+8dbkjo|#_8Rto&0%Y`U%zPLY>XE-^Hl3EeBP8U`}eZ{O9t8{{RR_%-#R$b>NHR%O$eUmpX(owe(5gP&NAB*BXK+uK3!|olj&D!8RNzn={G+zkrJvc^GP_~JaX=ZjX_ypQViyUcX}cSVj5Phamj2ss zwLwF0#ZoSw27~Tj^ootqZ>@KPMj>L*RM{ziK%a=m+Fr>XFdd6F+l`wlU7vYUd-QY2 zT?0j@GR+`;rsqJND0U}u+5PquYqbTt4AfR{%uiPff$Qo@`RR%FEK7l+J|QRAkmCZi@wzwlzjUW+ zQocH_(|c}r1K&`9gcLbU<~Hl@#5>KIdGLn_KUHv}=ZuvvE;<;KPY-SN?C>zn!tFJ9 zm9R5gH!NgSye$bG~?O*TB=PgVYu86_VhKviaF~H9%mDUqnP?eoK{L!xF#y%F zE|r*XE*#OiG;342#5`5ALv7w=_5Wk*)715f%>S69XMzWf-+$uqyW}Ht{IHZJG65+b zHSsJ3VaM}Dyy*I7w=E}=whf=}vSAR`KS=V_CdHw9FkCFm+2k0gxO#;MEW`^;_U@z)Y@d0#x%qM&Ruda+O7yA*=x z!OIW148HqM!SWLcSsc=eyJEP9g?R+Zxr%Ij6RkfyT3g@%odg zz)lsVxinj^UD=vm`&LEqco!F2W@4$Y!hf@{nlv{swpXEZA4IVjZfb`xuzE?hG^ z{iJIwqPFBCh_Sx>lhBl?Bld<(%ZkEmtKsMl&@%nU&Bp}KUquc9Sree2kc$6OI0w+= z{{u2aNplxwW3c>GrNKkyigFW*T%;W6 z@;YFXy)kgLZ68*_6jzbJP*OP}z25eOyYtGL7)l6yVI!TBm%~3-bk?_Ve|wZh$-aWn zX&8)fa(T24@xMx-P6XgX0xX7a>mNQzfZtcgQPCgXx5VLh^~lHsFLY`o?AU(sB^r0v zxAd8*4*}>af%n^@%Xh_^2?(ZuE#3{wHMhkWOpe0io%?hAx}iOinY(%i>>-5t!Y7?F zk5dQuEmAbU>!~@PTy!a}DQ%vN8jYsi)^etmF|hL&%6B-?4s%#Mo!jx>Os%rJB^0w# zCa7Ng>U-M!TeWHzwd4C?wxS_^GmbMIQ}i)z`^VU!WCg(^T;89#1QX^yN(#&wnH7uG ztr(1+z;yrlUSgSJW&2)9hL#9A)4IocS4eWHEh+@Uuye7{7j12_u8GTlGh~~C6)lj1 zOA@<|q{!++;A?nJ(hz0GyBA<&)7E97aXY6X6oyN+{e8I*j&Q8qwljlPG9K8B)>cF? zHI_*UfXLIKr*l_lLl+-H6vK3Q|c1&C^&tfkQP!xQaU ztRFYM7O(2hU9EQKXQ+yFMcI4tac)qb$2acL*MMjgaz0KMJa1(JFoJI)*^;;&Ma{i$ zEr;GyMAS(T%8fm1{Up19l6cayP>V zX3DnK+0JY^9lbL7IQF}my_k&5Dpw)^D%d}b8vS9&56+aExVarERMxGZwRFAAgUOO3 zm5r#T%0B+Z>zhb^MujjXga-Fhj4Pa8x*q@zN{3ECNAb6wTK>2q6W^*xS?=h(Z4uqw zDB!zG*m3QzoOK3H5Rk^QY)^2uKSZ2=AigJdl1uAOcF`-a_UK`~-8*Sx!5Vh#!!jQ+ zJO*=rI41l01g~B}zq z*74rYzufhD7sCwy#u&xMf)iQSQe;^>r6XBi_25Z@x+$2#+zYmhbx7i;T6HZNMqBS5 z^Y;GU5_k`+`;vf}w30jrW7&ciZbMs94O#W4lRaXiYSA69<~*s8PoeQ1ALtPfmkzgu zJyB$@1O-8gJRSl|SGSq-G|SfWX}F!5unYNE>8*gl)BCOBqk$>>zmJB`egmk;5alb) zCeAT~VJ+3~aAK#cU%ZTa#m_tYy&X1hU8OwQO)tIPCB`6??+kGp-HJc0ddL@FZU!l% z0H!EK)JqAEa(Ft)Y?Q~=AfM9}0Oy9DE)iFcE-k{AYDJ49`|AAQxjT;HAPEH$E)ICf z#3ZM!bn||ELZS!zB2;PRV%DJAZTiIA7P%h((EU1V5Usqv7RM@HWa0+jRP{ApqX{WC zD?h6!F>2kvUQsq3YplS#hGXpZI3iIL5HKm~v^Swk>7!D!{u#jq_x9t&y;&-!om&%6 zDSz)54`ECqzByE;_7~a8(GEPJp6D;342=E`gdjyyU;NsJD ze`=A)#mB=*+Dt4pc=L&K0d{l0dizAMxS<8&q|Wn;OTM)aXUTI7aDL0GUt7gxzp6}R zr1j-6#{$?ah*?4pqvJ!;nKD{k+xq8w%;9gVb##1cGz~e!ROi4K{*xQW2KNu6Qvo?- zgB`k1M?TTS@f!f%e-mwBclP?f&9^ zurTgugBWglssDC17y40{`h+DgPVf+zQY^b8$c@O}nA8=|l){MxFf zljJLZ?cmRuB=>LTpDG?4m0CU9K8nwK%zCvo{O5bxSnd0>#Cd2!uv~2R^NwoM2)2^_ z!1367n|}FjjT6s>9_n@UvnBM~R_NDv*aKp$rw7fwSOt}u)VO|M#g??WFDaleeqjyY zH_;b(Z`m83!jI96PEFEB@%A8VTw@> zC(A`QFe^M#a{eSO@w9{%)|Kc6v6>c=_twr4%=bh3I+r&t1TM%FoeG~sLSAv+BggavTP)<-w_V)zuq`1Hwm&KW4|@A0 z%Z9^{M>RKMPDz@*z*MUa9}^jti-RI)OVc%GJBp*!UAg*4eOxv)HQGlxW&R7JPNJLv&$d483Z9v| znftyrc@Q!?$y;nybd82x+o}n%lc`e>EBps{y2c4L*O~;@A#eNfm27^%u&QhOt2SfZ z-o9aoF$y6`);Y6Uk9%+QgZx{u8-!Ifs_`tQrs`ZTz1gu)(&uahbbB4_@T*l21w|ij z9AkrdcoLl_hQRNzg4k5GXOnA4UnMn#`Q(!zU0=u6-nx!YIzKfBKEeNFvzBYmUgR#? z+e-N0Dk*=K^Z}aK@(C5Y89PgS0v*u~3DMrY=!>6PZxKzDi6yWnqaf=a(YDg1Yz@PP z`FUG>gT3@h4ZWGWIuBpQv_7)-I7*;LzIH&7%g%9-&Hahv5jA`QK-kTC*%r)nU6HkW z=!Lj}UNS3^E5LUw^hwWEYr670De16Z<9U;QE}VdTG|)@6$98C7D^})qZe4#-JIa|@ zp*wc}MpDoa6@1e&vWhi|%u3rdrT*f?0O3uj^zyHV2H>s;6hTznN4dT?Cvzo`7XG`0 zlAL&;bG?Y$JnLLYS7?cZ?<9l&ABMMgU+sPv7f)1Z(m8@wuFoa&mt|cQ2c~avy_J#X z3wBiL7Mb7g^4b%YaXON%8h?=9qd2rX^TJZ)Ly zIRK;o@shFUM|EYHQW|!wzyG+72h@B#Q8mXz;o?ALpbo z6*A0!;-O=|h?7Ilf|^T@o9`1mZ%bjg znq5>Wyd82l{pmUx=X9<4$?KR8Z8Q5W%Zc-(ZV;8-fu5|P!A81Hx>G=a-VOUWe-%`n z=s~rpncW&KK^@({$z80G`?CS2B}X6=#r5H{>KHA8n;_c+zg9K9RDIqu)QY3(E3$lL zG-|3&W}F*5eQACPG_88oe#u6B z;lD%l@FC)lP#_A$fBqAD=r8sfAQk|KwSb#JX?T87ip{_9|9E!Mzt8`##DfVul7}F> z5g)xN926a`MC9||$1?UXRD~1YilW2%MgJUgCA!5P_fY-!9|k=5&I3pS6WHwZ?T!yB zSu>2+`7kuepd2e4|HY=#02U~oV0DFws80@vTETS_Gd+5i*3!b z7-f;Kj^yoo#mk=9@uNpYfpmm6K>H2&=w_pa(@C8BFLR(nU;PsWLAHWc!R9a@LhP&m zWC5K)XsD6yo}}bn32qvgD#=H0E=f5PdD?Qdg|a1u@_l7|noaN#bD2Yq<68-<1??Z8 zx<1d4^K~r}Jq$`eIyI^}TCa(kEW_TFCfefqDo1k$(6eJ0K!A`;J)Z})ylVfmb}(_K zhgAB4DcWq)7A{P=l*z^5(k* zd#2khM6qSYGBsx8ek#<_eo3LoCV2l@mQtyOVUK#g{``&)!2Dv#Zg@|7L%^l13}n;? z1TJ`IC#S;(P%#rddfRYv0N_Q7f9*naQw38d;Ej>$nk_!)cvZWQit{Aj>A0R>o;Axz zdZn4f$sAu_+ryKDi3jWnE+rdx>C}N3sj(nd;?7i6irTyPQC0C(uAJ)M%eZWd1z!|R z1hM!5YSj0grhRe#V@m*Ge@e-hapgLv%bnucQElgMt!Q~rqOR;?Ryz8dx4j*W#Ik2t zR8GugVbF`B$P@qx{kZw-Xe0P=j**}8z$!tNKVA<&@{OhajSU3smJUeWr-|HN>P$?* zw3eKYGt0dsjz5ORxbp0GzkWeA@wI9`0|*N8;!JvM@AU+J5G!-<1-MoF=2@VTES;nH zcC~Ymt!47@8&ESZ^U3M7UfexirD}-gyIj6~^|s3vfZ)VlQv?M2_C^SccY++u(9@yY z8@ro{!r{`#&s4UI84!>;h7TI`Xx@{fuj0z z74j;+%^+4Z@WsD8ISZoT58lMFD74aC<{$YVXl%FsE`NEh@7Y5G*YNuKs9YP5Q-@J# zw4-@4nv6tMV1k+!2v32qW*O6FSr&eEL^qAnLhVypDorLq^}=0`QGS5e6<}p?g`neG z7vKv9bh~q%Y(;?)(Zq*|<-Rhotxp&Aqtju|=M|$|0*&&Q+e__8=ZoV?Oh|jV8OTk( z+hdUTr`Ao@k=TD+E#H&7RyCDptUe;LJvDcYTr~RmxpKdeczzsQFKO^8Yx9E+=d6V4 zvQ?57#p+26O^G1Ce~nF;>$d}x+MBM&0DaOW-M8tg(xq(uG8lgG>$Ttc2P;A>#IkX; z+}Gml&%eOlR-y+m7hCo*U&YUPwltU;Qipeu;Z|CFp>B+LmIYy8)9II$~AeoiJxTch1C?miZ>T{xL^@D`Qw8*P03zAf|R|NsYvgScS z7y*I%pAHOoC4?s0W&ue~msAkx7G}v6!|@k?4FqJY>~L=u_DPyA8aJ5mLOxm}kvNe}nQE(4~oRVUKP=A*hP)1;Ayc&$q+HlcznrOh^I$q|;6=@-|0l1yflQ zHQ-`gTt`d;R|3>D0N^ck(+37{)&h>E{++ZXh+Zz>TBv=qoWbjSeAd34ov!OFQEY)Q zxZq#H##Kk#G5+8N0vC0{S|&h_#)<(o5OCXTMs8=~@=U(k2M_Aj{`zmm>i=M%;s2$4 zN6zpsVarD6UnH*oH@52k&Yom%yL))>H~*!OMH2!s+5G6nhD|kIstLXeJ+iryy$z)M zfj``@<4@lHtK226|394wEz@YLx`uCwfa?>Wr2lGaV6E~2wrI>#{tlj!CPD~o2><63 z|5(8PdjkJX{xw(s|4qr8Gl%&qlk_?VXHP+(KQX|Jk9qzdcbBbWNkx8*QgtoeWuxJ0 zU_({kWj|h?0H*bSm#0vQw52Nq_u*w_+*fHNm2TKQqH*wi3P856$rca=)V=P&W5zdb z0h+aj9-yX`b`{&+<>7n=r&<{Q=8cdl9vkGS`6d&bJ@$Xr%U95qjbw0x-(~mGyTVHDwNB+45C-pN&-;fge13 ztn1Md-W7Pv2a|T4%9>8ggQ=UVYxuwAVO9*Ih<^)^(sY#-WbCd3q_kI-MP>j4Vp}#r zbxWHiS&Lgw$O-Uoqz9HiwmPbQUY_q8{)gV2zx^X0;5U;5M#zp%qpNxEaUKcNKa6|z z{VG8K)4!ILWW?ZKO7pjX@I>w)fH0=ailhu(dBqiRV)+Eg#>xIrFySWa%kLafZ;J(2 zZ<+rAl7joG3Z*asAPWspc-h}c>nsl66>@R52F`Ef=J|4zMoK9PiQJ?6JzwW73FH~~ zdm=R@&NUtY$;M5o?A-rg*qwUA0m5<3qkoUZevq7eKwCay(9Uf%ZTpL?Clw!cIN^b} z@n)o2rPW%G7$i*`zQyVfJ%vp4bMJQgdRoZtW8nz1i_vEzM*y*DwEy+V#Q`nDi~KPr zBJnz`*t>sd(^~--S*8O(ZjUSj?gc%s@~kuh^yTzxf||#=36jj}zM^2hQUdd``TKtYWP z5NNh9KF`O{Nm$sT`8n@rb)l;Cd2zc78b}-EFUv=XFU-;HP=DB_jnlr{@EZ*_3{Je8 zK#TW2(TA<0jiL7j$toOx$)5(OPLc~b1w?tlry~fhCa%Tu2noN4cyh;a%op&K*NIFT z5+bj*W zV?eM*>N7+#q~+A0V5SjBiRBH;hC2ZpKmXR(@?WrwYU0^p!-Q$8&DxcT5@XD-FAIK_ z)??f>pza&IOXrzkwQ})CVkNta=P9=b3OClBkfj6ulVi*hV}rB#`zpeZ4swVOr~G3b zdAZLtWTXn>?;fLRPP7|pC~ZLb(i1fi9`i&3e6l@Num|0ZF(s?AvLrHM1@W^%LnYY( z_O&rBns3Xcpr$4<_#BL@2TQqj!&uBdt8yt*`h)IPUs#oE2r18$s2&2OH0M1Bx&pj# zWdK0nS!8=fA?qyg4KB!LZs>qF@U%u^IR9 z5JjWk`FUV+9WEhKOdli0;te$xp$<0%Te8AwYu-h zMM7NwFwW%>x*~Vjb^teyQ_l?@YBt`P0baeL7xn3Mfy##)j=_`10JhaYbJ9SBTjZGpa>-lHQqq z@i#wYqnEh0{CC%Y9(qBdRUsntCY29zvzi8#(??s}`P|hJ(Dm^(fH(5w_*+sG=bNHH z!@Gcyp}_CxXTG8rwO+vWhFXi6;t2RHdh3(d)Khm%e4;9`GdYjk#^tf z{ch=pd3mEqk{!50<@bmu)AldKi~;y#BC?^OkUR zPsD@PsV8f{pGocXq>4;hK)a1XJ>)gN)9fiXhn|BI=1(Le?GpZ*eu391fAovA zni)Q8^>EpC&*t)KBAv2ZW2jfPKpOmhTG6akAL2TrIM2zS)J#uP$V+AZeL={Ml^OQs zI-$xdo@;koCM?r4cNy0+QV-mIDZfy7GK@L#{$rDwA-wK3dXkZXz_m#1stMb*O7woI zPT#{Rm35LqO#?VNzn$-1hP8KjW#I&+{jg-uaK0ga>-f53FQ446dGz&W;l@?!D)U>$ z?(LsiOM^QynqBNU)^g~m^h_i2^-S%5hg_kP_(SIjYNX(j8_j>grY=B5N;~uRylJ7* zJNgA!BYK|7D_gfV=KZr~>`=$DEU!kYB&n(i5@YARFI+~h6@$vCf zmpsLnT@z0psggwBLxQsNiIIL&6LW$v=+WDe(7wH{I5)OT z(+DfGGp4qN66#4M#7aMDj72vsV-`p(_PhhR6v<;k`aKHzBOfW}OZ)f1ly4c{8UOf2 z`H9vXwaiJoRWh^iZ|=6=5s5S(zOOzy5{#G@M9rU5rp06+8n6R41jk$66f{r#uVXx4 z=CaauSsbHcaEzpn=O-fRF`(c9n&ofNK36|w4c8PNc(<~DT5`V9;ren{BBh)HU;pVV z9k0zRX=x%mUSCnK4n2S2-=>s-%}&9hzpqAG(3D&3ez}{`N$1T#YJR>dte#lG1`Y1P z1bYwj5erdte({N#d^*bb;mVa`$3MM49KFetbC>H0MIjM#D~tH~>nFJm%;S?ZCPRfh z-%)dKs7)`z^N+g!$(?&6pXmd2P|bMCTK((ganGp5gM&}L^u+yp6Wev}eE zU2yi72z0|ir7*FwfIcWfzQOCBp2B+R9{Yq zs`rpYyn#c61UgdCt_1_phT8I z8j-w(Pm2m8(D9xX2#;y*Giy<6SJ0_kL{p7advSimiBOq#KM;)W+z}Dt^mNQau=Nr9 zO(V*l-t<|v1@L(IB6pUc2Wx8_a*D^fnmAwV3))*M>XjnD&+BYIVsQNEqw>8K!G3Ec zcH+-M)IbInqFbzoMCD#z@u(Igedbs?aX#$p=+=CWo=^Xl<4JGv?89j%)4Qy-0f-%j zZodLDW&WFW^sZY{L)zYef$sC*`Nw{V`Gspzcs7D2P4vyvr)zG;)cl272R40|-uc#N zqw}d)oLi#4AGk1kx7LWjej}bUowoM(p25rMM%L~M06*M=MP2kTi2N^z59U_l9BWJr zq7pu@dWZ;LZ#njaV}8X$B>cH}1-q-QsVRUtxgYUGml0np0pVW?!R`CU9SI-CRkRn&WMGw^;D31jv-i;^2M;7l z=U!FU)8>>q`khi8e0nsnxq|03^ta;YqqKMDTS!xL=$M&Lu@42Aa$C&F;wK;Bk?aCt zyGS$(Ftx_bV4?D_Bzybgp2?6-`^9@l*Oh+Tu;`_|lkk&|AN`uXNRtKQN=jmNCmTIs zl9HZEN4EweRxbstSO$Fmedv6HP8xF0Z{Hy9PNG%qk*6C${y;)TZGW|8JB%XpzF*yhx;Q&UJ=wml2wfk1f$j1_)IG{>*40KUZ0&^gDtOV53n~86 zWXiT^Z-HIJ&0ta7K<7v6prDhYQb_&nb#0>X^&U|2S%PbCU|*w`*mkn}jh##?_Tj#bHY|2#NM?W?b;^sbj-sU;fAY z$;o;}PHtYIkcbGRX;Vf$E(FloK369S6!HXPNq`KGFMJ|P`njv3HT;djn7*Vzo_+c1*Ps zJ+oi-6+Uh z7!4XU@_d%vJRJ58MBeB7xII(G6A$Kuc3*(!C>282P`c4 zMJt`nyKi(%ZHOdXs z4eKzVXNR*eFI-|HFvg+&+~%U~ z0QkV+e4U7)cw@9#`LAn4Z2eCt*!uB-yY-@Zw?5WlvcJKco~09L(-z-MF~gj0lQ!$K zIcWEpWIq4)JtwmyXp%uiy4PK)uE+CmPudhMF2j2yGdUMtC-5?|rG_CX`Hri_i3Cgc zx~h-n^XY`5AH+(m7kd^5RrR2V`R{24EG1e_6F9n&$`ti1O!1g=Aqn~%>ixY%rjhL} zHQ7HX7&UP?jsRO+Qrl$u;lP`;^bc{x#rU2mosFf1h^gM5Aiu_fsJFn4+eT~a#nfOu zYWb3@4Pv-T*pkbK4!lG9($!9?dq3#@GWdV4Xm{RooyFBA#$Ijukhc8e9bH^C46D$d z@o(BC-|e{h2e|2i?LX)CK(OHxh0{0q%5NgabMQUW@0h^1&!udr45qoxhHad-Qn(UXxXI>ZTpa>?0^wq<3}TsKb;LRq1n5H@I0xrP z9>G-z@zZh6N#8zLD01usi`PXA;=Itc)t@L5)~uByq-yB=zM5VB7y*Q`?zE?Oo3V~L zbc#-+oD-8Cdg1i+htK%n*lFdfGs3&Ja?;-{#N905TZ~v!VTaZ$-09H_=v?SVo|UkV zqdVswIZ&~>D_-xpr{AlrIK$_q6GW!tZsy7n(5m8;)+>sA{>=-=$esWX{{fgQ((P_5 zFD|r8caweFj`>4%9t~qh&uRfsZDB7>f|7+3OV3x%A7sQ9Uk_HgBa3 zVe7G{iJiE9Z`jB~-P5d~n2d4TSgw%9wzgW_{fjA!0%Cim2&lKGD5;iU6sQ>v&0TUb zmYHHeuSgLHCs%n^&`U@Yb2@VHe-ihW&skJ5ko+t&h{4StQ^WIlbu2^-tjt#V25M;B z1F)@jdWhsHntUI93e(Y(hf?W^{^0UE#vhxU^L_6xttp91tl|zI{%7-UBKWID&NMcy zfj@zJhdYw(&DG}5P+-0$#6SzhEfEAX!;ETU5h>(%3^{taWo&Vfl1{VzFBzOzq>QaoMG)d_pT2AgYdxK#7;-ef4b=I{pg z-4CDy@Oi96n(K4*e@#>s>4XG3FzTOMD*!dRVvJTopLcx(&O1g1Bp5RQ1xor(r3zor z!F8;^dQQot#G>sl{k~CQ5h6$Rr3x*|YQ)?)6U`6`))CBBxQ5Bqu#>g-uG!(XN`Jiny0DsCE7mrBJs$Nw<5FY0AQq``ucVLkdSL{7(gg zfFr95f=a*?|6K-8R(R{Di3OoU6G0aJzot>Zh6W~cWawHg6(9!}-BF~j2@Cx56r()%@#Hv7S!r}N>jx(-pBRI}w&k z%vV3xoMzs{FsdUYO~SO@>DHLhcPG)A!33N?cn0so_053A*sRo5a1}MpDGLc|aADYV z)-|rnE|+eP9)B-#V&$SBoNx^V?B8L?u=TBHYnm>76BbRVGbvmZz-lAq3vH~q?rBpw zA=9e4K|F~P1LKMCR0k%EB@Hz;$?^+qj0BmvO8qD6m2V(I_<-jSnii+ z=lH&f&qw90rbRwMrOM=DVzryeM~vx0|M-4Ly{#9-=+eVH^@yS_>|W`yvg(K&jncP}Km+QF;$-n`5u>g@?L!pCNq)J>UgYNVW??bB z_QpDn(M5!)0hiy1WpRQv_IX3U#-fj;Oe8Jl5s!>zXxU^!aRAnK?$b(X#GGfF+$gMS zF&&auyct+zQ7A$J$J|r;%FFxLd=Y$4;fwm2J?b3({q;IWTrPY^@P52NGR>S)u|~{B zSFI>PP=@c?t-d>kpgyPq*MGe1n{qNzFri}(UrVt+kmZs=O9lWbl=)xiR%6z(VQMRJ zb0!|Fa_#X>?yl>3slcp{zdbkCI-|U|^`6J4O);-cpB>vUWrU<{?ffS0`-@tR(7SpB zXaYZaaS#0xeg|QwXJis!FBj<@l?DGjT>Tddmxu%NwUe@)TKMbR3{V}ZR_+NmcnswR#faFn*J{iu4T{NxP6-A7RRFwGYtT2Z^Ib@p{$5Vi0)f2;}8;KgQEAD9Hu)HPd zn+`N9M=0PJqhZkbgk{pN^-d2h0yFGTpy74FCpb$z7Xb90bHrHV_<8D~cu zMz%eawEjH>U0a1#Z%vI50PK;2=T1PL%#u#ai1s z{`e^TcOU71GSZ%6dl*C1TQhWofj>I?gIy_urZyzykjzS3a<3~u0H?w|LKA|jC0zF- z>wT~ep&E9K9T2a=Vl(i`!jSYOlYA<{M6%Yp-a8t|B9WNi)0oz7F=59oTV!UIdlT$a zFI29(LB)?)s-;zHd}ltd$re$Rt|_x9{$;u&wfW$!-BDM7%{EuJbqJ{(*|U|4cn5ow z#vhe7wQ$YyPI7}_37o__F;Y90%&4j+iprG|{T|65+5h~kjwh;csqnt~Qgb1m_EE32 z=BNRbYA5EVMU?7h(>KeRO}~q}e)ptT>T(x|4*wyn!eOnvaog(tB>kJEuNq15nblKz z5vZ21#yGnxix-HaO(C|~p3m~@O7!pU?Bf3#MPN-PG_Qd`nO2W{;x6*F-~B1*hY_4^ zX_hdA(G=WPW5S>O;ViP+NuOJHPBBm&`;@;$y5Ye?1SXnpcCCb_R>bEc{*3d9;m zaz0O+Uc2+epiQ?{*l-VzJjn&pQH^l#Q{PKY8tmg){qeM-z4?{Ux7$L%!`1Y_VtP}3 z>uF^-V}pSzDW>$&00xp46w@}tAgi-7W&=)1abMwg7~jd=xJ<+pQfB|{XD|}G;OWN< zCBueQL_J;fqxpyB-=okG5d>^5@Z_W3N;8x2lB8MTyEFyrdPktfzJ@IP*>#PF*-czd zFY+7fg^pjzrFv{+WYYejR61d&LO1wYAEvOBP9D)5o_qX_dzhRI7DN3={4lz>2%45U z!)j`DgEOj`$BM+!$S~K6W|)VnjXpZG#7^dr&FCk@7P>6c+^er0BO4xx^- zp_|5xZIC4bSX?AD2Y@$PLDLV;@OYiCE85o9)uRI6C5*BB7@NCwCk!%g*=Rddhe8IW zHhvc3J{AZGH+sa$Mo{5)gK}uQV6HUOjSIyYAgCPbLL|N2p->nk$P7g7Ja<3?phg4i z*H{NH{6c2pydq~K$FQ>B<9VCe&t&v=>UO8kujR_IGf3}X$7I;Ep$@eDernT$W!=ay zC#>s-AKMNJ=|G@Rm*n&2w&$}LdeEE1(-!C#h#rYdIo;yb)Hq_;0X(`(a+f9>cM)(z@^arj;v&bt>7_O+Fg zzoNabSN~sh9X%l7BtU#7vyGmAR`HZ&bt(0T#*5TG_3~$#qJQvV$T?>wq8N{3*Y# z_w`{hveTyleH(+NsC0#a^%7TcM2lS$TNEBUViMCe3*ooQfpMYIDZjV~a(YsnmnzrD z*mA!<68DQ`ccRO#X%qkXm@|1JRbkIG(rMXf4>|N?6H(W_hsKOam)lway^M-OwF^eP zAKr*JjJoZg3lD^IX|aQ}B?$UjvZGdD^x7(z1(1sNno=^f9w_oK>8VrwBhER=Unf%P zBLX{2(3^;%RJC`#xTo^i{^0=*M)+(s1`nM}FmXhPJYFVqc6iQk7`Brq^Iv{Ck^K-d z3DFYRXw*Aamm0$ntwbcvw)5**!0#IX<3#*KcoDORQgUE25Lbjl%pg#W^%GX{$Ne@r zs0r7^h8O%qm`+d$tZTWrNqeNQSj?U%RCLly%~a6a*Y2KhWOiS0U1=Tcrdi+^N8lIS zSp=(LgM9u9b4CkG;n7{g<)6P!=(aS^pdTap=;d-gCOQRiT@MZI+E*gglFOw-LgT0q z7occ^f%(+&IGJKeC&O;!po9bR6m5g`g}-Fu6e56DlQ@KI?$e?E<9M&stol&kHLrGY zuc!rW=0pEkpx%CG%vb-IGl_BBxj_gz!?E#l=c9X2^5AFYU-!ya%H~~DmvRN}HemEm2gpC&csT8+m4qgR z87AE@#*I`fD9!W~_ljq%bL8tg3+;@UyW~gilao7*r!8jp$q8PiJqdwqQylzsjeBY( z);k-(AH}k$e&l9V`~J_Q$z$9K*5F%F#Ugs%NfNa6RGKgy#<1dPR~Q6ACRD`1{&BN9 zR$s*40>Xf(skcFAMa{_C6pWH6aVu{T3+Ndg=JrB(Yo$dO!6ffh`MWYYln%rkBWf=o8aU%Nx(-FO96%Vy`QmA7+cIo%9}9>2dQizXsn6w<~e76+7sg~g~widv%mF3nD&%@2A& zLl5HG7sf4>yV;1g|D9ZqX_AAADMnEHhRXDUqH@G_AFYoB6f%9W2@^f0OLq|7M*%83 z#Fk)O7nfwk|Kkyk$-9HuoKTE3AmPB9*Q z#4jo>OD`KhTE=D|`8#$F(zriqRBWYb);M`?*iJW=)I34}+K?g?QWj0x|JD21S{+f83?=u5%Q zTxnQ%%mca#LyQ+2VUr@FS<&Sbi|Y(ukY&+DiQ|WoEP8aKddFL?vr;mPqc_yX>epoZ zsf(uv{^)=I;N|-S$@B8tzoo5~l;!EsG8 zpuUl~h0^a7T;m4I)kyVRdJ7CO>c}?qG2th}*kEPWytVE|NzF^;g-&IFe55}v%Q#c=mY_6w4lCs@_+7RF$6Dih(M5m(iy~dE?Bl`J%=E4rd zB%4s2a8v`r%UN~K1TE0zomf$H@NJQSCEz&f3n`1s_GzxYaa{}dEb^=xZk3W1a03Y@ zEr(aqnot;4d5w)8e3Tyr(z&*D7DRY~K{Xgw&42-i@w|^rOX-UmYs=i&du9W@`YbYX zp_Ik-G>d1gY-_HHM|ugPp`ufD)y)G6Ny(%PPecc0WJ1mg)P4zvf%Olqgn{`VyEd7k zTj)cO19hk}RYm$0)@JrxeBxJQl-2LnQd?LC5EjLK{yp_+A_A+2-#C8M7M9X|q>rNx zgMEzK9PZynJYN5Y1bn?a-~5liGPUT|$ruE)y-iCthPEx{IA-K(+Q@>U?1LSnblfpg zs}>ey!rJ4MOWT<|-kF6-$gK<|5gWIT4tlqBb+#AqN}BJ6)|^qIhh zUnYf$jWDk2B0~8zAf_xpEDl>8;9V4^@v&o5qD?!XW&ozA3wCUp!#)Xa3R+nnVbjnj zjNAM`{SF6{IAV{5nlS0vf-|+rA9OBk75B%u)?S#G2-7MByhfxi@OwP!Yfn8)A$;q? z4GTO=@Q-nW^cup(5pN?|SRto9^nCuvW#!;A3cIr?YtNfS-T-TCL9SKsH_OF{WdGzM z7M=Zjjm+1`6H^|6JiR|qavD9nWtP0%-HSjB>goO1WxL*GG)I$dYxP-g&ja=#kkC_sC;2;0gGkDE*YD_`4btw7aJBA(7~=it%>}VV zF}SVMBN~g`2FjFB;RA)zlCpBG^_CAD}X`UaVf1Qls@l|9%WM; z6b>|tY_RCNv>gf#-H2DKK~Cbm>ie*Ql6L89@!>Ap0ImRuT(v78ViY0o7mPM#M8FP( zrs6Ir9*tJcanVwnpovTKQ2c!1i`kn;qCLSIx~z#+k)u*u*77*^^g_`@WzodJP)XL@ z=M|f?_Eg1sXmSIZt$oIS#=>S$M!RoYa%mg*iFHqtvE=oKIt6V6Lx3-TrXf8SfSR4u3C4Z{0 z^U*&18racb;Ff&+=|<<;KLRq(*vbPj`nk2wcbv7n7_=K&($6JYJQ3j!<$>k5#O9@4 zCN+{V+@%y9c{s>7zg)Jq#o|0`^7IX0|23)$fzwP?xV z9PYR>BY!2!Wtm9h(RhRV8+C?9dKV-7$4+G|q7r~-p-QTg_G}|eX297_8T9kQxk%&( z)6v>+rWqH*F1>|agRHu;>v>vTwz{yzu=5oXlp>EGR#w+SoVJ+(uh#~wq0bW!uc15N zfrtPZ4&U+km!GLv@(*Z_T+MeFW3xt?^6PJ5f78vSEo|6F=1rak$V`~nm6b^ibHg~% zp42e}=zyFM7wVZZW1t!YLN3|#p+fvNf~u`Iu$6WE;_QS&GX8@1XQ$DJzNL#0X-?{C z*Q_uzrP0sc$r{)Ieq1jpEDXgomzRkLHzju)l0zI!tOnKPpfmSRR)N1-%Mx{nWe2!F z1^#?>>M@({Zoi^)j>pCBUlS>t_O_(zKPkvuVksWo4HtV3aec6}=P*0FAK5{c5EVrc zhMi_u3=t9=xa5oQYo}*qHlg>|11r0hn7DUkFe={F`ea~)5s?~njckaBFF?f0zePd1 z*s4WQ+(D{cG9MFUJN~Jvs3;VLcrpnA=jFUf$0LG`11I+4m6Pb<{~myWnavjaegYS} ztqslB^asd&>tsFf%b{*~2e4_F`90pBwmilDtya1-I+Zm94_1G&oCVTueb*s}i5|-) zwU1Hg?`pc90{=!)uX(LY6_~kEd#pJ7{evJ}u6-bpcPQL=nz?W4g|tT6w{67=a1JI5 zuO<7Tn{AIadw+H8oZ-m#YrpNjqP}5CQ|P?g`kR8c^3C^b0E>$Mr<2>skG{gVXtpU~ zr7%O^?#=pd;01_6&t+LucNBW+BU%o=bTbR~DwrkWC-RE`O+@HqJ*V3X^GEOC%gZ+t z;3?znP7pHp;GRk}|N81^jk`ji0e5` z33j_arp2KFM01R4@%ateV+kV`QIAiYKP?J|k5xy)ad%O8bTj5NoyVNVcIi>Q-*S^p zP9*{QA_xOk*wlC-e4%_T2q#^zj zpcnnu{ts{X-{2P1F)u7T0Jw>SY+z7QErkQSvw%b7n1V7tN`aW78KDOjl!3lM&2m)W zRv1r|{VhyY2p;v7Vk5~Z*o-)T5n~&Ev%=#aGUNDhiIenmpUX(FP63by1+!7kn%=&d zll%f5G;hW&ytr~0Z&nNesudxdz~3;M)BpyIU}i%~I8!@e=V#zDNK14}&a`&X)(rl! za&rMxB-*Ae38|q~M&HN%I_IiH$z^va5XxbM>h&z% z6)*M@t{n2sQGgUUIF;kK9Js%4V{ zrsJyazf@q%uX4^!;WPpzc4qcPoi8G`mqik!Eh^+R@o-LdB|y##`a~4KFo4q&kg9&s z3KQ#IAo96LG{~T}3c+CyK}#3Gd{HO^jlaVRi8xpSW8G*|L(@! zf_DH5vHB4UQkPM4-d*Ez!LkbGr!QP|i^QR88-WD_w^dc=0TWO%^Hx5{yE#)!CZp@i zv#jm**nthyG~`Ce9y4}{_oM^a3NS8rEgQt_6^v^%_F(Ms@vX3@AG-J`JMPbt6W54# z+(d7Cgd)6;%Xb$69XFD(_|`uh^vP>=dQFZC7LXh!)C#UHo)PHi;cLsblugT(PF7Px zp939IusOtA>d^^tC307O`R7LX6_k5B4AUDT-(DTmp{+eDx$aqVY=<3*={P4%{JK<# zVZ`$n<8{iMSBx!x<8Im8jx1Oq%GZS({tqc823l2^I;2m86e%kBA0ya`(2u8{_F>aX zpHPK%zQZa~(}F;yxEaTn>8!z({G>5%mF#>>8g`KiqnD!6y|`Yx7qc5@h(aY1%lXd{ zQa>jYh=z~|=eeAyn+~}9gC9?9yq;*kQ~aT%nH_g|Loh!_q|Ybo`-BLO-1m7yh&BYP z+!I2kwd8&=nN}zbeH42L+X2%z_T2Mt383*Ngb;h-GfbF+9l~(|KBqu?5IR#fu4{is zZCpcvWd~TbLB`Gs(MM$q^AD+ghzqBKvnzm4;z185ia0YK&NO^x8Mxn-;JrET63iZm+k0D`h!A@?{+UHxvfvVr9Gg)Z&gdr|A(qN!dU{s2UvJM}}o=&m2 z_R)B%B$nC#o7FmZoPQiKPpD#vm(v$<0Okn?m#@o=`F?W}N~c!PfO^Z5WD|2q44 zwRoCH&C+b-pDzS3DeLv`F_y7#5Olf86b4)9sbN6%RdMe@b6=x_aeNG5Uhv3IcT_ha zp6e6J$xS{Kw}q~El~5oKCC;CPWmvihi%N{nUxKkNdIEld#zfm|h-$fVnWsWOGY9_u z7l67G{3MQbD#2q{nqGCcZ1{!H3P!?Iw47SLmiYkh&oLIG63lo19EB|2FjyPobIkgm zXHRlHu-4sUZ2Uv1)+$aj*-w{j@sr@?i9vXtv2$jQBQhG1t4Alp}W}+bCmRcYJM((r3 zDnTDGt(ykJb_>C3G_kR7GousrZ;QfO!E+w+ZM$%1ypS&K+siINu^z?;XaM(7BAHd8M zhoNSyrYsSq9!*sT6bLZS7Za(Fm%@_R?><&-uoWyP z|IUtIxuWFe_1Cy`^QQVifF^UF5?@i%g`0AHl1%-1CV*2)=5B;^O4#Rk+@_WvnfjX0Xn7; zIy?j%vF+Hw((ZI#awU=l98tzus}}PoBxm|Bj!yMQbdI6CP;5>cc1cKz-o%Kp|K5gE zrJRaqn$aGFV>nY_{Kl^nB}csNEm(Sz{1bdhwIfcB8*HLHeo>G2iV=gvRCn{Ld%}!` z4}bPcAj;UCg0AF0mC#b!i8%a`KT0VG94(1uke4@8lv`gi~0ns}}9VU9-4V*YzXR+PI=;-*$ zG?)EM0*CAl!yD-+f!(1nDJ}#L1fw8DBAqbR%Ton1lEb1AaO)pn zH&o37-x+VKja7e#TJgK9!erk>2|6!MmBv8tVRG%m8`CH1JAIQ+&6=5;)Oi0+zUX-n z+KB?%gp>cr$&(yIu@$?C;H0Il;i8^MB{u#qUQIdE8}2U)(k6*(Qgm9yrTg{mN2|q` zr*%3gF-o@TEB%D;N&Ebb-O@8R++j<{#MTx<=_Pd3V3G`dnF|GLU)7z^)ikfw` z2(jTP(5trM6nCFCxWK(W5r_p+HSxPaV;dTjf$F>cOv5QFkrmHfDQ6H*Zgnxk-l?rd zTO{S3xg&bLS?E|@1nx2E5I=6o5aP)V8A@Qaq4Y^vj>cw8e>Cf=SWfd!;9nQn`pqBy zF%B*g|8hM{NUj$XZzVwK)MK+Bst=#D^?|DIH35vZVR~&Z^$3P9m z40Jz8;LQ@vH2gG)=hC9=Jt;&M3d%Zpl3K!4g@;#vj&Q>coAX~$jfwhX!K%l1+Sl8W zR1%pwQ#6FHQG1E<*RY`f-z8(~PRMnRU7(3Qx$cu?W)R$Yyg*~7o$vuu0^94+n^pgj zhfu^4P2+kFnKxqGa}8Q%w`R*-##;ZV_AfpC@C*?Vf>Tn0ajg%3#aabfKI(ejvCIJ< z+QHIz;R3Lahky4Ga-!%HwD;P6tGpx9qRvGvEwmy&A}VHcg-~`aL%Jr69@oAZ9xDFj zbM8Px58s$Tvu7MqFmJ>R>W_ls2-&jJG3j6^qj?0P{xa!0YL?9O=70MNh7gVL01bTPpJQ@~%Z*8bRmm3^Q(uuE|4QnT| z=F_Yv6o#zF;{P4`HnFbH-ag}5iOa-&OMO5nZIWDEO12p}dzV2i^YcG*gyjCjaqN2sVCzVG*LVy$Jl`r6Ta-E(<#%+s`HPNB^vT&ez%HgKLg?0X=0tPaMaHmWkQ{dPoh8s_*tLs zr{^#Ax~HH8`nSNj=D{u<>1W%>?zbGFYaa2 zdcGyNG~$QMFv+AB;g_u-$1w!v%7BlPj#<+wEpEK~=`73dv88BJ_R=kWsk5D#3A%;- ziwfoa0z^8V@FM*{`5lh-Q-9vnwI(Y`SOm(Te^^AmCQyiorXO2QX7aFN0^KEHp-##d z_)6{w$&_3FT9Sx6pcA8s)hmub$lCw&A7OdQEqKJLH!QvF5?4x*$s+Xw@wIMRDI|?k z1J~_Pa)l^GowQBd=~4C688w!%pb1iVxa^aDtkV_pK+>bkZn!D5@Pd}ie9M&yzz2nI>VIaMmXT}$9mz)^5rF>v0lib>?I_!9W$vvvPJ z3V>gC$xFPP|Gzu9FQrXNN{aTtdU*`3%q!hZRrV!dhkd#JKVMMeKWc&`=lSbfN(H99 zassf>UsUh^%^#EA-5mgu`Pz^$UJkfRXKM+}_!m&_YKsBks1 zB-1%UfRT=~^pXe0UwR7=M}b_f)qi4;TI&lhyPDMKY@c1z>`j{g$<=zim)`ZY({r$| zvCm^>9Ke3pkqjZTS!^$Lphl}s&wKW#d_2{Pt$K>>Y5Zz6j?A6t{uWb_{J%{?OGjt2 z9#l%6DQ&fe(d3YpgCq(tv~#^ZpjA+QE_nySMB4vPR?+A6O{)u;d52ps=oykC-r51` zlafY+_Y=&Zv>*gEkmQqgMh|tB5bYNUi_ zs>h4+@GwyiGqde7bFETadOtk5D<$cgu>OLc(IcVgVBka&oUK-%368vQ%IU*u>+f9; z>b+~cGrUi+?fS{HZ5uyF3m@%)a5b$&L}F5W!fH!TzF&5xXm16e&aW<6cDBtzv6-3u z_9bRT(pd+xtxy3X*rhAE$%ek5x_0Do&DAC?$n`Zr$GuABli$!%Drp<~`1^pExssQ6 z`m;y{$N2e|Bn4$U{wt`N-wnWwp>_ZbK0w0q`BSIdZq7uY+Vt2+XLHjZFV|_sK`nzn zrm5ewsmjt!^BtD{OM&4!C?f~xtBjWfa8XbT*t*{5y&aaBpF(h}^gO1K!we z1LK{LdL=N?BLPe&`cEYjE9i{r*UnQp;nxP;6ie^J8i_SN`qVan*|R66zhaCA+(3YY zAl_h=64QH0I`LKu=Z;qyJIqR}6GA7Mq<-eq-wKzHuwtG7K}Q$?9G7>u7P#%P*F4#SksqXWps$ zo`>*8!|~*+@Pq{NBYCAYm`YS839j zG~vJ+NMbeqZxQMhk zSj^bnJUp9d?M&@;e{TM@WNhK7hX?f4kM&?VQSr%H0mS)YeB22^Z+FB}+P)Ibobe1T zq*gTP$6mQo4tkXzPHzvKOm2Zpa1HWTll^M(LN|d#Sy?D#N9F;l0n@C~)WVu6fLV&> zplZPy@l0GRR(YH|{Fjy1o6cN7M>nni571e#1%Vn!rVYWlG+zVHRW|V(=ctBcJy=#d zV{31LqA-|(Os2~HjRtwij21xFe`O#2H&F7zZ847OSwN5!(+RQ4OtZ>FWyrYgPsHVh zJby&wZKr%uSGcCL6}mK0cg2vcQecmM{7~UrTAT{(&M~yo;`|0K+gJwkj6xXt1G8~G zw>R9T81l*X`>$kN9SslQT-T(Q@&j{46$T~_uM#={h39wANJJq0!k8`AI#v0q{Vx^v zNI3K>+Q4#H1%Zl)n6MoAGhetSlC>}bGrfNOM+4?ypOzP@`7q5`~-sQK;<%kw|-Q)eQb$NiP6 z^UuHbux>XNGJsE?+Nug8-LpuB$3@&hHzK#>QUhw98Bp_>s;b7tQVIM7QtR2_=e=qB zx3`Tsp-x-ocPq~bEL&wV9$TRt&#_;vpChGrtwN*#Lm7$pf)W7tb?4(}^>>1ogND-B z8P9|wPyY%SLxECOB2EPl`hvc5MA+TQ90{a7OT3&haQx?gU~e5z?3$tXTog2)Pk8ct z%Dj}x>F=9xq1AIIYx0(HJdpOP!qYp|3;XV(D){gT`?0{47#N!AD>D)&)O4gFb@P_{ ziH3VUN{XPxlf)-GdR>13b-uyBsQMd_550x&pw|CuYmhDX&Te-2YTi|XU`#5zKYK2` z)eP{wCjWDa#Mvx9f>PEG90lV@r0`qzp0~%(E}e}bc*{Dv1$P_2XrT|aHY%R1#sZ^W z(q(?wkU*;*^Vrr-KEf#sItxD58?i3|I)hgEKXt4Uoraqa6g0TpN;YaX#hB~881No# zh)aiR?&kk@9-9zl}u2w|nF=G?{+sj^%&4 zQ&amo+(g^?{0Lk9^z$OZ{~~=8QU9_l2<9G2-v`U#&nI1!hDX@vcCgdD8?)LK1N_Za z4tTOSjoMVkAQ-jVpV;_++gotBjvsPe{CL{ya?;*e2wWj4O={2gs^rwgS*vJ4||`m1Ko%)eD9vu%~Iy_o320m z9zC~5ufrEWaOO5#a+;xnyLufLxkSqAH~2xjo2Tm@cY<`lf>RE>uv1l4ZxJ1z_oC(l zNIaj2w70&VJB-otdjQq9xiv;-AIMjus>O^CjApy5?^KtRo5(*Gqwx6d(mnXR3sIpB z0)r0(TJnxiDE0heFYg1Fpdck7wLnm9UH*n*xFt7~Hr=LxCjJ1yCaN+^_WJAF_(h%W+N#aKL<| zR~)4xt$Pfj+xmZp&FLsYk$reu(_Vcy!AKL5C9vLh-nA~WDiGZlzSakRNFmx-s>2FW z&uBg8H@q{4rfq}EG04ADm4U8-Nww)hn)`cE_@YCwUn7sb&F||r`pCx5j+=Xi+EMA# z=)-lD8_21oUbxDqt5L~wRUz!es=}6R?Qu`gtBh?TtsXqtKrX=ZXP9rv6=2*rvVJ+x z?`p&Nl0@LdliuM!YIc&|`jCR|M2z|}7t*@;v0sM{QfL~r;83acQl^AWK zv+ACWcjimm^AFO4R4HN-rZ=G9wU;h9RD3XiqWJn>(&EK7%-kx+lVHj1bKD(~pI%lSFAW$Dhe{%hI>#UH&A(Lo65o7s0 zsC|A`p>4bpmtObuW24!ZlGpbyEhyK$r`_4%4M1!^`Y-Io%R8*~?m$*YFdAs0x!Ek- zDcSBr(E)Wc8gxVRw%*9u`M6=I8ywa_DA9FZeEU~&XT)B<#)f{}DSruCn}4Y0FhAa! z!6~d|*vlKghM$1{n;wb-ZX>AP59WQ_ju6-JAohfQ-t*h@D4RSsb-MLM7!x+WmH@)( zdY--=a<-@Y&L};sX2nzY=?1(IbGs;Hdsb4iGXPTYmBxUC(>vio?X@1CVS3l9N)BtQI#8`dO>g4cWX>a`}~8{l6>GoDJ|iPvtbQsS@5 z$4QQW2k=%O6+XUtRTYc!Xz~_#jN~k>93 zzF&v=ur2ub*zd~(_>R(X#hkZb#392YvhI4mmD!CU65hI|flt1y>}#%b z6;DGWb&y1ouHoyB^;t{=t?2YJ2ilWvSlCu6oPfPl8ctUok(Y{Psfj2iLc_osEFF%2 z{d?khAmH)seM2O2W^ksgPSF$ne}12>xJ5rTeh9pzyfq)n>GSaL zNR_v|-0X@98S*}>Tfk%0=lA{NyvXac-fBISQ(RnZ(DKP)wb7;X%WI)er^fG#)VF6- zgU(hw6Q}*zt;Y?pm9+5K427N6h3T2oZToTYj(&HAY=vuTs<7%*7j zadE8BN;cj=~4MhuVM26juh@SVuF=L}lUS0%x!4=f%d_owAA&mr6 zUe6nKkVlcXOY=`2AKP}@pRWh$Q=1w9PjZx^;Ip<~^%G|bdi;I7nV^sr5GBJEbBvRWAuFey~zjT znNkE@_>!^;H3jPn6de%8=f z3g-*bJ6Y*q^uu_p^Hmm}rCf`KZRl6#)Ya9+?9f9^S3c1uM1U#5JPZR;a>DBnQ^Lme z8#SbGa^K633KnW=4rUqG4tohL%H&jK`9A5x zW*ZwpB*o^kBii%ilKd51703*BC{}Wt?U`3pWbZ>!Wo2C7pOy|-3&{{%q9u*349ye5fk?wKb+*EWo?#pY zjm}#Y&&L(6_hh@2Z-YLThgvS@C%N+nH+?b|uoTYM)@61Sa+#r&_&TOZIb}UtCyaKY zYA%k+7FLFDjx@4)92Ziy39 zjMb>=YCDn*DnIXnEpE=K(}iyOq2t+4^f*&K|NdMEGj`?5i{!aTt)N=bRvnAg==h|f zLy;PrT`!p%zx$g!C%7rq3NF?n9w-QZf1mk0TwCnBO#b|6HJ-shPj8GvA-6}l1*eoH zI`)ag&TP8Eux(g2L(l`-9EL$|SPwc7&4Hll$IqQUaaQelkrqqO66*!(x@$%#l6tMzqB%LJqKEz2eW` zjUv9;-2jO6e8ZlFJ|6Gtr5IOy3`;(RGx1#i-FC>U{1Ru6A80>0u*kZaQW`wmm;GA zx(?}#1R~-SiNMXZNOe86yCthE9m~>>;ofrkD9|kTADp&Zj%wk$QnN=n!*~s5+v-7o zY;THs_#nBM92AxgE#^9@4eutb-K)Pd@~}`rDNTp!aiSSq+6@zlOb?EHsnt(%@;;&< z2RaPJh}3yqNA`Np^2|!T=~`_=Xp){X-UM0#e@SI(I4y*qqMHG$Is`{)MX`8FRw^Tk zp*p)ZoFG+OAATlh9amEr2lI_7JI=j^3( zPZ#TGA&(&__}=&DEMm82SH&eI_$<2M{r+fTa{oVDp=iWF6V%t&Z*|$}FD_<0qm4QrzFp6=>9d=Ofyz1a=?$NY zwxgMXk&2N$qmIX+@c6TpPanj;vl`?pq-*Nw!KS3hEjS7LAxxJeYc?D0er>6ZM#5E) zG%hQ219BeQ+0j%kl|{VG=txT`_cCh1@%OQ_yFlBH%m#1!Hn7a9DsF>>Hdr#wqO z12%F^nRGtqIqljLQ3dRXKT?*V;aWnxHhsSlLW^7O3dQQ{mKMM)f=HOhy)w9NX?t-L zZbuuO**-u2qEB6`)ci9D0Yer}x89ym*7k79o%81RN`UW9G@t07O*qS&OwVfY$_^q{e&&F3Bu1j-cgNtT=n0_2N{$m};M)>EV^wS0L2kK@_9lLZ~5w8qaj zw9(J|d>z?$U%$S&W{>-x89+J6GMxlhf;f&f6OrWX`EZdmv4Fa&1uOYUyl;xeVt{VsdtM?*`d)keKHEmdb^%>VF$Sv_ zg`;k_k5aS^O-Q9oGuHQu^~)I?rOl9+KLL*$!O~SN4m0IvrAssI>+KI&&kuBF{r)Zp zC0ReDWg|yXQfsNe{dz3qN~Ef#amDZo_k@`jPc0c+*3Az6nO?KXXnf2#ReQ9`^QJdF z{Slei1(2{v(pX9HVmt|Ui2Y9!vy;*GWKw*Dw+;CSpV>`!V18v{ij@UQziR3&Dj5ne zZj+h7O;};Ck=Lkte5+oP2jDm>S? z^>GQ)-@B86s{6VH!G1TqU^EF(zwJF{K z|2-N{@j2KbTl<`fGLaH%XOl7YwLAR>&Nv%9*8i^+`|qRvK7Y9r{_4i0ITFF{IrF9* zZEH`rk6h)4QX{W>7E`d)Uw`3Nw%;y%=L?~$9SP4q)}Pc$lW%oFAdr^;WgKdgsQ)YA zsdMdYW%}OppRKLJo);g>CpWu-bh5j|`PIVKij7xV*GPI4}Bbg!}R$SK2G97A4a44;XERtxT>pnuYvy zHfCgH9bfZ_W8!w(AFZ*PfJQa??xhtGk#6`njdv5ieVdeazfEv)hYZaZ3bkyBy*WB> zP*9h^@L|h*_+7?*E@$QbP)^w6S3UWp3O#Rk=~uA4JPH8AM6Vj{r8VY&P2IW?MDWolu4+63RNbXXWpv5kXXT-}q9Sd|N@Q=SvmNeIv4qAE(oy}2+dYJ<$#bmHDeKCx38a;U#dfc4FD>fNB35S>(kLq! z$3)%A$L#)8c~D>B>9A5?cKJ!PK}Dl#)ym*BB}XvXVaY}4ym#k!I9AUU>hvro3Nwb@;M z3pf;IdurebVzOUoYX?@I8G2gGMuHyuB%_Bwp;>G3>~P&1{zfBLnZDlUQ)8@+^pKWT z+`OD0fkRhr&{AJp%e~Nl6DDON;o0+YdcJikjCNIoyOsTy0zGY zc6>t(asgpO;%2xKt%~-EHTY356))l!=MWb0gJD^^gmwJhEaHF96ML3orXLmN@bS*> zo{J2Eki&vNAdM_k(ni-iXyo_uyfvrk#)>i~dIqh#U`xrhg@MC!6pPaom^h(Km8qq; zM(f1=D#jK6oGWrNTcV93q893XPaCyWs5vCoV1MSd=aKfYq-SLuW5>+7T4kk3+YHW5>0NoGIYPnE>i3U@MgkcU9m< zyt+CR=z|t=^nG!WlMg#EY$XP%?qix^eC- zPmT@}72L%rdgs;6>#j5i`j%C0+e~VYyjfi>4hG#nQ8$~=s1ZU_JjVy?6W;UB@ywQ} z^i{78JW#33IR|*J*xMt!Uh}MK1s<%&%9W`vC*dgNDWe}(!`|a{zYALZHVNM#O)D{G z%?|*ZSW~#{pM%J0KW82K%%~(blwYGSpQpEO5B2wZLl?*MR2irxJ_*^Z02}9A^seh= z_|e=R@gVv8_kld>)&+Ym>~ISUi)#waCh?9xeQYV5mJ|s?rz;H=b_?YTAYgQ;iJ*>wH6!i(G-rTUlL*H?%4alj(6N> z&+PK%a_R8m_re2Cxqnslz;(lL7JMCyJL6_n;uTjh{7$a{PjfXV?5@2r(wP>kuu)2z4 zcwv7rpIB4kM_aw8@S)_xmUuiDrC|s|JVMqME$hw zVTE1(=eVcYXDBbz`uYjoL}@xy|~c0F)C&DwM3dNT{J*5CCfkFyq)CO%3v> zX2&&Xc8{p9Tmvqo3B0nP$8qo7&4gHiR`rXRs6MeOiJpg1)3sUNvhr@sLhowk8;++K zU6zDszAGj${ONvD>a?sVjTosgBLHjj5SisEr#`O@*S^Rj33eC27cI5Q+KA3Z;>-gLomC2IE| z_FVB&kq|Z!OM2IL;SW186lw9fV7p4ldZfnT{f2uriqe3=+MCCjfg%tP&g`SqfcouT zzfjmu2H6-TW8~rTYL$wDlcAKB#jvr-svH}wceTKFE(MlMNG|HTir<}2#G`KDwt7EZ zEUV17eQu=M+5y3dN!ucIzCbC`rr&yE{}MzXlvYd1WgC*Az3L~dr>4$gk{UxK!+=Ij zhbPYeWbFtsG+Sq~mY z+=CG!em&FE-!C~A1!2DE>*|wAuJkjLXmC8U?Qs?3*RQc01Lihh^lLZmg97qEg<@gw z{wtRTJ(VQ0Q1yYNT7k?7QE*{6)U%&;O>NV@IY)8rlL#}|Pt#e%ok>3xJKDC@YU0PJ zXbV_y763IA5}}hL%gf9DPk$ZOTT}On%56Hm0O5E+P<5QvEUli&@3P(E)TW}Y8b#6d zd3$iGreJ~{mgWEV2pD}9DvV;`zhI#gup0xL6a|l2yV`tcwaJa}J8X}D!g4$#0+TZ; z{sa))DVacRhzEKivPib6qx8gUcBFTP`l^9%8g;)ZXe4X7A5FhCFhSo4czJ4A_b&PQ z^Cz(30s1*IGE!1pEIyZ_efs*&G}`<2Fz}no{d}2TDbbs)up2<{($LTVWlIm3>E3ZU zt~LT-S-;Ua8@Mt;p67{K8M?{wmR%WIm#=eVlf;7FR>KlyAA>CH(Ya@{7Bh^0}LDOLV!vp^RB69_1e zhlQ3h#Z!GAjMsgywYlXeD>q3~{;hz z?~GffWY~!9sHFVley-)wy3uyO)idC?J*9`m8tw2(C?^cw=LB{OFX}6-Bkav2es^)u z6&!$1pn5|V^h7PSs8*m@HL{%|gvF90 zh}DBMw6xsPUN(a;mTPTpS~i~0&n7^tA<3GFW0nHr)p~nilz7$h^8t5p=jWb&<_nfn zZK4A$#$jDi-$(vGSEY!cfnY=LqhEkoFj-hy3WmM>84%ltUWm&vU2pB!^v60tfPV3G zm>VlAE8FPzVS$_<%{pjbUmeeX?Ag#vmVRh5)GzY93pkPazxsI`qttJ8!~lc z^FKJR$ZsXzMESZ!<@Hc4QA=>W|Esy1tFd{dtK#6`K#zO8Se1)u+V%ANUUw#b@_yCXIU7DAM8*JQbV-4hiDdStNwswjJ5~?VpdN13XT$B(g zfZ}eoQlCRlup&W;i)>Qc6bc-L>cy$)F6Kp&rD~j&<$H~!b?SCJTO^mv-1S53`Ogl} zrHp_zS6~0>bg>FBLz+IF>0Ye20fLjp4k&+5)@7Qwi16cCVlQIP125VwpU$EPxe)oA zzP3zGLlG5<)EUWQdoHxE%!QLGN8MMELvec)=jIS*&RY(}y-O9%!TOQJl8b&c<@vLXcD7q!uP(-?Wf$ny~- znGDMGgkRxwX9wIzM1K0wT!vf) zbMF#b3*!~YsU14v@Y3(Zu9H!*fa=wKvdJy81pi|E8)d}r`&^&%v*u)%2g;kts_V1q zno7w_)=VND5l5A#nsbl>a$7j{CYm1%1E197$dac;k|oLc*X(xx zTfU}Le5SpKpX?^r?mzWs9v8aQP{b7Ba`QLX-O;kBts1-NIfgf4hTN${6$~ljYA(zM zkM(OeGg=oRxs8dKX-Fv8IeG}7`AMx^jT(}%km>~kx}pZry9jSIKR35-*Rj9L^Q@2)4{; z-`xJGLL$e9XkxC{1&hlfubn3~@beQ1q#=qnr4G&~xif6s(eEuArTeA>kvXnPG%LuF zWhQ|3;xK$GPjAi!CrPgGqK)ycJ|!tY``l$sYBJ$lIPdSJ3>uwurrfzKb`v-e4cB&%O<2|d;QqCF--*B3|2|~iI4x^q!!SpukOuZWS#J}P z$_KcfPVyWe+S1a}0C+|!=HChw<}LPgo-05*wq6f2EwYq3tu|hbuyrsqGByJv(|D#3 z;07S|AdvfhSp-}>msdicuXkHN-x!CYA2hn`#LX8dk)LMmAEK5?BpStBPkB!XmP-2@ zi`dPV0)th#Q3sh?VBoa>91oYps)_RtzSseFTq6hP4Y#0y}>8nA^ z3Yzy*#Z$VT?)Mlrka8Z(PsmPI)8{3I1!HN%$Pm$o-Gpq3Fjm7>f*lf0^Fe$g-;d1V zYfbIHm+iFW!q7?i-7|$eV;X~})v)yb$zBhSJ>W{TSx-^Uge#@#}*EK0iJ3E`*bAVR{-_XC^VU0n5q{%+OBA z;j3ynFhQ|Y?v}ft%puC#B)w{wgt`#HQ0^d0g5grSyYH?6Ym`xdAL- zmNZ?b*=s0VDfDTD{5gr%|2c94^{oghaY=v-m#*a?NIJf6J?)s;n?w@ z)aj;46?JAXeX6T4ryq=+Y{+5xsijQrYI#f}F<|2Eirs6yOj;!oFzS*6N&+ejFWO;_ zX4*wg*276pG`hMfj7jg&ktj%nlBDzGnFwdq0vizrM*9n~IJp7~@g`^Ppt(XtDMWR* zg|lmtJnMNWm^?yAZqjnIp=04mXoN>`+uANF8pN7+iMIV)95{qtIY?NOHHxarrTrl} zdM;{_0;$Dc%&5WOx?I`Or~-E;LKOw39~@{bc>*4~L?6>gXHIK#nmWcD57&uTcb1%2 zpN{Urlgg27^!=E;y@W3`gOPyw4wxhPX6M3)(iJlWlb9M&SjyK*FaN=@Zijb_@cQZ-0taH^Xc;_v?bok_@@rFvvNhG-eexZ9>$5yxO-mtt7CK5MY6Zh* zLVvo>4S~bYXq}`+ZZoPN6bo3RQ~SOS4X0^gd&^}y+FGW-Fy++W?gX9L6Sr?l*6}O< zYh0Al_}5fAdlJ5Lk*<Y44Hw8SCWe-k$n4M8Im+B37Ld2(@dI&;NDJ~wydhj9u zJ`?vBYa2+Y$$PbZ3fF5BPrmM+uWwNX7Zw&q!Xkj}-0uK^KziXofM1CQxy}%93q9lm zYTM)EqdaYm(}w7uy@f2}KbJii0!Hx>lDQ3zYt7zwj2w-lJZ;JpdGAW^2!sFDTz={YVZL zR8!H6*j1*_p|1k`p)^)zX6h&|Jja?Pdw!C3mz{UQ+TX{lGV`ERDEkY36qiJq=&bq!v}4hf`&S&7)r}W?EyE8ms?Uc4qQy7mWEawik+Lk zh}y77tQ+}8Ch+s;&xbfc#bsr`pn6MiLet zr4Hl=TIYw00{P2zqv8}b01j5Y1LW4nP zOP6Y~maN%3?6A>JS_LM%1~M<&?Y>R=2IYs8xJ^(*iUb)UoB<_iIxZ=6a{X#^EK^`) z8hO(bAxeSgm&xZumO+0D1u;#M(O?_2I%ADLUndcdXqDz9&5e8?%@V>$1;(PKCO1zN z6)e(xty+i^*4K42WA;~q@?tKF?nw7hv>&O%KL!&jMm_dM;1quMUCF1;8NPj;kSpjd zgZU+^c@ecO1Pv}Xk;(nx5!cj)i0qg$7&SNdw&`m}Zi`WEE#)-;X8~V^xVXmcKrx4~ zg-zB(qQrTz0?-K0Pp~BmnL3;$@B%BjZSi`x-^y#azuEC@9gm!k+82ooYU~uYRUE`z zmZ+gyx>|xgyb&iU6H=aM^LCw`u{QB=6B7Y{xqgF1yl;`;^+ZLMVNu}1oloT==!q8B ztaZ0WxSqNp7SrEOW=puBx!VJb^Ol4qEESq76)Snfu@(r2K*sNE3?zw21>Jv^m={V1 z00Vd^N~gc&Xv*slj^BWD1Q2EQmouk;$PD11>cC*>$@OLrrj-uQ4ZnL}95&x&77_bX z11cJzi!`sQgodQDm5Ph4rH-yRHU}*pfAc4ggrTC|NGV>qE;!%XvB6`EGYJ3Ic*wR0 zk-`U&>r7|J#*Eo2viyf^%!`FCHP){{Ae85O6v{4+@ms}k5|}P^jPKY{45iq^kW!wz zFvYhjGe09t87>-CZ|YP$%J^MhCRDC2p49zB`;p!<`BZz>9Xhdxh=63wE}<)}E~vdZJMp~H%$8_n5%yunv=tIN>mFD@^OC;a!ew6PWr`9usc zQzh>=6KF1X;}i?@o{L6+Xvcl%{k^FNpJrmA2m4Pv&E1}`SlCx9$np!oxl&B^=IasgjZz5Zw2xX zUfHj$sia>4%m%NIWA(wDm!6V}{NeQ|Qq3@lcs!R3gB#*cH>Lv}Q6_-w$1y~t%7^N4 zsuF#}iGXiF492#G_Ny0Uulwc49IIaAz^84Nbp&$$6g!kOFd!v$y!59QBS7Vpi^8hg z;!Pj3%t1ybSiM@)q^4lF50YozZF{vKZEY)vt6HriSCyeX7zHsS(j6BJ#$7``aVgh+ zqp@o*>pa5DmBcy0-YB_-@P5ph9@E~rqp!d48hj==h3Sk3d%`fBP@6CoXt(RjgH!3}-+GuRc5ks;h8`yj z5NN-rr^f`wjxO4)uASxCSuhqC5~(6B3FQYilY9ySdQ*t4on8D8wHik{mIcjSiKb&B zYVEeiaYW$rKUb2;c1Bg?!%b~mLCNZK2yutPp>*}LK%9Ks@WHe#b@c>;xq&2&dH(F z&C3S3Dj+iZ&MGjOG)p^;2UiE#cGDDTi0n!-)bY0Cdk`8N^|i>Izf)(*n?Qi-Xy&!j z;50EZA|dVJ!9%(Zc#0DN&o^REM@sIegYi_gJV4YC=!x$ph<4QL9oL3++hOM|K>G|P z-v&aBZT)?K3$+*i1Ho7r;M1A>7JmUhwK9hRXW(Nhw~Z<=2#7x2szGJt5(!71j)*D>yRxU-VRudBm?sTI?89DC2G$Akk0R_4__h_RR_p70`-!k z62S5knL_wg02;E$?UHq=D;wQ-I#UX`R_ZVZVbV8XC}9GGjJ^{9@dWs^UzP#ckzZPR zI{izI00bSrBpd-wkV;s4HK9p83I*Bmjc17z0lwZwz5?+BuLF1bXQz!Kl;;WV+L42aN(yrj*U|1!Zdki+Yxp^&Cq5A; z;2_h}(C3Uta`3V+k}aDHAQO`OM4j%FFM!fj$l%AS0;)Ly!0D{A{Q8+U*6*eKKEV|ch*FnZ}BfBw>A%HnK(jifuDXpu7yWM_s7 zp-)CHVlO-7FIxxvjz=(yHM$VMWejx$!YopfBY+uTjB+d6?n-LVjh`UkvJD>tCt_m) zv2{Vi5+N{^3Ntk^(W)>kD=aiN_OiB&8*Y+p$Inp3rNZLCE;f;J_^tkF6v~twPQZW- zIgcNbAH=Ouy~Wl`^5DSuAn{?JhSZ4RMS{OY;GV3+*>jdPZc|$T>D#sgr7LbkvU{qN z%=b9lB}cj8n^&3{dyWDVVyxC$`2}wp;WWwXtUME_{Meqmq5SwZDi9v|qfo41+^?@b zbKi;5)Wg@M{RcGLAu)eh&SmUFSGnbWSPoLYciM`#AG4PE{*dgBBop75er+!?E`Pq? zgit(wyz!E;`f&91*O9hL`Q*P^{u%&%f4sDX@t7#lhe@Y;z7%?AUCoBY(nSJjE+dye zgGZFRdtHvpRU80oPyo(_zXBlr?B!%|$Ut ztxm=u7en{AXF?7U@5T9K2keI32(tfSZ=$eME_xvDD(14?3&8M_k`j&|fE*u6pu+&X z2_UTmY|Jh%_L}>R0P?E;cOpP7IsoT(ak&Bt0Wjw-`t2c~17LK!l%{nc`RAYmasJ>t zrFIY&#bm+|HLCsDF7E_DWzocnK_EOlAcxzb-|EHjSzcN+k1Fz9^8XT5D+q}_e`l$7 zRZeMX6#F$0v#h=|#YkpqM`;H=ShE07wy<^esR;W)RAmuBvowmFKwxDAwDI;ovij(y z*&7kAeOqGmWD9^(63b0MOH+Mh`2R#Up!vh&!X_=M-7|NWk<0%U@u&jGSwnH=hE<0Baqeoysry(BT{f1dSWE{5Ul zR^dQY*eN&(BJvVme`})oe<&Agr5-T5O;P{3jl{=NF(d-cn_nDOfH$4aX@QJDO#skR z4&VzYY9?ktD7d=(|Gp-KGXD7Z7`W(Sr)~I_zfYF{sNb6*`ts=J2+U5IcmDG;)ulkK z94^55N1Kl?%>tU8UoOiArR)NMbNC7~leK|d>bqXC=Y<9P_H)w#%ddbSwhtOkeSOmq z_F5CHJ%V(%wZqV#+mHi$oebnTFQ@(j{1}5ABa+S%vTar^<#pZ<97v{=3mWpQ z-gg9+_3@Q?sdRfa-6bgym|sk>(7BBJENvXe{oQUcEOy`vof+iFooMfwm7B?rn$;paYq9W;I|G2%cm~IIO ziehFh`|*FQ$<%BiI#JXFV)ZySN=<& zpUyBcF}c0<%>D(U!A5%M7Nk!$iInHXwq`dQ4J3sg+m70zGV1ms^3A2|I&_1xbIWz@ z1b=@q;ij7)a2=AIZ6K7;N>igf#s<~U#KKN=)9ezOW~VvJQf4w*@!atCbaYvDY=`&M zxinAN{C7qN5+DE$ZfKENT(>5eKfwrAktxM{oTE6FLZH-H&IK;$N@$5OtbCN78qL%aH!LG; zab$Fv3K%bkz-}DB&(@QR5O1j)1zgg8qY@|SP?#R?vM%3BddPnD4Is~-%ZRd-1N6PdP@JjAM{7QenEBVy|l%7%% zY`?qiwS!iQ80mdd)&MMIKVbIKzcR3H%4MRbKU`^GatV z7_f751_YPd%OfnLn2LiJohgDLe%vR@6IUlEqzj!fv(TJUdeHU=Ddcm!d{%_q?={qb zcIyotHIfqS0HP}2_0K|LjG?Tn0aUc?U*;A@e_2t@iNAN~FFGtZDG%Uxd5BOwh@R*W zEsM<5$QjVGqN`}Xn@Vv?4p3___IVC(g5jSrIABsL;p3n5wq`Cca^c41DXC=2S&~!i2 z1cG;y_;42_OPK>{j;PW@vj5)K2tu@KvDYd8Q529L4CgiZ5 zzP`S>xjFmG#f81Xd!Pk>t$7g8f}j-Ywqd(L1YGXT-i^d0(7Of@(M}fX|EoC-)1_z|g|BmQ7 zVaQ!@??WD1$(i1Y`mLJ20vouw`5T1q7Hego5tYoT<#r%o#uy z0KhE(m!u&CBy&*LCb3g%*A}wPMaRoC(Cfp)PTwt=P@*LW0X{v@<^i7?o-X&#-;;`e zPBpL7#1E0d-~vGUIZEoe50rvC~fHf=A(^Uq^K^N?nwd4KcmT- zWsnxE6Jy0! zl#hn@e!^0Kq@XuBvLC7z&lB;n-e?yI1#|x!p2D%Heqycy16q&&>G50%kl*Mmti=2j z0Z+&ry!Jj_(3|IBSDE!qP|M< zlXe!3Z(%5z&VHr!se zKL?uT?IgGFzs+2c=$ZuM_^coJb;yJ|UK+j`mr~3*77PbOqA?K}R6NrW;(M?O%}2(v zV-Jv(DnM%(mrvGi=li0YA|dau3i}sr_lE~|Bu?rn6?vWodIxZ%fFJ7(n=&xSmCymr zeR)-By{4Hc`-`7ws1m@y?>HDXVxNHT=nL3)xqW8&r@nWkp5DwTw z2@k;CL+gz$60ZGZM5-|u88CrNQ}6P|3jYL^BI>=lR&hK<*x7=r ze7w33o?!oB!SwBqKT~m0k;_ZmGH!WUnUj5?oqgfZe_4;)c|9jn3JVL6+X3@pwTs5q znI4dd52v5XEf{xLuQdS@za2hTb6GF@7}42>K#HLwL)c~G%50}2BmWrbUeDXIR-o>& zyoA)vsF6lZj*Q82nM0(!AG^3k{aVB0mLfaFWzMfFQ%@_BmrjRKV9g1E==ww^fR-_o zYGdl|EWH^};{W`c#5fHj{LVxoqGKYWixFr$fl%?!pT_-BI$`K!CAP@P3$p=}ZLl~c zN!;&=dw}iPWY+TC(BETex=-9Z6rHr$>f)J6t0I8YH183o?D4u(o@K*@&IpYGcuNcR z?ou4s)LIuEej1sI@lvq_NZ$`usO9urhg%oi&+#N|6&(X(!+LHUA;A5Uf`AR&)dmA@ z-qqCBSASaD5OK1BsPwI6>mdtb{rVuI8oF$ggu|%8GXS;W+cSl!Q|IDucO6etSn1K{&|5evzfSmZmrp&u*5tiRb8J`_ z@J>a1e(z4IYH5nEYS);!5&AS=e2`-rHpf{Hq{CGklLjM|xbV;r*_-sMDd?)oA+J>) z-^mY3H?uh@gGSU$S$?4D>C8n*d3fr9rkJ^?a_X(2G`LdW*~T0iH64|O!frSTL@HNR z>2fq80DBrB-Jw%SAV-jXgG zH^=Rb{MLCrNcT@ZE)-F<;o41}O@IC~zh(huG8%L({eJLsemO%N;6?_RK#+*5vZ9F` zbR(Lj8z(U-C`3s_V6sKtrP51T_`?{H-V}^IMYa@guz2Dy1M>>qz#$Zp3VL&&2S*8s z*~&!c**yp5kn}3_ZE+#dMYI&}Cel2s#;IpE+upif{;6=M7$#NGUcNj^u>mC)Vu@d= zuBg;NkIQ~iXrA-qVdjjxZlp-zP!&|`i0j`$XKQtSw}(?j?(>S4?lU|T zT52_>x5H{FW8=PN-N!Rbtd$@fr9N4h9JlEHaC=H40s`_!$ zFfGzjs_!0CDeICa6EVq^^xL=X$9l*5V8d!BY)tq;=PmDH@{9U7_UhGcms~2utIevE>dV56)w}S)N`NE9vv(hL>AU4b;$_2#KiFY zRo!fNJfvPsE{bEW^6Y-@5{9#3jB1}zM0j17hS?|-Me7JK6ik~oEV)xYO0d$Wo)(=I zKU~a9I>=2||H*{w7wxL!;QxB3v%sBJ0Lsh~@ciAKTH|IpR$f>%{$CZtbu0!_`sh-) zkOp_PNFqsnJ5_nEA)O7==h@)=ezbd(dPU}+#Imxn->|FLW$xE;j}BQe3IZN-Bn|j> zIKEq_mIfaCTbA*q>Gn?d#L$IFuIWmSa%%J->Pf2UMhb>1GU>3SaOdO!Cc&X22yco* zV?}v&BZd9AEXB-DarLKM)2<(FxiyF9*Fe*^cngamGO2W-3=-6Uxc=%YIaYkD& z0YpiJq!VMHVPGeOM6eoV0Zt--aEyh6=lb)1I;?aV^QVJ~i$5y;Qk9jb83$8B@2j#h z$1M>J6%s=3Daf$Ne6=jq4P^a|>?aZWz+$06Ag4*h|b-4sV~Eot<>&OjU1n zVg+vH=^{jZH)C@zcc1TAsM1%pYE6vFfSG_)(B3>8(^B!r&eqz#u!u(?-Ern1^xZuO zf5|?%UFADE;B%w~vSvMea9y2UU9g)*pfNwZ9*RZe!n|8Y9!%2tLarQd$f12K4rYG( zj*Ik(kYC9BTVR)7#lV{l=s7-1nKdA|#vTZ{EGwG<|GPYf4jX{!&wwMX(hhK)PAPH;0D9;eDhFn!pXkk8@uILtY zh~VYQgXC=WP5Lq%bHV% z6IT}Dukj%Sop%nqFBhuFdHRm3km$N#WQ&NN`yJd;{!_(s)c#HTrABlCyjz$-2jHMw zdy1V&BMEMxx&`3kSdc;6P{7`31i)3?fixe8oVPks4e*{5!US2_j~B&&KGFeV<6L-N zIR=b7KnGaT3Tw^TSxJ!zP!5Gd|;?k^al(YcEK zQVQ=#$(9LwESDXRp-iBkdBypfC6eJEr8Wsix`D zgJiWwp4ld!^}@#mg$%bR(Qwr(s|=g&jTI+#8)4j0&CbtZzo}vUSC6dlI@U*Ah2M#q z``z|<+}jtPM8cn1By14!uH%GPO4w+;fzduB6ilrP$UU(bViMz znw^_-W}+dtB$F&Nm9H_0~ z!slEqSPy2>fow4S%sB438nbmz-*g@|Gu8CA(fdfLP50+os0fGa#R9kJ!}&Q#GEL81 z?MM3Y-XzOf%n(-T`iWEhlK3TFYZykZ&ZK!k za$j!KMVxxXwwLz0Ov?fPLm0#^i<&{wy1ia2l!m|1ol|r_tK@}=q3;iyHF4oj7ox@m zES!}R_}Oes;_#{%Jjx|_j6Xu7wThE;#Kv;*G{oE>z1g{t8Y(f^XIFyvRiH}e2Vljf zl--4g#YPr1VV;f3kbokvenzX)7n`qrY$h*E4D`SnQ=}MFw$G<%xuaA=IdemtzsP1#VbUw6idNdv zb9|gzhWVLON=@ASuKOqqOn4O5RL2`^=AG#W$ya@@41e(0Y9d@5b-7=r8@_dKbXdY* z5|?eNGUP+`Ty90=Q4uhEwAQ4|x^#*UCy{o&4Ajzdwp>p@~*^14Gb4*#~&C zX8r(5@1G@V8Dv=EM;Xu>{qt1xjSw*~7seuuwPfV00qr&s=h6?5w2-8JJHqaF)wb57 zh_=@p_%&7V6DLnlFz=c-?qf75ue!%ZZ-{eB7RB{D*DfHdB0B?*GbYe^dq>9&h;1v7 z%%6jqeaEcJW}fxDpX^3$x-jzNQs;b?MBBg80xyyeLs0abWwO2+Ax~i-j=Ei}elLRe z>dhV7*y^-Jfc}9i70W4P|~9rVu&~b-_-;#XcXmaJ}ZPt>-TxanxB2X222f3{P(nyP0&NNlSzow<^0b`C(9=KVt&VaO94T3zCvoP(?>>kb=(pE;oV5Z zj$!WAw{$errK>cB@E*>$BPuXe^}VZy{CuQmrtBONHWu<5x4co*rdT#CxvOgHdj<25 zVQ9r&x8up)&Z)B1Rjl2WtVa#dg8a`9PHcOs1zB!B-mudo;RYE&1lV;;+`hhJJ6^5Z ziud_gcFwfw@Yi|5-p9C}JM-vIkHk+$v#nol$7?o!cgw4fS6VRPBKKHN=JVg5R&|Ut z-I#u@deuf^UGc3R4S}UhwS1-RwBv4W>Arg z!xn6I=9Wiw^T1@oqqD9{dJ_%@-e}R=zmWogU0mL zacw9`u0Wl5NSUdvwaf8tT|AedT%J8ow-vj|?WzgGq^NMumwfhrj_H{M{iP?ZrKP}y z##E%YaZJ$}*Y#9hp)LtQ85&E;m9;rTjcEBr?p!bw+Kf#zg?=^AmR^aA^X6*auRb+F zy+O8_Atg6E!h8^-*k9kADF|nUnu?;G)?s-zBow}UT#SVoykVAfSpq$M*hM# zR@dthN2#4*Rp7?Q7C>VkJ)CSQG?b^alD>7_uE|w;cl3*1)Y|AxU z@wSloG}=VA=z9>QBkNM-adObatTI=o7%VzeVJqh5v%Hy?UfrUCP{=@B2LSu z49bnX=e*e0@YG~#VvA+xud_$dI*I899k<5ZRDmhbfz8_BJ7-Tmt+(ZaQvKiQLo6*_ z-|$`Kqcu)ecn)K4=QpZWMBNG7T=^`VwDB!3H^rrgp?r4&UZ&A!l#4nDWwuL=(Tl;j zdAKS^?t!W=o`4bT?%&P+a_QET@z(H!aJHbGg;v8IeG_O6l)v8Yq)tea{kl?;(8w1H zt~WHzfnxI;O+!^z%eO6)UP?GxSy`#6#s5wY=57RTrueW=0Q{{1sal?Wq3ED2tzhLe zpBPaD+UhYOF{Y?MH0S99SAdCQz7ptXFSG}2RivODhxO+eNc9=na>Ln~EgWyOe9b;k zx;*8$G=&zvz_^S8ml6$N=h@4L=!eWh;WrAD31&w?3E{YGy3KtZn~VC5u@f z1hL%VHsDF&A5IhCrTbH)X$G(m*;?B|Q9eA)h}=i`o9U-5x)hCiXtdEN($?@fBxGsS zSfit(gMQAuXDyNfs{%;WX#oiuO=-aJc@_)2a4Vob0L!rpSZ>KiL9eiJ z4^}!r*ozHxJuG!e>Fb1m)osf~XWT0|kLj%iQrqFr5gHc)W{$D`BDbTE;r&LJfA=jQ z;e*B;ApaNe3@`^5&;WP`U4VQE&~)?#PT@o`blj2HrI8bJ|O# z(WIOTulbJM(^JWBZ61F>Ehpn}e(dS|>+ueWbQ2s_n z;dtcznk|;eWMCieJb89wc}_PDO$zxtGG5gthqWv<_F}fqYieA^wPqgBkpNQFq7kG` z0j@nT7bwM2(YfxW|UoN=P1-G$&PYSJ1Yfrm= z4vVb;$15WDeIg(?=ue`GaC}(H9zio7HSZ`;q!)rkaO(oP!>lVN2B*D?#p?#bAUN4N zE^tu$r`Jh!4ItNav~e(5nsD?OXiJgxz|HpE3}-ih1@HS3?|Yr(n9A|=u98{?=kxtq zMS)N2!)jWQY7}22wf~rKyKnTqv>%}%@nd{n7A`&s&#j2DzLCo_`!*$0o0x>(V>BV? zWpH*3g^G3k0PjbMm7&Tu9jkHOPJR(QQVyG&G(pp`=^6MUhptj6c_NQ*?Ph<7-r0@z zTWRI@eafYy&=wjCdp@CG@NhUR|azIU~4U+}0f%@hL%960UAp zBtadF{7~vIaI-_?j^jjVLFRI)X|bQLPXF|Ty`Z%hnw=oBF32nRvvT#T@nCX<-R>f* zw7R_VvE(jnPbC{khUNhQ{XR$GBLO@Mq3%?h%)|!@OkuBEH22XLCexC5Q7yn>PZqUL z#Dephoy8q;ZV*^ngWMfdQ?okc#Rw`L%oq8}hzqQ#oN^ziY+0fybu zOk~Scc>()}pwAeYp{`OQH*oymAB`=^8BCWHjpmbs{GvCUf1M!Q{XF8|_xIkSlqNga z5jB#2lh)^&@zrk&k@#f?z0?_3m>!B-LPG`Utg(a79g>GG=vfG=D_#5)dz^5-nIe6u zyYLRA>n7&J^hXv1d_L;;b`Gy|c%t3JPZq+9)HRz}y7VJsT2-i#)J;=-Lhqslam+4H zk)*6^2~gX*UR9@`oSH416dN@we-7en4QU)P?u(eF`rMsB6QeF_B=CI*CB5yn^MD5x z&}{89QugIIS9pjy%WunGq4%pRC_|GRc{|H7ziEn}%fhUTF|!h|-`i9}hg34Hs4bgq zaZLZ>Xl^_k{Tq$D_>z`8Fe%6#udm&$t|7=-WjFug*H`_RsPP6gV-%$+OPc*;dFxAx z5c{YYbBbPY+={)}l+UV>&PMXtUKDl=iSGP-t`BFReSDdcD;E)5ps+1V4&rb4r>{1B z`M!QS*_Tj|B@ZV%@QOFRjH7v=+?Mnlj`tSKH~tv@VDf7%KTJ4FWx2M{{)cBs?6apI zrl{#BSP{!%J!o}1rl_E{1cmBQejo+V3c~({E6s!?#c|s9JOhy*O_(k&OyfxcKw&^T zMQiyoclf-sW^r;-6{L?{B0uZ2Q`QD%dFFODY1!^>7Qyot=|J7#J361xPzdD3FIyhcf1R0(T}Pso zAmj&v2UJOm5&s?6>yN|~{8pPd_R3O=%ST}61=JbLp8~X5Q^x>g#MMLqc^DvdbW=%J zR~J}PY?rF4s*D<}XF>Q!Um{LD` zM^6{)_5fnn9}6srFux@?+SZE4S|tcA;KU|%uDFUmMUgt6;TiRsB0vfeH`s{BG{CZI zPBzVLMdRcyl&5v7$>lTS)O3#RU7$-D1TxcRfOMLbwX9D&4@@%qpD(>dD{^#lRm z1-Lt$2;h+@Dr3ak2bdzC@4aW$51&4C$tz%xgni&!VH?C~Qo+PABrtJc?2|+LnY5kV zF$nMiVIeTqT@7fP`D46+ctRB>7@IvI^@W_n9+phxM|M0=58_5c3F2k9KZ@MxGA0Xr zIyVy}4+Ak3x7EN$g8JflFr)y`ebxYZZn3^X7r_IU3SPGXaII!!)GEnloGsR~WkAnP zv+dD!w*sV}T3S9JM>dWOBWz?;?+Ww({{+|Lg7}9IR2-%4?HMI5+r!wjSW>J8&Fg$I zQIL!{@Yv9Gr!fD!sk4$lQDJ#;R}#HF#x;$N1jxvz^Pjh`ytZA?v0T9S{of&_m@uR` zTZfzAc4WzEvE!=GMTe>WE%*Er$~n0ThOpt>?ns1DzP5zGSY51-D#r}o2>Hxoj@F%U>S!eA~F(`Jj$9x+?JDo z@HFzh*#Yn`0RaI3glE{Jfa(OOm5W{wVJra2YxU(7{prCqzU#yt+4J^X| zA0@=Yy8u3|LmKHQKHv@oDtH%?mmc2ebN_qWmQxWD*kX|N4?uAXuxgss_M6?WKxw!D zM7SWySL^ob6mtpS@LOlszZdJ48f?OXfq(;ucVk*5GeMb-K`zLbEbnu@5tc6{v107>TSk+rF+|Cu8|xGk}t?S@nL|DARtEDtgC|NbuzKbShBv#cyQZm&9I)Bt&siLpUiQ@jB+#gW<5Jo{ z8UuLtDv0;0z=Hxlge>-~eANOgl3WN*_`QF2ZhnNhuGxJT=6|mfO&CSQ399DE=xAbB za1ssdYvBD1-h<#RHfD}nXlW_Y;_Si)GG;^sV}VRtI7FJfbivm<5!nzTLZMudM^ij- z1(t=LG2+-i(jm|J7S|gnkVeeD<>dvcYO1RTuE~h^HJzIJkYJ&Nm|2dY|JOk4;e#u> zD4`6(g!dJ23LZbx$r5zb(I0)-DcG3SfCEk2OK zL6?F?#^(rz5{Py+0rMQC^XMcHJs^Zkb=)4713`xo;66ZM3ko?bG=vuS!=DFWKy5hk z%}4z=k#fV%;hC!1&mh^!ANZ%6KWIxzSC?2#(gH+B`1+55d52pKywzYBU^(#J(&8X5 zH6E1(Z6LhCB@AdaE~y=9jN07nH4`u=ITO|3#+f5yN{jlKaHeUf>RuR}PvS=*YYIIvmp&)p4rgiz-x`}p|qe5FGI zxtZdW{^Uq=OELE80&X)01tb{#=vw`kiUPz)++k{?SD68Le{5S|8!p)TxgctuO*OD4s&Z+T<7iwoaN*~XH?jUwkJ)A z27!fjXzC+CK%4Iz`P#t>2@;XIH4F^AL72BxB!OY4H;}aY)uTxnn7;?~vOCOS(ZR*{O*%xC4MQq5Ond}V2?PCX?HSyt7qmc}3Y zb`&&~nkc4c*UuRuD&D~QJ=wKmYxlAO>9F+gy!|}W+1J^_*)ko*ng^y_4e|lrqehP}Ay`L&nw|d)BKFXf%*OZHpWkh5b>ucLP!^pf&qV zcY_ZZGD~&mtfs-;v!9X5QbNI%P;fYSEB!`Xq(QNWnyj>Gi-U^MFVe}BwjhiJgYMsNzi0Wo=l8aHK-j39`Lf}GU-c;m>{q~h`6@p-Y9Jh6$a3d@w&=!nx@!Rp;bru+Vp;9V4BtFn-YmET5p^8D32RG!M+fHAw% z`R@MGi$;9=$mCbd*I8W-pRLmP_s12Z5pWuF@h$jH4B0;xNqURlZq~i@T2E^}lW)Mv zq_;ip*#Eh^bbvxdUnz1qqTOb3(ztEB5-N2|HkI%p!6XunXqxZ?deoU{KC^U`% z3C(cNzKmmFEc46j->s_4wC{{cfzf^FI=NgWDO#t-WhU)gSumex2bD-_hicXMFK6H0 zUmDTkimQ(9e=;)ZoH(oxa0x&@X|R;|*bN-?adi+?7kY+pNj1Z`m4Pr-g{RZ$ZKXmR8HH-S3Z~B zO6E4)IXiYo+0DP)(-;V7(f$=hLKnmw}vt z+!}B3r@xv_lW~hM!&Wx3T7^e5eRI8`oA=A}Ha4D2M)#`ONH%S9R8$V{!N%4C9XHCS z$;v+s2(^ww10T3}5{NnNeC*Vj7rn}bna+>4nr!N4wB`9}m2_MDo>+F=qxPF09UHC% zL~ee7Oytl3sBZbnRt~I8X-4&hd^Q%egggg|<$h$&^HDkA@Yky~dHLywG^mm(F&=tA&PU&q@z5RH3H#ax3MSUY?(+_%8_C)F9SSGc!qa^A$((3(WSEmwD&=V)u zEfTaa5)yb0LsV%~EhVb3KN|0F*>SLGav|>Y7=H9D>h9k+^^7!j3+&$R#Kkg{$wta* z=$J_|SLktYnZHJt($*YjKNe*ldxIB4Vj)pxr=mV)`|?a(U0XURj~Nbdy14q#9Q)v1o5E3h3$QqR!Lh zHk=`f&~;jo3pEAmEctI5i*aT1+z9y=jdHd4vx;v^i&{S`y?Mh`IB=jwzuR9H6fHKx zT56N?nU+jZFLmlYb0VlZ{9#j{2qoSdcs3QCyiEX_!4mc4O298b@`JS&Z}u}N+Dtnf zytP5j3u1y;MS*PhPQRN{Ep@z}kTtEX7V=At#tmV0f*=tK9Scf4GzP}3rbdQs^>waZ z+LBHiE=Sv(#4Fb+_>LmVxezF;I<>zm- zUMkz7r^D7JJN<+LD%|^*|66>~cBy~ofO@kNfm{Zp4cZsj5d|WUPA0r5iQ5CdAFnP3 zi=fHV8Nss15?p-N!9i+E@)oW^>jktp49aK>ud~>rzV&*?%N?ZWTOoT~Mq5&s&cAub zV8JZQOoOm~)D=z5Ik*mONZk}B#zv;wY`hEk1-O!`(y}bo%OsCv{FRRlQzGpx-eXaz zdzsrN85RjK@pEO_)VguR0XZZ+MhRdqnfE`1}bY>R-h7O$Rj+(Bn+j zp8A)5RbuVZsvhFBH==1|Fe-65Np?Ovt$NW#s)WzWZ(wM8Q-?+Dx%}}km3MyH`z`0Wj)Kft=mt01Q-wv262EgGDJ^@wx>tTQx zcgrz>KVgZ0psETB#-@>O2L-uV4jKu!B_Pj17KrN|U<*a=7AJrhe@GJh?md8RCxq{8 zK?_*Fnk#{LJ0VKIqDNay$LjWN9NKEcZ$q zjxd1MYU#JP3oWKPz4)+#m4}4$>Z=G#6R>LtD0LrUF>n-*eSY0`Q_sW-) z6dbjZ)Nu=BQpYS|pLA6*{hDZEu2A7&M98x>7kpSfxXe9%fWTb|T^cGVMfH0ul#9?CWjjl`oCVC3VD+ zi0Q*9B}3!-lFx9ak!-iqP+CH>4W7fA+v1y>t(fZ$j?9i7xKeqPf*iLI#Q6-Lj_0fnLN4oB8@AoTf!f>BRkw5)a~ppL4*M?GrV=)E;*R7csd*Rm_7j1s~t$= zjEsl?h@6!TK#jQJ_)v}7J>wPa4`DYE_1{gj3wGkiE|Vc-G5@&+^DYHgVPcc62O!SBz;O*ww8vE4WSx%8%pw# zlHviB4K``KCbK<3VTs`tII|$vrxwUdf9?DMBcF~hJOrqXpLV}G%mG~=pwA%A2H??n zzJrZ-gp;o}+$40Aa^DkQuBf(uY}omL6c1Vj~qH?r=^AOs@-`-`OFTWmKxXy)Oq)=7y)={ zr~-I_bQ`p3QLi-`&0GASd8}bn5+1!&$x-*J7#97#a#^8fh(sjEty>oWx~xML!4u-( ze*3JKik!>EWe3CvM;4ST<^geSNcxv){q}gqxvh5@**#+TVp&A~P7V^ZFyi`BwUo3A7I< z+bF=@F9-17N^(rx27;*nIpmw@|qw!O9n&-k2N&r&l zqHt^rFpEg!bOb(3sM65BA!9dHt6~@`5NIeFh2+V{>2q?h1iJ0Z<5{uRk;IT%8=#WL zOOGp;72UPTTZK{LY9&KAXuslJ*-4|Z{M30pjV!5GD=Y4SOZ*&dsJyu}{+k?1-$lTo zqTHA(9us~8m)Z)tZ#~XT@5x<)>(FH4>O@JK!^tGNxU&7PG=UlCF;B(>FB($iM;Qy1IgqX$@% zzWd#XJnc?b29na5U!r5u|7#Oh<0Mx3xC!dJG!ef?AnpbUa*ncYzcmw0n4FyIs9R6H z&kED~YdJr@&uw@#fmos%w4`In>t(Q&v}o#>(}Ik|A$!dioOyhBB3|X(IeA$;VXvLMR6oxvD;%YOco8(a?2s;Z@bEG4e1lkzMP5yu;eu{o=FT)q;B&2~u zMcUD%A>~;@hXh6VW(#`sBSkTAHj_5 zlbQ?Ak7ty~7_os=s6UVQVXK}L=)Q2 zmszP1){)v`D~Gr1UAh`+K^R!S@Vx3Wn%hQFj*b#Avj}8xVyymW@*z6e-7i&w<5Gt+ z`TeTn%{xOK!Vf{@^u3ZFd%x~xMf0V-8N?~J*D_+n%!Z&DRMy4p@_M_J+8&kO=V0x9 zPkxv$v)+8p(;^D$H8C*h&Tf4WR|ApBbCsm{$mGDcMCPAPLIQTj*(mDXjfN#dYEgI^ zrvVCap`(s&t?BBks{l+R@t2S_I&=SV<277SJ(jNSz{jrR$wEV(a=HJ-b!oEX=GD6!h_1bMIMo#vD7*&Uq1 zlUsKg2~`S3bHtc^eo6}Mzz>B3iJe(}HmJ}*uJ26jNqgG9pwm)I9MS#kYQW4DH`Q@u zNMZ^F%S^wvmwilX(_iaCT?!@K!_OFLSOj@bW3MO_SKL^r=CaDac07<(b?p`G>}j2? zUb}hO+rSr9>3US;OcT(BT5_2@YH5rK7}RxfxBV@W9#A3-5~8Y6xPOcgvZ9RlPK!#NG+N0fW7+$w_A( z1E8rL8SV#KT{=GghM?2sF*sG^oPCz8;MWo`-#UwTnd9N>6*2)c?|;K9Rt7(UB)wfz zdrebYh5J|i2b$ax4!p72RbDXPn&X`Hwv(2>V+C7f;Wb$+X7iZ~+&wf~h2;I4qv54z z{?&3MX{1Uxvs+!wHSi-cx;!T3aeGA!pE!V*;?K@^XG2TzD1E<{VVr!6D*c*+VP0Mu zRLn2FoDN54T2??ByH~f-%OkR?oapMe2mf7!<~OcROdRMZu&_}PVGaa z)Y63Wv-G-S^@;Gv>Z8rRv#+gDEAIT12ug;6<|Cc$^c+q%gL0$FY|Ad&?vi9|s8?Cd zJLN09tFIct9v$5k?j>gjYWB}|imGtu9XfHcnh$!%40*3I z*)+K}%a!gT--sDMTHfceW-FFPAZuNzNC{^N-mCsRJY&yA@&+7c=!X~21JYad)D4yF zB$Vv9iGDSh?g2pnlZ}nD_kSF_9(NuS84+ix=69caf%pjPlhb!ZwMD7e$cyd^PTXA9 z#7gPJ82a?JC~yY(dSmtIGe1{E=m+qW+z!%7XmZn1O7$(qc#=wrWVjXR2OJ+W6gBD; zuh^s!o`%RYln$-sW7T6xIB2$oU*!}of80P5NOYv2b$t5ikfzrUc2jF!nQX63jc(oW zu^O@EJf<||u86DTNwcOUsSEtfXld5_d3y39m|X2mD_-QGd{R5HR%MN%kw|7-3X=7K ze^wE}Cx|P4WaMF^;&PeA^22CcuJ@fsPEFM!M{*jnWqQxTLFJt)f~gt{lf{yB@DCYN zq%N6n+;mkTb}aIPKGc&BLFuU4-vGx-;tR391gxOs*aD#aK|0wkpn6WrZwjh+$KUfg zJpMl5+MUSs0K%+@^h2^EpDi!(_{#E2x09f)c-j8&*WvJzH0^msba@s$76r$tS(^C< z_(JA`nljO?~=q6QIDFft{4#XQEdeBUP*cQ)yh%tnF~$UUv-60 z$Yi_7DfIu@sJHD$Qfsy9S2XZTu|8K$LNz`)}yX7n-7*Yyv{<+FcLS&%OTrCgw1Ckp}#1>?ocf|6yfs zUAs!sn2#(*Iv=UP>t`MwKc{bvfNIG#zzh1AzeEvOrNaWA&cG&`>4KN=p_ITs14;NiDTTY;^?(^Rl^X^|pzRzq~idzN(eM}-B;=T>77 z{XC$}1t1m{wH*~KLllWtC10J($^=}zCLA+Fa37W*ydLlgBs7?TEslp>b4#{2KAIPX za_u?F9~UlN_yJuJd!3mhCpW?KfaPySl^C#5<=CNTgCy0=Qc>01%m_Q-qpkO~!G!Ae}V9SZPnd%3|%i0k*cmzj%uyfJW`tWO;5X>H*(IeV#K+&TXFmWkPXM{G>VA6>djn8W z3ISK7(=Om`;&X!Id(Vl)4-^+^Tpu0Rhy;(t`!(Wny*xksh=&1#>`~-Gt>A1)Amca0 zjVfUZtM>rM$M^3zFYy!*5L>;pat&&Z+yb%^A}&h5FAsGS!V>iMs8q6pqg%XAT4*9{ zY_T~%#@2sXJ^)-$ar9S%4Kd}|7<^)15@(YqucwjUgWEo^SM^pOFVqGR_qq67Ov$jb zD|pHkq4I+l-0TKqo}h76&MYj7xtiA46s zIw{K0%+en8;jTqM9huQ?zV;^->_kSxhaIpxo~Cc0BYC~p?Au4N=E;?*h`+rPOU@&%SMEP%dmZ(rqgv$Z_sm^)ZjhwG?#J=6StYm247T^aXZW;F+pnK`-F}u# zJ=|d`7IFd;NS+~qJ!ougDSi9FtK(mJX)>ryXoUh+0akquBK}P_Qq4Y30~PYSv`S<*-DZ$?0^CD6 zY9OAOLc~`vUGa74Xi)^yuYu_rls`#HNjbjGGh4s3Yyb$MC$uc;TCEy9zV*hqd-hvm z@AN{OQ;1R)(I3}l+M9GTO$u!gk7RqUiZv{(*BJt*9rCcg^T9s`w;urtAwm|96IH8{ z!<_6{$%Pg`eVz{-GM5X8_3^MvaMqbuBj6m2V# zH309jDkkCLsKLFD)$TRLsb7fLOg~r{qVO9_`B&MrnzyIJIj6jLK)WR8{X)1NFyaod z+`ZnYw}aZ$SR?%i2G3Yi)$frsT<@=)Fw_-)!+>_wAdvmI_oO&v*4;g?fQ&bVV*ArX zl3g|UsOKi(69}#>knsgFdSd1dbG|X2tvuFMM74_urzsWsfJ1iGc&m@k&wfq%U6#M+ z!1v_VlYAaDkhXd2B+AE`0n5+pt{46wtNCpDG z@HCtW*9uJn6&!!CV#*d6r6EwW*73YL)}MjmxLCT2K-mTMkucM()+&Ej`%Th`AVfc% zUYUyu>7ylxOg;xbUL8CP_X;Eh|0Q#SB=_U<4{~Zw*|DGf{v8Y_k7}d+7BT)gJi**| z-`CaIZoM)HqBmjz?k-D=jJW1?H-2U+y@S8)ah-!p72&%XzxFWmHs*u9QCF_lJb957 zz@mD;Wt?rjc0b$>od&wI9%;&tWmD>NU$P`V_7dZ9jpe8^O7{$gP}LPFzWR{tINE3m zhR#0K-!bYefzOjuvuv-Gl#4jw5qzV#bo?CFws_o@V>c6HF-E}7xUQbjS_WW zxCTRbwLoY;Yvu>~+)0P&=&9l5OYko zzp%ZJSv8UWxkI45i8Y1v%Cxd@paBp?CA0sdO-$wZ9)Z~7w63#QA}<21>yF)$`NQ1I z;*CWgu+*!u4!7~~?~mkTcKR1i033Zmx=G;miSNvW&$69d$=Kl<56!3%0>JarYk!Ql zVw4trmG#6Vz1YSn3DA)bwVK6yu0$3BirB6TM3jOHq;tcp3G_s7q}bzf!({Ub>cnP- z3s@VB2hXwTI@lA!aeoe=b6{QsnsqGZyltUa5K3*t6l>=4IuZkFN{OK)ACCVQ1b z&?Fnz^s|tv3TwyHDhXq&^nkYMg~B#FL6s}c4Kr3#J+uS>`BnbP-#6GDBjP|>L^Ys0 z>qeNG3=U|C`P1qF(cm8wFGDE-?;8F{6Jbw@8;=O$6WmC}Rc*vV|!nwvY~gcE^7!#wo@$1;+Y z1Aba;#;$7Y*~16bXFNpPI5U2&@+`EUvs+r?yEXe5mY@ubhSTU*K5Yy`yP9T}%qj+2 zZ{97FmJ);`WHc|4ZnLLBrSOh>MG-BbX$46|Bcmg^{Gt-z4mdBO=|M8{-c05@72IKP z*zdN9U%rQn>g6Jzqk;UT!G%K@EQpzeY3xkYf`))&d0cBc1m!kcAl!mF_3R66AP($| z)q_ozfy!bt78vJ8SxJZFqX3M42v|EHG9L4-1e!@(94G62p-?K3oo>dGkU}Sd4>Sny zg@Exfc6-+NR#E&j_wTs5czThTF9cALfrz*u-2QDS`moG%sXq!l@_^QOuM%+* zBPi%2#gD6Ha#0J8!MmCB1;Z)N#dr3Iwq3|5XI}Vo_EQIh8e5*=u&8H#%4gy4OL8tm z^5w)T4b)-48qv&EgM7;#9~Uboy$FbShBAwNvPBH!N_s+qU9PdJv_4pp21MjxqJcI+ zP(uGSSy9K{%IDq zB9uWI7P$VX7HUZU>ODu{(VX#938cq2qHfq28S_wl^8dmkpcyNtYW0iDaH7eYzAV%s zKy3sD(waVhsAEh^1`8#p;&$Jlts}WfLM}~M*5n-U(511?5#AVlFulPNr{L3{(SoQ0 zrH%ju^HWS^#VH8XrJN?#WqcDy?E7#zkNxtMkE!Hui~TyX7&LxvmPj) zXBqxCnF6eSz4m3h9AJ!EHo03KHwnA;7izaep8kr|y-dkYhIb!|+5}=?Aa3Eyhh^(N zJ%a6k)-z?Ih{W0h_U5}D-9X{#d$+U(xZ#8RSmDn=2o8K&;~S@gmkM@E_u&idHiN$< z5HWDc%E}qP%R2yaCsfZZ6Dv2bZK@1*ov19vcbqF{P7r8*`J|5A<5J3Pzni*6m7>gKr)%&kfU`G_>yn6FI0Lg!? zxXQaC2Xtj)XtU-kAe3FGuopvL1tH?pS8(zn0gd)A^BKn26o=7I0sMj zfLv=xLJjGbL>YVSg!!I zzev@L6GGQYq718HSzGpw(tPwS4aHD2?T7_~t%N_7lFvPxzcGRI9a#xHDRx=pc*lJ6 z!9b;e;6yw!J@tdoTRmkd@#gFT4b-Pdzah8pI?-YshMBh@@p%P0O?B(rm?bTk`z{RDKYB=vrl2g#%6u%7#>D%<F*lgSDuQFLjJH>@DLqmk(0rm@7b~V+aK$7Wu<&cyWi^1jytD^f&GQr zj?~e2>@Nl9`u&+qw}87RwkV0GplgfNzn^QswHrupF`-lRajDosPG%t$ch!S6&dLja z^-0ic@$2OXJRK{t{;9$kCD`h42P}66Z^dsJxlqA)4)5=num*r zOX{`3u+*pvigEEQmAm8p=9Sz2g4@)zm48MoxSdKp&XH99^v z3UJ0cSUh`XzwmuC>_&(ADxum6U}RB819P%2@jkUxNTW{UkD?=Rq;Fr>lC+r{Y~3h_ z=-0?rzy2AA_1)B`S`En4NhbRheA!6$zRH)*%BYnD-TKE5WFJ%gE+TP3_r({RT!qTm((xY_S0;z`#;LdAv z^?3cLX&OOnnmoO&t!-fs6&J7` z_p`y&=ah1$6J3r<%s^i9w;c)OiTx~JnX*w43|(C6?RkkXfM_Cylqg8gz#wKrc&ndq zWjzaF_?a%XF?X()R`k3|mkZ@I`d2<|z5~6*;v;6bkp_}o3~^h)0zgu)LQRq}s#GB+ zLYFBOB4e%~Y#K;S)}_gMWjvoWE#X*+X{@mVA1omeBZE`gAPxp%LpL5g(e?QFc#;xh zY1TM~u>FBj@lQ9J5*nEccg1Dl}E>SDV z)7q%G+f@}Wp0uPiH)i6;_YrG1%|z&Zo7L`)S=~=n7~#^+=&mCQC8h7mmm+YohXv

KSwguAc3=Xs|pJJeiL1 zuM|mj({`qJl$DfdP{$(KqbZ@UDW8~LrF2*X_=)&RV#Usd4jPXlhH*?x7J4rkHmBL*bS(MfW z25uoc!mGAL0;`oUY}(=@N4y;@d&|P{c#s(3gMhEn3T043_KIgkn={wZep6pmx<@gr zBnsp0qO_L!4mVSIvxtD(9gya2`g0zY$ELa=*P#nn*r|&^6A+Va1PQG^S5?J4ZDxj> zfi~cmv*(WRbK`gYY>72*_<{Q*(tuX?b~~u;dsVO&+r~DlDA$`%J1I>nU2%$V+wDPj zwzn^&?J0eJ#L&}8J|&qrzV*@=Rnt;Vw0W_XiqB`k&Q-+ks-;l*#%NFx+bv6UKwW;^ z$1S371zzcC^LG6^p596F=ks{>L`$L76UF+4ca*Uk5MAF$m1MC3*OsAaJYhjKDG zrH)^YvH;v7%u=saQ3eMxN;kM9^c4Vq=8b&e^AoL}u=!svtjOPfSV3ftmtCYbHf-^m zO14-IL+JbYW|$Lx!<3xUg2?sH7*i&%)jH6r{sETb0Rdu|^h-EA=y`)?5m~Pt_2ptR z{kUrgkK2ERB9VR7b78IzAd`PLoqu3=I?}GYerIB~pv$BTIZFtb9kNI>GB-xK^QF z!l**Z)KH1O-j8!-xpCj!zYRBhv>Hk6xL8+H{H|`)*C|rFSB24Bsdf&2n3Jme>k!GS zy=uHUptgjieN73He+}wDoI9Y;%*4>fp%xPXrHoD388+m)Z@*Y3HpxR(Ep|0Yk})R_ z2s$QSxTCp!^}BL?@dCZ{2n!-Y8qAz(ZyZwQFJh6@xeltQ)__x4TDr3Dxo&?hU)&;- zcgbS<>l91=h*DyPyAJYM(R5zn)=8FoHX&Q1HcqCM{N+qK6J7U5p_;U;ZQ2)^nF;Nv zfyk(Hglj}xtOlYi4elO58Kg^(x#W`~%9W;JrG?)D(7j}NV^;7kh{kZ15p*BK$~z?` zI11`dI4lr#tG_Yiw>geAxz}VSN)8~z9oGBu!bhc(bvr1o}y4M z_UtYC@hn+8RJ~WpGCMn@8S~`C>9-8ug^|bot@lQ81{#Rlk*MEB`tb6zGki3!M6NV* z5YyaUq%3IEY9(ew=GLkbr}au(Nb%|ytB(b^aRm#^Q#DFCPvl}ulTaW#<8$a?Q)HF@4m4>*&H|2P(VQ7Bcy?R!Pq$0o)E0Ao95SnJEn#A@Qs9Ftdx) zDZpmNXPNt8@N4G|$AcR&&s4>jq@k=;!!qToj|YRqfw&)dFQE~VZ>N}4T_CN%3EnK| zg_UYd8KySuhlIdqsGmDNG!lrs{zt4kpA9A--VD6{@zSgWhgsC#?2dRWTXwCsp;K~PPi($@WiCkdu&g`M+ zSIp%4#!p01V)Na{{EHdCGq=%*(NsoNNrA3NQgAs{1T{Sl7ehq za=ZGA>;?UKDX~D>JlNX+ljN`>KrqtV1|5q!j%i4iajUyzDoETjmYz7f0lfgwfwCBA zL=YD(r>uUUrMuF|BlKtkvh7SUJR07#78c0K$w}OqV(~msUoeSEIqPZ_fMn zl$&h0tVSzEG?ffIgqDd+?4KJm^@RO>{nM|tPA5u4@r%Iids%3gl%Jq0zf4|#Z9)6r zt{9%+n6yj3{i`Xy`3Xf29xA~_Yzlr(D)3PH4%d&5|5gY)W^1UR86}`_;=s`baHMm6RUo3%wN8hUF!2^wI*zv<7x6O27^Vx4Pk-}{66}%P2hdu#klx+}W$`h)6)L=jpZ~K*LY?X)*oCVAcirMNh%YjsPnDApgg#2=IOu z?O00-`yTvgVA$(dzHF?2d3X5G@t`nAItQ5cWGr`&HY5m3rjtiUxw0T6NG9&}&sS`( zWt?#y12LO(gF((-k;DV=*Uj=aA_<6_Ni#$`ixd^bM-phVo+y4yu$#8Mzfp@7eE0kH zhrXEXpFhiv(w{A0oH~Bc|2U*l_T$w@EqOCSY22eZcbv_Y7#t|D+Z(N*QHj^698W~5 zGGDBT*6Ee0t<3q(8_o3;Co%J*%W4hg%%44NF5fZYwb7wxPZD(L6HsLEdZ|8D(9@xe zimPQ3(PcndA@1wrQ9#?LZ8a4B`9sX|S^iWe@zi;`EoCmBqJZ19PK5}c z|A(6C>Ii=ud~umb=QuAE-Xe#~B4Ux#+>}&&n9FfdP$?M-7e{^bZs9XJt9c|FZ3_B( zy_-jG-3y;>5`3Z#iHCZzd1#t@8H)N<6!fZn zm<6W8N`WEiI^{g|`cE|*Eh-^j4lSxprU5QWEE1}|J2UBRarIPomqv3vB-Ywgo3!P6 z&3;wNB$tZnclUw!`w!kblf-L_0DJ}#ebPcgvP-@c=|8RmuI^huC0e^+uhWl2>X6m5djTT3L4^Wj$lZyygZMRftLBSWD;Z z!CYmT#ZGa}e7ZQVbfUTo>c4#g&m(Xk_9m8UdQCL4$WO>Yw|s2Q*qW&O_u(Fo0|jcK zO80N-HsVEZZl|kr%_T7t_idfe>ru#?t$LoVTc^)+#PeI8bwGn1I9W2KK?jnH-iW99 zb3h{rV(9mx;AB^B(*Tg7%dDEmS<-1gzEShR;l?90GH}Ryz*5#Br;Zv2**tkA$LY)L zr*+i#vktsU7l}&t^NvOx2Cl-jr>InpBpZR_f4e0^#rxnmzbpxR{@tDZ`uYMwiXIXC zYyE(WbvDivraDl9IwF#)6gwh<0OC-VQyzmbUel$)S+yb|TWrPb5EKu5Bugu{j)jhQ zXT0=@cEgRdUQ54C@&xh=X)&CaNV+Pz?xA9)VfHASN%MzrQrx5J0?krl`OrcX>j~iW zQe<17gDi96^!}2_FCLGKVOq;*BS33-SF!1J+Y1&lo5L_l8|B4fEiW>^kVUH^e$FKL z6H`f)fST~|@HBIyiqgdnbDRo+R*YmU?qg1{6iboc@?wj7DCiZxIpLLi8ig##S7jl5 z!U5}{Fd|fm{*)Allr2$jy!>0VJV+vpN2pny&T&4bsI4sBPOUK=kz~Gb9Fijt(plD*^b{dpl6E&lg(fzYBUXCs$H&5U!2I`mp@T^) zl(u&d3%%cIt=v`Vk(Z7m((QHbkRjrcnO3pUp?p#+_{oZqmxr(^ynia!RAs=4ishFD zPR!e2LjJ?utt|ZOk!r3Qqg2TFy4APwILbj_x)kb>*s<8wHVm?8{|bJn6M2qbcF~h} z<0pZ$JcFvwDyh!%=;8!ynI4^)PLduCl9s}a>LVA`L^oosuwn z4<28YW8WuIMloOdabFUOh%}#2(kfCDFz3X<0*@Cz)#V7nxj-7&m~0FaEb!BhQd|i; zXJL-3EewgiYw1`;@~x~fro&A~KUS{0d>_rDz_&~G!5xYEr(+R3pY#u9<(vHXb1Mee`dFNoZR#o0nui+L^#FCwSV<;uR-<86_5{JRpu7S?GZ-d2HNl zvOVjooKtCC_F?$u{I+0l98pES!Ek(stl1q0V} ziNZmOsFUdO7b-8UAdrg~*t7P2g;*jxS*5@2CjSNDZf{%$CV!A!x%}hU<0nFL`JbO& z{O_m61VQ=-L6V!{3o~(+aqJ^eT%v!$fj4q)l&u$sVj|cs@;-hDK^I^8Qc*>dztWO> zQ~e7?6sP<^gA*)IPjEDTNfhKb&_DG`;$MIyZs^Um(LuC$GZhxfp6G^DC!q`shUhYI z7xq07_6YqQk6&J_#`4&8YhyBiilqCSK_L!w)XR1W2~ClX8{Qe|2B0ov_>9d zX-pTCmWFx_j7upg&=Y_NN04fxt^k5@Sxi)iozZxb<-@$_)(H_nUc8MB3$dbtLX;4& z)jXn8mSw3K<*51x6@85rKf1Y z;!)Z7{%Cz1aozVj41{>oB!O+@4%kcqnj`~)3j|PZa&DK-=1cV|f2y3Yu5cmqSA3D&8`IpM6+&(L{&H0FRsoo`AG)@UK{~v}F%SXs4x{qj=ByG)FH?GXdO5 zvWfn_5-+f;lj#ux7QhG7l~X|Q3mAptpk9`~R(0$E#33Y65L{efM)lbiIG5v%0jqw{ zXRUVzCWe?K8=ITJJK_~s|E?49aLIY2B0yORO0^3BuLB*PmFTq-4muKoWQnXO?$^&_ z4iBUdT8zqyiXcRgo@Je%nu;h&pZa1bPvtf6Ky$cOl@-Hpr-OtXogpFzO9aVB(L_j* zh7%aO;LJoU%q#r_Zzjlbmewfiw*sT7d0k^eNu2f~~;osRCeg zcz@7#xHkR(vQoc1+~0uxXDGUwd~O=Pzr9FIq$%HJ_o}l5tCl3s^`O8uYDiHSD=nuA zRQxk)@uZgYGln101RM23o32F|@Kpm-B-*V{f+c7!qgU(2GVH#LIdo(95I#CG)%YDO zwmg<^3Jo7W0&BL={z!ER*|Yj%W(aLs@XQJ^-2696cV%cFjCC9$cQ-)UiETz`?i?r9 zCGZ3B*^XD#R^w!1&{W3OCnW)dV2Putu8UK=nfTa9K#o;ZRCL(`P7{H5d-8p z`?d|Xns?hJiQqHR#KD+c{TzW;!+LD#Hs?R^AOvVgA>~m8G`KBO93^foMu3^(I9p9N zN|!tUvekf1sJ6N~mw8VV5K~IfgD5v|P+~M~F@+o@NzmYl$lM}%N9mzfRRF+Kwgl+R zcNUs!HFklMh`)owGjc#S>`S1+48H{@uT-i5!aK6860ujI;9R|8F40f$=z~SnCjdn? zDzcD)bbCEf{QKxAgZwTCRR%AFnlHd|GE4&ISDh`vMTSKJV*CnAaeicg(3k@q77WC< zQ31UkV50JtLqSs3-@0tvCAp&;Md-0YOK4vlAJWo4Fp4T|C+p5p)ATkt9@Y8o2uxwe3TX_GHc zPg68Gsc{*tSi2NQEiM{yBgwXIz^_KsRaRDEFl3#g{O6J$k8a!L z1(&tUTauQMfrb#23 zHE;&pqXi#r?m#|oDHL7}PzurAqhf%A8(J(90=z-zizB=%;LhNzV0Cq}sYVpn1W5QB zJH=nVP=0zJ*eChltKq`!d@9Wf)-{moBJb#U01_Gt$tqp}()f{@nb|6kHzz?=Xsc}& zK0PZUz*hwTo)Zvx?qqUV3;=9B2dxs++hFzvxELEVvmj8FH`+|Ky6+&=PheV}eshZZ z&*;HF9Y6ig#4&w3uKF8nUF`mSiD5_Mg#S6A$C1!?<4K*5{O?b$-FQds{vL*1hoco% zb+)bKW3E6+<>mhwHyGsoZWvyHUh)rLBYxwI&_F^WIoT|V!R&+f5uwejtWUwW($)+qo17;my zwgwfa#0zGk$qrMQM60IXm?Puq12|U34^>~m%?tFy!_5=%PASm=igjHuGJr*T!10b-M8IJc zPF$lmxb@>vM__{ds~Q@aPjYm5g!ijstM|Umua0p`07eZ& zX08i3iA786-gO`np-(C*{Y1bOHaD%}PK=vkw1rM-= zsu&s_l>zH+I*2NVreFX0IOYhVGC_t1&_v_&44&?R^$U!g?dS<`j#D6>31m*59WHki z76yTBsas)ES63HMKX79R+6*K?kz|1{3oAQ2xB!9r@6F2ru~OM!gM}8eJ5`Q*^_YKB zRi>N+GDV63)YBL*O}nG=xIp$xfiF0=@EX{0U)zKa=m4z_usHjH^%tCb46pK$7nvSB%WJGt%_ z6UL`UMhsXt8$7!z_Be^W6H6f;pr6%Fim)DM`OweKrDpfA^5b2LxaoKXK2~ceNs~I= zc4G*>Q_@zA8s}F1aJ)oX+H4Yk_wUy`WrSIg^h#3RLi5e=wq%N}d+tNGvsu5UP<}MS zoo~ArWG;VtfDXQ%55*?EH&v!l%b7LZvz%;v87!fO>xexH6TkcYsemK^3%66$83h}i zV+FUHlM)9t8N*Tyv~p#fkB9$9UTHdRSfErU}fzl zI;FaBh`zfO%fGY>Nym#KE5qk4d1?5Af;SbifHM4AZ|hEhJFT$08kHdKjmhB!Q{VuW zfIP|0FZnlNXLDL60f8ZQu!x4|BZu|z$9*ta){S_L;@SiWnhH5lT>rV>t~(zp7RAYK z2fQjkX4@l>Nh+H_c?E**cYtFt5)3F{Dn5K*;79mZy#wA2DG{NgHKLp%AtOs(k{D^W z+B-$o?tNGKl5_=WD(zR+CtgNP39V@w(5GvXS;RGNLgoQZw0OK!n_?MHBMjf@5GqQl z?8x`l-Bs_~Vhf|m2hz(-PjXJwZo28WH#%p3v)6cW<3d7ui_aAwwF8x8vLWG0QXT$L zkeO`%Lc9qg6yvoYZkOdTjwo2lZ`;aEZqMHkKiH$^Vf5D&fp_BT0?Lo2cuM5+FNad{!HNuf!89;f%YOvZ%S-3)6Bl zLC2k0f8mX0E15#~p)Zjd_xQ_k9|b2WeK7xLVC;lB41^4Irk#MD&h3zo1Zs{?r4C>U z5f|Mhjryi2uD|lv2SKtsChRs@UgbsB9aY@iZvhe3q5H3Wd(|4zYHaqXm|_J2Qr{18 zQA1vKQ(;JlNWTB{oe-q$Zl5774cGQE#lJ%D^@h00aO_c;<~z!e=*2L_)Ir0~p9{gKC{l zb`TUNi(|0t1wnI5*6>qJf6!|MkUQ|^@*Yy2;uT?Ev}P{dWz(k6;Io?E$3#XbDtxk5 z5f=tKuhsX5k6iHF`T0zhQ~h;cymMDvMUuv**qd@z@A|qvt*UPh>I6y^YP|TGRqy(A zZCL5d0^tUjQwHgmBm*X_iNYi1bobA5R^JJyIm>BRGHI;p9ufG+&p?r<#^>hWdk!xq zYiKT29vO7vF?c6fo2hO3XsNMSYEE@_LWUdj%dy_??oEt1H zU0J75lhmrMrvLIKS$v-;#EITKP(fc?8zx4nIfrT7{_dn-J08E(J3bbTd6gT%jMx*| z-`ZKGBrG)?QovKWjqgz;n!@lVj(0bzGF2c(ghiV|i4&JESWr$?iOhvpS0_hu>d-Ax z>84!)cf9BOuEr(T*C?}GOLTu0?qI^yBfQ?yU(U&i`pd?)OJH__72N=M{ z)>aq8pF5BiJ_BG5D^O072e6~U>!r_ty((C9*Sz8B=St*oxxr+fEHS-`p{oDcW~;Tk z6#9x;`-!@9sBl`>)t2rJnp;eKnp`Es;>p`iZI?Gkva4rJx@{mtw`5vi-BXu&=FQLi zneqcXn$IiHZOO_HOpf+~Z-oPYGZ>x6IG}n$I>H{_^lK@PGcq9wiu#sYeS7yxn(Qgg zlAe!X+uio2wt|1#(Mp0{!fx8`bK74Zvb|&!)CE2Ms^7Nr)R6q?&@R(jaM|O}A3Bzu z`6FXDOV!?frBH;gZrBh*a@gX0F1sK1^|kPM!PdLBv=i1hEdw7Pq<%GS3Oi|Eazz9v z#?kkG4`uwtcA5h1qz>J(_hiw=SD!KCv)jxMUfm{7~Gj{&o z#V*0VO;5{88rOIL(rij)tkp}rgsora(7U?V@0jLJ!F4AUu+;hVYX3TM*t6eEhqth5 zQh_u6$1m68I-rc_iYe}>~O4# zKNS|5c7>r!<33y_K9FL}*GD=2z5HAd$y*1OXGQC#e`7n7qTcC&Bht!>lVQC_#_7p9ZY zbzLfBe>TtaPqE!k4zgQ!t(6t1hWOp2sus?SljhTmTTq9H8bAFh<`FM4z%lk}SMV3L zIjz|DM5z|^zx)#)Fg5G{+=r@YvAm?2lB4O)w@EdRJ-)V8M;l%APkZB~_4laxHn+5& zUd4jLmDeMSi+0z2LZu3HRlh&?5}VEVcAYqC@;~XD-qkF{JYOEfd|zqEj%(m$+V^SC zV%C_lea$k_Cg&+S_FHn!SJ>CTokX5{_a4tgo=_@mMoga&Hg)S7L(N5vE2Cm|Q*6&t zsNO34&1rtqQ&m!ctFMN`#GqB4j9J7hD`5ZYQ$y6Q@T<|VSH2%H?lfm12g1H`=|zn8 z1Jr_hoM|Rj@}TGzL0c_i>PtPrgW|wraN)U(J>p3qOAMy?h=hgXje)Ko5F4X0fq0|$ zpu*11%}2vthsFaGt4lUa8mM(6eu3JOFkUu#gf{&Id0%y7%b``LczRrWuJzfX8((p| ze#(;V_i#GL8P}l+NbL98b|P!xfY)YH*!u3~zk+Xbyp9l`x3H`g@ol=i-P4>p&*+9j zB%!3J-#*HZV7>f>=sbzCZS&N~84GUQ@-?^nU8x!FwIszx5Qn z{lmB>je)(Zi=v)gu{De;IlI;^*FKA_Pa|3hv^>*n1#Sete;wCYsP&C`+q$Z&Hoenj z8lZ-4=-U*9X7lIVuXHP~!iLLs_(Ph3_q->v&yUP0zmbDK?}oT%kRz+KZM*uO=8@zt z>sPfK``Wp+3$5!q{WXNOujg7==)RN=w2|5$RxnpBUlo43R<*Rkx5Q+h_xW5SxO6tJ zDz8JJADy#_ZZP zZ)#Pm^cfRB)fppxTGLY-F`aL}S0nelD@%7111ZF3`ZP(T`R+5ADXZiWQ+|AQSqJrl zDS}s23V<=LfDH5z6k(J4BDD(St-w4k8{l7FM7W)PpqvTb{gb$EYX|ZG66)?oLWl(r ztA;2@1w2i>H9iRMQPi(ae-~-mO3!vJJkg7{!UsrD3|;R)QUHg-Pys zRaKKJu-fA^cd2kY_^kgU>oaYLRyc$&VAZ3-eE*e&V)~8Ii^jRjSDRoK^PT;a)9LgC z0%>u6t@FxnBt;a7a;_?M_`*auYj2-F0J%D8UpMl!%dl3kuUf3>;?tq2O2tgnCg%6F ze3y!sA8`n6unoUt!Ih3{S)^0y1$=T`*gyJpJN+kArrcI5c7mejdgdgR7-r?zre3+_ zB&=@Dy#4W2ZSM^F%&VT0m`tJMbrb)~gLnfzho#Dr`Cp*|M#lZsg1VNk+NLizQHxTM zh1v61&^##G{5ID7=XR&xHpr`0e)pHvCaol>1@ib~%ZLs0}C@yw-wUU^ULSXxFO#N^S zSbMvZrI=j+aDCj}mxJW2umB(<`V26jJ40G)7NR&5gh4eneT~#=j2_oLu&B8zF4e@~ zO%cIZBUn9TSQnEgf0}yKcb97=>(0>6V9QnWS01GM0&8-e%@-MlJB(sZ+}adqpP${l zsd{H%!kwg*uJQcUfri|GLnTJ@TSIjVY3&c<8hf!VQoBAciMioRYcj4Eq1yU;ePcLZ<{c-X?se0z5 zL_8O!u$z1D#YU=qRhr+L#GN{1R>`e8nbFWuDTUtk_MUm-MdciG^+){;kIFf+kJL&7 zmGzYBZ%U>OH&kf0V&2>JLO4#~-|9Z$*QgpN9{$kuiv9Q8bBn5Jt>?t|YEr}*GwHe% zona0~A7W@u-Bx}s(GKI>JI*3ig&wme3YY$A&cs9txjEJ=7#?(6xBw605%(@x*pF~B zV%Mc7fMQLK_5R(Niago|_5qLc9MgDpcmZ1C8dOVCq*4nwEE!Tx;Nnjj^HTDBl}wyF z@+kqOmb&)liT1P?8Br4?v44-}X%#E>6xf;OD2Owq8yoG$Fdl8aJqVhkjt|#nBjTuJ zJHK3-_inae-92wH74ZCKyjSy{`Kd0;X0=-nt$N2!Yy_PSrWs@iYw9=5OdeP-<10+sh@gvn|t5$T+ao$*6Yr!dFpLc?*wIH zpF*tSc4<{HH#tTtmG)8Q!YXbg?F3pFf$TT!-!i{=zijNFzyH%;=O56#uyafiT=%Ls zlbfn69$6CbvDBTgn zZ%|X3R7~h|>u%w1%B4D)bEOwG)zS&oqg^uy#XK%a&3HF>w7An-L;$t{X)lPZAc3?} zgI&Z$=r-!l%YCOn!6THPxF()M2GLr78~a}+Dx1wEL&p67w2bTfUDEG2bv zvD%%#q(<5WHc7ase@xJjl~w62_2503(XdmQlCKcqNHFG|<>0&jQaN|h+AqlY*47AF`>a*4E;B#VXA4OrKM$Llv_}M z3oSyj3Q>g90?f+vWZ%c`9$ILz&A4LO016wC2L;Yl+~;`LjP978C?5oyTFQu!D!W~K z_{8SM>f(l042>dmOt`J!NXqXq5(D?{&j{k}*6KC4W=gX*oS)OxS1ih|)d~gXVQP)HHQZ0jY(?2?C9CnH>hkab}tAYgO5f5|Mc!e zvje|zUaG?}fzQfwwK->sPdVyKNU}3M{>7ydZQh9Qu06?(U8YnL5k@xgW^ZFdPWd`? zVF%R++R=TVHWE;4Eo!z{pm)u9oUd$9#G3Qd`B|(Qb;{)7LI9184qbQQWT5Zb zeFuhFhcchC%K7-8OSZg8T}c|eTjEEU7NB%@sCM71a&D4xaung*ADEmr4pE!5T8!8e zvWk5Rk-V37i@>|zYhJJW(wiYEpgCk=zbp)Ef)szU4j;DAxIg~UGf|#*zSQt_?poOh32$w=)2IS-TKDy&~ckR44c7JbQKF%iAkd)t_sGlUR6*hT);1GZyZoNRrtg zr<0QtJnPGrT%D7k+dFXkR^34LtgIJ_ReotM7(D`PT565ktR4#a2*`vz*oeFi7N1*! zXeJZT9|lx$v_F7q-{O7BhygH+W#IP%XaLJCZsh>|cr3!x_?=h2fnF465^xWXivW$X zHh`N0BW!$-{qqXYG%|~UOOJ&iZSr_W0qDE^0n9G&8xd8@5BC?K_xx@O(EKNz0W6+& zxY$DI08sg2P50t39S|wBdG^`77efo1T8t7ABv6KjYnCaQp`FQ}0wCZFi1b0jwG=8B z$HZejPLpO2yux361|&HPIrNfH!KO|nL2U7dTemPSLDARePm|qc!7yun1nEH!zX~+m z1TVU}q|VnNiREHF6Jc7oMy&1{NwQ_k*gf0^kod!>$oqrC`vf&Cvh#Z{J+}VxM|W%Q zTn>gXGSFY=od6UT&@lLF!L)A9ZDyA?&f!CfY%gt?0Ep5>NPXd&T#3PM7<^r# zVUoZlIjj+wruhQk3H11+z8z7IG`=2#fd2f-bI@jQ-*bC@Gv%-fOqPgnZN3-cjlEao zWtM}KP2j%XlTxtHZ$U+1L}DJxUG6S%|CI=KnF(#crOG7mjt^2GAL7-;t8D2!4>q!6A2X0_aZ3Ge>PL|Ly_%`pA)O{9SXRA3-8L-Dw26 zlAMj^lWGY~nW%YiSSwnA0}=2Q#pvM!P79x~wTa9jvKqZ{RH8mJiB$4 zI=;rBDdv}r%HfYbFD`U4Q46r|YFVjYgI*aO1c1fW*&*l$fiSomPaw(sC!Y# zQ(7$J1ULpI93hrSrX(YfX8?@6cQDC5q(+QDms}JeTnQT!5{JCdL=l|{VMg^>Q3FJ7 zUiy;JvL`2`p>WtOwAS6GBZW|IQW%804C+ygVWyBI9VaEKH-wDP37XTOyiynGnT4Q6 zG67G!bK%1;u);d~d2W# zQqL=xc-nY6tID9YgO@kAQn(|In#wb6B8}K4-XbJzA8E90owIPPYZl4&U-lSHC_~9} zaUqrNMRJmE3IjB7<1j;oLgujNr5p-)vvMC|2InYc-Fmh&5=b$%<5cWaE;sud9~(FSNb2ETugNI&W-2)KS^0UUiCCsl@|MmpE3(UIA@%ucT*3_4>t z&tIDNg}`MWPoO0g;c*G|Dr?%^+??IK!IPjsP(x<0RO^yZ8^C{2__riUozTyDh~C=q z8z~ZV82UECVIqMtXZ9eTY!H@2ewUA0NF4-UP9pIq!3mmmnIzBVPkx7wI#GGKlPsfe zpkzzwlF&FMgZF?{B!&m^F<%(~4bCx4@HRt8lKRJHXLPb(swy`b$2Kd|6VFZWG>9K| z-OvTuMVue?S{`ljZt(73?W?|b-phVYL-0j}!Rr)Q9`%q4j=Egq!I`HeMMh+ijFN4a zLm7U^7U@u+`K;1(*98uy&6-{$44#DqIPk#a8TSQ_X;eFyp`rW=0FzcF{wqQc=m6~G z=(ypnZ+7cmb^q**C8-94L$LNe)u|Elzt>U8%{BB?ygO zot`JY2E+{Hy>UE6wFD6|Mt#($)+GvHJ=1zb$gSB#rfWTM-^TP8pL;5%^$@an4IC{5 zBBkqqDH?c@<7!Dd6o~nI94yX*07cM>2Hl}{&^1z<20wtu&I9rpBD=Z3Iu68U0ydMD zVA;rSYzJA5z+C@PS#Zl#;HROXF$s*_z*?SBzO1XIt`48~ND=u7;{Lk)##PI|@8A4A z6nzDrb;K6%gv%1}R8M78j*W@g_5n#AU=EdO2MegP87SkT8nXqQ#B8UTy+NPv(q?}7v63HX@_19cNfvc znYloLstODx!PI($&0Shr8ZBMD(?8G;z9U2>vlbTVq@@6^dLK|w!2&N^4Sbsb|1EgX z=lstgy~Phe4psNMI575k0@wxGe&V?5&qUnCozJr2(8zyOiF--?j2x9{>6CM^B{1Vk{tIj_v8wk8GG7%RtQtHba5Oy-zm&au}i;&DNSErs#jP zdW=CxbN};$EBzi;!x^*1s!~M8y)794i2Z=c#oiR zi|%BJz1e5Ljsf>nro_d|dcJ{JT4m6Zz){%ygkDQp8*mP+ag?U~fD7FjYBZSp%Q3uF zR-=P6`ft_^qakR~`NEu`q{xSfW|`&QQT90`CUF#eej8C{0Pe`=H0!EcrHhWFgwR0} zVTvGmVPg3JuZff7?xUvQ3ebGwbE?u5Jn1xi2zS)PIkA|;Z4 z+S-TJCj<32i^%r|#G}+lx)b7Z%t9~zdLWO?7_rd(H;Bk*kGmc7DRtu_f(g@ak$IOF zLXnt|s)~BDGy)^>@FXPo$N(mUMF}^IzuV)8&(&2>whEINTQTnr1m&Yx=?A|F$xret zKhNs;t&GB6L?Q};BL=k^zZ45n;@Gs(hPkyV-Mvk}kH=5{=D^$u5v9bisR={|?3aKl zFljmlVI6%Ew4-z>+hz&HybxG17uOZBP6SMXAfLz5;i0Y5s$hU7{hmv??2&gB5CA@u z4}y6=-y^ZPu|INX#6@O*yPhnbe}qeZ%!|$6{O$V4^g(-M`ZOJle}p>&N+k#skgJY( z`Yn24CoPK~gZ|->!mSqlM)`*p3fBc2!~Tat2?v%d3bx^&9f2Lce=R4xM;+0^y)#td zzIKW537ZNmYO1I}^X9qp)S|Y&q)di{JyNRJcfIBF7w!)u=Ju9=sS*;5Q8P_;!wFv* z_V6O#M@v_CESoP@NfdGZ@VR`4(rODVQ3_lNgz)i8>-GKshmgnO1-x+IZ=6@e@Hhb_ zZW~a50I_bEsMH0}Zoyg@M`Y*;$F$B+E(D}YMLo^L z@#PTaNIJ7ru^DDIHuttAXT7_zMC&LiDq>NScc@I@b|uC>GQ`3oU-B}S$|gdvFSh3l zI_d&5R1FPrhu}qqxX53{7)A_N;U4yx=MDaYQ%(O;|5_gQYSUT#+&H=^$8B$ z@PW$k6!;UBa!pTgSaRfz=i##Gl=Wt$md>N`;gNM@n14;egX{-1Qh0R27{YEy-+}Xp-uub*$9qn68)@j4NS$ z1j+S~BefDFNAeD=n!(>TVcsF#6G7_Kfo4 zhFOct_jdN$buX0Pw5aS%F?}oXswi%-+?^im?F|QW#TT%dR#rBiDl1rQ$-A4Z4b)f9 z7V!Vs)8TiSKfLMO_W#Iw%c!ctwriX2?nb)18|m)u2I-WN5Ts!fA|TS;-O^nWf`Fue zlyoEcUf%cf#y7q({K4=CuI;t=+Uq>$oX5$v6wIK+sd)@_2pHq#L>0<9Mchc z013VM4DJ~zrfS+7ew9^tOoy29yn1K{^U!ukFgH0zX3RMmJ0{}IJPcGfbz^!6V$>9(rJr%&+$*P5IJPjTPjB0qQK zd%P@EobrV5&R9!twcL2oDBWxGVrS*{h@<>%(D%nn8ByVPXQ48*yr8f7T-y$AyP~OK zcQj`1ecp9nlq$c=vNw2iY-efTZ*?I4(x6K+h;lM)%a z`m**Q=jZhfaeL2A4pnvhyYSRx0;C*DgUYJ6;LzhK|F&nn$z)GQ)hjE1o8m0xDLlu= zkN@)k84T>qY%GtDadtfRYCYil7*wW#Jow^cW384_*Hd~)vzhs!n{XnLh~@m9qDS%i z-%G>+`9vm`TIY@Kr*`d;p2wzx*kV+p=10f-c*D4K)`#uGkXNEc_3z$*C^H4tUJ#(T+hGZ!5|k8$c;j8sG`h76VdQfQ1V)m{to-?PQlEQ)wxcKe8)WurZ{aaD$E6|!vZ%>ZX2Gb!(OmF};EV3yBEU2Wb{ylcB)edoMZa1Q+&N`QaxL`|Nf!!nf$@ zPfe2wz1w`Nbr|RamYKx)c|B#E8wX{w+$2gOKl7eg1uOPP_xRZ6)RjW$?e2rt-Dxc{ zYW%3l(EJqhUtP46-n1R2#6)lG#TW~^*mL9Xnl@YZU?cl=O_89TbvOk@N|zILi{rPF z@$J}zi3@xiAUGzUMdC_B{K}LsdgN=(Hg+|i%$O)EjUivX5u8MABj}`UNg1T8uS=^P z`@rVtud1%fjWE_$9g5uu13fT=J&f+RhW70uP_;F@Ggh9+d9=tWtnp0OZAlA?B;DkvYUj}n)r2AmzF zm#j{6gY!bC7=6EVYlxnl1;9|jp+odCKNo1kRU#<6Uu}lQ%fANWsFe5mTa5oxmMvhuK=FKIp-3qk4;Qo(Qf~)y{mTrado$JyRj{!|p z8JxHwW=GRiZHiXh;9`;Ae8jz9q4l%LzZNCb8!j9!tY*c(-k|tmACApa5wEf8g3zyr zRdNL{#vk)A&}T8e7k8fl#fpN(U`x$F-v@TI4ps>M9hKG0*MZq+h<38Dblyb~@L_wv z-teEV7ETRdk2Yo3H+5;YZOiO@foyt9s)Yn>vpp{UbrL{fuK2HWG70}iTJ~UiHMOhU z{@`zw2B%}D%qmr_#GfnK>^7ZZM^@c!^@ytI6~YR>0bRMJc&1X0qw}A+0lJ7U`W?w%^^dDCvXob>A-gFMKer`rt{iPPQd^=)3$?Td zy-p#HO>#WUx?OC{xsZ3jK}O7?x0ZD2w=Q6|g)0C;l5OO7$_2|XY@{fy z3Nk(2it$|5>Pst^ghkK0!V?V`y-Nc{L>cgX<%WdG7w|Z`hX+dXcD#ivnJ400H=H-N z;_N7c?s8xLJ_u|Coqk$;{?J(C?a%F*m~i?l|IHi&n~7iufK-A}p}7iaYWaYhyj#Xp zgS;)ti+<4*ONW$0$Mx%Gmr-T3-&qP(G0NJ)0V(|5oCPm3+gepZht?k{HQR+X9R2%* zfI%!7&iA1-z5E+*2lSe;FXVLf%+`K>*)dZ#?KXV7qvtPEE~#R>R&yq=YpH5;y3@d| zyhHq__s2Mlc6+Mu7dJB|bm783CU4hbobYFMw^T<6t0Wq3Ra`&I|M36BP*!87Ul9B5 zb^ED_p5-U?YC*H6my(gf`7z_>uj(e4EIYgf&2qFG_(PEvv?rcI8JkL_{#|7)leLfy z6pGF*R(>75{FkL4{hn@B?5VVU-OZLhk4CTG79YfyH~zFOb^8Q2mt}f<^RZoK;vPrYDt~zC&AlO`qR- zJLe*Ni6$+hL>)XbiXLJDSy=iilk zs=Wfoa|FrmYo>SP639r9qoP|meSVj5ZTeLJ?W@@8Zal%>O_#~1d5Srq;&KPrY&;zD z=1c#iItn@HDXRF8b!9wW(7@x~;+=Ns7&=wR8ms;Opc|n@cTzX)wzDvVvQ{3OH(stx zgyMTDn0;8CP$^=&Fn0LE7_!cWTK>Jxk;~mMK?_tcdjo&npBCWoVAKB72#wmBRb3WW zevaCLcaP^9(AVP3U?ts3I5b~iYTGLM$H?@;+wu&Oe}V4vmAT>k7kpU!cv5EfHo`l- z0|+7BVrr_$ZEl+$iR8;T+oBVZ<{O0_k*6QnJ}bCFnwuP&j{B)QA2gOiP6A%H3(Q*2 zI}49TDWo_)^;N;Nl5o4=OIviOxk{MA+ak>Wv_f_2p{Os=D|f|RSiTU~CDXg~rSK}z zsZFlLVs|eZ7aJ$m{AnxhFsV?XrF~5#lwO|EdXO3}h-Tdx^Q5mF+h6f5=`$9C*uvlK z&xbTvq7wi6u};SiNxZC%GO4nry2e9i@y?kdU~I=DU0~jtj;_PSH$*EPwy; zihFC?@3D6`Uyj4)ejcN^;-&oQ-tnph*8dzbCy?V=SzDT$(NWrVTlGz!r68)o9HO_ocY>o^?sg=I6n&;d;Bs^tZKu;L%BP2UiK#pqB&E zHBDXHK{eAU5%1!oUoNNhD9zL?eq|I;taQ?L= zi|8sXWLDfw+y(Xah}-{L#!euHEq;b#OcdNSB^a3~)Z?P^vXl%;8!Ac)zIzAqV!l>W zkCh*mE(i6vG@d7R=H2gv@KBD|8>eIGoDQ?nI7|q2j&2vpCaN2B>Ur9?ZTMX~7OT4A z64Ty&{k?yk)ZtvASE$E#$m2UZJKl=mddL|JyYjfUxMqAgU!6*AM8ah)l&V3X?GiPa z-E;Z9&v+{T(zn-<1!Kd|?@rB9%haP1`3uLbv3uKbn`-6M4{X>S`gw-%g`TxQ|86aE zyAz6T>Ppsvmh9;fkB#Q}*zKAxX@B^4Si5Qk$s;9r+m!LCOSHAQ@c}A=L&>l61)#TqhJO8iRd)XyH@s zD3u>G)R<3JerY^MvhyWtb=;1KK8FyhKpu<2AgDdf3VVC<9q zCdyS6k@d;yE=^S+TclB%E%Nw-PKldD>q!Q#n1Aq(i zJy4bM>-}8@pS*s~Z+MtJM#&D20LB$5GGf23+5jO zTIpTed4O4;r+D21tgub|_B|u`f_EUZaf#Hc0lk?@R?%F>0n@83r>>6X5Vy%cPNobe zk%1lYri-p;nct(0ns3QYp4BAzjs@HvOHjW|rS($lA~)Y#)m_ea#bFS3-S6~%VnDI% zt7*J3y{af*;keCdq?ssOcaSLA%MzmzFf$BX6R;Ti?6!9-re8f=B{uiw`|w(8kanx> zb!PKN=wKoDo6%zXDP6gMZw4#A!_PbNr|c4MgC75&Y71nE=>8_{`aSc@P^5Cpaj8l* zjz3r8i`$i{yT$R)vYK`)&YK`^i$4FT%r?Htxw}tr*%NQcD&xxw>M}bv_m9{Z2u?*$ zKKUt}!TbU#K*!B|LSl)?sPTyjpxRzOK0X@Bn+A#M7#rgA2K780yGdIfG6k~}Vj?m? z$glTqH@;0xbpw?9sHQazR`?1&8qvDLYPL>^mfZbbR*gjye~~EHPArSPR67oe9d|zy z57s4u)>IpJ;W(vkciEFqv`9&3GVKH(p6Yz51#Qhoj?A(cW_2ZhoC$zua9R{0|2%67v}Dlu z5L$p_RV^DYdU7G)4-Drj#9Nzh*`KCfYQtC%cJMxFREE0VU63S^fsF+R zB?31_hnM8`z7TCDTY(dnwpPn0Evy<=$)9>0H!+ZFMN5v?hEC^ILA=G;vwxZT)o8UV zTz`$lDzQoj+m8CuoPy%+JrdkBW+Fc3*q$c`H!u=`%pgc60AGf>smmK%S$|tuTYp&} ze_3jrr|a4f)lKdAsLmSUi9{Mz;kl5JKI;r@vZj@t+r_ppae2Y5`VjKpNN|n`Nt-B! z;N9Bjm2q>d;{N=jJWxY-kGk?bm8%e(i23I zKMP*aa%Zi(wNIc0Jf;Z{)gO;I_Ppuop9&U$V`i&ew7xf4tz0%bF&oCeGCH8@zzT&S zrBCD_I&Z&jru3>#ZWjjvVK`W3jet3Ib#?V0Z~?@H1>81-0pa-P<=#}TnD6;f zdsSTe^R~n@Y)adg+;l)2cqcDfgrkWxxalrKjlF8;??cWjEjq})j*qf^Ow(;NVP3g? z+BUt5CP+`z@P?k~Eb__Bj}bu;j;IMA<^H_dvJsW!fv0y=9tpn|B{hO2 zX#e{>+57ZlK@rANqVky=b@H>A)B38=X@OVMqHbvFHav zzqony7#D10Vk9<%2>O`Iz@^kOz$Ng6?%}x;bJ9BCoeGC^7zEkXqA5dSe<*k^cT3#X zh$54SLD3v-Sh;QoLq@F6phV`CAK04z=SlmD^$dyP;!6p3;)r#v<+n38d+Sh*Qa1|BD0xiUmPdD)CD@caeEM({rFuZlt zmOc12RTb|s!}9A8&0X)W-|(in3uhaE`$d=8SE@{*f|;ua6Lv)U+1j;nr$gRO=;EVV z$0Nc`V)_XFAuOVZftgTJ%>k9-qtlzs#EJ@%^oftZd7qXA9%SA0W_CP>w#NQs3P13O z)vndrzQ%u@X_Qth@iAU*n@Gb@moR2{jiP`~F1f6%N{tr3wAn}PB11>}(4CZ`gypji zK)Ni`b|}6S8*y9?FU6n^B*Wniw9P2SGH8|2NmmWb1`DJ}IQRukqDWgaA0eM39>6z# zX0gj)FY8B(zx6wsCjB@@OPCBnGGh`z17HAyHwq~FUM)5HPRCGit=5XDq zJf>(^ijK)e<2kIkxylY9-GBJ%zjic?PpzbnZ;dZsY8c0L7S_;HG+LVz$mpu_Es~($ z@HO=B6x(hlss29b86may%y3t;u7`smD%`LsBZR7`t0*Xd*=~p66+|(?S1C@?gqIV^ z;m&*19|@g*k!}CUDm(sJu>_k7pP{o!qR~gt#Jif#x?VwPXsLT9P5a5dYji&jqDJEB zYmveq&+Pq2VkH_avL25KT1A8q=3~+zKV(%Kk2;2;1jKiL#z%WV@225!-&0dBv}sIB zU#z~hhIgvhJi`)L0cgWfi#qmM$(#yM1d02JD+#p4c=aT2PW}Gpd{P67Y0&-*m8;Q- zi>tnxP(cVt=y%AwN(80DoXDXF6=NyanD?kr3H$+U0bu!;JM|u6B5@}`q6u#uGISr% zR%1CP2ktM%%{GfZnEQT?Bq1QkWou2iB+9RV9V&<>kIum>jsD_j;^ISyyn z1&s0Y1bBEBM6mflxaS})!9Z2d66{Ngi;Dw-E!ffbgOWmzSe$#9<)4V%oZQ$U7R0~H>AT=@RGvCF{e4vB}TX+~FoZjz+e(?DGm0%jV#m6>>S12v8*VZ^I# zkM>Gt=4uN@c=aLNNfp-O==CMs8J~M8+SBz8iZfDoWm}hor|?Gij5mN>5$S1J%Zs~& zoDB~z3li1#g-{H$1Y9Tw*%W}pQjax|@s^hdYxlDgFiz+%V3r0HXkg%S@~R2p>{etv z85ye`*CMNi1P8Ng`q?V>rH=939EtZ5yf$|txDI_E)KwC<^Il5lJqVV2$q3CwKu=N; zLKJDFky9pr1GhzuNqhflLkD;bBc`H2l?H}h_XHxC8!{nJIDa`VpuCq5MgW1e2xSbw zE9xtV@gi(EQxxs$7~M?%-BBz)37}AH>HP(E=!qcPjrH62o>_PiXhn5(SOTTwyw922 zJ&zMTc`kq(^_yu=T-5y+)JgakAr_WH;4Hf`(9?ShU_L09mzUTRAi|Dg(&?An0(ceu zDL~qv)$c;|7zQNKst?j%%eyLx`vyIoQ5-XzNGeB~Mr3NqS1RA;&9qmxURxOs5AFZT7ZIp!&*H1s;l@k&y}R-S);V;b|GkB+&=>r@pN)GH6D)DDN=T7{ zL(`Ok?$MQ@hxS62Y?lK>#CWCg@T3NuCKz@W08LWGXd((@f`>419af+5uluD>nr|m! z1VS;mYdxZlV~#-~I&(FjE#^_wP;j#qQ3doJJ7lZgDYfhsL}~gps!5aCxMz`D6Dvqn z889KFycgY%qvF&z!BEP0x0H!Smr+VM4X{x1V*op9fMD>W!B$z#(2X_!pXotV`qwD_ z=IC-DQ2Ix`klWf0NGrMW|LgkmcYTnRv)-f{mIBNQz8gV=gfWuN+^KgoXFmlkk*ciF&$;dKvyyZ?+1ejUKL8=)=S&(teMG?vHs zIwSbu`Y$-DbgmZFkd@rG-S05tJiwCg}(0 zdeIc3i{Ys>`;DxY&v)aKCkAc5b$A|N_PqEeeuexkud4XjWxoMF#5&BtwMLP+BH-|= zuAu=XjU`pcc_}HUtAoUhAw5IUy1F1q=rvX2EWjfH2c{+eV%(?U9czyM%-=ZHL|<88 z4gq+LYns)sEE>NpMQuvSmr88k5W=>_eyA`~T6v zZGf@RAbZu6?EE71%lkFrLn1C$(zRF-EOR-w9Y3rS#0rNAIUFt}hcFJw6lU&J?fz^P zmPe9XHkWo|??e)yeYvLmqdKiO*rKiz(5)UXg`$nO?+FbV*P|EB0h=*Rr$t{F2q2~q zi~4a2kouBmw%2=Ht=2oYo=>ed9aT|5>3}f^O$^+7sX{F##@3=yXSx&7O3SuVcV+Y) zh7mWfm+}h}m@|3gA`8V>*WaVF4h|=%%HNrz2+5N217h80BceE|(9)TZBa?JVA7MF5 z88~*okm2YJ%k{e4m>~pm7;at{(Y1q?vLV|>k&+~*D3&Y{-x_|37gU-YVILIXJ)>WZ z?q-ATO~q-4aeLGQ?!Sn#1lNLqDd~+NYA-4?J2HP~;@P3wrh794U6`+zo(#ba+Knq%_yZP4YeImlr&{%%Vpf`Xo5GDgI+ zqN+atKp`R~8Y?@&p;NC?P9ZG*3!VCpucSFp2`3NNstY&vEPrYI%4)yVE+4$-n@}fP z54oE;cc4{7i}AbyMX?Ow2)D{51#p>@oW6(%oPXmpWruzjqAys+P*02g$IxwY!)R}M zFdFk&CdEi4!nq0kjI0&h?IsKms-$Tjt`5RIZOS5I#h>r2(VpjWp9d$sqNtrW+!9d! z_aw|)Sa)Zz!H>BLYZlIz&=|_lmV17hNn!A$vsubm`k|#w`9zvb3_^4(BV^^!n@klW z`bES9lf+%XPqNA5%cf&_F`MpxU7o(!uBbhU5_FJ0H)^Q1>@#t}*JM9I$h@tX3;DD+ z8K*-o=L8_F!Y!A-`~%YgI?igs2f-_ac$jl6D5|Q~j-$SxvyF7-oqk-USeU$$r+(6C zk-=?0es<2G)V?2xC}RW`YL+Q-eR%TkeB|}8LvgQ-?!<}Up-m#!|45}xvayqvh6^wp z^^OAapjLr|bKeoj<9`2>81hK7iNw!ofE4fF+tV8zpILK|?D1O41O}4zr)5bIp##9G zSW54_l>jb8Q64U0@*QyIz495pTXw2_Jq)K9ARk}ZPrNzA`K2w2*t!CFiU^eg9hyFt zMY$}hd^w#ehR9@S$X1Pr5FI=6ri>1+*Oc3bNEFnvM&pLhj&UNQlY9t0A*54bs!Xmy zUi;Tl3hGarcjmWFKI;lX`69chlSx?a-H>k&#|J%pYsH`xg(GD%Zb;p?`7q*CsVSLRE^5f&?R9<@LYLQ8yx*oqkZncrcska%!&)E zdAH|}3cf)(xVcPB1Lsj|(q2w>=%TRg5;CXH(lw};RR;+^3iwVG!uF;S)fOWy=JjHE z`J2}+KRed8J$#PmYXnaro9EKGSEFZ!ZVYNdS7O;P(%%4& zAuF365)0YRB*GdOCe*X_PT_~hrUJM?3)UL$%lLD$pNDn7ko^s_W=M5qe(0#?ij#|l z8X@$Pqj0yHY`_1vRVegB66jMSHtVBtm&T#1dw2fJkBq;_kNT0D)bYl4Rbe$NtKp>> zg@21+NZX5Yt9r?H+rOQq&EFl``3AeUydHO?`jxs%$pkMLrdKJhV4~h|l-zFn*_<#2 z(Y$$4!w;osqFInPRlv$BrX)#jMHFNlKsQB57e*Agx1+QBvYrZ0)F^e$wBx?o$xVRB01E`Fn}1q@|1h ziPvL6NQ&xft$RiU9+lu?B9m5_Sm^nmdauN!O;7jVQtnJ+`|dKR7LLPpGE(+QOdKql z$dxrMDa!_;G4-47WlfBWryd6R87sCDebG3PyKhBs$D&8-LP$#&WAv0c2Q_QiCGi{k zNJ`Sy64`C^u8U?-VLFn~Du|f;*Rr(HwvDtEa8Z&=@e#bb1nI(!I(A|B*#C*4b!L>~ z(!lm_@6*7rqc?b3_eoCcG}>d(Iq4el_T@_bWl$|vl_ikt>S})$_7v8dYBCb_$(<;3 zla#-QGUSo#no(i!1mC9uCg*^yVP_1+hPG-iKRQJQQL#2#n$#QEF1`l2hI9tH3=hhq$Mr7^& z{{3ozsq1iahVyBs(}gEUv+`IbC;sM>cPvi8ECLU#cWm&o<4V&;Y3!T%HO=Bu{b^+X zOej37&X)JkQh^4=BL(u~*%>1O4uTd*i@0?>XVoXP?bjKuroiqLwH|f z4#>dz8z)O()%Tkv_F>DFmxp;AebU~$@%*MVag_KxbHIacuWBo5Cxo6T@XMF)F=CmUbOFL z@K(VOx2pD>|4{U0sf3^ZKkopQc59Dsm}gik z?iEPp|Iii(DRjzhm6jN;vIW5;4XMZ;c?4-3-EM%Ha3`p$r6zQ4io_L^b z!f-=_z!^gtZ&~oc=t?`{XX;$moWdZ=omjH_=&`rIN#v7=b}r>D_SuSrkraOQOl>Y= zA)zD!T}IIw7M+4t7$*vJ<`@rkWXw~&0$yp%ZB>^;uVpQ-vp&(_2MjLmQ_UrvJ8D$I@24}DAn|bGz@FKr?$dbn zf3V_=}RKJut7x(vl=05y}kff27wwu}2LG7!da9Z(nWmum%=T=V|OYb$gJC zfLwrV+cqB5QGX=iDX_yszgqxPG`59#i_f9nQ_Q#X?GX=`5Ap!9WH+G_JdwsGmB)PA{z%d?E7J9=;Q;Bh9DN{Icu2Niz)wyoX+GPr zwX!38H5gnZ^AD_>D zxS3EvlBSo9cRV@gC6T0WORMT_922mWE8509T6uo>RMKOx`K(h8R{h5QqLN}W3 z=yrg&FUhqTY{aq@dVu^f*kB=bmQnNeA#m6I0)~Fg3=ka6(0$=UHp@7Tvq+6%kUVg}@dhox_Q-T~83< zjZVj5PzNOtl>&-nJmA12YYJ8y&&esE^VSNM{=mHFUUlQ=oP9r))8Fs5JSD1o-p{N4 z4$<^KYJw02oSP^mL#Os8bK2jXhkf;Roz4<^c>Ei8Hj^Xvppb?ywB??rXxW;PhBRIdtd79{;c#g|6G{SYHKjWa3XJWFb3B^R{936P%go0w^`KgmGsAd zCBxM0Ty#*+CHQc83`rAF&>+gX=czHOD=kEv`f)_T@iU9gY#Q45>@fZazg>(dxA({( zb$Rm}l7V0sD&0`!$z)3{2-=Rr9Lq<&OgF(|!X``7ymnV*WZkRi_^wDe3C;iUe8-`k ztbk+@Bxfaq*)@<1?wMRdEwcaO!n2c9{`i%kRxn5wo%{u>Ja11Bk>UsA`%2n{I+?p)CxK4LyUI-i%O!H5F2JB^kn%c_rN=C-_{dv=+)m1D*D1D+a+mKJN5Bz|oeU`TMU-XbdbwK08*l@s3(Blfu-Xnp(5jdA&(uD5T_$49w7l z1B2wG^RKGUZ=aME6{5MchK9pFcLv_FUoPZJBMvLz^Yc_{{0m9!6Dm52`23M!%WOtq zXHPzHs_lwY+s(yE1v41>KvJKSbD?}kUKVP?&JlhFBf*z-%U3Ea>}0wsG{p1-Q`YKv z44>g6p-7Ts@aeKZUgYC$#vtdIMp&N>g@JNdF42E63jxV}_8)R-cN>Hiw{cErqKx=w|o~(D2{-X3%;i3`X$cj+O=z`PA-~~uf z;G?6&-JZwnzlr+@t**45IQ-mFmN(sLsV0r)zdCgWi8^@o8NTJSsXOha>!Y8zFO|7X z3z%=M_rT<6@s-{5XhYT$u+C{H6Nl~8a-lJU?iCwVN%^H@-5$@?XJVXjc*3EePF)mb zUh8bc5~S(HQ}96EpDxu~FH9ahymc|}bm&_&Z#~@z$(xpk!#bH8v3va_t=#czNfe#z z7PLQsbxLHbErs~Q5l?|Y3o6miB1PQcyFG~)ViJq*W&sCu&Y|^oQ(0q7DJnE%a%K|S z%FeUhL4m1Q{9KGgPJkH?YDH;y-rc$DXd?Y5=u6OdJ%@S)1J=4zBR4@>2jf z+GKzk-3K)HqwI6nd9YzlVH3hYrM4`Me<{F!@HSZizV3K;~I2KUZ$!+aU< z2W0Wb&$lOWPKYX`B`C0JW1(EraZDJv{p74(aSN*6Nxqa3xIuP_=SsYeW~)VLWit5& zf=^n0ERs)JWQ2ii*a^sp`Hk**K#0Xs+LAdLKWTwoZG*XUrqB<(=z@@Ve-HB#NsaDBt& zkV^uo03@5^t6wLP?tLTuDnZW4aqC72Ri`XjFQ;Ziu2o_@4!ND7o<_OCT%x$cj{;j= z+3T6Ufo|88fQOcZN`1B=BAq^C2heN=)!!y0${|hy)0=pRE)ul)?tFIHd>b129+Yxn zn9i2J@uSMI5uJTm2_};UxL8U)*|FoSN42$pn}Zch`X#VIYtiXZ` zMmlHV#t>1MmA5rcZ3-Axl_}}zet3Cyam+#R`cbvQ+2YZ>1#TsIF3E+_|);z(j?AO51o2tk=n3YM`z+pnl??>`?vE zq7fz)1~oZDQ$PqY2!oDC3baslmW=;ggra>dnnxx#N%Zk~6QdC>opTR~Qy2wVNw7dw zo%=QZ4x@}DCh`91hka#dL zzc1Qp?(8m_R$=mGKcA`oP`l)`@K-u=r#9iff?8aD^b`f&k*+Ia3}qp?pK2s7i8@W& zp7Q`&gzib8)L`)2&MVxj#Z~j?q8R0J4kyt+{&{~88Ja9}%vv#Z6z|)MC3|gO-h?y` zb02RYv22fXq~4ZYm})(XFzXeB`R3C-5RGe7K~l`-@j9(b5m9oL13XxhfA_eUqq4|H zcu`gb6kM^^yy==MtufRpRMyKuAuQ8qX^7P=((%W9rgrb_;l}J$823?@Mb*8liM6lf zRBo3u^kI%)b;0i`!qL}ZRUcB)t;RP)cyI1B)c-Vs$%Bh>OR)^s?_R2nv$tr^gCX2tC#gmVGCk6FnLngO{vUw(4JW$>DlLQn=+me%chCtkc<4RkvVD z4jDP(i2h!FcCz+o{NLhz(3<&^PKm(Nb43wKM1SyH@QPT4>KrACf%kTm*Us*4I^HL+ z$@m;u%h}Vbsc-vIK3XS1P<&_*Y<9D@vIt73ywC721GC9kCQvRt-9(&Nj-KoA=LWc% zK7C3Zu|hV*!LaN^xt9ic!glXX&#Y)RQ}+LRvj06~OtFg|45y>JD4TRzo(&S&kIY&p z>x;XDbPOfSwOa0k4@#&K&zGdi=~FlGjs&b(mz5#!+IdUU>V`aVo9;XtIi5mZYF~ux zcX33x6$d}gD$HE5o3{PxYF&R!4|$C8-FUbCc%TiZvKgBDL6REhWTxfY-ZyddKx<1k zsSv|v`-whS5lD(q%jp$m$P0hzYu~GIfiF{ES_F6Xy-L{w4)lAfnX7rTAZ~%zk6Uwg zFMAwuV1$&=r|aZw%Fiz72=%y{3!QwA`z^8P!(Tsm%UY>Z~kC$-(hrYl z$yeg;>JSpddNsrE`ZCH$6yr(8W4Xoga;@)saWNJM+o!?H?|&b^@p$7KDe>#ZU&dSC1`(0ZkW+ z>wb;$x!u3NS?sT2iaW2>baB`WX*n)e{d~FkK0$~7$-6Y-|MSTzw``zHf<35>KuYjN z9=RgL`$P87{a5z6o{l-IG=(px;%j#I-+;3-Y?@&;=kG_Cz8eq9qB*Ob!P3(;rfOso z!cGhEFNZJBFW*etMt3|w=GF-a9@im9!M&l-FApIvr(0WA7kFkM{|}T`N{<8QP5_TYS`EOv2{;^}=KxqhaHp~)VgE0 z$gP`J>6-~;N$w{x&4Tf-Uk5lYAnbbQ)YR0rKix#!zlfI#SVXBRJ_I4RK(4lZ#dFi? zH~qq3(kJlI5I{QZ#_15r$6MUCr>{>=H6b`dmG0x`(~ADhItT-f`5)cVU|3_?-`ucz?9l^#12^{-uv&M`EL6)vGm<-{DtlFu5`AC(vv6IefPt z+Ctt+%BZIKtUzy-94(9cz$GLisr7+ZQl9&o3yl~nLGHSI&6?zTgC1MyfL@pyLpn%a%Aat8{!jOeJMTH%qg|l-^EK{w)|CD}1w-Iu4>*}G zb+w*aRm5|FH}tC9Rk@^_27)fl^nd@kvJq=pnVZw-=;-eo*mSru(#&D+I_lA%l_mJ1 z2)-%?wg2x!d4<)vbO(tZeJ)_ov^_bvi!*-MWejP#*k!6*ufA*jHJ-6$2rW@`g+WB% z$YM{MmwPwLIvurAgkxu9c*e*vDmM0C*ks99Hh*E$HVDz~V4!n}(UKqgLjRxZx_jk! zZXg~qlYSMjZB{Gr+bfC*!?3$f%cOF9e(ZC6 zB2S(`%go;|?4~LBE1e%+7dfgUVDtf|&$}Va=E*WQm*}JQ(ib)1Ty~qBs?cc^;iusA z4VU})yr*k2FT02*J<%SX0v5#Y>qM}8{?h1v z5aI%0%O9Vi(-+P6Zs=2D&(fIC5jr(@*uzmil0B`jh*2ki-R#}9aP8K4a>obxGVv0ohy zuSDKDTw4q)R86UjjfG_!?+Fx5P12@WQ0>IX!0?oP*I(W7q@s))5~Ln(Bf^f*5yN{M z0;n592;zuQ0|{ttwdYc++p~UEQ=8}8s)aFGVOz_>r6Zi@L^qWmt+?KW9ROcw>-6>& zDSOJax5y#c^4g{VR&T;D${7`kkb*I(2Z2tkQY64ORXyXmql_AO&2|FutcFh7OqD__ z%;$&lH`0`4=}@Nsn3W=LhKZPmBCjgs$W*G!{7DKnz}=zghZ18x@~grw0{S=KLeUE4 za3Y$dFu9R56p)_^(lig>YfG6o6<}2+$*`$9Kxj*K-YD)8TWi$dQ_E3V|5iZWL9)Ok z4x~L0nt%H}OY~J@xx+9K_x<-*F;HEvRPgCiY2u+SBr%iX7bno}j(fH;v@BW7OpSkE zis)+T>XSqok|%tzWZ9`g6*T3eD2zNDl~tzIx{9z18q=5vnfXcH4|`7e7-q9+ImvgZ2^Zi+d}CzK@Amz2tnz3DJo-uD+8^)}&TYE$24~*=rRN z`{;0McCQH3m-Q!3)##-i2I{?!K%7YLr{}mKY-8Ua3@XcJZvNe z-YoCcic^wYRb`oY%C*kx@XV=(LCgl;WZV#X z*l|i0h#MC^ddcrU&AJp;6N`>$hU)(Cal{&m*DJO)AFe1U{8-t8`@r?M z$4nvShSQH$6tf%NL035U#^A<`EDhkVI2a6HNCD4{O{U9ju>7PK@iDdZg@sQdO z9WTm0@oekgFWyX3oMcs)uCV+tySn=5z&pk3xHoNZl{b@U*Efw-1xNm)4#8kxwFu}W z&X|mreW0ANKEsgni1DgRnrb4F{+_)sNw4XLzbK}^WAdzs$_Wyr$!d){#z^T*BI`R} z=4_%T%5~;qKcF4i2>!5hr=(J(8oy?GTk!3W=QJ^TNqsTmWrc?N!8MqO`>ddm&VfPhw8b;wr7<~JJbAaBPqu4p*O8w#N@3Ph zr%A2R(wgRRi1TK;>2>>taiJ0L2Fa}4S=L?4 z-iMPTnxTRJwxohqv|ORGZvt&pZj4)!528mCUGR#Z_=F9=-WW?Ll($W9(-xb1mRT|3 z$I?f~3C755Gs-g*0LE^q8U@Gbv{=w1lB!9wuJ7rpHz`Hp^i@RITaDCbl$iC|TK(+j zVUDM6ERke^gdT`yxHiJnQ{=a|AH5yCAMgGbS8o|s<<_nZgLDZKqnDRX#|lJ zknZkMx+Wn=cS;FLBMlNF-Cfe%pfr4gXRo#Q^M30%)*mtM826QDI0`SGF;PGInoBsa z9cAq5%0u)f;L8QdfqFG<7YDx-FjpJ_=vGJ<D z*x%zl^$r&^1K3e5#p`kSy@Lc#D^ArF0=>vBe`6t+uLT$!-j1eaw3B1E7J}0jU|rv?bUU9aPCgB~@bX z)EUKG=Z0ZCHF0?BB2L@a8;#kDQnsBagNZ9EO`k>(Z}citz}__!%f zFW-Vc)}&9Y*0qraYr4+nXAc z;F;$4kMDLO{>BwV(!1^r-*(kBU1FKtm$hE|0)JBC3|H5`o5w|?#(DZ@ThG`oNF~a& zG!}rp1kf}cVhb3+c;*ZS>#M(_WyH!1JExV(Z}^_#!mR)}3TUN)MyJsS09E(I%=(in zd~Ura2_cUk8FxkUyKLc+a?>5HC+R;X;aCDFR{)~A0_K|*4=B@Go0&==X~T!pU=6(V ziXTMP4BL_I5}8#CuqpWPI<#`ZN9#NfHVa?_HVu!hJq#$shd>_3OuxIwrh{$_-f4H8 zXrq=~O)dU!iYw#B%)JAz=ZPa5yv4cl<>SJKYi8d#6YZz)IGfXdnO@M0 z%`N6FY7$w;Wl556lNu~K2}*#d*u7D#UrDLnT>JQw{5;`(u3>&Jg^zyc9i7UcSU;&M zy;8G^ddlkwM?!cW-_s6eQl;IMzh4B472~h>aJ%a8>bUl&j=DLJFGB-ZZYZs_^+h<- z-=HTgje+yl?X`|-5L|)D-1+BoTz(n*GjLXPLA&?z_XkOx8|DE^YfYUT*c-?k-tqY%;*y= zkkb`W3!Vdz4#zedBje`jkZ9;WNk(RVh{5>Zi_sPXfPVu<7Wz)k&Ldqm&c^py_ou!z zEWqZX_Qgw4BV;KG#ElomF0f1;GK2kyQ#W57Ns)j^5ge^UTYED9iHB~|5)BS_Be7_50NrB&# zU`XThjCodOt3!U*_Ds#;Qnn%8OWVaO+g3yX{a-8n#XsEX!`5!!^%dbuQ{B>97#-Lr z1C3qAK^#&cdOOm9AMdm4f&JCZ<>@#O@x)v)p#Gc^&<~C(Aa^LG^Z9cjzQz!VL$CyN zk?(Ps!QBq>w6`mj^78UD@!(94A+v}hM8l%FVGqbjCU!Qqf?q)CZ*|h43HZM9dtY%= zVJJua(g6s3pmRyWxtfp1HT=U3N0lF{jNwCKfV+qhW?f~|6#gVZu7k4&g#!u_+I8qc;QqTQ94VhH#Z*& zqQq4O5njcO%w!E*d#n5nslS{mR3bljzdy}F!y)lLyU4T^oV1&*8{^K!A|AL+^1T%W zmWi_NYJ+>?V(FE?q;N~5LahR_XzTuHrGE_qgc65duO+wD?l%u#J-C^-`{_Gn8T_$~ zOUp!NLtI{G7R@L8P7#iK^YvWTY4|Hd2k!DAxYSD3lBf>O%P(HbhDZ?6eq+iB7Yx>s zJCAVE5IKHufPLixqm7`Ra}WUwVf%^ViG*jG7C&=8K3(}u4Vkh3{dkkvH|MvC!~V|C zk2Gd#y5wL_9?O*JH8eTzCa(U9q7d;as%vV$vzB^sJqb-76A1uv*aTG$6v=S% zmBHnMeB|912VkuNMEKhH=En`7ak{Sow{N{aO z?OR<0ru$c{X%z?B_w}KIk-w`C6bWNS7ZoOcM{04n%=}$EophzB^%$$qO=IKnT;0BN zcK@5v?0qvE#~2RvHnY1e+P!#sT}oM}^6u54qidl+)2Z&kFiNA~NBsr6>6>rFy+ael z8gz-&Lp&!)JG+j%8&usrrzI_8lYdhyTze;2%+MTjRPkq zCX>U(<_C}Fr(m_Y?xdK`7bDgL(hTx%fESUJyu!3P%8K zKKl7hr03y<_yNgY~?S{(KcbYV~?9LV*`cZjb;ZO(w&9RNNVLERfS4kat_d8@0gWodCr8fC$!-dOm7G^8_#FIVoI=_4TheFDp7#?j6VwQF zP>PoTCA^&>sjiRY=V0W<{G0k+z~i#+ z&KT2i7colPGFF7e0GDa$aXV^vu)`xwjN$C_mo_Uo1*gAvL6tg91gCv^#ml_4#9iIBENB?K{+n$$=)kC89>DlOgIk?{t zTWCy-s$kEAgn+y;K?ErWyx<)?R+av^g5<}IK7e%?ZXn-2d5}>~HS?LazPlXqHT#9q zaqzqK9&G4MONW1uj9`cxun-LP8xzu+>gh#IrBNA3RA5DRHpxUC+@8K4NPMnsEhVH{ z@X_Z_>td60qsPdKXX{n1uipXKQe58Oh~CRS|CKHo;d}1x`)dLw+Plv~e{t!*Kvo*4 z6WAEWDjeZo)5b}Mo&)=x_nd0~n zpJ{xW`c_B4Y?#(-WQL;};1hsC-?Qr%-gpRR?1qL_e~k2D80X9{Icuq~2ClCQfqrDdmC~Mf`)Ik4pW^+{mDYRoO^=&+Ms4)~dgY4Ww#> zx`XP41vZT?W3PWlYHJx3n}(LUXVzvQ97pLST&RD1V_d6C@qPPw>|l`g_w}x#;L!6; zDQ(5y@d?#w#J|Q{8e^geYUjVJwMxk}4DoZ^TWl}CX|$U85)LFja+XsS){~2WlqK%h z&wGyNsyvIT&MIF9HdfO1Es49To`@5sZC`)|MU$SnFV2MBY|A;?SBj>sCBGTL2E~Pn z6OU4^WD~Eqc)H9U!TCKBCg1C!;1PA@?7k9O#@qYJvImS~b=E)-62|~3w}Xy=<#qn~ z`QFG|PbQOB_q(lk&mwSJ44)~}R0BpF$>T%`Y&@#$Z+Bm?8)!IZ>O9Ai^lJ`8J*Hdl z4-!@jhhEg)`Q2I&O=SdM{}R2c@NWG6O{ZqM!I3ggM^pW7$G4f&@?>0Y%#7`AMMGT^ zre|TFj}c;U5FW_wPXl@zoW5K#QYR3uQ!lm_x|XnGg=5Znk5xFI+XaT=?#|aJ3@tVT z6R~a*(#J_$n}Z8~^=td;GjL)w6B2yKa#r)Ph?ms{3W`j9mElG9jAT}sbQ_^_TeVDYO$t!y)H49=zET zGoTaxLu-cF{5 z+#x+e2CV)RQ=oxb07Jhb&St|b(l@;gUi&wqH(C1jTD4=_Y}A52-K}?heYN&PgZdoT z=Vdn`o(I2umv+nU<%Z}_vy(81QMT0SFY5i(2k=c1%S8>z0sfD=T-m_>2*|is{m`P%~>hTgGl3Sd^Kkc9n!v>{iyf-3K2rwvmG z14!`Z_w^_ClKRiL0iX%LVT|~kSck!71(V4a2ugz%S0w-^Ozq?vj86_BDYfzHWW4gm zBL+(1%X=saJ3=CES)sVp3w4RjUv9^uK*_Q7?2GBY;7<`Ld!$9yE>`$~$x(Y%BF zs{=~L3)jyAU9NLZHKps_>%aQmAeS!`+F0;7fB=z@FXGy$R725X^yjV2JNblAHAC5t zZ|fUZlll2r*iORt3ukeXRbt+}E3~JoUh}XMBh<3`JGiG(GL+7wsyScGl>c|}qf2Vj zeypl(%hnc$*LwXZOg%s;PD%tQn5j4Vk3C*+Sv{(px9YeohAMp2bF!F?(kU651i_Vl zF8^vkRE#E`T5az@ndqkz_WI*#o3{DNv0zIr>94f9j9At{GaYniRSP=LQBx|u9=Gd0 zT0#6Eu$zV+s#-b@DxUtoWLe!rDR}UjV0v1_zId#GH`1Bpeo}Hpima+=Ln9e?E*}?T zLQ$ooDG8K|2+RlX{{j~%yw+yti_P-Sp2f1bo}4k? zzCc1+)>2oIgK?X8_3xa7W0?=OoKUxlemKJ0CBUD6s2Cd3+Q<`x4B^qxqKA-23TFKX z3%&)dA7u6gVLyIg1MtNJV*}8&k)Vuq4`64jt2xTt+?}_YH=JSPq2B^O(>yxw4lb2` zmcd{qCd%2FWPWFcT7h$PRhi_V0T+4fF5X89G_61edo;*r*`Bh$d|!+tvmgR+ae?*h zdt@6eCjeBYd<1r?xN^FLo_5?(4{F&V%cC3)HgyimkGjSn-z#`%ZH&vyX=dv>kD!`y za4flkb>K>Z9j>hbDb#h349a}7~4yfz0isfPS^jiUojA2LPx@@MOGDzKS} z?0m*j@~p(FZp?MfZ;VT*bT*Zxb=hfBjqM%ZAv<-;RE0Mh#bYIW>L}s>>8@HvT06 z&^|@g=COMPF`x^SzyyLwoebcyj;t&RbT zHoijW=(3eV(eapCL=lxz>Qi$Tm1d;M+9Vw0dnIGiZ*8z}V z2XM^`MzNex;If7kw!Bwg+SR)H^deM$4A0v!rm0KsxS>e2SupL1IRCXcRi3k1Xkt%1 z!l9lytWwt5*wnCDti1bHd;epPpQ03~qf4Tl1>cqS?*)Oc`mxN^qH zK9@Dox{0qs-^Ve%s=_9sJttFtUJvl-l{rRLot41%84*iPR5v8az_(r7^j(FQ=2tBs z^KW0C2|9|>R=&}pFHX)Cza=Au9vhAqsn~?R{&^dv-P}BWau$r$&Na+qTTflz%7Mym ze$RCBo-Q|FRUzTL0Fx-K#xtx={q-9G$Jysls08&vXw5TCN@0(slYA^7=YMo@6Bi`095g(PsYP^jRnYFFIO9G81|a7;G+GFm)ms z2|!}JKZ|^Hw-T1(aA%?V!pd5CBNDxg+of)oe{Q6=FmYmFI)0b`T272Gt+-!J{VtEa zbmv3y?CW|SmZ?HFQ$qe+ma=~Jx7$uBZL=O<84?7Nblz;MkL0nGsH3q>nW>jFvi)S6 z_%a@o=Bn8XohrfS!D!55DCoVhx(^moRy0lWI(*VNGpdpDMd30ty`l5ZBgTvkFZJ(| zDEPgQH&eyx8m6O!-%mB=1K(G%I8GBv_wNrh*~d$DtT|gw4_3Mzr*+B-XqmpMqNs-h zlO8ZmS&skHE0u#mTwPfiOE}bSnn2etB@?K(Ytg||#k$d6u~9Vf>QkuQGWh}Z_=?y_ zPt3ufex2IB1JM(po1GX+_ac$*-Dga>4=)Lnfs| zK1hUqs~4;2%d*_O>Z0sVX?Pq=c3j^`MaGN`Gdj%Y)zUdNBO&T*q@2ND9W>CNVuyPg zpr1XbwrUa=gls*3h$q>L9Z;Slv^cr53%{yWuvhP42#d`hnbCY zWaO)HB7CYj&kLlo**CTviX_&ch}tE@f8-Po$n3CUAXGI!5DmsjD<-K zrZ#rRJUsFvdJ_i*?mP@yv;&B6^=J!3CcNCu+hTb3$fKJkdajK!=e70N0o+Ld`Z@TE z6u%WuA5BPAK1Ep(HS1U~`Y`5JWF}E3-#7VIJCa{Tt>LsoDsjxt=*F?)fr(S=)$Jr! zFL1fKIXVC@Nq88_DKG?)bKxZP>W(CqLyhoE=cE`I5ulPxU^CbCQzhHcW9r0Kb6k63 z5n5&*rY(G_S9UA0W=&jcyvK9wc!h*+ zxrpn@IcO5>V5p@v2ROkDiv~CdO7#g^^z-`9wJD^4SWKAMnQ(;AIq}P{A`@(n3{$rV z`<#qiD{`xq4Q$6?zS)uVC7Ka2%e><+;}_@3Lt^qYUal?XB}TG!;`heDFoI3aZVAC! z7zV@jy#9Vmsd7|$vhg%jsYLCcwHo z`2&u3?~S#|IFBFE^>KI6^~e&Hv3HePIcW`cki=y4!TNCyBjT2-FoxLqD4zCLTFwD7 znz6l#7?mjmQdgW$U+nxM8&JE|M0p>6pn5yq%}oH#5XVsv9$U2nD(Y1Hz#yF}D?kk4 z{FqdrbN0ctQ8}WIUwwlB=Ggsett3Y%H|H`i-23;i+VdfGe?b_GMR)VO9^?Jq)JqwB ze}nNmnjd0;Q-`Os%8)b>{cg-)E?nxls@TEo6zmw%ISnxcnNNk*7=5Fsr+8aSVP7OQsuQq1*>e&2LrmB3fIMm; zPCY}sgB@ZzFh49b&DQj=h43K4SMIRwL-?Bk1D`vzGGP z)-QeWS5S>sRPjnn>){cTu14gX_|FRf7mr$CWisf?#A%iv!+bU9iDzL_04{psk$*Pi z(csVP?P$9Cj6VeI6kOn!#D)=4Z^x;K1BlfHNmnpbeg( z4|ldf6SWVa^aflsC}3R>3K}`e;YNn$z|p5(zPVVt$~_M9hT3aVZ3HkF&b>s*5Ve^g z*~z7(h)yuO0siBd*DU{oNCSTtGP_8o84TvY1OaHIe}2^h_6h#rv++OhrkfA6|Mjzr z%Una)*{5221=!hw?0wK)Su06NC>!zCOi@;mS01DCzkkjn(}M=;b@7`n7QXeq?QT)A z73a`r%ez%oDOIVd~(%Az%ok6Y*+M!BL6Fw!*L^8;#BNH>^P^d z>)gWV|2zos)gNP#aGybYjZg3`!6PIn)F>K={(FO6A8^N>sW3*P{S`*Q2#n~@244P- zq~MR;eriGneBZvltr7uyKA_+PycH6%Q7Y2Y)0aC!vw+GSV4MN*qC%6QOkps9x(B1w zhi&KS#w&RS}$Z!w;kYhTY!)P7LbR4KLG~Q8fAK~ zJSJOx@4@U>^*tbA4Q2?&i5r4tP8whlftnDM`$j_INmRlA9HML$F=%cfLKwV-T$v04 zv3#!ceXozbbsjjX{92{udkgqmIV1fkT!laqY)?EsHY-cH$>n5C?h&C8tpr&rfLaA) zfm!%yU*loR`_-MPtp>6$;NJ(f5NE)h>WdmC zX|`w_?(*fpbFUHxltG8C8MH$$jHXR}Q_g7OeyC5xa)pvV93pYG` zEk*2q-a{rZmXzpUX&q=jc-YiHAdB?G z)YR1b>WmcddPaau2_Yd^TeSj4G!RP@y;wr3hG2%9uEX%n?Y;ct?>otf1MMt z4!G=M%WbEJ9t85<5sK)=jg7=*_q!znJjSWL!I`b3_;@^)av66%3K&g&eZ8lrCpgd~ za@c-ap#3vaGaVP^0(S@d8j$e}IH~~+mlwD=u1yty3kTT3V25@MmN(sCRdxvotH`q4 zVLy!kO$<0d62?Z7-GU~h)$0#Sq2dTQE|cJYK)-1xk!O-|Y70OCdyQ8NaooBSu}`&`7BQgDnvOr+QuUq0DALoN1c?l;&Z%khj8)E6AxTTEJ6+psPrR z_TM=41cZ>-R+%%&qb4Zy%4k>l=!ZxqosP2v95{LI0h9Ux&^w>F9j~C1syjpa2ayo;(2yKx6C9yT-iK(K%ZnE`=t9w|t zH4JfmR@)2KlA9}W4*mCvpIcl|#t8A8|L4`j_|bi=tgHk>&*qzxzD`k_fv~8%n@v&Q ztL?&vqX)JT4#3Og`!-Piy4eI8LO@?_eRH$wXCbS2j7DyaupoFzLD;dK64P=^;^X4Z zA##MY;Zeb7#Ny-lSqReN1YJtqYGvsT=r69MsIrOFgM)(=iGgMeRy)bcQwdn{u$VL1 z4wiiMnG|t19uI9n$?HC58LJptU)~@8_d|h0MgVVlK&474sa<2@?Pbx0dFF7o4N0=4rc*#SaJ!5Ep{5&U>?Hw z5e`>}zeLym)aJB8B#p_JAKtcO{}Elv1sjPkKb=H*6VdAvqa?;GA2b@@h`yaAa>O4e z@pZ0F3}OQoHjoxN+7Q&?@K_MNTK~>k11F_C zIk2G<1)4nL8|&-&f}SDZjQnrPyRh#7fq3mpz4;S}rEMoa6XViIt7Zyt7<*RM|x*w;27t>eX|TK*LxFyZ&zO48i1I z`{#K-YV#$hhk9XpOhO~(-2veN$RWa0KlQkr_S5`tZLkz9^>0`LcO@XaEh^C) z!&jJ>7lfai4K&r(!3JBYkPAPobJZ~*7jSez+*#JY|D*rgb29?~k=V7Xi-5Jj| z0m%4aE3X3Sq18xIE_g&WPNz^c6uv@&865v6UNJ-94gsqc-1cHu?f8~A}5yfrm6h^W*Cn9yMIEafMD*MTdl+u*|7 zhR+++0n#q+gYsZt@qat9(~Xlz##w`S%i^MMl>>Mdm{yLjvk8tPmR@- z>>&Vw?8}|}-3Momf0X94eo1y#hNS2*b_PDBiXg}^4^I$avpOX}rU0*A8;o@t+z;=- zS*He;$YdY!u^^nTJL7V#O=%2p!@|iM#s4eYmV$qdf%|~wg1=lCbMVZ%?$7($FlV@D zfl>yDMOk;?^Z-Cm+#T0vaFxD5mGACU^xhfBz5w1PLqWUjLbw)uNxp^d-|M|eKjx-` zdRiT{@6xp|B6%oKvMfvn$6j=}cN1&^;M+Ah{sc1c#^JEob*hIupPZid z%$Jc0Ib7w*x@+aXpGq`gp(0O~(TV!6lfn(!n4aHsSF|9KFj4AG54UxlKT^jC!G6KzRJlaS--Y>W-Z`2Tw@x&PL}t8#Qu!Q#45#Sw3P z3V_VMi4VC;l6(5$&Nf+z+qkqH)yZvsSd&YV+6{!9-yTWl?YREC))5WJpYuIy&no+G5(+V-KMa!)eiDPZB(YAOW%a6PdsR zbXJ$CKLcR`eo+y8`4pt7bYD@(BzEoLiZvbLg$?fSGD*9PC8414_)odth80nGNf`r! zMc-3`fcBgS3;7W!jIBUO25_DSn40mg$L-NzCtGbZ;{>i9hz^LMG z2r0@UmnO^Y!JTR@uze8MfZ_}npo5xl)>};!i+EotW(s)%5CNDI4)*qfsu%ecaHgJX z_4VZh#nsitYP1Rn60=}Sk&B1~Di|GrL-^6;dCHLuA}7Eh3i;mMm}hxwymulxkX-~*f;lRWw(LKxkV`F~ zzCRSros2FrH(Z`4YXA$7n3SZPApl?+r2xg$-Pc6GSwS6j043;yP3*$AmhuFa|!HDTko!{Q=h+Us0J%Gtzeu7 zs7kpZQU%^6c;Wb1+hxV*DIBrGY+OyK|JR!ywf`rGJd_-^XV#S<`lomqrXt;Pr;crp zs}QJnt14jh@&m6wnm`lvt1@gy`8;tkiD&&{_`%%bem?^B(0{mu-L2!3erv6+=B9W& zhF6nlszMIXY1RYi*_gNS1{h?oOIsg9k#l9NT%QE_aBAP>WUIzI{6F8TAq-SaK1QHa zJ97^FuaAug%%o1v;XddOy~KZ?r;#JUhtL@Y(z5&i`wjh5f+fPYa{l`+S1f&G&Z<7b zr`M6bUwiH9QzN18sHmuj*U8cV4iY@rg@Mcae+!G#huX#GyYc|y-*XrYXkhQ%g~7pr z0Imi6gb0+77{l=7XSXOZca{HJ?|8I4gi^ncB03+UKndX8I<`$OsoSZ7pv#sdvctIU z0(*iPe75&*QbZnt;6sEd%UjWG&isAgN}?nT2>rOrxtVxo1wM&qWYvhZt|C=+w(V)=F_b^eEd1^@gf?XK=-!d;i=6}MV?&r`CGXEAbctQ-B zN-)^_(FeU{cC!CF+rUNhf2u+~ysdL0Jjg!y{6%>RW4`#9p$AL2$V~N^j8;C!9)54+(W~)(3muA0bmgnSj|icz=dv@_;?z0_CS_};-mBn zRFlX?+!V2Wb6g3TjGq3!=9HfFfB)Ldr&MtG+9BljiP&@4Ym?LhL7cynSB%1YOVk6-EZ268y!xI^3U;6ro?Hbi!IzB6NU$% z+x=O!vZ-@Lesp$sJ(E*h9Igiv&r1LrHp&4c%KZ4T?L0gMj<655wycQcu>sfO96f6s zQpghhCRa`~aSZ>oL>`m>TiOt#T}6;_+I;=Jx@1eKnr zX6=!{sTic5V2-d8P!xjtQC;~03|c@BUJp9s+zdn{RNx1hanl}*RaIFD|KRf41;k{4 z{yG4vBcPI2{gja*Y&Fg_i~o0RZH*fU5`)^`WzB)FoPaK-XJ|;quN~}J9p#-f+Csp* z#~2B50<=a+1^)QO<>@F#l&k*~a2{+Rz8v*GM4*Q{BY+f|2>N(@GfZ%@SK3&CqLk0d1qRYJE{&?DYM;te)!Wwnm&UU$Cn0kL zI5J>y`ct!P!RNBJ>}+p=4v!NHGhF+_gxP&d2h8Xgmi*&eUfmuQFGj- z9;EsHrz*=tKN?4Z#58&99K|1l@k#VARb5^1QZ==;cO3Y-EJ(O0P%(?M*msO@lkR&y`<{(i>nm*e_n?)kI%_rC|4lKIV*hN@$% zYdY;}q{r}0<-&7oX~ggs1CM~Ai3*d44vH!V${`jN%ApEMeC=G}jHR0$`6jU-=2N&I zQ#Q4j4X?9sn}JDZ_&Su+`8KAJb4-J6l!B7q!en{nQ4FDAtu5Mq6KL=k-v4D7&Ir{ zL00dT!rcrlF{USCEHRE|6~32l0zJD-u;*L``0^JbMH8Ez`mT*Ue`(d2`f+BOJV2FVqYx~4#%qJT18m1Up3%C zu1Q&G(!08(IZ*k4pKl+i3sI!v6B6>rERWvsQDg#%Yd{VF^(H)cr};xa3c4Zvq)}Du z-<7Sm5Qt5^E?a`U|L>(=uL_*uUrKk2YnhAmdp$FW!#Z^ZQ(UUP9|Y+@E3!A1bK7*~leOC&C9=6nQDd?fXP+q5eK#l`A+a18%fzd9fsUY(&xU`Xi*RAl7wwNe zCAHP*Dcrb3V^)5vfZ>@Ae3`O77R9#e0e`5VuP?MF_1`^FzLO}#%jm@SWN!(AQ(aAH za71oH$%Z=paw zYU|OTHu|Jk20CQb?~oOHS4j4M7Ic}ZRe#%{iTk1!s+5i& zXV`{7cU#V6-6~)6@IJsxVP3IYzqcAJBv#NThBo-#i}1Ym_X3en^kx|sj3Vm6&~@Ru0Uo(aJn8E{m&|q5ad-(qM?#Sm~K=}ZyQC{#6MeuNQBcz

(K~5 zgFf2v^YnvqOifLVp`s)D;{^=hWi!R~{O}W-QDSsuwIWN+*) zg$|iF(xpG6vB#*Vaox5A_;nY+EeG{f@hAVTZ7~u1g z>k<8=5^Z`XG4K$oGx4kZ>EjhPT~(~Y!?PC2Bd?k8K86H$H|R-lxv<)We1V>N8uwCp5VntoS2c{V1tyLPF0eRRy?9Scp zM8?R46B)^dqojTxp{)58{(XMt2fD{Z@?TqVw%v^9C!=4XaraWx#LFK(tU0s% zxo&P%>l-al`(n+`a&dVAzrGx8k-qfkEfK!KmFrb8>?fa$s-tq+P#`bMbKCeH>sxnT z9lX6%Dm1HdkI(36nWkzMOP-Q%&PvDXiCy!?w(o!9T%5ALcpmc5K50xe{DT*?*#b5` zJza!{!b1`w`6t~3%nqL!J%lCa*Akh#{l$9}PU%;`i!X`?a|2GuMImSxtWEaOf<6OcC$Ch7 zMLzKDI5}qgoj=8MahvCfU#%l8GRvKyDTK=oLSz%robp|-%p|9iF0Jpx;i)(S5HZbh zc{J{q8{q{-fkE&CNP`;wv(XBR@`{`;S49n$I3*7RRjz`c5;-)V_y%Z~5>KIDpYBDX z>yQpWT)!=$GQ+rtkRJV5 z*qka>@+>H(XFR0i1v}xZ{Lgj)wlw!|Y4OKgE-gmn%(PJY`jYL6pOO`7!3o+GBQ)qp zD^>S`db`ZlUXy*+7K+2_+AqH$_zHU-6WO3=%MtmW$Ny8NBEgGSTuni%PN$C5MT8h{ zW8mcWlLN&>xlCX4hF7*N6dBXM6To5C{sB8@#~>PkkW?rtGeiK1>AnQ9=-0Ls9n?U~ z+gtdNKVr8G-Tu2qx8}1^1(_%cL=qv7BLt-G(bTlG<>zc{s5G}rXrdR(z*|1!@Pj#+ z<J4mKzUaI51_t-~=~@&K-0jfJ2My?mvoCQxH=-GF4CI=15Eyd&|Egu{DxjVE7c==ZZ`{2gAy zKb?evGOW7qFM0!$@g@vQSS(275Ou?}dm6G^Tn~>iPBoNts}1E1dp^D0CAJj^>caEn z+|`<@w%9JVu6=gq5xc9*@n~G3GZHyDm@4-2^|;d;C^{9_7(`~va>OWHa?_sJPWXv@ z#7^>$_0iMw!qQoO)1Rfb<}9gID;kR9=AD1BTnRJ}NNWsE8=B42Y(|PAOw;6L6m^>H zejU@0@}@K}wo5$OYo52Bm!PBdRVE25q`#1Zn>G&OyleU_1wUmqa#>z9Jbigi#^pW} zlHvMI+gZV)@2_x#rj1Uu;n3)4rM7ai9E4YjiLRL9h4X5rH}Sy?vwxtD((m*N%k%UE z!3g=GAPPu1>~mtcSAg5+#I}gWS6xfTfIgNg;&7ARzT%DaYoPIp2AjfPW+m67xIrYo z8-rYMfS%;w^-S=@ZmoZY#T43EfnVE+f3SoGZ#@1fFI8%zn{ON)*-GwAtXPyQcU3NJ zx{%MZ+i@w~#6UwDA+NKfbmuEX+1xM}?u6zsJgwIE_v5A|Xi6zHj=m{~4k&1tj*L63 zvyK*{#oszMON*lGwV}1PhcUFP1VZk-{RlZIOHR${!9*{t$BuE)2Iyf4 zjzAw%#yYk{na8Ht(p|^H;3gz)?F^C5^JX+~pYf2Yl*9a>PQYSfTTtRF%hWXyMSW6i zSKOKAcfOB?Xw{O5xT!l87N_A{gf%ZbJxZAuj1NL;W%@HTop=+8N)*_lSOwmsnCn!o z_Xn-N*FN2?{NR4sAo;SFrDihHLKZHj;YWLHeG|Kq&^Tm(s-Wt$GgvH4thryWwh7;< zE8>(wR`{#C!|QeYW7~Qg8F_Lx_e_G)bSy@Pr~K*9yg!WQgjvt*AtksAto6fMIT6~L z@tT5ZkM+r0%RRQL2`6H7y9ro1WB{*n(w^Vx^O^1|O1=RCcVnkHKLo7vh4lJ$ih@$% znPKa{g9<8+g0y_d7*i=rLtj5wB;t3Nm1%$fjO~Lx=hkBN)8BfIowt9{$8Bpg19ojB zrbaS)j27b2+y~!fW&WVXqZj?IDSyu{nb-7penUe3=1b~&Z9P(COuag4t*XPbR7qks zZcqFu-iYYXvS$2G-&tAfIgJJj$b?^g2yjc+i4_R^Pj&p^WP9j;zaNMNn!g_u?{PMI z&!0bk&Jb{aNVVSmDMQ1hiqx~=bK9GCZ#kv3!h`e=c(#{Ei{5!`4d(#pk6#5?9wg~` zeaX)DlkBVX(|X83xBRd(rY~qPzjPQ>MNdz}aivr1IV$`@>15MneF zB5dvObNjLh)O6P_0LGsjC73Hk@GXi&z_>3jL8e=#4Iv4-q9-x09R7B$H-v4`hlho2 zH10_)Ma6CEZJOSx{jAZ>U!4w(jQXN5tW*#4@vaGT+6LrwL-w3u^;nHC#2@LtSM8DvUW;2xeE`6^y4czA8p!R@D+yl@vIS z@2pB;aHNv$#Ggr4(-QrR}S{Wj;@-){U@ zGkF7nNmQgQm0!m?SGMQuzBXIjxm|216UG10aX!B7nL{mmj#R!d1jm(OW1ML<4D-P{ zXA_)IG!MpGNYvlb^f-}z-T!>P;lnS>Ac79ZwBGm6MVvI@xpOH|T<*%VPU{2ySR3}j z?;r_7k`m1R?%*tLw|qEU)=-JVLo4eN&1gDq!4pn8U~YJVTK$37>d%JG6%OqIeP>jk zSJK-#b^y!!RF?!Hv>fpr5lNSVSgR!w#!c>}HLmj&+e;xk+e`nX)Z8m0YTeg&z)VtI ziR+pBzM!~Yg8$C^(72h6Y-P++&~3gaao6aSaPwnMiPFo63hN;s5yw7Tg)WnU?St!wbyg%K0k?0a$2-*Mabed&s?n~g=eNBDH5{ML0z+ZwMriwMcgPOJJe zMfF%R5zbc+35sT8f1zl#b%Dsa>Pz_mZ@%WdyN(x)p{$KZJ>4IF9rF9t5-A7aOWc|! z{WBZzMiGvJ-_+V)pQVQ>-UdUVe&S$kKaF~cKtivnre-r;zHEQDVP61bng!nILr1xB zLe~3|?mI+pkUk#)Q4n&zwkR0)#HiBy`<>hB)0u1Q1+P z$$CtFf}B^Yy^~OzJDF);R7hC(HTX@rdy^3XBi1#+0XM7BbEmiY{P}TL_eV6ONBzz- z5c|hE^_xm7il4Xmy~mEx7H1fa+q%^m#W@l1X&DkGakL!&erIh^)^*+bE*+qR=;$p{ zfKWJG;$>%@dp_=Ja=A&)X{dzq^=Gy_VvdZDzCG{4{Bml8EA&Es<#hiMrZ|`3!0K)4@`{w;1>I6c!FM-?Pu&pW1k-xoJ&@%+q;U-Wx6yUG>MYu(xDC+LM0>x=kS}RuA9w zyBf;A^E6g06)?+B397Ian*Q=;E404Rw6|$Y@%_5Zczd_Q-;~WLw^swwDXX9Pefmer zk5mk>BBx{se{>SO%qER}g_ZM4vha`X_L=$L7v`=^*AQ@kgo|F_J$ZGyRC56vNFv=> z^QoV$k#1*4j))8VsTpPeRL|+Kj!8v&5H;zy?I*}~^Q&J5n1QKZ0Cey66zBT#7R*Tnp`oFlKYvzZL}IL{u8x%{gd>d~Cw5%*h^rj{ zJw4P}eMV>-Vch_u8@8yYf=*pP%DQxu9cB|8M#G;>#5NB^r;w^tuDiVsOiE5`yjO~I z9PG5LJmT_s*~~=xk=xX5H@lrXMh18$n z{SIt}-~OPiXCPudy>O40`f2T@ijWr%?dNAdj>OEBPj!#N2#-6+Qi z(3>(%n?<2!+&1deGgwp!I_xVr3ozKD4qT>q4Y4lGSbD$c{l#)BEnVlFOq~#=G_#@$G}p=l2^ zx!JqQxiNY|4sPn*2c!#>UBsgieTmyXG8}_{IOwNHME$NujxrJ+%=O+t>rZV@(pvS8 z##u>DkrPRO8Qzpl?Knm?#iTWE+7>&06y)*!`3pU&=_fam{>7OMl>32DgEa1II zT=vC#B8-)}Xn8(bO+#==Cis5r{sLZVt>ar;jq#g-@umThAXk@x9G+)MsV8KdK0co! zLRMARg|8$sJ1kDWgbZpv&vm!l58R5HXeQ@+_dTRHDpEK$P1JTWQtHExG{JnY<<*pz z=e~RYa0~!@laCXpIrroHKI>dU7!z)Kjg4CV+-$Am9;l*;mumT~_tG znFYjTVE8`JvJ0iX=**pP%+g|R1bpb@cTn6pJ0Xgt4y-KZgTFrCat>9)1~ATmjGNu zLl+%w)hO-CtNYfhK=7L5ZnNQ-t4>leyhNg-oXKKfEp^YqkP6?4jBR&bTGDeylY{sz z-xqq*979s8*j9RyBdLi{(swbT+x9amW~N+2PP0GVnaQFS7g1?4Qby23bL8?@&I4Z{ zQh0VWG;r?G#zPwMIA`*ZTuUps$^?N}-94C{hML*tAmPM8dW(spGEbj6 zhyCKK#iEV|a|UH$yQM@PGYh@TBG_A*3Z_)FRY4xMZ#1Q^O9-dJjYXWhnF#9YuHTmz zXJuK%q#-eXz%$U0qOO#Tv*adOuedHmC%w|)3a$($af59I;*=$ z8@z3XHCvbEuJnZ1qM^9ByjYOd2}%?_6piG(twN9AxU)*H#8DvVDY8uVMMIa`sMKWm zw`z@<0Fi1@= zVx<@vrCA5tv01FJ;b2qyxlqAH(@{bd&Y$*DSYCXo6QLcv!c|`t<})ZndtueO%{uQn zl44dZSV^LT^#yZRCdvK-^?Tp&TzW%rE|~6Dn|=NPjkOF7m1E_98EI-3-e;h}f^Xei zUBJ>_{2u4SIi@-b$RJR=-LLxneP>(*gkVQN;Bw$XayAQY5}-3RJp?j&IF)He4@*TK zAD`DFPl_z1VML*XXU4Rt+m+tZPWR89;6w)f$ry7zh3P%$EQ{H@Ef5hC4Hut;6=sxh zO-C|hkRaLzc6^J1VI`g~q=ptL=A_%$ml0S`%@jKF>(OSqAEod z*fGi?x8fteW^b=CX*eV)qakY!;_8<-U&mieZ7E;PNr~i@omJ6@L$V`1sjB`c4OM2W zW2?uE1@zIm2ZaMj=B{W~w-_#^wLQTId z^+JS=tiZ@@23_`kJv@ITjxWMC)uhCy-(TzgH9j<`N%3wgFT!|Kc zmn5{I!8{{?U{iPVMlV6WRc|gDwh;|8ZL_D>6y!*M8UpVlIonF$xhXeZx1MHU)`OWU zReC}TRcFf{X+)6>7Rruqsy)Hg7Fk(|yt5vPKtZh36xuZ9aUI>0WEKxGg9XYn99mUD zcLfC~zlgZ#G2tOkt1+AGPt$J^#30r1&ynCU`6q`r@SEepmTIobilrOW-maK8B3!D$ z*w+nSon+|E@JsXWF3I%OOK7*@MCfyE8GTdBMmi}W?~g8;vB$@^v2F;FJF>vXCy$Uu z%%@`4G;Q1SL|@1b4cbk28N5^Qw6Y3SLHyW14T%~)S2viN#;imwhB7F1-#`*RC?NF* zz=V*$U`Z?YyYzC|s*5!8UB6`EcuJ=9b`wqiIsSqYX*8j^#oN39WZrF)b+l4$c@9J! z*OpV-`anA}%uw`}HT2grC_kk8nf`KU$Z-6{@h)s_~v zM%=lr1#;|ZT_Wu2^p~Qd%u~@8I~j3k zjgsy!NqE>RFK>@c87oOSxGaNiS1XW~f3v@D&y8|5geT7{FI<;74R_(M|*bt+)37|@B>)}5mM{SXQa4i`O$qcg41O!pd+z1hvIrv!k}D2GdW(*)o=%oang8_sUg)X z>0EpZ@S!CIiD>q;Gx%0^a_*^c(rG_+U^G7OvGmQWlbcvOs%TfD=Cvgd(8qoayQ?#I z?^dMm^Bo6!3(<6YXT-LTcq_1aScivRGK#_tL^eB1U^S+K5rafzkrkK%3F?Z zZ=2V)dZ-o1Ns$vAi9Q)QT~c5y7~(#Fv1hv2!ev!=g^)aL9GFOB#+J(Gve9KN>R{fZ zdypsRIWgvy5l+F=`MN}cHW-}+xjy|4S0)iOBC@AW$HcHAqn}T%x^I!%=SuWURo6_( zEEsH~E85)Gl~q-Q!Sbti&BX28_lLT}1P;p;Gf$^9x@cbn=5j2a6k{PYo)9;NP%QYZ ziC47fCF-5P|9eqjoZ}>@a%6R}!-9p1aeAc4$M7m%2%mI+D%^ua=L=Y~XxIhcK6^Y% z0}#xfd;@mWITLN>l!9sgTl2c4@~i=LmAPa&34vILL>v|zCvu$mnG9l=8BZu(v^%@S zs7O}Pnxkfh%J~7kX1c9*OEs$A+#8u1KB_vwp}N_TWa@wyb&bTdJ$yl11&Sr-*RnE> zEVwa^JHa3Dn8vvDXaa~NJ}Z7UocS%zbUkMzhCfPpl~-If9KF`ym{hh=x2==McU>=( zIf=>V9t0ebiL&+A@8#T?%nluEU>ai5`Ps4p=WVnJ@~d>JVqYc~2VenouE;d6Id`}; zL`sNz9l|9U_|X!STlj^Mi>rDGz{2y?$ugwrd?j{e@jNL>s)39)oJDi2EN{kZ#YS`8 zobRSQ1^$iUqh{RsYEVnBlumAnDE(SXLWnp5SI*)>vRwpT`pqovyA~i@Jnm`2C49I3v0l`Kf#=yv>{xP+Hz{AXJj%V^GqY#0eEL+C z!cf!$w!S>fM*m2j5e! z$wyWG(7DRb%N()do_)C+cU|4Fzat-z5A{)n?@_zc$F4(r#EZ_Pebvco;p^FYL{i7y%W-81E5-ExiR1v7JGa#g;SY1 zFyl|EsBGzU9V@x|_$oP9I0CD!eEId(WM})^=k`n5b)8MM)VNWpMy+JCjaI8Pd>yq) zL)zlpTCaCF68$tRJ79T@2~CiLQQ_tfY=$~*g|HosvQ(~dqmXU-*9>&$3F0yRli_&S z>IOVeKXr@YZ{52I5}6aK>i9c6O2TF<2~8o+dgcjmtky#C%aiX&uP-`&8SU@VT)Q+z zUuZ7a9K6hDFfwqH^YZY{-TAHnN54Arp+ndXIjFboysA8d=G2n+_HV*}a5KMz7F}<2 zoa=YrejNzTf>D95B3uetu`3Y2!i2zo$dT+yxcPG!rLj-exk8SF4Ya1Hq5>mbt_RMn zVp?2QfgVLdDPRR9C*w<>!C@&37Hz?u4qCY`5P7nM$+!jiT|Uo3UgsTLK*%aRNCQha9K^l^zRYwKyr0Per5fk5 z?-}XrZMMJ*A}VmayKx;b?FTv_K+VQNZF_nF9cxl$`k4={G72e`LMNQdfqTG03P)<- zJ1_?TPu35B=mGc16Y)D<&XkvvyG}Ni+#!t;OjweR;Gco8wv6BOrNgh&Z>mU~z&$8w z{X!2cBLrTM0NF>grY(`GF|p|a$R1T2fG`vFNnUNsKmg8LWk2tFy=#yRGnbh|G(jQ!#N%(cINR|6k*?z47Xlzw~- z6xn4Zou-44Kpi{n-`de}TNo!M`KT7|0wxNZ4J2nEro9C2ti*DV8T}iiI@4F73Oq*B zA_`JH=IsDOt?U6%h^G~EpMwRB2t=HS26I4G4Ajs&aUdZG=$rFGz>wkZVSKdGcm#Bi zPl=3?)4k3%Ui46;A#q4NS&AqC@y`(FK1pnmebCdf#8Sn}0N-@_(=G&7pvJAr%Y$<@ zhC6$?bkqpR(dNIB2EoDkR}_Y9MZhgwJN~ z5#x#^f~I~3NEm#)G5=C5rMOC_Z!{8ERJ;(A(kI-62YN6JY|Ssg6Wj%I`8qEqh20~c z3}Ez!_kc~4%ekz(k6E?x;Hy|ufGb_bM#3OO<9iJkkcOcB9TFZg26V(SOy{~UQsKO6 zf>TUeBOZVdHSHcqN#UntV##!MbkLN5shyZ5q%k;L#{{ekF9^M&Ek&C8LY49j{QO6kxAY4;@3`CIFWXwca)CR7k81@h z_e&|YC-sf~GOuDcLwSES&6D61bHjv#b09FnvV8ly`@u)Uaz?k#vJ7bM=H%cc;a*YA z=+d15{~mKLy>$tyVVQq`H_1jA)-dh5QN0D$viR&s=E!8ZqJlyiH=C;2S2#qOkv;K; z+Y9i_SAzAKw>g(2g5Xdcf9({O0xU8W+9l^tV5kJ{0U6@FN7$=HHlsrQ?-CyqZ z6GsU`g$#eqQ#UYB68DAg=|O?(c=VtnnL$xS`Wa=qfU=eq^#$VX<;m&?wb@U$RQ`E5 z=G3H^7ju?=33)ZkV39FE_aza{5I*mNNMeCtpFx|zaDS5)#Pi?)o#_&IOd5JlOj7>J z%1TUE7z(Gho*stMAUR#G=f&Oxh@C5j-+<2uWSE|`FMWZTAhASDcg{$c=KdbkCO9?$ zyl0ht-|p7G!Iy2oBiA}FNdn_lhuaBBiD@^GW<4tGyl)m}E?&UKONS{P{yvIY!VO}S zqHfY5I51LvG+$(`9J!tLaJsj&!okA_gseIeB`Tp|8dt`_2Q}057lpo1lSjwy2;b4+ z;V{*-;_KMkrp+O=fXIyzM9B5;yZH0119a)B;Bc*lcHl_^iLRw&iS?%60ZZ=-6!Rd# zmQ0W+4rz^nV~F``4#5gla(}KIuT@|P9TScl-qjzv5sW6#^%0*k?Xo`i4%1dj-{WSR z@*(ZOT>;zr@{`})TS*M)A&~8>bh%34uU0Cc>VVjGFOq0`L`^Per>Ur2$oZgNnVTQmF$t;$yqdM_J%# z-HqW~s4<=h!Z@&Omw-D34pAUqf@B)brxRRA0%KdIxE9!yVp%9X=)MlIk}wIh2C%Fy zmOm3d-3oQCSKM(6_B4V=%J|s^V;2N(Cz?{6f;vyZ<}#2Mjshvkr_7jH6YUg)@CsRd zp~|8wg4KaQ@-);bfNUHd9Ys9rf++EF2V<-#Q3^P0fUVd%0+a$HIhK01@TX3kpyY@;#VdTfoDzOzp9G>i6Jf22OS} za2^1&13N3LS@`9L=y;Jj;II%$(@HdmH%Lu(0c&-4enwYx-x(+O13S)mws3QPet-yR z04R{{AiMx2UO}TUxiZ1lbu^jDEWRl7a2feW$Ms$&BT&n;%O8UK5r{gKW;*QGg_Qan zz198Vko2Tl&VM+1YQvCtx`Ny|xwBRJ(Z%mzDGt+81Rw85at8ncb^`54bt*EJV%8zu`NEv95DWt8e41S*tbzfTVw_c~V4C`M zJsH8^Tq?#f6A8jFodWk{yOYmqh3ZvLov5DqnM#V^248;3m#Q(z*E;Y(f}nG9k{9$+ zXAi$xNl}{rB!?WMVjzKFhbe&*W;KpF_0N|~&^N9%f+B3y!KPEL5R}7x%L3f+f(|@E z63l%jc)aI`MHT?? zhK@%MmkwO0nxIPE2cSxiD%b6N4-X$ULVuzT?fgu0{6g$jsWfzj3&n0+f<)@FY)y~6 zAUqWMlsfHzR+zz6hUy0%sup9GKU84zMQlc5E;G8Ho!oFyaPuPV3Vd}U~qf?_cZ7w z9HM{LqZFg8ES#2T39$k`64*^X>DGs4VMosuD-z9a$(8TR*Rz`7Q(`u5&CCV|3HtFxb z|HKt>Xrio8x0#oclGkRg2~a6vG}iL&7iVxJ5c2Qb>X!JZUfzVEl$>+o4wSxtF}EV+#-q(p9lU!0Xk|tQ zI3jyag7fHy{x3R1)7GBWj!PqBIf*5TaH8AIz}$z`(xpq#q?l9MJTB$6XeB)dT!DBc;RmL@lY4s zmfiX?e>Nr(waQmUnqxgT&T_@Awj2A-HV}-~lQ-k@RJ|xIW!nY=CT0GeHw~>9g)6(! zKbN97cDQVZ^fz_!2jDk_^_HKz?|h6VqX9!vZ%%5 zgrh+7wIPbHG*CNFAFTFIQjtjyX~bydf?-iBrz1_5@35FgawqzdKt$3orZ*q~%uSrL zp;iuZrF9G(GGf2fr{7={HV{kVBpw6@P|zh&gl^pGcrrcbF> z7pH^XG)?D9!Qw~#%fY0PIoDa+Wbx~gDd}?zg|O4onqYk@yKaNoNFrdhK=bSiM#JsT zss^1F>t&93pT2cj(rKu0rzn-cd*vbHx^P>=MSIqi1kdKttD`JV7e>Py_VnW;0rPXb zbJ9Lfg#-;Te_I38sliHUtgwHih@;$h59K$#|dcia;Ore!^UqE?fk_1Xng> z_y+KmKqbeVyUddobyzbm6tOW|u+KIiY-s_a3@TZ0IMf)|X#w7}JI^y? zYfxYQ=GNta*jALaWR8t|Ab_)gge=L?rm9%>N+#6YuY7#RYS1D8iC4X*g2Bh=JR#Fk z!J)j=*3!!RpxywXyt;W8f}8I8_m>@V`j;R7Ex=+vcn3c%VfUZ*ygesjLW;if|Gr=P zi`B72+?<&%Q@QN=&2Cq*iFS`6OMVac;Kl^^<);ISHK&q^jCSX#`)CLj+qn7`=M+3e;}kMQ}vx|DNmjT1zW97+dVm1{gAoaiihifkG^Q7oh#-&Gz5Z zZolItF16mrbq^XEfxQw5AU}Xi+?P!2Ec4qfN?G1o?@ErSmr6RfG(5vv0LYSB1V&HK zB@_T{=(IY~@grsdS96EeG!$Y;pOg-qg+=m7#whijV6!_||Ak@AC?P2>0t?E>2OC&7 zK{?NUf`K8S90_ms{`Zd)z<$RqRO@^E{yG87ua`g8@seG^NDIL)WBPyxWa~zpe)97{ zZLQ7(lR2W#lSZm^>rrI!B@v(6fq`fkZZ$sQ@1q+E$ZLUS!|~6VNi;(u2vhL{sVCsq zK*SH%BITxLAz6aU8tO9a@y zg*}g9LP@0jHpc-pL+e_p7hEYeUMw!4dV*fOX9I+{iM;=jb<{=`-`Cgo@}u@dmLN}p z945JtR%a!GSK*f%2y)Wz~vO&7- zz&VF>k0UgQ3^ELwC*lIEUw_w6eSb$8-6F`w_s90#dsmKw1L1P=OZTO#H2;U43~*C_ z%2V-i{SHQt?~{gkz(PBwXx8R>(rCXPddq{%~=qlC=!5Ppp)aCNM3}5&xl%R+hwpDVANU>!0ngiCS*c!2u zhMx4BOdxBMGdlvdqew5e1)`vydcq?==1tooI!j6QKbmiV(HbN@=E8XqWdma(7@9c@ z+mN)GfV;uA#`}^GAKw_nJZa9$DyGZDK!D}S`g~_35_QD59wa-KB!%?=;KGq4v>Sf!8rc85lk>3q{!#bSprpo#9On4aS!mf zCTmTc=^m}yzHi_u4g4)(x*K3U00%U{`Zz5o$+jdA3GvOY{-4KK z1SjF)qhRhmS;Cj36%+*cIzNcI^Zmpe*$omC3>E~zVS$4?;FIr0kc>+hIdHQwIw;?k zb+ct#X}A2HGh+ya~jwm-{Q1_?zqW zn^wY@Uq;!xsHAl-ihV)G|qigD&F5Jl9%6onKW1x>w&e`mlnL5V(PlD4DB zE=_$=I@TKnX`@I+GRLqeQE>Hqq!3K9+Vp!S;C5>9g5baJPmIu49sD( zT7h6$oIWm%P8|3KDgCQ{B?i-4vK~azY|cDIj{ruZIY?M|F=|@CS0GCMtY#b<6M%%A zwXbf4>VOcpBFT(qO#L)r9N&z46p{_OjYa$wODDoYW<4Jx2i+tJ4P{j7Gp?NBmFj#O z`<9F@^I6jgu28VVFfDg@NG=L@I>JUT^Hw2(bX?%4vQXpCP95=4+yA>s5Jv!$amN>a z`%FWgL68gfLox6O59TfR>7_)tl2>xLj+mBTU^tONX@^$gfKfdg558>-NR|F^NrPmA z6+Dw}u;ygTQGTFJ&yxE&zBg$IQF6m}hynv)dIVzaqp6t`D8Fxte+!38wfze3B?J9* zoIDjlS^(A=OFE`HBDH`S0a^fcNnW4|W)G%Ce#U2jWa00qoncbkJR6V{z!GxQe!*SR z{Ck`JPHs=FyaYZcfHHI3UrK-WAFZO zKG94F^)A{J2v)jeW-Y1=!K1dy?{&G^>=h}Q%{8L@zs^H8jt2U0vMP4Rz~E$+a0inSYf^eohDo z9@j>0C(HE=M3^&(WE$eL|DaR<`2&3C6e)X!%JMSZDnI z{`3D5@;5S&KeBh7_ux{MkiGvl@V}}l=978g0ZiDhoW*=-_CY4zSBeGxf2Xxamv(d9 zV@Yj}y|sk>7YBbVxQ$6*9JpC{)Z72xE3+vb0tMoiUG9BS(hY?=ClMQ|uiS)RXvG7jsQXzSfPP9!P|zV* zPY-M#(N$!OM-vRV`oIwHcXN5*A{0Z+eCn5lFLPdQxBP!E{Wa#laPGs1{NfexN|NMn z3Or?$#t~Jey&Bka^t|+lEg15mpesf$u5bkR5oi!mgL<1bMVQbba(Pu(Ri#bl7ytV- zJ-Pnx$_HR7Bez~q6C9&G=i0LD_Om<#1l+bJSQp=vI-TOcsuU&A{m7Gc6wmm|9f^hm7($K{TB*zUzm?Jx9;gWZxi-9SFrdqH6Liw_ zg7j?k%f(?ktFka7W#B-ba~7|`SPE6^$DGFQkwD|JOnylrVEG8tN|sE$iqYJ#%)#P`QD$N4kf@qm>c#~Of0Ji?S(k|802Qz+ZYeQ!mN=b2KZ+np6-!C3&)|^ z|5R2+#BBzQx_D*6uE#ZnW~(JJN8h}+ucpM0TtIUG>l1V^Hk!&=-^>;DYPy}Rwn|0` z6ZO1Wt8?`d!2N5wv2p72KnaEx&mU{8K&LaFE56uB4w(jB9q1y-F=V5fZ8N!DZ;D1V zL5!fs)N7yET!Hk-9n%b)W-^ZSF7In6;MW9v$ugKTLC0s<>QtHu-om*MJ4d&w=7Vsg`RCkn&fSl8?hTWK@aunDA8;E7SNYlTR*+~(cCRw^MHo7bF+K?;o-zciH$0_*=Dyc!01xmec_7< zVi*>w)A7Kx*$U13hxL!2E=m6k&h+i#l_>w+{rHZ8S@@Oj)m~Vxx95ZJOZLpy%@q!# z!L`tnT@Cd3`FIm4*RgDVult79s3ggOV|>DK`_8|VOu~h_5iOY_&YLr1-Pb1@)cvW? z@DU?2WQPG>$ACPk5| zhg#Z}z$3R~rYP&7t<+zagOP6yz8ccpCnH2 zEwbNg^>)`0^je$s&p&)ncv1Qq04;L+qy4l(R^q_L69m{j zGH`ojTXMW4#kID}bs)PahFskKa9sB_eY@vf30TqC99)n#O%fYo8anE~dL$b;+Lznp zo8~NTcdcots+m*yduslgDMFmhFPY#u-dfDP&Q7Ix{_Tm(y32~q^51xWRgdJ98VV+b zIjLuMe~^@l6}}c(vc?_wWKlHp7>RpBFL!P@hP|^mWm+#TLzwK6d>$|IuEBwqi;uLX zm{0blD|JCe21y>W6}+KUGwYKc2{#qZDEaX`YdCDh#R)aWxwW-5{u64(#Nw-verhn% zs?*}uk@q`JtQUiIx2#4j4q|xq%eEdK*I#b6;X&qDOrRrC`nTY_QL=U9o9~pw*T? zNywwXcBEjC)A$k~8esDjx?80F zqQhfjSqhkCN?1|#WXWSA5hx>=uck3*Fe;v=Ce;U-R&(L30OtR^)0<6)1D{HzF9OkCn z$D@_dd>qv)d&ILGyLMv{NWySL+X_8Lg1kG^nA>c+fmRo)zHcWmvKhXW;l*8qLQjfu ze;R8VF4S+=#(yU|NPZGjEsa<;agYqtz~YGPnojHuP5hgxQO(xO@N;s$CGPw>6!XJ(+@v|>zk)2u##^U$yl#C?9H!<(gAvg$WQ z;H7g;+;roWR?2EOayd&7(w@`ht-Jn;@cOyrd6-SbZA6@h^_udIA+w)l!t)OzHR>fA3c&KpBnQH{Hx*nHM*2Tq2y7vGuxc?n6&aB@coe|ym|j+F(lj{)d~=&mLPi6 z8b~=cp9fATLo@kk5~jos&PKv0J8v(HZa;Nj=RR6YSG5hLIxY5zsY&$oK9Z7>2KCmI zbX%zbB^M)+t*gN-XW`tmRT{B<4s3O7jh0cN#hQ&EPI@AEn~oK+MN)oXHE}GM!nIK@ z!*@oR%~V#ZZUAAc9wxr13U} zSSgs{UCkO?q!kU_0|T#}Ut3alTa%&j3!{?q?F5`f!>QV&Sc`*AE4f+S;Q0Ko3HM|& zz4@lXOc~k|WIIL0VscLq{-m#eC^(=z6t0($M~t;a9+rbs?|Q&-_XjO?;Aiq13tP=W zS`sU{_Mh&oJ!%V4K|e)UP!R2Gcvdi$-r!SEYsgPIajr*`SQM=%$~C;)``r`@uQTie zd*0*DwaC>V_ZCXwI)R2v?b)(yBKO28&B?_KfjS!PuF9&JEt^!0^#@9!Cnr8Ui$xN< z@%+5hh&#T8c9?&Vlk(8pn0@WOq&!J%`eUNO@CL?f1#-Rkh`2vFkw@;z`C$UX5bHD? zdT#vr9%Ywl3(`ErCyh0BJFr!UZK03jDB=5#KjIDvi22B$E|c045t)@$rCEpi*9kzI zRq-pw3iN~m5>&@`3VD81;Fj$KWFd9>Q8d(iSXy$Db^LnBg@J`I7+DkclUJ7aGJb8! z0%_4on5*MS{nlKABkb^>Ip}6#_5uboXz_u8`DIF>sBedN&d(f%A2q0kM0N;}HfLuZ zxYDN;RZsbz?*|a@5FOr*Fm$%L)MDNFO7ALibY4CtV*Jk0Pa^#Ne>2ZJeSx7q1aAWhco^Q15 z=Bdn1_*=+kD~YfvaiHqI9mhCIwQqHNj*cBW%%IseH~KQUL-66#ecetjT$$p>4o0xe zi6udy2+7^wKs;}#&<(mrYs+En(PWY&{FbDBBxW|2Xu9R-3nfpC1TPWaCG4|ek>+`% zY8{(6Q6^RPXY7J}1=i4MH)z6TNAi*9nS

n#EUxgW@WWH|MVObluy@lI`Zw{RuEA zb)DeN8zE!OeiYVT3fBA+^CX=D)}2%uBkK51f(@O#&yyu|N@*YE`zTg#a;>duUp-CM4 zg@1ln+}7Fnx9N;A zZ*fc!F`YG9!?Q7U)2%dkGt0x1qVx{p2~c_Pq~g2^aUz8CHi^21)?sV%Ca;xLk1W`Y z>g?W)#lP2(EE;*PD&n0yr(%n8{r33~jlFGaTDEE2;2NtJt67UJt~+-+rsaDfWzL|( zN@_Kta$^xYA@n+u{|?>&gSo!s!?VWlK)*5~#t8@nft|q7bha5r+0<=c-C9naKU5HN zRn<8E?)KNB6e^}wWmT(&FEx>^sKdsWDX?)?_2FdqN?L!yOb9qM9NPse?qsE4wK}l- z*X%feH98wj2?3fcof_lbP%Kh#y{a1-aqKh)bvT5x@+3IS8dLN`>s{bQXqS`A*yLJb zD$C}b@}sTfBSM4G(5BOHT&bYcP`3=)uP&O#nFJHmC;ZM(l#P+m(3EG|GJ%wdPHaEm z0x+qI$bxBuQ*lxuu@E=yoy{a!6^<&DfOM{zpDh$_TM6FQe^UrQXr{pHzeeHwLgvh+ zssNExjgpgW7!aAoi`8O|4z^vg#;JEU;URCVb5HJJzOAdvpjpd8^Maf zXeTX#e<*nE_rlpa*F$q`>udOOqRa+;3{jf+*qHlUb!37KaE2@}qbxh3htY6iR(d7I zow*x+iYDVL%Or*vKiioVlybJEF_Fi#TDEs)4DGGb-gA1%nS~ou68^-bF0cfx9Xc*K za1oV4Afw<9)pfqZx8GmAX_$Vqj))?~EC*F^3XQIWPv_sP~|qYf9FKq$CGKW+;zqvQBOn z8Iy;ICnc=w-e-NC^gN~Tk_OXT;UL)Kb=#>-2op13t>d@lUcB#Dq@r(*k9YZS;>H^X zachHNYW7fhNe;hfG8ne2bvo?njsvOX;s*ld-g8M3j9U>>gcQ*^_0>~p$lH7NWlxJf zW+n|yiKf*WJAb0)DPd=1Zr6&lgIDCvZ6_xc^0+$g>zr_$&Wmb&`!q(Urs^WCcpKw) z_PgQvqQTg)0GzR3ml<6@w{aA;Dckg|BQkMnU4}v?3kh6_TOH;Cw@5VCup;=prs9n1 z8c+Ys(^$L{^=NM7qOM+u>Ya^zPSNJs+M8YDG8JjKXqxx*)tuFgq}HOW^vEX58_OyR zF4yIbzLV+Tvbb}@w&q*#mS(f$05uDVEB4uT4Mym0QQg%G-Y5vs z%W$d13eV`w-#xgmNTp95-wONI8t+FJ{CuLouJySW(RuNhSjf)fTdlM1r#FignT9w@ z5!y8c5H^XBb5kpJ3ZfB6V7V?B58IwuiM&Qv)Wx>wC;6EYd zw78FVM0S4ShRTM6)T47P8T9NuE{<&HE!Be<=Cx25tvi#cWspj>V9trS{g2dsLU_R^ zQBVDNjYrFnGreN=ipi9to1xIQZOSB?Rv zjpNViiXgDvg>oES)`&zAv_I^06o^*o;*3TfuwY}Rw_49c`phm;wws5OzX~)gwX-59kO|+uY87*KJMJQW z_pG2&2GhXJX`rbMo|O3qt@LJ2Cf;}ZIfLuC-(I6f;$)3&df_~d(|&{HU!9wxGrCRw z=Fq6f*owatbXxAh4r8b2Ft&_>EJ96{HhX>Rn{KODcd|c75%G8L%oH^aS@Z57VP-&t zM}IucX}htJiVVJ2dReetQ~W`{=n2cy`B+Ag^>@7q=$Y@d%?6KWZgQNlU(X^pWm^;E zDl-W!uzn^m%GPp19sBSBnE~Ih%Oq0%V;uXkXQ~LPR=wNz)}M+B0rIdyf~amO_k%_K7H z)3Px3tKI5D)1~u5&wNG2dnV1^5WKf z+$erjM2DsbFB33*l{MDBxEGaI+&-s!^7q#PpXr}30Ph?yHOmYXVi>qb45L@gO&K2z z7RHaY>80|en>qikWBEhI&9DrFx)F6dopvb8?yBx>K{p~2w_gp78~v8}kbY+mz>Uj2+R z=9_@UNvm%AX|%rI=5CI&3V(!s{rgTnGihsS&qcO(J$*hO<6aW{Xcx0yPY`x=G{oD5 zpZ5CIWcYkMef1ODntntUoh*sWr*^FboaRK++mg54KltAFY~2ODBKy(muvqJ#*0Q}Y zJkjj-DyrE0CLHTk(`!Dji51T??dT!^N9gO?{YF3fIJ0H;#^o$=YZ{r*OGUiqPKJ*7 z*I*tI=kG07*)_s~+2D1aCf>Xw6$OLXs42^1wlcU70s6yI!Rr@S%}<*=j8LPQv4)@}*Z( zc1sxD%UGh9HGci&H+s}<9LzMPA4Ffsycnnb%JxYW}t3)t{=u!v0`(T!9lJ>mOB0G8lZt;5ELq;&C1tlp=q8 z(Cl!E`sTUPx|`*%AE>8s%K}w9pEo_ZZ0ASJhcXtjXJxC}YYtsDwA5}*_Upu+U@NaU zxsGglbsq}8-BqueI>sv{8CcdvSNoolm0fqUR{caf?kDLHF7Exj(0Rbi@9J+cetl!8 z`8|v4$+q%p+WclgxY|7)ui2K%$#waLr|JVQ{LPAfLeaYU)}i?zYUa3-j{*C)mcSF| z=G1w!T{mU{@9)|9Px!N|1l@&s9S0}Pg-1zjuMNihWd7mWkp88>9+7g;j}`D%Fi3mA z=GKLxD;p(-W46o%)pSm6wCmkmU{V8{N%}5C zuG<91mTR4VkGDRlgef$yS&h&2XH*F%=x`ekcUMwj(IJ2HC~+HZ;G4Mq|EN04uqvZ= z-O?S4?pSoQ=19QD+$M+Nz0|_l1w?r4Tvp%x+*{_zEzIy1MCbAP7tKmB zskv-l)gZ<5a_cmA_>I`K=uIN`(n%A(7`IZ)%-0|(CIgOd0RcmA354di3(pmtxQAVh z@txi?4DH|BqfQ&I=iq0>X#cUNCw38K(vk5}Bsa8;|MIVC=9_d&M@9=GKYue4<5K?02Nt-YB$yZY6S&ewaBP>&uHT(sMb+MD{T zZ)fP&;vS_cL6RZAhHEanCNrN8Vor>&p%2tcTq`zy{PY-3`hI_@{RbHg%KERypqk08 zBjBv)#_DuSO@`HeIqR&Ne(5=O+^en{t#NzpYA0PPMJ|bD4jlcCdy>;G!n9M`yAauW zNpHWPt)7T^wQhUYBmQ8w*jy#d8R6hJMIy$W0uEe`zT%(>4`f2whiiJABy_v z_vlw#Sw9*4%nH#!ar${%(7%=mWxK@!pLMNo22R*_(!;2O#4eqS36{|28hV=cMbp-P z4)O)V({Dak4~5#NrWw`pF68EDDVdTEeu`=5o)5Byi==!w*N%h?6El${xeFq`w1SE7dS z8ODD^erR!g*GVbO3H(lo+Q{!m@$u47I}f`tr0pO|L&+7;LX+pxiP?P%sU-Yt6X`>R zI$R%bd-O1WENnM2!YQDh9!XR+AqwtnzSnO2^)5oq=e*!czL6&2(NZjp0=z^BR>?F&Di7@$#KTNFLzsj&qGBIedc)qnI6;C zujPXU&Ek6VUTO{`h4Q%q$f#C90n9cK1#5xryPDldnaT{dVp3QdQtFiXhw8)4;S8Z; z`r9|C@8o~(*f&v%`ivuIiqC#s%)JtjPWg_m z!1<5-EFNdoUB=(Q=O?|y5~fE>U3960S)8YNF0raO=Hljfv~@kyQ{hOy=Jn6Iejer( zDsg{pm~Sf^!QU~YVi7gy{(Ja!vVnJpTk?5Z$ED|1&yQDb6KV>_XPP6%{ zoql%Rxy`$d@=ji7a;|&a&Hl+d?zqGJC#}kFd|^4+kLh<+)P?fS>HTomSLWsH7c46t zqHIG{U+ZR+9XFG0Ke}j+B?K4`383#f6Q?CiF8 z8gFMWU;4?Uqigusr);!(Bym9DTjaRme=`zOE~KU3LF6%)GyN#oH1fRpeUQocblvm? zv&(hz#!q*$}Z~Z1UuaTcC|)x&(ia^Ol)QzA}sBNPG+sY2d?-GUN!McHX~tr9QwLD9z|y< zHPY123KlffswT3_@c8|xW&Ajad2QZ3n>q3^@`IHV&UcgcUn2w0-;6ejzPlUip5(cO z*o9V#`7Q57bicvfKb|RPJwX=9gEQ&ZZ(a%gXeeuD-2#9}2ox((UVTulokx_lQy8>QjE&sJHmC zHRK5VtmCl{oVKUaC#|@`SEiD>wZzsi-5BY?4`!>w11^s zTzgIHuL2du(=vp1&D{kKYs1pc08{5F34|mu1Ck+6d-YIM00~eI_I?sNf!#EhMR|KW zarZ^1c8S3~6&~X(of?bz@!PjD@)S!AkNvnI?!W@8%wf8q{YZ26D~|WYK=PyzZ?R~| z?&3I*FlJMV`@0XuV1q*(!h=SkV7b=!heS-nF;w{&+m9(OF+1laj*g}S$qamHnQ>KK zicIAmWSPYmnct(f*vP;dJOfQ^Jg0E3!ECC^rVNLXG4aPyeC83;j;k)ldov+dM)k>T zH{H+jF8zdqs>7VGT@x$=T7@sBzn;slsrt|3i@84Q%73((-5GAX98I(yrOzgidBy8e z#doeha;Do=7-vFE@=~qmxycBYpz1)GU_s^`9D$*Nx=g%@tX9=jQZ=LV^dJ6bq}i~Y zfp3bH9=xH-etgYSMZWWTA<6sPpb%ODs-Im z3lgge;uM|3>Fi9+j~}C>r|}`sxh&&1FDv5Ms-UUvJC^GqA|f-qyp+bDFj|ZyJc}Fky4A(Q4mCIMK~8Z-yP)H*a$S(U&;jBH zFN}|c5%AgU-!qk4@Gl03F6@5&Cq=gKTS0!8?mxdh_LWa8dpzw$;0OjSOawt;c}Euf zl$R~d#N|~EIwna$@kkN0Wz!Tw_xIl)@4+f2a!Xr{g)}Z|eW)7-9=`JF$9SKOh4a1X zw`i5aY)sMmGmSZjQ-<(gOiaS*m@(&$Clt7#$jHYKC9l|xd9YZnCzu3oBnTV!C4Ue# ztg}_{&i_#!gjsM0=OFoq!JsnL{eb&b*UvC5;l(ii<7dUJa@iHNIkp3w8Ncp?p6!|4 z3K-uOY8z0NXgv6=qeM8P=l1A(DWnV+a(|%}%sp4#t;$sw+B+~Ak6*XUYK_{Eu$_qD zIUB()BYAgXH|bgl?e#4e@%WlZfrD?OB~B@1z2e}s`=_L7g>U6OC|xLLGA_Y+ip%nBM!r~urrOs%lu@)!l6NBgbK#R zpstAXK4`PqtMOlrcYd*)x9{0G_^~yJ7Z}!#qyE2flF9w5d`~7CYlWJZ$CTH?L-pPmj zSh!l7SDmCc@rK7&WN?g9W*_Ip)6krf|57|7z<8BvPL^ekJ&%>Sc0u!(m3KMlX1AZu zijXVajB`&c^EbDiBDo?RLqFp(TDoqeeGU#LD~Bo#H!I(re;OLJamQx^Y2om2>40oo?Pv*yhv2kIo82Lg zHdNHSOQMOtFTs%)G`ny7(uYBJg5bvkGxc7uzB#vnww{E|B#AaL8e72}q6w#T;k=wm z;d^cK-eHnR6t%&Zs?^;E4$~&xBDEg^?c(AIvq!!l9>Z)ESonpVf1RHhm70k;ugjog z?sYNOFuq0dHN_KQE1z&7dWZf@zcshdSBv)pROMwhy~bT7pR{LuqX`waTXht_mdOQf z+}eQh$NN;66?z4QN49F>BsO<1?}-%C|Nbffw25T!Px%yCP1SoNMR{CM^fIk6(_7#l z^+;E_U1!Kz_)t8|wo_q~!Fmj8h_~*-_4$e}!BibJ8XK79Ai2Z))64m`Vr{3bordsF$uX7c-Re_aud2|f-3;dZ*5FGAg}+sbZaVUD~W zK9axbgOFR2dkZ-8Hg+LMrcyW)x9*=US@tkcl(OST!z%nT8e#Ytf;^)Z}}-uG}DJ;P>LBhhnZ% zdei@YV5se#c&OC9rBo!w%2?RSIFpu~rsZWg%Zatbm1BFugv+c;sMe^T@TY9E@DpP$ zAy%qjO@wX)cbekEn}lPPG`4qHFG$hCO|{_~?*g7Z2&E2%f3Z;z4(eznO=7%2PZu9j z^Xb`@B4hB26wmC1qWT{!59mmE4*9yA=Fe*`zoT!Roh(hWc4~p-5e>T}@o&otd4*-? z*p{ieaed^oY2G5*yM5$+|2wo?W$R}U z%8kJ#>AHD}{rY3@#Zi+&LFZF;77)siwO@jWcg|vlep(X>qDzBV+DNV+qQ9?;;E3YVCk!s~)>-;#2 zr-dBvU5R$o;^Jc15~+e6KO4>0z7Y<}`o>1XV~Y`zmCP48UkLwh8F|&N3XZ*&r|UFJ zkyB0{z^WcHZ+~uXj>~s7JD8dP7wD)*fFyu9dNk_!DUu);8ymZ31h#frQU*94IurP4 zVzv4C`MEXQRfh0ZcypSF%V&8g{oxmpE{bJ&P~qHY-Qm|YU0tGU-d1q2-fx9#bfPS< z1k!onNNUZ2$e%m~eMum3gI-q0E<D zBqeSTEZG|8YJCyp&b-k0Jex~{D-VsLrT|i&{Z})wf_K@Qkcj&Id1-Q&?8p#uWksr( zxjqxL?v*5r_tTr<;pE)FWAZwP90n_7y|j+UNA7>E7>K1&9Tiz>;UxXqv5G5AT{O3h z3R}rEFHb>pEEMX#A)RQpI#MOQp~2Kf_tH46hB#$Rn?1Z{vLYkRUHdgs{~_I*6iAT; zEot)5bLQM>cj|PU7Mq*IofCK%5BXq2cxFDR7MtqZKc=fz>gINJp$uARNGvhX+waKg z`S`d9tE&%q^CnQfw?UHUlOos@=4sN&r7Ys)l5!BjPrbw*j`jP-GcI8F|<3#%c{Xr%-`l=wj}^=HeM66Ne} zFU$U)oL#&VqmjhR#_ElEWsJ^Z59}<5zG{0V`3<{{)%q9Rf9<9Ik)c<1y`hy!meh>f zla$vK2igJ9S+M}IXwVv}=<(P=@#?$F>PUWd4D zZG1h_mq>p&u*_>h6d%FSk2vrkP7%?0z*ZQ8p3!MK_?Ee+?SIg*?_M2fDIyfG+aU=f@Qws{o~Nx}G#64+Nz~+7henEP_8; z4vpF{8wKkn6s^9M(kfH40LVneCV4>N7|x z$Vqw|Rws|4Yf3tt1c)oJL`??ijz>_YvI1Us;N3i4Z94#^y2c1}hbgVBA1N;xF$DM7 zzAPq$3zp00Yd--sqUm`7#AdV>#KC!ysS9*V^`aQh=*eCSYaBvpU;444prPNSxbJEY z2Hc!&34QZNj9i7v7a2V1*~65andMumgj0-V`=Ku65HBc}gmvE5Ad8cA|i#xkQY-%}Lxio3A#nkp zVo5C(5_I}W!MR?0$^m<_Dfi2g0PUyXt%&gKzg^^KVH_r!$KKXn85x&(k??kvypC0y zXa)W5U%*>4;<1Qb)}iva4xW zJRemRscMMzR1saErPDv?Pf2wj^X*I}CMJ$EGki!jNHh};-hTD{_Mz*2J_;`R!&3e) zPO}cuU&bc#67M)C1tjsYFArC3r`L$$;2U@nmRF|ebax2#nvuTqAl5C)?r?*a65>6Y z4KA$k_c?&c!rb#_XX2Mi9sdad<`KVXmM4oR+(Hx`NoC@1=<1({SpsA1Yux&2hxWBK#r$Xw;pYd-bxy0 z%C0ywJDayKeuymJg!W}KC3}ZOKLS7R&^!b?Vr0!y%9SqsBvw2IyS&v`5K&DoPxB0& zkhg^Z1qf7r1s#Y*;dI2^BO#&4r)A*Td-7gz4%AQw)BXg(#(K;!>}52Lcq)ClQtwhwy;MLtMxi2w)1^@hmP8Zv=GZsKXnEF^KF-yR~9|8 zVdqW!8Ku|`e{Puz!@`oDibo_K==)|dktg6ZEBxxpIZLrEz!*W(Kr{=&F=|d&yEj55 zo6Lh@o|EIBXl!>_&8g5GO-{U$!qd7ogCLi0?mnD&f zBtAWqhm?I}Eg1@7%`+xwny3{mLZU&J=d=BC$1h*@D-euo`S1LZ!a7{;^_zJC$G}NW zaXH-gxj6XYJeGz^)ctHFtsG!Hmezj-&9?mt8(D(nNI#IzzY{J+lk`yZ#OTyLjye*QQzKh^Pr{olcUAn#vd#ta(S+-ah>kB{?Ryde#2kB%*!R*hEGkVlljqMR9A-)ECp2yJaN^Ea`n%;&up8=YQ22C0&-#_X$;7OFw(i?G zpM`X9zEIPF{9C``Q+6XFIIop)|JY;jmSq+EWXJ4fJAx-DPT_cWb8bP}=nRL|z63gE z7KmayBbI7>e@QUGY6pUjoaR^VO|)Nv^i*VS@Aq!52U^N zw3a)yoj#ywdqAKSBdu{_U%$OQV`eo*l>T!R(vHWY?@rZ+64c)e=mHED6awUUla31S z0NZPtP`^eE<89i}LSofHWL%EcIUpotXg%W4Iqi1+pLRQ4Oh+^!5z&1Uh){QQ^F+(Z zt_j|e@=Q>@c||P*JFQ~qu<^h2`fe2$V@l#WWn-5#k1M~`GyFW4f>dwJZ=4f+en(wM zQRera9QGT7V*)BW9a(g_`sq`VgvG48#JiMeM%VtX2^Cbk{g=`klDV4g)5!rqof$^w zTFGFrE4`v(iYvSGO>0DDe()!8@<#7CKImZ&c$disU+k*12Iz*yxQE|m>9{s-ICYX` zM5MBBD*XFNeC-h~NQUcxlq{@J6cvz^ehbeD!>W1LJ)*Jvo!$0Q3r+ zV(O7=#f#`5TWo`o#f#Y;@SXslW4p$-N7u|DB=P}aYbb#s2Su2eZ;e1;TMmB;eSo(% z^Ub}=g{u1BtDlMR^*H^bPR`Fh`SW1a09y|t_7WQU?j*fkEi&C|Xn{?m@Wlv)TXW`RbEQFj z>db2R9-1X)i~7opp`}*@v!w-hOG-g-fuS?SzHGjr%YgWaJQbd{A^>7QklNwxE6Evo zN!2NhJvbN?M(}5uxNvDi>lc`*j2etr7iayqHf}2u-(XRm4ZDT>`SHhT`D;^6(62&2 z5>8|P)2Y?WHw;b(@;N+SuA+}Wc>$4G9rwlxLS35K(K7pn>xKWXuOGf>?c-;A{87FA z_^WrB90xvj$?e;aO3}EjNW3(?dVj4uEb3}~*$s?7cFoy(S8m(5mK(pi7a-+;+SZF> zvN@oQU{=qOM-1!r*x3h9OrN9qWba9zz27u{(b1~&*9tmD{#xPAS!dpqrzGOa&@KW~ z(h0mXiq=4VpI}Ec^smaE%y3kiMMPYO8BBF5P4VA>)T4+CF&c``U-f)JY?Svwp5~mU z?)USznl#)sww*J%-N0?q8>`#|WM%5jh(p+6tTwyN28M=ovFyAH zmOBYa2C&qsK56Fk&WMF_J02?P3QNRm%~N;>9j{vGBF_ZWH+|0nT6lxZL-k5K@cQ)m zsrpK!jc~E@*`WHg26D#i#h19ae?mgPz}h7p-6NEah&})z_U_5Mb3|^}7fHE2I2|vD zjkR;C$%S^;M}@Ud9j{0^1m~khKe)MH@gQ;s*aZyr8>O8ZWjNf*?ZWzx&9QA8uhE&V zpSvcEmA2K_Cm|s#js2@u&y9%oPRGdD*~amcbUlbl)J!EhqH-BZSM$hcAY$6F5k+Yx zJ}&+Zy^w09`y@>swgqsMWz(|K6PTyd8*k%bZ8?cZS!3y5dS2E{>zhT%(m_hx62h7Y z7)x}FvS?P07P#j&7(JiW&{{10a!7`S`qU1p#*Bk!U#&kuUd8kxYU?^iF zIz$k+Q;eyF66UVlC9N27-+|RrmZ72WR%t@hE)0`D4qvv9p#l$$VNL4c{59zMsL&}h z$(zn_EMW=(ZeL$LI8&#qrM1q^B(!}Ha@~mY+ocgk-iLm%7={kS*_`qHh_+#BwaghN z^hH}Y=tSw2RUM0>sVNVcX?Nd}&2p2m5#(U6n<}f}NY=a>mwNmyMZlwLJVozV&I2HK zq!#pOCp4+JY4U05azztmo5SE|9FLd{`uAY7@f?PZA_@&+uDFR-sYiH=p1JnCp!tN3 z!Gg_hlgfox>I|`Mj9i2}RfRdWK6=2hAZgJVPIh9u6&02qjKHO9k5Mg!l_SHTGqIhn zV$G&^_`Ss%m0elcaYq0xBO}_|aBs=GbzNi`M#|kxJT$hA51$>T2C*lA%QEO=C`-T~ zKa9xe6pkx&hReo%jV4)SCFMa|7Zd)e82dGbFG;7EjGQnuI(8Z{Th5UyqoJ-AIhW%_ zhr>`ai1vXnB3xc5B$2GWhqoZTlr^ zGI-m+H$xOYG!`0hnzPLpjWK{)kf6(m_h9>9?7Quiao!v2u8~e~PWWawao72~%l8x? zJ7%B(-hJ?A{)cZNzYEt)$$kS2sn5@~ukDP6#X@fVhjZ4B-p7|FD&v}G1OI-78k=^# zq4wEB#q;p3>z*D+D`}f}2bl6>WD`s_Er-yeP2cRIy@zSHkijf?>c%M!mX-8|6c;!j z=N)I=M=m+%Ez6lU0_ABFzg>u;XxgAc%ny7QO*-G5KTbvyGnw6wOHQn@61hySCqcIw zh|s@R6wQuaJeZm4OrHxyS9`Vm*zv^!EwpA%yLS_>cjEPV?eh!`46uzHA><>?s{mjk z;krS}?HD?LKDfjN-3y8s*GdkBv!R7>8y#a|XU7vu-b7B}G ztp2lMkp3fAU!w)+4selU)#_1GEUs!q@g&i@8*U5uvA5H`A{D%1{`kDmLwzgovw>-} z^1T;UPf6NJYit%>*+gKiT$}@Y$WrtJy;6$%oHdn4f)mN|7XXT}B>Ki<+_l$_F=^PF9Jt3_aKN_GIb{<;K#D+cEtyPUQiJ=F0&I z-BS8fV*U>H)XsUW#u@DNd^)nwfB+E^S9y&b*w*7+@#E8pm4P0zE!l5om-gMAc{4&Y zefoL$Itp86zfIS%VU#*jdXgsvy`!+tG2z-4R3S1ppV$xcriGZ|P^m=LNsB?a7#(k% zA_cNx)B~t8ZyAza;cn5%(LJXXK8_jXEdEC(w}{5U;o z6VzqZ#lM)s3WFk8-*qkw8k(6+_0av4CTvVoCy=(S7&zz{_uYo*8Pppy?LxeK2_;+C z$HR_>?Bp$B1kjUk8Id^m_Za>O5+~1md6%{c?MkSApP}Wx#I%G`w**BYRMsP_X&nzj z$g{{6o!L^cyjmby<8CXz3s{ppsdcOo5AZB^8DueESWxFO!dntLg-;jAG|OCCz{yzu zBt#?-Fuf;v5$NPnS%eufNt3E8Jw(sS6c)U)5)4s4YcnhsRDm+gRv)_#Fwe;OKM!BFk)=k7DQfxCVnDw#_1`NI2=C#KtRJY`7 zUP{^~(OY50D$S#g=u@~j+@iPFDozu5rD@jb9pH9UWUZ7Ekp`y4PIXQxG!pH0UyhxO z8hP{Fchw{(xL~yXHe1If?U3`%=A`pwqm6jus`m*NKguH7)Vp$fybH<5+^p&G46! z(r_0o<%I+8g2uOvCH?3%4^$Z2>hM%DW_#|b-EWujut#c#5@s!YNQXT>iwR1Vv(eUv zfKkk$&AL1KHepEy=|KDrhP`Lw7FBi$!sr*r&m$w|yKRS9wF?Pwyb~#Vp9W=pF19%Y z=Js_RBQ+0GlChZUx8w^*aIK{1Bak>u$V1ZEM+N*z@hbfHhv z7e}-A-vfU%0E&tiqD5wB99=hU!@-sGyvnJrwl-jlqH^_Y^a4ufWF-yXm_Y6@i%=K< zA%Xes8_esc(WUKVwnw=v6&tt>D>1KD=c#QgU&QL|N+c3>scPY#Gb+D+#@&DkIBZoLQK zEXCO@=nErasc|}07A%MhA=siVWMYo)aV$CUSQ5vnnQ?ODHt)QxunN5A%gZ#>9dgylsaVdlPcQoO?!B3d0s9L-?Rf|K6Xj zu&&Xq>$)UnR=DwQ0Z%rZOIKTh~T9op<`2Jr)0+Dx2D>ZkD6YvP5i8iQKDDF z2}GphB8fIb=>pNu5Ec1R=u|+4(_WURR%BIfp;1vO7?~2q^S#mAqz>GKA@8*Q~vxS&s z&Fz?=s`58F{PW}9OjZ;UL)q4d<9Q2y#lt+04_BS_?WNOb<{@K?rhdM%hJ~P&t z&_Mn9Na9mtev8Or7LV`4wgUs47#aExu^5U+GOTM`vEi&^yH|=*ywJ5v2uqHm1vNsg zrF0rEsSeVY-*6u;L=g4#1*JD2H5Hbe&S&n!c4=wqK{Z)^6L|ia?hJg<(3iHbGMKcA z-km=ZMfq|2G~{XrtsEkOrbOFsBa;glksvu~pxl#Wchil9)|?otKL%;IX&%##wL5|4H!KEPuYl(4&Gy^E zj>`otqsFod)ouj_kW0?0^%3Ql5QrcjMVRJiCJq}>@p@#5v3?6PJskz|z%Px~qJaM_ z(sdYa!m9gu0E?NY8a2`b2_@%9U(X`UVjmK+M`)T_8xhY~6Gqc=cJLuKh=8gvsZ0ks z*+iAL9LC;~)Owku%NLd3424iDX8juLXDb`MjeD_%rNfSD*@wj>>n|f!@fnXawRRHMkWZokQZFy$w?Id{8K|*1?nh2F@@@-#qiYw_cd9kVE*=iEi z|Dw}wFO3*|$SU_k&iLa1^53gm=`{*T_v6Dq5GOeBeGlkee%}I6&G;Q=O90oNgqT>f zKv+j&3%=lK0!5Ag5$weJapizX7;qOhz+VPH&r-~XW%E!f$L_#CYaJf+B-dam{X|s< z@A0beu4`a-0GnQ9?Kx=#N1lQen9UgEYzC}WaUMFsKL&`TSmKC!e`b0GY5>b?1 z$KgY>{cXf0DIZd>(S7!Y8copuP#$fGcPP2|#$C;t&QHmobO42XDguUx+4%)(7%z)} zj)7g(H_l>(-a}rte-$Ggb7)VfK-vC^;hwL2%iVe-iBUofALCioT|_MLm&gVvId6G_ zf=vum*S!nJ&pW;;HPuhH>a9aR%83qj8e%EV8w2tvcv5xO($mA0@vA-*(zkVWB2lON z-|r_lDxmOo`Yd9dp@ZWrLo9x-I7bW!9kgC?Q6xg@9L&|;9AYcveRj8|FZggOpm-I< zzD{14a#M`UNxAJAQ#mQ9{B%1*;z(tM3JjdXt5LSQy6Ee1b4=y3S$|tJ1Tp#PlCw+F zekqqG6bI#UqarYx@0f5;3?Fp7_4tE1^Nj%coIKC3%hu5pC%UnnW;MF57@N3zSo z8Hn#T6M>~2v6p2GsVoP!v-UUErZhRZBP;z*lu{$s0lYOB3!=pir6pY(>9BuX2$po_ z{20qat7S7Jq+%|z?a&t7O=QqwPmFJ}xL*D}3eOds&xw<+Vv$X}AOw7ES}amU+RsAwlSO6i0g)#lEMUPh%I}8026Ur`wV`06ufgL`06}N zM7tdu^zXV2=)UeU4I*Ji!;mwyO9 z3py*3Hjc|zuLzIc<*H!i&#BX;S!0k}1dwI^H2}LXz0c>ryOq4%@lizWZw`z0M9^ERv|i zc7i2?X2~^m3sYX{;~cA z5#^N@Q}q3BDiArz&ZzXDdII5TMj6kg(;%({?P-GJYHwjf6d89oFS ztjF8p$AJC_mUKF3U3OU5qJ{o;+)T>INlBm*Z>fzLAh_Oqd5!*_9KqThM zx&HghTq5M8tt#^*Ub_rcx85_hAz7R>A2RzUS+8q%5;IK zBS5H^W{+gCXZQa7XvCzE$Llbg8gh?f_Q^l@)oeEBx~Si&soAGLUyMR~9n$Vl=*|!4 zE1xlCP>A_{`unA34d1!<``x}!ed|S9u!0R68(YX#TXFE;qw06(aROyBY*VTpV~zBL zWBQZRDfhq)D&&q_L`R^hiF7px%qs?g8rV_`mQ~ZP`V{HZ#0YHM+@oROhg0hl9-G{+ zilL;UE@*bb9;0U%#V-A%FtF|)(+0>XNP7Gp%y=qCg z%*M!}5T%lQA-7f^6RTTU00;$eE$rW5aSc4{@xJ@Ie2KHHw`Pz`ezZ3tJSN_E(eSy4 z!{XcHEY2NC7;96}P^sFV3hpbf#hgX_VWcFa+mHbzQ4#%nB*-lqGfpbLay5QR0Ly?T z>Ed6uZpwK>CJzH>(ec2T+21)?@hpCFRk8aC+u<kUy`#kBlLIb@bJVpCN0B~hkqrX!jpG}n3#<;h^t@ymLldE>Dp3ny&6Ter7 zqALn}<|s=AAX?#R=A$5N+0d<0XZL9x$GBr@3v_MTaES}c2C7PR9m>=K=Zq{zj7}XT z^03GI=ezvs(EL)3&!`Ti=KykN#n}T>4U8h==X&u8&9u)s z>rfl)p>ILs1Nt`3V3o8?xxzix8NCnAog8KX=UYY|@(!jmP4}fLcCig)Tje89LIDH) zrD!++)JTJ)9bl`g$|kW??PNM0i{v(tee`pok#b%9Q@4ymCA{*{zW5&zuDXPz_gVAy zw1P(RA9^LM^>!b87aN}9P}j>r!{aPm!%CU?i=Rf^Mqa_7;SFBHR!*QI(qW#M z9~Z)My$PQUY~S{42bZVgL|OFj@VGSP`udZ_v9$6gvoyCMjM(y9bHPftjgCKaN>q9I z&sc%Dt-j7_mLIVmvz6|_Jt86e8HfWSyn+yH*w}(c3$_J{NE*KJZZxO7ZgM&<0r}p^~Lor9yp(R!UMvaaL%Y~$AzjEq!XS2gmh*m2W}RYO?@k+ zaGn(fQuX9>xHe#&#ta*+vLc9Z11!;my^f@R4y+s;`miSfKvVY>dG@R#H+zTIfo8Kr zT$+HwPJbk-j4Nr_DzI=3;VpWc-d%m@9cG}t#tk_`d`BNkPC1-Cf=ukXRBwVdWU&oL zv1P?wySxE)`LWdC46VSs0|C=!%7S>7LF^_@^IY_%n0=yS3wWA2aCcNPi}*UR&{mzgT6jG-Z%Hfy=edWoQnTnDDNZA z_6to<>HEyMLqKUxh}%T+Pa@@sAWZhwyT{}~=UGspQ}F=m0xSkvH~N6ejJp_T@(l!P z+STpU_=>j`P8rNvOj;2cW~eJwlCr8eQScQNHl`I}7Pw5h^hgRNw10xtccsHnb#?K# z!S|Pu1S+m~DooveO?O>r=CvzRl|D-wO3T!T@+U#_^=UrY|Ba;y=>Qf6UTb_Od@v@tO503-{giDB z$~>V=mVbRh7S5u8gUUu(EOzd%zblb+AXrHM)s&n@vG|HNz(E`xtZ;$N_Yr(0G#=31#z7cg6d{3OwdqVh*gL|Jmgs3BB`HmUQ%)NC7J@hj z34%rU*k_vLzgfpdZ2*1zwKiW#j1T8)QkF-(kn$OQa(l z?V{QRf_=Kd5-1KjMnbO<(^*U_<@eR8C=#MeS{k)X3{9?7 z>S{r_*UfEGN1wodUGM#RZ@7za^r}=1xK*P_r$A~$ePy_P=`ig6%s`YQ$vV_*%7-dd}i9h0`9m8^QixzEU6{5!gcZFdu?_2*$Tr+EVBb#xI5@OsphiSmN)(>1=BF^#|m;%@=et9@@p{DEX03K#)@DS5 zxr$5UocmiDsU$Y@I?rgDKCwtDvUX?T;n`m{|zCp(tw)(p}t_Kzsx<<<|*Nv#1(Mes_+X4)Zq1lFK ze!!(@XfRCIelMCfMPwevRnb|oCXEnw_&Vg0KAL!TOcpK>ejJV=FmCJVoxtnAq8zZQ zzyaxL!&O;G>*KOg`vjDlV6eg<_PEC#iav|%2Ms@hsLl-=$`8DATv$Z0=n6{8epDeP zbp*M1XZ-pJ?(Vx)qO*(3qXl`28~Ex0i%Ue+e(^InSf&cUam3!_n>qp6Oa#(Ht6&k^ zoSLh%ub`!PBty>C{Johb|9A01n%EOzlY{5(xD>n4nPHR1J&`pmG!>SQ>W*wkdd!s?SnMP%i zffVg+SZCur$;4`D4OSAIf z@vIavd}-gA$?}=0i^g83*TuE6gAxMSr*!loS&n10xCsQ6e`9z$GR!*2WN(Y_-D?Jr zXTY0g+(U)t3u2U*->LJrPr0ySbFclRW&SLvMiEHUh1rlokl~uAgjs4%ZsNiA zH6rwX0=Gz>u6sgozNnUoQ2d)-`9WBvZU`*!UrJ$CFwAP}-`&|}lptJhDSJY7<< z^U|d&8#ZiW;;B<-UVr_KWHJppQW^Hnojb>l9m{&1Jb6+r7H+B^gR!6_-#|wi3;_>F zuUX==XV0p9oyZU?_5%wIgab%0UF{0BnuLW;B0!K&ojOH>S%_jG2oY^y0K1Er-?(vu zm=kbxVZeX^1K4t;?6>nD8zr{z(+>j;a(&>Il8iAbJ15A%6*e=$A;o7FOF$SA!YFfD zV!+tNix*ih`hof=#RaUzZ1mEDUij%pBUXXWnG3;yr*ct(L1I-_R(9sh8G-;Oy9-n4 zgiSe!@7uO*Q(NxZwQE>HeDD;*q_8lZDaNf25{;TE3Cq0m_dUGWJjTw zQO?K8%1Y$Z&(agXwQJX61FosH=A5OCeA>877+C`L3DS_Mo=35x@C%n|6A*%+#9{+h zv2Z^5aD$;p zjy$_HNO4?`{!CWX)Yj8ZrZTpZpmr0IYcS_u(8Ap(E~FA;h|AoQ|BaHCt=6* za8px*?aF_arr$8)Xl!l@GO@9-IgylqR-VcvBhdiCU<&dPrNV+Vbfq&n+`%t8m75go zgpGb2L6nr%)PhOMY!zPR3!Usn+DO9y`su_$#D>E1jd0X-GM%<^jT)y^+^{whiKWun zU@#1uX_=RppLjx-O%i&vR)<&1EUy>Oyo8ISi_W<)~V7#VVs7`np7;fLG#B0NJ(1;_nF$^}fxUflk!ckOYbE3YXNsZD# zFAL2S%w`rYu=)%USR%kECNWVNAYIT+h7brpZPh@9+KLRpueMg+LK$H?2^W$XQt?z< zQ880k9Y)#t)TmI_(vJbu9I6E(N`3ncDA}B0 z=)`7J;FofrwsM?8gF{TBAH4`sn~Hv1qlZI;z@r${9>y2+(uoA-!oz-OUt$bH5vEeZ z&qU0Fhfu(V&7He++qHX-GLL}3z%1sfWuif$pIPbyO zh8DmJ5Qaudi*pO-kZX`0PsYupX*j~G5AEpo|G9Z|qi||PqSZ88%!C!R?XZ^&bI-FJ zP5uKn_W}8v5H1kh)nu`(m}N5L*M9BSPg%!IBVy_iT?^^4P%IjVMZ#K)wqFwyA`>-q zqD0cGJC^C#hHHOyJpJ0Q|8v(|F}~Ep*`e9-$2tFMwK_Mcu`O(9>YV)w{;#E0*AVJx z+~5j>owVbg`_;4j+OPfkKYtx}!d5C0PsI(((M?Bl|KIk@?EAWO>?}Pao`)c@=z0_@C z*S<`@l5~$`^hWtX%s+}HrB-T*LYL&!YE~sjYBkp-`3@1_65J8<2!gD`bNvK(stH}G z0KiR~90R;Wcp4B3FCi$NSR5dNY$5T0tg!Of#(N)h4Q|3dM%&d$Y+XlXvqid?9Mk(nrK_*0-QPk0000< KMNUMnLSTZ`9&y_M From 871f0a49426f2733bf4fcea842dc0fe726497548 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 27 Apr 2016 12:52:33 +1000 Subject: [PATCH 083/439] moved deep analysis into investigate files topic --- ...ysis-windows-advanced-threat-protection.md | 84 ------------------ ...ows-defender-advanced-threat-protection.md | 86 +++++++++++++++++++ 2 files changed, 86 insertions(+), 84 deletions(-) diff --git a/windows/keep-secure/deep-analysis-windows-advanced-threat-protection.md b/windows/keep-secure/deep-analysis-windows-advanced-threat-protection.md index ebb84e186d..3b6cfcde41 100644 --- a/windows/keep-secure/deep-analysis-windows-advanced-threat-protection.md +++ b/windows/keep-secure/deep-analysis-windows-advanced-threat-protection.md @@ -14,87 +14,3 @@ ms.sitesec: library [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -Cyber security investigations are typically triggered by an alert. Alerts are related to one or more observed files that are often new or unknown. Clicking a file takes you to the file view where you can see the file's metadata. To enrich the data related to the file, you can submit the file for deep analysis. - -The deep analysis feature executes a file in a secure, fully instrumented cloud environment. Deep analysis results show the file's activities, observed behaviors, and associated artifacts, such as dropped files, registry modifications, and communication with IPs. -Deep analysis currently supports extensive analysis of PE (portable executable) files (including _.exe_ and _.dll_ files). - -Deep analysis of a file takes several minutes. When the file analysis is complete, results are made available in the File view page, under a new **Deep analysis summary** section. The summary includes a list of observed *behaviors*, some of which can indicate malicious activity, and *observables*, including contacted IPs and files created on the disk. - -Results of deep analysis are matched against threat intelligence and any matches will generate appropriate alerts. - -## Submit files for analysis - -Use the deep analysis feature to investigate the details of any file, usually during an investigation of an alert or for any other reason where you suspect malicious behavior. This feature is available in the context of the file view. - -In the file's page, **Submit for deep analysis** is enabled when the file is available in the Windows Defender ATP backend sample collection or if it was observed on a Windows 10 machine that supports submitting to deep analysis. - -> **Note**  Only files from Windows 10 can be automatically collected. - -You can also manually submit a sample through the [Malware Protection Center Portal](https://www.microsoft.com/en-us/security/portal/submission/submit.aspx) if the file was not observed on a Windows 10 machine, and wait for **Submit for deep analysis** button to become available. - -> **Note**  Due to backend processing flows in the Malware Protection Center Portal, there could be up to 10 minutes of latency between file submission and availability of the deep analysis feature in Windows Defender ATP. - -When the sample is collected, Windows Defender ATP runs the file in is a secure environment and creates a detailed report of observed behaviors and associated artifacts, such as files dropped on machines, communication to IPs, and registry modifications. - -**Submit files for deep analysis:** - -1. Select the file that you want to submit for deep analysis. You can select or search a file from any of the following views: - - Alerts - click the file links from the **Description** or **Details** in the Alert timeline - - **Machines View** - click the file links from the **Description** or **Details** in the **Machine in organization** section - - Search box - select **File** from the drop-down menu and enter the file name -2. In the **Deep analysis** section of the file view, click **Submit**. - -![You can only submit PE files in the file details seciton](images/submit-file.png) - ->**Note**  Only portable executable (PE) files are supported, including _.exe_ and _.dll_ files - -A progress bar is displayed and provides information on the different stages of the analysis. You can then view the report when the analysis is done. - -> **Note**  Depending on machine availability, sample collection time can vary. There is a 1-hour timeout for sample collection. The collection will fail and the operation will abort if there is no online Windows 10 machine reporting at that time. You can re-submit files for deep analysis to get fresh data on the file. - -## View deep analysis report - -View the deep analysis report that Windows Defender ATP provides to see the details of the deep analysis that was conducted on the file you submitted. This feature is available in the file view context. - -You can view the comprehensive report that provides details on: - -- Observed behaviors -- Associated artifacts - -The details provided can help you investigate if there are indications of a potential attack. - -**View deep analysis reports:** - -1. Select the file you submitted for deep analysis. -2. Click **See the report below**. Information on the analysis is displayed. - -![The deep analysis report shows detailed information across a number of categories](images/analysis-results.png) - -## Troubleshooting deep analysis - -If you encounter a problem when trying to submit a file, try each of the following troubleshooting steps. - -**Troubleshoot deep analysis:** - -1. Ensure the file is a PE. PE files typically have _.exe_ or _.dll_ extensions (executable programs or applications). -2. Ensure the service has access to the file, that it still exists, and has not been corrupted or modified. -3. You can wait a short while and try to submit the file again, in case the queue is full or there was a temporary connection or communication error. -4. Verify the policy setting enables sample collection and try to submit the file again. - - a. Change the following registry entry and values to change the policy on specific endpoints: - ``` -HKLM\SOFTWARE\Policies\Microsoft\Sense\AllowSampleCollection - Value = 0 - block sample collection - Value = 1 - allow sample collection -``` -5. Change the organizational unit through the GPO. See [Configure with Group Policy](additional-configuration-windows-advanced-threat-protection.md#configure-with-group-policy). -6. If these steps do not resolve the issue, contact [winatp@microsoft.com](mailto:winatp@microsoft.com). - -> **Note**  If the value *AllowSampleCollection* is not available, the client will allow sample collection by default. - -### Related topics -- [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-advanced-threat-protection.md) -- [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-advanced-threat-protection.md) -- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-advanced-threat-protection.md) -- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-advanced-threat-protection.md) diff --git a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md index 71806ff99b..ec6c9ec1b2 100644 --- a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md @@ -36,3 +36,89 @@ You'll see a list of machines associated with the file and a description of the - Search box - select **File** from the drop-down menu and enter the file name 2. View the file details. 3. Use the search filters to define the search criteria. You can also use the timeline search box to further filter displayed search results. + +##Deep analysis +Cyber security investigations are typically triggered by an alert. Alerts are related to one or more observed files that are often new or unknown. Clicking a file takes you to the file view where you can see the file's metadata. To enrich the data related to the file, you can submit the file for deep analysis. + +The deep analysis feature executes a file in a secure, fully instrumented cloud environment. Deep analysis results show the file's activities, observed behaviors, and associated artifacts, such as dropped files, registry modifications, and communication with IPs. +Deep analysis currently supports extensive analysis of PE (portable executable) files (including _.exe_ and _.dll_ files). + +Deep analysis of a file takes several minutes. When the file analysis is complete, results are made available in the File view page, under a new **Deep analysis summary** section. The summary includes a list of observed *behaviors*, some of which can indicate malicious activity, and *observables*, including contacted IPs and files created on the disk. + +Results of deep analysis are matched against threat intelligence and any matches will generate appropriate alerts. + +## Submit files for analysis + +Use the deep analysis feature to investigate the details of any file, usually during an investigation of an alert or for any other reason where you suspect malicious behavior. This feature is available in the context of the file view. + +In the file's page, **Submit for deep analysis** is enabled when the file is available in the Windows Defender ATP backend sample collection or if it was observed on a Windows 10 machine that supports submitting to deep analysis. + +> **Note**  Only files from Windows 10 can be automatically collected. + +You can also manually submit a sample through the [Malware Protection Center Portal](https://www.microsoft.com/en-us/security/portal/submission/submit.aspx) if the file was not observed on a Windows 10 machine, and wait for **Submit for deep analysis** button to become available. + +> **Note**  Due to backend processing flows in the Malware Protection Center Portal, there could be up to 10 minutes of latency between file submission and availability of the deep analysis feature in Windows Defender ATP. + +When the sample is collected, Windows Defender ATP runs the file in is a secure environment and creates a detailed report of observed behaviors and associated artifacts, such as files dropped on machines, communication to IPs, and registry modifications. + +**Submit files for deep analysis:** + +1. Select the file that you want to submit for deep analysis. You can select or search a file from any of the following views: + - Alerts - click the file links from the **Description** or **Details** in the Alert timeline + - **Machines View** - click the file links from the **Description** or **Details** in the **Machine in organization** section + - Search box - select **File** from the drop-down menu and enter the file name +2. In the **Deep analysis** section of the file view, click **Submit**. + +![You can only submit PE files in the file details seciton](images/submit-file.png) + +>**Note**  Only portable executable (PE) files are supported, including _.exe_ and _.dll_ files + +A progress bar is displayed and provides information on the different stages of the analysis. You can then view the report when the analysis is done. + +> **Note**  Depending on machine availability, sample collection time can vary. There is a 1-hour timeout for sample collection. The collection will fail and the operation will abort if there is no online Windows 10 machine reporting at that time. You can re-submit files for deep analysis to get fresh data on the file. + +## View deep analysis report + +View the deep analysis report that Windows Defender ATP provides to see the details of the deep analysis that was conducted on the file you submitted. This feature is available in the file view context. + +You can view the comprehensive report that provides details on: + +- Observed behaviors +- Associated artifacts + +The details provided can help you investigate if there are indications of a potential attack. + +**View deep analysis reports:** + +1. Select the file you submitted for deep analysis. +2. Click **See the report below**. Information on the analysis is displayed. + +![The deep analysis report shows detailed information across a number of categories](images/analysis-results.png) + +## Troubleshooting deep analysis + +If you encounter a problem when trying to submit a file, try each of the following troubleshooting steps. + +**Troubleshoot deep analysis:** + +1. Ensure the file is a PE. PE files typically have _.exe_ or _.dll_ extensions (executable programs or applications). +2. Ensure the service has access to the file, that it still exists, and has not been corrupted or modified. +3. You can wait a short while and try to submit the file again, in case the queue is full or there was a temporary connection or communication error. +4. Verify the policy setting enables sample collection and try to submit the file again. + + a. Change the following registry entry and values to change the policy on specific endpoints: + ``` +HKLM\SOFTWARE\Policies\Microsoft\Sense\AllowSampleCollection + Value = 0 - block sample collection + Value = 1 - allow sample collection +``` +5. Change the organizational unit through the GPO. See [Configure with Group Policy](additional-configuration-windows-advanced-threat-protection.md#configure-with-group-policy). +6. If these steps do not resolve the issue, contact [winatp@microsoft.com](mailto:winatp@microsoft.com). + +> **Note**  If the value *AllowSampleCollection* is not available, the client will allow sample collection by default. + +### Related topics +- [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-advanced-threat-protection.md) +- [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-advanced-threat-protection.md) +- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-advanced-threat-protection.md) +- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-advanced-threat-protection.md) From 05e8bdb0d45bf4bb6b2aabac67aff0aff3df6a80 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 27 Apr 2016 12:53:56 +1000 Subject: [PATCH 084/439] removed deep analysis file --- windows/keep-secure/TOC.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 54b6b84025..6fbce08e9e 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -417,7 +417,6 @@ ##### [Investigate alerts](investigate-alerts-windows-advanced-threat-protection.md) ##### [Investigate machines](machines-view-windows-advanced-threat-protection.md) ##### [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md) -###### [Submit files to the Deep analysis feature](deep-analysis-windows-advanced-threat-protection.md) ##### [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) ##### [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) ##### [Manage alerts](manage-alerts-windows-advanced-threat-protection.md) From 4fc2e7dcc67b05065ba6c81a93c2ef479938b86c Mon Sep 17 00:00:00 2001 From: jcaparas Date: Wed, 27 Apr 2016 13:07:43 +1000 Subject: [PATCH 085/439] Delete deep-analysis-windows-advanced-threat-protection.md --- ...nalysis-windows-advanced-threat-protection.md | 16 ---------------- 1 file changed, 16 deletions(-) delete mode 100644 windows/keep-secure/deep-analysis-windows-advanced-threat-protection.md diff --git a/windows/keep-secure/deep-analysis-windows-advanced-threat-protection.md b/windows/keep-secure/deep-analysis-windows-advanced-threat-protection.md deleted file mode 100644 index 3b6cfcde41..0000000000 --- a/windows/keep-secure/deep-analysis-windows-advanced-threat-protection.md +++ /dev/null @@ -1,16 +0,0 @@ ---- -title: Submit files to the Windows Defender ATP Deep analysis feature -description: Submit a file to the deep analysis feature to see a detailed report on what the file does, associated artefacts, and changes it makes to machines. -keywords: analysis, deep analysis, analyze, submit, submission, file, malware, threats, infection, executable, report, troubleshoot, sample, sample collection, behaviors, .exe, .dll, .scr -search.product: eADQiWindows 10XVcnh -ms.prod: W10 -ms.mktglfcycl: deploy -ms.sitesec: library ---- - -# Submit files to the Windows Defender ATP Deep analysis feature - -- Windows 10 Insider Preview - -[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] - From 2f064a06fe01a622324dac7eb208c584a7a8a001 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 27 Apr 2016 13:16:50 +1000 Subject: [PATCH 086/439] include DEFENDER in topic names --- ...-configuration-windows-defender-advanced-threat-protection.md} | 0 ...gure-endpoints-windows-defender-advanced-threat-protection.md} | 0 ...tor-onboarding-windows-defender-advanced-threat-protection.md} | 0 ...oard-configure-windows-defender-advanced-threat-protection.md} | 0 ...ice-onboarding-windows-defender-advanced-threat-protection.md} | 0 ...oot-onboarding-windows-defender-advanced-threat-protection.md} | 0 6 files changed, 0 insertions(+), 0 deletions(-) rename windows/keep-secure/{additional-configuration-windows-advanced-threat-protection.md => additional-configuration-windows-defender-advanced-threat-protection.md} (100%) rename windows/keep-secure/{configure-endpoints-windows-advanced-threat-protection.md => configure-endpoints-windows-defender-advanced-threat-protection.md} (100%) rename windows/keep-secure/{monitor-onboarding-windows-advanced-threat-protection.md => monitor-onboarding-windows-defender-advanced-threat-protection.md} (100%) rename windows/keep-secure/{onboard-configure-windows-advanced-threat-protection.md => onboard-configure-windows-defender-advanced-threat-protection.md} (100%) rename windows/keep-secure/{service-onboarding-windows-advanced-threat-protection.md => service-onboarding-windows-defender-advanced-threat-protection.md} (100%) rename windows/keep-secure/{troubleshoot-onboarding-windows-advanced-threat-protection.md => troubleshoot-onboarding-windows-defender-advanced-threat-protection.md} (100%) diff --git a/windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md b/windows/keep-secure/additional-configuration-windows-defender-advanced-threat-protection.md similarity index 100% rename from windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md rename to windows/keep-secure/additional-configuration-windows-defender-advanced-threat-protection.md diff --git a/windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md similarity index 100% rename from windows/keep-secure/configure-endpoints-windows-advanced-threat-protection.md rename to windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md diff --git a/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md b/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md similarity index 100% rename from windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md rename to windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md diff --git a/windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md b/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md similarity index 100% rename from windows/keep-secure/onboard-configure-windows-advanced-threat-protection.md rename to windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md diff --git a/windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md b/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md similarity index 100% rename from windows/keep-secure/service-onboarding-windows-advanced-threat-protection.md rename to windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md similarity index 100% rename from windows/keep-secure/troubleshoot-onboarding-windows-advanced-threat-protection.md rename to windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md From 5d1e07df7d8b666e423714375926a005abd131dc Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 27 Apr 2016 13:25:14 +1000 Subject: [PATCH 087/439] update topic names to include DEFENDER --- windows/keep-secure/TOC.md | 22 +++++++++---------- ...ws-defender-advanced-threat-protection.md} | 0 ...ws-defender-advanced-threat-protection.md} | 0 ...ws-defender-advanced-threat-protection.md} | 0 ...ws-defender-advanced-threat-protection.md} | 0 5 files changed, 11 insertions(+), 11 deletions(-) rename windows/keep-secure/{alerts-queue-windows-advanced-threat-protection.md => alerts-queue-windows-defender-advanced-threat-protection.md} (100%) rename windows/keep-secure/{investigate-alerts-windows-advanced-threat-protection.md => investigate-alerts-windows-defender-advanced-threat-protection.md} (100%) rename windows/keep-secure/{machines-view-windows-advanced-threat-protection.md => machines-view-windows-defender-advanced-threat-protection.md} (100%) rename windows/keep-secure/{manage-alerts-windows-advanced-threat-protection.md => manage-alerts-windows-defender-advanced-threat-protection.md} (100%) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 6fbce08e9e..9821c33c1a 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -403,23 +403,23 @@ #### [User Account Control security policy settings](user-account-control-security-policy-settings.md) ### [Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md) #### [Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md) -#### [Onboard endpoints and set up access](onboard-configure-windows-advanced-threat-protection.md) -##### [Service onboarding](service-onboarding-windows-advanced-threat-protection.md) -##### [Configure endpoints](configure-endpoints-windows-advanced-threat-protection.md) -##### [Additional configuration settings](additional-configuration-windows-advanced-threat-protection.md) -##### [Monitor onboarding](monitor-onboarding-windows-advanced-threat-protection.md) -##### [Troubleshoot onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) +#### [Onboard endpoints and set up access](onboard-configure-windows-defender-advanced-threat-protection.md) +##### [Service onboarding](service-onboarding-windows-defender-advanced-threat-protection.md) +##### [Configure endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +##### [Additional configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md) +##### [Monitor onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) +##### [Troubleshoot onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) #### [Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) #### [Portal overview](portal-overview-windows-defender-advanced-threat-protection.md) #### [Use the Windows Defender ATP portal](use-windows-defender-advanced-threat-protection.md) -##### [View the Dashboard](dashboard-windows-advanced-threat-protection.md) -##### [View and organize the Alerts queue](alerts-queue-windows-advanced-threat-protection.md) -##### [Investigate alerts](investigate-alerts-windows-advanced-threat-protection.md) -##### [Investigate machines](machines-view-windows-advanced-threat-protection.md) +##### [View the Dashboard](dashboard-windows-defender-advanced-threat-protection.md) +##### [View and organize the Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) +##### [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) +##### [Investigate machines](machines-view-windows-defender-advanced-threat-protection.md) ##### [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md) ##### [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) ##### [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) -##### [Manage alerts](manage-alerts-windows-advanced-threat-protection.md) +##### [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md) #### [Windows Defender ATP settings](settings-windows-defender-advanced-threat-protection.md) #### [Troubleshoot Windows Defender ATP](troubleshoot-windows-defender-advanced-threat-protection.md) ### [Windows Defender in Windows 10](windows-defender-in-windows-10.md) diff --git a/windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md b/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md similarity index 100% rename from windows/keep-secure/alerts-queue-windows-advanced-threat-protection.md rename to windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md diff --git a/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md similarity index 100% rename from windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md rename to windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md diff --git a/windows/keep-secure/machines-view-windows-advanced-threat-protection.md b/windows/keep-secure/machines-view-windows-defender-advanced-threat-protection.md similarity index 100% rename from windows/keep-secure/machines-view-windows-advanced-threat-protection.md rename to windows/keep-secure/machines-view-windows-defender-advanced-threat-protection.md diff --git a/windows/keep-secure/manage-alerts-windows-advanced-threat-protection.md b/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md similarity index 100% rename from windows/keep-secure/manage-alerts-windows-advanced-threat-protection.md rename to windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md From 1f892bf566a6ba9f00069f58ca769ccb10fab1b8 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 27 Apr 2016 13:33:44 +1000 Subject: [PATCH 088/439] fix related topics links fix related topics links --- ...-windows-defender-advanced-threat-protection.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/keep-secure/additional-configuration-windows-defender-advanced-threat-protection.md b/windows/keep-secure/additional-configuration-windows-defender-advanced-threat-protection.md index 03ea882d31..f8ee0d9239 100644 --- a/windows/keep-secure/additional-configuration-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/additional-configuration-windows-defender-advanced-threat-protection.md @@ -1,8 +1,8 @@ --- title: Additional Windows Defender ATP configuration settings description: Use the Group Policy Console to configure settings that enable sample sharing from your endpoints. These settings are used in the deep analysis feature. -keywords: configuration settings, Windows Defender ATP configuration settings, Windows Defender Advanced Threat Protection configuration settings, group policy Management Editor, computer configuration, policies, administrative templates, -search.product: eADQiWindows 10XVcnh +keywords: configuration settings, Windows Defender ATP configuration settings, Windows Defender Advanced Threat Protection configuration settings, group policy Management Editor, computer configuration, policies, administrative templates, +search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library @@ -24,7 +24,7 @@ You can use Group Policy (GP) to configure settings, such as settings for the sa configuration package: a. Copy _AtpConfiguration.admx_ into _C:\\Windows\\PolicyDefinitions_ - + b. Copy _AtpConfiguration.adml_ into _C:\\Windows\\PolicyDefinitions\\en-US_ 2. Open the [Group Policy Management Console](https://technet.microsoft.com/en-us/library/cc731212.aspx), right-click the GPO you want to configure and click **Edit**. @@ -38,7 +38,7 @@ You can use Group Policy (GP) to configure settings, such as settings for the sa 6. Choose to enable or disable sample sharing from your endpoints. ## Related topics -- [Windows Defender ATP service onboarding](service-onboarding-windows-advanced-threat-protection.md) -- [Configure Windows Defender ATP endpoints](configure-endpoints-windows-advanced-threat-protection.md) -- [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-advanced-threat-protection.md) -- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) +- [Windows Defender ATP service onboarding](service-onboarding-windows-defender-advanced-threat-protection.md) +- [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +- [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) +- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) From d2b7e5250c2c5839c9637a96de053bd5251d7bee Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 27 Apr 2016 13:52:26 +1000 Subject: [PATCH 089/439] fix broken links --- ...ows-defender-advanced-threat-protection.md | 15 ++-- ...ows-defender-advanced-threat-protection.md | 26 +++--- ...oard-windows-advanced-threat-protection.md | 33 ++++---- ...ows-defender-advanced-threat-protection.md | 34 ++++---- ...ows-defender-advanced-threat-protection.md | 15 ++-- ...ows-defender-advanced-threat-protection.md | 60 +++++++------- ...ows-defender-advanced-threat-protection.md | 83 +++++++++---------- ...ows-defender-advanced-threat-protection.md | 37 ++++----- ...ows-defender-advanced-threat-protection.md | 36 ++++---- ...ows-defender-advanced-threat-protection.md | 28 +++---- ...ows-defender-advanced-threat-protection.md | 52 ++++++------ ...ows-defender-advanced-threat-protection.md | 2 +- ...ows-defender-advanced-threat-protection.md | 20 ++--- ...ows-defender-advanced-threat-protection.md | 8 +- 14 files changed, 221 insertions(+), 228 deletions(-) diff --git a/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md b/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md index e18a0ba7b2..8f946e7ade 100644 --- a/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md @@ -2,7 +2,7 @@ title: View and organize the Windows Defender ATP Alerts queue description: Learn about how the Windows Defender ATP alerts queue work, and how to sort and filter lists of alerts. keywords: alerts, queues, alerts queue, sort, order, filter, manage alerts, new, in progress, resolved, newest, time in queue, severity, time period -search.product: eADQiWindows 10XVcnh +search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library @@ -37,7 +37,7 @@ There are three mechanisms to pivot the queue against: 1. Sort the queue by opening the drop-down menu in the **Sort by** field and choosing: - - **Newest** - Sorts alerts based on when the alert was last seen on an endpoint. + - **Newest** - Sorts alerts based on when the alert was last seen on an endpoint. - **Time in queue** - Sorts alerts by the length of time an alert has been in the queue. - **Severity** - Sorts alerts by their level of severity. @@ -56,10 +56,9 @@ There are three mechanisms to pivot the queue against: - **6 months** > **Note**  You can change the sort order (for example, from most recent to least recent) by clicking the sort order icon ![the sort order icon looks like two arrows on top of each other](images/sort-order-icon.png) - + ### Related topics - -- [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-advanced-threat-protection.md) -- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-advanced-threat-protection.md) -- [Submit files to the Windows Defender ATP Deep analysis feature](deep-analysis-windows-advanced-threat-protection.md) -- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-advanced-threat-protection.md) + +- [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) +- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-defender-advanced-threat-protection.md) +- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md index 68c3ac1e2a..49fde778c1 100644 --- a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md @@ -2,7 +2,7 @@ title: Configure Windows Defender ATP endpoints description: Use Group Policy to deploy the configuration package or do manual registry changes on endpoints so that they are onboarded to the service. keywords: configure endpoints, client onboarding, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints -search.product: eADQiWindows 10XVcnh +search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library @@ -22,7 +22,7 @@ You can use a Group Policy (GP) configuration package or an automated script to 1. Open the SCCM configuration package .zip file (*WindowsATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://seville.windows.com): Naama: Confirm package name a. Click **Client onboarding** on the **Navigation pane**. - + b. Select **SCCM**, click **Download package**, and save the .zip file. Iaan: Need to confirm the UI for this 2. Copy the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. @@ -46,9 +46,9 @@ Using the GP configuration package ensures your endpoints will be correctly conf 1. Open the GP configuration package .zip file (*WindowsATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://seville.windows.com): a. Click **Client onboarding** on the **Navigation pane**. - + b. Select **GP**, click **Download package** and save the .zip file. - + 2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the endpoints. You should have a folder called _*OptionalParamsPolicy*_ and the file _*WindowsATPOnboardingPackage.cmd*_. 3. Open the [Group Policy Management Console](https://technet.microsoft.com/en-us/library/cc731212.aspx) (GPMC), right-click the Group Policy Object (GPO) you want to configure and click **Edit**. @@ -65,9 +65,9 @@ Using the GP configuration package ensures your endpoints will be correctly conf 9. Click **OK** and close any open GPMC windows. -For additional settings, see the [Additional configuration settings section](additional-configuration-windows-advanced-threat-protection.md). +For additional settings, see the [Additional configuration settings section](additional-configuration-windows-defender-advanced-threat-protection.md). -## Configure endpoints manually with registry changes +## Configure endpoints manually with registry changes You can also manually onboard individual endpoints to Windows Defender ATP. You might want to do this first when testing the service before you commit to onboarding all endpoints in your network. 1. Extract the contents of the configuration package to a location on @@ -77,9 +77,9 @@ You can also manually onboard individual endpoints to Windows Defender ATP. You script: a. Click **Start** and type **cmd**. - + b. Right-click **Command prompt** and select **Run as administrator**. - + ![Window Start menu pointing to Run as administrator](images/run-as-admin.png) 3. Type the location of the script file. If you copied the file the @@ -87,10 +87,10 @@ You can also manually onboard individual endpoints to Windows Defender ATP. You 4. Press the **Enter** key or click **OK**. -See the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) topic for details on how you can manually validate that the endpoint is compliant and correctly reports telemetry. +See the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) topic for details on how you can manually validate that the endpoint is compliant and correctly reports telemetry. ## Related topics -- [Windows Defender ATP service onboarding](service-onboarding-windows-advanced-threat-protection.md) -- [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-advanced-threat-protection.md) -- [Additional Windows Defender ATP configuration settings](additional-configuration-windows-advanced-threat-protection.md) -- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) +- [Windows Defender ATP service onboarding](service-onboarding-windows-defender-advanced-threat-protection.md) +- [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) +- [Additional Windows Defender ATP configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md) +- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/dashboard-windows-advanced-threat-protection.md b/windows/keep-secure/dashboard-windows-advanced-threat-protection.md index 4d1a0d3572..ba9023b993 100644 --- a/windows/keep-secure/dashboard-windows-advanced-threat-protection.md +++ b/windows/keep-secure/dashboard-windows-advanced-threat-protection.md @@ -1,14 +1,14 @@ --- -title: View the Windows Defender Advanced Threat Protection Dashboard +title: View the Windows Defender Advanced Threat Protection Dashboard description: Use the Dashboard to identify machines at risk, keep track of the status of the service, and see statistics and information about machines and alerts. keywords: dashboard, alerts, new, in progress, resolved, risk, machines at risk, infections, reporting, statistics, charts, graphs, health, active malware detections, threat category, categories, password stealer, ransomware, exploit, threat, low severity, active malware -search.product: eADQiWindows 10XVcnh +search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library --- -# View the Windows Defender Advanced Threat Protection Dashboard +# View the Windows Defender Advanced Threat Protection Dashboard - Windows 10 Insider Preview @@ -17,7 +17,7 @@ ms.sitesec: library The **Dashboard** displays a snapshot of: - The latest active alerts on your network -- Machines reporting +- Machines reporting - Top machines with active alerts - The overall status of Windows Defender ATP for the past 30 days - Machines with active malware detections @@ -29,24 +29,24 @@ From the **Dashboard** you will see aggregated events to facilitate the identifi It also has clickable tiles that give visual cues on the overall health status of your organization. Each tile opens a detailed view of the corresponding overview. ## ATP alerts -You can view the overall number of active ATP alerts from the last 30 days in your network from the **ATP alerts** tile. Alerts are grouped into **New** and **In progress**. +You can view the overall number of active ATP alerts from the last 30 days in your network from the **ATP alerts** tile. Alerts are grouped into **New** and **In progress**. ![Click on each slice or severity to see a list of alerts from the past 30 days](images/atp.png) -Each group is further sub-categorized into their corresponding alert severity levels. Click the number of alerts inside each alert ring to see a sorted view of that category's queue (**New** or **In progress**). +Each group is further sub-categorized into their corresponding alert severity levels. Click the number of alerts inside each alert ring to see a sorted view of that category's queue (**New** or **In progress**). -See the [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-advanced-threat-protection.md) topic for more information. +See the [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) topic for more information. -The **Latest ATP alerts** section includes the latest active alerts in your network. Each row includes an alert severity category and a short description of the alert. Click an alert to see its detailed view, or **Alerts queue** at the top of the list to go directly to the Alerts queue. See the [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-advanced-threat-protection.md) and [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-advanced-threat-protection.md) topics for more information. +The **Latest ATP alerts** section includes the latest active alerts in your network. Each row includes an alert severity category and a short description of the alert. Click an alert to see its detailed view, or **Alerts queue** at the top of the list to go directly to the Alerts queue. See the [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) and [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) topics for more information. ## Machines at risk This tile shows you a list of machines with the highest number of active alerts. The total number of alerts for each machine is shown in a circle next to the machine name, and then further categorized by severity levels at the far end of the tile (hover over each severity bar to its label). ![The Machines at risk tile shows a list of machines with the highest number of alerts, and a breakdown of the severity of the alerts](images/machines-at-risk.png) -Click the name of the machine to see details about that machine. See the [Investigate Windows Defender ATP alerts](investigate-alerts-windows-advanced-threat-protection.md#investigate-a-machine) topic for more information. +Click the name of the machine to see details about that machine. See the [Investigate Windows Defender ATP alerts](investigate-alerts-windows-defender-advanced-threat-protection.md#investigate-a-machine) topic for more information. -You can also click **Machines view** at the top of the tile to go directly to the **Machines view**, sorted by the number of active alerts. See the [Investigate machines in the Windows Defender Advanced Threat Protection Machines view](machines-view-windows-advanced-threat-protection.md) topic for more information. +You can also click **Machines view** at the top of the tile to go directly to the **Machines view**, sorted by the number of active alerts. See the [Investigate machines in the Windows Defender Advanced Threat Protection Machines view](machines-view-windows-defender-advanced-threat-protection.md) topic for more information. ## Status The **Status** tile informs you if the service is active and running and the specific number of machines (endpoints) reporting to Windows Defender ATP. @@ -54,11 +54,11 @@ The **Status** tile informs you if the service is active and running and the spe ![The Status tile shows an overall indicator of the service and the total number of machines reporting to the service](images/status-tile.png) ## Machines reporting -The **Machines reporting** tile shows a bar graph that represents the number of machines reporting alerts daily. Hover over individual bars on the graph to see the exact number of machines reporting in each day. +The **Machines reporting** tile shows a bar graph that represents the number of machines reporting alerts daily. Hover over individual bars on the graph to see the exact number of machines reporting in each day. ![The Machines reporting tile shows the number of machines reporting each day for the past 30 days](images/machines-reporting-tile.png) -## Machines with active malware detections +## Machines with active malware detections The **Active malware** tile will only appear if your endpoints are using Windows Defender. Active malware is defined as threats that are actively executing at the time of detection. @@ -77,12 +77,11 @@ The chart is sorted into five categories: Threats are considered "active" if there is a very high probability that the malware was executing on your network, as opposed to statically located on-disk. -Clicking on any of these categories will navigate to the [Machines view](machines-view-windows-advanced-threat-protection.md), filtered by the appropriate category. This lets you see a detailed breakdown of which machines have active malware detections, and how many threats were detected per machine. +Clicking on any of these categories will navigate to the [Machines view](machines-view-windows-defender-advanced-threat-protection.md), filtered by the appropriate category. This lets you see a detailed breakdown of which machines have active malware detections, and how many threats were detected per machine. > **Note**  The **Active malware** tile will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/en-us/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product. ### Related topics -- [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-advanced-threat-protection.md) -- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-advanced-threat-protection.md) -- [Submit files to the Windows Defender ATP Deep analysis feature](deep-analysis-windows-advanced-threat-protection.md) -- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-advanced-threat-protection.md) +- [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) +- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-defender-advanced-threat-protection.md) +- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md index 7c69a1bfc1..f011efc8fc 100644 --- a/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md @@ -1,15 +1,15 @@ --- -title: Windows Defender ATP data storage and privacy +title: Windows Defender ATP data storage and privacy description: Learn about how Windows Defender ATP handles privacy and data that it collects. keywords: Windows Defender ATP data storage and privacy, storage, privacy -search.product: eADQiWindows 10XVcnh +search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library -author: DulceMV +author: DulceMV --- -# Windows Defender ATP data storage and privacy +# Windows Defender ATP data storage and privacy - Windows 10 Insider Preview @@ -23,18 +23,18 @@ Microsoft will collect and store information from your configured endpoints in a Information collected includes code file data (such as file names, sizes, and hashes), process data (running processes, hashes), registry data, network connection data (host IPs and ports), and machine details (such as GUIDs, names, and the operating system version). -Microsoft stores this data in a Microsoft Azure security-specific data store, and maintains it in accordance with Microsoft privacy practices and [Microsoft Trust Center policies](https://azure.microsoft.com/en-us/support/trust-center/). +Microsoft stores this data in a Microsoft Azure security-specific data store, and maintains it in accordance with Microsoft privacy practices and [Microsoft Trust Center policies](https://azure.microsoft.com/en-us/support/trust-center/). -Microsoft uses this data to: -- Proactively identify indicators of attack (IOAs) in your organization +Microsoft uses this data to: +- Proactively identify indicators of attack (IOAs) in your organization - Generate alerts if a possible attack was detected -- Provide your security operations with a view into machines, files, and URLs related to threat signals from your network, enabling you to investigate and explore the presence of security threats on the network. +- Provide your security operations with a view into machines, files, and URLs related to threat signals from your network, enabling you to investigate and explore the presence of security threats on the network. We do not mine your data for advertising or for any other purpose other than providing you the service. ## Do I have the flexibility to select where to store my data? -Yes. Data for this new service is stored in Microsoft Azure datacenters in the United States and European Union based on the geolocation properties you specify when you onboard to the service. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations in which your data will reside. Microsoft will not transfer the data from the specified geolocation except in specific circumstances during the TAP stage (see the question [Is there a difference between how you handle data for the TAP program and for General Availability?](#Is-there-a-difference-between-how-Microsoft-handles-data-for-the-TAP-program-and-foR-General-Availability?). If you have concerns about storage of data in a particular country, please contact [winatp@microsoft.com](mailto:winatp@microsoft.com). +Yes. Data for this new service is stored in Microsoft Azure datacenters in the United States and European Union based on the geolocation properties you specify when you onboard to the service. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations in which your data will reside. Microsoft will not transfer the data from the specified geolocation except in specific circumstances during the TAP stage (see the question [Is there a difference between how you handle data for the TAP program and for General Availability?](#Is-there-a-difference-between-how-Microsoft-handles-data-for-the-TAP-program-and-for-General-Availability?). If you have concerns about storage of data in a particular country, please contact [winatp@microsoft.com](mailto:winatp@microsoft.com). ## Is my data isolated from other customer data? Yes. The new cloud service provides appropriate segregation at a number of levels, such as isolation of files, configurations, and telemetry data. Aside from data access authentication, simply keeping different data appropriately segregated provides well-recognized protection. @@ -43,28 +43,28 @@ Yes. The new cloud service provides appropriate segregation at a number of level Microsoft developers and administrators have, by design, been given sufficient privileges to carry out their assigned duties to operate and evolve the service. Microsoft deploys combinations of preventive, detective, and reactive controls including the following mechanisms to help protect against unauthorized developer and/or administrative activity: -- Tight access control to sensitive data -- Combinations of controls that greatly enhance independent detection of malicious activity -- Multiple levels of monitoring, logging, and reporting +- Tight access control to sensitive data +- Combinations of controls that greatly enhance independent detection of malicious activity +- Multiple levels of monitoring, logging, and reporting -Additionally, Microsoft conducts background verification checks of certain operations personnel, and limits access to applications, systems, and network infrastructure in proportion to the level of background verification. Operations personnel follow a formal process when they are required to access a customer’s account or related information in the performance of their duties. +Additionally, Microsoft conducts background verification checks of certain operations personnel, and limits access to applications, systems, and network infrastructure in proportion to the level of background verification. Operations personnel follow a formal process when they are required to access a customer’s account or related information in the performance of their duties. ## Is data shared with other customers? No. Customer data is isolated from other customers and is not shared. However, insights on the data resulting from Microsoft processing (for example, deep file analysis processing), and which don’t contain any customer specific data, might be shared with other customers. Each customer can only access data collected from its own organization and generic data that Microsoft provides. ## How long will Microsoft store my data? What is Microsoft’s data retention policy? -Your data privacy is one of our key commitments for the cloud. For this service, at contract termination or expiration, your data will be erased from Microsoft’s systems to make it unrecoverable after 90 days from contract termination or expiration. +Your data privacy is one of our key commitments for the cloud. For this service, at contract termination or expiration, your data will be erased from Microsoft’s systems to make it unrecoverable after 90 days from contract termination or expiration. ## Can you help us maintain regulatory compliance? -By providing customers with compliant, independently-verified services, Microsoft makes it easier for customers to achieve compliance for the infrastructure and applications they run, including this new Microsoft cloud service. +By providing customers with compliant, independently-verified services, Microsoft makes it easier for customers to achieve compliance for the infrastructure and applications they run, including this new Microsoft cloud service. Microsoft provides customers with detailed information about our security and compliance programs, including audit reports and compliance packages, to help customers assess our services against their own legal and regulatory requirements. Windows Defender ATP has a roadmap for obtaining national, regional and industry-specific certifications, starting with ISO 27001. The service is designed, implemented, and maintained according to the compliance and privacy principles of ISO 27001, as well as Microsoft’s compliance standards. ## Is there a difference between how Microsoft handles data for the TAP program and for General Availability? When you onboard your service during TAP, you will be asked to choose to store your data in a datacenter either in Europe or United States. Your data will not be copied or moved outside of the datacenter you choose, except in the following specific circumstance: 1. You choose Europe as your datacenter, and -2. You [submit a file for deep analysis](deep-analysis-windows-advanced-threat-protection.md). +2. You [submit a file for deep analysis](submit-files-for-analysis#investigate-files-windows-defender-advanced-threat-protection.md). In this circumstance, the submitted file will be sent to the US deep analysis laboratory. The results of the analysis will be stored in the European datacenter, and the file and data will be deleted from the US deep analysis laboratory and datacenter. - + This is a temporary measure as we work to integrate our deep analysis capabilities into the European datacenter. If you have any concerns or questions about submitting files for deep analysis and you are using a European datacenter, or if you’d like to be updated as to when the European deep analysis lab is online, email [winatp@microsoft.com](mailto:winatp@microsoft.com). diff --git a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md index f3f1f34a18..038aba1c10 100644 --- a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md @@ -2,7 +2,7 @@ title: Investigate Windows Defender Advanced Threat Protection alerts description: Use the investigation options to get details on which alerts are affecting your network, what they mean, and how to resolve them. keywords: investigate, investigation, machines, machine, endpoints, endpoint, alerts queue, dashboard, IP address, file, submit, submissions, deep analysis, timeline, search, domain, URL, IP -search.product: eADQiWindows 10XVcnh +search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library @@ -14,7 +14,7 @@ ms.sitesec: library [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -Alerts in Windows Defender ATP indicate possible security breaches on endpoints in your organization. +Alerts in Windows Defender ATP indicate possible security breaches on endpoints in your organization. There are three alert severity levels, described in the following table. @@ -26,13 +26,13 @@ Low (Yellow) | Threats associated with prevalent malware and hack-tools that pos Reviewing the various alerts and their severity can help you take the appropriate action to protect your organization's endpoints. -Alerts are organized in three queues, by their workflow status: +Alerts are organized in three queues, by their workflow status: - **New** - **In progress** - **Resolved** -You can investigate alerts by clicking an alert in [any of the alert queues](alerts-queue-windows-advanced-threat-protection.md). +You can investigate alerts by clicking an alert in [any of the alert queues](alerts-queue-windows-defender-advanced-threat-protection.md). Details about the alert is displayed such as: - Alert information such as when it was last observed @@ -46,7 +46,6 @@ Details about the alert is displayed such as: Depending on the type of alert, you click on the name to see a detailed report about the threat. You'll see information such as a brief introduction of the threat, its interests, tools, tactics, and processes, and the areas it affects worldwide. ### Related topics -- [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-advanced-threat-protection.md) -- [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-advanced-threat-protection.md) -- [Submit files to the Windows Defender ATP Deep analysis feature](deep-analysis-windows-advanced-threat-protection.md) -- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-advanced-threat-protection.md) +- [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) +- [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) +- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md index ec6c9ec1b2..a0262abad7 100644 --- a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md @@ -2,14 +2,14 @@ title: Investigate Windows Defender Advanced Threat Protection files description: Use the investigation options to get details on files associated with alerts, behaviours, or events. keywords: investigate, investigation, files, malicious activity, attack motivation -search.product: eADQiWindows 10XVcnh +search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: mjcaparas --- # Investigate a file -Investigate the details of a file associated with a specific alert, behavior, or event to help determine if the file exhibits malicious activities, identify the attack motivation, and understand the potential scope of the breach. +Investigate the details of a file associated with a specific alert, behavior, or event to help determine if the file exhibits malicious activities, identify the attack motivation, and understand the potential scope of the breach. You can get information from the following sections in the file view: @@ -22,9 +22,9 @@ The file details section shows attributes of the file such as its MD5 hash or nu The **Deep analysis** section provides the option of submitting a file for deep analysis to gain detailed visibility on observed suspicious behaviors, and associated artifacts. For more information on submitting files for deep analysis, see the **Deep analysis** topic. -The **File in organization** section provides details on the prevalence of the file and the name observed in the organization. +The **File in organization** section provides details on the prevalence of the file and the name observed in the organization. -The **Observed in organization** section provides a chronological view on the events and associated alerts that were observed on the file. +The **Observed in organization** section provides a chronological view on the events and associated alerts that were observed on the file. You'll see a list of machines associated with the file and a description of the action taken by the file. @@ -32,30 +32,30 @@ You'll see a list of machines associated with the file and a description of the 1. Select the file you want to investigate. You can select a file from any of the following views or use the Search box: - Alerts - click the file links from the **Description** or **Details** in the Alert timeline - - Machines view - click the file links in the **Description** or **Details** columns in the **Observed on machine** section - - Search box - select **File** from the drop-down menu and enter the file name + - Machines view - click the file links in the **Description** or **Details** columns in the **Observed on machine** section + - Search box - select **File** from the drop-down menu and enter the file name 2. View the file details. 3. Use the search filters to define the search criteria. You can also use the timeline search box to further filter displayed search results. ##Deep analysis -Cyber security investigations are typically triggered by an alert. Alerts are related to one or more observed files that are often new or unknown. Clicking a file takes you to the file view where you can see the file's metadata. To enrich the data related to the file, you can submit the file for deep analysis. +Cyber security investigations are typically triggered by an alert. Alerts are related to one or more observed files that are often new or unknown. Clicking a file takes you to the file view where you can see the file's metadata. To enrich the data related to the file, you can submit the file for deep analysis. -The deep analysis feature executes a file in a secure, fully instrumented cloud environment. Deep analysis results show the file's activities, observed behaviors, and associated artifacts, such as dropped files, registry modifications, and communication with IPs. -Deep analysis currently supports extensive analysis of PE (portable executable) files (including _.exe_ and _.dll_ files). +The deep analysis feature executes a file in a secure, fully instrumented cloud environment. Deep analysis results show the file's activities, observed behaviors, and associated artifacts, such as dropped files, registry modifications, and communication with IPs. +Deep analysis currently supports extensive analysis of PE (portable executable) files (including _.exe_ and _.dll_ files). Deep analysis of a file takes several minutes. When the file analysis is complete, results are made available in the File view page, under a new **Deep analysis summary** section. The summary includes a list of observed *behaviors*, some of which can indicate malicious activity, and *observables*, including contacted IPs and files created on the disk. -Results of deep analysis are matched against threat intelligence and any matches will generate appropriate alerts. +Results of deep analysis are matched against threat intelligence and any matches will generate appropriate alerts. ## Submit files for analysis -Use the deep analysis feature to investigate the details of any file, usually during an investigation of an alert or for any other reason where you suspect malicious behavior. This feature is available in the context of the file view. +Use the deep analysis feature to investigate the details of any file, usually during an investigation of an alert or for any other reason where you suspect malicious behavior. This feature is available in the context of the file view. -In the file's page, **Submit for deep analysis** is enabled when the file is available in the Windows Defender ATP backend sample collection or if it was observed on a Windows 10 machine that supports submitting to deep analysis. +In the file's page, **Submit for deep analysis** is enabled when the file is available in the Windows Defender ATP backend sample collection or if it was observed on a Windows 10 machine that supports submitting to deep analysis. > **Note**  Only files from Windows 10 can be automatically collected. -You can also manually submit a sample through the [Malware Protection Center Portal](https://www.microsoft.com/en-us/security/portal/submission/submit.aspx) if the file was not observed on a Windows 10 machine, and wait for **Submit for deep analysis** button to become available. +You can also manually submit a sample through the [Malware Protection Center Portal](https://www.microsoft.com/en-us/security/portal/submission/submit.aspx) if the file was not observed on a Windows 10 machine, and wait for **Submit for deep analysis** button to become available. > **Note**  Due to backend processing flows in the Malware Protection Center Portal, there could be up to 10 minutes of latency between file submission and availability of the deep analysis feature in Windows Defender ATP. @@ -63,30 +63,30 @@ When the sample is collected, Windows Defender ATP runs the file in is a secure **Submit files for deep analysis:** -1. Select the file that you want to submit for deep analysis. You can select or search a file from any of the following views: - - Alerts - click the file links from the **Description** or **Details** in the Alert timeline - - **Machines View** - click the file links from the **Description** or **Details** in the **Machine in organization** section - - Search box - select **File** from the drop-down menu and enter the file name -2. In the **Deep analysis** section of the file view, click **Submit**. +1. Select the file that you want to submit for deep analysis. You can select or search a file from any of the following views: + - Alerts - click the file links from the **Description** or **Details** in the Alert timeline + - **Machines View** - click the file links from the **Description** or **Details** in the **Machine in organization** section + - Search box - select **File** from the drop-down menu and enter the file name +2. In the **Deep analysis** section of the file view, click **Submit**. ![You can only submit PE files in the file details seciton](images/submit-file.png) >**Note**  Only portable executable (PE) files are supported, including _.exe_ and _.dll_ files -A progress bar is displayed and provides information on the different stages of the analysis. You can then view the report when the analysis is done. +A progress bar is displayed and provides information on the different stages of the analysis. You can then view the report when the analysis is done. -> **Note**  Depending on machine availability, sample collection time can vary. There is a 1-hour timeout for sample collection. The collection will fail and the operation will abort if there is no online Windows 10 machine reporting at that time. You can re-submit files for deep analysis to get fresh data on the file. +> **Note**  Depending on machine availability, sample collection time can vary. There is a 1-hour timeout for sample collection. The collection will fail and the operation will abort if there is no online Windows 10 machine reporting at that time. You can re-submit files for deep analysis to get fresh data on the file. ## View deep analysis report -View the deep analysis report that Windows Defender ATP provides to see the details of the deep analysis that was conducted on the file you submitted. This feature is available in the file view context. +View the deep analysis report that Windows Defender ATP provides to see the details of the deep analysis that was conducted on the file you submitted. This feature is available in the file view context. -You can view the comprehensive report that provides details on: +You can view the comprehensive report that provides details on: - Observed behaviors - Associated artifacts -The details provided can help you investigate if there are indications of a potential attack. +The details provided can help you investigate if there are indications of a potential attack. **View deep analysis reports:** @@ -97,7 +97,7 @@ The details provided can help you investigate if there are indications of a pote ## Troubleshooting deep analysis -If you encounter a problem when trying to submit a file, try each of the following troubleshooting steps. +If you encounter a problem when trying to submit a file, try each of the following troubleshooting steps. **Troubleshoot deep analysis:** @@ -112,13 +112,13 @@ HKLM\SOFTWARE\Policies\Microsoft\Sense\AllowSampleCollection Value = 0 - block sample collection Value = 1 - allow sample collection ``` -5. Change the organizational unit through the GPO. See [Configure with Group Policy](additional-configuration-windows-advanced-threat-protection.md#configure-with-group-policy). +5. Change the organizational unit through the GPO. See [Configure with Group Policy](additional-configuration-windows-defender-advanced-threat-protection.md#configure-with-group-policy). 6. If these steps do not resolve the issue, contact [winatp@microsoft.com](mailto:winatp@microsoft.com). -> **Note**  If the value *AllowSampleCollection* is not available, the client will allow sample collection by default. +> **Note**  If the value *AllowSampleCollection* is not available, the client will allow sample collection by default. ### Related topics -- [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-advanced-threat-protection.md) -- [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-advanced-threat-protection.md) -- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-advanced-threat-protection.md) -- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-advanced-threat-protection.md) +- [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) +- [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) +- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-defender-advanced-threat-protection.md) +- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/machines-view-windows-defender-advanced-threat-protection.md b/windows/keep-secure/machines-view-windows-defender-advanced-threat-protection.md index ae40fd30f4..929a731f17 100644 --- a/windows/keep-secure/machines-view-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/machines-view-windows-defender-advanced-threat-protection.md @@ -2,7 +2,7 @@ title: Investigate machines in the Windows Defender ATP Machines view description: Investigate affected machines in your network by reviewing alerts, network connection information, and service health on the Machines view. keywords: machines, endpoints, machine, endpoint, alerts queue, alerts, machine name, domain, last seen, internal IP, active alerts, active malware detections, threat category, filter, sort, review alerts, network, connection, malware, type, password stealer, ransomware, exploit, threat, low severity -search.product: eADQiWindows 10XVcnh +search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library @@ -14,45 +14,45 @@ ms.sitesec: library [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -The **Machines view** shows a list of the machines in your network, the corresponding number of active alerts for each machine categorized by alert severity levels, and the number of active malware detections. This view allows you to identify machines with the highest risk at a glance, and keep track of all the machines that are reporting telemetry in your network. +The **Machines view** shows a list of the machines in your network, the corresponding number of active alerts for each machine categorized by alert severity levels, and the number of active malware detections. This view allows you to identify machines with the highest risk at a glance, and keep track of all the machines that are reporting telemetry in your network. -Use the Machines view in these two main scenarios: +Use the Machines view in these two main scenarios: - **During onboarding** - - During the onboarding process, the Machines view gradually gets populated with endpoints as they begin to report telemetry. Use this view to track your onboarded endpoints as they appear. Use the available features to sort and filer to see which endpoints have most recently reported telemetry, or download the complete endpoint list as a CSV file for offline analysis. + - During the onboarding process, the Machines view gradually gets populated with endpoints as they begin to report telemetry. Use this view to track your onboarded endpoints as they appear. Use the available features to sort and filer to see which endpoints have most recently reported telemetry, or download the complete endpoint list as a CSV file for offline analysis. - **Day-to-day work** - - The **Machines view** enables you to identify machines that are most at risk in a glance. High-risk machines are those with the greatest number and highest-severity alerts. By sorting the machines by risk, you'll be able to identify the most vulnerable machines and take action on them. + - The **Machines view** enables you to identify machines that are most at risk in a glance. High-risk machines are those with the greatest number and highest-severity alerts. By sorting the machines by risk, you'll be able to identify the most vulnerable machines and take action on them. -The Machines view contains the following columns: +The Machines view contains the following columns: -- **Machine name** - the name or GUID of the machine +- **Machine name** - the name or GUID of the machine - **Domain** - the domain the machine belongs to -- **Last seen** - when the machine last reported telemetry -- **Internal IP** - the local internal Internet Protocol (IP) address of the machine +- **Last seen** - when the machine last reported telemetry +- **Internal IP** - the local internal Internet Protocol (IP) address of the machine - **Active Alerts** - the number of alerts reported by the machine by severity - **Active malware detections** - the number of active malware detections reported by the machine -> **Note**  The **Active alerts** and **Active malware detections** filter column will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/en-us/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product. +> **Note**  The **Active alerts** and **Active malware detections** filter column will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/en-us/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product. -Click any column header to sort the view in ascending or descending order. +Click any column header to sort the view in ascending or descending order. ![Screenshot of the Machines view on the portal](images/machines-view.png) -You can sort the **Machines view** by **Machine name**, **Last seen**, **IP**, **Active Alerts**, and **Active malware detections**. Scroll down the **Machines view** to see additional machines. +You can sort the **Machines view** by **Machine name**, **Last seen**, **IP**, **Active Alerts**, and **Active malware detections**. Scroll down the **Machines view** to see additional machines. The view contains two filters: time and threat category. -You can filter the view by the following time periods: +You can filter the view by the following time periods: -- 1 day -- 3 days -- 7 days -- 30 days -- 6 months +- 1 day +- 3 days +- 7 days +- 30 days +- 6 months -> **Note**  When you select a time period, the list will only display machines that reported within the selected time period. For example, selecting 1 day will only display a list of machines that reported telemetry within the last 24-hour period. +> **Note**  When you select a time period, the list will only display machines that reported within the selected time period. For example, selecting 1 day will only display a list of machines that reported telemetry within the last 24-hour period. -The threat category filter lets you filter the view by the following categories: +The threat category filter lets you filter the view by the following categories: - Password stealer - Ransomware @@ -60,21 +60,21 @@ The threat category filter lets you filter the view by the following categories: - Threat - Low severity -See the [Investigate machines with active alerts](dashboard-windows-advanced-threat-protection.md#investigate-machines-with-active-malware-detections) topic for a description of each category. +See the [Investigate machines with active alerts](dashboard-windows-defender-advanced-threat-protection.md#investigate-machines-with-active-malware-detections) topic for a description of each category. -You can also download a full list of all the machines in your organization, in CSV format. Click the **Manage Alert** menu icon ![The menu icon looks like three periods stacked on top of each other](images/menu-icon.png) to download the entire list as a CSV file. +You can also download a full list of all the machines in your organization, in CSV format. Click the **Manage Alert** menu icon ![The menu icon looks like three periods stacked on top of each other](images/menu-icon.png) to download the entire list as a CSV file. - **Note**: Exporting the list depends on the number of machines in your organization. It can take a significant amount of time to download, depending on how large your organization is. -Exporting the list in CSV format displays the data in an unfiltered manner. The CSV file will include all machines in the organization, regardless of any filtering applied in the view itself. + **Note**: Exporting the list depends on the number of machines in your organization. It can take a significant amount of time to download, depending on how large your organization is. +Exporting the list in CSV format displays the data in an unfiltered manner. The CSV file will include all machines in the organization, regardless of any filtering applied in the view itself. ## Investigate a machine -Investigate the details of an alert raised on a specific machine to identify other behaviors or events that might be related to the alert or the potential scope of breach. +Investigate the details of an alert raised on a specific machine to identify other behaviors or events that might be related to the alert or the potential scope of breach. You can click on affected machines whenever you see them in the portal to open a detailed report about that machine. Affected machines are identified in the following areas: -- The [Machines view](machines-view-windows-advanced-threat-protection.md) -- The [Alerts queue](alerts-queue-windows-advanced-threat-protection.md) -- The [Dashboard](dashboard-windows-advanced-threat-protection.md) +- The [Machines view](machines-view-windows-defender-advanced-threat-protection.md) +- The [Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) +- The [Dashboard](dashboard-windows-defender-advanced-threat-protection.md) - Any individual alert - Any individual file details view - Any IP address or domain details view @@ -87,7 +87,7 @@ When you investigate a specific machine, you'll see: The machine details, IP, and reporting sections display some attributes of the machine such as its name, domain, OS, IP address, and how long it's been reporting telemetry to the Windows Defender ATP service. -The **Alerts related to this machine** section provides a list of alerts that are associated with the machine. This list is a simplified version of the [Alerts queue](alerts-queue-windows-advanced-threat-protection.md), and shows the date that the alert was detected, a short description of the alert, the alert's severity, the alert's threat category, and the alert's status in the queue. +The **Alerts related to this machine** section provides a list of alerts that are associated with the machine. This list is a simplified version of the [Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md), and shows the date that the alert was detected, a short description of the alert, the alert's severity, the alert's threat category, and the alert's status in the queue. The **Machine timeline** section provides a chronological view of the events and associated alerts that have been observed on the machine. @@ -104,10 +104,10 @@ You can also filter by: - Signed or unsigned files - Detections mode: displays Windows ATP Alerts and detections - Behaviors mode: displays "detections" and selected events of interest -- Verbose mode: displays "behaviors" (including "detections"), and all reported events +- Verbose mode: displays "behaviors" (including "detections"), and all reported events - Logged on users, System, Network, or Local service -Use the time-based slider to filter events from a specific date. By default, the machine timeline is set to display the events of the current day. +Use the time-based slider to filter events from a specific date. By default, the machine timeline is set to display the events of the current day. Using the slider updates the listed alerts to the date that you select. Displayed events are filtered from that date and older. @@ -117,29 +117,28 @@ From the **Machine view**, you can also navigate to the file, IP, or URL view an From the list of events that are displayed in the timeline, you can examine the behaviors or events in to help identify indicators of interests such as files and IP addresses to help determine the scope of a breach. You can then use the information to respond to events and keep your system secure. -Windows Defender ATP monitors and captures questionable behavior on Windows 10 machines and displays the process tree flow in the **Machine timeline**. This gives you better context of the behavior which can contribute to understanding the correlation between events, files, and IP addresses in relation to the machine. +Windows Defender ATP monitors and captures questionable behavior on Windows 10 machines and displays the process tree flow in the **Machine timeline**. This gives you better context of the behavior which can contribute to understanding the correlation between events, files, and IP addresses in relation to the machine. ![The process tree shows you a hierarchical history of processes and events on the machine](images/machine-investigation.png) - + **Investigate a machine:** 1. Select the machine that you want to investigate. You can select or search a machine from any of the following views: - **Dashboard** - click the machine name from the **Top machines with active alerts** section - **Alerts queue** - click the machine name beside the machine icon - - **Machines view** - click the heading of the machine name - - **Search box** - select **Machine** from the drop-down menu and enter the machine name -2. Information about the specific machine is displayed. + - **Machines view** - click the heading of the machine name + - **Search box** - select **Machine** from the drop-down menu and enter the machine name +2. Information about the specific machine is displayed. **Use the machine timeline** -1. Use the sort and filter feature to narrow down the search results. +1. Use the sort and filter feature to narrow down the search results. 2. Use the timeline search box to filter specific indicators that appear in the machine timeline. -3. Click the expand icon ![The expand icon looks like a plus symbol](images/expand.png) in the timeline row or click anywhere on the row to see additional information about the alert, behavior, or event. +3. Click the expand icon ![The expand icon looks like a plus symbol](images/expand.png) in the timeline row or click anywhere on the row to see additional information about the alert, behavior, or event. ### Related topics -- [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-advanced-threat-protection.md) -- [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-advanced-threat-protection.md) -- [Submit files to the Windows Defender ATP Deep analysis feature](deep-analysis-windows-advanced-threat-protection.md) -- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-advanced-threat-protection.md) \ No newline at end of file +- [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) +- [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) +- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md index 8705baf569..0ef82a2420 100644 --- a/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md @@ -2,7 +2,7 @@ title: Manage Windows Defender Advanced Threat Protection alerts description: Change the status of alerts, create suppression rules to hide alerts, submit comments, and review change history for individual alerts with the Manage Alert menu. keywords: manage alerts, manage, alerts, status, new, in progress, resolved, resolve alerts, suppress, supression, rules, context, history, comments, changes -search.product: eADQiWindows 10XVcnh +search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library @@ -14,15 +14,15 @@ ms.sitesec: library [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -Windows Defender ATP notifies you of detected, possible attacks or breaches through alerts. A summary of new alerts is displayed in the **Dashboard**, and you can access all alerts in the **Alerts queue** menu. +Windows Defender ATP notifies you of detected, possible attacks or breaches through alerts. A summary of new alerts is displayed in the **Dashboard**, and you can access all alerts in the **Alerts queue** menu. -See the [Investigate Windows Defender ATP alerts](investigate-alerts-windows-advanced-threat-protection.md#investigate-windows-defender-advanced-threat-protection-alerts) topic for more details on how to investigate alerts. +See the [Investigate Windows Defender ATP alerts](investigate-alerts-windows-defender-advanced-threat-protection.md#investigate-windows-defender-advanced-threat-protection-alerts) topic for more details on how to investigate alerts. -Click the **Manage Alert** menu icon ![The menu icon looks like three periods stacked on top of each other](images/menu-icon.png) on the top of the alert to access the Manage Alert menu and manage alerts. +Click the **Manage Alert** menu icon ![The menu icon looks like three periods stacked on top of each other](images/menu-icon.png) on the top of the alert to access the Manage Alert menu and manage alerts. ![The manage alert menu lets you change the status of an alert, create suppression rules, or enter comments](images/manage-alert-menu.png) -The **Manage alert** icon appears on the alert's heading in the **New**, **In Progress**, or **Resolved** queues, and on the details page for individual alerts. +The **Manage alert** icon appears on the alert's heading in the **New**, **In Progress**, or **Resolved** queues, and on the details page for individual alerts. You can use the **Manage Alert** menu to: @@ -57,18 +57,18 @@ The comments and change of status are recorded in the [Comments and history wind ## Suppress alerts -Windows Defender ATP lets you create suppression rules so you can limit the alerts you see in the **Alerts queue**. +Windows Defender ATP lets you create suppression rules so you can limit the alerts you see in the **Alerts queue**. -Suppression rules can be created from an existing alert. +Suppression rules can be created from an existing alert. When a suppression rule is created, it will take effect from this point onwards. It will not affect existing alerts already in the queue, but new alerts triggered after the rule is created will not be displayed. -There are two contexts for a suppression rule that you can choose from: +There are two contexts for a suppression rule that you can choose from: - **Suppress alert on this machine** - **Suppress alert in my organization** -The context of the rule lets you tailor the queue to ensure that only alerts you are interested in will appear. You can use the examples in the following table to help you choose the context for a suppression rule: +The context of the rule lets you tailor the queue to ensure that only alerts you are interested in will appear. You can use the examples in the following table to help you choose the context for a suppression rule: **Context** | **Definition** |**Example scenarios** ---|---|--- @@ -90,14 +90,14 @@ The context of the rule lets you tailor the queue to ensure that only alerts you ![Click the settings icon and then Suppression rules to create and modify rules](images/suppression-rules.png) -> **Note**  You can also click **See rules** in the confirmation window that appears when you suppress an alert. +> **Note**  You can also click **See rules** in the confirmation window that appears when you suppress an alert. The list of suppression rules shows all the rules that users in your organization have created. -Each rule shows: +Each rule shows: - (1) The title of the alert that is suppressed - (2) Whether the alert was suppressed for a single machine (clicking the machine name will allow you to investigate the machine) or the entire organization -- (3) The date when the alert was suppressed +- (3) The date when the alert was suppressed - (4) An option to delete the suppression rule, which will cause alerts with this title to be displayed in the queue from this point onwards. ![Suppression rules show the rule name or title, the context, the date, and an icon to delete the rule](images/rules-legend.png) @@ -112,7 +112,7 @@ Whenever a change or comment is made to an alert, it is recorded in the **Commen 1. Click the **Manage Alert** menu icon ![The menu icon looks like three periods stacked on top of each other](images/menu-icon.png) on the heading of the alert. 2. Click **Comments and history** to view related comments and history on the alert. -Comments are indicated by a message box icon (![The comments icon looks like a speech bubble](images/comments-icon.png)) and include the username of the commenter and the time the comment was made. +Comments are indicated by a message box icon (![The comments icon looks like a speech bubble](images/comments-icon.png)) and include the username of the commenter and the time the comment was made. **Add a new comment:** @@ -123,13 +123,12 @@ The comment will appear instantly. You will also be prompted to enter a comment if you change the status of an alert to **Resolved**. -Changes are indicated by a clock icon (![The changes icon looks like an analog clock face](images/changes-icon.png)), and are automatically recorded when: +Changes are indicated by a clock icon (![The changes icon looks like an analog clock face](images/changes-icon.png)), and are automatically recorded when: - The alert is created -- The status of the alert is changed +- The status of the alert is changed ### Related topics -- [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-advanced-threat-protection.md) -- [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-advanced-threat-protection.md) -- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-advanced-threat-protection.md) -- [Submit files to the Windows Defender ATP Deep analysis feature](deep-analysis-windows-advanced-threat-protection.md) +- [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) +- [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) +- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md index a55054b960..5945ac1988 100644 --- a/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md @@ -1,8 +1,8 @@ --- -title: Monitor the Windows Defender ATP onboarding +title: Monitor the Windows Defender ATP onboarding description: Monitor the onboarding of the Windows Defender ATP service to ensure your endpoints are correctly configured and are sending telemetry reports. keywords: monitor onboarding, monitor Windows Defender ATP onboarding, monitor Windows Defender Advanced Threat Protection onboarding -search.product: eADQiWindows 10XVcnh +search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library @@ -32,9 +32,9 @@ Monitoring can be done directly on the portal, or by using System Center Configu > **Note**  It can take several days for endpoints to start showing on the **Machines view**. This includes the time it takes for the policies to be distributed to the endpoint, the time it takes before the user logs on, and the time it takes for the endpoint to start reporting. -## Monitor with System Center Configuration Manager +## Monitor with System Center Configuration Manager -Monitoring with SCCM consists of two parts: +Monitoring with SCCM consists of two parts: 1. Confirming the configuration package has been correctly deployed and is running (or has successfully run) on the endpoints in your network. @@ -50,7 +50,7 @@ Monitoring with SCCM consists of two parts: 4. Review the status indicators under **Completion Statistics** and **Content Status**. -If there are failed deployments (endpoints with **Error**, **Requirements Not Met**, or **Failed statuses**), you may need to troubleshoot the endpoints. See the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) topic for more information. +If there are failed deployments (endpoints with **Error**, **Requirements Not Met**, or **Failed statuses**), you may need to troubleshoot the endpoints. See the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) topic for more information. Naama: Is this a correct process for idendtifying/resolving issues? YES! @@ -66,30 +66,30 @@ If there are failed deployments (endpoints with **Error**, **Requirements Not Me 2. In the SCCM console, click **Assets and Compliance** at the bottom of the navigation pane. -3. Click **Overview** and then **Compliance Settings**. +3. Click **Overview** and then **Compliance Settings**. + +4. In the main area of the SCCM console, click **Configuration Baselines** and import the provided cab. Iaan: Need to confirm that 'import' is available/ UI is correct + +5. Right-click the imported baseline and deploy to a predefined device collection. Naama: Is this 'export' as in the screenshot, or is that showing something else? -4. In the main area of the SCCM console, click **Configuration Baselines** and import the provided cab. Iaan: Need to confirm that 'import' is available/ UI is correct - -5. Right-click the imported baseline and deploy to a predefined device collection. Naama: Is this 'export' as in the screenshot, or is that showing something else? - ![image](images/export-sccm.png) - + Iaan: Need to confirm this is what it looks like -6. In the SCCM console, click **Monitoring** at the bottom of the navigation pane. +6. In the SCCM console, click **Monitoring** at the bottom of the navigation pane. -7. Click **Overview** and then **Deployments**. +7. Click **Overview** and then **Deployments**. 8. Click the deployment with the package name Naama: What is the name of the deployment, will it always be the same for every user/installation? Naama: How does one know if there is an issue? -If there are non-compliant endpoints (endpoints with ?????), you may need to troubleshoot the endpoints. See the [Troubleshoot Windows Defender ATP onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) topic for more information. +If there are non-compliant endpoints (endpoints with ?????), you may need to troubleshoot the endpoints. See the [Troubleshoot Windows Defender ATP onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) topic for more information. Naama: Is this a correct process for resolving issues?]]] ## Related topics -- [Windows Defender ATP service onboarding](service-onboarding-windows-advanced-threat-protection.md) -- [Configure Windows Defender ATP endpoints](configure-endpoints-windows-advanced-threat-protection.md) -- [Additional Windows Defender ATP configuration settings](additional-configuration-windows-advanced-threat-protection.md) -- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) +- [Windows Defender ATP service onboarding](service-onboarding-windows-defender-advanced-threat-protection.md) +- [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +- [Additional Windows Defender ATP configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md) +- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md index deb8ee61cf..c07da1f433 100644 --- a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md @@ -2,7 +2,7 @@ title: Windows Defender Advanced Threat Protection portal overview description: Use the Windows Defender ATP portal to monitor your enterprise network and assist in responding to alerts to potential advanced persistent threat (APT) activity or data breaches. keywords: Windows Defender ATP portal, portal, cybersecurity threat intelligence, dashboard, alerts queue, machines view, preferences setup, client onboarding, advanced attacks -search.product: eADQiWindows 10XVcnh +search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library @@ -16,33 +16,33 @@ author: DulceMV [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -Enterprise security teams can use the portal to monitor and assist in responding to alerts of potential advanced persistent threat (APT) activity or data breaches. +Enterprise security teams can use the portal to monitor and assist in responding to alerts of potential advanced persistent threat (APT) activity or data breaches. You can use the [Windows Defender ATP portal](https://seville.windows.com/) to: - View, sort, and triage alerts from your endpoints - Search for more information on observed indicators such as files and IP Addresses - Change Windows Defender ATP settings, including time zone and alert suppression rules -## Windows Defender ATP portal +## Windows Defender ATP portal When you open the portal, you’ll see the main areas of the application: - (1) Settings - (2) Navigation pane - (3) Main portal - (4) Search bar - - + + ![Windows Defender Advanced Threat Protection portal](images/portal.png) - + You can navigate through the portal using the menu options available in all sections. Refer to the following table for a description of each section. -Area | Description +Area | Description :---|:--- (1) Settings | Provides access to configuration settings such as time zone, alert suppression rules, and license information. (2) Navigation pane | Use the navigation pane to move between the **Dashboard**, **Alerts queue**, **Machines view**, **Preferences setup**, and **Client onboarding**. -**Dashboard** | Provides clickable tiles that open detailed information on various alerts that have been detected in your organization. +**Dashboard** | Provides clickable tiles that open detailed information on various alerts that have been detected in your organization. **Alerts queue** | Enables you to view separate queues of new, in progress, and resolved alerts. **Machines view**| Displays the list of machines that are onboarded to Windows Defender ATP, some information about them, and the corresponding number of alerts. -**Preferences setup**| Shows the settings you selected during [service onboarding](service-onboarding-windows-advanced-threat-protection.md), and lets you update your industry preferences and retention policy period. +**Preferences setup**| Shows the settings you selected during [service onboarding](service-onboarding-windows-defender-advanced-threat-protection.md), and lets you update your industry preferences and retention policy period. **Client onboarding**| Allows you to download the onboarding configuration package. (3) Main portal| Main area where you will see the different views such as the Dashboard, Alerts queue, and Machines view. (4) Search | Search for machines, files, external IP Addresses, or domains across endpoints. The drop-down combo box allows you to select the entity type. @@ -50,14 +50,14 @@ Area | Description ## Windows Defender ATP icons The following table provides information on the icons used all throughout the portal: -Icon | Description +Icon | Description :---|:--- ![Alert icon](images/alert-icon.png)| Alert – Indication of an activity correlated with advanced attacks. -![Detection icon](images/detection-icon.png)| Detection – Indication of a malware threat detection. -![Active threat icon](images/active-threat-icon.png)| Active threat – Threats actively executing at the time of detection. +![Detection icon](images/detection-icon.png)| Detection – Indication of a malware threat detection. +![Active threat icon](images/active-threat-icon.png)| Active threat – Threats actively executing at the time of detection. ![Remediated icon](images/remediated-icon.png)| Remediated – Threat removed from the machine -![Not remediated icon](images/not-remediated-icon.png)| Not remediated – Threat not removed from the machine. +![Not remediated icon](images/not-remediated-icon.png)| Not remediated – Threat not removed from the machine. ### Related topic -[Use the Windows Defender Advanced Threat Protection portal](use-windows-defender-advanced-threat-protection.md) \ No newline at end of file +[Use the Windows Defender Advanced Threat Protection portal](use-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md index fd231a6601..cc13aa0bb4 100644 --- a/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md @@ -2,14 +2,14 @@ title: Windows Defender ATP service onboarding description: Assign users to the Windows Defender ATP service application in Azure Active Directory to grant access to the portal. keywords: service onboarding, Windows Defender Advanced Threat Protection service onboarding -search.product: eADQiWindows 10XVcnh +search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: mjcaparas --- -# Windows Defender ATP service onboarding +# Windows Defender ATP service onboarding - Windows 10 Insider Preview - Azure Active Directory @@ -22,10 +22,10 @@ You have to assign users to the Windows ATP Service application in Azure Active 1. When you first go to the [Windows Defender ATP portal](https://seville.windows.com/) and your directory does not have users assigned to the Windows ATP Service application, you will - be directed to open the [Microsoft Azure Dashboard](https://portal.azure.com) to manage user access. + be directed to open the [Microsoft Azure Dashboard](https://portal.azure.com) to manage user access. > **Note**   In AAD, a directory is essentially a tenant. See the [Azure AD documentation](https://msdn.microsoft.com/en-us/library/azure/jj573650.aspx) for more information on how tenants work with AAD. - + 2. Ensure you have logged in to Microsoft Azure with an account that has permissions to assign users to an application in AAD. You might need to sign out of Microsoft Azure and then sign back in again if @@ -33,34 +33,34 @@ You have to assign users to the Windows ATP Service application in Azure Active portal: a. On the top menu, click the signed-in user’s name. - - b. Click **Sign out**. - + + b. Click **Sign out**. + ![Azure sign out](images/azure-signout.png) - + c. Go the [Microsoft Azure Dashboard](https://portal.azure.com) again where you will be asked to sign in. - + d. Sign in with the correct user name and password for an account that has permissions to assign users in AAD. -3. On the **Microsoft Azure Dashboard**, click **Browse** in the navigation pane and then click **Active Directory** to open the [Azure Management Portal](https://manage.windowsazure.com/). +3. On the **Microsoft Azure Dashboard**, click **Browse** in the navigation pane and then click **Active Directory** to open the [Azure Management Portal](https://manage.windowsazure.com/). ![Azure Active Directory menu](images/azure-browse.png) 4. You might need to open the **Directory** section of the [Azure Management Portal](https://manage.windowsazure.com/) so you can access your directory. There are two ways you can do this: a. Click the arrow icon above the list of directories to see the full list of directories in the main area of the portal. - + ![Azure organization menu](images/azure-org-directory.png) - + b. Scroll down in the navigation pane and click **Active Directory**. - + ![Azure active directory](images/azure-active-directory.png) - + 5. Click the directory that contains the Windows Defender ATP application. In the following example, the directory is called **Contoso**. - + ![Azure active directory list](images/azure-active-directory-list.png) - + > **Note**  You can also access your directory by going straight to the [Azure Management Portal](https://manage.windowsazure.com/), clicking Active Directory and then finding your directory in the list. 6. Click **Applications** from the top menu bar. @@ -76,10 +76,10 @@ You have to assign users to the Windows ATP Service application in Azure Active 8. Click **Users** from the top menu bar. A list of users that are in the directory is displayed. ![Example windows atp service users](images/windows-atp-service.png) - + ![Example user assignment to the windows atp service](images/assign-users.png) - - > **Note**   If you do not normally work with AAD, you might not see any users in the directory, or we might have created a test tenant specifically for a single user’s account. See the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) section for instructions on adding users to a directory. + + > **Note**   If you do not normally work with AAD, you might not see any users in the directory, or we might have created a test tenant specifically for a single user’s account. See the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) section for instructions on adding users to a directory. 9. Select the user you want manage. @@ -95,9 +95,9 @@ You have to assign users to the Windows ATP Service application in Azure Active ![Remove menu](images/remove-menu.png) -14. To remove the access for all users, click **Manage access**. If you click **Complete** ![Complete icon](images/check-icon.png), you will not see the Windows ATP Service in the list of applications in your directory. +14. To remove the access for all users, click **Manage access**. If you click **Complete** ![Complete icon](images/check-icon.png), you will not see the Windows ATP Service in the list of applications in your directory. - > **Note**   If you want to give access to users again, see the Manage access for all users in Azure Active Directory topic in [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md). + > **Note**   If you want to give access to users again, see the Manage access for all users in Azure Active Directory topic in [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md). 15. You can continue assigning roles for other users in your organization now, or you can return to the Windows Defender ATP portal to complete the service onboarding wizard. @@ -111,9 +111,7 @@ Follow the steps in the onboarding wizard to complete the onboarding process. At the end of the wizard, you can download the Group Policy configuration package which you will use to configure endpoints on your network. You can also download the package from the **Client onboarding** menu on the portal after you have completed the onboarding wizard. ## Related topics -- [Configure Windows Defender ATP endpoints (client onboarding)](configure-endpoints-windows-advanced-threat-protection.md) -- [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-advanced-threat-protection.md) -- [Additional Windows Defender ATP configuration settings](additional-configuration-windows-advanced-threat-protection.md) -- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) - - +- [Configure Windows Defender ATP endpoints (client onboarding)](configure-endpoints-windows-defender-advanced-threat-protection.md) +- [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) +- [Additional Windows Defender ATP configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md) +- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md b/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md index 82d61d6548..31d348f3e4 100644 --- a/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md @@ -48,7 +48,7 @@ To set the time zone: 3. The time zone indicator changes to **Timezone:Local**. Click it again to change back to **Timezone:UTC**. ## Suppression rules -The suppression rules control what alerts are suppressed. You can suppress alerts so that certain activities are not flagged as suspicious. See [Suppress alerts](manage-alerts-windows-advanced-threat-protection.md#suppress-alerts). +The suppression rules control what alerts are suppressed. You can suppress alerts so that certain activities are not flagged as suspicious. See [Suppress alerts](manage-alerts-windows-defender-advanced-threat-protection.md#suppress-alerts). ## License Click the license link in the **Settings** menu to view the license agreement information for Windows Defender ATP. diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index e7d7577f4f..41e97ecd71 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -2,14 +2,14 @@ title: Troubleshoot Windows Defender ATP onboarding issues description: Troubleshoot issues that might arise during the onboarding of endpoints or to the Windows Defender ATP service. keywords: troubleshoot onboarding, onboarding issues, event viewer, azure management portal, data collection and preview builds -search.product: eADQiWindows 10XVcnh +search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: mjcaparas --- -# Troubleshoot Windows Defender Advanced Threat Protection onboarding issues +# Troubleshoot Windows Defender Advanced Threat Protection onboarding issues - Windows 10 Insider Preview @@ -23,7 +23,7 @@ If you don’t see any users in the [Azure Management Portal](https://manage.win 1. Go to the Azure Management Portal and select the directory you want to manage. 2. Click **Users** from the top menu bar. - + ![Example Azure Management Portal organization](images/contoso-users.png) 3. Click **Add user** from the menu bar at the bottom. @@ -52,7 +52,7 @@ If the endpoints aren’t reporting correctly, you might need to check that the 1. Follow the instructions at [https://technet.microsoft.com/library/mt577208%28v=vs.85%29.aspx\#BKMK\_UTC] (https://technet.microsoft.com/library/mt577208%28v=vs.85%29.aspx#BKMK_UTC) -2. Attempt to [onboard the endpoint](onboard-configure-windows-advanced-threat-protection.md#onboard-endpoints-and-set-up-the-windows-defender-atp-user-access). +2. Attempt to [onboard the endpoint](onboard-configure-windows-defender-advanced-threat-protection.md#onboard-endpoints-and-set-up-the-windows-defender-atp-user-access). ## Configure proxy and Internet connectivity @@ -89,13 +89,13 @@ For example, if endpoints are not appearing in the **Machines view** list, you m Message | Action :---|:--- -Windows Advanced Threat Protection Service failed to connect to server at `````` | Check the connection to the URL. See [Configure proxy and Internet connectivity](#configure-proxy-and-Internet-connectivity). - Windows Advanced Threat Protection Service failed to read onboarding parameters. Failure code: `````` | Check that GP settings are correct and there are not settings impacting permissions in the policy. +Windows Advanced Threat Protection Service failed to connect to server at `````` | Check the connection to the URL. See [Configure proxy and Internet connectivity](#configure-proxy-and-Internet-connectivity). + Windows Advanced Threat Protection Service failed to read onboarding parameters. Failure code: `````` | Check that GP settings are correct and there are not settings impacting permissions in the policy. Windows Advanced Threat Protection Service failed to persist onboarding information. Failure code: `````` | Check that GP settings are correct and there are not settings impacting permissions in the policy. ## Related topics -- [Windows Defender ATP service onboarding](service-onboarding-windows-advanced-threat-protection.md) -- [Configure Windows Defender ATP endpoints](configure-endpoints-windows-advanced-threat-protection.md) -- [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-advanced-threat-protection.md) -- [Additional Windows Defender ATP configuration settings](additional-configuration-windows-advanced-threat-protection.md) +- [Windows Defender ATP service onboarding](service-onboarding-windows-defender-advanced-threat-protection.md) +- [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +- [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) +- [Additional Windows Defender ATP configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md index c1185997cc..cc6065ac39 100644 --- a/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md @@ -2,7 +2,7 @@ title: Troubleshoot Windows Defender Advanced Threat Protection description: Find solutions and work arounds to known issues such as server errors when trying to access the service. keywords: troubleshoot Windows Defender Advanced Threat Protection, troubleshoot Windows ATP, server error, access denied, invalid credentials -search.product: eADQiWindows 10XVcnh +search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library @@ -16,9 +16,9 @@ author: mjcaparas This section addresses issues that might arise as you use the service. -###Server error - Access is denied due to invalid credentials +###Server error - Access is denied due to invalid credentials If you encounter a server error when trying to access the service, you’ll need to change your browser cookie settings. -Configure your browser to allow cookies. +Configure your browser to allow cookies. ### Related topic -- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) \ No newline at end of file +- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) From 052fc7c9f0818859e6dd828ee0cd8c4c1eaee1c6 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 27 Apr 2016 14:16:47 +1000 Subject: [PATCH 090/439] fix Related topic links --- ...-queue-windows-defender-advanced-threat-protection.md | 9 ++++++--- .../dashboard-windows-advanced-threat-protection.md | 8 ++++++-- ...domain-windows-defender-advanced-threat-protection.md | 9 +++++++++ ...-files-windows-defender-advanced-threat-protection.md | 7 +++++-- ...ate-ip-windows-defender-advanced-threat-protection.md | 9 +++++++++ ...s-view-windows-defender-advanced-threat-protection.md | 6 +++++- ...alerts-windows-defender-advanced-threat-protection.md | 7 ++++++- ...arding-windows-defender-advanced-threat-protection.md | 2 +- 8 files changed, 47 insertions(+), 10 deletions(-) diff --git a/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md b/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md index 8f946e7ade..ddb43ebecb 100644 --- a/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md @@ -58,7 +58,10 @@ There are three mechanisms to pivot the queue against: > **Note**  You can change the sort order (for example, from most recent to least recent) by clicking the sort order icon ![the sort order icon looks like two arrows on top of each other](images/sort-order-icon.png) ### Related topics - - [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) -- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-defender-advanced-threat-protection.md) -- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) +- [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) +- [Investigate machines](machines-view-windows-defender-advanced-threat-protection.md) +- [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md) +- [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) +- [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) +- [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md) \ No newline at end of file diff --git a/windows/keep-secure/dashboard-windows-advanced-threat-protection.md b/windows/keep-secure/dashboard-windows-advanced-threat-protection.md index ba9023b993..2163100d68 100644 --- a/windows/keep-secure/dashboard-windows-advanced-threat-protection.md +++ b/windows/keep-secure/dashboard-windows-advanced-threat-protection.md @@ -83,5 +83,9 @@ Clicking on any of these categories will navigate to the [Machines view](machine ### Related topics - [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) -- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-defender-advanced-threat-protection.md) -- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) +- [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) +- [Investigate machines](machines-view-windows-defender-advanced-threat-protection.md) +- [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md) +- [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) +- [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) +- [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md index 5409e63362..27a72a1605 100644 --- a/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md @@ -31,3 +31,12 @@ The **Communication with URL in organization** section provides a chronological 3. Click the search icon or press **Enter**. Details about the URL are displayed. Note: search results will only be returned for URLs observed in communications from machines in the organization. 4. Use the search filters to define the search criteria. You can also use the timeline search box to filter the displayed results of all machines in the organization observed communicating with the URL, the file associated with the communication and the last date observed. 5. Clicking any of the machine names will take you to that machine's view, where you can continue investigate reported alerts, behaviors, and events. + +## Related topics +- [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) +- [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) +- [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) +- [Investigate machines](machines-view-windows-defender-advanced-threat-protection.md) +- [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md) +- [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) +- [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md) \ No newline at end of file diff --git a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md index a0262abad7..28ef91f88e 100644 --- a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md @@ -120,5 +120,8 @@ HKLM\SOFTWARE\Policies\Microsoft\Sense\AllowSampleCollection ### Related topics - [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) - [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) -- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-defender-advanced-threat-protection.md) -- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) +- [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) +- [Investigate machines](machines-view-windows-defender-advanced-threat-protection.md) +- [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) +- [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) +- [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md index 1449010c23..7afae8cef6 100644 --- a/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md @@ -39,3 +39,12 @@ Details about the IP address are displayed, including: registration details (if Use the search filters to define the search criteria. You can also use the timeline search box to filter the displayed results of all machines in the organization observed communicating with the IP address, the file associated with the communication and the last date observed. Clicking any of the machine names will take you to that machine's view, where you can continue investigate reported alerts, behaviors, and events. + +## Related topics +- [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) +- [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) +- [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) +- [Investigate machines](machines-view-windows-defender-advanced-threat-protection.md) +- [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md) +- [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) +- [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md) \ No newline at end of file diff --git a/windows/keep-secure/machines-view-windows-defender-advanced-threat-protection.md b/windows/keep-secure/machines-view-windows-defender-advanced-threat-protection.md index 929a731f17..3219928b73 100644 --- a/windows/keep-secure/machines-view-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/machines-view-windows-defender-advanced-threat-protection.md @@ -141,4 +141,8 @@ Windows Defender ATP monitors and captures questionable behavior on Windows 10 m ### Related topics - [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) - [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) -- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) +- [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) +- [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md) +- [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) +- [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) +- [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md index 0ef82a2420..8cacf28198 100644 --- a/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md @@ -131,4 +131,9 @@ Changes are indicated by a clock icon (![The changes icon looks like an analog c ### Related topics - [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) - [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) -- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-defender-advanced-threat-protection.md) +- [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) +- [Investigate machines](machines-view-windows-defender-advanced-threat-protection.md) +- [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md) +- [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) +- [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) + diff --git a/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md index cc13aa0bb4..4196306255 100644 --- a/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md @@ -111,7 +111,7 @@ Follow the steps in the onboarding wizard to complete the onboarding process. At the end of the wizard, you can download the Group Policy configuration package which you will use to configure endpoints on your network. You can also download the package from the **Client onboarding** menu on the portal after you have completed the onboarding wizard. ## Related topics -- [Configure Windows Defender ATP endpoints (client onboarding)](configure-endpoints-windows-defender-advanced-threat-protection.md) +- [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) - [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) - [Additional Windows Defender ATP configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md) - [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) From e6c186560219224446f14fe35513f8f5a71e974a Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 27 Apr 2016 14:42:34 +1000 Subject: [PATCH 091/439] Add new topics in In this section --- ...windows-defender-advanced-threat-protection.md | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md index dbda5f0611..ff71b33b31 100644 --- a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md @@ -1,8 +1,8 @@ --- title: Use the Windows Defender Advanced Threat Protection portal description: Learn about the features on Windows Defender ATP portal, including how alerts work, and suggestions on how to investigate possible breaches and attacks. -keywords: dashboard, alerts queue, manage alerts, investigation, investigate alerts, investigate machines, submit files, deep analysis, high, medium, low, severity, -search.product: eADQiWindows 10XVcnh +keywords: dashboard, alerts queue, manage alerts, investigation, investigate alerts, investigate machines, submit files, deep analysis, high, medium, low, severity, +search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library @@ -22,18 +22,19 @@ A typical security breach investigation requires a member of a security operatio 4. Manage alerts, understand the threat or potential breach, collect information to support taking action, and resolve the alert ![Flowchart describing the four stages of investigation](images/overview.png) - + Security operation teams can use Windows Defender ATP Portal to carry out this end-to-end process without having to leave the portal. Teams can monitor the overall status of enterprise endpoints from the **Dashboard**, gain insight on the various alerts, their category, when they were observed, and how long they’ve been in the network at a glance. ### In this section -Topic | Description +Topic | Description :---|:--- [View the Dashboard](dashboard-windows-advanced-threat-protection.md) | The Windows Defender ATP **Dashboard** provides a snapshot of your network. You can view aggregates of alerts, the overall status of the service of the endpoints on your network, investigate machines, files, and URLs, and see snapshots of threats seen on machines. [View and organize the Alerts queue](alerts-queue-windows-advanced-threat-protection.md) | You can sort and filter alerts across your network, and drill down on individual alert queues such as new, in progress, or resolved queues. -[Investigate alerts](investigate-alerts-windows-advanced-threat-protection.md)| Investigate alerts in Windows Defender ATP which might indicate possible security breaches on endpoints in your organization. +[Investigate alerts](investigate-alerts-windows-advanced-threat-protection.md)| Investigate alerts in Windows Defender ATP which might indicate possible security breaches on endpoints in your organization. [Investigate machines](machines-view-windows-advanced-threat-protection.md) | The **Machines view** shows a list of the machines in your network, the corresponding number of active alerts for each machine categorized by alert severity levels, as well as the number of threats. -[Submit files to the Deep analysis feature](deep-analysis-windows-advanced-threat-protection.md) | You can submit files for deep analysis to see detailed information about the file’s activities, observed behaviors, and associated artifacts (such as dropped files, registry modifications, and communications with IPs). +[Investigate files](investigate-files-windows-defender-advanced-threat-protection.md) | Investigate the details of a file associated with a specific alert, behavior, or event to help determine if the file exhibits malicious activities, identify the attack motivation, and understand the potential scope of the breach. +[Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) | Examine possible communication between your machines and external internet protocol (IP) addresses. +[Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) | Investigate a domain to see if machines and servers in your enterprise network have been communicating with a known malicious domain. [Manage alerts](manage-alerts-windows-advanced-threat-protection.md) | The **Manage Alert** menu on every alert lets you change an alert's status, resolve it, suppress it, or contribute comments about the alert. - From 28f78804f591dd49afc584ffd6ca621c3ad7f63c Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 27 Apr 2016 14:59:44 +1000 Subject: [PATCH 092/439] update H1 titles --- ...ate-domain-windows-defender-advanced-threat-protection.md | 2 +- ...gate-files-windows-defender-advanced-threat-protection.md | 5 +++-- ...stigate-ip-windows-defender-advanced-threat-protection.md | 2 +- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md index 27a72a1605..64891b07f7 100644 --- a/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md @@ -7,7 +7,7 @@ ms.mktglfcycl: deploy ms.sitesec: library author: mjcaparas --- -# Investigate a domain +# Investigate a domain associated with a Windows Defender ATP alert Investigate a domain to see if machines and servers in your enterprise network have been communicating with a known malicious domain. diff --git a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md index 28ef91f88e..4ffd477565 100644 --- a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md @@ -1,14 +1,15 @@ --- title: Investigate Windows Defender Advanced Threat Protection files description: Use the investigation options to get details on files associated with alerts, behaviours, or events. -keywords: investigate, investigation, files, malicious activity, attack motivation +keywords: investigate, investigation, file, malicious activity, attack motivation search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: mjcaparas --- -# Investigate a file +# Investigate a file associated with a Windows Defender ATP alert + Investigate the details of a file associated with a specific alert, behavior, or event to help determine if the file exhibits malicious activities, identify the attack motivation, and understand the potential scope of the breach. You can get information from the following sections in the file view: diff --git a/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md index 7afae8cef6..ef70d53b64 100644 --- a/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library author: mjcaparas --- -# Investigate an IP address +# Investigate an IP address associated with a Windows Defender ATP alert Examine possible communication between your machines and external internet protocol (IP) addresses. From 29a28109c8655826e2c807e5d691614f9dc65ba3 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 27 Apr 2016 15:04:50 +1000 Subject: [PATCH 093/439] fix related topics links --- ...ueue-windows-defender-advanced-threat-protection.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md b/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md index ddb43ebecb..da648c6c4f 100644 --- a/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md @@ -59,9 +59,9 @@ There are three mechanisms to pivot the queue against: ### Related topics - [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) -- [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) -- [Investigate machines](machines-view-windows-defender-advanced-threat-protection.md) -- [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md) +- [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) +- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-defender-advanced-threat-protection.md) +- [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) - [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) -- [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) -- [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md) \ No newline at end of file +- [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) +- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) \ No newline at end of file From 9cef6a895bbd59af414133743b41fd2bd72f638d Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 27 Apr 2016 15:08:13 +1000 Subject: [PATCH 094/439] re-order Related Topics links --- ...ure-endpoints-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md index 49fde778c1..176d52dc74 100644 --- a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md @@ -91,6 +91,6 @@ See the [Troubleshoot Windows Defender Advanced Threat Protection onboarding iss ## Related topics - [Windows Defender ATP service onboarding](service-onboarding-windows-defender-advanced-threat-protection.md) -- [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) - [Additional Windows Defender ATP configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md) +- [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) - [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) From 67c9b46b1be4b1084c6f4f0a782ed8124efae5c4 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 27 Apr 2016 15:09:57 +1000 Subject: [PATCH 095/439] re-order Related topics links --- ...t-onboarding-windows-defender-advanced-threat-protection.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index 41e97ecd71..3f3bfbd692 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -97,5 +97,6 @@ Windows Advanced Threat Protection Service failed to persist onboarding informat ## Related topics - [Windows Defender ATP service onboarding](service-onboarding-windows-defender-advanced-threat-protection.md) - [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -- [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) - [Additional Windows Defender ATP configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md) +- [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) + From decdea32203f2bcf74b70d470eadead1203e8252 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 27 Apr 2016 15:15:24 +1000 Subject: [PATCH 096/439] rename topic --- ...d => dashboard-windows-defender-advanced-threat-protection.md} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename windows/keep-secure/{dashboard-windows-advanced-threat-protection.md => dashboard-windows-defender-advanced-threat-protection.md} (100%) diff --git a/windows/keep-secure/dashboard-windows-advanced-threat-protection.md b/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md similarity index 100% rename from windows/keep-secure/dashboard-windows-advanced-threat-protection.md rename to windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md From b1a9f33d3c8b7ef8b494639a01f70d0cfe0ddfb8 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 27 Apr 2016 15:17:08 +1000 Subject: [PATCH 097/439] fix anchor link --- ...orage-privacy-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md index f011efc8fc..36ddc431a8 100644 --- a/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md @@ -63,7 +63,7 @@ Microsoft provides customers with detailed information about our security and co When you onboard your service during TAP, you will be asked to choose to store your data in a datacenter either in Europe or United States. Your data will not be copied or moved outside of the datacenter you choose, except in the following specific circumstance: 1. You choose Europe as your datacenter, and -2. You [submit a file for deep analysis](submit-files-for-analysis#investigate-files-windows-defender-advanced-threat-protection.md). +2. You [submit a file for deep analysis](investigate-files-windows-defender-advanced-threat-protection.md#submit-files-for-analysis). In this circumstance, the submitted file will be sent to the US deep analysis laboratory. The results of the analysis will be stored in the European datacenter, and the file and data will be deleted from the US deep analysis laboratory and datacenter. From 25b1ec4069e2dcc9e742582494e9d74e16aea0b0 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 27 Apr 2016 15:27:09 +1000 Subject: [PATCH 098/439] add DEFENDER in names --- ...ents-windows-defender-advanced-threat-protection.md | 4 ++-- ...gure-windows-defender-advanced-threat-protection.md | 10 +++++----- .../use-windows-defender-advanced-threat-protection.md | 10 +++++----- .../windows-defender-advanced-threat-protection.md | 2 +- 4 files changed, 13 insertions(+), 13 deletions(-) diff --git a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md index bf1d4c5eb8..283a3f70ee 100644 --- a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -48,12 +48,12 @@ TAP. Server and mobile versions of Windows are not supported. Internet connectivity on endpoints is also required. See the -[Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) +[Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) section for additional proxy configuration settings. Before you configure endpoints, the telemetry and diagnostics service must be enabled. The service is enabled by default in Windows 10 TAP, but if it has been disabled you can turn it on by following the instructions in the -[Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) section. +[Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) section. ### Deployment channel operating system requirements diff --git a/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md b/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md index 4c671eaabf..6e210ac056 100644 --- a/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md @@ -30,8 +30,8 @@ There are two stages to onboarding: ## In this section Topic | Description :---|:--- -[Service onboarding](service-onboarding-windows-advanced-threat-protection.md) | Learn about managing user access to the Windows Defender ATP portal by assigning users to the Windows Defender ATP service application in Azure Active Directory (AAD). -[Configure endpoints](configure-endpoints-windows-advanced-threat-protection.md) | You'll need to configure endpoints for it to report to the Windows Defender ATP service. Learn how you can use the configuration package to configure endpoints in your enterprise. -[Additional configuration settings](additional-configuration-windows-advanced-threat-protection.md) | Learn how to configure settings for sample sharing used in the deep analysis feature. -[Monitor onboarding](monitor-onboarding-windows-advanced-threat-protection.md) | Learn how you can monitor the onboarding to ensure your endpoints are correctly configured and are sending telemetry reports. -[Troubleshoot onboarding issues](troubleshoot-onboarding-windows-advanced-threat-protection.md) | Learn about resolving issues that might arise during onboarding. +[Service onboarding](service-onboarding-windows-defender-advanced-threat-protection.md) | Learn about managing user access to the Windows Defender ATP portal by assigning users to the Windows Defender ATP service application in Azure Active Directory (AAD). +[Configure endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) | You'll need to configure endpoints for it to report to the Windows Defender ATP service. Learn how you can use the configuration package to configure endpoints in your enterprise. +[Additional configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md) | Learn how to configure settings for sample sharing used in the deep analysis feature. +[Monitor onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) | Learn how you can monitor the onboarding to ensure your endpoints are correctly configured and are sending telemetry reports. +[Troubleshoot onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) | Learn about resolving issues that might arise during onboarding. diff --git a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md index ff71b33b31..3c5a75c47a 100644 --- a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md @@ -30,11 +30,11 @@ Teams can monitor the overall status of enterprise endpoints from the **Dashboar Topic | Description :---|:--- -[View the Dashboard](dashboard-windows-advanced-threat-protection.md) | The Windows Defender ATP **Dashboard** provides a snapshot of your network. You can view aggregates of alerts, the overall status of the service of the endpoints on your network, investigate machines, files, and URLs, and see snapshots of threats seen on machines. -[View and organize the Alerts queue](alerts-queue-windows-advanced-threat-protection.md) | You can sort and filter alerts across your network, and drill down on individual alert queues such as new, in progress, or resolved queues. -[Investigate alerts](investigate-alerts-windows-advanced-threat-protection.md)| Investigate alerts in Windows Defender ATP which might indicate possible security breaches on endpoints in your organization. -[Investigate machines](machines-view-windows-advanced-threat-protection.md) | The **Machines view** shows a list of the machines in your network, the corresponding number of active alerts for each machine categorized by alert severity levels, as well as the number of threats. +[View the Dashboard](dashboard-windows-defender-advanced-threat-protection.md) | The Windows Defender ATP **Dashboard** provides a snapshot of your network. You can view aggregates of alerts, the overall status of the service of the endpoints on your network, investigate machines, files, and URLs, and see snapshots of threats seen on machines. +[View and organize the Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) | You can sort and filter alerts across your network, and drill down on individual alert queues such as new, in progress, or resolved queues. +[Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)| Investigate alerts in Windows Defender ATP which might indicate possible security breaches on endpoints in your organization. +[Investigate machines](machines-view-windows-defender-advanced-threat-protection.md) | The **Machines view** shows a list of the machines in your network, the corresponding number of active alerts for each machine categorized by alert severity levels, as well as the number of threats. [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md) | Investigate the details of a file associated with a specific alert, behavior, or event to help determine if the file exhibits malicious activities, identify the attack motivation, and understand the potential scope of the breach. [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) | Examine possible communication between your machines and external internet protocol (IP) addresses. [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) | Investigate a domain to see if machines and servers in your enterprise network have been communicating with a known malicious domain. -[Manage alerts](manage-alerts-windows-advanced-threat-protection.md) | The **Manage Alert** menu on every alert lets you change an alert's status, resolve it, suppress it, or contribute comments about the alert. +[Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md) | The **Manage Alert** menu on every alert lets you change an alert's status, resolve it, suppress it, or contribute comments about the alert. diff --git a/windows/keep-secure/windows-defender-advanced-threat-protection.md b/windows/keep-secure/windows-defender-advanced-threat-protection.md index 759899e1be..00af7fcf6d 100644 --- a/windows/keep-secure/windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/windows-defender-advanced-threat-protection.md @@ -77,7 +77,7 @@ detect sophisticated cyber-attacks, providing: Topic | Description :---|:--- [Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md) | This overview topic for IT professionals provides information on the minimum requirements to use Windows Defender Advanced Threat Protection such as network and data storage configuration, and endpoint hardware ans software requirements, and deployment channels. -[Onboard endpoints and set up access](onboard-configure-windows-advanced-threat-protection.md) | You'll need to onboard and configure the Windows Defender ATP service and the endpoints in your network before you can use the service. Learn about how you can assign users to the Windows Defender ATP service in Azure Active Directory (AAD) and using a configuration package to configure endpoints. +[Onboard endpoints and set up access](onboard-configure-windows-defender-advanced-threat-protection.md) | You'll need to onboard and configure the Windows Defender ATP service and the endpoints in your network before you can use the service. Learn about how you can assign users to the Windows Defender ATP service in Azure Active Directory (AAD) and using a configuration package to configure endpoints. [Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md)| Learn about how Windows Defender ATP collects and handles information and where data is stored. [Portal overview](portal-overview-windows-defender-advanced-threat-protection.md) | Understand the main features of the service and how it leverages Microsoft technology to protect enterprise endpoints from sophisticated cyber attacks. [Use the Windows Defender Advanced Threat Protection portal](use-windows-defender-advanced-threat-protection.md) | Learn about the capabilities of Windows Defender ATP to help you investigate alerts that might be indicators of possible breaches in your enterprise. From e3215f22c4a97e02ab9ad57f4595fe08360eff66 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 27 Apr 2016 15:36:56 +1000 Subject: [PATCH 099/439] update related topics --- ...gate-alerts-windows-defender-advanced-threat-protection.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md index 038aba1c10..ec89a13d79 100644 --- a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md @@ -48,4 +48,8 @@ Depending on the type of alert, you click on the name to see a detailed report a ### Related topics - [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) - [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) +- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-defender-advanced-threat-protection.md) +- [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) +- [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) +- [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) - [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) From 840227ff55a9b0a43b3139618360e921c00a18da Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 27 Apr 2016 15:44:29 +1000 Subject: [PATCH 100/439] fix Related topics --- ...main-windows-defender-advanced-threat-protection.md | 8 ++++---- ...iles-windows-defender-advanced-threat-protection.md | 8 ++++---- ...e-ip-windows-defender-advanced-threat-protection.md | 10 +++++----- ...view-windows-defender-advanced-threat-protection.md | 8 ++++---- ...erts-windows-defender-advanced-threat-protection.md | 8 ++++---- 5 files changed, 21 insertions(+), 21 deletions(-) diff --git a/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md index 64891b07f7..b797b4f8ac 100644 --- a/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md @@ -35,8 +35,8 @@ The **Communication with URL in organization** section provides a chronological ## Related topics - [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) - [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) -- [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) -- [Investigate machines](machines-view-windows-defender-advanced-threat-protection.md) -- [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md) +- [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) +- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-defender-advanced-threat-protection.md) +- [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) - [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) -- [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md) \ No newline at end of file +- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) \ No newline at end of file diff --git a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md index 4ffd477565..58253819f4 100644 --- a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md @@ -121,8 +121,8 @@ HKLM\SOFTWARE\Policies\Microsoft\Sense\AllowSampleCollection ### Related topics - [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) - [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) -- [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) -- [Investigate machines](machines-view-windows-defender-advanced-threat-protection.md) +- [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) +- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-defender-advanced-threat-protection.md) - [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) -- [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) -- [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md) +- [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) +- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md index ef70d53b64..d41959d2ed 100644 --- a/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md @@ -43,8 +43,8 @@ Clicking any of the machine names will take you to that machine's view, where yo ## Related topics - [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) - [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) -- [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) -- [Investigate machines](machines-view-windows-defender-advanced-threat-protection.md) -- [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md) -- [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) -- [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md) \ No newline at end of file +- [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) +- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-defender-advanced-threat-protection.md) +- [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) +- [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) +- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) \ No newline at end of file diff --git a/windows/keep-secure/machines-view-windows-defender-advanced-threat-protection.md b/windows/keep-secure/machines-view-windows-defender-advanced-threat-protection.md index 3219928b73..8b8628b4c5 100644 --- a/windows/keep-secure/machines-view-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/machines-view-windows-defender-advanced-threat-protection.md @@ -141,8 +141,8 @@ Windows Defender ATP monitors and captures questionable behavior on Windows 10 m ### Related topics - [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) - [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) -- [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) -- [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md) +- [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) +- [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) - [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) -- [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) -- [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md) +- [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) +- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md index 8cacf28198..0ac1b556a9 100644 --- a/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md @@ -131,9 +131,9 @@ Changes are indicated by a clock icon (![The changes icon looks like an analog c ### Related topics - [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) - [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) -- [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) -- [Investigate machines](machines-view-windows-defender-advanced-threat-protection.md) -- [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md) +- [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) +- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-defender-advanced-threat-protection.md) +- [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) - [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) -- [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) +- [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) From b8559778dfef31095a11e10ba2adab21ab6233dc Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 27 Apr 2016 15:47:11 +1000 Subject: [PATCH 101/439] change topic name for consistency --- ...igate-machines-windows-defender-advanced-threat-protection.md} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename windows/keep-secure/{machines-view-windows-defender-advanced-threat-protection.md => investigate-machines-windows-defender-advanced-threat-protection.md} (100%) diff --git a/windows/keep-secure/machines-view-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md similarity index 100% rename from windows/keep-secure/machines-view-windows-defender-advanced-threat-protection.md rename to windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md From 5d1652b7336c93577518005ddd9d2a2d12e74d9d Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 27 Apr 2016 15:58:34 +1000 Subject: [PATCH 102/439] update xrefs --- ...rts-queue-windows-defender-advanced-threat-protection.md | 2 +- ...dashboard-windows-defender-advanced-threat-protection.md | 6 +++--- ...te-domain-windows-defender-advanced-threat-protection.md | 2 +- ...ate-files-windows-defender-advanced-threat-protection.md | 2 +- ...tigate-ip-windows-defender-advanced-threat-protection.md | 2 +- ...-machines-windows-defender-advanced-threat-protection.md | 2 +- ...ge-alerts-windows-defender-advanced-threat-protection.md | 2 +- .../use-windows-defender-advanced-threat-protection.md | 2 +- 8 files changed, 10 insertions(+), 10 deletions(-) diff --git a/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md b/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md index da648c6c4f..3cd1bcdadd 100644 --- a/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md @@ -60,7 +60,7 @@ There are three mechanisms to pivot the queue against: ### Related topics - [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) - [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) -- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-defender-advanced-threat-protection.md) +- [Investigate machines in the Windows Defender ATP Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) - [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) - [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) - [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md b/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md index 2163100d68..90c793c53f 100644 --- a/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md @@ -46,7 +46,7 @@ This tile shows you a list of machines with the highest number of active alerts. Click the name of the machine to see details about that machine. See the [Investigate Windows Defender ATP alerts](investigate-alerts-windows-defender-advanced-threat-protection.md#investigate-a-machine) topic for more information. -You can also click **Machines view** at the top of the tile to go directly to the **Machines view**, sorted by the number of active alerts. See the [Investigate machines in the Windows Defender Advanced Threat Protection Machines view](machines-view-windows-defender-advanced-threat-protection.md) topic for more information. +You can also click **Machines view** at the top of the tile to go directly to the **Machines view**, sorted by the number of active alerts. See the [Investigate machines in the Windows Defender Advanced Threat Protection Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) topic for more information. ## Status The **Status** tile informs you if the service is active and running and the specific number of machines (endpoints) reporting to Windows Defender ATP. @@ -77,14 +77,14 @@ The chart is sorted into five categories: Threats are considered "active" if there is a very high probability that the malware was executing on your network, as opposed to statically located on-disk. -Clicking on any of these categories will navigate to the [Machines view](machines-view-windows-defender-advanced-threat-protection.md), filtered by the appropriate category. This lets you see a detailed breakdown of which machines have active malware detections, and how many threats were detected per machine. +Clicking on any of these categories will navigate to the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md), filtered by the appropriate category. This lets you see a detailed breakdown of which machines have active malware detections, and how many threats were detected per machine. > **Note**  The **Active malware** tile will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/en-us/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product. ### Related topics - [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) - [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) -- [Investigate machines](machines-view-windows-defender-advanced-threat-protection.md) +- [Investigate machines](investigate-machines-windows-defender-advanced-threat-protection.md) - [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md) - [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) - [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md index b797b4f8ac..6877480257 100644 --- a/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md @@ -36,7 +36,7 @@ The **Communication with URL in organization** section provides a chronological - [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) - [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) - [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) -- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-defender-advanced-threat-protection.md) +- [Investigate machines in the Windows Defender ATP Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) - [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) - [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) - [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) \ No newline at end of file diff --git a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md index 58253819f4..d6cccabe82 100644 --- a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md @@ -122,7 +122,7 @@ HKLM\SOFTWARE\Policies\Microsoft\Sense\AllowSampleCollection - [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) - [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) - [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) -- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-defender-advanced-threat-protection.md) +- [Investigate machines in the Windows Defender ATP Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) - [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) - [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) - [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md index d41959d2ed..18f5945d20 100644 --- a/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md @@ -44,7 +44,7 @@ Clicking any of the machine names will take you to that machine's view, where yo - [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) - [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) - [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) -- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-defender-advanced-threat-protection.md) +- [Investigate machines in the Windows Defender ATP Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) - [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) - [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) - [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) \ No newline at end of file diff --git a/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md index 8b8628b4c5..fd7b98d4e5 100644 --- a/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md @@ -72,7 +72,7 @@ Investigate the details of an alert raised on a specific machine to identify oth You can click on affected machines whenever you see them in the portal to open a detailed report about that machine. Affected machines are identified in the following areas: -- The [Machines view](machines-view-windows-defender-advanced-threat-protection.md) +- The [Machines view](#Investigate-machines-in-the-Windows-Defender-ATP-Machines-view) - The [Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) - The [Dashboard](dashboard-windows-defender-advanced-threat-protection.md) - Any individual alert diff --git a/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md index 0ac1b556a9..10f5124e63 100644 --- a/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md @@ -132,7 +132,7 @@ Changes are indicated by a clock icon (![The changes icon looks like an analog c - [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) - [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) - [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) -- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-defender-advanced-threat-protection.md) +- [Investigate machines in the Windows Defender ATP Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) - [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) - [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) - [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md index 3c5a75c47a..280361c6ea 100644 --- a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md @@ -33,7 +33,7 @@ Topic | Description [View the Dashboard](dashboard-windows-defender-advanced-threat-protection.md) | The Windows Defender ATP **Dashboard** provides a snapshot of your network. You can view aggregates of alerts, the overall status of the service of the endpoints on your network, investigate machines, files, and URLs, and see snapshots of threats seen on machines. [View and organize the Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) | You can sort and filter alerts across your network, and drill down on individual alert queues such as new, in progress, or resolved queues. [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)| Investigate alerts in Windows Defender ATP which might indicate possible security breaches on endpoints in your organization. -[Investigate machines](machines-view-windows-defender-advanced-threat-protection.md) | The **Machines view** shows a list of the machines in your network, the corresponding number of active alerts for each machine categorized by alert severity levels, as well as the number of threats. +[Investigate machines](investigate-machines-windows-defender-advanced-threat-protection.md) | The **Machines view** shows a list of the machines in your network, the corresponding number of active alerts for each machine categorized by alert severity levels, as well as the number of threats. [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md) | Investigate the details of a file associated with a specific alert, behavior, or event to help determine if the file exhibits malicious activities, identify the attack motivation, and understand the potential scope of the breach. [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) | Examine possible communication between your machines and external internet protocol (IP) addresses. [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) | Investigate a domain to see if machines and servers in your enterprise network have been communicating with a known malicious domain. From be9d99a2375c2d1c637336b1ccff20e945180dd8 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 27 Apr 2016 16:06:16 +1000 Subject: [PATCH 103/439] fix deadlink --- windows/keep-secure/TOC.md | 2 +- ...tigate-alerts-windows-defender-advanced-threat-protection.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 9821c33c1a..d837167528 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -415,7 +415,7 @@ ##### [View the Dashboard](dashboard-windows-defender-advanced-threat-protection.md) ##### [View and organize the Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) ##### [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) -##### [Investigate machines](machines-view-windows-defender-advanced-threat-protection.md) +##### [Investigate machines](investigate-machines-windows-defender-advanced-threat-protection.md) ##### [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md) ##### [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) ##### [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md index ec89a13d79..2daa35a294 100644 --- a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md @@ -48,7 +48,7 @@ Depending on the type of alert, you click on the name to see a detailed report a ### Related topics - [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) - [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) -- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-defender-advanced-threat-protection.md) +- [Investigate machines in the Windows Defender ATP Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) - [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) - [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) - [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) From a767207496686ba4458572b44e18c1b518dc8c07 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 27 Apr 2016 17:06:35 +1000 Subject: [PATCH 104/439] update Applies to --- ...ts-queue-windows-defender-advanced-threat-protection.md | 2 ++ ...ndpoints-windows-defender-advanced-threat-protection.md | 2 ++ ...ashboard-windows-defender-advanced-threat-protection.md | 2 ++ ...-privacy-windows-defender-advanced-threat-protection.md | 2 ++ ...e-domain-windows-defender-advanced-threat-protection.md | 6 ++++++ ...te-files-windows-defender-advanced-threat-protection.md | 6 ++++++ ...igate-ip-windows-defender-advanced-threat-protection.md | 7 +++++++ ...e-alerts-windows-defender-advanced-threat-protection.md | 2 ++ ...irements-windows-defender-advanced-threat-protection.md | 2 +- ...boarding-windows-defender-advanced-threat-protection.md | 2 ++ ...onfigure-windows-defender-advanced-threat-protection.md | 2 +- ...overview-windows-defender-advanced-threat-protection.md | 2 ++ ...boarding-windows-defender-advanced-threat-protection.md | 1 + ...settings-windows-defender-advanced-threat-protection.md | 2 ++ ...boarding-windows-defender-advanced-threat-protection.md | 2 ++ ...bleshoot-windows-defender-advanced-threat-protection.md | 2 ++ .../use-windows-defender-advanced-threat-protection.md | 2 ++ .../windows-defender-advanced-threat-protection.md | 2 +- 18 files changed, 45 insertions(+), 3 deletions(-) diff --git a/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md b/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md index 3cd1bcdadd..dd445c942c 100644 --- a/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md @@ -11,6 +11,8 @@ author: mjcaparas # View and organize the Windows Defender Advanced Threat Protection Alerts queue +**Applies to:** + - Windows 10 Insider Preview [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] diff --git a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md index 176d52dc74..11dde6b424 100644 --- a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md @@ -11,6 +11,8 @@ author: mjcaparas # Configure Windows Defender ATP endpoints +**Applies to:** + - Windows 10 Insider Preview [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] diff --git a/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md b/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md index 90c793c53f..992ae9d369 100644 --- a/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md @@ -10,6 +10,8 @@ ms.sitesec: library # View the Windows Defender Advanced Threat Protection Dashboard +**Applies to:** + - Windows 10 Insider Preview [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] diff --git a/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md index 36ddc431a8..dd37c4b7bf 100644 --- a/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md @@ -11,6 +11,8 @@ author: DulceMV # Windows Defender ATP data storage and privacy +**Applies to:** + - Windows 10 Insider Preview [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] diff --git a/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md index 6877480257..f49c586ac6 100644 --- a/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md @@ -9,6 +9,12 @@ author: mjcaparas --- # Investigate a domain associated with a Windows Defender ATP alert +**Applies to:** + +- Windows 10 Insider Preview + +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + Investigate a domain to see if machines and servers in your enterprise network have been communicating with a known malicious domain. You can see information from the following sections in the URL view: diff --git a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md index d6cccabe82..e043f80d50 100644 --- a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md @@ -10,6 +10,12 @@ author: mjcaparas --- # Investigate a file associated with a Windows Defender ATP alert +**Applies to:** + +- Windows 10 Insider Preview + +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + Investigate the details of a file associated with a specific alert, behavior, or event to help determine if the file exhibits malicious activities, identify the attack motivation, and understand the potential scope of the breach. You can get information from the following sections in the file view: diff --git a/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md index 18f5945d20..5da98fcb55 100644 --- a/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md @@ -10,6 +10,13 @@ author: mjcaparas --- # Investigate an IP address associated with a Windows Defender ATP alert +**Applies to:** + +- Windows 10 Insider Preview + +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + + Examine possible communication between your machines and external internet protocol (IP) addresses. Identifying all machines in the organization that communicated with a suspected or known malicious IP address, such as Command and Control (C2) servers, helps determine the potential scope of breach, associated files, and infected machines. diff --git a/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md index 10f5124e63..cbbf24ab8d 100644 --- a/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md @@ -10,6 +10,8 @@ ms.sitesec: library # Manage Windows Defender Advanced Threat Protection alerts +**Applies to:** + - Windows 10 Insider Preview [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] diff --git a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md index 283a3f70ee..18d1ad3e3e 100644 --- a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -10,7 +10,7 @@ ms.sitesec: library # Minimum requirements for Windows Defender ATP -**Applies to** +**Applies to:** - Windows 10 Insider Preview diff --git a/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md index 5945ac1988..e6475636ed 100644 --- a/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md @@ -11,6 +11,8 @@ author: mjcaparas # Monitor the Windows Defender Advanced Threat Protection onboarding +**Applies to:** + - Windows 10 Insider Preview [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] diff --git a/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md b/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md index 6e210ac056..5ca561a956 100644 --- a/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md @@ -11,7 +11,7 @@ author: iaanw # Onboard and set up Windows Defender Advanced Threat Protection -**Applies to** +**Applies to:** - Windows 10 Insider Preview diff --git a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md index c07da1f433..fd3f7a1d9f 100644 --- a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md @@ -11,6 +11,8 @@ author: DulceMV # Windows Defender Advanced Threat Protection portal overview +**Applies to:** + - Windows 10 Insider Preview [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] diff --git a/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md index 4196306255..0bb75df675 100644 --- a/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md @@ -11,6 +11,7 @@ author: mjcaparas # Windows Defender ATP service onboarding +**Applies to:** - Windows 10 Insider Preview - Azure Active Directory diff --git a/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md b/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md index 31d348f3e4..ab5bc6becb 100644 --- a/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md @@ -11,6 +11,8 @@ author: DulceMV # Windows Defender Advanced Threat Protection settings +**Applies to:** + - Windows 10 Insider Preview [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index 3f3bfbd692..e5bcb34f56 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -11,6 +11,8 @@ author: mjcaparas # Troubleshoot Windows Defender Advanced Threat Protection onboarding issues +**Applies to:** + - Windows 10 Insider Preview [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] diff --git a/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md index cc6065ac39..aa3238f1aa 100644 --- a/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md @@ -10,6 +10,8 @@ author: mjcaparas --- # Troubleshoot Windows Defender Advanced Threat Protection +**Applies to:** + - Windows 10 Insider Preview [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] diff --git a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md index 280361c6ea..b04aebe158 100644 --- a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md @@ -10,6 +10,8 @@ ms.sitesec: library # Use the Windows Defender Advanced Threat Protection portal +**Applies to:** + - Windows 10 Insider Preview [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] diff --git a/windows/keep-secure/windows-defender-advanced-threat-protection.md b/windows/keep-secure/windows-defender-advanced-threat-protection.md index 00af7fcf6d..5f3f2c915d 100644 --- a/windows/keep-secure/windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/windows-defender-advanced-threat-protection.md @@ -11,7 +11,7 @@ author: mjcaparas # Windows Defender Advanced Threat Protection -**Applies to** +**Applies to:** - Windows 10 Insider Preview From 7a33a65de4f82a648445e578d6a859e9288bd94f Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 27 Apr 2016 17:13:28 +1000 Subject: [PATCH 105/439] add author name --- ...igate-machines-windows-defender-advanced-threat-protection.md | 1 + .../use-windows-defender-advanced-threat-protection.md | 1 + 2 files changed, 2 insertions(+) diff --git a/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md index fd7b98d4e5..247dac9890 100644 --- a/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md @@ -6,6 +6,7 @@ search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +author: mjcaparas --- # Investigate machines in the Windows Defender ATP Machines view diff --git a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md index b04aebe158..07fcbf9309 100644 --- a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md @@ -6,6 +6,7 @@ search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +author: mjcaparas --- # Use the Windows Defender Advanced Threat Protection portal From 44fa139cdbf83cb54b00c2b3f530c151bd2d5921 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 28 Apr 2016 11:02:10 +1000 Subject: [PATCH 106/439] fix Related topics --- ...ue-windows-defender-advanced-threat-protection.md | 5 +++-- ...rd-windows-defender-advanced-threat-protection.md | 12 ++++++------ ...ts-windows-defender-advanced-threat-protection.md | 2 +- ...in-windows-defender-advanced-threat-protection.md | 2 +- ...es-windows-defender-advanced-threat-protection.md | 2 +- ...es-windows-defender-advanced-threat-protection.md | 2 +- ...ts-windows-defender-advanced-threat-protection.md | 2 +- 7 files changed, 14 insertions(+), 13 deletions(-) diff --git a/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md b/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md index dd445c942c..e444ea12eb 100644 --- a/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md @@ -61,9 +61,10 @@ There are three mechanisms to pivot the queue against: ### Related topics - [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) +- [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) - [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) -- [Investigate machines in the Windows Defender ATP Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) +- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-defender-advanced-threat-protection.md) - [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) -- [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) +- [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md) - [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) - [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) \ No newline at end of file diff --git a/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md b/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md index 992ae9d369..0299fe5172 100644 --- a/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md @@ -85,9 +85,9 @@ Clicking on any of these categories will navigate to the [Machines view](investi ### Related topics - [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) -- [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) -- [Investigate machines](investigate-machines-windows-defender-advanced-threat-protection.md) -- [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md) -- [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) -- [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) -- [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md) +- [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) +- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-defender-advanced-threat-protection.md) +- [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) +- [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md) +- [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) +- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md index 2daa35a294..5c01e1d325 100644 --- a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md @@ -50,6 +50,6 @@ Depending on the type of alert, you click on the name to see a detailed report a - [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) - [Investigate machines in the Windows Defender ATP Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) - [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) -- [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) +- [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md) - [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) - [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md index f49c586ac6..d660128db4 100644 --- a/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md @@ -44,5 +44,5 @@ The **Communication with URL in organization** section provides a chronological - [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) - [Investigate machines in the Windows Defender ATP Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) - [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) -- [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) +- [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md) - [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) \ No newline at end of file diff --git a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md index e043f80d50..90383bc9b3 100644 --- a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md @@ -129,6 +129,6 @@ HKLM\SOFTWARE\Policies\Microsoft\Sense\AllowSampleCollection - [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) - [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) - [Investigate machines in the Windows Defender ATP Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) -- [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) +- [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md) - [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) - [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md index 247dac9890..8537354071 100644 --- a/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md @@ -144,6 +144,6 @@ Windows Defender ATP monitors and captures questionable behavior on Windows 10 m - [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) - [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) - [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) -- [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) +- [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md) - [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) - [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md index cbbf24ab8d..8be3991989 100644 --- a/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md @@ -136,6 +136,6 @@ Changes are indicated by a clock icon (![The changes icon looks like an analog c - [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) - [Investigate machines in the Windows Defender ATP Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) - [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) -- [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) +- [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md) - [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) From d3571cf547ded0c9535479b56b56416271b52717 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 28 Apr 2016 11:16:26 +1000 Subject: [PATCH 107/439] fix broken link --- .../alerts-queue-windows-defender-advanced-threat-protection.md | 2 +- .../dashboard-windows-defender-advanced-threat-protection.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md b/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md index e444ea12eb..ed73779e04 100644 --- a/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md @@ -63,7 +63,7 @@ There are three mechanisms to pivot the queue against: - [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) - [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) - [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) -- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-defender-advanced-threat-protection.md) +- [Investigate machines in the Windows Defender ATP Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) - [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) - [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md) - [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md b/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md index 0299fe5172..51cec3f418 100644 --- a/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md @@ -86,7 +86,7 @@ Clicking on any of these categories will navigate to the [Machines view](investi ### Related topics - [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) - [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) -- [Investigate machines in the Windows Defender ATP Machines view](machines-view-windows-defender-advanced-threat-protection.md) +- [Investigate machines in the Windows Defender ATP Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) - [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) - [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md) - [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) From 8b641dd9583b4f247fcafe3ffed39d11bb814dbb Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 28 Apr 2016 13:39:04 +1000 Subject: [PATCH 108/439] test image link --- ...tigate-alerts-windows-defender-advanced-threat-protection.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md index 5c01e1d325..7ce816750c 100644 --- a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md @@ -43,6 +43,8 @@ Details about the alert is displayed such as: ![A detailed view of an alert when clicked](images/alert-details.png) + + Depending on the type of alert, you click on the name to see a detailed report about the threat. You'll see information such as a brief introduction of the threat, its interests, tools, tactics, and processes, and the areas it affects worldwide. ### Related topics From 24aa4c8f2cf124529a12e1069fa303e470a51486 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 28 Apr 2016 15:19:52 +1000 Subject: [PATCH 109/439] link to open image to a new tab --- ...tigate-alerts-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md index 7ce816750c..85445befb5 100644 --- a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md @@ -43,7 +43,7 @@ Details about the alert is displayed such as: ![A detailed view of an alert when clicked](images/alert-details.png) - + Depending on the type of alert, you click on the name to see a detailed report about the threat. You'll see information such as a brief introduction of the threat, its interests, tools, tactics, and processes, and the areas it affects worldwide. From 6d935907c64b088ee39fd3063218d41ab945c498 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 28 Apr 2016 16:06:02 +1000 Subject: [PATCH 110/439] add Applies to --- ...stigate-alerts-windows-defender-advanced-threat-protection.md | 1 + ...igate-machines-windows-defender-advanced-threat-protection.md | 1 + 2 files changed, 2 insertions(+) diff --git a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md index 85445befb5..fef26dcd7e 100644 --- a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md @@ -10,6 +10,7 @@ ms.sitesec: library # Investigate Windows Defender Advanced Threat Protection alerts +**Applies to:** - Windows 10 Insider Preview [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] diff --git a/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md index 8537354071..0cf53b0814 100644 --- a/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md @@ -11,6 +11,7 @@ author: mjcaparas # Investigate machines in the Windows Defender ATP Machines view +**Applies to:** - Windows 10 Insider Preview [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] From 7e313a6a7bfd3c504298ad7102d61a3d7fbd17ba Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 28 Apr 2016 16:09:23 +1000 Subject: [PATCH 111/439] fix Applies to spacing --- ...stigate-alerts-windows-defender-advanced-threat-protection.md | 1 + ...igate-machines-windows-defender-advanced-threat-protection.md | 1 + ...ice-onboarding-windows-defender-advanced-threat-protection.md | 1 + 3 files changed, 3 insertions(+) diff --git a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md index fef26dcd7e..9ed28f7ae2 100644 --- a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md @@ -11,6 +11,7 @@ ms.sitesec: library # Investigate Windows Defender Advanced Threat Protection alerts **Applies to:** + - Windows 10 Insider Preview [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] diff --git a/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md index 0cf53b0814..ccd4c5269f 100644 --- a/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md @@ -12,6 +12,7 @@ author: mjcaparas # Investigate machines in the Windows Defender ATP Machines view **Applies to:** + - Windows 10 Insider Preview [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] diff --git a/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md index 0bb75df675..59ed80155f 100644 --- a/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md @@ -12,6 +12,7 @@ author: mjcaparas # Windows Defender ATP service onboarding **Applies to:** + - Windows 10 Insider Preview - Azure Active Directory From ca2c32b1626248134e82f784498f21bdaa7a3067 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 28 Apr 2016 16:11:49 +1000 Subject: [PATCH 112/439] add keywords --- ...igate-domain-windows-defender-advanced-threat-protection.md | 3 ++- ...vestigate-ip-windows-defender-advanced-threat-protection.md | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md index d660128db4..1604e9f83b 100644 --- a/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md @@ -1,6 +1,7 @@ --- title: Investigate Windows Defender Advanced Threat Protection domains -description: Use the investigation options to see if machines and servers have been communicating with malicious domains. +description: Use the investigation options to see if machines and servers have been communicating with malicious domains. +keywords: investigate domain, domain, malicious domain, windows defender atp, alert search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy diff --git a/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md index 5da98fcb55..3e935d061c 100644 --- a/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- title: Investigate Windows Defender Advanced Threat Protection IP address description: Use the investigation options to examine possible communication between machines and external IP addresses. -keywords: investigate, investigation, IP address +keywords: investigate, investigation, IP address, alert, windows defender atp search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy From fcdcbd8380fea78e1ef17b3ae67be424d71872ae Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 28 Apr 2016 17:37:28 +1000 Subject: [PATCH 113/439] new portal image --- windows/keep-secure/images/portal-image.png | Bin 0 -> 182802 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 windows/keep-secure/images/portal-image.png diff --git a/windows/keep-secure/images/portal-image.png b/windows/keep-secure/images/portal-image.png new file mode 100644 index 0000000000000000000000000000000000000000..8785079fe6f511942f4722f0463cbf738d7c5008 GIT binary patch literal 182802 zcmb@tWmp_bw>AtBf)m^=XmElC4IZ2c7CeNY!QBbL-CYI-&EUa3xa;6BXmEFjx7qu7 z&UL=)`+I&c^wd;WSFO62)LM6ks3^%`ppu{>ARu7Kew6%#fbhH#0ReFp83|~4>p#B? z{6n$*sO5lwfZ6%ONeVQ+a+Fn+dbRw5>=hl>#|2v6f10E|JBm3un%USR{3;#% z2sEKP0!@;}4o3FowvOgD)(E&L)HFal>QlRfjjfx#xv7~WLNV5$0MLs0PpiGL;Zs*C zM{_G<1fEMQ6yO(>r(aZUOdMSd?Tr!iY#*Pxqy00uxr33VA<)$xq4rNz6wr+P)U0V} zZ*6XEitvYYBM4}F_3!;o_D04C=Z}87|LrDWV`XJ*?TBzOnAi%mAw6|dGk3H!MkqWO zXFx!pLXeddQ*%wX4Q=K%lC|un$^OZ zsksKUk5=cK1cg(+X?f^Ufp2IGZQ2)UzcE}ca(VkK(7wi@`atD3a(Y~c73VM_yy-F0 z+6Hn1V3AB5t|Evil z5wGS_>#z6kLM?)Ed-gSgVxgt}dLY7&|6LanznvE_>7qOgI(2yH)HOb& zCZ?SEUwOQS4FC69QZG7Dx=g>B|1*65H6$=PFX-Pch3A;D_8l0LaAax=ykGyFK-y4x z2!u8|GgBYViVczepFym69O(Obra27TU+fWcK^u9*Cm6>gwEkWEoJD8wS|$BRx>mCl zHY6~nzw~K;fX4(2$h7|-Upuu0V_Pn@WCTvaF{v$(Q5ye!5&#FX|Euf&1*_*$zYYkH zLAxJ~|J`R~YRL?m|Jm~op!o5$eDle1Bt=+%l?1TK4V-BI*+|CFpHS#l!*Fa@Sl{q4 zJv)081o8&GgR!#ASj%6W8UWDCmoJ4L?@revFMDaCme1Yo>UH_aFx9FpOXR1W7OeTa zTfv2ejH^!M09dy|1;qXi!uL!^`3NV(ZQD69pkzvYgA2OV}H(%X* z10yIERO-%5a$_V71WfOC?K`j8^2-%9icdJ>I0yW*Lxt3G&<3_7wALjoe?MzRJSIXD z#s7df7z)J?g!lG-d_zNX>?*{cF>DXdQCDZhnDTC=1P0XCg#&<#`w!qGF;qTHItgUV z)L{I8ZPVhR8WKs@_m`TdzIcXsa(X((U82ip`Xf1+2m*l|U3=E)mf9O?!nhsvdVq!4 z*Z2E>{dEvJr}RHd{1dX~B=7Aakdd4pVyu;iSm$p@1Pqm~#Gqoww*iRd>({USYF5kw zrm|bWWAhU9P#XU~v%wKkzN@GGo4BC#jYxXi75;_ev*FD7wdd9S!?;}|egHgHM|MkH zUA?`u5chv+pZ_qfpG`<;yLF$B9-C(UEut-{3?R-Sf+Aog1%)3SwLE0VE{~~RI z$`qH^NlymG&8=9(v6r||uQUSX#2g#KgD?QJkEd^!D|wEVubt&XoHq zrt!w4rRi+1$^F;fCH}S|l>#Xdn~l(Kq1si@(a~{wUfH^z??^d1a;N4SrqU-G8_x4W zp^1y7%@^93lp=#aU!q;z?3VTQ_Y15Y)BV@Rg=LVrGB+3mr%FycSvMU^m$uwkKyq?W zUOdCY$IrNEhBBfaA0OYX61IN%^8?ZIY9)x}bNTYw=C4)ff3=&M?Hx)Lq^3}_jKXEn zjlt{oBCoJ8`0nmbPI$P+>Sr5O+m~o03=-QVugjSD_|DtIR%J#!=n*H5^X_l1`ypoH zanS7jfAFzNCM79(bku>`BH=oDj!O}@UFLAn+!Fx0<-#%Fwdfay0K)Rl2z8n5xU@2`mK zI1KCF|LbbSgHb!Xx;X9sethQpAwVz5YM^}zen!C&Eln}gWKI(lwT?@k^kFyB>!YO# z_~laBpK|i_co$Ce=Vj9aBi`DBg`}2cW#i@gwOxy z8R>D^5<#)i(H}U7ikJ1%q7BC&MmDKeKL@WZ2#WYDH+y3`EVUbdY8m+W(PYzQ%+nhZ z;VVn3tEqJwC+SH8nm1sXRL;znO8=I8%SVc@Df0Jx4oOwM&k{wQ(p;Oslmic|5gNREQX6v%wW3#My@n(7yh>i?&wj&yyt%+qk`UjDgp<6?qE7fJIZ5=+Z zaqU91I3sz3MK(C8X)v_xdoLR*dO5A|r1?pi$7?-tX=wvlVt!2b$zwS(M)SODJyB(6 zM)}HMeF2Jz8mo)LC1rd2lX~v@Pn&Xzigdg+?jo1!e6{n6mj`g=_eQ_1X15kUeoCD* zg7+tU!=I~zD*=Xh{o>1CvM*gbR1eig7i_IQMvuuW%y4*vr;N320 zKHt7H1{&8yx!qv2==@IhE%EB%+ws;JXgI6wsP zD%hRzGNd~v>8|~?`~UatP1YZx+Bce3d%gQ zS=tba{N->;*;8o_bKe-w9QG-=OVT=RF_ya6mvJSskb#R#s`GpxQ9|Id3J8zzLFEq^LIy|cHgOTJCW)EKj4$)kW@N%vT zcx|cEb=M`^NB)(;P`b>)uoNv{@kkt)O=#2MmBh>BY@>vo8ZYXt%)qAWww|iq`@l?c z?a>Cs@2S;$?GkY!ZB1J=n^q5w5|r9!_xOm+P3v8kqK2zwrGhJNag-k~AZl3XRQNb^|>fVw2>)`NyMu#6m2jZUpKYx83S z-y#(c5B_|Od{G_{)5?46*V!6wUn>bsw?3S+Yn1Bt-Cr(^Jlx;PM~PZYFm{I%cL2e> zjJ>^m3U7i?%ikHg+So6iP>1gB?sqN+x($xo;z?|JpBtT7`}+C{gp@2TEw>$twyqd# zL}%-(t`(+hn5ryiaR6s*tcAZ=mi77_D)J8If)d}9EO^>#pmY23s}_M2BI){H^OUfZ zd|6#xGFjOkQ4YX^5Gt-@s}JhAh5JrNCzEUT)hh`$*_isg^CD zqfz;fuiuQ4uc#5}w7zFe<$K00;J7bU%a#!W&H6H5u0`s8u_Kjcg29P~%Di>5oV#xf z--0(XkZbd@!gs^T;4whc>j7vW1hXx|(g z)m38K9ZTyzZ>qzI-GUVmTIulRN%YiQDW}%5h*Z!4Uzw-#|BAG(R*T-HZyr#zQD(XY zWq4c$ftL=3njS9%$@*CMy~F8Qw`Yq8Gqm}HSCCO7(rW47vY~QQ!rd<*@&z?{@HrY1 z2Cn53imeZFo8D*JW0*@QUW+=;TjFJz!e&z(4UTD0snHrMopd(Bp?RkqnWUO^daftW zwevI5OZuoNEf9CT&v1Pc>~QF}cGW67aW>%mheFg^Y)#>T#Z$j z1p)Ru1xw38mFTSfe5)XWZ>D?Hg5SXQQfl)xW88{NjY+6I#0@<=OzTrcP}^20DvAkp z<))W>(c-;19u9)QB~*j^~RDe z2-fxY>I7`*9n6Q`eL;sxCKv7axx=^Nkri~?3Y(ceO>Nyy%x;(awaM=f1?eM6WkLFE z&c}@EK9wz=cX~{so?Kzm25J4{le;O$8*!ZiR8Tke#4`Aw8SgGVB{GcUcQ)kmA|Cl? zl!ND3O?{UJO+R3Hr#-TVmG;M;i>~{M1P|r$f{it-mlF<^d>k&{DO$ZQh~29#RaVyP z?@~QJR~nL2HuEKwq8A#TMKybYa!1~PZLk(NJr+mD=eB^9$cqOfP}M8?wtTK21THdhWkn_M=!96J<9OBl>!IwxV%*rePvkqm!BX zn)mTbQS}Euhxm5RWzy}ytU5IuZYSR?=S}+K-vY-#99&#t9t%7-H@Cq|;k58@^p@+5 zH2Wxclbgf#NPT_%-b{rb&-bbH3(qCbQw(BaV#~#*`ZHa+sFA)tYEI4=b67qQp0~Al z-S!LBs26GESuxpt74#i{#3be23*QtP+m5U>86vs!7CqebrXzzZIz z7S`e96+ILfBJX4`q4^ig(dS`7p&`n6LT;{Dg{($A*e;UySNrl9pL4c5%aOGNBUKmwYls zY<~?g0eqiJnfA%_=*GifMb=DyWPk)g2}utgG3j6u{d^0mO&?GAQUQmgwx@R22uXi2 zZc+1rYy^M$wDwg8T%WD=e5C0v$>4NkzBJEtBom$3=~X1f+bb{3a24#Wm?kbOfqNRh zcXi5qz=5MJ3;d8M(t6EYCgT14c6x};$tSw4BM4zM%gcsM{#Zq{o*lmPoS(?f%Vxvp z3=uRW&2{{cR{wZ2u)UDS40ku^V<2@&@>n!^03FmD;-$g8J~tSWs_J{j6JSIpDH+XU zt)501e7(tCf@Mp{%sI89HXoKK+??7V61g9`E?(af(J#8tz&$Q#m=6{m4}$GyZ+)R}C0R(z^N1{WKJnR_G(~uH zT~Rk-TkK=avB~~>8*7qeF!E=Em%a5^tA2B;Kn6!p!&`CKT>tW5TDbQylXO7T`yN-o zdG8~*=+NYbiYE-u! zKEG{;bKzV{Upw}e5xAG(=R-`#y;0vrFnFNztqtr~NZJQ6Z0+2%2T%_Y*Pa}b{_XdZ zP$k$0Kn)-SCpBA2o4jM5@2;gNT#r!Z7VbQ{AJ3I;4BiL(v|jko9^A%y95#XvHLMGi zmk@Oe#~Lv&Q#L1(MZ5&y4Nf$4bOD@3-MU$c=^08H0x{|73bocNZiYAKyE6Lvi{?eq zgyR#xRApslSN`}uS4ercUQEAW0dF{eX*qjsCom#p8VQB|rC1!;ITtiv%;)L|!ZPYz zrbZ{_O~-s2G4tCQKgaP(tCAiQvyTUI*S_&N2KEitY*_ZPl4-97n@s|QyE0YRZ zM~rVDo&_o|dd%HFRESV6sGn-gR$mBCQTieJc|1Qp+n);0b4ZGAT^F4C#(yPSR`Yr( zMPF9L#IuqJ;Uy_7_Y5lvwhuW{A;EgMCdVWnpc6hvYe}yLZwTKa+U^RwRM=g>gt)9k zw60&~7I^hY_&l)lH~EJ?n>ciR&gU4lT5IIf6UyrGmZg8ar)+6+Y;(hY--fc&YU8MN zcA(yV`2)gDWL>1!X{(_`eww$}+>h3mUa8$24i_w_;wvJ(83HbCML{zS-WZL)nIpZn zzqdeak_PH7f4xO-J|&*YXI-1}UeS8==DpB|M3t_?u?TUN3OTXcBouUhN3MvrJ{u~q zKfHJOy_NCG^&n&R+uw~iyDwNe&imctPAo7ML6xN%PS&_sR!neEF}}gcMe#Y2baeVp zPnG!bY+2u*iC93Sr^D`@wgA>P7E2G&~M-m5KvbUE_tGXn<3wN-l z9X9LMO*ZGptG8g*C7G{r`F{`e+sCbl7v3EqAvm@sJx3GyJImMlhM6zwP}DnWLKsPS zK8ShhrSFjw=1bIaD_pt;(pE|s_;S%TO;}1lm6mt8=RGCpuVwqleD0T5VYU_=ZsW|B zBW!P?!BQNKfz@?DNFA(A@3QaceY*L!>HeX>QN`=dVgiBUc8Dm`^$uJAMhI;103kg0 z5s5VIu3AlMeGqmdgi@OlV+uO$sNI}anZx9YvMMSn&{-btoT!Vnt3#Wbgn;N^00>Tq z_^ipo2-!`>AX4F^e36@(9+9Nhb-uNW?m+6!Ape>6_;9Qh-J@_ttTwT!fRekr!2Qkn z8UW`iYxqsoZBlq6xv;xq{XO*e&?Yk%*Xfx7)eHfme4Y_lOn0#YC2cyd!gdVDTel`$ zYKisBd0MqZMHK870j}J1iDpgB*kk zE)nVvBbD%U`u;5RC4RFF8I$MnBy~3%KhokUn0ID)wky1gw5~$gXAUzwJHmxkT@ik6W*3O5WrUc^fOYxL&fI+zJnjKHMi~ zn&TQ-8QJZC-kpf9CS4kIi-JAFmV{1d%kDSbGE+HH#N$wjXFc53`<9LmbRK(1fxu{D zM8sI^s}If@(u=#0ri(sD-7cfJu?!Zi=1BL77)P_>(=I}J=DMtv$k`fmaCsl&srF84 zmoI$wg|hoX2p*k~KBO}><R=Wq*V@T-6sQi4~2}i!L2Wre#9<2k4Y6>hoZ3YAbS_{(ZVM4+xPJk~y;5*TN}9TO8+opTDYm ze7GH`URT=$q6UkE>U!w<#ztm7X{F+5xf$#nmF+u0U%T7sY+6h}{(BYmfMO%!J$SR< znVw?3#d5+Kcj%SjkkW*zS{RVHWkC(IitryYv;9RplPwk0fu z3qGZ^8YX;uce}=3cY6&IvNP4Zu+(k85e`7`zX`TqWcb3m-g zTgKF%pYC)_vgMlNe^>U@&rM4>6=r?-aw*2GjJqQ!Y?)K;2rl%;BsOz&v%x*Zmc)s8;;Qem8>@wzsmp&eqO0qK5H%Je6e(!j&jkM@K@s$4Xaq>exY>yxixTzmu18Pd&X!!iHqzX`m!0tsl2FWk`}DmU7tvFa%IQbG zCMcH>k*@<)7k=xl}ryLd$U==rs~3A<_2z)hs*7S*|N2lq?JW#tG%b2 zBkWvuqagrt-1>VIGX$#7HcR!QeCjiSV$?>9>iylaA6BAPtl7@QFBbi#np2dBCoJ0gj!1a zGXo0k#0v`95;=CmG3Tm#3$=<-v?q~?}hLNckcLa9f;9{8nbrz;c&@xzk-Nf`1bYr!iwmyU7z07 z01e;iL*v|L;r{n%uj_&*_&h2r#s!xv5=?%XlM#21ulV~#{oEczJRLUZut%dVOI@5;Wup*+PT<}D(8G2<55KBnIl zAyo9#cXWZ(-#HBm$Tv!t7RAytm7Se=-NZ7O-3?@mF{HPrset@}Bs`(j1N+dkCUR-P ziD5)3wKr?VlcH(Y`JnNV@6Pz{RXEWlnX-tdpeX5FtdH^yAECt!>OiThY)UGVuyBTS z1WAIHY3-9;64O*G!64<0j)?)8uvnqM0!>(TVk&(E8!VotG5vp{4Ji# zt=#^u{}p-CfE3_oUty9l!s&tRsN>6djS6Q2UVg)i_Vv8^N@rHn^_thH<&I-0>XKbz zRg}8JwlXhj8GddR{$4`AxdTZ`2i7Wj??esG{Qa_WqsWqcim~LygFlj~Fxu=YBra)E_q~BnPb&Tr_UCsgf|MSWXUPsGUNYaBhM_OH-o6mOO^it-_ocvZ z+q*782;SvRmog{Ss<|R5QMKFz{-UvMe{wfnBgA$A};rB6b51U;2r(wf_z3kGM8#zu$hhCMj zUX8HXCSzugOUum+!tNEPSx=5_vBhhVwD;!oS|>xgiTPGvR|suJ1^QopzIp=*W~rQt zk^2@;*vcSe!q03)T&cOg20mmn+-{mSBTgEjv?i6%KP8=M_|9N3lG?FhmF9L|=Cblk z!4cxsv&8iTE4}ljV=P;k)n&zfmT#>gI?aKn?*#t9)-;q;7R2c(>cZ4|wLNleKbwg* z6}V7bjOJ_!x&<;o;Sr>KiQvNi8WlA@#T}XG6gLFbNoCbS6&0(voZC~g*Mw0(DF$Ow zO}$!|&-I#?5h}(OwczxelEE#x)xPI=D4XTM`PNp%jG}LEy+`J6AgTt(PGFi=rKK1FtyQ#w!i-}(WvsKVU5@}YvUszBxzS<27d%Qe*HM#js@2eDGEey_FJ&nFCldH2fN%+`)Rz{FO9Cx#C%5JARW$&GCK-N?uo>_k{kk5w^)4<+@v;f7* zG&veuuTlzqMFS3~Z2bm%IKfrJH_074{LPC_A@n1VQ-s5>Sij~+0;$|XPuvLFW#r#^ z^N#HWC<+t3kD}fn1V62PWZPDNPj}3Znnorz{k0U;E&j&f1L}`}$6G;o4J%~Cm=(oj z-}vDt-Px9?zhWci^P|-z>rK7L_+MZppA+lx<{-vvrM*+ahd;|0OTY+Sp?O_pA$ouE z^#pt8sxr$oDgHXzU*y@tmaQERMdKsiMgWlkWPyg|!9*m;0r8fjm0}_7QaX}04}?zi zlI7MKv&fkYQBB{~k!39Vo`LL`@iKy3YGrt}V*1*n&Z_f+H2QW>rI~1uJ@xID=Go3% z!gud?KioxLy^MPtS}5DJMHod*JUs>RRa$I!!)kN@Cs(-NF5%6ccvl{%LzxlG{GDd) z;a!O7;-mk9-n{GPfRU-N?}S!u8&oer&+gdk{(SmuYwWoqEYihX1J4nEszg@|G|ZWP zvmKoaE_5J^X#K>3yT~{_3CdH7*>!4NnUm&!+IYISw6jXJ)hJ} z;rXtSa-Rp(m>DICk~)KnUcKAuUK*#5?k{xN&~%A=Dtv-af?RAcM}(hQ>Uyl0@DQx( zK9yOktmYH_{a>J>$2ntY{I}* zmQq372dWSH`V_OXvzG9N1Ry(D@wF>dPV?t~OYMM~5NK&>4Q2=?)jMqBU}KAY`$j7Q z#sYk&m>42JfFT2HCO`?P6sh?y*~$O)BpV;!Wv-L!NR&T(ZV<$y>I`-v%_XgRl6a@v zz`#Jq@8Wm!0F^*ju>>1(5m&C0Mn0npXGKV&ME|2+)}Zr7ay^BhZwS|nh|QB49nZ;_KCLHFY3J{@M1${D_r00Y0Zt zBE}A8o#X_C%@9a43WY7zD>y$L&U8O6Vu=(T&?B5Yegxf4W>wJ+r@rws4&c|M%h1ks z2zy$fBs^Ec<@rD8dfH1U5L*1RtN)vL^nY;;YD^)RadxWx7c&za?oNCk06>R8K2RaB zVX^5^zeW$J4bd(+N(4WN3YZ##(4mhuu-r{qrbhALIT;X@C{~`n(W2WvJGu=nhLm(d zW_yhl%RoE#&^x{k4(Ofp$$Q{iqDA$;8~4NtgE+s%Y|ysEi8JsChtL_kV{oFZ(^Gd2 zjm-ks0_R_iiuURf5>jG(q0mBT=$lE4fAH+^29N>BBmM=vjyAvPnm-^+bhCEE6EOy) zB9(IVH`LmR10Are2*XTAa{$jo(9J_#uwF3~62Axyb)>`FFkU=UcUi6k*nPJ3x~BM4c_ge)YX&6(u$0_?jgFHr z5qmsx9~o{VvhjezMGdj=WAm5D0r*XRVxgg-N-dQZ%FYnnXJ0`eka@5AB$sI0oNffc zlXUA;zWro+8U#6dqFRt(tZ02ruiC9^c-zwfLEy2aBHXdOM2k1_R~Fu zvQHG9LUK=$DQ}So1HRzZ{aWy9jo?Gu+;haEMrhNj_9r+-fVjH*LO*JNcyhj*hGA`u zdQMTO)jU8519UUdSg-1I%8{@RVE1pDplFd|2E6_0ADWHm8Er%TQl~TbeBy)P*zQU*n6W|#{ zPVXi_?JHCmB{_%yj>-TJws>${a=vUB0V@$u_G}>+O}(5O%|3 z5Bk>g7p={=?=|+=pA~4pONw}_D@gS4E$5}Doq)0kP}$EdFF%50w$j_z>poc`i6G3r zf0nY<5D8%{)^FB!Z_$1BL=Uq7ul~7RmoLK}Bn#mZz`4*oe039o%ka*6fgfRYbv2o5 z6Iri8H{D@+%ED2dDJ7txq1{^%Vy>N%Qoo)G=&RO=%ken%6OILckzA>_xLU&=sW6tnmAes!*dYj!zVKn`tm=G2%_m9Y+u(!*XKP5_Pvd~_+U9TtA zUoLudh!KA2OmGBBkUsa{EuDCFiX+Gc6M=FhRgT~jw-2QG4`p#!UZTckNgp1;FUn>5 z&bS{B35xq%CtiD_7biMk9g8r|3dqJ`alQM zL+pom5S~&u8sXC!{Kr1D3=FV(2UDP!4{dx8bd}6AZ+H&y0`q@jqk`~|sc>1saQl)0 z25TV`jWphfbo#*FY~}X{qM0ggeV=e`^u*R^d-FP;q=C#N;62nu4{Fi$iWe86`peeb{m_>f_%7(FK`#B#{#|KgJW$ zc=^mH=TrBZgy-3p$A?s6X9gut@*jc}u32)CE|cn-hFS!P#u=yDjaZ_096ktm^K69v zMG+8NdoaHgC=?9-wBa`qGE)CDNY5P)U-2bOXsH^E&#hQ;mc;0!dPVX%@$DhAUEisj zp6BgYtLtfzpjP4hPh9-wovOai$~y(}3&6 z4~hMvdTQ~BXBaJIUyL-^e7_W0C;^1tyU}cgOizDo8l{;QA5ow}=SXVTFQWloJs3D_ zZAI~Ms$G8p`1{YisnD#cAIfJn7}il}Ttu|rJ~M_!Km=?BxlzMHM>E*cG4WwlqmHja ziQlxABdfctj^m>~N3`(F&<2e;Va#)jfy%AW2B1H`moa{B6F+%I;N6;}T7r>Z$i(zT zn-^f+&97kPGkB+bNk#l!8FqB@Mupk!y}IJ_f%e~GFm=lTX^@&)7yUOiywtFcT=T>l zZclVvw3mA76_%t@>Y#Ffv?VpElE4+s5|GPKLjeL#g5SVy zPd0O26bKJrs)G4Gb(YsG6-jMum!(rGe~0blqGbI(rKo~-i4qPJ-yiOvC#0ugX0yfEfQ@@ZX>c^`48~SS<@RTm z8Dzzbazjty{wc82jBy;h+W}&+#gu;qmASm(-w^ zK~_)kjt_&t1?z>JceygSKlA+tSx?>WV3gOp1{5^sm9j$D{VYNhgf)Dbw-gUtqT8A6 z-E`oSaTnsd)3zn?!mJIARlJu&m=#V|Bp#T?M%l6BrD#LAZ#bFI{SyjyFi|h9sd<{C zy)`dBR1PSUBGJmU%z7-nkie((}G z<}#^9!OHiUz`zH~#Jf679fz;U^h4S%Sxzu%vW5B(IPqw`s(iWl`dSk-8-L^I-eus| zGz85mtqTX0*sQ^?DMwJN#e^@(=}^9yG8`t%pe}{B@!R>@{*(I|4fR}vq4rio_d~|+ z`{>;~hoEm95ioYX(!xR$#N8>I98j2Zr&~1)tQkzwyW&`GIQgzBclgX2RK~sa?6Y+6 zj}?>Na$ljx1Gz{%J^9>c`AtLY=1(TdX^zlFNMpr$fV+2SKt_GUC$pt5j)BX0@ADfa zWRppJBIY&UR}{;>aSiNIfT08^o5!;Y^^+R=tSF7CkSui%akWv$xN}jK9*;>zZat|A zo}ceuT~YI3=)h)L>|V;rVP&>#($}!ur}t2LC2N3vl(uH92}hbEK(;&vUm3u zllzA|r~y8S7|5Ew=2@a~&bEN|aVrK4+3+(jX3%qW5F#lJUZ;3h_V*QQc%p1?Rp=$? z!z6-=I(|?`hy-E>vSIpY-e~qyFii}Dqel@en>kbOyI)XiYmVwsIP&256bBj`$9r#Q zGcsWo5FF53161<$*78s4y&}#pCg<@6aA}!qgG-YPB0sq%8=L=W`a~I}T<1 zg4D-vA5UM>4xhlcj3gKSNj@1Hohjk`F+bS4qIg*P-*!o@$zN+;_!c=WmD;%~nhYpXv{2nCzC zE-e%iZ4e#B)gIOnI4bM&jdh@t96JEUn9K16dq29|;};O+4@`nVq*KRutE)`gJ3az! z(V#r_j;Bp_JNe5bxR}?=t*9{HU1hbG%3(6CVSC%e?^u1-5f6EP+qcBa6H*|J}|tW&mA!4Hz?Kn^IkBvo|DVj{?nb~`Sbk>l@8t&#iYh>o$k zi;a$Fm=o<}%Qx?`-{XAq(Hx%oxwe0pm6Sg@CZdB-s))Db_=UsAC7)zSyO5=g*IXX= zx7|5)vZ1$Bzd<-5m<*vQLy1nmzL{)}=em8z*_HX4N*@ZrVd~vbaSpz)!l@V%-m=E3 zIN!xRR6$8WntgQ0=NBna1E zT_as~k*u`qaJE17D+DR=S6o&=vUc55IA>DzJ<&;ZMMTecdsZF&KQ|llQNtwFc^vQ0 zz!0l>dWgQ)Z#1r12il;-2uR<^%)l5~96iR@3J`~%o8>}NMEV^S=oqESa`A;;^=zvV zng%g zdA?xZOk?7?jKYn}ZlG#K@6b#~)OXDBB4tzEP$y8M5NV)nTw+Gw;6qFbm&rKv-ndH9 zT6|?Jqj;`7qx)?Mqrh*!gkRr@XPU{gqZM;5* z`hCS2Skq{;+=L6W-~5i;XK0aqHde|q{s~sdcO|!AQFoFC2K$x>hMero1dy0`6ATb~ z2R;924MVxC@XIxo9IrD(M@7Z#`ZkcN{w)=o`#WCOoRc|YW=oajYqwClx)r%{Y?g1P zH@v8k2XC^ZVu&_-_`^O$L3i;?$o}5iw9>^Jd=THo?38&w+c>=%eyBPx?sR3Qzci3} zmQf|Q({^x{;krh$HZsz!k;T#aTIX~;7exDgs~?~Nsh!S^`ekqn;)@m!TVB}u{op_c1}#kC4zA(BRx=c=8yt9z2S0mz{93Z zmvyL-pP9iCl3?^)qEST3FY@D?C0TJ$@y3gH5$3#kgIq+@d!DzFgj>HrA?CHN4QtOy zOSwB1FTFZ9I5wQvTYv17vXc$a19+yUXioeYg!gyZUtX)LgVfcZmA!^Yzh8n@<(r$O zYTWRZzLNu9-7w-|UD((B#VI!3{Vrkrph-o@JO(FnjV(ypeGaS1(~NF6@+z6fh9E{D z-J-6@oTQUSp{>#Z(?L_9zR6g~VKZ+m-@~Q}GXP2??#*jCAnxS8y=a3F;bLR74#g)b zltjXcNr{WvTow@z2$&&AhDOep*x5d21Lol;Rn7jN^{{M@Ly-wI@^3@gx(!%OsW;x_ zs$;#g-pDqN5_47NeiTO)m%aA(KgF6T$mKyCr_Z)RDHX?%wFsaviBI;Z*d&sY?r#Ut zUE+{FsB@y(&o&;ucBb8XA01?#f=48kC7E&Zo(UR?&-8U^QTU2xXRJ|K{?6T1yg05D zDbXqcAmX+rYqW#O$tXmRk3p7#_VF8>=eA47}y86(&Peoj#cn_cpLV zG%Bpr;33d7{`1$A%{;#89rIUxf0)f)Z-2RMz*o5ai|}4_yY%WO+a?T_Vgo3qPJ+=TX69vgGAtXzB%5@m%bJ#6w(|(YD7`TNxT;I%I;E0 zo7;9dEVw{*lZ{atflTS0OR@3(!L!n)-+Ug^1ooq-K@v&x0Uf+3!~``~*xU+uU0OmK zv)$PqoET{H=uwoc7{R=ZZ1@9gOqss3(qkE&bhNJvm}j7J4}J0?h&7P0Dyi?OUDu4L z{-fz^AH>x0ic$Ml6U|qTq+pGQ_^#x<*(%7Du6GsY{^gcHj1FIG;|}AGCCxIlBx`G; z`AhJ^jA*43HD$}1l2y==E)YRpvp8!kxCn%=qJ~ibL&=XYOf3xkX&9fu*k6M|_Q0P? zf2DPEkF%OuMVFl!WR)LL%2;er5pJoB(=1R8VKkLBZw&+_1pWCnkl{Pbi9Ex0+F@R# zJ}EgOzrKPsAR4<}Lv3&ML*{7i%l)`DWW1Lu+zc9wKSDy*)Qlnm3PUVOhql{_)=yX0 zuqpxuTpwGbI1ekauD{5+z7?KaG1}U)3vYtHG67M%drbWy&#^}mCc}>Lj(f6<-Xz z7|5c^9n0&P%&o%0Cg0Av34aU zAN2x8+W4QtE=-CyUh^7}WJ0LNA&fN<*zd|&a9Q6)Zpfa0zU~me=$Y)$D?`Lk$A@t+ zM*cDu&$3FZyW=Fi8hY@jW^mQm%QF1S>n=hm`%hjq#Rd`}abZ+c z%Q@$*-bhwbyDr{r!>Y7c^&bkbKbQrs2~-*T#%gLS6HjbWT0cLu2LlV;_z=u43>d> z&{v5Q`_qpf<+=~cJ0yPYADv5z=;J_kJP26)5 z0)ppO$r>K_t3A_tWy{}OWl0fbmHOHFxJfhL_v`FTVt`?$t5=8S47d0UG%WG0;^zuG zVYzbZfNR9mnjOhpW-#PKa6X&zRXrLAmVg8oqQBoaoO(HTG*WOtr_EQt-y+jHGL%pC z1)CT@K()G$y|<_W_jzd8VJvE6zBvv$(pwf5+Wfr?!h=o*&mX`S7V;4de6ByJ)RKxT z=kCYXo~}Zfq@pp=j{A56OCz}yCWPZvRz{F?nW&g6ZB^sy4ALAo>PH0=V#kHz* z(0EUx(2*rOz~-ot_Js(k)W1~7`;q<1qRsQ>u8PKr9DKYN7iE+}J%`y4)4C*zME9Af zlzWCgAA-F-9cDUMlDTP`Ou!kUC_C2tLY&~7l!qo;jEre?^JH;P)RjobLA6z%J7)27 z!y0u_Z@$rG3!@TyjZEI!W2MWYoxS?{qYprZKbzIBq%(%$;>1S#FBYMG!hfs5VgTgL z@0q-h3m{)5EE&HXa!cWWNWE7m11uRdhTzmhFag#?cKXuTZIxunr^(dtl~KZ!=KA zLS28ye$s)>HAMVUtR74ur+<4aTvaMB3va-U*%(au_<|L-iBmT7QIko=$&1x) ztnFttX$mKlu8t{U7nNQi<@p$n<3~=9VHWXEIXoW+=qJaz=M;6!lR5CKCy}mL@Rg zs0v)mD*F#^Tc6(sQSb&O?;C1OraSJurR|60CUnGWaRql}dw1);A>~_{MTr!u@wFYy zZ?Y7U8ImurZVpo^e!+}q+Fz{IxkivuY|l(5eGxO^UShmybYz%mF=~EowtuiOgV4V6kwjq1?`?EhdTR&8 zd#5Dai)}qKTaP`rWNSE)*LAJOjh~Cjy}j8QU{Z41EO@WinEUDN2irj@@TwVugp%yT z&85$>8wHh0raW7kIAM`?$)(#@suG@TGnBP%%@=u|cjh7#uVv%805r96ZM&ha*Ekz+jqHSR?iv|ZK$kG7?wT1^#0uTr zRmlu{)1QnICw7a{Uv<*Eq1zAL`BiLn)LdICqn^>)viqq{L@HkLfnsv{YPLEdH@~LM z=Rh|K+RkGh59`@coF^8vqsLw`%q=zak@-yBYqjaIbn~w4Z~n=CnZ6Xt+i|V3W#xCy z)rKx)YG3&d;ZEsZux7zXzfCs}y3@+GFC2UFmh<#@sMrzGm!J0tT3v#!Ji*u#QTzMb zZ_`!jw^{>U*VPaHI33DYZ8^@v|D^^>WNLmiNt)7L;jhmS(d?&5B26|QAYZM8kw>e` zA67-S@>7}!+NRi(%USfi69fgRy|*9!9JBNYeg#E%M`(vk@^7I+EXtVmRhTB`JE@OB!bvdG>-# zcecly=~h(mf^7$euG6IY?NPcu`+I%YGwK7MBf~ily?FAqWL)Ky_&BB9Hzwg<{Sa@s zUd-1F`C$otaB<=D^78ujE`^##;zX4;{*$i9ezhPg@Q&Ors@6;pPFbQcfC*VzocP4V zPvr3jvo;&0B)}v9$TXpFp4&Kwusag6>Gq&-Vn%*%y(yr+m z9%N$M=EPP<9h(z76WdNEwrwX9+qONiZFbDBulxDl|J{9@XLVKWs#UAjR_dydlaw5l z^Bw&i|C>dUG>(`s21~^DM$hNuB*0g2TEk*RwWyu=*_M5PvMru*paGyX9)yJWTg-RNZ=vwsr8X_r{^7?SYGFciGNA z5_q#$`zPhon>R)8{p+IDC+61E2)FGBw|S-DNEYfGby1uHBks6n0h{L|b}%P95E>jK zs9~`ZlZAP9$Zrn2MxMZl&aqFgBHX|}0FU3evtkyQkW?M=& zkC!5D#PI(2u*+M_hOTN8*^^DyYc4NOWupnLUF{i@jKKGEZ#&&;Kb5rzuQx}|>l3ZZ zLq4i#MlXJMug^1KxsKS^OPu}_Q}0w>)2ST-@#xJ-LY)uyS6jEkq(`3Ck(hWoQnIwZ%N6(Ftj;;8mDi$MFSEIk{h~2E$HcRQ`bqj-mB&2cB zvu25QTph!k8-}({9{^z9j4oRHj@=WxXTkp*n+f}YL+t#L%sabpTDDZ-KU*etln8}qrDNVRH+$=Eae$^hivS$HRkz&Q~f93Py_3;>d z1$t<=A+8(ed$0q!`U0P7=F_&6q^5&YTJFwsZfDPI4>yL1SUM7vxH&5IgjJC|AUf$R zmuv@CB7R7SRE0E_Yprl{w<5gqx+9euYlx7d1S0?F}m4eQg> zMMtFcm04?o1G>rsiad9t2w}wf@c2-ncb3#Q)F=)f#BZl}y2@y5nXuts!St$z#eD~E zRzXi>{ejDD@Q(Z&I0O%a@od~=Nhbayfd&G)7H@?=AALWEhri_AU*nqDz{LnG^&SX# z6MZS5oHTqdAljXSB088*mf!CrdPAO1r-dsg@;MncdwL%Pv@;Ca8@U`jI!XSM+ZWDx zXBm#Uk9u$g*r8p0`fhFi^L>kMQ%FC`_R5sK@Sfl~MITyB`cm_e^m+X@C(9WE9?!#P zcFgn*^S%JQKPjJ&EaQ8wmZ}U}udXf53I|SMNGq_geb=xwts&MRBHk8iI{23QZzW0+yy=JFj;r z4CX{6a|s#uek7R!Bs_LKcD}OV)gQUHNEu1`;RmZPW@Wg!&vOvEzez@SJ&6SBj2(Sk zIj-AXLCU4+^f%@_1GZiVC)tL*_wI_Qa`f+`Wh++yb>Y?03VJ%Zx_nvqA|r6|eWLqh znoe^|dN}&^dGDQ3QSDoI+q;iV%d@x>-@8`VM|(-yKkd;uSxm>0ESX{>_U5;@qsUsG z=i#NUL8|U|C(|@uOd!uxupPj$!SG>J{f^%ri7D*8~ZdANfQKakRm*LQj9c1W@ z_q_AiJ+A!*$_haV0eGXwD3t`q7qhjdg6q+L2~#D9NJPJ_kJ+Zu?_ry_-m!DK_T9d; zxmp!8Gmd9tvB4=Tm7SbQ+TWhDx;1YM)DM<;XU){5z9kOczU+p5^wlSaol=_-s*fM zl3@%Q^nGPk^D(W30oT0Ad?*>o#u$N{3Wl7Fupr+izB-+&Y>xu*)70u=Jihp&9d|+{ zDbhF{`7SPX=EnhjChXuL5P-}H>09KoH%8a%#+3t@Cw7Ge#CjR5qJUUrf>&2m8jqYs zYdMbxz4p5p)8xF*HF{k^HP>AqU}?0tqhMvZ;zu#})|%=JtmkY<3R^#yUwZx-F1Lh{ zZu$ihKpSs)#>+V@QsEPyz#bkLGHK&|X*n;@E4;|q+V7~JI_h}T>oqo=&TT3V!ZCXL za~<9Wv6<{LgGhmfXmI$C=SyGI9t~26Mwb=M4zu{ouDmEYiwWhuER5z-YG~H8MErGV6^lJwh{hS>^L-~$bGUtxot4HIN zyiWV5{~h?)o9n4O?d>FtPFJ1(d+#?zYI#dQB~G$AmZiz2%IKs(yJOEVMuF+|!PQ$V zUN?w<0ZBp@Aru2f!CWf=XJT|^ilDZ&hVj)p9%x_a7t!$LjMhVD0P-}_Fh~` z^4FT}YTrWI^zGw+GKgDB;9A66n9rvCX@cJ;`Ur1efe97PXzv88s6XF6a*Py;M?!! z;yM_?=m6$GI`$)QUN<#IO)&W0MChT{B_Td^oQHd%rmEA4v7{ANRKQ;;rxZLAQ-M4M ze16!rZ~M9*XDV~Mj|s+DkCTXBSLWdFz)g0sYkO}@w;r!<#jRgd?Imhmcs=i3?I+hk z&&I==5Ip+uf8Nyp!B5Hb0_5<#;vW*Sex=owcQl59`|v>9YJKPaxf}1=^(bW_1>wRL zjj;~Ni%*6U@l`<}FYM^5HEq~uW9aY#G3RwPiY?makX21@WU1PVs2lH>q?*`u-n91g z-HLJM#x3ur&(!loDo66zEJ7f~ejoF$qTZC4IKj|D4p#=F@3of?uQ%mETSRi(;SK^O zHhi$R*h@a>;hyIIiZ3@bvO6Kv*Ml~O6Q}g-Y{J#GwKQf&lg~a98==i|Ui5{91;BL= zhY3>2n?hX4UX#EF3iyl#tp*1q*2P}1F}h^YeuShZiWKGUY(j+`$hz;V=^c@6b>!Ht zd(a*c@*@0sm_jTYqy2KM-T4Pe=fTHtSbNI0>h-w%vf6W)!^O#Y&qIORf-Na*=Fb71 zY9+DKhJ^D3X^5y8mVq?%Mfl)L3??KdR=Dh54qx$23l&_p<_vIa;umHOHRcN zK=!TrXQz~_l|g?K!|AY0AzOU6O~^0WMWqcua*NB%4p-j^*@dJOT5Vqwf!5-Dc5NC{ zvEOEu?yj*U+N#~3y88)bxN6HQZ@Up^mb8h`L;^dV6d6ikTU$n6m-FpVvgl>=EYocF z;IT2O_)+p%GpB*0b3zGhKTEJ@1-}O^6Mc46%lBUMFk>z;w49ceivgUtQNz$J6cN>~ zF_)$y2Mq)J4HA*nf#-@RnP{7?2;DUFd#q~RIeN1EnQ+soL!3T$(o>!Ld!Y-Thj}HK z_7l9-J7;P-fQt7d)kOtOjr#F}$vrAeUGc9HGc5K>v$&W=#_zg^3T%?P3@HQefj`kG zWq&i(hVxMV`iJnsHt-aN23P&QK?RMVS)OmhhS7WWTf-sc$mV~M051HoH{Y;pUm@dV zD8YRJxS|4=e>DK90BKK=0!6*^I!FIhwY_T)!%<$s6qv#AmK5@FkG*Gcrg1mW&GoXp z*K&}sWwLr)w&Z3EPAg0-sftejwG-IzWI-tHw#48$W%1f&XKt$KSgDefNI}szZa>@DTxA&LPJP|MzGGvj!15 zxv?kz>gdjwsGSfX`$v?uZA{gy>)cw+oBuDT!P~-%op<>K0`q{>4s@7nWVKpvx`;Qe zz52_|`%nc8op(wOt@u(jg^A#Qfo`0|dhx$U1$SWxL!ld-vAy?e8Gt0&hm&npr*+Wfy?=&gDD+qow$b`I{R z`p5fin__zr2l)#{>>q9liI8AMgZM|`VCH2 z1Qu02uyJS}mlnAVg{B6=Q=4Vt|Nrr8+}YJoogOz0_~3xd^lrZ6@ zfA@N*cwWeKoTC z97x`*MY{b`a{_ENII7OR;?fNM;eMgS1EUUZWV3?=*zexU+tU##7cRbI-@gLYpBM$P zM5@KM{bHYR;QmX!(=(oVs}o=l3M6L2Z*8!yYD=7K zv2FW}Yg!1T_7Sm)FwBr>$iZn$#ukYbpGq-aFn{I`#ogKM8Rk}Z-sMVHN6Kse4MOm{ zU+=rt&DndEH@=m@gnPk!lXbS&E=*fn+wlc>+ii5a?J|^Ty2(0!mKxm1*443CSa}Wz zV|Tw4(ktfD zvRhXmy;v_5E8;#+w;KhXfAcb0Ak)qc3~fx=y)-Y)$>~k&uU~Q<4^;h6!VmnE(R*J$ zGI^#!VsCEXZa+*Uba)ROI{r(hBD}q2b#ZGcV7PB)?bG2e2TSB}v{!0fBBm4#U|IbC|blmz58W3Sk=^YMkIUTZZzh-Z4*ffRaTu zJ|kmA!YFy11O)H(B`!E?5|PlqD0u^Juf&f}Pj8OyH8F>C+*k@M%HK8Hl=6S+Z^MX* z>|0=))K%zQ2p0TEU7v>R$CE(5xzX&5eHA4iws9&;jK7SoEcEb9V>&^`EPhHHhKG)J_YhtonBA%%4nO9vk^vrL#hw{gDwOVDXyUY`|u-91o0`a?;@=?r|Yj zon5j|S6QzGSyj}kN7``#Za2YU&E)@=_$r(cBjw{!RJC%gFKn2oH$O#JfA583x0ad^ zcZXIAdD|WK`VX7NFePfl?r-G=TkFBP0=LyZd-h)#2irv_=O?7-G5Ty+{=tIBu?P|}F=inlxXk4YbjG3^- zl7YvSw+Zv+^k1XqaQ&z!Zq!Jx_00t6)FpPBbx0JlfzSlxUG=aqF#*^Hfi*MKh4{}M zWISB1H0Z1Ih4qNsYAE{_VsKH`y#=2hfl<~Mky$(`@nxD#m9|A~eKFZ6)GVch=jt%f ze&B!$`oh8;1-~YdnA4)cnh1{~ufkjPo+n4g%8Ku2-Q1On>Pf3y{=MylEc$I*q>d4at4|`-9sKcR2E+F@*}GN}v6!@hr&-yK zyNQC(I%*PHIZ1PRaUx%IW)kmyb!s{kMAAxjC0EeDdbm{HBfFpDXwc&i)9XrR2L@JsAAgfbX zzTvL_=@HhCv&V<P~wHHJ*W&!`f(X5&y)D-qAF2&);!NjwS7`s5oPfQ=l{L@C3xYmxvbN^UrWl zdiwTpSnsg!Q5&dZPRI3E1P*B$B-*eg9CUoL-e)8a5C^3ue^~zGo-1XO@_VMXtEC^!O z41zPII6ohvj!=t-MMZ(vdISQrZrBhvaxv&{dvD7y9&P zJeNjDKannH0pOr){PpM{k(Rm0&2mM52HruSn9 z`0Ss^a$L`Jx?V3RO(kq4;ErUCqcLtuz2m~ao(9f+-RsP@)W*VOYM(imyy~d#_szE^ zn~UPEs`OI&dkF`LylecBpa{L<0!uvlNi^*FnVxtI#`%PK@_bBMJ+Cz5GtOA*>fcVX z2;*vWRA(?Ilc_=)=J`+IQP0Lq=RY92N}3Al1L(C@X=vz8RlG5@nygGbJ+asq?p2ml zauXwrC6VJ1ELHzRGMO8~Rh^~WgA3By+QJ{ef*N}rs*z;Qx=OW(H!tn4El#dh!sZe6 z)BGvnsRIk&=zHn_9vrs&AP)<0NdQf@mPXIJ2Q6lr#WE$OUFnk_*)^`C^Ese!ae833d4s?eU#PWOanNjTnE$sd zGTvgpoGb_{JNz&SW{*c|OR>Jkrkx)zj|qSJWQJvF$Z_AR|CAzy-l=tYX3=ctfhmQ) zZ){9V5gRS`RDZc;X=|U8NmqbMCdI8iS+318F6Use9#Yvwxd`EhGERFdllef3WI9NN ze@*n;U1W^A__07i9)W4QztXtj7U!VX)W$cF!J2NtJJy}E=BG0|SRsi(r}a-#(-cSN z*WjTwO|q*=X|;r-gbwyWkFV~DiH>KuI*`@ZgKurkL!-SkU zQ|5zB2$in(aGc|C-SI)C6SA>Y{p9LGhDKd!h`Kv0?{C(;uJ{xzx;*n2^|>s*i5yLN z?=)zJz6U6X!K#oXMBG}q@6vzZvpL(F2QIfCi{C3uPRO#Cw$?pie$Cj+)-CTcXz-bmi?2} zd)+n~6F>U#n4fDm)AQndCLv;_sl{n1idLb~nj9ZbKASoi9Zk^C+&tfA@ZA|<@A&jG z58T#DjgQq94nzmm1{K!V!>M@&(nX}VLGF@i^DE{m{%k?j+NSwSS8cMIC@BJ|5w=!1 zyj+Vgk;$E$y%6d~$Ete74Wq z*LYbl3|tx~PWXxhL)*6~TRn3mRYpteem*<=x2odz-jFlCcOOlnstR!t(OP~Z@xqd{ zd4A?1J?-=G_s{JSBl+U0s<_o)p8PmyB`s*_o4bNf6J?IE!K1FAr19h(4f93KaOd)Q zeBbq*f&BE?;0rB|8m|)8%0JeH`hheVM$TbkfOAipr>mEv8aZ}lUn1tBEKi0Cc z^jV_}#VRmpk#0vGPSm!pCpUU00`8Z0#6zD!%CpE(gV)+25^Pd>dPFWGCT~xeJ){Zt z3RV3>_h(^Z1uBUtqyepkrJMYV73#vaZ7~Rzi#4T8w?omyxLA>#j6^`Aw1g&Xn9J(WCtlM0|8W8G*w_|H`V10l%*?F%`idGW zqtqoS#%9++Dea}UxZ@}x)4gK3d|@S!zM}pCGwU4Z)99$`;eGYEF~NW3G*wm^78E7K zAS6cT4lb-VXT(Iz#D0mM93LNy7U|rzgs&>aoc_(Hvp{KrAlXsOhE`61RwSHLp|Bp4 zCcQgoO9K>y9R^#dsMhTVA#icaPWaPII@9U2rqvpaNq{FFr2a!=5UpLh#gX*JhXdpn z*0gDyC4|+Mc$(CD`Ts1sX66G8_o>|g|n1m&B`jJZ@;g7q*8VVqm&nvXl} zk&Xv*Ys+ANjKFAVNoP_)3=jMltf(3#!#b!xSbYBA}uY7$n{N2dnfs(xDh1O`%Vrfh^ zfCNok#gOIL3&YXX0})`CDc9cq$o`y}{-puP48JqL^U5>Ril=|QH6-_jX``#R1`8U$ z?I&_1xJjRzW8tu|>Q}~HvR__Y4W^*$tA&<27 zptrhI520Ys%Hkb)4bfR5L62Ae1~|}%scFc;r#hplDG(}Fla;U}C5cc6j4s2Vr7bH= zlZ1GvB#JBQMw@2qjp<#s#z=44a}*W9w6%M8kKR2%7< z#T`=o!c-bbPEN)|*_%Ge`}e0``p=B!Y>uq-Q}TiYv{LGrr?5+fkB0iJ<<=~m@?m`@ z{JY~^6{J7^zVRmR&pmczfX{*3H&(`(h0Q6wk2~UFd|wuEB6n;;+!GkO@#(Ly{wW{r zq2a-`nNI6*Um|VHw$-}d2=JPnk;77uW3XfRt+pg z8@gF8_%!HiFc+zSR)Pc8LhP6&I+v@}de7s|nUBtvXq%QB2A-bpR7#vLTq_R6-9bPx#S z(6j{RA=kRWST5Rj|$o{U}C#-HRKI7QG z2%^TK5J+J&tJCq34+*CRv)Vd@zu7}>54pM~^Zm#*&4(7nU`zAK34!f@a%I$W*^SD_ zuD`?}v(NVh@r!@oVUi&t5T%W&LxtfoBPnI5{t7V`a1(X#r#PQEOf}bOYWgq3Ey;?{ zQypTl8G_g`XB$uRj&uG05d1Sts>hu)@Nl0>tN0O97imR|$79(+rh7-x^D00n9TL_c zRLL1sBJklisl%ZOizsktcQ~EuR{($@ZUy{BKN zl|*DLp=M+hZ{_A$ZI@J0F%-A<&-|pu?^~A0Q*U+nv63nM%N>KFNb-e++wg{(A`HTE zvBLQE!6iK-{cl;-Z*fy93JPNpGLk?CjYb=^Z$jo1CL6&~|2Udv{wYMDcbSTHNQL`= z!6WULqw@!OKR78Q5(O!vl_ot-C0?Ih8af9vx(j{tu=qYk_QLl%PM^S#LT^tz%f&_( zdoQ>m<02nQL+M;}b!>s2 z!@!U<3_~rmEVFw7HzOwB5sdJtWmSm*$LFiT1kni+O7WTz49$JZj{ zyR`PY2h>Rf{3f**pEI4YRl+C=Mb0%#2(9?{hmA&FAE~^jdf)BQH&56^aJoyzLfAj; zY5xM7SLq{a8_5)4ATrWS>AP93SFU9_UfquS?=N~^^|!o2LF%9ZSgFImxf94fe7bCD zD!Af8=923bzbarSRfRky(Ed%h*NX0x0DZm`JHDR&=CYeFhkdb z3v7zjEC`r0>oWU6A1EL$;1)~2lWTA93@yC|y|XJBG{a#QM*EIxmE7dN?SqxaCIwy5 zgQy7n$^h+m5afMBmzDcq3!OMr%~aTXJ1qed)FTG#CrD;@qg4zaeBgrFP8qoZ9?l#$ z3kQN-l5|#SitCDCg6oZIh*Q;HRf1$TpSm*OR-7pgR_#cfwo#8zM55tVR@ql#_O=_HIv1vDk84d|tao67YS=h%>3EN^-Zn*`kqn-Jh^1i^2?Hdd zL&#m&3z*6Of))Y(rWftf$mHW=Y0ThizWMG;X%bN%eUIq#?yuLK2;ftlvN_er58GED zd$nhgNS=ZeNt~ZhlmHVkpb%E+%zUXkWmRuFXa4LZZyvS5#VbH_IhUNL;x5Yx>~VjcKt^BVT|-AEdaq)~uL;q5)O zYOzKyH{#>A$m2}{oy1DvgBYPN2d?~^25l0YQeI6>gNVnI5!alUkr9-9`%p2{J~;*^ zs-Fln7TniWF^F&K$NI+->Oqx3MYRnOeSaS4DPc4{s81eYP=o$)m?@@GMf z;G541DM7`VXTa|ds&9TrSJL~!0siT`ekI>gGHtr(!f#G-;XT80t)S}^1 zuXj(qcqf}dA4@^*+23C}JJ~?WPrFD2ff%sd`xcsKUv-U9CeFqmsZ_7S&{gfMKS+IZ zC$F+WU3qUznOCJvu#goL*9aG0%@IAYsIz7y0TbolXj^=@AB*C*eISoYzA9?F$nIZd z*%H2b7yROqXT0^jhpvFucj6>)>R?vTiCb;AM9t;+@h7vIPLuaKm zLZHLd_+d5oz1o}@Z1fT8Acm{9Wy43&Z2Vhk${43X$67#;`|Tq*hVm zE+e+uTg_|2Pt4?Ix^LUP<@+>!4fb~#82A8#!V}xwzQ=g@7wu55j7FCiK&*}ETBwi~ zR=4-Nf9baOlyYLrl)y_>3^SLP=HZ}Q-qq<<8swc0{3%w%B2f!*w;tp}l<4;#?_!Sj zpJo{M{okkD1obpJ;;DJWK3xpA9U%6*r}MhX^RHIN@J_xzun#!n!oLP)z2077O^Mds>!K?tTe^oSRT!%*`zZIap;MogXE;B&2W8w$FB7xP8c^} zkKP#@mp`n}Y4a;Ch}j*AI7D*XgIDwVpw!i@!^jtQGtZ(+LJV( z9n3gBz5fca8xqy~?a9URk5OJATfCz#eHH^Hxq2lszMZuX}1L|if{IKt~;gq?mw*7_e>?nl#;BE=gP2>ca5Kw_+}!h~S>Ln3G->3S)zFRa>FV&Vqd+X}KZ%ll6~$6YV~?I6e=*V#d3!J*jDKj5hp_%;spY>|WWa zt}Cm(G6*!_>>iGhr7q492(6IQwSE5M9+|d~{=z~yJa`pQ4An;|?q8L#T~UGqo;^kTH3iS{eppqA&7N4sMbM{bMT z4M6R0UQJ6t(KP_8g6l}zg%C89RA;dx{kB_0RhkBfK{HiF{aJ135F`tloyS@F4LY!7 z+{j-#+*L2>egsp!i{eSFvRuZA=Dg~!7P{|w_acd zNB_r=!uzru$O`J-UijX3s2)sRKtzvR=F3GfD;hEJW=wI=nM*roYIatTLLvyx997^4 zxkXzB7cjnmRolE325%^7XS?kX_Iw&#j7#!+yeDa|$L_d3cJ&nzwMWKVAw4$9?!|EG zjq&+<$C~D-OS$R=YcupME>_BTy{@b~4Bot*mpm%2DTrFLO&n@NcHlcl)#Gf;4qbeD z;aJdKvr1B5`rMiGzb?A6IL^6MJ-@Z9gWl?`bnBv&rvC=3!9|3Sx9qIA}M2F43ZqdzN+lG`$ zeMtfyeUDOj4+xsV0K`&6{(vE77~T2j1lNn z`*^pZl1q zRhxbJ_vZX|y*mIGM@Bp>#>0N1cgQs@<%tN{9XoNmdHK)2;}~sG4GsUQ3%sY<>Q6`) z{CrgWn%@vR)D2qXJwZJ;Y}uF+MaSpoU~{K?mv*sbc($cJERu2ieDiusrf@pkbyCah zm86>fJ)TUUj)PP<;8*Gs85Q zu@O;&asLvnbDm2Q)lex@2G>{Ty_7CF=n9{&|Ci&Oa6O0cecT3Vybi~%X1s3NTkiAw zL)w{%KG$VC8h(%WK>W)7eh}4hwjV~P+nw$>Er7sT|GnJ?wuE41puQBJ8mXNvjDmhh zCbMs4uVl~4JqVA;Jze6&i=%QwNS+5GsVI@6U*be4KmOkJJ+9uh;U;K&tACi^i896e z6pC);*uP<=%bA%^_G2yb~Jv>otmvyA+zw$(Ci-9Yu`;v7T)vWw4T_S zBCD;dub^e70g^YZYHMw1T@a-r}ZB1#%2dTzMlYIk-cT3v!`hzJ^!SeI>S<(r;7 zDI4)*y77gs7e7@SooCwiMZ0{4rP&C0aGJe&*kom8Wh_gDV{Am4 z>G#4dSKUti7#+tlJ(4Rl;V2AV78#G)aykd1wmOmtyQZZr+fwZwxV3$609BuFSSz)Q zdE&pWqxVc=$Nt&hz=X_p>f^v+*%(M`I&A5EPDRkNPGqwCRT-D7r^z`k-iWjAOj~C< z?%YI{x~wd=`jv3HkZ{r+NDFv{kDVlxPTmX23I7Ytd-u&IP{Eg;42m{0yEAn;xuc1erqr-ywoKIFAO~Xx@lu;r$4=!-w%#ipDn=-VYtM z5~J&SL*p+Z9zwRle!_u7>uVoFb@+f+_W zQ2Tc6$_uOH3YGt(n@IGrh}zuhw?nJ6-qg^k#&k-T3!dKRvgic23#*nYgUQMZKTnQ( zr2L0IK=0$!RO0^k$!1HqJpVl%r_ULOiT7UT`dfXi)%yD2R*p@-^yBTy^j06eUR&at zuQO^>(bEk=_Yc+(^G~2(+m3JO<7157&tIF9Z9du}mls9v1z{xEFxUr`CpF07e^0WW zJtz3&@RwmOzR%C??1_1~FDWP6x^M`Z=-zp~5np$OXFusi^4~8{x!PNyzw#`n2tEyC zzSEk2D)*oD{13K52A=N^%95k1CpU^4y1If+!xz5|$aO{&UTc!X_J;I=3IiTdeQO8> zCD@)ljz0KB^?zIDDR#-jltyGP7$_ZghgX-j_@#wR+X?0>jtN2IEv!gR&ruv}BZ^zb zqZOkO{fdcakTRn?SG#a#@4c#hxUNB7x%f*DhrB8}fE)X3Pm#rMh~a6>Wy=(TUKOR=*{xPMvCD^Fw%V1)QIT?9}KEl~cMQZlK4(2|=#=qRPOA zju_KV-7MA_1CaQTD?SX1s$t#}-^CFrCS=}l^gM2?&wPNOPjD`7-cZsLpPSTeO~*6S z1AJ|CO|aMd0}G>@uIFFlSd-gSj%A2tQvrF)YAdu9Ta22Z!`1E-s5CM5+fiMew zyq#Hu5o%55gaAeAUia)wPtXrJH96H( z&DF4m1l)Z?`VK!ME)t2&^n$KGS3E&X?NzrEkB^m&kK83_s5Kl@#>vtDaC$VdsC$HLbSsDAm>+pe261WpGX7G@az1V;;4#FUI&1ClR zy25ysU#82Rl~*6NiO-8THa#nC-MSyqtk#tSt}Oe|)h|nL zxKOL2NN+F|$uAuz{_fs0{B;_FC=vT5jNaX8@N^>lcW}g>=bO`w@}Nj~#h~Nra|fog z6P3lh3mqkF5CL8tP4iC<44M?(`<+cCm|lh}fGXWjDI4^H@EiVB%xXY!U3X2e=T*{x zecSQweu&V3o!uD+|6^Q?zRQ&{w%eKB2SK^dhfXNxh)BYteJ+IO7Wjx?9vRpB{2sqZ zUH4=?(R#9#*XRecjaAmh!(2mRzyCF8@A5@Slh zay;xcZEguWT(BVr-2_PO=s4&&^=Bes|45&y%+_cQ)eEqPaR2QgjLR{H=c2Ctz7R&L zaoqa4>2qc+b6IW>8+LK13{TY-KkOqk%!9KU7lD=U1{`L85XmF`H6WpopYrgo-vI63 z;M)MQK{M(g4u9ky5FH$trPg;h-?Hg)URu&{8jiqI2sAd>#Fw3uMsyLS+2|rhBIo$smpT3FQ zllQmlboGJZUwaEqEVI}DLIf?sM})lUFrA<$S_Nrs9>?}FpuuKV>Cc#Tb7S=>W@vj- z3&Fv1j|$?r;WImOowSE8(&Ul4h}1PemJi&!XJKe!e5i~;tlxXSKPMc+9!(lGf}i0^ zR=#g#9OL0p^r^Nk;e2zkDwf{!MP+@=7d7F~2D$7m=BX>l8}d{gwJ5LM*k*3GIc;KT zz7-G~DpsHSnsf5%tp^fhVqjZuY!979PbmeGOG=sEJjvO#{51+2CP^hZcqQ0n9hCkP z$F=ttrn(vJ9Xmr`)Gix45Jp^nkQmdhI_k&FbL&ufx64&4!=}}BU@H%bu~H)tb{}Gn z0wOuUoqk$gJnh?%VLXI3nk)ubFjPoyoQK{Z5LWb}N>rGuDRTH@9}c**a*-dw(8fiP zccIDs1%YJ41yW7gp?o-G!lD)%V-0;poqTcXN5~;qc)H_hH^K-VXGeY2p``Xa(`d89 zT_%eo3M`jpH$G{*bN0wDN6UEn9J)t8RchZ*UCHoNDE^$}JU4UE!bwJN^=(gIW|5Ew zAQeNryi2Ii8~#Uf#z+z(W8!4{0%h6B^2Cf%9UOj`ZRfHjh&%x8tGR-X!Nc zqpz)w(~X!&rUni7SRA*(SNk8{dV9FObl)vWog6q}H68Ow%yfokiVEzC|Hku7)efU3 zTj6*i*)B)t9@8>QQ;PjRizkphF%Z&Fyp#Ov#6YACb?aDG!oxDH86uPOXNrW@^&Z)_ zFf$5?Ef1o>=k8B!+g3&stsxa_9am$Y ziS88d{AzSPSJf#>k9uYV2NHqE1cj=L1O)isVBhZ(${2Ec?L!M})H)X(8O!|R z0`vLR@}2iZfp-KH?m>}yOsatSV)-m$yF4!T762_mVO9TYy^w*3re*2U8F)YHyVZJ& zy$rF1nOP`U4Va0IZQz%h&R|bZPZ-iqDes0UG&Po%YG8>7i| zb~-L^2KmopMW4I7`a3mC@DXl-nbio5GQN1k0qR*5PvtklrJd#rX^6i)UTwq&Jh7xy zb!8TfPvv$mM#wR@tb^{9M3dF(1R0WmjGnIm=cW_uf<+K* zRf~UbuaL{d`Y4vb=MUAa_VD?`slgO_1-YBQnpn1^&_j4k+ahK-)c-um$0$50Ak%nK z5r(t8oF{ChQ2h%@|ElH}tok$)6dhs&ZUc1TA>j&hi=ijK<788one*np;szeHP1#`S zIL!`b5Q=7HCj0&<)qzV-E^F8A8DzmTGAgoBQgIEA)E^-WP9|E!_PS*H8Ojd09U-&w z_Ms(u+lJCh_%rEtN=~h8GO-hkx7nBYk!=rDyE&4-f92Lt;A%CpbTYc9Kc(L-NUxh& zL`aMl4B=3;_WzB&hkWv*3>}ACA-*v9n}FN)>qM3S*zdcy^^W$?g|KBL4S28m#<6EL zCxo2{qH}(PAC-^H*?@)O!FSgel!32s4RD;|4grfU-@JjQ=grub8_dzbw@4Y^pDs{M z{8MLU%b@4~d}g%YxL;y+98&o>m;cOk?SAy0;Il@2^to#H+Q#xBOyQm4+JlGm@MwA5 ze04i3#J!I*xNLp()OMLn`iJLydasB`L3jh@I|g0v7wxSNZD(!<|CK8%(>LSYFC^ewuf7Q;^Ew>; zRV@=NTnC*(RR34i2x%qsro~!Mez_t*R!8r(-~UyyR!d|dU??$uSCRUk!ML&1={OjQa{!}R zjWw}tYvW{N+fFvNHn!fm&wKB`zs|$XI8=Fr1%Vy4rZ6Vtb%JQ$yIvz&22!ue#8x0)Q$$sIfVIJP#*ou-t)I`K zE5)Wc$`#3U(suk`i-wOtbGJ-3fJHz&+mDEKL{!I-t|Vx#0*Y2bD5{bkpY0yY6w@wR z`D*c-2hJhM8S>5tOC{ng^mNS5J#15c`;4(v)#@2ZOQuP&r1`B$%f{h{j2NkCnyk#V!66K zs;^JR_sM75bbG6dV%Q{xa>f;u{XM?4qCa&St#}Ocv^i31(6QR>=QAm3SdvDHMOZNR>%y6uCn~*-gJ?D7#5MDh6<4YcV`;G4`hLba%TZZ8A z(Tb@4__VN~Hl&V5HIplG1aba+mhq>C=`L;n zYwpgA$t%1&wNSoK2YN&R3LcryM0;=>na~4D(G84fQm>Uo1rYuOGi*f7w3_PaIXiIC zy*d4XsT0#4tC!BtTOcE>Vfphj-8W8ZfzF161vVY*M|ohp=Q|AyMTT{0LF%B~ zq#Y@tS5%PI`vA{KEFmAuaJ)J0bo)NRToW#isMp_APt~l%j_l60d{r49muDKI&%GWe zkhMYmMfDKDst4@1D@q!MG*bka30=n9PMI2AF$yavH#)8keju%aT6Ht`l@&W40TCW} zXlvJpy?iczhM1U`??2Z()1fF=&-0CKtm!}#mipQpu5F5ip^9i4aqU6bXe2R-2960` zgcbZn8v%8?Q+i7ea@6u22%e%o)D&ezyL$FBa&|nP;3Q~(#d|&PGAGAw0PiK#=_*6@ zmyV|8T`G1uyEUupaW2+&fV)UVZ6oN#F>rH6>&0Gb3a#z&#E`-w1d1z2A*;hs#nFdD zNvizZxpm)J*}uh}TSlrT>U|^k#1--VPRZJ_v@^G<{@A*Ch~lG=pQ)O~ zD$HsP{|57#!EebF9pI2IW|=pZ%$8>2vvF2#7#vN<&FYRLgNhhi1;;DxoZvdg-9jS5 zE)%+Qk&0P{n!x*DA!0SWXUakzB_Kl&iNHSeqnAd~m&Ch5VzJ<2sDs*Rjl9i{@L;2l zSlA45l%+HjFjar=h{!3ESaKhq@O`xy4#|ey%Vt0hfqTZ9SN7w^a!ejE?SAegN5Ovh zG#%=g^m|<)uPNqg-)iBwsrog%?!7og%%Cl{B2DR3X`IeRL#(!NV*d?hwL<>6{rhAB z1zd1&@Woaa{*}PT$H)EseR7!NO+blifog@kC&Ey;w?n-r=2=Wpxd*qSwS_wZPrH^R zo;y(Cy6{5i8SUkjO3!GuU&FT6?DW>$_xPVr`s*wOLl~_Z)vli488VJ!EKwhy)MjhB zWf5$_aL=L3H_0>i%qigAbVs}x4D!CpD@<_I-RRtp&sWE<%t0!B=a)l%knDY1F-vX{lTHpU(GU&5lOLh3d`F1c- z^(RSV0FWwP7qXbqOrnsfgAmQuaYn?VFzoK?eFeu6AbDo ztv+dGJ&esT52bkb@K&_y#Mxl#*D}RlxVx2i<)gl#H2Lo=wwAB6|G4&EC;tO5A1OMm^7>w z2%-4FSF{_z3|S-|j9!TLb_P$QG3Y%n%Wk2%J6rB#Jm|cvqv4%Mp3YvRC8ZpI;$g-2 zZ>I>M=h`6i!>E{Zp8z^dU&j1YW3(5oQ@zNQsOTBcaW$0O7mG7x%y3TfsfnlNm`gG| z7F0MasGye0WH7!A5>c(3BOoCB2cLdt?(7A{RtIIaJc058pWCLHLf+IhPS4Nx1+Lm- z`uf1C71}<-&MP$0?N}qvw{NkIKw5qn!D~UHfOmkmk8S6b-<2iEUAVR|XrDuwT|viD)q$jnSHp* zzQR84*x0SCq;g+ytIlq;G4sM3DLnK7Q5#lc=1luiz&nP{xqspT0Iefj9JbHH@n#rh z{hOC>r`GzT@F|l=xi@*>StQ@DbUuKYix48yw})+mxrbQX@^@D)N4eBLNr_ZU(w zzTX@FkwMS+;-3~y{22FLd@Q<8{s~NrrKb}gdBXV9O%1mGa6A6D-IeF-{m$!ljC!pn zK!~~P9t{OyheC$??V?eq+xG=7R`Y%bVfr7aeCuyHf&zD$wtQ@cf7>k4bv`j@|Bi?H zj`cG(jDJSk`4L_-yNe9e!sL1|P4gj)hhiJC9s#%LL0NTYJ~^({`t4}H_-Aw)JOOf8 z%tVbJFS(E$|hDD-F+5;5KAYuvo6ik-~ZD$+-@HOa$ z*RHl<4;2HY5*L&#&+8yOxJ)7&nNF#pUGZzyM|=dZ#MLJj$=xn*mLLVRN1}>`FX`!K z%Vp^XRGI!^Y?f|5?IH7XAlEEilv5)*UtMRRQxbuatUDUwUXGt;mFS8rws zm}Rupii6JeBy*R>e2#vpgAI8pWx~sl`f7~Jh4sivX@RMV`vM2`7Uc`3b&8M7(Hg%= zuRZK(>K~n)pO>uJ5b%|v=bvBv1T_r?*%;S9yp-jB$kG`X2cB^1?-S|YF|mK4_WwWt z`Om2-tN6~nDf+eVSXF1K=!XaE#7i3}YeR}kSd=f^EYGsSF?T>~WU)vfru;3SDk)H& z3sEN|QlbmX^u~L8y57U?9;|f?NaN9}J*wVtJiPGu8}!5T*w6W^wb9cU&7=tJd1GdXqurFeA^1Y;)&vI6rkNA7$I?uf*8L&rU8dOY zGbFv6J#5)|r=ko?roQ8xej1&A|4#_Uakkq_niW%jx@k2*VU;V; z%Gy!doU$u809b%@=ofku;Q^NGO;-Leg)=Qxm;lr6aH*;&D(;PHZuf5;*5Di6z1kw3v2B`>~ z6gshw*6A>}!6D0{B&2<{p$SvvMTS%tLJaxWc1eG3JutRxxiZiA-9+oZ_@xQhf@c7r zO6J)$G0@;HjcURLlSC~#(3D2FSY7FtO=81_*V*cij0x@G*+WNb7KU(yWbd;LlL>N8 zv<$NtVmrN{OF13zd}4|5B`=zis(APWmvKQiq26VGoPI#Uj83m*yOHb{pUwq@f#z$b zEdnYEc>wboi4G!S6!H=;_&`b)#V2TuAzd}zzLLf&<7jV34PXXI5rg2QBa}dZypSR< zfo<%VG%>T-e_$P-XfN%Ej~J+NJgRFqnS68K9xM*ixwC}WDY80n?otIS^oH3o^-&_% z;ZEC8m0S+hO4Ma8W4?&l)j;f5M<-+x%qouzQj7Wly>u^2B34g>Svs9Q#j!H|?^$1k z#Z^9Idhq|MFhr9*0p8fJvYQ&m_!wXGq>pr2-H~XK`UnqLXVPm<8Xl=*O>k^X*+#ZX z(n@*-Wetf%5()|?6s`K)kdR5ZV8K3;;*g7|^mKr_(rhxz0W4GM31mx?aRm$Jbxk(m z_A8SI{{!U8=iByCkkK29#cOAN(;4{G+&Jz2nI!c}$_lwT{@O{JHPW^WnNpIbWZ|kA z`{#t{-8O1+hj5uuKrI(!5lFp?K*9?xe%6a zCcy}0D4*icSA{0sZDBXqdh7)CIxvv4DAQ$E2giTm57A(0GZ|uMPoD2RlJ9;;@eyS? zH$SNP-nw+U61F(Zh zzk_-kB&Ej`{==D0yogPunnM18rSq8N>0^ty@pz8d`61wyCK%f=iprQHPHweg_ZmJ3 zM`Y3T9i2Vw6Stw`r0Vk9{+I#OKA|MPAuj>gx0H1B*dL+2?#L^YArq!Ts-mNU7USX~ zzOiOJ%YE6O!kRO#5|t!dKeCO*`*^d5tLtGiLx5c~eU&CuV%uw&ZZ48Xu4vflP?6Sq z3zk;qFizo5vuw})zp?k4kzIlH3q$yrLVmngH?b?H=`8_Q7%{vz+JCm}unmAxG-$tZ zLgolNJa?2n=|8VgS&fZPS&y;<1ao`Aee6dtfv`0L8@OFxUwvFsJHRKFHcyUPlfLj- zkCQaPt=-FaffjnvAj06jc1HHFuT1eL(&lZ73d3*mWp)_+yUww3|1DoP=*DD2(|Ii_ ztAgQ>cnt)Dt^U%k2Uov8NmbQGpiF3%=?;hzX3t8rG1T>aeDSQRcgv*Yon!?dQ_PT` zLni5)WkbCu?rzJ=hGD5V{pyTmZqzlT7k4NSk+kG-UkkCAERf}PX%PW>DP(V1ELLc& zLgT{$?a_YB7YAWq?EjFgRFv;y7SR7)DaP?QPx#ivh8lX{spR-SG9ZSA0C2@WoS9FC zNBvkBeqk%a+En&wN`3PigIoMDvAJ8;_PIxG&b@e9!ccwp!`UUj@aUh^Y7mNOm{b#LZsus06L(G%Xv!3Roz*h;tZ z-XZO|M+v#>#~;H3(|`4fW!6E?Lzmm%$iE^{LMrwsf|9}2ymHgPHJWv6E^72(c@@+< z@Vle9rCzVotnAp1OfPeBeC>*Hbraoa`rm?Bw`=i#;aQ$mF@GoE{mDo=h*F-?uBK@OAsQ%_kZ zW&1T14(1#+N;9tNwa}`7RJ;2;7Q108L2g)+-}Qiw=X_PX`3mPB@i;m$NM$xC462tS zWAcNOL#rjlr?NnUka77zBr;VIz@+Zx%q8~yueu#Q9zk2y*Lk8?P<}}_W7gWoY7&A_ zV{UMk(a!ZO7z1vF>?qov^KcngECPpNn)cFCM30qVO%v^$l2Sb8Rs56E#3J|nd|k z4?KFOE80ZOzKjP_8Y2mVif2(u((Ae)oZIqH78(qlt?PVQaIE%&`L5-uGk7uerOJr_ zn~au|QGU~yfbXi8kI37T5x>=LSB&_*gv9~C53;BO*+C87@NasM5v!|+0C>vyL6RS`8+5R z3`MkKL97`YXUPn+)QA?_r_~feAK@Z0uxthK?k9WAB&h;XfQYe|enO+(WvaWtr>!tb zEP4~86r3nYJew0^d^%=(krkC-06YPOt#4rU%}lX{T!eR6;X0WYSXjf+&})33``*Ag z{2qoz@EL(LGf9PkVrF(sv#UsHkvzm@cwvlGlN4sW&9k+4CC)2OwqQzMqZZ56D}LMc z08x(z@msFJOlml>$vLwB=x*6^0`g@MJO$nz9~v9`832bM>Vc>TJaO(?*1cgrD(jVJ zKL}om_)Aasy(iQ$+cWx{+EK}5=)ugc^8@n*uzaYmOqxf5vlw!Ed z!O)JjInjxVJ<1!X61IEHX6VJIy}zRJfAA{w#hY7#Dl=es3Ej}7X;viox_QvExtma+ z;I2H;27?}vjNdHg_>RH7wK@sIeyVQ2APngFM_l-(A6-j&&!Eh+F=PM-XQ&Eb&Tw4B zM*mfLJH@9%3wj036$MDu!I!$QjjD%eA{bMYuWB#gi_7^Rp`1`yLAKJ-Wub$AFGPO; z5FMZ7GN2R!@ID=zU5I?{0lB`fQU@6WK2nL=NQ7uVFIM|N)u-+Ctm^di)C&q`cGiYt zt<6E;j138a(D<~04aclPLFRv206gCQ?lhyLY)txeHc*bma*gTRKRvtHUfq`eY5&-BxmEkmvpg0<`UudPt>XT^XzOnO0e`ds2%79V zt!KA02-)(ihFos^{B3`Pyb| zJNH@kLQ+!{5PlfGYQ}A0%eX~LcPahz%}PXjl14kPNGED$M&y!NHRC={n)*XZ{wiF! z7P=MEJ*oeN0-}L+0c$wEATtR)WOxvNFwh;>3SBB1OLjqP)QpPv0o+^jgLT32m08|v zVx(OE_Iwo+JLzG0omg$7(6YdSFI|lYoROp9pfZIj(l2UxPHDGM3N>k$a?u(rA`R#7 zb*CW>MNdERZu@4488ATI6k%5ozWyX|e`X?|rxiGISWS(iY-JDEHjc|Yg)F7Jb(C|qi_=Zo_3 z-&&{#Zr;bc<;%?ieRjaC1`B^hXarm6$*ZO7+GLa@&kef?G^hXusgx2vwFE2?B;Rb{z-#G7 ze|t)|Cy%ZH7Uz*n=yf0SEmy@>JG}Vwd7np6!dLE3Z%T6gf3oUE7lp9qIJYZLib!V! z#H&y}(N2q)d=t$n^rp3V+J`UsMj?Y{f81Fe;0!-ZKr-`5UGqvUZ4OaE=Y?Sm5IxD# zMJU&=FP;Q{?F^bZGO48qF6pKq`o~!C4r|i#-xSyHy>OwOT_yiS#_eaSq+2XM-M+}a{kim-YTN0>45ycx zByRh5aPoA`u=+3=?}!1Vt-#Za@tw?o?|2Pdr0K?DNBCRM1S%TYS}a5weM6ig!vYd_ zCuP!Yaf6&i4b6ML=%&%5?jmntJNdecA$VHuuD{2IR&%ow&fGn9faEd#Bp3(ZP_VBe zDazfWqg6ab77GD#1P;G&zBq~S|L}xY5pNJy0A{(ceU|m9n0s)JiAZey(e3@>qBhab z`eb3aEX*}flES~K^oc8%kJ2a-6*wOxEtVpXjg|C~Lp$L$l#ZQa&eQyR^Sr`lH%|aO z{S`Om~<5 zn+u18Eq(XsuS}^z}q+HuG;&+jg{p;ELZ*K%lzY zjl(j#K6zxh)_kNEpTIcVz|^;vfCx7N=I#P+cxZ(=y83*&qNtT#n9R5LiVp22oMq;;A&UJEr zxtl1*)ECj`L-}NEN0=uhZ2C-Geg>U5Sk#T847aBk7XQwwx>%o{xR-67q|6g8`{g5T z)A~y%ggQnp8u@`ou$-10ntgc-lY_f-v>wV-XmNP>E@H2QWZgzNGB&G{D=>Fsd*r>f zJLP3Xe@rd!1w8J3|?* zaw3@}7 zV!odX9!?94TrRtmX)M0ad83V3Of#p%R(wS!kodvEI;kp`6`^_!qpz^VDNTPt44^pV zFzCx?_{QUMerAi9AbOt^ZtTrw zS#NYkbA4dM2 zCl~27$*a?fk?@?$6yYVzvuT}>&XyY3(h4@STO!kMG02VA{n71TrUB!xd_A%OoIsLE zLGs=84Jv@CLsF-pyoqR>VP2-PBQRb)Byd^un*(*&AS(2J}-oP#8Y zE%Xb&5F%>0+VPEtmSBgA_vYJ))k+bLDbC52WgOi!k2r&MqH)ZSS9o)(COtER2fEnE zUnQM?PE1y?W;*nA?C7#W`bk?`M2WJ@_?!Y$(aa8e4HHa1K)M9bLH@+%(I>Aiuw(;u z#gAu?kQNHyPD?t*1#il%nFpJ>MK~s;*QzZxbgcKhA)~{bm@6vMw&nJAOSj)JG~4b@ zTWz-FDx1n3z|_+3`#|2BxmaUc1Igu%tMz4cBlGH&|DF~`Cn4-cTF)p*2H&NLjU9RU z-$~~BT0mgyd*Vhb3B_n0p_l^jp76OM$I>&V$V28CgGum~J2&|Z&8`BWCuVd-m8Mc- z%hQp>iue_e^-YROK`q$PD1&Pa>c0Rh#sP&1OfAFlbl()o5M-HhQ!bh zcOqYljda&_b_r#dC$-8AS%y9SOt13v7N|(l<^-Y>{fu8Hh0*&WfYsvgEew#RP(RhO zXpv5Ys%KWUe5rELW=V^G`7q6Bh}?Dsq?Azg_VGq}+>yKrdEcODi9|HeE= zpXmHWCxSEK8P^6GH>8v9vg_6PfgaFT?22_aYV-*;Q3`aLs!760F9NpQI(;gyMLI(} zqVZ$0>fYabzRxxi`0qGocukm?UAt8umFUmn8xd-V1ucS?#b;3yjv4N%L%bZa; zDOQ$Yky4PnIMbw8=L*V*T$zRbbi>`jXFGPc2{ZGf-LgZ(q$y4@zMU`yqYRKd3Hq4i z%4|N)4|V%VYzg-@bC<}m%jbJ^ua8|sqlhB!G3g&xS>{2W;p@WH^su{7ye! zn%^&~+Re{MU>gp;hkkEAv~Rt>|8tz~zD~mR*As%xLfhW`oi3C?jGLz!OoM);gNVJF)Z^2#Jm_SQ zf_4CJK#sX9q&e(xBCY-*6gwT@j)z^>9imTo4r(5E`xn}G_T+|rtGPb)LE?1ufgv=6 zIpx$u6oOuHga^rBn5&*V=+wG^eImhoIiZmqVJOP7%Mh$(Nm9I3K$VQ~J|wi;J?B!r z`2aMLugUj2?8%bW<#6WlKV*ERH3r+c^wG^q^89Jvs9^B;uSdH;k~roruiwaAc7`pn}-VUkw7$F*I z&bLJRdKUVOu*UzloAb4cbaIXigEReH6ZauVtds0I0P}_4QI&#ZI3TW!}*p*yu$hVPX9;KaBJ9z)q1Ln4y7j&Uvx& z2Gmg(G6jRa>)AZ=IlRFmdC#a?M$Q1QJEn%$G-)#-I_NrCw8)a$cjlJ+Ru+T*00I6(LX(9J&q95v^J2^CWotrJ)X$qGyWOf zOFe=FV4tL=mYk`a$q{!dcoI(BOl|?sJ7#5)mWdAJbm4HeC)~?QP*a|( z+Tw582pWI0^rL9L*&`LRTMX}`X&5*^-DVbq5i@rsEEpNon}c=`Bq3wszA_>5c?V=p zsTc~z-^_nvc@cG|fNY!UT@J_5anb-C!Juz#xOt@-Zqb83P2U^!tbi`5&F#TPop55t zu&;q_rXN3!k`(q2Ep}~p`WexLAWIKvc)GG?=}#G!8o(?bm?hYfPf19jc(`X1);ISwLE|3JqJ zqTo+9STkZZ&a9-t29IOKO6&0shX7*YuV=!GwZ^=$;P3r{l*9As&H8m@`%+@GDOi`c z@}X?g`qOOqPYaW``MV^#!%pUZZ)mgx!C2M#b=<~lV4Xsy^p;&;G_Fh}1qTPRS^yXM zc+J!_;}x-RThMNduWC?a_c(1&-ES|mFrOIEBRmaf1yEnRdU?jN^&=jt8hxdc8LoI- zb^i2eA0Mrr&o3(RSSb?pFF8iti4s}41!1C9aE#lru}@E7S$@StjBuf;)Dvu=79n(( zmjcTU+>hh)GbyiM8mSp0Op2yR2LApb?AL;{fYZ0RHX}^Q^Y{^{O4U$ZaLyr6gw)3p z?)!WV_H_<*H)6ZX@KT!d#O;{x#i`UwTJy|K6BK6Pu8M4Uspj|SI@x^PxMflZXm1in zQMrP;pMUMVupI?yLSA(c=bvawR1ic4;dquO84KeiJ{;!!|5dZi>~+6&56uShcAe%# zRF6<$l|_N7KZXRmw4}_zx#x{%QhaObJlC@=#nMxugCUNbd{69DEM~^;&TpXQds9)B z#bk77aFuDxnOi0-hC!rFzq60g{TjnMta=rL|90Ji{`N$l;}_gVj6ynl+ZfgIcb|QL zAaZol9XEM8WaYyEf!C4TqGAsM-xEAP6NTW2Ul2mSfd)dR#|9|5-Nk1)S~2q`NBCpL-e&__PG zTp)b#`u5%EVv%x-K9%$H2?oL94LtV5tDGeE%r zCUyD5_s;^*rhzHtI38J9~a z&gw9V476SM>Xn_HmdIWlL!|=uxV`jStK|lJu^kp}Ih$&*h8*R{iW!heufyHAIh$LH zsp`S|q9I~$kG~n~ZW5jh`atFncoByJS3L=4cPLpukr(VNCOga!1Mc;>W-WiLxGLQR z_`jbM5QfS*cBE|keNn25Kc^|Zqr)H}%>^u-z8igQ6F1nrAauVSGT+_I)E?G+9f7j* z?g;{X>W<@tUa=$_fpXIZy@3kn&v5~tm`H@vI$jHU&%s9BshLyH<3j!!N&)-Usau}p z0nhYWZ0%&er>=SX3my(Z-SF(;&x6Ordka0CVSz#&Sw&K44m}U5{%$i*t4*7?b3&fX zLeCdz?O#sQ9iLNm*YsL>ik$p|#Qqn=836+wI{t3t#9!f8je7#bJ07+2&({H;>})gL zncF?~fPj0;JWJ_HN8hTB=r8lZ7mmu+*YbFL;A8(7qNM6%kUKYtIq@GP?&Ay&S2|0k ztO>QaFGMYaZru8K+w^<2Ja9%9k)85tIh8oII7>K);GUqGckrzl2A^{*x5Ac2wWh|% zIu9I|5>tJg7*nh9!$0Vaz5oSlVagW#U#!BK@zo;E^Re4lxT4e=m6jj;!2|AL#P2u) zQ#lloVqGRFtA;b7D&Boj@l_`D&>dgalDX~CeQVf3HAAN7I1o>kanno9A0M%S&gDko zRoe=g7x2@}*2+AoolO;#;;^Cy^gIeiVwZTYum1SEmFa0QxC1LHawp;L zkYP}}{e(P}AgffL=B+o=nTo_KA0Y2m!2A%@WAc zDVs8Xz0dHyoG{ugjIK5R>^wc#A}ypGAkFU@#;%tGlegy`J6-8NVPQ3;T=oA9c--Rq zTU*8d^xsjsPIwShquZ9sK) z?Ar13R$V7CYywBN%Q(MmiEliA_VctAkXmPhH#kv@CxgaAfC^9efFVDPo~bA7%I^y- zQIy%yZ$bk@LdBiJBsdmMEz!yHG7A*46&UN_J4CxuH~`)W3lEk8p&5m$A6(ga;*OpKV;q?9B0=~sv#&*Crc!AF2*NL^)DM#luDWO55zizBOcQART zr+oe?GaoOE?-NM?;oc=XguHPEd29XW z5E=Kf7bUWQv;(NJXv6`E&#?9qNw zSba$%&fUbh=!s^iDjPoap&q;XT06QynH6VR6ykPjMNIE#qPCChuA-uKhCN-sX-!C^ z#(8`bTLz4qcfX~=Z8Yjo)ZOH`$A+MlxNghw|4B<2`3gh|YglHNgj$LiBg& zT2`HE@jpmD8jDXWq*xuc(hyi(mkEq&Q5zWXK8J2*{y+eE z7nf*%<|*DB1w4G0#kYxSD^{GDWZHU7m8(}lQfK|4Amc+A2Ee~-383a?5IV>I(~&F&u5X;Py)uUE;N44lDw{6Bbn^SG3~y%<{sUs;KLMp&z3*0|Vv zGaTE(pf=5AOZZzXnTS0X4*6dmnD1utdhq{@vs`#?6Z`)<_P>WUdcPH5@rh9S`z*lcE%G^v2&<-ye0pHP!qb%VoKG=>7=(s7`n2y*#{D=X-l~>m>Qi zdv{Dpt4MZx#$G`RCa!SZ$xi0g)Ux${WKVf z%TS#4H)xx+Gr1*~;MkBgkJ0Fj?9K5R*0JrKA1ht(pO;&@ZEZ)qn%3k&ET6wHS&h_b z8oC0-dAgj!d)lwTt(8-xIZe;(6na7>eh$&AY{T21-(m=-pZ#46{ti`j(+#dmcHeUr z_A}Cy?Q|T)G{VJoQ}4cDJq-Ua=p_3+w@UxQD{NQZEI(T1NM9@|+Vi(~u7#?|PR+6X zMQv#12JK7717BbWFO!|@2+L_0J&5LalQ+`jiLT_bZ(4uQ#P4>ON{F>K zw5h8abcZTV$9z;Tbtq9E3UOx#@}eSSH6W5Pu#WQ))nE!dncK+2N2Z?BUQ!?^#YB6=GAyg z8i&(_o~Vt>JPWAd2-zkESM(>h13tl!G|{9F`>FeJWF6v15#HYarv;et-F0yI7}(yy z!xVfvRhp~ACasNSWZp6Q`sd+w+xQiY>~Bi=b#)ma*LOs-2J2oC6c==(p%`p>cJAbg z%K0<7WcN!lUo|??9(7!_w$@OA$r7}af3eB+&EE9=#^@6wuFfmL-s1~OtLL2Y{nY3k z6#qWW_58g30ei{t7HF4JxA{r)^{KaVyK;Qwc{1X`##*gBo{LeZ$i+UI+f9n2GZ9YI z7Hvti-JjXz{(1kjJ@C(6>864a>hmO+%fvigNV^L+>V;NO^?T1>>8v6#EKRYIu6@EF zZIsrS_3J0@51^Rcw&6khah1NWa{@(0!J-VYs8Sih9waxhUME}%rnHUT#Ep1ce|Pz_ z_gcK+$>Iv+cR0mf-18!qdTQ#_)hY&bs0MtS5AKGW4FuHa$m>1y!xA_BM<0qeBa@3+ z(}P0gD(Z^HDNkp5-!sr=q@|#R)kYWa(l2U0NX|JD4n4b9{q6)#!gWTN8Mw=r&7;1j zTv6WkY8uZE*CJ}-H`SssRK6qbWYb3*>28dnCTOzw4Z4lV zy2`XN& z+Z$kpJcInt&Xvm}-^1aQ3ld$%=ni+^vh&3G$~6YD0-eszH$m-6FWP+9m& z#&do^-P@f(n^RKtgb9t+L!mXF`3<0QT~s`N`Ix!+X}>#2TJa;g@n!q#R%>$mk!E80 zizdzB4UVb9Au7+-KfICY9g(Pda=+v2b>kjmFKku~8Vca{vt?mnX?U9N%48cznZ4m2 zQMcWmTU(3thfh|U%+8E!KKtD`Z;mnM~=HSP40=5~)zsKkVqmU6&uleafpM|6=b zE6(>q^5XNddX013dg7SOS#AGKHPHP@VDRL^^<}4-`o?kFhd>spm!+sE>9IV|QQ(GK zAo|G3bH?EjX{70C+T`F+?C;9~lY{@cdFTB-+ux^NJf_YwGK-kYgBSav81+*u-E>I% zhHHus3Y-b7A1K&D(PwyMNUmd{o1nWG{_H|sUI)f=CzalbFy_jr`@@JIhvU69aYQM} z2@vfoP@1)eW%o{2;bWF(M&Jd>hD=GUqDaN4kM3d?I%8!}&4s#|+?r9VurzK7kGv3D ztWHz*c?T(21=Jv^OsSVE6doY1_Dun+Kd?@ID>Vo0lf2YnP~n5?H2h%?U;NzoToB4N3~z-`9S#knYz2aKk}|GwxCp)-o-o zRdMMM9Ej=VWJZ=t#|~;oAeh8hb}#%YhHrWHS(-p+Br$4(!|w{@o+g)UOg&zsh1X1t zh$GSUN%wZ=IMD=pCU9bot+#P;rhi^xzkS-rHw+7;;n^Sp9gmZ1(rXyi03BcKqp)Ub z#dj&u-ip)@h0gU7y^>gfZi|%_G#e)>FEMZ4t4@oc4bksC4A-uS0eow^lcQ&4xPJe1 z&X~Jl{ldXmhAnDaF{J!UJEwlI7?!gT721CdG+p@tPp+fm7wb(_vIOfENdI(a{lcDB zCu=0GdJ6LSR&gqWT8&y)_qDQ_;ZL%@X6!pE>g)iqTKUfqSmyi zv(ucu=Pk=|7qQCW@ZSiss9tUTugHAC$<`h}>KVeyU$NI?N?+vL6_>?i=8{NVAhXin z)1Tu%1s}J2dINm6OZ4w<9X>DEj7;xRQ4Rl`BMH8yp?*COrUg~qm0;(ZJbkZvS)QfA zm>>!EeRw2pbfBXDx7BeDfk3S{IU4|csi%(NZYPk zcX!mWZCf4NwmP|GdUiCu`hGb6r!~=i7V5!5((GwkNmy zT{NxNiE>5Tg9@Y*9{}?0z*W;I5k)=GKgauZeB3jhk@GWWo%f)yfpcKxsx8$TlKZZm z{#NxV&}(;)?HA)t_ob{^q}xr;=*#FZBcE0;KAa}7P2w}!^(X&GqiteCso~_Kt()f;Uh}=PS)rne0&COczT0Jq&7J9MaFL-EcY^GDz_v zDkRwiux_&UjCc#FML<2nAQu+Y6E@!}A}rPED$jC^y6{Ny*g-4Exwn(`?!Tswz1pkC2z@phT$^EN~28(ktkA7C(7_ z@qqW;MxkdX;n&5@@w`RQ)(%OAHrYke1;NJN+1B5QyZdPIVZFXItpc2!Q97If)U#My z`O!xO$cH^Y8FMbku=Fp@g%8imVQdIZTOc&cPrJ-B`i?Y_)SXGjBir0y$$CK-nX`UV z_D`cM>+E@K8RF?WayxXPxiy+8E`x9?LCI?RAbvrePGgBTbal*c9eGx+*;W0mgn@$t zWEB<`20E;z@)tLEE`&#!95hIPLXGPLn~9sw1OWo&GiJRWj_2Bg;^P%2tcR;EQ_6;g z$u@FtEe;Y3TTg8f(-Ye8Rh%k=(R2!LBq0bFg!8(!_(k);G0t=2hXj(KtYi&^Ni1G& zi^b`3M~|o%tro-D47^g1IZxHI!k9Hji_aAXBr%=RG9u*-gcEkvQuk-Z5UktVbR1WG z2c6e;9G7M1p<6K}qMT+9R(5=8OLG=Q2=6W_Vqgf%SAc*fi0_Z+cXsZQp0vtSPiFso z1&UNcTcJ!m=u43@RXygA8CDF;V2z7NU*&wYJM(#=LWH-+*ROWxFtByWy!!8+YFH{2 zxthpdLa1i8_wRrH{1VpDcXwlMVpFVhmzxR|#okMHfV?wtVAeAOMcO|P2~3U1XUvtP zUB?je7u;?|tN5!|1deN+BLxE^l>fWfi&%Poz!&O*%aHxubHcR9Hq1Mf?dp7uukAhP zLd;@{<(>$C{BC;P+v5hl4E7T<4SkGDL^@_K!&uih*u9Y!EcGS459%yQEfpd8o2$eP z8lDu{-tMq{m5sw+_Qjpi{CUJ}hv7fljym+(m~tE`@$nk`jIzl= zzYWjSS~Jdeb@kiecQVm+12O+)pwQI>rt75>kEtG$Xh8_&h5uWVYT^CCx26 z&ncD)ePc$P>;s-YR9n^-^UjH_IIrANw{A=JG=kW%%aE=C^q54~y!W)iny|0KD)v1) zu}p}juISZI;+Q8da z(=2=NV#U)mmYV5()>2Vc;1xoMi=cisfk8=saa;)>9=lx}myaF9wb!xCgVXbF0;ed= zMvGNpuWwxA49^Dk6{WrnXHNL@#mxiamE_2v(+AeA+HW$vJdZ#YH+O}%E%mTbEztc+{uboieB7$YZW z4oOnqDpeBizL%}KoldJPQNc%o`DHB(kATiATfhH|h_-M1CpOw7hxt7-*IdL!_c_er zWKN&=yY>6X(x?;~+kF6Q9MtAwA+3?OTNXrr_!xJc+X?hem98HYmj-3W*7akgi$RM@ z@E_s`9XfWTQxi*zD%3d__g)VBW)a?i(xuQw5WS2c_SgYqR-hK13G>pCi*pd6hHz`J zc^^eab28*ndz5@FPi$l>0xF6r=seZ%FPbdd@clGUdJU4Zu*5$a?D&*fu?uuoiGW6g zUw-8pmyCL-QOsigu#c;Eg-cv+XNNy|A5u`YdKw}V20Cz6c%SjHUjU!uh|c+PxJ`uu>l5R8#zWTDv`6UyA^9^*~xj`FVk zP_mf7eYsxW`%7m#4hZa>i4|@M(%|F*7!ckx7Is-`p->o>^|XFbNL+{ymF{BNKRm+E z?XZm`1m82p_hUgz3@k^}Gnn=xO%(rej`n6dup{_m-r(UZU%TRdQ9tUo7mVJ3rELiF zA5a9SkOYB%vpY;yHBs0OH}e6{wDe9SAxxbF0!L;zfX4J^UJag#m3ww5P^60-wvO2O z8s+hm>Ioz!JN@2^XDooWD@_8*C>U5Kc7`+&XVl`q)e00S;t4~~lx%{{8pBvZNt5xj z$Le)@KY>^yi{^>e-cM^FEn*OOgse%@8oWaK?|2YX$f`?62-d3|D&M!+5jj9p40o0yULs>cC*balF_&B<%>17+M0sHe+CmJT$ZegS(h>X6LYr520cEjqUAzlN02rq2a*HPqlkK{RSD{$L zg1PXk|0z9MwMzqC+Hu;H>n6THk8jQ_j8SRU04=j@PzY7f6POqKH?Ymbo?4!qgocc& z>K7YvT#%^T)=0ysEGBA~zrEhIJ}1WhQEN`LFc|OqR%#iUIaFsJAlo%k_R8qC;A)r2 zm4uzMla@`lB`$i0cPONrSgXBGm}J|GGvhYl(I3q^Oz)=|8g`PHEfSo7DIr)u!W$P!;zl zQA9Ae8PIcCGwd$g33bE$peMKPrHU7=T1&*%)%8Zj+y&!q0^FrE`snw`(R8MIs|_xZ zpr!&ksh^cmWew(D(ye9&bY( zz7fGfU?8|6V|%-CBLq1ARVhoLA#1erLzn=P(cD1bB-(>}yPT$zZ-%>`)G$q(j$xf| zLjD3BiAE*(YY&RYxR{(g{YIf8+f7RoP0p$cd8bgdn<2O`db1!>+$2kITB7VxLd<24 zS&itJoWBxv1kNgN+m|4US|H!qV*h=JxG2t&;8w8^@4Al^BIAt9yE6#XON#t47us)f z{{V(WLl&)NDlE$c^XF(l*p4JmO#4HX(#z+w?m)5Bq!U@;qBdz$0u(P2Dw6*gRXd45 zVo*k8_);Zw>b*Pz*1FPbe{At0WFDY_qPlmRaTmc8j+JvzS0Ob+d+sLb1%DVilK{eg zoHY((smavNLq|v3?K_!Zq+lEao3*QNKeqO$el*8uFp}N@c&XNMwK^h)?~}yU;|rnt z@{y|cxvBxMhz`Z`@T2#>=jwX+H$$VgcYazz|KLKT7nQG5+i1PPijNBWUGujRC32W% z0$T(T7(IDFND@a(VSJBP?TVYv^gWGsM^J0`q4lQctQ@=ZaJiQ6R;IhdqlG9qgj$aQ z*m15WUL+dbL4GKn!E?+O_tS}?)ka4k{MMa7P1l_yLfKMfmi?Rg=0{Ct`}1~go$oUq z96sk%%Cx39AjtWAh0*fKYWscrxxr)_i`8~}N=c4)99UDhuS{P9s#GdpW?Xv)Z*J^T z3_e#4W9|FF(B9dzm`QrAIhjk^ZE|pS8w>psz(aHEF&E zA%iKm;Ge4hkP>z~qfagjsg{~T@p%DPhPGz?U!buI+z<&%yhtEB41yBojiWi3fWdckkJ$mKrbuhSWXy$ukaBq+N+D z9_NV35J#CUH}FU0! zqcQ{gqHU^mjMXTCyUS>XSa4I@?Fpw?(S~;elg?t=d z_9-(Lv1}zewfOd37fhenA8RYt|+>8Wmi zCh6hnd3ttXq^IY1$<^X`azmKod8F=gxh+$!T%u7;MD(9H5QzJ<12R|TDoAaBgKcuq zVel1deVyQ2Yv={nip&DZ+VP)KcAE)8+H`F_-a%+yisil~IAz%1B{|AEC!^B1r)3Bn zVnw`(l>(F4;)m>w{UhI4p?|R)p=q1u1|Ws*&v_<5F|zncShSoWINk#E%l3k+_K6H- z4Ri5|x`o?G^)~#wVxd?Qi5?FO)*-X~>)Pa@iAmTEX4JF*7hCr)6Cm`red}8X(fW2} zBPu`#jtLbe?`Sx1>@zcEX?cGW4^7$hK;~>*6=}u5GU=up!L#$;;0~WIzeHE~w78E8 zrasz)p|mr7(WfqP^FxZ&2HR4h636q|;6U?88yxt5irS=BE6CF1&Wjj8+Ox7Np(1>V zK!Qnp@OUOd^<(us(t;=o?XOG7dmkmf1<_$tu{%39>=T2aFg-qYh-HJYI*UHHVJShZ z=8)}<9v&-UUSafHANw>-{Pn(5)7+_c^3(zEr6SKNX(Ins<~!&_~A=ryj7fPEH81P)raf zBLq~!8j-0h?Y@m2cM$8tG|gUb>_*s)D)Y{);SH>KAYJaz1NVPIF33Oia{=s6rCrCQ7pgtR?O1$KvNCXu`EluQte8;Ld@qo+-;)g^?vNvLF~!N3E-7wc5g_5Ds{Ed)U_i}nMwt~p081@ zG&{W)E@-8V4F zmzg`XCk<s14#pZ4dijEJ+>D z>w}f1R1qmnH$^{05tMZ1BVk4V5O$i<7}?WelPJayXD$*36GR^CvM`fLSS*9R1W^^R zYPVm{cs>+fs}{ph{U=DODu8jP;EmPEirQ7SDjk%r2gN&+D$-M2Ux3H)i+zn>6*P1* zC;+LdQePV|tB>U-QU-DD)2{~L%xp6Ox9IlSBy$0!i`%AXTH!eL@ zC&)47E{e6r`+Vu)p~+A>yRxPuMNy2tK#CH2^K0w+5BuC`6*MP@;rLS1?8)Ag%9i-_ zsEE%kPr)d$%!Z6eVG51<0I(0kpbyM@98t{SR z+}H@@Y*eH{;U9`c776=(s7NW*`20?$B5igkjir zR#8btsn9w%a1KkAA6v7?sI1stS~c?I-|0K`3C}Z*YU@F*+I?!E+%4J3vd#=qtfRrV zlQ{&RU_!M7n;s=tt#}Br^T|0|>zR(dea}0?Fi7 zMh>n=yz;rxp|SzD?Rm0*!i0xEXETNBDwV?(AqSPkIi+Dru>Z zEh7LM-q!H1TzqTQ86ncnud%Y9(Su*ojYoEZ!i#zc*!jO(E=e3N$&poC4DG`h#l`)R zK(hdg`cZPN(dVHEY%mXT37?|9GYHy?$O2&lqKcV4lpW{UKTxA^N7@g}0)z62qSDV* ziXku28*)_0Iw4ACH?bjg)>t4bQpkS0bKLS|)k~7-k&fo{2W{Z3jjvaSy6ubHyN?b# zp2EJ`q<^g;wwV(@rDr4jdsieC2)t`O(Sm`N_^ZT_LY&AHnm+TWiUy<8h>LQs(^oP347>SZ^t+IIS<@q+ zF7grZeX31)hGAOWEh&DkCdYAzGQ)9Deh@<$F@>^d#M%eYA7?QZsw+#Vo2P8E zKZyUzkjZLo;9?7ZFPk&zxqVOVn7C9lDe?s zW1_YzRk2(c*xdBKRbCq|l*o`s3;^?e{W4IsEXey*A8V|zg*I=!_Xr2kW5O1OA?nv` z40p-ZH)E~oe!o$B?C+Utyp~{0qqQiNu(;5iq0?;s{X_iT3J9<{7GctcjfiQE?d_ZU zx%XBH?0}Xk)xFLPOpZX00|IqmGEAn+n6qks$=}NY2-fzhN)JcWNbrpBx2X*46{m{d z^&0k>I3KI#h&q88TM(KYpQQ36`Auw==$~M6bl@ATiCUxF01z~(jF~NAn4)>y{@uC$?2|cO3K|$^k-*nUQm$XAwy(Np}97sJ0WkQ`bFL;r5d*+Yfh zmoF>sA3Im%sSn-0xm4}9H-A~PGs_|{b#I3#S+Bicq3-C7=oLX2$_gUe@|Sb{8NJ7k z^{Xsc4n_RHG?&ce`tD!~No9JWia9tIW0?SpK|kQdQJ+0JV51zPQ2_$q2NW zCE}b_5zUtSWTGYvoQLEGAs?_Vh@g}9+|s7@Lyncsq@Yx7HIGHo!PM0-kE(7f5I z%AtK~4N-Gf>VH}Q)7i(Ul|XIHLzBf5RR2#_^3g0B#XN(AXB(BV)> z?4ReeqgXHVSTR-6FDDg*0!5?Ul4foA8Lgsih=Kb(YY$Y`p=kg!E^U^q587NJ>?Ih|$s^NdTMY8}*G?|{{(D~vS2!xvzO1wd?DB)m)Oi2uZ~J$c=8OCtK-Jcm{k z4+SI_Y~<(`y^ek$Uok==hVCnVWZ^k!k!X8Jo_TRS{3`ey;IV2!e^cf z8zNuzfHI2?0Z0Z?Oc@HZL}idk!ZcX8N{iMq@2UDZLYrBoOk0*442GfpOQJx}iCv|@ z1yvZwonLSH9R zd!);=OlKsz*O)H!#f!_Zoc`Qi3lrGS>0S$;!5wo7MAE3S=5_-2g}U$S9?-@K!mD3hr(Kk?sBwT_BKW;W4kBZot6^CsX)uByZT@q*YQ0 z8(~~Ig7jT>ew{$Vxri~ncqWjB^o*jtl@C3}uFCvx@<^C@lQSpPqTI83+xF{y{6DbS zM+sXs3p9)~ z=dOt2w5G?GC}{iQuzCTy7RZH-W6{L#<9~;8h9dT#4qf6H`sE^~e`CxcB&)n<{^Mh>%*reRd?KXAlO>}6>Jzviwk<>9-{n={wY<+L< zfabQ_AJwdR+_7o{VF__Nz%PL`*=ZYM!4(Q67#`EX9lFIz*%)}%0?`pS09hIN_NgEy zw(JW0e6Q-d&r*q>V@Gz0uAb26oD*vm0b}`}M%9w6rlDKhfL|7WiY3uk;^slpG$7nL z`(B;yJYYIqRm$L?cG^9eo=s|y10}Q73{6@!ZMba-8#yJ}m*kbQ@UDahGFw6=r{Q-* z1sg2m@{ov4K0bYnqMnyML&fgzZM4W0! zkBan)NK&%2AV8yQyO5%5AF0MFXi*5oJ9WiX7bmQPLP~D+id`B&Jq7A#f@vj)p>%kn z&uvkYoXttc5_!9n*0ui9Flq&kl+5H;6>IlCn+rR z9*3nd9qoraHFVtd$}6p+{)Jo+uQ31e>=fUO4Ea6b!_vDGW4LL~)1FS;zvJlhU8*78 zc&%x+mkMSlf`sC<~-5;2r2x5NOcQ7e>+}KX6u?NDsB{%P4m?%Jfipd7dr3o9ffHHA9!>w%2Oh)~>SHJg~7Ax-aiaklt8I&SorOYWPcwhDxp~3?l|r0^tIJRD63m9Qvtj zS(dtv3}1KQ_uiyG#p9UgH;Vh6bV;*a_HJaecKskvH;^pKz2PVAdP`!zD#ZuLM7d*| z=*8q7v%OT3hs2&1*j?O&v9Q2!3_YVgkxF5|QOoy>72Z9YylvQ#$UC)5G+LAYZ4R9O zges$mSA({O`6ZW!Y&SwQgds5^;u_0}-!x|P|EFw$HXJvP^lG*Y`^3rxFX%082q6pn-~m66 zv(Q`SG0IrUf{)%h?B|R28D^x3lgFrZlpzQeh9$GFC@i9mQHTP=42B8V7k{fq?&j`o zx(Uu-{9uS95qE~Ege%+~Dh+@_Tg)X#UMJ&Fu_{m0%AbZ$2j8*F(J8a$B(ANSr{WLW zh=!gE_t@vQ5R&F4mY$wuCYtk?4hIqCx9rKF6i1N~zm~*Zp;O+Bc=OOgHOIhDgj4uK z9)u-jgu@gS^n^^A&KRaK0Y0&2VIFNCrYJec-5*~rgFJHkX_nq+Pr}6p9P-TZN*4d( z%xVrB6CM@f*0oEA?uWPPPq9;ze`KjWZTaVU4SIuE3sWHztGpU^n_KRe78Qfb@Di@{)MW44z8t0vDc8ms4y)ps2eNc`FHsVQ%iV_x7Es2reWdbvZ*q=@0s~ zW>GzHGWJ`7Cx3HWv|THQ?CQC7Y1@zn6Oe6q9!FLDa(OO&(oPV8AddWTX_qw<` z`d|i&B_%2pjb;xD5IE(n`%+?13i8dctdCg&>#1B zjWJXj-Q5rZ3$IRo%06p$uKpw!EDqAd%KN$5G zuZnLTQyoj@5rb$PY6_+Wm~&t&VK&@EgMlSDMgwD&yQs_JA zjN63KGWeHGWX42jfgn@cNi;;^+5hNnV@MLkuEVIw1TYg!n#;%fm!Jer##@r94SOpK z13RP?fFLf}Ho9XPr;fsY-91WuTw*@7k71%$v|l0HSeH4BO|)(25X7mwC8oF|L01i% zOh8irz8?_E_gG7UV3{Kx@iN4*vYS0U1D3HR$;YQya7kP%5Y92(rS!ODfppO_l*bW> zj8INE(@NuDAwYb+3I*~8Pa}93nNjk1t(pAx) zZa{0eM1{R}gFkS>jG$geByas~fxl2mD$?Yk~P?0&D z$6T(~xbF#f0Jtt}Kjv5E|Vpu43}lY6Lp#NhihI)bobQF#l2+B7xl?c4n9LM_cor780-u``rv2 zC5#4PoLGQ}%H4#Jc~FlNkr$vbc8f1YM?zY=4*WUo=;uc^l#eba_q4kr2x01q#}%*l zZH6Gs+BYBkm&F_QXb32zBMMm18mvpSe}E+KSysi8-7!~!l~GYcRc8ME;buV2|7TsS z*p|y$RAIj`5qt+8?W_zD2{bB>WY-~kjL-**OxZ}|gU261>N zqAEdx#%k{^vKJ>~zjjU{M>{MVR<2odO1y&wY$^kGbJ@wL~_k~ z1*(&z?FcwiEOJH0GEt0EQRY>NK&4vd67 zHEKgtJog9vd;;t2wwj#!#A5A2Aan z8zLI=-yZbNK;8MuUDzOPeodlY3$W||dBNr87avb(H=u5sEmW_T_qVd{sNER`=Bd$O z_|Fl&nz*hmU$|0D`&PJ0cPiK|kz;VCd6po~#mr0*u!FUF{_~L4WgqVUm>nuZ#$GH}vh1Yg zL1jfexYxu5W3@7_l9^R_arw+G;tTn45k|4)W7#7nDeX;9H1G;tLWv4( zwcQpkhVK)gQ9J8&kJxMrukHAN zvoZar3q0V)K@+$rNCaBl1Oc&d5}$6s%H27*ikHuOltpP51$=}fs`(Ux`xF+_oIS4S zbPE%w25ACsB${_yG{fO}gqCZ`qg<(N{GJzVDk&G3)%^jcz5m7FUQIb4YV#m2);&0u$Wi>cZ@}BA#^hb`UN?TE*B#h%ip0gWT%RV{Lm~m~- z(h#YS5jfoS(QKg2{ml)A-fE8{v8GG!#km0K;}#YH6w4^=FDNKFQI;o`^igje(%+n< zgcWR}hll84XNDNa7VORQ*sPjTH!Oi`RaTkfC?Kk$lahU8jg zamBe5^f@ZPgpr~w#5YDfdo%x43-c#3Cb%I_@HVx>=ZB>}+2v~@O!RAWxjntI45{IJ z!>E$l$FYC3kT~n5&AAe-vJ|K<{(0Q3bR=xC@x!58%)=^}Vvo=3#pLo=evyQnAr%nu zF7h7OKV;jJFE_*#J>RHzV2{)7jWX9E#-JmDq%#+qrlb(@trQBhi=y}Q8ID&t(UTfZ z=qP8_;=?x|JqouZ{`maB zD&2kpkWw{#x4>?`?M3IgZ#mF(W5|`_2c-VUO zMQhsLWN6gulRUKcn-=8u1EA>-l7=JK>hx(ThL)gah8HVXQs~qtiqUmP(oJ*5TdX%$ zdwuEUxNkwpr!$3Sr|{r#Ij4wYxd$X1(Qhn!pUyYE?zzT~iGd!Cp%{jzr&q;s^tU&I ze8zTVxn8_0PB9w5MT5>HhAp}qo5@0_2IN5O+4(t(xx+-nOJ6P%;2iln|x?P;($@Uu%cy zifXzKie{m!%WM~OD&V9DL@UrNA?6N9=YGNz%eO+FHpLfb%MQM&s^~sY)!DAF0?)p_ z{B}OF`2cLb@7_Qm4e^{0l9X)D=$Ib9&>&;?R=08`s+AaG`CsuW#bNo%#ZwDvK|tYQ zLP?b@$TXtatS3>~qtezZXnaiYqLwW?wIor13hY^*LqXnYKtYXUtzF-3H5h3G%#?lTID_LRc*zcS(D$jyZ2;=`VLx;=Pv{LeR0>W7)L;7uj} z)=oZ6*ucPCm;2?#O$P3tjK6HT$or%k{3aKQwjL`zD6(+pp(y z|7|fv_T($@zVtsQl9zes`t8eROj{q+S=C>6DqvD1j6;KdI8SQc8 zIQ}}SZfWs~)t?OK+`ax94wxOVqa#EY;kNq*`A>BM?{flTwbK=h&URU(QHzM`cmNgc zCY{986N5f>cz*!Rv1m^5S3WA50_Ag60Y!l(rEKL4_%{vClYgHs+|!lhw8z_zvq1Rs z<@4kz>h2bexo=l3{_@>|eujp=T<&xRw{F{k_};VmPIfq3asZ{&jVCsdH!U|BLv5#Z zmq4(#7*8;9L!pp{Co8c(Rw5mk~~^Q?Y;9@TiCN{=@(GQhN&d3I;c;4psfUU}=e ze*WwsZfLX^GKjVFgj~}iv(-VW)~O(TsCqvggLzabILKl00a%9d&r8 zDz2M(UXYqVo#DCH(pjyG8O8HROPQflPBJ_`GHu&C;wl%9Pe&f9x4pLc3uK_i?z|#L zSc?D@5+$S}sOfmH&u;=x7#}+C_ft|GsZrR2|JDQH^o^K}-;~N)!&HO~JvOS!DO;#= zae|6m7PztInJ485tNG(*t5NxV_w_-szRob&J00jGqN9lf8GcK%5J)xSFf1QxwE?zG zLZ>LHypcucjPn+C3Nq2zqypJ$eQ~jsO|1uQ$H%cZQ{Ap}e@fEZ*dw01-#Hz?gs$^# zc)wkJXWPsjF`De&DuSJ^cc!0xoanDTj+Y)%-&R{bNx{J@rgA&|5>4a|k8-yJc~^!; zj$7|jT6+Vd;ddrmE<4%ZyV&gYW?5UVugF&BhtG zl9y$@>!p7Mqw6ci_qlJEewR0%D9@oawdCO@H%%OzI#OW0OquddPGOQe{QI!SS$`w~ zY7z}*BueKr{JJ|`9FBr*OFJx?9gO^hRA)XpNpYgJo>#c^N{?cX!d*7%Z z&E|}E!*dVh1sjkMf_UOQsdLB25D9sTk#D$~554Y2DC$YW6%q?WOC-e29$Ur?6X#n_ zDv>Oq6i)zI#K9IzxgU!f3C#H!%9uMWKTT;fTe|q=U-Jx4$@hQ z^ucM~ZZy6ECBSMr`SXSp?vqWK7X$zUFzCfgjE>^SA`#9{405%cTWtS=)wOA{CTyck zNJsEku9_p6K`ei(HO34g#t#gMdTqrthgzaiNQkQ?E0aW3e4p%H;Rk`m0cpTOinNVX zAn!!^5xC40w!gORII`M7?(k9rjad?BU++S_%=;VWEo16Jw?&+-DI<034{4tFu1FlaG)r7vA{-$@1QQ&2m{U=l0l{bvHl88r}h6~jr4sm4QMX1U_bawTe6l)YXLJGwt!YM1LR)!%>(_WlPn}$Rre{ zi%#%QjL(;?!yJp2C$UTAa%FKw#WXc8)$5FI715@3e-KTjb498*mJ$=uXxSkxm`?3h zHO>&}j@=I>$}!|uMxs)uGFdEA)OfFSvafpkInUMmJ_GnO*9u>p#l=uE!9K)4^~uvo3sVv+kfM^mQh?-rHh zm>iF2fc_ISCbJyz&~zPsrn%lBK&t5hAd=nyNb6zwSEHPwZjtA|g5HoG7K$|j*_aR* z*y(DwvgO)U?K?lO#=w zP)L^(v-T9EwQHemKJN7ODVxgsV>x=H_;kHKvb^^UDP@L87MK+D4v)&U3fu}ti!_yrX8M5}(TQNo^R1q&?vl|^_#i>JoHl?v_rblDn z{@K`Z}|vXmb8j4^7AUJ?(@-8|eM{F`WAWo2u>1L2t7$^5xB?&S1;=LzL^R z!aa5`tc-x|Zlemu&WtCS)-^xzCx9XjCV5-}H-0r^NRyJHoXCC!i6RP|93vYx3+c}& zm2jL`R)i|7zM$^pmvQ9{U$rB~QUGHqgIY(j*5bZO+fSX>i$H>>ga6<;5YwqGHcfsZ=JCe}aR1dgrc|@he$E50|7d7K%BJoGn$Wl-gDY`~ z26V3M_)#+7*F1NH;(zXf+jN{lc-;`=7v!OsL7NSg&rv)7kiZ`%lhZ5s>D66Z+FZcW zp4I;ssS2zZwg5I9S18|&s9+>c;@slX+mbIO?ELMUq4UdpfyzS@$^VI(d1u;*rNc-uvR)k|88 zCYLM8^_4&xj>PN(x#eUsiqZ$U9EM`i`e%>}_H=|$e?TOHNu^Tl{{cw9#`B|V8LQ44 zH{uxCZajjK`(MT$>hferVt`=nn%u1k==bOP*VoUkdtBAIML=WykvP&30cA~ejR9oz z=;tP>>}vNt=~dUGjt96)V{cLW!2sL)EaC5vJ%N+_`lcr<_ziWwhLS@hzTSP)3zfpQ zr%T&H3~Cg#Pyu|A9<7bp@AW;)U1!M50usO_z8e?5$GhZHm1oRnu)P;xaOLK4);n0v z_f;0|FODKN)SAq~-ak{rn60g44soQN6r$3&D*s1YtgOmO2kNl%x9AvQv=|Q=93O1A zPyT*}zzPCY6-b2qAw3o8Bre3#BZCDN;gL5hn=ubCOQP$q3Q%MfiOSi8zgMFuCHog? z8kU&-!3lGQB-vB~eoym;>g=X)oZ)T@YpHjAhS>8mU^Q;D@2`MfpJYwjH^yUax1Z2Q zQ^!q8vIgVhk!HAC{e68uaHl!`nAiUsENr58RRhJY;p?D$;dR#YWk~MMTunnGBvk(d@OjiBAm7+kf%W7&|hD? z5N0y}I6yqcQ&xgT&eXu*O%FOMyHZLZ!qC0CskpLEGmW6nN068oZ8REJ9EmqilGnp(R)F^}EqoLW?hlAWKmkjD)i*P1i<+nDA zxD80HA&jc_tBVDrJh-yaYNI6=)+hwui$Kp!y6xRRDNlC$?Zvr?8lN*wdNw@8q;R#S zNW$oT(zx2Yi;iQ=1&(yfZF@-F*Q;t67&0ej2|M*FZ0hq3lqiBeq&GJy2Ha^DHb&ns zEjX*QehvTCOt6Wti7n!-YS@PN4RAyZX*K61(vNXx>X-Fiui)$L#>CjKrBJtrFNjr} zk(=9C?S8f%NA%h5MUd&>!7(!&5fmaJ6ilmPL0t|Jz!>&+7mh6|1f?{eJzXO?x?1lZ zSj#n5&OQA7&BDY@` z;pu37(n1bWgzmqpA-cH#A5HJTSXbM1jkZZ++qP}nM&mTLoyOd;ZS2@~8k>!6JB@Yr z{k-S<3F}(ZbIdW+-XdC@gD_*%Xa~gzWQmG-J>iBntSmW((crqk9hUlmOFszDhEZyr zFxfR}t|O^oTrla4r-LW}7_K8)|0%5JHgLnr-p(ocWCwoI4z*~KRzL55y~yDA7g9t8 zgTSS~EE{0;n()>RjabzVt?XpYZ}z{IAU6suPJf?Sh@XsNR_kr%ZRRsHT&+*eJR_5p-0@@lA8AS=O8^%Jd$?{sKs{1r~Uc>hFht&(A zG0%_jU(NZ|zY>$@7$E#^wIXED)-t$j(#U0ecO+-P8=3hFDT=?&OSGk;1eUr}6pGmU zo-Z*Be~78TB$YF4$R)phVH~=PxH7gM(Fw;OZFo|{rH>f`Yf=S%gDp&Ztw^h^@)`8! z$iUf5s82%ynkt-beiCUT4q0e41<9aMF@2?W*bU!QQ&{-yMxE&Eb zMInNnuteU5G>8LaLn6??1Rug;5Pxr~+*8kx&19bClSUU|%xmV4l05J{D;mSGT8zgv zb^LZ%!F>!uO{HXsKx6n7m5LCzAqKCk}I}UrlM(cR71HIhHiochl#RZu|JL^ikNf%t|ihi_7SU zzGE+hYRLiVwZXP?fVbhoEfs;NeHzm5gImyAx{QJI4aY|>yt)!jUrQu&E7}>HTjuuC z99psHTaQ#u<1cxLOTrONKY8`+Z}vfXlFJhIacyiINhP-9wS9-y%N2hSEj~;cYm=!m z+QC4wWd*r2h2r5d#R#iu3G;&G)kTjUmxiM!q$gGWb=1EC?vjLpF5^&+;Whc1Fs}XR z{CYWdvPo2li<8w8`jgq_s*|L}MhOYiLuL-m#oz9bJ_7OVa z=s9LA&_D`8W#&d5Y<*RMh)*kn_e(4DB9YCBCOv*TqrJsp#9%!mnXyujz81PToF*vZ zYdh=kV71>9-{S_AJ53Rz(Rrv)3Je5(MExO!&A$Bi$8qL;{SwhzV-q(rQ&;n+%6>Uh~PQLRNpA}9-6mQ9{T;D5CSil0{H*XT(@U3HF z*6!%R3|`{m2hY2G)kkSqj=aX3?MFTCtNe%eSzgJ&vdCpXZ1%s{jp^MHf%U5nJ2)a- z_ihdVC=E$Lm#KRt9h3mxgI-QPHZ3jctE=U+eZbm}3~#C(e1o+ck65hcpJyedow!#Y z;3m~^3WX1cjYn#Wlaup(5sU5U^_tR&?7K3EHtJ&3G;>AO1Sy+EoLHQl+?1eEkbx+t z{Z5dDk0==u#8aPwGlwU(w5V{VM)zygf}*AxageJYc4E!2MOip(g- zCbSwuRxxd)mS+~3%$#1_wvulbsVFuhbW9DirNLNld2Y#yOC`F>v%U96q>q|bMwX+g zgSmXx6rM&@TevCMxqks-;`xB6Cr03Dd+gZ%7InYW&4`Skcxu)dp0r=MUAzXE6t(Td zaa^B+^fgoKBHc9Oj1x>O&M5(K+MAV$TteYNkil&s6HNT84_?a?OSbB}x)@13FOSaz zx=JD+Q;aTOVx=qmL)!=VRkhPZsu5HsR=kMEGAEzx#is~M0&Z#((vdo=;YJql9M}ga zmFant!z7sk>1eSkh@q`tuyJUs*sY4a88_7U$}Y323BI0-BGccoFx2n-P=PFBSgd|x zt9z8xDPD&PtmCdOLw>>SY&u&m=fFHB>n=K;WBp>yrVY3QKXEW$l5i}Xy=9Ho4ph$# zSqZzycsQ09-UT#MNtFv1R~Dy~N-wmIHOKa?YHLC0NIWYC*P5}?nvM<`r3^{H9*6k! zj4oLHbu1q$an~xTPjy5S$(9(LTiO~fFRiJtbF&VPW@DzKAeO;YuQQ0CM4=8wyIza1 z%(kow(vqU4vusQ<-GL~nXf zW_M`ae>}~vD}|{_D;oErG?SN^Yy%SmP<^-2fz@`O%J;mwr8)h%U^aP~8I#SIBSCk} zTn`*X^7A3u^u~AScBD|tMC)-G*yQhR{ZoN)uhml=v1mbmyqiXN9C8@dw)YN9|McDP z{HxF3Q#t8%Tx)z9p;m7dvF@NhAhPB)l48Lunbx)+`_}%ky9sI?Gd1p|P+FVj7n7aW zXRh`i-*St*=Fu5D4&wQ}SEZphPe%>G8k(c#j?VY@f0$|rx~0gZ7p!7;jKVA`iO6AogGg<L zD_&i2D>BCvL?gTu{+Zjy(|i72qfKrhu9CZ`v1Ad>7TYf2cX`EmMSvu~ zP(DNH3ni7u^HU_7ezaHD7A=Xe(vq2$g8f35l}FAE$q!MrEK=s3VD;vRVhtGVc@WDX zH$Wpp4gXNr0xzV+W(!Dm7*44fISCe*eOr_6RZec~aj1@>!5p8=F!6j`73>(EEcIH@ z6`n$r4J#tDfboMVY>@BRsj6sZ!_;8%n)1f8$mlicH2@1o?5&(-gvo=DK$@Za%mlNj z#grsWE0RmWvjolB5c*xzxtizvjNj^72VpOZhU+~SxW8H_)*#J3fZ;;mXDPTk-<|Nx zCs}Q0b+mpQqVIQ7GWXbsUanrGxp@AndtCYV@#6DsE?RUAE5)h0kZN{#fSq<|KlUp_Dagi_jf2(dX>;jndZ(w}b!o zdisgCm+O=yEsfwk_ug8Q=IHT#lTz+55R1NlwYzFle;1@DcVu#{Bhz4kq;^EV%k+7} z$}0!8I=?+QBJ`@M$#nAT9@LMymW5Y$cJMqDa^2r<|3+I(<1CU=I3&C7OlQM%bvjKs zzK8l*RoG=mg{Gu8nCE}tOqu-Xn4f(7aortspE`92>idu5YIS4Qd$VH48ec}Q_4}hw zlf2H|e%>ZTVb$5~M_ruNFux3hDfpRt-*!0;(! zi`23^@pNAybvO%}YQs|G&8R~@X;6MytIFXeFGzJ9#Y%pQjlsqa8&VoV61N^?CX*#= z=l^GCvUBAxdFdA~I?dNz0;Wkr3RISCbh1g=az^82wY-cUOo-JM@#_Op?`=P?OPYN^ z4IyJFieODYB2F0lqT_|DVxk0>K~os?RDUPniC&c`|7WJ>44!Z%B?r&lgyyO*Ks8Qe z!SG8N@cde}W(DVbW3)aTuct(fa5 z9ecsS-j^ql8~2ank~CL+Sq_jtCHoypR0{(kai2BfX}r5CEJjxiM9G!1pXZZx>g+vX z=6CC$r=iTNA*srkU+P3SG;Knuo4L*XuinFF(9}swtzx$p{c@Qe1GihGg8;K@|p7Jkyi&3<1);|JR|7&puwDS}A&w~rsZ0UOYbD@Om^`@AIA&guC2Ha6XWomtUy7RS&{o85M zgK%<+7pWAU}o;uc=;PbqyJviEKR69 z1e=2qlx%leIthWD*@@(s=lGloG%1x@P)@}w&+n3-S6_a4OumnJ@B2ziEZ0>SO>x$D zS4$4~7<%Bf-?lgw0>uHD63M**AvMG*9N0jXB_w%H)5@m%X4Y@Ak4fqdpEoqWLNWEpz(pe|ARf*h7p8fSUvDJ?7A9i*=tPqZTU8>h`={b&ukUS>-w#(92Eh~6 zPWI&ID*Llp&%Ig>`Ml2fhZ&{()>iCSI>Hb9#k^i`JP12d`J?wrjVWrYw#t**fHnGA zCd*N3S!rW9KEc%15_iLoPExDf!rf1kK0w3JhFGc=)d_voR zDXduA{9^W@?A>;%yu*pFM}n>Uk-X!q*4mLnxHjhuyY=5R8XTdi>DhCx@)yQFf`=v7 zn|&W~4n@G`483BKX|#;=E|%y#P8cr7_-p@T`&`dmKFW1*1w0HRJ>)4bO1P;g}Q+6yieyc|31aEXGSvL3vT|*uL)S`#+r? zzrUM4Z?8l*rC;7q4jo6%JvUsvBa}Trp-DXL<|QoDbu8mJ%D*NND}dJ^J!o24JK^#{INe6( znlDrm%E((D;REigW-;lM`yT`i{2a(4R(#-3zNzDChEz=90M`&|f;E6=nn5*j;doWK z!o_NqWB&3^F%D&p#NRGBlt>ZM%l-zW5l2>XsrRqu0K|Ea@?PNvZQ;hE78jzpBPof* ziBFRb&Gr#w=m4?eD2+&aGyK0#I>r~0Nbr20@QUcO-t#Acy+3+vU1 zUsZ=c_v5Pwvm6yFpb0Le67gt=Ug^ngMkRu&_Z!>xz)mq^oFVH!9p+#uL{+U!&Y~-^ zxn9@_eQoVlV#pj^KD_=xnr}f@^!BDv5&ljFL4}Q)3VweX5E|SgLm@pF$4Wl?Lo94+ zid7uGDpZrT+`=tJxMBuZBW@t3v@>|9k1p}BLk7O4T%S=tD;KDNU8N=sw z)6;w*8{^Q9CUM}x5?aDf?fE_?kS%DzzTRqgyv0CK;&woDeMLqz)YKxyuHo(Z7uW$;T52*EZh=76d~e_&~C^_`~P?k}Y~y^YbA9ABIN?~E4ri6z1j9F@Q$A9(CN z(b$$${@ykZyrHG?uKmlO^=WT7lZT^tBTR(9Bi@CHo@%s5PHGTogM+gj=i&bqY;L?g z%XK|PCUHB7(%~7NeXqtAaN%^&76{j$u_ImHlK838=(`NZuYI=LqZd*)itjWf=n`fkoe z(fBX8P(kT$WO>(v9c}Ph90M=8#Gh8(I)PC>kW=5yAyuwu=f};fszj_DB@41)AF5zW zlWXVDLoGvHkjrz5Q@+F{Gz#B410Vq6+$=`ddht_X-}kxYO?_9R7aC@R`r8(ebjI_W zgtwzEdOwJaK3XlKI_4yeQu-1KhYCayig)xwM>we_FUIc&!$L4B6-!JOJ5`D-NR~>$ z7=kok0Zp6jyYrh>8nPefwGrxSJ_j53A1nu1wWO#1kqesuRWpYbbZFhByyPmR`r?3J zO#%Ee{0U*hY#4P-U572&bYArPZA+ptXOlbJcwe*~yQ+{*B$Z zKtbFgg|$KZkKfJyWz4SYe)HO7p-j>KZB@zZW|!*ukCf2#N-U=#kw5*&VH$Ckwbi9A zB+REy!}PM8&1LA~QoD{qy9c{RI0O+cM?C^N2)qLE^{!^5$*i738hG(}=Tu}5vwEMU zj7r~8LJ5A0vtoiBLmpBMu|JX_-(38Sf`ciMK0hl|@0?zin0k$Sd~LE+@S$AkW8T+h zhYJ>b`*mjR`m2p;B%V%^AUjxgd>(H4*v0=vld$`i@^iV=Vee0$$Ql;YuA$%uONmD7 zy_Eka1>tsEoV6Muh*J3e(XtysTv$RrojdbGx3$52!hT!@AGQ{@;iH}4|6u{-akeK@ zv0CelmIYhvw$M)klo7|15yG1##`*N34YZdi^^yvbDScJamGrk{)oPxdJ!-~5NE~yQc)25J5 z*GIclhC9CuBif@Z*v#Z(vmAb>``%JBa+`eL&xF_Iv^(zOu;H2Ih*-QIDRg0=*JX{; zpAqa6^1lR;uWOBR87tOuewykvKfVcFO(6KIy$Da|MdO`iZ@6Awf9jmrr?TC@%6&z0 z>JJX9me+`>3t4uJ#dG_x{+ul?%ajKwJFF@t+V)e10~GMa*>{T}(s*uYad4y6^(D_V zL={-^0L>`jm{B`9Hk(%?C*AvBVh$a-C1uNa1SH&-&9b1KuTP4Hv-5P1>Rdlim(fS?Z(gLj2hX3P+Z+l%vTZOWGTFt%LFz6U3(KXn7>CclZY~+}_5@2gF@6vH8}7(=-i1SuBOY)OupL{NdmGR%dR*5hb663u!*a=&@|0QJCXN^#!8cAB_; zm2&cAg26S5deqCbB8j;Tb>eyDYI1nqK1+W!bumI}$a!TdU4RRE6pv~atFoeFc~N;h zl_5a75(ZcyF~l;(6D+4D8;p@i{qGckl5R*EO$ucXKcx@#&=F2T_V2vjHxycoUL|fh zHGC6eF~jm86bTnKL>UH|a@n(xq3hn*FL!sSuYIM@;NVS-iX~OlMN0wK>^ch(|NlKe zSZ_Hy_e5?ecyrqD$MfT|HArZb`sp4#PRvN9A<%UvDw%GZJhn3;bT$l{v@-Z_RV9KZ z;ukb?p^P1$_(VkHPZQYV1XdggMsb4=fy`#*@+SqswE$P!Vy$mcXrXRl)Rl4U!fs3{ z$MywJ1xy2<;WP)T(X0Rng0rw@Q?YbU7dVw)=n2iq|F{io1)?r|VXEf5 zvKy$~$UDx*LPCy>K{rJ@Hafbx_0vzwOR@!q(`Qc_0W;5mq%b2auu5YF6~SMMs;{U# z_xw9EzUHDwHkDlp8EA(J-HzDRe{jZIU@-DzdtUS{eG!>CtLVXsL}y8&EV~lxBn4I% zr93y2^tUAoBlo^>dI5_6fj4zSF?4n(q=RLr6^|9>zBg%C8Mv`7_6hd9 zTwd4PK4j46^1;>T`Vd7mwq0{&!3+whNCh@NshoNtNw(}vc2c|gME3MJ@z+0EVKQp{ zDT_r^22rvhDcf2XfB@;)1A{DkKE2jdK}*AVHq~)-V@*r*fB&*YTUuD!+t+k2F&Bey zVO*@)KeKj@cgA5(DW|`SJtdWYDnn z@4M%Dq=U!u_33LCIRZ zq2td}vgqs8{*kY@G%s(tR;msi0=78_Y1^}+6|%y?MRo`~pAxRfIxE?2;j!Lw1aVvo zhVpL-Go+>Ez*2{A%DJ}Ihq{C`hplvxj!W}g%-E?#eU_>gA2}E}*)Hl;_s%=qCAMng z-4TY8=pu?NTII}I<ZDYD?z|q^z2P`Bw0h&mf;$=O!M4;-Z!s`F?hEk7m;& zqzBaFs`(aoVA!pLmH=~sVbwi&Hs-rlN~*MhcSv9JHn8Iq)A?f^;2fk0Nfk7|^^4R! zK#gPo&&LIVbPm1)AG}D(xDWW113rV;@R?Dn)#KdmkxYqZLXaCVX}uQ{rr+s)H!Egy zvgH9#o8}GYaj^(i5F_Ws)@1YH_UG7bkY|8(Dj3#kPN3_-NOM=C^$jlRuVIddle~dw zr%rxk)uNi#^(e-rNbNf7qijujy!s=7gu;~*#X?2KN})H7$OL{P0w5Mgyk0b?5L@mZ zw{~cx?t)tmsj!pl&M7q)nii00cBNaq(-*HADMQtSD#ZP{r5RiD-M3!D<3}A*=7xt83-T564BI5tQYQMrh5)q&h9f5bOg|0lbt+x%J5* zFWbPYq4hRDW+C52=Ri)C{N%W`? z9Bi{N!6Mh3jHQIsauP0QTD;MRgnabD+l1{X_;3y?4YE|j-tL6&RJOi1D4&-@{NPK% zF1K~UBH+DKWiWyLN)U`<^2{XPHmWQ8k#gP)UIKVGs`O8Jz;T3l zJ%yW+*dfLIxQX-?yZo)Zde@J10CjLaGRpuM8gCoyatZnLBKcS|r(oYHs~XsIL==QO z*=bVS_)PsG2Vh-T@tTTN5PAOxQ|-tzh1t87I&t}qW7&#wc~ilG=v{R$xVI+v`*2n% zOcQ78Ebnj35!5i`G?^unBL=6>h%AH?Dd?SxI6jt#}!ZkP1g z6W2dHPW7?lOd53EvQ%%+=UpkUiIm=n*YGQ|kH1PJFO=?t^eQ##I6~&^$NK+{kX2{X z9hEq=KvfI7BR@;@Z$vhqR}3u9z11qo&qrBI!=xaBo~8kuhdC^tCJ$WGCj=O!r9?5l zmv#SVTq3_~2|dp_T6cbDqP&;+nU#jdWwgyO)6-`$8UXqm7ypR<47BQ~SK=l$q2({^ z2AEp7LD2wnbyv#JmXBm_`lXK`ZrL!|e>sS5ovLKOZ|McH8KMhONl-FSc?CK>;ne<^ zPPgbyx!6gOWOmD`@!X^S795&^xILIG&Qv6uNS z7e5Gp`!Ik|%bbPm_4lhg^uM)`n8Yw(he+{qeN(YG9nAY8)g;3z8kAi4p+{z2Ne?dF zQgvOab4cwmhgzQg{1KVIQv$dMoM2b2{BiQ7qoF`lOIoCzg{|cGigrU976_{pl+)?P z+WR{@ba=Aiif$5E53rFa$EOD6`zZ@)1%}EK9*19E74Q{EKtz%Y5{1_Itxc_vNF0+`7Q;Q#h z@b-+abTDvAf*GAep6Dr>G?}z~j|9d?3*}l)+(4FHKbuj&e|sg!SR{}k#K3|E9wx{4 zGq=lmYw{$qWvLU%*+ENSG1PZ9(BI`leq@*jpKvnc^GZ|tZu4DBAHalwkgYZOvzovK zA;6v$dXQ!yIyI9`_0N)y=mzWab7Pi4^KTO$#VLmI>ZM6>KMNmNXW5k78Jn&K%Q?|m zBJq2w0}!e=8r{K+-lTo3S*nG%6*meP)E{k&JMLxX3E~Q0IsX<`q>mnV(f4@Ns6nF0 zk*_Ta;VO}K$<-Rxpc&0_sLHUK+XpS}F7RQz)*~}?epgWPolnJZY=oxc5m-lr=8G-@S!xZB2y}=i^ ztQYjGFF-Qq_?QBA3mP8Nit~6Ve9>@(WYi3~HF~j;mtxkW zhChy|I#WTG^yBCvSb?NLNIK6QX1B*Fu*#B&e%b56DaSG!kX8Chrd&lAB26;Fa-(}- zOGe~~l-Ut!x^(63{ucdgRC@^J6$+Lvh%c!~MSDrX6P{wCc(Nvq3o{I!jZ$R&*s|&LxmDa_Uk(k2AKE$Uj-np29)! zOK)l83tL~U)akCgbXT765M37duan=YO2#g7K0{hZEs6#I+-(swJ_ZdISPDekw`Y~( zqsq19faqto_c6S4hH(GQpB!M>D+$2?3#}u-XlNgCMx^;g+;L|kv4e~EY|NUumghO9 zvl1hjrE|CTNQbLFxu>FP2G95@8AuXHD1g<#Q63N}fYLRIzoqDUL4rqWbLvqECGrT! z>HjVZ?f8P<*!ii~jigMz??Gqm{=6Mb0Otb zq^M-Sox;)6w4}#nzy*p;Kw>1utQ8i0C)E|D2$!C~lR2~~Ya@tQ`)FS*5@{}QWi)kd z6uqGx{nr28*83ZS003XKQ_wgEdEZg8ZVeCK`u1Vz^O>j0edUi*Gn|f%#7Q$fAf~=0 zn7Sjm?GPN9L4-VfU{4*Ek%E-V)kj@m^&KeHR-!(yv+TWU9nMS z0A;R9bjTPd1K7)mY|&&cfjhVEkc%v_j4S1oPP}?1;rSqqDd7-JFA!T)M@A2V==GXC zEQY8%hlnjqR`P6xXlzI}w=o1Ilp^{9ez;opQqKblqF$sbWGTraZaAeXY$e7DZ7}D| zpL8}H-&ZNCoHxqs>7pEjhwH6f92pQ)2v}Y8fQ?uoglTt4aIw{ycB{Y7^LtL_pm5Ye zqw$e#B+F<)Zj#M_0fjdkPGyH2(p<&z0~~d+@7GuBSk`fbJQz1~?t(X%IWjwE`cIla zE5aAalo5k(-(_VDej+bMnIUO~w&Cx{w2Z@AONgRsbcz3@5UkuAvi4uwe6Hb)CV#XYA!A2E3AHfVPZ#zAn*ZYg4d?9^-!AvQwi@_;Ys zw}`f=Q>(+VkzV}C*2C~KbxOdw<(XO9y+d?~&(WjuPq}%ar$`xyC3`3_-&MQ@dAB$c zjU>_-A7(mG^K&HPkYd1Bb=n*(Hw z4TE5)0@wVadn;=zQUZK2j&6(vLLnJaL~WhMF@NPsKwb~Vs}JwBNjlJ&VYC2k7|Az=cObUlqhPs z+DqabpYQuKuh1`OiXwy0-oF^Ml=g$OY9VdAE72cP>chqUau~7dqfss!$dr?bk@dLy zNK08>CQ7iYqe>^I)hzLX^B{91wLNU+4};{(DI-T%ZiS~Rk*KJXR;43q*WHYy2BC1+ z5gmds5V7(bqZ<^JD^x4zLg~ry9}S`J%!7Z4ZEr&>17zl=ClWQJcX)(%vChsU%&sb4@}})y$apkcGOLZnrK}Y3Gkd7hM(}8X=rQ0$ zOmxO*m@ZT|hvyY<(Kv`}4bX%Ha*Q8u`=TyeUB^(<>OpCH35)$-WOU>Qp@~2NQW(6~ z9p20%dBMy=3`twb@_VN8k^Ei@i@IDA4bppvmILLIFEvEDr6EPRYTjH5@18DOzO#1G z0&acvLz!C7OSDBjE)ZkQQ#8@*8MZ(-EcL_2?*$TMXhWjy z%qVPMw8PoAMw2J)#nVQtsYm5_JA9c49=4O2R5-Enk*w{^Zh1%z78omsHi>F@tN7*9 z@O1B73$V+38(Moul@ZQKAk1c-wKr12+7UsbMhm;{#JG92PcpzmN3#c$cWC*?vX1)V z*Cb-h{Ig$Zh8~x#nq9e(zGov-Q;3a4*+Z}h86rqjw=xSY&q@*AiZw#Lws_W^L*;6! zxQXmpQzO=3`R0FRh+p-nv_#C+9@Pw|e4v=QG6a!f8dNht&xwC+ zl8k0k82I{4r74dZbr85hKZ0i)_n|6=;-FbXTi{_C1OGx_AQ}2NTak*3F1kIJSZsjC;Smi4Dk7=SXaNe%Q`NDpOacq536suh7vk`7i^hXP^Tm<%;p z#f8r%+hUibhk2g98lSd|ob`@#u6|FK$0mWBGqZhzG>V4-`$Z|CT1>7=Dm|8H7LjPn zV`*n|`P-xRUF*(7=yB8L8iaT;Fx=K(HCVOzZ3dy+KuR%hjLwEFa*z#~1eK(wR9fM3 zMO0eRY4Hs*^u8O1kXr7tl>MN#WXt^v|%p*(*D=NRHdT5&8b$=6&pe z-;)5GpV>gum7k-dkkPHdo|n8q7m)8SZ#M@lAzU$iOj0m0!s(W%155-GVbZOUj(6l0 zc$8ImlqHD6xJ^Zsbp9SvaneDDqLVT&5d$3$ zbe+K-X5SyW9=u;tn-mDh>x~orWR{%@EuS^AoeZ#pMT@}H#lneT3KpJF{s)U3NZ=D} z0nzduSk1>auGJk~-Ht&iuZ#Iz680QBnv!)5Rg~COoytns#vE*PFfDQAj^wQN)lB`| zy$N9CN=PFN0Y+kifwJoO1Yo|SmdCb9rgr(nog6J54cX(|Xon+BGm{YY0^30#(eZ!r zU@SdN&BLO6jWM<)Sn8_K@YLvyy{nO!*^bKdhbH?SZ%wFVCBBlk0-*lX`qVPBMQFyb zNKl6`Dz2_>5eP(nKJ>LK3?J|ChO>z_Yu4tzC2?JG;GCcME~@Q>kG}uo<#6ksabqtXN>jmIp7Y2S%e(p!@BpC5QRs&sOBVU@XtOKFp{!o^b-2*8s$j z7?}_Bj*LvF0kTfiq1W#uxWVYQl`sd@*v{zE6jFE8 z8OyMfqFsv)FOxJ}56rv+@^7#QmB0m6*Pm1?CR!f0&AfCK3o&=&s9Au#JF1f`k)pVK zUMQEOB;=A=%%j#+Od<72#L_YWB`2lveXP;mSQTf%gOx4c2(VQxqwT~n6#1c1ka~Ob z`G07?^D%sWY};Z=x=&=0%=k95K1T_s6h0^Sq>{fH+-1+`bPaRCnZWDVB*TVwp5KC= zlTjsm#f=+3wiVy$QwnbQJ%M~t6JI0JbQ7?%sSf;!JZMiY)S5&(qsAVdAdkky*+O2F zTfEjn)?nYmNl(GDWT&ZPL>5XC4`wKWoQYv%%g!N8R#(UwDGv8TR>t*L6*ns`(Nxzh zb+IN%nt|L@hpzU#8$+Qv!Vj6IFk$qF2xc%V(-oI;R$!J(@*f+V)ZP!s>y)4mpW2jG z?GW1WC3U<%Vo`{u9VwpH0wPzw=nZ@*=2*Pk5wl5y$=}Lv6|lXyNTYkxo=Szo%g;;L zy^LVa0~OevQ0z3kP>Gq1_zj_>Ie+x@V>Le;3#jVLb)8wO?>R^7#jrS$f-~aC^d?R? zn=L&0=*Mm&_O4HSXfmNi>GKyfSVr7+ZXs^Rs7CfKWr`LAT)(-aUf6j|bAw#|d?Z32 zWRPu^W%9ll$d6W`K?+_=Ib~WMbz%4Q56$KWL z>}-E9BgH+hB+^R{r___wDI4+J54I zA%qM3|AOD+&^OYCK-j608|GoCU9u1no8Wu|5vclusdP^w9U{?l@B_Fv5^nH5^hBQI zYza>@vdU2gZCK_3LI`_~YSCN8lN#o{;n^fCk_lJkFN4f~E zYN-+2xv+WvC1D=n9o=IyG+tV~e!&J6^1B>yo=wlb#;`i7%4R0bk^mN`XiJD|cm8Wh z^)q^rUF6|y@J|-lP=jc~@2vT-&tT9NoSf1@+4WegQ7oD*nQaJomf|i$VV2h|9@-Y(Z)UjWN#K;mzW1^dr0QwM<0T~h*IMIY;H{tQ- zU`59;@ARyMR9n0XHH~?qDkSP)303_zmZBw@$_=q+B`JehsYR;Iqoy1Hc4Q{IddQG} z!novuV1Yl^Y8-#dU7AI6NRm1Sy9Zy(R;{My%o4lOV^XrW!alVx=4e3I!pxla7eP;& zxI%)Me4U|_z=fg=Cru(HbZrQtMEGH75y)AJ6B=+y{tANuiXy^uB8&3q-n&f~c%@W% zFvQv<4*eSLvVRgd5K?$Jll0F+$;Oct;5A=3g92t$%BWBM`~PKsrvw!mLR&@E3#k8x z1pp`|%U1@?+a&m@2iXsk$je?yrdIQ%8A#t`~HU((TQ=py5(cM7$oRfa{dL}x{NfVg~ z9&vKaL{e8Bc=4qQodl+4(>P4#&j#U%Ecc2H#(b!$2DCLHeY(17h4EK=^G`|qnVQC6 zryq)U3s%HJ<+>d!KCGTnxV#I>0yzKwhuo^*Am}42MJ>dYAv3Z@r-vD<$_a;-Pq!>a zb3$5GuvBy;=Uc;LQy^;`W-10^2+x1BY@%61*FgAANNSCT-aK8OIEfmuAk(Oww5yIw(d>qd@4y70`D({ z_DlR5wQid3Em?#MC*-*3@<+M@7yk?yW)#DTj2*2gsp2!p-J(+ZgL<w^c=`a*7ZKGQ_T!aQo0`Hi*lArx6qcwHSy{vWDEi_GFCa&$rv@Fcu zRdI|9{4fg6nc&22uo0qN+oE+glIdJyM*UGlLwe=Qkf z9zM#@-15)xF!O=J1R<3>0b=+*X#qJ3t+*`=3J^k9rGuH-q^LBrVX4_yg94!SOryd+ ztGPrQV)wn6G|d!c7`+IIQ<{WjxUugK^|i*@u!ttUl+3ispmJz~G_kU}B()qa|60#- zW6>53fH->vK#5sMDLS|HH$YfodUJPLgH%s5y#bALPRNMCtu0z4ygJ|3w2f6{wFg+} zf5lVSV%#_1_qzwWZa=1Q-iKE9=hE7zdBQA17NEUx8uY&2|5tZmK^QxA*`lN*bl-RX z-t9dU!sH`KOQZEoM8>#|6Srj#sPT-_#&@HP=4OmNkO<8O?W6JRdvTrTOh@|JA47YM zB)s2v_#S4ReRg@LJ2QX!_1{9OTFGOmysSw2%q%}vH0Z1I;1#O_|MXu( zOGLfnmD8s?jzoZx4l{TCo1&NvbU&V~>(9jb&*Liw#1Vl$F`#ze)#6@uEkK88=e!N4#=kTf-P&4ci%{ z9FJ-Yo7^eG^S^{PJ*+vOCv=8qhR~&oIM(Zy1IltvMoz|0IRSIbc~ttkBTF_dPU|sQ zr)5e(EGPMYK0m^}PHsQ`{Zrf-F+qNs{#$l-D9EQbz19)Lc}RVWcPOITKE2#f#pzH5 zsMQO<*LV7_l8{hb&Ee_TmJNZ4xe(Vr(NXGh-h8A>)9J#!Iywb;CBNc@!P&{TqkH;Z zA3nq9sl3CAl;(dPPdAftQaIC=EqX1fNM9HF@AFdI1IxXBOop8nSdH4?2HWAp ztlZ!Ek(wl5A(N2PiNBG13IRvqW7xR!#EO@8pb`!%t1<2jNN^d1pK(>-XU9S=)0_*s zRYC#^T)|r z<0sW&?9l^l-;W27#!zqndjh!6=e_?#pUJ?FF>=-Z?(H|2`VL6Hqa=^pcBXeo0)*|I zD8m<+zdYb$&+S1!p{dc4b!J!A8LIQe<#35lpB@HPo|M%Z{=Em25->-;#vvM18kb|-W?`f{|NM7c@-UuMypq^j9 zo~67;?%toi?k#wDxCe!{JfJVVjw1(*34uu)UQbYMZ{X|Yl=&6BL%!P|n7&)8f=*_1 zhM80I9Zqxze?NTAM`qY6yP3gkg+mioh@)r2tW>Cpsa9NvG&|17X9RoG5()#_8c;Un z1KmKkRjY>GNihsGL4S5m>9@Zg<6h2ue^bZjvsYHRSq@UP`@BK=olif!FXakE$3T~9 z=JWp^i6tHSb={NO@C7NdI!L#+HM%l^{pJT_>Y}{BZoBcv!RHY~Obze&F|~}6B{=!h z-!s5R_}KtlG%RnXe+Fdd`*ve{BFk9<(7&4>+C>Tmc0GNwYYo){lFg*96B1OM+u^4a zriv>o5{%SXV2I_%iU|H#+Qn4TR;@LEr@^e<-;fda5CAzX7A}=LlLi<fX?}M(7&2Ox{=k}+Y_boxh2a9}4?bs_^ z1fBsY{|A%zBYnJ=xz_8$-%9wvj&5*=mb~U=4`jJP8O$TklQ$&P%1D-Q@n2<%r2v`q ztO-@-9U2LFye?DtP$PFgOtrG3N004cf*e7Ua6~p9gM4UaHl_1nyZ5bQA(`_@n$Ml5 z>jDSGyE&z;AZ3Dlsm6Ykj_x{aNcp=lS*shD+nL-_0jm*$U61{+d;VTE$h~=ROvsz zABH{ z?0yty_N8_rn7fu}8;q1+u1--1w?%wDw@8l$IT4!Y>i_7B9vMOoe8K%3x`bZbd47A}eoq`}H9qVhaNJqLL=<|tyDDV6 zSnR3J+8vB|+VA}!OG$C1B-nWN?7gwE&0wZ-^+^1@_Y~eKP2n(j4bp!~Lp7H7CoC%; zd5-w>M`a<(Kkz4cg&^rZWDm_ho@<)D@!a-}s@ihp_uO6ziv&-1|EdCoN}m&YUEr62 zQolKq#w^C+!%@%MaM-+p;p6E7UU9d@)vWb0R@5_z_j*4LA9*%2tVYX)#%Q*hfTrB? zTEo0g1I#@S(|J>{_!wJZbqpSFOB&HDI*hG5EyDxOH?Q>Gg3#M?N&4I|yq{-vY1W+= zzC)8fUF{lT5oTn<)7~Czrv5n4p%8`N0|L?`NPHrb=4Gj=%iAtmADjF);69Ef1E(w0 zY3Q)HHtIT(nFuNU(tE=ac6%vSi=F^q$@wahTU47AZKMpcH4WhWWQFQs%c2@GP(R3rJ8?b+WS&ve-! zqhXe9A6R|IuCUqnKg(TD*O-16@GOl18B>Iy#y8=@qOh^{d6N>SFau_Lez~)B`*IG3-{PI;@7CM1F9>rlaGw zLts|DU*CKj9*{LoN+#j9XA)-MrA45Axu@>4sUc8HYp3hCkaZ{U2uE5Xf@C5e@0KJ@ z>=W8B@7!t>!0SLXd1|mGTdTfDBcN{OWnJcU>3~ znJHb%s=R%Q`RB1X@X$?JIOt*Avh4Kgf{Y`76fg}Ii5wP36`VRazfVY^h+}7El_@--2(65L@44Y01*geNZDW_EGG132D2TUg`IlLQjg?8;ADhNzPiqm+ zvw^pUM@_JAeH3Fjt6m!pe$NR)1CPD`e&@FJ<`jZA`r2NnHkWoI=&5(pQ1_R$G5;FO|-0_Xv_j=N3 z8*WYLIB;kiwgx}6YMD1iyNN@0BwAdBB-|z#2ZqL@2IfBCj5~f_b`uJ+k5`m^Q9MaukL=Z{GqclbAP7o^s)-sbEBNV1`JB$|FP?1a-9n0 z_b2X^spNp!w)#0bIak0h)IZ{@x~8$DLr3%$&?ufzxF2Q3SXt3s^9d(}wC@qRQBsop zQq!#fixetWwKT~25YJ+pcs2VH>HH`DTVFxy$O+VN(LfAMRxTkm|F?uh8>IihKkN|YjFh0+3hRqe( z;2UY!N7nlMl%hoODsTGvNlcX>g{s_?tZ2OEIv4GGv#5-(5*`IwQ6p0xVpE0r@H&*; zz4-*DYU%XcNY7`Sz#%e%8O>&Bssi$Tlhq>`K3G@p`h$ccDeh*j7?mtG0hqUc(vUKR z3nexCaPzM=nP}yNNOZ*g?;i&7u{bZ>NQ|?ePY7S-k(R(mV7uZyT_rchLDViI*a+s z=|~?T2>EJr_}Tj)Y2$MM_wy(Kjzeg?O$;!2u99BF zLPmXUO00PUU@QGqS5d@$ng%B@5I%N&4E=@-P=Aa$w~D{}Q)~FgX;IOQ$xv!ETFK*2dx#q$aO;`!S!AOi2K{GI=PM~eh#2}V6T-b|?{fE7w+IdYiR@08)cL%l&zCP&?{ z0pG^W4!(GoU|IJ9q+B7f0?=65`NRT0NyUOwgH7k9&+f`q`3W=VrJkM+5HSl7pn^ze zVtjqPt(EI)a8Zg*YWfjGwFs2rrrEi3q)Bhwb4?+r>rcCTeg+3YK{?pRRXP?#ieN%h zRC^Zwgn-mrwc(_@F6~F9si)W9HrjDCLyYrXp&4tKTj^xT^2k&Cwo2S3})!4xC>S7J(H zWv9istD=SmNMr4iw9d(7a1DZOVE(8kA)`Vp>WFG(_2rM(CjI4xcWy?26U!$V!qfh2 zVCW-r#fbTrKQ1W;^MTKhfggt?t{z_TGyKd}k_Jw*Q6`OH5S8?LFO=$7(w)zrJr9^4 zi-D{Cfv-*6K<^t$l*x4Gm%c@;D%b!BIdJU6;-brcee4pi7~+rmI##*$%yE zT_aO2n2P4bCP@w)qEP-^Vy)TOo*Wf^_#qWgA5&-mnVdXI;uXul&Agu>{CL(}E$knrw0f45HtI@HKcp?=F_M-?Urah0E&bd=-{Fy%){q}GJqN=!SMPwnVN3%Hm6=n`jFY&%_ zfb4$B%Ny~rjdz083I%18aaH;VZ-nJaxqAwqx_q4=)f^d> zsiW~@%eBB;EUSo_Mw3C?=C3?nT@kHR(}b&!>S4$t^1ZFjUMHui>}JvRAf5#csJWYvxH_vYqhlerLqeCyNe zt+uuLz1f4CnAHYJrh^N7rf^F4(@ym);-tv>{AXiF9GuOZtU^5Fm920y|7O`((=0A3 zsh-pqIa`-lxr{};F_^GMmEsoGb*4dF_a)5cU%D|C9*W@IzVlPk!UDw6vRqBj0?>bo zK{#WJYot1mBAtjVtZt2OdIkoA!SBvjg4@U01hr(q+Cn~NJVD>^;?a(Zidw4tSrb;Q zxc6>E5t$irfeLWQD|+KcZ{D$|&^R=z&`_GTvAD0DD{s8M9IWRG6}XfOSR(n@ z1wZ=T=<)gSQ^JAW|DI;0_f;1=T+_cC9bXghKbLm4-o4$u;_>iLUPq~)6OFkXzt&p1 z`U-A8zdBx*2j17kDp{gy#`*1f1}1g1|LA$R$cwe$q@o5QLuF7R=He&lcV3d?Ww&DfeQmH6}7+HW_;K%W%sVq>6R+-*XrOhtjmJ1!xId0Ju3)Yn9$hWX}3uemsZ5q9(FoWBETWR-8&P%2g za4I-c`yR38wU&mA^0mQ39M^SG99hwPZM7x5p@Hlx@O*goK!jT7_YdsT(0&-mtSmz4 z?oC48<;h#@s&VBwHb0M_m^8k0I4I(Sf>YDe&K~yhc6A-W2A1jTFMJqL0Qg6u?-wtM zoGdmYcO`ZxdtUHlN$cRA z{VlNo>dB~nD@UA@w=X;^{ZbrCP|mM`H}D#JfNPT3ZwQT~zS56wOc_&cRKV@xR? zXW|3NTPVlpIFV6~d7b=z^5&HVI>jD3*!)$y(f&jt8v)!tcTGPa5XHu^c>%RedaPz` zsOm2@%K9i!g{6$Q@n-)019OSShK2y6@gzG>h0ufoKEdr`NruY8)0Hg*YaVNS5;`7) zCqJ8t-=Chz<#WGcmROuW(NwP zusfg^L9vAn=(UGliNCJf+mZ6{p!Gn)Bf*?gZg)S?*j(eaQ>*Yb0vhLUNoB%?Q_`k9 z4po0hMDM4Wkk=XR6S$SZ)B7G67=l?&&GR-#;rDRo-O4FX{IqhMnK^+`Rk>Rm_$lva ztIAo7qm$b~i#@cvTD$o+Ebkj7A2gDfffQHx`jaeD7B1h5uw$%T&WMB`&egW;vw{J7+}o zJ02By_Rk?VMBs$2C}@vXFGrp8|ARJUwsYvU7nT1r(VFi0wYMFS>?L~!^wNVyC@@t)sfH+0@Hv2oiJzzm$LsWJ)v64GUxe$7BOKDmw zm1d+!$ULFIpXqaja50bE!k~cgkup{*ZQJHCE@7F7i$*zI4fw=8OAM#Sabq9MQ9Y=gNRWvi5XN|7bk zXt|7JFcP$%7tHz--Te5A8;S52(dcK=n2g_6qWzCi<(T#-f60Y&3cG8fTbPJP1r*71 zN?nIBd}xpe`PV1I?K)Zc3Nl#|W51YAP~d4l=?;%?F=CoQPNQT8v$`=lTDlVXj z^l@S~$>Ixy7*DBoQY!jd367^)QB>oqts{!SKX`y;KKS|8x_-bGyXtQFZ@jMEO)=N@ zyx`-XsS~b0Vz^3*u2fpYK0de(x~~*K5S3Z^0!{qHU?sf?$Q1ICQ7-NyCY|H7Tdu6^R4cL(n&tumaY&EtB%u) zQ%hZGcmnPp%{6C|VJuM0wP1LR5qMt5q6du9QZLQe61b$VE49+`-%E->v(B$ zy!As#;022Y8g1Do-LN$&A@Bvv^(G>C9tr%U7xsChq(+AyejfcTCn~1XfL9|Q?p`^t z6$Yi8mY?8z0Hyd|kgLI~pU?7GBZ+obFPnr}6JHIMpU~}P@RvTNcHimiS29vB_U3nL( zA*~Q>h556%^>FPzU`IE5Fz%xYb%vN*0xQd?hQgI^l^@S7xcjo5c?EB9RGD+XhKh{g z*LK)`Q5O6lj8k;4*4-5K)yG^r7f=?uM_zW1tG0LSw@xHpHA-TGQzAJGf{$TzbTqLg zA6(m&EgO|OwKe|AzO#1h(P(=}AD?$w{<}Q?LjM~Z2mj3JB29%{sm+<*$jJ$r(YkM_ z-R~dYEp0=4l58$}UXM?$9S@T71*EPjQW)*zlCLp5LR!8b-lo}i+J|fgsKa3KU7ucD zQKbDe?Ux3qH1L2AX>X^ZDObQf+aX6gIr2;6I?(#mJlOE{K}B<;Z>SG}!br=M$Rz`i9Ng(#W9n z$TbEVcU_IuMKqvOSs}&Rn3CiE|6u{_OQ^H<;@VUZD$t~g!$hO8_=UW1x1Z+ zzY9d^B)6P_RIkaB{#AdAzP4-fI9{FipRuY%aIkZW6Z#yG5~r5l|9k&7IvWuB_``VQ&ng1T1^@VJ zm&ty(roBN^>UWpS-scG4w&VHYgKnMGt7Rg5T&x<^8_Jw-wPnTaNa|CKR#(n5@yDc> z?G>kA#@41?OGj%WDsg*gDZ!yE!$MBEz$EMCXi7p(LR+e4=PT5peomt!I2OD#8FLZRo z%_pgjjB-@#Z%FpAj#eyM>9n{oDJr_V<@3fR$!am%jj~L!vE`Jyk7K|Vb4tNpdLWqa1GJgeea{5J5k%42A! zwKKer0LI;=`rZvP*g^3iWGV=QP zh|~gpa(g+WGW9iO$Mvni0HBJK8URTAj*LIOx35=g1GKocn<}b;{Lm6rFoH&;lcsTH ze2Ceo#=~|e&AmD-z6gnl48**c^|mS$kRoIPfl>$?_|t$8P__iQD1BO`llHgWgC>#h zc_qh9u5Sl42@Q{7n@=+M1dF*mYlBBj8{Uu8D-AaLWln**j~+R=m={#9zeV-REzzfq zbF{ZSpj)|NswZ#Te@h)BT!F13N-l5dmL>3X=yG^WnaZPotF6f!BMPgkwfY!Dz-(rr zj!#yQnPYX;Lm_bghixW)#xxl*k`4?Yp^Xjia&&xxi%sS>z4-A5H#J}HeCw5UeHGt` zA~bHbC=uz1qv;)eO|Q_y%49FctMIn zeAE^5p*wBYH(GBW4^6Hp4h}|52VSRGP#+ErW^4{^+M2`+IS7rG;+$1ga?oDnYyl#` zMA*no9nD=tAv(GyrYF1~;DBOHYOi|$mlH3aL3*B2)r_eAtvM}FD$JD0-Wzk3k(kLL zhD=f=n-g<2+c@X~k)dG|(XvrefO5P<1Yz5VBeukCOY*N$sGtwmLkq2=HaxfZU#^+> z9-M|4R&ICxzdhdvs=z^V^zDy8NC>p~F_;y8QP5yf!L%|5IY66;ZMqV=!cln9LT&F* zHW&pxyXx?b9IHnvlqlnTDcE5Vr^A4NAF-?6*Q@y(LrO1>5cmML));X*nd6@GexfDH zB|d&3-0V(BVY#4S9?WUxKA@OSQ(CXE0l#jZ&`>W%!tZEb^#~ogq#y>2zLq}BixteH zSubePfocr(^+3}4s`QAj>TLT^50nK#e zVG&B;(j=UwW!tB{&7B~U2xHz5DX}%DY zQn=_?GTP;*dfMJ7p$2GZxC7aGVN97tku`{6<(zOK3EUG#`3h~G@~%J04boi_c4ZE7 zTpUe~Th77OjQStE18o3Qx);Do>y z`kp9;A-gfQsT+R328c_YkP?bREG?3-L!rlL+ud3CnG|fggDFkUX&ogfH6T-s)v(Z~ zjG!w=#Vth<2T6v$Ae9Kyfu)MnEJ~04RfkGShM~S8iHPp}cQSZA6l7>4U4+R24w=04 zsVR*%?y|eVgbe>HwxuYVk}afIani#dwjwOVG>NQPC~PU0;z>x2?Cqd99otZJ86s*+ zNfOgpBl}cL)`@6iyov6xPXp440N7*Gn)29wsZ^Ac>vdezI!BYbmRo&^C&7Vq5!LR% zQ(JO{!{E|)b73WnQsE3EtDB>|tDMfWByiWuJ9pK;oD9Z`nQz}o!&LoZ05Sz-cU80s zomP|B5DDvqRe^$2Y`w(XWWeiJGr87kmr&p8Rx^GojffXFgDN1D)tZ9VHco|@owcwJ z+q!u0FHBf8IpIQp3nM=JmmpDH<8NkF8=P_flA^Gp>4=B4N_v-}dzc`;g# z9g%8T7v2u)^)=im!xad1kYb{g>S+Ujkm_F(O#0-LusK>=TDm@p8eOC~Ogg+3S}z~i zr<2&e-u;hWrM-lXEJn4a3!CbMj&Mrnd|<$hcLka!b};CnrDug?#x& z>deE8{AK7szYWFoMiLqmbj*T76UoXi4iG7r z&3kL>3}^!%9mUXCsDDl(2?<(HXPyDJH2`ECs$p#-EN#oW-cg5dk&kZs+QIu$KR011h z3OaXqHR2ca7sn4m4*>X{PiTdPv1srvok`&jSAYpY#;Q=7(kU3Ux1yX{OSpW|p`kXK z6L$5AK$hFoyRSI>zi-1+IH9$jqs3+sEDvFIU&BI#k}QB_QzpNjU&j}xvq_|vDj>sY zrM-b|ozk|2Dcp@|gk!ey6dt|o{g8){5Sl#n44e|;ZY?iYObd8#+Dqf|{*k`9>t%(W zH9frVoIHM@-_0BE33&GFaeLz>bi{Iv`SAF^7dWu4FV7oHA9|t4fK15ilDWI;jP9-j=^jAAfWL1DhfRxoVMSt*Z4^6YlmjoI-x6t_JS z7L^2zDPndt3AU!}Sv(_hYeYE$i7|x3ixOH}tzh!t&4fgX5p(y_jpeON?G%_h5{21` z%WL(G1=tJbHQ+|eaAHS$D***WHx{rtxmGwh1p5oSrK7aJsp)4Nob2MB3c1F*pS3pF zyvqd_jIA!wvRtf(C@rxGdEx7hx$c0slx^r$q+yVdglg9wV1wEwqSs}d2ohVx0C!q1 zzl{vqf;z!?EimxR>3^0(jDA0%X%24Qkq9fPn+d-Am*e5(iNz`xm}0OP4c}TY@VGgV zFipF2ep_zpu_LnTc)czqrN*-I@%g3OgF{B82QOp7I*>}dhxG^>+jfVPO z&BXH)ieIJCX@*kd4}5sGdlenQ-BjYnqxm%EVRzRE$pIX>h4YZ2r5Y=+1C zx^ORHcd`kp>EM8j)`67%bMD}c6ndJJ266F-%KX9A5 zPOIU3)yg&a9pWcDOL_zl*Hddk zDRSqVS^5C68MG3or`W# zwuV@mkj|+xQ0D(6JwK*nwLUs7<8}UrMiWnB#+@?CasVL6FDO7EHvn0)mi-BqATZ;o z2_r>74*JR}D)K!VP%J-L5JXCt8Ii-R(9Tj03hzUm+x3MJQpZd&XP1Q8frspQm={Gy zuVMK%dj1bNK;@REhbVPU6H1A~ zPn;P3NIpVb90mjESkS?ptAet!+CQ%KCk182r12>ZJ|QLMeCYj%CV41@zNsaiyLMBr zEgL9@1jjR<@>z=D&3SOlB-|nI#HC_-6h!{1bC3QSnz)NHyX*9p^9zmdFrXbSmNBY) zMzadMW|zplMbmz@IVoi{+}hf@sG>A)lci?}GeLN!G2UZ6y|t)C^viHENXxczac)k; z!zVQTNJ{OLavcE%DK-HOl9bI00OKS2UN0)w|Bfmk1LVwq{x=H1J3Vf|?R*YP2t?~m zw6e4Wj)Y5|+z0Nr(r_mQRR($ez&@zLt< zD_VK&R*r9igG(ob+D4s3W|rgTjZ4cdJHrBQiDu^Z!GA+dueSW%+^S3M+~Fn75{YT6 z1@F(N7%BW|0K_@_;W>_$KYoN4Ia=HQ+6Av{pRz*PXmu3LCR}vI!~aW=sD}O|WVX0S zX^I$6%&Q=fwbwYUk8sOdc6?M(=P2PFZOS$ZuKPy6UKU#n!*yseOGnIen2E^XlDQgK zPryEcx@OF5T~Y;KQJv3f_^&l$1v`z4YPv(*6tOi=ImP-8mU!q@B^~HTws1YvmV3h8 ztF%+(N?8H1AP~w&7wlKuUt`<<;ksS^$L^V+jYKc(yRZ2Irc9XHv^s1Cr()E^xYb@3 zwYQ+ua4jz{bN1H7`PGVa)Z$kRj1^~?-dSkxL;Xmr(MaJ4-W>0$8aq{t<` z32>+oLbx?FOS1sEdr$M?C3|RC{jABo;)Pn?2Y-@ZLt?5J3eVEW{}} zoy-XxeSy{TtTo^6c}GT8YBV3mD5HMC!^bOaafi(T)g6W58hy9tmbMzj0Q$esE!-<| zg100I%}w^L!Z0yS>i)K*>U=ymwKomz=dfyXu+g>=&XJ4=8gwpcbj%(U)Ze zO2FWkNSmosz^Y4RlaCA`TsP3Qw8DmP9(G`mNzk#Hv6d{@)OMGpTw=o8*y_mnJ78MH zd%AxA4EUQ-b2RKfySS#OsA-5v0%q;_Yq$At-) zNZA~bO3XBwF(>R4ZUyuQ&icLV|LQ}l;uT+*yuA*YZESSKqfyQ)=qZg0UvH5y`&DE2 zUDuZ(LEsG&KYgqJh)I8~rzU1=iwz?RQOmuRog0~}CFOkU4(hq9K!^3u&BtSk%s|vW zSdRZ6;$_#}JLl3$!CY*7?%}^Ijz4Z^7s$ERmfx*I%YoiOeX~i4uu8!5GXH1%4lP;s zCUt?k1yL;)$KC6GXoXlM*8J(4kBuK>N3w9>fu5-(L9x}Vx6P-J7Ng^F`>_W*2d^yS z5%?2VI}zKT#G;whHC&{Ul1R{{IEnMMTmjyDVeOkOb81oO1RV^YyB_P zp(21NGz+~j|kF5^^paaDTg{ZO=rB^d`+Qtyo_=o27L2F^L=HcRE zJoj8~a#5CHg0W@2v@L-_H5CB^LN;*-t*;Md#8-H6%Tv=cD>m|#g1xHJ*9VRQkj#;? z{kX1?JvJ8mD|Y+Qir4>zP`|Y&CY6P5W_t0@{9p*Gz*r^r%;s+a{+X=|qhbTZF@{M4 z$zU~^-K1;mF{u3%3PP`UMlITEMh@d_=?a*hD~ggr4PdzjeKCef6cuBK9_-<6`QnpN zvTdnciyn2#^nc6iAO3U_Q2EC$r%u3@Tw^_GZV zfYwj*I#9uKePd%huC7!^F-?U0evu6~vVK{8+K6(li-dxHxeZY^Qsp$fUMCRJUrEf| z?1M`b3J`d__b9DczM6%7_pl9*O2Vtw)cHa!*V{D~wvJI&9&M0QQ_|iJJFDDaKh4ek zW9w%=f=+i~{$(w(6ufjIxu|?kirWIkVy@L9NU`f-K->E=r*84LJ?!SDLu`Ef%|cJc z$=|<)X1Xj)c}(VN#CIHbsZa@*z^_U`p^-xdTwae8o^{Gq*XdiUmGW<3}1%T z;9nuBQJPpEMTybAo8z?`;{3 zYz4_@ti8TfRc|z7>jF)^4v?slOpa$dWygO~NPktK)j(?(V9;wEp2xPIri|6C+1;Q)B73gFyvmGe3NH z54+iAfYF;@Yl;o6RAbbZrD>XqMNvb+T5H9jFV&UfkZiuUxw556LNma_Cr_H0-}<8< zW*y2tg-frXfFr|cVKeoP`jXsOWxUs@RSQOeQkg<%K+%tgUDfQY3-M6;2WQt zPfCU{g>^hHn{O~MiVK-07gg9`<1$Xou85Z`n?FB~9)0Nj!uNXZ55UhO&36=CX9uU- z&8;4D3#r9Aw5;shN_M^k&l15wQHXl$8|bCH;WX4XHg=_4+h9Z{z||G@R*{Kv!5gDz z2&3(m8Dy*jMJ*Nk8dj315$fVv_CuOJH_PK*Rb$|<{^O@1>+HwZ04@sTF3eZ zy(nHfl_O{fCpxW!*M_i|r6-142_h!Y2&q(gillJ`-Q}p&ec#6{*OMIbBv9bi8(oIw zAl$yAfeKJcTof7YY)1ezLspHl?Cn^Y^fg4?1%~8jN9mUKCq=nq=BKlk4Kw2aOcCzw z(0V;KR1ZdWVkcB5_r~PQ8vJHG2!3~;~9dgtemhM0B;80B% zCw+Y@Y_DAqK?nK>tT5bQhs$dPJ=BlXA=}}09*8z{k?iZk(otn8;KcRWj+rlhr^KT| z{Pk1qACvwJ(WKV=+Da4#4xSDgKb`s)K2%|n zOrs6zY!e`+NzBiV@a|LxH>iql3kKyS(=$ ztQ9f{!UDnsZNM~E#I$~ZT!ofgj4lZfJ2w-x@sksZ47xg1hkz%UkqXS?Qvrm;5FneS zu?^ho(z3!alvHgn1hf8I^OP+>NL)boV+fP4r6646q(wt=Kw(zXD=LZL#t(|nAl4aR z7lmSot%7D0#KOVEutx`k(hOj*#3KU;cq`(8L* zBBUNKcQq*#paZ2pUmX5LM8E@L(SIc_MYB5RVg0O;d}k3e@S*+h{gM99Xk%F)m@rUK z#AqQfWD_LRNUKTn9VoJ7Tx_gUUB2I>NCJIc@JjBj$2r-ItLw`GsYF#wt-T`sTBEcd zx`)Om%@~chLRgsAno(gi!us{1ti53M8Q1l2o9q-aoktLVtF>jcpvBuGA+=ErQZa)aav9G3flN(R6GK`NeoQTF_`KZqlkK>`N2=8PugBaD4v)DMns;9IJI{ z`A4&4h&*v2$&Zdo4JlORvVH00qS`2FS03p!phRq3@6zrO6LS-=4HbEvkvK3tJwk*b zKy_0s0j-0=EutHQWcTCCZV2{_zb?;g^h;+Ix^t-Be>Nv#|9_qyE9o>ejXxfKPk=rk zuE7u+i`>{+MUbUH9*og>)tNB~jp_FIu#hU7-0n(qY5--&dFsZo@%xdDoi9FLZfu0~ zM);%F=z-*ljts0yI%oDw5HUTX>Z>t>`Jzy-r1cQ|lLz%xTKG#ImVOCypx=uxzYtK2 z@P|mr(GQ-FLupn?Q4X}}2G!%}Ry{JIxA=RA60`_wG5*o)G>R>)XT9=&Dn;EE|ME!i zn@DUpxUeh@VRBJ7_O45myeOj`!nU-)?WrgAUIq_Z%R086HkBVdZM4zdyTIM&CsJ)6 zm}9U}RfOGQ+c4#%3X_aDYlA7Lg+6w`rl9U*GaZWDRp^}GJCG@C309!S)l_0>54tpi=VA+%zTr2u$mI3{r|4v5poH;V1!MC z8a9L=dFHT5x$00C@;D6{hB;7yBz9PYeDeVgk%M8Z!$IxYo408Ak8bv^tv_ktgr89I zl-_9DcA<(pNQG8Dv+h}Ods;t$_`hH3eD23@urAmb59V9d zsac2U%=0azNO`K!$Qzu7IoZd`ZZXmlZA|yr`NBRZHTsMtoMvCtZUZ~r7{@9s zgcLUvL$Z5$6)l--jc$Rnt4fW=?s6l> z)W`%76j#*bY0#hIV=>#LAf{x>7?K;}(+CPjYcq*h%cc*s$uRFOlegQpaAo}cbbnwH zni>8Inr#QQw=^m^V(#{U?theAt(@%(w*)#K<=W+aD&wUP@PfEyXnr@nu1&*r%2al3 ztqz;LISgr5H})LqYyhPFx!#+(W22f;q9Q_LZm?+upw+AsQ*sHP;f;jeQDbMmngwIX z(Pd|Yn#?Yw*VgYK1<+N7cT{1|nDTO2Mij$GC^hdx%^Zcd-PWi}(FzwRi$F*c;N~VE zB0jIM*p7<;#OP|(HOzHoDXHM$Xz53QC>jg+4J*bwdh!!2nVO!p#@p(!Atv7wH9k&< zQNh?0rVDP;h1ZICD&s!eLpgAP`?|;X(D3b#n+a^ZZehg{sEh6PRH(vlq;z3b(lHXU z+BsTskWpAg$)aAeeQoP4BTPo1j?7&d5sw?=%Rs#JdFOnlkxU<#3N&|@c2;?F9S@IP zhZUTmmlpgD-7W_<9Fj$uEu1Tk5rey~5r>#7?;C$EV%P2frj}2i1K*0*4lUza&x;eG zjE>Q79hWU5FCJKWJt_4|xkk1#-vW#TK2~x#;*Obnj1*G0k#IWPq}*pW&(xR{N>;AF zE~B}aJ`$%zM&d?wNJS^gfF0t*fUnZHVXc*~K z9fp3qD5J|ME-%mcH=Z(;c9g|{V>9zjl|F-w+?KbQ5YQ(Fvp)VkC}N4ZN1J?(I{LoF z+Tri}08_z8CVsnnOd;6>j7?3o?vH+SDmx;)co;|RPVIu0{=3`@9*p%cR=|EOdY=C5 z4r493Net{$DT1!V3ywZ3!G)?egLN=pe z5=#eUdk1w#d}bCA4#@9q6>Eky3ZDOIOk)_dTJ=3gJ+&bx&)i&n9{qS*J(RmZZg|b6d<12l7x+XRD^U?bI z=HAREz}a`YPjQf=J-4_%z)*L&FP{P~2+MzWE+STs=(qpj}+l*spitZQrr2e~**&HnBZU?E0F3tX5;2 zet%DfZ~7WHUnp|fs!4AV9$q`QzAmM%J|h^BIM%TbgPDT)y|AXn0Zfy?A3JVoT}zCT zo~-7=CnNOE0Rk;O%0wKES=5l4zlt^XSksah)r9D6?C)bfA?EwlBAT7y=;&B$#zdB5 z#QD24o~ku8tA#Cyt{$(qIH!|R3H--Zibe~Le|UgB5D&eyO={d(D3#CUbqy~oqu#o& zy_lMvae5kKqfeu^1J#xV4kN7uei>CJEH|i~TbmC`#waPNYH|%K+T~8u?%CfNDf&^` z?X^odAzyF5#vaS2F>#m6>lviUpq(^cf|F-;Bam=&<6OB6p-k62@8;=QoT@G$>F|wS zid^EZ(|KkT;U-+GnzgsPo^~5r_3+tIVDj^kCU7EbGQ_^y440(mifmn9pAM&t$L$}f z@yi0P*Y0q}^9{)-Kw02MC=tqr350<5K~8L%3B)t6RWtE^^wnML4%(+NGM`?5tZ(hk zbL{z-fjpZxbeByxWmqN#nQvK7e$?@e2}hYPsy6-U&$fShUEn@!a{~-WL?dlCd>xtw zHI!bnJK>y&^IU2hBjg7hyX&_yI%GJlz=3r zXP~%PBcaj5$q<2;6W_V@WEnX(i}V5w%d5!EQW zMk+lv^(c*vje{g&|5@F+)y9mW67;#Z7jOu=av3QlCFMWR=h2bC^fa#}5^ShU$~gUq zbi~*p-`F8LOd7kZYtvL3ClQgMj0xTJEW3K<=p(qJbifv5;%A#HK`$?q0cmJz>JlA8 zGsDKpt$5rhVS3vF zT+~RIjE88#=Y2+}i7=7IDDV{RdD3giUr*J z@!N>9kQ%}0M~-s9JDmUB);l&K4x11=WTs4;t(5QHcQ(N#Z73Xcow(lY%6Om_AxG1f z#L})ycU;A=H~U};9Q+gBqa z{k#t5um6yI-^LK`|C78=EA%e!dkhmdHtQL#RA}00unyJXS%ePa1t{$Qt@GiYn_}JtveVNo6$&%w>E6t)CTl;NKpIs;Gt53=`+F1HGb9o&(@XK#Z}BP zntW+|#K^|l(jh3Eds%{>5eVe|3>Jsc zPAO_F4SRn-INNw3QJmCauo$Sxeo&!Pa=xFCtx|A4y0=$QMtAjh3Moe+81<-fLh7gz zJ^g}CF3^91lD5)ffrmeY!b)1w%BISK3K+VsCgO-NOgk;;Qz-t=`%qupzVt8qxjQtlgz z5gAB&`$r~@m6G%EHYIf==~vH&?-s&~L?ia5zH1cbxF#q5yv5Fry(|lvd?_D=_L_M;1E#z0wNPu@l6LYPA>o8ZFUnoF zug0je(M+7H(0$tagt^&ejhKYQd@I($5gefr8*o4HL5yLib6uiavlh)A!c7RzLVoZV zSO~~Z(4H&DEtgoN?@E^VflaTk^ohRa9<_Y~voh{K<@?&ekZ~rPPeGZ5DsKKK`j9?r zEm|$QZ}VNYX6zl2?BA;B&Ft}vWRkymF+?;c_O-!c4~rN>SD~tm@c}n5rHSr}?s4RV zT)}uvNY=KaP*4mB1vFa{Cf->YAlNZ5-Bc>psAY>|XOz!nN0J?ncyqxQ-+fryMaTW? z5ppwc({RX88jE#h5J%ZJ{BTh-HkWT|{fv*bw<{MyY|Lz~NB6nBKB^*vzX?4)dNw-m z!5953pG8`P{K&*_mZc~H*Zr5476H63hCi}R^Z%?aoIYJ#zGLF-LB>_CMAPHo&4;cu zw9};q$1TRL`)6C~BqW9d4(T{DOJn2oFfv~Z&&@`dVqD#?)vh#jiKB;qEYz~T1|%lb zLvnode~d(c+yhgsMAfG_3({q<-8H)qzz~s5#|CUk^5Mt z$VlZ!x4vs1!3Ran&d1vwU`h z&9e~5{m9oYmm{&s%=VHLlwvvfd1A35#~_=q&N(M5KQwD~2i_hw!g9x)E^|6Fav3?e zzZg`Wck`uQdPs?zb7}902_i;>HD&SF#ce&G8yyM1K098gyz8%Yzn2u=@e+*p>}U;!ohsg=rf+yPQGJNQ5Z7@Zno z5)&Y$k>Lpv^m$cnB14K=XnSP8Jguw`GJT?UWw{!S2^^iMO-;B4(rb}&F;^5ib-6ye zINr2oJco{QvYL1s<^n#oxSkKK;*+J}+6S^;Yn7SP6|$Lnj)WHXkXYbT`=327}_szRJc8*ynp z#-~I4#2)E-Y?Ult+$gw`63b)l3%8BH8N_1i(SwyX6V7vc8!2g)ogYF6aw!^PRKF+d z95%jpfUC3kZy4s)X^=T3)q0dUvdx{G;&%d}5?5f=sME7^iXdWX$+Gint&#SZy5lMN zjHp?;1$@FIxBIZ!*&Cmd$MFn*+~K7%pVFi#sb;W-nw8J$&d;}I`CM!&%B!c&zp&12 z&Q8TvpN^LJT4g5*8P~7o6%D5UjAX{K76qn2kgSXp!Bd-yV+yt@xXmFm-p8$x$5h~R zrc~-i21sDshd=#y#x~=$fA)y*D*(ahtD*|?-iwf6cJ{6PR(M&o>&`(TZX{fZ6-rsj zXS=Zh$lWD%bQX(6ze{G@;;IW*F#}ey{j>M8H^h4mnYjba-2^SX%|S7oPTh#^76oaJ zo^_hkH)ZQ(a%*q!m~ioH5wId?_lkZg>RFy?45*$p-d6ow35s1ALrO? zKF|{*l^5u0<>PuOOUUzQH6(eNjj(jAW+Gk1YtP`9cP!UGn-#rk8VY~>fJaWts7<}H zNQ|8zYN>i6IQ#b@$}xvv&@UrAHQ;nV8r4Vi}5G6S7max&S+*bML>W^D8P9a<0eU`3a(C_4J*Npu2v&Yz50};rKFHxq! zL#)0D`aIJYFAsGUtw{;9syQEryzwizf`Zx9g5weDw8#3h%0^m=Xnv>5FS}7BLf+Bm zmmR_Gr;9f?ybm|~1idoSTO1c&OXx~ILV6ef_V>%@qwn2jmKKIe6faG!-B^`{p5mzI zf9S5QB976xjKYqmL54qU{b@O`Kzn<|^?)rh!{_HEKHoXjJT#mPOkik$78=X~;# zHkPwYIt*-u_7RPrR7I zPc#1`=k4QTZF5;rOpmgdINHj_?VMGb>;J2on77X7MYC$boa4u;E>4k}EdN*CE129= zJB02^=GqINggJ!-pRXP9(9zY?Ny`-v=c3Fzx{sZ$jWMadoZSZ5xJ?DEtzrGKNZx6+ z=6cP45(>l0GMm@^jykouxdt|^dc`mic^s{2FZI+;xB(~NIj~PZ5s!mm3|^$0m`RGV zt2$9&UL(Xr?epF^ZA z1r#QH^VW4)FFooll#Z?GL;aUwv-##oyZa33*GQa7dTpYt`^;=hgs&+as3W?2PA)k? z+kMS7@i#y#PT#DZoSukhQ)RtMUY-UthH5PHD7#prCx01fVa}oBOGBr{V1845)_&># zyjVrO_7~Lcb6;n(LA08w*XB9>X17{*Z{Ioo8xOQu!*j0p$@K2y=KMk|8o+0GM7j*=L`CAPeD-0JCZ_Z8SA3Sg6np9gg5|X2%3Lg3wU^`T6+TYK3{%tR})6?KoNJNGX%5!szx~`6iVn1)J$6AdG?B}Sm-HR3njO(fA2@_AO zubU8+7s6|Y3&b9zr@^418MuDr>C)on=KJuF+X4eb8fym|IMkAYl^$D!2)9_b&w;ZR z9UW;&ju-jW-NoN0e^OJQa%5p}u|@nC*V?b57F1oQs z&dtYGb)gWU%hdZ#?4TO*77Nc64IZRQ8pR?y(qF|oF)1DoVg5u(^9PoLnp5%VS^MuP z=g6Z{pd_Exu1adm%{zl~i1S8}zWTtrNWvudo{|&GBl@pHCkGQzBrLo!(Xz6I;~2`C z9X#wDU-|ix(|k%7EoeZEepjD9z42YDJ>~3z%t`*wn^&g7B%I`NsB-hjRQ;gRk9WtX z{Zb*twVUeKW#w0SvdzY%qE;1i!$uE548dEvxbDmD*9D_jIHT9K4<%y;-`721Sr(|z zW&Ef16sm^M52@&%(8h+2kSQ?}R;K^K%Ns`P!FbGW5x*(vrYY*kU}6V?%m ziENmNLO)^ed>u@RJbqzaSg?3?kpABlr;}Yeg*=ENPoE_a0-r*u(WGak1DPvsnQX1B z-NNU#5v$utwBzyv85Lp`?7*PYSz7T;EHflW*%+gPK&m z>M8|KnQ4yOP-kP$=&3X5UcPJl4j))I#T1QwyZN@mL%F`YBr^H$fCHo~26+n+^)Ojr zS-LVsOxXd{*70+5>zlt8@e2(W=QS9lKNBzB;W3=0x=Sg+YHA-bTMv*S5wh&M_xFV? zxol|GOvJKH1zEt#c+w`olMugM#zy5R7gpNrA6QdGrGInB8eD~QIH+MhUqy>(sxuYc z*!2z|&aHT{OUQ2kcIDtLJL&7UD3Qk6mYLTpo{($Ld{P<-!st>eiqwTR3?{R__{1*0+rL82a$*k$ z12_?55&2+8ShY@b5xV}4>dwa}qd!3Z4~)kfVc%GHTVC)Rxj*c=PISu!GaeQJ?%k#9 zqXE9j+qVMmldT+Dg1zeP)!=)}U+RDT!yJ9EY910yH`8ZM$E$hJ9Tu8)Iv9ZT6#Bdl zM-h1cAM+jj^t}a;KeI?t_8fZoKNi3*msyV|NxoF(wzddw)Ylokk^waieSUFcn)GYy zY?iDVy}jAeGUADEPX6_mi{%@ZSTZ4zhe*7tv&%v?7S+rpg;?de`Hfw~!UTZXRnaF@ z>tHm7bUCD^@%3fxSfK7}ma)C~S}abYMU05*v@@ROndCB&GqfsB&gnikE()B9PeQgf zcU8=6kZm@brG+-k3`L3<0+AUSLzAX4B_e}NaUGhUbf!ur<|2NqL(QTMVaMCpYH@ZS z>pzqhca{Pmbw>g?9nlPOUDBp@>F-{QMP93)GBxZJ#JR97T6fT|s{0!4Hq)jAULP{y|78sA*5Nnj4_Zw>TbT5EED_-mW69@;c)*h~Wfk7PvQV#NO;MqxtW ziyi$qswe|RW?(_R=1wcW9qrgKqn*Jhu789bUuofav+Hh0Ri9YUC!)Y%A~?Bv|2IqB zIiWD4fP{L`OL=te-p5;9??@CYIZcYA*}^LKE$=}Fqk{A8ApK#5knj`dMBX%}h zYo;#F6=h7hfVy$O1>3e)sZRU-01ahV!fL&XH{gbE%n=UefB*b8WN6Hs>3{CTY>SDC zo=ch;pX9Z+#)z_!*y82pI=jf5iob0A`b6ga;4`p@dg=erIWQz=W=|*%Z7Vt&J|jXQ zh#bMRP%#8fRO-Y24mFFWvkASkjIE0<0ocKj+enm=;h}uPDm!)oHb{=~FWH$dHpifi zm!Ul%rL82-Ksyu&g@E|PDA_0lac5U3ubY}n?3-YqfQWJ5?)HeM+>i8`5hLSo7U9uA zrK&I6@8Qo@Sc%VY#8rb&naFk$gVmh`Gl;~xn-XTzM9+Aedd!xU*ChmAwcMy8=Q_Ls z_QVw&-!r|$H4gvj0>@1mjiMb%fmXXS2vG86ToD>F+@5H>oXO4BI|4KXZ9>FTPsfj| zf1NCM=<1!seg4Kep2nj*f@KZPIb*}KWbhHuwRDLk67et$A z`oVV}#%{GODES6SArxms$@%tJ=c3ydr@79@D6gu&djnSUd&mM^e&4e;EOE=F`O?&+ z@6HLq)1A>9L@_Uze7ieNK+e-AlLE-R*n!$9rpCJwrrAj|!ZSP>SlpYX`M2!f!iYgD z1UIPL@i8_z^ov3gj78k~y7QH$0|d=ln|?F=-$Iqb4GdQ$^2?b+gsvbx6Hjf$ddDf_ zD;~o{leGZ}e*SfXR5a0_NKC|h6-vp*;eu*WLdkIhjDl6YtIEv5n`UFwZ#q&)tZr_2 z`G4VJSQ-;7S^_P(^`}Yo^dKqNbj7Pl+wJh1t;Zgedu0{KRYI{mleicyH=kn18xQ#k zy~4v`1B3)@@C<(@Wp0Z*&ZW`kCywYnH5h=!&7rI(T=mYb)KQraN4hHNWEGgYw$9?dfK4;cxM>lJmU2AatLK$E-T`#I5 zvdyZ+ohu0G(-z-GKHnV;ci32#Vb%93gewzL7Eq?tm>cqyHmKv#n9wxPLE6FXHMyF$ z7aaM&*=G#srC^yCtNkJ}G^mtwRRW)cfcATQStdK{cUR}=Qh8BaXG+MJN3j~3y@gq`1;gC{(7{Z2wll&eIiD_zQ#XB)#r|DkRK%elOum&QQJf4ite(* z6JsFw=xM?z;McU^6LqcvgZ~pjz^}!oBh-785($CWR`@LVB_P{kLCBCg8KF@iy?SPD zfr{No2&EkF97#(*!sysc;~!wCg@;FM1soM#j+U}mv3-$g)N3Wv_lQGB-v7I`)I_Mr zRp{(X1Yhl$ngW$23FNhCIkh^|44I2`gXN8>7?#ViJskd$CfG^xv~>nMWrv(dJ_u5ufjif3bF72k?f^gSzmhnvSK z^gTaSzJ8^OyLl8}Bl(fAOC&pFy56M%AjU-00~a@>{D>UFJ{ThjxRDO%+oJXh>1J;@ zHEqk5R=HgXVGI|ea?1z|gz9QZnV6b_K945ez}jki4+Z;8c8*1r&cE62>im5YHo z6onw-HW`N#&Qd-zb`f8zfcR8js2QGdCMT-5M|EUZ_nE?$jn2+E0c2c6v(%CJLf-bf zo0WX;F=4=WJKuiFl!RW&4CFK37s~P__bDV<1BL2!>En6JYo`xMcg;sOlfiYKlj76{ zu{Q1(TbN3crQ|WY1%pf_q}f84#&;;`DB_P@%emkXJ$!8 z=43Y*?N0_$Lt5<4v||3}OBg(pk%ei>T7&%Z`Kv4K+bapXFveL$pom0$c}Al!aYe3IlUDDolmpi8akSxRof@E7g;Qi?J?kLB6e#+-5g8WTY z^TET+jWEAU_okfJI$`xS>JN*OY=Ju-4P0?M@B&u% zTxW8hXuhy@?!|xbbM|p;+FG6w^_*?%>{U^>lvt_`?b`wYHR-l>Z6o9?C4cE_ZOzdL z>Q;Ty{$68f%hEgR8zXzQP!}b{=NG)z;k_XD?8DJ@3qr~IxWcKrbSwcfUQkqDSB3R= z*p2gAV>Oy+zJ=!ikjCJD9`3eB;W7mI`Vf%i)v~v+J2+_f;RKZ@aK5gP`vvuWj6t<* zfC1zmTEbJLm8sokOK%yuPki*k<5t2SxV={` zX0@UGf&CC+M|DoP8dUvZFf2@Pum%ha2>ZD1zFgP!F%K18y_{PTSCnE&izFkwnm=+PTzQKhb{B9RUukMdLdQ^DVDo zK)I0qh9mK?U{t2Z1`}{XUdOsdlB6cIIAm_fo@+C>{xh{7JeK7!E@-kT^D7Zr3U;kH zf35r5>3Q!Wr(VV7(rT}9mA%Y(q17o1(S>`nSfRcHx8&rm5YOv6QMdp=VZaJ1|J$^7 zTCu)yEx22!Z4%&lafhqPF4_UlB(c&*oTJSpr_ChzX6v=T^8)B_%Tj(nA?M^1k`03G zxq?^$;L6a%i!pm08C*&uh2qMFXdr4W5*$2b2|h9yJ%6-L68?h4g zQf-<@B$ROA9Zdbt66K(_++kUJ+V1*{oJB0Du#%o$ET@%{S~{E_9S6IAL`vmSo$HZ9 z&vnXCn*iIy7@ptloyYv|&-<3KyWf9t5mLs+Mpl#+J$t zkqDOpk}dwLLIUm7MwSZf?vOIV z*K4l{5UznYam%vvQh)ig9nh16X0jGmlL*mlZsnGp z_k=HKkC}lTMiJ!c!^=a*1me~gNUyLt$om-o?OjR$9_fx%A=ZbsVyQ+0`J%iBETL9^ zmZ}L{3vNx1f~f?aCbrmlc>YKW-ApgnTaZq!K)Cvp{M|#Ta}!O|kWbLQNRUIbw)+M; z_q}r3$-^l%&i}0NY_);Jo;X>L-Qf!^?XNG-&!X6hf&z~hVJiJxM=a4Q)!Nu%d6G^8 zTeG@MUgxEviq`h__&W5mvT>cBmxt|+LemM2R(wDF;}6b>G1bDpzb@Ah{VIvVOLt)8XU-YL`a@#@^S39;6MZo8JFOYL1Tg;)f&ygxuJaMKUXlfG6 z{JX`;-!8NK1Ulp15|dI^L^ORx2PH5y4;V#(jnna9DBu|j^39n1%?lk9%A~#`&a$U=6*43&c;cLo`7^Ux6?bL?Y zfMjSCyz}YEc>RNZE07LAV_YtlPy1up*wow%mDem)?tQ)q;Rhkp&n6zOg9bMb4~PRm zMMs`-ba_JGA2{BQ!5Hn4LaVxXnN_$kL}^FKHaP6-K(m$&rYR+~ZGbZ@i0(RhP~0M2%O_Xb&e$NkKQh8RiT+w8PCt zKUDzghhr)7Zf<3J?y^Y#608idC zL3hOm?1Qcocn?b#oJ=-nJ(e>vH^zVMh0}ZeyLWQyea%P=u1FFVC`C@tkF{$>kYJv< zc;WxL^7ZxNuF0;~W% z-^1IJmfF~UuQ+%xMdjcM2{q@H2*;#E2W@>9n(N?B>UYK+i6zT#r;pkj31$; z4D_C{Q_$1o2qL+1P$Bnak55GT3O9eJ&mT*oD?bc+V?X$6WLRN zG?2)|+dC3M!Kk}J;9W%zo>uGAW8m*e6^0{ruEzTI{)q{ajciiu^FlPpnEhgdm?}Yr zgNvP|D@)F)u*CBQoUxFM5VV&^x)j-UhoI zHk*|6>LCD|XeR5%K;ck(V(yUle1I)2A_OVKvO@M+({dWc#vCRHm1+A{~pJ*g*zWZw~ zEoo=umO}PgTJF(3co(%d)+Hzj$q0*}A(}XK-SrSvI%z#C+TY`iB&0-A74R)B_bb}D zg&HjEzWeO@HtF5M;-mAZF{pcpqU{>SR; zq=p!0R~CP1u&b5Bw)^I|=z#w**3Qh%4>T$p8UL_I5F0Y9>&*?Ho0ytp6BZsheCEl0 zvLl|Aand7n?aP;3D7!vp>IkXh*5{5ytn1_%xqQ3eeY`X0oEGHy^KTA!>v8xJ+-&sr z8zPp&CM1Lo{VPlwYn6>#aCq*9s1c>o_x=gRdfLq1^|v-qN`mnIL4FXJco&1l)B0dz z??9c)y2Fp<{o<`U_7909_8AchBbvjc+jtca?IdEGsr&pix%F(H<8x25+3gZ_UGD7B z+8W=}zj*Ww(K-I}jX^$~l$T678+<15n%70K(f%lH&i>hn8J*3%>h~qt5b6ijU?|`T zzW=%K3j&vCcmLclkCa@p3XhzKwc9tFn?TAtwxrqx_jrKKXbocY7QiMZJbm>&nw7m{ z@Z=Y)vcV&X^o#DN8IqzYUtX%2QYgw5G%TP*c!!f{a6R%Lco9=rIy@6EFMvH)&;1|s zH9pUL!eA-nFss}j^@r?SC8n;AArKW$RaEE{MNYPvsCaC9*cQ{AK8zAdo$n>InxQAL#KfP&r#LNCUmoc3l6pQp@J-tfam`BxlK;MI|~Or6&<{| zABl&&=EF2G<#KjX8gatm+6WH!3W*qHCnFY$sYOG_rWq?rLN^eEnZO%a+0s9p`#qjV z8u{R%$7w>U<1_j0^*4GK$Fqo*xHhg z?pB^>UfAfU?C0U(h!KNS%@*UPIL{h`{=rN-d*;Lk{kfIT3dU8YaahaPr`bLrk3W`wGF+Hmgy;y+i*RtJ=yI6|EnS<`SJ_b=^^s4H3zp zV%vm*GNwGfj-e4%u3jG>`svHB3#qj7PIbFv?ndG@-}ek!tl^{c@k^)sdes_(ZmE)U zI#pHR{NJAtRhzv%JBJH4f#m^P$L^8(9WyUHy{R$A^Q+BH-WA9vJYQKx;smFLC%7Dd zQcPF_fYF;V_yg0}$yf9eXjfMhRCISXLFc4%)5Pg+r&J8bfbhtsy7nG9rj0+38|;=x zpI4YPwT(9NX%1XHy|H?C8#|i=Rax-*78Zl`yGzg17_Te^IVdNwG20e;fvQR*gr=6> ziQtjv^vtaM&fYYyIg9VRWS$Pn@r-BnEj`j^z^T_W10FEV;sXi86DdA{l@2S-3F%pB zt>9D&#^>X);r7>iN&c`{*ON)D6YKNAC8TI)LZXYN&5?gTPX!&?*Qyjk=G4 ze2Dv1D6;WNnd)&y+kf{6=x|YRQ6!_;>B@t;K9oI{D@63TVK>~(sIlvVFHZ|((N_s~ z6N1>SsgA$8{OaYs0i;A4p_pU;ESLX==#LqG^_#+6$V+n(XjKt7*01}CZ>F2CZMHH& zKX6pcCnyn*ra^RvwM3Uo)+0= z+ICmZXjdyKRk3ZUf+BUB-D}ubDtbH=L>eqLAlD+NRwRxxH63dTMCpEiD9z|FMa$62 z*(6qteWd!UCx8fWZ~`8g9WodmzNqK^5~aoQI>zc3*#1Q5(Bm20-3_fqp9~R3lU&u+ zl^Hf2RCg{yy>Tlxwztm_ewr6PIy0lSiLh#e_!w@zHuny^b@H}zcK_T1IBc}bkE$zd z_Q(pPn0N-n{k{wkvHdVR!$-kYi+m4+A`|ut0xfb_>}~Tq108}~kDdtuUqHVJjP_O+ zFw%22@|wGY)tsXs^bOD<`fZox8~1VZon%Rg)zi&Vj~xHb%|FHfrIzL-E7q)|=afo? zxGhR-`|VfP=|=WDO52yrLR#r|&j+Hh2sVC!K`?<*U zg4gH(Zl3^zdO{msi%r!vQ!C!w@;M zk}pZr3DzQf=+MiCdV7p)C?gupU314eX@91uhlng?x1~6lijZ0u`rF6>qzMZ!~TVO_MufLl$|pMcNnrxP=GbSQ5d=G#Qttx!>uLCgyIiwN2B_jGoJ5 zNJQ9?=hbjLsiZjp7jWUo?`N!A`PvK#j48_-OEO!S-&pXrN{@YR?;mb5j&hD%EOOQ3 za;@y_0*8i%exAwM>c9Lwt=7E0rc!Vb!GR`at6-SC*3R-`dKb5kSnNo>!93IuUd06E zaXhb_M@-tV z%Tm|V{wof05$fUyePy9BQ(=gdsPE{2bQ(X4$;v$eD{W67;X~Z6PSyG=@UEKbXrQaK zzIaitY#Eu_{Ro|!O}h2)R9(?CHT6J;9mJNM$_a=*Sb6F4d}Fz`4oL~6zu4@UoSI@O zl$Mei#I5apXBckVca=Q6RE}poOPVTThbQ{oU}s;`(AGA5vB&}v0cL}iXe>);b#(QC z337>}mg(8;(-3#N&KIBChdXu-zCmIF)&{oT5D*K+e1@j~`@!_}914N;sr3L@;Pb_F zLstW2`-`d&hSb;Vh|DU-E44jB&%6OCQ}^rf+1YM=(#Ydbt#5=EM+EAhxpK~tYlbf@ zM*axV!KZD;0wmJ2@l$gv3zH|Dao5GHA85Oyuur=}IY#}~pVT`P=eu<1rwXTk)WS{V2 zX15j~+AOq>bFA+`MMWErd*r4juEw55*^=Un{&#;v?-R+Kj|mi+V#rZoY->wMo0wPE zJ1}ue4QZ0{si|K_PE4}S%*2~I8HZ1IU139PVt*9WK&&)#Mo)A+JUkPC@pnkkk_)Qu zf4m6>16OT^z*m^47isdaI}T>lVe+=!EzgNo}K*?a{rf+^2#;IGiK{`7&&CLV$g z2q?Yne$2ZyB5!Lz)j`?+)|7WRP<>!7tPf~l!QL~wX78ucnT9f`5c0H%^4N2s#(*m{7%~&i}V?Dy7FpsEv?<%HYk7AWNb+A z{Vc9GbS)mZ%g|*S7~1}#|FTV_)D_WEf|}&%;CfQ+X+!?6Bz?NEs|^&xxRjoeNs+4L zYHOFcwp6Ra@}tS!ld?z(mQoR77@7#mKEVWhO!H|%_ zcFzwf>MjnIDLLAv>Qe+aw%umQqXp%J6yPOe<3k00sne0iK6*h8*7=3QhZYh&3 zU0i}6kU_gdBtkGAJug;O$gKS(J zGFm>Rc>gkt3gVYDi~q+0P^M5OMPe(LKrmm^*G*EFCm>a!v}|c&ks2Dc8hz7ZG&-6( z6JEw|Jz$2++;Tb)UpdjnF0Y+No5_)&53!p8$_a1_`) za}_{H2EjlgAvm8es2jE*96issivG>G@oAunM!=izd@g=RjVeRdNEuJ^Gw|8@^bAz|HeC?(g z_ZLv!Ux^~53Q^HWO-xK;A)O*`?-y%ZdmvfN{N^g8j7yy2feIQ{h_q85Cey>*5BBF0 zSO$2hc>j!koR{z_o@r-Ga2Z^B8pAJPM=03Wu;iQXKdaA?38r%UV;D|XX5fn^xfuxjfJ(R{Sk`hf^z``L zu`bT~NW-NXT!=PKROpZ+0X){`08In8>V;S+irkd2%tUC`9TW;}$fcx#NKHe5oqSi< z%ML>BOdcbXYi}DH;6)A`e2{xw#f*@|denScl8I((^Ri~9!}kN$fSh56=`gp6e}6#a z6A>kg^#_-JX*2y|7b+Gb}&4^&eg)T&fH6zraFENz( zxJdj2WCM2*T%S)r&wJ zM#z^F!9{yCgew&Nf^Bjux+O^hnefWR3>K@fP{FpTQKsN+%;t#lqaV1Co!hQk!^nvZ zG4A+~CCH#&(Wm)oP@{vk5y@-!3kz6!SoTu5Vu?qbVGWC+;j_YntzZGo&hBE0POLMG92={Zy+S(<3Q~TocsPSW;)yb|grOj2a4L#`1A*t+;kg zn-D;U&*Fs95^@C9XgsbU4E&axd=&kyhn1C;a;)eI1UjM^?6?u}Z^n;-FWaIJ3>f!R zTpKq^G6b_3`BNNG&yqGj=6U5mLhZjXIUUuK8&*P}%hv2890BPs8+Ff7tV^4%Z#%un zuK&MQfG!KwXE>OdTbE*J9;{yT)J|^?K4s8MP5tupI*({z;$jLzn@OFvw%4q+C2@JF zR&`e2sb$g@5dT!}&Y`H&v`Hn*Bg=%H-&{?4F_kBXA^JCw5lQ#w-~a*g)|kKwMlhRU zJ`R8;URNs^&$$Su2Tdn(80RO_*yQogKghmY+x#pJ61%6s!U1V^NH?FEeP~(3JVpdb zmTL#t)Sr$FPf!R~pWe4^7M*Qfh{ZOCA)&9oo<7J+WJax~Ay0=SUj|FZ+-JS+MG^|V z7l<@=f;fH1^nxw}HHR4|ISXJzrnh@44kv~|>Os26XfC5y`_6?)nc&2xG4uTM8xl1l zhP`i5?2eRan{{-JF{Z>WQs0Pm3>JD1CZA|{x+r{m{Lhv&F#s`sbqpfxAKV0MX!0#0 z$|_{pg-Q4lF|L2c@jQPuh%p&3_x_3w{+2+F&`7oGbb!@|>A^q@!Fm*ff)B;eEeKT} zq9Z9+kwZ|k3X&0sofBHEr3gWh$_rIyBC0>iYi9nIZ@*!EuH^*85&`-Km%@!XJCh>p zp~R!trw7+6=9!`>{T%`X;znw(i`oX>qs5+*{Ea{ZQVXdKpGdo{y%$m1J|QAc|Lhab zXP2T>gfoNHMUHk1V)Kkxgx_K<)JLGf?YYL1Dbldsl5W>T1K6K7tiBUam^&%2ygoiR zC{dO^zh4Jq&&4t7;A3wnlao2zequD%j3KHE0Qa?!Z)o|QyT5RVp5$+9?Eqdv5Jw## z4OO8#HmN00y1l&~dEjTlD2TqXPEIamee1yRB7T9|pfh#GFH4VyD6ZzB6$ZPy&i2W7 zrPyY#ESZUeu}(+T8eBe~f7J3QU|%bDEZ&r&a>`%K4mK2yfcz`8JZ_Ge zUs8WW;^c#oK&3N}h#}~YMSlSXd#S0vi2D$u-PlC^L<-?_!#hrN0uul`Cd_})^Ja&| zf9JuQWVcmKLp?Q;nFZU2Fi(Dh-{SSSW(`UORPDOg^;Vc#d_!9XT*dS!cy#B-h@u4Y z_^S-hM8>EHk^uo!+B-Bh@%`ag+zCMP5J3X7v-)%QvY#yn#gH!F=jAYwg5Xycog=)a zAA9%O4Az}iarrd5%isr?>8?KQm%!P6uf&!WU5!p8dtVW%W*DiRQ4V9w)pE(!umaF>zST@Iv7x*L6EaujMBnO(?3eCR6gRbi_tZ|R#vYL5Nz4QAPocBI2df( z7*JSOb4lhB+Av872!VXL3=L_RPaBHgc9pByFJu-b7x%vnJw#YB&4Ea+li|-~!Y_OV z8wOeY?#Z;%j)g!hmnXjvb~}g5x%KslS)9^vN&VZE`7^sqtO(lWb^W8iqe<(8aj5E0{{=piGA zct;aVI*o71;^CR=<(Q&S@jv%hYZk)uXcnQq2ShYTtH?xaG`m!Zr4wB@RkSkXRrH{x z;iGSx2B{cDn{`(%s4?|}KvL09f#`K_3h-78@c@(QId1;r-hb>Cq&n*9-@7HsBHZ<0 z_DfA=o@e3v?lMCYy81lCgsnp=f4F zQj1es#+aI-1_XCiY+{=nx1Ln@q8Dj8xe91`LqYr;C2w# z4rEo2VXKpZm@cUTp7M^<5M?3ZE9^cK=#(sF8+@t@1N>PEsqttetIbuK;Tw7K{8Z+o z8kSY};;Z-q>vH-}LqVeAoK@leKbZ?%bJk_St*SKF@xh z4ij)*+W@fy-4bWNt;Rd+u^up(I-Zs9os|ok@;k;qe(@yCPXY$H3-0>2q8XO#Y!Ou{ z!-ix_fgRNvw6s)({(Xlk5Mvc}=VuS}X;4{G8p@)V?XS1*532n3c%*bzn5U})^ndb< z7gxVRLyP!mpP;-}waM8+LHU?AUvKxo|3pvzt=8EMg}}VPzbH@!C*ZXOE?Svi?Bcc9 z)v!T(>RVLq)z}Ru)rn#-0pEn4)B`hF{4V(3pixRO&`XqePKQaY}@VK?b`s9fmyW z{cr9>e$)tYepZ_9y8A6l9T^B12pF#ScYKm?>JJ)$!7_KRkui^Fz$iZa{MdzAScrAnV2VOV8bS$@lXMLeXe z!#o0keChsuXp~cnZT`ukHuGnb`Ba=8qY_Nr2|(XD=h>)6&Oq_rbYa6|gZeAox!C zfzg?jMYo=_mGk!S0q6I?=^Nqf81n(ZT`v>i2t5RQ1)r)vU=(ur)#O~C1SVhRLKG)y z|7}#BDBhjp01QnBEYk22u->-cau7q4;yKtxp&I6;zFOkkI29u^m=oTsb$y)S<55$+ABQ9hKV%*=C^ zMAxOaU7kE>Zn(I-wEgA6ch8&vKgas*YK5eH9&kUO^^kY-D7AJ{t$Wu2nJW}d4AHS# zjdH?!U_i8URc?29SF9~4Q8rx3PHo|KUfkzfUIMbc`nJKnY(^xITN0i?@GS7Cf^P>B zrX~CwO5FCjrUK+^1IE~SE{e9-rw(J~vq^{_nPV`YcH##0@D>2xs%CanfZ%DchD;*D zhkwu`|HQ2C_kbYq9MBes`oePmF8Puv;1F5;9>rMOo?z^0#=Klk(%s#+15mUAQjxE3 zpl5m>9$qHBZ2R}^OQ*X<>~it`Yh&{#^N$I?anSQV<8-Vo@!AY{2{A4;+YcYq!2fL| zZ;^>_1wr>k1-KM357DgR8h=*~Kqc&|7Pg2)gs3X4F|~*HPfawZuMzf*V$S}qdVBtW z8?|U4DihG53M0aU{bBH#-uL97Ax7IqaBq!hZ1rUq^HI=+;0Ag-L9a!Dxz&?tVYYS0m(n^b?GFeLU0oc*6LE^xJTz_a7{lH z46wA>#~Yz01AQ*h4zzxdKLulPMNU!duhGWwFg|NScL!i{$}04mm- zkNJIb&Br7L$ssw&n>;Y6q-|7?hr)_*MIl}E<=c=AVEn#RB}K8`e;&Y?{Gz<-?4~scnTn3{G$YWtrBR!^<{Ork;;pV5Wf-W zfIj4LW-Eb@$X9hLwmgdzq<({SN>aEpnYBj8Pze-yC*x*F0&6`wBH$t_=olTIYn@6$1DFLYmX}w} zOijZsvIV4r$(i8Q`zK86s{F--(UQZ}4qvJYVNd zUfoZ7wcsZGy*j-P*m$@bMi&fx3wn$b@dhKC*FT;0an`{xKC~g*s?T{NEhs2HBH$5r z^J4Y8|9JguIyF7BGFt6@UhaJXr*C*WkE0w$<=g~bjKh6HUMuz`4?+KVL0^)R1zUT5 zolxlgD5^VV3>)#k_ZE?!exjpZqef*Khut9r-1^EwT-@cg4YRWgwm7k14IL)eOAc#m z-djWjC+|Y60z)4c|8e{7i8)47&5X|e#b?|ITJ44gw>W2^EyKV7OfXZnKB_{iPv5^B z|NI;@#OYgE7*;A*;@=@2m8;%a_RG_B>BPg*_S9>Uc2AA67V4u~^3HAHlZ}5!QXh-| zW^}IF66Wc(fJHffbciryqs?hpZ-2Dc<68hn$Vt=Pd9@v-mCyCo;oad!&8~p^=0dj% zJ5+lWNF=Z%L}FYif=f!{3T3D?39d}?jSEeLxQLHU{O314C z)Obm{EHPStrbW>*X7)y{bE&dBp2~5~9}%8Fv55+NOx{&mjdI_hj|EqfCUV9fb#HqV zwR}q|CGg0kofwvk^wG>q1a4;;P8GyD}m2+{s>LA`dyo{nk#A=h?~5@C7f|p%oyM zmMv*ohjiT^f~?lQfgPow=!dQCD+_%U)u+@O-&Q90-8{9F=)n~}V%0}VakT=LH@MS4 zHr;^4r{>c~LqF^q(QSwi12VFbSJW?hYm?RZ+n08kSq?mlQ6cxyzP*HZ2j^Y$lT2fDY3#s`1=oHeNXqgUzmhi?mrP7eZFe_Qf)$xMMkZZ%Q{qE z{ibn5Y`)Bpo1~279)c)eE^Tu9&B(=H#uc1QqOzL37?t-2aYy;d#^-ho zC7L6Lyx7@NdIKBnSJ5}pK%tBfbhk&#X&AU`G|5iZ;ZJ?#%hwkzQsB|5!dVvqBmG)9 zwLBg!)R0Nx3PsAb+NxRNNMhKkmzKF^^B&m3FAaUzQOaOIiEd+~|Dm(zhvd}kc!gxf1_6uoA0W*jg zWLJ?r4qvIzVl}l-s!!_K!DJ0?lY2X?!TReEXix-^w=1K$zjG?cPz&xH`=BGoZvZ({ z;G+hFp3GH9+Z0eN?=f|#oHvWc#NG0iXzPjdpx>o%|NJP#SMg6Ov zGPhJIB4#hP&XTyaW=2JMgjtbJq9e-Z&lMM<)F?IpOJ&x8!7p1K>3zNwkY`F%luse) zl}V^Ue#7wNRRB_p*9%7qqyBG2s@2%q9u3{EJ<8!)8FZS>g>Al{8M(Lwiy(qT{L9s= zH%O84G-fhT~eQM5r~_n)yGV_Z`Ecq9%H0@{rvyED0C|!N z*X`3V*N(_5T`&0VE?gMuucQ^P*9?2_fIA(SJbWgP_pO-sRJ`UPtKB%_ie!TdtO)T< zj~4YG*T>gx&nckX6;5JEQfV(1~) zf_Y4(haRYT-!bj@nA#h}+t5=jAV>&rUnNjnn7H@XtD^dx7?R2~R%C|?$~K&iv3low zMXhouc)8@=!(H`>N8saj{xjXwzN1d7V^9PZXs@z))6BsEMUqd1N9Sc%viwf zul;?~@WCAtQ7L{x*9AI^JEd8@C2zx+!9lq|rIx-TRce;z8llk}C9p(z`1wB6L-1$1 z8kc4m)MPqeo*quH_=xSC!}nSLS<&(C)#e=t`f_U!nohR7Ju$KUX;Q~VdOP;CK(UQPshryKqlDJ zzXG)9j^%6&vn^DN;kN|8u+0h;-HQl@>_8@-hAB=8{GyUhxcVTR zZ$4_AoH*F{q$%SwiMHbDuxq^911bozvXj%PW7A7(1CMXqj*xN++PtS3+Nyjp^^`Gn zt*yNSe@Hj7d~RsV>gz)RT##oMdlq)z9Bv{= zMh#+^1Q^-zPQich^QUp|PSh-5sM8PFB()0~1J(6e0 zBmqPoYLmB?FnM|DUOCIwCbQkxb7>N2Daife7xe?#(>^lJq|U@)NEY?JG1EI12df^ z?nF-f6QPhtDn!Q*2m>0(%`W%2douIKK9!hSHr9T;>h5pq>YTZ)9xn_@j%j4W08;12 z!xk^6QAG*oS*_9rnoxa#ndD)exug~WU10&wWW~pqg>H=Mb*_vN~^}E z4v@P8LgE^ldRv>zTs}VF&TdVt%mVT&Sn$#Kc_b*pTlMX&;{)?Pvn%K-yKXJKO_QMK z1xA&sGnVce0Gr9^YnmeX=vMt>`?whUXnb~lHHsl=g%L}NgFFp4r^f{ipPNONd?z14 z3Pr%ux1}V0iTGFF&EwWk$gS%G6W{FA;^de8y4=p9u!X^w4yU&-hdCZ$P0o=~=eDS& z5=;V@oezlSIqt!mRjv){6gjlb%oSVOS_-xO5*d_CfkSU3Y1Svj{1z)q$*fi1)g{N0M2-@pOtZJVG8H$; zf$D+}fm^**t4)U-AsGtYdvGCe{F{zBSBIuXg$gZfV5AV$fRAITxhD*OuupdlZ~7uy z@?C&(Or5-P5-0&NX)j=(OpjZkR+S>bmUM^9T`%Z-0)e!aJS_MN{?oO`xnR`)y`n*% zIJVieWFW96NE!C;RIsZDptyGtXUi^o6IF%{#ETh$oqIJcw<8-sh;X~FO6FPE*bG<@ zRr1FYhZzJ4tBS^aCgbm^zmD_A5`xyqOe-K+?Wrx`U(ZVY-T4GBCH}Q}-0l4YqfMR< z07Sq$&CTu6m{R;MwzRV^s;b)W#6E^vjvbJl$;^=foCxM^8Lxhyjb~`E}#r<_Kr+;n2>34I|TP6ENR7}10 z&ljT2+=6nLBAcybwsbu8O*8sKl(@yR&eoLOw+K+)+0%Ll=O|inh}59*&+$PSdu6JN z+D6mm)#VK$47`j3i2OIJdNTtp_HLws=R&Z?KaleuT~ z>jgtOp0x>XddZpn&Xeh13K3twl$F+RY7qT<16;z~bLODuvVW+-3KK zk{I2GsI>^+rTj9pN^E*{#^T?s-cvlmXB;W9#mdJtvbjkBOa-^s0W-zL=FVG2^K$tk z9pmK8O5*nOGO6Il6PCxv8&d4g=Jr2*v$$Sy@G}~Lqj>704Gr5881`M)xYpy=dp^Bm zuF+Fnk8C2=0xi!Rv>DtCd@poLP?@0-yF*laO`5veW{#eb=95_@nD*qjQP;f-4_r@T z_-RwD&5iO6BxB1VoF0Emr$_^J!|^I-`jQ*ruHUu`Sd_lt6#gbhg~|4Kw!8-<(gk@& zHZKs}hAsk_oZW77|61#KJm{_l%NK+rJ`7#f)fRgkyjqgN()1GEykxwtz%mU$4sw7@22jL+*7zIXu7Ab|DpckR!`zWdJT z%~^GIU9Eo4w*l_O%>BO$r{uhC)Q5jFf$a?KHR}q7D#crN@PfCJ@Zq&3yX%28C3S!Qm6F%(z7J;$uU+|X%rW-j_!De8K%c^kp@@QbBv1wR-O$*2?rYxoAVl@mG~7I>1sL2e?*pMnP|JKc+Yx%D zwLFuX+oC9`pbz*RO(pI5;+58Q%h8Of4sgsEd7e=W6M6k=y<@M7n&8Ut2;b*Z5cCNi z9AxLj!@pl(EH%$#4()NomvOV6pU8OO!c-xNgunXJEqpmrD zBI>$=n;V>7Y0v5y2jfSd3^^(@=ArQ(EMZ)ziLFmUagIlNI5Pk+GmPBpd!h{GR%&W) zwr(BFA?-rmsfIDOv1=dtf`cgyx!Uf9j6mP32R8P+gD)^_M0LJ5UvjfBgcG<>huG!M=3( z-SMNQu@P)+oY|k%*0u=^#PQwyal-cQdXn_}b9Kc8PH!uw93^~IVs!fm?dTa)SxKO^ zy2?#>Oq?Cc!r%DKO`Y?yyE|B7dJQyKYg|A#0UB^Xmynh&Vi}ePR9eF(CS2OQv>Z0L zM5Ij~JD#@tMuZTw3!;XqA1x|ZHnoiYzT?ISUgOMOgJFT%2Q8d{2D~gY_d+at+c*oh zp~pt;+XfEQFd8xBMQsN3X^E@(`YFfb1$$N=mS2baX&G7DBS$d#*YM?T!!2&ZMH*pD zj<@iVA#JHSIFy7_SGTMRPH$swsp%O*4>aU7;qixmcY@$#LGBUdOVv!=+zR$?co{Mo zfPaAfnzLy0%Y@A?=qk|A*eNc~xcHiea7nP`o3#RCYm#ZYEJ}V<$K$$_EXXJ3VyZ%qq1Bl{;Eq=`P$6oF5O0~u6sv}zw+IlB{lsw0Dtkl(fkh#a@Y5g?&|> zJ_8e{SI+gC8+9^&qT`Q3BPXXIB*BhRAXHCP*EBUr=j|1MITT-exus@g4Jn~;EULG< z91;c@p^%{C2F(ykXe%(U4yM3XV$4Eo3o;%BN9}7;s5iMEk9QBGbiYFGp!A=&C%EdC zvyVjua5z7>0!SDoyTHv&Jx|Xz4Xt$3ZdJ3bBL~kmuaU$1<0A{QEIWyp*)k^B05bRo zpeQbt@;h0LuX?2C2T_{r5H46C`An>VlWjuU3+vCX@2fYKQbWgQC*=CqmNu4VCKkvY zuwyBT*Cn~vGi)5qySA5#bY7X>ukdiJXodCE0{D2wK0a`|_dSfeV&vAec(RcSntc`d zY|V`h`x~?!4%ejh^*7E94bzJYBDJb{#qB9J#$>JD(XBxM3!pYo-B7Vk-ldd}l^tkt zeqwPOqUd$6u&=1qzp}Ko{;e}Mx41c4TQIx~(%l_PqFryfCfRo^{Vhdc^#QzeLerwE zphcAlbtxPED9K4GwZ!G+Q4}G*#>U1L!VWPZ9S7{2jYGoy^zT;&J@1&Pr0=n~r4W@9 zaC{aeHwB(%n9lGn1l|w*+p_wT2^Y+aF)PST({x2%1O7J2d_^!jx;f^c)j~IpM?u1QZ z*=&2T;sPz6StcyPGS;j`Mlc}ON4-X8|C;TNQlLeLwSj|kE>_x5Hi%Zenp8Y<@1rbWcT4Todx58%_l?zBTV2`F`Q?|6_eF7KIsOvmIPFV)V;@FI z6%|(P3~Qa%`_HH2Hx)J&Dl{G)FZbGPO^taCQ;&~a4;PzeW}f)^Vri-Ah7Jb;+U;u% z4@k%;s6h(sX;Pnp+Lx%h-B7+W?BWY5Jom`}jIl3;8Cu+)CW)#n!YWRzRd{3>-$)b5 zlci=-CuSE{!w}{s!GruN$o0(l46Z$}&n2-Z{OPSjnWC!8^<&HQ@s{-bXLB@kt zLDu2g0!ePCduF3+svDW{LX{{s&f+*!Z;-L0V|uV`^35S(aV@uuu`$`TMWign_{b44 zUWWGGUvVB@?NK()cstwQjg48!&X}}NWEOT-h1LeC(N*%#ZM?@P$0QlHMqXY3ue)zF zA%U5L9p=}3zUz6k0b?bm;Os6$M_!M>-5;-y#_)G{@skvqsrsZzR=J&(L1J`aC_hdH z95^^Rsgr4)ADm~GHpa)EX)vaYEpmyrTL#c9qod*LnFJ-tG0iPXauyHhZs5jm@9tQ6 zc%%Fo&Xi$Ic(nOn~Mkag$?rzA1*j^Da4d*4juCFe7ezO6U{if z@puAi*H~;A$2iC(j{xFPNK~$o5Ms`!_yOovo94%_4pcXD*Y)hQa$rji`CN=;(t z=-=qc2VGj=%|Vlk8{Z#9T^^2|4&bR*;;G{A&`OTybaiFiT-@GHJ<4b@iVE6O-n;aI zIV+3}7I1mAZf@`HnHyZ`=U5Zy&}l1h@l7o5tbS7zUpsQUuGd6;_vv(YxvMkmmk5Wu zks@g|Jd}Ta@zSi#&$z!w{2PQ1X!@rM#Y=-}r7T%{=(y5|jU&U1^i;eaHNmlwdE zntE~J3Xo4=YjvjIPa?|aaLZ_0({gUM1U$8RU}DnV-rvPd@JJD`@bmW%hJAAdb!0T2 z21CEbR$a)qwE>*ix&|*zw(ymB`StYy%C#elaVS8i+0pTdiOC`2YtLcdkw=qlxBvI@ zF9lvw^I;Aypa>Zh2s5x6H~YT@EeJ~O!Pltz(PS{9gFts^xq4-Od3yquzIU8T@l>71 zE(eDV{?7an&hJAS=R?OxIh|Zpgq0d!0==OEFLA+2dhTD+X+cJ5N#NyFlT$MbppbB$ zC|14XTBpNQ{Y>NjA(X{R-SO=deY3My51w`{lv!f~Q=-8j50)pjx>o!wdU^=0I>$Sj zaHl!=D#E^mU&fNrWPB-2i}=+<-cgR?b%whXYR)dX--Aj^9acTn>Rcy?ca0CZ9qz$` zk`Y-}4}1JmxCNPIT6dhLHrz-Pr+R@7q1R<{GG6=qqDG8iC!C{8VXKMKgkpy}hBOgg zUE6aLz7QZR{w}6iVXI3ssvSA4?ixFljAm}|O=YKjIWZ&m>#lvY|6pCQd)kj7Ysjj9 zFB7lu+mkl$HEOlOS?h|mdEmeATuo0Jqcc=t$TkK!F*3Cna)N7ynBTvpPO_h3rD8Ju_cA2C@VLyv+soNNLUmEE0vPGm`NQGz4(C1kevvz zK&n#zRf~5Ohu0(0*q+dIc!G#6%a|JrIxQ`Gczn;oauluX6UxN5U&!bYrhyQg3F1bJ z2FN_*^RSQ|9=8bcnOuWLkOGf+yx2$QI(5I_UXBSIuk&8w&$}c)W};UbHRv!|Yh~u0 zqi|zdMWC`%#7}?Pthch)DQ-Jk{LDU^JztgLK7H0h)RFIW5fj5n;9 zmwyrh4}U+m)EqC$$QOede;*lw`Eyz+0Bh%KXoGRGRBX%7$W?xvY2qM=Jhaa#8kV7f z1tnN+L%Ld$b~B`!UzZ;B(qn8oqg9BlI(O2kCM1TLj|$1+$qRy9m4)sR(3 z#D>Nmkr796i!4zH2(U=I1laQ`zxk z%KVzYf=g0mP*R_>Vpqr&#=gd@PN2?D;+SD6`jxL6ml`z{ZK-4b>?uJ`+I&w(sSdhj z5aSKwtlTCL^@6*NH2P^JQH$&zFcNh$|E1@s)h5 z*lI&AAudGI2MGFKoCdCC-1gDZm1oAt5gOj5;+ zS7YQ#qtTL4t;Vbor4_p6*AaJak?uag?XYk#f4e+c$mHVT5x3U zL15>F17_skcaM~JxCu-VaLg$!*(l^tP(G&ESlDp$3W5tm@gl++Vx;pDf{W#G>%U=Y z?2we~o~l?^Xwlh2%?!jt%r8)8m8~=u_kL@FR~n9&5|8Cmj}0}U4Pp@Xw(YafUfjf( z@tKV~iW_A>=>&<9vYDex5o4jDDu?kuL10xl~(;;lxv4mWnl@edx~%Xc+@9 zozDVgVK?^xp453(m^A1(7iFf!gq5%bp)$X^3^|N7QJx=-Azc7_1sJYQ31@Sr|cwtwhgrT&{lshtOj7VV)BDp!uSP#H6p&}m0=Hsqf7@?p~otvZ;$jO0%v>9?F@Yy+&s6m6r{XxlyD%Srt>Mp zQPC8jan`Sjt)2{^`s@*iDV0YCE=uP}RxXOhTNF*69jfJV(2o!IeU~svBf*G2f@y{49>E+{im4nM#fuSn-DZt)&ZXGZiBkptUs>$-C`u398*XZteTn#$!L3E9on8Z#Ar#U z9j01ve-v>ftPqCrnLQ?kOVx_jvpY>*{5x8kkX5AQ$p*RdgYc5Cq{JK3U3O`fBPMoDV}qe% zSWeCCYpa@*Ul{F}5rfJP8xfE>&g9WQMxm)H^w0=Y8nCn`+?X{hK~5!amSnQns}@$&iTR= zw)Ziv#9LO4oU2ommLK+tGEEkbzPky zzAnARq>Wx^>^sw__WBhQwjmy9Bpun#83w)92swQqnC|3VgU&v{xfreVkanY9#hNf6 zIvL>`SOO380!cy>`qILdsyo@liRRFlw=RlEz=I6Ssv4e5_3>*sojPf)6V8dfF8Dai zTzXQaglC8SYp{-<1v&qZd-2=N+S_Xxn9=!EkSeFz^J#+j&Cg{(AbU5QzqU`R5EbEr z#6xnPSCw=9xuh!H{(FP0;p=%ckB;hkDXNRr@J1u9zZ&jwYV82UM2RRvRk4UTNG4<% zd^{5m0VBM-zt5lPgf!*aZ8t*PhR#v>Xs91TItE-K4H zE;|v4aTt5}Oq{$)(!vZjFBA?Qm~&-H%VBc+@roH|s;X2W0E>`X1f6V_LbaJ2_b zTi2>lH-KB*>V1%CUUj)pIMyn2@bEW11?e4amb}hEQL9u@BJ{6d9Zn9|jPM05S()@V zmtTU75fliB5&Q9CQ*vmP3C`2=L3&lL?5^}h&EkIt=GC8@QJ3ySH`-;m28?q~LE1`K zDOG+T_RXSaH#K9L6p(rZe^dgG>oGRHAfx@c0R2aoJ;xk4n_6U%uJrM8<}*kJHNnLX zjoYUbF(!CP?3^|E1Rj&v0nNGs9gJjMY-|zDoW_R^P*;7Y+%WM)B4|v)6~B1d7_ODlmjAa z!T&30!_2LDyK6}uYR9!dULmz)YB!$Cau%_aw^YDhuDemL&N@4X0yO)($uo7%q)XoQh>2=}D#y z#Ax~7Cv=yDOE-x=|M$-lpV@Kjvmpu(KXndpzD~ja><~EWh=3aN5z~wp25JBLFRE5i z2iDmA0S^3HOwq9G`*&>+oq6qoRzYG}20W4w^>?fxBM(N43TszXiShQBrvGAb?0EH0 z%YTNA<{}drI8945 z?dNu#0*G@p=yqOwH=ZV%=#!hrwX>in7FoyJ{na1F|Ca*lOw}3#gE{_PrhwOxPaexE zS*HXGOIeyFO}0*uKQ0M_BsnL<%!qR{r^>o1TXWL`!tlAc>EBl(AW6tIT7jinrHpH? zj)1;5Pw2`HWlHa%~S(YD`#MjFw#F&}vpRr2kF(_(E9jYR&M! z33l8_7~h{>toiRAlAZ9P%uNvcW4#6ZzSfxm1AR$-b4=vQVFt{8uLj?Lmsh7w(UNRd zF5Pen)ZEd)l1+TF%0BSEOH;ov#T6*nB#Y0J};WUY)Yh93KjVk zB3hxtM*W)qwT~Mmk>}r&NdSa_kw2P-8_Y~Ea=GN+RYmJ8lJLv-$q-e$y9FXgZ8w-J z{h7v)N<&rYcM8`Lju*cc08y^w%;9wur)^uy!gj1WMJ!QTbdHWcV*gFPQmg!{SA34k zoh~PY_TTvrSvJ?jB0o+ihbCZ|oc?c-eHEXh$dkY1+>x`6nk7~Czzq_Tte!9Qp%t>g z(Nq@KU5|2|^dzg0KSx2xb8h$=Pk#bobMv^{l789!r%Md3yp7LNx1A}98^K@kmq@I) z6)tO9rc!YOeR6r`K9AjIU;V$CN_Ip4Z$$^CYgj)kqZ7ws*OoXaLRTuShH~dYT2LZ} z3XzC?5@F=VTniR23~mfnSv=^Fx=Bm&Gu^|iRC$tWhs3j{7g<^ffdE^nAlD-OAv?nJ zVC0X9ORt(Z{3tC}3rie-Q)_?;oxpB*wk{&+fd=~{{}dw%FVI5pH{Z7xfz8-bTVU-N zT2{)rtsXu0N(I^BA51UH0j3Dt9qNB~2N};%hGN#%^+s*=R{T zVL$z?5mOp%T#XiYS{4TMvL1pkWq=OhGIRn3!d6G6%3@~mY%va0dM=!)ktLcznR zuD8Yd-hcka^6Wonp=^F^V`ggeO5e-OI4!L>7>6jrWuc4Kg$pIDkx@*IkwRg+!FC+J zyh9Dv6Jayb$a*qhKu#xzK4gVYRGC2}GmksPQ&$7KVS-4X7w59L>nuVuRwPF9L%DBh zZ$;y$xZ}A=S;x>UZM?M>-gzb_(~7Qi zWNLgxu%ak0C%%ySc-%^KWy8P0Y_L4HnskuB-VB%9v)u3B-mYiMfu~m9l~<$=70#i^ zxYV6TxMEIPFa&Pk9dBv1^vP~Y1vS=7_r5q#fO>PW`$K2XUK3sgh^7aI~j{Uizf10u;vXlR_p z^MI~ca*C*P=aBHnK9M3p}|0sT!_(Rq?hL3 zTD8PI8M2X)gQZG^+o%wH6~FFstG>~2X|mKEWD|VBNQ`&KK`Ii#r-u0+BuzZpPFR9m z*lK17t#UZ|ckU4Js@F?Uf+K?rM2eyX&VVa^WStoqI4!w@`b;v5A+?QMl4z<6*M3&J z?-Rz-DFICqH|tJeK@g!3g?!Mg{8@_^x>VL2i$NJ$Uq0_!{0FNG2IwV-FGliXp-bDaPZ;^y_XQp9;oC${JoEjbe zCM>ivba0H%>A1q*1CIPi)@|OHOy0ih@O?xM(f0|^=_P@N^*)N$KGvH-6hqS&$7DEN zv}|=Olvsg7J+M^sKw{EU9c@Hb%i9ZNy5F~@3@BxNGr zdTQ$c9N^0e)J#_7K3i?f+UesfmXG>O5`su%d~;yy?ACx{B{v+-;d;J0q-}4ya3cKLV{YdfEteswF_XRh0{XDm6LbhBlSEWW&)O@c)X#PMK_5W- zvhp!U^y79yl<#To4Ias!qU4e9edA;236R4*TNbx#KL>Yqbw;*=6sfOa8bkxFjfZ3S z?6Dv!ytxy-ftOp-He8)wzG6v6ca5?NdL*+0?RTfY3HUx^DbN?@n8K0~(I;>xc<@5;q}toM zZRwex7iZAR+}jz1=_8iaNe{~oTh8zBefts|5>h?FrUpPpoen3Nd3eTF>dkQo2=-|K z`4oPBew($XsF%y`9Aaqq=i}mPp$lM!O+6}1foxmnq3}EeP|}hv8aTD@@FxR%B^Kjh zh?p~{dJ*_XVZC2wNa%h0Ij3~Uho zYITjrIHE+8eIeJ%*zNK+fM^fL?6CJi6!rny)MMm+Tor)>TVS=8 z<4nR_J#dWK`M9m&Yuui6mq^OvKH>wr=8a#d3I0A|{$0VO@eKpeky=`-D=iKfjGgYG z%9h|O6;oko=2v{suQWJQ1zOZj2Y)Ol$2ED@+OAkWchM-(C8g#dEHm+CMvh~M{8W>o zh7mRXF5s}k1s!s}*3@;Vz6bhv19|KxsUMx6voD%aa{~?+U|T6tr24U>>sH&+GLlTM zeKHBx9}8Gboz()(>gwvJ)XYp1Lqq>Y>m`Pa&DU2x!M9_Drz1(haAdF|bkN&{+e)hw zrKqUrrBoU~B{S#`4)q8em9Et&Y;OnX&^}()fAk|%=sYdz4)!ydI6B66bqNr9oiPK( z|L0&L0~E&xCMzp@bp}8^0F-3>sL5und*h<_r5DI}Dx3fI_Llqw_@0r`udc2xnP>!c zX=VWdc|SivKnRx$z+0OEp#MvacOch;{V&%OhZ;p6l#IqNP|Y;-bc_VAMu!o>n4qel z+G{(yT#}ulpWYN4QEWyjHq`h!4=ZVr82=~5`(m{*?c-U0>Uy7%Xe%McJ6yU^*3u|E z07`GGZ$%a8J;G@wO~@Yqv_%Psnj|GdNsC#omqw~`8gfcivvJ7X9Mn}-`5h@E0h zV8zp}UZYW3<1qJS5wUtW?pL&p)Np42-~A&}s&3{%0@6AZ7ZuSD$nTX`ESio%92^Mt z#3>Ub1UUtgpuMAQG&%;l{8FI1qUdR?29CLmqGN=?hoZEx>)wkq0?%Xg_-s?-jtz5kmXZM~%BbTUs(=)UzC*vMQo z`Bf1V1ljd|SAFw`b&83LYlJL@uTHEddEE5G@VP(`3{XQnum{+YU-$Lj zznV{Fi(6+!-T)*$W=2MUalJfTn!i2Y0nHq)TM`)}liw?OTQx)iJNVC^KL7#i6mWA`3_7{xB+vavGECC&=-H|Mx)*g0lZ`z#sF6^D&W`jop()1bBC(`o`^P{NC5rhZ{%K~hwP-QhJ6|5WJ`Vx8#* zvYrfFYem}f=y=m~{M5|OH)L*;CLxAP684tpPuq?+7fAWperX@C_st^*yvr`T@zB;uq%YF8yz7&g4sQHf6NQ(i*rN-rjWWmAi#Y95^Bi6 z)41`&>%ian#0d^S2*=~T8vES!e6(aa;eV4+#2na^IqN5Q7?rUR|=rBF5 zdZ9A3K9BFSoGw)#K3?wv0?hw>{AdE@({zY{SgGpH)pkEVpL;BxeMeke97@-9l>Iaa zq@bXHRHPhcp6wCLYCd^&tl*b!JRD6@w5JVv1~|4vGX?#!6?{%qBBP=l9H^9(qX2hr{@D}1YmDJI-*ih zQ2|U4h!=pkEtA*%+4e>I_|(|^Mt8nheE{PijyQ1hVCr~-~kWaA3lJWxVgEp zsC-&o>XHD4xU@LiXsyW>pxt8;5SZ-i0|UO2t5xYZPT!o{cmQAujTg$kOHrq#rWyb- z4jAwn%Q*@??`!d)p`jABav<}KV1j>|`gm0U0;a6CHr`sZ{b3kown2X|!k#0yTD9I= z_PqXh5=$oed|9E=K zs5rW&Yd9eUcXxMp4+-w>Fu1!rgamhY*8qXRU4y&3y9IZGe$911@3$8GVP-YmeNNS` z+OGscI-23vlW8Fqo&S;0g$^d1^a5|cK0+aKrFZZ=Di z2YeQWqYT0sroQUP-~;pk{8$*bbqDl}#`W+W^`$mboG)!b!s`X~;2>!=$NM$pauwQ?sAc`*yuAs!Pm_IN#+P7U$%-7X7D-!+%mt{!=XqHNrHaY z%e_x(g1N-y)hWVV1xZO=9y=H~c{ww)BBEwFNeW2NwszNG3($4mo}<-Nu_4S-|6K5W~r`EBa1?^QgS8$y!V7{Cx5umj%ap z_0q7BCw!`7Z8`}IfLi6C=J>NSrk2)LM}ine9d2bNT0puowJZUb5*H^o%8W5&b_LX! zR9U_?H-(Ni);94dP;K;Y4hz;)m>BGRU<4ClXkW$cHS9~(%FfcJ) zWu5zkOid~IY(UEv+yJHpzzjo14ls>iauNkFbAi`~9Z6bX^LPU+D_|o2B;TyZs*MML zgV_uj-1hsgPv-~E|E^EgT2u5Ni}bgx^`G!6+wbrIlLMRpFiH1*!|&^RTK05zx&wHI zlhx(~0BoGLdtvF4;DkeaAy$@_qyUcN{X6jR@C1TBsX$KmTdj=8X%_}r;Nk-?sKE@_ z);>G<8=GCw#3leJiG(0g8a0BLc3POEX#t~^Xa?X#oClE0tgE^aCges zK&ukZd$lBe((s#%4*dt@FV7LG^g?yp^e9o-GV_3zHw=|KMa)vHM7S_ksdcvN6140b zt(BuL#ik`x0*T8UkZ=j}sc-n_aw@x6sPe}(-BTBL*VJacq+jGJ-)Ljg1Q>Bg(J1%= z#3!>kt=IVEgMD?u(Q4K^aZXK&UHD#|X7T($!qk@1*4DAKw55)mzZLsN zdMt#K8zkf1D&pyw%^lq)U-bJ@2J@_GN8PJsS!p?PWzJ$p+3vPt&sS7?6!zokDWN2- z;&6Fm2JOO2aLq zVci#ucwBIL?-u^M-TPjd0Sl1VeF7SM{^Yasc5x|x0?3lv7j(d-4bUvza*)EF$SlwsDT3zSv>bmtL2*jsA zp!$1`4mgXd+v;}N==aq43}7H{kuoePB#?A(y$~8GW%@7`#jF%?5CM$ z=K=ec2PsW9cz#|T_`d)+o-9_AH**8RBcOk=6Oa^)XY%$`=(Yk+ivjmp@H%Z`a&2vF zC+4essVbmEOpvAO$^PQ)KoIh7Du54~2F@oog#ag9yIEu*2j5>V03bzuE=FdxS_A`9 z<)Vil5zixg7ruapgiH0xIjf>i8M(Q;Q!Z821c7Av zlEeGRPESt(NBPGiK2e$yxKU|Zf&neAHSx^OhX~-uz0C!v(7jy~6SYrkRRLwKVYOG2 zl6enXV6@H{!V;$0i_F5Gjh=Rr7JMq>!HpOVv9Jj!H6 z36ano#u%JgSy|=UoS{3tG9P$hXhR2PgM~>#=P{zBw_tvTju2@TCH?`CgHcj_=tvSS z5A~}3&oI|)mTQ2ybnAohlySl&6p~wo!}ir}Ur~fp54gR=>(z%kmRp22C823eIeK_R zkv~hr6he_=FfxLHNmZ%x98sRhJA1BTau$@A=3wSvlFFGqn#WBW11|~#5FL1qX@)wy=WW*%;~;o;&M8W{W_ zfoVGWmC@vJNhVFJUar}d&S@Rb8hpHvffNkHnSBx12^Wp4PVf@~*9gYO#x@%rS<0oN zMap@A#`Zns;^627NR4+q1VUQ?dfx-g<&_omg*E9S{{zo*-PUBM=69k3h@)(lYCca~ zqp`LFTnNE{ApkEH;P=Qs!D-F&APXq$Qc+O>kObU1{(>tm5s}%Hbum*@bjvfg;F ziCK6Kpd1r7|IZYD9pJVW%ugOa-Q5>pQMV;wF6D~}P4>zlNr`fFCH*TvS1O(Q2E!97 z+9Zw|#V-w~}5bBsn^%n2tsLn~L9CT)p{c2Rs@1nGdp z5n1uq+8DzaG27M6lfQp|XRK)rj|`M1ZWpEKZ68h*go!oc0&BVY{pr+xWEp~D=VJOG zNxFzK|DV%C2e2z`xH2?j*Uv`#I?i`I*J}pK=B#ux4RNS;pfd>V3pE)!z}3M?(tC`p z)_Qa{C;OS=)=}qAuK%LeYO{e$QDsDKKfAS=EOp)|BFe4VZVVJy|#Ng)z1) z*>IuOIIc;#H}uV~$Wj5ZDDb7@77H*C-%Iw-18&XOr>WN&&f$N0&dS#USL64Z?Y{8! zbl#Xg`N3Z?BSgX=EiV7r=yXWc(v5mY@1x+VZ+VXKxP|yJ%ws)8cp8qc_!D*l)be@B zz#ws4tw2mmO2UJ-@31MFj{~N%+fqRmUhNFY)*oP_Vq&-A)n11Mk(H(GI{ujfzx(c# zuV&j1K%#Kee?HM7FtLX>8Fk4Qt&;LKQnW(D!#uEpo8nPgH8zbY%rIoX;~EpgAFbkk z;>xv?*ndeP7MI&o$-z<)2ZV-J87^_quQ`?I)}O3*xCqLqahztaK*vRo zk!xkJ5z3H==92Le9H{gr>&1`3I$_0YPOIhQ#fjj{)0gp^B5M9iZHh2wRpB>uJiGQdF4^L zkptIOs1d_7ner<>^-?lo^t0)uc^?(yT5Bi!UzQ?wFku+;udOQ zM#_dN#d{I0E&KP=eS*w%MAqCU;`pop!gANYYJ!;;H#c5>ia*H{<1a#M;00xnPPI5700?7BF62h4-S6ftMPyv zeeGpzp+Yi7MP!1}N=dHH<0};w^3*w&G9!#zOO8dVL?f@x*At3 zv-VM{124QJg~Fy9B-T5jyttbhD%XrSLDGhQt4r%T6jt=E;?Vv-g@_7MN_o%}P)4XP zOreu*WtE{#NDF@#4|(0VoIpK`CFmn-;n;V-8jv!(i(`?2;j!=)ab-}zlD>33#H+M|;b zpMjl5;GNPBiT2q4$4XO*t)k3olNW)eFJzey^6D%2*GK)QCEJ)^+<8Z&3mz=FVC8n) z_@12*_xf+rIm?+BCOZ;2X|iG(y~g*he44MB+{>44t&(%h965iXF8p-y8PRR+kB-}$ zwn6Y~K7LZ?W1Dv5C=)qii6Sf0N*~*{P0ra11Q~neVSv`_F&UD=AcN!JTRw3C`xuSYv6@SU08q+)0hdQfQhYK|Be{@7z}6a{{J z?C9UqJ;URyZQydV;wXb2>n@&=s$IR6*4Z$cPCzK)2jT7LG5H-`rbR(`H+$giup53W zU9OkcpLxi7uphYOnm_Gl;{xtvu5>S(yGT{n6K_ZIfYsM_M}YZW zpt$ly2ebLeNjFB_3s~NNo>l*8x0Eex@d_%A=X+Ck7}7eW>4T=jn{<~Kf5>rXXD~j+ zVZn{zRXG~-M;|+3Re8J>m6t{#KAJ^cm|g19trnGgq*$j82y?Gv2~!Zlk1=?S=+r@K zm;Ex8dyDRqDTtMgC>Iw>l~JJhzUR3N{HR9nce+Y*oGYYnM7V4= zAz6EzId1(N$%(#R-?qS{QR}sSvZQzRonzlsDg?XUyM5K!=081QTfhX9!2i<%eEHuF zpY|7G=M)?|0mT7?v{^Cr5oikNrNE%8n}tzE*{xXZb!$aVlGyKPHP1~7i5CTj5xw(a z7Ph5d+_M1RaM=ih`!z$$5`W_7W3`9WP_pJ;dd^CuOjgRcbz3{=l_}|-C+5g{j$y6; z<#ulxhBQhUMZ5%-RB@JSDf;c#XHabor~7fFsGZ4FA)yJtA2+P`y*5|MZEU;i|wn9*jpwIVvy*E z`kS4q`sc!!)bUTG+upkTSoXZpD%7zBFml4sDdp3j`Pj24i2Ox+a5r#Dqi4DI?fl?K7ozsvqW2v@Z@ml1ZYu*2Npic_mdy*(T-s|3QP=k ziC$!!lED0}5IV_61c-f_BxxCj4)H&hbx5c%5TB!uzbT5rL}d(-5vKgBnGo$0vK)jI zYtg=ffz77Fho?Z&=7ss_|A7|rU$Pt4Z#B9(I9!3iirmjIM<3COI5z_zQLR9vu);wp z6S)pFN#PzyFa&|I7L-5>jloz&jaYfC&fgA&-@+%GxJMBF2}ett5@A{u4x-S71qg@# zK$$f8`Jt4KhB_dbh_57eq$x0u;^GrqG#L!$&rvc($-NyOq`YJj4B?vxT>o5Y8B%C%B|41)KD@QBurxmlep}Egvf&Ti zf526ZVsU>@LH7?15}ppKz=kEFRd{tmivB0VPC z5<*0unDH^{FC{{5S@PC=%ktk2VS{tp%#L$%Z!#f>Jyr5IjPCNloGJC9x=GtQtbu`J z=AU-y$;wts)x(yKE2CCx9`Xg&M^0zpF_0JjM8tJb{f7y16r`UYat7Db{xvNRpu%N7 zUjB|^8r$!{bv7)?#e=fIPDCPArJ)pR2~>&+J!rDP6t_F+|DBGt6Ll{sofdjiMg^UX>zA(sYxl1Zwb#xTv^a<7 z3Iq%qF77jHYqsAlqhisbeihU+;?gf!+(udwD5TmkxVyPA9k;C5@V~B1O*sx-F<~pP zkJ!{Yh95omKLH6P^Oo6a+i2AMj+vu=3j*g>d?s|hGWixI7J0 zC3B0Tp=!6P1(;$FQ0a%FE>^*I98{)54BI$*rqtff5CX{tYRFDYY6d}&^q-z>SI>6A9f!vgOhLvTY{tT|@Zvv3ZUv(3#c93EbcfRKf4ap;@=Q;jS2c;)}Hp~jH^ z)fxvheYRl(2>`xq=kOc)Z6qw@Nl1WiZ!ynD+U9VxGp#v`&&>62RF`XbH@XWJhF2Q5Jh8WMf6uvm;So$qdnM!4e zB4LSxLlK{`X>2uN#&Ei#`&*WQwHc>f=9VXKHSUb8CRg?X&HA(>H@ynMgj0U~QuEk+ zr7czW%uXC3DJvS|2TQ70HY6|!B@H+>8iG+#8qK^itqSW$B?U7f|HQxM4|^$#?RhD# z^!%{(A4p|=lv5wbu+2zEdzHqL*}~Vr_yd*;OfVLt4mw_Ogr00dn2h-f&H@q%>L_8* zjJk?Q(x_v7MGi3JWqIZlr7%KG7NkPr`<9GKakukffRH*|G&L}B-U3uOFNsP zO~BXw0}dnOQP&Oee&Bl-34t(}^_qLA#F^yp;gsX03&+poKw178PK94ZpSNV{9P&%+ zDdc|}!wf|7C&xWt(TPf%wUYJRip``Eq^xUDr#}dThPjd#Tl(x%1w;bKv#mX{phk_`P=2 z`2DyM7|{L$s9^ZLOLzb!huiu37$ZQU1v%RRITZH)rC4NkEa=UBbUQV)fz_dD{pJjz zRx1`iC5M&^t4FTXQ|nNq6R>`aWGyhrdV%z{3Ap;Fe3G|hbYqt9oUnGx$U5T8j`S*g z6s=c_sXe5bF)`lMXoN{GU4s?j34Y>+;6;2cl{^E9)Qnx}&&8*Vt9$$dp*FG&3|9yo ztGnTr5tF!Bta^tH>@&4DG_Wp3 zVsv`~hHQw*obIuH;n3J-<`NpmM+cTy2M6>{K`79HAYeX$z+}{hQ?$<~NYfA4pfjLO=XepFw0_S<+Hk@cEEA=!t)40uPA`on^ssH^ML^%xtou*;^ zde-jqOp1GQnPo=_QwZ$wDD7QeD85u1d~_R|-y+r4T((TAD5y4WP>sveNwfYH7@$u2 z6U{=HU@IdQZJQJ`DjVTkLb?bIC{ewQb-o^VIss~~%VNLB;^*=6XQa0qg|}Wn*wyrO z*1FW`_tozTP!+xlZ`fE_yVBUrd4Nh8@|PPFpc#+C426unv zamRV9om=xTwv919G|SHqVaSMqpcZ5af59*e+OT|ew5)}a>&cg8wD5cZ7oz;+Sbws5 zzP}+@LrR6aftm)WP9$Nl2L4^CH6w0G$1Ue6^>^CN(U-S9IM+4v>uOB+`fvho%5&@9 z;Oc(gvoEhZPaSUyv1?F>cpN2hYkzFf3(cIn>5>nHaixPq4kK?(TZR|Rel{mvRnCte zS3j>>{cG&bcTrtm@jskrT*O30>OGjgOQn82^$eEh{j#y6^3@v|45^5nrAZ%gRu;vG zDygGuQ!Gd4U*E-M>Pr&!n+rxDEX`?(%Pe?z6lAsP@d^RU-DELzQ{RClO0RuakWpod z(7zL8@L3&yU!<#4qFm@A@K9Of7ZKcb9!avV{lC`AuM_=DH|Rag-#0nj8R`eyV^VnG zJkTT{7}9Wfft#?|#};t!8jyyV>?B@jQFbbn40LRA5!?~zia z_Do#I-L8ory0t!^oxd{qz1{mwTwSqsUh{YMSa28_8-FrJ(5L`yDZK6~JS+|f2G=L| z^@;r_-kR_|bG~`<&Gy{K1%UaL8)Vp`DAuXV3=7Bk*nQ>8zwMUOBRmL}9C770@^;U8 zJLvqLv}GY1-zK>5$|65e`8J@xc|tg_zDd-+CjS-at7MomBHmqm^2eM|^X!%{CTW z#K(7%Vuc~xK}itHV?rM=;8EOLDidKkD=epo9-zh(ZKt3E$%Gq7&LvnxV?$rUN%le_ zTR>>2A{SK0Q$s;Bq~l1yFFtDa?x1G=!by;gQ5k;oFoo`L<|XG{JQ$yAzi457SS9a= z!ZsnPma1!_ZxXl}|5c(YtfANKgGW5?)?X?(nvIi57Z!JDTwZjcHERn6DU%9MNkg3i zs&6>s_A&D>b}f^32|tH)(X3=*&7`8L3%G zKRG)?{O9+!PrS6aUa;onYkk_zHsti$6GCJ+cy`=-+A4y_VKKQ0?k$fvRyAv|+}55% zE1^GD*8T}+n33aB18*<5m6XQIM=(RLhz>#bm0FmTF1dl>RFC)o!Lm3Y=65&Ri?u!Y zEf0}6tiIo-O00km=&>FFAvJ|%kx;WyiH&D$Ar|lzoKyOH_b(nyL*S}#-0%R8BC3ti z63@l+DfhUer;csDZ-4@3}ZrBNvZC|z2(A3!Y(=@b{BGS<}?=+sNQ8o?+OIx$D8+w z-=0tbA9LQG51JjeAl%nIsdJupssHtJcXT=MFi4%gS9}1q?V$@_BY5s{te@X?^_&97 zSTpr_OU=)wCW9m2z7ijC$#ycgi=T+J*z!TI3e^4#moQpgS2NuIh*vg3-SqthZ={Sq zvfsEy;9z%XCviQyXi;u!TyyEiR)0u3e$izbrY9c;G|%;`4WUH63ibr=@9_dbKh<)( zFM4j;7Ns=-LPTM~j0c6ASf;LUMi|6lfr+jI9hM&F8DBkuh&yWJgvX8V33t}+Gs}y7 zU@^n2P%xDPScASaw#34m?pNF4_pr#37$q_DDWal9VdFGCZhmB@n7_KZ)qQ=MVUG14 z(H(&H+5J*{R7iVx@;nb5|G#XB5uH*!72l4g3rn-B)lTj%;%(}}>Wf5$Yu`ZV>C@fn zZm6=QMsTJq9DzM+?%NYK>avQq5RSLlEr2bFIY!-Q+GRq*(xRQsE*MrO{p|L`!PA1b z6YPPGr)tYBeO=>seD@~OAymk5EkVJvk5Vy{Ccq9$kDz6EOH z%1s}|`d^_d%))qZ^wkT~wjfnl$4M?di`ljK0P?1mDrVaGH<(rFmcmAKpiKYVZ~qMS zVPs^a=wY@8`70>--=Ksb+iltav0o<83hG@Y)8!@o8OASHND(r=NHvj#E6~;tK{4M`cjzOMRtlhvdwvpr)=-gT3N_3l0b#TJE@q%D zPp>WYHCr1DUoih%7S2=EEmuY3U2r2*+uIl#!{~rPTG4orSr)~*iyjsBLs*-NcKia# z7_m8^S5zhwLT{*`eN3D_ixdVbO;R|!oo}~n;$XMHn&D1`sO?FWgZVL*eV9r}GZaH9 zKs@gEA2&E_Ff!codJ?2uge&cAsG5I9=?{0NmJMl;%7tL>8`k{3Oe^~9?H;RlLL#&~ z_rs?5cMshTaMAY&r|21g(8kE@|Q9@OcEiIfD{!fh=bx!r zMD<^ANHeiH4Dnz|wXkG#pT#ImJR}DjNxNPf+2EnW z#yCBsV7qykre1A2^-FBvCpE$AZ&@&L_xIk2{LE}6JBoj-((x6Sk1%JBdFa0uDd$Pn zxbxf`-;2%QmHl27ngPtYqog2q$|F4JIY%zI-0q@p4t7PNn-L=9?^U&SQAe4T$-Vzw z#HqgnTJR&D^@Cm=J$-ZglTm~_nJW|kRf+xoY+XpHna2g!sqzLI7`8sK-Ocv)9J8^j z@iw4v8Rhqaedc}NlNhil02bU0hnC{hB}_C1s+PG-Tq>8q6U#RKpMpfeI+F7T4FAhMc~9wU4Jz*=-~# z8|MYw);Mo)59$1}vVbX9l#(tbZ*QO01Vz`|a=4d_q-Eroa|{h$!9vAw;yE!!7#gkQc4=uU>UsTR z8)(5@dKKi7($Y*dwl&UB5;QP$44bXTjndy*ZFas<`G~En9T5Rp;Bo$;$H4IC)+>u< zVmmbYo%Fok2Ud!Cwo&Koe_hu%u1O3d7irU$^@rmVj=sL=8Jf!tW4G4WfYK*W4`SyM zMk-J}-ocXD(9bW&%^UX;+9Yjfdjy#5)2R^OFbN>N^Q0D)lr|1(Ff{pimiNcTSQ0M7 z_^2Z{;JG4BZ6)I|ZgDF?E#3bjbY1E~l1Rjp-1su}@mUFo3~Y%}HFb21m7r|SZCHoc z(GvWtLCtQ2*87svi2-Y<%pDhGH8VnDxcq&snR`iUZ4C}g12|jVK@picP>#?g!R94% z(#>^(!hKavCpZD$$NM5Q97YJa<{PWfwyh+KQh%L;JF&wo&2o&;wb@pt-B*^!w9F^DrTt!_M!W=_Q8U(@4_g_VYRHttTv2*z8|R}Q#~#9NC! zs!YkM*K{{{N8Tk9PE9UOnh*TMzdW zI1FQskK^bJg=(_(XhwFnF5I?Dfl6luoZ75^{ZSV+`*C)+#WNLqF6YGLiTH!{^@Ld{ zN{hax8XqjfOb|7@-#~qm&u$3_ibmX5=g_qNQpnY`&iAc%dmme*+%c0u%~TW)n``LG z!P0SmlrWR01LLZrfAtTSR4RU?kc4avtjqvb^YINV+Q*awlI&ipLCM4R%v#=2i-_VZ z?P$g%Ws;1x-s@7<>A1c`gmn{s@gLr&ljpMqah4n;CPy1vwFw zwpQx}N|3P3dz8XmXZaco=m)$G*$g3`Gx-bWf!jqaiWvkb))1_yBCTtAGe?lq4B=tX z6Gz{JQJ6lVWlWyB9*sY{UjOO1j%;VU%9iIZ(rFr$N6h@D=p#=j+__P(a~%9}RP)F)pndbqXz|0VwePH7Bjarus!Hp5^fV=%%H_-Jn}C ze9_hzA=Gg4c>2`Ezq5YP3G&MUiM=z*}GP@(vIBtO#VTN9o@GW+D`~r*J3LmP65%9P{0C&<$t~f4@XDF)R^I=OTaf* z9vLcNlW)=twSgy3d_QNavN^HzS-+j(j`+X)|gmfNc zQIIR2=DLgwe(rckwHkYLD6C^gHSf8|b9pGsxYKKArEko!$bc~QRsyldk0*^*!}XF| zh0iLHYII4Kq%aCnw)&+oQt7e$5(xU>c`<=;XzP~h;MiX!e^YSKMQb7ltRpR>jij}E zf2O4CCVfb#hcdUVA{lTOrH`XN*a;baQC!KP$ye5c)ItaKih#V6bmqnUZTk|vhs%@) z4Pem@<_$y#b%P_+b&YMC*Vm!rWird+jm4F~R$q3+5H~}wDM>XX?IfiD2cnsXb3L+XUhhoZ+54WyV%BugnFE&R>+SCbf)*{;zMW<@LSQp~XC&N^1_e)9c{b+xKd_T5sbLKWmWTw z;LN*o7U~@vWk+R39Zq(&!d4W#?lU(VAb#WKM1~G=a-=_aI@a}a{^ZlZi`l4ODYlKNjuB^2fRwP1xFyEBwsIn2NuL_ur+F!P&9v z{lCe$cJuoJSh>7f`>{EGf1;+XSm~qpn5lp%Po0K?ne&nz^X-%GZq;s9?3vXSf&EyQ zwB6#o2#TekJx(p+`I!UMeAG;Ql1bF;c1n+C*l6eJxE2XU1hI$5Jx^Suy#CHvf|tql zvVGNHv6NDmtnol)WedNoQ}MbGw&=iR+^xs4Iv#A>eG-S`hRh%HU3Jw0)HLWP!VA2# zW6fA4l4zO0M(0tb&YL~Hj0|(avhc2|Z|2Z+vVO&yKMUvj-43e3MDu5g_b6#}m7IF7 zDv#cI@BV(>E>(kh`aRM(CkQklg=pGTE@SPa3O9i9RPFJ;ow+`_d=Nj_6FFV8>e49P zsh@XN{iov_MZU})S4QxmK)^7Sn&81es18L}%h!^U!{RwMrbYyV61FrDqEOaMK<-;m zcRHSol`T=--zU|teFgF4+jQJUaQue09(h{@2d>K`1Yyzh+s#(vUTZzJNh4tdMkUv#(l_7)>GuM+p^m#R0d z>!fMpip?!BapbGCLEnCFS+o3PwTI^uPzu(bB4;eyLm39+U>USbTv7*#5|&0+zy1)d zy;|boSPy?9wkw;z&!|)Z-Ul8>6E5D!d&Gq&ONs^;jx+3V$Yc*ic{m9)Yvyz1W86Lq z<@LsN9*lpoDsScYlO=LO_{+@Ws;+oUNdQQeO1!JB)6Vv)dUdz zxaH{Ol~ZXr3fjFM@==}Q9J3mta``$oO*f&urZOV=$aFJt-QMg}=!3nnQmn(<+Y~4D zg?3_Uj0;^mtX9Kz$%Tv+YKDq;>jm4@Xw;g<<60`@($yQJX57m)zL@8rI$V#kN_@i@ zl2Ja+c6oSfCszC0>R#78vTd=|li9x*YV-HUhA{x4Q7PPQgi-iVvR2vGGUvxMpRm21 zS3{-ox?FqG&=eS2xZck@ubHs0xIoswY&dwyli4dUjP{t%*=TvL8|ohYRGA*W1P{R* zkHc;84m%nWB5wEqMV1Tok-|CBmj@vxL}c17=fptNe)521;^OyBi;xA(K^0X~vDd+H zsuJsrzoKhg@sf*3t*O}z+}vlUXtdfErSy0w+3Im+lYv>rl0L()z3qI+^P*;`$4FQl z6Eqq~`8tQ+VDkCnH!l|#*97h}TLsO^gOvok(Eq}>N1wv&Hj6l6&juDO+vdgUSWv*{ zdMbYAN>y&6y(k`*r6wc&&QW;{)l~|w&WSD>6v;}_FFcN+1%FnC3Cn7v=;~-!R{vWc zK{HHUjPzG#c;Fz;g;3E-KdHAd{j`W!vJ82CWvJ{_%0mxEx!kZLJ~_MkG>`cdcwyjS zW|$5aCZQ+JqUu|^HmHUXizVKOwHBL#^tENOQn@s+wpTK8j7!B^X%1WOXwM<@y3nY) z{zdm<%FD-zG*vBiv|S}qPTC3Qro-2@iVfWbCEX4hbO@0)DGNR)IB@LXgWS*HnF1&kiVUMcd?wI`_ zt=3041&s*ao#W&t3tr92yIbJ2jyCYv>q~j)Z|oQ&G(X!80gg7_3qI?)Ei91KM@9*i zZ(ZiR(Tu=fhqCed!>;P zPPx2}8xX?VVq!6(&st|~%hoZa;WU>MRl{z0zS3B8;ai z-yRX%Ke^F;zPiVxxzzhZB~uAxyRKV4(n`R&srCn655Y(l#N78!vC)}{=198Aq=f(_ zAi}kj?ytajh*P?^Q*jAff1vpS&zVq#Y?33pFO6MXmrU;XT!*O&GLGlgB?9M_A@8!?ec;tWeOAv zXq*G-1#2mWpnKONUa+e55vKL0qdUP}cy)~P?!|5#!e)OS$%K-9!u!Vi>{WX4B!P(l z(>g9@6ecOB10~L`{8NE2wb??)oIp>`eiR=2!RiyA&}!HCZP@0r&)s^rhKP`Z*96vb zlBAdi-8dp={vjdv;ZqbRa$!V7T(CE4pASTc+atmk|0+s3uB#kE>^8$+9|xENGgEb& z8nE@C`$fMd^pF0x2O0x|Pq+Ys{g{L*2jl6C+z;)-N4UR#@Nd4cvrppt-KXb!zgIr@ zRd?bwp`6oGMs@6crNG-;PB(YA>UpT+G%u`uY=A!DHSuIDFaKO#Puayd3`EFfb4K>| z_Te8Eq#T7DA|6$fD5L-;_vHLM1XMPauA}gEHx;=+I#m?EyGD_9it346uED>2Ifmi0Z076?ZH@I|Vvqh9l+GS0!5@l9#hU}G zRW@d_jcPn}ohg%2;cTdv7I`O?kk~AgGq#4xUqI9k!&QB9dUi1_gN;*1mdDj~#XpMf zc7IouMX5?1IglNZ!n7rBToqK&Xl{g!VqDE-$dTso`b=NmfQ*9}f>U2OKdq~2;A`9p zx*h{F>a{q8Aw{p6hAK@{Y)$J8zrGU9Gm);d5P4VVHFv+R6KTT3&3oLP8r5O+IQZqH z=yyogShGlF2;e6a2CJ8ioY{HsMWR;dZR~az9j9LEIq0Yt%^h8AtM@zjg<3%y2S(l6 zCeLJo!LCl{l4udrMz*$}@*?V!hfGH4v6&4ez~3xTXZf-AQ>7_!rzxO=q#=Lq#+F{s5 zrgC>lKJV3*iT|~mfU3cyyR+8}`*&c=b3EvKXHU?Gag9{;>8&DW1xU->!aX%7!`$2% znRC-7BI*{A1D6D%wN+%i-6JT-#Q$FUj3BK3WXj0e8Q(f(Fly_nNCu>L*K`Rf0cV7o zQ(%Ha4`g~pv;*ofQ%84}Hm!iidvIhO7T9R>__IiR&Oc{ZZ?FF%^7ZHcxEH)x<9*1- z5gFi=VsKy3XLW@&A@A>TV_A&rPm50?XBtZCDH=werr!;J+7;s)vwp@bnmL-bsz*Xy z)1tS@8pYa^trM*Sas!{Uo_xVk%(&; zpoRsXlFm0+G=7PIhbg)~jN$cBm#a#znZh zd?MrgsX~BQTvR;daF!AHB4Zz(A78ZYPtxK6$T5a3mt)p;@pb z_7`l!+}?69{f;Vs78CtI@)7lvl?5dI2AZCWG*_<;;1^k8d2%0fJ>R@O210DFHO|c>T6At@R3mZXUOq*1+M- z+>PTc3J)gD%Txi%iN;G9uzEyNl4&w_f`KFT4Y%A%UBzhuA5>6~P)t(L$Nu^PnVNz% zyV@KRmsZ@95MMs-!|8K(R=1$oElrdJwy)g1=le~oaa6P;^fC<0?iYVAa1<3<*ZM&C z5(RZtO?89AR}c^KRaa$3Gmslj6hrcnS=h-~2S@JcC)IP`4#7?&v;obqE$3+_=zL(T zvJrR&#@j(%BG5*=#0q2hF%x<4zo3t0WimV|edgj8jSTcXr2S_sL(Y<4A|k$E%>cw7 z6{qd&x9GgDhXo=r8W!%#@)bRNR(;q6jh^pI6qjeruiOY2(cavNQi+mkI0bjYIBMDBI^4yh*WGW8D?)=x zw+K+a`%f?06BP4srJN<}J{jF_UXUr_C72ZNYpI%;x&W3R! zShyDo7LGq;mAdtWpMHpY7I1%G|*GIMmN?OE0TFMuUS$|#lC zB~>h+qy`c4_+%9n^SzN6?|0*hWm30_Wm(^L_m3s-2S+%tI()yOfThggtvCB+d#rg} zs(0V7+Co#T8Hjwr;GlVize-D-;Qqi3&B{HWt{A9x}tYN z!jTuNt3R6m=`G=5+{;6E?P(@`uN-*>F*j%-8WiGME_a)UJ7+h450PJy|KhBhyRs(c z3Ik_JZ|YdB;K$OQjh=t(s_L4Zfe#R=CEfVlX4;x8izcBhC_?<)hwK|?5)+|xrs~CO z;z+`W--;7z>Lw}E9Qo}&o{lr2Fco6$9~|B7o29^#G(}@q(u+-cy{8|~nkcy$crA=y z5@%kDVgHYnqZx<1oCF8gWyKaoSHM=}T!TH^yp}BuIJ999lu-JlG2Q0TWWcLR$;vHq{d@5I zTyx8@dlAeDENfn9tOO-Vm{7^MC982Lvap=k_&k|H#r;o*xM1;i$jf3ft_nV;zaf{c|z+GO%5<9311#9vBOa3|EYY ztP^A|CfT&tu6{YDcNrLwt7^<(AF07iyk#`9Zq#i3}G$fp$jEFq=*05h@1zm6b60|fv)J8iHptw)%YUDsgiXK3p5en(huMW~GG0HjC z{jJZ?CcQxqyWCRTtcq1pAgD6$x;qk*SQc}*9Cgf7Go3aPR!SD4UpX5P(>-=C9+xa` zr+g)8dWJ81%(ykzW@f&2WWV@Ors`6AkZ-cjeZH+Uf^v>lq99Y+;X7llWcRE>8tbM) zKy*Hq?JF`%Ul}zg8G4K*z&dtst=+bS64r>e?)}~sh)K5v^1UrVSAv4z(A^!^!FU$n zg+ngF8uRSm(`ep~>#Xy{38p{S6JIBqoe%6D)0n?sMyTZcd+L09zXEXbIi@lE|D)-w zqT&j+EgC@+TpI}r#`}Nkd1lkr19sUVrI@miwO=GmSi9INA7h`H{|KV zI>V6X{Q<(Q=pq6$p3Y|6T7gpI;xLvDP2H7w|NNqiMEPNi7QWe%r#pfR`+yvb_9bYw z`yUbOluFow4a_o%6fEnnbE||e2V&2ggs;T^k@X!OQmsFXxiCP^0q?fm@dB9lVMy** zW20z#akcKEMc;|OOe>D{-D~&B`oMCB4};g{llv3ysp$G+t@q|oHU;ro#1H;3ge#&MUvg2R&628U)dB3lK90gFNxbDP>HQ%jyym9{kL;YJ$ zFyLQzc)qs-NRHieb65Z->CI=}1M00C=auSO-v^LuHpA-wy_n4m>O1DJzyOmwVNw!_F^r({JdT`|TK}H0gW5MbF0jdhws{N4lP+fQ&y4EiLMx zYw`q%-CwUT`iyCPi3&|WTPyB(3#VG6Dwo`{NlA9xUY%Wb#W5UQ+el>4FKIrTk7f3@ z%)7{*^M=w#e?wR1*}i~MDf%KpypFKrHpX+e(hDr8X3q!4qoX50U?rQ)Jp_TktiRp@ z$&wc&|3T@zx&D_i$ z33B$fw!fP?Z)i0uvEC?HUDr}w*JZ@I)!0#Z4sUxh%5l8NpGp;mIe%1X>D7bR?It1I+QY#dPK6kj8Qwu*aOU$`K^lllJl z%iX$Mva!wm`#V)3(KWhfGWD-EE-R;3-!8h?ws;F-2T`n1iZ9)dpc#KkXUg8x$uIo_ z6l`y=?PeP1?)}MoL-~tlyB}NcJFvW0S9Lm{cj@c8y2jrmk(Yp_J#L@ljaKP;Jt_9k zjqLqPTda%dkXSoq-c29^u(%y<6l(RPf;v$HrWmK;Brxwdo_#7 zfDi>Z8_XB%>d7hHt}Tk&`Rg6bEfLLf>cZkMfvh0@S<5Rs1V#Mc^>AL5Ui|^yz||YW>aO#yL%Y>63;^_ozagT& z%1pD(WN8SC1A@55W30cs)@st^3AU3NE7{64Q4@tISJ3rU5s>74So2eC|VhHUJtO5MUi{n&XxH_8XFtFyqNK0W!`G0Lj>_ z{`Xkj0?2Pi>O)9~i*#yz+&gstI^6``P-qX_j8$a=}__%4= z0rsuA*sTR$y7DYclcMM8XY;zzmg&C1OV@SISQ4u*(P~8=xKdB}x)GwDc_zZEUMHQ5 zm1tf}Y$%zp5Svu0WNUX>xw?@&P@f7T&JZUB=Yew^iC@BaQ23{b7Aq!?C_A`AVJxNd z1`Ycz=Vi<(h9)kCYk7+}N-btgX>BH@MI$Ag1$#TDS2?=p zyMzV)R?oql3=AXmZqX)Hi|tu{Hvxru1wGh++BlaV@>_IsLw#UPc&{1=)D&%S-%O~G z)hfD$L?k7=)oikK)O0e3Vehae9!q#sln2jkx449If_>I;UTZ~zS(Oqtb))Ai0=$6@ zPJth{;=08wE`|%6Awv2<2ac34ZAf}CJOqxedH^WAX|wzGYpD%yP8Vc6N( zU3<5k*Xia@wE9oh_?lmyT-)xDU5(CC)&gs*ZfXDR`)~{FB|fQ^DchN+UmgL1ZhS81 z$o0p{^`52JvlrmJ1R1@dlHb^xZ~TWhn9&>e2#CtveFMH|XlfcdIVIh-@ACv=1X2<{ zPK1~>XujbBcl*N7wcDJd_H%r)0dXi~8yv%Z3HOHSU9XQw`u}!VH^P*4#!VFBb3d!p z=ZNQ~t|zV6>3`Qb_XE{FS#@WvDS!@`m32-%n=e4k*v2L%AmF1fqiEH%l>-BBZlauu z$k*a~_`Q0wAVmgZ-ti}V49$~3G6~SB-0#3^(olGFRe6TwGd=tZdcNi!vJuz$EU(uP zF}XN1*`{R^AD__l#2ap7@tim-Qdo34o70I}4o)2CslfhatmWn9P{%M1lZC}K;-Nbs zNl=tId^}c51lU)0adi<$aYer&-nZaQ(?>WyhDcy+>T_=nH^?Mwf`3wPPVgugo0?+h z#efVP91@O>=tBJsgqBF5rjXVw#Amm3Y{QncA#M1ivBk+W;|qk1J%mPqFC9EpI?MX{ z+TyfA;=ocnK0VeaTVbfKw5jb(4X)?dDsY-&V1?KHVhDBi#o}n$65nDwKMAN7!MLUf zV%`2_6m1?J6_u6Ka>RE8nBtKJ>{eUM-V`iAzqOPsW%J9NDZ8}?nijgg{4v9Vfg4%t~*RuEVt z27h-3(Zv)b!=Cr#Bjgp;R*Wgj{2en1g$BH01r^NlHa2IqjSW#I=+eykcor?KDPV#a zpx0O0$mX(Ov5Su%`OfgUxu&Bo;LaaJ?80GTF%L4st`0{JXw8&u!d84VtNCMXZB^R| zjyWJxS1owjhjcO$5WdTMhCs0XG=LDra>H4M`|5$!Euw;AH25p>Xr9f0o6H3X40A!i zqz?BIE;?OVX*D-byJmXf##&gqIXp|Ok!?gK0Kc30W%~3Q6cd~aV?)!s2?q|Sku3nL zRas3mY#NfOUkAqF-rnBITNRX9R@l_E%=YYZ==O@FNFW^Hxyk#gLEo_1W3Z#;Pad8k zPPj=mKu7mfKv#uwSpqxeazHZXn#0yP69q{ouNSWVAr9ihz@`x4qx{1XfLr14e!idC zxB2cxci0Y){#t;qk@+(Kr#8>wuO;;VgB*RB)ra>kt4_hUQ}`Cu+PfWRUi2x|+M59F z&tS^|2?Ev{hF1bz3&C{|vbo>d6-or|el#HLt%GZ8ZpTa=P%B6B0 zWoVS4CY(4SJ4XDr^AKCBWH|+K4~avtS*}1-n$u4C(j|RWo?{%8S$+ zeHKqn2@^5GGe6&?E^WVJ7Fz3n6)xp|e0*$pLUe9_V|jL*SAgHYjiE@|Tpw{~Rl&l3 zwz#rn&wnZCNGf0~vlbFtE$6 zTt$W5_9jx916Gjj$r7#<&j{JL0;xJF!Z-5RRiFWrv0u~BA;gOt5@pomY2g7MhIJZ7 zrB-caKOb*wiTyFpvmb7EzapbSym5(y zywe|Qz*idoI9h4N%G$)>9eA}N@*58CNicbLp{k!e`efCsRic@K0WRz&QaS|KQH1y2 zfno-<_15!?bRdf$BN}f;gRyJh4a0B0A$v%88UB0dmOq9Z4(^sLEo1nB?@>uDEl(r&G;zQ$KArp*3uhY|okvv{GX zusdy$Ny>)$B;{^NJ7TK_B#?!QyMY0X!APjXY*NhTSOB(K)&`T!6SWU@?htF zc|eL;@%eUTUQbc#53={ec19b^aoHKO8}GO~-)KuF*(?-im8?2nEl;ssGl<*;PT3WQ zyR?H*%u6CdKJWOU8~hX-2D{*JXKHAeD!$&Hj)ws&LDyRR^V{biei>z! zY=}$8k@cyD^+#e|wSJ?oo6lyjIX2rW99{!XWOUSJj!2?0*DE8t8IczM?6k>J%XRk zxB^^o3@t+qv6@>mradBF$$=aRL1 zZ`c){cANbXTw)#6r~-J^rdR$|Z5vlvk;20vEI)akY&qT5;agFfj<0n8IK$8lLLX2S zppi{N=W8FM&LG%N3<~0n;dM+_b-YkTjr{$-2f2~%YKod*pXYAXh5jy+hk$k|>GP|J z>7S-*9R#}*%^2CvSv}KkmThP3EAxqs8~*qEdKm+~ld(-AeJ3Xn*Z7M+4)h7T(XeM7 z3H=YR%d16f(ErsZ7201Y)l?>WbA3fG@;L^%?%od>xgu9Oe}=M83Aq+FwlppIi86Yg zJryHQVv55_oWdGLWyPI3cuay*^ZT=!i`%6~wZ3J9=eDu;o?k-6_44E)29&$7KME3r zcqf!vTv~yoZwL3c{y8s7>Q=i&AcZ5k()0Zx%1LGc-By8e)Bc!J7=QnE5Zc%#TBW%E z#w@@)@5>=ersmA;bNs}+LtjRBZzaT!nrZ^&2>_{Rz<%584)YWVp4j5Nk~U6a1> zqo+bN#VduO6-Av7fvN6HH$$8)%xJu7f2`mP=;#6r4Wd$@4@nKGZ@oKslNg$azlM>H z{9+F`RO&D52>zT1`uLpQbIV*PA?3I7z(!js764-d8wvJ2DLuRL`8Qw9cmOQ!vdQki zr?bw0e>WMXn*MC;qrbFB(f$H$NNh%6CRy{(xlp5HR~#43KLP@Z zlp(l7zTyafqa@OYnH*lOX$5L1J2kNPDCPd54JX3dRDboMenb_&jBE^H6k#qu^CB8M z4C8FHqihiUP+l9@kXBW$`LYzB|Mh`;#f0bxcK~lthA5slx`FJQ9p50v^n0*KemR91 zvk02hqn3=$s(CJo2_?cAMo#sh{KcZ6zPeFPVFjtXBA$a8Z;yQabM~T_5<)T2cj#KI zuzV>dD~MD?eurRRxuSbC=lX>oxF1>|D+Lo9)l3|gTyvQox?qOA>aZ>^iv4m4bQHcM z+T)Iq0>74$AfCrhCypa!i5^j@6Nqt=$R$%8)Dj-tb6=my2}b}zo7Eh#SN0Iv&J4py z;j4xw4vQ-xIZW+%1|HIHU*_kU0MUl`eJgGJ2TNpR_Cf2j%mEv$Vd>9e+Wwf~n`|Cd z+yoAPr@jK%Nrz>s9H9i$CP46k=qnx^PPnx>FUg)7(GVIHGUWuPSa!!LeV(cyw{f4fR;mav`}vf(*WqK@R_75RolxS8*v76 zVj3DaBX%lv%sljpqw*X|CUbNgR`*bi(? zYFR4yij(|!bOWA)K<^d}ms?L!VqlAsztXwxf7!u%z9yAH!-CP-d#e7oF4!g2wd^gn z_Aw03JU*5@xJ)*zggQxaw59SGcq#%Lm%C~xF3A9N%a!h(EWq70HV~7OG1}arf2J zDlS;O6KpR{Ao*B|>}1X^jYoD##b!K9ggcSnIB~zNqJw&MB9KI0_btg4jFpkWk z$a4eR2uU4zu26iIPGfB1H-0MXQnhdx)^xvSDE=g!VJCI;cjoD9OFFreW*cqkWveQb zZj7Tq7I_XEH&&lvXNekne%0TtAQq=qeStEnk=^o#{aS83>?~&}m7^mS7fyS!o1!}}3}m5hvvj?HCzh5$RD60lhkWJQWuMl&vzu8tiCV4d z9Jq+Y$oV`@1D4IpU3#Ci|A5IacSoLqP5}^!83Ie->TBKfA6&BcCbqZVnb(;I4L$wz zkA_rfa^UI!RNgG!r~BT~KybiS0pUyN8|7BJ)ANmJ9u`9AotpEImg6=(;P7;|1$2j* zT|YDQZ|f+pD z#>f_AXI!?+UaZ4b7TURjBWgG)bDSJ27xLuBu@0m!wq<{-hcnXqWlRSnMDq!7 zRuK5|$b9-O>QqnC8l{ZZEYp@eQ&g{dD=r2lEmoezVdp66e9W?`;wf*!GESB;U}+6= zEVk3XC_gw?(q%Qmt()Z^f`0}nRYCSEsmP|E^3OF>FLT&&F>^W ztDViR!>cI;4fM|7k1KDK$_>ymt;%Z#GzI&)#!YNE3%1=r_OQGQz(e+p&cS5nm#sJk za9j+3kXu8v4e?ewfot(wMh?&u%yvJdyuG`7==;Xo4fw4!lJm+uA4c?wSFIg@=?u`8 z1{l~o0D{*9;GzQI5xn=^$cB}>Kz0$YMsjUu=hzpQm2O~4@Si?Ez*8M~Yia}ie)nFc zUc8|HKc)l_Ka`C3=B?lX?HzOKuP&11SzFBN&J{B9qhONf^C=`fAA=0fc)NdSo|hl* z{5h3n{;q-GY}sAQ$x^rGs~_d70Ios>jMHkYPyK;L{X3B(?V1OeZn7wF@L{jH77vIz z=_^BY1v7y;1_mQR9~OBfV`nXUss#cT?aHqP&r0Won2V7^mc8Q2L0Ob?DtEm&EzHtL z?P9cO#hZ;H4Bjbr%0m|X#PC*6gEW}JP>yg1b?vJG^=x?4+; zGOpB7S)Ju-6h$XWhZ-cO@Ff!uBd1JD#81zYu=wurCywWp0Zi;;>&nYsQS*%^1QVU$ zDPZ7|0-qp;)uK=#QZPSQK!b!5iP9emj#>4?f%SFgOy|z)THD=yuNOU2`6Q9As1RBI zvzW4r@tlW?Pa0r?=lI7|AB^nti~apfY!nf)rq=RX~2LoWDh2t z<5Kwog%&1`F{eliG5pT`sfUsKm_odna<8riR89%sgs|S$UBeZ6#S(5N9dnI)#952z zPhu$6s@X@8@^GWj{C>A9Rrga*NPfvQwIS*1 zjC~KR1BmN5z|cxSH)4Ml#DveZ(it^ z4$nN*a(ZmMa}BzrsZbC)tnUZ zT{cgh624}7*Q(4;ky`a7-?L3uhy#+t=N=i7i8IqbvTXM`|0aEg{W?6XJ@5uxO>@gE zEiKREVmt$@eO`|6*=>D+8_Fth<_7bW#4}rAFkQOYZ*#A4}gp!!TN!t!c)L? z>|sB9Z$@eS{C5~Ehr=ni2Nu@B?Kb41AjT{8uc-9w)Nyx2N}J=dm6`Fg$F~?iS2FQD zQT$QrxDl#u|GJ^rObp4fcMw4G&CuEloo_{jpv`I|T_k{tb`(zX$&Ud}xWxb1>sqj;iaU`~&H8ygU0fc(rVD6^ ze)GR1qC`-s6@!_^0&nm7CW1Q*^QpZlp5$#=Eu>d`_k*(PGtU_1TiKsO1DX1SKwm~j zN`>xB!^Zh1eCuHLwH1e#^{+jpSz*XvdO;+8FFZtn!7;}G6R8&ly z-L?FCeY#i!l5Tnd2)|U_;?7K|68HJr)`J~b{JL)FcmEyO`jI0#*&O}*5TVFGta(9z2W^i zeKLJ=bD@Dnn@<9z^>yS*{U?ihZJ{~P5XULxM8(iHuF=5uW0v`Q;~t>QLJU>m=ber` zC=WMrwCi~3eZi?;QGiW!@-sI%S2DTC@rj3dyx_1QN_9&+-fZ=j!!VF}^x*b!@)G+4 zL^wa$#F>BPiu>oRY#docGMh>TT=&=Orw;Zel50h|>YR8}^J|WI#__7Jfz4p0L|L|? zl;ZC%1fnz&TY~{pXJT`^nE(-D)f)SVm>#B2L#TZJqGdocpcch{;_n^tRp1n3r5~?T zWG(wX986q3z!G6#uI9d3!{vJe zSm1r_xCJqv4B!tLg6HCjHMIGB$9b}3Q>?#f#`C~T@;7MqYD!I%e91P>R;7ntj~XDO z0-2gOC|%MNI6|M^GM1rjfl3XdrV;{aMi?MyvCXWSI=B*XS6I-5aI=u#BAN0W zWZkAgNwXVhc*w1SAoUlnRRVM<6rpnt0N^Q@zV}fsz&m;R@cRtKYZbvhjf|da6dC*) z+^9)}tPSoBxIY2&_or1|&Kjx|i)R_1NSsi~`Dm2O)Zrh}u0CcPEU_MZ;-7C+iAi=^ z2+Km&O+chGRPbY~oQo=nKfXR#)NMpv%;lDS*N{!#Z9^i?a(Dyp!vNt{cIU4^G4LKx zt`+H4f3yVz7Vo?-uzl?2S>EOR^W+Ych+n09dW#hRWpB)yab!$kK0X<8Y`DAJ{d2+mjdQGm--zH6Hv|79qr;aVZ+9k%Fhyzn0 zL#ltFd&gwaYdvZ}b8~Yo?mR)RcgSCyUH^b{JUGi2>4Dhhx z_|JzQA7R{@V${*EPGRIuO}2-r;a(ansPQw${@%HZGmv45IoYS1)J28Lm#dny&THuE z7FZ|gc7@paGX-0WemaqbHQHzR0Z+g>H@En=p;Vbl1f}HXwuyMSjAgQMMOD?bI5ehM z_D$&=T1ENP5l%%!OS+mWn}%-2*ZL+~!)`cd?~WMF0B-Bbrs+7>kjkg?1^vBZJDXC%37(oZ%p; zc(U&=NWf~Kp~q`KBmS`Vx#368&2HodX1uHZui8!_y~eb(EF)8gk49AA6%9;HVH5rk zi5@g6Rq5)PE*bBn<-1m3HeLmuoRE`zhN}T8;bBcd@$G#-Vtr~%Rnj{g){W~8TqnYXrkDBb5lUdfgr| zPSL%vclNGl%*1!%d8$cif&KkXbh=6umq~PVV-EUNxH`#T@Xu29vEzy@FMgC;`jhR! z&0a8pB4CHdiA23@An3Mv-!roVrkdWw3#p({yf!T<&zX)9=s(-vP)r!No z0TMxK7}?KIH_W5d<@0+7yz3`QkK|k1>jMEa=2o1Dt;nJ&)I;p2il+P`CJFuZwHKN| zhEQx4)x|MHjn3d7f<>CU6L}x;)1*QNKE4;Jh1j{9!k#r<@B$IT1V|@(eLHobqD?wS z_?&4OkBNxECYuAisC3nI3@Rwc#W~P?ePB8thT$K5I{Q1APdaYE@=DZ zfK}Iyj{Nb_uOlJ?f1wNe8R77K*y%{s-_nkmd>wYQV?9m%syGH77N$Y!z;`;zsbckA9+&O*%p&*(z#`l3{C+P8 zH>vfZpS{;9^ot8PCL-;6$r-{Waf(e%)3T#fn@AI;-$~2#qmS}CI?-;6NTtYA2lqjml`R=3 zxEkI5+QXBuS|3LF+KEt#ysj8BX=PuFVXJHP*&!L}7U(Kr^w+Y^g~`B~IjUfGw}?*& zhL(oJ3mdwn3T9FjQ~VmsOUL{ms5KBn>R?5<<;ar#aB+NC3ozXtAKmmYnZ%|$9k^2k z#%W1M2X5WxcsCldp2PX+|N%n6u z0u}L%M&tUiwNI^fCMKF%6nGCrkr`MSby3R;)d!RLks3*hjzvKml~o?n&$S<}J!Xd# zVo`7)wAbSHST-+)6NN;id8ifxf41(Zy)f)*S0vZJ@~GX`cQL$+!F8#@28qFbeDS^} zC{ea1)9-Y#;;Rip-v;tXKCQ_kegwKp1L+G%69S?<& zWRKDc3F!wp(gq}DOPKi+@0Zq-j?Hv|=R70|xr^7DDutpA5^mRe-&HGjbf;+NUXT!F zuV-EPb?}{2eW#$lgw!y*Vh2)DR>%qAD3?<7(fO}QjnEWv4y@iMj4vkM;n>6&R6V;l zZGC0IJL1B@bbI~J(1w}kQBLi2!{o@y(Ka9&*HLDK(DACf28__?+KxeePvDdLh3qbr z7SQ;^tpr@*8Y^pN8-|scvr}Qiq;VD8{uE}asTRK=+ z`!u{ruzcX{dETJL^&F$8Vbo}{e!rC=NL)&KL`x1qde7H*f2h_402Mr+w+Yv8UICS1 zU0vNe8#G-2D?sDNEV8V;h70?@QU`>q7iAHqb{(BsA;KcS~Ml;L9yY zKyuUElZ&TKH6uF>&cf(=t>kvC0th{s5RXjMOqm8fsR{gd4CUB$@|oSx%`NR`j(7UE zY*+t;Z*o&-cYv|3vmXdR1Z2U_ht;oCZ@MElKxFB*74{8CI^=#n?|o}SD*coNv#|}N zbUhotUG4xl)}N2a+(4bX`<7xi#_=Y1ty$2ag(L6_I^~=N>a#azYfnmQ|YSgxgQXbW_9tFvu8JGugWSI_lNwj@GV@ zyB_xtaXvZ2)5`+y-Vc0Cew)h(d!|Ks7FFiKG@_nM_wYEcFf!pGdXU-q8VF=)hP_{6-%0tCl^ z_2<#`ok=l5;C?_#^1O#M^6h_GfH&mhiE{=Z%)Yva@yP_FU?wIe_m%69v{THxOAQv< z&9;6wH%@C;*?02Q^AhoaMMYoVc#l)eU&kGilati}rP*5)CLmOHY}0vrEs)1G2r%p3 z0ycsE^cmMwHF)vM+dl#2%OY)zV!!{I8HJ&}Qw=f!8mbmbr2NkE_XAn2*cJQr+(QLI z6t&QA{r)f+J_0C+$HShj5wURj;pqqYmK1e+iN=Uw(fp|CK;7{DUEZG;F3pg&K_5fO z)KrtA;|Mh7Pj-kp9C?n(tj0dDRq3QHcCci2_fr%Lcsey=a2^u({jiqj;(rM_Qv<|L zC5IVpQNP3%8o+2m3x7m2Ty`q#%+<^`MF_{9>=7&pXx&=>pf3>NS>ErVNMMWbm(T%1IscbjdA?U3kXvu4ya`U>c@5^D>`Vh%DsP*ON zx9GIB12*oZDnmt>$>BWhre0Iok<-L|&48~hPhp@hUGo&AM}xtQpxC%?mbPDeRioPR zV6HVpmp=42hZuTw7+)%2F&>&<1oVHVZ~r~t_3A|6eQyA82VbL$3c=)%secUH&W}~+uZ9t$K z#u?9B=<*wN7Fch9h#OEz-vc{Z@7vA>01pK^bOAhJ0w8}^lH=(g2l%3wMf6@_z!qS) z@!M~C?SHF?KMdT0()5$<(?<cLSr{iGAUd* z5ifxt{C-s0->UY)o)V?bA>&lJ*%U+=(`y?M+&N|yq^Sma%n;;o2(8P+CPWunTENhu zdXnVZrynp_HS)3aKi~HmT2d%yV(MAmO2wn?#{Gt>0da>D#?r%m7bzODMJC|))ZOv^ zO2vbxx1$|I6iwuB7Cr6BKphUzF0_N1%ne)#P#>&QC+5JV3CDqx)Zq6FeW4qfN`+PZ zlu$TH0q909z&eUMF}PuwP!vl)yTuIhFMsDDfM~Zg0#HOs2S1-`p_sr6`CCBsiM}Tu zr8Mf@M$9IP6W4gZEroWHpW^8zioQq@OZp>h$;iYu6z!=rl?X~n(~IJJ3C2x$U^8!k zrZkR=wbZ56RvskON&dpFQk;VnT97hOnYn`Kz)MPryA*iU{@4Bl)ep-Sd^HA zc5v@UoG^v?pU%wVqpkPL|(_e>+ z+yd24%^qgK)2JhVx%EJS#Peyh!Z+SRHBtp5B4NvjKLBZEUPhi7it&Rkh7z~jVS!@P zd`U3vCsjn4uRalT8npK2c=YNo-RNDwY{VPLjZOmuDmu?=XDqzW}>CRXh?bNx=KyV>69am5d`N#95urz2OMbk012tO31oWh2-- zI*6OdTs0J@^X6U;HBasO408H%JI(bxSNa9(8%xCpnM!RuiM((N=?g_%S!($Ws7h-SOXZ_mwJ zDC)Ny&$p1z)6OSrAe0c03;Xzjg9ivaA_4me&=-dzehU`|9u^}_$n)IZMHIt-k2cMk z`1t@~`y(&NZu!X07Q3fySh~8uZ&SD&w+5kL-XIk;aR5R|Yy^rWG`-3URPfA_5lg(9 z@C8KB5DsPv^|KtD2zvhqK@?)>cB%6@)OYAmlZtL?3ZK&`);PKShvoCIjbptBm1(+N zXF%K=QbER)y4crxv-vaUJ0*5P<>s|+VuJXeCAMM^gJ*^sD$daMmp zn1#W_$UBBZm0v+(3&!LKP&Xhn?r@183b7*`{@`2*^ARE8bC9CZkj|F`)4=%55~83a z?Z^RGAqFSLQE)s_Ji?wt-}~D2ZhyJJ4QM?S=EC~FNR^mtoHLv?e(%>~O9H>Fhl-JR z&nT3aw2HUG8bf*3P9nfV;W^ZVyGy>%PzL6IOr8NLs`cVQhn3oH;ob#Ad{h|VWXcs~ z2rF8d4C;y1n^2tbWs|h6B68_#pEwNXpk_UT#D>MHcV~3th>^`e8>oCBK!)+$GQ^9R z6v@wb#AlYP2`9vz0O$7$Ko`sj>CTj`1MzXxK_8ltrk!!X9R7g;68V|_spnqs!W zD`bg|B2nEaFmxqr?2Jl9a^b0jC)zD?d@sxZ#22vhJb!vCn%?X{KwftDJ_qkOs>18K zl1z4c`cz5kJW3%Ow2C;@!E8$G2tB{zuBy31b&lQff%j{~zXS9jJMD}2ujAjGn`?GU zTeUI}-;?(jwjI&_`^Q75Qq_F! z=es9w&yHKv4!<%?Y-HDtZ+F>!pPaDOOYlrAR+hL)%|6V~Hpb^BX%#SinDK<(52T4G zg;Y?eGVL9r)xoc93H`+StzU*zi^S42CyF@vaWDi0dGM2HynMD?4HXs0FML?p=N%}LN&yTw`u6tm zfZ+o-3Z_95aUUOGz!hj#{;H{YOAY2?KX4!SSnC}dLmG%7H2wGb($v8B74qLsXbnpz zhu|O>MwM;O?J(``DrVYlUzs{@~1)}X6F(}|IO8CPQ;priX#!L>~|HZ`1qc*w>krg$oCGXET|Oq z(~%yd?ZYoSvu*5lwf1ClQ!)Z7gh!$co_xCaVzWc)R&y95EI4ubzN6nob2wbr*&?W< zJG{MtnX&r|`8jimbE-@SO^^J8+|qrC;C>8*;1LZm0)#aBA%oHltIudyNA-ea?G(KC zaSsvZrILS{-utWhyY?|SMxlq#u-WPT5ahQW6Y(25v~|^X&Wz^;`6_SGLEc=Z+h$f)d+1UE6Myb0L@8I45o{J(1)TU>bdafTE+$J$Ff3_g}T z=8N#T*Si=P_<47Yzs1b9t(usdhXM07irTq+T9s@?R4kNzZ04px1Oc z-{|f>OOgx%d>6htbOUpmKpt{*_mS7rZHF~ZgQnGan}fCd8duPN3-0?)xS)uVqSYUU zP?_xR9T;D&HxlZDmRkgiawdn;GlAp8vtUfMPN$@b+;PSroqA!9e2qeFys4z=ke&8e zgQNtk?cyEeo*;?L}s3$*)V=M3)6~tnDhrW6J%K= zIJeT>plbU-ktZ_+Wm^va=)f8>z(bXPK+NZudgDnsx^zz1)@-tYYh)}V(Ij9sgyPl zU-l5N>zsaB!^R%q;&Hnf<2F{4WN0m{!Kl$`f7e~w(a6CUDvAd#Qwy3c;Z{~g5(~{s z+t=mE>6n6RAMvhssv18mK8k3ImCgoEtoAmPXB1{xE34mp7@Md=S9Zq>jAHc~W%uC} z!m@z+oW8HD^D#sDz|u1QSUbQvB+3G42xs@0o|wrXNmg?9Cp92dTI`n`Ld{MXTNnq) zq!q7PZaNTl%tzHY-*8K?_1|N4w)OWr_?ye2D-wggvUwGg@7J26ueSS+a8>A7+gVrp z(e#!Ory!Ja&dm{Pb@BJB+RfsoR4ES?TQE1V!s9xu7PHUMX9t|{jw!=&m1}ppCcRoh z=LCVAH$0g4ux;JYn>u7Cc<0Awo0%7X5*k)C*AiGzYd22`v(d+!L7SFU=w=rhc}TO8 zFD|Zin?-G)xm(PeUE?*&7wtB2c$fsk0|x%Uwg`x;sb@-LiT5A_p66kP;KQO`B%ABok&YSUWm z>RZ9D_4(PNv;L@5EMjv~LjfU$l1$KeA9&?Tzb3n*ZKErEhHQ2G%z<@}*O!;ho+?oj z@N_(+y-Hc4;*l}Cb&x(+K9`=47dMH_+e7H64Lr68rTK;!e#Ma> zVNix=I-ou1dswGkIp6GBtdq zb&e|5>N5JeX`^a4NC*hb77!ln$V;Ne=?P@{BR4CTgK#L55J>a_{|b z<=HJ7(EbEBsRR{><|WtiPKlXiHjmx$UoVg|?DJE}zEshWMlnf&WmaHETGq8sx^#jxFy-uTy{IMt*D$tbib`pmxL z6oL)DZW6Aa=qMU=lQuDP*7RRk_cavZ)Xb7vWr4|CT0U%Ow zVvn%Cy46i1zpjc;hmulMA3=UDXXU4t!7X3Zt@fqWPBNTjWIHY|CBu=2+fvFVz3#;j zEUd;`q7wg>ZQidP%2Y2NyZiS%_r>b#tPZ7#2QEHxNwq3gx3}XCEQB&>U?Po@*=WTc zRyG=RY%g+|uPelr=GvNbZ66$;aEd=%K!#0u!S`NgXaCNOemxaL{^#7%>XR8dWe9g> zyNVKKv(BY#AEj9nR>-2z{0`*MDWtS8xavUY6c_w$o}VnvKy#z~Wrw1XP}d(eB0#;q z2#*_LRn)tgzY&z4WcG4IHA zIDGNG`)hTYDZ|d0a$a{Q7w2JY-7__wbdqiA-7|Fz``Gepq6WMoV3Zn4RncH1ePqd_ zi~WJQtmk1g(&zPr_H}JY<8)ceP3h!etcdR4u~x=Pm%M@9@Wp3j*}Cb^$61l%$L<44 zEhO9SW)A!=gGOufBEP;*T3^Oj0(b9n77f}6?_p#9*g1VO zvgx(6W-7>`*5g{<+aADOx#Rr5n$9w+t)N@OEl@~tZ*X^a3tHTzNP!l2m*P@fLXcvm zxRp}e9ZGO_cXxLSH{ZSY%fGCgv$8U0W@pd4_dKuk!%1E`Q((aF9w$FvaL3I*e2(&K zA@9o3qO)}KYSa1CcNsW;G3#4`9>Oh3KB#Lm>)dx_FK;rO*`EKKENeJB_8Am^=|z6M zPXrIov8}LH&Ook6KPi-=i@{CJuW$WmrrnEb>CIeO@ls5q4Ws2Vk0bn}hzWx?)T8rzI-Hj|}k57oV8RFZDE z0G+&EH7rn}x}0 z^K)Qgd`TzxM-plsQtf=BE;gVY8xNNoa)L&jR~g@p&;6Hcc+#5xzNIb&o7?r9o|)-w zW)7FArb{y=6^E%aM&UoroOSq?oh1=P+O*YW|>6xD?XjP1<*-RHlCCNlS-1$xTo*-NnVQc?MzIL zLV=ggg=7?h@@IS`G-5O5neGd={(Srhbje8O^*oI>-8b1mpQ7lJ+0^-l=DseK8EAXT1MDPb>+h!MKQg{DV(k8#yLGnMJA59i1asmvp%7 zjdT53LxzswC+*)D6r*9If+ZcK{P-tE{P1l-m-WJR7&*qpxs;JaO#j{ebQL-|ei0;-(7U2bC7IQEepK^@^e$CEpJ z-nddB7ZsLlp|Jj)rK|JwX$=}HcoPpaIjilWY;8`stjKn7br#M&O5Uru6B0D@9)l6D zdDV5HV9mLxdL8J;>GxcoPY?&*`{A82MG6g1v!Ym$TFvp?s_Of}5j?DFMyD>u>?U

FB#=>|hSVy!oy-`a7OOF6Q5@#*o&{Gtl6{`WaV4=niM9baLkumZl4 zE4*C<$f9S*IZCZF{^OY#{Nem?>wPmYrYh1UGHRBQX5xFecBn*;9xj?Gl3D)KAKThX zqW5~$jF0B5dP=``BBP3p6sxj3J3|1yz;2;w;!DPjP-}99+^E4;LdguONWz0?T;BQM z44I?MNYk?TcK}Tp<-$s_Uw<~yDXD%FX%sHl=l7cYkxCGg1=nhX|A{ci?VLyLrLRKA zK#KBqmQjxR#=lDmHWsh?5QQQ$fKka<+S2%JvBEn;3{R@zZx2xN{R_^SnTzA-v=5OYwpMy-4pU3otv zDf+MUdsb^+yPu}*Rm5L1CKxg4E{x@9@sCvYcf6I0w-JC4rr_?})ev)yOoM#J46b0s za9i?Zi2tWN!Y!`Z3470RY-fI-_rMFms-I9*J4oj*)ZWH@m_2@i*Syy5c&%(Sg>w`O z>o`BNi_$wb)~Q*-O^5nmU`X?y(PNo&;=E|reJw6bvxqBg^So$tBShRsAi}6#j0(0H zXK#Ej%6kKlF2D<24{yrO=3=?^eaYz>FED7TgsG2^`FZ&zF=K7Gu`%uH#*OS&O@CG- ztFYJ$+iNc?)G6caT#lnw5PnuNJKN^!zK1;iz3x%aSr}cn_ROa+74_K z=@RG}sIF@@d~3A_b%j;E0;pfS$6~eU_hOj-x@C~wTAlI(W&Xgs-Q#!HjAbuFEZ;r2 z#=%GEQ-*Wf!CGTgMM#eGm=v^=sBcxFPyAs~SZ)v3!zZZ2*EMCNeD7Lz@Zlup%<$mi zF3>cE=ZMM3rzwouZ+#z$0(3e0qtfyBHFx0()^*#ZCwYdY$>e3r*l}gx;AZJL!S z)1nKU8rMS6*qV9Oy~B=0QGB&O(J&`Q7pt}MKJc=Qu#ELQ3~TiA_=enSP7^lgRC)zf z9PIEf9%vyf`P18lX0_gsy}DUqwaBU>Ldbx=);_&uB-W&In%p70wsHD^s`lj|!DlD2 zkGR#jZ45r96fH%aMetvk-QL_=Z0Aodd_GD_{|rBN{(m*cH>=i&L}9TdmN^Jp>Auwv1vUt8D8seGx+YY z<<(1(^wUM`9X$0`^!JX3*0#Doig$|kozYwC1Foch+(VT(&Myz#K+o-WHI+_GKag)G z5WeV{Lo8dLp?8h$56qdYR%4Smh*UyO zVbiIG@Uo*J(8aaqf_=k6O=WkKXGcUE8qXipuY9{Z7_oJbAzn}6d*d`~<*Lfc$SR`f zs8jpVNt@Hk>N=SeZ`*q4s=u#-Z8_!0@BNRX4{jV+gJ~AAYyMbiXKwrbIEI>#eBzh7 zgPUKVr{|j5UtgqtxxI!kd|qwke zlPHNUkI6Ny_s4hp1zC6Sq48X zuV=l2uYb8w$6z7LoY&bCh2`1myGt)ZLU9AB!3R5CY!$Da=_~8HUKH_XK+O$BM`L?8 zfTGQcMu|N7zr6s#YRgmW!#;zFslLMktWWf8S9mEE?TZ`#>}$sxCjWg@(mwqKValY( z?HcQ7fl`QeghZaZ-Kn|yGwijY{Po+@j9Bw?O@E_2x7u2_3;=n|A&L90(Y{`QiMK&&!n3{SXh||NnwsgVq(I6^>Bq9N~P8u z5xwr9?0Lb>l+gw|e0`fOitk+xrIWMX|wNd>KAx)YeYHi#mMwn@VitdVk^ju4W$A1_U>ZA;hN= zWx=ks*LBj4t7}Y-vfGD3tl`N+7PN0&h-X=wO*>*dd_ypszKyg{r!U8s*&yB#kGZQv zPl45o`F#qM|8`uZOQeNMgYQ8sn35CYdy`>qpo=oC;|1TJUm46S{4+(cD8i{BF?{I4zU~3B908RfZv@g9GP3?zNfJd)O?n= z?=1W+!c<%O&^Q9HJa@HM?}8$Vr&-pYCTt_9)RtPWkEdFFHi#WPA$f=M2E*lLwfwVh zbM9fEq_E-G8onCKtCPtJ*u@{obb!qUee9>JIY0DXHICWS`??);#(y}r;zZ;f7Nsh6F4kwN^ z-&2`e*t8r|;!U)y?`7|$Mf+2x);d|;gG_lvIhW`5xX7L4-N)!`LCw9~5RK`>tOwNB z7Y4%pok72@>dEWpZBdMFz}c$7&b(9@Yxn0NsTc!CTBxWmE-^t@?m}o;mQ}sw!w%Mn zTU*+dr`qT#u89u~$SbE8o}vs-qjx+O%lLiQ5$6;zDHh5#4cqc%;e85%)bGXSo$i(2 zlXV6x`xKSifii%}H-; zNpc4D^~UTxkS3cv|Y}To3in{!_VnLz<<)i7=NAtE)zE zdizvF_Ii&8W)*Nd{rcxTA^#h@;|{2@Ls4DO`;V$=Xx!S$n;g?Hx!76nduNC*A+x=^ zsBXR4*X7saZS*u<`1puF&XcF4XNB;@-ckJ3_y!gCGRM-=?jm!0KW2CYcdjCS-H2ME zE_pGF`~M=8msb4dnl;z32CsxE>D{s~Me=~ZyMh0)bV%FNZ7!9Zc76*zbT|vSZ_S^A zB|YnoLR7v-n@bjr8kb1+%_+zuW@t`V=;gJ+lfKi1?!f=mVz(SVRGP*(W_K z#i}%cAi9z@j9_DDGh|Hcej5-LN1p9>*@@Hsv|dSVPC-`B3h~kB8L>>H1f0@Jm@<8z z4`Rkw_nq-g6WeBq7v)JQvNC7+{q#aai5(R2w{%!~!~fwW^#)`2cQ5dG9FbJkmNkRc!-j~u7#JF!T+nkw|e@BeWRezUBQ9%X5JcifH$8f zbs(;uh>YCoY#&LtCDgy{5594XQY%B(*$YhE#4><@U}Q6ttXY50QK7iNa(7a&sCncD zOKjV?NLBv9mdGqWF*N@A+TwshzRDNh(%$daYLtyQh0bJWi*sAX&!2R-M`rLgr@n8+ zbAJoA+Hy#hh-TNN^M*%^dinvP4<>-3$na-z2dF;wd&(5~2@y_JIf|zg! z8m)s_;ID)Qn_JarkiJi3qP*L|V8-iX0mXuiO15PYN8$)Z!tgb2lpKzUoq7Q+e*{6Q zp%Ydr`xmNYd9I&hcn~@4Ud>!lCTvDhhT-XH))sW0W{)=AP+m zQmZ0u=mfT?|3^j>EThmsXs+l-qkxRHrx5Y(=Y2WlVIz8C7eAA~;0Tn^evIoM6l5kZ z=RYqxNsF(6vhNM2I)Nehw{I-{d@_p0va56i*LzXi(Bm+#*ljcc29-u>S-aPzigHih z-3YJe|Hk=Hjt0!rfa!Vpo;I_JetY@pj0bw1EmcRM*r7BE^u2u#n?n|Gss|UpkfL<& zvETXzQHcAy5JWS->xrl1Gm0M+gEh`qe`nsBnZ=Z<8aSJ62yacH(Iygo(!)jl_Rzif zdJOjwT;Eb_m*Xbhb77PcOgq0T_3pD*Pv8tvIBg}+GH;<<;D4{U^I=%3`i zg!?oVlAnJqOo4)#G_v{a*b>dJ0o^lA1`rf6T0j z#Fh37|7U#pVNFpEo3`sm?)1``5rvOP_^0i? zw*`c=Qex|JKjQb#0;E~6gm9!y7xtnigGJmq>$QajvE$hV(<6_2t3a@UB zWK56wq2r#m>))%1)4O{g0B_4%1SG(D9VHjQKv2GfY-M%T%*_F9>?SiFA{)srr1N=- zb_L$f8@83molbJ(-pa2k|K%qpmA!^XYl~XZ0)0wkO-D=L!U2=w zudgqhGx72c3|3R$%uL5Kxyf(weJU+4t!!$NY?~-puwT@rltg_irCBnkXJoXszaQ@l z1|OfCY%zXw5hx3jlJ7bkG!tui39bA@O72jj&`w9 z#6tzfq?}#-x+ey3w5GH&W^C;VQN0#(R2oVwM2ve(6QCYJsbksa_XlRtJ)29ygPuIr~bMvO?wmqdLGbmc3}Jr6cfWdiS(Put_? zKLX!!WQ%pqum_%Fy?&S7i4kZKso!HqpPc_TqhHh3q_oo-o)pdyN8ze(x2SMq*xZ4< zGezB3L?8wm^&}$Swo%RQk6?<6RB;%~ zVHxIu{jI4{N8v$)APd=*IP58K>maf3m?9fj>GzAM1Dq;S0(m{I8N0tO@>G|tYH|C% z_bsre@TP!p+`dlF_vKetrl`)>a*6qi_vGxij4CvtroL|JkQv>(;q>nmf167f(p%)a{_NAQU>|-P_meeZI~#Qh$`bKJSHV(5?9R82+&81mT)K zbM|pc&?|k4xX=7a#ReoH+4BjA*KF#yDOP1PB`ZmooU@YRB{zdDYF~cD^K)@}zav+j6%oO0Ljq|Srp^V+>bw^~bVuK6ZZ zli;nizul`-JDxlP)6MC7K6j1V>rt2#gKBkvq}Wulmh?Z< z+t3#`a`fv}o8QRl={HOak0@)E)Cq|#T6vlO3<~;cAYl{KY1x2EWa;CP1v#M^E!i6$ zR>nnpU|(}r`IEztY-Z~kJbCaw!5V97YRYMEEgK(k*s#4DuB`~pi<{eFDQIFB?XK~7!XorR=LGo8yDx55L;5}_wwrP>XIZ1 zOZs(?=7Jg~I;x2A`?pn;%*R=PQaeOd@y`5b2C3!iIW|Eomne^kt{fV+PDDwaM6qBh zhf1}tmvk9@+OLdmmuDc8S?LDeFK5Bw5d(pN9ptE@$;e2vl`;+B*af7FG`x=^fjo3$ zL$cs-opFvh(#AK(EM7W8u)&daJasHlxyV_Hs%5vGaAn;D{rWoYe1l=l!qk?S2ondQ z=jrB9sk)9_i^(JUEivl-$a()8eZ4zJyS;aV^0oZkrd;LhhI9ggvdn+g6M%|Kj6CYV z_hh7#4=$^(j?oDdHk`p;_yI1`^9^X?3#CsMSuR9w=uP`hW080tg3(P&EjVHBE zGaXCLl=YOii4S*+!)Pv2D3~P#2WDS4_|&BV8#P~dC87K$KqfhQ>cknGvGV3^fXp*A zW5o#8S4KS!_a>(!TPyplRUzPvBb^aB6U-cRgmN8Oj#fR9WXDF$EG?KWk(_*rGi zW1n}w{`cf;=$1yFB4w?tQi=EvX4f>;$AjK;-!xr zE$vdUr^VCKgE;$b_Ug}^NDi%P_eEV2rfeg?!Ou#6zm{cM1eYKRPZz-kU3L+w+`Opy zCpl-Lbjt^GLXTALeo=0%N>2ex9jL2S+z`J3pz7pajWr?KWIt`&_?XO+@h z1d!&x6$TXIP$Ty`ul_NXPKv~%Kh#qxF0(Fptpi{1CO1a_!r;?`e?SKl%7LbN>aHpys zl%#TEs_ROFeRg7MrkMRdew4SsD5|afVw&4hs1mU?$wem6DIsR3#I*&+tNV8)EJzi0 zTD!0!O23fJkPgTfwfpg#c6LIyNgiL0K?cOue}`cV+UnCI3Z>!fU6(%xrFOM(Uu2=D zxs#4H%8SeXH2|Z%opFU|)=9pOe=qd3g(TsIbQ1IX=6s38jBZrT$PFqjjP;!d(l1DQ zqDKR$r*}*JWSeaJFQOnWzpE+wA1rX6k?{a@tGdg61_*jH34d(1b zdHVNZNf3ie9xn*?I#DQYt^POS5yE2kUXO&A<*y;xHEeVU3Wb_-EHc#O7b?xQGx;Rg zq3Vj?_gvh+7BVDOq6m>eaG`T=BGlVOe9QFvW`2EQj^boTfKZv!^uYvtS+1a++$|Lv1HAjA4-Tj0_g^_#l)<5PmDu1;&!#32QGy+Dvdc0 zob|p5l{FRQVN?hzQeldXcMWpG*C{Onn89}bYid1{1soF zOr;~+gTzWi37~U^ib%ovT?p9$aIq}WZ88nLSbEw64&`=olb{f59m|gx6RM~qA{sTo zBiLF%kX|GLu@F35f<;P8%knb>Ul2e48}q+$f`;*yR#dp&4Ow7D(^WT-n@%ulhVUZi z77(a^s_z&RK|_#7MRyp+6X8vx4EVEvAoMr|LJFx;`k@NO_`>^($^ot z(cU_AyNc6fAL~x-n4ev+ldp)h=uqQ+Cx(^XnzLZbwY(JfZ=E^lqOMIde13)5d2gr% z-y>Gu!u6WgOx`5K1$`dCG-dK|`X!59bYs61I^GSSVrqG|m7pxh(PVb z^detPd}p9$E;JMAA&4}~qbyVc=&NJ8xZLC)(E`R=Sm59m=2oO7tN4}8p^z0&0?KQe+EGwUy>k;|U@3Fe@MTrW#*8AfAZ9|9N z?g$L02`2fYs=}7xRTw}8H??alS7IfsdFTtkS@vIhPzkZ3WPNv6Ptpy=Rr}~PywT~H zxRw>o^%L`A!6#FH$yx7CUIwWwRuXl9f{oV3H=O0gB%n`#02Ld)p3v&VAI3fyF~APQ z?^CXf;hO~Pb-R!Eqmttzhttg?kBclwCO%K$5>aRj#s-R?znIo(!oB80l$jM+i8?50 z+RJQ8>95z%znkvF7&^sPUW#BruS5e&i!Qt$Vlp$?CgEvj|6pEH`WX;84Lna%6>6iHEB#7tAq$jYj&xe7OASE45J6=_2@3MqaQClIEK zuf}4|LzJ$oq`P(e5H3vxsu(%CAxMh;F|=*35q&1H+(!N~$J&PmiOQy~oNP<`zX+-TS0{?vvKHUgr| z$!@W6agvNmyaM&#;jHW(u!T;RSl@fO`Nh@T6<0PE(vET5V4ZyEiNQw4%Mkx8fhtROFG4b+b|AF5nsjK&v-QmR7*dRqj z6QCLw*A!@lGdGoyGR8=jnTzh#3`xLsphZrtn;Y}GxMYfw56vtiV;<4D6L`15uv(wa zcgn`$V#ti6VS<`&Am+3(d#D3GGB%G$wi?s(t_nsKIzDdA-6B?+YKUrM+)=N{tZ{dW z(l3)NnlUM<+>+A@;-rd4m@Cnk_v)FFW4SJXJNcZtd@bvkv3(@o^~fK*-29>%8ygvs zcigeiHV+2ce4CJRb@hX;^t1p^CjRI!5~yLzkKeBMAGV8>mbY&|95P@0F|VnV>8s1M z&PUQ@NlKcw+gmnhRjT_cgZeR7y>bheD)izC49RJ1=-GVnm1mH?c@CYlc}Vq1eU$C` zJ{wM<%y8euq7dLoKWgt38Tf*DWcidi0qhV-Uq|6_f$cC5!6u}l#bJ^hfv>K?e`p^1 z<~02RnR7T$0Ot;p;|nhsvf~RF*z3C86*CJrzAe2UP3xj!%|wdB1X{efq4)iqCVhnZ zAHEovM22_Orn7lq#rEIc@QkO{2>q>R?-_qf6(!r1q^c@d*0?Q)tk6ph*xJ}wVEqL8 zvB7v_32B?ed1>pq-q8f0_sWNk177v}T;@dtyJw;&s<@z3I|AHg;abEhAVTOjK9Lr= z>uYl$@VKU3GOH;k4|M|;T@V+f&K%*IUjw^{it7;;)XJ((s7JQ7(J+@AySx9CrZwGD@)2V* z%prwvu|J^@ML(+6yc+b3LtSn8;Fr>!S3Ba(v3riv|pDXz4G-=djJX~Q|#uE8;3fYy8I zq5(y@Ob1czW1*&*sULhtLzFjB$)|%DItwT}s5Nk3B!?T?HhPD2`f+IbGUiKo1H=QA ztW#^Qcubq#IIXI!}6#G?K-+R`qu8F#Rr~j|vO)K0Fbqs$qGjybU!R zlI!or*J`R9VH^qlNf9%isy=)Z*2INx!AxQ)NS4R&w~-s$gqkEzU}HQRz-otpbpM-r z{}>s*FaB5Y*5E!3yp9<3ZT*W;U{6hv603Ogm`zhK#by*8$07>}L|83rd2b@I59D7R zY$fWzzG)b$0YH}%K>@X2#kY8NtXD3jeWZezZFwMN=(2#kFOzy&hCl(&i)ZDENXTlw z?jpbJNJv0F*FSq&?gWK}B&pAzou2Y!;p`qP_(|s0*Y8#wI?kdiDj%W1lbWQDq!bia z*8|*2N<;QeXK!JU8Ujf0IXo}c<(TujJQwn8_mU`Et(NV}|PH5dK!b+h7zWC00={iJ~cQ zE7*m|Zn$jz;Nj5+ke=aoXFgwTT}RtbmQb|3k=0fHA*|GTJ>+g7*DJFJ<;ao4&BWl$9YoPTt+ zec{ipsMeS-Shl%;Ha3U{QsOH7P`au7tY;SJ86jozLD%eHWc zrcR9u?0+8S7w1T!n=X$&PYcU>MU^c>=_3xxOEpQ>NAaQj;r459@-BFbrDLGIaEk&bJ>M^H%;ICuvGODa zINK20GE%{C4mt~ec8*(o!t!(njOQ_AM!X4>$;wqQ)8v&A z6%R}-XAIy*Zdk-5yA)A%Tgbjn#EF2xajVeoJ?;Nb;yFp@S^~Jn^Tr4bdiKW08ea-9 zScn>BjwRq|m``@b@GG*TZ5o&zP%0!OZ0hG1EnnR$A?8H%r`O5yaj{dUM7Czed}9|w zkt|i3`#|o8_0o$}PMzFCD_melqF?+N*iNCO&JV2R>*xBVUo1^ax_kHx(wA1C#q|Jb zKE~y1K=b`vp~KU>7g;!uPfr?(>oyRn@9}{AgIbnPM{I<<6|U2+@>V|25Ak9c^UWgJ zSt$w(lfz?1Ju25Ym`j06pWeJdnNg6I{3MdnYj58ggN?gltHqSfBOoBhoj@hd>BZGT zEFwmQexitB757k`q%ELM^tnL(T~< zM7Gh@B1@`x;9ifM!JcUs8KTbKE09Y(jK%F{LClazccQi2BO^dz*Z|?>6!8r^1gl(z zgwSfe_uFk=n?O0KQ@Aep{2%kL*3N!Ca=I4w?b*iRpO{jD`}O9QKC!lT5Ex91I^j>? zzG?9#0_RuoC+?n|Azemok(k(9gDVCMYYSaTU4eyX8mkV0@BoxY456~SxTNW*s@0Ecf|)Bg-YG>ToHEaV@k-I=CCwb`GNawBw*N_4OL91*W#FB zoodxcN<<9p&tK6sbz0%7h!(>#osKloNHabmL7gVl#r%79{Jm~C?!{Riw=oRXbr}AL z`L*syOo#U;&K->PTXq7X)D!qTJT|pnAB(;`4KAWlaq5rT`=ZC75k|QdH3C=TDK0Xt~dfcDyTJ-i^@t^k3^Jy|Gw@j@cgjju2Wr>MXIln+blcu2> z@2zhxI|4HF^&Ph^NXg&}tQi@bx&pD{f0LA0U~66+KbR>NayJFxu#dpC?WkM`oBKO{ z#3cvM#-|5=Te7&QDh)@rVbdfFYmqNHwW0YT0<8;%3_oJd2g3O+ZY&z+*2UFNzdRpqjA|C?Xc*`IRIf7tDo@0paB44xbHQ zY5PJ#k`IC0B=GlXheDNyzsL$j4;*|R9b?IH=saflYYLLzef)VgK%H!An`e&3XtobK zs1~*w=)NXR1PGT8T}^vgUm;M6e$O}t zj7_z4ocP1F4tkl7LA^m6i+VBPDb_9TqOl(=+U?cWJ^*j0L6Nh_n_#Tb!ux(f1_?XS z^jtrf+DjTuFL-o)o@H30N{pe3ktROMCGfycPd7MDQH^4FA|fT-zFh9^Azsi{2bg)m zo{8$h`xIv4VVUIIqVEkqgpSM8T@>Vb>2GxA%XOP7z`uZ^?Nux{vSaR8aYNALYa4TA zOO0IqEM>AHr-+D)%cz-I0BHdtgOyA@szE4?3v>egtj#mC(%p}_btRD*-=eKjrAcqM zz)zMn)6&)tKtixh9Up2DIcSr%gA%7v1>CUCfa9|%7;upbM(z=kew3CuRe$#S=;V|j ztrnYh;L-sut&&0vo2|UwCo0GJWDtFQ=hI(k24IWlxBqY;m@&r;GWtx155`fmyx;F4 z;dj&Xyvvtlgma>V4VHY52}-1C-qX`xS+j9TZ5czB59^TO)hla$eZgEoioiQFpQ(X{ zr^gE4>_f5CG1~u)$4)eGnS9L{NeEsmeU83Q`;TV+A3fwh3C0>L`t#f?5cuic|Goe3 n2TtVwAH)B9A$&n>op-#IW*0L&T;jie1Ai&Vs7jYh83+FlimvUh literal 0 HcmV?d00001 From 6d91529fe93216495430591918b31fe2a5c680f9 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 28 Apr 2016 17:38:32 +1000 Subject: [PATCH 114/439] update link to new image --- ...rtal-overview-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md index fd3f7a1d9f..dcf0408603 100644 --- a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md @@ -33,7 +33,7 @@ When you open the portal, you’ll see the main areas of the application: - (4) Search bar - ![Windows Defender Advanced Threat Protection portal](images/portal.png) + ![Windows Defender Advanced Threat Protection portal](images/portal-image.png) You can navigate through the portal using the menu options available in all sections. Refer to the following table for a description of each section. From fe00b4329d39523c525d4b17b6da15019425329b Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 28 Apr 2016 17:44:51 +1000 Subject: [PATCH 115/439] update with better reso --- .../images/machines-active-threats-tile.png | Bin 20868 -> 12785 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/keep-secure/images/machines-active-threats-tile.png b/windows/keep-secure/images/machines-active-threats-tile.png index 4d3b54e48149fd38a03d3b075a83927ffcc87b0f..9f347dcf68e4dcef460e4c301c1c71947c063bfb 100644 GIT binary patch literal 12785 zcmcheWk6iPvY>}Ra0vl|2AAOOlHd>m1W1BgaCZw13GNVFg1ZEQ4DJq-;4ruoATY?l zpnJ%@@9o{UZ{Pmew?78x>OMVvx~r?JzG}kXs>tJDl3{{CARI*n8Fdio5jF^fgpH00 zNJ{MgBmloK92K-(Kp@=ShY!+MR$OvGh~}!OEQ_{^LV?D{AXWIG^sh)(%T?0N)zZNk zR9ZEv0En<%0g;TEi;1(9qpOvJJ%|8aEG%6?6?mf}fE4$y)Y;7V zp((Yim7N)g{{jyKsKI!s(Qq(#^)Ple1L-^7KQzbs+qspCiLEiv)EU&+`6Ct(qd$l> zjh*eS>@7f@eC^(%uN(nkVPO@1m?SbXGQIJSPyw-1L4YJsqF^?9Xe6Ie$vLri_WG+d zAo~!{>5muzy?g&2DLH`V+SN>2x(Aa`>7gdlRb*^&kz#s!+IHbbcv%^XH%>6nHF_r? z1Z4=2wh=q~lJNN@0y5L34*#4lU%u%1d{c>~rKMFjH8$>o>mWU}7gFz}21GH0TtFd= z?lCq{SXcOOs?sq*>Onv15bYYZpgP^4@*lO}_3vpp@^78^@)Ve!iy67j%UGLypL4J@44}+TN!3hg02S zI0bkg-$3r-?rbT2RbCw~0TFQ_Suu9_tEJ0fR7l>0k}ochCg#U3Be<9Y2jsybg4 z`z6k{EX>vZTYH(r-qBD80*TuepNk#8;1vmLR4kC{Ew;S>wcsWA=#Hbf$KiBs^mVej zjEw264l+_tEMn5(p5ff?8b)#TWnJepdq*b?#BbsEeS*V%X|s4lSQuLtB8jFZK&v@gg>2y8pJJ zi3l|uFG{oclV-T?p&|y>>m$O)pa1!xB4n-qIOmw@`;jxE`aZqG;OxjZo(U)S;_KC+{FJOP_b=^VhOP*p&6$^A>9vj;HIq&1YHrA>t z9$br5pQAa77G7t(T+g}xmFUw3k0mX+^7grTc{i?g_jjJ}1FjA4MPA-!3NI~A|FtssMCNHN`ry1Q0qbgp7QPKQfonVne!O5HUt6|O? zm%~7~e@6JbgtK6~AB+{zP9&D=RJSvV8yyg;piA`ogNzw01bxRjSBo-I70Itbr&fk` zqV=8b)zh^I@prkhGN$!lxbT7VhTn`&nhH;Rdq@jSV?a1GV}8pW#wK^n6`%fXrattL z^~3J8vE39GTL$BeA602!?$g6RPN*gv3%VE29Fn7cuEAD^?!H<#a=y`6PjPQ;xskwx z7S~lL#>dEBXeT)slY6v6Yj0`oRvE0(qFN6})|U`>Br`k%E#h*Cc-&G9BV@%;b=+c! z=U`u*2Ilu?-F(mE3)JlWQwf>7{bCFC7Z!4QU#R|)i1holFmkvEp>HwVci+CVJ$fH* zIHu%V{bD*N_uYMz(9(<#g~Y(T;S%h?qU!jxNo#)OtJ8N#)t1j!77fJ3FXvV~XFJd4 z@C+!ThgsnZO!t&cTl&M>_B<1af6=p+_Q;F6*VgL-K^EkL{iq;_pE3C&VzENDX{@(W z)D}AZN?-^su3BdY7Z98=j_yJpN!{Mr;myy_PkZgPGcBDa%?URPq4Mb&&6VafzoPW) zQNQ-$KUFaon!H%g9W6ha)5N=IOBFu*Et)p!Xt>=cU2VSn-Ok$A&enghIoQKsj6%e8 z#lnxAx6STWG))ul`EaYHaEXUO{n2TbX0+Xj)$2{s#T2h!?)I1ygq8kGr`BtM7Hs>r zW^9Ik4)(iwb|ByT{`MPsFp_eTjeB8cP|x^cp`R`1oY!orXm{=uY6`JZLqsMMWhWN; z#6;Uw3}pCnMkde0c{BICr>_>)c-1|tMzSqzvLpRtLaz$--4BnU-rO8**9d(T`zk^ zFDtw0d(!Z*h_@Gqqx^+3Nht;HBq;9bdGFR7&Cdv~;q&J`;9GJi(c!Fmw(bU1@>~^< zoV+}5j^CBl_MfGeGz0?ihB0x-_LvM6Bsg}+@i7=~Xd#XKM9iSs4hl6n1Xy zX^$?QFG+HW=<2{u_*3CO{PqpNsH~WNhd6s2dp3r~)jI^2FWo>0H<*bJbNd|LRkgKH zwSH4Rk8}-s!z28tG?hxV$uSGjcOb69^_yuk93MyS(9nnBVA;lR=<#Axalax$XV2lW z>XcUhPY`p?Jx%+rp4jMGB4BLrOb$cS+qOsqdqSBbzj*nfZisufz4D1mWmTA3+?(>m z{757A{cTqW#{$;HmL>BJ^>tE=S$wtL!qNf1!va!cMk$Q2ea24*_T>5NkFEO5K7QAv zEce3W?aPsssTvyvVfZJ#FGR4mRJx~xm^DRlQ+lOyRtjKU1BN$Uf~vCUAK$?SYHilO;c)9$oIh`qD;H zwX_O95O4>d*ik?)ZU~_o1d9-MujG)B8%C&yZK3(Pgh!yo-#;h?9eUu0pxMhC6&&3Q z+t3!lZ|1!9;H3j&NDsw<$qyc+o>8}mVY?B` z?Qjv2m$QA}hBIkpzD(#8GhWA(Bl_K?NU^h&~N z<~Kr;fN4fVgxdALgnHD}n+JKD_d0s7Kl5l1kMwRp%S#`E;auXyU* z?1{YuY2*Su$vm@;%!7_ImH}m70&vFCdg~c|D@Cm9DrAN_Y0-@Lu!?I#!>NCaJWh?D z@}r|QraIm%1#ES+C~)~Cwh0^^%(T4WTcCqVr$9!(9Q>R&GO3_ zo7$UmBC04!jU#Da##V8R)&V-#ORDwEVG|=1OoCDjd%fU8h`llIMJiZX%}h!=qmeEB z3@#H94z2NxC7*R4U8T{zugMZub)Z8a^g;H^8D`MQ`N36fvPDSxULt+9gGq|$3aJaj zy9T^qQnt_jXBUWihkMF<_%7$^NXN}Le|eznm+0@m`|SSq{!`lhO>iug##-x-tB*3? zXqG1_v1d!?%5h{&vk93|KW)l+1+H)ky8U!xuRSkLE`kIWR;A(DcSGn)^Y)9dKMAVO zk}Tjy=wHIL?FE3h9>FXx$2we&9GM8YJ9e*|HQN(K>TQvp%XUAfWZI3uuZ7DsQns{Y zGuq^YIxiyKw37rc1^4>+=?1LZ+YfxjoV3}0Mpf)hDyO^H*7)tEWGi&p^=(8;n!9Gy z+ZW0E9>$rXCTaEQiwKuiElTF@wlAvZY$phTYoWOY=J=I_afi~2U(kqHlHBfMndUl# zuwkO?PX4Abic_Byoaxj0lH8bP+MP-vJH$ecGE_%kcGUU4$}MgFO-;TK+g!U@-4;e< zMav@OJ;S0vP=G!MJSmbT`}Ps^kI#5LR1hrK63s~{hXTD=b#9rjKg4Zh#FURJsfa+u zet9=}A9{>;0po1H_0GIR$dmMYjY!_X1UrU05HE`mM;7-<7gQRE)`8$SYn>a-y2elg zL%5nGUbew8n!c>n(>95Zxi=;nG&(6A8XDm~;&)Cu>>lF#BKNOaO!!M$z)QQ|EQFco z&8pzreg5yk$d|tJ@~e~#M$QE2k7*7dUwv!p8@~y!D1UqT`pM}pp;)w7|A4l!`KM&h zAyFHKH{7or%44jND~fUBq)3p>N)v zgxntx&xPE|`LX+EiGnqu+#e$rms2l$7x<8l*$n60Lv?c&P28cx&iv?&OcR?P-Wh4v z6-{M;Gl8U~rDbGm8-;3f6g6<*aJQRtdcKmgIiIDfeoF!uyiX+8Yq?Om*%`SHB&O`S z1L7xN-gI=f#)I_rJFEsih8d_nUDhZX2Gsq~__Pw^&&#Ys49ke0OOcp5^dRV1k3_u1`x7Wp!vLjRUH2>ca!GDP(-gXxz zz6W54)5*l^l)vNCszZ{77a6>FOHh&>!Mw*MP=pF_BvwWAG<*hz{K$seNI_mm?|ol< z?lT?C5A|6?aYLK;a@V7T`qlWBH4HxrN21_q*T2{Kb)^9I5?D{d#fQ?AITVK&#|ZtL za`|D0=v!o@#lkaHM5Rg@Zwue$!OxcF5;WWA}Kb_aTFg3Cd4^Y1C zubWM&1I@_iudqotvUb=AFZ5ri40_QSBiga_iIry9e9p@ax4c)bm-Ca);@_yMYG`UU z=9!hyKR>$S7Z=B=F^=*0y`hSJ;onH>B@VV@Exz0O9`DNx)EW6Aq{trLToD~M-X)GD2!#bI#e81guRAv6QvrGBrocIM%{&RHDoWO?jf=I8K|6pIu9{ zfL6Az$XSdmMH6XUgkNc_MJVkEL(jeNh-3vc z(;DbFH}h=p2|HR&9h+B7FuUgEDxG(;5)=8JZM(v@bHGAG@>^iwW>%|=tND0Uos#z)34r&6w+b)-dxKWjq@Nm>je>$pF2(BJV4nB_BKOcLo{_sIJ= z7Jl(zl_e(T6quYZDP{ubsvxmMPUM_XYi~2XG%~Xuhi0ErJ>?6d&Vx-)I8m*tP7z)8 zoQUM3pYHvhpQK{-BEl-Hy>+2ZeR(nok6G7u&zH`QUeL6`!!Tbt=_+C*@z!wgMK(|f8@=I?ia$2cE~h3d!wsX z7Sd_P;hwdnFl{U`WAc=iwtVsr$j>k$kjA_B302gZwL?)!Afs@vr+1PJtt4&yw^?F3 zQ!o}2-Sf*H<+JpCf?w3$mCymHv!}zAE`3tCf-sU?19XO`^iS1-s-7Zneh`dp&q8J9 z98igd(4Xhx2mRtP)0QLWdC;S^+R7`CrKmKcNmNf9IP<9dm2|*J8t)J7hA~r)QwDKH z8bE=(V$o=PIPOQpfr$8YjdL3I^ZB=d+C}K^;CRI-N4jw^7fQakC;J}q%pHCeb?yNi z7(SI*x{NdV6Kpe4vu2D-rA^{m*M+kOUow8hjNp9!>z98F;R$}c+xXI(mMz8%3Nq>~ zo5F*(X`L~uTGz-Zyr*@`-;}J%I8SBd=5Zn}QphYYsfCBo0W@Vp5T4_RDaV)y-oW${ zb0w??vvGoD^)372?%iBgK2sxAC8{@dObm<&6Ho_AyhckY~S1P{>|Yy*Qc8}6k3fY&Qjmp}NFB8AWf_v#(;rL>mzlSY9LlyN__TmV#o z>s=|;>7P&O3fzB$=)+U8Wr8f9bnmcC?yEi6w+an|7&ID+n6=Xs@Z~YnE1gGXo z<)`-f$YxD~QXJ+Aa$#&x@r4oCw@9tQyG@x^sL%7G2Dg$-GF5g>$%qm~DH)j=b`KZP zszCRcl*86l#wVCOs}~y>$d|i^=lGG^8lK)ye;#%@(05w$Xtj5xE(ZF28W8_1#w|5Z z5v+EFe>gdvi6tRrP~E3~L(s0e1CDjQcQu{zp@i=d;1_+U zEYGKc-7mF27@x6GAhQxLTlz44|DI*}-<_wKaG@niyzCfs#bUlC7{ec4#eyDb`GOlt zLCgovUfW*KoykgoM^C5r@hkgSbM8aZW(NNscA_+lX6WZD%#@M$F!f5bhrUhq=b;NR ztj`Kdh-my`xFl~5zvz;T;Zmx?t1~8u2<1d{ZRA?XV~cwdG$qqL8_hZ%E0e?Q>8fqh z7v&yrY5xc>bbdG~2Cr&G16EQ#8V&koMC0{4)(h6PaQQli!Qd~#WrBbWU(G33VoHSu z066$UBoLLxee_{zF^zyFMYgrnc}Z1+S7i9m*Or4`G0IuiOlz%d^r1hy!PXj?B<%0l zlpr3FM+&YWJw3%59UXta>EP#QT!^PBLm7DC325#K|KlO_U#WQho%)$`|Gue*5;}eZ z!Q>NizKaY~OOQ8#0swi+v&>yQma{2a!OCo3 z;qGB3FIP7b8NL`ceQFejw1DwEG~R%>GnJxi+As6waJhsVz4)Z%c;0GGJhLZx49=L^PjStA3fiM%cN ze&IARtw>Tq8j>a6n!D<+qzIlQ+mJv)Wxvy^><7pt&GkBOMOna;#Dk@oRpH0WnuPC? ziVsQ}e?A0_;N9uU!;0{D#4vS%PU9;@dmn+GJCXCOuH-xuB64fS(HFLksJ#Eq!iXcSnV{L z{i9s!&$rtqQNcgpSHleBf0EpZjWBTM+K5f!8R#5hVZC1vo~E3BK{3*=nlR2T)+4{L z#hS>?>)wG_1O|BOMiXNs3v{& zHCdL9%m;j6(ePGJ=O0)3`*qNI*^RuTC&!OxP^0=!Ql|g1nY9HI;&H{wjq(^XJOwFZ zL#IDfpcOuBRe>tg&$z0Bu}22k^b=}NC_KFt=%1cd+}x5ubzFOxK;H zL8gipUtk7)`3BPk^LGsT(1DyeuN1txM3@HfQ)-tdp9`iSFp8<4)oy-``e{7WxCx(W ztuxyXi~EtB|1SOMK)v4IEu5Yd<+_R|_$xypPJv$GGc}nCQ8B3{Q@Zlx!?DXJ*@S#c zpC_qz8RdJ1<`|66_IdC~kj#|c6imYeV5A=@s>Mh>EmC;!ijL<$n2hl zN>|wgh`xHU%c6kX6-SB=@{A>L?IU4>TG0TYo^_%6ueE8?9(Vxq^=FEX1n6w_!9m~s zHMvZ&0JsJ8j*LA|i%Qi7e$xt&e1&M;-*5H2=d+-a-&`F}NUSU^@$pyhq(Z>MZwT_d zq$oo->FJs*R}PaHWk-)_^lFCr(@3q`@~O`#L&S^o!A4y*~Y1VI1{1A(5@JlqAS%Xv?qb6y?(Y2dm6IMv@wcG3>7eBKC%Y>Rx%5<}_c z4dN8X;1mZOA3wb8xY*^-g&#~wOBC~x9-Q*`@3!t#oUIB+=xZPS;p}X?PK&sy^z5a! zi3CtrM8>nCevQXgqlSk{4H<15Bx!83!9PndNJu`-QHE?a z$4V(b{qhh-zM8c`AqxnZ-Tf`rJ6_iR%156xzH{9(c>rraKcsq+Yn;KUofB}nEPxv5QDhDr2T_gdoelOl>UY2r8X zShF@(l0Gdv6qL0%D%Ck#TxJf>UvQvW?3Fxt)r*O57Rz^UR5 z4D=L}Le(BP^(|fpxZB^y0+Im2xzjfZ3hJ*7vbe@FzaI_GD~Yz%x93X zF>Y~j{U5iDD{Vc7MHVTQJ|E5rh*K$U)nreu@H+gkA%XpQTjInocWz^MSkyy0JS?)o z;NeZT({1IVoC;DKrJr)r+=ON`ud%Vqp z?`zJ(P`xzo#p2#x&U(2#K02BtW)RTa+#Hc4ITKp;rvGxjp{AyDZjJSTA5I zc6`la;Q>$dJ&7N98E%L$+airX7oOg;Ja!Yu_wlJt9Tg zR2X=9*?KgRA02-VyUpA;Nbv!`z|+BR&*noaWcRV87xVB>sHzUyPgUi|ps zx1H2V7v0aA*LgRKrkc23zZVn5ZYYEsdq(v*jGv|x$E5B@K8ihXcdL)`GcgRml}zz? zX<@*1=Wr8LQRuZ>1>0XbCrkq&3{Sy^FyPJkd%hpwc>jIcxm%~9aZPk(PCi%~p~?rD z6z0oe9Vi@pACtX z?4;TxpAwHoS3#to`#3I%g~V%H`Xq!fB;DfxpuqKx(fxDrXzk&8@2(qf2ZKmW>=B>z zPD^4Z4(-v{#Mao#Tov|GpdnxElCJVjM!p`)_Y9@@eb*VYk?%Rb`nAa-uh0+ZkE3t( zTuB3!%?lmAl|qC%IK8vWg|7_|r=wrg$mDHE_+yV~bDSZ+kEPe21L>k{dFFBUe&ncGZsflyF)~7Q?I+_x=@9Fx&6p zpKfI;`h~xz-nWkv+f9$z1>U5%NNeD*H?Z3@r7C-`DymG4kqaIoXIPnM#|OoDr7X8$ zjT!#9DXZGqGWRsul;coVI-NB4JEw3V>Y!}4D)6!apGg*#?kSyj)EJaJzZK3?#x@;CEm+um)@+@b)6A6yY8F& zC=MsiE~*}XdS;3f3wu56Y!Dcd58Zt|mW0jm0Y~#ri#*-hGA(;2fARIcmjH69G=j0Z z!IxhT>;;*FTjp<3*m295>JvmD%itbt)Y}?)8}W`!*7^98klbN7yzRlLtv=#4#h8%& zkdRJqss=8*z{-Eu=is!rJARX*X&lbU9Y;`s`hs;8Bex zOz@y&dw8x5jpOfZIjk^^(eD)7cna5~Rn3mgmRiS{6^H6OBapWDd`?-iW&jN}W1S5( zW(t&U94!j#6Oq(`Xa+W0XV<02c?=JY+W-&T;K-=EjK*@mu{-D)Jm`Ju3SLz(b&h9ZvghK_AM2`4(lWaffq00t z4WLaG;LDK1dhC6z8|EA+q1# z#8?wuHI)@~N80E-hPl@$QJ6@U&Dm;2>6t*_26rZevuZ=5E{2v`9{pTrIY53Z7oPp6zj{cHCrbTmIo$sTH`U)acwDW$Fix62ris;YY_#Qo zb&z-Dmj4nhW{dZVYjbLv=ac2~!I?PJ8f%Co%C{H|KBX~pnQS+sr+(L3?Jm0 zWRrMq%7u1yEQhK;OlX+=6mCx33I2xE*L=Ma?UR|qoF3D2S6mfECT%>ffc^AwlX@`T zG0h}>>UZ5_<$u?CztwmqOj3N{ca?MU*r(6hAEN&k27>A8I+259M0$^dD0aWc=v-XUZ#uF3lm4#f^@4Q_peRH}m$EZ0~Z^+*o8+ zl%SWZ$|m~uY;jK!5n?KsBrJ#B*q#@OL&`_j%<)B8C{-4~Hya+L(9U}0I}xWjXl4JR zstRoMmrBp#BOJA#jmui%2(UvPd}S}RL>RA+;7ntc?mr&1;F|3a9tlr@yUg>9@s52J z;-)Rv@GF`KDhj}Y+rZT~SwdHuySDOmcOzETu6uqO8F;{LCQ=#d#}+;E-BORI*t9}A zBpl4ApUpumB@=rYX5Sl-f+bf25Ix4W$yL(VL~Mh#YKgtIEs~puEns0B&s^@8N^5~k z!fFoUDNESpFibZ)?4R#+iX;{nbtS)ki_^pNeZ0w{vYXBJV}SKl zXKLJ#s5LGkgGxX^^qoCmypzo%3L*9v-*{h1Oqr_E?$2XIM=kS(x^e7w>e-u*9hjmkr)d5k^MyP!!8L4PJ8 zWGbNO7(BS2v#r_j(~_-&>-F@$37E5}q0^5?t6a>3!^^z|Eeol(Mqnd9~={#hB0g8I8#Df8s5qdj`d{>gYw=HY6R1wv+3yJNhMb29Gm|2)S5zaN;*Bu zaB75*AkxIKs;5b_Ol={bDx2{?I?gQ(dA83M(PPq@z>@aPRC-uYm5ry4F)nNE?55=u zv8@ngGa+EJm7iQ(8j|~6ZCrKsq&A(-Gz}=_{T|cC93v&&x85Cw8`p@B8QnNrT zZPt-AY4s2p!Dp z%AgiycV-(Wv2Ccf_2B>%`Re<+yEVpT1-WHvUM)GxyqpkUyKdBc%+TkubXE2>Grw-( z18|rr!)n~EfSOB$FxR#M9+8ac825HsNkoq<4iP(19vLcrJpVwdg;cECYlhMg01iB0 zK`jU1l<@ft1A+}8bBIauA)Z{upksIli&Y;NNK*X`qJbo>h))>RB z18)TE_lR=2uJyO#35c<7@nk~*uSK5NFEQ1fpFZ8Zq-FT-`zxk|P}g#c4xP{XTy--t!^mL|tY6*iMmss~$t z8nwBdT(VZrfUO8*d-BLaBA|+^SO_^j*g!p(`ATU-y}L z3gv>xISlB5+vPFo^dF`^juG^qHObQ^_LWybTnfiCXUG&{N4IUrDh%eNG=KAomjTg7 z>>GY;A`4&ZE}xUN#{pR=xJ!A%CrL88M#R3=hQ%zi1x6BE$5M2}11FQe8=8jCjQ{D4 zDCZ-Pxrzrl4k#W%7$Ic`b^tsJ6c#mpNc;?>!Tu#c0ZRY(JMATw1p}@kZBHLEaPjX= zCmFr7r0fd@-Z1t6aKXjJW$_=^=ZToV0o_$p0EfYMuT%4E&vlH4Pgz;n0Y5fy55K`5 zSZY&~g&$Ul?39DkTmfn$Mz@*|fm9KY$Gh$zl|_5tPl{{u!-wJiVu literal 20868 zcmb@uWmJ`I)Gdq(xJ6Qt5D<`*Zjcm^F6j>G?nXcX0ck-%T3T9KT0u%u8YD!dyBof> zpLe{!zVqvh!+3nad*AH)igm3u=Uj99?uDWh7REyi6ciLJ8R_RLC@43@;pZ{LP58gQ z1KtDpcE?d#+XV#$`v>yRjd(_E61aHVRYpPL_8(LNG-7NDJZ<&=E=g#)in_U4Iyj>g zl=e!)B}`Yi^xVwF#M#Qx)ylyh<^CN?D!7h;ye{tG=;dr>Vd;uejMK{xSF!)Q>TLEB zc`Jphm7N(1_c6{Lc;ycA6;%gwSC5y@W+?iO*T~!N{`clqE+)1w;Z|pq+HY0Sa2bKT ztohQ}-pbwrY zD4(~6=ul87P-LEqs(Gev%y_)QAHCw;;WV@GiS5ffzIg{1fjWpP_TU9qXcqo=B2*?W zQM3nmsHKZxVMFg9drAb|eJm|ybu$y~9)ji#b$dk+HGaW?x-=i8{Uhij6iLkqF$_Zc|iIz6Rttrg-w{Cfmaa%M4p) zOZ6MLZN{EUNsW(<6{<136?3|}IQ^9^<>TWc@V__Lvg`@^AFhpl`b1%9Xz1bLQLRJv z-~kPywJ(MDNtpA|6wIQ^OR+3Y=wMKskk#N~S>(E#P5#A;7_m$~k1ahNovE((R6;^R zX-)3%c)RrBI7}0!#2!1I-<{m z>n<)%_lZpM3E*+hQas3Y2))upod0#ffF+b07h1Fusi;UR(k4ibrHlD5( zm8A>&o^6-4+Sd{i5KP(f1ig@uXb-w`pMXWr^H|umuq^~fDUHAS>({SOHN$WV3k#Fk zO**1Qu1=&lzcA@)X<1h5Tn`!NmSz32e2&m&N=V|g=>N#xX3B9n^Yyna^ ziZsg<<>hTtX9ow_Y{rTM0s>%XLV|;5O(x}ORbiMj!wv46vcrnxJ40QaopkK%${5?^ zekb!My9+5icE&^<^Nt@96XkaIdCknsn$EWx!U|y7-0Z<>lqje7e;7_U^*M!nSWYdf>~Y-lPTCfTzyX3d8yh?(Iap zF5HADJBBkE;!kB_{YUr+9z7C%*@{}N<2&DqRy1l|tNU7C)6=i89+tkRev;U;oi6OP_s_?$Yi=Ck%YLR_rp%5fg#w|{ z5kuY0*6aI}&zZEdqPR*cP4T#c#Np!7>`EP9f*o`CBGQ3Np=WVV#7gI%SGw6`%Ty3! zSk{bv;w(*KkD>43Xp8O(6djrfCw=|2QEM8Rp_v)|>|fHuk&@Znrdjkq+uFo)RW5)1 z#zMa(*45UQofPJic&_o}G|u&1R8(nMSw4LsL>K_O^z?KNcHP0j0W6s$zC_U|zw64NMTV~if6V4o^*Y4d(5~y=ziwC&+Bk@A+x4-M z01CmqE~){MYe7+5MvdZ6^ww)51-G$Dr4=~qOxXw^WKj~o4;WRm&bD{@_CSc6_YsL=B)+?2SXmlCm_HG_%yyg z=YQ?H8X-y>H##=vcRb?(s~varFYE#1+S(cclh$ioohI*U3Pc>8(rmd&Cu_?^mP&zT zayq}8wX3VEsOa~pY8xRz!Jj{W{#{srSfz_kFw<@_5V4!$T1^@JP=yb#l3%X zvT`}m(69XW=9@QfRDSR6E%rbigDaDDF3a#=Sk~8|VPQe^9FC|e3GV(7y23!Qd<4aF*^8H# zH+>nl>*mdyY7Fu1#s!6idj|(qzc=CRfB*iyMVIjzf}4xWC_V$=Ox zsNbPnE8TmopsTA38NkW085xGEs+>mOP%0;x$iDpS>A8*du*!4yFHBgQpMf$6cC^y( z^6bNh4={IOC}!>r`k60s^79QL1ilBL?e6Z*z1r_P-CxENoBZz!ky%ku0f~u{m36!6 zcvenYdZNl|I9DzaR}6V)?VO*0{q)yy1D{PONKnsQ`AEYFm^qT<_m>C!*9!8J2|iLF zLfV|p4y>$F+sj(6y#IB*4+yv!GzbT!*SxaZwBB`91=bSs20AwB%EAICB=^}SpGqcO zb@ll7@7et>PTt+8djuiXu-)8X;*iSk#z0B=a`$h0cXv0`H({S6Cb1PbWm@nSs!BqK zTMgUpt3&ObofZcxzu*A12Hkn`5ztQ=!Ix@PJIva|aF{Q;&wGCizq6ACROPkzcPM zBCY{O$iz;6b;_m>BkkP$U0arwWeoX1Mn*;|`qAZ|K%BGVZ4rxp((GR+i;0Fjc7YEh zoaUN+i!@4PWn_|g9Uh6%b8@PlCBebJ4rgs967jqE?a%_}a`OSB20eb*zkjCHI%%n? z7cjAMrUvWLLP#~uhhw^Mp7vmg{jW|fl<|+Z=UQH!?*04s&tuN__`TGlU+agkUi@kH zD}$Mku*R*c$4m8l`uk~R_TbpLEcYwO%fEs%OQ(>00EgURrv3pXJP1}_$G`w~W5Xid zYpHTT7=FcE+Z`sFnVAXEK+f+;IIb= zqbHa_xk`+U9jbMh`}XbI?n3AB#^kUO8|v-bkPZ3i>FH@`Bv=yXzB=8a%y~hNkAWs8 zUFh6&@;4lENm=t*p-xGER~OsENRjJ{ea-k2^b# zB^o_WsbZN#!mm7SZEYdkeplPjMTT3!dnucAM$J@OD8akXhruCrb8`bk=6iLz92XmV z^VTgxuf+$ftgK2(O0m?JmzPbAjksd6x%VjXNl8;bd~n_QBdUzw)6?TH{goZc2OMwM z(!SKEmB_bk@Q4lz<9At-AI{7tGKrMrw4L|@IggfxX4SPmC@9FF$y-8F5*-y4QV2zm zn7DYpLP|n<`V}DX(5#P%iJkj`GOTEiYF7&(B;kxxME2)Uzw0R{O z8rmS@ zYR2qq&(F`JiP()#cIN*l>~T>k$uhjs2_@dYBvQsl6OHM|&Q**NP;6x)2lw>N|clqX8+(rz9k#(+4WVn686D3J)_oyVJ%*xkBYretsR6#6*ae z4Q={^K;QTqFgLZEQj?iHBTyR(-|}e$!%wZjYDEL1h434{rof04K!b>cT5(q51mi zT*&7rG|O{+jJZUEG0fQHR<;@gRM{ZhPAC2}#d^B%s$02AlSXX486t*7qct|;Q7?(& zx_5+(4jbx3`W9zC+RxA$&phCJOCj3pr<0rhfd0nal% z@vo|NI4=<CfxbR6KF2?wm9ueCN|eOK#eIE+L~#ua3;@5L zm2*A%n-e$Ek%T7txwv@5lB>D7Ie-EmA7A>KaV9<{&kD$uuI~EMQr-*toVAcq>-cU{ zm@dq6h-BO3{D-e}1pvY2#YM^>9*5ZrI(3OyYRH_k0GJ?9eYA^R2T9qCz5#860$wn@ z3I+Rxj!qb^F;O0@*W%Ck0m1!V#znwmN^3y`yALDqc|lJmoH!wi6b02IwDPjeFutOd_(xRSqo`2y8+ zYHA8f^seCbLbM3f8%_oWS;*T?<@&=2TS1Mixpn*AfdR{z z-Dv0Vu*sy{L-Uo1u`zHoY%+diR0FG&KK;Qa4=DyJ2zv+MjM>>)kK3~L=mdi8HaSCu0Mp9!t+3KX{>|9Y+=3s4ID4Y9`$M&Nh3smj%w|5B> zn6!uBC!m>Jvzxh2xhm4nB_xD^O$=cTxbmmD*8KXKiye}^niO|X7f1ah%vfGt-q<+H z)%?@&DjXSL%_JUC2Pqqn;4CfaJ5K7B)A#rG0BpH8Tt*$;kJz1QP_quQEr_LOgBHpE7Rk{Nx(&o>!yzD&Ux5M?!-r`LUV)i zx$*~dDPk}D73cr__99g$blKn%FOXjvA#qLBhdV8UB{UJYMkU;>v!#z1X#H(Eru{nL_ zoJ5#+?%Y8jk;d}Be=qQJRSK$fHs{+ya%musUF3!tQ6-oK!dE~5oOJJ_jnkbr9FMgT z8C=w&Q5_8p0(^Wf_l*fk@!*TI^|DBXGz4Yv%SZkfy8x&R>zrwTQ*m$%8LAV6Y5NXl<4L^QSEA>sU`ii$8x_ zDHIJ@a;T}>ziU~==xJ$#^Q=U1A9=52BFP;a+Y5fv>)fUf85!gR1bL&@0L=kR{JJI| zKxDdaPNh9{=`gQ+8xn#;%E!jY$jHfA35$gkGyW_rP&EN2J)f}|Uv-7SXlrY$+=0}` zuqd^F`7n}}jqOXh&o+=g6`X{S5GhzzkWF%NN`dX6ib^kN-U)~)Jwsq(9vmK;X=~_s zdV2DS;tC53@v^JE(aT;1R-GVcaB+>8SAzUh9X8h9+S+Q?li;>F(HHL-BM0*Tq^rpL^;T#;tVx4LR zT3T8V*r;WSMrD;p0Owu;Chkw>24Rezm)GO(k9Ua7j%KNd@=4nSmg1U8+aZ~%wt34` z(d5Z_#~A9Q*w{UQ=*`EoKJb{jy1D`3b6Zc(6WBnahYuMNdt98IY2`mUO4*{KqgOC7 zx&=a&udl0{fvk}k@<a&{DwIDDCM14>deD=| zI?&Zc&&XJ*#l(}MP@o3%cQH;$*lRh>Q4M4=)735fW76%{S#Q3=8lzY^|fwz#DC9qMXIs{zp^5O!N z8XE4t@T`fi;nK14ii+t19$Qeu0V%lvhgexzAvAndUM?`!*JlS=6}a0OP#-vlEQZa+ z8by8Pm0TKr{i#m@J{}$(_H}o^3lC4>b25JR?3tR{2yl4-+%dpD01_|*j}j3v%>D(+ zksT1gXrZGCNDH%m=bJ!8Wo<}7NB}@kX3zwsMNd_Azn62sk(5qf7|H%pQ&XX&f-sW_ z3E=bR6~LM~R#W!1DShUv)bdlL0Tjg=>oBr~zkhQy%vR`bmBh^0(;>vHH{PTFRK^D> z35KeeU#SDq4HtHw6ry|4IhJ~TeI1s76gvdsWoiP7{;bvT~P>TMYeL%`1r`I|LpUY$=%AY=cI#cg9Y{^9%w+c!hQxBXrIVv)U3p_F4 z`gBU^)QDD)c|o;;(*wUSq*~~et|TXS7lA-vVfFR)QX{h9@B^rY7jc9RVn*2F6B3pd z7VbZK6op&wv>>UWkwAffx-A}p?Z!t6#2Vf=i{5>0WHn0oK~PMedBdyI3WKslofj@H zE0#4g}GqTp3XM#Jr6V`Bzi z9lu+0xo=Iw@dBt^Ycq~b`5`XO<#0_seYvTr>Hhuu#KFKLpZcCvLAd}ajTOR1r2t^T zYut+8n;@ef934ePMcM0ZKn&#A=L`-G0{+gcejK$hG&Ce8CI%JRGrh%gHw%iXr{`A+ zL?Wx9J<~V9@3OM8(=#(vj~_pL_^=)%S;(7OT0|ryMH)pC%JK>d0F$up+?n^f0^Wcs z`lF-crzwXrJ||?}%1SqW{pZi0D<~)c+=8`LQi^`}&g#{)l9$&hV3*wB2GKzDx`u|i z^0x5sa8*@RtK_YT^6Ue4nYpCDe~nj5)1B*H!3iC*(f}E^JC1HMy*RU)-%OJOgScD9dhNckz#x-b*B?>i110r zP<6;IG49@l+Fob_+0cI<`vHU#N79A^4RKFJ2oAZh`-awnTeH6+zC^XoCFB;KCYRgL zk4SjSo>1SMldNqbZoI&Z=2yE!9XV>mh7O{_GFz zSWI}JY7F%gH%b9tiM}t`@Y~R~~5&_*RPb-#s>g)Xl4THXhnBYi zbX!pVh_Q7bD3hsW!rN7}v{pt!I^iP9aiSWQDm^||hgN|a|2exQT>5tTmc6v7sEuft z$Rs)M0fvMeA+k?+Vq=-yK@_)A>n@4BsapCJ&4dsp{r_^f|EEc2r+E2-j%cP`t)mc2 zE!JhprBk9&r?<7b>UG@9)HAi|UZx6mnqq8$ufOP& zF!i`^&+3`;i?mF%2TiYW**u)c$m#l+@HlNS~s(xMI$Af&u~pG&GB#{u=sU zR)d^FANC(f4WLN2U`%c$s_pVlxzRyHiK@FCHgz=iF3XZbS0W;{){DrbM3N@^Nq)%< zK8ebx6A*_~Q20orpalil(+|W!q#mW95UF+?YcAk_b+Me`4{Ew~lfm_M0bzR}|BS z*_~9zJ!C`vRaw>Mqo9Auq;-B;92XH)%FJ$iqs)xSJ{vL&NXyhG;M5b2GRsTCkSDmZSilBryaJg2KfaDEU3{#wxpd89z2+| ztyyAip$}70C|77Dk|TeSLLFvIGRrTDo1^^Q?j9?`yr|^+#x%7}o5&_lu{JbBZEFF~ zHMr6P(I8p?xL>AQ%OWh?4CM?6*2Bo9KHj+x-KHRJ2ZnpA3qG-ESUce8{q!07{M9F|2|itf0b05wZXMB}J~^;&-|7D;rp#f%j@IpkSng zz|PLzr|k*BRH9l*o1~a8;QS9ECXG=TEqn%CeAU~cAdZQSPO8vKW?$rJ!USqNwM;Cv z7qrj{(B03E>{9xGNrSeOQn`bS$o!=(x;PH`tWoRhfBtx4D#0_mhLCcjCgDZFt|{AP zHe|yW_5ar-k0b17_+Kx;|I=Rj|6Ozb7qdPL*mLj>5%&aI5Uyk>H3Ccg1@*6?x6U-k zKL23r&xq-w1_pMq#?Z^EkpNMH%>#Kk!k_WaApbwRd!LQtDe9B%5lqTI2`n*1Zy3-z8y+|$fBQRSH_n}UuJh7&7>`1?*>^23tfC6 z19FZQTct@UMs*+KO2P*FjW^_(Xl@+EOu4aL&PA-mYx+DXaDAWfYN4XFg- z-njJ&1qCO9-2cLoCkg+wmOiNmBk8l2nID%=aOGmwhhl>?}$7!41P(`3y(lVu(z=R zKC^zPQ&3O<)a%%f8U#8JOX~J3)&Vym`-k35SIrM-=hfF>>&nq2H z&o)3OGY)M_%N6KJAng9Io1Qw2&nOVI+4N&2S zo<$gMM0mJ3!pz*f)Ud?>7ZnF58W`7q>S4A041d%DeVF$`BrhzTj^lDwDfRknlYrRg za!NiR8TrF9Wq|B$c}P06a#hGc5{7&qcpHZn(Q3(6-_XG8B1MBtppcfA^sFjhY7e)`UPM)>-T4)}eERw| zijvX*P(B$M_kUe@b$V9^!%F1BuRc%@@^t#lDa1 zRM4j9=8j+Bi=~bx6R2@slx>)4w)~X^(dZ8CIbf!5-@X+bNK8m5)vjCu;+O=i3}Ebd znc+1sUg$9~>DDmO(Bwi>5=s0{7NX}o7b2nK1E@A9Cx=wPy|}%T1r|lTh0Kx~^bV)n zlbi0b)WpHvJv}M>Zfgn5y7gcSG3~w=-u~B-FWE~3Bj7cAb0>>NB9$H4z&^7+ZayyR z4PZ&M)IL?uYJKCOe;7QqZ_W{uD>w5{BZATQ@?=nM?pcj^wmcG7CZSyO0E&dSQ zxMJeLnB84nM%o%s4C7@3DA+nc@7$PcY01xDzRTLk1~CJ>4t)w3gjx0y*6w5sEUe4Z<&4~M7#4JFhEDVH^DWHGa!0H;=I1j08*OZ z&+2eK&LhE-w}b{edwbS-O*=k1Cb3C<<^}Ux(6H04wjKq-3F^4>#mO#GjLXdY4((3} zrwnlV07pTp7D^u^a*A%vH!gMKwZkB_uKh?8<7bL z<;3RE%8Dh}r9icT+ip@K#qpqyBWh3?LtZH3=Mv{!=hDlTjSG-Q!9L{CtWH3eA&Lx= zDFm#ZzyEbYNm6w^H5DQY$}XsI2ucTsZKS+0Rb?d=MT*n{q3VLwfRKbl0Gd4@i9lqW zot`$GtraorLn%4YMUB98$D@K(Po_lM_29n(Tgjv?0cs{ZNH&*)o7-(DM+QOJFk{b= zgb3K#--ni?@T(I?ZS6@Qu{k%KK+MyrbIxry2Kf>?Wq?zQL4TjLjqI_twERY-TcS}p z8NqI!8UU>gki!k|+cgcm%wT}f!(Ic3A|dg%-Pr5kmsATVRY2eXS3}dXpris#d4H+T zg^#o(KQkihGaNf`VaWM=`}iPl1d(R_SN3f&P^MNuBhI&)8XxzV`0^6qE@*rTHb48I z=dX;v{iu72N4klLBdIv|?q7U6pYDl4W=0f%qc19xR^`JkV8^IM(z zBdCHO*WYIFMrH6pXQ)S`AL&i|9mIR8h{V<^6@!# z1mSP9=>HQ;BmuQ1FmzrQfBIyEl&@$NVufRuP%lkOi|icqe{az-mK7&)S*QoLZ#DXH zq|B7Bk(V894D}QD-0pt?Vr5*no+neq`s`!igWr7rwIZE`C=~xg0RM+1{x1R4nK?8? zd3{X`OwD!lwu@jF6VLf+Pc5z_k;&VDcbm9*>a~40J}cgoL4Wp}GLh5AuP(+=hsq-L zaJWX`>lQoS<)bL4p*?bWb?)F=;VX2L-d*EQEz61fbZ!v{>s7J3d+^XH>?HXkxwZIP zbR5%M{ruUyADLJqi7{o|{ohj;jMB4r2(ntMVH8FR7kx)^RZF=qI#0&yY^to^#%Vmm z4N|#*_3@M2n}4@aUh^<=b8`y`HRa09yCQ+ppPQhiaRMg*shKy;vi3L9Ol8(X&@gk= zunk9|3@XVO6Pm5e|J)2cB+XL2I>5E7UWKvH#Z?lyJlL6U^FKiNKt|KpZkxnEh`WLE z`fd#L(#y*sFqjz_FmP}ZX~CkVS~d=?i`7#U&=kQjMzjDH5-|RB@PgW_sjd!9pKjBN z`uciM+(7Yi+fkZPZp)7R7xI*&6zAjw@-ySPTNlY9ERWkR9iaiYtjT31no4mgM3|LdVAZsCuW10Xj zBcoihLaquFe#I1?lDs^0N|1^3Wa4NiZF$m{k%tQ`K?(8k%(^ujkRgX|MM4TYRur#6dZ^q=3E*#^jA<+T=Ej8rZ$C4ipT`^@VTPGxjU8y zbR^huAee`sm2UY>xZVw*zJ)`OPRLNW9xt04=l6CfJNST~SwYkw;JkO<5tEGn0Ms{- zXTVx0FDG}tk{u1CD43l9RWw&cT~m`)zy3qkXRx)wRoU&oe2Uq>02AodyLLlkx5!2wCf*5&y;}*@{c%1aNu}-+yQ(uq@4w$ z)?ryXzZWPeyT7GbCQtjG=%sZtWT$y_Qt?o-)XTZLh-{Eh2C-KN@LA9$9k8Mt1GdYe zzlXXD;Eh%5ixKQ0$m6tPUGt7c5l^E)A903y21ZH%@Rb!6fIJ?~y~TaVVcG?U5z6a6 z0NKv=_7bh~EGYgvf4(C!Q+OSq7SzHj10z8;PuEaIEqhx5B*X#j1bF3)>T-j-frl@c5#7YWo->AalQW)my zs{rkN6Zi?>rV%Vj;6lm}NYI4K@H<-tyeS=fu(M-CgiZ-Y%Fu$44g38Uz|BN#dfSZ$_%lDQvP7Wy!>6a0sbeX$9c-841)P#WCxg~YbOj& zZvD6Ml##NTF5{n5y)@n4>Mb?Cy)}45O-CnZf{!PbEfuXOE9>mxA%(yq=Ewo7jco27 z*dGnbjo*GZ0s{^78y_aNSpIsvSKGh`)+$^RrbA?FAZFPMdTT+0_mu?k?%y}5)|r`} z#>aT8$0CJ5x>_*W{rk;s-MlFbSQki_DDDSYGfT^!)WEAd$SPpz_4VCcTIMR^Zt%+- zX>r7Vz>%iu=otCsaK_SPFn2NqzN_78#e5t7-!t?7HaBMul>W1LyG8#Vx5pWeQV z*u++>Cu|N}{FHH61}71C>C$q^`C8kP6%oS7Zn2w zO_uw?#oogu0{ie!*)jT5+Vl zCoRDYzmIqgSL_A*EtU|oNl5zVr>ERx^8PJ|07yVev8K??E2`(-5rVOlgo=MV)DU%@ zWuBqGDe(MjC99(Z2r@`p@`op?!PsQpbA%=k<7#OijTq%8^I1!mRI5=2v`OH%Nx9z!}>4uf&eb75-Y-&Oi z1*vUl(--u8AW9CkztKcNe*6f06wEwO#Gnlg1`dn9WH6ub*iVD=o4o`2q@c6`BRmJ) zKap8?X?-1PB2+H64(yNxD5ZdFpo^jp21QWqL5DZg()#)zYsz{-&qUDE!`hPi@uTPJ zP%bj3!^DQ#27+>*^z|>H*_bR(8!x*Ejz%cz2~*1dsUxzG8^G`G3l6Avp`m=x zxdxdET2$Hzm!NAx(}Yg`;~z&p$;gLp(9(p`W6=ESDF=r$YzTIU3DgVdCS^-Tg0DEq zBK;}I^Z@dZ4s|F!SmeTuH8nM0Oy}d{6A=)WWl+BR)P??!oe*Aofup(C>>D|5%{Rz?Q5Zv-(^}+T+F15zm7DraEeLe zORT;#2BjACV{kVr$jRMD{cgnev2O_qpn9$f44#xS2gF=&Uyw&B5Tu=yL2MmJm$)h* zS?CBNeOi$rf#_IBUkTKt4!*~avtYQ0Ob{Xz06xl}mR6#8-krwKG@h=cZ_-tcAFbcrYEJ8nH=j*PpcD=aOQMEv541nBV{+RFuMkHC=!Iu0Te)Lf{-unM4RDdUrLrhw-SAqEztXV1Pt znJ-df0BKL0S^(I2)b^HSVaIc3IJb&l$ng-xx10`9xXcYSHxhe`D z*!G%EcumzOWTOhilyMF&fAl z)U>n^Ibddpe#l)26dbJn^kAx#m;dKAYh3Q>X8DwI?8I2FVppPfuV02p< z6!i{ufe($Cno^6cOj=|d9v}0j^fAP*LEgf~!GU_5cvhQ}UV{{Ce*6G0JA7ONG|}Wd zX!1;COW_1ifLUGmVn^JH$QNilz_Y!*JvO9O3KEU^YGDNiT8w8+bp46?~2_^XK62fak^~Z3j4-mz@<$e`@H|Dk<5T} z)o-$ZZ@j(+kKf=j8pY|eO?W=tEXGm#g!{54j+Qg_>3SvSMXqkhjmJLSXi(r zbADOo*xEP&2*+##6E&E(xEGLa6+v%LPeH&(*40z6C!^qpgjB5Ss3=~%X zO2sSsLmkI>b#WzfQ}I0eU)J7LSWDx2hpMFzCpuZXgEkauFlN%mUBIeNuB|HK)Z$F#W{h8^EjhxdA!T`L7r}{DyLd$ts zYa4&Z2hKc>T*lOIluRGWc7ENKYvSSxj4_bw^Z8K}IN(3|fN@|XgR!QRY`)BVOEBqt zxm+h(Tr2jU&6hi=p^c-=g2tOhHD2o0WOP{%Q~qR9%senHd!cUq#!i+snl9_Qb36JM zOT|t1*}Mm1F09vD!uc&%@7-HCnTk$*J*)EGJZO>LiLJG%kKs**y>GHl^4Au zU(6#GG;;cB35dQ9gq*tLsKuZTJ-I%=QU9Y$zsz-~MYAr6w@Yp+JR_~JL1$}%Q+P#~ z@R;@Cw80FcT9W#r=b9l+W$?K$Uda=7XE~+uD2tivWwTNNL;u2WON|PZ`zOvxP5rbN z$J#0FS(LLX3q5<4hXtoK;`ak}>!1G-_IVa3uXx{?xI|M~$$f<7srJB~&(lB3`1CvP z@J%UQ4T(QOWR_^k6QgO!DmG8FiPKO)?nt&1`=prn0k8St*(%XywQMKr(}WyLg%7;@ zZR)Bq4NN~%wEgP)jR~t6)=v43rIjX|ZCwi9_mnOEz4?I3q`F6OJdxz9ql4tPm2E@r z+}QWt+_{>{GGtZD7sRnn`N=3CgKcq#>^)x*qFNABY?xQ-Z#!x=uXbKZUq%l{J^;P$htt|f89U68M z&mL_@@9$WMP!V|d>-Eu^)bAqVra*7`Q%by{TZR?6G?EQ}O7fzYbcT9txkMwv+}8in z&3RR4_OnbgR4d6IZ2aka&n_3PKvF=3S3Uv2Fdlj>Xf6(#YgOlAV6SNn+bECg)YTr04wf{(oO{DT;( zzv z6z0+qzqjK0=1?+z0p70nmWxzp&GPq6x=NRCLGY+x(tntg@bg!dtrM2EuT0h0lvV5AZ7IKduxB|eKJd>9 zsrfcU$(?#=o4=*{nR2=sY<0G^r&F}!mi+Qe=|N+tFV{%1ulk%BQFddJp)*shjrQc_ z*P6-JFbxgCc!yn&>?g4&tCF|q{(ODbUc;Cd9W^?l^H%%3NLbily(F*JEIA>)v_Zd9 zVOlvaKF%KINP;CHX+MOsxSD%J?_jQ*XSI}$5j41jx$t4;!6OW7sXVKRshhFSsv<~R zngpAAo3|QY$_3w{JUH#1(mrRz6Z_4nK*I8H&w8@T82GBOl15u+r!^Lj)BOA7QxQ!m zFLn(ArAc)^j=6__MEyOBk525?=jPS~x}IcpFv-uTv+t!qBg1<7!9N(SgjAu(Q)QPw zdD@J0bHZAO9nG?lsl8>(v|IE7nx?9QL8;Uc?z?@L@$3ELQeK=yng8s}G#N?HD|<6C zid{5c7(A3MqM#Bq`>8RQ)*DVlb)btw{BogPytemY@RVEAeA+E_^pu_5cgX{aBa)|G z54hM}92Vc}$?3f|-ZxuF%wK0o6mU1NTlq()`7>10pQ)?{@%>SihNz?$y9aM6|E&(o zs{!?O7NV@iq?FN(gA4}Qh>K-9n}J4*hwo8PaCwpcF2I9HT(Qby&Aur^?b&avawX?1 zZS+m;M)zsAm|BzRvscU19|&0u5@g^ z+*S3^Ozo-+UimnnICklpJ#SuZa)x6jGRGmcmgH~9&U{tfp`hqpWEGjZ_NUKOv(jM; z60vc$_Q#5btcgD(4JWtqeV(nGa)j}{H+!_N|4#jzO~$TGzJ-C`ME20*t|wyopA-ov z_)j^qLXBT7wl!F)bL>53`L|>O zC~(i747+aRNn}5+jlz14P>>lM)k3Y*Cz>+w6`a$tT5^+hw&ksbbARV1S-sT~S_Go? zAFkoXDtle6eS6Z`-S(OTVmw)5c0O57OW&8WI1P$2G;V{vYs&?yv1Oa3o;BeF?e%s) zxfaKr2i#m53|9GKZP+Wd80l(FiB#{}Ivnki;%4rtC}T<-AYztBDo|UuFq|zvEaip> zy3bj{&H4hZWxAgpS9cvjU|-=e)Sl}wFGv)t$FLr`Zm;xte*Wz4ZT{V;jQ2>R(DYwn z{^isvaWb`}n^VehXrlNxoU&dKr{4@zcYY|p45VM&;19Q}~` zIIAh?QKoEtFMG38xX|Ebv{6I}sb53J)uC{@P#}KU1`{jKp7(>%QKemHhnapGtT_uJ z-YCq_qnE9fBs}>fd9*7U(K{|*vZT1HFKnBFDQ`;_GBG7gJxcyQ@H8QkF!DBC@Q<@@ zI>CSJMt1Y>^?Fi#g^n#!1Wvn}MnAlLuy0+59>PbxR+}yoz&7=kp4H4a$NRv zoGJ(r6znlV5oFDLQ|6PeHr9DXAD8F>w))KRt>92R@%vEx*_*Ge=+_@)nbM2(#pvJq z_gK<8cx9!HBIqA}=1XaVi-9;%z8gJHIJyEQ5if%-W=yefQ2iAdKb?Bo8?Nuw;Q|T1iscS)Ue|$Y&dP?$+e{65k2_f`o)q7B z6M8#L>v3=o{o6%ljJ)DKvHLXYvH@oIWK|1dJ)hGfC?De85DonF{03FnNZ9KyObr`C z$MOTN$3CYf3GrG5M6Hjp&(ANabp?ipn}lZO{L1{d-3&AIbPI00?rSi&ui?$J(yMtJz-X!`Vcw1y7O<4}zbi1ySzoR%#ozXg#WkMm zJ_z_V+cKki`hEAHe!zr$EdR<;wYy?H%&)v@Q!C%=oM?MY{Ek9iZS=11uTsJ4*e2%@R9zU0@EAp|1 z2%`>XE+zM;2C`~Pts3pW*vu%Mt0fBDBmRDaiA7%E*q8#vNAaNo`#J0W&y0`vUOD@u zbhrOf+`lw=g5v4q5QGx(#3M%`z3465Q&VP26uxH(cXbhEffzS_W7Ang?+CtFpF33l zThZL#EPPtp!h?h8T3<>u95a+lPQCl(YgZaWAph_K?@q0`si$T(O9?{0ZkY}F+i^}e z@|gQSF5srmj1oJ`{fcO^b_lu`YH{*r2@}Ou_=Baw#5j&qKC}H)Yp#lJsDj%a6w7zI zx053uCz?*R!oTBDQ6p`7ibLHIgfdJ}SAllJ$oYLW8p_8SHoF@)nOK}7FBs3PZbbGK z?iQ!0*0}qfRuqLLG>tc}YpwN3Jn)D<&X?~;Gi81+T+8xiTT2(-CF7aGpST7pXhd2g!}dCiq1usWnEkZhdwoo^P2L`teOPBZ#X z8!`DcO>UdU`1I>a~IC| zFx+Z33S0AQYWqCv=3hwFWIZ$g@KrroZtcmf1GMa>r_jDDLU4SRVvX{wckJPss7LD9Hm+7;BTcT zR>`?qoBB&vTRX~4jHlXLwyU^Ww(Y>-ygbZURHfkdZqnuTkUl$m^f#T&^yKf8?;-bd^pI^O@mVAuBj zqo6Lk!h{1AzlC zcfa92@6PPIJJ0)NXBW_Yjnld$_eH+VQApIOR*MQi^l6XUa8*PRWAqj?GTqw#M>!H$ zz~I?W-+YFmT1!kXy3ALxvJM)}n!V6W56>+cK&gbm{t9Zkj_4oupo_&2!Q9}uoRzFi z)HIajqY(sCg3L=i)S_i ziX6>a-g69=jGRBD_uz(i7iR;AJsDt?pew8Q}uKY)|5d+a*zoixyoxA$=wDp*%mkp*##`TwVw@y6hl7SLj zK<_eh;X3EmNh1+z)6L{m`jZ#cH6g)=rR&8Pef{*JYT{4Zt3756LXLK--sWnyrnj|> z8HPZ-EKRCTPy6$FlfaSo%e(G{WnG_|0(1Xqoi*EKDX|$Tyz-<%VJx>^c zYXh7P_O+~c?qb|H+8E~67NhTLmHaeti1fp(43pU>f7x6rGAzV)*Ui;0Y}qkd##--* zeW#6N9i8s?b35$F+m}(C?3!#rJIBUG`Nvh~AMLR^-?0SWV+=yq@ng>74qxX*Wqh28 z9uiog;MfH3$x@WkYF+X6exz{gi_z3t9`I^anLjqu>(V+zJlSpz6W;-U$eh*2y-8bo z>Ku;6pJXvH#3e}zB!C)Sz1cn%jtIHYTv>SyyJ<>4;t^cs@~+hA0Qru6Vzx>I?qPCQ zmhaiKv~jEsetW3beLGh9)`vzbhNwMtFq2i)uSZFJ9T_Bcp8 zpft4y0KYED9z2Fdf3aI zFYCou$Gu??A_{)pNCqRPn0}?Z3b-MyhmSa6BhLS8s-Q-xVvn8=Jikgkvl{ctgO6+kAq9qsRYt)G rV5rF24B{5FH_cB)Ae5)Q?6%=w8 Date: Thu, 28 Apr 2016 18:00:08 +1000 Subject: [PATCH 116/439] better res image --- windows/keep-secure/images/alertsq2.png | Bin 101134 -> 61887 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/keep-secure/images/alertsq2.png b/windows/keep-secure/images/alertsq2.png index 35f0a3836b783f2b10fa5c6fd707f59e577ed06e..a11b5ba76b1b3e87073a8a9bb6b9cc890c316e04 100644 GIT binary patch literal 61887 zcmZsDWmsHGvo!?w1PBBVL4yW&2=4A4++7Br;4XpS0TL{@ySux)Yj7X@ZgS51-uryd z_XF6|ySH?Ab=6v{Y6w-36GubFM}~reLX(sbQG$Ycbpizios0+%v~ay%eGU9UvX{_w zf`UTtdijBlr$r|K8WEf&WknIzUSI_kM^0l+X&a!M}7_!#h7C?vJF&S7(|#%58Lqo(dmGl>U^6lg{y73q{XXZYuc zz`*1f>hEDd-FSU{J=2#qsE5bL{i%E`TU%SGt=-+Y`1tN}qh3zuz1O&mdPS8ak}H8P zHwiGOTv=H`CFV^c6%Jb4*ibTRO-mz6<90DzYx4~V3aS8|=v^Nzifd`5^gofizzvFOPsI?oN%2zJ0tYlekD}Z?nUX~`o zwW7mTpdIKFxPtMFt@v0vGu7W8T2}TcHa51-c^~sV%gNuT3$Z2xlQWZEw<*=O_nB8Z z>TFqEzuaO{-Ro+ZNs1Q+k7&*E91#Hlp(l#S%8jAF@$dW-l-Vq@cXV{%Pt7bYrgn9S zG&MIL*c==m%NZJeC@8=u*3{HQ%4S@7(QC^0No$;+e8e5j9;6=MD>yWpqi$84}muohu<3*oyf%=g!}-* z%%0x~!62ZV?1C3Bc=p0r+zDaEZGV4%$$d91`}gnJ`4M0YBt8(|*2g0|>M%pMmnHUk ze!Piz$CMfPp@nJ5`)1i?re3>#K`Fs0Tg)AGTfFaMWp{OgpR2UA^l{6*?ayh-lgUu& zD}y}6Og#2s3=Ew!HYscv9?uwj4qZ{Ut11Mp||&MF*9pDe^b zKgZNP8%l0v2Me&@x;z99K;myd9o?uP1Ap6v50qqzyf^y_%Y~uvBpMNRTUEp%K-!`WxmjB zZf-$q+vpB=Kd#^9^tj9;4Vs!#Ic_}R7mFqyZgRgswdw5WKxMLBtSOfA>RFVDoUOIf zcRieI_s8Iu0QSH-TMG9IFi}NCMKrq|Dm+HB_^J6$Ailes6aC$%^K)c6BAI4_!w`QH zxNWwIyA$f_(c_=P)+!zdkI+0UuTI$ZZw{>WPwgr9TFs{N=J` z+)dszRl8kENj7=R$PeT34_P(_Ep0Eg27xNr$+>CWC>1V%>2o(R0oc7KHa;b96szO>F@41y?0S=sHq@hrewJ8kv7 zQ7h3w`t0af(a&^wS? z@g)v20-RW3LRC?aMMH}7ru?gp+*`q@!jdBK`~0>**e}zCusg-fYKmoqueM>y@RYJ(CTH<^8jeFzO2p|gnA@B-Kw*3O}(=Ny_ zx`vB=5ONnA4b1n(`g;2}GVv4>Lgfb6Bdr{juI1&l_0C|JcMNpJrM4~kqN1WNF`55% zD~^Ujgae-EM_RE09bK8z#n$yApMz6bhf;Z#^5}wEUVg#!NR!pU3f~@K9zEOmOpW?X z$84fRZpjQ4DE`sh>=Y}>E>AgmBr|}plgT%Y)SyLCvhPxq{HHgJ;;rQ8casn2b4^_G zi9=QbZ#9VE$aUWLnrXrOsr@~vuBbqn(Z#5g(S|TF-|62b@fdNz>UGKXR2Z}o*HC}9 z&Bld9XQ>cm1tn&4y5@HK3yVuBBv+MV16i?n``kfgUqp`Pi7e?~wgxC16^m z*WG-|3KNJj__<|ebx&fS9SjUABUW3%U`qLP85I?5(2@fJKR-VdIRyoi7sOr|?OqqO zJe|Fn`}?=k?YW7^J{i0s;IJ)nlA)raYHDiw!^aP7pWhiiDYnZE(+doAbP+a-HEf#JvV!`S z#woNgy%9U;i^|rk5H#(qEFcV1dK_?AFQog$uf7wq)MS{bJJE^-S>4soug#Vx1P7xz z7Z`!X3GSwq&nI6`ZYrJO;p=l%M)LbcwAOgse9|xBD$1Mw(G_iB;OjgRZgh9adH#_5 zrpA)Gj<(;&{&Wyb{{q&tVIaavCcoSlEd-+Q*chnzayJBde%xcVY-^J=|V=b%noMs(0Gj z+A0GO9D`2X*p?BaM%h>J3{p*}MANagC=~0urVq5oa^rt5JkwA4 zqki)>h_7Q~`tZ=2jfY1Mt`Ht0pBj){s@MCM7McxFuY_*i^IG=vJl6S_LyPTr>^m&sd z-PMm^%jc8xm|)&5QVjPb4*>C&ygBO41A?)N{F9@W>@w4@ffghlrRmAmA1W;1`GP2m zg!18MAcCq@R#X%iI|2x>ptiPl-pI--8iB-1;qkC?RED=EKRGb)&%RCWwJLv28iNW7 zOKtMf&6+<(!PkYbLDR8eS5K8o&&nIZ-zV>n zZdhGqKwA=e{J&SvJ1=H}=WLHZrAm5uaO*a@7N7UmpA|Kl*Jb$JAw`NA8On<<! zDBPUEX^Q3@Su#-MkDGJauR%eD*-|#)<8J6534LkQ@))TPh+Y5cQ7cQ2#!7B2LqT1h zuxxibO;rCWybNNUz}#w6l*kCspeci;ItR*Gm{R3lD$UkMw4la}4T@2DH*O~+Z%5GC zK$4`_lQ>H>z3n>#1A_?SDfF`29NXO-Z% zu(ZW+G@VbiW?G3oPJS%2VJ3e{simdF?O%pRdbCs@2W%KUxAj1=#4+r*Z_9zbAIEVR zn*#cW8m6=ZbVj4f{Ea^XhG}06XVYkXZF)<-i^KDD_h0FU~251CQFax|$)E#=X9?18;uvBjvxuQ6Y`P(_^dCYM@Y*JT z{9i&=^(M9nF*3{sayp#-#NjJo>@x6lZ$v0 zW@z-4n?0?SBd9r6z3J7J3$v_A`r9)Fz|dH?x3`h}a;7Vyg&UBr1Hz02NY~$q-7x*~ z!pg^-ybPHHNoWq(QVB= zn+}K;av++SnK=c&4|vT{J($Rt$^$zd@G?-jbzBs@HlZkM)NZp5N~d75l(yl^;LiE^ z+gy)kp^zC_N(EcqSm0^-r{RGRFN0(1e%~HApX}D{?D4n{AWe} zZ%0iUrI)KSRcT4tT;ZOhc*Amy#HF68J6SF@)4_QHQ9J0eRh-Gd;#DyvdofSonVB7J z<~#z2j^r7}LOWDs?iQ`}n^;02xi077t>^9a-{_*kHdarXI>DJMrhd~nD;m!%6g%j0 zRh%y`WizTvE79PU3=F-}xQt5vWT}5LeFt3%ku*iH-Qe@4$Cx-#=W3sQgHXAI*<~p~rx|*UtIs7{A6YW3GSl7G+ zx%SN0drXv6J`2k|DD$vnOxcAirV7Q@^u}ryfc2zI4_#xCwcneP2GrrGCFsyMSUS!I z4w_U|TCKYU%u53DjkzbP2}|yv3G*cS#kx805_ADjC*{< zkK33o6KPujQ;wI1f&t%?l((uc>cvV7F<>0GOwuVLvBXZB0?VDf+tNA|+n#$}=P(QL zCDgmY<7EwOT+-rZ2HbRnE2lQe_G4@FNDl5(Kx;5jHISen8EOm@e1HZ@>{GWM>nJLlVjJLp;6OV*|8h~qj{q4(c> zOPNldQW6WspaJljGV+L#wV^^aeu z`T*j);0Go1AdXx15B(Kn0RJK4Z?;18NU|{r=I`=eUK}534-2EE(D^uE+M9}!T*cPP zWrY2AQwfc=CExI*gHyjp`_)&tLZ?6CmR~~@aZufmPv(R7&L-}E=Z&;Slk7mCU1XtdC@;dTnBvS_2kP z!n}vpeZTYO4!=i0-jY(sd@mVGh&8FQva(*-T#;k(01))X9sfwK@N6Eg#LXYTR~ira zASa5PP5R5nUGBlZVtvQPhLC`8XueK^!>p zoB#9eq^(V-xVWDgDCrqds!eLj)0u*`q;`U9=gs%~t8E4<(syc}d>zi0i)xrE&EOGV zD;|a+aKO*f6Dod1@Q{oW^RdNLKbFvx{P7`GfO$B8WqAwi?4-gnr`$@whz3%8{hrX> zxRa3C?~e_;p%44v;t-QX@9Fs+E6in@CLh-DEp7A_@f1L*ep`eOr64XNFl8+)Y51b|54Q*k1J@w_uC=>+Q z8~wobr28`$i!To^+XE1fut1Sw!tUQ2TlsFr8hPV3Dls9@c-v!pYIktu1Qv?&gCy}6j>RxMDJl&mSD;U|wB?I+k zqb#jO#N7ZI3JytYcD6_?NRbMN&R1S$b4-sH@pSvK14X?nTNgS!O(%yU1{)SnZGpQ2 zngaq2RLtj3@q{+XNr9jC9hJV<3%?Mn9t&3dfq?<)k000nOcz2fkF@J6>tijl&XcCT zV;>$Jl~-4HFD&2#g7prba#9));zL72Bl%09K^pX?({U`fCQnvg4P;?pU51X_O0t~R zw+7SwDSk$ac<#@Mv2`!7Wh3Zk0nPUIwrQ$+ZB0#2Pfu=lFOH2cOf2ZD;WfSP*IA{# zy~Sv4U1(&;cALeM`N-Zsfi|h2AP5hVpr)o4B$o9p7EiGdp7JFANrImg>932k)wpW_ zIq8K% z6d@BxWJ8Ri-!ohp4Fk>@qdJsi!6&l!g~y9rXw+Ea(W(`#HI+T0!sK}!5XPDwuhE@?KiGa|zF0A&QJ|$!P?4P;rnfINp<&GnV*n=( z6273Koi{|0%&v4$(uoWvYoA$q$!sNJ`>S88sw(DvE>3T%?VH12o^xC;czJhgAtC33 zO58HR^MwlFgk}KMNufj6-V$Gb$#}*1#-->?w3wko=xhjlC2!W)BR6!9Z zSxVCP;VNuZQN_<}oy!Xfv{e)=1s=jwCji3TK?i7&2!T4VbK>LQ78EGy=y)9wxlHRR zC&i0q4VV!U5}MDJ5Jg2r%`Gk(nNZ}X}HX~ovZnWgc6 zBBk2r84}B4XATdjJokTWHlPmg1?kjL_Ee`$*K$yZDq8Z+3cRdTsx07uskK}8x(29x z-d~1?E{&J895b8`*Kug*EFQ1b6S~bOr*)FKz5OcLHrE$8l2q389{)J$HF@&`OSsa9MAzx(%9)y({@`WX>km{J0NBM&dv_-0MoOU$6_Ac1biPwB-KLMWbOzF389f}%A^hm z4jw$A8#e|Z0YR0h$cXASF1zLjnnO_SGi>dPpXaxGc3inyp@ZTY@{4UxhKmGGP zTJv&MU1N}dmki0PFtdOLKQd@yLa9WrIm~K0ZI~r*e6(-6P+bwbTY(#3>h!q@t+O-= zzo@^%l%_)XAOo4A8on|Mp_Jo>;M<;H=bq~OFR`G&^^*xjZEmBnVD#ntGUHj~SP)un zqOy1o%nv@*N*T%>UA1%S{>BbX74M8VmM2yACI3Wan>W+UrY`M74#)gSTe`H6t8M;E z`!o0|NlwenI1pSsrl?>R^=!=DY7&5*MNI_?WtXZ)&i_;va^CFG7NM21898@gZzkU) zs3|E4xw~_{eS3~Y9`H%vt%6Iarv-h#cfM_F0X6F+c5q$j6wAf&Xp?3`MY86sGJ6)S z#rSY07B65(vIPs-cilPdPVV&yitMeYO54`;ztSJY+0)&>Qz*u{vB~IPJW)TvNy@yM zIl#OhzWn9S|BHhy*NS9KylxrK?D4wt{%krrOM2n$qi9}au2KoLxr(aKSLnT7g3bb} zV~+(`pYhgoLyb%D{N#CisMem@>fpeDme*lL1v4wYY+R`&Fv|+n?KcNS( z12?o{Zwy5Re*yMbG7kcBjUUV3xD-&iuMTIJS+sI<9$ZUHLzElP z4ve*Oa2)m=x%~!*g?x9?w@B7o*b9<=8v#092Aw5$c$#DOa9;ueR z>0ybk02Yfwjtic63*eHHFSg+Vcve7G{!p zAq>#PWr})h1zVJ?`@x&cKEG)M>(L2Am_((^W4QMt!fNMvAgolT(1F5v}RVwL( zFJ@-JKtxGMNKln}0+Ntrm6e_2<8N?rak(`#`@12Ta#E}JW;18FWub{-))wtfT&IpC zd5#7LE=shYr@s~m7E{B>;#rDvDL}t{tCAtFuFxjri+scg^EMvRWm8p{*CwZ0K4YG; zi!hZZpV1yyR#pXvLR(h0C8oPc={}3>6l||d&B(Y5;3jNr?3mQl!K24}^j3Nwf0Y!tJrYtW3x3Iw0omzSsQ^^uetzaNB zRpIUJ8x<87f25@?bZC|p6%AZ}^|U~VMMy+s0YvBP>+89>ITgtj zdLU6#Q^P*gvbeA?BXJt|iBefDG6#x=It;ELFy7TvH#ONR+^}Gn7vFSR^{r^}&&*6h zZPjiiRqbO-1Ja?A7{x4NgWZv|Ao>?bveM*k8Uf@FEhlCh7U$;PJ>>$w71Y$k+}-Q@ zlW#UQ41xKwlwHx)(E)gKPkTEw4^JaL%L#x9HMF$>A=yge^s4$qNQJ83(Qopqwk{8WYBzEfhh;2@j6>%n<*|4)F$I$%0Eb@C-No)G)yI#a z047N0`3%TWpGrWp0=4Dkf?4B9O)Fwq;|f5gmtwwj1gMn&YCksj_CnIq0L}f~quU+% z3IJw5T`+L@0V>u_&qVQfNn!l>NS?Na%FJEL1DCQQ9nH^7!m>7eRFKBojUW(tJdjAP zu+?RUL9pc5H(OFK(rAbKS$UfYs5vy3{Z(hPciFnnpVaj9Y$Yy%%`JO9U!uzcECE`7 z;~8r6*#Pq$xgMAV1<+hR#y07rY?4rl{#tR#P#9g~C&pg<^3qnY=2ApvR%k?o@%}`P5;IwV`30Rq+0R$BaFm`mTVc7cj#8Y*MkavI zbPDA$IW!_zfK0aJywUlXjC(YAD0`56sOh3_x_KNW|j`(ip6TSypNS}3Wkos z6Gv@gRf7_&|yV2sjucT=rhUg$X#z?RED3^a1d?s2@@sMSXtmddb zu=87AtN@UfA0E7}O`hvVwCVLr|FnK?IU4&l!1&s|7o(-pY|`x35k~}_?LNZwVPX4q zQz)LdP;xDMdOtn)ft{93Ax&OEm{=AQFAYr<3EHgZFnj!<@W9FJx;21u1+5jHW-ya5m(l0LJ@Ng*`1IP@%*bj$)jQ+b^R0=~) z#QwoqOnv#mp*~5-{rv%PT*%OrZ8XMBufP&y&#mL}k!j^S9#_6r>Yt6!$ZHC>JSxG_ zp&kzIniaP{VUpT@oAPc=>^R_O`;N}XvkY9c{z0TGjxa9%CNYwN0!ys(FyxNT&T=5( zb3O)sZfIzjs5Fy5uG>WK@I@B=^~zFrQzN4ed|ylx`Xa7n>hCDFiZuf7e6&!_!V6FV zRIA#9MPvuQ?49O7)*ZD$S*C;~%X(@*f!Cky{yV98Kc?nbfIn7(CJv+wdQ%iB zrbrD_ge}^LYI!9fBOZ0SlWJE1n1hfI{#4Fuj-uGD6V1w71ct3ed(XXBLMKIy-hc%H z1Sp=sumg$8FJx^evXXuvd-RjnIz4#+3Hf_N8h$vqwXFafVQ#A} z_nFf1k_U(bpYj*gBT934A`ha=I6xW~$k#JQdK#@L^ZrEX_`Wr_ z`9s4+$ZAagQ$$15fWh#r+4`Z~&?E1GmVT644;TAMKL;;g>n`d&3o>Li1y#nUk#N*_ zWR`1|!_-EKp~B3F+s;R8^}x=$H3vI>tf`y>CfVH%IbUVBC7J2#7jDg!RfEj5e65Hr;#N)RqH=B>1DQ zDdzHgcgMbXC4yzPSOjz9PVNjR_BT}*e+Ky?Uh9tVKAQ_A5D7iE3j-YOFJg!dqB;o^ z3eEh2q@kuV1qm<%Vx|%e87vgh-pUiMYtNHVD}r5jKawMs+PPd25$Im;i&>CBY4b$< z(M6(D?qizsep1)jW|>g9*dz`MZsA7VcI+_zfJqds!#|d4mXq}@Zum16yuOh zfMNL3d0O9=sszgXj76O!f>j`niWTKdR{_Pkb|Kkh6CHf;o~jry8r@ z^M)9vSVHzc;HmS(Sn)o; z>-k+4!G}ADx{9mLm~d9uh^73Sd)i%Naxw;@N(?8=d+S-6+ic3ncgJxJxiqzmyIy!8 z|If-rysRAOXg>?0CVw>CH(^a3BRj;whyld{qW-Zj`U$-~SmP}I$}KCr!mr7McHVfx zGqcF86FkU7=8#-5ZyHKaCL3dgaylf-To)bnH5gh_%TtyLbZreuPzK&@$|FjHwfdSH zP?QL?*_8pDpR(?$8A1@w)2Xj1wVQU}zImG#@pMnl03@Z_Ly}=%Ek6^<3H891HK&T} zr;33M`vx+lHqghsw<={wY@|blIqmellNbb^KhwAqws>$v!$)*CM>Xk=*6MrO-rl|n z^=}%xNpEHJpZ`twPWq#OXTyX*@mK9!4}(^&K+$VH4JUQ>=a6cXFlEvc-SSL3TRdXn zhVcUk7kZu6-i4J84F|XHhcOP|o`Aou(#>A4A14+P8&3$HGmJY; zWRNKLx&h+ZH|?n5cJgfzZ;YQk(Q6+49USaC7_Q$_5q~`rAKbvwm(L&i?zC({|y#k#tFAsRS-&rQ``!|V%7lLY#PeSHD%io1Z~h4dw5CuAzu0iBeXF5u9!*ULz32*J?%;^ZV1FKg%lNcJKp2b=jq!0S zu(B|<^s7Th)k@+zdPiw}$JU%Tw zm4!8K%ai54rTJu?l=NRL1-@bx%^NnTN`B)@Z}EX}`K=y}IP=~5uK&QdO1XI8(Pq$i z!&Hr{TNk#Sa-ngjW&cT1__s7pfQk;qBj;E?R_;V+iN6i!gEvmjh)GecW$%R)v?nBu zKDp-^!Hg5!pThC`Ivb_c$yV4qBSnkp)T>A(f1X<|32PNNiNq) zz3aZYZLii#j-BAUYZFHa?beTVUEO)pM!6_nrd$|k^~pIWLii7GM#^q0sG zL4vwTNURlD*I<#IQkbu*B!|&xT z9F0AOdwZOc_L|=`jFnrHJTE%NjAT7>p0Ast6H2ZPHuqQSwJosjYId4ncgiq9Jw$;%ky*n!1T`=?)Z&icWi%hhZ(+09MK7yZj*D~Tm&Z0n`sGslW-Wp!HX z@RAf;)6nsogwP8;Z7<53`Xoq8O}6$IT;7S1)A^en=_NtamB3G9dQA;Kj5lrG1ZxBd zTs&l#JEGA)b4aj*FS&86A6m7 zlqp6$jF@jXl8y)p_$ZC>g454-RPqF##CpN_u-n^G@m3UvN7Y~jKp8+gz&S{arTZ&! z!UB|9O0`^&qHpQ5ya85k};8^hSqba<5xUrs32<=@AG){DKk4843hB_%?<#+t_W}2sQ! z(OK^a?bN*Y*`;ORa8&Ms>cG*EyYbYwm{vVZd4Bsq6n9sKe>LYc2bXXuDYO$-K5O=; z%ODg=)bp1?UJ_1E!k<`i1rH>bhD!ISrnbDpdlQb=+5~B>i-+d5{Bexo^blT@KTUUg zTNY|hJ3T{d@KaTu^%ryL7fp4=Nw$fDeTCc2!Gg0N~+Fr8yTi2q8-q-6jh4`2U2$9h_jxes3_Kt zk8L$1CBdY1uXl{S4lbfrkIn0SF>KZ|7Dt(!7i5B5E$R*IxQBhx!Dhp=___QZ!+6Io zgU|YuJog^wN&QwBe@>O*oqRx>&E>^~3{BPfM<5YHL&L0l=289TOE%Qwv@XmmzA7yA z{i5W`V1pCc?nOFiB+>{w)=aRi7vn4Mv_>DcltT4t65WMDnwf&IctsMS5S)$YPtT{N zt;uzAz@vGXuEy`Q*{Bi`c-@QIi!VYW2Pjvx)~DXmen?N~YNklG8K7B%bF+|pb-#+j zs*WfWVhP;e(94MFF|zBjzp=WSEi6+(Ny)Fc#kgk*Ed|KDEPd5^_hzR9(J9y=j(HWX z@G-*-iLsordEpv(=b7P^VaYN6j4Z3~pTuh;oo9wLg|CDIU(fy?h!k^nIjO0s0kT%= z?sN0=21Z6%%`vK~O=Eg52@v zLbhzr`?f!P*>Q4~&$xRTDd_v25`P3_q^yB2BDoYtsCZM5p%~`?;^FJeoFw=BzR&3y zH7OXFm!p%Cd=P%YFu%;po%x$MPVx8AaO4gQ-WU*G3`tK3fkasT*aj2>^qw2EvMTF^ z#$~pEoSdAc#?L@@U3Tzrkkw88@%xj1hM`LvYY_D5tFs^!&FYDJlCAvTUlx8Vpo6QpJ17E9*3~B#AT5Qt!`8g#Kpj9LD@Vux~4h{~#{Nv++2UJ=16atk+BFZeD z=jbakx|nU1jQcH5RRaER14*FtLd3lpU!NFEeqlqsfIo4PY|6NN7u$$pz<;L+0+fuy z!$WG?$(6TVK*BjP_nN>@2L%wptZi%@?Ck+D6dmZ&dH9n0b*TL20;B~aGsn%TX=$_S z>XLwZLS$rQ)XL*K6N=PWpDTjL!^XHcfx75Y!U#uv!@6C(GyHS zKma7ZQ8}C}rS4EniU9{ly9#KWeTR+as#=#lGC)c$1;{Rjh%x;u3FbQ@%=y z-%C%C%Gl)pPyLy3zJ!DF$JV*Y)9OH3M4Tv+6ej$aTZi;~``_*_^<{{pC8A<=quyI&BeraIij^tk7szmx1~u;vVyf-xUm)lnsY!t9itd&aFgEw{dx}g7-2pjb2ng7 zbfVW*>2K&jWbi%PtP3-hubqXu#V3Vj^Do^Yot$r`y0tri+&$_-J7^)VIs z()|bDtqLoEYklJh%>Pwg<#hgKciz)|n@u0R>5-iWzNtq8^i@UfVInY?EO$blhZ%{s zHG8idH+ivgpig#ZmOh+o^)09U&xLdt<89D-y(yk5q616ZOTlZMFAwaSeA*Cs`cNg!7A_*F9vVUWJ{+J_Y>->|pC5lQiMEZfD+52mqj>Zcl!`ATKM85%2FrPy@@uL?M$=$MRV1)jV+%-~vTH;L2hwqG$UtKCk#wXk!&>C!9C{BH(9XRTjY zo#X1a*Wu`ZB78V31Sa#LS3RisT_Ve~7^@SgFvz5~9y^jNFqCDECHnpg-Z-})SCOYQ zqHm+0vTn%$t(-v0ol9fx)tsRqSB~Vte21{ip=IXTEr~|;srYdcJI>9L0H^0TF##2U zPM8yftTw?l9_EYHFQQUY)O_p(IOa@!^n;a$1f5RTva!dv6=h$~n@(=GcA;hPZA-0~ zl9Ew~JAQdIY7=i=!!TYv(5@do7W25e>hV^5fro~io_0Av+=UK1;tzlSIG++ad?h}{ zXhvk`lPc{b5fMp|rRjkq6q2I#ICP(rm5Rr9D=YSh5yVcu4(vFCvHIY*T=`H`oYJ0- zVD9K{J8g|7AB^6cuGfX5+@rmx#|r|8T96Ozx?hd%>zL2+{NUl4EKcDz&}Sz~oG^;2 zVC*;OE}74A+Xe=L^=i2c7ArBliy32!7mp{WqgI`yzhYL5XezoMzcUdPI33@hClqK2 zlnu>Ybh+6V-%BlotVOEV73(6UHSUX7bTea$C&D~&{u@se^?|0kC)m$D<;vR(0 zvl(IuRVi8A5=xXdSS+>+SXviOpNR5SZm2(=~DwF+Fiv$)Xdshm3`Amdv<@XAAdt~=t;V9P)o*;e+2UA#uccSrLWkr6{wUJeGI-U-`|XeEZw{c z6gK_DrU6pi3uOx+LHz=|S_av)r8`{^@8BW`Tj7F+Fz=LNjJX`^tPG!$Ub!*mHZ^9% zhda4JjyqKs>EDH|=0@M{Iq5TCqZ^2|rZAzp&m{(;2z)3Uv^ z(Ky`L6=!)6o2GIy{!*KRlvG)D^>*KGhSOC)6`oF3Bb%{oT0t{TfYaggxpvepj-tx( zSASVX_|dYp-)y?c+|ykcf!`jjo&=R<6(}RFyUV+97I*4-v(83{%+xDFIhu|<9B28w z?JaIY-r%o^B^`CpJ5}NXfKZFQ`TVZ}Iw(*Mc zRI^W%GN?BbOjc%aEJ_TXjYPY9tRzH}d>WHp5b@euGJ98VM_)=5fcIwfGXxJ_q;2SQ zE@d-}oy>hU%wv)Dfl@ZVt4JpMu`(L#%Vqdw-)t&13KB&djw4p)oW(t7G{T&aC2H!3 zRty0sbR9+bET0}qw*y;ol+np3G?iV@oEnrsUVb}CXY1|C>V05tM@Y66TgHz*{V_D_ z2>0Ae!9N)8JtZ&UhY#j!s|_hfD9F_Ijve_1;#qu6zp~g=P^~O)VYCz!zQ!p(j>ltT ze~rU(d6JFP>`W<9w&(&En;$q!i|$O-tY*bCzD=$Rl?^b|nEFjG@fcgXd3U;0#X|t` z?3T!iy;%U;skoZ`XiCM;dg5P$wVE+zaixsem|$(ZqQ z@|^2uoyt52q_3_=xTwlAS;F%)PMYR^P7Ja^ZN)8TD+~yRZQwE){1O_mtT z@kgu2@$j5w2@`7XhJ;seAU+i!JSrz!u{JRZ|%9`s-~;2J^xrKr)sNq%ti z;pPi9v@ZqW)4DSITK6WjuQB0#FWe~NQ$^Xna6gw1p-}Mai)$?g{s*7!wJqf;+4&ge_qkUxQ@=0p<=)V=llR}1#mmymzWU;Vfp4*8^)9!y#JjHq*~o|1HrJ;ULF_EhRi2dZ zk#6;I&+oo;KilktGJo*#5>(oHlCZWm5y+rhVCz)Qv0TG`(YxC7-VQC}u%FafgUaTW z9u$AG?mO2(lj{eM;ie`*rUn~{9#AM3Mr-_)!_ZI>O=FM?ys1YnJnb=n!F})>L^kach zn+u`-hYbYB-YC&$&#C5T8=X*oL|=-BAy%PM!p--!j!(O;sE|pdnU@?`CJ#ZUq5ThphG`ze_c=qE@cW5iv|7v;J{_;l{y~&SI zE$Q1n+*>EG_8M&J(-{Sqk1m(XT(SThWo0kDA1;j3?e*332CLb-YdgzL(-V14xMn{a z8P0W))22s+rf*}=U`&Y3m|IBWK;@e(u7|tHY=Kh>@Xjh7*E2aIUlF+bd30sDciQVY zngnd_Kts_lTHPlYC5)b_Ts0;&*sa5gOJb9ukyPxxbJ6ZoZ(e+-VZEF*Ty$pg%{yTj z^%jyOniqf`$gR?$De_H+{D0Vc#~@3hE?l#0+qP}1%kHvm+paF#>T;KDcG#WRr-gobGgz6ETI^{`=ieCP7YjEAVULL&n-8$Y| ztyq44T&krs!zX{ey|`q`3cZu%ca;IH$kFG*tPtpwL7%u4>L=*`C2u}}j;$afPWz%yWd zqisC3_iK6Oeo(9OU90vJ(U|AJuFznI^JO#EWS5y2t!mN{TU%gEb71P1!Bfj)(N9AZ z&ypl7{^M>rquJ2qL}VMIO>u4xN@Yt9M`HWU7-AP&X8A~r4cqMDtLXj%x|V(Zh2X|;G`RTBpyTli}XxcRCKL;p6u+J(zv49VQQ)hoG>V_ISFtI@aP5w5GF@vwiZ zJ>hmQ%fFicz9dFdpitZNPM_S-e`1^SOi|43OkC?Jm3_s!r~FvJ)Bkt+&q~Cs{wE9a zLuk(+n0C0Fe#%+rmk?_-y>j2E=tJTRF^TgZTZ}n74X0^X>ZS-jwN7x%gl+}s?Vb;P zG7?!rAFESvtTy4NIfEa$tZ>_Ro=kJqE9m8l71C|wxN!v*(B%)RQ#em#NF&tt{Yy!R zqFvne5Bid5dg)o|hG;b+RSH`_JDydyx4vk|<=Tw}`(mz&5*6n{uAWF8&Jm#N$g@W~ z#D{a~$7maV6!ea7fUy>OEG%7FxKsYV^oqfwRVc}F4L(A?pgohYbW+iaiWkBYLiY9( z6hHRMVJd~?MeVKe*zpEVK zFA#P$N@S~Eln-7g!!7Puu#g=;SvrC%TUO>at~LpA{t+#;J7LR;;_O6a=N8C|QO$*@ zrY5gIwI&L(4~=^bAzo9<*8JqWWikuZZZ0%)!jk$W6Vx}3hssL2_md{`=x7h0Cma|B zhtckR%tD*I&Ut>H<#rnF607Zmuerb-=eA?k%V z!*BNtoTe+#0^y`If-c!t@#5k&ABkR}o;_roAz=TCOw|lE5|HZ<5u++-vp}F(mC2i zz3iC%^a-l6-R=iw^~l}r8DjL$4s;)3foTF{K}yo>qigP*C!Kx{RQ9!u^&b+$TFF_L zt&}WG7EXhph@`4fBP;ZVoE4rzFA|vVX*cNa7U#=Jl5ID0nzOJ9F9r2WS@~R!Q_6Dv zZd@N5+HM-zsvF3!Meq4Ahish^5%Du6jd9fnTT?b(8$TG469%lk!J+O-_}bLm(qz(| z5;>_KlKA--q-459r0Eq_q(QJ3A6Cb_TYT#RY7Zp%b}rRuLoZB6J;RKnN~!dNu;_njVn-6)r=Nit3$fw5)PmIO-GZS~XW zLaPtD5Kv^ZkNCr;qb#mhcrxj4dRy7~%!W;AdFLw_MNd!QK`o}Tr%4Z3dJ4p^`ee7_ zLq;i^c`X*TGShW``Mbz|$f7Ek1EHGJ7aq*`0+7=aMKe>fI;Sh6jqZ%;%Eei8koYk~e8-K+BxM5VVyo~Z zg^IY31~%60>xsXc-1|!yQv1Kc_-KMglDaJI^@5fbQj~rQ1SeM?`Fu`7RJ+pcYbEJL zJD&&d77W_7t|ZW&iO!%F+2OxlBMR0o=2L^4UfvMess2zX*$~Jo$l?GEz&>)9cjlrF zqm>GsxgFiBLC-T^WUzPUIDAd#P^mxX^>cXR)PG{BvSu93^99|W^6?PGpL~>hq5beR z$U0l+X{>eyJ}XD8&{MV3OX%%k?Jbw^cD=ARRxbQ9*4ud#!oPVtNicgAMD@Q+c;@j` ztt3-n#@X&ghV~~Hx7mj87YW-T2d>?FXyh;26?$dYML?jKSe;E&QWjbZKFTw>KZ8tF zWcOTF@fwf#v_pl+P0e0%Gg5nQZ+U0ioK8KzWag+JYWHB(w`-U8HYTmCdekpQ0sjgF zpNRU^cecGXV%%e#6iAs`+T@bSo(o(p5v@C$aC5h9vk5Urv*!%g|4|`EI%sQveXn-e zr{b67j1l}2?yXQw#}|DJsZ8gT__9WI@z*_s%`^1lKy~jvk!wVO&!7EJ-Ea2XneD)}?8y|3jg0BndO#XE~{D z4i~R#DFbvY_5O8NMU^5f_Jjdx>q7dFos0IF2pjA z)54cGW7`-XORpg&u=)dyC9a8*epI1L{=PcyjR!U4SX9D>YZnq|)j+~!d+KAbxE06T zsr6msi@xr7C?yo{=>w=t96?GS7kO!?CA!Hhz@G`U+_s`~M5W+{Tv4ejY+L6ujJW?% zyE7d_qf2&Bycpro_R-j?*3TC^^vf$v$hV#+B(lD#I@s}#*WWVCuS3GWdS54gmH7JN z+n*&UI?hsA5JqPo2&hkaB=-UhskUFYQw{Kve@YD1vXDbcfBUIty;{#wh#@)JqWta8 z4HrCt4kCi;i!vb$oaA6B=MwRMK7PAj*0Gg93K1kXUxx8hay1y}5!++fh)ccD6>NC# z)x6VwGA{oHT4~AsCO35|H}w~|BMfj=La|OIcY>%r<4lmcs!>x@h$K3gBkPm+wVX}_ z#aP%ahPLd!_H`h3#{lK;_;jU`e!exM1U20PQj0yf&`V(h8$px=+{)8EdeB`Mk;NG& z3!!-TE(|vefvh?#2c!DqYL`oo>7z z-s>%ug2#O!0e+HPqr1^I^7sPMD$^|q4zSP9Tl+_$Tq4~x#*^DHD~cy_Cv4z}59cO$ z7jGY1AJ`-fztDkLD~rt(&B7Xg zI@dpu&q$v}fhiL5iBcXOghlBifeHVSAiD-!6(iH6e;SJKLS$}QT70|G(2k+|O6NTT z%)JU;=PM5(IG*X}UO$#bio;DZy#M=3f*S8~!~Jp-8?Q?cKCc$@>i6y^)W6ON)1XoI zFzlQF2*H5Opqu4;G8u6kzRq8OjsJY6L78nOJj$?|xi)8r|GSTm8PKDQDG$b_I6Pp& zfS8c<93rdnbG6nWSKK&5ME%5)G8Eluaz_4VJY8dI>kWvfSA?9mM(5p!OM+f(u75Jyd}*fNtaHv#Nn@dIpkbe zv=UP8!YZ7b8RpW~RwI5_4zJuAfr?r?Y|tJIVm zTg9OAq1dBO0{ShtJun^0e{(-mn!0AwT(u?iR$Ssjz>|^yGqTm3nGSkf>v(5c&;low zb4YeTS!w7xrm02c^KjUhz10!P-?BCAP85)OVOy~p?}=_bh((e59Fh7UN4x5#6IHeD z;q$I_E-Ft%vkLb;8;eNg9%GE_N78YQCgGZ2kbQO>Y9k2TNT-l(J)|60eLS~9{Y#4B zR>MP8YL5MOK>ulHYL}{d**PufW+MA7H&5Ced8y;=XaT-Qi7fFMV(|vE(v2mQ)(Qwh z_8T(qfejQ!L(mX?{FaDCD}q1%{v8Cwh=x!-HNW7h^?S`6dW!8q+MD5g#8$UO~smDbVt~d zd%FF3Gi@TSQO7YG+jdV`@Beq1%mZ@or+S+v{R{bEY;UjQg+7vOB^}6m&izQcnyj6= z?)+MjiNA8)=f)YNpC!usy!)!Dd-GlTF4*L86daaZr(v4) z5%d7Rdu(o}KX9Q@U}OvrEK?G}sSoT~hBw-c)mk(4_?Htvc8=qf;8nH4W|>mTMktog zHg#?KZKUB;Dy>AqK{AZS_3ShDbLKDZO@AzSJfG2dG|D2jGe_#IQ*_PB?k&#^5LfnR zE_pKPM&h)C*9`G|fmdWqUd&XR##Z-PX^}9`hu%`zY~b``VS0-~=Cx5rspdeMjLYnG zCBTr;(8S_vU>Smgu`c$4YQBzY8I-4bOZc?T2QT z^25!ZKQcU@Ek$m?_BOd$d-maIFCh)YV(X2I=LkqD?JyFz?i6z6$u8^wQ1_*UpQ)gt zfKRT}4KOB2|C;a(`}ic`&Ziuh0x`$Gb;5J3{hRk zKli=zn!FIAqTUzn8N>-L1 zc$XN=t^IonQw&zsBFUBCM)zJtLHDebggt!7JG%EFOa1Rn8Ry%d5yoVM+XTeWc0@FXul1-8?TZCkDtN8ZWz|L zYeiZ}CK>6}SCO#!!!PZD(&TSeA7mAIR4vch#9He7l=l@h(1S|-?&zj^5NVy#z3bw<-tt%yvEqT?m=H$)6e3F&Df2AF zc18FRtdCpV71_KgqZoc}Y&Th*&a{!6sAvc2Dm?}Zpu5L$&1N+T;Rsq4e5>Id9uWzP z6P78>W92iRn7dUnl;>p&9$#eZY3#&JM=)mz+6U*oeJJR_+1NJ$!D=OWXQY>Zqb|e5EW4 zt16?SyCV4e*OVfk>SvbS^UALHM@~$%Kd*o6=kVlCzXQ^axvo858J1PlZo7Rr$NL$I zfO5FI)oFVoVbj4N0!%>^wWcBv#Jx~2c+;O7%3%kZI|scz{M1{gv^ z;C;%YuTB-#_Evg~_q6lplI{?%_E&`Y0hB)C+GOwLchPX3MR7OV*#&_^O@1&^$Xk5Z z{d#z6TiruPE8V*CI!%3SUmNI_FUzH))-^>1k1%Hy%n6RjU58 zHzN;>YRAh=Y%?=N8kHV>#j`(1s$)zagpUFH0KGc8mZx3)hq&X^cHZ$`g-YH;82?=$ zzY-;hrbog_T4bk3&nJD}eKE=W5^C;zY}_z4Ed$w9M3l)fZE(h!vhgn>^Is; z(bC!PRj~?{ThGL)F>pEcdHN!KAM3Z zyXYVRcXIof$k#SYCSdq|ujB7kYJcz^{A^)wDk9U?QmyU zEFZ7522Mpnedb-C$!nllbR-eyf7i?s9)rx=b~*zspWW+o!xm;ynBKCQP2hX!=&F8W zKI90VW8adS@1EA|v(k|~dEAJ${o#C>!D%~jhrRiyjbJoOTBiD zmwNms&i4Esx?R&vf|qYLwOJmw5e|Hsk}59Y6!9&DdxMZSenFes)}cmX9JR7R&Lk4B zXKAbp1=+gY-kuq~J$4W7nt-k-uW?1$^J=JB>Tuo_GhscOsA*LUgGP1Y zw30r|r zb+j~rGCdYbj9+?xz^v3enSxj-D9^a#0FJHMR(>eKOV|Db!_VOgi^v3W9jS?tmdpSS z);V8{eeIX^({^oQ|Bu%8@M7dGJ$!}SxaZwZhNuzwF3It&`s2Mc4#0m6B64eBd(&=a z>4v%|flrn7e)^pCSY8#$;M??-eDMkXj(l-qd1ZsXz93#U_$i z?Q$~EQgb_z^tps#d%9m;r%P!^$YmDV2Zpm9a7|k9E`}k6xSQjuCWo2{-eRE5;>m2M zv7bDsdN{| z@B2t;I+Td5Hr0N|<<1+W(JXs&6>FIpVxU~8$y=dm+54h+7bU0CEKsoxU*)Zmygqogitkn;? z79yhPL-c@x^Bn7xo#{^w4mK9f*>l9eXPqnCGUaZ~&2yk_x&8S}`x5w{3W3V@p>j`g zknbs=3Y^Qux|$fNn75np=(pCKg`ZB(M{_USQd_t-Ws<@kdX}gtqb*H4vSt(`S`J)N zpHL~%%yx{T3~BTBb3Ir}x8UTaE+=$ogFQ^{w|a2!yH}euk41&hImN$U(%R^@U}rRX z&h((Q$TsG;21}Cg+H|I}oVQDBnv;j*&Rd0r>ry*7a^lAiN4B%a-+h~sN%AuoxTIw& zlI64qF}=wjoSaLv&)bcFsEo$dXVDs6%`9p%x0_>VQ!hI_QKQG2Z+^M}+vbGNjq72; znhh=54~asTPU}+pm&dcw`mag59?F%cb^r8MNjWabPPD@#m#!)vURkn8N}Op{>rJis z#b6P2Kcm;qm%r_D6lW>%hM8ZO5Lb%KoWTq^mMF z>;M_XX=CcVV21!K$sey9Z8jKIW%Fw-Se#JZ!MRY}2h6&~&UEwn*g{Z}ZtdIYJYe~U zo{Pl^)5E|>2a&4Ez|$rZoe7j43J|Tl!n!C90-_#@%xMhY6E6q0hmoh2OsVGnDWnj| zEUdf%MMtoBmYIu^i^=QrxW;-{z$WHezHGGFUuaencRGuCxE-RbZXMACDV{R?Pbha< zBI7L@H_x#)7cZ>*q;eFKa%FC#0HaWr1*J3lRnph+l*)Jfw-289F8X+vfUm@T)4 zR~t?0F6o9*j#G7PYgAM_b9|#`#^)&E;e!;PM3wzf86GIo3W5u8w{NV7x;+@F!D=vV zTqhF2jD;7zM1;N(CPav2hbfI+J|8TW^^z$psELuX%Kf36Qv6A|U9b#$LV z0BcQrUbeK49ttG3)YK8_R|MUW| zE>7jl3Cmx&XEEJ09yB(iHngil4{k+pB-~TIzvGb2ef$u_47%ZSz>~}(T-wJnK;)JJ zqUx&X+4?@T9lj{PUXL8(cSxBaHnL?-Z4#i(1*u_D^8ki3{N*>l(wosvIL3)2baMXl z?B$%IoO|Nu3BmiMczz9&j{d=8fMU5CFyv6^QtQCt+V?Eu0%l05WF-e_C)1gGQ$|>R zmMG4XPh~gBKSTsl8`o=wi~SQXzvtcg^B*_r)7L@0e@oAzgkt~mJ)Tx~x-kQoXoF~& zs!;Qu#@K`9F>ue+p@IaKpZ`c+(E2~0Z#-h*vY89>MUnKx5bRm{^WkMgzYHu^`j-dQ z@Y}-oJrY_0;E*p4F3x(2-31Qthx_JB)Kn}=7s#((-!+h%P$N1)+p<_r8@PTUcz2t* z+G(SaOMUp*5=GIot~5UYrP;!~Uj9K1tf5e)bH-s6gb&Z~qZ;VL1)OO*8_V+_SA;$& z${UtH1+tLR=*emZtaGLv{3Z=W^H_t&@Ic{`2_p68%7Wk~Ufxt9W;nRn&_-k_t1@2# z^v9S(g~O&qasxogaDD+8-hbHSu3~e>*B0m~nchWc2fGl$Y1@*OtbvNHhRKJX>DX zt$Y!PDGBzuMUVJTIH>=^33BkSX=goDc@B#e0iebiz|I?G=G=_+|BE#8*P_{fnB@yC z>iIt|{4byWSKhdXob>GXk@`WZK6m}i=&Un8v>YQ+S(;|@imMV&)UT&Lg zpNtcFQDt*(=vQcKjU1;`3>ZRRZu-*aYNP3@=UaTJ-vF3x#bKg1sKp!>ap+q>?mI8t zjK6Gj&Oxx<{njCLNQsnU6ZUN}44K?9R0l7Zu;~g@*uKDbF!uKPZluw%Pv(L@mfV8J zTrpj$hB|$h{#j&hJ}*nr-{|8l#j!fbVgiHdQ|d+JtB4zP)5(+dcj}^VZ9S{Gu*I2j zBF|SWXp1$Q!#QU{L|foh=X+)twW5!Y;heB~r76KXGiGC6Ea{|h{iuaOtA{=j{mm)q z@zAC4<*@MfimXID@eiXubKfwV4rQJ9z=j{CEsi^@L`?r6%cj8;*SHt zxJrz??RH7uY+yXbxM|AlefIBmz^KmzL^fBF4cb8jvbH;%ylb!l{dsj=gn2sDtD(~{ zl2za42Agu&i~IhN#eg0lTVv+*V9-SvOmygR64%zqFdB~T#dhI-;IG43dH>{d`xBes zE2A!+g*Mtg_je+lK!e;7a!&2mx(qWg(7vyoP;yRuVoE>tUS((yGI`vvA9K5oQ>Fi~ zUh9XBrata4;<^@-09QI^Q{6|pTHZ9B1Ap3(ys&I0Q{Zz@5ERY#^A;F|EKFaSBf~P` zRwNN$p1kk0Lb21q-PyM^B8Bq8OkLMO?rHY(MIH4{rA(N*kBQ7*1#{XbIY&Zq(o-s& zPapi(?Tx>b+2U2oF6%{a$o^5)8pY8CvlGTMqYXnY*wzP?B?&IPX*n*1C$s|f21zbx zF-0;|4hX~3fKfq}u^_`2uc+%NU(~x-A;37S;}-3^DEHo!a_OD`1Dsz~fW35P z_>~6SUq|8y)X%@+_fF~AB|ueRD_q=n+3J2d4+DZwa@9 z(K4Ym1A}W)l0imJk>ECsk@cR!>-38y6c&Z7^?`*#8}yUHH_Tr>DzYTWT^}%MA@ijw z0|89v!~v6 z_(V^ef#Oc7MX#ujna{823Q>Tk0dFK^XtQcI0P@H)6@=AlD4(>8NIpQ+x7I&FSL{Vs$%UaeKqj8hrJUIpzo8CYGC=5*P?3 z6a;L#A^n}85w>rw@?-bIw-QP&|MFfxib{2i1 zxg@|RD`BVovecD0`LXV+>wt|nV1S9~^C%eihdbwAa0GmF+0VJcq$e)#4D`ox#aBP; zu9eNW!%hU=(;aS(K-V)9K|(F3bYioBPD+bZqw9a19Z#Qgtn)(l`g-}Wy;deKrI!l2 zfmlQByi@}@)T})*sO6@QPw5#JE!mJzpIR|njSfREaHn6aW)8%9(OO$u9^GO%!MX7CJ-s=(9 z0-DNUKX7Xx-C&?M)_mb+VKMN{#4Nk~F(Dz~zdhu*XwfkiN5h<}m@h=Bme46@c~S>m(VM@@P$ z&VlRaWx=<3E}9hw3-(UjCEMH4PZ&(sV)FR=`#)OjOCQO@1>zVs}qKjj7E^wE1}vImKuvG4}e=E8_^&T_jwwlaaCmi%5vF@_vv?g+5g?F71%Q3 z-I^_@`&ZL3+~^fo5O*PZdz4WGDd4>)yl3wptrBfo+^u0TyN;bWY*D|h9@z(K)~6Q} zZ4i<>r`U!w9|4M}%xLxX%iq&&pVf-$9<`MC|1#>N(x+4&0Kku#a4fr%x%K~vX|Y)E z+GP9e+MVpaoL5qp51glPDI1j;m#4NdElIi-*ZJIwq6^CPMyRgm8^ZinU-2Vjm!oIw zq>+e^_n8fsP)lON@F!A;S79v4S+*d*{%lNVUi(Gh;GqW{p9}58fVjBf{H_!2XIHL7k-u%Re|-Bln)-Fa`bayj?}4p{mGQMJ z*>&9EnypuKlP#WKPO1n&b-?*e(T`Wq5UtKmz~ z-4BS`o;|@@{qOHoh8GT5lQ;@n{$1|N7mw`3ySTROR!O&Rmh>`$XZ;=J=WgHNto)ui zJ{O$NJh?_5OjfGYQ095soD^82*$Hgg)IA>@*|qui$0z^lm?U*<)GWw=&Wvm}tPt%qIk(Q5^W-zYCkFiT5v=7!*#fe=fP6*$D42Wkn`D zpv|&-Cs@PKBB3CM_m-yd_`OrrRT5qxQRmCtp41fA*yUv|Rk)_w zYJ#-LEUu4QLPRCu>``C%>_;2$_S!N(EO&N5JlfRfX&T* z_3v$NTw-j`*v*Wk0(WowCe7?`ZkHgI_iD+&Y&Z-GR;{ka) z9+x0gN+v?S7~(amBU_HrANt-po9G$>RFc3mlt=hiH~m*p(F7|JX#x76@3BX47s?Y? zl}2o#;@MozS>l9lW!Y0s^_>hKl=%U;iu8`v?bj%^98JFf-2@byO=DQpKt6OVlhIQ8 zD{kAWqC)ll))>Hi*A61`!rv(VFG61w{r{Ij-zYE{Nln6tTSri3#1@mY9{iD4D@yfs z?B6^yK>^^Tt;ncjYetl4^b?Mj2*1hstvKqM1HslW_VyPCAI^QF`bQx;kMzZq4@CB2 zvg6S&gyt#J+qx8x+L#DPDY3zM*&d*CVaGpyv0ev^_bN*8f=D5U=wyneyVKl%`9*Rr zbs@_15cTN0v%S~MO$iMKVgS>fw8wGd;_g3`Q(t~=FHFx?7AoLUNogt+-8#Z4BhEXW z30l?_-)+R$CXJPzGmx}!3tKfr(5e1Of1R|<ofs#ZKj9e!yp<^q^l3_72Y@f1r5QBONMHcBOt#gu zyXw6?h1yq0(y-5Y%nY)KYX(oG7l5C4s`#Iu_lGS{7@|*606oAO9PmU2?pt~ri2HkU zXpC_2H<UE)I!X; z*T+ia|4)7Yze;^2ap2*sN+lq|!rpvI9BU9SwWMiE247mWZspU=I^S*8ng9mcLMvZF zby`{6O=A8QtRBX=x!JYkE88qp?~hlHj&M$`$^XD#4S-wf#%GR#EYW^Fi!~#I$olUt z8GH8=Vg_Ut{a|YsT-yfP!KS5JU08GSY<|Otq}J%hpq-BewEMMM8702lNhMsO+LUSC zI;Trvo!{sMN~0vx%vLV|{(3^jk9*IuTtg;iEji}+{FnWn!^~Bf5(tvXSd_rV&Xv=O z1MDkNpk3)#=d!|)@D_NV1@PcK21*y`z7#) z@?*$UOFbNT)tN@GYGcSl9?%jw#Dst6pJ$3dLZ^B1_h!oslvZ4r!@xv~^Xr0MNiUeaORn5OEPp>0{ z_UCpBIvn!>hSu+?#^yTVu5I``oh7wq4AZ*fSX5T#{jr>RJo(67X=P%Ur3frw zrxzjB@SY4*|DyW+No7y9rak@RF6i8%TA@#W_ZoCvb$cnF-JYgmlOpyfp;{Mn(EnKh zSg`uOT&~Rf&^Q5rzt9sV?zI;4(F~EXbl-m1)*YC&?;^a(5wmn$hG7@6;I^5-cqa2{ z)>JG~lud<%yLR9v6WW6e3f!F2noK8zqVc|X6MM=EvN1LpM&@!`3geQs*nfNLJuBA^ zBR-C}=^*6(t^;1>K~Gz(ZppDq@kwKBYt(mHDSGjB=*N7L-kGT2WX0zx1!-uq7~Iu+ zMM%o5rbAq|l44*jDt|zkgp>DUP8bXO=x@NBfk4cdsGW&)UaG+^&cyqKu^ZaQ`g*K_ zptgi%jdFd1+zI7l@BNjJ?rV_AmDki@T?M=Mk-xNRZg$W?hsRWk)4s(drEXt9uDXWD zN)lob#sQgcjM56E!x8#jl1jw1%pMWx=;{Z#c6H0}$_UQ+-F`)(0(G6v$|q^U5KJ{0 z`aX_N$y%EV&&dB`5T?mr;hm*$A~5yW4;IV(J~LfstUZmOSZJogh=2-fQ^ULoh;uA;I2Qbku61|XO5?5!*{@l1l z_5WZwpeN)N8`8o^(i81zdcmAx5^!M;v&{4?P8R_9l>7u3OXQBjzVh>Zpc;Ipy4Hf;`zB!hzjb(exe>&&6xzVw07h&&!@@f&W1O} zF~99ilra$1<OdNL}OcOgC(<# z8J8c4GawoZrvC;ti(c&9Xo;8%)F`fpCpxg!M3>PKOJUy?RljKK_SK&1I(x5CUxJCW*A+gL8}132gDKonDJ0lt!fc~b2a`+r6>0vkd^qz zc+dWaY8QX~8!~`b#nlaywp*d_lt|x4e2)RZ^LGAOg@cGTwkxh=Ul+Ra3;!8YA9A@o zues^7V^A+Fwpx*6S_d=akX^pn8U&0{L%huSSX%(}|38W0VWg1S3Ha@-Z^NfwKO!gv z_i;0;^f5x_tUk0clbV+cEBr1TOxHPS}vy+o^?Gaw=X*kIsg=WjBDmUw0$^|QVh z9iWX8TOtE-!#tK6pNIl&wqfyur{qT9^soUsXQTw+pqJ3zRSQF+Se`jf#toJoU46xi zyS0pvXgKM=&J4QIAmH`9#(seQguheD=nY+TK50DRDikSOs zgO}qgvMU< zyi-960?SP%ahVda!j)w#Gy?fE!h(03a4l+9I8tfxCRefrh%Z%H8r)u21e&&Ny6V$8 zqg8k5MEJ$lEmkWHpcct{inrt70oy!~FlJ|G_Ezj+=nbIh4n%oH8HjJz!k#*X77wh^ zI+SXT|IHaBf=SY8&zhW8M5A*z!HtP4$Hx!sFU&8661(o#0F26v%GD7QqT^$whv6Kt zJE?T|o!E&D9L`Ta0RFQ2Sq%OpKi^uK0RbR3?IE0$;_kutJqU7j?rS4mj_rHgr9@dq ziQTi8)7?DC*gH#SJkZ9pSyj6Bm^nSSMT!jx3TK(-g1i9|4UdJ#0;nT)#ki(DEl|JH z$p|IAPFOXuG0VqwFjQ&*6|wwIN~0k&xq)8sMRq`&0$3=kJ0cI(d*_&V5q;jQ!S)ei zj*-3iex@v1Rp_aCaR84iJSK?|waZlUjE<66&=9^tWok}jw~(>)@L}ucMcbo5Hz;tU ziM{q@*hGZ}?GRI4r$S?qz1C>+zLw4A(Ehr5PrQ#Gh|;LpOPrgJP@6U0`VH!;ZYfi_ z%%o^_WnK?sSQD?j$Pa~~_orgLwDRSF20k;v)74eBq){gNZM{S}w>r3tKJe`_0!hM! zFo0lU>{XQT+>ZKuyJGi=#u`f492}J1{%Yv{ize^huSe;0?9+9Uy2nFE@Qwlh=kZ`Q zw_sfPivPEgy)}f-SG*T)kOeuuc+mZ4X(JhWPzuWL^rDQzN6ML=qikYl*bSg~V^h8E zx{Pjym(NLzsP|ABs31ke|0e~7hhReSiw{$7K~o(-f8lZX+~Rw)vg6W=>kKQ0;c) z>Fu(P+tpcx0@a-WFPNXOT6e(&;ku=2aW$Yc6y#){66gpFh1AuCq3L=@J*?veYdFIc zVA>wEI-%v|q)RrMktR_e?GbvurAF4>%sqR)Vxi&@8ZP1kYCNUOfg*OK5VWMui78$n z1pV@oP1s-iS)Lkc;c>S{(3!2hR83ed!{7-QUa5#MlZ^(`na?qNZm|p!Bxn>JFKpEO zz`7)XLVX=5;y0Snj+&XjqH-Tgf)>|HdDUj^mzrljYfp`kz4_~|2Ocd`^mvXx_`I(4JZBi!d%ur(M|;kMeq?x4m($?{n=Kz2ab4t5 z+4%93FlL)6e=Pd}#}>F%;g535$FU@j3~2>=#m{Sj(TB`B)bi=T9tH116>Ar(Wk*mJ zLEN9-$^RVX)Ks*fpwIzepku8mU!-+#lq(YAl6oq>gS)YKz?1X7Yc? z06^nBW2Sgi*FX`0)jey>2Z}}y%!T;PsGSC|4Mza0H6O?4UMd{X|MUWE`@{e5x`5RD zxJDw-Ok4nw;*VlAM)e9r>cXHBkuMIC^2O=Wod>z-jR~eb67bibvH7_!*vKJ0n7<<^ zzv>||()R04fJzy>9gZDTKiw#xf_nFLYTr~P{^`~srK12+kLe7wa4?%)0Q!oR9YOvv zylHX~OWOUh&nFl=Sit~L@sSvaU z*SAU}+n;`y>LG)#xj;!F-54BfACu?Z}ZzMrRT z=gPLvTY$Vh5BrO$Cr2LXaTX@v;YPiv0#fAKDK6ugFyp2ImKUM&@VklO_@Uhax%FGz ze)&y82r$NmN$@H4j;}0Byhkc$%n?NTm*iPvR3hk3J}a^VcT*uNl!*?)dG+Gby$Q#H zJ_zTh^P1U*LK5ZlsF>ENwb4#; zrK+wz&8;8A{;7VgfO^`)RpEU8^x>PFP)&q2f7 zw(d_0BiKQx2)bb#A)>f5M>~5vrEz1-80|^3H*#G;c`6{IVT%mEH}z4`IXqkRK2$KT1(jV$+}gA~8kFe`c?Rv?|ghgv}4dURU;`3fe}*GuQ+y zj{Ktg?kom|jEsy&(=ymv{O-XyiW~8wDSX+|7M(7cI=uCX>o$4*1ft!aTKl~FRGZ(Y zDvd|U?D=Nk#33GaD2M6V3??NZGWT*;DP z!u3`_u{->ZM&wk+VvpvX-HCm!wy)s!h2-7YrMJGa z&dbwT%diK6RnZ-@-#S{lT%W+E9Lz5|TA4`m+Bee~!o{6dD(^0S#eXpxcLZwJ&OqYX z!sstweOYHWtuS9?TuMf~sV&O+vX!ph+{rmCeX&tiSQEG*incH}eOR6nWkvbhLBu9< zYfjK*9({D7@U9etrSwUW)5)Br1gm&&0BTPVv_X|mKT@Q5{P)osLIy6RMUdquhuO~>;Aluk{Gvqu?QVJ&_w|M?_`Pdg#OKD}@ zIZ{G#%_aWh<>IZ0>xj{Bw|X)1yq5)iD7JJay2!C%x!z;s?x^m97H+|73T#|aiYLw8 z%8b&l!b65{J6)uZJ^EtBIjHNZh-WpP3|`pU%@F-aUOlpwxxWM0Rs~V`AB816jElWnq(?W_gT)3j;CVc zcDxi}af1S$*!h-MaI`v`1H&RnT55T-u|>la!NIU+FJgABuf|TGiguOHJ_=>e?V;&2 zicrr)%xHc6zUj>y zo?QD(BPrvNY))F{NhPXEzgwqnT0knyrHqYOSKkVONx#s46_N#BNBThJUO*QqHj)t5 z8!2T*8#)E>8}vt_-~JYm``WRTeF9tH)u>a0cB*y4{wsOy&A90KQO4EyPJ&tEKk(zb z!u!DL%o766GscepAxmfdUotOUVh9eQv#eDlQ2_P8AZ$+FI?)g_RE1Q6pl2M9zZ#XR z$i@4%m(zW43gn#!7zTT>4@U+(O3_F!wg7Rtl_U%3KGZdE9PX!0YJ9ANZ~4}-B0dcU zMm`jYtRXu1kbPO80y2G}G?wy7L_y-jZSY{p=xYQkKPLqwZMN_v35K{(_m@;mHFe=H z<2Bv@>agaFSY0{Q(EE}w+qxBc5 z1*}j8lVbsPbFcRKe!OhA;iMui;q1wGfP4Bfo-9RG1j`n8vS;~WKsPDjg$x{j?obvU zv6lc>RizX%VAlLPJ8tMI9fkhP3gBgaL$H`Pv%v$l}wH(lAs5M2_-e z9i>ZS^)kU-6+U3x)G&(QoqpNM-wte2GSG4(eW18ua`62%XU_A^Otu&l`F2^sg8?wf z(&Re>RG12Hs#KEWb!6`v7%P9M7O#W*sQ|m+^Ak840Pbn_0P4&@LUDo|NP=+<}1k^b>@L z5Y&#p4EoeKTn}uZm?@Ux#_83+9WZcRgl4%Op=Fc()+kq_X{5_9698Wb2BC-)E?(!i zu*!+T=s7uLfDN;=v#%RS_wU3KeQ+CyD9^am_l)TekA6I2CiG-SN)QZRkFadWF!Yi` z$%iA=H7!q$7Q~Kt(Y7cZxJGL$@%cz3@LOCl>OO-rD8u;rA)zFGpRshviQm1 zu5jle+EBOaDTbu0ib@D6xe`uQ!#^vHK(^@T12gv@`8&v1&YT_tJc=j3rH~JPB@}WB z)3_QOiA72@qK;96s|*mAWvUu68G^0)X2cV0*<4vNnsJYWu4DS!P>iST3Vw+^dwAd< zr%?=V&i^p#3s0^pic6@dl(h~~JiSUmy>UWLwdm@)gGg7MmCWrrqV>YOop>%ED_k_W z??9l+o9&d$J=vk%g1%ufxOdG)Hse_5rH-`8+80MADx}rZOL*ioH(4@?7u#DD4<3zK zXUCd6ho1$q;eD|eLNj{_o_o?jz2)_kNZsU0d(s^he&PrXQ-IOKFh=6381F1S=5RQs z=R3vB6V5wted;2`G}&{!vfkbPtHoN(?z_eIa0PtiA*KU?D3rqCtNlmoTytH@ZwIa^ z&lM{s&4;ogJ|jNGher&qnNcbAX=f)Ly9H|Du$@0|)DBpZE5i?cK|8T=26z=cJA%$q z>aPyKc?N1yFP(0zC5!WXI7J>+aKAfWtx0}88K+ydTGDdu#K`n3QPhf z3-R@hv!MPsj;Q$B8Erdr9~FADW{A4$A)M2p8!}G2oF+G;JMXmmWpU&fJSmZFy*oPw zO|tr&@Vm4r#J{)ER-CpiZZ_U%Vn zp=v@uXd5kI?hEeWGSX`Qajm>e>}eU@$sv90orrJBpw21vL_0bXY+QMvEwyPU_VmDy z>oM4w9tn28IY5jfAmXly)~-2g@@Rb*NuaIWK>me=)vxCYLyy?rkLyOCYAKDNqw`G z76&0tjg>pp8G5S{$Jh2Pw+oofhz=%WvrF+Ycm*hNywfFBeQySsxm3duh7PI3Fmbg% zxlAK9a@~a*UsKUg6lpl>pz#llm)Hge!@o={GfHW!jah?bGJf11%QKg$32DYUmd3d6 z%`SVAD#ZCM_^ZyBR7B~fg&xNR5LrH$#cOkj_9{koBkhPRlFQckGhkZ36@8j-Imqvk z%<7X8#D38?CYgFfmf`n}w%~H`-j4N|)A$DPJYi@F7FcP#l$6hAsC;?5NbNY**_4Us zK9&ToAmf=5{fNe}>bY5d0FgXFuW5g1{JHlfp^Zlr+IX5Wx=TDt_kfOP#A&c@gEblr z=x6N(p{Q@4wFS~4M2W!bZ6r3+8!|3(90;Nu2wX=*AgJN8R@y66;?}@bj6u1z?sTkM z}C6pj$Hy_TUl zV$$C{6f;{9gL$7QgkWC3r4aK)+l0;bv{fpp$&lCNUh^^u-_kNoty0K0Sx_Jo7zB3$ z6@x6lz_L%io$jQ9DZ)Ir?ur}L=J$404?2iTv;tjnYR5LHFATD`b#ogjwpeL}j6wxD zwIPpk@Z08erLZZoHM}fT&pYsQb*&ouugkP6{uz$(AOOdMl1p@=+~~n6W?;$l5yu?q zNNV^{ak5nDf-UA?-?{X}aYRP+GuJ|Qs2TdXNu*P{`!C;fD3qJ({V)7K7;p}V2x zpi8C)zAFA9&V>ko3vVlUGLrFHJD_*~+|G-ky^}Tn0$%uHt`O-VrsfmdM5oscj_zR{B#dx9>a{jT0K9RZTog0*W5A zVdo*`SI5WS)|r}J6*exGM$ahEIymJvYlNYhoO%qSk~dPie7~2NE(?eM>DG9uNpAZx zHfIIP|Mj;Q@n|b|$19GVf}8i66tf9p7$NHXu-voUH;?p>Ezc2+$M=k(uz7%X zkBKI^GB3piCu2~Cu^}gSGH=PtaXqu^1FWu}<2Tdex~k@$->OSO^RMlO(59_we;n@G z2mX<26svVq+JVOAqoYJtHXYeG&16ZJAcAmuW>Au+KO52RK&TL88?m{TwuznhdK_av z5gh*B@unW`ol^fX zK+JyIWi2V5_Wnt32lsa=_RG=W-Wd;QOR&u`HO}&??mS{?Er0{EB~iqdYpb<5Hds=> zQ**M6lMxhFzsbvWgs_FDw!#dy97`M{CZrL^*)^1=BUG2|go!^W9A<7D^V|SneE;|F zGrF##-SJ(Nhwd3TdJm7JbeycDB%A_c=ABZyr;XO}NQnoIF<_T@Ad7fpEMalVqN?@^ zdSo>@4=Yf01Puk4+PBnLQs$3Toi?8d_P8*b<7ul|hd;+(pbA~?1&n-j{j?i5bTL5{q&R zioPa?Oi=#UFo!0w_L9`aTco45^?m(%c7&GZq2=P4E0;VSw=6#BG0u zG13L?oViLDow|Op3boZ6L;4GJZtz}c=~%JJ_a6QUOisW)hWq%m$7YNmBIPQv9IS(} z4m}xLN2)A9aWTlIziq5XpckU4jO~`B2$1@-h0*o3b?F3#;#4a?t_|_@+*t=WFtGzo zR-oaQ$8nwfk%T+~1p&x8y9;p}HQX(VMk*%46`c`K>084~AMfJmSEVbaBd4r2)@+Cp zuW8ps^;O%MQ~+Ywz2XWc*`aVWwEliO{32I#5SkXQGbyCq&Fw ze6vTHm-jMY0@cV9S=}Y|6aC`tljEy1eaHy%cfr-n*6W2hw+`-?tgq9?Q$JokHbGAC z@dFE=8_q!>JtA<~&hQvWzje!9tedXa(SJ1hU3j+Z*_VN=>uoYbf6PP#b6=lp{B=HP zDd&d7%>?{%=wUpW>p1k|gDfI`JN-RYTDwi}=SX2`@z*fzt0iU;^x@4Sy#u^e^y`Si zfSB;3AiG>eV~r!{CuD~|U5tX(vp|e&oZ6sGqnynxU4owI;2l^-Td~h8 zA?uW|NUqNVn`cQ*CDgVA9cnPIY?o`-6)KEu!u##5=E*l*)A=?g1$C@1qhYVJirlP1 z9<v5aPW&YDGl#r+)ya^J{E1YXcJD_1VxgSFLfv+o?m@64dUQy$yI?s}1- zE|fSl{hAk$uz4+s?(=a&RKi}%ThIf%xjVh@js};{TNr=zgw*PS69rF#2-_P`wB*Nf zH^!FIl2t5$UD{sDbnc-Ne>z1$%xCO6!kgj{?c$< z`DdzLw||gwKd^x51e2naL=x0mXv(|>yW!bs2Xpwo1O+hv%c_H%oJR;0_jdraMSdw! za@1E<=4e(+?u`Jf+zmAXqk?9B$tb+%{O80C(%tA|xF-{Ip6nds3T+&EQpU^Pfu=|W znEI?@Nl2`-g2-?t8Y*39$UCGbWmQRUMPW(~jB7@gv!X_k%$&q8#foA$SlL;EWwXsvDi8C$*=jQg`y zGPXhxkfi%?S^pr3T5y(gp>Ghr){~rJQ;DkNx!*Rw*v=~B{u+YqXk4yJn1M~dUsgJ{ zI-VR@OD6C+Y`yeRG@t<>vAdHHb6FgA<3dPPOyRSQs5&Ltn}<-BFZ#mR zgkne5VHJ8^{YDuQNX*EX95xhoP-AW6Rw{JAK=sk%2_IEpn|>Hr*PGY>1Brsy40uMK zpEUSh!xr_sp`{zH8(k9KGM1tEtEPeI)&=D(#5wUtAg(R(C>nbA!?uCMgE4eLb!t#W zhlf_9WkU_q1|VYbK*Q-+&rI+9nm0H6>F1)PPIAS4GbRwWLbGnIqw)9J5%<1(e&s&_ zbfSNv@YCU}qY~1S9Uuz-frRp~b(zg8*hGBgaps2S&I)j3^^+C4hA~TG7*n#{lM*M* z@1R2gP#27C-gg@WD@F~WYt5wX4@+%@0LYGF6P0;_O-Q5SNk`{jTIum%woF)88X6% zQqj*Zpp7*_o&8@yiX$eJcQXbreLc`15vdNEbKBNa8m=pwWRP7mWKPozdFeEo`C1?w zItRM)p<;>i$m0A}C^ovVP~F@6ym797hH49Joh)78(W`k#B*mj(VHOwr_-z;iYW-ql z&Za!&SX-F2WV@VJ#$>c%Ks52#^vMf3K5MuoJWGN7+*&N>_U%MTe*w?|0MBumNzRF14*@AjJcW4xui|DYQ|BT2=``MH zGcv))eX&N5D-^AbxMg^*BtJ2Eol5G)gJ*8kfvJk83~kZhULXqNr`>@@@w=n~U`hge z5sVSv+m9ru4L*j~O|=;Xp4yq<2b#u{RcdPSKjht^!6RLS%ke#i@21&397DTfn%E4T z?>&9p=!tMbvxDmbNGN z=KG;B+tRYOX8U4o)`0oZ*o0zBV-HB+!Wz@-T#?u}yrHj>JhMYXuHNO>n~ua22)tN7 zyh%Y5&Qzbxa`FjcjGEw39Y$--tNfVw>suPsvI?W);`?UuuU4?wysJI-nWt+!2SEgE zwEu+lm*?0b|H1lYclK@uVz(8dqxiqp@Mu33mXdDyXb;IfB^1`ba3Djy<|}k&e|Fq8OU;H>k5@eD1~0F5{U$e2Qp@J%FdoVuevIf3OG6aM8Zvy< zqoo_yLe}`$Z&Mr!(0P&~QiToB&BY{HP4ro~o)G=fm4fXarRGX8YbbV8IWCW-(7q0h zKhGg)7q*1t(=pJ-+?`iZPOB-{z;&S<|9=PfbtKkNB}~Zq&CDW9O&EM5rm$tItbB0*`is zS_HndKy#?Pl2c}6@C5vgv|0~y?vjoEMZIZ+LbIGAuTxJDCy&3l_^!crmLla%Oki>2 zee^gGP)crX*g2L%c+9~keRp_Y&9qJFzgE2zbn@e56`^75-Q(|^22^SeEDkPB6s*lbSMFs4D)|H1iDny6Q%AU|u=@;0+ zsJ}i^Al-$3iV|v$hL^9O@2@tIMlHmfcW3_trdAj+Zjy;McooRtqvD)R=@l}{!@7(J z=98`ErLQfSDArS4)ZdqD{il5}f*3gbB&TJTrJhmD8|FA1blHjM9Qp8MPsF1~iK~V4 z|Lij#80}041+O}Y!{UUvU(@r>tfDD4HU|MwMr|oq4wguS1Oz0?>{ZaJ)y=>zMCPjU z#Z$WMg*^;iRu;nfZ=Jb2a0MXNABIt5yJ{{7)_}%(zB>}!iz2W~t*@L1;!=uH)*%re z)7ahp=l}qmk9t$7FhPMmld&i=c<>3VCq-m&zRv%DOdqH5{=b8&7@lPf`~5DI8B;C9 zj}^#`7@&xpSgB?V8M|1cs@yy~BVd=nC`__-V|6N8e-&X&>$>`V4yx0ES3-CY9 z>)%8I|G#;?8#2!S<@NuC*JsKI6=)mf=9H9h-ZOkXmu@~__pp2OrFltVaER@d>cD$i zNor)UsU>T!Pmrexfx4{RWh4QtKQfh#S0}y5w77W%5D}MIL`7?K`_e?rtPT4<^s7~0 zzR2xrP?2=*{GM-f?0I+#XdeD(|9tx&%M4r)O&EY2NTq)rsK=C$Mm)5Nu%A4phdslL z5|!XthO9Y;Svo_*VhWk{MIO~W9h!BJR#7QQeKYDd$cwJjVG7~w$YTCCeE(a>9qSX{ zuknzdNxh`vh%i{_)oBJLi=JQ$Gol@Ba0TEX5hWV438|c!%0??)KV`j(!(;Nl{}%A! z5_g3Bhu+HrZSgP-a5klqx-N6B78{LUAdpucP27og^4mJgdF@Yr?I-(*-)Npiax_qqeG}u zmv>*(3h5cAHxFVU#H_x3#>K%r&6eodf;ppxT~iRc5ku+RjPdgtZVD;0Is1x&@oCH6 zu()`W%?YLu(maspf;6w}>^!n>xOG4|v%4?DqJLpi~rqoC1rCxCL;6Cu7zhSA_`A?mvCS%w1 z@4$6xD$)%0&R+fcl{RV>ZEyGlKcc)rlF=xp5p|(4<}EIVX{j;hthe&Y!$Vr)6}8By zOGb#Tm@PNcYs8qqF_BGLny9Kfv3iY~p2<$=lHx1I>3q&9^#tOQt+l&9Ozx z6c-{67*qGRV!?o+%|iiN1#1`I3J8QBF#`1g-k0C5lIe2tfI>hJp##g>>Tp&f zAhp)b=P2ATNV73rjPrExIVW{WyZ%%yJuFNYJg(kdhUx`M|G@B(N+4nwtL~Z#M{xg? zhIOUO--4R2vGo96m0i{5{-I5|wJm%WON`ZSDcO4?VyD>v;c8h!SiU8pGG7OF#=Y!( zNdX9@x6XTkD#W*LqzR}O>Z{l2i=Lla6tSi#RRijhhCboS$?E&pQJk0-Gbw++#Gsv> z2kKuKI$L(Zp29DTIZ~Y<1V{+oR2<<<;t_>Y$8>)~|A08Zhr5k0sXC|ZnO2uTL%gN! zT||{WGdQCodB^)lmoUIH_(zv;GAS=vLuHoq_hpE#d7*R2{z<{JY=|(gA#P=KgZ1%# zh!68#CKT+UB^cG8?D7N~tu#4jNQvlB(@@FXrRYVT&ex9}8l*W`T)&gJ*x^gKhr6pB znZ-5UT*qvkPW$~wGmy$N!2e6JIGTlIAxG=&AOyjxoRZKP!KQfLXbeBA`Sn`gh>8(I z0qf?0nFixvLq-zNTT5qu({?N*6U^l<^rg0o-jHacf`*qyAE2}vAC+>=NyO<=Wj<6P z?^MChOHG{MvE#i!42t8|lKd(1;PqMn{?UGbg~HQOou}M>nD@C}3}bA3sC_B`nQI3B z+;8v6QaB+`Uh#U23US20pG9D7kpLInNI7Ic(coVYAG&JdvntF#(ot7$HQH8Dw9U4- z7*N>(!Vh1P)KaB}0L6xH>wX2pJ#KWL)yjcCZ-(!Ll1`2+prO_b10QFxVoS9Klt?~l z34YZ+P`2M4weC}=0;d%e7b>NALf4(>WCl5~-M5E(>FXegT@r&d4 z6U=Iz*@97nQmaM*xtl9-wB$n*Fq*|OHDOY!&@@jEo>gjE-i>iUmZ*V_4=^Xp>AFJY z<YW{nAItJ5!n}qMc)H6p#IR+oW3NYptP8k0gQj_S?%Q&cmpjv-{P?WK4XHE=wC! z)6duE6s`}qEr=FLcDmYvC??Loepy1+*Y$=Qtvn9s;o6&id2Sw!SPi=P%C7l=z84+^ zt7CsDs!|p`n`5(c=SsOvBOLcW9-W?`L?tu!Tt3X={nGo(ZMaM7u{KYU0nHeMHBLvG z*E60vcVwn+FLtvG&PU&@QP_6mD^r`UemSA=Bi6D-T#wLEs%V9_II2bCA5_uT`L=F! zY&D!{465D0EVS;aYXbfX7zWU`_DFI?kY}BG;?%HJq>j*uDQlgEH~1K+4`FoZ>6)=6 zm6aWqEswUw6~*qpjWc&>4D{8o=Yx<2C9?(`F6$oKc@H{Mh)@mfJXm_{xFn>UYBhv` z8CLw6U-R1S6I)8j7?&!M(mq=WHV2?YW|HshK3A~lO(m7yVFXD`M}Yg2?c9&NHWdi%0mo@?-~`i-NKc!=phTDqta)==8P@2|TXEu2mue0D0CY{iWa z$4wnz?@OmYepIHujm=(}OH!lroJ~f1(6dUhi=KtHp@fjmlFyd+j;V>}9>2}aXkvX! zr4N(>B`p6cjwaRFf^?YNoKcI2ocD}ng}N6KQqSayqt*KCbahOK1HFBZ7iHhqYU&9a z{nI{vHP+C=Kz|&@4Uv!!bg{9cd(kVYb@~`Yq}ctG{Emc@)a$B-L?=E`Fk)SwG)^V8 z@KB=QMnqkLEuu*sZgKN{SQ*ryowo!`WbUpd6k8yJE9V=U`AEA)-eUmx4_Xf{s*>8AXaS(rELD`DFeH0&Rp zO8z5vY(h?pzbM8DAjeQNd#TbcO<$>V5K0Bix#k676s~QBR<@_vy5`Ib4);KT%2S z0~i0oi6t_Yg~*61a=crAIG5h-i&eN1CQ!cKsz`NSaNLaistxvgNf-h;@d=MpQ2SWUz2hR1pU;6jO{u4?*Ed&)fk#ssKx5? z8zn`12MW_HZ!F=r_$~yT1_WjXN$v_7zK7HT_Kd(WcZk<}T>z$(JkVkUMqT5!_653b zDE=JDd8WnoCT+P?Ilh9ON7RMQAUr%#J})6ZMsqtbXEdx+gllo53=SBMUkHJr(Yo3c& zO#v0_G@7Mzl2F=c5Rmm3Sn*s+tjq8oRE zG_qZW1}KewvdtNc+K*9Y4PC0sDR$AdLHpC!{$v|892K3RJXE=KuY5*Baus2eD)fvO z_8v~f)??%-DG{OKj&3|3oSG5;!}2Y3-_f05cqSa-L5#~fp&8#&y7TV=rXu}TudSI$ z|Dr~nIXI-b4-~ee7r1Sh=c2up>~wmw^0QO-8a!}Jm&Zr0iOJQm;YEMfuR!2v zGhO3O2QIWslW4ZODlMKP2w~GlH|e?_lk+R_?MRG$NH)Ln{0c(RfP#OR`(=mM3y$ma z{YIziNWrl8^c|R5Qbdf%u$&-*$K{pm+Xq8tW76M=wW-SFQjXVp^eep#l<$emOOU6Z(~~y^ZTy*MWn~i%(uCFhxMEb(;80VWI@mhxbX1Z zP2jFkRn)P{1y<|!O^)mN%bYZ^DP3DY7vbqQjX)14+Oq|>zthvvx0tM3zwZP~!wt8( zOIle6!nyY^a(4jk!fU|KNY;Rzq^A_SVGAkS01~aZp^mY#C}-gf$7^{0#q>*#_|hkE zDa#Z89I*OoCc}IeRzn(Y_tdc>fy^?rwLRrYD6lrVBS?5cv z%vaBZfF}E$0NaqV#MVmv3_0MuV>vh^;gWngEFrnEFGflx(C3Z0S(&heG7Pw?R3&qGzd=Fa5l((@ zIN)@{? zxir==-+>#$57Qmtun@fZ?ye49BrBt!3>Xy-|`!0 zanCG@Z?q_P!YpT;44=q?lj~w4;65jXwfAG=hCzSvIFIuT->p-OgUp@s1zd=}d4`!4 z#)biFOs>;q$VP~KeKPsrkQV$=9J$kDfFJKj+{+c^3-cUHB?}tP@v&vAER`|7O$kXa zYo65j2-IVt(e{$%nY9L`b1@QX%-RT^^038C^uhuMNQJt)*C+mP zyur*L97nIa|HR2y8BSO!*EaNs*67z9Z9lH;w|Bxls3f0@R})taDI&!z##1 zo%|JW@Kp&^e5KAP>8SAS`)#R*Qp3tG1NKhknwMOY-#*+I{Rwio1+?rMQleVwv%K0ya;-XIC6g%UFkPPg0du+(>#yOp|7y_NYc;1-!)dN~>Ts?8YTZz%L`WP=dV+hbwfu!gk&@et zRlqL_Zm}6q6cc^7Fd%p0@*KbriaL*D`=`}Y*HgAwri4hCP)NDsooxrl#qfOlzi4xb z3sT$~qlt%@Ae7?vWF5{aY7LeE!_=Pv(aE|1t>ds1YcxwU4xysw`2B|!#(|c9OGB9H z!!**@JV-Q^g7FqoHZ@qN+XLgEMB^?@13CucSS{9S-+{v3*Y3MqDP=DkS-A;2vTOBi zn6Ecjn-m3Qj;%Q_n?HS=kYEcq%2ux!i%}V_WkggQWi*_9rx?xrt_A16&DYoJ*`27b z-H*D~+IL<#V&+mo^#&MbtrZ)C2ykdMfMlkh&2?nZyX@g2TF%^U!q9$QCJr^`OV*Tk zzavjfo?lkr4fy+5l!Hts8e#MYWSDV>^T!e(bX+GhyCnsJ9I($jP0JW%&*y zS5fT+;6Gw*^4xiDdfk7Vt$i~~N@tX~7G$Dto^ShxZJ%~zr4Jw@$2ncmx6)hiBs1R$ z2~n4DQRHIcdQe%bGaFBGoo_a3f!|4K83{W&9eHFocl%irUpN2zE9-;d>&A3a3(E}{ zcib4h8_(Kqu0%(U38j+|MxtX&Uxc+^=>2gnRA+@ZpQCMSs%W4X1zrh{!2Xj>d*U(w zO0joA$#A#l&P@{>DpR47ZRt1VjNEK_cNi~SLs4gA=@zyp;Dc&)C+Bj@69c5dLTak% z$~A=j`kdf2N*&8BJQlAe_E{cfOO=(}katzbzyZCmwXKO*Lbrh!W}}AB4JDSMdV0A% zW7*GI4hq$tW9I8myeI@9Z}S}Nzatv%6(%zjLsRudpQBH9-JTvg%Gyq>Y-A{k+( z&$`~VbNJSOSQ-Q&kwG&QMmQRBmEr82Vy66YOw-CT}E|5?hl>qoKmQ0io}L4 z5TOP|J?tr6abeHk>2a(4Kk#IVSS*-nV$ukdY3YJ$QW&D)zb4uB5Yy4Pk?PwJog-HC zh<|R?KDGtid+6v{_$jo(SdZdt<{Yk^9iVN_`W1mO)NBzkzpHkPhTSQ1@LhakvQZUfLH&J2%5rzs@Yb z%Xbzbu0ywm_eyt@d?5o3~wfw(#$!CsF-Y$N>U{uIAmI#lucxuy8HcsuI?1j@w1Wn*jfcR$%uKn!h4 z-X5Y=My%` zO+%X0XsVUSA_GQ5VARCQb10rgJariGKofdyWCnYnZ00RsSjWQCLL~oCoCG$lC>LKS z#L70bkCdFu1Mob#knUOOv$e3Rgj}!QCu10O?;A&lzxxT70YvCi2Jw@;lelB)J7-|` zaP~se^?uuZs;jx~gGSgXP*Ph(nX9OZ2X{|8?-lCK0L+eD=hvH2TQet=c#rgfN0l6- z@s+?e6lY6S&jKF%wx2QYT*5jZxO~=NnBHDr>o33zaXPajX9-ju8|X4006VB;V0Jly zvfj33hi$i`boG|p0a;_XttAbYw3!V`xL@dLgM#tFgh{XQoT^D8d8dNi27~n%k{n>G zzY>zjkY*PAwuETgj(`oMI~)V-2xc2IK@%~d-eUJsywl_6Kezu>Jg=agm-43P4yJ70 zIhhUHnO`4VCSz5fOIg?aYQn}Bn-6&WD%Fo9Os4w#osVm8EX&jtO3REDjt3~fRInyp z^*0zZju@QRv@h?KB#aro#cPO)IzS<{b4WT;AaP+>uD}vVN2SXPzkCU&dRVOx_zJYd zW>9J|=pHBG@1Hkp)^vH5(beo@6YCJ1}?{bbQ(``J$p^P1E zFFz2oPg~546d{AK3eDObo5Bt-ur7aR+Ib2r=}l%B2$}cSmg~7>uaAW%q<0$&qh$;f z_@TjH??%4$<^E5O&QaX5K4Bxo=oVFycOH&#YkMoh-QQQw9dVE3An7f-&{$a#QE7+Tj7ZQ zpA^duKKI}}-}#aNk3TtYo#wWbvFaIgPR0Z3mA7Do^jf1~;&g!unX!NQU%E;@J=P!Q zf_Ea|K*w%(U!cGRW`-P5WG=fAV|8*I zU2S;v>Y)KrLabMh!68APG43!M=5V&+=Va51c~+e>x?R3Y(0Uk#r#19TxIE^vdsN5* z_jb<59H$NA9S4|yt6&56vpu}se^F7o)7gV zAzV;7xsDuekpGWBOo!kZcQ%1`qj(Lk}yA+25Ym#Or=LBY2=yuaxNY8Lir{tn^7dBnJ9 zK1)q^lug-foW;$d)zA8NAhWS(%Uh&zI^MBd1_#O=zWp7|W;{TGJ$jxbRWS}(V6viA zT8=qTi(+AYsr=STR7lrX`F@bm3`=OQHa+JzyqrM07(r~NNDf6|P_uZ0k>A2Bt3_}J za=5kyrlj!?a~UIJ>}h5}ZxiII1mBvP89b3&$H32#M!(fJ6C(N)@wCJOs1g0|Tl*}P zQW=oGmSeGaDn~FAf!J`2cI>A}C>?29Bfq`xpbGwQWq$j(Kj$nTc=3FF)D3Dl%=D2L zlb`;*?i(CPsk)qBR_A7#5~1HO*`DEk8XuOSa6i<3Vo);%=f-4dkis=OX%J6L@dIDh zGDqNhnlzk9)9&R_8oS)jrLM9eOf~P^&Whqabk~;`7M9G`fLMc>1HXE$r)k$ z9?21e{Z+G}#ktCrKiUxwM0T9c)MAGKb&fEM{?7*c9b%pK+9Lu8mLPx9{3s8g;#@a( zBsb5#g$o&HeCPSvS;B3$ybc`IL2o!=Eor(i@Tg|39H)#~=4$I*ErabOpX1d!{KMOx zO_!Flc=90QJ&2})=HI;lw=O3el*M*A^dte)5|TEXe>-eBv`S~RLyu%)xd2dBZZWJd z&HTe z?=BLPli5@91033>(^4X~|5zOg&xaO9J>OKmAf2+N>-f%FTF{3M7Mrd(Yw@kN!3Rc0 zc#{5?4~?tjr7ODLQ&7x-AB&GSMK+noqi*yAt)XSs)I~Us#Ls*4;i&Q+ zKPXFG|6q)EFPfT42MA=AYc1k=?~Q%`=J=gtxo&GGS1d@^I?%g{J-4@a0L@Y(Ha^ z3S(EMT6464#pO%Gp)1z_x5KXWCeO@CnWn2`dxvV2I5OFC7<&eJ^;={Sz8^yN-kBz{ z*s?JJ%SzOji2%Scv7?-rW)orvl;csqWsA~}6bE#I@oDSM8{Z8|)G5$;`^*}TM&THYBEg*y4Y^f5IVoWepXz&=@RgP4$$IoySWQ!FNeMebr&~(!gJnlQ=)os06c8kps1+30w_e zSS04HxrcILlPmU7?=S}u7-ahdt+TWJs5ei}#`y+{y;idH%7 zhsvt5mpZCBK|(=IXH^J&D}TB;7i8G2=gk6q6cY3+p+?Ml^+{?e=EQV1_-a@BsWv7mRT( zO3C|{juFuOV-i0Ojk%H%L?7@XUCc-?AYO-BiI8FMnfP0(k~jP0%GV}ySm@#(=v}vU z^QA7V)ULDJa|Wl(y?7qiY7(b}$gO9xsoMy59jqri>R?LAw! zQ>-0H!NbN)sCM(*Dvb#;%}unvN0iNH)>Q!(B{q$wm!F*>h5Fls$`F5smAelA)_q91gDXNhV41e2M%#h5ZTkaf zLyLNeZ=p)tS7aO5rOPD!$G%;49tBFa;f=V)w@W1tf47|QNCd0zk{OjxxOpoD|89A( zCR1<^vjd89I65cF>B7#ob9&mh>j|M#s@_!`0T>@2=b$r1@9_#}lW^}Nm3KG|9;yq7 z%cM7x&nJ)oN(P#F)dU(67L-csEa}g0q;c}^cY=ua*w|ySjs^%!;`G45+K4k4<%oxE zmDVh8Yh_8lkw9qM-S0!C)iHnvCPa<#kojBG9Y5)UYk|+5IPQAO_Ohn2^OR;j3(y~% zBZ_12{AhKwmiNlkp9CY&A9`n8E@TOcxuG}iE!uzR*zY0=^0tvQ;61!`h&7n&IjAnY zFtW*yJ}9q{~t|;fBq*=j%ne2{^%B!?OCf`sEpoiWcI<~p{~iPA8*Zj$gI1u?AwLdqKoocW@-RIymNVNrW9Mr z^~Tnc?>?L_f9x&@5bHiKD$t=UF?MfcQN_rc%?R;5oE#*!)V`F1)hnpIt|%{>ue+L2 zFYQ=#V<7)J7u^OizDh^whvK=m__ZVdoE|H39~rPDObr5(y|g*2UyiZZl8ZIEHWvsq zE7XXx?IvaXv0Y$7Yodx4g zYs?xS$T_aMpA0Lo-zr?i>45V=yt>Vw2I(}2T*JBf8>Mn~XD_I78S)Dp0r58P->}vU z0nSE<{q1+rx39q3`Y$%Day?J+r&58gWR_4LWvL>!oBkny`B&bhHQ{ym4E+HY@BhwDQt1(cA2e?9%Al7Uo%S=Eh)11gT3ExH280azk9T z(-t9e713EyWCM_R^f08s$0x4bX=CkW@7HO2(tt~+I0zJzm=QfbC@pqN4rDe%C!TPP zzvj!snfg(=9cC$vbx+@u9@II38&ZMqxwlyv#PTI_qJHO`U+87d)4=TAgYJVWh2QD& zE)PD!De7B_Txrr3a*9wJFHQpO`u#=keZ+p{^&d*4G*yQe?9hm;Md-z_^(E@?aNx;dLGZxu*bG>0Nwr2y-qeTD%gkMCM<=bBz+ zpEE>Xqk(&1G71|ncyU(aQD1aKcheqscVht^O`+1{ECdF~9zM!<@xyTB@aK-`W`Ts$ zlKD{c^40b>by=ZI-act&PMsS(z3YxE(NMzb`r-Orz~YmM$nqsgTbt0fj&#jyW_@Bh z7#4`tnPd8>4+Jd3Fv-WHM|kqGju?8zKrA9l3t){VLyu3EO%fY>5sk-s+orZ02{j%x za$-4=A3L2B86Lw6n)=YO03&~K_UlMr2t=Zt<TGOw!|zu(jM+>p(HPKwWecH*U)=5W4fC@_Ag&58)hq5T{ImT z-jDB^7s9h~IyAYB8o{&D^BL*n<#jFe#C2rI_6}$+r?U7U?CXyhED60%aB9jcY zs}k@7ymltfEp-0sxyG-G8=OuK{7uL8ada;S4=PV)iiVN_>8AtIEhBC* z>Y|lW5y@X)FNm(9d`Ig`*vLKRu9=IhxLt*r@;0h|~)Isk&g|GYqn}wiEmOHPB-vpbBE;-UW zTVb7gD}roDT(i|?zAS?t?pf=?0_C9FV?!^|xqx;o0ISH@1qfux_^W(Ah_rlRNFCT> z325a5EDtk%wApJRtFEP2UfGvFgO~PV!Ydwe$HQWj!DRUC7>XBH1WpKI*2HgdE~gk-v)kRol*0*C|<3gxb1Kyz^~n=sE*Wo(&$YX0#Ijrm-pT3w@`i3 zT&|BdMLj5GNjokdbQq48qxwFM7d8W**^y4YMoKqap%sL%QcF!esvMb5FCW-iCjJTa zXNfMcfD#lM{P8N^;4L|*hZ3yL;yHw*^S?BvK`O7bHRcUbs*6FxPpX|!)|Onsa~PJD zxEp_0Pc_9=rP+P^ICHd{mU65#+Y$w=!(-)P4U130=wRXP2+2);2*e8&VsfQ5YabL( z5gb1EL-rycMeE`Wt_XSV_S_vDncI0uXt+BySS*gtG?z-Xcx^37=q*YS5Eq_z&+y|D z;5kX3RVHL#Ny>Gn_3s@3QHnl7^8Qth-}HS@M4S!tB3Z+~3o)!FAfJo%lo z8+ob0p_2E9tMR>WqCwjd(^?_R*M(6NQ%J#xR8wN1`Mauzsy%uIf@Lz-Qcfl*xqLA% z;?DgR0{WzpV0K$?pTZCHW4~1EcMn_XM+1`33*J zuiqOsSxNXbA5Z`IXagE@Jl-<5ejRe#CGDx18VnS%ifWDB(tKn-sx$uXp|YsC>%YIc zTGVs%c+-M-9gA1(=DYQ{HZg_7;}>g8?zqp_x445V5goU5d$_5&AoG=-VMfLSvE=6TTX|VRMr|@j%b#}_Zn>DiS&i5RLwnec-PtmLuF>Lb$}Hq$ zc98f00o&^{N=bB|6t@x`{vguMelghrOTZV1yZax0+=5qp4W#)IttuJJ4US_b#W*ni zeBk;;BTKo-onPURcZsW;c>=0q0UU_P;R$PM=3Ir|g1b2DE-e;fpobgHiWvw}qv1Wc`&Fi_>Gu3NT{&<}Q76flpYX4Nf zAQoKdCLn91rjhI!(D}KU;6P@-7g+H-ivhK=S$&Pwa?;}Kt4<0CNt|573IV^M11h0c9hYpWR6+qy zCH?3xk;cuGa)TZfHu?*dHZMKT!UeJ(?1Xp8CWB^2BFV|f`_2W9>M2q&AWX8D{XIGq z#&?Zny+2UMmN%eFQnFAB{Rpe<=p!#55cHhW`qG^#`$RJ2Al&`I4rPeR$?IF&;Y3>hpX!NNxLex0L$q{O*El{Q1t;cO7d<`l?_ZoB4Mx zRniCB^vBf6GUmRVMixEW05K!<$HP+pVw(Yx?B7Vp)ALR>>qLx181lxKn@^6nCv#VW$@(pF zTMVoqzbx<4VfT??QZ*_ZAomhl5VBIS8p+}@cIxlyb%t7^m z0f1(jM8SyQR&=XxQhrNG+WoyZ+;C|LyqyJIl@*dQXtSwQo{eZ89ggNxkIu=A#Aq=w zR7ZMbuLw#HYv!&hMWjdDe>?}F8CBeiY&AwnJq=|uS6}zAIfLlTAi5z>SeaEFTkyQ} z5D6Z6%+GTrM<^a3yd5^+h^rkM)sw4Cw1K=y4*R~O-=Kbbl<}*9Nynmwv5H4e^2RUNZeNL@)@_aK+9Q`uYGrB5hOpk?R>00 zHy-gKb48k;1s4h({_?G*7HP&?1jHB}gPF(6fRpIqbTUUUl13^7n0lZtM!J>jFeH}C zKf@&6C4C^$`=MykJc(c=ZL|5%WY?rYckIQ=wIwBvQY>Klop7kPm(1M@;N&SwkGD(zQf2&~T6@6(zS0R*ubFB1R zB~km!&QZ<5NxQ&f-(mmAakmL4IX8s@{45cG+yKARpsq(;(`McA`$DZjd7eLG_QN8tpo^pcyNfm&!%eK2Q*Wc+}MtVS@CP_QxbQ| z?97mtp!leOu^lMr;pSpibN#~kl_+P%RyHXBeUHBHhJ@GQ3nDVcH(=TONd*9k2uYWS z6_IE*1(&#yg8lj#HRE!aMOqW$?vP1qTkrYA+k*B(@M;ilgI&qnx9`%jCbZ-@7Nx9w z*FWBD#JiRX*;aN7SzxFllbIRo178vW*e4hg<0*mn-nZ*#HiuOt`|NE*c)DKH#gXO2 zXFCEDuX6nrHVR10f?B&Taf9#k+MUUB2Y!^lo9339YjUBb();A0g_PbRfVHCmov0~) z-L7CYSpZ$n$z|Qsr<*i0{gy9KwF*G9X3fArG3uYftftD1EN8&tXN=Ec7+;%eFSb<* z@ap_nH}CD+IUPebz`>gcLZiYYR!DD(tgfe9CyL^#A>&MD5X~MX1WKK9AD@#eLdT>u z0r#SIb{>JAn}rGvkU64pP=_FU88IIKbr-20ts_se^mjlU<9vZWVuFCEQvt`Z18UG1 z<$DX%@!RP!)uNjIs*z-~WgoG+AI`D0dhV8<^rBPC{dW!s{PG>!(siDvIW;FnMrv?$ z4S8QGSO`jo;pj_CUi`c)-W9a|G2n+^R?wx9M{OIyvmudjZcAz%U9px;VXvQtf zI+t-KUQ)+8=g>A2T+M4m=aH^nA~!9P#d}Sek;=-!@Zq7#vHBIU8LkOdI~Q_Kfi3rok*vip`v1m@AQzCr5KqfvJ@k{I&}-X)c~r1+xq?baTAd25v=n>U<-7!^pxa#2CNuin1x~$1yJ9s5hmg-D zDLYjg`C18fK59iPgr)$b6l}Eu&A>0!nS}!`=Jo?O+uP-3zD61MgnYJH_OfMIrj_mO zw>9V~p~1Z%i@-tL@dDwDaNiGpC9Nl*Jd`zwx_t4Qlz%2BTF>+{=*4euD016Qcx*;= zc_mdo&~GRO-C8qK{goa%Uut_udT8aW8hU-9jTXhF@xJ{^1z`r*3_RA8MHF0G6DxLC zUH-Vf+hr2EvhTad%Go_!1)w0R_Az=Bxa=3YtK&5#UYSy1r_T6E(S=nA%s6#4 zlBF{<6H_BpROq>T#Q_u{2n~okmrsuF*QTmjNd=HKq5JpWq5Yt_x+GYuG6zc|;y+fA zkhbxO7!N?q;+ti#dyqrJ@r73?n?qY9C?;g+@yLa|rmgI?7T{7Ya#vz2CGbH0F(Y;Z zXU_e7S>xvZ6|c#kLDO|I!V)R=snrNRb7yc?GCzy3)p-F^?S55!`&eB z<*z%AKmim-1qauJMy~MD>#q);7|-z4ICPtbWA#cmZZ=kd;@0WcX|w_(G17#`b_WGZJ=(&)V#M<`1@c^|d!_e2|fE}5x9!W;OL zxL*>5LR+7MQA3-}u-iva2rQ2m+i-7PQw}uPqdM)I?^n}iAcEQG6gmG zJYmJrx7Q@HVKy~o+JbGoZA)>bWv{qeA|pl4IV-ISMrA*o>4sV(JqU7^RAtxn2MW1h z<+DI_nML@IKld04r0yfKr5lu-R`7z$Htn&~@3EH1E0R;3FAsP;x*Mn(sHB04i~i?6 z8i4m=Z~jKpq-RjM@?70{H9X06u(u`t0#&P&;7pp;EhPS`nY%+{NPEZ=At^s3?OO8( z>27!nWkSNXx8~dCRu~%+{LOcY6m+Yc>ICSUvEfuK3m(z(w~Eo>C!|;F58$#Bv4I6AQ*#gQt21#2g`2N6n|3H>b7*Yyyj~Q&;>p zXYb#g`Xvt#1Gk-8=t+@+r#Ba>yq3v7{rPiA(&AO53_rg#u(M9#=7cL2b{9xOZS5@%nFFJs88*fB;<}i)SF|A0E8rM4khrHS~Y5KLV3}y$c&~6 zj@k&9OB6+4QAh~=t0Dn-X3jbq*t@^*73(nRnc@CAhz+AsK_zGT=mytUe;sm@i*-Bs zFmx+aSug%PT0)@EwYt^X_R}c~8NJ(C5A`#Yf*N53ATs)Yec(Jtv%%;8AK{ve!loBC zz@msP70gFxueUUe=-y@amReadf9?AbOr!!8x?Wl1Ie1 z5*RSX{tKBGv;Hk~T&mZ{S{dQ2aQ{!RqG2r){uu1oyv2Up)$;HGJb5}ep}+H+G^*3H zz2a}w3|ODtM}{qne}Bo~l7{XFpB;8NB1mb~{h4X<`$v@@8vu%z#zjk}9kMJmbA{6K z2)-C32T{kMcd*uAd^dC>yv}7QnEEc=c@=A`EiK2kA5lJkSw=scDHA~IHH}x!)_rLJ z)JIbEOyQ;WlIGL(R1r_VDWEAarY#DjU4<4Qd>GOm7>+|s+OgJA zl^dckgb>vzxa32PRXt9BDfZsSsxE}EjKOoFI9lhVX-k5J9e*4$^-7TTQu|4((UZvQ z49`SNy*h(e8kE)SPeC-VRuk#T+qzXN{o-`rvDLZJB)7^?IDa(qORL=z#}7A|gWd)v z@krEGzHe)l2=>{tgV1Z+E_E9#HN~yE7)Aww)ZXzleG3{`jk|13g8lJ@$c7WKsoWyr zeT=T(65;~0bE#&3rF|uF93};+Vba)?ur|o6vzXoOWy%VD3xy2MqL66gaY`l@(Yq)2qkHc(zDUov;7 z7Yu%k&KP+3P&)Z-cdP&51PymAy*2Wqi!~i;eTvMC8%fkcxuV)c1q}JaGDlaa*OFg* zKZ(AaF}^d5{PFqeN_asn*S*b7JiR<`>gNCoAt*Q~rg6g7h+dRRn!_=VhK50MPLMAs z)CKmK_7367qsdq*_PE399p+#a*$9M7Id7Z5Va|jk_fS+;Z_sZndK-KU7cvI`Vpf23 zj9aTVAMCH!B~U&BSN1Cnk;OeRNO}mNDjhe9*tyadeQo1Zf*cKu0-YaoM|R++)81D8 zDVcOYKu8+`UgPx%qoRBgIJ4O>vEd}Z1`4H6M6q<->7d39aohtD7SRAFF@9{m8!}SS zBttS@;%Mnl{+mN4{H@KC=Q`CmTbE>!o*NwdoqT;o%KA-_urcFyxCbTu4}RV|%2z*F z7rJi+>1f>r7X!KwVQ$nihm`nZk=9M?F~y#jcSBwug=FmKEi`|@5R&;Ql&Za$NsGV2 zO=Bvwf0ZT%a>=z%q(!wztkvBQNo}XNd?0N)(bD|Y>8JQ%29oG}5Ry>N+yK7c zhv;QuTnU$`n}qdf5_l3iXB)q6ETeA}p^8RJ#m?~$-PJxNzudZ8H7KR=>1iY>BZ|rl zWZoTuI48mSkPOa5pTOrnMBnU^NrbjGxKi8x>S#|?k}mqdh0D{fd8*9YcrQ(O^?nQK z0ySmc05MBCg?09$SC`;;(iYLBw9tIBmHuTib$R0a5|8606 z++e$u#VKmoS284|{xUE{7~iuHqkllj2I*jK z(gKX}bxixz(FrdBRRNcDYtCN#01;TOBQrC6fyMUvqWI9e*`11%g!%d`k(p3YYcdCf zsFWhl-Swi;d&Dj3KgBESS?}l;F=eK+s!`3IkLb!;=R@^L(Hvfvt!?vQO!_$6^OH@g z2=ND?Owa6g0>JYsOrHC{e$&31az>Y2UDYg)GCf1mxOE5KlB;t*ITqs3H9oXxxA z<-LGnQ`OF1?NHeN{`)odEJhLY1o%$XJz@0P2d#Ketk3q{Ns=Yy_wQH_a`2o#)Y#@0 zunzmJ0tghdr@r!NsUP+IiAc7Y0*Jb6y~`X|%&BdqqDegka15l5N){%O94hv=j>lc? zyel|ifRZ1{7nX_a=5r5NSiEvE_peU@FbP`4#At^`%5fHqxzJqYg460JDSQ%9D%&jk zZ*MwhXU;aWUCwUW6N#Ltq~~I#pgXfWHQtmXQTSK_MvTw_t<$8wmmQ3bz3r+mE%j*M za9Z%x;*;esytU6D_DviAk+9BnO_{vlOo;94lS(b6Ks`Aaoh=M|unI4KOr2zy&E(g8 zVRH@T*Ct1|X<8{X7e4Up3f}6@a(HANi(HyvFXl=T7U`-yV_y5oe9)8q9u&KsT47fGWIY_|nQTN7er>6IJ3Lf} zwHhEbqPIRZ)Yc3Mzqm4TcqvEw!U~Rktyk?cdmgcM4fk6yhvje zvLt75GW>@TC%e>EtcjdlU=1c-30DQOyZ?=?l z3L;2bFA$IGLVIz4I={dth#izn^eG%Yartts#`gKD&#qAzKErBQq2QzzU+z)Rf2gY8 zJhE>|LrOu4!7Pwe=dc|Jc} zzYk{{N8qU6rQUWw-m7~nRwxoptkmFwg9oo1gdEIa9ZRvGQVy754n?C$M_BLD{be<2 z)m8k2q@c^)Kkr0>9%^6Wfaw`Lk!2}YH)M7vO4l}k+0|CdhcA5@2lOq`Z+HAhw!D#7 zmn+|tb7!uwUgQo`qm7x8^b8{Yw?^%L85RoTQ}y9XP753;oqC0uKDN%IyJHMa(#U<) z5kIP)KtxPMyvT3|Ey%-?KU;Ll9o88eB~Bh$pK+uWfyuM zW@+!`#7ptO(!oAY8uJ=Kr7r*Is593ERTQU;hD3338roKcJdsQ&Db~oI^(XLFxL* zz|Ebf`AfSw96ZI-+T_{7U(x2yjidg1(RP8!uKS}%(&e~# ziAQh*mkCt%!w0Ou^9WwVth^fURMPP~9fXBBmA!t8PgzXCdU~Ne-sneP&xwVB{5>t- zq+O@Y%o}BKu_0-?-q%|Mr(h!sucybNo&c|;{u$-Vq3V>!3{%V#ljhQ~ zi*m)6qYL97Usd$3T5CP{TXu3_1#&K1RV`VXFB-g@A@tO}EVSkNCyP;#G;# zPDvX=N)>9e&<2!($ofhHuQiro`4FyVA9W(_JDH_sLDkO}E&B2OPzg_8XP1#ZDL1t3?U)Vmy4!v{}b|=-D5W;MJ7PvR#Xw z;K(=w%$wqq10gp+ItEv6jUvn-`}5!)0*p09)-g@Fb{iTSQIxAeX-TjR8y zaEDWJACXj$KIY|Jsa{Wo=R`zkHDm`VggX92nTs1tiT$MJRwRPJpZE-sZTepDB{?I7 zpQfsP`o9D5eTRrJRry`cHb9@m$IL1X3wFW_hv}nFwbLtetf5&sVyV3 zM(pn7Gbd+q$ZPX_j~AnbChHfGPaxz_I!cirNAOAP;@V`natG6`z+^$T&0Ky!N96k; z9S0ze(7&2CGDbl9EZ>DlITX!-X=r2bx;f}Kt%x>wq<8DmJna^(_(nX5^K)Xpy?u{s zBttQfe0wO_HBYaUCuHw83w;(s7Wj7B)(MZ@ne`LFQ!k zoN@+>CGE%i9(vGg5iM(bVq-RbbX4JAt>56fw`!C&GNG1`UN1DM_P(SXei_qsUL=;8 z?5i7=E?xs6OcU7Wl+YXF`4qD%s2hWrY!)<%-v3$FaMektO7DH>zyeKn(bxr$?IVIbf{R||%@#C+5x_h%DuOaL+? z3Rn+YHdgihlnIo2K489>@>8mg{iTMgIElH?Oa31qhip@Sj(ya_} z3Q>_BL?LKZJL6r9spjiOrlD5%top`{hd;xZ5S~B4x?P_!+c{E^L?Ej4$r@wsx1~5( zs1Dhm8oK5`v-~$V)Y-emwvE_u{-sW0b=a_y#{Zedg9Uc~I&T~Fzhd=&8<@Q?5C00p zx|>2``*$#q;s|D3YyPnpUi#LdZ=WN5t_p`nZnN`0o&$tOTcNVgV6|ok3o5SpJFZSW zs`*Srlwf*-Ko5-Nq|wjc+ROEHzb#_lqWdo%p*X^c!ny8`q4`&GaZOkyv5LoqTL0hY z5y^edC+j=+>5eWEVP5tuWfZ+WIlei|)5iZKADd#PX%3=r-2R<yqCyB=(ML#8xb(&)`r|$+p$UTEH5k&87*s9nJ6yxJ9S_kegQOOzkGmy*3#Er;f?r zrzOmC$BHR*6SR>7hRTwDA5diG^|AN%_F_%#oP?&V3^q^M>ReMP%Oe%0tuN|%wm;9! bUEdS32bv%`d}6mI9PA}4sUT4yW)Sc{niL2# literal 101134 zcmd43by!q;+cu2bzyefE5ZFqI2#Az`fJumeigXD`#{fgefCVZ7N;gP1k^>9_C<4;W zP(wEiAq*YwwRG?Me%`;I@A$rNj>GMC&5B=KabD+ju6h4hUW)1{-BAh(3Mv`t`%ft- z4&o^&{^~k>2#)Ao6aNl>9kG&DLsL*t|3Loi3*w}vhl7;1GI9?nhYp-QL~~$(4p;U2 z&;wQ5J9f6lC>x5@tOjW~blesW-8Vq%+n89{nxHHxXpdZChT}((|fc z+E8FC^8MiOVdSuiu8pOMr4dC1{e%}Bqx^HdosGT$1$poF?7yeoLs?iDSlUvoHUyW$ zu|vpd&rEF14JcCP+t?{6{-%(*f9IKF+MG6*5fTXK1_FA`0ptG z<<1hDbT@ffm^iUT>7vzmeSgEpilN1#K}&+%?M#1- zXV?ehqo7!PeE04vLDaw;>AKbXrJ&hr72o|+A2GwE-`^ttG3I2!|2da}Li}}t&_7>P z7->%Y_oT8+DL+O!LG#e>m6e_GQZ#7)g!W{Gh<2et*LZ*bQ=J_hj-@>Q0~D@p-aKU~ z=X6|K`*i=@$X1P@iT0TP%a_J1Lb3uAdAeQ7|1>>)x)-Cfw33q2)vH(A z3N89m%+JhHrX49y3~%&l5p>+~S>?OV4<0-)S(_*J;$5)v z(YL1C3jaF^i_14|JcZH0s%W;ekq#a_I32S)9dr8Jxnzd{Cn;7|)=bOF+rfVxK;hwS zvoRiGHuB^BW{CSnh@h-vU&%zc*~(aef+-v<+5T0pp&1fA@XzTKemlQH$~!(@;Ny2* znX)JPm6w;#;}*oV9Ef(C?J>IvF__KTY3G#{#2=84QxH@$UH}D2;e2zb@qe z&HYfYTK|0fSXfx5nnV}o7Iy}mCZiroOIwvRB>rOSQn9o(^U4!+W0z4EDZ^^?ZHR3Z zXw2^a=dw~}nCBYNA%?K(KIpbKJ=Gdd{aWK``@d^96g+@;;pF9QC6P+(W|K}bOHTEg zWe354SyI1zxntB6`Q*uy&oi^LL{k*ZR0OkKRJJuQie?;_`*&oP7ldsRzJLGT-U-k7b}`@;v@iG~XY4;`Ax!p%P&EOR58@?E?3h*`=vKSD|Y_0RPl^_%3` zXA=30nv9#H#q7mO>g($}Gc|;KE($+|aipcEqtk2FQl7*=d-^mE zmg!+!vO`2|V`EUKsgkLwDK0-IDvFpzinrtCuC!)i z2TaB1{bd$HL(i*aDuXo&;Cw%u*VfgU=J?2prFJ~g)6;vAqxwukgEPI;ROpKxm~mZQ z-3{89LPZOUOl;+{Nwv$J_SCerhiAPX96QIoV*l>X5-?o7b*rCb@z?(SAkHML6bM0X;{h;9B ztD>T~%GI8*^OMAzYZBXwujAt40)vB-e*OAoI4JvjS|Ofr>iEP&T7G^8$FT7SQ0 z)sG*JyfU?FWNNxsTprwk#QdTEOjyXt*0j} zjV2WpRU;donVFeYCPD~hS^l@%kCo|mB`vMYOZPmDr&_)|eE9I`)2IH2s4q^nW(!8i zX=+BoO7$j^#>QS`s^;AF=Qr!R26lK=L_}RiM&^T`-$D!erg`^QLme8eZ{Y%F4Q7O! zYdf3dc5sF>jEq^YUj2pgItRWV z;>}nedLcm#s-dU(FKSPnId_ip@4tuQdVBIs6eIFq%hto{+Ck)S$pp4Fi6B!7AL&%^fc|sHSkZsEtEyz4vT=1J$xV~WwtPYKYHZIQYy`D824?Xpz!dS z$KrXVrJ8DLYTU$^CON8+!PoiOsspV9KYwmDcWUeCc!mzk(MBt_i+cH3Sg@mlKJP#n zQhM^_OBkQgRbJjFNPL8q4hjuTfg@>gad&kv8;L4<%Le-o9dB70tzpP|%__sTQdgoWEX3%9UAIS+N!1=f9aLq0jQ&eQ#?})^x7cj8j-x z4Q6Ja$QnsiWGKqR$yvYsT2n`7(ER=3_*FYMH@sSQaY6Vu7(SS0Zu(MxzT2pub91tE;zDOsB}|3lRfnsQZv$MFKi*ilnFCy>~AtD$2s4?AlrHc8&KR?IOJE z*Z0rNxr%DQlZ1tPK3;;S`|k{SRF}Me|K2|#Q8px;_l1E$fhz65`SlKCLRfMPMt$GD zed;-SZ+|T>Yu$43xpCvhT$7B6NopmfkVBS2dS@D3_0azmEo~I$ysbUS(8x&Cbt<3X zQ|nEdrmS+=+MTt*Y){WaJ{S0^EitC1X%A&(8_{~2^>WQJ#>Oec;`Hon)M_N`=T#vg z!u&04$5w(#UqL}Zqjrd7U!e|TxJwjvwKvb8)Dq^?I5{YINMT?NHn&9p+-fFBMY|Pj zhTnSR{>H{eE!Y(kX8jAqglEs5b&RZCllkE5D~PRcXb5Ck&UsSE5B`q9V8VsbhTvJv zp~C1SCq{jJeO7^i0`mshhYxQMGBYzf+Y)6-P577?9j}_m&!4}5jTjgiMF_`%k=f05 z$w9>66J31k<;5u~+P6*ZBRN{*M_3%L6uYW}Gihgo$T0JblF7D+`VbXe!t!LZ=-8OZ zT@CW9H3KBU_w{vjbWGJSxj!q%?5JyDb;>cDOEpYNii)GFm=cEtZkdt>5|`UgnAYi& zC%-`az$NH8Iu=0~&9^71Bd%QOMT70*zI5r1|1(w9sWuGweFs1d(g0q=pWn3O3M(5M z#HPM^s=>m*x1T9yx-ugs8p7hil120B>FCnHv){gXlM)yAeGV_~xcD5-2ivLJ9yi!p zC4Kntp-taU%+MjjPi!@mh2z?_hAa|{;^2V;p%#V)1|~BdsrFkJ#9fO#sTq1la z%Cf=No*h+kg20QPCzfe^NlObvoJv(ym4AXZ z-noEI#SBTeXE>FA4i4)0ci!WLtGcC6wR_4+!UC&2!tbm+@g*^&v<;eE6X$QaIje zd7>xN1x*%X02*XbUTp+)+v@}stjh*1qE z`M9Q$(NVCXq`l4TJsW2W02IXS6DHdyZPwgq!1T33s`Q>nOTQzo-K{KjTINR$+%kCa zA~c4lm=Cv{t9nhuZ8N{!CThNG5q};qK==)V4*(jG(=yfal6ve28EWxyahD+tUV)r@ zDdfP~HMQLP-@bjDA!Nt2zu8z{8WphUpC3>B%429ibja4j+E3rWVGMnvv0< zTOrGQVSFa@tcs@fTgi{-b-VU6^6I^zqobQUCGDSY+ zF|A9NF4Z+ObRY@Z)L?RK>s{)b#WKfN8|+;p*E_Os9!E(7gUitbp)R3pcCtpBTPfJO8eE)?&66$_M9r zj~qY#?7@S#BO@boz9eM#R0;14sy|+!&N)CyIs1V#>#@0ch8B!z@K1E*(kyyBJUmP% z=A0k4C@&{xcjYZFdg75q_t)V#S?2Q&t8_78KDi8q<2Oys%t*mKP3W%Ryi-ht4r+ob zdWj~&XT7WR2xVZX06*`UoOBquK7U~TFqk9wj*UpQx>SUOds!D);?$HeGTW%8kGN)w zg@hQ0$-+%tfJgYTV>- zMIgWfjhBlMl<_B)CRxz;^@wZdzIaa*lyi}*sjA|DJia#Il07psGdCgu@Esr;Qss1} ztE8u-NGsf0dZU%mo+Out3%2OP60=FXMW=Lb-}Znt6fkPKh}2_{k}L~|D^AAF{h1bn z9aW6U?9IvPS@>0TEcSCkcG>1bI0NSP)Ydk?@)t}Bpkiuap|Xw}IY?^DigQ}btlhy< zu4jwqip$`yR@o{;Su(zL|gEMto`)^o@ zplj1@W|NgHOTWHG`55ucsi`UNw0oA@y7@a#9{49c3cH+2W|I4;Ju&YHNHtQM7M>5` zN4|ce$i}VkN0Gfsmgclo*+&}FCQB*xGS}i}0tafdGMHsq>J;;|*|tdU3XLQ>J2Oc_ zGa(t)GOKC0fJ?^C&W_qa<(aaw>3Cg`Kc-Aj!+Gy>LViBK%njKMX&uGK+_cZ9s1NVox4t<- z+b~&}lJc{(Ps8+)2jZMU{Z_BHx3^as_?oA7w-y|XYkt0mI5X`@Z`tzhBy$7PJ@^*N z$CLne1pvSek;3S?-XlkkwxubhH;n7o_;$kHAXSnvc!Tq7CbnT6Lf;)+e-#8R0ppgx zmzVrmW%JE@Za^^5ET1iPSx7y0A&R*|)qXWPv ze@xc0MaQxrH^0iw*-W#*Z`bP#&!3BXB9c%{rpo$ZJ=e{Pi}u%XU3#l^xqY4DD|k0V z*U%#d)03xoJfVhy@S6gNC0^nK*c=4twojMtH4Ky^;7?1Vnin93@J^yAghYTLpH|Sh z^Lp9`xU45PESex;Ms_**LO}>+PM^W^W^g$GLpR0TB}a-)n$ap*&B5mhmg?%^mEt}F z&3I?BO?Q?Fhp%kZ6YRj1jmrYT+_gV{KDM_ntgEkw0@xtrW-y)X@Ok_q8jX(X%EFG% zy&j%!PmbD^Zqsx+G1^2kN@(sHaR2zmw*7^@jZJQDUS4A~E0<4}=94GGR*kr=GD->x zk1P&;{%0^)t69+>Sz0)Lo3WpQepQ9{`sazbGbc{O7NaLc8u%WC-FT2^*qCd^%+6kO z&B&x)I+&i}#ZyH^q+WYZ%ifzQ1V}iq)bk5CQx@Tcp<$BN$k&3K{{H?V8PWETu0`cI zDgjvnJk;1)TM(M`p%ZwxHt1fyvBL^!DPGd&MuiqTF%#t5l7BFj~dG~+9*DJ{qJGEb;0AS&N)p7bKpvpERA^wS2kGu)y z(cw;A66q^OC%=0AS|h^&4;Cf1v(j!TisWme;Oj$FZD6;oGDs9gd~x0HqHr87yZqG8 z&&<>$YIqo8y3ww`WY9Y$B_d**Q}HDm6A=Q24d-#A8R_Zme9gDwfBuxlH92Nh5uRyk zYNlJPEes++U&MYcw3rB6-Vi;PRoxX_)1%y+%m>-T!OTq~Cnx79I2G_4DZRbwQKAm= zlTA?wOM!482O%l0_MsfiTyGoY6hCWsnO^Ur)v?IY+GJdl8Y@)=3qzn9eSSrugDwVB z2CPh@#92v{ai35?;d7Q4&GCmfa#I^4gvCn@I}Q+|+5Z zWSD&fb)A~zWhiNYM+q!1clWmYejF0Nq5mLKEyIZTW_cYBj23^*G#Pk?whMQyjlJ`_ zqow6JTcU;83l$ZW^pXHCY4|p@gH&ze1Q=%?k!t#{54iPu@@nGnf|@C%IMUUc?`iqAv4J2 zE9u}s7?)b^kGXHxWZ2~+Ke6~QimCfQd;GY?l)lE7ArHp}6iEtTFSos&wTaT)+#5v9 z7Ky76y*P9SR|C-1dFUmjExA(#>)c2NV^Gm{O5EsP-9pROoC3s(RAtvhZN}bZD5ry2 ziupDN6{=)wXMX>F7h!7>67DR-GdRLys0a|m9ud)}M~Ms8n{C^#_RvQlotBms$Pgpy*p~dYMF`oAKgNf?z3yyj zv62ZkP{rA226Jf`mg&Cn@-mz4%Jj#`zoRc_k@X!H`l#^(>TG`9?+1`d4$Q&i2&IbN zMveQnRAOS{^mKAe;TE%H$H&!!3#H4x0O=a`-S-g^Q^|^%nK1>w;}8(&%$y|wYoRUd zZq}7i%%XG7;u0HM^~J}X&r31$<$D<1m>q<$dloxjRa6Wj&yYF+02$mXU$5#Yg9N5j z%W?yqXf7vvmRr-9I=DCgP>84uLRSvyLFF5PomF}E%(ianm0@Fe=Zr%lumD&2`0})5 zF-51O(ESXkG**N!13EDI{NddE{Ad3BPy?a|Ae@nhy_mwsCB(NE@8Nt6su|{BPEm2# zHIIG!VSi&G>0P~k{V~9Ra6yZ3Z8x$K%Bw5mH6=~28;@XJ$N>P}fb4|=27rEn`^W8) zb@nirLyQ{funr|(CtS`StA201N#?v}4 zey)s-pTFbcV&`gM^`}oK7)0$GzF-UUp7MCY)1-Bfyjv=3 z??oH4)cP=PRa4@U9IoXnhbMCUi|m2R5M6l_NLPNZw=1Pk&T-JDo=dxYv_pDIgkGao z8Spv`=3=#BZ;rlKyM<3PQBt_8@IySSMcwjB|yGcMUr9MGtlrtb5>zXk&`%dl)kSA7Y=Qx% z00Uk%3d^LVtQ_3Vl3^`wA@MHX_7O086HKb3elKioZN2fz?d|Ol7-Az(Wj)-UEiI3I z7(@%Jx`_t;94#Gy2Tq?lrN>6rVt8;1!ad?xQ2s;miex)|4_L7uUs!g=dECKjWo;F! z(bhTPyB;lV=##*bU(YS#k%5Qbx$_d(;KJD z>_m91TsS`hz$aWZ%(9aoc%PN=KYLB}xlsAEz{0$j@;}TQ8Nm4r1Q$!HN5Wve%Ujt( zz>HjBWv!au(uAej5EcX49g0VJmy~1x_P{fJsqC)yp+^cAtg{UEtQ4$YkN!XySTG3~ zA>dgG%$R}X1wIC+8U(I#)}^+nwf0tpDXSFc_@Q&XE( z_9Ja>I)g2wIV=oVcCHEPF;8=)e*OCRss5{!;(f>K>*^YWC{^6$?4*F|R@-v`9|6-9 zpnMl0?pC7JbD$C-R3XeKCM2W)uZ{3l9!{`sy*P*LN}ei7e@^Hw!L0K%lvP!c1PLTZ zgqR8y0*w*w)eSlnR{z+l_s1OtPGxL>v3 ziTV(p5TJ9EGgNi8aWFy%L^jgDw9}y0)QeW|u8K=byNZ;n0F)mCwyiX4T;EsY$Ovp+ z0c0(&+4+~0jE@1qISl~HMk;q;+(QYz$x!$6yKUMolRrm9r0;C4)ejC14j;RR&Q1p8 z2kESjmF&Z02^^_@wU)N_{A$Iy=+Xsf^~Rd17uzI8JB}O)nKu;>*(%~&G;ooDMvJ_> zFGRf;1?mO`>H<*qG(xzC6lzGc)(_*oP)m5ZpAzv9`+EC@0n%f`MZFO#B_Iaw(Ib>1 z6o`EWiVy%BU-CsTx|r#^79@fv068ZK$+{IO0h^qf5Uh`&Y+yq2?Pis;LkxM(zkXT< zG)As^rZbqM0PrJdCn)0Pi$r~UGL^wz-8O+H8p`~{Dnlc-@(I9=-S)aQpOe{n zXg3v__l&HFP5{A228MbHIBUa&#XO^C$Yo8_xd4GnwDexo2Xl!y{Ys!_63-YJ(Su5> zsACmM(1uw@=(vPm*L@ZC#$Kq<_hys#5+vf;xt=`kOqWp~p&9qRHTQ_jVWK}I+MV@L zzmlbDdM))mIAIgqZ*O0M9^n?dISZlazC#Tz-YF)!+4cN9Z>D+YWf zZ?eA=-DL|A-fr{a3nL>97>ov+Y*?n7dj$5+;nX-B|F<;t5jIS z@JDE5d?1JdDj0>yMGg)3>BUxVz=>?w5 zNX&h=w9;YTq&>+=OfV@p*<}Gw*aQp87XdwkDlCqs`kEdV>B3%!85|6#;mR!=Q5Pg$ zH&fI{^(T(H;0mG!^K`If{+TM2IIQ>(D?q-Z$Bv3lA{vPKuFC)|DWVkq(O~@A z1n-C5O_wJX{R-4!5qOJp+?pv!+=s%fmOaMyyar`i6>+xu%!LaV5QZC}61%%qfyS9` z2;)PVp#VIJ8=?l5GEMwODMTIuNRM`&;ULcwZFYsAcLK%Ua*?JjI3qM&24>6>v$Evf zw?~-}Vny1Yd)XL8p?Q{;HXd4$4+W6HRXhOXr~=yv(I^f&p5fy(5T8~c_Fn<%fNmsr z#Tn@QbwEp_q3v%;8&M7p89=RFKi<=d%E{2i@})q1rL(t5P_9qYoTCxVVyi!P>{#O) z?EN-+V~6S?40^JOY{P;)$!c0wLBRp%$v^br560_jq!+PG35nY$QZDAQYP>k~&3?4e zsS*Mz!yz8FX{!AF`Uhr_^5p8(hky=-&ix}PS^o$vD=28L0=W>PgDF&y;X_ZSK?7rbQ3V_6`&M`L-dg61IT|0&XEj#qU`y-yk>E9r~(X<68aMeYy*Kp zU|`@F$?DI!9`-qy9cNN^PJHDW4m~NKsZ%~MeIukUVjV;nQlj#M=<4|Y=wqS=d-9CP zF?$;^{&bv7wr`px_B82*EIZ(66nApce>64vz_WD%-}OvKC;P{bANE87XkG$?f)YVB zlGaVkdz{V*4?ai7g;5NyO}I7MN^-3a1k;$u}cpDHB+ysVdm<>m%L+ z)PDp#vGp6<%gsvAkcS2?ClqzCIvWoP*7kM>_Y^HHvji=AJIsXxlK%Ug-Ub*VkWGm| zGEYal%p+Qev}iGxlFn)PjZ%}_WB!GD6KWY^ZK?l(2;P-a7oS{awgNSX0aD_*Y znp#Idk%JVOa6iU{kpC!&VznTifHorS-YVIfy64!R^`)R-@c7Ru6-J-_BbZq~EH2*zK_0Llm zFZ@?1^naySbb~Qe(vE-b8p{XQRxk@Mh$qj`+Od@WF|?LcSgxVZKcw8VKh6FXnDg8d zd+*OT6puojL@6jjlIrvY=-d|auC7m=k%_AjYI$J0FhK0PgpBBRgs{VWB=+8IQP`IX zeU`G9S?_7yMoEF53xEfn0U4&14EW@-{b6JFK%sqBPd@%wdn4*DmrDC*Mve@y5a)b; z{Nq?6$6&{L54`_JcVv4A_Bj6n^OBp&-1WDI)>iCq{<&=G)%l;NZbziuQjUL#6&og9 z|8uzILF<1-Q~wJS`bRL=Vhuz$fT%wc8Okj!y#@WHI|ycfd+eMo6oNBQ0(K?H1c3f+ zmbBP%7jFXb4{@JOJ~9QInv;tQ)@SbVzcag?3_v&L${$|MR@#vsA<03ma!&(msidu~ zO)2%R>Epi+=^<~>S7<>eYHyx*1XT%u3VA+E;>+vHm5IOIwrI?CrB!NX0FSF=kpW^f z3DQj#((3a!Y>v)^=ezK#Bcq(ZdgaPvz=*Q51E7ZK#iDdXrQXOML44CnW@fOwyeUf5 zNJyqlQ9&#bQbj801_r23z=gNHimirUfswG^{nx)MSV?u9*(>&kr|$pu^B4d)4Nut{ zFF+PiJ7oYGw#F=n%@q^BV8j-SZo+Voo~P`r`n9t}Xs?qlp5$gl-2ZmS4cn>5V%v+A z_N-4LJGaH5wXE$t&6-?G@)O^b7Im06UsHv9cx0K5{rn8ftlu+5#r6?rNW;A)cIj+# z;T?BA4?n$)3{2DC_oA?#(7Qy=*Gd>z5;_2+NJd5v^cSPaAPp4B=!13?e)0P;>h}xC z?fq>R@N0$No*>I(We8LubZ7{W-6P~&Aw8K5lsZ9&1^O-K$d=6AKmn0XG4y_SXDc1# zR+$#St`vZIDA&iFH>Vv$6a+oEh&PBQw3H!)D$vzPXAcnu&g0j#5gw#R4zMF430 zZA72{F`|+{DJHjPsM00R`dRw-3&QA$DaZkT0z-Zth(b)3MykT0a6&po$Ui~3r(R$h zRNMqwLji|*O~4CHE-&NSf16~pv+bK!xZKaShNt>V}E`f2Si-Gsog?+WK2vx(MV5d=`&7JI0IsC*%*Eff9{<*hf%G4(!r{`%N1goHX?a>gI9MiJ{lOhxF&d z|3&)XHcR)^v%C@Wk<@x;WfrFvToW9X5=eFv|-~HE=oHCL!?UBt!J|3^V=cgIy z`W1tzvN=%1dOF*CUq9^GtL`l=P5LK1xG=jy%AxbwX|y5@Mt_-eh{jKO{1bpFjGG>i zSLEf-XR}u zqcJl=-)3q(zkCx@T5N@;N9&sS?9)@C!n*m&*W{n{5Q08LuPj8*oxObyon>Bty+`pp z9=1sY3Fws-gLbeN%IQ)}Mt`v}8Q$WmCBMP4WD+%Fr_p?8to2iF zoNcgjiRoFm#X0-ghgxyw-dYhcn2#5G{4@EdWL5u-1mN1}wF3+)%`9@uy~iJx{$3fd z^B~7(11uB4mp;%5KF&K^YQ|QYH|V4+Y9A8DDj%L_kABH0{h>8*i8ow$j{&=;Wxev| z(7@`Ojho~zF8Q{*@!|gGWf!a|C`4{U#sPd`zP_>HBzge3`_!{r51pH1f-+_T?Cg)s zGvMlx3m$He#Ohp8vfi}|9p?r+TVG)dtX5CsN(Q5)bvlc9VDxpW*DK@igUH;93cLGz zBSb{~>LQMpTvDxa7d02+aqB#*bW!XJ)9#j3qpY0rhEaV4m*`Wc49PQ63dUoL^kO}D zMHkt+Gfs-38$~7@fk`>t+-B-oFS;dGu^RIkuJ0_i3aWesytwGK^UUH+ghM_aV1MO{W#{JmFy+0K8bp{^ZjSS!3zYF?Q0!J6U{8G}Jh4%no~9_TGJitlj&vlM<%f z>0H{G4V^Ke^$ML)1!iX2rn$xDD4Alx-DwB=`gl*OKo)dV`=HKam|Elbcnp_HMS)6K zy*|4{cA&}V+^If?Dr&xvX7$Car%66}qAL3c+KJlx2tVNw4-_^XV7u=-&1x5VyVR|R z779E4GlwDOTZ}(#X5I`=P1pF(O@JZC!85Mce;k|V?i?|4pZ!XT6Q&7$Kf0=?vDSCR zNslFHe-{4X87be0`T)aHJuK<_O2Nb)VQh?Js5gBsSmmOaF1C>w>~CN}1bJpE4KaQZ zL+Bw%?A7no)$XLve_)v4FI!R4c;+xs>baxuj@#+(x}vi^hbq7(^k=zxTSWddHV0DeC%6a6$l+#&JMw}znkG%#4_M=?xf=xP=%o;}R?!E#d?&;tD4GA{# z^Ew4!RQC8hi=b`7Nw2*=#(TuDW&7Dl_u@fwiBfkau$1AJ316bYj5RsPei_-}rGuI- zLEpF5OzfGEmHVDeEkFS}CxqQ|)UL(_VYKOv!jWCGkYY zey_A!U|^qx-iE!`i`QPwIJgj=c-x${(XlGhNG$gW47`txwJz5YK*Ez&utW60%52+-mz z9kes_u}tOFCFZ-z!17_!$HmOP;gIp6ojSh0w71|VmI*)*umjkd=YwY*wvMcc{7dc=)#~B;-QSPb7PZ1*m(o2-oIHyXCfIx zn-OiPSwi+ZdJHe$K51CeVJ52o?RerN`sBU!b+p(z3guj)L80}tIJfiPI+7yf1O%`1 zr$m$U zq(D@8Kt-Pd5tRQ=vP&76I$}_Ut-7|fk0L8J`JV;sZ)KA~RetYLSZa2hC?lw*K=Gq5XfWX0r~%?x*kw*0k$X zYUCCLvXWBrPl4(oyHD)DFVc+WzTDYz6#Y|i!5DiF{EsjH=UX=a0U;FYAL~mQ;DwQy zwDhcB0BnALre6F%13v!0D2$650(_F>=;Hf{1|qve6Y@0i-ctN!?yK)Q>Fu>TR{u;8 zU>_qJK1QKf;i-PE2>&7qGmF<9oskDW6l*dMEUR<-u6=ssqpZER&PcJCddjPJ7jP3kT~aW0un z@|$A&<#UPI?e4DI8xPh#Qi>d79*)A{p4D>52Et!vZIdYq3ycHQ|6nhzKq)c&p!2l# zjuVOc3}j-6)>^hB8#+4c0UEP|w-U;Cow}F=SZ>`{kf$fiY__xcEMags9+JbBUq{4D!q%@7Cg&XZD&oa-*)lp zrbP3mK5pfc6hSv)QBYfYazUNR4HkFrIZrP}-@vh0xBp@@ zhk1pmz;a7@0 z_ht?)ueUvApWR8^lXSCoY*72&cY6ftH43XcMm!g6QiJuN4g|}y2*`|aRZdV4=QPdp zP+v}e>4xm)#Hibr-xO?Zgxn1USe_kZnepMr%0Ks-Nb?E z=x{-kk6H5rjq{P^yUBj!-8Of{F*#lC0_&}xhj*4UB*Oi`6coRcJ{zLY6%1UgrBp0s ze*pUs7r-=p?G+2X?%ceuRdhWn4hx3C961H3y_3s(gE8qSyK+gc`PZT$1u`_#?MBVG zd~IWC9<6qK1ogb;L@Vawk9AnN#(2^`jVzY`abGI9FE%qeTS&#Si#_IyNxud2N=N09 zb7$V98;HQt$l63#Sfmnip9E~_Wej|kO&6ML)8G-yf+wZsZU(j&t*Jbded^7s0^7k+ zzUWcEWofD7&%atY%w2GYgEs%IQg*W~$FRlqE)DYLqY$0RKMq|{wRmOPZM`o*L}?4p zGX0FSW^W+TtN3W_IjLW9;<5S*i;4CR?=Q~TMl3XUayqZaddoZ0?~>n2gxP(IVlDLf z#i7W)T|F(1m~@nw3W{yNLX6nLV_JNTfJ)e2c82(Pi!4zY_8(aR;w^m;U^AwUv)md= z^NOyu!qu#T8PBxiq(mS50~or0hXGr`LxJWf@F@;(f@qf=H!lOp_W=+KF6!0t+=@-5 z#ps8uxXmWkkS7a7)jw`+p~*Atv+B!By$#7hk-0xC8RAtO6v20GAsBgmWBcuK;y3Ps z7YR+OeW00H{e05U6`ZoQ@!n=StY1Pk;{WJ~bL<{2v7iff&lGu*y$vPz93WKwZH zPu5vflrdHyI{3<$eB_-~_=wc8DzDwJl5whIs{shyy6b#?0-@?GNp=SPXY=glFZX;Dw-(bf_(DU*Y zC%$CSY7Lr^qsQYDtH1GTW%?YqRf?t_`49uNh{@_)&(&+!R_w3bu18XhYZPg)q-l3; z^y!B)2x6O=-m#f*9-p_I<1pVoM&QqsqK>s_4CTFd&x=|K+8Vfw!LWY!y&Xilh7baz z$G_KuLWIiCf1t47i=Vqg_`Xy7Y_Fy(XFdhxxSqZ~p5Y-5HJVSFUP*CvnW6a9dpo6O_2+?i;3R+Kq_N(c9f3Y*rN1z9s zdqNKj552wiP+tAh7cQjo>Q`Uk;%dw?e`sx;bD5brf-BKKIJnDvWT$|jtq9W3K5I1~ z!raz~{&aq5cn6}l$U44{B>hxQ&Igt(=+mcI&>KFGl$=RTj<#`bf@6*0#BBU(xRW*z zOGcI&@Mfk`x^kGGQA6l(i)6bSJm2ZGC~$Ql>x(t?c2A`&|$UR-FAXbbNeG38YXegJ9qAE&gC^n z76!z`44OyH0-Xh~z~RoQz$g(8OLU>MJyOVKOnQ8B64&Y5+6By+-BimZMA;8F+=MrE zPMv2#w(dK!mx2S6SiRq7=}>Aru+XN#0nGav0#ny1<;lik@S$ zK}I?Qgr{W;edK~!5=QSf!%4?SJoFYOD) zpweJT!%uzolSlqY`?nQ#{#fshDylr%!j9;$>#R(`YqsutvOzt% zZ7+%VTq(He>=!S_Hc;D!XW}h5fjGU?3^Krv(WJ^tBBGTA&Tu@m04n zAM|&)4LO%E9I)roAUt0wDnow2AbfKxHW-5eCG67&Zv#jPx zxOA3?!>Z_;%3{hzV~3}uE=~;Q_dClxf>8m`O#>Xx6CGI4FdZ)oG z8Du&f92^X}gT5ncxc!^k5uVh<FY0Mmq4hu_#_bwp$R9-yo1`<{EQb%iVgGcZ)0w#qIE=O1@9Y z&85;#?h(?D%=-#%?C6U)?Yb9?&mN-6gd=)6oeevKn} z1ZhQVYGy+T;^Dizc880qd=I~}z1+s&AZ;0lH#38W!1Cl6HiYU5r4$b%hDMJn{Q{B% z8J~hMKFAQwZ=r$I2?up8BjDw}2+NYxs^%i^b3Dr6e#IC_J7>AnUknr*yUq`kxw&{d z*p`?MGl-G9J!#c#jg}L)7&oTgD4!M#Ry^M|xtDUYpd1|3xSnvXAwdZ&4Zk(67Ud}3 z-!JLE>$+g)Jeh5TTx#f2h&Qru87mW;7Qq*+eSGMHUw<`fX?b)uziZ)nsm@l za*~5Yc=ht-yYQ0{$;z4P23bb^@3-Jb8g4R-*3uR>XIc}t_vVOhwi=yLLYpY{DcXvc zFW#~|y-~_?fVVbpJ5Dp;fyv{SO2SX$JmtMk{%Fo+Ru2q&aV!7boeLtNqC%e6uV`V^ z)502lTvy5{&}_-ie@uBHozr9JMt`igo)PiIr{$+VPt;O7osy0XqZBE2FLE)8iAS%D zgmed&#}t$Xvob{G*)@ry%JFLprI<0k{<38^HOe1mIZ>jk(bc|Kg)>y1z2}UL3YpWVPoH0w3WDdmKS67TF9}hO-=HuSR}4{_QWYHNZjX4EMAh2oNXXK9&~BbmIo+`PnAu47xQXSb2VURVa930exM(nKDw4P+r9s)~2e=9(nw2-7c!e?4zzndZMRyMMs2 z_@ivC^>GRZ6`l8)O-?t-xV@_;o2^e><_QEs$WBGwz<~C;t9Va$Yg=2~1t*ORUqFA2 zZl9Vb@4356mlD<5oNVl_!z| zt1^kJG%>`WrxYnF`k1zY;+@HL%8nvK5iOu}Q=k~SqVsj~4oiBy~71LJA=*NG3lYH&fkGt~?=N#86(Kq+j z>c1}cDOcKTyY8`j3eVF-Z4a(*>?%}eWRwf9aCG%QV^xeeT`#x09_=@_;Jks)D_S#R zGS&88nDKieT5eHQeJ(eAuz2ZhMiO`7YP5&@xOr*el8CCI)+=N=Y459Gqe`xkRSi!s z3T}xR&K6xf?o8X7pKI7i*Kglvaro`sr1oc^!i#e0HO%{_moo(D@Ea&?Kh=+a1uf== z6UZ>lcNCJ_4JMa&0r_*d_@29339o^)5{X*27nup zIo6_=6NtaI<8YtuZZ?7Qb=2h{aph=ypK18Si?#BYD&@(y+CveRVa%_Iri(XRCXQtk zr#?KylV?WsLgP?&48AYzNHEjhn0Id7=C|qQ<+>g)MyAN!(lMuXm8LRd z;m>4Ye7(hi3l}fmXF0|D2z7Zv=Ur#`V7h~q)rktLdmoCj>C->&uVAuKY%aOa=RD-@ zd=`3&1Eo9P7ATGj`MM@!1R)eex)MuA()@$lyROq9rhZ6B!$skF)%UQkT03Wi8zDB_ zgIJX7uuKTis3#8Q9?V%to!x+t)%8d}%CA>?~-P>*WQNR1Ld81iQ^Q_;K-Jm>yn#<3NCb3^3NU04r zykp#n`z$F|cDmOW&AoMMetPrq@<8*N`zv>%`yts$Ox2i1qOLP-c;J8wnTfsRFtbfN zLj?T&>=h-WBL#HanUKzZWitv#5-f!upb3w)^J5Ey;+cHS}E+3;YTs0dU`d&c_CKM<@oV23A=TL-7$s5<(R$F=colx*9k9(EmhRPejU@H9n?OR>V=L}pKg?cUj2ES@-{ zatYGS!0wR4dY605ThulDUkkg#o!sNX2&i0kwZK`o+VqN@3>hamzD3#!N4qNOQ8E z#R8bD^0zOYnAZ{3m>5-l9UGTyFAPEKYP*7}k(U3tH~A18!piRMn1N}%Rnfk@f9ch3 z!Da*-^Nus4NvsN$tDj1R%W%+WyGoB~n>XfG@EVylq&}a0^Yqp4#7>ow<}@Q+l7gR) zS_M4?w-ZWX*emp;+`9{kdC5X+$*KBKwyxKgZ_8Fv3TLV2`~?J$-*_K6|&yyhY1wY!4Z9JMSL0~>gi7|c4?r_$XQ%| zcbdI?dz>c+l#%Vz_lG1-9DZ(Wd>HXrQ24)uYW#Q7K;F@Lk=Nt@7by+iYp}JqkNfgv zpI`)4?Tb^?Ui(2Hdg~A+<*=>Du+>egksn7&H)qlvArgFrDm*v%4*w0M3Nm5;{{594 z@^!NRhqSkVt9tvsMX@kwR9a9#N~BvtY3WizN?KaFL69yvbPLEP6e*Do4Nu<>Yo zf8lWYH6O*Mi(rz2@7mg0$xUf>bz(Ad@;OuC^ukForc?#`i*GQfqk=rxGRA$cU>V^< zFNlTPVaQdB{0r^HyQ^c*j~YY>zIS2)t}foyv555O+AjsAEZ;gdQk(5p z0xtB}Z6s=M8*HCuDtj>hzSr@m-yFq*imynN_8sI5x^o!LkR zxGXEi*8i}#hL04_Qoelg0>%gmOFK7OM@PqSpZw&3=}d8x|M(%srvAZQ^tzs-xfSSk zU&RNOu^Z?dA^OiuHS`=7ve_H(sj7QDOD^fKh;=%C&c)FHp- zLX)2sy~>M5LBYBOnogVJ_<>iQZY+Vi9R{0r_m-@F5($9Jb zK&A|5I5@k=()1}K3qPvl`wtjY2IIHm!!U_~-mAN*-Oyu^KOU&^0~cKPyBnbhdAMoYv$|!`?=(XNgmbrBNU{Q-#C?Q?A;LRT{^icd_Z1n`=hk5%$THCN(KRp6 z&r4qlsgC4Sk%OkU6FS|QJNdl5N~CVR(o(t97F`>nkX=GZAa63`DmYe4zUktFL++!D z?Huc}N>7~`MH0Oug{x6pPQXC zTkk6?UBy%1epiKLhyoI{KelTW@53i!<2m8Q{W?@(>Ah6j_mjLhhnIkW;8_jDK0%pWi!*BHJtPIyolg zA+v#iC(pi!{weleDkcT)5w}uOg7YjNpZ0d70iWxx=^BF@l>&ekiif z8{el+LLmCK9GGHbgM#QH^Bm3+WZ*&SzL#*RC~GDzoUKjJRo(jg4dD>G4)4n5Ygap8 zqU;ur_x=5;=x;34`@4Ug?(b6$Q6_k@0ZsFUU`&IqI(LNK0oN^ZSn9jZa9h5j%p%af zJ5>a)=9oq48Fw#y9{P)n$ME~?84Wdc(w|J!iw_Sy>VjD={∋@AB_MuDgK&#&rz* z8~$_^wErHHIF~XL-69S~l=S5nUoF3Zb>lLE?3#_E3#$Y05hI5V*cl z1#8exi2;8dc`hyW>9pE0`ZEofm=T;}GXaY@#~trD_W_{0vbX z{)8TSt__=C6$D^V5${@k!Hm+Q5^e{Dum=gK zlVdKdqu&{Rx{T3JISu!oD*zz6U*3O>0A;kf3hj$cEfOKgN>K{R4uu6!XhEzKO?P|BpL4d(aues zYng)PhE38R7uUypS`5#Q{ z!9Q=L?Ei6bm+rp|(^|IQ)BEp7Zu|WX3x8jZd=elt)O8Xz4O!7ZW%x~|}k@fGdXV{pve?<=T zXXP6FkHj{t=)9?O`R~Jo8Rv_}yZ-(9@8_5>{`bH)Ba@+v#_$oReuEzQ zFuq%p=Yg)`vzxt^qCk()FlDPfzyWtJ{PMpSslNw|?*ag!B^b6Of|N3W+v52+7udgk zgX|-!V-75Xe2_q7O%s2)JY`Gb=jUf;VUfI;iT^AG2##s65V$X24YoT!pp!C1mWwAT zO$67bli9;w^Q?Fyuq}GA5l#YrS|u5ZQ78!@7Kw4L?DSj^Ntm*_Hi$r{PduqR@M{ZjgE*`V^6agIAI} z>Ga$MDQE5YF&?v#yhW}IdQ8l0HJF!~w|`F0X*PJ`>|8!2&~qN3#$;S!d5U5`zJr?3 zG`oY9D2Evy9-eeCus3;d9Ho$R0Rw{7!-o$Ma}`6@HCvK!7xEz*{IJ^GmJ2>^Abk}HM!+S0c=}9LdgS~8>hw&Rs>N(qTqq-thA1>6 zC+BLOnhd5}vlj_&Al&j<(M-Ik zv$l@gX*DTDAg{pFhw8mWn2BWDRy4W|id&ad@?x-;LzbG4qoj>g?(ASbaElw=Yq3OS!ds2gywueM#ide!(8pjHHu z%OI6wFNEFmbaiEgd}n1=jp-TJ+hK#VrFIK-!hZ9XdrjPkO05;Y6WC$-;GJk8HvaJZ;h;b z)$3uJ4LVX=FAs=pz1Z8(3-ifsoa*`ILQc9OiMPia$2oyMcoOXP_rCBp@AN$_EIv+s zB^dq5tdvp6IyN>IjiA?KxFxEt9>02re)$vlbL3R_6GF45wDN5D~a4olsy=ro3W6dFg=;b<|^f`%;fFfLYSg zC@~s^bfKws*0i&;Q<|30bw{bY9!gEH5TJA)^sItL(ES7!EN8c9PuUMQ za;i)^!;u0v(Acwk&aOzSAi$V{f+D7}=*^UV-EdXPwalFILuex+hqlAF5fQlHZ+9Jj zZG`^C&CN!uvvLM|X zTHA8znV7H{@ew^rN=hp7K0ga)!IU@bbtjspUtyNWIsO=L=dz#LuTj22@^eif0AQ-c zj3U%A3AcEPAm`?CpRjuk#399}? zz28DF3(5prE)>r{#?}%dNK4n&4~~^zy!g08nuD1&koF2DQ~!+guJ}!%TBZVpK_oJ( zwpQotyPeir>9D0PUUl$$Os+7JE8*h$rW}Od9%KdJ5%}~W#d7+C>*|C%-C^#w&eVg@q1QF6>{uV_Wrya5cxpTk(Dyi;$rg6f}SeO_nO_Y zF4#3gCBw|n`#);|?ayR#Wg5&d*{&?mt7wqiVHLNnB#ENFM1p&HC6WLPCK|viq4x+I z7nhnaxb;0kGnI^jV&Jm!g`GY8$d+F4#&8(+Pw0FU-*GQhp<_GWu^P;iO3%N~yzX>L zwge9>x{hRNT3c`~qj=OBe!=9?hNm?0e9u^ajlY zcg%^>5|Zxir*<`&QS}DhHR2#0CSh6rT6a%1h4a*_{+9v@)0jP7n$}l|;lps@paP9~ z<13EDnDA;790UrN-lQWZZ>{-~>1JPm1^Qo4yigz&-Ff_c*)=wi~odw#63`9n`H~mQOr0kgb)zIk5*2 z3zlGMT7W?nbdopfdZH+0mpQ_6cUCqwkRFKocb!HYNt79=ZBm_GGEchp1ce;*a&~g! zRX;zkR9iGys9GGR;-+6?u=kG^z$ky>_AC7`micf9EwC_ib8~N(HBOQADru#6n+`Qf z?xqbMFh5^O^r~J)mgdr!D{4QkwtfMNW@s~9`PpzcK8mgvXE2#$@?RL}d|VNo*ikQV zUKVVAxA6GxU2jvCcrimmXrE9V-`=f#G1z;_dmQHRHyp0kP#O;=Shso_n>TEjU@8{fnM^2f-Aj=ty4WXff_(sn)Wxyu9su zxa2?vY}n1+#igaFTH?Wp2VU`257m~#%X)<^dHxWsS7_$B-SkCrba2kDZ9ID!6(&yY zTAN&}%L) zz}Z2Z9WJN9Icb3fjXB1%`pAzhEXwtR+hI~NpJWWnM`7`pv)J?IeDnA&D^-bBx(sQo zF;`?1a6+km`;oGSge7Q3puZWY9!6WTmj$j-``+S*V)*KJyK ziIyVx>Q^fp5jtsRx*H|^zN(5$w-Ct|sZUGzL{;^sO5Uws*5x&%eG3U(%Y#J0;zorU zufN&EICCV*ncJy+pV_MMNg+}A6xaPpDmqDzGgfA9&)mw=GG>mjk{`lIjlO)g$~Im1 z%vLLwx+hBy%&nuuLu+SeUf?EE>eGa;=Jkeub|Xku$dO%-%G33@#4yxY)Z^q_seSG8 zMZ-Vb8Z8&UE=th3g_M8&YHr7#Pkge>Bb}{+;8$;Ed&#Z?8?$CjAe1a{cBsjpR{)W~{VG`VxMebH^pMY|tA6FD-HuX(V{=B%9lNI)QjlK0{p9|V1E zMWyTJqK=iIc5^q=%j7Q)r+UWjgau%{g_lMR?9y|EirXtOUgl|scO1KUviM{lo3mm zv_5DA5eGVkZ_tJ4P1MT-b4rW zAKhnWR-h$JfYGO?zr14+Vt1Xo;=Wh3#^+v%%te111mN@A2({hEY8^T>F0QH0r*d`pq-jvTM0=pSeE7B z2tc8kq6pdo58?D*3a6*1N#8G@x)Hwd*wf(P<1<+Ei3on zZ{Y;8%I3yyOP=VSrXEX1Pp5a@0$bKjdT$lcfMM2%t?CVeA^aUG`Fwwwm*7gY@+4hB zoQpc-eVKAQBYVmFp?&;sdRc2^kcDQwZ8s>My(1gm7Zvs$*pBV41rr=QC~u7KkY6c7 z9s!Ecp|J9yejOxJWXk;CUjR-8c8ft^XJP>6ix@uOpVfLGL;CHdr1uZP+Ok2n9Lz!c z%9Q!TPr@Hca&qW5P_LL(kZJ;_e$0cOw8@?AD_UDQX;OPQCU@@K36jhT$P)Aiu?T-j zY0r@)RTxt5Q8M>eNPqf0mBT327Wg&$d*p9}0ImskfC&N!FlX@#Aai(>9-H4@uhm*0 zmX2m}OS@w7WIiVy8Dlh*m9jQ3O^_apQ)2CWtP5M2*Jg@;a3)@8&oS>HuvMCVDrb)) z@)I4KIWoHSKz<^-T#K1-RaFu-NzKjeJ1mhbTx8_1&DLI+2e-T(Ya}UFGreBr;b>1! zPf*&QmT|JX2Ev5T8_`~DlY0lpYyO#m!za7>H^nL?__6lbnEkJP-90$Sf=Gs0+hmc^QtgUdxiN%>=TB~t~)Xa?zl##^)LO9 zt$q1Lk1qPDI5h#O%QIDRFpo?^9D!v5ZS>O*{jW3^26siF{12#o*vu|Q!3v)}z2)*W zd~&(Ou$Tlg_9=eVRbq2%{bCyk^YW(=l367ulCP#h2;OK#N$GjM%huBEEqWNCj6$VJ z)6z9_GVj8TC;}*j`NdakfcY+Bplc#@ zyrqn6`NEziV+f-k`B@TKN3msk~>Y@3TPy; zmKQn%IP6&Bu|VXEkGA@{?Dx&r8x*#eDcu$`u9JJR*PHY8oUZtp8YymQt;qd=6d*}^ z%*3@?YC5^YWC}tfXX?|$`L5JZutg$o=U@?z8plH31v#`Fr%yjJgLe9ov=blPj?u{#3T3T8?eSOq61L0p& zqg0mTdP`sk;Dq+XPaq#OH1A04v3~)XFly8cAAuygi+s7h4=@N``5;Rn`P9=qx4+OrC`v$f zfVWglQ7r+v(hR3yOcOY|7PkTt7)3TL{onx7*j!mucUad;>cJ>4%5VDkx`o6LbdtVn zIXZ~lL%Al!PMDOwQpw0W)`lodC!v*x{xs0 zw8qstFtY(#ceJVr#0l5Hq9=jZM)!>k5psAqG2UAALpZ^J6?0cZleGMtc6 zY6)Zk%VtlAAy>`>&Itel}zxm|$sr++3 z3KqtO;hr9!@82c4xVT!ADWhhbXvHHRu?r4-3e1KIm5Z#?UFqH3_Do%EaJ_8DKs%&#@ttbMMpSO?VU zAo*dhs)D!J-JhjopP)_p1iSSUPJQ$Va}gMak=$g0W7N}l8SZZ5f*VA(dKDe)t@-asBWyDp<1)u`jM+7~mA4aOPbO2+nTD}Px#>z-Ma#k=GYulqy! z(J-@R=B6GrZZdr#lNvv-yZXV~#;KZ(OT=zQ;PuzIu#<>LV|ZQ;@=fSlN^|a~UamRg zy|uDLM@ho897FOw-3XS6T>l2Ri8Uic>e3eVGU`e9ZVp?^IqhLoyF4dr!^g zW0Ys-!p`ka_NY@5w)Mmn2Z0^RK1QiwzJr+O>6}hsqE3C@M)E_& zuQs+*~heTbD$dy6h(ZRl8<`{+#LsuX)~i-ZMsEbxW*D~NYme%o-Vg)5SjML(nUj+ zV91k_hM?>vcl^Yrh_KlG*yPm1HVjPW( zt{t9v61%0|5pudnPUT6rQJqO46`9(w#F>7v0{;W?H^+^U7Z?~57As9}#Hgsh7z?d- z6vpo;yQd!4I=3!euwr%OekO}*u#p-hc`U9Ps;Ow4MA_6>Dw!mi^KMD2yh-fA10j5D z?Zr;LrTS+d>|Wk=I(e;wrqZIKxGjE8o*Zqh1?ogSvB9X=iJNnMvqXH8k%DjcW!p}I z{orjrVTTdhv-)YIvO4sWyQvd5IV&$sGf+c?WY=cP;aY`4??i8YmZr% zt9vwreA&grv#_zD>c{AJD16b+c%Ie!Zbqibqlg#}$&IGtan#V>wV&hGEq@-BzFwYDoHI2~+sl@%tvDsKof-ANpsG z!C>3dOxG(57W+cAmjZ>~+BZhS)xGTDo!>c8wbg5iKYGfuUSsS^TK_LK39GDOkNYh` zoAp5FwTDTQy9b`uAMj3yuHt$I!CN%-8q#liroZqygQ3B;kpJLDm%7Ks2IZk@=P`_= z3)mvqs-7*&|7r-b4ZK2EMe^Ee~&V^@2_wmPHa#$3}eP6=e%hC zLX5c4YOT<@QlEoqU0KuSsb;+ZM_lv2WbxC8C3%(-DV{O^X57*Ow4ViPHFWv2 zKo}m5Scq(V!HG4Y9p}9YED|lMMgv`(~Hz#=9%9~l>x*V_F|1{GXjyAgfRyx ztd~g7)rygAO$c=+Y6rW@k{qlABhf}s1l#lj~U4U;q z`LQbapzG$e;ux_+DjP~JJ6*xM3s9bI&a9o1mYKE()m~{(P&(XM^!6Jr3B7ZvnPacM zv`2twz&@eZZS(ka`?Sr@8vh@9oCMnd^v|$GQtR<(mE!~7Z+C$cwFRAOgo|dT!t#oA z#-3_BiWmw)BO8Z4*d__k*X=^s{P0I%v}&GOuMbpqY5T|pRrKaQ#nxj2f@g;_SI&Vo zSGTi0L0;|FANy>G=Iv&*QBg-0E!vnhExpif9S&>y4d~=KsCbATGMUs+hGC6c%G3Xc zn9Y___?wtr?o6yw7$E2LeE0bLthr*zk&glnqiEO?(I4iR6^J75NZf$lQvz&ED3>v? zuQJh5YfOxcm{(XeedWeNEw0EqJ0Bz*yeG?3Vt5O<0;FLW6-88`cf->rHh8fG77qfA zI2b3AWe;lDTod0wHM#xE&O=_X`b$Je8DF+?#i&Po-%&^2kvC+mt&u@;;0`g&ftNK-N)< zSXfy#Pfou7Bm&Zb-I2$iR1vz2@<0OY160%7{GQPS1WmvNF&>uN&9(nAKe&7HdKcFt z1Yj$Hu53gbx^o?L6f*)$KEH41^cLTz=MUWP%W;~Fj=^*Qu<<6Xl8x?Q@~#?FcI6Qv z@7y$^yl+{}(^Ci#{5hLX1qBa}ssYPk9bzK@4!Ebk-w@?W9o6d23hMJzg-Fw4Nx92c z!^nVsB1fmyLQo$quB`OeKtEKVHcQTR9>A#@!AVIhuO$w-A_12QI|hIo00cUPA^W9& z_V@;g@Mn_2S{K0x1OjoLA*xt(h0Mo9NPU`p(?FJ%5Up$|9Gp>CRE$JebMf+$|GZb$ zJ3M9E0Lq5793CT}Ztlf*kj9CnqKn7=V8g70NWOUxd$k|ss4)IW7ZI^Z10QV-0L`Pg zG2n4?-&{a_IoQlghq=NhoT~4@UoiswhRwxvnPNFCeOSLlKxu|uv|z`NX6ra`adFMv zsH(@T`yKfS#1(C}%ArRVjUfRRF!bfsO<)59tVX|1!CoYkuN5}{1sgU~($RT15!q}2 z1ijrOXaRH84Q@67`q{2}vD?txFS}*tiMMzCt4lX-=R|x~ItZ7eqakl>HpB50L-3iR zPQ6@DdUzQ^kD%;&D|$~p(z|s01f&W)>v0@}k5f%E2<~$6i*INKrGI+hwRWz~I=8v{ zD5uyO$^L275xbz49_ZT~*8;+gLiklgF6~FMdhrIgkhgZ-LF4RG{;|@Hl<#`AF^zc9 z^mAWOl*`K{-kzIsnk#Wl@LzvE(#1^6#BTKscp7c z=p_^?kh$M^CQ9(>V0Tu0514NBrsx_zCWxt!`qE-{pvX%SLu2wxge6|Xw|glw9u)j^OYe! zcf#EDJI(!{YB8NA&`UwD_kx+IUq2tzSUkxO`RaiT1?+Z6n$EYQ8Nk$GpG3e5$-aZI z#0NH+$=vz7*Q|!9M==NUf1*Zc^L$=k2zxnMM3e%{RyszP44wyV+jNB2(K-Y`>-#Cr zJB&+*jcBAZlwICD#=sLfVZ(S|TB>@6XGZ=S;91d(cb4MzmD)k#)LG+o{ZId)V@daV z|Dt0J14$(EB0j@P5s*r>i__k)xu^i4RB9hWOk$wU8e2vh9t0@>Q*fkYAWZD;?ahT3 zNz+9qp?b&1g&8GZ_qNu$Ok(Sf*y5o7p-L7u8)wh^YKSh(gPa8CynWc^RU$ z8>YckeZEN{_xbp_gU{-22|;JC^#9QUIIjvloVfaqn3;H7WRD+XG8+du`FXB%b0n&J z)>OWmszs;6bP679sJG)0*jMO^dDxHhdv?$gURP6BZ(P|U!_5Qa$;{kblqnVj;F4Tq zSKf*I`kAZ#f|f9<)&K@J~Q;q3R;jz6 z1fzcS_A2jIfGC4YXh}j}X3VtNivTwenr~ncy^q`ig=Abg)gy|CnzTxT7a?;YlJ7x} zG^|A9YiNQa42y7F8|ab9HBQ5G`1cfuBk8;of)41IJKfD`WEk^W!{*rut*orB z6kd_Z-oN-PG8w3OF5{4VKp0a~Q@6{iC}FFJ*}ZqtcpuhR47~T;YI6$;V&{NkWKD3g z%!FwP+!Qpsz66tB44>vu;;j7q8-N36QHGZR(N`02lU+c(J{Qw$H_Zl#F)NNGzhz86^w}7?r-H>r`y1|l_I_qAg$WSUs}pvujpbZ|(pNrHm=1eG zVAYYy9|+=4d9h&NiaR32sqLuL?h{_`d@YUUYZ0HTDJ3e&*<(>{2IK6Eyrs}r6MRu%Z<@0Un9{88i_l9 zJU}ZL?`31!h_gx5Heg};C8gCaFTmBm>7g7rDFB0Gs#3BxY+ySW4VHGW!nnJ`un4udmqj-Lc(X^Ra%!*MY`wC65qiU z`LcLzysys}LVJ$NffvO>t2>*-O%RHdeNg}_P-W>?kLnls|62p+vr}*^Y zZP~mR4Yqic@g1>9KVC?Ck~_`khhdc4$>0NQog+^dy^Y|9g-@4wRDIyyGRjj8JNRmt z%|7fzjwxT)Ys;t2WlI*>va?+F-m5%jCctX~xlua(2(?S=5Bbc(ol)5KcFqpiw@4WN z1A~KYo|zsuI)?kZ^A1ma1^oK!k9m`s>%9T&Dqx@)JN)sw)nBrzy23vwdmgBV2&gV5=fx zh?UOx17tN)GO^p9)nhEk8K8edFul=AHN{IkT$>0LM$k7sP3#{xC`Kz15;#q9K?r{X z1EdLg9yVW|*z{&R#-~vjh#)f1xlb5ebL&-RMtANvjworivZn;7l$~X-q)wAL$AUxE z?ktp{l$6v}K-8xg6f>%;Uqq}jJJj`Fo!M(4Ep>};Gmzs7FUfcUTUg$@|%KfavZIZY=Cv;=^glCpz8Ki&~cM`8B$Q*wVzZ z8=3Xr7_zOeQ#agoD+{(Gy74te^s*r8_*fY-NI%`_G9@!TW$$>e#hNp^4yZ>WF!A5W z5)?7;qzFW}-CFfTP|}Co;jOB!Hl~zQ<|(ZypX0K1sU5EofL4RMNIl5EfMlUds08h% z?_Pr(OFXC5D#1$os=N6Nn!3~80KGOSBTJCBklxe`KRb}mqCClb{rbc1+_M!|m^9Ui z$Q%YnDKRlWMDG(Jh1(yy%_}W=k`Yr~W>gew{68$eycM{Wc2pzP4cc(ubCkU=2|rDj zgye!Th`%*x-d;N+yHfGzRMBd1AylfaEibbiXtRp-zxmckT9zs^pp^pL*KU{>?m(YV z{3-J#Pg6fA0|;UbYxef{(K>jv;M-|+2sG@liJV7a%ohohT^z^E@~>JO12eB!;`=H5 z1_IUgcXww~rM^=;b~>2+%h^sJ5{664M=pR07%~nt&GYRwd;ZhY2gbJoI!!ohe-dO} z+1r_u_KA7~+AEL*Jb|7aA&H#Yg*5j~@U)tqeL8dN-b~*Awno4StSzRYGXU+j-eN`i z7i$*T^jV6_8(=urk!@#TFA>UN2V_O3Nbw56r&`Z#5r&Z5KF~{>U2K4is#5#&hcro$ zkg{PT!al@@O>DHltm1lgFD&=fjp?n5m)+)BDQV{TXnNQ6$&1oZ@vWkJr(ZyE3_4;~ zM$?>L!SIW0#5)%P=PaEA8!v#WG3kbwVl4)18GVYz0c!7)q6GD=8`Hr)UpnTP9+bai zbnGzGq?VA(&@Ray_u)%bK+6gW3-NRd)e$2~eyPBaHEaqmgXGC(6Rlwp8+kVU#3VD` zF=Il%bXW%WR-D~0rT!sU*ZMs>KSg~DOX?DjA+Okc$G%ksYa$3zIPi5@vOFsO!{Ao3 z<_me14u4|Kl5U~(oiML+<QvS#7s&97UX+LJ_zG0a$WNW9l@Qj-#UVBQAWwj=FOKx z2d`@8&)v?d6vux)(He~w68I(W{jY@tt?mj^{4gvfTTqYhzIQ#$=fezkkTt)fD%A}6 zTt9)CS`s8*C26tmb#Ep++9~Js>P6-)5QjE%Oh@54RgV?@f--gpwucLvfBIdUg&6b# z_XM|^ZbI>X#Yub3(&%^{+X1OY>I=7u7n|R|p|2)nS zHWi2_Kyx(}UG>zy;}`(nzTo2(WIP8-g9`bWi{Kg0>kI_m-59dTTa5U-l`o|FI0-9y z$kldZ*k|l2K}IG|#dF{K+CZr6UV!EYR)&G&=Twh5ZeT(QBQI>cHOcjjxoFO=l8ZRc z-`b%?jB!-Q`}G(S$-91moZIX@;VZsfSEtb4gLh2X>bAvIv28}%?F<)br>EYbu1?){ zXGqdgMDL&`G}C0G?w9&_=@>SsdV|^|{hU^AR+54T+>5$8I^kwqOdYhoUXnNz zP!O>eeGoS4h2+4zZ2n4J(PinifJO(jZj|Uw0IHP997_5?d1;uMO78l=T z;WshlsO0VpEZ96p7co24b#=PYR22w>WONCbnZ(4zYiA2TE-NnXwY`JUh{L<=U_Nf` z7!yJAMBSR7B|w`c5H`4+g5C2tgua0`z!o<7Rqn2aqRRdRpK)uKF|vsrtnQxvB=|KL*IooP;V{^GkVsRP69xnz zI2(tTW*2%FF1?f5fZzmk1=>mOpGr^@Kx^A!X8g|n{rD_UaHGM4+Dqx}Y2z51(T+sB z#^D8U{b}^lZ{J7 zJaF}UOjcgrbqH$z^0kWyl^EH}(jaBSb|Q@(h2(ym8$=7xFSK0?5MbvQXqy;MSQfcy zY$uS)v5j8nna~$(p4(k6Ed0S(Z zhe<8&(`#0LyTwQ4Vm+k$0MXiM`jce?Hn3}adt>E*8@SY>uB8LRNl_t?DkN$DLIpYq z0QY5) zjs?h{KLgPE-JVHt>U$ja9BG7i{^qyB?uVf2>wF?>}WyWQzTBYi91s zYuIH?qt8J^Q{81Y^lV48u-+X^U@kH3Wgg7NKZT&Clzrx%byW9ditNaHjjAudXO^SU zsbwCz9)o%b^W=OLPvz>+R43a)dk6Q1|JP4}z%g!@0b7=|v{7SR>2X^7RRMU^dl(HH zwU@@r%3Hhpu6lh;+~{iAXz9gMoNN}qA!2RyJ<@B$Z>&&fQ3t`Qx4Lu{O^;z?pe{{68hDxsJkTFJ%162@W#*@;~RSfe}R0z=yqxtk}`mR+^E+rJvuuSw|CK zL;ZLS#|{0P?i)Uy!;agW^#`~|LIl|Amu8D|s2+nbLVl7Q1D67Y4@dtPwr=OXV1B&4 zVyua#+;_hnYyrc10sHEYLD&0ELcT&aR6QOF;%ZE#Y3*D>L4uhuD_L6{3SLZSz*b?` zFj;oz3wI}$K{OREN&2PoTE*vJI+68sXlo?^^SHNzAJq-P;Bw|`81y`k#_O@VOQ!%7yq!p|R_22N=^ zP6f|;ZQSA8+sYX_)gnXx2+!wukAuN_Hh&(w<7U*agQl0~cc>($4_{l@Yp(bPA*lXC zTn{*4HrSFS7T3HD zS>madf=;-S@4l@xdvl#AJ>a$qlDXV)vzoH^1A%6pLq*w>^yfwg7Oyb!b)J zU%OMRKBeQ1g=VPNk$n}F^Ozs->hLfs;0%F+6zsSAQMqkLak}|-Ug-2BI4JB^yQg%l zRZaP$6{5drL3!@mH+PBP4k^uld+u(DzFu2%QuGYM}NTK z*;>1(c&YD}=(<^ z+n<*FLxTndwQ5UX)?T=~HShJywZksacXqM(=3({KGc`_m7-|@em0$KQY(*+~UBnpL z*?&`WGDcqKNxom>+2Al-ttV>;;)==nB=Sv#^Or|nQmfC-=X~>HCw%2bGgL z?x81PcqO#|5WLh(o!Fyyl7Cwe1pTNfU!amnTK`cVM^Y!UqAvBlgzuk2<7#_m>2~wq zmr*Bq{T~yqzuT4xdNmUEKGOV`e&eLe|E=BlH#NN|((s>d>Ha63+xM@Cm_lz9lW4Ku zoqyP7dA$GD&I}ZDE(fg%N&SYP_v?-)|D43lkpBZ}$^+`UQt+Ts6ma*z8kDPfu^=*0X6bj}<8!gO2p!%^b(Mmbxv!*I)F?E~iE7)BoF93Xmq{aRBNbE2PBU_^6=q_L=kkTO&<3pBb{FG#Y^~WBMzNW_KH<0me?!4S<*(j)<<2Ucou}MOr!RL%ljyO^npG@1)4K6iA7bve8v;++@rL*uJnng6jOR1sdxf zNZ5#85uJI@p<5eYPNAMN^|ri{YNoq$<2f>mL~rkjm4nSS96u!+SQy<2HmAUHRtbAe&W&!(hYkYW-F95tiZ*4B|n zDP??`i=gf^!OTWaIw!$yN0q#R6ybOixpLg=1Ty!@!sCMRpk4S3x*-r&QCw7jLuz{N zn`Win!1N2SnzY1+i*|IIIi@Oqdglmwau*(v8ezhuN4KJF03@Xn2H*i;_VF#Cya1Pi z_CJ**jG<2zng*NM%BTQVr!FWf_!F(%s1eQZ@epQhM0@8KT!QzyX4cfcw^sd+FUBg115?#G?3PW!m;z!5QqWN>2Z)BqWF(b{<@I@+3tQ zg>10bclhJGO6-dE;YGVd={nU;FQH=rwE9CO##pdJoFNr@OT5zSNc1xJSyr_TrOoQYwU zG!{Y^9{)JRpFk;J7hy_i&=cAc;1LoIAoj-5U)8a6^H|+=ezWa9%#MM#?k-Dt95{7z z`{0sI8t(b-M)d3RWA;!7X$9&LkqG(7$d~pTg(6koeS;68SUr8tYqm3A#bG7NGq~Lp z4Y~rM2gnQbe+xUet|5XZHsa?N90ZJAf4aHqWhg!7NEDojC-|c@8PN5xurM>Pj)fg# z*(E7SN%OC>HY|YPB{}KS$<7dSfP4cw?l}tK9l38JP5q!x1u!Vw{cin`W@_kNn01EH z&h!&n=;3O2Y`(?9qG6W{>WIZ>;qZByA%88w7r^;2*n}C|)Wd@Uxb=`ElRXCy4{e&v ziz9Y0MWK}y24a5x8i8nS@2r6!WuexWu7w@4Vj=L{tE?mi*y5RvNP1X!c-!?qfO#!0 zW{00&+S=NVyo5rqqvSTwmzJYnaWHzI@#g%h0#-D1h-tkI-Tzuvb{m=t$$2ajoXEOO z08DjoG2mk7wX-V zAk|*Qk2|3Qn?jt&bkJQYBI+1XMrk4k*{c8lf>VZPwi zZwH%05942M5U*@C>=+)7($u$%zfd*8& zsKrBLjq+8|#!b%ui@3KAt8(w&eE|h&1*8Q;6p*e-Nhks;-HkLzNC}9fK}xAemvl@( zx=UI@q$Q+7Lb~&e>3Y}uuHWAK?BChvk8`eTU2DNylNrzRjqx4hbKj$0kp6R_j6c=h zo8yVrnJ~^)`0JT$PWC481;&j;%TNVli?i|rR!z}Jy^1G$xNqgCQJa&>EkGq45A*6~ zGjOS`m>xN4;rhN_IDy^6+=0FEVn<%#phEmF3RraHnQp`6bw0^ptT`H}d zYT#R59WPSxL1{Q4OeC`ls)%@)T2?bkvxqA1l-$8%Lya=G6&LP@{RXM6uqMtQn!j;W zX6nMiuo@lU3SLfB7E`x2et)@CZ$P0^Oz!mh11(mhB_FHzdjaH8T2InLSupVe9%Dh+ z^AI_W`R3jWy}7|0xxs?mW@1kol}isahWQZ)%Zs)Sb}*wd@*zjs`Kre4@~*SQ`AODp z$CC}yz11a5#?rO7WwHihgF5!*<>j3snyQ+TBZ0z9p-3|;b?+T#5H`a6XShaaJ;P^Z z64FRVOUvJ_Tc|aFt<&h{RJNQm!b|uh$-*H)TPVv}wzTS&1v%{Fu!L__AJtP%+gEha z6^-(1%zo%#4qo~`GIAReEGJSnr9?<2DH=PpN_@dAgO{5lk$$i?C=qlhgFzZxxn-*F<38|w%TfgMPetT0@$Iv zZArJGKiI^h>rf?F}bXHxK#cTEnaSa_Hy$M#$uy#^i zpilLRUlxAk5zHv=gQRxesu(@3B$@n%Z+K}2Bb zK5E=%Mj6-?I7~f~gbpRw(H=?OQ)A?wg~S+wASp!vLOb-{X>u{H7DG9kvYU~{Z%tC} zUnTTMXv{*E9i*PI-+DJT3X(CE`KTgjav^v0eK4DxxH{?V zM>7kA0|qk5UoL%8mO41%E5cAeb;@}mKq93M;RWAJc+X;gnzl_qTHERwdiWdt-okaz zE!f1S-|&cAa1?^V^Xfz`bwgT38m>8%Y2dvbx!Cdxw_artQlRwCxdWkIg<2oyP1W{; zx0d#g5xY#`Uq7j_Jla%cS1q&*8(~3tU1)1Wbcj=hSS`PdaZWhG$DRxTmoiB2KaT1) zM?@Nc-v}U%RPPn9Dc&SDbCzRQ_0$4Z(H?B(2duXbYo>1ox{9?FzIufYDw>qaO6?(1 zWJn9z(*(3nL~4U>Pzn1~h*s*h2lcFyUnJ9kJ79a!xa1_$drwb1LY*|nUL`vpE!j#Fr~;-8xMrJBRHjEQvt0Ata()FLOG<)(C%$vXBHm9}R6NSDV2*F8fyk z?DTqZ0d7o3aWkSH;TH`-U_vb;kn5a5Vx-&;0?HtCHwz!rfbCtcSor?$FcikNO&chQ z|C4!lXGhHg3tU1_O9X*q^-p#2V~wQ&pa%Jn7z2XMZ+)`Y?l8=d%(HB%5*!_{rh9{T z{>F8fQuB*Y=0XIz_q5-6>mDwki2)2Zv!NrHPE zp-EL}-akvy_;G~rUO-zLaIw{#f;Q8++Sjhu;?Sqbz)P;?B5CMrlVpqMn~rX^!B+E~ z4I!7=@7Kw5e0+@91X2qB^5rH#8^7rC$3?s;lt}(`XzNqp$X9HS=rn-Hbmd*nIpA}k z^3LJ^eETXcGg(mVDK$#D|M0_AMec1ZN{Be=j-sgE zr#6@uM~K!-uRS!E0Mbyq9%iV#t}8IQex3yM6|qK)M?pA7y&MoOEYTVzbAvG$90;cx zUR`jVd;b6pElgx9;N&SIQer1xejrd)d0kDpR*l8dqZS#bmeIe&Bf!1YnaA?m}gy-zlt5=wo^P+GltzN6b1Lxj+*EKNib%35SM$iCbkC(3I7DJm((AO1f=XEXxr+;j?IwOzwcX#20YMJZbEd5}_ zX2_nB2`!{01#=2NJ@!LidX{IXjx7D-BI zRzBOn*Q=>j7LkfZMr^sNJ_p%4$mpjW8MqcluaN48&s|(14<8ILTpW|Jm4+*8M46pZ zrIWcMW-_?N86op*#$8>%kY2+g%h~M7lXjIS-1pa4G}HTvQTjSx7W$){Nf6}dv9M!> zXv~!BwDQNvGjuGkyzM>ZbzhK8|B!p*ofWAJb{0(3O8DO zRs+KzTTMbNX?V_#g_W$m5&S+r0S@7{zO=+`gK{)#Mffih=2cgZIi>rJGFlXCcl#7o z5!neR@W-!`on9M6Xn1>jtH*8TIKcc??UkdrlC>_uy_5vI0ofSHt0IRQa_~4$t206A zyeeu@;->Jk9fbIoV52Zwg5qV)8dY=02j5md0_p-_%X4+h3E_UCqd~(HOu*LPfD`I_ zcd}Y*l2jK_2z8ppxC@yy%(9*360YwY!fu>^H^k#Y4|-+DF3dku&9-CT`(;@1xULnDv%JXVLF%Rvr3&a9S)Prob=A~(Ti$z*qV5D_%{x+C+7M0=$y zu#wtrsY=YB^707aayXjMs#B2VlQ$babm|+N{{nZ?HW4ZXAoVvCR3c5dRs7|B+w7N( z4KCR3O+{b{f^$V|w|B;C^|MG$16xZ=_Q-ER)_Db^YMs;epWvjJ%gdgR~ zl}1fiOQ9`b*auwUm-=W)ZsY~?8&-(<&s8~)f$+Pq^6i@f$Vp`iTc3<%kKAo}m_}ZI z2?M?9Ahzr7I)p!Ke6#2kwl9oNo%yt#0=8$x|IiYbM6{p z--qNxa*SNgP`AIBT=5QGr%kV-^4LW%6t@>->-+*dW|>r@uv(J$J%lapTVUlT9Y9xN zMvk)`ILb&P;(8_Nbk)LPW9lBnxfkIy9jE*Qz!0ib?84>dRa%JHAuP}pIt;T}N!F0Prey?MFhK6$#^dlKDBE;*3e;(Gcp=D_Vz}v5<0>Ey; zYh|mGRX=TkqLvqKHjQ%)&4^Qoa1wqRE&Ul98;#|P>txfR#Ofi^tW<2jj-Nna*Oxvj zF$dl$P~gkpxY3;-gV1>F6L!AhVB_V1kG9bwuAfr4Q@1^;cw_XOk>AtlBymLp$N zGL!^-Ke#wE^FjC}bv7{Y64<$H$M-~Y8*1)p?Mz!%kZHVd(US&^aXn~R=Dr!ryg~OT zb>~|2Czt4qmC`wq6d1$(hMwP82LY_wMYz;d=$2KH;t?nlg0;1wk4E6S1rStbZF3o% z%?q{UCKv`6-O?=-^*-x_;0CFre)(aeeUp;FRlQU0)fHE%>Q9NBT-M0u7t6JL)+SO1 z%Y`7*@5iA%HSGdLbB01sT0X`?PX+h_to^J`FUYgiVonrS$5$#WI%2ZGGL}#Zi_>!Br#rKdAk1H=?_(5HwdUl$?2qePRvrts+DCBVS&LE9&>%|Q zl6q2j8bA)tsl$OHB5Y8UEIdbAt;!%RJ~A@0=n-Y92cYeKpxYI?msWMa9eYCjOCScp zLx#b)J_5TNVwxghYE0Kh=wZk@-go`0&B;OR%$!BrC3r{4K=}8kCQOYv78ez%STT`dmWG) zU1tJkXTQ25wp6|)3_lj0w{Bm(-y3&DA|qgf8mXg!0~C@umY!3^fI{^0W$ge(jiJt? z&?s!p0I?QhWd>YzTsy`?5{H#L6)ZXPG1`m6Y<4+PDa&H_t^`WvP_f|((9Gx=y|Nv6 zq`_V7-HEJc%ZpTZcfSM6i|Oc~Yshk$?P zE2>N@f}7to*JZC?DY*7hCjyeuA7zERb6r5Q-kR`+*`3}dXU*RSNrA8}#<@ON8muF2 zY@%3;Iq!t|O9oIJn3N%RphF{BvvHxN?g^l^kWu}*18bjrwc+k6dN>INB!luPh?a;r z44QMW?v>hxu=K(ekLonDidh1BdT5BTA1O{Js4w0%%A!26EdAd6Y3`FZ&D_QERWBbY z>lj2yj#{9?#Z6da0dA$#xJleA!g=JVl*F6bJ%dfZNH%%4SH5@$C#_XW9xaCEvx`bQ zo8GBpk(N=`gUR*c*t@Zhgjo|(liu;j`g^4)dnfk#goxRsI;o9@S=MRSx;e}1E4_Ob z9vFz@aeh46He7$^47#=9o1sz_C!Lw*#0{C8x_;E6s?UWJ&&wHp>~A4?17oi^6521f zCoU^=vGJV!3!gE{JR`J0HvtOecnhcF?G~#w~L8 zJ@mQ+4YkFs{A?xHX(PF7cWk5c^IlPJOzn+L?VS@C?@zo%#uKvXIQPe=hg^{$!+?GA z)!k24=RcnLM(AFJ)s6u2ruu_97lGlud;RVg7`50jOwG%kcds{Wq6;lnobHWn#`Jh# zL193?dnOvO&!|eIfyXH#l3GzW$G_fgSLG$j7)q0*d@$(Pw&#<5@L1L>zMEm7uou#1 zapSJH4I0307eTs$LqDh2U_&|Y0cK!IED>y;d&Cm$YQ5Fx*)H2PzI^mhBAV+mrr#~> zF(n&y^?g^F5&2rc9_wg_)-x}lG-|96VShiydH4RE*INf8T{L4P*v>Z1@S9o6vAV*g zweig#BI&_bB)%!+5WQpJR(%zSK}z3@T^xds^QUkn6eVO=N5Vz(xP#ojGh-{AuKc8> z^uU4NVDA_%x5IKf?coSj#l2@9)>ByB4%0)D8*rTsT~|kY3<6aj>`lRcZ_nPY*(hKX zV?geeKVIS&&2KfE?>tENK+kVQ#7@$Va#yaDMdQ0Zd2q$9wohOE0RA14NwOaq5!gDe3}7y*Y7L*1a@l-{>7Q)IDo6 z*@{mksej-0*-`i%wNQW*()RV(xj;q7(z}@=qQ(wApVB?Y>V*^dM6E&M;@872WP19G zCsdH{I?K)%*7p1s2w@U%EXc*z3$fl%sWWuz?(sUft9>AG)q8XCQh{x^%!@T=O#yVY zlR6~g#c}nz=u;}Oze|0nkK83-k@o8}VUCx=GcT)9xXvt`n)B@B<@8~w_<6>OLBLGo zYayo<1)8)WhLL0=mw#i={C=+R zB(#mrTl(#A=Zbjp=7api%m-0WUV+{ot=V{MUyzUhiu< zj8R8p(dAqbXo(kexd!iRMESn&!nswf&VUuLXmSJ zoYKzp#S+sw1scAmW}Jg|6VoPgcrsqO=DCgHRAhYxneGLFsVZa~>Xtn5J^5=MJ1mB_ zr4?AuvsMq)eB_+MGpKCa_yM!01%}0RGR-|x)jQk{tAZS-HvX1cimTl+y(hA^nc3;p zpHy5q=kY4mmKk&POEFNlhpoq2-22v0o_65DZ0l>`f8J2GtLCOlwIk07*6Mys@He-KDm=$UG=q3zy(oruzdmhr`rX7{rZW4Jb$D^NULYy#A~;i9}Xdt%Q{;~ zfr-9~E8Mf8zj0t~Az5CD)QRkU{-MVZo*+`fpw(+EdT#eX$)J3o@3n}4;}sa%K1c_G zL~jR*hBSBb`gN<^+HqSeDTRL*m0_ge`C96_+3o4SsSoqzItem})#1>kXDdLT?Pfww z!^P$+%1(eW_~dqb4mF>bI9cB{_Zjcs_p?kGR6IFlIu~H7=^XVZa=;b7K2S&`ems4l zs4M^UB;vsCd|rB-qQ+pm+Hj|xI?^b#PD3)w#6-$_tdZ_8as4a_JRuO@)Fy*aO9~UG z_Ki+n_|T{Y!s+QhXRQ!JblI;{@6+M)3zxjL<0GdC?3xE6JV2U5d~4Rd~pzT~tVLH7&R=QZJuS4dBhNw^}WN&fL++C7S~qr49XoH#tz z=v+`k$vpn0K@?-b7GAl!*!wGv3M!?S&$@2RPKx$h&HU#&w^MeMu-AS*U-|ums=}xh z$5pu4yVdBQV;7sg0iO-BVx}BfqkX9T;P1hMw%Gj~2O>auieX=}# zsDSbJQ(+Ui5Sy>}^hG?Rhv#xXshB+Y&mVpx`1NlP;LoG&+85a24J|IkNVV3xS7>tn z`(@fIFQWd>-`D^=J0795!}yQi0SLH@inadp^6+Y?IQ}1hWI=$+^8MqF{y%$>Cd};w zw10n=F3}MiGBhZTqI}i=w9;Bcd0P2jrt@o?MMncpQ%Ifxu4-|3(%DXC#X_vL6`9z7 zzRTRTxw_-ErqNPsWi~Qy@bFBRjfzZoc5>hlFX(^)gaA~h556jT@$BQ|y#{SC9C+ct z`t7+2*)=$s0F${@4a&(I@3XW$pccp<*S+-^5CfECaBr`1+J1nI-5i21h_j*Mpt$0u zoB_p(NRoRH#DIq`C?5LdmtPwi8)IA|yq2{*4h^7^>+0%SZ|5}o9}I;}G)IaTPb;o; zgn7c*>Pfv7X8zfLM_LF-qw0_KA?BHENDUKvI|hwF868l!@Ev9VRP?Q_StXLcdoZQ5 zNM>?Ib#`mVLtiqmLF;Epg%czka8cht#(!+yv0K;wR8ErpoHr24w&eKBu&<$>Eypd<#|WVpB+G|J3ZA<#j!xWmWFq>0K3KiX35)bioP_N!^eK<3t=$JQYj1*oTsU&Xat zc7jG3AfEnKarOfkm;%dwMo11$Y}J4lz6lunBT6R{gcfIe<1`1jP8^j_zj)eBA2zL{ zqYbfDW8V?rXlg;oeTix47MKi%79W?OUH7x@nNPo91~X>8;cM_{(89A4qJZ~=1HNX>B6HTy#5%X|GA{)tKF*?U`n+f0CgvOOCauZQj5WXECrr8oDqdwe#A`uZ>cy=mzJKYvL76xkz}o|EEY zcBh#D*#b(3lH`b7E|5wrT#M?&3~RekKBmt&jw5Sat2GFxz0SKyiikXrSb*z7JV&MId+J0%~Diu({SnI02Xhv+x^Geg#sXC^66l%BvXBHnLKcfa=^YRQe0-07MDO zHw)#w^7aW&!8{ELCA}c@*U5Y+1g%g2u_+VD1m}!Um16r5UPlbOlQ#bjPNvNzS*ZV7 zb7FGcetEvXYPaECEzT{Dqjw#381YE?K&?&uKa~6-^|YOk#*14&$=M0&jgGC{(kXrB ztMB9($v@sArFTQ+ws?3_4%tCYs!bXi9E|GK#1YPqgfff#9WD~qFTQdxc)@d_%NpcL zSB=PSz)Xgm38H+Dp_BoNU!Yg@vIB0zSQ3;^;P)yr1Wbz@qbivn3ky_@Agid&G=TFS z&VM2FFSRM4V4A22AE0N^Ob`we;O__ZWu6l#>dkjXMftwi`K1h2c52M%hK7cB8B*X3 zJ-7WL#vhtjF!Mn66c(5mJ9TDf;e?DAAUNTvmoOZTdet<|g>SOI_7i9Y(rvzBY+1X_ zky2}NlxY@p5MkFXGlb^4KTwarNgo~oZcITa6#AF9KY9hFu0wZF6NBP6oEsViKz@am zHA1GyW;ex@KMr7k*YHozViV*PTlh%;9Wckx33Da82(XKSAX@mkfb!7HKCG6|mBUp| zltXDf>Mwo(Ae!zMyz-fphaR+$+o276Q1*zW_la6K;rla{>@*yMG#D6GTdW=6f%{(x z0&rcP6Vf;oc0c^@@en!OuQNZy@sr-w)46Utfh9{)@bP4rcG`VM;@&d{;7IV}+`UhG z5oB^TVIE5tP8K7`Z;L1TbACRqIB{8=r$ZJ6x637?X0ST2Nc8OQcW4CEe<_?7|HSh3V z6Un3AR77mG>->=BnzsJfz(5*NMN6%Na6)WV-{fQ%>LwSoyf_k0_VyZZGvjmRf!_0i z11AA|Z=Vfr^|n1ljoGee2xqB}30co(Ds(b5b{`m!LuWd`IU1)67!^|ahnP>G{Lx=S z8YIPsKzv=7co>&gWwjT4VRTVj&q9OH>Zc0kL&pW!RiOv*je1DOLUG5uI9ZEL$B#)* zi$Yrj*P)WQQ3{L8QlI6b+`aqvFSNF`vHJ0fiG`Z-Xz#7@2rH5*qdye_7!Y7Sb(=O! zi7Wxf=di#b$?~8gENv6kHVdvCLnTCb5rDl2-GiJr7eBur{0zlkg*$ToO-9;fuk8hc z0RTfsgS_1QdBf84w5I8IWYfkU3jgpgDs`-ZWd2RB^7Hd=@1|p>ti3JLVCpw6q(D_^ zu_UBV1)WI)4=4sN80~&mpw%3!FObPh1kF0r!xJy>nE9fr#=9QPIbh=s3L4Ea+;qst z+Zb~vC`9FD5M!abXn+d|G-hK7GSEs+!aG@e6W&hiaXIX#Bjuh~A?;-mald-eE%()0 z=Uedm75y(rdIv4vbN+lz7y~b7EqPu^zMV>!!;~-e>u%9YCKZ>o;0h#)qhzVj10sYPFnQv1RN>nGeA;KVo- zp|?n+*p)%_`{0ZFF=DhAEO?6I|9~{mOd{h9Ha8d@LhWjuYBr-LWw<+`x)Jx&ar6oAp%)>YyFO*wf8KgJ1bRzy#p>VnniO zzg9WeBER>R&Q9EV%6H079fbN$|btgW0M!14# zjGQ#@y_8mZMvIK)P`PHN4)wWAs+~7}5 zr>=#)6bM6acySQB@}Xa>0MRDaEKcLL?j$I9IjNYFAOCy@F|?%AB*wG(Wr=UlAfP2k zVMdd2Xadkc>ZHeBgDZQgsIyJZO|qaz);CHS z(hRn&%^#(g*Np!FEA-)=-S3g%wR{@Mr{pn*>2u<0@5N{eF;Tpqal$YmnbmRTQm`^4?Rz|mk-&+ai zVa@&T@C4pY5mBqE7Ghh&B9q+6RPdV6Ql<8_`>2ReM5VO7K$Qk|IDjw7YX>-G{|8W@ zLe^V#FoW>F(FF|WUl3)H$o?BpSlK^D($=7T$6wnap=CjB<0K?_a660g0ld&{MYg6^ z$@W%@0uj6wleM!7W3R&=6&{|s0POfbF$($%glNFD@Fv)NU%X$TKymF_?hlRZ=+Z*B zVf>fQV-S9#95wP}@}jNuOWj&`ZP^BDexb&6X-SD%$=NLn#uVCs=N`|V@q%~%bfxhv zDJW%*JWIiC)!5a^6(%BkUmWbi%V2Ma!0ze3po21Ap;p({vyG`QvCXxxEVtBtrDm=>ekJ0v>APqW z^ZvWYpT+)1nP&5`uwPi6oyW|NYC*4Mj1%X6;@MeNaem8muN9fO&>G*3VmlqJ;3VqR z$$C1VEU-bcXHYEo7pa;fcr8$p@6EllHe0Z-^V=)p>ei&Z;>aBPjErKHe-a6u{eTesO(b+K z{zW7d;p_j0NO;J=qZu^u`;|<(#b;1g;@+3oQLl&CxKd3ApDM4}t~3}N9Hc)E4wI%H zTkLfKMxp(D$GKibH+_Me%hn{5cY`$2NkWj9WC@@c^lgh8HI|sSIB;MG)F-??J6G#E z9(DE4ddFw96EREZH_}*(b@d!wZ`V==G9w3NUu^K zpIYuSmgm1bH6d?rT0fn>e;;pcWGV&kThp36Yr5g7+E^w&TczTSqt9)H=j{%+yTrW@ zL`61ghUzP(zFDsn99;eOqW2hSaLNLWGkiXK?IICDZ%}c9)~B~kRu6v8J3flShM*?a zy17*j1tAhfVL#AsqF_zC5c9u515^R+h`CwOnYbmFFgh@6@MHZIa~SH`pC1|d z0^%vx;!ynR?TGmk$b`holc_tjGw14PHNSloI`LLX&QN|>{ylVsk*z;?yfi}c#^?`U z&_U2PP!i;3JMVUv-2^$`2+Q|sO!^?23-9pIJU_wlVtSs zc7l;l^N;F(TvbS__Z9rasM_`qKxP%XgKLLa6FOgh2lZaneMu`_z{C;AEGV1CKa>YR zjHR#E@v;Gm>-HR-G zv)DBRidMmfZ{;#Z=47c={oN8>ybuWX4S!ZSYn9v5z}XK}bb#)Inb@WBF;RwnHn(9$ z>E8x|*M_tz-qyXgm&zF8c2*At^+W%Xh{gClIaC&5FA=c2qORsUk3Ur*)R?MvOz=+4 z+hP4HAb{A3l)ZEC>>XA4(W<;a0t>3QAk?d+SRy`{84uCr4P1uWI5?G)5|Hgo2b>*9 z=okLqGBVpm7IQwvOP*pHg9b0pg|_0t>XMp!f*6N>s7lk7Q7$I;k6riOtS!%Pc1Cix ziVo++mz*TJ(!H3ETn8z~KKXP>b>y>XP>c@qd7yZ29(l>k_O7j#E*Z7bM&cA>*x6|= z=3I~#1#FJ0oVby*c=UY&hx8%X!ht+#_#i>`PEw;)CDmk{gjT;@>uoG4Kn${~c=OsI zN$@RAnQ62uv;6JZS@v*1K`_=-&fQG%8lNniviGX#fw;Ba8qR3hgx}R!l}H(o>WCyb z$hR01!2s`z9fsD|SlCCxXj+p|*&n?Tk(F+E_ng1O{>pdZlSHy%WudyNYPh8iAc6=Z z9PwYJ4NFcbKvRX6!$I8X`Ey10z^9OHU_4!ZrU8RprHC2w@U%jMEU={6l-p$g; zqpO8diwISk7mv)zFe!^kH|E&~UKc~H2-`WE-MSD4tr4?SYH0;PeEu)jw(vC^RL2#Q zHgj9Ck)J>FmYA?LWvyOhlc3tP6oIp!9cZe|F<}yZ&N;W|=m*cJ>?BwOVlAv7=7_bB z(l5;x3qn26Ej4JNSdqiMOp?WlAHuIr2KH>=#WS`ulJqx-kXA(jC?sI!JR*bFTUK^; z#3pIOGH2!zqc18oks_DLa@No9`xC-p2Gzer92l)oey?<`_C#e=Ofe3Fg*4%?b^8jN2G;pVCpZ? zOL|I&Pz9!EX|&7Lip{~50{)UA1qVszOo{v(Re+2p6uH^-jNXGQBO*m9eZ%~NI8ix^ z)yky;2v2~~icBylt`SO5u>6`@rFaE0%sChNr!(%yv$B2nZ8u$@9!J62LpjTye8g8k zi~%mJa-9mLSws*Yh8&pP!Uj!VXTe~R6?7HS)s2&@ruwY>v$!Ku*y#GqfMUw86;S;b ztd8sci(G)cHn{*uAjFL%W_QSoT@r6ReP>Ua+WM3qJ*_HIx$~jT>h0yi1J5c9r&~T~ zISOtiB_#kS$&bk}Ud1(n5tbo-1^dY;Ceq@vpeX%ytdJX`#vhB5WNs5eLPl!x87EKn|Ieyq&UW6!cWH_^__!KPH)e^f)WNGIQEoH=iB zmB83p6s;SpLStAff)p)e>^5oX(;OFGgW`gPaIk}Gig=om*I)kPkM^u7%OiKKQ0tMY zWcsmGN1+>8SE%N(N3<`J+^&Uj&TYrJX<7R(7Q&mqyD!=9+3q6cpuXo1>7}d^x_*!F z|1*+hmaDx>+o!YM!>W$t9yYysyl_!w6$x)pu=jpJ;2m;+ocp@lZNSO`Iy7>z4w3&C z7(x?mFu=Ysg7hcG6~{H61OkZ>a{9l3h{cP|e*qCM_C_omz~Eyl#v<`cYY4S9@q=#m z+Hx%0hG7ANFho+>tO+@1Yjfc&g~u*-otNUZdXLj?od=453S4WRw!eM_y8(5a@kEeo zRZ5}CQHGF2RL_$EeIle1uh!rQwHYP(ygR&~TZexU!-MRrP@7qlz8|OOl5E9lQKuEz z19|pZx=|vi1~LE`@a}Nw`h?qY`N7e`O7Bh*N82_h;p|cU#A9R@RHtxCb{O$qjTG$c z9eP08yT2?a4HFv>gW6-d=@kDz6{vU5Vqya)P^H~3zsu<-PTAIeh%J4VCH+#r5#hcu zF24GyMS#AU_}}VNn0clw@tVk&>tj`v?nz^IEUxFP{+It0hEFe%Ev%LNqi6+egNW4) zH-qCtR%L_otKR#yndlUF6PiLa6lX2gPbwYN2dBlL@ShpF+Ut?1Fn))1DWQ9VOc+Xu ziMu>E|M5!ieDBIj+AUfz`mRF7QpZIOdt!6VV)HaJ@xJHJzT3W{M><478b5vh#Txu@ zIz6HcDw_=RE!eL-)hbzLgkq|uG1;Sv;}cWK;hn2dg*lT zmh1);nq!qIEHL1beyX#zj43#Wsw%JI?Hm96HX~+3QtRDy*7o~P1!mGc?wKsH``9^~ z$o3%E1rIuBa$9N<_7@arM&9_lTttB$S0B4-(Ymih*e-p$f5I^y3)O!q7y$4L246QK zzXKbB@#{@TBbVtK0F`*@M6&fg)NpY41a3_GEUKz(_Cl#Y+jc6m%8=Xfk?}`y(L?V$ zH=2qhoV~Y(SbxSI3_rGQ%UBui^a$e7BwBpy3il$Y5$|$T#ATuF1D69bkE0?p)vAU5 zDE6lErt$%1segQ#Co$^1?#1g=C!TCR(*`Gf-`x(N$ll!=3Ag#+Otq(*`J1@5!|e&L zMW2Oo&dLPT-4HxGi9=(=oF@17x?8o4#whg*RfmR~*9bEQbwN=-0!9!a*4}dXe9aaA zvTeOQ1DV0R(^T7t2-Ko+pk%J*DQ`RX$*J2hqCc6ab6g>2YSTv{s?z@{+_v8=W^~ge zuJJu^|GoIR88989%di!j!EGacfiaFqJfDC&7T_+W^Xb+yl^AqPxBz)HUDhoy@p`O=cH zCcsPqHZ%NjaAI+9R@Rp3r6cq=_4pR6%8p?CrQ+iv$#B2+(=e0Y^LuZH zrX!*SUGzxS$m<+00}x>~!-SUv<9j3Zm3Owx0om*QFsw5(8Ipg_!!92@bB1>^ugibb zsBi(;fr6MyF0KRYgvjR}KdZkz#-)0C#>C12@(^O+c{Ty-LZMxJ^+>V-lD5#EgIKuU z^Nb$=Kyn3|N3Q=FFe{P%y~B+9O(L81d-T9TpfHAtonji&?R|iF;L=e7p%DPQnIC-V z#*i<^g)W1*Fa`1gSBPp6Vq7ujrAUn~H@&nnZ1m$y@d~=(aSu+f!=pH}MWu~@RNl8+ zf~D52F0N;s?^rsCeQeaVJ12vQpu(u4=-WH|w(seqQh-?GUKC3+aMzLzs|79N>4(`< zGo1Kp#!bS7;c}ZJ2vHJG*h;`jeJ~MST+zO2bjw5azr4lQ;PE&$R#$I!;x5-4vxZymHnv zd1dD0P%9Sd;sXzM-J8U#r5kmruPpz_B61vDu~?ys0OkpXfQx)p^Ep5{Gc1|+ix203 zOzWd7Qx=g9$AiV|AQlhQn!l*Iu@}#C_V=fR-R{|2%Sr(u)r)ptP<+t9dr`BxhVBY( zS8>#WV`BwYv*{jRctV%-RBtEbP!OQOv?oXo4MAgUv6!wOYwxKfg8TIvMgsI9UH>-M z*W)skr&)zq%%XM@D->XDy27DpTXlMVkH1v)@iQ3t9UgGX(P-W}Qhc(-uO7u~YINh` z8oWSZ~~Jglv&sKb-Z}w zxx9Shp_PCJjo0o*ZX49F{=NrfwDOwyWg=qivVSJSP(23jgim~R*FLX7b|J&x&jKzK ztAA_hbj^L;?E`6KM5IZxRGW{r{h8Q4@M0hUqYi0-NLG?J9NuEEJ=7Rz&!_O z*>=K3M~-*erYCm{<(o) zjLt|GxVxhNk4pe7Q<&x9f5lWJ$Zq`q1)=;uz+v>bCULI+eO=qf!@JGV(Lg_m)co8^ zs;Q^!@(pFP2EEY$2S$4da+Q8Q4OtP|wu1vfaC%t0bK580Sx!z4rNB~8s0N7(s-7(< z6@k*n_s0F$vfw|l)ITh=J2AZWTQjd=Fex^ygb0m-imFj`fBelQT30ksrXvFXq;LKV z@c38Fvkst6M|=5)Sb5j>4}L=lyUV;7{K~f6Q3Y*2)&F1|knORDv~o3YCE02iXkY~o z#fI)(KtoU@zKdrxl!u}E?PvC>=RVka;vyhXcrhhbLt> z)BexrbVK?2LB@pv5QMYoSCy>B&$fllHV2YG^hZHM)1v6L6>iybYdKBq9C#Wi6Qe=1 zgDbecbA?tN2JfJ?cA#WNL|HM7r)aKPB=0Q>{6_O)ZH2o5i{^ESfTR0|hK3gLXX{AD z#FmDjcpcC?jGo0qpCfy;IR2-NAopVL8LRge-&^|`WSw7W9;(7m^Q|pa;B)lP>unP) z8Rw$Pd&QI5{`IyxuSFTwr_SBy%h6s|1#vc?uar-R7stKk4IMV{rV&5e3@Zd&2SQUP z6d3jFVY1S9{9G$k3-n~AXa_++ZopZjV>n&qcFb^P*Yi9atT*8Pxt$RF7LI7(1aYV! zt&T$BwKGO+Tt<78la*ffEF$mae53gm$^Yh^4)m*l?+fnIY2Q(0;YpS3n_=_YFPdDy z+`j!82m<*Uf1}(w3PF5Ll&t;->c}<%uMQB%LOCfJnps1VxGWov2ha)Wn(CR`vFop$F2&IgHDtn5wj1QDdNolEt$xyxs?JOI? zPdWUn+>&sq9k{!JMw?}*68dagHog8bl^fi<@aA8Z9$qYgGZyTu;(m}D5;@&uZ%fkK zdhi3b{RV&6CP2aX&4jYZRQ>@$ z4$n06o`P9-T4|a3{|gZ0cCa}QC2%P(P;G@vJfIk*QUju2s@@LBS&3l3*MKAwmzWr# z;npeRMVHcCNv#yHFeC<(^_H40ayb5iwI|rbd;xt45LKOGpuCe-RJ;sYeZY7!ueE`^ z&NQi@uu%CdQ6?Rva%Oa(<@y4zZIZ6?Xo&N)TB~LlRGfeYfaq18N$H#O&MpNrXU{WK zFNv{sUiFt^U~Te0J9>mX3R-GwQ}8Bdu8*R*urXCvK3C{XAx7^lzOk^hp?EGvxnECL z{Lp{yX38l_RYbwRe|D5=&9Xg(Y;y=gPBU1qZErdcFRAkhWs@KNHF`~j%X?T;72C1S+HM8O#a zDsiovEDoDXel1*{{pF#@pK7f z$Q>O+0iZTxe+S}7#8CST7~T*rl}XpEK(ZW+mkN!V{BCFd)`MGRxm-wl+QC;#ufRpY z7AFVD1ghyl+rTV_^9Kn}La_8;TDSNgEIoiQiFFG2hpETv2$>%p)Xx*w9V_7@gZ2aq z9DSc$b7agLiocDLh8JC$Y%(d=^Q$$;ZM)DDHf zR~ap3>ri>zmUP_^42@j423JN>}Sx)S{J=(u+n zrMF4eO=g}4ZD{j)Pp^9gi0gQWabVf2&Z>BL^ggQDTKT$?D86&YqyIE8`zk}>OH{d{ z3(fPAf?b5oK&2{CLNROu(2xh^re1lpv72zi(?3^77Bj9JtNQ2TNJeg@{!j?B>%(7iN z2A}OZ#QCNgJi6X7#O$#v7IRAYWMvE%W`bGhu?|p}irf{;D`aO8So3fNUHZB^GzQ31 zD|Vb8rs=XXrHU;7>Vde3|VGlS63}B@Z<1<7BXIvQbO2;5_9Syih2G==z+0V zr)V+;oXw?H*Ji4P+f^@t9rEMfhFQ>#5t7WY1tFuXsRbd+MRgPKp}Rem`|~6HkE*dX z2ZS7IW3g~|eY)^7`vXDXbf|wi84NB53zxM$y^tfJi2G)*0L-TOOQZs=E1ID22Ld4Z4it!Y>)kH2V!HT4!8IJv1aPCWRv*hXq}EaH@Ze$mUr z5aW)&7gEbVi5eJ$ii~Mh6s1e~>8NqwxZ3GYhY~9BcPv)^EMUq+9Qg1&!mGZ%OVNxY z>OQO`36E;)zhx8Rh6r20RRueY0Tp~SKyJ-0K}7-jL_O+MfgxPTo426bY^ml4VHgx! zcx-w{)H?gyf4{BD4yG`CJ308x9?V^wy28Jvbwv%YlwQRKL>J#+y2dSYY4m#_o)1bpRKoFBdt{~Ko- zB-*aVmhp`0Z{EP7Zc`q!b>rR#;8FX%B9Ex;*Jv|UZx}5dUDAi-uC00Si#6Rn#DUjb z6eSL%s8U{DTDk`TwwXxE<>az^w&m5!7LzOqZXifDSAR+6ul1fQ!Yh(0iCME$Q4PoQ zB%)6|>DqsT8ffdwr~ENhdg?A!^V#I!*D-1S!IkvM#H048@<<3_ub*(%x2$ol`20R< z$*TW#RYBjLKA*psQ2c-8+R=<*WM)&=rSSVo_8Et7Y1XKN>c0S&$hsn_%*VfX-~e!& z3!0gA7xlo%1VJ_Iljg;Yo7JSiL?!k^f1SF)=6755yi|Zigp3w-CC-oEpF8C_gl22xV_;+g} z+u4RC(gir8XI_Xmj-_lU_mKUn_y*b0`6(`34s( zIoON04@ID1m|Q={a(;z^Rviw#!6&h}BR6!p2|D^<v zkE7tV*t#K<*7qr~SW_O#$?c~zBZMg^Q<$nMVW3;E&0I;H=JBSm2 zWjA;8_mumWoJQQM>g$v8<#W=Ci%HAWpu%vK+|JT<-eVCkAS3<^l)Pt5;%)qED$EdBLq2YDOR$_E?gZ}fMz5p3$ ziag(5=&o4FujT@uNOv3xck<&_FYnRXuX(J7=RYvFHr%}rzJGu1&R_BC^>%@K{}KU9 zlGX9mvjG`HI(Irc12?0X(mhl}Mwj{R!7wQN$fiivXNTJqjb;SuS+~`__=~+x-N3ma zJtHnj1$D;9Q)7L=8}zi-NF^^fj8@djlAS83h2`xBFuw7NyOSNqN=cxET%y1Q!aPmt z87wnbbFF-}>q0s<&Mnr@QpcFrJvQr`!iZ(GKKT9M;q$%t;3-BCd(J|c<@YEXhG7iE zQ@4YTsUhjiJVN=f0P<%TUHz6#84ayPo*kJ*e?!x+nf!IPW%Z(; za2~dC&M8kPkAPc!9i4e6_FXI@N&E5NE{c_&++kpWRQXMW_A+=>%-3YZrbmA@W#dHh zSJTH~^WC{d2xm1Efu5TyhZWgkVz_0P50*5U!S9H6P4%J7@1Yr7XKlWXYNo_THE1dd z1_6{C(2?uoJwI@d1DX+<0)5>zk~|g5T9GACAyPJiw?a9%nG{cMg1`cd85PCAvi)$Z zZ)hmvHc7I|g$JNy0RVZcIxmtR7C3H^Ku!h1x2z37@I%OrSLIMR>cSJlM-ZzHJ-za) zKsBFH+J>55T#stsgC{+75og>VfwN_JB}?n|6!!Nqx!>-yWkxHUk9y>Z{u~<%f=cZ) zxDvRYY__4Jg^8b4cznxRb4cDvmk(~0US7O#myt1mm2U8d`(+BK!$igQntR0&9k zS!G`>p5ULg;euRCIN$Vea- z5Nx(*2efCNYzF);$vfNM?Aq+k1LTp;h)Ts1occSM9wXO}sa-F>zhF0oN6NY(E>??w z?wIv5b{el4W%TjGB+LkmK8lB0F%Oxbzbr#aFr2~sYwm?%-;DV9an6)B8^U|DCE{Xq zWlPI!BYku3jp7j-u)P#oPm*B_g-uRZm%49>ueG%mSNKW-;i;o;-hBou^LLcRyBVBF zo^XKxqII(1Gn0Suv{=e1T_#(OaIwT?=`U2oQ{b;SyvBcvcj;UFoQ)`^PJ~ z14hms)r+$(EMuoU3xUQX;Br=j+YP2plMW84;$Lj&ZY%KRfQtvDS-x3In~*td%btof z${FPd5T-kp2!NGsWCt;H z-+}{hKsgmGbZ;dGY42{M`8*Wl1>@mN$t(dZxR^q)g>JOUVE;&=B%N!+djiIf;Pk&7}Rd@v5{1ZURMwr{X}Wt zV|hg3%aL<1cbP;)`&)Hpbs z&h-4jt_nyYQaKlSDIkt8DVjt*U_8F|_{O<60~X^_itS2Q|D<4gn2kXSN=oC>&yruC zH*JP7>ATnYz+{#7>Xq4{LZgy*b#qfki>L0bmY}nDyIJN@E@69Vh zHtT8ohL%_0dAC4;eF=Wz*Z{tB?YA8z#O$QUhdVSWujv z3NmHnWzbI10(BDk(eU=0NlT6*0=q?bZ7Uzhgh^|qp3n2H#jnehiq!O;xR-Oz+VaI=$8yWvsiUd`?M#@}}G zqD!VmzYh3ofQuo~ZIb+xI>`@DnOn!b7~Ty+YuOvp@4(Yn*m)0BcfT+7hRU27B8R|4 z2jP(~i{hd8?Hn1CSQROOMuqiz5650dme_+a#GQn*nRaXpIi^QhB!#@3->L1okAKkj zO7}7~Wrh>hR6thNxq)}%Ym{%l#1@hg_NAc%!E@#|8yj?_UEf^?vzA)dyqrI(k<~_z0)b`j%a32hk3r-7$umG|DdnX7 z<+Z$;7F$|cXy<5fS8~ovA<;DMPg|@pg!AG^R-bia(wu_Nj)WMy%Vk4(CqBn*-1B)Q zCz;T7f^NS$m;iWUhLbh#kUCmlJcs$_?6Bi_!->5ya>+W4T7nwr0(z@DS~tMH-wmC~G zUEYuW5|M^2@Ek}(_?}0j8VXjma&{6&t+|iP*h#I8I0<(y z&%4tboM`^_DB~)X;E1~FkdUX*)ltcBSvwx+4{-6` zqrU>2R1%et%f{PUdvQfyzhn*3musomG8Jv{;0P@L_z%R&-H#I5X^N`(UNhtStWFfA zr`MVKb4_TB&R|oq0#kM~V|)|;cE;ODSpqe%8~tNFNZlsE{xDaJAa$n9>nEA6x0m0P zV@yrRk9$!ZUB$KH&-uQ!UThdl)Z!M}D7GUs>AJl9XY3x{zTLgsMgFSXb%p%X{*cmz zkzbp3k}rd3e58=(G=o1`6P($#OVrN)BAeFuwPChmHx3tVJ@IZ?UM#qYJW(q1N4oGl z?e8Hw+x1yp_3KcL_tiHC6QKDhSjM0X(lKO8vynakc*zOLW@-GqROLKnr*e`QR zw&xpbisRdDjlHb3lLEtkOkp{p`9(yb2rIe2QnJ0$iQ@CLF&nptcisO;xjAE{vVlcO zup0>0o`vsH*GwFSEoCkb(3jID zzllp1Q~GE2q};ur*6p!VD92+zS?=k%9;Gyf@;Fo)73mF;IMYCreMq71ZOQvx#D4Nl zBv+N=W19tRtbAkVIKH8F!;F7_4<7m#8&s7v--yN+o}ELVM_V)15_J3R{plDy)z4vO zzdoig0<1R;42Exo-*#xc$wp`RdyMO4-_oP)3HZS4Jog(4&(?SgEUHvknKpRypf-Zi>(GS6ao-BmayF3H5@y4n}`Hm|g8~ zc-P0|>o@ja`w)-*xNIA1?{-dH;Gw7*Gd5~GOwmK}Rxo@{kC^(5fxICm+I!l{0iIoK z^F9}S=#uATAeLu!s36{L^Hj)qk!{Ab@P45vT90|idkLo!+b`iba87I&eJ^&VC+sTH z+htD;Hvv}*H+>SA02JFDXXoDm!O`|+c6GqzhNCQ`BTPE|vrXZabvma4(OORT73&7x z9d8#w>#4~{r9qTxDZD(c zvtHJFGKvb8MRjFbb#w^b_x4xlB%eI5I_yK$?+;l8&GGuSTF;eCu?2biBs(t)8)~1M zg5|1-S^QR=X1M-1lB-v2b60{x>C)cM?Ho-9C#?<-xQK8t_DTLNHv2EEt9YsP5+S7@ ze5m}dVi`VSYDGLsOb98<(EqjyGN`V|G&bjdR?~p@p~*1l+MkzowFuX`eYfC8Qt;AU zg47RYDH+_nhR;aknl{8SH~b;h;hLGSQ2sD|`2e@*i2SuFMHxM7FUiIez7QR5mW%%g zQ>>a!4~I$mYXT)nKIZs{cB3hBh*W4IOi}bR-tDPG2HBp^nNw3XYX;x;zZbgIQ2vRB zKnee~AHFLwwDxa1mve#Hb6zuLJ*B|jwF|Zjn zKgch?GG{{J+gd32x*8qrrpW4t`e&FQ{*@JY^VoTQniG`yxjxY+dU&>~GO^RGX5VM; z>ge`91Et?!2_|^EHPt0`r|ZT~yZskDxb7pXFy%e_miWbAO3euF2V7S{rpb%lUmE{? zvMBF-T!0`=|+Rnc7}yLtwNZ^#>OB? z-{eDAS_q|=gzc{Ygw{*_T)6GYN8j2GPsLb%6tzrT6HYe+VMA>cdA2!eFdE-pfdI*`mHL&)dFf637Hqs!ud0)OXwjfW7>4qV^3Bd7KD zMkH%r*&K$PV$h4+9qdP4ez4DquFH@Vqw%_qC|_-3TN&u|zNn$^HkDga9}CmdOc|u6 zuV~^}Ksw|)=^*q#^^hn+bqMRu66H|}HUT%nS}T6a>cg`OeQ1(j_2dk^k*nWAB!QFQ z0rKI%Za^k$%)EbH*vS~n0q+7Sf9OgNdl{w4&T@!D7Oj>*ZS>2&HT3Ls19`;qNZI-G z=T}Rf-^o33HwVi40^M0_0OMz7Wl6)?5Fl3~{vjc7F$h#!lGD?ho?`&|@91aO1mSX% zbaQwQ$iiPK0>>EuIfSX8Q)Ig;S}_Bf7jI`Q{QMcoED0bLVCFwW)S(y4qA%534{Q;4 z+zkxy)hC^U-@RkJM43`kbCuW(`KsQq1Aje4jA)h(6bx|Vkgqtkq6K=wU@sgW#snCX ztt3<3Df#!(&CShIo85T49U+cgf-h3PmAS9VQo_d1;abFFP}QNYTSOr=ANHXQLI7<6 z{=M|d&JRz|<;Vd_*V-Voq|=o{0;)*h@O5%wA@LDq=H|j#hPd2#L0xYWp)H{EGMbP2 zM(FD=zN9%Kx`{f}E$;2_*H}+Wdwp)GChd z|1B2ssUe*4Hy2=M7mZ|5hf}7tO^zE8=+^_G7(nskLq=@hLgSU49Xj3zh5!z9_S3?k zpbaiDVpc>ygWjW0?j`?8`3?-RfiNO$2GzQ1A&i+1SF25m0c4ii`mkS!BQa?eJm{-U-xXfU=dGe69QZ z%^4AJwJGzuP6%5k7=JM2j^@h;ToUT%Z_rt2iuswe_ciM_3(Y*;OBpdRU7-^icykp> zPXUWokd!%uK3L>Iic;vq8)jm+nxKD5TM@_#UqS2wswkk=@#V$pKzRAxCXu&FKeic0 z6BcaG5QkR8EP&Lw2HH`+TbJ?;)1?eBzY?B*bYbNX+81%ffNE!EXN#on$33!aGV<{` zq!q1~mND!5{yiFLU)O>sng7S<`>Q)OMJuA$rM%Jf*4B zy;mk#1E;m20yolj{)Tt03Kt4IvVq>kJN_9i)_-p+{X!cZASC8yweUX%IcdtfQ zJ6!Z^j6mI7E~S&pjuYRu%=7ra5p%V$kB?TLywyP#Fwndv1Cj|-;yjw=|aLA>lcOT8d{l&zsKdns!u zS%Tuh5`43VwR#{eZsXrNUArj@4TR|?ffyF& zYgbOcO;>$WX#k{**bldi4zC|^cy*Z_*a#5v!s{!6VOMcZanJb_u>KNhG%#7r`qL9? z*0A{j2|+HBy&im85QrT0yw61E7L(Qw7OXOql$4Y4M3x8eKEf6>boH3$IdWJH8+Q3( zC;`ixUdzeMkrJn=f1(i(F3fP^xm5{4|YQ(jklKA3U=+HCVYN&jtd~_Jhp#qi+*?7eeBoo+wntaWwmwd zkU)sgtQx=jWhdicBHS}XO|r*r+4ZM@u4C){?_Rr)7YU0e_cE7{j`HfIY<>N9=;7H~ zaz&0)m*0WS@}&s)>H%LBH3t0EqCPTWF4>*b_qnH^NbLYNZLG+jw*`V2f!YC1Oa!2I zNMViF-s$8sr*oerogfL4v`3 z&%o3TD4OwQmvVC!x-%C8-C3Pp_})s?;FE&%kH5YW3Ug6dXmlhy4$nKj7UP{YSb9)$ z7s8_!sT%H0L3S{>r}GcRxhJ75ZEa;4&k${Y7t{>4`0>&e-z6G$!TTUx--0Pr3fg3? zDZbj?b4Ox{^p2sNJKIp_NncuU6QfrU40hkC)eQOaSySR*MtB*de8cnSDjDQZ&T+xW_0|kX(u@^*gD-LOzUhVFi zVZiWGijh@Eu7?D)j5`YGq}mxS2+X%i$78I>*}E- z7kI7!$?lCQHZr-o`U*l>U!M~dXZuwL#muGXnQhEcV5^d)+F@64DHZhaEP-d&uQ~XU z8yHED7T%k(9HeigDe!3BAc0Cud6V>8gz1Uvd0q< z;${O`jm!&=IU;x?tZkg$0TWadT~z(x!2_tEa2!H;k0KF24(<6@QQ9wqNDQa$YkCd5 z-uAgF$7-PKb~e%r;X36+bQgM|Cn&7fVYNK&!{EKJ?)jWvLf<*`$DUGcb0x!kbx8a+ zc20t$_6!Y&J5?=T>*nanuvK~Xq>&$;*@sZrJ%((naKB6jR3rXc6A&JFGWVkDXkPDBXV0wjCnCoaD5YxI< z)zvL6E!5T3waIecMGjeC)dp^JdW^~VIqR+mRU@atp$?Q6DjL4R8ZJ!kwWbDBqSk|6 z6-kvkY5fmDXY)QN+$s2;bD`CmK*sJG5`< zLk3x%pv932evrd;kFV@0rg?!@HzXzUEUB#@LDp)OF|D?ifts2+-HT=@-xXCptaEhr z*hW0sIyeWcR)JQL z2_eS6Q+1yc3g8AluGzHeGBYVqAW~>O;q{4yKE&!(i7e|n6#Ck2OWW8ff$CvQDZrfz zOi|(5G})<#>8ZuV{24N8KoH&4c_LH|Vjb`aZhl(8m*?xdeC0~dVw?=_IU9(+9XKZ_ zKG!WIVthz2x&BabrWNOL5%0)URA@5= z`1xDjO~caD+OH>Rj~X(+8vBSP3<|~R0@w0RXWoBwI<)r*dr_yUkRZb2CQNL~@lRo;?>C6#6GC3R;@?Y~V3>hX*KU4Saz8_5TEm0(T)VKfh1c>3mS5yj6%0 zD6b((-LK1eshdOTbl41J))dHMFZubG$`~pnywz0XNjNCk(e?m#+-0l&{6^v_9Wr-B z9Z-phj;J7y8b8>elFVge#4q?%68s>f)O2?;ZH?yxY*3vUS;>kOpsJ>L3j?BR6&O#X} zTd(JYJ0w64Z+zH_ek_TKjlJwvGU2JJqT)xiO9B2hY?qNf@OSy{&nh!#t@j6KJFo7q z&8@PO8N4i{(q}aAUPy2`#aC|jnHVpx>&R5G73BQ z_Hs)xcPuyzFjvY(-Pyq5M8e8O_fMa5Oia8?ZRQ}w+CsPPFZJ}%qeqIRYQY_Jdm+|n{(_ieTEdM363@`x%A&C z74-Z8Vf;pn;=P;qeTBg@(a#DZ8;}GP7(H(TNxy@j!VtGa)#K|7g>2y90>d(0a=x`l z`Q{(WH*b(~AT9#!ud!dHLM{rjQf2QB*RJoQoOGtfx`q zFvh^>gy4~mKbs5-PXeX1c~6psy%cqqH>N#{n#-Rj{kt6)z*Yoj?E|aid4+EJgxA@z zGLegCx--{Ky}k=SiPRwJO#AYd3cI^5KP6t2=CB?9fhak`QHwaV+CH@>wDlCR`~%-S zTHlOCG7V>;%3{{OF80z3Ey1~^TwU+Il8-A{rSyGc*h5{9Qm7UU|-1RJdx$u9tkn- z~ytGPQKp z!rr+&#Y@`940@zgF=6j_^o8aZRF6m^vEaF)F!bL@5pyPwI!mEBy!oKpXa=%?D81RfM_hL5g z9qRQfnH4Y1&)D>YKqr{6Ey@axuy?%ow!=pqz^|@dmt38*iJ2>2W-06e3BqT$i#b+) zxrt8VkB3`q-&gzlm-pKrBbGZJb_WZwe*vtnIg(ZB2%=4cT^6grrr1xD;THVgs1B^V z(rHNZfVc+%PmeI&BZe2g5J1whRA>WaPPR!Do;&#(j*T7PN&fgNmK;w9yHPDs&Ac>= zaBAzaA&0*IpgQnfNay=>A&qg}i`#Mtq7eOe0U;r)HWz?zXs?_m^RpN3-Enbp0vL`K zxg5amp1MdQ{=$gp!-X9D4O^WBkgYIZfYRc)XT_A zSlraqBE%|4<0WX5BdNccJ&Y477dX!(tew2&B^(80 zgHMYJ+3Zql$oA`nElWvc*Mj;Q-)`;7#PSI52Eu#dRFu+=_)IKN5r;jNYh1T~ zyfs@2Ot@c8pjhr~ix2Qe)_(8n7_)4QC%0`-z5y7BBXQw`$ZWU;Kuz^ z9*~hKHvC`lqAqv;RYs=Rvx!?XmE^zgo1cpN--Qo<|BIAJ_w!w^xc`Th%MK_(a2)?H zdkZ89sIZ9YF}*N$4YVb{KNI$_{}&9LveySrT!Mkt_!5%%|KO~SjAae%4xKpok1H&u%#&M+iT|; zUxRlIKG{u{FqmD9e+24|(jY&6=Sq_wm4v^mSmN5&m>(4rn4{5$7~^6E?w2u_KH3*N z2a3m)T_FJ{wGQtB54>GAqg&>ADH^SGFamgV(I8TczSCp1e#to%jkZ%fG74ezUo{+e z6k!B_4Jd_RJ*GgT_uJ8GKd3gij9C`|8-0C!UGrdyA~46>d-g`DnA-)(?OwW~?+fGm z8e8^c)n;8p&eKeyhi%`HQ3R3ewEB(V2KdQpDK2mA2DM#MCjXcXd}%nz&~`Qvn=F@? zJKZGC90xQAXRhN8;3H%JDz>cW0_xy6k&pL8by|ZhJV0`_mgLG4_Y|1#)f_G_Uw z3Y0HYDV#fti+~{l@O7sOWS*f}0otOWu=gh%e5~Md#7tm|5A576Wct!v#dvtG5s&qN zGo11h1-K@54$d!=b~<2GwX4q4k(Hed>fR5)a2gOF#xsC08g_Wr=-WxtR>8I42|*`O z>2LL5*dgm`D__Ol&Y5>{UU*5N$Z)S#WXZ>SHkPSVl z_#Qm#oB!If&!9@W=l%eb_oKr1OKrsHqlRKMYsXC#3=B}Z=otAX?uWM()jzF2&i{** zoa1K8c?7ri=yt?iFE4RGmlVow#p-QTy*Hj~ocWP$O4H$_VSXC7Nlik8f@98*`^+<2 z!Bu`4&RE|#O=yt*5pxpLWW;kPq2pM==?yV@CB>!|IE?`V6e%Un&mZpaT+ty1GDm2L z?(OXr`*kg)=q`L1G;n(A8W?bqz5&pK*acq#RT=Q>jZZ4OtO~ZAaQs}|dc2>I4}?K*FzoP#r{VB1ek0IsORgRK)AyHfuTWArTZtyGLw~$L$^H8+$CVh0Tf{Ae~Uwg zO{D(Std%q1t!fm{IjRANEtmthww81aiv|FlvT;8LRaJ}kq#s&uz>Q3;Tc*6bLrWdh zsQmOPcnwCZT}JFwZd>3(8551KpD8)!Vm(|-q?`$a|y7=+%>z1 zjXQHT2Gj_J1qOTkq&Dp31n6`*SU)Icm^w!cn8vA?_T`&*&Yv?z9MhveIjNtWQ_HW7 z54nrAhG>w4!RT*lgl{R&Jade(0{wreT?5prTME6U4{tDK&|ot-%eqW^39D>IHCi4>bXV%v3_TI$BrA!fjnsFu!zFw&#w4w;tL!Wuz%F0Uh8Z9&{GlhQI z6TfXjZ|O_@N&kT?KoWHSgwRK@{sK*i_w?d{L?4MJ z9u-q?O?`AG$JYnw|Lj#jtxmsHf31|HYJ`*T^Zl&%aK4Ar9UOsaMw(x@+m@w*%3kKg zpYW*K+8$Tr_bv&6+Z#MkOdn*RuIJ=x0%i7SZOEAx4CK2(;k z7VK_D5K(-}_cg&j4{Oui_SWu&k*qN6&7V5j&(-*INF$}f{n)n$2mbX1WhC-s)lr-h z2AE|_<}YI2W2bh+ppYlXbY!~9&LE%@U3FnspOEUA2fM7N_edJ?x^R*Edv$y41NQlU zL94!*Ye=VnNhtGOIqp`Y-|Zd)t3{tM1X|)UOgwp*n39}PO4;JH8R&^We)Qz+2qxS1 zl+z}SQd%`1wTpXudcwDoRK*R?Hq>WaQkG>pE1a|l^6`IR@*q4wEbkIo(}%<&I;pMr z3oR%3;(yoU!P!JvMJ1Is`t+$&*UlW*#6S(jDssU5YTzO#&luETiRa-vS9tm4k5adn za=a+KPZ`)KLc{z-W*186=M6QuOqb!K?p%o!Vt>ll-5{M&9 zm-^&u%H|^w)?P~0@nbzOk$8}Egl3n&5QRMLV+hR>OKPH;If$5FB3sEYGBjkIX$XLh z5h%~<)*3BdYx*%Sa$&jCgtt&8Uirxrk~mxwTM4^=($eMf4fMjQMYbhHA|404l604E`R=b$BFGn-+?(9%!|6v6` z;2nU2?FhkGOe}eOkIcQB%Zb$Ur_=CJUUMDqsY3Xoy~iD$olFOebW68A_kISuaNpS! z)c4-Ms(>tuO}?t@LpY2urTKv?!}BdRt6@3AVuys)sEDD7-v+#(BDKYfs zBcB~ps1=bYU59qdUkF}k`>?i_@6gdz7Y7Gm==V^VRtL$5?3^49JZVzW;wKnBT0?s1 zVuw~wlfW!#o$GKL-nKB$iaPEa(npIatIl+Hcc-@cpF;z*uRunqt3v=~WV*mz`1v(# zrY#+T^jyyJYb|FKMq%RyI2V6PA6)>i5!lc>%$NuJ%mx?AI0PJIea>e<)T)m86G$?o z1zhTWC9<`(b#rV)&0vQ@uHN$>)P-JM&{(=)uTqxv)Tgtf7#J@LPB~6BIOq-lJsrCD zB~P<@s1E}i)-FMooJj_m3LL*#k^ki9znEl1YV8M`oUkO31`F> z84O7zMsP&F*IckF)D+_kM2Wfj@Z(1>x`#a|(vD?fydx-xyz?m`I=V&FZhyC@nW;+J z$1qQ_ydV|@sU?)?9Hyt9-!YLbz2kdvKnC=E*TtbM3nPj_mU2QeH8lgAn-BuQUBQFN zTvSaRg?1ge$tHulONztE;X@~AWVgfYX zt(hDWA7~JUz#v@D_GCy~k}3`t>A>_YbF#(y76(To%$#Ycs6J-94)2OZglAIZXVjj^ zJew2Swgw}}1(^v#YE){USaZQjg2m3dT_y%o1yz^+C_-EUR9%JwVwt&`Zf1i{Ga$zo zddnO@p!R{5R!lA)wH)2Ny!8dZzjN=$9eP4`p@>Dcj}7);y3EZPz{}9n(=+z7YPl(|Y*hQ}I$$nvIN0t* zdkbL2yR-35SA_Bp80klh!a_*KuFG*X(Am+N*>(Q$fq7;Evf?)9EN)`wMFbnEYCDmy zGzLoXu&=t$p)iqS^15w0$8((X$SlB60(?rxDqRV3M~|H~VP|9Gvz9}xJZrFIyhZlb z@>C6MtSMwZ(21$icGp1to{1V!Q#;8Hvjse(icwr&nkLx`2bPs`z=oh+M$}C1F-&M% zo$XJEjbOKxK(0#|+J7RVpj6wv2bm;@g7z-+;;~$j7w2x^w}7ezM=)ag7-<8%xx(;w zH$$(VZt9V{cYokg!71(D3;~fAZjns3&7?Q}<`TbL#a54AxVT6Qy-*zjpXOtxf%5@5l?`^r z>=(nP1RD1Fp!#ARYk!JptV{aBhr-Z)MCX`Z#?yJjd`MJ`fx)O*<;($v5i-R0QX4wZ zFrt7`QJz#h)Zx08?I6*aKI(ToGmtJnXDHhJSQ1dVy5}Yz*-*d*`D8C>U;~`eBd1A| zDlGCuF7|{NoDcW|i2*j_a|W?)}Qr=rGOJ)WcsYEqmze;^!#2GjwZN2hhqz2c4Tq15LaM+_{EW&deyFGc4m zC{m}s%XE5st)_Xl28sO&Ss-n>x~ghRy&DfX5@so6T#bvRx=Ki2r2?_y5(K_zOZ5GeZ9x`Pc5>-u3m+gQc}p<+32i^ zYtq9RcO|JpAJK+1|FEx^+?QYN-4IyNNY=>C0>V@}eK`)vmifNyan0k_Y%Zwt2s<_R z=EOpyAf?al^m!+FqAB2iEoMAh>DYsyY~MBx`pn(`QO$^X#|S=MjF*GkY(RdgW7kQv zAND8vQYEK^Q2-+{b8^CVL3xF}C_i|U^c7|lQ*NZxxx8fzwM;&SR12`gAu3TxuHy%c zc5ls|f2s;qL*fCu7X0%j1=BabENo2cmSm!oU@lJaghtCIpvwb4{<+JEBQhPXNP2rd zUalAqWJ6{NP21}3OE*wezubN)^t`u_;>E!D+LTp@Z9y`muhwp>HxYF;^M1&pTaO(! zPRh6&gbIDCwqDsWM~km5_!j@&LDiqY$i%w_T|=K);xVdzB6olnyovy) zdoTimRSj-{OkhJtAA*ge$|e;AM&I*0@qAz5bPQjZkHe0MOd7d#q=~%3(x+!D$XSLg z_&`c|{lOXX`nzDoGaRlWeo0VAc17FDDu?`=a zx)}U(7KAQQT3Y7ktbMJ0P-}}L+pL>gl9deZV${;pfK-u~$`&h2R>679$}gxB;+cMF zGA7?Zy$j?1C<7$yU|H?y_D%`XwLf4w8y*>HDdACawP=a&5@j29xN)n+l1|009V!x2 z#RRA9(iumQsY>3V(jHS{8zB3G0_(Mv!l%IN9(XA)G;MVU|xIeZsPRc&gKFd z14rklUnA(k4FJEn9TD5l{HH(i%UY*oNHCpH$KW3AI!lV1O}^hK{~ADQib=5@^c2F} zxsuQB0>1o}+QIK@3`Xl#g4d<>L@o6b_hcw~w`vc)Jogt2nzt}p;?Re86<}=QF}8~q z5@eVz>~hg(5-i|c{!+@91nTS}8Qd+h{4Nag$Mfe3MasESuXJXRk z{{Q5~iB}ar5of#J{i>Gi7iatzf}P^#``>_ShbqRJp#@l9O^*u~)+&SS?3=O5S0zYRS?*Ox_WyB$i;D7fW(3$2}mR0 zbzNSY*Sjs1^#6*(@1-YMND{h2#_ur@zOrwbBdt9MTic(TIX|1BD{jt|e19o9)~GSs zI3aY1yRvTmV*!>qN7?YJj70a70L%Sdr}=B@nI(gE7jR4wQups4b6)&@&A`gSqCQdF z1A&MWvJ<2{`V(Jku;wWz7t}t!w7A&Nksx}?KxHl?sCnWh7gtmWa9E%xngsD3<0V>Z zJCg0@V`IYs*;)EB!7Va8oalg zCJ%B}IXYt;aRU8@&F`;%2k}VYR`a70z}_-2AmD`c_fI6CW%MsN`rG&K{=o7?z^#)d7GTJiW>0F0Dx^yxTkK6-s_p~o73 z6Ij)Y14U+|o-;uk@GQyT4ckDZu@xSvJ>0D|hFjk5$&iR}Nj$XQRx+paq!?Wd`ZX08 zWR{)7$5MRoq2lM~SHR7B)9E?Q2UNnizd7u&&&HEl=j-O>=ixCyR|wL{Fh@g2CkV)c z!WH02l&y}nlZZR)Hfu{BXzGf0R{ z2{xGNJ$dpHetjnXLIphQ0^{b>!f!4vl!1;%-K6vFzJ=M@%xAu;;TAulZ$@dl%$MGQ zgb5ly?1za;dcvamgD~ho9Nb(Q5=t|E1Lv^{A3lON9njuly=37*{j6T=5I(W4)ZZ+5 zK=cRJR#cfK3~#P4!?t^0(`{gfuS-CLLio!2>Y;8&V*N4vt;9W6{1|efFYo>_-C(kh zb(2ZfFtmL1#p*?tsszfo0cGnX;tj$(igaro+zON7aRVPqPw~wMi7Mm6gZ=LX#^laR zgN?omVmt|9R5CIS&+r&8;$)hdfLmPrUO-xJ$jv$dKd=*^{Fx~|1y(Rg@C3=Id-s!x zXLJ2HoH1PAz7kXih^hXHoSU04jQ_hDkFB;HFo*p@I;vsdCBTZXkv;V(2Q*W2PJANs zleQi#Ci)^@qNi^Hz1H(P`WutJme4Z*Ycev#u6jk5C|UiKVm)xK9noz45C;lhyk zfqqcv`JQtx2X-8d^iA9;V20d&e^rzS3W8_NxQn$nOGeEa~UNbu%NE%`?E`u1d-2HaRyc7gTT8TP_3>A2_<&49DGy4 z|9N=W^Omc}#OiRri1o!f&V>WNB}9|Jx_eRd7kT_1-!EKn)EMf`=w}M_-Z2Kuy4c>T zB%Z`Kp3qgX#b*Se#6AWB$s})w z^H&I@sVON&(quI7^qS(WOF;3T1c)xN?_y~TJb75J2T#Lsr0Q!|7tcbB5>)L#wH3Oe zTACr06u$GGXRbdsL4>^&+_y_mV^D(&0eQ6!LcU3odp0N# z@sspr6>|YIR*Q)&TC6Jxl@SUt>r2u;e1`pzg*6533BX>I%Un0Kl=`g{(J>`S(qhVno?eRHWe5C8# z<+kd@b~x>Lr`YD#`krsAVcFTU+=pE>QJ;0Z&mL^dimsN}C>_!hLv1P-=ly$AjSzXQ z)ccMpoFY;LSRlfMs-!C5JOi62-uUtIAda$-yN-V_;u&%Dn?^1LZua!QJAF>bW>8f* zvIC+GQlC&Cg<)XwxP^lKp@k$xQ_@J^h<-jvEf)=*Kd=Fii@N*_$6gF+CfcX|U0e`x zRVV*$>C@<5M1x4Lh{~(9C1{4E zpbf@pHh*kU?-bhC7$RWS# zdjuhUx@@CzAwNud$dKFIm0BMHB$R#Ri>ha=c7lnn+5n_P>Dr%=SPcz9Ac+4S`yj_z z&m5)u3aVxnI3HKnJ2MTfU{VF>lRzyNW>(?)AC;$}9sj|D0*4tz+>8rk8nJ!XS(lu} zdMEybIR#*uqBlctK_8?5PjqzH4CpRj=B>8B$B}U3;GLqk|5G8O*vQDpS4!ugzXe@X zq+%PSQ)Y`3zLpf(d)6oALeRqt-AefSpas;+G;x?l(okW-}ZpqUtY(B132-t$V2YUM>Kuoe?R_u!C4!wS~EBOPwr$*R7 z9@1P$HSyrEgsr2wRg!MYc*=AJ+rGl3q5BShI44f)SZlq)B;47l?{HRK-x)*M6jso$ z?{P{=eB*+?$5M%w)nC~*snI7JCqpJn(?H7eMSQEUstZR=A@!-IRVrv7RI?+yKKLys zFYi9|{Ya-hZ3x!td6|3ZW{#80eI3Zq3`XVI1>_#+(If1o2EbdXRcslwiKnE9;eKhT z4C}`<=6Gi0rsgfnfWUW~38F4Wj*k4Smx zb;=a=Pv?zNw)vL_M2g%bW05p?!sZPzw;Uq40Eu&ncaFrvB>ndsym>ORm4ujK2pX}S z!;51DV2_>euriQ?%IMmJdtvI&asQNRTQtu1MCqKr6Y(RDM2pQ*$N0^gG51AXwr(x6 znJZfD&(kr})QE(7!u3t8K6y?O<_?L~g^x6~BWr4p9-WBf)C)|Li!uUo2*MZmNZ6T^974vj#0G%Lpcl; zQd>9qsLV443y>XH)5J8VYl* z2(FEWfcP%{M)T^wh%XGKg<%BB3U#Qczr=Yu;2_)_bZhxwZn5t3YF*v z9xy5$CFwC$<|0-1J8DTr08}4h1Aj;_X(O>P`ET%lfY2?8PP}o)^;gm~iy1i;J^x;= z%n(7|W4|;F*^#+G5#8R?>9Qkvw#yUb68USZ2=+{tJLCvqX_>M0VAecE$0K38Pm9LF zE?-h7s;4c61wVe@9{J(JxgDL9Qpt#(Yp2Tx8iWq`=c>eJ>XU@@C%mAXFRqJN@=RS!*XV*?1@(T z-K?~ytEO=|Jvmevs~Eny!$OzZdYgo;m&-l}WzLpa1*!f=mgWW3Z#bH~W$H?a?Q{C% zY{@P4D!VI~#(qHVau{XPlQ#v%gp;j#6ty?4Mo#to(5;FV(Xy`OuXx5`J$*Ze_uAu+ z=ea&?P>@%hX|=MV37=H>9?f|5zVjrD;?<$8V{2mW9reQGjQ0aCtnas*Tc08Cbo&)A z>6(al>sa2KWR(mhPP5fkCGWx?g(&#JRFJ{mcx=b0lf$n#$p|W&8ug6ZI~xm8cN5EO zG1~e*Ya;?W%YAg{$fe~PS+vIf^^CHz5YNf$t7SgBWf1c{O>lkEUqNMp|K#&n3)*4& zpT*~<^BfiVN=N#t%F8u{jw`2UWGuXD)gPv3Ogr+bL>srV&v3Zid}DI!F_#qX9iU^e0O0ZMs&Gah1i$cTzr)!B1g$2YXk}o>j^ZY7f zpg+B9%&mv*j5U{|qtVONYl>RBy6f>J=IEI$m5lNYS}C~-Ag@min4x;naFO}#-BqZ` zVWAv}IlkR+UTJpi(+>9o(KX$D__5BaYEF+0lN`wdbQP-Ss$7O*f~CkWtNdL^>lKdS z7JKZ<2?`)hOJG7jX72N^6m7{3vLua|mov#)s`)0%Zq_&BUIF~0hUKjw{Bo3%*Src7 z(`uHI*JBW@A9kBbpouVQ@_spz6|xV)f?A~k^D2oVPLJt57J0A|NX0kcWaGukU3}}({vgW_Mwg}l3W-Vd4WvL8r8?$b-yw%y>erNM6&Z%Mm1oDi;Cxj_NS0CRUe-Ux5K3cjj8etYy$CfD^a^kc0L~W(xo8vt@ZrrfC_77@X?hx-0Ac< z@Bj(NDF@Wc z8Dcs_yub9$&So3s8wKgbZe*lb>(?5XKO&o2o9C!ZilD29)9%Iy7n9tK8@0(D=f&u$Pp z*_D?pKx;G9gjZ`TQA9FMwT;t*78)9>Km+7`oSHrYgHXPxacL!8KYRrj7l zHk7~QK2}HK2J67Y+B)~==P&zPcrHj!!bdYy8EAgO2&A(<^Vcn>ds?IJ#qMft~J*dVAoWfy>Cv z!>z3YEy=poesryN;=wi=JumXf^Joo8-RsNiF@Dv=o7eYTx$kzki?@q0b-#6FG;qjW z?e+zSx}mPFWV{CH_qPn*<&hjauoOVwWCve(?d-GM7S!aV*>yJZr zwR(x}^S7{@0-~c^qaNtJ4THlH{kLAoVIUq}14>RW-}Bej9P7Wi06hoef;xj%va!O( z%DD9^IGk}vTb$jR_-ygK5+)pWF^RYqBDI1nWm7Fxs4od^QU7n4J`LlfUkIkX1<=SC4}ii;arm;>+^Zu$u>Dy zd;JBld)eomGVXrg+S0Zgf~Q1eiBIrJP0$FQ&x5utXNd2^U%6y6ji>h*=`IZUJ{8so zHnuBNhvloO^k&}(IfM}pwIVG(*KoG6q#%oH0vqr?CUx=gschLO=+7`WH;03$AtdBF zZiS>Z)KIw4XuBpBLcSGrCOhr=uEA9mX69A)ntD9DYHj7n%9@x->B0BIBP#@6LcyDRM_{ zr>lZNq>6J=&E{~rh@J@xauWYbJ}`6gnIam&m9iawE|H~fyI^;A(-l}2zP1&;JuCav0S2Hs zr7l1AkWxKK+N_rbC;JR4wbBCXA;d<8k50^2};ZS?`+x%B) z4i3wKjFo|mqCo!APdzsNxFE{(T!@W>*Kwk#11wXq0uj>!+6}S?Y;-k*WPHcd0xg#s zJ(#83m2{k{O=(#o-S{cYk?{AOv-|iKo4GX)i2Z8j?yKK_`=o+`!tAe+r#QRik9Ouq zXhk{bQO*qWdbb(4q~x#xjgry}Kc!l=y|B((O0gB>C zpDX%Ir_w`ayc@#AI5;>2MtxL~nMf#PoA@AW5!3~!IB0s>7wPKjw}&kZOCoNC+4c1y z7aZNl(_y(ByycrXtc|8#{i6fl!zCNf$<1T#l*|c-ay^!aoAf)jslhvY5`bi1M>AKm?tedseU8e#gdej*XqwID^}kzh4Dp~$FKWU!$=o2& z)%)tVt^c8)D{jw2OzpUA*o71jyg1&t zaTesb#CjJV=Kixza1qiobg0v?w;u|K>`nMu@3?`ssn5a!}zz zRe5!xcg+4EE6ueSGwN3?tIc!RdX4Pd)O4T`8yLO(*0b;uXy#|*OF}Pb&Y=jciP&Yw zpdW9!i4G!g-|bP*tlU9fkf?79f(2kOL4=uDE)myuxz@TV&;Ll=m8}oo z?|#}M=;da(7;5|1$L|+-y-I@%dJ90LS|b{P_7C;g)azmbl9^;tVb0t7AkPIi6TW=j zn_%0IN=n+r2ldZWzv``};vGP>hZWtwzpLVIuWIY0MqF4eEFVy>wd4=yU|DoT{QDpC z;P})+3@ICl_Ad5_yBx`_FTm2uy?P)HxbhZpYMw)sl7(eYxt3F7R*hR9a=Ex~k)S5Ehx$%zSbV)LdJNe(%< z>f53othz&a#ET9ms64j=@U_Q9X$84)p_+Dq`p5T02Mh9_GA$8+Xn76YT+;11jK@E5 zRGnJ}fi_c{gMXPmHMJW{DdA*+ydx(kXR6(O?^k2v&!<7VxoRsFe^{7@b_O$`$)e)7 zKLIzJuE|P3$b*}l8o_|zE4dEPCT3>(-qL|%W+S6WWCCf-pN-6=8E=u#yGQYV;%4xsLU zPmazlRC^l+3#A)W8>&IUq!y)3cqk$2H z6!z0@&k1ZsDD&K+z-m+F%vw-qmgu1Ri*)m6$mi~tMJ)9?r>^{{!pP>FE#-p!rFk2) zh#SsVP>+VQ3fw{$xll3Zd^Hz@$WZ=xjMAj(E8;X@i>KlTPCKaE!Hx>n#pVwD*4@uq)hB?f~1udNuL(-jaR+xge&8l2(lkqj(K6rb(akV|rK7 zgGZo%Xed`F`vt67um)Fz%CX1s?vy-t<1h#islH>bCBdpy55v~3XP8m-b#-B?mA!PV zt|hKA0#d z&j6|ZOD*5M`o+bd$*HNX5~xvhJ<$uE%*)FS&OuU9QQgvmZEaVe>(x%$8zYBDk9u6H z>IR4~2D|S&BQYv;|7a)}e*|kn%b8#}*`bfQO;{IR%z|lwQT~MT;3M$Wo8SBbW`nP< zue^$iq@;eTxi<>Nw%sQ0`ba61?p3MyE_dsrd*>q+E_`?q{!w?$L^e@k_v2O&D2`m< zmcF(kAF`&Hh`Rz!1ljY@Rf#J8qK=(qEsKNJAQB=kj=>=S(zgu&Y5$A9OOsG_0)!2m zv5{<|igAIMb+G5^tjMvnrP^h-R;@{FghO=bq}ceVoZYH`>S}X<>gscuSw?zE8*oRX zB8#Lb%;*FsNrY^5_4sV$9AkBA#maG^k0y+hTYaiB@7yqTBVh$bpg56ow^2C4zFv4` z!gSGcv2b~4L_KU$EO8@)chohO_AdJZgg2&{rszph(8E9fbhvxB-dAs**OWb8O`H$Bo8n9j2O z6NxxS2nC>=L#ARLTDQoY)%4d{fGY^QDvqT%_h=AzQdFWkDb2c`KJnrzw$g zpjb>!1?r_>zXIPaiTJCNZ|@~<&238A|43R|dV+8<>sq5;uS_2-flKUuJ3^|H%4qJ$Lqc{!7u9 zO5LIXkn+Q_r|HqdVU^8iNP3^Y8WS4_o3!Bm{pG^9ruqU)e1>BQPyjvL>A`;aI`#r{ z1+Xw?$j6&sy#GwKVh4$k#F;JkHT>_BSQ|^#Ks)^;Hg<|Qwgwq~nci4buai;Csra(p zpn6?ehDMUYk!~R3wm9KD_mLA10%^# zg>~>02lg-;^yRQONu=o$nQ?d`R6c>#hs_#ga%LA)O+D6rfExPY_rA&u7m3B1kPnHM zuLKYLB-2JIe#=taEEbJA79lY^rONjlO}+khK~~0WflQjU(_dRYr|MI+tj}h~Qtf^{ z3Dm%s+i9|K+x-W9(ySwT)o0Hq4v={xey!-7UF5FDNd{mqt~u+~E(*F2nXA1-Hc17ALqG3YLkI}XMcZM^fpTb_ z#j(tCESBP39S9A4z==>N^B43ZIlk=#XeDt=ocHfR`Vt(TV=iqum9N$e+V)`kEVXu! z?m^&G>^xhE!O)mW3deOn3=ULlU2bn8gJv`z@;b@wmnrTYArcenH0G!IODFjnvNC_RUXC z_e6*i_s3W^RqVGP2;H7LqLwZ!x0MvZXw}=)T<|^j>e=4t3jj!34XZY<4$?ig=0=MHgtxP0TTMf%nt!{zYO6b{ z%0A-qXh?B=`>!=u2ijC>!BoQ{E^zeoPgPuSO3?K8)!2^Nu6GuT-&CJdEVJrtW}plE z<{E=_{S~kRl7&A@CSX-FX9<%Ml(W!kt7-a!IjX3g9BE-&3)Lw_NAw{gS0=qKJ z%EL6*iZ0Z9X|op0d>&yKeC;1T{3BbYV>Y3?*aJofO?KaaC&{cKc290VDdSR%(XOOv zb}muVajXMeFoLCD?kgu)EAeI%y3Sl^^iL8yE8(?IIoi%);nf6F^JD8D7QB1CD zW)K6P+(kAV@RMt4_Jw2uc@qBD%B!!iHKwbknWY5pdQJ3Bd)M{r*Zt!T4jCPnk(E^&n{J_w18xm!;-{_mIl1@Ch9GDF zm}k5(JlYC5m}%}tU#&Ps=SsA2m_2x9`eJ1=);^(^=owgMbwjZJXqf9R>!xpmXliSd zmFcdUa5M6+s6vYqP5eV(r&}J#AS-RZ8x0x5J*8Z=S%~@|pdYsX0^tH|B(yW)kcUAr zjGHoT>3|-;88NzyTIx2KNt^=f4Q! z6`OkSio&+^%)IJ`{tY>e8hZNfHL1+xTHaoo(?H~22q!UFX8J@3-$6710nYpr6{V1N zne3Rji|k4pCkqYV@B<};f7kF_0qe2n((+h;AeqXxP6bibjblE!L*dt*`WZ@}X4Wy3IV zdo8zWjiuUt{O}qMy5r?#2>mLo2^h#h#ByPWl#2hWN#Wy;BhbIGMZV{}P%k5($};}( zV?!F{E~5UGC3(T{B) zOL63TMu*V5q7DedytVo;cEA9LeJ*qu2I{!OPA-)59%8-n(o*{YPyBX1NGxVNE=vPE zg(z0?dtH1$(1_D?ZwgS~XF^H|n|G;lQDyYIzj;{u8X6;uKh<2yL+-1d4CTw0gRoyU zAw1sFLb$0w!3KAW8&Uv;mDoZZbblX-ZVyI|pMq6%V ziob~GP-t3%C%?;=_CEQqGUxO?Icgk+oT3KjJd$B;?rd};2zd~CCl!;xP1s*G>Z!2m z_n_^0W|BRr*@Jj#z4&uyuZh?*GhcymPyE#jgk)1@k+D>4mlKQxd6Q~)v?zca>RPvb|e{YbfVCNy=8 zUCd5#^1CW}+GubxR#J7_eJ*ov} zZM9#_Px_|bB=li&9w>%w6*nbjo1Yqc{rPr*Qe&;5@i_|?VqcQDPN$jt2yVfS>F$ao*)(aI%Q+Tf_yzZG0VYxg|(w-i-;pypN%9`Cc(}$AA z76_`mktys-ms)I=B-=2qa@O>ry@J^YRlAHRVQu(jpmN!lwfm* zqkGGjv8pw*$pcBcM`Sh>z;K4lvKpUmbZk#MwHy-7;a9sXww=hg_(PxRi+-4Vuuv1- z_f4_el)9{lL%29_w9^3?2I>iZ-fi%>sIQrU+0-(cV8heC&t+ixQC!BU$APvf~}Y#uBVNEaog4&Kv?5&FwZ#WS*Qi{Z^L4d~2r!hnJ%Qcf%E#q&@ zm4lFyM6>vj0p+9GN4{|H_G z=g$4Vf{Xt?+eF)Z9rnIaKavR0P-oC4Sy!} zzXbfsD=A6X{dy-bs$;kG0=U-VHnsI3(d>8>oZnzodh`e){5IhH80dTLWQ|7-L3%S z2gx?FZ_r=D->NM2AmWB#oWDe;>S^uMO_6WwsQ3U6CoNL|Lcu75pI8zvkbt(h=B+7?$1I?@4<){pzhHT-x0HA>b9KCfe35nuDa$8f`8>a}Stzt?I7 z&Pp3_2IartoWRzgDo!B!Bjl}@!H`>`c;LlFrb7PxRMk^fj{(Akd;R_AsR}pcyiiTK zk2in5=00VvA+_s!z;aRF&ssiXv(|cCojG8?7y`K>Y)TOecvhL5bGj?|+d%>iy*B4V3AUf06(#(Jx}_LM+zBL- z{h_3^GIl zzZZVloKofFF%DPf}i-T8Mrbf8*YRhHz*4XXF8lV;xmO1uPF;ecQq5!gqWv9{&gMeo1D<^u&iE!>2u{+A=qBK5 zK*X7#p)amfoiLySfDs*$l=NSOodzoGrrNEotzRPQiQD%j;QV3*{J_CpqE(FNAwtt= zCxkoqGK|a2D>tEm;AP@(mMj1g&$AB@W8nB8fv_>-tq6nr1JjCFZO!YFgINkhz+VuR z0iTHc16{ezp-MpdA&&?`S-^5&$x;JLVJ@ z08oc4-z>CrXH7!`Bp4UjVYK;o%Bi{)FLIDzg`*3yy#wdYb5Bp{Qald=D%1=yJb(;k(Pu^?@bUFwy5 zL0wh#7*yikNHhLx2j6qcB2yK1Fu2ggdi(e`KrrT z_Qvic;~!FqI3OwzQ1It#&W3#T12020OXSA#qUmFs4wO6=WnDQx=KVtVNVa9sRmdyB zaRAte7oCA5PJ@QN$I$J3;3Dilc5MWs&as5G!)bwzc!btW0PzfSo7 z4ndz*7-$^4*ei+BwbXQOVihD_59wdfVg{MaK$Zw-j*f*>N(g<;qvZ-jhp^a{nd5z) zpqN&jKl8izljxI`2Kj3FjwUPk`)IX4Q)}o39+`c&6z@T*ung(OzG1aWh=*1BQ)d@k}FzicMWzjPe3AMC^jv%GGJ2GikBm#G+A=8k9Q zNAV~HS4+*`pd&y5oj3AlPeH#^qJK3Q23U(Nzqv~tPDP=xpw~RACYu=TCsTBRu;r8uT=D~}|FB9=tJgdjDPLdMKf>i;sH=UMRfH0l%Or-dM zhKu)88#a#hV_GOMphdJ?xuO@P!uctApVZU*!SI5)B3m@WQSQ=a8R(hf7#eB~TOfc4 zQ$9jPM7I=Jup86uPaK7<6yWe|FsyQNa++5L%s3JB{8#+TN=v^cNB98^sdc#h&P9C) zHnhcGk$Pmt3vQ0Nny?>{G$GkTgkrK0NNaAY@055{cYr_I0Ky75F6;`yA!ucJoQiL| z@;Vp}`7^jHOwdQ-)rmb5r$Bn#=YNe;SAl}Is`Y3Y2SP+btfX5rdvGW{F(5d2(C752 z;e9iG;kGRSNB0(}^GpkD9Rd`i_arc!a;G0Zx>bDVf(VwyZTQzCDu%GC?oj?e3bH7lnO}H84%&cYc0lUJ;$=^v2ma-i_q&s;&<~6kcg{~OL6Cr zWIo2sD(~C2S=DdiS@kJlSZU4fRi z*%d+HJKo|b1YBuCryGD;5akdEfUD|gm~h`ku5z?jm1QsQDvlqz9RwBrg%MdJA67Z!_{xOWJOHbnTT}+D`oP&!!qulAeeoA z`x%w7!1+O2j$|T;7gWti-H-E(-KBO7gWSXH&$W11Ny z#aLu?qq>8tVDbUw|06Yf25PLa-GI6i_OpUZET%kAKD7-uILYEV$J`Ksf}}zE%iN4` zOKok$Xmmw|EuxP57C#8l@+tj6Lsg2&(hC5hfDD9CS%Uhcwab$yU(ZyZo(MZInuMX3 z3>$4y9o`D&34LCL_i*o__LGX(1cP8n(V7L_qkco3@TytK-^eB|YW@iCkT_r!H+UEX zN-)WrYr&;v9nz!+b1i&Hr`(o*v{KygbGt=_edzIi2*05s&k*YO>YZqy6yhj+gbkg(I#yU9bFrk+DK?*Zs$=Tf+37O} zGP$Q+PH1Xq$RM$@vNIYCY>D^Liy9{C{oUb;1tn?wht#~=L+XA*+AC+I`MlkZtGJk^ zz1}F|;Vvt#_RD@o2R=%fb&-$UJ+|QHlu_*)asYKbeBdJUn!+mVF`{n(>iv(9w#Q`E zc!9~kL)x=5$?K4|rnKzdZ6GZ9qUzcK4FNE$Ikjq`%~8Nm{5z^S{tZDjN6LSrnx#~I z-sjmABCu=3fs8Sm8-IhE_rUmWK1~9+#j+jD&lmj{u2xwV)t{J#4y7OnSzKIn*(Lk_aIo*v`(dnEzoOi*VkBd#$TXf{X=mars@ zXJU~R#@4u*EK>#huSXJ(B)lI8CP(Z^hA{|H{P&zMJq;&=!2KK^)s9t`RSoHoQ>5(p zro8Cv?fvEF*{Ygl`2L{zFPBo%V?c%ae+$tpfcmwA5pyaL6*)9Sj^>Kj^?l{Bq5@vp z#FygYItupqvsruoJKWvPd#Jp`x3=fNfaY!1_r9&B_py-a&~lAT{|35u4E5gYl3_-s zx!|H3I|j+=M{<>|JA*rh9!~jJ^w`^kflUN0V7`uaVAqz*z-;RiUMB?BQ+wUV+_S<4 z^|M{eTtQUAPB9D9)*g>BRd~D-js!rWc4BE)WB0^uJ5%z( zXCWWvSzKHkB8 zJ>5Vk%&FH6d)8xltrK_OIic%G=qN_n!YNp5`P;&k;O`~_3+M&xkB6iSqjVDs=6kUw z3(Yy^W=KGS`1l5DnOs5NZ&}HW3aEsxMWiLJEq`}Spq4fvf)R=D%Eyg0+}iK_0G~kS zS8&3xbh1O(Wc_idQykf`Un!*n(ieLU>B-;f}NqO!1b0YYnjme2lR6Vz9-I z1x!A;;c*SdF6)*$D6L|JD#9A86II!}&)foRC$`1&v}mA4ZVE1Bb6lg-iIkSxe~X{% zhPbuW!g7EEW@7rA^h+Fv$-YY|6h;ZVNoXZh8DiDD&yATf({Ykc&d!OAJh{qVq)Tao zr6|JNl_&h}z)5e^{9t@%=%LTP-RmScadu?mpH7F!I2Q1%IHE;4qyh zT_~4&oKqDm4A54C9WNC@S>dmM8RAm)U|!?>YRp*ycTVF3lyH{6EE#Mo(l9Re!aQuq z&n(_H%7Q3HEv@?Hh@zoYn>UD}gKMgyi9hrE=+y?Q*Vu1}KDP96e>e0%np6~!RWIO3 zjkXy2W{#T5)$ekvHyhFSbefCooEZlFa<7AI97-elXn{kk&uckH>+;Hx3-;n;A`^h51wv&MscMJEziF=;W{b#9X@1 zxL`BKk9W13I5h<6^v*{znJ{`ED|wVdZS@M?YEINWdJZ&X$` zn_Dc@aHeL2rxvQ``rHsbCmJ3pdR z*F?h?y88ZBOw<1QC;0kb;NJg9?D#(iOs|9L2-NH~2{|kuA7EPL;3Kj4m0QakgNK?2 zDx`V4c^+QSKD>9EO_$n64$E%Dvgh{=EewTwhCHnAi$*Ma4^+7(;t2#C0L*UWhFTBQ z+&BRz(_U`-!2#?R~ zXj@LgaAODt#nN^1Wllr0I=#sIHM{-_lSfr zPf1N=X#VJ25DJB=mF5Zuavj_k|8(t+7JLF2AON#9)7+W3o zqxlF7Igy4x+S-7Jjxg@45so?ixVRFl-soH|=d9(7pq0HY;^ML6O90FPKbTNQ!hwx> z`uO#Kg1x_sj4IG3j15f0Fv_Kvti?t96XuxEEQaqfuzu44k;2QX5+Fc}#RmQdz4D+W zo&Bgb4d^bQ+^jU6J;ZVs;sM^wH+K2RbT!dm`2m8#9GaWc5IA!8(F2>-6Rf?_A03%m zAdl1xSP74~&SWqcnCS|@T*1S=Quh98wD;`jl>v-r#`JJK(YF>XAI`>#X_0%Thp}2g zwg8tOi3nvoEzUE@m6j$pN^8y&vs;GjivJhdW&v0yKw~%j)v0LX$waBk`CLvOkz7ip z*EwIr_eqLAwe#Dh0184dJj8q{E{BmI{$1^MLl3QPFQ;e~g+!$8^-_^@v-UV^7V`Cz z%;(KtXF*GpZFqEI&KL+rct4~`h|(E!ehaXCgOs(70xH?O#Ig*@b%k@&{cgt3b%pZ- zJNV4Hd|mAalnqNj>cc$^W_Y@KdcET5!_0#@&?jl<@L6&Vfs0s=#7~MP#V5~ji zUYQzAkkZ>8_6fo#Jp?%SOtfnDui}rsfB+(p0RZr178;`H`cLql^~G;!)&kK-{NTu}f;@VXM(Zv?fN9T=SBB33v0t%;X$ixkP9C3Gu4YgmnCawI zgGS?g&UO_2XJygxAg=z8vgq&MG0t>l#_f%IN{_B5 zlkwx*dmnJ(0h$T<=eG_T!N5h-4#OS~brMz6{(gahw676>f3JqXbVk4(JbBGHaEF?E z3amB%tc3PZ>kr6=NwZYUD>+tnpxiGMD2^31lB!nlA+1E8l6 zJ&e391#J=|T61AF*ly(H_;@UF6itcHV`(TzBKZ0IC|X`=Er(ilWhIQF;5%!UUE%Mj zv}DcrVm41fRy4VVUIz9^hPrJWRw}I*7tUmt)E2WD2I+RDA@=UDCESa)XEdWWDDinu z521|5rBgbtLfi@E-neqsEImy;MR_tn+!x_6r-X+u!VjE9rP%@))}>8gWQLm zM5Z~9vcq3#x)z^rROSvEYi>DBP7&Dw0{%(Cm$u`_bIa3Mj_h!>(^Dy@;SSb`wc>UY zcIr}t1@}hgnOh*vP1x=S^Hu2t9b5~;!^st=V;!q zshPt`um#=Gyl0Egl8Pe>h6c>TMA#7^o`Z{T+Myc*75yG_3EdR5it*EQAZUU`ry``@35@9CC>baeY+L`Nb1 zOpQBJ+a4Wt?$t~uGQok813Jh7AX9)wX?@W1cI3g@a#zs0$htWI zl^k(>wP1b^&XwPOb!x#bZj_ud`iqm~SQ>(UX}gNj?Z6&`nr}vmN6p2E8O~2T=7zSH zOk$%i+mu=_zOBUoAP(=QKJ}zX6Vet@;Uxr69E#0_(abAS@n6DSFzN(p1C@yB}R2 zFEp3FdP+DzL@`==r=c-723p2a5(=OrlWq#ds;E1EC&0oIyS7Y}n>cs78RVjD#?Cvg zQ&5xGl(cWam+Q2I-o0xcQ35MA+`MASSt`@mUwQ6sGOZd*lves&!Mmf!{rgmiqr9Mo zx!L4heAq{Xw**gkfJEzTK=|+YBd@*M?!&d7)mNGska-?BQv|@IYO&6TI^KcWuom#+ z9}Lty zpHfe*_zXqIz~NfOE>Pb{U)yjLbE~6h8o(NzGyoC+LJ9kp37d40X}1Cu&PBrfMm5;s z=LyvmyxanVU?#Lr*Ko(ZdW6LlnOoAkZmjPXC+Oxj)-YoH32~|_u89~y4)2uKGV-&o zp#j%;9?1>6c&`b#!TAZZC51FrE&~4x^s=5YL*6 z;lBp0kVSR*>yVXvf1^o6C;njiP{_A6by7(pkrLWcCW;N3^H(D* zS+Fj`EoTj<7~)oOIfCp_F%jxud8y+3Bk5ojWrT0wPn zb&W_9eF~{)XCri0AfByCj>(ytSYU&a7aZX+_-bhGnK1C#sYOGW$I5AK5JkG+PK2AY z7)mbpm}{h#V{UWL~t(axQR8^YO+dRuZ z*I&sH5Z57H+We`*2V#Zn)v>~wixrA#fMJ9kuO*g^nO3jd9RjkZ7}TbHT#TH;F8Gs0!G)sz%ht+V{rxbazJoRIoTx(B-6tV#MQ-pXlSmr zOdw&)bda{x3f=ROhdSowe4rUQ)Nds~nNv&V>&5yiKBQaT;#dlGEX6Ycd;&nL48_V! zimdX4jr2a5d_C=irI!UIMY4FXB^*vvU`NCEAsonBzpZk2F4-AK~vo3Z%zdU^^8l46Hk!ZQ)e#l8WzB zmJEOrFpmifGGd9Kdt_vh0Z1Cn@{&SS8_iR8^ZN)GgRaTyp+93VRPJ$d`5TpM74N>y zfN9_}1bPSEb`;3^q0;q-eW#CKN?DPb?wIr&gwGgwjnd7zVd!(?#@myG?5SV1!w-gZ zTMUuVEb<9Z6iQ-GYQsEpmHmJNf^4dG?7g+Qd7hB*F)4|MQ(uc;k^;cwqvx1Q50>i2 z>*(cGD(h?y%SJ>+#KY*xOf*4#r}2=ieG+cab2~3rWN`&PP1CdFAt`V#p9qK9+n(Gj(_L`J7lJI%^j?O+2Z9|DbJLOw30%HY%8ZMc zrDOrxH1DLJTHjE+sF)ZeQ@5_1h3;{F&q6@oNO%b%3`9``{C}NBYEnz&fNhnf`}@xD zP09t7GuSO099yqk(LQU8=z!X{vXMHRig}yVC5frGaUMZ&@lbC-MC9DPfp3!#iSuTM z63RpsIM}|)${KlLdl@V=moT3cPo6A$Ul4Wb{lb{l9Ft&P20 zsIkz8QBtU|1ToRfA$>hP3)Y^wK&;`>9-Gwa+$;B0K-B?brjF8`S5hE44f^66S9ot5 zWFu|1S||~|HXg9i-opCA4SFGeM}nycUu8M-#CXj(qWid>@gb*zy(QzD`cYx%bFWGd zvd<&1%q7tvZ64uMpS=cvBmp7#X>n(QTJ9DLoyJRc&x=_?eg!WU$X+qv_u#2wBU!RC z6a+nZZj=0Cmd84Xlgxq$mp;|hVUPv;KoxQA+A5p)8*#CZ>cJn457*BAvMV3^vC{*< zS&&_wR=)>KjV~Tos1`oQ)*2uQ*6WYUFQ%ZOJT`>@Z44U%pBYqwT?r{?QAYOWiXz6P;?ateP2!TE~7jU2G-&#b4;2Yl~)>p6Dt z=2ZOv&5>}U-%VqvDXTRKbpqY~k0IU(8;g_%dPE|r#K=wYre& z*uch;&x`07TmEsuM%&PR-y`J2RzQt6$nodP5oo5zp^fF_zA$tq+i`P)ep9@QxWbx>ieJr@9Cw9tXc5p0qNZA z@&Y_*&3dX?=RwJK?>5Rr5(A<_qdLj+Sqj;=O2Q0dMV^WOg=}lE3W=w+ZG(dJTY5N2 zBpSQoABz_}0W~jRuqeGafY-M?y4MGP?M}cwh*~w&<3M~4@bhbm)nw+0bpRH`TrxD@ zQZecmlT`;RInySsDUfaS&Ut6`C8BJ<2qg*>RYvTZ=d5M%OXblCv60^sFPXIHl4 zwXq<`zK^Hh&*M`43#CO2*W8sa_6Oj=I%VcPoMmvm;Lox7rVU*sir@VUgW}z}T)_*~ z0T?buiqsD$**(y=oDTJ!+0ZFP=_nuEjqwVnSzb;vwRqO~;kP%)n;kV%%{xW|Zer^{ zg?>(3Ob`C_Xyp%6UTkIJtIiQfF}0o&nwRx{v9lwRSPef*wAx z%5319(@%zI2Iq-~4RBoKp3vF)|(f{;Ia|g!M7OPZZLigj-Xfj9==M^-oN?DH@HuGVfksP(sEq7XAvlgzA1@84s)| zR6%%au*@tCBr*u~tPA+Phv1xnx|Jm~Y?s|16P#lRwG2DuX7ZysoN56VNf_sGQ_MBU zNPyV`S%}_>5U}pR+1SknlN(2fNWfmsK&hfqSDZDvt+Yo=78V^`Rt3~nz-xS(TtIAu zKTc{awHK6d;sWDCzwTia2TE`>cht*?xq7_)ZqgaSTe7@2S9Hg1MnirlrnL*dm;ZFk z#Vq-gCtp#n^BNn&#{Xe_4kSnh!{a8B*LHp~zPgcF>H9IgpxGMx$egRn#Wc6^R<7t? zhXC;ohQnH6au_u1kb`^`Nyv0vONcNJlzMaNy6PKH_Vc!1Tl|_pD-#eg z&Kn{1`4&ZEENGpz6oR6BDT;ZyuCS?-WvTTO0gtiv#iT?s5U4;Fl7Esgol4@KE+|T6 z#Uo|27C*v=cMIBgDZIzz%z6$G1L-x}!8$fyz!Y+nM`r7%kW1$>KzsMBrdL6@5 zzosyUmj?&{MEiiag`2T83)|tsFC{6`(ynGpD;%YdM?zR8*bmZ8kY5J}RcZ7r8L#XQ z)56RpxTxnsyze&0)`rT>4*bK91z=!L%aRYJ?@||NL(f>wDC%XA^#Z4Ak8J zmuyA;D-gIj|F=M5{cn2|4vv0~e>**}NLjZM$+1(b_;-sEiPCYFNIGK=;xV#6ZF>Fm zy&MlTZvFe0WICSc7CPg4)Rwv&DC)KTs@H{su%50zYTUqCS^f7B{(i+;xwvUi-BktT zRDZwnKRBiQ&p&B(EnxZ#a=!M@uuP4ncMusVzgf375$gJF&T?<(x{ST~&vg$M`}6C% g_|k*x-_gG%rfKC!?x$PE$TwcOps!tg&i=uF14DyV761SM From d8cdbd663acccb87cfc658b34c0738a00e4450af Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 28 Apr 2016 18:01:57 +1000 Subject: [PATCH 117/439] remove extra space --- windows/keep-secure/images/portal-image.png | Bin 182802 -> 182308 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/keep-secure/images/portal-image.png b/windows/keep-secure/images/portal-image.png index 8785079fe6f511942f4722f0463cbf738d7c5008..be59f06fa52aea7b1152afcaf580e4561ac9a146 100644 GIT binary patch literal 182308 zcmb5VWmH{D&^Cw!2|)vd;1=B7-Gb{0?k)#+O>iebaCbNacMt9mTn_H;u5*%m?>pbj zH*03i4;E0ncXf5`>gtlG!;}=HP>}GDprD{oq(6(RKtaL!K|w)pAi_f^8oyomAiv() zf7Wz@f2^8=kghl&p&A~;LSOCYShAwYy?Fh}f`{!5b3a29cKwy<-ADk&fN3?U&q zLrCJLPR5Rw_Rf}ewosUFNy#B}q(5{qJ9`gDOLGfnsGn#fybvntU#g?2;h&)-&Xzz^ zD2`jSw~!}q|2$E(Gjnz`bToz1wSWCH{M}#XmQKbthLE9-Pz}FoV<2S2KV)@7M_Wr< zbEseVJ0TDn!awi3I2xNmUB3n#{x?j_4hS^0b%webN$h~o;QtI$vvjsGg(^Ooq=JGX zfsz&%QFBi}T6XgWTtD}p&*8eQ(#JuOjs&)uFk!@+LMwyA^Xk5qxzsO)=PhbkA2O2E z&17k3Ya!Ssvi>L;K=L}pFcWokJQdiy?Uxr7g?WQ);*%NE@AEy~>x5_3%l7@rqi?%d z6%Z_mNE(PPibyJ6R;ca*`}fa4ZhUZkgk6zcg-v+wkNfsLN^yCrb;Z8})wJt@#+n}z zP1o&tneOk!I!QpFToCAuu<~XJU>WKkUPG!_PjXYAu#f=K_@X)Jg_cH|vl1ojNDeg8 z+yAnWl~^BVMuzzYwL)tlMuHBN|5#K^`045G9|oaTgY`hj`yY|xva%HA_W77r!ermH zK0SG3Nzj};(1^=Z3Uxw64n)sgq}9AHMfxTT)y-T)dGdePi%5C^_15p7 z$y{ZmbKFi>2ucoI5tZc!RM7q*f8Z6pK;cqzArCD6l7I2fC;-iT>{+AbLgpPhtPRC*S)YD;P`5Rdab4SnTlsun=Vins62GDfTj%#cWHh5{N$I zr5hCgu2C6C6YdWJ?KO{87sw8djC`V^3i0=cLGGrmt1#6J6eWcijfaN^|LfDGY4q&? zdCc0ir$dttHvy_zoil^@oXe6emv2W_aWVCV3n2hNaTlf~^6wgp>mlD4H3YT+EKiLE z^K0GSAl0nIhhdoPBl3nlcX)?T#@u1=>FuU#ivw?lX;)UEWup#bs~(eW1Aa)ivd%MR zZejfY7*Z}MYk0fs^cHq~4F@S`D3EW8{VjaJ*6wZ|$f{|biIp{OVBj-95t>3#jhveb z01y#SxO&>Z?U;k}?KMYtum9S1Oh5`#dB)_(_}4y^84?Ii)vwy7_Iudn>4#}i z10|5VNzf73oO!=pwD?F$NMK-Ms)9i3D?AaR*;D)U{X+S0*> zSTVQn-~+aUg|fy&R!^CTZq@bf=$f&Egdtje`oCyZRAZ1tBfs@b{i=8+k-zo6LbqnXWU4qMVen>TZ zal!nBi86H>7^VNkMfR`VTh)GG(5kds6+}fNR?B&oC$U)A(xT)k?3JGSG*?@R=;n55 zNz0NNtgm`rf~Now;p=CSwPLn@f#ZKi3PLOS*EKD6)+<*!P}8FJ_LWg*muPSnBQ;{f zh2*X&sbSevLYKgV^NRmxZP-}Cs#xqcIv{^Elp>(iZQ%qpV_@@V=_l z!u!1F|6I-V$K3-@P4>)+R%u-YeS&tfysYSGf(vpjx}Ko0n3y6UxW3kIHFJJmgN&RU zqS&pit?vm5y|Ls{^Q|6i+6}f8e0(ik{R#iM8WeE7GS+q^^r^Rh7J8D_RG~aBi_x1l zuUkr9UOf3JW_irv>PjF!#4_#X^t>4QqX~`IyMnx*ujfomOwup!{__`Qj-F8Tr@o{h zOx?Mr^FI8hhlA3v=x9oGL?tC9``IjjgmP$1%q~vH9ULqI>Q*p-{Fgeh4noxO*^N5pG?q6t_Fyhv1tU7amV<$N$?m{6bh;>{Cm1UJo*Rusm8p;$DKP?9k;tt zhTGcGzjnRuU@ou}w{6K^MT@^=MZu-^cg={(ILO3;>Cmw75Ghqpo)aw%N>Jm#E|g80 zVpw3&I(gKig|XR;M-~8~JVOQ)#0Q}xGJ9TG)Y~j{^+n;!F6(o3WdS!Gxj#-UMqJXj zV4G~STypCq90?q*i}F>E=@Mf7yHy-}dV5){rm11R2{-8q0EfF~m#=WSLnVpk>s{XU zE9|@{OcG90@R7Dr$_iR7>#8J7Pkd!YhOL+z9{0UrgUqL51^mUU+FT7xqu)Gw+zPUh zJ6y_PoU1fl`uFVE@JGhyj0_BXiM z@_*oF-WLrH2s?4o=5)!PNP1wru)_7xM*_M>$A{YcJu}8a)Zl!>ctE?#OIZ z0C#AXo?M+yLMM^O`KqJlYd#mh6LcGn?pOfM?-tA0?~7Z}jr^2diLYJmIOkcYdRPcD(YfTr%^wqaz!5G$Nh# z{zzOlcyN6Rv!Q4ZF`IE;J7a&`0^3^HdUQYfz^*9{Vw&y$qh(L|o7`v*I&5LgV zpUYo2V<`Rv1A?@pd^g+sIQr&YVqCdR8}7%?`}{X8X%+;Ve7D`!jh0h|In+pKf_G~? zxAHPFWE>pWh!yzi&W}@BFFobDEg#v;-)C48!2x!X(1rdSF;+DD?{EdIeHh`aO%KMdZ=k z`Lv`uOt+^iRQlDv7j22xp_{2N9fJO7s^ZNG#V3xRLxnbC z8qnVHd{y4v3&b}Ca9Gb8fL$Fp%1pK^_6~a^aB#9Jwwhk9EBvZFudPlxUVT+mRU=}A zAU>cknsC@@TtG@iMWuujTcCY!UZNp4+r7}Kudk2QZiTVE{iSG2S$WCZEsPHEVe~2ORF%zcteQ z00)h~ePt>1E~QXfM~6T@Ez`4`8uCH5iFJotXQ*(Um#M=&eK{>=0_qtEj`)cT?q-s3 zPQkuw!nuQ65kb~aRD$|%n#t4Sj1C*JO(P_~O7`2f?XT3mQ{Kk9!sE1)typQZ1hG|?d7*QQF9x7xBw(ZS>G|#{2n;7%D*@VdQTyMtxrVmSuQWygg;=Df(pH*W+Gfq5}+Bw?hefK0jd(1EXFzAeWqBHC@Wgh#1yDp2V9z($EI@c@7 zb$d(!D=k@kT(50^A&>8Em9KDt%i|4u_!Z9SroETtY7T7G$r(VwW;VR=`fxo$As-S7 zOkXxtIpYY%1n)RHYK{xCm+$r_{QlAI<26+-&&KO&74ll^@pS`Jd!k(ak`*X(@JOfk z*gfuXauWNrp5iv|#mw>abYr*q+_1Xt?zvK8%x)ReGIL-D-_<3hVD2>q9S@mcE=MU*wpw}$Vv*w@uNnxa0O z7ok-))uIw`3t#SxDq{sz8TYf=uL(mu;7Bry@kb$FeoQKbPmGM^OB7HLUm*ke@-#Fw zOWv2G{8zulzq4A@PWEatIlZPJ1KQ|SFPm~t+QVCvzEGANHONSaPbiS^M58J&!M^T*a&{ z(($(RC)cQ%pwo_@?4cm61s1NY&Uma)f1N35#nURdw(X*boe9}NU6&>BNS98dPT<`P zIO~UeOQWd?8kB9*GvEVL<}lrh!X+*FekZ<%mjonX_r-R8r12$)!cz*i zaBOv;dOVZn1-kj=8`u3w1de^P^9%RA&le`$U-%VmgBzzwPUa1+rkS3uJ7zn_1M3ar zf?}s%P=?z0lk}a?4!P{M@@@-R4#C^>j~fhefQ@2ZAa-9*T;)~TlNgvO_8}btA*R-x z)oTH}ValZI;fHsRr*;U=wmuf`nFM`=P{^R&$SJ)mzhg)2FmErT%~zTV__gvZnVI(_ zjA%CoqwS9DblA0bZM{{*Jg&fxe?}q=EaqcZgz0$P6u3HAj0nK@HP|0>ZmzYG)2bKg z-{Nl1e1X0%N4;u4D0=cea=`(<2v!Jfq(9oMwr9|&78-y#Rf`lLNnd<&^1$9i-r(S% z;aECPenG+cDA(!_kE41ZIJ{$QY|LytQ{bn5$IH*%$DK60&$6<{kYlWOm)6t!%a;#f zVPSGvf*G~7?2xcj?VzemyMfVGH8$?}P53LJp!XfmxaQl}7XHAVuNrO4wR1Civb7oR!y!~WeNmqj9yWFv;`}}S z;ybqQ{2trIYAmc7;{~hICapV#lFCs&dizIP#t4`6a04P9r_`lfbe3Vqm3Mrt!S?7) zlY5`sQ86R(2|8Nw(-GD4LbDlVMaM06W}xd;^H1nCle3v+O)fV|&9CL40#PfGU!QUu z5WF7+&3($9N( z#J@TR4j(Jm^3X!91cRk-S4W=b^c9lIm-kk7Wds+hJ4P-!ofPfIQSugcPKGZ=`BEM> z@@j4DLA4*ihRj)hPw&|%Uo)c#`6k-?0ejE3rWaX$?|xN!QJsyg_OtG{~6H(|0GQCH(WIs&qiBvzyft)tpDb;X(`DjI8vCdd$UygjVVKf5s z?jNteTTX>v&bvxSw3?H&`<6r}b`eIIIxc>Rxg%cB}7r zB@=49RSX>1Em=j*Ii0z!eB_SwJNG#`LFj&T&R6Y^UV47wr75gxJ&&^f+0n4&e;M(xDYFkSo#Q2c$fv&yz!;l{c))cN#S_ey^L zJ88*l^_gC)Eu#Gy-myyZm1k*}C|=0854qXxRKd}a)wn;p?K1<95X3GiX=uVumb))y zu1;68($mvxzLYQ)LZZUh^z@PS?vNB-mje%Z14vGp7BOE<+`rF%n~o0x#rYhO9C98P zNPrn5KeD9fhy}BH-y!l+av41a*AWa4NeRe?)*jm@DTQoKAH}(lKUw18HhC;vt->Pv z6+MAN-B2&C+!l^xMvZ%Z1ehLi?Fdz9h-J2o)s(soN z!Qhm+ld}JAU|`hPZHSEM;nJ^jok9&g+qVe6F-HokgYcH`3sC5@uL!4*_p@M(AXkjF z-y?}FTg2QE(LmZ8`XlI<~ZCg8w)^MvA|2Y%(*p5;6W4-RzWiXWBiipSU8l@u{8S4PVav`U{y zN}%DJ!J%O|2^ykT3vE)l;Xc;Lu5AJoJ)dio_nx|n9cJr{WL&G9(bL;gDJ}QzDZALa zlZYm}ncDz2herXos@D+3dz)?2_i60pUazc)r*fN#B3w|}k8K2ccckO(_t>}#Jl?nG zUO#yZewT_h=BD5v>hCI%pn*A+b6YMSt6<$vqZ)XW)(WJJV11JxG2q51pIU*eu9Z+l z@T!y@UF9P%Fip5`#CA0v#UZJ2v0*jW$QqYl<`DSQPey8{zd{mit7ugC!_3Co_x^BI^<{D~VU53AWp^wiq9YTMi#sIHL-G!hpwkY<;5zF$NTx0Z ziJ6l5JyJ_@LTohE6#!jegV2@*N4(e~O)rRgP?|#?f!}!fATW zGM)eWGV-}0tje|8dGzh1qtHgut$v?SmUqM||HY?@=UtD?RPG?}ct_k61dr{()$vtCy`(yT5muy(#d7X*XS8EO&1a0)9tMIT*gmgt#`ftVdUMV ztZqV^L&{+hndnl=bM*{8wGiq9g4^+@XA{A2yqNca*P0%GiZgWyErX^{4}BuuHyv*C zhTGN02Jm@)JgG|+Tx>?dFo&zWzp6O;Q#z{9+#(<06y;u+zBv)!z@+m%$!GGXj0?S{ z>$bR7IYDysV~7JZzS^6R%iv8&PbW}O8S;Bo$DN#<{9}!fxWe>kzN(;^Y{hv>zE}Tr zr7dkNgOAPk$-OUzczh&<4VS}8tpo@Kal59S{&40Qq_tZ-TsHH<5UWh#b}(w{|5L3v zukQ{)b9#NgO|l$L8RLVPs*JUh>G0T?plpL;TDIXtJs4YOmOrld633pI0ao5A8-#>Q zHO1ZNht_h-u?Z4UpB$!Md%X5i9#@iQmyb_RS0#3uhE%fxK-BD!)1kbwZlj*I*dgWU zr#xQ8rMqgh7ks)Rlum*#{w-O=qnK{4o4*oGZFs+<{laOV;R^>1s7O4oT0eo@X*H@e^@g|5C5t%RMTF z)`wexN6Y;im529cgiAdFxBLT9X@c9SoO+XkpZvzHg0DYH{N9y-hPiKgBTDHhXN*K2 zbvJ9;kF*HsC0J8us#ejP+)ZF_tF_mNOw6zXsijr1f5s(L`TMkT_^`O?38e}mG)(ra z3`24NA@D(ZjM+s<(&<`~0P#*+g4FN{I?~$PVjEr7DCmYK%&c+PL&~1m4t7m&9%?``uCQ%e;jcWL!*W_-EqvX!^HoQHXzP z*jCW;Vfof7^y4p7L5yw9XIcG3yLO5KT>`hr8++ky?$*-K>dwFs|5H~d^H&8N;7FFr zH*zM8%Is-z0*WX+j)TaUG)|z_`5Xn#*-D$2Tgl_t)pY=xpoZ1kP{=u5<-D(w$f!H? zHyta=&u4btQ-av#kk3*|JvQN`&MrUr8K=38tiNo}c-$4}_fsqc)i8BiT~e<57x8L3 zW7(#rpxp2M{Rrv7*-HAR zN}yF>oyogK@N+|^z;G=CW0epS|1}qHU2%-qoPG1N&g~TbSAI@HfzC*tn$SbmKzvDO zNDc0b9@#9qw)rb4W2kM#2Svi* zry&}>@5)(OZ1_>38tpJ=cS@o#PQk_&pPoI2?Nk0~7C!IJ7#ia0a&Lx~I|AJV!2@V@M)6m3HKmD+?Lrw+pj^{F$0&j`yA{hQq* z%l!-;%>kZbuRV!nX(^A_WV01o;sy&?C*DV+8^&W9ZJ`718FlZ>W6=Up%Sb5LU<7FW zdEU*!pwD@{kyWX$G}`C#PO1*mYaeaBdm1*)bW#vug!Q{en6+K)KhXs*)YuU-3Ef~) zKAmtT60ps4xgo{0USPl8JHp{7GHrlOOF!SA&;>h(!}>oRc52@_r}c3i)>odTHQ6lI zCQ|wO5WcDQc&RF~;NOa|(RqZGO=R3@ND3KVYwz0E^Le4peJTiXZ+VIpm-3A0p72|J z39RQ5>}&o3;CD1uhl(!G(jK@s_zw#(sE#js^;yQ`fbTTp{JPdD`Yb|O?9L*u(`)tT z&hM9H8*qC-0D|lJ*t^a1W*foeCz4a|q`{>hy7Z4`M8m4})prqG7MR;G^xhcC;)z6_iVY<@@b<;Xm=PJ zfl&*;nvIolu}Wgp?P5#%Prt!+0|zXsyv$xgEaLfKCtMyEn?^9TM8oMY~S~t@gPlkwe_ztMpLvJdbu3-}G>Tv~I$wL$Z`@aHH zui=*&wYxaP9x?Z4-LHE)m^Vu)3i@h&9v5VnepJN~f53uQrpq$7?TE%575&MBr59j! zjG)N2)g!aW9)&=j)a%r4Vr{kXR{vs3WzSDjI~W=FbN5H$WRcl2je&zv3BOP$kM$L0 zZ$6(lx>{T!y;~L5iPa`Evu94c^=bI!dxO7~^FGUjl6}8Na@zHV`?c}aJ^!v8@ z%NsV-YJ+uFPt=b?vp)S$?&o$5myG?gGjnGA9$YPLQZx@ETbDR5zrK&I#{EF=1#Jga zgk|*4`gje@H-}ZI6R+D;qn51~k}mJF7<|l#!_NUB!7cP_K8(Udo5J3(_zL8sokrnF zIOct1zR;+$V6?s^Kv2_jcP5y~nSL+D-|4d{8Q;-he`Iz7ZHvzn8Y}j=N&k7US)ij#BQh~<@QwG3p4=B8Jn|QPeNo? zI{jfGBzGS*WAl-#>LB00j8C=<9@5L^v0sCNlph(cKlYY`nzWf5@Cy4Sy)qYhygS(t?ptL!4 zS~b~%8qtY;??{gq>&Qt-zdb$WO5-Fr_QPa`feyG8@dtJ&SlyP3pJv3tO=ebXD(*9_ho0m5@+)~Mr64C5=GG7&t zq~{rSb#(=)(&Dcxst*nfZtqrXr?(ju(PVdhS9ct%##~?9RW5i?5BYrdkC-@+#`2S} zmKL7dst*^Wzy|3*qa(x9U1>-tLr@VGseN%2vhJHvTm#(0HZ_pa0yH%e_n2}ST{Bqo z+w-S)e`P`>rR{`-;2s-cR3CYrsl|ekbEM-bH4=jiKPDH30m1Y2QMuH`pzuOV2*AQr z(*|50wNPVTV=@@$^no7IR1OHQuxAk94f+RDlcc1efSToVgS+bc$ROZ#lMjjbA!wD& z%lk8Te(nqf2vCKGhsVUstlGFAb+%l07z8M#)uH*R{XeiBP*r3k^3G^lf2+r3XlN)2 zE9-j*)?#>@jEO0xwUu8XlV4gyq|<{~`+q<>YGMlu3q@tHcbn7YXS>DeG%9}1`1#=C zKN9uCB*w=Fm}(Z(C+IlqB0Bh5so(LnmVvaP7==E5E!6`wh=+!=F~n(o`pql|KgC|! z%mI1p4HV>*-x!D`2P{V#LC^u^2b72o3gPd|#S^&hBaG&9d5#ha=hPs8ih2<@|6BkB zPEp(#X`|=0EppQ6K^;sQF%Q}9#YEv|Tyh=0?f@>hubx@sC4ad^v!^}ResvyzTxR7D2)Un64aW<>lDb=|1K7SZxRP)Q-4njP^n-!ZN0&f ztc?nW$x~4@1al^u8bUBeX@(yYeEFUUApgm7{M{ZKQn5o>5FcrHHf5B?x_#YGt#L!) zG)Dl_P&%ogjP*o6oU3PJQ$W~|J2^F}1i%IWl=D+*{%FEM1OgpWj>m@UXe^ZTxpcTl z@*T6wx`!dl%Z_86+{f+!8GM9KErd>2hpGj(+_^s747qxyL6CFpfDik&)MbipeG>HIR@kf%VG;9t1_UAd_ft&4PsUEaTw1k&{{TGec#qAL+Mprxj!M)d)C zo=|DTmnQsGEKY>n9hta1HsbGEZ8XWcn2oa6QP>%jhu*gzA;7|qk_lg4kh_cR-9`^o z%6<%5{aLVb#^-It(A1$_OjlXUF;Vtt-9)J$Zm#!q&CkDG-oOJ>|E5Z@CGLBeVje9lUn}}|5C!>{9};lee?4t~jK(0B{Cros{pUkX zmEehc-g!^TYCL7q*a>vno%%)tO5oO}LCr3JLdq|6bOC?xE(%6QWRU&^1h}UEFMCLr z&+%$c`44LcJl#1+8`0%(R(kv&G+~{HA=J}F!5m^?OcyTU+Y-PdyxU~HbR@A5(bvXC z?wv6Kg}L&ioh6PsEzOj0GoCWgnRbRn>KCgW^}n*FKI#7C`y-xqG2R`Z-Sd{szNxc7 zU8Z6D9gF4UCq3VLQ&cb~3bffMnXkqZ1~-mLtvEvC&b+~%+xW` zcDsU)>I+3)kq?Omo(}alK_KN_;8LRlG9fP(E+OR~n_U#8^%D)1nf(r_*#KO~ebY5- zl6hTdA+EpVAn~s|QNx1(JVPUFC-dhtTU;5KTA3?AX)4fCpW9E{LAHM^kW{?j5ALtg z-E35}X$KFAQXyS~yzfyy^-3r%E^cqK;GL$XCSaKWvPp8g*q6TzZ;PsSA_h?-zM*wm z&{uvpkSs*n)63>)vTl>K0IB;FJ;db5O0Qqf>F);N>|kJEC_{jtkZEXt!Atb+-m2QO zCcrthZ*3|H8s9GhEf|@IiWp_NLyaIIgQyOS@6Pi&T2Bmqe>4`z5{@|}2Tf>%&}~VX z=9o@PD|_ob>~1c#Ov))xn8wcyA`uK$24c+65}MvlK$CT7bVW>m&UY3!)KjTXj<>`o zdAhK~P4^;L_h^ha2FSm)&TR!Pk7PGJ(hecEp(pMY&-Uh zR2iaQe>pDFuL)GZ5<02XSNPS08W!?2VP-WRs?XA-zVpn5ay(-Lu@v=1h3|23rEg=+ zy-j9lj!y1h9<|TaU9@E&Ft_gN2{pJnyw>hIpuLw)awiFCx2UoW*336>POQGt*AwS; z=i=nTph7;S5%i{exZ-Bar1I~?h)TzY$>HJU*7JpL!~KEU8eb@Myd*l2cH%KB&mP;- zEg3#Y0F$Yikfnj92B$@HIB%qylv;tV#-F2(~nmfM#GR#cc8Y8Bn60#M`u%yM}!h6*B8 z^3|->_8!mN&INZY;kmigu0i^2V0ihduQHw)L5)3X%MxQbD6K-)gtt%E5)bv^WK?|k z_)0ElTuYZY3W6R&szu}5VSG{|3VHx8O|>d53-Ce8Z1@F+w79 z<&gwDaf9(8j@ttsL58#;Iq_6UdXE)&DObl0e1GO z{(;)6vH6QBwlKtUY1UTJgcM6BjPIq#Dc{H=?1OR6?uvxY<~sQMQpYJTx9Dol-F4Y#254{x6HEdv-s3{|R{owxp` z+Uy$M^9Db3yda&tmU^#wus({WxQf9N*Yxr^4htqc*mU6&WnGbc4Se!W$*PaUL^esl zwf61rTwSWC6MK^7Rz^7e?t1ns^Xj9JsQFaPZg$I+LULd#BwAW2J5mf_%+UUZO^a^_ zKw%JyIQ>wTuQyy?YfU6eZIZo@>ZovJy8ZC1Gn+?T<;y&Fldgu%kUSckKqq~&kQHdb z6>OPvh*#pp<-iS=O^TK_z%$oBQBzhP<>$0rl+H^$4!g867pg#?`QE*6aJh(WA>Z=5 z$h2)^4Z#4H6ec(=ryJq?sil-h&z>O`Dfz-!uLuI<&5gd_i0U6&woQRw;Atv8h{-~* z8u~#KiO&@s`d*{}1fwRwfA$NO-(JgY++nlNVedDoU>aA&5a^r4x}qvpEv=#)QmSqB z{$qlB1zuEPDRsRh^C9zUg>>gEyDLyLC~hgf=(H*9cvxunT#C5xdN&J`w<(Ll`ZfTR zV_%r6KI62<``GZ)@U#kD!1F4fgpW`gdboPRnXv54t(#r+VO+L9QgYbS zYQ+C(`ku9{%Lhw|14<3hyKcXs^ov>aBSo_T4|^IRU%g>-+U5jI`oKsLq?amwh}1kB zP%gOOQLsux@*~rAwsG62!R`fltLAg=b2{c;csGs^ZWQ>SotERip&%R zgGD{|<9ZJ@sD}nAS!6OgD_i=|zCjNzEuJdcSgMXJ-#ivqWpBBZ>gHVFr&dky-Q63} z`vn5UcZ&SVj1tgn;tvzB1XbjpZSg`t)O(=b7ees76LXrYu8kUiu02}gLyi(6KHPFn zNJRt40D<>EuJ5cO|i2;I)wFArQOLw+MUOj8^32ZxNyRE ze(hdk`5x!XCuKVCFD5YRZg}|2R?K^miRTVSt!@f-ivS2vQOL2ns)3LL45Se#x>Hc$ zNV{%ezDOH8!NML|A;qlpHA=KE_W5WrDg5{~^duvw3 zcl{CWo@ajLp;pm$AR5J*CpJOKB(LxjZ#uOZC77$6RDdmwl40??hS2*dc4e#tB|SpJ`IDgfrog=$NDTpkf4d`|KvOELOV z8>ne^!n(?s;;CZ_!FFh0DRynnQ!+lTP`vHHxHb-KINdqfsP*ZqF5~&Ni~ACNp$|pm zJM_c+DJN zl$bJO7|?8uV~5RE3o5^Fee6d<)NAeuf zI({HQ1Wu;Ypts^5V}G zu37((3y~z^EYloY_ogaK{gmw?P@Dt9s!;fT_0u;Cb$A+Um13?fnI)@6*5tIb;4;3j zi-Y-lJTqH(Ivl1h=udUWk&jy#u0;})jfTibNT|Igj}LYEX&CHwSiQkfG}M{CwN~gJ z!4BT*GC3F{=BFnaTN(3G!VzRFV=)dy1yF#wK}EhUw^d(RYOa_-PQtJlN5`}5ULHRM z;JcaiJP98r1lQ97m#NI7)ixYE9pk5_lzF7B-5q0Vy;SyaljmR*cjJw7vr|gbN9Dy@ z1<5%Ai*Okdp|quR4K1!n3e#g=vJL#~d}34eZvpvxk~W$R!FQaxpNn^mj~8cp`cO#i zUMX*i7HX|lLV;_*)02(vsV?u?|TtsDb%NJ0nzz+|K6YTZ`> zWaX!RvzOi3=}2G&b>#M2X*H(hs{sA8qD*Ofmx*)i-=k9yDC(j{Ez_)CUQEo`@Shmp zJS~VH*cYxl7FwduG2@P}G>vE$BOcsWGQ6AFFOYiu#=g=K zKVz+KnEf7?U&iwbV$p=q2s*4OtgeY?fQv|oz9iXot_#S}|rwU?b8 zuD>-?Xu;E{2k6|>y<~rR>&Ja`b_cmOVYGXWSsPjsqFUnarq^Bh*=EHbvvkg3?UygA z`PNjs6W>j_Vt+kwNf0eHVQAf0L=F>1lPCXJNPPH4VDJ0%*KEt2tpei`Tdf9L*fZ z+VmjkWp;Vw?qAAqRA@n>d!CKEC2xcwmG=$DCP=+&7aJ;}tK3zg2s5TXU}_&Z=2jIX z@>By6Xl+us>^V2+jYHCUNkref}lXblyLYE z?NaNorzh9l#o4_%9u6Ci5-!_Y{SL|eu2$KZ%Hi$Xo_(ZxP@LDpd;G6u7VOpw!8;Cu zNHC=AMemf9u;EJ6t4mB%xxFW@_TAw0LLk?-y66cyEbvI_@om7Ox9-f4vbH&b#YcQ8 z=3VXu4`@6|?kZ8rX0TLg^l~WauM0q_1^b1S8XOj&d*9jL(m0tClxy&@fJ(0l2pb|4 zZT8kT(XS!0k@6U_eGQ8&^XQP$zLb$nP5oHO&{q9k_p|YY5D{Jkpfqx}CDmM>hj{|B z1{d9uL1KTd`T}%T(fROj-H%F`skQlHDg@vBp~821kl>hE9MUa+=AzHU0`qtT-0O7o zyq`$xop4WIZ&`NyZb*scP?&V{dA*VG*)o;YuY2eRM0VKTLp2+Id;Xb%Z_(dljC~JbG`7dOULCB=e5(N zCB5)Op?1G~#ivHxiZ{%MKKr#9!|FYK?9F^d+w4h5u-p=G`X%20$7CZ$Hs7>Hyi%?b z`9c&=*Go^{F$8@gR`BA&AMpN(pjqR_4d|P_mA=d_F zV2dFe-d)>#XWr3DQ^2N_g0MGPIM6r{nSNM2A~H{6%Jb)oFH4ETwf&s6uo$419T~}3 zyF|$ZOv&hn9PIH!r@Jpemzy;5+c*DQzDkA~dt5kt@{i)@60y^@f?%$)B9a^;4-d{` zURR^>8-_-swBO8&@)MwUg_Z^(@r07p;?!85EJ8x=OTK&urqyH4eM+&=Z?p;~k}mxa zC9T;M7%7G_Fw7lZqeq_Fb3e#!fQ}S2K!-R<-6T-e(qVSIv&`ZwS+^h_hh?~JN^<(R`-j;-HR^ z8rL8&UbEQ~KQg?6ngzZF2E7<3veOu zz0GG|+plJ2e3<(~1tjRXDZ`k)C!%U@y`4-UgMMDgQQzvHE=#<^X60>LPB9#7*aqKe zh)YVWs{tJ^9YM$9+8dKo0i7iG_xC+NmONPyG=JQo2?z;wxbw@IjxbXPqR#|DE;8<3 zuAjSy(|yHOzT%o#x6eN04bIIjk*U+z6JX+sF*JUWGkf{;@;t5oYd!aLfUoKF#+n%= zfU>N4QUd62__6VQ^ZDI#$69I7yS>LLg<2=?z8XcrXwzT|t~<#W-&c(v2EKRk7T_K= zcCu&B^~gxTq805{ip&2B32|D z-s`=PjVmKBHC~tfKrxoLL26nqd(z?~q^wS`cLKJpFNnM@NI4q!^Hx}p!VURkPB7I~ z6+`Qbr}zP9NlCxuT%+J}Gw*q6Af0=#i1?<-BA2}Z9WMm9C@Dc&B8Jw=f-pGp?)_Y) zpx*W;x?7@rRZ*4onras0phRHH`Rh@JTe=S5{&jVCiO;8g&PIBHJ?{H=VZ=6dxO`fb zpYzH}N*&=FXcE1_^Gd(;O2VnL{YlzB$}oS*zm?}SeLOiDS@Igce|9(>8MEayO;Y%fCi`@ZNTa0@1quOcY3lbh3Occo6t_=6pVZu3$(^yco9=jqL4);nxgKf# zcha0%JlXutKa&Gcd6JWl4K)+e-G>H0$>d(qgut4OfBF!znBo*>W6@WGN#GzyxSlL; zIVc{@&)%6hs~}oM_ERYxGK!L@;j=k=JZf@OC>5d?%E;B5AyhV}G3SkXu~`%r;0|eE zJcdlExxGbg;A}aT>GsU@52=M_TZ(dBQA-Ep?G&r5;I?#_bvISLJ6-wM&lB+%{#r_; z?;XCy?~_|2eZ+;2jd?nL%bJ3`Za*Jci;EoW6K&6(j^j6B;jFR2M0Mh5d8YDUdVCAN zj*y)o+gH=HH+0x|=164$B-uYaF5t@JzSqs#WMt8i8%;V%41d1$Ky`+gwdP{gI%-Kw(!wFEnJ zQf;p1IW+!Dqm~kwJCk=ktEMQM_oPUKjBI*#7LFzY3Qs*Sg})>=h)z8Y#P{QYr7C+A zIvYDSmvuvQ(=+uT74Mb1Hrw^+%|W0rY+D&aWCnLawL7=|wJME>CV+t&O;HS}3p3{s z;4Bk$VMD3F^Hu!w=Ju|+6~DSFj~V^UwQr5roXfe6Jhzs(uINT1WBD!yO?h^^_$H0~ zR6fmDecf8q3=<>GAC*e(FL06}WYg0#8$67ei9gi8ta&h&*B3+ckA?q-1^8Je;=veB zy-6t#cZ~BiF+?8kLQ_&)(Aqo}bJ9eF&GB+kF8lI?rTo6hT1|Uf-3|~3I^ccv+Vxc1 z8kf#X*Zaa@XZ*CKDIORS>l@rgXc$D&5=HF2TiTkK(dX9Ti!G7AH|&0Y7k*xf!q93rPO%C@*T^^OM{E<@=7* zzGfe~KW$(3ek}A$z6u;b|7u0MP0c!J)1<*mmnO!>)nFUXEp%1EO*jFsZJG52+*I51 z?UZINr`VI<={?8i1d2oCR!J?7#{1(fB9tYm#>TioQ}B4rB~tV-!ya5Qe~dT)wl|Ix ze*sNUGLY#_Mz&DSSK-QglbR;$q@16H-;mbFpAUuJ>Q?$?2%)j8rDG|$u9=gZsq($! zO5md+MH;s|<9Od$pYd|sh}tx2L6O3HiN0}e@sf@l+?Ha`J|g?-{k_if{p#JKIrV$k zpsda_&v}^=5uq=3MCFIMKUg=$4ctqOe1Wc?4SUCy_}g_2?b^D!>%dLDkr~89GL}YR z+*&2NX?b}wp{4m&+bj>wQrSQHR~U-|Yo&X{C{>KyhrjR3vRp&@#t&f*^eR`TKkjKb zBN4T&3G+8v@3(S&#jbJLKO#ev?bm}C%Y_-mN`a1IN5LN0g`vb4Jt=vID>+h*B7u(_ z{2bgR)9M9cR<-TOQ^B5pQo)0~wayTUy3>t^+|q^EtB+Qc?#TH1a@%oPu>|Rm>OhLQ zdEOd!l$v^;PZ&hrcgk8`IzI?E_b?T9wlEd5>CMu`1E3%1losnpyU_&1)zxv@+S>A` z_DR_gYG*j24Um*4CtcnZ1AIUZJ5fZz@bi(L)4k}Ky{(FJg$E~sWPk1E8$(!gzp4K!io-(G zwi(j8c@^JyJ+64XFUJ1y2FdYx*AY(65r`Zf9$x={@bs2padg4fXhLvzcXto&?(Po3 zU4uh#cMa|k+}+)sKyV-2U1sjQ=bZ2UoOzy^?yjy~yK2>{wcq8bQz%np(W4;2gU~Dx z2q4#UKsu2vf5&6-0xcMhnQ9DY0zP$Emk#{TeGJjEevI!-P3hK~eC>Ok(K?>KHJ+6G zaO{1x)cdu*<@~EFMiTVKgyVnq?zhXZa}+JFJOVN6{~VFY=|YZua~61YcvmGne&(>V zr%xgXP~@eq!Gi5D41y`;RJ)P_sM@7kK3@&pq)WjDIc!Lfqk->hSG#E%%YmMf=7w;L zEPDo-H;|4v0RuS#E=)}P>2+EX&uyVkhBDY;g92TZB2KGURiSzDfA4jB_GV-!hu40q z)1xb+E{iXXptE!Bfqi)vZ$^B>zeLaIIK{XQwx;h_8o&;z0#L|@(+7x z6wH_QXT$o%i;Veok z4nhq`XcJr+v~r?+7Ti=9boehoI)NSGZ+fx9!Xq-`%eP?;AU=V0yxp+9Uwn z?Z2Zl>sr6sn=%Hn=YI+PJM=zi$$fu_aA^R%fBwd5Icfh_5NOKm|Kc($a0I#iT!_Na z(;(3IVww>U+$n4{eQ&2u$nPla!j>WNXfE{eTIagywG-tJ5a+%R0zES+y#h!o;2v)W zmy{Pb*QYKhlr8-f(Y~A;y|b_|+myMS85}FYt7~Y;wR#AG`~rkVFi`f#e`AQkCXY~+ zY;fPzmFLk2Si;i~@=^2wELenR_FMG-IPgUdSt;HqH?*Z$<@<%VHqWq?=ZRTtmbF+g zZAqNy^x|rM&kaGTu(-WXXmEEU(JV^XFM2WBP@b;0nuzM#{6Qum1kbbVf9_3u>dtp< zk3!WvxX0R{6RX3>W&Z79Gr%>FcaPiPmV43q$eI-&Y~X$m!~aGK4L!F;z%%i2u)`pG zK7Rhwlat-DY)AIhVeoo^M-`i2U6nR8+#`$Q5IPn@dMj`cl3SL?JkGD_Hz^Gb)e3%knM`!u1??+ zvuZs{_upnG#x0GAue(R{x3n+QJdYvMU9T*R2CL$}8zGy(U4~`M0jDd!L;|N*xZF8l zo)d6Sw~RBrspOy8)kBI*TiyO&V_>q277XZP)br)R6EsXUmcHN0xCh|gQBYhyIC|y2 zec=}#^C01k*$8})1U}>=5xSdD$UDB{MdWyXH~yIaBk=Id@8!OyMZe5-^#NGgd`qco zI-C%8Jz`R3ud0kb*m)1M_XBc&yj*2u3fjRF82N`|dvfimz9}HS6Z3x6p@noqqyqNi zkhMCX@K&V6j7t_T5JmS5%t@>9Sd@URydNjUARVGXKLVbRZ+}|1Q!J_awFyX`Fn@X| z1jq0pqlnaGaCoOrV_)d=&oRUZ47%AMSQp@l7uT{Igb#ff`pXYmv~5&kVbb5Yt5e{= z^{WIvko^r+I;#Fx=K|Lc(PLoFd+pc@um@x=#m4yduH13w8>6sZZdx8I;isFPh9e{%)t4hP z`T6hZq?M4!rrEXm=~W86=Di8?0A!_<=>J?A-+<8_)X*UVteklOyuCIORv`=FjBsZhR9)|Mup&aoN%xOG z32^be=j6x0eaEv(d1KFwZ{*~;F}mF?$q9Dp>7ghFl*Ddz;Iw%13E34vkh zPJ!9?vwZpYLe5Ybxq>NYmDHB;_ZZeww&-5j`l9@pihPN>OSWHNSCvaR2`&FEQiYBY zDWwRfMUA)XE^|??wg3Fy270h7Apo#C*b}9UYV2BkXHMoFn-%{;pv_2=l{pk^7Pz(E zpr{d+VTxXe_>N8yr4|1d2raym;z0a!jQ786W5C4Aj-v=#hj-5t^yyQF8nBz7=B0OF zGgEJns{`g*rflBDbis5RaQ&n<{@hOJIQ88*7^EQZI-CG~t$!FWZd$b2uaF(#|5t$w z&*=55%wx;W@Ax3U_%!yJm3ezGpTsvS!SJ0*$oUk{{(MbrT{fjb?)A`v`!3sV4sc9j zFjvMLq`|B^mSGZ~GIEOqh;`Z2cDaOpy9xc$|d*#AW|{rTy4v+|IT zwCNjQSLVPPgtQ%DbN{~yj;YfRNPnQwaX5kF?kIuNVJwG~6`=2JrS5L!CVV53S6hP& zJ0?j1JWfY9@IHNXg0}qOw?k968;bx;ke=lYOF_oPU9jW3aqhiu8uH&;>B_3A15x1^ zzQZK*Z@K5FRi)Jh+!=1_p_A!pj9&Z@?#B`K#!fs+PKiI@u*x6WET%CXv9n=hF$3;6 z9{YOsis%~L)jk`_Y9{r^k2VBPnMC}cG-LZ>OY{9^-@ol<*hzn_d1en`r#m*aW{Y~BK zeg!3W?%Ha)NW*hcV~I!L)}9sj3D+Mdx2+uI|I#ge+=b1}YJGkE-@JBOpepeagd=c9 ztE#IzA&&CM9k}yK{I0o7)V32(#3@D`^)jWoG!-Qbh)zIDNv^U@w{4Afj48krv=rw?FS38()0zPcW%&PETgbTYIu{0ZZk*e0$mv_*)WRJ77*)%I zMe+*#oIH}CKmQY}Yu*5N%4xUyonqfYp`s2#pp&mFib@_%celj%#0_d>0(XlpBJ{Gs zR*@qu4udZ4(YUJjX{LH-UG}nl0#n)*a9QvAice24hOvswM<~tH^WdGlFTvR7_S5;iz6yYW7YF=nEq#w>?m6sf7;13!SXHHQnmoA-dI`1r5vhnfpv9_~20P`kx z9Df7yeBh{0EVab~O%rZPJ-bvj z@cvDmLY6YI+ewTc*Pnk*5G4T{F%$|m!YwuUT5DTgdD2!^fM45#yzk&9!+i_5`1`g^ z01s}H%3dWw6EU*545g3}OmpV7;NHmAzm0r_6myD?(bOh{aOtGDHk^qg_s)et3xG3bW1P(`#Lo)8W8;# zzQ$u)bW!iH$`hV!{ud&o$*jtekBeTqB+urx&e1l<;GD_Y^TfZ9L7DX{XUp&@lLqe8 z69Q&AhIwK&nYXt$nP+#3K^JsMI7)aV9kIT`cH_NAg0rm43A+yNiyf0S0$lqYc#><6 z=ZL>+YI61)$EW3aMNLg9d3nT(r<}Ft@ozx;4Ql+j)t=evy`7ey*gH{aX^m~{{A|qsTKPR-*lBfcb*}XUr!s8c zqhibnI^?;n=@W&<|1TJ);2?Z&Wq3X%z{^?3YyBSyy`lx$_=7LN9KyMKDSxYUiz9+A z>EZ=H4HJzxG0BM&hbfaatCQ0}o@GJy*poo!8g)5@Qp`L6Y3PHxP?(4v8V^1EI1|DN zX{>d?I}+G+Lov}q_gh8~BBc&O87M7~9s_K<7p=)|U}oN|VB&K~{oP^As#q6qEZNY> zoFwv111;*;2qt~&j49Cvkc<9v_G@XG zm~9P~giin)AAi@UcToC>3r)^&=9yeyMt-U_7LP!%Dw;ojxUQe2G{L;}*Rs}%fg5Uc zbI1$ZRNK19hii#8S-Ml(9kI&t2w8Px^8tjpCYM|E5+c*l<+1|gzq1s9Ls79v*j^!F zyYX$g{9kby$y-KQq%pCgWg5L3ke)15`I*}40AMha8o?o?&=R0h?+6ICP9cLZ^u!<8nS&XhI zh!0}PP5-#I(5l^~58|uW~Z=fZ{-(z4z-Svj=JMtyL8>2>#**8~fcKjD< zA${8%c3?|CDK~IlT-=qSQWBYUM!(Zb4G7CQjrK0Ly?D>ue_+ zrzW$v(8TKRD>Z9+?273LhlVg-r1GdkSMs zQ4wR5mSg?K;OmwXC4?>Og`+!bCYeeQ26-6yDwcA=T?_KZbz{UG=OS1~p`dE4u!>vU zK@pwcoGS;f^4e zWY|CRd15;0`KDBmy>n3YZrRoV`a3u>a9H)qi%_#|D?vMi7d(_O0sDtEFqXoS^+NQa zpX4aWvrnoxNiF$meRL29$N57RzF`DZMM;ULhNsiL)j`4+s{o*>Uf9UGyt)5ssx-ac>k>8J!_|kf;;7p7Bh`< zPW)Y&)EQ%ymp``|f>PYg8B}i%8fOaABIYXeGwu0arMpD`@;@_erqI5`NWKix7x^qs~-oILFg_2u^`;Xu=65Va=wkN}xbl-|rrgM3N z5N7>hCd?Nzj2zQY^;Bex?K zc5<~gjiKBla?oA|bX(SaQ}d^VQq%G7qW%@TD1q7=iJYS~w-ogGuf7D?cCBH z8cENDnJh&I1!qD0su*Y3J+c!eacxf)BUszXWFEW-rVYM76-*T7y3O{NVz!F@-faJ> zrQt;d=v|hGH`s$E1cDcXkJEn^9m$r2w`rW*ELNf|2zjqX;)PEcjRKz7T1z=;^4$sbv-MBp z^>bVX{-uTrICfkK1cXD2uQei~`b1&;O>-GFjPcVojy9P#nNn&gIC;x)j~S#_^l6UO+KYR}tLQN;=y z8cLwVitAkrX)1)icY4-gcf9&RID=z-^dh!ZzCW`CTT~U4-Y*Mpcc=CK1gEZVR8$ef zuBZ(vu+kO{r4kGoU@m>5*(V0!&zGcBsv+yTjPg9c%$0LB*u4e^JA^50rXk5C_kKit zTZVtlHcayAwbW?Lg_Xl2$;1f2Hq`Q_+|e@VEb7?8qR#ZhRK`GuuS7NxwNJ>Cw)mO6 zKk$wChKg2=3Tuip;4o-Zh0DTAuRF%r`r23@4|_Pn2Qx zzhe`>&ZQ_^jXU4bjj3p1iozy*pGt3RXbMS;R?#<9v~fvQFy@vwGL+M{B2lMa`BfSz zWxu}B+TeZ!T{f2^B~bLKu~2{%z5_J`3PLOU3^Pq&SGjm);_E5!=`i0bLK5gJLts%m zo8oE97DpkLFC{t>W@$Ff@L>0qBa+AYIbY5ZTT@}O^cQoAk9|4)(Zxg&_ozS6_}t9F zE?P&7!%2#1L(fNNX;b`%Lwe;M>s)th6z>uPuDYR|UB-|)OWjdq$ARw48TNV{GCR<)_yyLNARcWgPB#r6&H*>SGA;zCdUPyVKZC%4V zyMVIIu7P@-BC>p;0<3hzg{9WtrFAuj?Hsd`)(M&nT%^tWZGD|_z1y4sV`t)}GOj|w zxxVr+$*J(82a5xPmstcak5jcyOCk}QDTt(Si5* zuPlATHe-YX$=b$+(i+Y;)4#{v!!?Xajx>*|jhZ6I^6d{Y#Ziu;Xz~ke-W1Lls!)GB z*xUXae350=EG-pyT>CM6h$is(fgUelPCX~|iaHT~N+?j8H?0ze!P0(L6vrN zByjtJp^=`^WICi5&j&P*o|;Ttob#X8OFX+Qtzf^t{NLX1#zlHNqNtU|XZ^~7-hicATVkT4-H+H6f&(`;P zE3M&N4(0Wn^}=SkDygKMZg8WyduU=pRS&sy0ABj;Jt<7JeNcF#Rr=HEMo3{8TxZCm1ubEJ*yJ7o`-DX{{yK)1 z|65#`;okv~DG9zp`tYy+<~=8+=8C(2H%cNnY4E-c!?Ce(Drec6sTZL$>yz3aW* zEe31&Fw6-(Qr;WujGNvcvw3gg3Y0GBkqHEDM;15n`1{*mDN#^Rxi@<@xc@^3S0O~X zh7w|`?0*=s(!LY=j1yKeRMN7rSSe^S{h+7E1Arko@#l@-yG7L~7u$WosWmskuSEzt zN{Ffar3$Es8GbNhhr7X1oB;u+)_m490yQoI?H}f%+XQW(l3`_eHjeQdiAPHuq4&7` z+1Lt(QfLKTo$1v;6R-6wWAwg@PbVL21e8q7*`&*Kt}hRaLbl>iCcIW}Yh>w^_F}fG zyXPZBaM3>G3fT9J`-sWx?ePY2Du~ln+G|G#P4%VuZ;Q;%#+Fr9S;NgK4{<>EoRYV= z5z~B;op1OOJhAB59*;;m?e_LIWLg^WuAE>1!^oCk)a}I-<_E=m-mrRzFnN%TkJDP! zI8G?W>$R-_ei6Hks$-Xi6d4{GDV2PBOQVfH0$L%SI$CK@Pegf!`{E^iWsD$waddKp z+HH9()>QKwegJ$jvEb9>`yWDXkos%HT^Hb}_%E<(-8sg|lxa06H;wa@c; zkX_#riswC*(CTjgA{~0__LkVH$b)aO7#gKuQz=bkEnb!~Vwa8v_nI`+oI;g*DgMn3 zg*WxB!C@2BpJM*D2!4&E_$WWX`R0}g>WzBPue0;>;`a7XBm%vg)KL$@R!4glk30Toe7D)>WtV?}8>uWielWvL%dKS}>&hL~MrLlkhY$DO@ zn(5-h7MIR6TEx8E8($Ui5D#hg##E@vtV~UT^oNsZ;-8iEBS{ffSX`GfJpNP@4MA!< z14ypT?;gHovN;HxYt(!C1_a87Ie9W)E02r(Rug-4!LaC{<0(IO@R3xLJKC-c9z*Q*?0& zuAOxx_WwY$Bz6_}{`lx+w=v#svv|sN;}@a2j&Fd%fJuS&d|A0jtfa+eGZ++0M=*7e zAUrxm@OM|2EQ?y%VyjY9A(u5MIvV{$W>Q7mo_ck#zHK)U$3w_s5oDy4s}?~qkWSXU z2up9ST8Gv8qp5{mu4t{Sm0on}7_tU0VU%q|B2`fUGGexx!VE4{gVQ#~Ynd98p}bKm z<>&WoKE6N9KO?PUCR$u3ku#OpDHrq>G>iwk<^(ds*IEBGQ&Li}G7p?7I%r^uYKF~h zDCdf5S|m42Or)kseGID724>Cvv=7Y3s~a<6wU0p7qxd4jR4*>e4DQeAG`PdD2tA|c z*3^7F&Y`$HxX`#Pqebi%Cgt@ve&D;2dL0EK&{Yx4MU4@E?O*HU3%EZQt~a&gPx3lOOK$hlxmho!lKiA8nOH4SSZU{6_^hGlQi602?eO2Pz&pUrh;E>(OH<>Sx zt6gruh81zf)eXRh)rT}cHde|Vv*?W?uyiY=3bj6#L`srVVg%R`B*{DBjAF6jN~LTX z2n!pOot|BooVWh8wX4EgQc1uD*OlBHHiPbBss#Er|EcwM9>;mb%Zq#P#%GMk%AcK& zp(cz(Nfd=1pfSSLIMfXPa6!L)apZX_pwGu_cGw;d%=5}SU7}WBRf&0$=*=o44Yf#f z8{g!S$LXDJALT1kvWBJJc=>a!MH^mEu8_?cL_-W>NhwpNF_TQxLye|_l`gI}Y)N*Q zsX9GRA@o>>6S#XB+I)NtWbLhtO^ys9O0wP~R{?{?iKb#?1XJj+2%(du>w2l$>FOHl zgM-@G^F5_mUgWacx@ce#p@J%HbzLJlTJz!-YVc533{Hd37PQ*sjF((eq;wQD`G*q_ zK_i2jmW4@*j0`;}QMeu_8J_{u@-h0TT7NYbHA}(psSPU9tGx+1)2b*m|Y({%{q%(nB)%&82Te2CxT3X)sU*>z=f%`? z^`Kx=VKC0+zbfkbqt}R>RvR~HAFAnmx+@bY*x<#^JN@*W-|7crloP_Wx~ZEX(%@<% z*FJAy=g@!Lx1=X~M*10qs=WhpX1)CFx1O$H`0@HA-0){fN`Ampnq;*5H-}4VME?*q z;v&Ly#mI5`Or%%r-M(4LUzt_YrBUo6tTdTMFI`C+8@kDv#qD*;qH02ZTa0BLsXf$D zDfp3Stf>ieLwY#|T6(3$>{;{}X*xMdogN>sK7Y&N+PsLQ1+N1U5hhj|YFsGlq{Y#? zC1mh^=FIvdK}D@oQDH4U-A9t|Egw}97-@4p&A(q24x_ey{3SvcXR#5mLx1@aW>7y~ z)X*GKN+k#1*Anuyf%t;=CHb!dQ?*f7(ga2}Ei>H{gP|ToX+OT`0M6X~$;E{PY|wY> zS`+f58{;K-ZQix?nV31Dp`K^q;UsB7F&<)?bJ;=BgP%vT0^su30_euVevnwq`y7k$ zVOIc|r)Iz17}mIGHi#x`r5!EN2w5n&&fi(V$U?ocG}4GwMO#-vnoe8X*iE>4eiRsk zgMom?}X*(#k)KU|p!l+ z3PY5u-!SBY9!2@*N=XG7UZ=s2O7bX8!5UxMN+0G{f^ES%^Ly2*s;;IeJK8r$wc~ep zlkk6tzIg*~dxyX3%11?QU}}bR^hlefYn9p=N`%{xqZmG{`)a=ama+-cLMz$f3bQa(82A4@hwGQH*cSI#ozRu zXQq=Rs!(GK1KA)I_$aJqS`|@!n2&&8){B3H2%$zKT>_a4A0$iQTX{C$z7C-U;$Lpy zm7ZM6f`!ZR`FuJ>UM}sL)drfa5wtsW#4zGU@%T;Q)38Q>9Y@rh`j8_(*mV}g7@`&z zoq7s_qj;glY7LOocC)(!vJYu966b$8&3#NG;snKM;VU!PPupWlKhbu)Ixn`7zi!Or*HxH-c)XHJ-K+-jatk4yU_>YzcQTZa;D_NUbp7urc2?*+;P0Bhyr=lCq~7`sgA$?6>vj zOiJt1!V)J8O87qx^W^!OH4PJ6F0L>uLeIjt<*7RzZ1~WtP-6tZ&ZL|1cQ`r}La3zq za~3;R#0)a2*fwdH5WTJ!`Rq0vpv>j+zX&#upR8il5LOI*feaO>XTno$K%{^dH>VSk z=6|nnVV_+oyrMV{p~+&$T`!sZb886MtWPDGXudceB(G1$V*`j+KTbyny15U`MN1$MB+7i%gTYd3 zP+81(p}c$2JXWmveQ&jPKQ0RT_R7!3%Fz+-{d!%6yiF_9fH)fO;n+j=^d&5~iuH~t zHXX7zVLoUJkF{jQiRc4wjJ?mXm&*n?|5lZTEKnYFVZ5(QC(#&5hh$N$(;7dXsfS!a zhj%{u>*@0LEt#HRjDs**mmoWH}zLsi73<`f*V$^vl>+ZBa&ao&kPw zaVHWlKF|OLyr>_~IsSH|b-g&YqZ9Pt6Y_9wc=NYgYu2J>gu}kNpGM||pR769X1nCT zrtZ@7)zaX>Gj%f<6zI%pF`BA=sbimO%qzEoB~5E;n7IQ2FZ&=EEEBnS0>olP5EJu< z>Vs$3Fxo==|R48?!(vV54sJn~Q<>tE?Z8gL~0=Icd{cbjLnJA3^S?ZLVjcU*N!p7nrHsMjYa>y1NJyb`5aIYw!ezN@J1pPlb;W zv-TLAo2Z!luu8S`kK3Q|T}P`!2D&1Wbi;$7F3ai-$9~3zCVx*B8>Ku0`69S^T@{BHVx@qNJj(&Hk0|~?TY0cRKLe<_^ zLnUDOd`U4wykHw`PCPz8ZBTsF0?sOlf{WIy5u5S1VbQVyBwneWpbNK;{d3|B|I-8& zjY9x5)J`!Sjd6eOD&d@G?~~y=JN9m@HIAGE3HUS((#vlxMgO(@XPqUpnQ=EK{|P6} zIirql|2HZT{we=q!J%_NeU~(avcD<}Vo0OO9X}dV!n>N>eCmSH>8Tx3ZefsMh)i|< z#~a}~HFtebFa&TtT=w<0y#>!hc**T~GwZm_c3cP`=c-IkLeR^_PJ zK&emJ<0oVdghFT68TrBqf2@crcx}+-1P)8EJLtDxu7b=`iU-`_RybXUGPXw(`T_)v zdmj5#2=_>y1!r1sR@;H=o_GDeP6yp?@%uXiJ^E zETWqsOzFeCP4+2gX;b{cniS93B8kgUjqtHQVEX7!#?`kElC16O!vk)Ei4hMQpfkwM z;4Ny3cGBG~aLV1W??~Avt-_c)@r{wc<7lkQ=?5d#u5Phvf_cIAw6V2 zSvD}GrY;=OaLKg!TBlvui5O_vy1zY^e{}B@h|^T2aG1r?o4vv!G*>pF&wKQ-#3R_7 z-1kxSd*}18shP^m+c)aa_YU9J{gwIsp)S+!cx2OU zi_Y&etIlQhKp$d{+tr17_^EWs^Y8<=eEdHa4IbeZ!?X|X2iT$)8y769K(Jee4OJl7 zy{w?5i|L{f#N%VS<=t3EB ziOU`Y`8_=R6L@LT*KM%nKv;de9Y8=nh|>32tG7lYd3|YHYh@cLZ1~1Ajkfu5-^cz` ztgWh+T;R6h6L7cD7eW+K0SUv1C&~kVi4Chp<}46b4y8uN$LHfL&}XGm*_NQVm8%f= zjz-80C**x@#@Fc5IjIB~PO)t8b|cVQ|3-J4gQ&096{#J2#DPOJEguM^n9{B;_p{(9 z={@lh`i!9ozS|f*-T83{WdcLueZAWL+B$a!=yEhy@JKzc>&WZMTl3h1NmNQ;RI>)t zaC|w!khgZnjjvk3B=1Ii@DxU9A#^RwMtIWNucVSp6f1r4e}4>lYst8J^P~EDg)V-> z+#fI~9lL1ac!o(9^yD2r;TL8VEf$?($)aBXcR3MIyG~Afq&Xhxh}H4 z@jOOC=P6r=dasShGTN{?-hIsxbb+2dUTr^Zu!_Q*EB00-*zzZ%WhtY?lafP0KdSBm z{G4^P+mp}e%TV@vQDAL9o;DCm!kydl6$WMPOaqjWm(I*dbIH;kRjkbld1Svn z{-AMw3d3;W=eoHx?u~9Ow%p#?{`D6%L9{Y=iUmZr^Li(_dAs2YR$}C){^*yu2gf`8 z>_Wow9P#g|sHtk`U<8KIZu|)Rb+7nUFH7tL*7kMR*|$fhAt#i3sW#orB$dq4M5i5g z1%eg+8`5WvTb!uf8r=cy-oFZRVLGq#ecsPa%1CY&Gp&D-BN02z{~)?C3#1iKcJkgh z7#Ec)ic8&>`a14aKIe{Fv{^>sP@U>FC8sf6+8cbZ?{uGI;Ui~7Z*<1V_^0j{RTx*R zivP4DK|(@OaHMoy(N-XvJy7FOnj>z``u~ z6#!h~7Uh8`b?RQUqeRCm{RU=Fh4;YB-6yiI&YBc_vj88-`n_E-7R=jPrBwjTK94T( zoqS(sL6oLnOH~8*qXpEN)nN6aZW^^C5g_HM97a3Hbli`At(ywKd0m1ZM6vx`>jGGD2J5MLKq^iH5y1b!J6PMOAU+w!Sk>5QA zj>`>O_FA_Yn*8eH;_W7e-)EQXbS1y|YIvI8+iyU}DZeM{yZ-e-x^b-4P?-|& z)*ivg7$qOHU$g16Rl50_jnTj~qU`h`n8}Oki=!9fAl|SA`ft-fIlCAEzV=zQYPO8Zg#; z(iuX`i@})95iA=xuR1vwJ_mLGA04!bw&MVb!{*|&>Gf(X9u(0N(k6$*qX#9H_Gd_v+ifRTV@M5+}FWpp>jH-|-QSol}H<3q;ynU1J6U$NjK z8Wb5iACHh8hFYL*6DjdA$h^M8G8v{Z>a5C4^0(GLZe6?obD(vLp& zwer!v78t_WfI$=a=KG~N!l>3_9JMDP=JDXmD{EnXUbwG( zYw02{@7SLRHcR;LNC)1;xw*NpWUVoGROoPwQ}{_Q8~?g@ISal%W1ZNj8+4=Z9+=LUt5+^iofL&7SXmH# zP98b2$CkEBPO(HKQIAPxma}HOSZ(Rd+I`mX_0ox)=2|{}g}o#<^B9kgqWvxM1Mowd zzYTAIs1^zq#d+ZhJM@`etYpEAk(?7thIKQ$QH4fx=k?%|@eU_$kJ)(Gia8K!A1(d! zs4nN{nBad|EF(n2JgF1KOX7uS#v(lYkad4@uU52_s7*8A^?Is5WSlpYZ!Lb&TKP4u ztL1JrP7;QX(7Ny0nEeWYoowLzV0Gset`9lvBOtU?R#>h)jAiXhV&XVa#8X&4DiGAM zS~Sq8C(gOg{rnVc6w=B%I9H#L>;^0}-o@(0;ko0p>hUB$bj3G|+>R8-%3AXV0(Tu? zA>l*&H=}rex>G@eSkHp{2J&5I``;S%V0K`Fu&TjF;?nwKWE!i(Y@h+HiqQtNB`AVD zTKOw??`KPiWl#BE_3Q#u+X6*Ffk!BUG7TZoOW~>(714nm@69&>Gc!YYx)d*k;o+?$ zgX1h|`WlfR%5_>mPkDsE8)Vh-6v8DXv??93b05!R8AgDg5F2G(Jy_9(C9QXWS>YpDLmZ zAg6&DW><;}v;InPsCCx?vY;!RDEn*5K@k|Y`eIF5lIuz=Bs`<9Tu}-JDln zBi%u@j4~R1BxhJ5^2=9L$gikLU!eP^-7EO4`h;iyoaGICp|sGYj0DzynReIK*7nrQ zb?fcv`@Dp?`tg3{-~Bn7ow=z!M2b;Iq0CBnu0Z?>MbvTfH{PHIHKvY#wt)seu!3AF zc&VYe4yIUArQp+;pM`^MlmOA|T0BQZK>#0$(f8-|E$J1+w3iN`%&pkvIg)a+13c_yZ7TT2LpRG z0Jz-4yL(n_HPkb2|Mu7#A`_ZMt6U~momV6J&7#Kx{O(v!P%}A#v^KBO5}e3$bPk=! zyTJ!va35Hm6~%zuGhLE8XqOY_MEOBh@#OtW$vn**LL(3^u)El8+pcK z@rAKT2EPR?MX?i(Bzmq9@cd{duUix$hLoi(#W;aUng6hu*gf}h+Aw^PM}mFOmt2I# zdRmA;!)&wi0FS~EVR&-v$H{F${x#q}^u=yXDXl2|g z3{`4Ph7u7a)FaXH;Otdbko$Ni8+HoiZkBarMckQ#Khu44D1`>CEr=0+FvY^}4kjP9 z^RO<4x$^`9w(2T=yf-}2n186e6nFkW{I~`;C&nS#o(SE}X%GSgKGLuIWk2QzVc)LI zZ!5t50`Gq+#F=~!`0C{|yW!_MgR575sai(M-_R1;yp-dl-`CIJ6MR#Rb<6En<9*pD zt*J8^$ILwnLrlFP2e4Ov!D~S(h-uYH&*I&&(mN#6o&ETPieo`fkC-SdqdD zkl}1JJJP+_?hV?Sp&SqcCiu-M7Xh`65T2HG+PcqQh3D%Srk%TXl4>yPNC38OMKE6r8=glFozUObS7<4H5JVb7bM5SC-nHQkG0k~S_G$#c$$3M^{ z8YU`75N1&JnLVmk_9E|<`-1$twy=6*C2nxuk-QpAcwM%4nN=SiiRGZ5&1I1vT?0s+>ec!e8%~y@&}t zJaHIgR;yXU+8$sh=;ryaB#x8Ba8jDu5+27nHmde`?)TYSX?k~RF|e3^Vh}ZcaJz+q zE+0HnbY*h!cNZ39%)ulZm+ISRc9|Es$&jc8sz5{cg%P-j`t)ZRn?l4w$1+l9(*0XA z`D@9X0sI6WI4J~juSc?>@&R_eZt2wBUMobMA#oI831edt90TV86!QX=WjqUHy&CK? zQm$||k1!f)_&eg_f}>)5^Q`US?O$wOHmg^K*inxjBkoKPv)&SnMWzGsx44go#0qA- zUMHwK#(n8-TE-$fCM=b~Nufo(%KNqhF`*}na(D1}g{H|Xz1GgSv}tbYm^H-Z@T?};1CxVzu4?ZDJ&#o?z&)yhK7#sQCB@H_8<2ZnK{S9-Ut%2 zw^*BMfqTS7xk(DJ@+Pzi1LM zSqhI6c-Rejczkxd^jKA|(P}?Tmd7O|JS@H3c-;r|^;dFeyDV;Yyezr`Arsg=ZmEM! zy1#x?3QZ3h{1h)DD%UofFQvHmUmnmN`zWC#v!)HUr9y9eYPzgosxzrRyftIhA%*%b zS%E)(!>Ovc@pX39WO@1j-eP3Ytkl#_a9S~xqP(^=%Wjdv&YI3?2Ih(>*$>P+g#oiI z{E#^!DX50<2x6benK`H9^1!!p;}o)CuRnOS>Xy@cS$5llslYs!QMOwU$=S18cLAyY z54#VuN8&T4{bK#{`KP^Po8#^4kB zMtghS*Lplj7-sbbaC#r8v~qspSIrts)EIZA={8xh3J6Sd_j&Vc8+l-{*l!O4gx-0D zUff7bz!INd%sVJN<84dfC8F5tW<|BefQ!#6B$&Tzb|jM<|19G#groWvWQ&N=$Y9Z2-(* zHPc~!$L=KCmT0&CkEXBSild8`h2ZY)65QPh?oMzYTml3LHZZ~6-QC?GSa5fj;O_47 z=DYXZ{sp~y_1U}5uG&?ofN{Igk0wJ3;ifLROb#|-NopTbjtFtx8k!=i;V`fd%TYu* z3K3^3E&#_qLX~v}!X4d0^yG2-ovj>Y8g?>j>khp!w{6WtregVoygA*hP}<_gjHk0P zWyWE1cb%JzlCO$h{;L;jaAgk0(&FiGMZ*f&t7$$lUDvp0Dz`fVMBA+z$+DsUr&U1% z5AT$V5%7B8#;9_^78x12*6maaTrA|`V=V{--7gAftf%MZT=r0#e029b2P177bX`^m zy)>pc?RcF&o-1a~*fxz{kwb#f*e~~_*1eZH&*Xpd{Ma1dmI(2DSh?hMT%phOd`N>h zTkQ;>*PyAhoUlMfRo+?Kd`4||Kc{5JwPW(k=5#yJWa-}dschuR;lAmH$J%*^so(M= zDs2ogfktKLnl{^H^W%Lyoj>6n4)tn9U!a#s)E=)GMkZV&tal-b(5^v8hUg+#IXOQ zlN|;R_3Nr8_*$Tn{_*__TcW7k)1e-Avx$q=!uRn=1(wLnG1!uGzjGx#3$^*eF(yw) zk>Q)QHluU8K?-x?n!>60XQ!2F_P(a10OE9gad?>bhfa>3WmQQ$Lknl~Y}@On$RGty zt?QWzjA~L~SzjN{ck6~o0W0+ue22^6jN?K4dZs>p_eA0JU%^Ink87AJwi-WE5_pL; z8R$b$Ne{-1-|(tC9|V%Knp1t+(IB=uq2Z=(@cSm~wIYNZ)hia!5t;_GCUaTPh7ybE z7xgmT!Q})M6~(W2ZR3N7MkRaPFONdxv2Ci(Y=EHS{@fAi($CCn*YkMU3eS-EF?7&K z>a6zYNR@iGzH-2+Q>psjdBks4Xv%rHSFS19}L;{tn2 z83O3ofK_(L()44hUVw;eFVBpOid{@|h zKA~^$pL9tH6G_2y_cEtIv8mV0*;{71Ew&LagV1AUMez;9Wl+&>Q*xdZFf*J+2Jmj@ zHB{=3_7Vv2iO*D}i8~!F!2gG_>NIi^;)X{@T_gN$Tk5w69^rfB#|aR9NPCn_phosPn3u)J((c%wa+T-W^gkqXOUzx-_vw^?Ez}-7 z;+`sT;X{7M+oO}BVe4{V6H^t)gc$O9<0VkkeMGl=FbM4+tgFLhWwd*pHs$h;u5=Tv zz9(-*!EZpaLnD`4p0s{C4PukC(@Cu8@ACa3k5iZ3h)MgX$;ZZUM&z9NOD`#V51nS> zXaQsXa)@L(eC-pyj}@3<`H5FH!57f;HAP+5i-4mRnsq@|3y{cb3F=IZf0Ow&wOr}? zR%T$(;VJum?Vm5rtEBN?`W`si1&jv4-39DXG6Yr`{=EPjFX~r3G8uI|mF}VSx|NsT z-QQndxNr7vZ9y#382C&qXjUNbr1dX2dLp?TPV9nHg;>Es>B3&#b{&tMmw|Az&M!9dZl`6Za>Dqn3M=^qM3ZD~7J$WJS7z#DL=x7t_y0AEz$fSo@ z{eet2tQQH5NX}m_2M@n{&Cp|D0Es1Dpi!cDcsHlKp9jY?ZEJZg`zNg%d{Ny|isV2w z96b{c_<_W}18c?+iEQc-*Ktq0as(AC>OTz2)F+l47kI9)UzCc@PleX2u0d^y*+I>R z6&e;~y+Yc4TEs1lF3mCJ-#D14C9UVkQSV8$#^Y#yyW|KkIi_c7dtuP(+C9&7-L_2? zVm|BMg2>*Ir_Vd~5Cd*x_D%x6?LH^b4Pr!n7O|_*6w*Nb%3F~p>{E$vy7(&BC1d6u z4^P2&%DjOuz6KK$vn22B%XAC~QAj6OmW!HI^j@xQ7})zrJmyAYDS)39fYgAhh<$l) z?R#~WQ2A*+$IE6n1-P1TiDUVLUpy}3AS$oIU*mnuS0GO9PdoiAj5=N2@*Vu$$5yOz zCa_e5dcawZ;K(5~blgC>cqj0tZv*i825?q&1c^Jm>3NuCY~*N_?MbuYZ97CPD0Z zPR0*J=+=8&r=HhzKCDtj|FJf_*7L&uH8XGxanA$oku|g+GnOt|f&%eEi^9=Xk`svT z#fY;cGb4)RA3>;2MP7vgluiwaBsWXt@*!-p4WH#nBH+Y`d{$sOhbN@EMpeQ6*AJP< z`fZD3z=T!?PtaQha^wVc6DNH zLEO~`RaviG%xLABhY-$6$_cZBykaAtjz7C!N4leyw}w;rI8WQh^{G6TP(~Crb4d7+ z_%vtjZ!qh>K{;*1-tr7b^XsG(K*ST6YE99@)U!Ktui~+hA*iR zd~ERrFm>lUC}EVhCFRs|z0Zd^QdgQ3TB{4kTtuz|cdKA#Mt{R2rL+Gex zv0Hm-{^2_j8-gcekU9kyM$ROG73lxkwzgmb!>e;|9~Y-N5Lnw`zh|&Xp(L&6(G=yW z&ID?bkg6~Qr+X24yWi~Kb@eN3zVW!Q7*5#mZVn$`wnB0`klG?|1fUQ@JBmeEPSGL; zF5i3;!=c?mS09N5GOipgjoj4azi=(=sm7`hUMXV`oi|sR72DSnDimO&Q^3k9EKjff*@T}}#szFcGJvA|V^Kp=pL+mbCMT$M`v@$Z z_j(V=iY@L4Z+J4&L2KY$@r~a}DS9pC`0-kA3Q?yavRJL|m38c=b1M=a1&N^>}b zMq0OR#E!~)!GX{uNXAF#8qzpAQ&y`fs$0#zDx_qIw|^aD+$=G?S&{;Sj}mx^s&XU} z=g6UYyqtegMDGkN-uSHTwKkl?Y(g_)6;3xU6av+C2g*Qd&@?~IkR-Z?SVxb-5uEv# zf^YV{B1`?=rqxyI*UaCXz-a^hAvQgxBiNcu+)76S2_(d3uMV3gwmnm{p3UyVo}3HFD--9fE<#-X zc}=?JjXBcW1|5#maAPEA+nEWjg~3GJ_??Q4Qyz}_G=!~m!33If3Vz4~`I@N$03K}v z{`OrLDX2f}7ARN+{~xhotr{^AjQlRSsshmxJqyshiX=5g;{}*uT%zy%J#uhDj51g8 z|AjVcq2s!yuFW!{iK7+}8{4|P`p*j!lYT)V#Kb$G*w$XjL8|^4sb}1b^R|i7C0gmmziMjawQBLx5~5T%7fA zW>oRLz;!i;&gqLM>rP9v$_aZRj+#By#!5hPw{p4|f2;wR|4aF6l}ca2(RwBi6bK=% zHLA1BhcpEmI!2 z-SQRY;6tmT_rvFt?vj>Vl3xU8eC*b>lVsO_S^-iQx&=K`ni)qfZiaw`^t&Q&4TBjlG1IgvL$E~u)YfeEHYw$2+I*H22q`bM! zNa2ZMEAGKR_8Cz(ZA$ptYdq|NBY%jWsTW1R*`BnL7xw7|ty5uE-baY37yS#>ErfB7VtmZYkRfvhx~lk0hv zAnQwn;|;Gl!aaYdTUU2e5BSiCYWhytUGoh&i5!mE_ZLIyLv9yY9vVANM}VYVq-MyK zO%@{VJuGdAoPJ0tpTYus{NDa+7@GQoB5{7Km$lwk;Q>logf_=~I%#_+`0uiq0Vm3h z&${WazckYBZc|qYJIEly0kj`)2ZB>WRN;2FIt1MSE2tqt9yd(h`}3vaR0l!hDtsF( zk*FG+!RU4eNE>1+fyXM}O8Z8rteBY1VsDgR*Orpb-!u9-Vrk%~zcAQXFYRQRMTNa< z8>1lJ;z9zBv3dxtm$&GwC|KxHf9FJXyC9t4nAzp)?8K)FfHU>#QZ|>{v%;uhW!k;l z|A)MKLMtGr+3<|y?kTFaMqO{N1m3?g@{0acMUp6xFvrt9HMT+dWX3U6uqCnZRWysr z=^w0m%0ILL29STb&nIVLY8KvNirrB{vu4eoW3!}@Q-?Y(0{ucO=>*3;{3Wm6wjm}o zvmU~gez+_USuHGLE?>=;4`QIPz5m+Gzy!51PxBo~Sg1-fRsSJTf-hH!4pu#U7A4F6I`A zmt=-;}RoraKa$jYmq;6u%=D%Sl$On)8 zC~$TXEhD8Y>qM#X$&>8YSp1ZevAlH?9+5EsWKo;>?}o2+Lq@;BiL-fy1;DElHt%^F z5q8bnHr2Nno5pgeof|(f?BE~wIp)_@MZ`3TnqAe!Y1jU~bRvET>Tfl4=W{(Gj}iUg z1M^NSP*4GUWM9alq_GZ3ggZNX)`P@9h))4y5SaUiNS%YwfIu*l*TmDM@^tp!EOo`6 z156DuB*~|s|8ib003%UC+uktuKg^5huw3O*{(~>6-nTpcWyHA1=9rfW{aC`sZ1MSf zSi@CAQSl7>#Fl=l`8%>v2)AjCLq$A7fYcMl_5As#mINeXhM}0sAM=ke(0xv&5o?Ly1`;vm_8R^R1 zY}Rra^^4zwo&a|K0JnvzKlPkNm(p85B?pQHdv$$07k|WjwdA-xTj#f+>DB`4$#c1b z?+92nMx@ny{9H25Ax62+Hw}^Y-tqRQ5_@pGeyCLO6y;Bdcg#xc8bBv#ZrIbFh(0;^ zZ}=!0jdZE|Lbu~{#6lkMcFe-U!c2yL66aJzJMHh;FvL%T z(5=OLDQi1^DP1%BNnLG7-6r#dAwxn9P!C|@oKO{j*9W08>wbO>_#Kw^w+T(ON5R|p zz~Rytu8jGX$W)X?64zdj>Alx%#uIMi`fmW*?Rv2iaH|AFL)?N-`n*vfCI&i#xwKW z@8_P0YuYTZeu<8`Kj$e8;%fA#?~^CI_|E(*sw5RgNvP}k|KD;%gLQbm4wBOxBDDY^ z^)tp_H(jujbFX>G~1C=|vM( z#ki-VqGo#?&GW7L-;#m{jo&U!Gu%<;f5b5;Uw+t3yW$7)^ui)(4J` zauROHlL`^i`@;b||icpjqy?8(`-jch`lNF_R ztP-XJ929Q^%|YLV`D7KLa)c(2wpC^;{L2i`IB@cC5PbZ@qqzNgptodD{U)J(a|ven zQ@%Ay(Vi6WML&_SqVMc5y*V`f?0Ou2^w=pI8s-dnjHa$5<|F?vuP{r{{pa(3%G})C zEn?vCv@N&ik8^=}t23h2p;?O(HZIrDf8Y#J0!A%1s|S0YO2e^5lJ>HPLZ;O2-$6*Y zet#F0GIU#xJ&TpHdMo)kkINQ49$u$zA|2~ougjQp*kTCgEY**XWjYUE!M-*Y1aJ?R zyWnA*uJ7v4S_J(TdqCeH%Dk8Qq{yoQ*jaA5(UY@frK;pGvX4k>tt4SPuMU>Pl0$q}$FJCH_wf;2Q}g%DxWupM>F4GZYfQJSB4LlkE#+ zp1=sX1qZOqH=d?OdpLw-{gJg-JX3JS?Du2Uxx1ur^o>5a5{+9%Nu_it#J8 zgEJu0&ZfZ!?ifZT8~bry76@DkYQl-itG}}ic7gpQcik{1(O^08zR!Dh+~yLVG=nw1 zeeK9UV-B`{TJv8Gnkc9DWu8{=)PG*9ZG6Un#@a>RwV8ZARXBxwXyBS)Rw-wQXQr)n zN8o*6m=O?|@9&gd3~nC8l5`5a>|HP!FLeBGb6Qe0`z>J7V zXiW?uC`SB3ns~J#`Jhhrt{rh2KhW*a&|Hn1eAw_;i&3i;k!irr$?;pw$>%t3k)?fi zSGDX1`>t8VC3lw4i25lk;tkDCU?iRe z_uC`PeDl^TuXY-tJMeXO$R6m;&n+fQFl1<*kIa-S*4t$^)8)o^TdG}qHO^XK>j3G0mg{PR4m$i$d8ntDx)(`(C* zl7;b7-rlEKd+z7O^G(yKjZXWOyDu%ETjdw8R~rk0Dy@jV5Hy#gEwPSU;73D_#oZRX z_v3}>(qzgN%Wgx?C)0mircG0?w&T0@!^P@YGG6xKMSJ(yos9-~KE>9u;l=2g?Q$~` z;c>dQAq_Haj~WO-6OvuDyfuPY`#Pi zV$4nOPthwp<(Z?yH|+Jl_g%UGT_?jYNmDHaY0-4YS|pDf4z8U4BlrLz$9V|7j&};( zP3wUf6#h09XH-lm^pnha1@={v1rG>vx%k%PafSB|4K_dv+9OJ>_aQX(_)b6CEBr>F~&4mcfqfCok(6vm6T3^>tu8=m*qrL@GBqd7!nWYU;Hdo4qk;>o}W z$IO1YF&zA!Mvh2s#aSp~;0~_hlqT%boAxyNKeWBo;BmT+Yi_r4z8Vvua)0pdd!%># z!FD(8HVfujlp{fY6kqsIbes0>^PdLX$ZFoj7wI_; z(ld^hqsL#4ozY9-n>+_~z&tou4naMZUMLsNP5AS3;+JK#^uw0x?q$45nq#->_jF{)slYc>V0d75o`oUQH_}bb=(|Z<1_A&STE%dR3elXt_eIIhi~A`6GT6 z#RPX-ZdaA)Piq9)kE~G0s3yUn;7x4))Y>PMCbw%J$!m3ZEWqtkYnd0;UgW#aIOtSA z4Kz?B^qj_eHBI*JXtdFhEmjqq&XCqzYL{T+f}-7F7rUasnO-HphgBcdW`>DxeQxpz zl@nanKp?a$yybnJzTHoeI(xYng@jNzMrU2yBL)p<-VOf5*u5Yxi`s!v98WJp_&GI= z!Wwg1AlZQT)rFhGP`2vwA9a&^t|hxXie_z`bz=NLDnDb^EcGluMj&+1l_Q4J!VYF= ze|q$A#VWq}mETpyiq5OD;-7FPUGa+N8vJfj#wgVo3ez>GY{mJkFZp~xCnPY%+cmiz zkZ_d4ksz7;8;Kezp~JV|w^AQdswXn96{S#!%c4@!6}YTBrgKk}0)aa*B_+Ofcy(o} zDP)t*0aoTs8n&nMf&`?I(;oLdel@0x7HW*->JY7aH&_N_>yd3RPFN;1s&8*?LjgZ> z9Jl`vRqwAOv6wtL#n5mjx-*4 z;A#su*Z6mAx2=1LM3R}=em3BV$gvdj}v z&71GgFDS*EC+hH958&mjZL%x7?;;!L=OgL2{`#*(PDaAf1%{lxa#?v zj1#5X^WdY7-plJ{MtEc$lZy|)Kf1IkVVLBXWU`4ji5l<>X-d{&WQEejk{B{j(YWfb_0S$I<|=jezgSCn#3l)W>6$Ljt*LlNjN0<(wJTqA8Y9ud>fs_sI6YpqSN7lkrcjvwXIgkO)Mfbp3KZz@BK(>wAvPs zU^%r7F3#H=mP=NP9vO>LN_xqdu|>EHP=a z8n<%FJuL12aW@T*Cj88lVYG~N%-+Re#qG(c6-Zvn~y~vL!5My614B5b*6ggB(wknus=t*uZ zRjOVnpSNAmUSAr(GadxXOvm#F6pqi2#g@Z}I&p3s~Tmlp3AT8`C$p2Gn9*`Gs(&olyCspu(pKfe3V zL|&6RBalWkusuuc5zfg+CKiMs#X#vq+*`D^>c zxR17k@>rh=1+{2XY%bh=cd(S<#DB+Cv1wL7eQwe zp;;hfb(epcM#(gQDZy%@p9bMS@$Jjq@$aAD6U1q^$aFB3qf)W&c~Vvav0vDBTRT__ z_Q|N^W-{)IoB(S%BFpCZK=&|vCpzuFn33?Z$N3M9*$x1m*F)(ne^T*TlSaksAVyPb<`x^EB`!dos==6jrEQ^8mex@5B5>ml~$#CQ_3;>+Ns>Y^FB!vlFM6) zb^|NrEsCpki`Ma=W}_{z#^=0Gg{!a*MtXot0_{-2BB7Gi@DNSn3EtV+MsOh~D9` zxv>!s*IvbKKC#_4$UJp_zKI-V04Pci-};(5zc|B@nW&dLB=Baa#6QC+(g`BU){rX)Im!Fs zZZp6g3E@VZ%!t$SD5A+6Ufy~@b@)9zrkJGP@y)E+0J{L-FY7Ofh)E6FKwNxXE`b|w zOf&e%AhY-=Ylv$CDSH!_~8t=F`sm> zOndLqasOp;^rd#rU0c=p_$KwnHFZi^T{TuZL**~fm2S!HUS(6AT>n5^G?JQKQW1!c zwK5(U9mBV$2I;YgP+Q^x=qbXkpU!O3`;7AhJijJOZ86!7*OkP6GReM*@JgXX`iJhw z1lx4AqBxLB)2QTGfzyemX_X^_W>YISuf_4PF;ud_mWwPqnGKVN-Z8#0mM)1Yj}~Vu zYm`%cE%jhYiB`3NXXJoZp>;v-!EJ zL4X`QtlVf@#nj>1?G*EV8lE8#gJlYXss4>WPMwEV zl|TZx>1=oQtwPs~<|p9Qn~#`5{5;H$G-^BQjku~{MLsknSkp9Whpvs-#S-~r0mmLn zpYbYdw$kJyxWKhP^uw2x?DL5kEUHf#2|ya%7=Q#=2chHxB-OwyA>z*3WuEsd~!%?9Uj{RsRKdtloNz2a}V^9EG z4jGJ%nr>sf@%vU0)9Mu$H@2RV_4BX0#%|usw>Ym%T^zk^rYSxT5A5L6Se;sgyM?Dy zl}};mpQS}?LgEAts<}11(A3f=Vw^#POW#c!Q9X%k8NZi)HPLu`z+2YO>X};iK;86u z%ZOzxG4RFUWy%>J%JvEbc|O@>Hs?~Z3CXwpty$@#anPutvRmEW)id2C(0N=HTG>Z~TM{0Z zii0J^rBf?A&+BpRkr3OGJj?rZOTF-z`@_gSpSZvtP){p$z{a#S#7Mn5!^?Tl<9~IW zS|uO{EjCLxQ^oP)GD5^S$iby)bm#Ho%Y<9!+2;Y-?B?=sIVcCNx{Ya~m}^h`%B&%R z9%|Jpvc2g!6^1@2}8`R{P4g#?|kkEqkS%#74y0mtLIeG!X2ik#YP}5)HC(y?9%fbb%#~$gJeQq#(rht=~+;LHf z`u={F;7A2M&w1Vygwge&^d*%0JpXS0R}i%OU-_ah8ZJ7*JGSfz!4U z?~UDM`|oi0&zmw3Snf{o!YY`y`T6M^@_o$e>YNpn76W=P-FPwH7^{Sux(O2$?tYwU zVN16#a60(%;Gi=G`fR9i+A^6OJ>BSa1YOD7^6WB#9xXneH*?I6o0e__MZNhG7<*Gh z9{E3>7g46Q{SMG`Uf!VIZsC^Lu1Z>5o>Y4$c#Vbu?!XWfeP*)v^GBygtM2hmI2Yfu z?l&e;@8=QoK8d%na|SCjBxC?e4~3XhlysWx|s89^d$}fHSPEEl6UBUKDXe@PkiBtbLudOPP3%t zjiI1|JAWJs?Ex+1UzZw@LOw(R4O1}s5wDBvNL^&Y0#+I9%w212sP}fx_iJ(qDPIVv zQCQOBQ|uHGBKhYB;^ywS=d1H-E>kdAA_)F`$p)6CZ>GIH-r63y=wQ4~IinMsqAL9#SYgO_7VLkFJjn{m=Pjo!7v)^iM0~(W zXE)k>mmQ30qK*P>?xEIckZ9IZ*HTO>5E>cEKW~!Q1R}?E5Sq!*G3|6(uc*De7-q!n z-%@8bauOZ$fVQm8vo6Nn|vaoDoBQ;a6M|9SCN3uF;hcl)Q)m6Ou)ypXd|lm%jC zzKIdnW-wbvH}SCy8-J7|ZUh=7+@gUVl{Ox_7PEZajjs9->9I$%WP6fT~ zUw&|W-b~Qyx^2i$t~R8otg9VTk@?bYzOAWTg{g>)kpbVdpNIb(K2;1czV*p$PJDjk ze1=3d6#-9LM8*%Ya`s|AwgQB%RC2bkrsx*=WOt=zH1>N0FSf60fQhHtlUoX#m%CYq zlY6WmYyVWUMkkgGN0E%5C{ut}B~N6RnPW1(?;1>=Ln>Ego6iIy@79wcAE1W~!O7^| zKezAM~@WsN@!m)9f74qW)>_Htom0YS(m^ zMF^l~V`eBt83jV^L5q@G-)eXsSlZM)obcGP~oe2^28AXZXsR-Z$-~ zbTS7tV+rZZ5zwgwJdIIrr}H33j){NP)B8V04=m7P_(Wz__BLHcM6E*B@9g{u?C}cx)t< z)n&p3AO7c>Aj)?f3d%-x&sYOZ9|{tVtz=ucDKvua5ar&PE^T<}2%Bi|k6O%Vw?aCO ze+qI150nU~!}8ZNuWbJmjvFLhSRX%Hc0QeqRf*NP#scyk$<%2|lNC(u@||ykZ0MCQ z7glNEzO<`2)(SsEj~g-U2zn6PTCft8ybKRaA{z>yA}jB`;dPFRUXLC{HnV3#C||tJ zkxpAUn(wp1?;!{VPfWO_&Qn7Jr+xGW%c=YA^B$tj+7>0?5{b!tUbS-FA#pg_6D=sW zF|RmO;pA@eWGCxVCnD-+?kwG8_F^)k1J8p)Hw_PfGEHRd}2r<8W( zgF6dbLCOgDrnXw$mT2tr8U&1KQT4KbY7u=v%<-H;tc>F46B_n(Y>Sf;wvaCpYIYYP zYyYs#emO~b3Ypr3GPJ;V2JWGW4Bm(#V7QX+Glu_m*DnqSvPV0=jvIA$f)1#qA;_QF%!PN1{esd!MFj#FMwxbl5X zKNdF>+AW+}=9CinWnZpc|YTPT;lXDh`-_i z*Ev9#&Lvci>omwXtoDuho;bA*C9?XHCrC=$)MY=>s`8pTeW_}$x}DoNcRNiTMw}l} z()kAx01%@Zi3*6E(z+uRogmiX%V{x}lI5aYv`CB~1A|<-MrIFs%SmZs@E$I&6jp2? zbz&^rvI%YM_=Me8n2kk{Igl@V0m8Bv0gx?(yYoe+Sj|bQvNKry86s&W3*TpjNS?YX z?Lb^NqOs+}C4s2Ws5=JuZma0p1ZqC+v=Wv*6)V~mdDiWKCe>{= zZ0YJr3AH-Q$v{hdKPn|Sg;6Mkt%H78!OxiR!V_3LwOi$$@R4N;oPba$CQZJd3S(81 z5b&A{jLL$pEPC|l*j0wN)}M{f0XQpn$_P8pOG^Xq)c?huo&*6AH0ao@Hr}?_b429J zbS2+kN(NItobR1;k}2I3>yX@}*gPqBwG|g!qa2OkG}PujBy?;yu%l+o@lBDbLsH=n znG6jLKadXzE2`}1gonIaK#<(7exvwII^(oU*#l`=++BBVqOgJ!Us9-D#~H9TJzzfH zZ_$1h#($Ha63~sz+Y5eb2X%$4eQqtasRd2>Jg^c>k6~yJCF5PIfNn26PcA==f4r_r zf8<<#aKmI2m{S>-@?-n=KQV>nIp2E%+u(@=M`vqeC{@b_`kUb`D73Ywv=TWrE54%= z69+ase;kRvGpkgB!m=LUWPW&j3O*%#K7pLZf{b^0KMq2ytyXx=D}ej$G1uL`r!*fs z`NU|SN2Jm+*zzmm*Jm<)5@(lW!80hpx1M&-hp_WXQPo2g-%E+JwI?o6TjyW0jbDsf z(ogShYq_a8ma%#_5zIDq>ci_SM}gc^6rnKAf@M*_5SK~eQN&k>u>aEnR2xcVgYrgk zw6W#l3FWiyzTRE+QYimcs2zCBuSb+~Q{u-#lRb(EpK3wc)=~CR&WqiG&aB&zC-b)W zhv|*0k`M7AUX4Da4Vxj=Z$=5^aQEaV(SBzc$x9&+ec@}P+k26<1#)CF!IG7iE>5S# z5Nvpo?ZRajH(E2Zu$%VarT#GHubMSz7^Y2s4d*~j;xiYZum0epR`IKf)ycWF`OeP3 zhmoo0ByUE7Kd`V?H-nP8&TP%GDXN_|+3rPoy}?0-D*2^NFHnyrg(94tP>%n z&gN*~9WEv}MFtBV#P5v3Irl%1^O}4G&|ahnd0V>G@`y+NB~I~&3TbEW30vRaRv<`h zY|;#9R+NJ$`mIuuKvw0cHpg+^_4$T2`DK9LGP5u##kv&r)ZXCAww8X z2sajf6?M$tS@-}D8SMyyuDW+$V$`c5UHXiDl3jju2HD1&&rFp;7V@99=|UU#()O58 ztL#q;pl;mb4KJfVWY&ya{7KQ3pM$9z9W0 z7M+ps44MazrFC?R5>=d@(#xUfXZC$Q#()NUvtsIY;#FK0l)C%A^Qzps>~`RE(R$)qNvDox7$i&wC|LS(|N1F}?>9z`ezWItJGkyv`f?v?9;gm zH>IF;+%g#X9_U_xoP<*h-T51a9Q>!hu16!bWx8s&E5?ha#R>==Gs!) z!ZTp-;F$*GFsoC@(7{|VaY$^z9gCkQeM`y!E~0R1rpbD&QlY4hHS1thrv{M=#j zye1*d?0>e2a;ZePV3Z;6y0kdl0OS7NMb81Ijenxmf3(1Pu+Vj^V&7nP=qV@t`MvrT zdvzlqfio=2N=_3qlM5M=_B4Y6L1kcz+Wv2IU_$7hKe0LGzDVw|Xcow}H2IYLm;efn zP;M^7t85)=3ozpOuJTwH3f%5oK4R{7CS^}gGMEUavnJ^pZZ$h+KUr|g6=d6yi_xTJ zq*`k=dFftqe|PwuIGCw`lM<}RloOYgn#DXvk(EO*0`Wb8_N?hPe4?Lw(_@*^gen3* z=l0MgjtgJA!;C+HyN2MZsqkwz-OeL*x4??t_|YFLeD4qb6V^`X_aO+jLCfM&&FD{M z&#XQZp=)g+#kD*cYtbvdnYtA6GQdDSkB_m{mp38(Cfa-rN*DNwM?Y`$f(&$Nq9Nt- z_bkF4U3*Y7>UvccdC#HzXnCxJ(LRh|6`AP5Te^r#Hnd#VsjMUR17D-t zbD4MYz(&v@mZ;~RVhN}J2UJ0;zRdFH|L_9_AAHic*^-t_k(8ofl091q-ZBZEk^@vK zkAV)M73k|7;mpN3Hf$PY)>^@;XKr-rsn|8nBf0B{ir102PK=3z5+8+NzL|O9CI`zY z0w%$VrGEt0?HXe9o+DUQ7S8Qq&59nDcIMC|LNS4?q@lph6ny#7a2N$&*g=U_y^FS; zPgCFguSA79#)&WDp5~yYRoVl|kk?h(4qOu_Zy$4&7B z9s=~&;rW-2($!^Hy{H?P_#C>}cslKa!^#Ug2iSICfboi>tGCEmOJ{TT`~qE^0=yD$ z6~=h*muQ5wXA_m*PGx92IkPM14o%~xX~2&!0b$jVBroCO^_cuJP}2a_Dd5W(i(cb= zzmwiyv%hL0*K9KhNmhe0W1>t;tPuVR;h-8oqr9=+zvj8stVmU>RfdL!aL&=u(LuTF zQ%2IGO*P|s)A%oAsWIzGa}+ZJme$A{1`fyFgiL$xviL$IT5v($YlMQ$aXu` zyO;hJk!gYK2}x{P(vqK3@tM*g5<#H7TtG&l1{mw#k;Fli64uS2MI>t2wWUZdpU37a z)NIu7$YFdG3_9gqoGfWHhfB|+gq1Sr2sIa>#E2xp&@89yu@`+4n0yZ1a&z|g+zr#z z;%k;9MmlHls~^3Iv*vYCh&=uG@kL1LH4g6C%|CqYevXZ+PX=lF9!+3)49aE5+fWw4 zLVFSF6&Q=5vkgYapceb&0aYlLd>HBQm@g0yp?+T-Vu7|2XzaglYlBMFgUzDAa0S}i zd|yUKfygs>j*NwJ5(+l&f$H#B!~9+@H43^n-2%g-kQkqL7_1l!kNeP5(MB5z6!N~5 zL$v~b{K6vwD-gUuj3bCR#LB+85 z;22-{(M#+Z&M~W}hny9T4)k+$Y?OCgvw{y@+(%cYx1Vg&O*MiTr%FPEF?Fn4M|J4W zFx-!?4T#U-3Spp%XIV4|B!bhqNa5Fr%D)fVi5fp&{dSaw+4`);)Aii5@Y0aqB4QbQ z>KVRq(@oR|`{}y*W`61R+sSu!01l@q#Zeq|s3@Bk&IM1b@rIc?zP6lkHhAoP-O8D~ zL#HB1k}x2sAwqP5Y7ptKpG%+8ZLJD@Dc9({++zJLapejCxl#D(9W*ztP^OYyXGCzocNH0SGo_Y3Ixi*o4jF+Ts-|KfA( zW-2!F04|bASkZ@lW_1FcHVUvi=K)wp07K;xOyZS6@%8>DUd$5@rAhrAq3v?9aY#p7 z<9elVzQY61$<0lvVK`kM+9rKz8rMLkw&5J)^3dIs+t<|*nrH#Pmdrqmq8W{UP*-J? zdhG>Vyq&0^I3tKwDHdSyLQ5RSBzO`KQAeDV(ZVH2;S!v7VVf95h2S7c*$_`6R>4TK zm(Wm;Ek9hho2OqHT^InlPg7@MHM!WUFPL=`77&Z@8dGd4th-)1;_7-MH;HS%6BrLBSI zGt`IQ!V*F{66jGhejH;DdblD!gfpeE_h2VIPZ5gP=n_OOLdkjZ6wOTuF+6UcGK;Hk z`-$xX-0|>E4h;)!o$VyH492q(OXRRg0%EC;*IBu+#QWE*;LPqkCW8LK1$^O0JNUQz zUuMbdHm+Y>LK06JW34^z7<)Q@fGDFpaazEc)kMXMsE5gAX@! z$r0k}7NX)2FdZHgU?9}hq@m}(A)2ICSyNn%GLK4i&=qkmwKf&OupEnbL;4Axjk z5_W8Pk-3YOQ7)CKYwW8rh8vM7o7Ed5^?IGhAAg(|Uwkpk@iWFSG&IDXJ$pEO_%PRA zdu`?goGi`nU~{fuk|gAEIg%v7IY%y+L!A!}PHHtAjzXb?I_GszBUCFjayd(q#2h?w zkXpS)9M^rx35C(&5rzhbGOwSa)T%WKg#t;E_&TXZs8*|3V~BD&^7%ZA7A>Myt5L01 z`Q|sj$=tbfS-g003-q<*O)2U7;fx_RKHs|rKD?h$KhwEM&YlxC=)*{X*u*&Nh%Klj zO=$vw+4rRHlOn`4arT1LQBwz0QLG6B67_`0kk#0;7UFmgx%`b7nHOw165^&Do@n9}Rz+ug z7^!g{fEml!Xw0_V2UxXo5jUOPMQ6x0yL@SZ7gzN1?e&8k8c8^#M^PJ-NFJktana=H z#}kN$ISJOoRIPhYVA~=JE3Too>plwZFd{x#+>?QLz~saeiCBe_t-;`K7$3xR%nrt* zFw{-Me)>h4etA!nA;MTilf7uN0UK2i^%ab~HxtA)lf{5KAz>*|VGX$MpfopX`ZbO{ zd5E3hH{8Pqj?uw5A9&{lNL1kOzx^`Rq^Wqhcw^R*Gdfwiq$k)^9SM%k9?J)=TFjPj z9%b`^QLbHFA`-7eoMQIU{NM!)D2Z`3=xF4%Wn&OQ;uoo0e8V%|&Qlswn;dB>< zMZqH$qBOFT8{Y0W0tTuk7@IIW*w6jx4?Gy_|4jkCe>Q!e^tJm4RdpB2Hb}5&y zy^;s-`!UbF@I2ieoh)CvoVC}y6>)I?UH9;<9LGHT&_ir~=_RZ&+Jw7tYC{Z!Jw|4# zl6V-YB0jn!Aj{Z97zd(F>;9{JEnBP{Eon(h-Z0TL7ezxTncG3)c3=&Nm{9f0Yrr=A zkodf!suPG-64|%l3u`CDq>krMo9$GrHCZ%toLTBh#xSQ`U~FKF;n*J}SgHyGBNckf zN^edwB9WAv>y)l6UeUKse2qZ$iQbMja!W2J={}R1laMQrw(P<%SR&^)1gjOs4{xSE za5%IpfdO!OW%Tq*2)We&YNbX!-i=ERH|2+Udg=sx2@Un13xLbxosJP6F=bv{BIK*Cvjn4H?)TL?&G%N@HNAW}f$Prw!6C_48ty!3k%Nr}+ zo+F5{Xfn>`%`fuA6YF^V@u%4Q(n}mUdYB!%ck+`*9^=mM-N`?H{)?=8d;@W{#={Rk z$QQr^|uh)2C{R=E#zKnOh<6Yc$?~gfa)mgm#=C|?Gx^;{W4YG38DlWO`VwNmk%)<{q z%)Z_Gc>J-)*|}pkAOGZSTzl=cAW*AUIrp5i`M~=>zQdV@?0{I#SdEqUF3#Nc3+sT=O-ovE{Mnf3~jR5g= z){IY@t|wjC!Wu*t_W*j<}Mr{&6X#&N(@b)WLQLNSY+I_F^=z$u~ z9!&Vc0|$8d=n(IF>jDdVyXkA zFHz9?$9mt=rkUWhY5oCyqzizI`kA-uoaQ`oJ%7{`nVj z@aPc6=D7aG>sh>T30pS3+!(8$!m9n#N*b04K1XnL)HCa);IF^GpE!=Q@K1lgG4*== zxb0=rLzTIGb6K%!B?}iWWcA9kSiEEjb7s#*L>L<%W6Mh~v1i9l#9G7}Dq~~p-Mf#a zt5(w2H;V-e&!DZXOhFevGtFx2A z!9jNI-o?>lM|u9)=h(Y%AEi>6YPE`puzvk|_V3@%C6`<>B^R+JEqQZ_px9uFBDkvE2+;TqRnv6O4q z%Qpk-$2~}o)E>uWfOu$eZ;Iqk{DAx z#_0Z+D6Jj?TlVD(Xq0?c0v4HR68ou0n(C*7>w3WDq>dUxqyw1hUPS6)t4z|Uo3NP? zym`J9O=8-Jq9vfcVIOR&r`E{W;CL3$W`$LZ5E1rM=fGMF5mpTt&!|QSJJnFz&zGl* z$OrG!GcS#B`@@?#=Yli1=!{aBS53T{$`nx4@Z$xNuZ+IY=Vv(un?IA<*nE(!KHSqZ zAiFr7aA%PW##?~8t8-**gmFMehfopXTEv{b zMZEicx6oFOx&51WP_HDkm5VG{w17t+e2^`Bj<9Ia8VYS4%$YZjqXS2&4GxB(Ovj1W zexAJhTBED03+Ei)|Ni&6k$P`SB(K=4*p7<=plqTVD)7-&n z_9bY6zm~M5C9kUl_Zs*`NgII@FakOV)I!ZQe|$rS4+^n({oR;e#4G?x_zbm6QA^27o^eYdVVjLpFfAom$lI*uwhS?$JQU__Ppbl*Dj#L`oiQ{Mwgly zE3K1j-HS>fb_a;)n7x8yxgL_r01{~kAqfh80Jo}v3O=b(8$JlGg4l9n*qZxty7ai? zv@2<%gR3A6d#^8zu1zPNq-PewEHDM{2g*F7(l}9%?;)D1uquMXWyBi^*43~s@ne`e z<`C+^`dcuTxDF4#aD*>Ew1Z`5ck=NY7tohkhbLYmbHE*EB${B2Khg-oJgiv+ZfoER zIzbB(lej^UiXRi5)CGmpl_aNuoX3VSPaI%la$O}By!(CVz!0<6UXF8?a(5dyz4Hco zd)qOl&UM$_M5&_>(dCo{zWeQOGc?%G>`Oa2ci9cJclUDMnjWO)?dGq4jmn9VhB>Ar zEX$THW81cE)M_=NC}Ln>fJ&u;s%D{)ixw@SSS(K4Uh2n9|0)y;7~=!Pi)}>|gN-6` z`8<7d`dG4b33uFa2ebS7ICS_3h;aE8m-F?neUq<$^>*6Ya;!RQHJ$D4f&Eh{778HZ z+leAXgmS5rg(dsG30GXcmhbHUHuv0f4~0Sz=ajd<{brti`e}?YTzB1dQCy$A345f4246xUq;POiKD3RFD{ur=DW2c=d^zu%k0H0bRQMh z&D(CefkK8$!}(2-HItcJL+cu9}`x(TQUB0NiF-Qm*5d@s#)M1PdPmJqF z5jO(#l7inxy|CbY($fJD!bMUYx5@kGL2(6RM{q7VQ6r(L2xI1Z)=~o9byg$9WOHEV zNVX9WlRcBbnq~qqjuT%)601Z4R&wkgO1R_EJ#5%nQollPRGb@SdTDF{z zed!B?3Fy6%QH~|c7U48TRav%tRrXfC{K8{6O}PAu%XrJh=P;|gjaWUobUG_V9TT*d zH%QVvxHHc@lM64rkQZKfA*=H@Fff2IhB%H{y?Qn0pMU-dTJq0cQM!7&_|;$gG#$O& zh;zLEgYToGt%w#P-uu4y($m|+Z6E&x8#lg4cXu~eU41o$e1THAjZb{)6KvhOl{tOA zEI4C6ANtTQ(b?HSBoUwdl~2*t(arn?XHc!x$mI)s;u9aIt*wlz@=L$;VM?VE?d|RS z@-Kgcty{N}Bnb-_F2q{P;>C;k%x6B6dHq_zuO)AGao}_Q0x4JoSX<`k!Ncs?xr4X8 z`|Uh<-*c>3wt~e=`bd&`dREg?oAOgb8iyeY);Ui?=W0-NYO*8s!%L>k3O6B4?NkEbg1t@! z#FrD;v~PgXL|A)HFTDaab=0ZRCYBp6n8gpD-OG!6j&SvwUS?|((34Y1#%`|7mih>S zr4NH`n?nR7AQTpdmON6CsV<@!kIbtRA8%qpn5xDj z#L1CRj^kt!VND;Ht_Fb*lKF(1;nd7;W8yt4hJ+k05X@-!RGdSiJRA4c`RYCEsg-hk z^nGi%cz%I492zHxnOSY6>8_j>H}{181|z)~GY?I?LZR;Xn8$xS3a*M;Z)Wx*(iCQV z8Xj$$M`F^PTJYhWl1D1LscyL!Qy;)}ucox@8r0=T)aOfzF~qJ$A~~!kEM9RoeG695 z*40ZcXNl`Rm(}4=!RNH5H}D2xj}+LY-oHyPy_8wAX0d(ycKZAKvDQ*36gcCIGdS&?Ext{PWF4Ir`?#CdOga(l=)ou{w;&F{^JD&N&K&0vBI=Np`+-j(VKX z)6>Oem-)}tCCu)dL*4oMk+bK{&7OU+tw@q6eSNb4pSL)B_Ux>!a=FX}7hI6FpCk!$ z=g!UkZq@c{$(vnLVC4zc{4VSOYhZAAh>rFSuDs$39(!OD<0GR$A4bv$BS=ltzOhNa zF*r$rgV2Gga`f0CX3tr|rI(+>16zJbEmnvm>;>t`4aRFhecw{@I`yods=;nagcJ%a zU$K;(;{%OTU85PD_|FN_0)H)ONlRWwX=tWiao3EBUv(VS@utN!1%1uhtOO5)0cis% zPjZz=<0r6v&fNEB8XmaN&q#ft@p|IFh)4pki>OqTYT~d?$bl!Ok>C*u8_LWs-P}hB zV}Y*^gzKJ)hdA={$6Pj`&=RJV}UAC|3WmlgZeoirM%=~Y_1cHO_+TNXpD%( zNrWwT(_K!zY6%iZVw#OL(rn#$gTy(P6?{+sUbSi!%a$!;Y-|khp_FN!UvsGBWbt1$ z(MKentu{eCExbr5eDAWhG%eKjW*bXvISA`QH6}unFLUQQKOU+2?6GeML7Xv4 zFfS$~v$m6+Q;x|;a~U;I}vh%uRk*f>u}l(;~FVw%Ub;pb~c zXsOrF--ivKIBx_AUb_=HTD+y&q0V7Ma60)qCu!hSN=7Fm>0KzIN)92$P&Py4tTM(3 zA|Y?j+J>qWUU^4DWwHn&7Lzs`#v_%}F+)#9CVTMGzoRIkvvX>l;1h*OrXOd;>#Y!B z!>f_zJ)7fud?$R7T9|yTQ~%M#@bbvmFzcodJ3oFuCw`s+!j|{1C2u-WhbBtrnP>9e z&;B>e_z=!n7GH2F9c>-F^@f{xY~6Fb^Sw9F-PcCq5+B8)DRZwu0y&uva&g%jUg%mt z?@fOU5+gllqe&mDR(CS6_88l@ALOQMucc@d)ff@O#DM>FK}_oqdZV7nEu+x+n+PL_ zy%=Z*Rpu{P#ZR&bPSoj2s`nb{SuLco+ZW8!xeZei5sVeFq(f1}ePct!Hq} zxjg~wDMplp1Sc*i%rnXPYj|)PX-=W$UHIFDe7C9oqlQ<(7!PCw^*}T|C_{(o`N2E% zTI+M#mv1Y~#MnlweS)6Kl+zcFV07FJ^W}38xxz64TqA3;@$|9O-uKX}cwR1_>%L zVkXY_t7w9n2gQHP4CkU7i@?mF723V5vQE{O^hTJ-G)b^h{3wT?_QJK!WuJBb;KomeO(gZ;?VQ zjV;8&wNDKV6q$MqRVeLcP34_xlcw^%DgoxR1y@HN2&mf8G7z#KNpC)0_ay{vq?$Q_t1VW`i5F^w_4p7_u zV~iTKVmg!N~jZ+vX81k#Corno*c@mf-x3j4N43WLZ1n9=CnQDFxEas zd*b60=j&PlkRWMbtV^A(KFcy?J@-b9V2}vmt`c%FeGRQJU(;9r4Fn~VJz~e}%ZWoH zr#@9B@t)t*&lz5kMvgNlxn5&V;YN)v@I5FTHW^>LKd+57XAY z$OFm*oUsToMv@8MzZ2~TE%4WpmbBz`lm`58;N$19UV+4WFhubSn7H7k(V!d$g~mBg z6rnLtZ7h<_`8gB34X2>2m`3P@RXj-rLZXV5Iz3U;XwNA`1`)-IL2#%MvJ!=_Vr;yE z-3*8gBneU-$Ew39IPsx#f(7;CWI~w=r;06gk}I_NCR67O&a2yMn?~d{R^kK*ew_&p z98s^VMs0}6X8@x4n1+WkfD3WJC}_=RLj(#;3E?oQVbg_-JyD;}ry`Bbc*-qG2Fle~ zBID=|1>Qwd<=!A_DH|wfr=>ZH!HXr0?HWhMW=d$s*TZ9y&M(>6q^L+kxek>I=txG% zosrrGf3Jj+@0#6@1zW;lLDlEXrPoU5-f7U!J@cG4y;9*K#($;)PC|H;)8O#c@J~gJ z!ARua8{-GhX$&q$>>Ls$;XF&tK%_n|5aXF@9cd_Z6v|TGEo1yiO8=6f;FTSe;WqB1No}FivpBWlL6?V4dk23XtI30BAqL9MYV@)N3eN zEx`%s;-tOP)C%rWrYxUJXTmjcw$Tw0oLB@U$^gy8fQ^}{N14mc10506xpZrR`Z#91 zpS*fcWNf{+$?M!vc6(O9B@Qk3U`pK+u3$(=3&%Ra=O|7B%s;JY@Z4xnbuEB~Y$gGd z??Q6jxWuHLB5<7`YJ72f<3b=!jB)^6zt{DRke1+0_p`KIf(KG2c##~cA&fIcB;tL3 z+0zgY>NNl{35oS70G&9`AlqSa-nxrtW=z8_Cm^nX&?aQ9Wo{XZ-C7&;{YQ;(}x@ZlL{^TcY-MS6u3@cZz=E|!tC6|k` z@X?khuq8i_B7{2WfLg&s4KQS~_1|Juz)sr9GtauE5uKA7{{l&iiM^pS8bhsuNy2Fs zH5!P!B-0uEdD_@Nglu05o$>psHCPA6L>UMb>tmcmBTz+5($GCp1Kc$7CIo*9VuQz^ zB`s;mNkt5FwE<(N`9hPeS!9-VQHz*9B{~m(cTh znG!sCzSM#Zmkey88HgkUb{^lPgf6MuvAJM;1Md0|#wNfPLNR@qpUI9-C#nzm+e@76 zz(y%SN;(xC&NK#6F{nlu=|MD?Va+M#hM8L(W-LA^(?0_%*$m3Y(Wv(ri3^@tBSE={ zsJkjQmm^Bmja2DT4}z?zdvKV*cnqpBrGmxbNHihR5a_IelLTX;5CsrCVop!PTn>s= zxYx>fg-0KIg!SuR#5qGgvP6+%1gYwx2KowJ6@){r;~HntYK_;lxLrN4u{g+-p=ZC*H9?rsaGmI_xyUsM@Km8+%rDBn-TQ_s}-S_gR|KUF{I5fgP|MUN1$?`=kUc4v^ zPi+Cemi+vSW~+IF3%c2W(-e}CP4}tBos=OQ0uT%Ph)T+FOcQT`Ute^Jell&y%7m|{ zD+$!-mVlkA0U|Ee}Dgu$zoNb1A%);t%^%;Ffu zdv~U{w@oiT{U)@j;6zABfCM+V7acz6js8teCNW@*&*gJsNE8xhscSoEG2B$Tt(j@o z|JVANH|E*IJtzIVgz5rB%M*bzfy5*nZvaFQ?Z>%&z}TeHAAX!P_3Wu3GXB{$2WS!) zCsWc3uY4z=MjuUcB@Hc3+fSNG5-3ndL{Xx^x|(Ff+{pyXYzh!l_R7pO;0u_CYpMz^ zbRBVMya$n;sEMOt#K-ll*-fxJAoePH4%eiH6;w1bbDB@#3Z0v zhiIH?waQa3Jj;<|BSf}DWvs^Y&pyl0;3$ZvHa8*|D`4{M-?f9sfASL!9v$J>zzAYI zb6zfrd?>E?7t(~9j3Oq4jh`+%uLOPv1tVak-;IV^*VcB*@vp~&_fTgZrw8&XLx1TUKGbuPd~*M zzwia(IN`bHp5uWB?k7nS?*7r;?Af!Ia=Fa+?!1%z`wuX0&K$ZrySV>>hxq!}@1XzK z0CVTgWzL*l?zrO{JpJ@jEM2;c-rn9R^#EJak~fuP`Mv2H*9-|$F)+b^s!c!OL12hj z!hs}BYiBS(N(d95(E3CjY1-~hICi@8QX^@TC3+e$(|-E%EQ;R^T0gCy)=%SS!aFkE zF|WtVX_!jFVglv6B9u@&i@NJVlL)jKu=vH+i7#W|NivS%>e~<*BgT1efI57M0Pu^m zV`|mF>BS}fVn>f2Hbazc))M&LVkeLi$tc0t zBEE=s;<0B>tFHZ+rNhxVaqd5^4Y)m3l1FZ=aqeXx&0frv-g#Q z)N140_1z!xt*?KJZQFMci=$R`y!_-AMh1r1yMG_MckSS*Cm!YQAO3)6o_UfxzWZHv z9ysXpaaDtd_cgv(@nk+ChFUdY$M)^SaTO6Et|uh1($m`mC{biF#;||?e#Xbgr){s9 z-Lz62W9jl0TzS=%tXg?C^A;@Rs<&Rn?Ad+n+O>p*?A*SM z%^Npy>w9kHnj5ZX*{bE#;~Hn5b2gV=b{S_bUCQRo8$cnhR&Xw+R;{so*>cuiaTVvC zcOE-;?&Q#+13dZUlgwK%m)=>u96frBM<0EZdGiA)RxX`lTsYn@LcP3;U}JI)*x&IJ9{oJc$ANO&Ipsl9sgOXH%wG z(lX)_|Fzh~)U}VC^n2n0^@USYR!a#$LDgdIAey`kI*6eZ^1dKlMzb)z8EC_*>XYUK z4({E_pZxCc^PB(f5BbgC{s@mh_9(Q^W7!!C7#-?ocqFE;r;lp2g6$|G)e4DKsu*gO zI$do=NW3>y(h$EHNVA91<@? zy4yLhe;;*?m_KhWk%i&GLktX#)809UTrtAbM;IL$BVWu>Eay0KWQ49+eY6!L29F(O zbgWA6{P~!q!r_Dcw0HH;)?Oy{PBvy@2q^^A?Ix*h!+>!{EVVstvdVlpZ8n z3KYBo5b{y79K+M~Sk(hs&mE!|=fgTv4w&#nJk_|1aIvy#`D*s=-p7%nN7=ApJu8>5 zV(7>#eE)&_sJR@k96Z3n`Lh`w7TQWhB&o1|(|V}1vHO8%_~38d%nL7X;LkgP?IF&@Jlc%Cq4>D&7>_o4TUgG2Fw8GEQsWQyvKEc94k?uzAJ8$ z_f94?JI(8*q`E>{dM3#tX95JBre9OrX@S4V;#_7G_B`Ly4_r%H(vnvr+7vn;z(La@ zXY6v2GjL`jMl9-rCoGVn7)i@PB;=xT;&=xdZzq?Vi?4jE@a zcoR0d3X&*`UQL~3zL>qGkgL(vp67uFpX9}d?xnr2ja;dhU;EU@$rmj{1O5Du|N4J3 zXUQtY61e(`HS`}jz&F455Vw8wgN%$1vwP28Mn`L$bJn?>zj85m-t|KY`7&Ex-ov|p z`6Fz3;vshL+0S)1U(eBlyV-M~pM3W`uDWPBkKX?v-E)?5)%BNi&z;|*p0soM+N(J4 z{N*0kCg7q_@IVC-i%^65Gr0O@qFiH~JQ=1h%wbfr&?DvlXYakk?JCZD|If^`jkp#j)7|ed3M@ReYv-fJV*35k8{l4EX=y)t9J^_g9 zGI5!2p46`TtKGB`Y7|wCPUL~0Mo67Sr-HViwFT{{q*W$Pokh{WXFvNnrcayAiSx#A zXy*%T-@cPsC!R!W0ru?N!5J64lj_b*JoU_@RFeeb6k1yj?BB<(UAuA8#L^WjShaKp z_JL=ZH*-4o-2X5G7K)LC4Bc@!XYs%?iVW=?oow5w5$6{hlmcUN7#$&6NRotnK3`MB z93Hy1Jw;MYQK}3;l2oWxedDLrlB5aMq{`T?aX4$)xcPayyGu-%Gzn)kcisH}^S1bN?HNn~xYc1tcwx5K7{(eS|8pX0@OPM-tDpRIRp}YGK?H%oG z+wuZ?_U)sst(~XVJjI+jbD20{EDt~U2v0t-1}8#$dpn(-BVOgJ+=xcJ_EAr@^lT7S z`&~kvhlzqgJ6=c)l_Jj8RDTcO;^2RSw2j0T^BMCVMX5BEm->iFyL#tvVYko-QaFs^2kIy zWer0$adgd?#kIeC0e9W`6SnQ#PiL{f&ENhH9)D&diP7xb{X8a0dFb8;*}8QX8#ip> z$;UP@X56?M6)&5ZAJb(C`MfNYfVL%)%@3pdcVHst*@QX_Rmu+*T4}U4DC@O0>6}e8 z@&vM7*8pN2rSSNB{bivC0cQ|iQPCK5yol7cg|j`1znxO(*rM4^b>I;cTf>L4o5i7w z^X9vNI7h4;d-w0BX~Zbrb=4)TduBabckBkGsFX_d?%U5<=bpzYr<}|q_x_R>ckE`& z#2L(()XClVKESz`T+P*&p2wO;9^!}B|A@BHllYzYzL$|r!odUGY~OK+rK?tAjN-PR z{~U~B!}?9^+PRxjGC+H0JH@!b!2{jI#fa9nR=Og_h`kz+V@`2uqJA`6$SV(f@kX3Uz)X=j{8wOnEG(q)`_+A8k2?IwP?`d4(0 zp2*ma5lovhmKh7iaQhwiP$~;u6UH%e)M%8_bdBvI(uRrSx&|wQRo%_~Dn>^6GLd5X z^r;jJ%_K>Ri4=YPJ#5*s6>*N#dOFzDsZ)vL_-I?J^#zL;En(rj`5?lqIWw3sb1EXj zg83&hb=ow}Jo8NQg*=Zx@i^nUx>&Jt86!rF;F|ZmhXV)qv-X*_lqwaLELp<5IdcJ+ zIcpXtE|`bO?vA@+qcIpTSvYoyp8uvpN65^Lgf(r`fvo1unYiLMBa`R0FZYP464gh&M`P zGZ7zZ2u8{%+6Q)R=gzzCVBemD7^6Y7w|zJ)RBaoBwhuC>@F`w^QY+Z}?6cf^*RAxH zN+=bhvO53T@q}8!>{x33yYD|#Cis@w-?)^0JGZiB*Iu0RGZ>L9gBZ#Wj&cnenZGQO z1Z_35moMRrWz%Wa@Zz@Z-2ccrw(stNTr@;x`BjZajJC&6VF0U8)h z9M31IjKW3xK>V7RmqyOK!~B-K$lo4ZO6F?2}<$|8eLpk14zX_^y3>n6>PE z?A*4VfB5Vdne;cGrqI^O_%68cytmR(v<&q2@mGKPX)e9;GG5ram3@16Fn{h;0E~9j zo3X$A6;Xkn;g4Av;LtjhXZCRb03ZNKL_t(4o9{#?{lrn2bgPVh=ZM7CD6vXGNfn8^ z7DHhqIKk*_Ad!$+9A@+Ws;7v;1hc>ocL=Fk6Z7LkdNnWNE#X1b=#VE695w0CsU-Z6s_ z<0lchJe?iwSgkOTVd3=AEZTpFwvJ9z#Y>iQ z;-baA=g`L2DAoD=HE5rWc%z0B!T6QhA&VH1IMPamJAZKt&+psIrswwY?sr{IQ;W~m znIlm?0|m1-x{4(jpZd8=oUm)hi`;R`J#_c)VqZyf@da=7pFGT&Xw$5`z-qk zWB9~}ujU({|06~uLZ zXTu{~u6RupBpdO@2?aw0Ujn^PB|wA{gHRkQE71A6{Kh2_~wN zR-YlQ+=nSl#o19cDSvPJO;C9}1`wta1ZW>Qngz3Fp_7QWoOKEJKe_?kRN(UK-p`l* z^=sU6(@#0~g7cX_YaXYZbRvtFFQj#32mSs1bTsG4sF+F*UB!E;%OdDt1wg3ZDpT2d zH|eg`v_?5k>(pueP%}vRbK=?RxejvU7ed@ZO-}OoBt?!G^~W{@goKQp(i&8OI9iO+ zldyIJMp>NWFhN>Dfkb#^%?+fbJIJ-3iBl6i6%w!Z7=@j7jG4rgnZl@XW2u&l*vK(| z(QMk=yxG0d5mq!mz41m0qek+ct1f2K+V!;dXd&**UznLceS z_uP30`wsT8>h!aSv&jYC&ctV?0rrtp?}T)#UsKfDYsp4AHf)UO>#wqOQ3N){IYkO6 zJrf-*1DXTP(cc3@#eeEno?pd=*TLh^qdRnIoeyTnt@MN+iU zEMB~XF=M(|w{9K1J>9s}QYaRgH-8>er}{-7Ymdwn5(yQ!68sQFP+B3%d8>>t?klh6 z1X_9EC-`h}$g*jr&^0=m3yWjf!y`c?YM5oT9-NpO6Kt@QCW;4XZ7BS26SPkw z1TgCm=g`5#x&itc@kWlJtQ>D&69Z*HMTXrwx1n)-@Pi-Zi=X`#FTS{&*>fic>!A9n zZ#_M8kZ~kp(JqEG2A4p-$}?-9V^rrvu720WeD!;`&_9sS(Ii2&tZuBVm%$ze2qpN4 zN)YkOH8(MD-W>LC?8aJw*o$w;u*$z9J*^G!CjtWrtFFA5KfQJZU;me{^1Zuv@X^2d z5Rcq{gRNBPEvHBvc>#%+!g1mtg{iaW zFmqyob?cvJ+s*-qk3+N6(}-Wm=M-KpFG*=G7Rkj1=PU!&l;mjJND@FpEEyJcmJERI0{Pf(NBDw{=O>3wpJpo z_>=$fNgTq$#ft)kL&D%-vI;)58$9J9v^W7{@1_9wP&dt=*nvazk3_gnW@HB~cz4ZC|zcc169fp~aU zZdN3E(;q*`S7lbq90w8-x0oii%RNBfFh!?J^jLs(hq@i>vqDWrVG z>}IGvzuCh=nj;tX@vkhd4h$Pqi4U;F3b0EO3_9NAS6M~SF;AHS!0Q0w2XW#XLbVaC zTo!+DtG+XQA!Q6DrlcGeCv>S%6{>oU3xx9tBg9=(3)|ev!qfxy!djOpB(0)AX!`=C z^HXGKzHMmbjwie~;#0i6Z7KP@uJhJ)0wY_(1nzLNzKo2VtT*a(iN%~Ax~exaW^v`} zgX8?&)}RvY4pBPsEfkI)b24aFTviHkMV>dd1w-Sx z)J7Yb?l`QPgHRT(z$MA_U@Hpn{)K+zCgOt7emo%@1Fz}GBny}WFRsDhI0v?}B|udsvFIiP@^{um(pRjx+9maU_#QcZ{DvT%X6|K2Hs8ZNZY8 zHe(ks6r@>nGee!&v*wh6l$9$_7bVUAd{DB|@YQ+8>^NpDQEE=F4AHW2yIxeZZmQ|r z-meXu9}qxmnF9)n@gS8rWV4Wx#-h?F1A@-`jb1vgHXrhp16%;*^g3xofs=AyrvH0N zDC^H65$GqC#t=88f-!)^5xwJm9E~KLJ?}06H-&PHC*rL~5lKaiPW^_Uw?GJ2PBm~8 zpJ*Jd>fAY)JQ%9JB-6Rl%|3+x zmbUNX3}OQEz~ExRZhr=B1Kp7%2VNtyGYXX-Q8{g|C`QZ#l*K#3domRob$#cThPg#w z?2cRSOr_l(L>#2CNzYM`psGmYu{FEAI75NjSifr?PvMSzfWuz;@ElM_Tif?v+Jgge7cySF9`25lltLc6Gvjy~(&eO6y)w!^G`pVgBkYt#c37q9q|YklmqsY-&6a6G?Vf`&S^9O#)zn} zK87TOsNQbr)k?mi@ueVp5%aIh#>W+_8`j77@@x69tKfBTd;w@Yzbw&OZ?{d?5exyg zLqBVvUWqPbQK91TCo4@3uP4qQoqPsVifH&2_{f32 z+#Q3IW=wDzP8?o0^5P<}%SIww%gT$9QXxH7;Mh#M4&zS46AC>yiYxbnNn5iSh0?&w%<)iS5XP#4 zuTi8G(}t?Kq2U0g_@cJeJljZx;FEY~09dUyK(on}?T6!6feRJ>dk*?!-WU&oERDLM52jC7^KxP6>n0IFyDibp#!5 zJ6fZ;V+H~vS;em@1y1styqZtCphvXE6>WO@FU{rVnhYGi5QYOvSU+otK;2RrIlp%x{x=llqj@RVxY}=Ixk8f3)gLhL-=sS zFip5?NJ9_@uhg5p(7evrkxJH66y&gF6El}-{W7z!b`ECil20)pQiQ&w#`Mll$LOUQo5AVs&3hPU?x(P3 z@{&&&Hp^{{u=4Sqs*D~58ksa~EJth4|1F}o+7o=LYW9v}L(ASgy|;&H$6vewlg7;Y zuj?(BKbP1JVykboo?h4M$n-*Rc3={lHMsR6;a#s*S1-3cig}JCgXfD^37j9hlt+m~ zE`uvsnbcf`>TI_5Tw6=%(j*Sa-tH!qObIcM=Lj1e+sts zGmG)t1y*0T9*TWdlHJwdPq`;GlFrdu^NjPzRO@{de|6Slxor9ZJ1Vz14Xnnrk&kQy z;n#y6!WnbdXHc@7mBPyvy!-8D4oIc?r0Lo|g#y1XHe&Y+7A2j|=+Oy%-^1n6aOTxv zeYWW|zdgFFnc{E>xm~B}Plx^Fw?@`9)$jeMjq8J!Ft_@PMO7_!doV{?+TZfjtzY|k zcAd{!8I*GS{ZTW!7vxE+?Y6W#y?aOJ8VRMjdNZ8%9swR=m_G|MASz3m z>P;6QdfWzlFRmX^>q}DHhFv-CM~BU|e9sR6PT+FPaduW_L+O=mZ%yd{#LJU+&Q0O# z@b<2Qs`kmmIbHWl1%h==!)dUgXFIE*xi@iu!R zYPTE&y%CG0YJh?K7aX&)f%L3qa;D2DQI2NFrE|#CHyjiU(LE}Pp3o)?d{R;B06K9$ zaI?%3A+4BeU+Ma!_k>p~*Y`Gl3O6VWMVN6w@M4)4CxC~;;8*Te;gj}knNrpPBrH6~ z&>`JvAUj^y`M1)Ajw}NLv?n>4M7?V%lJ#ClJxr<>jubeS6im}37bgFc7?LU}MOO|* zaqwBdm-`6Teo0cf+fMMP7eIjs^%OevY&;MvD&7DL4pNGS)9@fYt-m?kB}fJ|0P$NS zMVge#bXJB`8-#yu#qdn1KFN@cAD9V-oB|0IL`nn37EQ)ni)zMA2_k+~)^v2eB|>unzp))8$2v?YWx}%VrL(!3S;Alx6FQ zG3}87s?nD?BR}=@=AJeClbg^6?N)3#FK{GQoGGZC9Wy#iWSCbDm{(y(nqR11&|R^G z58d|LdUVnTdHr`249BqFmoV!7-;|p-6U{{wMjHc&w|j`b8UAlGBOWK$y}`FNVUp_h zd5Qb1ssroe+Qhjt3j&TXsad^9=FfFz8ljc7?U8Za=Hz2nTXGrAX}xcSvZr+T2G07Z zgx~)*xLy4qGxav7@v7}22BL+-Z35DJ{TC<_xZkV?tTGU zuM9peLO+H^7>so-Ip1YHx4(NPxZO|j6u3{>z7E$_9pByNm>nqyU%R8yIb2EXd!J+k zoaTI5>^uUqA^*z)GN1kbWoL0Vhn8|)m@l>4?;WgUPZVS74HEul%5}Botgq~qAyyBd zq_Ee12HSZX8qocmd%j=sf3!1`v*}AgQ4qMs`+D;&Z8Tmmlc_#<-B9d`a&(N4@9bD> zeFoBLxjYGJpLqEjN;#K8aafdG$;cPCKpA6ln8p3EMA#i%OiJ2fyFR7E&>Pay~b%-9rKxK^NlqrlrLV+yY#&S3`MR>a2!)pQ{Kk^L6G5oh@_a$br7v0LY~ z_dHj*lOQktUM8qK;8&y+HDJzWRi(IeGb9#Ho0rV7s8BsV*B?6a#r1o&EF-^@m?kTP zA?pa8Z|Lop0-lVP7+e7fz@wuQ!sU?3jIwxM!(j|wtOAjqd3RP}*7ebV%0Ig~K$v*{ zoY!g!<6om_Y>cp1rpow)Wv~WOaqM(u11L;5WmDs#t+Xep1RE0fECBi4xdL=Y^d3YT z8UZsz5U&8dROEQRc-1O2BFPEODFd^GK?qX;a-YcgUS(xvrGHs&XN*mcJ@~Eh3k>X~ zHX_P&Wk#Q}y5Yn~De$S4S}!;KL4vISxmUp?8gb?gOHCoAu7O;EFS)nHgT2Y*;HD00 zno&&~UO~z5&JeV+%#5GB*>$M!iJIpgrY4ycYzt)00uBQIZy_`Ylbw{XbeaR+r;JLA#G^<^kA*tm=V&eA{uXPES*+?NdIc@YJ+h9`)gw5N3Mvlq?9Mont?xiC`!`# zz~3)y=3|TVW&OlHPovd&E)f%h2;hz2a6Xf3u;S+A51VBaK?Rk|9%JU`DnMlixbqD*kslCky#k4Ed6?_`-5`} z(_cBy9S^0<8h&?@G>cB<3sJ~643YU9KQ%k;dX zdZ#Jx>^<4Ip(-{KFSO)3%lz#$xmrv$f5XTc=^Hxoo>2xD2I59ZM2UnxLtM}5z!8QK z3f;g-Rjd66^s-4~Y8l29O(Lgw^P8OP6FK7w$CU#21PqmqId2&Vc+(s(xJTO>jJbDH zBe}H1ZR(=DlaZr+*2+t@OAJy#pH`vayRcRE;70SQKXe){n2POAW79R&O zr1?*|Ge+H2yW_(HT5#{e+(uc?=h;MEa|Ba*Ly5a6hfegb=|k zt?S6U#BGFkA)Yzu57aV-MV?Kh4-fUa0NTw$$fJAr&QnHMo|{|>yzb%RH@CxA9}t)n_j<(H~O#2B{x$P2^pv8vtM*X8E(s=Bsz=9oCn zK3_t_81BF-HLAlWMvXf)uVq^m##hn#01ByYs!V&Ya_9 zU@-YO`jF5X3Hivs7QR<1)9-w}L@*Wexq1?PCN@_WCPy3E%pC0jPP>k%Yu#_ruM2(q zlOIX*VNAhKZ#lwW0W$mcU%Cj%>K-?coVR0w?(cu~@CFY}ys zrUx}4Psbqj%VZItN3+P9nFehCeA0-x|D9eJ>eeI{t?jO38R#?KW}ah-{7$5bcXPP{ zQQK1+=a7hcYTQJ&Hx>AGu8)l5)~q6jvb^7@eqWo?F)ODYn3 zpv4=a#*L^+JYfui3}~72zdkABdxgJq3YU@$pBHY~suZ#UNB(6dXJ_=B6Y|LqK{>^= zCzo-o7oY?OP{C~R^?(D1bQ=8DkD3jPOw^VK=!gS4Va|sGpcKf8;>9n>;eM?fdU_{vcI1$FqxS^km zB4_6W$l4R`@@Iq_GIZGjSOg|083L5%sLYYh{V}VRNXU{oC=@#rnNbz@5+qkb7P#)1 zS6T}(!S4ELe0}-(zW$N^P$4l3;US+d_wttzopzNFk1c>+R>C_*tm2Qf{L5U07+Jds z84B*aV*ix>{y{w(=%Qe;0OAFR(H!UNO79oU*pi%6Zkis5Ek+I+mTNmfqtUsJYtj&+ zbqMo3xI^%qiUwc{gv?pI9-G%hZx83Ck2SP$YFdWgG)A90e7=W5!n@YoSLk;HxLLRT z2%jrfLQ|`TY(<~_$|`?1L}`YC0yMO{zLq_xV8A>Zrt`%{T`=U;?}6z>kEmcOlH4e2 zwj<#_W5tW(CN0vn7FXP78wTcLQbkV<##gG6X8wZm`6<>Jd*h)dX`8JVzD!#Bv@bia z#Bd{GNmW@`sfcP^&IVsg*mu3nY2S_Ure>WM7hZ)p7`7ARzet!)P0fd|OZ+<2EeglK zue%cYH%EjRB)7Tz9{)uhzI(TuKWa<3xhi2}?S`P1<|AJ2=Zxqb`ljZNUN~0Uc+}%I z867^PcU>-OUHG_>wm&g+L}u9X=AJ~TaF$MH556^@b4#(xzXCAbeloBS$zG^{=%HvBKg1b4*+HT<>0N00i~7ExPZI=QRmk!(Mb=5*lu`T1Fuh z#PrhylZr=)hT_olRjS9@DWq*DpWHq|)2h>#8ZUYOWP3!*rIB<&>Tlsp%kBAUBXSu% zU!N->>lA*bO9wm3hnclxr{0N+Tj46Ei~%S>a>sEJ$H7$8L|F7hib`kinEN7}?IjZd zmihAZ1z?yElKiXVjD(UO@pw;?;5mL-#i+NROBnb z&4nP}V~K*XG58v!C4o(_m3^2i6>_E?ciIDO8Es5ej^j8#>cXfeBdMz7J#GRa+g{CE z@2;M|1V|-ZoX#2jra=+;ry&L293|YFUfVH$&kIeNivp6?DMwlEsLGL=-QI)*twZm~Ozv0}*R z4q%4kSg|X`fn}_;A=W_5Tfnp^9f1OG2bG`91Rl#3ea}p1E?o&ecfMxU&;2(ujqAp{ z7_x$8#uM*n4(|Ow-3Z!mDZWn3?To$yf!8tVkM#xanM>4KZ%6!ZO$j#YQms@8aB;8O z-P!0Zk(H1ShT}|jQs}GJx}u!W!un%Cl7=}NUqh#=cG^?vGu>1ob+|4MhqAhjcq+b; zdcBNT9ldd7-aPkjUHM)P-3k(ZXL%nxsZZi6K41O*IZ0Sb3&@7v>exEwQ-kR{fftp- zx)v>$?Hshy>0Ux-^DhuD;9WnHH|%PjwO zpW_+4k^4Bl!ING`Ufi4wghEQk(=}O5E^89dcemSF)EVcz*1;@s)^s+S5k))S@a|iv zX+d8B;|#b=PP>D^CF|84_CVE>7>N^Y%?=L;-dxWt|F5^-7pJZ9{?66XT^P3j&DW6s z;{uc#S2VADw{dbl#EmoBe4M5UpA45+`#p1ld^co8o>acNH=UAjq{z6^7rY61iy9$^ zDLz4Gp#3WRg>=^ZqrDNcdWckSDVk1^)wIhJDoGxk-B>Z9*(IY~hy{^nIha30;$bS* zdamqc_x(MKTU$zfcH2)3rQmHB=JtXke1z_i4Yf}0(uAqmxTLJ<1dlr7$4J7g{o!!X zR5KyDgdYV56JYXagMD*v(C2^EoaP}5BqI~p0D<0G;KEuwE&#0F>~I}Px5ui7{mDx$7rlMX+=ds)Di{bi_z&x8JOa@p?gJmE&3UZzv3-M zw44RpA^$?fLR&qUa|}+6`|pdJC6*>9%a=OS@(hxwPYJH+GQ*Y1)vRWOeGi@5iLcok zd}AyI?JXAv>pwu!QZoK*8u0HbQ-WKqo=^I-9&AxvYvIirQ>f+z0Z&iFNNhVv{VbVD z45#Y)_nS#_e3&rT(fbjD`>+P8T3-CKa3U<8>_V>p#p`no{EaCSA;GyeCOvSxO~fP|*lJo~CXoL`ss4^GKPCCOM=bm1s8p|PQ?u(-Q51%kxQT}ud(g_uYa}h^zZ`Q7gq$;su4^o0Us?4vbNaGA= zh}04Q1Pz(;4K!Q<_>dH;B=SC9av;i)gRHpB0!s8XExNw~m#iwDv5}~Kc@VO=vnql# zy>z+ES%~;`Z_2luI^_4K;&(78WTjelFBgjZYMpfD|3r24uJmlaPANvL~+(rh!<}x?6Y(GJ0)4 z+BCT-Nu;i3IxNLPMT$NSUwEO*><9!3cpaCrrg?b78_f?jTgmgu%!}Xy=E6H%gkgv( zSaUZ2N=bIP*t^pW8C(KcOIA8=FLar8ZP}CIMAwHtw4f9YCwqiCN<}ir-_MCYU;pCr zQq)@B+M0IR(_gU~?X9?oOh5Dnn^=i#k4GXu^&+3==9;XSF^P2sxaX2pnUFr6xNRWf zj)a>lT74JJbR#5Ekz(hAph*B13*QYRP#HMH9O^sy?}yh-Y1~Z@q`zKEXQYuJhi81z zgJ@GXE`4VgQyfTE>9yH`ON$5|cZ^f4S}?h!3clp#gYX?aq0l@6({{yP%Z6QX`>NPV zo1><;hp!dH6)!I@_6GZO)Ib}J;M-SBbT&({ss?>2&+J5N&%JL-ju%AK@uW}{WZ_7G z?)m2xi%2zO4VA-_9?jN@p$Y4BSD461>Ay?-fdlItqrQ*V=zsr!j#gXk1&2y7B46>Q zx#jRkr{7I^kefJqs+$FB@+P!p-QAy&cGJb3ot-bc|NNEx53Au#HzMCSI~;+z46{MA zZ;JkjOvQq=5}NsQkqPaL^6f78WznnWLB|GI7fSzwD2aq6hCMNcD9C_TQv^)sB@+V^ z-e@)yj1!bJ>~no@kFs8hS{G}v&ovwq+4l7$$z4~Qnn0^@`|AG&W!%Ymf7|;3qi8Ge zFECeq1nvU}CG+jqv|(lV5*xU!4+T?Xou!Pu|Jb)OZaCYtwn|@S@d&b|)#=qGBmh!h z+cOHf_`^{gd0N}+9kSo8OWOOas&|1T*f}=RHAet@1Yj%EPIym7kogaj4TMN#Ue z(z$0~CFr_y0c9)-k+tsFTa9yDuEw5LSz&g3S4?Rg(`E$0fyM+Vn4wUJECV>T(El)E zviFd2?RygFJjXB5ls46KNQLEYd@sGCs$|(>wcQyKQJ^g&*c;JtKHZ$vdRnf|QnMT` zs0?f10TdTH*%WmkRLIBuqJ-+Fy!8p3-$T zOwpR~WHTa;h{Bm2%shddj%H^XrikjTL=c|2XWy*sbWrV)eOEr0p{mH6 zoXzXD{IBEDRtL2Jxle3ZM<=fi!R!4U+uB#X*NPrA8KsRZD;H06IPOL+bm4iSfJhVx z!vX+*PYA9FF>adUbAer=kS%O(o-9e&k-Jp6;?zF~9gV*xa|WjKuc)+bG@$t z_2eL{nmx3_KJLHDQ;f$i(G@>4x<5FDfo}>_QHA*&>@RNFT$-Oz>zr}mFYvEdN~Tz< z@5U`NHtp++_!71(OeP#meA{@ti~%KQ&Y7B>w?O_k@2N~q%ODIME1^vn8>5nfuY^@w zUQpUmlBFI!YGRTd(N;H~bnRY6Gw@oTYLZ`a0C_o+8{Pqpf63S%(etkRY?A9Ge>QK* ze*o9CG$mV1Xt6rdEqbJxs5NGkD^ci6bRw11R@hO zF{^;Ag76WN^NE1{<8*3;B64345O8~Hq`~`8h()kN5iocqQXSuOiXIl>A8J3jm9HtZ zT?v)-y6U2)mbLj_8hM60Y?9}^U&Uk=^q26?G^fj0ztcP>Q54i5J$HL})7%_*va<{O z`MB@lan|Fgiyfwo#4Ri>kGt-t4+43w54PX0jNh`-#k9Tkq08&VW81PdNI#OU8u@yp z6#3GeQK{L!84{nEl|FffK7`q}A?Li$q~YB>{vPRw@Y#_>(wBR~&@d*d6No#N8bq4s z?GOF+5W{9+-S*0>3AQq|4R@=N*sEHj03&avQ@wz6g1r!#r*ufxH>#{eZq3QsmNfb3 z4?*R_$3AEU?1_)b9rx`i)#s~NijILF>i9!GL_563V3ML(*xKd09>c|gr$kLq^)NeQ z(iuGboBMK4GVTikkG}euO;eyR>{>g%-2HoMT*So!Q~L82qE}Qj*{3F5q(0QDJo9Hw zVo2-n+s-QQ8-iv2N3ukFqmiF~uuO7&p@h>_s69NAj&VQhlF$!c5&NN$!}S@7f~omU z#lW9uF5PI9x;>Yof;cgDjq=ng%FT^}{- ze}QMZKX~k}PV4rfY*ydy2o>5&FJ=X07`w9fVw-tw13`C8i-EzXjjj zk2wav=C()%!8ew&UMp5vn_Xy#pI#7F&u(~0ng7@y)V zk##OHVlV_Tc~Z>_;F62^Qzk@Pb!R}cyoL2lRr3aC`A871D2$n!@2sjE4Ix2VgI?^E z$Mz^jm@CZMT$MBu0Q^|SQlKtlg_JW+M)A zv~$7l(_|yaOk8A5@Bz*}q0Ja?Z$Cuu@@BbAHV|b`z0LZh9-00hDe(65FG(fKkOu2Cm7pbGQOZxIU>Xs=oDk)3qa@TJ`BMQ z>u()AaP_AnPK1_68e~i5hX=_P-DnSNYBjLcyp9#{_E|Xt6I>ex)fr=)VF#qQ<)uv^ z-MkKA9I9*GfoHLlQmukPXIo-X6-FevsP!J#0;O;yDN;?fxh#Gvm%oTU-Lj!TYa(PE zIY<@0xTfwI2DpXE#1o8f_lq|@N2)i!|N8!rOpvtfIhi&uh~?>%6w?M@91k37#LQ2m zD6*N-Fy|XnZNNxPWj8p;2s@Pz-@%bP_}U$ zi9pC4h!qZ*XRyJ{*YT6CjuOvDIV$GSoYyB`t1`%uMIIY-Ay=CTvEi6T=0yo1_XT_C zKU4MmE(bCtI~{1>()5fStR7i+6>~!!ClJa6YYL$wG{BeGC%Q}V@Ty46=&+GkbR^N+ zEnW}dFi*07Wunm|P_t3>XG{WVpOri#MNoYtvK+N0Gx7O-`6;I+Zk?NF{oLO~c z4zc%3!n+uKt`f=3-~lf$#>kmhwKRIKe1w2FRcB0RhBs{KnO|n*keW{L6)kJ5FiWHy zAdpHK%U&+8%tM-NWtH}>d0qLx-N5Slls z-@7PWnbJnF5HFvSgM8YHEnBmd%;$IDs-$J)IM#^}ocgKuu_Ck>7YnM@oB=B=I5G)) zfZMq;D6iDfiPU0Xg&Z&|IJ&$<`SeXKelbZInzT2#4*d`M));=g8o^)vbG9AC-Hk%A&gbjM4 z@_Ip`ABm0#d6?7$uGA4`SsQ-Dy6?tWLf*O(4)>`3Bp&=QM#fc_M3D@{cCSEUQOIL^bzI3ovJs>3 zdW63ad-R@QR?_IS&off>Ab_$PgSDnQzT+^0K|uNjHBXgP%jV{E@96#EX@nP{2Afr* zVRXHQeii+KT}M7LGE>M67Sn4oKN>gv@`N!|jmwHD62;<*LH+?L|5c7YJ(2%ZnZgkdoES-pbby|Q2QO-Dm>QUD>+R; zfRV_qF&YU$XN}IaB!@PG*qq9vsSPC~c?g57P{D;TYx zk`VM0d4HPzbKwW5@Mw$wtr&B~NFV(Jp==QfDO;9DfyGu+1d5;iQ&dJh{YzDGN}uQU zE?s!fCIOwS(Hv2fX0UtKJu3zQ9Ja$ig%ZsZt_oQ$yPDS|3@_v|I-eo`2h@7b%Zvuc zo-rR^E!f880x!JZ2uYb8RI3uKnor7MIrtZH6qRh;B~iAAfbq-+)GMlj$l!~Y2)!nv zb+C33giW^$>|?TPSXhbmrdY?Yd{uXn3M9fG-^&-d{$POLpPOGOLZPK^OIcWW;TZ~> zZ+btu!jm8Dka1dDZ;5XxDqze+YjEYW-GO9ZxOI3>+_e7)#3jXX5nAS#6}w-&Dcry- zY#@RalFbc%G*D<7+GS9LkJK&q5g*krgRH!)Ui)krN8nlRRMPsWh>UH8npc{v3><)A zk=Y}%;h9(+3w54G7=6MLQ%{3eM->DcFNnT9HY7|9jFz-A4QdW9ST4=oijEL%@H`GW zU34-?)|0kzLBDVOTsdx4*8jpH7r_sE?tg9*#@zN+Tg2dv$#=o`7t}%|oi%(zLYZE^ zX!D!Zs5?UQxd5%Gz&ANr#&=lpEWkj1cF0u1mOW47epFfSVyBQNW*)}&1B`zm94&}9 z`cdC49Wxtt+Qm>L4hsNhM)2wF_YN`JA~Ph?&P2d^EhCZrWjHy?T{LaTvbdiQw~KG` zhbG9>3_X49b#JA~ZMS&_GNTN};+%b~9gefG3^f({8(#ZXD+^bC(+6GI4kS5{P)Yup zLPe(=q;$N+%v!5+l82a8>G_N=e%~6#I)&&_uu-;bJ!Xp1d7d;;7DwpRjwb!=GSq;HvnsHx!VwYwny8O{*;7qF ze6tIbtVm=HVOl2jd>7r+de~IS&`CgIeAGM^w-dYu#T&7T{aN)NlNJc`e{dlC2PkV_ zkQ<)y%Umx#iB&O1S+MNRW;Dw8kW6#ZZGpM*>UQD}7){tjEC}cy$l|82<$Y5)x9n*I zRVK6W01N%hQ+_O^qTm(nhScH8VH!rZgL)ZFC?$rMEz_5|f@sJnjxj^pq}g^@<{??8 zP;nxBs!Z4sv$@2)XyNdi$VzGgAyZkTbdY0v6d2Q$30lYHD~#;&3A3jGFC@`QId}CB zPBbFr)eOjQ87-m;e#A%Ywf~QoZX+OG{tM2xJW+5Z@L%fQj0PccOgpTE_#`-^uanVw zQk!hqWez-`N4VwccBBe9BWYm9n@CTEZ9?q>f4^t8y~D;Fv)wzcxqmHLIw_=KhX6B4 zfk`n1l29j-P(uSuWE!NTTkx7%nxDEmHT>va>j~elnxE_4>1%7RYX-*kHfU*A6Vb~J zm?N>HiRKNEAX(G+(z3jGeq}psbY=r>Rgykm7y(rKDs}|0~R$OxOHd za*AD0a;<~+uQd}gDVu_YUwuDzD-#0)hOALL&)Kixsfni#apiso{~GN&kBF#9O~;A0 zt14YpEJIhh8GhW$!mHvrM(|!Edi;R= zsz)&iban}X)5tw8fiv4fokP3ojh?hxX`w;#L_fm>s%QLlzY*u|S&eq7AysjLS9pMF z(v4e2zWc+$!Was}kTay*4eP4q!|P+u`24$DuFCEaY@mWXMgP(5#Rg5KAX&wvQOjqC zGfBk0(|FjZUQf`MK*0;O&HiPmuoZwO?fHypgF#5J!U!Vc7ZW(e&puUFFshx zJxK!x;vD-T4iyph* z8V`zfZK>5jXGD`;oLm!*#za>6=>kdEEOtmZ9cDDTRsQzbVlQXrePz#`u_J2nScZ#w zJuqhvFr^o2Suofd=;3^+)O#s%2joh2pQCTm6O17nqmRF#m1L@hP|pWyzZcuR$EuW` zwF^=R2?8KCacU{g1-Jhr|mMu8;@bR138G7hz=@>xw!RnM3#a4}lBTBI&R z*!6pWbZU#{&%>t&nFfiTgPaYN#7nkBPxoq;G=%Vl7#xP4G~) z;?(-U+ihWtuUz+8Zp#;$v5r?tSi<-Z=dlXy;+iYs^SD{{3%I>XEgcOyc^yYevKuOL z8ONReqtlk0Edbu+b=<;r+&_V8*s}O0dZ8RMgPgU(lL|@_4@aAq4u*ok9O{CY#PtY5 z{!>z-x(lhS#sKUGX9B%mF7Aat`hu}Js*Y!mI&Ud_&Z0&n^bS=n&nRqY_0pe9E6%}Y zf5FhyMe;hDBMr~d`g>)_^*8QgqbA)oRMVf$NJs#>KStD%3i)+i0%1?sqtCiH6epg| zNi{j%!LT&?IJG!e=1m(eBTML=V*CUFh%1=n!@+yfixsdmhIjz2PslZ?Nf5c9I7@3d zrkKz;QxF+c2pKK8LIKESasrh-g zA_rJAl8N*hH=+!4ZuCWHQICRI4k6kI4CoMxp_mq-2mZe(HG&fHm&8yIbHao)|3tw_ zrOcsSAgY6o-u~7}phAnt0G^=KxN8>vpz0tR!S`zgqgqOKTncGzXQIhhduI4VmO zNfC9M6>Km4<@*PY#~-Jj1olOxqFA_u5|}F@K_Z58EY*sbFvSf;85y3utG+~Zz|PeW zG@sEdW~J@8e>AE|9S(*>ZBu_baTT;EYNOs&4MF8x4SNLdV2!!XC2~xHAk4%`+mk9k{_ej zWcYPwW;TJSd29Z2>=_BUKmkSuL%}4x*WQ)m1h#kJx7sQnR0HxGy#y`D0T2Nbfff&L z>oxq#E^z#@-67y#P_$4JmN_1*6B9D3);>;d{XH&0?i zO3_D0M9)&(QOaHB!S!>jh~yz#RHu0N>;)pk#}30jW>K-VF<>|vHc{2en)Vd`bqdXG zDbJ~uF}y}QrK7*Qs+vFrBKgKe$_o`kj{L4`Qw-fA3`sORxb-aANV}Mf?e6(sLpjY>8PBk`pt`@Hy4^33r@2GKo`FZWv9#teDo;cFYa6;M6zP=}=>*TAd(L&}mq8 ziNlUnpQZ>iB?-tcbE&H({a*v97AY>$OX zMfX~>O#Towq&I7emI$rplsl~B%3tUzD)Zm*B&oIN>yLXDK^B?76|Ya173fx_zRx}i z-D#kX<3FRrnBYaE{rcIFM{43LYKc1@o`}@yy3f~1`udvI_c`KWXv@&> z`+EnWV)Kw#`qB~srB^m3<>(!IWD_W&&PiMNT#50@sgh-2=TG?)SoaNva#fH*C|5tU zv}NwiXPSR*YO<2>FXlOt|JpM$W=E$Jk+~u(W|9UjnSONlr&-m26E(4tp;%j4Y?IJ7 z(&&%1Y!m4A>?_iaz9I=NCWzrBbrm;JWKZmo_BsEpr?idwpKII8kza)t2ECTu(H>!a z=&V@QYtmt+PN;rZg3Dr~9HC!yxna6*w#B53V_C$&G~jVNMTZdxihTcN^BW8f_YRc6 zW_;e>a~kGA0_eq(^eD4`4xRhZPtbf0N3QR?Y7&C}cNyJ%x=#P&+E$c&QDdrlx{v6Q zMW?M3+R~C4YA=Dw%`)0tXy@5=~$;}Y(jH6Ot}KHg8tQew%{{3vpbZV|o$ z^}ft)yqszHk81p=%!tT{ZhD&n|9eL|ga-v$0WXg4k&p!EfdYcQQl#$a7ja=Y6e>Y` z5#CmrUBqdtMXE+4@(CRUFVkFnSz-d3JkG8VC+Ot%0`ZiXJ^2Im|aJe){~MoHQ7Z1lcT1K7j|<;YZxQytZv4R)bX zPGR!E8j-JEWz`bCr^I#u$F1qt-RAw4T!~oE!Q+syH5A&>`AS1+W5UUk>z=qVRI;HJ zLudnLpF3FP6w3C6*=TJ`4`&Bws_mCey{=gZy$)bGpVWdYUCV_UQ-o1R$&%6ry`cX@ zY!$;~&5+F>Vb0TBAD;sgI`;&mmHx*tjU2Ee1mV-+$m#Jv=C1uBPem2)dHrAH-)6{# zq3qrsDBCOL?=ZiwTd}Zljw`M#SO+DcNdM@V7C9f-^x*)NHP9{ZhY?ByRfIQ1FQ8 zSG|@LcxcFG1pLEqvjW16N&Lp>GHW)6%>9lSS{6s3L1HRZe4aA}k0%6qq*ACtwIqv0 zjB&@%HQeqp-EEIK5eZD3bcM=6W36ipUZqIVDihAr{DTeF&?tMmJqz)wr_RaaWkeN} zn~Rh5zbEA%2no$*rdAH7@DC<-u1Qdldenb{_j}{rXVi+Jr%rz0hNnFp+Mj z`vbD0rjAIzK)?eBw!NPk#;{LzK3{zw;^>7vp^F;TIG5}Fszv$Egz18u(BgbwaeWTP z5d^*(TW>$|g*(C$l`wQ-zbwHmrzHK4j6a4UTW*5wzv8d?9E0YMF*ZYqIj$`Gq9npi zF+KlvBJL-9(EWiAl0|jogN}-#ZottU=~KnwJl@OG($p3*muC^WFW9r3>(RKqcJ86m(`3<{3-%a|x0XhmJi*iQqE9Or$df z0R&|c?s_6u(2yL8r3_Wsi&fW7x`~td@l1*EKqf#Tj}Q~YDNn*dzg_z7`;1ZTKD^=$ttvZ{`tb{ zw_Y005RIA)?sq4_AC8IF3D4?g;JSQZGT6YB;#hsCAcCn!fBOc0#-KM&PR*dk^>1$C zb=GVSbZ)z{(pSS?(V_eT}pu>#ogWA-QB&o6N(k5xEFVK*TT*FzxU2$CLc1BNzQNg zoZYjJgz4rOq#ZJ6Y|Zmjv}-ffr;SU#Td6|MM$-uU4tVGLUJHA}A1Q{?3%1R`w;~eEb}+9R185dP;7t`64fO0lT8hL>IU=uTSDc*9vNfGq0Z(TI#a)d_`ylj>cr4((o(r_$Gq8RPW>#*MiFw!QOgJ!X*NfsQ|{tb!s)y(4d;@XIaC zL3{B}&IfhMABQmklUbZXrY_Np^_!FN%)~`IIimFa`_qBH!TNOJ5mnXo78kE5Q*kQl z-!;NgF@nBK3qfwPiHNAMWR#SboAZ&&GM2ici5FoNiEsQ9TExLE5af-EgDH_uTKw(YoSPoOJ+`9r3OF~M5Z!;2tJ{%*g|JL~NK9$`jM3U-P{P-cE*@>C_?0M7`B zlS{gZ2r`3j)hi?SrkNbeZE_{+Vi}hmjISonAo&# z;pz3Fhsi%;=M_*`ZY&|agc36N$j7InGG15g{Ru3gQ!TK0`+%(7<;p2N) z5+7(Zb+RxvY66B4N>ri#{Xr~&`i|i8bgk9pHcYyX$5WfC`r2X;DE}?sT_Sv>BC%fr zfE(B6#3l21b)@~I7J8IC#lrsAC!6%&w&BSIDTS(V)jkneJCiDd!?M=%@T9`?xF{kk zD~md1EEHW-i6(_AkNs$^Y78MfLT2>PH`FoOB*fu;3S9YQaAnBsvv#Eezp8QMt8Doa z=%`OR{F|!hcsw6?KN9)iQK(|_-^M6yvIXs-^gKt99{virY0vHHO_*&Fl^k~@wi+}P z<3tLMO<*K8W*?FKa(9{Ib;b$45AF`?MZA=vuENtQmoka3 zB8;LrK5DaWy)Eqta%hdk>n}Hgs?tp6DevG1!FYEQD;f3Hu7N-OL z&7o!r!7KbRnZDW_TKvYvreiR^xVC0#Z!J13FRS^rsEHm$=$Y>Gc~Qm^^hT0>M&0`$ zAhJJrgFm&u6S-tt~XR=3FWLE3#|+-f1I$F zCpWlXF`uIoEIUDv`jGn|(RVCcnV4_OddCwVIXUrz zXIR2O_K+t2;gh7aSA%DQq!6{KU{e*WhiyVpRI)@j4@B@UbRr7V(sAa4=fyBFH;-M| z#So|I3p$N6f3z~W@{l`R+-G^i`dDna{zF+M@6pD2W z(E>>9=L_J~Z>qAx8Mhf)C}y14p)8e)(35?8?k`$Tfu&U>zfBR^VJ8=5j7vPsoYN(f zbRr}pHeVYpZiOA@mts|!z~Ygxx_jllO`Iod$qL0#=Mdr_1Zy^GeoejI{wHG2e{eHX zf=b?!psT$MxgjR{x6xq3ixH^nD(Q>EtlI zyn@NS`-KI0*(k-^upn`2{@o61}SE-sMI1N=!lOT!SSD|+iAJf)bw zQ#uix{_NMUn!pX^LO$B+(+3x3Ecz@7qlVfg7b;BX;~?9*=oA9}-vz!mhM-$$(tVfS z2hN35+47@#+h1qU??YEx12-ciM}(+E)RC#P22j>k>3R*;sswKMd`_{YvChkH?(@2Y zlpF;V@nkq|PWnNZQ?ZETi94-K?Ja{df2lS$XrKEHH%FF9FQ94R(bNEU}Q`OJs74CP}yq{sL@00&x zsr-!5;fuJDO6Z+?U{tofS*X!br=2R97>fiCao`~OLshRcpx&u0mm#4{zeq}=JyA#! z!?R)((ctLhL$r0d9Uo|_kQ2eMc|KxIUu;by^KMAW>=Ed$uCDkj8(^S&dT*teLYdJV zv_cTQzIuB;H(EeMVF`;rKl`JI)CA%43k=>*=otkTYX+i6kT9@?)Q44BbtXKeOjwty z0_R4+_Nv4pW1k;$89K7&ctm*HAEcj&tbP{-z{UB2SrdKVe>q#*SrsHlV-@)p!2?l@yV9*T&fnZf)c*Sm=#Dq($7PQjT!-;*U6eN5Y3`40=*h1(OloO;;>ro2T z)rF210%rggiKS6j9}EmYwO^4@E{K)eA6TTZ?tMiOaN5r<%(XDm8L#Yru!WOY;LlbXL-N+#XFy&;B}X*ciWU$<{r6a$ zcSx?pLh@7?2jzrYQf_Y8Jq+>#trgVZ!3KjKNslSmQ>*i;YBO#1a-csPrm0Hu>lSuB_~XSR0$&2c;D=F23Y+b zmn~QCxlHI2*6i2fa`^^G0}c@Q>we`VYh!_%DB@ytRN89UBd#+6kL$C~j}#&zH_%Ib zwdZZb*3S0?r6#-aukR;U{|FLD3XGS3)sn-jAjOvfm7kO{O<^=d(w58RPaqfRTxN=@Jt3WikF_Z9#dg0!q}b zzKz}+a{sq>k+CSR=jY2-SD{6l(6*P`hHuU75Ngk)h+$uniGZG|aRPNkRgL-oMo^Lz zXmy&)(83^4CO%(Ga?iDe_x9pyQ^wAZ z)5C9Dc`Bc8eBzwwd%KEh?R}Kne{f-R=_J7>F0~#{wcE^P(4uDaMSGyZZnd#sM zAxrlT@vR6++xZ3m`2*abHIGb_@;a3y zCCrfr`QLfRKPWY~F)Le`z~+Z@hTIVmD`Eg9rydd2v#7p4d{vB_XsD}-ZkCAoGF|?+ zqYfp&J^u8S!#tx2SSN`Pkzzq(S;=B{6fVDu+ia!=Y302G#lVKL9uIA)l*s!_jPjib zVg-UCK7vl(MaEPusI(K5=X3QB`1W*l6!GMjVdKz|E?XQs7iqe?uA`iLUQ*MNt4I?k zoib0b9Eav4L^Lhs&9c4SfpNjV?sSwV*n1^M;(1N(Zs@{1iQGEw)FXacBg6{s%#rrq zf0Ke=U5kV_-f|yz-;mlrZ7Gr+vRyWvf6r0)y9x9@2Qhkmyik5A`2OSk9v=m{qT}q* z=I@f;So_C^&HI?)KSoSWdPzC%g3mm|LgU7SdS4gP6gk*g<7OnteADAWtH%POlAk^C zt+j5R`~xxY%8t&K@mVKc@%i``!g=PVzOlFkB7<2`TyZwKD|5O-f49ltf5C&5Q@@}f zyZD+SVkb1Vw1_@MaS8@_!w|EUO}GI4yc5TUxTuVe_bJ{`^NK~PRyw?xCtKO$iGZVq z?*spGiNE*PMsjirh<#HLX$}&N4E)#;i+?OI@wJWz)kxSV@UaTFCVW0zSY+W99FDHI zEYv%c)HbGWmdHGx)e8?seaJ~C2Q%9cW)YL_{jT^0bT$smdZ98gDRE6uPEww_n;SDa zUHx8J7w>dE!=CTCL#00gKWgsh?IQ!^%%@7x-QTWio_HoePl`oBzCEUV^Rl8Edv$y0 zSdltpw3%rx5&YP9O82#U#nv_8EvTQyvHx6=G(AW$>RCEEa|w%(7k)tsqm)IAE66Xd z_DP(&_*KOe!^X=wTGbpvX3WLQ%PzpYE`<%B)*Wf-A$&{ytx_0zD0F`AVZ5EkEzbgnInOH$w%v1u1@% zJ?M(R0sDC0+pf%AO;h9Yh?%D1IQa976-MA_Xl3|TIRgt6Lt>k(=J_$y;!vQH@2tY% zUxEJSflF-t!AK3a(dM3;!C#O_&0v9)iW-%*tCJz68-p|*pb%g1!@sjs94T-|$ z=HT^D?_1Vb?H|wXQ883!W#$%^^+f+;?diL>P0kbWnA`BnJv^jo(fWd#&}5}STQNm6 zFfFF!l}nrN8JhgloTuKQ0t5=8)ZZx8z~^78*H8DB;yuqAGj8mY&(pkZ?9PzeM^)Sc z;*xw^CcJFd792hKACdTj4-A5eX+@XwBAMrjBaZXRG{NioX?CHUen$E|=+6(_mzg^C zk7p5~KVywlR2U8XiwgW`K`C#j*GH_x6cn(CO49svTz>l5eJQbmH$d4a<-rqgcae$$ zfk0X^MzTHGd~a`3aX|1X;;_v0^*48=*zURRt z|GiF*eiAOa#+3tPm43F->i?r5O+5TbpQ95}(N!34~w~ z@{`ciT4*Tm$#qrMP*)qsPM1a@=9hC*B3^5^qu53K`O}7u@$5)(i=Lr`1o;7(YcY)s z3Rc(YUYiu@POhnnUOFNIFE3YWuh@?i0-NsLHeS+6a6FV?E{)}hAuIdzF3VIT6a?0ITG<;jcQ-t`GD4=$kFss*$~rle zpLQ~|ClL6TYK^RaL=x8Z;=rpK@mHT&mzUEVi*U-WGwx;EI28Kb>2hRI(W($z+#M3< zo}3+7dhkx#=vG$OmDF%ejgI0~_`HFfrrn5yJ)@!FQRX|!^W18gbA{GML<2}|baju{ zn}%AZu%+A<|91R0w)SEny@?34Og-O+_?!-Sf&VyF2}tXG?f?93_%Z2sF0e3iB2!RI z3!#?%WAc%C{jLi22I*?6fBEArCI7PUDc0)SDfq|YuU1N&)X^sy4p%}I~O6{AlKjbKX36ag?>YW#VPFSEZq6WK#ll^ zG_=Q-_OSTZ=PqyB?e4_1J`s4wq`QCezGoR`7Pq%YBzp#z$8#$xy57wd?di2Qr@X8< z!HpbsJZ%<~l!3Bk{BQA~ExffgFey)^C*c@>uP(KouWnkk86H8vV?TfSf{c+M&T>Y{ z1vChqV*bwOeMlr^;l0vo$2=QJRyGlo9x1gF@JvR1@Kq5tfz#hU_p!CssAXFEA5#Xr zIKRz9p!jl^1mO*OAszcmr?J`v$Hoo1t*OLSB=Af(7*)#h4fG9E4+oW=feNP4-~ zBcqb&)ZMVPPTgC*X+Rf-8P#Yv?yYOBFayGZN6p(^*Ce2*%j@il%w22K?%0^o@4S^G z7lX}R%V!eQ{0xDg?SJ2N5vPEPqiwz~IN2M5rlqfv-R5rqil|tbAzyXw=u;J=&u?o# z11;xHzW8-hPOwhQ&aF$DNl{x&J*w;KifL#N`zzzGO~l1it#GRbhSS=R^3~84!L+P=ACs4Tb(Wj!KDgx*xqQcNiI^U3nX0}p_3Yv zUWpOFS1OQZ2JyrTnCYbn$@G#v@`&2l)|OgJ{M9r#u#ys;&X-6%i-~=C$c5^JtqU6o zwOw;b1`yf#@{wE5tU(2UIy^i?>u)KZ)h$V-Ac(_A0L#|AQ(eNtf$`&X@UdBv_ zymugklTS}!Dtum7+V-xgq;`PYQ*%C3dhcs!>J+}QFsGo;nS0mzQpBH z<{1>Xb;gIMo10V;TDD+`{vbf#Ba1-}b5mon+T7F!GU^J^)g~5|)SjZ#ub-J#^M;aV8qAgxoH%Af@4quW?M z*|~HXO^*AVUAzRIo4Pa*`i1@C=Zq{3@%c*gRJ%f%;h<6uib}0cw$ZR?l3>csReyNT z$;G}s_%cMqP~l(#c5+<8)3M@zb*-WsC5VQ3u@oFtLZyh^5m+D@#ym?{rkrMbJT2|$ zh*|cTSvf@|B^jwJ+%535sOoQ7&aHh7oIx3-xTzSp%Thhm!)!}dD@t^4U2$g?C$E(H zyVEagH;+T>sPgao*FC;pK^Fj}pHkCv3nRU+iYNquEyBXNsjPLHZ{S zB$05it?ftbiGIuBP>WMR>!2fdOadBNH;EVfZYee~;xAEK_W|#-u&nNMS{7)m(JK#h zDUzUf!k^-1T#3GCSbH5&&R8i}AZB?HGmD0&)U6WXW*0{h*nK2QYg<7= zMmJ@~XcEA}$a0}5rC z0-TVMQG~KbA$&L3r}XB>GFG?Y5|$S@d@mj7{+@}6xzoh-1e}O5=w4r&@%H*}7Bp}` z|IrtVBZR6KM@skJ)#noW(oC^GDUtoV<=`T!ZwNg*5P}?5tPuSLGV2;L4lB89Vfgc0JSus5$J=05B3r8&^+Y6J3fWL7YWChFHg(#tZ+HL%a-^yZUB=QS zGOBX;mJm^F3Y4HZ*%1VIM-1jt^xVv>0Q!lFWc5NfoKO?>mi|!^aUB1$>O3gBh3Q*m z>Fkw4HhE>>7&IVEJljMjM!Zxpc^V5FXjIA?z#nMLNzaDP95w@0)jyc`o|9REiwO(e zVlr6x)F3 z1=Wk|Z2w)&W*3s5vyX6-HWTag0prIl0J1KxyInh)y-IEeqF?bQM=TcyICX2OupNk4 zaRWZAQU>W=@mN!&7Z6h5VJ+tgRf6^q(dx!_F$l=HpoA*xTiCJ+OGJ^+eo8`Y;kfi)Wgp9RH(vuIfD}W~=*kd{uMcRw z3_jLPXv3N6;osgGyLK$?{)1J%SkdJl;7BDL<}l?PCKos4{?dcj&@3$Zwr_i)s*9+a zO{Un*0f&wit;dB?%8r$)n|)+!RR^vNi1*>w#LyDQOk+(PGvN&0yM~ zd{&zt+l?c~ua{3VAR@c=jbZGkcP3rD63=q=nH*wO zXrXY3@$8a7k8M7b_Xk5LG7kE>jwh4DHXflNMeCEZ0&eEIlg8!-obdyx%`SS3D72WN z&C^LRY{!%%tN&`+*sDZa@Be{OA#as}i-7Iw0C2op0{!3dOiVPmc)1&`?)c{ez)qKh zCcehu;MR;RG)AkO?{@zgZ*RVttA0(<-6)!~VtQt#GyiePobot2rw&?;RX*;>I0v}K z8_5cr?+9GmQqeh+4o#)QCJU2B(vLhoQLUF1WuW{}+yjt`QQb$VjrwjBP4P>UT6#b+@EmrFH*?WF=18GR@mi>i0`>8D4f?zOj9Z;ie*XzD8z+>rzqw)<3mFL z5JW9j)&zx%3+KLX*qpFSb2C+nf})~Q(p0I~+m3Av1TmY4z>qpWE{R99Xx3J{Q<6F^ zTG->VEjTW&QKH@#KaY(d20Kx6;6uN#LVy=}OLDd^0AyGI$BblL?6={~&udp)+!Z=i z`~8@YPyXvyWbTJaBF`J@e9w2Mr53LFg};I71k^;Q1O#-9N}^w}t3XbtHq}wI#&pbR zz(T)J07TTV6s0QTDJr)*;$^_L7zfq!eTDGw^D|mP_urA}tvj)I+whkc>Yvp=laxjI z^Js8kQqxi!JAf(-j+NDPMuoizxCK5zZOA!zx!R^0CVbOw#7Es87gEg3$z!q%KgZ>0 zj%1msow|Yl@yhB3?iaWk!LZs{fG(^h{k01|4(?p)SIylDTt44tm^hmpo!lG?cjKgu zW&NlnB&rm828L57AzbWI{DRzau2aY386#a?p1H=Ju-qkCT%y>2C;jhGdm$D0;QPn$ z90zkJr~KUdsyc=}%VqR*^=$obm!hX!E-`XH8LAWK$gllqjt(Qe)s%@uq^WQ$-r9&^ zvcR7zXliNgb)bOsvR}fylu3jX{l3!@+k98k#id{qUj;-T7&q%R*i01anOo2RJxg=G zJ8Z<9c@ha;V<=5BQ~i;rlLMFK=H?ZS#nh=ILMYu03CV}Zwz|Ffo`UhxC21V?1GtKS zURkMrFf!9Q>MkDbKe~aj2A4ve6y3A$UQ-ouu|crDfCpKbWEIiHnLwqTr8vEml@)z! zJ8zPlg`8$8MIIZ+!SG7kKL)*>#=4?t@B=Y6JLo_k`LY@+3MsEps=XQh6(OyVi<%mt zT*jQwtvJUMCYb0si;Fg%*xb=JzdT&}&p7m>kVhtCeMfXtW$D>pIrUYO<*7;2CcZy^ z#;dC8EgWs((xNb#%Ern$?_G(F99_fXF9f1we3e~^%{^_?2_5`Uo$wuR7ZAFVIovNg zqkrD2L%~Rd2;~a{HQ9||=K`Aw ziW*&PPxK;ivd3JG@JR80%-3CLeod3ucDbMNhYKIc!n>@f1LciHS#|zGZBCtR>hWWa zKqWQuG!5_U2_R{1F>SMBEKX`UYmXcjz^NEyuaba?HsLbPV39%D6XH;};U2_dag5xyoPJ?TK z#9hmr6jpnrm^mtOgyOo8dg$PWkMfops3L4#2?{lF3bo)lv}0TCUfLT9cF97~PR(V_ zltnOEwy0GmFhNd?D}7m=^{5PqJlcEEW;Y6ES$|D=>!f5slUrTKU|>bV&y|=@{2=?G z%k$Z5l~A6(stW&=CAuN=LlBW5|$w>*w4Vw6jYAj4A-|K|#?E4v? zdrQnolvTRA)uzt~vuB;D={=F1oswcM;cgjagq4lmA?WClU4%2_2-Nj7^>p{|%0Gfk zk?|{HVlkcBf-&f?C1+zPWUUi%#7P$ZqtG2wT}h@eZ%}(#2x!d7dqdqDe%SNV$Ns3V z8D1whU;G!#nE>y+E=F1X5trTBGNuc)JUkE(s%l9!?j-v59o%%|G;sfyl;W0RA0iqe zCH;UxOnLDzv~Agu4rd0D+}|E(b7JU$Y~{%6(zE=1vyd3b@sf-h3dew;84Pl;#Wc(+ z6EveYAJ+7q4RV!hc;~8h-QS+Lih|9N^9d+WO}`5@a$M`W|AUs7R#q3upSB#E-T51OUZr{pEKx7R5Hx>HhYulhvjWq)H3L~EUD6K zODltci}qf^X-rRaIj&QTI7!t^?@_Xf$YFUaE32crZXYMTlwrcS;YeDH@i#n;7_-)b zgSe4Q*%yCNeLEqKi;Zy^kz4fDwKagV4wxGvON#&{#e_jg5?7?w(Fo(__Q18EMbJ!F z7Msq*p#tuSaK>N$7#apj;Bzj&SM+9(izT^sW}bz&FG(%&Je{z^6^P+L z6LYnDUqh_5w73{!IcB!WUm&O5wm;^%W^F-Q!jBTOWKR~osHrR7bAeh-P5G!z8Ab4o zPUS*C(nWz08F^7rQSr9_j#brgOV&;SGtDiH%9y3<151_Kg|mW*0nQv0qWrX!boi7B+OkWR6{6cSQm35A23oSOcv z$w`ASfAqF51a)>zWHcQ44D_#!kZ;~4dUlMSEBSR8ynXKq-p_>O9-ovHmxpisau58& z&d)7JMNrlXO8?!cwp(^!tGhfgxWL87yyCW~JQGbS@;v$&Gzwf_pASJ04Be?@t=6Hd9{wNIg%VdE#*-7Rx5r0QW%r?jlTvK6blpq!^^r6> zc^J7sDp_N|k8L=-*r&GctDmPF_~=hErdnU0?ja&^up{Lx-nn+z*5GF5DJTcas2r+r>sCaut9Nf|5GyBhCvWuXW_-;|Fu*HmG} zsVJEV!i_<{Gj3^bPmw*6HCxl^wa2dhbtm|5pTvOAIT=>4=|%7)Q*sz%Ux1%*)+Xn} ze|9?#ja)qRfb5(*)rbS}8H2q4OvWaDB0s>pYsg_(DwK#nAV^51yDyx1Eol*7dW1zC z-3oksrIp_Ed0v}E4-ru0SS+3j|D4|=5^|15&S`J7QWCM4&NH=iMbTKcU2V*oonvNe9p5HS3o4BOyJ%#QnRBN|991P2SM;J*+bG5x3@%4s_FxZw%~NkxW=Jx! zH_q&=A9ZcfsGiWsVl1+Yoyu3fSlftOuyTpF>+PZG`hPR#7?SVj?+iC@Kc%QU>cvALS@2jYs7j0JZn@{6!=o$!%EKTLh2eS3(ls$-R>ROwu2^T*X0aPV_7OJ`QZgh?zc zt)m~OlqJh1ju*Hth+)BQ9OV_XbQv-GE*FCuUc2m3LmoT#c3|_ve*pANEMW7kbdPfN zZ27Qwt1?rTR8bYPW~73Yl&IhdyYoF;J(2K`q@43e9&fWbTS6N`YNF;(;W1N0dQn8^ zB??JS;MX(2k}ju!Knxnx^j*V}aV&X~Y)2ovTJjUXfs!E&Q5=8~HR$n+0lm&BR_OL} z_$YtcpW^l<293Pm49$8sRAGK*epw;l6QY%2&@ZNrSrwb4F?8hqn5{E=yBl?58gsf= zlp@J|<8V@OatVC95B)F)Gq9I(-t&*-FhYfmM_}a7Z*C$%PY7gBsL)0{@_`_$_TIRi0ciI^M;emymmm}BKH%t1ex-TMC%a_1B-a_M0TPE4muAJE9Y{4zhm1k)69PtZDzqZ!nlg9G4*re2pb6r`&}2z&IoFW_T&(g`38Ta ztO$}NUm~-1QzjBrP;n3;4rAg++T6kN-`GZqlT4QL^2{I7*2@?CGK|=QGl*SB6dW6( zj`0eIa5g6*OP)A)u#`gA(u!x4I6PA9nD3IFscLz)holOJ21m{`44@jOPM0YHAf!tg zvxy6oe1o0?gx)u*8`oaRmZWM|qlp`RnYyC8b{hnIvncArt4U;WD7=PV9?L}f8Jv(B zf2~We*MPV)njsdXYH8z`pN>H-)G`YYEWPc+C^bXVHqs*zKPhU+40J@?A`?UpUGV5{ zY%Ef%cLgET4#BBu4J@FjM;^k7h5{U@*X`!y5f@fea0gul5Q@FeNldkiFqIIi z@xa_D8C5U%2%Ph7sc>ORwXPx5i@W-UhfhpiFn064X~E}i6r9HR7AdDdgAMI_+W({W zOY&&M*9J?Qyy*gVF&KE-bGaQFR&t^j47^k*a_rH}>UuQ5N&at4#4uM=S>68iBdx$h z4Axk9I#D?b4w}$vg%GqTJdT-ggfH^^$i>)y4sb9F(PVchzv7vx!igDBsmqr}8in=A zpZ!7qbHWoQDyO6f5)9WGPRy@P!w?JoN-io}dY`L4AQby6CRH0ooqvw8Oj14w?N6&h z$tI7i?$s${nCoY$_?Wcq*C$pAfAmeb$nAv0{n;J=IZR8~xoghSKe?)X> z##~T^WA@YG`eL-r@BlS9=+HOOC?*ZT?*`EEquP`!U{M2c&q(jM#zv#1r+W%agiu4H zr@VF-Bg^Q`4}a$qn3Eijq(7aK$5ony0v;%AJi>BJ_!adPNcuM`ZsSUxOCD;HVSShw zn2u<6R6~7k?Yqm+%oz|nki%vGOe0Bk^ixFm( zT>%Y32F8jDjZ4n%T5wMM#{j-yu(cq0oL0$-IYmu`^#ZSWXggdjmJ-}7AMDShe_}BH z9#BTiO-T-#6a*vZ#T*2mI*re&d;aL@1G^o6ek+hpNW>%%J_*1`uFd>75#uL|aZ1OR zl>}xX6()I0z~7bGdgI_Vh?|5;6|Lj*oXd}MG#iFqxrLq-K~<+wv;XoMcU9R*#KIx2 z*~3^LMhDvD0?_}rn>t%6rJl? zwn?m!o|HK0|Ccngi-a}Pv~)KBfgV@zy}p7xc20d`7$J_;pd?lSMp+EJyL1-3)#%pQ zy#Munqn>W=cwYj`2Rl@LP0#nS>elw26Vq17RMK*MH`u# z3?ghO^6ud|hgcLG$3%6|4+@AS<4Q_fqA*d<}&Q zU-cGkBb(Igo5lL~sTNFGe-n7T*eIbEYZJ-K9ygx15=sNwz#I$C2d-i--#|1S1AnT9^1!FKnx#DaoTgVFTD_j zLzN(72uft)vSHCM4`-S;q(dk*wE_`!5+ChvOn7l354&~8bzaxhnS?6RCYXfGV?pO` zwY|)Khh@`?-c!|!HlV$FY3U4~y79$>#YJG!uj#Im!&I( zx6j34#j{q0D_ryu-ryk`N2ATJy!tIFt2&2E+^8mQQ1na;^3v{cWWMeCmz&a5hUCGmj}Nnb z2U|V|P`)PL#U}t{!&NCVFSVa%9vz=Mq(_FIa}jmyQ1^K|-u{pO0UtW@j_Zz1^cjB2b;*_nj_#TzEl>={-IE>Lc-Lbxf)(X_n(h zm73Lf=;=h~OoV;%Fsox!JrN62BB~TKH22somUh_>{mgX3nQ$vEF(Kr!T;{d5mXCet z@HWJJUtrZT1XK%Kf8XWWvtt>DIgXXZv4gL1(Zz?TOHHdpe-Vix$jzuDf3xwbFWZ>c zHFSP=9<)E{&M;_inNk=#-fipF>~Lt?D|;}MN7OyDj1{AI8{_0&)qtVrV3EMtvbD1f zYv>>>M?En=$MO(0(^sj)cPJf3n+paEbe1p$^?Y`dNBI`QL20c%o{Ti8j(gW16vplgx zkIfqO+zgVy@gjHLD=w*XLY{QRM|_q1ub^`b1JF2Cq4mqyOx{m$xwvQ$3Ah97R>!C{ z6qRFV1sZ~V>;n=m)j z?Z|+?GI9Lq{|Vy7#sa1zytuj6S2yF zB8L{dCu6Xykl>egR1gr>7=@1oXJWIzw))p=&wlf6W?AQy zq!f#?(3q_oOcz%tdsceX1{;fgFlv{Wf37SCtBA4v9}Jz)4% zNc)bL0iMZJnq%G+?*A=;nmTgpNr5|z1>;V8lkGF}i@%RY(P-milN`QF85ZRo8U7v5 zsPGeHRS9rt$J~xxd&m%N)s-TYs5OwW2~ik1y{v@w6eo)toS*U^ElYI7>~3*W*H+F0 zj)A~xFzz^io7@=LS;J@HY?%HaiATVh+Pm6jdh0hE|A3g?CA5u2fzf>WUaMthx=#@% z4iC~>YLyT@U-t^GI-zfvnVoI4{gs8o;SSoe?Nb~u8zG28i=UX7n&J@oRvJ)9N)N01 z2I-|ghfRL7;9qhMzV9}^!F#bqG07p|*RF9xh|0vMb#rc7b?)(050lH)&m(*qwn9w3 z7VZ1{3={`+@(bW1>`|~?A&lL<+#T_G-BN+{;yt=dXp!z*z>JYh-P)aK0Jxq&c3mE3!P?f z(TGJOw8&zk7fa zzfrgOYuNH`H9D? zg8pTH@{bIR4*o#WRFr2jebojT2ZFNb{~%@8|RPedK!`Rt*t*$mrV8;NGDDu=4;}a4m-IFHEZ*0E)Iq>>}t@Q01 zs=77<(%l3$Zsbrh*6JPJ78@U@oM0Atfl^2v8@JE^sH6fvJG0DZ2!g#x%~E~{7UyU7 zqc2LR3P`u8QI^Eq4<+Z+AAW)#?W`8c$!wQbbra(_w%bH z92)oho#yQS{>6sia7`TWDDw7yX!-{CHpBhztxRoqwQbv4xwcttrMB&+w!N;aSFfwv zbhWnHw#_%^oZtHgJh`qU&wYRK5e<9(@1FNJr@*kLl#`%0MzQONipTMwXHZ%E^SKE{k^$4jpE%LJ?07Y&5AtBJHezjNg*---yqH&cmAa zui|I$@nc2W_dzd%^zYn3H<#iv1J}RbMO#fB;Azb!oWu6$2xt@rk%6Y!4Ed&hdz~*m zuNa)VE0g>M?`{yLAx_Ss42t7s)0hqk_RWN3;O}hwO*<*&^+%Kiz2qP94cjdpUo{j= znkUnL7tPp(*V~BrZ&GqH_}3S>eXN|k*jfuX@QsLA6zqC@;3w)X??bCP8&HZ!MyN*c zZ`BDOIXg~zko<2EttZuMVw}@sA$DNVWCHUR!AD5-?pkr-Pb&X(9jDj`{ZOsP8IAJj zP-!QwaPRnMAH{?sS#2i6$!iyc#uwR=la&@<-iK^0WdR!kcN}f%;+UdUG3hoLaBj6L zf#`e9)OC?)Y`yNruHNtZT+`}&6Ojp=iVR@?WD@8aE9FGbRj~8Y&i(u9%Jj!A{4XJt z>gC_5u!xE31th(3^a}yA<7MWdCfZX%CkVk2(bVDM*`NyFCb z9h^j$tu0jk^QGaN6Wm5E8~}6sVT+%D*A8B!d}KY7WRNj=SQztS z_FH2iNsIk9i`=ST#{)vqAyV47T2}f&T&j2 z6(0O!ksN}zy3*#sJ$Vw4>}napdOYv?b^?Fqy&-886`7SIGWr%4Rrwd&-tgb#VVpE7 zMn2_i!8RoKeB)u1T{9&#ATe`OJ8EORfr>Myiu3nzq`oFx_Y$Ux3$iz#TbZzUWvg`x|R%m7|sWjy_mhRYFt!o^^4@Ztm`cPVU#&+vDFTbw*8X zcyPo9l!kg0-dv;I50~%p9j!IKhP3=1vBaTS>(T`1E<3x@gvH4~&0(5hZ-~PO#+WM_ zO@Tr)Mz&_swlz$L3h0ty6I+0s4M%1lJD$Oi3iEq7CgJJT4N^I=aN`mXTx+iK3G@S~ zPftfP!X%R3qZi|pC*8uiK|;1H{6-fg;By66khyPo?oW`*S8IK~w(oOUPM}D$_4kK1 zRK3$PHN|khcCG5zbt;#pX>;mH3kr;Jr&H$3hbB&%gFlZ=Wsq-l`H>gtv0R?4=}PQ+ zKWyGNn)WkU8^z52>U=oSQel7aHcB}>w0(O1^|+_oEd`}BTG)U~=@XJ2N4W+0hP(C) zdntS#lB2$IPW3Nb5b=a+wud*wqLFwx&wpywU{$>sDaL7PzUSiQ>w9~BuBU>8VTg`F zLoLHFgFhfp;)w=yf)iAnkN!TINcTQEp9Y-CCXk9k^1V*zk`=i4ID4mYtQj&!*lfa; zINE%Z^c|OmW7ixZP^xsnkd$pso#-W+2zy*5JBJ`|0&cJ&aXwE9@wy|>nlAYIayp5@ z`8?l?+y9B<*+@*`TVv+uV_j}u-;4nEP6-jiA_F#;lPMH%{Abt6uyd<@v}KJxb2HbR z!$TJcJsqc%26HAuI(}BZvB_zU$BM^({y>VYWB0ZW{s^trH*1o1*~}*x!%3UVYB=UR zTage7Hr65IwbAp}H>Ydzz~}piT(y9l$)HUQ^iQIb86=+9Q_}bC8GrFXu(M9)#N}%) z>(V05%Z?M|!aX6dQLBb!Qa=dwLNj2@kBUTnm(F)u(8T2s;hD+_yw7&%+kv9s_^&^- zldMqqtDlkPyqt#mO{7?V#t-}j!52H#H6wJNb)UIPiMG^^yKdev($Udn7Zz3+{G*`l zs-YAONjE8%(5t_tIE@AuANx-4-Q7kjToXWn3uR2E<(`^brAX*x^r4*oqIq^g@#rrT z?+9;Lrc%-st|m>rj#h>03bJ~rQhWFp7qb|`<`I#lOq#~8s2(Ev(jzk57ZR|&11niY zXrJ;|p+)(3+qqAR({j(ng)E)bUi)KY{BQpQj(+L>JTb2Vv{TWd<23w{2R(BhZzWB( zNp9n@O%f>H((_jdH_nm?uh5+;60+qJ+c3?kybVQx`YetRD#adbsf1O`MFrliW6d9(Pou@PW-XbM@>`7bdb}URT2|j?p6f-+2i+V zhs(F2^oS>fCmYZxJaKo%Z+8TlGRz>x*W-VJ$ zvt?k5LbG0P9Vm9T@e9F-uJ1Ak|NjPDz`hluVN=&OA_f- zhjO1g|6?RM<&5RCuBdp}0MvYeQROHM=Xt-i7`&Xr2GfGTtK2`{1;S+B!JFGr0)ZzY z%Z|SyYV>u??K=;HSxp|Bx*U5izNB=Vcjbzzi4SIWJ<$Hl7U?+u6~_Cz3XV^N4s_iS zV>E}y$8?)t6UfAs?te%k_+r}=FZ2{x7i{(v_n-I=q1i9g7wmU+M#*>I(EdWuaqbs( z+zBTzUuIn;6%Gu&>|#Uk^Z;b40u=-%Pv*REB;Qb%TZ^NC(_SeJdIlgJ|~$=vFABrnQI&>>^X`O@IG z&%)V6tNruj&s+^{C9U(>*AO#KAz@)bpDolFVCdSJCqYxc($n*^&G|{OXy!+d;{I}W zwospWqUglkcO8J8A_yw0Xrn5 zDjZ+0N>T@FT(ov~gx&d*yo#>kHkWjFCvMgXOXlTw_Z5Vh{N8T9C+1t(N(;^ z&2NW*9a~s(^cb23-&0jRr~frX`1|Aa{fbVSQA$e&daRBf=yI~1w$I%lYc{=j%LaO} zjl}_|g2E`tlZM#j1i+3^Tm7ePgy4`R*-;rC*pWZuL zy&IVYgjEw8L=+J3_lzPg{&XV%wb~DG^WKTP5mpRE`W%FjTkLH?JKU(lV|M4uKFr}4 zWXCR3SVZHcp{XxWVf&+)Na^&9?4_m@1&7L8e+A+5&N(KtYU)#Oq2(a^`#KaB*9rUb z(52?$Sm4el&vF*h4A8Rf`a+jJx{VaW>%oL#`CEqAm`PJp(~zN2y=r!C4k7rKx3QdR z(I1}{SB@kt1^V!+-WC%;$lTv*AIjjy!<-T7jV1)Z%5m_EOY>z)Ez+#}ZXLVdxHo$C z`$Fr6wd$w6hv~SJU$^+sX$QLiB^J7nN&FIPPZy7wv)C^9GlrCDQ-fcOjG|1wS+97H zgzJz8xUT3tx6Arvq~w)&&@A7cZU1lJoV*@6CC(QmJfV#kP(aGD*r^q)ZZ-j z425skG}~l4^V#|A$x7u4G+Vg)1kpZZF=e9-x_TFi5Nw98){eC@RQZ(I&Kf$(gV={H zd@2+M$fmu-R@Sj)Kfjh$Btd@N^#!W~kFSCis~B~mydIB~VVXmC7;qv-=r2tmWeiCe zhnUG0e_R9S&vw+}J~g9?iRX2#dJ{Mxk0z`RMcIJT)C0h{IQ)Ypv5(y)adrBDvy@IfF3r3JSQZb-}%*R~`GDi&vv z0*Fk4cJNhbu*)HN zmg#eV7?g+c`ZsYpQ>`Q*rrv}GV5#xf)|bqut*O=n+@yfx=A}I!n9;3N9*P+%Lv^`Y zJCY0LP|2H}qlCMik$ro3e-!QNa*8&7uMyt}A(?mG&FSWV&=Ve)1e&7(F*X^k=q4_M z-pIQlHoT+fFK12-E}zLgYGPu9mb`(L>T|pFd`t=Sb?n`(4f1QN4=dM;YBD+9P=tde zOg7hrc$XH~YKmjc22KJwnZGVIgCA1TUjv|h#N-pAqfACm5s9ESwDD9bNVSF zQZO19CQY7gU6s0~<3_=fboiPB$P)7Vy+W1l# zkkl)`bOhFkJ8)ClrWDMl8Q?H6_Au3$`tFT?D9_RvCjJk%&ycmj z!IWFN3n;W}hSAZgd{V%(_O**l`##%RlA3&p#nf+(`}1o(8MQP)c0m>u-b0qi^G$1| zb^vmO5!w6FHtrJQ!O3-AXTb+rbD)Fd(p2ZvZr62&{(~W$rhFhS_GiLXcEH`aS@5Dx z$|e`mj}3mx6|*TR?VQcwFefQOJ!F6q=0pTtTdsr|Cn1eZ(#*`!Y6Asnjxrf>@PG@Iy*d@m;xD9aW9 zc-Whe8;cHK{eu()D4e@y7idI&bDImQu5i#BgQZ*mAui8XUcaq>R}iFDt? ztLBpwYgVQzK@LuBw|6RMaS@=NSKUue3(Wy&AG$uWqH$6uEy2%AAo1CE#~8n*qi!X> zhu6K$?l0B{GK;^2AWjtw+8kR|swc@$`xl0JeT92m2V6G?dg-zCk@W5gpWeDx*u0=w z`C(PxZ^|`uhG-}0JCLsYunqIj4%d{ZcQlxUW&R&44YltRZ$t|MQCx$=vd+&+n#d`YBsz32YZlm_!geMq)P2Ek#jiBL%|_{ zWeRKx;y#PiF?h2S3I_JS)ITzssSJXvaa5~OT``HuG;NH{t0mz(7J(P9#F~{EzXv~> zHrB3T+Ue^vv%+#KF19t}1k1X8Y~=cr${beCig^QL{E3vjah}?rl8J59bl!3iNK2A@k$P^X81TLLOiL`YeB+O7@=y42 zk9R4?RKIxv{Pso7%K0DI;TYhg1hmH0OJ^78FinlCHfqpEkV-|7msi}8jHpP!hZpw{ zUJWAwlZGBt;t&Wiyi$Y9w$73kC;IOjRGh(k^<0th_h<6=XzPNG>Iu~U&jk>c;acy_ zxjiNv+hruM7I422*!2Y$KL2??iZ1-O;LCA7$SdcqKwGa2y9O#e@rId+L#vK zDtv#tUU3~ot2UnAMdgPgVD5_MbGAvo{Oi9&g63O;$%^qdeQ_OS5k{T77b5Q%$Ln1- zf9>uO96~@m1;NoTve5Plnc~CdAh5#}2cpMSxdy2|Ha{c+u40}Cpwi&n)RDqD*p7Np z1pA!_>8j^!zCE8~&^g67YooeU!_!KCB=RXOc*QL!}sYpimIRxn-1yF|` zo#lY*&<_j1G~LqwC(^yE=QUm)nhantDV?RTiH8u}7up08d>l5s2}>7P770O%sq~nH zAvT2_2iw$qRqhP620i#UiQQ0v3Nz4cnmm+2%fU9cD;*IFixi zzg$n}_0`s^2+_%_Lh;KAl>+fT=I2D$b-%zY@`nw-#h*TSig^9}ya{At6UEXMZLb-u zJS(2&FqUYJo;bitES=JD7?OUfg(f!w{?nxq0&>5|^|$e$N#XT-qqWR(1}Wy5|M`mR-F;Mbz@Wg+6rd$wftP(_%mA?>AIpvP4Q zQy~*3|F{05P!g+rBwAR6?M-nY)?>2lkNGPbsr8*ACDS926mFyjnly;D79jzMKxT;J z#dkm(VOVl%NBp;_T3s7cXMh1w&(u!4fa#aOQlOl&Gb6M+)3cEueO+mfw=A`E&`X0_ z7q?%f@K)c3f16X?6x=HL(tk3B;J^^wp$89B6J}?y{5LoRaNjR`9fL0_|6odl)22gp zVmCj7UE~J!wtr8EcUkxUA-m!=?c?Nvw~pT=mJa~rJJ?l`IO%Z^0QhHCOWCE5^oQ&ZzHzvfi|%8$9Cqyg;H-}lA$q5Cc`1B_yiG4Fre z*vYm_$zO^1PhGw~t5;vpFy{&($`e*HH7mZ!hI@oao(|h-{X$L=Oq;(A=)~TZL<5yAw z9ackt{ySXbtt{GspY{z3ZGP*A+)X}e+O-l{7yCKGir@6!H@;sK&NOaX1s=%1(=LYh z91-gYX}R$0M+N@*Jpxgacz|cXvAG3X&aYxzB`lwtxIds4zTQ|rzLX|j4To>d2i;QR zY8Gf6un}Wxh#QeO3+Ld6G~m;+6kI6`;bt+VM-au9tAe}wEY5qato!8#M|!RXs3I%_ zyHr*~laVJu2p-dXE3U|=PAqoWTXp>Z1Bur^!c-O)H(;^$1vge=uy*9Jt7^4%|0O-w zEFLE|kN{}(PkgE0b@7rb3AR6m!x|!1o-N-$ojQ{7p2d2=jT{-3z4OzhHL5zR<5aEN zlXsG=64VyJSjez8R*_q)?l7W`zt1qSU0&F`aro$O6-ztPHF@SBeBh)OQbP$I)Qd@$ z6l<~Mtsd>yi?c3YenA10UCp3YFZD$Qy%}=~^G@)0J>nJkZb*`Kc}3yumA9!R6##VE zaUo9+eSA>XjzfrMrBt)d-sJm@+Czs7s%ahgMUY(GniD&azZbb=3SekyV*{u&=e@qZ zmZ+c(oXIzZSz^ds4exrx{O@`Ht=g2tcl^>}!LcZWrAFaURaT7U%~PV$@`iE}lUJ8F zfD_u#xxO*B{z_z4tT68v7~L#>snHZqS>u@_+a|;OD2mdsGJkAnZmR!BstP{|6pYFy ziL%%pS#X3MtxV=B$XaM<(f6oF+aqJ9(D4 zTEcH4=voPllVnq%y0@slOBOjSIm6zR*K0L^*{?u&EIAC(`@B;)PmXhi0SwsSh21~e zv8owV0Z69VPY95@>n;xZE?@RFY`*sTHjrE1)(=x-v5o<~7eTLGMsI>_G zBfFKoBM1x`ukxFkGpix#PI!RtU9NTezt@4%pv`%`uAyF?7GG;%+a>KvLZaQ^+Zkx- zN{|D=+~5f|B(a5j3XUx{|>FbxL-b{Unj{Fh9au z=kBms0w>BnzPcW1C(2D_)U)T>YDiU%M}AZ=k{55fGnBzKBFO}OV(bN4qt35Q%Q9h^ z+quJhpf-plDK10NqlI3zc@?@Jm|3KVMVK))P2>B3`-O%!=MqYi<$88B4xDqlPT;5O zCCQ7})HL-1vMsHkTV4OB>%^ay^QSK-YOlDUXFtwgvFb+DS)-sd1@o7P9gJ4nB9BkB z@ae8G?~medD1|{c$1jqVeM4e**DLj=yj{F)U*y=Dqp`+M_m83cqyMNw@cI#in;~f2z%CXm~ot-6aGm88MVy8z_rlX)x!fh-{B&kb^wJCpA>NniceI^a`l3f@j zLoroh_A#Gsud!rjjiTTPZ7yD;HaN294(?0w`+8imp~y&(P84XQ7d7|ZzpY$oS-J6I z*UcXAwp$2t5!78um{?~}7X~f^4#}_)NRH4m0QaLv&!hQn?fZIqb>$w$dTXFh{CpfX z1~cbpK{iRx7hPxsOCaD5RLu@zHH}SCpWeR$wNp?jBVD?h-@2MVHbX!%$m|h@SA&;M z_s2`TRYWJs*C(@3e^uDTdYAh6oa*+}CP*V0!f}a@5p={r(8!f`SyfP!M_MMu{xm%daNkiAn(585_a^9PJEl0bnef=b6N}#ze-L_0b4$- z5OnpCzrC@D-^X>2eG=xUv=^=S%^<`&e5-XTo&OJo5rIu0*pN#${E29N9-Nq{#ejQo zcxYvF0OMESpJH9$n=m}Am{2G(q1*MOT@d&r*fb6N*x;R4S&3w|7i&QJD|jC%5*k|Y zj1WFJFL_2^973#PSBA&%$p$t|VFMuyi>)}cN|k{HE+(w~i;eM9r?xsY122Qj$)-BP z00;ToXgbLpA}A?t0%hD_wbpOphpKSfZ_E|n_uV6B+fIiKen#SsIxD0Q14qPn*U+2Y z`n;r;Ch(j!#~d8ZABxaFAgQ+GIga&WTCLftr25g-_kRh-wc{C8&$|iiM<9}^zx58Q zpTkPobiWdkR5rLYG$pXU*P?|JJI-DiN)+94&dK)TE$I3<;lEpfJMRARIaBpH69ECG z<1J0V1!W*hK-jVOMwc*=U{JW)+h8FlROp;1z`42UL&lJ#L=mCKv){QSP76h?Ff}O+ z^d!>=w*S5nJZxnamQ8i$tn#1REr{`$am&AYk4pfG_(sJ8_q6;kkJVg;I@Tt;U*nAf zlw-&xnARuR15b1x{;0hH%qtQvG7DdD3F!7Ey^Fnie_{b@`Tw_!F^Jur+lUk-o3O9Y z+`UMqc6Yac62k}wed-6XwNm%Lc6xs5@I2kqH}*?GkuI$^;_ZL zUbC?9$Au!IM-Qi(7=fBs2Ux}%g5Nv7(#MdN#G<-Gx`PY?ME15T18@zPMA&>!MlmDj z%;OaQZn z8nwmvXfZm@Hr*Ei_dR(iE||cE<%i2ybBzpOd5VYKA!^iCBGWED<4zg$n$dDOHy3z^sj0DMnq$-@kq&u(ZuFtHbd>Kz*bJI)PbAv^NDcJYT{;+kI z_h$TFXl0>oWluF)0d^sFY6vM0(!6W^aVfYWMdS)re5`@nT;%CNoP(2d3{m`nz0GAA zVTp?fm6$m!9?bkN6BvU9a}lHXeQxCU!^^Dyo|E`!<))9=%_fG+Y)iUL2M?=PI0&h{ zQUkrSsnEMN(eJFAV0Y5>>4fk$hn5Xa??Lw^flsT0fBrrrri?STI*q1$sHVf~dZ)E; zYojt1N(UPonfMH-40AYDILG^MeKjD03s0?`6MOV8=r~&&mIxw{CYa<9?^2bUWjpA%xLBEGWG_-3PVixdOo2lwT)*SPuo`mN zRF6)W!?^u%t5DN2`2N%5*s4f72^B8QB*2@u@9&d-r;)Y4f9S*nI(CdqX>{_YDO4If zY{3;*i_wsl)V7|-r!{~4`(;Gz+c)cj!xPi(4A!#LODngZSs!@dS7<*65wQ+K35d`q z+}+(j6gA6LTAlSkuY}lgE=EP+TJYP|rTxgeO>(TIWsyL9G z9%{0k)Q^P-*wB*|$|`mDGzw@kMrK#1&nA##G?Ya@fagLU+2fAd3_6?m81S$Kh;#n! z9ywJz*jSU?@>*S@=@rb{*24XZV2ZIQQN$$)`cTaAZDcTR|M2LL9!sqWEIX^Y)l7Gz z$ASM@~8a2c47gd zt2~O_Av({R*w`s=7r)D8-k)R{7>toA@obc9-FUli8WN}G*P)Qv3vTzjaJO=hT7dzR z;_9?`na0_w|2QQxN7o0-G69avV4m4qYZlTm+O~5iN7)M0GCt%sEa&WP#Ab=ZHd2vcikv)u=4RUefxTC*zL_mp!{n=J1JJZVsq&2j+{Uy7~`#ZaKw4V0SR3X90-YXKb-wld+cnIH~M*Q5GYPbx`%x1Gb2{_uZnC+tG@^E3=NK&1gw;A}$A~7-Vo0OQ(id<~!V>1*-9L z8nf7;Ox|pTng&DD^z>H~Gqc#mN?YG21P0tC=ve{^K}}$GP8P4L56=4u;~Uf~S)6YU zIHAUd$8*)Do}L*NbWsE9RoaTy+<77%$o|k(!Ka3-GNUS2@Atqt$3-Z~mqCY+&uML} z(!4@(f9B@?R)Zyzai?)?Vl3$o0Wga_`STEiF1|pJX}AYy9`l-JpB)uTjmBnlSJ3N> zbTz<`RNMuw+lmO-9{aCKH+j^Gh@1p!W|0?9!p9*ZGB!0Oup7ZurGqxLx*CxLa|%iz z6%1D=%jI*haP=oK=IK8P9ZT_s&5LGKcU3l2A6)~9_OI!pCK;=&Y0Y`A$snjYH&o?*s+`O&{ zwc)w|`$hTkZ)qv$vjgowwe@uc8$-V4}!| zrYWG&Ca2JekO|5)GFS+ky_kFsFSHV9>BkCmS>QyEvX;W)&S0>$8O@M!QIO=u1Qdlh ze&{ToJ~n(ldp6Q;&2Zy-O{zGWJ9SJd0yxG$d3|wT71A#d@!{&eedlxw$|m? z3e|K;JY5w*8y0BqBa@Pq^dsb17GAEdtKsC}kzvXCIxw{I?K zmO-j#;)o^a!l}F0X)xFOZRZ1XT&n*zNzlN2;P(9Cp`*3EJt`b3T0BLQsjFSuV7a!{ zp6_4Xt zklmJHrH?e|)N={gIA@rGsGze%8Sf9%AN$;00|!(U*qjAo?}F&}e6U4}YP=7DP!lNF zqY>jz9)B+ZCsDdYV9N!b57^Wam6+1f(l(`+&GJICBa7Fc33)UHMD9K#J;_eg{Rq2V@fW1if3h5@}7_GscK6}Vqs@uf>5}_%SU^9ILuQ~L<06O zH3d(q*<3cAj7p13<03N<99OePy)j+v&WzNk%fx(to2&7&`4sPY9qks8;UI!;<)-4=zp5`&F>v}M!>TTWqSDJ{U#~mU8{#oa*<3U>o zD8?3n{;|>lXe=!3jlW=LwcKu+Xnn3nJ{P=?S+@l~5<9Xen)`7_m?i9%v%1obzg&^- zC!o2WJ~2e3SnR#w*08dMTfj{I0}S~pHyLkTm4jGnYi4KH#|H-BwoA=rO4;H@b2(;4 zJ9OF2sp4_@3I6!8RjN?$&hW*2$?JZa=m5L7UL1j(I5?&dcS))8iVT*_&22OE%}ewA z&S=FRj&)sfb1r|vk1QIx&R7RnrqAqgb*RQdLO!l!jo$nfNcIjXZ`QtQ_W^I$XYji7 zwyCV;TXdFXe_h|Yo)nAV5X)ri8qH3nHt2LscRx1mD^d8x8A1)8YHn_CZ_mv$HGX{l zdosD0+S^iJY=GJE`pu7jaoowx>x4}{QKa|j2G@~AiUz-zaCqiQs9Y)`{)O)wYGdOy zDryTiZ(wSTRNiE#cO-^WP&6`cV?&D+&A*<7RShdE`UQrxulkGM1P|T3>^^p%G&Z&; zXs}uK{G00s`czaOV0jCZV#qj4yOey5bSBpPn)E)vhS+ z12pT%%UMF=%03ix+oZNyPUj1ZFznY4-x(jtUf6#mlgT|R$YZ%0-ci3-EtZS7EWi0k z8a`H)CI|(7fD3770W=2}x&FxCm}Wr2MsyfS6J4i!P$rouZH54xEijc1pP|`2LTT|B zOY%sFlY~{kl8+eF{+N~$=HYNe$oPok2dB`h)G66M&TapU!CEb`D7*(PLXlQWrj(OZ zUX$g7GEGJyW(qj@nNx`ezqAQh(j63>Y2*{3Ya9?3@%S}1g0%H)#k4*s+ zE;oJREa_)AKf74t_wnwb*AD)6Zr;RgLdVs12 zMOot@akV@l$l4w@?e>O{hLj_?(fav-Tx>v}z-a#{9V08}YejiYzL{z2Hwc}SW4OI( z6!P-H(GpCm7PtQ+$e0$-&FA!=Q!3PRw*7j)&GQji%iIePfs^O=20uqHZoyk6=OV7>uOCNrh^_)e?m1!r3_ z;dmwC_O_P2rLu*x77s5C5uu&6pBDio6?mP*+_^sPn|mIRCB&H&uD_Az4nct>!rLi^RZVX8&jL7uvwK{O?s?3-YOST_0EWyCvM1MruG#4fR!6Gri3C zG1fDv=<&{bhmF5qA@DkL1ku)9_SH^5Tbjmk_9teR76w3d?`Q?aQpod6-n@XHH011@ z1Ekf6`+j0k=;V;N!S;tc{j8tRzJ;(ZYxihZ*nST#Cd&-uR&YxjMNklg)fd|Ra_q&3 z8@CfH>-m%Tkfd*<{Nx$eKe3>TOzipv#el_H@Nz&m~U^+$YzfO@(h5M%1oj3=lZ8=dZ4@)Z1 z$$#{{G(o=q%hnOEQKbZ>F^xig$rpwc_6!L|QXUZVb+tqF);3i#L*0N;U{nbw1D;$7 z@atDIKR?)FnnC}N^nbkmuu?(~yp=TR$Rc_`C97i(R5690i?VW=8Ha>|s%pCQyQ{Jg zYb!|!8vOmS_EeVfmHk(cS4^Zd%cPp?{hUKfs~4dlj|xkP_jdd|2ZXkenZqk6@5LzN zi%p|_}EPVl%u*hd^R(`JbKYX z;bhd-^RhyP%&cBM!}_wtT)4eUFgd%l7Q62QUN1DY^+|^=@8zDBA1@|ERmC4k8@F2( ztj%~@nr5e`hljW2A9m~fV{AkcP}8DtDiXKS-3)#|un{88yYzYsBv2)fOieEiR?gBt z&Sbu$PkV#?DdYAtIhPPAh+}Zj1)*x6`p$MargWN)j^URrWY95)W|pyRyCgzF2z}ET zj*>Z?jco*r&^B7GlmQ8lSX0Bg=J#%B79%k1o#U#pEoUBXfVlY}W5!0g%fT%=Iq*v4 z+R@Plxl81uh>&EGKnhO_FE658Rj>{sXBW9=sr!8aqeTzBH*4TwZ|Zu2~JAYKwu zq}xu5BV#>fMaA&ASm9>BctK&`X6St#MuOU&5APyJ_bjKy$}SignYg;A)YR}c%_tmh zm_^G`w_)*rf3&T$U6h1%1zbw>AARr33d@V)%lygb<@)Znk<~pY4>Ht#IYM5qfY&BB z=B>D%mI3h=JS7gulj_oXEl-vPI5WFF#I1Drp%{}S6a?hl zK~UXr%)J$!q9QNigsWLy zBfB=qW?TlxNxamV#!~kurk2*mc3z2or^q`6u}j%Pe{tLM15@wsh3X2$0T^m1zP?W} za#AuWNCuT{UVgYlaaRL}sb$-g{-@463rJLy{Tmk_@*O^9JeWBq%W!=bBBCQ!oB8|q z&qAm0&J}#5JUW!5ph$-^kfPW$2S!ELV1TmT4Qa^YW~Y*9u;Wu56{h~?QKlB zXyIJCgWbP{)RRzdg%c7JTiAL;)QmeUE$ac~Nt>p^4HX-{3%Kt9D#MGKJ2NK|_&mMb zEUw{we+dusd~5eQC##IaM<*wvBgT?3*C=6v?2MsOS%B1$`tpQ0rHT!#oF4!vjodpw zh23v%rq|{s1{MrGTlk4cNqgDxvh}m5R~JSurYIVsEo^e4W#zbYQb#)O`PqVQp|G#e7B!N$%P3v$UX5HCE$4vD5_fkTUhOb6QJ=&WKUSmv2~@JY}gC#Ituxp%jHDo6dUXsDoylCVlDu)=7tYJywqb z3-M`pOGkMBI!1+o`^oPcCk5=EzbZW{(5U|k?9sdBsq{$>`Pbya zs=h(H5Twrkl$m8R@$!yjUf}r(rEJ@DOY^7h!fw9T`p!W+0nr)J#ubUv&)*FbaZnf8 znpZwa*F_mNa5?zrn?)LYR29gVXeG}lYQG5MKBvB68t7nPW=1%`p>uLcO0hf z_~+*J^8La$j3P9M1*}tX91je2u>~9(vaNq?xrmg)iUKK88j4@EIw2#i5o6RoirF+F z`Py6Xcn#P7WIhCq8T2@ZP&Tg3fafozN;rgN6RW_;h|81U>SBNdsQ_{SY@Mai3ydMx zN^Oo~_$~ZoeKtuj4m5ltYrwkcH8LXsB_M!CmI8O``?5K>UIu9}B}$X6_Ua;DisG`9 zs*5k2$`r24GJ^-38kLPq4+R;%FsaI!G=viw?g6r=#zcuJrNM@G(M*XQV**xlsS78G zDTcw&9vsylZ^xw7hXe!q(k|1(IEfL-6ESVb4Vj9lT>R}5^al}X!V!=LOVDoJS234N zK)a6=q+wAI0)$H15q^ODmXBqVH6V)0MneuIm*j^GU^`4*mI936Uk9EpB8}nj?LL=6 z?>eV0m)rWO%R~v+rb(Gj+b~riDTH3GNp=caafYESKEb;bO;l%qc}Pz(od7{y?2gBng}XF46b? z*pb%%3ogj%lpS{xqx()`hu7;%v3=h^!rra{Le;FvjY?1z%STCBciY27-ezW%{26;wvTZPTgz zp9pjY8D$X3O1_*QS!lgBAC1jNYz$)tf8|`WAk;pxhy>F#i6fIv z!K+8n0+Rpwh7g;h!qzbiwR99`I3TK~B(k9rOdNup;yfm66UJ$Y$|i?Gg%#2}MA&f= zE^Sgqoq;i(~DWu^r6(HR09_oj7Y~|Od*nceIQH$uOQ8X-4X!} zx&!xfINya2t}9ylf<$-B^ZtRpB!AcSgg80WTI2LYwkZ|m;PWz9CTsAGPLnogmC0P zYwnnoG|AA^GHo$Kez@9?>xgiD0RQ3-VSR|K(|r~8xCvhv%3+TvBpHZhZOKnFvHIYt zr~2rz(HH%umNdga`mLJJmU-%cB*6NHZHTJ@G@1SZrc9b9tT}XYQw0b1|-QljE z($pUy@)XIM#R25IdM%1gH7M54#=%Lw!j{({(5TH{4{*0=;1~GQQl){vc-?B`WDam2 zlmTBZnU=eKOxB|&we_F>1*)hYQ40JJgNV`n-$n-$JpHd;O<#Xfz9>e%1ZuvVvG*B!rU!(ywk&zujP;9J}_PmN!Ea^`yRdgip*M-)Y>I5;k<@r zgKnFLjta=-!k@LkJO+yplW2xf8B1}pW#W%m;}D(ALyY5{g=vX7!UXp-T#lldmCZ4{ zK`G?pCI~guc>$h!x=Rjm%pIZtR)0X4A|`T9q_XI7D(!{aq_gpdlR|t-|4V52uen;! z?gKT)OfTGR3>e>r(k_D;Ud}8$s@X&+SdIk4A(U8wcPB#Zc_itUf!Lm!1&@!=e;sHF zgk$9d%Kh8$$CGP9UM_=b9mA+kpQ_>|Q9}3v)#Zli&b8Xfs0gWnR5-Rtz0p|OGZ^II zodo75&8Kb*VJ*8N9AaX00#OnrVK10pw|Rg1RNUz?*>qUf71Qc1Jm14k*7N`amJUor z6qoH;nO4L3#EO!aK9*isAaMXrzfi|mP$Xp?abwwtKuO_n5N{JHNn@bwz)?rRCq%i$ zV)J_Q8&1`0;pm=ik|Zf4N{%iGl1~>hMEGtD=0dCgvn+U8&^@Y7z6s`^{BkALoAo-ixq*26FVh4ZM(h6b zo0yiU{A$OGi-zvof2S!43JY3P=~O$LofvMlsl|W8F*s2^M=SVDxKx>wRA5tcP!u%O z3!Pk8l4hr5GSAEpl&Q`Gfk24q6Ug@`78nfC0!Yb-t!iB|9@DjV-gzJo0G&O?@xReBsXGcRoO>mUFV9U-ibDPnHf zMqO?x05&ll9|6ysT;glG(gB6N8XR)SN5*8mMa-|Jm<(TNhYh2d@(VCOZu%D8EY|*u zE~1^2v`Um&WM-g|`(Y<2K&hgQ)mRLZ@V8 zx-C3;s7zT#xTpTX&j1r4RT2U6Q$6_cVEWwOpyCyRNu5l18=aS$(>6K84)^y-xSRt( zs;<*OAf^4RVRiz}dmNUml|9-**{^8puFeTEU($jWBs{Yh(X`0ttgNOJ=h)?HN{>2C`Ws`|9gip! zXZyHc=s)r_+VriXuJEkuZR6!zUl0}pijE1?HmXG*5ilgIQQ6f~wXd5^507nOc~$4V z&D7X6Fth>ZQTu)EGc9`$;t4c7hF4~xlQwioYPy72&+INec*LcoMDwfc7r2a(9}?`< znI%fc?A2bgaQjtxm9Fc2Wtv}DbN)rBWWml?wj}4RlQfO3#!edBXl%E!Piz}aW7}@r*fvg_#y!h5Tx(r8QnA3W>(;j}!b-Lku;Z$s=oSo?_! zQ$!F{P1#Gluu-KnKK0~x-PdS|(n`;uZY%_>Zf@E#d%tJa3opFyw*rvargj5iEOc~a z<;5?$=I=h7FZwb!pxJW~aul zF-v{*!CT%s&!PetC+8QVYC+`BNPG!#I}Y3&92`={X_6FMX5=`LC_$&?h`{Co3P8dm z!#kxUX+C(qXP+RmXjNO?>_3UxlZ#Ul#FSgrg@QQu!sCPTzkXZt`}QSdx5o3_5i>g-RyUw14u{u)3S~?xmqTL~-EciI&E*PjeL0)%-c}_TRm{x8$7f?@ z?@2)IT`$%tSMPft{pW`0`CNVXeK`DeFlk0ff`ABFa1iFU7q~n zf&9jZmWt$a-}zL@?d*iZ^biQ~zNhz&$I$K>=;tT&mcIUMdw6)D|Mtf9zUBL}{`lPa z%A3E{`a<-6^qyb0AA1jaS@XU3Rk451n_J@@<@*E1v{gT+{Tr& zV~)dX99r?rQ}qvFPS}<{6$kbo!hSd!U-(U8yApn>S>9S-T$=8f#CNNo`8>pJ;YaR7 zHw-;Owu&E?Q-3g;mUCAAQHDO{DPBLJ^?v4dPVBGP3IvAakJ6^>Si_Q|s=Ur(XCeN_ zXF{p#Z_j}xYfJur_I*4p&Yrux`DPlHOx2ogKT^k#!lahpScWV`EeZy6J(O^}pPtS| z#SS}{%E2w^@PA(@4_lgs?wncix4!F!4})8r@H_3!-qL@*)4Ig@2DN6}Wzl_Sitc7_ zO_WBQ-0-_5E+cYU6+v=E3pR z%fS$IbbOJ3&5mAp3LX4SL~-#p>O2Yxh<@G>=pP>Nmp6lHD^?upeC>W!0VzLVxb9AH z(kP)J`@9=qgz)(IkPxz14oQo)f1qbmtI(yylKDG5iFdM@lfgvR&cD*)9%=is?mPVY z_@m?5^qo=oi@^P2GWD*EC>gAWN4op@u(iN@vl`B!WFD=R$83?jja3aYBFpKdF?!xRiGzTIeFr^ z3I&t%s2BA6sQS5y+l|O{bPlk$Y?wbJ_e9k?ANGRXs4SEE{QZ!it>MVyl-@Q4-@q`4 zwt7uJKU_8Q4O{P=zxuE5Wxw3nIy~AsfEH`{L`aaOcXJfG_tB0pSYayIjJ zjsx3xs9ImRBy(bJxwp4-vabI*RxhZI333Yr>BU14X)B~0r?UGAGq2M;(ZCm?gc{i- zWp4dpAvc_#aMBcJbyc~#$~gHyZ%eUL9$nwzb6*$`^&aV=qX@tf&|>-4hE04ZGxyUy z{v?*qJ=WIH!qx{M>$Qbwmv)aR5duLGm>^JByJn;`$5yw}v;G>0K#+SSW+_4h{_oQAj}Zexn_5dLPb*i<|2MF|(XKRxeE$T- zgz>uC)K)bKOPJyXi$kLh?0sYyWvpte8!U-8RU-Ke^7>oV(cFJ^MXIyfj&aYCl7d^5 zSDL(bMrg!jeQv5_F68!JjTqk;FciBfD~7 z@iOm`1{rD+>eSsyCr_bfO{v{QnScm;uM1weR6Qjvxkw<%hozWVl>dsLLX@8G$^FIb z-20ThpUSR-$EOU1sF(U$guf*ioXG4l#sMMlyvWGH;_xf08{|~aewq9}k*#=za7sY% zvNYc@yx(zwDK4Ku`2}7?0?#gNb6Np4v;cMKqG0`j-ieN2W({$m`Q;K%geaL=`+q0; zRxG+Uaa&?IP|4jSBvKe?MB05ej+N(H1k*ny`uo?UXQPJBYN4rJNM0{L4kBO$t3zI74?dSJOvE3%=u0LJ9$|EU1JB1a?OM`Di&KhTR!M!=Z zG(GBnUFB7HUOfBrxEZf6-KpK7&vv+7+%G-*&Nvgboe!_K#Pw=S+X8tQd}M_?a+$=s z*#h##9qK?yl4-HnDHpmhaRDEbyk+BQ^yG$j_1xlT7PY*1qczCf<>`#aquKqC%cuZ%EWmPMc|8w5pXAx2$X*1;at z;Vz{wpHy}f*7{aG5s-@$Fg3oFKNsBT5>im{F@S0+US|IVS@dV1G!LQxzou1#iI8Zm zX>8^OS{auml6h+gBQrBIV!d60GBKyLJu&v}V_}i$MSj;0G?kl>{4FyIt5}D05_Myd znW%ha#?cli$i~zn6v+sdoRghOBjZ>&O1nJ!{2m+vrbq(qwx2Wv?;XVXrTbOOv_z2! zn8ts8E5cgZBVfp&THV*f9-(NS=QFDwqxE3X-!q#DDH;mvd-;E7uY(c7bN-fpeIZQt z>y-w+5@|{J))*`WA_N(*Hw*Bt@Hiy$NCjAM56-NpuMze|SnupoTArY7nM5~Aa zs$$;|`g>BS2l36~Z+&GK%`-SO7T|V*-rrAzXbEv8T~P*%IPsJyboZa86nN?EuY7zL z-2J{W*G^C`)c(o%@l;8=GB1!0NBDiv(sx-98i8<0O)?jSg~{nldS<~S%(g0`S~Lp> ze-y<11e`@;>o9(0HI&Vj-+i?U-2=||3!6C_sf*(M8)^}uK$#C^z2n3Y(Mn;3NhaU6 zFxjQ0?YcOZ9OU2)RKy@^J{H`8Y!c$Whxm_0=RD0uIj-NAzFzD5@-q~pcl?(R5p}Pa zQu%aWT%bgzBD8901%SQ+KqO&O!e0Ac0BUFG6&;5yoBxs5%*8eRG?V}7v&Z6?$>QSD zCyG+tnw$vMj++akFZ6tM7as_A;H2xIN<`~%TIUJ}YAH^ClRL#YnthTkn1NjLe_j4V z?NTqTBBuX`I;4tmVS$~vic2+cN}A-dii=I4Vd zoHIr?Sm%r7=6du{k~g>6N<{ zv$#@ID6vF*hX}}|s;>@WF44xvtm$cChWSd=;v?2vybbo(ERd59{f;Ifo#5~Xl~ovO z$9k$lMf@k)vvCx@sjs(3fEm!|7D^OtCG$C4ATMm!U$+FBg zZqSQjTV$)tzTk3;x|qhFd)-%>ouB14mJ&pCb1|gK22~UyM9O_Rlb4%bT9W0#>Ydlm zuZPo8x6PR$R+2pZSuG8RL@nWXdqmN3y{fjTHZ1$2xP)3nnOm~tE>IYu;+V9cj6oNZ zMENUrfwpK4%8&8f1eiPfU!i)2Ox*$u{mNP4=WXC853CXxx>Ztjt`l~Fmkr3XwT`j= zaO}lp+69#Kt`rR=m;#Jh4vpPen$&uTa{c$W1hkXWQ~TXvOowLv1P4WFRr&`R85y&6 zuswN2De!f|`dm=7l9duiGu zwRyIsk8N^bAYy=0Q%`|90~4>H!sN9QL;`@U>7j{xKFaT!dnK2=sCrO(@Vnpr@Z*&} zdxDjdQ;nUFcYGV2?(tzo>K}Lu6x4-d>F2l#V>+HC1{Zpsd~k-hlbqIaSx1r@aZ#%G z_~Yu69BHO-T21-#SyP7h6Q6S6fw|@8U@VASS&H`C!yJTFL*LO&x{^KnjWO(Bp4BTY}uKtMYS~l8#){N?bciW zlUW{kqCwxjKRh}H11Kjd-y1oB>n&_<=O+{u6?9@ld~UV~wWYn@R`dY;-qe94aCqt|)AGen)_%HkYEeSkPISEU9ki>*M#G zMT+#d`tl$;Z1>41o2Qr@Y2gBG0!-jm2A4eqZTb(s>ABONFMrWj>J=6VH>Ag{48yCRBX z06akb_{(oogxrt>N`M!SH$q_zV9I3Sb_s6HvwT@ye_$!NLUO!bzPZ2ONOpaQ_kE|? z&vs9HTSJJX*Eui@wK9)(BOTva;Htpe{+ml8OoDCwE$m75dg%A>(NBaf6WjiHL{rnV zV}I?4(wC1Dq<=N+iK}9rU7ywCWq95hYpS5mH8zA$;B`H;y}z|)xL;{_@GSq;4fU${ zCZI>2Bn>cFUm_aeDw}nV?(IS6Dn=O5gnnpfoco&WRVgwvmnYWg)?JiH zzN0o1VbCH+3qw`tXV$E3Xb|K3LWPB>vNBSgITkz2hT?(`g=;$jDyoto$0a3)!sFFY zj{HLUt)vNjryHtBEzI);a=W^^0aiXlmNN2=-=&s2{}Mo(21SgMFWOkN@QwpW0sb(ksF#Dbg>12z#7>^0;%x&M3kP8)V%+FOuaD)hVp{>E5T~9E4}Vbfp@g~JmLzh`%*?vXh|2k6h+z!^guV;2eOwhDd3%WK2i1G(t=)w z)dXcsCGhZQY1^&`cyF?~ga;!PX)F;0Xl25!_Px<6Ox%6Kc25DI0f%{L-`Ak)K{o^v z0KU{_m%VEh8zq{?$=EiA&iD$kCZ9FUPjAGj*38K~8yuN&zu0Li|HAylrQ{u0iscT<_i!PsIYszS!Z>(YNFp z(L7X#NBnt40LIikR{gc1fkR!RNkK(|vtRiOUMg;Y%O@j3Ca* z6$FQddmu`A0e&ocyO#xfG}Qjtdq#Uxi=>xvB--QBeDuhKT0A$O&^FlEi8Cfv-frn` zVY=)TPn_ z?BrfSPoEc7+j}2oFihpMjb6^^E7sfkZ5B<<4U(b;*yhEtANnUc`)-ekh(FqzhCcTH za1k-@iA6!@tcbC(=|`kp^SE|aO;#Ox{g3dJxR%esl=Pn`6pF&Y2mE zz|3AY_V(7%LVpRk0vj@CdGCFxS>%r*B-D2`P3O(K7s6>-YE^pt0i5v=mireeehT&k zxoWJ>@_C+NkbK(Rhi zO1*oP!Fvsru2ot_N2hYZ{z~RuTmvpBZFIZ3LA6=$7`Ymzq#r}HO3YDD*&5h&l`O=Q zGSzfHDw)=He`oRJ)uOAgcGzo9=5j9X#PxW){`rLW1K3~SgF=US{yCP(DumV$;|7gC zFK?%bH!OtKq+(zTf3=VRMS)=aMc9mpsu>@%K4zIOxvVkLIbwpP!;VZ8v z^`XB@c{5t?!UH*LIBlOw+HAdXmVoQ8;=I2FfSjl`pZy&jD0!{#njbi9fmWW%u-O^7 zwS35B0=H;3xxYe#eKut_PEn(!({Pu#Jdem>fAj>9`TFSW!2Bq~`GA`L7p(Lv<<6Z}$ru(kE|KgQ%%MZFmaig2BPb1;XsD-6*r^+7#2{_*B&kbO}JQQ>adF#+!7;$(Ve(sz4y42b-SaDv{!J;r2%lCY8 zjpNmETjV?N_b)jX5!fY6vkxO*4&Pr8)~?h>)9Wp z1&`g@9Nr*ULY|7=+)o4q57iF4T>YVj3m`1<#{@vfVBOrGC~%QIX2^NvRH&z0GJ$h& z<^kpF=uW*)QwZoI>1{8&dYdD9ZxE9)n|G_QwEO0f4tY6q0ww|PcTrLB*_k{R zw&@_2%ngx%w5uBDqju8WovLyPWgR2^NHP;w&%Z1#z{%Xoru!Q12KhElzNp-gj=Wkl zB61e7@LT~>6?HC4ft0Wyuh!pdu_(7WbhG>8#W1y=@M2!XfW-9QnV`mcx!fK5m(b}^ zh3NQU@<%(Tg!+0pryy2}j){3(|@ zG5j+O2+1xmB)G#%nmC4K^yv!XUfec*0`n`Tx5rZpj2LFDV!-AmnWUOwMDXXEd)L}J zF0jQMz`P!>Tq0^I!`gg;guUK6d^OC|OXly^BFnQXX{#2UiC!0+XXs{}z3ghU^<34) zHBr9Yn39q~-l>*z;x0L#Th%zy-s(DNq}k;7jC9`qF3>OR7lYSx?=21%AKIYU$|Y>`#v{WuVUB@u}ox9C?SoX<4H0 zXYqlPJ6|xB520X)b|nFvBpdF)J%87RyD?DDB5Z&=Wlk#e6uSSM#5|9K48yV^VC@UYppj(h~?$fr>qz+O7*HL^Gf&I&@wChbjV|Eb&lDycb}kI$v$+AKR1+Kf(C;;Vg@qW(zs@}YIoDW8 zQ!dv#Sll!gHa0dCL2Q3M=WU*_@leu1Om3vA`7_q`1)Q} z=yD|!y1NB5(^y8w7$=vP!GnV^v643*jtzms4vc^gx$L=iDNZ1G>vDPo#JlOqSrH!8 zg8G8QwGIJ}#<`)ra3^P%spZwNfhS5E@}5u?@PUOjNxZp%on4BT3-(v?BKfTR^76pK zLUH91wn_B>BN{o^_^SLH+TxJ#(vSOB2T#Kk2F0)>h4N!hw`mISe} z)?SmN!^&q10Gsm+i`ubCbE-WCfouZl=~`uF<&JkN8c$E2m%{?71JD4@`^3hS+vfzQ z{k5HqEq`%jpWESvy0uj!jTI3fivLxkW@2s=3j!-l&dz?}6M-mr+ke*Z5_HR=n0dU6 z4gGEu@+wf4@LfrI>p88woB-Gt8)W0KyFCI#BKEl1ydt_cbqn`R7FWJb;e=MTHT3BY zncC$Laqdhl%!rc`0(BFEd+>FxPO+|69<9Q8T z?R=8>Z<5JTcdA#5I>M7so00)RZuk?DORcSg=T=jTtKqbtw)5g)=1EdR?CyJcF~Z`y zH&N4A%p(|Ts;i}Inln4H}Hg~a6T1JECD{GtD z#wX)V0i9*)`P{tnFXjl-_oj*l!HRTZl&PdUG@6>43oGiTI|n3Jk9@AS>w9MhT_x^IP@jU;|%92j@a{Nxw{(h7F*)rub zX#j_DIvjO*mrD*8tv*6AZfZ9tMFPx6^pxjez@j)reLe`C9E2NWfso&Q z8sSR^c&LdIRA>Z$aGF27FM3|%@JC(0U0;89?VMi`aganB+GK9~s=+3v;XpT3L#B~L z!RvBjWk^1_$FyaILassV=l_CggbpQX2qhGQgM<|lf8v3@d^u5MH43Sa8O26Te|*fI>T+1mD%1_ zs$7PSIk6JHZ66Ue0R&RSw?1>ErZPQSv7?KjPESvp`}1mCvt&=G&|$5!S$@I=F)cVR z<7TvJhRvRZM6BM$eesq|H<3e+?3SnLSS@=q1vq#FOLcWrbjMoa33FUxviNq76^549ZgWTU`8l)sJ)~gajf* z=y*Lzq0xkw{&e@KG-p`YS24}W&o82QK%C6D0iUqHS3(!$bccn)Sk+7N8-^Z^egl1p z-LW1207c>Pr-`9qT8?_ocNpr4AKxCGoUp8Px9UB}E@2Z$%NUrLbqZ^X(kJ63xIIoj zRkYmgTbU|#eG^N}4y>RgIms-507d zsq1EGQRGt)xv+#@9O}1!$*?9+v-pCn~}>0K#nk1IOuVV&VM^C z*tg@SZ*HBYSC>a-nwftWiyQqrjCvs4@#nLgFW+3;kNQm}SC3WgV#f{%Y033+K!&5_ zv=0&S!Eg(jm|R8xXF^`8{Nf{KBcy}=w@?V?k{l_|%h13CwlIQYT?<1_Whu48+764m zyy;@g6VfxO?Oqh{;)x_EgzC=_$M+*uEzbfyqLJdbPp3aJ7I=axivmKPeW3#2e#zsw7<;vO^WC_hG}TJ?UmvRt znKX)I;*2vQhl_u?snMOqm7=H3w|dc%l^m1`j+h^6)f1d!JfB6bquvFYOcmIlU}!@p zu0^*n-}iPgx$^@Zmb;k59!PFpi! zT#3O|Gn^hCP6TW&IwItF@fjZn6+eVi>GMJ&@VCDj5p5Zoe(oO+GV8v-lLou#P15UyQC94~|^;)`M(s+v2|_g&C+( zW@-4IU*IF6B5N&PJ>;{#kia+q+3|G&qi-bQvdi@HvPkZNUj@D0iD>E@CM5pDCNeBU zc6RHbP6m$;+9|d>_|4miMr_P%c{{@_y~%zbJ(d&G3o8^;kM5|e7xH>a@Vptab8-bz zWydN65p`RPLwPmH(Z4-u3()|=4(dVqR=?e}X4f$)+et38?0)4lU*{%>2pz+l zz3nTV@OYC#DWdzz37>PN1Ja$Tq{HQHyR&OcdIeUDXdDj@RHe{lnUaxmC)Pz%s=ghUF-=(Zfe}Hb)SA} zH0`|k*~n{)^_+5O<+I8=0iJi>sAr*1K{>KZ)c#&V>+^%hdMju4!i4`q==rZ z3Ht=)Oq7d5DYW-$;KZ6kYUD zQ7LM6k_Z$YGB_`t3kv{(3xeVjIG{mncxuux_mDb+(+!>v7CeS_cKjbSgG12zezL%k z4crZy50)?ebUl3z#Ttf6uMAtpY`909J`p2H$If zO(UiG*HF?rV(J3C>GsKp*Ir?(ZA8~d5*SIP)g-mKJ>%LwJ$#v97q++>7fr`>T%a63*bxA50=zd4Cp5;g%m5?8!dXf|J+%378iCqz3A^&a~QKwip@C;Jk>dWrk zZ2BeT5k#WPIHFly1LQ!JeWLm)M))DcvXB!U3FQUjG}H?2)wAP$ASb@>Q%Y7x?IE<4 zt$~THmAx|-k|mINkm;0_SwRC(oxjT1y-b#LET?sB8%)wfhCWj|+C2GPUyZu7=DXp3L3g6%v)5 znCzOJIi99e&>LAmyzb*22L{0ldJlqv!uV?`egIpTSD#9wo+m_)iiyG?8_ z6P636`>f1&ftn{lhOSGl(R20+TCK?z+v<%j5;cg~cd8YIFD7DHeeOe0mADK_h>sRn z!HaJBn>@KCMl9)Zh#i|5djlH0-D=UlJJjm&tq|#3_pe@^xEU01c_lTE-0xB?{?tuf z@IH@n3}do%)@(NJm+Sb~o^Ob6?oVp2(0IB~#;7jNoxLrN6}qawuv(9Eu3KuZOWlH| z5=_9QdApXAPoR;y?q$<39mb^q5L7Sidd;Jj@RH-7VIi;<%?|O~L4(D<}q(ce@rcH+Z*2Jcr zwklgVAJyG|m+ZK7@&1d1$%yh7-2Zc_&8ID~sLSEM-&|t#$N%xQSpkE61ZuhWM+= znXzrxhRQb2&RLSWeGBHg+_&Re%1P4o8`-qusvyTLbc?3<9qQN{XiWdHa49~mEl3bG zkGW0hWe>#Z;vbeaeiXsImxZL&PhUV6e2ms+v;`=rJxorjf?z!1scsZ8)B&77vwx1A z?An+^{>M47PP5|JM-m73+V93$%Tn27DmI=OgYN?k277uS>NU$ZpInxaz_h!&@^m{# zz(Wz6J?swrn?M{7e*6D@piMHlA2Z4znxXgpyRe`t9Xql+^|}~ppq;mJS^HQ1h2pu^ zd2E&yY#EJW?2F5}2Xt?pkf>ig;2XE$3f#pNCayo=()kRXntQT`1T1Wyb*Y>m${ zf{#N(6m6FF|CzIy(1(=;NZ{ot3*E~*PtNxSS}b#T@uO(t=NdBpdy`MwNgn_D7$U9Q zYshxudT`ePacknLO*KYcjzWfsN>tGg@o$@ z|K|g}R9=wuTApzH>;k;9+{*I5PVMh|ce<0<%Mr?BHXEcPwqU|xgN8Ysy>zBT8r8*Q z$A@fP&q^2wvkAk>n+DxFkyEjs+46x48#YszzhM*w%YJJiv`afLbi?~SiGyH}aZmno z12_F0Yhd9eJ?STlJ3iqAZKAs-rldzv70opuaGbKK=Qp{2!TV8tSA(7RFqv#K|&;PGSpdW!oqYu@HY% zct1#~pWf>k>HR@;7DnPL7h^wbtIjp#Z4&cwGXWQE-^6THuqnDr~T*W z&16V*mpaIypaL-!pphd13J}$m5L6~z2hv~SRkk~%J0xm4B|#Mb&xh(ZIjDSM4s*lP9K)@; zQ0TU%wk>-JlymSNmGwC#9!>43oi=yf+>#YlkQ8CW=;D~o=GZFbKf`yU|IdlkQQ6dL zpx}3Xkkf zYanq&;~5OHEhO=xqZ*k)S&Ig6bX>jVrY)w4&C_HDqHy%6@|#JLva&uhQ%35AcS}+- zB5F8Pnt~JM4a*gd9NIxe)iqQT?zN0{wO+iy)VGXGzvu_12#F=ErD>qWTX|P4V}i7L zzX~BK;lNB_PPa(N(RG$l4~tQ`9*3?Jogo^8kQE5v11F9$%r*9}QtjU{>-Az)wv|m= zfS@WI%V0B9M4aol66KLE5GHf`LSi;;MIR8ClsUXJuL(gxKmBAjWJT6&FP$e zFhv!krsk{D?g|*eJmmi*tm1g31|OUTw-p5Xt3eW%uOB|3`bV8`34YINY(LfHuvH&A zoCdocq=K{?-!rXrYtbS|%0^jKkPZ(HsZau$e^K`eH_O)JPOZ*HhJ1!t5;cpcr?7y` zs>jF>6dZn-!RKv60wqA8+ixw{o9yo|INmbw?e@oaQ?rFpvpvxCP@`NZW)2or!vP;BI0G-uaRH=<1b2XA0)jQXjLelTezMDr(6j)og?8#f>Pw8gJego ze=Q>+$nf{T4>jxFdqnm;Si|aKxquL%5@H5_wI+Z2HC{9z+`Y;KGOba6E-(QI(*QL*`7Ayu zfoxMVvyihho3Q?^0{Ju`tmOZXOOettQY>L`cz?a${`^tom=i^uvNCPCF*wT=0=1Y1osnSo{mr*yLJ>~=!KA0Y;xfM_Zt^3yBI6i zODI&Lm^Dd_%w|yxY#iFqP8~v>P?KZ{LSr^TsqU;tVjd7lXvh?NphhKC5&6<>R!#6t zoa{F!c0X6{MKZMobIs)nC&I7RbONGhsos)7>`u$=?QtK_xqs%e-+~Gh_9NhRv0Juo ztTyNklF4KPtXT3tBc}7SUJx@#^y(P&TzkH@T5f4Rbc+Nuk1f4!wbr*D!hD8VNeBo; zLawBA2=j0mGx^6Lkp=qBPKij0HdadF`QG|S?%J>U0}KXpg9-NzN~X&es-p00-99HS zK_K&8QSXmO)_6V>{vy^t>EZTy=p|wj@}vdCAA6Ged>UF%y0UdHxR?3V)C{JBOWgp->a1XkARoBPWA znaS>%8MbT3a0G<1zI%Qsbgd&kU0ebYzWzUntJHi>)YPaE)WpJHiDXY02*L&Nk_T`= z6JmgZbssSTQbjw)rzv5;NUW?P6nw7YGX%WTJkQ&ck$o=wlX)}%cRcwsU8xK3eK9%^ zGG8y+AdD!TKdPs2PavPY>G9dU3;i*U78X#*S`F|zVC|W3J6m9c zaCz-eFE^eSb{2&X;&`Y!0rzZ>_J}$wrV7pMN-3M8RR_67075h`reCNW0u< zYrMTTrtLUpQ#inQapEYEnwqxNh3wNe?8lB^t2+{X{t7!m;F%>su2Zp~P#hJ3M2 zv<_Z5;iJLwc3H_!f9SFQ%1r+*8rO*;#*T%J&BghIroitVQj!WQpMkS^Gbp9&wn>d6 zB-QtFLQ2M%we@g`E;}*G!pqqk4#4i1^h{g|g$vMXs+hoieeUDgMEfs~%)gn2>85Pn zDY3v~>5TwiqnA`+poX?KKqy%o5fNbrDA09lz5UXL+A-^TCz`q7GlDX7i01mJb9W9;?^dr0|}3ASY^u z?C_|st_v9FYNJ+5VyJVGEYSdKCb2Grji1F=p^f%E1>Xe^e>0@&^AnS*lG8yp*SuP`DZ- zLuTQJuh$eUQU6_A+jY_4EGwVA@lcK3+~SE%;qWul+7Vold9v=yt{~tM6I%WCPdK}m zAb4ZxhnpcVtgk049q2#N!3qu+xxs*bdrY?Hv%rUjNO@L=Eu2*yTJ=^>&QjHK(Xr^M z>BXU?ddTks@+5)W7y9?(tJ>bTNGZqrhj}2r+XoV8Xy}CoPzsagNM3a2Z`{_o7H&rT zjy)buU(cmi}a+I&ZUuI?Qb|5L>;`hCoM0 z=L5h?4WMbk1Ce;i5w<`;%znEmYCHEn7ZLrdd7XLg6w zSmaf;OiU?p(2NgQ_odL!H@Tm?bi8&F?p`0d`=S8L{}_^`^||>ui-?I|a47h!3Gw1Ddl&W}ar7MkYoud^w5UOfO6UAK$uZ2OrqW-LKJldCU+4P-_*T#()=N7*$?fG@(|vwn%;NOnnE&IM+vsUMGn@UNrhXH||`!zg;oD$FZ7@>qkg| zVddrJSvWX?=FBiFcJn|OG7e!;=fx3h~etp2ww-rn8@&a%Slu=TuRy#ywXW=mmv zV*v6VV19kGwPmc=j0EuI9v&Vk+1XUt6X-!C(q9{_mj~h%1cv52?%4m;zy1s+@=2i% zTWEDv z3koWrKmiFwDyu2ZILr%mSV~%&Az&Zf-9ow^hZIjwPk<<+p@T!*<)wX4P!Ir1*$ftZ zA@RIB0dgBeQ6*8FAPl%qSXfwpHCcIhhJkeG@Zdn-!y^s&$GLJXFrb2mj*bq<%W|$H z15J!)aQFH_eqLyHr1JLm#^-g3kW1&V-|YD$@Or3lJ*40hr_<_Uf40Ki!z6n?xmasj zqFOpSK7Mr$WR@>y=Wh(h^OZ%NokTx@9zuuuh{s`-qgu+$&p$RgiU1IqK6FehEZ_hW z4iFsm^AdR1R8s>Ri`Huz19q&`AhS1xqpuoiYqwfon4mWRgXwg=dhoA(?&f(E; zt?fFyth_+?9YMPL-lFNyBf&q`^x6sh-40J=7C~MGH3cfI#`btmpBtE>EcY;i^dJ}> z9_pP_(XT=s{!xa0QQ!P96d%z74S%w1ctUJBo_1u52wp+0KkUs9VS6rkj?HRQM_=~E znldkewx4cA7fRF|e6p0871YBQIvlZqI)MGwd#`xIj^tIf)0`Ma7H;>fbFY28@1-Po zK^*q4x11LTz0sGaw(D}tMbx`$HTO%eEBD*XFI^p~o@y0JqNZ!q8$?oA1jsvQf{{HAj?Xvqzo{u8 zckI_HW)&%i{*9I2t^*;K|3yOu0y9eN{LG&lhp&m!2uMg%)6?;1$A^cTujjsk@bK^} z?)#b6<)Y!?;Z|#HssGG`nYsJrg^x-hYe(nY1AEsYl}sY)Vn#*5evEy-%5t8e<7u|C z#^csPwL)8}S$nVhGtth?;k4HYh-mv@GLO38;c32e9Dx7rk7xc<(4o%D%fsh(2+%Aa zh~!)w-0ThhmpKIC+2k}fCO0>83*0wPT$Xk|m3r;5W^eMJyCVZn1th(H=jSD=)s2Ae z2n~hxTHgl($iHS@pYI(<=o>#U0k)ABEimjj!4D1=xFG>joqx-Pg%)SptbO~p7a(;J zoB%)~!1Dvl=swSlzUl8T6YoaXdt*Qniu)6A9#^!TSG2$cXPw~d?R;JCtOkLRfbLpo zu*L%{?B%KQo#$WVij^SDRV}?-yYEP5x16)PUv+hymgBU4d9atyb#Q;e@@*{>(2fH(#=kkRd5f{DO5y}2U64}%f{zd|lD2%*=1B=NN#?Ad;XU@0sadRIPn9z1`uxtOl`O2xS|)Qw-;G(w8i;YQJNXR5dk(? zq>yd0++fXjw*ZQWic&6DT?D+962@hut(X7la^p1M$Ful7AKvaeCz9y301l-xz0Nnp zlFld@2^1(<1qCwF(b3VEkzF8DH`3StP=GOj1N32Pdb-R+<#(ErL|*rIu~;3NKdPll z)EHCp3CaHdZRBBssFS2WoUFA6hYo!`>wFieYe1(rBOs;GpkmBdW!0_+@%o)Fij9b! zJh^Mu`k1j2;jjD>ZhEq|HGLjGzI>rsc0~XM0hD&oPA<-hB^EZ##)#bOz*nz_aUTZl zrmn8A9|pC7t1{~uFd0Tfr$M4J#GcyM@J$+91nQqs7e-QPbxJz#z`)8N&@#Wh1+vRH^ zhhD6umlapXi@$I})frtX^l!4cT;m&*x%mQeC!xdqigU6fWC7;LROg`7>4xw%K4wLrU*?LdOotCyX#j*ioWPXT8)I*Aw#T61Xy4wDpYDC+b-pSE4r{3RJ#$ z^~`qLfJY$)4FF!;;BBCR&*%lN_RacV&py3&0we@D9S01peChPvw%&_Lz3uW)1ate_ zR@ij#=ZzbF`>k3EaF&RtbCOq9U{2N}^q$Cp(K2;&OVzS#OJep~M|=Yr03NPryU_&L z!bqg20<`J2!+1BS5n z2Mmh6xOk9+T~{i=yY4*UIxzXDPn~9mXR731$z{hUdT)-s--#-O7GvUmI{(1y_&%>f zp;YWn_or+|$kab47uPS`+>l_h!}daFWFt^ru(Q<+#wTxo%_u`xW@3HvsEP3CQ8`}T zmaq+H7&O}L523=5cTTRJ45MQgOP6DcCHR)x2wW>}{Pd5_6MfN-Y>?7%zUSS>$boPI zw7ruPq0d5AEh~D}%D{yTv87Ql2ZF6;zX%A70{T&B0bs$_U-c0f z;Sv#TSG1gLOy#_=AI_9-j`E#u{rpJ01~hg>1H7XVV4QJrXaE##1ego(K9NyT>yH9i zSvPHEVCr!4d|L99;X*6;a5zAjLtEJRe6t8#5LwRHCAiW%YRvn@(d$4dM_APDadCBY z^=V}F3|NkjUfc9~2Ah3RZ|+p%6;!|%|5bQ55jfC>7Q-_E0y_4bOXmTLk~ z%)rM-;Mg3f)STPWk^%g+(*r+o*yPVNou(CNOzX>vX)CZ*0^hSB*ObuLLy``+l7zJ% z+Gz}`_X&9(MirN8udaMs-;W-&+H-ntpRe>#p`m^BeLvn*qE^b{v{1q!i1w<|^Cj`c zKb7?tCQ3O+2`yg68W&!Axb1JzoX_{2d<%r*Ye!XZId?{DLFIQ@cm2M>gCN#B)fXTf z%Wm7HgizS(1d1ct1Zd^4$#Sz0h*`s-OC&Kiaxg;l$nYrNuqChyqdGz-B1&C!+@F!6 z0L_}0BX$_(s#0C(HQcBEcy4q7TxuvCA{<7Fkm#27#0LZ&289p92;z0N_;tPbb&B7E zw(}Ch&8mX#^1epoB88gs^78H<9aUvX!9Ft33_nV4c3;#_5O>g+W9Bo{i~!7t1?e+( zL|X6Gwn-4+!p8KTr}e5$NAO)vmeOt@yAC}5q`9@V3BY)sv_IO~wj9?d!>oX3{*H|S zz+a%br3K(9p8y&!ZZ$HkrZ;kT#|`OnIy!RtNqh;%F6TOY1p@*CO1@^Mr%TbqzU|Of zvlT$Kx0RQh21fuh*3FcuSNkIqaQ-q%^BvLJ&f&vfmU3fE5tZ-~&K5 z5J?Fjg;TT#YSZe1#y0>L(l*yd}N1JqU=Fv8V#ZvdGBt^k{yCJ~GVj_5Bnu{rm&Y$t00Sik^ajDQ=h zG8-c%_PH|{&Eo5?&}mVmm-Y1(1R7Eq4kt5$&N_kfesT`|M6SQKQyar}9C%Pj1pWda z>Un!23zNS&B1yheH)CNY>Vl;IB~5A4edAHU0JkWMA7Glmz*CSrxw|@ay1VhIg4`oZYk1qtv7y2%QU&_^XM^K%UCUC{_^rgH870Epg)%3 zJU7;@8~3sQ7x}QhAKY22@<8u<$wcc|o2BUq+5Y2RPF<58ws`y@8R``e-pwD8Qag1e zW-6gmMO}9;-_oHoc8Z|;t8poHQ)D9gB8Fu?&_%O{J65vjD=W>j@6=|Ga$7gh#caw3 zl~1Fs5nu@3A{cFxxj4ImA;t}rK1kN&7xA#_dU|?2M|m!J58D%(mv@^nm)(fWzpy)8 zfXO@`b#1@Iy6*e1&z*hbyzS5=CaN2$Sq_9AyaaMIadr3qzC{8^;gUhR<*EeTk@>Vl zzW+|#*Z=}kX&opyHrsJl!6MF3gxO(o(|PsYNaZP ziZ%qhgLf5b9==3s)M35MIb+4$OeK8tqs5Tsl;LfbKKXLhb8iwOBqJlE{kbJzhg-z! z`0I%9;{~Wkbo`U~Il=MKiJS1)oTfEdaPb9vQKY~=&3euw4I4YJkRr-^*&=X4v&e$U z4$GXCS9kAbg`aF?O}TH^-h7`<8SEiL4vVFQ#Gzr5_N&!?=t&fT#$BdoFms~5l`xv? zJwiGO*>H`@%cQ_3sn2id1Nd2(rFwEPJfDUOur@lIW(xUH4Qt}qn7zyK>(%g_6R|4d zT&j=)yDoi>>I_f zxTi`xo}D54Z2!XpgNOGmFHTxHtw{P`=%SusS*-6;VH7(Xekm)6axGXtR61- zLtg_u5n4UNhr!%#JI1kpPmOnHiX@I6hm~Vi!zpC6IeCuY?sA~;&gqDluCF;_!QRgw zH>|Rpju3(>QRYnvRPe9lEg}z8=W(xmp(JM^OM?bH)W3g;Z-3pC6=}Im z`|pt%^`nD(A=^F`a`jF}<;QvZuY%IJl`0RqW3BCqOvQCyjXYM$OkTt%nN};+G+NVt zq)4wGKHEyHAWD4(BAI%ZXGFmJDSnx`T6`PPYKD23_#{O}o)H#(|>EZC%G|cD=Dr}_VtJjIv&aBoFfKc`i6+@YeSQk z%v{US)8TvX>N+sr?)FkbA+@;%)97r0qdrfH{F|79ZS766qn`YWH90a!L8@0;NTMgw zeFXWi5P$SobVG5M%0Q>gJ|}RNiE*4xu4dmHg@(ZFGSY82?B~&WL{^7#06!n~=Wy~w zMd`i<<$wkqw_%RR+FOpnQ$>@1qxiE77mL#YF1u!%gEh+TCgp7K^OAfuM5rSM%t`G> zcNL~xP0HLOfE4@dp@)XqFnbfVR=xCeNMUx~mbybs{4wRyPV;hRzYDp22`~8HWf9nR z;JYL4JiF;Ir{tyLm}C8sUd7(<&SANEuQQ;2$btD!i&TSaL}1o_I@=qz3;z4js7{ zLV~VtQNt^_-VLsAuiky+MGpURq??YOHyuWiQ?C42D*BqGD^>jcJfRuq66NR)uVK#& z_ia(47DHdc#s}Y>|IadO2pNuHNaLLdUE$fB)My2S~kkVo_6C{zX)pkUO3fxLcI}laqAmswa+&05Qirnx(cuPUOPjOSW@m8-lTL+5 z)UNwGWT@h%xP>E^Brq*y)Vhmm>yA~fJ;V3(TI^EUN2|r^CFl7%>P6{7yQVrCi@(V# zEp8dNTsy<0`PRc4Wk1l+jxH|kxzAV2axGFCZft*4??o``N@^aP=w@7MNmdN@r9^Rg zf?AN#%%gz+T8n=5U`g}lWA71MI` zN1AO!^Gq#G;}z|=G~tD+2M&_xQCVdoV`|k))X@qs(Si-DCBWL%QG3)@N`~u0FSY_S zDZ>gS%6^49%aN=AbH@!Xxf|NO1Y#bXjej{JihkK|^HYlbKP^B;qb6|V3=;v@2p}em zyHpnD*hyjL^w<#$z?Zw+%t8`4P)tEIPyQVcM=spnaMz9Kr6ow7NhgH^v~`I%yR32I zl%2Rj3SGIKx4$jU&dAC(U=WO~1;TsD--Lt2xLNALBV!3H9DluYICfcOQFe=|g@^Y7D_2_y}~2dxHFg@<;HZ7XDt9T`Sd zhlg;+A_9#LX~_|w+RPc1-Efb|poBxw^X4W-w82t^nq=SnQW36GMmj!KsWN|HolfI49>hxTK$P2!*=Tne_5-(8M z3l-xW+=+?iAI;yb;&|Fc?{7_6F98 zy;4Ei0zl1xRxnJcjWIPcc<#iQz>e1v&ATrZd$#YWW>NORcxJC{H0gOvUm%E=wPoWpCMF+(wxjg{ir3rqt*c>7hShl>L= zvBnYYYUT1Cd^?h!K#n|33%Sdcg^m-qf*GO-_k@EQ>))ewc?7FAlyTd%e*?k*b*3=F z2k~KkDLum}@=fIVpvakAC~_$BL5zF%Y!b%HUQfNP*T+E(pNl124uw!!c7X+GT#%K} zMJH_x&Oz6$A2Oyc0h|3Pm~hj-fqMD10Xvii%M*OL>}b#5QUD z3`jUp`g`q@|ARL+`cyMj_{F-Q{--Cxyb8smqxBuvj)=i|Jlm%0-L&kiE?R@*gXt2H zh42?2fUq4i8=)4m;Ck@3OjfIos8$E=oJ-928QIyL##cli*C%xF^YahyxR(4_&^TF$ zavUn+nx9=>Zj011eFSl7;VcHVc@ZBV-(T^D^0SxUv218bt0iF7%&TxljrsNELLiH| zM&HG&l6fk}`pu`z8GZ0D9N1Tjx9rT<261Tcaz10oZ>FzvTqRvFQY=a7VCClywGK{H z*L3!Esi;a&Zcakiy&rq{YA9ARPOnpaNIti89|%V`m>d>@MrSxdkqcvjY+gP2#hhJS zn$9>W(0+fn6Ji^iztLrd|4Wcj2|AmPuWQ~>1vLhQ*lKf0#~a}uIg>g!U90QCi=vdL zP`}GLnj(Jm+@(Ka!HHhZvAlefCjBQqxp8(D5)3v8)bz*+UDk~fKYJGy52qF9g^r_9 zp1?~5u*wGSc5t*3N$IqD3p$?L&J{HCh|0OlKt-4C42l!8hHLy4Z^QRD_+j!twOtkV zPh(+}m_@tSchu~nyu$8$hPPF4tG6s)Wf$!w7bqtS?2(e9V+amr!cFOC9E3~Uiy%j- z`7Q}!#=YNK`V3Up>N0v+GJ;KqbvOLev~!N^vKec6S_>zWY)Bi1zqR~`U!8Z5y38%V zmPxFip$1vK?`i&4bT2;{d+H)Q`=}odUSz$YVpvFY{}eo|O(e&L&CRz5QMT`C>y(6@DTl{1cY8Uubg^k>HbYn z`ShykcxqqsigpM2M0IYRE>!kcjUJ4C=CgrwJi1G^r=b?t>Y@(53LIYK+Izf4bOztB z!+HQXYoq*cvQVi)B{f6p$@blevoFT!{KxB)t*AxMgfZc&u%i(iz#8Vfhu7O^$EFk(#m!r{~Q?Qn^DPEIt^9A9nd=Rle7Jp!q z1suY8IcIgl*Ud}kCZ=os$o0;j9|*aB_^m#+t!}P$1-xZwtXJE!Rv*e&$>E^hz3k__ zgaMfsK+N%$-2sv!%T#hrfKitI#|g}Z;$bPP3G(WhY{_Q~4GE0GzW%l|f*u@btvm0Z zY`fAhh^3+rO>VAO=9#w_(y0DN*hjDNw@HJW$wa}L#xlbK=d}0Y<8_~{OLyYYB+{T> z6g9fo$X00N8oUdk)})(i`qe0h*do)jN`c#xOc2c|)0`jndSRJwo_78FEuhA7_H zTF+|Un9*CBaaLjMyS83kpCz`SY)kwW&?HXDi(KieGOE^GykA)oLu9!o561g+d}9A@ z=`xpmg#}Vt^1$>h7WD#E-OpA$SY2!j&0$j6I5ZrB9;R`cCfS;pRjzIkX` z6bTdx6AlxP?232>Q53p86!H**ID7NA_R{$W`CO1Ebm;!&SXAG0@k*A4FUuMg5=O8> zHieu1{xqX0*$*9A4$kTkaT;F;ODHc0qbQxMCR1MgGPPmgB>EdhB#?%~v&bI;(>6cp z&7;Vaa-Z{hPx7)U_!5v|*PbT$JSDh|k#h(A3J7buqlx$$fuP}A`r7w`#<$zQMg zkjI|h=sixv?zB3r?#aDfU~k@XvuD`ZuqO9m_c+4O+9|A;-3cQG(ctT4D%-`5w9HSb zv@Q>&T2D;LTzaGfSU?a33Jo--$po?yOJvQ?Vi8jgkSu|c)Q1}ySD4jC; zivx|gdYj9o^y;_YqI51~FiW!#~RdOm=Z(ol~m6^y})zzOA zkl)OYz_>dE$%%pxz~u3o6D6OV67K}`X*LyvALIsBIH`yg4@A=71l77Ok9bCI+qZod zyBjPN>w6>&P?Mav%crC@Lrj0Aw3gHjDMMUa(WfGt0v&>@>ARG|3agal>s$ z31M;ZCh|<*ip+NJpJsjj3OD(mcJQj1XM7)db(xK_Ce*&hFFq^p+SU>Q&=1wG6>~Pj zZQ&LREK2?s`%FFhYv-;CR{@d0>vfc8T52{$j;Hgjrj-a7+u@SWh41{9uF1

~wpLW>tAF6GaCCNaA(!?sf3VPaM zTg^LX9eNv$f?a$cl!!F`7*fQe6O>jnM$}kn#BWoFF_HGV=y%?Ty!&uV^+_Cw(tSV# z3O71uqxc<^HEyHd&v!qMI{i+;3=)xyi}A7=`DNJ*H3NSP!Nqni4KtY(pByVpPaXeA zDE#`vP)_ojclW4m=4f{1GRG*=*G;5ys!$~2-}ZJoCpmZb&JvU^Xp}n>PA+$R6|*`N z*1wIz{s}1Tw6*hdauUAdW&Im>HK8G^Sb)0h1csS^?=Yr24(Y|EzKPPisr;6zVD%Uq z=lqsmpElSrD`tzF7_p!k%lafx8}mG1RTy-U1VphFRS|?(Bs#?pb*dtBXCn4b6&{o9k%{MJ-!u3*X?Hpm)+#P(}_mu&SDhFtj{ZV7jDm_@Tba$ z4+$N=&=fqT%m?%WV3DIqx0De(5R(aJb&b+_RA*-97nbzBuQ3~JmyMmhqb7`nlXn48 zRQx1g1!fHGQU@IY+0u*ji;D%uj+jz31Z|{EP_NJa`d=??H2r1cV@$+#Y5(E~LW;5r z`oL!2VzQCq5qNk56GAIsTUN-xS1;S+sdqnW<#h_yL3dbrJ%eAlUfWNH_|Qry2S|kA zM}9u?#uEB;y;E&X(9F`t>Xc%mA8bR{#uuYN;qPC1ewgSrw$dLheD2YP z--q|-GZL!DKvZ=U#fTTB5S0Gvof*U8Lgs2%H7A)zjjtk&V3Ebz4bI!%VEUDygTmG? znU7Y!qo{+%gadC3hE=gPrx>sIKhFlKWn$|s3JI~}4hKF5!0X*T3@?GsGBqqOFHb%F zdh4S$IM>~o5`}tkVl1|sb$AQX^~;|w8Y<5wt@zaKz1Egb*Crm-6ui98&JjjGPAi8u zu6Dz;R*`!!E?bKwp?52autkfwuZ!!$OP(`+Oj`uNu`2>O>|IyF`? z{@b#QSviK-iD^$6q@`kid_2kV7o&^3y`s||x>`5Kv0|n_c8q~q7tVs^*W46uB*zvC zItC*Lf*V!L4K6`BcQ9$E!A8+j3s>;dvNX^A9`*2ZVm~oA#>jVpt-UHq)B{qnf4K@* zR7Wp}R@t8r%2$#C#Uk84|6@||*UI*DWoo9E%2YZNfPBK987O^JdfA=~46qn7denNl zO4yaZZUkL{QOVBn=R(ln5whTB%)49yk`&-96Z%NiDVxi8Rt$P!p)6r!{BQjeQj>)` zvHujHZ_FYImoAeZ3mFoPLPWhcSPw)9%GNL)KBbG8vavs~gmZD{d^EI4kSOYYDk@Up z`P%mZ17r6uKGm^{#Ucvolpv`aatM82uuJI2fUx972eFY@hA@Fbx+3K<#)l%-xOLhP zUmy3F+2GGH<)&VH{0jTvv+~FtWg{7xThxI+^zquiKb20KZPneKfYJ0kEJCsR4;IK` zRyyz2>$Sf*;nX=74-js4NrkU>Q32&-^d;Kk3|-KZRhm zP4!v9PX{^gT^$nIan4+N3AxOHY0nT7dBJBl{{byjT{{ri?1QKv7>%-tf1`Sn@t zZu<3L(`#SvB`sw2nmbE3WI0Pmu97hTtwOJD6sSLC2$P_$eWI?VW#nqs5cwrtZ7VQ5 zwX3YfD4z1lga78{X2>(1@^e_$pD$T*tbMUXpEZ($WNYAnH0RODiE3D*)&2Vf$~3Y7 z7=eVrxS$#Hfos~}5}N?nT`3{= z>q!ndC$^d%5$pJxy1LH38KwfS&dCde5-Ya!);>VUvR4en)cg(`vOv2M@@p-ikSaK& zN8kR6SVo;*!xJ77t3J#!c0c2)n_qcotPwnxC|4@xYX4I!V{r~LS#M*z+}a(%jL-&6 zoq!e(S5CQpAk@9SPIi1lx6yB$wmDR&HZKUGl+-dmLEFT0Rh5j#77tu^g9HKnlatXQ z)H1d3%eE1e7S%0?lJWThn_!^Xi(6p?&Y4?JoW+WqA&a|=sdQlVo6R7AE*b3))4FeA#RPwwa4Vnv4^ismsX zV!u-($+ZUfbc`J|_wG_u=(KeW52H9Mp$<6ixoEX|8HIZU$ZB$PtshJu9;JQo2%vIt zag~H@On<{Mh`3bJw1@!Z#D)ubB;&ET>Uk&_}d3Fby zMIkNQ-iDl&%;gFNzzX93U)R;?nG4bwyW8PZ~fDE{0Yru~~pjp5DeZs?3yI_>A(ZKe6}4Qo;i(mV-l*&Cz@L zK$UqFw@06aTbR?1=C`6c5~7uXK^DVMsh-wrn{ER*IjFZ#(>ndrxs}3rKEpTqh9OaZ z=kYqN(BZ+N!>)@$A%n?#eXvxe?b@Y&9LW8E@-~M*fL9EeQXG!~iF>Zv_#Qj0Ti@ho z?QM?X=W@d@NvO4E1)jRY)R7J(NouGuRrd(O3 z;WP}6_&KTS{0;W5>p2}#v(Aa2C&?{yv3VV(Cc(^P_sV+>7r#FahTch!GinMAxMe?R z4H+vkCOUi)GCuOmxF@GzYp5Sg5nOE;2vx0=>tK5am_mr9$qpMaB=;E2W zU0-?VjOOt7?)SbY*3*E~vQfT0A2qUxm@38wYATCX-AGC78k8HPkhNm&47xCu(x|Fi zF&oGTyN>sW)9c3LO1a~qX(tDnbs`$Vw3>+_MR3_Un6S|dJIG~nckL(8m@!=S_r_s| z2uAgm0jmvp1sDHf7Fc&i^1W0gv}0a(1u{i=%eFY)Pm;V@Og-zNx|JfyW?M~@`}H3_ zv&PnI)-7hyYNM@9Pf2O9Wi&4KE{_y6zFcFT?F`cn7_=-it>(~Jx`uylRhn;jY`L2+ z+OfeA6FXCkKkz>mWfm?PWpl}92oamgpFIs6md=af$qmL`9_AP}k(>|1}Y{UV!+m7hl*`P`Uhw#Gw_^}F5>dN0D0iIkq zd$(?Z$Rmq$JUZZye&Bn9EGf)hiw3P<7Ea-bPp*k$4@ z+hUnLCOEt`FI20+tb*lZ=)?3rQ7nb3qQ&dN;iAyVWAOejd=Si}?Z9tZmZ2|SqErPw z1-$4p-LZk#mgPbia`I`Pb-Bupo6KxpNQ=mPkO3cg_WbpKb6vnvpUm5-{tzJc@YTBo zgbS@!>QXA!g0;db8F@|tCxHnOLR9JF*-*>1-7f9m`i^ebaGuf7o%H;>7kwsd^~t*u zhs$ZnxdFqsWC1%q+B1ig8g?uUp5XjXr+)>-(m#>J z{D+L=R!2qOC)eoaUzpBqrFetu6^9rW@ZrP0-G%HjUmnl8kdd56obvU15`&a<>4Iv) zv1f+$(-;|9{dh?pRHL}bsUh%v2d$sZUCFyChwpvc?__O}iKMdvW1hDPKs77Ko8sl( zbYx9#Jhx(5LIYx!hf-n^lYvV-hId*V%p3Ls>RM48fpw@VEs#`FUL%mMk&H1W%>;RL z-M`KfXxTCjZmWPG)^-Zbup(|f6O&5F_YL;kP$_p7L)jlC$oADLwtP77#aK!epDU%v z=qV%!wF1z{T=AGRpCiHBUY;ZpB=%)eqgY~=f9@kc;`mWSr$DFJsmYigNi7T8QvOYH zB+eAZFVLo9@L%fDd+p(BY^0(r4^%q-+;J0eT1PD$f2F-*Rlk+V~$R`a3K60wq=&eYxsrfA%k1mzYG$1CRUNclFFZH1bO4C zDzsA=s7P+p>i;5@#puHDb4m{w(Tm3FDr@pnM1PpBkPBs!3^jr6BH<;Ez~Oz!w^(C_ z-aazZD~58vpLI}`*luM+6?JCH*h>8_(wI-uPJvF0{}|R#wuj_K8@O7ouwn14J*iI` zbYuI*QY~LBkFzRE$-MuwfTHpL4PuOgh^hvA;JxgDjZ0TQj`NeJV15SocL^GO6*K~e z_4O`Xg0>Hvi1^bq37E6T8(6ItYJqYx7F7P00;YZK3*{lMU5_H>oMRdMf_C zNINs>uxkGf!1L&)9xUI!N*yj{HFmWAq@f^&4%{IGlVg-u{=qNv(bQOpv9b^%?@pRfX;c~He@t7p$->o>aSJs#IRfp)7 zm#FqW*6XxJSCS6}AcItzNbf2ZjnE3;_BwJr_LZ%I$dA2Af&Y--D^e?EQW*;y*hHvV z+7Q-RKFaX*7Q|C*&^1US@F|vi=51{DJJ0CjhUJfHZdeLxjmEk4dO)!TfAuSripXO# z^7x3Y(zhW-?EIHXc)Li#hJoOhz4iao0+`Bi>Gv%-WelC15!WKNR{0P+&Z6OLZ{873 zBh6~jv#}NYe!%aFk%JKbdz|+$1FHGcZ`%ad{}GD;wVfJstDc>F_+F1 z%dF6fX2G)-1~v?Rh}$!wQc^1-{P${ajh5zt*ouk3iesH+z90iiNC?yOr&R&+%iF=`>xfHdqD=t zMq!2kz`$pB^Jd?w1h9r{;JbJpY5{8$njSKXhVPuj69iXyyLh@ux?FIsYlJh0feI3|`Xj*-@Ok!ZslWwls)(H=mO=!c|k7gUaWgf*W~uyV4t{qD?*` zMwlhiZ|;e6q56jgQM!RRIl0F8acpH%e;XuzKM%YRE;VX{azBY(f&mZxE>fpu!N$*o zGACB1K`z1+hWE<9Z)#da_qkp6L7%DF9$^oJ?hhC|Ic z-9~0v+1OF!^Czi^0u^9{sBru{1?OCFhNp)&>b%73b$io5;T!6C0^wToNRk zvvj2@q^Kz0^1FmhEbXJ}Q#&Qld;gN)2HuSbe-bZ5&qt$Rt)Kc^CZ?k2cAmU!KbjEU zJ2T_jHFj_w74%NlK=E3RmGkqU;&{R})_O|%vmE>er~TLN2j{it>W>INWj?BW&+`yy zyR?_0svm>w@*({|UFo`Qe^4Rzc;Y{@v;AtB zh8v*X!zTDhrka8smrAMA){h?%(M@?!SLgH>qn$iOH|tEuq>x@>!OQ>J9Z}c*`N{d( zD*WnG?R}5`HRV4Qb&!nwH>Ys6i3fedtpX1SHRyE`x&3N`y1=?SWTmM)B!@d@hZx-? z-BXbsm-$x~r&5Yx*+yn=-?|}T3TyUfY%Gi==H3k!lgJcD6iW3`e@D}~JM<*FHcL`i ze4VS-h~VGjE8X8`x0%!pAbv`j3feYHIt;@tgdA%sort7Q!5muesOurY4ZB>IinzlT*qiJCpP?u;>Tg18To%SAyDu1b7`_>|?1F7&$BKPWhYEBI(?- zKMrfyXp<7+Z;cjM`u9$`qnG}c+~kGdw2UPC(HXlragSQCOWBLzV1^I~KIkEYi{0g! zNsq0ehz?>6UV{1b?i8y)QauBm|D84ZUM9k52&V@QmfCb){6=eWDE+7-PT%au;p!+y zokl1eRSTnh5@91)>v3Q)a0LcGaR8AubxbWuvaMr+?|n|ZMA+Ck_Xj{<&MCp`gs07v z*RV%opVX7wv6B;&L+J?GZlLSZqvxZ#Re-Y?zjTB&(7%nS`Y)DhBh>Y;kzNjq^hrxF zH#c`GS)g;gI%<19NQFugoi__5BqW4vR;%u2dWxTWS0bJ={vA%4*TKG1vztm^0+N*s zsZ{ z^$4imL~d$S;vw;Ofy-_DOuDVzio8N)$f{T{IrZ}^D?RB{osP#3)M_|L2@}MI0fT*J z!ZVg^SsoDe3()Stw3fE6a#4ZEB&CVLxS6LfWaW1VtG_J6$4AfBhXWJXatRjMDkPLk zAdLFK+6-p;b3)ke&~$0z1hjP?!C~406-2#E7FV`dyY&wL@R+q=9kn3&pJubPw6*PV zvSWK&ZBJ=RcSt((}_+N#U&&8LMZwQ8H zIR(bJ^Z>~#{7f_ReSH7M!uoBGyAxs^0_inJa&#kNTz%(}cEH zS@GlLi6=QFSzXYP~R&xVJxhsy&1bw4Lc=y&!w3)Sz2BJV9Dh(6O^Zy zs?EGj^c8FqQWLffW-FDeN;JOL7gOwoi^rp}9ruq2U(|Pel%#~`oOx#E^feT|#Zh)MXC?HCyZi>XfPR)H*kNM`EeA)%ay z5ck&9v_cjZzBDq_v%x3F{|b_&_Um5=EG#50EgjyP@{w1OK|YoXiOQnXJSSWh%D|ve z(~v?u#3ZX{l-#@ia>b(lK`r^AjEOn^dQm@rDyt!ql~T>cel$*V_&_RWdfVhlm_%7( z3VQLt!Erdr-Zo1v1&mR8m0+&&#UE>Ldwk!zioo%eDy#~m9xOz9NEb(GiTHY8TjzmL z{Jp%UwNA8S5fLGeoHC2^`2`LRV#Tso+g>9&?B~c6YFKVCSzo6WvV{?%76T40ETnp9 zBbM_wSq$&r`t05w@y#5pSyoA{}m#n)@Eg zg2jAHn|ZXm&{r9W4WAaDZA!zn{m#G1JZtB|c-& zc9O}AYD%Z8KbAUH2K8Msh2)LlQF&EOt3*eJ{`azv{#HrVzmTwt_VUcqW%uhe%PN_w zYbGgN-G5-+5Zg4+M*BwMVyD2CRaUNPW9Q)IE!UJGhv2sKvyYKoGcez(%VB6*Wc;gB z_`nnVk{g4Cac|BG`IU>@K}HLPw2kUWvP zp8#ig%*OZaSparf6KP+9tV;dOceXE>( z&&zfljJNoK98G;MnAd6#Dy!%DM~d1)7N>MXgwxdggQk1c%$+^%7$qwM3h!SE1=M*M z|7%;|wH=F}u%-`>>!iq1>ZT3dEjpigjwypwOJNembLyzB9@?7jz7Et%D7P6Z4Np$` z^%g#OAagmj@ca?U1UeS$BtPiv5Y!ukIOiEYVR}5HSd@w_SdK*b;>3x>q8c?;vFICA ztIfdn^8Dp)H2*Vs>a3x?*UMXq63I>>t92)1KUzC}I&QI;W>$gd)bjWnMTpF%5SZWn zPo}$$QcfySfASC!KfngOPvUb^mywo+%|Mz+)%F24{p#hIL@4zOL!!DM<~D zgZRHq7WIBEW+ZSQ+28Kl6Y+8i8dcjSVm66<5Bvtad`RKOWs#SYi3dMF7W`k&OPfCj z50U+iKj|VI&)ZDhIK)_weSTn3Y!IUNT|nnEzLYFzWACHIa<^--m#=Fx33q+u!)ilm zaX6lG>qkg#dV;zVyb|swrf@RMbiNk`&S+MTmGHOfb#`@>2;IPX`S97m)PXsl)2?KfCH)wB80kMguqgLf&yPvG7z(!asViZG>h1wWPI{Lf8aYMaEUT*crW@~R8BWQ%!frKt zzdgiW@PAZ{s`g`D0eb~TP(8wKKKm#;hQH+(%LBrykL>!3#g;|(ZSw~&--4x!q*CX- zI*tRMcLG8~nj6m%FOF8kng%qHbn~z@LX8NuM2;W$>bFpCS1TgjZ%28fi#%u@THPaY zIYaO&Pvn~FcAMHW65N$;KIZ+6*@3Ld2vftVsiMJ8WHMIQ=tDSXGn8o-DyMFwHmXk2 z=#yZ!8a;<B83}=7m5JDfL;?p)#)lSx$ zowDBgcy2@Qo8^CUrJX2qJt_;b#V2nl5@0B7J|xN!YkJlTS{o;_uj_F2xItF<)G(t) zLB^zf24OE)o!uH~Nql8lZ`%#R(OmVbjjs=$<=z+jcBJuuu6+R{FaT^#UYL*7iUcU z4wp6$H5lfC5q&o)wsd@XLlFj!xyN&27mC^@Y4?e%)aLE1dnlVH>$v&b(qvcoQ8VUy znTNH!W!gL1_@oZ!XC}+$9xSP}{L^pv&b|Xiy0&MhFqN)r7(NRdY$iK?zml;<5U9pI zS08RSBA74U&W8W5;LqV9==JFm*T@a1R`6C{k>qi%e{OD$RCenB&~%Q`d9_{FP8!=b z8Z@@kxUp^9wj0~F(b#t5#UX!oNLZwE-{?F40h?;w4ze+Cj?XGxCe$3dWJb2P1V)b_THZ^wYi*Pej;Y(%awp; zX?wuou=#f3W)!v4vGqp(=9_zaG~GkzWAQ)xf~Z7HK}S9bxhoP*m$&o{9X8q=nK&`k zj`3UQkuqa$)*I*2RC`(EynE8%QUp65%(aLY*>tr6oDrmXN@yb#`b7+c0(|&J^|wtd z5zdrIK|c^&SMu_vzj%3m-ysJtU9R>vKZqo#++ljKgVpTLZrt?z((72Vv@WmXANl=d z!1wQ4SX?T%Hfn!m1CR`}9FLG==dn+l)lGb?cQEj4z+9Kx(9tnIJS;{n&6X`ogSFKH zGIz{c^0$>^0j}$j#ATGv`hMaTABAN4wqqm7NFi#cD}q(#cLQxvvIFAL<~o1h3$ZDC zx~#&zG=-9KvMaiV7Y}fg0pO9upQH?c0%dJ$3v9Hwe4bggw6wg>t@QSQy!(HU8ox(3 zzaJeNho88fMNJ^(J3P+NGx4(Z;Y+XAJppj2{v-1#$?**}O!JS|ypGjeoi$7|6UP2K zQR|VcT-a?|(%nn-Jx|KW9IxWOk<`I7Pk>@I*jrrJ zKp$qjJc0?C`DVIRM&Y%S{+c>n=i6!ggB@A7Lj=9~?=K`)6&$8H-ru5>6q&yiLZp&; zKNV}Y4CCZw92&>MIxO!tc~9I@iyok;E`M#)W!w_|=;R}J<-fSv%*m=xRwUpAwMO9E z>O`E@QGGvO(9w=sc=ILh*Fgc+jUA0^HYIb^L4E#9x?a)1F7$Js^GW#tA@tZssi*ZC z=kT_hA9}al*$P@X(H-gH_eK5iqIvQ`F=SXDuKt)zfisp(=gzh;%in+fB#rz>Q8)!y zp`T~~jg;##nwr|y*5B{%{J9^mN5Ji3zs2{o#r@-DOD^Zg`>v4apu99^muKrA;@a98 zP@Fh(djGUf`8}K|`JXotm1`TCDN-pSFho6E#>C+7N|V zWtdYOelCb)!#DOC*b?i8jKe7v(6L97oGNRh|khs{?*0K(C;m zW7W){YL&hYJ!cSf3c-t5nfz1+VWO%+_D-+ie-Mm72*=D%yv+5Clf2d};NkDs zcz6}TFl=|>Q=`~!1*x{*PqSUd$&=z_7^XzGFA2W*O8_s=O$#uBdm*Bq+m%GY&>;z}f3EgQvNSKIkS_Pmbwd=f#Z z=A^@e(S?SdkMBK;)n?J;c>9W_QthX%fj`KUE)ATZ48GTq-hYLOJhc|ry4nKq0KL|Y zBv~sd>|m9K;Wqj570-;&C(VjM?+XShtwhUYQXJmpC&@Gg%PXE}fmZDR=H+ZkYcL7# z((snQfri#KunDc(aSe5j9-88!`ezXQgBYSRj8fN5(JTlWjAJtKVo=-AOXnzFZ z)z-%@8oXz9tHQlM!rE{0zEjok!Mgn~Rya6RAn$=q&SydlGa%JilNJ@+p~ z0twj2P`If5BONGOYe;C?lGlgdLi-QCTnxpl4?fxSN`rDvMCcOV$U5y%Ha zUwtHII8dye!5Y~W4-#szT;`AZ^sV;|aFcW+J(%laRfX`Xm;!<$NSKfH1XINqob|(n)}2h))O3a&f@EbU zrc#<#L9$R^@Dt&sle~EoS^~L&J0}864oMtycue{5%{dL(`#+wgbW@zm&Yo!oUY8IN zr}ho@&`{y|BI`qH;pZr8JRG^U=B^(jhku>X#lbP{v;YGV>Fig_=Z2P!9|=T|Fuu{u zeJmX545dS5OtX6s~61=4&OaWW0f4Z%b}->6Z8dE}#zZ z>@L}YeJE@QS9sNyg`1Z=j$&YEhkwb=c9vP_f;kF-ek>Dh+?*90rtOXS2>Ab)Fz5KA z%m*=z5&5_VnMf3Zop31=9*eqe3AZk(sn`Aru7#F2YLS3Ezj&#?uN;tm%{ z3+D7aA}<`ZLdT4mA^Y#Ow0LU&7_#CAd|RYanlrSsBT^BJA{l44-B=A7ja%m$#2)mT z(5G&s!Ci25bp-&S?zuxpD{&19x?IYU$u|Uf?Z2Tj9J0i+>LM$e}v%#d*I5n z`Z`7aLV$wk+a-&dx3{n9}DWQ{Z`hKP4Z7YOsuks zL*OVBH`5#ckd9S!UGZ~BN7PhxznPyglNb4%S9>Q|aBp(^p@8S$rYVt9&hch{H2uZS z3@`z80wlgq8sGR5k@r;}$4U@K$p5rpml+-Ws~ESe!Y&{}XT{+@?X@`oR5*F;hEt|J zXI;BboQx?R_cyh)i~vOV8*dW2!t}Z^rTQ+M$i$_->&xcR5#cIwS~`aMhVO>F z$506dbcv&BnH(JI#~LLbF}QuW2ApgGuLwdhoxGvh8+9VjKpN*bb4%mo7@`D;>F5Q)}{F!s3t6X#`Z zHlUv~ixo0u&>D(h$52N72+7X2VNM-U+QS6&S9q|fx_yt~!$m}z(IktMd@&eU`dj}P$|FsMdpgtBeER;dT7F`mCW$(llZWN@OzmWx6uV6@hF&dyv%OO>*a zDsm-gOn@#@{h(yVobDb2@Rnfx%GkwMFPP1j7UliozF49OKElVP?M;FIiEU<7&fGfu zPj^uHiH=Xbgh0FbneAn5Yv-UjH}JDHHmfL3|7$FL&WzLPaN=xOdS{}1j*5%KS2j?R zYNksOK{kPSY?nY6UN;!a7T)817EvrDZ8Xem(<>+0m#0WxZHQ5{cxcEwwT>X3>wo|$ z=RgN3cgQ`qqL#kT%Xyu|t0A{bWxWQYbKWkqf>kRa`iCYGje zjye3pR4T2?RzH{-nQBNI1SgoWEGG4~x#ec)<}Eo$4khFqA3(|y>S8c@kHQUs*6VU1 zu*Xikx&kY8e|oi$CqgS52u}=ot9&Wj8seH>UFDADdysv$2|s|KnRQQSxam*pGKjIk zY0nN0U7Qwf1Tg^bWBE;_t^fbM0M3~7dX&@5sF_#4-1vUCHP8s&3Da=Q-Rt~OYq_of z5(I&6e4aVv&p$j})Q$eiz<+q(V>G*sI7k1n(3r~RCekjV;#EsNhktEh$jbo21MWvW zMB9A}?8u38kt34*LoyRL#ZLa6Zf1=kM#YH5h?2||HK{}-hsuTC zy2ObTbfKKD?gvB4I*516p>^`Xl@QQh=HHK0vvo*2Fqh);yWn5+GQ0Yg#a)MJ=unaM zyh*3K_P|+6OLy;avTG8A^>VEY)YJOd%ozlXC*6n&L z85X(V>AZ*c#tB#Q;-!OM2rK}>AhJH*X?I72FCwUBH-?QfuB)-=;}2p+2-|ZHhTb=9 zXV(J%_g=sjKR_+k*P?!Nm86jT7=*bR8=a%PBGf#`gx;q|Iwl@lu9cTX3BKSf-bxHcq+f7ZD5lj= zNlzQa@EKm8(Vd9>Zs>g)T7i?aMEPo=WR~lP4!Ur;tXg&{s!F(Ci{x^uWFs?lpc)aE z5wcReyUq;A*DE|HAC<`Ij*gJ*;q`72nuVkz=p8Kv{10w4`w-7>}XB#DIIroL2k zv4exF_S0%ctE_}*zG@&l%zP{UvHmCc9YRk=P&g|;7LSrHX|ssDRrILy(LL~|7+dSi zH{uFWe|>eg6O=j@%Im^{C%)v8A~M-qFD81(XYJ?%q* zx^kU)&5i)cFtV?n!FSx**&>09*ENd5&Ah%1f2I%y{zselxsMk&cuzasI}_HNo8MrM z*WW)zJ|4uQo@2S$TOR)reOyg1uWlZFJa2uFeScB9>|T@c)cT)+Y8^7(SiI>N3$&E5 zFoIiYZF{oZyJA?zNw7Y`y*3b?`bBBl?|n>^eHey@+Izp8WxZvV6x%IO0O|{Ym3d2t z`D&jtrnnRd9E1y#FVvOLE`lmTIm2&JWz^_NN9Z<*-x7g5deP!TA*l{lL)hp=(e;%M zPPC}PUyKx^9Fa7(q9u_9!tEA+(vRs>23w6qmn|hsqn|?;Inb->rjzI{T=FAJ+>2xn zawcn%0nUp4bpXXO>1!i7lMqEv%@U^;{f3bFCQ#*lX4R$4gZdez9Q;HPBfQ{1rJ`*T>ZAU8SWd)WL+i}kxE(IZ%%lhAp^GSyN2EJWQBe4sn<5O=C&ZwDP}><}X=9Gh62Hs1{~{=k zOHvWWeTXCs>@Xi=GBbI+k1Myl<}hhMT|Awz6@Ff)~>YLuuDqk+Gp@^51Clk0R z7t=;-%)h9-WP6l&p#SuCdFze?tG7f$4YO;Vf`p^N7^NPm-Y!!aA=|5XtgjbJeyb3( zaMdot&37!C=-jYeJSk*xn?Dqd=pJg9VPbIF(`YbXRB)57IutRrC39`T9baB*tK(z# zV$IOYr`bdpj%w8a%pRC#;;s85c0vS@U)tSaiKA85|eVIx?ei= zsk(<76AoF@DPo~Ql$U;`eY##-W`CObkwH$2&`$fX_1aVHo9f&0X5>Ln3fOmrGVr4* zKa<8rpAvYIpWpLbF8v36_gr&J3vl24henY&T6eHT6Wm_+pT7dZ$oB<5k19uhkEwX5 zxN$d)_yR>n<$zuRnR|nf;CxQf$$NqZ8+BCJfjwDjY~I-)J+j=Uq)@th{`Oa>I~%1a zBrDO_Y;7B>_&$#9@QDJ2X=Nf(3;^6W6liPUJ6y%-r$k*}P>%iJua2KcXUM`0qP-oE zxaKe!>;95#Q}nJ`J%wYndcBd>roT9$rnzLg$uK%hJ36y^ESRkJi?q?RYJ8Ixr{jFd zxN`#Q0Cpsa&CA2UCbO%S7$@1}^!^q4vXv+UFfkiAEr=?!uxaU36F?W_q~n@F-&})t zaki$FJEh!)5J7jYDSK{TCKz-HH4JUxd1;q<`Lyy6^3skGPUYbF{?z+6b88=naf_t? zc}w;Cm)hofj{BMD7Al?FnfXBkY(H;SrhQX#U)pl_KC#7>m6eT}bbx;9<>j^B>5-WG zFFki>cPR1`J^Y`x3CPTVO{0?c{b}!YQ0{ebZ8O))4+BUTZU52_nfpDnbQ&zgNWv$u zes`ezrxlb9S41r8i~1k-GQlAd{*fpAQOdCPdV1>hzFpHlWh2{+yJOmZLyIaAK%_l? zpL0)MNrR?em0=JSa#symCEDgoP-N!sg1c6P>UWy)%FqUh4ZZVbOpLVeg0$lqZFEWZ z!;SAT3^mKWsVQ^+JdX^oPqg=cWBIbZF5H)x#?Q1(c8cxd;!LjlW+%X7)J$se9i7le z^W84Z4|gt0AR<>K)YPGI$zgQsq_z{7;vAR-?12qI#y zr`-c!@&>?`1c-CT3=9bKKhMP0x3^2Cn3R3{)SE3@*0MMq0%^zHA6Cr%eRA{xRRsvG zyxz%uur6wLzn$A9n&4z+W`3d=J|Xd+U})agtAYP^Q-Ctvex9>aE%d*!{Rea&KT@W$ zU79pSQFYQfb+v26oc)cRO`v5A%8r-X<5Ov>+h{3HY*p`w?+uB3Xa)5~-xm^iJcVTP zl03-y(9?*qt`SRlJ9q#-m?8=%*tiLvsgF!NgI!p}f5yKMRHvvBVK^f&Bf64pRteu)Dv?z(`YOdjD zNom;_QbQ}9Xr>s^9-|k@%F^J)1&OSsJZI(B;YA&P>FUi{Ma{TTM_!Ce?Z&zh?rc)_ zKMZsfomm5a435~yJ7V7+9o~|R#N4Z|w6kN&X^+bpa)`=*!GU3qrxC1;iBmN#8>lg) zJ#)#;u)8!31Q||Z47RDW#|!&?_p(<&R#0YM$Ky4%xEcruvp;UiJR^*eu)aHadY2+` zi&;2;n99-hs?7ZDrq@08@i6kiA(5cJ8H^kOElq(l9_jNQ`*G~ndbxk1wK)uFhoqcb zT}_wcaftK&e)*B}a?ug{xn2V{l2=PWkxv%4O9U&zu_bU<|MxWVed@DENzTpIf@pT;FFKN*{>-#Uu68?+XP2hxR}D)>aP)jA0EkvUgR*#iWAc6(qaxqo|NS(S>j^$cqFbHZ^(dW7&h1G(bXd)jxPf-^}O5)8|s6!}xg|kt8Rm z<0;Kj_ChvIYd-tW>S9WyE0$YxV^z(wQzKGGB;)yNqCsor-)J@$^P`|c(R3^7R3nr` zGnEecqca5<2AZHiE0J- z|58jO1GO6G!eB^cG&dL^G9!bh)3ABe)d}EsOZt-O8_9+rpLy>Vl&`bdd^LU{g&E(y zgyqACu-r*a%rtFnUjQ+1zvuCf*lF*F@hVz`O=at(u-YcC-kP_ux!0PH0l&wT76oLcdpsEGOXae(KTn zJw4O6)8D6oqMd)jB>w*=D+|*ii~qJ~-KUv;qq+3F*#KOXJrhAld}5_rW=>YAL+{76 zef2h;U0>w~=4~2SvSu+t$9?t z@aoq^;Ucz0erFq23$g&Cy*+1!;VZfXs&)!lxC!?{LK;^p3%(3?G-WF-93~4&r%mF4 zN7)>1m3qls){MEj=Z<#mPeO45vR)S-vGN>g7%niOtTF8z-v#%$B5;Y59$8$zQm4(X=N=e7-Ogl)&17&yh7Dkm_N|?;DR?K{wS=wAcADs3=-Tn;Kz-nt>?CbwLdZU1rrt$ zzQ!xpiDQOl96g>)&Jj#=dDVC?A8kJB)=?#h&ZcPEp$t{HUACFU9(CVuSyg}Z%uQ0= z&>sG^lslS66>?TaFJ74XYmDR35`-d^z!{O}+=23w^XMuc4Wfe&{UDgr%G{Z^`%2x4 z5mN|RbAx_A=TD@zWu6p*5$zOLV8H!7`}ruWsDl1{AS6HlOgRW+s>`irpHvM^;{5&% z)QmP-HEN&x2s&Q|TBv1%@cNs_kyTy0MgUCSBN>P?cL)LWvroaZ6Y}o)5AYgO~ ziK~IA(W2LHnq4?U^$dcUw{fh9POY&RjT>#qv>0#VvHsnkfwx*U)0IXHmk)AApjdH8 zQ|ixenaracF-owlm=VZt*k%^2ED^k=soX0U`^w~lT#7@u#bhuZIX{@($Sp+@)a*jlfFqd%oNSxkUw=s_2Xz8?)Aw*zm?fnZW#E37(#c0uz^ebt}h@8zc_@5 zR+UY@@ww+TTe&k)6-?NUu5DY%TfhVVCR5j2t)G)hsL_ARp6p~s0vMUf%pH@l&4iWQ`bzSvhv5>=! zzuI{DwJxfvs*KDS+3NRIv^9#>&P zEqS8jk%-KjSJyN2iuYELg_0&~F}V9`>*~Un9cTeNrHQGXnf!hjx3wV^s{psiRa_B_ z#y|tG)_?716itce6!yuJES%A20cv^rA_`~J&0K8*>MUa(NyMasgo=k(pCPAY6dRc_ zQ&iRQrAB!&^~W1knv9!K$!r%3xM-`b?Y(B=+3=KSVTFZ*s;W4SO@mN=gXh<+Y%iYC z7GenJE37fPq};Q!t`S&okfK8CYUt|bo4cV{6EaZ+Zv z@#wfDS)H6C03WI}4UX|6-mP32t*Y|RF?Lm?W;|SE6PuV_gM3Ms{{V6#QW5Vc;91 zu8ULfx2lkY&==cG!v?QiBZPcrR9jtpNJd#hM^{+cLDeDy_tXjx8>bgrs$%2qaeyTh#YiF{xO2_W!z1~hN6;gINUvAErbH`WE?TD$DiX443di3uZn8on z>#AS+(vtMlczAee#^6js9qCM7Ug-v@O8XJJb*kzNsEbP+DCr{p2L~pYDX2o2JxK7N znI*Kehw%cE%flkiCAFTU#&tL|w@oLuk**d+iM%)l^0J3+MP{HUtgcw`leTt&Q*(5N3)e(Gl6tkU_8}q7C8o?&l&mm z+ffBfwM87f%%TO`U6pifBGT=`{XkGF-im;_8NnEW6)6l8<1*b616V5!0X+?J@S(3U zZ!Zsy_9YP^U%r;4YFI7zbdQcpMM9%MpQUdO^j!xq?}7x9VDBgzfh|yUL!Yg%4DASe z#mAw^i-rC`K25XRx8K3s^r~{gU;jSYcWfZE6QA(*l>0sApWB^rQ7Ihw4hAv_)yV$ z8D&qmO})(1kU9W0LhL@DNyVW56F;bfX{n}sjfZ6*AMEA&XRQ7T)gBreYbpkU)V}D{ z)jo14(xnmk47ScKZeLkll+L4et416J4Ag^ct=|^w3FRN=8%j$H>ap!#MTz1KesxmmO4 zqd%SFfOwYOk6suy%=+ULpIcqN!#BG?Lthz(h`_+OacbMXOD!SPC8a!5hu)@{+FP(# z^T4S$_Q92!EDn)otnXu?j!ejPztPNvT8lJyB?9t?GkZ=v4#%iev2JN=Lc#>T(yj(o=k(q^C{Ngt43vSXc83mni1tF%hweJIcL36=zsj_WD zn!*F@+q>RTsJH-EFCpF;ypNHcH@Ko0*}(aZVu@of2bZwI>Fy8Vw*v4jsUu~Ip_`k6 zgH>yEx2+yOqR@wPvS8%GW2#{s+qI}8yNxe~-<~%#0yg`>mBGob{~TB2gu2=+ZCbOr zQKsJfdh0MvX5E<|efcQqxDHsOe_CtOS!?20Bal@fw_t*gjbY}+Eo2Ub3S zE0O?XWt6!b>_0rukCGMX|23HEK8_sqGL(8$w}3p@1#zL1oEIglK|Qs0!H|_s31cXU zx?uPZkMl(~e@Bs84dzHjntT5wJLvNA2bHx>@G_;D^*keODJh7A9bFh3GrPmJlf`A_ zIvAvpW8gP2S^%Q}znH?(F5|YS5osBK+Lw+3dNii+O}{pPfLc$5>FDbYA`x|a%*;MF7-TZjHE zwu5I19#?tqjXOPu@aTd|ihN2vTTdtA5aK`=Ov=Dk)?X$)hYNG5x>o^%L-WcG%{{S+ zs8kOps>RYH7-U5h=Z}RWWh;qP`90sg-Z*$(^lY)reh#V_Mt_4GE0VM_^2tU5tph#k zjTm@n&Y=1w-Egt6z1FWW$z2EOqWK=W@oHeY8HRuCDH}&g^p2wQma;9e#CHTWql~bn&tg z&)lk!*Z;jQ#~uGD|EZ6h+%%cYW1A25Ft#Uau3LxXrMpf`iyCT*Ig*f#m2OL!aLaQ~_E8T< zjaI6S-cR@NyFO!hBh+SWZ*HbPc< z_8z9ozqP9@Ka@Dwe!MPn+pOu;XOA|!O}e^jj)lDwbgeCJF0PIdcxkodP=+;mAG~zo z;;gWrq%r%Bw6=`$-h~A>T9^K?Zd{no=COHM-;BIh_2LM*oio~MU*Gk69Y!rwd3nIv zT0l?0tzXyI=g@yuvf6q*1aA7la)3h0qpPQ*W8&<5_hZq)*4mm8sKN!1G@qUvJ;1!l z|M%iud=0`6cr|rA&|Bk0Qvf|?@BXRC=&M}Sy#G8CRZG)dJluTG3CY9!$39^(xvSkQEN@*?04S3BP!o( z#rBvamtD5~ENPj9_?qC0E)8a~NtQQcZs*K_;^0qZ@zZSlsY=+kj04UjJ_<@o96Y?e zPyf=>E>_R)PfsdvEtD%(+yUTLhrq@0vseyjI_rMFulX$d$?<)*AoRIY07l)2wNfn)l&m57l+u7&RT!DgOhyB?d^=NP|#dzlZj z**4uuYupKcWu{Y}x3Zx#2ol@rt{&;v)=w&h^m?x8YEJ8{yAvsV!3!?J3okiySKiw= z=}K%0GaI{>5IA`A zHgr25Suyl{a@9!mYJ>TXg45r$Kf+VOmo~QH7yF*JIyMH|bFbC&>HC$cRuvX`>e_nY z%b28SvD-TQEG0`!Oa%J7uK=Us8ZZE^uj4QM(lPSzNFO2e0(x%563Bsy$g5c?hIkVk zQ3Xa8mI0ulSMTja4H#%kHf&j#nfujxo>c(;D>g3fE>Ls%Au!wo_YS;WT+b&d+9$o% z5wj)T^n^9$N_~3l$C+A+2M8p)7@B91r2Z_u@Ku~B5Fx82#1G=#XB!A2Bb>?WuI=Q( z6+~pD&072|N58vhI(ULhD%R;8%^dwKo4Rrh#2N`C5@~rmUYB3T4}o;~xb5mKsh!_^S+Q41fR&i! zL8qk&OWEtG+s_Myj!b;jj;0$61Wxm$E4fAj>FRML@9Q?zQ3d%N==1K5q=ZB zTkKkLxXuwu-KOTY5_odM&Tk(n4rMkDx0BI^>iU@ezZanX9OhJSRJEqL3-{SxvH2ci z%meA*-E(Qm{gPsh?Aov4;iR(W=G@LN6Oi^YfIFhMJ}SuYpyoP}nb-G_ch#0Bhdvv- zg;=$t4sEUJ@@22-FZLE=D?bD8_{69#AC8Mlj_$0X$R7Dq7r9hZR?$gPKwrs$C?o#( z_&D$F1dDdNbNJ+>%x7!or@I_*5q`EA17)xPpY&=N&+h6v*00mgrf_B(h)oQ6O}q8H z=sa9(NHwe&TUdlQHL-PH{baDeJ(TGN3d4bZBu=38O;o}D`Od<32g^60#^>DX^DOXr zdFZ;_Tm9ep=Zd9dC_^OTb}m~GP1P9#UO?4WfDR3z4`W#iTL9UFh}8O?>hsDotNjE` z$cjAn5C{tqK_&)WjUM(yIJm6gTk7vwgzlC~ye*Z@#M+E9v8c|vNE9xH#rij;u<}a@ zxXaJj{)=z0md_{&IkoL`AcjorNwoP94B1;bbA-oYz2LRjyb+f{DA4;Rg`+8QxB}h^ zmeat!B$|P3i#Uudj97EK@o!B;fdU-els@`jdfu>~q_GH!d3^v%J$JWtg~Ll(zu>{hKgb2eiV*REY|?PjobCi7OXx~|y&?RK3Zvye4ILI8 zjIa5pk}jI)3Ou~G9~OHHEScUE<8g|Xlp73Igf4!3M>h1d!y z@K;{{`61sKnAo~xv;|R2l^c75oJU>&L-q6UKwI?YD|HVftNHhhC2&z;V#;k%ri0re ze&#;UXzR)X{RMsb2sfOrImPig_r8-YUSv&m_3b6!^CkDIKB#|hTOU5}$KT&dIa}uF zXoSEIFA;vh@>7v8JhLS~T8fc^E^a)#Uv@>lFf#CN0EKiBUhTPIf2JH^dz1t=Xd2;) zcQ2b_uf1r|K}T;A@Xt1ukbpWxM{hU8OE=y1?Ure4MmGI6j&vc>Inaq@NEf<-?lZnL zkZfAY={Ll<$5o+Wzkefe@tx;6GkSr|OXVC+Q4D`K_Z)+ff8ThmkzFnlx^IJix@G@! z*p8<%+_p{o#C-O20x=Arei$ec{;XI7y5;y^R;C?K7wI6Op#FV&Za*_4x0yZvGC$vq zz_SU2gculs6BTG7E>r&YU$kZz`_rLrf4wUTln#=BQ&3O<6M<<`-?s}Jf~~3lKa;IA z-py`}kq7c!I@wN5DTVEAzvEOG!hG5M#(%x91O0U`Hwgs7k+>L{WEq_SV;;OYuVlm$ z+$n4~`sW}ryzv?-2uYGoRK+zo3UhA!+EhW;YQ<9uoJ zs8K(n`@p(Kwy6)Mzv8PlQK|4kSgxxoS38@=BOeJRJdK1@-!1$0kV@Z+QE3NqAkHTA z)kSgRkaC4W!PcQKqDGOOL6boQdcwmH4v{a2+wbA`VgD(@Iu#VT!e%z2)<#g;56)@$ z6_});%tS~8-#7oesaHHud{&PV1!~X%3XUHo5X&1zJx+JR?v!;+D^wGT{m*01SLW(r ztX&i#Mz;BH74%QO;LBpnWbgt$Cw3hIFcLgW< z(PE2hHt)*xh*~H@$7fcTt@)4excPC|rEu&d926H4$DpfEDg}!QWhC)8>8JP6x`zS+ zQKHpkoWcgEo);asK_qud51kJCB|@q2Oy5^DeHgl*NCA=Lzvz$N>n>KC?;AJJ8U0ky ziv>YC_Tgokh-J!hQtpAK@BX6%Rw81mJ7C=#BLVgimW*d3YcKTiCig8gmpZ640_n<+ zzo)N>O>Sso%@UeeV(edWuSl0rLi_m$<>f0s>HIh9DO^_Yh=Q=H>HNIIqzDfr{XWQf z7)1%Px2xFawET`0ENVV?y_?<05;Y)UrPvxELeCCl^M7*J|d&|JZ`9iiI=YXN^zjZb+ z{(h!vegn@DX@9jAF#0jEvJQR*m}5eHi>)5ti0!Ee#Lq4_Z z3rwK^rrOr}iQ`n+#LRCCC&*BxVp1Qxc^=O1LcfjX<)}yLB;%EgjP$9fH2u#5U=_~T zC2iw_<6sPv`=xL!qP{_Qb&LJMK!%-%ijo{XQ!hbHjxj3w(-JI10zJH(rn?yHf2a5W zt_0#STBpHIL3%CKfJ6+AkdsF!&5&O$-A7XcLs~4BGvqE>1qMo{rPl)^0CMT1JT8x( zG?QPHOKP+?Kdk4jd%artFBQ7}#R&O|PytI&1Rf%Jfc1?F4xF57w<$O9Z`8&ZyGY?x z*ECZ;F*-yuekog*dDd~PmJjhhAtb4&UmN(_vE!lwxbTISe)$Npm6SZ{TB8uSKNbIz z%_)|NfTyz17w{VJ>o5bFWO1ru$bwu`Apuw<)5^uU6kLZAj)pIyVTi8K2QQrX`Pwmr zaK#{m_gn?PvLdSmoX=8)k)!;PgzQ|aMHUM;WtpfpvBK0MNQsMCjHBsvw%ng>fuzn1 z=?L{3|AcSJmgsW}oFu z?R%VEu;4URb9rT<9>^JkKl;~%=)zMe(vk6-86#~C&+h}W5gqcYj{?~7Um~`e3We`|MYyQEFWj?{&WTzd z!!QOfiNAyU9SPKwd)4Pfu!J0k#}ibw>3LWtG34NT#QLzt@xf&$YU#B<>hn`ANCq}F zS4o5iWm~PfqmS$`JWC4cagl&;M^J}G^kQ9Nb6KF?U1jpFf0%VgILg^}2 zpqf#uk4H|?OhGL**sAf)gH3-)9xC(~O{!*Q0XL86Mu$uh#grO42NxoMMcKtKUN|$z zIj#w1eahYxgS;v=p(|xyZ4gnV!wsyi6;o_=hphz?*veJgX{Q!vT;yx^`L_r4=aRgg zz?Rf|UDm2LHTO=8rNeQ`RL$8k-0{>cgz2@s;`zyhDQ9XyD)xpW1ciLf5zUHelH-ct0tgBNB zDO{Dw*h1u31`V<#-4OC$ij?S;Q}||@;3-Ha4m@olcyo>cLwOiqYJ0&=I1rdv0 zt3nl86v}%3Sj!sx=HRq7MX?$-pKogY?3+d<0nTfuKa2Ajh=tkD+S#H?;B)tXD<|s< zMg~Sy8YLzzj(r;)#&6WBnpgm`641FEMvY8V3uDMFDVnT@zvO2?zvWM^_J65lmUe0Y zOd}HyZ2hxmDhaM3*9hKT(Wh$QbNCd-LX46I?eGY)`VBJ9_qe~z>zo_4dwzqvuualfQA;s{9VEwEk6%%4&IT!kJQ|7jREMRTLa8YO9-D%#*Qui#*rp z6Z$+z{%d)#ngOkG{G3L`7T)zZMBU1=YGgIZs)c=K;gmdMSNi8rW>BMbXx}q2-YFh- zHLA9dnMI6eOAH(au5Y#!)(>oZP>dgxG-WD^tLbL9i)s9%zgB|T<85}{r}J}0v7*8_&z5x>`w&qnN>{n11PFy~A@#_X%!msw4W zG+(_7=hE!;%uYGCiY~dwaMQ82EZhjc%?=g+zQ;W=pVR7x_xPuyE-l!oZX%9Vg8{^l zt(F5E_a0kt|2E+dm!-{3k?-QIuS?dB`>F3G9kqZqlW0+yIpOC$9+2^#_}xp&Pg2Uk zctN0YV;gF^%U>dd^Zrh0UMa|YN{q(Lp!%m;-*eQCrlb#X{)+X`-(2p&udKl86O)k& zj2#GXXoQCNQ_rojYvQEKTn{sw>-P#?aSgAEqobl5(GePu-RcuKb4S4|GlEw%eLHuh zS%kn9R{GhD6n6x#nSVly>nOm)PC{JO(vH51Y*fybp9B5GEA|t)YH;;eKPN80Q%tES z)djXgjVHf(a72Ob-Q|hi5Pt^dityr;!Dk9q*fy`rW6XdUa%^-Z<9RC#WTHf3uV;&9 zp&w}M9S{`mio6300tM@;4z7nZl&p8^ zjAaB<2r@HrP?)^CaG|_oFsM};_AfRu_0KmgO@XsR7<4_!@TN%h!&evhC27TZEmMXkXe@!&^}v6 zDmtY<6o)O!Du~jap;WUl%2Z{|8h&4rldp*z?#bwW9frcnVeJeTF~}6hT~PpE9OK%7 zQ7De8v;chR+OX%C@=RvrS!)M3vK*06 z{)?QM&fEozfC%Ce3aVm4I;zv?`a-v;c*Pp<`(xwb4Pc{LSryOMz2eo%mNx9|e-QYT z$Zx9uH3TPIQCf+oyY^i+Y|w8t+;aG4c9`r0hr>@5JE3gYejt}d$Hu3o${a!yf;N}j zq1&+f0RA&PfUcLRLxC|4y08feGuT*{s|EXLIgC*q1u=^JGJX4C~^wZ=U_?Rb#io(7g+~gvE6xqpsU**RoOlSo6i+L{3;kp@pyf&-x5ykBVA3?Czzb zOy`j*joXxp-K*=`w42mbn-jk$ezoaZvK?P)`yMyZ3kE*6R`YVGwiMGLb%|Yt?vc*Jf+RX*ecTLuo698*|&AKK`4l+IrNi(72Z z-!`=aNrKYUJE}Rj?i2@vRS(@Ba}v)_RoF4S(+S@YT?b>SpE|H!7Lzf19(TEah@m0I zetqp95JuOzKvzpe0%0jQIm=kdvBh^{Xsb{(4r(mVJH9S$zKf zaljmz3E_9N&j@^0)FN#(ZJfG6^#SlteeILNt8xSTxJqX-#t%)9FxzuTw$Nx%620&+5q%>x_Tf0q6q)sp-|OSq#sq88O8e$o?}Esc-Nl|iu> zf|R5hfJ1OSMn{bVEEp~6`6Fpa0K_YaNaS_#ike81VGx4%1mhs|*arhai&(d0peQ8= zL}-O(Nv6iVsR8G|3~uPS9ARrY6pB z38th3-9d;fv!an5QUITWq@^T60p+>{p^Rb)zM$MQp{&<5k<7*Ta@^pJA-94Fkc21? zVzf6l@YZ4#jC#;W#uGHc8dV$XQhb525hQuG1Wb&H4w7WiX;N2^5easTH%QPZFfH*} zj1W0SkAo3Re7aB#80!ccQ&25}hEP6>@wv4cfV_m2HZqH1B7uTJBwTfIUI6t4*2Vp2 zf`Si-trE0^_~H@uk%=~FS>J0wJV7EU3_)>f>9M~SWzkrwib_E+No27NzFfZuKdlHx zq41G-2Ptskz)OjRJsKjImwRAe{7JT~Q0j?cWWX}t^!(M;7JqrU$%hXP@X~CD2Pae3 zvcUX$POW0uH|*#Zfu*MB$aun~<(#S&HnYG-57qeBXE%BF@BqzjU^DZaU+hwO7an5f zqnP^iu)`o+Udi}ZFK@DcIHB#8v$wnKAF({Px5{@exA@4x8qNuC%yp=ymZuL_`PXMR z@tzW>!bsJ!f5dTVIcIv%;)60VV0rOohkauSiw#d!1ddOpym+gP5#hi3nF;m{-6;zK z2Oa<4E1OiTyeIJILj<9T5#}2O|Kf#p@2;ay*WbAW7N`8;5ioPdyGUFVqAFw zD1ky1>udxBc+i+)XhdVmV+i03)ifYFgC}tyCZpL{jgHQdRa4437(@fk8pK+}xk%V1WmG~U`G_-MjmKEQT7z*Gv4Zx%ps{!XuRflz zioqC*7>Ae`tuPV;ELcSdq{fn15F;2H)9qAa6v#-xl1CC1W5HUoyg*E(+V7EP^ntht z#u&so)EbINiGpYmL6V8gj}}3kA&8dp5D6M=307isM?|q!$O8naASNxNQzo*60!WCo z?y78VHc{g+R6u+3?op=05cx$+A{d)uY!dIGfgn+bPsGGpNdwLrj7ego(#C^^5Hza0 z8O7KbZA*;7h(T}=ESA_8#UoBI&S0!TtYD%Z1u@bV0a7lCBraZS4PsNU4kLms=QU`+ zSV)|~8XK=G337VU5y2Ql0u=(OQM8mE5mzc227?wRJ_{O;y-m5^SdA&6Xe3*ac+epd z%KavEiXuu_xBy0@B!f8AdyqV`ziK2|GDc9zQ7s~KrjJagVm!t=Hk&Op1e}dgWFsCY z7E{LYtT9-VVvLLFqDB#khaWu+FKeXy11@o8gwjT)S4q(_a%pWzhGbL37}Q1fPcMSk z5Lr4ym()0n-CD0w`6Gf~4M^x>2smRgHbIQR7(*5xBy9OyA>c7!O_Vdy^0|2jQNMrJ z%m`dq%s4)o@{11-a&Fx{>`}t zXJ*^{{DXt6wF9rsciBJexVVz@n?G3N@17c^RuO*p^aj&)#{*L-?L1IR4UNq6jf+jb zeWl6&@x4{fFJ%+~HaebfU2HMCne& zkH59d;jx5`PT=pI8fCTZxv-LPbv@^~TOIzvM@PB1obk1D4HV(2!vlQe&<6`j+PTun zm1Z~4^~&FUVwlN6%kRCk!QLT@v%;UezR8|p$Bng&^={zidcpHI+dO@!# zg8|n+O|~2P+qGTWwYRVz?NCMHmgv+648a#zJjN7UxpaXGSFf?w3XG0S@Uc@LVxUsN zied-^4HTW6*Is#<^OrATYok2#(T}rl&sfRYRYnCx*<8B8=@(vLxzS~O>M##Ic9N;# z!7Xuja(vccaj{9KQ;->`jZd;~cnG7>Nmo^@G0a}S#OrTd;em%Apxf;*GPH-u$>A8` zP{EZNdas^2&EiUnq9{0WE(j8K*lJEJ-0UVWV#H)m<(1>-Y^c=E}U3|J{M zc}-b!*5>S)v%K`iB}_WV$De(MgENy+IK8*X*06Sap66fuA*;Xmbxzc|l{WA~H$E(Z=B!X=eBt1-WoPG^&s&%R7!vrWhf9)98!Q+uXjB+wX2PDrj^ zxxkCxKh0{hfg73R3!nXY#)oT>MYKHs>~5~Hxv@eQ<>gl|aPrY7IkV4`6NTbBS`S&vl1mXj6l|I z^6JY!WNAHPt(|c4(T92X{yjupNkbwIr3)tK!udthDLb!`@37;@m}CEl1goG>|H z8BT>4Z*@2^b?<$6J2L`%h8&3%_6%C~48{83Ln8@$ha6Att@8B2Dibxsv8f9G^2`RA zD#ylChO36tvz_-8`5USj5(EF&b88$LOIU4se)st`{=EkVnHsb-v%sg1*ZJxj4IZ7T z&@GgjGt4&vV|B};dn*h$!$0`Q7{B}C25&5O`N~tHG`h-U&G6_WL%cHIWu$7^JM1_( zlJLFjZT{mYhgolXe)d@X1Fx<8X|P@Jw`;q$YxiV5+IKDMd#pGFMMIYx*RJsV_s%dr zeUMHoXJL7nBL@#g!D|s5j@6ANEQgqn001BWNkl>rJ+Ga9g$viNFfmf+{2Ny|djGMgSEW%|5R~PG1zODxufFy=?&4)W^wiU&wG@0e zMs+Y0S(7(jev!-9=5Rx!EHwfrP8_E`T#JhBWj$V}-R9DT^K=>=GT-6s>*tx79w#xS z)?3ubVD|bo)|Xa!_`{EI=9RP5D#PrVdOYf{8-uZmF$rgXc!q1Y=Gk}X0mjG2nHZah zk+CRBhlpi<_9lPyr+>G4zvC3^@b(w2duh41-h6hJEbM_oRH#J3KY)ms20EZ1Qcl8o)T)EEvC!WD2E~X!< z0b_9@tgWr`&98rrVqk!DaEi09U1rbp9;#_X!Vz>@I;|$pJ^w@2T1url#O;M8#)k(9 zQtIwWAcVm3@&X|beE<8;vG>4zoIG*7)RNS`p#1vE8fVYE#I2r)D~4{j%PTLxM7OD|wK6VTy28xNAVbv}g)i&WjAdnUg)5gXa_U2;c9x7?~XB z;L#&7+AF=9zrf{77rAzI0b5J42)C!kdEmrx3I$OULj*RZ=yo~(+AGX&wmJULDGa4# ziN-?`V;qgOIllRgzo1hT?A#w}V^v`{go>-uiLgy>Jy^-l@?Yq$Y1?PwcDm;8cZ?s^K?2H-!(-=my3H zELA6@RyZ-8ve^x+G(Go~ZNDwtUI*v%nTzj?e`-GYos=c)K{I*DU=)Q1=Dp) zYK3Yd{6|lweB?k4YXtWm>NdZ8YLx41Iac7|Jr(v1J1#9}Jb$Cj$Bqo}^r0G+vWCs8 za$zy!{>c<)Vy48$4%gW1gtu+yy;#Kx|IH^R7)*sPpBgRaCdzFX5r(UV|MruUTwl%D zKbrE;XHu5io`WL^M&S0Qe{)&#yRf~(j(_x-Ddsl|j!mZg%;6f>*9sopTOlZ%I#44q z!l#eb0Z6Uz%;6eOAFOi!WXek0b89{7^8F{LM##NVPYwUwr^cDz^z0vTeE2|>iWC0f zGvf?Z4EK#CyfoM4(LGiEgOl$IZR=0H?Sj8u+qGT0N0ajZF``tUXn@2x?tkDR(!o8n z8(r)`o#{P$&`_YNF})38WW3IaM;>Bf)$`%Q`$=5|W3+V4qsJY9Bgc<(^Y$VaE?wsM zk%R1+7%M3!%Ky}0YXh8k=s_yAA@&|S&Ss-S;WMl_LWuQ8n1UmR?_;&yVR&SWR;wT# zj43cCXiU}AKz(qS1IJD?3tONI#5A0rjB|e2o~p3jvTq4Tbl*V zW{1(q8EhqmhyfyD1)loQ5J!$4XMMFnT1^<4+>4cX7$GI%4_=v^ImBl^{{{5V{*1#9 zouFEAWno(p1=dLzpPpdmz^rj;Jq&dBH(hYubh54Y$vS9toV$Fau6f?190 zga~P6ki&-#@!jv8=HT%MIC$RyDyA0a1CLk56vCeAgFN-rhnSn2XJ+pVk39ZxtRp1K zM#MT#;ju?fa_HzI3=WQBQ$v#U@-IXAw`Y8EnvXp5aR#dcyp&W(2kYgY)otW0!jU5n za$w)%1lMJCv&q2dD2kA1tj`Q(J>X-{e3EbOGy9Wj6(>8GIQNfiML$Qk zMeHU^0N4B4scf66?TnVa&rH-U6ZLl=S*ci|Qbv&X4Bp+ftRM`ghP^{u@1NYe)rX#6YIT_S78--l@1P{r`bo}E##V-qR=_0NoRY~s%Q3y<&H$&R%VQ6TWvu9u8+O_Nb{>Pfj*tgmFId0y%N~_gCNVtA&wqKJOiGM74*5bhTL9nN36R<3iv{r~Nq$!}yy ze&0V4@m}tkWG1)dzSqXux~F>Mv!Mb0}JYYUx0-K>VYpZUSu+U@%t`D z1{yn`)wP$Lmx~PdW@yx_G=lLPbnp%o^;(V9*Biv+DNc(;_V)IyX3aL(tY*~FEZ+N! z*KgPP;gA0zr#lC%t!`U^BEf}1P%WQxQY>-v?p-QpCAM}7c-?g&v4;`@UO#_^r#=4Y zpZpPx>Nz`myS67Q4AR)=s}r!jCd*&tZA!HL|Sd_r=NbxC!gO(8O7f2A->=Jh)e5vDxleF zv9`L((e6HPUcZ5e6A%DA?9q}&2*vj1HXG}kq%vtbb&c`A?sOWW?Hkrk+ud}SUxKd< z|7p3*S>uUGjRqx27Dag>Ya>p*`bA#mDE_4V_;-|Z)s>Ep{! zza$pxo&|ddVK=!^H_F`)?lL(!#i#cdaS{oHG}ikg=n!IHC_luNgKqkU$fQ!% z)zKJyZLf?(qAc9F&cyfxj~+dz+4cfc32O&$i#kbv{|G<)opFW-9L^pr5s!EOFnul7 zK?}ymC%Ba#qEtTRtaO1JwT`Gr8R)wpmWXrx<_+@0liYi-jB%Wxi$&1A^iTo@`g07A z3=@k=KL7kH;!!&nMq6Wkjirdr&0l41_6nPaTU=}&<2YZ}L3hV`kG%13L3!2#hiIy=ey+*QyHhqbbGY6LLC z(qN5des+d>z0Jw-0VAU$3=a0$fnl+$xgqi6( zOipS>MhDTty2Dy~98gB0wILplb7SEKxuJ2=F@=i8QQAhwfWk=V;E>5r@ZtBEK z5hP;pH%GF3yYSg&o!zoWy>0j}kI(t{e>_M;Sq<9n&Lr4B_gE{n`DirG(r%Nxqj7$= zS|{!Zt_?-`i?=mC9EtG{ra~9R5Fx(l2y^~Igb49#g}nbwu!lqcdOswq;x{ZOEQ?x+S0@X;wCNd{SJ<+(497Wdncp@@??_{v~Nv^l*Bql zDi4X`xOj@M1^NC#jBkS25QA_8#uyw4zVC6gUnbGhOK&EDZ#-lW+tIB}g@9VQPN~*l zV0h5d;j~6d8+dOGL4D93$A_nQPJ-dVtfkue*w_o%L3a#_D8g-XUOuN>Gvr5yhzNu6 zO`zoisdb?Jb7)-DX=zC!6-W7=y{EC1Yyn6|f$=GoDF7UJ_olYT)hd^U+ZN!TaNMVb{^KuOtjggGm{JLMI`1>a1{QY(Oo1dPb zwc$HsasKzaI)8XA#h*W|FqUyJ!tf{8)BM>=g-Ap&lyW$#d7RZfGBJm0+ve;2yFVOY zH1q8<&j}IYn~uMp^QV6Dlb`(L?`}B1UHses@aKQmLkJP#?us^jo}GdC20UXOwFVh6e|TI@WnkbUQ*q(yUkb^k<*&X1#z?4g>vtm#&Cl z^*%xf_SQD|^0O~FJSo#ZJV-pyfC+3kxRQ!W>4?uiyT_aLeWLLcL%EFYMH)LgCBgVU z&z?SGY55`LYJ*poD_~J|6t!`q3OaEZM)vgHz=w2D3nrI~Qz9g*2?Mzh&{O6%J2JWOF^lV=<%#X$(S1E4=VMmhRtU`SA-{zC(Vf zANLoeD0ZXYZj@NOzsS=!1spd*zCTMh#KB&s5mK|gzQ(<;7TMlECYQ~TNhWO6hP3=W zi9ma8mKPuL_}MF(trjDF0|*SB5|}_6D5cBZR)PCpEmGJ$Cf%E(ClyBu8$@8hMs}DE zD~pRfUw+2%d6nVGQCumzd{jUnq@Y?VvADF%+jnpAgiC&~4~gHMR0J9!6|Y~tWbx5c z4iC=g>B*8##{>GMw%K=5(rDE9?DNlg^KKoltr#92K)E(*L*OEerTgv_HhFk|g~H}G znZbUN$&`)O&^lNdfbaA8$qLKQo>Dw5F*-6v#8uW<=xf=8<&z>`-haTmjRKyp$mjb4 zqZhtLs|BH2EHAI{?AcrD7Y&Ao`mL7G2ph40k5rQ5qkVq*$tOH}u}Z{Ak{`_BYtK@y zg|TM`rp^5?@3Xk{nB9X@#zx18MqJAgmDrBEl$;lj_>2GfbKbr!;A_a|2LcZuYiJ>n z2w~XTc)?%({0j>EMY7o}J*gPlSjw=aQ~TgI`QnQ&c<}HUr{xyYW1~o6yYgCrGy7k7BH*W~x7;|yh7K3%_{-ZmUv_@twP zR>vTP|Ht2Qo~kVNl}IY0{P!R@YRkR#{uypf{Z&o=RMjx8CpZt)}eo=#bOuIk~l|q+YGC z`tBX+bPwrt+6HA`)mJHaRI)NcZH3N7Vaz*${L#CBEmgxxPxL-6oUGTFZ~X zO;ajqJ19bNc6P?@?hd(JmSigaetHdohD!lHJB4?go>j^A_S(EWx*AD8F!*rs{Wh!X zZ%`^mt~Y0kGy;dq?)5Gc1|<~b(kWkkxkS6^Q>|7wIXMBLEHT&Ef=&yM*RNK1 z^ZX@FB+AzIF71|QS+oR&hY++HRaPD@b9!9Cr_T2FMzC%IqXB7);nU+o?tS$YzN0ul zJL9Z$YR50IdNU*NnjM}ze8_fT6Gu60Z12(5fyb(41tW#v?Bs-p_m}W|%~|=J((yUU zfUnyaDbYq^@K{@Y!K>HLNk*gWZtYTSwz{7bM3A`GZq|9Qvdl@TL{vp6Y;FZSUt7Cc zEuVvt9p1cn!JAiaP_D!7?hYN#SX#493`8l1i+Y9S2g}s!4LYq3TZP>q3Iv34K?*#- zPGRF6&!4=ZCzIyrXrD^$;=R@@&_K2uHCC1uDIOn_aAO?o>|L%!jI_E+At{~|SzKDg zXrD%{O6jzSK!UahDONYy;qBYkynOqXL`euI3}|im(M*y*zLw$-W)sZyx%}%N zS+~URj>Y+dxgf;|>O%ih?|LkU(-<=NWo*_bfTM%~sLWBtM z8+QJJ-kkB2K#e1$IaGh z7&;&%u~>vsvB+7~BR@JsDjr1`A0OXlvEh@7#JFhI*)JV4&^JPVE{(thf$AC&T=;E7=gto0!=a=r&hb*;P9ACHpkFFAI9^8 zU^^S`EzrbVm;L=?s-9qMY=mSqYUfM(0gYCm9E~v^2ZvQ+i8T3q4{nzl7tF5_hL{tf zUaPQka!4*a%y7T$Hd?pOpnE0^$wY*cVv$Cu3qK?b%)&U~w zGBiFy#Bq??AdEpuL8s9KI+W`zMkc1YdS#A8%(Wd*VJ^q!cUl+^YFcvR_8rED1}tSU z=$Hy2@pT8!G&w)7km~K_*6k1IO{cqRMbK6Y*J@oLjo_@>U~+nf*_kO4F&9tU!vlrF z_c|Eeq0{y-u{1Ys+_LK@Fug$wgc39x7dQxNl?MG|7BH?fD1|Rh>Xi;>Y$ z``Hw}Jy00HESr1iR7ABxhSRLu8BxIG+W zIvZgm*Vo_i;`uTw zPabkst`dZZVaZC@Gq`z8^XAkf=(yw)~0c=F^aON$RUE*6mp{NTR>Q53am zjYrGNEIoY0i&t;(eBDi-z!)8{I$cgqPI&%oh2`ZHwzv0zU?XWoXCQoh-{aluHJ&|w z$^Cnes9&^f=LC%u9ZO9VigKyM@S#dHUi7D=SOv z?VSYlKo9MkOG=^9hSx7%@o0IO(*WDRZY6))!s z;elwgzrW4O;}!0I^^nbtUHklu11Jn0Li%X0#p~xUd9wV7m4_=-YBd0)5*Q`%fOKC! zQhB^ueaXAkO^OGnmNF^{Okq5vkmQG^ININ1^W|GM3Y(NWjet*SH|Pe4MpNX{J!}@% zIM~~zP}sxMSUPQ2zor$rzG0fJ23xCZ6gD?FK0N}k9Xot{0d68ef8PL`8|xJI_So6n z#4@N929%7@H`qs|e9HFL9&7K8D4$l}Zv>1j0Ni+t zcrwGA*PE=a7C1UOwViL#)l*8OG4$mIaaD)H_BtEe#}rGI%QGVzd!Z3ZF)}<%>2ROI z);_OaZ{s&QNG0hg@Qoc`ESV&oO0)jzEqj}r>>eHB88E^}3m>IDgfe9NhS04J+dEtA z?woK^3_E`zLWBtM>mWSp2@xX1ZwL`|hP25k)|jHX^H5sgH+as4`4#7HKSc05uBzel5lPq|oRc6x?H&nN=}11Kf% zwMHR8NQBXJ+Er>7Ef%id;JD?G>Fo*TLk6@->mGV`Rwk3oaQ*rXyktL-h+}D=#@hJ{ zAwUh;!Om$R#};}gQruGYcx`QU?_l$(-FCW{X!X)fIwh0&ZGoRH1- zbLUQ)c<&%mMuL*AYu0b)IE(BYZo*#-UO?Ba`jr=662CO{7RfWB5TSuMyUiqtj+|bb{HrtHfhD2K#b0`_b6$ zpbF@#=q5K7u5#h8GcYt5IJ^o=OT@lUtu={ciutSaRH|)8M)FqIY3wnC>8?rNFf}p5 z_HK#3OopMp0ZSnipoKtd18t93EXuWO*C~{mOpNDoB9@YC&$@opxct!nR#lhH3kOyiAH0=A%vwC3&8j-(y268uU?~6>o7JpV9iuCpp|_J!eD%u zo4rc8;gip2>C2|9S&$$w0x}riBbiR~;dgGce^RF>m$A<#=r-DQX7IfR`JoZU$3{qG z67*$zFXux9rLOQL+H;tlze!`gz}Vy9=FIIEQTjw2)s-QF(Rl3^$QV;oGk6Dw2=Bt)FX;LSA;Acm%@)1= zeTZn1{c;`M@emOQX#~(MR5U_LCZ;CADEv+fVGPFCK~|e}B5byNWHib2bb_tjGISa! zV=fC=8wnw(T{IXR8X=l)Q>nKxzK5VojkB|7d_k*i=pP)TrK3o3LC`KmTyCZn?WRvO zmS%P~gBCk<+Vx*}_Cg4Z7Bt&FgQFuvQccdz&M=)0V2wB&15zrUEicjZI`pOUEZn?H zHk(4@;Ru7##%kRB22UT~r_nIX-nhce8`p@Vc;9-p&)~Fl%Idp!C@0444{k9zHv9|k zuj{(`cxj3Hd5d@?$;Tgmk4!2B+ID9J5~&2`lT+4SKgV@r%#Y`potq5i!9n{Sgz|8d z%bQm(D4iVAH#W%Bjl1M}Q)pwgmRdMSY&Y@Ai%gZ&ie{jfl zp+M`R&7JEvn4O;NR)@j*mnfxZH=EqQ_Xz30{QL~pu3kk6g*I)wdJHJ#a=2CC?aOyK z+To)+SDBc|+jt3MpOI1#+MNc^AHAS@R%K#*lJ9+IfmqZ9ZEP#ly7*8$IbnBa3l&w| z`EY^BDH~=lO*h8GAf)2O%cqn|Wpaa~T)BRobWa>@Y~d%c8Ju3b!{QeYsds!P$H%z4 zFo#i=(du+rq!Nw~ci7onCz^`#gS#IwK0IvQca1HWJt>jE%U7?c)i22QXZi5MTVzr( zg5Zw-r|+*2Awq=swjnJ3LWBtMOEAI&!Q#IfgcKO<(sk$T8yIGAXcVmtr^O=4h+{YR zT}_PvAsuF~UPlPY?ED4i=jWhxU`ld15Ym|}*B5$`j$(4UNF)*sa@v#~qcON{l==DV z2q~DGt5GhW<9i-TS!$dy5-Ak@LnGt{h7nRQK5;<84T=gKSkP!dxs1(RMM}wRyTw_l zjL-%t1V-D9uQ7sHGRMO0EJ`WHPm1uh_eN0oVGP5=ql}J@qqSjgf6vg6k^#`+{z%y|2Ua;}t43AFr+G$^3xcoP#kQLb$dWBqilqm6azO zL?bC2Q~n{+1@+i@VHDY7GrLD5-@>drm$Vi4m^MUl2WBfx$HD<`#RUGZLu*hK7c?IzM^&jO9tR^`!?C&c3^VzC$>fA}G8G+1l)N#QsV-n}cZx4TcH-XNV$GB-DQ zdG29j6&$1k#q(3P3R^^?2_msxKKS4k5$OcfVY?=k8)Ln&P5HD;v3yQElVN&d7#q#t zA&^9*OZBYG%A=>Kc$`Qq!N(teh!c$f(q^gvN=eq%H`y%g(ARfLvM0yv%tX*-)L3G+ zLTgxl@&eBYYAr?PhdtynafB8~8}^5E94hrHFW>Awq-*5h6s05Fx%<82qpQF*JM$5h6s05FtW@2oWMgh;IYJ q;x9yq5FtW@2oWMgh!7#Z1^7QBaS>&Ou0O*70000S)dY literal 182802 zcmb@tWmp_bw>AtBf)m^=XmElC4IZ2c7CeNY!QBbL-CYI-&EUa3xa;6BXmEFjx7qu7 z&UL=)`+I&c^wd;WSFO62)LM6ks3^%`ppu{>ARu7Kew6%#fbhH#0ReFp83|~4>p#B? z{6n$*sO5lwfZ6%ONeVQ+a+Fn+dbRw5>=hl>#|2v6f10E|JBm3un%USR{3;#% z2sEKP0!@;}4o3FowvOgD)(E&L)HFal>QlRfjjfx#xv7~WLNV5$0MLs0PpiGL;Zs*C zM{_G<1fEMQ6yO(>r(aZUOdMSd?Tr!iY#*Pxqy00uxr33VA<)$xq4rNz6wr+P)U0V} zZ*6XEitvYYBM4}F_3!;o_D04C=Z}87|LrDWV`XJ*?TBzOnAi%mAw6|dGk3H!MkqWO zXFx!pLXeddQ*%wX4Q=K%lC|un$^OZ zsksKUk5=cK1cg(+X?f^Ufp2IGZQ2)UzcE}ca(VkK(7wi@`atD3a(Y~c73VM_yy-F0 z+6Hn1V3AB5t|Evil z5wGS_>#z6kLM?)Ed-gSgVxgt}dLY7&|6LanznvE_>7qOgI(2yH)HOb& zCZ?SEUwOQS4FC69QZG7Dx=g>B|1*65H6$=PFX-Pch3A;D_8l0LaAax=ykGyFK-y4x z2!u8|GgBYViVczepFym69O(Obra27TU+fWcK^u9*Cm6>gwEkWEoJD8wS|$BRx>mCl zHY6~nzw~K;fX4(2$h7|-Upuu0V_Pn@WCTvaF{v$(Q5ye!5&#FX|Euf&1*_*$zYYkH zLAxJ~|J`R~YRL?m|Jm~op!o5$eDle1Bt=+%l?1TK4V-BI*+|CFpHS#l!*Fa@Sl{q4 zJv)081o8&GgR!#ASj%6W8UWDCmoJ4L?@revFMDaCme1Yo>UH_aFx9FpOXR1W7OeTa zTfv2ejH^!M09dy|1;qXi!uL!^`3NV(ZQD69pkzvYgA2OV}H(%X* z10yIERO-%5a$_V71WfOC?K`j8^2-%9icdJ>I0yW*Lxt3G&<3_7wALjoe?MzRJSIXD z#s7df7z)J?g!lG-d_zNX>?*{cF>DXdQCDZhnDTC=1P0XCg#&<#`w!qGF;qTHItgUV z)L{I8ZPVhR8WKs@_m`TdzIcXsa(X((U82ip`Xf1+2m*l|U3=E)mf9O?!nhsvdVq!4 z*Z2E>{dEvJr}RHd{1dX~B=7Aakdd4pVyu;iSm$p@1Pqm~#Gqoww*iRd>({USYF5kw zrm|bWWAhU9P#XU~v%wKkzN@GGo4BC#jYxXi75;_ev*FD7wdd9S!?;}|egHgHM|MkH zUA?`u5chv+pZ_qfpG`<;yLF$B9-C(UEut-{3?R-Sf+Aog1%)3SwLE0VE{~~RI z$`qH^NlymG&8=9(v6r||uQUSX#2g#KgD?QJkEd^!D|wEVubt&XoHq zrt!w4rRi+1$^F;fCH}S|l>#Xdn~l(Kq1si@(a~{wUfH^z??^d1a;N4SrqU-G8_x4W zp^1y7%@^93lp=#aU!q;z?3VTQ_Y15Y)BV@Rg=LVrGB+3mr%FycSvMU^m$uwkKyq?W zUOdCY$IrNEhBBfaA0OYX61IN%^8?ZIY9)x}bNTYw=C4)ff3=&M?Hx)Lq^3}_jKXEn zjlt{oBCoJ8`0nmbPI$P+>Sr5O+m~o03=-QVugjSD_|DtIR%J#!=n*H5^X_l1`ypoH zanS7jfAFzNCM79(bku>`BH=oDj!O}@UFLAn+!Fx0<-#%Fwdfay0K)Rl2z8n5xU@2`mK zI1KCF|LbbSgHb!Xx;X9sethQpAwVz5YM^}zen!C&Eln}gWKI(lwT?@k^kFyB>!YO# z_~laBpK|i_co$Ce=Vj9aBi`DBg`}2cW#i@gwOxy z8R>D^5<#)i(H}U7ikJ1%q7BC&MmDKeKL@WZ2#WYDH+y3`EVUbdY8m+W(PYzQ%+nhZ z;VVn3tEqJwC+SH8nm1sXRL;znO8=I8%SVc@Df0Jx4oOwM&k{wQ(p;Oslmic|5gNREQX6v%wW3#My@n(7yh>i?&wj&yyt%+qk`UjDgp<6?qE7fJIZ5=+Z zaqU91I3sz3MK(C8X)v_xdoLR*dO5A|r1?pi$7?-tX=wvlVt!2b$zwS(M)SODJyB(6 zM)}HMeF2Jz8mo)LC1rd2lX~v@Pn&Xzigdg+?jo1!e6{n6mj`g=_eQ_1X15kUeoCD* zg7+tU!=I~zD*=Xh{o>1CvM*gbR1eig7i_IQMvuuW%y4*vr;N320 zKHt7H1{&8yx!qv2==@IhE%EB%+ws;JXgI6wsP zD%hRzGNd~v>8|~?`~UatP1YZx+Bce3d%gQ zS=tba{N->;*;8o_bKe-w9QG-=OVT=RF_ya6mvJSskb#R#s`GpxQ9|Id3J8zzLFEq^LIy|cHgOTJCW)EKj4$)kW@N%vT zcx|cEb=M`^NB)(;P`b>)uoNv{@kkt)O=#2MmBh>BY@>vo8ZYXt%)qAWww|iq`@l?c z?a>Cs@2S;$?GkY!ZB1J=n^q5w5|r9!_xOm+P3v8kqK2zwrGhJNag-k~AZl3XRQNb^|>fVw2>)`NyMu#6m2jZUpKYx83S z-y#(c5B_|Od{G_{)5?46*V!6wUn>bsw?3S+Yn1Bt-Cr(^Jlx;PM~PZYFm{I%cL2e> zjJ>^m3U7i?%ikHg+So6iP>1gB?sqN+x($xo;z?|JpBtT7`}+C{gp@2TEw>$twyqd# zL}%-(t`(+hn5ryiaR6s*tcAZ=mi77_D)J8If)d}9EO^>#pmY23s}_M2BI){H^OUfZ zd|6#xGFjOkQ4YX^5Gt-@s}JhAh5JrNCzEUT)hh`$*_isg^CD zqfz;fuiuQ4uc#5}w7zFe<$K00;J7bU%a#!W&H6H5u0`s8u_Kjcg29P~%Di>5oV#xf z--0(XkZbd@!gs^T;4whc>j7vW1hXx|(g z)m38K9ZTyzZ>qzI-GUVmTIulRN%YiQDW}%5h*Z!4Uzw-#|BAG(R*T-HZyr#zQD(XY zWq4c$ftL=3njS9%$@*CMy~F8Qw`Yq8Gqm}HSCCO7(rW47vY~QQ!rd<*@&z?{@HrY1 z2Cn53imeZFo8D*JW0*@QUW+=;TjFJz!e&z(4UTD0snHrMopd(Bp?RkqnWUO^daftW zwevI5OZuoNEf9CT&v1Pc>~QF}cGW67aW>%mheFg^Y)#>T#Z$j z1p)Ru1xw38mFTSfe5)XWZ>D?Hg5SXQQfl)xW88{NjY+6I#0@<=OzTrcP}^20DvAkp z<))W>(c-;19u9)QB~*j^~RDe z2-fxY>I7`*9n6Q`eL;sxCKv7axx=^Nkri~?3Y(ceO>Nyy%x;(awaM=f1?eM6WkLFE z&c}@EK9wz=cX~{so?Kzm25J4{le;O$8*!ZiR8Tke#4`Aw8SgGVB{GcUcQ)kmA|Cl? zl!ND3O?{UJO+R3Hr#-TVmG;M;i>~{M1P|r$f{it-mlF<^d>k&{DO$ZQh~29#RaVyP z?@~QJR~nL2HuEKwq8A#TMKybYa!1~PZLk(NJr+mD=eB^9$cqOfP}M8?wtTK21THdhWkn_M=!96J<9OBl>!IwxV%*rePvkqm!BX zn)mTbQS}Euhxm5RWzy}ytU5IuZYSR?=S}+K-vY-#99&#t9t%7-H@Cq|;k58@^p@+5 zH2Wxclbgf#NPT_%-b{rb&-bbH3(qCbQw(BaV#~#*`ZHa+sFA)tYEI4=b67qQp0~Al z-S!LBs26GESuxpt74#i{#3be23*QtP+m5U>86vs!7CqebrXzzZIz z7S`e96+ILfBJX4`q4^ig(dS`7p&`n6LT;{Dg{($A*e;UySNrl9pL4c5%aOGNBUKmwYls zY<~?g0eqiJnfA%_=*GifMb=DyWPk)g2}utgG3j6u{d^0mO&?GAQUQmgwx@R22uXi2 zZc+1rYy^M$wDwg8T%WD=e5C0v$>4NkzBJEtBom$3=~X1f+bb{3a24#Wm?kbOfqNRh zcXi5qz=5MJ3;d8M(t6EYCgT14c6x};$tSw4BM4zM%gcsM{#Zq{o*lmPoS(?f%Vxvp z3=uRW&2{{cR{wZ2u)UDS40ku^V<2@&@>n!^03FmD;-$g8J~tSWs_J{j6JSIpDH+XU zt)501e7(tCf@Mp{%sI89HXoKK+??7V61g9`E?(af(J#8tz&$Q#m=6{m4}$GyZ+)R}C0R(z^N1{WKJnR_G(~uH zT~Rk-TkK=avB~~>8*7qeF!E=Em%a5^tA2B;Kn6!p!&`CKT>tW5TDbQylXO7T`yN-o zdG8~*=+NYbiYE-u! zKEG{;bKzV{Upw}e5xAG(=R-`#y;0vrFnFNztqtr~NZJQ6Z0+2%2T%_Y*Pa}b{_XdZ zP$k$0Kn)-SCpBA2o4jM5@2;gNT#r!Z7VbQ{AJ3I;4BiL(v|jko9^A%y95#XvHLMGi zmk@Oe#~Lv&Q#L1(MZ5&y4Nf$4bOD@3-MU$c=^08H0x{|73bocNZiYAKyE6Lvi{?eq zgyR#xRApslSN`}uS4ercUQEAW0dF{eX*qjsCom#p8VQB|rC1!;ITtiv%;)L|!ZPYz zrbZ{_O~-s2G4tCQKgaP(tCAiQvyTUI*S_&N2KEitY*_ZPl4-97n@s|QyE0YRZ zM~rVDo&_o|dd%HFRESV6sGn-gR$mBCQTieJc|1Qp+n);0b4ZGAT^F4C#(yPSR`Yr( zMPF9L#IuqJ;Uy_7_Y5lvwhuW{A;EgMCdVWnpc6hvYe}yLZwTKa+U^RwRM=g>gt)9k zw60&~7I^hY_&l)lH~EJ?n>ciR&gU4lT5IIf6UyrGmZg8ar)+6+Y;(hY--fc&YU8MN zcA(yV`2)gDWL>1!X{(_`eww$}+>h3mUa8$24i_w_;wvJ(83HbCML{zS-WZL)nIpZn zzqdeak_PH7f4xO-J|&*YXI-1}UeS8==DpB|M3t_?u?TUN3OTXcBouUhN3MvrJ{u~q zKfHJOy_NCG^&n&R+uw~iyDwNe&imctPAo7ML6xN%PS&_sR!neEF}}gcMe#Y2baeVp zPnG!bY+2u*iC93Sr^D`@wgA>P7E2G&~M-m5KvbUE_tGXn<3wN-l z9X9LMO*ZGptG8g*C7G{r`F{`e+sCbl7v3EqAvm@sJx3GyJImMlhM6zwP}DnWLKsPS zK8ShhrSFjw=1bIaD_pt;(pE|s_;S%TO;}1lm6mt8=RGCpuVwqleD0T5VYU_=ZsW|B zBW!P?!BQNKfz@?DNFA(A@3QaceY*L!>HeX>QN`=dVgiBUc8Dm`^$uJAMhI;103kg0 z5s5VIu3AlMeGqmdgi@OlV+uO$sNI}anZx9YvMMSn&{-btoT!Vnt3#Wbgn;N^00>Tq z_^ipo2-!`>AX4F^e36@(9+9Nhb-uNW?m+6!Ape>6_;9Qh-J@_ttTwT!fRekr!2Qkn z8UW`iYxqsoZBlq6xv;xq{XO*e&?Yk%*Xfx7)eHfme4Y_lOn0#YC2cyd!gdVDTel`$ zYKisBd0MqZMHK870j}J1iDpgB*kk zE)nVvBbD%U`u;5RC4RFF8I$MnBy~3%KhokUn0ID)wky1gw5~$gXAUzwJHmxkT@ik6W*3O5WrUc^fOYxL&fI+zJnjKHMi~ zn&TQ-8QJZC-kpf9CS4kIi-JAFmV{1d%kDSbGE+HH#N$wjXFc53`<9LmbRK(1fxu{D zM8sI^s}If@(u=#0ri(sD-7cfJu?!Zi=1BL77)P_>(=I}J=DMtv$k`fmaCsl&srF84 zmoI$wg|hoX2p*k~KBO}><R=Wq*V@T-6sQi4~2}i!L2Wre#9<2k4Y6>hoZ3YAbS_{(ZVM4+xPJk~y;5*TN}9TO8+opTDYm ze7GH`URT=$q6UkE>U!w<#ztm7X{F+5xf$#nmF+u0U%T7sY+6h}{(BYmfMO%!J$SR< znVw?3#d5+Kcj%SjkkW*zS{RVHWkC(IitryYv;9RplPwk0fu z3qGZ^8YX;uce}=3cY6&IvNP4Zu+(k85e`7`zX`TqWcb3m-g zTgKF%pYC)_vgMlNe^>U@&rM4>6=r?-aw*2GjJqQ!Y?)K;2rl%;BsOz&v%x*Zmc)s8;;Qem8>@wzsmp&eqO0qK5H%Je6e(!j&jkM@K@s$4Xaq>exY>yxixTzmu18Pd&X!!iHqzX`m!0tsl2FWk`}DmU7tvFa%IQbG zCMcH>k*@<)7k=xl}ryLd$U==rs~3A<_2z)hs*7S*|N2lq?JW#tG%b2 zBkWvuqagrt-1>VIGX$#7HcR!QeCjiSV$?>9>iylaA6BAPtl7@QFBbi#np2dBCoJ0gj!1a zGXo0k#0v`95;=CmG3Tm#3$=<-v?q~?}hLNckcLa9f;9{8nbrz;c&@xzk-Nf`1bYr!iwmyU7z07 z01e;iL*v|L;r{n%uj_&*_&h2r#s!xv5=?%XlM#21ulV~#{oEczJRLUZut%dVOI@5;Wup*+PT<}D(8G2<55KBnIl zAyo9#cXWZ(-#HBm$Tv!t7RAytm7Se=-NZ7O-3?@mF{HPrset@}Bs`(j1N+dkCUR-P ziD5)3wKr?VlcH(Y`JnNV@6Pz{RXEWlnX-tdpeX5FtdH^yAECt!>OiThY)UGVuyBTS z1WAIHY3-9;64O*G!64<0j)?)8uvnqM0!>(TVk&(E8!VotG5vp{4Ji# zt=#^u{}p-CfE3_oUty9l!s&tRsN>6djS6Q2UVg)i_Vv8^N@rHn^_thH<&I-0>XKbz zRg}8JwlXhj8GddR{$4`AxdTZ`2i7Wj??esG{Qa_WqsWqcim~LygFlj~Fxu=YBra)E_q~BnPb&Tr_UCsgf|MSWXUPsGUNYaBhM_OH-o6mOO^it-_ocvZ z+q*782;SvRmog{Ss<|R5QMKFz{-UvMe{wfnBgA$A};rB6b51U;2r(wf_z3kGM8#zu$hhCMj zUX8HXCSzugOUum+!tNEPSx=5_vBhhVwD;!oS|>xgiTPGvR|suJ1^QopzIp=*W~rQt zk^2@;*vcSe!q03)T&cOg20mmn+-{mSBTgEjv?i6%KP8=M_|9N3lG?FhmF9L|=Cblk z!4cxsv&8iTE4}ljV=P;k)n&zfmT#>gI?aKn?*#t9)-;q;7R2c(>cZ4|wLNleKbwg* z6}V7bjOJ_!x&<;o;Sr>KiQvNi8WlA@#T}XG6gLFbNoCbS6&0(voZC~g*Mw0(DF$Ow zO}$!|&-I#?5h}(OwczxelEE#x)xPI=D4XTM`PNp%jG}LEy+`J6AgTt(PGFi=rKK1FtyQ#w!i-}(WvsKVU5@}YvUszBxzS<27d%Qe*HM#js@2eDGEey_FJ&nFCldH2fN%+`)Rz{FO9Cx#C%5JARW$&GCK-N?uo>_k{kk5w^)4<+@v;f7* zG&veuuTlzqMFS3~Z2bm%IKfrJH_074{LPC_A@n1VQ-s5>Sij~+0;$|XPuvLFW#r#^ z^N#HWC<+t3kD}fn1V62PWZPDNPj}3Znnorz{k0U;E&j&f1L}`}$6G;o4J%~Cm=(oj z-}vDt-Px9?zhWci^P|-z>rK7L_+MZppA+lx<{-vvrM*+ahd;|0OTY+Sp?O_pA$ouE z^#pt8sxr$oDgHXzU*y@tmaQERMdKsiMgWlkWPyg|!9*m;0r8fjm0}_7QaX}04}?zi zlI7MKv&fkYQBB{~k!39Vo`LL`@iKy3YGrt}V*1*n&Z_f+H2QW>rI~1uJ@xID=Go3% z!gud?KioxLy^MPtS}5DJMHod*JUs>RRa$I!!)kN@Cs(-NF5%6ccvl{%LzxlG{GDd) z;a!O7;-mk9-n{GPfRU-N?}S!u8&oer&+gdk{(SmuYwWoqEYihX1J4nEszg@|G|ZWP zvmKoaE_5J^X#K>3yT~{_3CdH7*>!4NnUm&!+IYISw6jXJ)hJ} z;rXtSa-Rp(m>DICk~)KnUcKAuUK*#5?k{xN&~%A=Dtv-af?RAcM}(hQ>Uyl0@DQx( zK9yOktmYH_{a>J>$2ntY{I}* zmQq372dWSH`V_OXvzG9N1Ry(D@wF>dPV?t~OYMM~5NK&>4Q2=?)jMqBU}KAY`$j7Q z#sYk&m>42JfFT2HCO`?P6sh?y*~$O)BpV;!Wv-L!NR&T(ZV<$y>I`-v%_XgRl6a@v zz`#Jq@8Wm!0F^*ju>>1(5m&C0Mn0npXGKV&ME|2+)}Zr7ay^BhZwS|nh|QB49nZ;_KCLHFY3J{@M1${D_r00Y0Zt zBE}A8o#X_C%@9a43WY7zD>y$L&U8O6Vu=(T&?B5Yegxf4W>wJ+r@rws4&c|M%h1ks z2zy$fBs^Ec<@rD8dfH1U5L*1RtN)vL^nY;;YD^)RadxWx7c&za?oNCk06>R8K2RaB zVX^5^zeW$J4bd(+N(4WN3YZ##(4mhuu-r{qrbhALIT;X@C{~`n(W2WvJGu=nhLm(d zW_yhl%RoE#&^x{k4(Ofp$$Q{iqDA$;8~4NtgE+s%Y|ysEi8JsChtL_kV{oFZ(^Gd2 zjm-ks0_R_iiuURf5>jG(q0mBT=$lE4fAH+^29N>BBmM=vjyAvPnm-^+bhCEE6EOy) zB9(IVH`LmR10Are2*XTAa{$jo(9J_#uwF3~62Axyb)>`FFkU=UcUi6k*nPJ3x~BM4c_ge)YX&6(u$0_?jgFHr z5qmsx9~o{VvhjezMGdj=WAm5D0r*XRVxgg-N-dQZ%FYnnXJ0`eka@5AB$sI0oNffc zlXUA;zWro+8U#6dqFRt(tZ02ruiC9^c-zwfLEy2aBHXdOM2k1_R~Fu zvQHG9LUK=$DQ}So1HRzZ{aWy9jo?Gu+;haEMrhNj_9r+-fVjH*LO*JNcyhj*hGA`u zdQMTO)jU8519UUdSg-1I%8{@RVE1pDplFd|2E6_0ADWHm8Er%TQl~TbeBy)P*zQU*n6W|#{ zPVXi_?JHCmB{_%yj>-TJws>${a=vUB0V@$u_G}>+O}(5O%|3 z5Bk>g7p={=?=|+=pA~4pONw}_D@gS4E$5}Doq)0kP}$EdFF%50w$j_z>poc`i6G3r zf0nY<5D8%{)^FB!Z_$1BL=Uq7ul~7RmoLK}Bn#mZz`4*oe039o%ka*6fgfRYbv2o5 z6Iri8H{D@+%ED2dDJ7txq1{^%Vy>N%Qoo)G=&RO=%ken%6OILckzA>_xLU&=sW6tnmAes!*dYj!zVKn`tm=G2%_m9Y+u(!*XKP5_Pvd~_+U9TtA zUoLudh!KA2OmGBBkUsa{EuDCFiX+Gc6M=FhRgT~jw-2QG4`p#!UZTckNgp1;FUn>5 z&bS{B35xq%CtiD_7biMk9g8r|3dqJ`alQM zL+pom5S~&u8sXC!{Kr1D3=FV(2UDP!4{dx8bd}6AZ+H&y0`q@jqk`~|sc>1saQl)0 z25TV`jWphfbo#*FY~}X{qM0ggeV=e`^u*R^d-FP;q=C#N;62nu4{Fi$iWe86`peeb{m_>f_%7(FK`#B#{#|KgJW$ zc=^mH=TrBZgy-3p$A?s6X9gut@*jc}u32)CE|cn-hFS!P#u=yDjaZ_096ktm^K69v zMG+8NdoaHgC=?9-wBa`qGE)CDNY5P)U-2bOXsH^E&#hQ;mc;0!dPVX%@$DhAUEisj zp6BgYtLtfzpjP4hPh9-wovOai$~y(}3&6 z4~hMvdTQ~BXBaJIUyL-^e7_W0C;^1tyU}cgOizDo8l{;QA5ow}=SXVTFQWloJs3D_ zZAI~Ms$G8p`1{YisnD#cAIfJn7}il}Ttu|rJ~M_!Km=?BxlzMHM>E*cG4WwlqmHja ziQlxABdfctj^m>~N3`(F&<2e;Va#)jfy%AW2B1H`moa{B6F+%I;N6;}T7r>Z$i(zT zn-^f+&97kPGkB+bNk#l!8FqB@Mupk!y}IJ_f%e~GFm=lTX^@&)7yUOiywtFcT=T>l zZclVvw3mA76_%t@>Y#Ffv?VpElE4+s5|GPKLjeL#g5SVy zPd0O26bKJrs)G4Gb(YsG6-jMum!(rGe~0blqGbI(rKo~-i4qPJ-yiOvC#0ugX0yfEfQ@@ZX>c^`48~SS<@RTm z8Dzzbazjty{wc82jBy;h+W}&+#gu;qmASm(-w^ zK~_)kjt_&t1?z>JceygSKlA+tSx?>WV3gOp1{5^sm9j$D{VYNhgf)Dbw-gUtqT8A6 z-E`oSaTnsd)3zn?!mJIARlJu&m=#V|Bp#T?M%l6BrD#LAZ#bFI{SyjyFi|h9sd<{C zy)`dBR1PSUBGJmU%z7-nkie((}G z<}#^9!OHiUz`zH~#Jf679fz;U^h4S%Sxzu%vW5B(IPqw`s(iWl`dSk-8-L^I-eus| zGz85mtqTX0*sQ^?DMwJN#e^@(=}^9yG8`t%pe}{B@!R>@{*(I|4fR}vq4rio_d~|+ z`{>;~hoEm95ioYX(!xR$#N8>I98j2Zr&~1)tQkzwyW&`GIQgzBclgX2RK~sa?6Y+6 zj}?>Na$ljx1Gz{%J^9>c`AtLY=1(TdX^zlFNMpr$fV+2SKt_GUC$pt5j)BX0@ADfa zWRppJBIY&UR}{;>aSiNIfT08^o5!;Y^^+R=tSF7CkSui%akWv$xN}jK9*;>zZat|A zo}ceuT~YI3=)h)L>|V;rVP&>#($}!ur}t2LC2N3vl(uH92}hbEK(;&vUm3u zllzA|r~y8S7|5Ew=2@a~&bEN|aVrK4+3+(jX3%qW5F#lJUZ;3h_V*QQc%p1?Rp=$? z!z6-=I(|?`hy-E>vSIpY-e~qyFii}Dqel@en>kbOyI)XiYmVwsIP&256bBj`$9r#Q zGcsWo5FF53161<$*78s4y&}#pCg<@6aA}!qgG-YPB0sq%8=L=W`a~I}T<1 zg4D-vA5UM>4xhlcj3gKSNj@1Hohjk`F+bS4qIg*P-*!o@$zN+;_!c=WmD;%~nhYpXv{2nCzC zE-e%iZ4e#B)gIOnI4bM&jdh@t96JEUn9K16dq29|;};O+4@`nVq*KRutE)`gJ3az! z(V#r_j;Bp_JNe5bxR}?=t*9{HU1hbG%3(6CVSC%e?^u1-5f6EP+qcBa6H*|J}|tW&mA!4Hz?Kn^IkBvo|DVj{?nb~`Sbk>l@8t&#iYh>o$k zi;a$Fm=o<}%Qx?`-{XAq(Hx%oxwe0pm6Sg@CZdB-s))Db_=UsAC7)zSyO5=g*IXX= zx7|5)vZ1$Bzd<-5m<*vQLy1nmzL{)}=em8z*_HX4N*@ZrVd~vbaSpz)!l@V%-m=E3 zIN!xRR6$8WntgQ0=NBna1E zT_as~k*u`qaJE17D+DR=S6o&=vUc55IA>DzJ<&;ZMMTecdsZF&KQ|llQNtwFc^vQ0 zz!0l>dWgQ)Z#1r12il;-2uR<^%)l5~96iR@3J`~%o8>}NMEV^S=oqESa`A;;^=zvV zng%g zdA?xZOk?7?jKYn}ZlG#K@6b#~)OXDBB4tzEP$y8M5NV)nTw+Gw;6qFbm&rKv-ndH9 zT6|?Jqj;`7qx)?Mqrh*!gkRr@XPU{gqZM;5* z`hCS2Skq{;+=L6W-~5i;XK0aqHde|q{s~sdcO|!AQFoFC2K$x>hMero1dy0`6ATb~ z2R;924MVxC@XIxo9IrD(M@7Z#`ZkcN{w)=o`#WCOoRc|YW=oajYqwClx)r%{Y?g1P zH@v8k2XC^ZVu&_-_`^O$L3i;?$o}5iw9>^Jd=THo?38&w+c>=%eyBPx?sR3Qzci3} zmQf|Q({^x{;krh$HZsz!k;T#aTIX~;7exDgs~?~Nsh!S^`ekqn;)@m!TVB}u{op_c1}#kC4zA(BRx=c=8yt9z2S0mz{93Z zmvyL-pP9iCl3?^)qEST3FY@D?C0TJ$@y3gH5$3#kgIq+@d!DzFgj>HrA?CHN4QtOy zOSwB1FTFZ9I5wQvTYv17vXc$a19+yUXioeYg!gyZUtX)LgVfcZmA!^Yzh8n@<(r$O zYTWRZzLNu9-7w-|UD((B#VI!3{Vrkrph-o@JO(FnjV(ypeGaS1(~NF6@+z6fh9E{D z-J-6@oTQUSp{>#Z(?L_9zR6g~VKZ+m-@~Q}GXP2??#*jCAnxS8y=a3F;bLR74#g)b zltjXcNr{WvTow@z2$&&AhDOep*x5d21Lol;Rn7jN^{{M@Ly-wI@^3@gx(!%OsW;x_ zs$;#g-pDqN5_47NeiTO)m%aA(KgF6T$mKyCr_Z)RDHX?%wFsaviBI;Z*d&sY?r#Ut zUE+{FsB@y(&o&;ucBb8XA01?#f=48kC7E&Zo(UR?&-8U^QTU2xXRJ|K{?6T1yg05D zDbXqcAmX+rYqW#O$tXmRk3p7#_VF8>=eA47}y86(&Peoj#cn_cpLV zG%Bpr;33d7{`1$A%{;#89rIUxf0)f)Z-2RMz*o5ai|}4_yY%WO+a?T_Vgo3qPJ+=TX69vgGAtXzB%5@m%bJ#6w(|(YD7`TNxT;I%I;E0 zo7;9dEVw{*lZ{atflTS0OR@3(!L!n)-+Ug^1ooq-K@v&x0Uf+3!~``~*xU+uU0OmK zv)$PqoET{H=uwoc7{R=ZZ1@9gOqss3(qkE&bhNJvm}j7J4}J0?h&7P0Dyi?OUDu4L z{-fz^AH>x0ic$Ml6U|qTq+pGQ_^#x<*(%7Du6GsY{^gcHj1FIG;|}AGCCxIlBx`G; z`AhJ^jA*43HD$}1l2y==E)YRpvp8!kxCn%=qJ~ibL&=XYOf3xkX&9fu*k6M|_Q0P? zf2DPEkF%OuMVFl!WR)LL%2;er5pJoB(=1R8VKkLBZw&+_1pWCnkl{Pbi9Ex0+F@R# zJ}EgOzrKPsAR4<}Lv3&ML*{7i%l)`DWW1Lu+zc9wKSDy*)Qlnm3PUVOhql{_)=yX0 zuqpxuTpwGbI1ekauD{5+z7?KaG1}U)3vYtHG67M%drbWy&#^}mCc}>Lj(f6<-Xz z7|5c^9n0&P%&o%0Cg0Av34aU zAN2x8+W4QtE=-CyUh^7}WJ0LNA&fN<*zd|&a9Q6)Zpfa0zU~me=$Y)$D?`Lk$A@t+ zM*cDu&$3FZyW=Fi8hY@jW^mQm%QF1S>n=hm`%hjq#Rd`}abZ+c z%Q@$*-bhwbyDr{r!>Y7c^&bkbKbQrs2~-*T#%gLS6HjbWT0cLu2LlV;_z=u43>d> z&{v5Q`_qpf<+=~cJ0yPYADv5z=;J_kJP26)5 z0)ppO$r>K_t3A_tWy{}OWl0fbmHOHFxJfhL_v`FTVt`?$t5=8S47d0UG%WG0;^zuG zVYzbZfNR9mnjOhpW-#PKa6X&zRXrLAmVg8oqQBoaoO(HTG*WOtr_EQt-y+jHGL%pC z1)CT@K()G$y|<_W_jzd8VJvE6zBvv$(pwf5+Wfr?!h=o*&mX`S7V;4de6ByJ)RKxT z=kCYXo~}Zfq@pp=j{A56OCz}yCWPZvRz{F?nW&g6ZB^sy4ALAo>PH0=V#kHz* z(0EUx(2*rOz~-ot_Js(k)W1~7`;q<1qRsQ>u8PKr9DKYN7iE+}J%`y4)4C*zME9Af zlzWCgAA-F-9cDUMlDTP`Ou!kUC_C2tLY&~7l!qo;jEre?^JH;P)RjobLA6z%J7)27 z!y0u_Z@$rG3!@TyjZEI!W2MWYoxS?{qYprZKbzIBq%(%$;>1S#FBYMG!hfs5VgTgL z@0q-h3m{)5EE&HXa!cWWNWE7m11uRdhTzmhFag#?cKXuTZIxunr^(dtl~KZ!=KA zLS28ye$s)>HAMVUtR74ur+<4aTvaMB3va-U*%(au_<|L-iBmT7QIko=$&1x) ztnFttX$mKlu8t{U7nNQi<@p$n<3~=9VHWXEIXoW+=qJaz=M;6!lR5CKCy}mL@Rg zs0v)mD*F#^Tc6(sQSb&O?;C1OraSJurR|60CUnGWaRql}dw1);A>~_{MTr!u@wFYy zZ?Y7U8ImurZVpo^e!+}q+Fz{IxkivuY|l(5eGxO^UShmybYz%mF=~EowtuiOgV4V6kwjq1?`?EhdTR&8 zd#5Dai)}qKTaP`rWNSE)*LAJOjh~Cjy}j8QU{Z41EO@WinEUDN2irj@@TwVugp%yT z&85$>8wHh0raW7kIAM`?$)(#@suG@TGnBP%%@=u|cjh7#uVv%805r96ZM&ha*Ekz+jqHSR?iv|ZK$kG7?wT1^#0uTr zRmlu{)1QnICw7a{Uv<*Eq1zAL`BiLn)LdICqn^>)viqq{L@HkLfnsv{YPLEdH@~LM z=Rh|K+RkGh59`@coF^8vqsLw`%q=zak@-yBYqjaIbn~w4Z~n=CnZ6Xt+i|V3W#xCy z)rKx)YG3&d;ZEsZux7zXzfCs}y3@+GFC2UFmh<#@sMrzGm!J0tT3v#!Ji*u#QTzMb zZ_`!jw^{>U*VPaHI33DYZ8^@v|D^^>WNLmiNt)7L;jhmS(d?&5B26|QAYZM8kw>e` zA67-S@>7}!+NRi(%USfi69fgRy|*9!9JBNYeg#E%M`(vk@^7I+EXtVmRhTB`JE@OB!bvdG>-# zcecly=~h(mf^7$euG6IY?NPcu`+I%YGwK7MBf~ily?FAqWL)Ky_&BB9Hzwg<{Sa@s zUd-1F`C$otaB<=D^78ujE`^##;zX4;{*$i9ezhPg@Q&Ors@6;pPFbQcfC*VzocP4V zPvr3jvo;&0B)}v9$TXpFp4&Kwusag6>Gq&-Vn%*%y(yr+m z9%N$M=EPP<9h(z76WdNEwrwX9+qONiZFbDBulxDl|J{9@XLVKWs#UAjR_dydlaw5l z^Bw&i|C>dUG>(`s21~^DM$hNuB*0g2TEk*RwWyu=*_M5PvMru*paGyX9)yJWTg-RNZ=vwsr8X_r{^7?SYGFciGNA z5_q#$`zPhon>R)8{p+IDC+61E2)FGBw|S-DNEYfGby1uHBks6n0h{L|b}%P95E>jK zs9~`ZlZAP9$Zrn2MxMZl&aqFgBHX|}0FU3evtkyQkW?M=& zkC!5D#PI(2u*+M_hOTN8*^^DyYc4NOWupnLUF{i@jKKGEZ#&&;Kb5rzuQx}|>l3ZZ zLq4i#MlXJMug^1KxsKS^OPu}_Q}0w>)2ST-@#xJ-LY)uyS6jEkq(`3Ck(hWoQnIwZ%N6(Ftj;;8mDi$MFSEIk{h~2E$HcRQ`bqj-mB&2cB zvu25QTph!k8-}({9{^z9j4oRHj@=WxXTkp*n+f}YL+t#L%sabpTDDZ-KU*etln8}qrDNVRH+$=Eae$^hivS$HRkz&Q~f93Py_3;>d z1$t<=A+8(ed$0q!`U0P7=F_&6q^5&YTJFwsZfDPI4>yL1SUM7vxH&5IgjJC|AUf$R zmuv@CB7R7SRE0E_Yprl{w<5gqx+9euYlx7d1S0?F}m4eQg> zMMtFcm04?o1G>rsiad9t2w}wf@c2-ncb3#Q)F=)f#BZl}y2@y5nXuts!St$z#eD~E zRzXi>{ejDD@Q(Z&I0O%a@od~=Nhbayfd&G)7H@?=AALWEhri_AU*nqDz{LnG^&SX# z6MZS5oHTqdAljXSB088*mf!CrdPAO1r-dsg@;MncdwL%Pv@;Ca8@U`jI!XSM+ZWDx zXBm#Uk9u$g*r8p0`fhFi^L>kMQ%FC`_R5sK@Sfl~MITyB`cm_e^m+X@C(9WE9?!#P zcFgn*^S%JQKPjJ&EaQ8wmZ}U}udXf53I|SMNGq_geb=xwts&MRBHk8iI{23QZzW0+yy=JFj;r z4CX{6a|s#uek7R!Bs_LKcD}OV)gQUHNEu1`;RmZPW@Wg!&vOvEzez@SJ&6SBj2(Sk zIj-AXLCU4+^f%@_1GZiVC)tL*_wI_Qa`f+`Wh++yb>Y?03VJ%Zx_nvqA|r6|eWLqh znoe^|dN}&^dGDQ3QSDoI+q;iV%d@x>-@8`VM|(-yKkd;uSxm>0ESX{>_U5;@qsUsG z=i#NUL8|U|C(|@uOd!uxupPj$!SG>J{f^%ri7D*8~ZdANfQKakRm*LQj9c1W@ z_q_AiJ+A!*$_haV0eGXwD3t`q7qhjdg6q+L2~#D9NJPJ_kJ+Zu?_ry_-m!DK_T9d; zxmp!8Gmd9tvB4=Tm7SbQ+TWhDx;1YM)DM<;XU){5z9kOczU+p5^wlSaol=_-s*fM zl3@%Q^nGPk^D(W30oT0Ad?*>o#u$N{3Wl7Fupr+izB-+&Y>xu*)70u=Jihp&9d|+{ zDbhF{`7SPX=EnhjChXuL5P-}H>09KoH%8a%#+3t@Cw7Ge#CjR5qJUUrf>&2m8jqYs zYdMbxz4p5p)8xF*HF{k^HP>AqU}?0tqhMvZ;zu#})|%=JtmkY<3R^#yUwZx-F1Lh{ zZu$ihKpSs)#>+V@QsEPyz#bkLGHK&|X*n;@E4;|q+V7~JI_h}T>oqo=&TT3V!ZCXL za~<9Wv6<{LgGhmfXmI$C=SyGI9t~26Mwb=M4zu{ouDmEYiwWhuER5z-YG~H8MErGV6^lJwh{hS>^L-~$bGUtxot4HIN zyiWV5{~h?)o9n4O?d>FtPFJ1(d+#?zYI#dQB~G$AmZiz2%IKs(yJOEVMuF+|!PQ$V zUN?w<0ZBp@Aru2f!CWf=XJT|^ilDZ&hVj)p9%x_a7t!$LjMhVD0P-}_Fh~` z^4FT}YTrWI^zGw+GKgDB;9A66n9rvCX@cJ;`Ur1efe97PXzv88s6XF6a*Py;M?!! z;yM_?=m6$GI`$)QUN<#IO)&W0MChT{B_Td^oQHd%rmEA4v7{ANRKQ;;rxZLAQ-M4M ze16!rZ~M9*XDV~Mj|s+DkCTXBSLWdFz)g0sYkO}@w;r!<#jRgd?Imhmcs=i3?I+hk z&&I==5Ip+uf8Nyp!B5Hb0_5<#;vW*Sex=owcQl59`|v>9YJKPaxf}1=^(bW_1>wRL zjj;~Ni%*6U@l`<}FYM^5HEq~uW9aY#G3RwPiY?makX21@WU1PVs2lH>q?*`u-n91g z-HLJM#x3ur&(!loDo66zEJ7f~ejoF$qTZC4IKj|D4p#=F@3of?uQ%mETSRi(;SK^O zHhi$R*h@a>;hyIIiZ3@bvO6Kv*Ml~O6Q}g-Y{J#GwKQf&lg~a98==i|Ui5{91;BL= zhY3>2n?hX4UX#EF3iyl#tp*1q*2P}1F}h^YeuShZiWKGUY(j+`$hz;V=^c@6b>!Ht zd(a*c@*@0sm_jTYqy2KM-T4Pe=fTHtSbNI0>h-w%vf6W)!^O#Y&qIORf-Na*=Fb71 zY9+DKhJ^D3X^5y8mVq?%Mfl)L3??KdR=Dh54qx$23l&_p<_vIa;umHOHRcN zK=!TrXQz~_l|g?K!|AY0AzOU6O~^0WMWqcua*NB%4p-j^*@dJOT5Vqwf!5-Dc5NC{ zvEOEu?yj*U+N#~3y88)bxN6HQZ@Up^mb8h`L;^dV6d6ikTU$n6m-FpVvgl>=EYocF z;IT2O_)+p%GpB*0b3zGhKTEJ@1-}O^6Mc46%lBUMFk>z;w49ceivgUtQNz$J6cN>~ zF_)$y2Mq)J4HA*nf#-@RnP{7?2;DUFd#q~RIeN1EnQ+soL!3T$(o>!Ld!Y-Thj}HK z_7l9-J7;P-fQt7d)kOtOjr#F}$vrAeUGc9HGc5K>v$&W=#_zg^3T%?P3@HQefj`kG zWq&i(hVxMV`iJnsHt-aN23P&QK?RMVS)OmhhS7WWTf-sc$mV~M051HoH{Y;pUm@dV zD8YRJxS|4=e>DK90BKK=0!6*^I!FIhwY_T)!%<$s6qv#AmK5@FkG*Gcrg1mW&GoXp z*K&}sWwLr)w&Z3EPAg0-sftejwG-IzWI-tHw#48$W%1f&XKt$KSgDefNI}szZa>@DTxA&LPJP|MzGGvj!15 zxv?kz>gdjwsGSfX`$v?uZA{gy>)cw+oBuDT!P~-%op<>K0`q{>4s@7nWVKpvx`;Qe zz52_|`%nc8op(wOt@u(jg^A#Qfo`0|dhx$U1$SWxL!ld-vAy?e8Gt0&hm&npr*+Wfy?=&gDD+qow$b`I{R z`p5fin__zr2l)#{>>q9liI8AMgZM|`VCH2 z1Qu02uyJS}mlnAVg{B6=Q=4Vt|Nrr8+}YJoogOz0_~3xd^lrZ6@ zfA@N*cwWeKoTC z97x`*MY{b`a{_ENII7OR;?fNM;eMgS1EUUZWV3?=*zexU+tU##7cRbI-@gLYpBM$P zM5@KM{bHYR;QmX!(=(oVs}o=l3M6L2Z*8!yYD=7K zv2FW}Yg!1T_7Sm)FwBr>$iZn$#ukYbpGq-aFn{I`#ogKM8Rk}Z-sMVHN6Kse4MOm{ zU+=rt&DndEH@=m@gnPk!lXbS&E=*fn+wlc>+ii5a?J|^Ty2(0!mKxm1*443CSa}Wz zV|Tw4(ktfD zvRhXmy;v_5E8;#+w;KhXfAcb0Ak)qc3~fx=y)-Y)$>~k&uU~Q<4^;h6!VmnE(R*J$ zGI^#!VsCEXZa+*Uba)ROI{r(hBD}q2b#ZGcV7PB)?bG2e2TSB}v{!0fBBm4#U|IbC|blmz58W3Sk=^YMkIUTZZzh-Z4*ffRaTu zJ|kmA!YFy11O)H(B`!E?5|PlqD0u^Juf&f}Pj8OyH8F>C+*k@M%HK8Hl=6S+Z^MX* z>|0=))K%zQ2p0TEU7v>R$CE(5xzX&5eHA4iws9&;jK7SoEcEb9V>&^`EPhHHhKG)J_YhtonBA%%4nO9vk^vrL#hw{gDwOVDXyUY`|u-91o0`a?;@=?r|Yj zon5j|S6QzGSyj}kN7``#Za2YU&E)@=_$r(cBjw{!RJC%gFKn2oH$O#JfA583x0ad^ zcZXIAdD|WK`VX7NFePfl?r-G=TkFBP0=LyZd-h)#2irv_=O?7-G5Ty+{=tIBu?P|}F=inlxXk4YbjG3^- zl7YvSw+Zv+^k1XqaQ&z!Zq!Jx_00t6)FpPBbx0JlfzSlxUG=aqF#*^Hfi*MKh4{}M zWISB1H0Z1Ih4qNsYAE{_VsKH`y#=2hfl<~Mky$(`@nxD#m9|A~eKFZ6)GVch=jt%f ze&B!$`oh8;1-~YdnA4)cnh1{~ufkjPo+n4g%8Ku2-Q1On>Pf3y{=MylEc$I*q>d4at4|`-9sKcR2E+F@*}GN}v6!@hr&-yK zyNQC(I%*PHIZ1PRaUx%IW)kmyb!s{kMAAxjC0EeDdbm{HBfFpDXwc&i)9XrR2L@JsAAgfbX zzTvL_=@HhCv&V<P~wHHJ*W&!`f(X5&y)D-qAF2&);!NjwS7`s5oPfQ=l{L@C3xYmxvbN^UrWl zdiwTpSnsg!Q5&dZPRI3E1P*B$B-*eg9CUoL-e)8a5C^3ue^~zGo-1XO@_VMXtEC^!O z41zPII6ohvj!=t-MMZ(vdISQrZrBhvaxv&{dvD7y9&P zJeNjDKannH0pOr){PpM{k(Rm0&2mM52HruSn9 z`0Ss^a$L`Jx?V3RO(kq4;ErUCqcLtuz2m~ao(9f+-RsP@)W*VOYM(imyy~d#_szE^ zn~UPEs`OI&dkF`LylecBpa{L<0!uvlNi^*FnVxtI#`%PK@_bBMJ+Cz5GtOA*>fcVX z2;*vWRA(?Ilc_=)=J`+IQP0Lq=RY92N}3Al1L(C@X=vz8RlG5@nygGbJ+asq?p2ml zauXwrC6VJ1ELHzRGMO8~Rh^~WgA3By+QJ{ef*N}rs*z;Qx=OW(H!tn4El#dh!sZe6 z)BGvnsRIk&=zHn_9vrs&AP)<0NdQf@mPXIJ2Q6lr#WE$OUFnk_*)^`C^Ese!ae833d4s?eU#PWOanNjTnE$sd zGTvgpoGb_{JNz&SW{*c|OR>Jkrkx)zj|qSJWQJvF$Z_AR|CAzy-l=tYX3=ctfhmQ) zZ){9V5gRS`RDZc;X=|U8NmqbMCdI8iS+318F6Use9#Yvwxd`EhGERFdllef3WI9NN ze@*n;U1W^A__07i9)W4QztXtj7U!VX)W$cF!J2NtJJy}E=BG0|SRsi(r}a-#(-cSN z*WjTwO|q*=X|;r-gbwyWkFV~DiH>KuI*`@ZgKurkL!-SkU zQ|5zB2$in(aGc|C-SI)C6SA>Y{p9LGhDKd!h`Kv0?{C(;uJ{xzx;*n2^|>s*i5yLN z?=)zJz6U6X!K#oXMBG}q@6vzZvpL(F2QIfCi{C3uPRO#Cw$?pie$Cj+)-CTcXz-bmi?2} zd)+n~6F>U#n4fDm)AQndCLv;_sl{n1idLb~nj9ZbKASoi9Zk^C+&tfA@ZA|<@A&jG z58T#DjgQq94nzmm1{K!V!>M@&(nX}VLGF@i^DE{m{%k?j+NSwSS8cMIC@BJ|5w=!1 zyj+Vgk;$E$y%6d~$Ete74Wq z*LYbl3|tx~PWXxhL)*6~TRn3mRYpteem*<=x2odz-jFlCcOOlnstR!t(OP~Z@xqd{ zd4A?1J?-=G_s{JSBl+U0s<_o)p8PmyB`s*_o4bNf6J?IE!K1FAr19h(4f93KaOd)Q zeBbq*f&BE?;0rB|8m|)8%0JeH`hheVM$TbkfOAipr>mEv8aZ}lUn1tBEKi0Cc z^jV_}#VRmpk#0vGPSm!pCpUU00`8Z0#6zD!%CpE(gV)+25^Pd>dPFWGCT~xeJ){Zt z3RV3>_h(^Z1uBUtqyepkrJMYV73#vaZ7~Rzi#4T8w?omyxLA>#j6^`Aw1g&Xn9J(WCtlM0|8W8G*w_|H`V10l%*?F%`idGW zqtqoS#%9++Dea}UxZ@}x)4gK3d|@S!zM}pCGwU4Z)99$`;eGYEF~NW3G*wm^78E7K zAS6cT4lb-VXT(Iz#D0mM93LNy7U|rzgs&>aoc_(Hvp{KrAlXsOhE`61RwSHLp|Bp4 zCcQgoO9K>y9R^#dsMhTVA#icaPWaPII@9U2rqvpaNq{FFr2a!=5UpLh#gX*JhXdpn z*0gDyC4|+Mc$(CD`Ts1sX66G8_o>|g|n1m&B`jJZ@;g7q*8VVqm&nvXl} zk&Xv*Ys+ANjKFAVNoP_)3=jMltf(3#!#b!xSbYBA}uY7$n{N2dnfs(xDh1O`%Vrfh^ zfCNok#gOIL3&YXX0})`CDc9cq$o`y}{-puP48JqL^U5>Ril=|QH6-_jX``#R1`8U$ z?I&_1xJjRzW8tu|>Q}~HvR__Y4W^*$tA&<27 zptrhI520Ys%Hkb)4bfR5L62Ae1~|}%scFc;r#hplDG(}Fla;U}C5cc6j4s2Vr7bH= zlZ1GvB#JBQMw@2qjp<#s#z=44a}*W9w6%M8kKR2%7< z#T`=o!c-bbPEN)|*_%Ge`}e0``p=B!Y>uq-Q}TiYv{LGrr?5+fkB0iJ<<=~m@?m`@ z{JY~^6{J7^zVRmR&pmczfX{*3H&(`(h0Q6wk2~UFd|wuEB6n;;+!GkO@#(Ly{wW{r zq2a-`nNI6*Um|VHw$-}d2=JPnk;77uW3XfRt+pg z8@gF8_%!HiFc+zSR)Pc8LhP6&I+v@}de7s|nUBtvXq%QB2A-bpR7#vLTq_R6-9bPx#S z(6j{RA=kRWST5Rj|$o{U}C#-HRKI7QG z2%^TK5J+J&tJCq34+*CRv)Vd@zu7}>54pM~^Zm#*&4(7nU`zAK34!f@a%I$W*^SD_ zuD`?}v(NVh@r!@oVUi&t5T%W&LxtfoBPnI5{t7V`a1(X#r#PQEOf}bOYWgq3Ey;?{ zQypTl8G_g`XB$uRj&uG05d1Sts>hu)@Nl0>tN0O97imR|$79(+rh7-x^D00n9TL_c zRLL1sBJklisl%ZOizsktcQ~EuR{($@ZUy{BKN zl|*DLp=M+hZ{_A$ZI@J0F%-A<&-|pu?^~A0Q*U+nv63nM%N>KFNb-e++wg{(A`HTE zvBLQE!6iK-{cl;-Z*fy93JPNpGLk?CjYb=^Z$jo1CL6&~|2Udv{wYMDcbSTHNQL`= z!6WULqw@!OKR78Q5(O!vl_ot-C0?Ih8af9vx(j{tu=qYk_QLl%PM^S#LT^tz%f&_( zdoQ>m<02nQL+M;}b!>s2 z!@!U<3_~rmEVFw7HzOwB5sdJtWmSm*$LFiT1kni+O7WTz49$JZj{ zyR`PY2h>Rf{3f**pEI4YRl+C=Mb0%#2(9?{hmA&FAE~^jdf)BQH&56^aJoyzLfAj; zY5xM7SLq{a8_5)4ATrWS>AP93SFU9_UfquS?=N~^^|!o2LF%9ZSgFImxf94fe7bCD zD!Af8=923bzbarSRfRky(Ed%h*NX0x0DZm`JHDR&=CYeFhkdb z3v7zjEC`r0>oWU6A1EL$;1)~2lWTA93@yC|y|XJBG{a#QM*EIxmE7dN?SqxaCIwy5 zgQy7n$^h+m5afMBmzDcq3!OMr%~aTXJ1qed)FTG#CrD;@qg4zaeBgrFP8qoZ9?l#$ z3kQN-l5|#SitCDCg6oZIh*Q;HRf1$TpSm*OR-7pgR_#cfwo#8zM55tVR@ql#_O=_HIv1vDk84d|tao67YS=h%>3EN^-Zn*`kqn-Jh^1i^2?Hdd zL&#m&3z*6Of))Y(rWftf$mHW=Y0ThizWMG;X%bN%eUIq#?yuLK2;ftlvN_er58GED zd$nhgNS=ZeNt~ZhlmHVkpb%E+%zUXkWmRuFXa4LZZyvS5#VbH_IhUNL;x5Yx>~VjcKt^BVT|-AEdaq)~uL;q5)O zYOzKyH{#>A$m2}{oy1DvgBYPN2d?~^25l0YQeI6>gNVnI5!alUkr9-9`%p2{J~;*^ zs-Fln7TniWF^F&K$NI+->Oqx3MYRnOeSaS4DPc4{s81eYP=o$)m?@@GMf z;G541DM7`VXTa|ds&9TrSJL~!0siT`ekI>gGHtr(!f#G-;XT80t)S}^1 zuXj(qcqf}dA4@^*+23C}JJ~?WPrFD2ff%sd`xcsKUv-U9CeFqmsZ_7S&{gfMKS+IZ zC$F+WU3qUznOCJvu#goL*9aG0%@IAYsIz7y0TbolXj^=@AB*C*eISoYzA9?F$nIZd z*%H2b7yROqXT0^jhpvFucj6>)>R?vTiCb;AM9t;+@h7vIPLuaKm zLZHLd_+d5oz1o}@Z1fT8Acm{9Wy43&Z2Vhk${43X$67#;`|Tq*hVm zE+e+uTg_|2Pt4?Ix^LUP<@+>!4fb~#82A8#!V}xwzQ=g@7wu55j7FCiK&*}ETBwi~ zR=4-Nf9baOlyYLrl)y_>3^SLP=HZ}Q-qq<<8swc0{3%w%B2f!*w;tp}l<4;#?_!Sj zpJo{M{okkD1obpJ;;DJWK3xpA9U%6*r}MhX^RHIN@J_xzun#!n!oLP)z2077O^Mds>!K?tTe^oSRT!%*`zZIap;MogXE;B&2W8w$FB7xP8c^} zkKP#@mp`n}Y4a;Ch}j*AI7D*XgIDwVpw!i@!^jtQGtZ(+LJV( z9n3gBz5fca8xqy~?a9URk5OJATfCz#eHH^Hxq2lszMZuX}1L|if{IKt~;gq?mw*7_e>?nl#;BE=gP2>ca5Kw_+}!h~S>Ln3G->3S)zFRa>FV&Vqd+X}KZ%ll6~$6YV~?I6e=*V#d3!J*jDKj5hp_%;spY>|WWa zt}Cm(G6*!_>>iGhr7q492(6IQwSE5M9+|d~{=z~yJa`pQ4An;|?q8L#T~UGqo;^kTH3iS{eppqA&7N4sMbM{bMT z4M6R0UQJ6t(KP_8g6l}zg%C89RA;dx{kB_0RhkBfK{HiF{aJ135F`tloyS@F4LY!7 z+{j-#+*L2>egsp!i{eSFvRuZA=Dg~!7P{|w_acd zNB_r=!uzru$O`J-UijX3s2)sRKtzvR=F3GfD;hEJW=wI=nM*roYIatTLLvyx997^4 zxkXzB7cjnmRolE325%^7XS?kX_Iw&#j7#!+yeDa|$L_d3cJ&nzwMWKVAw4$9?!|EG zjq&+<$C~D-OS$R=YcupME>_BTy{@b~4Bot*mpm%2DTrFLO&n@NcHlcl)#Gf;4qbeD z;aJdKvr1B5`rMiGzb?A6IL^6MJ-@Z9gWl?`bnBv&rvC=3!9|3Sx9qIA}M2F43ZqdzN+lG`$ zeMtfyeUDOj4+xsV0K`&6{(vE77~T2j1lNn z`*^pZl1q zRhxbJ_vZX|y*mIGM@Bp>#>0N1cgQs@<%tN{9XoNmdHK)2;}~sG4GsUQ3%sY<>Q6`) z{CrgWn%@vR)D2qXJwZJ;Y}uF+MaSpoU~{K?mv*sbc($cJERu2ieDiusrf@pkbyCah zm86>fJ)TUUj)PP<;8*Gs85Q zu@O;&asLvnbDm2Q)lex@2G>{Ty_7CF=n9{&|Ci&Oa6O0cecT3Vybi~%X1s3NTkiAw zL)w{%KG$VC8h(%WK>W)7eh}4hwjV~P+nw$>Er7sT|GnJ?wuE41puQBJ8mXNvjDmhh zCbMs4uVl~4JqVA;Jze6&i=%QwNS+5GsVI@6U*be4KmOkJJ+9uh;U;K&tACi^i896e z6pC);*uP<=%bA%^_G2yb~Jv>otmvyA+zw$(Ci-9Yu`;v7T)vWw4T_S zBCD;dub^e70g^YZYHMw1T@a-r}ZB1#%2dTzMlYIk-cT3v!`hzJ^!SeI>S<(r;7 zDI4)*y77gs7e7@SooCwiMZ0{4rP&C0aGJe&*kom8Wh_gDV{Am4 z>G#4dSKUti7#+tlJ(4Rl;V2AV78#G)aykd1wmOmtyQZZr+fwZwxV3$609BuFSSz)Q zdE&pWqxVc=$Nt&hz=X_p>f^v+*%(M`I&A5EPDRkNPGqwCRT-D7r^z`k-iWjAOj~C< z?%YI{x~wd=`jv3HkZ{r+NDFv{kDVlxPTmX23I7Ytd-u&IP{Eg;42m{0yEAn;xuc1erqr-ywoKIFAO~Xx@lu;r$4=!-w%#ipDn=-VYtM z5~J&SL*p+Z9zwRle!_u7>uVoFb@+f+_W zQ2Tc6$_uOH3YGt(n@IGrh}zuhw?nJ6-qg^k#&k-T3!dKRvgic23#*nYgUQMZKTnQ( zr2L0IK=0$!RO0^k$!1HqJpVl%r_ULOiT7UT`dfXi)%yD2R*p@-^yBTy^j06eUR&at zuQO^>(bEk=_Yc+(^G~2(+m3JO<7157&tIF9Z9du}mls9v1z{xEFxUr`CpF07e^0WW zJtz3&@RwmOzR%C??1_1~FDWP6x^M`Z=-zp~5np$OXFusi^4~8{x!PNyzw#`n2tEyC zzSEk2D)*oD{13K52A=N^%95k1CpU^4y1If+!xz5|$aO{&UTc!X_J;I=3IiTdeQO8> zCD@)ljz0KB^?zIDDR#-jltyGP7$_ZghgX-j_@#wR+X?0>jtN2IEv!gR&ruv}BZ^zb zqZOkO{fdcakTRn?SG#a#@4c#hxUNB7x%f*DhrB8}fE)X3Pm#rMh~a6>Wy=(TUKOR=*{xPMvCD^Fw%V1)QIT?9}KEl~cMQZlK4(2|=#=qRPOA zju_KV-7MA_1CaQTD?SX1s$t#}-^CFrCS=}l^gM2?&wPNOPjD`7-cZsLpPSTeO~*6S z1AJ|CO|aMd0}G>@uIFFlSd-gSj%A2tQvrF)YAdu9Ta22Z!`1E-s5CM5+fiMew zyq#Hu5o%55gaAeAUia)wPtXrJH96H( z&DF4m1l)Z?`VK!ME)t2&^n$KGS3E&X?NzrEkB^m&kK83_s5Kl@#>vtDaC$VdsC$HLbSsDAm>+pe261WpGX7G@az1V;;4#FUI&1ClR zy25ysU#82Rl~*6NiO-8THa#nC-MSyqtk#tSt}Oe|)h|nL zxKOL2NN+F|$uAuz{_fs0{B;_FC=vT5jNaX8@N^>lcW}g>=bO`w@}Nj~#h~Nra|fog z6P3lh3mqkF5CL8tP4iC<44M?(`<+cCm|lh}fGXWjDI4^H@EiVB%xXY!U3X2e=T*{x zecSQweu&V3o!uD+|6^Q?zRQ&{w%eKB2SK^dhfXNxh)BYteJ+IO7Wjx?9vRpB{2sqZ zUH4=?(R#9#*XRecjaAmh!(2mRzyCF8@A5@Slh zay;xcZEguWT(BVr-2_PO=s4&&^=Bes|45&y%+_cQ)eEqPaR2QgjLR{H=c2Ctz7R&L zaoqa4>2qc+b6IW>8+LK13{TY-KkOqk%!9KU7lD=U1{`L85XmF`H6WpopYrgo-vI63 z;M)MQK{M(g4u9ky5FH$trPg;h-?Hg)URu&{8jiqI2sAd>#Fw3uMsyLS+2|rhBIo$smpT3FQ zllQmlboGJZUwaEqEVI}DLIf?sM})lUFrA<$S_Nrs9>?}FpuuKV>Cc#Tb7S=>W@vj- z3&Fv1j|$?r;WImOowSE8(&Ul4h}1PemJi&!XJKe!e5i~;tlxXSKPMc+9!(lGf}i0^ zR=#g#9OL0p^r^Nk;e2zkDwf{!MP+@=7d7F~2D$7m=BX>l8}d{gwJ5LM*k*3GIc;KT zz7-G~DpsHSnsf5%tp^fhVqjZuY!979PbmeGOG=sEJjvO#{51+2CP^hZcqQ0n9hCkP z$F=ttrn(vJ9Xmr`)Gix45Jp^nkQmdhI_k&FbL&ufx64&4!=}}BU@H%bu~H)tb{}Gn z0wOuUoqk$gJnh?%VLXI3nk)ubFjPoyoQK{Z5LWb}N>rGuDRTH@9}c**a*-dw(8fiP zccIDs1%YJ41yW7gp?o-G!lD)%V-0;poqTcXN5~;qc)H_hH^K-VXGeY2p``Xa(`d89 zT_%eo3M`jpH$G{*bN0wDN6UEn9J)t8RchZ*UCHoNDE^$}JU4UE!bwJN^=(gIW|5Ew zAQeNryi2Ii8~#Uf#z+z(W8!4{0%h6B^2Cf%9UOj`ZRfHjh&%x8tGR-X!Nc zqpz)w(~X!&rUni7SRA*(SNk8{dV9FObl)vWog6q}H68Ow%yfokiVEzC|Hku7)efU3 zTj6*i*)B)t9@8>QQ;PjRizkphF%Z&Fyp#Ov#6YACb?aDG!oxDH86uPOXNrW@^&Z)_ zFf$5?Ef1o>=k8B!+g3&stsxa_9am$Y ziS88d{AzSPSJf#>k9uYV2NHqE1cj=L1O)isVBhZ(${2Ec?L!M})H)X(8O!|R z0`vLR@}2iZfp-KH?m>}yOsatSV)-m$yF4!T762_mVO9TYy^w*3re*2U8F)YHyVZJ& zy$rF1nOP`U4Va0IZQz%h&R|bZPZ-iqDes0UG&Po%YG8>7i| zb~-L^2KmopMW4I7`a3mC@DXl-nbio5GQN1k0qR*5PvtklrJd#rX^6i)UTwq&Jh7xy zb!8TfPvv$mM#wR@tb^{9M3dF(1R0WmjGnIm=cW_uf<+K* zRf~UbuaL{d`Y4vb=MUAa_VD?`slgO_1-YBQnpn1^&_j4k+ahK-)c-um$0$50Ak%nK z5r(t8oF{ChQ2h%@|ElH}tok$)6dhs&ZUc1TA>j&hi=ijK<788one*np;szeHP1#`S zIL!`b5Q=7HCj0&<)qzV-E^F8A8DzmTGAgoBQgIEA)E^-WP9|E!_PS*H8Ojd09U-&w z_Ms(u+lJCh_%rEtN=~h8GO-hkx7nBYk!=rDyE&4-f92Lt;A%CpbTYc9Kc(L-NUxh& zL`aMl4B=3;_WzB&hkWv*3>}ACA-*v9n}FN)>qM3S*zdcy^^W$?g|KBL4S28m#<6EL zCxo2{qH}(PAC-^H*?@)O!FSgel!32s4RD;|4grfU-@JjQ=grub8_dzbw@4Y^pDs{M z{8MLU%b@4~d}g%YxL;y+98&o>m;cOk?SAy0;Il@2^to#H+Q#xBOyQm4+JlGm@MwA5 ze04i3#J!I*xNLp()OMLn`iJLydasB`L3jh@I|g0v7wxSNZD(!<|CK8%(>LSYFC^ewuf7Q;^Ew>; zRV@=NTnC*(RR34i2x%qsro~!Mez_t*R!8r(-~UyyR!d|dU??$uSCRUk!ML&1={OjQa{!}R zjWw}tYvW{N+fFvNHn!fm&wKB`zs|$XI8=Fr1%Vy4rZ6Vtb%JQ$yIvz&22!ue#8x0)Q$$sIfVIJP#*ou-t)I`K zE5)Wc$`#3U(suk`i-wOtbGJ-3fJHz&+mDEKL{!I-t|Vx#0*Y2bD5{bkpY0yY6w@wR z`D*c-2hJhM8S>5tOC{ng^mNS5J#15c`;4(v)#@2ZOQuP&r1`B$%f{h{j2NkCnyk#V!66K zs;^JR_sM75bbG6dV%Q{xa>f;u{XM?4qCa&St#}Ocv^i31(6QR>=QAm3SdvDHMOZNR>%y6uCn~*-gJ?D7#5MDh6<4YcV`;G4`hLba%TZZ8A z(Tb@4__VN~Hl&V5HIplG1aba+mhq>C=`L;n zYwpgA$t%1&wNSoK2YN&R3LcryM0;=>na~4D(G84fQm>Uo1rYuOGi*f7w3_PaIXiIC zy*d4XsT0#4tC!BtTOcE>Vfphj-8W8ZfzF161vVY*M|ohp=Q|AyMTT{0LF%B~ zq#Y@tS5%PI`vA{KEFmAuaJ)J0bo)NRToW#isMp_APt~l%j_l60d{r49muDKI&%GWe zkhMYmMfDKDst4@1D@q!MG*bka30=n9PMI2AF$yavH#)8keju%aT6Ht`l@&W40TCW} zXlvJpy?iczhM1U`??2Z()1fF=&-0CKtm!}#mipQpu5F5ip^9i4aqU6bXe2R-2960` zgcbZn8v%8?Q+i7ea@6u22%e%o)D&ezyL$FBa&|nP;3Q~(#d|&PGAGAw0PiK#=_*6@ zmyV|8T`G1uyEUupaW2+&fV)UVZ6oN#F>rH6>&0Gb3a#z&#E`-w1d1z2A*;hs#nFdD zNvizZxpm)J*}uh}TSlrT>U|^k#1--VPRZJ_v@^G<{@A*Ch~lG=pQ)O~ zD$HsP{|57#!EebF9pI2IW|=pZ%$8>2vvF2#7#vN<&FYRLgNhhi1;;DxoZvdg-9jS5 zE)%+Qk&0P{n!x*DA!0SWXUakzB_Kl&iNHSeqnAd~m&Ch5VzJ<2sDs*Rjl9i{@L;2l zSlA45l%+HjFjar=h{!3ESaKhq@O`xy4#|ey%Vt0hfqTZ9SN7w^a!ejE?SAegN5Ovh zG#%=g^m|<)uPNqg-)iBwsrog%?!7og%%Cl{B2DR3X`IeRL#(!NV*d?hwL<>6{rhAB z1zd1&@Woaa{*}PT$H)EseR7!NO+blifog@kC&Ey;w?n-r=2=Wpxd*qSwS_wZPrH^R zo;y(Cy6{5i8SUkjO3!GuU&FT6?DW>$_xPVr`s*wOLl~_Z)vli488VJ!EKwhy)MjhB zWf5$_aL=L3H_0>i%qigAbVs}x4D!CpD@<_I-RRtp&sWE<%t0!B=a)l%knDY1F-vX{lTHpU(GU&5lOLh3d`F1c- z^(RSV0FWwP7qXbqOrnsfgAmQuaYn?VFzoK?eFeu6AbDo ztv+dGJ&esT52bkb@K&_y#Mxl#*D}RlxVx2i<)gl#H2Lo=wwAB6|G4&EC;tO5A1OMm^7>w z2%-4FSF{_z3|S-|j9!TLb_P$QG3Y%n%Wk2%J6rB#Jm|cvqv4%Mp3YvRC8ZpI;$g-2 zZ>I>M=h`6i!>E{Zp8z^dU&j1YW3(5oQ@zNQsOTBcaW$0O7mG7x%y3TfsfnlNm`gG| z7F0MasGye0WH7!A5>c(3BOoCB2cLdt?(7A{RtIIaJc058pWCLHLf+IhPS4Nx1+Lm- z`uf1C71}<-&MP$0?N}qvw{NkIKw5qn!D~UHfOmkmk8S6b-<2iEUAVR|XrDuwT|viD)q$jnSHp* zzQR84*x0SCq;g+ytIlq;G4sM3DLnK7Q5#lc=1luiz&nP{xqspT0Iefj9JbHH@n#rh z{hOC>r`GzT@F|l=xi@*>StQ@DbUuKYix48yw})+mxrbQX@^@D)N4eBLNr_ZU(w zzTX@FkwMS+;-3~y{22FLd@Q<8{s~NrrKb}gdBXV9O%1mGa6A6D-IeF-{m$!ljC!pn zK!~~P9t{OyheC$??V?eq+xG=7R`Y%bVfr7aeCuyHf&zD$wtQ@cf7>k4bv`j@|Bi?H zj`cG(jDJSk`4L_-yNe9e!sL1|P4gj)hhiJC9s#%LL0NTYJ~^({`t4}H_-Aw)JOOf8 z%tVbJFS(E$|hDD-F+5;5KAYuvo6ik-~ZD$+-@HOa$ z*RHl<4;2HY5*L&#&+8yOxJ)7&nNF#pUGZzyM|=dZ#MLJj$=xn*mLLVRN1}>`FX`!K z%Vp^XRGI!^Y?f|5?IH7XAlEEilv5)*UtMRRQxbuatUDUwUXGt;mFS8rws zm}Rupii6JeBy*R>e2#vpgAI8pWx~sl`f7~Jh4sivX@RMV`vM2`7Uc`3b&8M7(Hg%= zuRZK(>K~n)pO>uJ5b%|v=bvBv1T_r?*%;S9yp-jB$kG`X2cB^1?-S|YF|mK4_WwWt z`Om2-tN6~nDf+eVSXF1K=!XaE#7i3}YeR}kSd=f^EYGsSF?T>~WU)vfru;3SDk)H& z3sEN|QlbmX^u~L8y57U?9;|f?NaN9}J*wVtJiPGu8}!5T*w6W^wb9cU&7=tJd1GdXqurFeA^1Y;)&vI6rkNA7$I?uf*8L&rU8dOY zGbFv6J#5)|r=ko?roQ8xej1&A|4#_Uakkq_niW%jx@k2*VU;V; z%Gy!doU$u809b%@=ofku;Q^NGO;-Leg)=Qxm;lr6aH*;&D(;PHZuf5;*5Di6z1kw3v2B`>~ z6gshw*6A>}!6D0{B&2<{p$SvvMTS%tLJaxWc1eG3JutRxxiZiA-9+oZ_@xQhf@c7r zO6J)$G0@;HjcURLlSC~#(3D2FSY7FtO=81_*V*cij0x@G*+WNb7KU(yWbd;LlL>N8 zv<$NtVmrN{OF13zd}4|5B`=zis(APWmvKQiq26VGoPI#Uj83m*yOHb{pUwq@f#z$b zEdnYEc>wboi4G!S6!H=;_&`b)#V2TuAzd}zzLLf&<7jV34PXXI5rg2QBa}dZypSR< zfo<%VG%>T-e_$P-XfN%Ej~J+NJgRFqnS68K9xM*ixwC}WDY80n?otIS^oH3o^-&_% z;ZEC8m0S+hO4Ma8W4?&l)j;f5M<-+x%qouzQj7Wly>u^2B34g>Svs9Q#j!H|?^$1k z#Z^9Idhq|MFhr9*0p8fJvYQ&m_!wXGq>pr2-H~XK`UnqLXVPm<8Xl=*O>k^X*+#ZX z(n@*-Wetf%5()|?6s`K)kdR5ZV8K3;;*g7|^mKr_(rhxz0W4GM31mx?aRm$Jbxk(m z_A8SI{{!U8=iByCkkK29#cOAN(;4{G+&Jz2nI!c}$_lwT{@O{JHPW^WnNpIbWZ|kA z`{#t{-8O1+hj5uuKrI(!5lFp?K*9?xe%6a zCcy}0D4*icSA{0sZDBXqdh7)CIxvv4DAQ$E2giTm57A(0GZ|uMPoD2RlJ9;;@eyS? zH$SNP-nw+U61F(Zh zzk_-kB&Ej`{==D0yogPunnM18rSq8N>0^ty@pz8d`61wyCK%f=iprQHPHweg_ZmJ3 zM`Y3T9i2Vw6Stw`r0Vk9{+I#OKA|MPAuj>gx0H1B*dL+2?#L^YArq!Ts-mNU7USX~ zzOiOJ%YE6O!kRO#5|t!dKeCO*`*^d5tLtGiLx5c~eU&CuV%uw&ZZ48Xu4vflP?6Sq z3zk;qFizo5vuw})zp?k4kzIlH3q$yrLVmngH?b?H=`8_Q7%{vz+JCm}unmAxG-$tZ zLgolNJa?2n=|8VgS&fZPS&y;<1ao`Aee6dtfv`0L8@OFxUwvFsJHRKFHcyUPlfLj- zkCQaPt=-FaffjnvAj06jc1HHFuT1eL(&lZ73d3*mWp)_+yUww3|1DoP=*DD2(|Ii_ ztAgQ>cnt)Dt^U%k2Uov8NmbQGpiF3%=?;hzX3t8rG1T>aeDSQRcgv*Yon!?dQ_PT` zLni5)WkbCu?rzJ=hGD5V{pyTmZqzlT7k4NSk+kG-UkkCAERf}PX%PW>DP(V1ELLc& zLgT{$?a_YB7YAWq?EjFgRFv;y7SR7)DaP?QPx#ivh8lX{spR-SG9ZSA0C2@WoS9FC zNBvkBeqk%a+En&wN`3PigIoMDvAJ8;_PIxG&b@e9!ccwp!`UUj@aUh^Y7mNOm{b#LZsus06L(G%Xv!3Roz*h;tZ z-XZO|M+v#>#~;H3(|`4fW!6E?Lzmm%$iE^{LMrwsf|9}2ymHgPHJWv6E^72(c@@+< z@Vle9rCzVotnAp1OfPeBeC>*Hbraoa`rm?Bw`=i#;aQ$mF@GoE{mDo=h*F-?uBK@OAsQ%_kZ zW&1T14(1#+N;9tNwa}`7RJ;2;7Q108L2g)+-}Qiw=X_PX`3mPB@i;m$NM$xC462tS zWAcNOL#rjlr?NnUka77zBr;VIz@+Zx%q8~yueu#Q9zk2y*Lk8?P<}}_W7gWoY7&A_ zV{UMk(a!ZO7z1vF>?qov^KcngECPpNn)cFCM30qVO%v^$l2Sb8Rs56E#3J|nd|k z4?KFOE80ZOzKjP_8Y2mVif2(u((Ae)oZIqH78(qlt?PVQaIE%&`L5-uGk7uerOJr_ zn~au|QGU~yfbXi8kI37T5x>=LSB&_*gv9~C53;BO*+C87@NasM5v!|+0C>vyL6RS`8+5R z3`MkKL97`YXUPn+)QA?_r_~feAK@Z0uxthK?k9WAB&h;XfQYe|enO+(WvaWtr>!tb zEP4~86r3nYJew0^d^%=(krkC-06YPOt#4rU%}lX{T!eR6;X0WYSXjf+&})33``*Ag z{2qoz@EL(LGf9PkVrF(sv#UsHkvzm@cwvlGlN4sW&9k+4CC)2OwqQzMqZZ56D}LMc z08x(z@msFJOlml>$vLwB=x*6^0`g@MJO$nz9~v9`832bM>Vc>TJaO(?*1cgrD(jVJ zKL}om_)Aasy(iQ$+cWx{+EK}5=)ugc^8@n*uzaYmOqxf5vlw!Ed z!O)JjInjxVJ<1!X61IEHX6VJIy}zRJfAA{w#hY7#Dl=es3Ej}7X;viox_QvExtma+ z;I2H;27?}vjNdHg_>RH7wK@sIeyVQ2APngFM_l-(A6-j&&!Eh+F=PM-XQ&Eb&Tw4B zM*mfLJH@9%3wj036$MDu!I!$QjjD%eA{bMYuWB#gi_7^Rp`1`yLAKJ-Wub$AFGPO; z5FMZ7GN2R!@ID=zU5I?{0lB`fQU@6WK2nL=NQ7uVFIM|N)u-+Ctm^di)C&q`cGiYt zt<6E;j138a(D<~04aclPLFRv206gCQ?lhyLY)txeHc*bma*gTRKRvtHUfq`eY5&-BxmEkmvpg0<`UudPt>XT^XzOnO0e`ds2%79V zt!KA02-)(ihFos^{B3`Pyb| zJNH@kLQ+!{5PlfGYQ}A0%eX~LcPahz%}PXjl14kPNGED$M&y!NHRC={n)*XZ{wiF! z7P=MEJ*oeN0-}L+0c$wEATtR)WOxvNFwh;>3SBB1OLjqP)QpPv0o+^jgLT32m08|v zVx(OE_Iwo+JLzG0omg$7(6YdSFI|lYoROp9pfZIj(l2UxPHDGM3N>k$a?u(rA`R#7 zb*CW>MNdERZu@4488ATI6k%5ozWyX|e`X?|rxiGISWS(iY-JDEHjc|Yg)F7Jb(C|qi_=Zo_3 z-&&{#Zr;bc<;%?ieRjaC1`B^hXarm6$*ZO7+GLa@&kef?G^hXusgx2vwFE2?B;Rb{z-#G7 ze|t)|Cy%ZH7Uz*n=yf0SEmy@>JG}Vwd7np6!dLE3Z%T6gf3oUE7lp9qIJYZLib!V! z#H&y}(N2q)d=t$n^rp3V+J`UsMj?Y{f81Fe;0!-ZKr-`5UGqvUZ4OaE=Y?Sm5IxD# zMJU&=FP;Q{?F^bZGO48qF6pKq`o~!C4r|i#-xSyHy>OwOT_yiS#_eaSq+2XM-M+}a{kim-YTN0>45ycx zByRh5aPoA`u=+3=?}!1Vt-#Za@tw?o?|2Pdr0K?DNBCRM1S%TYS}a5weM6ig!vYd_ zCuP!Yaf6&i4b6ML=%&%5?jmntJNdecA$VHuuD{2IR&%ow&fGn9faEd#Bp3(ZP_VBe zDazfWqg6ab77GD#1P;G&zBq~S|L}xY5pNJy0A{(ceU|m9n0s)JiAZey(e3@>qBhab z`eb3aEX*}flES~K^oc8%kJ2a-6*wOxEtVpXjg|C~Lp$L$l#ZQa&eQyR^Sr`lH%|aO z{S`Om~<5 zn+u18Eq(XsuS}^z}q+HuG;&+jg{p;ELZ*K%lzY zjl(j#K6zxh)_kNEpTIcVz|^;vfCx7N=I#P+cxZ(=y83*&qNtT#n9R5LiVp22oMq;;A&UJEr zxtl1*)ECj`L-}NEN0=uhZ2C-Geg>U5Sk#T847aBk7XQwwx>%o{xR-67q|6g8`{g5T z)A~y%ggQnp8u@`ou$-10ntgc-lY_f-v>wV-XmNP>E@H2QWZgzNGB&G{D=>Fsd*r>f zJLP3Xe@rd!1w8J3|?* zaw3@}7 zV!odX9!?94TrRtmX)M0ad83V3Of#p%R(wS!kodvEI;kp`6`^_!qpz^VDNTPt44^pV zFzCx?_{QUMerAi9AbOt^ZtTrw zS#NYkbA4dM2 zCl~27$*a?fk?@?$6yYVzvuT}>&XyY3(h4@STO!kMG02VA{n71TrUB!xd_A%OoIsLE zLGs=84Jv@CLsF-pyoqR>VP2-PBQRb)Byd^un*(*&AS(2J}-oP#8Y zE%Xb&5F%>0+VPEtmSBgA_vYJ))k+bLDbC52WgOi!k2r&MqH)ZSS9o)(COtER2fEnE zUnQM?PE1y?W;*nA?C7#W`bk?`M2WJ@_?!Y$(aa8e4HHa1K)M9bLH@+%(I>Aiuw(;u z#gAu?kQNHyPD?t*1#il%nFpJ>MK~s;*QzZxbgcKhA)~{bm@6vMw&nJAOSj)JG~4b@ zTWz-FDx1n3z|_+3`#|2BxmaUc1Igu%tMz4cBlGH&|DF~`Cn4-cTF)p*2H&NLjU9RU z-$~~BT0mgyd*Vhb3B_n0p_l^jp76OM$I>&V$V28CgGum~J2&|Z&8`BWCuVd-m8Mc- z%hQp>iue_e^-YROK`q$PD1&Pa>c0Rh#sP&1OfAFlbl()o5M-HhQ!bh zcOqYljda&_b_r#dC$-8AS%y9SOt13v7N|(l<^-Y>{fu8Hh0*&WfYsvgEew#RP(RhO zXpv5Ys%KWUe5rELW=V^G`7q6Bh}?Dsq?Azg_VGq}+>yKrdEcODi9|HeE= zpXmHWCxSEK8P^6GH>8v9vg_6PfgaFT?22_aYV-*;Q3`aLs!760F9NpQI(;gyMLI(} zqVZ$0>fYabzRxxi`0qGocukm?UAt8umFUmn8xd-V1ucS?#b;3yjv4N%L%bZa; zDOQ$Yky4PnIMbw8=L*V*T$zRbbi>`jXFGPc2{ZGf-LgZ(q$y4@zMU`yqYRKd3Hq4i z%4|N)4|V%VYzg-@bC<}m%jbJ^ua8|sqlhB!G3g&xS>{2W;p@WH^su{7ye! zn%^&~+Re{MU>gp;hkkEAv~Rt>|8tz~zD~mR*As%xLfhW`oi3C?jGLz!OoM);gNVJF)Z^2#Jm_SQ zf_4CJK#sX9q&e(xBCY-*6gwT@j)z^>9imTo4r(5E`xn}G_T+|rtGPb)LE?1ufgv=6 zIpx$u6oOuHga^rBn5&*V=+wG^eImhoIiZmqVJOP7%Mh$(Nm9I3K$VQ~J|wi;J?B!r z`2aMLugUj2?8%bW<#6WlKV*ERH3r+c^wG^q^89Jvs9^B;uSdH;k~roruiwaAc7`pn}-VUkw7$F*I z&bLJRdKUVOu*UzloAb4cbaIXigEReH6ZauVtds0I0P}_4QI&#ZI3TW!}*p*yu$hVPX9;KaBJ9z)q1Ln4y7j&Uvx& z2Gmg(G6jRa>)AZ=IlRFmdC#a?M$Q1QJEn%$G-)#-I_NrCw8)a$cjlJ+Ru+T*00I6(LX(9J&q95v^J2^CWotrJ)X$qGyWOf zOFe=FV4tL=mYk`a$q{!dcoI(BOl|?sJ7#5)mWdAJbm4HeC)~?QP*a|( z+Tw582pWI0^rL9L*&`LRTMX}`X&5*^-DVbq5i@rsEEpNon}c=`Bq3wszA_>5c?V=p zsTc~z-^_nvc@cG|fNY!UT@J_5anb-C!Juz#xOt@-Zqb83P2U^!tbi`5&F#TPop55t zu&;q_rXN3!k`(q2Ep}~p`WexLAWIKvc)GG?=}#G!8o(?bm?hYfPf19jc(`X1);ISwLE|3JqJ zqTo+9STkZZ&a9-t29IOKO6&0shX7*YuV=!GwZ^=$;P3r{l*9As&H8m@`%+@GDOi`c z@}X?g`qOOqPYaW``MV^#!%pUZZ)mgx!C2M#b=<~lV4Xsy^p;&;G_Fh}1qTPRS^yXM zc+J!_;}x-RThMNduWC?a_c(1&-ES|mFrOIEBRmaf1yEnRdU?jN^&=jt8hxdc8LoI- zb^i2eA0Mrr&o3(RSSb?pFF8iti4s}41!1C9aE#lru}@E7S$@StjBuf;)Dvu=79n(( zmjcTU+>hh)GbyiM8mSp0Op2yR2LApb?AL;{fYZ0RHX}^Q^Y{^{O4U$ZaLyr6gw)3p z?)!WV_H_<*H)6ZX@KT!d#O;{x#i`UwTJy|K6BK6Pu8M4Uspj|SI@x^PxMflZXm1in zQMrP;pMUMVupI?yLSA(c=bvawR1ic4;dquO84KeiJ{;!!|5dZi>~+6&56uShcAe%# zRF6<$l|_N7KZXRmw4}_zx#x{%QhaObJlC@=#nMxugCUNbd{69DEM~^;&TpXQds9)B z#bk77aFuDxnOi0-hC!rFzq60g{TjnMta=rL|90Ji{`N$l;}_gVj6ynl+ZfgIcb|QL zAaZol9XEM8WaYyEf!C4TqGAsM-xEAP6NTW2Ul2mSfd)dR#|9|5-Nk1)S~2q`NBCpL-e&__PG zTp)b#`u5%EVv%x-K9%$H2?oL94LtV5tDGeE%r zCUyD5_s;^*rhzHtI38J9~a z&gw9V476SM>Xn_HmdIWlL!|=uxV`jStK|lJu^kp}Ih$&*h8*R{iW!heufyHAIh$LH zsp`S|q9I~$kG~n~ZW5jh`atFncoByJS3L=4cPLpukr(VNCOga!1Mc;>W-WiLxGLQR z_`jbM5QfS*cBE|keNn25Kc^|Zqr)H}%>^u-z8igQ6F1nrAauVSGT+_I)E?G+9f7j* z?g;{X>W<@tUa=$_fpXIZy@3kn&v5~tm`H@vI$jHU&%s9BshLyH<3j!!N&)-Usau}p z0nhYWZ0%&er>=SX3my(Z-SF(;&x6Ordka0CVSz#&Sw&K44m}U5{%$i*t4*7?b3&fX zLeCdz?O#sQ9iLNm*YsL>ik$p|#Qqn=836+wI{t3t#9!f8je7#bJ07+2&({H;>})gL zncF?~fPj0;JWJ_HN8hTB=r8lZ7mmu+*YbFL;A8(7qNM6%kUKYtIq@GP?&Ay&S2|0k ztO>QaFGMYaZru8K+w^<2Ja9%9k)85tIh8oII7>K);GUqGckrzl2A^{*x5Ac2wWh|% zIu9I|5>tJg7*nh9!$0Vaz5oSlVagW#U#!BK@zo;E^Re4lxT4e=m6jj;!2|AL#P2u) zQ#lloVqGRFtA;b7D&Boj@l_`D&>dgalDX~CeQVf3HAAN7I1o>kanno9A0M%S&gDko zRoe=g7x2@}*2+AoolO;#;;^Cy^gIeiVwZTYum1SEmFa0QxC1LHawp;L zkYP}}{e(P}AgffL=B+o=nTo_KA0Y2m!2A%@WAc zDVs8Xz0dHyoG{ugjIK5R>^wc#A}ypGAkFU@#;%tGlegy`J6-8NVPQ3;T=oA9c--Rq zTU*8d^xsjsPIwShquZ9sK) z?Ar13R$V7CYywBN%Q(MmiEliA_VctAkXmPhH#kv@CxgaAfC^9efFVDPo~bA7%I^y- zQIy%yZ$bk@LdBiJBsdmMEz!yHG7A*46&UN_J4CxuH~`)W3lEk8p&5m$A6(ga;*OpKV;q?9B0=~sv#&*Crc!AF2*NL^)DM#luDWO55zizBOcQART zr+oe?GaoOE?-NM?;oc=XguHPEd29XW z5E=Kf7bUWQv;(NJXv6`E&#?9qNw zSba$%&fUbh=!s^iDjPoap&q;XT06QynH6VR6ykPjMNIE#qPCChuA-uKhCN-sX-!C^ z#(8`bTLz4qcfX~=Z8Yjo)ZOH`$A+MlxNghw|4B<2`3gh|YglHNgj$LiBg& zT2`HE@jpmD8jDXWq*xuc(hyi(mkEq&Q5zWXK8J2*{y+eE z7nf*%<|*DB1w4G0#kYxSD^{GDWZHU7m8(}lQfK|4Amc+A2Ee~-383a?5IV>I(~&F&u5X;Py)uUE;N44lDw{6Bbn^SG3~y%<{sUs;KLMp&z3*0|Vv zGaTE(pf=5AOZZzXnTS0X4*6dmnD1utdhq{@vs`#?6Z`)<_P>WUdcPH5@rh9S`z*lcE%G^v2&<-ye0pHP!qb%VoKG=>7=(s7`n2y*#{D=X-l~>m>Qi zdv{Dpt4MZx#$G`RCa!SZ$xi0g)Ux${WKVf z%TS#4H)xx+Gr1*~;MkBgkJ0Fj?9K5R*0JrKA1ht(pO;&@ZEZ)qn%3k&ET6wHS&h_b z8oC0-dAgj!d)lwTt(8-xIZe;(6na7>eh$&AY{T21-(m=-pZ#46{ti`j(+#dmcHeUr z_A}Cy?Q|T)G{VJoQ}4cDJq-Ua=p_3+w@UxQD{NQZEI(T1NM9@|+Vi(~u7#?|PR+6X zMQv#12JK7717BbWFO!|@2+L_0J&5LalQ+`jiLT_bZ(4uQ#P4>ON{F>K zw5h8abcZTV$9z;Tbtq9E3UOx#@}eSSH6W5Pu#WQ))nE!dncK+2N2Z?BUQ!?^#YB6=GAyg z8i&(_o~Vt>JPWAd2-zkESM(>h13tl!G|{9F`>FeJWF6v15#HYarv;et-F0yI7}(yy z!xVfvRhp~ACasNSWZp6Q`sd+w+xQiY>~Bi=b#)ma*LOs-2J2oC6c==(p%`p>cJAbg z%K0<7WcN!lUo|??9(7!_w$@OA$r7}af3eB+&EE9=#^@6wuFfmL-s1~OtLL2Y{nY3k z6#qWW_58g30ei{t7HF4JxA{r)^{KaVyK;Qwc{1X`##*gBo{LeZ$i+UI+f9n2GZ9YI z7Hvti-JjXz{(1kjJ@C(6>864a>hmO+%fvigNV^L+>V;NO^?T1>>8v6#EKRYIu6@EF zZIsrS_3J0@51^Rcw&6khah1NWa{@(0!J-VYs8Sih9waxhUME}%rnHUT#Ep1ce|Pz_ z_gcK+$>Iv+cR0mf-18!qdTQ#_)hY&bs0MtS5AKGW4FuHa$m>1y!xA_BM<0qeBa@3+ z(}P0gD(Z^HDNkp5-!sr=q@|#R)kYWa(l2U0NX|JD4n4b9{q6)#!gWTN8Mw=r&7;1j zTv6WkY8uZE*CJ}-H`SssRK6qbWYb3*>28dnCTOzw4Z4lV zy2`XN& z+Z$kpJcInt&Xvm}-^1aQ3ld$%=ni+^vh&3G$~6YD0-eszH$m-6FWP+9m& z#&do^-P@f(n^RKtgb9t+L!mXF`3<0QT~s`N`Ix!+X}>#2TJa;g@n!q#R%>$mk!E80 zizdzB4UVb9Au7+-KfICY9g(Pda=+v2b>kjmFKku~8Vca{vt?mnX?U9N%48cznZ4m2 zQMcWmTU(3thfh|U%+8E!KKtD`Z;mnM~=HSP40=5~)zsKkVqmU6&uleafpM|6=b zE6(>q^5XNddX013dg7SOS#AGKHPHP@VDRL^^<}4-`o?kFhd>spm!+sE>9IV|QQ(GK zAo|G3bH?EjX{70C+T`F+?C;9~lY{@cdFTB-+ux^NJf_YwGK-kYgBSav81+*u-E>I% zhHHus3Y-b7A1K&D(PwyMNUmd{o1nWG{_H|sUI)f=CzalbFy_jr`@@JIhvU69aYQM} z2@vfoP@1)eW%o{2;bWF(M&Jd>hD=GUqDaN4kM3d?I%8!}&4s#|+?r9VurzK7kGv3D ztWHz*c?T(21=Jv^OsSVE6doY1_Dun+Kd?@ID>Vo0lf2YnP~n5?H2h%?U;NzoToB4N3~z-`9S#knYz2aKk}|GwxCp)-o-o zRdMMM9Ej=VWJZ=t#|~;oAeh8hb}#%YhHrWHS(-p+Br$4(!|w{@o+g)UOg&zsh1X1t zh$GSUN%wZ=IMD=pCU9bot+#P;rhi^xzkS-rHw+7;;n^Sp9gmZ1(rXyi03BcKqp)Ub z#dj&u-ip)@h0gU7y^>gfZi|%_G#e)>FEMZ4t4@oc4bksC4A-uS0eow^lcQ&4xPJe1 z&X~Jl{ldXmhAnDaF{J!UJEwlI7?!gT721CdG+p@tPp+fm7wb(_vIOfENdI(a{lcDB zCu=0GdJ6LSR&gqWT8&y)_qDQ_;ZL%@X6!pE>g)iqTKUfqSmyi zv(ucu=Pk=|7qQCW@ZSiss9tUTugHAC$<`h}>KVeyU$NI?N?+vL6_>?i=8{NVAhXin z)1Tu%1s}J2dINm6OZ4w<9X>DEj7;xRQ4Rl`BMH8yp?*COrUg~qm0;(ZJbkZvS)QfA zm>>!EeRw2pbfBXDx7BeDfk3S{IU4|csi%(NZYPk zcX!mWZCf4NwmP|GdUiCu`hGb6r!~=i7V5!5((GwkNmy zT{NxNiE>5Tg9@Y*9{}?0z*W;I5k)=GKgauZeB3jhk@GWWo%f)yfpcKxsx8$TlKZZm z{#NxV&}(;)?HA)t_ob{^q}xr;=*#FZBcE0;KAa}7P2w}!^(X&GqiteCso~_Kt()f;Uh}=PS)rne0&COczT0Jq&7J9MaFL-EcY^GDz_v zDkRwiux_&UjCc#FML<2nAQu+Y6E@!}A}rPED$jC^y6{Ny*g-4Exwn(`?!Tswz1pkC2z@phT$^EN~28(ktkA7C(7_ z@qqW;MxkdX;n&5@@w`RQ)(%OAHrYke1;NJN+1B5QyZdPIVZFXItpc2!Q97If)U#My z`O!xO$cH^Y8FMbku=Fp@g%8imVQdIZTOc&cPrJ-B`i?Y_)SXGjBir0y$$CK-nX`UV z_D`cM>+E@K8RF?WayxXPxiy+8E`x9?LCI?RAbvrePGgBTbal*c9eGx+*;W0mgn@$t zWEB<`20E;z@)tLEE`&#!95hIPLXGPLn~9sw1OWo&GiJRWj_2Bg;^P%2tcR;EQ_6;g z$u@FtEe;Y3TTg8f(-Ye8Rh%k=(R2!LBq0bFg!8(!_(k);G0t=2hXj(KtYi&^Ni1G& zi^b`3M~|o%tro-D47^g1IZxHI!k9Hji_aAXBr%=RG9u*-gcEkvQuk-Z5UktVbR1WG z2c6e;9G7M1p<6K}qMT+9R(5=8OLG=Q2=6W_Vqgf%SAc*fi0_Z+cXsZQp0vtSPiFso z1&UNcTcJ!m=u43@RXygA8CDF;V2z7NU*&wYJM(#=LWH-+*ROWxFtByWy!!8+YFH{2 zxthpdLa1i8_wRrH{1VpDcXwlMVpFVhmzxR|#okMHfV?wtVAeAOMcO|P2~3U1XUvtP zUB?je7u;?|tN5!|1deN+BLxE^l>fWfi&%Poz!&O*%aHxubHcR9Hq1Mf?dp7uukAhP zLd;@{<(>$C{BC;P+v5hl4E7T<4SkGDL^@_K!&uih*u9Y!EcGS459%yQEfpd8o2$eP z8lDu{-tMq{m5sw+_Qjpi{CUJ}hv7fljym+(m~tE`@$nk`jIzl= zzYWjSS~Jdeb@kiecQVm+12O+)pwQI>rt75>kEtG$Xh8_&h5uWVYT^CCx26 z&ncD)ePc$P>;s-YR9n^-^UjH_IIrANw{A=JG=kW%%aE=C^q54~y!W)iny|0KD)v1) zu}p}juISZI;+Q8da z(=2=NV#U)mmYV5()>2Vc;1xoMi=cisfk8=saa;)>9=lx}myaF9wb!xCgVXbF0;ed= zMvGNpuWwxA49^Dk6{WrnXHNL@#mxiamE_2v(+AeA+HW$vJdZ#YH+O}%E%mTbEztc+{uboieB7$YZW z4oOnqDpeBizL%}KoldJPQNc%o`DHB(kATiATfhH|h_-M1CpOw7hxt7-*IdL!_c_er zWKN&=yY>6X(x?;~+kF6Q9MtAwA+3?OTNXrr_!xJc+X?hem98HYmj-3W*7akgi$RM@ z@E_s`9XfWTQxi*zD%3d__g)VBW)a?i(xuQw5WS2c_SgYqR-hK13G>pCi*pd6hHz`J zc^^eab28*ndz5@FPi$l>0xF6r=seZ%FPbdd@clGUdJU4Zu*5$a?D&*fu?uuoiGW6g zUw-8pmyCL-QOsigu#c;Eg-cv+XNNy|A5u`YdKw}V20Cz6c%SjHUjU!uh|c+PxJ`uu>l5R8#zWTDv`6UyA^9^*~xj`FVk zP_mf7eYsxW`%7m#4hZa>i4|@M(%|F*7!ckx7Is-`p->o>^|XFbNL+{ymF{BNKRm+E z?XZm`1m82p_hUgz3@k^}Gnn=xO%(rej`n6dup{_m-r(UZU%TRdQ9tUo7mVJ3rELiF zA5a9SkOYB%vpY;yHBs0OH}e6{wDe9SAxxbF0!L;zfX4J^UJag#m3ww5P^60-wvO2O z8s+hm>Ioz!JN@2^XDooWD@_8*C>U5Kc7`+&XVl`q)e00S;t4~~lx%{{8pBvZNt5xj z$Le)@KY>^yi{^>e-cM^FEn*OOgse%@8oWaK?|2YX$f`?62-d3|D&M!+5jj9p40o0yULs>cC*balF_&B<%>17+M0sHe+CmJT$ZegS(h>X6LYr520cEjqUAzlN02rq2a*HPqlkK{RSD{$L zg1PXk|0z9MwMzqC+Hu;H>n6THk8jQ_j8SRU04=j@PzY7f6POqKH?Ymbo?4!qgocc& z>K7YvT#%^T)=0ysEGBA~zrEhIJ}1WhQEN`LFc|OqR%#iUIaFsJAlo%k_R8qC;A)r2 zm4uzMla@`lB`$i0cPONrSgXBGm}J|GGvhYl(I3q^Oz)=|8g`PHEfSo7DIr)u!W$P!;zl zQA9Ae8PIcCGwd$g33bE$peMKPrHU7=T1&*%)%8Zj+y&!q0^FrE`snw`(R8MIs|_xZ zpr!&ksh^cmWew(D(ye9&bY( zz7fGfU?8|6V|%-CBLq1ARVhoLA#1erLzn=P(cD1bB-(>}yPT$zZ-%>`)G$q(j$xf| zLjD3BiAE*(YY&RYxR{(g{YIf8+f7RoP0p$cd8bgdn<2O`db1!>+$2kITB7VxLd<24 zS&itJoWBxv1kNgN+m|4US|H!qV*h=JxG2t&;8w8^@4Al^BIAt9yE6#XON#t47us)f z{{V(WLl&)NDlE$c^XF(l*p4JmO#4HX(#z+w?m)5Bq!U@;qBdz$0u(P2Dw6*gRXd45 zVo*k8_);Zw>b*Pz*1FPbe{At0WFDY_qPlmRaTmc8j+JvzS0Ob+d+sLb1%DVilK{eg zoHY((smavNLq|v3?K_!Zq+lEao3*QNKeqO$el*8uFp}N@c&XNMwK^h)?~}yU;|rnt z@{y|cxvBxMhz`Z`@T2#>=jwX+H$$VgcYazz|KLKT7nQG5+i1PPijNBWUGujRC32W% z0$T(T7(IDFND@a(VSJBP?TVYv^gWGsM^J0`q4lQctQ@=ZaJiQ6R;IhdqlG9qgj$aQ z*m15WUL+dbL4GKn!E?+O_tS}?)ka4k{MMa7P1l_yLfKMfmi?Rg=0{Ct`}1~go$oUq z96sk%%Cx39AjtWAh0*fKYWscrxxr)_i`8~}N=c4)99UDhuS{P9s#GdpW?Xv)Z*J^T z3_e#4W9|FF(B9dzm`QrAIhjk^ZE|pS8w>psz(aHEF&E zA%iKm;Ge4hkP>z~qfagjsg{~T@p%DPhPGz?U!buI+z<&%yhtEB41yBojiWi3fWdckkJ$mKrbuhSWXy$ukaBq+N+D z9_NV35J#CUH}FU0! zqcQ{gqHU^mjMXTCyUS>XSa4I@?Fpw?(S~;elg?t=d z_9-(Lv1}zewfOd37fhenA8RYt|+>8Wmi zCh6hnd3ttXq^IY1$<^X`azmKod8F=gxh+$!T%u7;MD(9H5QzJ<12R|TDoAaBgKcuq zVel1deVyQ2Yv={nip&DZ+VP)KcAE)8+H`F_-a%+yisil~IAz%1B{|AEC!^B1r)3Bn zVnw`(l>(F4;)m>w{UhI4p?|R)p=q1u1|Ws*&v_<5F|zncShSoWINk#E%l3k+_K6H- z4Ri5|x`o?G^)~#wVxd?Qi5?FO)*-X~>)Pa@iAmTEX4JF*7hCr)6Cm`red}8X(fW2} zBPu`#jtLbe?`Sx1>@zcEX?cGW4^7$hK;~>*6=}u5GU=up!L#$;;0~WIzeHE~w78E8 zrasz)p|mr7(WfqP^FxZ&2HR4h636q|;6U?88yxt5irS=BE6CF1&Wjj8+Ox7Np(1>V zK!Qnp@OUOd^<(us(t;=o?XOG7dmkmf1<_$tu{%39>=T2aFg-qYh-HJYI*UHHVJShZ z=8)}<9v&-UUSafHANw>-{Pn(5)7+_c^3(zEr6SKNX(Ins<~!&_~A=ryj7fPEH81P)raf zBLq~!8j-0h?Y@m2cM$8tG|gUb>_*s)D)Y{);SH>KAYJaz1NVPIF33Oia{=s6rCrCQ7pgtR?O1$KvNCXu`EluQte8;Ld@qo+-;)g^?vNvLF~!N3E-7wc5g_5Ds{Ed)U_i}nMwt~p081@ zG&{W)E@-8V4F zmzg`XCk<s14#pZ4dijEJ+>D z>w}f1R1qmnH$^{05tMZ1BVk4V5O$i<7}?WelPJayXD$*36GR^CvM`fLSS*9R1W^^R zYPVm{cs>+fs}{ph{U=DODu8jP;EmPEirQ7SDjk%r2gN&+D$-M2Ux3H)i+zn>6*P1* zC;+LdQePV|tB>U-QU-DD)2{~L%xp6Ox9IlSBy$0!i`%AXTH!eL@ zC&)47E{e6r`+Vu)p~+A>yRxPuMNy2tK#CH2^K0w+5BuC`6*MP@;rLS1?8)Ag%9i-_ zsEE%kPr)d$%!Z6eVG51<0I(0kpbyM@98t{SR z+}H@@Y*eH{;U9`c776=(s7NW*`20?$B5igkjir zR#8btsn9w%a1KkAA6v7?sI1stS~c?I-|0K`3C}Z*YU@F*+I?!E+%4J3vd#=qtfRrV zlQ{&RU_!M7n;s=tt#}Br^T|0|>zR(dea}0?Fi7 zMh>n=yz;rxp|SzD?Rm0*!i0xEXETNBDwV?(AqSPkIi+Dru>Z zEh7LM-q!H1TzqTQ86ncnud%Y9(Su*ojYoEZ!i#zc*!jO(E=e3N$&poC4DG`h#l`)R zK(hdg`cZPN(dVHEY%mXT37?|9GYHy?$O2&lqKcV4lpW{UKTxA^N7@g}0)z62qSDV* ziXku28*)_0Iw4ACH?bjg)>t4bQpkS0bKLS|)k~7-k&fo{2W{Z3jjvaSy6ubHyN?b# zp2EJ`q<^g;wwV(@rDr4jdsieC2)t`O(Sm`N_^ZT_LY&AHnm+TWiUy<8h>LQs(^oP347>SZ^t+IIS<@q+ zF7grZeX31)hGAOWEh&DkCdYAzGQ)9Deh@<$F@>^d#M%eYA7?QZsw+#Vo2P8E zKZyUzkjZLo;9?7ZFPk&zxqVOVn7C9lDe?s zW1_YzRk2(c*xdBKRbCq|l*o`s3;^?e{W4IsEXey*A8V|zg*I=!_Xr2kW5O1OA?nv` z40p-ZH)E~oe!o$B?C+Utyp~{0qqQiNu(;5iq0?;s{X_iT3J9<{7GctcjfiQE?d_ZU zx%XBH?0}Xk)xFLPOpZX00|IqmGEAn+n6qks$=}NY2-fzhN)JcWNbrpBx2X*46{m{d z^&0k>I3KI#h&q88TM(KYpQQ36`Auw==$~M6bl@ATiCUxF01z~(jF~NAn4)>y{@uC$?2|cO3K|$^k-*nUQm$XAwy(Np}97sJ0WkQ`bFL;r5d*+Yfh zmoF>sA3Im%sSn-0xm4}9H-A~PGs_|{b#I3#S+Bicq3-C7=oLX2$_gUe@|Sb{8NJ7k z^{Xsc4n_RHG?&ce`tD!~No9JWia9tIW0?SpK|kQdQJ+0JV51zPQ2_$q2NW zCE}b_5zUtSWTGYvoQLEGAs?_Vh@g}9+|s7@Lyncsq@Yx7HIGHo!PM0-kE(7f5I z%AtK~4N-Gf>VH}Q)7i(Ul|XIHLzBf5RR2#_^3g0B#XN(AXB(BV)> z?4ReeqgXHVSTR-6FDDg*0!5?Ul4foA8Lgsih=Kb(YY$Y`p=kg!E^U^q587NJ>?Ih|$s^NdTMY8}*G?|{{(D~vS2!xvzO1wd?DB)m)Oi2uZ~J$c=8OCtK-Jcm{k z4+SI_Y~<(`y^ek$Uok==hVCnVWZ^k!k!X8Jo_TRS{3`ey;IV2!e^cf z8zNuzfHI2?0Z0Z?Oc@HZL}idk!ZcX8N{iMq@2UDZLYrBoOk0*442GfpOQJx}iCv|@ z1yvZwonLSH9R zd!);=OlKsz*O)H!#f!_Zoc`Qi3lrGS>0S$;!5wo7MAE3S=5_-2g}U$S9?-@K!mD3hr(Kk?sBwT_BKW;W4kBZot6^CsX)uByZT@q*YQ0 z8(~~Ig7jT>ew{$Vxri~ncqWjB^o*jtl@C3}uFCvx@<^C@lQSpPqTI83+xF{y{6DbS zM+sXs3p9)~ z=dOt2w5G?GC}{iQuzCTy7RZH-W6{L#<9~;8h9dT#4qf6H`sE^~e`CxcB&)n<{^Mh>%*reRd?KXAlO>}6>Jzviwk<>9-{n={wY<+L< zfabQ_AJwdR+_7o{VF__Nz%PL`*=ZYM!4(Q67#`EX9lFIz*%)}%0?`pS09hIN_NgEy zw(JW0e6Q-d&r*q>V@Gz0uAb26oD*vm0b}`}M%9w6rlDKhfL|7WiY3uk;^slpG$7nL z`(B;yJYYIqRm$L?cG^9eo=s|y10}Q73{6@!ZMba-8#yJ}m*kbQ@UDahGFw6=r{Q-* z1sg2m@{ov4K0bYnqMnyML&fgzZM4W0! zkBan)NK&%2AV8yQyO5%5AF0MFXi*5oJ9WiX7bmQPLP~D+id`B&Jq7A#f@vj)p>%kn z&uvkYoXttc5_!9n*0ui9Flq&kl+5H;6>IlCn+rR z9*3nd9qoraHFVtd$}6p+{)Jo+uQ31e>=fUO4Ea6b!_vDGW4LL~)1FS;zvJlhU8*78 zc&%x+mkMSlf`sC<~-5;2r2x5NOcQ7e>+}KX6u?NDsB{%P4m?%Jfipd7dr3o9ffHHA9!>w%2Oh)~>SHJg~7Ax-aiaklt8I&SorOYWPcwhDxp~3?l|r0^tIJRD63m9Qvtj zS(dtv3}1KQ_uiyG#p9UgH;Vh6bV;*a_HJaecKskvH;^pKz2PVAdP`!zD#ZuLM7d*| z=*8q7v%OT3hs2&1*j?O&v9Q2!3_YVgkxF5|QOoy>72Z9YylvQ#$UC)5G+LAYZ4R9O zges$mSA({O`6ZW!Y&SwQgds5^;u_0}-!x|P|EFw$HXJvP^lG*Y`^3rxFX%082q6pn-~m66 zv(Q`SG0IrUf{)%h?B|R28D^x3lgFrZlpzQeh9$GFC@i9mQHTP=42B8V7k{fq?&j`o zx(Uu-{9uS95qE~Ege%+~Dh+@_Tg)X#UMJ&Fu_{m0%AbZ$2j8*F(J8a$B(ANSr{WLW zh=!gE_t@vQ5R&F4mY$wuCYtk?4hIqCx9rKF6i1N~zm~*Zp;O+Bc=OOgHOIhDgj4uK z9)u-jgu@gS^n^^A&KRaK0Y0&2VIFNCrYJec-5*~rgFJHkX_nq+Pr}6p9P-TZN*4d( z%xVrB6CM@f*0oEA?uWPPPq9;ze`KjWZTaVU4SIuE3sWHztGpU^n_KRe78Qfb@Di@{)MW44z8t0vDc8ms4y)ps2eNc`FHsVQ%iV_x7Es2reWdbvZ*q=@0s~ zW>GzHGWJ`7Cx3HWv|THQ?CQC7Y1@zn6Oe6q9!FLDa(OO&(oPV8AddWTX_qw<` z`d|i&B_%2pjb;xD5IE(n`%+?13i8dctdCg&>#1B zjWJXj-Q5rZ3$IRo%06p$uKpw!EDqAd%KN$5G zuZnLTQyoj@5rb$PY6_+Wm~&t&VK&@EgMlSDMgwD&yQs_JA zjN63KGWeHGWX42jfgn@cNi;;^+5hNnV@MLkuEVIw1TYg!n#;%fm!Jer##@r94SOpK z13RP?fFLf}Ho9XPr;fsY-91WuTw*@7k71%$v|l0HSeH4BO|)(25X7mwC8oF|L01i% zOh8irz8?_E_gG7UV3{Kx@iN4*vYS0U1D3HR$;YQya7kP%5Y92(rS!ODfppO_l*bW> zj8INE(@NuDAwYb+3I*~8Pa}93nNjk1t(pAx) zZa{0eM1{R}gFkS>jG$geByas~fxl2mD$?Yk~P?0&D z$6T(~xbF#f0Jtt}Kjv5E|Vpu43}lY6Lp#NhihI)bobQF#l2+B7xl?c4n9LM_cor780-u``rv2 zC5#4PoLGQ}%H4#Jc~FlNkr$vbc8f1YM?zY=4*WUo=;uc^l#eba_q4kr2x01q#}%*l zZH6Gs+BYBkm&F_QXb32zBMMm18mvpSe}E+KSysi8-7!~!l~GYcRc8ME;buV2|7TsS z*p|y$RAIj`5qt+8?W_zD2{bB>WY-~kjL-**OxZ}|gU261>N zqAEdx#%k{^vKJ>~zjjU{M>{MVR<2odO1y&wY$^kGbJ@wL~_k~ z1*(&z?FcwiEOJH0GEt0EQRY>NK&4vd67 zHEKgtJog9vd;;t2wwj#!#A5A2Aan z8zLI=-yZbNK;8MuUDzOPeodlY3$W||dBNr87avb(H=u5sEmW_T_qVd{sNER`=Bd$O z_|Fl&nz*hmU$|0D`&PJ0cPiK|kz;VCd6po~#mr0*u!FUF{_~L4WgqVUm>nuZ#$GH}vh1Yg zL1jfexYxu5W3@7_l9^R_arw+G;tTn45k|4)W7#7nDeX;9H1G;tLWv4( zwcQpkhVK)gQ9J8&kJxMrukHAN zvoZar3q0V)K@+$rNCaBl1Oc&d5}$6s%H27*ikHuOltpP51$=}fs`(Ux`xF+_oIS4S zbPE%w25ACsB${_yG{fO}gqCZ`qg<(N{GJzVDk&G3)%^jcz5m7FUQIb4YV#m2);&0u$Wi>cZ@}BA#^hb`UN?TE*B#h%ip0gWT%RV{Lm~m~- z(h#YS5jfoS(QKg2{ml)A-fE8{v8GG!#km0K;}#YH6w4^=FDNKFQI;o`^igje(%+n< zgcWR}hll84XNDNa7VORQ*sPjTH!Oi`RaTkfC?Kk$lahU8jg zamBe5^f@ZPgpr~w#5YDfdo%x43-c#3Cb%I_@HVx>=ZB>}+2v~@O!RAWxjntI45{IJ z!>E$l$FYC3kT~n5&AAe-vJ|K<{(0Q3bR=xC@x!58%)=^}Vvo=3#pLo=evyQnAr%nu zF7h7OKV;jJFE_*#J>RHzV2{)7jWX9E#-JmDq%#+qrlb(@trQBhi=y}Q8ID&t(UTfZ z=qP8_;=?x|JqouZ{`maB zD&2kpkWw{#x4>?`?M3IgZ#mF(W5|`_2c-VUO zMQhsLWN6gulRUKcn-=8u1EA>-l7=JK>hx(ThL)gah8HVXQs~qtiqUmP(oJ*5TdX%$ zdwuEUxNkwpr!$3Sr|{r#Ij4wYxd$X1(Qhn!pUyYE?zzT~iGd!Cp%{jzr&q;s^tU&I ze8zTVxn8_0PB9w5MT5>HhAp}qo5@0_2IN5O+4(t(xx+-nOJ6P%;2iln|x?P;($@Uu%cy zifXzKie{m!%WM~OD&V9DL@UrNA?6N9=YGNz%eO+FHpLfb%MQM&s^~sY)!DAF0?)p_ z{B}OF`2cLb@7_Qm4e^{0l9X)D=$Ib9&>&;?R=08`s+AaG`CsuW#bNo%#ZwDvK|tYQ zLP?b@$TXtatS3>~qtezZXnaiYqLwW?wIor13hY^*LqXnYKtYXUtzF-3H5h3G%#?lTID_LRc*zcS(D$jyZ2;=`VLx;=Pv{LeR0>W7)L;7uj} z)=oZ6*ucPCm;2?#O$P3tjK6HT$or%k{3aKQwjL`zD6(+pp(y z|7|fv_T($@zVtsQl9zes`t8eROj{q+S=C>6DqvD1j6;KdI8SQc8 zIQ}}SZfWs~)t?OK+`ax94wxOVqa#EY;kNq*`A>BM?{flTwbK=h&URU(QHzM`cmNgc zCY{986N5f>cz*!Rv1m^5S3WA50_Ag60Y!l(rEKL4_%{vClYgHs+|!lhw8z_zvq1Rs z<@4kz>h2bexo=l3{_@>|eujp=T<&xRw{F{k_};VmPIfq3asZ{&jVCsdH!U|BLv5#Z zmq4(#7*8;9L!pp{Co8c(Rw5mk~~^Q?Y;9@TiCN{=@(GQhN&d3I;c;4psfUU}=e ze*WwsZfLX^GKjVFgj~}iv(-VW)~O(TsCqvggLzabILKl00a%9d&r8 zDz2M(UXYqVo#DCH(pjyG8O8HROPQflPBJ_`GHu&C;wl%9Pe&f9x4pLc3uK_i?z|#L zSc?D@5+$S}sOfmH&u;=x7#}+C_ft|GsZrR2|JDQH^o^K}-;~N)!&HO~JvOS!DO;#= zae|6m7PztInJ485tNG(*t5NxV_w_-szRob&J00jGqN9lf8GcK%5J)xSFf1QxwE?zG zLZ>LHypcucjPn+C3Nq2zqypJ$eQ~jsO|1uQ$H%cZQ{Ap}e@fEZ*dw01-#Hz?gs$^# zc)wkJXWPsjF`De&DuSJ^cc!0xoanDTj+Y)%-&R{bNx{J@rgA&|5>4a|k8-yJc~^!; zj$7|jT6+Vd;ddrmE<4%ZyV&gYW?5UVugF&BhtG zl9y$@>!p7Mqw6ci_qlJEewR0%D9@oawdCO@H%%OzI#OW0OquddPGOQe{QI!SS$`w~ zY7z}*BueKr{JJ|`9FBr*OFJx?9gO^hRA)XpNpYgJo>#c^N{?cX!d*7%Z z&E|}E!*dVh1sjkMf_UOQsdLB25D9sTk#D$~554Y2DC$YW6%q?WOC-e29$Ur?6X#n_ zDv>Oq6i)zI#K9IzxgU!f3C#H!%9uMWKTT;fTe|q=U-Jx4$@hQ z^ucM~ZZy6ECBSMr`SXSp?vqWK7X$zUFzCfgjE>^SA`#9{405%cTWtS=)wOA{CTyck zNJsEku9_p6K`ei(HO34g#t#gMdTqrthgzaiNQkQ?E0aW3e4p%H;Rk`m0cpTOinNVX zAn!!^5xC40w!gORII`M7?(k9rjad?BU++S_%=;VWEo16Jw?&+-DI<034{4tFu1FlaG)r7vA{-$@1QQ&2m{U=l0l{bvHl88r}h6~jr4sm4QMX1U_bawTe6l)YXLJGwt!YM1LR)!%>(_WlPn}$Rre{ zi%#%QjL(;?!yJp2C$UTAa%FKw#WXc8)$5FI715@3e-KTjb498*mJ$=uXxSkxm`?3h zHO>&}j@=I>$}!|uMxs)uGFdEA)OfFSvafpkInUMmJ_GnO*9u>p#l=uE!9K)4^~uvo3sVv+kfM^mQh?-rHh zm>iF2fc_ISCbJyz&~zPsrn%lBK&t5hAd=nyNb6zwSEHPwZjtA|g5HoG7K$|j*_aR* z*y(DwvgO)U?K?lO#=w zP)L^(v-T9EwQHemKJN7ODVxgsV>x=H_;kHKvb^^UDP@L87MK+D4v)&U3fu}ti!_yrX8M5}(TQNo^R1q&?vl|^_#i>JoHl?v_rblDn z{@K`Z}|vXmb8j4^7AUJ?(@-8|eM{F`WAWo2u>1L2t7$^5xB?&S1;=LzL^R z!aa5`tc-x|Zlemu&WtCS)-^xzCx9XjCV5-}H-0r^NRyJHoXCC!i6RP|93vYx3+c}& zm2jL`R)i|7zM$^pmvQ9{U$rB~QUGHqgIY(j*5bZO+fSX>i$H>>ga6<;5YwqGHcfsZ=JCe}aR1dgrc|@he$E50|7d7K%BJoGn$Wl-gDY`~ z26V3M_)#+7*F1NH;(zXf+jN{lc-;`=7v!OsL7NSg&rv)7kiZ`%lhZ5s>D66Z+FZcW zp4I;ssS2zZwg5I9S18|&s9+>c;@slX+mbIO?ELMUq4UdpfyzS@$^VI(d1u;*rNc-uvR)k|88 zCYLM8^_4&xj>PN(x#eUsiqZ$U9EM`i`e%>}_H=|$e?TOHNu^Tl{{cw9#`B|V8LQ44 zH{uxCZajjK`(MT$>hferVt`=nn%u1k==bOP*VoUkdtBAIML=WykvP&30cA~ejR9oz z=;tP>>}vNt=~dUGjt96)V{cLW!2sL)EaC5vJ%N+_`lcr<_ziWwhLS@hzTSP)3zfpQ zr%T&H3~Cg#Pyu|A9<7bp@AW;)U1!M50usO_z8e?5$GhZHm1oRnu)P;xaOLK4);n0v z_f;0|FODKN)SAq~-ak{rn60g44soQN6r$3&D*s1YtgOmO2kNl%x9AvQv=|Q=93O1A zPyT*}zzPCY6-b2qAw3o8Bre3#BZCDN;gL5hn=ubCOQP$q3Q%MfiOSi8zgMFuCHog? z8kU&-!3lGQB-vB~eoym;>g=X)oZ)T@YpHjAhS>8mU^Q;D@2`MfpJYwjH^yUax1Z2Q zQ^!q8vIgVhk!HAC{e68uaHl!`nAiUsENr58RRhJY;p?D$;dR#YWk~MMTunnGBvk(d@OjiBAm7+kf%W7&|hD? z5N0y}I6yqcQ&xgT&eXu*O%FOMyHZLZ!qC0CskpLEGmW6nN068oZ8REJ9EmqilGnp(R)F^}EqoLW?hlAWKmkjD)i*P1i<+nDA zxD80HA&jc_tBVDrJh-yaYNI6=)+hwui$Kp!y6xRRDNlC$?Zvr?8lN*wdNw@8q;R#S zNW$oT(zx2Yi;iQ=1&(yfZF@-F*Q;t67&0ej2|M*FZ0hq3lqiBeq&GJy2Ha^DHb&ns zEjX*QehvTCOt6Wti7n!-YS@PN4RAyZX*K61(vNXx>X-Fiui)$L#>CjKrBJtrFNjr} zk(=9C?S8f%NA%h5MUd&>!7(!&5fmaJ6ilmPL0t|Jz!>&+7mh6|1f?{eJzXO?x?1lZ zSj#n5&OQA7&BDY@` z;pu37(n1bWgzmqpA-cH#A5HJTSXbM1jkZZ++qP}nM&mTLoyOd;ZS2@~8k>!6JB@Yr z{k-S<3F}(ZbIdW+-XdC@gD_*%Xa~gzWQmG-J>iBntSmW((crqk9hUlmOFszDhEZyr zFxfR}t|O^oTrla4r-LW}7_K8)|0%5JHgLnr-p(ocWCwoI4z*~KRzL55y~yDA7g9t8 zgTSS~EE{0;n()>RjabzVt?XpYZ}z{IAU6suPJf?Sh@XsNR_kr%ZRRsHT&+*eJR_5p-0@@lA8AS=O8^%Jd$?{sKs{1r~Uc>hFht&(A zG0%_jU(NZ|zY>$@7$E#^wIXED)-t$j(#U0ecO+-P8=3hFDT=?&OSGk;1eUr}6pGmU zo-Z*Be~78TB$YF4$R)phVH~=PxH7gM(Fw;OZFo|{rH>f`Yf=S%gDp&Ztw^h^@)`8! z$iUf5s82%ynkt-beiCUT4q0e41<9aMF@2?W*bU!QQ&{-yMxE&Eb zMInNnuteU5G>8LaLn6??1Rug;5Pxr~+*8kx&19bClSUU|%xmV4l05J{D;mSGT8zgv zb^LZ%!F>!uO{HXsKx6n7m5LCzAqKCk}I}UrlM(cR71HIhHiochl#RZu|JL^ikNf%t|ihi_7SU zzGE+hYRLiVwZXP?fVbhoEfs;NeHzm5gImyAx{QJI4aY|>yt)!jUrQu&E7}>HTjuuC z99psHTaQ#u<1cxLOTrONKY8`+Z}vfXlFJhIacyiINhP-9wS9-y%N2hSEj~;cYm=!m z+QC4wWd*r2h2r5d#R#iu3G;&G)kTjUmxiM!q$gGWb=1EC?vjLpF5^&+;Whc1Fs}XR z{CYWdvPo2li<8w8`jgq_s*|L}MhOYiLuL-m#oz9bJ_7OVa z=s9LA&_D`8W#&d5Y<*RMh)*kn_e(4DB9YCBCOv*TqrJsp#9%!mnXyujz81PToF*vZ zYdh=kV71>9-{S_AJ53Rz(Rrv)3Je5(MExO!&A$Bi$8qL;{SwhzV-q(rQ&;n+%6>Uh~PQLRNpA}9-6mQ9{T;D5CSil0{H*XT(@U3HF z*6!%R3|`{m2hY2G)kkSqj=aX3?MFTCtNe%eSzgJ&vdCpXZ1%s{jp^MHf%U5nJ2)a- z_ihdVC=E$Lm#KRt9h3mxgI-QPHZ3jctE=U+eZbm}3~#C(e1o+ck65hcpJyedow!#Y z;3m~^3WX1cjYn#Wlaup(5sU5U^_tR&?7K3EHtJ&3G;>AO1Sy+EoLHQl+?1eEkbx+t z{Z5dDk0==u#8aPwGlwU(w5V{VM)zygf}*AxageJYc4E!2MOip(g- zCbSwuRxxd)mS+~3%$#1_wvulbsVFuhbW9DirNLNld2Y#yOC`F>v%U96q>q|bMwX+g zgSmXx6rM&@TevCMxqks-;`xB6Cr03Dd+gZ%7InYW&4`Skcxu)dp0r=MUAzXE6t(Td zaa^B+^fgoKBHc9Oj1x>O&M5(K+MAV$TteYNkil&s6HNT84_?a?OSbB}x)@13FOSaz zx=JD+Q;aTOVx=qmL)!=VRkhPZsu5HsR=kMEGAEzx#is~M0&Z#((vdo=;YJql9M}ga zmFant!z7sk>1eSkh@q`tuyJUs*sY4a88_7U$}Y323BI0-BGccoFx2n-P=PFBSgd|x zt9z8xDPD&PtmCdOLw>>SY&u&m=fFHB>n=K;WBp>yrVY3QKXEW$l5i}Xy=9Ho4ph$# zSqZzycsQ09-UT#MNtFv1R~Dy~N-wmIHOKa?YHLC0NIWYC*P5}?nvM<`r3^{H9*6k! zj4oLHbu1q$an~xTPjy5S$(9(LTiO~fFRiJtbF&VPW@DzKAeO;YuQQ0CM4=8wyIza1 z%(kow(vqU4vusQ<-GL~nXf zW_M`ae>}~vD}|{_D;oErG?SN^Yy%SmP<^-2fz@`O%J;mwr8)h%U^aP~8I#SIBSCk} zTn`*X^7A3u^u~AScBD|tMC)-G*yQhR{ZoN)uhml=v1mbmyqiXN9C8@dw)YN9|McDP z{HxF3Q#t8%Tx)z9p;m7dvF@NhAhPB)l48Lunbx)+`_}%ky9sI?Gd1p|P+FVj7n7aW zXRh`i-*St*=Fu5D4&wQ}SEZphPe%>G8k(c#j?VY@f0$|rx~0gZ7p!7;jKVA`iO6AogGg<L zD_&i2D>BCvL?gTu{+Zjy(|i72qfKrhu9CZ`v1Ad>7TYf2cX`EmMSvu~ zP(DNH3ni7u^HU_7ezaHD7A=Xe(vq2$g8f35l}FAE$q!MrEK=s3VD;vRVhtGVc@WDX zH$Wpp4gXNr0xzV+W(!Dm7*44fISCe*eOr_6RZec~aj1@>!5p8=F!6j`73>(EEcIH@ z6`n$r4J#tDfboMVY>@BRsj6sZ!_;8%n)1f8$mlicH2@1o?5&(-gvo=DK$@Za%mlNj z#grsWE0RmWvjolB5c*xzxtizvjNj^72VpOZhU+~SxW8H_)*#J3fZ;;mXDPTk-<|Nx zCs}Q0b+mpQqVIQ7GWXbsUanrGxp@AndtCYV@#6DsE?RUAE5)h0kZN{#fSq<|KlUp_Dagi_jf2(dX>;jndZ(w}b!o zdisgCm+O=yEsfwk_ug8Q=IHT#lTz+55R1NlwYzFle;1@DcVu#{Bhz4kq;^EV%k+7} z$}0!8I=?+QBJ`@M$#nAT9@LMymW5Y$cJMqDa^2r<|3+I(<1CU=I3&C7OlQM%bvjKs zzK8l*RoG=mg{Gu8nCE}tOqu-Xn4f(7aortspE`92>idu5YIS4Qd$VH48ec}Q_4}hw zlf2H|e%>ZTVb$5~M_ruNFux3hDfpRt-*!0;(! zi`23^@pNAybvO%}YQs|G&8R~@X;6MytIFXeFGzJ9#Y%pQjlsqa8&VoV61N^?CX*#= z=l^GCvUBAxdFdA~I?dNz0;Wkr3RISCbh1g=az^82wY-cUOo-JM@#_Op?`=P?OPYN^ z4IyJFieODYB2F0lqT_|DVxk0>K~os?RDUPniC&c`|7WJ>44!Z%B?r&lgyyO*Ks8Qe z!SG8N@cde}W(DVbW3)aTuct(fa5 z9ecsS-j^ql8~2ank~CL+Sq_jtCHoypR0{(kai2BfX}r5CEJjxiM9G!1pXZZx>g+vX z=6CC$r=iTNA*srkU+P3SG;Knuo4L*XuinFF(9}swtzx$p{c@Qe1GihGg8;K@|p7Jkyi&3<1);|JR|7&puwDS}A&w~rsZ0UOYbD@Om^`@AIA&guC2Ha6XWomtUy7RS&{o85M zgK%<+7pWAU}o;uc=;PbqyJviEKR69 z1e=2qlx%leIthWD*@@(s=lGloG%1x@P)@}w&+n3-S6_a4OumnJ@B2ziEZ0>SO>x$D zS4$4~7<%Bf-?lgw0>uHD63M**AvMG*9N0jXB_w%H)5@m%X4Y@Ak4fqdpEoqWLNWEpz(pe|ARf*h7p8fSUvDJ?7A9i*=tPqZTU8>h`={b&ukUS>-w#(92Eh~6 zPWI&ID*Llp&%Ig>`Ml2fhZ&{()>iCSI>Hb9#k^i`JP12d`J?wrjVWrYw#t**fHnGA zCd*N3S!rW9KEc%15_iLoPExDf!rf1kK0w3JhFGc=)d_voR zDXduA{9^W@?A>;%yu*pFM}n>Uk-X!q*4mLnxHjhuyY=5R8XTdi>DhCx@)yQFf`=v7 zn|&W~4n@G`483BKX|#;=E|%y#P8cr7_-p@T`&`dmKFW1*1w0HRJ>)4bO1P;g}Q+6yieyc|31aEXGSvL3vT|*uL)S`#+r? zzrUM4Z?8l*rC;7q4jo6%JvUsvBa}Trp-DXL<|QoDbu8mJ%D*NND}dJ^J!o24JK^#{INe6( znlDrm%E((D;REigW-;lM`yT`i{2a(4R(#-3zNzDChEz=90M`&|f;E6=nn5*j;doWK z!o_NqWB&3^F%D&p#NRGBlt>ZM%l-zW5l2>XsrRqu0K|Ea@?PNvZQ;hE78jzpBPof* ziBFRb&Gr#w=m4?eD2+&aGyK0#I>r~0Nbr20@QUcO-t#Acy+3+vU1 zUsZ=c_v5Pwvm6yFpb0Le67gt=Ug^ngMkRu&_Z!>xz)mq^oFVH!9p+#uL{+U!&Y~-^ zxn9@_eQoVlV#pj^KD_=xnr}f@^!BDv5&ljFL4}Q)3VweX5E|SgLm@pF$4Wl?Lo94+ zid7uGDpZrT+`=tJxMBuZBW@t3v@>|9k1p}BLk7O4T%S=tD;KDNU8N=sw z)6;w*8{^Q9CUM}x5?aDf?fE_?kS%DzzTRqgyv0CK;&woDeMLqz)YKxyuHo(Z7uW$;T52*EZh=76d~e_&~C^_`~P?k}Y~y^YbA9ABIN?~E4ri6z1j9F@Q$A9(CN z(b$$${@ykZyrHG?uKmlO^=WT7lZT^tBTR(9Bi@CHo@%s5PHGTogM+gj=i&bqY;L?g z%XK|PCUHB7(%~7NeXqtAaN%^&76{j$u_ImHlK838=(`NZuYI=LqZd*)itjWf=n`fkoe z(fBX8P(kT$WO>(v9c}Ph90M=8#Gh8(I)PC>kW=5yAyuwu=f};fszj_DB@41)AF5zW zlWXVDLoGvHkjrz5Q@+F{Gz#B410Vq6+$=`ddht_X-}kxYO?_9R7aC@R`r8(ebjI_W zgtwzEdOwJaK3XlKI_4yeQu-1KhYCayig)xwM>we_FUIc&!$L4B6-!JOJ5`D-NR~>$ z7=kok0Zp6jyYrh>8nPefwGrxSJ_j53A1nu1wWO#1kqesuRWpYbbZFhByyPmR`r?3J zO#%Ee{0U*hY#4P-U572&bYArPZA+ptXOlbJcwe*~yQ+{*B$Z zKtbFgg|$KZkKfJyWz4SYe)HO7p-j>KZB@zZW|!*ukCf2#N-U=#kw5*&VH$Ckwbi9A zB+REy!}PM8&1LA~QoD{qy9c{RI0O+cM?C^N2)qLE^{!^5$*i738hG(}=Tu}5vwEMU zj7r~8LJ5A0vtoiBLmpBMu|JX_-(38Sf`ciMK0hl|@0?zin0k$Sd~LE+@S$AkW8T+h zhYJ>b`*mjR`m2p;B%V%^AUjxgd>(H4*v0=vld$`i@^iV=Vee0$$Ql;YuA$%uONmD7 zy_Eka1>tsEoV6Muh*J3e(XtysTv$RrojdbGx3$52!hT!@AGQ{@;iH}4|6u{-akeK@ zv0CelmIYhvw$M)klo7|15yG1##`*N34YZdi^^yvbDScJamGrk{)oPxdJ!-~5NE~yQc)25J5 z*GIclhC9CuBif@Z*v#Z(vmAb>``%JBa+`eL&xF_Iv^(zOu;H2Ih*-QIDRg0=*JX{; zpAqa6^1lR;uWOBR87tOuewykvKfVcFO(6KIy$Da|MdO`iZ@6Awf9jmrr?TC@%6&z0 z>JJX9me+`>3t4uJ#dG_x{+ul?%ajKwJFF@t+V)e10~GMa*>{T}(s*uYad4y6^(D_V zL={-^0L>`jm{B`9Hk(%?C*AvBVh$a-C1uNa1SH&-&9b1KuTP4Hv-5P1>Rdlim(fS?Z(gLj2hX3P+Z+l%vTZOWGTFt%LFz6U3(KXn7>CclZY~+}_5@2gF@6vH8}7(=-i1SuBOY)OupL{NdmGR%dR*5hb663u!*a=&@|0QJCXN^#!8cAB_; zm2&cAg26S5deqCbB8j;Tb>eyDYI1nqK1+W!bumI}$a!TdU4RRE6pv~atFoeFc~N;h zl_5a75(ZcyF~l;(6D+4D8;p@i{qGckl5R*EO$ucXKcx@#&=F2T_V2vjHxycoUL|fh zHGC6eF~jm86bTnKL>UH|a@n(xq3hn*FL!sSuYIM@;NVS-iX~OlMN0wK>^ch(|NlKe zSZ_Hy_e5?ecyrqD$MfT|HArZb`sp4#PRvN9A<%UvDw%GZJhn3;bT$l{v@-Z_RV9KZ z;ukb?p^P1$_(VkHPZQYV1XdggMsb4=fy`#*@+SqswE$P!Vy$mcXrXRl)Rl4U!fs3{ z$MywJ1xy2<;WP)T(X0Rng0rw@Q?YbU7dVw)=n2iq|F{io1)?r|VXEf5 zvKy$~$UDx*LPCy>K{rJ@Hafbx_0vzwOR@!q(`Qc_0W;5mq%b2auu5YF6~SMMs;{U# z_xw9EzUHDwHkDlp8EA(J-HzDRe{jZIU@-DzdtUS{eG!>CtLVXsL}y8&EV~lxBn4I% zr93y2^tUAoBlo^>dI5_6fj4zSF?4n(q=RLr6^|9>zBg%C8Mv`7_6hd9 zTwd4PK4j46^1;>T`Vd7mwq0{&!3+whNCh@NshoNtNw(}vc2c|gME3MJ@z+0EVKQp{ zDT_r^22rvhDcf2XfB@;)1A{DkKE2jdK}*AVHq~)-V@*r*fB&*YTUuD!+t+k2F&Bey zVO*@)KeKj@cgA5(DW|`SJtdWYDnn z@4M%Dq=U!u_33LCIRZ zq2td}vgqs8{*kY@G%s(tR;msi0=78_Y1^}+6|%y?MRo`~pAxRfIxE?2;j!Lw1aVvo zhVpL-Go+>Ez*2{A%DJ}Ihq{C`hplvxj!W}g%-E?#eU_>gA2}E}*)Hl;_s%=qCAMng z-4TY8=pu?NTII}I<ZDYD?z|q^z2P`Bw0h&mf;$=O!M4;-Z!s`F?hEk7m;& zqzBaFs`(aoVA!pLmH=~sVbwi&Hs-rlN~*MhcSv9JHn8Iq)A?f^;2fk0Nfk7|^^4R! zK#gPo&&LIVbPm1)AG}D(xDWW113rV;@R?Dn)#KdmkxYqZLXaCVX}uQ{rr+s)H!Egy zvgH9#o8}GYaj^(i5F_Ws)@1YH_UG7bkY|8(Dj3#kPN3_-NOM=C^$jlRuVIddle~dw zr%rxk)uNi#^(e-rNbNf7qijujy!s=7gu;~*#X?2KN})H7$OL{P0w5Mgyk0b?5L@mZ zw{~cx?t)tmsj!pl&M7q)nii00cBNaq(-*HADMQtSD#ZP{r5RiD-M3!D<3}A*=7xt83-T564BI5tQYQMrh5)q&h9f5bOg|0lbt+x%J5* zFWbPYq4hRDW+C52=Ri)C{N%W`? z9Bi{N!6Mh3jHQIsauP0QTD;MRgnabD+l1{X_;3y?4YE|j-tL6&RJOi1D4&-@{NPK% zF1K~UBH+DKWiWyLN)U`<^2{XPHmWQ8k#gP)UIKVGs`O8Jz;T3l zJ%yW+*dfLIxQX-?yZo)Zde@J10CjLaGRpuM8gCoyatZnLBKcS|r(oYHs~XsIL==QO z*=bVS_)PsG2Vh-T@tTTN5PAOxQ|-tzh1t87I&t}qW7&#wc~ilG=v{R$xVI+v`*2n% zOcQ78Ebnj35!5i`G?^unBL=6>h%AH?Dd?SxI6jt#}!ZkP1g z6W2dHPW7?lOd53EvQ%%+=UpkUiIm=n*YGQ|kH1PJFO=?t^eQ##I6~&^$NK+{kX2{X z9hEq=KvfI7BR@;@Z$vhqR}3u9z11qo&qrBI!=xaBo~8kuhdC^tCJ$WGCj=O!r9?5l zmv#SVTq3_~2|dp_T6cbDqP&;+nU#jdWwgyO)6-`$8UXqm7ypR<47BQ~SK=l$q2({^ z2AEp7LD2wnbyv#JmXBm_`lXK`ZrL!|e>sS5ovLKOZ|McH8KMhONl-FSc?CK>;ne<^ zPPgbyx!6gOWOmD`@!X^S795&^xILIG&Qv6uNS z7e5Gp`!Ik|%bbPm_4lhg^uM)`n8Yw(he+{qeN(YG9nAY8)g;3z8kAi4p+{z2Ne?dF zQgvOab4cwmhgzQg{1KVIQv$dMoM2b2{BiQ7qoF`lOIoCzg{|cGigrU976_{pl+)?P z+WR{@ba=Aiif$5E53rFa$EOD6`zZ@)1%}EK9*19E74Q{EKtz%Y5{1_Itxc_vNF0+`7Q;Q#h z@b-+abTDvAf*GAep6Dr>G?}z~j|9d?3*}l)+(4FHKbuj&e|sg!SR{}k#K3|E9wx{4 zGq=lmYw{$qWvLU%*+ENSG1PZ9(BI`leq@*jpKvnc^GZ|tZu4DBAHalwkgYZOvzovK zA;6v$dXQ!yIyI9`_0N)y=mzWab7Pi4^KTO$#VLmI>ZM6>KMNmNXW5k78Jn&K%Q?|m zBJq2w0}!e=8r{K+-lTo3S*nG%6*meP)E{k&JMLxX3E~Q0IsX<`q>mnV(f4@Ns6nF0 zk*_Ta;VO}K$<-Rxpc&0_sLHUK+XpS}F7RQz)*~}?epgWPolnJZY=oxc5m-lr=8G-@S!xZB2y}=i^ ztQYjGFF-Qq_?QBA3mP8Nit~6Ve9>@(WYi3~HF~j;mtxkW zhChy|I#WTG^yBCvSb?NLNIK6QX1B*Fu*#B&e%b56DaSG!kX8Chrd&lAB26;Fa-(}- zOGe~~l-Ut!x^(63{ucdgRC@^J6$+Lvh%c!~MSDrX6P{wCc(Nvq3o{I!jZ$R&*s|&LxmDa_Uk(k2AKE$Uj-np29)! zOK)l83tL~U)akCgbXT765M37duan=YO2#g7K0{hZEs6#I+-(swJ_ZdISPDekw`Y~( zqsq19faqto_c6S4hH(GQpB!M>D+$2?3#}u-XlNgCMx^;g+;L|kv4e~EY|NUumghO9 zvl1hjrE|CTNQbLFxu>FP2G95@8AuXHD1g<#Q63N}fYLRIzoqDUL4rqWbLvqECGrT! z>HjVZ?f8P<*!ii~jigMz??Gqm{=6Mb0Otb zq^M-Sox;)6w4}#nzy*p;Kw>1utQ8i0C)E|D2$!C~lR2~~Ya@tQ`)FS*5@{}QWi)kd z6uqGx{nr28*83ZS003XKQ_wgEdEZg8ZVeCK`u1Vz^O>j0edUi*Gn|f%#7Q$fAf~=0 zn7Sjm?GPN9L4-VfU{4*Ek%E-V)kj@m^&KeHR-!(yv+TWU9nMS z0A;R9bjTPd1K7)mY|&&cfjhVEkc%v_j4S1oPP}?1;rSqqDd7-JFA!T)M@A2V==GXC zEQY8%hlnjqR`P6xXlzI}w=o1Ilp^{9ez;opQqKblqF$sbWGTraZaAeXY$e7DZ7}D| zpL8}H-&ZNCoHxqs>7pEjhwH6f92pQ)2v}Y8fQ?uoglTt4aIw{ycB{Y7^LtL_pm5Ye zqw$e#B+F<)Zj#M_0fjdkPGyH2(p<&z0~~d+@7GuBSk`fbJQz1~?t(X%IWjwE`cIla zE5aAalo5k(-(_VDej+bMnIUO~w&Cx{w2Z@AONgRsbcz3@5UkuAvi4uwe6Hb)CV#XYA!A2E3AHfVPZ#zAn*ZYg4d?9^-!AvQwi@_;Ys zw}`f=Q>(+VkzV}C*2C~KbxOdw<(XO9y+d?~&(WjuPq}%ar$`xyC3`3_-&MQ@dAB$c zjU>_-A7(mG^K&HPkYd1Bb=n*(Hw z4TE5)0@wVadn;=zQUZK2j&6(vLLnJaL~WhMF@NPsKwb~Vs}JwBNjlJ&VYC2k7|Az=cObUlqhPs z+DqabpYQuKuh1`OiXwy0-oF^Ml=g$OY9VdAE72cP>chqUau~7dqfss!$dr?bk@dLy zNK08>CQ7iYqe>^I)hzLX^B{91wLNU+4};{(DI-T%ZiS~Rk*KJXR;43q*WHYy2BC1+ z5gmds5V7(bqZ<^JD^x4zLg~ry9}S`J%!7Z4ZEr&>17zl=ClWQJcX)(%vChsU%&sb4@}})y$apkcGOLZnrK}Y3Gkd7hM(}8X=rQ0$ zOmxO*m@ZT|hvyY<(Kv`}4bX%Ha*Q8u`=TyeUB^(<>OpCH35)$-WOU>Qp@~2NQW(6~ z9p20%dBMy=3`twb@_VN8k^Ei@i@IDA4bppvmILLIFEvEDr6EPRYTjH5@18DOzO#1G z0&acvLz!C7OSDBjE)ZkQQ#8@*8MZ(-EcL_2?*$TMXhWjy z%qVPMw8PoAMw2J)#nVQtsYm5_JA9c49=4O2R5-Enk*w{^Zh1%z78omsHi>F@tN7*9 z@O1B73$V+38(Moul@ZQKAk1c-wKr12+7UsbMhm;{#JG92PcpzmN3#c$cWC*?vX1)V z*Cb-h{Ig$Zh8~x#nq9e(zGov-Q;3a4*+Z}h86rqjw=xSY&q@*AiZw#Lws_W^L*;6! zxQXmpQzO=3`R0FRh+p-nv_#C+9@Pw|e4v=QG6a!f8dNht&xwC+ zl8k0k82I{4r74dZbr85hKZ0i)_n|6=;-FbXTi{_C1OGx_AQ}2NTak*3F1kIJSZsjC;Smi4Dk7=SXaNe%Q`NDpOacq536suh7vk`7i^hXP^Tm<%;p z#f8r%+hUibhk2g98lSd|ob`@#u6|FK$0mWBGqZhzG>V4-`$Z|CT1>7=Dm|8H7LjPn zV`*n|`P-xRUF*(7=yB8L8iaT;Fx=K(HCVOzZ3dy+KuR%hjLwEFa*z#~1eK(wR9fM3 zMO0eRY4Hs*^u8O1kXr7tl>MN#WXt^v|%p*(*D=NRHdT5&8b$=6&pe z-;)5GpV>gum7k-dkkPHdo|n8q7m)8SZ#M@lAzU$iOj0m0!s(W%155-GVbZOUj(6l0 zc$8ImlqHD6xJ^Zsbp9SvaneDDqLVT&5d$3$ zbe+K-X5SyW9=u;tn-mDh>x~orWR{%@EuS^AoeZ#pMT@}H#lneT3KpJF{s)U3NZ=D} z0nzduSk1>auGJk~-Ht&iuZ#Iz680QBnv!)5Rg~COoytns#vE*PFfDQAj^wQN)lB`| zy$N9CN=PFN0Y+kifwJoO1Yo|SmdCb9rgr(nog6J54cX(|Xon+BGm{YY0^30#(eZ!r zU@SdN&BLO6jWM<)Sn8_K@YLvyy{nO!*^bKdhbH?SZ%wFVCBBlk0-*lX`qVPBMQFyb zNKl6`Dz2_>5eP(nKJ>LK3?J|ChO>z_Yu4tzC2?JG;GCcME~@Q>kG}uo<#6ksabqtXN>jmIp7Y2S%e(p!@BpC5QRs&sOBVU@XtOKFp{!o^b-2*8s$j z7?}_Bj*LvF0kTfiq1W#uxWVYQl`sd@*v{zE6jFE8 z8OyMfqFsv)FOxJ}56rv+@^7#QmB0m6*Pm1?CR!f0&AfCK3o&=&s9Au#JF1f`k)pVK zUMQEOB;=A=%%j#+Od<72#L_YWB`2lveXP;mSQTf%gOx4c2(VQxqwT~n6#1c1ka~Ob z`G07?^D%sWY};Z=x=&=0%=k95K1T_s6h0^Sq>{fH+-1+`bPaRCnZWDVB*TVwp5KC= zlTjsm#f=+3wiVy$QwnbQJ%M~t6JI0JbQ7?%sSf;!JZMiY)S5&(qsAVdAdkky*+O2F zTfEjn)?nYmNl(GDWT&ZPL>5XC4`wKWoQYv%%g!N8R#(UwDGv8TR>t*L6*ns`(Nxzh zb+IN%nt|L@hpzU#8$+Qv!Vj6IFk$qF2xc%V(-oI;R$!J(@*f+V)ZP!s>y)4mpW2jG z?GW1WC3U<%Vo`{u9VwpH0wPzw=nZ@*=2*Pk5wl5y$=}Lv6|lXyNTYkxo=Szo%g;;L zy^LVa0~OevQ0z3kP>Gq1_zj_>Ie+x@V>Le;3#jVLb)8wO?>R^7#jrS$f-~aC^d?R? zn=L&0=*Mm&_O4HSXfmNi>GKyfSVr7+ZXs^Rs7CfKWr`LAT)(-aUf6j|bAw#|d?Z32 zWRPu^W%9ll$d6W`K?+_=Ib~WMbz%4Q56$KWL z>}-E9BgH+hB+^R{r___wDI4+J54I zA%qM3|AOD+&^OYCK-j608|GoCU9u1no8Wu|5vclusdP^w9U{?l@B_Fv5^nH5^hBQI zYza>@vdU2gZCK_3LI`_~YSCN8lN#o{;n^fCk_lJkFN4f~E zYN-+2xv+WvC1D=n9o=IyG+tV~e!&J6^1B>yo=wlb#;`i7%4R0bk^mN`XiJD|cm8Wh z^)q^rUF6|y@J|-lP=jc~@2vT-&tT9NoSf1@+4WegQ7oD*nQaJomf|i$VV2h|9@-Y(Z)UjWN#K;mzW1^dr0QwM<0T~h*IMIY;H{tQ- zU`59;@ARyMR9n0XHH~?qDkSP)303_zmZBw@$_=q+B`JehsYR;Iqoy1Hc4Q{IddQG} z!novuV1Yl^Y8-#dU7AI6NRm1Sy9Zy(R;{My%o4lOV^XrW!alVx=4e3I!pxla7eP;& zxI%)Me4U|_z=fg=Cru(HbZrQtMEGH75y)AJ6B=+y{tANuiXy^uB8&3q-n&f~c%@W% zFvQv<4*eSLvVRgd5K?$Jll0F+$;Oct;5A=3g92t$%BWBM`~PKsrvw!mLR&@E3#k8x z1pp`|%U1@?+a&m@2iXsk$je?yrdIQ%8A#t`~HU((TQ=py5(cM7$oRfa{dL}x{NfVg~ z9&vKaL{e8Bc=4qQodl+4(>P4#&j#U%Ecc2H#(b!$2DCLHeY(17h4EK=^G`|qnVQC6 zryq)U3s%HJ<+>d!KCGTnxV#I>0yzKwhuo^*Am}42MJ>dYAv3Z@r-vD<$_a;-Pq!>a zb3$5GuvBy;=Uc;LQy^;`W-10^2+x1BY@%61*FgAANNSCT-aK8OIEfmuAk(Oww5yIw(d>qd@4y70`D({ z_DlR5wQid3Em?#MC*-*3@<+M@7yk?yW)#DTj2*2gsp2!p-J(+ZgL<w^c=`a*7ZKGQ_T!aQo0`Hi*lArx6qcwHSy{vWDEi_GFCa&$rv@Fcu zRdI|9{4fg6nc&22uo0qN+oE+glIdJyM*UGlLwe=Qkf z9zM#@-15)xF!O=J1R<3>0b=+*X#qJ3t+*`=3J^k9rGuH-q^LBrVX4_yg94!SOryd+ ztGPrQV)wn6G|d!c7`+IIQ<{WjxUugK^|i*@u!ttUl+3ispmJz~G_kU}B()qa|60#- zW6>53fH->vK#5sMDLS|HH$YfodUJPLgH%s5y#bALPRNMCtu0z4ygJ|3w2f6{wFg+} zf5lVSV%#_1_qzwWZa=1Q-iKE9=hE7zdBQA17NEUx8uY&2|5tZmK^QxA*`lN*bl-RX z-t9dU!sH`KOQZEoM8>#|6Srj#sPT-_#&@HP=4OmNkO<8O?W6JRdvTrTOh@|JA47YM zB)s2v_#S4ReRg@LJ2QX!_1{9OTFGOmysSw2%q%}vH0Z1I;1#O_|MXu( zOGLfnmD8s?jzoZx4l{TCo1&NvbU&V~>(9jb&*Liw#1Vl$F`#ze)#6@uEkK88=e!N4#=kTf-P&4ci%{ z9FJ-Yo7^eG^S^{PJ*+vOCv=8qhR~&oIM(Zy1IltvMoz|0IRSIbc~ttkBTF_dPU|sQ zr)5e(EGPMYK0m^}PHsQ`{Zrf-F+qNs{#$l-D9EQbz19)Lc}RVWcPOITKE2#f#pzH5 zsMQO<*LV7_l8{hb&Ee_TmJNZ4xe(Vr(NXGh-h8A>)9J#!Iywb;CBNc@!P&{TqkH;Z zA3nq9sl3CAl;(dPPdAftQaIC=EqX1fNM9HF@AFdI1IxXBOop8nSdH4?2HWAp ztlZ!Ek(wl5A(N2PiNBG13IRvqW7xR!#EO@8pb`!%t1<2jNN^d1pK(>-XU9S=)0_*s zRYC#^T)|r z<0sW&?9l^l-;W27#!zqndjh!6=e_?#pUJ?FF>=-Z?(H|2`VL6Hqa=^pcBXeo0)*|I zD8m<+zdYb$&+S1!p{dc4b!J!A8LIQe<#35lpB@HPo|M%Z{=Em25->-;#vvM18kb|-W?`f{|NM7c@-UuMypq^j9 zo~67;?%toi?k#wDxCe!{JfJVVjw1(*34uu)UQbYMZ{X|Yl=&6BL%!P|n7&)8f=*_1 zhM80I9Zqxze?NTAM`qY6yP3gkg+mioh@)r2tW>Cpsa9NvG&|17X9RoG5()#_8c;Un z1KmKkRjY>GNihsGL4S5m>9@Zg<6h2ue^bZjvsYHRSq@UP`@BK=olif!FXakE$3T~9 z=JWp^i6tHSb={NO@C7NdI!L#+HM%l^{pJT_>Y}{BZoBcv!RHY~Obze&F|~}6B{=!h z-!s5R_}KtlG%RnXe+Fdd`*ve{BFk9<(7&4>+C>Tmc0GNwYYo){lFg*96B1OM+u^4a zriv>o5{%SXV2I_%iU|H#+Qn4TR;@LEr@^e<-;fda5CAzX7A}=LlLi<fX?}M(7&2Ox{=k}+Y_boxh2a9}4?bs_^ z1fBsY{|A%zBYnJ=xz_8$-%9wvj&5*=mb~U=4`jJP8O$TklQ$&P%1D-Q@n2<%r2v`q ztO-@-9U2LFye?DtP$PFgOtrG3N004cf*e7Ua6~p9gM4UaHl_1nyZ5bQA(`_@n$Ml5 z>jDSGyE&z;AZ3Dlsm6Ykj_x{aNcp=lS*shD+nL-_0jm*$U61{+d;VTE$h~=ROvsz zABH{ z?0yty_N8_rn7fu}8;q1+u1--1w?%wDw@8l$IT4!Y>i_7B9vMOoe8K%3x`bZbd47A}eoq`}H9qVhaNJqLL=<|tyDDV6 zSnR3J+8vB|+VA}!OG$C1B-nWN?7gwE&0wZ-^+^1@_Y~eKP2n(j4bp!~Lp7H7CoC%; zd5-w>M`a<(Kkz4cg&^rZWDm_ho@<)D@!a-}s@ihp_uO6ziv&-1|EdCoN}m&YUEr62 zQolKq#w^C+!%@%MaM-+p;p6E7UU9d@)vWb0R@5_z_j*4LA9*%2tVYX)#%Q*hfTrB? zTEo0g1I#@S(|J>{_!wJZbqpSFOB&HDI*hG5EyDxOH?Q>Gg3#M?N&4I|yq{-vY1W+= zzC)8fUF{lT5oTn<)7~Czrv5n4p%8`N0|L?`NPHrb=4Gj=%iAtmADjF);69Ef1E(w0 zY3Q)HHtIT(nFuNU(tE=ac6%vSi=F^q$@wahTU47AZKMpcH4WhWWQFQs%c2@GP(R3rJ8?b+WS&ve-! zqhXe9A6R|IuCUqnKg(TD*O-16@GOl18B>Iy#y8=@qOh^{d6N>SFau_Lez~)B`*IG3-{PI;@7CM1F9>rlaGw zLts|DU*CKj9*{LoN+#j9XA)-MrA45Axu@>4sUc8HYp3hCkaZ{U2uE5Xf@C5e@0KJ@ z>=W8B@7!t>!0SLXd1|mGTdTfDBcN{OWnJcU>3~ znJHb%s=R%Q`RB1X@X$?JIOt*Avh4Kgf{Y`76fg}Ii5wP36`VRazfVY^h+}7El_@--2(65L@44Y01*geNZDW_EGG132D2TUg`IlLQjg?8;ADhNzPiqm+ zvw^pUM@_JAeH3Fjt6m!pe$NR)1CPD`e&@FJ<`jZA`r2NnHkWoI=&5(pQ1_R$G5;FO|-0_Xv_j=N3 z8*WYLIB;kiwgx}6YMD1iyNN@0BwAdBB-|z#2ZqL@2IfBCj5~f_b`uJ+k5`m^Q9MaukL=Z{GqclbAP7o^s)-sbEBNV1`JB$|FP?1a-9n0 z_b2X^spNp!w)#0bIak0h)IZ{@x~8$DLr3%$&?ufzxF2Q3SXt3s^9d(}wC@qRQBsop zQq!#fixetWwKT~25YJ+pcs2VH>HH`DTVFxy$O+VN(LfAMRxTkm|F?uh8>IihKkN|YjFh0+3hRqe( z;2UY!N7nlMl%hoODsTGvNlcX>g{s_?tZ2OEIv4GGv#5-(5*`IwQ6p0xVpE0r@H&*; zz4-*DYU%XcNY7`Sz#%e%8O>&Bssi$Tlhq>`K3G@p`h$ccDeh*j7?mtG0hqUc(vUKR z3nexCaPzM=nP}yNNOZ*g?;i&7u{bZ>NQ|?ePY7S-k(R(mV7uZyT_rchLDViI*a+s z=|~?T2>EJr_}Tj)Y2$MM_wy(Kjzeg?O$;!2u99BF zLPmXUO00PUU@QGqS5d@$ng%B@5I%N&4E=@-P=Aa$w~D{}Q)~FgX;IOQ$xv!ETFK*2dx#q$aO;`!S!AOi2K{GI=PM~eh#2}V6T-b|?{fE7w+IdYiR@08)cL%l&zCP&?{ z0pG^W4!(GoU|IJ9q+B7f0?=65`NRT0NyUOwgH7k9&+f`q`3W=VrJkM+5HSl7pn^ze zVtjqPt(EI)a8Zg*YWfjGwFs2rrrEi3q)Bhwb4?+r>rcCTeg+3YK{?pRRXP?#ieN%h zRC^Zwgn-mrwc(_@F6~F9si)W9HrjDCLyYrXp&4tKTj^xT^2k&Cwo2S3})!4xC>S7J(H zWv9istD=SmNMr4iw9d(7a1DZOVE(8kA)`Vp>WFG(_2rM(CjI4xcWy?26U!$V!qfh2 zVCW-r#fbTrKQ1W;^MTKhfggt?t{z_TGyKd}k_Jw*Q6`OH5S8?LFO=$7(w)zrJr9^4 zi-D{Cfv-*6K<^t$l*x4Gm%c@;D%b!BIdJU6;-brcee4pi7~+rmI##*$%yE zT_aO2n2P4bCP@w)qEP-^Vy)TOo*Wf^_#qWgA5&-mnVdXI;uXul&Agu>{CL(}E$knrw0f45HtI@HKcp?=F_M-?Urah0E&bd=-{Fy%){q}GJqN=!SMPwnVN3%Hm6=n`jFY&%_ zfb4$B%Ny~rjdz083I%18aaH;VZ-nJaxqAwqx_q4=)f^d> zsiW~@%eBB;EUSo_Mw3C?=C3?nT@kHR(}b&!>S4$t^1ZFjUMHui>}JvRAf5#csJWYvxH_vYqhlerLqeCyNe zt+uuLz1f4CnAHYJrh^N7rf^F4(@ym);-tv>{AXiF9GuOZtU^5Fm920y|7O`((=0A3 zsh-pqIa`-lxr{};F_^GMmEsoGb*4dF_a)5cU%D|C9*W@IzVlPk!UDw6vRqBj0?>bo zK{#WJYot1mBAtjVtZt2OdIkoA!SBvjg4@U01hr(q+Cn~NJVD>^;?a(Zidw4tSrb;Q zxc6>E5t$irfeLWQD|+KcZ{D$|&^R=z&`_GTvAD0DD{s8M9IWRG6}XfOSR(n@ z1wZ=T=<)gSQ^JAW|DI;0_f;1=T+_cC9bXghKbLm4-o4$u;_>iLUPq~)6OFkXzt&p1 z`U-A8zdBx*2j17kDp{gy#`*1f1}1g1|LA$R$cwe$q@o5QLuF7R=He&lcV3d?Ww&DfeQmH6}7+HW_;K%W%sVq>6R+-*XrOhtjmJ1!xId0Ju3)Yn9$hWX}3uemsZ5q9(FoWBETWR-8&P%2g za4I-c`yR38wU&mA^0mQ39M^SG99hwPZM7x5p@Hlx@O*goK!jT7_YdsT(0&-mtSmz4 z?oC48<;h#@s&VBwHb0M_m^8k0I4I(Sf>YDe&K~yhc6A-W2A1jTFMJqL0Qg6u?-wtM zoGdmYcO`ZxdtUHlN$cRA z{VlNo>dB~nD@UA@w=X;^{ZbrCP|mM`H}D#JfNPT3ZwQT~zS56wOc_&cRKV@xR? zXW|3NTPVlpIFV6~d7b=z^5&HVI>jD3*!)$y(f&jt8v)!tcTGPa5XHu^c>%RedaPz` zsOm2@%K9i!g{6$Q@n-)019OSShK2y6@gzG>h0ufoKEdr`NruY8)0Hg*YaVNS5;`7) zCqJ8t-=Chz<#WGcmROuW(NwP zusfg^L9vAn=(UGliNCJf+mZ6{p!Gn)Bf*?gZg)S?*j(eaQ>*Yb0vhLUNoB%?Q_`k9 z4po0hMDM4Wkk=XR6S$SZ)B7G67=l?&&GR-#;rDRo-O4FX{IqhMnK^+`Rk>Rm_$lva ztIAo7qm$b~i#@cvTD$o+Ebkj7A2gDfffQHx`jaeD7B1h5uw$%T&WMB`&egW;vw{J7+}o zJ02By_Rk?VMBs$2C}@vXFGrp8|ARJUwsYvU7nT1r(VFi0wYMFS>?L~!^wNVyC@@t)sfH+0@Hv2oiJzzm$LsWJ)v64GUxe$7BOKDmw zm1d+!$ULFIpXqaja50bE!k~cgkup{*ZQJHCE@7F7i$*zI4fw=8OAM#Sabq9MQ9Y=gNRWvi5XN|7bk zXt|7JFcP$%7tHz--Te5A8;S52(dcK=n2g_6qWzCi<(T#-f60Y&3cG8fTbPJP1r*71 zN?nIBd}xpe`PV1I?K)Zc3Nl#|W51YAP~d4l=?;%?F=CoQPNQT8v$`=lTDlVXj z^l@S~$>Ixy7*DBoQY!jd367^)QB>oqts{!SKX`y;KKS|8x_-bGyXtQFZ@jMEO)=N@ zyx`-XsS~b0Vz^3*u2fpYK0de(x~~*K5S3Z^0!{qHU?sf?$Q1ICQ7-NyCY|H7Tdu6^R4cL(n&tumaY&EtB%u) zQ%hZGcmnPp%{6C|VJuM0wP1LR5qMt5q6du9QZLQe61b$VE49+`-%E->v(B$ zy!As#;022Y8g1Do-LN$&A@Bvv^(G>C9tr%U7xsChq(+AyejfcTCn~1XfL9|Q?p`^t z6$Yi8mY?8z0Hyd|kgLI~pU?7GBZ+obFPnr}6JHIMpU~}P@RvTNcHimiS29vB_U3nL( zA*~Q>h556%^>FPzU`IE5Fz%xYb%vN*0xQd?hQgI^l^@S7xcjo5c?EB9RGD+XhKh{g z*LK)`Q5O6lj8k;4*4-5K)yG^r7f=?uM_zW1tG0LSw@xHpHA-TGQzAJGf{$TzbTqLg zA6(m&EgO|OwKe|AzO#1h(P(=}AD?$w{<}Q?LjM~Z2mj3JB29%{sm+<*$jJ$r(YkM_ z-R~dYEp0=4l58$}UXM?$9S@T71*EPjQW)*zlCLp5LR!8b-lo}i+J|fgsKa3KU7ucD zQKbDe?Ux3qH1L2AX>X^ZDObQf+aX6gIr2;6I?(#mJlOE{K}B<;Z>SG}!br=M$Rz`i9Ng(#W9n z$TbEVcU_IuMKqvOSs}&Rn3CiE|6u{_OQ^H<;@VUZD$t~g!$hO8_=UW1x1Z+ zzY9d^B)6P_RIkaB{#AdAzP4-fI9{FipRuY%aIkZW6Z#yG5~r5l|9k&7IvWuB_``VQ&ng1T1^@VJ zm&ty(roBN^>UWpS-scG4w&VHYgKnMGt7Rg5T&x<^8_Jw-wPnTaNa|CKR#(n5@yDc> z?G>kA#@41?OGj%WDsg*gDZ!yE!$MBEz$EMCXi7p(LR+e4=PT5peomt!I2OD#8FLZRo z%_pgjjB-@#Z%FpAj#eyM>9n{oDJr_V<@3fR$!am%jj~L!vE`Jyk7K|Vb4tNpdLWqa1GJgeea{5J5k%42A! zwKKer0LI;=`rZvP*g^3iWGV=QP zh|~gpa(g+WGW9iO$Mvni0HBJK8URTAj*LIOx35=g1GKocn<}b;{Lm6rFoH&;lcsTH ze2Ceo#=~|e&AmD-z6gnl48**c^|mS$kRoIPfl>$?_|t$8P__iQD1BO`llHgWgC>#h zc_qh9u5Sl42@Q{7n@=+M1dF*mYlBBj8{Uu8D-AaLWln**j~+R=m={#9zeV-REzzfq zbF{ZSpj)|NswZ#Te@h)BT!F13N-l5dmL>3X=yG^WnaZPotF6f!BMPgkwfY!Dz-(rr zj!#yQnPYX;Lm_bghixW)#xxl*k`4?Yp^Xjia&&xxi%sS>z4-A5H#J}HeCw5UeHGt` zA~bHbC=uz1qv;)eO|Q_y%49FctMIn zeAE^5p*wBYH(GBW4^6Hp4h}|52VSRGP#+ErW^4{^+M2`+IS7rG;+$1ga?oDnYyl#` zMA*no9nD=tAv(GyrYF1~;DBOHYOi|$mlH3aL3*B2)r_eAtvM}FD$JD0-Wzk3k(kLL zhD=f=n-g<2+c@X~k)dG|(XvrefO5P<1Yz5VBeukCOY*N$sGtwmLkq2=HaxfZU#^+> z9-M|4R&ICxzdhdvs=z^V^zDy8NC>p~F_;y8QP5yf!L%|5IY66;ZMqV=!cln9LT&F* zHW&pxyXx?b9IHnvlqlnTDcE5Vr^A4NAF-?6*Q@y(LrO1>5cmML));X*nd6@GexfDH zB|d&3-0V(BVY#4S9?WUxKA@OSQ(CXE0l#jZ&`>W%!tZEb^#~ogq#y>2zLq}BixteH zSubePfocr(^+3}4s`QAj>TLT^50nK#e zVG&B;(j=UwW!tB{&7B~U2xHz5DX}%DY zQn=_?GTP;*dfMJ7p$2GZxC7aGVN97tku`{6<(zOK3EUG#`3h~G@~%J04boi_c4ZE7 zTpUe~Th77OjQStE18o3Qx);Do>y z`kp9;A-gfQsT+R328c_YkP?bREG?3-L!rlL+ud3CnG|fggDFkUX&ogfH6T-s)v(Z~ zjG!w=#Vth<2T6v$Ae9Kyfu)MnEJ~04RfkGShM~S8iHPp}cQSZA6l7>4U4+R24w=04 zsVR*%?y|eVgbe>HwxuYVk}afIani#dwjwOVG>NQPC~PU0;z>x2?Cqd99otZJ86s*+ zNfOgpBl}cL)`@6iyov6xPXp440N7*Gn)29wsZ^Ac>vdezI!BYbmRo&^C&7Vq5!LR% zQ(JO{!{E|)b73WnQsE3EtDB>|tDMfWByiWuJ9pK;oD9Z`nQz}o!&LoZ05Sz-cU80s zomP|B5DDvqRe^$2Y`w(XWWeiJGr87kmr&p8Rx^GojffXFgDN1D)tZ9VHco|@owcwJ z+q!u0FHBf8IpIQp3nM=JmmpDH<8NkF8=P_flA^Gp>4=B4N_v-}dzc`;g# z9g%8T7v2u)^)=im!xad1kYb{g>S+Ujkm_F(O#0-LusK>=TDm@p8eOC~Ogg+3S}z~i zr<2&e-u;hWrM-lXEJn4a3!CbMj&Mrnd|<$hcLka!b};CnrDug?#x& z>deE8{AK7szYWFoMiLqmbj*T76UoXi4iG7r z&3kL>3}^!%9mUXCsDDl(2?<(HXPyDJH2`ECs$p#-EN#oW-cg5dk&kZs+QIu$KR011h z3OaXqHR2ca7sn4m4*>X{PiTdPv1srvok`&jSAYpY#;Q=7(kU3Ux1yX{OSpW|p`kXK z6L$5AK$hFoyRSI>zi-1+IH9$jqs3+sEDvFIU&BI#k}QB_QzpNjU&j}xvq_|vDj>sY zrM-b|ozk|2Dcp@|gk!ey6dt|o{g8){5Sl#n44e|;ZY?iYObd8#+Dqf|{*k`9>t%(W zH9frVoIHM@-_0BE33&GFaeLz>bi{Iv`SAF^7dWu4FV7oHA9|t4fK15ilDWI;jP9-j=^jAAfWL1DhfRxoVMSt*Z4^6YlmjoI-x6t_JS z7L^2zDPndt3AU!}Sv(_hYeYE$i7|x3ixOH}tzh!t&4fgX5p(y_jpeON?G%_h5{21` z%WL(G1=tJbHQ+|eaAHS$D***WHx{rtxmGwh1p5oSrK7aJsp)4Nob2MB3c1F*pS3pF zyvqd_jIA!wvRtf(C@rxGdEx7hx$c0slx^r$q+yVdglg9wV1wEwqSs}d2ohVx0C!q1 zzl{vqf;z!?EimxR>3^0(jDA0%X%24Qkq9fPn+d-Am*e5(iNz`xm}0OP4c}TY@VGgV zFipF2ep_zpu_LnTc)czqrN*-I@%g3OgF{B82QOp7I*>}dhxG^>+jfVPO z&BXH)ieIJCX@*kd4}5sGdlenQ-BjYnqxm%EVRzRE$pIX>h4YZ2r5Y=+1C zx^ORHcd`kp>EM8j)`67%bMD}c6ndJJ266F-%KX9A5 zPOIU3)yg&a9pWcDOL_zl*Hddk zDRSqVS^5C68MG3or`W# zwuV@mkj|+xQ0D(6JwK*nwLUs7<8}UrMiWnB#+@?CasVL6FDO7EHvn0)mi-BqATZ;o z2_r>74*JR}D)K!VP%J-L5JXCt8Ii-R(9Tj03hzUm+x3MJQpZd&XP1Q8frspQm={Gy zuVMK%dj1bNK;@REhbVPU6H1A~ zPn;P3NIpVb90mjESkS?ptAet!+CQ%KCk182r12>ZJ|QLMeCYj%CV41@zNsaiyLMBr zEgL9@1jjR<@>z=D&3SOlB-|nI#HC_-6h!{1bC3QSnz)NHyX*9p^9zmdFrXbSmNBY) zMzadMW|zplMbmz@IVoi{+}hf@sG>A)lci?}GeLN!G2UZ6y|t)C^viHENXxczac)k; z!zVQTNJ{OLavcE%DK-HOl9bI00OKS2UN0)w|Bfmk1LVwq{x=H1J3Vf|?R*YP2t?~m zw6e4Wj)Y5|+z0Nr(r_mQRR($ez&@zLt< zD_VK&R*r9igG(ob+D4s3W|rgTjZ4cdJHrBQiDu^Z!GA+dueSW%+^S3M+~Fn75{YT6 z1@F(N7%BW|0K_@_;W>_$KYoN4Ia=HQ+6Av{pRz*PXmu3LCR}vI!~aW=sD}O|WVX0S zX^I$6%&Q=fwbwYUk8sOdc6?M(=P2PFZOS$ZuKPy6UKU#n!*yseOGnIen2E^XlDQgK zPryEcx@OF5T~Y;KQJv3f_^&l$1v`z4YPv(*6tOi=ImP-8mU!q@B^~HTws1YvmV3h8 ztF%+(N?8H1AP~w&7wlKuUt`<<;ksS^$L^V+jYKc(yRZ2Irc9XHv^s1Cr()E^xYb@3 zwYQ+ua4jz{bN1H7`PGVa)Z$kRj1^~?-dSkxL;Xmr(MaJ4-W>0$8aq{t<` z32>+oLbx?FOS1sEdr$M?C3|RC{jABo;)Pn?2Y-@ZLt?5J3eVEW{}} zoy-XxeSy{TtTo^6c}GT8YBV3mD5HMC!^bOaafi(T)g6W58hy9tmbMzj0Q$esE!-<| zg100I%}w^L!Z0yS>i)K*>U=ymwKomz=dfyXu+g>=&XJ4=8gwpcbj%(U)Ze zO2FWkNSmosz^Y4RlaCA`TsP3Qw8DmP9(G`mNzk#Hv6d{@)OMGpTw=o8*y_mnJ78MH zd%AxA4EUQ-b2RKfySS#OsA-5v0%q;_Yq$At-) zNZA~bO3XBwF(>R4ZUyuQ&icLV|LQ}l;uT+*yuA*YZESSKqfyQ)=qZg0UvH5y`&DE2 zUDuZ(LEsG&KYgqJh)I8~rzU1=iwz?RQOmuRog0~}CFOkU4(hq9K!^3u&BtSk%s|vW zSdRZ6;$_#}JLl3$!CY*7?%}^Ijz4Z^7s$ERmfx*I%YoiOeX~i4uu8!5GXH1%4lP;s zCUt?k1yL;)$KC6GXoXlM*8J(4kBuK>N3w9>fu5-(L9x}Vx6P-J7Ng^F`>_W*2d^yS z5%?2VI}zKT#G;whHC&{Ul1R{{IEnMMTmjyDVeOkOb81oO1RV^YyB_P zp(21NGz+~j|kF5^^paaDTg{ZO=rB^d`+Qtyo_=o27L2F^L=HcRE zJoj8~a#5CHg0W@2v@L-_H5CB^LN;*-t*;Md#8-H6%Tv=cD>m|#g1xHJ*9VRQkj#;? z{kX1?JvJ8mD|Y+Qir4>zP`|Y&CY6P5W_t0@{9p*Gz*r^r%;s+a{+X=|qhbTZF@{M4 z$zU~^-K1;mF{u3%3PP`UMlITEMh@d_=?a*hD~ggr4PdzjeKCef6cuBK9_-<6`QnpN zvTdnciyn2#^nc6iAO3U_Q2EC$r%u3@Tw^_GZV zfYwj*I#9uKePd%huC7!^F-?U0evu6~vVK{8+K6(li-dxHxeZY^Qsp$fUMCRJUrEf| z?1M`b3J`d__b9DczM6%7_pl9*O2Vtw)cHa!*V{D~wvJI&9&M0QQ_|iJJFDDaKh4ek zW9w%=f=+i~{$(w(6ufjIxu|?kirWIkVy@L9NU`f-K->E=r*84LJ?!SDLu`Ef%|cJc z$=|<)X1Xj)c}(VN#CIHbsZa@*z^_U`p^-xdTwae8o^{Gq*XdiUmGW<3}1%T z;9nuBQJPpEMTybAo8z?`;{3 zYz4_@ti8TfRc|z7>jF)^4v?slOpa$dWygO~NPktK)j(?(V9;wEp2xPIri|6C+1;Q)B73gFyvmGe3NH z54+iAfYF;@Yl;o6RAbbZrD>XqMNvb+T5H9jFV&UfkZiuUxw556LNma_Cr_H0-}<8< zW*y2tg-frXfFr|cVKeoP`jXsOWxUs@RSQOeQkg<%K+%tgUDfQY3-M6;2WQt zPfCU{g>^hHn{O~MiVK-07gg9`<1$Xou85Z`n?FB~9)0Nj!uNXZ55UhO&36=CX9uU- z&8;4D3#r9Aw5;shN_M^k&l15wQHXl$8|bCH;WX4XHg=_4+h9Z{z||G@R*{Kv!5gDz z2&3(m8Dy*jMJ*Nk8dj315$fVv_CuOJH_PK*Rb$|<{^O@1>+HwZ04@sTF3eZ zy(nHfl_O{fCpxW!*M_i|r6-142_h!Y2&q(gillJ`-Q}p&ec#6{*OMIbBv9bi8(oIw zAl$yAfeKJcTof7YY)1ezLspHl?Cn^Y^fg4?1%~8jN9mUKCq=nq=BKlk4Kw2aOcCzw z(0V;KR1ZdWVkcB5_r~PQ8vJHG2!3~;~9dgtemhM0B;80B% zCw+Y@Y_DAqK?nK>tT5bQhs$dPJ=BlXA=}}09*8z{k?iZk(otn8;KcRWj+rlhr^KT| z{Pk1qACvwJ(WKV=+Da4#4xSDgKb`s)K2%|n zOrs6zY!e`+NzBiV@a|LxH>iql3kKyS(=$ ztQ9f{!UDnsZNM~E#I$~ZT!ofgj4lZfJ2w-x@sksZ47xg1hkz%UkqXS?Qvrm;5FneS zu?^ho(z3!alvHgn1hf8I^OP+>NL)boV+fP4r6646q(wt=Kw(zXD=LZL#t(|nAl4aR z7lmSot%7D0#KOVEutx`k(hOj*#3KU;cq`(8L* zBBUNKcQq*#paZ2pUmX5LM8E@L(SIc_MYB5RVg0O;d}k3e@S*+h{gM99Xk%F)m@rUK z#AqQfWD_LRNUKTn9VoJ7Tx_gUUB2I>NCJIc@JjBj$2r-ItLw`GsYF#wt-T`sTBEcd zx`)Om%@~chLRgsAno(gi!us{1ti53M8Q1l2o9q-aoktLVtF>jcpvBuGA+=ErQZa)aav9G3flN(R6GK`NeoQTF_`KZqlkK>`N2=8PugBaD4v)DMns;9IJI{ z`A4&4h&*v2$&Zdo4JlORvVH00qS`2FS03p!phRq3@6zrO6LS-=4HbEvkvK3tJwk*b zKy_0s0j-0=EutHQWcTCCZV2{_zb?;g^h;+Ix^t-Be>Nv#|9_qyE9o>ejXxfKPk=rk zuE7u+i`>{+MUbUH9*og>)tNB~jp_FIu#hU7-0n(qY5--&dFsZo@%xdDoi9FLZfu0~ zM);%F=z-*ljts0yI%oDw5HUTX>Z>t>`Jzy-r1cQ|lLz%xTKG#ImVOCypx=uxzYtK2 z@P|mr(GQ-FLupn?Q4X}}2G!%}Ry{JIxA=RA60`_wG5*o)G>R>)XT9=&Dn;EE|ME!i zn@DUpxUeh@VRBJ7_O45myeOj`!nU-)?WrgAUIq_Z%R086HkBVdZM4zdyTIM&CsJ)6 zm}9U}RfOGQ+c4#%3X_aDYlA7Lg+6w`rl9U*GaZWDRp^}GJCG@C309!S)l_0>54tpi=VA+%zTr2u$mI3{r|4v5poH;V1!MC z8a9L=dFHT5x$00C@;D6{hB;7yBz9PYeDeVgk%M8Z!$IxYo408Ak8bv^tv_ktgr89I zl-_9DcA<(pNQG8Dv+h}Ods;t$_`hH3eD23@urAmb59V9d zsac2U%=0azNO`K!$Qzu7IoZd`ZZXmlZA|yr`NBRZHTsMtoMvCtZUZ~r7{@9s zgcLUvL$Z5$6)l--jc$Rnt4fW=?s6l> z)W`%76j#*bY0#hIV=>#LAf{x>7?K;}(+CPjYcq*h%cc*s$uRFOlegQpaAo}cbbnwH zni>8Inr#QQw=^m^V(#{U?theAt(@%(w*)#K<=W+aD&wUP@PfEyXnr@nu1&*r%2al3 ztqz;LISgr5H})LqYyhPFx!#+(W22f;q9Q_LZm?+upw+AsQ*sHP;f;jeQDbMmngwIX z(Pd|Yn#?Yw*VgYK1<+N7cT{1|nDTO2Mij$GC^hdx%^Zcd-PWi}(FzwRi$F*c;N~VE zB0jIM*p7<;#OP|(HOzHoDXHM$Xz53QC>jg+4J*bwdh!!2nVO!p#@p(!Atv7wH9k&< zQNh?0rVDP;h1ZICD&s!eLpgAP`?|;X(D3b#n+a^ZZehg{sEh6PRH(vlq;z3b(lHXU z+BsTskWpAg$)aAeeQoP4BTPo1j?7&d5sw?=%Rs#JdFOnlkxU<#3N&|@c2;?F9S@IP zhZUTmmlpgD-7W_<9Fj$uEu1Tk5rey~5r>#7?;C$EV%P2frj}2i1K*0*4lUza&x;eG zjE>Q79hWU5FCJKWJt_4|xkk1#-vW#TK2~x#;*Obnj1*G0k#IWPq}*pW&(xR{N>;AF zE~B}aJ`$%zM&d?wNJS^gfF0t*fUnZHVXc*~K z9fp3qD5J|ME-%mcH=Z(;c9g|{V>9zjl|F-w+?KbQ5YQ(Fvp)VkC}N4ZN1J?(I{LoF z+Tri}08_z8CVsnnOd;6>j7?3o?vH+SDmx;)co;|RPVIu0{=3`@9*p%cR=|EOdY=C5 z4r493Net{$DT1!V3ywZ3!G)?egLN=pe z5=#eUdk1w#d}bCA4#@9q6>Eky3ZDOIOk)_dTJ=3gJ+&bx&)i&n9{qS*J(RmZZg|b6d<12l7x+XRD^U?bI z=HAREz}a`YPjQf=J-4_%z)*L&FP{P~2+MzWE+STs=(qpj}+l*spitZQrr2e~**&HnBZU?E0F3tX5;2 zet%DfZ~7WHUnp|fs!4AV9$q`QzAmM%J|h^BIM%TbgPDT)y|AXn0Zfy?A3JVoT}zCT zo~-7=CnNOE0Rk;O%0wKES=5l4zlt^XSksah)r9D6?C)bfA?EwlBAT7y=;&B$#zdB5 z#QD24o~ku8tA#Cyt{$(qIH!|R3H--Zibe~Le|UgB5D&eyO={d(D3#CUbqy~oqu#o& zy_lMvae5kKqfeu^1J#xV4kN7uei>CJEH|i~TbmC`#waPNYH|%K+T~8u?%CfNDf&^` z?X^odAzyF5#vaS2F>#m6>lviUpq(^cf|F-;Bam=&<6OB6p-k62@8;=QoT@G$>F|wS zid^EZ(|KkT;U-+GnzgsPo^~5r_3+tIVDj^kCU7EbGQ_^y440(mifmn9pAM&t$L$}f z@yi0P*Y0q}^9{)-Kw02MC=tqr350<5K~8L%3B)t6RWtE^^wnML4%(+NGM`?5tZ(hk zbL{z-fjpZxbeByxWmqN#nQvK7e$?@e2}hYPsy6-U&$fShUEn@!a{~-WL?dlCd>xtw zHI!bnJK>y&^IU2hBjg7hyX&_yI%GJlz=3r zXP~%PBcaj5$q<2;6W_V@WEnX(i}V5w%d5!EQW zMk+lv^(c*vje{g&|5@F+)y9mW67;#Z7jOu=av3QlCFMWR=h2bC^fa#}5^ShU$~gUq zbi~*p-`F8LOd7kZYtvL3ClQgMj0xTJEW3K<=p(qJbifv5;%A#HK`$?q0cmJz>JlA8 zGsDKpt$5rhVS3vF zT+~RIjE88#=Y2+}i7=7IDDV{RdD3giUr*J z@!N>9kQ%}0M~-s9JDmUB);l&K4x11=WTs4;t(5QHcQ(N#Z73Xcow(lY%6Om_AxG1f z#L})ycU;A=H~U};9Q+gBqa z{k#t5um6yI-^LK`|C78=EA%e!dkhmdHtQL#RA}00unyJXS%ePa1t{$Qt@GiYn_}JtveVNo6$&%w>E6t)CTl;NKpIs;Gt53=`+F1HGb9o&(@XK#Z}BP zntW+|#K^|l(jh3Eds%{>5eVe|3>Jsc zPAO_F4SRn-INNw3QJmCauo$Sxeo&!Pa=xFCtx|A4y0=$QMtAjh3Moe+81<-fLh7gz zJ^g}CF3^91lD5)ffrmeY!b)1w%BISK3K+VsCgO-NOgk;;Qz-t=`%qupzVt8qxjQtlgz z5gAB&`$r~@m6G%EHYIf==~vH&?-s&~L?ia5zH1cbxF#q5yv5Fry(|lvd?_D=_L_M;1E#z0wNPu@l6LYPA>o8ZFUnoF zug0je(M+7H(0$tagt^&ejhKYQd@I($5gefr8*o4HL5yLib6uiavlh)A!c7RzLVoZV zSO~~Z(4H&DEtgoN?@E^VflaTk^ohRa9<_Y~voh{K<@?&ekZ~rPPeGZ5DsKKK`j9?r zEm|$QZ}VNYX6zl2?BA;B&Ft}vWRkymF+?;c_O-!c4~rN>SD~tm@c}n5rHSr}?s4RV zT)}uvNY=KaP*4mB1vFa{Cf->YAlNZ5-Bc>psAY>|XOz!nN0J?ncyqxQ-+fryMaTW? z5ppwc({RX88jE#h5J%ZJ{BTh-HkWT|{fv*bw<{MyY|Lz~NB6nBKB^*vzX?4)dNw-m z!5953pG8`P{K&*_mZc~H*Zr5476H63hCi}R^Z%?aoIYJ#zGLF-LB>_CMAPHo&4;cu zw9};q$1TRL`)6C~BqW9d4(T{DOJn2oFfv~Z&&@`dVqD#?)vh#jiKB;qEYz~T1|%lb zLvnode~d(c+yhgsMAfG_3({q<-8H)qzz~s5#|CUk^5Mt z$VlZ!x4vs1!3Ran&d1vwU`h z&9e~5{m9oYmm{&s%=VHLlwvvfd1A35#~_=q&N(M5KQwD~2i_hw!g9x)E^|6Fav3?e zzZg`Wck`uQdPs?zb7}902_i;>HD&SF#ce&G8yyM1K098gyz8%Yzn2u=@e+*p>}U;!ohsg=rf+yPQGJNQ5Z7@Zno z5)&Y$k>Lpv^m$cnB14K=XnSP8Jguw`GJT?UWw{!S2^^iMO-;B4(rb}&F;^5ib-6ye zINr2oJco{QvYL1s<^n#oxSkKK;*+J}+6S^;Yn7SP6|$Lnj)WHXkXYbT`=327}_szRJc8*ynp z#-~I4#2)E-Y?Ult+$gw`63b)l3%8BH8N_1i(SwyX6V7vc8!2g)ogYF6aw!^PRKF+d z95%jpfUC3kZy4s)X^=T3)q0dUvdx{G;&%d}5?5f=sME7^iXdWX$+Gint&#SZy5lMN zjHp?;1$@FIxBIZ!*&Cmd$MFn*+~K7%pVFi#sb;W-nw8J$&d;}I`CM!&%B!c&zp&12 z&Q8TvpN^LJT4g5*8P~7o6%D5UjAX{K76qn2kgSXp!Bd-yV+yt@xXmFm-p8$x$5h~R zrc~-i21sDshd=#y#x~=$fA)y*D*(ahtD*|?-iwf6cJ{6PR(M&o>&`(TZX{fZ6-rsj zXS=Zh$lWD%bQX(6ze{G@;;IW*F#}ey{j>M8H^h4mnYjba-2^SX%|S7oPTh#^76oaJ zo^_hkH)ZQ(a%*q!m~ioH5wId?_lkZg>RFy?45*$p-d6ow35s1ALrO? zKF|{*l^5u0<>PuOOUUzQH6(eNjj(jAW+Gk1YtP`9cP!UGn-#rk8VY~>fJaWts7<}H zNQ|8zYN>i6IQ#b@$}xvv&@UrAHQ;nV8r4Vi}5G6S7max&S+*bML>W^D8P9a<0eU`3a(C_4J*Npu2v&Yz50};rKFHxq! zL#)0D`aIJYFAsGUtw{;9syQEryzwizf`Zx9g5weDw8#3h%0^m=Xnv>5FS}7BLf+Bm zmmR_Gr;9f?ybm|~1idoSTO1c&OXx~ILV6ef_V>%@qwn2jmKKIe6faG!-B^`{p5mzI zf9S5QB976xjKYqmL54qU{b@O`Kzn<|^?)rh!{_HEKHoXjJT#mPOkik$78=X~;# zHkPwYIt*-u_7RPrR7I zPc#1`=k4QTZF5;rOpmgdINHj_?VMGb>;J2on77X7MYC$boa4u;E>4k}EdN*CE129= zJB02^=GqINggJ!-pRXP9(9zY?Ny`-v=c3Fzx{sZ$jWMadoZSZ5xJ?DEtzrGKNZx6+ z=6cP45(>l0GMm@^jykouxdt|^dc`mic^s{2FZI+;xB(~NIj~PZ5s!mm3|^$0m`RGV zt2$9&UL(Xr?epF^ZA z1r#QH^VW4)FFooll#Z?GL;aUwv-##oyZa33*GQa7dTpYt`^;=hgs&+as3W?2PA)k? z+kMS7@i#y#PT#DZoSukhQ)RtMUY-UthH5PHD7#prCx01fVa}oBOGBr{V1845)_&># zyjVrO_7~Lcb6;n(LA08w*XB9>X17{*Z{Ioo8xOQu!*j0p$@K2y=KMk|8o+0GM7j*=L`CAPeD-0JCZ_Z8SA3Sg6np9gg5|X2%3Lg3wU^`T6+TYK3{%tR})6?KoNJNGX%5!szx~`6iVn1)J$6AdG?B}Sm-HR3njO(fA2@_AO zubU8+7s6|Y3&b9zr@^418MuDr>C)on=KJuF+X4eb8fym|IMkAYl^$D!2)9_b&w;ZR z9UW;&ju-jW-NoN0e^OJQa%5p}u|@nC*V?b57F1oQs z&dtYGb)gWU%hdZ#?4TO*77Nc64IZRQ8pR?y(qF|oF)1DoVg5u(^9PoLnp5%VS^MuP z=g6Z{pd_Exu1adm%{zl~i1S8}zWTtrNWvudo{|&GBl@pHCkGQzBrLo!(Xz6I;~2`C z9X#wDU-|ix(|k%7EoeZEepjD9z42YDJ>~3z%t`*wn^&g7B%I`NsB-hjRQ;gRk9WtX z{Zb*twVUeKW#w0SvdzY%qE;1i!$uE548dEvxbDmD*9D_jIHT9K4<%y;-`721Sr(|z zW&Ef16sm^M52@&%(8h+2kSQ?}R;K^K%Ns`P!FbGW5x*(vrYY*kU}6V?%m ziENmNLO)^ed>u@RJbqzaSg?3?kpABlr;}Yeg*=ENPoE_a0-r*u(WGak1DPvsnQX1B z-NNU#5v$utwBzyv85Lp`?7*PYSz7T;EHflW*%+gPK&m z>M8|KnQ4yOP-kP$=&3X5UcPJl4j))I#T1QwyZN@mL%F`YBr^H$fCHo~26+n+^)Ojr zS-LVsOxXd{*70+5>zlt8@e2(W=QS9lKNBzB;W3=0x=Sg+YHA-bTMv*S5wh&M_xFV? zxol|GOvJKH1zEt#c+w`olMugM#zy5R7gpNrA6QdGrGInB8eD~QIH+MhUqy>(sxuYc z*!2z|&aHT{OUQ2kcIDtLJL&7UD3Qk6mYLTpo{($Ld{P<-!st>eiqwTR3?{R__{1*0+rL82a$*k$ z12_?55&2+8ShY@b5xV}4>dwa}qd!3Z4~)kfVc%GHTVC)Rxj*c=PISu!GaeQJ?%k#9 zqXE9j+qVMmldT+Dg1zeP)!=)}U+RDT!yJ9EY910yH`8ZM$E$hJ9Tu8)Iv9ZT6#Bdl zM-h1cAM+jj^t}a;KeI?t_8fZoKNi3*msyV|NxoF(wzddw)Ylokk^waieSUFcn)GYy zY?iDVy}jAeGUADEPX6_mi{%@ZSTZ4zhe*7tv&%v?7S+rpg;?de`Hfw~!UTZXRnaF@ z>tHm7bUCD^@%3fxSfK7}ma)C~S}abYMU05*v@@ROndCB&GqfsB&gnikE()B9PeQgf zcU8=6kZm@brG+-k3`L3<0+AUSLzAX4B_e}NaUGhUbf!ur<|2NqL(QTMVaMCpYH@ZS z>pzqhca{Pmbw>g?9nlPOUDBp@>F-{QMP93)GBxZJ#JR97T6fT|s{0!4Hq)jAULP{y|78sA*5Nnj4_Zw>TbT5EED_-mW69@;c)*h~Wfk7PvQV#NO;MqxtW ziyi$qswe|RW?(_R=1wcW9qrgKqn*Jhu789bUuofav+Hh0Ri9YUC!)Y%A~?Bv|2IqB zIiWD4fP{L`OL=te-p5;9??@CYIZcYA*}^LKE$=}Fqk{A8ApK#5knj`dMBX%}h zYo;#F6=h7hfVy$O1>3e)sZRU-01ahV!fL&XH{gbE%n=UefB*b8WN6Hs>3{CTY>SDC zo=ch;pX9Z+#)z_!*y82pI=jf5iob0A`b6ga;4`p@dg=erIWQz=W=|*%Z7Vt&J|jXQ zh#bMRP%#8fRO-Y24mFFWvkASkjIE0<0ocKj+enm=;h}uPDm!)oHb{=~FWH$dHpifi zm!Ul%rL82-Ksyu&g@E|PDA_0lac5U3ubY}n?3-YqfQWJ5?)HeM+>i8`5hLSo7U9uA zrK&I6@8Qo@Sc%VY#8rb&naFk$gVmh`Gl;~xn-XTzM9+Aedd!xU*ChmAwcMy8=Q_Ls z_QVw&-!r|$H4gvj0>@1mjiMb%fmXXS2vG86ToD>F+@5H>oXO4BI|4KXZ9>FTPsfj| zf1NCM=<1!seg4Kep2nj*f@KZPIb*}KWbhHuwRDLk67et$A z`oVV}#%{GODES6SArxms$@%tJ=c3ydr@79@D6gu&djnSUd&mM^e&4e;EOE=F`O?&+ z@6HLq)1A>9L@_Uze7ieNK+e-AlLE-R*n!$9rpCJwrrAj|!ZSP>SlpYX`M2!f!iYgD z1UIPL@i8_z^ov3gj78k~y7QH$0|d=ln|?F=-$Iqb4GdQ$^2?b+gsvbx6Hjf$ddDf_ zD;~o{leGZ}e*SfXR5a0_NKC|h6-vp*;eu*WLdkIhjDl6YtIEv5n`UFwZ#q&)tZr_2 z`G4VJSQ-;7S^_P(^`}Yo^dKqNbj7Pl+wJh1t;Zgedu0{KRYI{mleicyH=kn18xQ#k zy~4v`1B3)@@C<(@Wp0Z*&ZW`kCywYnH5h=!&7rI(T=mYb)KQraN4hHNWEGgYw$9?dfK4;cxM>lJmU2AatLK$E-T`#I5 zvdyZ+ohu0G(-z-GKHnV;ci32#Vb%93gewzL7Eq?tm>cqyHmKv#n9wxPLE6FXHMyF$ z7aaM&*=G#srC^yCtNkJ}G^mtwRRW)cfcATQStdK{cUR}=Qh8BaXG+MJN3j~3y@gq`1;gC{(7{Z2wll&eIiD_zQ#XB)#r|DkRK%elOum&QQJf4ite(* z6JsFw=xM?z;McU^6LqcvgZ~pjz^}!oBh-785($CWR`@LVB_P{kLCBCg8KF@iy?SPD zfr{No2&EkF97#(*!sysc;~!wCg@;FM1soM#j+U}mv3-$g)N3Wv_lQGB-v7I`)I_Mr zRp{(X1Yhl$ngW$23FNhCIkh^|44I2`gXN8>7?#ViJskd$CfG^xv~>nMWrv(dJ_u5ufjif3bF72k?f^gSzmhnvSK z^gTaSzJ8^OyLl8}Bl(fAOC&pFy56M%AjU-00~a@>{D>UFJ{ThjxRDO%+oJXh>1J;@ zHEqk5R=HgXVGI|ea?1z|gz9QZnV6b_K945ez}jki4+Z;8c8*1r&cE62>im5YHo z6onw-HW`N#&Qd-zb`f8zfcR8js2QGdCMT-5M|EUZ_nE?$jn2+E0c2c6v(%CJLf-bf zo0WX;F=4=WJKuiFl!RW&4CFK37s~P__bDV<1BL2!>En6JYo`xMcg;sOlfiYKlj76{ zu{Q1(TbN3crQ|WY1%pf_q}f84#&;;`DB_P@%emkXJ$!8 z=43Y*?N0_$Lt5<4v||3}OBg(pk%ei>T7&%Z`Kv4K+bapXFveL$pom0$c}Al!aYe3IlUDDolmpi8akSxRof@E7g;Qi?J?kLB6e#+-5g8WTY z^TET+jWEAU_okfJI$`xS>JN*OY=Ju-4P0?M@B&u% zTxW8hXuhy@?!|xbbM|p;+FG6w^_*?%>{U^>lvt_`?b`wYHR-l>Z6o9?C4cE_ZOzdL z>Q;Ty{$68f%hEgR8zXzQP!}b{=NG)z;k_XD?8DJ@3qr~IxWcKrbSwcfUQkqDSB3R= z*p2gAV>Oy+zJ=!ikjCJD9`3eB;W7mI`Vf%i)v~v+J2+_f;RKZ@aK5gP`vvuWj6t<* zfC1zmTEbJLm8sokOK%yuPki*k<5t2SxV={` zX0@UGf&CC+M|DoP8dUvZFf2@Pum%ha2>ZD1zFgP!F%K18y_{PTSCnE&izFkwnm=+PTzQKhb{B9RUukMdLdQ^DVDo zK)I0qh9mK?U{t2Z1`}{XUdOsdlB6cIIAm_fo@+C>{xh{7JeK7!E@-kT^D7Zr3U;kH zf35r5>3Q!Wr(VV7(rT}9mA%Y(q17o1(S>`nSfRcHx8&rm5YOv6QMdp=VZaJ1|J$^7 zTCu)yEx22!Z4%&lafhqPF4_UlB(c&*oTJSpr_ChzX6v=T^8)B_%Tj(nA?M^1k`03G zxq?^$;L6a%i!pm08C*&uh2qMFXdr4W5*$2b2|h9yJ%6-L68?h4g zQf-<@B$ROA9Zdbt66K(_++kUJ+V1*{oJB0Du#%o$ET@%{S~{E_9S6IAL`vmSo$HZ9 z&vnXCn*iIy7@ptloyYv|&-<3KyWf9t5mLs+Mpl#+J$t zkqDOpk}dwLLIUm7MwSZf?vOIV z*K4l{5UznYam%vvQh)ig9nh16X0jGmlL*mlZsnGp z_k=HKkC}lTMiJ!c!^=a*1me~gNUyLt$om-o?OjR$9_fx%A=ZbsVyQ+0`J%iBETL9^ zmZ}L{3vNx1f~f?aCbrmlc>YKW-ApgnTaZq!K)Cvp{M|#Ta}!O|kWbLQNRUIbw)+M; z_q}r3$-^l%&i}0NY_);Jo;X>L-Qf!^?XNG-&!X6hf&z~hVJiJxM=a4Q)!Nu%d6G^8 zTeG@MUgxEviq`h__&W5mvT>cBmxt|+LemM2R(wDF;}6b>G1bDpzb@Ah{VIvVOLt)8XU-YL`a@#@^S39;6MZo8JFOYL1Tg;)f&ygxuJaMKUXlfG6 z{JX`;-!8NK1Ulp15|dI^L^ORx2PH5y4;V#(jnna9DBu|j^39n1%?lk9%A~#`&a$U=6*43&c;cLo`7^Ux6?bL?Y zfMjSCyz}YEc>RNZE07LAV_YtlPy1up*wow%mDem)?tQ)q;Rhkp&n6zOg9bMb4~PRm zMMs`-ba_JGA2{BQ!5Hn4LaVxXnN_$kL}^FKHaP6-K(m$&rYR+~ZGbZ@i0(RhP~0M2%O_Xb&e$NkKQh8RiT+w8PCt zKUDzghhr)7Zf<3J?y^Y#608idC zL3hOm?1Qcocn?b#oJ=-nJ(e>vH^zVMh0}ZeyLWQyea%P=u1FFVC`C@tkF{$>kYJv< zc;WxL^7ZxNuF0;~W% z-^1IJmfF~UuQ+%xMdjcM2{q@H2*;#E2W@>9n(N?B>UYK+i6zT#r;pkj31$; z4D_C{Q_$1o2qL+1P$Bnak55GT3O9eJ&mT*oD?bc+V?X$6WLRN zG?2)|+dC3M!Kk}J;9W%zo>uGAW8m*e6^0{ruEzTI{)q{ajciiu^FlPpnEhgdm?}Yr zgNvP|D@)F)u*CBQoUxFM5VV&^x)j-UhoI zHk*|6>LCD|XeR5%K;ck(V(yUle1I)2A_OVKvO@M+({dWc#vCRHm1+A{~pJ*g*zWZw~ zEoo=umO}PgTJF(3co(%d)+Hzj$q0*}A(}XK-SrSvI%z#C+TY`iB&0-A74R)B_bb}D zg&HjEzWeO@HtF5M;-mAZF{pcpqU{>SR; zq=p!0R~CP1u&b5Bw)^I|=z#w**3Qh%4>T$p8UL_I5F0Y9>&*?Ho0ytp6BZsheCEl0 zvLl|Aand7n?aP;3D7!vp>IkXh*5{5ytn1_%xqQ3eeY`X0oEGHy^KTA!>v8xJ+-&sr z8zPp&CM1Lo{VPlwYn6>#aCq*9s1c>o_x=gRdfLq1^|v-qN`mnIL4FXJco&1l)B0dz z??9c)y2Fp<{o<`U_7909_8AchBbvjc+jtca?IdEGsr&pix%F(H<8x25+3gZ_UGD7B z+8W=}zj*Ww(K-I}jX^$~l$T678+<15n%70K(f%lH&i>hn8J*3%>h~qt5b6ijU?|`T zzW=%K3j&vCcmLclkCa@p3XhzKwc9tFn?TAtwxrqx_jrKKXbocY7QiMZJbm>&nw7m{ z@Z=Y)vcV&X^o#DN8IqzYUtX%2QYgw5G%TP*c!!f{a6R%Lco9=rIy@6EFMvH)&;1|s zH9pUL!eA-nFss}j^@r?SC8n;AArKW$RaEE{MNYPvsCaC9*cQ{AK8zAdo$n>InxQAL#KfP&r#LNCUmoc3l6pQp@J-tfam`BxlK;MI|~Or6&<{| zABl&&=EF2G<#KjX8gatm+6WH!3W*qHCnFY$sYOG_rWq?rLN^eEnZO%a+0s9p`#qjV z8u{R%$7w>U<1_j0^*4GK$Fqo*xHhg z?pB^>UfAfU?C0U(h!KNS%@*UPIL{h`{=rN-d*;Lk{kfIT3dU8YaahaPr`bLrk3W`wGF+Hmgy;y+i*RtJ=yI6|EnS<`SJ_b=^^s4H3zp zV%vm*GNwGfj-e4%u3jG>`svHB3#qj7PIbFv?ndG@-}ek!tl^{c@k^)sdes_(ZmE)U zI#pHR{NJAtRhzv%JBJH4f#m^P$L^8(9WyUHy{R$A^Q+BH-WA9vJYQKx;smFLC%7Dd zQcPF_fYF;V_yg0}$yf9eXjfMhRCISXLFc4%)5Pg+r&J8bfbhtsy7nG9rj0+38|;=x zpI4YPwT(9NX%1XHy|H?C8#|i=Rax-*78Zl`yGzg17_Te^IVdNwG20e;fvQR*gr=6> ziQtjv^vtaM&fYYyIg9VRWS$Pn@r-BnEj`j^z^T_W10FEV;sXi86DdA{l@2S-3F%pB zt>9D&#^>X);r7>iN&c`{*ON)D6YKNAC8TI)LZXYN&5?gTPX!&?*Qyjk=G4 ze2Dv1D6;WNnd)&y+kf{6=x|YRQ6!_;>B@t;K9oI{D@63TVK>~(sIlvVFHZ|((N_s~ z6N1>SsgA$8{OaYs0i;A4p_pU;ESLX==#LqG^_#+6$V+n(XjKt7*01}CZ>F2CZMHH& zKX6pcCnyn*ra^RvwM3Uo)+0= z+ICmZXjdyKRk3ZUf+BUB-D}ubDtbH=L>eqLAlD+NRwRxxH63dTMCpEiD9z|FMa$62 z*(6qteWd!UCx8fWZ~`8g9WodmzNqK^5~aoQI>zc3*#1Q5(Bm20-3_fqp9~R3lU&u+ zl^Hf2RCg{yy>Tlxwztm_ewr6PIy0lSiLh#e_!w@zHuny^b@H}zcK_T1IBc}bkE$zd z_Q(pPn0N-n{k{wkvHdVR!$-kYi+m4+A`|ut0xfb_>}~Tq108}~kDdtuUqHVJjP_O+ zFw%22@|wGY)tsXs^bOD<`fZox8~1VZon%Rg)zi&Vj~xHb%|FHfrIzL-E7q)|=afo? zxGhR-`|VfP=|=WDO52yrLR#r|&j+Hh2sVC!K`?<*U zg4gH(Zl3^zdO{msi%r!vQ!C!w@;M zk}pZr3DzQf=+MiCdV7p)C?gupU314eX@91uhlng?x1~6lijZ0u`rF6>qzMZ!~TVO_MufLl$|pMcNnrxP=GbSQ5d=G#Qttx!>uLCgyIiwN2B_jGoJ5 zNJQ9?=hbjLsiZjp7jWUo?`N!A`PvK#j48_-OEO!S-&pXrN{@YR?;mb5j&hD%EOOQ3 za;@y_0*8i%exAwM>c9Lwt=7E0rc!Vb!GR`at6-SC*3R-`dKb5kSnNo>!93IuUd06E zaXhb_M@-tV z%Tm|V{wof05$fUyePy9BQ(=gdsPE{2bQ(X4$;v$eD{W67;X~Z6PSyG=@UEKbXrQaK zzIaitY#Eu_{Ro|!O}h2)R9(?CHT6J;9mJNM$_a=*Sb6F4d}Fz`4oL~6zu4@UoSI@O zl$Mei#I5apXBckVca=Q6RE}poOPVTThbQ{oU}s;`(AGA5vB&}v0cL}iXe>);b#(QC z337>}mg(8;(-3#N&KIBChdXu-zCmIF)&{oT5D*K+e1@j~`@!_}914N;sr3L@;Pb_F zLstW2`-`d&hSb;Vh|DU-E44jB&%6OCQ}^rf+1YM=(#Ydbt#5=EM+EAhxpK~tYlbf@ zM*axV!KZD;0wmJ2@l$gv3zH|Dao5GHA85Oyuur=}IY#}~pVT`P=eu<1rwXTk)WS{V2 zX15j~+AOq>bFA+`MMWErd*r4juEw55*^=Un{&#;v?-R+Kj|mi+V#rZoY->wMo0wPE zJ1}ue4QZ0{si|K_PE4}S%*2~I8HZ1IU139PVt*9WK&&)#Mo)A+JUkPC@pnkkk_)Qu zf4m6>16OT^z*m^47isdaI}T>lVe+=!EzgNo}K*?a{rf+^2#;IGiK{`7&&CLV$g z2q?Yne$2ZyB5!Lz)j`?+)|7WRP<>!7tPf~l!QL~wX78ucnT9f`5c0H%^4N2s#(*m{7%~&i}V?Dy7FpsEv?<%HYk7AWNb+A z{Vc9GbS)mZ%g|*S7~1}#|FTV_)D_WEf|}&%;CfQ+X+!?6Bz?NEs|^&xxRjoeNs+4L zYHOFcwp6Ra@}tS!ld?z(mQoR77@7#mKEVWhO!H|%_ zcFzwf>MjnIDLLAv>Qe+aw%umQqXp%J6yPOe<3k00sne0iK6*h8*7=3QhZYh&3 zU0i}6kU_gdBtkGAJug;O$gKS(J zGFm>Rc>gkt3gVYDi~q+0P^M5OMPe(LKrmm^*G*EFCm>a!v}|c&ks2Dc8hz7ZG&-6( z6JEw|Jz$2++;Tb)UpdjnF0Y+No5_)&53!p8$_a1_`) za}_{H2EjlgAvm8es2jE*96issivG>G@oAunM!=izd@g=RjVeRdNEuJ^Gw|8@^bAz|HeC?(g z_ZLv!Ux^~53Q^HWO-xK;A)O*`?-y%ZdmvfN{N^g8j7yy2feIQ{h_q85Cey>*5BBF0 zSO$2hc>j!koR{z_o@r-Ga2Z^B8pAJPM=03Wu;iQXKdaA?38r%UV;D|XX5fn^xfuxjfJ(R{Sk`hf^z``L zu`bT~NW-NXT!=PKROpZ+0X){`08In8>V;S+irkd2%tUC`9TW;}$fcx#NKHe5oqSi< z%ML>BOdcbXYi}DH;6)A`e2{xw#f*@|denScl8I((^Ri~9!}kN$fSh56=`gp6e}6#a z6A>kg^#_-JX*2y|7b+Gb}&4^&eg)T&fH6zraFENz( zxJdj2WCM2*T%S)r&wJ zM#z^F!9{yCgew&Nf^Bjux+O^hnefWR3>K@fP{FpTQKsN+%;t#lqaV1Co!hQk!^nvZ zG4A+~CCH#&(Wm)oP@{vk5y@-!3kz6!SoTu5Vu?qbVGWC+;j_YntzZGo&hBE0POLMG92={Zy+S(<3Q~TocsPSW;)yb|grOj2a4L#`1A*t+;kg zn-D;U&*Fs95^@C9XgsbU4E&axd=&kyhn1C;a;)eI1UjM^?6?u}Z^n;-FWaIJ3>f!R zTpKq^G6b_3`BNNG&yqGj=6U5mLhZjXIUUuK8&*P}%hv2890BPs8+Ff7tV^4%Z#%un zuK&MQfG!KwXE>OdTbE*J9;{yT)J|^?K4s8MP5tupI*({z;$jLzn@OFvw%4q+C2@JF zR&`e2sb$g@5dT!}&Y`H&v`Hn*Bg=%H-&{?4F_kBXA^JCw5lQ#w-~a*g)|kKwMlhRU zJ`R8;URNs^&$$Su2Tdn(80RO_*yQogKghmY+x#pJ61%6s!U1V^NH?FEeP~(3JVpdb zmTL#t)Sr$FPf!R~pWe4^7M*Qfh{ZOCA)&9oo<7J+WJax~Ay0=SUj|FZ+-JS+MG^|V z7l<@=f;fH1^nxw}HHR4|ISXJzrnh@44kv~|>Os26XfC5y`_6?)nc&2xG4uTM8xl1l zhP`i5?2eRan{{-JF{Z>WQs0Pm3>JD1CZA|{x+r{m{Lhv&F#s`sbqpfxAKV0MX!0#0 z$|_{pg-Q4lF|L2c@jQPuh%p&3_x_3w{+2+F&`7oGbb!@|>A^q@!Fm*ff)B;eEeKT} zq9Z9+kwZ|k3X&0sofBHEr3gWh$_rIyBC0>iYi9nIZ@*!EuH^*85&`-Km%@!XJCh>p zp~R!trw7+6=9!`>{T%`X;znw(i`oX>qs5+*{Ea{ZQVXdKpGdo{y%$m1J|QAc|Lhab zXP2T>gfoNHMUHk1V)Kkxgx_K<)JLGf?YYL1Dbldsl5W>T1K6K7tiBUam^&%2ygoiR zC{dO^zh4Jq&&4t7;A3wnlao2zequD%j3KHE0Qa?!Z)o|QyT5RVp5$+9?Eqdv5Jw## z4OO8#HmN00y1l&~dEjTlD2TqXPEIamee1yRB7T9|pfh#GFH4VyD6ZzB6$ZPy&i2W7 zrPyY#ESZUeu}(+T8eBe~f7J3QU|%bDEZ&r&a>`%K4mK2yfcz`8JZ_Ge zUs8WW;^c#oK&3N}h#}~YMSlSXd#S0vi2D$u-PlC^L<-?_!#hrN0uul`Cd_})^Ja&| zf9JuQWVcmKLp?Q;nFZU2Fi(Dh-{SSSW(`UORPDOg^;Vc#d_!9XT*dS!cy#B-h@u4Y z_^S-hM8>EHk^uo!+B-Bh@%`ag+zCMP5J3X7v-)%QvY#yn#gH!F=jAYwg5Xycog=)a zAA9%O4Az}iarrd5%isr?>8?KQm%!P6uf&!WU5!p8dtVW%W*DiRQ4V9w)pE(!umaF>zST@Iv7x*L6EaujMBnO(?3eCR6gRbi_tZ|R#vYL5Nz4QAPocBI2df( z7*JSOb4lhB+Av872!VXL3=L_RPaBHgc9pByFJu-b7x%vnJw#YB&4Ea+li|-~!Y_OV z8wOeY?#Z;%j)g!hmnXjvb~}g5x%KslS)9^vN&VZE`7^sqtO(lWb^W8iqe<(8aj5E0{{=piGA zct;aVI*o71;^CR=<(Q&S@jv%hYZk)uXcnQq2ShYTtH?xaG`m!Zr4wB@RkSkXRrH{x z;iGSx2B{cDn{`(%s4?|}KvL09f#`K_3h-78@c@(QId1;r-hb>Cq&n*9-@7HsBHZ<0 z_DfA=o@e3v?lMCYy81lCgsnp=f4F zQj1es#+aI-1_XCiY+{=nx1Ln@q8Dj8xe91`LqYr;C2w# z4rEo2VXKpZm@cUTp7M^<5M?3ZE9^cK=#(sF8+@t@1N>PEsqttetIbuK;Tw7K{8Z+o z8kSY};;Z-q>vH-}LqVeAoK@leKbZ?%bJk_St*SKF@xh z4ij)*+W@fy-4bWNt;Rd+u^up(I-Zs9os|ok@;k;qe(@yCPXY$H3-0>2q8XO#Y!Ou{ z!-ix_fgRNvw6s)({(Xlk5Mvc}=VuS}X;4{G8p@)V?XS1*532n3c%*bzn5U})^ndb< z7gxVRLyP!mpP;-}waM8+LHU?AUvKxo|3pvzt=8EMg}}VPzbH@!C*ZXOE?Svi?Bcc9 z)v!T(>RVLq)z}Ru)rn#-0pEn4)B`hF{4V(3pixRO&`XqePKQaY}@VK?b`s9fmyW z{cr9>e$)tYepZ_9y8A6l9T^B12pF#ScYKm?>JJ)$!7_KRkui^Fz$iZa{MdzAScrAnV2VOV8bS$@lXMLeXe z!#o0keChsuXp~cnZT`ukHuGnb`Ba=8qY_Nr2|(XD=h>)6&Oq_rbYa6|gZeAox!C zfzg?jMYo=_mGk!S0q6I?=^Nqf81n(ZT`v>i2t5RQ1)r)vU=(ur)#O~C1SVhRLKG)y z|7}#BDBhjp01QnBEYk22u->-cau7q4;yKtxp&I6;zFOkkI29u^m=oTsb$y)S<55$+ABQ9hKV%*=C^ zMAxOaU7kE>Zn(I-wEgA6ch8&vKgas*YK5eH9&kUO^^kY-D7AJ{t$Wu2nJW}d4AHS# zjdH?!U_i8URc?29SF9~4Q8rx3PHo|KUfkzfUIMbc`nJKnY(^xITN0i?@GS7Cf^P>B zrX~CwO5FCjrUK+^1IE~SE{e9-rw(J~vq^{_nPV`YcH##0@D>2xs%CanfZ%DchD;*D zhkwu`|HQ2C_kbYq9MBes`oePmF8Puv;1F5;9>rMOo?z^0#=Klk(%s#+15mUAQjxE3 zpl5m>9$qHBZ2R}^OQ*X<>~it`Yh&{#^N$I?anSQV<8-Vo@!AY{2{A4;+YcYq!2fL| zZ;^>_1wr>k1-KM357DgR8h=*~Kqc&|7Pg2)gs3X4F|~*HPfawZuMzf*V$S}qdVBtW z8?|U4DihG53M0aU{bBH#-uL97Ax7IqaBq!hZ1rUq^HI=+;0Ag-L9a!Dxz&?tVYYS0m(n^b?GFeLU0oc*6LE^xJTz_a7{lH z46wA>#~Yz01AQ*h4zzxdKLulPMNU!duhGWwFg|NScL!i{$}04mm- zkNJIb&Br7L$ssw&n>;Y6q-|7?hr)_*MIl}E<=c=AVEn#RB}K8`e;&Y?{Gz<-?4~scnTn3{G$YWtrBR!^<{Ork;;pV5Wf-W zfIj4LW-Eb@$X9hLwmgdzq<({SN>aEpnYBj8Pze-yC*x*F0&6`wBH$t_=olTIYn@6$1DFLYmX}w} zOijZsvIV4r$(i8Q`zK86s{F--(UQZ}4qvJYVNd zUfoZ7wcsZGy*j-P*m$@bMi&fx3wn$b@dhKC*FT;0an`{xKC~g*s?T{NEhs2HBH$5r z^J4Y8|9JguIyF7BGFt6@UhaJXr*C*WkE0w$<=g~bjKh6HUMuz`4?+KVL0^)R1zUT5 zolxlgD5^VV3>)#k_ZE?!exjpZqef*Khut9r-1^EwT-@cg4YRWgwm7k14IL)eOAc#m z-djWjC+|Y60z)4c|8e{7i8)47&5X|e#b?|ITJ44gw>W2^EyKV7OfXZnKB_{iPv5^B z|NI;@#OYgE7*;A*;@=@2m8;%a_RG_B>BPg*_S9>Uc2AA67V4u~^3HAHlZ}5!QXh-| zW^}IF66Wc(fJHffbciryqs?hpZ-2Dc<68hn$Vt=Pd9@v-mCyCo;oad!&8~p^=0dj% zJ5+lWNF=Z%L}FYif=f!{3T3D?39d}?jSEeLxQLHU{O314C z)Obm{EHPStrbW>*X7)y{bE&dBp2~5~9}%8Fv55+NOx{&mjdI_hj|EqfCUV9fb#HqV zwR}q|CGg0kofwvk^wG>q1a4;;P8GyD}m2+{s>LA`dyo{nk#A=h?~5@C7f|p%oyM zmMv*ohjiT^f~?lQfgPow=!dQCD+_%U)u+@O-&Q90-8{9F=)n~}V%0}VakT=LH@MS4 zHr;^4r{>c~LqF^q(QSwi12VFbSJW?hYm?RZ+n08kSq?mlQ6cxyzP*HZ2j^Y$lT2fDY3#s`1=oHeNXqgUzmhi?mrP7eZFe_Qf)$xMMkZZ%Q{qE z{ibn5Y`)Bpo1~279)c)eE^Tu9&B(=H#uc1QqOzL37?t-2aYy;d#^-ho zC7L6Lyx7@NdIKBnSJ5}pK%tBfbhk&#X&AU`G|5iZ;ZJ?#%hwkzQsB|5!dVvqBmG)9 zwLBg!)R0Nx3PsAb+NxRNNMhKkmzKF^^B&m3FAaUzQOaOIiEd+~|Dm(zhvd}kc!gxf1_6uoA0W*jg zWLJ?r4qvIzVl}l-s!!_K!DJ0?lY2X?!TReEXix-^w=1K$zjG?cPz&xH`=BGoZvZ({ z;G+hFp3GH9+Z0eN?=f|#oHvWc#NG0iXzPjdpx>o%|NJP#SMg6Ov zGPhJIB4#hP&XTyaW=2JMgjtbJq9e-Z&lMM<)F?IpOJ&x8!7p1K>3zNwkY`F%luse) zl}V^Ue#7wNRRB_p*9%7qqyBG2s@2%q9u3{EJ<8!)8FZS>g>Al{8M(Lwiy(qT{L9s= zH%O84G-fhT~eQM5r~_n)yGV_Z`Ecq9%H0@{rvyED0C|!N z*X`3V*N(_5T`&0VE?gMuucQ^P*9?2_fIA(SJbWgP_pO-sRJ`UPtKB%_ie!TdtO)T< zj~4YG*T>gx&nckX6;5JEQfV(1~) zf_Y4(haRYT-!bj@nA#h}+t5=jAV>&rUnNjnn7H@XtD^dx7?R2~R%C|?$~K&iv3low zMXhouc)8@=!(H`>N8saj{xjXwzN1d7V^9PZXs@z))6BsEMUqd1N9Sc%viwf zul;?~@WCAtQ7L{x*9AI^JEd8@C2zx+!9lq|rIx-TRce;z8llk}C9p(z`1wB6L-1$1 z8kc4m)MPqeo*quH_=xSC!}nSLS<&(C)#e=t`f_U!nohR7Ju$KUX;Q~VdOP;CK(UQPshryKqlDJ zzXG)9j^%6&vn^DN;kN|8u+0h;-HQl@>_8@-hAB=8{GyUhxcVTR zZ$4_AoH*F{q$%SwiMHbDuxq^911bozvXj%PW7A7(1CMXqj*xN++PtS3+Nyjp^^`Gn zt*yNSe@Hj7d~RsV>gz)RT##oMdlq)z9Bv{= zMh#+^1Q^-zPQich^QUp|PSh-5sM8PFB()0~1J(6e0 zBmqPoYLmB?FnM|DUOCIwCbQkxb7>N2Daife7xe?#(>^lJq|U@)NEY?JG1EI12df^ z?nF-f6QPhtDn!Q*2m>0(%`W%2douIKK9!hSHr9T;>h5pq>YTZ)9xn_@j%j4W08;12 z!xk^6QAG*oS*_9rnoxa#ndD)exug~WU10&wWW~pqg>H=Mb*_vN~^}E z4v@P8LgE^ldRv>zTs}VF&TdVt%mVT&Sn$#Kc_b*pTlMX&;{)?Pvn%K-yKXJKO_QMK z1xA&sGnVce0Gr9^YnmeX=vMt>`?whUXnb~lHHsl=g%L}NgFFp4r^f{ipPNONd?z14 z3Pr%ux1}V0iTGFF&EwWk$gS%G6W{FA;^de8y4=p9u!X^w4yU&-hdCZ$P0o=~=eDS& z5=;V@oezlSIqt!mRjv){6gjlb%oSVOS_-xO5*d_CfkSU3Y1Svj{1z)q$*fi1)g{N0M2-@pOtZJVG8H$; zf$D+}fm^**t4)U-AsGtYdvGCe{F{zBSBIuXg$gZfV5AV$fRAITxhD*OuupdlZ~7uy z@?C&(Or5-P5-0&NX)j=(OpjZkR+S>bmUM^9T`%Z-0)e!aJS_MN{?oO`xnR`)y`n*% zIJVieWFW96NE!C;RIsZDptyGtXUi^o6IF%{#ETh$oqIJcw<8-sh;X~FO6FPE*bG<@ zRr1FYhZzJ4tBS^aCgbm^zmD_A5`xyqOe-K+?Wrx`U(ZVY-T4GBCH}Q}-0l4YqfMR< z07Sq$&CTu6m{R;MwzRV^s;b)W#6E^vjvbJl$;^=foCxM^8Lxhyjb~`E}#r<_Kr+;n2>34I|TP6ENR7}10 z&ljT2+=6nLBAcybwsbu8O*8sKl(@yR&eoLOw+K+)+0%Ll=O|inh}59*&+$PSdu6JN z+D6mm)#VK$47`j3i2OIJdNTtp_HLws=R&Z?KaleuT~ z>jgtOp0x>XddZpn&Xeh13K3twl$F+RY7qT<16;z~bLODuvVW+-3KK zk{I2GsI>^+rTj9pN^E*{#^T?s-cvlmXB;W9#mdJtvbjkBOa-^s0W-zL=FVG2^K$tk z9pmK8O5*nOGO6Il6PCxv8&d4g=Jr2*v$$Sy@G}~Lqj>704Gr5881`M)xYpy=dp^Bm zuF+Fnk8C2=0xi!Rv>DtCd@poLP?@0-yF*laO`5veW{#eb=95_@nD*qjQP;f-4_r@T z_-RwD&5iO6BxB1VoF0Emr$_^J!|^I-`jQ*ruHUu`Sd_lt6#gbhg~|4Kw!8-<(gk@& zHZKs}hAsk_oZW77|61#KJm{_l%NK+rJ`7#f)fRgkyjqgN()1GEykxwtz%mU$4sw7@22jL+*7zIXu7Ab|DpckR!`zWdJT z%~^GIU9Eo4w*l_O%>BO$r{uhC)Q5jFf$a?KHR}q7D#crN@PfCJ@Zq&3yX%28C3S!Qm6F%(z7J;$uU+|X%rW-j_!De8K%c^kp@@QbBv1wR-O$*2?rYxoAVl@mG~7I>1sL2e?*pMnP|JKc+Yx%D zwLFuX+oC9`pbz*RO(pI5;+58Q%h8Of4sgsEd7e=W6M6k=y<@M7n&8Ut2;b*Z5cCNi z9AxLj!@pl(EH%$#4()NomvOV6pU8OO!c-xNgunXJEqpmrD zBI>$=n;V>7Y0v5y2jfSd3^^(@=ArQ(EMZ)ziLFmUagIlNI5Pk+GmPBpd!h{GR%&W) zwr(BFA?-rmsfIDOv1=dtf`cgyx!Uf9j6mP32R8P+gD)^_M0LJ5UvjfBgcG<>huG!M=3( z-SMNQu@P)+oY|k%*0u=^#PQwyal-cQdXn_}b9Kc8PH!uw93^~IVs!fm?dTa)SxKO^ zy2?#>Oq?Cc!r%DKO`Y?yyE|B7dJQyKYg|A#0UB^Xmynh&Vi}ePR9eF(CS2OQv>Z0L zM5Ij~JD#@tMuZTw3!;XqA1x|ZHnoiYzT?ISUgOMOgJFT%2Q8d{2D~gY_d+at+c*oh zp~pt;+XfEQFd8xBMQsN3X^E@(`YFfb1$$N=mS2baX&G7DBS$d#*YM?T!!2&ZMH*pD zj<@iVA#JHSIFy7_SGTMRPH$swsp%O*4>aU7;qixmcY@$#LGBUdOVv!=+zR$?co{Mo zfPaAfnzLy0%Y@A?=qk|A*eNc~xcHiea7nP`o3#RCYm#ZYEJ}V<$K$$_EXXJ3VyZ%qq1Bl{;Eq=`P$6oF5O0~u6sv}zw+IlB{lsw0Dtkl(fkh#a@Y5g?&|> zJ_8e{SI+gC8+9^&qT`Q3BPXXIB*BhRAXHCP*EBUr=j|1MITT-exus@g4Jn~;EULG< z91;c@p^%{C2F(ykXe%(U4yM3XV$4Eo3o;%BN9}7;s5iMEk9QBGbiYFGp!A=&C%EdC zvyVjua5z7>0!SDoyTHv&Jx|Xz4Xt$3ZdJ3bBL~kmuaU$1<0A{QEIWyp*)k^B05bRo zpeQbt@;h0LuX?2C2T_{r5H46C`An>VlWjuU3+vCX@2fYKQbWgQC*=CqmNu4VCKkvY zuwyBT*Cn~vGi)5qySA5#bY7X>ukdiJXodCE0{D2wK0a`|_dSfeV&vAec(RcSntc`d zY|V`h`x~?!4%ejh^*7E94bzJYBDJb{#qB9J#$>JD(XBxM3!pYo-B7Vk-ldd}l^tkt zeqwPOqUd$6u&=1qzp}Ko{;e}Mx41c4TQIx~(%l_PqFryfCfRo^{Vhdc^#QzeLerwE zphcAlbtxPED9K4GwZ!G+Q4}G*#>U1L!VWPZ9S7{2jYGoy^zT;&J@1&Pr0=n~r4W@9 zaC{aeHwB(%n9lGn1l|w*+p_wT2^Y+aF)PST({x2%1O7J2d_^!jx;f^c)j~IpM?u1QZ z*=&2T;sPz6StcyPGS;j`Mlc}ON4-X8|C;TNQlLeLwSj|kE>_x5Hi%Zenp8Y<@1rbWcT4Todx58%_l?zBTV2`F`Q?|6_eF7KIsOvmIPFV)V;@FI z6%|(P3~Qa%`_HH2Hx)J&Dl{G)FZbGPO^taCQ;&~a4;PzeW}f)^Vri-Ah7Jb;+U;u% z4@k%;s6h(sX;Pnp+Lx%h-B7+W?BWY5Jom`}jIl3;8Cu+)CW)#n!YWRzRd{3>-$)b5 zlci=-CuSE{!w}{s!GruN$o0(l46Z$}&n2-Z{OPSjnWC!8^<&HQ@s{-bXLB@kt zLDu2g0!ePCduF3+svDW{LX{{s&f+*!Z;-L0V|uV`^35S(aV@uuu`$`TMWign_{b44 zUWWGGUvVB@?NK()cstwQjg48!&X}}NWEOT-h1LeC(N*%#ZM?@P$0QlHMqXY3ue)zF zA%U5L9p=}3zUz6k0b?bm;Os6$M_!M>-5;-y#_)G{@skvqsrsZzR=J&(L1J`aC_hdH z95^^Rsgr4)ADm~GHpa)EX)vaYEpmyrTL#c9qod*LnFJ-tG0iPXauyHhZs5jm@9tQ6 zc%%Fo&Xi$Ic(nOn~Mkag$?rzA1*j^Da4d*4juCFe7ezO6U{if z@puAi*H~;A$2iC(j{xFPNK~$o5Ms`!_yOovo94%_4pcXD*Y)hQa$rji`CN=;(t z=-=qc2VGj=%|Vlk8{Z#9T^^2|4&bR*;;G{A&`OTybaiFiT-@GHJ<4b@iVE6O-n;aI zIV+3}7I1mAZf@`HnHyZ`=U5Zy&}l1h@l7o5tbS7zUpsQUuGd6;_vv(YxvMkmmk5Wu zks@g|Jd}Ta@zSi#&$z!w{2PQ1X!@rM#Y=-}r7T%{=(y5|jU&U1^i;eaHNmlwdE zntE~J3Xo4=YjvjIPa?|aaLZ_0({gUM1U$8RU}DnV-rvPd@JJD`@bmW%hJAAdb!0T2 z21CEbR$a)qwE>*ix&|*zw(ymB`StYy%C#elaVS8i+0pTdiOC`2YtLcdkw=qlxBvI@ zF9lvw^I;Aypa>Zh2s5x6H~YT@EeJ~O!Pltz(PS{9gFts^xq4-Od3yquzIU8T@l>71 zE(eDV{?7an&hJAS=R?OxIh|Zpgq0d!0==OEFLA+2dhTD+X+cJ5N#NyFlT$MbppbB$ zC|14XTBpNQ{Y>NjA(X{R-SO=deY3My51w`{lv!f~Q=-8j50)pjx>o!wdU^=0I>$Sj zaHl!=D#E^mU&fNrWPB-2i}=+<-cgR?b%whXYR)dX--Aj^9acTn>Rcy?ca0CZ9qz$` zk`Y-}4}1JmxCNPIT6dhLHrz-Pr+R@7q1R<{GG6=qqDG8iC!C{8VXKMKgkpy}hBOgg zUE6aLz7QZR{w}6iVXI3ssvSA4?ixFljAm}|O=YKjIWZ&m>#lvY|6pCQd)kj7Ysjj9 zFB7lu+mkl$HEOlOS?h|mdEmeATuo0Jqcc=t$TkK!F*3Cna)N7ynBTvpPO_h3rD8Ju_cA2C@VLyv+soNNLUmEE0vPGm`NQGz4(C1kevvz zK&n#zRf~5Ohu0(0*q+dIc!G#6%a|JrIxQ`Gczn;oauluX6UxN5U&!bYrhyQg3F1bJ z2FN_*^RSQ|9=8bcnOuWLkOGf+yx2$QI(5I_UXBSIuk&8w&$}c)W};UbHRv!|Yh~u0 zqi|zdMWC`%#7}?Pthch)DQ-Jk{LDU^JztgLK7H0h)RFIW5fj5n;9 zmwyrh4}U+m)EqC$$QOede;*lw`Eyz+0Bh%KXoGRGRBX%7$W?xvY2qM=Jhaa#8kV7f z1tnN+L%Ld$b~B`!UzZ;B(qn8oqg9BlI(O2kCM1TLj|$1+$qRy9m4)sR(3 z#D>Nmkr796i!4zH2(U=I1laQ`zxk z%KVzYf=g0mP*R_>Vpqr&#=gd@PN2?D;+SD6`jxL6ml`z{ZK-4b>?uJ`+I&w(sSdhj z5aSKwtlTCL^@6*NH2P^JQH$&zFcNh$|E1@s)h5 z*lI&AAudGI2MGFKoCdCC-1gDZm1oAt5gOj5;+ zS7YQ#qtTL4t;Vbor4_p6*AaJak?uag?XYk#f4e+c$mHVT5x3U zL15>F17_skcaM~JxCu-VaLg$!*(l^tP(G&ESlDp$3W5tm@gl++Vx;pDf{W#G>%U=Y z?2we~o~l?^Xwlh2%?!jt%r8)8m8~=u_kL@FR~n9&5|8Cmj}0}U4Pp@Xw(YafUfjf( z@tKV~iW_A>=>&<9vYDex5o4jDDu?kuL10xl~(;;lxv4mWnl@edx~%Xc+@9 zozDVgVK?^xp453(m^A1(7iFf!gq5%bp)$X^3^|N7QJx=-Azc7_1sJYQ31@Sr|cwtwhgrT&{lshtOj7VV)BDp!uSP#H6p&}m0=Hsqf7@?p~otvZ;$jO0%v>9?F@Yy+&s6m6r{XxlyD%Srt>Mp zQPC8jan`Sjt)2{^`s@*iDV0YCE=uP}RxXOhTNF*69jfJV(2o!IeU~svBf*G2f@y{49>E+{im4nM#fuSn-DZt)&ZXGZiBkptUs>$-C`u398*XZteTn#$!L3E9on8Z#Ar#U z9j01ve-v>ftPqCrnLQ?kOVx_jvpY>*{5x8kkX5AQ$p*RdgYc5Cq{JK3U3O`fBPMoDV}qe% zSWeCCYpa@*Ul{F}5rfJP8xfE>&g9WQMxm)H^w0=Y8nCn`+?X{hK~5!amSnQns}@$&iTR= zw)Ziv#9LO4oU2ommLK+tGEEkbzPky zzAnARq>Wx^>^sw__WBhQwjmy9Bpun#83w)92swQqnC|3VgU&v{xfreVkanY9#hNf6 zIvL>`SOO380!cy>`qILdsyo@liRRFlw=RlEz=I6Ssv4e5_3>*sojPf)6V8dfF8Dai zTzXQaglC8SYp{-<1v&qZd-2=N+S_Xxn9=!EkSeFz^J#+j&Cg{(AbU5QzqU`R5EbEr z#6xnPSCw=9xuh!H{(FP0;p=%ckB;hkDXNRr@J1u9zZ&jwYV82UM2RRvRk4UTNG4<% zd^{5m0VBM-zt5lPgf!*aZ8t*PhR#v>Xs91TItE-K4H zE;|v4aTt5}Oq{$)(!vZjFBA?Qm~&-H%VBc+@roH|s;X2W0E>`X1f6V_LbaJ2_b zTi2>lH-KB*>V1%CUUj)pIMyn2@bEW11?e4amb}hEQL9u@BJ{6d9Zn9|jPM05S()@V zmtTU75fliB5&Q9CQ*vmP3C`2=L3&lL?5^}h&EkIt=GC8@QJ3ySH`-;m28?q~LE1`K zDOG+T_RXSaH#K9L6p(rZe^dgG>oGRHAfx@c0R2aoJ;xk4n_6U%uJrM8<}*kJHNnLX zjoYUbF(!CP?3^|E1Rj&v0nNGs9gJjMY-|zDoW_R^P*;7Y+%WM)B4|v)6~B1d7_ODlmjAa z!T&30!_2LDyK6}uYR9!dULmz)YB!$Cau%_aw^YDhuDemL&N@4X0yO)($uo7%q)XoQh>2=}D#y z#Ax~7Cv=yDOE-x=|M$-lpV@Kjvmpu(KXndpzD~ja><~EWh=3aN5z~wp25JBLFRE5i z2iDmA0S^3HOwq9G`*&>+oq6qoRzYG}20W4w^>?fxBM(N43TszXiShQBrvGAb?0EH0 z%YTNA<{}drI8945 z?dNu#0*G@p=yqOwH=ZV%=#!hrwX>in7FoyJ{na1F|Ca*lOw}3#gE{_PrhwOxPaexE zS*HXGOIeyFO}0*uKQ0M_BsnL<%!qR{r^>o1TXWL`!tlAc>EBl(AW6tIT7jinrHpH? zj)1;5Pw2`HWlHa%~S(YD`#MjFw#F&}vpRr2kF(_(E9jYR&M! z33l8_7~h{>toiRAlAZ9P%uNvcW4#6ZzSfxm1AR$-b4=vQVFt{8uLj?Lmsh7w(UNRd zF5Pen)ZEd)l1+TF%0BSEOH;ov#T6*nB#Y0J};WUY)Yh93KjVk zB3hxtM*W)qwT~Mmk>}r&NdSa_kw2P-8_Y~Ea=GN+RYmJ8lJLv-$q-e$y9FXgZ8w-J z{h7v)N<&rYcM8`Lju*cc08y^w%;9wur)^uy!gj1WMJ!QTbdHWcV*gFPQmg!{SA34k zoh~PY_TTvrSvJ?jB0o+ihbCZ|oc?c-eHEXh$dkY1+>x`6nk7~Czzq_Tte!9Qp%t>g z(Nq@KU5|2|^dzg0KSx2xb8h$=Pk#bobMv^{l789!r%Md3yp7LNx1A}98^K@kmq@I) z6)tO9rc!YOeR6r`K9AjIU;V$CN_Ip4Z$$^CYgj)kqZ7ws*OoXaLRTuShH~dYT2LZ} z3XzC?5@F=VTniR23~mfnSv=^Fx=Bm&Gu^|iRC$tWhs3j{7g<^ffdE^nAlD-OAv?nJ zVC0X9ORt(Z{3tC}3rie-Q)_?;oxpB*wk{&+fd=~{{}dw%FVI5pH{Z7xfz8-bTVU-N zT2{)rtsXu0N(I^BA51UH0j3Dt9qNB~2N};%hGN#%^+s*=R{T zVL$z?5mOp%T#XiYS{4TMvL1pkWq=OhGIRn3!d6G6%3@~mY%va0dM=!)ktLcznR zuD8Yd-hcka^6Wonp=^F^V`ggeO5e-OI4!L>7>6jrWuc4Kg$pIDkx@*IkwRg+!FC+J zyh9Dv6Jayb$a*qhKu#xzK4gVYRGC2}GmksPQ&$7KVS-4X7w59L>nuVuRwPF9L%DBh zZ$;y$xZ}A=S;x>UZM?M>-gzb_(~7Qi zWNLgxu%ak0C%%ySc-%^KWy8P0Y_L4HnskuB-VB%9v)u3B-mYiMfu~m9l~<$=70#i^ zxYV6TxMEIPFa&Pk9dBv1^vP~Y1vS=7_r5q#fO>PW`$K2XUK3sgh^7aI~j{Uizf10u;vXlR_p z^MI~ca*C*P=aBHnK9M3p}|0sT!_(Rq?hL3 zTD8PI8M2X)gQZG^+o%wH6~FFstG>~2X|mKEWD|VBNQ`&KK`Ii#r-u0+BuzZpPFR9m z*lK17t#UZ|ckU4Js@F?Uf+K?rM2eyX&VVa^WStoqI4!w@`b;v5A+?QMl4z<6*M3&J z?-Rz-DFICqH|tJeK@g!3g?!Mg{8@_^x>VL2i$NJ$Uq0_!{0FNG2IwV-FGliXp-bDaPZ;^y_XQp9;oC${JoEjbe zCM>ivba0H%>A1q*1CIPi)@|OHOy0ih@O?xM(f0|^=_P@N^*)N$KGvH-6hqS&$7DEN zv}|=Olvsg7J+M^sKw{EU9c@Hb%i9ZNy5F~@3@BxNGr zdTQ$c9N^0e)J#_7K3i?f+UesfmXG>O5`su%d~;yy?ACx{B{v+-;d;J0q-}4ya3cKLV{YdfEteswF_XRh0{XDm6LbhBlSEWW&)O@c)X#PMK_5W- zvhp!U^y79yl<#To4Ias!qU4e9edA;236R4*TNbx#KL>Yqbw;*=6sfOa8bkxFjfZ3S z?6Dv!ytxy-ftOp-He8)wzG6v6ca5?NdL*+0?RTfY3HUx^DbN?@n8K0~(I;>xc<@5;q}toM zZRwex7iZAR+}jz1=_8iaNe{~oTh8zBefts|5>h?FrUpPpoen3Nd3eTF>dkQo2=-|K z`4oPBew($XsF%y`9Aaqq=i}mPp$lM!O+6}1foxmnq3}EeP|}hv8aTD@@FxR%B^Kjh zh?p~{dJ*_XVZC2wNa%h0Ij3~Uho zYITjrIHE+8eIeJ%*zNK+fM^fL?6CJi6!rny)MMm+Tor)>TVS=8 z<4nR_J#dWK`M9m&Yuui6mq^OvKH>wr=8a#d3I0A|{$0VO@eKpeky=`-D=iKfjGgYG z%9h|O6;oko=2v{suQWJQ1zOZj2Y)Ol$2ED@+OAkWchM-(C8g#dEHm+CMvh~M{8W>o zh7mRXF5s}k1s!s}*3@;Vz6bhv19|KxsUMx6voD%aa{~?+U|T6tr24U>>sH&+GLlTM zeKHBx9}8Gboz()(>gwvJ)XYp1Lqq>Y>m`Pa&DU2x!M9_Drz1(haAdF|bkN&{+e)hw zrKqUrrBoU~B{S#`4)q8em9Et&Y;OnX&^}()fAk|%=sYdz4)!ydI6B66bqNr9oiPK( z|L0&L0~E&xCMzp@bp}8^0F-3>sL5und*h<_r5DI}Dx3fI_Llqw_@0r`udc2xnP>!c zX=VWdc|SivKnRx$z+0OEp#MvacOch;{V&%OhZ;p6l#IqNP|Y;-bc_VAMu!o>n4qel z+G{(yT#}ulpWYN4QEWyjHq`h!4=ZVr82=~5`(m{*?c-U0>Uy7%Xe%McJ6yU^*3u|E z07`GGZ$%a8J;G@wO~@Yqv_%Psnj|GdNsC#omqw~`8gfcivvJ7X9Mn}-`5h@E0h zV8zp}UZYW3<1qJS5wUtW?pL&p)Np42-~A&}s&3{%0@6AZ7ZuSD$nTX`ESio%92^Mt z#3>Ub1UUtgpuMAQG&%;l{8FI1qUdR?29CLmqGN=?hoZEx>)wkq0?%Xg_-s?-jtz5kmXZM~%BbTUs(=)UzC*vMQo z`Bf1V1ljd|SAFw`b&83LYlJL@uTHEddEE5G@VP(`3{XQnum{+YU-$Lj zznV{Fi(6+!-T)*$W=2MUalJfTn!i2Y0nHq)TM`)}liw?OTQx)iJNVC^KL7#i6mWA`3_7{xB+vavGECC&=-H|Mx)*g0lZ`z#sF6^D&W`jop()1bBC(`o`^P{NC5rhZ{%K~hwP-QhJ6|5WJ`Vx8#* zvYrfFYem}f=y=m~{M5|OH)L*;CLxAP684tpPuq?+7fAWperX@C_st^*yvr`T@zB;uq%YF8yz7&g4sQHf6NQ(i*rN-rjWWmAi#Y95^Bi6 z)41`&>%ian#0d^S2*=~T8vES!e6(aa;eV4+#2na^IqN5Q7?rUR|=rBF5 zdZ9A3K9BFSoGw)#K3?wv0?hw>{AdE@({zY{SgGpH)pkEVpL;BxeMeke97@-9l>Iaa zq@bXHRHPhcp6wCLYCd^&tl*b!JRD6@w5JVv1~|4vGX?#!6?{%qBBP=l9H^9(qX2hr{@D}1YmDJI-*ih zQ2|U4h!=pkEtA*%+4e>I_|(|^Mt8nheE{PijyQ1hVCr~-~kWaA3lJWxVgEp zsC-&o>XHD4xU@LiXsyW>pxt8;5SZ-i0|UO2t5xYZPT!o{cmQAujTg$kOHrq#rWyb- z4jAwn%Q*@??`!d)p`jABav<}KV1j>|`gm0U0;a6CHr`sZ{b3kown2X|!k#0yTD9I= z_PqXh5=$oed|9E=K zs5rW&Yd9eUcXxMp4+-w>Fu1!rgamhY*8qXRU4y&3y9IZGe$911@3$8GVP-YmeNNS` z+OGscI-23vlW8Fqo&S;0g$^d1^a5|cK0+aKrFZZ=Di z2YeQWqYT0sroQUP-~;pk{8$*bbqDl}#`W+W^`$mboG)!b!s`X~;2>!=$NM$pauwQ?sAc`*yuAs!Pm_IN#+P7U$%-7X7D-!+%mt{!=XqHNrHaY z%e_x(g1N-y)hWVV1xZO=9y=H~c{ww)BBEwFNeW2NwszNG3($4mo}<-Nu_4S-|6K5W~r`EBa1?^QgS8$y!V7{Cx5umj%ap z_0q7BCw!`7Z8`}IfLi6C=J>NSrk2)LM}ine9d2bNT0puowJZUb5*H^o%8W5&b_LX! zR9U_?H-(Ni);94dP;K;Y4hz;)m>BGRU<4ClXkW$cHS9~(%FfcJ) zWu5zkOid~IY(UEv+yJHpzzjo14ls>iauNkFbAi`~9Z6bX^LPU+D_|o2B;TyZs*MML zgV_uj-1hsgPv-~E|E^EgT2u5Ni}bgx^`G!6+wbrIlLMRpFiH1*!|&^RTK05zx&wHI zlhx(~0BoGLdtvF4;DkeaAy$@_qyUcN{X6jR@C1TBsX$KmTdj=8X%_}r;Nk-?sKE@_ z);>G<8=GCw#3leJiG(0g8a0BLc3POEX#t~^Xa?X#oClE0tgE^aCges zK&ukZd$lBe((s#%4*dt@FV7LG^g?yp^e9o-GV_3zHw=|KMa)vHM7S_ksdcvN6140b zt(BuL#ik`x0*T8UkZ=j}sc-n_aw@x6sPe}(-BTBL*VJacq+jGJ-)Ljg1Q>Bg(J1%= z#3!>kt=IVEgMD?u(Q4K^aZXK&UHD#|X7T($!qk@1*4DAKw55)mzZLsN zdMt#K8zkf1D&pyw%^lq)U-bJ@2J@_GN8PJsS!p?PWzJ$p+3vPt&sS7?6!zokDWN2- z;&6Fm2JOO2aLq zVci#ucwBIL?-u^M-TPjd0Sl1VeF7SM{^Yasc5x|x0?3lv7j(d-4bUvza*)EF$SlwsDT3zSv>bmtL2*jsA zp!$1`4mgXd+v;}N==aq43}7H{kuoePB#?A(y$~8GW%@7`#jF%?5CM$ z=K=ec2PsW9cz#|T_`d)+o-9_AH**8RBcOk=6Oa^)XY%$`=(Yk+ivjmp@H%Z`a&2vF zC+4essVbmEOpvAO$^PQ)KoIh7Du54~2F@oog#ag9yIEu*2j5>V03bzuE=FdxS_A`9 z<)Vil5zixg7ruapgiH0xIjf>i8M(Q;Q!Z821c7Av zlEeGRPESt(NBPGiK2e$yxKU|Zf&neAHSx^OhX~-uz0C!v(7jy~6SYrkRRLwKVYOG2 zl6enXV6@H{!V;$0i_F5Gjh=Rr7JMq>!HpOVv9Jj!H6 z36ano#u%JgSy|=UoS{3tG9P$hXhR2PgM~>#=P{zBw_tvTju2@TCH?`CgHcj_=tvSS z5A~}3&oI|)mTQ2ybnAohlySl&6p~wo!}ir}Ur~fp54gR=>(z%kmRp22C823eIeK_R zkv~hr6he_=FfxLHNmZ%x98sRhJA1BTau$@A=3wSvlFFGqn#WBW11|~#5FL1qX@)wy=WW*%;~;o;&M8W{W_ zfoVGWmC@vJNhVFJUar}d&S@Rb8hpHvffNkHnSBx12^Wp4PVf@~*9gYO#x@%rS<0oN zMap@A#`Zns;^627NR4+q1VUQ?dfx-g<&_omg*E9S{{zo*-PUBM=69k3h@)(lYCca~ zqp`LFTnNE{ApkEH;P=Qs!D-F&APXq$Qc+O>kObU1{(>tm5s}%Hbum*@bjvfg;F ziCK6Kpd1r7|IZYD9pJVW%ugOa-Q5>pQMV;wF6D~}P4>zlNr`fFCH*TvS1O(Q2E!97 z+9Zw|#V-w~}5bBsn^%n2tsLn~L9CT)p{c2Rs@1nGdp z5n1uq+8DzaG27M6lfQp|XRK)rj|`M1ZWpEKZ68h*go!oc0&BVY{pr+xWEp~D=VJOG zNxFzK|DV%C2e2z`xH2?j*Uv`#I?i`I*J}pK=B#ux4RNS;pfd>V3pE)!z}3M?(tC`p z)_Qa{C;OS=)=}qAuK%LeYO{e$QDsDKKfAS=EOp)|BFe4VZVVJy|#Ng)z1) z*>IuOIIc;#H}uV~$Wj5ZDDb7@77H*C-%Iw-18&XOr>WN&&f$N0&dS#USL64Z?Y{8! zbl#Xg`N3Z?BSgX=EiV7r=yXWc(v5mY@1x+VZ+VXKxP|yJ%ws)8cp8qc_!D*l)be@B zz#ws4tw2mmO2UJ-@31MFj{~N%+fqRmUhNFY)*oP_Vq&-A)n11Mk(H(GI{ujfzx(c# zuV&j1K%#Kee?HM7FtLX>8Fk4Qt&;LKQnW(D!#uEpo8nPgH8zbY%rIoX;~EpgAFbkk z;>xv?*ndeP7MI&o$-z<)2ZV-J87^_quQ`?I)}O3*xCqLqahztaK*vRo zk!xkJ5z3H==92Le9H{gr>&1`3I$_0YPOIhQ#fjj{)0gp^B5M9iZHh2wRpB>uJiGQdF4^L zkptIOs1d_7ner<>^-?lo^t0)uc^?(yT5Bi!UzQ?wFku+;udOQ zM#_dN#d{I0E&KP=eS*w%MAqCU;`pop!gANYYJ!;;H#c5>ia*H{<1a#M;00xnPPI5700?7BF62h4-S6ftMPyv zeeGpzp+Yi7MP!1}N=dHH<0};w^3*w&G9!#zOO8dVL?f@x*At3 zv-VM{124QJg~Fy9B-T5jyttbhD%XrSLDGhQt4r%T6jt=E;?Vv-g@_7MN_o%}P)4XP zOreu*WtE{#NDF@#4|(0VoIpK`CFmn-;n;V-8jv!(i(`?2;j!=)ab-}zlD>33#H+M|;b zpMjl5;GNPBiT2q4$4XO*t)k3olNW)eFJzey^6D%2*GK)QCEJ)^+<8Z&3mz=FVC8n) z_@12*_xf+rIm?+BCOZ;2X|iG(y~g*he44MB+{>44t&(%h965iXF8p-y8PRR+kB-}$ zwn6Y~K7LZ?W1Dv5C=)qii6Sf0N*~*{P0ra11Q~neVSv`_F&UD=AcN!JTRw3C`xuSYv6@SU08q+)0hdQfQhYK|Be{@7z}6a{{J z?C9UqJ;URyZQydV;wXb2>n@&=s$IR6*4Z$cPCzK)2jT7LG5H-`rbR(`H+$giup53W zU9OkcpLxi7uphYOnm_Gl;{xtvu5>S(yGT{n6K_ZIfYsM_M}YZW zpt$ly2ebLeNjFB_3s~NNo>l*8x0Eex@d_%A=X+Ck7}7eW>4T=jn{<~Kf5>rXXD~j+ zVZn{zRXG~-M;|+3Re8J>m6t{#KAJ^cm|g19trnGgq*$j82y?Gv2~!Zlk1=?S=+r@K zm;Ex8dyDRqDTtMgC>Iw>l~JJhzUR3N{HR9nce+Y*oGYYnM7V4= zAz6EzId1(N$%(#R-?qS{QR}sSvZQzRonzlsDg?XUyM5K!=081QTfhX9!2i<%eEHuF zpY|7G=M)?|0mT7?v{^Cr5oikNrNE%8n}tzE*{xXZb!$aVlGyKPHP1~7i5CTj5xw(a z7Ph5d+_M1RaM=ih`!z$$5`W_7W3`9WP_pJ;dd^CuOjgRcbz3{=l_}|-C+5g{j$y6; z<#ulxhBQhUMZ5%-RB@JSDf;c#XHabor~7fFsGZ4FA)yJtA2+P`y*5|MZEU;i|wn9*jpwIVvy*E z`kS4q`sc!!)bUTG+upkTSoXZpD%7zBFml4sDdp3j`Pj24i2Ox+a5r#Dqi4DI?fl?K7ozsvqW2v@Z@ml1ZYu*2Npic_mdy*(T-s|3QP=k ziC$!!lED0}5IV_61c-f_BxxCj4)H&hbx5c%5TB!uzbT5rL}d(-5vKgBnGo$0vK)jI zYtg=ffz77Fho?Z&=7ss_|A7|rU$Pt4Z#B9(I9!3iirmjIM<3COI5z_zQLR9vu);wp z6S)pFN#PzyFa&|I7L-5>jloz&jaYfC&fgA&-@+%GxJMBF2}ett5@A{u4x-S71qg@# zK$$f8`Jt4KhB_dbh_57eq$x0u;^GrqG#L!$&rvc($-NyOq`YJj4B?vxT>o5Y8B%C%B|41)KD@QBurxmlep}Egvf&Ti zf526ZVsU>@LH7?15}ppKz=kEFRd{tmivB0VPC z5<*0unDH^{FC{{5S@PC=%ktk2VS{tp%#L$%Z!#f>Jyr5IjPCNloGJC9x=GtQtbu`J z=AU-y$;wts)x(yKE2CCx9`Xg&M^0zpF_0JjM8tJb{f7y16r`UYat7Db{xvNRpu%N7 zUjB|^8r$!{bv7)?#e=fIPDCPArJ)pR2~>&+J!rDP6t_F+|DBGt6Ll{sofdjiMg^UX>zA(sYxl1Zwb#xTv^a<7 z3Iq%qF77jHYqsAlqhisbeihU+;?gf!+(udwD5TmkxVyPA9k;C5@V~B1O*sx-F<~pP zkJ!{Yh95omKLH6P^Oo6a+i2AMj+vu=3j*g>d?s|hGWixI7J0 zC3B0Tp=!6P1(;$FQ0a%FE>^*I98{)54BI$*rqtff5CX{tYRFDYY6d}&^q-z>SI>6A9f!vgOhLvTY{tT|@Zvv3ZUv(3#c93EbcfRKf4ap;@=Q;jS2c;)}Hp~jH^ z)fxvheYRl(2>`xq=kOc)Z6qw@Nl1WiZ!ynD+U9VxGp#v`&&>62RF`XbH@XWJhF2Q5Jh8WMf6uvm;So$qdnM!4e zB4LSxLlK{`X>2uN#&Ei#`&*WQwHc>f=9VXKHSUb8CRg?X&HA(>H@ynMgj0U~QuEk+ zr7czW%uXC3DJvS|2TQ70HY6|!B@H+>8iG+#8qK^itqSW$B?U7f|HQxM4|^$#?RhD# z^!%{(A4p|=lv5wbu+2zEdzHqL*}~Vr_yd*;OfVLt4mw_Ogr00dn2h-f&H@q%>L_8* zjJk?Q(x_v7MGi3JWqIZlr7%KG7NkPr`<9GKakukffRH*|G&L}B-U3uOFNsP zO~BXw0}dnOQP&Oee&Bl-34t(}^_qLA#F^yp;gsX03&+poKw178PK94ZpSNV{9P&%+ zDdc|}!wf|7C&xWt(TPf%wUYJRip``Eq^xUDr#}dThPjd#Tl(x%1w;bKv#mX{phk_`P=2 z`2DyM7|{L$s9^ZLOLzb!huiu37$ZQU1v%RRITZH)rC4NkEa=UBbUQV)fz_dD{pJjz zRx1`iC5M&^t4FTXQ|nNq6R>`aWGyhrdV%z{3Ap;Fe3G|hbYqt9oUnGx$U5T8j`S*g z6s=c_sXe5bF)`lMXoN{GU4s?j34Y>+;6;2cl{^E9)Qnx}&&8*Vt9$$dp*FG&3|9yo ztGnTr5tF!Bta^tH>@&4DG_Wp3 zVsv`~hHQw*obIuH;n3J-<`NpmM+cTy2M6>{K`79HAYeX$z+}{hQ?$<~NYfA4pfjLO=XepFw0_S<+Hk@cEEA=!t)40uPA`on^ssH^ML^%xtou*;^ zde-jqOp1GQnPo=_QwZ$wDD7QeD85u1d~_R|-y+r4T((TAD5y4WP>sveNwfYH7@$u2 z6U{=HU@IdQZJQJ`DjVTkLb?bIC{ewQb-o^VIss~~%VNLB;^*=6XQa0qg|}Wn*wyrO z*1FW`_tozTP!+xlZ`fE_yVBUrd4Nh8@|PPFpc#+C426unv zamRV9om=xTwv919G|SHqVaSMqpcZ5af59*e+OT|ew5)}a>&cg8wD5cZ7oz;+Sbws5 zzP}+@LrR6aftm)WP9$Nl2L4^CH6w0G$1Ue6^>^CN(U-S9IM+4v>uOB+`fvho%5&@9 z;Oc(gvoEhZPaSUyv1?F>cpN2hYkzFf3(cIn>5>nHaixPq4kK?(TZR|Rel{mvRnCte zS3j>>{cG&bcTrtm@jskrT*O30>OGjgOQn82^$eEh{j#y6^3@v|45^5nrAZ%gRu;vG zDygGuQ!Gd4U*E-M>Pr&!n+rxDEX`?(%Pe?z6lAsP@d^RU-DELzQ{RClO0RuakWpod z(7zL8@L3&yU!<#4qFm@A@K9Of7ZKcb9!avV{lC`AuM_=DH|Rag-#0nj8R`eyV^VnG zJkTT{7}9Wfft#?|#};t!8jyyV>?B@jQFbbn40LRA5!?~zia z_Do#I-L8ory0t!^oxd{qz1{mwTwSqsUh{YMSa28_8-FrJ(5L`yDZK6~JS+|f2G=L| z^@;r_-kR_|bG~`<&Gy{K1%UaL8)Vp`DAuXV3=7Bk*nQ>8zwMUOBRmL}9C770@^;U8 zJLvqLv}GY1-zK>5$|65e`8J@xc|tg_zDd-+CjS-at7MomBHmqm^2eM|^X!%{CTW z#K(7%Vuc~xK}itHV?rM=;8EOLDidKkD=epo9-zh(ZKt3E$%Gq7&LvnxV?$rUN%le_ zTR>>2A{SK0Q$s;Bq~l1yFFtDa?x1G=!by;gQ5k;oFoo`L<|XG{JQ$yAzi457SS9a= z!ZsnPma1!_ZxXl}|5c(YtfANKgGW5?)?X?(nvIi57Z!JDTwZjcHERn6DU%9MNkg3i zs&6>s_A&D>b}f^32|tH)(X3=*&7`8L3%G zKRG)?{O9+!PrS6aUa;onYkk_zHsti$6GCJ+cy`=-+A4y_VKKQ0?k$fvRyAv|+}55% zE1^GD*8T}+n33aB18*<5m6XQIM=(RLhz>#bm0FmTF1dl>RFC)o!Lm3Y=65&Ri?u!Y zEf0}6tiIo-O00km=&>FFAvJ|%kx;WyiH&D$Ar|lzoKyOH_b(nyL*S}#-0%R8BC3ti z63@l+DfhUer;csDZ-4@3}ZrBNvZC|z2(A3!Y(=@b{BGS<}?=+sNQ8o?+OIx$D8+w z-=0tbA9LQG51JjeAl%nIsdJupssHtJcXT=MFi4%gS9}1q?V$@_BY5s{te@X?^_&97 zSTpr_OU=)wCW9m2z7ijC$#ycgi=T+J*z!TI3e^4#moQpgS2NuIh*vg3-SqthZ={Sq zvfsEy;9z%XCviQyXi;u!TyyEiR)0u3e$izbrY9c;G|%;`4WUH63ibr=@9_dbKh<)( zFM4j;7Ns=-LPTM~j0c6ASf;LUMi|6lfr+jI9hM&F8DBkuh&yWJgvX8V33t}+Gs}y7 zU@^n2P%xDPScASaw#34m?pNF4_pr#37$q_DDWal9VdFGCZhmB@n7_KZ)qQ=MVUG14 z(H(&H+5J*{R7iVx@;nb5|G#XB5uH*!72l4g3rn-B)lTj%;%(}}>Wf5$Yu`ZV>C@fn zZm6=QMsTJq9DzM+?%NYK>avQq5RSLlEr2bFIY!-Q+GRq*(xRQsE*MrO{p|L`!PA1b z6YPPGr)tYBeO=>seD@~OAymk5EkVJvk5Vy{Ccq9$kDz6EOH z%1s}|`d^_d%))qZ^wkT~wjfnl$4M?di`ljK0P?1mDrVaGH<(rFmcmAKpiKYVZ~qMS zVPs^a=wY@8`70>--=Ksb+iltav0o<83hG@Y)8!@o8OASHND(r=NHvj#E6~;tK{4M`cjzOMRtlhvdwvpr)=-gT3N_3l0b#TJE@q%D zPp>WYHCr1DUoih%7S2=EEmuY3U2r2*+uIl#!{~rPTG4orSr)~*iyjsBLs*-NcKia# z7_m8^S5zhwLT{*`eN3D_ixdVbO;R|!oo}~n;$XMHn&D1`sO?FWgZVL*eV9r}GZaH9 zKs@gEA2&E_Ff!codJ?2uge&cAsG5I9=?{0NmJMl;%7tL>8`k{3Oe^~9?H;RlLL#&~ z_rs?5cMshTaMAY&r|21g(8kE@|Q9@OcEiIfD{!fh=bx!r zMD<^ANHeiH4Dnz|wXkG#pT#ImJR}DjNxNPf+2EnW z#yCBsV7qykre1A2^-FBvCpE$AZ&@&L_xIk2{LE}6JBoj-((x6Sk1%JBdFa0uDd$Pn zxbxf`-;2%QmHl27ngPtYqog2q$|F4JIY%zI-0q@p4t7PNn-L=9?^U&SQAe4T$-Vzw z#HqgnTJR&D^@Cm=J$-ZglTm~_nJW|kRf+xoY+XpHna2g!sqzLI7`8sK-Ocv)9J8^j z@iw4v8Rhqaedc}NlNhil02bU0hnC{hB}_C1s+PG-Tq>8q6U#RKpMpfeI+F7T4FAhMc~9wU4Jz*=-~# z8|MYw);Mo)59$1}vVbX9l#(tbZ*QO01Vz`|a=4d_q-Eroa|{h$!9vAw;yE!!7#gkQc4=uU>UsTR z8)(5@dKKi7($Y*dwl&UB5;QP$44bXTjndy*ZFas<`G~En9T5Rp;Bo$;$H4IC)+>u< zVmmbYo%Fok2Ud!Cwo&Koe_hu%u1O3d7irU$^@rmVj=sL=8Jf!tW4G4WfYK*W4`SyM zMk-J}-ocXD(9bW&%^UX;+9Yjfdjy#5)2R^OFbN>N^Q0D)lr|1(Ff{pimiNcTSQ0M7 z_^2Z{;JG4BZ6)I|ZgDF?E#3bjbY1E~l1Rjp-1su}@mUFo3~Y%}HFb21m7r|SZCHoc z(GvWtLCtQ2*87svi2-Y<%pDhGH8VnDxcq&snR`iUZ4C}g12|jVK@picP>#?g!R94% z(#>^(!hKavCpZD$$NM5Q97YJa<{PWfwyh+KQh%L;JF&wo&2o&;wb@pt-B*^!w9F^DrTt!_M!W=_Q8U(@4_g_VYRHttTv2*z8|R}Q#~#9NC! zs!YkM*K{{{N8Tk9PE9UOnh*TMzdW zI1FQskK^bJg=(_(XhwFnF5I?Dfl6luoZ75^{ZSV+`*C)+#WNLqF6YGLiTH!{^@Ld{ zN{hax8XqjfOb|7@-#~qm&u$3_ibmX5=g_qNQpnY`&iAc%dmme*+%c0u%~TW)n``LG z!P0SmlrWR01LLZrfAtTSR4RU?kc4avtjqvb^YINV+Q*awlI&ipLCM4R%v#=2i-_VZ z?P$g%Ws;1x-s@7<>A1c`gmn{s@gLr&ljpMqah4n;CPy1vwFw zwpQx}N|3P3dz8XmXZaco=m)$G*$g3`Gx-bWf!jqaiWvkb))1_yBCTtAGe?lq4B=tX z6Gz{JQJ6lVWlWyB9*sY{UjOO1j%;VU%9iIZ(rFr$N6h@D=p#=j+__P(a~%9}RP)F)pndbqXz|0VwePH7Bjarus!Hp5^fV=%%H_-Jn}C ze9_hzA=Gg4c>2`Ezq5YP3G&MUiM=z*}GP@(vIBtO#VTN9o@GW+D`~r*J3LmP65%9P{0C&<$t~f4@XDF)R^I=OTaf* z9vLcNlW)=twSgy3d_QNavN^HzS-+j(j`+X)|gmfNc zQIIR2=DLgwe(rckwHkYLD6C^gHSf8|b9pGsxYKKArEko!$bc~QRsyldk0*^*!}XF| zh0iLHYII4Kq%aCnw)&+oQt7e$5(xU>c`<=;XzP~h;MiX!e^YSKMQb7ltRpR>jij}E zf2O4CCVfb#hcdUVA{lTOrH`XN*a;baQC!KP$ye5c)ItaKih#V6bmqnUZTk|vhs%@) z4Pem@<_$y#b%P_+b&YMC*Vm!rWird+jm4F~R$q3+5H~}wDM>XX?IfiD2cnsXb3L+XUhhoZ+54WyV%BugnFE&R>+SCbf)*{;zMW<@LSQp~XC&N^1_e)9c{b+xKd_T5sbLKWmWTw z;LN*o7U~@vWk+R39Zq(&!d4W#?lU(VAb#WKM1~G=a-=_aI@a}a{^ZlZi`l4ODYlKNjuB^2fRwP1xFyEBwsIn2NuL_ur+F!P&9v z{lCe$cJuoJSh>7f`>{EGf1;+XSm~qpn5lp%Po0K?ne&nz^X-%GZq;s9?3vXSf&EyQ zwB6#o2#TekJx(p+`I!UMeAG;Ql1bF;c1n+C*l6eJxE2XU1hI$5Jx^Suy#CHvf|tql zvVGNHv6NDmtnol)WedNoQ}MbGw&=iR+^xs4Iv#A>eG-S`hRh%HU3Jw0)HLWP!VA2# zW6fA4l4zO0M(0tb&YL~Hj0|(avhc2|Z|2Z+vVO&yKMUvj-43e3MDu5g_b6#}m7IF7 zDv#cI@BV(>E>(kh`aRM(CkQklg=pGTE@SPa3O9i9RPFJ;ow+`_d=Nj_6FFV8>e49P zsh@XN{iov_MZU})S4QxmK)^7Sn&81es18L}%h!^U!{RwMrbYyV61FrDqEOaMK<-;m zcRHSol`T=--zU|teFgF4+jQJUaQue09(h{@2d>K`1Yyzh+s#(vUTZzJNh4tdMkUv#(l_7)>GuM+p^m#R0d z>!fMpip?!BapbGCLEnCFS+o3PwTI^uPzu(bB4;eyLm39+U>USbTv7*#5|&0+zy1)d zy;|boSPy?9wkw;z&!|)Z-Ul8>6E5D!d&Gq&ONs^;jx+3V$Yc*ic{m9)Yvyz1W86Lq z<@LsN9*lpoDsScYlO=LO_{+@Ws;+oUNdQQeO1!JB)6Vv)dUdz zxaH{Ol~ZXr3fjFM@==}Q9J3mta``$oO*f&urZOV=$aFJt-QMg}=!3nnQmn(<+Y~4D zg?3_Uj0;^mtX9Kz$%Tv+YKDq;>jm4@Xw;g<<60`@($yQJX57m)zL@8rI$V#kN_@i@ zl2Ja+c6oSfCszC0>R#78vTd=|li9x*YV-HUhA{x4Q7PPQgi-iVvR2vGGUvxMpRm21 zS3{-ox?FqG&=eS2xZck@ubHs0xIoswY&dwyli4dUjP{t%*=TvL8|ohYRGA*W1P{R* zkHc;84m%nWB5wEqMV1Tok-|CBmj@vxL}c17=fptNe)521;^OyBi;xA(K^0X~vDd+H zsuJsrzoKhg@sf*3t*O}z+}vlUXtdfErSy0w+3Im+lYv>rl0L()z3qI+^P*;`$4FQl z6Eqq~`8tQ+VDkCnH!l|#*97h}TLsO^gOvok(Eq}>N1wv&Hj6l6&juDO+vdgUSWv*{ zdMbYAN>y&6y(k`*r6wc&&QW;{)l~|w&WSD>6v;}_FFcN+1%FnC3Cn7v=;~-!R{vWc zK{HHUjPzG#c;Fz;g;3E-KdHAd{j`W!vJ82CWvJ{_%0mxEx!kZLJ~_MkG>`cdcwyjS zW|$5aCZQ+JqUu|^HmHUXizVKOwHBL#^tENOQn@s+wpTK8j7!B^X%1WOXwM<@y3nY) z{zdm<%FD-zG*vBiv|S}qPTC3Qro-2@iVfWbCEX4hbO@0)DGNR)IB@LXgWS*HnF1&kiVUMcd?wI`_ zt=3041&s*ao#W&t3tr92yIbJ2jyCYv>q~j)Z|oQ&G(X!80gg7_3qI?)Ei91KM@9*i zZ(ZiR(Tu=fhqCed!>;P zPPx2}8xX?VVq!6(&st|~%hoZa;WU>MRl{z0zS3B8;ai z-yRX%Ke^F;zPiVxxzzhZB~uAxyRKV4(n`R&srCn655Y(l#N78!vC)}{=198Aq=f(_ zAi}kj?ytajh*P?^Q*jAff1vpS&zVq#Y?33pFO6MXmrU;XT!*O&GLGlgB?9M_A@8!?ec;tWeOAv zXq*G-1#2mWpnKONUa+e55vKL0qdUP}cy)~P?!|5#!e)OS$%K-9!u!Vi>{WX4B!P(l z(>g9@6ecOB10~L`{8NE2wb??)oIp>`eiR=2!RiyA&}!HCZP@0r&)s^rhKP`Z*96vb zlBAdi-8dp={vjdv;ZqbRa$!V7T(CE4pASTc+atmk|0+s3uB#kE>^8$+9|xENGgEb& z8nE@C`$fMd^pF0x2O0x|Pq+Ys{g{L*2jl6C+z;)-N4UR#@Nd4cvrppt-KXb!zgIr@ zRd?bwp`6oGMs@6crNG-;PB(YA>UpT+G%u`uY=A!DHSuIDFaKO#Puayd3`EFfb4K>| z_Te8Eq#T7DA|6$fD5L-;_vHLM1XMPauA}gEHx;=+I#m?EyGD_9it346uED>2Ifmi0Z076?ZH@I|Vvqh9l+GS0!5@l9#hU}G zRW@d_jcPn}ohg%2;cTdv7I`O?kk~AgGq#4xUqI9k!&QB9dUi1_gN;*1mdDj~#XpMf zc7IouMX5?1IglNZ!n7rBToqK&Xl{g!VqDE-$dTso`b=NmfQ*9}f>U2OKdq~2;A`9p zx*h{F>a{q8Aw{p6hAK@{Y)$J8zrGU9Gm);d5P4VVHFv+R6KTT3&3oLP8r5O+IQZqH z=yyogShGlF2;e6a2CJ8ioY{HsMWR;dZR~az9j9LEIq0Yt%^h8AtM@zjg<3%y2S(l6 zCeLJo!LCl{l4udrMz*$}@*?V!hfGH4v6&4ez~3xTXZf-AQ>7_!rzxO=q#=Lq#+F{s5 zrgC>lKJV3*iT|~mfU3cyyR+8}`*&c=b3EvKXHU?Gag9{;>8&DW1xU->!aX%7!`$2% znRC-7BI*{A1D6D%wN+%i-6JT-#Q$FUj3BK3WXj0e8Q(f(Fly_nNCu>L*K`Rf0cV7o zQ(%Ha4`g~pv;*ofQ%84}Hm!iidvIhO7T9R>__IiR&Oc{ZZ?FF%^7ZHcxEH)x<9*1- z5gFi=VsKy3XLW@&A@A>TV_A&rPm50?XBtZCDH=werr!;J+7;s)vwp@bnmL-bsz*Xy z)1tS@8pYa^trM*Sas!{Uo_xVk%(&; zpoRsXlFm0+G=7PIhbg)~jN$cBm#a#znZh zd?MrgsX~BQTvR;daF!AHB4Zz(A78ZYPtxK6$T5a3mt)p;@pb z_7`l!+}?69{f;Vs78CtI@)7lvl?5dI2AZCWG*_<;;1^k8d2%0fJ>R@O210DFHO|c>T6At@R3mZXUOq*1+M- z+>PTc3J)gD%Txi%iN;G9uzEyNl4&w_f`KFT4Y%A%UBzhuA5>6~P)t(L$Nu^PnVNz% zyV@KRmsZ@95MMs-!|8K(R=1$oElrdJwy)g1=le~oaa6P;^fC<0?iYVAa1<3<*ZM&C z5(RZtO?89AR}c^KRaa$3Gmslj6hrcnS=h-~2S@JcC)IP`4#7?&v;obqE$3+_=zL(T zvJrR&#@j(%BG5*=#0q2hF%x<4zo3t0WimV|edgj8jSTcXr2S_sL(Y<4A|k$E%>cw7 z6{qd&x9GgDhXo=r8W!%#@)bRNR(;q6jh^pI6qjeruiOY2(cavNQi+mkI0bjYIBMDBI^4yh*WGW8D?)=x zw+K+a`%f?06BP4srJN<}J{jF_UXUr_C72ZNYpI%;x&W3R! zShyDo7LGq;mAdtWpMHpY7I1%G|*GIMmN?OE0TFMuUS$|#lC zB~>h+qy`c4_+%9n^SzN6?|0*hWm30_Wm(^L_m3s-2S+%tI()yOfThggtvCB+d#rg} zs(0V7+Co#T8Hjwr;GlVize-D-;Qqi3&B{HWt{A9x}tYN z!jTuNt3R6m=`G=5+{;6E?P(@`uN-*>F*j%-8WiGME_a)UJ7+h450PJy|KhBhyRs(c z3Ik_JZ|YdB;K$OQjh=t(s_L4Zfe#R=CEfVlX4;x8izcBhC_?<)hwK|?5)+|xrs~CO z;z+`W--;7z>Lw}E9Qo}&o{lr2Fco6$9~|B7o29^#G(}@q(u+-cy{8|~nkcy$crA=y z5@%kDVgHYnqZx<1oCF8gWyKaoSHM=}T!TH^yp}BuIJ999lu-JlG2Q0TWWcLR$;vHq{d@5I zTyx8@dlAeDENfn9tOO-Vm{7^MC982Lvap=k_&k|H#r;o*xM1;i$jf3ft_nV;zaf{c|z+GO%5<9311#9vBOa3|EYY ztP^A|CfT&tu6{YDcNrLwt7^<(AF07iyk#`9Zq#i3}G$fp$jEFq=*05h@1zm6b60|fv)J8iHptw)%YUDsgiXK3p5en(huMW~GG0HjC z{jJZ?CcQxqyWCRTtcq1pAgD6$x;qk*SQc}*9Cgf7Go3aPR!SD4UpX5P(>-=C9+xa` zr+g)8dWJ81%(ykzW@f&2WWV@Ors`6AkZ-cjeZH+Uf^v>lq99Y+;X7llWcRE>8tbM) zKy*Hq?JF`%Ul}zg8G4K*z&dtst=+bS64r>e?)}~sh)K5v^1UrVSAv4z(A^!^!FU$n zg+ngF8uRSm(`ep~>#Xy{38p{S6JIBqoe%6D)0n?sMyTZcd+L09zXEXbIi@lE|D)-w zqT&j+EgC@+TpI}r#`}Nkd1lkr19sUVrI@miwO=GmSi9INA7h`H{|KV zI>V6X{Q<(Q=pq6$p3Y|6T7gpI;xLvDP2H7w|NNqiMEPNi7QWe%r#pfR`+yvb_9bYw z`yUbOluFow4a_o%6fEnnbE||e2V&2ggs;T^k@X!OQmsFXxiCP^0q?fm@dB9lVMy** zW20z#akcKEMc;|OOe>D{-D~&B`oMCB4};g{llv3ysp$G+t@q|oHU;ro#1H;3ge#&MUvg2R&628U)dB3lK90gFNxbDP>HQ%jyym9{kL;YJ$ zFyLQzc)qs-NRHieb65Z->CI=}1M00C=auSO-v^LuHpA-wy_n4m>O1DJzyOmwVNw!_F^r({JdT`|TK}H0gW5MbF0jdhws{N4lP+fQ&y4EiLMx zYw`q%-CwUT`iyCPi3&|WTPyB(3#VG6Dwo`{NlA9xUY%Wb#W5UQ+el>4FKIrTk7f3@ z%)7{*^M=w#e?wR1*}i~MDf%KpypFKrHpX+e(hDr8X3q!4qoX50U?rQ)Jp_TktiRp@ z$&wc&|3T@zx&D_i$ z33B$fw!fP?Z)i0uvEC?HUDr}w*JZ@I)!0#Z4sUxh%5l8NpGp;mIe%1X>D7bR?It1I+QY#dPK6kj8Qwu*aOU$`K^lllJl z%iX$Mva!wm`#V)3(KWhfGWD-EE-R;3-!8h?ws;F-2T`n1iZ9)dpc#KkXUg8x$uIo_ z6l`y=?PeP1?)}MoL-~tlyB}NcJFvW0S9Lm{cj@c8y2jrmk(Yp_J#L@ljaKP;Jt_9k zjqLqPTda%dkXSoq-c29^u(%y<6l(RPf;v$HrWmK;Brxwdo_#7 zfDi>Z8_XB%>d7hHt}Tk&`Rg6bEfLLf>cZkMfvh0@S<5Rs1V#Mc^>AL5Ui|^yz||YW>aO#yL%Y>63;^_ozagT& z%1pD(WN8SC1A@55W30cs)@st^3AU3NE7{64Q4@tISJ3rU5s>74So2eC|VhHUJtO5MUi{n&XxH_8XFtFyqNK0W!`G0Lj>_ z{`Xkj0?2Pi>O)9~i*#yz+&gstI^6``P-qX_j8$a=}__%4= z0rsuA*sTR$y7DYclcMM8XY;zzmg&C1OV@SISQ4u*(P~8=xKdB}x)GwDc_zZEUMHQ5 zm1tf}Y$%zp5Svu0WNUX>xw?@&P@f7T&JZUB=Yew^iC@BaQ23{b7Aq!?C_A`AVJxNd z1`Ycz=Vi<(h9)kCYk7+}N-btgX>BH@MI$Ag1$#TDS2?=p zyMzV)R?oql3=AXmZqX)Hi|tu{Hvxru1wGh++BlaV@>_IsLw#UPc&{1=)D&%S-%O~G z)hfD$L?k7=)oikK)O0e3Vehae9!q#sln2jkx449If_>I;UTZ~zS(Oqtb))Ai0=$6@ zPJth{;=08wE`|%6Awv2<2ac34ZAf}CJOqxedH^WAX|wzGYpD%yP8Vc6N( zU3<5k*Xia@wE9oh_?lmyT-)xDU5(CC)&gs*ZfXDR`)~{FB|fQ^DchN+UmgL1ZhS81 z$o0p{^`52JvlrmJ1R1@dlHb^xZ~TWhn9&>e2#CtveFMH|XlfcdIVIh-@ACv=1X2<{ zPK1~>XujbBcl*N7wcDJd_H%r)0dXi~8yv%Z3HOHSU9XQw`u}!VH^P*4#!VFBb3d!p z=ZNQ~t|zV6>3`Qb_XE{FS#@WvDS!@`m32-%n=e4k*v2L%AmF1fqiEH%l>-BBZlauu z$k*a~_`Q0wAVmgZ-ti}V49$~3G6~SB-0#3^(olGFRe6TwGd=tZdcNi!vJuz$EU(uP zF}XN1*`{R^AD__l#2ap7@tim-Qdo34o70I}4o)2CslfhatmWn9P{%M1lZC}K;-Nbs zNl=tId^}c51lU)0adi<$aYer&-nZaQ(?>WyhDcy+>T_=nH^?Mwf`3wPPVgugo0?+h z#efVP91@O>=tBJsgqBF5rjXVw#Amm3Y{QncA#M1ivBk+W;|qk1J%mPqFC9EpI?MX{ z+TyfA;=ocnK0VeaTVbfKw5jb(4X)?dDsY-&V1?KHVhDBi#o}n$65nDwKMAN7!MLUf zV%`2_6m1?J6_u6Ka>RE8nBtKJ>{eUM-V`iAzqOPsW%J9NDZ8}?nijgg{4v9Vfg4%t~*RuEVt z27h-3(Zv)b!=Cr#Bjgp;R*Wgj{2en1g$BH01r^NlHa2IqjSW#I=+eykcor?KDPV#a zpx0O0$mX(Ov5Su%`OfgUxu&Bo;LaaJ?80GTF%L4st`0{JXw8&u!d84VtNCMXZB^R| zjyWJxS1owjhjcO$5WdTMhCs0XG=LDra>H4M`|5$!Euw;AH25p>Xr9f0o6H3X40A!i zqz?BIE;?OVX*D-byJmXf##&gqIXp|Ok!?gK0Kc30W%~3Q6cd~aV?)!s2?q|Sku3nL zRas3mY#NfOUkAqF-rnBITNRX9R@l_E%=YYZ==O@FNFW^Hxyk#gLEo_1W3Z#;Pad8k zPPj=mKu7mfKv#uwSpqxeazHZXn#0yP69q{ouNSWVAr9ihz@`x4qx{1XfLr14e!idC zxB2cxci0Y){#t;qk@+(Kr#8>wuO;;VgB*RB)ra>kt4_hUQ}`Cu+PfWRUi2x|+M59F z&tS^|2?Ev{hF1bz3&C{|vbo>d6-or|el#HLt%GZ8ZpTa=P%B6B0 zWoVS4CY(4SJ4XDr^AKCBWH|+K4~avtS*}1-n$u4C(j|RWo?{%8S$+ zeHKqn2@^5GGe6&?E^WVJ7Fz3n6)xp|e0*$pLUe9_V|jL*SAgHYjiE@|Tpw{~Rl&l3 zwz#rn&wnZCNGf0~vlbFtE$6 zTt$W5_9jx916Gjj$r7#<&j{JL0;xJF!Z-5RRiFWrv0u~BA;gOt5@pomY2g7MhIJZ7 zrB-caKOb*wiTyFpvmb7EzapbSym5(y zywe|Qz*idoI9h4N%G$)>9eA}N@*58CNicbLp{k!e`efCsRic@K0WRz&QaS|KQH1y2 zfno-<_15!?bRdf$BN}f;gRyJh4a0B0A$v%88UB0dmOq9Z4(^sLEo1nB?@>uDEl(r&G;zQ$KArp*3uhY|okvv{GX zusdy$Ny>)$B;{^NJ7TK_B#?!QyMY0X!APjXY*NhTSOB(K)&`T!6SWU@?htF zc|eL;@%eUTUQbc#53={ec19b^aoHKO8}GO~-)KuF*(?-im8?2nEl;ssGl<*;PT3WQ zyR?H*%u6CdKJWOU8~hX-2D{*JXKHAeD!$&Hj)ws&LDyRR^V{biei>z! zY=}$8k@cyD^+#e|wSJ?oo6lyjIX2rW99{!XWOUSJj!2?0*DE8t8IczM?6k>J%XRk zxB^^o3@t+qv6@>mradBF$$=aRL1 zZ`c){cANbXTw)#6r~-J^rdR$|Z5vlvk;20vEI)akY&qT5;agFfj<0n8IK$8lLLX2S zppi{N=W8FM&LG%N3<~0n;dM+_b-YkTjr{$-2f2~%YKod*pXYAXh5jy+hk$k|>GP|J z>7S-*9R#}*%^2CvSv}KkmThP3EAxqs8~*qEdKm+~ld(-AeJ3Xn*Z7M+4)h7T(XeM7 z3H=YR%d16f(ErsZ7201Y)l?>WbA3fG@;L^%?%od>xgu9Oe}=M83Aq+FwlppIi86Yg zJryHQVv55_oWdGLWyPI3cuay*^ZT=!i`%6~wZ3J9=eDu;o?k-6_44E)29&$7KME3r zcqf!vTv~yoZwL3c{y8s7>Q=i&AcZ5k()0Zx%1LGc-By8e)Bc!J7=QnE5Zc%#TBW%E z#w@@)@5>=ersmA;bNs}+LtjRBZzaT!nrZ^&2>_{Rz<%584)YWVp4j5Nk~U6a1> zqo+bN#VduO6-Av7fvN6HH$$8)%xJu7f2`mP=;#6r4Wd$@4@nKGZ@oKslNg$azlM>H z{9+F`RO&D52>zT1`uLpQbIV*PA?3I7z(!js764-d8wvJ2DLuRL`8Qw9cmOQ!vdQki zr?bw0e>WMXn*MC;qrbFB(f$H$NNh%6CRy{(xlp5HR~#43KLP@Z zlp(l7zTyafqa@OYnH*lOX$5L1J2kNPDCPd54JX3dRDboMenb_&jBE^H6k#qu^CB8M z4C8FHqihiUP+l9@kXBW$`LYzB|Mh`;#f0bxcK~lthA5slx`FJQ9p50v^n0*KemR91 zvk02hqn3=$s(CJo2_?cAMo#sh{KcZ6zPeFPVFjtXBA$a8Z;yQabM~T_5<)T2cj#KI zuzV>dD~MD?eurRRxuSbC=lX>oxF1>|D+Lo9)l3|gTyvQox?qOA>aZ>^iv4m4bQHcM z+T)Iq0>74$AfCrhCypa!i5^j@6Nqt=$R$%8)Dj-tb6=my2}b}zo7Eh#SN0Iv&J4py z;j4xw4vQ-xIZW+%1|HIHU*_kU0MUl`eJgGJ2TNpR_Cf2j%mEv$Vd>9e+Wwf~n`|Cd z+yoAPr@jK%Nrz>s9H9i$CP46k=qnx^PPnx>FUg)7(GVIHGUWuPSa!!LeV(cyw{f4fR;mav`}vf(*WqK@R_75RolxS8*v76 zVj3DaBX%lv%sljpqw*X|CUbNgR`*bi(? zYFR4yij(|!bOWA)K<^d}ms?L!VqlAsztXwxf7!u%z9yAH!-CP-d#e7oF4!g2wd^gn z_Aw03JU*5@xJ)*zggQxaw59SGcq#%Lm%C~xF3A9N%a!h(EWq70HV~7OG1}arf2J zDlS;O6KpR{Ao*B|>}1X^jYoD##b!K9ggcSnIB~zNqJw&MB9KI0_btg4jFpkWk z$a4eR2uU4zu26iIPGfB1H-0MXQnhdx)^xvSDE=g!VJCI;cjoD9OFFreW*cqkWveQb zZj7Tq7I_XEH&&lvXNekne%0TtAQq=qeStEnk=^o#{aS83>?~&}m7^mS7fyS!o1!}}3}m5hvvj?HCzh5$RD60lhkWJQWuMl&vzu8tiCV4d z9Jq+Y$oV`@1D4IpU3#Ci|A5IacSoLqP5}^!83Ie->TBKfA6&BcCbqZVnb(;I4L$wz zkA_rfa^UI!RNgG!r~BT~KybiS0pUyN8|7BJ)ANmJ9u`9AotpEImg6=(;P7;|1$2j* zT|YDQZ|f+pD z#>f_AXI!?+UaZ4b7TURjBWgG)bDSJ27xLuBu@0m!wq<{-hcnXqWlRSnMDq!7 zRuK5|$b9-O>QqnC8l{ZZEYp@eQ&g{dD=r2lEmoezVdp66e9W?`;wf*!GESB;U}+6= zEVk3XC_gw?(q%Qmt()Z^f`0}nRYCSEsmP|E^3OF>FLT&&F>^W ztDViR!>cI;4fM|7k1KDK$_>ymt;%Z#GzI&)#!YNE3%1=r_OQGQz(e+p&cS5nm#sJk za9j+3kXu8v4e?ewfot(wMh?&u%yvJdyuG`7==;Xo4fw4!lJm+uA4c?wSFIg@=?u`8 z1{l~o0D{*9;GzQI5xn=^$cB}>Kz0$YMsjUu=hzpQm2O~4@Si?Ez*8M~Yia}ie)nFc zUc8|HKc)l_Ka`C3=B?lX?HzOKuP&11SzFBN&J{B9qhONf^C=`fAA=0fc)NdSo|hl* z{5h3n{;q-GY}sAQ$x^rGs~_d70Ios>jMHkYPyK;L{X3B(?V1OeZn7wF@L{jH77vIz z=_^BY1v7y;1_mQR9~OBfV`nXUss#cT?aHqP&r0Won2V7^mc8Q2L0Ob?DtEm&EzHtL z?P9cO#hZ;H4Bjbr%0m|X#PC*6gEW}JP>yg1b?vJG^=x?4+; zGOpB7S)Ju-6h$XWhZ-cO@Ff!uBd1JD#81zYu=wurCywWp0Zi;;>&nYsQS*%^1QVU$ zDPZ7|0-qp;)uK=#QZPSQK!b!5iP9emj#>4?f%SFgOy|z)THD=yuNOU2`6Q9As1RBI zvzW4r@tlW?Pa0r?=lI7|AB^nti~apfY!nf)rq=RX~2LoWDh2t z<5Kwog%&1`F{eliG5pT`sfUsKm_odna<8riR89%sgs|S$UBeZ6#S(5N9dnI)#952z zPhu$6s@X@8@^GWj{C>A9Rrga*NPfvQwIS*1 zjC~KR1BmN5z|cxSH)4Ml#DveZ(it^ z4$nN*a(ZmMa}BzrsZbC)tnUZ zT{cgh624}7*Q(4;ky`a7-?L3uhy#+t=N=i7i8IqbvTXM`|0aEg{W?6XJ@5uxO>@gE zEiKREVmt$@eO`|6*=>D+8_Fth<_7bW#4}rAFkQOYZ*#A4}gp!!TN!t!c)L? z>|sB9Z$@eS{C5~Ehr=ni2Nu@B?Kb41AjT{8uc-9w)Nyx2N}J=dm6`Fg$F~?iS2FQD zQT$QrxDl#u|GJ^rObp4fcMw4G&CuEloo_{jpv`I|T_k{tb`(zX$&Ud}xWxb1>sqj;iaU`~&H8ygU0fc(rVD6^ ze)GR1qC`-s6@!_^0&nm7CW1Q*^QpZlp5$#=Eu>d`_k*(PGtU_1TiKsO1DX1SKwm~j zN`>xB!^Zh1eCuHLwH1e#^{+jpSz*XvdO;+8FFZtn!7;}G6R8&ly z-L?FCeY#i!l5Tnd2)|U_;?7K|68HJr)`J~b{JL)FcmEyO`jI0#*&O}*5TVFGta(9z2W^i zeKLJ=bD@Dnn@<9z^>yS*{U?ihZJ{~P5XULxM8(iHuF=5uW0v`Q;~t>QLJU>m=ber` zC=WMrwCi~3eZi?;QGiW!@-sI%S2DTC@rj3dyx_1QN_9&+-fZ=j!!VF}^x*b!@)G+4 zL^wa$#F>BPiu>oRY#docGMh>TT=&=Orw;Zel50h|>YR8}^J|WI#__7Jfz4p0L|L|? zl;ZC%1fnz&TY~{pXJT`^nE(-D)f)SVm>#B2L#TZJqGdocpcch{;_n^tRp1n3r5~?T zWG(wX986q3z!G6#uI9d3!{vJe zSm1r_xCJqv4B!tLg6HCjHMIGB$9b}3Q>?#f#`C~T@;7MqYD!I%e91P>R;7ntj~XDO z0-2gOC|%MNI6|M^GM1rjfl3XdrV;{aMi?MyvCXWSI=B*XS6I-5aI=u#BAN0W zWZkAgNwXVhc*w1SAoUlnRRVM<6rpnt0N^Q@zV}fsz&m;R@cRtKYZbvhjf|da6dC*) z+^9)}tPSoBxIY2&_or1|&Kjx|i)R_1NSsi~`Dm2O)Zrh}u0CcPEU_MZ;-7C+iAi=^ z2+Km&O+chGRPbY~oQo=nKfXR#)NMpv%;lDS*N{!#Z9^i?a(Dyp!vNt{cIU4^G4LKx zt`+H4f3yVz7Vo?-uzl?2S>EOR^W+Ych+n09dW#hRWpB)yab!$kK0X<8Y`DAJ{d2+mjdQGm--zH6Hv|79qr;aVZ+9k%Fhyzn0 zL#ltFd&gwaYdvZ}b8~Yo?mR)RcgSCyUH^b{JUGi2>4Dhhx z_|JzQA7R{@V${*EPGRIuO}2-r;a(ansPQw${@%HZGmv45IoYS1)J28Lm#dny&THuE z7FZ|gc7@paGX-0WemaqbHQHzR0Z+g>H@En=p;Vbl1f}HXwuyMSjAgQMMOD?bI5ehM z_D$&=T1ENP5l%%!OS+mWn}%-2*ZL+~!)`cd?~WMF0B-Bbrs+7>kjkg?1^vBZJDXC%37(oZ%p; zc(U&=NWf~Kp~q`KBmS`Vx#368&2HodX1uHZui8!_y~eb(EF)8gk49AA6%9;HVH5rk zi5@g6Rq5)PE*bBn<-1m3HeLmuoRE`zhN}T8;bBcd@$G#-Vtr~%Rnj{g){W~8TqnYXrkDBb5lUdfgr| zPSL%vclNGl%*1!%d8$cif&KkXbh=6umq~PVV-EUNxH`#T@Xu29vEzy@FMgC;`jhR! z&0a8pB4CHdiA23@An3Mv-!roVrkdWw3#p({yf!T<&zX)9=s(-vP)r!No z0TMxK7}?KIH_W5d<@0+7yz3`QkK|k1>jMEa=2o1Dt;nJ&)I;p2il+P`CJFuZwHKN| zhEQx4)x|MHjn3d7f<>CU6L}x;)1*QNKE4;Jh1j{9!k#r<@B$IT1V|@(eLHobqD?wS z_?&4OkBNxECYuAisC3nI3@Rwc#W~P?ePB8thT$K5I{Q1APdaYE@=DZ zfK}Iyj{Nb_uOlJ?f1wNe8R77K*y%{s-_nkmd>wYQV?9m%syGH77N$Y!z;`;zsbckA9+&O*%p&*(z#`l3{C+P8 zH>vfZpS{;9^ot8PCL-;6$r-{Waf(e%)3T#fn@AI;-$~2#qmS}CI?-;6NTtYA2lqjml`R=3 zxEkI5+QXBuS|3LF+KEt#ysj8BX=PuFVXJHP*&!L}7U(Kr^w+Y^g~`B~IjUfGw}?*& zhL(oJ3mdwn3T9FjQ~VmsOUL{ms5KBn>R?5<<;ar#aB+NC3ozXtAKmmYnZ%|$9k^2k z#%W1M2X5WxcsCldp2PX+|N%n6u z0u}L%M&tUiwNI^fCMKF%6nGCrkr`MSby3R;)d!RLks3*hjzvKml~o?n&$S<}J!Xd# zVo`7)wAbSHST-+)6NN;id8ifxf41(Zy)f)*S0vZJ@~GX`cQL$+!F8#@28qFbeDS^} zC{ea1)9-Y#;;Rip-v;tXKCQ_kegwKp1L+G%69S?<& zWRKDc3F!wp(gq}DOPKi+@0Zq-j?Hv|=R70|xr^7DDutpA5^mRe-&HGjbf;+NUXT!F zuV-EPb?}{2eW#$lgw!y*Vh2)DR>%qAD3?<7(fO}QjnEWv4y@iMj4vkM;n>6&R6V;l zZGC0IJL1B@bbI~J(1w}kQBLi2!{o@y(Ka9&*HLDK(DACf28__?+KxeePvDdLh3qbr z7SQ;^tpr@*8Y^pN8-|scvr}Qiq;VD8{uE}asTRK=+ z`!u{ruzcX{dETJL^&F$8Vbo}{e!rC=NL)&KL`x1qde7H*f2h_402Mr+w+Yv8UICS1 zU0vNe8#G-2D?sDNEV8V;h70?@QU`>q7iAHqb{(BsA;KcS~Ml;L9yY zKyuUElZ&TKH6uF>&cf(=t>kvC0th{s5RXjMOqm8fsR{gd4CUB$@|oSx%`NR`j(7UE zY*+t;Z*o&-cYv|3vmXdR1Z2U_ht;oCZ@MElKxFB*74{8CI^=#n?|o}SD*coNv#|}N zbUhotUG4xl)}N2a+(4bX`<7xi#_=Y1ty$2ag(L6_I^~=N>a#azYfnmQ|YSgxgQXbW_9tFvu8JGugWSI_lNwj@GV@ zyB_xtaXvZ2)5`+y-Vc0Cew)h(d!|Ks7FFiKG@_nM_wYEcFf!pGdXU-q8VF=)hP_{6-%0tCl^ z_2<#`ok=l5;C?_#^1O#M^6h_GfH&mhiE{=Z%)Yva@yP_FU?wIe_m%69v{THxOAQv< z&9;6wH%@C;*?02Q^AhoaMMYoVc#l)eU&kGilati}rP*5)CLmOHY}0vrEs)1G2r%p3 z0ycsE^cmMwHF)vM+dl#2%OY)zV!!{I8HJ&}Qw=f!8mbmbr2NkE_XAn2*cJQr+(QLI z6t&QA{r)f+J_0C+$HShj5wURj;pqqYmK1e+iN=Uw(fp|CK;7{DUEZG;F3pg&K_5fO z)KrtA;|Mh7Pj-kp9C?n(tj0dDRq3QHcCci2_fr%Lcsey=a2^u({jiqj;(rM_Qv<|L zC5IVpQNP3%8o+2m3x7m2Ty`q#%+<^`MF_{9>=7&pXx&=>pf3>NS>ErVNMMWbm(T%1IscbjdA?U3kXvu4ya`U>c@5^D>`Vh%DsP*ON zx9GIB12*oZDnmt>$>BWhre0Iok<-L|&48~hPhp@hUGo&AM}xtQpxC%?mbPDeRioPR zV6HVpmp=42hZuTw7+)%2F&>&<1oVHVZ~r~t_3A|6eQyA82VbL$3c=)%secUH&W}~+uZ9t$K z#u?9B=<*wN7Fch9h#OEz-vc{Z@7vA>01pK^bOAhJ0w8}^lH=(g2l%3wMf6@_z!qS) z@!M~C?SHF?KMdT0()5$<(?<cLSr{iGAUd* z5ifxt{C-s0->UY)o)V?bA>&lJ*%U+=(`y?M+&N|yq^Sma%n;;o2(8P+CPWunTENhu zdXnVZrynp_HS)3aKi~HmT2d%yV(MAmO2wn?#{Gt>0da>D#?r%m7bzODMJC|))ZOv^ zO2vbxx1$|I6iwuB7Cr6BKphUzF0_N1%ne)#P#>&QC+5JV3CDqx)Zq6FeW4qfN`+PZ zlu$TH0q909z&eUMF}PuwP!vl)yTuIhFMsDDfM~Zg0#HOs2S1-`p_sr6`CCBsiM}Tu zr8Mf@M$9IP6W4gZEroWHpW^8zioQq@OZp>h$;iYu6z!=rl?X~n(~IJJ3C2x$U^8!k zrZkR=wbZ56RvskON&dpFQk;VnT97hOnYn`Kz)MPryA*iU{@4Bl)ep-Sd^HA zc5v@UoG^v?pU%wVqpkPL|(_e>+ z+yd24%^qgK)2JhVx%EJS#Peyh!Z+SRHBtp5B4NvjKLBZEUPhi7it&Rkh7z~jVS!@P zd`U3vCsjn4uRalT8npK2c=YNo-RNDwY{VPLjZOmuDmu?=XDqzW}>CRXh?bNx=KyV>69am5d`N#95urz2OMbk012tO31oWh2-- zI*6OdTs0J@^X6U;HBasO408H%JI(bxSNa9(8%xCpnM!RuiM((N=?g_%S!($Ws7h-SOXZ_mwJ zDC)Ny&$p1z)6OSrAe0c03;Xzjg9ivaA_4me&=-dzehU`|9u^}_$n)IZMHIt-k2cMk z`1t@~`y(&NZu!X07Q3fySh~8uZ&SD&w+5kL-XIk;aR5R|Yy^rWG`-3URPfA_5lg(9 z@C8KB5DsPv^|KtD2zvhqK@?)>cB%6@)OYAmlZtL?3ZK&`);PKShvoCIjbptBm1(+N zXF%K=QbER)y4crxv-vaUJ0*5P<>s|+VuJXeCAMM^gJ*^sD$daMmp zn1#W_$UBBZm0v+(3&!LKP&Xhn?r@183b7*`{@`2*^ARE8bC9CZkj|F`)4=%55~83a z?Z^RGAqFSLQE)s_Ji?wt-}~D2ZhyJJ4QM?S=EC~FNR^mtoHLv?e(%>~O9H>Fhl-JR z&nT3aw2HUG8bf*3P9nfV;W^ZVyGy>%PzL6IOr8NLs`cVQhn3oH;ob#Ad{h|VWXcs~ z2rF8d4C;y1n^2tbWs|h6B68_#pEwNXpk_UT#D>MHcV~3th>^`e8>oCBK!)+$GQ^9R z6v@wb#AlYP2`9vz0O$7$Ko`sj>CTj`1MzXxK_8ltrk!!X9R7g;68V|_spnqs!W zD`bg|B2nEaFmxqr?2Jl9a^b0jC)zD?d@sxZ#22vhJb!vCn%?X{KwftDJ_qkOs>18K zl1z4c`cz5kJW3%Ow2C;@!E8$G2tB{zuBy31b&lQff%j{~zXS9jJMD}2ujAjGn`?GU zTeUI}-;?(jwjI&_`^Q75Qq_F! z=es9w&yHKv4!<%?Y-HDtZ+F>!pPaDOOYlrAR+hL)%|6V~Hpb^BX%#SinDK<(52T4G zg;Y?eGVL9r)xoc93H`+StzU*zi^S42CyF@vaWDi0dGM2HynMD?4HXs0FML?p=N%}LN&yTw`u6tm zfZ+o-3Z_95aUUOGz!hj#{;H{YOAY2?KX4!SSnC}dLmG%7H2wGb($v8B74qLsXbnpz zhu|O>MwM;O?J(``DrVYlUzs{@~1)}X6F(}|IO8CPQ;priX#!L>~|HZ`1qc*w>krg$oCGXET|Oq z(~%yd?ZYoSvu*5lwf1ClQ!)Z7gh!$co_xCaVzWc)R&y95EI4ubzN6nob2wbr*&?W< zJG{MtnX&r|`8jimbE-@SO^^J8+|qrC;C>8*;1LZm0)#aBA%oHltIudyNA-ea?G(KC zaSsvZrILS{-utWhyY?|SMxlq#u-WPT5ahQW6Y(25v~|^X&Wz^;`6_SGLEc=Z+h$f)d+1UE6Myb0L@8I45o{J(1)TU>bdafTE+$J$Ff3_g}T z=8N#T*Si=P_<47Yzs1b9t(usdhXM07irTq+T9s@?R4kNzZ04px1Oc z-{|f>OOgx%d>6htbOUpmKpt{*_mS7rZHF~ZgQnGan}fCd8duPN3-0?)xS)uVqSYUU zP?_xR9T;D&HxlZDmRkgiawdn;GlAp8vtUfMPN$@b+;PSroqA!9e2qeFys4z=ke&8e zgQNtk?cyEeo*;?L}s3$*)V=M3)6~tnDhrW6J%K= zIJeT>plbU-ktZ_+Wm^va=)f8>z(bXPK+NZudgDnsx^zz1)@-tYYh)}V(Ij9sgyPl zU-l5N>zsaB!^R%q;&Hnf<2F{4WN0m{!Kl$`f7e~w(a6CUDvAd#Qwy3c;Z{~g5(~{s z+t=mE>6n6RAMvhssv18mK8k3ImCgoEtoAmPXB1{xE34mp7@Md=S9Zq>jAHc~W%uC} z!m@z+oW8HD^D#sDz|u1QSUbQvB+3G42xs@0o|wrXNmg?9Cp92dTI`n`Ld{MXTNnq) zq!q7PZaNTl%tzHY-*8K?_1|N4w)OWr_?ye2D-wggvUwGg@7J26ueSS+a8>A7+gVrp z(e#!Ory!Ja&dm{Pb@BJB+RfsoR4ES?TQE1V!s9xu7PHUMX9t|{jw!=&m1}ppCcRoh z=LCVAH$0g4ux;JYn>u7Cc<0Awo0%7X5*k)C*AiGzYd22`v(d+!L7SFU=w=rhc}TO8 zFD|Zin?-G)xm(PeUE?*&7wtB2c$fsk0|x%Uwg`x;sb@-LiT5A_p66kP;KQO`B%ABok&YSUWm z>RZ9D_4(PNv;L@5EMjv~LjfU$l1$KeA9&?Tzb3n*ZKErEhHQ2G%z<@}*O!;ho+?oj z@N_(+y-Hc4;*l}Cb&x(+K9`=47dMH_+e7H64Lr68rTK;!e#Ma> zVNix=I-ou1dswGkIp6GBtdq zb&e|5>N5JeX`^a4NC*hb77!ln$V;Ne=?P@{BR4CTgK#L55J>a_{|b z<=HJ7(EbEBsRR{><|WtiPKlXiHjmx$UoVg|?DJE}zEshWMlnf&WmaHETGq8sx^#jxFy-uTy{IMt*D$tbib`pmxL z6oL)DZW6Aa=qMU=lQuDP*7RRk_cavZ)Xb7vWr4|CT0U%Ow zVvn%Cy46i1zpjc;hmulMA3=UDXXU4t!7X3Zt@fqWPBNTjWIHY|CBu=2+fvFVz3#;j zEUd;`q7wg>ZQidP%2Y2NyZiS%_r>b#tPZ7#2QEHxNwq3gx3}XCEQB&>U?Po@*=WTc zRyG=RY%g+|uPelr=GvNbZ66$;aEd=%K!#0u!S`NgXaCNOemxaL{^#7%>XR8dWe9g> zyNVKKv(BY#AEj9nR>-2z{0`*MDWtS8xavUY6c_w$o}VnvKy#z~Wrw1XP}d(eB0#;q z2#*_LRn)tgzY&z4WcG4IHA zIDGNG`)hTYDZ|d0a$a{Q7w2JY-7__wbdqiA-7|Fz``Gepq6WMoV3Zn4RncH1ePqd_ zi~WJQtmk1g(&zPr_H}JY<8)ceP3h!etcdR4u~x=Pm%M@9@Wp3j*}Cb^$61l%$L<44 zEhO9SW)A!=gGOufBEP;*T3^Oj0(b9n77f}6?_p#9*g1VO zvgx(6W-7>`*5g{<+aADOx#Rr5n$9w+t)N@OEl@~tZ*X^a3tHTzNP!l2m*P@fLXcvm zxRp}e9ZGO_cXxLSH{ZSY%fGCgv$8U0W@pd4_dKuk!%1E`Q((aF9w$FvaL3I*e2(&K zA@9o3qO)}KYSa1CcNsW;G3#4`9>Oh3KB#Lm>)dx_FK;rO*`EKKENeJB_8Am^=|z6M zPXrIov8}LH&Ook6KPi-=i@{CJuW$WmrrnEb>CIeO@ls5q4Ws2Vk0bn}hzWx?)T8rzI-Hj|}k57oV8RFZDE z0G+&EH7rn}x}0 z^K)Qgd`TzxM-plsQtf=BE;gVY8xNNoa)L&jR~g@p&;6Hcc+#5xzNIb&o7?r9o|)-w zW)7FArb{y=6^E%aM&UoroOSq?oh1=P+O*YW|>6xD?XjP1<*-RHlCCNlS-1$xTo*-NnVQc?MzIL zLV=ggg=7?h@@IS`G-5O5neGd={(Srhbje8O^*oI>-8b1mpQ7lJ+0^-l=DseK8EAXT1MDPb>+h!MKQg{DV(k8#yLGnMJA59i1asmvp%7 zjdT53LxzswC+*)D6r*9If+ZcK{P-tE{P1l-m-WJR7&*qpxs;JaO#j{ebQL-|ei0;-(7U2bC7IQEepK^@^e$CEpJ z-nddB7ZsLlp|Jj)rK|JwX$=}HcoPpaIjilWY;8`stjKn7br#M&O5Uru6B0D@9)l6D zdDV5HV9mLxdL8J;>GxcoPY?&*`{A82MG6g1v!Ym$TFvp?s_Of}5j?DFMyD>u>?U

FB#=>|hSVy!oy-`a7OOF6Q5@#*o&{Gtl6{`WaV4=niM9baLkumZl4 zE4*C<$f9S*IZCZF{^OY#{Nem?>wPmYrYh1UGHRBQX5xFecBn*;9xj?Gl3D)KAKThX zqW5~$jF0B5dP=``BBP3p6sxj3J3|1yz;2;w;!DPjP-}99+^E4;LdguONWz0?T;BQM z44I?MNYk?TcK}Tp<-$s_Uw<~yDXD%FX%sHl=l7cYkxCGg1=nhX|A{ci?VLyLrLRKA zK#KBqmQjxR#=lDmHWsh?5QQQ$fKka<+S2%JvBEn;3{R@zZx2xN{R_^SnTzA-v=5OYwpMy-4pU3otv zDf+MUdsb^+yPu}*Rm5L1CKxg4E{x@9@sCvYcf6I0w-JC4rr_?})ev)yOoM#J46b0s za9i?Zi2tWN!Y!`Z3470RY-fI-_rMFms-I9*J4oj*)ZWH@m_2@i*Syy5c&%(Sg>w`O z>o`BNi_$wb)~Q*-O^5nmU`X?y(PNo&;=E|reJw6bvxqBg^So$tBShRsAi}6#j0(0H zXK#Ej%6kKlF2D<24{yrO=3=?^eaYz>FED7TgsG2^`FZ&zF=K7Gu`%uH#*OS&O@CG- ztFYJ$+iNc?)G6caT#lnw5PnuNJKN^!zK1;iz3x%aSr}cn_ROa+74_K z=@RG}sIF@@d~3A_b%j;E0;pfS$6~eU_hOj-x@C~wTAlI(W&Xgs-Q#!HjAbuFEZ;r2 z#=%GEQ-*Wf!CGTgMM#eGm=v^=sBcxFPyAs~SZ)v3!zZZ2*EMCNeD7Lz@Zlup%<$mi zF3>cE=ZMM3rzwouZ+#z$0(3e0qtfyBHFx0()^*#ZCwYdY$>e3r*l}gx;AZJL!S z)1nKU8rMS6*qV9Oy~B=0QGB&O(J&`Q7pt}MKJc=Qu#ELQ3~TiA_=enSP7^lgRC)zf z9PIEf9%vyf`P18lX0_gsy}DUqwaBU>Ldbx=);_&uB-W&In%p70wsHD^s`lj|!DlD2 zkGR#jZ45r96fH%aMetvk-QL_=Z0Aodd_GD_{|rBN{(m*cH>=i&L}9TdmN^Jp>Auwv1vUt8D8seGx+YY z<<(1(^wUM`9X$0`^!JX3*0#Doig$|kozYwC1Foch+(VT(&Myz#K+o-WHI+_GKag)G z5WeV{Lo8dLp?8h$56qdYR%4Smh*UyO zVbiIG@Uo*J(8aaqf_=k6O=WkKXGcUE8qXipuY9{Z7_oJbAzn}6d*d`~<*Lfc$SR`f zs8jpVNt@Hk>N=SeZ`*q4s=u#-Z8_!0@BNRX4{jV+gJ~AAYyMbiXKwrbIEI>#eBzh7 zgPUKVr{|j5UtgqtxxI!kd|qwke zlPHNUkI6Ny_s4hp1zC6Sq48X zuV=l2uYb8w$6z7LoY&bCh2`1myGt)ZLU9AB!3R5CY!$Da=_~8HUKH_XK+O$BM`L?8 zfTGQcMu|N7zr6s#YRgmW!#;zFslLMktWWf8S9mEE?TZ`#>}$sxCjWg@(mwqKValY( z?HcQ7fl`QeghZaZ-Kn|yGwijY{Po+@j9Bw?O@E_2x7u2_3;=n|A&L90(Y{`QiMK&&!n3{SXh||NnwsgVq(I6^>Bq9N~P8u z5xwr9?0Lb>l+gw|e0`fOitk+xrIWMX|wNd>KAx)YeYHi#mMwn@VitdVk^ju4W$A1_U>ZA;hN= zWx=ks*LBj4t7}Y-vfGD3tl`N+7PN0&h-X=wO*>*dd_ypszKyg{r!U8s*&yB#kGZQv zPl45o`F#qM|8`uZOQeNMgYQ8sn35CYdy`>qpo=oC;|1TJUm46S{4+(cD8i{BF?{I4zU~3B908RfZv@g9GP3?zNfJd)O?n= z?=1W+!c<%O&^Q9HJa@HM?}8$Vr&-pYCTt_9)RtPWkEdFFHi#WPA$f=M2E*lLwfwVh zbM9fEq_E-G8onCKtCPtJ*u@{obb!qUee9>JIY0DXHICWS`??);#(y}r;zZ;f7Nsh6F4kwN^ z-&2`e*t8r|;!U)y?`7|$Mf+2x);d|;gG_lvIhW`5xX7L4-N)!`LCw9~5RK`>tOwNB z7Y4%pok72@>dEWpZBdMFz}c$7&b(9@Yxn0NsTc!CTBxWmE-^t@?m}o;mQ}sw!w%Mn zTU*+dr`qT#u89u~$SbE8o}vs-qjx+O%lLiQ5$6;zDHh5#4cqc%;e85%)bGXSo$i(2 zlXV6x`xKSifii%}H-; zNpc4D^~UTxkS3cv|Y}To3in{!_VnLz<<)i7=NAtE)zE zdizvF_Ii&8W)*Nd{rcxTA^#h@;|{2@Ls4DO`;V$=Xx!S$n;g?Hx!76nduNC*A+x=^ zsBXR4*X7saZS*u<`1puF&XcF4XNB;@-ckJ3_y!gCGRM-=?jm!0KW2CYcdjCS-H2ME zE_pGF`~M=8msb4dnl;z32CsxE>D{s~Me=~ZyMh0)bV%FNZ7!9Zc76*zbT|vSZ_S^A zB|YnoLR7v-n@bjr8kb1+%_+zuW@t`V=;gJ+lfKi1?!f=mVz(SVRGP*(W_K z#i}%cAi9z@j9_DDGh|Hcej5-LN1p9>*@@Hsv|dSVPC-`B3h~kB8L>>H1f0@Jm@<8z z4`Rkw_nq-g6WeBq7v)JQvNC7+{q#aai5(R2w{%!~!~fwW^#)`2cQ5dG9FbJkmNkRc!-j~u7#JF!T+nkw|e@BeWRezUBQ9%X5JcifH$8f zbs(;uh>YCoY#&LtCDgy{5594XQY%B(*$YhE#4><@U}Q6ttXY50QK7iNa(7a&sCncD zOKjV?NLBv9mdGqWF*N@A+TwshzRDNh(%$daYLtyQh0bJWi*sAX&!2R-M`rLgr@n8+ zbAJoA+Hy#hh-TNN^M*%^dinvP4<>-3$na-z2dF;wd&(5~2@y_JIf|zg! z8m)s_;ID)Qn_JarkiJi3qP*L|V8-iX0mXuiO15PYN8$)Z!tgb2lpKzUoq7Q+e*{6Q zp%Ydr`xmNYd9I&hcn~@4Ud>!lCTvDhhT-XH))sW0W{)=AP+m zQmZ0u=mfT?|3^j>EThmsXs+l-qkxRHrx5Y(=Y2WlVIz8C7eAA~;0Tn^evIoM6l5kZ z=RYqxNsF(6vhNM2I)Nehw{I-{d@_p0va56i*LzXi(Bm+#*ljcc29-u>S-aPzigHih z-3YJe|Hk=Hjt0!rfa!Vpo;I_JetY@pj0bw1EmcRM*r7BE^u2u#n?n|Gss|UpkfL<& zvETXzQHcAy5JWS->xrl1Gm0M+gEh`qe`nsBnZ=Z<8aSJ62yacH(Iygo(!)jl_Rzif zdJOjwT;Eb_m*Xbhb77PcOgq0T_3pD*Pv8tvIBg}+GH;<<;D4{U^I=%3`i zg!?oVlAnJqOo4)#G_v{a*b>dJ0o^lA1`rf6T0j z#Fh37|7U#pVNFpEo3`sm?)1``5rvOP_^0i? zw*`c=Qex|JKjQb#0;E~6gm9!y7xtnigGJmq>$QajvE$hV(<6_2t3a@UB zWK56wq2r#m>))%1)4O{g0B_4%1SG(D9VHjQKv2GfY-M%T%*_F9>?SiFA{)srr1N=- zb_L$f8@83molbJ(-pa2k|K%qpmA!^XYl~XZ0)0wkO-D=L!U2=w zudgqhGx72c3|3R$%uL5Kxyf(weJU+4t!!$NY?~-puwT@rltg_irCBnkXJoXszaQ@l z1|OfCY%zXw5hx3jlJ7bkG!tui39bA@O72jj&`w9 z#6tzfq?}#-x+ey3w5GH&W^C;VQN0#(R2oVwM2ve(6QCYJsbksa_XlRtJ)29ygPuIr~bMvO?wmqdLGbmc3}Jr6cfWdiS(Put_? zKLX!!WQ%pqum_%Fy?&S7i4kZKso!HqpPc_TqhHh3q_oo-o)pdyN8ze(x2SMq*xZ4< zGezB3L?8wm^&}$Swo%RQk6?<6RB;%~ zVHxIu{jI4{N8v$)APd=*IP58K>maf3m?9fj>GzAM1Dq;S0(m{I8N0tO@>G|tYH|C% z_bsre@TP!p+`dlF_vKetrl`)>a*6qi_vGxij4CvtroL|JkQv>(;q>nmf167f(p%)a{_NAQU>|-P_meeZI~#Qh$`bKJSHV(5?9R82+&81mT)K zbM|pc&?|k4xX=7a#ReoH+4BjA*KF#yDOP1PB`ZmooU@YRB{zdDYF~cD^K)@}zav+j6%oO0Ljq|Srp^V+>bw^~bVuK6ZZ zli;nizul`-JDxlP)6MC7K6j1V>rt2#gKBkvq}Wulmh?Z< z+t3#`a`fv}o8QRl={HOak0@)E)Cq|#T6vlO3<~;cAYl{KY1x2EWa;CP1v#M^E!i6$ zR>nnpU|(}r`IEztY-Z~kJbCaw!5V97YRYMEEgK(k*s#4DuB`~pi<{eFDQIFB?XK~7!XorR=LGo8yDx55L;5}_wwrP>XIZ1 zOZs(?=7Jg~I;x2A`?pn;%*R=PQaeOd@y`5b2C3!iIW|Eomne^kt{fV+PDDwaM6qBh zhf1}tmvk9@+OLdmmuDc8S?LDeFK5Bw5d(pN9ptE@$;e2vl`;+B*af7FG`x=^fjo3$ zL$cs-opFvh(#AK(EM7W8u)&daJasHlxyV_Hs%5vGaAn;D{rWoYe1l=l!qk?S2ondQ z=jrB9sk)9_i^(JUEivl-$a()8eZ4zJyS;aV^0oZkrd;LhhI9ggvdn+g6M%|Kj6CYV z_hh7#4=$^(j?oDdHk`p;_yI1`^9^X?3#CsMSuR9w=uP`hW080tg3(P&EjVHBE zGaXCLl=YOii4S*+!)Pv2D3~P#2WDS4_|&BV8#P~dC87K$KqfhQ>cknGvGV3^fXp*A zW5o#8S4KS!_a>(!TPyplRUzPvBb^aB6U-cRgmN8Oj#fR9WXDF$EG?KWk(_*rGi zW1n}w{`cf;=$1yFB4w?tQi=EvX4f>;$AjK;-!xr zE$vdUr^VCKgE;$b_Ug}^NDi%P_eEV2rfeg?!Ou#6zm{cM1eYKRPZz-kU3L+w+`Opy zCpl-Lbjt^GLXTALeo=0%N>2ex9jL2S+z`J3pz7pajWr?KWIt`&_?XO+@h z1d!&x6$TXIP$Ty`ul_NXPKv~%Kh#qxF0(Fptpi{1CO1a_!r;?`e?SKl%7LbN>aHpys zl%#TEs_ROFeRg7MrkMRdew4SsD5|afVw&4hs1mU?$wem6DIsR3#I*&+tNV8)EJzi0 zTD!0!O23fJkPgTfwfpg#c6LIyNgiL0K?cOue}`cV+UnCI3Z>!fU6(%xrFOM(Uu2=D zxs#4H%8SeXH2|Z%opFU|)=9pOe=qd3g(TsIbQ1IX=6s38jBZrT$PFqjjP;!d(l1DQ zqDKR$r*}*JWSeaJFQOnWzpE+wA1rX6k?{a@tGdg61_*jH34d(1b zdHVNZNf3ie9xn*?I#DQYt^POS5yE2kUXO&A<*y;xHEeVU3Wb_-EHc#O7b?xQGx;Rg zq3Vj?_gvh+7BVDOq6m>eaG`T=BGlVOe9QFvW`2EQj^boTfKZv!^uYvtS+1a++$|Lv1HAjA4-Tj0_g^_#l)<5PmDu1;&!#32QGy+Dvdc0 zob|p5l{FRQVN?hzQeldXcMWpG*C{Onn89}bYid1{1soF zOr;~+gTzWi37~U^ib%ovT?p9$aIq}WZ88nLSbEw64&`=olb{f59m|gx6RM~qA{sTo zBiLF%kX|GLu@F35f<;P8%knb>Ul2e48}q+$f`;*yR#dp&4Ow7D(^WT-n@%ulhVUZi z77(a^s_z&RK|_#7MRyp+6X8vx4EVEvAoMr|LJFx;`k@NO_`>^($^ot z(cU_AyNc6fAL~x-n4ev+ldp)h=uqQ+Cx(^XnzLZbwY(JfZ=E^lqOMIde13)5d2gr% z-y>Gu!u6WgOx`5K1$`dCG-dK|`X!59bYs61I^GSSVrqG|m7pxh(PVb z^detPd}p9$E;JMAA&4}~qbyVc=&NJ8xZLC)(E`R=Sm59m=2oO7tN4}8p^z0&0?KQe+EGwUy>k;|U@3Fe@MTrW#*8AfAZ9|9N z?g$L02`2fYs=}7xRTw}8H??alS7IfsdFTtkS@vIhPzkZ3WPNv6Ptpy=Rr}~PywT~H zxRw>o^%L`A!6#FH$yx7CUIwWwRuXl9f{oV3H=O0gB%n`#02Ld)p3v&VAI3fyF~APQ z?^CXf;hO~Pb-R!Eqmttzhttg?kBclwCO%K$5>aRj#s-R?znIo(!oB80l$jM+i8?50 z+RJQ8>95z%znkvF7&^sPUW#BruS5e&i!Qt$Vlp$?CgEvj|6pEH`WX;84Lna%6>6iHEB#7tAq$jYj&xe7OASE45J6=_2@3MqaQClIEK zuf}4|LzJ$oq`P(e5H3vxsu(%CAxMh;F|=*35q&1H+(!N~$J&PmiOQy~oNP<`zX+-TS0{?vvKHUgr| z$!@W6agvNmyaM&#;jHW(u!T;RSl@fO`Nh@T6<0PE(vET5V4ZyEiNQw4%Mkx8fhtROFG4b+b|AF5nsjK&v-QmR7*dRqj z6QCLw*A!@lGdGoyGR8=jnTzh#3`xLsphZrtn;Y}GxMYfw56vtiV;<4D6L`15uv(wa zcgn`$V#ti6VS<`&Am+3(d#D3GGB%G$wi?s(t_nsKIzDdA-6B?+YKUrM+)=N{tZ{dW z(l3)NnlUM<+>+A@;-rd4m@Cnk_v)FFW4SJXJNcZtd@bvkv3(@o^~fK*-29>%8ygvs zcigeiHV+2ce4CJRb@hX;^t1p^CjRI!5~yLzkKeBMAGV8>mbY&|95P@0F|VnV>8s1M z&PUQ@NlKcw+gmnhRjT_cgZeR7y>bheD)izC49RJ1=-GVnm1mH?c@CYlc}Vq1eU$C` zJ{wM<%y8euq7dLoKWgt38Tf*DWcidi0qhV-Uq|6_f$cC5!6u}l#bJ^hfv>K?e`p^1 z<~02RnR7T$0Ot;p;|nhsvf~RF*z3C86*CJrzAe2UP3xj!%|wdB1X{efq4)iqCVhnZ zAHEovM22_Orn7lq#rEIc@QkO{2>q>R?-_qf6(!r1q^c@d*0?Q)tk6ph*xJ}wVEqL8 zvB7v_32B?ed1>pq-q8f0_sWNk177v}T;@dtyJw;&s<@z3I|AHg;abEhAVTOjK9Lr= z>uYl$@VKU3GOH;k4|M|;T@V+f&K%*IUjw^{it7;;)XJ((s7JQ7(J+@AySx9CrZwGD@)2V* z%prwvu|J^@ML(+6yc+b3LtSn8;Fr>!S3Ba(v3riv|pDXz4G-=djJX~Q|#uE8;3fYy8I zq5(y@Ob1czW1*&*sULhtLzFjB$)|%DItwT}s5Nk3B!?T?HhPD2`f+IbGUiKo1H=QA ztW#^Qcubq#IIXI!}6#G?K-+R`qu8F#Rr~j|vO)K0Fbqs$qGjybU!R zlI!or*J`R9VH^qlNf9%isy=)Z*2INx!AxQ)NS4R&w~-s$gqkEzU}HQRz-otpbpM-r z{}>s*FaB5Y*5E!3yp9<3ZT*W;U{6hv603Ogm`zhK#by*8$07>}L|83rd2b@I59D7R zY$fWzzG)b$0YH}%K>@X2#kY8NtXD3jeWZezZFwMN=(2#kFOzy&hCl(&i)ZDENXTlw z?jpbJNJv0F*FSq&?gWK}B&pAzou2Y!;p`qP_(|s0*Y8#wI?kdiDj%W1lbWQDq!bia z*8|*2N<;QeXK!JU8Ujf0IXo}c<(TujJQwn8_mU`Et(NV}|PH5dK!b+h7zWC00={iJ~cQ zE7*m|Zn$jz;Nj5+ke=aoXFgwTT}RtbmQb|3k=0fHA*|GTJ>+g7*DJFJ<;ao4&BWl$9YoPTt+ zec{ipsMeS-Shl%;Ha3U{QsOH7P`au7tY;SJ86jozLD%eHWc zrcR9u?0+8S7w1T!n=X$&PYcU>MU^c>=_3xxOEpQ>NAaQj;r459@-BFbrDLGIaEk&bJ>M^H%;ICuvGODa zINK20GE%{C4mt~ec8*(o!t!(njOQ_AM!X4>$;wqQ)8v&A z6%R}-XAIy*Zdk-5yA)A%Tgbjn#EF2xajVeoJ?;Nb;yFp@S^~Jn^Tr4bdiKW08ea-9 zScn>BjwRq|m``@b@GG*TZ5o&zP%0!OZ0hG1EnnR$A?8H%r`O5yaj{dUM7Czed}9|w zkt|i3`#|o8_0o$}PMzFCD_melqF?+N*iNCO&JV2R>*xBVUo1^ax_kHx(wA1C#q|Jb zKE~y1K=b`vp~KU>7g;!uPfr?(>oyRn@9}{AgIbnPM{I<<6|U2+@>V|25Ak9c^UWgJ zSt$w(lfz?1Ju25Ym`j06pWeJdnNg6I{3MdnYj58ggN?gltHqSfBOoBhoj@hd>BZGT zEFwmQexitB757k`q%ELM^tnL(T~< zM7Gh@B1@`x;9ifM!JcUs8KTbKE09Y(jK%F{LClazccQi2BO^dz*Z|?>6!8r^1gl(z zgwSfe_uFk=n?O0KQ@Aep{2%kL*3N!Ca=I4w?b*iRpO{jD`}O9QKC!lT5Ex91I^j>? zzG?9#0_RuoC+?n|Azemok(k(9gDVCMYYSaTU4eyX8mkV0@BoxY456~SxTNW*s@0Ecf|)Bg-YG>ToHEaV@k-I=CCwb`GNawBw*N_4OL91*W#FB zoodxcN<<9p&tK6sbz0%7h!(>#osKloNHabmL7gVl#r%79{Jm~C?!{Riw=oRXbr}AL z`L*syOo#U;&K->PTXq7X)D!qTJT|pnAB(;`4KAWlaq5rT`=ZC75k|QdH3C=TDK0Xt~dfcDyTJ-i^@t^k3^Jy|Gw@j@cgjju2Wr>MXIln+blcu2> z@2zhxI|4HF^&Ph^NXg&}tQi@bx&pD{f0LA0U~66+KbR>NayJFxu#dpC?WkM`oBKO{ z#3cvM#-|5=Te7&QDh)@rVbdfFYmqNHwW0YT0<8;%3_oJd2g3O+ZY&z+*2UFNzdRpqjA|C?Xc*`IRIf7tDo@0paB44xbHQ zY5PJ#k`IC0B=GlXheDNyzsL$j4;*|R9b?IH=saflYYLLzef)VgK%H!An`e&3XtobK zs1~*w=)NXR1PGT8T}^vgUm;M6e$O}t zj7_z4ocP1F4tkl7LA^m6i+VBPDb_9TqOl(=+U?cWJ^*j0L6Nh_n_#Tb!ux(f1_?XS z^jtrf+DjTuFL-o)o@H30N{pe3ktROMCGfycPd7MDQH^4FA|fT-zFh9^Azsi{2bg)m zo{8$h`xIv4VVUIIqVEkqgpSM8T@>Vb>2GxA%XOP7z`uZ^?Nux{vSaR8aYNALYa4TA zOO0IqEM>AHr-+D)%cz-I0BHdtgOyA@szE4?3v>egtj#mC(%p}_btRD*-=eKjrAcqM zz)zMn)6&)tKtixh9Up2DIcSr%gA%7v1>CUCfa9|%7;upbM(z=kew3CuRe$#S=;V|j ztrnYh;L-sut&&0vo2|UwCo0GJWDtFQ=hI(k24IWlxBqY;m@&r;GWtx155`fmyx;F4 z;dj&Xyvvtlgma>V4VHY52}-1C-qX`xS+j9TZ5czB59^TO)hla$eZgEoioiQFpQ(X{ zr^gE4>_f5CG1~u)$4)eGnS9L{NeEsmeU83Q`;TV+A3fwh3C0>L`t#f?5cuic|Goe3 n2TtVwAH)B9A$&n>op-#IW*0L&T;jie1Ai&Vs7jYh83+FlimvUh From 4b1a7f18e2cfac5f10e4ece6df9057a59c6471ea Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 28 Apr 2016 18:08:52 +1000 Subject: [PATCH 118/439] change image --- windows/keep-secure/images/alert-details.png | Bin 74033 -> 52295 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/keep-secure/images/alert-details.png b/windows/keep-secure/images/alert-details.png index 49c12023c3f7b3f06de4cec90b6b724e1aff3719..d762e722a03b2a96dc2c6b6030ad78bc8ad0a300 100644 GIT binary patch literal 52295 zcmce-bx>Sg7w*}F;K71RLkI*2PH-9v8X!P$w-5*fhsHe#Zo%E%-CY~^;O_3Ob9mqH zo0_VbxieMw*8PKG*XrGUcAws7?`Qwkv;4ovN}!_>qk=#nbjeSm3LwynSr7=`0vQpA z(6$$^1OHI0KB?P+Kp36Re{fOs7$iUt2`VWghP3>W6d9SZy3Y}a03k6o=tn!Kv84?t zuXx}S5PJ0-5;e3nuraZMnpj$Za8M{HfjH`OT*T7K$;RZnF%(pYIlv1(6=!JX_zr3%+4Kcs{|rsh($2=f5OneMYwy3^L@dqC4K1Lc%Yo`><=~E(EMLx^;pk}xv+b_x0f{>FY@%hni#{6 znR6P8)3Y1blJGE~wtsb~3g`7me6+ru8ki?PYrb;3y34D-XdZWS=iB1h;(ItB&$*k& z@zF;XMyB|UCEQbWnmES@dTt_9I8Z_>QT}Pp!2OR~Q(ML^_)33&I+!CMT0!yZakMo3 z8&*zj5JTJtdExn_z4IZpI~onIz2LQ#^|f35>HwA#x;p}YA^-^~xwF?N_+ zK2TOKw^1%K zmM}w4VUxY`VTb$cwDe0el8%)vr zgzwf)*@z0_Y1d=+@XQDHw%GX=hojXeV>T`<(qN^+G&H8SH&TWY2fceS&!bxRu`cto ze;qYXU0;}%qCQ-dY6|r{VGqzijFs6muErc=mm+wuut0FEKw{&`PBpz8Nt9#JB-p(W zCmcxFjx%|Xni4JH@gYGggz7^*%l6&~fna1Hew>-zEulFv-3X1pHKSfivR4LybfFb(XL|#+$NYrL{e|GJCQvkkd?ReoqlC=@Q|zLX!giGr}H^O>>9PR1-S`2 zYQ1)m+M-xL25GH#Imh|I5MtXu^UFezz_v1hzqT1u@P_2=5y4h3-z67pj0gegfO-?& z;Nkl$aaDK>^Ojn%y1=pwOsFFG*Jp8rDnyo;57Zbr9PN6GUh-qH;*1`jMG7JqX+&5$ zzF|N$#3U5+I6P&zP&8Ncc@g6;nq1LyIX<-OQUCs^63;)8(E7DXU%wCE`ISmwIJ;)0 zUPAeIoPklHG_=dzo&~voe`ju{%fDfPSllDQaGQfmvSc~M)ZTg&!@hFW-;y4HGh18Ip)urQ(X5CfWA0_@ zr+)sty21Ie;X9{s>x*7vbT<3~`V##~jZ=+dj#D-2?m@DFG_N67P($gVbBLsSl0+qY z=7;z~(p2p-hPCp3h5)}T@->rY?^SA{*WwJraRW?Q_y5+^&G_juaIo1qMtgl6f>*9zrEc#* z#%Ud`NExFqav?z#R?zVL9BncU4tf!-5_tG{ieb2M%4L5 zY0R&UCQZ0pn0!d~7E&d`a2C=+yWtb@!0?J0b4zAM7we1CDkgDf?nMM{K z{QDbyd|rkf8@y}7USdEEepWZ!^wa&jx~;F^@Be3=1M&WM#rwasibwzX1d4A+Ea@`; zeDfZR)QtaoYx+k=e5k;!zjpt}e|v#@>B*cVcTS2Ne9Z1=9kdfz93YsDhE5G)Z~mQz zo_261OyGZagKtP9|L1l7*R-^Nr4rsz=V;AwnH-^3@abx4@I>e;=R@9++r!a{R}I5S zt7deqF8tvhQ^XQ5uJ>c6F3{YNWKp_v!+QxBlS{;bfm z`MX<8zsk@cs}_bO%8cC4VMp$ab7L;LPc8~czvmepOO^2Q^MxIL&Re7D2vofr%Rl8A z4hY%l!Icja;K_y{+n6vi+oqP!uQx`fczDpLpu9Jh0YYANoY`Mbz9rsGm`;P4Vcztfy@zmUo zZv$?a+m7$1n!GDUfURR|Nd*=$qzMOFiTiZ6PGn`ddjH6Nc;g7YHx~>zMi5Nm?MS(? zoj=>fJ{+95vf$&-UF)rRc-uaFpPqZBeY99?F84t6CBpKxJL*-_vdxctD(kmjVXeQE zt+4XXb|JO1NFh2<-m!?0ny90<=5?|!kem(SKM{GYy{N`qau`jXZudWD$juKFtBBRv zyE}FxZ$__`1-ru=t@&s11~P-t zmHp6WROY+rqjm?k{{G|g7)g)OvXa}33iOc6@#`YpYuyuq62Z20E)UWYWC4Fz$|K{w z+0)XR<$Y(#3YW(t(s6HvAl>@S^0{PX^ICoI0^=L2R04}v@Z7i2T;gRigA0udN@FC` ztAlGkiKUZSOQTiZTEAO5aY6+{VA4;?t-30PXXLQG#S`|&>we3m%#xdA-;<2pq5?|- z*HyPC!l!GuzjL{|-dj3#zX=*&I&MC-Zh1IqFx*={yhuK4g#|h_-$vD9wz6reSRbhh zzI5GOXr-i_Kbv4)&Fd6sB$4x2Mz4Lc>>fJyJsH3uJ{05$eb$&rvF0Tl3RO8gZ5+h9w#vby@En$Z?c%zPD;R#F9i!M!J zaXa%OHNMAJ12#YqZ|Q@;y6 zyw%bfxOioGl2hVA-@Mf|4FA}|44dM=26@6x+B|Ml&Lu)u>z3|xSLRZb^yj_YIYI34 zXrK9o0+9l^+FznqGAsB2-^pCoelG87`4&>@uR-2EFn+iw@Cg4nW9or;^+XWd9@q7B zgS$w2|EjryA>sCIqr?Nl;?3bO-Z1~ANu$%ryTp^L_vE zu*b5u=+4W0M<1t+0mP@nvx_?O1?FQzWCP?psTjy#{7nJULy_~Xq-uCoL zFaUP4In0m5{J6d)c4O&^tpksJ@;D<$Dfx7|r#M!1A|rS$&}b=Ps5?9s_FcfA*=<+E zyX9Eg(0?f)XYo>ho`e}&y@P*=A=-J~H|0~(-tb_#KiS}-m+OhPpx1HMsX|1-i8rPj z>6NQ3u8ha~B|p|R#m*O z2muwW?s{ExKJb|PCv@t04~qG1SI#J7nW^iSYJkiYMRQ#OX`P!f&>tpo^Yh!)h__AO zqVh)qIta~Tp|J7e#O-M?GZr^zwD|fm%(f2^gW18?iK6-N&f}G($KBk?Wlam%()qyj zB)g^srNr$Z;rNoP3BSZ`eD1_x>B(*n&GD9A-em>pBw7W{<4LIv^9ddy^a+NSe7m~k z)#8ZTa^I4&`mTge=-Bd!CUNpf;=b>RqifjhA%pvAZz-Uq`fT#R&z{6eQFBwKD=l_) z>}_vxH#NNz9e!)sD)i*Zd!e#$y1Ki1OND`E))UtsgA`nk^TvunEjn4W8O>|IT~Qg> zCi+pRAa3xpmu8s{M)&J-kKa~~1_|m-2Tn|uH5ad09&e^RPz3MpS}~hW^zVCq>9$Ic z!yltFcMdn6=r?W!W3Fu54lh4k1GDZ(tpd**XFnKno|l&an@a zr{@>ajA&>h)s|}uu!ivI{3u5VwQy8A-e!L5dW>Fs6~?ukOylmpM|&?un6MH0I0idI z|7_${`*nI%Z6A36NxIUN+ye7$@NX^+>d@vrMI^6Dg3tker18#CLW36-tMYfq5!ITH zxmtT22X-U26|(;K+l!WP2G&?Z?C$rLdOWA87ux5%{I%}n#C$=~;!1Mh@$Jzf5@s$! z`_YA1fvCTQ%q%U{i%y)WsVcAH3nlg>-1zX;RPyxAv4I0*QaT5280*Fhya2yCKUd3v z4fQWMMWWUBYe%i4X|kH?Fc))cI;Pxl0f4?#GUFsMlV!oXb7o zJ>DM$FUxrlJ#7a*VYEE>wgxuqv>7~|U9CWt&YA9qno8Q1ZWGAcO9U=|G;SOT{48lb zJB~@Y`{8;=&&2!2;x!Vt88a&y)=UO|c!Bt`9`PKWfqxhcbHeFp0K=qFw@|Pl^_a)C>KuFJZPUKZ%0R5b*8v*WAkN=_?B9wd3DGze?LuSB-ZWYOZ5! zcwen>fOH<0ZI8oCoIuP-$99;YP!B{b(*{BBsiw8zlcA@VpcL2|X2ALT;Wqg-Q;_Ss z=F7IPC(JjuND-%Spp=`}0>{0A&l}JC#zV|zPr=9e?+(+o{b!v=iOcH__GdbM2M@bF zyHAX~Lr!G;oosTAxK}1vvPTb=e{{aw!|@&cWfpUc*0eonBGz?1hFKpyX!c<<8p3(H zwA^HUjgx9`IPo5C!o6y`Ey3Tbqvj0@ySkhC9wj+385GnqDPbBP%*W;8JMv|-_N5wQ zH;Xb}{trDC9pOSmmQv`3u@;i}`I9SA8>%t6=uRYjW!db$S|anPvDm?g#&6At z-KI{-5Ln(A|I6(1V9QU{N+QxBK8W-a=qBoZlfr8%HC{?*Wtb~m?rU7A9^|*v7Wpnu zC4#{OZW6eoAybYXw{i3>N;lypp>Jn_l|k?<#bZOct8s0*EW-`c%42BG?c49WHD*uO zBWY~+?IIHCo7D!s`yJJB9U5hOztTFrD0~+zVCg5V6C;4Us=7m%pc2eZH`^wRR zYCNWCdCigf%J?Ag=+rYuKucqI2$^)+dSX&GxMh-Hv~pBs_=IRj_GS!Vm75B(_dI|yyS$?9rPRQ`C~$DmArx031MCLH?! zEgg#9ipymfaY@mqJ$jw>VP_BA{aRcXK2-=eO_+naz0O}Z5nV-XV7wse;WX{_+ty9f}%#X9^H;=Qr5_dbgtt1*H?MpW~Euoe*&W?X2 z9yuP9^H-IZ?$)l4DS^pxy1)z~Mt7YvczW$o^Wc2H?<*Kwa(f7GhU_u#8VNr^!?|w= zzPYl2Pdm&-O-E0Bx!1K>h!kzp)Y*l5Q4fP0p_U+|CGfe-W&ES9}^V zi)8hr`sBJ3!*{qhWPM~SfWXJvsrYobo?pJm%6A-%R)~Gcptk*8$EWff55pHJb_WqL z3^u)AM>r`i4{h*IhKOFx|7_;PB|wwA_4vFj#D&Bmf4hs-!L+>1sTc2QZt#<5 z^NdzzJvQiv$axh=_N~bMTMY(Xf`IQIIbd}$JXw5$)bYk0kz>^6J9Nhkc$;dG4O`nR z>D>XR>o(3-zS@Z;GDmF+GAGM5GolsxdbNh@;eQhReLc=vTzPcP%u~8x$HCY19+#}k zBu}W1`v$GR6QYX%;(J`YS`&Qec&c9Q-d6v#+!_x~C7uI^*DKx=@fvd7I!GUH4T zn(I8)Lv&N>U@7-)pJX51uhhT9WEq#pMYp|Vu?pv_38-YmvL91x4=IK(0}E=Ym(m#M zuNgut;2xT(qcyv{MW;aOq3I!?R2{A(LLfdHPd+VYw^wV1CB^PYYfm?=Pr*}-d#cA* zdo^E}6nZ7dA71L5^hiq$YX@dLwDvdSuMh-U3M`(@e?JCP%Bm}uErrBg_1k7z3MRte ze-gS3u8&;=t0{h5yl`Dxa(~ynf-fn0$X9%6M{Cn?-A_XXODVZ4Jd5G~P0+M_Q}a2w zAxV(WiP4=1S z+sTvgsYkSXv`9#w>c%d%xx(_0zcJ1~#I>N5Dc#Mbh4&xiBiy5n3O4_@X%G6JXthp~ zO#Xx0u!IAY%+)HQ{=+Vi>j<^}d#V3Npy7DP>3{u!>R&#wq15!ME-Is`81(Oul8Xw_ zKH2X4Lpp#{wr2?Ezy1Cm<`jywQ1&R z;EREL7(uT)LlQWHTQN(^%)0 zDEnB%shGp(WQ4zjdIA7Rt=N%1Do&>@H0ZJsm)C^#^{uIAof`H9A65e#fHfB0fX&23 zV6{wAFj-0WLOT}8R9jSlANjAt|^3_URoHNn$#`U6H%rb+Acs@kN)bZ#V6778pnT@Zxy2&w& zsk-`WPO(0eE{`*Ow!x}>{PZ;?wOt$zi<3GI4UUxGGL*`N=FWWF)Z$Am0{P7^ShZxd zm2)FGSxWYk6ixd>M#S;{Irn_1Tq2q8-5pFnd>_aq1bC!8XAJIEMtjw>_s_3P92-4w zrE=DUfviL2;rQBvm9CV7b7RV+hy80ZaMEvU?C&%Z!rhGn{)ILPvK?y=4_cb1Eo;?D zJ}^mf3f=jTiiiw$xyLK~+uq77CGzydO6T|5%|VG~MA{qQAP}Cua~YKwWjDoiRY?a4 z6Pm1p=&?;ZWo3I4O|}n)Fu%en;Qa%R{ufqCGlaqxEIcGJWfUvGEvuo)p;>(*D4qGr zwBfEgt*D=4+hPczt)htHDQ_cch+w2NPl!E>yOr*r|HE7`f4t7E>0?IDwviG!SNd5S zxOGl0QaxZ%zAH9?Rv=eGb@vWNv!cGK2EG4OF7ICiK@WXSyc{#|@q}*7Gf{ zDBtArbLUK@3X)o()Z~#PA-ZSs``%n|x-W{+M+Gblw*H;??JlHBd|vM*w89q@rh@9e zIm@XF^9<+Fw`FTKQSg-sc()_Bp9%zps-5#*(QXri2WZ${p4{4*Jfw~RpjgfU2Y9gc zvXiKGn8flp=x$}dnrl)vVk7>!Rp1e7c>i~bwRG^chwveCdX5CZC9B}r+_&_DWzdaq zgvt{}>bL0#DrWjVk__G--Mseq58uz5+{N`^Rzdy>q1A=}13&8=;dqx&^zj>-)a-Ls z=gmM{{D-N{{*2VQ;b^a1*EE40Er)RzF4fX2my1Fjl)4PR=#bhb=)2CF*Jou!VsYrN zx}_88wPWpoTb5$r&xsM9=j_S3?v%Qm+SEFMb6Ge#*4GcHET~3rqx9Cv#qqo;BV(w& zU$UtIJ~XY>t6{rsA6}ig$luw*>s+Vl{VT(r_8nG$xGOTHk%0)D?5s+3^x5H3y)?3E z5vsaL$4yK1yfOk|KG=hcoOMj;}8^pCIWc4<_LT6Hq~xyadS3$DC%r(x)Sk8Gk6E?RDu!>cq~(u+)V2-n}EaO z?CNNZKgRyt{V6v^jPOpoac;Z7!QavSX~Ioi+(V2N2e{#}mHoKf4m^SE7jI(qe>!(Z zzeh5krbJ?^w4O%5ij3OR|M7X{g2Nc=qy7YDNs)SkU1eITDSK)N-voVh z#?KDN#BynTDSeSnE2+^0g`26qH5K=#)>z(VDbzR&en6|NGKgtDAm?uQ6aOc{^Em^x z%ga6S7NViA$WI^eieN~~SEim;=6qhiSCJYs!*1sEa?jPDXLqmvRU-P$`YvNGfLh75 z=lIZmlsB_^FwXeUZ>#KeOx^a*UNu1;`<2&c{3dHymF>6>v5d5R^TjP}VLl$UKP_Id zgnH1U>Q$$a(24eZp8rNyuKlH+MVxNFKG5QPE^(vpz?6HxjztNN+EaGRnR2$_DWrN* z_`6vc)WwYE5zomI3#Ep!urV9e6H0`tMQVsJu=>xg zPmjK=6^mr1oSB&PGuApyqBt!S+3TDNkNmIkm@u*T|$^EkKmiN-2V!g>q!f(;Q$UB}4nDGnjJo9;Y_enI~{ zD{~tsR*FF6hU*W1G+*!NNQ?!0mHVabu(ypZ?DpZ&KE-!294t`@Cp7<_!Ai|6+86LX z{Obj{rIiLYYhk%Vs?y7{n4gCu-3lCk1WsBOVc#^CkQg|$6|7{iq1G|@{R^Tw5dw=! z^@zOrD0chlTNrH81Wef}eY0Y?^v!#w_HUFiQ-5)q<>nuMO5i6DLC3nahg+bXfAIf` zIcgjHNmb^2pDf-&V@rS7TR)dDQY<8^5j-d1(I5RSW(lfychfvGq4GYd;ipBeUjqJ> zoyl$onO27<@3Miq%@$7R_kzs~T|>nx0avvhEn%c;OxixX>CC`1sBdY^52HL)*k#${ z+4#+#*rd2}Or3zP3KI^0uRvc|X?sUqhw^TfeGkW-@2MpM*AkeL|mv z*KX&da?5z3jq55sBLB%tb?^$_FfIH{`bQQ1nM3=Z5SRadg=s4W=>aIDSXenjupj;f zQvHUx_RnV?x)<}=ujV8E@aqq{s!kBtuPjKeiYiE=#tIJwUc$Gz0%Jz%1@|pS2+DB% z7Z*NhF?9l6<3t^s#Frt-Nz#z?{9rEduoTR`u%OR=ezHzOK+ZC2v4*$=09i5zS4rH| zoUge{nZA9_-yi;KZd%Q-Q(rfkjU#+WWsfszalQ-ytR>&2DSL&kp^;nv0j~_*8)4g% z1fM;Y#e~G8{QQ0}b{3?wv_MNTy&x?WLYl7d8w~jZuy?}O1p5hSyyplnkS@ot&OXIU zPq8w2JMK(>o^vdym8B7jtQ>=Sx^a-{C{cFZ+!hTGPl>v--Mv zs~U-(v#jk=%a3DCr`}>V7*3o^{oRy+2TGkw-G;OTA3Zr^*x|Y%Jby(x)G%V^S5(~@ zfnnyxj@1i&CWv#@_(yPBQzqjl?rl&Qa#j7%4}HGU7CWHU!21#dcrc%_LG z+%?YET^8Uo^tb8>_z>+$gs{A``Lv-nu9fkEyWaoA6(k}9&QoU4)GE;`K78Ye)DK8R z&cJ%9M7+AiM$RnTawY?QPWmoWRw$3*9-sgU{#{hoEdyjr;QcdP1E};u< zbkglj!ZR<5iwnA)z0Mo@gC*oFpKeEuZ8Rq>#1M@B@>FrRB!5rXg)=@BCJEK$5lo5Kjv~tUJ7a>X4=XEl zr0-~NLzI zt5>uPu=~c4yo%eUjh!&_l1LqR4%6 zU>mk#QdV68SO+p@1CQ=IYSZ(Jt~wMFb-^>}BzL>qmJ+M3HkxB~N&=6DbCd+kGk5nl zs0|T)B>gI^vZuBJas3hqkk?xfCUE~ko>z)__LjfT6q@xUoTUT73=wA%G>Y6c6rV@yu5f%D>wR3<0~0T0>CvxZ~(GA@eV7ZErSYNWU+re zz1aEb4gGDaCgVt+QXgVn|1E`T=wzSi=eCb7UU>w1)rD)N2%nAM8sATzqnElTMvt(j z!-ie37QRfj+(h%|?AWEHBmGJe?2*UWB}Psh!>CH5>5j2^DaJqYZj*Fzxwj@h?{9 zvTmdXcR^oHV5S-~vPV;X9;I^%a!-o9uoN3(Ohn!P>($HPHZPFy#_7=&Zu10>Sxw)1 zWgf2c%kjz`Q|Fg2oT0WRvJ`+U=4E2KF{~9LkF<%qTommb%vP_B>#ynRfX)k?1DBBGJ}vrgK7!|AO`DasJTV#^e(|2F6e5B3EE@C|vR(O_}0 z3??VcR-{?|L9=&Ep7n8Dr00R`%D{{ZcWQr{TSy&g-0V%}##Al+;xHF$Ibi(x@%Mbw zyoQ8k9^A=79X~cKvr3yfs7Qx<^cFGN`kPwtltDvog0`_XJd2{Q+gBL&x7HywL3B5g zUhUf5$(7B*44aYe^ipxnk5k4}VJ0p!SOi$_KQNalj%x&e1DnZP2;m5S+9Sk+b1{OzBOrRFz!Ydcabj_hfw=}A&jlWWRuO^ zp8Z54IkhV(3NKC|Md2YvZtOPAf}`EHyF}|?B52ILpLLUMXr#*{;`q!V3E1$Keb8tjZ|X{I|Tz6Tm+I2-I?eW1-SdUnhph)pgyyTvd=K# zUi9hPy$Q12GH{(x%FB@E@e+D$8%Qn9s}3v0bik*C(zqHHGmq+290m#z5H_zpOcw%7 zj@hf~blF9k4`PWBbj;}HcKwyjNGzKIwJjRk4q|}(aRpvS{4U-3252bb!&SfkK)(iW z?EjET3)cU!m6fY=6k~Zi=33kWFIo9oeE%=X^7gwW2|zkPo(^-63Qi%d4f!@r81NEH z3NW%lu!qESMZSIhz?2Kgd2QZMtCzcET;H6`CyZe_*Et@D{n&!a20v)*Xt^Nnh}$I^ zT4=M6XjOQv)o8k3bd&73yglc(C6FK;UbE^N_s|mjGQ_Uz=16^GDYtpZRBdzasmrn| zBB6Vu*xxH7X6WJk?!KYrP&&$jW3swJvth-Ddlt36!ww?1fUY(2W$882<0{K3yf0+Y**CN`;NAe)i+E#DkJgn#5SMo9)-9pEd>W;7#?fRTq;QeWe%Uxs z7FuWqr3(HLDZ%-AEqeb;)Eo~z!Oa;1UUUqYMGXEuVh)ak(YfnyvGA^nR89QzT%DUk ziD-i;Q70*0rEvbEFV4|kZLW!j$kBCY!~F+s9}r_hD;lx}QF)`@${XTH6nC7aFUdQV z3BUt7KJ%8Al{cB(Ka;A5)}1IV z5*VKPFQqq~jK|Ka(UXv8xsg?MROr3hB&2}|L=VR($)b%1Tw*JvzOzRe7#?l4hJ%o- zV?ii&T0e##NWt|+_nvVOXa}1+%rp+qd#Z4Yn+Sk2zODA#(pL2*XLVQ??$0aKZ#&?< z48gGFV?K-}F6+~kUgs$Sd}m>e>%F>*_*+#l` zh5SMAm0YN|R#y45R8&w$dDeI*CTWGo00JfO7TY>2C-u#l`3VTiYqk8C%n;WF$-2M1 zgWJ33+~$gD%`AKno@l6Td@=-r5_&mq^A-G#cc9na-i9jVJ2cVK)SFZ?nL#qiW^QVd zXopG)XOBWMrjnjHrVz%lLAK>w4BZd7m5Z>&TcZrC$R8fJ@3~M486AktO{V`%MOB?< zHbfc|l-78_-8V4&3|Tz{Zz09;H{Vx!t=WCqstXH4jE9s5?(Vf{Bcpn0HucT6#+?}F z29*xY;%nUu&+_jz6rzt93~)j^#_2S*@;P^$6~3NTNM_i4;JgP+-JyE}8@*cnW3~XS ztus|u+OjsQk($+>%_(Czx&Ab#)u#W(XPRS-U>8d)&nKw{>S4bD1Xrk5^n za$1PF!6K^L$nS@30qS!%kczWqmsiu;tv9it52xSG+CwI&DV#@Zl>m1u!1W-%mI=RG zwQ4x>(#bmnwOPLG)k%dh8dE#3pc9w0L_9y~4^V0)uTCJpE`)u}{hD;e437`$T9Eqtp!R-RflA{hdY45VfO zPih0DZDVWx>E$-5bfqTN7%v#!q=I+GW+=uplVBqiUFm#b1G!WKIuf43s$DJ{CgabRw!k16xy{PR zrN$_lsjZxrPu*?PlK!L7c$-8zR$64X&SLPoRxc&yFHs@>HdVmb$gY_Z3dQTM1G90t zbE~h%)ir>FLl!dNc|-f$M4P`j#$;*w;RctqGGS~blRdMGV>B?x^R;ejb-E*CScV^P zX5Fa!UO+cZJn`Og#)2>%<5yGE;)N8?@3h^t?Hu3^tZW+AMY(aUSk7G z6bw8Sbe=OY;`bEFKT%-jT-u&KE`0Jql~ceg1e?(ukj6@DlIx3|j?JAnvyY3dSq~ft z+VECMZ<0C?q>7J(@>}xv(#O2j9kOW9Vvgge@C}Eihujh(HLJy4N|KAuG%Zs(&H*q`{W_n^KcaL-^@lOLi`CkP2RqZD zt1mHATnKERu>`-);UiRuL%&uCPPw8RwRHsE$Z|(2-P9 z0zfhrJC+3YPH)G-MmeU)Eot0rJ8E4|b@mgsOAuV~0u=7J@V&+;Y1JBu?gr?f3wOxO z|1!--N|RL4si_W?$E9LZizNX$>F^l<=MC1a5^Elm`g-rZ$*os;ul>r6+}$*u!Q<1u z%b4!X-Y?&sS}%=_Dvmutv+@J=s>sTv3YKRjN-xS8Nld))T$G+ld2iDBMu!BCdt`xkpcv8G zE!Z%zH6-IhX$1jX7Fq?raH0rvjcG^1-KgjAp7`FJ=lfoD?e=i9^f`SVJroInK3BwDMQ8(#kJ_-kU%<%jjcn+dX~o5%UyvS&!Jx zX0>s_@>ysZ*n%>ZWkJ-fbU1&@X3?&8+pTD7rG!6LHinxuHN%ocgH+W-Dxl&`5L3r5HoM^NP`$ zI)Q(k7{&`^hwB(LR;i&s2z6j{+g|Xd_MVRm4>z%>0AEC|T0ws-e?h?&0QfWEHy0ke z-k0MgBe>bsvVGs01RPJEfIM6Ap2sdci%4+^G^B7~1B!hh3*xVZ?L(iv6~>oZuT0o_ zw7q@YpX~dEEM5owo6^U!kp##C*SCMPGhq5ZWZM4E3+3?tudVm63aMrqaO-G6OIrhY z%pr2hJ;ylc<*m}B-PmB7JAwM#X9HVNmzB$TGZU&3hFb)C<4b_=xZcPVAMka<9pv@yJ^ z(AF%*bYBbws?-qIk2>kMF??0&2g}OXU9VLiCQ8S;@WjH9muo%wCp=p}X1upQ+@lMC zx_cRAFu6NNPsjFMu`LZECzMz!(|m(0h_f)t|mQ=}1#cO^;EBSP41tK95l}c0{T*f?gR0 zN+jte=5x_|zn;$-b%7|)f=fbY?b9DzyDGl*jDTe2`Diy5a+-$XcU$~u^=njy@8GzG zr6}uVS?P)=hzVo%`xE!~3Hph+M;Otf^M$AE-tQ7hRDG+<;uM3SZs5%_+J+crMDfa- z!yok01`i>yG0d5>9My=2^g`wlmm4E;7>OYKAZ1n6DsKrBzRt|E`F%P^* zmZKNs_>>XEMnCu1I+`Iccxf%3TxswQtXT@hS#xUa*XtrYW!R2J;3tC2@%8r9WKGxD z)a4((K|VFmsx11V`hinfO)-x-{iV|l;9cNJrfKl*zU|9V9{;sr`}Tlm$6sQC*$aNb zCj4=19FfW`H8lDiZ@>j}-}?v}fLcaJZD&Dcw=ojKt-~Z~1Q)`gu}O33OMH=YNoG_$ z!R|3bE_wG-ca)*l{gS)U8;W9xgui&Yjcy^)B4m^e&gG&K3BcsE>Beb2ce}QS{}mP^ zuHZ)gh!2@IaU*ClLaIKZOmP)ZOW(LVULeD_SjQC$(^=y3>a8slx-K%g6h2V5+6(*K z?6pCA`US9OUa^t_dEKEOEFGEppCD3*R_C*0p;p z3FGMQVu4I%C~;Vc*^?YVy>BX#*{&(Jd0-5J7sYmkap z^**DW+Z;1+J^P)Eiv`hYo)=KYkU{eE2Gk$@Toa*L8<&u0Mvi2)|L&FUy2IYMF-lP3 zn!v3HNs|!E%;2@u} z3Cj+}4=`Y3P8kEYAF_|yKI|7qB_rV2D>Y-17>zA;@r32UJ*bs5L0!cnaGNcGqg$KE zA0iwhH!r7bQiKK3CpTl$b)pP}CGvC^9ab3X8jxoj^E;2+n``wtoLmvVD4gqMvvi0o z_UitIzd$Qfwhb1hkIQK@`{|Put!wD<0@j@g-Y{om^~1}&h;Tn*%szgu48#FLxQ^hF zE;ExVyUgYEj`So^p0hZ0{X2wV5!I>^IH2df+nUi70${(D&i5Sbpf>=#^r!4VtrySX zGk~(P>j!>X`9YE1kdLa&!Kzc(iJ(qLZ}0kR=4Ej7J}r=`E?m>pSVWjB0!)H3@0e8cIL7|*jFNKeeih)% zc;sRsWVTKwO7NVd3mG)uKvO}3QX!ZY$irSTYPzHAk1SN zSm%P`w7M2$Tgbxn4>BsJ5!{j%+8wsT-N#_BB*qzd(VD`4QSkN zE=GUj{@#qh1O-#S?P6xJEa@?(Yz(7*`*p(3{WJ_~IJqub=8}=aDr0UlIlVdQN;W*y zoTd5WTy=Z<$%qKSXNY&1AC80}&JxjMItr)w#WbjlQ?F4nnf52)UP%d_otEA>;Vi8K z5$X?gZ28L?zw~UG+>9AX%Esm;-)a*x9iis?Q<`VZSFK*$N+cF$N^W7Pjjry7R3QmC z$gG{J;|xqznS7ctTQ~-pFtJTDn3_6;pSdhgtnj>AWPfHVziI5O-BLXe1$ zZ6D`+((+?x1vE_2rmSKk5um&q@*v*VqSWGDh3`iZwwJI6^ysq?`uNY)8u{| zm<}uCJN#dFHCcBckLpH?%t9}t1OEzs7bH~SZ&X|Z655-K&8JghW3qHB*|@8<97>gN zBkWh4uqG(-K@~|#-NMLnXC@Ju>(%y|HF0IHA3cH+tbalVec*_ zc8HC0tv&2UOkQ~YBo6x23?-!loDM#yc0W4g(0VGxg2MJZiq4Z+UUkU$Padqu0(sj= zN~US)jN0nEP3yQ43p341c)&+_yh-o%2ZA&F6TqsA+04s;JRy3nBD4wa8D;UK9R;uG z(rpt{=0+nOXn~B^lPCy=z#E(&EXntoAfaZy86)!0D)8v+$MzlMnpAi5XGtog zQPkxfjb1}_;m4h?wI>yZ4P#=-(!BA?LmR|#+hyB4?HbILkw>i(oMh8}} zj1HSsMt?3*qhCbS!4t|1<^S~p;NKP@B4*rsGkRtu5Do)J=iEp?3ki==ZOEe`Z96a&pu}M6jMDM%nj|4y0ve{&dv>!{XuN#u^{9zx5l*H-9H06xIBr zNw%zBw!d>ZlfUt8cW9f!DmB5Ntg73;e{@4LvzT_hq5paPuQxq&;2T8FzcGj0M7|zXf2aN93^!fl+^ehM z8{W?U483nNn4_WuCQ=7Cga`GXI(%R<^tZxCVB8U4; zDMP6_Z3PQLAZI9%hP6RENI#`Y5t^uSFPJl>=KBn)nsYO>uB;)MfK$qQ9tlW+_C8fS zG^AAWSg2;ZNiMD5R!aH&n{n-{Nr}V>4Lo;MZY~{}Qg=F4+R5aOUVRL7{|(Ej0{}?m zpRgvg`{*eOyg!+NdvpUG1BCu#n=rADM<-=wHzq0H&l1U0gA3HU!`QxD%`40!f_5c z(_epIB&pnDshQf9s`;0GapeO5iV|1IZzh$uKmGzcBs>VA%ICVqbaKV$?QiTY=~TDU zzv8%qi)oGwMH3@f3Tb$ZzfQ8zDlsD!;zl^+9s1Kd4bw%#jeWPf`aZvPKtw!4P*EN& z)AJU~i4x$Q(%A0g-60%3jpU!8he(PnskPGvJAe1T(<@p0{8%zUED5kyEOWLNzTs+2 z)bx(HQ&gFN4Bu|hSuNvst6y~AzA{(#r{WSkbx%UMkV0l_oe@cQ1_U+6O+rHX^D$C` zGSt)ybcSGdn*uW)#Pa$;n57d~p`%okr0hr3FZ&Oe5xMz1-Fz0NY*GdPK`MY+$ipb# zF!kk^cL%CX1U#|D90pI~%TQ7qm&ST3c#;X~Gg9MopCUCVZv-!Q>)c-fPo~6s(8SUQhL-`9Fo(Aj<%;Veg~=gSfYhin4v%zK8CTZV(A+P`YbSk(QPm z8iwvhkY)fSq(hMIl12~)0qJf;y1U^$;ky3M{oZTc@4eRZ>GjjO2AnmVa~ym8wrxMo z>pz3L#+BWpn$|c`dB+PbQDDXAxmLYqWqKARE<8X1TWU2CK39zNc{-2l!vj$3|3TCd z$C30}%6+5rT<=SnPBp7+IPLf#cQTSB2vF|;z0_TOy{RUe?`8MsSlsb9G68GS+22Zl zsn_>Qg=3ys@o|q85`I6Eq%YU3IC2=S7NH>7kGI`@DDStNoP4Q?kPnO$^;8$93!M`u zUz@WdJkXj+<*WB4Ns~k8z86eJk#F^)1D)a{gg=F3!%kX4jrf01fkd%JHRIuX@$q`# zWL(zXf8kH1U${G)s7-`syuS^BKu*>~tli(1=iN4=hQUWXRq51II1dWT-)Zo#B)LDY zls^E9YDcL-Q^Bcm=i3SCMpx30>3y|8?H72&m%}@vt3mi$R-tG3<8;O|)dnnoGf5Fy zZ(hkK;%srx^+&A`LmZm%W+F|a-B=?6!Bi;KfX0L%38-3QL*35`>lsJPPfD`wk<6Rd z#!EX}hTQh8T!z2Yd=5Lwv*eT=6JYJzVO42ln)$3PfSL$ShJ4E&51Tm6L49`hC4T%< z4pmkQi;e{w?cix`<;w`%?WZ)(oFu<_(~00}Pg)WuR+!>UAs^1NHF;6%V)ZB9yrxz| z*r14h_6N#E`RAKyIqV~O%*U=o0ai2N0v5xFv!rtBq^l|u-Q980UmmWcze`UmF?K7G z>U=RvPM5jf87BKxBv4Ng&pjHO8dx$IsaC1M9d4m$3Wm!Eu=sS_j_RM$`w6Ws&R9SL z**y~ApPf38+69=Q8tS!40CDT@z|ZQeltY<4;5>~?7;6K8M`DDF<=N7i{aFvd_`8j0 zZnxUc_TMvm6aKgU{{8=O8o>W_Lcrr|4++W;3i%v4jw;`FQ|}6Vmv%w_-910ITSB!l zjBEMYWwtt^DF?+$nD5O7;Avr2(jzHNbo(nz)wUi`#fcXIs+m^3(0~RcVAljjt$A~tL)5t8>47v z)jPX^v4=j+Y~d;^+u?61$OzS87Zg2IZuC=0Oa= z!3<7G)!JPICU~QcNPMLs;OZpV8ejjgvZ_$8Y9tY%wXbbmWj)@mM!bpcJw1ot%wp z*o{SCf?ZtOwzf)3AQ)v+0CU$V)GjFixVL#QVxp?)V2Vb)>Eq@Z)hJMvZGv1|Dr$Up zCGF&7m<^5e(P=W+p{(Z9z{xW9Nf-zOU=bo+{x z*2DL$nf<+L%!C2{2NQADa>3Ia!QCv#Gf8JH(?Z7blJcZsAMYrALJt%q>y!p=*pf>d zq+_Ze`NcZL)!Ql!4j5r$>0$Lpb?^GvfQL%U(FRA35;$@XH9e|{B% zYNHz&IvMJ}d7Jjgw3tH&;C)DV= zJ9@VNJe@|6t1_ec7D@A7!a~CBpY=le)ukz^F_u-Iu%(NLCYR+iQE5cbE2m&p1h+4B+2l|Z z7+N%47CtcNMSu26)E$z)Bn;N!w5PZQhVT;!*I&=74cVXyrI6RYaLCeAdUDD(nkufV zd2+@YO_C^!w(9n6eH9(TS+%3n0GT~i_@;ju=DyUff3lP)w3P=L2+Gr|IJwYP8B$!@ zs9F@?c1CTTKKSS4s}hpb zdoQ0vC!)4@S`G!Iw;jrT#8JZ?g6;IJTIRHB`7x!7bXnF`m<5_jxZS@Ceuz1ulm~!{ zP|cg7FDq4A+5Vaaeal2A` zH&&gcq&E%GJBzevD1bxY+DwpV--g9m!o~0IchXy6#r>bVGqtV^Kbm1!F`{c)ewI>7 z(|rb`##Zgi<_a{5CFJ}uP4|?UkPzGHjY-@NZd2fJS+MDEXob}At+Dr7)F3=NWbC+K+p4!cvu)|q)99hNzMKneONwuOUaP15{ zN2SmYEugw`Y>V`!lWxWzLSn|u5pRpAYfeA`FTH8;U4E?B{P`~aQP-~<8PnQ3(KnSv z_f#jdNN(29YTa1Jck#R2ghRkp214Wv{uhpb5mPbR?Q9KKu3rtWc(_6?=G;}#Tp8@! z=NUg(vg4IPplk=_w@jAe9KXLj$AY|UP^3LHT6$(0g9vQj9edM* z9RIis!n~e4T+=9oXA24mfoB4p#_IG1d^EofxzmR2kY5=SNkZrJU4g${fJX!A1d`79 zp3*_$R7Rd!U86YT%TLES+};y%l0vbHsAVi4yWsMgW367^byl~W{c=JS!Lg9`!+_yc z;-rf-Dne&hG@hf*8NIfk8R+?~Du3;kM7niOd1Vab=kZ4V&8riN8y;YY&qwbG6&^D( zGg2T&j3p)QQ^Et{wj_Pb9k+(P%OM^kG*FiD%09w;FeN!RwvN?i_tXrQc1ODsO(3Ox zHp7oY^K?bqkMG&^SP=c&x+kJdL-hEAJ#0+MDDb-xDBBLhv@?yDG0DKl0vU#OtS&}9 zxWDceN*F-CnCJ))G|AB{V|v&9El;_R#?v-a^2Jp)(~EASBi$+A5F%Bjw6Tc6I&KYA zzszZtC`8DIIP`yhyFs7?wa?XcYtLRxrGnm)#u-b}7<5EyCG2@Gw{w@^#Y8p`JGE5V z7V6UqPk7T-V5WYxb!YR}o;+^A=Yp6w!~wS~36|U-hn;`+BK~;1JI6RPj}lVcM=Oh0 z`$F$Ken?^{iFa}+cGj94gypZkEi#_;R;Puqgs5n6BlD$@(Xf7MYGw z?6WV^zY{V4XHfD|@QNbm8fm7ONaEtXZw%cvMgPBg(9!EJ|DON!m$~y{T>@_tE7Jb| zb=5?HlpHgYBkH1U6g zT-L9QyB62j$YiM6GgAw%@?d4GOYSJ4@0hpH>!&0ycMHLTEM8BCTl_eDGv8Y!NBaaX zk$S0ykUI@1-<3p*s}cz7?m2gfh1Dh-xiCcgzz#D~WVcbS^YUn_z7;ft(<-IvR{MKj zqE-6JcQv>5H%2XEk{zV?&|UyF;*tLFB!1CHNL5G~v!FRv$pk$WlEVra6CDyKbFe40 z_~36?(ALw1q{7u@jN|q+BZgJt-cI9av4$a7f-w%js z9U-%S$w&OaP5D>{1{p{1sYt~Cv~XUNfb1NViU?%zsL8mDA>IdkXLg!qF@%F$jT@4t zh>kXR8)AQIciJG-aV4%G<{jQZ!G))X?B8iB7MprPcxSSaDDCK91VeJ$F`e|F&RCvb z4?d_Y*0~^p#P}=a;#TnxoLTx7KN-$=Bd%t3M4uOc_ZhpoV}6(l(Vu@L2T=cI_ZMg4 zPzYi$mmtfF4Ipeg8KAu9Uf2F+@m`;)q}-V8ZXCOywJ!T2y<}VM9YVU0;ZreYkHLty zwZ`rEBFNJs3ond#n&^+3vJ@0T8alwmgB)@MCrU(?-<6z{D%0F^rdbJX83fJb0?Lim zcbxK-$MJez@)#yE_u4kK@5TR_ql^_+=W=7ty+sTXR`5o$(F2@x7pTnbJ5p!sxgR$Xi6h0qUB6KYo5Of}nck6(b1aiHTT6)5uC* zdap55xd0Da5z65Wvq3%r!esi^7Z!>{yC^}Xv{8y+$j%Rjtx6jH`G%Cc%lbkYf$`nBP<**&z3AlS}F;i?F#aIC>5 z<1eb3t&RT3XtV>8?Cf5Ii0QQxqek_}y)UEP+(ZoS5+?EG$fEd&4GmxADBR}h=a_qC zUT&r?9$!;I@X|6R;*eN?X{`vsn95Y5SGJ|0Xg7*6Q2{i>^D!XyjaFT-P?E2Z?Gly| zGxiS1QX_C%*oKnU`$eDyMvt*hN3?4&3_%3+Mua(o(f99Bxe^9F?cYq%!DE|`oR3ub z?>UnTw(RjmZ>q?i?4KWA$tL$~6u^RRMZA|^xB-r_(*k1Gi+=(D@3Ed)+&!W+TFBdR zX>*%;>?#cUHf-~Mk1)M_mh{K;jtmeC{`a``Uq5}wyTl^o6kT9OhTwq%SWLEa!vbFf z#{!nw-#y?^5IV--W9A)$FCG<~8|1=W-NF*qgNyhLzpwMz{6)OqKRqnTC}mx|Xda4e zb(fG9{7r2n(UG)4)xqO;Kd(ssAm9jmo0H;!`Lg43Wj3++#hV|P+7&CRe0tdQhKodu zheo&k^OzE|2Gtp@-FIBRhV>1%a{HETNHT#3_Jdrn0@;9l2 zBB&2BM(Y5EjmcC`gpt#Hx zscv7O1zVs7;{GL9t?yexIw3CM&03sF(1<_3xY<$x7|Wt zzxI9cAMex>y|j#mA`WhyG||h?H0XTuED^g?(w^xr?$t9GIUDY<@NS$$Qjd`t#Wg7O zPR}cY8Z9$Yx}YshQKx3#)k0T1%pCNtmA%uhr`LW~F9|A@0&>l4CIgFIMhna^p>B6D zd&Zv9ncu}o2$#JxfY4yF;ghlFL8H$7+WFhd7WGRzox0_w^vm(F{XGHAOPrf^|NDK8 zF5tVracf>v#>2bp>{P$=s+>~4JJC%n?`sto`x`T8?|FCi?4HX^yhXFhtfl_u@{q^h zuW#0DG2>WXhtA*IuVmK4XJ9enSUF*?S<9j%dNMz!G;uE>0Qk-9iRIJh{vKWlPJM1z zzBHMOGrP4jetnsl8OQao=E;2N%(4ue>3K*(YaTSk)%(i*#HQB<2B|h&J)F$`aGF}^8gPqw;MaI9^`Iz=6GTiY=Th-UudD^pIpRxMp zO;oe1N9&KD>*mkMi-_~TnZ?D+QwkEFtTC&OVStQoEN-g{k?bCNv8)@fTGW=b-V+Jq zUdZ-w$~fn4YsIWKZ(Qq+pM&q;+!yRPE3SWwn$WJr);cMNCe``*db?wf91IUSKUXpb zKUArFOm&V?f*B0FcG_4eX>pwEELwerttd<00?sQr2xoDUNf2 zSYnikELSajF>6Kfa8eU=>Z7H(pa|2lADkP1Hj}_Ec|X3i@$^BI1A2xpMXQ%py(CWw zUBQk$z}+0@F-j1s4I->MFSBEb9@XU?s!M`pFGDMdVr7JX48^7Z$t0=-p^Ucxu}K{o zn#YpJ^Ond`Ow6^PM5grxH$RZ{tk6`a>AQqHOhPoUIw8^o39kGOR#p2uQ z8Uxu_&a$&5)@>B=@4u|2X*wYYb+6ux2}Ah5IV*&;hLAaZj;Pbuy^Dq|#tSDpEABWH zt@ZdCWdTKxKME5nB!%;e$Qpk<#{O%TV2SkXMVHt9Md+klN-;{+*H9MddpdhC{M~rP z;mVuL+eWrr0^|?^L|07T98f64RaFs&Cb`M}EtzE~(Qbaw31{nfFp#HIC%eA?axFo@ z_mro4NA5APy?L&^9q_K60MVuU+t#F_SNc}g3!y(ldf;405o#DkpH7Zs*GUirVh8zI ziSr$|gI*7Iq4jwvoSSRwdmsJ03PnCKUF~i{7R|y8=|c6WycdJL8nhi+%JrB94`)Mv z=Uta2W?;ZVv(M1F!I{$I{0D5ayOk5nDs=WLX2VG0BdMw1&0z1PGKMNhdgBjiiIehzv((I}ZF?=$%ZvpzYEugV_l=kro}HqlC(sh4y#E5P~1k z>zzPn(eL#JT5)*3;kLd+F_jMVr2>h|RV@{CQR(azE(G>wd5tX`J6};cD=5vtoYO&G zN?Ex%1?5ts@37B70YYflv{?QU?0!&)F~%!bGunE)XD`w~S`1{{#+Ox=#?6$lU9$mgJgZhMCCh@*iOw$h5mxUe0ww9@C9V?69rr6kI{w$ zUl~#7a;F6+&JZ3Y-?0@tA|8jK$qEE|CKfZglMU8>e8L;g0x2tV2cqq`-^?IoMQ+j)K z8eWTmr{sqHihnj_i9ZQrnM`74pEh@Hdc<+Bpl=tVzBjfJygPVKcUaQ&i{?Z5IUq<% zzll)PFvZ{KQ0S-iI6t9165ltJbCRvoHnv^-DuLtdz0J1q)^^2ko8Z?WXgqoq%sXpX zg!vbi%sTgditZPy#G>we&?#@1-?jGu??dtOm-4d*2~~NI0Xa!;ut_o>FE$c5*%gyo z8^+M5OYMlx3Sln1!kngsIG;7bq|__gLIRi zJ*{sVP&^R_S+_~2+YoM>puw>AJ)-u#Q`MQD&cbKqJM%Q3HASL%6O(GHoPS4ITXov3 z>;$Lt=SX)ciEw~VYDCK^zTSDfG)>Akz*RB#g15SQ18tIHS|E?jm9&hddbw_3qiwd$ zsD0Fok(Q4{Fht0qI&=-1WL`dz$>H+8Wfqr#^b#cf1rvtrR#PJDIs%ONGTX9iV&utS#{V zX8*n=j|}+k7o+Oe;Wx{NLjHZnqW-?Uv>67+H@iaq>@mbQK`Q<2(>t_VH0HkaxBJv@47X{@OiGHAE`TEy0s2km`t(PlmRGHDfjuXf{k*{<=XvSyVO zk~Euu_a0TB-y3zlbL$kWhcdwr4lhd=2flQ@xi!c<3RP1Y->cZEi*CI22mW_nfBn8L z%J2Vp0oLU=%Uk#<{WMSWpxgE9`8SuPiQ_d|>gJ5wMf+`Q%6ZDoV(T#p{$qFgGqyfa zZ>;r0*WY%!dz;PhHx?SUI9hFKZ;#ZS*WTeyd)wNEkdI`aHl$2;9U^27G_8iL85hH9 zb~##a2{^lcJ+$~e0v69BI9i!8UxGXya_&r=N+w6Z4mBu?7=Bu)>)S0`IG~kG4^)U^ z0=!U+fz2n!Tbrffm%Lq`&%ABzPJ~=A*fk68*i$aS9@3mGPvFX0pt;85A(8rWu>W!b3SNpm-NS`g#e}3o; zqx&0$LcIi^VlWuBe)t4N|IEN^hI$*~2<|fv5K7|Tt{u%O&)*q&(>t86!qt-qS^w%n zQfQvXNMUUvw9kpQagi((8h-^V@$fPtL;cAqd3FcG#_Fd~@c-mI^T}!;=@k}p%i8r2 zrVfxoFUbj6dJYzbDkQ+Zi_|*`HUsSR5qt`Sa@$i&LAP75J`~-v)~Q8$@0e)Cra?3F z_d7}nu%KoOxoScgq8{mn@5(3?PDQ5G{Li9SlXAhQ9b~>o#pfP z=@UGz3IaHfiGR@9>Kphw9DEH`oiG-bM1!w+1ls2 z!^}{EWg0is3#8tmgcv_NFPg|_t%>I91JLU2)mGj5m9FG`3tcd_OQPNT$;A}lcFuJd z;tssI4pj>FR9!568ef*~QgRM}SXj?dZ2QmmVoQu_+yZ8?6fLGsue&)`L`|ywMEE+r zaLFCtx_yAu71+JZO?mCRmm}hK!yZMKr<7%>@ZC{NNzWM(1&xZbcUzrUYBv}CD`@Ma zxSnT!wrsTt;%haK9C=gZ=jyWYu-vSl?4wky{4qa!(=MW#MJ&*Iv`AtO&u_vW=+sO{ zhId-!p8Z?GP+n1-{Q;?(f8`Clb?{4OcyR&=z6XW9a1{gRi|Xhcn81=Da^N^jTb0Z zAo7y=mjj*rl-BvCuLgN2abfZoAA&}DYRaMPxH%MyZ+E!vK((8+;9%(@SZ(P${)A~$ zY8&ssAj=Xn{(1*vt(CuQ;;mN#E@HE;zV*{dKZKm44M)pcarGY-&({f}sqle08mI}5 z-r?-_fQUHM6C-P|;#DNyjLfl$p-e$j4lMHRZ3FqP|B>imIdNmnqfU2p9oJrs%uBE+ zv~+>}h{AA^PxsLle@eH~0=;ePqcd7S3U#vS=-0tW7nffo#b!37<^I}^t7j4GfjvFs zNuN&&j=YoqGCe0Wvj3Z_OBo=W%jkUoqQySO|^g0=o6w3_!*?J`%G&i!K0!GO1Ld4e8?_npkt7TLmfE(yueMj z#7*%fnGd0~pYnHO9H0$@1`~`#$9$hz7Y<%wJ6ItT4j6L8H$kBTt?~SUHZ`^`Fc^@Y zmN0zcbExrQ@r(NYWV5{o`HwaH3vz~Qdq+&=Bt4StWM@B()(b&N0OtV5kN(u7U9Xwb z;0|7~UxNFu>_r5}N}xO@So_X7Y15oI4RHpsUAhR{YU*4;W>CdXA4`ia)@vw0m^|Pj zyzJaIvdzDQx~eo9)WMm?f!O<`WA7uLhGnn}U8T2cn&Ow12m_zn;2(+OH--+uZ>IGc zVe5ZOVrgGYjoEg9cmqAs0z@o@33plcI43QV5oGkZsSeA;H3(#Xqfn>w{vtqQ`2v#k z;!OP3%pkH1oX+t_Fa(Db7r;Q$elq`XAf7dABtxU15g#!c|u{eEdh+!J4IJ|-{Vx{kpNl+t;SAtSmAI1N%PS~>B}sT z37cb)c5vf2a2m~`7o9!vNR(tUu??*{0ID&pe;KlZ_xHzR0P&CNA8M@;f`|14xUxYH zOX2_i>XH(jnk+GNSd6H6o+jE0-qRK~ba{D;o6cp&b!g=4v7UjPvAPs9v(N0Z*G9Q9 zXt_dquqy7ZSL_fa(GPFMec67gedjtO_5P2}k;k7OPE>*+!?>8A z)y}Ux)bWy+m6vq*KaApbR2cDzi@-ECDTKi*)ni)bKd!HYl%6*YhgP=lXp6sQxgOtf zceKr-)wtgQ<)>TrNOV>Un^B%dD@eULE)1cn$+&48?7Ra+pC)xslfb};vS_|djGh1N z$}%J5iniG6tG@O8voXJ!vu*G#_&&XW*U3zIdL7}G;-DAWe_sStv5o;2K352w|i3iTaRoH;BdI6IFCNDG>T zsvGsS=}EcIga7C_P~{&D-?=MmwO#*n*ItC92@ncE6=~P<$C@UNlPGz#f)|MVg$iiFM60M8sBX-6xSz@>{^?S@&L_w8}gN7x!ZAZ zT}j0B_}gyiRdIbcq%_n)w$y*qIbT1-)5`mPWqP%@oNW=4USFy1g}e#{`L^$HUGX0W zSwjiKLZ3ILTpSX7S~!d743Z@XgI&hUT6G3gbA5flIw0~kYE6LOqTqIv!fzeo&o*Ed zU$k!|gb z79OFVKN58FY3nC?JnkgrHSUA?jsO~^vPBGT_d#Kd#%Gc@jfht@>-~wFfASvLJ8uCf5HUnl=bERa2x{ut zgMYuVE>-SZ$8j}R+fjNo__~cYNjt)1dJs7R6|~9_8N9ONF(gt=b@`-*H6y6TbA z8oLz+UMY)&b+oz-Ri=t}K8^m16NA_PdjyA#>nEQ;Fq8cbI0jILHIgxih>o{AJhrM) zMp$H>`m;*bBv;p&!0_Cf!CLW{D_L)YZJWTEUWKqfOinqL8kdo+j)7*=Jwxt;@;+x+ zkMw0R;ULc|%ATxiWsgf+kM%_Z{}M^yVj*@KVcKXQCLpg$pCVmKKh=!Hmgkag{2~maI_`QOEdOzp=%yXmoymmCESS{sk77_WHTFmlw z8FJO;QzYSvEW^wq-X{HC)~XFLf3lT#i$)1`w0ri&ss&Omx2TYsUpZZWqrTZpNa-!> znKz|#vpSV#2U!}J*CcIZD`#7$vNp}$`v$>kK~ML?f>@C>HbW9fbKE)!tzAQzM&!Tq zW_01SV-fYc5IXa9DiByKzGNc37F{Du_oN0#N1aLHm2Dz`#&PyUP}^|9t=@KL(_H^7 zNv$Gz_)*-E+HCtGux+tRi)}fn8=CiO`*EpB*uDUSCRdJo{}1;&dBaZ4o8i+OP}U$3 zm0LlTE>IG(`ueckk(gKZ=k`Cj-dxRepRjoWl`P5Lwwa2QNeCxQCPVjA>>u~KEfvxt z$ZgLZ;=!Rq^7F-vpVoJ;nB=ZU)JYz0J`qLGLX=X?$559usnZe0x0fHHg;&e zimK+%DOaZA4b2cKZJfRDvLJP@&?YRAhDP4tIcm2XYzN&!V*)WYF()U+LL3^``-%Ar z#YDkq^>u|!yBC%8Ntg)jvQoNN*@kyn-@j(|ux3(Fp*iF3;A+P!b4~D*05p(;kXMCI zE48SUAn6Lkure(up_hwZRoJYPf+SV+N`jW^vt}sgdBZwkbV{^11p&9iwwjG#ZYZ#t zIVLQ(ZP06XzQ+7056a%p$nZmIJ^py}dEL{mbjbg9@P1k1?sjqS8#2%mx1|jQ68!e> zO?iF9hQ6$AQF4|}`H_oozx~JAx5cN=GCn44-hHbwlm^ll!nJ|#y$pa{o)WhC4fwaa zcLSoz{r0g5V6~5>WdyXE9VLbDJVCZculqUb+H^w^q~QV7mQxqrsM9PTw)GpjR|Jxe z-Os51o7VE5rxN|eeJF_@YR~`WYJ}mil@o%caz1#+7=Cw zbGsmXC+dfUFYQMtEofNbyt+T@_F+Zpqe!C&M4dXnvT&%p28;f${69N0*_yP*ORHt5 za>;Y`P}t`EzN96f9}uCgZ`nC0CPyEcdDW_xwTPGjB&06fekaF+)3s=pStKCe~%-jodMf+}*=>V5)z9Q~`pD ziDbR`J*5+Pm-YJB4nKWc*bVC4aohcQqRGRD)_dRx`8Rxn$CLS?H_MwEG`@cQw3&-X z50t_O5Dki|@H|y>Rqp{s!G^|bfHukgGDEeYP(1g_e<9--e&jKJPOmNiovv_% zV1rpF*7fRa&a;Q711pPXeY|#0fE!Et9|YjebZA8WV2g2owr}fM7a`o72-gBULy^rVv(Z z>yTslF@+h~EpC_?P;|YELxi*(1(_tt==J-v@ajCXxstAsK&y_vKqnMBsaJ1{u~CgO zG+aHuFhmwjC@gos3(DVVnKXE9bggp3;TP0$j(%xl{D8g}6Ok9NjNm+frr_TwMFf%` znrx0iK^mobM8FW^$bvqWuM$*X&`khFAA9ZsTH^;(%?51K0k78L+z5iH00~!Yf_5&+ zE5}m1(d?GY(Y>z-pem?Kq;u~c{gyyR9pNDySu zL!3P6(#NgSs&aw0?{0w6FAM)E{3Bt{du_`iJG*j#jmnu?I3K1ApD|dX3z=X{ooWow zFMDxDe4$reX{WtZq5UH`ytJoi$H^aB9o{fw@O55mG~^HExYysi837+A<$A>D?|FvILOY4vN_iP;Z$FTgcLI3Zrd@LyT zz4^;pvekPq)4RP>{SnUXBo2*E7tZym+Dx+uSetwc239LCFrN%w@rb~t zHw|+-SRGUkEr-`!trfkDz=Un0`U7$saQRDrM=EmBY zIOLNDiNQB-Tg8UHRd^G5N9BO_?&OgFloHg}Pk4=_@)ARg;?zzaeihV>NsYBW4tH0( z1)ewwP}$0RnQ!Ki%F#j34t?6^JCR#Odr%+TFR}Z-y+cl{vyn40O;+$wg6PvItLMTk zPW$+(|H6>ucN{Qn$-vCcW9(X{U|{HJB>_%J-fj(ljimIlL|(sqg3*Ot5T;QBpye$; z9fOfy5eYhQe5K?<=!RvBDGs3!R7i1K=&{_l`V7%&t&`e_l5j1kE>a^cXWtHPdFzyL zySF*EQNBu#K^-=a5vbo|B}!fZ9}b+fZ8{1X@#FuX-jHhE2}pbl)eQ#En^JH0wniy3 zN0jubO~v{g|9;n|`DEH|Sj5x|`5omHXU3VSa&iK4ph?n^m?qmc9NpvU@oGF-S3I`w zQ;78-*;xW4Ik=ODQr%6Hki3_(TbAF~#TI5tF+&Pk!v|egQGx^BdtB6LCZe@&CWJmk1KM)T{g zEBFfE{-)%`qNa(s(-H=}f2X@s>${hgWI>ZRo7q$`x|!DOtoo=f6cyea0`@VGKDXb8 zv_ttibr+&LFCN|ydheFpD$X$vMArO3p2Ri(qVC3RE*ZbW6WtzfFIH2MGrOt$V);ch zJ?TiV&Rd(y=~?GHL2iF9UbYneQeS%?CH~p+zVlqznEiC~blbprcitiO*=WbTA%KIe z_xNwmXPRvX>hGvn;U|?ZV6{YW=TH%50I_cNyJBv&EiFofb>n%icvH3<6Y2&`=ye zK!Zk#yg1VN*v-8P?M}&uc=SNiO|a>wazrFC!+KU_fEP2XBxjJMRy?0tHt#yjm-VHs zrW(L1=;d+&s%tDlDdk0DxLpFJE8b=)>P#yZq#~q?isdvP3U%qAsQY8+%c@HDt!m!- zD>3ud+w7_ISeV<wlM%@J1VQZjI;jHv_b`I0jWa-xr z`8Ah$gfTWv&X{sh@xYvfOxL&Lx~+9O#Lo3;&d`?7^}L(nno-%|qQR?o(CeIq(_?qj zE<(ml0jWujJ={mIrQk8B#9(0>V0F&fEBwtmpa8R9S~f6Zb4YkN91*&yDdkILZ@dLC zS(nj9_@mI-*jeeEt)^#Ah7#1Z6}ewAK#0OChyr>hNCPrcLxs@5rgP9Oiz!qbBy|{t zXdGBihxreR{rr8XOT{&^p*J&b*L>p7I?`mssFvko0~f-S{xu$P-ry@!eA7L15Pg;T zx|y_{({74CspB`^ML!BtL`WXxB>!{@?U3=?T5=MrU{aPZn@nrgAxYbgXL!R$)qlfe zEHJkKUOSdXPoD-PtywvL);Vj#f1E{j+XGucE2BrD%47QuMLBa`1E;CmgMBeWXU^m& zO^&+?64wHt2O;e*<>>o;tIn>8cpK)XZSK=kn!7(LW>S4ou??<)yw#Q$DyWl=UlU#z zO-iT4j#I(`XQ-8b^qK7IVkbYZ=V82+Gh=37167bg4i3d7baSl(S2Nvz=!&p?m?A(r zhB8K>LA=|@O~Mm^%+%vH|CXaFm8tG&@h-nZHLqUoF5gTGCzPHyaIbM}mZwseszN4t zlXj@EQfWLSHt^gwu%>~8T<(6HmvZl^x*6B$^Q~6eEw^>+25{4KI;HP78FgA;sLbJP zt6)i|d@O{(RDA=~FNB|q+2}Zzr7s@dN}|%2Pi%);yFIf;!np&MU{+CUs?rxC?r+d7 z9d7Mv9lx@4Y|rt9UsN6rPgYPaV%674gd|>#r-`udEGTYnG&d(?WNvHEV&3e{+(lpz zVT=8~7QXv+EZU~I(RR0fe?WVGXYc+l2uQJ)6n>ktY^}ufRGp!J7SExif4P8Un65Rs z7;y6WGGadxfV2OQ+UJ(7svY3QO$%y_OQj7Pgek-OyPYThRbl@hTjuA-dI%^od#E3a z-~Z`qG2J@9;VS(n->IGVYEzkv#ZLO5+4SIzbel)2+`iao{pS6lyMjM`INJ7vJ1a9y z$>2#G{t?IJWVvR*!y98fIIbjMkvQ4_7(}tJdf;mhIXFyYKQ@{jFMN7Bn_K8lR%6(C zrpK}^8U6f4n7xnI9PKryt#9=0ofexE`lbG(QrpUbAxi6@r{@LSFDxnp>1P=+E-QG* z)xe@{ng9MQn88gD#VszuuGPL_ARrWm0esU$mOI&H^ z!PZVhsT85N+#PT)nJLEQ<2~hF0a7cKppu01!W?~dKMZ(-L1$r+ZocdBfjQ=k@gAV$ z=;&5*IeL$tZ`m}HzOSwf0%}QwN0gYZdad_XK*@xMa)4Wzh|XqL!PaEkJ`3>rUh^%a zKP9Arhe7Hqmpd^EO&DO5v%K3jJM)Y+(J>w(l#_g*HOHu1KRo}h#+%(?kxc=koSmXD zf@{iLKY|U?a-7$auq>@Kqb1pEUVKT1)qwfB46?ID);u!YuORr1Y6!zCwTT z#_&&{-oL9BK-(-yDt02$`{e!iusN;79POVkU+Mvk!BTN+hY&zPR zMH-8}eA|Hi-OFyRYx}MLg;N0UXf{B4?o=jbegafG8e5qD?|#rfEXkz=#i%|}HQ3=N zLSzDlZ=IyI-h~HM0pJ0NwzUsqQQ>J3YUKZFx< zBHiQOJ=YW$2pGVVq&6u4Gj(v_5ql!%pVIJiY!%LuBkp?6r+~+3l2>slq_zi$ zBOg_33au!{E+q@65zDxZWI6u?9`i!jtH-MJC@-#gJ_1`Dp|b+Pa_A*-&{KpBb;*}5 zojLhr56+JxcwRX3#` z8U`KG2D)=u6H_qJe~b(xPhD&!e_~gO#7}SMQNHM53Z6s$Z$gYe_UlJ-{=e+q|7kz} z|Nq)z@=%~L*{MXI%!8FxhXgpiooB@isCiwBv+xKzthVgQxUtce({-D4@_S*6+3Cvo z!rW4y{WXO692qwd$Z&6HRn33WA6dd$DR0Fr;+E6_T4cl8agv_ z7NlhnQhNX0$F~K3$A*k!VnPXQL{bGPk^~HxLiu7i(=E@rMw{)s+~!h!1UI%Luy1oC zYE4-jT#yi4zXPTEXOv%yTRWFG_=-H{GA?Pu*{NIt(+?%+vJ^V|yvB(hn)}+0h?)W- zG{SOVkq6TPJ3t?QC;-8ZUC*pJ^%U#JgUf-6ECh&0cKtJaFXp>Gz630fxM@`_MTR7z zgM}^|XB;lbZuua$=}81?yq&1-_(07VPDnc|KkP7utyQW5y3H~m4R<; zFmHS1EtE3z=B1IEQVWGoRtkX96t2e*JQisb8)|W)c~a|5Uy1eY92anW#=640GFVA- z86rr1xvN#J5F>E~tpc+iH)%nfd(O--{o3DI`|mT7NZ0EQo$Y=;sDeF) zA7OOWatQC$D|UQFY#V^9E)Y!UDdmjgbhQJ-xM zAl6GE4*sU=-D!NHLD~p%{&`3B}OSbo$~P}9aFE*E{Q2PZC;VPY+DZhqNw;WJcxDv$__po!H@ z?bRX;pv#RXz|U+p(3daX96n~9lDWMdZ3Tgr7vDRIwXWjIk-oG&{eQ%@iq$> zm0E}+o@VUirgM|h@NaH8^o!Tw0+J)gK2@SKc@~pJ?yALxc4VIDea14;lpI*Wh}6{5 z-S`#!0rbC-bB3*!UPTodnoj_0m}otB6#UByO@vS*HuoVHObMSZR}PcB*bq4N#l}h1 zF#c6IvnfA15FoU#_f3@y!1c+1f65q5OhjW^`N1JVDm7Gv`4cElbJ(=|F_|YUv@IvS zD~W7?=kXzy;*V5^wuY2mxS|R?rY6>=I(s!Nx!m_(w4rt?rtg5Jk7p<~LlO9UN0o?f zD+zKfmKN@+h{m1poLft}t5XI!u0dC}2&Vgh*Ugh5fyz;3y)@6LvyS{I{UF41`Y$zk z?|!Z{zg;>~X6QrWx{(8HPR5m6C61g`mHbP>^e2T8bX$grX1D0ayjX6RMf~l^Z{qYR z`V;*FetH-3THUEQd{xdyRV98OtQxnS@?ee}_w#Q#kA(rPfQrTM&VnSNrXuC0m!^kL zzm_5#y_WeJ{RD8P(eNb_Y-sPBoxR**Z}~3FuXT-^)@#Wo#LzN=RX7lqj*x{JzZjR^ zD{ehL`q?0n@9;p))C%Gsq@bC`(w_bH2Qb8Cr||4N7<*dAaNo>LylTl9v-S!q$zEOK zrH6_Ow-)NF%{sPeVr3y$54I% zKC0VC8f_N^;CsAzGr3w7_Uwdj=c~pkjsof7#82C0X)@HO0^M$s^3Jt^T-ao4+FZ{3 zB{AU*){>WcAf5(O_DQe)`M|!4L!_$xZtNkv9y|nhkTU zK$Ra|wezGeuwc%1YLh`L{l9*CB!)q)Jug-g3X4|TI}@xaUZ6%_y-txoEq1|M zcHyU$`txIp=GqHo`6i1)8eUMhdB^j_L#e4P+`>0*$D5biZSmvJAlG9Mkm|NONRB1i zL)R{DAEOs?dpY{MCms{>i1nFNxz7M2vAc(Svj{%;IltdcgS!e)J*QF@`lM^(q^3^! zb&zDMqrF=@EC3TP@RD`rkBcI>*bvJ!3cs;fcNgK?y=b}h zO)0J+=$2j`Wk)5IpeDV$DLv&WFTgNwAbRluOQ;(Vu> z;Mr>!d2BYF0t_{%W&k3^&E_WGBX|SfJ~%4@*P{MCpj7N&dIRh(bCCiqrAiNl4KOj% zP`FZf)&Ff<9aNTUqp|kfZLGz`(@6ezIKpQ8@a!gDqOEq;a)zgT#uIQk&YnTf?h9wn zB=2X6#CqMlSJbJ>cLd(GL90WhbO?NcVAB{m#0I-^le0NuE)QK*Y@{<%as#g z9M}Bt{1ppm?k+9O%zd}nWMi9{#HzBga)M%>!a2N5Tyui@>@)CzHNAZ`Qd_T5Boe$d z?*v3i6w`Z!gkOzv(Yz625TCC!+$F@*NIgv}Jl!6gAGmC`3eDb6Y8~Xiy~=j`c2l__ z(^uZho0)$8+Y8cqj`VLaA8W7hI5FVyuDl#25fqyim*Ivl2ZrOSrOChe23Y=xRMDSh z;Popmi6N0xTPJ@I2Uyy*t7|`pEEAa5-_kVC7C9eVEhnVQcIooSThp`vn=GWAv*#e= zVOU~(1l75f>YdDNNd&KO?iQel_ct1o;WuTCrq@v;5FVRZRbO3rYl;$ZW0RSLX4!oH zaW{_yq~hVuLfrz<2alvw7>mBqH)g?n-cegJRBRDRFC`sQw)2H3iR(3uPrtWJM#C6L`x1Oh?NgYIR0O3IY}orK*4k2q?V;LeeiZ`7kOH@r4KUf0Qgjjfq} zF;?vXx%*b_8zsr`aydX=Kz(Vn0?P1j_8$P%Wre>BC?EmL*f#)h7RFLoqm1VWJa{L2 zj;uko-|LW}AfsAB4^1hm1cQY_U4{$n1V2WSdA`{^2f{9GpA%j#nC&HLL1biZA2VIN z(YAQONj#p86`+8%N!zTCtn-$7iq?&#W4ob0f@{6qWWGtt9iF^)0hprBO$aV|!Vc9_ zAt>KvIqB_i9LZ#!`ClM__249hV@7$D_9Z!(XL+-%ULL>Av_-J(>sVIWD4~g_uyzUX zf#Snz%Z*XYMZD(Aj6hytZ4J0{=_8vy=Vr4a(7VLc3|@9eq+3C_NhRY~0I>C%GR`!D zj`Kz_#=Q46!He%#*G$1Gp_c-UZMGT@ZJLiLVv3m9KpHz^HiQPRv zb;szes%}ecYTFi8Y{IN*oKv_M!XGp_f0uFWXWFg!DVynzGAS~r{{H2I`EX=O;sg`vzdUumgrzw3%JYt(RNI7?*r|!17KLm= z{w`%cPwu&!fhE~7|5plhLeCbA$+x>*^4O&rrDj=w;fYt6d$znw{EOWGcs=k?^4#GB zz=yv~Jxi^%Kc4c7y)WO$l)aIwBUvtd?ydd4+a`}H%8Bdwd3k#y00r}I=KE>6*J1Pg z^ya_Z@2BBnlU&NunG!@zw`mGWUB)P9_Q4IQY8Fa^glU8)ZKY7VZtALtr<0nDk!P@; zHFtB1Mb3Sworhn>&oF`1ncC_bP2vXtH!f#(8_xP@;M!Y`EHiWkPGH{=op3_`J?G;0 zu*)ON5Wn;#?_jC<*Hv4;gwl7Wp6csmBj>{3zj;gPWfAQ{9`+3eAyQD4}2oU)&-;z29Cx>1q-FRHh#8(MCY5=1MqVBb!VeR74|Iz!@ zgY1cQy6Lz4ZLUk|WTmV^H#p|{Svf(QHD1C-t0{w{VYFsF$}AgX&m}ak{J185>!bCp zXBS6y;?rwE`Bw~P?~sJDSURHjwZ1hBxB=t<*EQ;U9%hdMuT8g+bF1gGfSY#MP`~M! z<*K|oL;|uW7}bG?dKH9r9~ndqsQ>n-O9x&c{oHxTMOEeneOdZ^ZDSt~zXu?h8!sM< z@4b|vw0QlR;$9ca+qM*O;e@Ea%d*?v2TSh!V7vWm5#&KHP2(%JslhvvrE6J(DX^xK z`~%Q|Kfa%aJrBI|m(hw#{E;p2RB%BifWNxUsAKpK_Vd;0Rv9?I9gNJ(4%7p%v>pq$ zVk!7;#b;nI@DG;{x-e5*>sE@-O=zF08>1aiQ)NgL}7P)KBfNT1KijIaAAnH!Ke@0JPoIQ{T{~P8sZFQv$q0 z@cZS--;b%u)#(w(m0J46tHt(o0S#oeUO=^f{L!UE4qCh!Ue~r8045K;fiRZxZwaPh zEggOVctRL8$ED?R-gwnFno$z~qx~_4s#W2J&%)2k4QBS6uKBa@9`J{Tov4F8fDg}f z{NkMf!WaOCX1nxyec3r;S3gGnAcB=rfu(rbXJl4|WC+xl)F*gY47(wefbmTLkjIgt z*BS34pe!5>7rcHj#-22UUoEPiOzl*GoWM`Fc6MxbE=4xHXU5dJnn=&pD7(p!^d%&Ozfw*dwPNdNA?s ziAml?TRSXhf25HqSAienkY)N&y&iLhhkTE;M6zyOYCQ0L#e5yI2G}d~77FTOp1+y* z^Bx*g%}DuC$yC3g#UyFg2m>X5jle*@^%Pu@F;!x5Zq@quh+la0L!TXW@hP2MUrDhP zwX4~{zIX+S0B|$@{Lt++A!`lQU6X#7ICYn}^@})P2s|0sMn1d?q1z+dLiM~PLxj#WQen-$Rf zQMUV)X|gwU*Xu9*xSdL%npL?7Z0Quykdcwyc{WM`G}rDqkOK_`unW+TU%>+ZgD+fy z0!06%ciBvz?nT)_&yCk4L%|9uoYXL+#br zX{3uS540-g{EoN}FNGZLGPqr8bLv#pP%LeI46iI6%p^1zls#@)vQc*oQ$`I7HA@!_ z=oU7hq~cp2JCPvCU~i|Q0n=hC;qT$2j3bT8lqW|9i!j;XgoQ#|IhbjLD9=u zQX!wMl=Xf^%*aC+;H}NApZM>UYY&I>e}g7 z+NXB@tQw!W-SVy|iMdkA-e^Zg#6ESRwEhZV*RqkRSwscV#uadU2j9A@wdup;ClK;E z_S2^yY6YHStAvtFE0_KASztAl^`|GkM|x@R2yM2cf0TaLAdXg4HD$8uWpjhM!T9u+ zetxm0bYxKr4dGZV)8 zZufqFYtst0xEW7$(%Y$FNpXs0`t^H9DNcDe+c}}A)?@QGL*~gyDn!{vX4*&5?b7gC zB`2(9az?kXr7Xa<)hr>faK!X&IWH^l+z#oZZeXNcgPAiu@jA8UluPbD;El(I&`d4q zR8!c<#sV6Y2f7t+-LsocJD$viJmzkT7czA;9=}^b-ij_#oE+0&;S+J$8~(j$)bXXD zE2HifVG~o}qQ+rC_)Qum3 z_b{u~Or?M;nmhG)b0s9SSlp1F@`Vf*C`|)sQ<3f@r5Pr+&+zK6#V@B|k3&9@Yzb+7 zlT@(o7PByfeWg65&gVmBfGp%?j!Q}kt{~tj^4F#q#_l2+*^KW)L#c)GnC6coMM?a+ z1||)aqpaH2=4i#xL&RC_UgVNPIa?i~w84a*YvTdeO{%gT?PB@TR?QeV*s%tn?=h6? zz>-?7KN*&gnuSA>BX>VtwyjH5W)uP1HBEsp3+)zd9vYzEGQr4J7$Me}`P01p>xGMfZT~m*=zb-;=`R8%O&B-Iq zz7p~wUE}=*F4%5N#wo1Ktw%+Yg9f}xJ!EA+0L$03&$d<*E+n!-|46XFon@b(aMz`H zQ42PM-pDEW9a>RhTKUX+baJBv@1%cMiL+s|YWAdCgAs&n&P0#z1H1Hv~@4>%p@Zg*EE5P;}$ZMtl z=PYizT!zxAUi+usbNfE1B3U84Adm+h?Jzl?5?utm)2;FUPi*FYCWrH%!Ylr7Gsups zbEgJXx@1m4bEl?0v}^+tdU%vIK+lT@U`e8~0Fwns!!h z@ze47eCoXn%<7`_F|kcTCn+rTY&tFZp-OxBLD2dc`fGFs8w2pOI)_7+$GUC6-ZFA6 zj$J(&INqey#7&s%DI7CChG)6E@ya{gJX#2v-Ahot&FRgYpu|TiOe&`#v}eD)xMIq-k?a$~#P)oq=Rok(#UC|(Lt*Z;)r7yy ztn|J6s>jwBuJtWHl=JlLF>(7W;dCQFaE<-Uq2%`P{yjiLt**)AJ_gShy zzX9=J6U~i!C}G~H{A~GX19vDq|7$Hsrs4HqZGFuAL^yNlD=R=g=}A|x4L{!nU-WVw z#dO4ren7Mwgxbfg4R*#cF*5=?tUL_ytS>~skt2CuD4@q{(;QCXV)uX_2KCLZT?JYo z_{?QEM!`sqP-u+t%vfo71F;Osd$Nhwa~&KP^UCfxmj!(ZN1dWu2$porRq}xm)h_#h zi+kn`=BP?PQ&s-lgu1ZE`!&3@D6@wdZ_)OlloF3&MiIWMhaXZApv={~HKzol%6vYJ z@%))qih7@yi8o<|vMPxlGXW+U?_Rdfaa(jzeLzzOXfUayK68U8ufsWT9~2Ivc&2{SCodPLPIyp z@7d{${^71VWXg9<;b=mEQ29evDftw z=Ir;EMSFC6Mcxy>a4!3Vq28){YwDy@BsZVb7hghXq~<0jZ<|zh_fJIQ+&Ip)6EyKR%wu`}A0fS}Q^6SwWr=Syo$-%$Z+VFbO;`g4vP*v` zZ~el(DRQ_>wIQ?KBEnChHIP&x)#4KqIe9;B;{w;*=Ff8l)V+eO8`fP8Y|#F2cV}w0 zASm8r-92wI?g|c=#dS<29PZk4mfq+wn{a6VOW-Rzu8_m*O4DT zzRL;h|6(-P`Zll6^q1civTbT!X7)(A)1A2G9dD1b6C%Xh+sLrWOh-i}LRW8bZty(N zN_sZhF=XE2p`skeHdz!W3m1h1}a1Xnpzef%>3}oK9WMGU_&e zW@_Lkwdc=6s?6?Mem{xO@_*jl-L0ysn)&WrR|f+w5meqtun2=LSp!`I14d6ymZb0* zswU33Gztj|U!4X9D;}I5kkz_3EPb$66xY9Tfd5`&&BVqw6+oOV9SJ(!69$O@vX_j> zrvd%yBKQ6Aj#A{wll1wEp2%JI?$oZU6~M8p#2{b{Cp+9 zsk@`ha!&fb^Yr4+IfRTbvi&WWa97hL0L=N22Yy&J}Cp& z5$yOZ=Knl!P$#dP$L2*7f>)q&2n0f0$wtsWOu^H{Klc5(JWq z|Jrv`wg`L~N_kI)wN+++}{{XUaNIaNHw;c=M#yf^57yUjlBGHtQ*2h-VaU_OqeF^4EH~8cfTXlLzXLo~ z%31zFXJYZxD;{z4yFX=*QIi}wWsQwIsZ=v3iR1M+i>V}WcsC-^#1EX`W6*lc$@9ch z1R7A}gtdXzwQ9GxMl7+%qj%o@>ASk?MW=fF@^p!l;K{GA=T@kRzEulc`zLC7KP+e2 z`e%`iJjm^Jo*2BjqEp@~;Y=GzW3IEEsp#wEU<74KCeb)rzXCI|8ltyeMkc$`KU`lg z;KNS>zEBe~cR11S%&t%Bkw36tnVeWZJWc)-6I)Z%=f$5KbmlmOv%P#8UHJksQk89@v3Ov4Y%cKz4CajhqeMtg>E@>r{caHCvf{b@k4qu1LwU;;r;(%YVaaO25i*rLIcQk3yHcIgt2p6<_CC#2Lmqaaxj_ ztjM0ci*fQag}8?ch-JT6jFkm>fPG(?dITIgTU|aFQb^#^Vhk6U0o>8E%8F$hyLwll z4bA(9(L{ARyKMUAhLUfhe?3Ig4lnv+srjo5Q%*Hkh{O%eJzgAGt{vNsh49_Q`<;5z@0 zA@#1}yz@M$E2;3^j+=q~Kjxa}(W0J^P8petvLWf0%3mPpe~P@TgB<*vmOWDYW+h!d zI4uf@f79bDtutUFH}`58SOS*d&eH)SvkN7{@a&!CNdM)#0gKEd4g>6`88gV7)&jOt zZ@*5>=B!qI-3LB6>E-_6j)I&x0v1ubE6htIXzyIokU?pRA|0kKq_xj4uIXlstk;HN&@$BRzvifm|wy01=?`wBc0j=f-h&Tk!_o-ANdmL)eACEGbdcUA%AS z4Jg(dY6pzkEFHdF`T2d*#8gMZ*&*)uNKFv3Cgqo-JG$jeR8{opAO4HxaU&DzK`2eh zoWmen7nqX4H{+F5oQ0*SDWAPh(M2a6)Wlt$>5rSnTSBF9)8c2=KE)m-6NuV3D&do# zrWSRe4tc2DUv3bVniBr8jRk@@dXtINJQoOz;t91Gy6f8m{wVY8WW1KQOnd$s6cC&Y@QD9$w;p_2vSU!|mXv+ll+FU4*Z5Ni)Fvd)8EQL0##xv;` z%SivQTV?1Qb8`#Xy%DF`AOSXJx;ofXl9Jd65~?7Sfy>{utR}W-$9Mtw?n_=Cy71iv z7?-YBr)b!)rw=(7FCF)xb9291)$z~!r-7B$?f_K1DY8!uxSA}2u&)Ry{5UGW6@M~X z_){QY8+mHnd0O(?-15UAy+GJLfOTKgZLWJexNGNC9%)^gCQX_|1e^5dFyUHW*mG$t zawQw0{68qr^2c@VZr*JLmjGb(04tw|g1Bb0Qm6RF_jAchcAsuLSoXT&%L^M13{9Cl zT)aC1ZO4!sQ9)p&AhPW=ko#^u;Vyn9J&{HWkv&Afd)UU{f+>-Ony-xFF)MaFmQ zl;g>(ntl>nx(`MF%53xL=2>jVPT~G{%s_GyCj))5hUt6~AL~vwIEq78?507RCf5Zd zwzp*bHGm0k%S37w?maQ{iL@uJgNUivY|xmd`|ZvA`Zwe)>* z2=F84#)2Rj=Bv3f@R^MK5$pK@{~0TG|J7an#qOleJ~N53NV6Nq>%rUg6(=TJX{XvA zfg1GUR@Doe8|4|y`AXlOk=cPLaMF4_3d(~u)~6R9u-zU21_B+&@AZ0Y z`rD|Jxo{=?f^C0hLeZ4;Z_Bxkc(5lP?CQbcOShz!sn=r2*SfimRQJqT1uo;sXybIs> z-=d!6Ai9pH!I6u!bjf7f=fOHC|LIy9buc^ zn`G+*DdfSC{;nAMy(MW0svT-L{v%2X)uQU>WrBPwN~2)nQ^f5o&@66@Z?S6cpkr{@ zo_nAY$m%Rn=2ro)4;+j>)FcF$CAK+LbNheY@m&9t-bqd-9+Dq0VLlq4h{DR1-CB(+ zFIY%#m(kxi(TDRoXe%my0O9V@!_x(H4I!{>Oc(m#=rGDL)&Lo(17&=8CnQLF z)!l%120Es?oPDR>{t4Bl_@rM-HWp?bPGx0q$5d(o^LY)%M_^FY=XEI4R_yui*62M< zr?I~P7_;k{j~|WqXWwE1r?9D2=_vNx_j}AJ;xUJ`W?+z_$3Eopl;KM;aaRpIzh#sC zBRd=Ds8v{H!SkPnLkEH8cM=U&aiK%Th{#?k=B%V|mu|JpxAsjprxJ2lC)4`nsC2qFH!o+1O`4c0D(zSXFDM z@RPATGH`K9xu_KEi9T zDP2i6DS4Mbp~DVub6TtI!3Y+>P%vGL22{hCo+Lo| z!}F%!&__;$y1t@dcRbZ$*r92DSR|EkE6U!CT~OOpF_bs94?d=uvvo^&Ao}Q`h+AWt zc8-|)T{QbGH)J~t7>S($Q7|}Z&PJ_*H5p8_QTdwC`qCh1AAD(smFpE!Z%A()?)wjCWXK47KTybbi(}z}+ z_g*+})&}@Nc?p*GN1_z2ovQ2wti#T@Rf4mz)p*K9VF16hRsV(febyIjI{QG9cXD&D zZ&mu9;bDF5xp#jy?mj&13kjAj3WRK;@lMitD0p8((t4usZ$*_7{`Brvdf&3+2UCV7`aVxY6G%DMOxQjdr8J zxPsTk5c1N}{17}d!}iDI*n04QF%HRqNk0Zet3P)qzNpq%IjAmz8!oTSCT3^Rlef)Rk$-YP(V` zU#ZD0nv{g-dBwHRXZycv#~+QK<8J#|a)@?YfQvC+hEH`$QA;e+E!lDNJZI9xP)V@3 zUAhN5J#U}>_9dzoy5``BZMhD$Em!b5niDe0iV=07l1UD zL^5wjd6jM144`_?q0O26e?ujbsXj*s{-?R!Lztf&P@kAs1a>4_DF(2iw`uNva==Cx znd-lSwtp{E?<(Gs0#wH??`PgIdUwHVzdNYY)GMy7l#cy(p;^i0ej}NlSgGUvQJwV< z(DnX!^olGZBp9ebz6kiV%XPqZ^-*1b$Dj~wf4$&@9WSb)#fTi=`l2me?l|%Mh}el- z6=}$;o?-)e?6|bI+~;z7)!DGsQpk@RFZp$P6J6hTACsxVrUr>y@lh%+d#WgyWL*KT10e zwe0jXY*)V6znL(_`?T%xJW5r*kE&al;s75OS6|Al13FmmcOZ<(cy)$UNiWMv!R31Lc#(KPOZHX}i9+?{S`$$Xlu}ZhxPRj+JL zzNJ})6>f@c2p4Fw*I@ctz&cdnGn5)pd0Tldk-mH}GP(I1mBI%VU*EMzUuoHR%Oc*7 z_=+J={?I$Rl;(D2=v%)H%oL$i)D@_{5~3bM-AxBpn!^cPJZ{iC>|4HZmo{s{kK^{m zT@CYmxt3i&ic5nmW)@>5#S_u2*wWdv^qsI&VCwZnML4O(Zf%Bst7%XYWKV7tlsBbf z;E*?lED+DOdM-g9*AEYLXCwyQLvPi(?S2i?UIPhLW>a#ky8e0kVi>2OOko|{t{kp# z;t{8+upKumHY4DKE3^J)4F4S@sG0!5@wR7XU59mqPgdQqjXlblGdb6#LCH?EV36a< zMs5_c{Abry))Ueq{!D@%yb1}N*{hZ6xGORW3S~R|S=>ydi zQny+{KFf03ume(_$wH0R%PapA%jZP*{r=FbAdiz>Ltu(nzrga^+61QlJD%Izvs~p{ zz9?i%H3^LbF%nLos-r(SLID`Rbq>G%V)tXL*NX;ccT0m|4$r&YJvyM(2u5Ed%tfhQ zi}=W>Qx%lKft_&5$wKlQJH>E-o%W8)a$)>T6F3N=2n+oF`M77CIU&AkN)6j+qw~A_ z*&{H!W?b?j3++K3P%B1+;@QT%Sp%fnme`t8qvc{jpsT(Te_C0CuC*(NrPTFFxsF)0 z6^qgIpM-f72Bw4@sOWZKcW0wG`Uhxo=IIcNf`j#64LXf{0Px;0f$o_W-ese$hvXMg zL|iCKc8ue91zR#R&aBFw^E};$kgDu|{!z75;lnr`l!W@~=NW9Bs3eAoiZs1+-04>; zv}Zy-r2jM?j)-p)xxW=n#BzCI2}%1NoBg8ezLT_{L23dJ2xNb-GC9v>a#mvo(y^BAPt%Rx&MtaBASL)nngf=nEBRV_E(U2 zgzr=p*Rav+p??l7l5_hb;q5Mji1$lt?nz#a?VFlFBIVI|z%x^7leUgVj(?RUDRgy} zN^YZ5ma!Ulw zi9kKxH=yjx7!FAIwFw2F6m3z~V3x2)3Yn|3Yv%s#7s2fs0cxoHN5xe*?VPWa4si?A z^J+f=!Bp|yCFWjdrAh%O6QJX8!ythiY4|NK36x8S2999-O~p7fAC*{d*Flf1f*BDq zqLOPwUTxNDuf;CTM%9wzKGNcZ``a0nyEpPS>g?Jk-}dBQWd%%0wb<9;7U|85?PGna zmT|P-66i=lxXM$)*}an+B-Fqry})sll23YgXZ5$cFxP8q8qWKFTDJ*o390`a{jfrp37qUF4j)*IH@kCSTmo5}?(Bwn?+*#G zPxSI3kWs@OlO_6R%f=^tSX-sTDL>A9kQ&RaHg7Y9nTl5Kfe!3Zi=fj5GIgXg6#M(r zY5&QmQ!k9Q$zzp)j^goGoin(T<4waeGnE}N)1)fK7V`d?K$BbZ%lF;FsW)P8tS1)p zXA}^i;}Y#;WK{hsFXX}Jv=2pHRj_4&t&ZhM@7%g|3@866<}eQ^C)JBhcRZ^4K42e$2`el`QP8p+s#xOus+qvH41 z>MY_0z2(ehK7a6993BEC76&M6LG}Vkcc{45*+3}Bv%Lno?_Sf@f-E%iCI7ULy&;U+ z`c+Qd5h~uPTd7%f2<5cJ8#gk{baxifP?r!6eFjY7hSYkSHIM$By4Z%w!}y-UonPEy z>3+^S2blZfUpdbkmK0+HptbwS#nCi6y?CR_ADQ$Ao}KoMbq%vO1H@DQ5?6#i&#SR~ z$dG!KHf)6Z>MC}kgeJOmo>m8d2gYyKnI3gm7&{M7|>^_wMKeo`lu8KU)<+Up)F zD%kTlsF3IT(}uUz>sKqFF6fptr>}x_m`jk&4)^XH<%6f5;h#To=U!22x3MU(RG*qQ z>}373cSgz!wU?!$2(`DQIUPE*4;9Stp}y#H!!Tqvocyz(|Elw^d0D1byQXdDU!8J{ zSH#+3w%9|Z^=}@>%dE$fBWVtb8$p;x3u$rrBA}Re@Qu~)@|!{ZHXu$&pcdQ2@x>4p zJqA<8#s%1kks4SrQw|rY#H* zCarNo_BmfS$Mh;z7!0K6FQnDdg9V*rc8f7~z5A-fpJaZrX z;x2X6UgYbp-ikTUA`u~HrzcWwg(FUrbA_EjKQEu0sGSuOi*Oz8X5oYe<@w}d`J-62 zv3KMn8?C(;Ge5b%?H0oL>oRI}R{RM1Lvw;-W;JxYyUM$gUg3>;RbYeR2O^TMX5MdA zNJ4~Tghm9G=-X*CFUIY$y!CVHYSk7k@hOW%W2<(;G4cYBps}yv)MaL7@#2lig%=?6 zHoVk;CfQ)N=0U|vpXo$!C5&qpzny%}c$U_#s;qFyDq$Gl$^jKs!g>;mH`^Yp4^F>K zdYxwW^lEdRC2y@~8Gu~l8$8R%JIHzCum!6&jZ6G#6YI%!Q|^o5zRYSZXZHh+I=99w zPtuf8zHmDD1s6Vce9ExS$+~@-@+{~iDQ*XtWQjq?!$Le9e>1f29zJJ~IVyHTdaNx6ML3bR zv<{-`HL&%LNo+^aocvS$FfLv`5;^~oaciJRJLTJ1AvsbRTfn{!=yf3M{Q znNwcCzo4tJB4t}#)V=7@nC1nap$DK6KD_?YZTYFB^oLC?(#22om`M+W@pp|Q#(U&Z z=E)7karieI`7KDd&sTz*e^d^8XhEYiy)v>jOYvY{!v^%UTm-EQ%E>~9->|{MQ&)Nu z9MlK~6Ou+SmHjS$Vk~6Q#~%U@`Me&9t0fA+yGg<*UpWH|iM?VH_;|Wj$jJlkVO2f; z!8lRd>qv|3EI-@t3>?diY|QafM6Bwer1td<@{~z&Z2~GS)=OsboE+$DK}u2Be`v(DFZu5fVby`(EWA8aU?;WMD>%nkBZt$ z(Md1P?oitm%=m{tpKS2;0BQk0F|}yZO8aefuiOO2>+Z!XO~A8y02(UOtVy|9PFPNw zdzA`2ev}8uef3y4$;{I7t1fY4+(ab$!Z21%N~G-Ab~lU8mX3Quig^~58q93TY~L`h zl5*v?QV7OQA_vcjyzOP&j z`pK#Aao>mlzB^8CYI#~$TIez<7E45;UlRn>$GS5LN+F6{YUN)z%LBm1PrdH;eSZ^| zi?7+PX`b&$2zr&cyGe2hv#Z}@H_P`VQJiQUerLwTJ*UCE-)7g*G>9w~fvVHa4(w|> zI-o6Rt+x6NGTWTClR4uwJ;VE7KCH2QWF=@>u$5%ssBGUVZl?4=Wfu+CoZKZmip6T~ znn)+F+ITfZ+sri8n%KZ_<(|mRQ5v#`{NvoA>>DvIDkg=Zik+Xn6iU~-?XdDbJ{DyN zobo-^I?ITI+3plp9Eup*xo#5;!cU?5)+f6qC&yNAw55(e$=Xi_zEmNuVPt*c_WSOi zZ0wQaC+txT^|}zQ_KDrLKWc@adKk~(vdu>03tmga+@$2H# zVPhN_c2|8pv#bY)2*P3#o4Df_>rI88%88!JsG8H92bc!>=C2}}6I;F?a36NG5RKh6JDZ*ui`xdpX2oF#r)1@~P^l7)tD`(1;RJdRrzZqFQ zTl5XM^$pcv%P~_5KY=wHvhn;prpw{kZc-Hl+e8_ZTdrB@3d1awNb10}18lL(dFp~; zd1U{lEwCIw<9dFS7ka&Tf~Nv!$C`esKpA|8dcS$|62qUh%8q0P_(X?c&}plVM%W0v zoKHTe*7kG#=39#=5*qG{Iu<^sKI;RPQ>zR78+#6CS!eQDThhqwYh1jJzqpTkBIgaK zSHoZnd7A4*3HRHj6AP48F^Oi-xTgQkYuFQ;V(4j2$27B2??1ArTMbF!YtF!j*fAoqAjSCEJ%`DObz=NJR+$(k; zucgfBIKM5(thXiOwvv6i;>Ygrb5&^R82sfQbM1B9f3Vzll$Vu#)cOq zXPRLar#U+2$Lo|W{)*!vm*JLTFkOhciZyco!&O9Y+lw$i#3s7l<%UrndKd-Xc zr6#15p$>Pyhi5Fe-d4+<$ZQOFMoKQrE)n-x>w>=ji$I8o6fUxkQ5Uk=i9La1IC-|Z z2LZNL;4_oln_u6<$R+?DH-PW}1Rl1dXLJN0_@kP15CqR1UKoO~$0y#Z7c-vf9(+E) z2{M1Y@y<5)20+%uF8#RL6)Zn9cV3A9zX@{&pRuE+YX_R2KSKbWk*O$ZzNmU`74lyI DlA@BP literal 74033 zcmb@u2UJtrw>KJlqX?)VRY3ufF1@Ots5DU&qzXvyCG?^PX(FHp0Vx3iX(~c2ANlLHE$gGb&w5lQP7RY z&->4&8~PsCkRCS9Ziu{s_FJ%t#sfB~TDn`f*}8bxIy)hlj-BU$?Z>IxRh(UX+-$9F zJP@Dg+vQ*@-Jh*)mS)sl&w1E7S|TLL^vB?xW7K!lLunG zJ-!aM9j5N4YwO`)iO602$%jCkL)=!qrt6)uFdF2-gEiyZDC|GZW9>Mwsv+TeSlmb| zuGr>U*)`q%^EDeZDoAMX6hLFB+ux7CMIN#V$n z6dngr$5Aps`}55;;g9={^&`DKR>S(rG_HH|NQu#Vk7)#mlsi< z+<$&DIKSPL|7Ta781qcjKfC6t6?gA4g`gIHn+j#53)8+ZqQM)i!RyX#W~%+x z`p+?){H6Vj#bR6DJ^X0q=-7coUr&D;7Z+ECM}>MTMBmIb)1M)2E{&0EnPU`IzL!Rv z`uCdDIMzy}S)=d;VOLnAGK_@Vf_i#-Hd^&+-9|aoa#Fn~kG;QlX_yEfB%|CMeB0EN zRv1nl4`CXQ8J0cw=dxEaGH-4Vez7htEkz2@rpErQ!MmJJA8^#r&=4ypz&9VlY*OFQ z@QmQqrMySE)SO+uu(+7o8aUFq@1Id&=8zn6uEd@3U(MwDHaW@d>FKE@pv5Pgs4>|Z zcNr_k`tLv$DAe@`Ux>Z^yDEBomoR>_Sbw!(WxmC*o&y1x_Qvh&|(eL^J|njK!%08#<#;cPWzDg^enn&du4Xax-+fF3-PK z<808Y+j=08tXV@@X{#WV4KKB52Qo4X8;Ld!Mh{ro+TJc8N^*=$?#^ikv34ntUXC+as-+8$_rGS)3YTU9Vs zIh%^HR^EQ}>C-2~Q?uO=PqVjVGGEXN--?k`vL+2ZJx@ZLZ0doviW{6nJpPMf%wNW- z$3m_j4Y}^v^Xkt`DsUHyv9h){oSK?iAt{nadVDt~!i4ZbA|h=4_N4~-Icb4IpLb_w ztnjIRi?$tIU2OdvTwKnITfZ~&2L~Tv*7F~JT+0#($deQoHy^YL46KEJ{M`DPQ2XSV zI<1;wd|qB&*>Wlh<*2w+e;~i3LlaZGSUJn7{?=;pEmy#*PMf&M+^;8YZlBkdF!XH_ zws21PNdEzPg&*tQ&(qV-593hmL=3(12rCzt^rz~|N?VyDGdmiZnvZ^tM#x~>+S=R( zd$g5DlTuO~M%}v<<4JbqyDKZ7Eo$##L{BhLXI*#H#P=xA?)qZ;_P1<|_wU~?i<<4|=;#;O`6+TXJ}M?gUTUG8 zR-i94M#*llu(G?hvhos}yj>>t(%200IrSuNBUbbZOHZ@TkKUG(DUR%c>vA02<&W|# zY`)C;iIBTJ_r77wt}+e(`Za^PoLs)Lvhp}ww}ha(U5Ov<)Lc%QQ`F0sES&lSu5w36 zBvSNjlfR}c?(8zhzmY+@jAu`48%-XIEG`!F-|9*8GfrS-mKGF=yK^)Q1FyGOF7CAVz#fF{r!CUy*80Dq2!c5Kb>F?DE`kkh*Mo(WU1$OWO9xtV=V8mv2wiQxmXS8GLzNg*Y-8_V}eg@zM3f)jq&s~0u+h{MY4dI&mNqKSM&gB$FrPBM zDjFhQV&YjrK|z@&^?|{`hP2(eG;?QX`cebU+8mntvS;OAz63XO1+k}XH1g4yab4s{ zfmqU(ATkxEOgZoA<%Qdx4Y}S>oQ{u6mFlRjT;(TTE5X~gQPBH;>Oq>p?o~L&>wdhLC0nCXB=FzjC`~E#LW@vDavbzF;WCHSC)77?B2rpH6f+s;}>X|0GkIjOWNuo~}T&txKCw`LA!x zrV4SQHE!~zp7i;Dp3LvKxq+zl6U@TrVq1PG@6GPLw2`o@?#wSAvwNF9tp1jdFiH%R z?#E&|>aa)-JRZM+QKqP<`MDd>o>BUab4v}fBaT$M4~&m{QFgNuOvL?b zch-lEvE+8`Hd4V*Y( zDk@m#GO^!Zi3_5>$EPJ?-CiJNDNNbJLC`Mga9Y=_k6RJsf*KNvxFEv`nH|!WnBef> z;5Fd{jGFS6PP5Mb(K|=vV-(j}{FTzo5{EAzw(d$@V=o(B9;2>V%5t+}*y|1}F)67~ znDN@QWYe8K({I$3h4F+Kp{=;~#_W*<>kYICx%cGZg|IX)#+#6p66z?pvgSz-y2Toj zmUb-NO>Tw_e9z%2+E#B4H5inj z4lY*Aoje|LH&2&_woQ%G=b#9B_3y0iKnOGnV|KoVoOt{8ZT-kd%7i}BxLJi>@%gY*b;svG?$^|f z=Xd4h<$p-fMyP%*+U?q1=$c%?wS`U*FT8vr9wEP2ap208EAbn7v;A}I({8c~r1mS{ zpNPk=s$XCX-Pvn$rW}SDE#!J9>)vl7(Mwb9pMlvO?X@d4FnQSiL_D|8&T;%38iFQu zNBmq>^tW#}78VxjXGs%KvK&3Q|7~ij)M|9|lq)tsVY!is`oxwOzI1(^C8ZBKOv2@F zY&0u7&Ea4d8wu7>ONiVMAE|+z79V-|Llu!P)q8)?s#?&6F#aR^_xV$%xSB0u6b~a- z_I;)Pt{W$^SW9XY&i$JHnWfHuCh|8PkBPgiH|;mD?9Cn<8ykA$NK&>L5_uYq>@^-B z4JDC6fst@nZLLzxa+LF%E7g9oCJ*3oX5G7HYRU!K!l{}dMcFFctMd0!WT(qC5;iQ` zY?7{>u$|eZE?qbjwYq8(sT0I7D@RyGYp36>XRcj3^q-RE2NoM9Pps*2EAWCf_Ctjp z?lc1ugQ(h5tZ4i4fv0e44Gj$z-X|V%N8tH*FBCTm&PgjNIr(g4&iF9oL_{2`SuZUt zoqqJsfERl^mHbK8kgn(E=a;k=lq|R(OUmhlD(M&HhljaY+lFVKj&D>O-6rO zT_X@vJrw?gp73y!{C;`#q6>2>J8;6-Qub7lYU z_51(+#Qgt*`}tkvacFO%XS}g|Z@r|Pu)bUHOW9z!4J^d~M;lKVR?OT}A>iIVE{K^w?pAW7)^GI0BS@&)S zYF%LbZuJE#d|mC;oh(r~xq0sZ`=rCh*y6G>&-Y8P`p3pN-6~TEWc1&mfJ?qN52$Bn zXAc#S61)6o8mC+>eq(~rdtb%M_N*!ElU_>;C-jz*Y73-X@9(d@X|X4;s)w>7FawY>SjVRtBu!GGi0!LhxM8XIulXY*IU5%tE<07ev`q^ExQ|UfiP~Ak2{tN>~ zLqqdjeC1{qzKWvE7~vtg;FOb|ZHriXAuKN?CG|vZV6*;+lFQeq^~)O_BRw0{%!R)i z_Dq_lMe5GB1iAMYQJBXAFYjXMYmOm`ws2g(mfMu;@uu578!_~?hw9S&nyd^hHmDP( zA#qoUvQ}=|Nd4%xpU7m({4>TyGmB09THO)EeVG|=3OnL4o~>)LVXxNOV9&*rzGjcG z5hBgGyVEJ}ufP4-N3q&v{NS$#8`G=9E&~>O(tK~m2s^*kl)qwY*Ci>x)kX<;;?UAY zHK)(X!a5QiB}lK}@vrfKA1g!xeE`if)9p0J@|~a{3b|sWv2%AeV0KQp=r>^b$3)ryPH8#kD*Ug(T@#35AOQX$od-EADeTLm{Kjdm~{U zlon4~*8xO-fB&@Si4!MaUc@(zCtk6hmV-4gcA=oKkS#tkpwV0mK$rd`XH2u@2!VA$ z%WS?X+902IN?-7dCHq0mo}!|nb1|mqf*amzzN2pWr;Z7miQ=chJZ2<5T!eqt7&i7n^OJI%SPVUIK%l~WgTjYv-j!C{j{`!mBIi=g4 zYwCiY-t-x^NtEgyQ4?DUO-z0LQw!p96fa}MVLx;nd^1=3X$}qUd;V7V~313g963bcaHDQ8!9*Li7_`>bJ9%i-_0VF zS&5i#TGy;;?&xoK$S*a{d||1==l}V4dDqU4cIZ1Usd((nSN-Jb6MZ>k+>h10vK7Ix z=^(}anXfAi4Q+b6XO#z>ISSJJPwW!wD2Bu73r_e!E>q`|JB5`_+iPkw%Z0)_sTM3mW$(iQg+UyMUqK_=`zVihy2N0YiL@l;Cj8j0 zl;F6>8RF)M#Zmvq`w=d<5awmR9p}>L?la6P-nLj@tG=;~Ab(HhkIuef=M|8ZTdYs@ zJ^yZun!CM56Ja7_jCEa}yfIe8fXaZ!=9~e6%R&Ex^uq%O4#X3LO>18Q2Y?8}H<&y3JJKVDNk8x~o#X0cvp1esg)^wLy53^j7 z+OzDV^d5h&OG8y}N1L>fGZV9%+NEf<=`^`*8k}0g)h3OKi}FKMY?c;M(}3A#_Lrkd zlyeXvSmK@KB5}!`lOglvF5}WtmMmV1E9aC3d^zFwJA%tb8xgJTw5{F2#j~*#JU}U> zZ?nvB-6dJny?ho#zJ{stbY0A@tdxZjkqhLC{Psk~4#YU$F z7FiiJ%70i=!F^;QxUAijU3YhPH`TY^rh2QqkqkN=R!qUc!GQkZULmcDu|t5Y zveZ3|dTF?260&*ZtMc3qoyCUZ)87nrQ?t%Zz5acH8D-QuX9tyYvQED#Xp=%l6BZ1W zug{1CKJVIjpR+UTuiS?|;QBboU%D*Sw&XxPGtoaL-P&*?ak$fBI-;xXCb^?9fc7cI zY;6)nPOIKVd#7&+Rd(RWV_|w}bz9$W(8QS5&I!VN8uQ%aa!`z+FH3F4k2xujGEH~6 z19SIIBYp{S-T7thB=4-RH`;X@E*_$MnWE~lx6zsRa~=i{8SNTugY8Ps z3wzx)>o`u|VfDpr_%1(W4w|+`zrQmQ)C7q{VmZfT0o|zaqes^+FkX{G-4ta}tu(qR zm3#wm9QW&2((iyhiEq8%BO%*Z22aKJS1++$*rX=hLoN!^TSLRO&1wC{2k68@kHgtq z^!I(Vz2sEY+iDAer_zY7;ql2i4_0+`b^cSw2gb&vbU&HP1VN-SJ1X}2Bwd)8v@~|P zI_l%cj|Icw={;JQAv6`1oToGgawqvI^AXVguV z{@HGu)mw$pqeoL%{eUKpH~ZdgqZ_XVe+hH3u!z1?y2lmmW2_zUG^3L%!%10A?gbjH z2wct8bC3BWQNBZcVY&5Ym7bd`mYe9U5BH^#QP`G&Oi@R*zP3`nt4r%3iaz7lZ$ROxq4rvad0VYIT$wm6X}$z_ZFbp;$KF z7Qf|W?X<0FBs`{K{q}pmq*!S&KX`PC0h&K@adLD#D*(vX-n;6P*1fE;qaS-CKKK5m z7~ArFzYipxsGAs<`{vTB>KykjhR&2_(#@V~&c#;|evBLBhZ^KtZSQ8^QZAijYAY)* z7gC&u0_8Kh;usSpP+3CrimsifK-`Oql+jV+UOP#QYwl@fv|B{_3oWL@Yh*GTuYepZ z`qf){0;iip9iRrwe|W_|XmLaq2>jMAKR>?$G-0+YP5RAcSiPZy;gCm#Sj!PInG9v` zwC}U4^)6ow3bD9b`!#!}{Z>3~(d3<;d&Gb07ip7*{%U86>;YH+bAqg=Jlqy|ZA$!N z&?bd#>1~s73=Kqb+m^zq<37IV$(uZ5%Zuxc4k$(@qZjsVZ7By$@(T(K7Db}PC!1Pq z->S>W?hJrUHjGL_?B_)UA$b3_nviNpOG_xZq*7TYOwkqKpK~SBA&A1KlL{e=9F+)rF{}_m~THG zxp~#m((=Z-{-?r1!&X^iY_%`RU$OfS16UBNE+j0>ozQ0H?A-N3Me52GO!~6ow1M<3 zzef$xH1{vZbx3YC*+cV2k1A=*uG6S$LTs4Tlm8|V|dr> z`w_p3-4-$Wa+5+8bsU_Xz1C*Op59-y-3u9Ckvc#&9aD~c&8H-yTv$8DvGEx1BkQqS zS-0^beU?qepKllGTy0DjAgz7U3(KR&7qh*^L)vKAN}FmIF(J5mFN)N1mj}Q~KOjRH ztb}QxCCnT<+^1Y;$6_wx`&-*UJh2himZ0;oZ@N)8BLVAZPVa8^$u`LXQ`&6<+%1dm z+vJXHv#)%v7G|6V_IkgQ2?RpReyx0&_Na%YVa{G&dh4I_;->5C5f7n^jeGGnMD|SN zBd0~4*GC~s@bfMFl+X;7mXSGXj1{uYYtnQ)mA8Gm*=aZ8OsOb6q%C(QfS`|EU3HxF z1mbAWW*!!X1_sv!&!`mZORTmIM*Y6aHZ0o)pj29M(yIL zsHhfPgldK(5BKX^-`6@Y=bmBk--O$5UHI!x7I#8UkFELuHRYeu5oLLkY2H4^NORbj zPjCLg`1TmtVUOtXH?L-oU~`%VZ*fHhf6r|NN+QsE?d>m(oXBnaJsc12-?y1sWQbXe zbAWud>^6z?@AN%aee`3q)BIk#Lx{)ZT1H3rCDpB!Ch_nBRu06{`eR~q)J{pDY zTEy;hrkG|SMe_-lfhE6YPwDX)Lhqw%eWA}b$pL+5^+W(|WMy5%{O}OV`~Z_YT(l3l zZ)zdij&ei)$dM!Bspdy(z3GFjtZqu_HhP)Mpa*WE#3WgxTGN9ojkKD+QP}$I4Bk$? z+YKyD((-g=QVp@@{90FBe4czUPD&}7ipGDu0RK1D{D057Es@ zD<=u$OQOaMSP-gQGosdk;CGREsVmUuiL!Tv*a9o;X8PUVHr1fJ!yEd7p4Y|j1%N8N z6#_M<&ULzr^dLDVTv)0K=iB>)Ksph~6DB5Tu&@bHBZe^&YB?H#Hv@Zu^KDZxs+v9sF~ep7FOKrsFiMgvb1 zdtEpo7F~-{_|41BZKw8f36wOzYfGE{WvC}JYfmvp+F##N4TNxdlIC!6Ny&4-SHBg6 z6WUe){(&Q7A0qr_CP)eThK9k}wosMd{3BjrhK5+h6KU>bF+Rn3=KrR7fVuUDj4f-c zn$Tq>z;%Mo7LSXJj68ZcSVl&s$Un!H6?7VkAfst`^ArmU%PT%1pp_CefKxh`*44H) z!l;f#wzs#lXnE#81PbZuFcTA97>oce_~@EELR@J+kTK#Q9HKpZlEtnxX~fgaY~Px% zF=w!G_5;7yqmz8KOxi#DR-6Jc?>`7~XaV~=(R&o^@hcmecyb`^o3>b0(?HZe6K?)rqE-&1mivvPa_B=c3} zfGm60ZSxC7^yjMu+0Y<5LK>^utC^8c;P;fr9p^UnoahK?#VwK?j4ewhs?K z0vA;FDXrxR@B_G_8h~hk(S4+Abp_0PeGTYbnd1^zewG&%JvA>L=-z&uasAA;qXg?p z8H##Q&?|oRyVT(dWD5?g{5ZW5F{3^TOOJ1-WFX9wqU1Rc^D~ z`Ve5J4Eh;}w_lLw7$csW-Lm2%`hvoL9;J2Q>C|N!V69+XD5YsHsymJd3k$dI90|T= zRO8+4X4>!YCJe5jIMcZmOUl{TK_v;fwMn<%&~`W39-;r(M8aM+W}N$ zUq36WCPry@bY8Zz;F&AzWT172IGGvHE2^0~kD95qjM(CMsW;*;0QdAY@Irc`}(?6XjmBVWVE=7(a%n@rGrzM-TY8(Or`?0@0R!H^PghIGMs2D&vT0>Cnmm@zC?v|;)1a)`mK2I zpHMwi>&VPp!x#hS!@<`8npSG-FekOa<6_+VII*!4=yN3(FZZGE!^8m4t67=X@;~0# zM3G|MhSUONL4Z0p?SNe5Iad*aY)Xgqx9pF6#<-u@6Q`2(CqDW!~ z`uY4T*#=5U8OVQk%W0SN7a@fo9$(dpqV8q-MZ@&T^I|2Kq#r+}Q)-vYK> zwjI8Gx5t#?h@Cpm`V-Y&#s&=H7J#wlRR^i$@3W-PRbA)5o?=RPxaBUHQw!gcn#r=d zI_KX$FuOy$^?@#?(nS-TrDF>2GcU8E%RVObR;f#z>8n!9_fqAsOuaPT?q4@S+I)g8 zsjG{5_G}-9JX2L*?CWz36R~lFO-DQ2yApLkWMT3k`})&F`4c1a9bks>R|@I~`W71Q zL^El|=OS~jHE&r_RP^zj=o#d#pde*{fH<#tUn_XNWraQ`fOG(r{6~v@`9g&j4(0jF zu8=%G|KZaG?Tmz_n?W(s!0t^D>-)Su6-tVw7-|L;VulK5)7>%>R7ON)amvf{pX>e+dI$+ZpG&U+M9Rv z+__;EC!CjXf{H-gXJfry`$>5*1{4ZZepq!X)x1C{d3j-%miiQeUg$%3?YB8X7p4Ks zD{vLfIdvJY%~R7K(%g5qZ-nWnD-d_zu_R62t8=MQ4PwWluXgSq`ZTnCu;qvMuOe*2 zh{XwZrBb=hPa81wkb28_xOJ-v*gDP7CJAW#&dyGm_WNEW@Ddi4xpJDpu}~<0m;@2l zJb4dj5=)!+Jw<*9x8E1Rpw)Y#si}!Zn%mQ|xRtQo^GSO6*unjf{Nt90^=6= z=lYzKQo(-GwuCG-u`TcNOete#TKBxu-a6tG$j2F}7phI;vG`;w=`4LcaC+`8?W~BL%fb`fVhPv_o0$WEmJ4NoWW^=3|V|=QV42 zBA&|YE-T<_-g|rHc*tK<7yL%gMQbmpA$KW0*rs( zOU$%nt{^$&5P5^ywXHj}=G?xqiM)6-g-D7ac^c zo<0u>0)s3V)_B=@{^K>fM1I~Q;@a;8zV6p5AM@ZIJ0PtsGoMv+TGb$T?U~%dJ>%v} z)Htmca1_!Y&05{CEMll`*SZ{?ZR<#!Xm7V|N$a?nVRB#ajH78c;bP8E4;{NwzO!_# zaza}Rx$KY#Ca*E-s#2OXMYa7l`Jt18152nrg6~SnBMlb5=q@7JFw`CVpupd=2Cj5~ z3ZqGPpDB9VpyB7wzbA~ZlDg`0o8K+!1>8Fmp$Zxu)f~2YVN7A+B9un=^5Cv3jzO$* z<&a{EP@QH!I z?T+z?q|y8?$mf{qduj8#3&RcWUnC^}b#okM=d1_kp4sUa1%`w&v-6z%S#o^#%L8#gG|2 ztM@9uT|N_e4ZFq@;`4^^T!Ysl*$WJ^$3wop#z*>GdlJGdW&Q6`-OZ8@)Amm1q zz4#u*Ad~o72J<9_>`Phwl}xd$2bx6&ZGaSE8f`8u z0aRinJX_USYV$5{S#Ew;TVO0l$82*a5GZkYLG8OVLpoXaMpdwfuJ0Jpc+T1|kV<`bI_y4;7+g%L~fc+~ohM&R*Y|R{iRnPz#D5h$wI^ zSBv#)7P-ErtYeh;fL1H@hbWbY|;Y6kgo1vzvd-B}O6w`DyZvVUb$fi)_0>Xi_wh`XDg zLHou?s5Lms+B|1A68%DZcOo{zQ;#EM!u7LXG*A7I=va}stLTIb%G15mbTPJtC6ue& z@2`bk(z&lpanI!5d`roJxn1LMiS}xu3vbhgti{i&kM$vqo7$ZA5Jjb>I5~&h9>T)Urk2&!5_{*jqsR*@AAIva zV55e6nn5B2s{fIbS3$?@O+~G8ypBs`tnpU3Jyo|^@pBJ6Gr3&xGBVpXv_#KTy|~T7 zPVPlbwz#RD2`Rb9RX(nGCg25feSMw1j%n_Fd>*$(4#iq2t&SvLXJHusaanIFuPF$L z?33Dk>ORObX{%?F9Pb07Wt{4!0|{TKA10^(IqDps*$9)gQ^q{p5DBnSZ9Z_sBKy( z@X4{S&(rW|C3()_&p4N2FnMDom-ia^#d0VMo`n|7sT-XsrX%xi%RBAuG~k^#lh0Xc zx>V?c4jrXB+D{%G=qH0d6djdx_1sg)rP|wf2S@#q^2ldrwh!xc9kZ*P^{8{?yn&PY z(7L!)zO6-TYQ$z&%RDXwWe9j)p&de3AYE5raOT+B#>l*SaeigzgPv03U3d92uFg)( z^n8R?#%llkP`qSEU(GMwht1|d75wCj*}ZZ~Udo#f61W zM$R@iw*t#+Y8?F7=L7pB?#B3edX`Db%U_N$qzIKUY`;xP5?@f!G|ib}w9VoS8yKfh zYR)T=WZ?wPj!sUjWe>XAW@fUdDo^%KNu=G+v7GTv>EvB!re`0UL%rmW;(3GLV>IHF@sA4N)1((=0>cfm|e*31LR)GuGY z#0Px9&cmfstUIxuxM!QbOcUXjPS{MQHE*?>H)*i%Di%9%ufo%ODp?bjmt8T%@+jqM ziz_*q3HVm^z%TMnIpPnq;;(S~myQ%)W^Qj@c(d1zE9%*r_hH;NHZds^%2|kRc2Wjo zskkv3OemilZRI6*wQw-;_^CqNC$%Htq?R!&ZwOwyfD9Pu}N?r3vyeBRD8fTXA)(f{`qcWMk zWY38R|AIhIIV%!6x(ZdHl(M*&GWlLSAy^9+m1w}siDUIVVejtV%hRVyHa`N>oaSO zveL~DJ`peOCB_({rOAx+NVf9NjYbJ4wC3!z+;jYHm46<}7s{Bq?H(}ck!H)B8lIzH zFy@yO^Ju5DW^`ktf`B%zmPyQO4tlfw({o{HjBlvNuH}`&=n1Fr?DI~Ct3tY$$Tvs9jfX4fSb<0MyX!dFF z#zIl+R=M?F{caC9j!viF{mvKz%|zbxw!Xfsz!3#Krx0{lgOHyTR~^K=EVHLTikqk)hL0X$F^bWO^8oaC$B z+J#a8LaG=Yc!q$EgM9;O7!$rpr-$&^$lJ7vm%(flYTs{vHh29=xclP*5*nuNP#@YU zW#xUMZyME4=;HFY+WAVk{jXdyKOx*}h%G8qfzN3z`~GIatqU~EXKaUr(S3x*HQ-6X z(kRFylrlNplvlHFft2(M$GQ#z%|P_};P`mC@i=}7xwbR$MEsJem#n~RXI0KzEdCa6 zY;)E4nRc_>&2-}pK*0sd3JN1SV`u(qcqf<)DmSgIvz{|>Kt7!UamS&Em1_;kD3?y_ z@{0~*%Aro*@u7h^l(gLH zJW_$em`MH+_~bwEbfw7lbSnXm4Bac1RqWQ+#YC`4zeCDA1|ra^L+gcq#+lS}~L~R+JG+t1p$0u0X*&DaEd?6P!-Y}~*qYb$Z^<42j zJEcXK7Em5mEUN1YqcrX@9uEP_FRk_$U?FqP2C1Z<1c#|TkHM)=p0j=y7Aos0!$Mbb zDz~&y38ZwBPj=edR6}TW)no*^N9EjFjqI8yL?0*;fQ5MSbdT`oXZ7zS0d>QuGP>Y+}3f6u(^uC&dLuvG-Y6yiQc`Z^a0(Q@IPb z9=XmdYpaTS%IlSX}?xg7SzMP2ME|k3W_iDR9na-UW*4hLU zdwI{bG8QCIFW^zrsccu@Jy77OfSPU`AuLYG-*ztq79vOI_8%6rYw6?O^&nGRm1 zlp@9D&KtYj+rl?_VKGv!lKh~pD>J?UC0Cs4so4V&R_IXs@87u>uSBFC`a^IpWHE+B zd2gjFJrh$NgwQuIIx2bUE(D6y$p!K@)i(O*Y9s-851?yl&4v_Fl3Y+ws}<{)Xb6al zi9G{Kp*hh9+uu*abRT?{%{e9+dPhX*_LlBw7OHYT1KzUjy}qa7%}JKVN^$VbK~kaS zl_};}g@~y;ys>3%2;iZ+q&PuZUqWr>y=Ccmmz@S(GSiotfp!NIS=0Sb)u0_g$bby{ zoo~zuBXZ!`Q{2ptxzOI4pu!p_zR*v3b2Dpmu&il^bCKKq} zp_SEAdCsG1%FPuZ;%^N7n$kJMw&Hbw3mD=Bos)NSLuz`bN)G~E2HbRj2_{scF*M^W_ z=L+>#ig_YFr|&!z7gRrSfWDOOr0q}(I{F+h&zZ)6r28rD5Hl9iy#$<9$3$mKV_#|T zx`Js;#iy*KhBn>Ui~Mic`G_tT4oW#gIii|Pm_EAzQ~VR z50yGT)YF6F#epc<(Y#$O@+4)Qut?IUmqdKqcT?Hyl@WY7BoG%UU&VPc8j+W1T%LfEk=7jxr(t z{bba4`Q=4Lwgpuz9UGySVcDs-pVhBNUX-7@}_mRM4h8#;RDK22OR=dE`h4 zhPv%{)tINT7+c-Otj9~fi|lm6!Xl@Rr^YmV)ZpcbAysT%0|hbN)&TqUO5`{59}=3` zx54rMiKjDDmJ{fk^|yqd+?+AhsX@hi_K9_pnz7iVM+%%?6mzMGL;vvt6fn!+*6eRL z&hcZ1ZyRMc+ZE-4h8i${YjEx&yp19si=5lCLp6g%Ar9?11paN2g6hSJGbzQum^eSTq~1&Fiu_V!poI>o*}ZA?`R5P8(K zXP|OopgCNq^YRnqd{?mPY2!h!GdDA9aOn|ZRg_Kw4<*$*-Zkj3US;C|c1j4Yn}bAh zCPJQ z2t>EdDJCW+1YMeW1fLt|ybzON1i%Ukt7GMu9u!Gm2A_A$UQs~Z4~qx~hBN%PH<$&A z_1~o3;IJ=900pfRCC`UlyT|+y30-Z?AYXbIH&d-Yz=MK~Y@f_R;#t5L+b74NocITv ze|PEK{tN0twpTFAHvLTkq4Is=4VIge&XU65F@TGLx~twyCEFl>|I_qhyV@=WS7|m5 zj&H54FC317|IHU24XPG+yxK~b$=852v0z*lh`R&S83NI~dcT~x4fWITlOcHGYisEc z@e)vPKtE?1Uh`9u@VsKm@D3_TxpBG4Tns#|Edhzjk(PE)WeQULxX{@N9U#y#@(#4& zbxMTe4FfRn8FDItxCDVA1-=pB@8*uVOJAY)55)SbfVQZOtO+K*Ew4i1;vqOzcrRxt zaF!P>th`N{?V!Jl0C8M@lI?g1fFS|wY4q|3yVCg$M3ayZ)Z>;W5A$Z#QuHL9_lNP& zJ^i?u35sZeg}Xk2X7i`NF|g3;hS%=)++UE6yJH418GM`K^e^0>FvrVyk|cdW(z==X z4B{x1Nz|LEIm$l6>^^pouCNsDq}i?gHh91w`hmE){5jH|4_9t1OUr@}g?<`xI%n)H zX_8olapp|Gem#%zpN) zt6~A%k$T`gWoIX+)+u)Q8iV(BtjcQ&kvQ(4 z+4g2<;S)2nvpA(2yG!Q&{zfx6Pi)9QOqD-eqEja49$fBu!5q)99?1_)Z7E}(K0WN( z)jM)o5wcx!-}>w~9fjF$$XW`k_mQSO2uV{@9#J1=O*NUcboT7ig~T)49v_H(Eyb!v0D3Km zxA|1NPPz>Ac)PeD5CATrQPr(3>gE9|r#C^hk+`}t)SGF)9IkE$z973Wu_DY(y$+xp zm16K3SNHY1__JPp#Jw_QA#OjcqTbX(CwKWEJB8+^CL_$Hgtl8bJ#PDjmd8HJ>_Hj} zozf*$|DHJf3DdvtF_@zp9{>0m{QFHatP&l;Gsfd6=!=NA1it#&)vH=seDQfh#%-Rq z`|3$cUha?HMJw$~@l$yAk?F69lDn10%-6xI*aoH1a3|(h|DsFvO|*D(PXW8VT4TB~ zTZ{T88jX&!D-|e*uUMd(72afN@w|w3qX8Nv)LtY}19a~;%ACheQr5jom8K8M3xXQd zH$54({Jkl+Md{$0{>_})G9;cTK{KwP2|D1M%?>0$zUKWdAFk*Q)Ao7%-C>0j z9Oc^-uD(?V)(tk<`MW_mYiKAPp^p5493>SGOP=d!d^O=BGqRJOMJE@a4Mr`HxBg{o zR_33^0&1liHbfZ`^t60Hgo4ZoeQ(1BQ@xKF3+=#RG8~F0Z$q{nKDN?Z0&NWNq*7yA zpa--VbxIrhsH+Ov@RSm(6{UPnHR)EdoQkTfkBL4?2NbMlWS3+$d>15!o23S&FE7|8&_iz^xVMCO6h>BD#S>M( z4633{${pWoYiSwyF5l>?xo?1|UtAQ11}cszfwyg7bytw~RowtMSj$y3h~$m=mn)|8y)h}YX0RBl|;T&hA+7$ zw33dUBKz(nbL9BTM>9E=fRzopEj)I}^0PBDG%6tlIOiD<1xIgPPk+U3;&Td6UOyQW zeNbKEtNfr&fZQm|#l}YJJptqV6oNdE4=@|v+_?xP7^JB0hp)m-alaO>E#*+{Sl zl@AfgepSwo!21g~`kZJ5G#@-c0`1(-pNw>LbWbX@lyzp`1ZFfF)Xbb?wMM-!PinFP z7tP;g<_}%nN8pQOhE3epq{pqTtfp0HyPry=4Qox#t5P%)2MT*Ikxh8X^`XF`I8o3AXPU{ou=37onkCBs>u2V ztf85e58uq^$1r7jY(n6hN5Y&;YrGl2Y2<3`PLa2*k37OZ$u3hWpHiT+Jpb2k%QN&9 zUnl+-ac>?E^&Yp4Pp3^Mg_LA1L`6sE>wR6<`}+LJycGns z2!A6=(xt=-Sc*C|`Q5)K4jZU#$-M~#sl@Kz_ciC68mK&pj&2^DSs=&In2aBXhHX^) zIKBTYi-m=m0B_nC8&eG>SR4I<&t;p#{H^(>9doAh@Z{6?tl)lT#5|45)cT}IVqJX1 z_wNABmvEeXr?C{!y;MGpk~5jev)OSYpGi!eHKstj`<5GVU~(?Pyh(Hp6oN zwAUFr=YRP1!Yj~*f2`X_8@)5R@5^Kei~p#e!^!GSEW4T|hM1EoJRAjN^4N5>LVzeY@7Ikej} znBj*6PDv@*nD!1@lSEG>O7NQmnUdbDu#8k)8 z>Kd29^8}qxO3A-USKRCkuBYUb1wZeMRy%r`MsDvss@m)=VyW8kLKsV+7B{!KrCnTa zrzh~IuvXwKn-vx{#>!l@c91u%XK9!suC;y^L>OQ4UwHK zLDx)OeR-ijW>;{g4AD#5M<%S>O$B5STKphl7gW_>VQlCW)u z$JOm*5hBzJtxQwe(+ZLE(}jT^5+VL>KTd>3EZwyK<}U&el{D&@wBkR~Coh)K=Y#b3 z#e!=L{J+CwQyMA7tBcR~z(=cvSwV8-s6T8ay3Rs;9q%8^sdwxDC>iDFp+8BA7h=< zlQ1gr0|ZUl%?5&TY0F+**8O=*gPMEN$VXc0r}V(;iiFGXdQ&AfqTh$B0^Si=t!o5> zR2LJyJ5oJ)D{6m(`P{hu+HFRe%jJCOKt_pKHIfgv^_P+SlUH_0)$JHy z$uJDkb6nC=Tcx2MTbGeE&BCBT!&yNEQOAHbD<^35_+^XUg*Q~^ONSbTktqU(XiXE- z&TCtCQr?b@xzjOF_FePvFb*-5jtA`O<8!>0p>X>ps2T9a#x0<1L*JZQ7#I`MDO*8$ zg26uJRWlWi}&42X3)Ev~wFFcMXxw4v% zR$klsWEi`j_bKgVAZp{x{AZSRPjByO&_3ux)AJUQN4lQM9_<6p*b;DyV;M zgMQV?Ek|JDDgGFHL%lVf$Enc63EQ2XzidX$xF6#_4$aSDX8tySqM$L}&o1eVz~;(r zwEET*!Ox>E<|N=XDs4qmj)q+ngLQhc^OFjHoqkuUSJ{Q0yi;FRUB{#Cgac-(Cu@1q zta;6|!r$Dw+A@fu7$W<70mEh+!2k|X2HJH#;)IgT<_2367;po z-W7KHBRXN^&Rd(TE5EI5U6P$josV|@kT~c(*dJVbbv^`Tl$qRa*nUGxXk?dHPQ1Ot zl}2xolhKmuTO~ABPQ2tf(wWLE)reHIrYav#U`|XZPTuBwtkCOmPi8Wu7X-n77JaFcRO`$+9%il?KBfX4> zqW9%YIb%`Mte|tUw=I~x!Mzo~={jV7O5mD|skQ!PJ%g6#jpj6w#KPA1*Qg)qv*|}4 zoN`Atb0M<-#-2z$41RBgQU9|QXqI>)m!E0)3V@(tPebMBd#{r(s`n+jWJf=R$VNjU z{D{k#v&{0+)27>kVX>iO#mc~XsH&>QmI_4b4S0NT%9>Oo_y24*^yyd$@D2%yp2R$X z9c|yFb zxH7Rj-|Ga+`en*0?BE*fk0~%2?@-NCwjyf)D38tp2b6)nvr5$YeC8|1)_1U3W>vI& zhviKTRv@WOe$XEMPP^gzGo(?1kaRL^+nmlh-P2V+oKDMp8Qntea(~g~{#NmcAsz;8 zrn~zb`T4UWc;d)wsM@lQ!ur$q`7=S(8(3`&2GitctoItb^qi1-#RxZK`s_lrW6XGH zQXub(%CQ?>)_Bf^tqY!3jY5Uys%mesnN5SHfziucy3j>mZ0*TepQ6jgU9jG~l z1oJG3>x{ORYU z->0)2%*;n710+LYzm%P3jZ!Am@v=_u=V*b$vL@z?)O8woTVS=l`ys{Ul~-Nv&bqkp zxMjk~*<7lQR(dGY1926j!LcJE3LssLeE#Z!W`oT9?NMI83`WB^hEVU|rO16PH)4~+ zu78Q-8N|PT3_0-QpY|%&VgG+JQD=6m|C5P&`|%oPj$jONybaKl3oL})%fDKAz*WT<9v>$w3SP*g)JWW;ZvHIy>$yLYe zD422S$Xm3Xt-ZaIhFA;A%gf8#-#=_W7fke_1sDWnlKDT0@DLITaR)_zT~+nWt*@^S zfeGYUnV2{q!gI5k`^~zLRE*DYn+O(<9=xiQ{0E)&ZdyZ5AhM~c zBF9a5mgb={tTH_>QfRTg(Bd3{xv2GXeEe8CMbZtJA0StCsLH^oBHn!X5b@)C{`~3YHdRkgqR!(}NOr!U%7O((6+p~6$N@KtO8F|6^L{?w19L%GE z#o6)LokT~$@BWoG)ny?fRM z!y*2%Xeei=2t6L{GAs{QDX~@sX3TSE+J@))B|4Lki98?3;(Mz60{jDdX z?~gNTy>K%G&c{AGT|Vqn(O240o3r{}d;99#zWD?2zu{*=@*ul7My zj+-=RJdYKpH_QfqBH>RO7J(j2kP@L2zPqf8oceKyz=GpVBz5>|G8KX9tSDxwy65BL79dXG_rP+~men3+wbH$5ttr@R6*`7e<`!d#qDGQ3E;Yf zZaeJrE?CWF!d0d$VHsQHP1W z2};gi=-?5*OOXw~LF=F%HS1+QJW$@{Gu_95GobxLPFIQ%l!(}M3||P2f{wh2A5hNtq@0V zvfW{)sjb~eBRUMv0YNq*zN28?@Oiq(1kIaqf`u`_ zqz31f8L(eR@Ga5lHUJ1<(fx3(iV%FTqOvlc)jJz}BPDV4?dhcjn?t+dlc{=^M~pAR zr4pY0!=69B?F3bsFYHCtXJBcXymvES@>tZDRrYw~h>4?dS(MWqY`=ce*kl)4^#0pZ z_N$%D#6Z+zhjR^QRM<-HzOLGeideeI+6uO|1xUQemEcwpb6QMaoln0} zPFMP&9a3^qkoynj!r7DG{g4T6jK02t&IrMMyBCclJbCph>Z6LR1!A{O2185fFwg_B zPj7n1tEE#e9NNtrb^wwn$8Pe_yK!f$e&63cI=kr8ULA9^QExBvqX!OJHHwcyT2eBB;o3CGA zECt=V^{0REfskcQEv@%340BNNV4-=Q69GKqq|W{DO&5qC+`{S(0OwNKZ;#~#9HS@} zGdu#Y_IgRh!cO^JV8ZYCA<_i{_6A)N zbSsziaKo5}QRX87Apj41Jhm`qUjTf6a4=H1yOj1jxXVGA>J2ag{TcTj*i}dfHW&Cp zj7T@8J`=Tz_3T*M0LXA06zs9qRTXrSt}!M%x_P6SWKKr(_J_ZPEX@_gIkXgaNB6#R z3r7v0D+v7`N2U{YR-}w$Ub3a#YfhM);oT${)A*b+QcMV}7K7c}l4LjA`@s*{(9@H= z^yB1CK)2(S`D`dgLF^q0bSGDq9z0N}`EtY~v)zz&DxW{Uf$`xp=N@4~Llu~MS&~y5 zrOF$X$BI7r*`4);F}@mlu~D71Pi76PEoC)$m^#E;I4gLTC(-;4Q3>{eDVt_ zZt~H*JW9sTU4;~~rqx=2G$Rkgb9S);imtqwT~4T4m0R2BVuu#BVCbnt6Fii}VnBA0 zWJG+3yfe~zXtnQru+Eb|B0{xqcVt0guOhcMWY|%kOx27V=-1HDehz07$*@KFIG;5p zmwg~KDxVYXFXd^Uzi6;2;KGpv33PV!*fui3tAE8|5chS2ls&hxLQ3MXzNlMhUTK3j zgLH9TXuQ(Zt#05&#^A}D_`ao!w2$?`}vsMK(YMxyr+0$%D_KZjN^t!Kq(BpMAE&sq_4-{Wv<-cDE?R4tB$e#sHB0nMM9!4NaB=fU^F*mIVcQZ_ZHhr;v@Onp>T+mlHP5e_w~LT z{iUSnq*c+wIb9d0PR*4z0!Foigi0nnKl!~vt_4gt5kCx!<+?n}q4;q&Ea!^vMr(RY zAioeN+Ck6#C^<8>$-*7;lO)oplS_>-J|Z3d;eF?}$$DKsN*UoNP_!2a@#uOI0Fz^RB3t1$ zcKqb7d&<-VAEX@f+!b14H!3r+UGYi%&LRxz%ZZLHcw{m2`;0 zY_6)7qD-GJv~bX{gKtxEYlf2pY|T7){nO>psa)VFfEEYC_?@NkbAan#*VKf$SSiHe znPkMB>m~CNqcGT98rHVP zOwCG=%xjCUk(9{L<~QJ!#D-&jNWczUb&5rqH|Q#WP~R!)3WgOQmjz&0;jy;rHch>~ z3LozRk!Fdc5|{%kEB2lWi9B02&fCc+MOKB1ZQ1}&s_ak1?%VkYgj|-tdQqJ{1YqP{ z0$2enm?Ul-Hu726V!x2(AyEVBKe=)js|aS{#X<{k@a-=@43a(mP8O2kCj!HO@^-C4 zF@m+S%=##L9yYxy+EM-9hw$-?n6O?X&jyEv#=v+>7>A96pOz=;@r5}1^=Qkz95=3e zS6N#1K4^8IKUx}U26&_fMxCw9p0{4-6v*k2ZzO^?do^v+csD$JMTC1T7skjK>6&ug z=?W>wP5Xp)%{Y`9O%u~e&!aR8xpjC!yZsQH9ffzbQ@E)WHx@+o-VfJr>)Q3Z@$mao z=_uR$ucKD_$t94A^?i0xmXVM9F=u#N$b_nx+GS_ z=l4KdJH*3Q!2~*!bE&cEcC@Ifb39VCiUk~sPMo6pL4C(qFM#skyp%u3or+#h#kMQC90TdB&9^qG+yr+%Lg4jR zpvaY=pGY+U+6jgPKwfa*0Y96cFU$Stj9RltinOxHMnp2+aC%|E+J7vV0iz|34z`LW za%6)DIJ{Jr{Ngf0t5>H94ESMF#jmcXiVZ|wI}EhZ3{ zKBeb}E_X&5YUAIJjvj_}3(_013MMrgDhQE_i;GR)v)oehGG``B8v-+S4$c$TR=wCI z==o?WevF*d;GvH02KEyGXe@GX%k`3dkbQDh(Xfy{cZ`n(sCdI%KB}Q5@0-I9)xrWD z-lkuEc4h@K7s`#WyV(-GPi|~ z=1^puMa*$a`PR(dZ~usd0!zy^Wg+lKKyyU%U?t&a7qh@o5Ehr%n+JGNsRJ5@m7YK` z!R3a`f1r&LZl1Bm738mCY+}-r#!e`3pTSlQ(h{?l-)DDuEqOgyu+kifBcxY)EUuH% zP)Fdey*U3=)!b^1!_~>uF$Y`j?SIauS`l#Qo7L9+3zA-krs{NM+ z&*0=0PX~xmGsh{?GCeWa$W!5|l^#=-2&J%#5J&+LZZGR^ZpzSVP%(lo%Br`! z=cBbf`07on4Q*Iepf$|*L(kDrzfHSz=K>$m;UycHY<$bx`>rB4>;x8x& zQ?29#UX#hzZZ=0~Xvz5i5m*`jppNR!9B96j-v#53FYEy9d=l)vM4O^&Yq8kqD>?q3 zx>Q`P1c0xDHE$>Ys^e){F{`$`tl~y=Wq*_G@iFXeUth_je+y*yGG{9Y8u)Ql<^q+s zaigL3*8Hwl+{~SIywK`>0>ut2y&`AM=x^)Lx1%*cfjIR1)im}ci>CM_L2(Wswt3zI z^E{~-FE9mUo5#9oX=&+`Dj^}mme?_7Qn&~_P|?ppY=n4;B6mBJ?HqhmU^~{dq41`- z8=HtfGax8!H_csl$1P<_s4%C717wiS!&s14SOU z2>T-}6PtAQ8%XMf?2XiO!q*$hPjp&!qeW}RuOV>*KYkb!a^)jaO>>_cOZzy03IoKW z{9c?-qj$G|$R*f7lv@p5RidEG4+FY0Ej@kXDd*Ft8MBtrL`5KS8yBXgc9rxPhX`EQ zk#Xiw_fdgJ4*NEAra*G+QfCD`?Ih}z4f{Ea`3g^KI;7zXg3H0QuD@SYAo8JHXnxl_ z4;82z{zBV*yZA#rs`oS0xnaP6Gz9|2k5$Sk6b@}FHcj+BlJ~>gsY9z><+A%{Fz9-y z*c?8W+5WU$(Wp}yM#L=$NSP6NLW}4X80ZX7f%bQ(afo(acEZ)QwT%r85BsF^q8_u> ztKQfY1+;qEHJN5&i0Sk$w1QMwE!$ceRknvv$(@==$2EG{slo-WLAY z<3XCPKbw-HH}%T&PPvhM5Q&%T&MR92YBFOZpP6H7C(&Z$A;#S9a+ECKh1s#ewNT=4J5mdaDzH?YON z%D3vU+$?lY?Rs1otrE^xjdDv7*jHvJlhgv;zaBWcnn!#CmV+t)L)ogwn!Q(b!zm+!E5pIDc-mU5p45{=&B9LP(6~ zk_oB3YW_#Nu#Y5?V(hkz?5l>d4nV}#ok<0KxYxEQW>7* zmfe@>jv&f^eLERkkcq$Olu?4|+018M+p0A%LUt4sRxckT4``UFZ-pMqtUf0RGEG{# zoPW{e710F19N-G)-C@r!UBoHgN}By6{o?E!s&{mGEr^OhB4l zH44Oo+9e^uj7KQCHY!vX5jqtGnE3M@0uvMj1Rl8qunk2)#}C|t-y*Y(%mAFpCoM{b zO8it~xiRQpZYZA?4D-T88Ea6^Ks`}T-;DS~iVCb=DM$|jp#c{A9KFh8Ceul72DK7v zeu4H>q_%b_Q|>PTPf!&D0~fk`{@BaAX@j!KZKj9w%*4c9bJ`sOs^+hHq}#CNEJQ5=8M`i4FiCWjt(_ed%FW9!(U;_t zyn}-|fYb3UXO#q9V;zA(JzmgR`Ny}*g)#^1RV6f`!XBT6YLe4yemJxW-?hBK3|H0T zAx+n<+Sz%{D+TJ#UHX~r&Bu6MF4I4fT_jqwNJa8I&;bX8RWTllWDQDPkXBM79|B+o zUT{Kevti$_dZ0vWS zff94=iEu{ZhpLpEb&_sf^C;>NXec&8KTFi!-+O(q(Kg|d!Q?d9Mb;sDMNH|kbXQc< zBR~rpmh_sJwHR#2)X_FsZ?RYD@x6N1nh}EuEyEypSm+bGP@Sa%Z0WZ9SvRG4H7SEM zD{tK6Pyv=MY9oZ6+f$%W8a_|-HX6}Jxh201U8StH6br$KUDmG&nlE0O_*w@@QC>S_ z>GjgwWTx%R%JS{``N77R7C8E@#YJ2z=t{`q3<^aa|6Cov+KJK*T@mS_=f*&vNVJ(>ksB|m( z1F}g~pL_BE%e<9ACfmrTM-$0~)(TF^hbWLCF3B?2eAG#fDQ_r1@7A8x;#`BN;mAJy zqqh@P3cel2lLEPme_Dn++#F~$?L1f2-@w#6Pux36F=9y^tsTG|6kR-dB5JNecIxS+ znK`n1>f`d8Y|dvN3WV<&Q7Veop7ecAitn7gzGhs|3y;8ewkNMaopbZ^KYqv+7toj= zjD~^Vfz7A;C)i&fIEKTpO#aIQiQ_OfrTUqCIn+FngTFM)2)6?Q9)TuELzP)Wg^}ER zL#SRY84c zL8iUE{q-9E$KN+MdYjW@!<#08wJ)ZW?pxae3^{xq;I9K;mqQ%nZT5bi>zgp(t6^gC zRYsTV%r8d|{sH{oEsOm^zg2FZwD+=}Z_v`c@{?nyxvC(r9qteK1)x#~*bPyq2n^Y~ zrnc5$@#o6hw{Lrc4)QscgF+tGNGEZYr~@5V%mWe6?|AaFaf4_Q%8dTeBK-tUWmB)T z3br+%IVL*V{wNC_C;iCRPW564tm8l@KX^J$W)#FlTh=ld^VRdE{;|&(XqN4Ro=BF% zRFaf^u_%P~&p+17?{dN{ZT|wELq0yeaN$lM#piK3Zn47kfNPo-aHg&YMQP~c{kI%! zZJU1m{_wOE>oxFh2E1VXgSBIqmk+!>)O9hPe)Zu36P<_8do{;5D}<-IpwpoaArtCm zgMqhbaJsv=cpEzy2oxJ!eHcYi`9jBlhIHAg9YH1_i??W?gX$EYJn4P~POS|HhuRPm z6K&?o0RLZrk^mg-Gl4@@b&9U^y^eu73mKu<@Y0)N_RTpeFCHhgqWcTg9~iOY{p7)1 z0mcuHgqd@ONK=5Vd151IQPZ-G$>=OiRP9*h(kt+_8g6<>U`Al!jDYaYfDWxYxq}(_ zM@BTBGP|td0RA%1PUaQ!6>77XgC)*Vm#Vz)@bF^Dx0l?26A2CX-y*^szx@2U6F)MU zJLUgojh~H!2wLv>6WnJ)v<0~(YV+i!GdALp9THi#pT6aW0>NL)fJ7d>a(V-td6C6Q z-~d^$H5aJ^ZH7i^4}J^{>4sgAiJIcnIy@(;OQ#xTTubC+l}6(o1%2w}l3EHMT+GKc zeZ9p+RhH!U$$t3G-oXLd)(@I~&hC!ovata30O))$Zx6R1-4?gsLjdz3n|Y7rFU&bY z^em_&O3O>#zP%S=qQ?rnafo--ROP9J`PKPof4`??P4ORzj>415x}`?d_AzN|X0WsG zDIFdvlJgt!y+)bs;c0ZY156m#P*OLSw}gl`zMUOsSoX#bo>UU40dcm}$lETwyb@m>fxp6zx1|o+|WS4I)crBGo#H7cHb5w!NOUaoAY zf$$qV9NO{rnj`GL&mCTnpp%BZQgXN5LvV1~W}S(6pE>4~22YOLI})qB?e`!?C_4x! z8=s1*i$c&$Q0`#^_3-R+dX2-HA`rR|GTUm?6)Hq0VQsq=O^#2KYcC4BuBj3hz|qVH z;oZPl!J!3Rt-57Le$oPbeeZ))1hT^}B3r$_9!2(4`n|DV*s^+1>{3-3qYU-4WZj!` z#LaSzZ9L+(nitZ2MtqF~yrBp7x4cV%Ophg!K;&j|PhP$Y((7F0119+-7{(9pICk2y z(8BWFHz2R1c#MeL zQq^MnyJJEXW)8m_1g9x%M8?$m)fL97x>E7snf#vyokmqV^{T^{A5Z0Duc%5q^DEF5 z3=LY$y7m&*QBbL&B`_zFmGOez_MZg2!rWz%G>!f6~zG7$UtG}EN#bCm-__W(V zsO`-;Nl_8ahuus~W^n!-Qp~FPS*bQ(>;A+@q)D?wubN~%QO9ULvRua7wt?LSN}hjj zkwqRe+`r)4nSO@~Tl)(6SM+=r6QnjEIbblsWjG|1wJTk(`th}+&CmV&Klb|5?8-Zf zU(%{d$KyT7-PtT{R$vYxy>vY5W?R11^$Eu6^lEW|K8MtP4T1V{+Cg)F+QJ|=OV>K8 z9lTKLzwE`RIm)QMEwfr3x@w;@{jQ3yxd91S=W!MrA~Bkj(8BC#z%%@_@y}*4WcOgMvDJLEm;wb}X1JL1 z9HcRQ75*a0tY;$gxS7$HgEV84vaSi{5+r*e-U9GjE~x~txPG*kwbiCF&3by6HHCxI zLgpqM=UMdf`oOuRd0(fBhGGs{D;;dK?0+<;Rg+$d(h8d6onHYcc9W@sH)Br&-jkr` zvzB4AkVReN)PAjUjYsg%l*Md|kaIb^%gd636xAqkV@e^x&|`OQXlWOA4>POGs7T?0 zK#^(HXRXkcG|W+xBbG}+0;>wmufD0DtGqyom@7L{6FR9@L&Vq!pcDM%UHBAoUn&%N z6^WmSVfNm$UcJ{FJ-~9%R4raI*~L03AJU55W)$qTUVT7y4M&iXdi8^IAwsHo9BpTi z*^WSfQ4idAzae0}xR>=>EW%RtbX7rLrJkz^I)V0GRs%N^Mq|r_^5eLcVFUv7j@VM& zmEx+~IDug3g@J-q0t;ekEL*hkE-Y@JgFg=YOla_c4g^B&Qa@M^fBm|YX!Hy+VsuFy zPXax>-Ls4k*PP;CaHm$E1reH3F?6vrcjfjS_{R%iLjB7_Wdj1-&M;{Z_~;MNY4glL zq*8h8yG?K3_DRG0aCFXmki5gWPcwF?I>j$1ci!ppm((BX?lP(}d0BsKBR;ypLxq0C z>lLt8EuWzGW%=XvlBSRWtP!%!+ba4p@M0+Q&KMUfbsRs_zUu-Va$8~w^1Fx0zWPH3 zK~O+@W3h*)wNqP%iYz5}KniUO`u$+hlk-r6R@?KyRghimL~EiSSp2XlJ<(Fk!E3lu z|M=mhPq2|zjDs(8-wBD{CioBww$=gMoj#B-u%8Rynq=cek&!IFt_8DQUaMmjv3{DV zt=E-~=yVRk89zBbHDR^2J$R6MZV)~>;(T3#gmcf0!~=~ zI3S0tdDhqkrS_0=IJHXscEM1+&8S!;-#l*^Y%r{C;+f zIZw$6%MnY_gWyh$-5D{0oqEp#8c#`xCM<0}%O7=Dr2gYIuSc2Y}g%blkC;sAOZPkfff zGdU&@;w0IU4%JFRqZzfd3CmA8*TGpj3L4Lr_Do{r49?SV{He{qb`_@`hwcKv#Rb|9jF_j$HJ(EI`R#T)?nYZS89`2TCaU91r3&ZHTw(_bIA})&wqi}zO}n`8 zKaD`YX)-n5bV7f5CdURuNIAvVc!3chYsCFabOj#Yk7#4w1vW5EYySww3)56{pHsc6>o2ygce}V zo_c@*5O!)xY1i*IMA`<8u6ztj!cDmcY$1bgR*8KEOIN;=cY>GUWj>S`dWXUf#m+Tl z51s@WIsOID{;8lJbk! z8U%be?*!t34F24(4>lX+<=b!Gq69sGC>0a%n}ZK^gxnPQ7t3D~Wmzqdvuv`9_=L-d zHZgZ%r0joDo$ZhE!_KQqJTUq#_J$39#1VtVxfX9UAQmP{s128)wW1|6V&6BG0R8P}~-l)qMC@dcN0VTq2e zuGI2BE`G=czE*VQ6jd2y-}!1FmR6Z;q)20IIw-zSa~3!Nt%k*JYxH(bK|sj?Jthc^ zheI*?k_ccOp-Juyct63GNu3dOnn2*ytUFDO z2VP7WfiUp{LAhRHcq33SOcsI_mR(0i);rI}JX5Z_V}fiGXFqkF4`s|AAL;*}w!Jd% z)U^_S(Rh@fuYEjf%_-Ne@3cw1<;l-5$2TMttjY5@sJgXZBvMBB)oZ~72;UlkfNwY- zw39JAJOzYM-eau-dxl@(|rR0!?}8WI48sJGHJ}W$|lcq_RS|B?*c;s zR4Hu~%5VVG^I$jilnvQc2r^I9$va#1U*BdTJNeoVij#uOw7n6vIQE`jN#v+Cg`P za(23^(KzHLu-cD(s!ga$#PLNf zusc~ITNTh74RwDdlB%UwM(^!^GdeojJe#pme3cH37vA6@ps4}bRB+8IG3e7ZL4Eg9 zC?ZaQrmMCJR{&toXEj{X`?ZBy@8gK?KC#z_cSFReKPx;?qfhG`CXZ`J%p>G`>Vh_` zW`A_Ke^`?4|Cq;&RBYYP<%|h1SL^!gBga}xzzAh{I3*iyos;!DF1E{BK1p)X-)?W0 zJNn?J5IcOQ%jEe>U)+Y=*O!yAX~_SWe4W)5s$mlA#rM0gnXH(ZJcTbn*zr`)L{h<_;gLM9ZPK`&#hQwhVM zDtnjSM&hJb3V9iu;r+hug$C;!DqQ|C?9nmB!}a#hz>5iD88OXltm43!iKg_Jt2aJ5 zCt`IjW_6uFz?9Jrt=r;0c#8lzyJju{)ltQ>#PbqNZ)iSfQEnXcc7Fs^ZO@K-rwF0` z{#$5hAjhGvsh35vok@p&2?(G03oYs>C>?hEF&g?3JXGRE3xR7-vgCBifx4+mkm%Ir zKGVlw5oqQoKV0qbwlq$C zU@JX#{sgBT0|^JBO8H&vENNOKFEFGI7lO3}*yLt35ECh_*WK}UG(CtaW2i^p2i6b@ zN6>FG)HEpZjxCOY13(G*By$Z5tm@)bvQ>eLRDmuf*pB6)Nqy>h;@N|KNL)f7@9?%d z-hR)$_>r&h1f^Cu1Dd{i>!h)!Cs?Z-1>Y%hL+bpsKd>Em90;u}g zV8JjxEA2wf@L*_(Qk$x1BaA%#z7)=`|L$&H?N@0BJ$i7yVlBfD#mC0C3%i!UeONLLYQjIg~nfNRfEDo|$(vcWGEgp=St1OBI`x<9}wS78k0K*gcvk&`<; z=+SAQI&Y0_%P};trRu3e``qNxPiXBq>WvS##CHw~h2Gk;>22@J2c@-pz%Hwjy5UW4 z`xH2IpvETz5%IKs&w%V57T{Pr6Z66O9t1%r+`JR$>5LsdTbjSR7`mzeN*=Uz2!^Rw zZ;1hKkj=~zMAB@IJ6Sp@D;maE`sq74@&-A!nlKjMvw^84A{1Ow%atoF1{LB9Y!`rHkF^D?<%u>S{)5eIC z8e2d$dBuJPRkFqxAWbp z{Y*_W&CL@{Lt_IYJ|tZ-Vy}v1Y*f%6?^20NbOrG0s(!AbW2_QJV|&omat9fJA2-!^ zrAnE&4`cC9OcC7yhf2UH)xcsM1u5%C7Nfr(MpX5j?rkfLS&`l{`wqgz(s(S8bib z#=q-pSGrr}xb7Kel9_<({sU1kUG}2cieBgItO>`s*$&8Vabx>H z%?l1Q1g5*J!CR!1&Z@sAPKjialf^Wo5*(@XH9Oc{$)>sYAtCBDp1_3O5co@wRxNww zlEiL%k^7~Cdl=FzWa>;gCxU{H3HCaUNFVuJQw$@NN16H}5fU}2F>b|k3=}0vmP^0c z8G`KMxpk?_h``iGqO3x`-2f_Q+v5Q`bjX9Rb>1^5+uTZh3f7eOgWgg{kD2caZM-7N zK4#+UqC35`Bm!$>w17*68`Hni2fFp$I@OM9*iw~Yb+;mchv7Be#Yz@Sq%oDo*QAmx z|C8Orc|9J4&ftz4S6-YyMWoe1R7-EVl(pq51!5>+8-zk>D8LQ7vcS&wxIISM3G)Jg zCv;XDY7LA+iGaNy49zN_?tnXR$~3?_5L$d86d{6z5ngxyM1MEUr5dKd3JxWI*uI-7 zTkL4%pUu*8+=|bD#}8VX%8lUWspYym4(* zjD2VOu!)NaXX~vYP?Pjc)L9xL+*@Lis?ZUCBYAF~r$Eed|NIg!@tKrpWLE8-$?z0t zlv}(&+)N!+X1{$1&NY4M-}+}jwUb_O{N<%5-$BOYR=yNV<0)U6UWLz zb-7kuMFG7-`;|W;>yz2ycf0}3;_7~_MLzKSj)Sn zjr<4D%wY%qZs7k9SRBR*^dgtH=}W9>H|3w(NGw+r9GY6nGZ*g#Px)oDNDV#0sW4IN zArSE7zniDqANy2rL*)QKi~&;0>U<3k0^CHm?Dld5-tK&QxFUN$7o68M?C%~3A_WPW zpX2Z&SlM~Nxm@@5$KgL&0`=u4brd}Ey{_w$4HU}j4V>V?Ev^HR47@MkZiRjcF#Xe? zG+u)Z8Tt+5@K*qAK#LRLS_I%YU{B0Jh};S#mn03?P@se&vS?7FpUN3rv-(PjLplJR zrBB)p?G8S`IRw`SaQZn8aUui$NB2I!+x6a%0$F4mxLoo^!I9m5qjU;R$108w_3_y? znnou@0S`@!gd>sW7TB_KE$?8lG&M7G!K3J=K{3J9^_O2Odzy7&BY%m71`)}$_h>s{ zmCg{-J2%9@KuC1?5IZ9U?aYIdf(StIKxiYbo)j5?K$jCsf4|5&zk!lMj!e$Bl)xd$ zn0Qqn0Kfk;zKw7L7uPrR<{?N+ zsJ1sV9l8!(<0vQ(j|oLxO_An|%vk@HVnBrOH*j^wl0QQQ2}lbbvO(kFSY%a~`w1Y8 z^}89RX+TknFaKxl4&h3`w!rq8c0L-0its-IM7u&BV|?(}uU~6q%dc1K1-ZlHIni0j zT~pg23bSPV@xPvXOKU&*|J$8coTvT2=PA7Q|GlrdHZwV2@BcFvWM+pk^?_T;pD1&M} zB!!tM7&fKOm<30H!@+Bdz^>O77nHYcS%10Z7fNX8gKY#YwX#1tX#C_(D5MjftpAd4 zd6e{f4CNh%Tq|q}82cWiQE$&7_v)G!a@;scoa_FfaXM?JxhX)S8g{r*oqKL6u@nd= zi_*V#u+^UU2(mw{@KRjAakfu2F^h4sJfv~RD=4@uhX?kQqJps2YJ+Gvr~=wIoN>@E z(BKsNnj_?M7DVk8f4jEn0X7-w}ozr+xdUBXM8m-+vy!Ae*bR3~bNTbAfE}l1Tcy zj8Eu$mDfwQLH#xAXHLDTECgJ}0ouNXISJ<{TiFU@%tD}+iDIBXyekW(jW5{WE_zH^5tScD22=2wHWw~j*rC!> z$;VFGsjH_qS|7oW);gsq6t&~ss`_|U=7miCE;akw!~jNcdE0Gko5e@sAvacL;bA-6 zUur)V+q1_7pQm_x#sho%c1flN0)DO(2?q|*L8@ja)h_A5$OVO$cs$Nl-HF~A?iUnP z#l7WB=0)089XkSq-iXBKJ26%aa(r{`dj$MMcV*g_C@6l^)zvjxysF#6swbFO>7Gd2_a*1Dsd!rU1KY?6?Q&ZW z+e=d|Eu82YjGYW0w@}sXLPcC8;pbIuZY6-4+NUN=OiXC`?Tn-K4jec@MTov-{rQ|0 zcB8zVr&l_AWQ#<^U7ku|c!F1>-`<=MiPWN&Bl-)>y{~<2ysExd$aqbQ?kBO@`_7#^ zjo-dKcH`f<(RGf4vyAS4pLj*LRgmOtWan}=caDokS|x2+C)XNR2XkLC;5XogFKW3jP{!s-u!cK ziP@QtNZ?05qNWv7Wh&>K;Q!r&l`h1t&2ClQ@S);*;lt_M48m*uwvdHJHRxOKfTP^$ z90NxTgU9bLZ}$?ZtF$neFf-W9F`ZENVYHSK}1%I?iK!miHr+Vk3BXLKxHLTTi#bVcH_W938{KEqtm zL)&Fm=8t2)wRb{7LUXGx&MkXuWX)lIaA3IdBezM1^Z*U&P!0c2Sf4@3zG;@=VQ^4a zqF-X{l+BA$=y!fB;J7QW^Mi^{8#VgDGbFE(XLjdTo*x``{?0lT|Ie4%9~kdEW{u=g z!Y=etuENWIzjEUL%2$+HL%I25-ggYz@7%a;){lBI^T0au)_=4BOSZmuUG!LXqmMm{ zI)8fJ?i~4V>B;|{=lP#j;644f&6fWkkFHgxnVFf!<`|Kf2?eLs%k*KK;uNP$rgmfO zEd2fbX>aI1%r{q1R1ArU$$5L6WxD1$#p24!Y}_=O_&@yGsNG6l#ciQPNBo;&nRp0)$fDzkg4i zj@G%c6c`-sy9x?{{){3yKv*_GqGaHSBS+%kJOT6GyjRGGdCI(n@#$pc;82DG!6YRm zm6Vl}o5Hw=pxCFqZIg667k`kNS_RyKkf5MTfGQkPJ`8R5p952vX*<<%*#N3;u&{_j z1zEPMSCya**o%F9eaE0zRc;%NkFTW}wZ`P-=PSYy1W+c9cDA*?UW_>?-D@5hCSxIJ z$G6OGDzKxo^Rfg8z(}K&LPBV{jpe)tjzd#zD*I^wm5^+eO>qUWZ~^i+p&oWsFN$cG~UwL7Jskr zj|?>D>3aLJxGe=e{eAn*?({)dWZ;XwNvBEcO$D7;VU$}Qw zn-+a39eqhsT|HdKb>YF@J$tTPym&WJ%rDPQ0zMTDyJJjgrHJO5gaVxF*(pu< zq~~3=xhU20@%lY*?_3hi8=IO!K7RaJ8-k|r00k@~3UG{k-oBLwN3hU!-RA7!*J6F) zk5Z^}&_tZnfww;Wvk)7$MV|M-_GGC?+_FwcZbDa=@xbJgP>_-FfBN*PJ{Fsa)&PKO z9hZ07W{9Wv1YjNqYpEsbwqg*AY?0k~*K#ncqeDSxdvj?K>ay>Q z9wrAyuPnWwfZLoj=h-4TakR0J?V<61QcqMzIcYYb+t(8_F|DlCPiIiPR^0N>xTF!wKO^rd5n^ zoW`PKAsn9K#baacv+j1l!SUMACFt;DKebM3yF20aO^dngoe4h0++02`RI+arMwR`C!U#Pr6$5VVO{ikv|^jr4gEh^bwN7kN0I%sM#YFL zaR`nC!Nf&h>wssl@K@#LB)bW%&*U$zt*OpT>vIfR>%1*JS;mrETslB7nIky&r+pRp z(KOVp)8610$TZ~c5NNvF+|{u3^F9HrTmRk=C9U=sv$yTV+Ob|+(f6WS8aB0O3+F`R zcWceAJW}&mT6pY8nH@dODFGQ1cixurTpEOt({PN-{qe?0>hp3;@C|4p{U&LsA$~mn zo7)m)6TDKUaPj`uQ%Y>`s$^VLjrxc>XsYC%xGT{16{>)zRcJY{_8P&_zIwt8!=^ax z@2Ba6SZca;cIB*URI=zoSJB-9PsFO{pL;!mMzoqIOiLndV^(THrH#RmZyp3AHy^A=y@{Q((K~_nE z(Pt9&i>NohV(aPoTbAy#;kjEkRJ7WAUr3rqk0irfvMY+q`#~%u7Y18*UvoO^tmD|# z-_*ABnqk6F%}K-8F$%Bk{)6AX>a!rhBl{1P2`zETIEI<4yBYISW1eCk+`lH`I=r5v zv9616WnzW1uj?fQJCxmR+6uzP)a#V@_V?V@IXLuQ#mM<@;idj6@=PwV*4{ z^Yd$f$=ieCoVZBnfJzQ;?vffG`sW7v=M3ZaU&`mmZJMm#KkFGnY7p6qfAM1XKW+HI zuEh>fY4+x(YtKJ7JQq)&d!xO*ef+2cl)9G+L%pbZ0hgXEb&wR?X$f4k++*8+8$^O* zV`U$sDg3yn6AbEm;lINaA;H0u>8UXncUrp!+taDlx$=3*W0615vl)A~QLB9mVOL%5 z(X>nliG9RPBmaN)j>oUyCVREY>?ABJS3(7agifA4Yx0kkS7U`0QVTxL3S7l{?V8+8 z!{*$7OnKHB7$8yb-kgcq#V2TKGr*o}{Idb5_=9zRzr1W$x%5NeAPo(E^m`D8HriP| zWuO~&p0Jl!Zf|Y)ynELLXJ%Rab1%DNF#6GGH+ET_X;+jLN`6xJ`rj=jdVf5)$Z>^5&>UsZDZn z)ASL@Ea-{d-ZUc57>RTim~>wK_j&xM7K|0e0~nOS=Yx=&Ndn$rp#D}VJB00#)QrMe z;4+v_w#EOmIfZy@Zh-X_m?XR2~Zg(25D z&i8ylVvAja{A#Q4#-mT4K1J|gLzy3a{C5MkyZ+LlAiQ3z*VfjSXm;1JRcOr^1~2pq zPTIiGkd2vH4ARV z+jI4mx3^~5IbRqq6KhRIMn?KuR-#o^RkLbG;rg~hgc@|N(9+93Y@a+|?Vm;&t#tqX zO9%zH?WdI_6x7r{-i~^3|Ng_kr+RuED!Q8Anwk_JJ$jdsnYjWkJQn=iP|okaA;v+T zJh=PZeVjZz%HY@SaYRpic4witn}VT4J~X(}g&wV{Fd?ZYML zKHiH)I1L1UQeoZZNBY5HcoHuaBud+b#>Iq%8BtGncX!kBSwy)nMGjrtTjj-F^yPCy zgSYk=`X=)cLi-rJrEo82Sf2HMbg5}+SJpQ+G|LJsj5<@KrK>_ATs_II(!c!f2s~IE z`^AF9d&sYT`}S>PYik(DzBV^E31j>KmqG~D-JU3Z5`qHjk$P4^L9GiHF3j2panA$B zrtI$S9)x2Qd?rWi$;Jj@?YrjBK!a^Z_s>pV11#}h-M>|^uuD4>HK z;uB{XooVLKb!e|90tV`WKfM4m#KQbfBm)h9M5Tkdnk?$GP=v5k8RAiB@8s#znMq0a zzkdCCgVxW!N>EU66pov^eWY()l7Tsv1qhA97ip%xLU>&^u23(ZDVn)DbO^f zXvj<#43)*AquEqPav2;y=)5xBoxzV@lE0X-xc9e~7IT~B^0c&v5ch`p`S~$@hY+=> zsA#%9(c8@2ygT1Wb}0-_Fj!n#3W<%y0l;ZL$`N;*d;|Ee zzNc5dT?*hPX+Zn{aokT=^m3!A<12kL-5f~poDfagDY^xRh8C4U2@;xUL8rXh1-Nt5 z<7>t(5j=T?h20RRD9g*o1BuC>IP>7a19;@dmX;9c0&GM)#%<@JV1+T*jYUwIw#IDo zI~EjT@r__CaTSY_nWVS={ynhcXTaN8N!cK+_E|=5(nH=tU}~ySrYSO`SDy!WzWQ2U zKV4i+&Q6N>qeC}rsbXhW0Q2HgBtgjx@K4g_QY#F4YHseer3HvJ)e-u>kNVut-&F?> z9t;i&N`!M>qJ>;kD5=l2!D}C#pU1`D^M;u#yS24tCX8?4UK4}RpFXum-L{1@Hxnye)=X zyv#x0?JC6@jw^8UzcHeBJOx&?Gxtdy;c6~EgK93&f~`bXQ&&eP#?{TOkK+-Pd!Fsh z7hhjrhtNL^@)6Lw1++v=tM5Hb46%1-;sHfcSvd|)ia4X2651)jnEaeB;TMv1`sgaHmR1aK+IWzh5 zlO94Gz-K!Nt^+J|lje`tXEi9Ure1PyfI;;17d4)L!KqbpUV=247*GIcm_zC7c4M*6`H((`SCtYnYC-tZMJc*5t7o7DX6>yStze`jTh^ zcyNAyzstHO#BPqV5Q;5h2i?}R;dPlb2D9#j=q4&Guz3Otl0BVRP*C8Pfvzh%1s>Zw z5Prcwt|wggsJS0_uMZ?(PR4y|-iOFI?U2}dLJz(#YDfgy))@Yy}YQT+RzuSW^b>A0VK z-ov3=rFHh~S&d?g=o>d~T-81XEqHSJv{_sa(OAYSN;b|-+V+v0LrCP;oor^amv3-Q z<2|H}-9+etp= zibjtV@1^NF6hM*;+$t53igYkY*JY$6Z#ju%ldJRnqBM)QA9zTIVm(~wCD?i{ISwVf zSo-QCWc@3`9s7B4p`b&Il&{fCHH)m;y_+pus z>Y?`;6XP^NQjt}7dLwuhq*jluL@*zwFx9~w^xRvy+#w|?AyFD{n<5jPk(QR`kg*@U zw0(XC^FR0sdN2PZwj|f#4wUnV>ypLG#%1WT`@B`LD=w^(jiI|Km8a#NzTK)0Yly5f z)0^l~)luj07}|2S&P#RwbX}rVP*A11Y9zs(EFW?3a_Kh}F0$$0?jD}!rPo|NwQ_oX z5eH-~Iahe9b#&CTvvvm+RSN1zUhO)*-Pl#B+J~>UP@JW$uI6>s*!te29U zT-^5{7R@py%&9zsrc-0%M&WJk)kYEG2Tn*fMkBIYrW)5Zbl|9SV{ptv-upcyKI7>EXa&wX|@?o_Bk0^DkF8 zS11_SHm*EM^6=U+e5G5t^=5FoII|&uT#%-%xQ73&Ieh|9wgUa{$12wbUD&Q%k%ObO zV8T4U01ihd*fPy7-YZuonRDclC-_oK2FdqMTGeIRXxPrR7|%H?Yb-o@eX51Qrt@aD z&NjEUOEsTlAVXQ*J(2CV#BSA$6$QHp8GW6=AUB%IGdu}ibEkn;x@TN`(SNmw)OmA+ zxVJar=z_;wYsYa9{&>|G#_m4>5zW4&uk}nJp{kLo`MRo4<3rum(^|L!!aBQI=Vr4P zHi*uUM%YqI2EVOqBtV1{tdLZgfi-W_v6i7$T7x!-!dr@TD@H1c82H#mUSS@%zfb?t ze=u5WCKaOkz$CyKim{a#exGQa2%*t&SrOfow~4L=!@}vSbva}HVs!Lvy1DqimP zxf1$!7lxnfZh3cZNNul*chKU=TWMRg_EWV210jFwzKV$#k9A9V=nAh!P=s)lCHU6r z$iVn#oYPbGoi1^j?Z(-o-PwbT_m~Qj6>dkNPfN6bYE>0SENgqO7F{mg@%1|?IUOvFS<*r|F?4 znd<2IMEsD9p!9$G&Yc3-^)e&IZeqkn~4ckgN&B#p|E9sE{^tfd0P2JQRK#-6{XV|gcx)P$Q-Odr?R$%|*h@1N@ z*^$>9#>A)#jo+*7R;q`JG>(p?W=p*&w3moG)=Jy5t?fbXJm*9+oejTiVLTVCsx9x( z9ul#7v!ZZ9?M~u0qj8S*$eN>HellBD?uX*Yqz*Ritg@`3%IKtTsxl_M6**bWpuye`2GngFzl`zsM#x&1i`hz7rdgp5VgF2*BJ;^n2~LZ^ zAE(%DTwXJM|6bM5J)$hxl-*Xb;mtcaUmL4cSyi1+a_b#waM$R{N#7_Z)%8B*5Ku}A z5n;?C?3H-+RaxVvh#Y5z`dZa&4}KN4-lWGsah^oa-K14 zi#^6w;{viNn`M`hcdb7AcuQAbD58Fh^uLX`U;wwLXOoQSF z#eXZ{|3vU2vVU$TcsmQMwEYU+y|;wtoV5Eeuj*yPU>^Q54o9QP^2dL9C^Nc_ak|Zz ziWRnovZfZSMvW6ooTQgssvb@Fk`GD&pp|5!_b znRG?SdK^+{^cuw?ga#h{jIoTy&rnY`eo%;UO7W&H7$H^JI|V^7=2q2URwbvK9}^%1%{C z9vYHS7-b)lT3uBYPbbE@9N&x%`JkDOrI$i=6F! zu*-TRhnUWPkHB`jclQTHZ!IhGRsL~r`Q)o=7EVh8@q`&jHKv^X{8^HW?T!RU?ILva zSypp^j2$d8z9X6YyNi9^MRB?Uhlui?2JN=I?a{`P48!^7SjIY)?Ltz30Ub;_#of+4 z`)3eZ4BS8lN1R6K_=5maGX~GZ$Iq|wmu+jbKq~OdZ0FApr~Ck* zFdx7IjJ;It8%ibBIlV!!n5w@u-T5?!AIQ z;Yokmra{1e)t-AZI6u7SP2EjrSrHFTE&!`>^h&C#z~nY`7{D!MUPBXaDH)!Lf+M-d zG0vB?wJ{I#)p+U#xZy0oXlCu-p}%Vi5svFL{G1YqWl<~2EG6KZg-Mf_D%Zy&Nz0wG z$_ffQNSo+sF}SF0d8+fkoaaeGscq`kYH{^<2zo!iJU{|ab{Vi>c~(}|P);iF_vBwX z)JRIl3TwmtodLD52dWu*Y3BlrE@>vebs3t*f)jS|z=8I8k8Kx3ATqiwe@Jcuh*%rc z4!KWh1pjzCsXDz7Xxjp;O<6@H<@4vefJ+cTuO=rc=@S?fWItT9YXGp?vawLj>8Rrn z5&$j;h^ShMF}Q8XD+PADFcExiBs;go?<~$EethV*P2azN2MRITr`=fT$&+}9hT)kL z0t1hQgob7m6o8sb9*|eWX#X)fjsF`kLTCT&R);9z+O)k^l|Z;k6xkoc(kv zou|;zwf6S2!{w;+^nfAnG40MUz zkPWRWDS5D#e&92p9U+jCl9a@RkSKL^_37@+u!@R`Q8-U~3tv~4SZ7N5I})%0sCY(R zo`T!PYIiWJ;)zqI90rz9&jckr2f05}@^$1v9*!p0#(XuOw;j~22HM>iMgcag;P9YInwQK zo>LR}8#3GRwo+V?Ue14CbAw?_2=eU(|Iu?5F+ZgcJ5LX7Zx!DzS&A}N3j$0Bp$gD< zMQ7(SKqBk_d;jRgqA|x;z3vC0oaxs3aIF`tdn0fBC(EtJOKb5u{=j_xe1wIirU89F zR08zJ*zj;1UdKgRR(L&W9~G_sRA5^RQn~=$(pl?8X<%uI)7|`in)asQyX2<45-P6%l1&l4?vGs)L3q=Yaxt(+VR$}_mEVO$@j&Wu#4$Ln%cuq3W zxHe!w^3)B3OI0ehXY{AyCc#diRLJ`vK%B zgd~X01ztO%@8%c-7;A8TIDdmZ3$3iIyj=p?p1&lPUFI{en&q{$qI`UOVCJSEKy9B_ zZ3omHh>AMrwz<$CT?OZOXTjSpZYq>w%Xye_;0riE2KiUp&-o)K5TXfNE1ZZ>Ra{ot zo%cG7j(6bg`|UFWjvcMheAv7$pH?zmiE)+aXwR}at4h@g8#<}4_`$gQsrg&2!7d-Sj6)cvG#hW;YVIBRQb7~dcq4#zAVk@Wuk5eUKT0j@cD?wr{t;+pm3 zlNiF>yeXFlp3!k^?Z&c_%^icF3E`XZ9?`LvM80+XNa_%y*nrys+n=zv&lV_ondlL0 zYAF_c+NC$;OtTWKiV|N#_%AKNo9OSC-i>M7i^jHpdfCM7}R?ad} zcU!}&i4_^@xExRa()l*{yPx^7gV=5vw`vEr za;7DvH4W?>eHx6HetwprkrUTF*$3bwf?K?#u?B4WSS7#uS*|_CvXbi2Q_GIj);al7 zLSU)G|ADC57haz5qkc-DZ95wcHB!O<2#k%5HEfA6n6ha*fEFWAh99D%qvtA?emL}9 zp%Q_es-rQ4{p87$-TINh+#(Pb_yKygv%ss!f}sR|mr4str$So_%E}=O9-Gzx;H#H0 z+3ohGrdI&36~N1606Vaw-#&m7+_(SWL4~JJf7|!@ow*L$7mVm>unlFU=6yv|puly8 zX*~ufmrvO|PNt^kPXaF&_D%^ydjQJI0=9S3kXa@w4S8mOY5?A>3T#`l)QeZz0(tJ+ z_b4Kq=KoeoCRAtk2OZ zO=yYaL(V~4mU=!ngfH+ussF&PW4bmsU}I<31&r+hBDAgY0z|*lK%jb$H-{&Jf}99S zn{N1G4p>*sva1C_*gBHi+JLwk%+AR@XG|#1OR%xBB1BUeJUI1y!>LeB3wT81O9(uN z+0vCN%Q#?<*GA)lVgLG2z>|4ps#AQMJhYvStKQP^0Ew2}eC677jLY07JM|I?U_}u6 zxjNg&0(*^`7ZBRvF~yA2+6;Cxcw z&!6AGo4NP;ut`xYFlHfPVaNOXKPDHD)&1IHZ(B|QG^6X=gho`CO$2tts; zC9*1}ToDxP-;DU*u)5*KKhr6JNvyw*09?WepdY|x1HK56Jh1N%uD-id59-)vGhFHxOH?lB1OlF3+)k%?tnA!~v-W%R$DEUZAJL0OnI1 zJt#Q~-oV0%ab1*fgXu&1?aNgFxGUY99*8yr?^{(LP|eY52Psu5ylHk;R*5H1o@kU< zJqg-?O&6>Ida?`f5n?LrH~(4#Q~n6L%*?RfGC5Lp8&3uV)fszTp%N0gL>tLt(QyqxGr3{ z^RIgVNe$Uxsgd7{HWCD)$9W;ypHE_9qRz8ld;g^|Nw9hThfV;8O*%&0YFi$-sej!c zkmof4s{(W)X<*)+1&CFtFqpNNL!f~(J`TwOAXij|ult|7oxoM~_bw8tl~|8}O7yaX z^Y6DTv{4fyBZ-ikW^uAVGb5w#Hk zKa3ngAT;6Nq)6aIEv8EsTS~2dy*PO2P)KyNHcOHKKR$0eZs*o-Q11YbkGx%gN~hx)K63*l!gecxg1|M)3;}ju2jOd#?z)k-mNX z`hbCf0ibRLAedmub-^ZDQr4e5fr7sbR1D-EKG#veaazzh6G z3EZ;13LSJKEu*~%B9Y+8$V_l^_$K>+Dg>6*d9HLq-^hqX0^o%*n=v1V>oYPkAa2T@ zo;F4N6TD0ns3&OvPX%Uj$^JDpJsSi)OJUjB<_(p1pevI_Fhp5_&=rUUnp?eaxRMez zFl}W}dK}ua1E~q~Mg}}Cc%WmWqfC(94*LLV8xe`yn*U0kAqs;Rpa|Yjbejb?t^LC9 z2TQ6zXLUmb@zpXnxRK~FFo-PZ-~92tKYqwqRxG>*mx&2=2TqiI2AW{q>a7)=W!iRL zULJqvsIQL?;s+oH=gw(PEx9{)o#PSy@>pXXglf9^K*Byyddcww)!CYk%e_ z?oSYyE4hcOT#bPFcTs}hX7mk&sw-WJvIABgP^SS51Waz1AakJ9Vdj_*zMO-d3DN8@ zyNEBJK@JoZEq7Wizbmvl>m^8$wExkDzdEwq!EZzxjhDKnmA?^ki;7CXr7z~0Ep0&v{vi8EL8YxMjtMH z0_Pt_8)A0}Fb^tVAES@7>ivQX+RlIi*A4>#upfgEq2iMcXwGhbnFop$q!ZA%63~JW zD}0nhieSW*72%*vGb77>maSq}AEXf4IQR+*~J(J=(cRWY6Cf;^q|RrKo|e=z;ST;nRkpUkXfF*0EM)%ft|?K!D?%05X8Fe z7)R>;I>E38fA|nzQgVyD5a59Z=kw>!Y8#+kX?ulCr=*ip>9OO-Ikd%!!LP~&Vh?H3 zQD_9aU!m=U4Dg%m+}vFqNP!X;@?Rmc_qyU;6d2=VQ0$n(VnXP|=ej!kjoD&ETmjfA z3a}C6Fik%FH;iI~t!86&_GUl@Y~oElJv}>(4(|g^D@I!j;%BtsLdcBmNRohv^gS%@ zovmI}=p76N-{`~yi-?E_QeE-#s(AdZV{8uiaH#^uN{vs9uq!U|dvkLaBm~+oj!GZ~ z91QAoZ&0fhbo^@erx|HuN>2-)KZEXwt_Gvt-*y{h7s^UXN&?F8X80)}a|6?iT!5c? z0jz*!Kso%Jo8~cp2KkX7&cY%GNfi=SVT=RqDB>$6TP+`T0;tVaGb@&fZ7JnTEF~(N zeDyx7!R_)!%c5u_|Eo`b%ms-up4{q~*l|_~5$ z3sY=bc_KQ+i?w5q;-@Np7m0a}1EE0~E2#mUAyE^AJB$kOu8}pH-aqs{1=Q6*2DA?s zLR50n_H!D@vnN4Nil5Caa?7qKyO6T^9S1-M76&*V$EVDf=~5r|X{Mv$Wi}M?m-KbXrP_ z3V(2tP#}MpA=!5^jd`Wo0%Nszg`g{NP)VBimIcKjWY@j2e2BHW%9)+@qxBL#wC|aT7s>KZUvak68 zML*6aw9-tN^jk5SN8h}Edp%6)ibNhzgCgeI$Fj1ec85IcdA9OQntssB8A}X&yhKSk zrmPyQZI_%vK5RLATjjBZ?sl1UA$DeKOIhv$BOm3`I!y`x6(QVR_-nE}SfSfBNiI7v zJvrO8br&Z0+-n&O_YpuGK>BO%zoSo|9%)-_C4v0cY)iPSNnSI6F4BYwt4KF^^Tv$= zqgIB>Kc5eQ@2vXlSqWGw?9`&1`2ROrCnGa+ou`AQU-gmUTT#BMF8MsS-1f;)#B+Qt7eQ9B?LTaFXbxOs64 zcdyjh=3Zb=GmTlvufFvgWYy-|Au3Av@E?O&`Cm00(k7=P79vbw!M1PQyge!V_H>Jg zj=*BourMP>32yu^F*XIeUlH;mqX9D(O+~Is8(65ysSKQdhzlr>`*^%wjH2kt*c3l@l!{%p2{5L>Lu`f4vQgr1u4^*L<^^56UKpHY#3b{>>%g0r`D3R|y(17c?8bGrF9Q z(l-<5zWDA`Sl^2;krq_7T^kz>1NKhZYc!&JE4wE2>OX9h;TY$MWfmnk{K}TK{j2N& z6@{##tK?4xpV!EQ-)TqdcDvPAPj=vq-WfP^HH7%)4wgJI3?j>y#l7y~6k4HKBb+Ax z)+Cerd`TXg;gCWW2WIXwVO1+n>wzCz=1Rt5uI$bFFU#1{%QStIX-%wa#`p=N&-+&M zG;lI&T3sFVy4WdyoO!3zX(kiLPDevOz?IDBI;LWLiz3#WOmYIAUw`^#KegTM`f!Xidnn$D6h z#(j@%a4n@$hlXzF%<|~6Z}~qF>B{J%v^>!=Ww zf5rBVX@(qIbxS-@C4W3taZdi83k?sE8rYju0zsp&un;{gR2QV>nf8gTaH~TBVBzE1 z-9n4sE}@?{D*M6x4hauul>nD`&Ilzs@yz~*#*5?MkPllmof=mPOC3;ew;Jl4e~H^&GIi=`RMh#_BLR5 z%eZY4juhsxe%jvNeoAC(L}VGsmk=FrGomQ9obyS+>UCA+Qv#)U?(~%q2|{1L0aj*v((O}`{Is=O>3{|J{z%IOpo<*f zB1k%h!e<)czj5{NrndKw^Cf`eCL=8^9dW~;@g&DkclYJkfYhttu}K*-&|uCeLGl<0 zK)(#+PauID5H+TzrX47~3?z8zSy_)za^6{};x~~3 zBHI#s2-Pt70cafIloB1_yey+GEwzf^0hK~d*nr12xeUTlh+Bezje)9jM2$i4xu%d7 z54>n_6$N)eD%)WOaOrF0U(+z=04Qey&{`lUOjLQ(zP?3suVQR7=4HaX>9oCc##DXc{ zYU2g|{?t$e;VwgfILb4Cp^bwSy=g#EP=+D6!91p2SC(|)$ZOBwF&dA*UJ%O1gK+ra zLBRy`?hIu>+JPut^)!QdRf7`tOMWpiF9!$mPhiE*t=XZ&|QiE+XD=F5~6Lu6WN)W>o=YL{`oadq5({kkvu6*YVg<; zx77f6RL5nOhdixX-Lbj8WWEG9J`8GU%y0@4L!ce43}jjN2FqcX`T6hGyTzm2&#$#)ps13PARzVOUVcKM&Ikc72($X%28=&)eAAuAmSQelMGoR_~@^k`MOjVPH)7Tu0GF zpn2zEx|j+nsg8TG<|5ez>VbAl9u-Wi)fv*3DzSk~m&;#gfB`95AHYV8E<}eh`Ms%< zu2N>b(0O@ktXZB-`+XNK@BT@G=J~(AEZzfn*r7t_{__7Wd$;CiPG{379rn*Wl|n6AK+PmrF%~!vMGnU$0<-k_gp~BihFm(iT%H&99^?3 zTeQcyS&!HR6s;JWDiqu{U#gY4SyG1QHd(Ddb#u7Phn7e0(Yv#wV1k1c=dR<=vi@03 zy-KF4?xEXTyUOdx+RLL<9$9tB$r7%1()+C3mA09|tEp~eX*Pvl-JqM}hVH6fp0^&j_W9&-*Hi4;b9iy~DO zV)tqKiQt)O@-ep5{zPc&*Xf$jMsn0DM={HTGM@M`uIEv=tjS4n>PvadFsNdFvB{!l8iNvuUfhN zrs|>fxa6uC=BE^Td1_(Y*>7vvpzzbtVuL-ddi3=U>@*wP@T!@n79<>v`<}#_m%?qv zZCW2y+bunT$si3Q0M}{cujzkTq^+8~WyCw?c#>zeG!}z-2_g;5Fzp*40aR2}a7*_O z&QLso331lKmeDHxPwQ;u4-b-egfR@PPwd0PPD5wDwd_y6J;or-ZqB>$g6={&SL-9k z@RsQfHecnb7fiDjBpH`T3LZj_;T&2#3Zufau~Cz}Yw31(0(lu{3PSLNRJ70xEzRUj zZQem|POpl2+yCJw^4ea_rZRl@R(>OV=>l*RZKu%^z}EmSlG9f-AVO=(i=PXC7agd5 zFGO*!9j2H@*$7tiiUZC>fmEW_7iZTOBgKnNZSX&r(pXpJ{%UnAG?}l5_L*0^$ce?^SPd#z!LjpK?>?Tat!r4;&bzhdqZDcLrRTWmlt~hiBr?oS#SC89Fu0j5E3sDuMmcT;%cMGFs`rv(mf?)9$Z?{6)VnH#R8_Fr0yV3v3u$q27v zOttX4a@RBU4Ok!ca-Gze8jfLT54k$cZtvF7*`LI=VRg{YaD4~UMFJ>;c^#Y%1 z6@^#s-X5&k&A;nY@EUvffy(7-ZL1t#M6LMK*-i_yrpZ3W3a&^RhX_8NEH^?b^8;@; z85i9mp|C8IiRJgEkg0uiA6!ift z?WG@z>gwr`xi{4*D^mITGVFU^tXiunPAI1ogP}&1aB7~ruja?H0{Z#8Iu`N;@#Sv- zoTQDDg^56YF9@J#X2%=t6!2$Q4vDAX&$<7U+qs9_82Dp#1MF z?0g!vUsJ=sX|lA!x!aR{xh8m_2*0yjhM7;e{-UW_|2$xo_+J+wy5Rq?O1zE{^7Hb5 ztGIS1v&sx~gFtcq;^|e9mPREzl;q`~xXcFY?X13%Pg?TEx+PZe=mSN?n{8tUUvCkq~kyzv4^8Amyz;4PFS z*y}h*y8yA$Z&3_QA+Cp=a0Ok2;R}K+EEJw~0kZ>MOtxk!L=ZaGnSYvcOhoJ^-veow z3fbRCRR+)^a6d%bQXij#peXu?n`jQ#E8lnzq#zL7aL7*@^cVsMRX4ZFb$4L8lm75b zpaOLh+C^sJJG>veY7RFZYlhMup#%sd)*@z~Ndi44kbpfo+L@qMvaS481f%kplSQH_ zjBDP0yR)OCIZtg(G02**-8Kp`>Q9#jI^9$~%KRNoZSDTRXZ3r;7vL{8hm$dR*jWmzD8D z>7NG>mq!S@mBE-zPfuUuB*nwSGw#rD z;rLLOgi^PGKo}PUdI&@fr85G|VrqOnBQ~XXi-1E+fwZ+1{+;<>b6Y_{;j;`QpfV?M zOL=!U0Pb%|SqNMPF<&O&6s>IdWGKm6R&qq1ZV*{9P)VoM}NV1dn;Bn0+Qie)OVXx^dRJo_-bR3ia@cs0RI zV;w+yn)R8QoAZdLAXXc5s{zUsLiL{d-1+XVu8$l!TzG?5t0a=MrhV1X&qF}EzG*sh zVF`4XdD60yk~bpV=|F7q?Dp5vr$Er;SIRtm_`Yc@Z&njRP^R!ZBuK77k;=s0F`*DudWFs6xc3f=heAC%aXk(G5gy(=dz?R~?@lxp#!6=@)K zz_?LIUEPGZ#*wZ|(Q($T#Zn*6UYXIf9CIkAbkzh7=1@5YYQl2~1QA5gGIc>>XR>r8 zFDt~d9@`s3CxOiTgmdv&7AU~OLs1l|pQUJC;Wbmcu$!5Q zX&GBJ%sfxQ0Svov?7WZnRP{MTTY*2k&uwQz_RQ4V<3RkVzckUR3Q2XIN?L2|1$1sb zm#B_~MMRjo2x{iS`+iw4i%UxbGW1StpNynr9@YNSZ>_K8ERT!oqB}d3uRv)gLdxkA zCl3D|wt^H&1uPc(ZQ;o>90miMzrWRUx40Gdg89B;Sy+()f2*#4(@Hv0Wii0t5`I%0 z#F~n*K9O-!Q0Tyo55c;Gsc<8V=x1$v9t_N=wGG8DNRY}8xy->K4W51Z?_GN@e*gCE z8l$h#K#$*GCAtm9;uI)v%93iSW&%%)!AUn>We^&J*V^?A$IAi26ClkAahA4o{iV*NsZ>BZ5ig3xbD|1Pjm^#H3Kn-^IAtXy-ooD0f(I)N z#ld=Db3j!dI5Y~3Yl;fZdT-b}I!5BMhYkRz9hd~_WSXC=`x@a}$Zim|-$knYF_P;r z&^21Fcb*M|91f7XnUF~<6nPeyGlyTUMm~b-4zs?HIV}fsk*pBKkocU9eW{3GoN$4*7^#gv90A{w>r@AcT|8zNP_RRqx( zXpz(K*u%s^DSP{snv=AceFs`bENvhkzKp!uR|rrXQTqf2!z2Ov3>9E!vwOCtQez>v zHy=2q7^2#ZTk?j6DF}{vPjJMPD9d%aAA0!cQE=--&8a3 z`9OPnd{$Q0d-F}G=%V80=Jw6Ok9k?lyt@6XWM1*LLt8&Is$5Igg)U0KV<|(0iEKgi z!~oGDrU(j!L=N%v%o+5|e*7T0n#-z`h z?B#9!0&&_Zm6-MTcarNF3Elz|!1}>xYd0ho~W_UgY7();voLL-0LcT9w z?k^qsp_Wo!t_f0u1AVH4&QA>b&!^?&@K)dQJ0y&?EdVQ>o}B#E;ri-MGr>AIRYA6*;#4ElhZYkE-g z0O{YEdaEw^kv|tY0`s3)S*ZdG&nH4TRPKBkWAo0st};q5PDocuxt1VJe#PL zl&@iH49E9D?q(z+ftRgO@yz;*Qw}KR5_618p`F6wVj4B@_r3IBsiToR#ii4aOAQ4~ z`KM_)6-xX*cI?Z9<*!Whswr3oge_{`d`g`XH-;KyC${)GjvT;IP?Pwla#>YszcBM}P&f zmm%j13I4pS+oMK0O<%i97NB-!I(uiSbjsz1HT>1Zvxln0*pGKODj;ii9s3HNE#)

2$gk766t9r)WK*>1 zbu=01)r3gsy3j+2GaQ!toj@UB^iC-$DTbjs1x_hwJfvW~Lc6lxS~i(Q1TS#hc(X}+ zx!ZGBi~;f_WmdO~bobLdNTIXq|FScl1+_7kHHa;UphMB?5ZMb9NxX~1?Q@OjKfqiN zul(pJ5}!Rgfj9^aBtsHH?v4&!QezUe_#o-*xpP-w{P~~=T_QS<@OGi){4kEx_>)P? zjU!qU$cu%AxA-A)Z32d>aCTfm0?`*O=+i6_!$XNX^KeINf{sTonK7u}yXP7@!GL)Xe%vuT(;gYvtEPK((DS<{nkYw4jG*64Y( zb##<1TfKLlRFIO&GWeQCgn$T<&@&SMUu|t|wTH{^!Lg?47T=rlUzg&xPw(?lX!T3Wr-&ADbw9n8&}+goTaNJ@9>@HGhOs{aK(aWk`i}Xp8L0|S0!f~`~ z2=KTIfpRY{gj2!3CrXf&;vf_B_*=lGHz-M7Z25DJH$A&IiG}ssp+nWX9(R7Vw?MfC z>FE<8H1I9_wWhnjA8Aad)NB#x;Oe^3{7i@Qu>}9;Cs0iCP1ni&rhg0_tZ9rB3619k zsz?7aw!x$JyJrc*t7yaWcO0kma_;so|FRP!{};9Wf5Mcno-c$GsHyjIE*b%va-H94 z>$aO{C+LabmGSkATQYF@O8uYEnST$2E`vfI@W6c{0&BN!-ADR1JWPWaF$Gshw~vC) zqsxaCM+DO~H#NnAphf=AYt*QaZPE+OIcy9CB%>P&Lvl}cs)R5`rntWCu=`9T{X|3{ z$mTfdG8UlIV9RrY+(Uw{he(XU=L8V*RR+gpdldj#6I=u&42j9KBv2^?e`ZLRa5H|m zIA#(mWC7wKpf|AOUqyI~`#aHkP82W}E>MV=TRbUH@V#{(0by4pl=$+cD)170Dl1*T zvM@^aEO6*k%$rn;qg3x?wvt3=Jh^_qs_s-~qbZ>Fv|1gIN|1&`vajb19JFi(bwG*x zgMP^&a#%`zY`V_3#x~ijvHy#uoJ(Cc+1SNuCx4Ns<{Wq6hSmc~-D9gojYEvz20L3o zav%hDrYuTnI=`_ffh5b7TXU3;9f2fbdy!XpxJ*h8ZwdAw{;WITKu~zVvFOh z@}XcMo$%1(yQn=+8NN09s+@E|b2oI%y_Hegthl+XlA-ORW+>h`nwHL=WLKF2u5$i; z@MA?0>E5DlR?o+`iV6~)+nwaUWDkr!&3S6}&)wCTYMOPar&>z9ETBuCiDDkKlvH{M zLXPyMUOkQ>BRnRX`+H4S%U;s#-;4u3gVk7#9-|{$$?Q!bM2P@(1)%QzBwhvAOr&QX zB(=RU^v2y6CPm0Qr}ASWN4tH=Os%csaEB~1uyjjiKT}UV2}hQt%eBvz@aFEBhY5D^~KQs=&Io zr+V}4&kfrb>xLV$qaVqu5jVy3ckC707xVO>Vvy?{(8NPDWcHJ@u785sKWZ~PshOrD zReXz~JRCM_fQm_2NfC%S>^E$)w?IvmpR^->YR3_6Arg@CCc?}HR$xOv5qyBWNWS#s zTb;nVFLx)DVlCDT5Q*e4afKi$agDvz(CeSa;iGa1ck|<`Qii!2Iqhi4&%tuApkLP` zPsN!LQ5)fJ6yUmg~L zc8LOYnL8bC&E~FITZR)sLfIgf$tr8BUqxFooe<6-IcufRo!%PZXjs40Ve_Q@n3AYj zKzi2Y{{H-DIO$ps{<(LzFX&uQw6Egji)jSkt9^*4lGau$(Ks3;a?AKOBp~eBypqaV zG3e&3^KRHtEgHF>)Su5y-AW?|+%K-RcDeDF36|3XNrhY~@82zU=&}rOqJhJ9Xv609 zHN>q~=dsb;VHG)R-7M3wvQA zvJBB&5n?Q-;f}=NVH*_M765~o+{uPmU62NW(FuZvs&$o}bDljvMK-RX>UTY*Z zcXjcnr-IP6nEw8$z*8n4ajeKA4PWwG@oknecjsKzk-G)&iaOIWwa4Bpc$;Y{)F1`dXyB=93?WNc937pmBjlUgHCmpbYS43%@Zc!T`eJ|2=TGEN z5G+QTI@`6#)WBHy(^AW8Y(e@|nYbqkxA`G1^YhzC=o)2bE@!mG#dQ@JdqDL=iNn%F z89I@)oj1xB1^l=EeldfKVPYrIW+1R5YtspCOt|UGZ>)U((crii?p-6UsKgr{LyLBY zs-LZ@HW4D3JkO89Q(-GA@e?>!Wau8aqQnltzEe%J?h2a%-ELaK#EF1xCF5eVq2OJ0 zqje+7`NGU=S>ca=^+Bz{o~;fmNv2uR9?d;Gz-pK?s%>jl>#&NDlofC5h$&_=N^VEx zEvD`BZMAfIo5mkX#s(=o^$LX&&LFo<&NySB3&C?3L4U2{Z^k+lTr(jsGT*haBq$(I z2!%$=pGk4miZ-h4uBRdz&)uc%sBlfLt$s^pzt`GVYc=RI$?wpm)+f~HXjT1-am}B^ zrsf(`bgQ(BDUzY0fcM6~Z1!XplB0|3)W45JZkyTF@!M-f`PdpaWu41Bm5m44UDq`{ zoJ>oz70jP6z)@i8pW8k}yJp}KPc5GPSm>?jwdnp-o|{L_7&{Un9+Q)omm=bA8{zZ) z+`4m`qmRk-NnY}o=@OgEBi7UW?Kw^+;wB0QEL*5F?2rC9?6Jv=hl&==?%K02tbv-C zBmXZbNvh{fGV5ga)`UL0RopGF$-!ZUex`})wP2-lVkD55GDSDRCP>U{(AUVA1OueA z)iYLB!3GVOFu1DA#>RWT7bA?B2*n`uOBspoC{|H4MeEav(oIKXb<=%wBb!p1j zKP*af0#Y{^M!KH6tn3z;LK=tKwI*TQN6nbyv4~pZ{r>hE#c`DqYvC=w?vwglCp^`X zf9&jCyZoUyR0I0evMjGWuH3zv&v>#X`57+l;v2cI?sai*-2Dx|9eCEw7|oy~^`StP-Dn(WCoe*39q0x^>Sr zzXSwkbk#9c;JbVzlyW_7uXUK}2!D*DFCj6pS5^O35LlI3U;o#_ zUa{d-fxBhT-Ixc0z|2ZmpyLY_1M@-l-cgVC{@S=0e=t@P|2C@j9(X-V?f!4Ewlx}6Nw#0-? zsjYKdubbyI4_&xXT1H?{()JhBlwT4;Kf99qYIqWrq+~0kUla%_NGsCZl_*_x>bZ=Z z8#D*I*kf}GUlkmO?E6M)pG{cEST?`~a}(&DA0q6@7dCJYa_u^HV~ulcYfgibC$@BN zjSd|Zh_}e{gI8?A6fgNe4yWUFSok~V``k#=wZjjM#u;xWHNvBKQbgtI!kznm@~(SN z^lnNW;TzlqefaKe<**xqmDmbh1QGjtU=HP!z&+FRT*U!LD^{$pq&qZdx-p0fqRv_@ zH3f1rjp@G0M~m-iV_Ja^#I;@Q7_D?v28HdlmdaQyfef=D7XQHXbpbasy^C=@JF4QXy3WNAU21zk+RelJ$P&{xJuA{4 zI9@1MH=yuS(^u-Zn_XMKkj&@Nol@D5AFz0Td~U}8c4QTX_-TK}s-vkB16v5msBFS$ zqyw*qYQK8uAu02E3oir^Ny3GQPzeLVc}mC~;CYsklr$&i3*odUMyWX5k*iV+>i`W- z#PM(BdTQRV)!kFRr z38cHBn`1lZPf%E!W~AYv|{jxuYq1 z1)AtNW^=seWIRAF%wil1m0SO|;2_6)4zW+kE6FZDlyS zfoJ4ufx_>HPm~Cz0CGE*Y{+@%t|U4-v~uHe$Nt7?k5+Q$C(U=>JAMeqa>LOU(ppDE zE#E5vwr{MqEOPBxl5?DU)4pc@rqe$#%k02==ip- zkK#MnO+8rO#X1vD7T5JWLRxMCR$w`kfJB5Mg9d>$*06YLj@|~qt}&j)$C4zqeec!NCZ4(<674?}Xfx2?haO zsU^gJ#e8I7%GG}iRa`sGFl01*K!ofjl4rn*&}>WI&s7;ocl@s|D%9r1>Fv^CN;-71 zHT!Jf1C8%_lsE{QKQF%Tu{L=VO)XBffOS>1Q++nr5 zJ^J&f|5guLsqfx*XlQyoQ%Km@Me>3N;mF8v$s z2r7iek%^R6x1)b75bay~QfM{6wc_Z9_GjANx_DVqKNUUCj%U5ju~@sgoOqXrq*vlX zAyc>1BcW{frjE89>q9F@yn|7{F2!@;R~1~b?A?oaZwPuCfHhBctv!XU% zo#iO}>6Z^6wRUkt3K*ecf!tw&@WSB)|GGWJ3`h*=?)Pa(o!{1N z-Bm-#^`VY-aIIS@LYCh(t&p~+65UF;QsCP4X%$W>Qbh}iwIQddCFqMZU_nD?P3EKV zHg~rTty}l@>zrW$B@?!*qGMKnv@GP%+IUaa{5FLu+Ir3+Wx)U4TIeKV*YnkQWb$*d zYJagpqRs7eGNb%+V_%3HqMBjbF*B6lWEnj_i?Y5( z?dbhn2HF)Zw9H24oA$h*|Ap8TnssD`YqnVzJeMKPA^}YFC~z902*I1BjbUq#g~%;$ zP9C_pW_S#lA=hBlctg%(%rj-=oQIyrUoK7!RX5mMEKNtRhIY*SJr=4F^i7F&Kk zh^l&1ceI`t42P0laFcx&Sp4p*7%Dy-fXB%KJ#ekkeJpj-U4vh(*wa7Ii@%Dhqpl3E zo2%?WUBjHO;N<17GZy{<>k%3^VxtA2LkJ1m+S+P3VxB%t!9r>K=?cp3xDy`;Jr!6` z$fvBI=c9QB(~`B?i3Hh(82u?!d0=cXxwaqkEZ(RSKZ}HSFhO9MPW=G(cFVjZ((drl zVaN+54%4Ejtky9|)N8ExAd;sIDp(YotxBxR;I1h(|Lbi+fWz7QMceN9aqthCx5qQT z0as$WLN9+b$BHa%t^4rI>j|0D`HSfUlo`BL^j>Re_VU^xp9|GC2>-+8;`&uZ=z~q; zAKu)}ol0{ed;@+D8nAnwinu$a8C~MuYGQS;bM~W9#)kN9Ye!Xr2OzG`_*Gu_h>P9B zb+Os>H!QXU(`mCyKDkd^_tj>_1Qo4=Ub#EBCPU4?)$`a$P+jOvW5Ha$3iuh*^$z$Z z`Db}L%|__sd5q%x$%_;2ncjaDAF;l62ao5J>qa~UV-vcPfyTKGzmkY%oaG|x5F#{} zx3T!{Hj#ctzuykdvf9Oz7&GDTvbVNN`M4`mE1voD8~hv01tm<{kqj&m@YX1giHt(i zEdl@rVRDgl9@a(q_LsF4+Gf$OfwOHD{7ClYKAg`t8 z9Xu@w1T1Zm0NuX(Cs;1lwL2dKHk{pcw=iQBq-fZzOnth5;D=}R(zJ(x-&yfsB*`3i|kk z0J2RAPLB0^gwmb@_rkB_YNdAbaReotyUR9IPy_%#zC9)aw}{oLayxbg6JQ;`Hx_R^ zR%^TX27cc?9kLS4jK$4bbcdu@vx9y|M>dhwcg<^s#MQVNYfQ9;uV|kHj|o9kxYXak zPl<8X#hBI1uD%U+h1hT6PV_7OPsGJM6?r#&>5G^;@Yeb$#K1_39P)aHfsgMaQ+*a( zB_fWWnJv$aQq%w;q@2q;^xt7NCWqnW8=u6Iur0V0bv@Fa>~;a6j((zlSAftUvI zlEFGJz@0QHarfci&kZ@@%altZd+^?)82}xG2Ph&$On0|lXqWA`V`lnuy&-NjmyBEB z*4>aDyfyaor>H7^2J+IYncog$&yhi`XptYTXW-oIFD%@xuks)Fonl4Wwb{TtC zq~KXgnrJT_2N;++^hWgW(d_69_-!5;yL@QceY9j^>SZ#mz0Yh;h25F=@NAyMB|%+4 zxuEJySw=l(JrdFOeRdws!$$8g;r*mMCCD;Y)sF{b3}3zaVEwB=hi;c8rcP<68DTOb z`Z>e5$5W%Ss;-H}3S7-KJ%egmBYzJG#YGL*LAZ;%nHV9H06#H3`%aetg!DGlYQ&@T zBYmytwP!z66oA(yBAYqs<2@DQp!48^JJlJj2|J};R+JD6;iMg&5s7ASfZ<=yI&IpN z_k>U0K1{ZDZQcUP3PALV*8Lap_ZC%`@JaD#>5y#z!Aq;0_&y0QWXqpp#y!RpRS(XU zjRkM*WOjR(RW`T%@)pQ#U>CPl0H+vQKW3Kz_tDp$xonf|x?9Od&Y@PB(b_Q8IzZ0f zHofsBfSv{v2wz!w=AP2dSRHN*JJf1{{(%}O5e*!p9=6P$N{`9Ff|>o>myiGQvopS< z^4n@!Y*~t3hwD7OT)6ZKI%eD?%stxtwH=kwtP*K;_O=cFWVp;*XwYSp+x4y#HR~7z)3rHtdPDCmi8K6Q51wyL;@qyL(|P zx8C~Z!a$&AFQy69Y^4j75X4sQri64Q{`&Y0GlDWm?<7@NZM=X~?B5R#M9Kz0SOTze!)!uH>5?o6jUj zWMaS;EnLcj1yl)#D_@@kFU`tuDV+G-zCx}%FY`!D9s`YC6J8xB=#-Ko90&l-$i|y^ zaMlWXCjz>=_7$ea^DBhMq{wl`Z4I}+_|Aw9Rr?$m`8MIM)hFS%TlR2o#+HGMjNUKP z_hW>GKMgA77K+yKTFhB%#~i&OR-pkjRf6-8#Bo=Hm*!D^t-o(*uI*Fk?9ZT(uMcT*|XR(*(B0C0eT(Xo_$-hB<2{W6Sh+>;u zLL9bK-w{#KoLU2Yef}}METi}9moN)$9&$v(l1eYUM%H4^o||!#W|BrTYr=@}r6uQZ^^2x~ZEkD4Po`z- zicqcfxqlXqsW(o$KIq{l)0NU`!(AUNl$R}}M4}jZ#WqZ{e)0Txq&ocr`?$|r!>b1$ z_fNReyWXtaRh{bE^M<`-C{=CKSe_u2$MOjbX`2g;V0)wmB z*93~+S5F!AbUoEkU6MjvO0@Ab|`s~_f2F}PW4Q%eN~k%F8>7I z?WqB`OaYChft}0N#gJwT^+MvGZe2Dzo*=CwtUi}6|MTL0$2Kc76GskH0wE%uxo|r5 I)Qvy?13qw4;s5{u From 90cff30cc60be129668285986b73eacee2acbeb0 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 29 Apr 2016 11:14:47 +1000 Subject: [PATCH 119/439] remove link out --- ...tigate-alerts-windows-defender-advanced-threat-protection.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md index 9ed28f7ae2..43c25ad0dd 100644 --- a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md @@ -45,8 +45,6 @@ Details about the alert is displayed such as: ![A detailed view of an alert when clicked](images/alert-details.png) - - Depending on the type of alert, you click on the name to see a detailed report about the threat. You'll see information such as a brief introduction of the threat, its interests, tools, tactics, and processes, and the areas it affects worldwide. ### Related topics From ed752de803948ab5925544529e961825739103a9 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Fri, 29 Apr 2016 15:48:46 +1000 Subject: [PATCH 120/439] Update investigate-alerts-windows-defender-advanced-threat-protection.md --- ...tigate-alerts-windows-defender-advanced-threat-protection.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md index 9ed28f7ae2..43c25ad0dd 100644 --- a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md @@ -45,8 +45,6 @@ Details about the alert is displayed such as: ![A detailed view of an alert when clicked](images/alert-details.png) - - Depending on the type of alert, you click on the name to see a detailed report about the threat. You'll see information such as a brief introduction of the threat, its interests, tools, tactics, and processes, and the areas it affects worldwide. ### Related topics From 9b47e9a116fdf1bd499a761f12e2cf2fa5163428 Mon Sep 17 00:00:00 2001 From: Iaan Date: Fri, 29 Apr 2016 16:05:35 +1000 Subject: [PATCH 121/439] troubleshooting changes --- .../keep-secure/images/windefatp-sc-query.png | Bin 0 -> 18795 bytes ...ows-defender-advanced-threat-protection.md | 178 ++++++++++++++++-- 2 files changed, 164 insertions(+), 14 deletions(-) create mode 100644 windows/keep-secure/images/windefatp-sc-query.png diff --git a/windows/keep-secure/images/windefatp-sc-query.png b/windows/keep-secure/images/windefatp-sc-query.png new file mode 100644 index 0000000000000000000000000000000000000000..fd1c05b648f5c21d1836501969f7aed52c9db01a GIT binary patch literal 18795 zcmb5Wby!qw+b=wTg0!G?N_XCfGzbV1(jhg3gh&Vs4Ksw4q=2L{gn)E+42^^!IUo&^ zLw5~)3!nRa_xJ9-|JidK9Kf~Knpx|L^E`iXO@!tvB|gaF#G?@rTw z3vsXpecv5r2Z0ztFBRl;y}shaLzO_YV*_v$_3f^d^dZqgr`mk zT*XrWUe#4)7;VmF{0xoscmKwYBKb@A7bGF9;lPVt0$ca4l~6E~33%CuV~~-MkZ8#h ze7`$NZ7Hh=92|d$#RVM94sF%9&brvU_0EZgz)q0Slk7mNxXouwF3>srHd%(twC56W z%X_~)P1-nHM-`_6o@7y+Z3 z%?tLHc2Eq9b+_BG`{~1GMMjQ`ypIlJZ$V}KlSPfQTHZL$M2^h|FV2UDZ^_{VH>|B4 zRs}Gld9fS%`PSBs$PmsEJZ89Nn5Q%YpN&$;3n?!~1-jhK~G@oaA-A-sAB8GEe zVVTao&6vYu{U^L zSC=?#N^Oyz&ik9)G8i|TWd|PPadl>FE%U>Vu0qOpnFKD)DhJ`1&bJ3YJw)e?7uq95 zZO+xTRCW8F+S4_u41}82MWAml@}dT<%pfsEm-Ca}UMG`a+BXZ`zPJ9TVysNrISE9C zL}Y3hB3Ol9zaFD+odR_?O7<4--w?r}*dRm~ca&ub(L(2pMRL-u#nex%#iNsccCVG# zKn=duh_d-B#QrWZEE);RTFHsj2sqLmzhJDcBuSG`gB|qS}p_@0k zA%PxI#ap-9t}-+YJMYiTiVoCip{MjrPeq!4|GrI5-?64YI#V5TsYN1gv6|1X_xAf5 z-MOIj^D=|2h!cu9m}Ez~*(C6+TxW(jUOFNY!}4VJwGPa=>{|*|AZKVH2mgzEWjFL* zE9kTCbZ0c5+3mISf%g>N(Zui#8yW4~vKzNU!^J*Ua|f@PcdHkwlXxF5-wRz*Tr$6W zl*}KQY&^eMw`V4I1D#f+n_**g`hkQm&UJyd66>H8WmcgETBuQ5=IgbbM}94zwbsJ? z{r;h}j(y~_0-3|C8hBdB&_q43whJ2)}cV zK3YR&+H-+desA$abk95CE(kVbY#?F*8=iapUz;pqT?sE73zzU z@H%)gu;yFj zGc%Q3c*Wou?$(U-mubgml{{OjugSqRj|k^5FcUc0>IBmk=N5Y4>y3C7WHWN_bnn5J z>R`^fjaAa^MF>Q<1maeDe`)w&Qv(t02|It+d?hbvenEDV>E!Ntlo8?y^CG{o3f18E z)2fRt-S=?N^yvsAm%g>4*)zGN+P@$uo5Tu)W*F_QpC7}~e18}s(I1V>%qARNF3MwL zlWdAagRDu`+V_L zMsk=gfF8Z$d9&|VR-#+xf89PX0c0F}inQAs_{#11(XD?z;dK$>2B{_`ANz1U4M-;T ztxy-emXJb7(5t)LVq2&!+fB}P_opARw2t_Q%cYof%emO@?c3)}Og>Q_8DSsqQqsNu zr+fvh|Fhfc%Pf=}kcJ?8`bA`|*M|cyta)G}R``E2ozB0R?zfICYiCM*3gsd6qc2|d z6BEw|yeGEPDQ#aVz3i1#Xd2&#ZMLuicS0YJ@%iZoRAYoejqkVEgYn>TF<;lf4rt#q zlybm$&*l>qSav%#3CT#s42#la=zI11^UB?A5jPz2r9Pe>r50yACUz@Rmx+I@{7Nma ze@!p~Puzls#YHHuBWHf5(;i2>5PNGJDp--JO8;UD)K~wqTDw6Ct5W!drHDCQc{`2V z&xrc!EPS2mYl-r!XAHe6@q}tTbfY#H$HT(4pXHyjl|wjBlgFX7nb+HALNQ>7-z4S~ z+Red3M*OrO+K2gg&!?i&-LSM(FVsQJye40BeeS2n@|8iO|G2pH$c@uidEkze{wT>@ zl0Xj=;EDX_2RQr&anTc9UyBK-xHC6c%c3HhT-}l<^yQJJgf*2XVcfhY84hatyIqET z-ZM$SneGOU%bm<%O@l#{f3P5K1JPWCQz%~^y`Ut4xO>YKM=CE^tHOD zBK$G|{(3DUMNzP(D70$NOZ*4BPLnW~HTqxT1)^qLBiWGPCXn6NH_36c(32Hrqr4=_ zRWoK__Vn%nJ)*UQ7_$r>HU801H@O^}zn?hoQJ!eHhUdX3SNBxzvy3z`R>^x=Kg;(g z9=gg9e)&R|=3GOcO_qoo`@e;iiD z>`dx-RXF9#oqTvtrINrr`;lR2`&c{%J}?TUr(~M`C4Loj7gk@2zI3?q zznY257IZ?HH3&mk+R}wmfOzF&7l!}c4)z5@mtZN4&qVmr3e;3aZ;N68t`~Nz=aadM zY0RG2rcmH>6=K_DZdPP=n|DQ94+udK5mFIAP_v_m2vB*-mY!N!rQP`t=}!x?)@LtA zB-9h>Ap3NtfH(5-scpJ;T{jyQfT*+BJXaYOOcXR2wV~(!wDl(HeN48; zTw&h2p~~>5lV4o4@Zd+ng-Qv&yZ+5SOBZuUHj@-y8h;TKwd9{0vM-3Bx7^~9$0qOY z_vSC6OT=2cnkwE(^_P}e)!&4NXOw-k`u>LU(Ib@+3W!&gvc^5GyL+IN@*>nvmaFpdSKH9~8J=yTS$&C-w|WWtg(p ziuO`FrT zIxBr9my_nvNXs`u(E$Zh)!za+`2V#2tX!#z-N_$Avz&=do2DmFb9@DfO}Hn45%%k% zFn=v%R?_xq$r#GG6;{BvYGgVvF$8X{Tp2q)($Yudov<@y=W$`{YLz0sq-Wl(Q68JH zw_NcWMzZCymFEHo6V$g+uQYXo_#Yw2I*d7$xfHTTPJ4VNHup3}U9v2`O8R^)B7VR= z8Fkw5=X~4x3eV@o{Haw$u5dhc zHrOQ8ah9knBLWA->kCW?ssWu|$D4j~+yxtV^>qilX7uEV(m-nj=KtyjS zrS2OJp-f{!ke;cPC`8A44iA+l&_feI52a1HSZd&4kx@3XHBv7=bMwke9Tcfky4fN9 zHKySa!QL9wO&}dmwTxM=@Jm3eD!9S6W7{6osJZw=CgUXoT*_gA!D?$WeFx|1rN~~Q z_B<|^l(gQEv$**~IojQ=2^Z0&nunk~RENS;e~lZOY}Y3vLD>9fArr4gui~CeOjKPe@CiFqs3yiM(p>+LL2o zyhx7+Y~~n;YNBN~Ek<=7P9eJy*N=K_HD=(xvejsTxMDV1=e%RrA&u8)l_BRz%Bp?2 zAo=JbRnp+f|PDUKWdAq zv3s`6E~qvTLT_v@bM#n@@>oNlLaiPpT`+#SPOm2HBNHH1IU-=FKk>JP8DZJ%BYj=!Gqhsr>oGL<`Cts^S`_8YBgxN;r5qik-9oho+#^BPY4eu z;{HVY8Yo!ABbQxheHqzKzwG{FJLEqhXp6FxE@oZ7663o6$obF&U?e_G*oVN*!(db1 zXlK6_8p9j=({tC0ixtl1t}#uVEt^@=pX0k0T{OooVvh1bAKYX4A4+@wXh;nY-+(%J zUX(P^oz7Xusn8|ddKu&51kWka?7jI)&hkSw;yH0Ym29`b#41JGZqfE35UhPaZ5%S+ zMfO)2j>$k62Wq)#7y7>xNd6Md!ug98p{eKpgBYRI1kNH6=?b{3QNKU=f2mRb-!47T zeJfwT`_O1>xKc1sLXc5LIhP2?ZT}XhjSS$K>$1?Sch4gbsOU^0TF~+fhfQsJcVcFD z5ROn(L`c_6VD!xeCG>dSRcF#BLB5_%KpUs+S4aUPE0;{GpX(FnZ1i? zoOs<8^91O!qlehKz$fB%4?OT$CdE*ioY9hff=T=i^LV&7g%@+fhl2Wx!hWVZSsP6R zf>8GvM?Gg4hRS1E#gn8JbzasJZr08EUp+sh?)|;AF!p4XUv&F6DU4XKShJ6snV{CkZtrP$BX*Vw|n z3j3dm5OhvvyeVJlTrh@^wjF_TZDlnnryUu-O#SX!gXP5g@p0JLDQku}tm zzSD&@IJ#ps7GH11A|o4pDjHr#O-e#Sr~E9mzkL?#@mM!BH0y_e58mR>ZuJ=;{$Qwx z>eo+(U=km3X$AkAl3E1kO*NKYit`D@%29%b=+1$FSrA;+CHqZckOCvI6#JqWi^nEq z?ta|we2MXIAqi>0U#hdXjZSsR3Jagpc}JX~54_hFkY575Wc*GXW$T_=l~-F#InuPs z9G35r#`N#b1U_(`T>Xa0)cs+m34eisHP*fFbY-p(wTc(a2`mPJJYe;h731VeV7XN3 zsZo@oY=}*gAcjuo&>o?9r;t6z*i=`bVuXl_ZaDEQa=HC2$_I9%fzewBGLZte-erjw zXk)ni0n5h0k9Xeqwvr+F$M2`*JoXKYWJXx)$ifpxf9YXP8C;=W9Xlsi!1|uO#b}@V zdC5OCi)F-q662h$xQXqF@vA?AHem**8lNs+l#4J7xc6VvZGB4elBKa>=oE}lJH$1T&2BvzPaitN#A~11DC>(B9ht-FHmT!_5R{+k?WOwO7l?K@cA@_eYSAdcJ0ikySF@83 zmfx?G(u-s;pF*96jPB|~04n!Am_Es5bMzZjAwbJKgxM=BDok)xRd z?FOKl6i4HSpP(zP!Y}G|3-?E3TSHW5`966Kmbs$2AkKMPOc{mMj30^3V;vxahBU_Z z8T@1J7Nx@#Q{Vx}Qkun22bw_ol09>Qt&Zpx{%@ru>(m~@cmqRTG6vJ9-I8H=os=@*{2{F7sYJ zKW(jI0s-DH^?u9e>$ajHliYa1(y6TijUzfDhVxZqP920IP6bh zSxAoV>vw18mgnP0=5OU{>8e?4+_e{aX=X42VEqV`stK&~b8XnpK+l_1qMDtv>ZM5$ z)8h*lB%Go+dw6hd;UL+Izg69_zQxJrs}OkU(70ELws#a=WO}>3vksH_wxEHmtG_`t zHf~=2;BFW_)0jRe_HDjcM!B@;7foyd6oB3F<=x$ST<9&ux>)1H9Y?yWP&(Q@$8|7S zzm`1$3eE7`;3vODY97)ObR^2Gk6FK{!1hrAUD=OiKPg4bxw=eNHkVAPJZ?L}`K1j+GAk&(VOub7u{(hzAIHbps@mSUK2=NnsgKIRS5JU0Uv(J;@&R@C@ zr_j3ZQi&0xeIy0BhwF*lzVL8ROje?LsH8!&e!frk83v+Z*t6LuaZo#ETCbgGA^}y{ z?#)--LRf0$URc}iir;pm+@VF}>l4%BIL(&rt6nNu_W+K?s#%Z2tW@AOGQ?^%Cm?PV zpmw@SC+5JpFzRS`i&x~0{Gy%@I&@_Z@+%wrGaA1*?>+4cFklhKjznB)FIibt0G$7q`P=$DjgJHJe~2AAXl#iAJCsvFvVvsx$UBJEq7 zj?A9~WeKB~N>*RkBs{upegPSPu@0kh+dtbj+!T8Da@0c6@dosac*0FD%a=`2_2t`0`_h*ICBBGTK8?r&&Dd4K9( zvlx9((n_`C`OV1E4JY^pmreiryldTsYXO)Ad*Jb!Dd9KIRw^$eceM#jQxtpI_paEb zdJP({f$o0*N?-;GvJv5)KR@m$52YX=9v+8Ve^Yo_Fv)vvSf`=Td)K6(aO_Yq5DQey z8_ELzQ+}jPY)ulZAICp>8?wnKqA88?Q2!zw5i&Etkzam| zS2lQJZ6)F|=05r#0<`!tWVJrw^OL=NGd~gEx1Ad%-KB6mB+3lzjjVGhW~+F|YS#Nl zB-xYB5k^0X1RtO_{h$}ik!4q~5+J5gfc-``PVP9??L#ckmuy}Pvrb7mBLj?P&QfxW zZ$q!;o_a8>6eNFwqhzlIOSeJs(27^y*@SgfbL2$la5u@_}trCxhUbJF-kA%%wLN0h)PN~(dO6=_nw=C6h0jc%py`(` zOy*nu?FDPLRc`>-5S6T+-uJBs8Q(e!M?{z#@w36jOJ(nJ(+y?HuQc_@n2FEkO|d}l zu_?VtS^7HvS&33+_W!;qHyjw8(M`avruUOAUVs3UtZ$_8F|+CdGQ1MyY1!q z${k6`JLP|37F;lj`Zb_*@4vhN5-3YNy-lH0=i~ss9%jd+B$vrg4|!}P?(Jxt9jPkx zM)K-MwJ?B_BA(B3P0=Qh_r7WhLI=6o_NG{sZ5A!$FVP*HCE0Mn**l-c-g4j_ir|`)rKD zoNQZ!J?KiQd%LDRk>Lbkq;O>zlt6XFDGvC;5{$ z^XmSbv;uJmQieo|=--Mc^8a2DEoUCb0UE@n_Ey=5r0Rd;Q}Gj(>8sZRUF&@XmC*YZ zM)6(r#W>sK4l-%I>{jsKI%HT5$uu*d@pko2bnF(<&^tX2>P%Csm^^=uCTW1dtVBuh zFdU>_cD@r6^M&cY>bW_(e3FgRLta=9DQz52c1s*k)w?Rs>QrGh{|S?6CNbB6E?`66 zVak`9L9^Ur>i#$kBSk0bh+it%w9dH4{6pq1p-i7YwW6nf20yf;d?7|2ytq{O$zuNR&B%*cMD2G+w+7M7#iuiC2D6`Sgqt*H*cEVWOBo@nN|FEJE8i)n)q7 zv`~xlchVQ<^~4Khjc8B?h3w|UgJoBdx!Zhuqwne6^v?={}Cu_XY*gWLfTN>@f zcKpW>5m4n{NSga}Ob_Jzu}BeA;MVh}O97%wsky_VVjwuYX{OxD53dd|4}4=(DUjoD zGkIBgI2H-d47qN$)vJSfN`)lP;Att1p)D_W@A}F^=P8tP@q_XkE z_~vn(@SH{9bd3lg2Ls13XbQqNQr;8jnTQ*h+SA5;>vjF?oulAs@cC>&6tQx7SK%zz z9;8s?AU%lnhXb|;?aSsMw{U5O6*sb#u+p9(A}@a)=cOp;5qIBu2aHH=hG&r_w5$Ri zAoEbgOnJmFfi;mAK%U^$b=efuEs$Fpp^We z)l2_L&_9O(x$E9ru{rAZ{Eb)H)C~m$ubQ~Rc2xM(}b6NLeS_0h{sz8G7{TIso|Lj2{ z3G8c#G|3sUdl^?Z$=(|)N55uZ*MJ~-X0fK3MTxBodiscOZP=nJ1Bc^X2G?|3*Ig;7pyQx~a zd4P|EvuIGxPAzm*6uJ_`81{I7Kc(BUk~{%8ZlN)ZRVdZF&J(e>5VX=>ep&j5W06L& zUcD`L`uQI-FAi>UAZT=4^vkt%FK268D6E)5IU~61N-t)3#q-C?E$#mKXDeBxIypw;a+?idYP99LpXm)`hm$CaRaN% zYdT?|n$%s4j;{&s`A(1~{9p zlhGXLR$N3;UN*8++3=B+#z+@t_-JLLD z4p_gh>2pESth_JYJ;B6rA;JL_EIrD(urisJ6Edev)5N4fN- z{2lt(Yd=V!F5Mv$S!sck3c;y+w?*}@Dm`X(zW=BlqII#H#wFgGnp8*T#+w93D3}f@ zrKcWu%1*cbW???-H7Liz^_ixFdgC+X+o=YK@?Q!(-huU9{uZdy6PxEsbLv*Di!o|U z?C;SW$D{Yvpy{BqN1cTknW>)HfSr^35YK|o$GMhxjw0@@ts<4?Zz5I_TGxb(zT+GB zffoN6QAu@T9F&q~Jt^|J9{A%VQxqb(;%t4gkZ%Vsa?e@&%I)%sn*kAj@thr*Zph+w@^3tod%>)Fw}#l7G5P>xc!*tHwCbq){Ocv%i>ejRunVSu z(FsQQ9WJP90%@D|Y~bh#pF{z)+}0ndLC%HLb%urgH7=S2cY|cV(L$}h%A-0xszE7P zd-%tld-yD#&TeBeyd~hofy!_A|9IZ2P7)`?vKuL`3PUU#@T{#ct3EqmND-&Ugj9((S~Wi(P{WZ!)z?-JnsJE=B!H3*escbjbz z6YcdNL z6?8QO*KC~#1PfK{DckEhP0rCxmVY)R_b<@w2V>84^gUnUH6hzF;Q6YgN!#f|O^aCN z{c`X)W37b^< z;A+cN1E<`=f?_DD0?O2xcXHWU_zfPYG%3D|Vx3onBkI5r9vfKqO5H!8BQ#L}=)4g~*0uWu$w5 z=wzZ)qm~zV-G`m?cEZ?dchx`QswOW+@A^8}U0nG8LaoyS>t|)~$#PmF!@!2Y<^A6% zLri=Q*`H`Vl9pPZ?o`CMudfaKkQW?|L1$Y4ylM zY$yLr``*`x$(D49d)hR%76zMMd>QBB?~qQG3a1wXq^OP-Q=4lavJ$O!OKgM(nwDT( z>lMCi&kev2Zd?=&YWM7z7|$i4#00^{mB9c|ExMTZ0x^Z@ceYor#VHd@P|+Sv52nH@kFLs* z!)SBa&q}E01tLz?^4Dp4nFD9U4)P8IH(kb}(AUzHc{$gXZz8fR< zkJ3+ap8DPnASqBM0-Kx7F?v#sH%Ne=mm)&yhgy`WcB@R!xSJ?42^Pr;;VAE=p;-2Bi z4xJ=OON*RoBuhqV8n3{21``h5r<4{igZ! z4!9ABl z<=#2%8w?qJ1?n^L^q=Cb>WP}3s71WwP5A7S)p0u3u&a%sM1@1jIh$CNKo8uYrgoGID^Z^#Og_}~+F3{-0r;bn za~RwtU}fRTquV@D=z`{+VOifgz__dll5gWUaMh@BAQ>;`wXFSx* z{~VSZ52*VP=-L1BUOB{2kP9h1wZQQ$h2g%eTf9RV3In^&J9n<3Qs8+O7x;vG@b658 z56FejEj$?>3pZOdEj@C>YiuBy$crq$I8FG{4v-)@US3)!JNbItupA=_JLrY`nGD~2 zE(Jp(bSMgVoN6V4?}hKz_A}dPotPf{%Mx6xd&1NFf_@T#ScS8HL&QuCB5eC>5iOXd zfIlTw^t@s1^j$K1`LAxLKhZu_a5!+f02mFV+9YXzKs~GU&asv=Axzo%fJun-aY`w^ z8+y;Kl=&}Dn1qWI(b?-0-~)u+Tx`2YCmGYd=S{6xfJ4qiLH+|~6LF0z_sfyfD&+oO zPe{g-&eW{mr(;&%@z(5B62XlO+39;88+kGOi>oD{I1moEIcHW@<%~VHbhh$-oNH6pW3NaB>>DoSpJW- zf&&67@~GHDJ~k9$5iFMrqCaM_HQ}1FM()k{PeQ0o)4(=2B?>x+AixcF*Sm> z4~yhjWHXlSNo2RaIL4p#WAoJoaf0@js_q9)dZP@qyz89Y^^P3F3M=bG&D$kZvO-g6tEe&as;kq|qF70eU7}ekbnv=W*K#HY+ym!qL zw$GR*B_Gbp{aK1OdeZgo2l+jtM`DC}?#K#_r5bBYX1(qoSl>=JTe)8V4YS zO%GeqQ&_g*n2Rb+-^iN|qnq{Q-Q3hRZzMlnePHh}tNY&bD61{+M=*0C zHR=?ZdT!-{Qo<5MD#II=NzwCp_-Vj46k6l&Dt&i?c(itG{(t67aPUFH$C)hrF?SN@ z&cofh%43cXz{iX7{fEn5;r&Mc;)_sV_=cT;m=NH;kTO<_QTx9Q^Z)6_kdppge&c60 zp5mak_=-Rv_)UawtF*OMJj@!i7IoYeBd#*;B41eHz?L z_8u{~1ie^QGyhS5u=eYVAb#yP9go&XeA2H@A6mTQJPGf*{Z6>lbCY!4b`*?A*iY#J z$8s9{37(6x#!4s|4y;dN&t-_YI(R0{AT%US%2?A*5bv9K&@j|Qyn4{PZrQOp()rWx zhk5!V-=2Hr$O0+AhKFA|W2%v{L7@BWAw~4W>r9w*%+CRi&Xg3*W|DEa8{NpjxnA!S z2?fAQGmHD`QiOEXp5j+7NRBbfjm>KN3gj16<^bWLOYU(nmCjsx4itLhTdS(#eAR-k zo=@Da4kq|Bqq`4A6-qO{wY{PfEmWiF5Fzto7V&_-`7wMkgDMca91i=TBM#lLmlPQS z*`KElwIY65wFhvG+1P9WOPDiS`PE1g$l1t$-u|z?o*MX){!^y+hoUC>;vuR(75vhW z8%hHY9DT`5syqCN?$^Ux^bQymW|Wv_SexB}*FL#VFUi4FxAb4G3*EWvDn?9q(?W@X zhS016#`3EIbEL+fnDJ1)L3i3FG**_>&Pu7RTyhs_`eN}my7Dk*PFSD@d*h2@Rl^e(QWc;+wV0^1rXVzML9gfaoid&S%zgtF ztX7uM{XO}+ulskX`M#7q_8TlIR=}IQH*me{g9kVbKQ$0{&*1C|fbVHGQvazUDo?TS zpwN|s4y&j5L~DJu5Rvi2dZrG zvOpU;eZjp-VCijyLf-yD+U6c1-}rYc?3FU?CQl82V)tR{pDa7Ph^hVL?Jwr$HRXU0 zVuWWglliaHv19A{E)!()SCsEHmGi&u{6)sAjMPi#?6~*S4JWnF6$8*faQ;i^_IerBAnQ^yfuQRhZQolk$<`Nh*xMyUFAAM41zBD42Gb|z%pbgL~n)Z&5kR| zxf>oUZw4njL-bt+Mi*^Ng`MT5pAawS%`7-DUtN-((G|GWw$9h!(`lEtF-PW4t=1W! zTHlihympcp`G;?lJbUt2+pc_x%TYw*jKb@_u0d3po^5~@GNizZa%W17+FjAiPIy*t z_6G2-6oLR9?-BFJpl=e_^+sU0-T+O zv$T2F`{bdU{^S!M4G}gM;93^U#acGFZ{#_3Fo}KeE(@o~Q_K76 zz)>;y3~9tZTuinF0^ILok4p#}k~PE^Nkt1<{06S-44K-p-wcN8nzYXi$SmG}yytq> zyRO-58QjwqBobK9X)t>$pAe0!#wz=eLm-U$OAwBEw#(N6V}^YVV&hvWI`}Lq-}0hi zy$muy9jfKIl1J>r?d2t)9_u`PX1m<{jnGt%m7E1u4DgQ;nYtP)Lb4d! z=5{}+7xED27&0L43b+96qMtR?K+I$3)XavzJ8MSgbEkP^@2>2RP_}&G6sYWB{Gjn> z*Os7za2FHz(%Ouo#IEAQDEF7_PK4VlD`MV$iOj#{X`u0-WKU2Gm1{A8<7vN+x{0TY%1 z%QbcnT@1gyDD7#eCE<`#^TETsYV47h=ndx8eMbrz=)S!8pqp%Rh#R)?GIalK^5EL? zrG^CvZ}5Ack7*CtuSm~2Mb}33>GNuB&c+WX$*S$A{Mx>)W=wPIEZuMr#$g7z&m~^t zp6j#hzDG9O)c3R5qiG2)*;5SD`Bvvj5t8ZoW=BH{jRUM^2uNMz9Y*UeJ@_7Dy&6gL z&FRGzMH~I}M#|2|lVNdbWi`%t=yRSz(AV+(Eb5_X_$3~{)J(3lI_fc<3gmt7^>>|g~%BUv7Wzt z*#O@wY!d5a`qe!a66?6HyHOJ>)@&zriMUBzY z06)S(x98A6xc1J=IU@h@=ZNQx*A)+?rj+-RS9uU?E!z~}?rFq9MaW^%phxo!VriPL z@5Jlr-v-GH@V}1H|9$@~P$e@;>;xqHLEIz~o|UJDG5b7!f@;A-Da~jM&OEYyW*}Jq z)(`=tF3Vb>QfKU9=i#IH+1}+9tT#k4XS=rtQ@xxkm%n|f88R4{ve_s#OS;*gJQ5W^ z?y#}*aW_PC>kRw=-1rjhFa0d5D$_H+g*8MG=^#1|JI%Q+y5Iz2U#LY@IGJf4ebSS9 zC($sIY@w#c(JUug+0eR`H_6d?B(E_3xanFbBGp2QV}opUl!MDca_$w5HpgEIS#K0; zTN{ymC_?Z^SkSq4WiJ<3;Sbr-+A!Lt<=s|lHN>7!YgaR}pQ6mdhZ!iDn!FdjDj=WN z9OV#Np&FemwjKe#|4q<}A?rQ7`znCwd z)5Gn80X6!Yo8zj7i(@?Z*;jE?m{_h4_8VJ|fXmfH*qtTOz6)AYw?{B8!2UXg|J|Nd z06o@UtVV}?^~Zi-BO}sNtTVM!SiM>U<2(ScVI01QxK4EWJftzjblN;bMWQ7_@O_H| z7js#(8RELig~GBh$Z}eKp1$NXe8SC#fOgFPp7Ff%AmTmatwXCNFz>P9r2vXZm3z?g zm^-kaXyb#r#ow^|*g13Yx;O#(B0>XhEvu%G2uSG-|3E(btU!YdJ^Od(o)7^LOl1$V zyP+S2dBzdo>6X~(L zZJ=V6Bf*%&O!KFL#`gk7i=a^aVGSQmNfMHZ0cZ6fr-ty*?{7S&b9*1;uBCA;C`_Dm z8?v(s9{iF<)tR;mYX)ZF3)d1dI@1^0NfaC&)xt%F4J@g{*Ymv3?8n__0I_)~v$%`0 zXuRRI=XCe5^SGnI(zU~|JlnjjCojpTHozznn~{=SShaD~C&84R_Ft&(zic5^-^1x! zY>tcpBeQ<5~n)DYz3oJheM11S*#%+7!$C z7^86twN8dJrzvrMB2sjyk|OKPFNaoiwXdf~Brm4*i_fVZt;}d{8+nJz0*O?f&Uve% zPeh@k_0SDi7wOjV2^+2`wO zJyRNdpFI7p3s;jrK}_td{$zB-U%mu3O;kKEtaf@4(0lDJ#s!4}b3z~{3-jTsR1utl zUqeVFOvadTs^8dvodO@p$0kTJ-VXq$ogdS1RYtf(RC97A&nr%RmSP_fo*{WB9X4#65S+Q@ zC;T;{L{759q6%<04#HJXJ+396$vpqFS;wAcy7$HzQ{g`~bdqnC3LRXkp(%r$g^;gk zfo?4lq+$^4H;F+mJh&S~jT?e`pfkK3{otWm)MQ`7)zeJlihw7RB~-jQJ;pO%+Sm3_ zCq>v$R-{IXU(+L*MSzYUT}w-f#vM$Gh87cPoxMv;Y;eZO{`|g0jZ5T}1G?mro6X15 z|86f2XJe3(S>Y?-`x68*@&1)A06IIC1xn}4&kPvl=1)^NZFezLJkj_0ja0d?AOA-y z=gHtI0Dn@s0<+LFUJCPI;`(q^a*9h|k+2aC+2?WWDR>;6*!G6bu)WdeJAnzdHP|GC+z)F=B`#^7SMToUv*(+XyOG`>|~XitC`ZkDDpUf>(4N9W^qfNzl0a=8lOexrEF zt^#K)$^&mb+QyF0=~ZmncB~#f`j44g9ZI#i+twU*@8e?=nZBcVGSJr?=Q{IU(&Bz# zk5Ib#ko!^|&W~PR=h&5Il97at0Ir1KKyj6uj*_ZV^F$XN;wHt$G&|mxx8nRfnvm4l zh1ku;D}JXq&A}5wbxD%s7U=20bn^GlTbMg^Tk8blZw96VF%f80oLQ#uj|0xpBLZrk zI5BAij025OZ6xf4r{{Q0{@)#wdW4056ON>9w>M~RzgzH70Rjff)e*o{m${+j-@2dY z#AfXE->&NO&$Q864ZU*J?x!-%axtW$RnpsxB2EsxSLfT2c7$4)3RSe@r3+cKcA7qu zl)3v6FGk#{YJQyHmBCjVBe-c-CKY;4R!n9d{C}Gwr)JCASQ~rc?%cl@n(B9-c`3FB zJOi-iHmkSG7W+A7j5p3CPx+BtrKj4Gobly`{HN!NpJ0P!om_>_KKKZC2_4wy*A^U= z1S)c8f12B<^=#Fq7?mu6`ECo{{+8YP|7Pl8#%GJKl>NC;B6vG6^4Z6m(xBxTU3#Ib zfGe&)dxKV7H~PKd-z|4vH!(Zt?cK11U3zAh9bBKEIJls`sWUY(c<+;+pN~I(0qjcG z{av%XQQ-J#qq|>ag6HKbUr5faSy_3>#r9C{f=6E;0|yFA4Eb-YdGYK1n)w#n&Y8ZM zCu+@h(G0Sq=-Iq;{DOhCkZs}H_x=6ne7(72-kv7Uyv`1}6IojiO^>g;xuWOk`ZQqC zzUa5W*`W7{CFc^lI_Al-h4{z0c})PVwm$xBrqj7u|8meD@)KWE4?j+tqeV&mgP&1 z-G5AYd|4as`m;LQ{c$Ot{Nh&eUBxYH7rAIpy<|K=vKhFlcpZ27j=gH2kVsZzf{qKU zD!aC|V3MdQu#Y{duY1jmlfX4|zc)mu`8fc`PF=oObT+)&!prG>XWFq~yJOF_LcYp8 zK9dSw4U-qQL*?50+qyH}vB(?-7Hls5j&C&g&k0*T>knvFSDR+aytv>C z@AF%33re<6zt~m~D=e`x;HQQHNR{C0OyN0=T)@?&)3|N7IefDTN&KD=_j(d&?g+G6 zEl_xhSxfe|gzur-yg;6v{OQ(l`8_eUuW!G9zdr@I%;Z(V#q{lRKq=Yfz`bJn`~PeT zlsp}OHpqDC`^omlc3Rm*d<1$2xbzgfY^@`y?#p8NtG}!dfcI==cw1FyaV=wjq?DP9 z6jtfXV1gtC)jv+_0v^CK8(;a1(H!u&w-|_FJO1uLeJmX b{GY2VAmMAck7XS2Od$qOS3j3^P6Naama: Should we also include instructions for doing this in the services console? I can write that up. + +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + + ![Window Start menu pointing to Run as administrator](images/run-as-admin.png) + +2. Type **```sc config diagtrack start=auto```** and press the **Enter** key. + +3. You will receive a success message. Confirm the change by typing **```sc qc query diagtrack```** and press the **Enter** key. + +4. Now attempt to [onboard the endpoint](onboard-configure-windows-defender-advanced-threat-protection.md#onboard-endpoints-and-set-up-the-windows-defender-atp-user-access). + +For more information about the telemetry service used in Windows 10, see **Manage your telemetry settings** at the [Configure telemetry and other settings in your organization](https://technet.microsoft.com/itpro/windows/manage/disconnect-your-organization-from-microsoft#bkmk-utc) topic. ## Configure proxy and Internet connectivity -The endpoints must be able to connect to the Internet and send their data outside of your organization’s network. You might need to set additional proxy configurations to ensure endpoints can report correctly. +The endpoints must be able to connect to the Internet and send their data outside of your organization's network. You might need to set additional proxy configurations to ensure endpoints can report correctly. + +If endpoints in your network use manual or specific proxy configurations to connect to the Internet, you may need to configure the Windows telemetry service on the endpoint to recognise your customized proxy configurations. + +You can use GP to make the changes for a large number of endpoints (or across your entire organization), or make manual registry changes if you just need to configure a few endpoints individually. + +**Use GP to configure the proxy with the Windows telemetry service:** 1. Open the [Group Policy Management Console](https://technet.microsoft.com/en-us/library/cc731212.aspx), right-click the GPO you want to configure, and click **Edit**. @@ -69,8 +132,36 @@ The endpoints must be able to connect to the Internet and send their data outsid 4. Click **Windows components** and then **Data Collection and Preview Builds**. 5. Click **Configure connected user experiences and telemetry** and then - configure the GP. The GP accepts a string in the following format: - ```:``` + configure the GP. The GP accepts a string in the format ```:```. + +**Make changes to the registry to configure the proxy with the Windows telemetry service:** + +1. Open your preferred registry editing tool. You can use Windows Registry Editor by opening the **Start menu**, typing **regedit** and pressing **Enter**. + +2. Navigate to the **HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DataCollection** registry key. + +3. Right-click the key and click **New** and **String Value**. Type **TelemetryProxyServer* and press **Enter**. + +4. Double click the **TelemetryProxyServer** entry and enter the proxy server you want to allow in the format ```:```. Naama: Please confirm this is all correct. + +In some cases, you may need to configure your firewall to ensure the Windows Defender ATP service can connect to our processing servers. The URLs for the servers depend on the datacenter location you chose during service onboarding. + +If you chose the US as your datacenter, you will need to allow the following URLs: + +- https://us.vortex-win.data.microsoft.com/collect/v1 +- https://sevillegwcus.microsoft.com +- https://sevillegweus.microsoft.com +- https://psapp.microsoft.com/PSApp/SubmissionFEService + +If you chose the EU as your datacenter, you will need to allow the following URLs: + +- https://eu.vortex-win.data.microsoft.com/collect/v1 +- https://sevillegwweu.microsoft.com +- https://sevillegwneu.microsoft.com +- https://psappeu.microsoft.com/PSApp/SubmissionFEService + + + ## Review errors on endpoints with Event Viewer @@ -89,11 +180,70 @@ For example, if endpoints are not appearing in the **Machines view** list, you m 3. Events recorded by the service will appear in the log. See following table for a list of solutions to common errors. -Message | Action -:---|:--- -Windows Advanced Threat Protection Service failed to connect to server at `````` | Check the connection to the URL. See [Configure proxy and Internet connectivity](#configure-proxy-and-Internet-connectivity). - Windows Advanced Threat Protection Service failed to read onboarding parameters. Failure code: `````` | Check that GP settings are correct and there are not settings impacting permissions in the policy. -Windows Advanced Threat Protection Service failed to persist onboarding information. Failure code: `````` | Check that GP settings are correct and there are not settings impacting permissions in the policy. +Error ID|Message|Action +:---|:---|:--- +1|Windows Advanced Threat Protection service started (Version ``````).|Occurs during system start up, shut down, and during onbboarding.|Normal operating notification; no action required. +2|Windows Advanced Threat Protection service shutdown.|Occurs when the endpoint is shut down or offboarded.|Normal operating notification; no action required. +3|Windows Advanced Threat Protection service failed to start. Failure code: ``````|Service did not start.|Review other messages to determine possible cause and troubleshooting steps. +4|Windows Advanced Threat Protection service contacted the server at ``````.| = URL of the Windows Defender ATP processing servers. +This URL will match that seen in the Firewall or network activity.|Normal operating notification; no action required. +5|Windows Advanced Threat Protection service failed to connect to the server at ``````.| = URL of the Windows Defender ATP processing servers. +The service could not contact the external processing servers at that URL.|Check the connection to the URL. See [Configure proxy and Internet connectivity](#configure-proxy-and-Internet-connectivity). +6|Windows Advanced Threat Protection service is not onboarded and no onboarding parameters were found.|The endpoint did not onboard correctly and will not be reporting to the portal.|Onboarding must be run before starting the service. +Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md). +7|Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: ``````|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +8|Windows Advanced Threat Protection service failed to clean its configuration. Failure code: ``````|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +9|Windows Advanced Threat Protection service failed to change its start type. Failure code: ``````|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +10|Windows Advanced Threat Protection service failed to persist the onboarding information. Failure code: ``````|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +11|Windows Advanced Threat Protection service completed.|The endpoint onboarded correctly.|Normal operating notification; no action required. +It may take several hours for the endpoint to appear in the portal. +12|Windows Advanced Threat Protection failed to apply the default configuration.|Service was unable to apply configuration from the processing servers.|This is a server error and should resolve after a short period. +13| machine ID calculated: ``````|Normal operating process.|Normal operating notification; no action required. +14| cannot calculate machine ID. Failure code: `````` +|Internal error.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +15|Windows Advanced Threat Protection cannot start command channel with URL: ``````| = URL of the Windows Defender ATP processing servers. +The service could not contact the external processing servers at that URL.|Check the connection to the URL. See [Configure proxy and Internet connectivity](#configure-proxy-and-Internet-connectivity). +17|Windows Advanced Threat Protection service failed to change the Connected User Experiences and Telemetry service location. Failure code: ``````|An error occurred with the Windows telemetry service.|[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled) +Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +18|OOBE (Windows Welcome) is completed.|Service will only start after any Windows updates have finished installing. +Normal operating notification; no action required. +19|OOBE (Windows Welcome) has not yet completed.|Service will only start after any Windows updates have finished installing. +Normal operating notification; no action required. +If this error persists after a system restart, ensure all Windows updates have full installed. +20|Cannot wait for OOBE (Windows Welcome) to complete. Failure code: ``````|Internal error. +If this error persists after a system restart, ensure all Windows updates have full installed. +25|Windows Advanced Threat Protection service failed to reset health status in the registry, causing the onboarding process to fail. Failure code: ``````|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +26|Windows Advanced Threat Protection service failed to set the onboarding status in the registry. Failure code: ``````|The endpoint did not onboard correctly. +It will report to the portal, however the service may not appear as registered in SCCM or the registry.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +27|Windows Advanced Threat Protection service failed to enable SENSE aware mode in Windows Defender. Onboarding process failed. Failure code: ``````|Normally, Windows Defender will enter a special passive state if another real-time antimalware product is running properly on the endpoint, and the endpoint is reporting to Windows Defender ATP.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +Ensure real-time antimalware protection is running properly. +28|Windows Advanced Threat Protection Connected User Experiences and Telemetry service registration failed. Failure code: ``````|An error occurred with the Windows telemetry service.|[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled) +Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +29|Windows Advanced Threat Protection service failed to read the offboarding parameters. Failure code: ``````|Naama: Should I remove this error? Or just leave it as internal? +30|Windows Advanced Threat Protection service failed to disable SENSE aware mode in Windows Defender. Failure code: ``````|Normally, Windows Defender will enter a special passive state if another real-time antimalware product is running properly on the endpoint, and the endpoint is reporting to Windows Defender ATP.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +Ensure real-time antimalware protection is running properly. +31|Windows Advanced Threat Protection Connected User Experiences and Telemetry service unregistration failed. Failure code: ``````|An error occurred with the Windows telemetry service.|[Check for errors with the Windows telemetry service](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled). +32|Windows Advanced Threat Protection service failed to request to stop itself after offboarding process. Failure code: ``````|Naama: Should I remove this error? Or just leave it as internal? +33|Windows Advanced Threat Protection service failed to persist SENSE GUID. Failure code: ``````|A unique identifier is used to represent each endpoint that is reporting to the portal. +If the identifier does not persist, the same machine might appear twice in the portal. +Check registry permissions on the endpoint to ensure the service can update the registry. +34|Windows Advanced Threat Protection service failed to add itself as a dependency on the Connected User Experiences and Telemetry service, causing onboarding process to fail. Failure code: ``````|An error occurred with the Windows telemetry service.|[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled) +Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +35|Windows Advanced Threat Protection service failed to remove itself as a dependency on the Connected User Experiences and Telemetry service. Failure code: ``````|Naama: Should I remove this error? Or just leave it as internal? + ## Related topics From 70a036d9d0f996da817325fe4042f606b1bd17b2 Mon Sep 17 00:00:00 2001 From: Iaan Date: Fri, 29 Apr 2016 16:08:08 +1000 Subject: [PATCH 122/439] update author --- ...ot-onboarding-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index c8d092ff74..339f657d3e 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -6,7 +6,7 @@ search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library -author: mjcaparas +author: iaanw --- # Troubleshoot Windows Defender Advanced Threat Protection onboarding issues From f680c11c9d89f858c0a4873baf1e3dc0ac061011 Mon Sep 17 00:00:00 2001 From: Iaan Date: Mon, 2 May 2016 16:12:12 +1000 Subject: [PATCH 123/439] updates to onboarding sections from Naama --- ...ows-defender-advanced-threat-protection.md | 26 +++++------ .../keep-secure/images/sccm-deployment.png | Bin 57015 -> 16071 bytes ...ows-defender-advanced-threat-protection.md | 5 ++- ...ows-defender-advanced-threat-protection.md | 42 ++---------------- 4 files changed, 18 insertions(+), 55 deletions(-) diff --git a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md index 11dde6b424..332166ff68 100644 --- a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md @@ -21,37 +21,33 @@ You can use a Group Policy (GP) configuration package or an automated script to ## Configure with System Center Configuration Manager (SCCM) -1. Open the SCCM configuration package .zip file (*WindowsATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://seville.windows.com): Naama: Confirm package name +1. Open the SCCM configuration package .zip file (*WindowsATPOnboardingPackage_ConfigurationManager.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://seville.windows.com): - a. Click **Client onboarding** on the **Navigation pane**. + a. Click **Client onboarding** on the **Navigation pane**. - b. Select **SCCM**, click **Download package**, and save the .zip file. Iaan: Need to confirm the UI for this + b. Select **SCCM**, click **Download package**, and save the .zip file. 2. Copy the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. -Iaan: Will confirm ui for this +3. Import the configuration package by following the steps in the [How to Create Packages and Programs in Configuration Manager](https://technet.microsoft.com/en-us/library/gg682112.aspx#BKMK_Import) topic. -3. In the SCCM console, go to **Software Library**. -4. Under **Application Management**, right-click **Packages** and select **Import**. -5. Click **Browse** and choose the package that was downloaded from the portal (zip file). -6. The package will appear under the Packages page. -7. Right-click the Package and choose deploy. -8. Choose a predefined device collection to deploy the package to. +4. Deploy the package by following the steps in the [How to Deploy Packages and Programs in Configuration Manager](https://technet.microsoft.com/en-us/library/gg682178.aspx) topic. + + a. Choose a predefined device collection to deploy the package to. -Naama note: If it’s a package we create then we’ll set the necessary privileges, otherwise provide guidance (Omri: what is the necessary privileges?) ## Configure with Group Policy Using the GP configuration package ensures your endpoints will be correctly configured to report to the Windows Defender ATP service. > **Note**   To use GP updates to deploy the package, you must be on Windows Server 2008 R2 or later. The endpoints must be running Windows 10 TAP. -1. Open the GP configuration package .zip file (*WindowsATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://seville.windows.com): +1. Open the GP configuration package .zip file (*WindowsATPOnboardingPackage_GroupPolicy.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://seville.windows.com): a. Click **Client onboarding** on the **Navigation pane**. b. Select **GP**, click **Download package** and save the .zip file. -2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the endpoints. You should have a folder called _*OptionalParamsPolicy*_ and the file _*WindowsATPOnboardingPackage.cmd*_. +2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the endpoints. You should have a folder called *OptionalParamsPolicy* and the file *WindowsATPOnboardingScript.cmd*. 3. Open the [Group Policy Management Console](https://technet.microsoft.com/en-us/library/cc731212.aspx) (GPMC), right-click the Group Policy Object (GPO) you want to configure and click **Edit**. @@ -63,7 +59,7 @@ Using the GP configuration package ensures your endpoints will be correctly conf 7. Select **Run whether user is logged on or not** and check the **Run with highest privileges** check box. -8. Go to the **Actions** tab and click **New…** Ensure that **Start a program** is selected in the **Action** field. Enter the file name and location of the shared _*WindowsATPOnboardingPackage.cmd*_ file. +8. Go to the **Actions** tab and click **New...** Ensure that **Start a program** is selected in the **Action** field. Enter the file name and location of the shared *WindowsATPOnboardingScript.cmd* file. 9. Click **OK** and close any open GPMC windows. @@ -84,7 +80,7 @@ You can also manually onboard individual endpoints to Windows Defender ATP. You ![Window Start menu pointing to Run as administrator](images/run-as-admin.png) -3. Type the location of the script file. If you copied the file the +3. Type the location of the script file. If you copied the file to the desktop, type: *```%userprofile%\Desktop\WindowsATPOnboardingScript.cmd```* 4. Press the **Enter** key or click **OK**. diff --git a/windows/keep-secure/images/sccm-deployment.png b/windows/keep-secure/images/sccm-deployment.png index a72c7eca69fbd3f245094e60db88d72493261b42..99d9b858d8b93b02c0c692cf5196c120e19966bb 100644 GIT binary patch literal 16071 zcmeIZXH-;8(C@oZ0R;rfN*V!C$s#$95=9gwgXA0}=Qslb0+K~QvLwk_a?TkX9gWt%@+{UBAgCOX(>!Ze4w&Y-{S|YT#f3>DXbey5s+IaSKNyD+AEg0jg^L z9s!zfUNx&5IM`U&m_g0dD}kU5_us#Fb}%x54l#b4|FxTht+lm@jT3a#AKL`laIU(k zSU6dkKsh@id)k5jJpPzdL#c|z2F$dD)L3gqI*NEfel=2;(p{P6nCmlBJg z1f*{od?LtsvkSxRO|NVDb|WutceQ57J7GgPTfQp(Y)mkFgQp86f(1bbKcJc`n-ktT z1)r4e!y)Jy-V!bZz3{yN&CHQ7FjDOO>kyRr3;{ttWZgs%6nX7`+^wP2}uM3;q2_JtE>C77hKZU_ooXh8(V*O_lp-V^pR($SFc0e{4)u6_tPXn$BE5T z)G8_Q8JL-s(G!@78pqYpd)#bQ-^fCZAe@c;7j3l-cZ?#RCjRL-P%-@kTa>iXLRgoJ!| z31(+!Yiep@VaC8DV7yAXDm^_t;;}a5NbS zi34iob@{e*MpRI!G~*D8-*)z3Z;y*AY)eW>iDU@%wovWy9V)7~+S>gnFD0c<5fMcB z?99xv`J-i&TQfg?yh#&xd6O}Gmx`)4Tmy8nlz;iskaI$@RxruLFCYUy@Chp;jl6ki ziK2OSb6M!HIT_*bs3HW>gnz#58bTa#^Yd5jHeqJ1Jguz@)$&cQYXa-uyLS&f9maHG zMrmVHQJ_ZL1I<62aB*?rmNHjqtz~Cdviyg9^GA+K9;H>NpN*2mD2W=yu7I^?sUDoV|x&>&URvCWHag_zqs-DK%v_5^0HB9D6y@e`~Ffm zt?&~BHbnT^5RsXg`QYJ0ykqUs+?#rObM5VtE?l~LdQBdOmidkkVvn|`x^xTlnh-7T zv0GhSa&I-b^pvruhfsd%(cCN9cOJst1rvkG!u&SV zZbN>J`@O7S@>#`U<5Tzt1h~7qi-N&fU5c=>vWkc#Emj}TA@$afY#Jp#17Y|vH=~av z$tWmHD_&`6Xh=)r2vgK4ewktWv%TG5Im$Bq2OlE*xah7sOYz{*qoH{2z+^8hs98}T zP4fTvgKju5A{2fTedQv=7tYkBD5*WFXd&p2#+7*?CH)Jq}>2SE{?)onqN%=SkRhQH_RpKbL%6MNOIV zrDl7#Pz0}1(uJf-TH;Og*8GJKBL&`cW+7T zq?mZMWa$>vJ(#sRG$&HtUE1oW5x8#4z3aHn4*8s~)}kYhIWKIF;7^xq0whO1NL|j? zNH|no)BZeXlUOADZlx;THjgz(sgt~P+(Jl9YbJmDlX&W&g+oxc?(ann?e7@-gWtMc zw}}{p5DncayA;<;q*II7Lb>)r!+Er8b!Tx#$t5jbfIv2sxZlU)z~8l3y|9bCo5&JJ zt^28t{P^8e$KfRroOtm()q(#;GoN#3S@#!{k4H_vCijWF9~%<6et%9(N2+OFz*vz! zCHj>#ZWCE@>K8j^T0{L4e^#ujeSXEZ*_m0zSIWLO=e^LLw0G?fd}7@(a!LDFU0O5N z7R7H;2jj_0YqR>qq^(U9zv9ggb92PO&?O|EO%}jd=UXJJ-Qspw8&)af*qzM6$;a$L z(lt(*!7MrDjad%Z)VSOoWDhBRjgl8I_wiQ{Nft8aFqTb=XAbUIew0WpV(!y3MT@R| zdKadr%9FxbfX=$;#jIPs~x*&in+UxE@N$ z81P1k&Gb_A_RKp79m(daO5##jeAcGPT0dzE3=Vo>Qkunj<|Hp6Bu3E?k>XHz+10rp z^sbc==AKGoP(WW0a1r`tT(l zWpBjdc*xS3XoT3IHOiT-`CY6LNzmdQr2zK zd$C$DVkCFyiqZ57)Gu}HG0j?1y@u=DqRI#@K*y%qnpe^(1@-Lj21vILX*1Pd}- zxH#RjMjc*R!$t~em#lyX9W|e(!ko%*aq3+E_U>4;F)Z6)3)J+bhLvS~8R9Hbk98@N25&^c;pfUsbG0{DBPDb#BGgZtloj_s6~N z>`NQr-d$L9pNr$oxVs>k-Tu|mbjc;hNwnct<4L))Si{oJNPt6rA=}FkHBw^cR->Fn zdujF6rBlVXwssX2qTxDIk6cNi+AM|D^q(UcJLrC09eV@CuP@U;LwdT98hxpD$nlPN zot2jQ@~%N_4z+ZBJj)0ZF?}hIqkoUev8a3sBstGXU@mI zb|%_i!v}cCu#5CJwKcUu)EU{nv-YEd`;K>BHr!uWLakC#HGQtTg)UqW4%PFW2?@Qm z>!3FM`@pHI1DQSQo-x9M`)>2ai7HC~OC$?>@A1mZh9B|K$M8^0-amh~?qW2uEnTC9 z^+RFjv`(R+OsUwd|D{Om@Fenam2!FH+)Ba!MushDUJ={fp`x6Q}yX8QzWcM4eVEHb6zk86b3~Q%a#g=n>G~{-7`0Q5a~gp{aw8?H`SN>(L`|p;grz9b+f^USU$>aB*@~g zgKO;H{ln}^y2RD(T{8U|GIQ}bFxUDh>b?AO^|tA|&7*zsN)1>QM$i${W+J+DdDW-n z<@ZVs&xGPCeQ#|+0Y^lr#~W}3=&Rm;e0Hm@Sv!fTS~YUu$7<$VsBoy$Gpib@(}0b0 zfZjPcr+qUw+`lejA8qXXu62z|AQ|h;vKgP;Rw3D3{EZEU_k71M(2X#|S4|6X2f-7QFGod+{K6EU7w{+cV`CD?rc zrxwCXJg_<>OPoKzIr1H2K95)MeiWYMj@DtYtev@g(39a%m9B>d@d$*a**Y4i8EwCR z*#&|=2QT)*{K~zjlI*UmP&1Q&JL1mp_jwK{F0mfgc9T>OEFZ+m#VN6vVdeDeH8_f_ zxOe6TWJf-j3IlUSdx?XMh<_+Z(Gje3s2a~q7peY4VbAiP5Ga)za#xU&bypmISNK>* z>!Z%^bLrLFE1SF0D~Xwyi2|`?twkj4{FuR8C_An0-R0X0m$QbW0b=&M+Uj?*LK$!A zg|hV#2_rFnL55zK5pq-PbeW+zaQ`!;qDY(GY~W9Ocyr575jP`h-{;uaJf-LRxUz z2*Il-56M;YdsnswqSd<@e!Z-;qN&ISJtr7kmW!fCOA$Fk^Enz@{Za; zOi+}g&IT8yoksfVP)rQ#gg}Fsj%H1|_bb+KPfEXrAFL;od680wl`b1<*IO2As!D#A z7#0~q)qbaW&0sN^@8|KZizz+*DUy8%RnPInrd$_Hm59)Oe%kP?_q^gEwRd4koZOyW zUbhTLEV*GW%H@y&Yw^kKOoKA2y>6;+zpdyKO!A_!q|Zk57woa>^zr=ZC?fX+B9qTOfd5+D2a&C^#utAR$=P~UY z*<H@1RxNEsNzJlm?q>xZy4x=paO4Uvc;Qxy*57EzE+Bi3#230vJW@)O< zz~+uxY0KF^PPEm2FA8BcRKL;Lv3&Dz3XD%ks3d2ktVPr^MZ1rvP7SOWt>?RfBMtTI zO&Z(N$Jjooji6i3mAT&Q+VYxrje6Chg|sN|W-keZ3%}U1D!dtyHmFsgZlS2^+EtZi zcV4Y3bc=m~$KQ3e1zu)?+S#$;1nc1RtWM3_{8yv5OEAcZ zu*QxeRo)8gvrbqsZw2(++#(01#4tXPTorBl4K5+Cv~RQ81P zSda@gIzoQy?{F(vuJT9yB9H*?QlKE%0wtPJOtv|7gJG>J6jV;>5<}GjOM&F;DDKN_8o;BoTTK+EOV zx>EsDLx(vJA&tNr^HBM0(#x=&=^93k__(+#`$g%ow`$MK%S$@Sthb_9mX}Mffy$1P zmR91Vu4(EFaET5fqYrN#21T%vRbIRtwdC~-@s8Xf>TSHYw@N}~b*kClD3m6;<(J5t z7*p@KDsO3-XCh~6oy#HMtb9^l5tjOQZaF&?p1IRV60KzfQcwPOa=dYNv2p^QsfRww zpSaU@Y%UJ45*wGJoECpSm+1|?zR-& zxlX6nM7`-O<|L7yDy->rz;;5*^Jt4WTME>l zV%Xu%NN z_m;3;mCa0|ZKK7J0>!<*f9J~{&JU5sA?^zJ;H#p$YELupNiSaH{hCo1!6E$P_y|=K z9ivNhXSh(f{(QkvCx+5NZlAcNv^yTQ*cE}?saXwLi;|(cC+6h_Dr1_IlG+aYOFc7W zYdWig$>%GHwmaE4$?{b$+i%Oc;~al%9%d_~QXs!y6_VsZ1<&5mk+c$DuQd>c_>z$D zQj#Txg_$`x`Cc5G1t$6Q7U{#F&ABEdoRy92F1IOxr$Ggs%X`EhUtE8x{r&y1BAv}$ zTkl-1FzGf_{fVJe#_-L6j+$=5gA3G9`FQlh*Cb69-seZ4hShg={o1txx^Z(JDgvA| zKDlzUAr4MXvtqyZ@70R5nIDu6n|odCb%~0IOr(ZTa`MT=o#f7*56+=eJ1;q@&2Yq~ zM}4i-(bjS*f9@X%Ju>};R=+9V$+7a!oU&~^?HnI>{j0yZIjp9tnk?#h1RfbVYh+}k zKHo+MPSlNp&A&_03V7J<#UUR*`hT*TmaRVr&nhE5J!oylbBS#fry?c_*qx z|ISnWR{vXZ96BVss)~yAmqnmb$Zaz%VDAg6kSk>^u$cm~V_BdY4^oO+GZ8`YE9sfe>d;oUFJVzsS57r?CE8Uj_kp%l?6{U;@G zv!Rp*SKDm8J8t^-Denmc-8QJG+>>ERFn#UyB}mCt@3dHSd_o%I+B^9|r6o6U!N&hd z=jiWFTvOGc{4fHylZs?#apb}n?X1yyjj**yoZV5=k@koxIz+X5!^(Q``eofhEB}D< zxLU{3nAI?nmB9U0aez+kdb`i{C^+0^x;kyxJZLT1b+**2Dl^l6Q2>d=^u=+mE-l?r z6c-n_x8HM}^X`&vP%C_^s;U~3lyuQaZTnZmR*=W)TTaen7M2ZQc#$E66cP9N)&Lmt zqO?SK2qhQGW{`czKkL?J&NEx<%=-B8T2`E{VN4V7GmqqxCcayYOqQDkykv`D5F7uZ zn5*KtGi~7aWQ)oXwK9N9NOK2A>%apIdU0r1H{(3B;&NQ+hapaUS5JTZ_yMd(s%U9> z^~0LUb*{Un9TQpn)aGxiY-ovj`T0HF+@>47g#`r#IXQRdFqc(NVhtCUK5D3_kZr== zbS+nEl4$%~cLEi5lA>PJ{{G5PDyLWvRaj?72qnHZvDW9<*vq{Lq_Ko0xZz4<AU#cxH0hS}%1I1cPu?{NwLoJ{v%gl#iTFC?tYH%G?1tRL6R z^ZBr1c5g)x9gCc= zlp%r7nySklOxnWS+`Xfthl;js1tQda9>+7T0Yx8%&4K0XK$)6ULFBn))8%2Y=UMJ# zBpQ_e32-E|w5I%Tk(v%Bxx-260tsmi%^FPlV!eTLv9`7b;iYv;&eZhVn@`R!zbT~Z zzI|)yaxE_>=T1@bc(ERG{U=k*%fr*v)G3Faeh)tQ#b3WCcZ~a%UBE;r(y5bA6=Nqm z|Jz2?p%?`s%|Zw#n0EQujJ~ZrZGD_g)2jR(q1oAHl9K*E60K}(CgL<3h78*dr&#NR~F zZS=QvfmSn9(xHY&QP}G33b+{D;D;|~6Wo41@Kzi08`Xk+?}FImS>)n2FjYr`3JEPPIDKY&C+JpAD{^#lc9 z?jRW@rJTUQa$j5km1+N%mRe%AShn3vhIG*B*7B|+6`YrMbbLHcwL|**q|`e@Lqm0b zd@kVP^9lz=uwdr&v5!k_*lg5oa=lv+?A8^371`47au5 z2Hgrv^38;+$QKqCRkX%N$*I+8i&Yl>gCcezG!5PYQjfm#6tzl$79q+~( zv-0nApsDRlG7a?gor4(KFNAA#DUm$_+@pdBxvdL)G)*FK;zz3H$ED?E^x1e5#fBFK zeH;)^J@qxx+tQB#D2l4Q9q4ZIDMOf3pkUW24DZ3F2bw9m6I@uv0{>ilRm!F(07~NlY ziyTaROsISrL2}vK+Z$v)oGxV=J+D@3aFtLZ_Btq|A1Rn#f3t<0h>D6TZaAW%HauI) z0FtUM679^ezqc3v)Z}9c7f5+t8krzn65c93r^WPa>QDP286tAM~v|N38c zfe1c%QB#dDct1mdrz7tgXyWNc6`_Zw~Iqa;|Ba}p&IK}>o;@<_o~&I zq&dN6yyloug(y|nLouD4~T32b&&4CUWch;}2OxkJ4%Gs1aeE36!SsSi?t zrX~!vZGFqbDUY z`QF=P8*0*}OtNo_XBM;Z_j=b2b%@5{sVu%Ks{NX+ST2(pv>U%>|dDKg>zcK-hib^Kq` z{l883-y$wwQ}S|i=Y>Fm)jdi8LF$ZL@Quw)fQmeO1`PpWa(ALM126?LysrSdlAZ0@ zrvtv`r3xE1Uvj_vH;!Nv{|k?}sDf>{tb>C?L^wVK#p1l2Dg^pJBO@a{y)Sxw_3Ab5 zSy(m-WP6apnY);Caux%S{qQ(Jw5y3KhWGBK4N z{T1P?r*PpCz5_u)vON)C&%+F^3dU_ZrRjDvLsm>o3?M2EcO1l%?i3i?+n3sX8?&qs ze_QeiG$)^(7D)j1M>go5J(FRp^xixh$}cNi+#aT!X2z)OscjSWfo?$9Y9Xv%q5~LJF^5v4PF(l}zpVinXCLo}ZJ+hZhU*;+FFBBpW-o_&gJ>!3{BJ&d9GluDQL;pM@ z+2G=0TSG&JI;lK>A^`}4+qA#hOcn4XnhhQmn%V8rfN>H}%>d)x(iwZ_eli~zY(CfM z9b1Qc<3`Cg*i|lE1H%SPkBH++=yx?NsQOy)Y0F?q2nD<0qWt;MHa^t7F-EKE!+qhQncs+0>LtG3qGr%#{OH#C6C>@+Uh7K4qnySw0&JqXBb*FioR z_2o;>o5ysBlX(y!OA@rSv?e*8KYtD`ZA28(-rim^-qO;dAbLm^+*t>%qF(qG05MG4 z=U9-P2h9-5p$gDoG(=;Z;O)O>z(~fMSZXJJ)NKPotn2-G@f9-`3LN+UnhyK#90|!d zr~N~q@AC7h0?o46wgxDZC2yqe{LXT$A?Rpmc|Rk4@1peG`K8D55GWv?7g+xC>jhQHHkrW` zKDILT-#E~pXWEb90Gp^Q^)iuKJk>3B2U^Gt48NWllLtULJeI+QdYJax>?E2>4YTGy zG%7?q-FR+t#;G>6@1CX*0mzC+K=}maU0XIicQ77=@PdEKb5JOye5x{ID{}*i3>aCt z(vtH~#Ylj4I2=T#ZGhtM?LC@@eZyGLnXltY*C_0DaQ4b!hf3h~2RFiz4?FQoNTt8uYOzZIh8BHh}E!o#L26&R(*;|N9VZ;g9T9+%aToyj$_`T+^ksL(ssGr z7K=!bIe;Wwe!{MmaGyDu7=#9!Ic3iOJapg>4hq`9BM}zAT{|ywx_30mnUPp6CdHc83MvI)bq zqWh&!q&>fMdwhCs7CwUk61=jRn}581_3bnEg?>_){vR?FU-DTw z*jPR)JJ4i@vV!;DeO`?X4qF#)sD1`_7|G|a>n@9}O#@D!2}z&L<+28mL};$_cPYNA zZXIu8lsdq53<~-+Y#|lUQSe19Ipm5dVFF544xi3YB`LEZ(dJJ{rVcGO0J>D+Ml!>n zKAkguggSNU^F>{)5&%H}E{6;h{3lPX;LqT1{_})ILfM6hB|{(k*y>P=DdEM1{z9%h zy5@=DF4cnI7T_nwJaM6}|>ogUZJ!CkJ@N|FRJ)n+| z4)bbcP(n1HC62CE=jIv!nt+y36Z7s$OZAZ?oW$6@AH?FY{JBeMIfBV4h zImY1{1ANNo+~Krbv62jRx;#2aeXu^=vgSGcAYWmXN6-}m#J$PBylU5R!piIzzw_wD zFg^5kstf=)Y=!L6L05XXqlM6X%QGGQE+aaJeAXAC_`jTW2|GpwbP)n;+%O&HLVn4RdvkJQeLmSG5gnnMAm2 z@5PhpAN(^mG)rO{J0GBKnF9$Wih|b)uG$x_Zx$h`~LWf zh`1)GhFJuFU3Lwsw|_YQZtJx*+KLz{-@Kij9~)sY9>QUo!ChtA9~qYe%Rk@}t0FKl zz-)FelE)TAzmTr)=7-DoS-_ku^;*X3y*LYg$t`Wd;vL^8NUEr7znD2lN&3PVrYE>J zWGb*HbA3%~!z!BVWlsk&F<_E3uoeH4c!g`niCxY=&f=uqK^Cl#Rk7&k zc7&8>LE1a(0iA*`Q>!%0aKJMHBF4KT7*6%9N)iR5HS-Kf@fSq5(9pYn1{!-z1;F0I zvAxLinh};l;8srH7ye*gv6AB8_5gOF?hObQX-BWtJ@&*=yiU6{D;x$L(_(*KoX)pX zt~U~eMS~kYN?+{PHDfE+ZFaalvok(z9SH6vk+D$kX%DM02%olzz|BX_@>^>xHQ-}a zLsDBGo5L$?gCAQ5RESf&TO-L8j_nT%4b6PU0ESIOV*x-6kMpfhL}70Mn%Jk}cM&0_ z)(zZ(Pl|o!9xDSLOi*j*;Xxx%`Il|3LC+!tH4y#;io$aY74wWqPsp&E*Fg&)Fy*Ot zRFts+aS7zzC=dl9(G~sE=kl%<;VrBH5Ds_3kdtyb6a^+`j}&xJi+VJI`C6@qJQ=ak z`pE9pvDM^Ku9eBQ^M!;`d(n1d4whc{50H2@CI3FCQw<--{Ix^9I;iqcNL{>jFOTqw zI3b7hu|f`iH}CEH1(BfD1-jlVg5ZAzQ#DhujlH`b*iQuf8OSJ>Z933^=%nn6g*2|H zD&PwWF20dzx$x`QHoRI*4XmxRDi&)nvX?&kUK`_Gs!>cv82>L-FkE-P2WuCgKai)Y z%1UvC#(VXD(8pW&>*EA@>(e@lt5ML7Okc5!myMDeYt5~^0c4~_Z-8f=PiTF{$7FN;%CudB zM5FgHx0S^J-YHssvWH1nM!g4`e+fSDC76UGL0gc*tm``7*{}ks!q0_qE8&fg%qnHD z6b4#PHAz}pjduCVkALs7YzT>gTKKEg+p7wAtQHlT|t`>4U4&{5daU2I~bAMyzRiB zDVIT~a>=yC{mK*a8L`_sCGrhST!p0w8&_2s{Ywn^{e=KD_~7)pq~A0y26PopN=R8E z-;XO9+Txo6q_lm?#eIf=Ezm z2(r{;ZxO>}dzC{5IRY*L5Tgnryt}}kYle#fboh66)qGVN)Eq2mjku!-639x20T_pk zdF{+ZYL^ZV2U82?b*LtmkE7$tg+2fjY}oWp(-fzO+BAt7R~rG*43cqg@B0umDTqWo z0g3z2rHu5PsL|c0Dri7HRQKRP+JX5?xQ>T1BYLlU zq7V>ek3>i^J-X+P)9k^p3_o0lnnzJ>c>vlS;{;oRE^8GCQltOp9831wrW?Q*xBs`t zSLhuP)pd1nR6qBE*&DFc6Tp`Vr-{mPFW^e#x8<8E8d?ALDqdVNH#b)%g0A5o2p~1J z2^7M$TzKMN0SF)~Ev;pIe0*Obchs`{;kr|8mRuZ(A_5_HZuXQ_zXspgODS2t%jKS^ z#{nqhPHI(-XQ<_C_JE3+W@U7P$r16ys-f+zISoromZ?^;Ag1UZV;8b9hw??dj(rrW zE)TEy6qLrnW*I1ITvK-`C^|uH0R@zu2kB#DYALI!$jeh*k)84(v3C@2MPp)ODvY`a zEzXbBmL@=1Ukk|jQ3(k`_6zNgQoVj!)yZcIBQB~ZI|~X5K7S@lmREoCrWxhs?d|R2 z!Y524_uj_`D%W}SFuFxQC@84fZvNW2`YaIk3pC3o=&cH50A6csTrvaBg1j5M1btIh z!S3D2$SA;=A^qF8Zw752N*ly57mf^;=H~jCdw)eR&DV)EZf`9tEHKH%g5wjq^<4j< z(6dwXS>3#Ki$1-&x*8M~>AY8=aJkBhoT4J#GUH&jF7#IU5Kz>kd&utG(RW#KAlw`) ztaDiI%~8zgue6=1J#=k4Pj(CW%d|Du1ZQOp38M2p7@oU4s@iI&qNMCXU1Z8e_ir$B zaF_-JAU*W-^p09PJ)DGeo;`a8^pMe`xY*clnVEN@lyXDCu@u*xq>~wNnq@CFLhNh} zpR>MMS4*1Kaj82B$PSLHgTWc*pb{nR=;$b@Lkx+a2+lDgL-6yha<#zv>6w`T+Wh?dt_axN z*qF=N!8#BWR8&=oqe?P#+Va3sjp9H^a4PqQ!LRz8r$`X3Ay&qw33&ju@C)M_g6G0!J7`GFGBSBAqFurF| zn#gC)lVH#$RCrxYTU*3zkcNSUot^yYvn-{UxHwnk(I`fle))xpiVCZcu*17yomX?g z;PHp#t`4od{QQ9DmA`-gF4U@W;oVTx)fF@Czgr&mFxq16M;egtZ{NB_EHez$#}2Kd ztw~ZkI-vLUUJ?)yfvSudzuq;Uk;q4Iu)aX;rJIA?Itm=f>AVN385M8Yg?CAZ*GIC! zp%?UV69(-^Bqrd#Z>*?DJcL?!<>2aSHeLeGJmrr9MK>=m4_HbBeJ}#FmMbXZXwnQ! zg;B5)w6(o}9oe-iODcg<6-+x=#-%pI+n*631`f{j;TTLXZKQ~L{u~(zXo+>+9Lvhg zq!D!RznwN=2+Rt^U;w$BUcIi?ZX-~1obj^7vy^%&e~pcm8G1Azet);1xktdq3q8KQes-n`KtQ?>%Nw#Sd3$i4RjVzfjc;o;E{#dtY5&@+YMzMl?e zIFPQ7=Md)rJEW(lUm)5C>Ije@<8;pXd3d&F>eTBqq%#a)7$77ii+R@y2sjJTQmb+c zj{(_GLwXPl9@LQ*s$x0y1{;kTgdCQ-FHTVbRXDe)Bqb|va0A(q9u6K8BLf3qn0OEu zZd1pGI+0=2{3KC5#)i}Y0m3D?`%DsfHj)}--WhsN@}QTsxWrZNS@_?J09rEvrW!IX} zn5=h4O+0()?q2icyv*y=A??BD=aaKD-3E`*tqT)SmdxKhIXM9)kb!w0poZX-sRQi1 zJUsO$3n73Fcrtal9H+;jQS$ZNn|*t(NsoqHDA{JAJs6ymT3>(h#}|{k<^h45eJaJqaI~0m;+AAk8ER81^m!PHYtE zBY7U`Rwb4gIyyRlfRqtPLF4oi2(YrhS5z=DG1=3&0+MGWTLH+XPVmI-ot=~~Uo4AiObHt;6z1yOoO4l%h&*am;RS3~NV6N2`y9x{|UoAZiK_ z)Iea&`a3x}>N9Ee($sY2>~M2HoVYowI}+BaPe%RD<7_?qHqP}fd!3l#q9U7j@4z#r zfg`-6qyk2tZV5$&>6A3yBxWZ22$t0YCMK}JSzZY?7Tcn zz|V-Q7H}GVOLX)G6-VKg_*W12Zp#6;3=ZaPn!Z)dQbJ!IH<_tdKa6G;6VnxVj_2M=`c)GK1oCj;{`Ld7|W`beaaJe821Y_Bs&=ldQ${tt&$vhgxFP z!;G!{H9z(vBk#CGr6eX!jp~1PTd7Y=n+GEI9jZ1DQ@*hb6&6qxZ#hbaBO50t^-e0~ zF;rd zgQMf5zIw!px`$+;8bBZq+t};DAzA>^eOi__%cr8E0znD5_>qhTC!raj{cf!)ALJs= zZLdFb8H|N(5zc@_qwJik^gMH99TcjqngU-w_3R^Bqf3O!?LBTa4-3j(t-PBn y9e^E$nr%Q6s3gN3eNMrV@Dhptzs0{j43>u8*r;am5;y|~L9$Zvl11YB@Ba&8wjY}S literal 57015 zcmd43RajkH6D^3lYl6GG1a}DTwsE)M?(PuW6I_F9f;$8a9)f#d;~HFgk#qk4-rL;| zefy>RA^T&my=1PMHAhvA8Z*%;l4=kTa3l~AP?88x5D<`CW!WdFECbOieeBD^$Ez2Ca}PFL?;;?R|p8S{?~tyLylj}At2TiWF^Hk zybO;zQM2`>(r(s=^Lzgk_0_bArc15tVQPgNkYm7pYW6J@_6`6dh|6D38KgZ$Jnj7n5IS@ya6#OOzX+Nx_= zSy_8o``*n{wuVv;zh<+8yZfqZrQ^-Oy!|5X@MeFc-aAJL2FVN=kt`CQdp`uck1JmKx{akjR$uBB+!4i4{aWrjY!m58NZCC7^`@tBE( zudc22ypx$Cm>@u^fH)uyo>BOON?;N>8*fja9KeB?1iMc=yNWJ&aTy*87CR%^56s~aTZ(I(!BJKc`w|& zbutuG{^M7N>#L)c`50L#0UU~c4ikyt(EDN-#`n{vW@bfsUq#z1Dq`fy$m(F{7I_N| zMCIot;rj$lBYHV}!@aT~z1-F};Ph#rAE%)OCChV7k$FqKwcXkUwS8+URnY_*vsac#>6itG=nPy6Y z=L0E9{D}A3T^G0_3t_ZD9D&b%bK$gC=z+KWGVo|bQMzT>E~8PHlvp*9=seuqs*vvP z?iwmj&kv^}P8$%7Fw&%gUT0nY4>g_FOMec3^@oH8oQ0Bxg*?|M|Ae|rul{EwVkIb0+wAHR`tI}3q~|lgoU5!QaJN?Cv;*z z-(6bWDbKu5%oqvt8bfcTka?i9yZ;@&)te_vQ&Sb??O?JcyA*7OHE9*P zkT2CwTUA6d#mT5HNaCq$Y0kbE6K9New&dCD#sOT!02NO$5%bw)t9%I!&llo4l7ZWgtcy*pKnBuD)wgY z%x7qIR%tW&%eNj~dLO&|$)yb!+XRCfBpB7n5lWTFW_c8y1EfX{e%1<9b6#*{wY^-~ z-(f0{8D&ey-?j%gi`8+EUnw1_4^`^fGL#Q7*d`934<+?AHqfkn>Mi`bGnl^G?z!D& znek3NWSPHO0d}jMvkPmS9LdymPxaoMGpp&$d}xLF+?b{{#6|4Ywg$Nh`ssx{Evg@U zWo&p-jOQ-20<0}Y@o(0APt%$8CioAlfW_T?y=2>Tw9<-=_u^TNft*0VjWqhOb|b7i zoThEK&vi;k=@SACkA^~Ubuu~k=(cqqY9E>JcX6MQq-494!-Y@q>Tg_Gk`q(rSbP#G z|2p9R&Vh1lCE+`Bqqm>K@G$d7s9Yjw{yK(`#2I&*D^1P@lH6OxQWCOE+0>3_ee9(& zHDVEcos`=x>TZz#7}3@IC%Gk8al4;Oab4CNxIqRFo^Z1WTcdJW3-{IS(9YBplM7t;cZIzZ8e6Zv z40tW?1m9kEOiTl{*Ku zOWZs>m+I9`dG-aVqyZ&Q?TC7kk-jY`bF{#3D;GUsHLHyp{Yq76B`tjHZp8(fdqCt9xqnp3W>k7ee*t{9|TvN zrH~*jlxAVmYu-0v#z9_!R#Z|tuqT*N_LkR)>|@^ZRT*pN)eN8Ou4v%-AbwJzV)5ax+GYkP!%iRW29=Fgk7HfBb1%Pv zC``5x0P@KUy8QTby|&|cn3gPt62mcxi!etcMIKGAAn$7f{!|vl%lXCSG55rIB%wF` z_22)lLE^raL=9cDe>sz;`j3nU2N z=WT>|b)=AToN~d`)4tQw)s^EiJTFUC!)q`A(fYF zltn;Dn3Fybh*eN&{0I*cUAvCcEzUO}4D$nL@$5W%_5H(2k*^fbtzgqnJKw2k9N8AD~YY&GPkjLi88hcQ6( za)q?~i``jDr8N$IS%Du0*BU9OmZwHjjXr()6oF3K<+`V236Dw;<~A6E>y?1|hArQy zJD_RB|7LY6g(b2~@$>vla+K5Z($bgPo>?2|i-}-~kFn_Ah}*ykj5bVc{|UJN#g_lw z1L~1ir|TkkvFAf>69T6lnw46Mp#jge#|Zxu_WK06JJ!&T)s_Qr`N<#t297g&E9Nrj zD`{oG4Pyp(TGR{2Q-wnW@GHS*p>iM+D?ZffP+6)SWQ6P5GUUwLb7dhZvIYA&leB)P z!N#W<&jm4^uR19)DVAdW1J?Sp&$DzRj8a7VvlxVv?DujSF2hyuS_Jt!$8{N+7tZ*R+p? znN_E35uSsRM2dUQJi=be3leVXthXBrdl7q$RobFD>n8Xt%QE|zX{XQmba)ffo5;MbDb0hH>j9{$s9<>Dl)}ZuwN!4S5@in4=V`wLm_H6_MxZ}_I(#Xi$b4@twIOy13 z^D!`CUB5eSQ-tNy-K^rHc9#Ey$u>oxc^exdxnwWc&t&P32O&(e%a70BR5N6#k~`$~ zkY{&S;mK1DN`N*I&?spE_lM#^k{5B)Tuc8#Rd_FHp-nkY*8W^(QqWtcm;^(fps zS|RCBh*e`->umTC<0#|ies|3U8bXv97m6b`qajh1)Xg3_B(fY<1@&}$f4^RuXh{nC zO!Ky(tG>r@PmwbjAa(|Jv7O)C2teVh6+fdLeo-yTo>!{N`Y~2JMrDHA0()&JRVRP! z==I}KL~wO{Tj!XNDe z;}xe)TOwqvqpBJ#1<#0vpYybqqBsn7aMrpN!|2k&RzQ4>gk&XX$xvD@q7I2OKCzXR zKW|m+XUlHu!^NwfOPP%r$8?NFMA3D*NEYA6^Z*A>Qd7CG(fIWw2rb`HCNv|rtt23Q zv`VKj*>XDNe@usuvp2T+bD@PReiyIVVs@7N-powWc(%~`q%dFk{8hNTq4>R@-vshy zx@i7nc4Lnmb=P=K_uS+=h0i%!35ix^f{txpcM01m#cupY>U?cr-KQnEx}2O%E8NsW z%A?ZrybczlPJVxIqFTk5QV@?SENVxd?YvoQ4|uw7KWRIhQ&$!OY7n(I2}0MPVxZy? zx(62(5V?-C%Q!>7d?$1y^S|AUWNkmWNrZSlLim<)WrR9Sm@zUjUgWwgrke|K~ysU8ZCUOEB&T2#r1oCTxT5lTd&`Cp9C zP7_@5toyk>Ki;Wqbo)PC%d>W-;${h-4`4U12MDAFLt`s9UxH**Er5u8#&__gD1TXY z8ez5PtqE6tm0{QTH!;84umyk6=@;uWG*8{vDE(ztjd%MaXLdSi%OmcamwXULjt3Q}FPlb^ ze(J7oZr%d{6F!kbDkim$ZpjQw9EVspGYmsYIs>0ZSb&EHF?Dx`Ge*VbVkegl7l;Ic z#bzmX>s>kT+1$V?3K2kD5bFj8r6NgcPDnt&Cc7aTNZ>D(iuVo5NlX-}3V|LU9zq~5 z^N)X_>Ht+39e)#B^o7+)I`2+ej=X^(j*xDqPo zCYv*A`0H%8Y0M*)LDIgW(%13BE+$(U%=SizJc-xU^6mBG%)Au3-&nmvo*r&~&Cg#r zehKnQ-bpw=;W5+G(=#)pY+z<)zBVxRots**?%ltVeZGJUtZxSDZXK>DoclVH{#(}` zH;AJ5apKIjiv%dTaL*(}kJU&o_s9gz421$PmC9u<+cPFLma1ExxQn0W`|A&s0+a~Q za$0wirC;`@mGcBFfB?;sM~TB8ebF08=qao3ugYcK$i_}%iqLcHNeY7S1E*tq;VduH zek{lbv5E8a{0LllYocm}iP%txf-wJyWrUb@eM6U?>QrB`@&9uMW+ZgL&r9JdP{iXTuX9xlxm~*vK3(q8fpbQYcga?o|_GE9I7y zW;@^682Iwp_hzvVhQla`zfcbu8!Fx0D^*z7v?sZL0cI16z3Y;Pigqw zesz3Ts9r4AIyl)$j$w}ZTL>X;@>AacD7tNswcJ^~MijIoExRHZ0!8UgE?T!`P5~J5 z0!XDe#qcoIT_g~7-QAhyKWSj_P~W5)$2ZSwG~nz?+HidD6XB(5sE$TpG~r)aGNcZE zU}gN~u&SfoZ9b_7zvjJ1Y&8lSlPTGnG$Nsp+V)4ejlXahJl{9KOeJD`-cPqN#H$fT z_eMm=$-53qwTT2*B<8P6d*YYQDVAj3;AekXNXJmuI4`PDsPn+cFYtd!5!U_kkP|$8 zq=ihZa->CKx7bipUXD0gUX~k!?|FN+DUc%i(ogyvgeW0ElsP{?UjwQyEGdCSV&dv^ z`SVk|e`bFEJ#y?x*MkF?7&7p=B?P?^KHs0Wh&#PuQA`#N(;Ze+y53lx!+AC^LKBz0QMI5eN0}nvBGw zA(xyk2$w}rb+b14?^6ALdDvWb$%yP?e@-kaeyWeE0p?IiBKcT00*x4H%v-jFirnDq z2izkjD5p@7N@UF7|2+DNg{A6YXu}a(MZca74Oq>Fy_5K;Xj+Bw1DbT)@!-IV(;;^` z3yYH37<6WZ!pC|Z`-rWI=v)cp6gt-sDOw5VH2KJ{u1bYeuIHet z8hr*Yrb2-dqfKj8g7x^z+!@MxwP5$1Cc zS}pFr)+ot3@ARem9g#q)yEE0ZQKyAbi!nCpC&qZ1=ytn%Ht|Z6%jFrPA{9G4rA#Pa zas6iwR3oxoC-`KXFFD)~G<0YBSWgr`zpJjPiN}LZci#Tqs$hlkmZSLTJw2p*Bgz}L zAfyDSho9O;im`VWKa(}@Vkvs;C`8AAEzH>f!j5q&rfBgCy;k5G$4K$Jt zhuxLn$sF&W_l|;X2M$)FL8?XX`Iw2%Z!x=@+3XhB%DzHJGS;*dR#YJQ$jc+gg$J)| zfW;0D4|8^t<}>-Oe?~fBxfKl!F+k;V@C#awzq#hr4kf#gF0Gs~Q@2_ZFu4HZc01jT zZ&VCez@GVv4$t&yj_fv7%U!z<0idrQ95`QzwFD33%)K3MrBs>aY)eFcx_`q|X$wK| z_p_>rNsB<jwAsL=ZELINP$D!7y`NE+OV6ZkJnal-pb`AD|hzM z#r|1fMFdr|bo@fC*thz6Ou6oWr~IMqbHEtWv}ask$6|*VD^!8(^xRc#q&nXb2Z!06 zg9yeq*+lW0R|;UP07@cJT{Z+T8}pGj8ajiEIPkpL*}WIj(aCOp=FipCOhWed_A71Q zZBJ`C$}6$t*tPR-_GjUdRREhZO{v060;R%&vQ>d1!*o8kQr8@+BS`eX7uPXBYoC4! z@*{*mgs>~SxVFg-y?IMl59-%1WkRzKA#h>`px(Z<-N&dbGujCU5MJh>QFTZwxlbZs zjfcEUe)4DajD3iXw#<0HIQ4=Y(vmE6JOU;KkZnaph4oIM>+{`Se+ubO6U{9v@67j6 zbsJODb5mXEx5^IXBdJI?f*BqZkjr2MP%P%FbgXi{Eek`ys!hv)JF@WW zqxi^`_}D^VY<%S>NyC~ zof&1Olx78egBrc5fcrfCtDVX!&(*;=cmpFCHhI2L{rof1r{6kP`GU_^b3IV9w&VIP z?rLH@4TO(=$d<&D`1Jfo-Ce^o$sR1SKKj7D-<=90Z1N~M=mZEg+Wc3 zU0)Sma+6`gli&}S(P+#J(CT(o&0%IcY_HGB=SC9D;Hn9(b2b8_!>`LA$9OT#g*doZ zLt}UZ(G!7FmUJD$;kQ(stP$G6NW_DuPYomb4sQsI2o(gr(V0$$7KR{N<^Ktr z?YWmgj(gTm!wGfkVgT4Jj6TO~l~dG<#l}fgreuw*uhvq=NiuD$IaP9z=%nBKsFGx; zU{fZvsS6#m|8Z$Gk9FRWFoYL?z$6Ojrow#@Yljei3!+*u8#3^xV<*#AR)q^q>95~1 z2Or?b#jfMPC-TEV5|@SxO>T-wDFKUM^n{QWU>x@(makJ}i@$yInERsY_mPkj8Y$2= znqF=n-Su^f10e8 z6sO2!h#5f(%h{ytuD29W9{t}TUwu;YJaNAwb(Ke{rSwWxyuF%ZH-h0&m8VLw_ffR^ zq*gA|`zWom6S5)5QG>3|X7^(-Ex`hskt_xd=tyKBpPW437yX>>DKWE_Za z>E6vL`)fhhDJX`99EZO5c3^8U?L{kHUg`ytH-F+%C;)7GUHG9|)Z~)RN&6MW-OdzY zbSQu^Sy>zl$MssO9K`xBStl|Z&4b^nTkIa)1rM6raQL6x>B!g~mS%PG{$8Y?ginVW zTe*{mMy9G}chzaRE$KqIz{N~lfS^9BXW_HknMlHNchg~OI6il z54>>DJ08ci$7p3gD4+E%|3x0ID7USFXy5^qZNcwf8%#h42=V)CKk0J!hs5;l`F0Y} z)?ig5iPg*ve7-wgZe}&?coQdhy%+j$=X-6JORyxSts3?|@oC&jICSnF0u~w; zxyQR6!9eKgYPR6goIT>Kccf5+E*uj&WTyM>bGKMJ@%w8lk%vX#K@wL7Vc1GRlf9wv zp2u<>@2|1)Vd?CM_zw!TW%B$kWEaBe5Zk^nKr$&zv7aU_eMYTRP*R^)P%je4Pr z0GN5X`**rtl{4sULOKQ(2MzrAbhDmtecG~(W^OVt(uZ2s1MPeafi8Fk@$m@y2pONH zIHxG`1hPtJ%DVxy+QJ~V=VaoPc(PCroqNQVE)IhD<>0m(YxGFLOlNOv`!H7~9FB{v z^KN3E?IWnWE}NP-oDR}w7tI0al=}UWN^E1WfGXtly}`>RecXUoVkGN+I(E$QxOFlx z$e9&1^gEX-LsUhwHUg4NeYXaN&2*%uuf)m!)Q5okKVo%bh~s=z(xP5g#sxBmeE-)K zQXs$!d`^c8wA4I@WYC#?k0)N9n%dx?&-PsNR?!>6#2Iba)$p#rhnJi&(Kp;6D(VPZyBb5qa@zpjF+yWK<<(!*8Q*;pdUP z<@a%2FTL=muB9F=41;jY`~X+pde6erinuz?3 z`aV-8RdV|NQ#8J&m1^WejdnmDtTd>}s1<)?Wx8uFTKORI(y??ks@SYhQC_}T`)xO7 z%>{laoSxQc5K}6uGqRnk#zi%GX$0in!QaZSIZvgP2g0J`3ISCu*-*naa z{Bvd(9YLErJp8RB-+q!%sp;ARRyY;NwvDO=QI*K;28{)jcJUO>>tLqJj+~|xY_&U4 zxPyTAi6z>$@D?PnMD=-+gzc#+|bOQRrnmqYplh3w`N=^N(WimM6X8w8Nu6a@q4XY50bg9;er zm^!a>Y0e#nu|Rf2x&zM|~s=Y}`z{lZ`sj;u?XcPSOzZav@u@?LP4AZw0{SrU=?*WcrXe1F+5?QZvm!YHidNUsHY)X9vn_Lf{ZZEA7wlZ1_3MmHHqiS$Wg7c-SyyoLijU`H`6QOLU$|@5|?rH~gm@LU^uj_=++5r29pFGShE(7`* zj_`+Q<{O!K#Z3zm&>EKSPR}!#^MKd4lkGF@RbDsgWnNAsm$+#1GrpbTjTaBc6G-o3 zrID#yF{h9sp)1iz+lu~4Ti?E_8|psvt+gIZ71KF$Ee(@6V2>#8W$Y~XAuU>pVN*vv z3pCNN-MWVtxGg>T)J-b1chQ>P?&+plgW2Up$Qmgoe*2~Y-4hHQ3Ww@adJV@;Uj7kifFk_!dK}Q)|6u7@6yoMFmJ3KH zW>$hggc^3)rs>(fXq6g-OXd*hgSMh?PjR%$=UZX2)EOLWNPd~Z{3Vfg@ zMR|8eyag=sR17ZT(aoy8=2jn!6G9EQ(>3$3DSIClG%`*NZ*PTUQSi~UG^u?h7OBJY z&Yx(vjm-4P$BVSE+0Fh_B3>9uEs83YCVhYy(HQ*^X2L&2v)@d~715Cc|ELZ!{~E77#& z0T}nRS9^vU@9)cGH-lA851UWoG4`k>_h-ah8Dx_{FB0ni@b<&=tOFJgOTo z^o56qhm$b~c#+oWxjD&_>T1;e(KN;^ShJyc|4HAq*W%rbxhEM1$O`13j5~ntrU8xY z%kxuGUz8`j7PWbODL`WlRG96vBd=851C5hJhvjc^NJnRoQ=90%eX?$C41BEQau@(R z<=?`)FdH!Qoz)G*$nc2~Z9|Cm@`>%juY#PUWI5TQX z*!=gam+6>Rl@g=vy#4&^@;MtY)M$W@^2&lRaVt-YJX@r=FYe zTS?jv0gr#Lo}A3i&?^0*3wR>A>}f#ecp&`RY*3Yw3LorWXTe;ydh59}wr<)nF|_PJ>h)m_^B7K@9A2mfa*?&{mr z_b*<2fzKU@`6Acv;HP3u1gGJBaimHx#Tw!lzR^K0NsfF!dF z=GQZ27a-xrff22vRQh0NC%IInO!{WCUoDW{99d<<1`^}S+yrW_L}aPn8qp>}QvL{0 zP49u%dib7JYIR;L(CY_Sxoq6IP|3qDPQ7iFPQgiaKq;2c{>9Vr5mw~x<(i|>;%d$Fv^BXdiI$K{8 zUePn1g3jk85x?qZ`1q5(3aal4Q?2AMgG-QX6ycb4IB_Zk&^h}N6z`<+ z`lRKFD41N|X=xlmNwDRznGTwdZhnQuQK=74K5StA8iqR4+H4}RX;fl2U|e8|S4>3L z$hoX|i***hT{&XO{CiVnr~6(gR>bWc(-FBloggLSSM1;rif_j6Evpy(g1#?eAHt>O z!mb+E9t}#Rx6!{bFO@ao$?OtQGcSMR;n6hti5q!8%PLn^D#}nPzKEJU3`0DMLt;7^ zLmVI_arolXcbP#=Pt~2wpPQNObYhQo{v=GX04E`+76Q}$iQUR!b-WeOxRTzkWWDMQ zG!MI-mp>hn8n`zzp75J3<*A>5qalSwH1zbw?1F@(%+amkpC2uW@-X%&H)ZbpnkQSR zSW-e>dekA7nP`vpBiCg8u`*=IGfQ@}miG+!eGo(9aeunXlkvF_qZvqQ`ySYklVlK^ zP2QPnCYV8+J{9ySEqxjpN*K>7*)_A#r7)x?_n`&GP4iRH*Y03EGB@C44KXE&xN{4? z$tt*WN!(+F#QQE**6gAmza!-73YRi}|&g&$j&I%!@p6DU_hw#YWi2wrp z1|AI-ZmLFt$PY}!wX|t@oozhyHPxVR^RY;x%!<9o8G4HEe2Rw<`)Z{jU=+JR#J?)a zY>Z18B$9L?I=`74P7FOy8mMrD8k@U(n>l^MPFeRZxE7gQCcda-`Lyjcy*}{y2iUhu z_!Py8fz_^-F6xU9;WIxYAhhmWKqi+=Dk|#;f1SZXutO7<&3U?z@3I0gk#3i(H!t^| z%}QTBpDa^j0qTMz899wMLS~^ZmDW+N3bX7RQVpVpDo8*L6QC=Bbe1M(=*eeQs~A@B=5EBe| zWcD^h?S}aGk(d1J$8uxg0-jp4kP|z1+b{!cq)mma9s&ZrtU-_c^?PploDAY7?n|4e zd8}@P@QrmWVIB-~Ne#r67RMPiXMWy>y!Zl7b7G~Ytig+}98i9DcE;6z(WblWB-2XPMm0Fd=rb~~jVU>O{ zoTBazE9Dd#QVM=Ap!Ncm**E^FinLmxhlCt-!YGC}C4$k^`r$G+ytc{&sX667cN|Uh zW~dk60~$%qEm>%1xK4x!QZ&$VKZtS$jdIxv*GD`UI(EV2z6b57<+-&k3Q1kdgz}1B zwLW7F?rjM6&VIl6Ad?Iqf~D2B&sYlbw)1KvXi`^9aOaT|5#d6`6E<*za>tVS`BBW7 zNjkRgNJIVsBNE_=lp`nSaS8&=&tEA1&_>^hf|ANcdLyUaey1&)5WPMX@rT2WF3ynm zEGn^yTjn_xrUQ6pz+2U7W>&37gqZ%ppHcvSW{iX}Ux6wM0A_m9z&omY+M@_+=PaCC zfey^TtgtC&+~;>ZZ@53;1ZFhU*PlOLPBwQJK~cmTrn_-zb%xyo*du;MISgP8sq_h$ z8i7B8M@h94G?H}a1g2ZDu{lYTOY>l-HI{i~Zi4A>4 z7NsP6;y+IhEB3$9($qAO+9>QvM4*59h$vdsuUjtF%j!J)!<1455Z25kq$kD`3*eOx z8h*@*A=fp1$ueE3b6esECw#8{17hFo!Bpyma1s<-qWRvu8z=b3Y>4YzevblT*ggx6?e_Jj zn%Q`BKz4&otK^my&v)E3oA}%>^4Je>y*AOMYzeTB-7hyUA8c)<> z)aZKr%__jW$Vg}f<~=XV3%DFwBY9x+DM3ed8= zOs^z4ATj#0cGGnO2)apcd*DGxEZvV6uiP%W&=tnj+%Mb5+jFtd^2g)#=jvI0v$YQI z6dFaBER-lOF;4GlpcC6}HA#}emkiwJrw#GtSwA|fPQ!o&FfTj7e#gw`6uo5#0zLz{ z88ZSWEzqMQw0R%rY8U}6Q|Er^XW`4NNnm_I>6{ZXk3QJM`TfC@4*d;Io8kj7Qwe;# zZ;HuU#QRAzQrg=1!B@S5h}s!N@%%{l$Ia{UDjNgX%3%TfB^h0p69Rx{v61oSa#F-m z(I4Qgi$m55#Yj>e6c!QCgRf7!Ujjf=8`*rWRhZw2u4wZfR`wDNoqAy(u8)g|SG^9a zoAb$H8_oQBhGw2(Pw`l5xUijs0J?q-EWm5*f8Q)Jm#$h7h}YjsbhRY zuT4NBQ5Q!JMYFJZBrX5!eO|Snz{36R-8*h>1J@tiY=zFg(Z{qxcUyhfL*h{zL%nt} zdr>hTA&x%wpz^HrY?jb&^0Iw(C`z&zOMlv-6)8YB8B+jy4dY57+wlTuW(cq;CV*6v zS4V(Y*mHbDOI7uJoOALFUk(vU0EG#sX+Ob9kR*@KmFD}~qJe%B1-9}>`Y<;@7%y_$ zi=OX<@rW2*V3sk39Sil8>-uF{bIzjas@l;XIr4H_9#}-J6y4KUHR~#gGjEK4y)$gw zj7Em8d5bQ5OUCl01uNUB5An5iqB1asxE#h=+hTdw9QeRP2dMt1AQ=i@TO6dmNA)dT zed`Wgq+T14`VO`qJ^+oDE(AHC1!gdb_euO)r@%f5tW}8zLHa&zJkH?SeW0QBUA<9>f+2*M-U{~Ny%R4Q zlN+H4@ZuL4e9v_opuF1w+WZG~1YAt?9QS!0gtyB4`&6m-*fT!E6k9hdq@thKGS3h) zv1$N-af!**`#%BAYFv8P?I3Gg`YR}sk76D(Bfh51lGCf!^dt%G|2gcBMf-XJX1H)P z_Ftr;Fv=T%?Us2PJNW7IXJCKZtOz2L%pD{5%%=8-D_^K>9=&|58{Vg>GUYMMWJk|5TqE zotV0K6p?90K(SYms+h5HFNB)csjzNV`!LS5*ycbu%Y|jkAVQUDUZhoK_RhOA2(8i*J zct39;*RBH=^(|yPZo{C6JY$ZY6DJCa6~56jHfJ-2ggy?C5k)3`&(tdr~VS4=w*uwS2y0!7Vxh4do zkPw{m+JHgT^{7S&DPS21cYgsBU={K%w0oXLpdLQ2zjzuQ4P<=lbiVyc90|k#3vDfP zoRgFm5LSjwnen6*E{gE+jNhJtksn$q@;m#OfI+PAGfks=IyC|@QZq{Wq^Sajm zdVh8(YsQ4K11MEdboKNInRr>vZ6;ynKG@heXL$fph3xqWKzsXT1EW6zwX(X}LMy5d zV?by%wQ|>RcL}#}k9W_NdnnLFYWqN_(P-s*VOv>9(86e))2idoyj~69*uiFN2H6FG zVk?BhuaCdj^T$FA4xYNPG!mb`B*j`G8mvyb_$gZW1Jy(qkG06#4J%B;Gvu&q3lT$P z9i&ew-CaElgCEx=4m;2(AYk6Md|8IgWRH}BQ*r7Xq9&q*8?5=ElBk>7&tyzr2}sU^ z=;H)oC=lT=criktzhlp%G3wSXybZ9ye*aB^(g;(4C0<;>SY*+@ja{k-o{}Fzxi|m^ zD$s56anZHs8R8J--Wc9A5TRn~Z5-Qxxw@bZ6#Vt*dpN}ci))xoGB}v`#deS&ktgFM z;{2SpmrgD63uz4Sj>@z5=>EwY@hccwzen_X^tcC+b^ZINm$k<-k*D&SfVBdNNPV4T zGF{UT(^y3m1m$%I*I7S&$)=KKeq=Y6I^_*)%6&&h!7=>#2DHEfQNTu3IM_`u|aR%ib86HFqtC6 zrY|sk62}NSK*2PYI_3JFP>_O2CGj`% zkMEHFK|f*bP;&-?nW9W^+X|ck4RmCzQ%mBK*rJsH*H$s0M1qnUzPOqudoUJ)^e8>s z!DRk`L!tb-ML^6i1zo4XzeXSzOwlW&roXu9Rn-uoTg6|GL~c`EzN3asS4}qvX* zLCKwLpGwZ!an{!tj(pm>m&>g8jaR*1twnhYKoN5pC)9~buXGvvM;Mx{596Pi-($12STb>k(v*saS z<72RaZjtiAuw()ikn@X2dg>8Wd>3uTr#*x?XakvGy$CS9@ zIOG|F-8f+!;h3IYN$j?J*{KXQN5fAAR1>Gchnx_3mQu#NQLfFQB>J$zKw24#SQa0)<85hc zyBsbKqGJtxzn0sK?fy_^2JK19U;FdOza=4uGfgy~PA1h@yxfpEHgU3Cj1szErAE4W zg|jH@U599RF$MBLckwF->TcCk*zK}rztj2s_2<2Zlb3%moMp={#fwUEG>i zchIlUIwRnGF|KLZpLy0312&dJ^Sl?aEI@mM!cGL~_aTyBD3)Be&{UO-|2-wn8)jW` z$AX?-Qpf}Gs5J$QUL1uhPt`WLzvdrRmkWqlh>B4qQMS+E0q{-CqpLZ)E6xSnYYV z<}cZlN`OMXWr8p`M*@x*w_EFHQWMdIx~}3;(i}de4|WO0!0}- zF}eCUIrm15Ob;t59adBjbFA=1tO+I@ukjK_M-><;{dk^GL6xs-oInK_Ni18^*@8t^ zZh*=8nL7nk^_2!Qo-8)7lq|@ZbSCM*>teq|(*0J?z=x)Ss-FzhVU>+FfsjUq7#UWu zl#s5XJ4@iG_-TQF=*c>oSbmOym)Z7P*G$u9ZzRdfx>30hptfIU6?*dPzpSYmrURz* zS|LHG0XoqlA0nU9EkA_9sNT3RvmTh7!1ppX1JMindYH$4#nC!I5FWqTUg?!AaDt4Z z?TsbonXu;7QzUGYA^TFS%}Po)+y;^K{RZ=(dFyW24m zIY$vNUyFOrC=s`rXn*c^IE56V9h)~sYM~a$wyBDd09C2Qc$|DBY=QD_;a*DE@F&2l z_fDC`OhBPi@VyvrAg06+Se;@#Eb0$5hZGi4WA}0tT53&z%#?fO`~sEOKltPjHE-6+ zUVJA8xb$yArW%8DpVDI8BDKSjl==B(BnSQIaU3nz#vk-a&xy%)K3<6!$=%Y%WFF_x zYUbBlNVjE6Xg7(22Z&{DiEWLbcgp}CM>)I#^P@Fl#^nYd6;>E`RbOV1wtpq;U;;F_ zzjO+Lfx-eW*KSBR-xcG-4ouSs3CC~DMN|QQfprbiytzhbYpQDEI{$B>b4v3!_~JO3 zrKL2**IKI$7Gok$vm(7wsp%}veTcNYKek^5Pe4-rrTf(XRHDsv5Xll6P=0STdE`~r zc74*xvzaaBV@6z7fUV8}dVngxb{3XmK%*u92|JL%eJWoJ*sY+_G8zXobj!JYZ&p1i zxk;~j)9JhS&dPFds|nT1l%#+JCl*Ih71BBp3GoOVdOBW$C2e(`Twj@}WXr!*hB@o< z=k`}3T3+2r4z%>+`7fZ;YuQZo{HBXe8<={cdE_2q%pgxpwS^}}{#b=FVtPNY<0ejn z3^Pn{h#En`MouCDvktNbVBaYwr>tv3)xB2G%RXY!saaiATi^#lOepwn3Sx*OLGIG| zct9=O^KkX`7gh$S#~M)#ok>O&=FJIN7=f_gt&UaBS6~xkDHHXp!t1lC9C%k+{^L8Q z-F(7A7+wCD^fwa5gZa=!*x)bA^Yh=?!WG$1*sH{FR87=Bii7RMP~yNSOHEAv3#i|| zgJM8IxRQ2NgVYmHWLrG)3$Ao_Z_(&1LOpPe!I!hqhglcR1?#SZ6a()O3Rp;HFNOg9 z@rAzgZ`0WHjcBGKY9LkmW8O-K{jc}O8#nE6EY3^|t8j_+BynpSdY8-@n2j(5XiHzf=+8|K3Ql;BRIC zaJ>JeME<|L4N&~p{P@IO^G^rCMRM|g6h-@~>PpW4d`+eNzke~DsCu&@{%Yvg%|K-( zbsv5*FzjMC%>!~TF7mKp?$?V{$$)JH2Tj)?_|=9<)KHYGum1x;v31ro z7J4s^<|8E%x#ax+Vu(Uf1#kCAU?ZKQ^XYYi#Q$Qx!f~CO-A}bVeka@83380hOx^Q$ zh~)f0lm&JQzI7Qqs)bcmjo|Q%eb#EjApbk|(a1>M6Qshts==>xNK$OiINE^D&4MX- z%q;=f>|YlB@$amvqK&U&p|dpcVg70x7U>;U2Xa3^@*>$Z7c=JJZhDC>Th#z3XQ6o5 zF4us71jCM*t;qg?p%RzbBKWluib|$!8Q9f2@pdm3_&7}4Tc@u7wq{;7e~!u{s{#|B z99%%HfJ5cWh&8o$iG&$wuJG7}+J%3Qh5hY%57Q_&oG7jm z?qz&+Rg%Ni_TbIEIO=TFpb?2Uq`AfuM!P6q#hDBb6;hF^?DnvN+o5ALDNQ z)Hv##@k}R~sjm)ri4*TV)YRXaF{?)vmMH!6wiWt#FKQT5JDMx1QqC!U8uaH?$^Qp? zUl|rEC%q;w3@N+_MuAR&l!gMid1-5nwzA|a9z0+Q0P@4@$7 z>sxE@wfC`)@5lbL|M?L-k<2v9PdN( zax9x{h3xet+i3?BrI<|BkJG9y$9U7zWO2SL^L6gOitk4d!K`IPN5lQ{s#X5n`W#79 zVQA^kahPrFr?6m|74Z);dJq>I`!a?oc;>NwjRt0e$!6ob8d$pm$9YeH&+P_a8yR7c zT+9DpO}dA@zwc)Px=F7!A^p4JVmOf9NgbA)1<8eaRS}SQ%2S9d6u0VwMMRb;1%Do5!FQ6T*d7 zlg;)e%x?O1Kh7{(oh4gbY>#FJ;f~c+qKR}<)b)t#ean>RUFS~$DDJQVKSB^ z=wA#4n3eyo;k76=nHkfaLO8AtR=l%DEWbfkCqme@E!0XUJas1=r!U7!!E*U)Vg}MC zRX&zKdNpywh|6&7&tbssY!U9=z*)XA7xQPK02fHP%5oCnZHjR8_4R~aFCuB2QI+ubPCm`0)gGUR0hWOGpN~J-NJ4%mi00b%pA$)z z*r?W8Z=yQiwcNfi6{f8Z(q>!zuK@hJ zxRaiPN|u~`&2h{a4LCJDc9fsLecMEQS5^oXKrXoSsu1YnOr!d(3ba*o&1Mtg{g{ho z5q8+68I<6l_xtdgx$F@hZi6`}AQ|)qG0or9tSZ5YqEsr{D2Ftsf@;R+6`0@3$-26P z#C{J<#=rW9$kqEj(@)-q7fW`YEWUn-p%%nsPxX--?++#Qt`soFY^c^`6bRE*OQ0*(P7g*)igjC<)QgWQl zH>l}jUt9Bzk2}818L{x7?v!;sYMY-?u~9$_qfo4Ch;k>o6ZtZa+`pwbrGAj=(J5*$ zn~Y{-Af~>fk5%(r%;JSU{Uj?P=8IT^mS3t;^NEP&sAhHy8As9=op(Zbp3uO64%H#^ zr=F|x<#EQVi`!O>q@1W%v}qo*wjo{fJszGE?-{~(Ys2*;-H^gsAa~}VFc6oBbKB4X zqfYu{lthaLht>=sJL2~`s+D{~J7l)IJD#?0knC;wuxS zZ8#{#mOO+scvkTp9r#38F;D_3m|IQGFfKf?oVUAbM4ZT0!In7Agn$L>&V4t5icKyv zD~b35%*lw6EL(;7&NAnr`=ak|FvMBUZWx^Nnx_aE2gnQSJEPMxzot7J3;4&(0mZU< z?^~kYR|hli&iiqYNROi@fLnng_W@(4pRr2}$0D0YR5_WAhRaZz1p{9~p+-x*6eE>Xn_) z`tV}h`9q3X;>e3P!esgPo+z4|Bf6NTc`cH+ZownDX|xbSnL8r^3SrWpWJ5E1fDoF< zka$gPM1RsI+Zh4=w@uk0X-rA;i8mifJ&X@hXA7IL+a+_TX`s^hWE+f0RuR;9(t}Qp zEBmYyDlMwDI!-{1Bc0zKngrqs?+6P$*0c{7S%RxIIV9FP0Bc;%dlg#h^#c4{Qvm3JRyhqKp_jWE@{Vcjcy z(@Q~YU+<&-WnK2SrVs|C0qIJMozn4Iwtu}A=WEZsm9pcFm-b*n>};>~VkPJ|RGh~U z8rcldnKvsCReL!@d0UneSG}}igjJN`Due(%#HYBvt&>p&YsqC)lqES zz(KW4VvWu_+?5dPvjpaTPN?!vrBOAUg~UH^?DD6c5&723ME;$cam}0@-?OfEd~7U1 z34x)`-goO)dDEHV_>XPh&fY~%VIZ7TsdkJ}761J1*dlQ}Q&izdRfzVT`Nw@pd0pK} z4KSaQ+gx1Zsf*F)x+FIY2Sp9)MuQ@Cyr>1lX?O=Mic4k~WOBMU1ztof{t9fbO&N-X zXQ1+olrsfQ~!-2nQ9IgC9HGS(8R@oGk}WF-D2T%#8XTl1`)h&+u0Fz1U5h3-^7p z+AFjBEL|Mlp355543TE+W&|6Exj#X6P_&q~;mpOyp-M*YqI-DrvICDkpF)c&m33u> zyTna$U}E0VsTnUCrLBN!sVzqm%E8s-XE_3I&mNT)r2d&6ATULxO@qI+@8aPG-CgUJ zw3ttju?2EKX!3`o28IC{I2X@7FvN#Wd(u0Xrcw6vCz><6dtP3c571e3kzj6#5k*T) zkj=N=(FuWwgYEF-cZ&MX#E(5ZT6@%2I$C+G`tw5>EM}!fWz?YW#TfiaU#;(Z?vy zl=Cn2#uI?vuv;~9Yyqg2<$=8TyJ5Gb$6|Gh&|gnK_3s)}esRHpyAJme!nvGZ zc4mSZPLSzqg<57t*tWA+Jg&;RoVowRrsB9hcTNO@jgmM`X>kB6!9w~c6H)^*GCJ?uHR@BElxV%tAsM2Fi$Re-yULnj}a*M(w2wQ9q zj@@*}hMNJTV}Hoju7%ZWjp;OXCTGz2nehe%@Fn%o^jtC;(~FQ{jkpKmX}RjQc^$Z zqvQ~L))i&M;V0Tv+VeRVH9U5+)wW7YRQ9Cn{-#%@4V3#I8Ox7pYxZ+_*NBJ)GCx~1 z-`zFJt5hpII1<^OVJxG&m*AB|LY~gmR%}6VKU&mRUuc|y(vSxYF>>ROh7fJq%3jr# z3-PIQYSh50!aYvq+TJAg{$+0%JeUqvr!=o!j{2QCfdJ8D_X^wY9>^jQvzGTp)oLJb z-y1aC;ja=QvP^-<8Q$rUG6lPdgv?!u?)hEUFQ`L)ALi;GF3&JNbo=a>XRaW(rg6D{ z7F>cNtTFUpRsy009HYXTn-ykfsvi^4GO*=1;_T(wC+P2?g_h7}hzFKUH`y-Sw%-i* zym~Gwno}bjb3lMWh*F>!->q5Z3*EhE$II+ntSvR*WJG_?bWcTuO#hiYSM}%BKrR(? zm{;<DxPBuW*pz>IHr(p}HEl;(E))pszoZ;8_Q_T4cSS5; z{UEiyF72~h1B-X!e}Xafr7;bD^EzbH{BtSaqciVHyvTn7RhtV+eb)+yT+)&gBw$?( zu{Y;h=j_&tLGAYp)PSEBx*e>44#PW-2f&nEWx%1YVI6qQYnh(R`|;z)2OH&X_u%QJ zzkmN8LNg3^-WE@7!UI|Z3WhordR;!261$neq4DRz$2#pa$M`$S$uobnh#`|4Owb+a zg7;4^g+a4MXjmsam#KGDYZ{o|fd<04A!2;i+~n|QNJu`ani~RRZRIYVuCDHb{Zpi< zPChjEl^Y@nvsu)zBP6=T;m8a@=2kYDTd7a&r2J#vUk z=|z9Mk~E8|i=o+}q+d?nO6EyK(9&$>A-h2k5Kq{>f7jq> zL=Y{*GAQXnHp@bwqj2wP8YJfv(tXVt)vkk~Q%Dgl_qg9}@}R)BOYA1LuKjVOg6|%HVA`Z8R>e zz{N0G9Q*k=7i{6Aai$RMl2H;eGN1}Ff^BfmKC6y*sCp7VFzJLP(woZd1rRa3lc9k^ zcIAbO3`l}EP1BzdTM#P=->Oco=Fj)5X~t-boYc?`3rdnF3~AZ_E2Iqzmyf zo4N#_nT?{lL;^41Zx5n_-aZ?X4Q)9SAa3JHDY~7^qqTj#?j4Wx}@c804Q2 z@rscO2T8TpnH;jey*dq0C<9lBL;pRB%Yg%-0#JR3{HCCyrlwY8^3d2-Zxbo^4vzz`%EzqzV+ypwVN8Im(-s6(q%BDstW^W>88Z&O;?(uyG=SbtQQh9%YXBn^VMiM`RJTm(j9e^IrI2SgMra4<#;xsVU5OqbrCxb{&9%~VsGz>vuuPCtD3cV?>QQfN%{^P~t`YE$-ih-+ zxAb@MJMN@ke1&IX%#Kw1zS(*#w}$n`u+C*6Unw!WMk?LAnx$Pq;#8CK&}&M_?4hKT z`$UJN`9m|a_-?ams9SRN1jq`)v4MhKmbsmsos?dVneqrJM=a(KKou22N;aGWUA-dP z-06kRbe`6;+3lU6X&h#r?r~|3VXC~y6msqn0RO{^Qp@?6CYblBGTrNE36P8EEDLZV zt*)=9WE-yAxovuar?q%QgNL=VVR|L(j!_pA6EjYFjrLQf%VWh)U;+?D zd0R&s5X*~O2AV6qg`p)-eAg>@*yRL8L(8@e#(rx(|}Wy zMFpc3eFj0_3+47{--N;#2hpWK^6gW?2#y66*}~7h;&3M#sKqWulnZRNgjcBXcrj}9 z(>Qz`m?(3dF2iN+%SG;&r=tlOH?^GnG>#erzfVi%T)if^j8bW&CqTVtZ`<`cfH9ot zb~U;Hp^fe9pqp>d`JeAuwLH$wgZG;l+y$yuLdT9whKnPNT~biCy%8BAR^yqx0rfu~=EYhXxo*l{>q6NU@ZY)32>g zr;ot+~_($ z+d^m%vAnW3K=|hj0p^;Q!f3)(Jgc@xXKn#fcJo{Z2_a6Uf-!dEhoG7(ejE;PocZ9p zCPN>T(T-utO^vOOgu)vGb^s1<{KamZfAqc_0`&@MTc_Fqd}7)+l1{h3mnk6ZsD?}qjY!ps!}vf09nju3+KdGWl@?yNz^-Me~B+mdTogR zt8uUg&)e{PO24U)^B%z#R3Q1+9~nOPlwI)xZuev0)wg|s29AHaM*<^f3x~PuUCL;H7+C>JDY5|yT>36BlvZs$wWuW3N&+7pLS3Pdps1JK&X4Y- zNb3GX$}f)8DUVPh8avSQ9K(98utl; zucx%0vuf!81`3Nu>-SYgoudlbckBq}&&SqBRo3T@8`z2}H+! zcyHL-aqA~gIBdQ=-556X`SYOp$SG6&j_f-T;`yZAJp->QoTlq8#pwNh&b2hwT7O=! z<1TZ<><&YIQ+5v|23$I8b9sm@_9+Zc6C?d_z0s1bLcjI*&cF>vB8j`Z3%j3;?d6j40E!`iK-0!oOU4dpO!uNkK~d890yTxHeVF%nkUv#hS62?i&oH`AUt{L4 zg_U`M0duxfl3Cq{S6EXZr3B=B&( z`v{9-&?p;6+V7m#kt|KCXAlB`@22z5q=ZePMg$9{<)egKs#9pxy)YDjc)3oO852_lZmUIGcY1r4&57VNKw1`wb2>LPT(qoCg!`_Tkdl9Fh1ljW+aA zdcudJST|_1_sR8)+n>rZyVbz^u@akaJRtqz`i2Hl*!Ci-;2zqCA$Gh5`gGiQiFa?j z4In?3H9WTF)(M$q+n+DTpDvxoMqd0_nxp-GI>T$f-6$ar4rjdy!eEvzd4f1Dti755 z1G5EU!Nk|eCI}3ODi6zIR(lOd^9Qrc5oX-{fbhKP#`XTC5Q6Hr8HC?zU4p`?_*|@z zO$%QerxV{~$#vI;BX00@KqEuI4MT)fw;>;|hce$6JEVP1w4 z%4*;7i`h!Z!1O}ZP}Ubzk)DQ-#CEQ-Ai`{Z0m5@BbOd&WZPwNZ&An(gmFLEp{Mr`p zU*-~(rEw86nU0tH-wk(ua_5&K)9s-4kh-AGuu{ucic4Q2bW24L6D-puC7Vtna(x>W z+t17oqZ@n0@2&l`tBrMd1|*|Be{ucXX_f?BC8efmRQ70=*JE_~JGJl#y!3U`A$_7z zb9q11CcphBu~B#KjO|!K@$U3{1Rimpub^b3$b#7=uS3*8D|U;6xboDY3tpdSZ-$`t zEr#o?slSxd)`T%B(D-6 zzR9@Jaf3qyH&o1uT!_JXi5*Qt$hZxQlq2$7{A`pY@^$EwZgRcsBwsUS{irP61jNufKu&@m)xcEu4*7sm6R@Lnl;*%!e*u>zL zZsX^sqJ@imfaId%k--X1xCHJRMz-vvkWR^|*vVwA70r{wa5YIVTvg4jP767H?MR2a zA&p|iMN={Jdw7HhYk2Wc3|=c`@1UsG(?OS+!Zv-`KEj&Bd()|>s4*FYTEcluWDkpI zFUvZhpit-&6@#^j{sx zn)PBYrgBQj?@!LZr;-(KspE40I?Pip*?V&M_0!|PYj=(k7jgLxx(uCLnNgyg*&Ixaiv+qZ^Pq~LBu{J?IUtv zwbohDH~OG>w3lNmNdckr71G+`@zFg|Pv(Qe^zmcu&!6!pFh>(YmBanmN47j0C}A1m zi$53y?y6t0wZe9)BOevGi~?XD0S!9EGr1)N9Y7vn4mZQ&0Jwkm3`i<5a+qF9Ar74E zw5qZwB&pPUWXi$~3mM##y4hTR-`FkPHbSfa*-{VzU;k3*dAM~WmsM5(B6}Z7#5htV z5oQ5SDDwMQS~$_?@QAiBgF=_^<7jT!wI`sD1Be9!NLg}WM!W|lVd4fFS3W)?TYN3v zg9pwR0xcUcUuzv_8*D#0Nf=h^V*@8o{y`rg7zSzdgK(VSt$r6zIFu8@KExy^r>`&e z6zRRlRzYNWLX(V=O*a7d;WE`&aO>oLR905=aRxf}_wPr;M&5JJpKiC9IrmpKvzm!0 zVHN@dmo?ab`aG|zs7}eag?-`v&k_cJ8O0!0W&FX0f5$Te!gNI=?6xK;Z0x$LSqJa8 zc9pBHS>Su%{n;dK3wVs~oHE+##){|9%Qgr7-A3@ z;{$0c6nru(Vqr=1p9(5{K~@DAP@j=-IBullrxCcgm^1{2+G?pWgvu~Dd>eRr6oPkX zp@2O@`V~E%SE?Ap6_Zw0MRiLL{kvRN*DEy4$mAzDd3Z0V3gkEr4RACS!2wJ8=i`ic z-A&J9)J1u1FJ6@2e%QooKheXMW&8^-GGQzV=_N+v2EFd+v)<*d2Xqg12<&5K|Z=~v6z7FR;dLxAXY$bVF@dy4783H8AG4ur;@lTPF47)j!WhTY0jRJ%ai$t0r zp%(2y6RxmIi%|0LvUkcMzd8MnueYT2tFtu@c|+AeNIgIC0fSo7tr^7tOID(k@Z`0)D}$&4m(UFL_|Dio zmL^VnV>V(KD|&&a5f@o_@`RI*?~k7_BGH3M&x*9GU{h|tHUC?6)hq-FkW-%1DxnAt zbY}egF?ki8p)iA} zpsC;KHusw+Td>cM40bg~;J7?)JK8;XE;vD0O}TFDM>8M4okX!DiTo-d&`g#OhjAaE?@!O#&&Y;i%;E2Efue z$7*j3bHPK)>8eU_Dqd4ifzvK%FuB#_k@d2K zYIStTgbmTc*(fLs5M4OvEWt4$u}Qi^TIa`UN`-m*q6YFRE!_{kZ4TivV&HVV@#)ij z$_?P%p-jY;;Upj^(87o&2Wfl^jCM7rA3^=}o?*n&Zt|b5AzEYAzdrIyg(u3m_5u>& zb&$ty0?^L)!k;v7dsQ2SztgH)O}0?D%t7E(dk6K>k%Nft2~(|U{O3;|`0<#begiXC zZ;Yn7gRDt33ohQJBbOiLQ_x!j+f^O9r!n~G-F-$`J$5$$(p9_sy1r%Le3j$;i)Yk= znB=jhEeBOTy3xZS5NqlIYw&z}sTT`X;{_5{U;i)!@~8;=FqsR>0^F<6c0~}Y8Q-l0 zB^tGGtd3k{VU%^A2kkr>$@qLdd-ROe7-c_@9n`a8$t$YaW(OzXRh7x9^f6K7(&BY+ zv8$HT3g5ONkv<>+v8gE%icX#StQ7`dknvSi>G;mlLaoPqTObH$>s0Y>KP=0(5C_Op9UrV4RLck! zIOzH{26)i|lM@pHNHq7z9FVM-1r5S9V#QC_kn)O1IY{z*gRJTtd@Rt-%TU$icY zxLYtXn&2O}DtnZNtzA4L(q4i2+8U3(74xALo`~;xTL)R`tJ`G~(VAl)KEwVjH3}fLp`-FqF|>_7Ml$fC ztY$cuSlCR}EFQyx7^)dKD|!LPeGd_2ILM(DU!w>jV8_wW=rTkw>znJya-CP3h3aPW z(4j%=^t*x9KBjnda%G4i5pEvqVz1z)grUt69HN%<4$}jQS#7Dh&_kFtDzlJYrEcpSc|NE0d(nL4$Z!!g`pK)0O(cI zH&m)$01nYjm^tVEN3)xLCevG6sEw4asbRxRDkUgAtP_OVoMnAX7&i_O=%ZnPpd_F- zX_OI$-Z#BI(s4PGIJ_c5%TcYP*uh<3P^g2F#@{W?4ib3>TsW^beepoC1r`8O{Z>_B~~GmJ<<`3xj4?WM@I+9*1h7-dP=rS;7Sq2Dk-(fEZ_v;ak3 zHdKb4Vk+sqWu;UIZCT%1Z(PWvP$hHqN5m+JcGo>6BebYwu2WQpNZJpFxM{yT8P?VW zW~`EWf^$3lmh}KxN?uNp5?2Z$%19@@CKH+&;H~-12-#1LlHAo9_;rY2!x6bDjq7;F zi%}}1y}1C0wQRiqYGOHxWWDJ}O5&N1&|mIgUp*C^B!1Q&lq5y6$kxhawl=RI4ehP$ z10E;=4w?P{Q(-hGB#&pa5*~3m^7$8R7ZUJ=G8S2Db9wNFbYvf-3N0smUR(2YbsDgt zf-29ek=qg^XnwV*7gNs{&w!w0F45`cO-2-p>|pj)vl+&yn7RTop8>3}H&ZhZn5OxT zEd2`&2fXa0NOtsV-}95Dl)7hS8|zaF7dLtd0X#DY9fxD7SCEWrJL8p^E~{ejvJ|cq zz9;{;M$Larr2dVc{cq%A|NkTYb0Pa57XNRk!2db5{ofl-*@f_Ki`5Lz%t0$mLzFup z?}{k}7D29LG_A-4kRk#Mw<6jIO#K#_k!c_alyM8_#2{BmE~M$=a0aPs9-EEL5OuJe zsQw~!7g7x}=^7Nc?TUi_B6ym_Dlo&`4tT_u_(RZ7Q4@JD@{G%s)c5Ipjn&ps`GUiO zc^|d!?hWy#Jlf3Y+DSv;?|;GekPbISE-+07$Tx-{bNxi0Q+DEy$D<^$hgPE`Xv}BX zH{`y>26bSC5l{wkMeoSsf!nN^0h`44e>EE6XuLnZ&;l%IQ+M;sAmRVEdXPI*zxpMf zp59-_@MM*vsI~fO38;g({qacDe@;kHcF7Yz8O|p~s>(jbV~mwWZkZ%%;N?Da&S!0!f&IL z^Yd!ZdQSb)H2D1UUOex0D5{F{?)_}i;G*f1t;irqv_uyv5Hu?@~CrC0`V?#7Nt!XqfMlqj6zqiKhASBOu2IYR}glbN>!=p2lmF^ zDhAiPS2^>SMCo`uV$*OTmT^y&XAh!hhL}KnP*923VOM&akk1cQdFG`Y^kzVI1k>2W zD*F0$j@6e~#xE8LnZX^KAPE1)tK20Nv6>9I=z5zNsM+{Kk+mw3O#L!z^2yz9|3xM6 zwriuQoHkFA_7vHB=$E4O!9(Oc$>M%4$jTlv{MH__R(?HTB)5>BtY?!?ut;VfHIQN; z0|BN_-L&^%xDK1RyNb{7%HAyVs8+0BX14M5XtJt8CYIH|?aF??jz$&fVXUz7`ezs= z7lUp?5s2%jYW;{!amKNDa~>g*-$#8N5k|)>ehH7>jB*CddR%V{?X^C7vf>g|b_8?8 zr2*kyhcLj>fq+4`b3Gm?IXJWwU^q;3S&x${NCE9|9n&hauov_q~G zFk&*Se#vg9bnYQ3a%vYqbA3c8ze2Jc&wWPCJaqtf5gDg9HG|3%pf08<=^$#8*siCu z1o_0E*SGw~s_jGn@p1(p5>P;ssD$Gd%Cj` z571D;b_F?!cNh#G``4X4!Y2!n8Uej+!(V_#n(abL>i(X%*Audbv8zV-1JN7j-V1qt z3+NZTW7xf|+z&6|Ctl%Uv2f5yjm{miFxTLZd~A5zK4DbXyCkQ%fa@B)#HxPTLbFQ9 zu%~{#hJq%#oKaoa`lFHw>0{YE;-+ES;xCskv zPRll}OVR;q(7;lWBP~^k_@e}5zj=O^5cr?VjL4)(h*WA{gW%V?Q)wKc>tFoA>bU(I zW}-xk)tRxL0#1C;^{n~RJ+9xVK2ABuSqD|EvyEoUFb#mt}$z6*$X)9pZ!Tpu&W=+SXBAn7zf zP_GwNu>rtw+*yuJ4#&jE2x?eOe;PaZOdmg-`lYViQci_9Vd_=X*d{DnKGAE(SaCNT_9}PLaqnnF=Q$obak=ID=2-} z0Gdavi)}wwH!_+5wdA4)8F=dX;OBx;53ZezOeavUHu!1?`l-f4B)?UHivRetZXb=1 zK6F>yB_erhC`?m|!!vrm6Du(kcaq_oen!DJTMP2GJR_($oTpqJpb6B9&}{Rea-*pF zM5w229xv|}OP_ZEVHd_fi@%8hOWF$k9LCfmtVqeoXebSJP3Ts2Ly1m)X#%hW2>nMk zKu1;z%M-o^G-bCwGC+6HX@!~l%$T9DRDTpISz;<|AsS1viQhzlNooeqk|qFGmG)N0 z;T9JP)$%CJM%q29hYa?YUA17_`c9%{JPkA4gPrdXj!ce^>u739VXCpJ7$dq|Py=ze zaHwA9VuldvXjo;U2-gsJt_3gz3+F*vp;|9JoN;-6RdI=`*%EXa0u&bBOkn2E&fqb$ zY`!Pb0}pbE@#EGy>Cg~EpKaACU{wZ;XxB#OB%rT9uJmquZrD)Ojm*1w#-CK&=#h&R zNfrHx>qmOmI~wq@iK3A3G2NX%3rI zsrcZb`)4cW9zl?;?cO27PmlmOpabmQub%(>BhdYx{4X#0@&4l@@;@WFCe}6KFgfwh zKRRq|H2#-&ib*^*(X;-Zpl333{uj0G0L!AB+I0IZj}B7S1mJnTOGdk@d;FEku)enU z;OajJcz*{Fk&_LuMlWUI8y}DY&T9odl>0ZuL>zm%PLD$x?Bc$twYnaNaa~AXC;>5X z`0ro0Y_0`^kqHe(*+7n;5JJ-+~hqh^SIT(Bpqe5bWA^QmlE$({F8-fP2UGP7J0x102Z zat99xd79F_gMB6T7|1otKL5~tAhtx?DG_3VheRzd^G$$?t$`FMqz+U zlEWpHY;7p-b?9ZK)$T7a8l$D`U@+|XR-^0v&$leM&p!5v_>1igr^#Qer~NjqyZj<0 zSVpy1v$Cz%x<}vYOuM_G_u__ukPDLH`ygkByZQ3{+?~#hMQ0eQKM|%JoYW=D8c?Nu zPY*zEp90>=muTz-1)!H^N%Rjsi5wI%*#K#!wq_H*6p`F@ftx}^S7cvp1 z9nb1b+4Gk6xff`1e*Ti&Q-&SqRoNfE&N6&Z=ka#^h>EvD%_TsM8-qehVvs-d*2dCYPYbrC*4M8hZk(bcpO7u%=)Yp%I-BDE0bcTHqP|YICI+E?gkNf(OO2WFQ zGcn8GMQfI*;*4LVRd_3!Zc2x#oi#b-aR7d+^IWs{5u3z`5)`PX4H+cnJHax*A)?{n zAJ!Hoa@P&L3~qEkBo6I_h*i_s!2#h*VsSJ^Q_}3L3M(7%hyXOTL)P4*Idx z+b-YTnvB>X3vw9i4z#Q)7IcQ0Gnqeg6gGeC+J?KN`0SLJMJeWLDC>2wX~svY%Kh+? zt-N>i^U}7^VFb!gpqY%m!ZkqcPx8j8LY%9FG>)$;T`jO^UvY}snq!qBriCxZ=#z!> zy(?M;+U!J8ZjyA`PiP}-j@m)TGPc56YxmHoJ=lkr)##|ycBxs|pHwKE-CnG9zVutN zGg5J^*J(4@@51eAw~LoU%QLU2QzP=f?YAc^sBaTl9Pq zq1t`Rc3!(7@gdmY=EyZ2@kw0JZ{T1#R_nr-)ZU)X+h(&<{YJ|Qmfp9#{N}F3yY$9q z%sWTg=SA*jL;}{w;gBP*?9Vk-RlLvIu))x#N^pH6$sMJ-H^1#HU0`9PVpmE!gB$tX z5KSoEe}D#$TFl9P0n%(`k87q#iEjbLL^WkXs5%*R^rlV+7ST&3j6=giBLuuJevW9y zdr9)lXm)$ys~$Bf%*Ns*u#JWahOD4DA{m4ZP(O771xIME)A1~2f@uqI7{W(ehglKn7ae>bk)f= z=`LDMxSD2Bn!C+kZ6mXNKnJ~GCUDB6XpbAI_-FF0w?t_7uzDu-hzjlYe9UV0{$y&R z>Dzq!7yq%yUFjrtk6I9R-h7 zmTRu|yR7Cfr&3y^dmzOUya(l*0GEa>>aJW?TsjT3wJY!eVHb7 zQl>Y>+-xUuoS+-J)2)(v-_4%gKXO@w632t{1lJbO__Qs3;7S<|KH8n1BOOF@Dlzee zBGe?P9iJ-B5Gp@+yZRE?ZATmY)1XNN49Edzq?f(j^w53FU-bTGlV^T>d&8!2P5XtK z{--tKH>Yw+&g3)kGuF|~syK6_+wo(_D)`wL$qaFdLez958`U0|<^=27 zY8o=TLs45?y=Z{Ae4vHcYFfO!p$1vH!_WFNHS+!`a&j8>SQgm0Bg=ib;)31hIKD7> zQ`D7Cta4frNDaz+je$ZG8n~@o+gO|a6En$xLD?P&KTYo5EQ+oyOAHwW`bkY?X0Eag z5lgd=jBt#}(wEbO?q=dB;t`aoENl7dKLf#Vha-2$TgTVp9OBy%FK*IRr1AR=M2E3S zT+Qb<(3>3DC;PciQ;OAY%(A|ND4cj0%{ervb@iIf_#4mUmz#s869k zVkB_YYW3)o$0K?vErtu*K0nXjjHym~8ZAGUI#O<1CHUqlHji*bDf1@oaI7urTH*%| zsq-8@S`Ig=z#AfDwtKgTVhWFMkdW1X&ATAqoe}hJ-9?lad@$ymFMGa-u{4k9%Qbm0 z9kHxVk~BTi9;@}U@~MZE(u0OBVLS2*D2m|@%x;FU|K`tGy@55jAr>|=&K%PMrj9hr z*XcZIy`Q$=^z7Eegy`YWWLOrJ&&M0@>e$-cr&~oyjdSc|?NTgC%(7VB?IYs2+!5pn z4e!a0^>lSlyp`G~NUA*!fIB!-yI1Rw{h4j;ZQM4|WY{xNI)vSpS@woS6M*%U!_2ESd5f&%`0b>IyQj+oXr4o@znq6_)z`i40D{l7>+KaO@ul>_i4X%-5}%- zr52F>m2j1afE|ZV@1CY%f1m!E{BXi~IytG_{;RXW#dP5c{|2>@iP7cHH*J531R&ds zAnzVy9_utxiQ}F`csm;@+;s-{ck9P<=H0>#cwNM@w=2q`ZLEnQl|j=F_7}r(Wup?`J$eIL%f) z-amYsdh_aR@o7ud^0%m)S*{Bm>W^wJXV8nX+&_MMTVO;L+;EbJr2p@k>IRo^8-HMe zMlpH=DS+y}|Iyxi21V6%>!OW_C?H4_CB1?OND@JEP=Y8;kRVZlAUWqu3rJ2XL2}NL zqr?VDl5@@=4Kz9D=FZ0V{r30mTea`Gw{F$>bF9)TyVqJh*O+6@5#|`rb9anESZKJi zAqHnX=j}BZ<55iKsgz>UE(##YU8!tq@@#NoH*Z)g1R!P$a z|KVQ0@7NhFZhKq$S3AY+)Vbl_Q~eNChXFE)q@{atFfKMr5PF)UN=DpdWZ7ysIIYu*#G-NMNoCo&=;&TO6M2QIMJ7&HdcetbNf?pJ?@9)HwFUE@W{<3Tg^`WhRv`CG=ebwjn z+KSf})9f}G<+XCveix`u$n}sof@JSbr$vaI`kYzT9oDsq%@_H1Rq|4H`}E|BePTsK zehv&?q7=&ndGzYFIRthjZ;a1T^0B<>gC!Q~uOi@VWyv_KkIFE)Md=>LesO;SS#*W{E~qq-B_C zFkZNO$D-Wm;9fi`>1e~Wa{WaM0GN>82|3`ro7^#dB(k8=uCCzf!!l8s$9JqJN`vW; zSkHI7K;ZT48r>QZWsAriyV;m)Jn0^$2A_(c@dPN`gx4zWFdY6l0adv-{lP=|789Od zNwl^fTcM7t>i|3V*XKmUw70Z*ZMl6EeN^pDr?gz|yBmsDCX()dUN#L}T`v+*@h)9d zgPf+DONj!48oP9$onu8}9BF@|tMuewb<`V${y%Z?;IR|>ivFQ0$iPqA)*Y*)+A(jX zFIPr!Z}N|Qk#;+*+EL78aEw51#i?rSjdAMHc$jQIos#FPL4 zemFtN$E4lAyiXZ=Qj+DeG-WnypRi>aQmh^ORoF)gIoVcuw5IKV}{~{`sec?N@$M<_s^6 zEYbfKti_M@WhAPbe7XMhaLLza@D|+-KP7?Y*1_xlm|LQLe683a6>NMry5nm>2k{|- z&+J=gVW)T>+?V2J>*Iydz!0n5=sj@F0oVeR;QIl0;;dlkCS!=R)j~*|i0e@zyf*dp zv_WQo;sYX;G)d@es)3Qo#`!oPXZ8f3P!!X>7`v}pLM%fXAg=q>fpp;U119Qr-Nz_I zMSt{|r~K8@OpK(SQFk%fL4;U>otD}~7nwxkdN{KaZc6Qb+TGvT+>6!on#Q6MFW8mXz)UQ1~0z03ZfZud6}BME^Y!K%Iz=dk&|t)*Nav z)N0%f*G8zmb6Xb1I`6>Qg_kLyJ#|hy_wKTt4?SCh3t642Va@2==QO~Jd?4og#?rz9 z^d5_ZXr|`pZvY0T!ra`zw#A+Zj_e?BPm>t%(0rX%p;J3!7;AWYB-0>xE_I@f}!}lxHz+V$Y3i)pcLP}RJCwhcix|EP@rMkW^=xom6n!JqAq;MpKy#3Yg;Dd zp8j5+V2YL6b2^k;>8fE!oY;iJ8yq1gdmU?a90UR#{EMceC*yy#ywgP{zj|Zg+7}(L z^LqQ{LhXCpALbiQGz@?6V_hFL&|3Yn@Kbug7nce!gJ(MlZd&5W7XtJV(+U|qvdtcJ zK)f~@76rm%dv#NgMf^2z8@rs9nr=+pi-6f?7MnCizXd=t8jR<8ssp~xgGo;YK!eyO zj7{-+LY+36o2=}FzwMrt*0?k$He)aeAL;G;7-G`tT~DRUawwD}qb#}>lDn>ba6hLN z;Ig0nWt+n34q;K2h~RKa`La-sc=$;acRr#h0LQ4ZeU;g+2+1O4n%+a(z#|*xEnC9y zCU4n|bKuo~7)&qBmM`f()gceDZ!-y+pIRgOR+t;y#*)kRuyx6j$)v_fJ_3VzQ}sSM z6d&&J_xl3n<|issE)^;*=6{g=kH?vvG5}M&zVjZa22hZ2YOA%)(Y~bYgY)bsvE@ zT-Ss-ep}wKR|;yQH=1?C-PR~gpnD1u4HohlhmHCZjfC^-jt#x{r}PFCp~BIeWPinm zzQS*^NTI&g_#1a&4i67O@#6m;1O`dHpcR)fn3u*)-b}(3(CJC7-C;;sJw!Hr<=^2I z>l!C<;tz|claI0q?Ozcfu0CKne7QGkJ%qvEzDL_QzQY1>AK<13baR<>KC*O0@BJ2} zXMU&jlfYki(H^;!!D&6t5L-Nn73D)wP^|c8a`8Hp@nmX4agC<8-#y~vS^ltIR z$B*V5dT*%7*#7#PDucPh$sk@b*6h~`s;`3UHH8rvG;4859vd5b zRX3PV4<~yqls#X`4YYaA`k{A?#2ea*sO04Eo8n&GPs!DA`go{CHJ~?M2FvT*p}O|c z)3`}M#DPme7SBtemkXf>N}s}vUTgQGS8;dEF`bDhx0DH_K+{oskqKw_OGz- ze7c66Ipdlc&Nzw8Y4u@B^cT|pN0AGSGe()$0o1dzf&;B_uaLRowK2&3c>AJBuF?lS z(};)mkCmmc^kjX~-6hT!Crk}9xNazN^+E9|s)rPztjKO1#wYk}gZMW(3<&+0t)TYF zvTvGGUXsFp<&qO_%w@cGx1WRXd^2V!9|w&^37|9Ia~D8Qu&XhGyrIhfL*9@~Gy?yo zhN8C;XzykI(I{J2H)``R(2pf^A^Om=7k$9hB4#a8&Q-NpoMl4eygPpBto!tLNM@>1i^K^|5z*n|GHDFXs=5E%Z~CjEsT%xRhZ*$+~GkMmeuaaBF_ISu!yx9USq%YgdkfBnQYw0ugJ z*;FeRZ~vOu5YVXHR4sRQ9qtOcbl>5dRkhh{3F-x~5?KXmmm8jgy^ptV41y!0Y&5&@ zzADSe)ReT4Ehvtf1&p#_Gq0$q04L#;#04<^P+bG~9ez)N z5(2=YenxRrU($PI_uOzBZ9sYdQq4`I!~SUbAUZVTb-Me(!_!}w&@>lnen?%-x%P%9 z=-}~&b~3Xi%UolC28lRrpbLX$Ao)pVYjBCPQR15)EXjnh`tkkJ*6s)90*pS?wfsfA ztXQ^t8lVaM!2mie7I3U%`V%Jq9k9|e$ul9d{-pLhbu#ue>>a_z{%VtXr34$@P@x_l0H>aUV zwFATVcy*g^9_v9g>oF@VX8}{NzNMk`FADJRF}*M$M6@27wLJb2%bS8KL~NO&9XPm$ zpAHua9~Otrt7h9w+mBXx5g8sJhn@5dyJMGj`RHpLjqtzyRi6pJ*s$b$=kVly8x8Cn zz-VaJyG9INqrcKO7lw@Dax`MXs>bZ8vW(2_1xpK7q2oF4zHjW>`0fDq291yk17HjE z?ykO}6;U>#iQLxLs$FpS*5B4|<#ix>%t2p28s`O@PQ+KH5Z0#nx;oN0=HF@w~s z9Gyiic)Xl8z+Q030|+efZoBQ4^(T+0g1^qFtJgSej2k9tYG|B|0#p|_cC*Qf4FDbk z&_6t0`T>v`J=LPQH*M|If=-_$Zp=uIzOxPKbo#K1>af~lj*aJ1&~b4vH3lF%3<-7v zVgy3JcVoV2=9hs(1N5PQXas-8{*Z#ZyAb-d=GpE#!pppYS9LrtJ1_JaNDzQvTmbRb z9o22MgvUz_h+!)Rbb@{;bCXS3QBX5#?R1$0j8 zh}#e8;?`mU7tMEiv+Sg=P5Zn>TX6Rm9ee%pLYDAB4w}B=@Om=@6n zn3v(U$I=P>q_<~mdxchBgUXJ@FcFVg_oEcQUco&)m(a7f$9st1pm=)%;9i)_-(fsO z6EcdvU=Z0)AxI&qWHTnHgk7QlW~|4$9*vl#wLhSkv+arJ%k}_tjSGytOz{(eq|Drw zGr@tEXRu4l;C4_@4D^qSf|zD%{O4ss&89j4A3qq?4lAw(JdHYr1Zboo^eF*gU!=sK zyi4WF8K~3tz>3X*xJMGxifntCupdL|1tB&iD-SpKDJC@sZ;qpd(RKHR@8@VLa<{$i z6{HN$^mW%K(UiAcTR5T_f0_n1e)3|QS0!J@W%~gsAG>C`g;qv5sPg>929D4{L;sR# zVO=W+L1r`HcJwLrrjl`Aq?mnfh*}guVGdugKJ-#~IF@*Gvw-h7Ivk)ek-aWNrIXC7uA%(fPhOZu6hn3*|=U=C=?3%4-CQvsl-Fy_uXwtA!;%W^&O9KgTUe zI_WaZluNSUtVqkx2-RYD&G&?{Q8u6#K6wbJw81%L%8K{${5g3EbYdwH|Kfccvqksr zTiLT7{WxBxT2(YuhSnyBUh6~rc&`JT!o2cZPT~d}ZNh*HF;lqGYxIkE4Jb_2=B_vuvvYps&4xpN}MfZ7L4*@0n zi=a$lf=gDu76~^xx0=S(boh4vYZzBjMfSEOOx$M0> zC%8e3OA-&%PFGs5)|%H2xVSA$vsO*F8(#>hC%=hsz}LHB)A$Kfqm`MO17qwJ@^SMp zMdAHSY~L^JvjE9QC%hsJ>)sxv@Cs2dda=&mvf6kxtrJ3S8#*a*SM!s@`8^|ClB3Wq zurxnF100F7_)Gr;MWDmBx||E(SHMrd!&9mLa>E90!REj`ffcrY4X>dL(Nx6)w@M9M zvK>@jJ3!hpF}(hiFCK=|r>Q2e!nY-oZ~3C|=4OmF{5Qo$6z@ukwh&`U z;&sFMu=kRfiS2Xb9&`;_c?~p21@&=M_&ibdakD}KreyPvE_vW5w>QI2gqX;%6n_@} zOw}>Na4|wPi#Q@NR;V{On3 zjrCIX#?;F&>e~WGssbhzX`|oiT#-h{m@Q)0FLtICW~-juV3*oPo~aTNG%8}cwVV_^ z{HXEdzOYk2d^fUi%-0|Gqiheu0q)m0ej-62xZSYRMia);^Q9(9xZZF(5i7?q;WQB| z8x2bnJaaaC=}}v6Zf@RRh+iUX)zn1> zf9aBXg?`&Y`&=a&6=uZ>6vT%QA*Awa>!rQEr~o-P&?ksxXMlY^k431r>DW|xhARt@ zyp|~_DBd^!e(mo5ryzz=RLb6T6*MF?Z8T!teOKhPvw${{eJ6LseXk!qL|r@yy0f&$ zZ3C+6Oh@wOZHa4NEG?e^`WOA}p|8{N#~~V>jT^<&(7B2|8q_?^F=LeaUchexF?)JvRyt5Z<|pu${mlcyq%GaT&~s7#|cQ#z+T z+y)e-3&9Ib?2tlUEerfi&jNr{rrmPhSfs-?j%mTTJF9KHjOq4+*;8*mq(O+J_ALj2 zvr+Z?XAKlMZ4!#)WM?Ib^E|q8_jhl_0^@yWxdad_El=S0_QOn8f$73T+(6)wl=%vu z6{0kx2w#BdKcjU2{>8mnU?yW>HO+<(?y1Rvg$cc8py z6(lC!z9p@c6o`c|B8^BFFqL`l%r25klkcE>!0R}yQ00G)-X^E)$}V(UVy>`yPx<+F z;^RQ_y-)+4qPaODZ?f&cJ@+fpst4jbiolhlH7%&!m71E_=FxQt3_Wyo`Rw2A!;<~| zd(*82t)Zp8CN!=d;GTufepyxfF{v-d8K7VYG}E|JoUXy^u>UY&a|*m-AaJL+8Q=?7 z@PD8hq;EvQxdhZrvU}_VopblK0gp<|e;A;zHeXukz7OC8{U_Y`LVqd>`1Y(M$`SP z=C}8PkaB&+;bs)krPati&V}bMN^^wYoVR@&phlzZGJ05D{In;2p3*W4kusxy$V2?b z#PwP;3j(tbpLCM=x#GxumQ3OgRm*c?bn4Gd&0_eWId((s${5=2ay6ku@V-0j#Qk;Xc%$?v@R!T}Ek0>@uHgMxQ#$?2fqoEgT zTv^Q%1ZG|%l&z|HDvwOyd0JuCR~KH@l`RUz%8;9OlY&wQJ92%`nM5BsXrYIC%j!k* zg#gK9-j3zr?dnEs9M%doJ(Teg#(DR3flu>1MnzJ6u~eZM4sYnnt?!uWCpR_>EJlpo zU4XPwdB0jG{rP=Kx>yy-wQIjTq&3Q3^775~&scV7B@@3@EOf$4#J*M`0V=egv~)*jkD&Pmu0lZ91uEe<4BU<$nglD=9jsh{y=j^2c! z6-3-ITkgn6;kBaFe=HRV32?1N$9I80XTuTIKh|7kZsIds#j)wXn>B|x>9U!bYX9e@ zn(-e?S6=B~SCd4jIIz`$ejyPxs}q0<;O=%VpMY)wasr*h(}35{wsPeQ47|96-#-gl zydLzDZw;E#RGDn*H(JQc{sz2%uGvcknrDvH-spshkmtXy4UMUxM;-X~VhOx(Mzd3G z?@vfh%>#39*IHj^NlvEjLo>z13x3^jC*j}or?c{*$ zGE7WRQ<>fVrB^ZimOuaZnai1dc2l_+lX+f;GRapGoN|lkr&B$l!HX`WR0tI zT0I52VafmeXg@3HmvTmPEuIOq{B=~zKVUBp3Yd8&D=cD0o&dw6HkfGn?!n>A5bMPW{bF$i;8-A#o-q9oj7N9p>S7)}d&iRxu zW2$46Lb%d?>(Qt&$T3CcX_lUDiMU#>r}Z|=syVb?P7l`}TIsFLtME{2RUo$OjznB8 ze(}7VDLp8tF?kspuc9Ha3IYo2VL|?hqkFuWSfW(;L*3&QQL;2Uy8v|SR@NcwV_WV# zvSbmOue;0&l1$fesJ{9Ly{>Y9fM3azb0+@7(JR4G_}2&kzr&qdFH5(u|6*=ok;xgd zk5Nxxm%cAe_DE-BmW*(GKJ3AbD4bWdvP^|G>Q>CA>^z&s)|dntfam9EpqA#5Lz{+% z1{Bxw>jl{lDjmng+IgPKQ1vHWJ^0tvc#~b@| z8M3hA^wGnz(wd^uA#>kzS7YhVGFfMfrPQ^^B zsqih{m_aVu1?`bavp3hp^BRYmG8P;gWU-@#HUhvN5dbjGX0BaEC>$+;z7>rl#C^wW zAVb_4{Y-E3Bg}b@U9KSDVpy*@tfjCKa&bAxgOk18yA! zgZgt@Th3C(1#aS3>k3Xa60fS#USNOknN-qsea#{o<>2kmFY|Oted6!R;Lvlxu^Im? zV0!lSsH`?T%c8Q6<-qbd0OltxG^VcmWwq9i$1Be2vJd5P+p_i|Evt@GZt{oo&u-F( zFJOJlHN)6BhS)(=SVc@QZ^(7S+d;6B{$Y2jjFIAG|Kr75V;Zymk5NuGPX-T1RGv4# zIa?k!{`T>0SpuC`pq1~}39)a+ZJ|VX-)7%?=@m1UQ#2eA#9qrhYaJ>*l%rAglMh

A22m;t7OVixKnLuJ7>U4Yv%cUd37m>3h@Ak}i^vAr z>Oc`+a#;Nbw_8T*BsK5@%O2;;VEU%|EKFRe42Qy2_Qv6u<>3AhncMmZ6$(YnRl8Fm z07F(VdoB(3+zoY!H!*Qa@|9ymNFplyWRb(Z6DelP;tNuijvPBPTFaPqA}m zxv1BMLzySD_leLv)?0*yP;4Vf#pK($f-dR2S@#W9fkT@!RVKN{o*siy&~j`1THvN{ zLh`C{?~q8&P^ke;*RKZ>l^4_{Tz|y>!Z0acZN*ql98}x}MQJhvjFPcA?jI!jKapos zOt<8pdpVDN;k8UF&nzj)9M%sEUD!;x*|_n$v{(47&zoSzW^c;^HC>n#&FcZ0?ZZI0 z0DLWX#(+Iy&Gac?io{R8IQY@Rjw!DDq@SJPSLiM5RwZY>Ok-I!l9K|z>4WY}`+>n` zTvfD5a|F6#du05*?nwU(ZFZ(pcSMcx@Cb^ZkiLt zSS#lLRcA0$rqrO@W!~p5$oOb!YhNP27jBN1Vms0nsD6NsdpwZ!|C%{+R!>Sp!9<=> zUf%4d%lpQK_9a--s2_l1(5q(l>1SXblc(wBUwPdFZ@YB~ud4}*EUVta^q|lvIp&0^ zzZepa#L3Ma3e zH{xOk8VYz^)vjqxvdlGHtLZFZXIVeP?Swis22Ia)ZN+dd3v=4KJ34GlPW4Jke%p&* zjt75ZOq<-E8E!Jh94kGLSH>1gJSp36PTxriue&F3L&G4b3c-u}y-VEO9~1I%ZKNJ@>2yPw7>j1gibuHQ4E9B- zF)6?$NBw``C=*gFKp;9l1`TE1S0uMA>$Vb#Xf?0RQOZpC{#f0dwKm1C_LDJx9^X-F zc;G&%PeQzyr!`oLoFal7oXGs%lfS&5luuO$|8x@)pC&TCFPZCz(^{6yZaf#Kj{U*|gsmGvlK;eeLWuD)9JnS*srGZ**R-g+v!Uv&B&3Zr= z(zN?l19=%i}X>O%R4PB@|qj^`kQ_R<4?l>L3w7E5V3BcO9o1&8fChqX;PdhPg z9V(uO@q0MXd8zd)ptkB5w|WKiTspEp8|s-E-^u_+$BG*9_zv!2sG$PQ-6PEJLBwY-9zaIW- zKaM9Fq9dJSE*InXAkkT1dNgfjvGULLOFC^C5-lvK$zC#x-hUfAn;}wG?r6kAjfPl_EFNYcBg$cL2=Z=IJEa=aNRz$Mx3{Ejr-vI4_(`$cW9+>qSJ&w z=sg@+$Uwrx=F9 z%OW!H3#txOrRt<9O0=}O3f@Lthjh*6Ygn4lvlD9<#8j13IjfTA-!xV-b~!p&i0NSn zkF_%R%N!a1JpxsyCBL=AFH=4{aPm$*OZz*lF!swE5pv}44UHS!{EFS}3xIv&OPfQI zn@(Fh9Mw{+!9#Pt6-Iq*8MY3aqdB7CFM@}&m`^&a%r#yfO?|d3#?=Z^_buCGB zR*V3`A`FS4op#!)HwzZdC@%Okz`($=7lFI>rlSM8<~$ zqAKi#EA7Crw=Acudt0e&#i8~kipZVP-@Nk!g=X${Z4~xSBqe(~WlD0<3rde((BtJU zvtO*W`}HUzIppruTRk!nqkQu_E8b1(7Nm81Dj-WErt>k=(dMb_-c22hGTL;o$4rj~ z85&56l$OSO`o1|Jh=JJe^S7P|Y6;w7_3^mOEFP`9l#vzFnCK+0WrONo_{O+izCVgx z?UpY{nmHez8X;{DW-W&tj@ z!gkGa3^Pbs(X!@$__#?-2@x9Ak@Y#1V{OUoJ9P)?-CyZf8=~!g!%WT9SSu~+a-6R} zSv?KtEjb;qBI6jys>l&hnAR%BJ)*M+TSjBt~)(7QC_`zu{^aq9HI+HympEIdwe zyXih+ZI|M*$IGD=_$c97&sxt@ijlb~^ipdyG6odqCoqzw&fw8~)V^zlw4B`Xd;caE zUxhF!hoJG@Cuhs=p*(6xai}#n`YbG<(_&Vnzj;?4m#hwl%RL@eaZkS!Z8=-8tizd{JQu-DAw>F1)TlN{)FE$ zx9aFP)|`A4h?m(@^zrK#>Vp?jiz|JUM<}G*d6!hSA>%=H@x5_HZMNakNSBx7_VmqT zUA(bXE;p9nnJ*M`^`;(u$#60{+4XTsU%Kb(mTvF&Myuqhn156}XPMTwJ0WVuGFXs2 zZiZRDe)I^Oe>aGsrSi`*I8%fsuw)O8bbeAlKr)vL44fxUjWSIeIID!E=lAN?@^Z1co{N~kT?5)frZtYTuNvXdwD%HdhKy| zzQu%54JqJ9XwG;%`E9@Yb}d;E}b`ZaWfCmNMl} zT)A9zX9g3q<#xjfuE+)>2d5#_X1bc;_lG%cj;#5Qx9ZQnJI?U!fhBO+J=+DqFy*%3 zmsxA0A{Rm0>&_=jdTn8Fd*slhj7ZM_m<|o)5l0b$!PD(8M#l5M;e?_mc0`bdG2!A( z@BD3juTJ_SO{>$c97GSsqalz81*h7=Hf#B_Fl0_bjRTd4)!dNhh2i1m#X*HR++(-h z5rr(|HXqwo8ng$L%e5T#8&NEkmi$v?Y}InITV2oaP}bG-9LDISFjwn@TtO(Ko;EJc zXwDj2Q0UlP>}U1DJ&+0ESu@TXNi!ZB`Jn9D<8-(w>#%kg;VEW04ZEZ}nmJM(wEUD~ zTFF&jJXOECJ^tv0n4fs3PVTd#3AT%l5%9bHlq`@xE{Ub!<*@Q~&M!-QafQYf%_V)Y3 zFYS(-HLyeLcaSOJ>{}xBXG>{?)NZyHr`=#UuLdonDYmBXX7FXZ*|-?KhNX&)q&)?% zE^Uh*kF*yuKD)=|DQRG-e0yR)YvEghoJaz>XKi$;83U?pcSX_?Lo$SsBM8d@?&ios zSOI(}CX!LB@tNsJ@C9v8@s8CB69p;8#}xEZ2cFT-4nvxn>Z-S@I)9t2@~7V-x9unQ z)b*C@H*5EDXX-*iqkOwYR%GzoUNIyo0hNdk5te5nZY}Tl{FSkriZz3rH2gzl=`%3DNH|N>!KSvlY5hj_Q0dcW z&muiV&+!t{D^8m(#~F!6LJbXkX3PwbNX>XHnVRBSf*e$W zCS`XCy&W9Ni6rdC6XWN(Yax4R6FVcarrwX7jN?I#uZ=57hIS`8R}0A)#ron|cJV9T zj@QwsSRXs<*wJ(iTX$OR+Y>mvT=ArlyX=(|v7Sz&IXw~yEu}dL183s}T1SSC=NI7` ziCrjfi**l5Cg|(;=!rH1G71P+KXB0*>C8^)SIG8D&;C}dkHGU?D2fj;PW#;e;A!JI z*PNrjv9ao37@C6l)^r%x@4lShFY&eT=Mq%!Xgw&s^wQ`mN;`9o;aC3E+C?V?A>{n+ zqabu^IUC4u{@n(Dp1*E7$<~L379>cuq zhku0BBj_Tz)2pnbaAb;ns|cs}i|oiVk%Q^Lqh54v_Y5l~%xrKmgf7-eSTco-bU9X# zjeXIaDD{~ciz!#}>1od#%$qm|bz9z0S%@PmcN-QX;jI$_L z@2hvrDXf~v4Z{uK%0It7NN`m=aA^|}Qz{*h*JM2~++49+*Ur8-$Q3ajIIbtqfxHnl zN+Zl`vaSC8*QDj;?yoPSiB1bKtCL&jBbVw&-CM$_Zn)Ob^d)G)B%n5Pd14t}@xTIa z4ciM30wFiKR`0T^NFnTo-Z(vUL~q}c|A@s27Dek{>enDTDA{`3g+&6*i4Id`@v7hT zxQPNgcD57{t3>GuUtS1A^?DpZ_xTI~tR`}rWmy-S5`x=|{+xWU-BI=(r>#D7vzqc! z8iCe&xD0?5Qh&Ehp zkCu6~2Rq!!vfWIY{F3;qtE!$rSPEXx+^IC^j_opi+QAeOGcgp?zrVlVch1-{{#5Yy zwuSVNI5dVZ3e=aujCNXR_hi>Bc?kNWwXL-Ho5#&^$~QTZ zG|D2fRD1~%7_|DbN7+r6nZi7J^e5!u4AzlPHCEqg7t^2mx#XG|<5w@3l?BIQfDw?j zfx!jwOde3|X18gaD#0)1P7s1?`IRfys;5~i#3I-XX84(zPhI?51mlnP<&^vtgm~DW72o07{=nOmk(EQtA+(jZtF-eC%hRp01JU1963{Y3 zD5GP?l;)Ux8e#wdhx7HX!abz zQwUg!vfo*^kh0fWQP(%rJnOy9GqvpqJ96x9jOVtPie~21Mx$CL9@S>CJVNx|WjqJP zcU`R{1oLRVp;V&p-T3<58TwY{&RHDX0_Tl1=Z!U6^>JA@mS2PZ^s^fpC5EQ2nGiXJ z8vF#p1FF)A9TYjYwYZX`4|`8Ky%gQqQ#|bSg`5}j^$mNCf^T7~?6y_bIW6l+#(IMi zm983iHHdO)CQn*#AJv|3Z93%`Q$f1~fe*mA%u7&23zX!?DXaVAl;{3UPCV3+$1#RY zbD!^|A%#C_&mSU&{WvPPYKs)PVwbkE<`j##IvDPF}2oYas_Q6 zHl>1Ryc+TM<8!GMMs3aY8}r2=s^w25OfsP3$HigpECjI2BN*(7hx%UxLi=ydp_c%G z$Sic3i%Wgthqa#brO3-NE;}?`4q8yYzU;OX)jvV%xfM1Ov63$Msd{g&1bQBkDrSl( zLGdAS2sDWCpCM!L>I#Rd7nZ(hqpEt{3+&ks)@BA=cyqK~=Cqv_0ur`r+u)EWRgHQD z@80bVZ4|O@RA`)1+|N}D)hptZ!N-f8-~70YZAgJOA3?5a{K!r09VJ5J;&|M}QhTPd z(l_0yP3x)GigGJ{LXpyqLIq}(;7*B3BAlVUh@dE32|YG;Nqs#vTOmWPm-<$>`JSvf zbGKDgv(g-}iVJNqQ>(BEL@pCoYA1ehzA52OezB)E?AsIWE1a}482ivK>#2qka@hAY zR4Su&KAt2z!bP5eByAw@>odGZSYm!<_dBz*o3BZ& zeC~g#BxOK|slg$YU=(4LBm2Q-H^unX{pz35xm+W9Yx}v8XU$Sbf?d2!QI1~MnY~0x z;Woh~kZ0D2;Y8*e#vvKrL}cAn572m5u+Og7DS`csiZ!2rvHX$r!P5=}+ltd6Fcs8_ zk@tM-*($p!dkDzPrw&iysKQ=-Jp*a`h4Aq=#_b*O>YPD1wW|2yP`QRwJkWs0m}|I^ z2SW#qc{r-dkIcm=iH%(j4Zk3mP%Yy_kdN&OKhshKrjc^2k$G7bEXd@n&=}vB&>aW& z6;jRzI2>|Rz|WbSML9S?54yxe%9R+{^GOVpJP4Uck`CFGGyDD z-FTM^&)rVHTP*9I>4cMir3MzcDMj6~Bln z8G|#dC;|20&gDY28Zn6{!A`U*@C&e2@zJjcfe^FLDDiCd)JUm@t1~G);&oQlP5vAs z8}oR^rma`n=cxe>hpqH5j<>>o*EZu)!)Ic|=cjVNqKE>0YITA2Ar4`7(H?}K{BYNW{h-`0S86}B;#^K$dnvfmvUGR3}dAh6m3$~ zJw7l&`6z_;wku+qoRQ&!0#GFq+n3OjV1?B_6Q)tDs7PSSu^|w>Y?1P^vU)Z16!kZ0 zUN;^o)K1YmJw|Q!Ru=xSX%ae%9meeR{oDGrqg@pUr1b+@kl@x5v}J{S3j@|ddH>pjcI@mokVYMm``M>C#19LI}}`DFP}R&B$&qlAvT0ll{r8YoCELA$!zXK@(p4 zjku-Z{FVGrkWEFwXb2NNG>~NP!$YOi3|~A=bqTl~t z6#h};ydpL?O>C9v8LPG{0y^6Dj<3wkx$^+zBbll~YQu+1vYce#j zm4TqG6T@Xy;nTSm?HQX3I&5l_%o`s|-=mje9v+A)uA&EW{w;L$a1L^uanNfGmb&P# zS+uiy<4-|kpt0JU8fj`!AP9WpQW6Mx>s3e+n#f;$a^!J5nV)C)x&tJI=4_=Q!GG># zhaPieRCS{BT;W^sM#{H{vkq`YuJTkPvYPhGiKxb*i5P^A@kZ5NZjOn5kq%lUAD0$t z1S~D<0yKS>IyDL`qj1AB4!#ScZ{s&s5cnBTq1B+2JDr{N-O;2V%HZebZ_Q!15Km^M zYIBY_qW}q=t5MgvTW)GSnw&+bolEdNl3V-c26FgeeYZSDdWMYUloywEPPxXOLh;w$ zQh2jsN~Jzj*R{S98+09=5UO+3Bt*;NDpI4?Su(xw4SOuJmDsZ!oO_;mEBG`;mH`LZ z{Jc9Lx3@1!>%<!$#LSoA+SX7j}F9C{;@IF4mxMx~`{EIrF0+c{hcoPP_VgQODJ8 z2SuRI)o@Ie-=U*C{3QOqDFVp%F!WAW#P#Sel@4%5rrLca4EpVI!}=i{BW1gjAzuO> zo*T>~Gi@+KVUQm`ii7WEPa6u;kx6=FC@SvNN&nd>RLy!5oT^E?rJtjWW9Xlp zKVu+FtK4DZ?KFILMAq2A=e11Y;418Gmg|vp7RLcducr=j=fZ6BJ&qc0OtP~zjFu&v@yqq>{<6-8T+GfyQq> zJ7DJ=d-}Yr+4)M*SaR(Pr)H%-Jjz6ePqA^INV7>FgaE15Yds{s%u7ugN1sMyB4_VU z<{WCIj!;b@XXA?Yb~4I2hugC&s(Dz&e$Qnp8~By#U5zJ~9d*u`FK(dQAxTsFqw4is zE#Ya=)RlmPOcWfO^otqrb;^s;W`=ASeFUEE0fAn z!ERYqPud~<{Nz~d8+RpkgUO#|SOJdrF3?#6((b(d-J$;O?hTBh*gwiX=UL}inHoc? zSzo(!ifDzX>R$;a!x}`n>KNTPtYCu~pCZcpFpG+FMJR#;LC#XRX^y?>DlBq9cc(>~ z1?Otm?Nj9!QOeS#3x86O_f+TqPP$MKvf6v4mzx$MQ3sW~b<@*Q4BM-h<3GmTT?_?W zgm%S;PC4XZ{IddyCY^VEB9HTD2-fRrsxYE& z{!v>MWZxqZ`JtTKFGcF2P%-`PCG_7pO$%`nOc<%+Mu>6BubX1(%>S>L zdn?&Z(7utAlLMHo#n8QDv6&qp0-WJJ+pO8*Zd>k^6yE(Jf7g7x=)G7Tx>Li&cFGno z&4ChXy2m_IR!!CRYbDl+zWBz^Jk~U3V-piC@DU_ixNJ4+B?z78YRiHxPuT#^vmEG@ z$S1X!`oWPXX8M}XIlcpn5>(n@(i}h6VjH2k7|l}~ysw}PjsUk$dWlD=4!ZO%`uQGP zr~LRrCmH&|mE7%(bqWaP1=cvMRxrb`nm_RwcGy?&w{07BJxki)#8&3KQeL;D%kyP) z=*g#$$gkdU=W$E6k@HT=UD#Ts2XiZ;H~K-QiHn`k`F7K^ajdf_UYEQxd4>5T8C6F^ z$yZg4ige{NrDfs#SB!dJC?nmGQGhjB{4%dnH*`dBiAb$#A&^=3RYGKh^MaWy8X3#% z7T?=YoS5Jbf+Qs{7M92M#|n6w((a=V@H^j1eI@#qtr$J>c^fe2R@=8c{gAl#p|1W* zYEQc8l*B%ZV&o)&cfZ_Pl%n7OrAAWst+l9k3Tl@+zF1EJ(dOexXqV&D!Wcu~~- z3P<;1b<6HUqZP6q)8hs9&{O7k2OIUSMcv8$O?8kfN;QS|I4EZ^%Z1)rF+=#$C`Ze| zzsFvcyVqIwtINH73Z@rYU7&@Fhd_8)Nt^i*i)sNeof3PG>0bp(JyN{KuvE5pIizq)c$ZV${;R^v za^G}*!<@F(?5~s(LW;o(w>UH$exz2)l2N zvc~7<;bttn*F3ydL-Ee=aTsG}z6wQ$k2=r5fXhvNrI;t9F(D~}$mj~LYhB%cyqc#J z9c4zI5tQ#!hI2Y>tbpczFRZWTi>?eA&We9DlX_tRA#S+3lnq&DnI?RroQSp3=+?)* zU+542w?{c#<%X9#5{#|{@lGdmrf2vGW)fFB1;`@koc8<~wMS1ZB}R1<^8_I7XLbiH9OYSF&zPsrBL@vPi^^n1`7Ej}kRqq3nqbolU* z)ClR5a7LE0J_-9^^j}vVOa-yCi;fEb#P+K=PiHCC#b9z%g0bd^s_f4vKUu8*>-uv0 zwiz&BZ6PzXZHF{`igB6G_;xpCUEs-iO;qe#v`~w#$(YYxAZa61@Tp7xeui}2kD~_K zhzq~4tAG^pWhat is the name of the deployment, will it always be the same for every user/installation? - it's chosen by the user +3. Click on the deployment with the package name. 4. Review the status indicators under **Completion Statistics** and **Content Status**. If there are failed deployments (endpoints with **Error**, **Requirements Not Met**, or **Failed statuses**), you may need to troubleshoot the endpoints. See the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) topic for more information. -Naama: Is this a correct process for idendtifying/resolving issues? YES! - -![image](images/sccm-deployment.png) - -[[**To check that your endpoints are compliant:** - -1. Get the *compliance.cab* file from the SCCM configuration package .zip file (*WindowsATPOnboardingPackage.zip*) that you downloaded during the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://seville.windows.com): - - 1. Click **Client onboarding** on the **Navigation pane**. - 2. Select **SCCM**, click **Download package** and save the .zip file. Iaan: Need to confirm the UI for this - 3. Extract the *compliance.cab* file from the package. - -2. In the SCCM console, click **Assets and Compliance** at the bottom of the navigation pane. - -3. Click **Overview** and then **Compliance Settings**. - -4. In the main area of the SCCM console, click **Configuration Baselines** and import the provided cab. Iaan: Need to confirm that 'import' is available/ UI is correct - -5. Right-click the imported baseline and deploy to a predefined device collection. Naama: Is this 'export' as in the screenshot, or is that showing something else? - - ![image](images/export-sccm.png) - - Iaan: Need to confirm this is what it looks like - -6. In the SCCM console, click **Monitoring** at the bottom of the navigation pane. - -7. Click **Overview** and then **Deployments**. - -8. Click the deployment with the package name Naama: What is the name of the deployment, will it always be the same for every user/installation? - -Naama: How does one know if there is an issue? - -If there are non-compliant endpoints (endpoints with ?????), you may need to troubleshoot the endpoints. See the [Troubleshoot Windows Defender ATP onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) topic for more information. - -Naama: Is this a correct process for resolving issues?]]] +![SCCM showing successful deployment with no errors](images/sccm-deployment.png) ## Related topics - [Windows Defender ATP service onboarding](service-onboarding-windows-defender-advanced-threat-protection.md) From debe658c33a07a510232dbd5406fc8dcb8649f41 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 2 May 2016 16:20:11 +1000 Subject: [PATCH 124/439] incorporate Heike's feedback --- ...ows-defender-advanced-threat-protection.md | 65 +++++++++---------- 1 file changed, 32 insertions(+), 33 deletions(-) diff --git a/windows/keep-secure/windows-defender-advanced-threat-protection.md b/windows/keep-secure/windows-defender-advanced-threat-protection.md index 5f3f2c915d..a9833ce304 100644 --- a/windows/keep-secure/windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/windows-defender-advanced-threat-protection.md @@ -17,40 +17,9 @@ author: mjcaparas [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -Windows Defender Advanced Threat Protection (Windows Defender ATP) is an out-of-the-box Windows enterprise security service that enables enterprise cybersecurity teams to detect and respond to advanced threats on their networks. The service is composed of four main features: +Windows Defender Advanced Threat Protection (Windows Defender ATP) is a security service, built into Windows 10 that enables enterprise customers detect, investigate, and respond to advanced threats on their networks. -- **Advanced attack detection**: Actionable alerts with real-time - visibility into cybersecurity threat incident details - -- **File deep analysis**: Dynamic cloud analysis to provide visibility - into a file’s underlying behaviors - -- **Footprint service**: Proactive exploration of potential attacks, and - the ability to map them to specific machines - -- **Threat intelligence**: Insights that are validated and enriched by - security experts using telemetry gathered from resources worldwide - -The following diagram shows these Windows Defender ATP service -components: - -![Windows Defender ATP service components](images/service-components.png) - -Investigating these alerts provides additional information and insight -into known attackers, their goals, and actionable recommendations. - -Endpoint investigation capabilities in this service let you drill down -into security alerts and understand the scope and nature of a potential -breach. You can submit files for deep analysis and receive the results -without leaving the [Windows Defender ATP portal](https://seville.windows.com). - -Windows Defender ATP works with existing Windows security technologies -on endpoints, such as Windows Defender, AppLocker, and Device Guard. It -can also work side-by-side with third-party security solutions and -antimalware products. - -Windows Defender ATP leverages Microsoft technology and expertise to -detect sophisticated cyber-attacks, providing: +Windows Defender ATP uses the following combination of technology built into Windows 10 and Microsoft's robust cloud service: - **Endpoint behavioral sensors**: Embedded in Windows 10, these sensors collect and process behavioral signals from the operating system @@ -72,6 +41,36 @@ detect sophisticated cyber-attacks, providing: tools, techniques, and procedures, and generate alerts when these are observed in collected telemetry. +The following diagram shows these Windows Defender ATP service +components: + +![Windows Defender ATP service components](images/service-components.png) + +Endpoint investigation capabilities in this service let you drill down +into security alerts and understand the scope and nature of a potential +breach. You can submit files for deep analysis and receive the results +without leaving the [Windows Defender ATP portal](https://seville.windows.com). + +Windows Defender ATP works with existing Windows security technologies +on endpoints, such as Windows Defender, AppLocker, and Device Guard. It +can also work side-by-side with third-party security solutions and +antimalware products. + +Windows Defender ATP leverages Microsoft technology and expertise to +detect sophisticated cyber-attacks, providing: + +- Behavior-based, cloud-powered, advanced attack detection + + Finds the attacks that made it past all other defenses (post breach detection),provides actionable, correlated alerts for known and unknown adversaries trying to hide their activities on endpoints. + +- Rich timeline for forensic investigation and mitigation + + Easily investigate the scope of breach or suspected behaviors on any machine through a rich machine timeline. File, URLs, and network connection inventory across the network. Gain additional insight using deep collection and analysis (“detonation”) for any file or URLs. + +- Built in threat intel knowledge base + + Unparalleled threat optics provides actor details and intent context for every threat intel-based detection – combining first and third-party intelligence sources. + ## In this section Topic | Description From 0fe860f7f6089b4c3d835fe62d436eb0d0f2c96d Mon Sep 17 00:00:00 2001 From: Iaan Date: Tue, 3 May 2016 12:26:26 +1000 Subject: [PATCH 125/439] tables in troubleshooting - remove < to fix tables --- ...ows-defender-advanced-threat-protection.md | 54 +++++++++---------- 1 file changed, 27 insertions(+), 27 deletions(-) diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index 339f657d3e..acfe014edd 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -178,38 +178,38 @@ For example, if endpoints are not appearing in the **Machines view** list, you m > **Note**   SENSE is the internal name used to refer to the behavioral sensor that powers Windows Defender ATP. -3. Events recorded by the service will appear in the log. See following table for a list of solutions to common errors. +3. Events recorded by the service will appear in the log. See following table for a list of events recorded by the service. -Error ID|Message|Action -:---|:---|:--- -1|Windows Advanced Threat Protection service started (Version ``````).|Occurs during system start up, shut down, and during onbboarding.|Normal operating notification; no action required. +Error ID|Message||Description|Action +:---|:---|:---|:--- +1|Windows Advanced Threat Protection service started (Version ```variable```).|Occurs during system start up, shut down, and during onbboarding.|Normal operating notification; no action required. 2|Windows Advanced Threat Protection service shutdown.|Occurs when the endpoint is shut down or offboarded.|Normal operating notification; no action required. -3|Windows Advanced Threat Protection service failed to start. Failure code: ``````|Service did not start.|Review other messages to determine possible cause and troubleshooting steps. -4|Windows Advanced Threat Protection service contacted the server at ``````.| = URL of the Windows Defender ATP processing servers. +3|Windows Advanced Threat Protection service failed to start. Failure code: ```variable```|Service did not start.|Review other messages to determine possible cause and troubleshooting steps. +4|Windows Advanced Threat Protection service contacted the server at ```variable```.|variable = URL of the Windows Defender ATP processing servers. This URL will match that seen in the Firewall or network activity.|Normal operating notification; no action required. -5|Windows Advanced Threat Protection service failed to connect to the server at ``````.| = URL of the Windows Defender ATP processing servers. +5|Windows Advanced Threat Protection service failed to connect to the server at ```variable```.|variable = URL of the Windows Defender ATP processing servers. The service could not contact the external processing servers at that URL.|Check the connection to the URL. See [Configure proxy and Internet connectivity](#configure-proxy-and-Internet-connectivity). 6|Windows Advanced Threat Protection service is not onboarded and no onboarding parameters were found.|The endpoint did not onboard correctly and will not be reporting to the portal.|Onboarding must be run before starting the service. Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md). -7|Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: ``````|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. +7|Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: ```variable```|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -8|Windows Advanced Threat Protection service failed to clean its configuration. Failure code: ``````|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. +8|Windows Advanced Threat Protection service failed to clean its configuration. Failure code: ```variable```|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -9|Windows Advanced Threat Protection service failed to change its start type. Failure code: ``````|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. +9|Windows Advanced Threat Protection service failed to change its start type. Failure code: ```variable```|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -10|Windows Advanced Threat Protection service failed to persist the onboarding information. Failure code: ``````|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. +10|Windows Advanced Threat Protection service failed to persist the onboarding information. Failure code: ```variable```|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) 11|Windows Advanced Threat Protection service completed.|The endpoint onboarded correctly.|Normal operating notification; no action required. It may take several hours for the endpoint to appear in the portal. 12|Windows Advanced Threat Protection failed to apply the default configuration.|Service was unable to apply configuration from the processing servers.|This is a server error and should resolve after a short period. -13| machine ID calculated: ``````|Normal operating process.|Normal operating notification; no action required. -14| cannot calculate machine ID. Failure code: `````` +13|Service machine ID calculated: ```variable```|Normal operating process.|Normal operating notification; no action required. +14|Service cannot calculate machine ID. Failure code: ```variable``` |Internal error.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -15|Windows Advanced Threat Protection cannot start command channel with URL: ``````| = URL of the Windows Defender ATP processing servers. +15|Windows Advanced Threat Protection cannot start command channel with URL: ```variable```|variable = URL of the Windows Defender ATP processing servers. The service could not contact the external processing servers at that URL.|Check the connection to the URL. See [Configure proxy and Internet connectivity](#configure-proxy-and-Internet-connectivity). -17|Windows Advanced Threat Protection service failed to change the Connected User Experiences and Telemetry service location. Failure code: ``````|An error occurred with the Windows telemetry service.|[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled) +17|Windows Advanced Threat Protection service failed to change the Connected User Experiences and Telemetry service location. Failure code: ```variable```|An error occurred with the Windows telemetry service.|[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled) Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) 18|OOBE (Windows Welcome) is completed.|Service will only start after any Windows updates have finished installing. @@ -217,32 +217,32 @@ Normal operating notification; no action required. 19|OOBE (Windows Welcome) has not yet completed.|Service will only start after any Windows updates have finished installing. Normal operating notification; no action required. If this error persists after a system restart, ensure all Windows updates have full installed. -20|Cannot wait for OOBE (Windows Welcome) to complete. Failure code: ``````|Internal error. +20|Cannot wait for OOBE (Windows Welcome) to complete. Failure code: ```variable```|Internal error. If this error persists after a system restart, ensure all Windows updates have full installed. -25|Windows Advanced Threat Protection service failed to reset health status in the registry, causing the onboarding process to fail. Failure code: ``````|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. +25|Windows Advanced Threat Protection service failed to reset health status in the registry, causing the onboarding process to fail. Failure code: ```variable```|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -26|Windows Advanced Threat Protection service failed to set the onboarding status in the registry. Failure code: ``````|The endpoint did not onboard correctly. +26|Windows Advanced Threat Protection service failed to set the onboarding status in the registry. Failure code: ```variable```|The endpoint did not onboard correctly. It will report to the portal, however the service may not appear as registered in SCCM or the registry.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -27|Windows Advanced Threat Protection service failed to enable SENSE aware mode in Windows Defender. Onboarding process failed. Failure code: ``````|Normally, Windows Defender will enter a special passive state if another real-time antimalware product is running properly on the endpoint, and the endpoint is reporting to Windows Defender ATP.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. +27|Windows Advanced Threat Protection service failed to enable SENSE aware mode in Windows Defender. Onboarding process failed. Failure code: ```variable```|Normally, Windows Defender will enter a special passive state if another real-time antimalware product is running properly on the endpoint, and the endpoint is reporting to Windows Defender ATP.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) Ensure real-time antimalware protection is running properly. -28|Windows Advanced Threat Protection Connected User Experiences and Telemetry service registration failed. Failure code: ``````|An error occurred with the Windows telemetry service.|[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled) +28|Windows Advanced Threat Protection Connected User Experiences and Telemetry service registration failed. Failure code: ```variable```|An error occurred with the Windows telemetry service.|[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled) Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -29|Windows Advanced Threat Protection service failed to read the offboarding parameters. Failure code: ``````|Naama: Should I remove this error? Or just leave it as internal? -30|Windows Advanced Threat Protection service failed to disable SENSE aware mode in Windows Defender. Failure code: ``````|Normally, Windows Defender will enter a special passive state if another real-time antimalware product is running properly on the endpoint, and the endpoint is reporting to Windows Defender ATP.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. +29|Windows Advanced Threat Protection service failed to read the offboarding parameters. Failure code: ```variable```|span style="background-color:yellow;"Naama: Should I remove this error? Or just leave it as internal?/span +30|Windows Advanced Threat Protection service failed to disable SENSE aware mode in Windows Defender. Failure code: ```variable```|Normally, Windows Defender will enter a special passive state if another real-time antimalware product is running properly on the endpoint, and the endpoint is reporting to Windows Defender ATP.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) Ensure real-time antimalware protection is running properly. -31|Windows Advanced Threat Protection Connected User Experiences and Telemetry service unregistration failed. Failure code: ``````|An error occurred with the Windows telemetry service.|[Check for errors with the Windows telemetry service](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled). -32|Windows Advanced Threat Protection service failed to request to stop itself after offboarding process. Failure code: ``````|Naama: Should I remove this error? Or just leave it as internal? -33|Windows Advanced Threat Protection service failed to persist SENSE GUID. Failure code: ``````|A unique identifier is used to represent each endpoint that is reporting to the portal. +31|Windows Advanced Threat Protection Connected User Experiences and Telemetry service unregistration failed. Failure code: ```variable```|An error occurred with the Windows telemetry service.|[Check for errors with the Windows telemetry service](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled). +32|Windows Advanced Threat Protection service failed to request to stop itself after offboarding process. Failure code: ```variable```|span style="background-color:yellow;"Naama: Should I remove this error? Or just leave it as internal?/span +33|Windows Advanced Threat Protection service failed to persist SENSE GUID. Failure code: ```variable```|A unique identifier is used to represent each endpoint that is reporting to the portal. If the identifier does not persist, the same machine might appear twice in the portal. Check registry permissions on the endpoint to ensure the service can update the registry. -34|Windows Advanced Threat Protection service failed to add itself as a dependency on the Connected User Experiences and Telemetry service, causing onboarding process to fail. Failure code: ``````|An error occurred with the Windows telemetry service.|[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled) +34|Windows Advanced Threat Protection service failed to add itself as a dependency on the Connected User Experiences and Telemetry service, causing onboarding process to fail. Failure code: ```variable```|An error occurred with the Windows telemetry service.|[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled) Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -35|Windows Advanced Threat Protection service failed to remove itself as a dependency on the Connected User Experiences and Telemetry service. Failure code: ``````|Naama: Should I remove this error? Or just leave it as internal? +35|Windows Advanced Threat Protection service failed to remove itself as a dependency on the Connected User Experiences and Telemetry service. Failure code: ```variable```|span style="background-color:yellow;"Naama: Should I remove this error? Or just leave it as internal?/span From 9ffdc96f0ba01b85ba357f547ef7b54d544eedb4 Mon Sep 17 00:00:00 2001 From: Iaan Date: Tue, 3 May 2016 12:44:08 +1000 Subject: [PATCH 126/439] fixing tables still --- ...ows-defender-advanced-threat-protection.md | 93 +++++++------------ 1 file changed, 35 insertions(+), 58 deletions(-) diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index acfe014edd..2889f71dac 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -63,7 +63,11 @@ There are two ways to check the startup type for the service: from the command l ![Window Start menu pointing to Run as administrator](images/run-as-admin.png) -2. Type **```sc qc query diagtrack```** and press the **Enter** key. +2. Enter the following command and press the **Enter** key. + + ``` + sc qc query diagtrack + ``` 3. If the service is enabled, it will be set to automatically start. The result should look like the following: @@ -105,7 +109,11 @@ If the service is not set for automatic startup, you will need to set it. ![Window Start menu pointing to Run as administrator](images/run-as-admin.png) -2. Type **```sc config diagtrack start=auto```** and press the **Enter** key. +2. Enter the folowing command and press the **Enter** key. + + ``` + sc config diagtrack start=auto + ``` 3. You will receive a success message. Confirm the change by typing **```sc qc query diagtrack```** and press the **Enter** key. @@ -180,69 +188,38 @@ For example, if endpoints are not appearing in the **Machines view** list, you m 3. Events recorded by the service will appear in the log. See following table for a list of events recorded by the service. -Error ID|Message||Description|Action +Error ID|Message|Description|Action :---|:---|:---|:--- 1|Windows Advanced Threat Protection service started (Version ```variable```).|Occurs during system start up, shut down, and during onbboarding.|Normal operating notification; no action required. 2|Windows Advanced Threat Protection service shutdown.|Occurs when the endpoint is shut down or offboarded.|Normal operating notification; no action required. 3|Windows Advanced Threat Protection service failed to start. Failure code: ```variable```|Service did not start.|Review other messages to determine possible cause and troubleshooting steps. -4|Windows Advanced Threat Protection service contacted the server at ```variable```.|variable = URL of the Windows Defender ATP processing servers. -This URL will match that seen in the Firewall or network activity.|Normal operating notification; no action required. -5|Windows Advanced Threat Protection service failed to connect to the server at ```variable```.|variable = URL of the Windows Defender ATP processing servers. -The service could not contact the external processing servers at that URL.|Check the connection to the URL. See [Configure proxy and Internet connectivity](#configure-proxy-and-Internet-connectivity). -6|Windows Advanced Threat Protection service is not onboarded and no onboarding parameters were found.|The endpoint did not onboard correctly and will not be reporting to the portal.|Onboarding must be run before starting the service. -Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md). -7|Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: ```variable```|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -8|Windows Advanced Threat Protection service failed to clean its configuration. Failure code: ```variable```|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -9|Windows Advanced Threat Protection service failed to change its start type. Failure code: ```variable```|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -10|Windows Advanced Threat Protection service failed to persist the onboarding information. Failure code: ```variable```|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -11|Windows Advanced Threat Protection service completed.|The endpoint onboarded correctly.|Normal operating notification; no action required. -It may take several hours for the endpoint to appear in the portal. +4|Windows Advanced Threat Protection service contacted the server at ```variable```.|variable = URL of the Windows Defender ATP processing servers.
This URL will match that seen in the Firewall or network activity.|Normal operating notification; no action required. +5|Windows Advanced Threat Protection service failed to connect to the server at ```variable```.|variable = URL of the Windows Defender ATP processing servers.
The service could not contact the external processing servers at that URL.|Check the connection to the URL. See [Configure proxy and Internet connectivity](#configure-proxy-and-Internet-connectivity). +6|Windows Advanced Threat Protection service is not onboarded and no onboarding parameters were found.|The endpoint did not onboard correctly and will not be reporting to the portal.|Onboarding must be run before starting the service.
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md). +7|Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: ```variable```|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +8|Windows Advanced Threat Protection service failed to clean its configuration. Failure code: ```variable```|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +9|Windows Advanced Threat Protection service failed to change its start type. Failure code: ```variable```|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +10|Windows Advanced Threat Protection service failed to persist the onboarding information. Failure code: ```variable```|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +11|Windows Advanced Threat Protection service completed.|The endpoint onboarded correctly.|Normal operating notification; no action required.
It may take several hours for the endpoint to appear in the portal. 12|Windows Advanced Threat Protection failed to apply the default configuration.|Service was unable to apply configuration from the processing servers.|This is a server error and should resolve after a short period. 13|Service machine ID calculated: ```variable```|Normal operating process.|Normal operating notification; no action required. -14|Service cannot calculate machine ID. Failure code: ```variable``` -|Internal error.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -15|Windows Advanced Threat Protection cannot start command channel with URL: ```variable```|variable = URL of the Windows Defender ATP processing servers. -The service could not contact the external processing servers at that URL.|Check the connection to the URL. See [Configure proxy and Internet connectivity](#configure-proxy-and-Internet-connectivity). -17|Windows Advanced Threat Protection service failed to change the Connected User Experiences and Telemetry service location. Failure code: ```variable```|An error occurred with the Windows telemetry service.|[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled) -Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -18|OOBE (Windows Welcome) is completed.|Service will only start after any Windows updates have finished installing. -Normal operating notification; no action required. -19|OOBE (Windows Welcome) has not yet completed.|Service will only start after any Windows updates have finished installing. -Normal operating notification; no action required. -If this error persists after a system restart, ensure all Windows updates have full installed. -20|Cannot wait for OOBE (Windows Welcome) to complete. Failure code: ```variable```|Internal error. -If this error persists after a system restart, ensure all Windows updates have full installed. -25|Windows Advanced Threat Protection service failed to reset health status in the registry, causing the onboarding process to fail. Failure code: ```variable```|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -26|Windows Advanced Threat Protection service failed to set the onboarding status in the registry. Failure code: ```variable```|The endpoint did not onboard correctly. -It will report to the portal, however the service may not appear as registered in SCCM or the registry.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -27|Windows Advanced Threat Protection service failed to enable SENSE aware mode in Windows Defender. Onboarding process failed. Failure code: ```variable```|Normally, Windows Defender will enter a special passive state if another real-time antimalware product is running properly on the endpoint, and the endpoint is reporting to Windows Defender ATP.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -Ensure real-time antimalware protection is running properly. -28|Windows Advanced Threat Protection Connected User Experiences and Telemetry service registration failed. Failure code: ```variable```|An error occurred with the Windows telemetry service.|[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled) -Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -29|Windows Advanced Threat Protection service failed to read the offboarding parameters. Failure code: ```variable```|span style="background-color:yellow;"Naama: Should I remove this error? Or just leave it as internal?/span -30|Windows Advanced Threat Protection service failed to disable SENSE aware mode in Windows Defender. Failure code: ```variable```|Normally, Windows Defender will enter a special passive state if another real-time antimalware product is running properly on the endpoint, and the endpoint is reporting to Windows Defender ATP.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -Ensure real-time antimalware protection is running properly. +14|Service cannot calculate machine ID. Failure code: ```variable```|Internal error.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +15|Windows Advanced Threat Protection cannot start command channel with URL: ```variable```|variable = URL of the Windows Defender ATP processing servers.
The service could not contact the external processing servers at that URL.|Check the connection to the URL. See [Configure proxy and Internet connectivity](#configure-proxy-and-Internet-connectivity). +17|Windows Advanced Threat Protection service failed to change the Connected User Experiences and Telemetry service location. Failure code: ```variable```|An error occurred with the Windows telemetry service.|[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled)
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +18|OOBE (Windows Welcome) is completed.|Service will only start after any Windows updates have finished installing.
Normal operating notification; no action required. +19|OOBE (Windows Welcome) has not yet completed.|Service will only start after any Windows updates have finished installing.
Normal operating notification; no action required.
If this error persists after a system restart, ensure all Windows updates have full installed. +20|Cannot wait for OOBE (Windows Welcome) to complete. Failure code: ```variable```|Internal error.
If this error persists after a system restart, ensure all Windows updates have full installed. +25|Windows Advanced Threat Protection service failed to reset health status in the registry, causing the onboarding process to fail. Failure code: ```variable```|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +26|Windows Advanced Threat Protection service failed to set the onboarding status in the registry. Failure code: ```variable```|The endpoint did not onboard correctly.
It will report to the portal, however the service may not appear as registered in SCCM or the registry.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +27|Windows Advanced Threat Protection service failed to enable SENSE aware mode in Windows Defender. Onboarding process failed. Failure code: ```variable```|Normally, Windows Defender will enter a special passive state if another real-time antimalware product is running properly on the endpoint, and the endpoint is reporting to Windows Defender ATP.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
Ensure real-time antimalware protection is running properly. +28|Windows Advanced Threat Protection Connected User Experiences and Telemetry service registration failed. Failure code: ```variable```|An error occurred with the Windows telemetry service.|[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +29|Windows Advanced Threat Protection service failed to read the offboarding parameters. Failure code: ```variable```|Naama: Should I remove this error? Or just leave it as internal? +30|Windows Advanced Threat Protection service failed to disable SENSE aware mode in Windows Defender. Failure code: ```variable```|Normally, Windows Defender will enter a special passive state if another real-time antimalware product is running properly on the endpoint, and the endpoint is reporting to Windows Defender ATP.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
Ensure real-time antimalware protection is running properly. 31|Windows Advanced Threat Protection Connected User Experiences and Telemetry service unregistration failed. Failure code: ```variable```|An error occurred with the Windows telemetry service.|[Check for errors with the Windows telemetry service](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled). -32|Windows Advanced Threat Protection service failed to request to stop itself after offboarding process. Failure code: ```variable```|span style="background-color:yellow;"Naama: Should I remove this error? Or just leave it as internal?/span -33|Windows Advanced Threat Protection service failed to persist SENSE GUID. Failure code: ```variable```|A unique identifier is used to represent each endpoint that is reporting to the portal. -If the identifier does not persist, the same machine might appear twice in the portal. -Check registry permissions on the endpoint to ensure the service can update the registry. -34|Windows Advanced Threat Protection service failed to add itself as a dependency on the Connected User Experiences and Telemetry service, causing onboarding process to fail. Failure code: ```variable```|An error occurred with the Windows telemetry service.|[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled) -Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages. -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -35|Windows Advanced Threat Protection service failed to remove itself as a dependency on the Connected User Experiences and Telemetry service. Failure code: ```variable```|span style="background-color:yellow;"Naama: Should I remove this error? Or just leave it as internal?/span +32|Windows Advanced Threat Protection service failed to request to stop itself after offboarding process. Failure code: ```variable```|Naama: Should I remove this error? Or just leave it as internal? +33|Windows Advanced Threat Protection service failed to persist SENSE GUID. Failure code: ```variable```|A unique identifier is used to represent each endpoint that is reporting to the portal.
If the identifier does not persist, the same machine might appear twice in the portal.
Check registry permissions on the endpoint to ensure the service can update the registry. +34|Windows Advanced Threat Protection service failed to add itself as a dependency on the Connected User Experiences and Telemetry service, causing onboarding process to fail. Failure code: ```variable```|An error occurred with the Windows telemetry service.|[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +35|Windows Advanced Threat Protection service failed to remove itself as a dependency on the Connected User Experiences and Telemetry service. Failure code: ```variable```|Naama: Should I remove this error? Or just leave it as internal? From 251809cd12d17eb62451f0123833b4d9bd7d1071 Mon Sep 17 00:00:00 2001 From: Iaan Date: Tue, 3 May 2016 12:53:15 +1000 Subject: [PATCH 127/439] tables in troubleshooting sigh --- ...dows-defender-advanced-threat-protection.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index 2889f71dac..22b162a252 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -171,7 +171,7 @@ If you chose the EU as your datacenter, you will need to allow the following URL -## Review errors on endpoints with Event Viewer +## Review events and errors on endpoints with Event Viewer You can review event IDs in the [Event Viewer](https://msdn.microsoft.com/en-US/library/aa745633(v=bts.10).aspx) on individual endpoints, or check the status of machines from the [Windows Defender ATP portal](https://seville.windows.com/). @@ -184,11 +184,11 @@ For example, if endpoints are not appearing in the **Machines view** list, you m 2. In the log list, under **Log Summary**, scroll until you see **Microsoft-Windows-SENSE/Operational**. Double-click the item to open the log. - > **Note**   SENSE is the internal name used to refer to the behavioral sensor that powers Windows Defender ATP. +> **Note**   SENSE is the internal name used to refer to the behavioral sensor that powers Windows Defender ATP. 3. Events recorded by the service will appear in the log. See following table for a list of events recorded by the service. -Error ID|Message|Description|Action +Event ID|Message|Description|Action :---|:---|:---|:--- 1|Windows Advanced Threat Protection service started (Version ```variable```).|Occurs during system start up, shut down, and during onbboarding.|Normal operating notification; no action required. 2|Windows Advanced Threat Protection service shutdown.|Occurs when the endpoint is shut down or offboarded.|Normal operating notification; no action required. @@ -206,20 +206,20 @@ Error ID|Message|Description|Action 14|Service cannot calculate machine ID. Failure code: ```variable```|Internal error.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) 15|Windows Advanced Threat Protection cannot start command channel with URL: ```variable```|variable = URL of the Windows Defender ATP processing servers.
The service could not contact the external processing servers at that URL.|Check the connection to the URL. See [Configure proxy and Internet connectivity](#configure-proxy-and-Internet-connectivity). 17|Windows Advanced Threat Protection service failed to change the Connected User Experiences and Telemetry service location. Failure code: ```variable```|An error occurred with the Windows telemetry service.|[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled)
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -18|OOBE (Windows Welcome) is completed.|Service will only start after any Windows updates have finished installing.
Normal operating notification; no action required. -19|OOBE (Windows Welcome) has not yet completed.|Service will only start after any Windows updates have finished installing.
Normal operating notification; no action required.
If this error persists after a system restart, ensure all Windows updates have full installed. -20|Cannot wait for OOBE (Windows Welcome) to complete. Failure code: ```variable```|Internal error.
If this error persists after a system restart, ensure all Windows updates have full installed. +18|OOBE (Windows Welcome) is completed.|Service will only start after any Windows updates have finished installing.|Normal operating notification; no action required. +19|OOBE (Windows Welcome) has not yet completed.|Service will only start after any Windows updates have finished installing. |Normal operating notification; no action required.
If this error persists after a system restart, ensure all Windows updates have full installed. +20|Cannot wait for OOBE (Windows Welcome) to complete. Failure code: ```variable```|Internal error. |If this error persists after a system restart, ensure all Windows updates have full installed. 25|Windows Advanced Threat Protection service failed to reset health status in the registry, causing the onboarding process to fail. Failure code: ```variable```|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) 26|Windows Advanced Threat Protection service failed to set the onboarding status in the registry. Failure code: ```variable```|The endpoint did not onboard correctly.
It will report to the portal, however the service may not appear as registered in SCCM or the registry.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) 27|Windows Advanced Threat Protection service failed to enable SENSE aware mode in Windows Defender. Onboarding process failed. Failure code: ```variable```|Normally, Windows Defender will enter a special passive state if another real-time antimalware product is running properly on the endpoint, and the endpoint is reporting to Windows Defender ATP.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
Ensure real-time antimalware protection is running properly. 28|Windows Advanced Threat Protection Connected User Experiences and Telemetry service registration failed. Failure code: ```variable```|An error occurred with the Windows telemetry service.|[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -29|Windows Advanced Threat Protection service failed to read the offboarding parameters. Failure code: ```variable```|Naama: Should I remove this error? Or just leave it as internal? +29|Windows Advanced Threat Protection service failed to read the offboarding parameters. Failure code: ```variable```|Naama: Should I remove this error? Or just leave it as internal?|TBD 30|Windows Advanced Threat Protection service failed to disable SENSE aware mode in Windows Defender. Failure code: ```variable```|Normally, Windows Defender will enter a special passive state if another real-time antimalware product is running properly on the endpoint, and the endpoint is reporting to Windows Defender ATP.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
Ensure real-time antimalware protection is running properly. 31|Windows Advanced Threat Protection Connected User Experiences and Telemetry service unregistration failed. Failure code: ```variable```|An error occurred with the Windows telemetry service.|[Check for errors with the Windows telemetry service](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled). -32|Windows Advanced Threat Protection service failed to request to stop itself after offboarding process. Failure code: ```variable```|Naama: Should I remove this error? Or just leave it as internal? +32|Windows Advanced Threat Protection service failed to request to stop itself after offboarding process. Failure code: ```variable```|Naama: Should I remove this error? Or just leave it as internal?|TBD 33|Windows Advanced Threat Protection service failed to persist SENSE GUID. Failure code: ```variable```|A unique identifier is used to represent each endpoint that is reporting to the portal.
If the identifier does not persist, the same machine might appear twice in the portal.
Check registry permissions on the endpoint to ensure the service can update the registry. 34|Windows Advanced Threat Protection service failed to add itself as a dependency on the Connected User Experiences and Telemetry service, causing onboarding process to fail. Failure code: ```variable```|An error occurred with the Windows telemetry service.|[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -35|Windows Advanced Threat Protection service failed to remove itself as a dependency on the Connected User Experiences and Telemetry service. Failure code: ```variable```|Naama: Should I remove this error? Or just leave it as internal? +35|Windows Advanced Threat Protection service failed to remove itself as a dependency on the Connected User Experiences and Telemetry service. Failure code: ```variable```|Naama: Should I remove this error? Or just leave it as internal?|TBD From 9d4102408d3fdb61f842f1f2c89d1b72cf186c5b Mon Sep 17 00:00:00 2001 From: Iaan Date: Tue, 3 May 2016 12:58:44 +1000 Subject: [PATCH 128/439] align --- ...-onboarding-windows-defender-advanced-threat-protection.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index 22b162a252..c287bb94bc 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -194,8 +194,8 @@ Event ID|Message|Description|Action 2|Windows Advanced Threat Protection service shutdown.|Occurs when the endpoint is shut down or offboarded.|Normal operating notification; no action required. 3|Windows Advanced Threat Protection service failed to start. Failure code: ```variable```|Service did not start.|Review other messages to determine possible cause and troubleshooting steps. 4|Windows Advanced Threat Protection service contacted the server at ```variable```.|variable = URL of the Windows Defender ATP processing servers.
This URL will match that seen in the Firewall or network activity.|Normal operating notification; no action required. -5|Windows Advanced Threat Protection service failed to connect to the server at ```variable```.|variable = URL of the Windows Defender ATP processing servers.
The service could not contact the external processing servers at that URL.|Check the connection to the URL. See [Configure proxy and Internet connectivity](#configure-proxy-and-Internet-connectivity). -6|Windows Advanced Threat Protection service is not onboarded and no onboarding parameters were found.|The endpoint did not onboard correctly and will not be reporting to the portal.|Onboarding must be run before starting the service.
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md). +5|Windows Advanced Threat Protection service failed to connect to the server at ```variable```.|variable = URL of the Windows Defender ATP processing servers.
The service could not contact the external processing servers at that URL.|Check the connection to the URL. See [Configure proxy and Internet connectivity](#configure-proxy-and-Internet-connectivity). +6|Windows Advanced Threat Protection service is not onboarded and no onboarding parameters were found.|The endpoint did not onboard correctly and will not be reporting to the portal.|Onboarding must be run before starting the service.
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md). 7|Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: ```variable```|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) 8|Windows Advanced Threat Protection service failed to clean its configuration. Failure code: ```variable```|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) 9|Windows Advanced Threat Protection service failed to change its start type. Failure code: ```variable```|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) From 41def3b2a0995bcd16504f206f276b36e39785f2 Mon Sep 17 00:00:00 2001 From: Iaan Date: Tue, 3 May 2016 12:59:49 +1000 Subject: [PATCH 129/439] tables --- ...ot-onboarding-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index c287bb94bc..aadb6b5803 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -217,7 +217,7 @@ Event ID|Message|Description|Action 30|Windows Advanced Threat Protection service failed to disable SENSE aware mode in Windows Defender. Failure code: ```variable```|Normally, Windows Defender will enter a special passive state if another real-time antimalware product is running properly on the endpoint, and the endpoint is reporting to Windows Defender ATP.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
Ensure real-time antimalware protection is running properly. 31|Windows Advanced Threat Protection Connected User Experiences and Telemetry service unregistration failed. Failure code: ```variable```|An error occurred with the Windows telemetry service.|[Check for errors with the Windows telemetry service](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled). 32|Windows Advanced Threat Protection service failed to request to stop itself after offboarding process. Failure code: ```variable```|Naama: Should I remove this error? Or just leave it as internal?|TBD -33|Windows Advanced Threat Protection service failed to persist SENSE GUID. Failure code: ```variable```|A unique identifier is used to represent each endpoint that is reporting to the portal.
If the identifier does not persist, the same machine might appear twice in the portal.
Check registry permissions on the endpoint to ensure the service can update the registry. +33|Windows Advanced Threat Protection service failed to persist SENSE GUID. Failure code: ```variable```|A unique identifier is used to represent each endpoint that is reporting to the portal.
If the identifier does not persist, the same machine might appear twice in the portal. |Check registry permissions on the endpoint to ensure the service can update the registry. 34|Windows Advanced Threat Protection service failed to add itself as a dependency on the Connected User Experiences and Telemetry service, causing onboarding process to fail. Failure code: ```variable```|An error occurred with the Windows telemetry service.|[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) 35|Windows Advanced Threat Protection service failed to remove itself as a dependency on the Connected User Experiences and Telemetry service. Failure code: ```variable```|Naama: Should I remove this error? Or just leave it as internal?|TBD From 9ed36a70aac5116b7eabc2538f4796aa63946b5c Mon Sep 17 00:00:00 2001 From: Iaan Date: Tue, 3 May 2016 13:21:57 +1000 Subject: [PATCH 130/439] table --- ...ows-defender-advanced-threat-protection.md | 35 +++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index aadb6b5803..8a899cf3fc 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -223,6 +223,41 @@ Event ID|Message|Description|Action +

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Event IDMessageDescriptionAction
1Windows Advanced Threat Protection service started (Version ```variable```).Occurs during system start up, shut down, and during onbboarding.Normal operating notification; no action required.
2Windows Advanced Threat Protection service shutdown.Occurs when the endpoint is shut down or offboarded.Normal operating notification; no action required.
3Windows Advanced Threat Protection service failed to start. Failure code: ```variable```Service did not start.Review other messages to determine possible cause and troubleshooting steps.
4Windows Advanced Threat Protection service contacted the server at ```variable```.variable = URL of the Windows Defender ATP processing servers.
This URL will match that seen in the Firewall or network activity.
Normal operating notification; no action required.
5Windows Advanced Threat Protection service failed to connect to the server at ```variable```.variable = URL of the Windows Defender ATP processing servers.
The service could not contact the external processing servers at that URL.
Check the connection to the URL. See [Configure proxy and Internet connectivity](#configure-proxy-and-Internet-connectivity).
6The endpoint did not onboard correctly and will not be reporting to the portal.Onboarding must be run before starting the service.
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md).
7Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: ```variable```The endpoint did not onboard correctly and will not be reporting to the portal.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
8Windows Advanced Threat Protection service failed to clean its configuration. Failure code: ```variable```The endpoint did not onboard correctly and will not be reporting to the portal.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
9Windows Advanced Threat Protection service failed to change its start type. Failure code: ```variable```The endpoint did not onboard correctly and will not be reporting to the portal.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
10Windows Advanced Threat Protection service failed to persist the onboarding information. Failure code: ```variable```The endpoint did not onboard correctly and will not be reporting to the portal.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
11Windows Advanced Threat Protection service completed.The endpoint onboarded correctly.Normal operating notification; no action required.
It may take several hours for the endpoint to appear in the portal.
12Windows Advanced Threat Protection failed to apply the default configuration.Service was unable to apply configuration from the processing servers.This is a server error and should resolve after a short period.
13Service machine ID calculated: ```variable```Normal operating process.Normal operating notification; no action required.
14Service cannot calculate machine ID. Failure code: ```variable```Internal error.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
15Windows Advanced Threat Protection cannot start command channel with URL: ```variable```variable = URL of the Windows Defender ATP processing servers.
The service could not contact the external processing servers at that URL.
Check the connection to the URL. See [Configure proxy and Internet connectivity](#configure-proxy-and-Internet-connectivity).
17Windows Advanced Threat Protection service failed to change the Connected User Experiences and Telemetry service location. Failure code: ```variable```An error occurred with the Windows telemetry service.[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled)
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
18OOBE (Windows Welcome) is completed.Service will only start after any Windows updates have finished installing.Normal operating notification; no action required.
19OOBE (Windows Welcome) has not yet completed.Service will only start after any Windows updates have finished installing. Normal operating notification; no action required.
If this error persists after a system restart, ensure all Windows updates have full installed.
20Cannot wait for OOBE (Windows Welcome) to complete. Failure code: ```variable```Internal error. If this error persists after a system restart, ensure all Windows updates have full installed.
25Windows Advanced Threat Protection service failed to reset health status in the registry, causing the onboarding process to fail. Failure code: ```variable```The endpoint did not onboard correctly and will not be reporting to the portal.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
26Windows Advanced Threat Protection service failed to set the onboarding status in the registry. Failure code: ```variable```The endpoint did not onboard correctly.
It will report to the portal, however the service may not appear as registered in SCCM or the registry.
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
27Windows Advanced Threat Protection service failed to enable SENSE aware mode in Windows Defender. Onboarding process failed. Failure code: ```variable```Normally, Windows Defender will enter a special passive state if another real-time antimalware product is running properly on the endpoint, and the endpoint is reporting to Windows Defender ATP.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
Ensure real-time antimalware protection is running properly.
28Windows Advanced Threat Protection Connected User Experiences and Telemetry service registration failed. Failure code: ```variable```An error occurred with the Windows telemetry service.[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
29Windows Advanced Threat Protection service failed to read the offboarding parameters. Failure code: ```variable```Naama: Should I remove this error? Or just leave it as internal?TBD
30Windows Advanced Threat Protection service failed to disable SENSE aware mode in Windows Defender. Failure code: ```variable```Normally, Windows Defender will enter a special passive state if another real-time antimalware product is running properly on the endpoint, and the endpoint is reporting to Windows Defender ATP.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
Ensure real-time antimalware protection is running properly.
31Windows Advanced Threat Protection Connected User Experiences and Telemetry service unregistration failed. Failure code: ```variable```An error occurred with the Windows telemetry service.[Check for errors with the Windows telemetry service](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
32Windows Advanced Threat Protection service failed to request to stop itself after offboarding process. Failure code: ```variable```Naama: Should I remove this error? Or just leave it as internal?TBD
33Windows Advanced Threat Protection service failed to persist SENSE GUID. Failure code: ```variable```A unique identifier is used to represent each endpoint that is reporting to the portal.
If the identifier does not persist, the same machine might appear twice in the portal.
Check registry permissions on the endpoint to ensure the service can update the registry.
34Windows Advanced Threat Protection service failed to add itself as a dependency on the Connected User Experiences and Telemetry service, causing onboarding process to fail. Failure code: ```variable```An error occurred with the Windows telemetry service.[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
35Windows Advanced Threat Protection service failed to remove itself as a dependency on the Connected User Experiences and Telemetry service. Failure code: ```variable```Naama: Should I remove this error? Or just leave it as internal?TBD
+ ## Related topics - [Windows Defender ATP service onboarding](service-onboarding-windows-defender-advanced-threat-protection.md) - [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) From e7ef51630356817d77013663972bb1b1db6f14af Mon Sep 17 00:00:00 2001 From: Iaan Date: Tue, 3 May 2016 13:29:45 +1000 Subject: [PATCH 131/439] tables --- ...nboarding-windows-defender-advanced-threat-protection.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index 8a899cf3fc..8de9495f7b 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -184,9 +184,9 @@ For example, if endpoints are not appearing in the **Machines view** list, you m 2. In the log list, under **Log Summary**, scroll until you see **Microsoft-Windows-SENSE/Operational**. Double-click the item to open the log. -> **Note**   SENSE is the internal name used to refer to the behavioral sensor that powers Windows Defender ATP. + > **Note**   SENSE is the internal name used to refer to the behavioral sensor that powers Windows Defender ATP. -3. Events recorded by the service will appear in the log. See following table for a list of events recorded by the service. +3. Events recorded by the service will appear in the log. See the following table for a list of events recorded by the service. Event ID|Message|Description|Action :---|:---|:---|:--- @@ -225,6 +225,7 @@ Event ID|Message|Description|Action

+ @@ -256,6 +257,7 @@ Event ID|Message|Description|Action +
Event IDMessageDescriptionAction
1Windows Advanced Threat Protection service started (Version ```variable```).Occurs during system start up, shut down, and during onbboarding.Normal operating notification; no action required.
2Windows Advanced Threat Protection service shutdown.Occurs when the endpoint is shut down or offboarded.Normal operating notification; no action required.
33Windows Advanced Threat Protection service failed to persist SENSE GUID. Failure code: ```variable```A unique identifier is used to represent each endpoint that is reporting to the portal.
If the identifier does not persist, the same machine might appear twice in the portal.
Check registry permissions on the endpoint to ensure the service can update the registry.
34Windows Advanced Threat Protection service failed to add itself as a dependency on the Connected User Experiences and Telemetry service, causing onboarding process to fail. Failure code: ```variable```An error occurred with the Windows telemetry service.[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
35Windows Advanced Threat Protection service failed to remove itself as a dependency on the Connected User Experiences and Telemetry service. Failure code: ```variable```Naama: Should I remove this error? Or just leave it as internal?TBD
## Related topics From 625e26734d955d181c73db917344ecc57ffeb250 Mon Sep 17 00:00:00 2001 From: Iaan Date: Tue, 3 May 2016 13:38:16 +1000 Subject: [PATCH 132/439] tabe --- ...ows-defender-advanced-threat-protection.md | 404 +++++++++++++++--- 1 file changed, 336 insertions(+), 68 deletions(-) diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index 8de9495f7b..04bd07cdfa 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -188,77 +188,345 @@ For example, if endpoints are not appearing in the **Machines view** list, you m 3. Events recorded by the service will appear in the log. See the following table for a list of events recorded by the service. -Event ID|Message|Description|Action -:---|:---|:---|:--- -1|Windows Advanced Threat Protection service started (Version ```variable```).|Occurs during system start up, shut down, and during onbboarding.|Normal operating notification; no action required. -2|Windows Advanced Threat Protection service shutdown.|Occurs when the endpoint is shut down or offboarded.|Normal operating notification; no action required. -3|Windows Advanced Threat Protection service failed to start. Failure code: ```variable```|Service did not start.|Review other messages to determine possible cause and troubleshooting steps. -4|Windows Advanced Threat Protection service contacted the server at ```variable```.|variable = URL of the Windows Defender ATP processing servers.
This URL will match that seen in the Firewall or network activity.|Normal operating notification; no action required. -5|Windows Advanced Threat Protection service failed to connect to the server at ```variable```.|variable = URL of the Windows Defender ATP processing servers.
The service could not contact the external processing servers at that URL.|Check the connection to the URL. See [Configure proxy and Internet connectivity](#configure-proxy-and-Internet-connectivity). -6|Windows Advanced Threat Protection service is not onboarded and no onboarding parameters were found.|The endpoint did not onboard correctly and will not be reporting to the portal.|Onboarding must be run before starting the service.
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md). -7|Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: ```variable```|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -8|Windows Advanced Threat Protection service failed to clean its configuration. Failure code: ```variable```|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -9|Windows Advanced Threat Protection service failed to change its start type. Failure code: ```variable```|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -10|Windows Advanced Threat Protection service failed to persist the onboarding information. Failure code: ```variable```|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -11|Windows Advanced Threat Protection service completed.|The endpoint onboarded correctly.|Normal operating notification; no action required.
It may take several hours for the endpoint to appear in the portal. -12|Windows Advanced Threat Protection failed to apply the default configuration.|Service was unable to apply configuration from the processing servers.|This is a server error and should resolve after a short period. -13|Service machine ID calculated: ```variable```|Normal operating process.|Normal operating notification; no action required. -14|Service cannot calculate machine ID. Failure code: ```variable```|Internal error.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -15|Windows Advanced Threat Protection cannot start command channel with URL: ```variable```|variable = URL of the Windows Defender ATP processing servers.
The service could not contact the external processing servers at that URL.|Check the connection to the URL. See [Configure proxy and Internet connectivity](#configure-proxy-and-Internet-connectivity). -17|Windows Advanced Threat Protection service failed to change the Connected User Experiences and Telemetry service location. Failure code: ```variable```|An error occurred with the Windows telemetry service.|[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled)
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -18|OOBE (Windows Welcome) is completed.|Service will only start after any Windows updates have finished installing.|Normal operating notification; no action required. -19|OOBE (Windows Welcome) has not yet completed.|Service will only start after any Windows updates have finished installing. |Normal operating notification; no action required.
If this error persists after a system restart, ensure all Windows updates have full installed. -20|Cannot wait for OOBE (Windows Welcome) to complete. Failure code: ```variable```|Internal error. |If this error persists after a system restart, ensure all Windows updates have full installed. -25|Windows Advanced Threat Protection service failed to reset health status in the registry, causing the onboarding process to fail. Failure code: ```variable```|The endpoint did not onboard correctly and will not be reporting to the portal.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -26|Windows Advanced Threat Protection service failed to set the onboarding status in the registry. Failure code: ```variable```|The endpoint did not onboard correctly.
It will report to the portal, however the service may not appear as registered in SCCM or the registry.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -27|Windows Advanced Threat Protection service failed to enable SENSE aware mode in Windows Defender. Onboarding process failed. Failure code: ```variable```|Normally, Windows Defender will enter a special passive state if another real-time antimalware product is running properly on the endpoint, and the endpoint is reporting to Windows Defender ATP.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
Ensure real-time antimalware protection is running properly. -28|Windows Advanced Threat Protection Connected User Experiences and Telemetry service registration failed. Failure code: ```variable```|An error occurred with the Windows telemetry service.|[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -29|Windows Advanced Threat Protection service failed to read the offboarding parameters. Failure code: ```variable```|Naama: Should I remove this error? Or just leave it as internal?|TBD -30|Windows Advanced Threat Protection service failed to disable SENSE aware mode in Windows Defender. Failure code: ```variable```|Normally, Windows Defender will enter a special passive state if another real-time antimalware product is running properly on the endpoint, and the endpoint is reporting to Windows Defender ATP.|Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
Ensure real-time antimalware protection is running properly. -31|Windows Advanced Threat Protection Connected User Experiences and Telemetry service unregistration failed. Failure code: ```variable```|An error occurred with the Windows telemetry service.|[Check for errors with the Windows telemetry service](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled). -32|Windows Advanced Threat Protection service failed to request to stop itself after offboarding process. Failure code: ```variable```|Naama: Should I remove this error? Or just leave it as internal?|TBD -33|Windows Advanced Threat Protection service failed to persist SENSE GUID. Failure code: ```variable```|A unique identifier is used to represent each endpoint that is reporting to the portal.
If the identifier does not persist, the same machine might appear twice in the portal. |Check registry permissions on the endpoint to ensure the service can update the registry. -34|Windows Advanced Threat Protection service failed to add itself as a dependency on the Connected User Experiences and Telemetry service, causing onboarding process to fail. Failure code: ```variable```|An error occurred with the Windows telemetry service.|[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -35|Windows Advanced Threat Protection service failed to remove itself as a dependency on the Connected User Experiences and Telemetry service. Failure code: ```variable```|Naama: Should I remove this error? Or just leave it as internal?|TBD + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Event IDMessageDescriptionAction
1Windows Advanced Threat Protection service started (Version + ```variable```).Occurs during system start up, shut down, and during + onbboarding.Normal operating notification; no action required.
2Windows Advanced Threat Protection service shutdown.Occurs when the endpoint is shut down or offboarded.Normal operating notification; no action required.
3Windows Advanced Threat Protection service failed to start. + Failure code: ```variable```Service did not start.Review other messages to determine possible cause and + troubleshooting steps.
4Windows Advanced Threat Protection service contacted the + server at ```variable```.variable = URL of the Windows Defender ATP processing + servers.
+ This URL will match that seen in the Firewall or network + activity.
Normal operating notification; no action required.
5Windows Advanced Threat Protection service failed to + connect to the server at ```variable```.variable = URL of the Windows Defender ATP processing + servers.
+ The service could not contact the external processing servers + at that URL.
Check the connection to the URL. See [Configure proxy and + Internet + connectivity](#configure-proxy-and-Internet-connectivity).
6Windows Advanced Threat Protection service is not onboarded + and no onboarding parameters were found.The endpoint did not onboard correctly and will not be + reporting to the portal.Onboarding must be run before starting the service.
+ Check that the onboarding settings and scripts were deployed + properly. Try to redeploy the configuration packages.
+ See [Configure Windows Defender ATP + endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md).
7Windows Advanced Threat Protection service failed to read + the onboarding parameters. Failure code: ```variable```The endpoint did not onboard correctly and will not be + reporting to the portal.Check that the onboarding settings and scripts were + deployed properly. Try to redeploy the configuration + packages.
+ See [Configure Windows Defender ATP + endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
8Windows Advanced Threat Protection service failed to clean + its configuration. Failure code: ```variable```The endpoint did not onboard correctly and will not be + reporting to the portal.Check that the onboarding settings and scripts were + deployed properly. Try to redeploy the configuration + packages.
+ See [Configure Windows Defender ATP + endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
9Windows Advanced Threat Protection service failed to change + its start type. Failure code: ```variable```The endpoint did not onboard correctly and will not be + reporting to the portal.Check that the onboarding settings and scripts were + deployed properly. Try to redeploy the configuration + packages.
+ See [Configure Windows Defender ATP + endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
10Windows Advanced Threat Protection service failed to + persist the onboarding information. Failure code: + ```variable```The endpoint did not onboard correctly and will not be + reporting to the portal.Check that the onboarding settings and scripts were + deployed properly. Try to redeploy the configuration + packages.
+ See [Configure Windows Defender ATP + endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
11Windows Advanced Threat Protection service completed.The endpoint onboarded correctly.Normal operating notification; no action required.
+ It may take several hours for the endpoint to appear in the + portal.
12Windows Advanced Threat Protection failed to apply the + default configuration.Service was unable to apply configuration from the + processing servers.This is a server error and should resolve after a short + period.
13Service machine ID calculated: ```variable```Normal operating process.Normal operating notification; no action required.
14Service cannot calculate machine ID. Failure code: + ```variable```Internal error.Check that the onboarding settings and scripts were + deployed properly. Try to redeploy the configuration + packages.
+ See [Configure Windows Defender ATP + endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
15Windows Advanced Threat Protection cannot start command + channel with URL: ```variable```variable = URL of the Windows Defender ATP processing + servers.
+ The service could not contact the external processing servers + at that URL.
Check the connection to the URL. See [Configure proxy and + Internet + connectivity](#configure-proxy-and-Internet-connectivity).
17Windows Advanced Threat Protection service failed to change + the Connected User Experiences and Telemetry service location. + Failure code: ```variable```An error occurred with the Windows telemetry service.[Ensure the telemetry service is + enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled)
+ Check that the onboarding settings and scripts were deployed + properly. Try to redeploy the configuration packages.
+ See [Configure Windows Defender ATP + endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
18OOBE (Windows Welcome) is completed.Service will only start after any Windows updates have + finished installing.Normal operating notification; no action required.
19OOBE (Windows Welcome) has not yet completed.Service will only start after any Windows updates have + finished installing.Normal operating notification; no action required.
+ If this error persists after a system restart, ensure all + Windows updates have full installed.
20Cannot wait for OOBE (Windows Welcome) to complete. Failure + code: ```variable```Internal error.If this error persists after a system restart, ensure all + Windows updates have full installed.
25Windows Advanced Threat Protection service failed to reset + health status in the registry, causing the onboarding process + to fail. Failure code: ```variable```The endpoint did not onboard correctly and will not be + reporting to the portal.Check that the onboarding settings and scripts were + deployed properly. Try to redeploy the configuration + packages.
+ See [Configure Windows Defender ATP + endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
26Windows Advanced Threat Protection service failed to set + the onboarding status in the registry. Failure code: + ```variable```The endpoint did not onboard correctly.
+ It will report to the portal, however the service may not + appear as registered in SCCM or the registry.
Check that the onboarding settings and scripts were + deployed properly. Try to redeploy the configuration + packages.
+ See [Configure Windows Defender ATP + endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
27Windows Advanced Threat Protection service failed to enable + SENSE aware mode in Windows Defender. Onboarding process + failed. Failure code: ```variable```Normally, Windows Defender will enter a special passive + state if another real-time antimalware product is running + properly on the endpoint, and the endpoint is reporting to + Windows Defender ATP.Check that the onboarding settings and scripts were + deployed properly. Try to redeploy the configuration + packages.
+ See [Configure Windows Defender ATP + endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
+ Ensure real-time antimalware protection is running + properly.
28Windows Advanced Threat Protection Connected User + Experiences and Telemetry service registration failed. Failure + code: ```variable```An error occurred with the Windows telemetry service.[Ensure the telemetry service is + enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
+ + Check that the onboarding settings and scripts were deployed + properly. Try to redeploy the configuration packages.
+ See [Configure Windows Defender ATP + endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
29Windows Advanced Threat Protection service failed to read + the offboarding parameters. Failure code: ```variable```Naama: Should I + remove this error? Or just leave it as internal?TBD
30Windows Advanced Threat Protection service failed to + disable SENSE aware mode in Windows Defender. Failure code: + ```variable```Normally, Windows Defender will enter a special passive + state if another real-time antimalware product is running + properly on the endpoint, and the endpoint is reporting to + Windows Defender ATP.Check that the onboarding settings and scripts were + deployed properly. Try to redeploy the configuration + packages.
+ See [Configure Windows Defender ATP + endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
+ + Ensure real-time antimalware protection is running + properly.
31Windows Advanced Threat Protection Connected User + Experiences and Telemetry service unregistration failed. + Failure code: ```variable```An error occurred with the Windows telemetry service.[Check for errors with the Windows telemetry + service](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
32Windows Advanced Threat Protection service failed to + request to stop itself after offboarding process. Failure code: + ```variable```Naama: Should I + remove this error? Or just leave it as internal?TBD
33Windows Advanced Threat Protection service failed to + persist SENSE GUID. Failure code: ```variable```A unique identifier is used to represent each endpoint that + is reporting to the portal.
+ If the identifier does not persist, the same machine might + appear twice in the portal.
Check registry permissions on the endpoint to ensure the + service can update the registry.
34Windows Advanced Threat Protection service failed to add + itself as a dependency on the Connected User Experiences and + Telemetry service, causing onboarding process to fail. Failure + code: ```variable```An error occurred with the Windows telemetry service.[Ensure the telemetry service is + enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
+ + Check that the onboarding settings and scripts were deployed + properly. Try to redeploy the configuration packages.
+ See [Configure Windows Defender ATP + endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
35Windows Advanced Threat Protection service failed to remove + itself as a dependency on the Connected User Experiences and + Telemetry service. Failure code: ```variable```Naama: Should I + remove this error? Or just leave it as internal?TBD
+ -

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Event IDMessageDescriptionAction
1Windows Advanced Threat Protection service started (Version ```variable```).Occurs during system start up, shut down, and during onbboarding.Normal operating notification; no action required.
2Windows Advanced Threat Protection service shutdown.Occurs when the endpoint is shut down or offboarded.Normal operating notification; no action required.
3Windows Advanced Threat Protection service failed to start. Failure code: ```variable```Service did not start.Review other messages to determine possible cause and troubleshooting steps.
4Windows Advanced Threat Protection service contacted the server at ```variable```.variable = URL of the Windows Defender ATP processing servers.
This URL will match that seen in the Firewall or network activity.
Normal operating notification; no action required.
5Windows Advanced Threat Protection service failed to connect to the server at ```variable```.variable = URL of the Windows Defender ATP processing servers.
The service could not contact the external processing servers at that URL.
Check the connection to the URL. See [Configure proxy and Internet connectivity](#configure-proxy-and-Internet-connectivity).
6The endpoint did not onboard correctly and will not be reporting to the portal.Onboarding must be run before starting the service.
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md).
7Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: ```variable```The endpoint did not onboard correctly and will not be reporting to the portal.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
8Windows Advanced Threat Protection service failed to clean its configuration. Failure code: ```variable```The endpoint did not onboard correctly and will not be reporting to the portal.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
9Windows Advanced Threat Protection service failed to change its start type. Failure code: ```variable```The endpoint did not onboard correctly and will not be reporting to the portal.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
10Windows Advanced Threat Protection service failed to persist the onboarding information. Failure code: ```variable```The endpoint did not onboard correctly and will not be reporting to the portal.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
11Windows Advanced Threat Protection service completed.The endpoint onboarded correctly.Normal operating notification; no action required.
It may take several hours for the endpoint to appear in the portal.
12Windows Advanced Threat Protection failed to apply the default configuration.Service was unable to apply configuration from the processing servers.This is a server error and should resolve after a short period.
13Service machine ID calculated: ```variable```Normal operating process.Normal operating notification; no action required.
14Service cannot calculate machine ID. Failure code: ```variable```Internal error.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
15Windows Advanced Threat Protection cannot start command channel with URL: ```variable```variable = URL of the Windows Defender ATP processing servers.
The service could not contact the external processing servers at that URL.
Check the connection to the URL. See [Configure proxy and Internet connectivity](#configure-proxy-and-Internet-connectivity).
17Windows Advanced Threat Protection service failed to change the Connected User Experiences and Telemetry service location. Failure code: ```variable```An error occurred with the Windows telemetry service.[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled)
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
18OOBE (Windows Welcome) is completed.Service will only start after any Windows updates have finished installing.Normal operating notification; no action required.
19OOBE (Windows Welcome) has not yet completed.Service will only start after any Windows updates have finished installing. Normal operating notification; no action required.
If this error persists after a system restart, ensure all Windows updates have full installed.
20Cannot wait for OOBE (Windows Welcome) to complete. Failure code: ```variable```Internal error. If this error persists after a system restart, ensure all Windows updates have full installed.
25Windows Advanced Threat Protection service failed to reset health status in the registry, causing the onboarding process to fail. Failure code: ```variable```The endpoint did not onboard correctly and will not be reporting to the portal.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
26Windows Advanced Threat Protection service failed to set the onboarding status in the registry. Failure code: ```variable```The endpoint did not onboard correctly.
It will report to the portal, however the service may not appear as registered in SCCM or the registry.
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
27Windows Advanced Threat Protection service failed to enable SENSE aware mode in Windows Defender. Onboarding process failed. Failure code: ```variable```Normally, Windows Defender will enter a special passive state if another real-time antimalware product is running properly on the endpoint, and the endpoint is reporting to Windows Defender ATP.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
Ensure real-time antimalware protection is running properly.
28Windows Advanced Threat Protection Connected User Experiences and Telemetry service registration failed. Failure code: ```variable```An error occurred with the Windows telemetry service.[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
29Windows Advanced Threat Protection service failed to read the offboarding parameters. Failure code: ```variable```Naama: Should I remove this error? Or just leave it as internal?TBD
30Windows Advanced Threat Protection service failed to disable SENSE aware mode in Windows Defender. Failure code: ```variable```Normally, Windows Defender will enter a special passive state if another real-time antimalware product is running properly on the endpoint, and the endpoint is reporting to Windows Defender ATP.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
Ensure real-time antimalware protection is running properly.
31Windows Advanced Threat Protection Connected User Experiences and Telemetry service unregistration failed. Failure code: ```variable```An error occurred with the Windows telemetry service.[Check for errors with the Windows telemetry service](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
32Windows Advanced Threat Protection service failed to request to stop itself after offboarding process. Failure code: ```variable```Naama: Should I remove this error? Or just leave it as internal?TBD
33Windows Advanced Threat Protection service failed to persist SENSE GUID. Failure code: ```variable```A unique identifier is used to represent each endpoint that is reporting to the portal.
If the identifier does not persist, the same machine might appear twice in the portal.
Check registry permissions on the endpoint to ensure the service can update the registry.
34Windows Advanced Threat Protection service failed to add itself as a dependency on the Connected User Experiences and Telemetry service, causing onboarding process to fail. Failure code: ```variable```An error occurred with the Windows telemetry service.[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
35Windows Advanced Threat Protection service failed to remove itself as a dependency on the Connected User Experiences and Telemetry service. Failure code: ```variable```Naama: Should I remove this error? Or just leave it as internal?TBD
## Related topics - [Windows Defender ATP service onboarding](service-onboarding-windows-defender-advanced-threat-protection.md) From 74d58c3a3cebfe952bc389a11b2ca82ed3b34b9f Mon Sep 17 00:00:00 2001 From: Iaan Date: Tue, 3 May 2016 13:43:41 +1000 Subject: [PATCH 133/439] html tables --- ...ows-defender-advanced-threat-protection.md | 553 +++++++----------- 1 file changed, 216 insertions(+), 337 deletions(-) diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index 04bd07cdfa..7023e288ad 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -188,344 +188,223 @@ For example, if endpoints are not appearing in the **Machines view** list, you m 3. Events recorded by the service will appear in the log. See the following table for a list of events recorded by the service. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Event IDMessageDescriptionAction
1Windows Advanced Threat Protection service started (Version - ```variable```).Occurs during system start up, shut down, and during - onbboarding.Normal operating notification; no action required.
2Windows Advanced Threat Protection service shutdown.Occurs when the endpoint is shut down or offboarded.Normal operating notification; no action required.
3Windows Advanced Threat Protection service failed to start. - Failure code: ```variable```Service did not start.Review other messages to determine possible cause and - troubleshooting steps.
4Windows Advanced Threat Protection service contacted the - server at ```variable```.variable = URL of the Windows Defender ATP processing - servers.
- This URL will match that seen in the Firewall or network - activity.
Normal operating notification; no action required.
5Windows Advanced Threat Protection service failed to - connect to the server at ```variable```.variable = URL of the Windows Defender ATP processing - servers.
- The service could not contact the external processing servers - at that URL.
Check the connection to the URL. See [Configure proxy and - Internet - connectivity](#configure-proxy-and-Internet-connectivity).
6Windows Advanced Threat Protection service is not onboarded - and no onboarding parameters were found.The endpoint did not onboard correctly and will not be - reporting to the portal.Onboarding must be run before starting the service.
- Check that the onboarding settings and scripts were deployed - properly. Try to redeploy the configuration packages.
- See [Configure Windows Defender ATP - endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md).
7Windows Advanced Threat Protection service failed to read - the onboarding parameters. Failure code: ```variable```The endpoint did not onboard correctly and will not be - reporting to the portal.Check that the onboarding settings and scripts were - deployed properly. Try to redeploy the configuration - packages.
- See [Configure Windows Defender ATP - endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
8Windows Advanced Threat Protection service failed to clean - its configuration. Failure code: ```variable```The endpoint did not onboard correctly and will not be - reporting to the portal.Check that the onboarding settings and scripts were - deployed properly. Try to redeploy the configuration - packages.
- See [Configure Windows Defender ATP - endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
9Windows Advanced Threat Protection service failed to change - its start type. Failure code: ```variable```The endpoint did not onboard correctly and will not be - reporting to the portal.Check that the onboarding settings and scripts were - deployed properly. Try to redeploy the configuration - packages.
- See [Configure Windows Defender ATP - endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
10Windows Advanced Threat Protection service failed to - persist the onboarding information. Failure code: - ```variable```The endpoint did not onboard correctly and will not be - reporting to the portal.Check that the onboarding settings and scripts were - deployed properly. Try to redeploy the configuration - packages.
- See [Configure Windows Defender ATP - endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
11Windows Advanced Threat Protection service completed.The endpoint onboarded correctly.Normal operating notification; no action required.
- It may take several hours for the endpoint to appear in the - portal.
12Windows Advanced Threat Protection failed to apply the - default configuration.Service was unable to apply configuration from the - processing servers.This is a server error and should resolve after a short - period.
13Service machine ID calculated: ```variable```Normal operating process.Normal operating notification; no action required.
14Service cannot calculate machine ID. Failure code: - ```variable```Internal error.Check that the onboarding settings and scripts were - deployed properly. Try to redeploy the configuration - packages.
- See [Configure Windows Defender ATP - endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
15Windows Advanced Threat Protection cannot start command - channel with URL: ```variable```variable = URL of the Windows Defender ATP processing - servers.
- The service could not contact the external processing servers - at that URL.
Check the connection to the URL. See [Configure proxy and - Internet - connectivity](#configure-proxy-and-Internet-connectivity).
17Windows Advanced Threat Protection service failed to change - the Connected User Experiences and Telemetry service location. - Failure code: ```variable```An error occurred with the Windows telemetry service.[Ensure the telemetry service is - enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled)
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Event IDMessageDescriptionAction
1Windows Advanced Threat Protection service started (Version ```variable```).Occurs during system start up, shut down, and during onbboarding.Normal operating notification; no action required.
2Windows Advanced Threat Protection service shutdown.Occurs when the endpoint is shut down or offboarded.Normal operating notification; no action required.
3Windows Advanced Threat Protection service failed to start. Failure code: ```variable```Service did not start.Review other messages to determine possible cause and troubleshooting steps.
4Windows Advanced Threat Protection service contacted the server at ```variable```.variable = URL of the Windows Defender ATP processing servers.
+This URL will match that seen in the Firewall or network activity.
Normal operating notification; no action required.
5Windows Advanced Threat Protection service failed to connect to the server at ```variable```.variable = URL of the Windows Defender ATP processing servers.
+The service could not contact the external processing servers at that URL.
Check the connection to the URL. See [Configure proxy and Internet connectivity](#configure-proxy-and-Internet-connectivity).
6Windows Advanced Threat Protection service is not onboarded and no onboarding parameters were found.The endpoint did not onboard correctly and will not be reporting to the portal.Onboarding must be run before starting the service.
+Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
+See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md).
7Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: ```variable```The endpoint did not onboard correctly and will not be reporting to the portal.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
+See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
8Windows Advanced Threat Protection service failed to clean its configuration. Failure code: ```variable```The endpoint did not onboard correctly and will not be reporting to the portal.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
+See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
9Windows Advanced Threat Protection service failed to change its start type. Failure code: ```variable```The endpoint did not onboard correctly and will not be reporting to the portal.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
+See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
10Windows Advanced Threat Protection service failed to persist the onboarding information. Failure code: ```variable```The endpoint did not onboard correctly and will not be reporting to the portal.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
+See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
11Windows Advanced Threat Protection service completed.The endpoint onboarded correctly.Normal operating notification; no action required.
+It may take several hours for the endpoint to appear in the portal.
12Windows Advanced Threat Protection failed to apply the default configuration.Service was unable to apply configuration from the processing servers.This is a server error and should resolve after a short period.
13Service machine ID calculated: ```variable```Normal operating process.Normal operating notification; no action required.
14Service cannot calculate machine ID. Failure code: ```variable```Internal error.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
+See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
15Windows Advanced Threat Protection cannot start command channel with URL: ```variable```variable = URL of the Windows Defender ATP processing servers.
+The service could not contact the external processing servers at that URL.
Check the connection to the URL. See [Configure proxy and Internet connectivity](#configure-proxy-and-Internet-connectivity).
17Windows Advanced Threat Protection service failed to change the Connected User Experiences and Telemetry service location. Failure code: ```variable```An error occurred with the Windows telemetry service.[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled)
+Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
+See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
18OOBE (Windows Welcome) is completed.Service will only start after any Windows updates have finished installing.Normal operating notification; no action required.
19OOBE (Windows Welcome) has not yet completed.Service will only start after any Windows updates have finished installing.Normal operating notification; no action required.
+If this error persists after a system restart, ensure all Windows updates have full installed.
20Cannot wait for OOBE (Windows Welcome) to complete. Failure code: ```variable```Internal error.If this error persists after a system restart, ensure all Windows updates have full installed.
25Windows Advanced Threat Protection service failed to reset health status in the registry, causing the onboarding process to fail. Failure code: ```variable```The endpoint did not onboard correctly and will not be reporting to the portal.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
+See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
26Windows Advanced Threat Protection service failed to set the onboarding status in the registry. Failure code: ```variable```The endpoint did not onboard correctly.
+It will report to the portal, however the service may not appear as registered in SCCM or the registry.
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
+See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
27Windows Advanced Threat Protection service failed to enable SENSE aware mode in Windows Defender. Onboarding process failed. Failure code: ```variable```Normally, Windows Defender will enter a special passive state if another real-time antimalware product is running properly on the endpoint, and the endpoint is reporting to Windows Defender ATP.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
+See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
+Ensure real-time antimalware protection is running properly.
28Windows Advanced Threat Protection Connected User Experiences and Telemetry service registration failed. Failure code: ```variable```An error occurred with the Windows telemetry service.[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
+Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
+See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
29Windows Advanced Threat Protection service failed to read the offboarding parameters. Failure code: ```variable```Naama: Should I remove this error? Or just leave it as internal?TBD
30Windows Advanced Threat Protection service failed to disable SENSE aware mode in Windows Defender. Failure code: ```variable```Normally, Windows Defender will enter a special passive state if another real-time antimalware product is running properly on the endpoint, and the endpoint is reporting to Windows Defender ATP.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
+See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
+Ensure real-time antimalware protection is running properly.
31Windows Advanced Threat Protection Connected User Experiences and Telemetry service unregistration failed. Failure code: ```variable```An error occurred with the Windows telemetry service.[Check for errors with the Windows telemetry service](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
32Windows Advanced Threat Protection service failed to request to stop itself after offboarding process. Failure code: ```variable```Naama: Should I remove this error? Or just leave it as internal?TBD
33Windows Advanced Threat Protection service failed to persist SENSE GUID. Failure code: ```variable```A unique identifier is used to represent each endpoint that is reporting to the portal.
+If the identifier does not persist, the same machine might appear twice in the portal.
Check registry permissions on the endpoint to ensure the service can update the registry.
34Windows Advanced Threat Protection service failed to add itself as a dependency on the Connected User Experiences and Telemetry service, causing onboarding process to fail. Failure code: ```variable```An error occurred with the Windows telemetry service.[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
+Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
+See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
35Windows Advanced Threat Protection service failed to remove itself as a dependency on the Connected User Experiences and Telemetry service. Failure code: ```variable```Naama: Should I remove this error? Or just leave it as internal?TBD
- Check that the onboarding settings and scripts were deployed - properly. Try to redeploy the configuration packages.
- See [Configure Windows Defender ATP - endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
18OOBE (Windows Welcome) is completed.Service will only start after any Windows updates have - finished installing.Normal operating notification; no action required.
19OOBE (Windows Welcome) has not yet completed.Service will only start after any Windows updates have - finished installing.Normal operating notification; no action required.
- If this error persists after a system restart, ensure all - Windows updates have full installed.
20Cannot wait for OOBE (Windows Welcome) to complete. Failure - code: ```variable```Internal error.If this error persists after a system restart, ensure all - Windows updates have full installed.
25Windows Advanced Threat Protection service failed to reset - health status in the registry, causing the onboarding process - to fail. Failure code: ```variable```The endpoint did not onboard correctly and will not be - reporting to the portal.Check that the onboarding settings and scripts were - deployed properly. Try to redeploy the configuration - packages.
- See [Configure Windows Defender ATP - endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
26Windows Advanced Threat Protection service failed to set - the onboarding status in the registry. Failure code: - ```variable```The endpoint did not onboard correctly.
- It will report to the portal, however the service may not - appear as registered in SCCM or the registry.
Check that the onboarding settings and scripts were - deployed properly. Try to redeploy the configuration - packages.
- See [Configure Windows Defender ATP - endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
27Windows Advanced Threat Protection service failed to enable - SENSE aware mode in Windows Defender. Onboarding process - failed. Failure code: ```variable```Normally, Windows Defender will enter a special passive - state if another real-time antimalware product is running - properly on the endpoint, and the endpoint is reporting to - Windows Defender ATP.Check that the onboarding settings and scripts were - deployed properly. Try to redeploy the configuration - packages.
- See [Configure Windows Defender ATP - endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
- - Ensure real-time antimalware protection is running - properly.
28Windows Advanced Threat Protection Connected User - Experiences and Telemetry service registration failed. Failure - code: ```variable```An error occurred with the Windows telemetry service.[Ensure the telemetry service is - enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
- - Check that the onboarding settings and scripts were deployed - properly. Try to redeploy the configuration packages.
- See [Configure Windows Defender ATP - endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
29Windows Advanced Threat Protection service failed to read - the offboarding parameters. Failure code: ```variable```Naama: Should I - remove this error? Or just leave it as internal?TBD
30Windows Advanced Threat Protection service failed to - disable SENSE aware mode in Windows Defender. Failure code: - ```variable```Normally, Windows Defender will enter a special passive - state if another real-time antimalware product is running - properly on the endpoint, and the endpoint is reporting to - Windows Defender ATP.Check that the onboarding settings and scripts were - deployed properly. Try to redeploy the configuration - packages.
- See [Configure Windows Defender ATP - endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
- - Ensure real-time antimalware protection is running - properly.
31Windows Advanced Threat Protection Connected User - Experiences and Telemetry service unregistration failed. - Failure code: ```variable```An error occurred with the Windows telemetry service.[Check for errors with the Windows telemetry - service](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
32Windows Advanced Threat Protection service failed to - request to stop itself after offboarding process. Failure code: - ```variable```Naama: Should I - remove this error? Or just leave it as internal?TBD
33Windows Advanced Threat Protection service failed to - persist SENSE GUID. Failure code: ```variable```A unique identifier is used to represent each endpoint that - is reporting to the portal.
- If the identifier does not persist, the same machine might - appear twice in the portal.
Check registry permissions on the endpoint to ensure the - service can update the registry.
34Windows Advanced Threat Protection service failed to add - itself as a dependency on the Connected User Experiences and - Telemetry service, causing onboarding process to fail. Failure - code: ```variable```An error occurred with the Windows telemetry service.[Ensure the telemetry service is - enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
- - Check that the onboarding settings and scripts were deployed - properly. Try to redeploy the configuration packages.
- See [Configure Windows Defender ATP - endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
35Windows Advanced Threat Protection service failed to remove - itself as a dependency on the Connected User Experiences and - Telemetry service. Failure code: ```variable```Naama: Should I - remove this error? Or just leave it as internal?TBD
- ## Related topics From aeb3ec52686b6841697ff0b5a0e434854ad89ba2 Mon Sep 17 00:00:00 2001 From: Iaan Date: Tue, 3 May 2016 14:05:23 +1000 Subject: [PATCH 134/439] trying to get the updates to go in --- ...ot-onboarding-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index 7023e288ad..0f1f4d05a1 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -190,7 +190,7 @@ For example, if endpoints are not appearing in the **Machines view** list, you m - + From 411e99526ce2ea4ac4b33643effa1aa003181a00 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 4 May 2016 17:34:16 +1000 Subject: [PATCH 135/439] add marketing images --- windows/keep-secure/images/components.png | Bin 0 -> 96200 bytes windows/keep-secure/images/value-prop.png | Bin 0 -> 66377 bytes 2 files changed, 0 insertions(+), 0 deletions(-) create mode 100644 windows/keep-secure/images/components.png create mode 100644 windows/keep-secure/images/value-prop.png diff --git a/windows/keep-secure/images/components.png b/windows/keep-secure/images/components.png new file mode 100644 index 0000000000000000000000000000000000000000..0522f3facd1261e6c47a45a108af3f37aca81ca0 GIT binary patch literal 96200 zcmZ_$bzD?y_dbqO0wOIU0s`WQNH+)wf~17Bba!`1gVKVG($dn>B_Le~hZK-*0cj8s zk@~Ljd4GQY{pR(Y^Bni=nc4f^>t5?x*L5u;Rg`6k2&f4#FffSZ<)qXwFt98!Ffg_8 zapA~G4c8a=zpKu2I&K&k#9iorFcVmbY2YB9yS$P#-r^M;JVs2pAAJJ<4oPdfOL(|j zJGo*MmG#TPAwqXJBxT`d=4#{YZsX*LasBF@yKtNUef)`&vyZEdm9;y@N0NSFI7@Xl5AJL*oB?p`LY78nN3m*~^4{rhqoH#2(^IMo%SzO5z> z4&$Q_KR0o8v~je;XroyRhhupE`@Dy%nFYqtW$4!bJMD>+gM)>mJI3$+#8x4cqAs47IXT{ob#qcX5uXhoJIZBEC>HH<89(Y|?{-l`TF5-5^+_;|WR#Yly@$lQ z$<`&Tja$8^us3&%dFhzTjd3*yLCth*#Tg6F%^d(t+ zAOnST<@b3hHoYmoel|hlsV|mhT2t)4|Nd0*uuf9!r^rW1A=;k){utHz1uoj&rO{{N z{JJqjE~md8xCqT^sJ56WqfJaq+O4_25e*$u(bI=B;LAi;Ia*p;z8P9K8TOh9>sxh= zkjY*2nYUK`_KG%~F58~|j{kc}#tm3wvazvIs!~Xwn!(kW z983i>;J^7kP5FR`Cb?*I-tLAw>m7M=<|rQB7!Nb8264_hBx;rG(WBR{4fcN)6%#E; zaZH4bNIi`0Wc0X81_$)T2a4UKRT)rK8`EypUx-AL)34)T*3Y~yE8`d&8=IY&C!|Rp z=wkSm0+1V-Nycjf+^D%8{$;92ut8>-$7WEe1d(zQ5}uzOwbaYK*C zPqZYF2n6}nPjim&>s0K6jj)8qI+U+pzs{$A??M}{!E&X1!j2`KH7Z0hJ4lf!bZ}5P zw_E2X5@F)*P9fs8`*Ogt>`K$dhRx*8Z=&NTedgp#&QwjFJ0YVRpVuoB<5FIAQ$F^{ zns4$dAIZ^1zeKUh^czBggE76E=Y8p{GKOfbMGtW$I;FgV*A?T3mwIs0#~7^rDlAns zh6flD7<|%g%4A$a%VluF6qmhmeh)YIjBs@hGbs+HXVV-!KM0X5n`sTPCv7=KAvw(X zH8)f#Osc083*00~AFIAA@(T-+#xoc{3CtB&(J z^sw^%B|F4@;vLqXY-j}& z11CU44fnq8LOmrVB?+Dzy9)X#+LKCSGVzKIDrvnblgoabVt%G^HAt#|Zq z$>k*ev%mRT)KNx<*3m7PFKH&`6~s$dMewa&7YvN>PLp@|G?IxH6>Qh)XB=vnx57-Q zglLIJA2t?WNLmt55wQIYai+zC^MqxeXRJ%8zT2Q}lvaJohGG@Ixe(>{Nf@=5;wab{ z5=a$9)csJjj%d=biTm^~y|3MV?zIPeFC4PuurP04jq~^SQ1pnJj~LWRl+IHd8C0jZ zLLB}?;rm5lXaPY;kZS{B=Fsuu-;DTJkXtslwp5uZ9*^?T65}EJ5Y#j@^o{Iast8pn zCO){yBi}sDV~{6@lZc$6rBq)cUdw4!;n&WBN(+-_~b z9A;BUj_+d2BBihro_4zrUc!!_viFo;zl>fY_{}Hm4$tO?le_V=Tx{i;9$|uTBJaAH zXd~hqF18gxB>Ak#1LaPK!EC7i%z2m-o^A<0Ln0KFm6wlOFCPUQl^87z2rhI@Ra7ON%zz7I%qw~$@ zpS%wktESlI{SKA52oF^T@g{Pew*weJ|`m(E6vF^UZ)IeIwhJget|m zr}w&6TuNisPh`Jkww(W-5%T}*KHgKw`n+th=QYjNvWxpZF=NsRJ&Zcm!P-pna29k3=7kWx}o8Yd*< ze2^@6&HC5$u-c(@>gV3+_ud~JxCg#8tyr9`8)FXr_O7U(YRF$zipm)t8>`tpMIs^- z6Ddh?f}?M8N|NG;UY;E~3(@|s9>Kyv{-uk5P$#i=YF4cX2Z^XPGuM$R z(g3-!hW*@~Rg=QQ+fLR8*itODD0Nix58q168&EqPb#b z2lB_CgSfz$J->C4A3uHsp;jdu^l{-`Z&7FAbOw2~H2KPzoh)VoA|j$cTdfy%4l-dY zLhn!(!+fRZ*~|nv%(m6`VwogWY)?pWB69FE)=lbXmJYlz&P=|+1{(YJtz*?y0*P?A zSv9d$N)YLMuq^%S*RREBqccY9)G!8oC;-Ia*q%+d^VF`=_O`DaSPQc!q2LD-o?d~w z%6G^nV)on_KMA-cOb$Sl#WK4xy#kR6L*W`V= zQ-6>Yc#;HVM^}g_(ZXYh1I6=Yl?Qgn#MTw1(M2I;k&GPXVZPUe4H z(bo2}lz)zhVe*-csDN#dHFf+W?en^?sCU)q>pH#eIxpDTpzE#@JjujF* zRxpNghG=Aay9DB`ynci06}YpyI?B+{P-e<#2%7ehT-lP0Xa@Z6hd%Eg`BHLz-p9g` zXj?@ksj^Yl2G87V*}pQm<2l>lh8Hh~0}spJ-{0EazN;WJpm>0B%3gq0*c~4LKyqeg z@9;3`&l6G4-PuTkCQlPfOBtH~c4r%|KYH|N+I4kymKJh0Iu^siaG~_+B$Bh10`kc4XY#crC50+FfWfe0Lw>U}5g~+>mZ> za9bzE$AKKtekl5TcP=_3gRXyIUfb_PBU>uo5jsMn;00eUH&~)@yJ6)tsZOtSlbveYg$m zw1Kdd-nh_w8^|E&g*@@2!y~4B92h9>IQt0`-kodmS~)*n2!|^#(ty3xv(yQK^9z zpY88m4x=g_>=1@C&P&ZJk;s?zG71rt(r0^kcKh8Ng4<(j?gSh(!I$fOqyd6zk{Qi` z>FVcXg4BUZsuT|2o=B78z@paF)MRP1*@mW$jHv3j1{kDio-T%xK;Q#bb@}_t1`>Uj zDfb^gv9a;-CBfDcB3QM?rY64|QsA6Okhf3mH`I5lO`qw7`WkE(yP8E}G_Q)Nj&-vp#W^y*euUx$!AKR<_ZEa*7f1{nW^uP?W_ zc%0k%;GGo3<#ez45z8I1zd!EA#KtmGMlXHMQy`TlgRHkcm>xP{`Q-WYBmp<7=x$g( zl7i95II+L@P`(cj50lf_3TUAUx!&?`_*4?(SVlo>R+^Hy5g zUuRADl7I9hjHn+9B2UV{b_a@gK)^hN7A!Eog_RyNh2lf1M8wrT^RMo~g2B?ghG8a( z6G1$Lp{CgwiP!h%rEWR!^R+x&d{XLmm?lgky_n{E_KCFR60Z;n_^K<(j+y3bf`x^J zIP?~|yf}wc4bO#7X(h!fqrG}aEZSR?ILxHxo-_uOEGQ`$N~4fGMTbJyefR_gJNJ&w zPJizR7aWQchTXjSN)o+C;ZY337EvpDiQcB^%I=!v<_=q}MyXvXo$;pVPc_EJ(g3eEmb6Z>K z=jP_1a0)ujzl4>VX!*?#Nj57#9~T;(LJbypOCXI%AWdmKddpd8@%VIPb~XlblM2PF zyRxy1TSk|{t_`%))6>r1|0CO;ti)b88T8`f=FWDg5r!-G+?jp_J4E#S*C?dx&dBTc zwFt|0T^sg0u5lW}gZ17lDyW&N%g<*T<|E2jU-E2%gbHv0Vx!h#_3z&oknZef>WCm8 zmz5DedvrwcdwVMMk?(H^H^@|gyD*gt)b+lwC7~Gbu^`j5MRT@9K%Rrb3J3u{4Y@EP zCjuLfc(JmV4t)VNtMX|B`Rvc9cRb&V`j9s_H+yg7B|(8vDbg4oAJ1cV3zI~rTRDX3 zm#gR&)laPT!7-2hgX-Ga@j^XuQb_Nx!vz2dj?B#1)!@_Qw6x3vsKHShwRUn6gySaP z{%#zfVqyp~vTZ)1Ag-mZ-%7(6zWw3guQ8p`l*e8Wl0rJWvhpAsl@&n2W+28Wug02W zaqH;lXtK$R6EZ23sG;@F)-zOVRzU$Clm_Pp$|TdIq5q2D>BCL!&?$KRD7u6S59NI$ z4oWgC7#YDUhA75a$76qS>Tw+j;{$A+^w(OMOT*buQWqwk9zS2bE=?A~0NWkf%eK8^ zK!9e(#^`zr@uN3Vt~s8P!|dENH%&-CbeL+$k`U!6Tk%&>!OI1SXjsP3hkSV#Dkp48 zpa|B*FCWI<7744X6W9^nbS;kh>$@SMvicSw@4IeTeiQ27{)r#NHEjCzp-emp(&^aI zn}*()@P}Tz^5(E|0JhT&tW#f~?&Yf$S%=n%pH_=^;?esBJvZ{dv2eB~Sn0GNwhgIn z_2%d9DaBTAR4;G=%e=Be_uI_wtJ*nB1%$tT9KZ1XmbyIBotI1jPt8`goTIg<_vrU; zQ$Ii2K65oUeXj<6Kx+6nSOB8{lt<+R<=a%SMZ@#!*gD#j#Jw7lwfexIk(MPD$(7F#iAcuU}<}idj)Y#j%Zv!vz$$f(ylI{rXJcpUOJ8%0KD5Gt9Iq8EqS`(S0 zU_Ie-zIomk5EL|Xc1Gt&05^+1hBWBbhr|vRCIJbP<@tM8)^c*JUq~Mo@g=pYLOdj6Hok4 zJ4p;BJb**xJT-|*?b+c$(P-N;&WZ~4u14%0G5eqIW8!h*3Oq%pKZS4FM-Q!!wrpQ} z6;k)Bu*cZe!2vj-!jh6F08@1J^x~i9Ij;}ie%WaP7n$4Kd>gQAZf-6bYn7IEXFT#% zfx@c6^2%8#W@n~;Ygso>?EyR$K+1QLP$tI4kM)EdoSdM};m9MYZrzfAf(Iz#pznSr zv> zwb>X+@v~Z5=s1$D!G@}LTIl)nM@XOJW=7zJ4-h&4E74RDr0XP9c2UvQY!$gQ_N|?r z@m~eZ1RO>!A9n%<%z3;Ix^Duez|%=|S?M7Hh+0!yYXVskz&k+lnI*YVKFH*2Yin>H zgsJ(EilG%Q*m*bG8rZrPD8S2$4F^X?vb%3=ZEs6)Bz5-E2gU%X65O*W;p7(7flr7d(9h=mpZ3OP-o@_TeyNlHHDJFQ*IlaEpi9cl&+l;$9*pj0WR7~l;5+lPfhW3qxiR#C z;}xJMEh^M8pnT`MH=0vfDoHTZQ*RO*@(N#;xTN&2oedp|666v5-LyBxx$^eb3Kq-I zy3}lxtI+)J=ezoOT>U--ylSAcGyD@reEcUTC#^#2Ty485h=+S;&5zPL8LcU%dH ze<_*GPvXd$KtLYZbvMy^2R1*tIQI1O@ z<9zxjH=SlI?Zon52drpqYs-_joz|yo)nC^mS_s@-_mj004#D}f!o~AG0#6(p`;yA+ zdArVBdb?oATkPyhqpd|SX6lA$mbxLhoCZJNB;*8{Ibvj?r7IsN0XEm7ep z==c8j8a5;9XJf0wuyuUM+hbRaKKMzH4Hc48$lt(ft&jptucalfi0Ah3g*qt?^l}?t zv=gP-D4#$B7S#RN3jnc$gTpj8@Ie5aA@%E~r1mO$q&^R=0Z_A(EX9Z!-kCi^$_2O^ z_Ugca2zev}6`^gU2c|L93P^>Ge0bNdUxy+$QF=A*_3P}WCO!53{(eFTtTKgYZZWYk zh2QM*i3D7@Sb#UMU5Krl_K2nMiQq1rMf;=*-vQl;33JBet zyuT_GSD>kew3V6xJPseVw1PskR?nem$5Mr|7gP>-6A%&xr9*)>+a?leRjmUZoq=MG zInULMb$)-K`vA>NPwVa^>vP~m<+#&eL3e`{9Aqh8q(MLzCu_wDVaLzU-)J0h_wL;v zySv{uEUc~Z0m7t~Le~c^pUn$3iYtJJp(&miB$FmHGc(gg`i_tAQxMq1{s>`UNJ8C# zRkVPj0~aHf`OKGN{8yRU9iNm$DfTbkG0d9msdc<{ZYR8j(pQ)1z2qcA% zibw=-!=DWS`Gv3De5c5ys;74?Z2&ifp~k#lVJAnesBOvl2ahbY)CNCyR(lJ{c9Ih1 zkuM?P0utZ35FN@@VTR&ksNg+tC<^cq*4unph`8NYMPX8(C4oU6nW(NZ{&voBVo?43 z%sLepB3GUqx)P2gg=!-H{|bxmhcL8NeWbi$$R6FhBHU|H`w_mbJ2%<0-o*V^bLdW>9-i^ePXpOZ(vEHlvCpgMX~c%+U*0F#PNgSM>285q_R#TqP& zK6Js4A6v0ju|dVOJ7I!yFkm@)_CT{q-60bpZ_ab;lRgIktsSb^703$wBBau)sL`Tn z1D=#IHPxazq#~0?u=%*us%=v#Gl5#sJ1s#Cy*_iERAPkqj0KZhTfJ9{Lb8N+`qHJw#YmPx8ASJ~0c)^l{0uUP1|uKg`!r!ZeFXH3@mDNZ_uBtbD)9N zEm8QIb`18!{CwH?gVJ$LnvB(tdG@8mnKX}_ntv8r&@?Q_WO&v3I{Z4JOEetAT{i6f zDE*A4HhTQaw~q7gEej8~9$MxKw0t}KrncrR1Z*lWgepK?ne86Q`nM{S*M7F&*c%^g zTJTRqHGe(VYPx)CpDQ{f37w7Para7%u-YHXhC@};hov715@H)N2ltNr zj(s!j{5e@S>`$6>Q9gFH39B@?iAklFtO^S!wt)*n`Quw`%@uOW#s-~+y z<|mDpd5HV!ZhWp4+tb~xPbJoB9JJl}?|e`Xb;vP3qg(D#{$lO$WO#VE!t`lZUN3gy zVJljaf>(E9`%mtFsS&c{BqNmomjcK9c7tlb6O=b#$vX!!c+HJ*odx^C z*q@ef({q?d>)82}%6|k_jf3KNHH52nFv-!A_xff&Q#BC5f&*G?^t{*p_ljl@Imv$p zQqRAaSZ*?>eDbSqD~i|^xY4Y84ua%SIW?2AmXZbm{3Y8Mit8m7S`FjQ*DPypXnIzk z*plI3M&&53V-v77julp7Ph68AMfWRqcB9?H`bXZmi9ER@%=jV0Sc9oo#!rlhQf-;? z^Ye$leX|r^cXrpG7_XXIU~%Fr9|oC zY|bR`O}TMtdtLTV&vmmDc(ZWlJR0y=Vm#kA|%*w6c*IOE6Leiz;BbG;gguS`O0y3g)Zxiy-+DB(2I{w_zCO*d50RoMsY=1e$43Q{Gn5zj zE_lGa>E&7oav+1lC${(#IOVccK)--|LsIkc;oIv67gD!k3WM~2{)xgG6Ouo3$-HUU z+j&}+fVc_;kRu7@uJEWqpP05c8+Z)9!OON~jvtCl*l4La)9N3o51dS;!;Ao0YX-W^ z)s@`9z#v~QDjkS7V4UEo-EB=WNxh1Lm2bPR31kG&L1+;O=&ZCd9*k(QtCmyTwGuR{(Zy|ePGCnnm;xktu;a(;b(_XA-qM4^Fz(5* zR;QxTD+TTu!b}2rWPYt%_3lgmH#$`$1uRt04uvK+JAPBsNIDXX5$sfaWG*~L%Dpo` z`{9Rsd3X)e`v;y~#lZW`*ZDT;j*VQ^hpjpu%A_yRl7>BM;HbzLjogA>R%3AtXjG`Y zQQ6DeA2%@UU&Z;rO0K-SpT#S;V))h=A(1ukEO#7l7_q-{P3LUkK9;lC;v(A6fW`pRNe-?b z0;{m-6VQEm8K-yUeF}4K>qxNE&e76=!2JvViXbE6q>6&R;N9V7JPU<8_{PuPV$0Sw z?YC24pI~a-lP3pA_VeVdhtrgF%AT@FGLMtBN zr?i*BfIn$3@M&(B=qMAQ-`?j#;`tX_>|mwP%-oo0z2J9kn0<0o#3ZkF7{{w8{vG-k z&nEgprT3YcvQM6L`a4Wj+~S3{`02tO-czE6IY)KjoS7X@b>T*G9Lyw?MI$c0_Qy=i zQ)?_rysNDIf2(pBP;x&CYja2JMlHMLu&jSg4R2QmGYS6Aut)4am$lm;z@#_FxZDpQ zNU}=yFbHLcAR>9W<0&%hC*TaXt77yPO>QxWpZp(J9DncnJn zglQrXpMQQ~J$|1K*8mX*i574o^b?Rb{|tJy9Lo98$s_fv2UiY+SQ5T8?r{qUgiRRw z61lm#3D3P3@gfG!{j2AzfIZ&@y@{sh;*SM7e*NO(Ng*_Rv2hPg<)!mf~E94MkqVjWtGZhgOvexTE zdr#pRw*3duv7A}HwjW4Wp#?gj`+G?laMDFV9KwepE*sQxqcPQcEf=~8^4-2*Q~ftLXv!9gCU|5Z?L z+UQ*c!B_w`6Fxp1FbSok+}fURrUC7{^W<>-;GmbjbHg1?v!EG5AWy*Q1Y$%ec!@BE zaqs^V9rs1!uo|M;%B6=YQU}_5lgvoVj-|I!Nwy^29FZN%a=LKuxqGj zY06{la;6gx}D%Go3 zQCANI^8GP|H0Wx#fl8ZfaJvu5Z7}0e$*Z0XXtr>bU@Jm^0WS$M4zyTM#JbZ(ya1%W z1a=L;5PTR)i5aXHDB*B%pv+IU28u(^#9{auh=5mqVsWq{zzw3EYp>wrD{f zLJ`m)%{Keq?2V(BWsGlwuLU^n^8LSfS>5nD#p0YPhv2j2PxW~vluViM?@_;@n(H{qbF z&}M>oMJ7xP;0z62!X8i%EP=(~KXXclCE${QeVy<;u4aoiy8JtVfsWqKXFpNXNF4}M z&^ir$R&Su?KG6SGlZ<3Q%ARxVMXQ`3i87K$E{+wc0~ZcB2S|l_$GHwr4sc=X0WYjx zpbVrdkoZ6fx39X|pxg}0>us475-kWxNT3~FJUcl=?_qPD9u)pV#|` zhR|^cW*gzN0P&oWAJ}7rho+Nl_CU*2S6BaEHBS?C0{dCmC%1KCDocL_Hoahwg27LR zHVZ-In3{HgSqM&tf}8JlF|_I${knl|v4b#FPnDQ+``6;uxftK6{nqdEX=caNt`!Gm zA!c&khf6KJ3donx0TFRNVu?~aDuXBiWpjVlZOCMy#UH*5jS7T_VdwYMw;Zvf#eAT{ z|EUtQjUH&&iI&@j=jVxa61m~tOe-TGJ3)5Yo~eI!^JkC=)qoa-G%#Y`%aQl@e~mut z+&W@>+lQ8*fF??PUT)mO>(_9C)*X6(UL&ydzj%x}WJsE*ncL z;o!gyG&RuVXnEIOAljTK67Jt#;9ApMY)gxn=<%!@x~+x%i}nPBne593{*o1P|3M1w z60{u=JfV>Ipgb)tE#1Jw0T#aNV5Rq9$0?8o=oQ#~V0wv{12zTBl0a>1HDG{s0iBCM zScWW#4rXw36g4CO@AEVd3sN{}-OH>-Cj_yy4@1!P0g^5R733|n^w;J>3uPUYL9{w> z{l2m__Aa=-Ktb_ax@H9J5ETtgCnS{Ef{YggXay3gDc}uQ##oRo-90?AOG}Bs+c8;b z)*ID64-TmPZq5KQ(A2OyxjcYC1|p8q}>5{rk7)=)+;`==O*QQ9S9K5#YHfT?j|yGN_VQ z7EA?a2%Fhwa0Vft9sz@YSfTLGqfE4_M5S`z?X_cn0`50c)*l}$DIvA8xv;qZ{7&0c1 ziE!>>_f4a&^1yRDv;$YouW8Ti6pY;|XL}3$5H5>fe#Vv81y*Fh z?uCi$P>eb@JW#e2a41t$c-bu94CLYhWbX{hfQZ29v9 z;hpFxwzdw+VMcFbVp<`zeMyBv^N9OCiU$IRDr`gz3oBZO19mvT2bW(zR3QwWJ1D-j z(78qrWKI?l-+1s86w=|*(dtd6S1QbCtHas0m3SxbkZ853uVwv=D)?p&4i0XV0}}yD z#|3hivCDqCA`=-QE+z&fp7u;ogE}1RR|eBX03)QT2Lk%3)JE$f2>GvNMa%@|I)Pp%Rjw;cD-6l2L2XSKeEMZLqJJg%5Qy{mtaSAW}%H|C4(`|f0m>F)CZmlz8CYShP?X+Tz923r1iD6*2GrA5C5XU#{p~G{#u%o zB!#r->2~!rFI(-~ygCoCp?p62rYGdJOY5D{+twEJyG-+;rte$CRmjMlTji~>+1Ype zcI=EghXOC$&cI6h2>7SIxA)Nu2k1&Vi4b03Bswsk~s=6K~#=)wztMqVj_F`hE{ob)vpsH|07LwUV}uWS@K}hxO>U@ z@&B2-OHa&;9?F152_Y8Log7xh2EZIj>`u$(DLIaWuK+(H4k16?e*+tf7U9!B?C<_-*S zoRRzd-^@k91{OIq)liuJoCm10cUxBL{D&3J6nBll0*{r&c{(QENGs@)?!nS4gJXKy zsGJD!W5xAW=VX4>)fQvcp6=r?2-6YH(q)%jx8<(VvK4{eRXcG!q_7w}X0?|y&Y(eU z{XT=Lj?cmy;p9xnl%4VUu=K6*6@UcIRz@5b4-(cYOL!J{DfJkrAhq zM=EX%J7_fwII?ag?KGqHWdsm8{;?;~p1VGycN^97VX(?W!1++p- zhbIEt6IM8|=X_MgHMA@tp~S?*7$5J><ICF&>J|9Z z>Y*{~@lzX996jmSBU4Mg%1OU|d(On!G*o9rLhWGVt-5!&h{M^}FO}8+b>_QY#C4ly z`m6^Qj9yL62i+IUC-&AW(ntj0e5Lg>7+C;A<=WYvvykHGRW>3nNYILR1wl(Y40Lm= zwt0U!{t>76Fp!JtvsKw(X_wmiCAjoP|07DCH~~p7CN2)xlX=1NEog>=L8eYZ)#k6) zErWa9o@`8RIZv(6TD5L$d+vn_UVP$qTKK(s?&OBpR82?YmEX(%P}8+mC{VsS*#AE{ zr8M~AS~_}k2K^Gl1EJ`x#gvBK3QJTDFbcWdlcbgjGau`)*w()At$e7_S=Ac-olM3* z_hyRA?VPVgxHlq(cJ(*(%J*WusqUG!9MI&U4*@jEpvXxeWXTE8d7T#fjeqnZoft4A1F$ z67#}%97uh@a557>>4P7Pp|qHTW&qs=%}CV_+K&g%fH@N!tmsiLP{OFe`vFabSfFH5=H{4;m1<3t>fPF7z{oRVt>?ap&Nai`rqQ582^jJ7IEzL5{ zi_u#RH|L)XDF%@DdWJ7CU7S_-3XIbLqYA+b{vLj=>OZrtV2*=8UOZXPlr=DzEAEZV ziGWrYrq+O*2*o1_D8sY-pHA0Jjix}r%nn{9XNY^vBz>5vK&#GQ`M4L^*yseHkUn|x z1jtBe9)U$Dp=+uc)IPH8Yg1Hx$8vdBTDADy15{NRNaN151tK!Y4=nT`*m_uOzWAwz zBT>k*BBVTl@l(`j71idVuL-+Y^8#FC($DLV* z8Soo!e7_?wk5{VicSKFOt4 zZoN`^{j#LhJ=?s$uB`#j6IWRtvD23qR{GoNf@(NY;iDcu;|P)#hk>&zbI`Z(>Y5d} z9`71}pJeA4+{{tkIlIYVY-3qn_~erNbP7nf(Ff3P6c%^>`Tq8q`#NkAyNNQJR-cSs zm@n|?g~l0bt$~g}8k$M0S!mENv#ox@k|2p7A4z!Cxx`X12$EX*=n_l?V7QmQ`OfcA54oItSheNU0yODe38@#lMm`jmnCD-Q+YJ z)2wh7(jSjB_~b0%70ZARvsyX7^(dr)y3x{{g)cME5l;U$UJdNDHD9p^Q|1s5A3x?h zySiSMDPy+n?^l!=-g_$#Qudq=kROFrnQ`J5+677fh8#cm_QuP7C>{kG?DKEf5Tub( z?yqwZ^3cc#HqI&udxf1J5c4 zi3wgwCOE9QK16@bIoo(}4l~TeHoj<9gB=gQUA%koN>XB?3^r@CcmmutB;+|CVAdKv zU#$p%UnV^Oh6vdxM;|RfQp(BJoccT z>9_dlco9Ps-v)*QCW%f?d`e+<_`B;vgFvKmfrtMaAjS(uh0niK#dwRx!r~;rG@EAa zD8w_YqVU6{`aG~Jj%|B^1W~E2c-jVv8$59t;GZWala=v+0kpSQv=T?1n#8VXZF?ns z^G~$k77{8H$yZ_4aQKEY=V|ohjh8d_^V9bNxlmHmKP5A>d@~#jPlLPAn#2!Sdh`Nq zs&(`ba%f|ngR`^Bgr&~lB|4KI1HFiawp^pCbjMtwpO+_(r5BI&KmEO-MmG1^=Xw%{ z0hR=*kk3y9nDZ^Neo<1UDS-5_F6d~O0 z+bXrFM>Nja0rKKtO2WF23WY^ux@xgg!hoeOv+#XysnulvC8p$QZn zl2VSM7BPf;s@A$?NoMgv{;eH-1CE8L^Y!^=UraU*t4nCNVS)^%vU}b>6T2GTS!v2P zuH%|B)l)2iJiO4?!GhP>w{`i( z%OSL8DJsVwBs_(hrWxBrf_?O;7?rG`n%xrEFKJ8f_XCRKqQO@Fqo z1vYXAm@b}-nW}S`iD^8-UUC-V;^Hz!&smn2525EQpF9a2VYJ6j%?EOl7!7$q@R5nG zxC1m0C^OX?$2X+OV210;(4lTP@FSpE!3Y@;2QW_XJUs=5`GD9=d+_tgT~d51nCAo$ z*V@L08|Lf56AwHf7}e~+LDOSdjb8BSJ&>`j)3OtHfA|4a49EdJ#&Jt1cjL#8$r@jW z<`YRY3H=rtB_P>cVA2t!EW6c}m46O-$io|nD8L5%Fp&b36il=<%3;{*)&fTzdXEp+ z&e-yw><;)4Cd_hcYc<#D!5I(q8JbSQ&a1ANOa(3*Mwvc+5g!35?$5zWiRHwfk7ko? zAJvMId9v%+Q27ckO2Ct)xUtveGW#f3#!1s$r;I?uj*=>jdv%amg48{jL-2ZPKKd)c zU{>0{b+il}^6^|m7VcpHMT<)uwdT5IwHrS}(Jha`!?VPnt-2((EjkG>z%2PN(9W&|J)jFtHk7pQ(g!&7>s({pbuk> zhyGiVMn?28&B1|ICMj=TnZUhy|Eb%F;>uod4qz_Q`9kxW}+OQf-W z#2q>aVhi<5W$k>0kcZ~Zv&mmQr$JoNI|Bv){*7kPMdc)S^gdInGlcjr7Kr~h7YabU ze8Tsc0sIvbX%3Y;v)2Bf*4ylD__o4NzCMWh3ca4afcg#v1r8?EC*V!;3-MVH@-Tb` z-)7&(M^^&5ckOX2<$c?z9IzPIOXWSsv!sh#&qj61iQ}~fZ~_8UPapn)p*KkS$AJOE+hGnge#;Njm-ne7HW$KOoW7Sc)```1cZP-9Bk?l_B86p%811P)|GKO`UTb&J z2isslla&$Iwcq~t@pl=nA{ie%{b0>Lwrm}Fk2Nv-vf$dipZ%eaf3k8zkwd(4Z>4_137rQnIj&fk!M1jHp16o} zKa4~~XlN5qMZLbRzDy-`yZeQp!(IBEP3fQMj!{G$VdN`a?+{vja>4EGDvXcyl}#s7 z{^Os#b@3w*ZsLiP34&WfUm0mvVHO|b{q}m-D#Zydo{W6BAQ>Y212dm+JWg<>dBjU( ze%E(NX$!VnOhq3a@UA1(%+HFr9^6xEco_Ey$@qrgtrkHEX0 z$&Z6r6flF$Um6QXVQJ_RP(2I7&$~~eosfvtgS^wRLB)u*nkd>M_SfLP+`AOFTM94n z`zrfdxEpFO2XZnbbFUlmND1BUWl@TyktgMr$6c!;vc%z)Agy}J1$<@e!Vsv}K0ZFF z#)(7#l3-{@O-Cn1)8(A!w4mKMD=TYJ{dOZlUb1|`tWq1cxm&{) zi&d*yr1hpU;L9Q3CCtATPUm2q@h>%lFBsr8*uVt(1iKdme7LKK3ol z6w!bELpt6|R(a*wE1zO_UYCb`bPEqdHmF*ST6S{(-hTO&`{L84m~bcddjfYd<=&IS zO}vM8`NzA<`A3et^dQ?#*PkQ(B zB<)=}^XJw2Y3{PaJN83H^1qKw;!Uts1}x)~sb|3Zl7v!aIb{t?{w+TMppv$Fci zKiBz5Du;YyqvIviiu*4MeIkx!hK6t4lDyJlc*x*HlKI`$9VeaPXYJ;xx7iQGqe@ja zWPG{SZ0FV!c5l<%PrtMR%C|Y@X&*-3U&|X_T&!F^`Ybjk88|DOkoV@4KJws&+TswW5kTol0&>)>XLEdixPdg|V&fY?XqFcKaaRjE}oL zwqrb58XK=?`hY1^RQEHTPW(gB`F3qrS6ZbHIkYr;=At*2Qhqj3J&hUVxww<<9wS~j zDf8SsVl)^f^&KZr+k#d5~naS$9(Dfh7`h`g~Is4%WnJa((+?$r9!@5{v!(^K*_`y2hn zYSb5q@{g~g>>ZA4V-sR-4tI6I*#8?O68Q{aV|5*OC4fU#7Shr7aV?qh{mDh!tjT0l zdV@j)N}i?P=YvK{ldAlG51uM=YztqwRlPUI+lEU(Q^kQdx zADeq!YWu}?8hxUdt3pg8k7EZrWS(O$xznZ%zJvspYsannFjn2EGq1k7Z%$4_`HhqN z8>|0Js(r7jK2$DxkR+M=c3@W~=V=IJqlUkqaQQ znM9)hJL?Pb+0%Hkpil2}`oH%SRU1nTm%Dt@PS)!sAgTGn{r82VZ?H1uc}H}ONx zcbeN2ROz!zwhYO!YPSC$P2U|)b^nLmkVHcnWkk1Zk`<9ip~%QMO4(aPMum(@l9lXD zAqtU|WF?z}P^3b32qD=#*Z224&+B#nao^oJ&N<)D=RL0XbzSeK7hivwrk38nB(3y< zi@mt7RcX=m?D)xBZ#lBV{P9UY;@`VWT^`g}>Trxxe2Lm-PEw>-NKpxMa%Nk8M33jA zs*G2u%_%V6AIup+uc&m;UH<$N`+NuLJ$v6o4n+v2F~oYD+uQ8K-zawS(xnE;Z+fBH z^3O$fZf%hKsyF^JtzlS!=kYL;)0L5zDW8Ww9+_yA9R4)?GKKuBE=5esm~2v%`iNSa zO-h<(2lr0f#3G$Inwt}^hkuc4hB=SXMN>69W=kKnAz22e?k$fweKl4CI3c(+LksSF zyu1zH=nXd$G2S42A%FK$(eC%Oh7SoFwpP0a?2gB?3ar?b{@JbVwC2#u$8}ftt zXWE)*_k!pY-5g2cH;)Ml=cL-k7&sD_J3cvyjshKsm_vK2m`6=pQ^v2|`~IXR_0y6L z$Xv@y{PKjEb6_;?I^FX_DVlzLPYqbbq(Zmt;7paxnu~jxslp$1Cb#qGp?q5}?!jG` zbasy}kHm0Aitjp6+c>*#xjU&pU#d7XLq&2(;;Yr`Wc3VxrPM>aAKA#?Kggj&vheUo z0Qj7lnF&U!0!L^z4T+;!6z%))$jC9O_l^2bm9s31+hmh+DD|RB2=Q*>lcuI7+rcTr zcJ$>BjfGvceMMtFH*p>CkH5Vc@2e`lXs5t=pizavNi;UWnYLkW&dEjk@clE!eSLZ) z5~O}sU6l)OYF|OgY%c#uOgQJ3JB6K@~Rt-*rOY-YCJzUXbM6Kq*DTm z8b<`SU*6uG7>l+D%~{cz@$R|lPH{^x;l#y>_xH^>t=N%;2?BD=y`NT*4-dKtTKjz!m8HaRpR%*q>+sBQq*G(G#2>X&i5W) z2yIsuK0M@?v}nC=q4iF94oha{f!&k`J<>M6FPY;Jz+Wl1aqA3q6`5ZYF;40jq$;sD2V}&xKf# z=%w?si=t>+G0Lz~9CX!-I?-C3nTfyXA=@uge0>`44=7`Hq3M!GMO)cE16!SkZnpv( zlv)zD9CGOyQ471Te4N7~mS^`p!vn$-1-ZT5G>RmfT`rCyG8aNcO3QNWha?!8=Yno4 zh0`S@{EC}N*O$~GwKT2IRWjRuk&G#hP%SAbnP2$TMnU>K5Kb-SBKuG?+JH_mETLh; z*IPPamu3QMdcc8-K}kK$ykCmC(Qyq$g4x2`!#FiBT@oIfG*x+!^oy#({1_&kPIBcJNvx_1Y?4BC zKK~96mD|ck;^yGV8_(}Pbyag9<#?m@74A^oPm@Qwvs3F{*I#cKt**LZ&Z3%<#PCmr zo{?>*5Q~V6Oi@j)YZxUzbpbS+4< zdIgqhx_*qY#SBjH*URlbWfW3rpQgnpbjKiWL6St8UG~s_|95rG&JM5XB zs&dPf5ApyOn=43Ow^Q#13MnlujksBvWA!8?WN2|UccoOG{wd=#^Qc|aQr%mMxi#A| z6ZoUP3D|2j%Mu(}g;Zx6=FH5SUYv~=*(sK9U3=WTL7$&u`jmp6^vs*1B`0vdq1~SR z%GJ@B&qqV40HEk8Z?Lnl9A&NO(69W23&h02a_!ASdxprjH`&L0I?q{}&&gZGSNmpW z0wMveeQad;d+ZtxFQR##!~;^kaDEhi(h=D+$WxTb8Er9|NVte%s^*F*K-@d!Vk7nDL^ppJqx zWeybd9$;CJf}Xv27N_ym?rmGb6Fz)BUDq61#^YS1TY&IC|MWY7FS)Hg^yv8<{&(XG zD;m2SGQ9p4f5HTdJKU!Ap=SBZ)XxbQ8)Xh`1}hCE95|{`!{Fs;`CvMa^M#Zp&%`Fe)*yZ zvrJ=Q!p5h1;8R^Kjt)Sv|Coaj#cUiLtXy4V0EAnAw1l@5fY@a2;eGq|IZu4%QyX}m z$?sK}+?k=#+0(O2m0uOeY%5-$L?XqsSP~9xUa%y?Z@6_XpEE`^{hEZFLmZzoZ^YaN-O1=FopC-RJV(Wlm4#*K?|3Jor{nLhB5Zemi$IoP zCm|*)i>ZQ+uCA!Gv{cR{%{LNaogb?L)KA zx+h<~dR4+f`v#1np;_aC9#D=!M}&ukqjVx_0&N2WPhS-&wvf)Qu1B?|CbNUJ-;`Bp zp;$Qt;vz6~kj)bl6FV8e0^o%2dK%HDWCw)54Yt~?zk2D%giaP^S(V=kfM3|YCEAS!Q;zeze`yy zG?VVH$ZY5OClJlxL*b@-*sZIv|D&?6_IAhCCpApLX(d@Jb(gm1pE&szCHSe<+!G@6 z9`f`GQNt18y6LtyF46|Nb(DZ?3VLK5)^jrX0p-Ittn>T#i#9fVK(SKZzmMzdGko2O zlZnm~H-OMF0EEx$v9tU7=Kjr-Mx?Maj+-bsJ)eeZXIVpr^OVt_lLlEQ5a@ zAUWL0SGliS46Pli$9{PMK_-cim{&(o;(eUwNOvQjLfq)EhJT4wR1B0if{6Agk zu^-}9cET}rVxgwjf+N#BUdWzXdHhhQc|LbT_kOv-{%IrgQp%h#;jCxCZ}EdbE#KPr zHhp)fY%vQt4Ffr_n{dR~J^pOHR%|~~<4*@o^K{v~I(#@@WoBY{i&_9IXp^3N3-BaN zL}OilJ@+F%!0l2PPr&vNpLuR>F8#(?P%H^IC@{3}`Ssqr@L}dQ0^W9dSsANx81W;7 z-(XQKFLUtRT=Q{lO-<+xc0v?@kNd`XOg%0>etdlVd2w;{-RTlP_O+iof#>GI^my}UQ;vCVS6yZjxrQMK`4aBhUsxZ@u{Y+xbI~x z-`~yB-c!29*R(CDASxL7KR+J^cxf3Kei&H*RqmJB6 zq@-}*8-Z*i6@MEf$b7pVQG&`2IB&A+HB$b@h|z{GTwzcwNr8yA*n5ZFzBt}hrWKDR zxO(7c-`$xPm6geuP3C*8yMswbe0lH$%P1>LPz+>*riMU1%WMwj9+XrQ4kty*1lBYS z_MECYC2hmrc3kMap4vOhm;9^?3Orne8lmK{MvB8z2aPA|Y(}16dOSbY2Hh5}9;R!! z=7@4HGXuU{2jw;5oZnt}mpGneWj*a4VJ@od=qLioK}tbEINmKaH8roGU>g1dXeD}|jKEaPXsuPm`^S=~rdxnSl_tX<78$o5y=^ry<3>ZNvaLB8xtLw(@ zu+XamkS!5kpzh4Ln^Kwc0DgJjfv`pW=g*wn2SxKU-&FNJi{uGc#tmZ(-@SH~Wwc;n3W8e#%F)q5wCm?Vxw>veHKQj~G3;GQ_4t{?ADKWm< zoK8-J88r&88&1PxV{{?)U};?lgZnFZ0#Mg;M+!FoT5u;@&XZcGxx@Kv&HfD!50l*r z!W8^v&h0IEv@BNe^@c>Y<m{g(ox;XFFTf&A7!4^FprpSaLF&@ zRK6m}xcgC?gxA=1N*@!$mN)227zA`NrzHf07>M948x3qp$>f)kl0q)BWi?Awhv7EW zgJ-XU@l6fI?eLLD0LCRoWKQz@r-yH}h9I_rk!>#8-YybrDsX5wqG&^7V>>Ig=#6*n zZedfmSC4)78$G74B$0S29Z`R7K4a$|HSTc2Vn`z1?Qi>e9AJ1@?maB6fX53$19V5# z1Mmq$wtt=YR7}gu+gmR0N)XJVQRox7u-6_38@C--6gELsP&~nK`B1PDd=S8?+ir}Y zP1MC}LvkBO@q@uEl7qKPi_%`@3yMidNVKq6wx=lKBY3TT?>8;FYGZHD9jl7uiBOCy zCeHiuBk-)tK8()tR|)ByJZ>4qX97qKh1xh6O`^O z8)+>3X16vxOyMixPvRO4sqTLzOs_uQ((nGtk;(dffRcw0?T(j?Cw}fqlR80b)xxTp zA{KgsJ8-wC{JDbtH05oITcb|#U&!i|9N)co;ycP#rBuhhmDAywE!T_k%^MF0>AyR3 z>(&YGaQ_RODQ*hqQ#Da7U3+VXmf?@a=3fmQNH*^^M~GquZeBSxEH_(2M@XeS=HvSn zNF?|g+t}HeL*|3$g|V!Kg$0huJj7l}#PuRP6sfkMc7Zbd=d3F@4&W~E2GBDyc64{w z!$;VYuxvHzzAD2|tVPTCnQ!9{)3*19xyUzbV!cZW-a+aPVODWDi3&1Cmq<%}`{g#x zQt#?+eANk3wAg4HaNJlNlhw6q$|pB8P(cYsX9_Y5?)niqIrhqa4HR#)t_g@zP0h{9 z=zxQQtk*>0vSCw5O+&*cBs99vZA6ql$H9eq^;?N#HY{|Ke4mX_#LT1F;6>Lj$y zu+0u+JoeFC)Ny0Yjq%u3;0Qlqd3Pn443;f!xha3ef}aQzm7orWT&$Ige9bux{5-)L;j-d>z1{QM<< z+G`)p|IY>B+0LHw>`m2|KjQ}lg^{7qCh{ITW0~lgPp*2Vmxjb)Nakm9NYo7$s<&kf8U+=MJbSH z*ORYtn)U}HIVQ_E{m=RkormpYOZ*W8F4$4~f%!*-=;`;9IXkSlVIBe7!ZjKMFGA=w z|1E0s`U5@Q!$bFS_oSv--Q8%qwy`$*lH7K!+QY5raK?C7-r>3wQHMf5|8$)nmZ54S zOa6o&t8b;jzP^S0^FB#;lm)2!UwXP$#EV%8idX%X$YJm1j{z&e8Rl*Bw3b}QEBe?> z9qvTP=}(&LwXa<)(FO_kr1vzdU9VGT5~RWKtxl_`NJ7cR!X05y<{FCR!Q$j3%p6Q8 zykh8Ht-AvZ&?GIqpHpw;!3{*o8W9=U;y=$x%^~GZC?s#U)dt~2TRl)lP*NOy$I zIhKn}&$OB))c*x(ul^H`tUst4WG0Ii6on6QvV~wwl^>AH)hr6|v!G`!R!yjw`TiOB z&C8=OdBC}u#s9Z{E$#ETydS)Eke9E#?#iZ)4;?Vs;ZxO?eWv6KW@qR%K_qp)`0oje zKPsf%l-oi1lw8-F?-CP=wvGGHenMjW_Dpb7P`$aJd+4H&;@4gVt~L(G84iKv?sq5q zRS}j|E~+?8h#{$_4A!0Z%+1OwHKEDi4JfwLL~e-HrdaXarX1GL+#K(me13$YzW%sL zWYD~+`}kbF+ne+)@wMdFs#F5hPi;dRiY}xvM4Fb?C>n)Hp8A+AD3SkuxUS^S#w_kPWttm=mg>Hrm%ewOP6uMHGPpxi}(QEGYJ32}6P!-;0wvwtj{^&SC(9yhd z<=rzuCR8qHNcjZ>tQbB!yy%`S^X!Rb=SG)OwLj7b%s==U5AFYCSg-uNu1O{AqmDp<-O& zK1ci${ep+hoU>Iow<+E)vPc$8@VpxJ*f&5m>aktT*%{}p_n9y5r|#S#rb&O$}ZU-$4K_SZoB(Rm+Cj^zsaLO4nAixl#U^pd`gi9mO4nO#s7;eMR z<{B{YMm5yne2KP35-COeyq`M#AH|Nplv-()yL3*m$F%H_#C>jWpM53u0bLAwICKU2 ziv_ut@4_SXc5hpGFpNyh2dB%3L0yGKTM#FM*G-uZfv@G+uEqI$FFO)N`8VuCKF87K zfFPF@U>svn+nteriE9tlIf{M<71?^|ac5K6*R2hmg!ltKf?&0b+@#JQx$=1>UvU1L zZ7%FQD|Wb4N(w!~v@OFII&IXpt??&W%n2oO*B%4=OPHz=sUguMN8i9SMeuxm)|3hL4Qa-amOEr76J52l z+}yCh8X)qHxVZImQFMZc!|-^tkzb^wq&#{1cT7|mbjKagf2wDgq2@rkdzQ%$^VYaU zQxNGa3y_LoU*&wzu;@C2ZdN3|8k@9_Wo0tx26s{V;H5(2;{(+*N=-S4ZVEIg#3OXP zoRKO}rte452nHk%J+&j;lcDnh9*9brF|hWmgTrx1RuP%c7H#Ae z3!3lA5E(j5VY5)j)7okY z6)S2>)c$c9!}quEBvuokXes;m&6ZHb#kbVaX~^7f8#8N5It`Qp*MLyUo&k;q{R#N> zPW_&Xj$?^;Fs(UWxh6`uR9-KdYd9K06nCPSaR5UgbluCav229PxgH(>E{!Gl!bB^K znqg*hW5!JQ&{E%G#d%Z%z&(Ild(A9*g>YSj8>0p&3kwT*x2LY&Xk%hx8t^@6`0T|C zi16#T?~^&BsfoI1xvhw5ixJ)z!X`*)kwp0gE-{~*3?L-Lv#ys&B)SCIrJvhjT@H)@6{F_Ws{!4Ua3vs^c<8aw zqYt2ZLhnX+gNI$j+f-aP|R2Fnqakg@H#SiSzjJ5P*0$#J&|f zu;W3-oxh;0yz9Xc=)*0%=E9Q!k+z`_L8}O?NA4NWN4x}Dh5O&9Mj;|V`GKC5kZUh5 zFB8igvh_=}0u$D8d)t7A0&13mm4tw9_D_7vgn$R_2^0xZ@RbH)iouiAeqLD5!zBCi zg84X;hRKP?^k36yMEw;WKtI|!o^Vk6B7fvZAehD9$6Q1cE-1P>4|8tl{7SDEq2ZzT zx+O#&RiSAPR2x2|$Y~Pxi=S#6Ix=~?pJ3>A_y^U~2M0>9p!$Qa2tYJIH)`tYdo|?N z#cjK?pQooQ(JX!M>Z(KA0}2}68ihPK#WzREOu$JSTUu&|W-)eqh~g?yy|beOJ9vl- zj{l9iAJp#}(>&UcddJdUBC4^eYK9If@9JwfgNw?_s^g@h{YP&F^CUo20I=}j2#g8S zOZ3P8;~qRk5X#KN4>-Z#ehYde)RII;4-%W2Iz5UKif#9I95$E0blc7;PjGBVO(OJy zu(Wih;&Y>y5O>q0T$hN)nMM^2XeD>`DG(z-bzD3=evtx~p#yxSLmWLV9UTP(F614V z<>7Etxvj}^ZTS|>;(k8BhKSM~2jY3V8R49Rp{3hUu;ih`hez&UjTM?mv&Jwkba43G z8nVlraKtKG9*rkTejWbW5brfJ08`Ij2>eEY3rhl`UqXH$uq0$9yq6K2Q_>K zXqyeyb{#Rg?)0axR+vF(yWA;;;eB1wyv-#ia#IMj{dIW?{I#L4N6EYoSFO0uJrL-S zGmgu##yf_FNsKhvB_*-A*Ki4F`Sptze+QL0Mp|TCS+ve|WAp7D9cKj@kIKm<O2S_~H8(dTdHuH)sIaO3 zTZuvd`K%{z66-k7!s@-X>q%IVxn@vvOZqSu7gyXUT3f<(`G^OH+&Lw#r%yPX=hYVF z?04Nf|04EfPa`34qs=3c6wx9gu(WsB zPN9T|Z&A|LrbBWAL~6r4M!us*+DUHaeuf`rN+L3V1opz$j%IKUK^{<^p%a$OGDA04xvHGhjyi2nzx@ z@X;6yH0hzWLN*6Zeo0fa3f3=VBvC#=K?Qn6m=KX)X=k7@RE!$2r9J^OUzlNDds9Z* zdY{^PgMn47+%VThIUivcgBtsjazf6u&BM24p~D9P3>7Q@LyR=(_67z7ob*@{Mg;+w ze`|OsBfy)fsVN!wFJ&8+UoGG)(HFuT2mllshuxGux6e39C))jZx4)o=46O^o+&o5dCYBPJOd+zj&Hwio;<|HHd?;eS3NclyCeli z$GoVYGT}aS+}c75fB(W}zxMRv58_)Azp*YLB(#yMv61X{R`Y(Jzqp)~l)T%MCt7|_ zE}HRi4~p(hrK0}){+7;ryE0da3-{Gb&3yekw>#RusP5z0|6YuuPlsO-+C#%SAcZE? zlsIBg`8LAXc@%MD;@3-lW`?l z^osa}_QfnXP^bn+oMsbeJp6E|W{21}V~FViL=jcSAIwFGbxwx4-8ltUU!%eHotU^z z+-;y5NHKp;EH0nrX7oN_dDJB&D2T`^UAacyU;eO5G}inpV>slH&sX5h5&T_Hb5i1n zf9H-jzH#YwH@XIB1bC^*Zxe55k4$Eg*J5D;k%T> zPzoQ)(tVwRd5%?*o04rZZvehm)D775a5PbU9v(wD&GHyKB60z6$j1nXn5+|z0fGg> zq5wTHT&SKR3E(@+%*3Uvg$`vL=H;67fH+I==4ll}G0!OQSaw2}h)Nt7JCU$p_x%ou zlYp2l3u24=z2X7u5QCIACe)K+x8Tsky|1GzM>t^hXVNi6edNQx!gQ9!DFczo& zamodNRyY=WSS0=|4TYGAGea@}eA^3n8}N9*DXuc=1_p;iWag*G=g{ZT37dver|^>Y zcg)LP=+VZKz1ecRFCr2x_It|#dnED-@`g=bBji_6+~tRtUW)#0^vA zTOwD;ZO+Tpo94a2up=`o3vnmpwpKrCm%IOd%jb3%IE}pC7x$hP2y15Mb;~u>?Kqg? zcMT})Z@&zP+Bjs}M82%>*M48;$|(3ouF^@z@_7Rw<_tgNQK6|L2KukCawo23jq zs3EO`Cr%_?d^ycg$5LOv4#p=72n;-7!s-0(UgI9KiS$sZP%DX7WbTN@PMf?d!m+Bb zTRKg2D_FDzKf`zLu9U)A>?eV6rl$Jf-5?5MGVvkJSpU+cXKqn&_dp**IQu)6=p&#g zXnua&6dUv(=vR<%Z3~YZwP=n4^$7Q}-dbGUHmiT8dv4H@EQZs4JTr3+B}~V+Z%uGP z5qsUzL&Xqz2Grz|7Lj;rQ15>KHb-xRjZ{%cENmWsAh4Mtn=pJN72s-dwDBUUz?{l{-NUmKRk zVN=y?XYxh_(rTaQqJi4;r?0|oCRMe(j?n%jd@?{6`0s!}ERkAqxp$~aQ3H92 zNQ{--Qr~#iQ{`}6i8p_8`BQRA30dLwT`gzPNTazC?wxmq>R&lex~3le=xlrI@<{Rz zUh-|}>{qXdz76&!D03l9%DY0CO<`31h4F?@6<&=?d5~CJ1B!=Ulz*)$-Uhl_#z0^A z4KXt_7itrZGd`J_sOXd2Mwwb@1bKLNhBwyq!x_?+<~KI@KrTnYeeg!sm!>EDxkO{^E1>AZ{F5@Qlx6RSqY->>sU9b}Sg^@-gf zJgz9HAjei;F#3d+)P+J;6PsArhV-i3+9K>QPMEmbV6&0 zT{Uolk53j}FI8vwntpu?Y>Xt5U}NXg<~i-$sd^Os7W`z0`${kmkRq&39Hw~yGa!(O zh;cnk$9_#r4B{zYJxn6u3yMoGN1;f(=WEx}pLi;20%`b({tnX1Sj>?DQ(*@3UB7a% zdEgyj z?nVF%fY7QLt#m|RDYie1mn)rqfAMJFWsI0G0oS;@GqCn!+zH!5%*?Q$srdWiIKtZ< z*pLz(BBm8EOd-w>;kMImJq+BA=!`H#sQ6cui&Fi8U^99V91j%lmJ1VK;PXRdOoFL7 zCHVP8{2n#oiy55=Gzs{bsd`K{5D76o_tC|yxdgxoPV^3L|6~+-xM*jyh8CaP+|WNB zHTUAG9{Me`Dvus1lk)3_wsN16@c}KzhKBE+0Y(KQO7g zD00-F=fJM3Z3&NVELz`6X{Yi`Vq<2O^XeB#4hcLwm3_6GF}zX1_(xmJoreLL%&(_p zXQ&z#9)#sLRzX7fYvWHxnsiCJ?$8SZ>r>~SR4d!`n4h`aHX@WDv?#9q^;MMF=g-GF zbmlR$iAp_xCEsI5SBUr)v()OZ*JatvDSftTEOK2xcuZ-Hx2X)-`P0T}yKniV?;dM? zCO_<>yV&%iV*lKIW$-ue6Btd_a^6vUSY|#qU1DfWlB#{bhlNLqciU2ZStnK2IiK~V zvQ$B%lB)vq`qSKuA$d!w8-IiM9(@*e?awTwi0H|C?dBiGTX~{%{QYDu5~?F}#HLKG`Vt;XISMx)-I7 z{5=1}%uEIj8+;gP6i${Vh|0lkGjS`-a(up!a;m|8+(go~;`4`T6meD#t z(Xs>L-u#~%A=*6e^=|K$-aGwj0QCBo>Lk(ML(cvNW>JV6DjcDoC<;*O(FH4EC?yt3 zaA>&tSGtM`P6}8et}?P}r{Yw(dr%4xN#k{KAGV3A-PM4ig7W|b;y`ENwu27`<`!Vr z!s6lD>-L3Ca4maL;WUiJa) z?1>irI-e=n3!@TJ8*)RN5RK%ZRuB_wrCp!iHin&R*Pra$g6cHqZ3z%I{7IyW&9}gw zCeS;uGRGK^q;r(;VFf{^v4}fTg>cE`4fq!KwYwX}X^Hy%`(G9^bliTPc=5jaM6_ya zH1r=J+u0Y}+B#YOKqoe}4p>B9QE>;rvk&GCsW4y&2nZ0*L~ny-&k=|T!S3)bX2a}X z{KiHl(yd+Zd(w9wz{21u;(go9Tg>#8caA<1Y=%c6u)fR%?IW~DXsN6pM5OSdzNe%1 zEi91(FVMju_w8jX^7nw0OIlhV0h?lqPcXr-5AVO1sj1t2sy?Kv#a}_CjTlIr5w|25 z*o9ieVzUszQ9+TH!t1oQ7pF&_`>~zP=mczzssR4r=^W6(+&uZU&?fwC*W1EEl=PH%TlEOG z0KGi$f*$Zx`)o~x=@H7yeCu`&ypO`+F%0@XJ6-ZS`yY|Ve{>5oS)k2QbM8Z(ghtF} zC2Q9VeZJsfaS+-;7O(s9D}2xDuc?z)0Jw z_ljuXnRG$3!8rS@%O^h{PUoRAx_W}?=dl7>bIKb^PD$5!G+t=Iz zxSwia2&eHBjVm{3!RuwUK&NNfjRTaLuyJoq%Vx0Ud_ad2<xGhCU1 z!iDniOZG^vFsi}&hqEryr&|gEzRkL_mK(~I3o^$4_6cbMyx?B$bu~FHO!=>vE92~y z-JSHN<94^Sh(DLtCcVm35e@xdEfN0Tx-_q7%Pg z#i{5;@w9k8xNuh2)#-%~<-sE!{m| z7?W};Kdd%EklO2K#(c14#0ga0{`KiQXorY3!O0RrqJEE5FT|2d<610n%L&TTzL?Ln zs<(bNes0OGV$%Kv*FikKwRZOP&^qPd`k`+t(c_nu!!XK4a8k3)$;=%6U@RIdZuR(8 zzw_vol5ce}Y7+mS3$T`;C*hoJUh(C#v{?OeQBY)0QncPV;Ff%(QFght6L|^=n^xm9 zYS#+r6=NmjM2GArT-7)a{Bn73qb?&>Z<*e!-E4V^+|so(*6~)6G*fN^I+>|Ur<`YE zUeAbbTO#`mkY~c4SDN=NUY~4I6&fJBC0^i6pOTNwk6ryk_T(KB6kBi;TbxiWP49~3 zyQ?2q7RDFwjft0fzF#C{;L} zH}}9XG0lt(Z?5}VHO8M(Gug9Rtqw3)9TjTjbUXO{mN5S9qdKuDl^d`uH@g*iklb)86 zStX-uYmJjXy4`wD#H{9wy;nWoc6LfzZlx#tV9rl0#(NoiA8iH3aeyq`7Q}b^RbM5) z3gVdohL!Q6S?iL2_($OpPb=zE!ll|Z#Z`9SIb=cAC(WwNyPYJ+JW`MN~q)z2;kJs!2IU#I@*^$ulR_slpj zyhHv|;qlmC6Ci02%$<9UwNsc(8F$5L(&DvW9!KJaQHFmcw zVBojc_cQOdq`36{#AZZu)lJ1s`bf0L4InRcqHB zu}N~o=^RDF#t6@=at4ztk_Bo73!UWrS34Vb=Unm5eb>D03W^V0OYp(g?lJe5E(z|w&)u~7Ayzy01vE7&CVG>T-dSU$d2OmbUj z+Jo#5VIO^2oUikXUX66{7-A{rykJq6;0oMXgQjM=|1bv!Ly_C}?TmsV3taN_ecI+wS_^B;|+>{D;jaH#cS8C6Ye zmo6wX!twb$atWNu;Mk?UY~rjpO@F(GDnmz?fu$t3Pvyz@#M$N7>MQXoF9@XS%a<>m zWvik|a+nkpBpE}eC6w_gP_oj^nYt;uG1@%OaT@$rXiBi1q`K(q-%?^F}dtVoe7K@^0_PtcG-p09=_S$#X z)+(tFill|t-;1X`Cq0uF-B!&!ZVxTg=KA^h0oXIQv}`S*KdYJ5BA%ltU-mpK|((S+%|aRLZ36FA=MXu?*Lr%lQQbB|u7)H8d)7s)mGn z-U(Rk8D;7cX)a`X!?c6)tf(^f7NbRkZ1j|RaR6~ zG^{D+Gk%5`Xq0u8m$DTq1onJLV6vohdt4md^YyA}wJGh=*d4#whZb`QO0A1Zd@ivU z3LblWIy^v^rNyTzmU6FEB%bdjRgF$4y|&Y7@|Hv4+AkUGH)sVWE?lrrA^K$$xGD|w zNxOm!?}?iXOzxt$y+rbT%6cx&_fvCnw(`*T^E;P*KXM5$U_Z8V-X?rOfxgcs*jUWp zPVimc!0F_m#zs@w;AL~+nR@+uF&z8ZGjuIQL)=7}B^$pv#PpVk=6d>5%AZ-?d!DL~ zqb+ISzkr*65|WSGI}V5kUQyjv$0X6f_{R^>oExwp!k8*4a&p$S?(xA^3GoMSzg*|y ztv@NNA5v{?X4N&^bXkp2H~d5L4VAG~o=4a%BCgUg7Ja}yLj&U}FO^QU-&tiP)a%3EghByAmR~k=Xo0K! z_O*?(RC24mf!EQ#g?Bno-NwEM<~;tTA-dQCOt$KX^!O5QU+31-AAL+>`}L_ljRZOy zTkw;5=9`W6&&-|KBC4hyA!Sr@@XbAc6T|S$^F#L|)%Ru}+P_A>dU~UueGKerwvcj@Xv=bPo`5d!(B(H~ zvxIa2yR;k8(18bjR6t-d{gKK^)=`jMfeJWd(Sp|>AND`ked*A&=t78)QhA#ql%ol= zW>I`0?=>ZuyEjf79MZTv=3XBx6geX9)gVG=IWwzT%(PTDrI+wK=+EZi`A?ngK|KR- zQEH8A&wRqz^-f}y9VrZwP4p>p{yo3mwldV0?48_B!>H#Xi`+M9G_G;TM@kDRP~ zC;4aQ_lQ#G{!LWUVt8w*Gd@K#yxDVJhHVUe5@x4@;|-f2i-XBVv411>V?r=lVUOsZ zl((kdRPx4Mr!BTaU|MbX_XQEx(Z-9p{D438ct9JOok*Be-v6qZb>7in)>-7uUT3|!b)?*(LWE4bs zYuhQ`BUG5V6AHf|bVQ-y;lwQKAwY=!jj4V#DQLzbLD$5RV0yG^$7#7%%}|Ms(C)fihO2 z|0R&QlU{2li6NFIy)P<8+4%T+#yu%ik^*?M=GJ9yID`ornUeDS5 z>E|@-6;ff%(I-Q&7y}IhhDMLzT678Y@{7V~*5%;y9tGxCBos9m#_c=(mlj8Z7^4uf zm`l7hm?2@J2iz0Xp@ycWLCCF!{_l)&b~eO20mvbyLKrPTlLd^Ma9GFuRh{Z668!vN z;PE-kc_vN62_Nlu2oi*L<$qI4K=VCiZq6S)@yf)&*wT_49L2KPI+g@k&o}}gf$)If z_vnybfZl}ZXT`=st}{5wz2zI22FzaeUbu|W?H{sO+s$8}{sZZdoT3=GG;z7I3DOrh ztqrH`E*Mw3ew`mZk|Zu{f}FQk>x!c%)noPzLF277?@mxrr7>yO{faqeymg+z*)ql^ zDbBnwsXjcCM8CtYx{60`S$Vo*mEhYGTEr3>8yg!?-N5kyO9?O{9URaJm;|%(j80fJ zV-{*E&YTBzd#WbH5WE5cL&U;v{AwIbhSc`Q|C0)UhL+V`(^=O!G>dH)2j0=agyr&) zIkay7@9 zOdlIZez9xwTFmi+5c6qCa;tu9UZjz(?BH+1tU3q!9n5h`4V%;XT4_wWla)+5w;sA? z-*m1Oq;c$Gj=QhG7Fc(=qf8fbDvTzGVU!ad0J{GR7cUY}F3^Dq^V@#a@|ZmsZXOd5 zxR^Wp@{9T8^mID@FElfRr+obooXQZ4A-^LSBv>_50EP!fVYf^=0lQ+M`~~o7uv~(m z->>1RnqrJZaMp+`ylY25(Y7++QP{`*1VejgPy=+cugHVyPnf?0orRY67iAwIAMCL^ zw3`y+CP={usV!LC&X{BpWV=tFp325%a6IVg>~y|3yvbt1eJ%#+3l{k6r($`{NhZ8( zF{CFw);VwwC-{S*p(42vn-0L2M<0GF~CbpOC!d)Hef^ZNA; zF~T5G+D7V0Sy`F#VL2mXXhvSXjQQ(!^|h*BRo&s9EX!wBW@z6ofRPJ&w_enKVjpsA znh349b-bsxb|>qi`P`?Kq-?XkA3r=g%@j318(npFar2*Dv#8(0o6E^A zB8=SOH1&ze~nniLimBIl&bm{dDPN?to#!x_0*DDFn_9|J>$%e&~! za!Hn~*%b%RzQ-S(Z^>4?;dASIvvKH8Z?WG?q5QlTzmD?JV&aSUh8QNsoReVxSFv2? z%L@PA)W}MqRSmHXH+;{?T^K`OAdZS_1LM;Kta$*>B@CxX;8AD_KP$`opp;CzwyUy3 z$&$S&ya6U78$69*s;60^A^=X%UQe=0z70+{a2fS*i0CpIPgjaf;T20~Kfyq?ZLMe2 zWn+BlkJ=L*5n=C@(@YI>U&A;Xw~#b1jkW8??pB%%SEI)pI^C1i6Ix>T$bDfyDvr|9 zcz|=FVq&*a;ryUC{{zGt88*lW`(4!FLWg#Ka>I!9g~jmPsZHIPV~m0SDR;#Dv;9u5 zSTazK`EjyXs7QC=Y+-VH_ve#IbZ)IY&c9oPdx~UEoQNc5tYB-2GnbFFRWgY`=^3cd zHrtSlpZAb{Zo|&a5?0hNTq@CA_(=5bcF`Mb{w=;A=mgk90bW4(V2pC+S)$+a^$ztOPle0pL1Ru1jE! zjsTA{3EXwzojwCHpl?>l^nqV zJ2n089D6BPFIl-2O+c`fm6b7~CD_IwVgbDoG6*kt^&p^?@4B;1R0n0)b z=Ge%3L;|@Y2pzH}qCavM8ed|~6zHKr&8It>p2Vth6WpZLnM&_oGoJ0>ES_ZLK7QQc zBdZvUk02w#gVVXU9QB;~iUQr>i6YVPSThM&Fw_q{hXq4UsTiMiUnNpH_u+a_+w_im z$aThag_cOun+Xd#9+?^akKB{}SyuCq!qN|=gZ&;i?p1z|u67-f47Q|sRK~E@V(V%C zg0s8kKrP304aIv6`gbg}XdmuBr*(sgc~$NMJLyWS)pHqJFTQdtrU!`2<7s#$U~c;6 zcJ=Vc(^9s$#O(6TPv74@m-zZ1d{=9*CF*5n=10o{f=&h@?@(PZWa$tkl1OCB0>dqO z&1a%GcOi8ip<3yeh*y*3w$SUMvk`9_0ok2yw;E>2^+Sm7>sPV(7Ld$pzmUoIOFWN#G1guW7ayPj2muuR}HVHM8} z>)LyiC7V+jZ_D794$INt)R&%@zs;sfz4>-Wf`yIB=g3->BbjJtuNq4*g+^>E*t1H9D+$wnQRj;*wv=a0Go#papa^8#Wij;&|+mR3N zJ;WyGoE@G=(_Hzm@E`TI+dezuPgW;AblZmMAL<4idT==LfrU9-JRl|od-FDuU_5&FdWa(D+2C^8x6L@ zft|0cre=ZhuDOK;L72zv7z{U}$^q38rwcmJY@^DJN5>;6t1lSd0sjx0v9-m`jsAtr z*U)A-curn}C#}!lzb>ejw-Vdw94eN%2^uCm640}uzYt*##%m<4t*t$5yP%1co zM`#i7gqfg0h9AkSE67Ve_HT$`4zZcTMH)X_WiC34y)A6f&5B28u{dDRMS8)D4dU$+ zwq4|1CI&lHAME#en&9$y$J(sP)!hXz(>kUj-^A}p(~}c*ihDFz<|=Y8`=vh1o)U@e z%3IEc1w4CD%Nr!+#X-A8L#N7ykw;&y(`LV$$Hn*RZ|Qb?)ioXRu9W>CbcZ_jZQeF! z5vFY-Od^dJI<`3*-Sg!Cq_phrd6~ozsQJN?K11ALl!aAEptRt!$pHuMzOc1VE>niy z>$k|3VxR_s{~m-1J;8Qt9^v5P@d>tS--2`Ry#S34=Mg$myF%z(G zAiKbhJ}?r7VBm`46SeIvAHsn_QT|A zHavOlA)yG7+%wbl<%=e^|9-MWZ+Gk%@e}ys2w!t_l~5*j?I}Q8l!UcBkWoN2jxne= zxv0ny8XZuB058};>1yx^7`l0~flNkP`gyw)k8l){5gfu< zs17kZC)WkDFdaJdv&Sm=e{VG_>*BtaZ=jUmS5^G+Jq}7bN;krg1N^7^g@xiM8mmww zqOUQ<%Y!^XFwsETSA-B2ebFA4oED4Z!@Rs@-@N1AaTEv$NR^+USsMCSc*ycHrK$dO z$Xx9)f2N}hdX^jgQ$wZKNNx}R@E?+$_y~uDuPxh3qrYa9Rc#E-noPfPx|AS$%j-$c zkw437;~tw|h5LUbM*fl0)0FC*9`ao|G%g|XYImZwU_g(xQjC>;cD#I)xy}b`R@;|U zXLxh8o>~sek)#@Kk(2-AGX}66-WEqS7@&ID-1?zel!VXWGEH{b-7_sNn%9rXT+!20 zM)3viz%Z5(8bj}k1w#I4)G+=78}02|2|PFy7gl)gNOxcpW97>}f{KNFgzaUB3&L8} zBCLBmVPnu@N#r%KGEn$|PX02p2`oZvmWHVP4_x3U6sNl}Bm}+!su@8i!q0;NG`WEK z(?R7B%KYxbr8sGr)}u8flz*Sj-9u8tGsCbEG(%j*a<7TtXEqOP2C9)FHWpT4%+XL5M*tBce=SnVw_*{O2djJ`&xv(+Os z5rU3pqFk3B+da!YxHXcTkTA(MpIH3poiu&&wUkQ0+Gwoz9RCEFx5rH0| zAAz3h*s(o|nuNIlQTHD&`?C#fIJ85ZSowK`iZ>u-zU|&aRmh4_w7>uWQg%YHQy+Eg z8ivj75B(?b*9p=a_-nuVJ%taYflUMk7934*rv?e4)&lJ$h+56jm1`CRq(S6Xa1b}{ z6UHOp9r5Vj73UGArTX*f&VUu9>jO3!)25`{6)Vt0`-_s!HcqvpY^P+vcr#bS$txZjlo zOH;kp*Gzj}F^1y#MLj<>cT9&~n2AERf?P#&aQnmav%?%QCtq_$f6IR~mpP(r6|vQP zWH>Cg;Mb%2#~*iFSN`C@2e2=`+d=bmYp8g5qE6=zi#A3EhL*SqZyC1#M*zmgQo_6e zu3>my*p?0~0hcgH$!wd6zSuS>ZBQl>Sqjk!2Oj+>`detU;nPz;a1-cvs0EW=6j+VW zToBAER@PyFy%;s%+#k?d*?xZuS~F0~!6?kWcthWI*!olJHPEfmf4sj$=ot~Qxda4g zAp3$lx$AJ~`K6Wa%2vsW**$Df!gDHP11RjwKODaEqiU+SzZI2c@=Z??2^u=|b=Y&F zhDDQTuyNPvl*4dmU|7&&m!6dsh{7qc*)s16fH*7?g@w$585B4KR)PPSbvf5m_z)tu z0(~t-wVEcqfvYR(2Skydi>t~PFS1B#-vFtSXz-WTH>4Q+b-(QM&avs%`4Qg8>$BfS z8X)s{km#1w_6C$&;jO$rp$}_&gqwacp0=Da^e;HQpN-j%Q;w;ulbQRAU_Q5ld(b0| z+>0aLWfEteH!J8ieRh-9O>H=urM+Cq?&{{zd_lTsi*u$~dM1D91%@}?94Y~a}`l1K!N=Es<9#{7@2ob`su zX%}e#*h4r4?nO_aRe|;->EUet_bJE_yw--;p$P%$V*pHCP|iiMO%R)fQE-31Q9Rpm z@%ZfejCXQS&~6aU+d%bLBHkkbzF1hiFnl`!9_%O~JCj>!4*}VJeRUD;0cUZF@&zZ^ zn(@n!6$mZ~sGr16Gkolhjt)e1*y(WDy~9bw+z$a{RD3x7*`KT4hr{@tt^Q3&P1bK? z6xRGdJbec^*X!SZLxohbL$Y^eWhBZBkyK{L9w`!%QKZZ$JF+rD5*d}O%HEPB6h)#W zD@nrtb$5Qx|GBPnUFZCsb1L8O=X2lh_iJh!FCOH7P&vSq-7PRT{p~)R-PMGe^doCq zB($lxYERXtw_ZuMTmO`CKrAB1M_fr2JNeSpVENXav9<}*>I|t5=jK+=YWcQ;?t~}? zhaAipPY38*Bz2f^g^__0LV0C92HbY|lUU2rnf$4!x9SRH-%L#%J*#8O{oC#O!~dTP zpmKa=p+V(u^{S{rS6w4hyQpRV)IxWEf7rle!3!CO@*oY)3Lrpwuzq3ShI16<8@KvS zo-#23ierOI6#yv8<0Y*dhP74ZBEtn(_NS$L$viZe$WjilscPo#{Y2|3!5v}Mf`mV#h?FT%6B&WU+zfHR#YBx?|_cjK# zuE+19cmKKjwTW+_HTGZV9q#Vvn}2tOs-k|$;8(g(VfoP;8tP$J$2yk;c3;`cbDaBE zdhWVftF0Ruu3WY}Yw~-ylE3XUrkkc)2BY;h^8CFwzl&ccAySah`)bjCJCFk;ZHRcr z{1$KfeS+N_a9A*m43Las(ueg9;Ov#>yU;`Q13{>bc*El2)C3u?awaJp61g(FS- z(WCR`wnAP9I2hC{yE543+P<*;=l4TGzUB^DbtT?`Wc4u1AHV&9CS={a7eUplBV$#p zb@~v8N?R&5P80lL@H=8cvn!EvY?*|14nq%?+p%Zu(yE-TmUU;6-!Du;=ct}ZrPi#& zPY*yIQ;%0iFP*-AsPK%q8`fJ%xEwz?rcbvZ|`fTJHy*se`S+JxIQaTiOO;S36xQ<0P1x)ym$`*4OR07yGccbaTL6 z`%ismrSa7ffiUK4QbfYTzBMK-trL)joX0l?Vs=(g*r^!}4*LrZo|A}WysvvX3_ZT* zVW!5P25+7flyH?uqQPUAiUWp3twFLl|KAu#3u`TPGo+(Lx@ePVU zCu{s}3)2~i2VY{XpIn+5-mw~r|ns);M2&Qm^DgL+!o3^!q-Wj4tCwo6>|UM zhR05KP9GOo6BqTp-d4^|n#rUniQic}Vr;v}?%gRepWW5;y)J(|;Ht0Hbm57SsN0=b zF@5+_T1W59NE}BnGz>6!=HUCpPes0f|5B|HCaviZD!dF8`cSySdMO}iw3$b@V zfL?WVDM6eH=M83gFjTdqEEI@27FI&yz+nPly%S#tNgTm&hRF}u`B0P++8fN0XAln=U@Y%1res}QQ;2Z@D zMOw^=%H}hCotPd4QXVXB+aRu%A@nX-U#f`z+?BJ=l2@-rwzbYHRX_Ihu3g@ou)lil zE$vt7s2;CoM(zq&ZHwEE^6rznVc*F}U587VP-0usFdZkwImJ0fb_-gEu&P{ER0CIp~ghM$o!q+ z<^Z`lai@Y;HrGM|j!@ooG-L>jjb*^irpV#-c{?O2&rqktbYlaoW6-cZ{cw>DI0;oo z5b9z9sR@Rm=4kT?ERlde-aU3=#>?n^_6o{>#!MY6Zw{^edP>}}FG6msS6mTed83lX zI)nxg;0iEu1MnVK4(w+O>pRO~c+PhZ8vH_4qaRcYg!>+RX>tCw<^4x=BjHa&=T@HV z_|`}9hjuHE=Iih)LHW7Yv%YTWs~>^7vnl_LMemua5!#bzsCkHdM=!)Ko;iAwKSfMo1;RIWTpLw*INki8~u(n+O+O z??jK|eq^=$op`vmuz{-Ae_+ssgaAyLx|leA2uZR=*x1|0#K#BqoWaU>{KN^54_ps} zQka5WTwEH@JcjKFy3)@8DfW-St`r#`pH2T~WJVT;eol8N9Db7*-H@r%k*e@uVYj?I z8|Fn~A&0gb5FRARXzTW<)uv}m(FOXRn|H@u)zCN|TOmm-is5EXqTt!^woPs{0V^to zv;CRul1dge_qzGRu$uDHaVaQV?s%pXgGMZPt5+7L4VNTxhFJVTHrqJd({ z5QG=xuW0!Ugrn&^a5Y#H|I2K`CawbA?2k3rXvs@L9yyXBCdLA96yl2JT0{!RE!%aH zq`P2SI`{NL1L&4Un2vSb+$1pbkLN{P*BCJ)eBEP5%%t)PDS_E&%Xv-dbd1;A>#%x1O$0w`p5=s zjTN3`7-6h*kU~y=4FL%DrywK)@((qno#Hni!_W?23U*a^^l^2hfX^*1E(Y|r9tRN4 zHY_$EvOYuA01yVYc-+%qSSMTp;OX?o_eOA5m=wYKAjA-x1hj4PKSdMerz+hVsD@(d z-R+-rFlqC5$6lfm+9;VM*)kSuEq%MwUW%0u!9eF_5za+%?IjiSbMR>?+qpd<=!Svk z{rmSjnmXolYBD;{{1Fz_LWXBs>koCLU+-!7Q6zepB#=I4@5G5VOGL$}Vt zCckjVs))Dl5z7AN+v_GTPBd(fJQN0ow%c!4RXXkg;ZJ|?eOPDhQTKULuzNsaaG!eK6Yc#j9T2=c$5rm{8HNN;oQ>u#NvZ!lHKU z5&x>w>ty|-&z)6`|WmTK2iJP#Trtn4I}Eb&b|=m4H&C2yy62|Jw75L-&1Y(t&V8l(OHxvJM(Kltf^g{HtEw_9tl^?mUdMMI1_d$;gK(aG zrLt`XKF?VaD-DejI+uQ!4OIEafRF>`4IqFRL~(s#M#M+_65{jU{k_%dcszG4y=yEx z{|PA+SBX&*b=WazX%E-nt--YO3@SuWZy)jKV|(J()^6uhPbp-~>Do9a==j}_eaFWY+YXACU(z3GJO0toG1j}@ zqAlsFHaee8tLtYqJ9?nApi#(^y6}~gvsK<-_=LjY_8w-m=w?n(6sdTu8 zY$PD!fUJ6fbJM!DX61IJhAk8G-#*o0yuu=eGY|$d7#ggK#@}l{G)1!xGFCkB|~WPMNdz}YvMiC$&DJn@GQC@ z_LZrUszqk2!tQ8MKW&_wAWH$#ZwNo%0bqt0F6eKvO@>~OWyhfiGdpwvup>+p2ez*7 zFg=#Ss{G#Z*JOMr!57G6P7!&61XgpDVZY5cu7w-t1%O)wX`n_d0cGd`m|TGA;Uuy{ z7AbMbVlbc0@%xjrf6^9kCjRMLr;dc&&IT4c^~{-g%?tEb)y2|We6y33RD)h|3hZxt zuN?8yI5_N3_Q%G|?7M9hdC|SWVg6<;T&5fKTg&cvWpG+ZQD&LYO&vKBknkW9?SlKK zTqJx2N-VOZ_%;o&UuctBX>?f8aJ>_%`|!w-SI_oe8tmlGxw^?<|Fd_@qX!Fh_=H~u zR-Zbhf)E4(AL9?|ox6e)HwPvn-DjOGEgAnsrgBn3Gl}?DfONps=kOq%fGvd04j>mM zf9xIb01({V zn25-R#C_oMz@=3#Ypbrl5t|3R^>jDt-HY1cDg&2D$b1YW$oGL=+dcI@%riK?@Wxp_ zHfe5Yxg!%q`ama~I~u1SP}9`?wWhGMHRfmEiYFmPtI|YY9~%}@_|@loVNfO!nZJI0 z+hfaS!74Mh_jah7wWE zD*T!nC{Wkmg2X~1n6V~K)aUP*uBYZ7StU-+4-@??=tU8WwN9c`-SFc_rN8jI9+vfaKw?(XkwJl#qq*f}J zditdW>|%6p-Z#!^aGax_y|o~!tpCZ~@Org>c&lAPac)WWrgsRh#@Z$0soL}mvv)_w zQ6ez`$=HZ9O;AWE9oRb2Xds5%4Qm3nD};>^>m|%r)}SSjbqKRCxEmz@AWTSLb!OM9 z5(?y;6NJLxT7=SR+~o&AJeZkrt=6A%sS50!xOexi|Iq5n0{q>_PMvCnEUT5=`w-n5 z!ymLdyLYw5Z@F-laCVS7YT^-jjzmgwDM6+YlFfEis=T;(RgJd5~n7XaZeG`&}nsXX}7_wERdkEkwW$2IL!4rnL4DtP9xUSW(#C&{1BgVdjm0ebD&lvVr)lm&OwRL_ z3K+&=Var=t0K1F&!dGb(BACMUqsxfWLez?LlbNA(Gm{Pl2(I2KMefB~%t@H7s!QdGx zkga(wyKf&nq0d$N`EF#)J z<8F8?ynmNIf4=M5OMirRO}yRy_3N8ACm}ck?gn+IHQsy(9!V0{Gu&!e4$DoiK^TDF z26Uz}#toX4n(G8nH#{!;%9rkmT3+_QbfNB`-B%E_CqT|#<>slzktHhM%+BP z{*_jwBPK+mU{16z7A=8m3PB1;pn@!I!hD73i6MkV=ylopiVqza=Ah9aWb?6OWQ_rU z+)K%zw*Bcqd#B%u8;)s&)_jE8DjiPAv3`d?8etiTU(nFesmI9mS3+l75wdkL6}$cY zJ>zAa(C!%$lCLYGl4{Q`sjnYpE9a<1PZe-iARScs#e#~tO%bm4z zuv2=94Sm4%s5bS8+$3#{w^y9@ZlKrH>Y}FKYf>80*4CEwy7;w)ctWoGXX|}!h0|I} zc~K|KwjVll{N&)dZF7dFBrlz}&1h7mz5Bv(*jJY!r{|DVfdp-AS;e<6>cx0yM@KPg z;Ef{j5o9BQNT@2G5EppZG4%on#R7p#3KOCGhv(1%0zw;y4+A?{bhNUU*RzgRd=LOl zI&eAS8o*~uL}8e>AjBi_ZO|Ox5HzaxmCFz;28jnAY5uju(!$gjF45jGd!&A07f&jf ze}jZ2+-Xpi@`H&a=?OhOfk?!7_h@ZS_kDZ)fys*)7IIH#B5m}TVAcd9%!|+wH-|Bb zWRHj}XZnX}+1s!fC!Tgn%Mc_?C}3*^o9F%;)=+-ia#8-F(KmMy9;XAF{ShgcCD8#e z@A>o7h9kO6xVgZK0&vib3))K=U_O1Bn~OdoS#H;$GD65lX0%PdOYt6-8#`Ce%W5=c zB5_TDoon&wlPB0w>95l(aNH^|&iaHQPuzHP>(iar*7(gI-wPyHB}}M`o?qmc&pr*? zCyCs*sZO8#!x zm_v#7*j?8}Q?t2jsESvU+&u_4BMb31Cy0o6c&y(pT^2zOG{AK1X3;1y?ix#EY8~fKEI9>dT zpL(~?nc|JUCqvy{4&7|GNOi6K?hQei_fCUzCFkbrnmzAaDv?t)J)YZCY{Ai(Sdc56 zQ^E6d6CabD4o#r#kGzDP#pO)YQmhf0GM$evoNeCNeni2$piKbZN~ppn$Jq67)j|S! z9myT^>UK+Nr`Sqxdt$K#IR#otJ7nm-qZ=R37q`U%HcMfr#gpRpBE65T?l-T??2>&z z{h~YcK5f_7`sjAf?z>Ut0ylEma}?hNcFTIE#>{ARxtMO5>D{-Z)Mw=Su<*iOPb>DE z?CAWOz5+p~x%^Aq64Eg*CVvzKCFa$*%eNxtyRyY7Sx`zS;#p9>#MjReiyb2j+l^yP z!e%Ws`StaQ)~mYO+;1^qvx<_wKJZH{8(^dnExt0y4BjEOpSxIT0{r_pBkyRhi=f8~;Fh~hQ@?DtwGiS?=e^OFlIE63qjOW8mIC7j zN<%PRn(i??UTq<2;r+~WpSL3S(m3$|hP;U74==_4N{ zs@mvt@{4?yb4eA8b*6vj5*TCtJiLn&%ei~lHBL&zUrMwjafM|RgcK^#m%WKLDb;b7 za`C8?#%-4&=$*tFMwxf#?$*6w+@{@j5{W-)-;6)$vb;Bu;(2b|k$cQ+;Nm0;Wq`rM z(ag^*RXRJwwbm$Hb#kA*#m}4(aW%hYP)k6qpfAz0e?g-A*vY_>K|4J4etX^{LYasL zP_EQqojvd9K9KNC;-%chl4lu0ubmn(a+{lTAl;CKo=>BJc41xi*5!eC+eGk_{C_3U zt@7qg>?@{FRXPfXYcI(SN7aa>25=gEKd4!t5?!ktK#R_w7yHDr`>i4?{tcuxE>A&= zDxPr>|74xV2rW&xG3CU>1U*MG?!N26>iYVC8Rh`ytNA^KBS=8%xceT~O1l4UQ_R zxTp=Vj!t^NKM`C%e~_nzSjHMzp)h58dwb~zX$0F>xbg;?|ocP*QO zEkQVIjb{%e*J6fPRgpe>l;!q6*6w_b*VD1UsLbsYul%n3nRR6i9+ukDxH#{1u zWw?J-DLM^dI21{My8bLTSh<4mpbD<}v#idohrbO~K(ARQJu?7V+Q#HMyR(-*(WpY z6EvnEPv{g6ve5A7ixi9E(V0IZA(mmC`%ol+^H`M0A(K}jPdzD>Xt6gD#W?=$V%S{( z&NbjK*!<}Ma}$Lf;^eTRY{dXcF5`ixF7{YI5i3Cg14s%<+EXL}K+Ac*pdcIhd0-V| z;B@)YobuA@&%trD?AK!_M^Dd%GM`uDa~3w2cP=mEmy0lVVPj>bd&~GQc1hc4 z6}NL$l>%afD{ec)$*c3A;iD815a2uXH{rM;kMh4)$^-U_@FGJiyUJc00e7PW2zS)cbnyr}M=RGaYPI zcOwkf4SV;N|0;7@k{k3I(Y$6lAU(J|c$TJtEoNqrrO?wabD%-K(?Tr#*~;TTZryT6 z>339w-hA2qrR9=K5Bd9!xKQ7*rxylQt2?`TZwb4y27GAx7NNjQf7x8h;f~43S32{l z{h7B0j2s$2J>m(cE>iSSwefMJR^NU_Z*1h3#Ck8|qqGNG{_dPwlH9R{Vt9HuaE;tn zo-k@k?&6FLK^_in#Yj>AJ z{&;;0PP>ec#oT@c>db5cBpzSSf5f<0`-c(F5V#$1_ee{; zZ3R2jF~Qhl*+@u3n7jMY+oG+=L%sgp<>5K^#m9)Xx^m@;GM$znLk1#M7Ft3xG(gqj z=x&(22za{;Mz#cT78g@z=`ZwVE`tcyT)qN1bMnV#Nbo$>qIRM7AKt<3z}ubj6^*z4TRC8pZlSv+Mg-RlKAQTM%0~o?x#x^#cJ?YbU%F(p z&80l6+IFDb10#YzZSs67#@T8v`=?HuxZ z=?tUSc5~zR+#qW4%W`{otcjaARkz6Z?+Z(W8Uho9EGBehJUrscZggfO;sKYclI^)v z#tKI(^~8-HEB8hI>Z#1_@7O5Cal3Pj^qhgsLX;K}gO##!qA0Jc_o(U4(-sDL3|Op5 z;}Wn|aPw#T6_?asg?a0$zPP-nR57zl5Om@Qv5mo7I}8}0T;M)&pdB?K-P?NTmNjZ=yy_V8dz6Cr>3bqe)nz zjEv{;9?6;u;oXCF$7$@Ovnq1#?Zxm&cD@6#xSQbfg9(L2M*H>9&@Jreb|oJo?^fM! zYFJDa6n=D}tG#4jVZHl+Eskm<(V*_H+QK^}BPQ@5emS{O$%6NQ{0_hgW&^Imso5~c z0p;}XIa6;}0v{2ojJ852X7UShnYkCf@Z7hKNW$=nQw&?OB@`atzn{g16_(K!cD-S| zF3xG7P=KN!PZ+-w0aNzn41p$J`Qow?1R{pOLD#k^HeoGYMA*wE#7hEk-&rfU{t{w+ z$zPz@5eZ8Ck~xa=Lf{HW#>RiS#j^-yyMvwTJdAZPfxy=&qq7kyGeqGFbP$XMBE>%; zg-(iO34^?c(kvP+7(^P@t$VN?Fg}((H1N>_SLv_PXYXemdnQTxP}=cs!HrHJ|z02Ti*n?fhCGpk7& zLx$QfIg_@MtqlMaK;n66q{$tj;w!lR&|e-?=t>I^a^o7>Y4# z?luG_Sno5ZxWVoL73(>CTC4`6hofc ze-KbGiCOEEdQW-hG^6?x9c&`H*6|PmzhBbat_L(kX$wXX&g(>r`ll5 zngU1zHZ;Vq&1VUKUiyka%fGd7|c5OBTL#>6zO9S+gN zHb_g$ucM$mN2%#>+dImn%D}K^YMWjlE7h^h=TfGVN36?Fwql0)Q)sF;eF<@daE>Xa9K=hmn`@5GOu*Qk99P7W*x>0tO7v0B7kbDZt2M zF@iaog`M37o4hZ&MZkSSi-rEq^o$JU-q9l(8Xre)9n1!Aiz|zG4j@H`)gE*`DGp`Y zW7-62pbp*^jQS*u6>bUbXP(3SuOzwY>F98L^9TurlH-_?f&}-^%*3nstwO@8KGyE+j# z3i@F*_~2hI9Gc`_fN_JAf{e zb~XJiplklMpEwc6oEOfdBgMdCm~Q#7%mqLn4ok_F`*Uyt0X^ zA#}%jjPiv2Th6}s*y)ehH-CUHFxwHk0>$hYuOZ~SC44j>&_?DK;g%A>*@R(`{H&dw zhxHhssDOEx8$RLHKZUDE&ICLTAvv@N8>~9tC*Hrz6&;_AEx;2@KE6M0wfKYBf4cCO*xCPB*=U2A^Gi0Or(Vb zB;(Wf7dD56hL)fIV#Mc>O`Rb~$IQ&EpTxff>MnqOU#-V=ptHLfTbrQ==Toh1V0{e@hCE6 zK)ra4(09qQt^uDv+x!cx*Q6t|2&B=%>_&7vI0^v?ecS~;P*Yo*v@XIHQH@kv*tNuy z+M&=pofx~4AU^8{iwz`sn0_Xx>rY&D*t$hEhNDHJ?d^2WJndJbu5c2qic`rhys2P^ zT~rNcNLIqI*o~-QNzAzzo4}>u|BHJ!@fe$(@F(;bqokk~=Nf1bP)cwvhwy6tvD*X4 zWz-jXA8kPSz~qs|jE*x8o;H+l-@Y9Tl@MaKYtB6Wc7qfh6U^D@k;U5o)rsK6w3bMO zf}s5Ap{0eBDzw*gFCWa2kQY-_OoilWoUaSh2Lcqfd$pfr?5|wbICJT%+_jgqZ^vMl z&@1X=qQJZ-F>0I$$qeTA+xUr4h$9DgKln`iA-@e?LScAb)(}xXA&nNYOwfMh4~th5 zvCc%2fR`DVccP372LPhIev7TJB8mI0_!3&qHWBK3_|ITSP>JUKAV{Ycg&L_6L>)r! zj|Ho)vC$0zo(XS9tUBZ$Iu#aBAxRE^3>}%2)bEcHPtz}*(2qmS!_iYb&cpotZ0Jlt zXm#r-wMYuxmg(lTH_e6<^!u1p-OoYG35}s~JPJ~|<>h_COwe(trYFO{n`twuta*im zG!Jft$md@0K`9A8pq8$#uAqTw>FKYb{Tb#7`~h(P{Jb7;{W=Ax6zKCwJ0pA}@B%^; zJ_dPK18V(X>i<@;h}I2RVTqHgMtFyyG{H;r%|m_yY2io?`#r@)DXN(od|>N(`8yd@ zCnE4L;)NvV2-0&gArW%`q*g$6-(Oz%K)g8{HrI>^LQZ09JDR%$vg&y)6%|!^y5wOn=7y_kYtz7dv_<~nXjKMPCXM8+MtTqS;H0w9B4l>|jQ#2$(WacI zt^0yeyiq%v7hfd;2;jU(mUGK^ExB{oE?w7|o)`{DuGDw3wcbdH5;y%OBrSbWn{P2{ zb4`;lCC`b8x!Ku<-tnXaiMqPFVYH#rhv)>Fe=ya?-%}q@qEpm2GtQi*3%%gKd!uRmu#@w(UUH(w|*n6q5m7aa# zpn|k+xKOsAwijc`)_LiJYhU%qkyb&&)p=U`N5$eE+nu<7#>@SauOXp6I{Jc2xjg1U zFf;cj|2|zT+B`iIX{afRj{OB>#>FVm%aShFQ=lq+aqaq{k z2H!T@(_5B?1L~D==i0-U-_2kWF*LlL8p5>u6~)Pc{{HOwXV4>o$HBRSi-!^F)H-PE zKHJ9fh60`q8LR8_fAZuB)k78fm$|ze-FI7c8JHgi9~|B<=7K`qlU_Ha+W2+SG%WDR z;8REt6Q*7_v++nByJSvxGxP!eNBwu{vNg7pYiVjGdT+SAmL?`yDv4#+5vxi@{uiA| zusL%lI!e>p$Gbbz@~rAKoG72rau_*RITuxL#f1=WJp4mbkQw=CcYf_j?HTpFnHT3M zkqBa0Pey<`;E<`Q>6^H>*FFu&3kcZ16)+4B#B6-<%IK*G`Pq=7StWmcXzT(N+3StP1E4h&?X_dl%ou4I~FR=NhIQ7$LELs_OI?Ymy9zw zi$$MVFf?j2)aNp8ds`foxg~&8b#lK{O0!(oWBszwq~G-53wg%*b5+0m=yksuu0B$x zz!JbIhLhw@QW7S7US3|#u;J3s?aZuY6#ru ztLGoO=(H>s1OauxB_$%_q?IPwhnEIaLiFw1%z9j=eY$ z1cimIAV)hr4GKd;OY1dr?fn4GLqQ%Fet^X}nnVA5sL<(`+O@xHY24cWc>CZk=IXOc zD!TZf_mj&o8RyC@cEMn2ITgm6cweb`t=Ce&CZ&{aUSzWqN(`6 zZi+WW65le`(vO~?T$ezxohQm%#&!MS5vu0maFnL!!nEf}eGlc~LSf-wcYU;P_PNgn@ozTK>2%0izk_BY zL?-s7+^wo)06aIDDqbsk$4dndF{WsItzNKjVHdIV4Tb9jmT3sIGK!1olxT5tVpZ;f zx&v}9G{J&YOx?tB$shDP9t|XJ;H<{19t@lbMp#ItzkSQ7tTfdfK?&su(d#oX-~s)s zM?Xvot{fe?Bqd{DFNDa8w5kBLh>eerPD{Hb7)F$MH8sju#xzY#?hG2h*N+wzsNua+ z4xyM0V*!3{;QQk{{Q9%91*uU`1WkE7e%a&Z=8BG&IU-D{SyB%P45$3OzK;FER=2jd z+41J90Y_f(BRNihp`}|n;m}FC8<{)1_6r={B$cTx*~TqiuBIA4@P+3=rkq{Z{*HZ9 zpUyTQQ%VC@$lT4)j3(fM_!AKQbIjl>*pj~k&zITuR{!Qk05YT!T|Uk9&@lo;#(Bu$ zJ)RyirI0c;mi4!IC9>tE^se9m-vpYjk|P^59)W)^Tw8dyXFIHzH-D?#Nj zRtD1CMzU}~2SV@|9TyjfO$S$L+j+0~9z)_l2YhX~dlh2&ItYQG8~<|ewmB(Px4<$> zf(;;1AX_1uOC_Y{L^cRnZxJMumF9c*+}>Q++jFA(JQZdsQ0%R6>#2aT5=kBvD3M1WYNAESIebSp1UZ**UIXi^z#DFq{o z`FkE?-VGEN9y-d%*~zQ{YwhCFdn7($(?K-x;6VEe(BNr-5M}MGu!)AZaDU(X_cSyo zq)62jnGc8*`T6S7^SM70g%DhGS5E=9CL!gJWOW~Bv^`E!a`PqaxjmtU1&_B=MiiDj zR=dovS-x)CYW`mMBg)>raHKLVz1Lx zm}kHSg2fw8oVwSE(oRV9^!0J*Z6!=D9&7l}P4_TkC&DWQ7E9Z}z~EiY0D776yp!xo z((^=1ftL-_I;135F;!bxS-pca4(VG^48!QD47E!%uil9hD)5Cs?Lwq5M0KLC--ik> zoRoGDPhkiUWBCmH)dDlA_lIsce%96|KLhrM$~C`ku_VsnEe21r^(}5bGRS5c#4!EO zrFQyF{Nl6FB$iN+8Zg|zxd^yvcih@q_L9rXIaESgEREm!3vLp%AmZpCkAwvXm=11J zCFF^M;sL~g>bY5hZl*Hh0CCvzMkk_m%FJVi7)DIbJ_0Q1} zEaozJV9;;%GJZ*bymdrR+;=n%vb#Ice|aeyAoE^?AV5PXfGxEO2^NUSfcvh2VsLhXupGfC`n#43CE(E+m>PIZO zb{MUcXbI|oKhhtQeRPCi@_g^Q2}lT(^(g;)nWz7NB+L^67|qtiuSVQ@M4d}8yMzQ5 z_{i##T&kO~hjrpY@wgN!lPu69Y2!cX?=40SZ3SBudI? z{eB1gvGkk{;DmAsZ#vFD1#*)7YiCDRB0fU0mR?hcn#nl zTZG1R)4fh+sMV$oTD?Ib$J3IkN{{sjk@t9U@u?FVzO60lYA~Af;)%wy4&4}FIH)=R z?W7+QJiCS&h3)_dfm_deTcr8UQlaV&=_iUSzpcTg;LnbUnKO=}hZ{ zKvzvqFUq_c!m4XTpm9TlM!*=3n{8>GhvB^=k0Y!WnWoMC&-pYnpzVXYlBADJ&ou5T zv3R+Tly(8R$8DCK%@4T7!zHKL=5>`bfJg7#i^X@pGOMvc4q=`vLw9L(&8CzsbvqvB z>+bZM`A}Dz!XIxMcB%b8+S)KJ;VAtNO^G`6ETpOB^ROPf`X|Iz2|KKh#M~y)ZAm((Q9ySxLZGhLLC6^-z$Dbr|^ZqAPxi_r!47Z5)u@&_*4^! z55EZCBhGgO#f;+F7>PgSYzZ+v89<1}_e;CX5TFTaYHGq_p$`o-4iO>a%|!+%A8=7( zW5c&a0*pxV1YQXoN|oQ1;P^7nJ6hoaQ(o^BNW|G|yZ)|0q8F~A2DELB2b<@C3d938PpDy6wnuyW&)ZIpAmF2CQTI2VS zWK#S~uH#MHZ8WX=!WeCCMn+;MBKip+;;4xr=+-U8KZ3-&Pio{W#4L)8NOmX)P)z?H zKI$=S(2Pb8&TtxH?L2BHH=q8!4$%UnNfw!yxKHpAe?$Oa?c_xeV>lRz0H0)>{#jFv zU_kzd9Trkvit5UeblibqVY*u_Xt}Kw&!p-?(~KJp-73hZF!fyL;^2Vu?VPecHQ)?x z#Fc`tNBRnAt!9tLABJ!G$*o<%nAEnv1Nh3>$#@b8ywZABp(F^hpDcxb4&gUUGG!+JLZ z_19)S*4>R`b46f8$n{6s1tmRynBtP&_M-60ya;v%;>*G_%FD->mlF5q|Fi%za2Dx2 z>(xGXxQrX6OxQSLni-<1ja2+1*FRKDHC622X*#s)^Fuck3Y9Z;=8u~L@@sYn7M&ce zKX2>(Y)KK z13_Dq=h%LJhV)UtweXmO!(zUHf)aqmmF9&j!zQBfJ7lUiZQMx00|0sI)uZ!y?ahh~ zYo;yR-K;=$?ed*oiwPH3F+Ti@?dO9#$1<^*!47mdOT>d-#+3(2AcRkam~^5#2}lSD zsrk?I0)-LJzI`5lJCEB|50zbu%$WZ0y7Rq5cg{{I*2ofr6y|fUl^{lf-+Rmt)?ldB zLG+OdG5A=sj=B(IFs@~27=o5LOy;*kZ!Z{zxeentd{DS3VaDL+-*}@wp!O43N&LiE zo=_IzGbXid<;4sCqf_FiO-4$W!rNZ;RQiNvT%V7z^TiDHX>N-lMOV01#A|wH=3u0h z#@m{i`eZddG4M1#wZ#9;RskKKIM1t{*S(A_OjZ-JtFG+dXlRq5H@bFHjeQA2lA#m?xMm!mbYvDY0PD2GR0j;wvasKR+D zxsN8DmWAdnpE65CZ0Qq;@i{Jc_sGb2X}8iQM#oRrsL4j!s_%KWx4c(nEEr?u{* z>wF&1?&MJr;_2McS}PH6cQZR@{q4ACF2fCoKVGXg+~R3>0A~u`<5!rU@lxYc1zz%i zNvii^eN55%+YE7rx?7Ilv9zpD9{-g6q3);3sbhsX%i|X-`{mSHI{>7z&DkCqbBJO1*{)(na~9@weQ%> zx;oV|J%34N09g9%QI@_Sk>2LM(knX8EbVBy3>eBJCW}UEHc%*8n8yk+!_O;g{{r0Wa-2U;TejF}JRlPbut_VH?GY+$ARu(TPYNiIPM9-W^BL0={8lPE^peiB8RZMP47S->A7ub8xOnfz;;7KJ_M?uo zmFEo)=>@eah8*Uz@XhL

Pon|G8!D2v1-qQ*O(&7-L7@;bk2?u9u=0P8+k&ov`m! zK8q_vSUBubhThe?tlYWU;gzWg38ZTrNDt;DSSWG7;bOfhk7oG2dox}i&7-z2Uw?K_ zIM-W;kE%I->NF*ANr-W1m%eb2Qs>*g^OZtzOxGB;b!o9_>(5}Q)!z64ryt%#0Kqya?A0|nT!VyMA~S(E*VGj&Oqg29>YI_v}_o~ z|Mgsbn6O1+IK!^O!a{Ur4qDEAY5yaxruPnp=UWK6CB_fT{E1y{fA6>W@7yeDm!LLK zcmJipecyLU*suT~Be|_63?2*A2 z4aiuKJ16Hg%L~|zTsJD+$Gb=7d~9DJ5ql5^;@cCa`$&qVu4tDkt(};y$5IaZ)R9mj0ULB7Pm$ z5nfoaP84RerTvQ+9mz{o2Ue`CybdtMm$|gn1L#vFf!?Q19l?&IdtipbrD~oDYm7Cp z1Pr-Atx4V&hI9f(S5DV#Cgx(2(Tgf_bcP}0@B4=eW^CVp!blP$mNil=cA}qItjd~i z{|O#@S|#IqZen#+wzV@~1$DkHW-5CpN3DGx-pXt?OKEs5Lzt%dis-ipuVhf$Ywxnz z6WqhYgGBd%wZM`v@;bGgpp79$wO9B`g^5h2R>+dlMn3x=d; z-yV}ig@i(51;f}0C+a^395Rv@Q9pVZcZv#{GhL8X&<6t|i9-ORLOzhQ{iUIpp;ptg zvMBI57*@|Ra-hc-FXO+W;mOCnq_ewIaY^)F$pBQUQomY$S~NVtjBI-M;p0H_LanJ| zKO-e}YlzCErhT>3ro>U6Yu(31xxL|JScyREDly!od!v5?g@965a-@>EN*? z8p`~m#xMF~&)-VIrHaImGSdRK@>O@07`86no!N9G3lNK)%#d#kULOJkR-+ZN2zkCv z<_jSGuVPMv_oB|lZ|M{!0jIb51nI|P2|17a#qXpwpuoJn0d=x)QsMJ&B=QEZnL(VC zAY7ovCZ70$iXYs7EJ+;rRvm2o5WqbvtIdK2>hE z7`|@$A}rCliQ*U@tT@Zm{Ou;^x+pNPy1LF#{4rJ23tmm4ft3Pv-L*i#?mu|Y-CS{J zPnS`GjLYD@0kaREMwkUQdYv(rU?g0ka#)K?2aR6p&d=L)YQ2@8ute=G3_W)9%f`s$ zWH5#o-bA<|KLQAyefbW0tL&nA7(j6_vp)_x{H>0P(CWJzq^Cj2|lNb-fO1 z>u1y(C5StX7n?R{KeiY?)+m^N-?5!!D*&(gFRpcj`_$CX^E6Z<%)VH^ZCrR|`_r$l zvo6kl*2K36KASaeEBm<{aX}8}WVG`qsTx>*G#Q0CvL`+nQ8P7V2eM`dfeW5C9DBM5 zMg_~u>d7N+P;txj=bYt@;I(PW#^r%iL#bDL+!qgI3Qi9kK1>_P7`H8{>Yakbj+t)y zxm#a~W^*7)4~d8v#cpE#GGK!*$`SzN0nz4f7mU&C>-GtVj`xvTYLS8{9J{S@DD8_`z~+a$$R;z!%H`n&POVvmQmz2D*Bq;GU5`JJ1nlgg@;&H<{Q-P`;Iq@ZhXr`GFs(Kac1zb#g)akY+OxfUTu zugvRcuPqdWQ@ z2XFSwsf(=YQq-{2r1dX=W*{l3K&zabM4+6>M^Y~!E=)>LU%;IHmAU~KXLp1kd=7{m z9Pi4+O$MnOiFnP<-iSK43_(2G5S@^AReZBR7xm1{bdYU;a~hHeW;H!fE&|Sfd=-fZ zs?uvt_R=)x8t@K4P>LP9vyBTE-0!*W&|z^(KJE0q_WZ*(mD^`*2cxfe1WcZ^%9rLh z<|%o^!07#+OSIwZ(ub9I4O&tb5=-x`io%6*&hyZ2H;O4<;}veU+&&|*TxL??a!+`j zMu$TqcDi|6)p^IRdwUQUoZtG9YjS zl@C}gP0!dkwAp5O)4|_s(^h`wAewp&K*jfv=#pRdt%_-h+__5RIH>7mtG#oP5RZTH z9mFjxEa_!szgge2uhpaFE{Ky$1n?SRWbsQ&Fi&gXP>5{z&&zNG2mVU}IQP~?RvncF zBrF2&TWQ>fL{W!zC313dB^Nlh(`tw{WDGJSq`3YExElex%Z`-fY*M z7vJ5d>2i9+oW5@x-YWc=zj4CqoB-Paqqa}-{*EgH5kvMCxl|=YCM=ETv@S8lu ze+w|IHUZ-ko=#}OpmYKu`@qdFMpDN?xX+5Rr z9;(=j8)GOpx_;AEd`SBfi8zbH%+EET48p1no`2fYZ^4tmy&oz(V-gbn$siG-c@E#7 z*WZ~&=!D^l2MkG&`R9x6F26_j`ZfQr7ZroX3#%d|s1k&XG{FOW0BnzdJw$|50`mWt zTgStL6fbQ6u6Sh*AYlBuG8gH+#nlYD)!XRY=jW>l=s-ng2}$C=EFD86I2etSV9W%9 zsAVX<(6V;xGu9B9y7Q;J>%*UT@G6IeU1(l!M@vyKzdw*6ZY1T(N`{1^>4E_RUz>w8 z3(X&K3u_zDaI$){Pfi)VFCQ18J3PZyWB5w?B zO38KFoD9@x@POUd;DUd_#`Wu*jvtBaNwPI@=H4%6>rxi4Iz2!PmMJmkCWN)*^hC3=IQefdc51iqp(v#-$({y%qk;CPXCEsc?x#a zOqE#B5jzrWwv^cEtG>E`*PxNX)E5B#;hjDouWq`8zkYTCjUf`LKVyZLC!GwJqD!b{ zitjqUVk#A3?z`X6)3nON>SdSV{xDd{hOhq~Nk#fA%(15igSH0+3Y2l|90ysKi{rfe1# zPreYo)5yCj5=IwiTX|AnO)u7QDEGZ!L;oAq&HUCoS@&k=d;U34%Xfh(D?&jN)<~1XE}1!(W!`tiMt+r(6fKiRA38sGc-+yK*qSkYeh9Z&|g4n z1yI0)9xY2tF2yvLett_G_AVHgVhDzTL&@bZ);*AMmWd94Fa}VnS&y`Q&jO8{&ocr(kpR_AYn6>oCaQKEM-}!7*#d!1ulE zqMv3ophM)9>CqQ8j(kEZ6i#t-KXug9KzoFct0KSED~j{?brCGnhix*Nw+Q7h2%W+H zV;PjF?gvm1hYtvf!#flZjEMK(j|J~J<<{vz>{!@ZuqvEfkUcY4G2`npiEMyx%YTpw z5(cF`fprm4YgA$vF(~~|cVE~c1A}7q+(Xh_Anz7 z3!$8e&PP>W{Zwp)h@wNb0s%Vazpvzp+bXzq@pZk~Rheg*9d$!DTxlh({Z-Q{y$~H8 zbdO(_?>K8;Wc}lAc>u3d0qd}VejLPQkJN0l#n2%Na}x9!2=;*6>YE<#V5D$2<9RDa z`wnYR&6RqMZ5yxVU*a*IQ5P;L+?&i!1;!nhW%-L@Jn+)e7?9?lDNE8O-MN$d@FCHp z;`##vLInTNQ2Y-wvZKY}f9%AGYu#V7zz%`7o(TGgdmTR%(sjY@!Yh*n$o#)1v}=tc zJ9-S1Xw|)h)xDV`)Om=45HTbreQltC`%vo4@$C)HN0i|Y0dJv8#fggYS#?`mKH`p1@L^KZ`#IH%BucD$h!;dbk)z}N zY7KlM@wlF`b7Kz51n+}?fMQ}TA#Fx4fWU>00kwL#ij@#~L~?l<)c#XRBh~uj%q64e zSC-ohe;nIjr7FqKm3*4D{qw4W&IR#AZM}-E%X)&Vo7aV$X!?3bh!Qq<;brq3C6^vc z`6neDP1v$-qtXkhtFn*3cqMj39>SY~@@`^7YkR(=taNifTc}L^d7p;Yj!wPWwNnew zN4uLFL$N{JwuUb(#Lgp+iVSL)?Q-!2AgBzF8mR$?eiRpF=C_w`dwY?gjQbCZ*Jc39 zSeZ!;Iv5i5uJB-Ro&wfY3}S$vLH{&c4mdrTOB z8wPDdEmCsA(6EuDpswF`;1IY-EX5f(l`+^5jum#UualFbNbo15EI-t)*!jTP%b_|B z|0dEH7zM*>kc$Mel7s?H4YosD4tUNIXCTDG5LY8%2y4(ZR!Nu^h`CofDFXWk2-zHa z`rEOwkI+F6AeT6l@GA~uHYG_r1jHwnCZKG{3Rpz2`|0ZCNte!CPgRB>CtGvl=&$_F zR!_L|d_%d^>P7B1wK&ZGDPovB%yC0J)JQ;S{IwOW#v_*B9fMcCCZ+;{HlIh4NDmSDnv$JJz3<{48A20K?Bry zIbvg9s5on2NCB!uAcr7K6dx9YZUOSHGAxX@XK*Db;LYK%EB8G=;l%bP$H9Qj!ewp+ zCa&iW@GT(EgT*1@Gzawr{1R~VLf;C~e&Aw(s0z5qz|)7K8txZ7?}!f*xMhLV`Zmb{ znJX}bKp6<|D$-|fPSt?FErfQ!sRXPo!0+FJ%Q`Gh;QGS)0m+61{0N|Iz-R@tMHmR$ zH=Vm8{0m@P&z{a4LaBHKY~Yi?*aw2-5YZJl2yy?NzI`R@VR#p3=v_(j8=G|YI7Wfv zv1j0Tx_x?XltLq=4Eq{&IIbVw9cC3Xw2Lcf)OUq=VU_|617Wb?rOU#19p|9vz>mX+ zR7B`<;FGKy1k9$DFJNINd}w)qhmh2K5)_t8Wv15lUsSf^*gVZE&E|-cV#L~h#c6p9 z^Mf+=0K`L(lar4E_29YaT}(!I9}!3PVjtDAO340?MMehKlXy3V0xyyq((Yb5zz zF;e17`G;oj@h>Xk1Yejky9y8QT%i`!lwDCtWxYnh{ckX+QpD@AX^nd_PS zm8CPXJs&DdTnv0k3^c6rOhot~?k$X={N415@=YUNaxu)NP1*2-e$?=(B6Xny0GnWt zsB+l|?YxooB#@*arVPx0A<6*}(T?yz6W~z49cbXB(fxA&^c=C5{Pp+=nFT`gKOC9( zRO#~hwoA6y(!M9~31p(2!$Aw&0#yGvzMi}aoudD|WGgFUK|uHznSw9)sAw4R6-{$_P^=bI}qcH4zAG~UX0khB22K3$K zo3UdjGI2|#sEF8SSz)`8PFB!}2`1`@Cd%iOia?{6&^vb^19lc`*MQXwPNJe~4j`Zz z62vBh_5p%T%xU0&fx>ZE^cF6jis3AWu#usELsNR%fqA)I{G+V83hbw2QbP+tP2ND< znoiaK+@2`&6~}OLbTqJ`B%%-<`(}Lj$k-S#^R9G$;4kH^jA$}2T23ZcJz8!jyqLux zk67H>t<3*jYT`y)z0F^+a14K+HXb9cUL5;(q2uFH_nnQz3JYav_gUz{0sAqUsKracAN~_sLAbj8NhiM?fyla8+MF((1JV0>` zQ$hHFLEvEn!vtcb5mp#HSTA*_1o3ISHz z?s*%y|8#mEUb=a|Zu0gehW~$@O?BBds)+aDWz}0D&+MljMn$etM6Il>U^2&S?j8fL zuk=EjTSeOQ!`GYYy3csJqW{x@aRc)Ts>ng`HiY^fK!@jkC&Mt1Di!QT?ZQZXZ@x2$ zb7XqDcVIv%VeUSNQIw3JE`;@pxWd;GVj!Wh&WVX2U4-}OhDiW))x$E)I-v3IW@Kka zA+7+xogDCc3WX%RvI)eha1tRd{|NeswB$y=q3!{V227;!;qD;rc2iRyCO2|m+W`y& z5E`H^T>5~Y3+x9#004dw_>g6QaR8`;8l>~%2tU1A{n{D=$Qlq45KYX&_Da%wAcng) z7=S;>o-cBN;k5uq48S-K+D;hf0T)b}0=Tx2YLdor6A>@J3sY~JrQlosivQBk(D3(` z+fs@!1>D)t&FueevLa+Q$lNHW&|a=y$>d??aOAEeer)qmaEAR8`gOl*!U;js^&5zUFJs;U+R^mY;wM`TV*4i7NVrAL%tJAKknX z-d5`K`_Gqm?5|)}bUGOC{1dB)-xIhN%GGkJnOqOW>Qeylfyj$A=U}JA5i!z0!kG3WIr;Ep5WTVM5$cO^vXs zpq`8kuk&o{Hoc*Kvb^-vQfgK=`>+W9ymNJHTl2#&FYv#c6M0yh?eMC<`l?_A)XTJc zQ2Qg`AfUy%_B8>p5)h3Cfb-*E1`ioqG?bKYfb16wa4r%j4jmeh3#UBSii~a&AtPGE zs{C?YHT{GzBolF20DMypOan!MfCQ@i`(XcR0by6r%p-IpWcvVa<^;1MJBv3Qw5X*K}-?0F2a0+04^A*fZIt0bldQpJ!K%I0#<52pe06> zq9EmgCeG5vh8hZG&?N#v5$x9g%YnLqckdyn@1RVqfYth{SQ6BYdaK%4%bW%4i?fd-)ziZ*;t96CD65aR@XCGJLPPak_@9)yJo z`%sCD*_-4*?bg8Y*M@VkWc<%d$WH65>o{09z(E!nP(VNkk|fY@skJ$j{Ee^JJOLL> zq#!gL2;i{k!F+BALPSIkU|gJm;9f>cjy70A~XA{z(=S)cYZP4ng4TxG*sG60j0W|U7m;qN#4k>N^qwq1>l^53knXtO}GS)YYu+V-@T+USGs)iDF$<|^zQs06erf0d5#H2 zIooxamHkh5I&#opgG2bpckV#3=V>Jh2}-*)Jb>DRsz_S-Y4N-EmWC)VV%&j6>l}$> zhj#Oei$(){beP|d|7eJ0@=U-~ezG6YGu+|ZMbgM!KHemMx_W(iq7(=KZd82w#0d&{kxTwKa1q52- z5cVeGWp@;z5SjWFt?dh*_0 z+4H1gw!Z(pRVMp&rO8?E+{*zFy0qL9?SW~@F{Jt-MiC-f{pq6pu=+rcTT6okKq7!F z5chy!2}}jR7Lb4wfO)_v6{spN;5z^|Obr}@oqS!!ngv$$23b0Q!ikBA0Q>;d!Jl{d z;3f#oL$jpO(g{9!eo90)!8tTnkom(l>B-y2o%uC)%_~}X!EE3!4mrsTPtP~} zHFVC&0LA~$pZY|o#S%xJrfPu(mn|hlm~{lJ-4Wx1i)}smbD(8bt_`S>HESA!)_yVg@$M)PZ^s*8q15(j%av zrIA6%35d)LsvsZ~Lbvo^1Q)>enCK9SY692`bmwLE(?Z~LEx1PCWC@B&(~*32pfmT@ zzN}T|_-Lj`H7ZaioV;<3AQ{Vq%F__ovlo5`Gr|JJYmK|-Q;iLob%VbT!>)XD$dn8r zBpxR)>l$i()gDJj`n;Vnx4q9j$J|54IzNYrH!mq)Gp{~RJ3mE6MR8vHUQ>PIhdY9f zER#CakviY5(ujS0cu@HUgRFtw?eSKGM)hy>Xa0omH<|Z?E=$?%XQ7_l6l^+uG&{Sc zX^sAo?-y^Nb^zAW&m0nSR^Lan!sW-KUMjZ*Hfnk{m)_O%4aGd8A%SdE9tFgo9c;e= zaD*w7IAL0^dCS^9SPRR*S_ALAvon-vE_j?n1~F4ClPP%#cuPV7fH3qCzaGQWN<-#F z^ZZf|Kq+EtZ`%C($re7g#gx}>``G{0eH6xQJ)wSS%mC+`O`S(7Z7BsxRPvNZbxSsu z;;1cNQH{ULYF}PHm*v|8H-1BMJnhFqjYfeiyYSU6J;`jH=g@)qJ?AP;JGi40^*4S z(+fI!dc*|@EEWLL6tBgQi4yQR;Q<^97W*eFGH4d=iTb82FIP5W9Ci;45x{rixO<|y zXmYG{hB&Z;T7V36N>FRA5Zk@Y=6hmoW!1kv$t-2Ks-awohhvYvH5UFUA6IgY z?heIb-`rg|Wsr5^%y4p%ne%*Rrdt$kD7ezmpniA!sVNsJkfw8T+EoG*t&+eqa>~AX z>BBqkbbcP5m?dKyiTUk`3trkpXMM=>B#PSC3GkLmI}5Ff<-mE{)`kq+S?Dh!B&opa z_Ib5Y)$PG-8f91VhghzGJ#1<98{cNP*qLNmyLW2Q{z9crC3dti{|`uFnTrX@j4@MC z73JvLFn7h*mXW#EoxiD)y&si|_ncbYaWxZb%uB>?!4j9{PMU4LAj#f&Si=||de1zP!M>)=M2O8E0S)L+3%ZvEr`Z$u>W=o!IRkH4dfoCQi5 zdW@+@qOqN^4;)XmWLMq|VZ|p23F(}rcU_*DMT0gUkUe%D+!Rm)xuIZ3* z=+43#+X3&RZpCYE^bq82MhhdhE81)}UiFwVQO~lYFq>;Vv65-ZqWBU*EZ41_=bhpr ziaU9F{Rj4a_Y}2N%@{b}&Kd}ra7RA-<5)AQFhtf%vNyWaeqo49f7GP-OL>7U!WS%5 z^vA#%C~i2xjEfX{uJLS#8sc%=yDc1>k2=i?N{trEk{Ws0T?36ic9{Y$8Ye5AQo@kQ z5VBOoy$iGdoT~wP!J>83jkL9mQH29&Bq`wpvSd6}0$K_-G(;7hov(fp>~h|hYU-sr zU8#w;BY2Y_88(TBSv4YPxidjg8>BFZvn+o5Vk!9X*P}w-QvV90B%Sk4*ELN2s|3pT zWeASY+>+j%oi(2-OUJ1{uwhT1GW2NaS=*l(qgjl(x2I7Vqh=DPn2UYeznZ=3YJ|Kn zY>WHok9qOX%#35i*mPJ8F}h{%_%*79O>R`B7{zVvI@kPy$P)&6G1^c)fa8E15k0d`+P-eD{2i8SM3onbzOvx7p}NLZA>XE^UkdIIO|`3RKg!jR z-^k%Oez{MV!~r(EsOyWZ*stEfl2G!Rmz%f0OKjN(S+ zG5odtU%l-=^js;fsY6Ng%I{T{Q(d`N-nvOgUzhCYAQb;ryRYBuRX4#69sS=FQET$w za~25;N^5@8l&0m?i-hEHrX;jcKN3_6B;$Uadz$ZFyVaLx&!omc49{srzEN05p?H9! zncP@;-g{|T&f|GJiv22{GOhJu6u-xP@==`owl2GE8zLep-BBtOX>+C>pY(O~o%F_B zmQg6|o2C`x>k>9CZ((ph;L`A`_nQOkn8A{n$X7TmFQ8idm}{TK5ZJ!ID4dno7WAv! z3(VlU9dTwuZTaM=BENGK((d&+cHhT~*NtJE?)5nAaBSUGW5!LGWkO0`5LSM5VRNQS!U47rzc0It?Ezo>++Tl{G zj=b8$3V>eegf;lS_Ic{brsvy_o!G(fFDJP5TfaG2W4WkW#J$a?%_ zrPf}C-Ap9;^t@`C_R;Spn~sX>WZc?uoH!;5?`xd_iiMM{ad~ zha~V#j@2Qr#yfmW%BsafB205`X2A$;{a55X3Ke=k>^k>r@{9F@3ZFDag^nnxyL3-9 zWCv=eJ~e+H9lh&BYMh1BAp zd`{IeZtJR@fXQ$RE>d%IbAkUcuHy}T69H;2g^ZlL#KgfJ3xL@uK?BE?Xli716@+zQ z0+c9^p|0L#UIFrLRn_Q%N44eUKYsp19Cd)i7xj#$)07JirFZ!7QlN4}^}xc;K0Gk+ z1o)YGY9YtR9ssz4Ic7jt$-Omk`*+@cTDW!77f))@<9nMQ7~a5}Z1EGGw&#aY8bpHG z*w`3FmS-MdI7ZfKbO+*regFvib%()b@B2}8CA$Imz&D|hnTUFFLp4D!Bs}Zp+Y%S= z6tbzgmxQ#tRaj9pkodA$H`{$xJC3yu&rW(jHLQGT{&G|22GnMncZtk1$*iP|1??Wn zwIyCCM4sASbLP&a{Mq#3X5_FZY0eYwC*0S)lJ)n-9#MEIhy+i$E+;KSy=$3ccxP~m zczP3?n3w>E7zsY7pvZ-q0EQGF6>|ZGgEAgaC2Z_WAYbR@ra^?6uGdshfUPhLP01BU+5}`q>gU%)JKHK+V5$&S5Nst}9{SYg zL2-MJc?DEikoj%w=vdCB$RzA6KP;)P4&X-hXTm5N8QWdHlDt^$4DlM3C}&c(y4FZM z{-;7yH0sf1rP3T3CM203H-F$$VAt*jl2VY`i!TmY!3SK;b0NfHcDRlYYXr33V<8Pl#>I?7D#9Vw{+-$ zsy;Vr2K0*Y@<^*Tvv!+6=vNT5Z)9Pa3|JqzfA35xXn+eFjZFDs+_^<||9!k0&`#?v z->jy5Rq9Ee(?(#Ud9Cg?iyxj-r7OA>fk~78i2~3I^v` z!KIn;J+(uu4zsMt5VQ_d@DN_Jji|?ZdV3L#JIqhIObJ>zlnAd&DQjtIJxo>P=I8HN zT%-Z^CS)<+4sC-75U7y}?`kr$s#O~=mF+yVbL+-CX<+?YBd3X@hiO#PDgCK*-+?zG zQGF7Z;)Y%fGoyqN2Vd8bkaC|!s^<43yZ(|l8g{1|m35{MxC^lKc}>k*C#qv0&#DoE zcM$f2s_K6c=iBZnAoHZ|23IN-b#*X{>)3Fu@H(^y&V)?vFk~~30!9D^Q7~ITmLQn8 z!{iw5fJK@|Aken~$yWJ|_8S^$#Kp%8f{qoUn6n}61pFa(cDSNwh#K1L&HU?o zKTqA!ngJywg_firwcv9}1;;{H6kWBo$*o}9Tv(7s%D?42Br z@lBhIcIBzQq8(pb48G)|7hh4R{d}girQ2V}ZR7NV_*x#-D7W+pN!{s2zxh%7RAUW{ zg*2`bYK)ZI`%O##@pio+H-BqfCS* zNp$5b4xIuO%QG4`yMizI9UOoJn@nur{suY$g*x-=Yfhi5())QgSzWl9)Jla>)LALI z_p`^%aJPPMz-K-4ZKA#NQ{yNB%zHZ)#y?gSn+9qFY)Xg~`}g41hij=K%lsRj@X#XB z-?~xMW>&sr5@QceeE5=0S!B6<4`sSIoCa%`-W9L0u&@Y!)L46|K+&Myd)7N&6EpzF zKUToA+~K%TeEDn@SgCQ9%T|x&hiUHN5&L@=N>W8WyoVQ`En-hq+4?-5jq(c0&f_Yt zf{B?~fEtr}QoG$pZ##J@Wh{dVNvh^~<5i}&!VG~%9K5_{GUtCGagow;Tdc`YRkb4H zbw00dVib*Cm+87=4GZHH=W#Q#wKMN6<9q2@XH-|WfaJ!)PX3F9wsf+n;w`HTL6<38 zMsa`jMRK5#f4^B)QEk01m~R|>_oR>SeRHKz^w8~>pm$2)tW*D%Egf6DO^f}ZBPhk8 z=~HZ1Bd*b#J8s=|} zF>N&g$HRPYb+3Qcpt{7LT@4W9Mz@xUl_g);2$~%iAG&+n4Ld zl`8zX;@9Q2D+aC*XDxUaptQ+SMsXh2#@h0A9~}um843fS?(F2F!g4s!*4J5p2?awB z`%VT{uAYY|s{5p*a}e26)|xCCfaQh+MuXKB9Pi_~Sjy@UHw!absSZ>{0ZyC6dmAgE z0x|&&T@Rytr8#?&AB!b#DRw$kMVGRx7S5#mowDtRaw2836Oxl9#$3Q<;U+p-T({Su z_IC~(C>lY}W?G>Qj5uIkO_g#sv_pUYwyR4xI*7N^T z34o-joxf=c2al&`5=2;mFIwE)v5U_MIWmw*i;o#|-o3K{-9MN^qIRb%n|3Ep!1@lh zIQY+=ts!F8EzAf5=xMOkLvaR9BYZyO&!T7ug3&+9aT~>oU8hj^R7L`zQ=D}*jSM_Z zD*F0%jKtq)WUk*nk={A5Op@jyllm`O0|+d%!`$!>b0xN-c8gAx$O4<;8bacPxs}yT zb#;VP1+uv_G80EBg@1pCXwkx%qCDfq;%=<&^X+2y2ECeC*9&`Yg4J9$kt(^*!ymny z@MBT!{K4Jw0{LtS67he|3nJ}Np*~h-lyMqe&2Lqbf{BDedGqFjv!`E+~+{(#!V&n>6|GMiwt*EBD;AxDfPjatdT1-uj zI}R%o`)%}o-A(f>`CN&WAAj-!edIsKCG-~?W4;{@yFsehL!e@ukl>xM{qWj0qed(` zT62X$#7j0VS$Vl@|MYgLQ}i3eRJx6$X&MKdKf1My$*f`FCHD;Do_f#=%TFl%>r_lD zoNRei&|->1l)i4>R1ke@p8vLMuuf3KQ?yBeI?rouN>;98rNd**HzJc60%db^(~9%y z;0h|?#2PqYD->UeH@?GA+YTSfHz=98%!*LL#P1V%U2pqKZ@jhv_pdp`3M(IIh?Q_s zvs@;F*GTD9LKy=4f=~3{{UYIBHB*yVP-_t}=kD&Y&>WOc%_TeJPQoewEGc6)fQxrG>0Mc(x}anlb8 zY3%wB(EpDM&~D=7SZGgAoN3Zpi8F$CD`IrdkyA)aPfm4fudJjtS+49Rm35S-1#ejK zl}nc$hhS^Q3*R;63!~HMXU_y|-O|=@S{^3%-nG7`3#$^+4}r%oM`|vPSw7AJEwZB! zx0Ety2>|%=I&d>s`@8Q+VcDR6$UF1DNKXhOj_&#>PsgvH9Ao&!xa@b1fg5wD#b`Ad zUQpIL^~X`_OALaD4t{3?nB0RJk(T{7u!T1h?(s)=0afSw(UE(`Vhrrpjg7w3Qkl)G zC`}Ma(R#$}iT5o1J* z9yoGWepm7)(#pJVfq9!z+}gfgbo%A%<|A}v z)&Q1q_k3T9Yh|yZr0+sg7470xLqbk%mw&YJAnnU^^YIEp$bjX`BM+W|j^p1X`FXJ1 zEvieRod%WFGAgDgW#eGo#{Rzu5tfVIMEqS?bi`}px2J}I@4>C0|KGX1N4PdlFd zCACg5Na1^g%F3eIXJOqW;|e?(?625U<1PCvDM);uI@@A=)xm`n7jrvTz@8ga%XvN2P`q%X(Yvda9>kgZ0_-HNl1nq3& z0(z7EvA=n+|1zob5l5hV*4#@rRt{5H_+sqfLaaHj%EF|aq<{6Kp$I;7`Df|X1D>Hd zs}~$XV$Z@VI>waUWvpCBN+-w4=+K-Vn`*P2E`D~>bxKA+G8ehPcZ>NNXW4w z4XyuSK@O8T=v8(3Ym7*G`ue~`N9+Bs+v3PH$^?XaV8R(F{3|5y_Mpm#;g+fHLqT!aLk7^;{; zQ~RxZJdD(*%7(n9`LtamSmIA|bKjWpj`4pyt^X`3`jXg}i~^ z_fJLL%{)%|;m;Gw0Z(1a3)?y6qu~(=QlKlO<&cl|%%uQyHlL33olI5%nJQ+c4wgg$ zPo1?=fV7^R38q*Lxj$C8VTf zdT5rN*JJF|Rc50+dbko(5`J4>58Cy&XTCeCNJD@WPqJsX2tUXa1O%Yy2O#%}iaoJq z?ge6lBCZ8CvCmHmOTUZTu&T#EwJS8Y|1Ha}rzyIA#DJ0kV0w6rs;u z4uxodzSs=vwFaWZ*p@m5vz`Lss5B)5P#Ui6^?K~Mg|`z1LjPScg8CkA)N)- zQfYa)xSSj|l#@g)g*^j22nxZ?$EWe$vTAbUI{Wzf^4B~idm6m&LvBLLPb=E`KNK;_rHDkRd2NtuwIj)HMC(knSDf&(Draj$c4(W<({R=3X@ z({a5WTUv6O6nW~U;FXtLX*84Q9rU*7#?5cnY<&5uxZ1^y-$XyAFH_IF#;o?`-%W;b z94M7rz#Ko%{_;DJ=D~ZL;%8+?M+a~yuKodrk-VZ}u^@eV!J1eI#;seoqI=Exvx{`Q zU^v$Nq7)EbD2l;zjN)HAxdUNT8x|!Zqd^>ts;kFTq{rcnDW4f}Ykgn`!;-Bvy@ZA* zVYwK+1MkhV$S-`QyZ=q}j=Ar*7q~rUPkcsTfR|;H%+7Yv+(v;f8#sDCPSJ4q^em|Q z;@Zun=68!we(PXG%9w9@*wfsZTgr&{usJKbQ9E}2FO_?C?&pu#x@vj?N)jBMOUQY-6mO>do@Gm6*~G?Lvb(VQ@d)5 zo@clzA4Et~7MOXIZ^=lDQ-272dhET0vbwb>>>NEO)2Eo8-I$-II;lAK%KhlY^0j+> zHzMWVsW#-2=-iwC`Ge@7YJDkqlOD7Et>wvtW&hGIE=JzAzV=icc3h{zQ<9M4e|~J2 z6e>DcLA_$JSt0D}M`$Qi->&oJaA#Cc*Z?k!4Vp62Z{>=9o}TSX4CeN>+KNvI?cE;z zt?NAI>g0L4`lA8epShXYd+Y4bvcSFtwfE}tE@u4O_! z*&cb7w&Lr*fji0huKCZ@!)w^r)@>)c7E&Wj;y3h?>fYrS$Un_lE!tYrI^>*5_Kj$I zaAG4J_w*&*cygWTwh+kva zTJSuUy-a_EOwut8Q1~r=`9V{dp=OIzJMr>5+fQ zD3WmTT5dP~Xrup}Z!ErKw~6hNU1aQ3kgg^AtSiXx2eGU7n-^4_D?1FczVnkTba#&@ z$^GOU^w}-w`b$%Ema!i-en0H~LO{MRgZK6oENdC-ENnP}+USf2b9lA|U|N3V0W&hW_ z+sW~GXTQ7CxU9NKy!UCYuPr)Rml zk5lwM_H-(QJ-@V4`)Xm0wfE0&9=mj!#d^&gAN(zzVZO0Sf;dA?*m>vgYJ5u#2)KR$ zSr18|CW%tas0%od=0-Ow zHb~^kzqxD^)YzUkqq_I&;N{m-hFReQ1!vWMQnRtkxWNI2-9ZmR{kgC~et05Hzv9da z?BHIkmifu*1#?p*qbv`V4TO#e9^?ky^}|;5Dr;tX_os4jOkl<-r6n~eQ7@GyD&$Y; zBX?Lpcy9NXW&dF{?Jqi9#qVzaLydBf?*BMaLGt4}A)Vo)J>JIJ%Yu5&1B`-1byyvV z!96eS5AG#xm*p0>&Hm`iNxf$+DjAj==teg~8H2@nKhfOO<6TA@rG^T#ZNYTA=Alol zgYX5e9v(5QW#OR<%=ER>d+L2mccVkm7sSdv@4oq?*3a1Jx?;2UYrix`E3>*W-rSG- zX>E9EuE#CB@g!;a04$9xVg1|bl>g0{{+;di!!QsTNdWH|lpY8{6A<}~fx3~MMsG4s zoVOs?;}919kjZdezZW!JU`qI&c6aizJX~IDH(nXqn$3P%8K(D3*%22b?vRS`UG6Lb z`|_>B#S;JVNQZB1?rB;(BiQYxv~qDq$wob$cyRU8;MjZpsyp3_e?2gSucB>UaY+** ztH*V}Z;({40QXzqzBz5BxSJ1uovv#|!>dP%brmneMxQXdj`vlkAMvppdL{bpXZf|o zA9x4*ovnzrFKC_Sh~9l*LdDfweX*k}V2fu?#a-{XK-BnZk^HxvtM6s+EK2vecj(NC z!LrHjZyMd^T~kmn?N1%OdNg&<^6_g4SNsn*JU(yScIDeN)t%<^Ry2&PmaXc7x6*SZ zzR4>lF7vW<|KTGt*MSF?78b*b(wfqF`=djP4nOSNV4ox*IdebisQ2AuxQXV~#uXDv(nD^lu{c>uWH!YjrjS5K2pll=x(Dc+F^8gWisBc1-=@CfULc-e? zUV$yG($T$O$#0I?TK8(ded`4N`d}Hm)jd26dJ%BRpZi-K_hktxSl#v=8bU z8#FWop9gyH9OTfOJ3D_}NdayP@N~eSCJQiYAgaH^2TTw&Yk-GA>r6vQlPtE=O* zFw|-oEI4~nOeKwYT3UYj_?y2U&TDMJs-60S2^*=jI(WYC?nf7|!Lv_vUoLl8>Kwi1 z*8?DwGI~R8X;bg#_USQZLrM*%y&H@rzsWAf`o%x2t8D{VBjs-|0Cp-_Mj>Lp=TFS>4d^0mGu>OF? zQ7ZEf>{Q^+9MX6QI>%yCW)N7ID>p$pLdosR=TMlf)}=#*9&m|GnUIn~6Dvy;o|q#; zmy*$tpE~QecKBv$cV{8}BB5sS9>|F`=ie9paqvChM<1?fN;f>%4bz|f6R^SlZ()ui znv?5DjUsGYS_h3)z>J>1g+CZ0tNvnUZACn{rj|7Q-yjX|(!|^Ebdy^8`n2CjXbMcX zYrJ{X`8l}+ez+dGHhw*nTeq1GdbfyDGzug zBzV<%)E8Q+MO)4L6`BL>OG`^%N2&duu1}6hnh$-{)XCP*R-Z#$m*N#)roJ zr4@QcnOBfryOwMU*{K=r5K$u*MMFr4=afLFd#8HSxDn)!QVYOmhy`h4CTA5)&wA%qD=dzyOA|nhASvB;|luMvdo^G2{o#Lt*W2ti7a* zo&yg+sScGqwa5*C?ghLKYzGAgEx%gc51g9tUaPNx8`5r&n3OaR?SfPX=*310C4fyY zwXg{6;F-t3ZQGie~83Ih!_Ji@!^v6PdXZKGS)BFD_`T#cti3h8wsDJ_PHt=}C88tk| z>KVc-wy?Jk2hZ)G*jOT~7(xZ=_4)ZP>JDugaUEFDrYx%Ze zj~0HV>Ga3ee5v43k)|*9^uVh>-&b9CC@yFG7W>)H1x4$&x&PL?)R&^J`<{1}?4Iw= zqHgtHP|k|%+a2(1%ssMbYU%llV-OTya{q!1sT?l$-ip$uh3zJ%Un9&Q%(I7=@jF*JQ?^l|oV%3(ex^=xLXsbe!|`kTJ}#Y%%{X7kwhy`MZyC%;Q} zhN#)M9sG72j(;|m{F^F99UYdOd!3M-96b%Xxb5e8@cejI;xgHA;!+Oz1s9x-M}^tR z@0V2fGm{_BNTXuw8@WY&`MF984;#*QJ=X5MI;}6C;Z8}Pb$IN$rd6X$G1bU6WrJHg zd}uFPWk6wT%GTi0&;_RoU$R}Vr;m-Oohh!4Ly_LrZ%?0>?7F7Zs71foNxR6&joA7* zcN>aAi}b0P8|0PG?F~a6wsK{cFS+Iw1ILSC{=W?;3yl5rOcT`I1%M^|YPpB>$J|RJ zV}!H3*cEL%Syg0v?aohJN_0lv0Aq${&pP=8tEK2=Xkzs8n38S5=f7lFPDde&1gl)3 z-Q@63d7YATKui);B@5+s&#V}osrfmV`@5{Q<>mA5sS9q!WXzY>eWXo{iTi06^iz>Q zHuKYDzN5z6*GDqu(eC#i+$+y|>G$S4yp!vvXMXq!)zH_I*QLOSLsGiW~A zff}{6>qy_1M}j(!E|QjXoX(_r{MF<%O)QN;JaMvV_v%gzdY~0NLe-foSTg%r2NU-` z|5BqIs{E-O@Z?h>nfd_}jSN+GPU+-2Or98dQOz6y!5wp5(}oK0+d;3?#;}f%IcA-YF|pPt7*hy5p8}4IRK7pMg@tO{pmhd9TWJAFHdX>z+DOm*!>T=YF3eeXY#v z-|r$)Da{Ojb;j|ZK>4uhLiY&CgfWKFUvpu6%@PCsEY1ovz-pcmZ8ZdoUadVp?vm}|{;qIzp;SZ3tm1z~)?siNEdzTMSx9H67>|3NEtb#(}|0<#;Kw<-{cotV%V9C_P3_WFoDpO~KB!GVMLwpd#Jju9!J+yMEbPH_{Zreh&+svQ@m zHe82iX6$Q3;%S0``fY79=4sOnKI}&0E|wt3&~+_Apa8G;4rT>6VvE=G8a!kF2mR%# zVQI$&w;9)iPZTI`K=6a4!fz&V42ImgX4|W!ZD6nrmYg7E1NSqRx@p7;q_MH_#%Pqb zONwsgbb4z-J%sjxY!Y4#3B;9~yU1J}yb(IhD-a(vpb9DI{uT}OF|cOxY1~&E&G1qk zOwhgpE^%XPW)KevNBny#6~chkRV%Pb0RM?{+q-KjRPSDZ_k446v$$oQRT4axVW1tI zu8uGC=LHg%nYA^R!Z4!Oglh)V`(i14;LTuZDRL zQVcLSXsr`npl+xKj|h1BiS{@_K?&)PAon!nbQYxsW)#ST1}zDbd!?CT=Yg(*6t;1N zPqi|{uiL2JzMQ2G$t;x7`=)+R$oV~pBE@G&^~Vr*8{p29J60^;${KXMY|HS)B+kg|@~G zIFEpZ)7=dP1``awfhP5$<$9mo{jdK%!D_Les03yj=E6=FU{ZoI8j*~kqq+5ytIrJw;rl~*0&fNZ%kRW9#HBX@o(A$NFeV@d z{%4gdAkkGHLfQ*IbcUWdu#-AJ0`=mjs;bebjG1hJKwloLYr{3fYWtI_NRRmbf(kL8 zr8Zp|J`2c0p0K%1+mtj&(?vIL9Xf&OrCbj67o`mUea1wixLN7)Oe3SDWr>@qcDA;Q z@xH6^n;tXg_G614S{uH*U_5rw{f|2<<(LDRhH67y2i*kqrtGDP>q7EXY6ttfB#;g?LJBEv;`Q zTar|_5w#6a40Snv!f*q0rHjX?^jU%|aI1hul$G%!JuR*3^N}c7n7!w+UkgV~lZX%$@ zNVWiW(?4wJaG>{H2L2$_bncV=UfuAxgUZC&Os*b){$z0}6Z5M(4l5eYx(>9*vY4Pc zhEftD)FCQnB`cyF_`4~Js0MbGj2}XX7zOS+(pZE8u?6l+SBSC(JkJVQu!uxNKaTw5 z#-!xHF;N|6nhJYH^J8z12Sx(G<@CIz^|Q^-av&Lj-Q5wWn)BNN5W5K8 zMs{{fkhDsx(3pH!s@40Y%DQgXps;te6aZ8Z!~&dOFD8_V;kd93KSi#n>BPRt+t*E0 zP(@yNI+R@UL|I$3I=tu}iq8&OhZ#C9DPF)=xAl4QOvb}pq7PbS)NW0+a8vTq0LKDD28-^?%K$DZRjldL2+x5{gJgr`fa)3SWlMBXrQ!jPAPpWdH-PRq zySDZu{3=y#@opBy`Fl9GkmL<-5yP80x^U;7bHgME2j*hNMn-SIK@@1K*d0VtMy96d zAQl6%DqDQPyCN3c<7#lVV&?+sxe-Zc`G@W$WT#tUuBi4!Y3`0PR|`w}VTZM@qd2CT`m}S&2Yi2k zB;W?X_EcNICp+dMEiDb%pkVDO{GdN@6CC;!bB7(pHHUeCmJ1WGmtZ&U9}fwrr4F+q zfbD6(YImlm})Qc=)T9SS8T`d;&Y87n#{dX7_sF zi@w7LpoBQHb+c_{g<;&*l{=~4Y_Tm9$&dwxFSEQf3^5Vg!+Rp$-&n%9IxBr#U90fl z*wTX062!?k&R+t(@aNBvrKppn92o|}a@b-XL=Y2f=>RDOObLO4rNY0|2s6!yj%t?i zRdZt!X)%9eUf5>AAWYY>PF;4Oz3l`xgXcXGn6QmZGlM}bc-SfhKauv{wn}rOo;^xPja!k1~vd-&cdPb z+__HqgHFdzLxgYDQcfWBl$t$ zgng;~WOwB>>?66u+IdIH&5kiW9NjjlKh-Im>4C?Ys_2(_CIuTQ0&FCjLba8=yhKJp zK_4p%E~*X18S%2&V9jO5=nRlxULGUNRy)C2tXXapjQeLAyZ~b?`}|EHxfht{Te>Tt z$pAGpoCD7KvpZ72#{_E!))7<`O@$ej277;c-)ml>mM*b*ovP%Vg@okzh0V1~ZFzSE?m-I-r%Oj3S+eliyZp`oF0 zFL0lp#bF0a!h->2N*t3W$XlT1s-CnHEVATE1dK=p_J57`(i|&53xNy>m4*$~D(o9B zE<`0`HhKCOl;~wzAGBDc-Q3*rlAR1;cKQ1^350}Hr*H~CejL`lG!gYxKDMZbRZ^J{ z!~jt411tXVSGyX3cEvfw;8_@NOk5261=R4{I2fVzra=7$m(<)}3M@AxpS^p*ag>L> z@6pX(FFZ#cPQINeey@zCVz}9l9R4fL~n{4JSAETYP_@f&(qmprrb< zuCNFDILO&yn+R}}g z#->CM$%L(F=|oRmU49tI@3AA;e~JpLIZgjxPv0F#W&elW(2^EPRuh?-*(IS8DseH!$Iigsta90F1Ie_R4YOyJH~bDDPu+&Gx)_vt3*7L9UzH zu7k6W{ZfpisZqxPAp<*vh(8!{bFXd^e7KV*_#P{3vqGy!_=w)WbP8cX~S8sjuu@bb0!Ty9;V0(z}sA0Y`Z~om@ZPM(1&taogiY;oOFAqr^-5b;9HO zuU{gYXMA9WgmN5t`p)*d4lT`m;b(wn-hnI^Iagdl;tg~;lr<0!YC*#nbjsW*9fQvW z+7DKD>OCnI*}HL2pnQV}8FHGTU5d!k&>z9JRNqudqRk}srzc?_rT9KfBv92KKLyrm zhU3z80~044Oi)odIe}M@c>b5lMn4{PY$9V3Mz}DagpZp~#7DN^{7Zjg%yxs{erkp(03ke9$7L<>lqY*cOGdlJ;YD{cvBSb*k@ZdZCyW3z|ZB1OqNaIQm@pL^$TG zp~M;Sz5HKi7DN)<{d=ZHT#A1yoL5^VByfA=Wq{V2O`EoFeAaTXU1woDPZ5GOaK#({ z`atv@E*mNZp3qd9g*0{x_J0YVAe5icP!mB~*)n|Pu~j6>cqk{FQ_L&i45$p^l$nJ$ zZ2be#vU=<}t;Uey8~h6nBe(EHY7&b!XqSqd2i9Yz0iJ&roV{@!;BE^yNQO3(#hI#H z)K#`r@q0|9>vA98=$DehPcctkv>SK+d?wZA`2Lwt9&B?fTJTCX;r$8aF=!E^Z%gam zBDtR-H8mCgA{N+;sevm8LN=nSApG-i)0wKC<>tD!-^q;B3_t+hN5?kDesyNFt*CyW zwWH$eyRz0;23aC1(Q1n%qGPc-KTUn$dVNJLoACb2`y#9kr?AjDK3Z)$Ceft1dMo=0 z^_YV(SnHpBjiZgxQ!%axXA|Qb%wEupA3v;YiM@V29PGn^DH;(KbpQlY5Ob2+i47F+ zqV8-bSR?<6SHRf5RTC4=s3wv8@pq_AiPV5Bi{&WPTOn46276FsP~sqd#P~E5?cRJY>E-PIX(k2KDQw&Wa2rv6Lr^Yxar)^fP41{2UF44e=ex6 zwSe|6MoxQLSNc9juCF8Y1}?ih^?m-3o=}>vU&?FnW;bV7ZKZ5w1j9HJ6VIdbo+_cI z5Ls#Y-(b4EaAsZPg1UB{Umb^OMO<&Zm}=ioQ65VFK*iW>b;U0Wm~p$V=d`do{x&L(kIF1{PiylOi+W^9D!XS&LF#!$?GBZ2R~b^HL4y! zpOXmHbX0qUFC*aw3jZEFcT@=YP)%5oAUqQA{0NQLr1rpO^1+bP`zQy11`xJgWT`nA zYRp0AjE?`}qZ5grPz!`)#uRKr9}%kd2qG+7?}ZS(O^mw{LBs>?3V;J~*6VXNk0G^SLAp=ITm%ec-_6ar`zkfdtVMhZnH(1rooSh*B?svlf z)aEwMhDk?L|8v$7Of{?l!>j>AmMxFscNC!*n>VA4x~yXd zZ}ctfK{1NUCa?v-ffbuYUsXW2=N`7Z$hi|33AKUP>RvX*O}ME*KCQ@mPQrAq@ggkN zcrc6`l}B~sq1b{-9^52~1gcvJ_l6fJjarPoPJGDn9j`4c9`t#E9+}rQiwKsdK&jL%Sfi( z?@>UgcX6dk{leU8UZ13T-{QjiGRKTx3H^d!;Bl%|hEXwGS(Bi`hLt@~P6&?(SXh%t z%?l(F@jDCvqrQTih$NGfBf+37mRt8A?zAjdVsUZTpJr@$NE&Uy1lKElp}l3*+o`g-b$v9!ZLeuRiYSDF???w1ATABY*znMe66{ zR$-|{ilgS&^~{`B*nCG(w98Iw{J%Xy2&_IG7X z_CUivAMkz1VvTtZE2Mt@aAid=DGpULQev_FZ%W*Mr+NOVGMG5kpt??>MnBDS z0*&WGO(`r);iow?%I8^8BEfo!s-}xy&jLdiom*!2x#tj36uOuJ58bH5Z1`NOYJUTP zfY|dkGQzI1HIQdq{{P@ZA{=3@5o3U5N?cs4x5x5qof2v&S)WA@lk(f>MAsrOO)^3h z_bkY(ke5Rrk3Hh7{;k38lZL4&C4&!If0@TiWv$6!yxAsv?x)}ht;2D)^4E>6i**dF zLblxF7o)v@IVrlSG|eN zul4$$(B9)`mALtkNm)pp8MM|4Kw^ZKaISSLfn2#6%N&d-pA63=ER_i>Sg1szFC=_p zmA4aCr66`dt{xH@#MB*-$EkKHod#HI$}LloYJ*P7dCwA?U9d~sw~=s42ho-&W+6+g z&1ywr$nX9o?aJ!N8lcQQdMa>m|QBai? z+4L1Kp}goiIENRxsfh{Dn`b-Odk@}QIQQNH^s?v1PjOr*+<`46)FD0!87f>P`X;12 zeC|iE?Br30A8Y_&C3WL>aor-+Elr4hT{q)l95DKgPty-f7yYrworTJb#^|igDj+0e z0qiI;k{xC$1zPc;^udyJomc7b|B#IB_CgQ_Fi{#MDYW;+lmxq4QhJYawv)h|ZP{JD zHn$;3jt|QT$8R;vUSK6J1m_DFtl6$%^GD67R?rz0Dwt-~szJUZ$|!H9nO`5%OJP)niRO$-H_M-4VrDSdAST_Tfy8G6p6i!QjP zI<&Z`2nis084a6y;$51OnTXGCW&+o7NDSw{y!EI|s zW@fpFWZJ%sr$a5HG?~^3MQWPoc0ubJ@+foOy1Kd%NzNl~9PoGtsOI7l3JYPpq=fMR z1m>|k{HpZ7{(dvK$>RhTC46C33mFf-2JO)w;&LRxkQkSdsmm;Xy+| z&0O_xZXbn!^}_`ZszdE$QonEf?ys7hy3dD^mH+%@-b73IJ7NG9?HgtlxxBm_Z3h-T zq@Sk%-B*79ex>Cofy`C)N87bs3Bxky)EJ_g6i0KhwXJO<6QdZowPt|j7Ztd+W>UsE z+1U+tYJY5R&u!%M#u`4CuRqc?i z3G^)t!EWJ!5_aUMs;Yq36NU2iQf_$Hfyaf4EwP~n3+-F)p-w}i3c)}y{q==wAwr0q z`X|Myro|Dan8KjZKs)^(PvBMASArrZ(U%UUB3GzESrLOjM2-x~fp#hATtv6K(^ZzY zV0je<;!xj++ozvvZ=1pdp477)n4$7JQ<&0(DhN$6@f;dP)*5$$ZjX-Sn~@>%>D*Bak6eZxXh+tb zF0wa*Ar9SBsmj+&jwo?kT88pmA!2IXGd(kdj?m@l=*UO|`@NJD6lSjT4KH`+dZ(os zX;>PVBv@Nw;l&PpETVq&4ICljbaWyWw;0{8F;DHli;`oT9`*ET%ZP&hkJP~dM@!4< zG~2wzPmM>cuU-{9Re-)}ut`BjTvF3ssQAMXZPtr(BJ6X1dM1XB7p0r7(;M8iLgPuT z>AJ_k9%|1IFJqWnOxODiaRq2~put54HWl@kLAl6k@9vqGDYn#iv!6Q4YB2x;!2gDv z`+T%yP7X$W*fM#DVF#x65BF_EUgW0`q6Oer;@KX7RVmC+8%Ha=AQ}Q4=jL0tyl*}k zi|RMDoP7&*_4KHhbMuaaPGv5d=?Sq9?dW5YTyYmayDC@=lE+FzyV-?gZv57BsF#^> z{98u9+j(i|{4vwuS5q~Pb!IGG27)`(Q@)qnnjQYJg|1{LogPBErnt4u+w_r2wIj=a zq@!b{>96?g#A4nhA8z61oU5&D9BY;Fd1#lC;xh7%7r?Be2^94Qu(m{oxl)qo!#`~F zg=&OBZ&OUPL6wu+?0(ENC49$Cn71ZPN%qOTSW|ljw~#K|Dr3r^Twh!_dt=TTI5FvF z;pC^rR=@m)4qEf5VRNo`U*TjiuJv3-T0$&7{M@{E!ny&yrP7Wv`pjXW?mTLCXlCoh z0yB}(tQ}d|_};Nlr$uiQCH7xs;fnP$hv(+^^(|y@Z7Adrs?DGN`*>ohu!NeqtwZ9T zUb8?irGEzvp56eTk-^}H(!0H`+)|5U(A8$rH>Wjv`6>EOhrp zm5D*i4l+LD?=(c6F=Y}$LqO@a@m{e8mUH)(Q>5bpPk3Vx9 z(#J|{qSINw(mH_LXj9QZShttokjNMxZIKoIDViwzD0yP|;@6*t-LLwFw=;FT_cQg* zsmLa8Q}8alZWyEfa&ffIdAYMKNGlxcLWH5b8tin=9i3*)(p8$md;zD4=~3P7W-@>P zR;_ll+9(^cii+;@Q&eAQB;COZ4GM5VyBF<|9OTDAf%sP%tN}oWoCk~s2krpZ)?6S? zx}=1{LbiKVA&DmtEx%7c0cH!mHXc0HM-<9LTO%dK(bk4iu3KPRt~>IW|62E~Aa$>c+Sjjq! zGkUuQ!>pKZRb4x5Qo3i@*C+XptCDHkWj7PEi(R!z9%9$u&|d^@d9v!@dA{u%ui{~0 zfJAT=PX%)kWj*=^41>_nVs;lXgMk8CKg2EYtUDF+q0K4ZH(M)1KzV5E$UZNS{K0iZ zy^rE6t*bEiIQl!L0!>5+i|z>q2mrO?MxZRgl>O9OdXA}ot}fS8mag_>8IK1cmDgHr3ezT{(#7px9{fUgm^qEeb*mFjXCz~Taht9LM8N? zY0Z;p1R_SPFklDvYVG6m6ox-U_X9l}!q<13(xMp7Z~O%Tq7Gk0c$N?{IJDJrb~WST z;CN7VhL}thg?KLnB#4VCDLsO&obHcJRk6Y$r}Z<2^7<|GbaX5PA~!~q_4ytDlHuD) zZH^1~+1-5?^?p*U4+SgYkP{DQh6fZcpEHJTXqM$}_d(LG;0r55W!gG$KNmJf79u{Fgub!J2gROjd6Wp zbLqrZ3KyrS7n5%!relPbEKGP%PL}pM&O31on1;r4l?P+yf#U%|aXgNH5)%C`#VD!) zN22w^v)BQa7ZezwF|tD~1hWU|`l4z2=L`%L^l#v?7`a=fYtJ{>ew%8|U30QnL@0{( z>w0NI%1&V*+xm`a6``Udsxvstej6SOoYVO7zeS8;Z#S1F<`1a?94O%uMU2 z$V;XzUP7#C)%t%f3%mn3#lbPiabkAWs$JXERh4x)et(zj^xw(a@4dT0EB%e7QUBu! zruI$i8h+LNTGkxbkoL3CGFk3BH1(5FPVT~RZGmPX^DSfL4cs-%#5JY4K4?`iBA!9{B66_{kBMH%OhiPW~)<~2CcOKS$O5BGMU zCCdX!%fxaHURU`005-^EToOJ1?6_ZRm6vsqyPt>RS#-MSeQ|O{@^97+I0N}Q0bt!k zDbG8tiDjLJr#CS+#lW|jB?-?CCkRlT3`$9Y2L;*xabnouBLb@5E8^KXU`sitNJ9?@Do757ZtNdv+M z;vs>qOhVPEFW>zz+BvpIB05b>s|!Eu@ByI($jW&G19cMVgUHP+tR3Up<$~ww7!eS) z6+jP!GMw3@;^Ihxs*mFXI04QUK>V?&bGf6}9yA`pJQW}hf$Kn0uWX@rj93Q8comf; zA@UZeI*Xs*CKW_faPQx{wHp}-xz+;-N8byVh2dD=r-XSb9`;)}Q7A1|DW%bU4*zqD z!Yv2EgZSTV92{N?HAaRQb=sc#0)i=CAwh=jz>tWhg|+Ioi`V~NEaksGOf{F#yk?T= z{=w;o>;0eUMw8n}QZacsZt@+R%`RkqwaANaM(c0Zifr;u?r2^)$~o};tW5g;L!)V5 z-859SrL=-`gc0kZaor%UEW9mBTwmb!L;jKQnPH*Syq>Tzmtwf$KAS5PrX#z36DiIE zYKp-mIy!@vSJEK)NYi+?Z`5y`>)W^p@ph`jLC!#rfr;6~^=1y3>%x~?6}|<7(JMj6 zjM%3bkP zAmOBiFW&h3^La)FhWclxSW}=PkGq9hn7{&&wg%vCfN~5lBI+rqmUT6~E!Q)PIGfZa zwMDBP0h?gLE`C3y^tHQh`LBbTVuo%DB<*mYd&f7y-l$OcW_8SE){@VT55nUrM`QVl z3VSO1<=su%vCILsnD_7K`g-|83oH*0^M6$3pE)D7fje*gMJ4OPOdVPJD!{nV27{)B7Zr=sydkHt7f)!hfoY1S8NC@Y_Y1rg!#wuDF9^Rq$PSH+nAzJu z#No#7tsqOH@-elO+F{W-+fE8R85|UM+<;jPBq-5c^%ObZ#{726&g**D4)0QPHncyk zH#wpiK)n^S;9lhTV{F=UHCsr0qfqD9({aZQi*J8oRtVi_wTE+m<{b}~$kBoaTq)Ni zpXdfA>b|3#J=5V)D5`v+!}Dcj&F{A{YPL>E-;I^G!+a9N$-mU#PyYM#uSYx8eV@;V zc%`rb!{_^a`R3)EG?GwGWKNHl;oU7D7KTFW^5)H@fT+5ECYaF;8T^dE#4taAS0;u{ zysV7kva%Rl4V^Imx$hy1$l8O>yu#u7QPI)yh!6m=z@M9meOB{sUL>& z0H2A)l=78@@?rSCiXbzU9kl8im;jBm6>I@;Pc8$W>$VLM9%ozOq^aINNDN%WlB>NO^utH<88=(M?|EL~4z5xiI@X|zXU>gOIMN1G)D zTdj5v>=&VLMvxfhS8;khy$kV4@$W|q9AXsQ#7qHv1vhy@dXF&L0IH5+xTPnHFgi8~ z7ZTj_Xo{%E`2Hd&nt1fzCD8!6%@LqDQnYo$#*#Jb811+CI#Ud=>4%dPqu}o7@#X?( zZ)$4mGRx)#QQRl$T>a_4t2>NSz`Cc3y*v91uPeIoz8ZA!n!dQ7Mkn(W? zAS++$E`R;v#ib{7H82N2OGq@x&D!UnBzTkg-ssU+9j{NH>3AucpPSpH?2xURO{aFw zXtaM>iH@`|4Zpp?j{E(SPhA@=?(i_aXVuW11kly^dVAZ$}0fLzjHc4MN3%@m8z;1^@`_e!mDY!@1P&_&SLI~fYl z$+_NGXYxGvi9z{Ud^`h^JJJH$8;mxyk?nH2(jqU#A)6{{N!VWHW8NgWgE-koFuy@MKxKuN z)BLmhKhKP)BCYu43otr!1<;yF^%liPI zV}u6@EI@%rVvBjNq;^rLbQ+SI-=V`dCnFuw0!u}vv@@ak)t z=!cR`UJjgbVIrqkD@L~`|JA7HFyhc?J8xU(V0xq6Ch8=}m9gHFn-Go3x>K0c5~{Cp zasH@@;kF66my^aT!)iOI=<=lSz&kG-0x<-{zlZ2m(gMAqPq z5(oFuPLmr!SQu?*U+7y|>azhs8j}~GWk3{Vul-;}X+)tgf|jHN4|)%*+Y+nJsP#Z^ z|3?r7h2iSN*P7_#{=YPZcUk!O_;mAajfsst)t*O^Ah=GFl56$pT#zcjV*|wIME8Cc zdrz27Fw!*ox(&f=IUyMSDeT%6`q?J`$}fpNeIV@P)g^%95D9*DW{f3dmfRoJRl!TM z0)tM?dnWJ$2e;sU-2nN0cpN{5fl=(aGh=;DjQKYg{PXd3A$>3E%lsg5&&H6daSd)mdfRXqTPvR@oYzmT}$Jy^jkE z`1yxfwT5Rp2Nq}6+RdD5y9UonG@;1uM%o^;QZ~@SfLw#uX9fP$dQ`V%(62e z1?=^i-H$RAOBC-=4}l0>sj}@TF|{E&?SlAQOTR$d(HgxK4xir>yNQ9Yk;9(ZYW&;V)#G>5`C#ZY|@+F+lSo|*Z)1c;29i) zdMP|~%Ja-QZS6L}ElPb$oH5To_g^IpZuu#A&M@`z?pD|$#JDdjSf#L+@4S6(Na@V- z&-m|uu2RO7bX_{bC8lU z0+NS@#sjMjcSztWV;f~vL=u}`Q2m_7$E2CPW(7(aqLNLd1twpXw z#alBl0U4LOouf4)Zjh|87?L*(hSM30NI-@28Na<3q`;UL5&3y}S3!dXFyZ2F2+A4K zz!xm7c*8M$vA1t2X3mK|cvd1(weuQAq@X4wU?!86%n@`FOP*BHE=)AC#O)(P+$}Bd zw6(RB&U51!Lk<^ZbDr551HQ-4!97wrW|xb%xWpj9CRZ#h7e+*28e+3_bon6&qLTZw z!@(s0$0C}QSI-PYQjE)2J-sqLp2=om8P?pu%hq}&np-P7f+TQh*v0@ymm>)5EJCGG zn>C6?!#Ovgf^LpP>^l8}M5vTw=0U^~EJ+b7Kr4%_E7)K?){l)5Ecs^0hkIZIO{~;F z#C#p0UJS^NaClcCk+$wVMnod$l_aK~ME8ePb;2rDrqBEFKc2=u&^*6k%?~9TU=)D9 z=FZM-KV5~yq5q2o2(5$Fg&3d(po^tX7iWwDoCo?-P$DpTQkxaks)ztfkV^oqk}9`S z+WWgS>ih)OjL~ueeGAy5%rPRA=Hcx$%WGdCT0gm_85JBf`>rkV)h_8xX<#Im*;)EK zZ$GVn(N_rO7m?LDjfb?qjOXBJm?y7MVaU6$SjTHzCok-Czv%~FD*>B`9*G7k*0}QM;oqF-rmG`xI4eqDZs2T&-?^< z%R!x^y`Gtjn#CKG7}(Z2(^Zzds?;F><0`~=5{fl zb8k^vnNpfMxANy);$Ca{80<0qBj^pza&g4Mc^A|G$co}3>(jR2Rl*HC&w3Z!$8^WD zerxRBT>9}>1SA_=TjVjmb*l?sqn7yR(stR~8(fdVKe{g~KJ8dBa@j;>e*f8YP}TT( zV7kq{!nA@pmwXLY>f* zO7NRjylrgF%8~Q}(kUG*`p`U)pAl0W&|#38gx#wbp7=kH?y{GD(=Qg4=-|13Va;e2 z@1`OiyU6e{X(HznKx*qCyod(7b_jvz{vPzE1$C35d)9j*!OT^rNucM8k>$ z0g8XjuDWnHf1UDWTU!dI#tzT(ev||^lPxY^UZvIER2@ABvLpbocBeW)6a$#uq66xV zYwfJUZy`E`Pp2WkadN5i_`a-U-pa{@1cPn=Mtyg?e|;W*f5e@J86r49=t`-RA3#(_ z^!7d$o4}mU(Xs+A6qF~@9a~Dyv({*m9gjrHiirWD`d0;bH$8m$Flg2pr4}mMmnkIz z{s6n_a&c9E?FutS@!V`|Muz#gq$z1mNd=j34bf&@rykmo(1Ra=!v^oZPUVk%FcGRrSWO`+`DNWI|rCHGig@RW`=D|WA%84uCLzda%?5Xx!-G69--=Hops zu^&pC+1||cMOsn;I@95A=Y=n`mu;sQ_^mOO z0+sZ_OxAq-LllADnLUqB&Ll%Iz76Z|n{OjwQUS`%ipD*0;x3)Y>ld zXX!bV?(E*uo%;)o7aA(b7i%Atk`Hlv;abMHp#VH zV6%*hHfye>E&P@EK;ZQ8oE3zl~U== zd~^xeYyJHEy4z*h8ROC-qYN#Bdjv%9{idK>)ns#bbD&T9l_+wp66>8o{ruMS zPmV&5uzl5=@@u{3uy1O9@5d|y=ip1E0{g_43u0Eg_zC2VIKM1uNd^D^Pu|L15;gW1 z>_310Jbiw?8!!9SxyiwF$65!ZHz-Ve`aw>kL6jQjsi1^?ln;Xv_-PB%4H2azrKGAC z7hhR<$1tJi0HguP-SL`E$K5!7to`CkL>}Nn3r12*Qw8M^sZL+G;DeR{+drZw2orrj v64N*hsJPW)QxTT};cWM&e>~BM$bz1H@=SHX~NuwbXB11tzp~=d8R)vCsu?5nti15H)Qjm!^@DIsZMh651h2H<~ z7dn{{od_@@xXCI?B5c9IB2dr_PO;|vXOh%*6LWX7c5;O(sT`L9OsH;v>9YmM%+>}N4`udLG! zPhWE_zsr}7JEc@hu4DJY`P*Xy&r^3+{Al*H+pv&5q#v-?VX!a-qKJXKfwV|Svcrk6 zUTT4&hXe3L3l<%>D|S9-XOd+bh11qwJ3tpgQ)Hg%QZwhJ(Uw#`ow;%C87F$NlR}`$ zi|10R5X>aHFTXxVU{T8@X@iCb97X?2{$~rNN3sRX|NFUJQV@!*IHH>Y>t8cSP?61m zV{a`RYW^G;u4oP%I>d&G+DGTXnKJP83}mnB1FXbOinH#j)R2Rcy5 zBg@1?ClgknNu&qzj&E&|7b|5m{Clk@7-6xndv<=l!ExxpEKW#sPS&O+OC%r%0-nNa zBaoLu?D=OswPcFow3_@gKd%8K2@Dqby)KPwGHaNWvIPdVw*Do}Inq(XG00f{m730J zg-=ApxB@9uWfS|Kj`gn;?B#3zpFY#oNd14kY^|)47h(P8CSY(%!xW{Oi$|(ByWo&p ztXg8qYocSF(dd|+yl9te#gXp53O;dn95LrOnQ_9C^Xt?{X8HZ#+v$FEiE{Z2nW`Ea z@bvOZ1A!+$v=NN${K=CzaaBD&J2Pn7eIB9B)lcn##bY(x+Zl)&a2!l{FMhd~sEqqB z=ko*P@9iy+l$Tm`M<)?b|JQGz7=4e_bdC3oBD${hPsIpy`cMyH{Q{nbl0{8j>3Gro3i4<%`0~#j__f zB(Mt?YY9rlixoy&UkxOp*1^D3KKqMgXJ?1{pC+({kXH~;sRwK8(q_DPUoYo>#M$rtKhKUfh%q>mt}FWz$)dROdtsM(#>a0 zDiZlYnKc(t#I3&Gjk#6J&}@(V0X;NE1AV3RG-;Iyc#kEM|KQ(hF|GKq08}L=J}+w% zG;JMO89|lkl3h@m$VJ7aD3Q{=Tdm^Q^k=WJwq;PPa4fQqa<`Vg*`5Pehv7E2&axV( z4SIkwVFr;E_*24a%SlFO6JV&UraR>~|faiEt) z_o=Q}r)UdAM2peov6E_en{?~T8y&{YaK^)GS_D=mW;l?+-OHtw0OR=SCu81QHl1YI2yE{N|q`AB(( zVmUfYGiX`4HZ0{G)Vd;1wPz=CQ^GhlI;+B(&MQpxDxy|g88r*JwhZMz&$hN)DI8{z zM7ezB5-S!Fn=+5g`ynS-7(a)~HL->X%%)PAxI;_wEdxTP9r0TYNg6{ zwK086K2~ZE*%TX==7Xg4H>cdREp5-GtXy-O0|Zwvk1PzkhKk|n1A^G(S6h&d_t*vl z(1;WwU7@*TJ)=6!5MU=&L&C~dvg*kxIS#7%Jqk?H>;CflST{IDv{33#X|S9yX;8B9 z)q3Vkks*|_GRq{^l(+*s&hhM`6Zi+;5{BnH31GP1F>%~olpIJjan)6oWWmS9m^vT> zYj~DRpGC`suo|X!n~gLM!G=V(t&|0E2upAgd&em!eQSC0CqE0*bKoW&7lN>A^rb{5tj#kq=?_q-tOUqb=4Rah9G`3ws7Uk{! zmLh=HHjIRR@g&z7pUAQ`tlG&>zy~G>{J9@z8B4#saVu&(qq=7VyR_)xwLfH zpa!l{b!^&F8J`eS#r~{Dh+TvF(!&KbTw9JdVc~m$+l(#Gu&J%-?1W-3njYiB<(cAI z&47I3Q0HFP_Et~u8fZ%BM2-)>=$&Pw)288G3KJRyY@Em|-`$4K#fPbwBKOC4Hs~I( z_meJU(muThKDjHf3e3)RyfCTa87~*aJ)4+wnxDLeG#UimG`M{-M@tx+D5nUp!IRm2 z+s@TCvqjWz>jR$`-E;gOZO&UyDouGUMzZ)p@KuZQz>ioik&;aoVFUytJpAGH3W*I> zO*D~hC=+Uca<|56QMFB>VQh4effkLF(J|`h#j{Ig=N0aZO^lb68Al#FrW_}}%zH(m z&$Af>_CIFQ8|SA~zs+g#-~XwYc)sR#uh$f){vdPWbH2u3T2@w4RmD0CIk+z6_8XiL zD3;!Rp2vRod|w}6$uV|LTEPRtQfoo=j5}Q>HiC;*gk{$@_Ilzpnmj;Y``JUSu?WgKY>tA2oDFp`XJ#Bc8GPD5%L$ zZEWa#rF(v2ze*>urz|wY*4c%!Cr;_<;TrTYTA8Y+G))&ZZ8~}c%Q5^Y`mB1m$U-#b zhlQHjCkK9Bg|`Ov!RXPKA@AZbJVOK}O<6^g$uLiPh{`=&r4z5WfVRlivEci?g z=AZl|$jqcfyp39ye>QAM*9;PQjiRmPz~RL&&s#~ki67a+#BD&(*@Y%$kd=qt;7o60 z&kq`vJHNlk@8KCS^#yeB4T8zY$Z_O?4bm5E`RtLI4L|WVdV4)}5}t4BgbFDut(MYw zo%T{~e&X+mddL3wj$XA?xbBao+o=*`uHUZI2FQVA;)DERWilNL%;6R7Lr;n9>v4oX zO)x#MtW#P=YcevwF{FkzG9d8Qw=5f;{HmCl43k6nfG)3uV<0{sQ34Mv$WGBn(trf) zK6a%z>a=K!OInWpgypO+YDJIH=$fIP`UYd+jy5~Tmb|3WviAWE*or5D%LIG*BIkKl zT=2LSx}u36BBbK7g<>q)Eu6S9&MHRU?_f`}O@zAVL> z3;Bl9$(Q@8L$>+pDA&b)P7zJlCpnn+y!;>-fpGatQ|qg)^w*ERHxFNO&XA@#(=#@_ z6&?s)&d->iU(cB9wW?S*W3f07#ho3QdNu|5yBA|)C;0vl!enZgn8gJ9G<|*83Z%K^ zN~*Bcn~WWJ7zKS4oF>@$#mZkNhWV`&BG1cxE$!)G8~}PKZOs4t3hY2R=jc}tLkN5; z?_tZbIK#ch%InpamKW6rgMDn9{p{dw_Qw`k5TT`?K0g0lqY7{B{fnR)Ev4}{nteAQ zX}aWE;67U~VoTGOd+lqg2dB~Y>AoPk4+vVLyv$P)Agb-7;O9Au7MFE>K7Bf2^6yCE< zNst3I+6NX}B3oz__W7-{skqBCEt*4oWlSY=*Cetwy*1z0iLLB?gNRqb{}ZCc*%l?zqPISAGq?@EQOxYM$-3Q9|DCm!T2+!}v__)G-D5#&=@x}DFfMPunp<{nr)KKgp#D(t@q zztLWX48@%NE5Iu$mO@0t|Ja-K6Zd#`!MDdVl_mnF#v>oEWE_e*5AYz4bb` zlnyt_q(Qf4HOeemMHrGkpU`_p zd(dosq-Dv~m5Z-1SwllZ*=_XvPGPE{X(AU}sM_YfJzQOfsI~c>(G&Br z-m%+i?U%hM_G`^96G%f^zq-0|t+`syag8WoSv&73&(6-E+Bxv|vE%+;B^QU++5{_X z51VK;SI+lctgrOqZPZ4zHGS1$4#;7WwXXtQ$NDv#I(a0{q0*QU*0?Pg4KvJg#vf#c z$L=P%-#R&JYk4oB_H8ZIm;n{mEGg=6tgo-*hXoGp>LfoI;VWP2ZFUY%O)5>^iz18p zR3yILrOgH-64l0!@OC(k+8p%gja zY1EI~^+(4h@v?>7vF5>WcRVTk>$FY9#RxhnQH@CYcSXt*n9ryB-{M}Yqt0uZkK&3@ z7_xBBS2ZTU=bOVRD-G`}15BwVr32V)2NWTZ9TIF-6zR~W4hpjDhG@80N2%)?>i zX7BBa92YqWe%e3{9CF;A(3-y-@!_eqOXe+ItnA36{!cNLrT`-&9L z3b^if^29nHPuX62{?`KY*QL-kOEKr-i(h(KeUE$j9W^;kKvB^+ z-s`lv(2Ga9_Bq(<>~jcLvx8uLQ&`@QQAs0HU3a2rJL01l=cfhaW6doyRa5tA)Sg`u zvDeF?biBAzPH=GO#KwR-3W?*ZXK*ouwQ|p_P7wZerZ8GT3Sk+A>(LRk@2{UjV ziS#=*oX*tQ3to+^(T?5o%=^u9?*~s3fTQ`&zbqK9IFu_;G2R=pVcU7j_-ScTJ+`RG z>wF1G_{m9RC*aNW$JN5qPygNMuv0lE3p2Xf%&}1#n8_HyM^!v4BmW$MrtC%m49~N2 zE47#??0lE!_aAVO40!p32&HA59ioVa$_mQOdf*z=86*Wsr=t8`LSN~~UQO`8VZSU3 zvRSOJm+td<>#wdp>0S$)C@3gwxd~{QW7X=JlP(!dn2YbOY4<8*G0NZPGYr9-t<`lT z$XWSM5JY?q`b=4Ko}e0J)5y%o$k<9SiFvsrnk4cli&6ae@xY4{)}53nz}J%~x4DU% zHiHv4DqewR@pJBG$3zrmPx=+?bW#bDY!Mgw-RI_#j-V9&-u_d?<>UZ2^z9xz0<({^dBm)}{}F`(&_5{SiM(Nd(`zu>?RbEr4WWLEA?(_)w? zE6-?Z4czDvEp4h#j!g6AZ*$3DrAPNH*T6c4hrUegdzZ{%p@&0PYe%Y;R&53SJ6135 zs+Qu+*^&*oTzNQqr?`~#tc+tdl~b6PXEN}rT1(}!8O!j? zCfn@Y7p}hX79PSc1gK^0CO#I1o-qDh0qX+aa|OK^ueDWRU6fDs zFjlpT+u7MoKlzrRqM^Ny8!9O+W$;i->7RZ@GfgSpzURH$ zsA?{|(~9P(TV_xI(+B&Do-zyt6YweeOp=#3PYq{Kd0g zMa5nC!J2i`+k(=r0Y}>+-KeW3{tXh#oV1K16%PM!@^(*=>)V`ozrY)~4jtB50H#YY zPIV75Ss&ZyWH*Az3+|JgnVn3eZM}3SwR$U}xpi>dTS0S-#TX($DiV#CrEzCbqOz&- zs4X+uCm@A~hmSnY*K`)EC@;4kh|=OKgtP>|^946!e9VkkwQIVpS!}uv%p`=Q6x*^) zOiXx#Y*VS4&FWI~WWun6*+28Nfto}@hitY*eO~1{JOHXBTO?Ai@4GTzS=HFwS{4q_4$eNR}JaAWU#rDAXf67X=)kbM?lm5uG>P9i-7Yqm`# zgVk#3Y|1Ak!PB*%%Ur}PJJX6Y17&M#drjE$mdhFo2`vs&I8nOwd8;ftxu028pm3<} zN)>rZb%H1ti`loJ{n3g2X+h3jt`Stvhqe}UNH9$GKG`9QP>7O@%>;J&Z*?{B5uO)p4D^NqQTE5F*Z_zSO^4t-6!P2a@lut4w!ChP)Cl^>i z{&xrl3ZLhW)bTvefA1K*JSi-?!>*lcHLLKGFY#7@rl%rQB;t7d`Y1AgJ4Ap z?}Vc6l=t!HtlueS)oMfFOJ=5ZiL-MvtpZm(bXor&^T-gIX1_YmiOgNrp;kNZCXtb@ zF1Ar?a+{Qp88~1!-tlyDFid?f?bz0fx7nIbqG(}xM21AO!;tG=9;f1JQ@W4!P&}5q zmzzsMlRN{3B$)s>7t~~(72fLtrT(vqnay@~7LzcKv?3>ko*WwOQXPYs-CDUs`&~w) zylT#f1d?HQ9hLD@RoD~`k!?-h5935UwGERN3jy_`S!9vdcj4iOx3p2~?O3Vgm4wd& zJTc_O2W zhJ;gNFJ?9PiHV8cEn0a5goMAe3Cwp0f-iFZUaf_GJ3_EQY@BPkU&~T-}VOPm`zeU4`x+)es5HzVH*|)dod13Tv-3 zTf_H?*=}`>KUI`ml#lp;*{Ag3Fq>Ju?d%|ImIg8`D`FI|EUj;lhimx(Q=E;9>p!|; zWJK1qW-0Ol@}h<ou`VCalH0+9 zVMj3M5%q(qxkM&Rzbfxvue^LGkkPbEy}X*OgH}qm@s0dE=5S_UllYn1pE7jMmk&C2 z8scTlb#|YZjFX(Yc6L{XXb;}ncXk1EW4U02(acDVpbPZVhK5ou{$Ui7pG6$|L4(f_ z=|oaR-UdG4D$1X-WL*6l$sLc?{c4lFVKVvec`AHVtccH0_sMoA-a!8V4gir8`(@FH zc=w@GCSH%9i~_c=uMePxY7t>!W;OUyqC|4G$uKb9%URDhaBj9%r8J$DiKS5azuv1o zpQ(MspLl}I+5Vsw%cst0dV-#{pq!74@hz6$S&btu7%|%hhN7-8Z(Luwfn5%a71J~+?A(#lH1ltg!3POrUjDl2KzA|6HVW_KrUr>@c>W18P~l`WR@ z=MHtlzJFtJNrgVi8vWrCLxWX&KAHX^eDm1&VZE)hGY2@Ze7Wkj*1UFOB)uKE3L%M{ ziKtJB##%p6n@#dF?>4HN6I6(Jn261t`FBbutw_&yi&>)sEha0~WPVJy>}Lo7z{8j9 zaPwHQ)`p1Otn57*WqjxYjcit7?qOd4o1zb!ZTRJ>Opr~HBd`_t-E8ctN7*=Y(|XPE zO}JL@L?*BD+j%3S@795oQcSVh{1hPC)X@?6*eb-Mv_FH~mY z`<8T8lH-F`gP|6ew}yY1gz%FLtBt7Q$@8y|!xCEaX@q^$96nii!S1`>0j7L|yV(?f z(0-VY5+h%<6y;Rd6&#BSTbH?APPg%1`fQ#;wTTNBLOK$$fkxBVjxFZCt$#gu_6mCQ zw^>`mISjImi}5s4Ybu2%ow}1cL@M|>&Y_0wfo$++X={&lV=kwO{i2@1_d17XyKQUkHbLO#Qb&lc50s%#QJTE77<;N)T|g@?(CG z2EAXLEi4!wGwAd z=v*LokU!k-MW;JgiLy+qR>cZk!NRL4>A?qZQ)*s$-H5%=W$liitT8{^Rl0V zJj4D6Ia}Yq((7EU4oOv}g)oZPs3EiMZ@@R<>NEDM%4b!BTX6ovPL~m}gfwN&oY#GM z?z=NmLd`Uqy#7(|`%@}BU!>V^6zg)=>q)-`wal`l|Iq?0F=1ILk%CW(O@BA|Owf(B zJHeS3bv#32{`?sw^mbz#B|;Y(3wHAV)?}p77iD0gPM*BLw}yR?3R4nvUk^?MXr?Q# zEWqI?fZ5Jpc7xH?MaT@Apn-HxmRfjvkmrHi*krjZ6fQ1zO1o{6akJR^=-ecO7opd6x-cb`dhRGCXDui4vCnMR$%Y*&sQ{YD=Xg#qG!7 zI*h;8T9;td(TE-=)P+(_oym~*AxsIxJ4J;vhi-@gF=umgjHDxu=2cE9~}x23b6p!&AS`p8P;C(Op_RF8-6SpMyWEq_DEGJ8T0#fBpYSN;dILpqXERS4!5Q!(q# zK^yC>%iWpS`I6><1`#da0tt-dLBC4$$Bu34F?4Kf>}LJSU;C?6u;8+qto}Xu+m}&1G3EDE7-o z+tOCp?e2Gl+(dXU44XnE+t{8=em%~*763LHIVECAk%!{ex3#7ngwokx>!&?)^fxkF zIZBcZpUE0VQv#9Y9*g*ly=&<(h`B*&qw%wYE=T%jjd_5e2LQ$_Qau1Gub_U6U)5bw z?+|F~e)3SC-f5WKRi^x=&ecC_V6su`=|?S_6FI6|7PJ!e?#pECq%Q{J7}N74^TaoD zOhhJKl}yT{xl2AAz!i(?T#lUtIlx5q)FU9mHdtt`loI!A1lL;{cPV_65F{P4tlLMl zg}SpZ+Y@aI_YZ)1hbXNc>n7b?xGpalf1Erig(${`ub&#ED@bZ|>+3b0y7kwZ*nl(p zlEeeWXb?a&YdUdz9oMR62|Mg z=>gn3gUCk|LT1|kknLwb*`}(Sa*)QE)o2@j3evT(*l%aO*~f&5#gHV(NgK_ybOs+F zH&%6Dd2s!@Dk9nE_c+G>NYA6S`kOKH?Hc`#8t{3dm_OY?IsfMEA!ws|-Yu9;n~Tnxz*Qct@{9oGbj5?bGTZwniC}AZ zV)>@)2D4qk>b9>2=_0Av-CtxnZ)ciI8elP<-ztxfvR~X64Vq4$Vx=`YudWps$O4bZ zg&WdP*h!jxK%VT!>5PyJ5FJ+z^D0JbeqVW%K%u8w@o(#5cWL8Ou^88bJ~L~7G{xMLgGat2V`UL2{^5@|-^3a;sd<;Y&>pv9PAQQp zVzV*}*PMl0xxO`7qS&mClkRQOiXIici=}grt;sJ<2hz1TO~st)CT3)esAX-^16WCJ z!LPkm@E;1?W6=)y%Uk+`La+#x-9r^7QYe1kEVY=8CC|D5sK_qTWGwZ;R186OM+K?> z?jXGFHRirIzyCvq!0Y}no9+sfEO@_%t|VGaCr7cON<&;W#>fq}Xf3E(mue%xtS`ZL zmPImotoNje)gR)+k4j-(QVpgS8uRp7|aAvfqBKt_aQMNo+-ta2Jp-MgJJRx!R>o5^}58Y6tna(ksHnSXo* zC*p;9Uj`Qr`mj|jRYa1iu&Pyg)Gm8EZLp?uxPG~A#14G(Nox_-tNLSqOT5>@X}bH? z2Y8mY-f%|;ODAZWq_YN=QUjiyBOJu^_-Z*Pwuu};94;1URt(AXw8;S4nwrs(8zRkH z!(uK=0338$Ya!%TD*VtwJeRTx0Ct0Um6)ZLtf?}cX#=bSZHZz4lL|R$;fh3zcd#&rK)qtQkr4P5xD(D#f+wnD43YaOX@kA6s9q= z>7~!Ex5U(dW6c&+<|~O`fZa|K^KrNch1RQc0oRfqiP8bHg-!Pd&0CMi8W~V zaxqNUj*X2y+6=|K_wCFAxfy@~RT}@Ib%vCcmDMCTA|fK|1l7RI%RJh=mkW&!H{I3_ z{v%&vk6^YEHYz-5!-XTA3I}o<$OmuO!iqrsZ`R$kqM)yqgr z@ebp>YImZojDX;fmN0wzcbGT@-~&xUim*5)g%_5WBT6T!6wm>2UPNJpq z`**Lht~lK7Jpw%3-1h3}31faJ(cE9zh!Cu|FEAH+txj@`)(Ufgp76TaqP=$ou_Asb z(EOlM`zBXB3ryXCeyUvI;rY2Zw}M>=+uu`nPGS3uB1Hsz#rHtN7*wrw!<_j(Go)wW zE~slzV@2%w#tjV)UOv6>JKz%%W+>hI8mqx&GJF{Qj5R>XH}}C*u!xiIkI0l$V{tKU zaW>Eu6}qHZu-azB@(_z*dm2O-?@@SCvEC7Xu$^Cg@h0nvA%vVX4qVQDlaqDw zZ*U21@!@N z+}kssyzAOE#Y@~ioFf~Gh3AckfJQag-P+El%4*PNLUxzKu}ERFh(|q6qPu3=9Af4X znPGw+XE>T;Y|$jkESUZIIUVaK&WLf{gvg8cajRmAET^(LZg{~LT4^ywal!9u3pNd~ ziWIC*&m8=UQPf-~_|1h}^R8>{T}<0?N5n0BQUatV(tZT!sUNC{hvcKrWs{xda{Vzt zU2pzfB4C4;o?$pDtR#lm; z_YSb9NlY&uochgh6y4J>0jTD}L<_M2oLJAZ&1H2Qn$vK*pmQ0GuAMJ!hs0+MRp88i zZRg-YEZOsvJ(%Dt&Zo@A30R)!lurjE4|PUs;zPK{w5f^*v5NbG8+h*q#=G3Uat+3E z(1TlBSl58h33v`toOPYd6q;7No6UO77T|f(SDZb#xe&h))0oeKu(+@5SI&8=Ike93 zgN9DTr{t|r;e(e$#lQ9CRZrV}OrInHgQ~E_$4^8QXK_zKIw@8LR?Y>q{Uy`)^^_Bl zvA<4EZRx>gp7nnYYuE{A(jAUGb-NvtT^oa2E2mDTTEv$NAAOIPh&(m_UEog>!e9kA z@wO$Jc$7C!R2LO*dc^&N@0P^RvQ|BT`qkei{WjK4a0w9rL2B_7TA#LaY?=?Nh6X6~ z9*!Y_$<5v|_oP)!b&+q4#N^m5ipk5`Nh7w=mVI~4-p7&5eCD_vgf+r76utw9PWC=F z@vz+UP6_ci#bO%cquf25nx!5?N?zM*CMFJS5&AmWhOvr=c2L7+>=Wi0C*OyejQg;n zblimkk|TZ;61{P+Y@c;;$nd{mhA_rJO3dnpPUdP_{2c4{bsad;6(%9LU$u(E#QSG6 z()%@MTin&)JXB@G!TmB>^#fs4vf5zlCaP`$X%tJV*RSk%#7JtxnK2H5C-xxMvJot8 zP8Yr>K`IHErY^Efb}%vQ0{>mYF19v@$>sSwRA`|k^-JQ<}~A+(g_1ksWj zgOoPyN_fE7&Jx>Ygv|@&-xyfOrmce2hAi(M*4X_@%u*jo6)7UP^%g$|69^tUmIF6Z{1e@@fcKfW%Gy(e8!iyac)Y&o4pc=0{1w6)hEYgB$+ zn*v|7)$=PL-rrC8KA&Z#6#d|nJiz0P10yb zY6-H7iC~Z-e44x=swG=8Mrl5;M>r+XunCij4x~A+>o1%ZMRH70HP&HeZwE_m{LQ7V zM8$8Hx)~|yYW9F%xYd=j{dBR~2Y>PGgWt_-NDOW(_7!|4@=0AkFM!Yev=pwGa{t$F ztSpxD+ufTo!rN7EGe7$={M&5~2>`UH8V-v?uB0FDQ?0^e3b_BEc3$3A`0h=jegB*! zM0SsbH&z92_27m!p?{D@i|5d*-|r5JlSTeayHztKE`WaV)c8=vBnF;!zO32~6bWx6 z63ew{xia9YTJ@kkBmgK)XY{M8if>~&Dt63ECp>B1U|86^jjoe3hZT3*v3<{JZku_ zywC5okyzwzrI{6UrQl(1o)~nDZ*Fkd_ZQ+psrPnRzKHs)3ml|sTCL^%$TGhLNOo)N z$)S^0_Ze}GjF2SqxM;(ES(iF4V8eAop|o>h?)N+Uwi;iHQ*j61ZT#uZ*1P6h26(Y* zJt|cKNP1_poE&F019jJMG8?HPw*1uTVCK3e0|{g95KF_*f?J?uytDR!lK`zL!DJk5 zQ6gxnm57`okg4Gd@oBk{Kw?lNCCF4b-AjM5%%%IwE9cm`RnkAcb7L zlCE%!`UunR*fqdpVu@Itky%`GIC^4@7YQI0+svichD z4xNa(yg8umd{oYZzhsW2lK_MgFnwxt5F2mx$n!aPCz&!KBQnC|Sbh?uV(U#W0uu-Y z0P86!16FuOj9H&NV@W=FjB_HC!`n<4(g_{9jw97Di<3Of#Zaa*-kY22}%qMKjH zwqYjD+r4leXDb@@JWQ#1c@+9Acp4h=DC9^3+<)oSvMJT}YboWOAJ^biHF@c9HJMiu z%i}WUrv?|vW%R*ERu^;yPiP-Xxi%_Xo2gLta`yd zg)TV@Xn^dJgH$2&0UEryH4}+CZ>&|8IknyuFNF3W->q$_RXvPFd9su_ijU$bwZLHK z9-T`X^RbBcEvO^L0(Aho$A{ ztu4=e3eGnxxXK`G(2&BZWeKHvuWY06Sp(;%?^mH@8LR&KePfp@KYE2E%Tp4WT22@Z_?H>*VP?+*V3a zf-iR`x|Q}W)F}zwzTDcg!nW`*W($o<;tbZm`iI(fh^;}}Ss#DU*M6pWE=%SQunP>k zv%@tJmCGb>!X3de)C?{bkjNs4WM<~9#nfiz=nA-l2P9K87fP?!>f|;al=E(15Z?`y zqXtq&k0EeExKk)Eq}6LVs#M$A{zUEgiPIReiT!1!Dwg%7xvZs=6f2efVv;JsD^a$ zB2-AHqY6P%iq!=Mi>63aT!zHoF{4U2Cu7w_9;vg)*xxn*81(=Erxn3lqqJeej|@nV z4O~faLu~5$Mc%|K)H+GS**mxWyJQOx)5}DjSdgp(h1QTa5S4&Nn)$G6xHV+fml-Y^ zzU)QZ!omoI)6~UsHB`Y<4VRcPvn{GY4J24?a>>F!V42C_81AJ#8k!dsxkA%njWXzf zHG_lf<^bOoz-<>67#Az*8C5m&O&kZ*4Swi^hJq+^PLy4LPDG3eaOS_}h8vmo6#=54 zwk+CKZ2d)hE9q>%`IOou8cP~Cf~uTzJw# z+xY4r6yUrV_90ohjrb@!kY>yF36pkCiWryQNjDkb7R_mB4DG}?L3b&mS!k)4LD;lP z&NuT~tVf+#mV~(geCfMYR5Ugzp+?x@r?`J=r>idsYxZ8r_T9U8fMjtD-kGj8i8Gc< zVvqUIwgo?|=V-Qgxyi}Mg{T%4K!E93S&NG-Z9b@FXDcYQ0cMOO%44`gyHItyZ? zCJ9!@7i=*Tk4N=b@-4EH%yYY`jh-;A%skk%bL?lt= zm9=zqw)6zwHacJ z1D}B+Mz8U{tH}_fODl0K4D8g?%hcN2PN0cVWq!$Pt%Zq-XZI5+_+Wb+`VA7-b7|wX zRmb0kLqUZl1^rG2HE_Ok%SHFSsQ$bqR+L`B*uqK9nCakyt?DIhYHBL$SJhHiof5an zkU6D64p=M*=RFHT8Rb>4aY9}-aIq&QQ7}dP?K~`#&>s~{e;OG*MnfTc*=rnmx7Hc1 z$ZeTwFuS(}#@qFMQiruzDA=u+Yj-&rwd1sO>yh!InTk@3Pst9;`}OOWwaEaZ#aIe6 zoKH$0WnJD(&%hVX7E}HCBb0)rj_9wc^Yinm&jCbb#Hr<4WduPNSy`frR{7bS@Op$} z_j?@*G5I&r8Nm8u@ zst<0CBeY{^86|G%+?AXe^uHf=2~drPQatpfC$YKymXEknudqOWEY5qQKClI&QhjZ( zMLuwFz*kSzv#DVCSf0TTTkOGQ7;Yg;^Ewa>nKxHNz+PhJXvj&|H$4im^za~M3;8)y zlGdh()Q%ns-y~i*yY|H^o8!h2&XdPLI$NG1eL8L3B8%5BKX8 zYaJ7rbrjlY&sWg|4_WT_6^u=$0Au&Fzjv;=oFAa-tL22p6~ew9b1(*YY)T!ER_HhN zNGPVaq_?%K_YK-2paFt9x4Y;TU$cf_qmD}d&J+R0-vr<7eG27i<_s9H*^@&`t+(jk$RV962 zpaPFht%)aw;jv`|h{{N`7ZVd#2rcwFIEgA8ktM7KceGl~zaW}8vYanlK288SGTqwD z79cdjL8s!3M9=csw$uQ()ZqMqS5FcM59(EWKynweEA$iK{v6Ret$EaKqVe4dyVx_D zR>snep{&fNo{FGb+i$bybS*)ihe>De%lE`@>PagMV)CGO>+xLq+is1=(LXE4p(U3w8#y@-ltmza z308iLC_>$6pY5<^iJwlIjL%`CEBdMFsO4p_x^q1>F#v{4udio=adE@UhGLnupTBZf z>sjbBlIW;?D$oedv50Nh-rlB;0ezF6ga?Sy!RSjaugw#}hd;~{-W7u`{Qe#+-&wZc zr9}{%3;q1k$DW>^jxH`(Jva|)s%q?Mvg2U!{E#e%J|j_hT@B!+x+x=R8hCl?T5v*N zTTC9EodH+r``SBTH&6&zwWmBfb7x^V9hiR)95Xd$Ly;?C`!nn7F@U`C+Fgq`RZTcK zQ!U=Rh}T~8HNN8Xx}atf`{#8OCBbPO2B&hOy*W8SPJl194D#ne8<*c)^^QdW96f*L z;I$C}&x=qfs!8SM_7)2f_Ik0CTJ_Q?YTa?@%SO~TkB9{#083e~7)B$tp6jnTZg=CV~P2CZ9eS5{Oo zYp;Hg{narVIBP*&a)kH}K8RlGW2p|UBT`awGV@4_P{NG&-Wt`%Kpg8J-t($`jEfDG zY6Bzvd2b88NKBYq!`OLB7jVjGkl-gHCJRG)Dj;M6h^gctLgXe?!d7!Htv!&DO<>Ur zvY`l)jUmgrR=cQ~)J{B*LXhF?8e1M7i)O(^$4X<4vG_oYG`}?`ll7vQnq#-_c=sW@ zT$=JIot#bQS4(eL-LShbwXANPaEw;(?iCXwpS=-?z9cy?? z+hC}AcSDS&)L{xTiXr$|kqb!!95MOFEhMt9wAv^Bi#E!(N892lr3dxO$_nyhyFgRS z3GY|Fwf9gurc_x6Ba`G^u4gk@vZ;ja&;v&QqXigz8E%0JZ|nQ9(BhGqs=PKk+NcXo zIIqDHph-{|oS@qku83@8AY$IQ+3kb2Yl4x^UJY9;!BjBE?6y|7;7TZ(u}M!UOi2(J zvPoZmLFF_RE+VwQT)|UlqbSO9e?Plu)B1D6VK;2d z`noEKlCqEhHC+8~G&IMsW+;4I#UYKmYy$E>K5!p7&4MR%f*U;+LwedRu#ylEKe?>K z^E!R)>v-Oezrdj5^I|Pi ziZvyJJr$qy@FNe2$zmB}g|2iZn=rbO}gFNr!;aUD93B(*4c3-}SufdH?zDwY*W_oU?y> z&s=lOHM95b+4;@VHN#oZAd2aXs>ta-3w!A2_z7`6Hd--)k{7^Y?7og|*$ z(il^vNaD@T`Q7;m%|lNnEmnhX{70?Zq38Q|FObUGT;yf<`n;Uj-kL8>mOVoovjk>L4|&bmE2U>_Eve37nuQS(#^t z%1T^>0Z4VrsMKm=DfDz_id3hvG+-y_dO6#FWRLnje^3P(5BoBgj#B^kL{{^Ap zWuk0D?eV1DJ~;vJG)>H%y6&PFj*Ipo-jW0@s%(rAH2No;+TD{0DUZdHGu8z7SU+t}D6h;5f#sqc|- zvx==j#FU?Sk#WHvRmCkGzJYJZHc2DA?LJ8o%cIGY%{KBW;+=(|dFA%hoP=TKY#EiI zqf%O0T21HUG{{_nKbs392e$-FZ~Hfwno{X6v+sB0SeSXHt*@Jl?q6InXg$?aBelrM zAN|$(VEF8;V%Z^zUUYOG^Z9VjD$bgH;ofl=as9QGOjc>nF*gD2{+RJ-hTt z@swXn@&k;hW-<9WRn*A0{abc($Hv>*+p|=h=kyvfdweZ<G)J5a;`1=O{9+dMvl(jSz1S=a^%1} zQ|Uj6RWwph@*Zc^GU^{upxsS)EgO1Z*BW7_WME%bn$4b`P4RmpA(CV?s}OlU{!9oZ zY}ZBXb;)?v_=$C=Qm)cFDREr7fb~31525GZUo<6JQK2skMehFru7e2^CVKK;$S41wN7nZV3QFLu0FGV?+Sm?=uPXVqYGB$ zOtxt*X5SgHx9Q4;l^!r>UAn_cfe~EgCxnlkOoRKzCA2ivN4j1QN1ts^vl;d)y5|iq z#2R1Qdc1zNONt{)kmPUo-eu+JldtryJ!N*gB|$v#&tiKz78Z`G4yt=er&keIT`e`z z9;%b;*^`TlLX|06Fe&t8M>TOyc{vfFuusnFLH2=X1dgInN_tzqX@hS}3c|5V0E-Yy)}o6=6{ zkQ1`wkD$p_ROeMzpBbbDq14?A5g}(+>wX=Lqrr7PecDvaKl#ccdf0YlFNmH?Fm5pD zs!Etr_C$xDF?HN!w7h*s>`8ilZ?9QE68@19zq)?udjhMpHzBt8QIt{dl}10zq|Ehl zs|+DiRE)f2SME<4XUxp*>|W8E?y>BUZI61#bvipwtHwi| zRw{p^u*1sO2W08gb5O>JYTR`^CBt*Ciu2gn*%g(Ph6=1ohy*`sYBJA93(*YxSzRn@ za9Sh3W#h8Ey1IC9By6<(2_-3@U0wauVX-q^>Hej;F&nEyve&?1Z7ol5NXSKc+?BkX zoLrL)J=xDC&=x6d76&7m5iIeP;4RP`&dFT%FRLo12du{ ze0!?@?`+ia++mcq#ge?b>ASfe++q^E{?J3}ui4^J#v=v;)QMbdewqY>I;_uA^>z4S z^!rJIe{C#Xc{Mo5G11U$aCGe9xxFU-R(f$yA+4uSky%!r6Z4C(QWUwpy*)}TVMAth zbwX`zZFz0`Tjgl{=sYZAAq%#;(}Sgl9`r>RIWoC;#Kpu6jEsy_Iqlqr zH6RERS5i`PciR3e$u3y;GAMKzwW;hY&L53|mVZcLT=i=l-&lmy)W$5Hn)RbZ$S-a< zJ&yS@iIj-?N!&v7hkhSJ>YI&GDq;`?iaDputyP5 zp|tz4SjLhQu(MTqG_p<)xI{)p4N?3aNkyZhd!Y5MwoNE?m551l{*q*;f;S%3ui0%a zg>ztZ{V@#F?4T>0koF7l?YWAOa>MGkmP#e2x5LCHcga4= zc=Jdp=W^jhvbu zqM~gUQ#GA`--srMTmAm^sA$uNQ?X8axr(kkkJ;rkx#M%HfkEfi8|u4~(mXEAOMMg> z5C3pG1g7#bNn;X+MD=v@TG?6l+03h=zGP>Q+N4BZICqKIOJeHQ@XGer3b_aTP*ICK zgo@OH8u`#c=Ug=_g34dG2}* zyC-2}mY^o~BBzL&$6StYy;&ZeoY0&`BcupZ?g>u=(u1dz{`E>7oe{HzVFWT-?#BgMs+=v-aLKX75|X5DIp7kjg z?~o7Ub&T9-?pc6G%kU=c>AJyEmDJA$94tMKWUKb}fUI99k2dVI;uvJt8s)0B=yGYAdvA|gJh^n20D zHVdP=PHYJ?*VjD^Wv=3A>JbqV2TyOew4xI~3J~8LxpXAC{Kw@Sj}>#rqpSDw?}5^_ z+m!jL4oh@Zvdxa>KW#!$(!5IDVZoGO`m-CStBi{nfwJj_8||u-$SV`SJJzOA+9wA+ zM@BUkgPvog<@>5Kti2?4O;>KBi~>yI5^FhU7t;^LYpf^AOs>wFfBzPTU6g%1&vyd3 zp4uobCRq}Zlpy;F=_Z9_QsxTg8Itxsls7%unaR%1KIAg6bs;V+b+~8>rnYiCC5lBx zN%4!fC3aKOM6J#G@goj)Ieun4vYq-7R#8zQ5b0(+_zl+>b5PObKuO00sq#*QI_2C* zxR!7gk$_w>mv5)>-ybP1)!T=>H&qRv@T$~|oShtl1%e33j82<2%l#VTx3;WVSXf^5 z$rn{r#KgrtSzNl{z}l;s2d3aw=^W0^^AOorrqaYywaCOe%J%@LZ}vP}oi30ykAN`e zIfJ;2dvf?8*VBAvEu~DhHiD6Lcl^V0-r(Tiy_%;Q{*rM;B?cZ+bV?GK4TqvgH~fMr zo%z3oIqyFdi-bObL+bXw1`8dLWUdXf<@V2c5(lMFWSy}BEVrM!M+#|1BSp`&UJmYu zcFGzBDz^XBozNg-70TLG7`rUyY0JSL$w~~qs^Mj-W|YiVe$FhSFJH+K@~r#IE$UGN z{6!`_WFP8>%8@r!cIu~(UkTri$T?f*%c7|_V`Gl*l*Crq7^ zY@)f$p9~T;ud%DQii+4}^jI2vL*D8mBbH8SqFw4V$duWl26jQPK4enYcsetGUsQGV zEx(CG58IitJ`vBtZqV}?L;4dp#Id8H*HS7j@eIjVD`%c5gr$0^WtNvO6|+c9Mny$M z(v)ibupQq#=ebty3!}hPKa_iwy>bdP?`kP9M)Sz>HIUfANRq zmn{Jwc8Wx75%l_-VP;)J?O$ze1}{I(D#hxRP|?z&Rl4tKXR%A)RaPR?)cg}XN?{o3 zR8jqStDuyby;o98cJ5erEx02Pb<%{vr>l77;6s=z4?QJXjvv)p#5`3r4vN_ODP?SA z--Lt&f&HVuwl7}12n-Ds&G}127pX<_@~tbbKjpo49#2~ef?(P081}jZL1)xxs?e1( zDKeU=BX+7u<3QkyptRCiRLUP2N(U zj%pV=cT`A=As2XYJ2XfqyJT%tU%y*5UiXz;So}Q!hK%&DtxQTWK@my^H;hDm4AGA+ z$e*VDGXIwf~NSBx)l~3@vsS42}29Gx6 z$Wr87#?V@c>NYiM|G73(-SP>1o|>H2SF(mKQnGXLDP1WaC9GvY8RbJ1%5^yZMBW?G z`c$OKZMGy`Z|#X(WqfjHDp;6>LyuTTgPkMamLbw z#Kd_&n0>5Y0Fu76{fj^H+8+wQc-$P196uFzM}I+m+2&YoO*4;E;kd8-h{v$F;4`~jXj*Uv?MYTiyr*V>|G^t0w%gQ>sm;~u^MwZdDgMvr$PkSSVH0(PE1Z3KC z2hCArr9RwN7&#~WAl~_lK#{E~WO;Pz>Z_V?`oxZjwgnMpTHE1*;&loGl4PBPapzjQ zD|>D@N`WB8lPJNP+2{wuZl@9!UL+ZOvU8aakw3Nn#V08+v8{X>(u*N|*QP`ga_tuJ zdq&Y@lElb0=(oeGs;e)Sa0IxgKaNh6l0WMb70Wwa4=>em*4s+gjyjhoW7U%n74BVS zp|fvq9y34ro;%d_XBkzz4PzFAB#Z+~zOZ0%hX07G;b{gJ-wSnlx#j#bGRcSs7zGCS zf{Hwk%UQD~l;7m^Ey^1*N-NC%HB^?O)4cCaX-3ZMbxFBf8C4UvWzPdSeR=lekc?*Xc0@F z$QpXX$@Espc_fVvY}3lzJiV-}O#Uk81)DTuUuerpESG|n#J{s%73ZpsYfB7DKy(8wnzSMw{aUHO(Lj>yu{<;8#V++*<}!e+7}sHdk#_)X{5eF_Q+ z2rrI7o9qdS&eiX%duJspaY;4!ZNIy9a=&?F9ursk;ia;uTS$n6ntD`xT7a~pVcd(K zn@bW#OJ@g}=)ZGC(f>-lrw+EBsf~p<^(~f;prNL2hKBFx&ocYimW;eiarL#%wAxo{ zv;^kg;RH9!--|ejoQ(d88zPB;`Bs1f)#m{bT2Rbo+Lq)CTe|y&`Uj99lAV4jf## zS;+SP)z4YT>-<@U5o=9nmDM>`N+xrQ@5Rz5BDagxK}Zn2%_xxzMkmd}yRL$|SNauL zKJSOS%czPFG3{8a>}r2YXPr$zrx_&N`I6d`R?>t22Q5|9*@CEhOnvXQKZY@u-?Mq= z`#oGtpVo>AIt#HsP$B)?_-sOu)cYiAdwRq1IRAm7%ZMgFUqxnUKPJ0(-Gx+C&`1G( z^wu0rt+_Sv>GTL&#rK1GMS+=w)~;8q*|L6Zk=J_!cYJ4(?yz9{5!H<-+6p%dQqneF z-3VZ7eM`T7CfGMnc3NgZpUfXt(T1Pw7moKs<={A#=Pv_^XC`joD4yBKzrz+s7_q0E z+Sg<`D%x1fW*vn8@Qzn_h}w4*@tr$y-yK!+$sHf;aMYr>k4^g|G<@wkB*0$rZ_QwM zxlC_;Z9(|7^n)-Crp9o5i;in|+5W)AuwQG;91}0|{DeMj5MKmMA?o`^{tI()W|~lZC5dyw8WN2@wu!# zoi7z4gg$lN_&q&NSKaxt_cfS3?4tSnJw#9Y z#f-`m1kF$gX!hIM#oxrU)z{R;VKp)<&Tjn+z}`?H@xobB4&(EAOXwaMMZ5QisAEiBWz0Gj#+;A4j0qGw1V5q^Lu|ADW}SiQBACxEC-g2ZGcGCty5z*t-C(DF~7EzA4#!c zV$RjP%xzzNf>7~p&KJ2P=P<+3{G0bQFsfclE$)+IQDvrGX{wXHUGZm7CC)2*bK*#! zBlBK<`J5)`a{n9pZ%P6Mbe3+Hg!0w}>n5DMN`Y0vAw}krN^Whrm|7KzoH-2 zxY^@~pi3J^JhG}oDi{u#*jYXel9s0ZX7QGN$+5<+F4??Ni%pBcj+r?*KC-JL)NwI0 ztZiKtpX?Bo5Glaw>E)&nztscn{L0!=r%#V@ZYkdJ_tXAL{;wyNtRrw3!<}wtV(){> z2v2FXr>C;TQhw#*Ee6hu%DwRBvJP)Sjx4z##UgTU>Fz^paZ28LDrorEX9>J^!Fq6l7_Vhw+ZsjB|t z)Y8?rWa_M{0oV(Jyf(SjsGBJiQ}agpMTD+EvRxaogYOs}@lbuz+fZhfM#BIdH4~Ny|Njl-a_;9qG;IJt=c1T9QQ0WYE6E z4L@2cTx9!i@PjLw?eCoz^XUCi3LD>)&%O7ao(%PlcuFvSLljNE_^PQGtC=ye@+YTr zwcz=q`J*6L3I$04T(sN%uY9HR?}VW!7&>$>$0SYIwe*Cuu(l^9Ys|cm>z9g_pO~u( zBO&Z8^WW$Z6b#pB#WEXi-dJ}L>osN>92sf*c>mG)idz)@@X(Htg9Xt|UF8>~Shdgo zLheEDhbT|UoUK&vSmxXbQxc*gJOxFpSrcK(i%NR=ITiH`~ zZ-a%?=X`7~_;?tcm>NHP;S{1CQ&wn=BmTUWhC#$>vs~8ANHkD1XckO=aYfD1_N!(zCfdf-qlW`|$cKa!D3y1BUqOj0>l3~t%eSDR{J;@fY~=5Cp72nVN%2d) za+WHnmfb6mc?qvL+(MTN9dCObk7 z*Ulxkw-cY^j!P;e0T$L4f7XjTHpN^gD$49ib9Jdg=F{ko+u9J@Mnu*@%w5)>I!79q zDe3IY0mq?}u75jBxV-cL-CqjSJue)xZCPq+>SxcN`z|jp?+Ts~59|hip$-nr{IkpawLUX+ zV#8?s{sU4H^Z8A`C-pXib7wSiO5g8v=yH5DMPSx@Q}X0|@I-&D%Fe6M}yIu}VYf9Qnf zAbOC($)q|pt_kM#Yu0A0Zz)wgp4JSk2W?;Mr7gG8)liO9Q#R5+iCHCb(teSV_+@Wr z%4Wy^=ZF$1z|z{9-_%ql(Z61c_ep$&bHuu>L(1DRx(wF5)0IM8Z>Rm2LrYGmnRo=x zvlqvmaJsg2G87Ko=qp)&Z5`Sbc6QFWjC{WoB6HOGgPVK!mL>h60^MB|G@m9@g}`cK z)quJmO|}P8EQak}%IQT;KkTGXq+YQ9Y%VdwT3VI54|SHS##i(Et_rlVNTx4Og_*pZ z1LUJDP68_`E;L*!{GBM?Zc(!um3#11oP-N2aEW1mh{okSn-U*kj+P7^XXT{(BDSxdFqVAmraHUV8}8w(a!a^q zzBYW+H{as-_X~0SLPk=c75b!a7nVMRZ3)`!-=sghO!_9rA?Fz%XQ%YaPiT(P_jmf@ z}<;BP?kx+E-Ig`79^a7 zzPozqyYx?*ZIa*9xjIPQ{%_t(?#4>vWWGO6*1gKKmp43|WDlM)ml|sxZ=OYk%Kt@| zbMI;!@wuaw5)4}Ta(q0xiJ>%dq?VX#t5CwTX@MZ;h>xAC&vU0+j#(af&@v>OJD%&l zmrMPO_VmV~Y;thWw9=g&3QqBFVA+=lj{esi5XPzGE5tf=}`jH<>ZPbmqr)swHd+YsScbPw*ffewk|c z!~X)aDi9r?jW*K}Z4twgWzo@?Vx8GC);tD{jrMkt61MaFHCEep^!Hj(OqD4O@9&W% zXkSVv_~v#xHfb)B6?%A)Y@vcyA-!;~A*4L_ur5#Kt*dG@qG8`+GvE8HpZu7h)@B zi&_Ev&Lt`E3ks4p==J9*X1S}J_=@9-alD;uLxhi7TK?6&h1Ry;zoSx91qM{l^e!1I zSTf0%_T49H9H`>;c(B$FuOBL)p}XhM3ks%v{D=&tBb4PcC?iQleI%DcT19o^0449U ze#)seo9Q5q=zXMi0YWHIJ9cK2OYgMb0dB8Je8z0<-YzqNSs&o4x^a z5@spM&(HY!m2y3~70wBcJZtp2@ayAs-qOH3gQ}kaN79F`AJ!9oqm~%Nq+nG6t=Nuo zZ{9qY%Vo{8-kz+4_?c7qNHdPxep#|v@c!jL{xjmess#)p4&?9|8_r+9ehHsA^Q3@C zj1tSv#)j-gs#XvSya&1A;KvUR7{-S#X&ITi`lgnamh=-@~H5A?W z=x7o6#(ed+Z^3XTWV*AOqN1?2wzk5=`O&6@tt}QYsh~G;!6>0)-~Lj2>4dd#zjlMW zQ#?n#`_bR@rKR?Wdkuo|-J@cw&UGnAo8$KogL?ens7@t&YvKPu&?JeqR2swH@C6D zjH#@uy4Q)Tt)1=8oiFDRpf zprS04*uVC`b2lX>KHlMUZ=tz#d@~2^C2z*9VYc~XwlhN{p!N`Z&hy~)zyTi#7Ia?< zFHQEP@P1f+@ZD*1EZqTi!AXP@-;Xjgo9JYjtF|*zsB_^-!NtWzo~dhSNV&YcOmCv# z<>g%`&K>TA6Td!m^_V&gxJ-|YJ;}DZ#m3HFYCG4MUIvrTXrvFwIDoIFrza;RB{jgk zva+Jvcr!FKluF-1IBPL6~QCOC^`$FBXwMkBaWT9ya#oIXf12HX}P=g^rl3VmYb< zWs`T5SBCm}<0(D;#>wzOyS6in7hNp^mIyFmWi>E zH{+FyfMte|n3xzIX{AC2FZ?e(JDc2i>g=0p0jijY2ja)?AslE`TBa8a(g70Ho?d>u zGjo>bj~0OW6zyNtgU7W8iVq$mV9WE?Mbd4}^Q}I43S87tcailm{+LaSkJd9Hm9r1y z+;p8x+D>zfvIB@|J`2dZRxd1FMcs&+DTb`^>} zsQ-KM|9%4xA&y7M#K=rBf67c`I&5Gs-FHLkQk$9D&(pFBT3Uo<+m|Ent1?;!vn06P z57&j%v)Uc;_Bd2J`ulfr_Be2%HU!3ofoRuTXbli?X8oD}(@(@7jO(Vp7y19r-J8a= z|7Y?j3jg;=K}Fi^iG33MF|!2s)Zvr=w;uV|Dnzs&O=fTY@1L?B5jXUwl1!ygGOP;jz9T3B|?JO%V6Ybk{^ zR*{6MyFH&>-MRQrcSh|@kGX{aK`GM8FJB1J9zb9xY%l~Uc|Jh{jul|dJ6B<$EP0+6 z8yEMpm4zY_q9Ki$p5xU)wyYJ8x?L`%1O@X&Q-d_VV1L0GT=63CC z?)Z4DdFe2YpM*z{M3@PA<;23YYLBI1SzBAf^#Z|Az_sxKNx1@|!N+{1dkL1g`tg>G zhlemlF5nreubgy|8m#&Escm=>#JQl*P`>SQp3S-G>Cn~%L`kep)OieAdK9#^J+u~l)W3|UR;1Hd8IlNlE&Sy?_K z0*L=ZV`Jj4UcE{iZ(n$4z>)}I^tUxfmIC#FIUC|k{`DhwV3&TA>%ehbua3qO`P^9C z8ydT>ATB|S6crbbN=uV>a$>)K|Nh*BS#t3BrU~4T;|af-os+Zwo5=QaY^)ff(d6cb zYJpm*j|b8RYo9f0 zS@%>B5k-kH@8##`^IJOPwyxL@PEJaTiXtNfBDhX&cc@)Ds%^HxLrPv=Fw3KM#zsq9 zn;9S7*RBREDMH{paD9E<=HhP2c*v;bU7;d1m$R#Grlw`MV5oY=1~Q2Vts+WZ-lV^O zEn&P4leM^bct{Tk2;9V-cCDZhIW9Sw7=O9e=;r#0?`%1m9!j%osUG3b2kl(Y>CQ*8 zQ?o`g>wWQ7&+AC_36owAfN^JcHyO08OJ?1iG~M*}`&|D=ZN0w2lb`)t`D6WKx9|d5 zrrMR|`Nbfyxz#Ut!&g%O4=sv3GAXIMyk9`Z&5avq+RbdopiNcM#ZFyB-EQLrZ~x|l zPgtaVZ9$Lv&m7MEfZVZ~_TV$tuD_s^PwfHXsz@6P&jkGT4(l>pk`!@uabm=ggj8P9 z=K%Df`F!+Du0f9pI1hAG?ft^jM^1$^-9G&?yq}F~$CCnB@cvgZSbO}N-3pXT?S;hyns&O^iUqv4 z!(wG*c2>^HiVol!VK#4CQJ^r9No~lH1c&;(*XQ0Y{6HNHn_J(H{sQM67-&wiZIsf~ z)NHmdeYfzcP>l{OrhJ0fSh!-sx}vi3ZWnyZriw@^>N|XJQ1pxq)@840IRPvypqMoW z;2zSP+1hT(t}3n={gVf7Zf>4?Kkxb4Zp-4sEV(%UFl+rgT9Eki%^f^lN9-)|u*K4L zk}M#w>{eq68XAG*Qn%eEtT~{=1mRs4*4Ay19%%YQVsmwVba~n?__eq=JWC?N9)7w6 z5N5xt!j&v%W-x#I=EB;_>Vd{4CNWntRhs83@NhcyV!$!lfls_9Gg50OcJ>}%?Jy1d zFgwE|Bcfow0%;LHe*9>zOc~<=s&2f{)!l6bx@ncI$e#3G%0BGQtn5;YCPC_j6QJ;SLe!#O9|0o(U7>X65!P(zi(5ma%slFKhrD zA&+QZv3~;#KDP~N1>(ZW=1gN)ys2#jDxU}Soj6&h4btq&i7Fa{RqMFSI00D(ettII zbp6;IYp>|G>G|P?@39$JU{gpYzH2;V`~%H6%_^Ix<9Z$p(6s8yF%IhvJPhJJ1hacb zR4Kvpw%!LsYK0oUkj-5pjMO#ffR5hIw|SFX;WmMZFPB(OjKJSHrY$U zu#Pf>!EQJjmQVN@BOqRb-gmd5oN4DlchTR%-GO!>*56Hg37;@%wLt`it<$6k=p_t8 z$r=oNl>zAnoO0RvnscTN6yHB}E=-Y;k*A&lBwmM#uz%JSTpXX}Yob$zd2kz^8x zIYRhWcRbU*OSI+b8i%@`As(~u@ac#^WNcz$H~gA&zn60ku@;UzPt|qo?gGrM0UVQa za>m1#K)vK^VPPn2*Jt&) z_5|mEd=~>Q;#ogBw<)@f1+OUtXp zr6mGR8)D1KFR;nl{%~D!r{P48QZ7008S3qj{7&P=4_E^85`yR0F4K1RAYiPe`J{$0 z)&|-(o_%6A`kk&q%k8-SP$r%cx)J=Rr*+gy^j^Pub%%4t@eyq-T9~+qk`fN$Zok37 zL0=AHY;50WsF(lZo8WRNl$b7y;jebvmE)Oe1%Qd@W#7v_{y8$zw|m8K z^qVU5#AgngpZ;R<7FJQg^*QU-Phhut0-VMOK#N|l-gTg&Dm7Du7DyucApvljz(7=7 zw7Vq@$AqP&rLdVaGBL5UsA{&0eO#yYY%MJUXcNF7cyWeOeqd10oBhRK^#HY(i+D}V z3-9)T1w=z|h&n!YzCP>sS$xM;eKe*`An48K_Y7E@D@-w*fimBUB`BJs^jr!DoG3Rt z`(utw{1BAgv~3%Hfk`B?S>V8Q*56!T;G?4;0s%GwLFe4fwF{_%h>-TLn`td8LI8o4 z@`6_}_eeb-R%*Srw`W1jD0F9o8kPv{f-kNAyoAM2*L8YK#9?jF`-Q!&t?i}Pxg#WR z`aW0ez-^bmSQQKB4rizp0I8skl}1NFLbxk7Huj%wXTWD+=^89!)7!ctIBXojtDFii_TrfkTV znfH0sw;Dr)bMx-|34w8yoA$N($LH!OPlYyAoD3*~0YqcK;;*uaEf8v{X=xXmeUT8q0lL;d zxSP@rhyVi0fic|CItPo+D=1i^5f$KyS}TN0mb!wES-9p=b1eM z(QK+0P-eYObf^E5AQ6Bw?Y>zAww?gU_5$^e%d8s}om!y*Tn<*K*YKrk*8PF-L#R+8 zKHTT#Vvg^iht<4t@>$47rF=*YfKkgB85;vL z7`?w$-p}H)ql1`g$Z!zbF+{+J5Lb^vFehPZx@3WAf3x&E4AAKSIDQH!N&wP;*bO^> z&IyGdLXOFIu~m)$bO}$Tkra^ln^7s@p07n9VCFJcGV% zHd$c-Ary!XL`qRHvHhcQ{R0>+Vg@*DrX@jK6};Mz*KG9UhIPLC;0bbE7o6uMCMSmp zu-Gqffqn}zyRKNev)!9(+vBYX5o>FD*g*<1h!Gp1+s)Mp$dU{2y!ZY?w;)7Ce}<0Q zWq3ox=G$A-;3=0oE=@)VHv!K-ne#~ldK2yEcL&VEZ9O9Z!GZv@uVyOFKgxv+ch1R} z-5|1ZqnG%SuV1eKA2IHVq47K%l%UtD2owpx+=olh5ikXui1c$*R7<_vfh&xxdi9GH zFw0Azd-E9qB#Uv{Ho~x9a?o6(((*BAT_OONgXV!@AWxKjPDqf1*M!1SjbhhN`TPewc$ST;aDs9^|X_w7tpE5J~C2g186OrB!FC@9qb z0LkoUoW>zRgd-EEXlQ~u;9!`jsE*Fgg)q+9XKCEYM-Ao@@1YgT?XGZqD<^Smgh^_&q<#xH>4pPW%)E=J4Xm`Q3Ja%dV zz{wIo=N}p#Mi_R@;gHN3=qY!Qih$-otXP7n!bmXNcIJ)O_vQw<1a#YA{|9&on^!B= z>Ab$WK=3X!{}=P>cn}+_?UwG`e$ELD7QDO{#KgRk5-PaDY~HNQVwe)b9dIPde*P0; z5PE>1mYQ@wfqlr3aREPIu^gcWY7AbDKt8^!!{Ir)gFZ|K+|MQm#iLo)1#}X)fe^c3 zwCi|#ih$pp4T=x9rXjVzJg#bjSf>mX571a-o47>c2av1L3ZD4T;;3!+{QgfW6y3GD*F^0Xcg?TIhycq}D0n zt&Pps%uK&_5|7ZP%M~WsR6g!`j~cUn5`@nH?z(|xz?A&7sk%4WNG=6&5dPz`TSSiF zKgI``*<|5L>@@|WzBv%QX@z0eH5*$1Ao88gf8aa*W7Lz(9Stdj9XK=Swyyzc5EwF1 z>qG~I8XfPm6^O&oGbs+U11uX1JSrxp4KYM$vJtkiVKgmI1PcXBMN~`?lolkHx}Dkw zvC^Yt691Gr-4EFZxT1DaoqyIqEcnM59)$^ZJs{3CWNHPF?eETkp zbK!0@bH3KJ%+m{+%mZpq>cg4Jwtn!6Kjcr7P_B_|xFQ z8S;byD9snhGNRMcA_mRjfaiBV@8ZFJLs3u{fSwtHgl24NY7ev#2M;d*96CMymheMY z#L_`Z6BH8Cx^|$br`Ly&Ek#6-0Ei&nkNW(%8O|$6fP_b@=t->fuODxxIyyS$!H~>= zdw}v~R6ZdoBeN9Yb7?exaU(Du|I-gd+cK4cLG#Zh+~0-MhvnfuSYU;2^S<|7!AKye zBZQJJm#sfPA>(s{tg{+YAOvj=jh4>AQN$gztmI0O3n%7oxiQ=A$y)kW?08d9Bb`H= z|4rqKStlXAW|WC0$A{bU=xjD5kkp=ojQn1S8plk==8WW9y|q|H!&#*s^FjF;(i00lm>1KiHf7M zGYbdDCt1p@+}wccYj3#Tj^b4ulrGv0OW)0TodnrE2{C}wX4#(GYOHW!!YnNZTuPGs zm6sPkSh@9|@3&LrBpe)A;dWBwJGa3Wp?=zz5Zh_o5(lSkn*tj}0E;K&slWfzue(6| zgj?xEvlK7A1xX?Th-|8T5w-@%&LSw-59K;QuQdq!%S3ahC=mVL*x1Mw(m2;$Wn#Y9 zagLbW+M;J=Wd+e$cW)PtxSO2R(sNsR3`tcdVnIn<=WoYIQ*b1`Mkf^73pNxyI5>dM z!WQr8?iK+9;VLJW`q=sgBwWy1;RmlWK6CA}@$dxC?Mjr4v%Y-!%=rOxvVhl@&EmRn z$oXUY`s7HwPv5|M3SLa~zr;s}kUu;=PQ~RkXdZKT=twU03iOpnT3SVMgM*52jvh68 z_NZmzmoG0Kq9Ste?iH9LUr->%0RTW-JiXfW>4yl}9sHQ?6!NAHxB$K#0g0fj?KQHb zrKXzN*o1?~D0BEkPyqRZFz_QyNB{w-U>Tr-@Eh(w6udd>hcg-w>->(3UXB-zY6oIE zcYR!SHWc6329%-`bXR|^B2$1d1XLkvxImfzh3H=*7SG+C2Ob}h|Ki@16c%Qemn+9` zPn8yIxjlDX#HCyHnRR2|)!fSJ5%Rv!Gsq0?Rf9wey8kMW5J=7taTFm5 zBNpII==Igy4L?+Y!3@Gl1^YmXM-6C2$HD@czRfogrb>nOF_0+`TVSz*)CzKni{+?y zR=VTMJx*+(e8lCt_YBJa8uU*<%ZFBmhbSLzgYv0XKtV+nFs|?Ov~DK6bs>))Djd`p!^}qZl#~MK$1sLF?@7Lwp`Cv;@v=XUH|)ck+bOx1MZ}QlmIHw_yh#l zUIhgOMxZQgO;tr8m?<1v3mGN^bJqsF80nQvTK=)|aS5P%)4cSwv@f6|2xMkNQAS^% z6d}}!XDM2b^mFbRPXC1AIRnrF5&(ca(R&Ts-~eBssiLR9AJzq7e#&X*xIV{bK5&9y z3-+D#@y*2K^=R68Csg!mUag;()-GId5yh3+66n zPhfgqwYOhm1hfK!vR`bwKkK@L0TqeQ}S=~gv8!IB6AJ=ifKoBpu2hh+4oD^~V zi;c}HZ~zKutjZdcG&Q9ZJpG9U3^yY$Z#@(91t6T3xcF~UwxRjyzMjpae_)#kp^%V} z@c*OgP2hUox;F02Dr3l$q54NilO)NMqLL7YP-&7WG?`PVB$ZT1M}{JC3`wYjRGK71 z4i$w8iKK)|%KP2td7k(4zW2v{?)#Acuz!26b*<~V*4kE(%0LFOx}1g+u6pKBS{!4< zFF-PbYVw@4snfYI;r)}CSxRT27WmD*@$yM|j`5cuMY*aDj2lAjcm(>^c3VXk3}}zy zr~MdHp?(KuVC|YUGst_-*Dd3Ch(Z~Pbj8NhE_wrH3i9%1kUIYUdu;dpOD+yL^E6M? zvUBIk{`o%tkEE;)x)x;FknGc%{QK0OMxV|;cG(98m|IxL928;~yvbV>o$pOeNl?6P^>fd`Aui&J)p z8iW-{*!5+-U@{aYyZin6wS%y7Tz5n4wQJ#E>u!40GtXbSat?Cnt5@}u-v#NvWi@Ws zcbsp~&{?p)^g>ZR!g+~$GwQ^N_u>Fk$l(n>gpp+Hx-m$71c_e54f5a`98Qx=0s1YUckpwUQjEtFreGyBE*Q@2z()0&!+REQ>;&d#D3~8UdeqTQbC3WQlXo#Su>D))+V$(tkXE5BH>S635p5(z)L##slbS6AA*dY{j3m~W{-^2BhxIF4hp@zgnP%-9 zAp*njLM2goq8^dtS7YQ7Vjq7WZa?7Zns?%F3<=rCPc=gS#1wzNaOFylLn22^RGEkJ zop3Om{0dVd2%u&YxNr^6>DJTmgF62j}J; zC$k82$8KNv*Iy#H75-_diZ28VZsiJY3G!r)_hFF#w}_-_VWsoRbnU zDZ4Wk-PNPdLK&> z`xv?TetLV=bPBDsqVm*Q0V2oDyW3K@$#TVt0!J$Bm}li)3MsYwxJsPsiFVbdW=-q$ zu&|IZEbh&8q5c&EtMtC|!h)FUHodt6TmE)YdCR^1 z!+fWo(!6b@iE>l@+*%E4Bk%pUQ1kHik)&!tPt%`z2rUC^#*U|bJDP?cJAQn{;ec)q zqcf+wJi0%9A7#|hz(DDfyMC62X6uDXq>-5iYTx<$>ZUi-_|0WqyLA)N;I`Vt+`LDR zx;_f=IAXRr`}UQ{@&(6Fp3K>p?BmjMaGHgJzUO`>ILvghR@>jV`i;gruNw|vNOntI zxMbDsXfWlyuT2^c+}a6N*Sy<)jVll79ReTRvHIIE^-)-Q*^C8nwpTotPSXKeK{Sy% zY-+A}sos}+{TeoH>8)`ih721v40RM5!y_*3TTGu`0aOR}#Pa|C(8k8bO6_Rq;d{R= z-~J=JOWj_2=}-rwwZ0i6UxI8H_Kj0&?#5v5o7yi4`kK7{=BqEk!NGX#cFf$gR%gh7 zfJM{x&(U6D@xV^=3DWHH%k3q4E9Y8e%3ZOgIagCta|TyRj(Awzyzp&PtH@yNX`cnj zxVoXc*R0tOl<)n+%QRfT!hd74{~owWv0dkGw%pNrtqcIoixrz1`1UzBx^?Uz5@-9T zg!WJ2(;G#(=hIf~Q^=dN+9tE`(|%l-?}kz(+m7S;i_g_-x&BuH)~~l$50kpv_GMG! zgK-I7DF-#|rRO$B+=HDGgp!ee#9V(k1>}_>VZ%QdlCo|?g+O67gnqi`&wfy9_~~$_ z;Pwdlr9C$BH@ojQQu_Y$=Yd}_L>t5$I4D*yI5ZUM^gMa#!r~(CzG8%{i!OC%7E1Q! zjkgA(tCtLS~7KYqOT z`GiNdNF2gpdUDp91liDUyaE3!|mJcol;nLDnO^zt36l+jJqE{fA06gaf9yA z`1z-1hf65Csqomk2g-IQE;^=l|NA#&C*&8(dBw;Aq$0{9VZ|c31NgbILq2477L~G* zp=Xr&YzA{Z-+bEe*280`PDMsrRKNGGRoPSM91;8U}WU%lq&@A`G!6FSATtM5!qxJNu|OSEd9HC6||zpHxh#r}}BT>M0bF&(2a&T}Vt^I965l5Fk+T4g{3t#*J6bqEjV! z|F~Gx+q=HgnDOK1J$Ur!s8CH!=TH4{`0&Y->KC4`tJ&24Vbj@)3i}$;=k>)47b;#} zmNfep76&zo>$z;9A}FD;HVA)3@ZY0}4JO4lTTd*uu^CT7Hl>D%2AfMd6oGo;NCy}0 z-nEqp$QtSE}QBq5IHYtl+*RT9 zEY#iltiIOMb8)!DRHk#sB4o+&%PubwJg}vO#li2$D0AV_iVz{xYdrO9ZhgKI0lzV3 z>hJoj|Ni>zMvJwmtVN=j$zP*m#-)En$Z2hQgQuLZSnKWG?s%l7wc=X9G#V7B6C+y_ zBRg~V-3Yy4&xsiou9{j}ZesEJG+Nm7aCn^n&Td2&bc1AV07xcn{c20Zf&vi36VMBU zS?u|`Rl+G!e(SGyM|Qjmo0Eddfc>fWraM36r%s(}5^e-mOD7i#Y?ym;>dx+6eFX^H z>eIB97-T3JbC**ySU~}I#J9J;y~TfF_61Fyj&>+?4aU`0PB_)lgS&wsbiCUePf_QY zY}%Ayl2;0WyL$C#VLoCD_6ISerrUZo7+*>KFy!XO@&_of&6r8&Q~U~{I~A&}nXUM6 z^t1-);a>GK;UKdS@-hfSYbc?Z_#?g>`(F@oLJke9ZGqylU$^c6J{BSLd4G#I#r=YU z)qM;T!#DF*{`A^rt@-@<6Q)kx#rnl4wj~$4YdN^Pf14E$f2FHQxTM!9HC@mT_+r}6 zYN){BJ8QM3!NGh(FOB;5-^J{wQYbNcDBcqqZvXmpksqSU--e{q65!L^P1I^m+JnhW z%J3P`2+LQjXsKO29mZtNs0jPyS1nINz3*cixi_o#R3icVQ%^5X2*hGN1pwX`5CErBc{1^V)>0V|3k-2k-Qp!Zf*S6R zo`Gt?3150^=m=@xW}Awl-vcLYE+HXcI|KbVq)?w3c8BWfHaa^yQ-@LhL<@7=MQnL*h`5ZN?d~0$_CbY z+2H{}v(I2jAcJs{a9}SyI(A8!-jZD%9*t4-H=N1Jv1^;#ycd=#E&1mYbe?4SeW~l(u>NQP0pV`-)F7zG<6Qn z$UY;Ll{=xpmz627_em^nGq{TKz*v1igW(@x;kUBN>+RD#OZW^SWrgEe5L_&>Qr|l) zN>u|7Pw0NeHQ6jG_i`KG=wFjQxAp|0*_Cs!yoT}5+zQ4g-!I%*liu6-1lLy8)T{-= zH1@;)DO=Y8xTP+H1B&|W6L%?N08i=KVNM^o|~)sl+d~H&W|OKeireIoVu>0G$xeq zeYF|Lf_pm$qH+Vz0lNrXCHxCvFvB6SyW?Y((Oiv0#6wY5!?&ftAK?=%bIs~mwyi28@4Y+vWLUlv+ll&GC`Y^hT$p>yt!lP# zSRhD0&hYJqet8CF>ea@y5JBUKb?19w9csp^GtbucWc`zD_dXmz&P^009L7UCFRy4( zm2zmvP#BW=^b;me&c}ic-gG7n3HzS-2pCGhlwEx*{&}z`_3%kYX`gTP+YEmHSovon zdFA)}mF+4mEiI&RDNTL-2RI5wAF%A*vnM@Zewen)Z*7*09z8){-wd)9Aun?R(>^&+ zeP547LlZ`vyuAIYYq^bEm~Q@S2+a6<;(DR1p#sJp+JUBk2~ua$Bo8*3u=fxyK-+LJ z?w|f0v#?I$e2Gf7Oqsz2^2*=`^qu-m3V-r zbLVE&cwSpytPcAsP7=|OG%x)Auf8CMT4GUbZq}og9<8kG3vpG|)Vdwp(lW?G%v;dR zsNm;}Yc|+s${jtlACZO_E_`W|@m;YnFn^+ea&e*OPZ^ROwhan34z`}djW?uw^u;+l zz#+mR3T$LkSHSad*4*CS>mX`ri})&%e-6R!$&(rQc)8CgTF-57rS{pg?f>TmsB~a8 zgpZFXAxJx*n9xY5nr*~VkvM8Tems5YlKDGlVj<;7QE_pAVa!Opj99nddg@c)%?y`t zx@7!2hUN+;0m>CsXTp>z1ps;;bZqq7=X(n_p3jzvQqKu~g4q``MD13Y8WgvkW{T>B zQ=uUt?C4z!hY!VzG~uy&w67F5gqt=2|+w*Qv(=LhnchjTkY|tuecE zXl~M)RnxS!-JdF`VkHyIYkQ?ed!^iuPoY^Au4>DpntuGSnRq*?cc*|Xw`C?TB8P-a zv~_>1Yj^G8dPhYcQV`u2R!-o0}hwo}Pe zwtFkKo9YY+Ss!GiB&{tSkR`o=TbAo=y73%*mzvt%lax+Dj&tLww6O&R;WBLBag(+@3vpNWAKP zH_3&}2Kfc2QOauS==5*mCtb?!WL0SL1+ElUH>%_@0V>C)U-!9Wf&J^N#~>$~SJ^`_M*x>E4F{`}S4l+;~>dm@9ju^vloAwx?QONK;Ry=tk-e(#>GqSQMetFli~%i|R#+|nhtZ4b4lo1@;( zE026~9UUE|Z|%SXcxC>c8B)owhBaML*C~b%`ft^xJ=WMCmzer2p2LYiKP(%Nfker6)>G&V< zUiw`3tW)v4L%hLtHJR3WkWuA>i5gJ_^ihK*dLxwolU9B&6GD4WqK?1LO1BHDEqzt{e~$c z*t*g;v;CXD@}`D4?j!38Ov4Y?ufpk-c@IX!ts~;Cbkt7Aeyv`eJMQt*WvhXdJoCM$`Eu6BUwyIYQ)bwugG8-z#@?9g3j(b_4lxa{>>4C7 zmA)1;?q8nM_1v&KkT)p`9#m*Y_HF((B!mT*-&BFz4}8#OQT|cnZ7-`R^2_t z5?kGaaj1MfuhwR~!cf^aZw#Zl`DXYv$*m8X8Gg2Ni|v{o8o$f@orb@1iS{{#>NBYc zN4DWB!&x5;izz2M?wPSy@z#PjY6@A2lRfTQiw#<{zcGDftw(i%x^A)j!AAetS()qQ zAH9;zZ!+8tIUbxw-jdH^nbG{ruM&2lDT;UJ8b=mH4&Zp;E98}cdmSK zmDluJ&spmCA)Or@QJopmGdiNhaQm(Dx|GQ@`t|$%nJ|;7pX}N=VttT(jb_IGH$EOv zIr#sJmj}jK9^Pf|vOUp`|1A8l&_n-(+wX{Mzt^u{8%I4W*qE&G((SHQ&|j}yZg#eP z>yY7aq=g2>*oOmEP37ps{I514Q3q*nEjN7q-XW7e95DWYcj@}OMm!#?uMQc8?L`hV zRr@c$t{v*8EWcuWzQ0#&wqN$x#%%o@M}vaw{r(0S*?Y6q8?&vhjNg*ype4*1PuE;2 zX^hlcC#cQ;4fadN9Od7eBW6qFQqO-gNQ{^(JO6%ad7a;)IgyTkOgsyA^0)hYQls><`|BN`YNl)Rf-SSH%6XegmObI7FreAuU zF?Zv6e?!G{@$voum+LM(B9sj;{TLx!8dOnBeUj)ju@D_%HhIP>VfD(#b2^c zr>3^_R^PuR?ZlNUS9+gif<-JHQi|{MbN#LE#>r+sTfKTU4DR<+eug`+hj4lC!x6t* zpFBCF_pPkFye({Cp{w4*d-rB2oKjKfh3jR`(xt_7ZdGTaQoQf&{s!1G{ZQXzJnw$j z$5qb?m(U~lrD@`ax7PcwU%vchR{{-pkU!(i9^36huZq7KOBO#n*6&eNt)r$0>wKF_Xh0V7tL^ejYmxLTGxzqdz0t z6owCP&nv5-1`9KDva@@8ZR5Wh+fOsMF^TypP^iK|hcD7|^JX-}890Hx(?^8n&RV|w zWw*QW1@B{#3aLMWXP?<-QG1uW=~JymE1(deoSl_u^f}-t$Qf8b%we$`AjWa)0?_G9 zL~`ws`nzpIIXed&j~J&kapDiydjP&G}F1lVEl#%3~FgZ3wOKZ=oFQb%|XXRymZJJwGqo|%2s2ZU$;BF}^D@##&MU8-$LF?e`IdeqqBp5#bS{942iy3YR?Ney^P$yAQ zg8`hzZ;+-S+mvy%^FlBNNGE9NgqOHDb5cuh zTMwQMeni^EDY8Ww1%Z<%TkWccq9Vb60o}oS6SW`}kV&aT*m4nv4;!srdm*n}cj83R zQM~%`NtOOG3zsbe7_Z`HWkszmF3KyGEem{H?da)w`0m|ljA1}>R%8h;K0hEaM^sr&#f_odcdb-5?h|ucvcR_l?Knn?|^98`h5e9=tAH{76+%Jhv2tkd1z5X`rVY? zri%jw?!mZ3j_N~OTbP%xU+>Rp^Nhyib^iQ*K0U%`yDu&hWLzUl%ka0-oMZOITvJnN zO42=hItW*LVWDxHrA_!&@BE%OW{lij=*+|P`1O4)D@KtiJ~lKHqyb&yII9Ur%JOz; zNh_7cg z0AMy`#L=U(eSD_lk)Yt_yYLC@U0izL^kR!JSwrv(SUfl#bU!03CNDhm6mhqJyg|ow zM82eJ?eqPz+Z~V^85<%?4;&wiodQo}K5w4A&JZ^}1!5i1ggx8P;Kpv^k1*Z{{fjgq z{BXi3W8LB0195zzM(=ycZMW`0*k1#qmOLnfxxSs*JxO zwUzEraz~tH;OsLqV-_%&LbQWnO~J$C0SV}ey9^5yY?*ZFcgOr;T+4|{!j2uzUy+!? zC4e_a8V+@R^sN7@&O8eogC*lX|JcF*E^r8!NLOK!>B6iC#5)Ivy=Y!oA@-NL+?B{y z#r=Gl{Z34txUd-Wa@gr4zAL$avrW6PLqkx=6e0>_JtQjeE(r!k^dZ^1h#}OFk0T@U zX~*wIP5r;lOSo{Lzh_RZQyKxw^+7Fu& zo$k|nK>yYVY?ge>|J<|d^ruY8-q&HIhDPsH>w~#fG3@4`Y^7_@bDhSR7X5Kr8(9#A z)7IO2`0>Jh9NXKsqbI%I=F2l>vBd&&0`Uw$?oHZ1?=Q8pD{1EAqITiyqdy-fKBtu{ zO_@r;hJ_`I^fa)cqwAAiCo6__SYAN4kXxTkaW;XrRE{2jB#*lra(TZxJaE_nZWeLl}IPtHo6mjnOBU;_>ZSlf1@pj%qGAa?n%wDvKEjTFyt z6o$PBFp*~0thz)=aNjoPehu;5Aiwi>FVJsgKW}5j{8AtVJ#{$XMUfcr|(;yOt{ z1*03<7U<-E+#yLmf4oIs7^?TN6DQ&l66SBy7U3Q*?5cxEB-HEQfBcA9JQjE$qP0|J zpP#L5oDk`D#Q1>jlkhc>wnbFqf2ftNGW8(w^U73r75oOPw{1H{rXXcdK*1r3C|@V*zeg~ty$CL z0_)KwMgKi<00jX9>6~rjL@(yTK+)&HcLZFbP_J@w^22KbV7gxtwB1-BPAj$lbm|ie%9vl&Sm(O)JA)z-`434~TGJe@YyTCnm81_*pYb;<@!Ee|> zs52%!8sbn`SYN>!58GNMb~bKw>IKoj#Xa<-K4Esk=*qwjQh7C9v(X0I5NV3;Gj$Prvl$!GkRIO+c#}&(7TyS{Yr3)AO_CjCFMB=4rl6y1t zraibPh7khTS-@GW1iei(OG0w6b!>{k{u{QCM*5U zofEXb;$birW=;6auMlhc!E`$#H(fB?b_=@r1Aw}vBewwP}*x!H0rlt;#e>SE$ zHnICmH#aThgv`lWqt=0pJ}Ty-m@g*bxQx9dVFQtMDn9P!)uAonnmsZ3J~1WoOvh+A4%9pL@%p#5EnQ zzgY&*gA@#7aSC&!+~snR!s3_NJ{@ zl=(i=oRhXc{tCxelD_%(hX=Yx~K_rpO_^%lrVF=j*qD&NS z|5@$6ET4aBT1ak{A_3M!qV%9Yt4-7*=aZh?cq%c^YN&Y_r`7#yPK%7zhr(wxNz`}{ z!`9tcu9{0bFxDdDH4R=xU$K91o>%>8Z`aBDFg*h5}I)+fW>qR0_)yxgC|&?d8*1WB)7UZ*W16iVl#C0`7uY# zDu(@~+8-#%8u-Utq)a?@YEJw!K7{|Ik%M}Gv)N!6o&wJsxp>*IsR_dZBR;F48j?P^ z08=TQFTgv-z1V3UI(hP-SzP8Codcge+}$x_(H34|%p1`BWBKt5!3^9>*^PYt)CVYd zyBV21D0}bIHT`Xuqu4xOm%ToN7FAwgKMe zFq6*zO&-czAA#^`o3NTDc^)2db%APsR)V2398$T)G3PW0+Kfy%W`6EsWuNS9x&~mw z`o$W8;tR{6DX=E4jJSrfY&X(;JrJA4VUXai=W>w(8$EX;_lno)6a!s$zqh> zYUD>O8J@0aznBGR26NDk@=H8&_^@Aw-ToCmkBhY^acEr!HuEG1BR#tMK6y_I7KuX4 z%;4-1UxE7k{{G!+)~|45(f-E+dLct62gYJ-L4zWNN~58rvDqAVaE7q#yeRfp>8#Op zM9`e^qwX;RkKE!vZgBhRn9X_$Zd@{VMV*9zwfBB?Bm1nrwGE_9WiV*y&{+w^uvErR zKUldJurIwG(n?+Rf-~&wwrpAQZ&Xm~LdRV_{0%9?0VE%5YoTRUzUy+Jd|X#P*=-fv zeTrD!jvgJAGI#Ri$x2@Rf}S;f|9&VULb+>FwnJaHR+{lxFz!J)ot}P*oJ@m(e{$V# z|4AM zX`dcljkif|Zbu~)h*A8Zfq^;i1jo#SCY2k7EC3}y7QfovUtYcv3AV9t67Mwo%+t3& zc9hcY2@1|+JD)nGv2JzFx{i=R40&T?v7p$;tfU+#4u_b*Jn%3QS}Z?e^q8?@Ge7^3 zxiy2-MEHkDWR7lMYTT+`nfFr$CDx}{UT^}zW3!w&bI*B?rOTI(&0H=8rvbVk_`@q1 z(bA`p>;eZQkjcnZ22c1(`sl&RNcg2=T9X z*e*9KrVr2q>o=szLJknoico?XCp++#)i7|Qx#pn$kKuO6kc}(<{8*WpHe$s`$Ko7| zW^U2OQv)d#G_+V$BVz5==!An7V1nqLyp4QKpB!6)Q>gUsD$PNDF-rhAn>J|xci+MS zp5-|b68#oTjjocNG;v~su(e?kHydR%^|o8oJQQA)vsan~OtE2{Z(gtxkQ6cwAjYM-iD^mPfQ@ z%gy>@+2?KaPxOk&H-d%55M>X4^RHyYkRi9u=G?8sw(0#VygbAs%{BSeJUX(8B2?jh zXC3T2(9!`1>9eSAR@ z5v4c*hNHM<=-|PMfO&Qq5#s(EusR5aqyb}Ay+}dz|GWTHGQz9Raii$-b30r7xyzr2 zWL52`^OrBH{MR+=zv2c^h|0C#z0#17qLPyRh0e+v8lf-|ROg+${gas3mmttAMT)}z zlz1_uZyBME;`ra74E6f1Oizv zSg;%1<2d@oNhqNICXFqEYRz{tOemI>TMxlR%ID4du8Sym&zg%Oztn{fkx>mG&5Sr2 z89DkeU1d0yf`ReWqL>}_mM}$o)NKzql0oYLEAVsd3!K6f&V^E-xVSi zTw?#nYP4Xaq*&#FPGr8$gKSGmO2Q){YwLum3P+yK5L)Rup+HbP%Pe3I{!xe>rP9Dj z>nqm+_u{+Po|Ki9^)IFZ_!90ih~Q085$R&E{>F0l{{8es-wssfSYTPy47&x}zRepI zv27E(Y41h3AW8K6IS?2Q6P8)i0q{_(qdQQL_2nc=Rezt4_gnnSxpOce99-ZLh7NK! z{|D4Y@`R}8%lXeyCqHkCCMAP%Sg5DPB_+WPU+CGQXv42UsbRds4|agBh*gI*#o&!- zi`Pcx>)&Q^v5?oW4b%h1Bk0S7i$7Q;O-x~FcQ;?r^8O1*Nr}Jr*s!4q-#t`Ht=HiIIdYL_fIS}(^ZfyJlmNHqFHN2~R^b3bPp zN0N^u+VG;I&G{E1J|sV$2hBAO*6tw1+uJEiD(&X7qEK26zB1JYOSR^&m_56zbJDWl z!Tf~hLi0JfFLXeY{3Z@Tug8$K8FLuRzBhSbqx#tXGFsiH=<8FigKDt(2nw_3{vV3S z6Gj6aJ~M507PSg(NqCt$j;K3R89w@UPk%#kz)J8;AoOY;FRVNqS@52|vTXlAhm*lp zA4i|lWMb<5po4?$i1s`RzCBOUPIEsqZbn7G5GxtlX?1-2_U%Y0e2QS&`SolDR#os^ zfffi%JbgAWp}6m^gNj=!$H|`rA5tIvk7*yav{5+E$lq_H`+`9r1ym+a9?Zr?oInEv z0P&X8W1^9e3Ss6pbPZFGU%r!^qyRn-@CpIsc5)C;bjihREE$XbqNHORGN;nN*f?f^ z=H$s^^m_3uGZ&;Te@Z7o_ZLAO2ow&Af!oK(4`n&%OD_G-P2)1b{YG##3<4=oj2Zm% zanQ7#Kh-e(M<#BK?8<>tJ@P+flwnXwX=rMiFWa(n{@zj-?=LSi7mCSEZn)H}Q(QaT zv;8J@X2Wfn{?XF5ns}%DpLEdeK6Z2`xzz<_` z^+$?bQt91Do06oFN6hTku9b#LB0YOmZo8NF@BB{vR<8Qb)V+Pd`~ZV)-e5VnF5p9fviFDyQg_o>uHo<-8A zoxGAD`%JN@t&x7GDq3^4Zyd@3!g|d2RNF4cMBjt8J5#NDv45|PVhmKxn`0Z5JrszY z^M4;aabg&9#q?qi1aC9V=4p2S$cA=m9Y1vF&}P~MX*$x<(`(LDOE|b8h9Z~F6z{y= zbJgS{TrU?oE2}iE&iMILx8eTDfuzGXuf~Noyxe_fwnz1&Vbp1rIC{OE-=w{%HC1tTbx>{KK@9X->jAJQZ9N}qytML9eO>pXS#SM0z5#@}B*L_Q+iin*Mh^#oVa&|7|9xYTL@xiC z?JjwjjT;@@+!}UhCKXx#SSmubC5D~aQKrkberywn%h0$-`CuFwi@dGvU7>)Zt zyXf-|SN#(Vi4zV*R#UoqUfTUWy7uO&JLB@Erzt+dtDbG{g*B06R45Av0MyHfIx=^4dWo`9uG5-TZ@74y%PZ zBo11&=guR$sP*hfG3rg-=9V8{l|{Mlpv6ZKaGP{xWo0!oL>rZXKeN8GW5Cw0uT^4- zDHeD(4y#smfk@>;AO78;c1+v!9pCqBD?|l%+?k7Rje-1LW@bm2>-?nJ^fxu0g6ZOs zoi*ennB>MIyl6*ovN%Z#7A=|;_5rs%U4gN8?+zzYJIVO8d|P!XA>j;jixG=@kC=9! zu^EZiulvz#Xt3jZcVGf79C&~yi9xBQhs}*j(KTu55zE9Z{VrUIcI3za6pgn8jr*bA z-<2t+Dwx+eLCmZ~1Rr_ALV0*-74!S<|B10Da%t~f_1-N}3NztH z*DSPIw8$3(CcZg`l=Wrf@(Vjdm(X10fN%szwejP{(;gCnN8v5^q)5$(O+!m$^%%RY zvrjYQrIp&g!oqnl__M|y$wVN4nMq0EC5C}&i9@u7uq}6!>py%D{@kZXl^II6y9F?W7!F3pRKh{+Y(}M!dR&H6#cK0|-@ku9 z%?A{rBmP;6Yeh$bP5##whSuu%tkW3+pUCz&a{F|Ym4U}--0)U5HvTlC=qco2^$tK_ zX4it%#QVvs5sSqkqO^VS;>DVZou6NfFS-bkEO=@pN_FcL@#AtUycr2cycpSE#&oG> zn8|4faF!4cGU~fOmr0*0^evhWiTS<5vMv8u#Ak7J2Sp8Q2ZOhOV3ugrgXuVYYk*Jm zl&!tiuV2sdg3qsSn|Qp?Y0^;>iHYud8hJX$F1yDB&I-mWu}6qSl4Fk!4@T96#=}lh z(bVep<>f@uIQ_^&cvZL^DAxIfJEq^MHJ{VI{DmBQZn+l-jHqcel|Inez0gPTt7@|G9+ zbJ+Zt(!wU@Wy13%8(-fxmFu$7tDy@?fQo|H)7#jCL@_e5K(tzN#!k})&IjJiQtCXXq-7$Fa!keJ+tsQ|YK*Q(>HxNBdf4=myR6<8;_1K<=;Pg-s%@&DlH{GTin|Tq3J+z zUQCf=&Dimo=zy4js71pp;Ptv|@bmfSAKSbB zcW2cWOPA`@YuEP92^~&Mv9q_|(_Ua?vfA1CTkK@ifqxG|UQ%M2cpO+|K3YzigTV^$ z7_rA7+MS7s5#b(IlwGf?p%JinY&Nu&Ea_?ZRz{~WwO^2Q*PY&VYJp%ySK&B z%a5ZM>Q0&jbfLCOOiP=4%_!KGIq2kmd#dZ#Fb2Sr74B2xnr zfByV=TeS=#F$0E_DF}V-nMlDqqT{lQB*Ry5WzXIl1qB6cU<~RsfdxQ#K*$>mXQG?( z{8c|+Q3erRcQZEPcIvU*Dr^uV@gKOm%Tb8K6dYc*9BQlMLrfeH0bbLWN#!{wg~@bT z9}oB@iAqkgIybf-G4mI@Og>1AtANvInz&?<)|?6y`S>b%_iAt$R!8gTD?0EcwKvuBmS4_=Md?<57!id+eINu%QfrxMdl*V zCn)>l{v%&hi;IgFE?<5Ck`{a;_m!q!p0wmx^^YB4`A*9Q;lp|Ahp-v%SGn!auIx8q1}O7i<`RF!^1_qn&;5x=2s|tfK^VkQ1*v#; z{tK?U(C*0&;oyn4YiX=bOiJZ|2w|!hI<`r)F`73Y`~XOhk?a_JdU1s~MtYNJQpP zLi7?5Fc;uf{HFc;Saz=@8^>vXlfKSg%)Wk}y*9ocs)~I;D&%Ky<51o46=vUbcxc#L zYT5e@n>KN>!bjQgg3FAwCe+du3+v~;6u@@k8^d=QP9RZJN-L~`Sd-_fuOoxeeI(Eg>P!c0tDljGy77dWpY6=m2lcw*S2 zQ`18!Oj$CbJDBJ#!nx}B@xl?fz0agclg^~24JC z4%}j%pEB7cChPtWU0q#d5vFC)4nW`&8&S!dWU6lnGwNw^3a+y`@Ip(jgBH(RPIgt3 z)W{Y4+g7Q4l8mx1zwqqa?k=VpN1U45K21HXnAZbmFB&=8 zb$S(@Q8Q@X1$j~C5G?cl+B-Fpn`p8eBJw*&nRmsh_~XZB5Cjcx4!A;eT8{12TR-X2 zWt9k1qEjq*_TW+i1FV-+?U!JDe}uR(l`o$^?}FfL8!be%r`Ah+P(*-~Wb8fV8|f+w zn0-c20LFQxn`ot!NQQ*w3a8fa!(t9D`TIuUR~fjH`<)LC?C`-$NiL9&##j?ElmqC| zspNAc028uIzMic-`%GVeW`MQg?x}VEV)h`Dj(-<*Xfxl7!pa}rex^h&%xarNjs}ES zt%Ema{@iG_!qH-MZTC?pEJmzLA}&%+oWFF5m5bRqSjB(Xt|U|a;h~G(*tHRoDu1^$ z0*U!W?3>NtQ^;wX6$A?>ZD|C6M~@!OTH<7WdLlrwzl^|8J9i%c)p=*~l8Z;SEf3zk zG0}>Mbl&Gng3ppS(64&42<9XPc%6qq=hN$WhEP`QK>A+6Hdw!7yqB^2;0FPK6c-e^ zl&?y|Lmf%Dq!#SrO6BBElTi^?*4C1sJDBv89`Oed&3Z6>Al<7;NwcbCf<|`Q8MuW* z4nFOFgNX}td`o0UF@7LB+gQxoDR|ueGlv1K3@kzz#pEH58&+9lW}JVIL%Np)JsHxY zD+bYpLpd^3fGY8WKa^xeA4F9tjC*+Dt({>XhRpIP5s|?sB*8J~59d39s4r}S-7tjn zajtD|2y06|f4)1BhX;k4)T7kyTFS-^}(k9w($ z;{7W*C-5MSSr6fbU3$ej1D}S_E7v^~|AOTTqJmGU7-mBF6 z5f(WbgEsRD!35-A3@cQ)Np4l{WxrYBuE?U8ED zgW8>2WxsW6}I?5K@&diG%%oAx%sV(TYVQ_= z1lB$3?1bLAR%%^gn7rnUs-$3FTb-x3Avk&^cY$^CLmi*so>p#=JKtpnpG>&%DW^ac zq&`3o!P7MR?wK>4*md}pL=XZ$G6cfdo4vfbzrAUkWy$N;U9m>NGVt*PNTpJS0dQYt z=X((4sKZo+Udl(zusrpGWZz$hIKDr(im-n_-*ML+Mrz%U2|93q{ST`l2$s@A!G2es z)euUJKK*>tO>J3C3Mo2p>3dIofz{ZnuoR-lpsvo4Q%y<%`&zA7;XC_GjB1CVb&2L* z+0x)CshzT?x&Op)>=8>p8>KKi508GL;s5D$%Ifpw#sB^*Rno7@Ik#SIhu{xh%x9{? zxz9I~lPUJy+JA4CIvx0LjVFii3``Hus(+&0&&~L<`~NO&wzaknCL&=kW@a1-`V7~9 zC-}| zI4atr!#AO+TpkNVQ}CW1`9tQT#8!OvY}Q6y8bN68X7iPlmhQn{5^HcZx!(B;K28v} zwAedWA2o;7P65r3`Z3ZQzlz#4uF-1M=&pD;K6u&9_nRUYcse$=BNHH`ep+ZyjS&U5 z2Wg)iRp5|t@#2|&*8z|8Uo0P25UA zI$wBQ^noOv#~6HKfO2EvnJGurn4XYlD4v0w+@Qy}8l*}V^>fzP&)<6Q9%f@f_}4wI z@_95dh6h4W)o(Y8vt$Qee^oX;kk8F-g1u0TGKcz$GE4w96HvjI#APmkH70ld`lSyF z6soZ$1C!YQT`2Y0idexY6)@!WS*sUi4xdGDN_6)$HG|`3ad{D&(zn{8ZUO+l)W65? z9!!9tNocb|LYo!Ni+rUZQyJDPXBWFI{k!2zkwlrr?1i;+)|_!s}*D>wR4I= z{4>*^25Rn^;o6lAdS4!v?#8fpII>0lzd({#`!_1|5wn?U^8E&%;GZ-|5fn1Hfi{JK_a^vpr+YEFP6Ti-le`Yk!u8G@j zLD$#(?f>Nb?gvT(R|~GoNNEp;nq>-$nHpK3GTrh;??o5-Pc0ze4t7bevuoe;u-}pK zhj-sOGgW@WqOnIvZiKnL%P*hnJe&mu5`QVA9%e?77?m-*^b|?_(#=8ReO1gT!C$_g zp!|h04D?7qJoJ2?&JdMnF1l;4X@#ro|II*}_|>6CN?>It`z7?~pb9_+@p;U;+Q~kI zLG~^rH!7??Hj(Lh=TyIV+b+_MI;(XTh@(>#Q~%okc>yFuj*c9$1*&Hg58asPeEx(*Jf);reE-oM0Hwe$ zF@lVnms(ckR=LG4znZ#KBKI^$Bg(ueu*c9@C9{Js)J-^^Vm@kCP>VPpZQf9Pd^?2) zx~q2WxzQKzc+~;wCSoday5WPBgEipo&S>2aiAH(^)WduEf)Moj=bT0_?or#>c{7HF(>S`P`Et@n-Tm=J*mYK>lx$FsoHepfUV+IJ=u0E(?5`b} zreggiI?Cwl()8Em<-p~9<+SB$N0p^(9{a-D>bFmoLEkzY_&Y@(*lD$LrO#!*{gZTc zZHFcYtcI9|yz_~zyp>^h58;+PZu+=(yT2)&jRY=e`__Mr8HIS(@k=~&Q4Ib%|J@kG z&qo*;WiGe$hpC8a6{X^?(M1Mj|S-0N1>>t=H9o~#O5fJe^P+GTIwp~7_# zLb-Q3H&$}kd-d zYpx3TZl2y|%-rh*u{i}fOkK0cH&yG`wEa?rm2>kA_rg%3?A$}Rr;0IG&kvqLzi)|%V7SRk91??9< zeT1RzqMxrrfrHfV-QW{awlyfBl=cnHt-wMRGJA~jM(9Cm1e!<;)gyhMuJLvR66tc z;X@Q;+7kMO4xfr#pTku{exmI*B!pt z659JzXPygU75)%@RWU|1Qw(EPAKem1#lBoENGx>NSGasH4m)D&0Q$f9_`7OUIKSbE4ej~~V^8^JZ7-NVrM1 zIEoa-%o#Bly(3dIV6++-#~C*L+ow-sQ)hv8!_{)B0xI2Oa#8%;fWS}{U!h)2?;JR-{k;`7(e!k8>t3oO?_srdg z(H*S92Z+&GwERfbj_)!3HHS7u@77muDghNj z5|F(U|7zS5V_2|Tu6rVrSh$!?Shw_kFcX7oO3HVLZPo1fz>}L)S<6qBRdc=`AK50`W z6ZY}42fX?+TTMO-ciEWVkE$Dcf4L5tgo>rYk(zdD{*^AUqJrhcDZ?l@(WvCGYVF!U zCmDj-ntS=qNmLnd#29EZ(ZmsXX(N~;KM7L-=i~76t(wY*>5q2OW-3?@PB039MB1HT z3T=#N&73>K3yW#M>_Ug0Cr~|R{{2iwh=e`tr|uRt_Z!1FoOSD^57P9@`Tlo zAW-ag?K*KSXfSD1+*bv!`9R4zHxFT&&R@)3dYeD>A74Z!g-ipJy3)oN`ApTe1G~{Q zn)!C9Ktz`+CK}BFMwO1l^B_VSwd>ZpvYAM&lemdyX#R9A4?XJ!_dzjfWO&&;`_x)p zY9JAqZrvIp?(F2K=I>kg=YFJF9EHUKu26bmCX~huyWL#0fme(&Ky>O~yT+7(Nfnwk zL!{2CgN8u@@Nt3fyvkA`CraCZ`%5^0_YMP@+8Te<7U z0EG0!J9k28Q-Pp{Liupx22MG4JT})@iYsehVh!GHXc%rYgA6q$|D3saQI-bt-+rYZ zxOHqs{Ijt0=m|zJzEpi;4)3$gJ_waM4w%6)#KK$wUJe(QiMHcx;{)=^$;pe3eq+CK zZ{o~f>okUF?22Kykm$e9J%&pTYKYN3z!5n2ZP?a@0`|*L%4BsMwJR^kp6|xYEvB%A zPzGcM^gwq6@>6Ax`YcO*1KmzwHSlWg!%D;7(rBo|*T64GaqP=YRoBu>LeW~k4NNL^ z5ekQRrG&e`WLO&3kbOtM7X&@C${;A}xh1iZJ2L$+>lGfKG)DhfX=&6_4U8b-f;QKR z%q}mV3SNdy4)VHBijbF=cZIAM<8mn~-$mvH$G+i4itvkec2k-o_QP?YY9b#1%gP8l_Z;M<2L#f4(&n5ef}y^shO6 z0}??cu+Z5TAWP1KuH3vB4uMCC#_0$Spg|UUfiSvmfyOuST5|C@cly4cHwvnYoq%0~ z@XbT|f2z6?aH_lQjlyRL;f5$BkrI())`X}OQ7UAvL?y|PF_p|AA)$zrDNd5UV=D7p zDpQdmr!pKq8R{7R?{@F=f9~z+(W9dr`?vSnYrXHg-Ua#PT?cI~EgsY%*FzWn3$vaEl5LM_Q=bDT8h>EN3`kNWvn1B zaS|Fq@L*e@2l3o2EZc428Qf9)6v2fpu+OY)K)+*gEZ)2xF%tI!bdw;rw!u%JnIBas zf<90q)La-+`tU5<^CA@_1c4|@!3*`$pU|<{aRpT18{pC6zQuhEw82U_aWcXmuyVK_ zZp%Rnf@m2(-Tyt|P&3dggwSS&CcBU$V{sa%5$b_p0CGqLhn$~-yN4nO9Vb7&hZ1Dh z(UB939pWZd1`?{Y{X0aZYpSbj=?bw1=pK3m(KjgG!4(!jRFO}D!Q7qpZXG~;K~8X{ z!~DU1Nz5IMF5K|u%OY&lEn zl317AHsA!u;f78?A;l;08!9p8ul3!#-EzFL66K|F3Ej{-bnR9+APFr18m9&z>3Rdz zma7-~u(^Sf5|eN|M45C7BjJz6(Lo14S8YUv+i0A4}T<)m<)Go6-(IpjnHU<9m7N0_0*&vLp|w0wQJ8L1Rq=^`e4~r z4X5H=ia!gaZ!CtCVMu*)5m|xnc%b-KxYg$&G0=Qvo=csnLN8_{esp36)b$wZoVbQ` zRtps|sn-=o-l|Vc3~V}}6dQTdF|lL7dyUh@a?3dn;|0#F~HX5)V!C1M6&{Pnbf*9Kx+X!*qykn3KG1dk?nD4bJHY@)DPzqy5*9Vjw>Ln8!co3H^5@Czmt7!uzJ|LN}7 zZ90o61(6`9vLGM%6- zD4hDp)C*LxL@x>?9vwa4Z%&$z&7>nZ;SwpwFzh`m^^hXqiiJ3(;;hmhT!zpaB3S|5 zh64=IJuo#-zhRZ}g4-o}NIFUG296(h05Qc5Bf>d20Eaz;27m+(48xLOR zsO}oQI)}Y4uk*R%@!Nq3Z!Z8Ac7!Fj8Ep*G%2Dc)m!n zPV#Lt`V3YXCFN1c2xmUw6}y(qi=z^m2e#W&PLL#J5kuj^{r)`h+k*~Y;9h_mPAmhx z3jxTT7!vI=Emg&ugB$$M%*vS`oGx`O7DI;|kcD##S&$rW-ME0kBA53-*WCBnXt;C%2_Qne=lS`&soUAW zcc3C7qhQ4XaJefeDG@6ICuiqJMMZJuJB8yZM$q>(4YLn#j;U*A7Y8*wRK$Wn{s`I&kP@C(yopU$ooa^j4(c`G%i!~gWEuGo z6l~Iy@3EIK#$^rv16yxp$Z~;$VEu^H4-^m_qCB&Pk#S%v0eiu&C8LZ`GlYhQK0dqH z7bFgj!q&xQC9Nez+I9+Q60g=Q6FS>uhy!}7Q7Zb^>gzeNPxkkn;R)JXa|a0no|KaR zG}NQWX2E6?5)+-3D8g?)T&Nbk*gBcfb`F;(m_z`_Ux8!*!$9+hM1eC%2{7I+oc~tE z>*~@`ze08gnH*>y*mBnd8%lbtf;<%t9UBAu{!P~^H~LmLUnW*sl#MI@s5*slky zDMHh3$oqoeL9*u(mhD$F zmJcA3Oxb~SV;sr?JDX(}0exWAp@@+Qp!^k#6*HHs0a1LS5Ygcu3s|u3W5((U=G&fl z19u7frX-n>?a6}bY}R93jg(Jt%!_~vr}6U4)YN`^rO-GYW&iD`kL%V)?2~wLAa1`T zs9^-ICI@74!Ij80REyq|1gtlK5u9IPHqL5v&n(eur83?~@=FK|lykCu2!;p; zz&oZG_MPq$^0p6&k8ugp!=o%O748|NqrU%@cp?Qo`$(sunj3U)ke!U!FgzE#^+SCA zHcBoGRuD`Ape#Th`PleJRNn`%Emo1U@b#=48_MLVeWlv?B(yUadX?yG01ILazr#(8%b+5h_gSpExBu$ zX(**Sf(aN7inDY9+pi5ow^i2bC!s0=v&dJNFCLub3Xac1!#6W2WjU-l`haJuE00bgEwSH zL7KR(ocEfFh)Tn*<<${9hW!d>K}Bqv(q|bcNRoVe=GLxtm-=OIG4TZrN$O@8Iws+; z!i84gI1P3z^uK;flFp01Ieivab^L(V0ToMjZf@z%8V}+h=*<`{%KM{GDiD9OOCJwtHvp|H-!S?OU;$|2IX*Ak z5)L@u=F2+N2bNEF3>=_kj>bJ#IfvbZLn$56;Tt`yu{u1tR`Rcm-BhmL8{{LlK+HUau%RJ(8j2;-%!3D8XaROaHe>-5v z&vGRZbbs+|6aW>nuI08HtV<$qCqaLJrf%vr1X0ikKU@_Ph<$O-j(oF`BbvYGeF5aW zrvaKlaYQ}ut<}5!a^6Qr&0jO&y0(@{7oDB0(PT}(k8Xv%Zd#g}N$yGS&T5#Hp~t@Q zjR?_4bKd+uiEP7jogz?ynD%vV$*Ia*USt>06#BgEbVB&`9Bs782XjD+MLUapo&`Mf;BQVn54fVUK*1X*Pf*u5(7KqJ zPCLbKC1oBO$upMzB?|rUr2hrixN@8P!7uR908lsC^EVDZEarW9Fz~aY0h%GeQ+3b9 zI*#)8_GSc>l$Mlf1Dq!BW@-TBLC5Gcl|hDX07psz_=GL_kXof0h^8rbIK&qZTAJ9pI zZV4@%KfD61Ih9W79`zixM^3;NxSlS8y3IP@?7J&~KGgF)>T5+rRF#hL^6(6WHvr^P zPTZPzky83{QIi}KPkI}GXUD>!kHsythHDuIrCiU30h#ff!rXHZhm%9`*n|}o6;uXx zSC24JGhZ%7JkFF&GK4Ar&=f{#hk^V2^S~gTv>djNVLwf|-$I-6UfW8{Q0bXLt_Nyy zaB2}wThu?S)BJCWy?t(>t%AMwTH#Q1oX7cY^)spF%#c*}WOc@M+Jt+DRg;LA(im4wM7DD~=rcE>B8e`qIPYIl z?RO`0?#1hC_Zaarv;{R!^Uex2ZI44Jxt5L8e54!Mx16Nmh+|4pJ!%mZvF1l=+GZ&z zPFMoI1}FITe+r-V+1lO3#zFKXwdxlSVqcnIe(J+rxH~A#3k^QQlPe$7h zDuc(;)uhwNtyxWCi*3@lRrlx9W!Ygh1Ml4QK6*;UFvm6c*d&R&HR0PD)7a^7UBUA_ zoa5@iR~yX)|jF#2VnW6 zZv&-g<^_J5-ikjy=1CORh6M)CCkw<>)L2=Qf$bW(%_+*dVp9t|pX9f6_gbbD=B+V3 z%wAKTR-cT&ck3OMzw~ts_vP-fy8eF}tZQ!o literal 0 HcmV?d00001 From 22ace9991d4608097fa1ea7ab615a03701b2d4a5 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 4 May 2016 17:36:30 +1000 Subject: [PATCH 136/439] removed old image, replaced with images frrom Heike --- .../windows-defender-advanced-threat-protection.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/keep-secure/windows-defender-advanced-threat-protection.md b/windows/keep-secure/windows-defender-advanced-threat-protection.md index a9833ce304..0e2829f1c6 100644 --- a/windows/keep-secure/windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/windows-defender-advanced-threat-protection.md @@ -44,7 +44,7 @@ Windows Defender ATP uses the following combination of technology built into Win The following diagram shows these Windows Defender ATP service components: -![Windows Defender ATP service components](images/service-components.png) +![Windows Defender ATP service components](images/components.png) Endpoint investigation capabilities in this service let you drill down into security alerts and understand the scope and nature of a potential @@ -59,6 +59,8 @@ antimalware products. Windows Defender ATP leverages Microsoft technology and expertise to detect sophisticated cyber-attacks, providing: +![Image to show the protection service that Windows Defender ATP provides](images/value-prop.png) + - Behavior-based, cloud-powered, advanced attack detection Finds the attacks that made it past all other defenses (post breach detection),provides actionable, correlated alerts for known and unknown adversaries trying to hide their activities on endpoints. From 3598ac41688f9c7d3e082b2457f2790b68371425 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 5 May 2016 15:36:50 +1000 Subject: [PATCH 137/439] replaced the whole configure proxy and internet connectivity section as per Naama and Tomer's new document --- windows/keep-secure/images/portqry.png | Bin 0 -> 68569 bytes windows/keep-secure/images/proxy-settings.png | Bin 0 -> 96706 bytes windows/keep-secure/images/psexec-cmd.png | Bin 0 -> 39672 bytes ...ows-defender-advanced-threat-protection.md | 166 ++++++++++++++---- 4 files changed, 136 insertions(+), 30 deletions(-) create mode 100644 windows/keep-secure/images/portqry.png create mode 100644 windows/keep-secure/images/proxy-settings.png create mode 100644 windows/keep-secure/images/psexec-cmd.png diff --git a/windows/keep-secure/images/portqry.png b/windows/keep-secure/images/portqry.png new file mode 100644 index 0000000000000000000000000000000000000000..227b201d83670dbfff48b5954c12de6b6310515b GIT binary patch literal 68569 zcmYIv18`+Qw{x}nZQJI=wrx&4@r}(JV`AI3ZEIrxneTh={Z;4Isam~HpWWTJ zyLYd(PlTep1OhA$EC>h)f|R7FG6)Em0|*GH6g1=)f*XUZ{dI$JkkoVr0YU8l_XAC$ zLB#z6pW@(Y4@`GQ1EosFF=9b7E! z?Lg3Ah)BM0*nhZ)y@RKdrMZO*NCnb3_ZN!zAJoaz@So`q7fV}H5Vl7on6DC;e&(rL(b(;g_isNK=z9E5B_QBWM^q-4$_T#81{uh{r7oS zCu38P`_G`W|1}e_x3x93a{+l6Pwx7{Ape=ETDsVnf|Oj&Qhsc3!poogh7qFRQ|bhjxZ zNzw5rd(|a?NYB!&zj^mRQwS}j%K zr=_J~MT@uVUAdk~2UMfJ_!SFL(V%;L@Y$mO#|l}C2@4)X65!I;It%O){8(a>`tRe- z+1B6e0HnGcB`P1~IHb_OetcbTd!$mr$r;WzdexY*N5#HCVsMK8lw8vgNufdp1!nQM z*E;TryKrv+4XW7U1JVBLO49U+OCbZSI^rCj+3n}0k4j13>x)ZMM^9_FV;qNp-kxQ|N86qEm4~6t5u}r;fv9w{IEZCe8ZX2(&M6=fl?Dv?3 z%+n1&_4C0+cW;JP-8v%VXZ*TcSU|4r*Mde^j+ks!34g(JG!H6Toy^uTI0}{dE9?b# z=^M~?c)9iJ-^g%?B17yf$pA>d`cb_cBV)pCL*VP4G8RG_h-!bkhyBZ2;V^rKiqbK` z-Gop7Tz1Gax_G_mg!dOpM+5Kchn)_cscxto$&6zt!mBe#Tpu9K&zUC%k6%0t#eJGV zK6gt_rFLp(}!k7h_(aQ$ z-NQVGa~wp-I;J*W2Yi1?AQ_A5(kHat44pu&{KcaQW%knO@G7B=FE{EW?~-oPM^|3% zDe!3Gr3hH#^!!5Aa;k@Lc+z=_AB4|teqoZ1^jIBC^E^0nPWipycahp@K`!Mbcm#C#Wba&d16yPJ zUJ!FWo{6mz@#wlIF7#X~SF!2@Tl`39)jF-^fn=An7I<)iY4P^S!~0DL`J>?d`naN; z&v6G}^smXM$?>@W(=Es6PbeYTOflxoRi z0t;Q_)e1ov|NS62a-=lobjIxvJ%;jE%d~)_fLd-dHf5N7e?Pp-qly_n$eFZ>I+p44G?JgW9it*h$rfb2~%$W{Jzy`a(Wd1 z*vQ;|2ryF$Il1rYr_{q^t%8Okq$-E-xx33mWp@$q7YW@h^_8k2h=!+fADNt)F=B*M z?NG_n1KN`q$;@h9?VZC&M?43iByr zhd1}2?K!(Ca37Tw)uRV?gmCc`9xt;ZBJcW?HKQ92cDn_r)8-QqMMEttOG^4+mT{?v zCuzx;fM}*iNXm-F_L@W(Gx%+DExKSzd7zxpYN;3URbIoeG_JMmYR8p(oqOsHpwMHM@e&&W}Oe5dO@)%3v{@qUY(t+xQ+~)c%b!F=d}Vxp_TK^vJILYt;^F z=wiJUIy=fePEK+k-Ow-AKvtwz#K{BaU7l1exuq~u_=-JGm)RaK@=hu~PLU!UMLd^NXf{WGiuPx}KRsjP9m!Gs@HhD)AjU!!ig&gx{k z5(&kRdfkxK`I&8ARKjTSvRJCsK!lZfZeyO_=A9$y8oI#@v6A-u%x5R-?b z!b27JJRX*$fpr=AmGF1XZ+|@PK_A_sM7z3>bHX1)OVXdn%isPEvZ(_y)TG(~((|S( zCZ-3V$jBR!Ygd_3nLNML5g+8~Q3PdkxWgmmy=RWb74*AzC$y)2&}M}oMt12Vz4Of38ZX#< z-#;T9(+g<5xl_8UL{eGqzvCgOiHb*?Z4HgBcr-$6#gKRye0aR!jFna~4Cy7vcm~~; z>5EEXb}wtfo#5mR($QeAF@*fw`b1Y#)hEzcPgBV83I)VCd-#~4+w-?a73GrJb?vd& zA42}h2R}yZ3TfgX=zm8tg)vnQoicr(gHcUh*r{MBtlF>p81IrYKtg{BGw9uNtysx9dg z3$Qt?VXK1dZypwPUN&z?SN*2_v2STdt6f9JS63vIuIL3KW1g2I zOO!84ZwAyn!?j^>B@;v2h#6pw&?5TC1WVXoio5lG2PJ6w*}H z`~w;GHU=XV6dL@kq4oGVHE!nL1?rVc}K&cI$=s)cm-E_YU_smj8o zr-+hCzu_Ey9@hm|3p!Fqh`pC@w<8Ht4x`z_BnFvNvwd9gf6J?AK5V0Z;iK`P<;7E^N!i;!1XOE-*Gz$Vt)Nh-jvXq~ zDHjK~2ihgIIs#8K!R`hxaS!J@9|AVRPkB`WtsrFBTfRLbxiy8U@{U!|tKzOj-fcUg zi&xtW_Lsp=O1y29*wLs}>C}nF*aCa%=iYh;7x>@cHSW;oj-s~rXBXO^Utm8xw(x1s zD)U{2+I*TBaJQDVQ+bI4<)+>UU#*3kA6qC=SNsVXY~>~HT;P6PZ;40rg=jDCpt;=V z2!@sZVi}_GQ`SrI3)Wfkg+ImWqZo?3;XZFBX`2NSCBPxr9w%e{TA2^1JK)$ld*7)x zLuE$2$J^4I94>voQCp$9{ZL$5`x{izH1-{51O$HNldBy)MZtom_I)h%@H8_5ZC36hYIUm@XU1j_chnciz}x9ubUpln0@ zy}o~MOy9EyDVtX`EKtkaQ^Zmj=K7ZC@^FL~09GqsM7b2aDG^)RnO-LT?IGQW`dp8d znob&_`4o1!`P8)$7c7yy+2+(EO9)4TnY;y`X?X!y^Av0@5DEz?a>kBG}>7DX13@o5@S$n?LnTC?m9XS&(M9;o} zvWcr)#ux=Cj$vpBOL?!ut=?W4ljcj<@yqZ~_w8on$blpKAR4JN|IaM6$A~~@>}k9+ zHrC$QqA&?TF@ju%2{}V+juJbIMCThWZp_klUJS>k-q0_Y$J6=Vg7iebpdM-oO|Fub#VcmQ<~AteMYS1j9i zBIBPg3LGzL$6zGa2oVOm`JaY`6@n`I!Ug5eSW_DfxO){!{fQUb)8Ei?DL5I!xBFEI zJeuk3H04}{U|=sAL@-@7ewuACrAr3E8Xssbwzq^v+HtHUcSV^!5P$sb;xMk{AJita z%`F^sS}=Y3)-W^`Kh?6U9+*u_!gE$y(O|5WT54O;lb@snIf#N?Mec8Y%c6Rc@ zK$^7?_Af2HiJ(g%?7vAO<;!nQU8do)#;eTyG1$T#(Ogwp@>@QBZMz3Ky|*8Rs?dIO zcx6-_{5FfshDT>Gs1NGTadtY4DyX&e`Jp-)-k6l_p!Z#bglSJk|U}1_g-( z4C#8SZx{$iCG`r%PjXg^`1kpW)JhGi)&e$=??z`DjjYibm~VkIB5h7i6H>dc3P9`d z_$KuOMx$YLRQ!SVx?S%cF#x3RhqJM=*Ef)wyz9z z8$Wlz(petWEl9P1Gl*-i-zXZ7 z0C28Q;O|iy+KT@>C*wccTW|hG=yGf$`ncN7ThUNQ ze~+FGRHh;s3mB7^6N7nz*v9-W8=wW|)9g7@Fb>Ud2t3*(D_?kKFFKOEYH~mr67P0HY;_Lm`{f7ccOqkHC zL9Om4QWoBjlo#Ry0nZml{McdDRaoPv-0xIn|D1ndx9ldTE&{atdbP=>_Bw;^}&dG(!1r~ zvXdF(9~rU5j;4}@dAAdL*wZrujY+taP9nydkVykXJ{`NBF=~y!>s@!Ey38Sqv=t}$Sz^4Jb-(T7;gF;UMr01x(@i- zWBvUaFZ+xOj<6wK?y6J9D-ZCoK(08Spzji|obW3KtLB-4`RKC61xAg8XvaqKXyUP} z;9h62t__jNZp7gwleTg11=apDmPVdWOi21^9<-x)_Vi<#V_(blk`t1KpL?Dh%E z1beA`uE>4_n6>NuDTMYm*ojwWSA(`LnzeCVuJ}{WzWOyzW7zB!FQEgEbcZXQW{LD9 zQ0&!4D#rM1_po?waIW{!%a!ERG-Zy~yQw~(7k3e}1=qrctJ0m^YVrnm4tDr6*rp>~ zo@k!s`nw6fnklUSr$@h0bEU`HrxEiSudMy^*I!B6Q{cHb zk;cnUN|f?`{$E|Kinl7a^QSFsc`Rj0eyy~+{6OM{kY7rq#e35MEGc((cwT3@yKPIa zIq@44$Na3pOJ3w$PwBlrz~{;*+vkLwm71rx>p7|bm_*61t?;*x#q(jn5lhv~t?DU& zB^s4)kj`Xx+O9wJiRrfLlgMez+$ULme7YqPdyxx1WGSS>iqN{zRBxv0ZsRreX`2yp z0B=8cLRQz7L_l8fMdH!$vUfzZly8`t$I`m9a2Tw%E?zvxJBjOg*pxAfEf?VlX}qgU8$6#uZSI99_=taMbbm*T$bk+8oWB!>|8v z6>*)dk*8R|5Aa3ZYVh#)ZLmPr-F5g@=xv3p_A%L_%z5Isr!h@8IJBT1!IdDTKc4gD5 zsAMn`ud(F7eIQ=ZE3@(cL}&To7_{_92|N4>~GSXfK#%%d%~(8*1K+|WyPv)=L(U& z3aeHRoHH9-W*(F*y&X^}2CIf@8wg(65h{&y@NTCxfr*9MPxg1^=eI~?)@urS89dC@ zRJWQgF(uUu5eJI)MgvP>G9&`k=?v@iZFAoad{Bg?8w^% zJ+>S(7ItJV;xyq%EJmaYq^e+5<77MVX?aQ*!8h8ToA}5krtZB^v-wFYx z-^x^bj%^klziX9)VypAGaL*j4r!A}|6Q!A{qY;DTqiLm@ZOGFr?C!kif%q?5=M@Q|u?%l9|CYQ{^ z^2$?Gsq+Bu-TTa#j2z3al{}d=wduh~+4#M%BUeJ9reDA1t4VJ=8nLE1d>Ert{DAJQ zmaf+8SgtXK^7QoNXpasbx*(_LO^qndkJ}%5@Zy_-f8k)eFLx8cOD zMHe4{!V?FyeXq_a`vv#rQdRUHVW@Yi@9aK*#sV4^_N6U5q-^f=+N*;&;D3ZFpa(C( zofltxd_2c^w^V@M!}d)$$p7j)_m6IQ(%nc+{T)3jDqlqYmjV>5kNbZz(cu4Ca)?7X z{6{*1?qd4Cs-sarGym&>eboPnS;nFu|0AH`lKihGwS|>-Cg3K69PH1b84~M{9N6iV z2z&Dl(}_{xmc^>B~&eOVKoaXG;jHU@cA{$VXB@7=SD`(&kEk36*T9{cdQVJ3)iMHg~GR?nh|8U|1Ju zB%u!p95w)NAmd8p;QXjW_!N2ty>0PTMh!&iz~nR|h7d|MNle~+>~=f5B#$XLSOpGB-&kw z)_B4q5gy}=)4O5#q}_Rej{x`ZxFP);dzE)6Uei_?ct_IqM|@K>KR>m@{P!o_e^k+r zcVc2AaO zAjw{C)xOcXEAsVvEJN&-htU&UDc{Rtu!q5$khbSre@czbI;`#ai@tmq^YbT)XpAbF zDd0=gS4G@ianzo+&3Uw=u08~{_zyz=LXa+-vNs=C)n(PKe0PF2#vJeCFs8FcOwJF- z?go_NuQYufHB7xdtu@&(7JpoN-+UWH3@0)+{!sg=vqvbAW9OL3*ytA~P{x9A58uy#T-bbZNDR|B)ux z>PCO2=A0BG)(B5~P!cZE&UFCyCHeO$Y=x+<^p{M&_Sc!F5^i}D;U)1-&5p2_ZS+Gq z$;0_clKz;?i965>MckuX7ip3t^TwOSR*_*V@Pfnl7*Hv{>BNEJD<5&Qy#*v3Dg22i zY!=BomYsyu;IebPoX&eHu51JGD14#t9Kdk1s&E$OlgWZaVTw#)RO&!s9@UeDt%?16 z=mL*|vB+TYE7k{N3!zt%=*UfU#nT})Vn}G9N(y7UHLI2c|5>ts?~N0Qv@Tu(=475s zArhb=aN|smf^IH`pEM*5u6TA)Kf1g#ZX%~^C_?!<@?x~Y^VZ_X9C&w5knA5HI#BR~ z$dy&42>yp;-WM~>!>?PHP-ac~yWyrIZC!w%Nr6;%ufVeTPl&s~R~e4IArKd;sj5nnYtax zu&%kon(AN~oa67wX(P}Kt;lziLY%Q-BwVRJ; zVpc=GuP~DFfmVO;wFryA>xo@_-~86sk~9)?YOw9fR*y$HV$7`fyj`4zFM646Miz%F z&K|LfsC3GJJ1p_m6-{-)oTED2AJvebfIe|S$JrFW$cVjCCx*_DmPBGm7j}O9;7FtH z4PrC{leshObBdsQWdn6)LxQ=H3bndV^03r*f5|k?ty3Vfcq<0ozQDgQWQu=O{3K<3 zH>3&h@f_)+YGN=_@W_z%7fl5r>s5dbBUy`E5F6y2bnF z?Z1Gd*-@}w=x|X&w@GqXAeQomm%vlCw-!XL}KKkK48a?jQ4fi zyB@b8oC}UTuC6h3($`zb-wVq2MFIG+O%IO`kdl@swj7k@4ddT!aCU{yeCPSTt~UW! z?tT+5+ykDVqWO8Fy}!t5VZ)dgd)c?k6}0^PFh|?ebg&b4$XrpMnw54BBKZ?9T-~bD z%L@s+|HYmm_mn*@dxxNLUhhnXpG*&`sKAtSbv4<=xUrr;5doOv{Kt#CUZwq2ftVzFInw}8RMH!fn1vy;UbV(9u@goPXgUn_)z&#m<6 z1|7p$Z|dXm2E>uw{@UK4HT}Sun~^iP78`R)kb2WxAnvrKs$}J8wG{ryFxB44_r2I9 z-HFWwedmh&lk^2XJ(x;`AMr}@9+mfrC7>xua2cDX*7N$$dmD!BZl8RaC5}aFH6u4%;fvxRSju?5s7DEynq~ z+X!ue!#3M<80zB_X)%aYGO@C{%zELWIOk5QLcSbU79F6)t!20PxSaurH;1~)|) z{1koyf?P^SpkVVf0oLrPb$5wp+@KH7JK0pVKV$aP{%KLM1)^Y@fKmqjp_-r-4J$a# zcwNK*y1gF^bQ9z)x~O|cwA-;lT6%AHKe$&W)2{f92a?-qQog5&7PiF|9Q`_;W(m=C{=iq5|w+Yq}AYIt0idA6|xaUD=8K$x%z(Zv(+%(BKh z;~}qfE9z^}DDqr6WWP}w%$;~%i$vNWq?wRP;OYe8Uwl#T+VQ-0T#8I?*$@i*ACf#TRwYY^#Ta$m^rk zif|x|{Z{pbsUhk#>`8p6 z+GGEZ@Vj1Tyos)dO;>H&)Ff1c!}AYtL6A~^yAikKzX!*!>YQw|&v_EOMT<$guT;vpMjlK~r z4}U$xA~z!D7OhCjxPpw+*k88T5uA+?+T``#yy-dq#r&UwurIV4tCMQNg{}-nLPd@iCYExihw(_(g+3r1gbe?f%M)mN2oS&f8KJaQCCkHu5=w>Pe54IqF$| zfYL`fXpV>#RZ)0ai9<~ia)xw@m>c!8q@r-R<32{1EXXhiM`6q8mX4ioxl5|) ziwm1m0RZVJ#K(oRhVWCabjNq@eAarRFD9|HG@M$F=hEwrX!o{jKV&I3zI9(O^w^2Z z%u&iq*q2mVTBg*lVraUCu&Iy~4KGE~2p8i3h>^Ok6&jN!>k~z&>y22T zU!TRd_NZ*-x_2L8K3_r<{0fC)cv!2z_7+{N8TkgG(FSz=MaBiXXYTP7`Q3(xMO^RgDLFvxpN24RI@W?KT^Sl zy5>&Xw<`i;y%b0pl+|176va+PwV~p;S^)t8nb)WWP_ZNKd^Lc4JQ2*T&hEZewBah| zOr8@g{^-M==7JOuz$ePUSAgb-C6F2#7QE~E z2)63TvyE-^$ZrObZ ztP4xVwVu;uNy7wC2Lqn-qeKu(x(0JqD)TF&!_|;l zFC;zko2o8Nz$;W5&Y1;s+l*x*rGt_#Kmy1U$0)ND4O$lLsuj3b{lDTez!RH(9h zQ)6-fpoKH)+^j)?f{Xn%3O%+}#7%|S-NTJ^rdHHbS4JD|<_>wJwEPhz$o?)kY3Cx^ z%RcoW40g4%bw4Np$b|S_z_7mn;!|5KR6qjs!%W`&d_v=n_2hSbp4Y>M3@Qft+&}fO z=H(vkHMEhx$jKbzg^pRRGUX2TF_M*a)rEx&QN(})=;-?@iXQQiEoqrN*&!61Q6SOd zCs}994xCM%LXD8M&eBTXLJY38D5 zeH_uK&B3{zO*#3tYo4d;+`T7@eMduJnLgycl31HAa}c&kpKm(!rfP*gU%tb3an_R~d%J*Ius&C&JHW2?+|8ob^FSXAWt zV2f|HUZ{U4w4m9JERB8Urk?4oH{(Pgk)IRrbj;p$C*+Y(}an-reh+ezRha`Zocs3*sOr^iMY)QBE7*H5r{z!CxOpgQ=aQtNH)DA7OO= zGW9pM(uP}m)ZJc<4OeBf*ff@vq&1u>9VP52${(8OyJ^5svi|Ts+W*GlH*$rIsx=(% zoHW7m%(@em$sHL%0yRUXEMh1`q@E%>|7T5unLIfP{Dh;k1KRK_$0i7dBn-LQnz$~v z6&R*f^!W5Vj^)fEW&4Aot=>~ttrI@WjY38Ij#$TA|4jliB>ctrav?QyC*PDlH)U$MN5D)`5|)T zuz4Nr)f$^R9IPG6lxxp``lh?DQ?YG+A(go6xqp#zEJwhjfcc&&1DQJ&B~W))r5fXt zAb#PBxUkIM|P!tAYu*)E87 zlX53ueG!q7B*gtq2N$rcIDFh$f!EC*y+QC3132J*ovkw1beel20o90_$ulKMlGONy zGmgPfr&`|&$T^AQ3iR81GW0Loh&AHsKSYNHP%sFjB_(m+SefbD@H4=F^%;jpK#PBq zwBj?AqFU!ZV;8?all8G-CGuOvt@4|Vqgp@L?={Dr+=U?Zg?IjZgD^(ZDJ(8lDT*jG zccP_U-?!11gXBx)FB(Ir^N)BJk6#@e4mrp1lGW|sCm;g3%Xt4$2Njy&`aujMV&?q1 zOivky?LXBQWeIh1RCdf`iqiBDA)GhQWU%?Z&gTBTjvSHb@`XzH4b7Xm#2ez<$r00C zYHz+2UtB%;f5)FHi{_VG^7%;~Ca>JeF zF_{2D&)n1(?WN{vbM0h}2(?mynB}r9VMlj2TRNXdGB^%CaY3-#?hSEzk<}evH^h%q%;msRqyZtF z_X78l8xtmFvn4kE8YK#9R*(fGY&u}}bt>oX?k)_{gXJVh*?q7W&GW+r=99(IvrJCe z?D0&gYq015G8)RS)&;j2sQ2rQYfH^4L;-<5pd$=GIV`7|;M+DDp3vS30`KSU5c)gi z={%GeG9jUYtOqhR%(@+>dL+KDBxOyF(o>25rFqc5&kDL+rPq7l@tDz{`z6}%25t_O zLm;DBCOd_CWGI(=@} zRq)DGS$sZ7?pSTN7ph@Xy{3X(U|o%BnuunrldCtqvvkQIA?4BsmM>8ps&^uWKQ(bY!pw|KC>!htZHbUC0A*Ze8JiOuA zx$>;v_pzN5LXm-S@hWMYb|4h=ml7&DBVjo|9k1FEInMXlF>7(>YyF#_bS5%nO*u2VZk@>bh?tobFfA0{era|D9om$$=t8h&$W1J z!K#u_)o9K*wH4(QU4C*)F*g)H%x!~(#0v0*${A@$OT6`}aWdfTOdu^PV=jaVtTUlD zoQsh`?d|bSl>2K3&Rq;z*6lKh{yBa`LSr!fb6AOy*|i!39p{j4#o6G^w{^vV#`mJm z-T##LBVG(?iu^XA_~|kqDd_u0%p}*DhpjjNJ2|b%_ym&&9l>d>dyUt|qv}{-RE{Hs zFZat{jmSzw^^?gSl}+GHR5pKD-UWiqdqwIvz)P@bXaS1RA`liZzMB6Xj3n2d!e`|%%#TNqJoa?G>ObnQ<&>Q#<#JpXpH zt~fxq0dYM6tN>Mq&S|6Z&mk7m84n!xj&Xe?bQIUQthcFNDm?90NZmgS(U<~XB-bM< z%O%R;6xQVCQRk8BJKddh#DPO}dNz!ee6{S*A$*~nvUxA8`pqk5)6A#)6pN1o)C0Xh zFUJ+X$i^=UEYxlPlLE9CxuUj9Jfyd);$V24@mVGLnC~mc0y;ta)CadeH*@pPgp(0) zL#{TFp01P3mCim=M&+hzKJM7;B-f-3+AdwD(>;po%YdT9jAZB%mt4OYIyNFV9G`7g zG+dLlp1*s!!BXr=4#Z-5M)b|{>dql^g!99|#@G!9{t zED^dG=4nR^LzmPD&j=lVpncjPU4?`+tZ+p|zckWbMU3l}R4=U_rhLG0rFj`gXm?#s z87ijOZgul#PiOyN&7PEil`?Xuh&bOf0~EMen4}f0le9P77^nBXUcb$`JIobTuk8Oy zMbxGIIA{8>PYBuSdVvl?H9=gypnPAu?I!dpsCQ z2m|{b?s%pSPMaC-c!4Z2(z2Yk{^2Nzu;#}3=#%dAyNK5lg2_Bs_060G{p|( z1~i{is)Qz@7metsiXwq}FuD_#GsLzN@ONSTXDd&Y6tr~v|$FR zJVdwune82F{`rE%@Oqx*O zqs9G2mOMe~3IQxQc+*=&P%s@G6bMJ%*wEH`Y}8X*RbqXmd;Sew?6*syJM>A1xwILx zub)3DE3o9uUboYG)4ylD<1y3u%D3ZiglfvLuao7-b(ETpO=7W*ZV4O|rdS|cDvx_> z0_BU!`4}3W$8dZyAjv9@Cht6eTFYEb=X57q&||S(6$g!*1;W(;LS|ckNPn?Ae`)5c z6tsT<50(SUM6@j#9}Qj-<@YN$g2_OJQJoZp7fV1bY)bN9>hTHJJ3&CNB05Bqf{%kV zGF zLZciP!lD{On+Yqv8Zlb@c0flqObRven6VD8G@`jgkk5#F6^CVQ{(hIkjF; zrmvlb2MSOyXS0#1f^5&PF)BwcadjtXi&qmw9STUQ4I!#c`#QI6?SddnBO`(G5B{I@ zv9zAyP=p?UDSz(GT4drxA?K@o=02k2^-omK&L2;>lyucY>NOdU>X-TbnQ}v%0%5n> z^oNeS2*0*A)(ec|`0%F6$xW{<$PrFOZKSvlE(~a?^ieekPgP+vF-0h|o#>kQyGQte@Dcy-&i>NdINQhV$3YCxN1~+Uzi^ zX_jl(XKw&j6_7K!zTtDXTi#qt!Q?N<+Ec`hjsuR<0LEH+Hy#s~3-MIC+6V}{?1<;d z)>qgXfje1Rh3+Je@qeWE?>G}r_R$(ne1@~cU-(-XB;Wq=gMX?t1Rp?KFvI>h{51#_ zs;DJ2z(C4X6H$=3RUq7q5Zr=W$<&${8;lM!eb8u5qvKtD_BeS{tU-5J0nmBrqCW4p zz1S<~1~y$%oT8<+7pf_C2rWvppp(SEz1BZcdA4Px@r_PdYir^?mQ=~?*06ka=&!r_ z&GVXo<8A($Chw}aNnt2kb-QRF%dny@C&>|?;Hwpbcr+bGh zz7rj25J6AxetsXX#?t4L`zI+gEw~_mTZ`hHZ9uA;9i++Qc+JC23wp;hSNA6t;L~J0qTpK{< zF)McOF>KS?j#0Rmw60srSFWF(V6`Wi#Oo<^^ktL+4|tnq1!HUAzLd`paJh|^1N)#q znCAx1ZRMV?1CPxItJw}kY3Y)RbIpi^{O z;yQI#kulAUE&hK?x-v+}@cihkZO+|%!s zpUC^6rD^RxXWk%^ryhgj>Ec(27g90Gf2S{C`QMI>A5v_OCKy=K_+E*)TX8ID*C%nW z{Da2M299`UXz;s_ZX@^|EpebZtrbY7$^9s@x8Q>c4XO^5xuYpRJ{bNtu$7t5E6{V-&y6 zW2H%(lT(o)hO7ntoXtg89iee!-Y*)6g0DC@iFMyoGj+V(#m4j5GvnVZ7L_6S-UcOw zE8HyKyJ}#cW?oIqPM1ZAKmRjDS>3y{#eq4Eq}o(n0!o4Z_B&g#9L;ZOJCS;&kRdH8 zJxkr&*rL_`{j)3L(re@F52Gp1S#?S#32_wEeDTV~Jf#s2oHI(QvR;JLU1cfwCF9EB z;;-X)9c1x)?=c;kcHds;$d)8DgO@B3YeN zS>1vHYl{0=F%>}5%hiP_;^tR3f&N*57!@gNBBK%sozavxR0PvYNnr3r)D|Y@3k_pP z!fTz9N|Fz81cb>yE1%mnO(bvIaDBZ4J*M=FsCF7&5UKQb$6Hrrelf(%5Dsrg!edunRk4`kd@Tj+d0>VJ-+wC#y%K6!J$ zZxK)QHp>WnFI{O)4UXQzclP3DV9EZA&ij8Fc6!jy?bW8#?RnyU%oqAP<)~A{TOJl- zWpUnl`>+LirdfQJ#jfiOycGW8b>yn*-Csn*3BhbK zS0qgG%Uu1aI?+4UY);mHFEbK^!D?{fzq+(<_p!bJgcP#m`jyQo;W(P3gz!{`hs2hi zkD#zu8gPWmus3y32ga=tCUc*>9o=R7->?emiNYC78H#C-q8~dLCf^ybl8^YyaUx%# z&aoAV9n3%HP$8cXm99ZumGMPzRAKNv$s9=@9{*cII@7<31No8cOcXu{2z>2unoxY| z#1vCa7x7Wd{`^B~{7x3gIZQ&7o8A%NJ%R8b5VKrDaWje&-B;KYE#t*5coN*Mz&BlP z0iCI)F;v1Vl#B@&L_(5skwsQNW^RWnNsFeCfXr>7xd$$rks~|mU%LxFoLqvi5E^hd z`?&Us2-yq2!fBZHQ4%9pyokwS>xS4OZvR7tj6ZG3GX0CdMjNf7=F~@JQ`{9#K#5V+ z-^7;a#L79XaW&q6GCAL5+^w+}L)%k6k%_Z^POQf&?~hl}nnk^OZUMF(P8K{fcA!0} zY($Z4b5ij5)V=6HlD7G-Rj9@J_-nQY7J|+V@Fj#n(a9E{f{^P~9D3`WRw~%J0%Fy< zo7o2}IYoS>#qf{U^H^O%g=FR^S@25<$xBGSzVIVdIQdZoRmM!u*}SM5rt|Ia`NmQl z9$6gS-n8KpydowpW%}BYXmy=qvF*pE`HAxqPEJgOUZj#&Ob+OmrW3U~kC?oetY$O= zT;jVgLCpo3v>R>;mQMs($QY|V_z6*1ZZ@kT2}6H~Si(>nqova%Ufk|f@YniVj9Ej5 zT1n*~j-%B?B;lWJwk7IoJWEWa(hOZ>nfJ=Mr%mRNH7tFE_gnO!&GQl|trf{PmTHT~;R$8ZA$dviTw`mU8%Tl@;Et)}FTFl06=a zOURLP(?i+|GR2y~8>dJ5uDmPIH?;oSCH_R1Ivl=sg<4Og!pSl3?_M@?2om67Q*8-V z^tK=ZSp^H}{N3bI1lEHxW_rtLIck68>bU>KB#7CQRBV(?=J3GkN|VRZ6{4{7+#}TD zuH{Ay!q(<8Csk|EVs#;PL4PJ9E2n2L6yb%!8lG)wa=b_tK6(K*%lf!d{rR*}PO)!OY`^rqhc~gVCf5KJy<-VP>GwQ})E}nx|72vSHe`6iZ&M z9GfP+Dn4S50mO+E=ijsZ%vd#Qae7s61H-8$hq*NA{Glwq&VkU*$OmMyg(I_llR0cr ze^Feet_O=HjZZo6nT}&Gyq%nkOr90YWH2OFInAi4jG6u&XJ$10K@hB3C|aNZj;xkG zaTrhqQ3M*k+|yxqhUEeqbm`2tE<+f}Un*R{o~_8dC|Sf{XuY1UK0}dYX+ z+2s9D+Aku)WH#m-SQjq@%s5wh1wll%8pgp2k|HdKk}!S#d@~t7gOofQZ(h-njfO8i zwXyTrmHbVQA!s9GZno19fmhGP1U_}xCw^^apoL-iMgDg;>Ue2(P7?%knH9c9O?*cZ zMw6ojfqb6D+C>W$x$Jk|s8*OSYwjfdG5hFHoX1BerO%`7Q=9^dUKV&fnm7a}fIaFcx|9Kw#X-aIp z^3;06H5!Bc+CO8k)_nAx?_?kM(r+$D@Yk0+U`Z-cCvHfW-+QiBpR;VN;I_(O5bSm2 zt;N~Lx)q;?HgB1UWM~MnkzBUkL}0Q{A8+?dE1K#^u~uWcF0xU(S5x|T1%$DhH4~m+ zQ+3+#%d`Hy9P5};9!>{VpQHnC7jS8FA4w@VP_K6z6K@`C{HvCh6NNo71UgkjyUq3P zUs<0QIl_anP)D(oHY`=K$_eh#v`g^S@U$k6B-GqUZrR33-kQ=DQlQ&URjUoI_@XJx z4?C=y@+T)da*oZHmh*cSGy}fR6U1lzkbmF^?U(e}@Fq%{YCXYj z-|f|y4>M`zQLQ7+(goLIQ*asuwDK&Xtq@4F*qzJU(@`kTD&fCJwU^wqwm6_u3P}YL z&|Y&$tG^FLx3`x^dCml zhHh;AsAxETI8KLY(Y-#d>HZ5&3PaggLCxOyCG6=iMJ|A#%~4$C9Vif025~ zPfs$1>T9OW<+}sriXXDv54HXNvbX(iWETGZZYrFLK38sc@CP#X=uuUUE0B%X6;#lH z8I$2LQGfGN=lgmG4u!?{bp8Ut-pQaCRH9H|M?t0*cRnO3;$wlu*$y=8sRE@cMLwxu zEpjknNc^gr4xc3zu;y{^G485reqsUL4Uji2@Gj&GuLmeY0^XyN_8Jdtg&HW->lf&3 z0;d7af_J!rni(;bT=2nd1&`CWK!5?_CwW8CDvameoT*F>Lm;*tR&a?8b6sawkktq0 zd|LUW%O!hs?U*6x=Tf!zMUgYO!y=$6JHrA!OTwp&t<4%%qSosCMcV>nHj565&xore zX-nnLf|A?-5=@M)*DQ7YZ)G!UF4VU2s``B{ad>t6J+)j9rM}0xgMYq0kmBxsW7>JP z1(fF4Bh|d8oJK(Hqhf6SZm0o4_WFC4GcIJ)=@TlAc{6D}Q<=J=K%-u~Qj{J}X)uy% zyYB1d71p4z5{dYft2mpXSa9VjQcYg@rfo{bkizJ{hjtm29VL-XJ6e=4?+X?y9a3Q;2_!# zZy-dQ{XeF0`|bNwwYmP(SoZMr-7VRjXnM4M*2$sh2AryD9H-ea3Nt>bJm-OX{d&c;F-cSFNS_R zyC>tK2bP-+IYj1&@ru+Sm#_DvsWiI7j-uXTFB0IWr$W)`vIQX+!cYh>mS|lsa-g>+u1rV-W|kF2r9vBu z-2wD8ryp$o_)Sj?Tchd5*2<1(`yGG|1-@T;NnCe-OVq>Ds^%T${OLS#Sk6Y=tf7T| zVbD|ZI&C>hd*YUu*~PXMc-&=lzm}+IP0H*uh$Kv%sd>U=`d&@F`r`a%-S4TRm7S@r z6@9tKNQiQU1G@Lfv{c?fezoIS_gMy_M`VS8OgK^4O!k=3dE!fYTX+iK{rG^G>)^k)0+RN9gMT$!opx}Q zC2ih{OW!$i+vs2cuIZRbfB6c*$HgeO5ux!ekdZ9eytlqkD+YTw{F>s$6M&Yps6~sF zavuGn{-1aLO*3vFARmXM&Qz*T{fP&qnjeIa=a&Ey10)E4%@xZ-m@x1*ati?*4V%uA zMySb1aW}7UOKV@p0XmLBm&F>ccb4G6B4yX@$9B{G2JT(6gnEc>`~ob9jt2JjYCF|s zNSf7sJW_p;;Xd=l0nK**h@F?zXvb-dY`>fOfiJlCpzMDLk?Uhl8@ul0^aliVdbIPR zsFDQTUDx?0t*Ry2rv!{W)aUl-cP+jz`5y=`N8Gis?tLp%5k{-)UtT35yQIifwxn0NGx3d!0M+|I1r-K&C5X6ixzj#eql8vdq3 zN|Sc**A>~vu|UI2{PoISOitUSpfcX!Ln!HTIZRP$nS4`1Ldp|CPRTw6iITV&P-PZJ zD!C23!`E$cMv!|Upo)4ixcfz6!S4Zm5N=X%=Y6*de|KNC1FYp0lQnQ_ zcP1f)rfg12vj3;`)hj$@|C7fm2gnag3WlPx9%OfNZBkvEi{ZW98&k76PJPEOu4rWW zcCH8d**hU5;PfLQ5xgz`8|_Vy?u1p+<|#fgyT)=kF--Co?1{W z(^ArnktOAB^DWd?!?nMk*%$k~)Oy~T z!XH>n(f}65IwX+@t6J^X+sK{P^xOv3f1&3OA%I00W^kL(CqcWA8x+`!*@5Dc<$|81 zbnm&p7FY3-%^}J651IiHGTV(2Q)@cSG{b=5_K)o4j2;wbBthUpVWYBX_S>61G4TYj zT-84P1qLLdh)}BhHjtmYqdz!6c5hnmA0uj17g#@+>;KIRx`p622SR`3 zsG#H5XH(hhN!^hac3lgN`yWYbuaIPU;s3X?@D$)Oke1(qrf4N!z zAD$SA%5wvZrOd?JUZ&7s4I%n_#lKwZ*cC1&P*NeRI)@G3-KF7oY7OxkKT7jvf-V}&32L+k{`VN&UkMB`cK_a4r0Q5;3X>B zN9$#2-wQtF{SS_>2=zPMb>x`pRN&SIhuYq2W7U7+k2-^g`O30sf=L;y-OND8@M#WP z&CFv=?D+YxH>0ery5ct>v;6g$Q$j}I4F+>6>tWQ2RLK&8{P`xk>69)}>N>ZdvBKm` z4d&-#Kh%JtEhbCYdNCk=-H}PNz7%1|H`6p1B?o*Kp;VF@w*+J9C&NQ6=* znnLs9Ona4@F7n(@HtPu4qfHa-KLtm_u2@qs>@vifUn8xGD9fo;_CGKv?Ik(q@Tn@W z*PE=5Ys*nXR4f&-Fe_K zu&hg(2|6?p80Ey#^QIVPQQ^PCWm+CnC3OCuxBal2%zhSq+F0j=#zPNd8|x{u@_6?ilpSXB2|r`jG>s%H$i;`W;%~54v$_CIZ%23=%k%= z`MT`c9C5Pd)>J6Au|--!v>fG}M$X7xA(xNftZ3;h9qsSXy1;B-&edPEDYjdw6cg~* zUf0IIfHED{pU#I@?@-F2>O`H}0@oXO?x}6eZEaM<+`}rftKTaSf!4Bx@^W+5T20}i z+FDp_zT!=fI5p&&<`Ct|wZ!moWt$X5HKz@!Y_^ZvLrCMdxPVo)sG##;;(GqQOl2>| zE;|-@U{iCtv|;q{MRODd-Jf#>2?|t@k#Rwr+hV%KWgbpG4`MC7X40VI%oObLEx2TeYgcqe5qQE9A(HkQeD}I45XC9? z7a5t^o99he-6$S=@LMA;&)qsg+w^=Nw_!_YW2~At6XimKN?ESlTSlMe6Oa| z(y$4$=P@c*vlL;=^ZETcF41_AD|2M# z5fem{#hr*Tma4KwwYv3C*)o){@!HU(G;dQVLLPE&H>%9zMjT?me7a2fm&dFjp57St zOy?k>Jcsg$jyQGWA2IQO$}f26Kj#c&FDA>Mcc(b;Dvo=wJMBT}YPf{nv!svb3z6v& zWVKn?Lb6MWY}fU3&EED#(N;}Y9}G0>!{0G*C$PH!89fUY*21VU0`5hz0xk((TUNQe z%%)ghOm9hd9q%3UnR+K6qel9Z>kF~n$qflx3vME5_P>YvdHXR|1J$0+jNUb`1N)4X z50*}XJ|78_8LW`@!7+b}C8BnG1Kn$`+MX(5bA4|qp|b>_rT5Ok8du+kcPQlB65kFs z6x28WY3g!`4rPv1e?X8!Cjqt&pCSLt}0kJe-n#Qm@`y&@KC#K(1p+}~SqDwmoF z`_++yAFnj0ku@R8NQsir=9@0T>qSmj$R-?=`LJ!?#MiT-ja5e#u?791S3=>l*EfVu zm6wSsjCFXz4UIABI{zs~S+3y4vuLdO$R%xPOAhJ!FvN^aR{X!bCrWl_F7Lo(Vw0Ic z|7=*Pt%?$~+d*_wshnt31A>aB#S@NZK@95X_AFeX42rY9l#=0Tfz}@dbvStvr>MIL znQ3}wgjsX61f5Cf|2vy|@{nt=y2NDfT9mwGvHD}<;FZiJ33;RfT~D}jspqadGqkMbe6{@gzYx^wfB!&)ck> zBZjWp)s;m9mt!2^?%Ub(bRbpXZRnty+$Q9v=Vu0nCl6z2VT_SYo9{jMD@8Y&vH1ZBa@BYk1&cLr4NS zO|Bz33~lE2bC_sx%-G}g_^!CCA;CzSXl^WL)DCy*jt2s`2hLnMe)+4tfLe1Pi@vUS z`|3v*;qU3Gn^oy_v2qB!shRjA>&Ke$-MsTB>^iu+^G;7UN%4j%562HQTlKbVkx+~# z_HGV3p5dPwa({mZph&Fv4tKJCzvvUdse^Wn^1?Wpz_*7(O0VD=N_gt8$Sh3uR{|#xcHg_b> zHwZ6!mj$VN}Sd2A6o-7qpTE=jT`Du zM(kgW9t_7}p6}n%^y|GA{A_^26kMoCsbXSb?%SbATmV~3GL|@G`pnGc8Qh1qK1r{L z2!m&dnwUCe@d&?g6xd?1txJ!EFoC4>jAGNZ=`9}-PKv-FicH6toWIo*V@f$uzGO!t zs4mtiEtTyK^ATe?Yw}gaVP#$e;X+?~*sTHrf#(qvVT&n) zbdEK4zw6_+kd%rlDBZ2=-&bx=!)^oHVyapJdjK?ls5e`ENk3R@4Nr>)CIpt@PWX?J zs4BAi*O%kBvW4Vz7+xoFeo&Pz}6$ zZ@66dY;;p9U!_4jfj|N z#~-w(IsnGSDMzCN1!$JsVQ7<5giUj7@?84kP-Ok-RNBhKdCR$_`fv&zf3MkAk8B1f z9IyAr^yWOy<0%6|LlJqVNs<@xhAqMJ%joYv6wJ*sX2-Fsvjs-nfl#}^|3xWcOjKxl zr3yUHLVTWAXny0gppwE7^`>aTh^WwD^JDrV*v-JKIUUbOlMcc{gw%@GtU#|kvK#>6 zme{m{iBl13kbGGKgF2JSIQ4y)*NW|bLE^u6#(8fp%?Fb)2hT4LkJ#rb#l@2YD7(mW zkO}DPJay(QW($_i7<2WiXTrs6Ncot~gJN8l*pW7vVRA~+oAps=ZTl4_uf;Ous;iSt zQSU1zsS-(w=Fa9M0;&Z{lnA}ASQcL;MxDr-5RMYI>LASg;gSsQ}!IKHUIr$74Q1r52o9OV3|^(T9x+n)4q+%E=7<)cp8HTAA`Fc8#Dk{iFOCet?YL;}UTAgqaC<#=_ z{fY>kph+ll=;nPGE2>jde)M=hhz*yT;CMjbV4F0D4io`W8e=-=pVCC!bsm$m=^bG` zRa{T+)+BAivYpv!4W~H86JW@KjR;B|URTH-4{j4MsnAU(`DwxF;}{&5tg}VdtknpI zeWis+Hntv^*mtR@sHl2SS(2eF#n#0QEoCu7M^Zao4#|46=w~Cfnw_|MTeh5q1IRy8 z1iYkJF%rxFV+{8tQ}o_E?LRle8jbDRH4u7EHTAflCWX5blX69$!Pt|ZWgYqay~fb* z`u=sC(dg-MM#^!8R{j3U%68;s(WI%+F+Itw*!Y31)}q(@SrUir0#SeLHy~~Oz(De{ zf3BH^QU*&<9A^lsE!jxbnXGb;oT(XDN5S=gewU&&5&1JZx(^ zH6BBg?#3+-Phq<80)Q2auQjnRsA|Y}UH2W96deYof>FcT$HL~5rzb-jPcu^kG`FI{ z?V$GF)Kd@sYS(LQO&z^$Y1G6>*yguN|KD1GKCKr2mZnHraj9S!-?q3K`^)^L#BUEL>3Soh!_BuxSs3BePnM%v z!=vN9=^4x3Cj^9cOpkG z@{~YeWi#e#W1OgbgdSJ!yjmVmCDfvmsRI9Smi~dJP4|@;pUzL+7CfCH^{k|fw_Bwk zc!%WbqkpcRuL})-wXyEN0`t*3hJ=!CHiZZ3al;vXKPj|G!wsWy#&h-A+v4lZUj;z-E;IamgQRP&q&lD+VX}GKdpmqJBvYGC&^*DVqS|B7D#mR!R zs+HG@Ug0d@qzslqYH&%hD~jDvb^d{%D7>^8Bb6JMML|-f0lwTH18&iy-%(C2Z0bz| z975n@oo`QUBK?T}9a3>*V=uPQRQUKoGZ#mL6ctJ};CTq4(-DeggICY_N>z9NE>{7} z)Z)Zp2|y2qg z!%9H_@rGy;C|Asic3L?_wOoNR$b+|AKRW(Q1}UVHG!uu-X4=`*F=@_X3AEF$(@(+L zRl*Nlujf}0Kz3^~X=Meor`3OVZgh@mI5yVDCvEI#3B+GGuTN_#Zfbg`fZg ze?%2<6hm-0y)rOqV`pAeDmbdOxQQ#_nx&wbm=SU$WHYg{#6SW$Yh3u5w~?=YZ<+n= z1foqK%nG3DyL<4gYd^D_29&&v6x1OD#B$z2ulCvj6 z=p5c1$ygu-V!VRxD14z<&4)wF1|u*OO=A7Rt{yh78oFgc0-6P4MX7h~o3C=(u(O|^ zeM;)#ABVK@3YDxBM?iRK;XnkGiy@gZ<-h1MKbf>*q8t0979!oB&7agRgrQh15+L_m zRt%lNfS`0Epa619B0%E8w9|PAxma6ygGd`ZDn+RHfQ2sS< zu0$H$?Rrzv*qFEvhQ=u=0Fm_ZTQ7!W=fjxc_BQ`VhBnk++9K_a$L&Fd<{!4k*N}QO zug0^vy5wt0v|~;>gDYxqhgtngQP0C<)PcWS%KyNuUp?#r%Kbk-piTYwMR%iGseFm@ zKIt-|M{8n1MV9|owOxft4t}y%!>f=pnO)QJ-0lW% zvRyD4!3L1zG+&(*&0{fO#hj}AeEhwgCZ*{z#=}kYTOhOUiDz{IZ{6VtZG*8HM9g3e89Vqu zs(n9lKWUHqakm`pbopiMUHr9%2EhMb>zuS8i2=$2tgsj5eOCO^;EM|$ST*GhVNO%4 zd_AKqKYxC)6u{=XzyL&jfe`pV8I(WBS@MeJ=e_5N@H9Rd;`p8!VCXM4nbNCB86S|p zpX>bZRw%#ZN~jVZi`_A&YF@Uc_PwtSgnAa8(JRj;bK-cWCk>$jCQm!^_U}ZEBS8rw zZ-YdD| z`QtW*n}2FQwY9Y|wq6L7$9uM#n~yC2+~WP;y5eASt674XCdKAeXlu0e71j3$SZm>-EcVvpJ@Fnt~;eJ?3^ z{fmlkA(4@Z=bEpAJgZVCRd@q+c%d=ZpYulZ2g%r~*TwG6FzHl~9`QL7FF}c88-lAp z?NFZ1J-EuU94w8`mI~lnj4$5278rd5yk-($&y%D2_4~r&x(UnXU@S)Qd@y;L3*)=! z;O#z>Z9U}(lDiLv6LG5s)Epyjy4Qt3fUFAVRZ(kqhHHc0fJEFe`q7NV7wEZ>NvW`~ zsb0UsSy5H;c+31{%EmT*UD>Mey(7>@szsV_gqj3Fek0U;M4Jh?Avd%}KjHfd=Ptxi z{^PYQ&^vsseUwvbaNbJ$Oui|REz1?T_#AY-3}_(>$5*Q@>IX?=3*1AYC#GeQc-ynB zUUz_u<4Sh3RT3yD)g8f0ul{&D|Da`Q>rKy|iXa4uT-02Bn38Hi=RW26gf5N76=9YEo=G?SvfQi>lO3U!vrdV%BOaM&T??rq48H+XShISqyIspQP0Ra? z*d(KgzZx!qS57zYzVc|fo<+`S2GCLkSD)gqDqfNAHYmE-AdE;^Mcn6Tja^t*6W{dm z-BX9>I!MZl=t}B!$sFf9KFZ(!-P@=^&1*4YC8-4=7Ju$T zwdp^CQ)+idBgKP(`;E3G9z)2+7-f9XW1_5w!YeLgGF}cW!bzNvIQ|#?dUpZ;c~4w) zIbZS73MJ;!+0o*_+-8bb{2p0S&?$>1nhKxs>OHZ5>g405yC{DfAi}6ib^WljqcBNx(xQUEeYuMUO zdZ$J4(Doyf6@teFcN2H#j`ot?T8Pb@pygVr%ldA})pWg$@KnwPpGp??-!WV5rBz{jVNj(P^)`XTF>2|~Gvv$ksi1LJ zP+ucDW4kX$1ur?Xy$?H03K~l$m*Z6PLL>x0P0IXxwN~X2kG%CSsC5!P?X36KGog^sU#UAkd61E~BeD+l-4 z)M=TilX#jepRZ8*__ZT9FUp<<t{GB0= zngtrgGRHeCNy}VtU8Ucl9lv7-cFPGGR?sHfJ7K6e!>H>zQt6JxsHkXMFxk^AyOas@ z4SFZNJwBf$Pjh68;j;!R$_ti_M(k?J8X6MM z!^DCFW)F&&&r5GkDIcxT9UEl7$aO~sa}xkRpTQ+VCfLGzk?2G`r~h8q83>e`di>@O z^e}>jYcBf@PBEmHOU%h`+y#e@eWCZrLL&KumP%A(bd@y=h5u2!Th`u#$9|u-h5aL8 zS?umGm~ljM5C?7Z>wY_f@2A2e?M)67PmU*yIf^*0YcZqgxkUf%o&!hZ1yfY_8Sr^A zMX5}dOd{0f)6$~mJP!0T=W)g zhaJAE0is}DrITG@u&%6}Low0W^#R)zT(g7B&fhjlXsm~a$BKH^Blw`oUI?{0o}98J zBNg$98Qk{Z3D62;Zb!!uc&2@`D(AKdGXL(pyhNzSFkDF0W6r<@-UFZ}J3Ao~^$S-* ztT7e{Lk|A^Yr^A+sQ_V)S7376j)AqTDQ;+p1`j{+w^`KyxWxU*yAZG@tx=^;+S8Vj zPH2zUyaBraqQFyMOJnvqd0BZPHMkkd3^-l-Y=81__8SPL&Jzcz9GE3IgJ|qwO9x$_ za>mRv9E2jE7Y+qKIE6)xI&qE+aM`d0L!qP1NiYI?!FXqM*2!e)ez$+a4UK>LL;}(& zbrh#UmD%X6n$Mjd>sgJf1**bddyqUU9SXg11D4>T+pI`*Lw2u`Kzuyi}v zQ$v%j9eiV5UBm-JxEEda=u_Of`#WwmoAwM6obOck*5lpsx}xRdL+mw~v~)S2mmz2> z-yWMC$;8}QRNg*XI{=_x7F~8iic6{ggrjdq5mM(Y;o(HLwXkj8Gb4O;m(zKFNu8V+ zbNoI{fhOe>i`@NTf@xn{-MdMb%x&&kqU%V5dr;l!cM^^R0neS7&R$J@>{|u-j=lDI z=H2--B)HBZ@S}hWYz-_9f0T$^+pldHDrg&tkg!&7OnWikUNmQCd^Ap5cCM*D8dhg* znY8t+Qrq;m1@;twKwh4=cSTf|qSe!5H`lL8-xpL|7s{HgXH?u8Ym~)=k(n26D3ix; zg03NR@Y%$|+T-g3x2Y;$^FHc79y;yjIYGQ#$cT{fl+ou`gOV$`Emis9jUMeBF1H`Z|;8DMlFQ z#W!ePrF;r=J~Q=Q{mUI9rwP7HuQx6RqcZ4bP<-EG*k1|oy#3=+2^Wtgzx8g;=Hg>9 zoGGS18!rjA`w#AR-N5OxEw_^=CpWJ9eI9-BzRrOJQCV0;XX_i&NLO~IGm*iRuYI$V zlc2P}Jbe9r`Qg)A1}B(ACK78?P*R2^>Mlm-2)M8)+)wP2NJd`LnI3fe(6DMbVHcfV zS^3_3H)}x&;$NrkN>s`B7Q4;fK7@@zf4Z9D)H?p+Tkd{f8iks~plTVp0~(3CRBu63*;Nj-QKh)6|@7d)Csazp~7;Asu@}OZDOh<$3)C{_M_^<$LhB zh4}T_iH=p5qTq##nufjy;`3JJu~(wJlk0P%MYpr45kh^)_51rtjA|1}!>L7a9b+(G zaj#`%?i8%w1r&tuF!ihwybC<#Wb#9!{)jnM>jHD74#Jr%)_5iJ#lwFo(0Nf&?95R? zMJXEp?@{$`3Jya{7jll8td19%AUo>MD=TTZb^NcT&ZpU;XbkQ!LgQm5vq9ig-Y+QN zdK?o3(AiBAuh5>r2siCGxJ&6Uf zP)J)xhs^Mn?zK*u-%olZP{t(;LdVD9+IP0|jHK7Qo9aqU?YFAxN|$bj7-0&Ind&v= zrsSOk?ve@%kVORSy>R6ZxhQ?on8}anV5%#u8uWM;WL&qC)VQ3N9-SkI83PGpWN`>b z&{QUV7bhhbj1u5ccpu1}8S=GIFt^&KD=K5u$U@(!_F zf1trAm6LJ$8cQM;f{2VME@i{vRS>zkX_Oc~U0|<-{8ff9sG=y~cC@qr3kOX^LK0nC z2>Xn~CtI@>HAWAeq$%v6f;L_jfj z24_*Hb9Y`va%BQ{Wsf8NaYzC#pCd)?3RXt9$^aTtP|?wQe$#De4*YnN0GeW1tPalL zGz^)Th@9cLAyItE(m)Gj^#~BB$T=2Y=u3Uq;`wF-D1gNrwn@NdvZY2zxXnLb2L(Q8 zaCDN2fb6f3^0=J1aJaI&Hz? zDFeo1xqtiart;(%4MOWCdtj;Z$fyPQ=2|wtwt%W58-Mjj;8T@)qv;Rl_&tmzDl(>@ zvAR+C%<-~ej@I}uApYU44=Vib4}z;&&s3%inP>kjAsntBQp=r_#W$HvhBju;k2r-J zu=sKbe!-Xm7!*4knU`rwg)~t&&x;^1R~}`1ETQY~B^?S&Z&*3}*@VTw`qlHC5Z6=L zpYBKwXQqGgo~ggA8Q5j8WVgAwJ}nQ%jQZ7w4E4C z!7`H7lO4Ibf?|b-6S(r(Df{9b3ICYog&A~-n0axkvmc@=cK2>M zG3TP-MivEQvxfJ{eC1)S(ztC=>(>`t@`+x4@$weKw&?uRkqnDJSlh^Pr%u7`3b7IF#hl;9nn}A}OBDy2H8n`q=k@7KzllPa?7ssw2lQ^OEAggzk(wB4WDFlAi!O#bYST>6iP-{gsyB_1BEOOBc}{Lm*tbX;Xh$Cv^P z64?jl+e8XrEaANuFbo`Uv&vizLcd`?it01u9c6{L31HTZLr8ahgnh=6~S@tV5|VALZ8QuqZM ze`ytt%Lsj-3d#O(ufxw_NZtqvV{-kazawn_ad9(g@TUxo_d1cD?;a}Oe`j_-HUTsy z5{*}pl=D=^wnqZgb_ouXvpV1Etd-P6@+zMp9+nob{|Y$87q;4o<+z0Riq05#?b|w? zcLoaP4pUIjh^BI5XbdA)Qc(yPC@Ojg5DcNHIXwVpusyeUe>#)TGvU8?e)#JRlU^Q*B7kS>lONXSAtiGQBR1&xi0%7c?4xlC&JZ5YEa~uVFcZ(g-Op;C! zo;Z9%nAe;5US+E;_H00Dz9dx&AW40Q%cfpHK|N`~=}A zth_QB%mNj^3(?f>eBUv!udMyVRJ=3ZAow4p#^SYHbI#P+5Yj7ZZo_$X%BlJrLXLBckG~xm1G`9DzPZcZ$Jw5 z2Q@C+nvN0vm}91l7%#-hT(6|*F@2s)_?h>5@s|}50fqTZ(|h!O!VU+l@aNXD_7|A1 zc@L_Jet%Kiq@cP($YUb-=RR^i%^$0dkbDJW1}mgayv~}J<#jS#VeyyJ?@1&o?TsG0 zr0c!XXT27@v0nnwXA{D$F+?|$gqfXO?OP0?-37m&ae1W$CE=ioj_>-5lr8yMVwg>d zP_FePqN@-edMjXGs!n#_e1f=Q%*G=yrZ2gK$3sMEaIj|z4o+rC;EhZg5}ovEoXZ~f zPrHLzyn$RH8*ehh^^IxkiS0`}DncGOQ&^T&m6f!lj2mOfM1K*3i^lss@=U3#(Fn>a zcwhwj`JJlrUAm!5(% zWf?VA^-zGsyP8ca7_^QmBVqw0m50(X0RxT3RRf;G36wGt!`6!*bJ%wT)-@J#XwhGD z-9H#fd5F&|*;T>2K(-ao#e!nm!5D3GvNw3glRYeAHk~D?A1Q2-xN=x-i;+L9Zkf-2Up2uQf$e6XsTk|*WLMab9L*HGl+ zx}iCnkut_97ofBMTMK}^RY3nT*@IT_juV3i=b_87MO%>`L<9-NQlt#irfb(3QLaj) zrzk9;f#KB`I(1}Q;T}bOp0gbx_qc!Gg1ZT=#b4MjG)u{=foq4j2nw3nchpN9C}cf2 zlizpcLJ0gG;Lsm5wcD`&87k;3?P;kH3H=Bx2nvC5yISMnV|!CKf2v6B1L#c=Bo(Yz zG6)aaY7#!iRz%V^d6N|$wD;Wb8nd(*c zTNF015A^NKam_~Oz!+S>5|V_7CBA&x_pGqW@T35y4M^Ak)KJim!UrCQ4qqymU$RTQ z;Wo9N1vPho)atG+hxSRzqRa2A$-_o%)3$^Xu&z=~Wd4s*NQyPXCi8ps+=A95Bm%N` zZwENMX|lmvzNTbQ2na(nCIW!me7kSC3KdB&DyrOHy+JGImec|X0S%HqU@?bv2R)hq z{N^!ax$vqZFI6naKac}E<-=<}Z(L|7VvO$Par{5ux-IzJqKY+Xy|*4_v_9$Zl|=U! zB#VU*9S`fc?1CrqCLRoCUEp;Sb6&Vqkg$J9D0%}H*S9HEtX%#JKjD!Wz|(ur4%Kz! z`0Lz%L_QS%f4sd@bY@K#wj0~(*tV07ZQHhO+fQtposMmFY}>ZI^M3#M&-cmR2WyOV zSfkdgxn@<}^SWU@PWo0|)X^I}<;RZ^VcsUZvbQ(c!fwLgnzJc^LSc&Z0OMK!A~Uce zh;mMMTF7;_KZ{k#P}EHrCFQ*gw7C568ke?^*wn%NkzHX84pW@iQB%7pjUEh3+ydvn zgghh&A!0$wHUo1(ior27=7I1r2%cAm1e(*nU%RMm}Poe9&0BNu;H{4f`* zss`2+{!>N&Y`KIhXaH^OeV=_D`y7oUEaY~*2ysN@1OAi>t5e#%(PnsUz18#;!Q}621@Q+OvDStLNW1}hNx4=P^2DLOt7f&@d z3?Wewz&wnMSOZVAYx1qZR26lUiaRwj`$^9|#QJFyIqs8$69>X*{m>}&FFv;|m~Rui z!}zl=o{JkDe_19q*FBt-sRk&XiH@t(SAEK%nlbMB-vKi{X~@xTT!?Y8g|qwO#XW&{ z`_eB4T}hC+U9k^j40Ys_a>vlmOf-C1&#Bc#4`CfAtAetUT%=8igvQ^9$%_k$kC)qj z*Rm=1AK*L-7?=dDD=MAp+?T0_>9Hlt9w|8Ixd_u)P3U1Mo_dcbN35laUw1e<9}oE! z47*x=XW{x644{xWJ6>42xiV$@|8b{tkcNl>_-DVkU=aMqewE2=@Yqt<6$F--ZpmH` zb2Zm|hFzM|Sn_*Nvyhh-I^2^`4@fW5f0_}(I9!MVt3eL~!tXgpr` z_a{7#;M>uv_vG`gdu!jJ>~emG5*8qr)FdPFYe>m$@?%YXMxN+#G*}z~`AohdC5POv zJb%2N=dAqkx}IhHcq)^q_)L6OKi=VRAeVn|yggbUM@|fDxcTFF(na4Xd-!9}%_k01 zn_KE%M)l$61}3fNn{|)Df=b{O7x$`vd$fikw(a(7fD3};3~goVYX6hW+A`v5e4qs& zQiH-&E;OrwaQC&$ead5oFT4g`1Vu1X_^&THZ}s2%HbEZ)ap@N6{sTj^W!utnC_6(0K3Jd{uYoD zE}7%Tjp`ki)O@HcXOi5!(9ze@U|?jPy@Zn7ce`-?8P(Fwy#Fgj`gt<<|p>j zI4Qx)lz40>&ATlW=4xuCvMKY2UJI~aDmm-_)VHsPDr3#=@Z9Hk=OX6hB{#1KUK~Cp ziMgIj-+QOhW2MC6@TEh$vYj*7#il!BbL+lZ8|T}4gjq5m)f-&y+t|;W*qa&Lr}JdJ zbF#wLe3q&;#v+Z-K}V(yKmLOK6c3g3H(!wBGl)Ha5pl@*{3rq1DY12`gvOHE``PA? zDu`!Wrf>=t@2{>w%#D`{y6UeJW4FVl#f=Ie7 z0Fu=+5fGm>Z`qSQaIXeVFAZwaY~^km{I?aB<4ClO9mNb`JL5@gw$2-dK0bZdnP-@b zl<8A(LP!_{V|UY5jm{U{h%+77bMC)uGk9T|Hp_qf6BN0 zhPes81QwgTLYRS)!N5=}ZWF#;Zx3tmA%A5#YpY_@q=|5uwuaAr}Nnf$)Cwi&DYE%+-jUzZ8X* zNDPpw5(grcM#u<7@Ip9^?bjSRidw=+uMP2vjwoiD*|~{FV+oOTes8!ON2f%tTg)?f zoMYSYU6=l-5r=qp`?KHCwMutwJ7xHN%2f(~Ixse$rR`-uOc@5a7Qa27z8x({lrGcs zxq|C9{FGq-6!3f38zBeXfH$uRQ+T<{hFMAEMS7uYcAPn&}R_8tm}tZfJD% zW>h|&6n6X|@#~=vCc4+(P1RPSS}PH*DmR|b9Eib88ry{*IprpW_UB!&Ldo#Er}c7; zD!iIG&ZfKv!mq{$Vk;7RF1YIF8mkGI9<6A~Q&we90e|imczJ8_w6|y3y#)!SfuYwg z`YG4#77#9d+MZIPW^OwKo4eELt)bG(a9KnqODR$m6^1*kgn}nIjKJdM>ktQvrzN-Nn>a zi|f;CSfTM)x-#qRw{Atg`7*tYWNnFbagcMzoTFD4r!AfDJu(NvV1jqZM_B6gSXxV- zGFvbvGi3%#mNSro^&}XCmd3|N-m3LatWL`pPv`OknN9Zl_<=K2^8{9Wy69=KCL#RN z8?b~ckygU=_k9xmnzGpPa3V&o(%a8zp_%3Nqj=}@&;5L*JFNiqayqXr!1X%DVn2kD z@w)rHhNUfbEVTAa$n4Gp=zc`t;CbRgg&4V+`Z8`6i!09A)~ZMGMwTX`VOh(}Wsc`^ z29|`+@_dTb9o&8)1Z?vrDa(K5nCAKS6(LUVR8WW+J(SkHyyLOb?EQ3R!I+Ng?@kuE z%6OmEZtykn*ZOytOJrkc&iA%%nuBlBDLlvsj6QK zT0M}%Ev1$YL=?Q>vZF`VJHY@WyowcyGBz%d+zM5MwZwgGi1)7+U&5*2(bRV{f zz;&iLM#^^HPUKOk58m}k1DGn7@w=(-k(Wy-QpWXnR#h?Zy^bZt#B2|e0%{BjNw zYdzdALzjx)nckYgL(r;sUTfp#Oy87gJI$$&bHB40`1FVOqs{JAVqldA4Egl7u{)bm zqk(D;i4|83gb54@sp}YS-=xlDi7Xa1C7Mz`ZUE{P9rvEYVBk7j6e&wG2JxYY`rgs| zg2tZbxhje5_$2dAO@Ybi&uC!*!OMd|SROdE$AV=?eFU<~!~3+2WN)xYN9k@NC`VBeUYHyIXyFmejUn$JKE@)L>H)td0O)}mGh#RbRsP;7##w)FSXnt?BdH8KBsg)weSRl!QiUi+ima`pD?P#XUr)?ISMUqs+lIG) zs&ckd$|}tkF4{ye81`?c5p>$|LE2>vh9i(tJ6~AMvtlNEK1A)Xw}Xq`fOKBNISnqQ zD*f>~+$vADsIU&3KiKz+q?eVfeG?d2{`*{Me$)5Th_kPy6dJ7l)W>Q7)xU0)p+|N5(DZj1z z7Ya`_MhNhHhl}HZ<(|RKN4wlyzF6O~ZIW;5&+d9-{+r`9?A#2F>>q|j?8DM}b3g7h zT?2(e^D8>visLIEP6-Pt3UrqKcYvy=Abs(|(;f@*s9$#8J@6Z2UU4O8$jD=jPIk`rRCO*o4y1yX64v?#umouVnwsx>AD6OVfqqu_d6f3g0eck$zb8F ziRQDR?bC6O)IUNx?3wLD))u+7fLT}_%HuaZz1~!+o|HtJmI(GnmlR;vj0wL5%Gyl+ z0Uwgv^7&+ZWQVNG8NuW)!@*m(gnBY-ICGF@cpMDW2?Lx6rrl}DOc76+>%xJ9amjfG zXuo^E-W|Fw=vGEQUhrp+4hSnlZ>I`}{t^k5=o^*Ar2;N5Uf3JvrwWwt=RT#-3i6je z!h*s5l!yqh0R%gHbJTO!;tRHg@^?3FaBZGL^qQ;zEqDn0I%VXi!#HWDJb$&4J{K9F)s~Bw&8t z_ygAtKQ&0H(b4SEse3i;XFsgu=EiUS(=mT$V0QSeN4_1PY!A^esCVRkco=)ay}fU_N~^?i1@F;#?w#8rgMK5&=W|l!qwj4OW}- z8Dxui%7mSn^f#t#jezqMa`%=S0yLR^&nvc)vNTPRQiMd>Fg=heCNi>N@u2+CVKQ{Y z5t2wpC=%TQ2EM^&fy$OwHAf!p8+T~UB2D43$yK)}kXQ;}PI+DPW0F4ePP#k};V>*$ za!`!>x9&wzLHDWBYLtXWS6Z#KAd!-b7sC&SE`xUk`L?I<>LY?E@B|6RoX_48AX-pj z(*@P4g8Y+^WLfRFhbcj0Md{qtQlvsD10049DL8Y|QIy;E<9>72NEx}hG3VIExIsz% zO-oE!4iMIlswoE(Ur|tcC{695LEpLGyVtGG^K*%QqPTo{q6unAWm#@LUuiG})pT`R z2=CdMgd;f9YfwljOVC8z*_jw6euI-7+>zP8XW;nja5nG5SQD0m(`_^vDAjKio1F7I z8oW1g@>R*=*Xhywe~x{^%-i6t~3^784XZ)#Ft8O~`qML!Q;R_%Xt=RZ=A zB}7ixB_)&FIUKBuC`EEuftnS3RK=f$lk5t$%pvVwIVEqFr~T@a9SnIdkm!n4`KI3b zqk_CmlPKWITh~YNv)MMPrQ2Od$T={9U~#xHSu^*SGIPZtDy0h5zRH$tkwC>aN9ONr zNiSmKBNZnpld~-zL^$gtrp?R+t8B9Zf>f_{58FWy@w$J#GZ_Uup{Gz&&$~J71i|~n z{+y9VKrOVWM%B|$R#1^{8krtd<3MvilBJ-e8z(X@9xJb12ph*0sMlgj$>-#k-$q&4 zj+>2-Y8}O4|3f@I|GTWk=yD#gdqLFv=g;9&sBt-OE3~$?_JxD@ZPYJ*TWCczMH&&Q zG5MK%-04<3`lY;NBvD|%d=wa%8_q~R+Ao4{QwCrAwyXl(qTekINXB!q4-t>Ii*ImV z&sdV#B_S!&%`7IvE`?NP>c-ZYDXSM%6T^$$G_YQz_mgX=tUyYmz)!yb<_jlNxZ0lB zK5{VbwFjY_+o&^+#P+Q9PWO+`lae z*bo9Y8p)OH@x><+08~!_OwT0X5<@8jMbiRr0li z6$&J4G^_1z@a$#p7IrrMpit;d77!&!^a2IN1>OKoo8LH&T zJIChj*=oLQruhDLm@|Q~uOl-efMRvrYAvm}`fwOU3tNXS*<|#V4VN6z@X^Mt@fuiT z%9R`5wwlEXR$B(Pc??GT=Clty0;L0Bq)04J$Y`;Ux`)H#n#tPj} z4aat5Xrz$Tt!ktk8L5E5T;0_ay+%%t{21E;!LY%~~PMVp@}mnShDqDzrG zO;NyvOGi($@3#|YvC?JbLPuK3nB6oUof<6Ha#+B>9QKaz#yw&YGra2JRS2pQjEmMsNR(Za*lqOK7_ zx{%ZDpY4s&+`|W)O@;TyOXde<*O>*u4G-(R|;x64cVVF4x)$R^cV5ZA!rw;}rut43n zS5SK49J0FxdMt3<;~F;l46^IPbAHZcw3D7fO<>+eFoiX&b(lcH{n1E;qnE(BTHwRN4~JYo??3BN(JrzR*Z)u(wgY4Ukc~|FZ0Ytyh@8jWY8yU^<~t ztvNe&Bz(=J-(yG|HJ&x$RoO`MZlWRE9FyV86T<4&2>zz%JU$nbE;O4b34jVMSRhoR zwx?L3P^IF52BI@jvKTgUJYdPMH<9&SHUDCGn>QjKxO&!{%wlVDvfH)1XR4EUAZ!@oVNM zuIN0;a9#$|#I?>hhju=WKfowFQ|usQb0hhhK@$olyOn*+e3HUpa;u? zTMI@EyH|6AYf3|s*vNkFI8Ir_k*pUQ@p{>g8_aIKZB!y8e(v0dfHAeivb3k^+WpNZ zVpY*}jq&nF_JtplypG*ii((}5h0}9kADgAu!L`=(S`cSM=gGt-XH&jc!I_p}OY)r^ zPC6JQB|M|l^#DcXqrpu_AXTY{paxM`|BM-?%oc^8?fK6i;y?(4uuH@J$L~$0IO&uOMkJ}c_ zwA(DKH9q8ZAN6Z3gxXZ5;q86B6YQ-L!Gncoa&~_x$K|*)YFH98&q=>! zzRq#>%54kV5Cl3nlur>e7qovhE*G z7n_G5l*|P%*s|&8Q4KK|VItDDXPk6)!L?pWhFPDjey*zH+QAsCb!yMze~0zZZaZ6I zpA8<#OGzMQU&vnR|3m+L+pC{DVx?$!Q+zwSWV11b0L72L+^VDgbTRyPQuA^9 znyYefakzizt@%8Q?e~13+qvQh0ulUgmVwVmp2_9R_t9*|oX#@iOAl?_eS|@0?W%HO z-=v^--}uqSgA5+X*T5fx*MUZ|Y2=jsQt=I^8u!Bs+#5zKkFHM5VMhj@B^=RoKLdW{ z(#_~?a<9!C!ic$ov&)YT3%+E*uOSVRK(Dvq6B`QQ$3J|LqnJ&={PxWAffcRcTjlpW z!3PVdRQ*c#7x$Cdg_*gXKfd3&=#+ZZ%vzQlSEpz4l6Ps(BBS}2(B>coV$=`%-d@5?fe}_n@VQc@DECbHxM4sod zmsRg`oVxq{iuB%$Zx~hBTA|Hqwa$_)oY}fI6EWUlHOukSg*CrvOK)Rj*=xUzi(>>K z&*-E7-Gi?isi_|@JWQ@*al-wo7Uqs1dgIB&$+GH6*z(9L)gG5VO@RM!oU+ida$(oj zPy2g>DlN=WxWnt~!%^CIYP%`00q^SQl)pPddxkjqa(}?M>BUG3KeI>6m#5B|paS;j z-s*!AX3A!F-j!md+Xr+M)_(W)ACAIXcJcLl?&9w+o|j$_*6^<%WMV4I(J6R`THBH&f_oIs@IdpNf5gPWGv~l8X}6uV$;mx%u-mK2l03o z^yE92L^H-?p*W?d97(^$j`-fq$y0O;4&BE`D@G4=O#RJhJ+k>^fx%X-+a5@v>Lxtj zM3tC(j=D$qN~99Cf?z62ViQTBM~{aMQ6sLoGb~Xd=Btc}b&vSP{-rMZv_0Z>sL_%e ze(7v^xBMr6+&^q(^rTpEG#Nel_OK0f`XWWcwXlwI*_tjon4UrwlZzyR^E)FeLoR&1(&ybJvAfQI5g~4O{(YZ*_txQ?n``W*!dsPk*Dey zELL9s*7eC|@H^?xxz{U*Zi2QRh3&uyzC2D^jUBP4Vft(TY@r5(rUF^%d?qI?ySDsP=p^ zyY<@*dm_?$55Nh7Lm~Nzq&{(6%nj0iJdOkV2f>V1#0bWz`tSgQLtk5R()GOGZTz!TS{^wj9p7|LA*MMN?cqp)4D*$Q{^ zdAQT8TEhM!@iw8eeO$acHt~;+)?p^2JeI7YEjB-Vh^7S2D6llIS!Lq#`=$w$WnnNU z4*2|i135C_-$=E}^ylg+eIO|@=7GpgJ}^--P7^30`!^j?Q-|=bnu?q;fEoeIvTs{S z+K>-Y3s#zr&vQ3e^rCKKzS>@-vZ$h9h|E~Ap|bq_QBgjXlxyU7tn-uBq|RzjM9yT0 zz`zAm71`(oDi8>n*9c04eiRczXqzgB=nAtwo)5xsSACn#?~V`iB`a^6WYZ1C!qaOh%tYh)PY87YCvN)W2<%a+x60A06GB{X@at99dtgb`jsMW6}T=jC>d zx-gkBhPR|48OXPW71YGF2tV5J3I>||QFsebNjMG#O`Vvzfd;g)5WaBcUsa-b`Z`qt(MG^gu5)e$G%!yc8avh!Q$HFXLy1Ad8R03K1lW zjeUMzTOXuONXedY0)*Gxu2dhb4WiNWPh>AB7Ai4qcuWW;Q{`vu<@9t`nx}sde+oWX zO-sx3Wt`84zc4{01Gh_RvnMl1$i~H`jUX-50fPsaD)cn;g28fD#4KfCF2FCAn+wZq z`>LnVPs?*U+JFHHBI?)>(bxUTnt~^#u0^DbWRbs>8J%-t3qfh^rDiiPNr{-zVvUNL zI-$}|vnGy>F-I1l5)yGkw5ybq|H`(`1W}P>-&+MPVqF&&S@#^cwbb`2p`+jgFY6Ul z=R?#Lj1V3mv%n>dMI2V+8^zG#$a&rr_J}_m)@&#jxi(@=4^o?Avdck>EPvsJoH#4$ zW{P`up%(cwQrojUrsgfM&59_MfyoqR)pycXW_D4s`VEo|8L2=)CFT@nXG`1G4>JTE zgfOB_LDbK~((|rY&16EeMzJoiejH%2k{L#hieRR&s;0%OZ_SZcxdMlTomx;=6`w|V zXZX&gU1B>CLnw%_NBQJPF?B8iJN@_e2;c#ojOp&uX%k-Zm zh5+h`5ZM#bI@fiD21k$me&GEP&;VmIG`V8@v9V=45|9ZB&J@Fu(gnJWWI90y(bHzb z`fb{?XPpnX@$iq}xglYnjyQB%3SYb|2D6W_z+DdfEArE#RBulbc^zS%slg z21l}bYc$k1OVgS0-2DBdsDsh)!vew$&g2~Oy8d^^rK(m>OaP^XOV%Ba^BTeN5C{8h z?WY+d%Y2@H!c$q=&0Bj_br|Y`i&V~F2s9{@>DA%pv|oNr9n*hW+hrD}_fvl4gfD7; zUG1+d0$#rxV*JdVy&7}=q6>8&@bPc(9`*p`FN{e2+CChISR#AqvZl!FE^E$K%Wr?x z8;I|%=>;XP#M&)x&q-e&JBrv8&+3h5I!OP99eAx$CZg*br_^G$Pam}V7IIF`)(@5` zc8r#~;E?$>iK%Wj+_gsi|AfJ-{^>bgH2gy5pT|W(Jz}PBVtiG>VeCs+|JI(eV*anz zchs*6M-%XRUs5N83`!jizlyz_U{D<~@C$%!zPcvO0;>%3_NuI_2+;m(b?p-Q(QjsgCQT3jXdvU*k7} zj~3Ex2~kZfHhA{p?U#Rve2L!pUdey@dTs-2bEu84eS)&Q-oLp~$vhu&XxrPid)Owc z>eU*YS0Qbt?h{Z594#AK*wfge`FBK;2u2kHdrso*lu7ZDh!sDVJX8LUwz@Pqxj?4f z8{hD_=XkXCX?NQY!{6&l?k$g3-trDp2jAv)NhS39v$|r@G$*aHR7KmVvTh)7=w=C80R3m$qOzF+3e{(V!du#v%~%$5q~tZ_O^w3=cVvoaY> z(Nx0iJF;E@CxWqP*&F>)x~H}n-NOu#&<*4X7qxwgNds@!J!LEYNb_$Nt6gpsDfsA@ zVY0#su;N_i7&;JiOjJAu4|}` z-ZQVIsh!L$UIwct40Iqu{gbWnW$t~e4?ZnCo5~XV&WslWp3q&ZMKxVn4M zH(cIiYqw;CELQcK6WyyCBH@hv*e0Cp?Fia7aD@fxF91ej;#lJ>)5V(=xTdV#{{-~! z_M|A-lJ5qH-p_ep`9#Ke6n9;X*PGFUTO?R3eQ*I4pFqP1S0O0q``4X$c9k}2wVL7G z?<#g!i@<%y1^X}F9=F|8oDK3yIDCnsEpUA&sw^IJtnFdY1`-BmFNTg1RR;Ci!ztk4a7o zXih&p{!%nmZ4O2R+|PIg`C~BHEIA#nrC%@DYWAFR?^Mr>Me<;+DsXL&j=7nu!JWos zOmNu)8@rBRWN1VC3Bw*D%bMq8O?oOeep4st@>d^O$U?c(rU&PBL^c|~ zkJ48ZFn)4&JYVd~OsN)*ORL1R`vM1lP;0iB!D~O|=1&0^F82mR&Y%3M1rY^9rHCU3 zqB%j$@PDRF_I%gqGNXf>O5Jf2J`F9(9-}U)rws1$c5}XQp|`6Qn47`c;G<2n<*(jL zCJXx>+43C`*FAhE@b@iidB}~A*CT`uLE(~s6wIWgl&EW|@#;Fa-&}O9?Px!1|9RFF z6ziUaP)k|_2;<|oyva?OyZrq9!4%Ykp0ED6bGT36GrUYq{5GF*ze|7Kcb<}5s_lVu zmB3|D)0up+VA%h&(fb2oK9I}q`!^_<>O&U!vB+;S5MmH_`4+Sp9(8*19LyBex#6Pq z+%wX#E{)akhLL*cuj;5wP5-w^NvS}^$JbGh*m`NPIs;|YoS<{uQk@#7RyPQnEHrI< zILZgU!`*+hk45&ybm-O8SJ?y`wJe56>ba*whVDOf=eHCZB|0UZ+}nY33NoZzIHIQ7 zp6jYZJERo>Ukhl~Vw6zQKf?EK2GdP?}ksQ=?T7aXHoz~m93D0d)20}fV`-#+S@U6iq(5lCO2g? z=)|DEtzg-);gnonAq;UT#_aBfZaOcrZQk0y{i@U5oDt3A2=;DnQM9~qcbXM6XG7ST zq91l6DOHh-=7RLaoLFzCV6$F)z9~ANrzn!$-k3rtjBnWQ4!cQgHl1Udo6XL=lTBiC z$No~HS7cCyUMHPvP zQ~j~%$AK~$T&Wlgr;;3(7%GM(GQKkr6Sq3Kq}&~7c~*8UO~33wP_$P>#zuDPLzY_8 zD2p*C6{X4{MxrADQb!%SfN==F<7J|4VLv)=6xeHipL+?sz8Q?Re||P zWFm_{QXWq#7AINwkfct<<(2$dBKra|_X?!$?tqH3ywUe1xBUH={|8Yf_|hXBx*5qv z8I({Ucwy}jM4V*EL`|(-sZd52+S|*VqE#eT5I=RLngso0S1M5I^j?K)RXJG0n(w%3 zdEEpwquCzYA_Yu3g{ID8w?=E0>AHaT74X!f_2=Gm)Bn-`y7yPJS}bmS0+d0WOA_a? zm|ta{j7)rZ%Qlb0EJx|=>5L^?dAHhwB6fp@_kdVGx0`dJVxSZ>pFa>9%-_dZBRnYZ zL;Y^y-$?BBsIGhH8;^NfXj&xR?wx_?3|1u}wBv;1FKd9i3FA$bHektExiZn3w`<%h zc!!Ti{#nN(6mnBj=TAKM``c)Lvyn*lF+d9Qe!b-cbm&vzw50=R7PhOm?@LKf`)EBZU>Y!e|F}bj zIAJU>y!jVU_O&2ZG&SfF3^-Gx0IC=;nkoOj^(OrfZ)!-XJhM8n`&lE?W(Zm&cG&Py z$|jN_y`sM+XYS5VQmWTCc$((8`4JfcetPRU#_83F&~j1q=TGWzrWN&hrUT>xrYw2P zTMwT+wX(MhL+Z)x#H32SyFMO}mNH!1KDknSj?7s^UCgwsAYGtP&4|ei{D&WE2}F@% zFbFC{S9pDq=);4HTS-dY!z8J$L7a{nw`^i0vxa3WG!VNGW?%cGu< zP;B|4lt5q~TF5R=nK)UHj3BEj+U&xXtm+W-7!5ZR7>^3tbyGi=w1_~E1gi)|7P-E_fcrbG~+5W&vi?IP> zjue65RJjb#B|2_JrEo#yU@;!1y|yrF!S8uZ9!nHs=ddC*4JsNgffij!>G?J$wOLD5 z6dUG3#i|*c*dLqN2QgHw#n5TI@juvc3oa~*BoWM1Gngn5fUwefDe5fH zkT4tt2^4BuFp^<80~cu>!feg23i_Pe7Z|)0cIA)~~Vk@{XL!5H^{1+u~V)3SeRmmOh#${kJ96F)pAK zpO#c+?Fdeq-370*oOLS+lYFITWwi!{!yDSatMz7s4~J~5>2@k%C5KnK&i9Y|UZcYP zgv3yV$a6sG#ImN~&nuj&8T>v48VbQx>A^k2Z`EZ1?L64fgOY-Fn1;)ZVGpv>h1m(r zoRF5DyZ}2)*k98F%bv;mqGT@AVNAYb9!|{jk&CNT6*i(`r6u*ivQm8e%&3aL*C=Z^ z^gVo(kc!MF&CgbJ>gSCsxNm^%{T2ECYVsS9ahgI$r3q>@f~J8%Y3BTlT%?c=%{r`K`DOp zfS9o^9xppAyehhj2E7Ymuej{3BhT!s3}#B-UnpK%S5wxOMTK>9leq(-!dSH^_sb&@ zRlH9pxHKKEG$?nR8U(rlVbE;)8ZmUX#NYR&`4^VO@(4s~=0(Mw2|so$Z!wk==_&$l zW?Ts{uw-npD(X!rxolybloZ@8*QND^QD>!cJ^@T(NrAGfCdRWW9Zu2tMP{pKQ z-0HMAk-z7?v#nP_uC}@{4a@kw{qqg+{Q~NFEyfW2@VV-7M&ZW)l5bx6+7!kO$<6r5 zF6<}nj>`iC^R;q^!}=dcr_uWN;qqBMwQ{qV!jUqQ=KGoBl-`#uo$5|?zAise8bk-`fwZFt?`(gyIY1hoAD_8bTrg$^QTK zZNq&oiOmiLJmdB|ew3NaEHMv1{ElE|X8JPf$Dwf>QIoJu~_z0oA9YFV>(sdGla{ zL8lv8!4)999Wc2eqw357)OU+jJOW{OSzT1w_KVf9m^{qDuCinZ?#eM&K z35raJq%dKl>tT%t)R;XKx$^O+n88d0MA;Myw1huqs^EWOaidlFmkkkg!BNvatu6l{vqhWZ-CieoZNsz6EYZ9fF?cji8*m zoA13T5%fXHaQ;n)g>`x9=H3t*ZpbzPAvIIZ-++v}GqVj~0YhS65pp6ehRem2MhysZ zfdT*_2?=ztRR8LxglrL3EnH^2N4?U%!YkcE_Mg)4i2Xuw7 z499ON;15~vH;)_*4c<3Ezxei;{o1$^N3Q)MnAOqLKSz8+Eeoizd^%~#qU@2Xhst8cdMXZ+n;c?Pr{l^AVT98@p<-9Wl< zV2RxBD4HZ}&x=Xa1Nq$1IjW3gzdNuJc+fy5@1v%TZqlT8_brfPJb6*(;%@M$X|1BxW-QG?H!M2r@lBa_$G`}}@( z%UlfFD5%mY?cR_Bk%u~RA+K|fvr*Xv4W8{Q1%l})?dzRHR>)=n5MXD#w->^#w(GKs zc{4`WK9o`l&sSqcFT= z!2KLM%Y1EjE>(sW4<8+o69vQfEkp8346VL9tmit{2wG@ zS$c-!(LLhGxS|KAWgdR&v`S8~GJoFDd zNIx@6J}>$)g-QjFxFwqV--A6`M!$TzqDp!_12s*-PK2V3lvJh7x9qp@G*!i}47J?P z?^3J$Yn_<%d6;v<_L9}P9p7g5cH-(__a7|ka=U7?LX+ox!L&Ud_tRRFLcH56tDX79 zp8D?Bl;8;6x1cexeWjeL04|N|{mga|io=w{8Nl|Al32h0!;Kk80xTJJzN-bf9Aku% zk<;l(8m)_OydM0yPZ68RhXo9q{GMn)Z+z-6Kqk|E-UicV zrU|Z^<2#L%DSR*Z+VCy8u+yGrwAqkJ;^{j*vv3RK3{2y9re>(BE^uD1;MsiuW2Ftm z4V(^dD)yyP_(yZS5aDwBO|Oqs|N8VPfHvE$m#({h=Y955aQ$-nXq3*#vD+`mK*OeJAs-e*=yaAS46m9PIFL;t*0A|MF}E6;xCeB;z< zKTQz+!v7Q?qT|c^{AEV`6j#LawFlYgs^1EBd|kB{9h?#)F-1;81TVj+C`GGhMha>C zr@9|pfI=1C%?UMlh7;{U9q({|&rRSb61U}hPa%>q8?BPhYA^BUMNpA3goYOmKa2*Q zNQ)At)F2_)(zT;koUM?b_44|XrV08{fE3~t{>DE_j})qVS#mbUrfqEkYT7`hZJ5&z zu%V%`<#cqPvSW5>MT!@J)8p?Xuc0YDeB#p9 zybV9@7$UEn%g;dvWQ|41%`q1;wzXSc{++9BF@9>9Mdd;XR>RHy&t57lH5%8*VIN+= zM1&Tpk1Xj9nu#(2NM0V*p5Kvyzx^C|&DgBL(e7z=xm=QTtK?2sF{eD{>r5jvL=E#%L%)8Jp7eVuEg!0@I`h^0D&%?&xJIFib`j85#4o zhLmM#d!Fwz&Astl_1^mYhx_G_U@LzX)(|zdj&o=N)}OO?5Pmrk0|6<2cV>OV|9Nx6 zcbUQSZS#{8IIk!#ebZ7$ zTL=wLq4mCa8Hv@FjE;)VbN_v{yL;T-Tgs8In4Pt+VW!^{HeMPh02vUXR3ccVRyb!d zW3f=4JXX6E%pXv!KnOWSN6CHiRP~P`eNaD7I^~B4o*6g*#s|QwT8wOK2X}SCw~~Sd{}JWg??cocu(Hmcvt?~4=tMLHo_YS-ds>ym%vT}K+KS#F_LSF>OKnWATnXi zoWg-x__C-~zb9 zDo~S7E3Jlh=L?p9M0bl8tk|s7WKq|reGY9+(XovRq7wl;!sv@$ODBxZ@pB1o?j>;pV1Hod~c8r zvDirK2yR=hjhTcGulvl`{3}h zZ1wGKUc|ODZu`p&!mT4C=bCr=mpN{$4LdIWHpg+52@L^WcVsN$S84#L4xRqp!4fm8 zBe+h7BY311mgM>Ij5xvEn*GTA=)2071@H5>9g3E201H9SSeiL#_V#}MHo3pEec|@h zue__>C0G941W7vF?MIB-OKM2cJ!Z4NSE)KWc^3yUi?J7$2Pwbw_DgB(juIl-agV6C zHttYNhw^STmufa%W`eoRN3{|wGhuyi(C*=OqPWBgmL zg3VCD>n~S#^QoRGDLEHf$+V#OvA~eDQpFGSzg71NHiUB~TnxodVZT|MQ5!-ifSof4 zDhcBNDDDgYjmN4V9_Ed9DR4fQ8g!Q&{WH~%zSUGdkr6ZY<-(1p9!5DHyJIo1m>mTf z3&f7X@5hALj%yM_;e3YDr*)Ihq~yniD)9IMrJ;DnfYIuPJEzs>*eEh+C&D5I1~P|N zPDRSWyEA_V1q(e8=9lm0=a1O{;Q7KjnTxove|8kV-Mih<(-f^8$%r_{<5I1fox<;T zz%&6+@`6 z;Rt9JVsIag_x8H>4~s^x;sD5&=URZjMMOlb2*vBk)yW__Q0SU~hX^G$G*s*9*$H3A z546x0X*Qv6r+L<}IlESaS_Qk2+M%PHE5kdEi6>Jb2PC`+pm*MjnPP?Km4ni<8Tf2X zfF!E`mLRBQl9$!JmD`}IO_%WhaQBYUl|9k7XgW#9>DcPnwr$(CZFTIVW81cE+qP{d z_w?`o?)&`S8{>X?W1J5)PVKW#ja{`@t(t4CIqeb5jA@UeX*L*2oII3#;CRG?6rT2z z7fOin0Exo?LBiWAa&mm~@(3*HucoFaM*r6V_#o{3Pa_!n|8AlGA8V!HqwWw91qBj))(_vx{wAL}ivoBT$luY| z-@1N8_}VA^tSip{#`Tirg|gG2Utn5{l&k9fSW-YlK$0aFaF$-JU=bP})nD-G)72og zOD`0H(e12_#+)juJT^6N3ARLnaq56r-BE(?3iNp0Zklo_=INk9V|+PK-y=fiywof{~3KiSo-^N``u^ z+4?dZ8uaB2z^s2TsnSe%t~{ra1OVYzd3pVBaMz4=dicC;K0k}Dea?78IwNGWzp2xo z8Ub}mU(>jgyb}-QJ`;J3UXCCGnz& z`5ZEm0}xBq+Wi;)Oc%4RvA(5=dzaOB`j%X*)c^^)*ioWQ7vB4KkJZP~^9wQ?07lYZ z)_6Yh%UQwI3EbEH`!_;9?co`Df2^Q^ooW&S155hZa<;zhw%w65`EM!>aVIZeSWcGv zxnt*vmN%EGw0POSoN@0As0QTQgV{|NBH8STu#{-<`z1Td&G#2Kk5VlU6nBJPpr%Dg zdsfH$XxY1B<#2{hJmuBx{<~>F7K(I7ad7UZQM7cPUEGlD_e=Hmuh?^hz#Gorb|2ct zT+e6eOfLN=ua;^|%-{h_61VBLH!|{*trPFm^6vF1sfELMvEzY6AjIuDhmG2aIk3jJ zZR@FQS|N?4q0-YneC@gO|jaonGrMS*(4tg_7*!VJS(f4@rs{EnRhVgQ(off8tEUYbW zbI|@}z|U>HA{y<%P6k#oMc*V|H^eMK3VQDy{xdwXmwO{*IS9(-+Z+!!&bp zvE5rY3K>Jpc)|7Jba!W4YRI3^YK=xL^l1Pz?im#ic@cKb7(NJOC-Au(&>dB&iCf%RX}cSfAA-(P;>(U#o|aebJCe?j+E*IPk!-zv;(&In zI0ikhZH41C#I9-_6OmCckWA^z>Eb@qb$4p4(UYgBg~Fmyu$GZ#I}(psy#s04FfTII zywI`&gYz}rZI|WK%4Bbsj*i`TGpA2alEpK9V3#LC4bCN}Z#LQwBfC8alZoJT^5;np z>Ym!p#V)z~BJfxl_tPxVu_}z0+SW%LE{{hdYEx&csmIH0DBCNRhyAB;CU5>h1Lb_#EPx6pq!V-3 zzdV-I$;WT*N449xZ;(G#bzF&e1Fq)h7!2ODiVn|K9`_tGNaBU-hjRFYB{ZNCv$=+@ zakm0lT_IH`$A%KvlFZqA-MoK56-SfK6cZQ!jvtt))pC7xd+K`l9b-jf(3g0Qkxe(! zm$y056{BN(eJV1A{T7MF(m4YDKE@Aayjs~zH>W&tKg~V-m87<`Rp&o)y;5nuU@lkI zm@<{rYosoc1OjUG2dHj6K($NG2`eXJnqEF{XXUwOXNU8 zy%;m*Kj^z}xx|ig1cMt)S(H3+(p1dK&wiirwWTcd=?$~3^4FW@S&8Kd=Q|>66fCTo zmCG7tS&1d~i^(h;o~Voru=eKsjHy{DR+f~M4vF*;i$rv$fvzG6LaB+1vvHk^5e#Nj zS}>ue+imB3!y6`f7JI}*gDjudXMMZ( z%A3}{q%QrX!o{RWBv&A6s-&p-6b3emM}u?Ht&*j~4_ekgzd2xth4G0A$9eHl4H$@I zZrFH6@quNy>^!F}pkI+Ro|hw>_RJbBOKMbbGgsFAZIZS|BGKxXOs;fnFL8dI*u{nM zYn@VGd`K)SSN6*ClcGl*z+) zM;veN8ZfqqzQ{3pvIrI(hUX+nkM_QHtkCV<`?w_{a&cI_D};|7yWxU0Bp`B0qfG!s zcJoMEX?-`2R&A|eaiQm7z`RkIpBWE-RgI%84`t;K5s4aG7aR<8a7l(Ev?vJ3guShx zmLejjj7UfjE1J-d=t35E5+R9KAYfmcd%2|fw3)Dua(Y;ubzxE1o}shjwg4uK_r`vi zJYH~hH+Or7Ci%9YAvDmJJrBCx4tn91ak77{_}qm%NrVYhgS$PNDuY(p2FieSelVuh zdtEfV1uM)^O}{NS#9*fgE7O)$(A);y&2+nS%8@h{Y6>&-eNB1u0B>5t1@1*e%(;E8 zeg3TUs_BOCPDD!s9;uBVos90c%JL)El(f3D+q+|Q?=DH{EVfi*u_s<8$lGL+^H@bSA$d!i%UwA4_@L%<8B5N<_FcVzm_0NC{Yl{6#xVe ze}e;$AcA_~YVrJ`+si|CVrB=ha5S17LSK+MwBEjdwqS3=$Uz_t}C%Zx+(#ffQ~O?VRu_TH_zY?&+w`;wVMZ@LSOEm3JLp z?IwQ2i&uB0OaKYQa+E(2%U0VD#aFBgDrF?)zumS`D&|DiJELjdy9wL8^0lGvz?EYddl<6ueXXDst1coZK%RG*(~LTM^r< zqJop=XYJMr*qjo@hBc~^M%r~run~f8?}gSQsku@z34b3g8o(gCopbId5{LwxxL=ql zoG>wDzk41x7K9qgWQ_QB9}OITZQz+6i@P}cv(O`~9v76hCG5$-iN;(Nb=L<0xjb>- z|7KSIc@UK`0e9UMK#J!P7K&2cDJFs0$`8Xjg);YCL@O zkfA%JO6Ck2baty=xx%fRn3iY(!rzOzk>r!n6|wCLaKH6W0-$O2Mh-+MI~;&PQ-U2$e6ZD@o zMrENW&9SvY$y7!jkUu94^b_3x-fpbHNc{x1c{)q1ivvtR|IR?b#v> z07nE6ppTY(A6=W=s@B>rlPlF?1O^2mU|_=NP|7$(rZ7dAxAxPWbUtWmi}CO_A%U0N z#vH5xI3cVKIaFj8>Rpe`x%eTavbs}VkwoIyT}UEmF(gBEet?qkcm>ZU(-3Og9LuS* z?i?+A(Vi$1!DFDvxT&%AO0aTQ@$-V6z=$}V`NdK;dPH(CL&1Qz2^Z2MqUPn)I-!}SF%1+AA!1_kC-CPDA9bB{sH!Z)dyFntXgFZZixLa! z{`7p-NU^_Ello|>hfzKorva~8R+x1JNdbQ_HS=D~=gM0wYyjNo|7m4R+ z(+4D3+nJlP=m;q<76J$`8Tnu7!`NIn;A~0@fiPNYWtdQU9jHOYoic zEgcIa@#DqzHMrl4MKSHh;;>O)-FFuW8K;b0^Li$OFUg3$H}VJ|CExE|HNW0QUf4cl zGJKhAZM;LN77lAY@ce@>1S1r<-{0P~Y`?=nNGVS1+3j3d=a-CoH#TKNvjc+fD7f%z ziGt5+oLLo@x8Qt8nGa#f3=zYaDd?J+XVw-)-OZVU2Vf8h`$Or-&8=bLT3A>uV(zSAF`Ig|$^#G7)Iq^Ae_tAh2I@MUyE)q508AI<&W|5o&De!=r?z zHE?yoN0*j)MU%ot2Eh1nnP+Vr9GYb%7I1$v=wUi5vs`t2qVBeODeZWYGoy<JP3Ak z@k_Y5m6)7h8Sa3dzG%+QG3hivU$9j;(lAS}D|Ve4Q(p$0{2MkezRf5Hou!>zoMuk3+->=Q(Poj0Ptg4CTkk79`{nUL=bx$i9p_ z1UL2mCj6ijSG3(Hg}&svxktmOXt`@vh}0U}chw$?CH0*=rvA&d&p{(gejK~q#Xr9D zzVbh~&6g?)GP0bKQsAVCU=pp5fi$obMM{fyfP_LB*k>d9HmRm2;N#g8sdr>_{$ zF`hkHS`0OMPmpuuoeQqX{g_U|zI4F&07;^xC0+02+c8;bogLcu+{`rKB`b|V+gEQ{ zYiR%BK`*432ENeB|3O6j@IPe!Yv_j}{QtNm?-!_ID-Zx(J`WxT)yW?)ecFTdVhVR{ zo6LNSximq|x7v}t&Herhb$NSL4*;A{VF|8++bUY&cF}x^T)r5X z{ZGF^(eTmh)b5FNZ;25rOFPzUxenb=a6(V)745BSD?uz||Fz?Rs|T;eV3N?56FJ~$ zTn>+m7v+mmbKUu&sN;ckuh zXQb^OLwI+I)q8zu#z>^9d-mQqwJ{$ZHOpo zx)UPx=|MH3Z|{z%7vADlU$S`#RhMOo6{G5H@Mt@}$hD)Pn-MZtvpsFp{JV=$VyNWX zzom6HR3!Qu02F(JYHghDa-bX7+g+)ya4gzRTx~CsEyt|Q@H$VJu3uLmQ-c*b8V1_c0i`aPZhyrpM5}N0)gd zc?vZ8pHa||$;1M{m0Vv7^$E=@;Fj9|7VXz%315`Nc~8-l(H8_rbrKmJD2BWwgBS$~ z&1z4=1f3T5q1VfYD3h>JZ3!LD{0&nH1@T`NY~_9Nt!)pOV)E$1@+Ag_KIy^U%Z~Qu z56i_gTZKSkdUGLc9dG3Qdk1^vYlCr9QM;Gl_8Wy%sXUkg?ZGikUVQE`&~$V*vrt7w z!#NMF?6vpCE{RVd2ovg##QFPCY;Dswz0lb+z%7;BOpOimrV#=>oKW6?bd6zjwwux9 z2G7I-DUA^_X=c1D8qxH>!-wOvgyN=0Gp2a8&k3)Ne&V8;uQ&L%uj&R*^*e-a}~lHntN=HUHPDb z#{IE3pyE_iLXtr&ur@;w#(cp8nl@xE*u%_+9umgIUk+r72{<-_U? zx1nsWYZ?4Elu=7F?;VQljsPhdO9AL8A)8&;!R|Y z-4gr~m$&$&bP=*`I3=d~oV7IISP| zyLgS&W|393+Mx9EEd(BFanc4DayHj_FXLLYZ~P9bxp~t}MYZ1D@e5$vD{}0AYek=a z%2gqcCEBs-fOwIf(DGphsG;(KLRYEr%g~7xG1;_TIbatz-<`&~996YOcZi|14Tx`a z-70vD{jxg|Bj1b$vKS1?55K6BQ+G&cTf$8%mtb>yfiQ+O`P--FF>fseLGQS;gWu6_ zYTutGIRnc;Tl81nsIYu?VCtYN1n=mWS3|f=1k#50Y)4JxAm%qEH{`zSg-!zTPyAYQ zvg@VKO-56Ma+$hH;~#;zS%;;-11FK#j1K zX8UnrUsJIF5lx7`Zn&RfWQjBK-hpjjphGfZJ;yhI2&1Yp3QiYY9AXImJ3bQ&dgDcI z{uRV^hx4D{GJ>sjmq?#gA*na2p(vSwk|iW0tSADODED}gJiH21^*0AFI({{5!y z-BgI~j1jEgd4xY!Rpvpy3h`M-XY48mhI{bi3)s%_lGewnRJ5Ju@#T7?PT5pj7jnpZs_@ zq6}j#1@EkVN^+oh7i@XBQ{M17mR+T@#TJ2_a4t5BRZwsAK;eB|&7{Ihp3qI(Yci< zE?B&6HZ*UHx^=}BXwI^*o^Wa@9_x)-?t_O`DU4~qEAO-}{-q&;{s2=MASw*!(*+Tg z4R(Bu6d%B(LS~1JRBy3q@QvD3!knJ%ase2c2X11c-x)`>7NU8dB~b@?PinfhQ?)zD{0q zr0|kwr?L_pXry=aYv%B7_Gr0_Q}Vx^aVWxCI>3XnD`oYfnO-X~A&&D1x1(4BAf|YhyS~bD^4GdhLt;+%3L{dWFx8Fzeyn82iW7ZI+8L3zhC->a zalZPaUq{3-M2s4}jS=Z)(%G^$B4m`dZSf@+vqt9iYU^u*SlO!fwfkT;)iFR>euZ)& zu+0=NQb%HG|GLjOA#fcY`-?Ci8nto^@m z&b7!-s0J{?HNCJSq~cqe&NzhDUatez*p#fm;!9?k%sK>4{+QVUeg!f*%*T>N3m6d) zi>RcW9lZ^l5O({rzjPs~b#pF6*_lO2PrcnUC=`(-NF0mHmXtOW;czoq3DVx17;o4N zHj7qGN)uxRF(945x+?SDuy_uI5_ZB$^esD)I5T;}dFI zVI(Dt4fJ_LWtC^w_6s_Tkf%SGD@Gu1M)Pg=!96UV<<)sJvbH=V08@LG-&F|xUh9!m zoi%;Y1jLV2Z6pvE0tbu+X;&9>H048+?t&3tA$odMQe1b)G}s88+HL^B8kpRBwy|1;lw}s3h4ogNuN2D_%@Gwqbe3$mLIY zI*%>{i7H|CHG2T`%_?W9#UrE55|zmD0i8ig?An<_nx)0bBCP3A3$lhRj>-3~!Wq`t zsXc6y9@)IsW+;9BpT3M;GwsWaD(iv|A;Q^xC=9^ixcmq@Yx{$JsaNAhjf~QgSbqZ< zih-bH<&nhps+u1st?yzGnruXZRLAtF@;Lj@=)ARc5h)X0%J$J*qDvTuh1C^v z)tuZ+L&XjHn%s&%~OS;x>2OZ9hAx*QU)AG`#Fo>-rtfaDM0AO7@U^IAZu2K&HQ z(l!<|5=w*BhzY*`Fs{t@WN{j^Ge(+Dr?}a@yL` z!U0&mtN1LJw0(yTvvR6}&dw+<#o0q0+E(MG7OB|Gh{?zi#auDot3hr*EDg{|q*6sZ zZ83yp5)X`^58vV9;^U>Ga*+swO%XM_L(sln@uh!=T`?x5Dw599viA%%C*3=@4zS_} z!hf?86BE}uohp2MU3V2G1EVXyi2D5!_SVZs)nR!Oz0QFbfWQxAQ#3IlX?MBoJ9Wx4 zM@u=(XYUa{(LeDZEc-wY_;-cSIl-wk;6nJk#8@EGK)_eCV`6`h{{7a>n5YL5&?C^m zfVlIo2VVmN((Ydmd}Smk+rOSr6%pW!|87G`_(SIZ@oiEguy>>i9&yCFZAQ`B3IFGo zL&8(is6|_Dtj&{n(YJdpLjT=vaVDQ^@;g)}Pg4ThVnov0nmN%0JSm0k!4C{moByH7 z%m4=e3^OCpFXd@d%-XP^EAQ_dCMy|-6$@i8JW+uYL7y#Ya|KDdPdMW#1r%kx(=deeap2O7`ty`_XX=aGd^ zs{Ej!Y<1pcPAOFu^N)b$U>26B=C3zb7ZuP{yUR~088}4^<2>&?KkM?ZiQ_4Hu7`Od zotH^P>_<|E!^~&>m!s*9hC#uj6!HnorNoU#+F0+2Uwq56k}ZxlcxTbqr10ATH&?Fi z7g5!rXLNztn{5zj7AGr?Wb}{eZU(E0OiDTjjAZ}j?iR1e!iG_>NQ+-$a+vG(V4v&D z0u}ZLjtH_+=C92#aTVo|vOu}SrwMhgh&I~n{aRyRqfYKv;d>E1s8)KC2GTbCnB=UE z7_=qTSywySjF9ew9MagYO#^yTqrWCqdgogXeKwqyy58Z-tjT(f>as3k)vWoT4sM?@ zv^VPjs-n8%-wMdwog@=PMF-kG-vbO;-oBKD!_j}KcmG>|-$4&T4f);`S^4ELENCeY zW|(GVIp(1L{6Jhfw7q;lgBb!^S}@#2+QZjFXY@i?W*i0jbLX?|6t51$Bmgz9mk(R6 zR`x&R=f=-Iobh0AdA{xx%%V*W3%FdXKkE63v1ep>RFD(H2|3B1esKKEEZQ2_t6?}^gqAWKj zf^*#NL}&J#dCeMO%o|qr+hCcWVx6<$lV$z$2LpIK^b19L4J$S1%vw=2{{QTgfEIRY zYU;&WBXse6Sdq4yhTIQ=2Rf%t1n+x6yJb~*Ex0!$l={^f1!gHlYhvj}YB*U*&Z#wt zjK+-KbNkH3`lG1-1RI^<+`A+TemLpJtok&lw@s$EZtb$&XSUmHZSDW8rt*w$`)@C{2wvrr zQZ`SL2XONWGQIUQ1qYXlqPb@fTDJSOQIAvd=;u>ue`R9qm$ZJ)XGO|>(|_yeh1SXC zkK>Y@Q?y?#URl)%kS@w67UmtZo!fGfub|-n80&PcA=-at<^SMjLGjUpmx4x(tfbt! zl4(|m?BsCvZ^!v&=1%hqOsFat(6ndYJfTK7@t00Gz{{rxT0uPBq{a|jk#*liD8q)I zui_TJwNHWBDWS;A>Dc9+TPEYf4xQK(|6Siu8sX?ldmfbWgh5SZA35xApp3=_`jN55u<~k>I&v=ac&h zZw2nBr4?7xUnI}?SmW#(YEjg+ zjM{MoH*A??B3LAgqUJWgoF$OSFV~UK%mw)Ka|yEh&Va1r5#_mED9$@iU}7804RdPS zqC*p|8e*1qZ$rYE%9Rq3ZYah{;Nj}v0#5)?^cOn3Z@IGM*!OA#YH6ouQDJsXZ&_nCT#B#LWu$`|w( zG4F~4NdiYy-3&C(9jfASxn39Wrn@Vkh+n;guDHsl)+Efzub+>w_qY8uA zgE!==HDHc`!aucaArj^J;FF%rMv6i8Pt*vr`KrUmFf_?=m~2ilX$MUyCp@ zF{C6c!0)l%pzl+rtF*~~(XoV+X|(A$px6v-hiS8Y!UsPetX>Rw+YZb(yr0#^nym;O zcBGD|)kYGNV+h#=26fUTjUR}B9KoDNC;4!a_otI>wMMJ*Zh3y?Gm$dbjxq@({#06cnaw1NIUkA} z6fB*X6ugEs1nQ9CwAA?|v;-==mvwsr@bYFfhJZ94+is=t1c!ZMcif+lu6zPv^2C5! zw&QQOO?z=@Xd89DVQ-sxw_KeKMqZ`MWS4}Xt89-fpKlrE6J}~wrB46J8YS9zgmA>V ztnjpD*F_tqyT2PH5`GPny^emK5!v!0jIfX{95;j*p6 z>Lu;l5tZP&xEpe#D=5Se`0cDkd4+=m#) zyVZ8u`ylR2%VVeg^k!AN2FSS~?a`GKt)%KL$s?3z`p)*mjmz^AUh8g)J0Keku7CwK zMrU>`x694x(t8RgJkIP@LmI-geXoxps3znkV9Y1#a<$D@{-Q|?sj2aF+2D(jr~a4K z$^6yZvj{I`r(Fb{pM30&G%AkE_oL^sikI!#A0E-sX2o^T-zyGc+VTmQcB691j%O zBOXz8XJA*E0HL7o8vgr- zFk#TRQ~n7yE0WhGR#lMs~OiB$5RN)vf18 zU_ZaWach#esm*ZUV8lr-rQYJ$q7Yo#_(7LA(Q|e`vm$4$`ysFUXFef}h8NC$oU>Vy zkcqY{sUqSTLf~jA{*cab*8G&#ta*m+;b*zvFd{@Y_K7Y4!GGxbybT zlBR}=C0S%jXW+|SjJvJlFZ|3~BX375M37)vqtOm2C|2WGRoC1lXQN*@(HeEhpQNHw zOf%`HOT~DLnkqNy=0x=-vVy9Pk+REPBfEJHE1YH_eXK6dFuS-c01ET9QPo%R5DKW7Nw(s_d-~ z=`)_Z(4-aRnjhoV*P%O~z#PTLP(t&X##sJ-{_vnT1aleo@-S8e17*dN)F?4pg% z?ex%t@PI5M0fWJdw3S6Yk8lPg&<*WG{xVCu7sVSz1vnjVr_=9JQpmF`+-_Z&6TpG6 z^pWaroR=bCCo`kd>(^ewi|$>{N}YabgxNP+;ZfL?s;hIJh^Zi+Gn(1KhSy+CxKkh! zFCHflZzeszgRmy?mV$wgzE0B@wOyLl~Ep*me|9nc}0BqZ-2r`NMDU_@W*<+ z%z0wVq=ks14Z)>&MjL8aAXW3;lfx2T_2dM~`lzSnt<5ny!i$$dHxmb^ka1_-!`dQ< zCqF?d;f->7SD!%Eke)NE*m4G|tM+Y#U4}lflTnZ4H;sx5%l~r!NlJp{jf{*sdt#@c z@K;ht*s+v&PDrp%%-%87DrCW2xi9Zp5Oa}iW;io*DsCxMCd@emIL^h}fn-wkH>P(5NO`}A zpd!Am)tIq?21jj3Zh*$fS;c1{vsnq%k(oY*w0tqmR>b8@@|DGp>W*&|_bH@85)MEz<`szOC05xOR#e|!Z{GJk|Lc3WU8>do zc{uK#4oVZc=P_M6^F6eVmkm*D*X(zK0XwyR^!cobA0Rg&0!GW1gxfz!4F6ow{Vr^W~1 z4+B3ld3%&`iu34`9(JwuogMWQq*Y+}e^O)TRMmxk0K=v8>hQaW&%ZwBkeTHI>7e~d zbRk#CSjVy>@gFrYFEt_(cNNa*Xf_#F z@4-*IV#Boy`n*4|Pag(szV#P6P`(bamq7}EG}nklUv5fD%Oe0Ge>L>0!PZh(ex{G# z3m1snnp0%A{ATBw^={R%o3MEr{_PQGlpD_I<|2OjucG%AyQAwZ&)1zDxm!Y*S=rpk7&yJjb^`AuP5%s_z8y`**9 zknY}|Py4~x?644>MZW&@Ya zN@$-hAAnsMJKzy6Ci2`tk7ID;(UM!~Z>t!#cPV$; z>LR`x?CWscl&CfVW+0*?eI|yZuI@?xaD9~SYOOZuF=w*f8+93d+dG8q-y{SEH%hcs zfryapx7ZaEpd1a2ofr`CTKI52gF`6FhL9U+f~DenPp%AOLQtV`-{^`9{+g&GGTj~5I8t}+5n^*AR+tmwNZ zOHEJ*+mD26$}9nTqpLvLg7&STnegIX{@On7Y&l=gba*K90X;r^RLigI)b1_KF1W|4 z5g|7NM=X8Jv2G&IU3g_iqdfXs&hrM%S3e(zN*aw zQZr_GuXM_Ey$jpH)mO&+np|jD1CpbEry_66-r|durxqm14kr<|I7wij=riy*Tf1k? z(|0QT;taY24HMn)gxQEoabxrZ1Nu?9e8M-UXuts+hu=oDOj9Gw80Y$YnNO~Sx4qYDOd!v{|H%>Vf&Mw z8dEyWtPKReL-lSX7HdKkhWtb-dvGPEt9&6wXpQowo9^Oo^#=b;WF&%yNFK6NpI3;tOhI-sexpA^1Qg9 zAjl(eD>fO~FcQSxbDM0EDhl?Io;_??A+_|EPA z?#VJTGqdZ$wX>X#S7aR~oJNnNp)q7o;UXv#ZxFli$(nPXV?_{&C*`f!;fVcmlzsID+_duAI|1eU3^ z^me<5QfF;SgA404#PWd2_D4;Yd{r2BK-3Hw1$9nNw||RUwAMw6w9y(%%Fp92e9Wwb zq9{it*K`_}h z|1OttH8d=`NIEjCEzU53)xrsn4O>%@r!|oWu>#)#I(*h(4t=AWvNl$J;0$Y2qt>7M zkaQ|PczIFmw$^ZgE$tcO#^WX!wjm-0pM(O@R~sLYHrJAVfsB$Ue_hsl<)G+JmJZ@x zI8Xpr5HUF!+p#Ysq*hAKDPnJoL*vOVOq|G;R#xiBPPWw^(@%VOvF;9UDB-#`EIgyu z6a%a7S#syKy?y{dU(7CjPAHTXz*)?hWN|;qG_97|*YLibx|8(3ZlCOHn|P3X3%MT$ zm^GHk`nxNoE$=|BR~ci>1J<=Z_TO(=1Co3Oan|bLbgG>hN|X6~jpC(QR*m8>dE1Rm zOe}Kc#4N3>7BDd}X(qJl0~5C#kb@!aZbBvqb{zm2p9 z#PaehXC6MUq@T6@s~B9Y*G1=j2WgSj%(2Q2Dwmh#4&uWE0gnFOyTZRA?;7XRy72zP zh48=5jZ94HESG6AWRBf!!<_wrh5p4I@;_2K|BDw`{=bPA{C^8O`0)Kv96{$w;=v*K z{_K3M#UMmyGl0q5cS36?{SU?BO~IuGB_oPb8=;P8lxu(=cBwk5lzrZZHb3@~S6Z_x zf}OE{xYmU?BR^+-m6!wZbaU;O2Xeafus?jcvfBJ$-XztY9-%?)D=~Wt`1p*1gDjrj ztr}JNdg`M@UR+1#es)OkpIjh~HtcPwdg;JKwWYW1YK-e2&Lp$oVzlYV8du1dYou7> z{#1295~VB8PKD!9iy?$SH%z5BC3*Bzsn6#~CFa!>6D|6K;p1kLY!#DtJy8t4`J4e)Ei4|rq7Fj9lYL4m(|&i-&8i^zycwq(t8`YN;#8M zufJ1n!f_0+7_d;WYxn-%0zm*ghXG>AV%V0m*r_(4XPxEjOUkd_wMuY^0p|e?)zHm+ z{Th-P?tH@VdIZZ0qBHv9+eaIwyhjlnzL@B^e>0vL2G>5E z^_op08bTwJDt2 zNJaQWT&=wVkywvh(AnPx0)i3}7vfhk=pAu;^2!8I7{-=gbwvFD<9v^}$l!E<{`VFs zB>ZnM=W|j>qGbU1e$!(26NYr^ib#Bfn_^xJV}Zh*;oHm zThMw+Ohlq@CL_hiCO%nUOG~H3dD7?UiW*4mm|685+9~R~XT(8qK7}KOk6*q7V1j8A zZda_!D#b|c(eJsm-+&8%e$tf1B+Dr%Oa!}b9m#oP?^mTv>=Fn_>|u8*mR0}z&|UOASWl!T~YR{Uy7iu$XPtPxw<>Nm?Gc1*;1Goy$q`Z ziZ-nHHbN@B_Z`)a2iN;z^-B3?!0gQx!=i}sG0q$^k1J;6Uf7?vJ@C%&&t)i`>mAQ+ z@;qa5422xUJC_6UVhokOA*tF-FtrIQUpk~SAQC(>!^`Hgt@!6tArh_k^}G@H!JJ5T zpfj<#6&}Hm|KwzjrTyOYa3-9(CfVM%uFA3O*nas&aX2-2bCu$Q1-oU! zHeO_${=4q-W18!psk_Sun8i?X0Vd&o@rhtAB&NqBkMWI6!J~1w))J{ase2;4qSLMK zZ!>X(KqDarB&vePld$R&bGoC}2@*&A+|Y9BuLefurVTNHqMLO_*c zyPk>V^U3?M`?SgyZ9~+}<8-#5xmIU4YZq<1C1gKNW&PR(%XNFh_)_#4{@v;bEMIol z&jb6<@|vM2dHDe2LdQZLSHasY+db^aUtINI9Kwpa*exWFr08U(L3`==U%t;0=EZ$3 za=aCj?l`a@nz^SInVYSZLh}4X2@-MfZORNC7l|`@LYk2&hyD{)BF3Fqn8*YwD3qz@ zh!BoXF!txDY!GiV>x!HON+R5RnH(g&3Ni*9Gsbp*Q1ogyi*$=0%Z>P1m$izx#vIvd zTg=+ZR-~}0V7kcg(>_%9Pbm%mkx9abBVX3<`Ik5*FE^@{=Zs|b#`ko z^!(MpqY6>9WQh!MRJ4EA;ybyN3AxTymi;q%qbG-m5G)|f1|%d7cO4s;AP&r~Ka-V# z?p3o~Cg9M>TT$ZrmayhW6(*c`fG6T%-Lr1}3D22>M>8vkP1kBeHqAU59bI2D=*~?3*4z z)_h~`;mdCCC;{1j;WUAd?Lt)oB^T4rfI~=E$4l;*xdT`^pBF~}0Vr38VWikmojyqE z=-XfIjMln3tMg=RJWmit@QTCBd}SsjW%=_4MFsR7H*fU%{OFv)p-9VXV})!tn2Ceg zY|^`ARbBu#;cpQTl5=$26U)8Ay${K>sHk|BGry31H&R2lfVVry+cA7w2By;85QlZ0 zI+;Iyq$hvw_8f#ZO3qAw;Rbuf$2^E4jJ(?El#43sgoaAf7PkdSf-Kx?xjlYg?KO28 zKM=xVWqfprgud!Snx3iMa+M_P6eTD3@WZ96JA<1T7wD|cRqilLHqe{aojN2tjXiTv zHIhUEI@hd`%J&h3OaBkNu6IpRWH$BDC~iD^%PY6es~c~*uI6A=v-U7jK<7z-OjDJ2 zCbRQmg7W!|2ey*R@}4~hIXMd=or~TQwIuq+RygLb*zeJZj_&5TlqaNACbA&C*7((C z-Z5nn&TO7<#B{7Z4EheVcU||mL{2E*2e`<8o+1s8u(w@3s*e{kkVph^ZMVsueqDf-n}4gIFo0EgT;%(kGbbn z2Jxz`ag$xxAisY9Q_H=avpxA|xgB_aRGw$P%|GGi;fyA(M>EWl14OqJFl;}5zo_oZ zixA!rX1Be3uAGm*S8!%Q=e;l%<*Lpzwe6XYMvukdTvdf(#lNW?oX!YyVgeD z=s*4Stz6dft&0V(F*yCO$)*+#Wd!NveoWrO8@3z{dU&=XZM(+B=#S#z4m)SYcor<+s|`%wz>tR z`Lu$jX0?93U-v0q>y3K(ZS_4{{xkPIoj%w21{Wv`#qbC{IOonC7#`+uxBNPI!NQOJ zNx#8MKM)Iy^b)&@zVZH2g{(V@Q7W;LWov%;BzbRK|EhVi*P-i?VwiNqxTVeWQtt1o zy^&+KCQQ4sva;sa%jGkCmKneDf~;QJ!Sdp3)u~gbD!$!JKY9NA@)Fre^N*((EzFb>R`)yd-u`o2nh_ItMN}c@ho3bi zudnsS|9uty<8R%YGVAjDwdQ|+f4A2@aFPSO0P2XUL!d~Ep7>m=(nr&x^A0}$d~tQS zKCtr>Sqk%w)15qXNl8hD9Wm>QuR#}E6<*BHF!>+w_a&2V@UrF8=g0Z`N7QkGC-EO8 tUHExdL(4_NfjfT3IwlRa3z{GPGko5$M*q6z!8`^a@O1TaS?83{1OUDWZ^8fo literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/proxy-settings.png b/windows/keep-secure/images/proxy-settings.png new file mode 100644 index 0000000000000000000000000000000000000000..717e483a89d045ced7dd5bbbb4b3251b58e79975 GIT binary patch literal 96706 zcmb^Zhdb8q|38i^QQ8AVr6nXQWRFy4CE^kimF$_lLP-jx2uTPPk(3d#scb^Xj1ZE& z_xE=8e0|=>?+^GL$Ft*Em&4dH(p$8r+7|wZ6^&4_3m|^Gy;$Ry(Ft?Cu47C zY-L0B=3S)%UfO7fmrfhl>f4xD+nHEdQthBSa0sujC$FEfvUavHF*3HJdb_1k46knf z_o|J-Rr1#Tb|w}ERL5tw(BUU^-Z=-KOHMQb3`2XH^%F4pRz|xLtx-ujmuhEjX zshilD8&Jg$*RfMk?Wa;aEu-%A{BOIX6MgUe=-9~L>S4pw@YRazWE2!mQhYrHX-;li zb2@<|UX$bYYR=`;N0ijIt&*V^*?&cLjrs{yl>zSkmtWnv6Zq)Ph}PhC-HYrCGLp z{Y}aHSOWS2y>lWbT_h6{uBA4A8=Ttp;HzKbo2J3q!6}i5Y8#L2c1wEM!Yh1>u?F=2 z&h)D)g~6xzR!R2};md)nZf^BqW3!^{X}hY?)zp|CQNP#%htohVriu zb~{fsTx61R6JZOY3$L1X#L8_cU{V`JbdifW1~oCx$D3F9frrFFW0XA`h5RyNA7OFFBf>q zy2qT}YjU~G55%oFu~j!Uh0<(bd=wE;_2Yy7V^+G1)(25h`@|jocBa-ybw@aM6khwF zLvO5GrMJ0radGiS-c51+ul`qmyuZ4UiGNLY`$OI2rr%kOMT<b)6-&0`$Zwy0?wz?a9o@?dBTWt=$;rGb%%h?a z%6}ci*@6`Po~-iq^E<};VAn=kdfDjA%-MZ4eCx@rA8i`26H|_os(K;g)!&%3TUJ(< zsx;-Sh6W>V-t586KGd=J~?T(JQ1~mOLh*wG50&%>PO~{LsmIsv^Q?tSe$OPIxQzxmw7|~!i5W& zGaas4xh}^=MMa;B+TJ~I>h8A$%2D@)Az{Os$aCuI^vlc3lOsQ)a$RS}mu7zM*t@sN zwnoyY*?d|4w%WfX9sDN2x7nO0wDL$r_n69s3**UYp~7KjXBQT_`}*R7 z&h68a_N?eVC@A4BuC3W3HM<{|%j3u~yQ)>smE($s z940zkM{bOE%9u93EyD#(bJ5}T@bECKdgk3=+K?cWyf&_0aj-Gz2p3mRZ>ZkuGod^Z zGi|n&5#pgeJ=ZxY37_Yu2Jid&#>jZlPX28UiV%1FHRj~hd28*Dd=KethoN8ZvWI_7 z)JPl6j&^BtrdzguYWdnQIK`!t`RMhz@D#%;=4ZlI%Aq`$)6PEsw;_AWQYs6*)|ORQ z=k+WwaH@9>XOAp51@8Bad1B_urdXH%%o7XLr&vZsW$Q#=O`Kl7d(L!=+1pDQ4>#`> zQ_<9%4Gq1Cvy0&gN2T zXV1z%=$DAt{@y4fBO|dq+l_tw(X!q5%e81qq6RA)o6YR#)s}R#IQy9Yid+6hT58wn zzg?qU#i4Hb4nr+%xX;>G?6XlwK9`i}^X)Qje9I&sz;c+4jW$yd+H8OJE#YGGUR@goEC@}Cg zSH;FXB9DTPUL2q6i&BeI-WwAedqZST(^57aDaA=|U%tHa_>g=|{biS@S`-SF#$wam zJrkR4H9kJbX)w(-pIfG5^z&}dcAUVr;5Yrwq5aXk3~Qh!dnB)-zc%((exp$*uj4fi zF0Pjb6(Kp;A338%8x#UR-`jQw^@1tZaNC=7=fNKz4*A9yTl{*h98r!FTd8xht~>AX zGT!1Kwe`^^7CY1r9KofJ=3Ur<64O8QSIWQb>9FVUjhWijFkt5-!J@+x+E{xskX47L z>F|mMJx#7|KD=Kmax zboq0Hi?Jf=VZ`-_&(i{ZE4oyDy+b#C4ZU8l8kMU~NHE>KQe@J>e*DQ&Yen{s3U>_( zg^^qP^YYSy;@Pv;QS>K=S}&fl2)P{kZ^sI=Qz&B-6WP~3j*Qst&kV8AMnQOFe6Vd9uU zgZ!5NHF@*XRF11^Wytw%y%XM^-xQ$n@3&+!c}`RPhXkzswo&45TW{EIAwVOu)$)8t zeg3-6HC>F|d;3)I-pr-`!*3?VtYbGETvrs;x3~VAxzNx47y=@M@3AVzZ2GV26eY>6 zvHtg+>oRt2DR`XcE<%M5+~uz0{(Q2I^N`R)2uPM$nz zo!!17*Sx0d<5m8!A895#K79B9)D-J?h`hV!9dki&FIHlMDXP$tTJN?yt$~GC3XBDP zO-XO+I-m8Ls=9m3cm)USj{4>s)7F2DT-}UywJ*qN;604C=a@1RYX|K5r(BXY1(bBl zP$-iwOUEhMf9%9q6+c}KlTr+PWWW?qawz3skv*VV+U66!G53B3lXjn>lR>2%$O<%2 zR#Q_lV7D3-?q01iD=%-rw{I%=97^k~Lf~mdMLM3)4T%jdxxS8NQ`j4OHm~)Kxx%*# z#TE5Vhi9jWiOHHZYdQx9kG349^YG)U_+c(IJ~45tuDj^khqfmXx0IBWO3^J)EHW+! zO#J<8PIcSM%gS02C-H9hQ$)0Z7MqYzNR8BjKli1N?@j92&`?Ut%C3%d0QQS-l|6K{rrTNAA!DJ6J(Yd*~J<{%ruZKpTJbH8jRWr+EX@07EATBEJ7|r~?&M~KZetz|< zugYv))@qt!Z0#Piu92MK!xD&e9TsIiZhG3uNhCmOKE6@mQe1tPL-q}^2<>m(Nhyr-!76>->mHp`oI@s@6N3hlKPN!#GVs;F&PHDG7jkdu{_^;SFGcX82;RqTi|jVSinqNbzcre=_Zo0z{izJVnGU~#s~ihGch!@oa1XbUYH#&E1h{qAYC%I6lo z*;D$M02ASO^^Cl>HXXSDma4p)3zl}OSlHH=TML}M4)f;fp1*eOAOR(46~7B^Q3HOr@Mx8CX^jUI?kD!b79k>LDjvGp$4c_Ff?R4s__=sigu5P zwP$7JS&er(WnNpPO3zC#oj!YZBl?_0>&L5nyF?s^_pDmAYO=r9>&1)xzq-5U0Dbs& zZM@^{t*WAO0;>#Fc8A6DHMope%UI$7ZTE}2PEaW1%YXg)CE~Fx!RXifdM?Sl{ZnvE z%t2k}UIvY1-Kq-S{Ie=5-}JOY>IYuFctPd&#U|p++zf#9`t|Gi!p`=-p6RdcrVZ}* z@cMG?fUxjRY3cmkm+56PxpkVTHg^I>Y184zV3NM6DQzeR7D0=OKUt znDp|j*H4d?2w(}2DGnYUHhf}crpVomOt*ED`-09(9S{+D`tEXeAP@{d_8Xln{y^3n zzdqBkIQMK*rySc(QVc3)fq@m2l?}i8Goi`3O#f8`@1jyrRJ^({J#_v0^{rdCp77bc z_ujpG-$E$r>YuTYOlo6j=;-JO^;plq`3;HK}W9ZjqLWen=|d7KYykgE!pSs{%SGpkm0uhy9>E4_V~^+G-8yDH1x|h$1@5F zSAfq^%76e(T0e5*$V1!iwtloY1R4PJnToRv3<|;x_ zB<-x3prD}U46A+kp?nDM%|Fskqx(S_smM}qIrp{+`!B8VHMr=xSh)vOKXRM}#2trO zxw#*Jr`=v!n5oAGY00pv0S{QWVMBMd_{jH=Zinn<^q|_>+VAnI)D#N&hpMWo`kM>h z4T%?n9zT}pEe{^3d$j=@C6p_9e_QoCSE@dX9ls^}?ZqOdb>y`|OuoH`XHmqpKAJbnu4;R7M2+w&p7otyAMULHhhXBnLNzcj z@G>q=4Imkx1s?h2$rGygHoZz6&V73mE+#8qzs}m4VP%9b-ndWd`7P?Ts~-gg6(3E` zDQb88x#xQ_F&7&gcw}c`dz$5`g&)j4L9&;YQeobHh zzP~^C#rrFTt0SF%GwI%(qL>Tq9vd5@XJ8;4!^S2>!|c7&*fnsBavJLmj9i^4J1?&b=T<14gwE#>%fInGO)s`6oH-4R_ z-MmNP0rPPcdT%BH!>x>rcd~3WglI2M5nsTk`>I%d65`M0DiyQfRe8(l;bID$rZiP)3Zb zzWV!G>oaYnRgRQU)YWAHgWP}oI0JCNSAAu2yc?rUI!*kC?bJl|quH?X+$A0YK4UNtst=O!?pfLOYwe%x&xQ*e&-P8t7;LV+^JDh3- z!Km`taX*wBy$z!m)YQ@|o7kh=im)>0z;V+$mlj6yjf(EjrI|MeLU;J~$=+;!a-i6c zH&3DD;oe(yo-H*sTlVdXvKb6wrGt2r#C$1`6~~XZpbzE<;=4DtRzXgVmYR0s64m}OPcT0E`+iKBO9J!CM(%)OO3gOJMbSQT(IeaFBTpZws zm`&Syy1R?j&P#rQ!dTIy=dtMti$0bss-Vu%fSIpJO2M3vgp{&J9fw-b!xKoOeR3&M z*onFyY66-l(6r8_W$(V24Gi@3@2$H|-rcfK_g(piYhQdXn(x%q(K*{!9l<2w^qx_I z@>cV)aEFuE=g+4B!aVCZKjQ=Wt`tzc)i^38B?ToY#bwI0!)@Xmx06@hM0c7=J!(jU z*g71+daV$xlz}{E1@Q%0@#&(<`^U5u=gvX$C5{sk7@;(Sjy*chIr7@7fjrVCZn9(GkFK zT*!M59=y7o?QmLFw#!cJjryDI))Sk0!ohB^b$~%)fnzC@W4ksAnl<`Ea~5!$9rfeq zxM+Lz(Myi?OiWC6{olF*Cz|3_y=G^fhSJNfe~OO?gRG4z$>F$pOvsfZTvUzT8((o_ ze$oUR@4la3cTZVR%chRtlp$SEE&821>v6Np<~s~i!#>#$>I&wb^j?qZkR%7*!Ypj5 zGu##!8Tk;`L`-Zxrbb>)?izoXf|61UE*XFXY2pOU)*AOf`l`Pj37+-st(HLE%ChUV zYu8jL!2mV&5D_bAqaagVf&S&sBKZs#=`mWhsmyi2MDQvut&}^s;L5F*fvg`qR@?zv z-`tE#r1=`!o%<&5y(x=QO*&i9eelPFhYlq>H{Tx3|MQ8)8p;*A-^GR21rMxn;$Kh! z$Q*U_bR>$pc@{CX3RklDs=3M=Zr4DIik?~ry`~BQnT~&TOgFHsm<0| zIy*N>wE>?SRzJVrZpnW1s2`3_*L|+Hg6B+#f!qUTS)2gbcsQ?JV5>dAG;+yJkZm(@ zchX*S=mtnHJ7s;e2(|5+`DA^`>GGdlW5YksSn$eZMqGx7L7^m-zc3Ge!&O0a2#0LQ zl)WsEdm-UdRGBx@0Dhf75{(|n#Wqfqw>GX*5;)kQYYD}% zB3(O)sQ(Vxs`TESomY}d5}^tUMP+com=X$y)Pin_jwI*cAS4(27}b{BlYuF-HPrE^ z<8YgnS+=u4YU|Kjovc847Uw%gQ8z!fY5G7RR*jYW07;(PlbVOQwaPH{@^`la*V-xC z6R@DrS*iii%4}Y~er*~NxLiG!3MdE&QHFY*ZmMl{=~GJIj*)X+y-talYHDi9CQHh3 z6M@vtkzm;YC9xDb>YWA&oEmRIm*}uPcOL&y1N_%zy_K1H{gaOO4|fYcM0>LyZWCoY zANiK%C)HjtyDR8)=FKVI5MzppiqcqOFV;b?)lN740vbuMfJsM=C`ysa)WfAO%{)KzGLSV4#^`fdfDy66(4U+ zY-ad{J11$GXxmo}STp+Cq=~i7N!aXb(%Yfd4B{3+5x#%_el#R>yFcIWql-ta-RJfw zF3SB`Z$+q@iVD>ejr1izLvXPdlP7Zkol*75DXB_D2v)v$1@tvDux*4Ni#-)N8i9^!WXT^VN6o#*Vco^#>TTc~0Hm6brIqBrN$gmPcJ z@N8>qI~sBo9|ZKP=NbW@52{HO2))|7Q>EU3RawyB!$fWzL{F=K9s1sU7>*bfu4+??)BBqDO^FJp%>ph(@bt6o);vOw4eU1L%#uR z{wWTO)#5INSesu_Ak*w$zIt`cb=n*s#m;hrZQahy;anA~wH-k>K`zt86=YQ{%T@cl zcXw-)7JX{Bl$!591Xcg_CaW9K;GyHd_o>&utVb~}B1QzXpMmylVdyT0j~t-`B7-H6 zzCrK=K&9sUE32T4?ST!naTlK_jGt}$_SJxHnKUFYpw0B5L+p`odQ=-LZ^mREP;yFF zw?mc^`Q^(O?fnD2RV_{e5~Myr!is~MAZXe46n)zG)CH#s_6mMbWoSvF@d--c3A;qB z_a8odn4Xc*w1P$0at|CRViBZSv@-gADMAD2Z%*wq*q6lsQ2{&-HHHUuoVa_yVAs;M z!vswNHG+*(n|bDWTyi6EQNxM12o(gH!f6z1XcDpTYTyN;D-q9Dz^M8+TuC?UlyPM=F2Sf!Ze3#Xy0`$3+|J(@)sAmSq~pRX5D#WIIE8(NlgLZF71U2 z$T`t5am)RLELyIlYl}Mk-31En46Xis==0K(d~XU|y$g>~3cY*3k$Bg9lSH6iV6#*MiKSWgrO+D**Hlsg^D zQrN{1)^9BgXKw-7uL$8bse4HWenol&fqI6OyKu>0Ce@37K8+p$?T{#7Q}8wxmOaf55Fcx=ygjUv!JmjtKuCWAG3zH&^(BninAR_ zU=l&uCprY0u2A>`a34O0znT^cm$(=|IgTh_xw0P>qu4S7Fi8#0ldJ_xgmMYAD@>FhpOvP^c3U94iYVPgV!qM+b*Wc=aNTWdgWbZG*TKaWf37U;gYcQM>C==;Zsv>j zmyu4t=!mxW`Thb*h0YHpEczhJy)Aql{@@WX+g}6ufb0YW)HbSf>Ig@9EQ@0Q#egvif8w~kf026GjtZSY6O@3v z_M`k(%i|ro;lIKHGCpn)S6OO>B@cR5&mt)VrLRJ2X40_RPE3}aPbQQ0qGZb6&1(tb zgPGPODED~(x~A&ZymM&+xyQZl+<9V_F=KV~$dRik6@QykeV}rD!#drq5n{%`%*<(d zWla~ePWqnA*|SR%B0aq|}6!8YQ@>=%mHd*h^&(Ivj3W zADvUP=*+31$!%WC$^fgTw*297$3sr8qaD7MlOK27x%41@2VN(()0h7X<1ijtE%KlB zcF7-}+P}YA9`iWr8AKJKKA->b1Rd*uP1HY+2e!hyeENa`R=%?BDY_?BWoA|m3FWTw zU7x~wHSqA{!AJiK=M29S#cyY| zeaFfU-ud4bMJ`XC8n@fNYic{Kmb~`k4RrULBZdopU)VLL#u?xden*CVY?<0|t7$OP z;wk<&G&~z!_P*#G_mr2Ar~GGHSuLnBiO{{zrYQG{mT}mrN`Lo%8>Entb$_Gac$;LQ z;Kt(ulaW_UX~Ijn9J)2shu{4@^RcR`Oo#o8rL20~zog23owXjE)O}{(K8SwsY`fzef7>m&uHu8EcbtT zS0VlK5`_XXpOA1tN5_A1MO+^J^u?r1)jx-FT}F1IVJ9oyUl#AA`?75ezlviWDFrq0 z`kFykhTr`1Yfl=j7&zJSGpKAnh=x9!p84)Pe~bwqW9;b}?Nx$FzbZa{KInVdw^4uU zg4@lT&P!8GVPf{2@C%`EvMQd95DP~0IH|>Kmxm+@N=tlf zse(fqxccq4N3BE_FQ;wqFx@FvpTOvT=IGU;M!}Fh)xTf;KG1*o2eU`yVILd134yIw z>SA^BXc=IW+y-By^;)GBQad;`J2!V#kQw08in=rUoH2=F?o=Q zFOcx@_Q}Df09Z=fcJDp|mj{rr#8}V<;5Kje*9LH&fwnAxB<=K~?y(oX%8dW+X4~p_ z+WWMAX}sCnQ@r?&f|Yj6tphQAu^PP!Q|+9!T(53YKWnY^b^G4S+_8^_SOo=e?)2IUUICA4ZBI`C&X{5dc- z;${*w3V?##Ole|rUinMKAfjslbrbQxydx)!dhKRD<8Q={g7|Gz`SchoJNuyue%|~= zemEvyLF6rl|5q9eFIE*epJJxad=ZzKA93Y0otxv3c1qS|kG?Q}=dN_|6~6aSc2V{3 zCL{m?DJiXo1ty4C6d|~{Xae?s)FB=l*T3GhVJA<|%JRs{d+j9HAbj`%1hw5l=0s4# zCHwYLaR(w`=iJ;R!i6lZK^%k1KGtwik9ay_cKzsO2RE>{X~3WbuLD{+70$SCUx02h zJ9s*6$X}1vu3{fio1S$MV)ii?UMV##&gqvtyz%$PF{IC^;O^!ad%TK^BYp$)=HxSB zD;5A#hd4QX;mlFl*w~1;PID1$N-lOAg(B)Q$pNAIxtP5#?7=^cNv^dvkQ0bELc(c+ z#@{?4HxcFz(my&ev2ZcJNpET}IscbUmT^NugY?ITqtoJLptaTEJv%OmZY&Vr96+(IBH4z8;^{JxaWVTzbyIph}>) zA0Tuwa%mQzcbj~V-v&wu7ZIDy7%mo!N}Rpv_xM7@;J`Zz3Qj=JSo36BCkcXVS63Gm zEJ@gMun%)}Yv9|>0zveDi>5wy>{w>|@ZftcX|UR@o_mK^5^o@Z=2((LCW zuY*>wva&9|n$Ac_fZMtUs!2le*k^%v24qyNaa;3H6 z0ws8h^x`9U*9zg&-2u{dfJpoT0;`bz%$fb=htGv+<OW3 zZ@K3@Ln)Wd*w;qE+m-xThb^Dond5)2x;4I2wJVQ#d4FMil-dzHr%Y}33lvIL_d{`_ zFi^o*C=Wgg6frh6^#yqz)Rc*Dr?xzXqjP@;dp`<_Z_JB?1jc(ud~e5a01sQRyNI7a z4DRVMePg&{P_(q;*7llinq1T6;g9I)b^gnORmOs=JMF|o?f=k&M4)_`oSOgq5(%4X#Z#_G1X8QAdT>ayxPZeG%1*dTZ zRvGHUBE-5m!<&2Bdp(0^o&POlBDuKEhHGeQ-ovLIJNBW?Zp8Wwit{U@n#h(JF%$yC z3y9P^xA^_Nt)Hq$by0bn}rh0}~ z4?{o?QeabyICS(SFzk~HZlyy}e%u}^oDqTs5MT<29AJoQ4U3GiNP}*0 zUUV1{gMq9FH@Wex7Op*t=n2St6~O}FIB(x_`OC$I$Yit*VO5cs3>E=OT8sOrr3aL% z)2BZl7ErTjNsB%gE<~Ef7r&imtz5jkTR^Sxb`h{cn3ITAQWkXJA;7hS0%l#Z*U`9j z3=kd5=Je@1)2(AH6#&JVJz0m~*+LTEfh;3#Cgdz!;m08%chQX-5-8oMPF$BiJ%Qjk zG?Q&ydk`g;I9}jU(I5x^!a(;Oc&tVC;7*wQY#(y49q&;@;s)>?QM;jC=M@wRkd$O( zlsj>v;IPM0;T8&Y=Jt$}L411J-j_7(C88z|?sUCio|ZH$AE3RQV`FuA_{@iGp%!t5 zkG9Ncq+bcKe=F`B8Kulnx43!3+In9TjW0#H6z(UP?{s9fR8(HjT+OrFL&sh%u9LOX#OCNWw-&83}ok2GZXoR0$oi(u29 zMAehEQkQv=wl{&R0#X5~jxc6?V>l$HzN-<=gix<1E_+vZ_bG_%Q2Kcm+D9UkwKbP-I{Nct6Sm3M%H z;~s8+0Q}YU8#aXTU0uC0SL1;rzlLTiX!`vgv8c@&xd=~3$bqc$StzyXewtXeKpX5x zHXv?_R^nNBZIMmau%6kDuuIWdvL)H;#Y|LA^g)V2+I2hcu26@ zN1Y^cmgfgaTo;_}M*p`1AhMNkb4~CeSr$%LZ3Eys1U`B4*_Ywyx-DBuAYQ}5F|2$l zgG3PeFjD^r$JSuAHA6fJWK~VlKHlNJVBzrhMx@R=ZAR?mn_ZwG7N}hq_f~^K` zm~>IZmDa-lfs8~PLaV&FyGRsEEzjzscHO&wzqULCcNiMof1x%K?f4q753=L$$MP)E z;O&}88XZpEo062Wv{DV-rkjlr4A?9!EsfUZ3}HqT!6WFSosbYnRs@cToc}HvSbpS( zymPL3-yl$h@f)n)=Qg?u9!tw4Qmh>=gWM1Ih~8F?i$y=%$RhESEFRp-&b~f*ECcvM zMD7RQw1z@~qbE8$%4BaDdsGi@jXn~Fr{(2?o;*2?T!J&4QdLSY{HZ8_L?p~IC#uDn zAmdO$1L=mu28G(TFTybp8F|PDQEuaOP==rmT4OqZP5F6g^eLaGLKe)>0r8Gx-CQCO zA)Q5RT_RIp8DUC6Gso!|u!%|i>&I|fDtdo?*{MfT!=aLE;R_fyUEnz9F0yAcFvVH8 zC4fhU2)qL`TBBli+?=^gFMB{hAn1tNYl0bHpO2~r@`KM!BF=y)DX1Qe$$A0EY$Nsu zd=af|Tyv+1%sG zk^9tnA@$84Bf^xQAGJG{qQz(EHS9}0hZq5oX8h$2DaWaqQ43@G0TV2Mc5#s|zDNus z+5sV%~oR{bN-oW97p?kfn z$a^P^HQMk05&@WMC?UeocyEPsf3y!t=9{F9*-%)=#IlFRNTO&!^@y^6 z#xMnPGfx&e2r)oPlneaG5XwAhRiG53Sh!G1!z5jWNF<>w@US+mH9`};AqNz<16v@@ z@&QRN>^dSptGzyZ096fJq%OzVHg92A9EETe88!sD2n>LbzfUWq8KJ5u_xU4WAEXta z4MaB$ih`RUyY?DG9HgP3Bz?GEwjB!h0Gv3VE&Jp`3}6j?MY=)}73=2wBryhZpwE%j zji?Xz4w_e54`B!d0Pg>;iP};?d~^W5f!f%$z-=3u1@Gaq#I()$`}?yZ3qXQ=cq>RP z6Dl>nkLC()wzlhgl$@bwT}cnXnIR}NnD&BV#=L*O)f0Dz1<=4;s8u$d2P>clg^&a< zP{vYHQ^_(xitZN}68Pm9tcY<;sf>|H72rhVhMpcbV??Rz2HH0)@LUBy()KcY&6x~GdHe96==;-7C zA#K z=80?yYst6-YI_L+Eg*$%9&-z2Jp?sp9bNIaLSHK4o3@KuTb0A-X2 zuqR9`PCy1gkvRm{9>F{SbcGgp936&Nkj5fsC3)+?mefW(Rkb{(W4^D zW&5cQXSzBP^1lDkc(7i|WjgBU)!{s@#Ro2v+uxq!xY9jvvgNeq07cxBD#%~4aZH8V z1OG1NaoBM^&!gM2r4OOY#zwP$7H!PV1nXAZrO-WlT0uOJpF%S8B>Fkb zknLpOp(OQIh6zYaR0_20o$(Ia55)uI=qbD{p>VJWOuzIdoI%8`aP7YD%#R##K&V<+ zx`=;C0YI)&YR$46sFTe;GlJm`RIo$r>^=xz*T>3lp_lD~izT1jL|E4c1hYRm43%5u zFMUM_sUkQDw47W6Ws>R)BRV*@0UG<9T9d!IvTj4xFcOU~&Sg(+~ zF66u4M5B-g|3v2KyGwbt4i8qS6G|UXR#k*@T;tnra!!-qPHEGoo{y3uN;p-EZ0`ls zsRz4-U!z4Ma!zukxYw2$mj-{pfj^0i1d0W%l2-}p%>|@Uu@spEjko&7knRo+0o@G2 zW!TQ|hGL=ilkJXCJAlvUlCF%<-azFLijq;K2Y8G#FwSXkGyqpac(>wmJeE!s$)RTH zU=q=^Zz2Ws4KU;L*RK~6HMp6D%mK|d5*3GJO@|!7(`douP;)`MD-mTZt*Uwjz2R)6 zgjV985o}NuZSH5`;Yj88R?nf|LzCiz>ok2r$RQ)OPfjqKR>SA?$SsH8M(Mubxh}#R~)Ni%jFBr z)D_~JzOBxJ9d2=^>*kOo-6<0W)8?7y%6+m-!rOA_G7cp+C^%6y@!>1 z1&xk$jElO?VB?(Mu#bRLF%XN9(kEtmw4*>vM0g`;3HSM_)J-wVjBFjMKFL+CWVLdu9@OIEu5Z7s5IiCis<_cFv8{Sr22Pl4O|@(nlbY?MMi78l z+~*KGB;yA#OfgeM(kdSX48(nJmPhQQP#W^on%-ST5_BVW$xu9 z!vph3DAAQs(otX(=yT;3+2X^QUMS2l9KMXB5Unu2_Q0m~&xMFpn47sSnv*VV(9~^{ zg&-ZqLTnbaROyH8n+H1PP^zMRSO{4|MsA4K5RvJf_VJ@3y+uO<+~=E9fC(+~QWkVn z=^=O`zV-HUb_jUJ7y^g<07YQ`*0qkgfhiW1xfKpsI_e4P_ep!$x)pTpTZ@+aco{pF zUf%O z=J4|)Qu&XR*4Ewf`IL)^I+PSPoQs%+oB?v@Ix@e>|juW_YqTzmz7FFc22RleSS zcw6k?pZ)9WxC*vx8>pjJu&Uc}LE*s5j*jY)fJ(`r6I;~{CFIi|>1Lse3S+2+#25!IeFS8UR2Z@Z0A1fr1wfY(QbP>| zaQkX5)D+g+iYWwK4)Ep_`#}xh8>k@Qgma;4Ag5+c?|Oluz8a>ERSEyxifDU&zI1Z_ zvKX9uWWc;2(1JRVX;LU@Ia7_7(9(LJ$<&cd8w0~Jv?sg^dK?=RZPc>u!Ajm5#dh7n z|1S%W*b7_{Nd5kqjJ%BvKWt2WG!yi)Xmw5#d?+07Q;7|jz9hU@C1O)%$9w;0S}DL% z5RZyMo6+0}WgYjl3$Jo$7lIXvpaWtqkoGX7m9G6jJ1Im!_;>*I%AU@SEL$V6hLbWf zt6+4az?XJ=m|2cEWSi0OIArflZaM?$oy=tHC-Qh;DqLe_$XP8L4k;nr>24oGwQ z{PC=E%r!Oia%-v%-PZomVmFQp%@`WNDs`h5SPlB+F19Nl`w2qE135HjJ zq#`bje>?n2n_{O1Up26g__K>I6G%8HXmnxfQ3^got-zRGGSD^ z^V=UpG`qV=boIXo%Q(yz4DMkZjzH3bl9CZbMZgS!SaR*Y!gB_lrZ$;}hyCbY+@wCV zn^!$Wys2FO{((E;-#4CL*Oi<5g|$hzPW)?>br7@9rPG$TN97w*49<{K2W97xHVv0> z=0~0EhFB=EvN(aD!Vcg9z^!!{ECT-Z-zOc3qsPQ{k>2unsJ6xC-9rA*0treZk;2xG zL&upcA)jEPk33)j>TWdXWE%pK*9{EFe8$`dIczNWH4p(-A@mRv6NAub6S_1t)_*rJ zD3U4y2tPo88E8pA%B`IStzBu^TTcz*Ey46yy^z8LfLhS{AuRWzv&p_u=f?{~O;uM{ zPdeU0=HVdJUwo%Sv{I_GVf@~qx-Rzt8egb$lB7Gxe;i;()8(Jsf`aPRd!~k3L*c;? zaR@_?AQX5zUFWmz1&&}PY+^FGgy`?ugnff3EB;uhB>Duc6X+oQYs_)e@9Qx32Ca=e z)Zi&}Jc#B1yrB7nNa6~O=dRzhDJi(n-`BSYatC}6e#u{ zT3y$nIX?(seWb~ZKw zO8}*NhsZ=d!Wa=2cshda#9HvD{cLQ%pLI)(mmcc*{hQyWN5Of~9&jGx|Ip!(^`V72 zL9jhmXM8+|=wL$Aph-*G5zb&J7x%Oa9qsG{@pqgyvJ%BnD~m>`q2$&8pKiqUsH?lc z;`;ZPIwu1FNVJ z_Fsu04G=1D-WyZreU7N62Kph|veJn8ogO|13yB`Rf?sY_UCAy`tATx`{;tlfn z1~U4CCv`Z_cKKi|lT78rvuyr=OgVy*m0*cyfO4G?&;kqq^{vMN&MhybgyX`%oQiE4 z9Kd5T@Wc&6zyUDX+o;oXspA>>OAitfI01^B;QOyUY8IyY@=4$M!c6~(HsS0#o)_w# zzxQpJ{FK}9Mj_zh$yX}-4@6(!R9VfFY*)WwcKvN@{XBVfwxEHKkAoG}I9O4qaY;+t zY)Fyw+5zII^eh2uBa|=p@#_8L^B&}$pZk-Td{FU1Qpu4#{l??Z3qyk^B&FWWt=o{W zk}@qh?uyNZ8NlDj>u0~-s~FhhU(;|iRg-Ic``&y91#jNsiAy_0ry_n<4eL#GoEUng z2jIdPoKU@RVPbxMxT|4iTCOD5WhGIXI#0gMe(z6np^EOJPRG=wlf<}d-Ur)!J99l+7-8j8g;ovU4&cc#_+HJ^vwe=`$#cV_ z2Fq?uoqwj2m;cVPRPDy|NY;BlKc3@a^77OCrHQsGLjeyw3WOvmA%8qwT%t_${RuGa zF1xK4b<4{`LU~I4qK*nj!9)N@)geU=hR*5PKLQ9ZiN_D_^c>l#dD-;cT8+@%H^=7O zZ|SsGPq{~b*U8_Q`P)zLje1~cXbCCLV2046-lXpJK6&HZC8>P&_}SdVdcEZHO%rEk zeuuh;HRa?9fAYz?nCtz}#y3hwwt`^ri1Q(p7yK zZjSNl31Z3TE)P+Uzh4!#o5u2ZYqrzaL5!(zD!tl{oSU0ljzn#5z@E&8$#8z8aTbjh z6Zx%IEb|(AZ~DFLSdY0^C>yYm6d{~hYGvacGZ@VRCs`f8`N#GhJFF7R{PRVrF{eN3 z+E!jrg#bkPt4V|f-0zoN4-AdYy4*g=rT#Cov8F3P=Klupnf?vnw|=reij3OIxdnh# zqKw|SF~&ViX-7LnAKcX2+q)7teg3&fA-Lr`tw)a7N_)iY?xB(L+x|Wa4e~3Q3=S9+ zha6^=JEf77UXqZIpb5^Hk0)=eC$=*hppD`|fH%#5gZ_UBblACbDV+#M@C15f#iZx^ zV=uL3x4;A;!#I|oG`f)O@A>pjxES&wLg`QrdYh1BoWt-Od7uuoQ_^@bCj@541VaVN z9!ljn9`(`ijP8=Qb~)OklCpAjRaB=3vDupe8B}r^HL>fHv*p6~uUpZ&w%u!gTNgf= zBnZ&j@sJ_y`q`Pk&8OVmr3woR@t~C*o3UM-_dS znv7aSO1d^`uP!hbnt)V>v;mBC!fAmcc`kptBNuxWg<}mZtql~%(vl$7`~N*51k{~X zNQm*(1x3sULe>QmAS(5D)8jZ9#NfhEiJenELrB-kv_61LY{?ZqckjYvvR(p4!GS%@D%Qe;gcb93!lOxrR7 z`3fc`N6-)+?L0vH1Ed1W2E7NPCZ+Jg2$n_HM$F%NFRy1{;CASucTYw?8VPT=jKkBE z@YE$F5{XI;iOl9rEV0=fvSE^vuGQo&NFy^#lMt;R6;{it$;;TraHsXog*Q0{X7mx@ z6{4Ga#GQBo`|r(9jBxt<*a)F8tHigt*P?-6DUa&&p2<+6f*;D0JwT8gm9 z$-ocF15yGXZgk5bmwpx$rDr-qnW&;hSR7A6Lv6=?$wIm$NEoLZmy`1xYYN$LGI>l+ z8PBZ(5Fms3*wy{WZ4+>XJZCH-uh<4eImL5pP67vGz>)~-5S&Oj7Ctx$Y-85G6GB9R zWk#ywh%UxOYp_l+V+|W~onqiF>`~-L$R*5K9IpV!wuL&Dw={i;aIV2A;*yc@M{hX; zBaaTi%Q|#-x6#72;OsVCMKoX?M~)oH=n*)&ZnaLPIU|#ZOs1M*;AioXoKt{Z#Das) z2IP$x9mI2@$iooXhN_989xESUhzp9dBe=9T_@d_@8x?4PxQ5i8AcSPn7YDcBN==Ql z_@2k|U=sejj@>2?t^sJp-6kmpTm+1(J%`Roz$U;Mz#oPiH@&)0h6e@}+@{&E3o=9? zYb`7=lKh5reH!*DQ6OOt<2oov{ifa`fd#l0Pl?dS7!nu4GDvHa=TXI~aQyh+qpjc- zykXcA7Z*1{E_qOp7gQ*$VG^@BVZZ+}GGyR>#Ee1F!U7vd)E;RSa@YvT(&)L3dFvSV zo03(8M*GfT!-}EW+*h5Q5<+GTv)&?RAo5EWEcjNZe>Dxr5GPl zYb+SwU`pI?EI|UDJpXLJMn;yAFGEBC(f9(4u|Jjekb)XWOd-S+z2KOHVG#FwLgEoT z2I;`p0=lBT<#@_UM(Y4(S5ClGGA?uP3r~Fjns^>OeE2#gB@l@nbnU0& zjyzcKztQx-V{8z2BkIW9t~~E(3!zI%WjphHnRfE(_JB$R>5agv!b7A|Qutxb^i~=G zh9e`6M`6@LC&O`ea%J5YCc&K{5W zpimf)YE=w;M_0-E2I;xvCO=ea!^$Sq)Y%HX{n}P@RH8eEJW#cS_cBA>= z^g69YdYB?rBn^4___iW*+BEp3%er(`4IqLF2faN{|KONY&oZdNcd>i~QN_$MIO$1s zW(#QEEol5`F%qsd#$>Nx4cY7JDF%`*jNvb z`(V!W@wsHo9=HTTG70^<-9EeASHJXZJ`UG0~^vF-WK}jsalJ3VPcjjonmXxe{}Qjy%Vcy)aPp`PzrliU5!(Xe8B` z{%h@c_xgR?x%Yvl2UobgsqGQ{+?IvTX5Kj%ZB0scUFpnx=ONKpuihK#5ng zc?h)$<`tctMIjvjhF$|I>V=Z~9xV(|OFl~KCh??6q5-FC1Vx96>;ilpfrBsbpht9= z5@Jqc?+_42lB-zOr;;?(w6u;yB_cLAZ-=9I%I5D?^u{6|8y=t4MkR$wf&UZ^(vL!s zkeB!oo=CRSy!GP)97?3eva>p8!|?^0HEUD=*)W096ZU}$749`MI(Ya%PUCcNa4;&H zn8V+DC!orn12TRZNwmU@`cDhIyQ4%%os?vgw1tY`IeeB9yK^t-*|-3|ILQ9R&Jse`S}A+ z+q-DCP3dRLIs0Irxr=I?!S*~tT1^g^9K{n>+s6b{a$gMa=JJwfgW)@Dim8-eT_C6( zBdRKUGmp@(ccyX7XuWK-m0dA#&x!W({pX`q@C-gAD{>5{W)c^M5K_eyA~sx!VQPcu zSGi~vYk)Fvx_7PT^|mH94O%rj>jY>d%Es0%{>u9I2sdk^?5k8pc(f8ODe>%pJ7g0Z zVl)x~*{))lLz8=LNoS$(&SXBAF>e zlx7Ku43!}=Rg#1v2_Y#dl~niZ$hG(LtY1pq;~7>Px25HVt(?8h za8sA@(wVSHT-sQ^MigI`+B3rRHCr~I2BUCz&uw;8U-GL)$c%G+`t-@6z;aZ~jtHOO zb2Q(;syt@N%3|wpp(Qi44#T(}q50}}{IAO*_j+(Y2Lxvj!z4;hSg^qV#KXcm6Jk30 z`}%I?W}W_h(FWpPY7<=WgdjcscwmeA(Z}1mjOWdPAOE84>3IP>VS!hl-_f=D z<|_uzdh(VnW#2wG(_kCg2gi{)-fczHvZCnoR7zS*3v6wo;-gEI3?-n-`&kZRL*R*{ zN;{2>kN6{Z0w0uV_1F$1!IL7$ano1M7j3H;$zG#)=Xh=2s?|1&FzP3{Mbbm~R2Fr| zlZf{FPHr)c;5Y||3zob4b?&^GHZpa{i?C1Y5#ZJwe<0}GIoyaTH`Xo(XN6H|3et_* z&s4t(YWSZ>3ydfb|MkF%38C<~n{^BL6h@I!aU^9BY9^>R5#>S1QY0^Zd7%dJq2{3r z!26_FgOsPk*mB$YG+tTO-w)mDM{BEv{m@#0rolAwJt-1Ca!%16oE~~`6&L4UOaWpo zo32@+f+U+oTzS;}1ZsRZXHHiEh<)hrVf4NuZEb@s1D{&=?d$Sq-6`k7@p7j*4fl7E zT2CB^6uEs>Jt&36$4!$Wo>V+~2O`X=0?`A&eeyYvl+($6j6c14ZX^E#^x;sRv_wL$ z2#ZS1E>=wMLCYS^_Z+^R6M=Qv8B(1N_!%fZh58=OIP&^%&2YXc11!T6bRzG9BF>v1 zim91LPC7|mQ~nwdrs#C|N{cC3!Ndh%J{aLy?UPX&_@>BEHa8Sbc-!Ot!UiM4%;CJE zR()wMkqL9Ix5S%^ngq>Thd!T(zuU8Cw7)4@`B7}plJ{h0w*UBX37+H7CpH=IpM#9A z%nq-qrPZ0x9ZpU0KTr1@|2Q!bR!*RO>e{^t3u{#lc{q=|Ks_NsM%w4#kPwl@gEBw8 zvTXLvx%mTgKL1#!q@>ibU%zJ1N&K?#GMsIZ9X1|0bO-`ajv;olz>tszTW-6heCfgk z0e*iZhSZsfa|a=g<;jyi+Qmg5*s3#5#JNUq>CUsuDqBQssCGL=4bNDm=svzVS3|IW zGM53bdes}q?W4A2dOX^4Brd3@@VeCM*tf6A_s6N}<>!6!EqEeOnSbnc9PW);+TV0n zdft(%D%Jj>pvT6;4U6k^;dYSyBf2N_nIOVrLQ|Wos)|A$>H=JCy>e_diO$X5*Jang z(p!#umhBzuz7E90(eyz*j0`iE_**DTP$H?HSSF8Kw0CBq@v9O6$nqH|v>aeWY<|P* zcsnG@?F?Hcdr`CI%^i*3eF}|KN}Z)^Rq!!1X=X$dKb!G>`eyx;t+8?oKDOAxNXzM>|E!O$CDS2KG21$OJblThm-xi6$0%jh3QJ7j!`c_ zsZj`Hk@&EyUW{*cjLVWp3$_sCiIUSqC3JClrana_zUEPZDaoR21ZY|R<==26p_rKj^>a!_zGk)W#fjh&AI0*HWr z8S<09Z+r6MbCEO8FW;z}`94kR76_z=9ddshXn{5%#=!X1 zWk=o=EV$^rJGExyeYdjKkzr+;&q^LVyXw3n+`~J)R-yh3^{THG&MoSmPn=%Xt#;}C zQ)REi%N{&0@m{{iBEi*aW5)GF|Apl<^7C^?B`ld95q_mk^yuJ-G0_2}Nv z-oE*$1h=@r^CN!`j1NxDIREL&z%2ta+g!AI9dkb0D%xsJeDv>`u|*aM*{Od@QsXQ9 zR|YS+`RTIuf3yHqp;xb6=apmMuC9)>A6alMczmP38}S|W9se~3_y2DKf5Lwq#DA;A z$^z%dt#{SekM*Ec`?9Js@J1)4JH5MzxmeWQKsJL33J$muOIdBaynOboFmv#BZZlR_ zSisv<0Ip{3*a6>P%Q5gI?3iYGoK$7RS_-x+>(venUn{Y=v1k~UGvBcUF2V- zIxwFNrkjC*Rg>5H<=^@vzt7H0jp?Z5+KUgnb=V2mcxp0nNV0KfJl7Z1F1>2y(Oadg- z7EN%|;YG?sfZfV1E(8+3fT{!;_`z<*a@5In6lC83n}>)mC36K~8Jc5+dXnZAZx{It z;7tfeZbuoiO*UVV7f>|#ng)NE(1$`ldai52`i-!O+_*7&)n?^h?=|=4F?eZ7EY{M} z`tVf;L`CA-En}R$K#Yap6i(fdW$Ap zWWiLHXzU`Sl*4+5F!mVSFgw@2auZ8Si9DgS;T#msmnv9pCxE}?O;Gg+9w-T|&;&?H zIs&kBjifS~yDqB^54Q9KND27JZJ5MB=m-U%4T>cy%?56QE6U-{mIcxxN>jvVHpr?F z|2E+%mxR?-tBPVjL})7ANoXM`@ZCHDH94?Eyn&7zs-~7TD6Zp}de%UJmQfCyZhXJK z8{sENxVk`LQl0WTPb3_c>J zVGH3;Fdm9{3yFcqJON+?Ddvp0h}wh7k&R0n-LTY%38sJs5>R=XeuB`k?Z6;EkT?+0 zh(qpZd4A7&L8if_yrlwb60Pf)CWX#YkR9n`l}J+~cnpg$j^H^s5)>CILQ}J@b+Hjr zw47a={}y>m0k$9n*eW8uq;0y#FG!Pt8K#@m(rC_jBo2X-oZ$VbJ;uTOQ~du!{sw>h z!NvloXc0(oLnU#NLy>h&tp&aFn3tkTd++C||DFKjPK2AW5HV_u6)g<_nr3FX4$oL@cE()t8tC_;QoTvXl6W8f`Fs z$ajaNLO-5tH-ic&}K5amx4<6ckwG z;D&wBVv3%aq=h*&X@5eirMpEs@59Cc6KPE~Cgms?+2f5{zcydXy@gOMi^NZ@pcpAA zDe11I)qomU_5m&qX?~=6QMM}JV);!DH&jobBGcyjQBhf5U$u*uO8a{7jeUG>@!bA3 z4AC6n5`^!Qz(>GI2?sVb3_{?JscmkwQ$P4|1%n5iryyEO^YP}vqC!(pKY*>Z<2FWxcBr`TNv4wgS4b~#KM52?SqLJj zNFAAgM~b$$PDri3R%?28>lX0B?*+RTbQo0B`JrUv?Sn**TWZU!4j8TvBda*zf#!HJlBg;fbWu8R;I56%;h9X+5Dz{#@+TY5 zi`R4xzG=BKG{@xR{`BY#gH=7YW6)=rNs#Wkufc&rL1W7DaQ1Lc3q*PgqWFVNPxjhp z)YW_#xzZ?X4tknV8&2@QL-%z%jBE_B?Vqogg!dzE2hL;^L^*1k8nx;cJfAkD9}X+Y zsmdoB&Mq?R@#i^nCSLzEoPvhGHJ?tpd?t?&+`QXYMKn+bjg&Wq{}Jsu7CDivYG-9m z)H7_gb=Y&rv{EkmtP9qg)V3;wP-BZOe9}KjXk-y_BGjXnEi4UW0pPvMXWfeZZ#@om zp*2A*rAwesIg`8?)RK#Mdgv&dNQ+HhJKnL2d|&J&I&>C@1fde#4!DB7nyzT7sVNUw z3%T(y{@_g{+ddHZ_uIwzolrVh!#HbvQ|-jg!fu8>jg3tU0jfA^$f)R#n3|-gfWZ&Y2EotoarEO&p4fUEXHz7 z2$i>eyBycxFC56Hfs^1Y!P&&4hMj`O*f)7GWV8l2dXUT3y!`w=v6VcQzNjQAe?aN+ zih)B!VO*ISJe`!z?dU(ncY-1ijl)QYgBC4DVcSRQDRNP8Li{Y;Nkp=IVA&06|NT%> zv+u!V++v%WgkT?a$G-ByK!b|$r;IuIT@$xGUijapbhpxE<;nu47WkXa>Hl(0)Oym~ z1V$0kxW(M{NnL5 zuDyI9!0SbhCke(rHhjYsy;n^4Fz8SX+3$q6qvL8frS;BPL4RAXtL^?frexuN$CMl| zGp=EoU^Hk+e%sSzf0q_oAbpFJWV?-Q?e2{<8$62`pVyPK3X4|F{<%eY$*KwfYhk3(YETuuGPMatO@gyc;3?l_k_tO=6+e5a*T%~_@7XhM?}ziBZ_Q4gBk%nhRs&f)W78<|5vdU4El(&iWhjenxz_$%3_hGkW&3 zGs_6^-`utSgfRO-r+Vg$i19izzS*SD8H$q@lQsjXm4?~ReDW4Ex-?69>G9H8V85rS z`G7cL5ldZ$j?kY}76lr}&IEA1iEbGxFfe7-qT~NY3O;{6T|BOwzOvPb;YMb*p&8<_ z;rYXu_<>jcKpQRT=oe=S%P;dTXe=NCft7ce1`98Vx{66f<9XgWg%Q%z*{A~4Pg=V4 zTpPdc8Nck!`fc!;HLUPhY^;*PZ_KUv`S zjPWyl8a(w@e*R4$mG+Iz5I-MXtG@- zNDyZ)_!1|Tga=dh)A2i_&pmYHhz_b?2=Xa}h_F3ib9(MQq^Hu_>mE6eX0Ewh`{aa8 z=Bt++spYu7%POs|o?W)~3$$vq{B7Ey@5Z%OOl+>@-~4dR7+r2%Mu=7Fcc49KS~SM& zv8JW@@Zm$ofl9)~GWOb+Dy5QPfk2-|05bG$Zt=W}Gf8Nu31McWy7F= z<&Tx0Kl*yw!8+7L|Ml!!-3?m#n)U24=*G--K|AAqcPkpa?vU2_<}!=GXXCH7JoH@< z8*nhl>*E5LY-;+f_m>;o^1Kh*zi3h)gAdEVBGT9OA+l((FHt~Bfgq{C6h77A>@CB|*Rr=SYu&PCK}l@YNx@*K&c&z!uptnv zd^0AVpp>DBz0XQs2NN6x{?vO|cR3t<+qtY9rq<;3m1PrQobsbfItWlj1DeHG2qXzZ zhCXoSQ=#6aiB}*zxtA4HsS<(4F|*|7&+NZyCu%acujgRx7M2x$WUGr<^~DsRXAiVl zZZUQGfi7ITeqNL45b00UTZ$4ts43!KW6dfg3Qy;Q7NXH z^?dq!_|4{;ha2e3+mh={R8Qxy@rou_RU%CvF4(##I{}0vv-f0SA_Wv# zD_o_R7_^V(USCF|BccY{9f~eVCSdVOJR6EcQMeH!e4o&A8d_mH#li^+iFF-<4-DDL zrK~H8xNb-)s1(#tOF%Jl1VMxLXUZZE8AA{>x^){f$y#}mp}C#_N7}n zZ8TF!ZVwCx4(HvWOQ~eZnw>4k(ybC{;>IREU#ysm}ng)&FDBy7@_<_k${zBcA>Vfij0Mt=BUYhd*Xq>-cBX z>A6N1=6bxzi|#s0w@#|3$y%Ek2WD2i&T63T8CU7t-{Np{&$Nj_QzyFpx<5Z30svWC z+D-e2R~$Y>`74vK1WmBopk)KDMypn>VoMH5Zr=s_>&>@t{QcG6!3$DqNZK&ftPk6P zphakWMRqtykM zKaA`5uyMt>C4Z6@7~X8|ygusK9F?BQ!G|eeER5RNsySzOYAj_l;w_S@>k~kHx0S_6D`GN4+{Z=i!X_ ziGA%3UG1_nCFIbd*OpJ-%)Yf_LrC{-JzAZvj92L1NPq0NtC>w)oj0qFV-M=CqjTV| z*hr~SBOBysRE7#fmLo=tSbaZmvD}N90o95U2NQWMu=6P)~J>KwYNr|Thb2B_9jK46_ z7=P#8gBt5kn`zD)u!WN*zgp#D(xa80cbmlF{WhufzU&zMY*UIx#rF{t4~z&jeb(1x z;*H*lw0hjR%^XH~L-cK7@+O_IYBg;8$ z!$Pe%)AQG%9$s$yD>vEA;+|8`L}ym8m2Q2Jy4wcT=L-3{tk zgtZPcZz!ogxy3IU#C?4oh;-)Q!>!4SYcn)wnuWy#N_6m+!Qlz36PECInb#pmGitP{p{e3Y6sS}1 zC>Se*M&j?oz#UQ?Zwg^e1^gZp0x;uG2CX8L_98Wee3tvT#Q1?^;)$&lW$B`Z$)(Uc)nRR5j_79uh^09fC%##x}!|D4(e}7Vr&(c&0GM(BhJ7 z+u%<7hc-IZ5dx4CxO319@ZDtub5}&>9zoECi&=}q;^nL z{!WXX*SF0~tduBM<}o5i*lkIDlv4-ij?A2coayPhR!R|msE}MCBEKGUw}TkDz=xD5 zC$bI7qIOpqY$$0z$INTE^Pdg&;a|2Y8`h8B*16MVH%;H2?(^EEpWfSQ)$@_hoAuK0 z^*ychQ^3dWQo_bQ$I7} zHoRGDuz<1AC|fw{yA2!G?&#xta4cT^=GO&1iYFB1uM-B*=mKun31A6vEBsz5B_u4G z7?ldjoc}Pq`Yc6N#^1cb&EgV;z;gE%G&OA zo^=C1yjVOHDwYm4P(O#XzBQ1saDv}ZPy!;CC@w60rNiLrp_1xub(L~h+)2_=w5)@M zD`8k>7H+|J2)kPbRlq`*2{Q z(l$d%qC-4G<~OSHU8{zP4;8BO$??ISTxucM@KlTgLhP%$=4G>0|Iq??$U{+DT54zY zh_&Gz@FoAF-;OoL-CCH3M!rspZFKf`NxqD2qe9lpbpF{`kXG~1;$y)oV`INt)eYxw zjMPx8-?^1hrGoSxCxo;VwPF;0lQj{XhfQIM5LZ0=-TsNB~7 zSeJSm@D4*hO`~Uw8MTkC zScA4=Jquh)XpYwR+uPZ{1E!H+SH`W5P}lMB@aRf}DFr5mrBOKCC`ZG8Wgs0b;B>^` zUnCjozZN-#IWHsiK+VS7?kch=y(F29wC(o)|`k^kn}^QA0-aS zQIoi?N}@4!))l;q_;a+G;m(7@J}MIJA_3~}@+t|ml1~nFomfhLEX0-s3_v6Nt306P zn=*81+qT^V(*}i=&FcqhM*h$e(J~>UhF^Ft#2&d$OfWV^)_$X0Um! z1BxwP!ed>`vM`4G-qfx2YyUTh}2-?PlMv>Ef*Mp=S*-@=<7#{F=L(70VDnxlDC zf$*I+xcl~XE_J}XP(x&=ocw4?3aDZ*;Sm5xAmUV4fghA=*92zcvgxB~Am~=s&4`X} z0k*vM`RiY`a3irE5w_1r->zg`@b0$6IPx}p&T*3_)wbqS5Z>3pI7LLAAgLf8Mo9sU z*%oP=6l2YktyU%s#NB$3oe|Q!C`X1dcAvxvH3X%1layAFJD)&2XW06JXJRyAo3`O53e}3 zhT?dItGc1mkFmP`ibU(axFPNd*r#KoBwarI48y!d&^>0uT&qpUiO&I{0# zVk^H#xMNjs5hpu4|C!~wSK087`Ja=IQjRKEs+P$lh{8>3#TzLplx)U5Jsp2F%OLW&KzONg5R5o|%t?wH9)W z9~+8h?;JW_$H7pk(`4K%V=LpE)lcladMs&AE^})R=4A|bX6|@WsKPI74O-B}t;PT6 zUnVcnu<8_Nbv!e_J7JP=Z4RXcS(!K8)2;goG06@4oN?`Eztk4I(x0J)wpv?9qzu5j zdYfH<$%{>?o(^5D6|#%2WnqNqC1uhxlUH2Eyl!Q<^ZKNkx}Co2`Xt4R%@hC06zW$& zY_TgdRPV#!tL>ZYcm?rILdc@5JKH1?qn&*eqkY$nxU_<`*X}|0Am!B=p!tx@HKfGA z@B6cD=6r2**bJT*-WN*s*pQXoAcARTa%V&a+Ir88G*asHRjdBHtwDFCMd8t_HW2X6 z3U%T!1uHvavXh6!p*VGh&;HZe5H~wIIPEmijFVVm9?Z`vfk{2ygobEQ#ePEQ@O0v5 z54hVt_UcV`aJsH#d~_!sA7Ai5vE^Di+^+Kn@5}FmjVgva4cf_D`-!KJG)=y&3`QjK z8_|^XP+1Ob+|b#G?NZ?E=s`c07bm$^9+cA*RR*d4V3)(c6o-TqLg90GSPAyUUM#6o zQ-&9}1Z{sutso)Bcx!bw{$9mem#c#uPo1Lcd)qG&+^<*T6x~O+Ka7$aF9wIt9mp06 zM~TdIBd@Jv%Lej)`A-ya9!U>Y&e2wxVY#A?NPrL-2C$8Fk9GlpmtIKbN1{hk>?5BM zWBq!e$1Gz;I-8F4mA_1OPPv z>k3tZxpmb(AwbgeOR|T$lC%8s<;(Y%V2_0UjOlRGh%!B^q?|29>UA`F+Bd%Gz+uV| zBYH2y#2@$knyu8SvR9W{eA5Me+hE!Iy`~eRcA|FIYH5Tp+$VX_4#Q56A$3P3WOk}> zF`!3?R~zg#3AOpz1 zwGQhhLKa_JRqyH!!)p>c<@`PR8|Xoyg`2CW%*c*J?v8_Dx>?woo9E8$`RfuzU*Xiz zg6>DNB|XH6Wc`Mn;(T`1b})QC6{u9UNHEf==H_FtrLWCcQIGRoknCBrb|C|mx?yue zZQc1vm<{>}%gxv}oY6t|b0sAc>H zR6{X+V5{wnl89VJIp8_s_+jn6jUtdH*Bome#y?J7oY0(mzv!%U%nHvJg9m!=`<-sr zp+Toaed82_P>WVYykU{|XGLq@EHD&j1_rsLndxKG@j#+(_y@sr+SSEH zUp)FDA+Y^-Gpj1sR%9RnlUZ4axl1ctgj;3tpe9`Odx27?ICc9kM>@;nXPh`jQLnE= zZA|fLB5rARvi>9_R3x-&dMB%|*o-+orJ|9VfowMJ9<*OyDLq^Jfklss@_lKRM$0U+J>SIY;77s?xr zezS5yjT5)6nSRYWXP-k?Btl8<)GREq^_OVAAnui?ibc2pYdp_04GTgsk+DKno-<$K zv21LjE5)C*gIoH|u{sS&2mK~l$YN=Kf)U3RT zKw9zzu#29JifV&(EIm(#RrhT(xktl=5wBjNnj#gxIl0SEJ==MVp>$_r%$Sq`RQPXW zIF7O$Fy|HJP$u)3tro5g&s{V?wKz9#&4$Rzv5C-C zCng7;YOnXZgI{vc)dg46i?jEaZT1deE?Y=E#vY@*f-sw zP<|BeFh;Q6?C3Cil=agX2c5v4E41+1W+ z%(KIRSv|Mm5uny$k`Cz^QyW_Kv5eY>EtX5gZ#U%C8F&29<~_!FCv_olaAb20Kd~3c zCJZ{NUfFn<9F#Hz;0zwp*xX^gBiGdOJ>GH;_ifMu)j9NuSl( zn71msHokv+yJzW?gEQN8Pp_LuZ$NuWxC$>p{m0oOA%J{0ktd=*$og4^m!$2c5!HhY z8`Yii`V*&(Jb`dq0z66!gnX=dqq+#|blGNUKesn&|A=cRBU?j49HAKnQygGCA6y7Z zkOr&_btSuYAgHSh`Nn((K-feS_lX8o&h(~nC_i!GPzn}GSHX~IR64S}s8uXN{~ z@L8~!&}LGY3^2}SW0$&BLMYKr3d=7lS~}nwuR@H}9$WYQ^J#q`E6pzaX05{m7rkTa z;_g!g62%{I+}`){<(50{ZhEy;ZrO4B>$~W8I4)wVD*Es|4NT0{QS|`6p=E@0?neu! z$2<;}F+(GnN`Kd8=(FK;>MVh_IP2(xYQ9siDy=7mwmS{`d>}@{hBoQ9gFox!e!Jyy zWRz?uu@~%1n(T)*oq1QmkU=q-Z|oo`_ncnnE8bDH5c?-H2|Y2)>42Ek+~gK>p|k0q z@)Ii)&#-TDZ$wj1S04ww@QP!NV?7&x^am2P>%QYgECMuRx7bd&fDqm$w3Q<8=a}Bi z#Rl_|L(}z7wz@N%T6G!b_^>NK>kyt+KD#PWp3lFEj(*-$$tE9anpF*@*tbEZl zq9O!uq%z?V4b5Aj(x@(=OC9j}?rKdAdV5a*WKbX;r>vRANE_s0z!-dv0md4P5TIp8 zUn%-DkZR+UaU>Vfo^@1Ky1*Ty6fI4Qt*kSGwiO4M&Q>jH4YEV}xizd^lMTz^Vb`O| zO0`QlV8^alaj}E5jJ#qqKX~fY`K0wf%PUGNDqEcIVAiruY-SSI&=@ejIBc9`zB3?} zwPPLG=v06$AEqJ)CC$b{S7f$mKcygQvV+tu5jlW+^n;M$AiwrCB(&((Br`KELG_3# zN<20abdq<76PuN{y4*R&F1(XkliZcBh`X(I?m-gmIQ?6b4tkQ*w@G8cE>1Wef4=o; z%?2bI6QmeTn?i?WC*Uthg`j&<>l3&3z+K#)aZX)48W4i%!1FId!9bXYmx|* zWTwY%?dv;%X1Q3RK@x>>g$p2ZmcudHO!3RTI6tSM+QU!yxj$F@to9AD^Q|M+WgXSM zs06@NWy&}m$>))*nrBN!X}KF>t3I^=8yMS?WFg7bp%Vf#6eS)*al~{$`iSI3iqMtC z@YfMEip`5H^%Epb4)vNZ0bDdTR6vv04-8l4srY(CRi&S%yJ?us3u>uZ1maK$WfRJg zbv^gIAHa9__Bs_^If#+b%a|`-?8TPz7&BN#fAPzwz`>w3p7Gf-J{U8^1)K~LhsEHi_a`ldd=sdV<0AK8K)p{5d|lT<7dP;%6u<; z2AmL(=;M-J8tH83N}_7RtIZSOi!4@@{+wj|0Q4{i21IBZ@$vvQI{SLB}2n1n89zisC}qefDjeQX~zy39GdL)db=0cQ^O z9#v6=xQ1afiy&T{tcws(!wXF5Iqj@1R<2qgi)LnrUGy%QP;OJQfkE*U01W8+FpTwy zAR`!3#5BdWeQST#7&9}xfKC^_I9@Aymtx)b-On;NjSWdgI<~x+0y`JzeN|vkh}PWj z8S2gV_S%C??{@^B;I_3%ekg@a_K(luoepejRJ*2=1A2|(MWeT`=-IPpaoFh2ckd5u zJaYH-o|n3xN%``}??z`}gr=8PO-%mMDxzeap2#h#DobMde1Mu^;m`EiyZfrGUF{!W zOU6je>FJxhH2(mt!iVQX(oj}lik6i6w-`RkEY)t)(zA2qdE1#iB&?BTmlmzOB3dieW_yg?aN&%m`;*2k zRv)l=$1j{%Q&;=IE{5W!?yWf0IaIf6H83%H&T5Mq89pP=o)1!f|KueH0#gF0Gx@N_ z_`oKAiJ@aYXC4}}An_HK4Jzj}QZdr!>~ciUrmKcFuzPHHB<|`{+#9AFNIvEcBRjy zc~VeHyr+J8$C-K-;mpgtUv^1-P}d0 zv*kN`s#IA{@%lcVw4xN-4mNMUQyQ_g;v+KKa0KgO-Ws3eOdjwPy_?f^@8AU_qkxSF zUk28{T4OhR6M8E+sJe;&z@s!~KWC|E>2y!t*A(laeO%f#9VYn)rkWjARQxp@(cg@V* z8g{a)(-siF$p%~!T(m`hO>r{~^x;nM->!#x#{$)aH7wbKoc40^tjGqmWj^R|5I|6S-Ohe^-7*^2vlp5o(VO zi^&lGYWVsgtE2?D2k})@(LN#~LiRu*6dTnQ4?dfKU|9c>9%556H@{Ev*}5v+YMsD7Qt2X(fO)3nSXE%zLOa zeg8_jtwA!EsB@b}Uq61{%O0{$qGfNqk%(L2_W@MER$7lX`l@<&fAe``eRkVqcFyUX zRN@p38L(fF4F_EkG#GFqp*AE5l%Zfu;K-LNcs0YZp@b0PArVO|rbDw&x9hX2%C7eq z-QGV$i#qt(j*-!G`_PI}tH}s1njJTd)QK$DiMnd%%{z5%+2G6VR3=Oa6QvLqng~P+ zTV|)b2iV3>pWCB%Z+`+82u>!;O40#0&r9Y5S@9h_-<04`5lN zM;JZ~GlI=1Yo6m3ul+C63iocZBm3BCtvmBBVhr@HQhPNq@AJ=Q`xRe5=X%DR$KDmc zag5E#xIRX|_Luux>1#aOk)4pX+tV}rR|I%)fI4#;KHX%Ub_L#2j(sKL_b9ijKHCG> zoRq!d{oo}j0SW4FkVphgvuPC~wchC78vM!s^e?;HfK$^_ZW{3}YW0L|%H0EORoNu$ za@-9LRU?xWvr98$+WRG!j$LcC)50ia0D6M8cZRpzRyzDofMRmW0KUDuFTDd-X;Fw3 ze8Z*y+wQ$h`fSxba&u9f&u!a!4wU$?%z=AJN0Zns6zi}uO~~V@TG4RoL{0b3Yzj(K z8=f>*X!(H)iLoVRo-`^f2A&nIcdd}Wp3Wo>A-vK&g&q8n6~ z978`Gs-;_JmgbfJXaOK3p_d**;5N6+|`8MzupH^a<(y2PrRnN7)FQ2kDSRzGiZ%hr24dm@a+A~?eg$H%>8 z?-op-va$`tX37_#rC9}>2u3U}d`gw|bK z`6n0rB%3!9+K>?Qc9lcszL+xgkX^iIW!dLnp8Bpguhst5I( z&W2x0?XQ37w!KkX%x3h}S%4~oj^}M%Mq7cyEX{IdW07Mc!ttj( z5+Am}zL0SgnDZ{uM`FfCgDNI=akKG6P_zOt@qt_KuEWrTCw4=(+&-O@w!8Kw<`#kM z9#7!gR=A*8J8O`#FyhPYS!dBc*SYcL{MBX;mByS}uJh1$uH2~;8wZY2gTn0-Q(6-W zv5tzRTT%{f7eFK96sRI_txTkNSCI8oM0tO|-tmNmle!($Z#mSdXfYZTpOBBqHK5 zFlY_|6ok*qXF%W5i--^pnwU^6u80w`B$_l)tJQDO?I|1hqsNcwZEg6WRC&F?3t=(n zn&YwgiZh<{1y}K@ixkZ};0J{>r%#Kw&OeO_K}e#+LE&-fnxA~(#E@yKKZiMKABX6z za1jF=sP1E4OIm%8F%;}c(i^Sji%h7I(FdFs1X?n37DiB{HWHwiZw&J(&pso~l7Uod z`De^o-AYz2^7#OcSMbK^voi>E0n~6Bv0%_~%0@0MmmelpG~!Ye0W=D!F7{4N1sO03 zGT}@|cmgT}>{Zz<_xz2$z$}7I($9m&w3nRySCLCp5aEyzN)6O|cP|#N(ux-+o^{?1 z+!f(c;RI;S))t#Nh5N=r3tf{32^WvV53)Bfb=NqzNa}ByDFB8fjn|jVSOX5lj!dBT zN!oF5-bgdE3Lh35xd}-Nj?NhaBGth&@U>x0;}oXHN4#?WaL;?vV(;ykyzsZkB3u$4 zeT1riC5ye^!Y6GIar{SjiP$J0B*dMp=ywmyyYnPfD;yi9YDK@s&}{ zWJS(0%bw|zl;cNhE(%!cWQIR-W^(=Dz=dgq4DQyyjSA>G4E(V7I{6=;lJ}jcffPp0VKgQ*qoZ4Wp@qAl*cdA^sOc zq&$Fb2@CyrWJq`BKCee}$)V)pQG-F-U9ch}cmjN<0pyo~V|T=7vo}cyi@4&5VBq6n zh8IU&LINYyj{+Rck9ai`>a zE-x`_$SiWcmqfTT9fqA;6smLxkW&)dP4OtuKBYG@XXIvEAKLhGmhz`wRoxQ3AN(3P zIq>J;t7fLAo$r0yR@&<9vFK7i__S4aHPqC+0vASFlmUDR08dH{heHZGly=m+n$)P< zUM?}#-0U))8HPuo zbze=?L+sQ%3`D|W^7h^ypB?;S4SKSa0dPw|^(fpRW+bj!63nHumJ+8;Bl9H?#gG0B zUSSR|7^gm^rtXiiv#DQIK-Vt4+|8h(3q;Hp3nO>h7;3U)uz7hRZ7 zXyblGzD>pXbLaFvmG+sqrhWJ_h8|E}($n%_pl`%2A?cmJwbEN0u7q<%7(07%=qk}W zZMm(wB_P(FFU8hG$!iihAHFAb!s7b!Q2aS{_E*YyO?Th$D-|DCRF_W%?uQ!5w*CLB z68W!g#HQI6<<*DK5uMtB)(NG>&E;|GlSSmANp(z_)vryLW_{wm40Y0Q>Qt#DFvQp) zYE9Sz3&*Y<#hw%1(JFeIypJ8MsO+czC;!C@Cbgx}kT2H`o~#zYC@e=Z(G@5(09Ke!KGXc|LWI(0*(YfP~KhA^DY1z89BPWUT7QDLpTK>E=cmcZz>6o;s>^yH7DUFbf6OSji1${rX4Hd};YV`%wVT--jJUe}tsba81 zeOG-pkqdNhUhI0Vj@PINs54N7%P=xYh*~`0{i>mqvA_GzpFbaT zL2z-j|56N5dVowpG84MFc!2ri=C79y5|Br-pSUX!DiN<5snvhZlzEr%H}>_wgoNgn ziUMjM)%EUsz9pD0KNGGdF&1h~cDzk`utfj*6!s7%d{P+^W`u_8;l9hV=tGA1H?kxJ zhx$;aad3|qFyvW4e8wddIWksCLW8mSi31O@hn{~u#uQc0;lu$arET9fqf-WmZ<}~S z{S(N#1;RnMBt$(je+3AkXr`%xgrpz~Sn`S!7HTl~3Yt;ywHt3hrl{uu0fpTqv1j2z zqJP3HwkKgW<)%>Mfsz4f$P`Yve!R%&f?FVhCm)>7fhDhliFwe{mooHKH~;2OQG_Ao zBL6lSvA_Uhl;pHgqd59Feph|Z@Urf^Gd)i<(NJluFGN;N=>!;-EIJL|f^nW_5bk$B z>8dGb+VzizTKA)R-5c=mOci84-h0u=i!sIc0yC)Z6qr&a!HyXe1Hs+ zw+uOp4`5F0cWRGC;BXQe0cb1A34s`CTVX@xgj7h$?^=;-B^{=;LUiKE9InHA5*Pmf zz5Q5ZN@!dEz-yo{Z%*IS^r&j1y47Kp%%|Y#kr)cx4P(vB1j3XMFEkU9OeS$Wf1_Oi zCgn_`ykAJod~1LG_pCU2)H!S4+(S^dBfwVZNrs=SV9-z@9K5K(uId3&Ybh6DES;{9@_unmo`sC||l4Wc*n}J|(6Z=HB zjCggf>9jF5qX1@GArD~GweGrtjv^wXM)|-ONZUfsBas(a3<8K-5vGirAgSl{l%TYG z-@cFm*^Jf@R8BPcTt{r_L&WF|h)jH?yd(xqiX;1LA6v^zTfAM;1Oj7LXSJcK6}JGj z6@KAIM3z6422lPv-*dPGrvhT=G@UH<;C0oUTWqYLSIo6vgw`v=;cjE67g{=L%a{Zy zz7eFjDdAQIEscU#yfxQs*%@>TlrMtoh~ViCPGVgUFt%Gw_d68UAX!<+vQDFgCsI9y zI1$;sGV=r3bRhI@IMM{vEyFjWIMZDvUK;$Vr*8CViP6^HivVF&TyQHmCF= z-<-z_!8?_cKz_6h5{S2W0Np5*e0Rup3f^}m<*aR}H7o!;iXSgM))w0oGyrFZE$t`- z8CaM+@Q63q0oaiEa66EVE*{{RY@~9LF(WW}?8zc14&AsdXj$iJDiACBKGQkvyr#}q z2=z>U3IjF%VMHk`-4+(ymyr{@6c7`qK@UnQ!HHFoImvViQ9##}{j%15S-(s$Gt0bx zH_Ji3D{}BG2L3p^<$)Xm_tBBH*pYA<#)fx1J_cFaF$-#@h_} zc2r|C?y(Qk;ufu;ET$oOs^Z9=#SCEHMwX!P6q50WZjP#c3nYQE(&viHP$Kd1=n#Wx zVZaqM8^DA(RcVxeeb`{+)OHYDeEA0qaDyP=iSZ2yac+w)zW;|qFA`~!`%#t)hLV|Y z@aZP}CM|=Qknp}vYw!+B1lu4xCw?R9J_9GP4sm@~f-;!23UP%$V&l{$p*Xj_&gGE3<-_{M1_NR09Ja;*?D1&YjzPL}8h8 z>ZbyLAPVxR&%V1Qgc8m5BKi>F8qh+LIWK4~8XvSB`$0Tt#-zCf2jEm|1BgPDP$|Jh z4E9uEFVGk`@GvuIry`&rt;mqAlTq|CJ{|@`0;pdtl}(wWXyz4N_2jZ6}Avnj)3w!cr-JTULdEQgrE`eM*#;6#m?i5*cC^5 zAp)2Sls_`W@xgu#5#vIufL!U|ujj3$rDFUhQA-|Dj=f|W}j+{1Y%L-2*Jzid|*kF z`Hg!BFo!!QEjltc9k0aFD?<@Ts;C4mD%*ybP&<-yL= z|3v_>fbqnuEl)c2e(pzRuc*+_*>v#Cxt#BL=)HTd&EOMG1$C=bM)Yv^t+$}r{w1A9 zg*DqhLc6fBzT=z^nFEdQ=KM5EA6>F;dLfV(Yngyz&1me`79%66JhEfnS7w4zs z*}qyE0D1`sj$zC#d9h501nLzPlFY1RhM3LSZOW_PhBtVJl7?!M)8yoZxwghGZI3;l zKCC#cgTcw1=g%v@==Zr4_=cm%Z&99|)BW(gP(BGg`16vTTVS_mo5%oiC%#89wjI z0$|(_ZXuZt0nCQFNr^)c=KSH~$MfkdYHt}SibxiFQFI%Pt~mm*a7Gn>X|n%IJy?LW ziV(%*6GM$tx~yxl+Woe*HL65PK#9Z(3BkcdE?|t=WH1G=mKR7*?%iYmYpgb_RC(5b zNN8M+vAK!ot0|Zl^8>UXK;{Sm@_vu|(ptoaKG;;N9ttdgBuUm_Yos#$hsXGLjK}^? zm>iEwL&jrInMJY?OBKeOjbOqA_eN(Lbc(C$Uj15hW6(oBl-0vux}Vea+`IS1lJ@G+ z$GW#{u;1G|WJ;2o#$A6{rn7)8PVEk?N7t(%P4tNs-5Xq)+)(s5dh1isUz? z)B1XS@H0`GdgDRh5qfnryz?&pNq)oq`qA^j%T3aK{O>8D{|#I8KmXCs9d#VseNSsX z>KCuE&0oXlitDVUv!@=K?>qmGQsP!eD8!y=C zzHJ1<;-R^~50QRyv{TjBe;4Hy>4#i;F2mw@h|a2{&?@lYtwbXv+6YOG5+AJ?^+W>B zBLFrxiD|3Ue2l^oUkgE`XsslO6g^glnSVJTv(z?u@Evk4p)Q`IM6xaW!$P*6G7zr zg7DJfl~=vIksqa%Tk<12d}WgpwRSYtX=ySwqt@ZkHSTS5$vEt%w)p#`{_PeX@qTR* zI^{@zhWBP%Q~91?;*iyPWQ_&+5lLkgx3`q%)bAPj`%vcFBv<$HjB@=`D^KPQ*QOd1 z9U(rSc?et|*yy17K-NxXd4+v}W_2h;!OikFjZQELg9lMpS68O_e9Oxdk%bJT0v43u z$AYX;GFlrRVJ7d)c=_tpeo$`A>4KAf|Ni~u>(}qUecKZe z(I1{ga7omCysjhzLyo8oThmBEhB*NXx0yLfQbtvS*mk$P5*9MUhsJ6F<%$Rf*XHjX zk5@Q4 z)_h0zqdR2C8Pi~fRY{9TH`gB~4cXoEMm_&tfaL`@YMfwF4!nSD%~awH+__DdGl3E< zo2u)70Fu6!mUa}Y5Q4}%V8OzM^*UnpCJ>DOj0uytZzDB(NN_IQgqB%|a+@~9-=k|k zCiWd@93bZ;m?1Jm_)>gC=*cmGDHrYE4E;AmuOPhe#>RIv^^Vt0;6?1qs1XGu#10RS z#uBL{HeLK5Ly@Z}9@W%`t-Voi5bXDo7mb!LUoH;_3M4-F(Y-wmKD-bSarf0LFG;N- z0qtFt=j7F^SBpmV9deBT(svlVx+tc4K21lZq=Vg6x7l5s3BOL5ost_2Q!)vPqJ$AF z_`!o)SOcd|FB*Nj-Jv=TZ{NPfld_XqSQL0{tB^emwM$%7sLn`2O9y zjsv4*T!oKMpE{l&E4~sXG4$kQRn2}F?J2~sxl~*~W;j~H2DiG_c@;CUq<6C#+HDeI z-!4k9tL4=Qg&s?CU1>olEHmqzob;zD2-GJW(o~T{h8VXmG}W>At67M7*aZIxhtJmE zux#nlD8|sPS+j=7$O#+2;Lw#Jr+kH%FJI~KHjA(qc2z_sZ@JxZK_++%F&))|nf4zEO||>r zIE1|6*dgl-l~1iD+=TBTuXgj$3qKYEeT{2r?MD&oKW@zJ(D*r()43yut76Ca1z)&% z`EpTHpWT0_7W_0U`u%r^#k$1*X5SC_?}VhBJrW92YH)Ay0Q|${lQgpHj8s0QB3UY~ z*HC?Oqg~bxr@!Y?u{l(#pGb|ku_C)JDY-Iy%(Wy~zUBf+d8~3IEIbgRoku=raN2Id zSgGW>@!77c7ACQ+Or1WxOM-fj=~T(R8SdHf)0384bB^);SyqYh@jDRsq09RdnhQ#b zXm)-b^heZ zllb#3RNhrquK14@Kqa1jA;>JWwNrGZtMm3dKE~Qd{ibUfRV*I4Ztt%5XEqn~2~4#U zpY}EG?d&T{vpfdB4Z4shGSsF`yLatsSBO+=&veW5w*|cOdW>7_)D#0oxwe=nUbObW+XeACDeYp-z$k zcd%Z7D{V=AV5brV8EQqDl7#5upH?sP$l~B*5pC7v7ANerwfP-@{3M|iNT)6XeaV~n z{5HD0g+VRuY?~iHCn{Hd59crgRo*ku88YFnRH;3mo8f-Fdd3}$+>_ottkgJww-GmO3tTVT)A?kh$Lte6~taH zOgfdo{u<035*QUr8UnB}TK7u20Q$t^mtTi&O~@=^tjULxD~paPxcQ#Rf!QQASU)<{ zgLb;jHp3c+%=~1?sx$0bT8;O`CEK zmm<9EIX&_fv=V4iMXIAM$Lah(r9U{YWKt?^OO$ijrJ~=WBE*tv5}L}0oE7BCV2dRi zekh@Xv_dA=92ZzxT8hkp)jEopDt?0l$Lfq#25288N@&qqY5*zNiH_-lLWXbdXBsSV z@E9b5H5X|rRcUl4qpBtay$D?hCy?+#ZhqJ3D@;LTL5<`<1_X-yI@_H0lOPBDLke;F za6g9$!wV{D7G;K9d%It5i@4M`K>#|yyW1ju7FnB|-~7b7DhhlUq^95iTwx*0-2 zdh--0UY2qVrG^dXL-)#P0=}4Da`Ef*baBg0@PALn=b>Mz0CzIY0RB?)7D&8iKjFT6 zk@-1!@?-_({!=mxjcCu%rPFZXsTq1%!Y+0Wn=|H|8s*gwE(gK*j@% zm5DTW;ErR7n`XJ%s`KRO4jVQ@H-HTHRc}mw>Gjvq37UOX8&Bn-w@qb8?y(#DCCps!oAY^1@NI(Iw(f&()y}Z06Tm&?=*7OI7kmsWsyyX;OsYxQU-nx!q zp~;I8+y}P2Sz~&z={A0P-YT|9L0qjSYHDiqz1vzk0Ev-Iywg%U2b_3{b2L|-eO;nR zY^@Z8W}RWs7eh!auFoAicC6E{Z?>)C&RImd)1_O~S*{?)n*d{(U97N6JD-3Z@jv4X zI2h*xb}J+bx_R@?VGSKhzRzLy&jaq(pU|A|xw((GHBIVMg7!AptWvGp?e((3F{0lwRxrj*Kj$ir9YJnn5^JARUG|rry6l z=Fz#~9_&&wWr5WofD@)Y_WaP8^|A3F55cDX@xP9*T(gEL5p^^h7U}8fF-a=IA`pO^ z>P~M>CUp?_)&$q4z|u4&eYuiIsYXc!kwyef61C%cY7Tx)(j!=|v+LaOG}UY=!NuYP zqdS&Gh~~0Kan}K=9ugSI#xr~1HWd|>X=I=@NXVwh4j!9JZ0d;o{o8AoKQL*?DEQfk$-oa8jwrQvPSrqIk~tQ`Zacgcqmkcujhlo<6&G z`GS3f$NQ{n5?Q!#5ep@_kJU98Luxd6D#Vy18Wmi-v296T?S)%iKY$bQu-&fZd$*|K7Gt>KThT(g=R>fvF$Z9{R?hVBO+QeU_F&crI$#!??! ze`MCceAJ`pM%1A>VJ3=R7IO@VHdiKggPJ@mTKK<+d-HIv z_pa@q<}@eG^WIG~r&4L2CsT$Jny9E$BBG)+Xr4$?l#);s2}v~CkyMffG9@8GMT2-= z%ij0>*K_>-e16w)T=%`Nw($LY-tV=}b*^)r3o7ZTx3^kDb-oIAUZnAsXW3s6;B(aQ zybdnBGicH=2k&u`eZ$M?8oIeD)Ht83NOJKf_+cQf{~Ag$m-Y-x+vg+!Kz6&j)~7d? z9~^qe4@?L~te0I>G>6E&4=iMpp9rH>v-0NG=U>0Dr<5*HE)-`zzmS(4kr zL$kJZJ@Ht-*TV3K2vGOsdoO!4xDu9l6MrGJgU_Jo?!HADCy@!+Qf=nf4h?dSC~pJB zU2BWydW2OPMMxvSz)ht)wwCu;fBNU^eqje*!42ahQ zM^1bnwb50WOZeIWF4$x9pILw6B;i3XKYsf3W}@+*_p@eUb;f)t9t!?1?L)u-vLgk= zN6RcLDPX8{$#!*d)a}+p4XOy2UAM-X!8tK;|oRKX7!E2Xoc@v77 zt~D`Y$3LZ7k7i~!otTmMIb5e#SS1?Y;xT+Ae>8B_EpXJE&7}#8E6$-Zo2gepbs?VyjmXl zIZhz(^N7@TVp)l!y@IqUMSdsJG+J#6STNs9PCi7583wG#+G+?;!*Ff~q_phw6bfYH z#$~Vp3NM3=jxehK6?iKf5UGJw8^(aOJS$UKYb)ANZrZNM$kEu`$VwSJ3dvzgyK{{SnmDzG*MxY`iP^l)((CTho`59uMvE<8a3KTr1COV*>%eH0N!<2s zZ2RN&;0@3ldk~%)PNlMMkq^jY)z=6yzDisf`yvcffXR>+qiGmRv&=xOPGBK6+SxTc z$KEQ^F9yG}Kuc7b`Me7KtHvHKE(&-=Vs2bdAm77>`Pb98l0IY}l?DV$adJtS{F=|8 zcQnV3zgl`9+$lr<-Me>JsgyA@@)3d%hb>#4v#4soVh^T_`6FO>xT6^WV)|guxv5(f zMCC`3eO=y73l|w{pEXMagZB3Jypt6pkGIbTIg|7lIi5yB5#|~?#jsf3J6+aXq7C}R zi+Mh{`lD-QY-kF@agYD`M>a~4{m)&QtwHrn0+9Vb9D~ay(Zk8%y&aTy)gJqFvANV! zUq6I4$*wsh>u*4_|8Qdcm0CG>Aa1fYQ3?e1cYMoo9IU;ZV{k@uOND*-ZZ47?#p$#j z>`kkQ_1Ro@f5|d_GWYmT(b8kiegS74r{R_A`$^nRf)%hfyA zzC3rW`ZZZlz5c&^k%=P|Hna~yL+}i>3#yB5qeqV>^U6L35Ulo%9*Y+*rml{1{H}_n zyVtxK#6=96rv|67b>c3Cwws$<{JVF*1LuC2wCLO=eN~o75awnj$FLQMVv&zV*??Bt z?b4FTLT~t}X=gUp8tj>upT8TgQg#!sSmC;N?_Tv0KTZ&4>RRe_95|iSQ{uP7uW_*R zNcQ+lqs=_yf^N|6{%}JJ2U7h2nf+f3hDT9twqng1wX_nF0r%@HwH)Yg-yHvXiDR>$ za!?7R9FhHJ&vxS*DE&xWwJ9C7VtG=*sNr?a0Kpdd#h71$E{;Anr^SG14eH#=W^k6F z`Y_qp%%b_zy5S36JG8g*kWSWWwEAJ)x_R+A>LqO8lLW4V(;n*1%RX(*yUwq*$lC82Xj7s z`iEA(B?>7dI_#h{G;D8QngLs(_8Qbt-nS z**t5u?~OfsnBWP11O*CR(PP-U9d*P@O5{ZKL$gSh6d$LOKL$J<=utHpW}CWO`kt_^ z8tlCTU@zkUi|rb!e;IfncSw*)N;)7KSM(AX3bH$UIoi>TJKMaOr^i2nZ2_|88-&VG zOd?E0S$X+gcs*h07%rEBozyKHEp-rEhu?3jGCjBUQWZ>rSb5Ou=&Q1+Wvf;)6S)cy zMsjL=XvS3B`o(?}sJ0Rn29y{BLiZ&G@DnsP<~D$ik{L)|j;@JG^-SyNe<`LO&9W2c zKB|7c@@~ZyGw??g#9O=9iw3q29An2@1qX?a*;_aG3D}6G@ zPyq?gN+RM`M(hFY5;bYv!W~Wu)URuL`S=`$YhV~R0lrn}1wuJ|so1li2EmmQ|I2xN zBWbDA5D=w|@C_}xJd(l;I4BAu=h_<9nQbU}J5p5WFb|kMvv9^VsNg@wd!{C5@_mOA zxM5CNPEpZ*7A_2~&70m0dXaa@He^d@JjaQqLJZQA?e z9anL-ZWS=bCbtmv0j-o^l`zml)}iqx<#lJ*D}{x+N<)+U4^U z&(PvW%##u8)B$z@h)YyGk(AGE;&RITHQExWZ_56QO9M2Q4s3OjAkb-~RXgJRxr-MY zkbaP)N%308!~K=4YxMp`uugyOHRWdq$U!d3vB%~Z#~KY@$s%-zfW34wG){ zqcdvfW&}1Ow#P6Tvp;>pCano6>mvtBh_feW$9b|ZcLJh2%=3jbA*y_H71Fao zPOB|Nmy_5|q8GTq#^xRms9(Q+{OUfx;< z_chJWq#{JjHnh(GMoMtRQ&swq+F+k&zR!3JpJo zYt7GUC2$2CFjd(=8-VBI&tGN0z9XKB)AX10|XUWltrRZy%rHMJv4n{$)JA; z>T4DH{x^898e4x1mFaJPy+z5%?K^dvjqw)GPuq5Bw8>$5=$CqIw6$%JSnokadXo2~ zB=2>KmOeKtf?B}K>!n(4xk)C3;Jx}ZbgS0Qnf*#V9-Hf>TK-%^_I^>lS!s7YCb1d@ z%<+F=wP?$zuf-MVz(`Z!`{^Hz|YhOe(y%*lr|AsUUK3zN*5W3rH{rVyE{eF`q zr_G-ISoz4TKNbsehp6?gHdbgnD`|Ul=7rw_m(+SD{IsYY!FMmo+xTu`>B1w6E1eSB z|9QV_qHEnI+Fb!5yN%zM*QST9)gE#7pDzv7^Ft?wyi5!Ah;z)C;QLJ@?q=zU?zM{! z|GU+wY~Zvbj&=Ec*S{=%U8?`zRkjXKtIz8h@9e3W1r}!S3tJ0jB{79~5LeN(;W;T0 zm{t(Kw}^_?EcVxe^>OSs25${IwDt@27@p)i)5a35B&?v5`I(}TUps&b8hmZZRthqc zVm6e}nek31`PZG;JVO|Peb)~*lquAD_3N{9$YA%jK7IR!(M}~2D==8wvu95ivb7My zd-o>PetYYaMjm6woMo(Zc zWi+*ae>e7vWn^Y5o?;-J{I1xOJ}vZRbzniwV)`ZGUc!=$Klgthe{3$KISsivNpiW+ z0JQ3^sX!6yOAW-X9l`PjLHb)h-{HQ>l=nra{JcEZ0|%Oksn|^C=wjQkQUC_tv?qCA zTv{2LTUa<707xhi;*np(DlKR?{4mkFubNu%knuICqR#@PpR6&1G=!LH4CeFZD+71F zs5KBit9E&1Wu?l_Cg4wMPDNZ?6=xpqdiT|K>&f*vSjeY zEO!6iy^UpDOZE14!jbv#PNb-eIA>o7XkHs4#J()*pcetrEV~}K!O}1X;PcB%ixxR4 z$-*eHEhHD2{vf;tO!(Bno+7+qu#OMy5z;uDs4p;yUr#1X2tu#`Xhs_G2Pie+=Le0p z&WK-reOB!{p5MqduNw5k?Uo?1bLY+|r>emL+P*WmZE&Qty3k@E51?X^l_&^zJW2~l z!E7Nz<+Z;6A>A0`+Vo1&Y5He+Co~w~--#N(=V9v6dq$+gl~|qvV6P z;>G2_-%|a%@Bj*{M|N%jWidSF`>h5jE(CVq zc?xZU5E@Qi3hfIsTF4G`unc0eo+C#Zye;*lFTf&ju~jfO^jV}AsIT%W<{8l@TFCkYydsn)h>-QLV&Ag%*|rb=w4ui#`$pB(+jZ&E zWw1$9JTpOM6&1bN*8x@*dnRV)CQO(h!UP%-K}Mm6X#}GFdC~O>S(>$jLOD|~h>Z<& ztAgg%AJQ4h1$=Ov!Da#U>3CFPn9uQI$;rzggW~I7uEu%ywt5ni8XWzmyg@1?V_7Sm z3A*2Xg_#25AV}*si0}u}6#!Qn!oWpYb&Y2|7hmRgDU$v@VrY8*Sd3{y-bc5-`{55=dTZ(6KZ==gR z6|hfhRM!9ELNpZWAD8HIP6%iY#c}l`FJWx z2%9-GL8;SqN?g2(4ntW{Jc-8!@C#O3mRycr|9;weorMkGaq3~t+q7@LhinMp#KJb@ zd6S^nWfu`-jHpCt2D3SbEINC4)elaCxYdxZUWDOMCCiBM%eeABh7?n`ua0zx!j!cl zO`9~y7PA@>n7BN#O9uOj+Uxne!rg(<;ep zz-e(vg$DzF2`2@Uu?4BMcviyM{;v801({6u1vKr)zymHKqEH4RKj6&?(7kALn4k9- zD>_-}F%(jia4>83>}6aVk<3zfNso-%$`Y2l@FtGh6P}Vi83O#^VPvM5*!OiUde0~* zYCsoLh+Rnu;+O{2BYU9vt<2%O^ z+y9RipjG#w*v$i(pU^jzbITLRHK6B$LnVIG< zRD(FPA$NE}X1ZD#nqDlwb&qY|+9-%79`yTx-oQgrJ$$)#(Ddr;yY;El>$`7@Phk%N zh5v8_VnmDm-rilL8AeIXYgERDni5*HN&JD~l4p{m0#eKI9a6ARKALiNTnCUngu{LM z10ukO`Mm%1>0wUX*XJ{P@OUNYBaFU)w1BSPY38qoG3Ud7Is*04ir%hBRC_U!UbFmh zaB)jkCQ;i7dP1~z4V^Jpa1kS23PS0D51IVwL=2Gt1B$eaXay06u#+`QQVy+JwF=JT z0jXScHM}u@?ycNBsuj74WG0!J?$t{X5UA#lbuK4;%QA=i;1}9Dz^)5$I4oAUYSV1FBZho+-Cce z3mfOCn)E(iIs^YijOsURSR0yU@OX?~=5S51^4P!{9Fg-C{t41oCA>1a!Su5v7UCYA zda+pMEGbBQMhlnl^yyQpQavy>ZIfL9jylQKa61AU*y<~SafNGq3dw8~ZHlN*3ivY- zN>$@v^U!>_+!zR33b@9JzcTyu6R(sMj-5CjDG&fYB8DTBh%zd62{!=^zAS}-m(MOP z1}8U%zkvOa4I;9NkS@K8Rsa(nbClj^W@Lzt0Qx@%PN;xWDG8j_#}vp4K0)95xQ~2? z)vC0`>DbE~maZb0UJkj8=o5RG7JkeCyrd_oZpYXVKN}Coa{^{atUqx=8PWD~KJ9HB z9base;W365q+6u`InE%hY~>VNZ$jn|5(~DSt2kVIqT#qdC;*yf@m$0*50d-%_7CjL zLlGzsS0F8eDe&efdk=6W=)pJ2Cb0f1ZPwWKOI_|35bM;uO98ixYUkDooQ5Hmd%e9k zg*32RcJ^`jMM@{FIqomWM;u?FTdl3F4d*+_CVEV2w1SSU9qvUzYWU|6x1Sj0Uel6w zbr9w7KyA_YiS&m{6yABBIOBjHrQyq+{fKD@%R5KNj&sP=$0FR}M^c+y|7D{9eCXxYN)#UjeC`_+}u(z z#pdZkm%~_F#t~H~Ey~uXF%($66cB@}l*M6;pY` ztfvCW7v7<53Y#v=e?Y(xA5=ionLdHCA4kxBx{^oI)7kUDjD&s5<(; z6i)OohOy=4+`w6O_V%kdfS81u7-xakAXW>v|N8Z-w`UT<6`Ujw0S85|qM)y;LU#!| zXaNmYkz83sphlI|h4kTNDG}jSwvGp{+1i#-KpOi4@`{U#Wf$?SaiUuSV<1v(+Nza! zL(6EI&@0Hu#B-qV?L?9ej8}(7Yr``lq}o9cm>|rWor{ zDPIBss7!F!wsq^m2rCsV<5|zJ58+uSPAegM>Gx$VE#7#}Ebb6TY8QgeB-YV`oDGEr zJIN-?S4GXbC+^(QFL2x1>kFgozxaHsx{z+X-M2f$rY=Oks!_;VyE`kx7g-HH`Pkg> zO??b6sAA#Phz6nz4&G)B&3xhc!e!nwYnSvrfpl2ZI5=&4rBzbF>TUZplc6E;bEVTB zNYSQqvZQ~C%OV89u|~iau+SNyIf1_lcxa}GHF9i_br2~$QQHz zeC%#o`~0`%^@ZF~jj>}Zzz!h5tG|L8HEP5jURBMBjMI`@`C%WpP-2tG2??ICLp%3* zf&O;Xu5Gy#Vn=M*bAGg#WrAA;7t#6JU~7AkB9>{a5~Cvsd+q@pL}DdLQ6$7%a0UeTXi~mm%E*x;RUm#)93iwkhXV;!#~wr&;V^}T zd!J3**KxNh+=s*jxG3=hfz<#&i8nqY99lWWqIr-P$v-T}(vDc}_74)diTFn6@|6Pd0BoQ|Y&;K9%()>ZYmoMy#3>)9lWMy_{NXUPZ| z@ELj-)7*c!0<%HpY+G=Dr8Z!|v7PYnGc7FxZ)~FoB^=8@4DDdLTmDseMudH9xSiIU z<%hrB8|DzkWCaA(%f{*-8%4-O@xr-6A5v}g<}R88QPv;sI;OXUGu)EYRUsiEdK(sO zw?1-#b&bPE=v3}D)7Lk*Gl2v_>%)sK0Hy#|Q4VyHEJ!shoCI{YGy=p;d5(uF0|P@E zzTxCs{bC!VVX`|2fuG57ZOmOv;O|guxc_pB{Z$lh0ucFw6DM5% zH8`Pvm7Aac5Tx(_RfMOYK;HVZB4fB9A`R4k7^)Z;1T9_*QyEA)Wk2DBN}ob(Q2)s7 zaQ5U2X~!Y*ng(hSu*7d*4jAI2V9=b%<0I_~>rK%>i!T`zbFm5`!5Y=-rHh!10JQi~ z&4N`Ce%9%9Fz)5Z%4;SjC`i{%ggsk-4kssY1L1YyXRrU-!Q1tBPRRF)srX#UeH%k7 z4xnHG#2{eWz}6Usnh8(<`eVOf@T2-yKx@~I4RXeOUDa~=hRvHVF;_3{di0J1!#8a? z@fJ`gm8Bx+Y5fBJwYRIIq_Ml2jyjKi@htVR}y9R9x* z!{V-u7I8j37GS&c=T8yHXb{LXY1;HIJOk=%#N`5pA!Z8bMNI2^LUyVlvQbsnO)?)Y z25rbL=!pS8{0Q*yk?^qM0!SknFoytJ%v&bCxjadhZr-~m;&Qs`1<*r?T$%XTVHiB! zUr#!*WJsE(2tDT}Yv)&8pmQp7CUiR6cInb=5-*Ul1k@uIwiHX0!>4VZ!pzqr7fK}K z+6}{qsCVz)OsD`ZnI8&H&?;QEX3bnW%W#0l8oedL%jPc*BEAwZB54_avk!Mn#7hkELshw2ijd0aTHp>B?=} z?woPq?*02y$F2kmp*9mR@xm<=PYAgN^tgD*_tMflIM!mVL`b~6AfV-NFFDUVDHgBZ zfBaY!JE`1Tg2X+jb9jUtY~JqE4Z?lHeUAUjZ)V-gqLFE0*08DK!)%G5$k?N|eC_M< z%{50C3c>IZ}cY5QnsoObKUn)Isy~i`CXa*7? zuKaplvmoQK>Wu#tKDD{q^xj0Dx``pp)aqrme?yphjD20}C43IE-0+^uLATCDcN$Lq z5qBR>{m%!{+M{%qt~SxY`K#A>FBCk_8^cP}j_=Wc0?{@$i{Qa9-=H zg0QC(z2}z+3kG{mwD%2^4#mB!+?3`SiI4LumYhAbgift4x~(2>B1X>u=5GqooNda%c&V@dgX1KJ?ynV28`^!JY+Jx@Ho z(x{$P#*nl~jb+Us3?#tqsE5ZxDt{T5=ltHVN>c)RaCsj>>`1>06i%c37!{_m#~Vp` z^hc(Irl(S-gKKDe(Y9-ZP?wJi1X+f?IZPGOM;T|tFo1BT+`ao#*_$7;MX`Q=Rn=SyT@vh3ej({@2mjUs{tzjz1St?C z8^fb82kbJhuh2}y_BQR>Js_t)NMa3P^e zTgD#<+kr-f`8g)r@*uehk~UDhY`TOyPiW z-f5KBH~j2GXX*U2@>oh6Sq#F7z!FagU6^6|Cr#W{nq@KhkKD`A8a#p!kKUjpQl#k2 zMl?aU!RQ6?M}jAPYc755Mf)o~o0PeC(qN*|_-do0E9a$KMR27iu3PEAm9iHZ3b+IS zDbDmVxH9pn>>S}^2_H=CWF)l>JwE0|g{{L!ya49p zltwmS(i-R3R+4~4+kSisd8`p!nm$XRbnKqRefp%uxmIs;i}>(=o?8Z$ejn&AsH+k`Ok+}gJy zDV;rXLGsFQ+jTruy`z`Xi)q%$K@&0y7dfM#ML*{vq6Okgvrc9^(Qp9Zq^|)=B)iAM zDa&F?5E(2n%ws5vs%g;w=Whx0m9;y_+j`M;AvJ9zKET$Hx23@evslKGQ(=V_#D$w4 zhJ1QLg+Q>v!hNV$eSCa4zn**>@o(Q=twB9|jvB_n$>}Sk=?2DSIRErJJbfT4-pT$Q zUOexsv6GV%7m{SQDR7Sk~K`6rU#gt!w5Ja%Ju@JAMbGnj(;vTk;qE43NHTU7;F< zM_S387{p#veweU8kaau4n!kt8zc?JL=^rcMU z{z)5x947-XY?Na_OjM4P+WvX@1qI=#c=>`M-9kw$!tE0CY;x{31USr)IffP3;T%T* zMP8L|o=l*U^TE6IVC$d2=5`!u<({@xN9KF(?rcaIu7YBRex7uj6}aMv3fhA@(GSic zQwA;y?^}@KOT+FNCOUHSU=+46WYvA#=*%6=>=%DG+?~%n#RG8pn>*XaLHvk$m$YJ8 z1W0cjt*+<;CoO6k%*n~i&E3g?rX&UM9f2nhjW3NQ5qeUVC#0pRuw$I=bvf-tSQ}D- zv5Ep?SAMY1$S6eA0}lm{B?XBL24O7OVv=f)SFm{lieJ(3WvZ3A7;(aq>%~c%^<@yZ z*@QXeKz&t_E>IM*UL+rW4^~*3vD60%oNfW{wMSxqw+sz>-C3jhUBD$He4Cz4o!?|u z2ld|PT=b^3)1Ne;_jH{GeHL1(=I`vkP^UGGn0iWvr!TvF>)fQ*q_$1Ye%oC1KC4Ic zm>$F2FFW)KdtXp~?8zIa$}@MKKDpw>iUM!A!Zw{ci3if=w5Ct$Jk@pEJsi2rFf<)M zP>kzY|Aak2&IXfVvoK`AxIB5~@0qXM+va9HMQD{?Jh!CHqF}>8v_%;*;wVPn$$)oh zf+m_Ei$jltLsW5Burz&HouJa=$q&1=oEg|%15+!y_F@;ov`9#cS0m?NpqQgcrhu}2 zHt&E|SUd`JdQDM9LU8ll@ET?r_0plwnEjBs8w9Yp$$znkd>*!NU`TR~_8E=4>moBh z-U2TuLG{1`FI06=dlQVh{ty>cN`>@R2Gez=Lj}7m(scyz3J=HIVQ3L+mV$IY5!VcS z>z-It{nBJYfhO|+gOi|Uu$$?4x0;$7upL!^E88$|R(iR@m&r2117lbrHybx)1qF$+4z&IZ@G`uI z#uT?TOgmy+W5dd3_+I=lKn&t8SN-SD7+PsTL4K))Vn)IplJYLE5vbAjhXcmJ@_^f_mtY9-Wi%$UwV zh7Y%0L3m|6F<(z{3C6)WN(%`-P||Ax$Chl4QPWUkYZXldSy2I73Iv;pZ=QZ|wwCmW=xO{nyIewV`^1O<7vQ2)cDa40*sX2oxsD$6k#wznVR5sj0+PS=4D zK0d+*(ta~@Dj9jFx?(P`3h$<{1$$bjPmVs`aq#H4`KdRO8m*?hPVf5mC5Hx=8fqqy z>ZMs(fL_FDjt91Y8z%M?%naa7=x;a|hYFk}kRZ8aS`Qg9AnL=^VDs%}kBdI@B>ClH zVq%KtHr?-}G-rbCt|$-4RY81UE!KJEp{<2U!sbL)qt{ImvME$H z<`XQ72#it;_mSv?)d6ZSp%qX({`1F=vhxikBRk4Scj7XJauw7y6r%!Ick%Pp=G;@* zv13{;D?im#v49ER9my;I>esJva2mcX=ZK>+)F~SlJY(bFkYxPkWr(RaQ4yTcS*#v~ za-dq0WvdqUHX=Kc!WX2DciIC3Gwhg&_DNmWM;PNCvuRt)mJFZrC*c@!&~tmJmw-v* zA7M4H#MTL4IUmbGDw&s87M)-V>S3{~q?0EL@t}0zWT_rwo~9%xKU^7(mn$|BcH2&3 zdw0yst5E3?iF%m~kBTZBGQsqgt&o{3F@h3{0-8y~slsKzQTSTw7n*q_w8jPog-o$h zLp;FTD#93_`G7TMW}7$PR67Rn!3+n+e+3W>h6syXws(nPtgNYr$o43j-fl|u$X|Ev z`+DmnXB|>ox7%uzw^-FPp|>uug7~2WXy$J(2-2hxPpB}lYXavRj@E^X8^xy-IKx7T z72-h(GA26##b%=7rd|==6hsh4o0+fX1g`@A5r$H^V{1ow2U`&yr1watzOZZBHndxI~riJ*$WQY_BYzmJE zmi7_b<`{q%3T)oIzp=QXQ_PMVOg2d3#U zOzuQzZ2H(7_Jgww;gVEp(;`;yf3yIZG14Zt&$R0Rtd9A-;sc}{(q&nri#w97hm(VY z4q?&g(i&D)PeU2!cJLqziEyCf?a49YS$kS}1GITs47z>J0X@sk3D7`mei+`~VwQ{;rlCM0)J*&Lg&-C|C-eUy;pNS%Tt_PryDlZZ8dydE6UAtKQ zJJ2@Op;oXTJDJ~36ev@ z_Ory7ST-HJOnQDHJ)q|PN!HG{n0)IJBn z3+^YO4OZSdpZ=x!Opg;7hdKF$9n zUa~C&5G{2myuy+gCU$rizQ#|WZtzKOrjLv@@W^o|6nlMWM^L+d063C92 z^h>+(`aYAFQEgIsQc*;OC2jxn-AJlh&M@*jKow~TpWF6rw6wJ`Cxwo~A3wxQ=|`jvRDcO2pt3e*O6+gbXI)QxLS1 zeY6bBZ)|9ecPspq84HAle>c1B&}O=>_@#1vLi}e7cII}A+6+9wg+_i}^RoLse57`@ z9<3K0ro&PWGIqX5BhVkv4)QEo#$e5DYEaE@&!$?0JrB8vrx1<&w-Ke!zQol&g)fp} zALLqp4H?pk<_8&07lT00wk3TAi*lxjJNg~P!)e+|Z z9MvmUG(7~!q>@H%izbw>m&4MfOR@2Bc~f1cSdy82TmA_jE&KJAba%QUL)tLMI7msZ5-L6#yKVJc*MIoVK3&?i;&Y_ z$9i~X?mKUu8F+kTmcD@n5Aw$7_w?)U-~Phw8(sIihRj_bXX|!j+T+q@MoM>T98mX5^(~|S{5&JS-3`{u zd%wK8##W)R`&;K5w>Q1FR*%WlLP*BXj9WWNyn>tP>Q?(Jw7k4wTn9i>rgdCVOIdQT ztF_9GD-HwdzThtF(Enfl!-GKs@yUmn(X)Wcw@Bn?XP98&mfQX&y-PMYoYk|CISd-( zqc2aF$2Aovb?apmEHRm8K~JnB@uW0y?x3Q=XxW@@>=uMoyR|&_^d(GmcBK~HF8a>W z;y_3B`Sm9mr0JzIF^Oa_+S-2X*~>x3mqL;vE_^sM7kq=6^PEgWy~>$b2888%n$^xJ zXs@CI0!nme1$mZ5)bkenY8rSDoz*hB^klU<3i=<^5V9B&^eltKl)K#G$IO9=aTNhy zwxqh|)J~j3gGP30Q3*e^jvRrq4!C7f)EQY*Hp*qP6cJe(0w~^cDD*^72OMVr=@fqp zK7|Us6CqbxbKDWxDG$lJ5cs43%>pM+TxZdTQuY=xZ`38 z3%@Q`iDC4k?(WmL9m1>=32LiP4A>RrKdaT5)_%! zSs#EPJX=QcVDQA9S{|58*u(Mhq^45a%9Iy%m$=Te6oFtd6IC3=a-*f-Ey4skui{&! zl;AMD7JN#f`6-LYSQ|CE3Xcq@De@!Y%NTMls<-8g0?E2VQQgt2>+FKhcPg{v6ROLm z;=Rr9zLY~MoE)!C8h;c&;!cjwW9q~o^P2XuHh59L--AIcbZs|%zyfRhFWuZ&H6#A$ zGU`Mb2tfY8B=v1n8MsWtIN~I&W@imfMRG2NJdjh+cI+)74Ue4>n*R0K)K`soXIqwxK0*qStbp+gXKKNPGmfr6IjMJqZbU?pV3<7_0!TZ_KyA}{1M4l z)O<8yg69(`MvsovE5N>mw*>me8-}G(lP6DBU=7iD5lLXy2jvcG9cY(1t~AP(;)cro z9?M!1kcTs`n#ZzRa#Anu^O+^ie_&^V+`aOuFs+r1u2ddV5$985VDl!v;fzy=|CEqB zM&h5W9tAI(^s?3h<}C-_cb&Mss|(La)}wLbN$D)U zLE5RszmpjA-x6f{g|MWIyEicmj?g~~n(jqsk|ItFiw3rz>y^?VCi5vmxQ}yeen8ku zQ32k6U9#CoA)W0&A~K@PH%SN#60f#XaQXZKs3zLiG2KE5Q7V_iQrnQ4-IZz-5MziX zRFAD?il;A$RRl3bq{Ljob5O}VPNU-w{AYI*aL)x3>0SVI3;Hr4N|;cSFXa1Euk(Vn z0u~(au&Z_LWt$e~$98Q=U}T9FD!6kRYM+lx9RdNT-nqQ8@=j5xHVY!46TUaQZGI|W zj}=11-H**!F0@U3-CK7gUb5Roupi)nB}qe>^p@dG(XJ8(aIVLULO_M|k;(c3GeMO6 z;Xs1|*|dYGGal%JkF#x`)+ULJ$|6UQ4S--p8c(qH-Op%jtQY>~v(k^!xZ3T)!BXZo zQBuNSRU8c;3-lomXy1F`Faqz~|M z+z&XvkX{^}cX*r>Xh~aV{QUhJ%S61d8?j)uivrVNn*0(US@$!UeiULFJ`5(*gY80E zPcd1ac%<=*h;eIvsJ9zFJ(DfJt;7M|txdh*L=97N~}Q=OPinxt~0Ex}Nn9Jj}I9 z1@{t29x=m8h2V+wrwo$J-O>mt10z|~%rXx^!Kr}ZT1fO(%0?L(BQB?Ju-QkChu?{a z8WIM*!;lWt9x~({kRGZ4KHHEXp>e<5v13)aI^Oo<+wm;PI85V(r~&X3mLG>|ccL?D zg2hD(0q7GL#wFU@r!CXxF#^}^=(r$QVXa47_)kvLqA>HORBDW692c1wb? zkB{#0>mSnU$MN%rCl21HGkkK)hq$?Wrwtw-_aTFyd2+}SEebtco`yH*ZQY6Qq_$w? zC~q$0b}yUhx|kN_7!(ID2sm7v<=JfcoR6M=HXc6x*j!bmtH+PL@3bA}{^>?p3cn%j zAFY2$-k$3``Hxz!Ts>+c`~WWNzsYxOIk(=OxsV2)W2#;}F=8itKle3F3<6R`?k5Yy z0jG^z&+9AbbNUa?Sm9NnmiF_3vUXJ8N$*NFqumyDvNT9A^rBYB99=3gw3Th!=AO>J zLicY=#oyR(a|_?B-MnppH2rPIn#Scq0`tCw_T4j*_<(el*T?IIPQ!4*MK*_X(d2v) z&c8iqTHdPT(53Nq&g(lhZzM`&ToWz!YGde~bVq)|2_3~?U z1{bQR>0)fm1(6b(GyWhsxdjq`(OO_mOTFKV9wCxxAx&iF0aOKfC8|={Ix7zCv~Bcg zcme~aB0>4d;5vm(0d<80O^$IkyvTnRam;PNB8qXYc5bSKBn5Rt`TV(Zhid)0v-S}z z#IgffKOsyY{x$_(t9)dyov2G0)7b(0*n>_ewhp2TBL2(5J0?2CHHTKmBU(E6Xh^$^ z5A}jnEu%~1x*ueG=KL=L<~ZlAX;Ps4`-!XqO;8SLTSnyMaS#}Hk|p!Ld>L}rTZ%gC zIq3&)5>Q5kCPDn%ooD_ zie(SPgRrM$RDuE8^$GM~y+Dh5YfH3V_5x+yrF!U``2#ClWa`*M4#F~D})0ae%fK$essEvP} zz9ictM}Q9nNwQKj&v;EKnH4$+`3H4fV!m(cTl$N>&9eGzgz`SN&8 zP4mHLq5`WIH2aDF^<|A$-N!DdQE0iLq&y(KIO&P<@4P!Z@&k*H94I|G@N#f^vFW}B z&`w2Z#ot55SocX#4B4`-&!&%a4yPB|8fn(Pu=_mcY1|FdK2E)qHjeliP(KR24PBeN zTnQY7H^ds%>_0w01swYldKIx_UTNv}vy0ik80lkE@?b;Y@k#%%Dj;xa$s9Y=5cW)j zcGNI+tj<5IHhW>zw^M3oLoJQHVvRyy4enKwOg_X6WElbmTHx39NBzh$2>ZAKoa;~& z7!XBJ>7zRf!tK&TmH4K;YPLx^i}3{HTsO#tRsZ(jX)P(bJ8vvaf<2S?z}vg?t4Iyd zG9B2&P*;XU`muI!5EIyVw()@Xm`#19lH7? zQ^!})*)*h>Ohx4^(|Y~1&YXjmG#Xz6AQXKt3LflQlqS(S?Zn(0-lhX+?n=-{?JZ{O zynLD9g;jAP0gwQ=_LRY`-tobR7#w{voSJ0`?= z5bsgQ)J49-n2JY7N1cP6n$4g`rWNZCJhU-=$0hvlc^J@7q$;@cBe$6>&_E$87)f2- zomztjNu{$Ad!`#}(o1idjz(dD^hRX4>BgIksQbDAq8}_?ADgcl&Nf}z(=au-E}1N@ zXxi(+)qCd@W}LmZyhmiZK&W2WV%bfG5@qN8oSvis zE`zCO@!i@Xov)-9(+1fPy+?;eZYP{<pkju35>u+1c5}88#%)h%4i5XS~{>Jf+UFD7)9sUj0gJnCJKYuiLh!?-l2lLPR!pQpVJf={$jO+jNAAZhV zba}sDwY{Zc!)GR4meg&#c5{C3TeM?AyN0gMcWH$tz$On;jW67A?vriDgMHoOqOD>C z5bcV(X;T$HU~IP;C-&XA*kE&Q*dEt$qgD*}$f1ePZ!Ku0AIx`+c5*DwEBHDl%)ZNh zzx#!@&sM!mYG4$&KiLXex9*wcW_>z+;+3uAcz&g=RfSFscJ11zzHIcHP8~GtH1`df zIIy2(%I5t_HnU&Z)Gnt$l- zYMVa#{PPNRuReF>aks8jP5-=OM0E6tYu`J3HdKrD>hyVG)u8=;dGW6fX?)(?ywP9L z=wUU#jTyGCbVk4ejoStGZ__>?ChcyjW+cD+1ls* z1oKsA3O?<~e7XMBp3Cj+uYE1}GRAS~=tdWg-86M<)3Ni@w?jI#)s30ZV)4yhBZuv9 zf3R(J(2SB#?=H79R7opbT6}talO|35SGqoWz0Rn#4aphYGAraw{Z&Id&YpO3+KF-F zDqigUl6q^CcIoH$dxwQjT=}5Oml2My5^PJy?RvCsTAP zQqPa>c->g(dV7`JE*&3S`f_La^KYKd2aMIcy>(%&fo9y+uMK>gc^|HqRf^t>u*9 zH1qovDGsYL8dO$SD33ksbLL>P*H_vf>^oYk+r%etlm|TNR@-@IrFB4gw{9V~+-Gg{ z3%nPYH}mz+uT}aXh9@dpRn81ZMI_s_W$2z{y=mJw_f=>UQFP2MXW;ugHTqXmkKVr0 zd|qjH^)=~U_GS*pSJi|ogvT^CD4v#6(&3++@r!4VKQqa;c=M-2Gd^#A_ucU}Hx_6R zwWc!u&6Vjd*S#Q0XjX&`ceA$Z(08=`?LYOK2Ag@iWG8BL-Rx)lzUgXnQ;oU$2gY4n zv_E9ws`95TRIg|DSoY!NmWL(xbO{VFr_mRp5c5U10p1oFd?DMam{j>u9R^H?^?(^|9)w+P< zwWiSqt-bYqUFO&pPQ+qsX0g_Ix67tSKH6u^j8yz9I^3zp&S3q&ZvMV-S*u^S?v6W; zx^>nFc~R`&U+Lt|trg+n|0F&3>p!v8d;{Hf-H0x04VwiOJqXnsIxI4BMgGk7*MG)@ z{wRvI{Pb;X=g5-yF#D{($K}=2KInAzO0!izD^J+#wsW(x>o>FN%iq^*I=)x*NE~)X zZI=dV30gJU>d|IeDh#$+B$jL*2PS3zO1AG>zo^+N?At>42{-eUE(S)vuMb%tZymYI zCV5BryDREYp6%EW zW8dWEIh9Yx?>lI@KXuvO+U=G^g5_^-25e7#rBSk(Dm3-N)YTa`$N!G3nX+tq_f{>P z6xY+0KI_x6)x^mgrj2}C<=B;dx$WBPL|e_bb*%sW^!vkpsgK+Cp5lI=K2kI(cMP9J z<%mE%@U)p%1;7J!^X50%TGhXqxG5)FqUmxJi4yvP*9aJVgI0jw$i6jG2er%13N$J7 zI*rz?xbTH@|9#^kuYFy$yZ&P5UV{egIP;|0%eAeiUU*gFW|`VjXT#W#?(vHTO}|n2 zqFF%d;pF9$e|{;YTXE>oy0PahgVs!5GF|u6v*L}-XHYBZ>K{Flx~yPFuNBwcT`@O} znq+?A(#!R4Pk(M!z}2+bs@709c$xCcH8-XC3k*EazM}%B zj*T_@a%&JmW(YGVBr+`Go80louNtD+p;qm!sYy97*~&`xCNUUv>*++arJ!_Xus|0& z1|AH5P--K$p=A7{-J@}NI-H{be%88!xu5uq_omA)7*c)yUr2xr4Cvj&uN`dW8Gh}W z#`VuUYyN@^t0L5zfrbwyt&laeoky*oTk`2ryN~(H2Mmn=TzYt~ zXDjROKD==K?{6og0a&Q?)wK4`jp`$vE{Um5CkCgqCMjGUBZwEQUV!I*Alq5W9jC=?Vo*lM zpfi-gIR}#0MY3P?KHDJR$u(&sAH)B;rnm!t)YbrC3{-RAU0I&u!U@r z78vrzN9ciRw22;&S5IFd8~wMREyGpzvS>AEI&yR>UufxqCg^4y0M%!s?> zjMGQh)bK~2yQYtC9$>sVs;FMs6t@?3Wh{Yg*Ck8V6+AImIkck;5zvvl1W$#I_yy-5 zcaix}xZFTktpg(e#1dyGov0J|Dbw$4ELIQ@IU&E0;LfA(%**|VLD5H=d-pM<9`% z=GB6^hI0<38RM%m?!zGd%yw;M{lK)f-xR%*pJ%16J^f(g6#WJ*4gQM1KkLY+MCZ7W z+Lp^azPXqrQsxi$Qov07-oLCJd}XpFD|Ydjk*PuFv)CqKHAS=l^||sP1iSDh!;oAH;cIvix_^>dNq++P>=}-~B5;A4Y%5QguBS|@Lr4gFC{PzJM%pdC&`jvaPR&l*;L{aDR`9V(sp1L{zk5xoCzu-mNcZTgucOOe5BI+RC))aZ*|IT|L>Q>q5~>6U-0gwI+PLbY11AYvfk4= z^6#I8@M1iS|I6?7|JUQGQ=gDjSH8)L-GeyF`un~v{m@?lb)3I-Cg{vhO?1zC68hKt zRO`1l|ER#h0L$hU-@pWXbJdEOW+XqHxFW#{V5>#DA!{=bmJUoQ(4=7v*De}$$K2f?@U&0? zVGQKHs*o9Ys(XQ$ch&lLb95Jk$zdt!Awn}J4SSuc*C<&rS;UYyu zT_@5nN#fYegHi92;twz#GqLt(D~w>5(dPb-fMvk(2=i1R>=kg*v@y#;i!zZT6S1z%=RZd}Pk22;WJ^$E_mvX& z2kpHGV1S-XRAaOJDP{Y?%&?0BB=+z?@o^Ey7*5=9njN%r;r~UpX`P`Vr$jIjcfq89 z4XxIs8SSUIYs#@?tmFqS z5sK1^5>*%DvmwRS$RZ>N$Y;R(lFtCuF24oON+yY=GfXH#lOy0?2E;kt6)40u@mv%{ z@(#s^9BOc5Z-3By*#1y7bTPK3<8mfCMB z%brY}o5q>tcejhZi6tYQ#L+|^KG?CNN3%Oy4H6AAdYkU)W2lJR1RttOf>u7xmD(H(kW2yXji^^|wegFc2SpYQC_Ic{3=7n#bb-Oo+E{IFUyw zuZV7(0#zUC|)Xg6e>feyHWv?iq;&xgrj zDom8FJlu^aN#INlaU^k$A=aUi5T*%D^8&AgT7G329Eas-Lc5(fEye_d++~z~2$*>8szkrEEipuf1+xkfZCdDlZ{! z)vG6epV+27t6tNlyIR*fHodh(*G|6|cS-4TJ)X5nS#A5BT}g;Jp|S z5Dx!wD<&o|B;?YC3-t{QB>X{=ya+RDLjpz4e++X>G_u{gb;Fc$6KkpPJH!idgluNz zq*zewKqu`E8M_5AaF)t#Bt?Tji+7&K^*ZoambR$s=Gu!rTOGGa%T z+e_lqGcA>s_WkZKv+kfcL!=*!^5LnIPH1zwoZ%2K6Lbjz~#D(p!z5Qs` zh48l+GX96xpr8S70-BZi1#sXDi!%y|iHV{Kmi6(`pTm-FY#Kt^7+dvadsR%7Nyz2C z7sH>9JpkY>N3O>p)tG$u1=rq{@OIY}kV=kNy?gZFLGxRUc1&`i@h<`#o*qwM<_eHx zidm{g*Gn-m-V3zGG(>d4Kr#v`D<>ByL3V^|FIv>exjL^0nudG%Hf)KyvMqgOxTQst zMy?H9?@rDy|NUpzlwMmW^k7d|tXYqUBTOaSHXCwYr-^s+=9fDfiE$lz3BKnM8DiN! zvHKAwA{&%+X7>XFwT6fPPkUz`)${)S`wS-`6*`2Jxj4p5kt9QA3Y8K$W~DSJp@Cz{ z*okAFQk*E&F;qgT6EcOQqL3t^)1+C`eeBNn-u1g{-TT-5=dQc%S>Nw>^*vPY&-?v; z?fu-({oK#JEnkf4e^xgM_p-G;*GV}qFVC4+{hbG)hX=Zdtw~6RgJV8*=-RE@2_))( zy?i9;pPAAQh=@?7%H|pYdopd2UH5sktbomKY^W-)sBljBsq>m41E($tnzs0|jM1n3 z*fpi7>e;h7-ro zwkC);gm8Ok-{4!i1LA*6RQ=W5JhIh4{__V;{&PDsgKWjNs~ubQ*7ecj$9pr6g@oX| zWZo_17VkZKrZId_-Zo)ETXozoMcaeWP5*TFg2KX!ENe|qx9Hln>rLon$>9n(9?${V ziLHoC`+`SaIU8!J0^>gj)&_)%;Rvze@0^kVSM6%2pY#D7UyF)9NBGqLf*AmnE0a?t zHJ+JKVm~u#RORv1xyTFY_eP4=>CjQ7+JKI7h17B3K>Jz|$g zICQ9;=5rOm9e(Hg40&+m@;#4M;M*jQEQPnRSqcsam{5zHcKo+kw6Zx)$9V-8nCFpp znyaj?m6?5Hony}w9iML^$`l)R``EapnXg#2>Z3~xc=!V6gK*pY#fum5=)HF!ST{60 zL&dN*E5bT*Mz^;^|9X#hoQ{NS^bQTbwO70DLo1nC=U@(Fa)|bzil$b(?rnC8Y|N*z zHe1SQnl`e$oUrViW^U;W!WXm-a0U?Rob~vv*fZZiAllS0ziEx*^*wE;J~L2ngYB2Z z_n4Ryw~KD=lQ_WZt3D-R=}Y&Xl9!4$ToIg-1c0rV zqBop-J{9X-PI>I5yGdvT zryj6aPi#jS9i;o%?E28XfkPnyif-nreEar|oW|`NhU8Udvd(TP8iS;i-qdi00anBP zyaf-xN=r+5_bwUtgr{Vl1o{NV4i1P!Skv{`&!=uV!|azXU(VUqN-N;v#hu{Ku*;5c zI^$|S9p+#Rj;nJC8y6Dtv8<+~ww~I}`JG!vDYs@QBVS_;41gVDWx^0id18K9_lg{! z%(cO#P*hh*w03rOH+tkh=(he7v3Dg?0@kMNEjU2~RN{HCQGI`|GkC<)Ve9_879cXx z+DneXqPSyYtgv~HQGchAyyy+Mp8=XGWwH*itOlFS z52sz9HB*`E_LqC1HK|u}AM^YQ!Kshp8td0L-!|b@ev8N(H~wOdPfP^@b#K}Xh6`&Q z|F69gvCGiT7Vl5mVT0|AB$!f6t-z+Xyu94h%IXn2=;?!JW?FLsf_|vg*Jd~3EHRv7 zLpDn$<}9Ur5eYVcf_K^J_B-jTVcoZ10upN1<)%ji{eJY3=FR8WjPk7L$S(sE%5(>bZP3s$^Srza;ngOYn`5@WEu&y1tvqX^1fnm7 zPw`yYrLeG-2r%F`rDo#=VsjUh06%SI?w^V|3CBhme`Un}!PgBg=~k;L0u?kJ53;dK z21+s$yQ{1&x3jnJGHlt7qa!m3!|mF&<2lPJ>Ln4uMEdaX!4PN^74AUF3Q+TJ*VW4 zu25wu*QOD`_{Odv9?%7V4%}E-^zI21C$OP6ng^H`($E@5$5lu!fs_5dy%)_scZkL% zk?=;pufovq(ha`#r5C4M$TMC9h#wTG^r;Ef!=N6+itO#}NiwTQ48ZisM|>#LDKDVi zjETbBFtP)i8rM2H_R~;iCc!tmcs0Cee9qGF*jV;~dlH;(^tV0ubm{Iy?6ah3l*|Zx zVBU}h?#1BX-QZi(1lf#J5Nz69T^*Ud+|xrood-jh;TiPj2e#z zt&CIgOPVx)en-R&FHMf06$AV&ue{AB`ktSn=QL5dr_Lfp78g4nGm}yL9cq(A z(B1UKe!e*U>Bo;BmqJ2*y#47PEaX5jiYi0q_}sYvAZ{;p*~wF<8iTw%JCbZKg@=#- zwj#>*$UDd2=;)0v8hX1Hd3D?1?k?-2gPu*P+VpqMP%5y@I?wEu(OI)6P1;_WfAnal zf81+FyWcr%#tGmBH%Pg!W_wtE@jb$)Oo#8$IlGkBMpE5-p##$*ynl+9*+t&a#-Ln4 z_H71xa*Q&QG9oeW<6s{Au`x0-Qk)x;`VOrj-93ad?OgFjz6tN4Qtjee56Q`J&zWZV z-+zqbl@kLT%5bkqeGP0Z=?4c^=8I$k!HZ@^CMD_Qutx?9IBt2}+66SW3LUInp;)tck*ZD-HB%BYU{lvIpP@=d8zg4N$1rl zAD|<@(;qe&RG;S(qc}UNpwy$pW8Bm;e~tS1aP!#A)sE5KA~L!~YEzVD6*j!B*Rs+f z4Z6e}wD$3z{%cOj+m$U^1W?xgd39|J1v# zE8f@)&M@n2URC3{J$&{jErZM*PnSekWknd#vXA>`Q(7}o+8QLngs(wiw-L(9_ zx2t1W&2}*pg1u2aIV-EUYB&lKhcgSSv$qsHto^aDqUW4}Crl>$9)5+nii~0)=!uA$ zb_byXgt(5HQb5Q68FD9@GVbh9Kk3Yz;MwW|>ZK?LR5BV&jgY}fD~pb+KLEq72vI|m z=3%?hZ{z9NZ-SPMj2sucWJt#1jom>Yqe03fEK!GB=jH%bdglq%_R6Y5sKGiLRT>}}uN?&yv?m$M?kebuw z8hra7J&K-0Zt)brC*3P962K7yx6%ckP`(dYjUG!pARmtku#^DvGciV>V$M{Gx zFK@kQ5w4|m0Llw+H!>aP5+nZVxH-tLWPIWbcS0^yu;Vr1TQMt;LE7IEdPpu04_6`o zf+mE&pnOMnafMOc;Y2v09%*-Mj$QIg7WA!n`dk@g9Lbhcg6>V`N&sjhMvlb!DuzQW zD2sqy_q?%Am6qMLYkCmU>XAEMGN&hhMr#5-5w*o8Or-STYTk%*0({Jk;`CRqN^lF3 zDn$UImRGqMR#3upueG;N%q?|F9+^?XRv#m~0Vm(TUm{meK`SIKj|^m18fsg=7h}8T zPN}m;JCiy~WuX4$%fNTRn0c;72LqmypGw8FD=9bU=px4)GFvVR5FO!ip?n0I%oa1|V0sSVr zTe*MCpOZtteWABJ!^X88fG2miQC&~@RYXbl;aqZHwYi&{n`onC$Y9{2sQq*-*32v- z&~wiwQfSGixD*kQVbNY=*s_*|g@qiM76RIcoYFB^ea5X5uxa3uh+|ACohEzJ4SWDe z`;3_0szRG2oGa%>P9L@u+J=Ne~0sTwtu`pG%BVtT%@F5d{SMLA11Q8k|R4zme0a_=#} zHN?1j1#&)_UX|vHPzxl@h94Pmb_thp2&86}0S%eQmhLj4r-kY`1{q-8@)Nz+rb>&7k*n~RU(S{)iG2)c##0V=H~$PvA^Y#dF|i@LvDQZ{28q`>E-?#1 z#L;hE+Q!u+ulJx*l6WUZZrCDx5|ax;a;Eil$pe;)-HucmY>2TLXmxD|y!=)AXh7tq zqfMJ%93aHo;Ag6{~wjB3S>s7zfMBtR; zocLIn1qPdE&z>zzG)P5!s&WuT_0uA0D%7LJzS-VcwERBMp7A#Ua2Q zw2BJ}(Hhwzzp9qStFjwrpv}$Sv+IjC%AhO?Kk&IYJ5W-A6Zt1F$_SEnAwx!TGt~*4KuqVDTlpT8ZW=fl?^ew<5(l@OI4a0{a_?#$Lpe^!d4x|V8=)56e2u}dP}C9yA@ zJ^>%%cQ|BTSR#e`8(F~L6RP;}qRn~agxF(O}GxC8&yT;Fev4@Fn z7f&L8NEamL)1jHP$#Y>KE`)}*MX#-^j@5vWzz%C~qEjd(&HV+tN6nfj^V=t8aZ`BP zAY2gN*xQ$cgv^*d`#|NPj`HqP=-lL>K`#LSQd3h~#50M^G+{qF0B{HBfvKPHUF5~t z$1eG$L!F+D$v3sIP}E#v{~G%mcw&O#UvJh)eBm6^cBzqmjhskw%Ej*UJ-5i*>GXk` zDpLo|a=5ziMqFw^g~ovg%MY3gj$Qu=VY<0F*2WjPAOCiXV!r-)>c+r@D-7>V=n*h7 zjw!~%1iA!RPMmwbJ7KA>-T1NAKEoq2W^URvMwlV67zu*n@D1%vwk;J@F(Gne;B)_c zoI_d_8mK9$(aIq;0>LH+r?TYUghr2qCE@R5z69=*oOyyt`C$cB5ASZFeuQ(8Y1JpT z4S$ouR}ZRPJ?hk$-2KCEQZhvL%bFIiHfA?}kS{E=gfY>?$N|NfCOo#%nieW1e~_d| zbONs}P~2`DT0CuW%k9QZnu(lJ4{RG4WuLm(wnvDM4YYDdh)Ko91?D5a-5vA&b^9h4 z7fftFfJ0V6TnYG+ZS;ATaX-voMQYuwu9CSjHGb!b9`MYB8 zV|1CX5@$ujjr2hh3HDH9nPFgJ7uG_?xC<&wx{p?GL&qzbNSG|2P{6B?j}bZdO1kC1 z4okUYq5H(K!pLX5lsoBj9X`aupUMI@`eA)FlwF=1R!xrWF}Wy(BXO?n;G0`bb?=Ez z6)D+kZ1rC~nW(SXPrc3B44rF*{uLc^%4%2#@R?V)kD3yqYCNTI{V5g5ousv8Kkv&C zL6eMb8fWe6IEgw{e-HjUy6U~u+YEF6XJKJGZI!q}WQX(dEXycJ(;5YDWNt2fIKj@> zCiB1da!Y?deR>ve29XP_EGUzl%7Vd*QM#U=a+>efwrSDgw+THapg-FiSdzYIeY3yd z_1Hgp_|k-CDx)LZHf+Gy<atxn=2UPvCrQJ%vB*IOH1V zuU$KYk|apC4IMX*t%%77-~7-#?D97#uEnSJS!_G`n}(t7FBFUiSjF&7O~UfqoihL&cJzv-$aNOet>X8U~bub z+a>!>tzCL$jQgGqUPA80B30PPRw{G1b+FR+CLvpQ5w=@YZ)pF#5)t3zI&VU|%0RFnMNBJg%WU*yt(%XwW|O^SXQ8ZPU`zuYpe#GPAN^cJ_Sh zti&ydOlZTH1XHA<5^3=QPL?!)H{*g=qx?VDLAe!^!ui~I4@!N`bxA4gTKRO7~ zQ<^t#;>wkMksj%59=tU65w{VDx?sTq$U4k((tbIe6V zi$w_K@nC;NHm@;ON|X7U?=Ao8$8%L z3L$qDOb27}SL>Z1&b-}R5GMD}#=9nuxJ>j=IA+?}%lf z?%tz0cL?5)N}r_y!NCH|BStWqDpz`~^wk_qT`xfyQV-}Nc#b#METiH^>Kw5=x54#U zY7;yOhdO_pEI31Sf|vS7+_|Gk@wM{U;slOK&flQTZ=Fj#teI z?SdXZKqg^Sy-Qk9_6nMl;)wTB6fg)tPM`{r<)6>S77WDQNA!g;ANT%3=A@0@oG#>_ z)0=vrt7#3`Fj|kP0d{DSWvENXVse^L=q`+cR0uMhfKCR&*4og-X7ksJKvriaIv{~3 zpsEqio@G}jyAAQJo71bsTzR@O(2ocsNH2u_XHVJ;K~0C`1;euKlzdTHjzLjTN97Vp zdUV0>kI6rsNCRhj4>f(e)adHsLy@LCH6|Xcvc5#*z$tXzyhD|y>+J0QE_7#KY{UV5 z*Rf}Kk5KhQ8n^S`8W0s_@#G{lrhRSE*ROCZoq(0u#laB~k{uNY#-I)IHDU-*5#YqZ zPPS1rdAPiM^JcoGWoK@V6sBsh#$7gOQSx(m(Vx;;fy}`VDYAa@pP?wXu%V^%O_!R0 zye6oqSJ0$)j-z=Epg!P!7@kr}hQ8{T-@d^l1Axcc*C&H#e8s_`Invx}>nXy+E8$+bm%j4g)->+N@lUr>Rd@1cJuPhzMBnP`piIyhkm2L~V`>@HZ0zXkyg-i4qR%jKP9NEN*G z)ARr0AuJs_4Pb)cF+OM35>NqzhLiq&^cd8o2M?;CIbn(ko_n+DnHtaWqAC&GM?k4wy@=N z-)LXJ(Z^Na9|Gf%XOLZ^0t7eG8wF^HjuYH<5wy16tX`f94!SIzP9iR(0QV)^>#u>3xa-artR7Tzze zvd`{TeS24;)pVp4EZ?DOAy>c^(}+TDA`%c{|5kU$kM}%$Hr|HqRqm^kx~vjLJa@b5 zcpgUT>(>tvDa7DYaWJ#hjJoXW09sLe?r7any6Ky!*bpBRn`+~hK*+@GBsGF_s%?#; z)TZ`khGEjvN9ytBmX>1c_@U$v9iVt+>%so|R#;ec=9U>7C+r!#S1mqAVa}43kmfV! zPh@UrHSzQ`;FQiSrHRVDf*{jj!gpziKf(Xzi!S$i+?zf?Z_%AA>viv0c06&#(%azU zl>iN4QqWW>>YuXWpnzKx@r_~Ldp9p@{R=1u9eyYqj(;dr3# zOXWT=@V_fBli#;PV;N&G|No2s!<(S2b4y{OZ%2A-MDLK0vtI(0hF!Q6G9a#-^WRM> zlL6!s&g_P<)9l+m<94+iRHJAIY=pe48F5!x8G4wYQI8yfPhv*P;2 zix<-?L4*L4BW<%YXX+!LbXHb`ckb7}|JPquxAp5xWk=Wq{C=tU(Q)3c^8;w4&7VJs zo+5zAc1(4Z$2f_yCr)g#S)w_9z0de_eyAd4DG%SqU!l5etUjJJ)876U@WiK2pCUw? z78Dw~4+CZ6dCgM&Z5$+%E)|fnfBtvghh)ME$D)d$0zS~zVJz&%T;Rop!Z4tRyB=NSN`0%_z?annwB7CMsK8vy)~=wGog`z*kQQh zDUdEoYdlG?+`MKG>3kw82HHdng!AAi6&P}d__=&}5160qMfV~@>zaQdiHU|M)hZ7j z`XjRx*&0a+)Yt4qM#faiL^SVGzMh%H*9^{MWJ}4!_mJnv@2Ic%Q~TO39^rP1^~eC(7YzoJLw0!`nrL-VvW^w-UeOu zm(RuoLU){dUPZ^C%}%A3%_$-HG-ODTcX*$fqr*~g${JWvJ|S#4^gfw{eCtq)SkmD( zj{~eg)_$S4ggzM7bWKaVae)f%ZglP3wpu(g%&dlTebfSb1E~RaC6vVZ4dX9n6+T#Y zRjSIN8p2^IWN!3(YrBKUef|1jU~V@Btm9JFjQi~M=KXtF-dpN1PH@MFuDJS>-1t5H z`%e$uaw_@HcgwZ>S}~-9*!xwiTFfpcBe`WfALrZecyqwJVRL*4x!?bD(~Z8g1p%@-^X-RF^*;NVtVW>W6?u&@ItB5Cc)tCe3SZ3}vE z%s>S4szMZ^fdikwrJ0PJzI$TNhKdNEwX@kGxsP?I!V>@@M4kr{p;Tz!W+!e9n0u*E z#xPbvVSj-OVd}+|dG?goucz7Dhj#K6naEbrmV)?@_eCzxNKco|1eaXbJ2-GS=NMGc zJLA=)d6n?5LX}_x@h(j<=uc|v;|N_aQR4#t^&@O5vm1hzD1ov>HxR9+@ z_RX`|?_x28vqTa4(fzhCoKTmX&UK@*0+f#NaBtv;QV;nYGKxZvqRAb)qss0{w;OAJ{17E{j*~`Q_FU==i%{$x z=k!n$(*&8DI&oq;2Zy~vW>(2jQKLY)fLrQKnReg}rHCIfVg!@{ao<|uYpDl%fxnAc zmtOF-pa9Ddg{@dt(7NL(FQc^}Dr;i;n#H=z_{{2|_JMOoa^}f1{c)dYh@mvXzICHy zs6<{`1_Y>eL6EYD4j771Cb6J`-nQl=k}r;Zkrv3KugqhC{?(4#Wk#RT_IuOH>cN&46J4C>G_EiKIqF*R%# z4Y~gi9sD-tOXyV3hgt8k`tNS9$x|s^X*-dS;fE zNx)WVI5OrX`#w=%4G$UU9e0iwQr79BEn>7uMy^x85@}J!{LGpK21~?ho`|7SOGV4dJ!W~6{amh8C<0?}A zdT-f2iZYPTNY_rbKrLF-jdz9lYN~qv3PDjPkgp-lv?Jp#1nQEM$dV>JF@l1ECkQnB@; zfv?*JX9UW`N}dTeqL;i}C_#j|VZ(qler#>$4%L_(k>UEF%W8$)!}rNL4dmgZcjV#R zVqPn$K+%I<4h>x{LMGyDQBhNqY{S@h$G)BHsdyMaw9*4K2CPRhDL4CxDdRbZv3wVgQda8MSIzbH>xLRy7>$@>c4PPTKwaxqGJ?YECuf^w?l9}*P50vW$!u(t zkDa`*JwlZ&9-$#Kka(vnAH_+bNwAXRew%x{@95et3*SGC$yzsR&|wYUc*X$IHx78I z{?CT7FgKZ13V23x_*#hNo6wpvrNxaL6#u25Aki_}{!N4uZ#7yr*3`5`j0gP{5b`a+ z_4&hxJ=Bz_;4iry9P;m23>E#0_wVO$Jkj?KXwgZj<-C574TF3|h?6=*{E;d@F(7Dad zz-zAl#a}nvGOoJ#B#+UK!neIL#uymju5ra7jxG*iXGc=5ICLoRuU4Mwm7I~V6x*UX z)UCV@#6H>pH-5Aw;Kg9dY;klOx1Qu^UFN|>yWc*;+vM=aCj9bf(8cHMcXxKa8s+8a z7#=lu-~GUq7iw#3F$%HHj(PY*XaQMw!x_B@qYS)ZbWI{?o(mg+uehnoU>6~lJ~%1r z-vM*R1~13j?1`AeAo@M$(Iq`EhYaA=w?2$4#P5f}x#z(v?<%fJIhek-eqr}Fy=QOs zZ)LioQv~+yzVDr=Be*whVTan>bcO2(nTqGP%J+G7P&bjwISl08MeSWr-nh@+GSza9d1 z9uDDs-?uHTgfx7ap8f#bz|Nn53l~~nBx%G+G!k&NXwgG&~cmuo~ z1R%p~WOaeWZf+w9jr7bJYnnA<#@zo7Ztv7XUJEY90$7oj5%wr;eFIug9 zNR9=WPWaG<@{d}yb zo+=75L@Q-=s#0Ha8msfDd`cIM+_ru)FD2{|+w}?;S&c8vE^8=q|H`JIN6+%h)+QU+ zPBz)+Wte?W(~_EKfu-eq8=HX%SS?4lY`fC!L+N3{b^=7HfM5X_0c)PSaqb8N%p&Uri9C~l`! zdidnY&Hwf9plyiAI9J{b6^D*jr+G@l%BN}TH@T7aGy#Kf2YmlmUnmY!>Up>Q-oSv= z?%q=um>+S{_xx=p40q#3xlH{cM#rgLICnfS+TFAY&wg2kv2$Y=4840E{AG$6Q*zQC z&(8J>)Fre~j_?6!sTG?vEHeA!((_ggWAyGP#m9A?=zI7KAICR$MnuN^MT_=j6^e|% zX~$c}=TiVRFdM%PoNTJA9vRzIorKklY^pyL6LWmR`}_{oE=+%tRiD>1jEEgXG@5u2 z!Wjh@|NL_oqZ)(+N+4QRXn&|asqUl*=MHl0&(q~$U=n3NIGeg#rA;-Y>xw?oMo2P8 z=|B+RJj)URN&|}j)UV`Isy-*yJIIUyhn32^X{wgxp|Wv=_)0-fe0?^qY!?1r9J>n< z5ycm5$Ium+fP&vQ7x4|<<;&mkl_w09yq`Y1 z;+^ag^VBZ#aWalsaX#m=va$wt+IJ(}Wz(h;c`hgTzq5iow&iRR~jX8g9M{Of$a5mNj+VlA(1t@y^@ zwzklEHB@;M+l8Jzf1YYRGsA5YOOhWrKSiVA>g??Qs|HfJYqin4l2;v8)gJ$k`*D_@ zk>xz=s)vQ94WL!&awsUMcSQSUzWk_#_Jh2#^O+;rxK1-^f9~<{0v8qp8x)^A$G-+x z-!9wr>$L2un433WFP?O#S>2TQW~xQS6?WMM4M9q^?>8FVQi(r*eNQum0F7p?6ioMT zZK0t1psT*VX;|dC=&bG88csew=bSaG43)R~Oo>m}HrCKEnUAR2aQ|kmev$iw<_mg$ z_%LC1aO%_iGB4E@TN~rM>MLwr)>2bp!m#El|MjPu#5Yq=@BKkRVQ+gU1%>-c|4;t4 zS=oKR`rY#KYf;@gtZ$NcghH#ZnJ*i!cKQCKVtuVv+mepf*0(l{8T-R4ds4HdbBofe cYC2BJ_?-LOVU6wz{4;&ZoXO!6m;UzO0Iav^WdHyG literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/psexec-cmd.png b/windows/keep-secure/images/psexec-cmd.png new file mode 100644 index 0000000000000000000000000000000000000000..dd3504553125c4c6ea3c437809b9dccb1096f27f GIT binary patch literal 39672 zcmb@tV{|9M_63@WJ@Et++sQAsZQHhO+qR8~ZQHi(iTN`3-v4?Z-YDcCsK z8yEpSdX20;zjahirw1zrAa-8pOyQvW&gomtMI&+ew6;V z{)1UAf%dX|p_`{C!vD{l!Z7o}C2mEr@ejG-}Wv-oe4YEQle2 zNhF|1I`3P_F!@aK%d69h*Tg5lC#PR(e77uz^ySYV9K;rM88hfji>BF;zUTX@xzbXB zYDA}0Yhc0S9N=%_of%d%gWQ!@U~tdMHTU~ZCj(zGUI3n6MQLyKXw4Cnd@QP9R#6(&D*PgHhBT_2qtD8A4$`l7mcR z&n*$5V;Xp8viE}r7bs)s?mJ*qN8_`K@le<0P?JNSIqrrdfIB#N8TD*@6l<%4Nw_T< zZ()9GN>?>|_@~ei$+75rxinuvf!DAd^C`~F+Nxb$P)KbAd$|U?nMLJbWl~tnajSz( z&~IPeB9nExs3P$2Q@r^nl3O$i^ou7rzA za+9Mw3(vO;E&D-IPn{Xr*~Sb3Y=BLdH;&J106!vml~rCr6-K)p0k#vp+Xwe7DUQ;B z`lh6e1)*~U4snXEnX`Y;18BGFL3zwvss-Eggtz_vaSL6iur{@1lK6v$w0x8IEtc_i z$L)Xv>B^!Zp8=h`vNhqM8eu#Q=TR|Xe!WYLiwZ~HDpZFU1`)PZ0jZm@2i&~E-$EEb zTb*&X*QZ(KDia_XP52RKZ{`taz%f>-B*ODj`}07ii(hGNbaN1adR@lOwkFWOD8M8- zMpsZk&FYs%2o@v_Rl*GOT@Y=zs7n=?gd3Mv)uQ2^TN5s~UqQ`SK1Vcxx!I~+ByxsD zC>iR-c5@U(J8HyeX#8FM0W6+GQY6kwbc1(F67Lb=F=_7n`K&1;7)VXU7BTS%eMpCmFg9yap%RI7%k`*}qLF^6%W$wf6~ zG|$jz>u8)!5d|r>OD~O51Wzhf0kS4x;ijj2D34H1l3ip*^?P;fcsvD9ePE*e#^zcV z71G^SD9^B{K$U_&yDOAB1}YgiVm5lZ%hnX~e45^A)FILI0NIFD(>^lP+x9HMMEO_d zr#d4;+;)icxCk~RJ{B68RA4;whm(fA;W6HV#ezl1m?ld5I7te>PA?cI{}3z%$^)K6 zPqPO126ednT)c5;|Kj*r5JFSVCsl9NKlwuwk0sqh^94?LXJ)utd?```4?SZ1%0PAn zpNvT1nxIk9y#{}7`m&`B!R|5rO1Fbp(gkD_b6S-_<@ld-sd7~R>tS*)713(!N93WeoX% z{-RoKN->#Oa;~6?>(ix+sHuhPk&Dhj83@i5${I$^;PX-i556j6{nG%<#TrZ-00yl7 zhggXS60b#*Zmb}C6KqXA$Jo~!ZdboK`_CXoH#L&uuHmR6#K%ZWJz+jbiVBW_`_b!qq~tXAh&F8(1j`0N!CgR(eJ+a!tO zEyKx!S=D>9grp zD4yD|jm}HeS%(`|q%Jg_lU#iHmOHH7F1m?r5>IK3#j`1H)?d=qQM9{M z2W1zlqkg?KTdzmW7(WYfm#X82tYmI4n$Q^Sql0e$W_B@4RFmme;2s^OJneA4QJ9dZ zkdL@6nb-iD|5{x9wl=xCd^3c`3lp|Pt?&z!*l@kSh*RQ+A zuw!_`79}lrF?rnfnMW=CEJ>oO>rzT$tO+?k*?$!yUHH6IB(_%n9U5#u!2)NsKR|#x z`rY+H@BKdIM4*OYpoL2ce_c?dC}McYeVyr%a;WJug^;D|3&dESAmA;>$U+5f$UkM=rgJii_>1;s{uf!cbD<;=NUZEG=x`qTtCe+~v)T^4lwshI?+(*w| zAyv39M=;A8R)gz<$4iFLbN)Ae3Ju|av6{o6lBg2au_2eTSgfcX9GYafBx^_C-5h8{ka2X* z#`sdSef;gc@UwkpYwepUCd<5<#j5Ebk`v=4=U5na6laTj+~1Vy`h#&jB{@oY4>W?HSCy(kXXeJ}w2FPCfSx`vL4&f0U$R;OPocwuD? zS^K0M&&Y--iO?08ONc~&~)5NR{O4W?? z9_;DZsJ689^ug9W!8uGa!+8`VFt**pxpf{r5{=&3l&*;@X9!3FVy*V)zFn)r6w(&Y z2lgkGch4DC!ccWdGzRx9@Lj!5G==Ylc93f|qij^(?3WP4Pl()errB|9yAi58kpj0@ z`>DWyL-7`4@A-sQ4(m3@hEWuYe_*%&1OW*KQrW%~N>rEV6ls4pf)LiKq1jF!Q(%Mp z7Q$h6wK-VZndN%Dxii#~aFivo(%gyzhj-%m^9_x{lJOdHg}v$TMHqIWarNz0&{JzO zN+D1#Q7Tq@h-!0MH9IA6Zf@)}(e0nA9mne3`yoU|q&jVx@vZ&eIJUOeV;&tYFCna5ysT%%2-aSG*ck;%gyqkkLdr1)j1&;YKQZEsEs7}emq7k=u@V4}0yhj(7O z57BfF4_fS32H`HxecZ(K=^6~*($*A^OlO^^w0fHa>ta$cTbVR8r_bHlgF`@&QJUrY zA!WP96A@16F-3ek-2SB)*x1@Wh(As;|j%1g}%$Y4C*}m02 zVedpt^9+|2aMT)h49w1Vf1waQxK(R)4M?`76UyKgivRg28sq)v6e%%h^#>}EMIn$x zZ{kX{(@xgVzxMwaj|>;^cxmMx*lyyIHk=cIOeRsuxQn7flNF0MHK>~5mgT2r`+9~; zw)x_Tqrx%fF!3W-t&MA$}$S_{q%{6sO#WbqP0s_0n9xFGb=mumx827hL@yuw(tJ$|Zi z$}F(;dOC(qeq3(YMJ2>V4ERg5$V=TnJ?d$t?M(1zYxa&eN+>v9U+34d3u_p~aa>0s ziW-wWP$OGi8`~<-{+(Y=%ckX@o9y&>!nmx^JDWnat{(B_9W0)Ng?B<8sUl3lEHyhV zq~es~jMa4;8kC9wDU#FYR2|!bhXC&kj-2%`$d8vNmr(}jGM_>f&HM5`<5LP&yjMA%5;Fed9k@AL!%HyZ=2(? z)hUTYcy#2={KRs1H9!HC7DEh@mKp=*lYaF01N4LOSo7~s4FwdWYN#WerSp|BD?ku% zU1@>Km&%LInOCZ~<%Z`mRl*i%a=DUcs~kAXLw${H#JmGoczz&(X$`x1X|)*gJd`Ue z!C+0wIL`}Cqt8wE?VJSs)@#LA1kAj3rPg$vQ%i{KmPBuHQCnlw-GlK}OToP&l%~%m zHI3v)<`TM`h}N<4tNWN(OUJ+i9OHv?P3!J(q)unwlegwn_eVV~A+_cX?N_&pn#9^_ zlTqMR6Xf|8k-QX0)(6sN^s?O$LyTD?(oBj=ozIu@*#*0No>6sH*MK;4jE`5C?K%m# z2g|MQEBm~IjQ6ZHnVEjg;LyUl&v4p#SJY&@A3J%(TkmfcWpUZ`hDbN5NJpj_?ipS+ z@1W&vFWhELiT)*N#`v3+TLgc@LbrK%cMc(c3%#VAyujl;~ z(T!I`pW9cXju&;;9?NJT00Zr@<)X9!%)&9lSMgyhKk0ciNRzid6>F)^<7EB%0 zxS04qi17q9#xQ{L}r$ZShpSxAhkQ zA$=hL$+PpW8LFSxGx36Z#}a|qzEuA-uMXw=wlJwJ>0eA#3=$Rfn z-QOo3czVi#5|3D!Q899SXIKYFQ%tXv4<|E2NF)e*V4Lc^IucgH{W?1@L2u(3Ri_hp zm_dw=VYK_Z*u6WsUg3E|AYt;y=z5k5UB%|+alk9yEiE}736@>dgh%}nm<;fu`DyTx zIF~16O*_O!*OCU4V66|xMG+h9uWav-)a068xu;kqKu|v%!}{v!9D|qs*j;9OSYR%` zuG*O#C-e8c*)@h2;zP)l1trU8IYC6hXf5?6;uHsZaL4AC-!jchs3&4zt4jl2?HhVX z(M;Rn@WIY6C<^MLCVbzzUbyA?ykc4^V7og7+E0-1G+IZ1`$ei6I_}F)g4)}DL|}gm zFmO2zErt=a&OEf?l5k{UWau~s>pEhcbeWPOM4h9G(%Bs@85T2yKEQz=lWkykd;$Ft zgIKWXH$gDyAE_yd3}0DagQ92b952};urw3WUo0|J%<~w4EJ#gUkZeiCUtF4t0yClgjObJEm^1Z?=KT8wU}VH|1aV9OEmtkv+AUE$mpdmC!?uDY&$Aixu$}jSO-$O9ZLHyq&WI9tT*J3wa7X@ZLr(s! z*-6p%u&{9!+xd}t+AE=3>3Re}y_W_pvj#C2NWuN`Guy}7x+FVs@KfZ>oUGK-QI%zN zN{izWr`a2tG`7{=>-I-1Q$I=e%bxSnAI+f>3tdCU(5Ynb@^ec1WB$l(^nUE|JiG*P zwA0@>y>Xca&Rl#(>u9g)74+&83yjUWVXZCPt-RbByi~Y5s|gvYpQBis8utaEB<$e9 zrWLgY4eF+rRwT{tIUF$B&?lzb9RZVolV49x1|OrQty>|+d)lOd+7bxEI7&TZ^%Wq^g0oZb(RON%xrHo2*hf;$1kl$;#jF2br@YT8v_X)4q{`FqKBvjbA=7eZV^s} zz>tSEZccwfreRM!iS-@tN zzy51E&_YKo(3NrbUqBb2~WQkP^eL;wQ& zg~>!xf$=HY8`|gvhf7?a9=KKphZi|XMAGY$G4#}%BuynxlTNZGm9FW9p@t0))1nijqPkdd z{)u`pdR>WKk%Vd03=&!LoLt=A&?MNId-Lq7y43g%&7)Hiz~_S?;ff5?fTjD(<|`4I z3%uA`8kzEd99lg+Lu14U3DTdJ`$V6DXvX10qN8qnV%6p|l=vKv)MW|5d22WWFuS2D z#hEQkNkQ~Zg9Z{7!;)04NU?YvOLXyh$3kH8iCbX76Vk?EI%ZJ#4CG{al9|Z1NZI`5Wt66AND4VXkdc^+) zaOJXa^|zZtq@|>^=8r>AW9z>=z&1|#Kq00U?u4)7uFm4M;FMG+g&o0oQnuK~H-APoP#DS=URGIN zGuAP7`X87Ub~gUVkP|R<^LO}VjVx*igt59YDq4~aQ!>31dBnS*u)fBpphavPFfq1S zq1i$&MU@~jMRFSwpE@>155@L=PP4&HYwZGS;705mfl)8rd;Avxl2p`nv$E|Y5ZGFI zY3a6#x*lgtZgE3gsSH(WYWU4$%61xq&!(byA=c1rOH9~esFZp~#~DdUl2sg(WSe7n z(&($7T|N|SNeyN^F=d_Zgt3s|oV7D9N~K+$!MS2&?H#rvrc9;Gj6s7!eu7JtG+BH{ zTdfEC<+KAWf0R!{0~z%(s}lHe;S{ zdP*xDFLOjb7K|tgr&BwIFCNM*E3kInlp0|7!Zmc10(Ah(I>7q#2&d)*)}XvHe?fn! zGC;N`VEcOb@E%W%qE^i@Hm1I*Ntlz65R(1kP`S_rJfZL=fTY zelqu6N1L1wwb!t*AO$ZW^k)7`_lF#cEXpBa{}xMX#ky(ZvD;0LP%)7Iv+YSY8GimZ zVR0`E!!Adn1KKG~kRcsEIvPqqb~jXG$2W&ZE(BfYJ7qdxID>y2KM>#g6I-fJpO%mE z7;-rNXLDF6(nuX__>HM+m$J>b4Ph?c@w^~%TFfBLs>Nv;L;a&}SYd9zAtN3%bgN^g zV4JU@-OS?Va5UE&nVr_b^|ot_tvWd0fNq`cf&~Ifnj?YuD`CPf3@TS0#xA@G6OzYoJP&ic(j7mNNIn5W+AH9+b!9-lUSnIhTteD$|T@2 z*Z53=e8g}b2GstLa`c4BU_PV~lXxO|+>Z2@Ty0#QPT$(LBxjGfAPDI>A?C5$e%wSy z)d`XYOvFTjQ`N+Ykk>?*KH+0?wa*(1sUHcG(b>SYrtbm@@b3-UgtbvbVhfmb8L(tQ zR6>j=0|a4$n2hcd#>kk62b$p{24_kQi*pJ#dLO+6yOwr@(LaZ2AWx#uBEhNi^JAq3 zMU5kHQMla$pc1?d@Wj}Yh$t=SLI*`2Ad!R%qAl5@U{5B9Q*oCpD3XX0)>l#tYh?8o z@=)rD63Rjz>gBF(X6q1Z6IW);Ko2~FT`3|87xN6~V~z%q8inuqlO3hO-ht-@JzFRQVM!Q-JJI;!Mv3wZz5SqCK(nASR(IM5P4Gg zbNhGdrwqfTjOP;H|I|mgCx<1g7pvmfn3h(zPsU|^?InS-X?DE-ijZH(vI&1=WJQJS zsCnGzG5@Db>MYTA)-?TBZA?1Lk^cXb8~^`SGUxDsUM@_qL%yj@NGmba&dv-nWc`Wh z>AgErS?=@Pf8yuEbg`U0@FI4AXOjhr#5B0gkdQ8=aHLjz2;<3l~eJCA+rK{~Tu(iRlQClWdarFFif2!t8o`?szm=VN6~ z=%NGjWV~ilT+UK)f+RoV!;-6|7**87L<9_Rjr=joGdRpF%KNQ-RXL*!YvlFgM~E-pA2q4wX*WBG+2mb)(Eb+7w>C6lXZc(6h$tp@p3c%XCM9I?K^)LK$dkvfPn^ene zEC%%yLq!xuAkm|QiK+%k+XenF79e|Uh#6Ddi75Xz#HhHWs~{vf7@F~g=+^Ob_S2H7 z%CV72PCK74Av}%}C_e6}T06a>(oi2C@N-%TkUY1xDrTU?ghnnykS46mYf+V3P#+MS zP7$e}?n)2=Y${%UdSzbFM}P!Hio*q~N`ZM|YE#ry2P=gy4N!2s2nfQ1Jb@Et#Dt4( zV@{{|X3**Ff4V4ctw@PDFs<=tsW0EU1y)CV9IV41(XCc zL0Sfru5s6fU|O$3gmIov9KT4x>1Z!Yvp>C+lyzlOy&2a!r11>1%_2Tj512>8rG9U(_e?B8S!!jRTG`|hr5S|Chg%$hSDgQV{Z>ZVZDY+V z0>vcdZm-;EcvSc8Fv1F{4VKGP(5sWg!l2cQdY;d>k3Wi7x!!V2Oxlw)XZg#-jCY65 zGh46ntWOX;nwj(wKo1f_9C$n<-ab*1Iz3#kcIeRXMP{6GOnao%>E_x$fIu#pQk}q< znOL81Uor}bAl~3{iyDVS=`)6TGJ5x+2$Po_Zf+D7)`*~6InSR8S~}_PjUFPeJi^`E ze?-s-To%D(X4vajUmXq1Zl(?Z4@$-dy|ZWA9^Il6o0;KqjdpDTpzG3*3c#lq%(hs4 zej3cvc{p1aDQ1Lpk!-PhgxMZK>UfmHjG7C;iXdKq`z!oYYi~SxayUnKuT`!Oq?=IfGVJ% zAPD^!*-vX3SY`O73UBf(v~?lM&R}$is;I2IN7k5+97yV|OmiegN%HEPeQ=nfeX!D{ zS3Ut;)&p?hgKL-RoS>x5&SkvRXN&EbWgc@72^nQKY3a^1J~{ZcGA}1)rbHU@6E;Du ztA8*e1wF$qPC@Xu)8&1`vhG5tX{D0o*<~+2k!pI|mzWN5JP z*ZX_xO-YX@ypX3ygw&4SK?xSo6=pkKm7l1nN*COov2_c-RcN}VA2{j*6@Zg23phO- zLo*%H-z3byW4e2~ro<(qg`Kf~52EQDZ&gu#dktc0m{d&n)ovfkwjSsN78*N`B?&&p z`R-#Ph*wLhN$LFwC5OAB%|VCH$v%|3;aXoZSOdal1f64!iPwyvpdYiMiclPGmUm>QUJ_QvWg5A)pyq#-Vh zd%xSq2FDF#yR!s1)?w_g(mnUbKmQNtN-5zrc*D0#* zXJI1Ea4L;&er5Y&4Tah$B}x(`NFmLbDj>&8jz)$8{e6V@=cPy9+X}jtUA((~F8I}a zd!+M;wUwhLvi;1siOn=10RH>Xy{?st!~qK4gMljvn5FxTJ*DJt&hH}m9tN*8N{0tU zM#folGXf@;sPX!9tSE&wBw^{!kw^QVe?A_R-eWAdKv2|3Fl2nIQL=;u<08H_N|Yc$ z&M;FlAxbE+L4rHv>lq+|;&S-MORT~hN zO?iEZz`nov4DY4`eeF(v`m1$IUN>>4TU0)a|2{wk3G0w78x*c8$~fCY^7%Ld%fyY0 zn?cWuB}R)#pgtHSHW1Vo`z9SNJ`tpKAUB>`x#%H$mp1r3Tz$?b^l_|pI!4l-XymBW^sD;)XIT9OobN7S zSZ;pc8}R6C%?kc4_k*`cf71DYTF%7%EhJ+hfD6Zj)k;15jx{>i>$j*#J-G5XMn7eh)Nz3*2FFfFnXbX~ zAYZj{!QIz{Q1}APks_! zi)+NS_w{AYR=*&WhXrobD;^8YR{sLK=-)zQ9cEs}eT85h@H}J4%!?PDDrX}6_iAw1FMICAMns%LPO@1A{G>RT}4sfB^Dt>xq?AmfP&U~sMMFQsj_gK z!azQ~y>XgtkA$ULSgk3f&E9C%7phvZDrl#+gp3Y|xM7lNb*Q$#By)r^OwbAdxj9dK zJ%mnCOe-qRR#wDA0&Flf!cbheLA9*HjQ3cbxCF>wk{yvKs|-IOYWKGCE?|{1kP}CK z7Br>n3)?dTVzteSw)^iQ^XIwG%k@Mx?agDeKnt^t@muwWXH|Rn*R#$v5;WMT3dKO5 zw?F0hh6j&7Pdrg(+pxtp3A@{Nh`LySbcsmGymiAI8tPph z7)jRK>Q|5fk+O=LgZam3mD|6-)Ypx;0qpL#sNjVTxohtXAI}eP$}KtoUZ^^zhset8 zdLSRAeuMf5`!TxCjlKuVnj<1o$Ns%2|~O}jvBR6Dd{ zW5{vm3uo%I$VhE6gq!wTVFMHibMy)8@0fb;PWGqv0XJ>)ld?!hK% zu7!0;GQ-I%}veB3)I7H-(Ibjklg4LYmH1}i_z1fs~D9r!az3y2@xfm z)EV`oJE(Feh166Z@~JJ1j#0ZW#A$baoD?zr<* zlkdvMq6Wke$cH+po&gKaRz@a1l;Bx`z2+p>-aXHi5q$=AsB&{NHD<9CgTqyCln1z7 zK4|vzhE>=aVabk7q1nH+b7B%Zqr5$m4}JNS%FtvabGsPFCta*_6(8suT9c}!J{s7d zHQnEUBf40@_#`~O@VF-77C0QAJ-?}EvZXmp6t)2W&_pQuZp;D2#YsOxnOZ9eTBai7 z0Z*iob&={=;&htBX9th4P4^I&;S}b0wSQ#Bhj46Q)*nwohr{crPo`hHre|_Kq)0&^FuI+?++uK3X#KRO>e|}I z0#Iq&>Y#rsBMZX`0&BnLK~@hE$NMAJYv;#C*IhXyOYpobYSClhBgyP)wM;M6(Skz{V3@Q@rAR8CCQ9l*=Wf<`{tm;Y8KkeHun^CU_@T*~4m zBQF`N9%kVg>|hb3z!|DP`Wis1(n%!vB}z1Za0dv_mmL|f{o^reCNTqc-0HedWATIZ z6Eqa#XM_Z0%e$F)1w}0eoat!Y)hz}4X!a(WxZU@U$ zltu#8n}6Y*5dXRLUO0FH{2U_BI1Mgeb4H0+X)PcjtfZE7(amwB# zw&bOL!#%!CYg{)BA_b83H;Pt=UDAywPPc~g|F~x#&|8^p$g!`}LqJ`O&5P`Z^Lz&T z^RKU0ml4fRn9p7L`+E4}=4{=XdNW%}4&i3GJ)C`wKRJUL@+GPN_`Pi+Oq3rD?%x>! z53E6+p&TkScz?!4v9zKUbMWN~N-FcArCgKiO=!!*{zE5$BMtDph{=B1=ui?OzE>K^ zl_~PX;NgW4*vn<9^Z%1{6~Z8aN3dk3^Oa+Ib$MSC;b}rK&)6YWx!8Hrt`edt^y`*q zS7#$9Zz|MbHUt$!NE?fabJVmn=T7NQ9%7ozqKq1xTx1`g&1!IPtCVB3-%?qHsNFk{ z_ScEAUu8JIbWTc79$tr+vXuXb{AJVP*D`UMnO*hkze}}uBS7rj@_k&k&kJ9%U|;QY zfq-KMk;(47%xQ5M6?{uZ6b9#@^O7%uL~1%iV^?Q6vhfgDmRHceGS>{nfw<&lXV{~>KIPX>x=KGIki`_^K+VhNcXz}M zkHa?h=tncgB$j!OXxO8uJbbhDVQJQc=;+Qx*%FEm(<8}`0AYIr6N4}*}9;TXl(t` z=8&#x;RC@`UaAL5NnsT6bYa)i!7QSZ>$=~cN>^AYLi*1G5*L>X3{2c2`8R>f!SUJI zn>q*2HF2Zse+?Hb|0Sh-mf+Jr-?5lO>+Qo#U-ZO5A&VWxPJknwQwGifP^mlbpBfaj zib=2F5(Ea0N{jO+_!L}7AB=>N{OG`{qF&qVM+QdGSeCXc{!rw_iWRV|f79%xHs^Vb zV}b;~2`WStn;&Mi75FW^{MsET3vr#v;w9nR-d?}6F7i4mVH1Rfb(W@h+oMd0A_}_T zz3`8k#1zol94;`3$f0fT&kazRsmc5uvFm!C zfRB{pnU#dEl9TcDO48*Nlh)|nio-|BR$J;%Bi)J=%1X=5+hklfG8ACo2*!e%+9XY- z+#jK&owpc8l!3aBhAjY1hAgzod>%_NCE){@=#P&8nLUB%3vsN+WbfVNfkZN!rFAey ze~BTtKob->WvnpI0EIF>S{JOMA6)Uru2Dm{-X73F`Jfw2l7MGKO-#4XG~4Wt>>B)L zYeNpP$;SFyEpo29bdSAT;d9f@xky6q_JVdbOru7qSG_*^^(sQUH^QE#?Pt>U8FEoh z25@$Y4;_*e*`67ye6vs2m10tf(a6dUe&FxzAi-kv;rdToOIJGVde#UeuIf5*Kfz0=-yQ83> zpftO@D(rjys&~oZv(I$NKJHFa+j3G;QF3u=eA)tnvw;-w1<&P`M-j3oV-TLZ+?=%1 z+^`O$VSc|Ay6z@o2bsCQt%44V^8%yR*Px`wpDG`;RDJEOU-09*?N6bb_inh6KQ z8D~$A3llQrOb8zQjCqq7;Gccyytx-*baI+kJRjx{Uo^!GsE6%d7bHn8^o`s+FBt$Y z>);c_b%&Zg#+11;=_VmzMDaTQgXt-i0WW1royEEP5OR!MI5 z;h+jMszr=v)S?KW_&l-bZnuCW+vrK!&+U#G<&cj)q^t~XMw2MnRIark%ROo6au*>w)-zKE1m5 zj7f;6`u1V5?KetE>TQ#DFCrr9>9c$6EuSYX$t;~c9%c2{8WO9xAku`-r>sD zcT4AgZf6e>E@QaG4a^XUl@?o~_@=tQXiBV!PuAM8a%iOSR3t@IVBjM%rXJZB7TJ*4 zFnlC_VjBrxWq!pfe9)V(sguY5jofA(9!7>LKRYJ}RLkttzNoLZ7e(*JZ0$6%(8|qV zi3;Wq001QQ*@Imbo{sm>Lu+u3&sGx~?Bk~vACYjH`&rG~djSs3VejFceU8BdYwG4< z({Oc;Hi;6~RD;Lj4EA~_^9ZR?)riuY?fB~cya{YDCcpu^z1l z(Q=HaV)=9qhhvq>)*cyUxV#WVIK$7#hSn8<$-|08a&~WiH5r7G(y?L}1|(#D>~L9E z3674lC(6{N81^WsiwP(oM@2OzvQmwtivt?^#92dDx2KwnN#{ZK4;U$}Q*aJ2vppVR zew)@I#Ynhrx+Pm@?k}85P?<0ps;SeiRMyY6nQ=TOQFc5mktZjx&7Dqsc)Sontrijj zxMUbrCJ5is)v&*_B2i$C!7xLKl}C+X?g^}jI2%&U)&EU6D1azD{GV6BPj33`Q_)6JGxQ- z@Lt^>U0IAS`(%S(!{ip{MN>wfRnr2<-`gt=4L0UT9aP3*&$No_0>>B`rQa?~H62%$ zq5CIzyE9JyoB=^2d;egJ&i-5$LfZ}~L^G4#WTpM*0P0${c~Q}zu$_0h!mnU4V=DxW zy}7de%x-UFGe*%;em&|8(j;|bNBwlvKWPV~{pRvN#B7GtG{bpF7Tp0Sza*kM_?&(MYCvuX^p&8 z+0l>>97FVvr0rgxo%Q`RT^(l0#BUOO6@BtDJq0VcW$$|(wx?U5pOI7PpqK}9P<8BF zi=X<{-7I`m75U{DNVlwImdTm`KF&Ddgu2Q|&xtqOjM6_A1uYu^-zhPK3Y3!D?4u&d zT8b>rJJhsCeT!I<6X2ty%4xrGO}vW&4ezvnNQn{Fv5xfw&BI2Ep{w*MreCsBQqmO} zx42tHqVis8993|5-R#m!>tq!-*2Ph1U`%Z9cz$uV`U}(0ji22AhRbGc_53ljOKH=S zk#SUFVhwmQo0LWludHQt^qWs12~9~tSXJYTlm246&cTE9ziF4Af;dXej8tf}`H6KV zZu_hKMn!2qd9O0qkYZh({MOxUbt70J3OUl4Pq_xgjhyF`S})7Mvh7G6Db@?w3aP4bYicV{kL{p$fYWT1p5{}&6e0Hae_ zy&}q<)vF{Q)SRCly@W;~adBcKN-bk|v?5n6NxgHy*&`9stj|m)SRBk|cY)4goLsi? ziZXq9Jye=7n{k<#l(OseYu}!Y{{P|bE1Tlzx~>x}K@;2|xVw9BcXt~kxVwblgS)$X zfZ#5JySoqW&R`GMUG@Hnw`x9g&4=#O-KWpqXYIAtKEfoI4jr}uS+N*1r~cKhO2v?Z z4cr?O)JY$`^rAbmyGuX@g%!;p-Nu;M9-2HSt6-hq*T&QSt{gnS+Gb+tIb$5yts{|* zRVa!DzPhk4?6~pN>PAw>N9J>x)TXlF-yJe=j+sMu?aX8Smvkypuk17V@HxGe?8igw zysUj5%ge7)aI|rV03;?Q))rjq>KrajPpNHA=@HPvR!yhIq6Il7_OMZc0*jM5yAw9Q zMK}ZY*1NZ}h!kG;2nYIT03G4!`<%Da@aK_CSHnAuS;L}}WZp{)vkGS6h!L4)uATwy z8;Yt4F+P@24*UuvHE6P8G&nM4chZp?=Tt#~1N%-pyY9F;k?}M*mWPLV!-l{?IK+t2 z!izSUZ|n@Ar`1Jm3lrT@emkC1*N&vaP?%YKhn1Hq2HJs>RbrH-Of+}pVxqpQWX*9jOeyI{Y&MUCe^X@T=M|ke zEorPx3u)!eY{88t>XQ1|Q1AF4?B>Fyyj_>4iV%d24L^Y1FY*~{{~#^LkTQNOH?N@m z8M_%n`C;wQwPdk84^JyVvOLglr9z#=9AK zzGEOFW&--Je}23eC>2U}-kpZw*zbK@MGLsaJ#&crhi7?OGZzf>2I$j`I#S>Ya@k7gJ*)E zBgPo3zss9RS26s>QOIMX2AEWg(O2?&WFW~?B#+H3H9+TZPVR}MW|pJsW}5(5!%Wzf zhx$_wyFgPWKEBUk_h$qvY7^tm#4L5+y|<={>2ascppcNF&?l^hbdoPe(41xI81?v}q5^t_$+~9#$rl~0dU12tTRcg{O;UBG+U9l)T_d|KEKx*Z zv|0|V{bcDqXMn1-Nrf=h0VQsZ-rgI2sWkxIc>lm0K4iiAM|lgoH63E4A`&xeL&*I0 z&ry1(*Hc(X3063He2_*;T81HMGNkh1Z>)SRo|dtvUv^pEXDrp&2&UTh^ybNSrYJf7 z{?joG*#M56iqZcbAp9g7TSK=DeS|cS&Ebh3`y>8*mocJt+I7S>j#bx?sBwOgBOd+} z(x)m@I~r}El6LZ*ik=cORElsOk0!Uw0rw?DD`G$!k-o03bwI}G#~%~hyn$B zCVvbl+d!mlC3eQRI_oKHluY&{B|W?j4XK`;rFUwK))V=bl8>k<@bL62^e!R*4HYXT zIXqZ2GD;zVOKU2Q3RTD4%`r&}5LNWVlPt<|y$n+!do#xHMOx6(8$tLx%=SaCeS2R= zk4g`l{|i+rJl0n;q)AZB<>$?LQm;aI!YF=+`X<2$spWQ|YNyx~2CdY)gaIA-W4a z(wE7OhqRA8j}LAav|x$kFp7OmP@cVSmEKQeOmz~ldha<#edf8RhLnzGTOWJ#(X>j#1{hnJ@N-s~G4z^5sG ziS`jKV77BkHw|nhrA3l|zBafUWBZjzp~aKum6;sMe}@r%d@Y1VM(`x>fQ=cACjC{I zpiFu-xo`0b0RZV%mzFff9+Rwd4AaF`rcTJOpI(G^^xnBC?U6h5&zix^zD;&49cb7I zDMA#+Ouqm(0|@)}2BrWW2+yRVM2#x-o-=uGOa$kL4`7POb1zmI;pD)vTbwQcIQuw&=o2% zDO}Q>cw_Pjht4>Dq*^4y{&*-sp>lCv?~kh)K(m`T1L)U4wxC|r-X01lhEVS9(_&@e})pJ)7t0)hRf}zcys=*OUFJGJB2E)w|hJeBGbuurV zXyqp-mpYg`aX4`H41C{+wu436STN9VXUfrdxG~CLY|h7CPd*TQ0sy4DQiA_^8mE% zWHMjYuX>_;hEHfWBEyf-l9>wT55I-%moMz7$Yf!ul+8hVr2;ZLt?+cyOUo`zDHX_z zb{J{~%!bh9_q(@p%SU1avB{EDsh^%2_esT6VJkQAbgX2CtK}Rj{1Y1hSkkOJG!=!F zbFyZl0-dDj!wxuQrI`%g*;^nB;z1g!DO`HXWtdtul;OkNysC)(bXIzmDuL zko$LMJEo*l`f5SM!#*Kx^XQ4Cm0f=8TBvdas`Ofk;NE2I)A5nbul$(yNUf}<{8F?5F+J6~LwYQbjlwHyd}%E>0Q zDE`od_*^RE>|Bh7A`yQkREG0vd=kue31o5MLlt({tZP^SrNw291Qj3|(Lo7*%YjGAhY4Jsa!4rGGZlDTCl}SjkfkBkpynA=d;d;KyVy!v2Mz9H*)U-c} z0tegvYF#r1bn!taY4z~C60RkF-w{@m4@vA7J5r(wjziho)?;)Ud zHf9lQ>`^f2Duqs779>FL#g#3;aC^&Yc-&bGYRkWx{7C!@(e=20B3nYV7R#sEcfJ{` zmUbb0VO?KFd;wLYOf8=6fl92O4lfLauU)TtoxO*vs=h0VO;Z)8>W-S+YfLv9lT|Hz z@8c4ZK>TfT`S<ZPiRjhKXL$~bBcvH&me$vdV{g^8Okv&I_r69 zPA|Y<+<0ZF*W11mB$glcY6#)YqJaHFB4E%o*5KYXnbg2*068YH31?YIG&!AyH+X&K zN*&|1w7SSIYe%xsMjeQD-0<1;rR@FXB7q1eo}X)VQWO{KsA0eLbU-W`4jV>+HU`*F z(~jO0s+2)X2BM${-N3Gl{n8K>wlhyoH4NOZig9$XAXFiVS*CY98Ru#d!#DKyL-fkP zRArUjpia=UdyQ=Xho6{2%vF{}jS20^@`N(Nh!prHSx|%nQ-Jln;n6|~h zS$#dHS2pqMnR^RXJ9ZeCN?()r=+ zZYdc9jpMhC3)?OjrgLWJuu+DcSgO*PcN|0_uUtG2+p7d!Egzf@6LVfEM_W3uxB{Lo z{!}nk+E>iK^Bl^%^K7nnrV50FXxt-Z^L?n-#>*TGo~ zT4v!pBRW8|g!bp-%`0Pn7=Lx#Y*IcD2+v*6E9S!gLBM3fYo&bAn!UI$;#Qw$bg&7F zX0th%Gso1|tb70x+ep5yTTJ_5hgMX*HZgNXmnjJ0EO{1Ooq9+y@X89l*N>Ss&fJmo ze@J-&ZFcsyynXUAq>3Rt1#I^#J`($1Ew;OJOoR-&&8UI4eWyXbPCURwR#k4jb=*o#k~&SI zW;U=mp21S8w4dxsQ7F;ef`YLrur-+|k|u4wg~mi1e)&g&7S7&Gnd}&BZ_wroi3W|V z<0@RTgxwSuD(Su)+9c-RAEsQ~rDunrBGtHv(di1*>j#Y?vsw7MmOEte8@ya_YO7ab z6LQQEDk8CBzWY1B$zUMr_^sY zOjm-B(Fa=)Yb{Uz4YttXZE-$jTiPS%!v*cWF`%W4 ziPiCp#iLdjEt~e z0)a@w9Mw5KIp~WQCRR%zHg8^*V^=MGgYwZ=4*`P_nNbI=TdBIpVH1$ud;vAD93>lE z7L;Xa3w_pI&Y27iYpX`5! zc4Uxlu?WObD!pJq|B2)B%CW4xbByfWQPJJ)*&1TIjac#$Fp-i;X=z_P1ngvFd>_{r z?y3+~l+QB-MkE*QVrf?UvA@}Y3jL>S?4tIrzm^DjgmM}9N5o95n^3&xE(_5<*}z$^ zQyxdCj!E3wtg1y}!J~aOcWkgL7(p`;JTX}uP>JvPQ4t44k;QlUSL|n*k$X&p7PAa* z4atemsn0QPwof5qXkDky&k2jvPPh1PjCw{A<$FWh&>pr3PmeH7186or5SEd;(KTGe z*hTU^n?HOOF<09S_y8aLr=1>#RAk;Ual7(SI_f)*%cl{C<;bDvyZZb?j7Um! ziNHTWA&HX#%fh0jbn|a$Hs*xOm+Z2##u~}R&Az*=#IJi7Ps?e1h2(5*3AhEINP1z` zfBn5GVeKXZ`_#Qw3wb!msZnrqf3oZLJNO&xfuJ725USoodI^`h$R5i+O?Bb2#lWV* zL?GIiI&xu3&>?7-pu;0r-I{HZzXds-Pk^14HGXL6h6)h+>G_;d6OP1&Ri+d4+qL0U%Pk+ z*xQ7nM z;jh!fi_f!8*Ve-4&rJr&+N6pF_a>Y&w?+`A{{f4o$wfZ@879}s`)T7Bw3?7{$a9H- z$rhN&?Ft+|qRZ^m68ARc%8)TB)GXn4wo6iC6=wcUo;K{y8LpE&)UOE-lK@ahW=H{W zG|SNDP;v|P_RByc6WU_9;33Y=R#K?1feBAHx}dvefh(PX4Azbt9n61fYE#bi=W)o9 zMNIYD1VtDha(@=ZDT-@lM!euPX^~~=ktfR(L{vI>Gs|f9QEEWR!t7GcJn=6Vd7d-& zC5Lz=Yhr7M9}UM+@v{uaT3L7(go5V3m&19P;_`hHit<0_c4yqA(D|h4iP+ZIU^*Y5 zjN)*%yV}nNJH>u(K)gdY`4F#zW6Y!R>Gm+q z-{Ep=sMHH}%AiUmtmY5ppR??&aU4*=+@-KHJ-Bu#WA)Ytsu-FvPTOnJ=VKfDdu3jY z|J-J*Ye?}8wswNmu~ca^poL9_bLiw4g#~dbzfVbFv$KDsrr*i4rBUVOm|0Kq%ZsvL z%r%Osw8IY^6X$B3H|>sPZBi>UmTNJ#?^K%{)f?-*Wf3X0`{L7fAysXKb+A8s&wqh0 zBP4Mm6r6nl0dkyU^K6nde7D@8MDA$7FD>48wbZb}@1B7-Je= zTr;9C!C7tw&*z&{Tsd&dzq_i_@cdc4)Oux2Z=>k*r6tOBR;blXC=(ZU z864vxVZtcReY+`e>&F8}HH=(t%gP8t&68Br$=sqK$*H!O^89RubYI2IPrQhhnt z7ao6Ph|S;*RgO;ywM5QtN{PDCz)4f!W)|BUg`C=-P||tH(9y+_eTG7X_s_~W+@X*A zC#LO65!}scO#=<)K+!lb566y7)J%%g(fU!ne5skLou;d0=vux+U2|tT6qJ^uOHv@s zEn{VAQ`uWSJ2aTw;%$*?sW1SjRbGHl8w#v-4->y(Vh@^>#-rG)LnEsf9bPot-FGAL zV7wq#siiCp7qj8qBIJSK2lh=dJUgU@%`|pl$0pD+WkQmSQrqEpD^eDsvDRdOWmhD{ z$-B8rzs}Ed=j_B}LU9R+OnAyw^mg)MwJ0zq*H$xRdo3Ne-Dra}G=?oD_$e3>;> z@HUP)b;`3oT&F54Vc>&zsVAJ$@#v<&Dy8wC(IRf6#*Cd7r)IRGr9Soyz`Lb6d_Pz3UpNzUcqdNkx(PlD z??IswjTrTggG6q&)>M9AQ9q|^JZ0rr?T?h}`x~fg(Jj&6(=MU#a7voC4?D)`{zYGf z)cw^U4nW9@Yi^gh_i{xiCVu`OEEBW||9)@9_urL2Kv6_Akn6{vA3q{e)Xx8Zj|e{n z_d@#%Yape{c_E~+r@aLFUu;hs*XlBVm+)U;Rac<_4PsD|Y#85l+mgRz z%TJqfX0TA>9RcE9&bRr|#XofKAGy!$9>TFG&q0?2Zy;{Oa#-?YtW3!;_FKy)&VR6% zdlaed>v0ouAJrHZgK%Rm>B%@ZfkvT7ayx>CAs3V1>sQc~XR&7fON5^rg+O+)zRy!| z-|5C&lq3opC;HE%C@rMxgAk~XYgw`6?cbE*{SKNo=_?G>>-^nN7=itM`Stt}O0~;Q zmm(NA{$**=$jr?yxDqn?$dUwTuWEZ5A@)gIU&kzjzM&Vd*Rs|4=R>5fE7a6u(`T}f zFbejQrAoePINdJ7zE?`cwV+9VI}4GM?y+I&HD8FEG#Bc)08YzyB2 z3NI+{F&5434j8j34;8;}bBuTa^%NrGB{);QNcU_uCRpUWqs81WB%nmr{!M&z6KC0k+QT3xO@3w%ACQ1 z=VBSG_y=uhA1?cK1eM^%;^}ZrUZNOF$|T?HVU}QJ%iK%wD_*J9wjeQkT0SJI{c)@S zkP@O5z5mm~?`RmVKBUV#(yy@W?=<3&mlA;o) zK0%bmbZ)m>m{;_Otx7OR$OqTZDZRFc`Y?j~@`bp*NpLc2o9FtFB}4uLW7%wTla3ec z@Jmn*)p$J3teg0~3=pYV4AA*G|8qKnn${X1nvv4d=AIhkgVpI*TlIrPmbFeHbQmD^ z_GR)pWtbN|$u{F@X7N2%RDg)m9tmxv;_#Hnjo34-{8vaxG7(O9zv-LPa|FL5Byza zVLhYn@D&JI-Z}fjuWd(X8*OMo2iH!a!YkpZ6L0y) z{U5&>7OfL(FHF(%s8eJ}#}8pxUaZ4KG~r}MT~4Mg{*Oo`z&i}+F|FNY`c<^SC*#Pv3A6_Lx9C+!eTj}c*dQ|p$@t`Hu5m!0g z&nHmfAONN^vTW9FxNVaZMs&-kLLkF?JzJHgo4akLPSh|Z=MMY5`jPWlb9jr*D_jZ+ zuoX4Y)mBuZP3QSu>B|jmUt**s0rw~eOdCI9eWsN1g9`V<=qDX495Nk9BNTwBaqTuM zQ{8Euo+`ywco{zA3S)tlC9T#>d@B`GR2JO+FZAf!^x{cX?8(~9-Y1q0_^F-F$<9sY z%E&~VXUp;hHD5Uhcg_bTTi8;H{<+e{+$PqqZ4N%_yckHuF=H=Y4FzPWVbWBN-#Q=9 zA&b<7W@n?cGeVy`5vMKtO=NdU{BZ8#9OfR?UF!5k)X?q$|22jCnOA(EeBXfY@lf*? znd|*!^QDjMR6lk5@J`(CN-DlbVe*a4WqIEdTqD?D`^3`;xn+}^e5K&p-|6zv$Vw`< zZTnSmPkJKnVPg)!RTAdpUViHrPN&sN#ga>PMF2Rh30|o}6o<9i@gEcH1$!nM1vgsJ zwnmdZYpyc!irGEAHlMpNT!rTDN=E?r)%)c3FAQ>!COofkjw@z;l} z0xa1@C~>Khl`S{_MeGAf$$!o)ANlTh8u)neCCd@Wo@t<*ANQKq)}2i`pZ;=0)j|IL zb#Mr9gJY}C|Fp*TkJ~v&MA?c{Xdo{uE0M#-=sj9NPXk|~0M}ifi?8vYvd%tuYj$!< zowS}^X#8acFKrT+Zk8QcK4EI}+3Fxc7-Ij;wA#9)-=xPtIb47T1mYtZ;k~~)?L;xL zuCVO1>%2YP|qpll;)XV#&1b` zB$gPY(!X%FO6{KUX=?R^=Vh(_AMZ_NaK4(oXJp^1uH*6u&*RLZhf_h09;x)recvtb^V*q1`HLQ!(cgp+r}d^3`Lhn7jHyT$(DzL0t_=iw?w&>(S6@UEjGy zPwmcm#R;9ruC>sb^0*1w*AD5ZuAk$m?at9$n?5-`Nf>x&@r`eGDXs#&$;adeikaq4 z45403L||vnNR)48cSV-dp611>d+Jeo)xVd)Aj1O^{8TeLL0De8b?jD5G3zr#sk$II zDL8!mwl?D(?oIz)w5!OFVyvI`J-M@5IPC+9{t!-Siw|ntKU4eT;tu}7FaB>>?mM38 z3v2vsWq~tq;wr%eP6mI}QlHYa^F0a2*E=55c5600Lc#5E0)}s@UR)Z^59{~@<1*Yp zPFClAGQn(JfakBYB^4NNGdi~iB;sstVbUZ~^$RXtS<&$WDQUQJ*;VTGg^BAk0%ZnC zR$P+W=Ki7tysA5j9F$S%_{e1BS^pyj18@7t9euk_9q{1U%%KgP*v{M_r9$LL8EBy_e6r+H^Pb z)Wd_-09E^>yz$Z#gRA%~CA1mnrb*iTxK2*x}{S?!0vD2PzlmberQ7HVoHUqRJOpx-@~d2XY|2ItXe+S%qt zYQ;uVzAFWHH*+E(;51x72|W3f5{+f9yJnq*E+X5(=DtK>@;!nOaQb)VSUz{VjsIzc zjg>HHjY9tG)}O%IfKE%H9v5Xq=MeJ-_vaV&4j@jtCC#4qamv2fvEP7qTJ1A_KG`^Bw&0K`=v7rF9|Y zX2W2@xj7wNeh8W0Eku&uTzGs)Pgt;H zqm6vnYfJ-CqT~A4dji~0dJy@jl9s;$$d+$uW&Wq@2^oQx6O-+_E>Ck4c8)kDw*L0s zEs(wS(GaD-o=D*x+n&jkNDt7l5@7! zR><3{oCO%A|KHB?rv^RN8i*00><1T&TO^Qpta50!^MKIqCmBB z?{*0oIrhyEd>ZBFFt4Hw0GK%h{i_dO=W9J&ZVx=OMKOmf4nIIJVmD&OV>v|1Y4|z+ zHI!8AmBHrXFn8jj$77R)QK|kzJjW76D2_zfr7)%@ZJ~+jq|>LfSCm(T+f|czoX$J4 zt^tr1nZ{?vxg7%jF|hB>O&OLr(2mwV^m5@_ZzDdqyhq7|3zLian|kB7vH;z7{52|) zwE+X9u^PUaWbQ&c9I|1B5Y9{!iJ?vYAyXY&UM)y%Z%}JyShE0}Y0?6E^@uYI{1&m7 zEGL^(Q z^CMd>Pg;WC3^VcBCsCbqr$Lw((-gAn{y3qyVG6K{c3>5!BqIGT6N}B~@?ZV@cmC<~ ze$%?BeOgKA`S-9YrqCvAOjJW12|8Pgi)hA5mCyC#;VfMPQ+xb3=;#=F<2LJa;;Q<% z!IwzRJ>(J<2_hcRacSKpbZgh)KV&O-SKRCiDr(cmPB}hmbo|C^r@TI?0=li1mH*g$ zPxwo!k-nqQf1hu+S?fq@#QWyVrEop*fq)~>0;fgd#7&I>k>LIg3W!dCr4h2|FKB#k z-cni>+>A_;w2t?wf@PgZ5~04}n{5xt*zz7L$O_!Yxr`Um3=6X-*G zmx(E8xSgQ+6WJwM*IUDm5uf}pNfaT_xqQ~#b0m@>FDOkHz0mpFqs%BTe?!(kZ$!OT zr8!INB-gF`P(XYpm-^20okxCx=Rxj3(6_hq@blOBPt?m5#Wb%%>XjzQUadI?x1S-4 z2mF)o_KZ{OLco@GXq9{%MWComPzfg9L=A z=}n;z4fsHMmag`qnxxeWLQR)vbW38&3x9Cj4c!ODf`n7; zQ7Sc7Gg}tWoKwA_u%C&>X}3CZjF!Q6@fIJEHM_)k*vYCxY%h{_bfB?_13w5b_xMWJ z6+TF8IEi2idN?v zy|Hr`Otf!aj7yAfYGaeR+$`_1g;!&sFyYF)J>8UmLRuW+8O{9 zJ!XTIaeZ0#LxNQq=5}Nwy!QDlL?jQpNQoPhpofAE+$Z^dnZNC`b3lz3lDAVxZ}X6l zqt&_?vuV1uLRl+@b`TJ8j_J}DSj|J8K!Y(JD5)uxMhWcHbL)BXsCJwcnMKAJBsJrs zP7lc2s9G-EoxIL#;gn|UU=|RtNA`EyN^lnMx%5&##h^jt?*w~kREIEa^=S#hg=-<* zDChL2r_3w*M_kyll=U;_ zL>Zr{%R?qFBsJG=8DwC`JP2mplw7`j?)o+_jT!;E2*wbfzJkm;%af}259eF#spawm1!tE{RtjOiE70I^*eW_6PT8e9 zp|?NpcI_|S@p!%mecySA%zt}m+Ry5GawCa*`tK}@xn3`O2m5j0;G!+4ywoT0Z_+Pt z?b=U!;K#q{A3ayT4jY=fSNv~Y<SHrFx0?^=NcbJ z@o8p$-s&u`!?V9*Dp!#DD{u8vwMO;rXj}_p#t9LL!H3o2TyK8MrPO_FSB0XZ z4SFa8Og2=iw7T;w(-0xVt~?`3H1c<3Q#lFjG+E1>Ur6!uBprwWwP{ z1Kn1ruOyvw>}Jmu{@VsmEyQfmU4Ntcm}~~SxIwonFM01<&xps%H@$)*`MYv3=sB~{ z%EAv=Q-94l8qA)!!^KU8+alUKDz#dYljcE|=7|nIE!cVG3HoXZp2}EdQjv2Vo&0z$ zU}W~1@)B}gGBo&`?#>yYjD`U`#S`4L7Fv6YnntqG63Y(F7k_0w|69ZNF!d1veKIz~ z%Rd%@@yYA$kQHbC7Be>WH=NhL1a1jN@fJa}aKoC19P_>DsWmxKdDvx{cqR6yi*sn1 z8w=IUl;AWu9}}B$SGE^J|0lA{g_5Uwdx4($i+2j4HkL0M zk;}vIy?KvRHQ542)$Z0xH0jaR%{f|y)kkpYw!gDpj(psE7smR6W%v+YGoEKMlP*hQ7K_Z0x zGWu_Z#86pDS;-X{^C4~!9LLUd*4EWSOiT-2zj$Y;F~sS1BN(vH+D(kpFUU&Z0WynlZJ8p$eI?I4CdS;^VGH zELX6TMt0>uG06GWCvVI|%%rHnxQfytb2dZccils{Q|x-NL{}bCU2>Afqj8+KPIMj> z2Yyg=tUc#zy6D)<@rrIcc%hoKokCWGtSJ;Fca70w$E&Nk$b($z=~u;-)iD-37GVsO zXF;xngRhUTZdr``@7=M)edDnL{CFj7MD9)0>XE*_)ig=^SOhH?XMHM za7p4i0xsSTsFs#If@kZIKbkTPWf8w~X#Q#8f2Z;vi(40X**itD)?7r_|C*8CCv&2$t{S1O_j^%lyBS4W-FoR^jOaM> z2QfXPBNN*%11qkJ-6w{qL$}E28%fXi0T>GT49l8f5~WsPh)-xV;)TQM46}qV+q2=4 ztZ828kQ~$C8(07ijpmwmWy#x!iq6Tm-{P73?rqg&k~@)IaN^BZw`|BQ?Ywh@PjZs& z0z$2=EUO+q(kp44zx}-yhF!ohtcJ)lq@f7qt=;O6DPgla=9 zXutQ1W|oY8YU%+CUXONIn-%x4sEU#4DqKMbNLLR>o7^7^$H}q3%U}giubtRRDj?`! z7w$7voYlbn(bS4$ZxRq;|CSjeVfu)evHb92pn>HXK6Zb-5fja7LtDA>FAFmB=?N^a z=Jh92=#7r?o-tm(CH!iu;CV%C-`g z?n77i0pe&!Tvnph=ez$Yw(#%f<~()>5L(1FKItE2b}jX_VLEe zwzxJ}4u{Lk<@JBZO>2+f;SaS5j*0YAVrmL2B=EH$)R$d*Sy?V zPPqQ5s>O<$&CAs7K({|Etlmo2EkjOkY|4K<`wY)ZEx#yuLO$=4Y6|&e zfIM(OhJ9}-h9rEelJ7@cPq|zp$*)XTFWI(x1EWLsO9LK@o(BH!cr;b1gkSDwbu=T* zLt1?Ikrg)6{I`{9j2qwa?1=;v znZYW0Z2=w6jjBXb;c{+HFH6rzaJC31i#KB%C0cQWCGXe2Hux8V6VwNi2Nz;fawJ{V z1y*`({q8n+ZXstj)T!H#pyzOcE#Wd&sa_wk8&8s;M>HkXQBg&qKr|^USwsYoxKUcn1MXpe$Na_c2yoFM6b8 zeW}f+oUb@6GF=7BPJO25jq66|hU8HD^HYhET5bBuF@cN~@j;PhSKnf`|DP3`O=v^a zX*B{qF+;^a3t9No4?1#4W2SrF%%TY{Zui?YI`XpeB|r4?_MCgmkj0#K&9a z51-J+A92C)@siW2&S%b6V64f|2f^1am8KysFw{*sAw}NPlcnBW!SPt{3#KlL zv!ydx?J!Zb`z$(oJaMslw>ysNa@@t)qIdgB|6?4FTQ^&I7+HTHSTaeD8=lXcUY=yg;&0%M zB4Wb;$gR4v{$jVQ&_kf%)!yHuZY~ekNxVOS9ZU189#`FPb>S>ij)B?@L5<0fTTE#T z8O@8Wp>s}3dwuXkqKNYiLi{v_v~1qL>hMZSp{!ZXjGVPT;BS!BAZBamAkNXnR&Ow( z-U$In1?jlyY_O)`& zH8rau;tIFLM&MfBV8vh*peXc#);n2Rlfkx_+4vvRSY5xsldj zIGQmB)$smwlt=v1l|HKG5N%z;IIWexldg=_XY7<>E!Z;3;Oo=L?-Oq9cQ=~D0?=@{ zY&h_MTq(b8i+u@KM3%pUTv{U3>u2pX)lhmLbME#av|^LqkFy%Dld~?|LUM(Ug9|VF9lTD!mv=e^hM6CJIuJ0l)$WA3jX=g zvuqO1q=6R4C)&WCHq9#=2`~FumiD9(D2`V@93J*c`;h5~OhM=LRAm{@b>iCMqCY6} zCY8Gw7X)1+KH(|yA9`T~58S<*1)>diKODbw9SxJoOj8e!Kk5_aI_V?LJg7Y`>)?Ix z==-`m(dPS&q+nNhLGd3w$R+ilqN{S9Q62C1Ue?{nyNx_k4}5iT+EMxFuX{;x7X63K zei@(^(rhjDai1X(QM1+uBzwY+UYopuVoffUvSpvSP2tT)`U#&enl%O#*-oFMv^+w1 zKDudEq_aTm9enz|4vR6=m6@4wJ3Rvo2?Qj@xWt@PIW;zPIPLTT7q9_6BNR<_$suy&(!n?K*RxwDkyNank9G)2@t|!(-D!qg!utK zW#@aL_`hOm(ChDq3h_xZTPdT~4>ODxJdYb*4-~=TAY@K7mg{paNfBh7` zgf?rM5J^Qk7MxqnjwrACc!#cNn_9&)9% z-thKEdBRh2Gq>-bgB~WGSqWm26>T}()g{zyEpBf(w=7$N+!%dfOu@16hX%S2^qMJV zOhrbop!=_3F3!I-Fs(W3+}F~wbkus$W)UR+r?|Wn_-9A!!+4kl3n76yZ@O zJ`3>S9MKGpO}UV)k0;O1Ej|DEWR*CSFt905&Aj|Vr09Xm{@Dd&2wrY%hTe8Uun}BG zS<*&roY5yctth~9V-KV`#RCtnj%3Cp))agNI_kp3GVSOH>k@xWWemMR5>yma+2X%z zw>l(u=iwE205ea=ahR*UK6motPFkHs_F1&c8y)S)@_kB`d%U^{6r=R5RIKPTqYrmm zTQz1?tms`MKLyus;-9G+`{%~^r?oOKlfL21uifr{f8A{<2SP28qeqmAdwYUE@~UPt z=hs`ufnInGFPBQKFo&^z`cH%Mlk<*xYWjwZ6W;F0oU=^|HythTM27Xi`*kK|edl<8 zk5~HeFQ+ofpC~Xb{Ji2F*hNf^crS=&uaZyur!eD(x${62j2*A&CaTauCd$<>$HZy& z8$VY^C_5o%7qNHsInx$8OBz4`>A=n!!Nsd(*z%jQoIQ_NVB|O>TKM20zkei=jg4zS z46ntnU;6TP*)h|r?q3H~4_kp*tkV4=W0Su9G2SMTp$YsNhoIAM#x0B>uo=eQ<3+HE z_)RS4r4bccziQnl!;c7%S752-mYG*3-k7MitL!bcW2B4f<;A!3&l}s&SH_H+z{IOE zrt_me;X*;VvbM&@S7pKYb_p6RugP5B9HNVP`}7GnL0U{$4T5g49zS}OlUefj7jgxq zMA|9u@Nz~J#(bqk2X1kd@Gc~Lb*#gxcwUHOSX`R zy;KRy_kFj6J?IniGC^W62!zxE56Ac1jh+kIrC_Rw?4?af-~VXxZ1n?V4k_NzJ2A{{ zJ3xs!d-bSREm%jIC{l9$CYbX@Uz5Zvj&)Zol=ox%Iy8~;EkOXM(DO#;4iC5jM1o3xv1F;qS;!lz z17q%=Dh?sIqX)yPEao>cl0Nh-rCB;RFu3BmRQnmmJMjmHEnV7?puEK*HRc)q($lrE z6WkwmTPw5L6W@?P&O7bTP%KQXfP@KsRLun zy=>1pdF5R(y86CBnFJa&))vmX=*Zg3HrhfXV7@>ky$j>f&NG6g3(#1VxvgE0J6{RQ z;^SAq^OYrD`F78NJkzb)@3lJpmnXwcxx*^rOHCmm*}Z^OEe@w+P33Au=NHWjXA4G! z?XbRx)fLMsUd0-fiF5{hOB=2KYwxSVq6~xmMMPRcmQ?AI?hZ+5=>}mb=~@J&L_%`u z?p{PvYNc6Nk!~fIPU%>3&+`A@o~!emb90{a-Tc0*cb@0{=9~97Gw;mwrNKo=8moB) zldb!9eN05Y7kAXfx|q(aS#)&&az6Wvp{1?YW+-UcwaF!OuOMMDtH zcUuEf2Ai+P+%vPOdK)>d3yu3(?cPGUvsU^JFRdJ?vs@9U{^NoGcwJ^5-U%$C+?R#& zy+ccOe4(+YYGnoY328iMy~78+O}k>L{b#vy*H-{HD7-vXnrI<>egQpxSiDz@pHGpq z9`@@<6jwx61H|=LH8%VmaezMAHNCKV_`&^j#j7|4NmT~H!7iAj>j$BrPTHDLS>3LB zok2qupf@Pq6G8N`cY)Z=J06(D9wAY~uig1HHrd%A-F>XA2%PGuUWQY=;P4yYw9)y?(r-P%ACTJxzTDcrKMsl6fYc2vLUaB?AGTZ+X6R*`8Wa7+@nbSBI>x42wjW3?Zs`mqt|_VVLW%%_ zLV6@`<2?4`ns>6I3Mij$PLSO(CSNwTr%E9c-_*v5g^>|6Hjbc9fnI~_oa__OEZ~xhn{Wu>AU@EC z`!v#??rC)Lyk%pLKOa^UYkY9eoW2Df%BYy!Y_Ni`Cv>!RP~Q1UjSB0+OGP-PJx@}8*waj^jvTP zaDdvKmJ>>~zBIf~(dcWwIwk`1{b&hrQ@l(}e{OWpK*^l;wh)Q`_iR-}G(!Zw9IOe! zRpdLulB|f1uHJK~jG+RPL}iDl(uq*yZ;}#nCH}zBXXN0(2Ja@+n+wYK#VV!WyrH() zvR&(DA;pslh@3x31I=m%zThUnoCe8Wk{I*LIxhOja1wpL3i8BJvKVDG8Si@#I-0WU#@jq%oX{Mjh7WY_Fk(YtjXrA-l)P z$s5Wbb%sPXh%!0T6=!6%)% z;@6n>8?YxUM~h-o&ec1fq|r{nP3h$a%sdhyt0pj@hco=DMKb(=nNmDI1y`z#L5Ar<0i^F7N?Yh0y2 zNhsLY-FE1cvvM2?EcUxY5&-6X#`Mss4`x>=vcCSv5f5Fw@C|Q3VSh!a>6QEa8)&t; zK^pCOM{B>1MN{Bb=dtG%Z!iiB&zN?+`rVx0+jbk+fzl*OlZQTmEw(NhmcgF?q8}^= zvaW>zRlMCoszN9LwMp7?rPbcr}woP6&bs#_Nry|0jz(w_C0+jxH zz_GwGk(@P22ZuW?q8FYY$fmotv@Z7rb?Y&8(DbNo!D8DqTp`qkqVf2wBb6XuqI-A+ zA>X0$8i`Nsd(vgcK(V}W+tvGuwL{(8jSt-!)UyX5A%x{&Uw>y$ToE#lF-Z+OW#p88Uai-{n!WgSxRAfblEYp!hF$|goi?BsU z&(g|*NMX+{on!KsC8CvlEa=5PpQXaKS0&ZZVJ_w{;?8f<)AQrZByj-;JYr2MObmp% z!Ram4@(dSOhwVr%cNd131_koY?aw&$VZWY04A{bmMTL^FPHT&>s@vX4Z z*?dXGI$5f=c249;DNWmhq#%lIMCh7zO3h|hJmI>Zvyudl`^6?s+G)u0J3>d{eOs>) zV$^NFF#|icUhYH|%j*C>sDGr&9CwyXepx@Y^(oNzo5+MgE)g50X2xDR4?iWB%?(sl z>1Pc;Z)!nBWz<9!jsQK+cbYl2LHvTuH?C%qz5m9EA6-rV+h17H>>w%K8)B~p!yKH= zHJpoL>RLssi?of}ljinCMSjBBoR)sifC!OwnL9sWkUhrrY1hqP{$DI_w>4O-A*f}d ziq%2;^WT6W0&ia0Ph%Lj0eNlw!fv0EuC00O+%rzMM);|Jyg8nzb>+yObF3@>BY6up&5o$-Y@9+aY$_XO&^X20}}xwUi>(>py`N1xdDQ$6~i0BNG=Jp`1ydM~s* znoD9PfwFA?se`BYCF1+&$-*X{tN9_5otQ7)p6@}pJ#H9wM&qgR-JfT94wl^uZ)F1I z*IK53A{$WGguja!&HiPU`kY$%)Zo9rHmrBE7bqMM`vtMRsWz~d$5d#@y4n;0Cv0(& z8hRNwH{q_b(B#i42U#a9)iIm(6}awUTr{VV98cAK+)~w9!8uk4-R>dl)qTS$A$v3O zeVrRLA@j1&Lq?j?pAKA~WbN62$>#HTa{S1ju-4h^ks_SpsOS%QJbp(TgK7-kz%yTu zA<-t*^oS;xfPa1VM@p<;%ev~ghBnBu&5blYf*wgwF>i!a?)U}-1q8`t?I8w-n34?AA2E0<>yFn1R;x5TyQZ@@t^@bCh~z*PKepSQ|BOG&)xhY| zy3#DK7)NtM(^4dBg0eF-vQQC+@);K4-iIR=6+q+ZI(7JE5E3}Dux}mUlbG`FeZO2u zwCUfvIjyZ>j3OWLz>SouO+?IS1L*Xr3AF)&`;6boz#W;I4$)Pj%usnZ*O8xoDarq|tUqpcdzP^L<8#(yo)%$&Zn_wf>}&mbQGHrfKD`#E42jAD%(68kcx ztCuOu12iN|OLFiz!WTB`!N*-K<%^w9Vwy7`+!oyTda* zJFe%x1prZYo`e!oz9Ri&=QKvlPDZBL=@w^Y{zi2>Dn5W^PQq2?M&@*7jz13mjz+99*@HUQL7I#hPmQsjn(Ms zGUD6MJ*sw(#KgWQ5Ql{EI$ZK}_17FHQA0zd0_ZN`BnDou7d2H)+o9fuKCMp$icL*r-19$_g?kMD~enC`pO_(*mD-@5Nm|^j%fkAMtOm^kkcL>TeVxEuwkEIZ>&$=+Ey^?W6qv=Q5%Rh z7`a$8Znlm|$3OiBo}=n?uG zh1zZQgG%>6nn(F4w3a7gN8&tA7AF;c&z`Qv{Dh2L+!|=TcsLJl_bM)i1a)=sG_+ic zVA=PD&9$*f&X|BP^xcZ-nRh8`H?V{L^$8qW5Vmov73NjtvlXVLIg{U>q-M9ZUrrib zQZ`;QF$h-!pQ~jVrKyOfJvP(RfFC&yX@U62cx>*nJiW~owaH!#+OV&LG{=7j&kBrt zBy+S|?HW!4A0;T?WU=i3eba->=H_Oz(r+6fNopj}k?v_#Q3%%(Wpz_Yai_L7y z`Dn4g&w4tA*2BUUcUl0Z>44YP>Bt>Z){KiMAJ93F`^o$ntJU%;fgv8SW#5gFKpggo z7|JkEUFdsJy&s^x^90QYC}`%LjvxE`V8~N&yW2B_Vj||$L5uIbl_gAPrpJQo!K-C1 z&L+Cy)gRWcUlw7~o6YxWXn6e_c|3Y+C2`nxs=G-l9Gxb=*Yr}*aI?tCLXzn#r-H|e z^gj!1m<_czd#Lb;&(b6L5-OwXwj&mfcA!)7nT;nZPg#-Mn~$x~j`kQY`r?A@ELxG6 zf0iUJYE=UjKNEF!CLp_*#ru0xgrx_9k-df$`RzTvdzu|{Wb1RESgFu?gw573g5qm! zSDQSoQZMfxYq38ly<~LRzW+Io9Q=MxW=bIR8#}C+gasSAO=H>h17nt%B(t=$JpXU0 z=%vduCIFEYMNLT~lZv6C%o<~__s4}IH|MNO$cO8Lg@Ryf45?;fAxZR2Wm+}0H!Q5I znVET3KAtI25Wh6?^31%j>5iB1IJzYtDx{tX|zS^#~PCO#xw=ZeBX_97Ipl z+5&YJ3$z6Wd&k-=ev^SWA|O2l&y5eVj?T{siO+mXoJ)f^i?rX)j#;AV1oj)9q%>61 z$0Q!m>nus0c-^)@M1i@q9=Eq#aw_=lM`Sg&^7_$4;J{ycqFB+I7FP6srC)MTmF@jD z9x*>;brln}ONkozkW?K(MaVBE);$!EFi=OuxfruMS3*isW?z<>n`P(koRWC#(ciC3 zMMY&(5gY<}pHsD9<~_?KxHvjMG&&|jqj-ws{UX26GC8U<(Gwe<@hX>Yf7bzm#houE ze^@n@_du8LrF5rI#}{p|>%UKl^iZLSGb-Tp}??!hNvimg4DY2ebN=|=rZ0ZckH>)YtVrN{CkY!DapR5aW z#?qL4L;+W|`iWq#TCE#4{ZkLg-A-*rZV_=mS80{KuB)tkeDDRFUI}zS{J9*~ALk_? z>;u(0<8N8nc9CJ3Pig~d4<(*P%lS`!skCy~nQh|wbmh2Ia})pne%P3ja>EuL3g|~p zolYzBcU~URg?-90{dI?2)A0H#WyzCj?*c!Bmoa-#F1>hD958qUTK?xTBje>=yccQ> zAgC2`d&@}<)jC~iH685ckdmHn@?D>l**1a-v!Biy#cV*0X6(0uc`U_**_CI!A7ol8 zC@rce@5Z~L+q&UrX_O*Z@qu!$eq2Ifn_Sq# UDN8uq9-$u:```. +3. Select **Proxy**. -**Make changes to the registry to configure the proxy with the Windows telemetry service:** +4. Verify that the **Automatically detect settings** option is set to On. +![Image showing the proxy settings configuration page](images/proxy-settings.png) -1. Open your preferred registry editing tool. You can use Windows Registry Editor by opening the **Start menu**, typing **regedit** and pressing **Enter**. +5. If the **Use setup script** or **Manual proxy setup** options are enabled then you will need to [configure proxy settings manually by using Netsh](#configure-proxy-server-manually-using-netsh) method for WinHTTP to discover the appropriate proxy settings and connect. -2. Navigate to the **HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DataCollection** registry key. +### Configure proxy server manually using Netsh -3. Right-click the key and click **New** and **String Value**. Type **TelemetryProxyServer* and press **Enter**. +Use Netsh to configure the proxy settings if **Use setup script** or **Manual proxy setup** settings are configured in the Windows Proxy setting of the endpoint to enable connectivity. -4. Double click the **TelemetryProxyServer** entry and enter the proxy server you want to allow in the format ```:```. Naama: Please confirm this is all correct. +You can configure the endpoint by using any of these methods: -In some cases, you may need to configure your firewall to ensure the Windows Defender ATP service can connect to our processing servers. The URLs for the servers depend on the datacenter location you chose during service onboarding. +- Importing the configured proxy settings to WinHTTP +- Configuring the proxy settings manually to WinHTTP -If you chose the US as your datacenter, you will need to allow the following URLs: +After configuring the endpoints, you'll need to verify that the correct proxy settings were applied. -- https://us.vortex-win.data.microsoft.com/collect/v1 -- https://sevillegwcus.microsoft.com -- https://sevillegweus.microsoft.com -- https://psapp.microsoft.com/PSApp/SubmissionFEService +**Import the configured proxy settings to WinHTTP** -If you chose the EU as your datacenter, you will need to allow the following URLs: +1. Open an elevated command-line prompt on the endpoint: -- https://eu.vortex-win.data.microsoft.com/collect/v1 -- https://sevillegwweu.microsoft.com -- https://sevillegwneu.microsoft.com -- https://psappeu.microsoft.com/PSApp/SubmissionFEService + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command and press **Enter**: + + ``` + netsh winhttp import proxy source=ie + ``` + + An output showing the applied WinHTTP proxy settings is displayed. + + + **Configure the proxy settings manually to WinHTTP** + + 1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + + 2. Enter the following command and press **Enter**: + + ``` + proxy [proxy-server=] ProxyServerName:PortNumber + ``` + Replace *ProxyServerName* with the fully qualified domain name of the proxy server. + + Replace *PortNumber* with the port number that you want to configure the proxy server with. + + An output showing the applied WinHTTP proxy settings is displayed. + + +**Verify that the correct proxy settings were applied** + +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command and press **Enter**: + +``` +netsh winhttp show proxy +``` + +For more information on how to use Netsh see, [https://technet.microsoft.com/en-us/library/cc731131(v=ws.10).aspx](https://technet.microsoft.com/en-us/library/cc731131(v=ws.10).aspx) + +## Enable access to Windows Defender ATP service URLs in the proxy server + +If a proxy or firewall is blocking all traffic by default and allowing only specific domains through, make sure that the following URLs are white-listed to permit communication with WD ATP service in port 80 and 443: + +- us.vortex-win.data.microsoft.com +- eu.vortex-win.data.microsoft.com +- sevillegwcus.microsoft.com +- sevillegweus.microsoft.com +- sevillegwweu.microsoft.com +- sevillegwneu.microsoft.com +- www.microsoft.com +- crl.microsoft.com +- *.blob.core.windows.net + +If a proxy or firewall is blocking anonymous traffic, as Windows Defender ATP sensor is connecting from system context, make sure anonymous traffic is permitted to the above listed URLs. + +## Verify client connectivity to Windows Defender ATP service URLs + +Verify the proxy configuration was completed successfully, that WinHTTP can discover and communicate through the proxy server in your environment, and that the proxy server allows traffic to the WD ATP service URLs. + +1. Download the connectivity verification tools to the PC where WD ATP sensor is running on: + + - [Download PsTools Suite](https://technet.microsoft.com/en-us/sysinternals/bb896649) + - [Download PortQry Command Line Port Scanner Version 2.0 utility](https://www.microsoft.com/en-us/download/details.aspx?id=17148) + +2. Extract the contents of PsTools and PortQry to a directory on the computer hard drive. + +3. Open an elevated command-line: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +4. Enter the following command and press **Enter**: +``` +HardDrivePath\PsExec.exe -s cmd.exe +``` + + Replace *HardDrivePath* with the path where the PsTools Suite was extracted to: +![Image showing the command line](images/psexec-cmd.png) + +5. Enter the following command and press **Enter**: +``` +HardDrivePath\portqry.exe -n us.vortex-win.data.microsoft.com -e 443 -p tcp +``` + Replace *HardDrivePath* with the path where the PortQry utility was extracted to: + ![Image showing the command line](images/portqry.png) + +6. Verify that the output shows that the name is **resolved** and connection status is **listening**. + +7. Repeat the same steps for the remaining URLs with the following arguments: + + - portqry.exe -n eu.vortex-win.data.microsoft.com -e 443 -p tcp + - portqry.exe -n sevillegwcus.microsoft.com -e 443 -p tcp + - portqry.exe -n sevillegweus.microsoft.com -e 443 -p tcp + - portqry.exe -n sevillegwweu.microsoft.com -e 443 -p tcp + - portqry.exe -n sevillegwneu.microsoft.com -e 443 -p tcp + - portqry.exe -n www.microsoft.com -e 80 -p tcp + - portqry.exe -n crl.microsoft.com -e 80 -p tcp + +8. Verify that each URL shows that the name is **resolved** and connection status is **listening**. + +If the any of the verifications indicate a fail, then verify that you have performed the proxy configuration steps to enable server discovery and access to the service URLs. From b6fb375ad6273464562cbe670e93b36099e35a92 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 5 May 2016 15:48:35 +1000 Subject: [PATCH 138/439] minor edit --- ...onboarding-windows-defender-advanced-threat-protection.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index 474581adca..360f6cfcb3 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -146,9 +146,10 @@ Enable the **Automatically detect settings** option in Windows Proxy settings so 5. If the **Use setup script** or **Manual proxy setup** options are enabled then you will need to [configure proxy settings manually by using Netsh](#configure-proxy-server-manually-using-netsh) method for WinHTTP to discover the appropriate proxy settings and connect. -### Configure proxy server manually using Netsh +### Configure the proxy server manually using Netsh -Use Netsh to configure the proxy settings if **Use setup script** or **Manual proxy setup** settings are configured in the Windows Proxy setting of the endpoint to enable connectivity. +If **Use setup script** or **Manual proxy setup** settings are configured in the Windows Proxy setting, then endpoints will not be discovered by WinHTTP. +Use Netsh to configure the proxy settings to enable connectivity. You can configure the endpoint by using any of these methods: From 7d438a0cb51845b2efe3a497cd297a42eff1b1f9 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 5 May 2016 18:36:55 +1000 Subject: [PATCH 139/439] grammar edits --- ...indows-defender-advanced-threat-protection.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index 360f6cfcb3..9ab983b67a 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -121,7 +121,7 @@ If the service is not set for automatic startup, you will need to set it. For more information about the telemetry service used in Windows 10, see **Manage your telemetry settings** at the [Configure telemetry and other settings in your organization](https://technet.microsoft.com/itpro/windows/manage/disconnect-your-organization-from-microsoft#bkmk-utc) topic. -## Configure proxy and Internet connectivity +## Configure proxy and Internet connectivity settings The embedded Windows Defender ATP sensor runs in system context using the LocalSystem account. The sensor uses Microsoft Windows HTTP Services (WinHTTP) to enable communication with the Windows Defender ATP cloud service. This is considered as the appropriate method of communication this type of usage scenario. @@ -133,7 +133,7 @@ The WinHTTP configuration setting is independent of the Windows Internet (WinINe ### Configure Web Proxy Auto Detect (WPAD) settings in the environment and configure Windows to automatically detect the proxy server through Policy or the local Windows settings -Enable the **Automatically detect settings** option in Windows Proxy settings so the WinHTTP can use the WPAD feature to locate a proxy server. +Enable the **Automatically detect settings** option in the Windows Proxy settings so that WinHTTP can use the WPAD feature to locate a proxy server. 1. Click **Start** and select **Settings**. @@ -213,7 +213,7 @@ For more information on how to use Netsh see, [https://technet.microsoft.com/en- ## Enable access to Windows Defender ATP service URLs in the proxy server -If a proxy or firewall is blocking all traffic by default and allowing only specific domains through, make sure that the following URLs are white-listed to permit communication with WD ATP service in port 80 and 443: +If a proxy or firewall is blocking all traffic by default and allowing only specific domains through, make sure that the following URLs are white-listed to permit communication with Windows Defender ATP service in port 80 and 443: - us.vortex-win.data.microsoft.com - eu.vortex-win.data.microsoft.com @@ -229,14 +229,14 @@ If a proxy or firewall is blocking anonymous traffic, as Windows Defender ATP s ## Verify client connectivity to Windows Defender ATP service URLs -Verify the proxy configuration was completed successfully, that WinHTTP can discover and communicate through the proxy server in your environment, and that the proxy server allows traffic to the WD ATP service URLs. +Verify the proxy configuration completed successfully, that WinHTTP can discover and communicate through the proxy server in your environment, and that the proxy server allows traffic to the Windows Defender ATP service URLs. -1. Download the connectivity verification tools to the PC where WD ATP sensor is running on: +1. Download the connectivity verification tools to the PC where Windows Defender ATP sensor is running on: - [Download PsTools Suite](https://technet.microsoft.com/en-us/sysinternals/bb896649) - [Download PortQry Command Line Port Scanner Version 2.0 utility](https://www.microsoft.com/en-us/download/details.aspx?id=17148) -2. Extract the contents of PsTools and PortQry to a directory on the computer hard drive. +2. Extract the contents of **PsTools** and **PortQry** to a directory on the computer hard drive. 3. Open an elevated command-line: @@ -271,9 +271,9 @@ HardDrivePath\portqry.exe -n us.vortex-win.data.microsoft.com -e 443 -p tcp - portqry.exe -n www.microsoft.com -e 80 -p tcp - portqry.exe -n crl.microsoft.com -e 80 -p tcp -8. Verify that each URL shows that the name is **resolved** and connection status is **listening**. +8. Verify that each URL shows that the name is **resolved** and the connection status is **listening**. -If the any of the verifications indicate a fail, then verify that you have performed the proxy configuration steps to enable server discovery and access to the service URLs. +If the any of the verification steps indicate a fail, then verify that you have performed the proxy configuration steps to enable server discovery and access to the service URLs. From 45afc94958a3a6d5c5c4f2e7fc2511a22efec1b0 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 5 May 2016 11:10:21 -0700 Subject: [PATCH 140/439] first draft --- windows/manage/TOC.md | 1 + ...up-policies-for-enterprise-edition-only.md | 19 +++++++++++++++++++ windows/manage/lock-down-windows-10.md | 6 +++++- 3 files changed, 25 insertions(+), 1 deletion(-) create mode 100644 windows/manage/group-policies-for-enterprise-edition-only.md diff --git a/windows/manage/TOC.md b/windows/manage/TOC.md index 3324e10449..6c60033dd6 100644 --- a/windows/manage/TOC.md +++ b/windows/manage/TOC.md @@ -24,6 +24,7 @@ #### [Settings and quick actions that can be locked down in Windows 10 Mobile](settings-that-can-be-locked-down.md) #### [Product IDs in Windows 10 Mobile](product-ids-in-windows-10-mobile.md) ### [Reset a Windows 10 Mobile device](reset-a-windows-10-mobile-device.md) +### [Group Policies that apply only to Windows 10 Enterprise Edition](group-policies-for-enterprise-edition-only.md) ## [Join Windows 10 Mobile to Azure Active Directory](join-windows-10-mobile-to-azure-active-directory.md) ## [Configure devices without MDM](configure-devices-without-mdm.md) ## [Windows 10 servicing options for updates and upgrades](introduction-to-windows-10-servicing.md) diff --git a/windows/manage/group-policies-for-enterprise-edition-only.md b/windows/manage/group-policies-for-enterprise-edition-only.md new file mode 100644 index 0000000000..4b15a22071 --- /dev/null +++ b/windows/manage/group-policies-for-enterprise-edition-only.md @@ -0,0 +1,19 @@ +--- +title: Group Policies that apply only to Windows 10 Enterprise Edition (Windows 10) +description: Use this topic to learn about Group Policy objects that apply only to Windows 10 Enterprise. +ms.prod: W10 +ms.mktglfcycl: manage +ms.sitesec: library +--- + +# Group Policies that apply only to Windows 10 Enterprise Edition + +**Applies to** + +- Windows 10 + +In Windows 10, version 1511, the following Group Policies apply only to Windows 10 Enterprise. + +| Policy name | Policy path | Comments | +| - | - | - | +| Turn off the Store application | Computer Configuration > Administrative Templates > Windows Components > Store > Turn off the Store application

User Configuration > Administrative Templates > Windows Components > Store > Turn off the Store | For more info, see [Knowledge Base article# 3135657](https://support.microsoft.com/en-us/kb/3135657). \ No newline at end of file diff --git a/windows/manage/lock-down-windows-10.md b/windows/manage/lock-down-windows-10.md index ffe9e7c732..f7b266d31e 100644 --- a/windows/manage/lock-down-windows-10.md +++ b/windows/manage/lock-down-windows-10.md @@ -60,9 +60,13 @@ Enterprises often need to manage how people use corporate devices. Windows 10 p

- + + + + +
Event ID Message Description

Windows 10 Mobile allows enterprises to lock down a device, define multiple user roles, and configure custom layouts on a device.

[Reset a Windows 10 Mobile device](reset-a-windows-10-mobile-device.md)

[Reset a Windows 10 Mobile device](group-policies-for-enterprise-edition-only.md)

There are two methods for resetting a Windows 10 Mobile device: factory reset and "wipe and persist" reset.

[Group Policies that apply only to Windows 10 Enterprise Edition](reset-a-windows-10-mobile-device.md)

New

From 68084b06cb164e856ccfcb49afa2af555d1236af Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 5 May 2016 13:11:32 -0700 Subject: [PATCH 141/439] changing name to include Windows 10 Education --- windows/manage/TOC.md | 2 +- ...-enterprise-and-education-editions-only.md | 19 +++++++++++++++++++ ...-for-enterprise-and-education-editions.md} | 8 ++++---- windows/manage/lock-down-windows-10.md | 5 ++--- 4 files changed, 26 insertions(+), 8 deletions(-) create mode 100644 windows/manage/group-policies-for-enterprise-and-education-editions-only.md rename windows/manage/{group-policies-for-enterprise-edition-only.md => group-policies-for-enterprise-and-education-editions.md} (64%) diff --git a/windows/manage/TOC.md b/windows/manage/TOC.md index 6c60033dd6..aea27d408f 100644 --- a/windows/manage/TOC.md +++ b/windows/manage/TOC.md @@ -24,7 +24,7 @@ #### [Settings and quick actions that can be locked down in Windows 10 Mobile](settings-that-can-be-locked-down.md) #### [Product IDs in Windows 10 Mobile](product-ids-in-windows-10-mobile.md) ### [Reset a Windows 10 Mobile device](reset-a-windows-10-mobile-device.md) -### [Group Policies that apply only to Windows 10 Enterprise Edition](group-policies-for-enterprise-edition-only.md) +### [Group Policies that apply only to Windows 10 Enterprise and Windows 10 Education](group-policies-for-enterprise-and-education-editions.md) ## [Join Windows 10 Mobile to Azure Active Directory](join-windows-10-mobile-to-azure-active-directory.md) ## [Configure devices without MDM](configure-devices-without-mdm.md) ## [Windows 10 servicing options for updates and upgrades](introduction-to-windows-10-servicing.md) diff --git a/windows/manage/group-policies-for-enterprise-and-education-editions-only.md b/windows/manage/group-policies-for-enterprise-and-education-editions-only.md new file mode 100644 index 0000000000..192ab7d1dc --- /dev/null +++ b/windows/manage/group-policies-for-enterprise-and-education-editions-only.md @@ -0,0 +1,19 @@ +--- +title: Group Policies that apply only to Windows 10 Enterprise and Windows 10 Education (Windows 10) +description: Use this topic to learn about Group Policy objects that apply only to Windows 10 Enterprise and Windows 10 Education. +ms.prod: W10 +ms.mktglfcycl: manage +ms.sitesec: library +--- + +# Group Policies that apply only to Windows 10 Enterprise and Education Editions + +**Applies to** + +- Windows 10 + +In Windows 10, version 1511, the following Group Policies apply only to Windows 10 Enterprise and Windows 10 Education. + +| Policy name | Policy path | Comments | +| - | - | - | +| Turn off the Store application | Computer Configuration > Administrative Templates > Windows Components > Store > Turn off the Store application

User Configuration > Administrative Templates > Windows Components > Store > Turn off the Store | For more info, see [Knowledge Base article# 3135657](https://support.microsoft.com/en-us/kb/3135657). \ No newline at end of file diff --git a/windows/manage/group-policies-for-enterprise-edition-only.md b/windows/manage/group-policies-for-enterprise-and-education-editions.md similarity index 64% rename from windows/manage/group-policies-for-enterprise-edition-only.md rename to windows/manage/group-policies-for-enterprise-and-education-editions.md index 4b15a22071..ee2fd20508 100644 --- a/windows/manage/group-policies-for-enterprise-edition-only.md +++ b/windows/manage/group-policies-for-enterprise-and-education-editions.md @@ -1,18 +1,18 @@ --- -title: Group Policies that apply only to Windows 10 Enterprise Edition (Windows 10) -description: Use this topic to learn about Group Policy objects that apply only to Windows 10 Enterprise. +title: Group Policies that apply only to Windows 10 Enterprise and Education Editions (Windows 10) +description: Use this topic to learn about Group Policy objects that apply only to Windows 10 Enterprise and Windows 10 Education. ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library --- -# Group Policies that apply only to Windows 10 Enterprise Edition +# Group Policies that apply only to Windows 10 Enterprise and Education Editions **Applies to** - Windows 10 -In Windows 10, version 1511, the following Group Policies apply only to Windows 10 Enterprise. +In Windows 10, version 1511, the following Group Policies apply only to Windows 10 Enterprise and Windows 10 Education. | Policy name | Policy path | Comments | | - | - | - | diff --git a/windows/manage/lock-down-windows-10.md b/windows/manage/lock-down-windows-10.md index f7b266d31e..ba8ca9c846 100644 --- a/windows/manage/lock-down-windows-10.md +++ b/windows/manage/lock-down-windows-10.md @@ -60,17 +60,16 @@ Enterprises often need to manage how people use corporate devices. Windows 10 p

Windows 10 Mobile allows enterprises to lock down a device, define multiple user roles, and configure custom layouts on a device.

-

[Reset a Windows 10 Mobile device](group-policies-for-enterprise-edition-only.md)

+

[Reset a Windows 10 Mobile device](reset-a-windows-10-mobile-device.md)

There are two methods for resetting a Windows 10 Mobile device: factory reset and "wipe and persist" reset.

-

[Group Policies that apply only to Windows 10 Enterprise Edition](reset-a-windows-10-mobile-device.md)

+

[Group Policies that apply only to Windows 10 Enterprise and Windows 10 Education](group-policies-for-enterprise-and-education-editions.md)

New

-  ## Related topics From 137336021f0e38b54f8621b050353d09540ceb99 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 6 May 2016 13:45:20 +1000 Subject: [PATCH 142/439] update TOC to indlude new topic, create new config topic, remove content from troubleshooting --- windows/keep-secure/TOC.md | 1 + ...ows-defender-advanced-threat-protection.md | 165 ++++++++++++++++++ ...ows-defender-advanced-threat-protection.md | 156 ----------------- 3 files changed, 166 insertions(+), 156 deletions(-) create mode 100644 windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index d837167528..0f87bc0afe 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -406,6 +406,7 @@ #### [Onboard endpoints and set up access](onboard-configure-windows-defender-advanced-threat-protection.md) ##### [Service onboarding](service-onboarding-windows-defender-advanced-threat-protection.md) ##### [Configure endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +##### [Configure proxy and Internet settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) ##### [Additional configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md) ##### [Monitor onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) ##### [Troubleshoot onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md new file mode 100644 index 0000000000..8a16023bd6 --- /dev/null +++ b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md @@ -0,0 +1,165 @@ +--- +title: Configure Windows Defender ATP proxy and Internet connectivity settings +description: Configure the Windows Defender ATP proxy and internet settings to enable communication with the cloud service. +keywords: troubleshoot onboarding, onboarding issues, event viewer, azure management portal, data collection and preview builds +search.product: eADQiWindows 10XVcnh +ms.prod: W10 +ms.mktglfcycl: deploy +ms.sitesec: library +author: mjcaparas +--- + + +# Configure proxy and Internet connectivity settings + +The embedded Windows Defender ATP sensor runs in system context using the LocalSystem account. The sensor uses Microsoft Windows HTTP Services (WinHTTP) to enable communication with the Windows Defender ATP cloud service. This is considered as the appropriate method of communication this type of usage scenario. + +The WinHTTP configuration setting is independent of the Windows Internet (WinINet) internet browsing proxy settings and can only discover a proxy server by using the following discovery methods: + +- Configure Web Proxy Auto Detect (WPAD) settings in the environment and configure Windows to automatically detect the proxy server through Policy or the local Windows settings + +- Configure the proxy server manually using Netsh + +## Configure Web Proxy Auto Detect (WPAD) settings in the environment and configure Windows to automatically detect the proxy server through Policy or the local Windows settings + +Enable the **Automatically detect settings** option in the Windows Proxy settings so that WinHTTP can use the WPAD feature to locate a proxy server. + +1. Click **Start** and select **Settings**. + +2. Click **Network & Internet**. + +3. Select **Proxy**. + +4. Verify that the **Automatically detect settings** option is set to On. +![Image showing the proxy settings configuration page](images/proxy-settings.png) + +5. If the **Use setup script** or **Manual proxy setup** options are enabled then you will need to [configure proxy settings manually by using Netsh](#configure-proxy-server-manually-using-netsh) method for WinHTTP to discover the appropriate proxy settings and connect. + +## Configure the proxy server manually using Netsh + +If **Use setup script** or **Manual proxy setup** settings are configured in the Windows Proxy setting, then endpoints will not be discovered by WinHTTP. +Use Netsh to configure the proxy settings to enable connectivity. + +You can configure the endpoint by using any of these methods: + +- Importing the configured proxy settings to WinHTTP +- Configuring the proxy settings manually to WinHTTP + +After configuring the endpoints, you'll need to verify that the correct proxy settings were applied. + +**Import the configured proxy settings to WinHTTP** + +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command and press **Enter**: + + ``` + netsh winhttp import proxy source=ie + ``` + + An output showing the applied WinHTTP proxy settings is displayed. + + + **Configure the proxy settings manually to WinHTTP** + + 1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + + 2. Enter the following command and press **Enter**: + + ``` + proxy [proxy-server=] ProxyServerName:PortNumber + ``` + Replace *ProxyServerName* with the fully qualified domain name of the proxy server. + + Replace *PortNumber* with the port number that you want to configure the proxy server with. + + An output showing the applied WinHTTP proxy settings is displayed. + + +**Verify that the correct proxy settings were applied** + +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command and press **Enter**: + +``` +netsh winhttp show proxy +``` + +For more information on how to use Netsh see, [https://technet.microsoft.com/en-us/library/cc731131(v=ws.10).aspx](https://technet.microsoft.com/en-us/library/cc731131(v=ws.10).aspx) + +## Enable access to Windows Defender ATP service URLs in the proxy server + +If a proxy or firewall is blocking all traffic by default and allowing only specific domains through, make sure that the following URLs are white-listed to permit communication with Windows Defender ATP service in port 80 and 443: + +- us.vortex-win.data.microsoft.com +- eu.vortex-win.data.microsoft.com +- sevillegwcus.microsoft.com +- sevillegweus.microsoft.com +- sevillegwweu.microsoft.com +- sevillegwneu.microsoft.com +- www.microsoft.com +- crl.microsoft.com +- *.blob.core.windows.net + +If a proxy or firewall is blocking anonymous traffic, as Windows Defender ATP sensor is connecting from system context, make sure anonymous traffic is permitted to the above listed URLs. + +## Verify client connectivity to Windows Defender ATP service URLs + +Verify the proxy configuration completed successfully, that WinHTTP can discover and communicate through the proxy server in your environment, and that the proxy server allows traffic to the Windows Defender ATP service URLs. + +1. Download the connectivity verification tools to the PC where Windows Defender ATP sensor is running on: + + - [Download PsTools Suite](https://technet.microsoft.com/en-us/sysinternals/bb896649) + - [Download PortQry Command Line Port Scanner Version 2.0 utility](https://www.microsoft.com/en-us/download/details.aspx?id=17148) + +2. Extract the contents of **PsTools** and **PortQry** to a directory on the computer hard drive. + +3. Open an elevated command-line: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +4. Enter the following command and press **Enter**: +``` +HardDrivePath\PsExec.exe -s cmd.exe +``` + + Replace *HardDrivePath* with the path where the PsTools Suite was extracted to: +![Image showing the command line](images/psexec-cmd.png) + +5. Enter the following command and press **Enter**: +``` +HardDrivePath\portqry.exe -n us.vortex-win.data.microsoft.com -e 443 -p tcp +``` + Replace *HardDrivePath* with the path where the PortQry utility was extracted to: + ![Image showing the command line](images/portqry.png) + +6. Verify that the output shows that the name is **resolved** and connection status is **listening**. + +7. Repeat the same steps for the remaining URLs with the following arguments: + + - portqry.exe -n eu.vortex-win.data.microsoft.com -e 443 -p tcp + - portqry.exe -n sevillegwcus.microsoft.com -e 443 -p tcp + - portqry.exe -n sevillegweus.microsoft.com -e 443 -p tcp + - portqry.exe -n sevillegwweu.microsoft.com -e 443 -p tcp + - portqry.exe -n sevillegwneu.microsoft.com -e 443 -p tcp + - portqry.exe -n www.microsoft.com -e 80 -p tcp + - portqry.exe -n crl.microsoft.com -e 80 -p tcp + +8. Verify that each URL shows that the name is **resolved** and the connection status is **listening**. + +If the any of the verification steps indicate a fail, then verify that you have performed the proxy configuration steps to enable server discovery and access to the service URLs. diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index 9ab983b67a..361676b695 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -121,162 +121,6 @@ If the service is not set for automatic startup, you will need to set it. For more information about the telemetry service used in Windows 10, see **Manage your telemetry settings** at the [Configure telemetry and other settings in your organization](https://technet.microsoft.com/itpro/windows/manage/disconnect-your-organization-from-microsoft#bkmk-utc) topic. -## Configure proxy and Internet connectivity settings - -The embedded Windows Defender ATP sensor runs in system context using the LocalSystem account. The sensor uses Microsoft Windows HTTP Services (WinHTTP) to enable communication with the Windows Defender ATP cloud service. This is considered as the appropriate method of communication this type of usage scenario. - -The WinHTTP configuration setting is independent of the Windows Internet (WinINet) internet browsing proxy settings and can only discover a proxy server by using the following discovery methods: - -- Configure Web Proxy Auto Detect (WPAD) settings in the environment and configure Windows to automatically detect the proxy server through Policy or the local Windows settings - -- Configure the proxy server manually using Netsh - -### Configure Web Proxy Auto Detect (WPAD) settings in the environment and configure Windows to automatically detect the proxy server through Policy or the local Windows settings - -Enable the **Automatically detect settings** option in the Windows Proxy settings so that WinHTTP can use the WPAD feature to locate a proxy server. - -1. Click **Start** and select **Settings**. - -2. Click **Network & Internet**. - -3. Select **Proxy**. - -4. Verify that the **Automatically detect settings** option is set to On. -![Image showing the proxy settings configuration page](images/proxy-settings.png) - -5. If the **Use setup script** or **Manual proxy setup** options are enabled then you will need to [configure proxy settings manually by using Netsh](#configure-proxy-server-manually-using-netsh) method for WinHTTP to discover the appropriate proxy settings and connect. - -### Configure the proxy server manually using Netsh - -If **Use setup script** or **Manual proxy setup** settings are configured in the Windows Proxy setting, then endpoints will not be discovered by WinHTTP. -Use Netsh to configure the proxy settings to enable connectivity. - -You can configure the endpoint by using any of these methods: - -- Importing the configured proxy settings to WinHTTP -- Configuring the proxy settings manually to WinHTTP - -After configuring the endpoints, you'll need to verify that the correct proxy settings were applied. - -**Import the configured proxy settings to WinHTTP** - -1. Open an elevated command-line prompt on the endpoint: - - a. Click **Start** and type **cmd**. - - b. Right-click **Command prompt** and select **Run as administrator**. - -2. Enter the following command and press **Enter**: - - ``` - netsh winhttp import proxy source=ie - ``` - - An output showing the applied WinHTTP proxy settings is displayed. - - - **Configure the proxy settings manually to WinHTTP** - - 1. Open an elevated command-line prompt on the endpoint: - - a. Click **Start** and type **cmd**. - - b. Right-click **Command prompt** and select **Run as administrator**. - - 2. Enter the following command and press **Enter**: - - ``` - proxy [proxy-server=] ProxyServerName:PortNumber - ``` - Replace *ProxyServerName* with the fully qualified domain name of the proxy server. - - Replace *PortNumber* with the port number that you want to configure the proxy server with. - - An output showing the applied WinHTTP proxy settings is displayed. - - -**Verify that the correct proxy settings were applied** - -1. Open an elevated command-line prompt on the endpoint: - - a. Click **Start** and type **cmd**. - - b. Right-click **Command prompt** and select **Run as administrator**. - -2. Enter the following command and press **Enter**: - -``` -netsh winhttp show proxy -``` - -For more information on how to use Netsh see, [https://technet.microsoft.com/en-us/library/cc731131(v=ws.10).aspx](https://technet.microsoft.com/en-us/library/cc731131(v=ws.10).aspx) - -## Enable access to Windows Defender ATP service URLs in the proxy server - -If a proxy or firewall is blocking all traffic by default and allowing only specific domains through, make sure that the following URLs are white-listed to permit communication with Windows Defender ATP service in port 80 and 443: - -- us.vortex-win.data.microsoft.com -- eu.vortex-win.data.microsoft.com -- sevillegwcus.microsoft.com -- sevillegweus.microsoft.com -- sevillegwweu.microsoft.com -- sevillegwneu.microsoft.com -- www.microsoft.com -- crl.microsoft.com -- *.blob.core.windows.net - -If a proxy or firewall is blocking anonymous traffic, as Windows Defender ATP sensor is connecting from system context, make sure anonymous traffic is permitted to the above listed URLs. - -## Verify client connectivity to Windows Defender ATP service URLs - -Verify the proxy configuration completed successfully, that WinHTTP can discover and communicate through the proxy server in your environment, and that the proxy server allows traffic to the Windows Defender ATP service URLs. - -1. Download the connectivity verification tools to the PC where Windows Defender ATP sensor is running on: - - - [Download PsTools Suite](https://technet.microsoft.com/en-us/sysinternals/bb896649) - - [Download PortQry Command Line Port Scanner Version 2.0 utility](https://www.microsoft.com/en-us/download/details.aspx?id=17148) - -2. Extract the contents of **PsTools** and **PortQry** to a directory on the computer hard drive. - -3. Open an elevated command-line: - - a. Click **Start** and type **cmd**. - - b. Right-click **Command prompt** and select **Run as administrator**. - -4. Enter the following command and press **Enter**: -``` -HardDrivePath\PsExec.exe -s cmd.exe -``` - - Replace *HardDrivePath* with the path where the PsTools Suite was extracted to: -![Image showing the command line](images/psexec-cmd.png) - -5. Enter the following command and press **Enter**: -``` -HardDrivePath\portqry.exe -n us.vortex-win.data.microsoft.com -e 443 -p tcp -``` - Replace *HardDrivePath* with the path where the PortQry utility was extracted to: - ![Image showing the command line](images/portqry.png) - -6. Verify that the output shows that the name is **resolved** and connection status is **listening**. - -7. Repeat the same steps for the remaining URLs with the following arguments: - - - portqry.exe -n eu.vortex-win.data.microsoft.com -e 443 -p tcp - - portqry.exe -n sevillegwcus.microsoft.com -e 443 -p tcp - - portqry.exe -n sevillegweus.microsoft.com -e 443 -p tcp - - portqry.exe -n sevillegwweu.microsoft.com -e 443 -p tcp - - portqry.exe -n sevillegwneu.microsoft.com -e 443 -p tcp - - portqry.exe -n www.microsoft.com -e 80 -p tcp - - portqry.exe -n crl.microsoft.com -e 80 -p tcp - -8. Verify that each URL shows that the name is **resolved** and the connection status is **listening**. - -If the any of the verification steps indicate a fail, then verify that you have performed the proxy configuration steps to enable server discovery and access to the service URLs. - - - ## Review events and errors on endpoints with Event Viewer From 71f3bebcb787f9fa0bfdfd907855c71dbcacb11a Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 6 May 2016 13:59:50 +1000 Subject: [PATCH 143/439] update keywords, fix spacing --- ...nternet-windows-defender-advanced-threat-protection.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md index 8a16023bd6..d9071e74d9 100644 --- a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- title: Configure Windows Defender ATP proxy and Internet connectivity settings description: Configure the Windows Defender ATP proxy and internet settings to enable communication with the cloud service. -keywords: troubleshoot onboarding, onboarding issues, event viewer, azure management portal, data collection and preview builds +keywords: configure, proxy, internet, internet connectivity, settings, proxy settings search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy @@ -31,7 +31,8 @@ Enable the **Automatically detect settings** option in the Windows Proxy setting 3. Select **Proxy**. 4. Verify that the **Automatically detect settings** option is set to On. -![Image showing the proxy settings configuration page](images/proxy-settings.png) + + ![Image showing the proxy settings configuration page](images/proxy-settings.png) 5. If the **Use setup script** or **Manual proxy setup** options are enabled then you will need to [configure proxy settings manually by using Netsh](#configure-proxy-server-manually-using-netsh) method for WinHTTP to discover the appropriate proxy settings and connect. @@ -60,7 +61,6 @@ After configuring the endpoints, you'll need to verify that the correct proxy se ``` netsh winhttp import proxy source=ie ``` - An output showing the applied WinHTTP proxy settings is displayed. @@ -134,10 +134,10 @@ Verify the proxy configuration completed successfully, that WinHTTP can discover b. Right-click **Command prompt** and select **Run as administrator**. 4. Enter the following command and press **Enter**: + ``` HardDrivePath\PsExec.exe -s cmd.exe ``` - Replace *HardDrivePath* with the path where the PsTools Suite was extracted to: ![Image showing the command line](images/psexec-cmd.png) From fe78fa4ab250cd6f9b46b01bd9965c4a52429226 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 6 May 2016 16:29:55 +1000 Subject: [PATCH 144/439] create new troubleshooting topic, add new images of cmd results --- windows/keep-secure/TOC.md | 1 + ...ows-defender-advanced-threat-protection.md | 6 + .../images/windefatp-sc-qc-diagtrack.png | Bin 0 -> 81969 bytes .../images/windefatp-sc-query-diagtrack.png | Bin 0 -> 59876 bytes ...ows-defender-advanced-threat-protection.md | 131 ++++++++++++++++++ 5 files changed, 138 insertions(+) create mode 100644 windows/keep-secure/images/windefatp-sc-qc-diagtrack.png create mode 100644 windows/keep-secure/images/windefatp-sc-query-diagtrack.png create mode 100644 windows/keep-secure/troubleshoot-onboarding2-windows-defender-advanced-threat-protection.md diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 0f87bc0afe..5f7b73081b 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -410,6 +410,7 @@ ##### [Additional configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md) ##### [Monitor onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) ##### [Troubleshoot onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) +##### [Troubleshoot onboarding issues2](troubleshoot-onboarding2-windows-defender-advanced-threat-protection.md) #### [Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) #### [Portal overview](portal-overview-windows-defender-advanced-threat-protection.md) #### [Use the Windows Defender ATP portal](use-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md index d9071e74d9..27de7a82cd 100644 --- a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md @@ -12,6 +12,12 @@ author: mjcaparas # Configure proxy and Internet connectivity settings +**Applies to:** + +- Windows 10 Insider Preview + +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + The embedded Windows Defender ATP sensor runs in system context using the LocalSystem account. The sensor uses Microsoft Windows HTTP Services (WinHTTP) to enable communication with the Windows Defender ATP cloud service. This is considered as the appropriate method of communication this type of usage scenario. The WinHTTP configuration setting is independent of the Windows Internet (WinINet) internet browsing proxy settings and can only discover a proxy server by using the following discovery methods: diff --git a/windows/keep-secure/images/windefatp-sc-qc-diagtrack.png b/windows/keep-secure/images/windefatp-sc-qc-diagtrack.png new file mode 100644 index 0000000000000000000000000000000000000000..f1401c96df9eaee54706d739240f2dc4f7aaad4e GIT binary patch literal 81969 zcmYhi1CV6F(l$J{ZQHhO+qP}nHg;@t$2NDoW83yOd+&Sy_&cJbqw{2DRh`qFS^4Bs zkqUC+uuxb~00026k`f|H002N5004k05MV!&7a1Y0pASd}2~B4J0Jx!lZ@^S)IP4!G zxQnE$DEJO27#Jo_SNe(de?+1hE`qKu7WPg66}3|mKOz{HACZWuv$2zYrTL-oew!(%ixYpc;Pa-#~Exkvf?g{!=Azv9vV>V10&%{J8@8?~1a$nTxxj zlPQ3%!}mXR=>IskbT+mz{84oRXzOc^{}Ds{6RR6K*;(3|1N31Zh5yLF|7-8+WNZrX z_#J%yKQ&={TU%2*7l5a!wB8>X*grKDOBWkcfby$9q_LXtujkln!$g+UZlL{zJF3&(NpBd^ol?s?}NpIh^o*Bqjw4ep?b{ZS~O zfTtvcgoNGC$;k`u@1Kct#Sw7sIgR|YgZBv+txtd7O?u61+-qnt!VC?VGG)k;$4xpc zOaKN03{*rHrZpx_{v$kvMixK{2?U@nFYod%Mh#aLLI|PnwD_m}bKSoT=56pyAfV(F z46bS{NbxknEWq@?&K^R`JNm;0V}SwD0tg@?h%$Cl|6@Y7fKD70%(zt1%d)U3`(Hmj z?fVTW9$!oUnZ%EIembVXe`my`Yx4hjbVY{7D)#X{O*Zo$f z)4^P$*%bEmbSh#|L@`IcUZ7Y;D6nK*Y1z8=~IG$jIaF zwCvXFz5V^F)8V%cd77%a`u%?XN6JtLNcD2l^P;a_K5<`T{n1jo=fg96Q6*J}AwlF` zr209|HCpp}b$M18jig1En3fnBXxp}HT({VX9q-inY|U}90qEdJoVkS$SRC^*v~u?& zaI2(Xm_BDL&T(k2mW>#lXISv+{gC_EEey7H0CB%#S_n&QT-3AXvk7mqzYqK{y2f#T zT(^yf3A^KDo$1%=19aVi^PRKDpfOKpD~jQX1et82LXF~EH!h2d2{VzX&_^dkqsYg! zsg1WOJ2JY?#KA@2&A5WEihoz~;QKpfw-r|F$Y8bqt0<18G zM-WZyyy`$MTaa{hWqszq0kE{R{CJ1=6EHFw5arwg<$o8IJeVsGPD#VTdC^3fcl~5; z!&c=8>%9ItTSE`yDzD)RqxFZoe`JUqt+c>O>z8=$GZKzQf(e_aH6(Gzaa2QB>lavX z5pf~fWl$6zI&~weGV}>#7-P$k18>|Ra-S$UfV+T{T|$7#jX)yBS!(#L!$FJ0Azr_e zhDaV|67u;nKqbKh*Cr>uMz`f%0CLW*rkr6o7$(SqCA#FAV7p3^>Oc@;B%zT*r=tdJ zFO9jb=bODakBrIAmCJ(2paS#-5JhI-xazo89S~P)VNn@Xc?!`OLn19v7~&!|wCHKT zi@m)HGyHt>Sf?x63W6|l3|$08R0v>2BEV2=5b-lKb`?ZeZGkmdP&x7qc>meJe*Le| z_uEic8aQ;i?3jQ+toZ~Q1lVv$aaWuMMvYj8&o727gZ@J|LqxDAOxQcZI! z2z(Y=QfQ?l0Kt_(cOH6-Ss}oJMpzgU1?9FEd*q}g?^YWI*hm+7Jn8g!ZCf#UyWjDD zzmdmvxd+5WMoTCbhM0vFn#39HS_=1v7M&&+f_` z&SaT0d~P;%CC*bIVn?0=_D1jb@^|6st;m@9;xeA_K_-=UfzKdZwoiWlkJzyWdKdCx9Iyvs_`G?%Eb!i@Lk8ej? z=TeeJSEbXORlfl9-VcjxuH%UP-k|&(?jb7kv?jr2I~Dxjw_Wat{hD1MYO=qEX1{I# zYYDGa07N?7Z-!>`4L*CUP|RVJ?cW%mw^-mR`HU_Hvms(-cXqJPPscI`E3wmm zU49VD+t3VC=!~%U-t*St9UgY)f5%zHhtHHs!Ci34e68RgfvtppT&=a0UpFcFtk}Q2 zPWV*&!rHuCws{ztXE^u(-rIfoe>gNmchmDtx7M&Wmx!-*wxnE$ZtrmG>-L9`gw_UI zd)^eJuc9Z8VKISJ(HW-le+Di@ihMi(QHBMBtjQsyZp~P^eICVk>2687ED~M)Hm8eZ zwZA?8_RUSI#Y>8+J!c3*Dj?aIor?wNh8K<#?C!|Qo=JBoKO{1?<@ zcO5YDXTuFK%wgqV1_jbgfAXE^`OKSi4t>CzHdJj~Hm^0?PpZrRcqrp}JHgkiHz3^p zymFV6X!qzx^@+2@a*-8YVCi}8zDC5ypCyjx8Au|P&S1C4bKmkL4-E~K$>+Il-2{J?kinX?H?xo5hR5t1MDuPY8j4?c6$W zm&YeD+j6SSJ~rB{yV`e0wcK!8!JU$PZrW{tO|dWpdQ?rhs4QGTfKc=88?3t$p3E%sMgT>akcSKbTTD04gb~T3I5MR+Zdq;di`U_d0Equn4Zd|zCu!!- zl4ZGT_4jzN&qn5O%k~Rdn?8HkSsC8$BQI@;@U)HRDQMm{sl%iCl|ff)>igHe;lzUa zU5h<^zglbV@yf+Oyx?qqEYC~tdSZ0#p1vLZ!RNM5>i1vNS=Bb*+|IIf&;5S%)x%h# zjwH&CJvciZPf}#uOB{~}Rw{-YHJjZ?SW}S^+GA~Yxzfwa*y?p1aSD$Fb-zcH%SdER z-*eg+<}(V&CqxuloOo1FK>-97p+LRAR&h=i=kGqns}ea}c`VnAZvM@w#wN~ddy!+L z=bm@&*97SLgKa&Jup@8M8s9@$QeA{ytoV1~+xDgQt3qm<4_m1iK#0t~vvplob;W-;OE%prSx|1E@dL^c-K1Z^711Wpdzl~pI#7KN!{o7^8 z7WngXx!s*6Y1`_Z4yEjRUXPf+X!Uz?uKk`nQ_|D@*F--%Q$5 zNv-@H(KmujF~GtM6;xRAy1kzp+%C0#UME*qWH@j|mRP$E8Q(AQ-#bUy_NASj?;qSS zuJdY7kgifVntc3#C8<|8j8E4*BM*`di!M=PMYTs)ooUIY_M_iNihO7+Dzc+{<7Q8( zlkJ{|swT~=93LCP93wNv^QymNTE#5B>xfw%M8+P55Rl7=i;5&9WAfQjQ`>adrtE0$a!b!U`P7)ahlxFC9!n*E`Ut8rZPG?-qx<{X6pcQmIuBk1NcNq~;BV zTn2miba5D$Hj{pAn=Iepd=_l2p3RbU0@B!v796E4b+QZt0Q^&e?>w95c_4Z$o^QgoZ8L1aQ&4gX{U8XKMi4;|fr7rSZ~s<7MP=wG zQhI!UK4&r*0%fz=?v?R>Que+K(~pgf5fBmvN{|HAVw+zQ!MH5fKW_3~ytU`ved6B$ z5o(=x)}zN2+Ac|eq=R?qQ#LgEh(mfham;s!>BI zPB4C92gDWrm57fXrUN`_zeI9_W%;S6RB&-#S8lWQ;|oj{iZ&dbY12PWL~9?xA*vLE z4Et(<*>KRX)dH^IUpIxX=W;wC`9Ee&FT7k}gE0DzVUZxh9Ycgf6d6UJ8%0U5)cQz~ zmq;(*z|nwRY&c9Tf8j($OkTdIJZtiRdPWXieg(ik%M=-mp(vRIKp2V&sDqkx;wr`? z0T=;O1ucaxP!?2yv5E5tGxG#QQH>-a!`mSW^jo#;Ai=1(s7wp0$x+b(_7TiyN-D)j zKrpyOl7xqlo|PCaK!4mhrgr*y;-3XRuXf0bGrPcS$~nbkV*o;kH>{iD6owgT)N|PU zf{WpaB``t+0g>B6?x-yg+dPo(3e$Ynn;y$h35&-OOTy)10gOHoNpl$xQB17YfL&BT zs7F*YwUOgi8z=Y)fU`1$BS2xLNc&?37S*8yzbJ?t)c_SiW!dZ3a!JTwNZwtaLLkL) z#z0QsK_J42LFgWW|K(V8O)V{~pCUltjgc;6+U@H087=xS=&t2ktFp54<(1xF(nyHN zecO|Ke0;oJ2M^EZgb)EltxhX;-Pch`m`^>alV+0VZj5-t`?~w%sjc^LHyr=yW_NIL zX=#3bK5+Zme7)6{gq+-YmiJjfNonAXojp(Uw->%EX(xvTrP*+NT9ZvRDkx+n`~90X z_nIc6NvSreQfu5Xd%Gq}bJjB)&M)u3Iv|RD3IiY?geZMxB9Ng%V~ViAz_PIjQ5G0P zzo+ne=-rGO%a}P^B9FHGOyZFxt4zPI ziefSk1cXR&;(h^ubg@_w7D6(TXaYC4J|H49)NA2t9O_lV`K2Cs6hdYGbn@ zj>9V738H@;h@uROuVKO=i;0toT+ST7-u~4y+jhWqpW*u2O_IoOi5L&(KVYZ-ppW`S zLqj7ogjD@Q6<1hDMrRup8Zl65(4N% zD@1@n21Gy|GMp$R(Xpf~VSjxJ+rFbgqR7(o9oNlspEB(bSvLfO%WAPNl_3Vw*<8tE zqJ{_qONu23E%KKExwQw;_#IhmZ)c{)@Wj`1@B{fQA^%o?j|70ee?mm1@fg*vM1X+C zFaQj%5JO=hp;5!x!(+-#|A_3tEKGx|Gk4%>RmMrP!Y&G=3ZB8}S7=Yt^3-v0R%y^!?CX^y~fa(cSk4~~CuT9$vb+F*|p zWo-=!7F=v@Mi`YZ^#~OX8Cn#Rt2b3hs*K^>b?#i88umr-?&Z>Wq(4nc>&kQYFuTUz zkg+i!O*u0=Wb2r~MTO5x4Tw#!jyy(3*O$t|Fdf9p7>pU*eNM+^s6GggEc(V{R=1i7&6c6 zRj@UrFe0x(=X;3=ZN$X!5dJH58659$_PYgfGkGw{{xd?_ISDcZc`P?U-YW(MqJ5!h zoEj>@0JHr;lK5`?zRY+~$ZD4&?3e^@2KdO(;?_a}FQ;Q5ZRjQvl!Ua5fyot;`X|G0 ze}4fg{Sjkw--X}_i%H=P;voh`4>&NCFyvc)z%Z&V(sX-9a{GRA_50%2#?ahAvyrBrXE$&~oe818Yhi_`e^iHCNWEqV2W`nj;FRizdd65)9sAYQn=Yp&dSb?f*( zF8LoOq2ap}KKsLxsu<}iD+MHSxMNz?ztF+n-G8GRp~eg>F9bhTC0h4CNI z@fatq$M~51<3t?Zp|~1E5Mho5HhbDl>!$detFn?v5^3H7MGygly(hx|yT6y&d$~E8 zdx5pkkUz>`*v#FbP<(0*LVO^E6`GNbTB|s|R*t@MS~g}lZrZBfC|v=F&}A)b(@<~@ zMd*tmXfSe+sz7uwL>LP#9+?q~2nW1TJQ(|LSmZoVK|vcQ9(jDAUZ;RjduKSdmpax#6k%=#;qKY8=`&-%KwzyG(U za$sD%TTFEH;H8^CWC?ff%DHIT;eA?3RaNxr&rW|v#-C7S(_nD76dJxhE=65INiA?6 zNAYY8M?MBWEql7Xp{UovP_{H$yvS@J|0VzW%4{Z!zsac`Q{W#KeY(eqXQ1nVZYb!7 z2m0!1?)K~pw#nh0)H(ieh;UPU%=jpkSRjYWP-gU>U_0!-D|waAT+h{zOVGEyBVt_Y zuSO&pdav=h?+KxQlgIWSpG_Z!b>qyLUo#Lv5e9H@EdRpvH{m^X*Z*K{Gcb++gWAzE z|9_Y`Ind7*afVYg_`iC|rvu{*2s)HeLdwqf0z;-?TK_fr8b9fXn>HgRB;19b&2#Xv zqQdO6O0=}LKAz=&BQ==O{4Z92njc?k8H2-_^aJC@x3{+=+n4-S2m+`y3t+@BkRUywYBBlUp_#SbRuK)+mjSO?Qbteklu)bp+NvU z$pb?$zzeR-yo7^w6AELf=@L1jgWC8bcuhe#$LSs-@Kv4m5{X<`R+QG!`g3yx!^8_( zYH;lZL=kjJ%!Y_Ty-#4ZBxfYZIp>2_lM-0@X_v$+&Li_^a(Lr55{V_9wFRD))U_n7 z1%^|zWD8g2#m(UjA3Z!pdB%k$lHST~FM<2}6XuP_ouW^I0`N{sE50yle7SC4oqyXk zh6~&C4lWx{=sR%o^K08sjoTsiwn5wP?BT8_Cyv%niR2{3)rz0gQXXogdpUs;rWqoO zCsJXHbk!^_vCScKK7V~RM68a`9_9Upvi@#Q1MVgiAh8>x`8wpcCo=n1{>j+3j6rfn{o$ML(*jMM{bZ{Tak#A*W|>rJu0lwD!IJYZ1B#GaL@9M zTWeP;RR5mp+?Cou#eVta2C=f`#rYfL^h`bSeig#~;y9EQUqNv@*iPE)NOgtT{|w^f zbeNMR?hAfsrA*`@^azS_EK0bTf$M1uQNUs>5c!lh`BjFXS`|h<;C9@Aa5Xa`(DVws7zLC znDJ!@uE3)hRtU?B2XoE35dmo3dt z-^53Ery-Y?C@}01Em7ot$MXHGXgH4J#U+}K(SlU)_Qpl!&YOFl?O5)&%cZ<3Y;Hx6gAy|lgN!u!Qb$d}^P;MMJF*td`)$4GhKgH`nW{P0t1reb$-AY{t%6T0B-5nsRBnkr& z9~T#x7BY~l_o^CW>baPF$;lw`#l@U_o$mbbT*L4|$?rtah=&#>-{O?gfb5hDn7s!( zEGupZpd{YNsT`D?ez!BM4oGP^ru)$(b`rdB8pKQM(l-gp$9a&j!(-;xKbkVQr27hQ zk~S~~FIa2(YO=?Dq64|gQz3|_?Ii@btR)w9XF_d52{{PTMqSvPl*rQiif=Y_Nns?2 zJX%t!P3g5o+@5vs5NwLzjOkT9e!%Q>6vyfGs>rQtl2Yyp?^jrE?86K`TP-xYKD4Od zcxKw2al2BcXG`jd=v+h0vv$R`-^!1K?PFNVB6?ylYJda2HH&H~O50U%Ff|A|#i%ic zI&wrwc*84dvYx8Ay#3G+%Q_V(C~;)m{ZLvN2KwBp;?}1(q4R(_!W48^l2S3aim-EP zz7fJLz9;!D`h7`UQISQBkxi!&MM;Xpt|2I>Ak>ycWejYaqMxNL7qvAUe(w1OvSWn~ z8z5mE!Vk}Eii%2-o!=hOzk;V2MGwqJ2q^`F5MfE@M9t;l(-s+Jvf0xuLmf#fY(21u zM7m^C($xPT)+423#4AG}HJB%{6J@VTFq@i+TU_9_$A@Of{NNg*YF((pw)-cwNN1mA z%`RL_lvESMtjlq~z)s6Kr@pfEezN}Dc03wxIVK}p@-4FX{u#%>F0t$jUGc!bOp2dS zd;Zg}`1|*7f@$VYzPSg}{7Go2?2?1#49*%6zWlynuB2aqpyE`HUO5ruUXe)|tsmJN zoXkTD->=Sk^t@ZK1_&2CBVS7V?o%03Gvcl(Zz+M>@9(Eq7es}S5)G#&o-l7hP>P}j zb#?g$z3~2J@qdy)$WTxb)V)J|!z)k0>mf0;xbtlgCEZFHdDsKPvLJQ?@)cBsS5Sd` zFBj9&6qXNy@2nP6=6$^TEuu=B4e}YW3Z96UYc_>);Z#_VvY)qUvh`#nec3m=5td+w zQhdZTwJXk05t=Dzb8{nFcZ=ci1K$++We-_jX3Kl@q}=cg73WFFWT#B8*OziULdM}5 z#b=NInl9WTkYO!Bw4~1Kt4levBsQdP^p#YMdK|jXHgSOSEB}uRux(AqXAibQM@`gz zFKUJTHjcxaJgh!Nv{_RiLYne4_<|ibhY&$({DLuJHoETs2{TPUkcA~?k6ck(QM5pw zkis84EL}&kfYpE1x|hY6mO-9p;w;a!PuCfWJyOx!5r(jhKCrSG(CGmbI30g~jLuiw z+7wthvrj%R=x9MI+5x@>K)f;751(fyZ_W+)Yh7yy)p>;3s=Tk&?N?h`QX>~sZFg9w zD0m(3HyF4VxHgk1x8~1w$88#B?+{|XUaq`5$H1BMv72fYX)M!?b7hvENcv#`6J|kk zx2&QdE^p`6-iwkf_Y}I$@GQdyrxJcMS5nXj``rJVFY7Uz^AC1N`|ebi73ie6<_YvU1tGoaF4oh^Ll6N$6arLuA6rV5 zT}LYCzAoTnXelZOM>&rLsYGz}Uw`-THBUVOO2%LS(jFkl*B$7ZOx z30Gd8(o;$fmJ|iZyZomfUTITpkZ>&n?$?5|e~bfqEI9lelPQ$4c!`6HJ2MnmqC?1* zLy87tm|@X~)3gjWIGa6DKuoPzBn)3LE*v*p6=>C9>;m9tu&-UvaFCk|Jt|}50a{E! zA#a2k1_Q@R2!WPE`^M@mBALwnJQJ3=oYB5plT8pR{!SK* zL{3rC7`;4MQN4jrUda4%*gceaNV&Vo-!3i?7oID6>Bj2VlJ+*|Pb&l(iMgr&{v{(P zNT~S)ppBIkxvGT0?N6AT^w;C^cRJ@PU=rTQwd!088JxYYyhPOgh!M2+mhND!6~9<> ze%uxVnmb!lou-ta0e5_NJ^FCkaLl>gK@@57>b(ndTmi8pDxb+@99gMuH;(zEoRrjk z2A31YxFfz2cF-cDb7o4qq>dM%ax5)ROG#7!+=*gW?q#sM98=L~{J>sKL7`*46EWWe zTg~uKYw)bHRSG88hcw!}Sh?YpwH5a?z);C=Rr zw2prod{oFHOK5H-_A3+C7;c1Kcet=1x9e^IY@!pzX2IV00H=No>BJDrt$RFLmRQ4S zQa5Hig40wRFnTidkJ9ja=gLB{)WMYgG;Px{V}l92tZSrf#DO1{u8AOl+Q416ZP}lv0h41%5*ilP7 z$+V*Dj!TywEpaeqa?lSj*;lVwUp&00CTAJSS*7>X{c1k3#TF65m+M+Qx1co9-*HNl z!I?GmIo(Xj)lpESg*!AFZ_vdZN?2rMNr4>|Owc2M@tCrRYFy7#mj5e8)yic1im!AU zXJC$nzOgdDHOml#9E;dRSa8WihYlMFVNq^7zt##PEW`)`gN}V1a-VVrHSw-25#1dm z+7JQa5%KcA@iB9Ij?Wx%B?fOeM%s+g-VDy)>jPH`t1Fn>+GP7n>xd3}c(sd!>It^l z0An6t`Vp1I4A%TBM%vP%qU2!5?r$NmtHy78_HZ#>xsh@nB@S|fQ=w^Lc@@tcN#C^n3e#juz{LChh& z>O_>(hz-O6emoMW)d#vgL5JyN3ilJl7gpRQeoF+g+{-s2b0hIzpKv|wI(_d=$DFI{ z;>x<5v6_P!+{S>vr75ug9WcIq-C?) zy97+=$$c0E#v_aS0}=$ssZ~W$&sU0kiKqx0P;=U)$!C}>P6gzjhDTf*J@8mS;FhvL zw`&WiQMob!G{q$3Nasn3#sCU$3}!m~N$h!0f=+ZY1{=K#I8&&h|xoe z&K>IZiNKXLmIW-R-KJH!@s$)w8L3{=2cugT#MbTNH?rjE=8(2HEy|%eGCFeKvFbcv zOI=)2to-c_KK_0~%ll1ydysZrc7H;$xs3LyT-=KhB?fcc!#+5aH|6>Z&uo`xLI82- zM8;FUM^DuM{!tJ*zVOZH0B11c#w+lw<2+i1%PSk;ZAE0$3eQk5#~c7pw%6= zr0FQ|{YzLuf zHw)-5IgxutK#q=J{c(72;K`rE80>7>t~*xJcuIRTA|KtrH4gdWHdK&y{J7J4aifHe z4R|J!T#U-}0XFUi$;0x#jP*%8PF&IHx-$=sr$ZzpNc#6E^Icd0=~YyKmDi}o$7u7=wb!e58U z_Pm@V+5XjrgTL|idxZ9Hsnr^en4pxk%+f|67PVY5ne?HS3t`6KDE<(#PDz|}(9yk_ zy7sAr=7-80gxK2t{005ym4%oTm0@VHh51MjP(c9{T8T?^Qtv6Gh+^7Oe?+Cw#U_Jsm!!NTNAaZ&Cy`M?&`%0I zhpc&CM~-;9ozVtwGPM~=!KxsIx+vdZcy2K$0~e!HZ4ey5&!o_mgYdhdvj zdVtX;qG=)|k^%{|V?PfQPVb^0KoItE|MIl7lRb!(Ft1qzod}Bnk^KAWh_n75{WMB2%=v!VZt~GF`vX zXr)WT_2c$!nQeDW$06TU7Jty{th)0*WCdOr0i;Who|2NXTB{{0Cm~BMCy0#k~T9Wh1ni z%<+@~!U$sZ#1z%BR$Kh~R|tqk&?-?eHkJ-4w*@|XsHUbyi$p=?K1A(4Q+MCk3p$69 zA!Piui7MVjy)-@J9MS6o&e6v3`zc6bo7 zZ*rz7EcO+=m#^KkSyRK1M59)T3Zalxt3jhFiu_PAZJ9cb$lRBG=(3ZdClv%ENQqx5 zX1iN6vjPHn9nskRF6C-5&~}qc8Ff6x8R5h;Mn2cqnt#LCpIM;kb*4}*Tj}}ldAi}) z9(&X^PbW_|Q=>8RO~N9A_8*QcdxmtE)QF@)#F}b*`s-6c)4!8_bJoWCvC60)%CXsQ ziz{z?CY8j%J=t!_&sV-yzijzVT|yQOc_;wm0@FGr((!qk!xF2}86K)%8Rr!ihv8e9B4l$3)RjZ#T&m8eK;*x^ff$BUHMzuG^F znoH3kC2k5SUKV3IG4Vc@H7{bnPq?-AK)6JhK%-`(25mkAUp=>>A}(B?kQuF>aLL-2 z8I{b?K@xmry3Jje;6BM({gQsoC_O({Ow!d?HKO|g9oLto;Pty=Y! z>@WMJ|JCKlFKZt6@YAg*^|$!pIOXKvsMYDoDk>sYRu)n~iHeGDxUJj%kWYWUgc;^M zQJJ59yX(Z@rK>Hkhqu=aSTIPiU{{T) z&1QSv<)JTz!0NhyuQj})pb&i6sWso2_xZM|zBIrf#Qybp@zV{tkCKvj-CkK;Tl!lP z?*+e7u(}KZZNC%?0>Mvj>%?ZK?@88%((-WOwZ}`JKJdZlC^mXn+co43FLEe`1Sd#} z0)=34eX1Z=d)2KyvLEpVBTHbSo~RKA_hS8yZqy4rd}LD22pQQy%VnS+VZMh9&i8{5 zAGeb57n}%)*RSB^CqAI4C@jdmYrBGug4{2IjICuaE+Hf~MN%XvMA)Z=rDX}(?DUAb z=#eZdD{b$SORHTCSz23N-R2c_hvG_LqvVLTXc3^#mv?T?4r5~b%WBfXNDUf09wqMZ zXPm-TZV47FLX?Z5rjp3gG`&JMc)613A6(yjbY4!*b~e$3+;KdTLnPIKL1J}%YWLqV z$`d2NI(oxP-^{uY0mmWcx3}f(#gSucbaQ%F<_I=6#l-94%WIKOD~*mDD1?(pxh5wo zEUx;uw**v^;roFSf09F8`co;_88^SN2N73KDOrcGq6=$OuOYsDZ*O*yICXioHF-pC zaSTdzft^(x&W?gBIiWth?Q|^5WlY=qvtHUYFOEu+-?(bi3h;lHmvGBI4)Q%%JA3{*lRdH!w)|S{@ z5Y+u|Y|?Dwm%j-S2P;YMU}`{4(uLfyT0Y^%x?=gh8KrTv^r?=MaTe zP@lTAi%ZLY{w@joy5iyj;+E9q{VkRI@ZWrO`RRC_*3tdY`BSOY_uM)aQ9xxEBI4u8 ziHU)ASL8pKVS=ZoWOV3OBAXEf0X74?>_L7y)54&5noXJ4I{v49TcD89qIhGM^QtJS z+_o&81P~B8c^ZCT+Blh>uLn>y7u1#nCJ+&Y0fsOnWzazp1Pm`t0Th#CdwmKL2#BI{ ztf;EYau3#dW8R1&B7h7oF2Vu`q9l@7FKl(zBB}D>{6I;=K{QYpSwbqjnLbPkaK;9! zpOpOABYg}$lazHL{d0<_k2#RNN`EOz;oSe|Ifk5FG5na2>TRwM)f0(Pb} z|IpvT!T@8)@P{oR@cW!Acx6|lV7_o7(m)A;gv4^^D3K&GxvaFXk}HgW2=dpdc?F>$ z4#j!oiJrLfBJ+%70*!_VAPj>Gtn31vK{I|pgiRvi{M?=WPMJHZ!t0-=uJ-fQ9guq9 z=KvBY;OFU`ZdXAO$Y>hE6DUR38$T8p7(tOVQ;~j*mwG~?T&Ha~8*1ZJQUUCCcNhT& zW|P~M*Iigm6`oshJ&r{g6^EqW6Fj@@y2jI$-lIq2&)`SCIaG>Bm<|84KE9b3nHtbJi!3IMqvYq|NLNwJXbYb>>;KT9d&y)n`mpW01g)&7 z0tI%O)pt(vy?P=GIWpM&nEI4hgKb-SntG|gg@q&Yyk(v|fvfh3^s=Pg7Kk8%{mbRS z7=hn8Tv2`n)>7rzlyiKpn)8Uje5UX}fc+eII6KA`w);gn&#aX@Lo-_D$EH%4PkgLp zO?|xYX2@{E@yvLMS)}Rk=&GZJ5?tp4Z{OAVY~lbK+@ImMY|F3e#iGjj?seQAMt=T> zqvk9A`}^Vi=G2yTvEPhRmwQqX_LD|%hjMa85x)#wdzYte%k!jsLSS4J1|~)xbl|uL zFTeYI;rvbn7mGZeQ-Is~yF-elGVhCUF(LB?>zte-T)l<(KJBY?hh8hJqu zT-6VjhzyHJ{E!JBDIo+9=8*LwnBp=-ka*y3nnk^B*>v_d^!XMF2@WG92?+?n)nO1XUbk<; zIf-ykMfjyU@2 zaz1f#mC37)ar;!`PKh;PP(l(YfI#!>O73f0-uYWwPJA>GR**I})KBm4Kr2%{u4d*} z-TBAA?SuOb+LP&KTcCdOCJ^8dcDnU;O6|Esp+pc{Yu1fafa~k}TI%=!dC$OLvWZyu zdime(RCTu%KaNGB(UQdE)EHfyY*Bo?%L4B{=>w-AY zD1xy&xEICF6k$t;WHTs(+y~t%N@j9%Q zGkH>qa!h7FYmA%Q-ki2TA&EwISAvR^WB!R1Cs>B^_`JZxAw~d1x0s&A%q@BJ%+Kdt}Vy!5;UkLm%b#0eN4BK=bl_KPWH*#+QIDZ{67$r$*b}S$;QRFsX*l zK{06|o83{bKDY2HvrC0*T)=ehXqPK|laCzUkphHn?7Zs(s$at=i!Wh437VqcbrBCE zb7n><5|&+=)pqs;$Hs&Ni^%(0cNf>6k&6=RjAT85q|aqJjaG8z^Sp3PMt7#jq^M!k zy^ZL)n~|^k2eHE5vZ>e*TE1*fYdoVv-B1l7!MQ>gT>o73ZC=S|`))l22z>$pippP> zTy0->{xDV97oOQKe<~q4WT^@=1{@yQ{9ca`xp;cLKo4oJau#nV+wEl;dy29>FJ17z z6f))szgMlx<6I#ihBqwS&!RvwLvkdmJx&ZKnl3UxASrqJ)^KOrd>=6tbB;dZ&co|AxRp1y%MDLvi&lQxhTst6( zC7#_Hkx(II_$wdHFY+g3O{R5_R#Z$0Ct00uqV%;w<>`nditGz=tcs0|| zhcJv@s#Mf$wveM4581G=x;1bOu;B<6;3%>^YD5K)W2Pv|5cNaL^1|xAxRYr@A_*ea ziSZo1u=qe;hFp~N;L5^iM2du-AfM#ceb?&+Use{k{gj@j5+&U@@w}yA3@FBl#jk>6 zB?4m3F&zHPAQEV=_VkV{u`nSn148?8<&R-vQjb>N$=Nv9J>=Yj6mb zu2`P*nA*2fd;7wQQTQ8_?v26M66 zEh>*f0sQ>EqpkTA*SK5!+C)q}Rbe9?P+3GlNe z3oP=>^vd_;@gzUS*AhEhu=D%A0tF*NYR2#2;t3MwHFn~eeF~8;+54vFvxXytG+eCC zl{e(f{tFc3?UDf{@h$m@we}iDWQ5f5F)W}3y}?^@k6Fh_3&#xZNtq+;{{83SShs-9 zu5(6Bgu1-Ngz-zDNFmzT!pKUc3XJ|hQk&j5e|Vr2mEHw=KBotVN{$mU z?SxLQOWW={pkk6l{=TeLueV1=Msk@kj#=ze`n~S0FFuGzP*)plHbODk_zA^DqL4#) ztZyBsqHmQFHzb9#r|$ZGqj$aN5%W=|-nGa#lC{OV=lcchix^suKOd{P*Fi|T%VQ+9-m4`bvc8NxMlKLW46H}orW z?={}xyNicJpW8|d5K<_k6qo)k8rK}MRJO31Av)*uH_6bcj9xQT^h$VHXKYvpT}lW} zDedokROO@uuPTqz!}K-hidnp*&}zy1_U9gNN;$Ly5^&4ROpmJVgOdF3q`-KHdXY6r zD?h;TOQOUpv_Hrr_W$DoXw^lEj85nb8LcdPDjPEz31vj2%mk4#J1q80Icvu&9AkU; z6#eY(Wcu^k5=a+JXTDD`+46C4CLi2f{+Kigf@~Cu*))eQcQie?{Xg3NvaPP3?HY!G zLV@D$?(XieaJS;_uEnjmySqCScXwGh6o=yO?$0{TYrEfn@P3{%$=s5eWY5^g7}5Lq zM0Q-+C_X$&JYTqB|26CR00o1&o5(r_Y*4wnD5mHwg)U3s z;eS5z??3v>Wc2vFFDvi@T#1^O4sTZWEzP4VGQpiw3Ye|IbnSxWVTnK=aD8-L@NfUF zS{K{#>bJ{Axu+mAxFbWnMG~hMO>E-SAsyLTKtp;-GwES@!rjsGfoJfxrtu;)qepIY zvq?`cjrZnh!yj_D+&Hv3o=W7C<>xc3HP z^A!ex%3T>FedJZ>jWw^=0oEl_Rq(vXLXp~d_}iJZgJ+Ka*Q>@$r@wcIxdqhOPq}^? z*m6p$_Ju<>|E{PJhV6sx+z+s?Hi``ae|{BzIx=HQ3RS8k<8LG-0n%vm$dcYC4|L@p zOXq$!o$pV7RpDV7Hx$lNuv8in`MyL5_0s#=YlQx7f4&esA2|pO>QH$p|4P^&m-TR5 z0))D~z8SP1fRfF6u6u1vD+}I*|uwssmMes z&>XG>m)hucV0@T-u$M}_=oEXwl=yU@`J`H6)Da^hTeE*A_YBI@%HZPS+eJ0 zfbf)$_t>_gtdwp@GUT*=Rvht?XGC}_$>-n?q4DO#OS0MKz)DkTekn$L+GWv)6r5g9 zRW95ctQG3t8y<2=Ty7WJV7i@!6>q`HpjxZrTHOh(TC=57Z_RFJo<_>zon+T{F)D74 zCfM$Cr_bHVtTz8~xgTgu-QM>inUznfOKDRBivAfO9cmzyS-Zr787N$RCfaYAU}wMb zk8pTEx;gHK%V>8bgG-w+I{G`+)oy{Tf*MX0fZG{DTHGpN^rQeSy6hpeoN9-Ren3nfszG`-Z*2qi81m&>0rtonn;wF6pQRr#&z z`Jge2XN@;{#XmsrO$;8&#KU{K&So3+)A>+t-r%e+MHSGsHa0zI2i8Qm0rY=Fx}9As z0qQg*c*-8tyN}v*^%Q~gSn(!N790OKWOf(9S0+hFj&`M_QnYwaZDc>Ao$LSpNU%Eb zh_+PjL>u;~<@f}RO@OO#S!(IG5D)HaZZI?;gDM+o+4=E#>qg zz*5n8Vjm(9OMmCW1i{rn)p$}~e-7Q5%`Uisvfh3Z9i1koEuw@zoi+9%!DH7J;`hG? zabECo5g#p_y?b20x}wk>Y-Z<7ve84Ow&HA+BWck&>dmrkiaAM0tv7CRs>o1=0s|JMI@ofN*UIi<@ak&sBhNqS@$eUa zhb5;CQT9yW3$*9UfnIhsUjEU!eeT;Il++si;Yv?DY6Ir6eWaG_Lq3a>2Y=QoZyeCd zwG+8s9aMtW-jDKedsd2(kn+JC=_RTq9y6e27P?X{Ejj z8BFPdTUR0QHzH{PSRr*jZCcMkGE9LX`cz2)+|TL;s7A8f4OrDWNi$b~SEa(j8b|OC z6P&UFdt8apk=Ukxu=?-j80ECbMewBz`c#HW0U9>zc{i=oW>;?(Je@s8WHv+oCQaL(X-6!Gh#T1O#k4Xf}Q%lIgQcW zv@;Y)1oadvA^+6WYM*SJJ?y+az@yvj>>-Jdy09UqtVxYUt#-3vBAS#UGs^ktsQ;j> z(XerYaee0)eP$pJWe_o|<0Jb;P7q9w>H7}%`8XGj;{tgxH=lEPP(RYQNbDXXB$jdU zYyt>g>I4`TsJ>uo*yxaT-VVayD;z?)DHIIGkFO4hszUz1eVSmknfrwIPt52o4TdL4 zK3kk2b>8@BIfRHDzZ@HXrgJIz+!OgmI1p~jIRB)`>gkA>@n;OYB5Ex%s08yj<5DiH z47E&SdGNl0BH&I6!Bg#44$)K$uN#){k_{=qL!ui;9Z+KMe*BELcziHSg;JxCIlt`} z4Px(p;{R&cmj8LfO87M|!)X`X=g#TkM=n$T!R;XA68f|U*LKz;xmtIL(qu%`yP+4g zttn;6j18Y>+559VSuf(>liJN=4^MS@x{N~NbOBu1ag%RK$=RXH?K+>;H)H}+Obo+| z+Je=uGx=%t4zJ_KRZRgG)^_h$X67G_yD1uQ(={h{d0XGpnLfuE<}JHAWetldF;wKrdO*qP23*QfF(dMr5!$*ohv zKf2Cs>5LV7CfyV)cy(mDT{U~-JU~VSi#;oT4*1L%BD6OKA$aWq@+0PSu49s4o1&gPATv&JW~_ifuu z_Z|=q%L1|4jDPWhFg>d=Q^19&^w|Dl`MiY-3qgRGBG@>tWFTL-bcd%_ zz_k*zI@PJ?vH!NX$U~fG`_252jSeRpCWG--v1yYdya=kJndzLjBi5DPvDpwC@aE%! zzv)zX_qsDz zp_(!`m#%v@;9Js{xVGx{%E$FmqwkD}b*C54{o38W-zQD(Yh_M`-5?|fvKbQOEt{mrSNlg3^-oOhy>NFP<~aFKu_kWE_M8>DG%`k%)ziKM z%sO4)UMM&mipF*uBdEP7nRE`pj2rt1V3Fi%;}`Zv0&@`|Qa?BH985+Mb*_p6vq!Q? z43{*4-YQG!kVjS9^SgWGE=JVKPA+Lq;vr-61{U# zx$}WJE6!Hy^^0(6Rk_18A_b#SWI4Ez&{i_7!!@XO84JSIFyv@_j*#s@y|mZj*sgLzdvK*K2nQ3 zCfoFBwW=~;;>HwXKPksnOoJUHyj}JQX3%+@=SBr*kZ`}y$_!=4XT)pBFMxMf@!bWp z@cQ$*px2V1%9?W%K`Vb0dv^m@Y#i;zrM!(sUhhMJ1Y|HRKIQn_e$qeKwS;ei5%c{9 z86V+3ptO$j*y9qO`Il0=^ZT{;o8<|vNTed=7GyZ3+?>&A);i9u_#8)!p#vHgE-wtg zKGiIWG%`buHm~pax5es`hgEa#xVX8WpeGIIeR?P{%=3C|<3r8nB0{K0)a?4&@8$E6 z3wE+o;tG-P-fNbZcOXlJggO1p%*dM0tBR z-f1PS=3i6ruj;{uLJtg^(ccFkc~7m5RUIih>oQFtDaH&n$mF}h(fvUpyP$tE!*=td zmy))@rKxV;yOiGr9uz+)%2dlq?^p zCou~J5RiI0(X-w1N;G00D4JU2@?+?YjGhv-v9s5ka>#K?H3{|4%xDhSn3TvMbpNl;@7P9Y$0`wQH(*Pvl^ z*g$lA(tgUqN@Ci#~k~7|L+?`sNuBT~6g(h#oORNzP%mCl} z8!=0W_O)a3fB2^o+@zBGx{F0!{)zcz<1*>6 zvq&Mc?DreGOzQmOzr7`NqwyuFj58h$Yw!$#)Wdr9bIpGG-or0ySi%nIb$;e! zeh4-r^kEl^M|bEyx{KZVIP;wKwou`BnD>0SBLWt={O-`x)jv^h(K8$+87f#HpM&t< z(Nky&n85}L`O=itG5#!juh%%UHa76g6MSO)szV)hS|0gx^CyYX*?ik=Ys26x%l~(T zlU#aZVCOQUk+%MK=TZBuPAAN1NtF)8>$NI~12ggBHAr*^p`LQ*Ebn%XK!)6gr988} zLi~+KYO0>QALP8}^#Ta|Z6o z1ivJ&hH!kz^&(g|+30 zmG-ek?W0F==)Y0+|HnAfKF^LI-}!)^RBNz~^}I~G@ZW>~x;RW~fnAOgZTvrTf!g)# zeZ)liBAX5r!~Y`aenV#6(lg#d>Rm@}WXPQskos^oVual_8a@^D2vmL$!BtOkp=lky zuJ-+lGgAQX{|aH-hy4F4*f5d^F#Er@9K&$H|6f4@b4bnqHGmE8p8o&Omp{Pc8|gH^ z`Zj^niX*NkEULPKlSE&n1}jbJx>fJq0=?VG=xGWs^A8)1hCgUpwx3r2uU~FzeeO|N6ZOQmz;u7e>#!#BTDnI999ot2YGvqDy0?k)}XKi+_Lt9j6W-x|gD5_O#kh z1kFuHNh*F6o)&yQ+v~6E1-T5+{{+$$TfT3pOI3P#?nd+D>8etczM`-5oURpIiArN`*xTTZ@R1u z1y`zsRQA|2y*}!#By@VJX9fb-5}j}8xBZ=%eD$FkO}^U*3PcpR8|(!ArSAAgZu3_= zS2sy|9s26_)SCkUCS@^F$pNH0Hhwz1ScLy!I^CW3%Z2r1^@a6H|30bp9OW`kFF;i# z{FL<75p8s9dm_Ve8RZW`;=#yR|+1vh9>z>Pu%dFo|+w>oVR8>SyVC$c|>$-#4}+`v!}ap&hS~JuEF@MFB@SGPj^2dohe_eVTQG z16$<3v9u1C-tEj%Md+8^8HL6IUTB8za-~0%jE+NqylEv@p*s;cuS?0ODOK??-x5nd zVa{Z+7c`m9&4?3jahiBgt=$<(Q(-S>j@NFMqINiW-?F5l;hnH{==R!OZ!;|mO7JU# zTsGHzP9VvXa2kh0^;BS<-ysWWd5NVchaBm2dLDlDeCGX8#fsj%Zjhy<s zXvWfO{$mMICPmw_8YMyklu1cAvb3VEc50<7(it$TG1(|j=G);Q0+}EGn6?-;W+num zx!a8xHyd@2yMRei(sR=Ntip)$r2kxA!ZzxKHXsgmJ~@nNfQnjmz4QIQ`QZKEP^rtc z%}-{iXUIG(2py!LaedYi!tGh{^v6yKnON*K&kRT5{{D?PP2`c1*RusXZrApCGm{~} z5yl`?vGZJE&xxL*l;{y&G>AIAD7U*WSQ%%KU$Pzc#~+D+z<0$K^>U>3`9_B$7+lKm z@cn^)oM?B}MQA^yD2>$+mS=wg9GxBp1xes2?k*~?JLt=;RzD6IyT*Jn#G_Px!eYH$ zL?W5E2L-8rMKhL0(2TT1tH{>>h2!5=HAYOVV4LP(U= zobli`&S?pgAxJhH7b4?@1{zZsGWOh+>Gr7QOAe=9{=XZYsq=uk_Mq(T_wNqpJd?y= zH1r<#3-mdeA@WfqI`rkAehPN}p_$1s{4JKOo>r{84NN!wlceeIcK91NxH<~=JGpHE z7-m*OYEbTT5auNkmV)&uQ&)tAztF44J?V9yxT9ne>vi5;bNL4Trn#$L#pRP3jWZlw za=14(t;mz(7r$*N=x@J*+u;TT)K&ln|Iwz82IY0cozLxc-Q8j;Jcv8I^!#s)zwW#? zx)n_peGXM{>|y(T8`cYaJ#peD-~?)vak&!orwV(yk+_v*4FR~Ee&T@7{z4#UbFzBb zFDq4LHDVnX<$92}1BhP zc3BBDO%V`qyp1tmUTE4jVB7X`bOi`xu%_A?N0fO>f~z6!gHB3*UuZKnQ>R9%iijMdD)DA=Vc{a!v34EkC#HiV!e4=a952MPxfvXLJD?I zn$MOBz_Qy~X}`W)}2Onw0;c`L57-DFEk=>SEh*L@A)mAs-TcvUdnf!5Y+d- z&GlX1=lK^?2Bc3nmFJ64ul#msn8!I&Z~y6ULWN8JoTC;!0JNICm}1662UQPn$XgBQ z6`x5k)8J`9H<$hclWSNuch{ywxwt$IZryK)4w^UogqMJTp$T#V+dxff_r>q_meuGO z-7cqyD>ubYU2x!HB!im7?ew@3W_d<`9)mPeO83V3^Zw5SjOEY!f~a%vkFYKm!P|P5 z97qw-MI* zzj70X_z!`pD}KB90)%v{PN)z+Sny4OnllEbQzLk2u)luRzs00+&!Q6W{aHb#YVk>X z^rh_TZq4kLG2aEQ79S&Yy&lTqpFsb(P)k)1O*S*t>tA+@6|=JgEKsV(qjsCyOf85% zpddB>_LF#5CLKIcOP!`-TL|&&EG4t-R{cr>tpj{#JRCkYlXfUjcq9E%!Gx=J~b$*^-sT{RWdnirELcH#gph z#th^T8!;6IYs%JLK|)RKV4D3=hv|HBzhnXtDDaT}Et2yEx^$H-8F_zJwmZ9fE@fcfpQkVXyI?n(7wUoGM5CfoCwdR$#? zL5hZg=iIjob}kNPhY8!C)r@^yYm+ajf04qV!O`W#)H&EGLcKiqEy^T-#ETB&)F7H;0`A1Bj&nL6STm2D7*MvPnxNbpwH<5lvF# zE)2t~OAoK2a069B5-Cc$ZnTR5IylNEdg04;)%(BVNJSLsXo)#?xCVMsl;LgFnR>A@ z?DkcuRN}pGMe;2gR9qZ$c1JjuhT_g;X1c0zO=C|M+)%LGB$e+}d^uFuQ(|A#R>Nlj2KiIZxGWzo4rh$T&7drGvKhb?U41k+ zSw@IHS_ZSaBhJNJzj)2YWF#@hHnMw+4qE3LH|fv+PC2mmMj*3t)Wcx>TQ4IWg%!f4?&PFNAwxAY5rVd2PBq(oP2+sD9!=%n~ zt=lwu{hr_=tkzjv`1$!oiMXCrdAPgPr@gD$S>9A|6jQp(efC?K$Z-YPky=dEpS*JN zHblOIAB)-iQtQB&YTYaGM#2&fW72vLQYVBr9wj`{{%AH|2#k~i*I4Q??eK&i1>P`G zB7!;?RLUgSByxx!>YcH7V+QnnCqIlDc*dy5$=wdsdtQJ}q^Oo&sH#`%Lzy^@n%uKu zU33XBtX_rzpJ0YDqqYt4$>$@+m~#NUh<4R<7Moy&xX9}7IOi9|Gi;bru+FF$XFX$O z8WfKI-oE1U2rWOK!DQ`9N-N`dCd=6Te=+?{pvRoa8-FfV*joPO+7B=`$E4BP!%oWx zUsvvHY8Y>7Zk=Dl8Z?a&Lxu?M3i6OprIw$fq}miE!{wzZE)FgC^{2za=-J6#5BrFi`_CZSF1Mmn*x_eK^F5RaE+4?NoLLfrd=K_0ZdmTY=6SOeFO*6K5pQT z9JL|8ngweHw;VRILvk|z+Uj-Ve@x9)=M(y(9d`~4;`M_=IusHGO|KI`|4;MelOFQPuW zD?`;;7d)S6EK@dPc(|y-8f<^6?R9fz-{67@+mdr=yN3+!5FQXOrBFHMxS+Mh&np9F z3meg<8u>{c`&_|T%MX# z;M!ot8X

Sa9_VFt0c8C5qDc^sKnEBzA2CGt*1LF*<8>;1+iOusA7!FE*kis;!eX zB6Q9AyAQ3`;*64Fc=GC`CaVSR!Jg`@L}tawy-BPh6`Mj?)eb*`?@raU78NFLG2Lll zmoW((rW}<3qr}WfW7DIXlE!w7MS0X=F0+*?W`oZTeW@ZH#rk1UcS(rRu!6NVE~P*8 zgN03b`-%d2QFbIL)n{&06XMpcW8MEy3nDTyvLH!9Pe_mlJ3VG+4XaEbSSF%f5elT< z@-L|8tL3Mg*0?`ZBwLZiL5wgk){s}nFlm$2pyN>1;O|XiQBr z`*!t1oy*jC58F+biBTNoaaHbwZ zba|rnzqm&uW?W=H@*yR#Z^dU(;_2P+-SB=k22+RU55v3&cm&qhlk{b6Lg`6jO|4u| zHaUiev$lB6;vWq#mIFjdAfvts?2@5(-aaslV^(vbbyVh`k#?X``cxEu3k+B_9tA`@ zvWFVF{cBpUO9w!T2y2i+e(3w`Ozwq{Qbu7!X%S;0qD5@JMslz24q;pkRYT)E0+7YQ z1u!WpBUbh{(=N@Du~|V>HxVMTp87Sz#9?vKE`p?LRBQxf5QSWxB(Wo~_v=V8q3$b; zzq2t`S-$UFw}0Em1;Ka5FZavCBE3FC5tY-Ol(8x}UmW(e%R}r(p>4l)f>MzYX?+$w zQ@mZ<-dRN)S>h(Dy>VuXZAn!X9Fjt|6tChxJRk9!YL;nt{_RZ!9z;ef(&Ua1z3 zT|0<`fHXq@8wCA-6MX~a;NYO^;jd0{NeK!Jq&;7sidxPG!&Vh#dr?6!KL}}fsCJQ$ zK)wdRY}~J67xXQ$&HifAMBe5|n&&Xy0jt0Mm1X@yWCpoEj^8e(&LO?->UH$jq7;|| zx#MQCO+?!wY_i-qiGG_K$TL0||GfBARN&iIAIDqdE58r7FRz#uSMB*9$(PA2aqUPYH5EWtc23JGu>Kv&mHr_zh5R|D1T&*0Ha*GB8>F zk$I7>8;M5it(NEyYv?8BL}Kn6-ok_|40NuG))D^??t7jkaty#I?KH;{`aBZg!XZUR zc1ie!Pb_#Xsl_xug9PIv*m5QQwfLx9(s-rBV4 ze=y)P!n+8xCXp<&QFBZRhEfVOE@}h$?^@I-fC%PXp>l2BABL=&@Q%R3(=kjqN@-Da z*G0{A!)F;`Dw)!HR^*0Y;(%J3p~8eLMKG@SIaGObQ}*O^XR#yjq@~|WZKkEIJqIkQm}i$mD30A|&{+$m*`-tHIHtfOel!(gtZ! z4Gc8`;7@2w&+5{!QUGjNE!MdtybLG`)I-!DKjej>CA4IYAa-2jTmm!#0t7zyY=4^zACT z1-CF1IDuY3cxzh6Uh|MTkh16Q8z+%vcZ0M7jV#s_v8%OEjJ9CPWN9KY94eZ4uqKhZ zH=`oxKQCm>A zfi8i)HrvyMZrp{Ydv|{wC|>NSStKWl zBe7D=M1}_(UX^|BBMO#3#6gLcszuTrvb3^7M+psBzQH2m^UA-~s6}DWn=00tDwxq& zVIt_^6uy4=;@iO{3fM93F?6e`=MYp$LjRjEKfJ$@>M{BbY^TqqR`oq64y$^bl{TK3 zmr;>may)f~8zh=T?@M6+-T9NLu&Qa?jm<>DtYcNEg})0 zSk|)W-}?~yY(d0Ue6qmk3MhMEU^w<^+2f)hqW&?J^}DYH^Sgqs0m^M$RBh22NSCAPxcsd;OCwzG=NtzH z2F`NZi>-$(!@_2oxs!B+oYp5YQY|e7Va7R*d!yHhTmw)U9ihQubIL@Ke<&NBE^yy; zqf5QI+XlkP96^0<*7aj;DLPaLCeU)gy49p{taYPKCtlC=C%whsAQFgb)NQND69sW} zaQX}p5pq!NyKi);C-e{=Nfk3ws9mRLfL2u zx#N@aW>y-GX9DNFFU=%kVa1n(7y2?457r)hPVe%J#HGJug4Kr)Bh?($I^Afx&T5k%URAvdFfbACFYz{GYp4${j`T^!AsGRn?lR#bQ zOvZm>S^cNYRpr=eA|fYx8;!PzJg|p!>ut^%&5krK7IJ09&MbI>PdtSBx(Y1_#1U3> ze;a(HNYN?^4G^NC> z$SGSgheMT1EhULeRY_$vS6}+GauZVDUDQjR*7S%9*38-ht2IqGh2?l#Ewx&&0B_p6 zx}t&#+zxY}M^LuT#(x8+TKL;rD|;PLIs4R5t=++>5O46)Jkg_t|0i5S?=5#+O`gPq zqM}J&S71uxe1+!&o^8#EiA0FZQG{OC>jqpltjPQZ)9t;+A*=ryqrwFd=KK6GSlI&4fcs4D{Q#2woN5<7(pl=&k0RDH@yJiJ1h))?q{QQ70KnwbZ4U-e z3470v48x1zuny$>;N=i^iB$`XQH}(9nuFmqu_lW(p8sdPX!MmWPg_D7GH`^ zXfPB2Z2ygZJ$#G356b2VqY`S2<#F*Uk9+)wFfuEL84pFT9bBHj`w&YS>w!XVhtHcP zS}G7WuS-YpOIZ|LsNeD2B&(k+;7@1j!XLrWD2@OZ-n@^vuffCzmlYRhwgRc(-*;i2 zFBy4Gf4{L+3+)?V&KPez7CkSdHP}m|T6~>>a+?YEebdnh28Z=aRT)k_Njp|m?cSv^ zaN93bejZI&2+U;|@pNZn4Z-L*r3Wi-@6S|MvtII>DUd(P7z+!@CtCc!Q2s3IW(7t~ z(whG*?3A*41{Zqo_p>isssM?4Tt3^_G>K5_vY5*V#dn-^-b!0`rh|I~yxbajNx6NlCmV-Bz`bX)?m@I zy(Z}{7gX6e(dg-WwP75uZy(gB-1B+cR5N-IU4b=j|?p!Z-}C; zNY9p3@xg7^sv!UBkftYq*aF*;!bX96Nx^IL7ZGHviXJo{zUoCiSOKzPHo`VeIZZW3 zHpm=Z7Qvg!8{Y=Y(Q7B$n1@EN-c<1HV=5H-NMKr@8O3tMhOi7WVDb2ZMmWH*!30gb z5a4jU?I)n)MJO%}flwCf>}Pn+V%C;>iiy+$grG+x$XkxGmnrnP#Qix1Bwb}B`+=IE zgxpWd>{A%|w=U^j8cjMrxLz=))oU9PnbBY6wLAJgrZ8iu{!%$Ibbq2apFHipsRDf@ z#Imx+oSR-rlM}`JOk|5^+1qN5_=02fL=8k)68s%)%azdawCY6D1`+<)JiD?KrI>~c z1*>Dsh(?K-n3SbxZ%%u|iSirSHwViq4uj_PleQfcNBMF6Zz$>H?rsS1wcjZS->PPm_^@~W;W;?%s1&H_Ewgm8jxjOzopGsl zIifoKwnuD*N1lg_uO`Q0+UE* zT$=0ta=RAuq+Nr3Ilx4N1=51 z%_fOqnNr>hTJjEH$>l;>8a+jvX^w_h_`zLKL(xnZAQ)4<2bEpHMj2t#mhD)IUx z>tgk4`_)AH^@NM}?86P+vXyq4WocW3(b$8PMBCw1xp6hKtL`9TaAaaHCOF&vN19$C zu=?@@TD3i&=^Y;4-RaBD!POj#yeHp03kKP=jhSE`LEPyJvpu}g<7=OMILWe35-TES zeLbYQT2fA*)F7Qxt*0kA>8ejyA))s}c_}ev4%EmhO|LLftrdyFm8n=Px5iE*n5pF7 z3EX792-!7)gThk6k598gg@2eoeCEPq?j0{JXQ26X{~2ff=5oo>rjHe+-7_ym;d2gO zcr)13HA&w+aA#g6C-Di##SJV(b}vrM))GnZibhNDp)|{pL>7g7|Lu-gS&Lm8Zg}Hl zen(j9=T5j6*-&JH(BRcO_dr5Z;0~#{7s}f zGGLWr;eJxr>q?GGRV z+M}Vkz*A zp&Q$t!898WF$BDNKN(oUY!yF6Wqkv~Wu(m>RI$2#e1Z$-MbC&DLra1HuN_@5g4Xr8 zi`lW|R8|yyG~m>t&pq9f%I*KeWs|OxF_@s50{~-KoNOoS&gOGY6nuK}upM!wv|k+z z>GN*Bnm=(R!Vu`gHEH5;vMzPsf-;XLk(>&jI8Y@(HLv@j zzIWL8Zk})n2E#%mKp^i5FY!P#FoS^N{-{g%Veque`(opFy+;7AH>oVaR^e&3Z+@t% zpQ`vXHmWk@4(2cC{QR2qW`7O-WUk^?bPByA@X|@2J*zQb z@4U8g<6}i7QilFMpAk%H@u`!*DTTi?X|0KxGzYTdF6QiRMwx;i;jygspNh+Z{ z*PWD^4fE{}RkGA4YZIw$ftJmCv-I3@xG|E`$enkHkyLSIH6!63DM*F==Y7`UPM?c} zkAJ%!9H62x`CviZB-G!3H@p09-9C*ke5<){eD#H#g4rgo3_rSCjkynhm_L_ol7ASoY+kh3$9->)}XDT_Cj3%v~04QBI-R;T!U{9^smh z0{P0~3$r1kGeaq5+HO^0IhT~Txut-q3ewVu6^Lk+)udVrG)>RkAlCNZ9i-W3wXy|Y zVy^%W^ST#!4tQkmFb7Wx?EIn|__gZ;)gQ|I1P|<$z5u!Fmg&)YWM8`}S2I%zXE5YbB0>iNMa#LJsL?;2>5dvqWk|*)nCyZeUK)>3lT1U`k>=cd z*#3~WX|-FjRJnYk?!j#7Z3_B$$VE~&Gq`DWdDIk`F2>A!M;Q=B8&%*SvzEVy!~l4+ znl+}f^{$9J=0mIQp#EL4_7s>^P<$h1;Aqx-`=A!CcH(-|o3p^znUfX3cGJ$xiLSjs=6{c|Dc2Rn!4EXChcX-ki_q zZG4sB(CeUxq3=GQa@~dS+pc$*r=Znf-5yi!89qfA?!}qS{`oyH6sVp&H3dk4*w2bbvWvn2R%Q`sdt9 z!anABJmp{tTSW&R#-h-7Ms@p_$y#LKRDpzJJZ8{X7#VU=Grr){{?(U7pzjqwA=(W! zNiSSkD0k-{2b6FiD7)eXx)+iS5EP673XB8JpJvxDNQ$jtD6w$bSBo_vNw)~KJHsOU zkKsn6`517*&_@=oC<<|$%1U?G0XL5b$jSJ{7FhA7(a5nA;pTj9691VCG7~4n9|GWC zZ@w3mhp(uxO0`%=-#_iB+7=%jC0gQa8c~IXo?IM{P{sAs(y=5Ilfz|N4_R}NMC6YI z!MpupVRnAN>ot|8>?Hn{25$TtoR{wvwt`sdCu$;EU8E8JH~qrEkm6*uYDk>hXyO$D z%?On1803Y%V;M?{{?OC2vhAlWAvbtRs!K>Xr){v$RtkSW^`+^?A@`OMQvx@!rnHP= zKk8N444Qa9z*+>{3K314KDg{pjNtYG2GUJ;J!*K1e zQC3$UE|t%cl9eSx{}JP+(k2lI)=*eqHv9)#lQ-uQ%^X_!oCf*4#L{dnk}K}{+i zW@X1MDL+YkE7>D7B!5y}k!(t7sK(^&EHacYj$_R?czIeI_bUF2ce89m62tIBHTb`Z z%vd|6XBfq zJ${|I@@~Er{okixAhkN#PD)H)umlw9RcibW$RB};c}@@l4m7%R2v5~6TMAlw=nR{I zr+AG0fz|*u`fcGGeU8FY#C$TdpyG38RFj{paWp(aJ{AM$4_*%1qLnOL0JV^FNmgo6 z$IRyR;)R)NVS=U3&Li`5llHt>;I~o2<@A*4d>$!Bjw#N(Rl6Lgx+#zG@`1dMN?J9KVO%=}SpRW9B!<>V0*%H?aS`F0W!TQz{rg*s)0y@Qm8{ z^UEmee#hVcIb~`cnz#3ds0QY_IZC|{F`D&QVxY#u@ThBfCEgS3<%W>1gi6tO@TAf9_MCuKaaJJ?WSqDmKJo+?Wvoy~f>jA|CsAiq)-9_GV~*4WAk` zfq~?F6sT)zfJBh9c@I)A!wv~AD3R)W@$y~UxKT1`4i^K2><9$lp966|Gi1n_sfn6kkqA3JJ}zx7ixctR z&#Brt8vz+3g+B|rWn!OO$#r`&u(<%E@8L=Ir_3%cCd;L||GLc)1zM7t&C6G(^JJ{r z{A8wB=YJFj-J*3X`ja6?bYvKsk2=$djf*Kms)Kpp+E7T3fIxGU;qcJv1^Kw3$Og<` zv)^*s1A44~x6R-6L4Iuv&qGo_7pJc7ym_e*jFm6qzoTNy{>vjgbV zrY`p&XrPAoHS&r^;KETweS)Vmxjb%OtR)&S@20N!hYGdK&Uw0nT241zm-uK5j79}k z2X>}l7( zb%4D#2h!flvd4`u*>0Cvc@L+8y>~*IjXL}iOV7g-QoZ3EH{#+GvbZRIrO9L!9?vEr z{$_5am4+RS^BzdXq*i~JOR|*z5gx!5`%6 z6#cqM0I1!2!JMLztE44YYRw4U4^jJR+E8@?ff6H2fx0D%jF4{ZXN_c6dH^HmGF?Pn zld1Q|uGn5!OdWuFRCD+^EWP;IOLY5w!^p1sqtW5*M{BkAVDu}IOZnI4sHtML;bY*q z=Jb2wa;^ZtLRUB$QV9bcgLmelsH}gWtwbTwoQJ3D0jgz5QV9bJika$&wO~y>LM7JgxURmNUt2e*~1q16Zk>L9e| z$&2r^G41Jtme!wz6MJMXkMC7sxmzT_0|V2Gb6b^c%;?N${-0KAs%E=4+$>rm$`W6E zgi&Z|DRZ0RwWO2^ARl$U$-mt}N#FQR6Wu9Pt!o^bAe<*g{$Ww9V?rgmhsE zTm~0k+-`_$dLA1v0n2TUP!$;pTs#&9VKjV_bqA!a`Ch1rT9Xa{^@SEx)Kci+PM>|N z5$E+ZL$GT!W){8S<1Ge#dScuGZk)=1pSE?Z%EI4KDS8?H@&X(R@*?M)ndShV_CTu= zqtm!WmoEF@fy!}HJaBe)brI!7y4wD^FRryJ)s(#HuB@Dlebe^d5;({U+Ft!O{^8IIz2$vseAn=ep!(~dHE%}3|4ZlD-=ABm z_iFw<;D5SES{V)e93|FRp7d<)+(XZ)q?zGt(zyD~J0u>@uU z9smAGzB6oPCP9`&YEqb8%M$Y~0}63zbVfq&3jH`a|2@K%oEp=?&_D5txZU3V1F<7> zU6J_};fb)`Dzr2e|FXHWZYpRQ{yzW`LG8YKyBScyjEtH+kB6Vgp+BG?s1a&k`ynqJ z30#~O)m=`-+kJ?q{P|N$+33sWvxFK}{3ztvF(R+fU=Y|Mh&+{x8Nv)hrwzrNK z&UMl6t;4gZf=M}lq^bE`8lJxc@y%;*>?fLJGEk6~M0{w7!OJ2OMe!4j8n9R_yuF{) zB@xd#UVi!)cvs)T+DE_3P2M&R?s|<)d+P86$5y4i?ej9mltgx6KCVDJXHM1N7MoDF;E&8GQ-+jJmL<8N_ z9Pa)=M~kjp7T@&{%ZdUV_~jPPc11qo@m)zUr!r}335us0At8wbb2kIA)l8n6%S+8c zU@T*G@d#x!izJGO?~z*5REuRX0UcAul6_7R9M1<@;NNH z>tT{oHu0P1_tX2fUR0Nu-I_n8G$KX%soDDm4epg} zC`-aW9KipcpKqN`r~7bj_y7xlk#5eN?&ch)X-)ht|NP)0W^R0q3yqiE?B4p*-jPQ^ zNj_zjcFgxCG6O3qIr${|ibzj3(-u(BOG`Hay>#-;ZB7(Px!+W=L ze(*yK>;@tlEI8eEgjf)NAad<_NLvOo?|6XK#WH(;^)sG7)b<`Zo{xs;9#3UKBH8xa zc_L#mG0918ej4hO$)s*PfQAu^-Gbp_5=X-9uwX=e%aqxbQ`u@fPE*Gqrg^#KTA?-u zU?VMiCV44dcJ=zNX?(H4R;mYEsXo!dNZL19KckBBoyY0z3|_q0ue|0ZtciIP7v?ZN z;TFD>Ih&|0i*ZE>boUpNEYzV20z!C@*4m@|v2lp(zy2m`*371*b1My3G;qJ#^t?`| z(_On8JHRr!$;wF^Yl^BN2u3n9?D!kb(=>P~C=nzB7MmT#c*JwJh85ffj6F^deB7f z#4@5j4}CqO&7MDc5{VNgQ7km@#xt*Tv}1^fW+Qj{Z9Keo0gH?GbM$;Kv1Ju3T|b@h zxe!vubY|oTbnm`E`(@3J4Q3m5i;0VuUOd9!k+ZZdznS~)I?r$R4`OuZvt~^>ffLWL z@BDj>OTb`HCMz=qr&&Z%G(>9_X{IQ>&Fyr(*$7&={PQyQ!jg;3vJz4w^=x@|Gy9u{ zhzm(fTCsuE6Q)p=zlVCkh}mYx;kJYCINJ_hVD5eES$VRBo}K3j$fIL0TI|>~1Mg!q zs7|NTy{j8Lz_ORJ@Yc1=D0D+yMG!#@o#)p-`U58}o61w7LHfJeQT>;uDUuV+DBTV0 z*tv~!O=FL3jZ;*f!?@%mtfmqA+S@Pi@BN_%R zO2@um@w3+&2rrBLWs@5z{7QVKHbp%a?H1xTTn^QQD8}WYY_~ zX}%ss$3&5gR100zhuL}LAkE&<3!^*Wq@rRSnWa|RHvfTNC2nBD7arn~*>UXlFz0tY z&+lJ8eMQCdkf)1I!As=g$0Uxgbqi1Z#LRB&h`LB1;`<`h%347KQ zR^ELxl^GUdVHJ~EroZk0&%Lyh^WNCl<1`}vL3(>5_{TD?SWG0^q4Vrfb{;rH<5Ko$!H@UIy#IDhg3wMVb2zJS3N|2VJa#1^8|dLX$t=ScDf>g>(EqMr_{UCtx8$AS7e4JCKwS{DCMc5=NVo1iMJYKTII1fgobC+OZi0qM-oc z`1=d83^o@I6GTEIL}FLo6$H_U&FR9Vj^G=KUJSAf78g#NKy1WEF!uK6l&mfi+)f;3 z0|)|wrV{h_zb#PHT_PE5xRM-*(Ewgw_!`!$2}lMT3CT{(MhQWXFo+_8s1ObK85;5v zy&fl95U@Ivu@b~L5=I%jWCY2KBf*U^=4B`lLo_)^PEWxu2?%P4p#jguqP1@_Ig@aT zG5jMV#IJb6R+6$)ahW8LBLuvIcmmf@P|D;YEj0nVNkmmaB+kh2AOrr((q;k}ElwQf z(a%dLrXffMYz`MjHB2CQ*?ThDa67H2kpN-UjKgLi9`cX<7%}2VOu{Ax@cKf;WIzzH zIuo&KL3|@o6ut19PItqqs;XksrcI=!r4b5+M#~jlBS8RJ(b&`Czrh2nPa&fvje-fq zKWxc6M*|(9%7u@9NWihS*5W zo66#~Q*j3(ms$ad2FyYn&-vZ-_H;2EdWV#%PN&m-M(F|8r;0|{TgTRCTi9(B-?DR2 zKtLfD4HMI&E8S;`mkTF0@}t^K2ydBr697ey5{~G7X>>Z>=ZhX-eadKRoJc6n^{s}a z(|w#&5Rtvk%-*H7WWMrQe3mQIwYJ${grEdjtq>FjA_ z#v3`&XrOA@5~k+4hW(iGnt`d2dN!Y5M22zTDzJlsTKrbfa=X#*78H*TiY~kphQ*^}u zQwHU8=P)BH$g!OVIM*8-8<>Tp(h4S}#A!NPPlqr1p6^4a)9F6#ZuksV!laelf6IK* z-A1Bu1x-^?RTU7hCYQ7N-uqcm=^`8!NE^492fuP3a|>;Nnc|tZaQB9r7?&6)tfnw) z?Y(?y!+g^0fRx694PWBHbyc`b8YC95aKnA9pP7Rsn#ieK${p)hP>~L*F^OqQzrX`` zEhR7U8e-mr0_HyObskwalYEeK9ur6@TFCv6KET2f2Oy9+ZW)g}eh;&YZ3Lo_GkXp9-@S^mBm<~c(x=_b zhShV(cbl*0Kj~+L5$E_t-1D`s^QHUllnq~gjP(l(2#xp=bEmWZ;rm!w>;{aKF8BiX-9C?Or$RWE!kpV5 z=F!`xVK*5t=Pu-dhaTdt+b3ZMoEhb;d*bWdyKDi4W4)d&+2t%*b_e&|xty6*Ww_rQ znCKvF%1zw1dOoGe*Z(}|bUNMjcEe||1VMoAWBm4)zvO)1<%>iFBuPRG4pO)MSN!7T zK3o;+_>1q{!!7f6aVALF&({EY2wcIH0%H++5G0?PNEVZ?P4x2-Orf8$U2 z_t(!5HfOW+?#EcMY8jI|HlnH;q3#-X{{F{os&z5*zOVD;`3sqK{1olOeeW@18^yEM zvwlf3y|4b9Uu`TB=%JKokc! z(^rVmQb<)Eyxy#UrlJWFreHTmHa)`;VE&&>#ckQnuYdL`ZzdTMa*c?QA#Hno$mADhRaeA&46Bkcacz8nDcoNvYX_rpd&jQN)A{%FD9xS8wN! z^ z)A(#IoDRU8L(%vQB+ogv?(WB)lgGHC#IccSXsSAPeO&j`pwsDe*WC@D!BSNjwO|E* z{ew#UQP5%msyF=;zdaI0mSr?YCbRGR0spcLWdAUA&;27W?&$&&(G(fS_?3M1dj+iX z7?FMZc=oBy)c8e~=caC<+0vPD&-eM4#WJ$rPt)`N$i{tLWK3Q{wj@$LJan-} zmmr3SL}G|m3r3?rOjAeq<$tbdcsmdB^S>FyG*FN48jp(ldZ|0r3#LqREhaudE6NW> zkdTmxw(sY}_~k5}S;HR(MB=iF(`hF?!H&0cfXiDmN238$Ed!I)#z;JZed29==lhlP zdu?d`Kl0NTc5)%0k(`-|%^zj(q=(7(ET-~gh%;wmRF+sVS;3T*Picl3&!ID%s!3<+ z>Ljwq6_aq{I9@%d(&==cGdFw&OAthaKqto!?Pc?pt?b;rkF(vQL6Im32=O3YXAf|w zp_jDc9ORB>I{g45f*=wfYUTLhU9=lr6+h$srg zhC4WW`Y^3wkyN*duBHyIy0+J1#$vHxdZ!zb29anSMN_ZHJZWfSZEiHsB+RY|jYp4i z!6%VdR)RAob4?R7f`A~0={|Rm!}Xmc7v~~$wb1F;0GVi9MiMSvQX1M=wo2f07+H%Wzzjs6h? z5Cn<%a5G2uZ>P(dL4i5Mne!gvvWUTE#W2`RQ}0=N4AUqMpW|G}fQW*Mk<9!Ok{RNB zbrbQCTI!kuICIJYvs-)3lML{Gs(8%%4uknj#cQcT)j19}maA`iy_Y8r}f!p|IlF&|q ztBj1)5F`F!L_tCxZsWw(=XvJ0duVq|W6i3WWL$0i_fRL@Eh?t`BvRAfa%+}lI(r9* zTWzF^my(k%R~flk3PFDlnx-Ne90=h?PIYRemP}_#PMo;PRi|bIK|+X)(0yhr8=rlF zP3J^r+;KnC6QQ@)OHVXLvist)Wkj)*yzE3ob%;<{K@dlar;ctS&;g@U)MF9M$97%> z2|lxd*%coQS}vsrUf32vi=Eq4OT*3QA& zd77h50VJalgV~DBVj$3Vh!agiGZ+wKcUU6W6oh*2R?CB_zp6`ux@0 zJSiRVTrHihsjOR5Nup80kW|9b+n15;t>NGiA7DT-7_p(ya=4zbYNenuACxPjD?yYH z-?r#lKr|Re&qu6_llwN~$zI92o6AsJ8))fsP`+|0v$G{6$xPLnHO$M6a^_ea-9ZCp zvxF#$NJb-)Bq2$co$Jpmk;L4EeB+;g$af!@N8;5FxJVF1Bysed2$G0sG$M+^_04Dr z0-_{gGzf%8`Z#sCox-Y8tZq9(e=jZ79-MPla@(vFBuOH9^3B|Kb0MB%$EfzISj-Xz zg9(cTqGx~4jur!R*WN)zij$n=B#dS=S|rFo>p5CIQ3N%D(UeHa_(>!s#p&GfKm7PV z|C?X^>S_M#H#=z*vY9%u04H%21Vl+hG8!&jAJ={1zfPyqT^~368Z1qY5zAZ7-~69x zjKn~c!(7<*BmQY)1B$Am$}%b& z9mlc8Lv+9ERG~uaf#33Dlfc7kAL8%-^M0bL$Vl66p8L&y`r7yK^iP~T@{Nc2m-&xj zHEKk=Px7mOd!EKX0@-M&W9ze&z7y1j=d&y^k7QZCqQ9Z0$S8{XmWe|ZMV1jY0Z`~W zdz@`2R`JEf%b2tKr)>MxZ%O+4J$&P5&!P^55!D{H{^l2KJkm#8aub&&k|(a=&;HLm zJYfx^(ogk{Kl1d8hZ&MTyHi9)YYIi>6(sq0UGoRZ;7DcR-G9Oz^Cys&Xu@fLum0as z=I(x#-#xvZ#_LrNOI1;11x*w|4b#_ng!ZIm%oOUd8+V?}mYEy~H8i<$H25PE?Acz#?} zIkN3Vj?|28B*Oq{s8IGuV?zNp$0|NTVeiG?mD3HyxfZqR~!bvJ*xI@r=lT z0gF4CWSfj{z(dTELXus-!9MzYQ9#7v zOu%Uq2>XT@iD)3%NJw&HQG5&xg|6PrS+tOto=&pEj3_|d*GrejPfP|dl9-uElGB1g zlL-#@(=|APh5=hb0(L2i-xDATm>fx@Bs)=k19*HP;$v}+H6b0BFoMSyL>{}hi3U3f zDNcl-2TvdlNSIy8q&PJE0|Nx&0v2}$85u52szN+8L{HBU5fu==TKp498bUMhA&$Zlti6!J*(aHR2W|Bkt5JlAUG*IZ8|wF`6JA7^c79N8~!K zNfL|>l9MdNy2zS!Vkm-vn1ArHmN^C-3CY-uVSGaY zWOE|v$!_ds2~7|XkqP>S7#Q>u)7NO}bh?j8RaF(6Hf3|11tO}zTz|L{NCYl&P-nnb75>2x~XCqfUfK2Wi(YL5*m5`^^|lvold9IeQM}s8g#nP7{O#E zB`c5IR5zv@A@`kU%l8{DjZVrjIkF5s)07gp^*#!lp+CSEp{mil? zWRRDaO@j549*ORgaD!*COeE(QlAE4_-3Wr9685xEQ`buj5Y0C7%Bsk5C`4m11cMc` z;-|BvffkQMMo}R-)&Nb-9Snz5L_;E31<44$UU~;ch$CT6%w}9sGRj~F4ef(tyX7Pt z$ywy)XOmztV30H-z8)ISH{(^D15I7{-gPIvh|!%zNp2#7zk~A~UKGuU zBPpGpV`c3PmK3scQ!qw)>FD$lm29Nu6_9QW($m_G zM{tvsmrrhz1EWCzK|~&Ep}wUHZ|Kv#yTL&(Fwgp2H1rv(MN^yX{pN`fG zw0lOkV7iMJaPKXX=-Kn%Jh!urk8V`&EunBJkA8a@y}x{v|2+KBKff&@owOty!TweT zMn3yndGZ#1k*_UEVEZq>$1AlT@pqBYN@_+Hc6FHEz9FtxWf$ECCw=dG-}{~l9Ib0% z%k$5C(&PDrv*{eC1z3iI!HoDC}%vS$4T7EQ_} zKh4facOCWK67Kr*@A3VwOkudThPnXx{_Z<>FeMw# zA3cXBrh@2Z@`^|J_FsI3MdLCkDxc2M1yf1V`f2DhvGDG%@$jmA2J5TGZng$8XKvuh zC%?!9wTm-#ZH&B2fMs$X9+{m003ZNKL_t&(bNiqEZ@#j2GR1l0m^5z=OO{T<(bht9 z_t5Cnqhlf~?t7BI{mwGn-cHWev=ahwjAz;UTUoVaCJWcx%k7IR$S)|Oq#yx*Lp_nn z_w$!un?nD~2WV3PQmI<`Wxn!25&b)k(DAO{@@7(}-^<^B|7)xn2h~Sw7!2E(xcC7c zexQQ*=@VS=E10t9aL;2;@~!))p!T#;-`GbCiKOCnJo%T8v%DXj1PNE^Jl5R*6&_hOgYt@U z#+4P2Wb)JB(N7@u)*57&XptxpA%Srf`3U{ZH1>>Ke5|8#Enj=^RXFLUaL2k;tXqFKYv+|yn43*vyp8?mB8*@AO@8{%_fZ({;oylTqFN@4 zANe--Es!~TMq>4!eV4DUsvbI4P62JLva!dODIZFX{~F*f7!Jrnw*r*SjmPju4nPg$y8QOVRCUYil>?L?cNVv z0>qd%lgFNXk~05x4!2ybm({gPE}72C_4l)U)&wdl=Q3wfF2+a`E$t)3jcz8)zLN(Y zUdO^2)0sJQHf2eES{pj>MpZ_JW4Mb-DN0soZ)n2%PQB`{16#@jrq3?GfBZF0c7OEG zpF8IczI68rENwfe9r);<|KpZaI+JPnW?D|}rD53tSXT?U)_jL53oKm znVFf~bI(24?RMhv`1{^PsA|yWjo#=PEI`#b|H}9I$6watBaJ)$;oo`aiwk(I_BjIH z9$x;pKVeJmG#>xP6Y$!T{KuZ~=y6HK#G>8Q`I9KhET!1iMx87p$6{#m=*>||%%m*e zLi7IDX%*9`C~(tQ<3ScgL_uSyb_c)v@eg>T+0MKN|C~ox-%iunAM)z&Um@cgE4gWY z6%8%>=(S8_(ZXqPVGA#BJxK36G-rO3AQ>U%=fv-Sz`woFM%b9a+Q0l)9{R>Tbbsp~ zc-^DmnmCCf;{~>CmWieoQ!!Cn>oCwczgPx3r4>xrN9faOL0_fNJk7z1#SSE3=u zV#pVJ>Zr(aj95&*N|r!CQ2g`;hlox;z1baRJG0#4>!A7hZUp=k~OI1Q*5oAz*f8 zQ$D2xlc$kW=eoF-Td>hRku?uI!s>)GJpI={Wou6q60<3vP)xGbNKZgU70jd+jH4vi z%3wo17kd4S{ss;+(B4E#sEWzc$5T^3KvQruko5U{gd;IbR>u_;;Z-?CAP_}U73yF6 zDc{@TV)-}!FE{(1;(z_($k>?EFsOr^9||KnE4is)8!t7>+@$?5!9kW?``wHym{*&)Kb^3~C(*Q&}sB88yWpM>_#~V995|XLdkg~MZ9?W`ms+eM(S#&uBMURnqB;7&91R==CJx}f6D4LYiO?d zCCB1+Ty7r+p87t!PqmS_;Bmfv_i~m_Zlrr(JK;zNwT)h;E-hzH*$Fz14_ukmlkDVG zR52kh8LQEN8tkL#%wf*;7|AS~NRD-w*7_y}B7l%c(UdZh!mTtk_TpCnR}pijjVH}* z0wsp0=`aUshtN=oM`TQ{3??m|MX^g}u=y-!s@pC$I!`Q^O4XzyoI)Hq)=SOale7g# z@BV_6K*syQr~Gm(tcRFuW*2^U0By=_#VJ5TpDM39Dr zY$_&KQJ7>v9qFX{L=CM&5sdC4CQr`8I9SK=+CJh2I|WmwlW+2I;rJQ4Vk$V&shB#A zqGT&ZxtE$Fr)d}nUiCGvO4G)A(5iqy`h+=5E_E?@>JVo;e7x(s5{x8d6p@!MG1yp3 zcTm8ToJ&!bgLr=@gJKrb7A|30Q3@%MsVuuqV!#`wuk9SC8+%4)J|q{p<&&9Qkc>$b z2=$-m)Y1ASotH~Evtldg2p zP~VAH=Kp8!y#wp0&b~FK1P4-RMKtd8qLNBJ+U~FvMdy$JIt9M=L>K0wy-tV3H{UNzf?d$>uJfD9o-)U#& zoH^$^&w0-CfO#DA=2cUYrALv|_`43Xx5-KJ^F3kknRCGlEJaa3(2P2x#qs&V48*&U z<Gc{B;K0D=TyL>6SCi4GTw(pth!d(N*1xOILy%(cX8Z# zwvJ{bp|q&gW70r08KC(3lS2 zf$Y*HeEVnLCwte=`PM(aiu0_;=*TXe&E%XR_PqWoI|oN4nRkH3eFLX=lQNib_1F2q zou%yf`NRBb{fSdm5p%Uuf1-~$m(6ABxO#e;hDQe2M1oi}Mlu$Hf=Z@jYZ&hDLaWyk z342JyN3W&Rp_c?CtpSq(;<1r?(HYYW)U`0wm8Rq)#R(2NXpdNtFX62yoz) zH`q7(F6Lb{kwHTZIsM!Ci-1p!OM7BRhZ?_Yn;tKA&=UPm17(o_Mq8_yU zTdDIJD5_pa&9n*RT8yMCX0Rkn#2jqHJJ3d}J&dJv3b(GlkEz9afg>kuR!nZV9ie-W_|w|#WaJ0hhck!hy-};9DMubQ=8Mn zULwj=G73#-MTn*obl2C?v+!mn&YVVJ-FECJZ(C!eZ042RdFwKAv=QXAj?_>K$^Kdz z2lZ55ayt($2=K;lf6eO+L4+|EargJ{CS%v{_*IvKfOP^(SAUDIO;&J)(S#u3e9sk!oAill6eSw$4YX0i6sU-NofgxvCF-0`*Rn4G5&3B)jt%VSagt32`A zcDlm?<@0akoA+FV9P*M*$b{`J1UnDW7tf`9%3P*Zm5`NbM4CJg^H`Z+mw>Ie^Q;0( zpF56aD{teXX=NDXIF@W3bIRV~iPyH`G8Hpx*=m;N9piWZ`2_XGi&_2s2Ptb=!y|PK zI7}s6dj0Jzol}VvkC9uN$>NI5Jods{w0WW*d);$FNfV7qWL2%;p}$>4e!7cowmMoq zR$!T_oV${*UTtCTum6QNIyG3UmvHOKNd(?~f!AE)nKFF_<%OAOVr5LL$%2@Rqw*k4 zU4z8MY$}%C#(m3YQlfF3yN)>ZU2YC5+hX^N6iw5CC{sIv}0KryAdvXlrQ|D9J;w6$)FvtpN z(MU=4c=AH6yk2WZG(@?4;dCl2M>!ryk(Sfw3#YMk)i){jZe}GCAWTqnHmeOW7{}*+{w9Gft7S>B&xe)rLwvLQ?!!-rwrx^R99Mv+uAsKD8z&n zS5ZA_Jo$U1xszD&^?R9=NTDd%RLmTYDSC*rzE`3KO~iw@ryX&A z4Rb2IbO>qEX%ShL(B_v@IYx`Wu92hlnN%&D&A9S%49B|AWM`mwBRJapR4$l;b-=}7 zTa1zgCNi@m2quW=i;RI3u-V35< zoX(dhdV8^ZG+a8qf@$eoBDNj$38yWbvf?EXGm?@lc*0S}X!DpbeG&Jq%46U2Ptd36 z&}h>H-G|w|c@JZ6xr+P$E}w-B4eUF3i2cp3Q}SK$bko>2#H4AHm{N8aXZOg{4ttKV zed8{2Z@7Zh-^*kEiDnKQI>4@aJ2Ebg@7_;WRSn~+%Fs17QB*UXEaw5Bt`@WzLzedfG7nr0g7O86msSshU`hzM+Af{_TGJeqwTro|@_CI`| zx7w2ErrgF)9$dneU9CL7eGh+mG)3ZXZsvyD?qP;z0$J_rc;fMwsSitxyYdEBUR=Qb z$9~95brC4Jk^g*n8CP^R)4!pC|5X<3!1_~$!Er$FW76+rmt(jQ! zi^$i@1bsuqPe$3Lq5ChFSd0|KUse7=P4d}HR zFlNA+0aSG3sTh-uE^i#y+;uk#1QSwr0lESUQ^r{76hZ_CyExLJqh$5~u3#PY(Q#a1 z(i5;)fMGO73wdLT$i|6lAVTKYDU9nrNUvwKoM&Te zaIUWVQXz$fW3c3zS#aI`jPa+@WR_DB>o1>(1p!GH$6kMs9otXf z0pwH?UC9Ezx@b1`9nbS`zu$b?()d@Rj7~S6x^1fkvq6Ur6J{%%o*Ne_9y^YVKnr^h zH}C;hwqyj`(Vgt6xSHF(_0L@9>!-bb7wh(Ql9D0N)4=iWc`Pg}CW}61%qk(-xrd`I zPSO~dJ!KreKyY6@?~W!-OQ+Mw zih?4)Uw{Y*8ZCa;5gLPwm^(R}Omm1n8O(*%OrKoA_~ILRAb&CBRWPl%2;-D-=o-5a zB#B7hA=dro*BrL4;>X{aSy*5hG*LB&thusVvLmpu_nwmM8&9lOiy9kY|7P zd+GqtG3oM$`1(zH&SkN{}jWT-3tY z$<>UFhAAqxFc6HBmIK%WCun;kN|v`3XP$*h&RUN1jvOP} zJ%oSBWb#W5=-N0ZzpW3D@X*@ajBDa-W>=Td=x!qti4uuM$*Pz}LF-2L?$uLdt)zOQ zfmC~v#OQ?-Sw@x>6j>(y9tS!FL1RV^cXO=E#nlyysL4v45!_ZmmgQ6JM9C|sI5*8; zQy-0joh20+WCA0$6g_536?xfV98Np&Y!RWd5|gWrBZoYYKZTj)T6&tI#776@MAvSf zdvrI?8Rzh|fBO#C-*grB=3e#=Mp1xhe-p=TbGWQ(29t7|IPN+9PR9EW^XeZD^Qvwd zcmM0(bN$WB8EWoeQ*S?woj&HzEMeN^MNH7yX>RCZVAM3>JMk`0Jrd@oD{B~ESk9Gq zO~zz?ny24s7?}YG&hePMRD6(givsNryovAW0e| ztscF^NMADg$lcBRc%gY800qmw#XqgO8QImrQ+pjC8X33rcJ8`bUstdr?PTt6;|uZtliN>G}ytB`TjIaOqJ11Z`UA$5r9n0CM|}f4&8@|a796ov=~l?X%IvtAg#!t$SAUiM$()ivbAWX zQTwQzqJQ_xJRXd2^Cc4~DxJ$$=1jo!{4=aOIAYHd1YyKUIQ`cwPDvxn3Zke*6t(D# z5<;?%LvJ0Yv$1bPbc%XR+7w|&8-4l&hRl5QlACxsjm*f$t|)2H8nx&Y7f05G~7$w z@h&Dz&!TYB1S%~-?8o}(3jvrh8+8~29eOol%2~PKACV}E7_8ak7y)$T8We*5ATjy0 z)Q}_zjif=NIa7}ch>~WsGYQeq;3229l=8|966i2b7)wE-mzM5fd@&hc{~#UC2nCa8 zQDxMSmIXAXOmeey#Cnf$)D~gtW!H02WyYy1B$NO{cK=ASTjAW~m7vj~71MO>_!GbW z)&JuczkOmtDTS#HCp431GEv^*tpbuMHA6|U{ z)25DRT)rMtMlRa$5FJN$QQPIjACIBYSTLE*h?0yV8L(#Op_fk9&S!;ywQx4KKJ-2A zT`>deIUN(n-*S-la1rxvx`j)}S)u>Xg6|B@L2BgGQ2&G-nJ4 zqJ$)AF_Nagv5#;fi|GqXK$b@b3ki)z8ZF-hR@`$VbF__Y+}=d{pEH3& zM}EsAzki%(UVM|a%h=`{j`N%(-0?P8U5M?ica1zjyw{Ru* z-nxX0x-~rc>^roD6yD#mmAIXTV>Xh7RZN>$^qvkq+_8r>kN=8?|La+fMM}A}W)fDN z03_*Y93(*=SA1nYn*JUdT6;&Qx4m@sI?0)RIdk%J(7m@-KoAin>2&!K5G4sot3?R6 z(rObanLUT8xg$GFy5ef)6$WWYiJgybM3scQA>21a4dmf z&R|S&>Bw*Ixm^iMehs&L=X*T#jTKDEGK_3ayRrB8FxcD8p11zOqmMqqBab}B<9~jc zZS@2A(|WS!tl+D+&Ly(-6<*#KW%g~iv7#me4PI>hy}0ay)NXo?M;>{E-#+>nfBe(a zY^?3Ydsg527{kq*c;Yv|;WxkeHNX7DW4!!s9VcgbC9Q#E|6$&E{C8~dj^l>E{d?}H zDdwzU#N-&UxF4;tfWk4E2&PIFUbKk0m1bh2bB1y(PB^WQm0wIjhVf)|04W@fJ|bD= zOs}5Km{Xmiz?qBT;ywF#?aANpZ~yrOJ3M2!eE!Myk)prNP9U1iRd+1F;Ih%s&@tLR zLUeZ9u}oje+%W~{IpeY_AK(JFU@4@MF^U%6%XbT}B9zvXoda8+ew+GO3XL_NOK$ll zS56;8d3he(_(Og&xtYE1u4RiYiJX>6kNB!HT)&U56^odXX(dM^F}^sTp=0a$(;qgU za>gyY?Av_rD-)Skkwa4|Njhx+t%wrq;_$8`%$slp3on|?p`Jsy6CesAl14;4vqL@` zvVyEAXiZsU8wYWp;iG9RDWbASOWpb>`Td5z(O*q;n18|7r%hp8{sA0=Bg2lOq)E%~ z6LpG0T2{`ma*bFs(&zHEDJ!JqksdY`anaR&0^jX-k{fKMs4$N)`T)CM{vChb=NZ}G zP|a7qy_&f*C!u()q*F1{XTHX=j8}?Cd$po@U1f<39y#G&XiovveABs&~_M*pJ7fVN8yKTO$*2bu*B(V9CfQ zQzMf`qWrQuxN-4xrcTQzFLfLLSh#?W{crHcjl;<4G-+8z0#f#)G&|?Be9Qv!l50pQ zDdN#gX5I2NelTs2xW1eM@i4FaaT5poLde2ao_}L3tMC624=?qiw-_+UwLJgWR=Ql- zj1MT}Wgrs5g!B54HT9b0*PeFKR^l5|=|Q9zbQtl%gz>12v{(m-DImE7`` z%P0}zAX&%|+|<3ZfnDvx7&7K?&B~QrI@OBJJDZ!nHxpx~g5&sJHov`}uE^e_QE4gGwF~)Qfjn#zYt7YBBS^_66g*|&X?))m>xM~{5pWaQU z?c{U`|8oQY03ZNKL_t(fgocez^K!x0Sn-V?u`m%QnU2uA|0VviwHH}dkkccJN=6v5 zg34&nFwEiC-eKwk*Yfp$AJ1T4jMDMhw5(stwk9`e<2bIm^Hvs=SrOAIB%MO4=UtwE zw{5h3Wt`2&INCmw<#+vrpDpZSsP8CmZ{9(ZJqn1JvZ`77mD`!_-%8IrdujH?fEYbT z-sRA^yIK0ZpR&j^jGR_T+iQ8{t?k&%m$Le{>zNpQjsLfKFD;s3GRA$MoA0=Xg#U5g zKDLGJ6|1@OoBz%Xx09rz!yIVf<#n4l*7@Ewsedi9B7-)Ayl6igp8YM)X8i+qeCz*U zdHz3ndUrp;k94Yy)8F1qi)RVfeCJ_GJA>%7di>peghwr8O2|pW{=>|?{TlB1@eFRU zw{z^^R@U!n#?!KsmpA5d+x%Pk(d4V}r_uyEcd>Tk4!ZnV)U3FfB{RliQIbd|BiiUO zUVrltfzcJ}N!uZg+A8?YH4ABa=}DTpgQv>Xy5(7(EB!h*-2FplMT5kYG|t1X@bs2; zqH3s!_i%y7!AcPv>Z8x@!#nK9=W)`q{~gxtX(OV5pwVK<$RX)&=g7W2)c1Occpdcg z_2cyT@Vjhuv~@G+jgU?Sae4-6KYEm=#tsG@PMVuqa0H^Gad-q$eh0n1Hu?q!u{#Fn z>ujZ?*F_*E6Y`7%60{B2a1I5D%b+Bqcn5pw=iZ==r@WW>i=CK(>0zpaf<`w$TY zAWbafq_?A;?tx*VA6dRM$%q$6cPE{FP6F`+vB)reJ?*p{K1OHXAhxbIMf`r0`!vdApW8RKfhQm2!jcu{kL4`QV&!ouhG-+kR%HqkB z{wTu_#7N^6 zQv2TZWCNC6tMZ(pq8w?NO$zh;omQ??tXhgu(WpJfEQ6t2ggdRF z`VSvNDm}<9kVj76d}S!&-IZ3s%k@$J6~r!E5Rg$R(;g4*dzf6E6^-Ii=fdut+81~G zqB>&Aj>7W#SUaBe@5Z7&xX;h?C^BY}^PiVl??^BAxI(Iki=`lHu`AJ{kq|$jUVb_x zTy4zcr7aqKoJ2)_Zi8+1)7}&ij0VMDg3$!4el2QjN~oAJ`Fao*G>l4Fxq(UZpB9&w zqZrak3m%($jm7)cCn9IZ)>n(+J6K+|=yUq0(~cY4Z9yPd@dXnh@$yh#eYuu1K;GiR{1?J-hNsL$5;-`tIU)cP8*#8c5&qea! z4)Dwk2JUP!>9%+Ife zswktvyk4l9Pu<`mJm~Dmg96kI21fV6PmZ#$R2|P_v&j;p?cH%FDlKC ze)N#c7y8)6pVVd?9UP*njZX!GQ- zR+7mYSInQ+x1DbM!olCX1F^gn4gDyp9I~T_Nhtg$dL<NY6l@-4biu)fa{arZVX>fUw1isnO4y7 zUGIljo&n_Ev!2H*QSc(eFemn{Ld@98C~iI9wTyaD)JTqmoU<^V^hFeh5BtDbu)Ou&`mq^v1g<*)623p0v(aAWCXIB zvq(Y@Si}IGTNwnqG}NMj}IAI8rt!f z7g}rJnR0FI`F?c1NdGH^f5{w>!=7pf1d4<&HrV{6q_)TZd8C}@>rZ3<@!9koj9ZcA zipB6#Un%^DBs)B%9g>}o2U7ONRtl5O@PBo{BD)s66-hv}gKJxso2f%+wc&KZ_iZWDQ=sFM>*MW7;bi0)oSr@1?$) zsFP8W)4FJFVLlJ>3&&YD^ek~eUy{U&d8^Cpl50jmB0Hu6dgFz~bS!~&wDP~QtIr^Y zNwu~M1IX?O*(HgidR*2 z*RMAL0Nh_X%`vGsN>06;U0q3no`NrB^s&T{pZoGoi*ZH1aDsJ%>q z&V-kvmTbgXx&vD@WVWl%o=5y+;cCB#L^kFllLUfOJvYZIJ7G@VJ_HaabSBD`jTI{+ zM?N7<=||N)iV|zvf@bVQqgon2qtjQn_eV7vGdg>I$G{+we|>DY-wz4Pn?#$bw8!Z> zc4lpU*1Vr2f3$IxGIrZzrPt_5&#KoI zH`|FI)$+OCEA7vFd7)so^jjX3TBD^@qUPR({^o;LmwiGZfxH*I4gS4<(_LA*EWKIg zp~8<4K23O`(u7D#WCin?^%;v+Qee5izd0YnI(D~2_;}j6JZgoAl z(2t&DBultMFiUU3V!GseeZy7m1?N4=-Z9@)g3xrBOI3zWUMx2r4LbbZ6Tfr2-l`rL zc}SELI$A2`jaFFDXz1igLGR1AvlSvT1J3X)IUU(j*&zx@KZi{R9*1;{RvuYD4S`ai zGe}2@xtyTYHtBPhHpU?Kfssi{S7)$M;i#Z4Ft^-bN3LoyeDdV)Sf>D=1p#H@QqfQm zB*Y*up#wCb1frCh6(yX+HYByuxaISzCilh3z%K6Jp&p_?k8ml|wPlPna zXyW0vCarcHg|1VBjFxo6vAGp_)wq_DVoBN(DdKlJVOGSssAy9W>#=iE!mwKa;--QJ z@}a28iAm#erRyh_Z4N!#gr^DV@><*hh$+Zo$nkTLiBKtm%X^7_`ax5rzBo}TYfPD} zZ!&1*#R0A69|!5c7wCW#L`ZN1?x}W zm&R*MY4`n^U|bkP=081iF5N5Pl8!0YpNPq(SFHw)xm=h|_G7@V;i%G=9-m!_5KYP< z@1a1VxgxM;4$$6?D&5CZ7A&1GS#hz&9Z;FsqI*Ra4+%dUqr%@5#1{*+8atdFDd3vO z{clPJ2GQ3GgR7#>TXS{oXv=^5Zl)F!TqFm?13orwSWsMGoZRRSrbJ_5UY)+oqj!pa3ow33|S z!078N@ZXAKYwy(_c~J$`pXNM~cMGQI*ua5a!$1NA>XxRPp;4L0M8vo2AxZerl%!#Y zN06oyvYlQZ&*uSlwFMENLQEFYYVDo3*LQOI-S?AaMb8Hdh;LZnJ~nAYD<3f&23Z0o zHbF*1gHXdN$_NHf<{(D~lchia2T;cU^9L+OMKHoEP?PGKhxPjlwt6t==l68*$CG}W z;H$LyKTA)b5+#kcaEX9bo1aN)f)`4Q}Y7>{1xW2o6{Dsh`ADNYeH*f|<>*y*zT;C?bQ(aift4PFE% zqG<)33n}kq{+O!D6b~rNoO;jHYqa9dYzW}DLskPI7taT+75x=z$juefVeYWt!}(!W ztSY*2!lpBwF^y-Is6X_B!NS<>Pve;+DkT$sH(2aa%(&Tr8Mi6->0De3C?1li;~_6s zzjyErmpD1u^xsgcoY@P*IW&1&{wjIHYp2Tu>75=fl-yr|aiO|Kmr&EzBJ zJ$-7b63j1EaQL_F3{f&=O51>3Z+n4^4~>x$%RVj%uRTXjtBh>7)^Dy}TVw&MpR-pj z`lV-K;K>0k1Ft@V8?)!@W%}WfH7IHjC%QiH4z+UoW0H_E7j4Zsj!EEY;X)25KN3x2 zE{O)qb^SO}Jk`0+kDa(9_tfxLCQ?wAm$&D{ePWXM?_TF;T9IkIWaB6Y8^bu7XGU8! zMQRi<1xiwGWUVV(KOU!{>yVuK!aL&i;w{5#l&bpu(0|IkFQd_KV0vS%u_`{#D{fr^ z*zVWwa>x9n9WKI&7oy&1p@S?xDS0IH$t6J_juJ2i2JhUVwAe99 z3*HY|fVel&*b<>TFYyUC@h!Kx^&WNJ%!r$Ta^HbJfynG@mpdmJ@+K;K`w`hkUkor$ z>rjr6KRcY%9b3E2-0@0r+}Ol6{$CEd$#~F%-(ODF`{d-@oY%U~=63-CidyTPJ~zoJ zWz4r=xp@n6EYRRFmO!CH>LmT2Pog)3 z{lkj%e?EeON>-c}D24Rd=kfiq)??WSh@p8?_7gNUuvguzW0Z-YFyX3;jRY_}IL- zxhgBuOW+wu^DvriWq)Q&OAo={s8G&c>Xd|3=TOX%JlWMA{>@6>(&YdPVeG^w-O|uI z5+c5aGvCT=a=qryhLBDDI0AHX^`4a9zTszTZ@0TJ-jQ2e!qf!R6fVs|hc#0+%8F}O z14?397~b6xTa&DBaBs$c!(iygY=^K+2Z_j!7H=|O6!v#qkH&|=wETxUro-R)&_Ts~ z`tO{U$b1Am07hb&AISF?yz;t?z|-N_OjUC#yR*WYp1j(^J0A)9e6pJ;;4;PUj847c z@rqdxo4uYv7#nAlkk-)N0S=q>1g3>KW%Q&pJ3E)`^}KcT|Dti>rwZ^hp{^C%i6m9| zhi5zJC&v-2yG7NVsH-yVshJH>O%vq;rJA+qKu+rH>WyoL*Bbe0KFQ%4ll}ATtWt$v z*%&0Wt@r0oB-j&POO-H4SW*h3sl2hhRP8WzGQp3B^GjkQaV6m*<-wP+%8LJ1(d~F4 ze08Fvg7gjJp)yINc6)N&0i9Vw?#wd)k#LF6?(C5@We$*?9T_c*-_k4QIEec6d2FMo z4PA1l@0U7@D5Z>!ln=bH33H1v(;7(8m5*>mNfc=f=J$Mh%>>7iJ`ezeN9LRwwbXZ#O#=# zRn4;XJnQOx&8cK=FN-l2hgf6bBil!z3)FcQ->#9FjOWiF8FuDZccUSnJJ9$oo0@^= zcCKApP_-Ji#zcO4lg)?4X*7ksl*nH-VsXUnSJzl&0$^Od5^K#2uu=onjiivBjrm3-+N zs~`;w`|i_w3{W3;g=hYCdvFkXaioW$2vn>TlllRg-92^{%9sD2F|F+TUs?oo^OrEy za#+wWW+1?ew!@Yx$gq&m5~>zU@;O6FMghiR|0J88saPoieBQ9o=Dkk*riI=iU{2V!3B<)ZnJ@ ziUmf6frps&Wm$^>kuhK;`3z0dtfokLcoGR?iRCawRioZu>iHljXPPWH4^{RbuL9yv zqIL3KFJcKvG($(f6-<}EP7t(FI|lI>tV`Nnn}$Hzvg4}j$fn6D@MBX4BZrE`CME1O zJnY5z`H3?Ou4*&(9!N9S*7x-he_r2L5uWh*lBTPG*U*I`0@EZ{RcI@j3;0MtgU8Sm zvC-2R!{?3OZ$zlNV0?XfkZj2_zrHWUYR>WWTG!-PgjT$UctdLJi?G36ZLD8|U}}LE zTiY3L%lu1{B%ZV!1CcNw^=P}&Tvj0SjKnWUL0*bH7_~@_a@9BIw@Tf9##Z8Yc3@SV zzNo{fMV?>zNvQH|Q8*xz=X!1hhpff^FfmX^rBg)gG0a@h=?rtdwWp6ETSt0OEF;5t z5Mq;0Xdr?n&r~Ko66I>cHN)+N=UJo`yZ&rgkntDZ`O|c^=JO$y{VdSL1I8K z?~M2rI`D}Iq4%>_#fhACC=Vw>O{+or7%n}rV#@qM7Xf^ecXGN@o+X%%+y?9wBvo%1*hK5fw{+(#rW#M zFUT3nh?=`UAsKVm1LG{w#h?u)>>Kp)*I8G+zalK| zlyk{Zi4pE)>EKCwA?-PUDO>v~F!*hxO3&*6?vcA~ZUJFTWtvQ&B|I-E1~YY}0>qC~ zL;Ch=^~j!x$dy^+!ssq{}a$qm`5DN<+={rCsB zj?k+y3q?F7?ErdiiH!bB=}KLgI>0P|KkIhD3=t3}d_J`OCrn|YsF^mMPJKibU}8G+ zF3b+?hM5>TQRWbm4(>IKrD$RofixiD*2*=vj?+=J=M^JAnryttie-U8LH9hkB4^8# z5v?Rg!L%9tqQ;9T)(A+-Qm(`fSA}6sN)pHliG!?`hFiKStEvf32=F!o=Ntj3b7q}O z5{MVXu4h?5i&NxjD~Ll!-_O&Ssi|d%#a)&*{YvwgeOR<7Fj*XHZR5Rtbvix2Y$x;imVJO}W2^^JY0 zR{4C})?gQr%`BdtnrA)&^}MWhBtf78LVAy*soo2Q?cflAjT3%&QP^Ia8O%T^6fs0j zouE8S8+{yrbHSwK=FJ>0IB%VTok%@gxp(GR+EJK2Cs4_m%G9gf9seTI#W9jLFgp~6<-REa*{aiy?qn8nBRrE`)q9j zH<{H#)a$qo_NBgkiQuaXF|;$Y)S84vRZGh1PpBFD<8-uU=l8!-(y5GzvSI=MB<`LT z<~9>-wFdFiWf3L3;;k_cEYYfv=a#i(%2!0~bg<&yTad%_R2rd@krD%>#XxT`$iO2r7|Cx|BTCg zjw57WP?D{6@ae4e;6MmTAiUr8XjxoXj_>^-gc+SWXozk%8^yKy$pylct8P1@;zUi- znkf?h$q`m&rH>rg)0szufv`Zkxq~ z6WMv!3?gC|azsV`@A)TdBS@@+*;lbKLzoFz_`2fN^r3v2r6InMiOe6$4=!=vu4{FZ z#%ikw{m^g|#zH(mrd6NuO<&^CZBZvMdHXWkTqR!Apc+1rb^wFn7z9{lvovlpVvO9 zZo4w3w# zgo-taj}NF(nqa!ZQ9q|@j;F0!ca3cY(mAOf3v;J{lTvTL%iF*Mnh#bGB)`$~wbkTa z2H;I+4LyffX*U?L|B}uek_?ZnbJ$z!wse9abzk=P^T>%rRzQ?j zS@a}Y<3w6oRC4{0^69MWG9slmg>Mz<$SD~SxgOlfBhBCm9sS%@7|MMY>b1kC^f=Y8 z*5wLcEtLM3<5$ELepxKwWxYt8^$tE>Ox?71`IeD^5kCFbvh6^SrMEFRW?4+JU0v(9 z8G7aoeu zmUD>RSY0QX1t7>lQpzv0OkxCS^2UWT~T{>W-Ad)=QS7Pt^+QY2E4%T2#_Tas}uW_9E`wVWu-BsN#hb) z4+-NTVsU?@h3}>i;IU@L$rc4s>;I}nu2jA_JkOBP`dD&I3aAdba>7*oUzI z?k=~K?Z(LGa&vXM@v5@l{8LlEQP>njCR76I5pc#C-==u9yB&mazFY+^R|OC2{F9)Z z%e`-V4a!``f=a@#kwTdXj}CV7`akEMw9`$GhL5;i3Ux;dpz!XkwM=5QZm#(ks`CB{ zWX~Eal8k1J3Xgs;*uEs<*o@`3#4NR9s(nqMta$}w+-rN@Jnvx^F$L<_xPi@?;|-&# zj2CTW02d~kdcCqJE{vP2ZEvMfVD?Q(H@<|-Y%@2>B5A_u?mbUvZ5psH2;RZ`18@m8`hmIPSDjQQ zX*rGBV!I;m!JF!amrek7Z?e1Yk4JA%*B&EGRik8TuLVV!i#xq3IEP$DL3QU!l`%@dE~Mn^Y2 z5&8rd@$P_A88Ey28lYe_;09(b*H{7Ka~cJkDc-zxqd5@Mw}x>JRf?Mbf=_#JxH=dP zp07$9ygwk@e4H?9HKk#}flHr2L&(CTL#v9WAZARFQ!w*^*{b1r3VI2!jef@V2G%5m z6?yv|Ha*?+0r&%2N+aeXHLM#C8{M{i-~|l#M@0nUR?=oqWqSLB7zmutVU4H9sOa6m z-(H~QEp`%K-jyr6(Z~6`OUn4hwOT^d+C$2Fzxb!s*q&;86H6y87VjpAk?miZgg(x+ zd3b;w{w(#KMd|hEBRuC2Z1|>n(B`hA82qi7hVQT1ii^a1v9?zhH#dRifvy6Dx|XWK z+=>27N*NR7Y{GPX?V<5*QY|#o5o^jwDap4PktD zSLTm7lP7BOS?LQ@m{2nWFlqFYD~ob++F=dyFIKOrziD4TXbMQn=XmF2-Rhpa6!n(Xb? z2r&Ez?UR(G@Ntk9@yg}(e$?Axs1{_hz)g9Dv+|8T{A0m^t6o=dje`;JnHcG~lba#@ zpn}&tAwm;zX76I)_w@vqJw+G@{AcByB8xqLGb~HsJR0fo<(|m{H*(I|5S8}vH6(3( zG|e_`0iF`#GST0EdHy+9j}jU*5)m#7)tXcD#k34c!<)HN)#0t=XPOH@bX+cHWRBui zSK6wKMvYY04Ibx`i*;hGAs)h^3nVfSrtz`!rsocgqGf6=jwN2k{qN{Uau%y}p@RiuT*4Y8{*bZn;fNJ2}2A4kfn zYlUFrm{_SvX%^-c6**XP=2nLqfDsjw{*3ON%5(7*4RQVQwd;HA8D8iHXylv6LT5J= z>lFgQIdrGM^Qjf{bX>Fv*#Y?-e#xUJt^H}@Qb=g45( zl=@|zHY|~?7e$RoaS%8a`N;|{s?6HC*e(c7vX^JZr<+)DOQv#@GsboSc%=df&Welk z-8F>5ZSggc^f$PIIlLK)he_E<&{^mM8!M5vb27Zr5Fd?z{c#3HGA1TyM`JvOz0o3k zH95xYu`XwCLV=%=)wG->KFJrOy3ViD$3)DC#cHyP#=KPda^BpP+X2b`(<}EVrp%@L zBY>RE;fmXrp_JHTI*?EVy}8FO_l)P`-*cM*J_mNsI{1aT{esmJ%Dz$})EpDc2KFnSqOOlo&B z$byfD3tu#H=66l&M}ZqXnJ4Dm5dXQZT5X^oLtlcCo;kd_wn*#O9kGr=_$0|lw@6C@ zjA2R{+>~N~MPMr_p;iZo#Ir>rqvJc2_jJdYV$D-p>X(#PCZts(I9nbKTxl%aFOQMGKbN?kyQ_lU6Gj~6t@i085NsS72M`~otYqP@oN+r65 zAQ8`X+6Tc_U(gKV@h2BXNe=U1NCp-kIXqfnRH+!O!>Lm60LdQ?^sU0#v`(;M4@P%P!X0Gt+BRIgEi=zaXYQ(TYUb@8UU#8JQ0oYWS(j+$J zwY|XHIvNViyg~uySfg*8M3kXm{XeEJ^?UbGB7Im1BsI9=-pL}}gprQ3(eJ0G;~&DN6V8;*-Vqcttw*(;p5L+IbhDbe}-oFcVLq{blQ_SxbF9=-+FZ{Q0e62lg zBQN4gu!@Ca@i;pEypAmnH$Fr~kmQ?tZ}klyIy9=^XpjF>4^m7L)jg#? zt|-AzQ{7CwGQq6DXsNsTJRsUK;%B4Hh!=K>ipk+Wa&G(WnRy#Hpjn@l0%=_dVz!D5 z4ifK-LErX;I5t$#x9KgZyHd##uoX6g=My-$i&q#V$oZgo_uv%+A3zP(2Zg@@9EG8W zc?8T!y(c<*dh!0~7D1bzI>i%N@0%a2G+I1sR%PgT#IOkkn?OEWq1J#jN7=6C%o>3c zlvxQRobjqeo$t5&Zy=tUfCFt*x8_OgPO$+q)b@@-#tbBC#TMRM>2%`<>*J8*nV7p~ zx5vUL^dizCXo$EdDq~c4H+_jYsiJDU5=j{6wrxu?y{LW@Zqs-bs@~=>%22G(f5oqJ z+UF2pkRgA%J}FgRR$OQQ!A+6y#J?=Uuh!ovDf6_8Xv`MzMK`{9-u2m=*1zVudD)u{ zWq&7vuSAv>6ICAwTT0GOr$p0V6ia25qC&IBFY4YBxCN&Sc3>xmCns?bHbjAdc17fF zg5z=|G|!|4_55jDUvee)0J-0Fgce#qdgQbTIkPXPxim>ke^~#<*iEcQmu4^}NGele zkqS~tdfwel6@)^e1R?>~q{VH7O-H2A*fZE(h;r&`2Jw>6zQxW*MIlGwLT*nx)5F46 zgl!7(M#$)?K|FqR-3x%}uZViit)81a-s{ComVM7bA5vA9^54lXto$nWOTpy3k{Rj~ z?-%)JY)0aNen;Gqe$pZx;NSR>Tf7q*8u~23K5z}A$e$Ir;~ShCd8);2ioYhOiHMB0 zv@)6L-+R!mAKzvUc9EN`g8MQ*@EjT0wti+qMlBTDY(?bfJY;EsZpvANZ)b*u2_SOK z3l@XIE$A#yPou{g?fWYuyTq|K+_+a*X%jS#F^MNIBE2G)DQZJ!ss;i1;XFiXX`C7d z39~7gn5pP}E7ir#5z-&DvouhP6NnqoHiP-F`hVZ%K4`%z)4#~-bno=24eqA0#OM6a3{=MpS_bwJfDJCPj~ zT;Wk`LS}e>=WGCrolFiy{+{3!$o#PADQL`p3@WFMp%}>~4Pw1*-LoyTl_e|nfDs9} z#T{IU!oGScpg!aX(4!l8>3GTw0LPc488&UVx&03Nq`B{;BC&RdDYAanrK2!EoB|0| zq^=eP@meZ)IGf!+G-XU*hchUVCKgXcA(E>FM1~JD0glT@OM61%E(gz%#=mi2$NCeH z`g8BRKbltSuZ@SVf4H^7+&sOmeVnVTss<{Z!9oKh!Q9YPJGwM}760O~VMTx~B-`xX zvVy<5xC_5)d&+CzZS4~MF#x|D@ab{>)f1jjpFkQ!A9-Ww0x5-stp-4g|M(6w6OdX6 zhVzhGcbk2r>{RoD2Be8UKS7hC1j7_v{9SbcHH%7Yn3NQ+@ng*awmbA03L`M_paMB8osB1 zNZkeZN(YisKYIMqRZ8od?3N*UsX5nyJ4{U!a_e zmZF{mml*EJ-OnNf_}v16Ovr_W8c2rz6d{oKc8r`;3wpqgP(4Xdz(tj4hNz*?R;a1- zQY~rvQWl&f_}I^EB}7#Gk}@urh*NwyD?^uACIKE(ikK- zk#cHqk#4n0cs0g-S^Q}r>DySr4uay6{j=JCtG}2Rq>oIU^Y+%t^ADV|NurDw{CD;k zCd)Zo2b}Sd`Cw0s>PJusijCM1R`e%u#RdqmWc=ddY5R1&a~^Mi?e?#FVNKbzdED{y zCLFo}Z?-KfNCgxoGo8S|w>6(jJ&!mbp7+qn&wL-ucx<&rjvH!_azyZ|YLoWe^G>n@ ziZQ98;TG8=VO`mix-Z~6DYGkf{>LSctl)jV--$FLqg#Z2`D%An+>pTXb^H~U`py*% zE$y=a17FJ>B+gU5@g`_dyw=gV-HW;yAWI*4d*s=fjtOSAwP_XUk0i@!vKmFlkj-_=Yg(d zC_7J{e#O;T+F)dJ3Ky9l=k2RA;rqW8eeIyW-izIopGK2(vqF{X25q+gT3- zK#EpR|2#Y9lUY&z)Z5RpW#x!TDj>o&sN#Nw{g&^yqPF=XxEwexnn@8ACLQ>oYbUa- z=ygxu^BfM7$^H!fwG***e@HO?bs6gSG$|bL@J{wl79OVB)OJ)wz8DIvwtxYvL2MfM z1818I#WI1@Wp)qdS?7`QH4+nXH{g^$q5euwpu>uqnmeKXpc|w~o+bYBKCDP2lGb>8 z6W54&{WPzgBOH*SPeag<@0aabdY1VywgbFyDkL+0_|xD&i-zCf#>fUY^cr`Cs|BEn z81f>~Y!WRf4ggL4;xg`@X?KRO5lU9?3ud`)nbTQ}bB@q8v?USR-KmP$>*rJNmp>BkkBx!LpLuU> z2QOzuwqwF9VEQB=4e^{DuZKXdmnaM*)Oha3n2}_9qy;_K;50B)a}@mxCSK?`GfeCx zpq&)(2dY~a6U}OiJ4yTpnWU=Z{2gUQVIgC?*HH?FVfC#rGBPLz zSFE{@^vv8I7#d&$h`tfm$Q@3+>&GrHGJ>-m6HY1&@zcngJZ{YrGK+rqzq!?R76$7N zjb(pa-+QQnX#14wq*eB%l$V?T0%e5jklXR@U+|6{3R_AeFAsH234b!?+u(nK(I_Dy zxp`v_7>7H_O3&lLZJyec56^r4>QSNL$L}YjaX+H3uy%K*XsxU=_Q7XaI7T#zX)(s+ zObJ%DnIYU4PfsNKiKG7^#waJJm4sKHe>lD3>C&?iNeW9Fz=P~dVXw?W=EmtAmA6cd zPvj4Y84f}=DtW*#=RI7lI#B9 zHmOQEO7Iya&Uhnu5Ydfi@f6WSS#c;tzTl4B z(LOMigNPW?6w|u>#f(zQc&@(y`Fo%XivY?GwvrJ3O(lg^7&`u7USL#E5T?ic+Qs(kd&2kuR)#OMY zD~HC#rK?UGl6}WgCbZIKTrYmCfxr zYK^h%E3zZf9J)SHm3agFikVLJ#;#G zaxH$}kycQEfvAkmSfxemNGO4F<`b|wBNo*ZBe*Qx;0v>BL9@qw>HhUQ^mCWB1KkW% zV%%|fi85A%DmjrcRbrQWN>S(9_;JWy&(6;7^*0zMDj`8S?I5vPgBF%T*J2%70=A>} z4E{Qs>Fs$WYxwILI!E&VVgY>7Wuj2Y#KROQ*&iN9+gw{lJ`F$O{I^zE(8vZ1k?692 z?7U+uOkoM$?aaFFhPIjo&}RyIv+K4xP%$wf<C_Tw&r|v z67lEn7aM;z%|@0C0b|7~&&_Qo{ zhFZ3xs?@u`pGF}b#&G>)DsqSY$U)Ldnvd-84l5M~3%dXRx`cpyuOA%JnQ~-I_C4Dc zg8o}bl-mnzYi;q#dgs~+6qqV1T3B)r@GAPiW%%JK<-_S0s-&?bv%Z9XJ}KMP1X4$B zq3sI7nwR@W(X&CjOb9=G!7nR4K(1}i*Wf)EY|&6>x=5uS58i-mHG!KwCHkjfU15yQi3AB+}g_HT+VuUuJ;5*N~iH8Jvf8Z`_H~vXs>o zQP3E>35$0ACvYB1xS930s>@qEiJZf+k*rB3#H51;1fH~tURk7spiGu zac#QyWjs7|DE~+i-)64|6N17XDkqX8gv62I;R;KaRJk{q;mf-HzlW=XNR=M3*(6EL z7yHd_{?zrOuf9A@JhA}7*6rQ|caFs*DF*pP<~*NA^O=@#-0s^+KZ_+qb|x}ReaS!K zh?-pkp84yEvl&C@4_|$jmQ=;o^dV-Ho8AdL2Hr75I3KX$flMIxw=u&sfjfa<1 zDMNCkxYsLPBUd2mpvoCp_J;pP|Jl|Fv^_7Qyp^wMw)aV6I$DR-QD}cUL%Ac_k=rl- zx)qEEq~70~m84y~U$?`9(mel+UwyGi6T?Cm39;cvZkfqsdw{Y6eHVj9fuS6`G z^eM@>@N8#Q^R~NCMhjv}U~rF#q#I|Wf)G?9DIFbp>`~>;IK}Rd|EImT`im>* zx`dGsAb4;mxVyW%1`qC#;O_2$#@*fB-QC@_ad(&LJn!>;f57}^?xt_*qWjc2U0qds z?Nz(ivLn#2+&`<^0v78G==)wN67p?EwPbuIp@_of&48u))9MLyeDgJyC#9i5U-Bw4OX=V9TvjwuuF*l7n6)! zv8bEnaLZIAzJW4K4<$#)FB^Av9k`czteVxS5lOuH)b_&)SA08}B>$FaZ`SC9mHshK z`0jv3)7Gf8WeGFCI&=j>MZJ5@<-Kye z&mZtSxY(M8yPQBschh(O^E?c#4J)4NpkjoXeP(S6LZxqjIwI2T2I zo07_ZkmM?C^v4JXHU^Bal0a4dVqy<%$JI+e*QULLM8z#*N3+{9jP9uijO@d>)FTT= zC=CQU^;z>MHb>LT5g*=89^2j7LlNtp9q07@ZIOGyDewu*oe-Ifou(DHWVgtQLST++ zqk1~YQ_m)r%t^RoP$<5e&}h`}S_i?g_B03C!xKEV(r|aGno4@fWRSfL?P$(eS?(Bkdq6-S6p9c6uQ`X&UkLpHl0Zze))rBP7dSSzln{%SBiBo5iHe zu*Iry;^_~w`07~~)$G7m1|i)JW4cGPUjhx6h~7nd()72Y7-Lz^AmjYI2yt484CF?$ zvx%VDTyUV2_~sXvc42>$iczpw@9>TnW$uMt+UQrivLP{OjP$BOGi2iAnm@bqx6uYX zR0!-G7PVemPzz;2qenihlCaV};XIb#X5;7qMf-?4E_P6WQp`%#hI~y0E;p})@98Jj z4E~h4K@ccF>iVF-9BQ zt(8XMG9+dy{O<%bEQtxImliwc!SoQVusY$y9)rI=yvOOjs6cKe8d-WASRl4Ki7H84 zvnj3+{bY862ZnP;3y>aH6c!&zN`6I|C+aK~PTc%dHC@LL#Ux#Q{D`H{L+w=CMs@wI5kz5rEYSY^rZPui9`f?bIMmmgRW@QZ}I3uc*n z`XSPDn`Tdk7XEnkFje8x!X1o%`K$bNkRni=+ zx*pKc9FVp65cUrdMTPu3dnla=o+wATc@|>TkAXH{?(nnWb;7}7Vn)N(-&0YOUSVGJ zsf*_^i4+8`y~Qr-C9Y z5QPJOdwKN`B8|hAidORf)@n?)y41Z`)Kq;e2wBTst4%dVY!~a>V=Rh&QS`89abuGu zDJ9q+3Lr>~c_$K2VUoI1(!uaI@6LBM_kK0`I0!>sIx^bZ$|=Qvd;IkH`&k1x%&hVO z41HdgEq~mrTXt;kiPw^S=!q_=^b#_KWDuo9_YzPyeS{Z1xF>&hFJY;(`{l>sJHkg{ z@s#3`q7f)nQo=Q=l-G0LD?5KIgC!AWZZKE zs`Z+SLn zsF--Ve<1Y=bMJuQClqYJkC>Uc!|LG^B0RP<4>i%bMl(2@M)Q9jrEGwRSc~yg6S3F` z^AG;jGbcxPLFQB@>@SKc^N)7=Fb7ya9VlvSrK07df`tgW4Q%qYFry>L$4yZUIVIIq z(JNc(QgoOB#Z8DgzrQa&;eliUda!w9SDRaCN9-J4Ci2pcVMS5{e~@R?C?C{H4wILM zQCjmX$k8K<%95jE#D!(ICAG2~YSf+R?!q^Sra(H*cMi-v_?SL-Y>C%d0wc6YTPz{M z@QXO@vmuyj;+42YWa*@TET{~&2NC?zI#Xf4&pzSy=K|dAT8w8H31gBv`Un6HxbZ}k zi~;n8lqBEy%CoV@_vGk=&AEnRMiKctq})YgZxU~!y56b7Bz!=AsAGTbHU+7Kq8U>s zG-%mngONdp^tpyB0!$9q_Te-fxx)tIVQ%qL=^?v~Kebeh<>6 zj_8#68`mQtF9zE+E*iM}Cfx_*GID^|ft8lVFnWIt^TJ&585GhRmUX|zx{1w0R>d~_ zsibYSoaR1r7o%bOpKM}h>hOTQ8UkONceQss?6$?h-^5ypUF;(noC z0ek5EF$uI)4ridBt+70;_~szN*K{iU>B^{o)ECYQ+lzT`E&$a z40_`=Bxvjr_#Xwf%cYl<5KUmn*q9;ly+cIOp(eALFd@k{pqy|I&F&Q?0%)=lzQ+&OHMlA-gPE~TN-swz(fjA=nmK&`J_4TZt{Dl6tK#G1Sa5U9J{V_#jB(*@8EKX5y zAy&g$jhYo}YYK;dfay(-jM-fx^h!zuX=cvRU&J6`5&ZlmE9zg&0eznM>%Yrb?~w6T zp^u7RnxXy^j9`4IW5{~{|J1aL5d~?H?2C{f@)t+?f|iyO(F9*2FbEj#qgL;G17{&Y zG{^d=+Efx4k}y^JC9(+5kV+koco|V-a5;}G$h*tYph>b78x1f~6vr>k>8sG-LTJd2 z(~jq{$w_cgmAs+xY+kDYx{G-L@~T>=w*ih zG8$>n_z6s1wEGHpTBV~HLf z5^Er3c3Uvh&>;xPwIIS)^eE-3c3_dvia?v{2uK(skIR2i`T{=!I7l`c$c7S^&1fz#(zp>~egx}}B{O+v zvffb~5rKtj(3Amu-7?k_elhroBiT;cn`{d^;M8DQI>uar*R}W zY`_PNV0$P1r*XbHa}k}fl)P`;D?n+B@M-I{vTRz(6Y{Qw*Ep&zVGY$|xwh+u8j_|) zAA@G8Tt8k_h(#m&6>Y7lYorArphtKN#AL2w^(z#qvYUK1Q^)+zgw?RVA?y8Oy76g3 zkd6{rRuG(;iu3#Q#Nr%3jDu`>mnwrj3L6{z_n$u{6(u=~n?hZB(3ZwgX+ymhT%leK z^Yffx1Wn;neDx9jUs!tL?PxpRG04eu0R{vji$?>rn*1s0l-MTAk$u)?-N`-6yV`-B zzi?LFufD1>QZOC>B%XI)w1&TN7nhb6nhp!z6f=hd<&tA1Sj>K5!~SAGXaL<|etP<% zm$0=Hj?QG9n!wu?swF%lHTBo;va%8@J7zS9`5&!XxFsbeLL(Vt5fCJki@#1zw2p40 zWV?ULegm4)8Eh`oN*~f0dXDd>Rv1U7^z|OQVd;Q6b~d2tNEjmcC1n?mZPFao7|i_} zRMV4`wIRB`Xb+VHrYARuc^GD9UM+jWkpR@E7)$#pFmN{S(C_^>X8MxKHUX0)SX z8bM?5HogK9uoo@8|9PBWL;I^aa7~?oh+#B>i#)`wOx`3S_#$SOao-1Z>$>{ksuX2&kWclS8I@W6@PsAz2Ath>pr!HEIWCA|X18M&pM(P4d~a zUK|Jss%KleP&H8IOq%&i*1#5gI*w>WrEVhl>1h=OTg7}zh73**7Vs?0Ds>{#GV@Th zgs2}qF0pcJ%9OIhq!fJLB>oci6z^P?Wv`~oNy&42*%R0S`qIN|x7*?yC2=he&#vh# zSC5}yT0PY}pUzs!UvJL)=i5gwvjir$5fbJ=swli7-o2M`Fk113R4HxYs$)fQCJTzf zI_ch4JZ%cB5%nQVe!W~}%|6$z%!YJ<8_s~vh9C}kN95TbUb}{B^c_L7XsC(BLX+*) zVI1=Fvpy@DDvP@b8sLnKkO;rJm%b zz^Mv`zLs8XM@3=L5%D^tlY z3t$(}jtFfd352|KDRc#zAiasxe$D2I=>Exk-^zOjVYaimj7ln@{*ePQNAq0noZYzOry7e@)*tVxwnM8i&umYvtH)a!N z!Bu{IuO7#LamTf5_1|~`5F3H|Uv8+Vr^sj?xet?yS9XJ~}IZb<4qB{LTM-Or{SHppWvV;p^E;WNPsQ)YS%3ye?V5BDX!&(Jx;fDpl z{=_k&WogRvp`G|;%Z9Y_X?POS5?A>?T1!RV*_qxA3Tn^P%}(dO3m&R3O+w6xjiu;7 z@4X2|K;u;!3Tt4fToqJbMYo{gWOF@;duiLu(tX2oY3k(!zMW@0@y_f1==8LPbo+8z zb-S1;GT#_!2qFF~jWIP&u3ZFz9e$r(>| z1$iv0$L_;1nT(jKP28c*e;;3W#J#=scfAun7|)u_-yV_|h56xqT6z6#kuoIfwd?MY zf6|5BEAF!v;(GrgoQ)n4bI$GK5I3NVU_H+N zNd=l>G(nTf@Pm1A<6ZTj64oeh&g}{|(+fyywWGkJ_qWr*=JxiorTMb5f%om)gqL-8 zoTiF*>aPdxvn$H>O~4#P%Xle$0E>ccZe5b*A-Cj4W8kyjdpl-LjTP?Y{Qmm${pTQp z8vpNGXWge2=ilxEXKg@j?wztrW-A(c&sAi)ibF}c3jK$2O>M`r{5f{#*5(jIQZLnVxZ9;o^<@ z_B;;>OeYykevX0NmYM=Dd52M_I=fe*Jdb9uEqCv7)Xs)s@~Ci0_yZdBvgEww!SMO_ z9r)QrCZJt!JotkzUm%d)KlB`?Y@yqnd8d?Z7L1D4R-VT)%AXJ5OAGfM+VzZP+97Zr z1SY}`I2(teC>VTm3t_W(r6$ai&3o~DDqBl<*5&4Tg2K}cx=#oYhb6q2m6mhXx_R@h^+O6Uu4ldNdpcySnfR1N_H4RCRk&2=}@=t?Jm;~6Xt)=gO@ z%EY311mR}mpem|3Q8xS~b0jMfiJG)Sr47}-fqBxzWPL5)lU_3frN>PzUWaTbF*Zqr zrrBqyod=*g8Vi%?>2r?Hp_I2If+^~qhUhOIY^*7SU%62io1||1gitLO_FmI#?tYoe zLrYC_{H7J1NonedKkhrk!_KtuQBNV+0~EeZ0VL!&QDmqqFi1NFHJX z2&>+Qxxa{x$*7wlnI(b+` z$Yar&t>nw$uGQ9zUpESZ>hfC1-Ivxy2X0d07oBFlL&Gz8SHTgJEQg0@5)?FikcLFP zuLTT!aTUb()2T4m_)OBmx(r6G8mJ5bU&Bk6oOeVh3Sy^tkh zR~Z6QFxw0;t42fTnUw*S%vf|b7+S^Wz5>Gs!*z`lB@4$&jSLs{dh!~UCA>r zuB`ZI2$--hsS5UQPXj)4Gsl&*H{@n{17DBNqpqZYKNvW?ovh;Oo!ssR01=Eh4OeKg zrm?uevD+glz3~v3BdLsiN^tAC-(+Nl?+J=NYoj7h$8}v8T&hM7$F)93KW_7i9jy0} zY#0QW;$bs3@MjYvjneYx2tR+hxfds-=BWL~k^OeylXjXoxqXk{z^WCA$Hg?f>n5|T zs2K69E$Y^)&!}gjG1PJX`bFU*@nzTYrjYh9hruUuO9uW{eeDDcdJKHRME?j!JKV!! zc8C8fbZaqRTfq4%E-X+#g({as1pd`jxpbwc0St^FT1r$%W#?vlmJMD?BrX>lPttGaH{0d-WM-b5rN_r5vbSNDgbPm`>j27@hSy-ShEd`Q> z9A7j`>U~j}=st&wO+aA1FnXLxdkVOBsXf@%%;cJtGt5r{9=^D3BeDOqeSn#=ZWCPo zqG${40J1klR7F>&q`YIS`;Bt0#(|%q1K-#_6>~e*^7+DWy`4RH!Lp%IP)BJeVX@Mb z^im(RPouxszE3O18e6Y&W{XLe@h-~mM4IzgzXz>Q9ySN4Ul99bI@!IUHMC=dDR2gc zP#g@X`~#ATkBS;`khcBZc@3U*ZvptKbOXo&TIu73F#$&o+tJA#gDF{o^HE5;{3|EsD{87h@#b{P3|Fbb6{Gn zQ7$g?D~f{PD6}-)Zw=YkXM(C$Ob5do#vcGzlPk`x&{mV|thKf)((F|@KbF}8Ehw-+ zg;idH1LyaKnkeNeXe=oM>r`TBd#BmH0rJ)(D&HtDS&B%r6h9m>=(Gj3WLPk{jh=48 zsTf8EZSl$-zbib;3X@FWad~E1LwDzTA6l<2^7lgC_VM0RIMquGeg_nqDXA!lOUlGa zlZ6((T3o{C=~5f~x^r=2%AGXpInin{XGc~*m|I*NF`tt9Jw?AC-2T&FQ||6Qt(i%R zBDep(Mkye;GM5@BxH6}dy3~4`*-=I8dm{2~-Qg;tM(6Rm?b^Av0N)o2TroRIBs?I6 zfP0XGonYk5%;Mlx?y1||%s_Fg--?qzhu#}h+av|{NxPtxmutHP{YZ_=rs33H!ycL` z%6uEPyu=ZgXQ)?^e<04*p`(LkxtpTWFjdx6VcUh7w>J)4tWPdCo*-EM&1EE>C%SZm2;XpQ}*J3&g@SFM@Q`Od*9y>*%V%ee#U zZ;IMpBuMK_QM5yY_Kpzl46okLqzw3-lAgUDznkyzoGSTaf%{lG>ccFrD@_g@MQN); zNk1je=*$|cqRTyzA~O)?7g8eRj^nrcFEY+j+5zQKE5^qe@X7jQB#x{LsHd>EC3P&? zhTjP<@}GrMFREb|VJdXYINiMY3;6h+RQ`&3Ktf019jNp{&lINVc$n4E?+u1O+E$jt zncwua#>TdV#oK2P{(Z+cQF z^=n`9?`W<+mwRx3M@N_q9ZTj~ElST4-~YmJv9ojYd-;;s@DD6* z95V0`E_Pd-wCa?rofP995&Qwg8yi@f3(r7wF>6~|v_Hwgc~jTplZ7%x8$Jg*o9<@c zT(-P1yI9JyHeVn?nhsj?&Q3Lt`$^XVZ$wSr&svmJs3e;suROZ?YboH|xVST~5}^?% z+U>5euR2RV@Xc89$SeR9NPQB{l%Ye4c0ZYV^GNz9wu`|Kw$;5bLdYuK8 zRCznWNc;Nd2s@`$CL)*q=#v5S(J^%)e}-|EAXSD;{r&r8M&sKUcA0p~y0r?A6tRhX z^1{2ab=*a-N%3;Y-g3hXd^`ig9$7|FuwL7pzE zQotHeh{>pb?i;<0ukTV&P8pD;Y!C|@Ax=_n$lP|neM{@ z;OvlD1BcXLZiM)*(G*~ZBp$!N!Y?J1kr%I{{dwjp2KC$aVndA|(u`7XP0c&*Cao|y z187gg2N-g(7p9P#P`iq(d|Bt#pqd2)YpFA$8hjO3#@ZxW(aeOMlJJkoG1x_QE;nV^ z{qyV!uytup^`rcAF*=1R_VV_f@Q$!_Y6(8b6No zxTXnW6pmni@T)VUS67~s_fBEUO_{v37ibHR5GI-E;Zz(I(?cwRvEA9{=6td|2;W7s zxUtJD(dT#DR}Tst9TnpckWFkuB|JPhe>DP$-TZtDnROV`sJ17$6+XB8OtQj@wIu`1 zdr64J!_XAVy$p)a7(R8Z#>#Dd%>%QmAWmUmSkm)Qs(RIO{qZtJp_>!%rr)RBwa+{A zf>{TROf?@N-U}HZbVnD+J(baSB`mKfJmF}{(B?RMT5V8z^w&RIOx}~Lugj%u^(q`t}AIh zO!K_;GYJe%wXn1{9Og;k`kSb9@nTCRrlh2bF7|xILBlKwEODPLpwaw=vD-(S=wD>Z zJ+`zte9v;ruPt<|#Oi{LyQn=hj~BU<$?hKabq=%KShwbH&!+Q>_-^tq@VZL9J{`T4 zUi>lYlzhKZ%v${o_rwW0;wo4AG7h=|PA+K=5f(2~g40IN00|o%NwBMgt!{M!kLUtr z%T$K>nTo01MTU*3Qeut|s=v)fbM}RMuH<-0e`gEQnoU;V{oNMUZ>B}o8L4D%2QXGw ze_31-5T#?uAip2}HirpGZqTP9%TjDmW`#^zi(ES&G{G_-U1n2KL04_DltNP#QC5wY zIX!9CHacz9`I`ETlDc(=xX2LuRE?o1m(h3VeDHi$iDDC33|DJuA4lslz>6}wlsa`s zSXoes%@Nq=6qonz=mM%@m=%^#4=q6Qj9jZk%7OTu9i8Cf855N0Oz#|cJ-*WI^=OrE z`L>=wb-Us?)nTctF>F#q4w}B&M)a!HO05&NQIoG6XhJ}w7;#QwB}&|_@SEkCFQih-M9v1v&va`Esc1# zv$JtI^XLKxg1zUvK|*o|E-eng`*hBkfX79xX8P$N<9i&mR9Juypx#?XDfPhw`--kne4|lfdo$RdK!{Y}2 zXGtCShpQjpf-AKbUvqM>rpZ-=oMnxC$vc^;uD7dLAF;r((TllQsW0Ct;>?(ao@bF> zna6uSYCY*9uE@)!V)aJM!H_DQNg;iB%*XrsCgk3soZO}VLxx6J!$kFIiXca3fl7-z zsRv(crL!vYf^(t;Eti@KvEcWV(j(m|mcvrL?G5 z(8pTbfC%FmU&4RuuaJj{;tVxP7X8#n46@K9jU!Jy_k{@0%smxEfXo~jPga!|Y?4f~ zuw3i0v!osCmDXA|P3^yO1DtV5cj@-dIxW>zlM0TNK%Uv)lUt>dLMzzTdk3~#I4IVW zitJD}Rzy2&yj!kt{?uYDd{6-^6<{-4dlhp_c5WX<)9CLnh`>&&P{`%hG-c3#>~q~7oi)uZoo%G zFkZ*+)^LX75Ls~Ldx3w8EQzPp94s9LqnPaUmskiBZ-aHo*f-mH{lT$eN7MCM%F!78TqFviPtU9L3Y>{SF|>d_D!3LU z9BF?Zzi#33GN-UviqMAy0Jle~j0aY!=TptNoXY|6vysZp(HEY$;rbD=XHf{tp~0BU}$-Fy^n5hYHzX`TjR;!r@B zE7h$hTY9ajk}6v7{7+FM*t2@MsTlQ@MI{*>DXu!qjp0I@cY@T@L*7T{bJx0K%0v0Z z*)B^iRfi&n;)YDLZBciw)_03<7w*2$T^~isG3@eZJ_%MH42*aROtw3Cn5#4?0%hST z2pwoavGti{Io{pit(_?0#`Ti;81B?hHq$A><0h0493*)#x%sM?%t0|b2 z`y{^ckS(3=gy~By!_{zx$lLY^A3XUGcikyeUGx3*mWiqwzLwA1*9k%k==$I`bN)5i zw+FWJbx%khq=mUTj8}9HO%ObMdc%U#pf27~5|3(PthZ*8Ieg`G<94<{(d&--PWaLXtpXagz6(g7us*jOTc+oC=`@zJ#@X-0Z0A&_^qP`6 zh-$o%2ct$kHx_~E2J&at!Zc<1_AA2VMMk9f0g5xM)HF0ybhP^R$FdlcW%|;YNa*N& z=RK!(z(!QoPCYocII1ib{H~nbY#m6SYhoS6D=h7= zsSX#~oZ8x0Tu=^+J8GD|>=3+INcy|lU(05!==KcR%4Q+kvN;ajWaY?$u{JzeQ&Y;s zgv{Y^vfy`*vG6e?ozujf?0CWmI3UBaH-$NE6#JRdHy1itoBwahzz_KEcL|&z@fi>cc&=~38&Ai^81o(0+S5KbJ2nZAV z1D6hY2FSFuMrtPL2?-795v2)qvb!7DyBWu^a@p!GNG&r%9cRG^;nO|X2PR)zAvaW;9K zmz7ImGipz5o@=FO6f3GA=qwEu;XQGB6vy2TP1f9eG_2R|VJYC_7Cw5?;5!7si+UVk zM@}y+%1O9|N*V{|(+rO9^U5a5H9p!sa%8oWlIcH=S z`an6f^7f18iiSWRo!=@tJ@&~ev?(gT&v(6bxp^zVNzJCOe6V(1ZS++%35f3(OHpDS z4&MqGo@Qdig8s)pt*~(COdpKePb`=ICqfDDBwL^YCA~8hx~tt^d!WY|jn_T?AaCjx zX{vKb!aa-0epd%j{=rwN)e)=gwAPZ1R<}DzS6(_S&Z1l_9r2LL@w^XkAN;k7XUHeV z%7G9=J9l(x(~P#N-9tsY;wivEpX|RTo98hLsxKQGv&k~HZLh_wTp7@U4sUk4=kv7E z40jyk|9DQ}D7LyZ{aiGobiI?|eTob!ZuFlb*gLDFc<$MR5!t}6M-r2wKxpOW!HOUc zMRK;SsfgMsPAVC*-uJ^jjFrP#n~`F*1Xk(s3MvSbX=qHGKt1>8*@dfbi~-B|nj=sq zFTFA<);5c}^f4R?O=ddZDc;6zp|M{i?UX?av{{W30OTaUdR%k9-gspP+eSqH8NDyA z+AS}Ng@Z%tUILS|GcnqG=^Tm>_5IZxbq88zf6C-MgQJeKJ&Lf)*1wrYkg^zs5dTLk zm;$5dbXhDOK6&~VJ$e2We#jwdVDZ;r!|&MG#*~J;uwQIfsB&jG$+y29Am5zi_w@zJ zMGC6HbS(u{mU13riFkR5lHZ-q@(SJD)LxrYCo6q*hYn3e%mz-4kY^WRW8;w-lsq}u zUt^Qc?4bN~XOFvqJOTvdQBpd`&g6gx=c%8t9uV6sU_PHPNA@vT8!0HKpY;mYt{ah2 z49TP5V;eK_=Jdsu#cL6KV*I(CygCyQ7zz8R$x_`AVdM$Po)UyYn-vWX#)7AyPdih+ z{W3C%u(PBpDRzX5_ahT0O}ICWC2ZXnS58T>S~3E0n&tQIJ+$qbU9VJvV0RF9RLtz# zmko@V7*2OJdJs)jvv;o1AJTgKSHsu85PF2}Dra?cd0n&A-(QNDw|83+ZEl}p?Xoul z0X0Vc90UElyD}S%l+Cl6A!PdxJm*OKGtWl=-@W7Zw)EHS2=kUmtJx;uH*1$%_=SO#6ZnK;9D3@G&HaCAPfrLjrO+YZ-v0jeQC`&d zNO30k00{!Oz_&Ng*pWT-rT>zl*EIcxO!f{AE43zY!3NPuNfN{{PyPF3|HGYX2f6af zOG&|k09=ixE%E<17E~GXdJFbR5Q{}}kM#d2RXe(BI#eh{bj86>?TWB5y>A+&rMnNV zES|}rbsmWP`DyF%u7Q|O2R&!+eeP?rY6L|yV24KmDs;G4!QF|8p^;Dg4>fB?H|>~F ot`DZFYWVnKyI2;T%3=j|yoTP+^5)crG1`rUiDip*w!i*T7{rv;&Aff3D1Oz|u z&lfoHCp^wK2552=T(-V(Q%}ZY0d&lBeB`#p#B8oN!>|(MqjO66=)EH&S86 zi&QkT>UN2$gVOkqFFyp)c}=eZXw`W}5D7pKO<+k6@;^QWpWp7yN;etEvb_~teqsC< z%FHUU|8T^dHJ)&Kic?Zj(r3by`KvW1CMbwhviMVfiB*7{ zgd{qz4}?)j@t-pY`ocUyt+BE?<5ba;baZ5#wYX;sgC4KTdciRq?k3s&CJWyx+%`QRo7X1M z)OCK3AG}W7mX%Q_(P;KPEa}U;x;}cW9C3ovB+N>fiD7@dq9enH^4IGmk%Ih2bi9Ec z805Tp3FN?IlM%zJUwMDQd1S9Moy4(uL}z>gw8F~ptR;9ZznwabCDIJ(`2vGaIaAez z3ja*5^{fsqb<^#yd7g%L`~2W}nxUSkuQL7&=H!?%9RH%+FeSJdima}0ZHtUEMs!Bk zpH578HTX)l+*duRcut8;QUi1u!0)}18iLI5{;Bqf?C!ip8tyQZd4wI(a|B(Q!kN;P zhy16{3FK5&vpi3!%%-zs)zlWvlcWIyF?ihWpD#yWR3K_PI=IvPUp$$and^?jcmo3i z8Cq)U>cfFwcZja-7tZ~=TYKvuNhzaGhj0UM; zveWr3-QgVb7=JUcbob#dLm5|GlR$HKtMsPp_z8@cr>{&3E^u9cfNi{K-aM<}Iv+8a zy0axYYhU~T3jCnDz&D~;h6N_(a&>I7}`=ADk4kA}i=k~cYQwIda%BXIEj7ciGhGP{4LVVRMToM((2=7i71m(Xe5~=MIHDl*!(CW0 zE?NVRt8&=&Zs+G(+-1ve!B#dJKn!vW@`4J3Mh&K_&~G55N&l709zzIwXRP$3s)0oH zzPQ{KlMx_l;Ogv>GUJBT8tqAmKdDuPTBlsgQ$B{73L1H|GtZy=PI zHC!1Qa<~|(3vs4!-SlC04Z98+3^RkX57y5)ZS=wHaum!%{_ph4+>}rO*AD{q=!mukL` z8`@aun*HT&U%}fMYb{P?nFxL!^z^p2L4R$E=-U8``W?NGReOInz4$M$HhULN>9RbG z;D+ZTDDmCE)nWO^&bnVo&a{mkqgw$4wAccBTbpLK8}I@0A0ccB316xD0@FoD?#H7D zB~RiK1WbuIS1)`C%xx<#bLAb)rwmyYJazL?Eym1P%vR(-#EP>xq&9Fje1ovB+z)kK zZ^9kG4T#v9n(bsxHhX`>^7M1B{e;%Mi0XJ1>~i~nn)tP*@tB?n7E12Cy>Y-|9<`fx zR@GN`H2r?C0b1f?b~kzT8T1puzLMkmG&Q`}(=r-K;#>zdXfJ{VVP(6=V9dS?@4kRorq~b>(IjxUR@I(0;2mthN+J zH+1s=q1!Jpwv&sKlQTt?offtAs)e%66Mg^2i*<6}}%0^^Zh)l{kR3ZR*Drb5yE z#qVwe&v<7UV)K0?v?O0?x%u3ddQZ%uKh|$V<%+xG?Nh8Nq)E}&o~QfcvvT4TBajfP zZ;1*Qetv#FuHiOWAb{k zfP;gZR}}kQez^6uY&7D+ktQT@$A<^Mn3S{rZD2tJDpTti!Li3D^m_fZ&eMuWr6S#! zM=T8^+pd0HeB^3~<;AH!DPy*f|8#Tw+r6soz^n*EMC0Y&=}{cyIaXb{tujLnE`Sy1 zWe;!>bVq+seW{@u1f$AqYQT z0*bN}@Tj@<>0ca=FN|)}`5TqPbr1GtJ??;zjAL~P z+3&|lk3;m^Q}+5|-Vbu0kFV%FBloy^gID;v@(ouuc5g!rO?(fuz8$k;_o8l&PX!uk zpF3!5&EUOBJ#mrt+hx{=Osfl`C(6%2+cd z+bK$$VYRz=<8ehuy|L!*4_mPkw2rR{WcZd3_cOjjdOs~;?IBY1ErzsP^~{)rdz`#_l6jpW?=2w4uxI| z-?wnwzy%Sz%5>XZYu#^*s#*`RtJ*Kyrr+HT64h@zuY6+X=H~od6u(Rl4iEDzsl{V( ziCD?NlYc&rtG{w*7{evSRGq<6VF}sl;*BTK=2un0#|{S$?+MPcfcyq}+VbOvM8Gd- zY|nCY%2Bh^w5cXvm=#vuA+$m!g0k-M;P#tY`ZIz2qp zx6CkRG$nV5p3HK!oe0Zh{1~+AJ9ddDu*lV%GVGlZG@;-eN#V-K!|0c3H9;mZMM!@j zef{%269xK_i!}>p01}rYs1Su$16+<=%n+oG*M)n3!G;{3^3qdM zz-;N*rz_l3If1;s3y;V+&r`<^4njJ~zi7mVonm zTprPLr;4n`jg0;g#_hzJuAO!qUJn3pXS6Qq^uM>Rz``#$8Azj%F`F~-TQfawM0Y4T z2C0P@Gnq5_9;#Gz8nS^#wVr?O0c%AJIlQbBrI4pv|_uu~^Fj|S&aHqzJ zPxx`%>%WpQRig;na#A)L#cncFd!VkOj#rdBFPO*z&{W?X?280gMsrTZXTHUeDE>vE z$R-`fr12edqcJ^uAV4;sH2SN$wY~boIX;%4KaIm*a{kD9GN=pJ_d@ry{f+4=O?2YS z+}zBFwOiXGZncLcD#=Ammn9-NlHS~?&%r8dMN)GL%4{l2X#M!R=U!oD;qdz)a882r zvHbQPbesf1l;>8T59VP6;LP-Ju4$pha zsum6@DXA20H#!_P8-wfZUYnJ=;81+eu&uApClgcC9TzS|RW#Y9*~aNbBXDl(aH6>KtTU>Y@8a2Edf@wLOtjH&X~DlUpT86vlfXf~U?F`piLlI*}D zP@-g{qJ0*Pd8djX{*G`~0`Y%9yPMh9dt4q*99 zU`8%P$u5RjK**r~04#FfvP1#r(_|{zmRVy<4Tvd@;-dR}F}=3UQ64J`M9AhTCo)L7 z!a`&sBBAOInXu&sd&ZhlTJ=~p8!{dTk)Y2pDTOhg37{6UX0CHE6ZH_pht-c@=5du3 z7}u>z$ee!={&InY4ywRx1lshEHK2_8%HTu&XA!P1B?Y5gEcYRfu_v8rlUt|3*WL7e zYMIJ@7uC|XwzS>e&xSVe+|8R#%ve}hExWtV3nblQkam32L}%X%2thUjrqt&%=IQH7 zd!NYSEYAr3j}v)Zj+*S#Q>)drweZ+j^Sz9!GwYTNL=x$unIBcqEjMNh?7%T$jOGzL@(IcpIB`;wopZk=NIy5N9CLFA(<1TYa~ULmSocF4pBS zI|?5Np)@>U;BrFl`!s|S^szBPE!mIEBUZl|3&{0=#W~&UpPOP=fp~4#y{2 z3^qFhu>`4R_<+G>3>=p8LuZ!tk41_FhYT1q*2`$YitF`F+5_n^ywsA*>;b0y7Z^oo zA0JOVp`hrQkIxR_@3=V}y++F3nt+I?*@B%bD&vi@SWHZXl}|-HyJ2s!!L-tPEGSnz zld~)crnka`ZI0$Gg6|RbWl1VYj0<1y^XBT!w`G1f(x6p|%i*w{O>Us7u6{Q{(mixp z<9zkhEiWbpF|&5_5&HDuumAPBbeuM2+q@Cc@90Zz`zoc5_|1Xj$MTJxRd>sYih`#V z&90n45Te4|^nfBD!iSbtRgt5@#HaiT=r!PQCW&YGEsz47AHra|$pJB(?e6WLz}6i* zxj}t0f5cE(nl`NG6Xeq$qBLVq%?!DZXk8b#UQPe960QLp$eEQv^ub8B77uK#gDu+s z8fU_|BQu`s9u~{75|*SbQJW-E0o)_>+Vcr^yUS=yX1z?f%cLW*VEsG@I<2^3M*7p4 zZL5_q8CKT(zJULB8AYBD>*{c|gYTYp)&Zm-%6KPAm*-`IWL=LhiU|AzbAugTT?ROx zUd~{ztoz2rhQQb3B5~ct4TIlrmk}Ro1U0%njr%G?u&F*VZ5;$g*pdTi5?NTuC=Bzg zcoW$fJptnjr2ft$%j*K+eQ6xY0d~7?4U&PAJQM55Cp1a_JviC#6If9k9b@Z(kom0$ zsWP0x&7GfVSH?exmn?mEM-4F1Y40T@NDwiZy37DrujUtp9;Lu0%rrs3l3-Z)4IC#E zjv93=@1#WR@sjNH@y35x{B%LW*GYgeNkfWGq9sQ(xN$Q8f|+4*|5Hrbd4~nvdBxUw zLq7M~@f6-DRX@o{k#m{3zm&`Gebt+ZQYCE=3};BYN<7T`F!dc{z2a%psbAI^Lo!o z|Mmw2Np#DlBC+&iemVtz+lAZh>fkpd{{HrFpOLz#Jj#^GL*~AOB1_7M?=eV-98M^S z3vBed!l_RoolM!nw zgC-p1Ct+D{)PkMZTpm~_5otMI`Jg{O91<*LN(Q_MnFwWpad@L3gMdb2Etf4OS#;cR ztW|?SJr2~<^K7MS#j~Z|8F`-nN|KCN8Xk0JTyyXve$5aCz(55mq-VG8X=(@care?; zuUAed3N3UaV$?ziuIvl!K6adatSSy#Z3z!2F(sj?Y5Ys7`mEG))QR2aJr?uqmnG#fBwWt0h$ zV8bFQlG4bnSssBNTm4ZWgeCuhUS8U4srX~h&UzR{p_YO)9`#5-jAHi=B{53lTrCP9 zHG(3*tXaD%BcTg)I93BmusFC(eQz`Z9S7s1VVVhJU0j+1G~Ehz~- zpfSJ$_Z`==i`(0AVuzge9TX#5OO48+BUzdT%u@=hvv z=O%&&OOMcNV(`nidwTmdDi@tM!>i6L(&T*g*o37ZK9u2?P(SA_SZsXa^?jW2jFWiA zcYVK}iKf15>g$f32VLZ3MS7&7E|6Cwx>e8cxG@<)-jRAXHgoj!z7;$R_=s{UoF*^N^EToZ@_Okj5_{-MP` zv%~c|zU%t_9Hst`Rsa7V!FFcO^4mv1{6ngL^S0%TQh=a5N){Hj2f16yB9;H3{843P z8Z_w0$jA(su;!Tp591kKF|#IrPL9v_y%2a|)2Km`{;lK75ml6ko<5e~^E#B2f&v9T zw0rIq02Wb}f5wGuzyhRK9b0Hm_u@xY^RIbdcfk9*_hs7|9Wn|^xCpVn<;FZHdPWMQ zbP}0KAd;-=l%M7IdhDO`0AId%RDRO@EOX0^FJQ(29;6idw;;&*TJ_a5+@I{FQQ&CklWJ;ZCtNLHhnG;DO^YZeNl9JX~ z%o0PuVGs2D25sF5!I6-a9Xz`8u`_p@75U}`zpt(Xdagp)#Dokwt=7QxPQM~*umy|M z_c&+YbSDW952uWn^YY4&pOpSz*Yy=k07NKJi76;TJ34q+WQFHhTy!aL;hDeJ7b>cv zic`KAxc{GT3j5^mE=?=S^psKjqx|*BlLztNWD5&`G}Dp3Z>RYwH-Wr$WpX^FeQaXMoy5cbk+k&GGW+_iWY`{ z+J+N(*;O0$LqHd&flm&vELUd!OPKquy7@461BSChPi zqZCUNUJ%62?YXXQ~ZBuZ83g|x6&1F^ZLL7cL+J;TWC~(T9}-)G zk8f^@WXc1t^!89iYVuH|2Uhcrm*d1Becsaga7y-FO7#i))7b-wesJ~0h^*%PXfZMJ z!{+k_B%12q1`~fX(g?0~2#e~KyR zN%t;7VG&RwtyK~o9y?MG?y(aqE=Q_36ToZq!CYj>OxFq4=H{BSQMFve(6p(Up1*8* z6C!2CWFxa!{H2P53be2r8jf1`C}2`BM8})iO|JR2*P8zJunmSdgr`WyjVhd#pr(x{ z)q{P?RH6gePodv(;e@9thQGTje$N)4MHx1*c*^+lJe)KLba^g{rQ?a5zM~Usuf@8x zQ2&Rto?m2L5{mwFU2s>u-O=hZ9?$gzn@%uF>uZw7K6c-6-EWI=qD5N2RD?012KHaV zeGDP6XTytS{UTE@w9no3=<++KH;(7}A6(ky)B1gqw5da?%wh?KKk_Z$|E`+ye5`Vn zaj7t@j^ee%rFU@#Etg;kmm~(3XCEFkPIhAWYV%OtsG+(sU)FCWNj~%VqA7cGdEDqO zM^X6FS^~d+5)vH@lqB9Y((4vG9I~gFKF3k$uk|h^##UC5);ZrnaSrsDeuqtFOyGu+ zh|z^u%Vxh&aLZx$uT=KsP2gIO!TljP(&4#@Tp<7O_ z0qIr?3HU@>G(m_~(!Z)_dCKQ?G5vY7)17U5|0 z8^dph;E7S={#^E`sq`&>a<8=42jm<6gg!|vc;u*UN0yLQC++UygY^hp-(q;_eTY|WlxafBPoLa^iIV}VA)&E1FA@0* zIhij$cq>Kz{F47}O_nz$iV3h=++NQv6^sL4Q*H+03>jlQ5Rz|m_IzJBCZi;%f2(Z7 zAjO5$onDkCr3H$vQz|)djK7-J4h;;T3Mpt1IiI!D(rSY?CMGJ5>$rEffdHKqfQ(*1 zV-YnP85uR7Nr{KWHxYLt5SP9o0$-!7w(GgLpiSp&4g2(<;(#+;mrcYiy#fx5UdDuU zWORkSDNR{Dy&gf|Wk!ZtQg`l{l)md)=uoN$PbdKS(7X;jYxPy*?e=+~1da^MGvs9H zej=SF_%&m{Dnysv9ycZ|Uzf`YbMqq8WyU6&b;0v=D$er8?^Bj4IYv)T&x&3ThU7;v z`Ae1MiIO7ik8Dd_6Qbivz(;m%;Rf_-g%Fpxt~(HWcv~3}q#VNc8fGKRGgw6eRa#=!@iC znb@3pK9p=Ie?uXuiq}!ZC8!God?8-()Ca$=hR84INpj4;Dg4Qdm`Ba2&rK?Oost*o zqRn~_08uiQ6#?bzYlCiV4`CY=wGyMt4}~)#v>RF&2SWw-^P(+Oy|5sMgr?*6Tn@zE zO8&h9-)Gy1TW&YxwhNg=L>Jl>%sG&nALKo$f?GE1^{S1UAS<~Ai%X8hx}V$F70@QD02%R5nxYpf=hPLsp3Y>hhq9f(E5h{cy>n77 znpQ=VcBI&f6dAMm8giXc_b3_?|L~!cmI8n2rXjJu^Pbo)ogr!cf))4l6b^UC0IGT^ zvg%|c1`Ke))LSE@GJoyS83dxI(k&({i${yMaZLN5qQbrx10)8WpPSxEummuXBIn-{ zRTT}gAQe)X1&Wp^2~AqHvPxT>N#lxVf^eL!`1}J~F4Ap)*|f*)?l;PXohLA_q=uHr zV881yX4UEL!-lFG*kW@lqs!vSN~*HD#vM0_wSP}5uy$EkoQu9y9GkJ(yO|l9%Hxh| zJhWeDExJI_2n@kY^@7s6`zlQ-#gZqk@-ACgp{*wDMH*~~L2oAJi6))p9o)HrT>G-u z;m1Eq)260qovGnqoY?NM7j zFs5lOhcBWL6IfHQepDHYBxP!Z#;pH}QYY~HP1{8(Wv0{LNFw7xiV;7vE+wwc9KJWS zt$)Yj=i`W{%4>^zWyyU*%vJKJGfgUuY__N9{adc7^8<{)YaPrbJja-$o;*6gVEHdj zjn+6NFHc9XMXW3&xK&gC!K**lD_cjw@Z9Gy(c%DhlElzPmPI2DI*#v^c3_IVSKXEV zdvf}2Zq2ko#CW9Z*y{3pYee7oiCo--JJ^`caI7u6(&ZS<^nU z9kzAR_#Xi&8JO=;YjvQ_^RUaMHAmq*+$_cMJPi4wU5a2s1)J*gc_2XYuEpH~;;~98spAv7ye)u&ua<51PCA9< z7qu~rl4D_tf;P40$8LHBtv#WItik!9I@4Vr(SQ|EhU5w9vWwJ~Z;D%5T`GeivT=kC z>1lpydk%u%kFo7JS~ZWfn=A} zLjRg;xgwM`7H24ds~Vt9k0*^*coz8xp7o!l zG-gO;NZtO+UNst~)D=rz92xLQR>1y{W1(e_^-BQ2m^P{5Pso=Ri&wOh7yc)TAOhRG z$ZiV>KHC#o4?CT^#>50=5zRA?+I3Rs6P(@2{Dv;e+Y-l-k&ZY^t|L>`yTK9S&g>I| zU)nt(7M|77PVj;VxCD0O{DDt0|v!xiqID{JS%j1&wei?~Bv z85!f;RD~+eiR8+E)G@M9u4+5T5>d5$0hrE^DQQo zaP{_-D2B774=a6TwHUkRC>DEiZ6(3=@?NYGwfs&uL2HtS*VA2cps9+8Iisr#lC<oYwjuB&w{= zt&UFcqqU3kYE3BF$9d*gIPW`!)ZRBF8V+x8GM)DzW99mVjbAQwsTu-zhvqMLLwoy^ z?V;S_AE7jO|zZ#>)u`^VVcW;Se0J0;EfLoT7eBDn^)X^w|mrRJ@PxRq*2r zEvN`}Z6ZVk#b7ViP$V-P1O&@SSnp=?(;LqBnu)}IFF-%>9@vo5WK)~~VUcV;lHywI z+)2Dcn{EQ(-mlh-0qrk9Z)L;GKDz>dNA@}7g<0SQBMPFfIHDrhTWKW=?xfI)*OQyq zFy9?`GEx~0I98iw{P7gWmHlE(2I|+NDf!$|L*laEDVUIHD^c>i^(ZZ6lon}7XmCau zr0o#ODh9obF1W#0=fefZ?jLr28@3hidw$BycUE=;?1A8*6+z@aJ=s~h(jN2Se+pIW zo$c{Z=y677fUP;(+RL9D$t1L`K`(tlQ#ftmU!oWOTx|6#^81GxLq0kjN=S?U*!X}+;qbseiC(~6ZVtUQ!wW;c6}7y2M1f7cX<4&4ameluu=>DX2?^QmXIr zShmq|1r&?Zmx0Q4Mms%D$tYgS$3aU}X|<(Qr#UAjMirs9^synZT%5D(1UvxL zYQNVP-uHH<{QLxdX3-b-si#XOl`Xj<#A@vEs;EO1a>8UEHO|<=^eqHodBs61;6n)- z6@fQhR61jTw>DN*gAvn( ztj)T{5XMp~R+uD~j9#1ALxk<0rH0*Rjg#x38C?pBib&*RyZpk9Xo|QP&(~Ib7iG6= z!b8Eqs1!a-P-qhlQyD`%(wbp%gT=N|`YmzmVlj15=3D?KsxC1yG}4Jh{u%+1(RprX zW%T2Gx)T{F`o?6u?A6`-+(pBQ+@qaFEN^>i99TR_I|nJ8+064eCZS~s9SVAVj7?np zc4%&t1JHf7{`A^QG9B7aGcvOlffFW)4HaidLjxZ8g|U2BnEu5K&!F@rl31` zFaP)0F*G~_y@vGJhTU7T&wz2x!v<13WQweuFhnL)PGd>_;XRS`BtfpHNW-WShE`k) z8p}%}!PI2iMBT7`K6r33{PKjzLS`tAJ!1VDVo^obRKbvK!x6Xxzp>eMVrwA28ULW` z33(KcDRk|sJxUux%>6z*5m((aR{U%y^N)OI$nI}pNzRt6CMd+qo$cErk6yp;D2F@L z@Vg(2ohF-oORGOCLN2e8_3x6KvW7z6HE<*88t>mLei2)!oJirHdV2?#D--z2eSZNv zQMgJ2+E-O(@*Y2s;AqH6n2<4}Fga3vNKNul+E>CzI^*JE9`jw&$e2vg zR2LL#34bExm4(pZ#F0T4Y)%dT(oVWAzL1V5O$-1>aJpJRo@}I7-rUeGOkptMYu<7t zn*y!Ae&_ajo*{m#QN|um1})0z*jI)W@EfYFDp%TU zf}EQzJ@9WH(FhVs8z~BhYh0NzEu}xrsKh0D*+v!$@CAcCuO}D_nk@S^XG=oc3kI{N z1RJEYbIoG4vGGN6;z|@5EmG)TS=I8`&8lc@v4oQeXMH9Ew)EqRyU)?RIt03l{ea6N=RtEw5=1H*FHdB~mlmSNN)aJXH7#Y58%rQ*GW(90qL0bl9BVCa?Pm zv+eR&!XvTmjqz-FJ=3|Y^a|u>77-#wHzrl>9$cD-c4=B2lsAl+4di*)DN&pSWD@r- zO&JH`T355o100GKt^vJJYK*Gi5~#1kC?Kbr$jeS{%Z^L4Lt355PYkIOh?;?f^z2|A zbtzfI9=XMwT-b?#vW>UW^Jf+9u*3XXZ~9R3^|5Ehmx^j0i5VP1;#5ieKm9kLZ!3>k zu>qsbSQ^CjK9*F!Q4Hz!Z?@q=!f#w>eNMT`v!CaK6z%r}G{XP@ow~Y872KJbUo(vi zdT!=d!DBiDQ7`jUac+0FX`Ka=={?}aVhqn8ytvoERq+!oCG=VkkSzF$H#Q9?M5zRK zhO$=&qIYgi4ll~MI`D@Rk zj_#kxi|AVcz>wJ5H0bkDp6%Sn-CyTDl#P*UxJhmK(i5U@*!9C&{7Iy+4+t z!)6U=NwhxZFwRF7(4| z1$`ppN=8ebD-A$yxa-0tieRwe_u%s)E$~LzPg90^yYBRfDaxj08W?1R+fQw4j=33u zx6?`7mqQjik8Qq~#UKevYymX`jPaz4;=)pbx=Mul;iv28Y}B^0*loXKGqd5R855@6 ziEe*sdO9LG2wg~J8Q9WAm`x8K&;|3q+mu3pXrE0eXOAF1w>Pa|nFVl9<_(9W8a7d-w<{&bstngd_=oOS>~VmJfFMyN1d zF~o|T7sWM$h4>+t{3ClMZ1$9xPfthW4`UFUIj!8! zo1Yy{ZFxOyx?$~Vzz}-Y#U0~pDRD0GZz$H%#z+SU{}ta2g<5i!jol*S3Nsd?Ew%97 zZX8MHFv+6!;O~A~kw28t;%v2DEXkJ1zS-HZRz2ln4(b<1drh4zE`Eyq73h!l93v^| z#kI%7r83K^<4w~s9pGah4>B*+w}zz`5g9-CV-Eg<$Jook;bVwIg)vC)vZ_Z$Co z4dnieJ=%U&W)2MinKwNB#WjDi@G#`mo zX)+}7C#9AH9RI7Y-)SGUqC9gbpWa~77$HPtAcs0^(om)iHLIe-G#*XcRk2COCyV`6 z$tm97e`t04f$MKU1W!$IUHp@tHy~tA_piI{Kr7Ah2qoUa`Bqan)6)q?E5k*j>G_(v zT;vhWR)kcTz<}85v1C-Nt(m+fD1K~m%#iWus_FC|ZA zz2zPMsyYfi%vk8~P{Z>ItRR=3@B=*kHU{4CZ@yTw%Aclyy**|I@a{@V~fo`n1+Vml* z|31S)ZPuHXrSWB^LJn6Aw5~hRn05H%7UHC&vOv`tfJ_iLN@)yG@vdaWwR6Z1>1v-*eqU6N)l6s>tI}5E?eT+?(GJ z6rJ)d!l?^r?u<`MV-t!oL8kSMsqlzY4b_@D4mDvI1}JJscm{x?7^t*UZ8e3UX~!Zd z2;4O)D|_H(GbR;ipa80n&aDcXaP=3)Fld5_EQ^*1bwmpRHZLw3k%c3PsD3&C&$+28li>sH=-Rt3&C|L%ID` zbgg)-59IQccU3StVfG|_tvYglbC||RdLX4;l{Ge|P^?eDY?qqfiG4A+priizv&71Y zWY7el9`~DMMn+VW)fOLoa!X8h!*P{Mi(~U#jCmjq(Ym0xFwG~Oy}rF6Q9*jn09AnY`$==w-`XdLdg9Ta_$bJ`9f}*x@87BaqX3|U_-)gM7(p5~3 zCD&(_+G*KOPT!8Ki0_Ln_ESq8O?9{(Dx#g}dy>c#va%+YSGB=N0-!?s^*!=tQ&Kdv zK(Rd}Nd`9?dEU-ptoWO^(ytTmQ>Xp5^n~`>tM68m^1T=IboEtl&IxWZIn6eG zj|KT`-u*ULl564i%Lu;wTZ%P$Ny^J^^xw~yhz8NrjuO~e6 zVIO?=Pwm`07kPXcIZOi(GYHK63}9kJM5s7o2~*9c^G5H*SMSYXH{Zpb$NkO??l+n% zt?y);G_fcnG#GS%NK7CPD6Ib|=kQc+TiInS*7x>DN`V52cfRTVBch`AGGATYjfY42 zj_T{@vZ|`X!sKtMHED<56(n6^LSm-$hC_yG;k>W(U>3=qOD3<#lD+9sclv!67ySMD zm&fC|X2n`lWOQU5Lwoi0(6rnPRY1A;@ae#wBeR(*f$rm7d#S6L%`{w5HLe?%mdlJ@FBf)<1;95ZBe@cb0aG?KY%#l!l|D&GhBO(8vPjQ+5`G`${s`*!l zfQZkCWB~nd)||(P_`mxg-3R_}9iBG){H;X#u004cAH*OHvn`yY6=19Ho92`pLsdQi zS?#ocq0TvrPLgXvrOj?@;Myjs0E!mf+t%6Pos)%B9|qU%R#(FSExHs3OJIA1aC`gt zQzP=Q&e0NWFL~3z@8f!3vC@t@*(Qg4a{7e%DBhfJw5iav1sXZwoYVp|gS#ucS&kiL z&VQe2k*_u@(ez{l5LEp_Sl#g}s>w0y*s5I%QV1 z_fX#6EIj}B)%!bP=N_ZVn@!gHu8sHAJD|Uk2o~35$_GGiOP}*KvDWc?Xxaxlx_89I_zx`ZXJW6@;StUH^i1iZgp$(%8F1&kOlNW5!QZd7Ud?BL zQso90hgMp{YbEwL1;5?{)Tg5P0X~~g zDO0Fp7}e&v9)QIVu8;tNF~fgEE<3p+Ky46J_rW}O3-mS18?wgA%#+d44K9z2_)I_! z2dZ^uj$~9f_-X0smNs^|#xvqFkm=mnFXclgWCn=b&Ff=O@^AqR(Fcx$HrCD)yKP~_IZH``m zbZk*jTbsJGuT&OUFWJB~LaE=kI;JA#nPy>UQ&8KO*;PC8@wSHxPP1NR$KgnD!598mb7YLv~7KAqXX!)pC?HoGjp7Sa-%1&cJ^vt z#)OIuI(O@Wv?g2spoTrlq--=xvm5jI0)w4(0IB4+@QzfH;Mz7JPW7i+I$UTT$~`2M z*u&@&jkZFA-s9)I{+;^Q1%}Rp_*Q+TQLSO~TCJw)rn8A;uTi~Wvu14xOqrFSDyfNP zZ$i>!N8>jslo~#1_AL#{qn?}mkYZmot2JuYR48b7v+Xr=HmKL!y2Avji}*INt2eBd zX`Bp0fquS$BpHatk*_ys>~j11XX0JA3xUu4LUZ$ki%dS6`;7jI#*piJ3OD14=sp7( z{@$mm*KM|blcLQC9drM^CxQO?b9#*d1bsBRvy}6aYX+|qc(w^xr_bT7!#8mV^1!ft z9+(Q?T|gA>9pj9`w7lOv_TG@!+J|*2Hqn-<9(S79!UXXg9o!5~>^4C*VZjNefY6vs z*==CQ+uZaCwP!@|g56ZceW0vhEXzF4c5jx3+-3uk5=dr4Q;=mWbqP#Lui@$x{^9Tz zf6w!qsFxJ7>X~bettmEKb>~Qy^Tsj4@_p3lgN=s~t!XKflM&qkRVRxjBa0-N@hn}I zzP@bJdEwoz?`ic0RxoKIjmh0(aY`nh7uXH+lvz0Ve6J7oM}DqrC|061Jb7 z78z~L-LkrKa#{MivW`gszZTSA((9m{azg7N^$wGZUvDOK`c~6)NNJ<2U$K)+hL1U# zlhrqQ#LhT05}Y+^Kk6&0Mo4?nbEY_r>)qV{wm0bAw8+;Rt-_hTM$v;m7%5&PWbzX8|-fwFD zj<-b@zM^@0hDorF3=ppzMA9ql0bP3|J35RQn`!*kmz7s8UhU7BU5a)CE)V&JDiDe zZOR^Pa|mt#Ne%(x1ZVGQ003nPx!dgqiK~lL4+LmUR?Ky`jNH^8Dapw(<6*`U$SDxy zu5)HnMFR^{x%q*xp(;{G(?hJSQ~=yV&w7k>YwVxRDu|XB<}E*?xYwdLjB?Vc9}8?? zBIX?_$Wsixzu$%MpZ5a9?@RXNZZ6V|N;$bgFR<2+$p7LM@S-SG;q6W4>&%LpQH{an z8u^`|ev%zVNCi`8iFj(eJ+Z>|id?Q)-x475R>`h7njt#54uhL{bvxC5=F)3i}ste>?Y1q^>MAkxB4LAuK*g8kf^G>M)m3cuC&jc!mfbpMSV9 zt7l(3QK@GaPyayPjh@8t80>8-Dz5!<{#-{(D&UmR?NSQH_#(s4jle$JhRksjK5MP^ zk4t&fAH~s-BfjB;K}Wjo{|6C4?!Nmj2M!(P^yN+_G>~NpOdTy^;x1gkr$4`&xt{`SeVyWs8aARdzWaS%I?zHui(^{d%vk+J{=6)VtcAJ$_P_GN!FFPXL2qvdt-kq` zl$4Nmv6K9wJY??`Iy%SR+xuYN_7_hg?o<_}$;8xD;I130X%N#ToHN$&hksf@K(~Rn zg`=U@h-l+R2vX71WPe(BmeiVW2vaDXlI-y7nV3_6<{VtruHYT4i2LB_mI#I77-|Jx&Xo=rW578>H>`M3DR&yFw_uO@NE^JIHGI1G)! zD`z+;dl~nJh$PM+Va8n6<)&b_Sx7G~XKtoM{Tn~zdxwYa*stQ!iA8jhOP2Gc*;Zl$ zm-)#*y}*Uu$OD}*K@bE%_$W+Ha+eg)4Mtjy@XEK^X_;Qg^vaDq{fB>w!}1;e<>d?L zl8iLoLhboidFOfv3>{zpAVC9ERYB5%bk@Gko(pjnY}r9df)oGL{H;(=Hyusml+Bz) z^&ExlG@0@1ZFEfBr*)=@VOX)+RV>Q;jQ>drs%#SOKFh0nk1`TbF=Kv)x?()gXrUw{ zSpzieIl!X7TENWAVQi*G+)#0+lryI^m9cjwNY8ZPFh@Na#=Pz5hDuS~1Y{I5%4p+J_8zFEKOhkgj?q6Dztt{N!#CWGZ}`F9C;;RPrcG1u zc6Bp6HuVxbPOPc|rg z3DZtmb`76?ekBD7CgGTklr#(DwSJ<8LRw-5wn#6n-FF680A^f6x4Oxlzl7w_CEk4V z6wM;I5(GgIe#fad|4)*^)WO?D{e>>-uTJ2s`cG_MT*2!vUtri&ki)}Vzj%ssS7LYU z#I49+X!v@sa{QfEx)bK|7u$EUqq&Wr*N&rydgy4oPN-%v>o(`$^N-Nj)^>Av5FoDW z=(>Rs*NETfsPcBuem%hAd8L$tNsIjvB*SnrI4FuMXxN!-J>BPV_G6~oP33E z)tLlh1`D+)x^6+W$S9^paG;6P$ImkKe(jP}9PT8N+$xcYF(!hs`_CmZH8dS;HYXNY z1{4Yl^O%;BK>O_hmSLdj2Br~5({8LFl*paCh3B5CWc0vydHrG#vtR{ZdA1sxDgy?J z6d>ZN=2N>ptkP5xM)&bQUOvS{WOC1@35FzNwOQZWGyp?FRh6kG1Q{KeoJr?MU&g1N z-AvBJTfF$wYYa<;to-yw$`lm^lel5xNKGemS}L@T-g%l78xBHTJ^Uh2J*Tg}M2kO6M|&sT@g00&O%W%4 z{B8EMO)c|RtR$vpP*7e<-n3Mbv39wGAU&h zB(4G|KE2`5|qI(k|^K0o2TY3Vs%d|$%&~1B?U7y#!v{by0NHMQqoeeTNMo1 zPI6uaa~Jf}K5C#CVaA4f8Jw6Jwo{UryY;JlX-~A_kc&O#>0nqm{yJ)=F%knL= zS-zZWc6HD`5Jh!(kd+Xji9yCk zlPRmoBR|W|fTUxRO2#yerek|(yw*v;p%S0yBce%D{Z|kT2I%e|X34xKSXpmnG!|iE zxQE{HD3YXLu~|`-yK~n{C~5*0n?a<{N6;U^nv+LKo(I*dBIz349rZN%%cxrVBHNi1n573F1A z&Z=V0+y%@jNy8XxrlmhL*)GY>w1OEFX32D2x=2IM!~?8`GnnWdLr*GV-s;sXpAPkx zS{Ur_rmdlYHm{YM?a#C8iKUbznuIOs%&sUQogvO&>%%)bLeP@O@|91pa&;B<@c{!-QU6jG{C*l4+Xezr1mhukYSYlG}nR0Z5=n@q5P! zL?>@wl4`^0O2B2epvV%KCR*6bgg;E&wBT^rk>e4pe%ZJ*ji zvEgu9LDw))ARZhk=D9NU7$N@z{_s@3Dr77+J9e9l z77i299yCb}-=iAg!0nNqiJ^t?-SJ!l zEfPe#dw#MJC*&O=^uGJOwZDjejEMief7hcye9<7jJN_<{kXAxzWgdx&gn9c|p{!yJ z_j9SCkwI_pj(x@a6Wp9G6?<=k3_VKlJ&8MSY;I1zz8n9J1ek~f?(v!ov}g$J*X-_I z^k{&wq4(c+XkvtWT@rfK$MB%Zf5!T3F1j2>oUG|aDG*I*F#ju3v&Y1fH`gWNui%?NuL4d4AdK@bE%_}y`H zlDj0UnEEFruaE_IS_uo*E+^k2Vd%F7Sc(nj*m(weI~nvoni4Xf2z{scw;y=WH!Wqw z<{4-P82T{BzW)>6ZT8=PewZK#f*=StsrP@%$5E8Q<^%lj8%N%gssI2}Cl(XI)g26- z;N`dYLE}NJQ#EKzBTg);Jy^;MK@bE%5N`T}23TO|8c|&YQ6G$n9*ZDG-vmJr1mWR) zVgs!El2mMVD;7mYk82pnsEPvU#G@LfB4fm2#P6CxtypX*=)~g&ip_>aQII9jwFu$p zt${RIQBhS37IkWpyP*@0MTy2me~@sCtXfbc6J3kHr>9W0Ik8(LbS-+vwe=exOR*p` znQ!jaWi25q3bLuABV(~Sut+*_T}M)^SR|cjG)gRPBC9GYIh6|f+`urb^Ydo8Cg+~FfjD{ERc{S6xBMF&IL>}PBeU@=(vO=%cvF$7F9)-O!U}o zi(YQ*!eYm1Q;|#qEgB|z_ZNz4!)3Q1nNvS*G<|a4%4DH+>(uuLrj8bi64Q*Ei)5@0 z$IaemBOW6b(})|l7A4&*xNaJg-#wZx7K8}Ghv@MQue10 zc^g<$m5Wo+&J{6l z$(~FWi>zV|c60LBK`wN9sM)xl<>>?L-FJ+Z!3f9&EZJ6#dF3!?+e4JB*vZl&7m5T% zaFmt{`#5^lj}FL|G-k|M%ChD8*h3oL?(>{Hd4cwc2YE#nGRqgSWJwj7b_t9zt{*wV zsa7AE)k`RIj&SK>9RvQU4^~1pb81R)hQ{eta#&Mtr}@H3j@S2LkVM7mrDTN~xp=;X zk$WU3b|jUsbn|LT5+vffiQN^a|H^re9I9v3RLQAc&C124BpMMkQ$-E8arm8+G!6zZ z0gJPcW!u+NnruNL%0%B)j=fn+@6?JBHFY}km#<_=o}F+^!`EHMsnZu}_o`%8uV8h} z3{tHc5iBUdL9SgmO6|2_qNat684Fmlq?#-TV44KFFL3PCMLNghSQ65iwPX!*ic_&k zGIDg3=8H!-cDbMEgD+MV1mPjwofY!&A%P^xND>q+e}<=4mEo~ZuBb#(aThP=>Cf+A zUfR?tl0B5I-No*0HKa-^*>j#?>k~^Ta_X3pOx}XceCA8LS(fQQlAIJT+03U_SCZ;f znEbUX@xT?Gg^vwMR1GArA4kDcDPr6kT;%d=aTlaqSuSlB$wT)v%MD`rgg(qQ1sp2gZH zce1$H0hmY_V9RIG)}4IukAIIRX60j-0H(9@nWtD)nu;BBvhE^1le80!Y#Ylwz3rW{l0-Dm5lOL?B2bDB_+wovW%->E}OP(X3_La z3T7?i$&Je>NVVPC#+}RjmFrota4w~bR`c{%zru6t7m)7+NTz!IcAi)^gLK=kJLn|W zv?|u`e2PW+V44QjX=QBs;#YZQQ2{n2^5#Fu?wu8ylFQoN zU*Ngbr8pD`$(~Hrx~F+&%`6;%C9{HcpZN;Ut}Z7?{5jwjd7 zCpSsKG$%_@NfMZ*O8Sgd?AWo6>Kw<^`JVjG#6YoSvS7p0Y+pG8j|C)2n%wq-UM_+l zJhaER2P@Rd@n5xa99Ur1kYL@*55IGOk*Q1rmVf&(Ie-3pJilW;4c|M1JaZkJmK4(R z@_*-*`W`B08T4K_z$@STA!h@Syx=SR^?zE!ss-Z!+y202iVH$$)s|A1qtCkYEOZZ6`bro1(1`OF>f97vO^sDhrj3b zHjVTpzt3O(!74T{y-N2hbv#g~&wH4RjSLde3=Bm9ivx!lCJaP_K8B(J;=Uoyz41e? zv^;^uE;IJp|K$6pr}C<}CA4re2QOq%oL|Juv=-`zBZU0{q_~M0k8^eZkGVQ^G)w+w z{_5{O%ZiehIMwaPj1N$M^hNfaKhL02#P2#?s~+kt+{GwRSlb+FAC# z*+>LCR!op@-4`cD$C>a(P;4r)Y+#_`NX=(PX+F7m`Q&7#;jxKdlAkORR#z6Ym#<=R zWiIvy-74m#>)5aO`OjYC%uo!;W<|a+_?MVRPEi`+#*17Za+6&=p9QlDNlBVUer^UC z&fmPXA%BoaG>W7vIIWvDZH_l{wQUSrRuOg=_vGaAb`)uUT zsvt#{i5m}=oYrLW^D5o=mJInA?Hj{T6%@eKbre?y`6anbOP@t?VvNp~tBi!8aP}o{ zpS-LL5*-Q>QAT>N(HSjd@up9)t}>sj6vxf)6)oILbH@Nu@n)X+)NE$vr{l4SZyiDS zC_KJBSoam9>%yBH>-;lz|H&6=m{6#FwKWzD}ZQVnC5H4 zV9TT+!H#T3Ze0^D2R6HeRViY@wn7TZGf;zJM%wxaW5r?v?v=mx9&HVW!^CVZ((Q#* zEMLKzOefbnj^I#KLV+>NdtR6($TsZW^BfHC%F=Yw zQygebFHk>nS7u?!O2yjsES;g!^u`%l?$vt*BqTUUm1M@kVZt}!1ldH_Bj~z=kP$&s z9b~(Usamy$Dpg_N&0#D?oIuEnj+Mk%BWK$asj4ogG^+tgGw)NU^u|k$gX$nPZ#sqJ zI595#N64XZ!L|FXzS+w~Lta_?!nMn&OHLHIC<0P7w!-!)FW zd4+9%zmB{&zRUl4e0XYD!9+Jq5{qZEdRK&!kdqW;lq0`9%>JuG7}hkb#0d?z(s21A z0|AM+Z-7C+SjF?nViF4t(r{+*q4oi{P0!Ob;$|u(3p3HBS}vV_n=98R$X~aM`ECXI zVHTn4I&o(rN!fEKLL2r7+9DDf#I01(0+JtH+@I%qbkDtI3^FLZZb4 z^Zvb9Mm&b(%Aj)XZYVcNPk`ZbFYxbgT*8MPi=v?W`e>=IW3;l8N{5~Ckq}x;!5@tv zxfC#Olu8FPZpZ2XBNjn2?bxgql=nTdj4By~N4sdea*5_q2{SxMzjw0krXCpK+JPT1 z*gl(irRB_BI-gx%nTGoZKjZClo%q^o+53}r+Nb;s|j{6AM6UeMC!r$;y4zrHu7uOIOSPv2@JgoTvq zwLHCb8Pd65@;`t2I@j(OT>*iiF?xLlbMmrCk?ZN#0cSDgGxJb`2N>$qD6F1M`iw9g zmrl~*C}BxWIUaSCdY_J62g%|>4YhE#bp_k9iYUsp5F9h^+lwX1Dn?|2&dVn`+peI5 z25Gu_nQk9I0_S(Cz$d{$%Mws`eeG$$Os~t%4vtG9thNEKWCW zyY+puzDt$}TGWR9jyih^Hb(;ZI=Oi82&eC^;b@x3&SY|nma=|hoUREIN%J$<(@OV9 zw>Q(PDLC8-xNJ6Tz|})nc;@#vFtaRyVN7J% zNnUvc*=`j~8CTjYW?5UQz0yStE6L^S_`=u!m?y1`y!cKpYUx525@4XMliso5ub*%} z*2T5UgDlvzl3mYeTBtTzE{7er-Q?QY%Y=9BWO_{ny{-FD?(;cRZ7!T@obHQt(ECw~wF180%}H#W7062HYKB#lsACx6_lC$Nc3RDAOeHb#m@dA3b-^NfAEQOw&M% zX=wU`kKIYCo!nVVSUZ0PY0dz>!xH(6mas(8@%5af`_en?Nlj+Unw4zH4PyE`IQ;qn zjx-ECR82_3-@~;F&1B^C(&CE{3Ab^fz6+^!i}t)nMicB54C6wPdcx& zKiExg+bEq^ui+o`q5)dlQBHQ2gx~O{R45Iu_?TkWC3i3ovl--+1LvBXL}$ zr)86_jMCBg=Ge@tCF|H!u49wDoPFbU-nr0C z*quh(#j7N_n&}HnFs60WP}ht#){8G1K<{j$$<~h#2_`Oav8$5l4ao$$#t7bL8DTUq zK~>cv85f zv6=t?AOJ~3K~!*C;{+xq2;F_!WCeR-I@3~;NU*EOvV;)}GB()5z(h=Z$$f&z78fb$ zNvKgTBcp)_3V7eWO0*~pGTTgCOXkid(SAb zhrV#EBxa=Ju|yah94Bljc+xZRSYmhw2MI_{GIFPrYK={NlkZvq2h4ZP-QT* zAS1m!4EpYo?eoTYwxyC+l!eD45f2X2)j2>=2T5^|l$wlFi7+-iM%c8IoSs2~9As?7 zkLh&dlwCY*cc%V zkQ^jursL9v85j){H*KU96_S}?gLsIsflm7Fh}L8hbEcD*>OeB$ghqPl8T1l06>Odq z(o<7NbgD?Qf)o!iHrP%7xPdDzo9t>tGghC%|VTdF_TsNuh39zOtO9WVgAbf<>X;dt%VtTe4 zDH5NY6AmEBsG66~<_0de52HQu4CEe)=g(ngPBPXz(l*Gb#PD`s;qawyQRrL{9y5r6L7l7&lWfsMsQd#K$^l=y;HsZ6B12wA?~wlx5>I42&DA zTqFgn8D&uK=4gF4hKR5PLHG@c080>rk4!w=&AE48<@#|I?kdf^}FKF??O^l6f{PgPI2(~SvtqXxWwZ_#Z$15&Ff}hbYJA%qgNP@KHQ|APe%$4(c3q`;LsqW{urid z5|8>B>g&a)+o@XlB=gck^z{xf>J4z?9_TEb!^)*AShsO0H5JoI0>DI%1{fRcXFQ@% zvS2;)3#|A?`WYJY5i%qavS+ev#Zt=Bbq4$U85kI3WFkmZEaLnal8|H>N&4UgbuI2< z7H$6=yLN42%i`&z+AI&(n7fV*YsyG*rct@}37-G`FR-Da02_c* zz@jHNvv_(ER$aqCHpqC`WX7_sEY33+8XjiUuYoO%k|mq?%vYXc zCJZD=M#jJ}3?jW3*!S8c+ zbzB_Ni4HYzWbbuOXO{BmwCUtFzss*)Z(uy4qwA2OT95;M)E)m7FTC45)t*NeH47gW z30GPbTb^4_Qr8iF@%s4(FN>tQDPOgo73CJ%uJ_>#fogg9P(rfUP(nSNJ@_g=KR!sN zH=V!#%mU^Y9Hp&YpIoJPM=&UXBq1SVQA2c%`3S`FSusnc?ScVFNRotvf<+nTTvrAq zd3j7vY2oUafhauR$D%E^J+Ob zY62#4!^DwW!?Gt=l0SZm7k=^@7ly;&Ng^{fg=kFYRy99C5QLA9$G8WpkAZ<dd zx+s^l1RIJOzm<{Oh@-_~#Nu)EcpOdBh{a-PaeXp3PC^mo6{*DgF7x)GArgy=DJe(+ zz%+C;Ek-=9q3dzt@i>vl)V3yofnn%Kii*?e#OZKgRTc3|{bNVM?k-@_6I)ojpcv-^ zZztm^UBkvz1^6!R<>=Kxf>===K^S2g264>**^0yNWLlaBGcv+NFo=$cq3gF&5=?G@ zu1{W@v#Bvat{)8rLzVYCjoM*SoH3 z#N%)v~crc;s-q4Q`RS1;tT;#2d0=Y9T9f zyBLbx7T(BKEMuoQ9$v)qswysC@e_?1+&-{*`{(86C6A0EndlQuG`Q_do+{>Ti>tEZ!%mn2=Te>NpQ9+tDOfaaBnc-)|XC-I)4003icT@>kmXX3E zG}j&H&Ao5%=Dv5RZRo>$|B4~P?-Y|*aDXePPH^^WFAr2@QgV{FWDA?Btn^%NW86q4 zBRK(w(@oN}R1$3RL-k}ziWNCB%+*u-IoaVSIVl(V&`!D%_{$MqW3-;375V-ZL`R-r*&Rhzn7gJW1jN>^Mb8wKBS4?VPh|CNR zS0--H>T`E*frKo{5FDiO!eNdd8~LrhG~u^TR%|3Bx{$RHKK}#swAifV7nPEoS4zhA z=P2A@Cp|BhY*z)($KbV>Uf_6Z_}3Rdz7I*UAVo%KZ>Z(f>qBJz<=5G=WhpHk`)G+8 z$TkNKJ4696(Cv1d78xUMf@y&4Kr;Kd-qBCl+{G+T_Y>Bpu3^&z*+NV|#hIaPtgW)( zPK?uiTY0^3Fib426OV=Otjj3L$g)Bx)JD_LYPMI-CN;5#mc}sMtvz^`t)_Bj9>-d) za{b&p_@x{Qa?_EN$ND#*AP660k8gmbx|x~cg?R-RP3H~ z3Z|Dab8r|5gIHjc!QpX2nwZY}@gd>KT*B}FAD<=t`Y-tJ-`vmrin>U#09W>Wo4-5m z#;zEc&RlA?Y~zXK9u6Hm!R5Z_Lk)+?stu>pMS|M}-t)YBx`}0U83;T2O&= zha33RbIT~4;b8~^Ns>s)nof3BF4<|xOv@`_R*8l2(E<8Q8P#UTrPxr>Xm4mGGIt^6 zi<9ZUa+=}GCppu#oM*Owj$OeQIoBU1dqx&XHWO1f#RPXj5I&Y3-vG-|!iw$NSUNKW zGo~Xc5^A)KfB)t$s2z&le3~8$Guq!n(0{8>Atl*?GThFA1N*t$GWFcnFohKb%t=co z$q8eAFtiBcL;ct$!nc*(Fo*>v7>YVszG63DovmXb#z5UZe)+~BnnuL!a!US1ruh_<45C&mhGUL7DR`e=x0$^ZQ@mC+7qB zh6fo?0>pu6?=`OW^-%521#gf@u%E;K{(U^pf0@<0|CoiL0M---zQ!YT5B}!8d4eDa zA0^2&P4ioCoZxFaR%7UoQ6eVAMQVBqZl{W5m>_{38l!j6cgGjHY_XEyPDGB3F%g=4 z#Oie8wp$4K#t7d$WeU#3WSmL_pEp2E2U)e^N^m2`{rCg7Rzt~F2kyjV5}nq``B)fe zp>amXyo7HXZV`U>$*P0I6c0+w&%{KC5Bv#|Rcx*VT#AO@7eX^0F2J@pJh+_-v5=2o zSjWUdLUIZ&Il#n3kf^SZkd{HR+kpk0SYV94VLt{k)&vi3t4?6dPZUt>9#T?0$iY!Y z{BazKZq!H+Unq)!j59fnM2AdhbQoXE#GR2#ibF<^$1r3oRy2a%5r%v^PLCTqQM}#| zIx==oGKmRRw24u?p%^+~^Q4oW?8Yh^7^X(Z>t$jhNKB+J5d`5wGHcc>_Uze1Zf-82 zQ0N0~D@hR7O=^1rtSQTSi~}q|5ClOGgxfsI087ju6$C*L1VMPjM1Upy|Lom&d>r+i z@bS--t=e6!dbO%0%aYtH#^46VHZHgUHV{Yx38Zn!-92}&=kA`n%iWW^B$trzTu6lw zz!XDljE%7Y+qm~`xk$2lU6t*tZ8P)yA-Q6(Ia7i?@BgIT+4=2nW@oC91 zIQiCV)HhyuCI6QBOc|Dk!zducLo^?Hn>Y8lNiCbqoEc?UqkRN|eTbGsoDPxBW82xf z?KmAVNE$kYnYWD~)1(mcoo3U@52))?kW3j2pK=?Oc^TM^fa<65_;xn!tS5|t)ci`u zO&-f2yAh)S!o9WZd4C%xI{OAnC1J^|;P%Nwuyj@N!S2&|qADQa%pJ<;iDM{AwPBW3 z!d++BwrLmD-C+<+Bo>r0JX@soK~;9mf?>06T+5l#_4rQFHhVoiP<~P&|Gl8Sy4gpJ<>r3fbfC zX2z&O5{-ZoqvO~+ytTK9XdJ+Rqi{U4ZqLPibUT}mv<=L(*lf^>L1woRQO*Ik5@_ zxP@EFvT#@=kj)5P$JnxUCnwwbb5&%Fx|12>%1Ab-XqrlI)dp7WY(z^R#^hl}YTrLV zlcE78Qu8V)FNssVrw&v3Nb=Pd4jruT-@b`L%$q6`Y z20|UD*!95yys4wO{gzTv5-b>nIDw|4Y}&G$CjW(FSUCO;ZXZ`dsxe4Q)jl@8e}o=q z0i%ZI5^JsEOp}}Fz*K%qP9@_C%rw`YrlB+NnXR>_w_xdXHy~5aB<9Z>L8RdTdrr0x z(f}cWA-CPnvbp2QOfn)!5|Z4XI}ijABv9kn^M)~d$ug#tC8B5|lBl65kX}BUZ$EJ_ zBMTiwVj6>Pzn90BPbb$bAsF(Rvg9k=HOzrYRIz0jGxr%9?jBh2@z0CECpLvLsCf(0zT zcP7Jg>;w5ClPJAyHuuaLPrmWor9YXGcP(b#v@%i+2J*)(XnYqMIokw}8b9CNtRCM@&m+{M@hb`10vw+C{*CWB5!SSU8z{ z+r`-{`&qNgm_BzAGe=~CARBSB|P@shZ&z?M^Y3JMa+q*jGw)n`I8F!9{>O_ zl9D%u`S&ei@(>52C?d%+k|&htghW8&P!%)X_F zL@kCYh?pH|jGMiT1(Qo~S_CvrKs2Q?_}1AhoHLGWSwJ)wT#S^0wzwqn;GMauwHc9C6r8J$%4D6%ul}V)9d5tEm%6; z4JUGjK?~6n6~EdgGW4#8Sw1D711o;cnv>VIYtdjN)OwU{FaL^lCnKbeS;mu3&SBc* zgH$!Ra3y3gq%0Fp%~l%aBnnEhIneCE69dptRrR8(($G**)fiDFn~4kWquBfZ_@}3K z;<`cupCz@J;iU$SZ+(kK>qy29Hd1rC|Ba$##9h6WKmYDo_Vk(<{m2jbhl%4T+`N+x zztX?2D>fAfh@t?#Cid@nfoIm$f3jn76_PcLvY|NyYPZm2%A#O!770xrJTZ~9@>wih zG7`hS-}3W6?xL{|40#m{wfKpu$&6p{b(U6kvhnGsdE=0W7!s+&Cz2CY(Igq88lvOS zTm1KbZ@X--35b#bZ|x3NKl=x^cR}WfC-|rD&tT@5ot$2Ogtz{91lgI*lJDd(toe0* zv*Iw`I6yjMZ=b{Mqcqh- z0qbC<8pE_5-@;43e2p4R6i<1WC%$?ovu>%T%vyf-$MrNv?2KLfI16r> z%6L;PvJyr%+Ahgys;L@2zmG`dvKH@8ncjk>)7@w?Dw$Ydp}qD5C)+Q&fT%sVLn4`D z?q$w!(?@PD0Gg^^lCnq6AI``mA6qwX=Cr3jOz~8$XHT=0p~D7aw?Zr)Lqk9W6px3h z<7bIl5=k5#vH+<4$5p*J(9s6|CxGU~yx(PX=;D^H$gxEd}kY|Z}DPqTCmE15+@c3;`0I6a3on#qaLCP zfPkRJ=nGw`+suc@7b3CpUKWgVe&~$VG?iE^OfY(``!#^y-$zVS(KODVdlzl-q5p}3 zfTk&E+QqGx1Mkx``WsUt)E(Zz?nB+A4WGd6lZIjoHnMByKAQUg)z9f8hv`t$$SBMr z8u8)xc~G({m^f(?71>r2EJoCLoJcgnXGw3t(&=t6*%jp!B&Zzd?!bG||23tR_nv=> z(1Ne?$Y1@8$(=n^Z+o4m-a2u~_M#{t2m*q5;h8TzE1h&D#x}qIqD%*Vg25;TQzDWS z0Zk(wiT2-!Y&J%Y8j7L!O&Wq=kw8=8MEi$vkW*SrSw;d)o7?HdOi5WG>9J0>9k0bz zSi#i0ODIa+MZGsbG#18DGM$J2sf77qi6q(2rnPUeyDkEP`D5!sh==ePa+$XLZz-MO zK{MKLAAW_E>vmGxdz}?68ZfwavBxxmF(bxtw8}*=s$i2ON;1>XdTVJ@FVvQz`Upov z%n262H;@2ZL=Xf-QG{zw3M8PZF(Tpq%1kO9%#f@EdJlBtk}PBmE@2QZUO#>oSAIEn zj4Yuv%fcyN|BdcSv78{t7-bK;Uiula#oy-fZ~cU^_qu7^wTd6VeyIOuYe}NGq6A0# zCbpmIX4vQewo#)fSy{#DxP}t#BX#s5zV{!M^u+9BSvq;`Pw#QED-Pnv9VZP%QBaf0 zxbu;JB6oHSQ4Q0$Z!POK?xEp&VlK%{+TbA+h+VvXqMp|5p=e`E8Iob*q}NGewiVge zfTvsFLrtJr*9C@fn%*bc+M41?C+u%L=o|Pb4QT618?%|%ZV(U@dJKyTO)@KZfDh+cR1dDEsqHU z=SQeNuc@`Pl=5sV-a{UGqH*GyK*ogS{L52!5Q;!w{cAk;-p>A{?P>&%n9kINf5lHG zxDiYa0#$GF#+rAja(UVF%74)p`Yzx4+K(8%$VbcGH~G&Mdx)Z-#K4+5fv^4aCoE7@ zz(8U~4rccz;@3FJ>3n?%7uQGsck2J02%u;X_2TIbVl2+25)C=*rz3PB&{fnBN?bru zjRXaOWHFJ_>_TQQ8A8MQPL3IkL_%Fe`l6p{u2Vh0(&=s}0x8ZUV&NVZ#tv z+rMq2b9e#VMt=6vJ2b=uDm0a}%DZ^%-}6}%6R_an=-bcn=k4{Vj#7peq~Sfgmxh*3 zx;RNocn-yb)7ahM10-Vp4r-5X=UA(XV^BU>6}K|B(aqNCkH0`_qJ&Wm(ouh!orlg6 z!9=9J6;JqoTE7<)ku5zOdglNo-!7vtU&I)Wqo5IqM$t5FV64}<5~^q_TrtAAW*YHG z2wTxzeC2-+WnM_dCI>mXRE%Daanj{QJMnKWDwc@1Nd4ud{%mg$dMb*i0W0&Q=}9HGUGKhrGh+ zDh)xDi1yY|y>A0Yx-I0DRZuZ`25oI?In*BenBycM3L;|EOKa~E7Hyiz=SxcD&ay4*@{3q)<|pN3dZ%^(`)3(PPwlDk(0_L2TAASS*+Y;mY01_5`d3 z1OAUJxPU~QK-+1yZas-08;N^bX!irCD6t5sBNyLLA?0Om29p4@bCI!@kju3!7Lv5yE0}46cP;~j&FaB zRhv%ZR?;xYBEj}k9IkRvFm@V=4ZR#X)7u~3OA&C$ZCQ z#9|u6!!#d#kBx_Wh=jv*)*Yp)Ees?gi6Wt{I%>DR!M;utcpErz>MXrs0mqP1%F2gw zYkDq&MlU5|PNp#1LUmU@mTiq_fD`O|&)KQ77rx zwmVKvY+D`Mwr$&X(m}_zeLA+2j&1up&wcM5-x%lD*|kTFy{mRrt-02mQwJ#YsLBEF z;{M=H<`ZEtROAIRKnz{9uB>S_6A(?92=Vpi+RX(H?Xc%WqO6hrWFuf`;^hGriSqn3 z7%`)#;-DSSY<=5U`by>_mHu9oM=6j05kQ6jM%v>huaaBH^E)v?TU1kux%igwVEZQ) z8atJ8%GGZ^l^Ev_M|8jpAmy&VDJUp_7#2$!&0_c86eVIq`aCaCV8fp(nf=@>+ZdaS zHcC?N3n@>Jm~?%fW(rv`3{ymvAj^b&#VN+tTHv3-w-7TbfzNQqn9b(oJ=^LJ4hK2B z$@A=enc3x_#N5F*}+mnWH_Ns_HtY&yvi- zHZU^T+yP2u2ogs##9-WTska4I+nL+H+XN+AUghR5B9f!fNYQr-?v_+G>v$bc=tB0m zORGI<9xlu`LV@=Yy3+2>cz2Uf$%4dg>!mpX(n(QcKzRSS$&hokLY7xyrJm9Za^jFR zd@ta_$Gym8oRo|z(cujRF%Jb>Ia8=%_{V)&i{nbPqyopxoJzO?o~*PG)YL!m$16_3 zB;E)^kzCQ!Hy9{^!^l15g82Uq5!AQ{)sy$b^qe_=bogoHkiU0)LG~dRDkLjyZn}6d z;Nr2)n7ZDyNMGQ{cQ&^9_N)Aye-$tuN(#?Nngx+Q9y|t6S(LPpdZ)vlS{pn^w*vqD zDDY?h)m9crMs#kl4xPQ?_6(Z3f|7lC>0(CL=vUnxLE8df;EbO)7;2Xm{aPAAo=F%= zN+_Zb;>9?~QnE6XN|+I%1EPh!-eSoAbe2mUW}jmNYveWA@28VGz-O6qOuw$l{2s@z zSonthfCek^>@(G5lGqUq{@!eH8~7}6%8J5F-eB@4|X!hEku&S7(3H?V0$K*)?@XBB!&>-(l1Ugc(I{KOYkI<0h5z$etK4nPFyPF*aG6m)?bm}lDio3 z$<)%=F^BPOt5KXR_ItDbU(5oZ%i)osU+ujx|>R5kMf|?n1250m2H`IXS!=q+Lu7AKU3sbz3Ul;Xhj;Jgn{`E7uuM{ z+_@5>r1)k&hf@Q{QxZ%;5bdzytTW}{X|*#NFQkQ5Kbqc_`Sf)BuoxPKarDm!7=2=v z@wiWhr&Q6$Q|;U~9xO##>AFI%5%ec^ta+O>XfVY1?=;(2ugDHk!zmquDG#6~!HZFU zC(!ZQ02R%PUc1fC;z`VcB$-AGII+|+Ueh-c#2{Od^vg1Hlm>C~w*BAdDPw-K$Q3l! z1lLq9NPHzgfyp5w@9WrgT7xx8Smtc>r1HJ3M{-MNx{O-fPJ#zHGbx)Xkg8w&Te-t_ zgnm9GXwk~Z7zqgA6<6qtU+-d%Zn_JL?AO1`t*~_Wi^?=V?(-eqAG+Ub^|z%q2!^dL zcQ4HI3^%11vjzhKqKNUB2TXN|akEMTh{^Pq$|<#~;c3Q*mwaN}Ic)w73GQh`CyB4B z|D>UxEM#2@Z}wo<{}33|#8*ODWI(L)P8PVb66}{GuQHm-{>$;{N$wnMzybAVwI|K| zt10oY=NsQI26ut$rJ0=!>&wB}C{_SFQ>h-VldODR=dr*dihUoB?43@HBaU%WopzUpFzTWIunv z<-gO+_s|%zL2=f9BIs>8q!5m45I!%VQX;iGZ;>hwaZaJf&By zy1N*JOTci2vAlj7!qfVMEBg@vi?Qy4^Wz2yl9^y_ZTxn`mU2(UF%T>&B8;!;J}=Am zZbVf~h9^%5Dqk*SI$=hQsHIFd9-942T!i2=u?a?(?oQ7@#3fw_mDi$fi%1b{rGLM< z-66tt1LLo(STkvU0wtVscRnVs9LkG(OHYH?|AtK%t%UU3=soaH^V%LImfV3pp|1RAb|6>W>JHePX)Urw|gx)O-GQ#+IDsm=^wbp0f;b7v- zf-`LU-dlKkLZw&pNfM*y>k9PrJgJH>ubX>mWp*<2?P+7UaKosd5e*^O7ytgf)iyW{ zO4YDm$tkM>AjyMKAV?TuPnteIBEcI_c6G~E8&2Sh(`C(0#}*fsppGe1SEK#=u1cR3 z5!gdY<=#(TuvWHo28yWCSe;eajdZ|-hJLd(KK?OZojV`QqI#?qa3Zm~+$Lh7oE_g< z*8fL;#6tLag{8TLBaW(juJZs+>&~X5C9W#c{S00BbI2GLecMam>pfgk6p*PnuDA5= zL~(`hfD+@a`SFY8$=8nSum(TMrITH^T*u99;N-#{`nW)nuw7&5*rb}AqQ#CItY zYwOv1wI;U6D*f=gciXpj>u)gK-d{AAh%PR#URgQE{>l#; zG6#GQDnNZ`x3Ia>K~;>P!~@FXNf*GmU+=0zR?%>ol&vSKrh4cjP0DSGeiLfgm6a2P zcbmm)^O3BKSUnsv#DINpLu-3xA;WdxOlGze;@$dIA9z+_(v+BDBZA-sOD&%COW6?w znJf1f^K)zQT#LV!=>gTK{?LFlV9CJ2i^`E7A7_@fWJFn#GjhbE27{DPXCP6kYs1~t zIX?L@AaRn1rH4fX_OHx-RK2bHA1rq0)vQI6WjU5o7#-iupTQLpCncnbNe7AQtMhF3 zW8nrfs@?mWgLdk;a9x4;-TH(If$QJ1&5S>Ken(c=BNs=p(3LtFb@I)AP5C` z%!v6m;)$^& zI3?w##tqU1mCh}1N*XIbLgH9EeLs<>rPPEJ3b9BaREOIHLulj+6^#z+U6wm0v#Sm= z=}SxrVm>SxT@J4RD}vQ_;$F3cg|Yf#`EIo$V=h6pb-hUDXe^8xsg@|&7u>7RzTZk6 z@%>ziMk5s2Ea(w;}VAl!fmn*PXnu)rz3pr0A%I3`Dw#=qDW%EOlq5reQ6V~KI< zc$ArF^}M=$hu8#}45VZ!`Gx~miAgMe3c2%K)I^(q&vq~~OUknmQ!{?{)@^F{p$?!S z$xKm!bIi}SbB9^Y6V_@#Slkwiry4ql)xf~OsM76B+t|<%E=0}`Ar{n`U0Fvp(9%pJ z{4Y~Q+OIgaLDe&T-=tgRV~62=DzLuFqOWH3ik|1;M1vL{vU+*xc~Y}K4_|lBAe?*o{rB*xr}^-iiH|Gii)Uz#1?L@eW1*d%)il2v zuWQtDC{rE-(K46iMMtI$#>CeM#6(s~@bQTV*YYN5rX&nUgX?BxSKSSEAY(^CekEtm zE0V{h{u9}-h{r}?Wh>KGfou!OgqH``T`2}}zJLG#0F2>V`}_D%dpqzt=t1@x|G^me zKd5ORJSA%oE){0yQmTcEKDiK+L4y_(9tDH$qmJMVI>-pcclKGLDx#)y78XKx&1@cH z3JLTt|0^l;$9o&17hIZrStn)vSXslr>XN0#F|c^rB;r^n8b7P=98;_ zLf}gZ?wYE0Z49}oNphx9=ZNLRf2n&=BAt#1Ew&jYju^Q7=vNbT+2_6OG2^B4iS)Hfh}=N)s;7e{nC z6ZpN8!5gAhvN*`872Sz0{{|fOfBVw^MS71EkA^{HD}+S2XK{!?IA%l?j}lFTHD?Yu z|JN*VNuk3ZdV=OWvtIxI`a0paF@R4CpdJO45fq#jWEb&B7*I&R>#!_GdnnkL+oz}A zq7;w4J&Qj6-{X|PwZn+v1lJ~CHa54xnK^l9Wjee|JM(3i+aC`zm*))dj$`O8|G!7+ zY|lligA_GUPDnc(#NVp?<#^;!)xUzVG=*Z}=!&M`kdT@2-j1pE-+SWDy&MX3(0NA_Ek=^tuu&OLG7B4RyZgEQnE)N`055c5w&HEM)eDSb9=3 zUo=p|-!`%`iG#QCZcVo~{ohLg$1t0Spw+pXMH^grd!1V z)cD}S|7VD~H^axikuv+pjdIPn?1U;R5WKN3=)N8%S<-3pgU8jF-R;C>vlqAjZ{yMS zI>a=W=C0{Tl^8-Xqc;?_-sWsXU!TtZy^f(vU(q2M(xO}WJYPz<=3Shx8~MMZ)w9np z6o64$*}lU{8}Yx*V|Q;cuw6izv_U~5=^yghP$#V0=>g>0Qb0*Eq27vP&?PF%{*HQ$ zUky^sAtxs%C0833zCuG;Nm3Qq1&aifT&*GSv_r;9fK?FYG`l$~+^J4ZLzWDX$(VA( z+Nz5pUXuj65P#pie=S;Zjv8~)N`wscSW$4-hSTkL9@iQpCof6nqsC~&C0ke*${v^7 z#=vy#&M|06Ov;kCDuU8P7erQiCjc}*A-9?(CEF0s%*v`O3W*HuPmptHj?AxxXxAkt zW=k|EQ4p#lo1jrHO328-@d?3czO4S{lr5iSVwM{rmMI85v8^a$EzmJk{Ti3V{N;Q* z=9s0J!s**>+tki`PZMB3O2H8iUj~(l{kesxwZ0+BM)sKE!ZL@SVS<7Zo6#G6$d1*I zO)RZ}IzJ{UH)4i9BZ|XJ__uPWR_y7W+9qJq2?DJ4nB`l5X0_;gwObtH{F zF4BfTMoliBMsH)>zrL?Ynqcgd#0X6l7;hd+i_7jqSlR}%+DV?{`ePi+G&l|a~{bW;!xjJai=baqy)J~`-)3|=d zM@8%&iE>>;SJ3=hC2n-L3YU#X}&4C-pog-R{&nD|1*Z^(M5(+k^Uw z$3(DKs*}viUi(#|sqEO?wFd-sQQ!>FmG|ux^WAjb^FGmXh~q2j%kO}gVVrnG;9i&T zZ?)m@wBI^UCw|IkEd3DPfi`97YRM4L_9sp!}BJ9pW3F@jhZc@B?YGu&=Zb){(S^ z)yC&imA#c4yZf5Cho3dwAUiw5pbyvjFj($P^X*fqD=E3KvF9(xC2kn=f|UJ442|OG z6auZMwL4j%HH`GvE=+_su4{mYYLC zbF4FM1-VHo%UPg33)g7WDxHDS)a@zb=UCXIUIVM2d>codo!;R57%gWPFf-x>fWnxE5?duq60q<|-T_3O6L|bZO zv%Ru!>Zo6Tie%Wi*;j`^qnSE{lAK^H*uDw=+tss;kmL&iFeDi?^O< zGDJ7>0bRDT zqp-563VSTOE@QOU4SKHh=q290@>mrrNqStW*_64QGkO?lnyl3oqWA4iuS0ULWq7>J zcosfOjd0K=dXM{&p_aEb(+#z}?F=l9!5cF9>WJ5!IBwI5{8w+Rx_US84+EG|EXofL zSpS`~jUQu&=s#qfnZK`>bDiyKmHK0&L9_1lK;zh!8x1oq%}~Rezbqd$dKhBW9I?+F zcWyCKGP^v|QF3Olb~&Lz;|+d{D!4d}e{35)7MSUM9E_{bSWfudcW%60>#BS#=bx}2 zDCbeltGZ{E>Os+v#1<8bW$3V}u(kim_=0>=kTw{<@*g_PVj@fbKtSSeis*>jZs;Tl zz`Z<}&}M8Hx$!;Zb>Q*N(~>aX=kAUAZx%>xHWgEV^E37vWVDr%{!UR$Ob-DP6I=bL zsbNUb$Pu)Mw$0sq1{dPpBxrJd{CA-&807IgdT`we<}VFAPGSf$B1+sy1kKN^(%GYv zqQ>IfxH!bM_sM&&-SR9brQl1}PR-U=SN?L#lKNNp*b8R5)z#nJwT1t(gu566);Gnh zy{QNY2--HlilW4MXQpaYX;)@4#&Ya=hl-KnBv$Ue*ZR&#F(GR42Gw>3x5#4!8X()d z<5lN&Lz4ZpK=I*YSX*B^ar1_K?glxP&(F?=G8XyyJQe5&njXL;b++D({Cz67vMuiJ zPEF?FH&CdCK05}c;Nq<|__0dhX<1rx4z$oipUB~iWc(G42)*v~KC!bduC5NV#p7@; zUmQy?3naI#QcA0vGw_kR5~`Bh_yM;6!R zm{R)Wxcl+M=};QWo*s?a8~OfsHU`+D_ob|`Ye5+=HLC3#P+aCc?OyyBXpEz6_}lEm z%5AB6e(SunkS3sb7qb*A+Yx=^Z-YHQkOM1rh#Y2LPHW=n>&APcT2cs828W9s>FM&p zW>rbVyDT5%CAJHN*4{`8_15nDw$9n+$iqeK$B2HEJfV`4PUj!)iy%4!SDlxsu zp0IMF=#e12H%`5E7g1!xH^tT7#(b`qZ|ZoA-S2*jKPa6o0vmxPiJSya*1^wY3hKL* zXbL=bjJnUu;IChjf0tku)Rf(C-cqrZAmF8)i`?>xN|*gVOC-w){7rb>%yIdO0{+Wm zg6-le*^^aQlZ2U>C1$x~7^n>KTaeFRos!jJ4Jksqmc=`^kiGwj(|p|r6cxI~U2REO z8`CbQtOx=O>8FU9FUuIxM#_N)DRDUC)lje&Q8>{e9hYT!zi)qh&)&PFqZyd=+0az z0eyJBC{c+!FG{-ap}mOmBTZz ztccnLaT5Sxw=P7VT_`E!SHeq0_Z_+xL_FBif+>*5cwB9xLj+H0EKPIY3aQuHYqWzi z&yx~kYA1$@+D;yDB&TG5^UpZ<91N$Z0&``|l`O4xW8IPFJ?Py@<%AN?O)%4#m$Ibr zA#}sD{#YL))d@nCAo)|vlcQ5o>)EO-m-U(TpVlSLIEAJ$C=D4Tpg^^~tAbSv;4TJ4 zcXUBrY~+I%pe~ckO0}mT5y@!{#jN=zSsYp7eu9Hn1)MR_`Z;<0tFoBAe0%t4EnjNNy2)@~x3UrIxbf;SA>i3c!;=I4jfupXJ8 z14|;3VlW>RA3o2jrk)W6JZ@n(yq9mnv9?Ot;U&SX#srtD8$nK-F~hrNPavNb-CJs? zB$S(?J*+r!3-`BnzFHV6uYi*I6FYeh+W;|Y(R^YfT$U`r^qUQ*4_5Iw^q$-gv}@X< z-~tc2xFW0azXx|!qL9IY3hP4h?Gh|qRrsA0A^IqXZkM5oh z@*y4DHovLBe`&$C(s$)+&wZSGT$r|~cGg~er_Yo+t~8&2#q#vEhEPHPTnwcBx`i=g z?9K*Uk;FxbZS)?q>nQm5t*(SV4PjuYsw(Z~|7suu;l8a=B&^9QuwK&=eBebzbLXcN zc}7EafNv;*LrDoDNqq7$`ADGVY^l$EHUMCj_^+tQjOAEH6VgHKva@3?J*^vVD&23m zYgk*LlsFY#G%f`$y5txG3H|F2fzKz5^UD}Tri*M@S!B!8XnpsYaxiJ$xFVfbsR|BB zy85KZmZz61|2Hn{X;DXXMw2eN5>`&+C`+Y*OZg5j?i*;MA!cx;>o=IO;TQtXApNhq zY0dWDVE!}FJX!YQhv7)wE?PM<+)J`jsG2`uDxgE7ohZizHl3F*q%2NMc3SkAC`9-& z0g2^b8*z-x2rr{@aO?>+8(2(PGcwG|SjfuuUOYH3DRu)u2J(&5ZA|)tkXQ0*2y>56!64>qiY|ArPWl7uSON38`FAABp>9>>VGXWT~ zuS?ZsF-xZBeJ?WUbD%fn(ob*B;aiH(@}zP$gQr|HBk4Dzs;ml1f`{ul_2P{bX)|?! zrHO+)|09y&F-{MH4!ATgz*mDP`hynj2F<1o?`@TFa`ATWchH)=OeZKI%w)jTtidT8 zaiUjalrU?%ee!WYdT=2;SN;iN^MC7g=h>BnV@Jy?EDQepfr}?iOkhd5*^{pCn06|q z@W|!jXY1(b>`w@p&vXJJ=~xSl)OR4RWuID{GA9{~n>{bA0}*mf^yMHI&wtxocGKk& zH(X?5agodIf7(x#jggSK}S(shN@L-$S9Uf=eF%YKPvu6Tjoafe; zV!lKUKw)i1_MqHG(82IUv(qRwhjvHNbC&#k&hxiaOo8we>LQ@@YLj;+3tjvifHo{r zM$_(3q1CpUo2zK#Xz>s_2G}uoOMIB+Ub%yr5zKeRebJw06Q(wK1X3tXK6plL$!P0t&gDI4d*(&MZ`aX4_-tMzn$Bcwmc-I- zn+-qwz3a@0Ue@TthhEb=6h=RO1J_xNye@khXYOoGM=j%p>iJASP15;2K-PUDo~A6y zmd8!mbvDI|jgSIYnO|r;CjB(nzP|82dxQB&+o$sxn?4JwalhDWobr)iz2Cd@N2dP~ zYLD8A(9k~<#jI%C%IzbE+`j#`M074+>i??+h#^7CXyt{9&yjYM&Uu}*UU8_4Y)g;_ zlp0PE3~oltsl19#pkS#&x70tSM2{WKK)lXER!NCuex!m}dgKFn^i;4qu6VJ6^9<}Y zj3zJdnj23V%y~@Y<7_q>Utm;TH3A5#M?kckTun(eadw~)pDu*!?^lJJtqN6iUf$qg zB=dQUMeLN-!S&i|Q~fg8+iDq4i${lD9)BPnQO*$d-;(G0Ro5YH6oN{<(p~TI z%!fXAYW{U`yU2;c=E_x{(x;@FF~~Oqr}?*Xy?M9E%~BAM;9i{gd7uyaA*ygRel8x( z^85XpjTJi~!@i&OI)#C*I6aOHf$@ZBS|mI;zOm{sHfxX;Pa^UB!{Zt9y){A%X2;69 z0Ej_Mcr&A>uAp3&?m-v8u_fW|%T|U+P{w6K>g>S0Di4=bfO5(`2yI_$X5Ng%v{#3t z2k4J@hEF5AZml8!6+ug!E)#~Waj9c{7DAU6M!oK#)sI+wl1v0dD?myJ~_69mV4y( zk3=FRgb#l3=5$M3CG+OU|t2~h7wV%Iqo$OG06rN=F<()Mr)ks4L8yfSNeCn zBp}Qz1qGd>%&o@wAq>q$0!)YmA9j8jO9c5yf8u9x0WjN@ma*({E;VE&q#AMmLASj!EsC64XilZg6=HJ z)}Ym$zM|0bt@bPqH})VC5-wUeiBYg6+YJSCY*K9gau3UTJagrFnc`DcN@d)uh~+@;58{?_C){ ztm#^nSz!=9Tr9WeLYS>@x2Mzv0=t~>PT1uG8y(wKg? zd4hxg@xj{VP;|z+Rs7#Ev;!pApxNn0|388a`E*2~|3CJ-B)1{$cS{b0(!8t6y_mor#%6s044O^b^~S)z(fftUa=A#{{MU6;4}gN`rMha8P@ z+F9OxL1fi`Ys-nxL?|<_9h{AqVr~QiaYv0CssBAF>@nDqeu9QR50zW9^KLZ57zMy6 z(d)5G_e%^*^eHmbqKf~6>q3SM^>lwBacbJqAN1`#rC%KCmI{@1?nsfBmL_LehNh)mxayazJ6fhKpPTz3N+>o zF$Lbh_W{xzqX{c+V1{9O}I3GwDb>2_Y5TnUBKe<+-YnuP+rT7eU%1r zLL5aXA;LTBkEP8ZUdP`Qf#A^n7@_@At~zWANTo0X9=2xJw%A~5U_F{mMd>2Z)s-Ae z$**52@=eWIX$g|zK*{f`fB|12KyfT2iKzLV=4pr699%TbUs+;8c+|MyS*u}5qMBE3 zt&aEQ1V~Lv=GqhzE~zmqcz<((=E=?b2Xh)q=GKti9F;1kjJ!jTJkSI3a0DMk@Oh33 zD6>^WT;z$%#0f2SS3I+Fq(INn#}X=z_o zy!CLxFm4I#$)%9_akAAI>HY-G$>E|P%}`Lqlq@O&ui#BkhFj~HsQpbFvm_W!vY8sP z6OU8%jFh{szCUq#=z{fR z*}T-4RAfg2Q)H>Q4+MG%CMh+n=P*liyUeT}1Eho<_H-jHS~@$BbEq5VKHeDiSI$a4 zqfUpE%hz*vm7I%s(Bw&XR1NoAe<0oY#w$9=!?xMOVa4QaFd>)~@Z`!KQO{2bIIssZ zl%{^;IJZ@@fbc@HqGv8|1J)~Beo^yRCNoCuu@x5#P|6LTY^O2%q{-FCbyYGZ08U?Y0N+)~cTLE5l!&P>iF__h&gf+AAx28I zE(1WSYii?bjis(l^vha)-2t;ocj`C>uWNmM{6hSbS+m%~Wsp@?CRM4*3{{ri=If@G zbI#=}l1a`nb7J+H7fzzo@EQEK$urmID_)m#eJ1ty#DZY6+Rzfb9zpeSnR9D2-wh}s z?5^*Q0jZPca*TCM59s#Y-pQ8%aWO)m)av3lAgYL#8ar%W_xXw=hDZ|0d10qA1ReQr ztR$?Xqx%yAe7h*~(~e0x{mz`UQvLZg1g>~_v)x3pg-341NUClJ(&0hlwz^S?g7wLl zU>?|M{eI&;v_IV4!DI)BYr2LhDBre-#?jOyEzth`m=>Y z-smpM@jmwpmZPJ%Tq!qeo+r{J#$d8hpXAS{Y73!FVeL9xhv?qHppAW$>2ud)6%LuQ zvkxAXedx8z!`9IW8(d~Fk?G)}>3%bz@zc7gixCMWAI@-=u=uA#T8+NgA0;4<_VjFt z36t%O(II`l%qAX(6pifgsonm}RPh3|EPQTvoN9Jn|L!YFZ~IIfUv+@6HBxQY9U*-; zZUf5j{GN{_5}ahl1r0j<^yr~|Sxwq& zA+wfG{v)#zoY-AD3r}Z!;}!nCaIibEH^%7DqC%sMNrZ9jRUvy;-$L`5W~U=qs=!t- zqb20tU157s3?|YTvn4zpM--<7!NG$r`lNr5tMgo2`(A6#9|UHj;dwe=AE?$f{XL^> zBKjF%v#q_O$vB5bgCAwOzgGm|EHp@JNXQBqS|dS+GlWhXN?Zm9BlpT*VL1R8vp zGAy-4KC@|6Fo4ds;~^m3%<=JZE64;X0=7WQVc2_+^hxVBk3>46Vk8&kcbTES1b7z( zyj1mRr;>>m*!UH}Cs$>Cx4fvR7NoAD{dar){l(p0qxocoWWvn8@+H3akEKR{Czwjk zWNOiqzshcL&*rzOHQ$Se`(_bQ3*JR3_{i9d&ZiN+I>+)^JcxtDTc9h9ahXZ9(?x>pkXHA+?S^p#^tH_97 zu9UL4Q&$5X-}&gK8gMmv*+JkwCRNmD1km%$p-)wIZVF=8xXpNOyH1e9=Z=IJs^PkK zjf1j=2I@GCr;cjV8R925jZKT?`8DRMI?T>y`zTcc6ED`e?j4)7mdPF_UWjp~ zY!)U-Eb9{$P!|CTry)k~JHM|ze=IKZ2^rY%` zPR+)J9=8$WrPG7w5$K{;2I(miUV(Duq^Jek2}Kn>`9~Z zRs?^^kc#~B=Is2!Hnjzdv7k4dBw50Yr{JlH380TI+R%8d7`N==eYk^RVUO|7F(Kat@uqCcgK3ToYC#sK&nZrCyc zc8TN@Ae^%qv}!bP8<0BnOZexXb~V!2W)+Uj}jZXu}d3oJ&RGkfV6PZFA z)yDWeOMzM4AtX|SxKEu@w3*ZQ5@t$S##HD{2^mJipn}0#O^Dh%?p7U{Ocr1AtHm_` z!;e;wwikaqXr(Vv@^_+Tbnk=};0~Gy3Z2N-m;SqCd(NjAsKCKQ4rOhG>G`5WzA7u| z=sdpB+Y%UP6HCQhnefM$DsjF&JO6@5rV%NDPesSt?B!MIKc==hp0r(8{AmN`C4F+o zdX?`##v~kND|}`%9IkhsHB21t3L`QuviSG9&~n4lWmkyk+i&4E*cM5d&na}bxA3wp z9zHu-HcwTR9bPxsG~~09jOecp$WG>E0^9`m|L(9JlXs0Gq*@GZXJ=xO0M;xtD;PL{ z+~aPAejMB|vjD?O``l>9X)UE9C4yBGF*R}~cyezRPbiVP7gv~(e>I*ONYl8_`0Ac_ z`act!k^7-F#lUrw>L}2eja7M#i@|hqRdY7C`|E(9&=~Eu>{OE?F*!R}%z1wO?B7~*lPLF1qNX|EhL;n|?CEh#oo~T~qd^nRy1@~1yy|+bEa`JnNhyWx(;WP|k0#khN zH@3fbJKnTqOm_Q@HSR4av%&XjdWCFtaY;C6j+LP+Ue;~1xNSW5#@N_lU>l!kOr)Y- zL83AEM)PtRJA;}i!!djd{i&>-9#1NKC?djeo;UoG68^)oF-sB;tGZo1ogH7mu{xyf zT&;b8nf;dNAD2AchZDN>x_~hMb-B=|%grsO*I=BzWbt3U!8><*?m;=I3SFB4-tlDk zCF6S}SrjO=+p*vmj{wx&{*v|?wu>ph2N@E!Vflp%a`Xiybg1eNmh~;4^in+xm)JUi zcjN|jh__k^*jIj`!bD7pQ}wzMjD&wZL(}?ez(q_V*kpE=5eDOs2L)Xpd*)1`ABEOG zpGK@YsA6zAlIlYxJnl;LLHwrJJkI=CHw1shQ+@XR;_01%IxC9~q5DVUx}I-Brqsh^ zHI6qD_KmGw!Fhd>JzY{lh-Vu-<7sx1qJu&J8uAA9AYyo}A|y=Y+jfV0o!x5;tjA~3 z-HDGARGi%MR_L<9$ibb0BaF|d z-mjpV0XE)FH$t4l&g_UVk@Bp-!jCvGW+~yMSNkO-VRyE9o%t|cH1H5SZkIfLW+WlfXpH&YYld_qN1uK%=9Rr ziSQ3^3;PR@`q#hni$N?ujbRPc$DtiMk9R4xNgS~ah-x&-nP2iEt#GZy!E0d*ULsO4 zxh!!_f^clrfza7ZukI|zr_KhFH$xQU-B$$NAGjPm!J>TCDf(waJ89GzjS)uOd2r2s zE;i_NTH|}l6o~J8jBQ2oMw@BF`x$|kcq$yOdk-M(WmSprd4<1ZGMRb%zpIua-}0{V z7mY}HNKn+(;qnw*=|EC2{$1bgztg&*$JgYHhXg^!lz(p!6;2DC?_K-*XNfvYE@%Zl zOu-{dAUYR13U+g~@5PvhYuSQ0yLxCyNS1fz*Wm0PhsS<&vHP+J=Km!SA;Zs}&RNty^cLYs zpkto#%-p;pD4;c_0O|J|YcO{Io$5|)6TUvgyL&mi@=2@>-+aH?bdAw^r;DcAS7KpD z(w=L5_7mbWJwj~w(t65`SCmz=VTU>p3Znya!D>$5HomHJNvnBf@aHQ`w9^%WYj)fl zGi1;a7@swSs?vDH-zM4)wv#6zW9|#x3~y7!GuTQ(7oX7UPfwDVt1eAU#4R{j(LU$Z zjb;STm>9xhJk78=TM-_1*Xj8rydDfyLL@^$H=;ICa}8(_s`I;l$Bw&CZ#U3E&t9Dt z)|RE~l|^CQE&w%U)pcq8nZEgXId^v~-RjsTH_u4ypNTzs+?}WGjyr&(ajk2_`|ou_ z*})l=J144G+5|s7xrJC7r3gqU`1Bg`JGs; zGZGRqv{M0yVd8bIsb^G3j>obX{HkQA*E2^>J2x*k zZ+rl~wb3aEbxYSuh_}7s<&&YSyPZ2|7!O^S*3DhD)~`a@NptLy?R`y}!@_U*|eA1ZJA?!x`#rIMq zs*)Q)cN8l~Q8tVw(J|i6#7-K={<1AX*#!>+awlF=T>QHN-vc@xmeUVE6Il29#?z&^#nQU zq`24qrnoADGz67NL3WU>_9qo}B04%ya9(BMDYr3DD=$!so*b%iI7TXwU#HC$RNtI3 z)@Lr=0Nbc3!~*X^|N3c7lFgL;Hl2wZyLDph`i4s*{pGn-l=x&``uo$1E18rG0e$GK zLR!UJ<0~T}!Q><_t3yFhjVW99Lu5AbSY+}sgVpS2Lp`6o?22H^=M1|U@#FF&-9*-m z_3yyb$kT!f!$ebrFR;fn}|K_Fnm-PseC9-Nt7c*45g zdfS4&Dhn$t_9cceJbslJ!oZy!`}l?N!O@GvXbQ6Zs;KF<-=>&XJhamRPAFw+sD8*7 zm{FVU0yt8S+-`1re%!}vV11MOICd_ycDF0iy5HKpj$iry1gZAn9ZKN_FO#n~)r2A? zxdpQ(s6$0#Hu0&(K)5|Vwk~&qI>1L!G^2xO;@@7>g1D=mFcrm^#tjj z@3}V8Eq^a}Q_RO!geF;nZRWJi_2~snL?Sjsz~SRHcnt|kG)!8>_shv@zxb=So+8%Z z^4+mbp=+vBUCe<3X5b&Y2Sk+sTSs&$Uiu8ru40pSBgPL*;d=lNzaw0z!n9yKC{B8y z>o?;GS$r~mOes%aVqYfmk?#|b!{t+Vzwu&%172L(JKtpHnZvTpOg&UHI+wO2**VIA zAfA2EfCs99nYZ#zue1(<`#7Hf+>_t8K2$`Pp^QF{Ismoy%ia|cLu7<|Md$9Lr~CiZ z)bj0%? zI?c&3&|+&nj55Q&j#4T#mXsl9CyuK2&e_R*a>M%!$yNI7;>0>1ks5sO=010VO3w!c zikTF?y9b!cksl?>`M7&B!?Fh}iViy(L-%et5>%Ve>+3VzZGHKK%4C6&Gdqp!@v;w& z=lOdjckDEJKDNur%HPhMEY?XXaWh=}TfWLISw%?u4K7W%K7nO^P*||%-s*5MwtmjH zDYllvMwbbb?th1CzTr8s{fsXo4&u8t>N{0%1cxg4XO@&$9{Uoepz{R2j-S6T%1?1T zAlH+#ywp=^u=|tZM8$EDh%Rc|-ySBOxm5lTF{|2za~?^^Hj-d2I`)HB9rd5=J-0AD zt~z=?Grw(bdZ5trDT`tHBl|YsEUP4cH_{?6t!`uFDD_j#n%9jch!L3--C}Q_ma(C1 z?Q5nZAIU38ROeALjrWG)Fix66&1qiOGf91WLqhJ!mvSS~#Hdk%*?&?TGiHj6jUk}% z7SQWui?!VOPSjiTpXsgle?bo13tZljcec#+#S2$$u5EwuP@;e%YVq7zTWW^5USZ@4 z&v1<-{=wq>=8%R7X^$R0zhc$u#Kt{6yZlVsXZF{=g9wqy zzH)+^s9y{m4S#G5JVqm1*gH;i1`l^$*kEVd-0^T0M_x<{r;h2>%~afc+gw@w>kE~K zlXJ>ezRfU)EuS`K{O{9e?Jm!DSZ|-DIMB9t|4=WIX8N7)43+VAefeqb zI0pF`A(Co>O@?qJNG!R2%Oe!aJ-5uR0LtB38&6G_#5hEr^LW&`3@aHgeN;i? zg6L;5d~SJJa%t9?OY^ojNH+a%{uJ3Bng!1zsXb9|pfYsUTAOKOk%gN0*-s(=kdU2{ z32zhX8n|^2?`hXA!7lPbvG;pdw%LsZk>%>U9O^t^-5g|t3}phhF?QjpGybM`lvh5Y zoHiH#doQc`8uhJJ_8%us3oDk{oqLw1+SHC$Gv1#8F{`^J?@k2w!>oQzKaUW_BgBhE zF(9PouesK)!7>q%^qP}PM=002dV6JVM9fR2Jx-*TWOFA%?&R*_wFlG09Cf_jM&DnX(r4rO2A$#NxW4A|odAjx z8KgY)Wm`sHi&g^`DihkkWaTo}yK}CV^mZ{OI?$};VgfD63#32hbpe-cVsCtR+1Mlk zBu29USnXZpQbujzEHh#$=KZ+oVZuMcWxc%^H!rd|jY(S*#7QW_s}8w;#gWq9>3&%p z3^XIYUT$2t6crLHt;Qgd?<*Jtt_s`Eb3GFF^yLE0$PZM0(fnU6z#jn*xX^1PfLly# zw3r&%5QVv-$()6S-R~2(C!6Z*M?1!r!quS>&3=?)`?#OuW0YuSa2s}7Dq3?|D@pIa4- z!3eTOCagaflpSDMHO4~+Oipw7;5ddhP8rVpoB^TI zSRC@{N(XI6$%`;yTyX=DG8)CPlvz20ZHe3mR5gl=se_`87!VL2Zi3{2xT?(XcY2I=p_lpPDJ53R8XSo^fAy9O;RGROp{d>94(DQS{-k<9Q~( zl0qHaG0Iw7lhm_31}4DIiu;fGfk<)KV?T zwv0!+HJkS_3L>oqa7;^CprRsc$`28;>f6B z%QN#m(vc!Rwlj?z&sNKsjy1t>h~xZN6hiUmCr`pBkjW)>j4D%bW+o!chWsGbFrp_p z|LeImr^+pf)0kC1&r&$giGQ6e* zMZgzMKhtca3ITF!*Xaky3Z)-mi(jMqsBH;f0XX71G12kX;JQLSVzvT0wtC)z>j@Mp zW;m?G3!saolf(b{8p1Io^4+vOo<$BcNN`Yr=8L&HG}YRlozUaUM{%F3i;XcX#zCzl zHZBM|<#OF8KJvcPyj?(>kZpWqG;1M~@S+j8W)XOOBl`c^`>Lq8g6B;FNeBc98Y~cC zaA$CLcXxLPPOu?JkYGb#a2ecnaCdhncyI_LxZ8jD?SIeNr#*Z2ZO_@4e(8Jb-mb3O z_p9pa`p&*T-y3^bPH?WMW)*%(2zTI$LKccl+48N{pZ?i7YJYSv^H{ zWtLAKmg&WRdaVKMK5}$TKFD>7jyb(5wGO;7d6&)>%e=E#@;WUR@9@PMmx*ovx=gNl zLC&?8PvWFp4!m5qh5qQbtvIziy>QZAo1a)!?f;&=(xwA#M1l_PVG4Fflr}Q7R+t~x zZTp?TRJ?r>QL;JyTn6viV6p&eyX05mu%9X%-#zr7qT-tos5#Q-Xn0*K5T%bLF^&X> z)ET(X9y>^tLVzMN^C+I0&folzBbWl?ana@N38m}X1{#lrCl;QD!55X4&f-Z`{WKrU z*?xoyvo>T`LTh|k*sVs;p!cGrW1mc?Lu1J6wm3Rg-5^&1DdfN;pr;(lj8$|t>kWrL zmT*caaoC~{eb6GQw3-+iTR`O|VuM^kwNJl5S%VVAx|?}@FEu3HM4GU5;~FXM$3*(D zoBySMtmp0eZT}qgKViHv@lC1mwct7?{^*8g& zqMiM45+?kxk)Mix)q05<%GUS|>i2hUrRc9{xFW^8qnKFk-mnnH+L7cO2Sr;$QR8Cp zq0$Lf*XpW_qUL)?MQKeB4n<_yt}>Zm-!xmBgZ__E)4G1q&7{$d+g=Va0sx>(i|Iz0!b0)U+qg8Q%JYmCU!8e8f;si|Kl$`I=lo z+{e%&+yyzfU8)Zc4*o7Kgi?@`2ijbS5*@El$z~Bx?uN5+Fp&^D)s(1ATVnN~l zpi7=toN$%|{hN_JsY%d2_rrFy+Y0oa$N!Fq%V}-&*Ds-m)F8>}6OGmZH83vNO{ z*J-7+LscIzq}Tw25ZT<)2LgVh)nUoKV;{X4IjaLitbI^ z;$=@2+syGTWhXPMKs@otprN3qOP=SeX)gMpe9(@*J?&NIZ?bRgNmoJ{QK}xI)zj|=LPqgf=qs+1!M7s($c`Fnb|b2QsdpnzZE<~htE@;Q3(^(4voXG zzbtOm)3Sy93bX#;^@rL}%8*>0>aUc9iu&H?&b)>gn126aS_0{HaH!&V$CH-O*-PnYB^7^)c^$p46k2ubx@Kh{x`^*Q%&xS*c z7-1>6_?U$(LZfq~Ew{FZY}GWCI|qH{HhedkM~zGJy>p7!H1^lzXg>jjeR%=d*~Mf> zKc1)Jf1%+E-hY~pn&!PYdlrwZi>D!dMx1#4_~39a32H`x})zn~!;bsm@6j{#K;Nm@=Ub7QLtim2+w zy5i>do&C8=sl@5E_kjNKKjL=9`42v;Nba})G9y`uP;kH!`!U`*65Uu7s=#JIZs^^< z-Kk0Q9GG&TyL`#jk;?}m#Y?j1@XM}6#^{gOTY$ko@r4`-N_qnNSDrKtE0amH5pJ&3 z<>=hS<)?mctv#!L%8q8hmujo`Dey93n9tQQ|B!WPgub9|g)SEh-=W?sC1U+F0Dy@G z?uuuUz3Re5hNPg-Vwa1{kBcsxgUOo4RwLD>D-S!$i_0k^gE>5U6YWD!>I=>@lCD!; zTuRWcqxag2h8r6=qfxXkj)T&}Qd|JnBv4Gp-89G*2Tv_7PL-0JL!GhM zT%I6D!*yGQY}FK}henBF!%sh!EzQD0x69%7#9D{R3RhQ*D+Q)U=FowL1W-o{C)C|8 zD1^X|vP;>KXc10&I8LlOu+a@x2Mswi`C{P_1_|9U$8UXle5XDg7mJRb@pS8dTxPHJ z(~@u}_p9EG1Yj|^&uYMmi+t7J^JJgoG2R$hLlNrWlizwN{LCLr^%+(r#wH+Z2)fn&@IC<>ZghazlH~F zvA1|qK`uw%K0UB(*)Z^T&wE~}64$EJ9!el$%R->r$P+PuIb+3JsOM?a5AnKRDnf_i zFN-nhU>16nil&BcH-|e>-x(daVLaQ*hOa%D^(jCBbjCxCTe!(vq|U*ZS=;+LB0v5# zpN@o>fEsjz%gBa`HNaWl)|&8FTki*U&wgK;E^tN!mJ+*R9u{B$L1Ef1I2-kjASF|F zsSJGcH_+~Tu=4n%W_P9qwum?tc72?YK;(4PR_n#YGsF*15RfP|lz6&G8yfuj#(sph z6xtI76W=c>&dSk5(hwsD+V<6?053=?p9a>?#{0N7sfC8l`-YO)dOhIdxJf5yeWj($ z;jMWcfloHnSWO9{eJSSN27T(IV@2n?u)eXh4q6;c5vP=StYi~f%rJk#k)sY z#*7~&*@r~2VVAF=uS2u3ukKH89`|i-kW@8#f&p%OZ;8Mq`^{n;*rbDY=&h7P$qB5a zo`N3Wxw6zO;fYRM=gGCH0l!SVNlJ-kKAXQsogUu8(iL@^ znJxM3s-m?uvCr5mj7-N~aeAuU z$RXH;OI^>i2t@JyivhNY>VKEyQHU2v6d;oKjEp$f;H{8-pOTy)2a1YrWxFl>c>g=myo;dxPaBY1MFBDYa|cot4H4XfgovtR^?*KDn z8^Ry8o`%jB#g(k7SV zms!0xP5NHqmQ)o5m61}T*!6WKjx*~vt20rP_<4CS2-q3hx);9XeO~v(hdhZK!p|;V zxm`GXsz*80ZL)fGuEl7w!AdLqEe;+RVJG#D+nZPJG4TJ9`Mj?Q=1NVjw?eWX$p2s~ zI1Z~xkfGGB0bPQ2%Y34!a&hS=(s$i+wQ(EaS^+7ct)V40#2)TdKn~nha87UvQcA-r zAwOrNwMD3=7RIxy-@C6=7^}6|2zaK?g!AsBV6$DJ2wZKeM^#_`KB13i1f^zs!>cef zAfLSML9h|UY@n~)_~M3hd$U>mie6M2IJYC(eE)z%9ve|u10Hq_!I%DEzl*zD?iXac z$j~QtNG)EkehhK2%5yW3fq03XLaMyJd-5NyFU*a z3$qb$zB%~Qo(AEh!q>x!j|qPt?i2p{?|;I2!D|~p4zElKI9m?el1Eb#=c9kikUa-Cd7OKv{C^)FelS@5dxOoa(&X5}#+-q8Tjh zu7_4!J3Lfefj&~iKP7ZS@tNrR%98-x8uU`j&njFT6kVUO z9v?@N|H5?eCUZ^2Oz|Em8vrkG`unm-z{{S9P8@A2EFO<4Jec#%*qp>-h`E6y8VK~0 zYEhO2I`RjNxP0tbWx?~lo&lo4nmQeO+gJj2spI|iTx~|v;)P9RYg%IehwaQ7Sm{pd zqV}`Mq95PI`TR^)DG`}2Ss+Hz+_D17JJe@~92z$i{01ldFI{e#Ab7~Fke!j~t#}el z-n7|n9Cql=8TjMvU|w|kC}mB-PfPZy-Vj@XZ&A70L@;=2+E**GkK=|pJ;17t>XcTx zkz_*siK|>q+M%B08Z#`(ujt}&s`rjAe~(NnY9&;$;dBDJbYIlaJ;M0Cy-dd+7tiFq zExZ_+cJ_)6A_Qvx7DPk)T4nq4bl{}kL6!eL9A}jGd_n}^gr`7sYri5M#G#BWi|#Z% zrkA|Gs4UZ|N)>r8ts;D-{vSJ2&O|e@A<|K&GlGTeagAmVT4f#b&5wel;-hGmLB1|1 zkiJmC{!rZ}ex8C`-zIp$$c%8DWOhcJNO#ZM;wOiLNkjSga@g2ZD%H??eOjGt0*y7PI9Q7Y{$yL7`dTHR% zh9<#TI#Zbo8el#NDLg@$p|H?A5y1^{Yq!GG2O31aI7Dwaj6;mic648m< ztHOBwy!Ns}bZ2tl1mJ7R3`5862FS>tPJ~adS&X}0eaI9wRpN_4lz4?r(6H}J#h9y+EU&BcKKk7l=>D(f64IolE2D zIv6ISF5~0w`bi(&Ic>*uV7nPr4LeEegXeR9VEyM`Qq`x({^PB9>if3#J;Xl-R1{3A zu_z_qnPr87YCSHnAnbwC+RFX+TQs+~Ym;FU2DJ$c+Q)GsB}!`S`S z#Hi8ayXaGX@Raa)I%6iaEyj;R2dWoy2gkYCEKlFEQ@_pLqvpqi7S#8IVMF>G-;}2C z3Peljo4yA-UIT{+y_G!O1HyfqDm2m$T9% zUiIkv>y&wT`Wrl4ibW{G-3Q?)3l_NKYw_p*VDQST#kQnfb|&MdTWP$AZZwTQq#O7C zo(uP~Ud1~byUvDw%MAy)8u&KWIasI?QxPId${r#aGj8Po4r0`woMYWkdH#?zX4U6d zXA&OX_jRJcGE#Kn*1pzO7LAEiDo#>t4*5?3nh3jTOn4v0hl9f7?jL|r2IKJN3=V5PN2yPt(Xnfg$?%l5hG|#uEfdKV%$6M za^`$+NT&O#J>m*Zsm!9XCu`B0S8PFl-D;_rXK}h!mX;XZP#D`BDy7Gl;YG<8N)Acp z2YbttS(*jD0Wj#ATUXg=(JfxlVyRP5oom5-w6H>JVwdjT>Mi-6grK8w2CwgA^&E5^ zUvC`Q6}Gi~zastE^&=wh7h#LdCwrR0ndK!B^R$?47Y46~DOK76oipn)^PX-OH2E0Q zKcRcNTopea9%M&Tgu{dK0u7aADES+HcB264;)i)XVPOGpgWELHd1ac2J0)7p#HFcx zT1Go6V{`TW$M_T8&OmRl({{l$>Uq^K(OLn;#RhbCi` zSck5E9o_kfX#Kdj>dEtg*+d}sFAbtR+ufh)A^OSDR%{z*ca7ISDY`y<2s1{b zofm#Fx|7@G5#EX`^;#62K!cAECCd?IP|W;r&C#zNi(60EDVEIL!Ako;lMsQ^~P%LQKFD?X+QOpG+b*9PeE2@N>H zj`Wo3cMTRcM4^jdLHpMsuvZ46+&a<;B-oTVv~g(msMU^=R!s@pd2#vCcBt*LPoKk|MY zv~pLX|Em5Wi93KaaJ=;RA`FPoyg!|bmc)HEm7(7#`rvF)}T!)j4ln9pBvuv z=voy+eE+SdeHS-T=n1d=aqgp+<0?lr#34Y+Ngc1Q;Q@d~Hc<2cs)leZ{c)WBjo2+{ zAY2=XREG`G@{1OJ-d(uayyM+2TwCM|hiSn*nX5*ff7Igug)0GeGpZx;0@!VnwbxZ~ z!ssZsvo|0PQcl}UoHQdE#`1P(QLeBjM7|!|x+a_U@qpUcnlgc#+3nzjxK%rCAOf#u zD5CA2Znq439&{={DpRyQnTBkG_U*U*hok(udXyNZ?=CYmDnIR{Utr~1VnPuNpHsui zu2`WI!kE03Hd}f8P4#Kn=9$qh2?IH9WAd{Hxyk%h^Eh`}5v z_k)Ox*<8#d?ci9hpwlfiRY9Sk2I*r&QN#_}jew-ijQAOmUGe(BO0c~mD(`Iwt`&n# z^V)j7Xbkp=&%S>mQ~2hPI-%L&Zg)!BEHA}2K3<$(;S+z@w2P!p?%zhD<`q(p9U*>0?p0%{_Xzb?iPboU+aiB&bzUFJxTu`93M2t*SrW#sTGSp=JEZw& zZ9mO?Sf2Q*_K%B|jv5Z#O9@$1*wV(5Es+#w?vS*y8lKo`Fxm&8NCUk8CM=)QWw!^= z3=Z?M8NZnUfo15ew-e99;O3S^AVOJqlu>(#lK@-D@2AYu7~y4Q%}Sf?7f%CCh#CR1 zQP^#Qrms1Py(5Z=DOzGx{1QfLKrg~R(|)1|O+h+-I*;+%le$LcD%^A| zFDxVP3@wHX33^8sh`g3nvRt_UG-Dp`w&ARfKG!J5kIMCWKd_SbNXTux3ysO_O3ner zZ5FaR)ysMNA)#Xs)-Z+gw4k@(=KoQ{TLK;uXvM`mmm$W5|H?CvQqCNTQXs1zbzw}i zEZjLW8aJr;%&?39o_pMCW=2R!t5KHOs5=NmmbBI==JthI>cN>*pVV}@#W7W{vM13A z$Uxo=rA>ysC*)@*Zh75YVXibx)ipC*w?x0@Ijj1Sn|Z#)S6#Q|b3*R(t-T}1rF3cpRbW{+xdoN(WDhBy z0kZ&k6@yiLpa`sC2Vcn&H@_xvBixqy_hD8^`9%>= zXC4_&W5i9#fNy4I4ogu?W`qHHiD`9yOnmD8@u0zIBSMcO722e0B$}ozS&hefII_Ms zK{~S6Pb^$8B9v|mq1Ga9C$1_%8)~$W!#E?*WaE+F2r!7kGTdMp>8U13+@*-TwKz-#c z(iyjgYJQPUj$AAeVsV6~XmN=Mu3FZc>Z+ywU!x|iV_vPJLf02v082vTpGr2HAmKRU zf9XJIEaPpd?=i2ZTyAdenSdA?LY3UvKSpkQ!N= zr`lHLs+GA$dAugQ{USQ^*k=4&Wl+)Sm&3ZtmVr5cp3>O^Am6!4WKc#l0>V3eSqV{% z+_;p|)KM!ApN&=_N2j@71wCHwGR>F^yP0NbO=HsAM+`vA@y6? z*kR^EVnq&7TE6nzuYdktGneY1+n#J^kus0(8*o*MIl`mQtz`xCQEI%olaGQ+Ct{VU zesR`$CPg_1U9T=X+!TP^ewQIN(jMExdTl31)Pml3Oc|*$huI!!7a2}mL&nTQE|IBx zP0GkmE=nQx(W=SKd9kszsF>0T(AKP>vuPJ@l7&s6-pg00b5*xJnHmU(ugNX4;<5XAYM7M0iCK-7fGG`S=?_ zdaOMPl2yq+PM+MJ4_oYV9ve(bXKr)EUY6GF*$Q48#F)_!0kN8rFl`0`G2Qcj)8QJI zLoqtkdc^f?{KV24)(TZjRC8(8=6X*wcMg~57Kt>^GM(%emcux_|4uu}tLGZ|U20xl zU9El40dEZwe1#WK581pf%_q-0 zJIb4W(_uEoWM|i^Y}!$3_f4xfmd&zqT~-KJdk^W89U5|8ca)TLTq=XSn#d(nxgA;( zhhVH$#ZggqzTv5jO+PEff|Rq5>#)CjDhJ3E`erZ_rxH(o(B-=1fD8R~J@8GwPV zo#5qMmwNnu*jj+FGHY}$Pwn84f}&AQc;(6diyd#FaL1{1M!Fu~(R+!x^nDF`0g45J zTMZ2#f#MNh6Y;lP7830oV0J-s7U;H?IiH#%Nx!64Mm|YvolL#cV>>kh-%5=LI#|k# zub!c+;WMSmXjC}doqqP@!zn3fS-6L1bD-gC-xkEqUQp6B`zCr!i;DLQIdvA+Yy{p@ zr^VKs+#7Tm)>BZXPmn7m2ruQtSK|d{FCP9YJ>1`)Tx;{a90g9yKIkvD`8M3$-NldW z*tKIIbhe%SGLNxcZ}-!yvzs$~Hg+W`R^#MLHJCgX{QLaAZ2jrN_pBuG>i1U=>MSQM z=>cioh*n1AS)y+uknqup^D?CMHc5l3a&&Y|{*U8M zC~^FaRKq++g2%r}(Z|PMeR#y$aqw5>U}epknwm;YdKW{&t9HJ|h=9;O+@9RoT|Ioj z_UQY}oZ%rqJf2tA*sXkQS)<$bba#jv)+1kvS9!}(b#~h-*RYC)ju23Zk9bIWKJ0B- zcsBghAv`F!=?!I18U2flh)@-D<0$+Z0Rh4DdnY0SLRHlNZ~u21__@skCK-TJR=vhY zKnSq>f4dbyhwjl4pwVN84-&ZboZ4`dn6P^FoE~E7!0mxESd5$sB5T;{r8;G!F|B6M zXU2w(fdT*8hCEhN-B94B7?4I_jvFn-$yRf~yzGg^KfXlJn8_(eL_!A$+c6Mu582?P_uLPILA~@g@ zKe0Erx>_Dh%>CzNqi3nkJ_#h03I4=ifKJR+)Y78AV{hQM*xM;lw#|$Iy9lW}_x?&y1`E+@cR|p8RCkMJ^ySr9j*4qtlK}HF3lJHyP z0N5k_2@)^;pb7)#!k7N#dPVRSZLCa@3N7d#3F3PMgx_4QP3g_e%>dbawS)St{|ugA zrC8&i*HK+3`&o&n5DEfxbVC`cL3ORYZ~1~FbSnv9PSVs>g%%4}L3_c9 zhzj0Bk(%LM6ET=lvqWmGPI`}LM{e%nayGfbNS0aM9j|g-n5zIo zKq+W!y}%mX0I**}AU7bU89r=dV<|P*rtFA7=dIEW2pm+Q{QL&[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + +You might need to troubleshoot the onboarding process if you encounter issues. + +## Endpoints not reporting correctly + +If you have completed the endpoint onboarding process and don't see endpoints in the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md), then this might indicate endpoint onboarding or a connectivity issue that you need to address. + +To address this issue: + +- Ensure that the endpoint is onboarded successfully +- Ensure that the Windows Defender ATP service is enabled +- Ensure that the telemetry and diagnostics service is enabled +- Ensure that the Windows Defender ATP endpoint has internet connection + +### Ensure that the endpoint is onboarded successfully + + +### Ensure that the Windows Defender ATP service is enabled + + +### Ensure that the telemetry and diagnostics service is enabled + +If the endpoints aren't reporting correctly, you might need to check that the Windows 10 telemetry and diagnostics service is enabled on the endpoint. The service may have been disabled by other programs or user configuration changes. + +You will need to check the startup type and verify that the service is running. + +There are two ways to check the startup type for the service: from the command line or in the services console. + +**Check the startup type from the command line:** + +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command and press **Enter**. + + ``` + sc qc query diagtrack + ``` + +3. If the service is enabled, it will be set to automatically start. The result should look like the following: + + ![Result of the sc query command for diagtrack](images/windefatp-sc-qc-diagtrack.png) + + ``` + SERVICE_NAME: diagtrack + TYPE : 10 WIN32_OWN_PROCESS + START_TYPE : 2 AUTO_START + ERROR_CONTROL : 1 NORMAL + BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k utcsvc + LOAD_ORDER_GROUP : + TAG : 0 + DISPLAY_NAME : Connected User Experiences and Telemetry + DEPENDENCIES : RpcSs + SERVICE_START_NAME : LocalSystem + ``` + +4. If the **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**: + + ``` + sc config diagtrack start=auto + ``` +5. A success message is displayed. Verify the change by entering the following command and press **Enter**: + + ``` + sc qc diagtrack + ``` + +**Check the startup type in the services console:** + +1. Open the services console: + + a. Click **Start** and type **services**. Press **Enter** to open the console. + +2. Scroll through the list of services until you find **Connected User Experiences and Telemetry**. + +3. Check the **Startup type** column - the service should be set as **Automatic**. + +ASK ALON HOW SET TO AUTOMATIC IF IT'S NOT SET FROM THE CONSOLE. + +**Check that the service is running from the command line** + +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command and press **Enter**. + + ``` + sc query diagtrack + ``` +3. If the service is running, the result should look like the following: + + ![Result of the sc query command for sc query diagtrack](images/windefatp-sc-query-diagtrack.png) + +4. If the service STATE is not set to RUNNING, then you'll need to enter the following command and press **Enter**: + + ``` + sc start diagtrack + ``` + +5. A success message is displayed. Verify the change by entering the following command and press **Enter**: + + ``` + sc query diagtrack + ``` + +### Ensure that the Windows Defender ATP endpoint has internet connection + From 595a1951bdd9db0bff7d9428f83792c36aed5d50 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 6 May 2016 16:51:21 +1000 Subject: [PATCH 145/439] add intro topic to config proxy --- ...rnet-windows-defender-advanced-threat-protection.md | 2 ++ ...ing2-windows-defender-advanced-threat-protection.md | 10 +++++----- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md index 27de7a82cd..cac027642f 100644 --- a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md @@ -18,6 +18,8 @@ author: mjcaparas [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] +The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report telemetry and communicate with the Windows Defender ATP service. + The embedded Windows Defender ATP sensor runs in system context using the LocalSystem account. The sensor uses Microsoft Windows HTTP Services (WinHTTP) to enable communication with the Windows Defender ATP cloud service. This is considered as the appropriate method of communication this type of usage scenario. The WinHTTP configuration setting is independent of the Windows Internet (WinINet) internet browsing proxy settings and can only discover a proxy server by using the following discovery methods: diff --git a/windows/keep-secure/troubleshoot-onboarding2-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding2-windows-defender-advanced-threat-protection.md index 1219c5e37e..1d9cd0f6d1 100644 --- a/windows/keep-secure/troubleshoot-onboarding2-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding2-windows-defender-advanced-threat-protection.md @@ -6,7 +6,7 @@ search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library -author: iaanw +author: mjcaparas --- # Troubleshoot Windows Defender Advanced Threat Protection onboarding issues2 @@ -25,10 +25,10 @@ If you have completed the endpoint onboarding process and don't see endpoints in To address this issue: -- Ensure that the endpoint is onboarded successfully -- Ensure that the Windows Defender ATP service is enabled -- Ensure that the telemetry and diagnostics service is enabled -- Ensure that the Windows Defender ATP endpoint has internet connection +- [Ensure that the endpoint is onboarded successfully](#Ensure-that-the-endpoint-is-onboarded-successfully) +- [Ensure that the Windows Defender ATP service is enabled](#Ensure-that-the-Windows-Defender-ATP-service-is-enabled) +- [Ensure that the telemetry and diagnostics service is enabled](#Ensure-that-the-telemetry-and-diagnostics-service-is-enabled) +- [Ensure that the Windows Defender ATP endpoint has internet connection](#Ensure-that-the-Windows-Defender-ATP-endpoint-has-internet-connection) ### Ensure that the endpoint is onboarded successfully From 339ea6f96ee21148091f040dc65d3115d625216e Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 6 May 2016 17:04:20 +1000 Subject: [PATCH 146/439] fix numbering issues, add troubleshoot topic --- ...windows-defender-advanced-threat-protection.md | 15 ++++++++------- ...windows-defender-advanced-threat-protection.md | 8 ++++++++ 2 files changed, 16 insertions(+), 7 deletions(-) diff --git a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md index cac027642f..731eea65a8 100644 --- a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md @@ -143,16 +143,17 @@ Verify the proxy configuration completed successfully, that WinHTTP can discover 4. Enter the following command and press **Enter**: -``` -HardDrivePath\PsExec.exe -s cmd.exe -``` + ``` + HardDrivePath\PsExec.exe -s cmd.exe + ``` Replace *HardDrivePath* with the path where the PsTools Suite was extracted to: -![Image showing the command line](images/psexec-cmd.png) + ![Image showing the command line](images/psexec-cmd.png) 5. Enter the following command and press **Enter**: -``` -HardDrivePath\portqry.exe -n us.vortex-win.data.microsoft.com -e 443 -p tcp -``` + + ``` + HardDrivePath\portqry.exe -n us.vortex-win.data.microsoft.com -e 443 -p tcp + ``` Replace *HardDrivePath* with the path where the PortQry utility was extracted to: ![Image showing the command line](images/portqry.png) diff --git a/windows/keep-secure/troubleshoot-onboarding2-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding2-windows-defender-advanced-threat-protection.md index 1d9cd0f6d1..74c7e390e7 100644 --- a/windows/keep-secure/troubleshoot-onboarding2-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding2-windows-defender-advanced-threat-protection.md @@ -129,3 +129,11 @@ ASK ALON HOW SET TO AUTOMATIC IF IT'S NOT SET FROM THE CONSOLE. ### Ensure that the Windows Defender ATP endpoint has internet connection +The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to be able to report telemetry and communicate with the Windows Defender ATP service. + +WinHTTP is independent of the Internet browsing proxy settings and other user context applications and must be able to detect the proxy servers that are available in your particular environment. + +To ensure that sensor has service connectivity, follow the steps described in the [Verify client connectivity to Windows Defender ATP service URLs](configure-proxy-internet-windows-defender-advanced-threat-protection.md# +Verify-client-connectivity-to-Windows-Defender-ATP-service-URLs) topic. + +If the verification fails and your environment is using a proxy to connect to the internet, then follow the steps described in [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md#) topic. From 3ee3c6c538d81a68ff6785b7d3d0a944d572405d Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 6 May 2016 17:10:56 +1000 Subject: [PATCH 147/439] update meta title --- ...t-onboarding2-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/troubleshoot-onboarding2-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding2-windows-defender-advanced-threat-protection.md index 74c7e390e7..f232126952 100644 --- a/windows/keep-secure/troubleshoot-onboarding2-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding2-windows-defender-advanced-threat-protection.md @@ -1,5 +1,5 @@ --- -title: Troubleshoot Windows Defender ATP onboarding issues +title: Troubleshoot Windows Defender ATP onboarding issues2 description: Troubleshoot issues that might arise during the onboarding of endpoints or to the Windows Defender ATP service. keywords: troubleshoot onboarding, onboarding issues, event viewer, azure management portal, data collection and preview builds search.product: eADQiWindows 10XVcnh From 826d79e7939442515926f17bbf82a1b33a9b3f48 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 6 May 2016 17:17:24 +1000 Subject: [PATCH 148/439] minor edit --- ...t-onboarding2-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/troubleshoot-onboarding2-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding2-windows-defender-advanced-threat-protection.md index f232126952..d3d29b68ae 100644 --- a/windows/keep-secure/troubleshoot-onboarding2-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding2-windows-defender-advanced-threat-protection.md @@ -23,7 +23,7 @@ You might need to troubleshoot the onboarding process if you encounter issues. If you have completed the endpoint onboarding process and don't see endpoints in the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md), then this might indicate endpoint onboarding or a connectivity issue that you need to address. -To address this issue: +Go through the following verification topics to address this issue: - [Ensure that the endpoint is onboarded successfully](#Ensure-that-the-endpoint-is-onboarded-successfully) - [Ensure that the Windows Defender ATP service is enabled](#Ensure-that-the-Windows-Defender-ATP-service-is-enabled) From d87ca9688d0cbeb73ed59861d71239960d42428b Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 6 May 2016 17:20:36 +1000 Subject: [PATCH 149/439] update command --- ...ndows-defender-advanced-threat-protection.md | 17 ++--------------- 1 file changed, 2 insertions(+), 15 deletions(-) diff --git a/windows/keep-secure/troubleshoot-onboarding2-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding2-windows-defender-advanced-threat-protection.md index d3d29b68ae..73319a24cf 100644 --- a/windows/keep-secure/troubleshoot-onboarding2-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding2-windows-defender-advanced-threat-protection.md @@ -55,26 +55,13 @@ There are two ways to check the startup type for the service: from the command l 2. Enter the following command and press **Enter**. ``` - sc qc query diagtrack + sc qc diagtrack ``` 3. If the service is enabled, it will be set to automatically start. The result should look like the following: ![Result of the sc query command for diagtrack](images/windefatp-sc-qc-diagtrack.png) - - ``` - SERVICE_NAME: diagtrack - TYPE : 10 WIN32_OWN_PROCESS - START_TYPE : 2 AUTO_START - ERROR_CONTROL : 1 NORMAL - BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k utcsvc - LOAD_ORDER_GROUP : - TAG : 0 - DISPLAY_NAME : Connected User Experiences and Telemetry - DEPENDENCIES : RpcSs - SERVICE_START_NAME : LocalSystem - ``` - + 4. If the **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**: ``` From 4a67cff27396a58427303861c07dd1b3c4682911 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 6 May 2016 17:25:55 +1000 Subject: [PATCH 150/439] rename to fix conflict --- ...arding-two-windows-defender-advanced-threat-protection.md} | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) rename windows/keep-secure/{troubleshoot-onboarding2-windows-defender-advanced-threat-protection.md => troubleshoot-onboarding-two-windows-defender-advanced-threat-protection.md} (98%) diff --git a/windows/keep-secure/troubleshoot-onboarding2-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-two-windows-defender-advanced-threat-protection.md similarity index 98% rename from windows/keep-secure/troubleshoot-onboarding2-windows-defender-advanced-threat-protection.md rename to windows/keep-secure/troubleshoot-onboarding-two-windows-defender-advanced-threat-protection.md index 73319a24cf..8caad38121 100644 --- a/windows/keep-secure/troubleshoot-onboarding2-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-two-windows-defender-advanced-threat-protection.md @@ -1,5 +1,5 @@ --- -title: Troubleshoot Windows Defender ATP onboarding issues2 +title: Troubleshoot Windows Defender ATP onboarding issues two description: Troubleshoot issues that might arise during the onboarding of endpoints or to the Windows Defender ATP service. keywords: troubleshoot onboarding, onboarding issues, event viewer, azure management portal, data collection and preview builds search.product: eADQiWindows 10XVcnh @@ -9,7 +9,7 @@ ms.sitesec: library author: mjcaparas --- -# Troubleshoot Windows Defender Advanced Threat Protection onboarding issues2 +# Troubleshoot Windows Defender Advanced Threat Protection onboarding issues two **Applies to:** From f836fff8b593ee919d6b64518158dcc6a9ab70de Mon Sep 17 00:00:00 2001 From: jcaparas Date: Fri, 6 May 2016 17:34:30 +1000 Subject: [PATCH 151/439] Create other-troubleshooting.md --- windows/keep-secure/other-troubleshooting.md | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 windows/keep-secure/other-troubleshooting.md diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md new file mode 100644 index 0000000000..e472ad1366 --- /dev/null +++ b/windows/keep-secure/other-troubleshooting.md @@ -0,0 +1,11 @@ +--- +title: troubleshoot +description: troubleshoot +keywords: troubleshoot +search.product: eADQiWindows 10XVcnh +ms.prod: W10 +ms.mktglfcycl: deploy +ms.sitesec: library +author: mjcaparas +--- + From 604f6625f8c4819fe55b34463e910a5b1132fb34 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 6 May 2016 17:36:14 +1000 Subject: [PATCH 152/439] update TOC --- windows/keep-secure/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 5f7b73081b..2b6d9b59ea 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -410,7 +410,7 @@ ##### [Additional configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md) ##### [Monitor onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) ##### [Troubleshoot onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) -##### [Troubleshoot onboarding issues2](troubleshoot-onboarding2-windows-defender-advanced-threat-protection.md) +##### [Troubleshoot onboarding - updated](other-troubleshooting.md) #### [Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) #### [Portal overview](portal-overview-windows-defender-advanced-threat-protection.md) #### [Use the Windows Defender ATP portal](use-windows-defender-advanced-threat-protection.md) From da5aae098783c3dd8467cccad54aa6e8892f7d8e Mon Sep 17 00:00:00 2001 From: jcaparas Date: Fri, 6 May 2016 17:37:10 +1000 Subject: [PATCH 153/439] Update other-troubleshooting.md --- windows/keep-secure/other-troubleshooting.md | 115 +++++++++++++++++++ 1 file changed, 115 insertions(+) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index e472ad1366..25ece39fc7 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -9,3 +9,118 @@ ms.sitesec: library author: mjcaparas --- +# Troubleshoot Windows Defender Advanced Threat Protection onboarding issues two + +**Applies to:** + +- Windows 10 Insider Preview + +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + +You might need to troubleshoot the onboarding process if you encounter issues. + +## Endpoints not reporting correctly + +If you have completed the endpoint onboarding process and don't see endpoints in the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md), then this might indicate endpoint onboarding or a connectivity issue that you need to address. + +Go through the following verification topics to address this issue: + +- [Ensure that the endpoint is onboarded successfully](#Ensure-that-the-endpoint-is-onboarded-successfully) +- [Ensure that the Windows Defender ATP service is enabled](#Ensure-that-the-Windows-Defender-ATP-service-is-enabled) +- [Ensure that the telemetry and diagnostics service is enabled](#Ensure-that-the-telemetry-and-diagnostics-service-is-enabled) +- [Ensure that the Windows Defender ATP endpoint has internet connection](#Ensure-that-the-Windows-Defender-ATP-endpoint-has-internet-connection) + +### Ensure that the endpoint is onboarded successfully + + +### Ensure that the Windows Defender ATP service is enabled + + +### Ensure that the telemetry and diagnostics service is enabled + +If the endpoints aren't reporting correctly, you might need to check that the Windows 10 telemetry and diagnostics service is enabled on the endpoint. The service may have been disabled by other programs or user configuration changes. + +You will need to check the startup type and verify that the service is running. + +There are two ways to check the startup type for the service: from the command line or in the services console. + +**Check the startup type from the command line:** + +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command and press **Enter**. + + ``` + sc qc diagtrack + ``` + +3. If the service is enabled, it will be set to automatically start. The result should look like the following: + + ![Result of the sc query command for diagtrack](images/windefatp-sc-qc-diagtrack.png) + +4. If the **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**: + + ``` + sc config diagtrack start=auto + ``` +5. A success message is displayed. Verify the change by entering the following command and press **Enter**: + + ``` + sc qc diagtrack + ``` + +**Check the startup type in the services console:** + +1. Open the services console: + + a. Click **Start** and type **services**. Press **Enter** to open the console. + +2. Scroll through the list of services until you find **Connected User Experiences and Telemetry**. + +3. Check the **Startup type** column - the service should be set as **Automatic**. + +ASK ALON HOW SET TO AUTOMATIC IF IT'S NOT SET FROM THE CONSOLE. + +**Check that the service is running from the command line** + +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command and press **Enter**. + + ``` + sc query diagtrack + ``` +3. If the service is running, the result should look like the following: + + ![Result of the sc query command for sc query diagtrack](images/windefatp-sc-query-diagtrack.png) + +4. If the service STATE is not set to RUNNING, then you'll need to enter the following command and press **Enter**: + + ``` + sc start diagtrack + ``` + +5. A success message is displayed. Verify the change by entering the following command and press **Enter**: + + ``` + sc query diagtrack + ``` + +### Ensure that the Windows Defender ATP endpoint has internet connection + +The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to be able to report telemetry and communicate with the Windows Defender ATP service. + +WinHTTP is independent of the Internet browsing proxy settings and other user context applications and must be able to detect the proxy servers that are available in your particular environment. + +To ensure that sensor has service connectivity, follow the steps described in the [Verify client connectivity to Windows Defender ATP service URLs](configure-proxy-internet-windows-defender-advanced-threat-protection.md# +Verify-client-connectivity-to-Windows-Defender-ATP-service-URLs) topic. + +If the verification fails and your environment is using a proxy to connect to the internet, then follow the steps described in [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md#) topic. From 1a81f7ba9dfbfd6880ada995a449ebbcc5657dc9 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 6 May 2016 17:38:50 +1000 Subject: [PATCH 154/439] delete --- ...ows-defender-advanced-threat-protection.md | 126 ------------------ 1 file changed, 126 deletions(-) delete mode 100644 windows/keep-secure/troubleshoot-onboarding-two-windows-defender-advanced-threat-protection.md diff --git a/windows/keep-secure/troubleshoot-onboarding-two-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-two-windows-defender-advanced-threat-protection.md deleted file mode 100644 index 8caad38121..0000000000 --- a/windows/keep-secure/troubleshoot-onboarding-two-windows-defender-advanced-threat-protection.md +++ /dev/null @@ -1,126 +0,0 @@ ---- -title: Troubleshoot Windows Defender ATP onboarding issues two -description: Troubleshoot issues that might arise during the onboarding of endpoints or to the Windows Defender ATP service. -keywords: troubleshoot onboarding, onboarding issues, event viewer, azure management portal, data collection and preview builds -search.product: eADQiWindows 10XVcnh -ms.prod: W10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: mjcaparas ---- - -# Troubleshoot Windows Defender Advanced Threat Protection onboarding issues two - -**Applies to:** - -- Windows 10 Insider Preview - -[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] - -You might need to troubleshoot the onboarding process if you encounter issues. - -## Endpoints not reporting correctly - -If you have completed the endpoint onboarding process and don't see endpoints in the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md), then this might indicate endpoint onboarding or a connectivity issue that you need to address. - -Go through the following verification topics to address this issue: - -- [Ensure that the endpoint is onboarded successfully](#Ensure-that-the-endpoint-is-onboarded-successfully) -- [Ensure that the Windows Defender ATP service is enabled](#Ensure-that-the-Windows-Defender-ATP-service-is-enabled) -- [Ensure that the telemetry and diagnostics service is enabled](#Ensure-that-the-telemetry-and-diagnostics-service-is-enabled) -- [Ensure that the Windows Defender ATP endpoint has internet connection](#Ensure-that-the-Windows-Defender-ATP-endpoint-has-internet-connection) - -### Ensure that the endpoint is onboarded successfully - - -### Ensure that the Windows Defender ATP service is enabled - - -### Ensure that the telemetry and diagnostics service is enabled - -If the endpoints aren't reporting correctly, you might need to check that the Windows 10 telemetry and diagnostics service is enabled on the endpoint. The service may have been disabled by other programs or user configuration changes. - -You will need to check the startup type and verify that the service is running. - -There are two ways to check the startup type for the service: from the command line or in the services console. - -**Check the startup type from the command line:** - -1. Open an elevated command-line prompt on the endpoint: - - a. Click **Start** and type **cmd**. - - b. Right-click **Command prompt** and select **Run as administrator**. - -2. Enter the following command and press **Enter**. - - ``` - sc qc diagtrack - ``` - -3. If the service is enabled, it will be set to automatically start. The result should look like the following: - - ![Result of the sc query command for diagtrack](images/windefatp-sc-qc-diagtrack.png) - -4. If the **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**: - - ``` - sc config diagtrack start=auto - ``` -5. A success message is displayed. Verify the change by entering the following command and press **Enter**: - - ``` - sc qc diagtrack - ``` - -**Check the startup type in the services console:** - -1. Open the services console: - - a. Click **Start** and type **services**. Press **Enter** to open the console. - -2. Scroll through the list of services until you find **Connected User Experiences and Telemetry**. - -3. Check the **Startup type** column - the service should be set as **Automatic**. - -ASK ALON HOW SET TO AUTOMATIC IF IT'S NOT SET FROM THE CONSOLE. - -**Check that the service is running from the command line** - -1. Open an elevated command-line prompt on the endpoint: - - a. Click **Start** and type **cmd**. - - b. Right-click **Command prompt** and select **Run as administrator**. - -2. Enter the following command and press **Enter**. - - ``` - sc query diagtrack - ``` -3. If the service is running, the result should look like the following: - - ![Result of the sc query command for sc query diagtrack](images/windefatp-sc-query-diagtrack.png) - -4. If the service STATE is not set to RUNNING, then you'll need to enter the following command and press **Enter**: - - ``` - sc start diagtrack - ``` - -5. A success message is displayed. Verify the change by entering the following command and press **Enter**: - - ``` - sc query diagtrack - ``` - -### Ensure that the Windows Defender ATP endpoint has internet connection - -The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to be able to report telemetry and communicate with the Windows Defender ATP service. - -WinHTTP is independent of the Internet browsing proxy settings and other user context applications and must be able to detect the proxy servers that are available in your particular environment. - -To ensure that sensor has service connectivity, follow the steps described in the [Verify client connectivity to Windows Defender ATP service URLs](configure-proxy-internet-windows-defender-advanced-threat-protection.md# -Verify-client-connectivity-to-Windows-Defender-ATP-service-URLs) topic. - -If the verification fails and your environment is using a proxy to connect to the internet, then follow the steps described in [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md#) topic. From 7aa2d47a238e3a435e427c43ad356109b8e12163 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Fri, 6 May 2016 17:51:05 +1000 Subject: [PATCH 155/439] Update other-troubleshooting.md --- windows/keep-secure/other-troubleshooting.md | 115 ------------------- 1 file changed, 115 deletions(-) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index 25ece39fc7..e472ad1366 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -9,118 +9,3 @@ ms.sitesec: library author: mjcaparas --- -# Troubleshoot Windows Defender Advanced Threat Protection onboarding issues two - -**Applies to:** - -- Windows 10 Insider Preview - -[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] - -You might need to troubleshoot the onboarding process if you encounter issues. - -## Endpoints not reporting correctly - -If you have completed the endpoint onboarding process and don't see endpoints in the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md), then this might indicate endpoint onboarding or a connectivity issue that you need to address. - -Go through the following verification topics to address this issue: - -- [Ensure that the endpoint is onboarded successfully](#Ensure-that-the-endpoint-is-onboarded-successfully) -- [Ensure that the Windows Defender ATP service is enabled](#Ensure-that-the-Windows-Defender-ATP-service-is-enabled) -- [Ensure that the telemetry and diagnostics service is enabled](#Ensure-that-the-telemetry-and-diagnostics-service-is-enabled) -- [Ensure that the Windows Defender ATP endpoint has internet connection](#Ensure-that-the-Windows-Defender-ATP-endpoint-has-internet-connection) - -### Ensure that the endpoint is onboarded successfully - - -### Ensure that the Windows Defender ATP service is enabled - - -### Ensure that the telemetry and diagnostics service is enabled - -If the endpoints aren't reporting correctly, you might need to check that the Windows 10 telemetry and diagnostics service is enabled on the endpoint. The service may have been disabled by other programs or user configuration changes. - -You will need to check the startup type and verify that the service is running. - -There are two ways to check the startup type for the service: from the command line or in the services console. - -**Check the startup type from the command line:** - -1. Open an elevated command-line prompt on the endpoint: - - a. Click **Start** and type **cmd**. - - b. Right-click **Command prompt** and select **Run as administrator**. - -2. Enter the following command and press **Enter**. - - ``` - sc qc diagtrack - ``` - -3. If the service is enabled, it will be set to automatically start. The result should look like the following: - - ![Result of the sc query command for diagtrack](images/windefatp-sc-qc-diagtrack.png) - -4. If the **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**: - - ``` - sc config diagtrack start=auto - ``` -5. A success message is displayed. Verify the change by entering the following command and press **Enter**: - - ``` - sc qc diagtrack - ``` - -**Check the startup type in the services console:** - -1. Open the services console: - - a. Click **Start** and type **services**. Press **Enter** to open the console. - -2. Scroll through the list of services until you find **Connected User Experiences and Telemetry**. - -3. Check the **Startup type** column - the service should be set as **Automatic**. - -ASK ALON HOW SET TO AUTOMATIC IF IT'S NOT SET FROM THE CONSOLE. - -**Check that the service is running from the command line** - -1. Open an elevated command-line prompt on the endpoint: - - a. Click **Start** and type **cmd**. - - b. Right-click **Command prompt** and select **Run as administrator**. - -2. Enter the following command and press **Enter**. - - ``` - sc query diagtrack - ``` -3. If the service is running, the result should look like the following: - - ![Result of the sc query command for sc query diagtrack](images/windefatp-sc-query-diagtrack.png) - -4. If the service STATE is not set to RUNNING, then you'll need to enter the following command and press **Enter**: - - ``` - sc start diagtrack - ``` - -5. A success message is displayed. Verify the change by entering the following command and press **Enter**: - - ``` - sc query diagtrack - ``` - -### Ensure that the Windows Defender ATP endpoint has internet connection - -The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to be able to report telemetry and communicate with the Windows Defender ATP service. - -WinHTTP is independent of the Internet browsing proxy settings and other user context applications and must be able to detect the proxy servers that are available in your particular environment. - -To ensure that sensor has service connectivity, follow the steps described in the [Verify client connectivity to Windows Defender ATP service URLs](configure-proxy-internet-windows-defender-advanced-threat-protection.md# -Verify-client-connectivity-to-Windows-Defender-ATP-service-URLs) topic. - -If the verification fails and your environment is using a proxy to connect to the internet, then follow the steps described in [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md#) topic. From 912699e0b88011aa2a8f0ba854d009318d54ef57 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Fri, 6 May 2016 18:06:32 +1000 Subject: [PATCH 156/439] Update other-troubleshooting.md --- windows/keep-secure/other-troubleshooting.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index e472ad1366..a86ac7ff5d 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -8,4 +8,10 @@ ms.mktglfcycl: deploy ms.sitesec: library author: mjcaparas --- +# Troubleshoot Windows Defender Advanced Threat Protection onboarding issues two +**Applies to:** + +- Windows 10 Insider Preview + +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] From f2bda6691ef7731ced380549332708b0d89933c9 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Fri, 6 May 2016 18:13:39 +1000 Subject: [PATCH 157/439] Update other-troubleshooting.md --- windows/keep-secure/other-troubleshooting.md | 91 ++++++++++++++++++++ 1 file changed, 91 insertions(+) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index a86ac7ff5d..94361fd814 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -15,3 +15,94 @@ author: mjcaparas - Windows 10 Insider Preview [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + +You might need to troubleshoot the onboarding process if you encounter issues. + +**Ensure that the telemetry and diagnostics service is enabled** + +If the endpoints aren't reporting correctly, you might need to check that the Windows 10 telemetry and diagnostics service is enabled on the endpoint. The service may have been disabled by other programs or user configuration changes. + +You will need to check the startup type and verify that the service is running. + +There are two ways to check the startup type for the service: from the command line or in the services console. + +**Check the startup type from the command line:** + +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command and press **Enter**. + + ``` + sc qc diagtrack + ``` + +3. If the service is enabled, it will be set to automatically start. The result should look like the following: + + ![Result of the sc query command for diagtrack](images/windefatp-sc-qc-diagtrack.png) + +4. If the **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**: + + ``` + sc config diagtrack start=auto + ``` +5. A success message is displayed. Verify the change by entering the following command and press **Enter**: + + ``` + sc qc diagtrack + ``` + +**Check the startup type in the services console:** + +1. Open the services console: + + a. Click **Start** and type **services**. Press **Enter** to open the console. + +2. Scroll through the list of services until you find **Connected User Experiences and Telemetry**. + +3. Check the **Startup type** column - the service should be set as **Automatic**. + +ASK ALON HOW SET TO AUTOMATIC IF IT'S NOT SET FROM THE CONSOLE. + +**Check that the service is running from the command line** + +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command and press **Enter**. + + ``` + sc query diagtrack + ``` +3. If the service is running, the result should look like the following: + + ![Result of the sc query command for sc query diagtrack](images/windefatp-sc-query-diagtrack.png) + +4. If the service STATE is not set to RUNNING, then you'll need to enter the following command and press **Enter**: + + ``` + sc start diagtrack + ``` + +5. A success message is displayed. Verify the change by entering the following command and press **Enter**: + + ``` + sc query diagtrack + ``` + +## Ensure that the Windows Defender ATP endpoint has internet connection + +The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to be able to report telemetry and communicate with the Windows Defender ATP service. + +WinHTTP is independent of the Internet browsing proxy settings and other user context applications and must be able to detect the proxy servers that are available in your particular environment. + +To ensure that sensor has service connectivity, follow the steps described in the [Verify client connectivity to Windows Defender ATP service URLs](configure-proxy-internet-windows-defender-advanced-threat-protection.md# +Verify-client-connectivity-to-Windows-Defender-ATP-service-URLs) topic. + +If the verification fails and your environment is using a proxy to connect to the internet, then follow the steps described in [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md#) topic. From a6b78527cef9a574d4a6f68ac17eb99504632b1c Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 6 May 2016 18:05:14 +1000 Subject: [PATCH 158/439] add content for Dallas ISD --- ...ows-defender-advanced-threat-protection.md | 27 +++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md index aa3238f1aa..a24b695473 100644 --- a/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md @@ -22,5 +22,32 @@ This section addresses issues that might arise as you use the service. If you encounter a server error when trying to access the service, you’ll need to change your browser cookie settings. Configure your browser to allow cookies. +### No data is shown on the portal +If no data is displayed on the Dashboard portal even if no errors were encountered in the portal logs or in the browser console, you'll need to whitelist TI and DA endpoints and detonation endpoints that also use the this protocol. + +QUESTIONs TO NAMAA: +- what dos TI AND DA stand for +- what are we referring to when we say "this protocol" +thanks, joey + + +Depending on your region, add the following endpoints to the whitelist: + +U.S. region: +- threatintel-cus-prd.cloudapp.net +- threatintel-eus-prd.cloudapp.net +- dataaccess-cus-prd.cloudapp.net +- dataaccess-eus-prd.cloudapp.net +- daasmon-eus-prd.cloudapp.net +- daasmon-cus-prd.cloudapp.net + +EU region: + +- threatintel-neu-prd.cloudapp.net +- threatintel-weu-prd.cloudapp.net +- dataaccess-neu-prd.cloudapp.net +- dataaccess-weu-prd.cloudapp.net + + ### Related topic - [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) From 26a73cfe3bba34a5adf6ff87d2f92a952a001d12 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Fri, 6 May 2016 18:24:34 +1000 Subject: [PATCH 159/439] Update other-troubleshooting.md --- windows/keep-secure/other-troubleshooting.md | 67 -------------------- 1 file changed, 67 deletions(-) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index 94361fd814..c8279f2c7a 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -28,73 +28,6 @@ There are two ways to check the startup type for the service: from the command l **Check the startup type from the command line:** -1. Open an elevated command-line prompt on the endpoint: - - a. Click **Start** and type **cmd**. - - b. Right-click **Command prompt** and select **Run as administrator**. - -2. Enter the following command and press **Enter**. - - ``` - sc qc diagtrack - ``` - -3. If the service is enabled, it will be set to automatically start. The result should look like the following: - - ![Result of the sc query command for diagtrack](images/windefatp-sc-qc-diagtrack.png) - -4. If the **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**: - - ``` - sc config diagtrack start=auto - ``` -5. A success message is displayed. Verify the change by entering the following command and press **Enter**: - - ``` - sc qc diagtrack - ``` - -**Check the startup type in the services console:** - -1. Open the services console: - - a. Click **Start** and type **services**. Press **Enter** to open the console. - -2. Scroll through the list of services until you find **Connected User Experiences and Telemetry**. - -3. Check the **Startup type** column - the service should be set as **Automatic**. - -ASK ALON HOW SET TO AUTOMATIC IF IT'S NOT SET FROM THE CONSOLE. - -**Check that the service is running from the command line** - -1. Open an elevated command-line prompt on the endpoint: - - a. Click **Start** and type **cmd**. - - b. Right-click **Command prompt** and select **Run as administrator**. - -2. Enter the following command and press **Enter**. - - ``` - sc query diagtrack - ``` -3. If the service is running, the result should look like the following: - - ![Result of the sc query command for sc query diagtrack](images/windefatp-sc-query-diagtrack.png) - -4. If the service STATE is not set to RUNNING, then you'll need to enter the following command and press **Enter**: - - ``` - sc start diagtrack - ``` - -5. A success message is displayed. Verify the change by entering the following command and press **Enter**: - - ``` - sc query diagtrack - ``` ## Ensure that the Windows Defender ATP endpoint has internet connection From 8b7c25f64a3e0c9152dad3edcb0051a3a8d61b6a Mon Sep 17 00:00:00 2001 From: jcaparas Date: Fri, 6 May 2016 18:30:57 +1000 Subject: [PATCH 160/439] Update other-troubleshooting.md --- windows/keep-secure/other-troubleshooting.md | 21 -------------------- 1 file changed, 21 deletions(-) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index c8279f2c7a..01ce31fac2 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -18,24 +18,3 @@ author: mjcaparas You might need to troubleshoot the onboarding process if you encounter issues. -**Ensure that the telemetry and diagnostics service is enabled** - -If the endpoints aren't reporting correctly, you might need to check that the Windows 10 telemetry and diagnostics service is enabled on the endpoint. The service may have been disabled by other programs or user configuration changes. - -You will need to check the startup type and verify that the service is running. - -There are two ways to check the startup type for the service: from the command line or in the services console. - -**Check the startup type from the command line:** - - -## Ensure that the Windows Defender ATP endpoint has internet connection - -The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to be able to report telemetry and communicate with the Windows Defender ATP service. - -WinHTTP is independent of the Internet browsing proxy settings and other user context applications and must be able to detect the proxy servers that are available in your particular environment. - -To ensure that sensor has service connectivity, follow the steps described in the [Verify client connectivity to Windows Defender ATP service URLs](configure-proxy-internet-windows-defender-advanced-threat-protection.md# -Verify-client-connectivity-to-Windows-Defender-ATP-service-URLs) topic. - -If the verification fails and your environment is using a proxy to connect to the internet, then follow the steps described in [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md#) topic. From 175296341915047d00a3aedb14994255264e8322 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 6 May 2016 19:04:39 +1000 Subject: [PATCH 161/439] update --- windows/keep-secure/other-troubleshooting.md | 39 ++++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index 01ce31fac2..7d228b5ce2 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -18,3 +18,42 @@ author: mjcaparas You might need to troubleshoot the onboarding process if you encounter issues. +Endpoints not reporting correctly + +If you have completed the endpoint onboarding process and don't see endpoints in the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md), then this might indicate endpoint onboarding or a connectivity issue that you need to address. + + +If the endpoints aren't reporting correctly, you might need to check that the Windows 10 telemetry and diagnostics service is enabled on the endpoint. The service may have been disabled by other programs or user configuration changes. + +You will need to check the startup type and verify that the service is running. + +There are two ways to check the startup type for the service: from the command line or in the services console. + +**Check the startup type from the command line**: + +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command and press **Enter**. + + ``` + sc qc diagtrack + ``` + +3. If the service is enabled, it will be set to automatically start. The result should look like the following: + + ![Result of the sc query command for diagtrack](images/windefatp-sc-qc-diagtrack.png) + +4. If the **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**: + + ``` + sc config diagtrack start=auto + ``` +5. A success message is displayed. Verify the change by entering the following command and press **Enter**: + + ``` + sc qc diagtrack + ``` \ No newline at end of file From 5a92c0dae7ecf39c1c75c8b81067222adb397a24 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Fri, 6 May 2016 15:31:31 -0700 Subject: [PATCH 162/439] removing duplicate file --- ...istory-for-manage-and-update-windows-10.md | 1 + ...-enterprise-and-education-editions-only.md | 19 ------------------- 2 files changed, 1 insertion(+), 19 deletions(-) delete mode 100644 windows/manage/group-policies-for-enterprise-and-education-editions-only.md diff --git a/windows/manage/change-history-for-manage-and-update-windows-10.md b/windows/manage/change-history-for-manage-and-update-windows-10.md index 81182141c2..1dac4c2787 100644 --- a/windows/manage/change-history-for-manage-and-update-windows-10.md +++ b/windows/manage/change-history-for-manage-and-update-windows-10.md @@ -19,6 +19,7 @@ This topic lists new and updated topics in the [Manage and update Windows 10](in | [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) | Corrected script for setting a custom shell using Shell Launcher | | [Configure Windows 10 devices to stop data flow to Microsoft](configure-windows-10-devices-to-stop-data-flow-to-microsoft.md) | Added section on how to turn off Live Tiles | | [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md) | New telemetry content | +| [Group Policies that apply only to Windows 10 Enterprise and Education Editions](group-policies-for-enterprise-and-education-editions.md) | New | ## April 2016 diff --git a/windows/manage/group-policies-for-enterprise-and-education-editions-only.md b/windows/manage/group-policies-for-enterprise-and-education-editions-only.md deleted file mode 100644 index 192ab7d1dc..0000000000 --- a/windows/manage/group-policies-for-enterprise-and-education-editions-only.md +++ /dev/null @@ -1,19 +0,0 @@ ---- -title: Group Policies that apply only to Windows 10 Enterprise and Windows 10 Education (Windows 10) -description: Use this topic to learn about Group Policy objects that apply only to Windows 10 Enterprise and Windows 10 Education. -ms.prod: W10 -ms.mktglfcycl: manage -ms.sitesec: library ---- - -# Group Policies that apply only to Windows 10 Enterprise and Education Editions - -**Applies to** - -- Windows 10 - -In Windows 10, version 1511, the following Group Policies apply only to Windows 10 Enterprise and Windows 10 Education. - -| Policy name | Policy path | Comments | -| - | - | - | -| Turn off the Store application | Computer Configuration > Administrative Templates > Windows Components > Store > Turn off the Store application

User Configuration > Administrative Templates > Windows Components > Store > Turn off the Store | For more info, see [Knowledge Base article# 3135657](https://support.microsoft.com/en-us/kb/3135657). \ No newline at end of file From 687e701d6cf95827ae65edae61c0688b7fcf4212 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 11:47:32 +1000 Subject: [PATCH 163/439] add h2 --- windows/keep-secure/other-troubleshooting.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index 7d228b5ce2..9dff77ee7d 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -18,7 +18,7 @@ author: mjcaparas You might need to troubleshoot the onboarding process if you encounter issues. -Endpoints not reporting correctly +#Endpoints not reporting correctly If you have completed the endpoint onboarding process and don't see endpoints in the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md), then this might indicate endpoint onboarding or a connectivity issue that you need to address. From 84d9f47d9bcc905884729fd5d686e51fdd8b3fbb Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 11:48:09 +1000 Subject: [PATCH 164/439] add h2 --- windows/keep-secure/other-troubleshooting.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index 9dff77ee7d..5df531fbf6 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -18,7 +18,7 @@ author: mjcaparas You might need to troubleshoot the onboarding process if you encounter issues. -#Endpoints not reporting correctly +##Endpoints not reporting correctly If you have completed the endpoint onboarding process and don't see endpoints in the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md), then this might indicate endpoint onboarding or a connectivity issue that you need to address. From 1aa45e320a1bee5b211c2e598d4206681d77ea03 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 12:02:31 +1000 Subject: [PATCH 165/439] add telemetry and diagnostics bit --- windows/keep-secure/other-troubleshooting.md | 54 +++++++++++++++++++- 1 file changed, 53 insertions(+), 1 deletion(-) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index 5df531fbf6..a06c55c880 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -22,7 +22,19 @@ You might need to troubleshoot the onboarding process if you encounter issues. If you have completed the endpoint onboarding process and don't see endpoints in the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md), then this might indicate endpoint onboarding or a connectivity issue that you need to address. +Go through the following verification topics to address the issue: +- Ensure that the endpoint is onboarded successfully +- Ensure that the Windows Defender ATP service is enabled +- Ensure that the telemetry and diagnostics service is enabled +- Ensure that the Windows Defender ATP endpoint has internet connection + + + + + + +**Ensure that telemetry and diagnostics service is enabled** If the endpoints aren't reporting correctly, you might need to check that the Windows 10 telemetry and diagnostics service is enabled on the endpoint. The service may have been disabled by other programs or user configuration changes. You will need to check the startup type and verify that the service is running. @@ -56,4 +68,44 @@ There are two ways to check the startup type for the service: from the command l ``` sc qc diagtrack - ``` \ No newline at end of file + ``` +**Check the startup type in the services console:** + +1. Open the services console: + + a. Click **Start** and type **services**. Press **Enter** to open the console. + +2. Scroll through the list of services until you find **Connected User Experiences and Telemetry**. + +3. Check the **Startup type** column - the service should be set as **Automatic**. + +ASK ALON HOW SET TO AUTOMATIC IF IT'S NOT SET FROM THE CONSOLE. + +**Check that the service is running from the command line** + +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command and press **Enter**. + + ``` + sc query diagtrack + ``` +3. If the service is running, the result should look like the following: + + ![Result of the sc query command for sc query diagtrack](images/windefatp-sc-query-diagtrack.png) + +4. If the service STATE is not set to RUNNING, then you'll need to enter the following command and press **Enter**: + + ``` + sc start diagtrack + ``` + +5. A success message is displayed. Verify the change by entering the following command and press **Enter**: + + ``` + sc query diagtrack + ``` \ No newline at end of file From 7f4315d464abda2166ff41ce5847c1e7616d7333 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 12:07:14 +1000 Subject: [PATCH 166/439] add internet connection --- windows/keep-secure/other-troubleshooting.md | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index a06c55c880..64b2f820bb 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -108,4 +108,16 @@ ASK ALON HOW SET TO AUTOMATIC IF IT'S NOT SET FROM THE CONSOLE. ``` sc query diagtrack - ``` \ No newline at end of file + ``` + +**Ensure that the Windows Defender ATP endpoint has internet connection** + +The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to be able to report telemetry and communicate with the Windows Defender ATP service. + +WinHTTP is independent of the Internet browsing proxy settings and other user context applications and must be able to detect the proxy servers that are available in your particular environment. + +To ensure that sensor has service connectivity, follow the steps described in the [Verify client connectivity to Windows Defender ATP service URLs](configure-proxy-internet-windows-defender-advanced-threat-protection.md# +Verify-client-connectivity-to-Windows-Defender-ATP-service-URLs) topic. + +If the verification fails and your environment is using a proxy to connect to the internet, then follow the steps described in [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md#) topic. + \ No newline at end of file From 5920499d82086dc1cb42c158f0c6103c1587f3e8 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 12:14:25 +1000 Subject: [PATCH 167/439] bold UI font --- windows/keep-secure/other-troubleshooting.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index 64b2f820bb..91775b45fc 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -25,8 +25,8 @@ If you have completed the endpoint onboarding process and don't see endpoints in Go through the following verification topics to address the issue: - Ensure that the endpoint is onboarded successfully - Ensure that the Windows Defender ATP service is enabled -- Ensure that the telemetry and diagnostics service is enabled -- Ensure that the Windows Defender ATP endpoint has internet connection +- Ensure that the telemetry and diagnostics service is enabled [in] +- Ensure that the Windows Defender ATP endpoint has internet connection [in] @@ -98,7 +98,7 @@ ASK ALON HOW SET TO AUTOMATIC IF IT'S NOT SET FROM THE CONSOLE. ![Result of the sc query command for sc query diagtrack](images/windefatp-sc-query-diagtrack.png) -4. If the service STATE is not set to RUNNING, then you'll need to enter the following command and press **Enter**: +4. If the service **STATE** is not set to **RUNNING**, then you'll need to enter the following command and press **Enter**: ``` sc start diagtrack From 6572167077ea7f4437cb2ddf68db9fa0b023fc37 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 14:34:38 +1000 Subject: [PATCH 168/439] add 2 sections --- windows/keep-secure/images/filter-log.png | Bin 0 -> 22646 bytes .../keep-secure/images/onboardingstate.png | Bin 0 -> 154461 bytes .../keep-secure/images/sc-query-diagtrack.png | Bin 0 -> 14668 bytes .../images/sc-query-sense-autostart.png | Bin 0 -> 19663 bytes .../images/sc-query-sense-running.png | Bin 0 -> 13934 bytes windows/keep-secure/images/sc-query-sense.png | Bin 0 -> 13934 bytes windows/keep-secure/other-troubleshooting.md | 122 ++++++++++++++++-- 7 files changed, 109 insertions(+), 13 deletions(-) create mode 100644 windows/keep-secure/images/filter-log.png create mode 100644 windows/keep-secure/images/onboardingstate.png create mode 100644 windows/keep-secure/images/sc-query-diagtrack.png create mode 100644 windows/keep-secure/images/sc-query-sense-autostart.png create mode 100644 windows/keep-secure/images/sc-query-sense-running.png create mode 100644 windows/keep-secure/images/sc-query-sense.png diff --git a/windows/keep-secure/images/filter-log.png b/windows/keep-secure/images/filter-log.png new file mode 100644 index 0000000000000000000000000000000000000000..02817ed992d300a9aefed703e0677b7ec3e52769 GIT binary patch literal 22646 zcmb5WWmsIzwl0c0!Gc@xKxjO;6Wle>xJz(%cbCvWaCg_>1c%`6!6CRioF@79+H3E- z?zzwXLAtwU$*7_47&R+l3UcD8NCZd_5D=)65}%YHAfQOWe>4bC5D<`^7-{3+2apa* z;=&LWqeT1QA26muvO*9L)iKDA`mo^Nh_(_M4iFG;x?lew`)!JhARyF{B|izNxau6G zw?q?(e`^@V|LN+%jEbGr4yEH4*)U`wh`xumRX3%OI_1rC#DGL8h%$~YD6-V&`wlb} z(JMuSuuU&IfF~|3-FbrYa>Mhvi0s0TMB@@FVV`_D4opU+PMFD@)T zHO!fX{x(0i50^n`nF4DSZ2Ii1n|FswsJT06K95+Sgo6}$-lw9_Z+GVxyCICG ztV@`_btf61H9n1oO}%iw&1wqM9KzbL zv2mO6)phv1eGNZu3Z0rzDX<#m=iwuWMM+PMDN$e;d0Zc+h!4HnKRmSL@A#ggiHbT8 zEE`Q-X{sdQ3)q2*`C3gWfzVVe25g{MVt*an-}m_Za6-0=`8?og+!?J{mkjX7dl!`- zIK1GD8nU2H%f8dN=KXLrr>ncx@o64}jWhUmn$xxY`Th&qkuNC}iA~OYvd{BHriuH@ z{VEi86?1JbrVqhvlm>$lerI19zgM%j_paSK>T^fChttg?fu!D*`PJi{1FE;X)05}b zZ=fZ@7km1MM>Y2I%*R?0Zil|j zE3n!xv!se}8GOx3dpvYBwEY=#wPpSDI5>@A^TNZ5EC@w?w)i{DCG`F?9_%*rG@9B$ zgV#S%(gWJwVU?ehkCUxeQ61~d4@*{mO~-vW>j*mfB$xnDty0a3?L&HCw}ry{z{kF` z6t_MiwO7qNVA6rEX2y05X`?3G5rvPvS{A50gAz?49t4(R4f8S5&yF7-^DcZ0?-VC0 zO?e&7R%uBjIaNoNV^F{&s+l=Ge=wg5zsb(9l_?03qhk6Q>ww}KU~xGWIpbv8D)doK zm36bQzwh>J#SE+iU#THdAQvky$u#X{?(|-kGjxG^FRrzi?w66O%p|QEh=qChEqGt{ zj`1+Sgq-*Bu5=nN=EL2}c9an{^p_-SHv>r+OofEeb_b&@Ji392!XuH16!Ul;_iKT> z2t-|d^Qan8uF;)mRw&EOA<=e*=PAp5uBW%_eUXWFR*~{bvSqTchAYVr$d4!bR0TTA zn*Q{M?M8aN{q@YX0x!8oXvMR~Vy(B+Y^*6A&}kuuZ`SbAOxBZWg1f->0yQW(FX47` zoDN$s!&;Fp`HpaNDN)Z{T)dh&sg`lG7fE`GbTT?@@akvv#l@I_rrr=CMbh(DA*&Bv zQ6MQ?6r9bh37>=WRcP+?Lj?YF1&P3~lPcF*IiqA^su4mg8&9o!S)YAW0+s;7lt+39 zN_%JL>tV)@cU4Wr{DlNztlq_!f|hwHi&GBQtb~W4>9bPJpN5WG%McbOWtKI})F@B1 zC2Z%+-ZE&{9})`~Hc=bB6OI_xnFv43MBRbS!sp?L14d`HgIzlPJg?P;J7dCPFXfg= zfzZ7p!2`49DZ9a`^mckF{jv0An8M!XI79bcD%+PiEQgEBjry0<(6p0XaM?QG1(1irA^MP0RZJ6iNxxA3yxzZr|hNuZQ8?jc1ohHRYCc0J;xv7Ble)CWe>A?{QpSC92_ksE#68PRqE$nj5Asv1 z#?+il|CM~V%K+FW>a8O0q+m=UU@vp~MBh$WI=|@^WaT7Gz^X}H840^!?b#Ch*r8#i z>snisa%L|>XgK#mSdG$O$Lubk#tQNyWL0Zo&J6*7h}FHSa5qgcfke>fGl{4@Td@}A zo0!kNjpDJu)#QiTg&=tG7G^6S3BH<)1rj&k(HP;ufWuBG3Ul2P*hf*y=S%A)u)2 z=XJl)Qn-0Px??v{X*h5kiklRfV@NOeruRO2f>3uUv~k3Fy>KfJc1_mUo?FaXwSkm< zmxCh{g#4Y6>r*#8Z*y#-fR1*0y7mBCm^am)LGa$f;o@=a{6IIcSdPF>-21ns88T(Or_?a{BZ@usg27i!fD z`TUia_lp}VipuwZhf*Il9#k&g`3z9|;Ngo>0kYt_bIuQyi;#TI)+h1s(9(v)ka$e; z4$bMHuiMeb`R?$NyUM=G8ef^h(2PBE!@2SXNcE?^`=?vkesagtk#wf=?7;Fj**mBWW0OZLmS?;9q4ZHsnqkz*O{* zoOE-O$>08w;(68kk@7mmW(wXmik&p~MEoqqUo*boUK(wR^et1O25WTm<%V6WI9o{W z8FNFrcz+Mi4vc<(>yy%+OSsPjvFrI=Ijd;{k5+#;rpdv^s;J$<->8 zDn<2(wkB)o`wH$!?Nhz*xCfS5zVF`XKZ@RC^bf5L>?Icx5=|Pk{w}>Wn%}UgKpS7m z_{j6do{BDIThe|0$ja~hS-?o}EFZ=BgMoChMX?ReWy#jwg3hg}(_-A^NYr$&yXBF@ zWR>0nva!CnATa1z({Lnf(%8PXw??*XEw!iIEy)eeMo@ zs?ea)UnIbL`Re6}VnIQCYfV?%7#%0hww_>mPfe_6lLK7I$Q;{9mD^tLlpcYgh%cMo zI$Kc*4(H-+PaPTu4{Rr{9b7-i_VytHoM5tlj^qyB_*52k=~!mJ(-~dt`yAQpJgN3$YxW2-{5*5_g#ksYtuHaF5|AgD2(%MT zW*7keG0!}r!Vma*XKK7Y|I}HEme>vHEWahupB1GkrQ`!U_6gJUIs@Zf|ZMwoBFZl!&?1ZC-9KA4eOrI6>WZs zHS4?K=r)Mr$uZ|eDyC{)S~4*@F3p675Yqz|g*(w{^^1_Z5a}x|uTE#obRby|ETtSn zE#Y((Z-dfWcId&p?}pEl_R#!1CN^x2U=%BTfX8J>>tnZY{eY|Mc_z6^ezV_FxNQ(@ z3&~^ho;_pe5PSA8S^IU?dnc3y+F1;-VncetJ_xXtgY8M`Bzn-(pXgKn z{(0!+-kYAwTh6cw$kL9EWDOpPpb;LpLQrOg^*B7j{A47~2xKXvby!P>1ou9P;-mJ@ z(b0;<<8P_d0#BC-unkH-LF&jR+nVSf37$zR>52=x*Li~3><6OBG=D_n(}GzQzr-8` zZ%8a|W(pZ&`U|$YS=?xDNxG;kxKirh=RO<&~l&bNi zDH*K|*dJ=8^oks9!!N@O6pd!z#QCcqcs2-9Fdf3(sV^MQtM=bo)>!jbD}U}r4kUNx z|FX_ayjFG&v?x8Uu(ce&i+S}H|2T~W)&4B@)2ExYFEVHmv-+aG{fW1C!$`#9##4Hq zi7&t&cWeGLcVDy%#-vR$dsaHRs}`E=1f;VsVNCK_NI(Et zP)ilUc{^q&zc~bLj8Q4%Rzo(dicLNRuW%amKi+P}yxh-qRMnYLFrMgo6u}<4wk$Gw zMBMAzM-h5lX+j+V)VI=v{<-u%hI&C z>n-_WvG=D`5mRTjR2r(S5<+sy4XaRxPt9V2uQbS(Sa`%M9Z_)@={>Ufx^G5 zkE-3PdiL!Qq;}LzsZtppvuTERxVi(Z8k&=*fXE)L5z5u~dG_-O1fJ66%<94JTeO7= z*Mm|TFcMGa+s=}5hc(WRWHZl}i8G}H_=h%h318l>qHaQYOo&j`TvLhph6KNQX*L&> zVD?W)iR9>Yk@%7sp>=*R4+dn)ZwrtRKif3Mc23bq(uEggT)jcb3!hgcN!%PeH^lz| ztg71EHm{!-e3K+(^&FQUb+66^QtH69D}z)+D`>yHtn}-v&K2TL&fyP=%&)B6^l&BHJ`CFty&!Q-s z@4vz}=Lam2Fh|;4=){>@a%NpC!T=$AyI$PGPR{!G#|1k<~pCCak@OawY5?IdN=Y8DQb?nK& zhv7ZT@N!w+Vb!U0HxZ^H*zYQlnY_|!=>GB^)7y(YO1*zR;FG2k3O=Z-pyudKVlmqw z8V|e-*hB2Ks7SE3qz=ul1^X{bZ1qOqp6BO7(6^^9njhnRhdojvOl5AuddUot#)mFLYrGE@J|6b|B2W|wfv#`!YT+0mpj#8N%HE|uQ=E+fC zTl(J)_0_Mo{7$x!qfBsA!L;o1<5To7RK)OW&jAGw#~!bP3%oGqDEXxRaAZ^ z_Y=N)?6OZ%}8{>Yp!XZq(3F>7X+!4JvEN5CZjrz*>EA7X1UQ!^lC| zf&ABOpDi@!$Cv~{o(>_as)j;>4Y_yi+w5ZOU(+`Q~=_?DualXja4;a$Tne z$N66#&0#4UaV&oaHgTMU;adCuYjPziVv#oyPJxP!DEQdmp!82{`um|~;`7`O=c6{u z`2DhHh~O|;&C}+}kGK}i(`F`Cy7x0K3GLJ*vn(zswW;ZH-v95_|AjIqh!@r$%I++IV<5k_COz099$RCw?y}MS9*bwkr+t9v1h_v z=#$X6kuP*22>W?-cyklzkB=8)I<#cU`qTc|TLbfZm|!R}OnG{mv;m*e@k{r~e0w;0 zSi`Pqsl~YCc7q27{0}lKgGud4M%ASm#ak47!Zw&q&{iS#*ti7uGHygrJCZA6oFEq+ z8KN@NRugzWkfp#fEglQ|dpu$HaeBNMbo+S6pVMIOsJ^x^VRYTro&;VNKFkba!=e8) zV82li0BL%2@$_<}$37FuFkPg0mdSfdxUm32DR(Xi11ZO*qI?>8C5e&N9KGfgFW`}( zz6fv$6^!V<+evcKn`)s}M5&?IwqgvaL@9KX+DI4j;ztYq9 zGj(Q(ezCTewUQ4aqHsTWc#>}V$RgJ`zwJzn($&9AKr6Fs)MzACj0InYDK;ch`XHl_ zkQp%kg@wfuF@Q2?Ps=`Z+vNCKZ{ZWun$OD=SXTxDVxm3>$p;2@^&Fav!#a_86z{R!@(Fpf7;M5NKl!Ck-taWhlCZ8 zKzkLnAXxbVra1RWL+fdtjLv0bna=zxX%L*9B%mUCwHUUCYMLtAlF8<;Y9;eDnUEj8 z?~7G%lKJLqWzHPPxi1XPdDp%jo{G{fnM78}5YVar&?tLAwyDSMe+Nc!vUI^T2tj&m z=oJ+P=m!+scXJN4Fj#8(Gs17we2rrJN!csG}tUiUInkG z+4ToDJ?;v;Tvht$hgE6H$5##}-`<|(y8O(tr23N~SIrk1L;k38T?Av86I}zhm;0xs zq#I11m&Jz8L&g)>FdxqdUwjVg6YhBJR7_{P6~uJMo5%0s{9f+QkM~o*XG#;rS>2u= z-ST@@2(@$APj@QvM>+V^F5yNzqk-F*yJLzzmJQ{-KL-jS<>NgwR4fhO%*~!N+_UkM z5qn^J->!!+Bkh1oU_sljHDWNnjHUvU10+MyZufj*uhTs`(e1!3);j|lI|#(;fs@W# zke9)2c_lpB z2Dw!*&7w9L6eYjwmDJ-t3esBC4&@7v5ot2?sMMW4R_5fw(1L6-L?j z(7gQnIeu7=uHj*!Kvh;)#r9^uqd=qRQ)0G8$M#6xN0!Fp4jmGJ#Q*k9+c2^EeM+Tn z@e=LtGq)8GQy(Of3=MM@v^F6%7luOm0E7z~^hY2aQv}@F@`|>H`dkFL8rs(763GYkZtNmh8SJ*$ViQzFga_W_}wZ;ZeI?MRO+@@?zlw>a-7xJ)ASl|Yx~Nbw+UVc zbsX0BMc^{_y~leXrl#6;!8<)Gx1e}@YZyM6X|VdGA%>Cf<^f$@(R6m>%F4 z%>w^6SdgOt9y~Ad;2t~G~F)b9ev7(fvV^VbtQq!jn#xb zWl#wvO^J7N+@u|=*Vucqw8N!Sr5|RMs@8zZ#Yq$BPl{~bza)9&ir8k@OYG*d6Jmu3 z83)2GTHXYj^ennFCF?nI+$q6*Zd&*xz9@WnucWf3VUV68+A!Ip38J zq1TI8ryW?QEEUMm$oGa#^>biU2~t6^>z(Eose1PO_sMMh%)c?k%4Lwg5@;EfEg>;DJ{uypqN$;=ae+7#E`63G;EO1Y$2`UAB*wBBFRaW z^@Hd%os2Y9pxL}9+tfL-^LP%dm3atG^{CPQmFrnvRvd!Z`x9>br{*Nen8(`KX*>vK z?2p5fa){sLP~-v)`6x@}VuSKo7+j>&s?fw|uY)B;icXrvSZdP=ctid|A->m;`may` zj{53L2n)V89Z$0%ig3y}KM&7^Uc8#Lz1q{#zu-Z3DYG=CY3INJ*c`A@a0)*pUl_?` zX0CZZxB9CPz(Thrn^jfiT`Xb8qx*g<3)T0p-aEQGynxQ}3mNuYkDCxi3y3=$(pV8j zLG}0Jjophjar#go{WhMrAy6pZUym|i##gI^g9ZQ9)NRB4yV$X6nE4}Fl0)?n7SO=R zgbz=U$z7P19&GGalz6JUGeGII$bz7o^fgw+)XvNCLB*T`+c0++n&frE5V zny-1VKN+E(f1Erj>`!l|E+QhNU`HlyGzZ(;V#GYTpf~IYFH=iLO{; zCWfwQzZQfa3s`Sa_TOPg5)HugktaWibj7}rVTw|RBNfA!`NTBKF3jEymLe7g3fY6- zKhXEDyyfo)i)&Ak^a4#=AMKc1My&+y9vJUapNUdp>dS?PQyBpYttByOoDVoZ?a9Ve z`q0$&lh8NipYJ1{+hG!Jc7}zSigPX#L1^dx0_{uZJ)FIB^cqX##5V0;adn{L5?WW4 zbWuJ?L4y)b8hAhcM{)8}QWTE1^F<0UG+><78`8R`mv?4x9`r4W4Zsm8G2PoHYa3jP z_iRkoWv7&ieSoEJMwm!>&cn(jR$ubfImEOc8+$6TzoT3Du7l%nIn3m~e!G4x^rKYs zyIwHoIYnM(+=R4g&2(kYyGD>O*_M!&v^s|FM=l02_cs*XQfIC-6Qw+CPCxvs8e&vLL_ zCSyqazjusll967$G58KRe>O0o<+^+ux$MIwZEbp7@URbo6pSL)t~YApz4?^5BJSyv z==Py{LWC)1Cj3b4Wucdk&An27g7O*-oe5Ut`V$&jE%6iY&rQ`+rbNvrFIq8){u=Gh z8AT=|#z+;W0C1keg7Rv}ul({u4)%H6)ZHP4?G||6em?s`6SyT@j~Z z0TB4M)#GMVWN=rRBC*NqbYen&K9QbEt?{fo?v66E_e*6;EHq?&vfgVVmO_;;3%CxN zzL5UTEPKAk5wQKCBq?dPAo{YUrvOqp$>h|sditn*I?$J(%wHJrO;*!jjbkT-dT`wr zNRSUTTht5S4s{YN6lv7}e9Nx>N{>YqSfX~E_Ack*LK9H|uw^SqH_@#!pgg<_|76y- zl)ik;*arnJN8x9z!Xj%BhKsoD) z4b0=^+K?Hgfp_-bTV?fOk3_F|QxX)bRfHpKPdj}MKHPnnSU`8p50nWl0X|zH6ydN) z2HyZwkW=WaEZlA**3RE+jkcGmb7uhuR5VI)5Cs8eLP?Cj}8nTy@o3siaUdjDor6#E>}8&SF>h=`&^4Vi4p z&w`9HX?@1v55d~SL9rCQSL2^l0VHHwl-WRp!65K+-2d9&YlAV8h1=OiFT5~&FW5mX zl^VO%PM~T>EG&y?iqywio$7yuoDr5I2KzCTB2Yg6qEo=0unkp47)j5qBkSkf0qAUU zr|)=M{F^F(+6WIcr&Cv_t34s%SD%~)%&^`nX7Ca;=I@AuxI8rqi#M%6^Y9~gdY1zv zsT@5uUB@{t#xi&WClmF)Xt^kG3K4vaVdGlQs;C1ZI;>Lx$<{sVf?V-$n0u$Qy@nSS z5+%egZ5icubcmwdQh(XY0BTy3N6qi2pV@a~g9vKY7D|NcOKa(wK4zfV(p%QU3t zQP1|SM1da32_+|--5+@DRc^O;P;+RjR3BQc&aY!k)E!3)(eDOr{{=J_Tr|NinOM;#+BxLj zc=U1aRx{sw3Z=96x*s8C{32v{0R}Z_kJOdbF|KF=#v~w)zJ6_xrQp(|@hA%OZinTg zOn+;=f+iWn`!=kvLL&U@U|00h~SZ zLGINe&V#=1^^mH}(|(!Gd6?o4OAxNNgm$h8`8IF^h-ZzKP9MTxm?r1ge{d}AbG><{ zabcVwUs+gd)H}>^qfY$YG|_L4;(;zJE;G?klh!lIp4a~J>`?}Fm8wF=1G7|}yhe{Z z>CNG0)u5yijwKg~BP!&fSAn}?QOzasEpI7DZYkC8s>lV9vHHPDc7!+%;dSZv!HO-w zH)vvreGFn%lCXK3)Yt*2>EXce{%Oj0*4eUvBK*=&CCH2{K@k7*4!7WNy{ek_rv&&N z_la^Gje0c=yTyjDUh%wb@J7xb-XKY^&JU7UY?w{wcG; zNs*!Mg)6ka8F7nWyd;%Oi+6UZanxV!wiPZ5)l8MYn_V_sd) zf3($C<4vM1+O}M&TohTar*VbiLT&bVd_QvzK8sNSIQRFzyG6p}6;cP;)J%Hdc#J>r zGuQYG@#$>eP8&4xvX_Y3!~y3gk25AA+qCF+QlOXS;(j6e7xfcy^W~LFEa*c9(zrP z%sA!eZ{^XyO&jzZmZY37b}MCWRTs+UFj-g~ObFK~ztWvN9Uos}EZBMtBmb^Y$R&m} z1PI2T|3sw!_S^s7Fsx>A*YWbu@p51Ja_@r#73%(D-_FP9=pwwyuSx?;i0KWo8b)t3_*@Lv_Vv9AhbZ7LrK|*(KmD^xTwe&n z-O9ti``k5Dfy)@{#@9(V5^gQ&fi+?sE9v=%5&)ZwwYKWL-!oUGGld7cb2ua0BP-xz ze-bslDj!8c!KWyvoa7J|SB7QDFNt{z%{XP}cMd(LD z=+hy_9-b)P&K>x5#m9ERKOl6-*b7CwLJ_do=*XGsg)P#+&@QmFx@5&M)II)LwgA+^ zb8@@u;?f3}sJ~gj=B}oMTIT}jR-=%;#Ivqh_pZ*=2QV;A{1(luIQwS4@V-YG_S-JYUnGW5Wt5 zB%?c*@`cUvGs9@>HJNw+81VGrLyZaoV+F^GAi$u05cB+NERm{OBzf1+^^T!MS4K>- zSDwY-CWV{~?>vN(A5pSZsli0V>}V8uFh z??}4TN7P75z;3(5#alx;2Z2WaYLc&Ul$sX7IouAkN~(6N2B_WP=m_Ok5Hg~gmf8fp z1cvH!ga;UNFe&6Jc%LiLXQy+v6&5ePaOu?d*$7?&xC6E5eihBwW9GFvAzAYFz;6vi z_eg9_PqV`uMFj!MQDRB~-XY+Z6a%V6zDc{C@y~5A~;a zpaH&28+`o#G8jV`MS1kcilHNGh~d1G3qW`Gn&$Obgfo4>&4{hz+;=g6E$t#5Jh+nz z0ClW!AWGkWmc*`l>FQ{8E6IIKomM`0_3?V$I^H8TB*bDtK%qAT=fB3*1AmV-2DV&8 zh-(d5gh>)8%r1ALxbv^&EC}9*M*NlqnMB^OXcpg%DBt8Vsti9f*So?~Mydd~#0?r` zGHfv3C2wKiI`NE6>8T!=-WCkG>O14`lgLsDgF3Q*UB31{;`9uVxduhFI_gN;wy@uQEq zi$PjhI6f8rke;_v)hT&%@mFdOktD3PP)dunBU}wzHO;wg$yMNOd zn2OUr>Dp6WUtC-?U&-MWK076HLfxlb!f|VLr0*$TwZEu66>8Wg!3zNcuqug67>23B zk_vaF@D28Mz&HNSMCK(`hDTp4z7*Dv^8S$0G`6ysu%gZAS*3|0#Ea6j_U2EmG{dVG ztVS3NXv(~-cCFvkJs{M^(G~tkA#B$?i$R?TQErtDk}ZL%CSf(esHHlhch=x;-xk_t z;xK%!7M!e-veW+E!Xm8vrJgnlR{s>W!%Eezs2X7gpW3eN7VDv{yDvwS} zT2VnpA1MGTDGgfJUV_xe{6iZyzy%9YqZ%$4J$brCU-W`@dxbW$s**)$LBE)4r= zdzsLs=ieunv{-+SP5UMthdtv=dzaDWIdO~=jByizowha* zNcm9eqq^-*xljm-1z6Fb#8WE1ts|(TY9@c1urC#cJsXjGn$wavc+*k`5N)(XR((>hFACS|E)`mi3h?o_Q&f{~?)GBs&cHC>G%tDnK#lme zzSqpS5PL)|eneb}CA@qDL4}=8gL-7vcv%{#;!arx>&iI`8oRdOqIO(EB%wJ7Rqg{? z9=-|i2%4}1g264}D>7Ng1`=pHWOT^Iu*@-SL3X15dbcEEOn0;_RC~aKT4>d~-jP<{ z!)n5o#mR_%S*LCh>c`FL(7g~QE*B3uontDE+yX2K`R=Z^i_2iyaiAm*Z}n9jgO>j7 z-5DcjyOw*OH|+&bkIC04!y_|Rh|4j1qs|ka`!!?ZwKCV#sv%{Vv1OzXxvKJ&A*bQ8 zfp*_na@*UW+_bSl?2CL8iQY(q((I@~Adt%c2uHH|F$lvrALs>sKWKH_-U_kiEzfuL zD2u$TCK&p1Br6>HNMn>DE}>zmm%W*#DWfm-^Hdl|T$&(8S{w_>N{K%5EPKS7_o_x8 z=!7!6aujL43R6iZ1L&0X+yLADl0nV%YQRrUVT#3SWPu|Uv-T!bVHQE=#esPBBS~-` z&@gdOzPwrQh))R6oT#NsX>b^kxK-gHD) zdvvqLnI}1RjC`H*o{H->)j<#hMv;n!cq-+mL5kxneq5Xy-hLyG5gRH1vEZmyXG=AATN6#M(8KAjytq|~*+1o!@4B}q^dzk9Y9GxO;^%4UI?Kc0+D4q|RIXYyCTu%($xYiPL zOR)JKSVBquES^Al|E`xbFWjWwQ-`cvy?1x4Xh38u`Aq+-kjoCm1)y=4m2lYk5ax%v z%_-p66DdYtvc^(PdLYcAx~JJdb*t!aPeVSNuw6V`SnT@baP%Lx98=#lk?ON#PRV-R zB4)CL&ZLc4z&T+S&jm*2Hdg#=n%K;$3^2O?)5tm_ToCi8i8KlfXz^azAp{6Kg#TZe z`S*^Fmv6CAuLo@4-VLe|?aew8y5&}fNBOx55g`c0es&KcJRYhMO70FGM(MzB(pC^N z!rYxrUUNVEX2_8w+w({|*w2b@e}B&su2E{H_u=F7G!{CS(E9Kdx0l0{RwxT70bhU< zLrJ6pxOanl(BXmO3vMUM?HwcNiQ#y=5UynMnJTpU8S@NSf~|PTqCVC8zQ?wGzhutQCq#emiY1KY;U^d6QcRz1GV4bcH~Kq)!$7QR+8%Ki$DIkA&dpw7OQi z)Gr5W23)PKZx_OS; z#saf&6C=VPbG^yXisRU)NXOse;{xNeQz)gf5PEL z&XOrs&#N^`Z_C9ae&}q>j8+tf-UTjxtfY99Q1R+y@@93Qg(Q@0uTL7=dbj)_g-R_k zzWN2pV)w^7xei);wZtFaeSpCt9p|V&9BeGJHciqGto-!0ahE(y4Lo&8Zz8n0_Gk|= zcH+A-92Tp;!bH20vTi)@JS-o+zOB)6%_1%dvJCh`oN3W^F>l?KvsW@sE&ib`SJmjHvi^oAucTH8gDjx= ztt!1LjkKaJ8D^L>PlZ^0TBh#e3PU1~?&y)&;7oa+yP}G4LExX6ZY}}!Hrq3SWGSV6 z3UphF^`UMRA3f>u?6&J524e>XIBsV73C3z7sX;wZNDAA&3J)+Du* znv3b*vZwPa4j@*unr~;V>aw&gIUL++Ff%Tk;Z|{Q4BwXh=fw zhv#X9AQa0$d}|9DzTudd5yx1Pu!Ud20ps&@C^uQ4+ktSRFuqV$g%Qg5)5jc0*=D|^ zM_aCJOj*ouZvARg^8x0KKi)f_*tqcU7k!5UR0{8(d1dNj_y0O}no=Bl;s5PL|8Hdh zqr=vD#`aliaOKvS$zR|QY~e&4uN8x>;%&ua8-bSl)Ai@y6S9P0i`b+V0mR_mkmLXd zBx`j5F~x$P0N?|Iz|mz(P)hLJYY!9XHGB4!s!+I3G6k9S;9_*sphCp^9LH6IiHL_% zRy;;Ie=JP@|&ZkCgW zBOH2=9VQG2jJ5v%j;nurNHBo!g&1b~w5#>530C8JCW05E#EsM=RcHwT7nD(FgzICq z+>4D1Y@%Da6OuL(*EG^Z8S4iQ=uB%57w1|Xmp?DS%m~}>XM_4nPiGB$M5^24>f!G! zn1!yvmE{&w!g@gl>j4T~fT=1m&dE~dK63BW&8bgQ2)H!WQWygC%)2kDr>NFBHfCK@ za$9Ss&$UK|1c$wwOQm7ZRw?YBc|=;H%4#DiNcg8%eXJJ~upT9%vIemv2<+1T(E7{k z`3?wv=iH;~4=MjTe)yl+(w`fSNv~%XqnSm$YXCU}vOpBbHe|BE*!64|vOshe-b;o+ zbm8ET)gW}?fzz@p2DGGmB#6yN=PNfSkBS$IcvyC^-}Vh<#T-i<8R){)qb)8cuV)wf z`*!&g>NNc=bt6BR%>z<^k3-u5;?6RL7kk}A!rP{<--R#6s|H5yHa6y~VhImScTLaj zN$7ow7YC{zXophh1doE5ah~-b_%q&uE{uRra>MYvk0cCU7vXiYfhcHyIck2zAP|FR zLk{L{_2jnpV_{01{+pd&x7Or==#xF}C+9XV*ETqKh=$1v``~eTsi>{e`>5Kw&&F47 zS4oUly0SH$Z(hX`dsds`V(vi3Y#w4=z+KCTTg%w)aV`yQNQdp_V)JK1uQYOyCY{8Q%)hXgys;JJ@a;iuT&UgE2w!e`TB#4?>7KUj)f?BvPj z+9n-vok)JGg1qe$=3jSU6k_>H`;CmTNl21}k1pcGv|DFa4^goT?cRauD`)ajb8i^n z{a$sedGLzCP@UkFU>5ILkECk9U<_e|1)5{L``B&m!!h)m&)>*$(b2EisPWPyk2h#pDX2J9UR zmu<063m3obUpYz?h;_jr&*9*sXmnmOsF$|3{8p4ZN_5}7AhU%56sb zFlj+QH~$qCd_5UWYNRF92BRPSS#?@dOFMZDWe|MiBhTQ0^$9ATqQLwY$u_TOi9&eJ z#MfzA1TF^f8BAd%_(10PcytpfhlzY}GvS)yiB?NaIQPu8$TexYkn#=X6-jYp)z(AA z4*@)@yMsPTttOnH=b%_a>igtoUFJRQ%d+k;oxBOxuU}iGxp$E#I_fy#&P1c;#tAMO zRg{Jl)Dg+BAms9oKcl!Og(-8n>?0FFjWHvT5rX+>$9~1&j2~f25EzS^?UKT&nE_Vw z0h93-86rm}Fz;Y8gW+KRucCOh1-(}xyjlZ_R%ch+urK4IMVZC$z4$dhi!cHg+%KrU z9qpkLFIYmU*O$%Z}w8=cTkXB z-f+P(MT)x~LrEtul(M#yhnW}SSzkhQ&1*?kVjsmu9(t5Z<1F7l8dkQ(HKR^J=)ys^wd}4q#Xuuq^ zD3l>pP^W^zVL>ZfPPJQERDHZ|mS$&3{`^|V2j4gOlxj+p;!j9}Z_eBx`xITT(=Zx` zxlg_SiA32_98bsPn;T!MjokVtdf%%)9Bf&;_=d!WI!C1ge75;yprzM7p(9VO-L8t+ z8rPthW>NORkcT0DV?}dY=aeFNgY)XpnCb3aSC;Ku5T(Knmc`}W;a2AR=~iD*=Ab2;fKC_-81uGkut#;rL^f7t zY|mHP*#jhB7W>fS9BGvtT?}Mu*j1z@1ehZCwZ(+MTT`l#=@FZAOdEypHZHRRnX?UP zDgC6+BBKH{Wt6k`?>01XmvJw&fBdrmcJ5rohiH6f(Pb{;x|6h_)wsSSO|1p+X`FFh0M(jdw3xO8=xTmOzomH-XbPUE+FC0A{;a>I`Fj7Oo7Tjrfd?1c^# zmJTWaSp`epDl;(hW$;fh+JZS9{LtvKb&+l zav&|OmUet@^5Tx3Z>0w@iK}(Vq|X5JlfT&SUUd#_KGdsV&^PHJ0*iEgT?NoF-(73js&DjeNy!(&N^Ix3& zYq9_D;`r6Mx($9y^y%c~`Q-IxXG~0tIyp*2VcgVa2KuDr&a}Jj_-KGz(#u`ui$=Lx zMm@@*#FeM&YR7dteXIA$taI$k_EHQ983nx8J@~e#M_?@N#?-Qy=i@DgbfwvHR(i-8 z1E=^M_+8mB-j1j1r52W|&S;gbvt=qJo48G`=-w8TTlToVlITq?jrtjA)O-^f}7PAqiPsgT8b=;2TOYE zhyj)mH^soCv6;1Gb4!4vp{N0iEa-ghA`5Q!ex?*JdK;@ul^LBd4K5xoWXND@v*aTn zx%7y(M4E2e(g0u|!b>}lStci8VY?hp*`p_C*R^DjZ6Tr;Ua#HZj>W+>t+WC)h~uFE z)ca~kMo>aa7gjnqy~xk_*(^91ut=P|wx`WKKilF<>hoB=>4KZ*-cD!VfbpISTJrs} zIOQ4shMonih!^-y8gYtCwWLpVvbd=)Z=%er|1K%{O7JIe8m<&J9hjFnnT=zFxzO%V z^*GUmVhP2Q$x+L(Xna*}!%Pnrjt23XQ_UbrvnJpo^u|V)HJ}XQSe7sierB0n!m@Aw zKDD6nql@w`q67f6$j)~Dm=9pajHs*x6_z&5523!V1j>MP=nhKh2+F4CqLY;?DFcT; zTzw;S0FD=bZbD<~ooI1n@^xW`YcVa`ucPYKl7N+0?inT;{~j6gW19%VQEIRSA{{wi z!dNWUEuWVoFCpmdwMHTPK@e9ZvwVL1If0Z!ijjNLqJfv>LLU-Ut?>-7q_1vda?!RN zeVvDBDdacGph5$JjSg(;bUywh2+uge2u1U&vKA1FeNLjGlRR4x6Le26|E)_x4I{wr z$=m`1BxS)^5cn1JP^G4;pxTyPL4ajS3 za}&nFaPzzLN+ljBVKrzq$P%_~I4|1;gNcLPJ&7GW6uAv~0qKH)-xnd}{Y1-_$O#w? zHu$dw#lG3oCgQ+|k3u6Bmf)!X*#$UH{z19_18e;+chTwBhTL%?th8mv0v?p2e9$Gt zgSMl6edUE~FOwzjCeA`;b^3oAx$<}@*Y;mRWEX=$c211R&QvPC& zkR*eq!C0eY?AzGF7-WkqF$N*aSUSp^!bDcOIT|GX5ypVv`bi=RB zNYUHZXGl_qI5%H-Ua?Xc)g>-)j!OGV9^U*Ggz#2Zgg^cY?@2>9@xYoVb+&fkBZRjl zo%&rhT&l3hPNr+hPA0mRA~Z$yQw1~%zULqncYntUn0IgXOROhN+v#kD>7{Vnss;4| zR5Gtksxj@ThmI-{$sW{OM=v;wzSw+dZU>I3t2C!m_p$k6oSYkyZ7!p{jC6tYv0x7s zxqmWDsIp+4A~0@{(Eyb?e5jgwV`>%~jWIIPwOn4c#36-OcHoKjhrLlLW6q!ArISk) z%PiHBOW>Oh?*)TuNqbk2VM1!xfK?;hN)e`fYsOiA<9kXVN1ezGkxD92SP70YG@zV_6AS(F380;M8Fe_9y0&JF1SYPVf`b4ZB~Qgkj!%Zf@Ijm8JND9^L5 z=Is_S|1hEcFC+hbO!%3Vi@m16+JC#Q-t+y{*_SV+yIyL2gtG;YDOTz|(1Mmk4K+$y z8tL4i1}dj3_w^C0u1{*Y-45n9^;!);zqx{csHM0WUYV`lvO@L;POjk)z8^A#^_St_ z(=&jtScPUBSu47lD#yTMmy4mdn~DR}@AzZX@qLGmpcFM%iXF@i!s9qq$r#K*^PPjl zQ{F6<3Pw;z`|?HtvM`fQqkhb1Jp!pbO}|Ap_49GgYwmK}MyZxYk}AYgI%1N|?{Icv zC{PzmoMh5GJLX#LL!(6!U+$aSHg~xIWp7bw6^#9uV6o4nH(5tI@jPuV-BNkt+?|q* zQ~j=*OXj}ETF8FN%17L@8>WeFMJs-!={-H-=3!w)hGWK^Q6!(U@u&5@eAQ(|9i1)F zNSQ^5c8#AxD@%MIMSx=4UL~U#E_u$kN5YR}&To^0iHmn@FwOPu-}}n^dSj|1!uugB zZ1mRPT9_XRrRq{~K(;moWk7Kjg%mkuV%&99%f0=Xy9Vk6^F-WrX3}Epo*3q_OmVHf zGU{HWEAcRBqp~8jvxiG6u~L#r#8QGLdRJY_D4s5p42!+6udRj6z6$xTY2$*6WR=HIJ%aaSI2!WrDxjO*{_}FVkai zrDiPmhRk}8jx^&==N;l8k=)UWPe)9R)urtxx}~if9LRNS@gL}Up+L}J)xJ;+^%xac zcv~~ZAy2GN4_Hj_Teh-Py4r!7j5Z~l)M{tl0&!O9Rqja0#1~ns&zgQ|Q z7TOe*P1il#BjoSD9_a70UnW{C+e4UmEIoT7zq|c5an)ZfTWq&3#Yc3In1fZv69*}; za&zdo_be0l8kS%A^M#rrk>`bCf+;56Fha7jND|>g)`;p1 z`X+(mYGB}(U?d%c%(HjM;?n2+9utN;M~thXXD$Q~iV2Tm{L09&@+Qujn(Xs4gR}e& z;V|5-f@Dg5bE7FNGe$1QneU>jlMG5Fcd=tmF!`fDm6-SDO(gUlf|MO*)9xrs*4n!B%LBbCLuP9Qf!o|Jsk$P!k^35=WjDJDU-Bh1z`H0_=2ou8PRzw^()pbw1g^G%2< zt@c(#u1MW1vR(FdgxZyiLq|s}lpV|=ekOswa*J8qYFeE1`iI`S2@JY$?|zSYC{psg zQ%vH5rd+04sWQ{xg0wY8vOpyr;=gzQ$q-dR7KnCi+HA)Pt^L*2tFh8h4G}vCu93WW zdQL~eaAMiIExYH1qpvTFU#)X;Vb~=SRSQwhP+-}PT+l#1ucMEm@#Pd%7oOyHHfVs8 z39^AtGu%MVY)rO@R5_HEAzZmA?-HA}qi@v9fhdK(>)di->?i z1?Uz)l>-+2fX3rB2R@9OiQ3x%NIfN!TU))oTU(PUq9<V>JfKZv(J4#JE*l5+-`Vk-@SXqoLVyRV{7eFEuKHaG*mM4_P;8ep zk+qv)&fN5==am{|7E`CihorV%m*(ba_&B7?2 zF>SJ>^6Pg?fqIBCC_)8u0E69?l9&Mn1xTOR5NzA?+B;b z`dhO}-E}j$qFGD|5n)-HuW0!;Ars9@NU*LK-Po8nfl+hy^lD``;Juv}Z)`0*2-<$( za=v%&7$~4siKJb;3GCSm0aK>qi1n!0YIHHz5Ytkuwz)s3E1*d8u;^%(L zp<-$0K81cX%q{!nuS3F^^GNM7aHQZ(VQ+rPGqjbh7b3Ho5FjaC3=4Vmi+jExY8P4Mox@T+p7_h2ZhgGnjg9&D zXq2W|w#-S6e+s7#`Dor{th@!)YvLJ7Q+x((D%S`h;s_zF$K5r%Atx%IuE@t^c~! zA!4cLUTEqU4w)p8nGQuLEnNRmGsQh~Sy}QUTuW8)=iU;+$JYt;agWR1K z9TULs#+kxWjm?uN^=WMe%x#`Wir#h{xyFC@0X<3JeitpS29D&;(dLGnF+uE*pPe_W|nBf+Q$V{?Kl9*Q0JCXC$nu#-As4@>`@FO~kvb z10B(mEltNywqP3=z?qG`=|&!sC^B80SKkWMh&L4!7IB?-oXG1!$fk=~OfXT0{UM{R!TX++-~kwh>$G%&req7fpWequ6vxR9Hb;k|GA0~YbK z_5>FnrHB0%Z(kcJtjFc>qH?6|nqRIDo$ol6=gw~XLC8p-aYCR->oB^<#jSJ6lMQi6 zei?gFzhu5g!JxeXhws~TnBn^u(xULq9u<D7lq39^g{il~Ef&9x-P2jw^_uLa|n3!9Xe)k{k9YFeWv!HSW< zposy0DpiHR4IZeaNI#a#s76QfPW3w0TuZ&%OE9QRjYv83VT6J0s1TdeO!B*NN%?}x z8Jt!Q=KhQFP!1u4 zoRsiI!#OmC-cl2us^P@Gz&X;}=)U0}n8cjabg$O_g}OY$_zAP7?1y^xXU3PMPjk-+ zu_F-jtJoM%3ZglI^}BnG{5C0gO?oTjTGWWhQ^Tz7!*gJoQG!mb ze$4L8_qeGDqU0qRy}})qY7sn-4Yuy5*cVy#bT&esQ|CT!`w(N)R3o#d|1 zP<0C)_JS>H^(JdQqR-}CL`g__=76!ScG`4WKmn0o71|3Yo!B1QOtFP_iF< z77dsO48nhGiTs0w^@r722bADK68UU(y-zDo{)k;wg4^(*A1Q>V(h~OF4`=Fj zJ5kO7eT@53VRDQe-1zv&lk|^Vpo%L-*xQ7wC$?3~%1#?i-Je4|cq0%~jl&U=CRjo4 zMab^Fhu`tFg^39S5HTC@`P+c| z>2tGFk>Wq*H+~>2_2~Z_Uw`(6{wD~>cDqYfL_ovsQ&&~DIZ2l-LT zGjun+|EJ3bQtF@jrd0>Qqe1MyM{xKyrNNu;Tn8883Ug-cNef)eiG>)IF744xK3N+!6j)}J1GP#j(S=bhM^1Il4Baf+pBl=*2$)%Ld<5gMnl#|D$?gM| z1tTHR=TOGLQgak#WB}z39L4f)X$K z=UJXTxFHKdGDyh-A?;RigJdiI8=ODE2eh643Ulym-rv6OQ{&QKROV7r0nQ5EV`gM! JSg!9D^?xP8)LZ}n literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/onboardingstate.png b/windows/keep-secure/images/onboardingstate.png new file mode 100644 index 0000000000000000000000000000000000000000..0606e2b2c63e947cc5dd18670e99a16d35a69249 GIT binary patch literal 154461 zcmXt9V|ZNQ)}5G*Z8Wy+RIzQ_&cuz~*lui0jK)qH+qRv2(|hmtJTpJeoYz}x@AXc& zg50-Hhy;iL0N~S)?~+OY05lN*04WL&2>?LM8~t?xzkqO7`X&yjnjks?KR}y{$%+90 zwXsOAhA`k~1c&dM&Hw;P@4qj^pnZu60Ps=tLsCq|L+|v>U4dva{Q$|D$H@4hE4taf zFPdlF`(j|?bUlsFd18@c@YQ8vQou73`77R5RvffA?B`to`De7RcnCieF6BJ7Iv%P5 z&IdScEiO7rdCJRYIj6{e66EC2CS{L|NR=_%4BMNks_h4C_`2c+oFW^Tosyxv-fyDc zc18WDIX}n~YYg`c4-ZeRH0NijowvZe{^D;PsqM9B!)=Gp4poQgpH>?LNOOENwVKc{ zH8Q*5T(q;kh#0n3I(n#um8RTYZ!k4G0>v#~|4AH6Pw(NAEEt-Q>4DVF$k?XLHsIbx z6626SS;A*5{mn~+Vpl0Dd>*RpB`7H9a59Q^cyvVA2YTRv^L;t!*VZ;R)emv##;jn` zzjx>&rpJl#Zf@~j_0YgMjy_vs9Z1{SvBgy72)9TiXoOv9Gdzb4rXMop&qCSIgUVvA zjI5;G^={SemuQNmI*a0Bmtb?m1dT;Fnu#imcaN*G8v}tv6A8=7=T$^PDU)Xa_+q6kRlvL#&a}3)1=aT&+h9v`8h@G;b+KAyWe6DqxLI1# z4IwkGG8PtYf`Eht9o49yrUyj*M-WM zNiwvXh=I?yjj8qcHCGk;?uo~4{8Pp|Y4B-E`rPpF83(QR@2Ez@Lf7qIRUa2FR{qj- zy>yIEd2|AFh!Q_drQyB=<7Z*D^sGPcb=!YDhmS3)Ag8gh@~NwgmL6xjG&CE$l(bq} zEx%NJTPC|M$y{Dizw#q}V4)}%uht|H*l#?AtI+YXEGugd>rIyTC&t8&6ApQ7UOAxF z6FPET;3eo}eROjJId6n)_)5#f!rzWk?{;{*arhvvc%KLvv+eJ*zd>r#PJa(uRtZ>QHS`kep*~)l) zdOKXZv?SBC+DT1&Gdz+|-ZpRD@ajLOEO2HaY&jFir+JX~yt@lQUA4md$j9`-z6&W( z9KES`Ua&x-Iv5~72Q@WyH-R_N^`mBq!+A#(U-k@l`9?UhA`XGxGHj7+X(7;8x&mkQ zU1_w3VEVhKP^m^Hmw%e!7}zMC33wK6ktHKL9N0NnIij9i%&>59xOsStV9t?Y3}Pi_l~9V<8dE4nJ&Z_%LemV9OMXvm zQr||MnRTQEh@ec<72`B-`X$K(+WE49rvUG<*9CQsbiQ_5qoCHXh6{O z2LswRQsEyMJW`1%U07{-nD-Cd8~yhazg}eeB*aXpdQb>eT5U~@zxG#yEa;j+a+Cu< zg&)nG>Z@M+KLdNl7H^n$^zZpcOw3XRqbtpQef932>@7Nf%A3Q+ERoDILxANb&Hp*I z9T99@va+&^J8_-QpEvP+Lv^jcl}buIWbijg&!yC8nHg-YjLMBg$-=xWQFH7V>Y+Bd zw=IUJUG0w(*1SLR{$xsVkZ%iJz~JRDeR#t}x>bx@8u?br7d%;&Nx}YkokY|!zMZgZ z9dUHCbXT9W$(CH2x+Dsf?VLF#w#;}fD6^v~xcv`GpD*_cU;`&t#Q0?OnFNSf7K5+3!3J`8oQG^t4V4Jmg~iCm(l2JmI0E zEOB<$S>zmLJM`b$V$Z1HP8Y`wUf6e71|6JPn1dDjHetHcH0Va$W(E)L1+8YD)>Kz@x*P4s<^IXe?ca9hTf)Yq!y8B| z*oj|O5j`4>n51C6-;6!qoWEa(dEkeH;}l9HNc&38@6GUo>Ik&W8#94<;H^XePj)#$m$H8KZXK>FzmD1% zHw7a8cwdmfWyy3FI)#UZk~MOzA+=}cpp|(az+oI`F$Bv@zH4)TIlGq6K*TqJ6RHq4 z0-aSS=eJvOpKcAWuRtm0N+b75GJe-fuX}Tgl$k+Rsjx7LVP33+PWCJYZ#_1ueTO({ zXyWHkK0d*GxyHHn+jf%d{sU?4;-wbfF5xg~CWc{)NKgZ+N23;T=zq3I5*wq~+n{Y1z6x-`adN8>^gPsV-iKnOX{$8g(-nAocAV=i-nM4iP~)BLCan zYHxSt78tnw)2hG zV;DQz3vDl>SP2yZmDEPWX}SmVXN{ckebcXE3u9KJDECo!rUTSMC~ROqvsclTy)x!@ zi^67Qo;rq%5e_}SxPx{wvq3--$~rwrZb8bDtx_0AU-os0Qq!IOn07t%Zd}H`u~dXux(RGyYJ-nXjLU?JDQ{ zao`7)?YP~xF=(RpUGvUyFX%z;CDz9yT9{{{6jCnVzF)SEodfXFTwSSXHf3>`^;gY^ zo#UPf9CsY-q2@_RLs_vg&Mk`#rVca8fxrW1Co_A~^ z;wm|Hg%73d{u8Y8s#>lj3KhWbQ(%G*4igaIPQu2~V^d)%8%gOVdI1sZ1??y{n42UG zCJjfX|Hd62E#hMDz2q%)#vsNn^EPvQ?aZi-X#36c_yuMR**Lk~O_%bYR7HrcAR1>R z2<^c!KuiDTHKP~FCovlEFNB&6B;TPdO#)lfDH4VaqJ>ae9JUEx9fuADmFWmg^AH^w zI?060{-^Sd z$X`>&g4Ed1t*cV|2+&-;E(WBn7)qKLqsDOowrA&Yb5eqy*QwPfPs)QV&KgL?P}}7p z`104SF|S@*gVyAX)W+=;h<%^0V5-YQw=cXrwMn|3^TU3m0Ro8jhY~JxnGql6pEg=x z1ziMOjY~MU`xMK^62CJWbMOA34dc*x-<}G#W~((Fj9v5}UqhOTlJ|g35dwqv0Rb&X zYxC}O!okWlA}Vv~wwhB}lp%6~AXV$)cBfm2>ahF_if+qO4U$~`oc2*tsu_p)nAMcA5jydfG$2k^uQfjI)6%;Yh zVPH1E5InOR^uTs zTB1zy?0id+Amsu_HEi&O$c5lFbJb^?YXpBxFFN@BRom{|$CD2~9u)S;(!ht0lZ(Ij zEc(L;lv-)%!&l4adL#1t*JSjY18k1IPDXUExERG{5!5t1$^F>fQO`_>R)9p7(fSMHXq3&lwDb)dK^L@~&?&8y^h@$gA% z0t=F+F+{w;J{IxKv0OxZLc~Phf|z1nhDx*}r%jL9>PZn@kK&q(%X61rdRb_M+zP0F z^x4U1hIO|Ogd!PvGBa4!-ttPu;U~HLHT`2;?BUzq%v$17&cvE694@H(d3EUohPc60 z#9;5Qbc+AuLghKhL+8Ta)cfX3YawSnJQNX`r9*(ci~^zlKtDtO%*Xp$f8ViVQlfkB z3p;_igaIFf6%BpTGH5Ts>6}(L9+UTYJpIdj9A?9zKV7*<%c9O-ORkg-iEQ(REjHnt z(QMEvBqkAYV8%_Lah3ib3H6@-{x4(+e9e!6A%9O+GT4bO_@5-@kdcvd2`gk8OpD{? zWz|R!faByC)(Au(bA0wRrI#y8qa-uR1Sdi#$i>Ckl$T`rU1(t{awbKZwZx0CXlJ9G zoAAu;uHI>pvnkr59hdle63!{2?o8H8@Xyp5-%1{5P_D$8&}>sNGkRLFw7+=5z z=L{j({0WYg7nmC0zC^g}Qe(EFbWF5re25=~2q!Isr`Q8Q|859^hp=D%9M(#84@vN$ z3?8(GIcLhp3cBhOl=GkNRwwa~h63VOzXw&W7Ge79cUQ*8(EvU}u&&iw{%dR{$H~RD zg#++g&Ko7n)rK)Ynf?3mI1RgTXZr7TXQo01Ui=c{e;2E9-5|k4d5s<}ng5r9J={~+ z6+F}?CLcM@iGJaf-jPX$Q?1%QbhAC|CvRXw^qEA#^rrizc0Y}i(b5b`?|6l@B)Xjs zK7%u)4$P*T4l^!ksF}c~18**TnMzsZSd{#3-{K-(>(!Ozx2^FVbgF_dDJOy7iQGCt z=g;iPd(e-2>}ia}a5*_Xgyiwx$vB#v9y46&nylXM<^|6Hd=S1Le=|#_8K!4f*pCe3lnqENZoFC?ZXoHJwg6bb72#X zWn=ZB2KE~W6XEH}exE?8I;79-^RiB7hKU2!skuZB07yaO!1)YX$^hKg%kD#ShpsgN z-k;^h5rh&F63R+f4AxfG*B2Ie*!b2rK8l1AZ}Dr(lO~wU1$Qes19<_gUr9Xmjn&iB z>=1|${15P=#eL;W%f?$;9 z@3a^#J!N(0lfoQp=QAVHVSL50Ey91ufBy~vB{WD| zzdL3W!NGDW8f;H;Bu?XZBI48PO5+7LsEpHe_h!5NTMlxf;#33?z;#NFQ}c|m@D2Mz zYoJ3eInCFvUoB<|R%7df@R0!*%E}>Uxtad}8k0i+X9ia=)W5Tq9E8WY_w(6Bjrr-oEAI$h=62mW(LWOs;vj8iUl5X50q?d^>!WC8u$Xwsr@?)F1FmaisIsi) z%s8pL>fOU1t>c#RhoNbw9Nu!b7*RC3+9+ZE+T{QW zaEoqv7{6t5y{86au@8R%zXJQECNi4rq}a^n!&v)62y_Q&`P@p|_nYp_b|BE(d>`6^ zD31_q$BC-~FYob|BrR&3U@1_xdvSk4$ei@L9+peTUT{ zBo`g|0`h)$E)^CNgT2woN*);d4{uH!tpw~rH*+2ifRC-%*YRtP+o5$~GMm+95hlCa zN3`;Ny^|#S8wvF97Xd35{@CJS(8OYpY?X}D2)Ttx#p%H4^N-SSJ)Ol#?g@l68Q62Z z?%-~-f)yOmEkJgy^0UC)!om(tvuFm#2eE;s9Kh{6si?w_^F(3)0lom?v&{lxWV=E2 z-BsTF8~{YPZ1_=5^6XCmt&cl-Bn$Xw!0J)l!wk=vsNmPSDw;;Q$d{Q2Ncp^4bwg7* ze^S(!erCfTayA4E&PE&8;hBIUsI|w(21+EK<*T&>9=;30V_UyBXP>VTmERUkENvW= zxVbgNE|3?t-L_4>05>DsUs-uF;4Yx+8o$B@{)-U8wS1UC00TL^M@czG&*i*$*(Zys8?&`!xAR(xSWng%Le_tlFjwsZPB}not zjJXeOpevlGY(KA%Jw<~|1i+)1#TPx zkbSHc@TLewM#BoV(NW$#@jBY$3|V(Z zNcVtkw|#=JU839b(m6-i+H33BL4%q1YixNW&P>^yMkJ5LEVoAcWEM1sHF;ggfIDNP zcq*Sv7^w^Gu5-&y|53;QF?Bl!PoN0sX7F_y;WWkr&Qaqh>M+Fn`N7i7__r7mzoRX$ z@h#SzHrB~KN6X!UZ?P}>wH2`)F1sntLR605Vu_)?E$Mi=>>f_PqA2M*>e!w1kuQML z1Da}g@?zWLj|Y+WcT+FSuzGLJ+wch7L)X4sww7ipwAtC&&E)LX=dY{mfs@)%_EE!^ z!D))Cfk5b?-Cw2Y0sfy^A5DZdl>r);x$(&HCR!_ z@(*Vb$J1Wgk*QgD)8Mw@%1r$P9)GsC!}?j@hZyj#?E!U0tV@Ov zH}>6+=KELD-#gN(#93>)XC)biGGl)m2{u{E$k~-?7jE5|&I3i8&~veW=ZGN$m&fEq z$z#{O^pN%+f!T+j)#&7S+Gg(m~%u{ zC!FSi!XXnhQDpM#_un6#+kab3zs{25HjqwoLuU5O&CLxD4=*xMKvm192+{lE(=U+c z@d&;O2{zJuD)pne4Y{E&gxxogyP3AaweLpxrY5D9s<(B14BagdlaQSM;PIVCD6Z3* zV$Oca1akxRmX#V^>Uf5~E0*bRDFW(m8n+d_)-0-6Iw6*1I#n3<4-Rm<1`InBVs!fV zW%?WQ?cXEhziUjnHU=uL^9VD2ZD%I+#P!t=KRnleP?-`)4?EplIX8BxZEG{PKd)!X z=D>G{7fMy1vf!*#D^I0CMMb@N0t%9tXx79GON$9n)}h@_E?4@w-FG>vv|b4p7#<%|4KLKNX{#!(395;^ zYya==558>A*J{O%*WNMbsf=GyS7(SG&-7!q_m$?4u#sV*K!8)5rA616#Z!5->Jc^>oZH#DJWA+E!hK2NiFO&I6Wesm`R0Rc zYv?rfWc@I*F4WYlxd_S~m2H3CJ|9mIMpf9*i=P-N0<~47u=$NpQgm>(#j;&oR*Wy7 zA;7!4BZjqE>v#C~VX53QO`T>pX|zF$Jhb?qd!Ypodo!g3;(ObJT|k#_ygFWiG49Zy zJ@C5i^C?nl7680ghe{36bojC5o~7&OrenSQt0XP&aG!+bCJHp>HkT)*YQPsFQjSle zk+>)xMjK%eF}^Ps^a!Beey!ehpzcZf&-FL9s9$={bDl3xUym}9c@naH@o=PmZf4WJ zG`SjYa|`PB5R1p=HC8IpA5KFEGUGNdWWzAasTL_zaiR78&Y!W;S<`_w#w5TclNZ1b7+s}-GT?J4Tqe@V*(4Ajz^+6;8Z#Bu?hCE$@Cx^db znQXArvp58&lMeHl*`FDMH}KN3vq|C&}EthcX z9R2JyJd|f&v=r$i7@hqzt5k<|bTV}_d(E}hnQ766A?aB-DlaUI(zH*#r!F(gVw?~> zU?97Qz-~pf+8>X#TsrB z9^rTc4_~5BQl$!We#0{n5sbDTd!T2jdw&ZM_(^hzjRvKEjBRXe+zgXD5EfEpS*p0G zW_v?sT+x!}gVqe^*9vO(X`CNw`v2B&z7OMct2z;qb;kk|bLYA9OFPB~{{I^a92mGa zu}8gtuls&Jdmp{-5HxG=M=9DJSZPr|&@T6xGdly$)(|#P^5DE+`nm%)e7tdZQtBY8 z6%?FRZ{5S5N4;L{$(tn(1N0!+YOLCf-t-jJLWIS{i^T@Lft#_i&PH}R$TA8){1ZxI zd|X>|OA13N3Wnmw(+AIPz)C;K-ysg_>Z$&tXHKcd#@E7oxnBhf7I3*I3@xHorCPx> zZIV=r4s*hAchXYM_adds8*Ie>rZLRsB%4Cr+A)UZI|;#n$i|96xX2aa8(-S~JH{Z& z1X@!md}-D-F3BY3A=T1z9Hh*%1!S-|Qg0FCu2Mz(%j0J_kZ@~Q@sQ)cL({`=5_-?E zjcsDL;ey*#>|=w~Ne7WT;}aq@NoyBAAt6)@L=|2M9LOnquW}cxGjhc&dIUQpr2I*8 zbe0+DwLez};BRLxMV>mEgxr2DMEbHB9~`QXB*(o!>h6!mgdu<^WMqRlu#m8B%4KF*Q+3et~JN46lqza0-UT$a3Kylr8Z13?{f z)f(*kr@#h_!`5ViXj?AVC}x=k>p8?@jRT8sezKbA(iM#K^pI_wVJOp<>ECEI#?Bxo z&A}!)KP-HO=)%05R58O4^<)x@nt;lf_*b5XUed|sGlT-aYPlqAn}anBL4O%>>m_i$ z-naVD*S*{?-1!McK;tIYtAMLT!`S*refdl7pp0b<( zv=n~$>`AX&wF=ATP4u%Y2{1d-FSsb^%rSiNzCj6i>9fAK{19l9(48MOTr;tE(Gl1EwX1Cnt z6N_prXpxFTs2Cr6e7z};v#puD+Mb?s(3@%euzZIYukWs#zbVInxhITSg{)X2XzdLP zX#7yW(f;R_x1R7OVhtvF9PbjvD(e)f`f-h3-mJ%dpc0$$2GQoHj7#*xV|Ou(VVyuh zB&=B5cGhGp^WYnt=Cu~2a`+)_Z`!D2zVCnQdonn*B8*knp+sbJ^V@O#jwO3A@0 z+fWx5G4$r$3 z#^2pHny9xCu65Nb*e4GWYe@e+C&m$83!c8u#i+4+`qwDLl<4`d_JNnXKZkhE?L=O$ zM%wCLi#xe@Zjdy9_1#+z-Ci}++*|z##mOieex!-XL~r|BRG?fN#y@6IRRA;5YS!pl zb+FABkdWF(djl<;*FlMlUrFzkd+vL>qPP>o2G9-Kx z(UnSK?nbFaE*T11`eLvYb%n1*{)Jy=e69=sc5Jj(#Of5An3(wEiuB{^W#faS!T*IJ zCriZ7x0#CN>F91IMjaE1ltctqjBFf*+k{%U<(%XtkBa5bjcRY7hqt)GA>9cc4yydF z^OCt9ra{=|WmUx$g25Nm5tVp?BhI`DSF zIyR+^IcgSl=M4joYd^QUN!?+jy=bnNmt*fuMR*nQWHDWnlS~k4+xQ??6DFk97$`jb z?U2~6taMjOB`GP%0C#?;z!{R53l7P$vRWm)1hPe|ToW5-;wJLq(OR2(br(DR$@u8g)$@TbPo=$}tsiOD zGS}p;tVrkK>u5aM{@05XHOLM~(=0u3L3XP8k~R7M@$seWNxFM-1J4U+;x026!*TGa zlO*?JTk6nhZ^b{7EIm^q{bG#H*QKSU4ouyRAr?x}__<2)~p1RN_;CoD(b zJ$|>RPDB~wpg#Ud{KNJt`Tn3v=O&iegkpEni@7bM(dYy$k1Nu{g!iP1Eo@1O_m*+? z-9+R$AbY;}hWIIBjm^N~mR_y%;(}g4M+V0*dv!MftO~uV$UtaHOtOD)myhGwYo$hz zntzDf8LOA`m;D;2@(jWsuaU)&(-vYWs!AkXd?DP+t^JrfLE6qx|8=_&7hur$&v2x3 z(A)kncp=m~|Nf5DMWCpVr6aO`_ZbycYXnSW*J54TQlh+h!Goe`!#(}ANsmrX`;-=O z^{(1PJ_5m>rc0fZhbM?@+1|=BHWo(BTV>0?b8t}JZqOd39=j3xH{!J7*E%4ul9Gdf zQ@mjg&*lU>UX#*TIkqjteWGgl$%+FEwI-|XBU<<{EbZ*9%L_QF5F|d#G9|r#h`UWv+Qp(>YSL*I%;nF*~qv znl-+}ooo?08bfM{S9u(o6sycNZ}R=)?HD>$AEFMv)q)ZV294lLc0kf7;LSh6oQ`lB zQIW;YhSXh%36}T7M>GNyw0qi8RVX5~1){u6D{-LMxqBH2PuWxMm`zfCNzv5G;Nl1Ab8d4V3E?Cn9 zI7(C*(h3c?(eesf0$7xJI63`wwR~b@ec6>s70YMJ8VO8A!j}-XzpENJX9sdGeL-|l z7qK+7s|lS*Aj<`oQQdH0zUeX{iF=;VK4*ezOM}0VkfYk0)EWO5D2)QX7>Wex2X{=A z>D4|Cc)@)BmB+E6By;!3+8I}_Kie<0@i+oi3yv-R8iL`!2ER~NpxfGlfp5KBwf`wx z=PW}v)4r9E@cX&n``vkUq>wPX)`0b3nhA<@rSdONj1Zl8bPJe#OK^rN4i3Ak3hT+s zys+oFeackRRTeq@G5Dog)E>Z|J)R9cXW<(k%~WgSFDtCntnk+#jb4zi0Wv29^u8f* zKGgq%s0MPCag#-5v+h*>HbJqEzjEA-Id;%_=a2c#W!gM*x* zS?V)?B{4LJuHZ6ms|p=qFUA&dwO07;`1I|VfcNto2e>N+$?wAz;)3MaLr6^c!s!0g z<=ek@n7vj7@u&EiJnw(sosw@X%-xNZ>QzZm+eBJhSzRMbBTL)JS!nH%*wg)QZ4R66 z`EZ)8H3nzF02yyQ=7M z>*Gnpw^-hxzkRPjunx@Z)Hp5u3$zP@bOk9gAQNNAMH z2ylH97)tVrH?$w5e?<)SY=V;*zPV{o;jk(6{egDTzR#=0unA&}!5j6EpS3&VI!n~+r-+xU?BlURrfI0U@#lTwBb7M?1$AG_0janRU?C1{m>Fjc^{y9m%W0|4XAtZx=Qv34MV z()QxvPkMRPuf57}T8LAe%2IMVx99oSzfNc}ne}cubKVL|w7UFDwjvGc}AwUZjYnKW# zhYlJF*VO$+*?)xn(zY?$N}LI|4Zcc9WVEC(0cC!WvGA(gPQgI2#w5yXa$;#|3E{5L zh3Jl_L-`0)K!JHgfj5y}6symYAQK4qc)f4~t9%^Q>w#aB&N=qS+r+P{Zt}Rd0l)W@ z$Y%9Sd@&RgJo#1LO8w+ocIZ;sv0f&46I>&_k>&0HKdoczuQ6=nCzGSn75yLwziwTs z>YU;Y$?NOq0CnIhWU2!pyvbnQUn&6H`_d3Y4GiSc0izcTG-S`C{6}4WG+w zW@pEov8tbT6EUkAa^Wx9l+-U!;z?45bar<3*tD*PcC!5PH9+lqi;5tYe++qK%sLze z?N3I!*bo?~{bCwUC6Xj@v&no39k)+0ljz0!#R$qi#PtQl{Earr^}CoNHA~a$Rankt zNP4nUk{-0sb(KVM5@cwUScv@rcQRwO1DwoANJ!0%D+=Xv8k2_pk`xfuz(G0jqUS$` z3+kpfO6zC4yD3$p4A0Nc;4H7c{;>HKFCq<(>xtPc#k`mj$Zlrr;q8gzvh|=fy0WtZ zv5zfC!cWBoF3bendG#-A<;_9a?71XbUE|=80Q=GNTwAohq0uK0{yKl|u|6 zHwoOkX|-&TszS4`wg*(>k&?pcjhnE4((56qCfStoR7!ej^p^dCe$iGO;_;Vop`%u! ziKOBb(X2HcQU6x;_xwRSpk;5%7klM}%7Bja6O(GqSDddSgBsiQdLW?SYHi00K8JO% z!(oWiHmsSlw{sS;&zWrp6=Pkwy@FKr?FNc2@+2)v9jN)TdG&bR`Jo)t@8&}eTWuhx;srdpjT|h; zDKpUf{S(m$wi1BNWOv5xrrwtSbVgib7CyJQpJMzSzYdwhBA9J^t33Va<#8a!+}$JC ztlmYc!;48_J3yhF z3H8DB9yeQr6mgqY*oR`juTY(qDqnNsCaUinMjjga_%Q8ZMNN=kY1_)&=->zcTD$;L zB17ZQAIYFQmX8tg*%Reu$(lNE+QQq#APNHg2|T)aILa{CkCMGWeF8Hev&P5*2{p&h z2)cdo&Cv)3d#xe@$-J2-xO@&mv##dILl?UR`?joC)Edu=d)Fd=J??gg<+p))`kMw@ zH)^w~2&zNjmnwDEg_ARq2zwhQ>JD*n^6=siaN)mJV~lF{s6%{kH&(@zpFj!MVl{WGg#(#=VuLH@$;uS)MMt zurA1U@mz7(b&-CvV3Qy5*?|sO5d!HC@HP>aK5AW$7PIMJ5jXA)(Y-E7`p3=?XBmVy z*qV?M^dKN_uASiE;12euEYp%*Q*^%W4gK!w;q=Uz$$aAGAa#vpfsodu(tVA?2sDJP zRG?34hGD(}{z}IRTfzY$g=~maT8WEzn$qFw?kVzVU5w1O{w+?{fG3+BMX6Y_#u2Np z|I6@<1OAT#ioSmbRI=UkHJUS1M#{CF{`?7cN5|n=VIayVsfnULSXW8m_p)LwCUtR)X7}^#s z@v5Vv*I^11eskfQN5e?Bc$372;}bh0UKWT3Y9MCar1xLO!nr9;>wlULi4$t7SYVh> zT^(vB#cCUs=JO=n06Zx3o5az>oXiG}%q9Yp;)MDCaJx&zOCn)zi!WXoe((C-jnJRc1j&w8PvU;MBHW+4e!cb7#Ol|Sk}&}6T0o`4^26m3p4keQ#&@Ia`R!it<^}9-1iYx z!j_|{; zsi=B>DcWMMH1|Zy>R{|+L{f9(FaSeE8)6-|_1+Hs1Pu(o z^d*xfhuVrpiXVU!kP|sAIOIEHoH8+F+ruDv!FS;HY%jZ$g3&MN29c)ZB(QOolCt?m z)I_HOVNG$k|K}o0EUu;-fycFZ?qmum>EclBM$PQ(B^HGVe9I}g$nD}}i7I0ZSOn)P zYYh4)k$z8mG@IDHI^?$I9x%-WTG8q1>1S?eL z)^FfMuhVsH8o~z%f~ZNw<%(bdpN)|uHE1Yxz zEA~w@4uF~W6Yoe!x6*qGsT{9{b{~K1qn1EeA%?K42k*m{b4Hg&jyHXB0j>$D(Y{-7 z;I-Q5GMBxOtQX8PRjW98!muR8w1!V+LSs%ZOX!528!_$(C4I=N4;1r?m;IhKcExG7 zht|2%HRmN_t6jHT`6(xTvo z*gl~u>x$QH?~kFkPoGaHSS=O}Rh+}EC`!5&Y?$nDLUki8i$-tP;KZ$|UBYApHG|05 z!=(yvCj8w%C?$=)L#UN%pX}6)#5-Xc7^3uEZ84}j{&dgI#-y6!F|=j$>=(7K zum!0xGBO^z@Pm_l8!EchDFKDAW!_3bzOl=rqHuT3yD0%B!H}~IalYB~LdA@IEAKV7 zM)Gcj)-qfLJP&`0`cly*yMOK?G@+SjI;c>kkC@dpsh^_ds@n*i+(m%ttW~W5wGUhR zkj$lg?5gU)Srh=6Q2Bgvhsf?Z+zdTnKwnGvk3#_q^bg*iOod@o?82S$YH9N7ca{N_ z&^Oa!81d1YQxuy86o`Kv!Lh8TN33Q5gNUzmB{}rZg!4Nl>(j^%zF9% zcewnbA{cNS=RGvP#X(iHLQ|)qNme`f^*0OOZDr?t!ixtQ%!FZp-G>*-MjDu}O6>y& zCEkJ1r2xI!yHqiTva&J<>mxi;UpE~2YJHhAu}A_7bwS3@!xmX3S*uLxC0L5ED+fh# zDb-ka9D+Jog;L=e1qWMQugt&n{a&jphqOS|YIyJEOwbdVdEUm0ec~y*0 zd7A84|J%*}zS*i4{{S2X<=oU1ihyRX(k8Zhi2rR7 zgPSukprByK+?DYc{dhtSIN_jXb8ds2rbl0^!Y@YuuSg<}j#P_N^w|gC`YobjGhoj3 zKcH%vtN2iD{kneml`k7E0l?$^y7T(t?#^RZ2_W2odhuHEh>C6H?Gh6nUEyb}&6<}@ zfvS#6J(?KQ`OldmYZ(es^R=yL^MyZrhD#xS-8pKDcjx9YF*iSfa!32mLW0yzi`axO zi3Jc2v9)9I8v^^qX~qWPVm7#2EN;d#WT-EBNlt9d~4xupaogn3BWLj;52 zg(rQZ&EPI97=`~BTd#VoSa4iH{?9`$_Q24AQsbB)(0K44SqfH>;42Nh0b`(sR&dT^ zTbI4B^M@iGIxRe{n^v?GwfYE;-(`#|xbXU~DNI(3ui@ZczL0kG;3L^w|5YO5%L+{F z$ZvanGIGbS*A9-uYXCm4A2&=k75@7Fz7 z!E6fO+HMYlwbY4K_m6^Gs#Yo$wL}Y-6eNl5-Kqhh!D8}^O~5L_a^)(}Lf=7_kaf>- zbjmJDgY6_FWJ;Tw5gjZJrE^bHw>#Z7i(ZwJb6%j&X*G`8q!m+)HurDgD|aNQ0F4G) zlPo=me25eP3`May4zmG-Dpa#hs?q6>7SI@5*AFCl&xs!H`+zg3 z71os+dI13!4bLPTKKCV@$i`?ebtmcyUq^acG(9yfM&8W;_F&Cwn|6pg-9Bg7*8eqX zFdx^w2H9-e{k!)kpc>%6^4+1oJDO@XLcacC;1Pfew<>(~1nlK$WrjmBf(6v;qs2op zV|VjD2EyaigjY`IexXMp(GV^a=6&rK6Xf!Nv``Yj?9ILHW&jsOBm2RhmoF9<8MzesY=~t>oN7(JzB!ihRnuCX7}780>og zNnF?eZ-teA==Bs0FA)`*1B}u1H`}^@=K)VXH4Kr8`fLKkfmhSoHNDeoWc(Th=rsjl zEGR_0xga;_fg4UhH5o>@47KuS46#ZLRfhC*oE&z#FnMJAtH%OUsZZM}T+r>}%;qQv zD%}j{y1eMv+q&Eg_pV{emW?}&)2?hF#`6?|P#ZR|8r~R9MXW*IMtlM9hROzP{AWfq z9{p8NUi}nVS%(1g9LZwU++N@*2H39y4zVLE^1y8L_BS`Mo@RE$AKWi=<&^m>{S6{z zNG}w?+`X&EUQW#>bbHcc9?eqM8XSWszp~WyPQ;Llc4Vuy*$ZaxKUWAs{K^% zYPeFP_PKvO>zMBC>fxId4V?5JJJKeX!=h^+mSEMmeU_EX>qc+2AN$2m+Dj|CJ*bNk z|0d$9YcKC&pCZ_C`uUfynJ)ie_YD(#6sX5z0 zYkH>qJ>)gl2WijU*HFqqIwfppyV>`;g&zllH|(ZjZu#;Ci!};*sY!uF2w{^$)ZA1G zbP|ROK>hY%Lypoj6B6gkH%agvjc9W_IiB7~SmTJY9d_s7hIo*@em|C4B=+&^c4pc= zkKTOomC7xceE0 z9)A_`^XNA+yCJV%CL5JvgsRpiwt+e@W9rTKKI?GbivW~0l4&=dnRQ%Q;Mk|cralC# zH~kK~z=nK?O$Y!h;0aLw>dMZ-y@svY!o~)g%9u3p4QL=*-K{CX5H%RY&dSBrPq}wV zZG=07onRg4bKk*a1HP{JHqm+8_}4!Aa6uYyhPa9WFD$8B?d`dfJSc5&0K47|>CQF9 zfTQ`rLF-V|P2dq6lSGMsj~=I7`&Z;^DpA#VY9<+SY|O{*y%Esp7b_nhui*bt^_5|9 zEL*f_aA%O<4uiW(uwcP;a0|iR9fAaRNw6Tn-QAr)2rj|h-Q{)8J@>x%{_zd{^-Ndq zs#<&PwO6$ewf9W+#H=LmTa&;*mSDQ8Vx2Q4wm<3WF69pL`YvM!XyFRAIsSR!4_}^H z?AaT=cJ+e3*;(#zy9+udf3WRgdGnvgfnGcJxV*f4ets74il|yu<9;T%j2K?eI^TK1 zu+P?S5b~d=W3RU3^LP05ht-bP3;v@|LViB=^5Wl^%FoM#ZPYZn@P+?{yrB1Rq`fUv zO?n%lF&}Nf-o)DNCj!jkot+(E6B(^D!LMeooZtN?Dqu@bSp&E8r8ahXdsir|Q zU;`ei!Ra9cz-iOo1`EQlb1ZsZdLj~7){l{fF)5!{8=K?ZCK?051+oMc_`PCWvulq< z-gdVcFG*Nij!fh;E5fA4SAl2eBXb`tG3==8v)c`^ud=2o668TPl2nU1S) z1y>c{Ec_iD{9rf2X2&?fv2cS(MH*%c=d}tv6Ak5RxPa7^tdRjigT9N>o5!3bJAh5NCX_Q*W`d4tc+w z8~=r~41Y6`M~JGmYxho50h(-yk0yHsCd)iuYsZ4y9 zlZW(WU2-&YhiNIWvLV`N5m@)X-YdNq_?<0C+CZO~;UetY$4s8lwYz#*E9lI?BrM#1 zwIAJ;x-WdhFVvueB&(oQPNt~ji$nOtM%yST%niRA)zUk{4Fz#y*3Kv-<%r3%W@kp-`F%l;%Uah+9&zZhorG>PgwtBO^Zu!e+J6(p?h zv)A`+wY(NL)_ecg3DK0kRrOEXsVs}^18<*B_)=+?6Rfvmvsg(a2NZ0^7(;iP{ucdh zx?lFjp@EpT{v;(K0c*!hv}syKjO+V)gjMElv|md!UBNW!9BaKPuD^Veb=zF5Dz{}t za)z9op?SISL%RH?#`igkdYZySQlahBIosaDf=MpapJig69S|1U)hZpO(Zbs*(Uz#s zpW))Dpp4Y`gC=)0nU=d`Oi}ER;9TT0LI0|Ulv~_9Kt-dXk(u@aI4gkl#&wmI17*~fbou^@OWi zhWV07S%dnP7>g2p@ui5Y1-I^>THo8TYWUOf--glx`AFH~uT zCnIV%yg7+pFBX{}KggcjqQcEZC zm%8onS+jjnZ|u^dJ>gU7a@g*58;ty2c7Y883mLxhRLi6cl#x|B!q9tb_lXF$F7t~` zSz%~Ps+gucpBhvDmeG=fy;iMXz~aLC&NwvJ`Qq$f;&|*EaSyad&m7S#yf447+7eg2fY?Do@Z}fp0S;rG$J*_ z1fu*uW_#F?Gp`$WrIRat>(k&2M$T1d#@lI>Fn&OasG~aMKaWe#^A<)~}DWKwP`ZYw8Mr`y$xGhy$M`5Gqb z|9ZXf8~TTMuvdTbyxbb-csgYGVg6x$={;*FoPmnc?u*Gj^zUXv@voMiyfg8~-X}e` zg?aDPyi4x&KlEtqa=K&u87eKPq2WOK)(O>?dtGll-{V?c+HTVN4{n20<2oDU{p?t2 z9cA2UBs${y8?fVUAwB{IqaKm=M;pg@ zOCLE%6LdS8g%S!p!-^Z6SJHlS6=D8w^mMSut;A_^gaAKU?9HvOnU+V0@6GZ60o_j% zhPsA^jd$4?DSxrEm?=u5CR7D3P|vtY&>|LaN#fF(Od*M|X9aX1^a?(hSsKCi1e2U0 zL~p8a{|-l}CP7|CG-uTLd7TS2!xq@PjfbxV872N_UN0^a6*uPb7CuA>X7*{nB6phg zVDU=lh_I6UrVaLRvHLdl+0cYy6cAOO%aYr`^&K* zocw=Q=YF7(Q#%+1ZuS94vsVHwZ`+(6Lo2cx;g69^B$u@AoXUhKhaPs89(fOT3)I>F zT*C+qyf^FOFZeWm;))+T_~Uw~9kHqleHG>=K@(`d9sBuV;^)teC3&4gbgNKF>WP3} zi=7{Z1B35F#RNEUBrmQalK%II{yzrEn(Vj+5D@gLcse-r0L9N|QRnUP%=inf+eEN^ z=KV_l##6ymksP&9!>wz$gVLd}#bGxASk}iTjHDg@NV<}K@9RQW!iqq20TiH<>qdnH z7WdhiJsWgyo&%YfCesc7S}tG)^R7}%$D-B5J^H*_u`+ISTTqhG4Q4Gj5ILydh9dL;4B7#cg!QxswP)|L%XSF29Dy zB;CB_);5f??=*5u5z#w2z~8pFhK;Fd+5(<&*}kvM;~7~}JNVioM6*mFw>fWKx2nbnX@>mr$%+`OEUN5M|JwfOA$cR{r_6Z8U^= z%D?L^j>F>10ZHkd+ZRO%8_$^wFk5{XM?b;)x`UKHsAvdi&MG&Fs5Z-e>2C>_rU?Jt zG2+3{C&$Vm0BFa6M_GqvF>`3S@s68_*;&nH z2u`MS#HSBRFRieEEF7vCsu4NOGyn$LC%8R?smh`E$cEe;P)VKSbk)PSC$Aj@G6oy| zXz%xGhdDel!&cUFKq1?NJtgtjfi#S2y`D&60Uln}bH%DQqN^qYsa`aUQoJr~!1GKK9l>-sfReoTxGtB?I zxL6o8Qlr+&5`K_yRDk*fnXcJ>!Rzk&@T>b#G||-y9!d?>;XBk?QMqJAA6ji~by7E| z>&dvX1+EJf(!Ke;y^ozwcrHop-CgKQuoZjIm_zkMJ$G+De{>QG&#-CxrUb11!*@Q0 z{PlG92Lk;vvUD|0$y{X_iLN(;^iq3AW%J>gzQOrAJwtosgiFNKVHv9mY`@ z#i~?zNZjCb?FfwH?`o{+Jtz{nujELQ13a!)1(M;Zisf=FxTD)(oMt+#4VeD*NNREP zkNzzG5`;;~$?JGcyYB|?x-6hjT93ULcYc~0%Kxg6VW@x*lt;JQCO_`Ae0xmhX8>kR zb~_pUSv<5wodEYIt+rBtROW3%ZGr=m?t3yxWVBCOQJNi1hT=)qzpZ{f50orf!_wOKG#;y*5o?o%&ffG<4Z3(@OPG73mXY`vPbQ|B%Oa_eLKRFP+ zo#kMMAotq7AOK6!=?2i=?~4X`n-dbfh)9VopRZc24uFZvX=$)E(CiV_tPNQp_A zib!qpU4e4P!Q*{J;jrW<9Ae_p^)!Od&NTnN4kP`1NlF(2A|M0%_|*US z1lDX!!kUVl&kH^uZzC4qeMiTofIO&MXGP6k)}?%O?c2ZlvoVx_!R6AxM%zQ&Ls^OT zUz*n5O+ARc+{W?YnDt$0Lh7JU4{rcW+#3gL2JG$@yJLmFlq|qj!$(W^mV*#O#FrOs z|I0~7IkBv;4ZL@lRPOP`n4J$ph`+Ot<&eYpNRa4)L()MmIK4AntfoDb@-Kr9A1DT8 zU4ZQyXe%`E{z16%DKNft_eiWYh+^g%uMZoXccQa8;^k4BLYa;~rN=4+Jt@|j8~V9H zmO4TyJJj>v3P)~jElwlm=T(1O0GpxVbMY<0k66q&=hQP}jeEi`)2J5;$rPhCoh3eo zpzzR*2Wx-nMwh!`W6RM>gY)X2HGNawrEbFeAEvpH(QS@^?BDl6aEs1Gy1DtaeUqKB zaLj^tYO#2I1)p0kz46p`T+&+XBOTAcVA!1dbvx|DA2&YtgS(I@i@A=++f^sJCHqcW z41Yp*QE&r;sAe?z;5dJQ=yhcpwqBD%iu?hXDyQ;*X%m7>>AMHh-;ZL^P20S!@wt)C zw&YP|vSmdbpkjd92`U6|Mv2rN9k?S`56bnY^C$L>)WY&i{QWY!xZ&q&6JEP{JasY$ zl1tYsfHw$4EX0(=KQPxKBeHVcG0+#^D^)yy##Tj=mEKT5Mygj5vOQ83e-x9a-PQ#)8WmV;J@z)SpBL$ldug8K6Kah z3=bn&!S@kxHZrqB4Z~dz&WZ5gP4S*->;ZGP0I)l0U`Lhs|(7H zz%0?YT6;cu)nKLFJB%>WAU-|)3;eo83x0PSOh7$N6rhU&PzNBxpXYE3*MfR_e(v^~ zWJFy9u3-1*my4>00Z7Y~YUef>*lXlxzNy^jj__X}2QI{#jz($dI^jG3xt0!G5!@9r zq8XA`<(eW?NJ7y5YvVFe?yg1NubzU#__39XkP$V7O-r`A%>dENIsdPdXM9h_Zl+8P8Q zep<`U5?qkr!kg=1oaAUhC-~Ek1+zkp=q~yZdNvPj-^h3BdN8Y}@H|$pN$qDjfBc79 zg~(lvSuC<0e7<&b6>@PK;rlV2(kuGTy1@$AXq|G-BnkXXITL$!oiYi0691Q8QNPPd zf1)7mwXBc z82+pIUx_Bo!xSOy$QLr!RGGDW{JhIai$bm^W0QmeM12`Qs)e)LemJL#blAs`ip)H| zNNsLC#m-h3rHWOZ?R4OHHZ9zHcKg4Qy`~VYb54MWg`EiI*F%Ky$Fp$}wRdAOn@%^_ z)I$u!F#Uc$z?hfJ?P^p9aO`eIe*^zu-+MXIIO>07fPHH zBQi!y9$aa6JFy{89Dc*%*#Eb;s$xAPO>4fNJE(qz@z=0OM$f9!PiD4->91eEQoKcY zrUE1g6B+G3KWQ5}>S`WLlvnzgf{Ry!JwwF0L@IBQF?)8L?#hh)cWd={OiPe%k*oZa zIb0|2o1S~8zm4N{F$P@#&94CtcuKzvv871LP;Z5Aegq3?6FyTsys_wT5A0|1IvGtr zeZ+hu=Y47k2==luT5n3;Tu1EeT~Bsqh|bKREsAU%ER&LZM|?`x5$!Myo2cxl^t`Le=X z?P>>o1OvB3BJh}}YYI8TVEIyg4M%FK+O_+#maul-lH3Erjfsat!GSqJ{no$7;&Yeh z>?65tbjc<2ttWH8pmx3pX~Bt)c)Y}2*@lIzF=~zD49O}LIsyyn8gVM1y{R7kA>3sd zLME)nwY*q=_Ce2b=q87ZT>2EWwi*MIL3~R!-@GA69tXG;;*s4QYlWS^kYOUi!337A ziN2O{Cn5jycYmONN0lCUJSt~25OB*4`1$HbN5(YIB0TlQ>#W@T?BNmL0#-K};)`5Q z7DiC^VN7>7@b6u821-B|g&vtnpMm<~aGGtx>y;AzTmo{i5yAIVWMA%B&2z+rxd~Ve zQ8w(!pO(s-{%w))1^g^vMT!hF=#>LziVKt;i|iYe966-fFE{5ado{)>9L1@ zM)L(Kgbi`vEwNa^#u}E7JaF;As45$@8207EJ2j~1?_vZ2hykx?s^2lBHgiOwV(ot+ zLD7QJKIf>2l7`y_PG1cl#P-C7h>>H4vp>kWUzng#q=N;_`AnnHsbFOIdVk))tV9 zI}S_8VrkQ~O|zVS^0$m+6*a9a&N(%|M?b!3y4Sc{+H2Pm_3|+p`Edrzo&*ls?>Sgy z+;W!tQ1bnSw6yIkp9r=mu9TdUuKSBUPgl%R>P*=ILj<^*{Mxd2fMuX(k-7~2#V{bk_)~PM^JWbc;^=PiyTeb2{m)l#|~IWk*!YX z!g%#%Izs|G8prNa7EZ6lU~-T((LgJP_h1HUjCtt}({!z1CHXb$GIb{8|wyl8F1>QPItg`9U@-v!E(1 zHL>+wQvAlyg=30C;PT1}%iO_R1AW##03%`#JktB2zm|QI8Lk zQ%)LbAv0$}&*2h9n%T=QaEX7VDLh1(u^;{XNcDshRRM8sMdq64;vb3>VHj14j|qz- zQ+bC!C@WrzW-W#MnsTOwVpkZ#+mDpze&ZdT)tY4&e>o>8dT&QVrt0=%PYGZBf(As!j?KKu&txk+K)0sYn^laau7TIiT%e?AIeTaBpt{$jZ zez1SQXT9A%QG;s&)2{w>e@QB4t5O=2UasNfY89_YCCybDfn#P`_6m*b-%=Y!2`e3S zYF;hw+k3CqHPyFFD(9F>7I!S!$tRh26jXYkfVtx#p&q(MgtYFkGRR8s< zZofcXOUs#$m_wq9K*!yu!rIt)Zkuu24eM16Bi6l=VwlI>JdnRmeq( z+Y=`~CXa$oy0X6Yi$RL}mXo>sMek9`k0|BT^@ZwR*a>nyzUqtD^!4>z;3k^GH*v^V zrZolhFZ!oPBw@~P>zB8kf;1UUKiNONs5InX2f%@h@LYtwM){upDozFcg^s};r+>|7Jfi7uZn zZtjv*`Z#oF+SpJ>NR9E=LmYVvP%-}eBq-6(l)kn{=oE3?k)ewp{S+?ZbJa(PqSP$S z8%N>^yoA$CanTeyec9!DwL(RZ+lSTq#y11q{`X4_&CI@iR!ksbas7KllvQm>civJI z-np8q#y_qJqIMX^fK39kdqfj zU-X6|`$`-k5HtE*4Iy*|LS`?ok=Z%kqfAXk2R?Tu`X|{xaH)%#2yFrdjuq=OBr{nZ zmykkr; zdwAVVJsCZXq&$r8&$faRF-6*eN+a(tN!Jrc5g#ZoO1nuyUsXzXW@j1k!s3TFXpzZ| z&M(E^8w4ClyGfS9s4F$WFMwwmKw^*b^70J05#kiPm-kF~^7-#qOV(B+%T<}8UY)k? ziq#aUMIiU??d`C3iQX3dpD}c7;21nMoF)aI04oEA#@%Ix!YW!aU?yt5#s@3nz>w;gYDqDZLwhMb+Z0*bAWt8V#%aspvtwf$y#N!FY5^z62(SA6vRlQOEZs z>Xt9jE36#-ui@0Pq0DXrW&0;>Z8XY4-6-TaHt6W?tbYV!_Lm^TEf5g-m7_&O=&>M# zZ7w~MZd$oFRuN4Q*0k>xY_JYCR%<}psYFIbCXax~`q)>&7KU=6zUpd?Sof%;MRY@( z#6?9xKI073%S8fmlh3twgOz$B&q|`L@HC6}fsfOVDHL)n-5Y%jsR+ejhEo-Oo;ltP zOb5Y|n24hM*^0T6!38u~cSW5H+pp^*MZsZ;*=>olj;k+moBg%L`gJ#2=p4y=5wGny zoy26@^dA>%VzUJve^?G%9$ASnfT%Xrd{KrFzku-~-;uwm(p_3yN#+jLcj*4BV2{h} zJQ{Eg9lc@kD!zNz;%NZaL2Pw&2osxg&E@2kF(s~6Fq~YI9y#$spBGkc1yiF#w zbFbm5!45=*3d0&mJU4RD7iZb+CAnl1j9kz$DdJSc4&Ev3OIHUIH=)O&A7tqVKOqu zu`vu)UXu5S1ugm4thnBn*hn>@j-ndt8t;^g-i7z|n@5*}Ws8;&iFo8TuRf#7_BxC! zQE;JK!h$fPTVO$%5LKB^NxpeoW`)3pp-tQ9f!ya|i3W3a_11Q-nRl!1+`anvy^A7S zQd=&nhXc*R>g(UL+eM;kd-GO^#_yZv{AWGP|Xi^7N-xq%E^B)(Cj4V7FcWSyceEVQ1Due zd1Y=o`YOc=@)tI)(Cj}dbF7@DDLb#|;o`u~eT=FN^1(YyiZI4b9!Pqbv^uy!fvg~m zdv+35V#>)1*Oqu+%xn^Yxav?{6}eY^l$;U0=6L0+{q=%nrQX?XwDwHTv&*gq4ZIBM z&ioW!B@uoW?Yv5L8y$6MLB?||sqr&S z>I#S}9f%%E5?&wS?dYBbL`a>Mcd@M4>fU4gIr*;O)i>)&i}8lf@T%tOkX&V4^e!j% zNA1fYL%TZWxS%9VI{*G96pEHk5)7c(^>IO6ZXO;2}SJj3vR9131^`-cckK3@iM&mYABo#`|;MwvG_^#v-p# z3-VLk)Me7(p$T6WpCshu)jYoTKtA6~PAfJ^tlKYp`J8W&bQr%) z4)0?A=^(ANpS9_8Vdttae*QMOk*Pa%`pCJ zGaBti9DZT-ke986b`+V3HdKOWYFS4Oi{Fns(0w{w%b=?uXJr_tct zMl;?LluNpiAPJ{e5K8!5X~DuWk;h(HR5S`&=N-~_efqW)cO#O>kZ70O1QmnjO&oX;5U`Er`_vISy<57l>?i9 zhz#|}#KfRTH|$8@pcys8@Pt(G%AP}D28}aX^+Sy=?T_c*2*AQvU~I5%Sq@`odLO07 zm$JkRvJklzblnkqJy?;pUO>neeotv3xbVlmK%s*~ax5|xp zYfFo~PH8xR@|Oo9bXt$#{mOBcsE4o|0!Ie#r1oPtGoLLRajvqs+bN>?{jmOoDgQ z#VKrao0~2A^Y^{sBY2qqJ9q-cxp&ZJs+xW z%Z^*~G^<1TBgh^Sb1IwlHE7k~l#H$Tu5G*q$kNhCb?|D^%e25n>V8_ntz5xs@icq3 zCaL+6bfJAF>^xNnIXl;xvRM~J{uK$UZZtJ%>Mt$|^qof}x$pS8Ds(jgGDY45dV!SzCo#=t=>tiptcIjtu~z0Wv}oeAz~z-=#!}tk_iOZ@=q+Dj}?*B zS!KmEIlVa%;qcqFPJpAf96Jqt`^jv)DE5Aj41Oaa`sm!umz6{=7Udrg^W!eNZa?M7 z_;jWSl3wrbwaSBbvb8^ye6Z3p($Vp%q3?~IdK)IV^h>mERHsl~Ok@~evvuj;tS)|T zF^8wS9AuND0sR?ax%4X^G$h02DQjQp4D(O6|E>QQbqGcMkA?=3?W~D7N#DL>o~CuQ zri0;B%Tni6ULL$VQC0-ibEacoQ}e9eyv8*)a?nF>J;ln+S||N2Nu`egs7?IO9J8fUZz<@8b2Ggxde)~vFo<#VuL;DaRKvjiT4PeLB@ zGon(huGaiV)mDyk_x$H0OhJ#HSTW$;(9o$-{np7T$?Pa5=uV9D7FXrKqADN_gC4X4 zBL@#mb|7D6H<)_Q^Q(k_kZ}KigZm3IqZ)TAIZ1N~<%*5~O4i6Fu|WM~sV<9i-|cDW zWOe1cVJ+DvKr#*lpR{W zPrp!};p|_U{pez1X0o-D64^gTzyLY|Dp;1>&-Ic4X0Kq_8u3uB$ZU%<3?>$Ih)9eW`Btl^a59odKwBn zDDJuIrV(t$k#1RRw42ilA9G(a95`?aR>!W;(&J?N_%*S`V&R45J#*QSMQADWc-He^ zrJqv_*w*9nsxBmCx838p3MpKZQ$|2WdKYwayYMS)IM@Uj4 zhXjRks3uLtn_S_veG4}uM!T2sciZAJ^xA&&P%Qajq}Oysi3>t6E5u;a8Uh3GkMPRkhKB_fLvnLjawOdK=Dx*Iw^+kNmMf3yR z*C-Z}VQ(yQsW^OSJTb)#90*O>!DmgDQWg`4nA1&kQ7L2l%?0dNCgtv^IMb|dtNV;g zS4;yp?uHUJ0kNPW*l{=tNJycpxZ0R!i*kSVSS9&s(z*5b|7U!G)cQj#v{dx=jfZje znk9qMc~|Um#{p_Y>*p!g?w+3UbtFuL_(X;dj^#Vwb2%=1)qm7M>&g|?V;QI zVT@@GKQ9CcT7m;3dU%P`eYp?TC8BpYn=W-LspsCT5N*90G!=3g-Ng@>BGRejw_5^| zxM*5^3;aUp7!20Yg0DlpBReWBFHvrA|D8Ngi4kf`OC?auNXtPsp#Od<#tK@^SQ*gl zxB7%%Lrvx96x8`q08xdBkOlK%`+x5^TBiSPc|>|T&E^APEu>VO2@fA1e{)rppx37~ z!L{*{YHlnP;_*3Q$23Ermm*ufJyb4Eo>beJp1&P17I)Ni-GW(|C@4lH3O-#fVw5y zxT?wKp=|q@O931XnvkYuY!!Tm7pQ8?0ubakuxaXP$NK$mAfQr8s$MKu-v3Sifc9A) zT@3oEJpO&1at-LTG%;@$W(g_^%f3Vig9-wdMC-;m?$&6)e{Te^Dz%MZvHs7x1Ap<6 z*1z~@9Y!O8bG$MjN&ET6o*vt*ip?e{65j_h*J=>KM7ajj@WpZeLH=&mgyw&bS6Bz` zS{WZ#?jSe0sr@x{|$_+ zg&@uTtu1Q1ava6L3<6rRTeZYf3a31!GnbZlPm#N9zTfc3ZQ@N`iS$4@gQMZM9rSmt zExl=nw|?i}DK2)X6E}UkeJdC*EmclOOGP_QY4ly2;Pg!i|NHZds4#NImP&G__P4jU zX%z$T=m=Y_FK~n;awkZb@`lv0Pr4(sLKcke4;V=HZ?WY@O*U7iS~$Jw zYfj1#BT$DU#0JAd2x?_jp+Bz@9E*q*4@B$tX=ZU6;EDv{;||%GKI(!>VLCgP6vpU5 z9wcWf1Y$ZcUtrb2$*Qp?N>uUd11u)ib4 z1xXda4I9?S+z=2I6_u^6Z5kRfX49h>^Z(s4V=ojsaV);mT@Eu_7t47cUBDI&c^#4o zR~egS=dD_n!mtQQt0$nuj!u$io(#la%FQb4`Ryzj$Ny9!wbJIhPLl$s?87zr!*RnD zy>;@^%xr+GS%nHQwzETD7C5{2Q5F)T2(+puS_oH9Yt(>_K(S*EPOel#a(zpf3m-|0 z@i`5NQx0BcBnKx)m|av9qX5PP3ODr27bInH0L17giUPA(b)YKns95C@8Z$68mTB_f zD%ud>jE>0uHF{+d1tlek;(0A%J_o2q%=|`t-+60Pdeq+D-W-7T<^l{n7x8k60$_r< znR3*R@BqXDeLy><+C8qKVlX=3Gm|g2=?(%T%?aZjE4YqcAjIQ+uPdyN`Kj-@v~+f) zenT&iA0{pLl;{l8PPg>z%IFoK=y|m(UsR3P;M=k*#1CO!^3~fBQ(ZvPsFTm**LDC3B0?)h?wbaDLCi9} zt^?B=Ng=f7KmxKvc*iqSX!4hCSOoNgSi`5oNQC{VVzEtsA@(bKV}E$v;NEU@E*3NR z*X_=i#$*9#V6csh0%WLzLPOTu;py3w!EX41xf;+T%2HDBnx8(4Q)D4hN%4~~NQ-v2 zevujY6&JfD+996BRGc>^;<>crd?J8}5td&ufM2-8Ni`%ioczr`_D#nRcMF~y?%f!q zw&P$bi8h+4f>S#9aLt{~Gy>n*4+T-UM;p`_Ik>O6;VeVG^5Pa%IBUk6 zq&i^yU&kz&=QmE3G!BRw!+4r0q!Tr7R`1Vn54`a@M`i?Wi`uk1M^jmwN^cwoOMj*y zGjStI(&LI3&%**MRpm!(4HtL!%~@pNlp;rKhBc+sl$4qU8=oa8=6CN03tei<{y;`xgQg6=dGnv*h$eg;^;&q~w*gH#_(W!)<4ztO>c+i(U?7 zk>!pf0iF~?0e*t4DK%_2?G?QsdT-r#IPfvsDFgUR?K&(ADGxc!j9p?-c9<4ODOlw4l*f<9v zz*&RC0eoXnC+C^oamw^yR6d5+>Asaz-@K|++Oh6ivd}%k+ap?!(OQY=WQC-?umMO! z(IJ{j*{>3j`}Zle{i@xjV^2%#fWN>F1jSF-=jsZp5KCN^Cf?3*r!Kl+iaPql>0x(j zu#NE3a)?;!Q2OKshFR!#NbPR9VqxPAe2dfv417(c%WQ+DfwcV=hmERWcjDqw7lmv- zGdkD;6Z@*4<;Xy{GjMnr78VvUaTMrlaWR7sEtRaSAMM*K=`a*C{O=TGgk#>?-v|X* zaXf`4T(9MH9x8e|_?W`Wr{w$3mXQR>!7{h4yM6E*mtV7zf{uDZA9`NyWf~KQb^d5m z_>vtw2<$$?4ysXSO;7Sbf0jgOEj3@(U4Xrboq~^&#ov`*ef5ZHoZ(5HlNB zLxCB+N_?N!FJ*0AT2s-zcVUd_v@tHvB_%9+4;Rc$3u=sAishw7Wq0lG=CLU2!on}~ zYy%j`Dm@*~$Drv#y%=6BfpPIDCKD7rCwcfyB(&oBr||ERujs29VhxD&An#z3 zr;4DrjO3ETL+1zgxFoy60Ji%AH~l?anxS`G_s8!N(4K-jGQ(RIETn!XWo*}QMHD&k zJPJ%Q2Nr!YGSWk4CNKp@&%U|DD})eYr|T7}1>afGd`;4%nF@k+5#W-fL9k@#DsNRR zC!5!M1JiBr{3?z~_~iO4G;SE5h*y>H;g>?W*u;B^#P7)^9Zsnclhsdw(CF&)TjZ#H zSjOcrXS>zxPFN&(IVu61Qd0;NYiws^^SJVpow-T~8FX*aA)rsF_1H%`jvjU0bj_7~o~2R(A?aBn&HIwyh60~2T!f-K{lHQvKZE*S9F+2Z#$eNp`>U691?Qa)(6$r{dp!n&sFYD>AE;!#m?N4@B7z*ck3vyx~hCVXpUM!9H zWLs!~@B<`r)Cp=m%aJ#X7Mgnp%QH!9J;$I5Eu1$`8GlH>+}W=_IUV&(!xWOQ&sO6U z5`DP}-CLql%;0-@&b$~xFiRn4ec9P}wy0>54$16<+%SFm+K=cENopkn7`t0yorX zRHN#FKUF5>v%Sl1^;y;u^i`_F;^S?z>+kQ+tZieT)HmMr7NuJj<>NR2m`2dE5{o6ehat-Uh1GfhZ+yDdw9Q55(9|SkhELkxCxbJi2Ktwq_; z&jQoaT80ARQiGh8rA!qpa-}p5)7Wl~j*honsq!{z)-HVw($VOagqh#51Xerk#U6Wd z>3w<=g|gVMX6U)$yhWV$%G z)7E_G@Ka_n^Kl>R2<|({mh_jG z*Y`X}a4FK?aKL9PrhLL_nS!oP{_+xxTMZ<0@kJ-iI$JJ2AL%x)|A#JeRL@%{h;`gJ zA)uUPzy;q1;`TquP5}M`66toj2<5oAz2;DKq-yd_k#F2(&zA#OlG~myNDp+|xT$BV(_(Q6an_O|^v9IN4wTgrQAOq!r>RBeK{>b7=aR-@ zGAj=kK}jN4Y@KA1Da_N$erifSuW9re23H=)W`moSs-E+%0!=G#A(GPGX@#I%jm1pV zE^GuIqo8r`f*z1uV@3w1P;P~x9!?;v{Q5#6cy!zaIP{s${Vi*j)IIyKZbVCk+sJ+d zRu=)^Jw!U?`8!7Zl=A^CeS1i1#xe)zuk!&lvPEO>+7hqpFUM~iw87e{TPkE6@{)eB z=+~|8+MVhFMC8h*S)%?gw_d8Ms=2wjVjlk6qZOW9;u)ETFsVwJ*%npJ3U8BHp?HFO zAyC{*L?juX5u)hjEod>KYjZGi^Wr`Acp_QXI0#(cCZcSd-NT?q29kh`*ZUSP0zUwe zCVQpocy=k$&FNhV18m>`U#ZIq5~CK7zNu6XxDe&!yzIpgHByCM#Jj)0CtubELoRxI z5;-|lIg1nqDuFgyW*@}ff~@BiR3Xt^X0&A|LF<^NFil|gZC zOV_vu2@D=2!QI^hySuvt2^QSl3GVtmoOAE3_xnK=Rm=>}?7h2p zcdyl}*Y2CL0OhHwC>p_^k(b7D=Xo23^zN zkOs>`Eju@0!_WOI>nNbm7nPOM`1tTu4BB~t(v_aN8=7vx?mTvpIpqk?MIols!&SLR zasJhio9ox}`84@YA>LnVh4+LBrIUuClCWXgI2o&x&m48mx@5bK)7m+j{nxH3n1^oE zU6Url#oVTsLbQdgD>5@5504Ui&Ajfb*~MPe-5fAAw~oHD)qffJ;E_5b?r<#+Y2W0T zu@q>>?sGW*7s`sE4Hw7qhlr?YSTA4suEw>bw+C(-*wkuC0av z*>>!{7RX27N<*poGY~cqzOg_S4ez!i5qB>T+g&geXgES<@}QRW+dXbkJMFT}%Vt(P zeTV~Y)xPk%#b*%W+%x4uhMA*Sy9c*~UhV7IZ{0*fN%dy{oJ*glgW9~F<8q|fqQFlU z-C3$^IkDlNG@V2gg7JXxNwSOr)Wx2sS^1BX&OaBeatGz^X1&X+QYgn|5+93Uw5-U2M*U2AZ7WMs-L zk!r#ljniFL7D=5&J4?!8*8$4kjNxT#?YCs~%M)cRU%E<5TWg0|PD?^pH|H$b#3Pf5 z8R%o{oK8|ZO#JkXB>A1*NAShc`vSqS{)p@ZM5xOjb4?Tj5)!icqG7!`2)w$nWK!jt z)z{^efT!=n2P`H64-*r5af0kUH5V5y?p zBbJ|W+otm>EY;rJ9T=< zX_Ex`?90*r9<3~;CCVDml2Czm*<*N>KkP!yadETvAwM@DmO7l?qhT6Ev4(78-sQx9iI)Eab*#{l2;p z3&;`G+FT)S43!i!A1;2juf%A<_B7m4ht$xoDzU7+7P+Dm5}F=Jnz^%AWm$TC;A-C{ zn*I%(BeHc%>o+F>fN0?n5gW5g`%Wz)28Y>#?5bRNl&O+RQ!Gx)4ge#81iD&+`cGHKB3MCnPIU=`Rt*PG29rohgZ3hM3;{go+ji-9|_bdmjdlXw^lrfL_r)> z{p71qv38*9cM`~m_hisFCG0$2JUrE6Im!-%nOo245b6&_q|og2DJgP=a6?1F4iB|T zLzA_zrsRr6VEpJjlqbj#!Ze5!d^2!XkeSN*>ESruW9xiVV=Ay+vH-sN?_Kt?wKV?o z4L3Q9;Um#P007%rh_|%=AF8k+mzHe>C=2=#x8Tu^cG0|Q?$MdMhf;#eo&J2iD_ zNegz18lJd?_V?{?qDe;NrAF?>J-C4Ih}N8bpVP~&edNeXKvR~|bDe%aKTf!ULzW}t zLg_BvgD!9Gd?KD9LYSg^;C4XmQl^#5n9mG}Q~rGoLX>=mpNf3SG9$tc#;>sL?viYl z;pE*TA^xzRr%BC-5?S< z=5VaLJ;g4e*29bu_&jc>mHB#*@`zdAr>;%rhZ^~ClPX9Nw+(u`PQj-lgI^Id4u_L3 z$!Ok51nN^UmhFqG{64zdbJ>OQXdr}!KVgNnGok{SbPIT#bi%%GaJ}ETW_#JYt^wcupzW;9uwV5@j%32+PY>o{3{A2t-7oDn4(I%AmDqX|$J8qW@a5 zvM!_L{S~SQ<0NY+UV#Lh7(^OS=i`*BXL-Bk8yU$L$~vd7YPEQGGyjtsxQ|y_pnHl& zyX*-g;y6*zhj&mRp`)oc+H%0mP)g5Q+*tRO@S$AP*#4WFt`xl=p!g3+7dFaPYXrc> ze-Ssk%bFy0{!TV5;V5SVnk8WWbDilQ_TYEkH?l}mElry|GBlR4Be}zeq*mgFq3`!) z(eZ7007S;5FhnrpTWT7KdK!;x3Z0h*t15w4yOpo+sV+Q$1vuKejPDm^p`4Z;byTPF zlHm37Op6g0XTI~{i$Q8h96YRS`*^RC-ecMayi8YgTs4Gz!_FLA@YBKGzn1ai#}A?N z9xDZ>X^ZD4r+*tB-m<6FKgAJAUJFs4<0I3HxeYElIjITlrGsvE5yir;pYrQ_Xh~*mGhbhSD5-vGYHCYstfpC?xi~2$#b2qq6o62Gutq5r}g7S!X+IjFearY|2SNF2)nh2O(4&e3^Y=*^+U z0ZC<})XMdjgHG~`NzC=|JRR?LPa8Yt>gn*7I~8KH2z1_#K$F7~AI?_KS1~liM-t0A^)-$Hidz4M6zNm{y#kPsQQAqROiKV z1M(Vmx%Z-g-MQc=Q#|mDx?^j1lZ!D=ZeOV1aypfk7tX0?jvDGi3yfV}A6)vxCZes_ z_$bMVA>fJiQ1NkPM7Rf6qVlBHV+CY)A@k5GbE*uVs`P2^tEQ@t_Y4)U)a!s@TPY1g zS4J7J2DXI64i!zZ(nHW~u951P3oGlIt9T-u&W*8i2N5@#m0jIS`$P3 zlh5L?6)0cb>FYjiz0~G4GM?z3B$Enwb{_I(JLjmD`b|}AI|_DBS=5tI2a1r!OZolw z_4pE<3hX$XuZq4bk{y8`JM};7iAA8`3Iy-i0CminKnpZa%jnsQYk^X@1pNpj-+EQg z;Xml#!y<%1K!rj{&2EvLWfr}Xj9EPSQDa=sysjpdDA8yYgrfX;bHPTOvhazauF~4X zDO$TQ!iT6}isrPb39i$!>rcs`8>GdU|D9&J(t9;|)zF182D$Fj6pZxaguNXcTVyz@ zp5Zi!a*^%hO>NDzZl&xwsSYNS)Ajvr*Dz}FAT&HGBu58_w6DV$-7*%>FbI;gmJnd` z3Fn|k3~r&{z$ir`W40V0G+}{lK5=we?_>CKDQsoYG)qaB3qKPO8IJDi}<9KFilwSBNu$DM}Se@8_s z#Pl{aEfFRexh}KH1rM(mK$~~dS#MgPa7m_wXUBj4_BHI%XR5jh5T>l604`RYzAyho zgQ%uDn9@SOgEjJ?s$}TDvN+l4*nL7ggq;wA0l~x$!LY+BM7ARZhW?8iTj{DRKnO8I z1VUmVDliG1`|?yvFSMwB{zp9v?JbEpWc&{wpO6TN8Pg;V>AR*cn=pNr3eAoKcLCly zkmyVJTR=&B%J(e9C{LD;VyCeVIz?Y+LFgkvhQd(cX1V%`7y^xsZ`f|e+g%7}uBeDX zC3DvR2|!C6sw~I3DJ|_zO+waLi9nW9b=j%MJm7vmp-i_S@XVCza&*^jIhL4-CBa=A zDL1=HGzQ#{`u1(*v9XSJ!*;vi3K6f%?OTWVF@74x!<5`Ta>n?VcE{~>BOA0ee-@7e z&7!|Y45ZaV1Cx{VRN}+wj!tzK7k0(?#=iurgxQePcnhcY(y;Kan7-(F|3cxp4h){R zvcJF3FxAUXAxd5il#r+t4CkwQzHSM+4AcB*R5krj^S$&LBS!nfw~@V^8S+i2$9c}z zU639yTpnrC{QGj*2OY+_h(Bvy3>lCTh$ZV+ca-%TKx79e~HhWNu_ z+7(xgtwys9nd|lWL09w=@JON-zsxEMb>a|!$s>9|KJ@JB9o+M{5%5lAEgeC34IkXUl3x!Ga2tm0!bP1?AxEv2fnf`dmzyT~_;PFfz}l+&Vf` z9f!6>M3%~pg~7n}2iCqYwH>pwSPSKBJU)4=;^4a-|om=jj zJB3~yw0PED>g*&6H}o#Y89O{QE51O7N>!bSp_DNhzuzFDo^g$(?%5{K?G0#G|(e$ZYgLy$dcpEd8>8pKqlxl02EX#??LK zz0D-Gwaln-t;YCi`o@RPH7N3%GtK&rgoX;gfq{XI+~7%D`V!-Nr2EWRWIZ6L{SR3W z11JPDgRrpl$C-z|vJl0_&U~LqfKowKIf}#Ej`C9F^sl<-bDq433 zG?k~KxAdge19sEJRDhDDu$P8+D)i#g!g3Am&--VFFYOk6Pvk7?%M#t?*<-i#FeNKT z6}di7VX?KfsX=PyuIP8^Nh)Hn>SpX^t!f__Gw)Z=DmL@-Ma90gN>M-njjzc*Lqi9| zXlt7oG$Zho6`cg!_cMAQCY|^w@!$VQYMSVSNt>kUS0z#uqUkEoq~LR2)hzqsqzS(J z&`LcvJK6&OKSpH*7*Z1r;AO#m&sIrEfk}N(;<}dNNG&KZJ!k^Eu8U(KU7?rb`@ok? z@3YaciRH^nktPm-@gr1&_MKRgQI28#@W~$*Ql$JUKrG4H#jg(d0i{O2CIf_W;C6-J>I?dCyXa=nlEkFK9}BxzikTxz+rxJUsLqi`)>>@FZ$QLQrNf zSEm+!q_Nfq$7TOx0g2bq%;L5X)=2)3ss^~CGNeKwIro3rO8A|n6XxuH#Z*ckv;=)) z6RHbwU}_dspQ{wV6a`$tW)}|(Bf%Xa=RfFG&M;{q6s)F{jp>Un;9EoDxiA1)j|QHQ zYj6>WCxlwzjV28^|D{X;ssM(;>23{u(4iubgqzl%Vp2(GzLPR3BW-}q4ahX8Iq;_g;tFwLD)U`)E8S8xlk=U zCJ`n!{Myf+w*1s!<=R29VX;F+%d-y50JERv%;y}j)&6LA5f;ZF^J2S%{%rnn=3LGH zQ!E%?XZbT)J~kp3p3n!Xi{SFKqfzN{$|kKJ2!#){dMkS+>}cARu<6(D85FPsdX!xp zKsDU2+a{_$!myt&dP$MTv~M#R_>zyth7R%#sC~HqyD0$CP;_a&1kj`gxYC+`Lwlsd zFr(m-o?y^oMxQG?1@k9KLpXejbA}SV{C}lboS}uFH18-#uYZN%>X4B}Y$7fYou2J{ z{vcYw^)k0563<3LN54Po{A@Z`q(WkGko`%G4GEx?W^WGu8XC%GMB+vI^z(g&N~4Ql zn5^5`nfb8u9A~lQtNR^?S6R=geP1lE99*%)F?tx~MQAXen)K3iTmT^Aie^&;esBva zAS1sMV6+`U0>-SrY!DOrs&L)G3ZgnuD!8o^o~*SXrOoaPq8Y|>Jbbpgs^zWKzE3t9 zt3{d34`UdTRFnx^WTnFpPBI7?MR26bHgDG{7x*8ew<~Y+47-koheyE0@JG64nllf# zkijPRPbI&T`#V$*9Wxb&tLw)E=>M9WLh;>-n)vUT5@6tLQ^vTLT6R)oLiinZ0Tdf+ z6b39$C|6(jf6qCjSLtTyUn{VTj0}+cCE*hOxRztbVf>fQe1Vvux?$)HtvKR+fA}ce zQbTre<1fR?$Cz?ZV&?tY-~snRx`d0eo{P3Qp-U0*pt!hL7PBmH(jxu~ucl7HoW$Fo( zr?2~!Sb2pxkc_}43{Bzb}=SlWh=X1g-X|d*>OJCvnXsugw zO#uiR}NB7DefCkkn-1rh}psUoE4boJdWzs;|77>8w@j3%#Z8i9wG+NMj?#wX{o`FVx?!*p)IENpR+~# zYC#b)$)@wPfE=c{v`47e0+B7bqD47hFUNT9f2q~Jx-`G%pe>-wL*JTmjD!@8xK@bf zDP0%yE9)`DhzOHmEzUN6Qq?HsCLl`x;O2*|#{cjWCpKqt2&%GWV5f~ZJ0$-S+UDfs zbGwtBjP8>WY>sTGcf}OVcfR%vldX3#hfnIiacSI6PENiUjtsL*oSPv!8wGFUEIx8rJp&ELHA zd!zfmaXdR`b#qPha>0`eA#w+`-cG-@hl)DW)+>`yMX(%QsrqC9lfj#KpzIz`<=2l-4TIn3$RZ6M=ECv8!Yu0JB?#mg;9A;&+dWjs0$`57hYc z%R_%f5u2KtZV>=HKl%Zs>Y5h4cd_N6fByXO^@Z?+2Kp|5!d*{Nyfxe%gvB@%v5+vy z5xi9YqJCw)PkKf&Adpc7%O(tTB_+W2z%tk^j3Wn%2GHFw|E2bqVvUd zU}&hmgkw*3rAbJru`R>*SwqCy(D;>(=}=i$Q?J9y+%05q_o4~QHq}us(uQ2w3Nq7i zx3qHa%ID&dR(|4DVAEy)^>FT#gk5~8j}0Q1`tjxRr-1%h)1^S75K_e{r3TOg?TgOg zb)&ngU_MWcALen^_{uc0d!D4ynt07`%Xdsj$nSLm&*l2v3<`3uBJ+D}tg`VMnOo81 zSofdBfr<kPXin3X>$6jWwk%z>W3o-qiZzK+;a}9lc^T3cz|4Y(!rh zejP9qwb&|&DxB3P6Eyn~>Aim|F!1=>rL(%BReNRXrp^<8sTIHNVD$j@X(WnOywjno zMy7(emm^{wXAW(B_x;^xXJ}7`$BkG%zAgj?OSU#cEZnPPQXEQJtvSmqSJ2G0kq5JY z3g@{UCe%WwXIyCYuqpdKriIX0FF`DwK<4D-rq`PDEv6^r$aNnG((Pq)D2wFiY7lb|}7qaRA?9Pq=ys9UY{ zr;7Nhvx%L@%he(>I~*#rrqo-yM9!6j6Pv5yIE7e+RZeKEPkDspo5JinPb2xFKG$qb zmSw**uoHc{Pq3pH?-sY1iAwgWPm|{=aLfaKZ2!bgop;BszBljRK6?~@u076ObH%+n zW)yrzksBJC>=tw^BD=zkMgk^nmLHI^i^e8QIF6<#LyMY|NO{*F>f=dlkE z%6L8(AxjXMAF>rcoRZh%fe}~p9Zjte%*noN_dW+#e9LD1%cx4R`ZxE?rg{Ei{wj=f z%1`B~ckY+>%L!oW1C^a1c@6`~!3+6O!Ws16z#niJL0ZMEb2~z?cSZiHv#jO{=k#b=ax8 zx*m~jr1vqVD$lyl9$V08n$k=@m*2-u+wW`{A*QG%cMJYM^F?KMxE6d-;at)=5FDS5}Hui(Kk1p{s-yQ6!b&Zp*}#3(QYiZ5~G$Y>bKQ@4Qsh>5rDCB95#9TuNs=bW%cebu>% zJx<%RL(>uK3u6ggCwr2{fHw}pc9?JP#_#d*PD^l^QV=~oop!H7S2%G#*wZIZc>49LzY8C$G$PB#sHdOh4|*c&jx7q+?U*{ z{VL-3F$sy7_!G4pixRzL5sE)EQ8v?Indy6#O?LI|!+uCoco@NI!5JCUVWjV1)ig1g z7@KcA)rh6z(aw(i=~?tnnwaPMkr7~1CNnT6d&iUPFQZ9OwEt1t#+;*QIQib5{WxN# zspY(?i0!)NxXDyr2$iwDTnP0m94`w_IaRWybn{BwOQ;!KSgca0>H@9uwIVpTuK+8$ z@GrFKM2lu}5nXbIJv(b7)2%jy4=Cuw+SX>{KDd9EPPQTH_tvw1^H5Zkgt9wVa<^eQ zV^9YbaY;DrU(#p^q7n<@ws4{?grRvsN4w&oNilm^q{3NJ$= z?qio^Z%yCcTcg@#+zHs7Asf}=d2`GPOM*$LQS$BtAPLwt^;u{49kDUG3h&&*>0Ry?YCY%1YT^&O^Bv zb99uU{+z{a zy83m9DV)}y#P~te=(h{!XxVmLmWM$T4fc}&KbgC-g>U)k$V8mU>_A&Rfp@B{Cgj6j zmUW5{v5$E9y_X@k6jUmeucaH3%p0M0IL zNhs#)*4p*U6OQ}q-#z!&Yg3Z6J6qR@$I921Pfv+H{P%l;YmO%&uRnhLrFI2q5aWnd z2|PKsdN1RV8v07KCk51a!+V% z>#?s}f^5AZuc!h(?I5|Q9iPMJK%Pi1!{OPzP1LHO}Q z#?{^Cctq@~I347o-l0w?>dsl{5Z4FWiL*q#^t;lv4B#jIDYH}XeopWEIOgl6i@VRY zR(t2e;oq_~|6m?iG<^fl`*QF!wY$$VJloTFWn&QL>k$Fl(>3w+%L76C>$N!B(`cjX z-P)RUAg0eFKYq8VwU&t%*FEQ&pD%ql!>h~M(eq!I^~=7s^x4P9Dax0ZvQ ze!i#WeVx0&nAJ|a%)5N%hkInc{pZw>RmRh!=houYN;PQU8-_J#H7JMAF64&2wU-GZ?_0^6#G z5ZmXg4m6=&G+|p&0DGLkEF{k0!ufXbG!=`JncjwLzqwh9iSy}7s0qt$QwjyaUCl^d zJB-(j{-y8QwcWC^p=St)tM-d~5ue4{35F+G&x1%_{J!Tc6Ml2&I6B|P4taVm^Vl(smr9{vNf z;sZ&V(-Ggns&h}f)_6O7Kx~E=W!r=N14`P}7eV>EtM9&Y52%NJO{ZOwo!u_oKKtWP z2wL{&a<1PATjZNu4w_wZ);1?{Oy}}Ubt+9)vQSC<`w8Ud+0yG^Yw;TcA29VRz#kCw zXAzeQV!w^*Z^_R$rrDXzI9l=g*}Cl^CZ5DrEct7VOWx|Tx!yb{y9nL{6^Sw;Q1W-_ zvAOoxilF%nz`q6eB=}EPapyyNDMH|XgbmxXfW}l4Po%d$p}+HXAKu;`e~qL0(_(st z`}X<{K5vIbn7^^Tg*QE9?bkA##Gac|Z_hW4gx#$P!l&IV5yBKM;W@YSe#>uw zb~H8L(=O%u4SmbMh-ZDOOPgMVGN2-eiN$pO@VO@|=XaGA`_;`^H}EshTHtkRk}T=$ zHf#Q4UB&blj-_(Kf5alwdzD~kGrAVB)rT{lw(E*l$8Xyp>Mt=f3wL#9qHbi?rC>4x zd)0X%tiisL3M;vHp zLaOu!<+!7-PJZ{qjQAvtg0kTwNlJnt?&4JSoLBakjHmpyyqB7wpq6sE)X98E4^?<1d?}% z=6fcG2slR9vaqy~;eRMJ9P)XOVM$$BQ}1JjmFX>rG(_PR-&+tabsq4%K3>OkzwZyd zQ(1)-{`6Cc5AN+@8?#Cjim~SV3~l`sa$sWo7G>f!L7}p$4pK_OE55rki`4^kbRRct z$;inQb|@ghakCszoL^yrej$)MSe;<6e6IY8@CS@lsX$E&hXeX3CncriZ7rBhDjrgF z5&H){zNE^7NbiAO2=u*97X6^aJvKV7g#ox=BRO@XK#u!rdd$n2`)IP&4c`hjv0#zjPTcf-JmbxXNxJVk56@=%OF7DuU2$w&*hc16N^p-Myc2)w5cw^uG&mx6t5JC%~Jfjy&&>ge690U}ItR ziGPlm#=07JtSW1OR#9AAMr{z}t2D?k zTY-FUkDT0rJG?KcX>>(4rm-A}yR#~R#3b4e=!^MIZJy84%v77D5m;nV6Q*t%tBg{W zrwQ^h_JkRdm4LUvw1e##9j(9jivc5MtZ03!qY0=x6t3zi_ z4vij{dncPmAyPNb=WMb3sxQe9poirYbkCdX8*~Zjd8j3W$pLqFcQ^zin)tlRLQ_8; zMzx|{^DO>sLgM{+>YJwSXc0n12+U#?M@y))g|#JCF|j4$KI$AKMLC(%jt3Y82@X6c z6%t2G=-$|A*dGvN7&sG@T9Vu&`p_IO4#`QQ7`f7h=NZf_!QVCdKrh3~VyEj>JcS3XbbrFs{>d%;qrh5 zBftp199vTIhlqWAGiZcu{(Y~b+{B+5scPz|&?qEig?kRo%Qs`IItNT$5WR_naxdsv ziFzs_jm!cNEXm=&*np34m4UuyWm@$(Jvcn1A^Pq~=Zkie*J_L4$qJNevb%r(Mj=`f;mR>gK>n4USF0NT%91bXW#JZ4t z6P?3Wy4I0L_gzHxfB3lW9p7oGB0{{2XveFG&WBqU^EK_gI|NJBXO z^i|la^CBH*M;+-aFYs(1Zz$AW{+hnJ?j%fRxP7`;vc4ZjmZ7Lm1m zd|oduE|QXx<|_4!s8dQ1&YGQ9sNRc>{n#!IV58JZ-F`4H_DxPnKiEH9P)pc9Oh(%M zi63iK&fkRpoywUA*ivQ~`|9?hXe8FwVyR@Rd>fYLwwZH3YsQEODv4$&_!hKd!X zey8k01tk2vlD&po7@GS}rs6>pR%1OAYtL7WL)P2N!TOeS(P(Z(_+pL1;B#@?zbf`( zUZ5^?edmb_Ky|l>-qmYR3d(dslkI?x^6{esQ3sVj)6nR`_x*SVUU5e590|m_p@YLt z;y8E~1N-~)hQ02x#u5b{L4+(6leV%CC6Ug%Md0k8vdQpY85%ndHMza#-l1aD<1~Rl zAaycYTI8_fe5A1alix@m;lY6-0&EkOCWigS3T?;~b0OUKn1+Um=*ltQxO83_B5c(3--+GK(c9cApOa%-^{&1 zmU$_>y%fn5$kjF5Guy*b9xGxVTvg3%oxWiTpQO2<8Gp^t@vRLByV%Dd_y#JXL?iYxJrYz7lUclDwdhud(elmQh!UURqp0}u8;y58+@C*CVPD3B>F-zEz@z^ z^uv>sPz*$Ds~vba(t7-iq3B_N#s-F5AbvaM>`29D8G+oEnC&G-#HIb#`^2&IKnzUW zBdk&_Kef^21$sY(<3jT=^!BbSnmSnEbR6FSfz>3EHmLF^%UJ-Ler5*}MQq3~w)xIV z5lm1fNz&D7nnTR!Jq=FpnabcsHn0>zU^8T&%e$42eM1iwb6Mr5Dr+$td&Dmt(kdDZou_)Dro*n#iNvZ#A<=(}+NnGVE$~)#ZW|djR^*0dp>j^Me8an*NW@G^1v{r3L194qVpBo z^)3z+m?w;;*wj?p=OL(+b8kdh^|E?(I-ttJjr74aznmN7hjMP|8^zACkL#sUF$~_E zg+bTqKDep7eWpeKYMwPXFiBfc1Y;%pEiSRprws|?Ya)*6v|Nr}Zmz!J#MeX`Awn~v z&kSp1s3SWUK$LiBVYcQ1#G_6`+91RsTVT1?-@Y_Gz|?K7uJ)4!RO}UqNuPuRGJ448 zgA25=E?>H+=e4`OfulA5SV)8!QZHS3>#M1i=DWzm-BTyOA3_$;I^6rcIU)K!WlXSG zWyl!%nST!DgX-R4%_H8F@%Zlc;6sm!mb=jSMNTE!15YPy0tYhx!MSlcI2kR~4CPnA zw<}&JoO+xaA!U#foK71PuZ$Kw$F$Lc#BVaFm64&bfIi6O{M%|;rx)U{5 z=>a$0wxEc(t0wmB7lZ!EZx+)WYPT4#Cx#WXn*7j#LQ_WF7SDmFY^6ZY$KJ+u)1iax zkfzdsTU)(mhYH(_2zofBleG@JvE?9sH6IY2)6TFD{)2w40R9qq1GD8<<1N_=jvurn zK``=Z`wJg?E14z{^?v^PRP@$>uqG&IRSlTqH9S20Ei7OztgOutP1AZ)^lVip?>!w_ ze?7e)oh%U-ZG7m^%@ZX#y((m&eu7ed&yRITaFLi}1>{TEdyvBCn)1Ij5++7FFe;Nm z!h_B+qG8a&&0cA%c?=h2fwlsJe{Y~4lP}INAm^3hkqr1MTy3``ITe6&|E<`6)Z|jU z1;;a-s~qGw(5dCUJ8VvEYi$i%yV~Z>p!#tYvf>anf9*(6l^WE&8Yv%pNJWn*_#%%W2jQlvzf^y9` zE?1T{2fB-`=a^-Xq5hM0eb@aR9nO0D)cXM}a%tsaRV8tAf)+&hX}aWWLJkzPqz2iL zm6Kx_wTsXwE$3E1fHC$*A;)7T+&Y-b#$hO2>JSv^i!XIc3vNNoFr{ydE;{yl2{*0gblP~ znC_ROt|Pd$;*a~KVTofDMU`4F7o}^yyCUPqJ)cLM0)umXc4QWpaK>^)>e;@@fA)cd ztfpx5#FBnZvMSDD|07l+q^qSKj2DYXFGd}-I-}`ApQl+K8Xx@ITZ}1HUC_d7GN-n* zcQYf|o!n1Ds3cSnQ-}N5`;@dw+sosV9Nr&djn{0V^sh^7sQF1V9Yb8Fp{&2=2jLLZ8tGe_+!R3his zD^@7)VH;E?KbVpvl)AE9TD8*#nDN^GkuQj{wT#zFnSCaptG3=&$ z4X%0NJXuR`N7$s$9k13Pj-Ury*`RDkuwpFieiyn*jymwWjnK}0`s48i`l8~L8EXX+wUFJfcq;T8xr;v_R$+vdKY5!QkoO>WXE~U~ic?k8?{D zh~=a)=yW=Zlc|BfaPd`=w>w2n`mugzjQw7;xfNatQSRha$3dhI$?M6)Y*r%;@&(!u z0oc2zrw5pqM-p;=UcIQ<7Fzjf-E(|DCZ2)^2`YR!dy@)Hqz9o^!q*1Olaxf0?nn^QP$#I;Y>)dMu()X(;r07@IQ@m zOgJ#GRHLT+rSW=slSu|=m)t?kZ?t1>aQ(OJhZEf zcz0jcPy$UsGJ?T7(g|>D&w9yw*`N*UeNCmmQuj}ydzX>Ggp`w7jjK&Q~ zMs(ZwlYXU-@ez)f<#8?Uc+WC54dw4$9 z2H6rixl+|7b=}xvH|jh1-n!Udefz|;1kH0M^{>auCn561ChwQwcLa5v3`37E@yKiA zGSjW@t~$+DPzmQFe~)CpAysj*T+6G_kj{9~n|*Aed~2$z9blli85 z&ZEc;IJt~`Lg22fOGt2F15VbDph?V2{slm0)XN%`skFG*ytG<`?ENJ9Jv0J;GV9eh zgw@Ex-@|;*na*Dy{Er>JkC((9dBZA`B-WxH(Cj#Aj+a>EwucVu%W-I?u3ox}&R2wn z#Oxw{e2tV&2$c7gDjxLQaJzhJJf7L@^LA?DG6Tn9=5IgD+ml|9)YsCkI>=^)H`Wo* zpv`pJdcBV2KQvmSet^LIPSL8;ZQ}Tml`}1aft8!(@z=A%(7*ust?%Y^@z18~-Y~__`f)uRpQRstlZ04jqvqS+K zLwbE>G^3L_gk@I6n z+N+r_yg}=b!%sRWC=-cP`XvaZIZ)uVY6%5u)7}z^@Ef&$vK&*1YTwyfX%OwQY-Q@& zRr#48&0qxLCq9jqTWb!FI|Dhv#Z!(jUEhy$;_qtg!B$ou&l3uaWXmsE8B&rS|!2Pyjr{+Cl+@3 zmKyg2kFHhc>Bu#8YS~exg(-!Fj*n;7C;LT_#gyOUPJOJG1s9K0`J~m2Uq%F9D9=JG z&*M+HH%6mo>f)(p>ePk|-m8i0`>keQGm zz{?M)b2exAUtN8Kv^9pUGgU1}Qp$7rW)v|`uSn8&!jSwP5Y-$RrX9GLd zG`S1jAlFiY%@=#`HQda$Cd6-e1|g0E`ykcu6CX$F$M{C@U}^2#i3@u1tJ_HL-q4os zVgJuEuGS(IXv`7emf@Xq069H!`1pF#Tq*kAqfO`JQJmuSRN2Kt0@;S#vZJx{B2n#sWp7jnB*{+~y*eA6!W5F8N6cqc zyxB8KDfGU3pl~bW9!ti7L7l(d^^$ph8aD(GWu5mMlO<)OA{=%sF6 z-T;M?8G$<9V`yz^tf$vH@k&!xhI1?thQ~9&; zXZr<0`~{`Y-yD>V8Y28QF45o>`?GJs5WvXfx0>m{@q`o43a!JrENF|@@uCZ6d?NON zEq--*8N~$FRU!3=#r|sZ=_|zSJ$#ULuH-My))@0OtRh^iPMcQd|gx?`uqi+9UckZFRLRdX=k1# z+hZ;_E39!od>^Dp>K^BQ@3f)%tTw2u3M^DAmI*olx7(_*v2K~=O&(SqjXQSVbLn8L ze(JQY`}nlP83(wpvHa%u#Eabru({6XE89vBbXBp=J4Qk3Ot6#uJDqE4xTDn;C-^!! zZ*!2OdaRevLUw)bjq!*S5d3q_@ij7Ff8YYneqgEn4Bb@M16bB*BWyGB(H=Ucg2F6x zrZlwXchM|)6#UKKuO*UJYKBdYe{;@q`fE!DHs=$-($7ofwU-6i9~4gt;#tGBRPEzI z3yhlB?S#i3lWA+kIi^)d#*`%k^xyzNiYOmI zNc3;)aGa7+*QUgh+}6=uRBl^TZn=H#Iy!2m2WucZBlVRnmWxE7iH<1m6Et$_dhPcb zM7g5s_i!Jrv92s62|^YG7!S1+zr{{kVtgNYf0dUSs!FI6Hr(OH7F(ggggnYh&5@Tz z^*71H*BEZXGj3fA4hLYKe&f{$pwAtPon-l5acAC}Km%vCp9$B{V6FQ{pcjf@P586? z>yqT5;Me#>rPUbiRiGISI(BrbtdU)yg)jIj`aDj628|BFo7QRNUY5={x}s|qs_^Wv z-dkmUwftQT?2n^#@y_J{tOv{V zytx@plfAYD8qpvEo?iw2Mt?9Zid+8(?g6)>5mrMf6ddl$*Sjk(kPzw0%8G}RC2~+q z1YdX3_kiu}Jh-h83j~c0R>O&7eJvi!!GJO^qK9rhd@s@UfFyht-0+hdq8S+tK`-%J zE}>zPptoNd_*caHs+l!w*39S+yi?cEctJ+i3$Se~K78an;X)Z)CvGc1aB6C9o|>50 zzNW0K450k`zTMBm5jCbi)me`GX&rcN`zATRQ~yM(hF5^n67{_LnvDo#%@QVdh>@n< zPyKHhYQSx$#j8;R=80f^#Va%iX;2oF#gJyH5T;OJC}wjg(_#&scQ5+^?1|z83|K{jfJIeLjeP1Muu$w{NSt$%)%pj@uK5(?aBrDfE9xo%F@Cig(KgI z`Ep{O7fK=8%_vX&-X{KKpP+8Fg`n2x4| zjn5%Dt1Rs?$p&5dg5^R)NtCQ@$1KV9JRN#ZM%V7bVpY%`U`Mf*WR+wh*jLZP~2z8l1dcxwpSkTWl&&Y zNtC&8@idZo<==}}NT9?f>RSr;lXI5g4V|Kcr4NzX^Ca}#-)66(nQB2!H@2!{RKnn%`xRKHZn&MFsIwMSUnkmiulNc{9Bpsw z1sko;ZH-tLeJ={uOM62|NB}l65l0Tqk;WdKYmWn$s}f_rnl3w^344 zQ{g6>uvW8q!_cNOYB^)ttA#DP0Nf3E>sG`^mh|S#6{MW;wmF zkvROLjY0oM@A=@$=Avj@xQj zzxL~PO5;W_>teHGKqd9ufzi7q!W@@9Bqb$mVg2Oj`C*ROyK(bPlgHWPGifkN-;FUx$nUSW4vc1{ni01; zni}6G!hdZ|H1x)ScXhR*`(hXB8&)za$e6TX@^&RUFRyaR75cvA2 z8ymO7i^{duTVi)EPk`3%*BDYM8m>&9;PW!2HH*V-{@w!O)G*?~ib)kA*n11ArdXy0OlZ6EtxkaC25jk8$-`K*9OXJO}(Zj3y6aI*RZc&*R z0rC;c^XIS;Ur}d3MzLB_M!WkPb})bLFx)=-Xc)lsA_!;$t^AyvxMQV0nwqw43c+X= z&XBED3QbXQzKy&Q^l_ztf!@txx6c)A$Uq>P|Y&ZjFI5%-CS&m&644-lS4iS zNLyoQpv(x#Y|08LI^^gEtAM{g*dF$BdTniOiJ9q6>Gu<>bVmdgY!N(eK`Z%V-H3^a zf!t;zvwVi|@z3v_wQC<$5fMucmnpQYg3QvxV`~}dHFV}gjV3(f5OUGpL@yA%?GW9( zapBz;>INeyBPzsBVq?F7uHO(1%1k-sI8?-=QgElNM;6A%j@K3IAjWj8I+~*#kFMhFqxD&r?5YP=J`B5{Up;<`8=vbZI zg2ADEp6`};s{%svxgE(vU(Ce&DVEQGR9~9v9g=rj_=wliY9eP+DXdz11=fXyuxMW+ zWJ?nn0#N&ISIpSh*xd?Iq5I}lrQ9w{^Pb3bU={}8CKW()e?IHDB}o2VX=X+SP(Tcu zw&Xosq7mfw4q?P(8mFnAwRPN!UGHEtBBpjq1-~&~5cC^_Sz@#!$NU)zmQn^LUAY)E z2%0~%HI$Sb6a-K53WosBdN%>=TZAts9|b-&Abvd~bhBM|d9tz%TR4*)-YA}J(tQI1 zB|u7gR$D`p$Dv;cWwd#{; zjV}ASeZUWW!w#Q?v0wrF^^`aSv=v+25=CpYJ<$E3;W&hKOMnVQh4|Gz<<(LF4ixx{ z;?H z5H9m-hXVv9SaoG^X7AP2XGx#o;zV4K*rJe* zX}`zpz@IF}sic>rL`+(X8r`(qB$bGi9DS{o>*#^bk54jO8a%o=;I@Zs$-Bc3ybpvz zAh>_S-QVU5EOB5@yIf$9_ng z&5BL5aAlLjeAkcMwC~FXuurl7|2bM89nTwzbNuikpz4N>1yg-MvEL8eoqGdvEH@-$ z{pSat@L>0Mv?dRILQCIEMeo4(`1xpGyb3+Hd4WLp#}72p@fAHckmo(JpARP~`blkiB}($exp<^uoq{qp_% z^7`wEG4F;Ix3s$+41{IyE>FS;YI ziB#;<&}g>Wt|*_O`c6Zx18{_#>701u=>QL z8pd)cT4H?g(D?Z?yV`)QozF8Ip0*Z*^LZbKniI_hZhyu0_lI%AR8(6EVlW*w_jJ9p@>nxuJwx9X>!Y3xM=b}n$c#K%TdIGe3L~Dqa_a@qXb+a zrHSVzk{<>#WncO=8C?~>e>fGHB7ZmV=#q$ca(!5dr(wuQ4UW%)`WaEKfE;;ZYkf1WV5GwiOv z{Gw|6s^$MpYj;&4mvCIY@Qz9HzotPek2~YvChOeTV&=Uni?xR-q5`2hsm8ao!n2SL&E7npTp7G zUM;*k3NAV2_WbANY$N8=SIhwgo_}nbknQ8Et|F3O2 zhnqMUl%G|Fg{eB8v0vvkY{m&E<2%G295h#p;tbzS)t;`l=e?Z$cL(yp7*zsRx`>|L z`l}T$+kU$G{_n~Dcq7gHmK_za`+&j`Fflm2P;#)J6rHG`LjNcXx7j~FaErW<>)Z-gZSNK0fBGw28|c=vUMT~wpk z=h>iEm6apNyKkS*2ck5^Dezk-A4WIpE~R2CDSPzXKGf?)M9RP4Ij8y|CNBky)m)a@ z*yy6K50^G0^v1W?=u~XKON0}V21g#!`R#KbslG~cHCweqR27{UB2`Rjh@!Rp*gB6w z_wRCWtmRPMdb7j1(3^jj1Srj{ymWNDo?%~dowuO9DXOn`0;ZlMC8wr}>Du^WwM%be zG{5w&yQiySjjPeDjNA$Cv21+URmB&Iy*kho%4l0z5-x^DCM6LhhqkoCRbu~-9mp_& zT+{VJVSo<21_r+lHI1E``>c6g+R)r;B71Onk;expCeP5MHoA$I>1f#MCa^e?w4Z%! zE)N8ne~NsvrN`4HI3@l6eC|mei7G6?&$+pVd3+f2x@5dzQs;8+4W=|~A%ArE;4p^%6(Cy}D9?cye6Yo3}q7FH1tHb*d``XS5tsOE~~{T=E0I8Mw4^+=~Ek23ahTp)`O z&Fx>b0+_lVD$-CAQQhwIb2id>IKUANzpTZVKO*&htwqsQ!wBN%D7UfQDhu<6jx+_x zyKI{^bVQpK=%>E{vonwUd|O1-O+(8~ri)*R`LB=G1YMS-wUoi-16u$z@~^F}_2zP> z2wn~^ZrQ|84}O&bI&%+D3SkbSthNjJz8}RBu{IHL;+s1Ya#7Rdba=&A)Kpif_qg}? zFgujQ89Mj{I_|evR1U2`{^!E^Ttc~QUE|z9O{9k0VSbqH(hY?j?j-^~QIp2PxLWP-m8HGrx;N1A*N%HysJuv~B!v}_2u;ab;E;>J*l#E-B znxt^dI}K{IM72`Vn%>oP>oxC3jxmA?loSM(<9_3+-}>aQLH?ac(GlAJK3-r?YqqNP zi(t&w4CnnH7l>?=4MA3pHAR*bL;=_oflXgzk-@(&QS-Oe*Brk z(5;agr0$g`goXX@4nuKyGOoZ?1W%Iaog$pzy5+p;q^k=kOz;!55s%pu?Ld9KQ(PBy z2^fni)^{-cAiVZLH0RIbGZS4eoFw>=GynZEct{2zM-E_e>dJ%)ASzI(*Fjre9S%-J zDCgZ6@;Bk*02=uo#6H*Cz0dBi%pejqtZ*B)kCNWGF2O>mFP@2Xk)G4 zpkkxT{=1|v(56wPC#4uHg0hZI%k3!vfWAZDnbD`(LlxkTMc7$;27guVK&F$tn3im< zZ}*s-gBAs9$D=HWI?d~l+Y6MB|^UA*TWkH!=^j-gmsQY*46}kia z3Z8%ngOav(^M%=2Xeg$wq&r#Vx4!2h{ww|c?g8H6Lr^LQ%d=JjEvZt+gx~w^NZ#v6 zX@~{rzR4L&LV5Yw-rn9Ppo-6)oZiRqO-tl=G-aGeUr^mDfd6QH6bftKY~C49dopw4 z#r!}t9}*AKck<*Y7Fy60Qg`?EfN^&xJB*Htg*h`Ce3YS!S{VV{2UHSAr(RSUot!kG95w?j*oP<4ypVYrw!4Q3=j= zzcA0vk2^liKw{>MFo2s0bY}SlFbsb~xA<%!EJEOVkqCmW z$I9XmRMWC zJ?GDW^=WT2hzLgnENV3r(S9cDb?7H~y{NWx@@K)Kl(<}?FrJkeMa4D`BQXm{ zjF6U3KkQF_*Lg@X<6VX4veZSS<+<*X6WnPxn8(GU8f0Dl9&OtrEs5TZKUuxWha_qi z{eIX?+`=nVMyl&4y8?T*BOqEYw!Cr)SS5UlFRGOg?b|G_5T>GF>=62VJ6Frq7!<&Q zMT-6zC1xwYc76GsU+ZK5Kk|Ivq5SGS3(O`=N1F!G=(Ape@_}<5*^hZaPb8aT+_k1) zKg?^w>n;vK=cgc)ZwU^rGSvsGovML8|Gi`8x8Iwp+P1T%{RVDF;sK^Zbj8Ws0uW72 z`Z)p_xe$&TdnP%|T6;X`!h?w&q`V2jKyG0MHlkc(jTfcxq{%4{zf*u#EaImt!4&y? z(+B3M85tRU{P^+12QRTKMZ5R{bu{3v$qbPkaQN_HUEZFavZlx(55tJUk^E9S(;s-I zw%RU@w|<7SUlz@R@BG`Z8z`Z$1i0*UBMl9W1|xKGVDkIFu`M7YiqZPEw|9tQa3y$UXYm(-$nd3`me@{T!V2Szz(=5^ zZ~YB%i=_hNzF%!&+c$!z7GdI+n<#P=?azfD$T5+KfDxqMQRH3$(!DWp@xx9{FHHZ%ljhjf^E0W;jdVYq@I zXJ-DX??HTkz}Sk8o_^loS)Jy4m-ZLs3pOY^&;-dLUh$muyVYM!jqmaHM%{JLK%KxW&2JI`jnuwc(h;F;;IHe*rkX96)&SIAWhkz zp&{9Fvi9G<_z&dz2>XDMj9e}=Gcz!Gxani4Kl)WV;R@Hjdlph^0Zt!KbLbsSeKo`d zf^<3&@_gN5%-{)%CtKuG0LMn#j!Kn}0?c6OGraC%?0Y9BF5W)dc`1jkpaHCi5Qxzg z0eu@K@O~6Op17k2)ILeSH45PNxym&wisaKJf$&L1Rn^4U_;?m4;D)DbVPOHdTvO#R z8wia^h*HB#$o%VP@KDj2n58`e#zRjY0Fc6Pb^jk5!mkAqd|XlJ_6DkdvJVtIM{KZIP~oBm_2OjG3--XEMFIh zZ~#qBP6x~XmDxKAHlC3AuJvBL_9o-5 zN*34Z3;Im)6@^yP?aw*(|NOuzK|1A(E)Z$zii&zkDxkx&n5B5Nl*DWa+P%C01^B!m zDLG^G!kf6@=OEO??Gj|toYhBD6knR!XBVU8)e^5c^7h)~kF$~*cb%-iY%VPU7(4D<~YYW+tsAi)(GL~ zWgRR($h|SWyhic_2?E)TiQk^d=?s@Jj`~GkD$w)MUcx{{j}z+jI*Q#A7kR`b%UCenXlca`#jT$DyLj)vh|!q62G zFEIZz$0AXBtV%2q;2GG$KtL@B2avJpY5!g}u9>&#V0!wi@9;tMG|-v9pE(xC6YY)>!+U>|^%+Sgt7zMUvp3U4-PDV+Y03N<2{r3E-WX3>gj zh~5%pj((#kq2HddUZHjwL^MA=1OH4k((t@t47gPx=r)Y0u3tFd6JG*$hE@`oLw?=$ z?636J?2q*J9oUVdp6+vm;`7h$y-Sik->|_XjLy!=ISb{duC~7$s|JLeoI(~EsRouc zoB?P-Pvz!D^{d{lJyg6K+#Vr)v;9eWV&8GPp7^Ue)wU*6i&}Z78bId$T`&+;A5j2e zF#s~?sQ}u+1rm3lx&1nIzUhSUaTJ%P@Nunxk;-tTy_?$zL*Y)Mwl4H;;#Cx(t4fX* zHZ3)Hdj9S0>w7X)pPZ0I-aP3}6GN2DbtI%`eDxkhObinn_JRqGK+BK?iqj#NG@Dx^ z&zC(Mfm}SQO8gO{-G;T9Ktotjp=d<+ z5v%xX0cCLz8swxQ#q^M_Wa5S|{p-j{E zZ)2j7!(fDWA?yHa{pUioy@$NdQ94OLN=E?VenGF9D&S7U0>Lj|5PF@a9I6RE2}d5^ z##wtnvVUIDYy$Dx4+8S>IF4#$yN?a5L?>dQ5V8UgG8R1D)EVMfybpD2R(-fn zTS4Lnex@>2f$}9XOcaJ5o!${6b6gO(6aV>d8r1Oj{Lf}S6!$CUcdRaec!CEK=&tBV zdZNFZ)gA30(~9Ihy#WQNBepBBk9>;#+}2CJLT_>ws0&1nwTJw%?TJ2H6BMSicSEA% zqLa-TEQ-I+Ax#nHAsXAkLA!`GODgi+v4dID5+*079AB|}`61J%A-x8veWQsJs9-KB zY;{>|ZrqnNwO&nBb||#&n9HY6ec%Tn(skdjXYk|239Q>70n2NHMqcgQfR}QBkLRcYe& zaOrMRKN8dnQH*VdFA=1Fez`J$2zOT`K(ha4YMmC+{(*&w2x;G&^kJj*krPnQn4}?;AL|(nuCNXq#0Yz+XYRO->puP}Ijqd5h_LSYXpqC5_4)X! zl^gw;Ts~17tH0~!(?;imn{H}8Lm8Nu)&MGKRJ8)CU>{G^{-!dLp2#jDf;VPDk5>_s zV$q)gU~kYa;Hz+QMkgP0v<9bLlWzU7+wlkEh#oA_(_rTN$puQ1dS6$2&8BcQhJBJ@ z!o}G5jJi~G}O?OYSU8`Th%i-oM}#*Yq?!FP#hQD8Y*7bG}ghT#@WX6^LZQ!+0xuhQe8+2 zV!%!}ze39#P80B0CH8-q6X`&sU->%HBPD(~YOMv-G$`L_Pvj(s`>Ab4j64S(-U<*A zceMoh`5^*r{}i;^ir+aL?wi`D1Bv1KPW!c;Md4##`p$|kKzj!aQZDCXm7dh8;SZbx zsVtTr8!jFp6e!kBs*s4Y_;^wY?%=pX`6{I}Ao-c>FcdLfI3n;Vff4h?$9|7gWfidw zUB#1$MSl*Jxr)L$!@+rEK6&>wB#2cz4W^=%R&;~(PaWge{wCNZ{G8WDVv4iP>AaVY zp&t5TpA;AM+JpBiS#9FiyAL@>l&bCrTRI`I33O*k>hM;ZAKmi01dAwm1`g*6DjNcQ zdv!#e)E{=-Z0rJ!jJP?|eXB`ry5!(DnZ->3V-D z97AbV`b}0d&m?|<)&Hl~?oU!i+7l~KIQ?eq-a&s!Rx0j=9>rVc$FV_Ar)rYZ`(_*E z1&fUvFS{ zB;uu?4g)V_%HLtfaXv0hUDd`aXg7JBV7DTCeOqN8!0I4eGkPJV49cJp@tr&?^x6OQ z(i=tPaWl;WS>+^ziKt|-)oN>)86zulHfRb_OJj5E;WDh?zCq%fp$C>s>U}%5YpE>Z zRYj!DWm)9!-A7)JgW;E**}LuUTDo`HCw5TaASc%?H85Qeo3bPm*Tp8>=e-NYt*UMR znnbREKMZtDC2N8bbnRoCffhPDmoHrY>!)CxVWsBZr9bh8fwgJ3M`DdupeA=jMx{5mN|h1WYC{XNg@OdEfkN6H z*Su`nOq)JI(hSNJV8n!s7->N$O=SAZ*LaaIU1N4_o09A4Ac`nD+#CXGeNlqqU=XxC zPRTDlIM|T#`6u?(S97W%o8&QOQtNx0dEejzqZP+IRife*>Cb(vD% zgjG3IN+c(yFBb129RBCnm*}DxR@`uAg7n1nJ^jy;-Hx5ouY@#FV9Lv3hR9@bB|*U8 z+AYt6uG7e((R0}XI5Sc;v9_%fL{lt0+#5P2i`CmUECbmvArL@zJda@h>gDy)f#g5W zCk`MXLEDHHqdsKszdjNP8Tmchx-?9TZ*47yYj4q$(*x49OBz`1dq+pT1}{h)wYmof zT`cecK~S&3ilI7X;ybwGh1NF!)`_N4LcGpqW>TPK!-~uP+EO0Ud+AqS(X-0>+|1Sb z9R^RRP=;l#3EJ;$fUC+!Tl@uB#~>@vEt|Lm^|_)PFd+f9Kw-0o<5gyY@>ue$s;d-O z;&ydFy!oytMKX2f8}^zyVU=F3_+7Z!uEQgpCeVPSk$o z_n1o4mq(^$5*`=3liTZT{P(c`{Ld{-5lk;$Ts1kD6s6!ST4E+!;uAWnI$T%VC245FA){{OnXp)-CS2gq;-atUhD&W$F;%(fK6R)I; zaSE%1P2*?Fo6UPso-EqI+Um0Yy`7{r+O3`fd*$Bm>*AZB4I{wC?aF$(QUkUx>Pba% z1Ag`THGr#tKC_PdDPXaP3$u3LcRcI*{4hm_EE2w~dkJ8i=PBRVT1;5jSorvPgosFC z>73-h%!$435$}2LYG$kdl}nNw17C7m!|_m;=n3)Q7U&l;R+yr=sjQUjP5Iba-Aix3 zO)pnLyf*81=NMkO1o4w)C^s>N9`2--X3HV@#@ZY6rRV{GRtDs?y5U9>x#)YU^mF${ zO4)dt?Spw@=iD29qq)>aSI5Bp4q!si>&p+X&2v$;puO(NfmQ z3xRk+-{4pCQ7pXCn!*jZEh-}5*}vhj2GUoZ3>%c`oHQDadc-B@9TW!^(5Rh+GsDy{b4IHrw$#{7J|x%y%sX=e9tH6N1H_{%W%R}DRz$<5C9rTrzjG^e39TZL6Z zOxjI%g&z=>QToJT3x!?-icY||%!nhU3z8I<0XZN~G?W-dg<&AEW;#CF*V*?8&SB;~ z*CB1vMefLC*2O&s_@~d>59dLdgIr^=(BbDzA+Bb>o3bf?e6Tb|QtmFX(7OF5Ws%Ie z58->>@@FDU&Wf#jdFj9#KM@QT8>%Z$TGQ)k!< zFq27R96u|7DAjLDCt)E25EG#g&ieb4u@wYu`|zz*D|Q39Qy`giVfGNv?7Ll>jTWJ?Tt3T{@ zq#t1D%efT(GuZd@TgpVG9vy_h@glgy1a>|?Mdjt92Rz@&B;NNa6*eA-SZO;uW3lZW z=-3^<_0J0`{IP(D2vGNNYdrxsEzrqa{#w8dSTG~95cdDyQ70@)+D2|0gR@fR^f=)q z9XRRPhohqJK>NC+;j%mio>>9a{_fURgL)2iZJz#^)4q%{o{;lq)5#C22R4Oi-|-7| zL(vS+WzAe5=KMfBXTK5A_E#CW@x6uIVQgS7OBq&a{oce7?!fx^WdQk=IDB@p6BtlhP6#! zy!bRp%iGo(7CkZrW5SEIR81Mfr6fC@9v~Md02mvx@Myz&dAM8qOorh_=BU8ajd_qAUhHJcgOwW3{oNBVU7vW(*s zQKgd-VjPS0S%M?J3>+o`&9p%JclJ*DJ4uLLwfg9|L0{k~J?2t0yRG#Re>+hc*8T@?EmV{K4MHjK({G6@tAKbZB+Fp?G*N*8{= z=;TunF5kX)xRXAiX1dYC=4~MK0kQZTk-lq8h#C(Q5634qUM2z&5;neT%mA&&qe1+z zJZr(#Zs<$EQ&_R5Gi6qTk8^23EPJ(3Y@V8>Wc_&EOq{^r-K{Odj{CJkiEKPSeM)AH2=R;ED+LAAiQaEznau6NySi$j z;n+m8jXI5Pm<(xKx3NiytB3=6+q?u`y^EiLxpJ{0_R#DB#!gMYX8N5&Bt4`Q1>4Ch zBd0D|oU1pEVeZEEXexP_hl|Gn3_~aE?A6u+M={_bQ>5KpLY(Vzqi;>Mn-x2o1CXGk%|4xav+H4~*x}-z& zxD7j8({(pW-n95&>NtM@y-FgSb>R!Ydu!Nv{<$+G1Os_lZ}aB5Cb;fM`<<+|?st<< zw!ca{kvcq{YM8FmoA)+)Lmk%S#!(o$d~GJZ@tjH0)P~xb@VRS<7|9yy7b{8oJnuBH2GNa z)l{Kgk5hsc_x(KDoMGGeX+bHTZQ_woIj?}`GeW|4FBq6Y%VrRol77nJkVUaTE&KQ5 z-ep@B)dh9V|`eWLbHQY zU-;9*;?8UdQX5a}g2-Fe(+^+5J`cn_`~-y{B+}4`Y49;fVYMVBrhXz$#*Wi^ReSrj zn`h}kdxWHY!|788)t=Ogv5p0*t~LfL#+`}!UbhRrG@BxQC#SuR=cdqw{=q>ucJ{pC z8s}c)relu7)E(3?r;RT=5}K6izkS7BoaOeks^AKRu3&1eB)cppGn=E15pc}daiMC1pr-$8m-ci2m*k-Cz~SbSHJOxq-dr}ZrzOz zd|r^X;}h0Z014pbqdj>|V9`ri@$px$k<*)h0aDt_XBa#PWe~1S+LRN>Pa!}vkTVkE zhtiR8;hb&f6T-;nsu=~(UR91MWFdAFE%AI^H?6_g(2(dEwE5nf(4u8;tt8^A#wS}w z%5dC;x$7nRAC5AJ3>AV1@jJ{gho0}|5XSsMC2L!~1caG4H#dAtpE87xD;=pW^+PEf zi?aMcl1@QL9^!)@kY@MW`JZT4X7A2p!c7$}_%)KWkT-{_=8jUJ1qQIi&#tZ;5@q zIY+|2iSa4x?4nI2BfUcewQ{DBtu!dWkged$+NNFaT9hmPbinVg2oaxd4<<9C@CF8! z9lABgxK7n<#McCu$i*qNND&KXzRjoTVQyw7l92ti5Td8#s^p^O=?{~3$m4gScj2xB z{DtY`J9Kn(?(XjF?Cg$FOaOrntZuYW^A@-fY78eE--Tdc9?vC3-a}LX^)fBzH5*bH zp?aVR(1YlZ9bshZrd0Yc!SOD%zWYkA2FOfn^f0(C!PG32*Q6B$5UtTdqApg-=PJGt zKH#$OaWlbU>(XxE{V;X2oF(epEdfIqD@vmPjhZRD8$92d{4#IqWZ9b(VBCn^IG7{V}BI2GH@D&ZOrNR7owGd`YjfRHi z?CcDfzPjS?e6oh<-??hdeSgro`}=&X9%N@owryZjwFLCKd%kH2Q-^H6tf+$l$L#MZ&+udcyGuT3CI5%V692v{*)7Mk-xQuo}6w-TYkHcW?yza!_1f0 z)X)%Y-gVvzbbfFYc_9DngXJ!$aLYXYoP2oAIX8!H;p*CwmvUxtK z*1qHw*;?@nfnlu|beN2<9C;c>1B91Q59AMZ)G6&^&chlLS}gB&C-4fU$f*UUhMn{? zYuz0S7{^=)0Qf5bbas1EJUPnSAjD-*{iR<d!X=b?FMc3MMd9f zfSg_;=`QyVxhapaE~KuyjL*3xE*x(g$!Vp_J|e9;(RmFKxhhWB{ldPoUT!M*M0UYr zFtqXJ`93r~$W!^5)}aLCx0+Ylz_#N>^!0)%89f}3zKQ@y^Vr;Opi>M`UDwqGlyV5s zsM3jmbBNw|S~Y&RA$f|T0QKWqC-glz4gd{+^qZTjD=oo~z3H-9GmiMi$ZIxvK9ACJ zBjjs?&ADoQ0yF*%#%3u4X`SMOZzqAMesEUZI`!|y~ z&rRZY0-1x}-euNnDM?P7N&hI?FgmRP{#CP&q?Z0iZ1t4i;y|=^1yd;Kzv9->f)>J; z3QI$R8=VGR=-&XlzZ&>oh_g7SaRNLbVEnk4s3;;5(kp7}{X%&=RN&AJr2jPav?Lhu zgoFO+;R!UfK`_9=i^_{?FhJ4y9Kx>c_s00e5g(m6PJxf=_L^GbW-PPKMN#MjwGz@S zHFZvI?)8#`y*}^3%fa7Yc`j0_`>c;<8g7O_M-*F;%CfSupUhwK-@B_#Y=ZCnB-8Nz zQ0R~fyQ*SHUFv>LEVu;+fcn^4AZ{lOjP`jTt|x=STzcpt0{i_(wEOkoNwjMuo->ka z(NCfW=}B0uafqtyYZo=}`)~u^_?kH1xtBN0glgE$Y!*6b=5BD95rb9|0%S5dDaL+J z3kO4*ypRhz>4%t&#ojSJe_;}ONaUTDKtGV8vDb&%=+K)VAjs^#t>=3Gz>5m?8#tJE z$68LQKcY2KG*4J)G~FeSpiMq7pH*9Qa8*oSqNUy)Mg*hZ!{;y*MkZFo&Pyi-e6S^6 zU&Y+l+uBId;v?Pr^vU)1=OCo2*`@6Qopb5d#+BedGcCiJ#H_e$2=rG4N?xuMiZWH1 z%hE9b6=GOsnZB!QvQP#Nitpv6Jq|JmlLx_qJ@CvNCG{o+kI1^VM!MtW+4km^eRHhU zIHjwWs2;9l{Zi^I=gwpH3kIXLLv|<$2fa8B4d|?0BoV~Bt~J7?R)N{rHnA$!6KLTS(2l-k?v)W~~iP z4W}9`m1{Jy$>sfQq>IP(@4~y+c*Io!dD-DshY%D9ZAk%5PbxqU-bw)aQyoBm%BSbo zGAChxl6rO@jQzPF$ZxJnwG|ohOD|57eblTEN{-ff(!5HrcA{VBXQg2+ksk7T`dJnbB(NicY$9H?JGRdfDL%TI^RQ?nDJvbGHNfX* ze(-{>m`JZlsr_>L!WPy(bVQ9-e{ZK*JmThR|I$_C?nFh=lP{9$L&?uAO+0agAQ2O{ z^dRw^w;5`woXa!GAPw%8VR;XQ9|M9gz1Je!R zzIG;n|J+|zg$+UkI^~kOffmfUX_93v=aMg@M*PXGNmEO|NmdYGQQwUNIYpnHZ5#oTKg$8~syrb1Gx6qALOe5+H}QaX)+i2Bp`L zP4XZTtk)bI_NJyNj+E@|H5C=OX&E+8r%EOdf;qSWpIHM=h(WRI(= zU+XNissgMY+9emY*T{dtby{jYzBl;{c}D5?3*uZ4+{+)8X56%p1gB8 zTU*l?2YMLr^iFqwzn1-~Yi%PI097;=k(=LUf?{A#^UKhOU9x!>db-MZf*(W z3Gr#_#pWrx2HuOpSu(D7H^bB(d#KoZaytDA(-N`vn1dvpe#ZnTCn8Eq- zCEs`YtW`V1edF12&P63*262w-2kb)?D8YR=`lZsPcg|LDNAmWnrn0DAwXmZ0;%}Q)#MZ#*tE`6eExVYSBwdf_q?EhjZ!vhLN;8~L zB4-uB*AH8ut%A+2L(xNpuY|GwVZ2Nj+?bzWxif?8D(Q-fSeSvSniOcxKLw8$7uhE1J(3liwT9bkF z7DjPi?=9;f{Yg?XCM2n`ZpQ#;(Esh@nfym>>e}pD1|~dK4EVRknrXgO233V}*5w7GM8jf-C612}(#RW|fs9r?M-StK9S^dBRhmGRh z(c8KCP_Ku)m{~0rwT(AT`%N6Qp(CI3vdmNA3mqXG@DSW-p;}hf55;2-r!HBD=~bd( z({>OLVJVUnNGd(3J=tHhb3O7$z=>UHnQFQQsDF1q{K>sMEg7IhfyV$8wl9}zlNFS~ z5n%DwVk#&A83F!^mk*xa&uGYBOFbJWIA2I9K|?tBsY3WhVZAL+2#mljxegY|LAc;b zK$knqQL>GLG@-6-XQEKX(M<%?;l^T6n}ZbD5EZ=${4fsQDoBh$+q4RteY*AOcpQ`w zezs?8HKE2?xbO6NH1fn@DbRtouL|pAsB!uTSdV3Q%apxEa^UWj5}k`ikD{d8tjRem zWD1tv7~+!%Qrg02)NIuJ z;0TW2O1C>TpTmS>>lY1r*+$V$A?Drtmuylrc_H{#3vZ_~m?w543HUEC_ zUkTAuz8okVjEM~jLQ^n3-eE*QF#Lt-aqi{&)J(SEZih&hefo6wn=Tur5jUctqzJi5 zjs&Ga)mWK=1cDjXw2a$Z`n28;He(|EJjoic{6GRXQ>k*+te_z>%N>QAyJyOmMl73> zRPCx7S}cgH)f5>_Z zsH(dC`d|@V^^~e9@AbpYOZ2fLP|pU{5*kw3-T5HM6|Tt=mfTbsX`Wya zW>CY_4$n0POwclWHSo`{MHU29QPDC~dh<^J%XMsQtiyZaWSAX@$Z3%=viE@L z`sTx{MNLXOc<0q&^x?v3S%q$k1VCEOhBnV<4uPEL3jZzlp(tqW9LmFPI8Cz!Ekx>; z1L-RkISzArgZj*PHsc^fkxRm&!Iu{(Is_$1g|YWJzFS=`;}s($Oohc5e_);emQ;SP zP~^DI<~Rg}3QJ41)rD3mo1k^-zc2@0r;)o9%IsG6aVUib=sq?hCM;!!rYXx7H(Rgd zyj(iMPxhsxo=(;DP-)w@)D~hzpGj$WDVW*K3O^J-w&bLcT)icj(>$BW8$Ry-c=@ZS z!G6V|sGfS&L(e`p}hBmkryAS9Qga$YK909#gUyPOK!pz%s;k=krpz*V zu-cV*^drk$&e%$o;3ITEtCT>%+G4Yx%;Usr1WKzSjb72Aak=6HmV=Z9pl`_6EQ*u6 z$)04ulM4ZiS~rjdV3^LF`rtkKWONmV){fuI0*0VeK=(|sP(%S6R1vpne zq+_&+8U~V5Yjs^G`om!jfF&)I%&T5r^IsB274B*JJyRxsb1iRpPe-zS6e`MOz{{tO zA_a};v7dJ0GptV~hZ7WBS5yJMXIbz~0M1Uqb0@klQ;U-|ZubMq>n`&y=CtsO2cdR~ zbRJb&ZH?mD9Ie#mmCnK18DnFk9CQBfcG}S-KA-v)fmr~D{?ga0i_6R3Om!Q;^6=Hw z_3j_K!r%430?QEM;h*bSLHB9o!NDhwC0}f-h}ks6Om;3VK*m!3^=wJ1Y9=`(zMOL! zX{x?$;n|LMm_p#_FepSr88VEm?d>Rz2@VV|*T>bDO*q}}WV{>f&{t7A#5lRGILA^j z1jM8}jIu_kC)0txDCUJIklgOQ;)E4b(q#4)gske&bi^9k}S64*C@Dj*T0-^nBSYbAwUeG%;U|GTt%9%y=kV z=pw+u{IFExnj-hTO;eM_idbdj;M2a=jD~mV674O;Rir)fH_q1SJB=>%qB=s z{kMJQqKBtJ8)*S~#(O*M!`VTaCc9h%=CO<6vve!RSW}? z77vrN0Ifm8oY+R{UQ4UoV z2GB0{_dmZ57t5dO9E71J{Kv)ti2Vh_Zk16`QP%Wpe7kc-e?2YAzHF~4(5nexW| z!r+zvG|&15($}VduZ$)Y@ToYj-dxFDxo+@OBD(tnI;eJD&mkJju;jG&L85hrc=!}1 z^f|M#>r>X1?YFIoiSxuC@m}kGqq6jqp(avW)C~8X-aoZ4tZdj$-XMrOcH)7RR5QZy{9DsIN|Ft+EQ{ zD)qo5=yFy?4#uwRj|Qjw_$gr=5&P53ezxooFTB)m$s1&KKxh@*Ir5d~L6a=^&2HxN z^n(RA%T!X4wV6}*lxk1LFYG&7KiB*F+4qIu*6JDlwu2Yrd~1JNV+yx0o;1cG&FUwi zPExwBLPvucm)j1)v2D-SE5pj4Md^*WF(Gb*IVWXVq4IeLAd1kaqo461M9&`^0eL0Rc>c zS+O7py>wp|7&JE?IQZxdu8qR0^H`a+COjyGv39F}VJ5Pv6tZ~1Xw zUD03@q^0nHb2XDSIPXn%#fQy#M6{zB9ms7bGKPXsY&Xq$>~(ByMRd8aY+uAjTkI@V zHilI|VXntpWwlf3XT43!K*G9qu2AWZB^X4;K_W042@OnQYFY6V(JepiPC`M3g?(PZE#Iib)wnuwaFy!G;LPVo?$P(?$y`j87QSr(ytmEU3)U0 zGfVHj!jdc0_4;kWug?3NzBk5+-_sk6A`WVAWTRT5D-8f#|kayW}8Ap5R-oYn%qeO|3G}?K@r6zAkaRY1MwCn2Kyg# zArL_WoG<~F>PQ`JZTeXvjn3mAid_Jzi-wSzNBqN9g-_a;{ zXVetO*irGY-kQ}6Q*nZ{sKr&_FB61&4P@gI8;@HcK1WU!TFb>Ng9`I6_d>wrrgr;mhe@0|u6l8}?5u%9tb!s^M31M>z zFjfoV^AuSEFb{h;H=;krV*-dYHCjRE8^LQ3$ZFmDBZh3M^w` z|JZ5RA5@r_y=+p^-{}eOMj8VthgIihP%H@v48;%+9}g!NGKc^ljDOPj?i}3j6VMJx zYLZ1rI#N{1U(OcrCRK*A`OR-U<`#wWB+nN zBq<_bt>W?qRRs3N(O1;L&QzloA=-!`9w5tcIN&TCzybE>36<|o|8&P_7-~c{H-l!X zig&OOjFOS#gjzTu`=Y-W-g}$CXLC`cc~x@n(*L9SM z=#L`vr=x#Ck|t~#8iIrWr>9q@qTTS%By^PV2+0!ZcIbR~02yr5xac4J(Hfke+qxV4 z;l_~R+XIdeC)7^!h+1uBaza*AXOdWQP+|6MckI5-s8dkm{j``D*7F5ew(OxeduUi7 zMPA%VZ+|mC62UaiNg#A-MXEhFH{eMhHO)Rk>KtFNC$ub0L4q?RjE;9((VKMYHIW() z#0W0nsm6wz>4M0GBKxI1GY18ii+R6dirsKr z;sKzT$;`wAg#Mj{(8GKf(0FG(heqrxJ}}9+Lx-|oiS$quvY?JeP*1S9H@bE?$kKIJo!85yx6tfOzEF&ghHq%*O>6oz zJgi%*hC8sp?#~mm;z05f5&YP~Xps2qbcOP(-9|flQ$X_KD!NB2Di8^r#G6@KrX~sn zW%BsdOe%E@i`Mgvj85kDs#hD^8E2Wfn2;^ z5Z%nv{nhs2EF&x~3fMnOn=9{xWUc{e3~GPj`cR+|r&I^sT-hNw{&m&634Yghdn@BM zpoSH~!5WacsWT zGyMn!{U7Rt2Kw(3sqf$~_gC0x)YJgTE+I7)(1U1ybpc>OME`{a#XsPYOi#WFbIfP- zLRVP?X2w*bFE2_oi;uBB+X~JyD{Dpme3!iDW^Fw42ZM*_2XgH}G+EaK0T#WirZ7eT z4Tjc+@3O`>7_D;?lTVk!=N*P>2TQGMNlcih#}tZUz_B`Gtp7Prbo?C0S}79$;F~;1 zI&0Irrkf~aZ8DC#aY8|yX(RuIS5xgwn~5`sZJYHgjgmJET8UQ|cg=!09F@ljphqkG zGt3;?>4-7|K04q?qQ%1X)L!u)l7=)6z8ZZ6amn`yOBaI{5U<$(1$qEu7C>`%aB@14 z_ik9W8)6-+xZJ6UNV&j}KQfD|z{~STicJ2Zhv2clzrYJAFZtP`QEEsBXQ*>&W^85O zwPq~!^@-K#2{dMah=ehMF~tm$IGusKPs*0m)kmTGKtTpfmL7yIjd#8=$_98G@zq?* z3-hdevdR*Z#&b1MGb@r%h?Z|5b_(`Xq33GkD_T%Ie)XBSneP(W>VQnDdxH~NsUzRi zOqQuYefIB*v5nJMY!0!1g_HGq-)ed3RmtTxs1d(}rxE7)JwZ5)kkL}Cp$p^}uZaVp z{PmAF1sDSM;EjmNQ5QsSA}_!}n~kqpi3jqxH><@F!T!w|X#zQr_*{XfL!b~#`pGo_ zW!@1`1*qKJ?3wm{*URsL1Nc;3P%bL}FQX^=M5AqC@3$NbD02hBLrwOjzYD<(4c8sO6T_$vZ)7fIBB zUz62*Wd|PB72*!zEw~%$&Vp@M+uOZ^C0W5ek=}*KL8M4HK;qZpC3!&%k`I1s>_?gp zUet{u5LJ;wv1G&|Tv?XRuEczQVSel*RbT^rop-<30TXOSWL#Vv-`5V9?g6nfy;p?3 zc;Bds2u81xV=0FH-JiT2L}+ZTBUFcal8V4*b6&Z&01YRYkndD(*>Wm7Z!Ou43%A zvUy5L_ilIhh?1@-SJpyQ-(BVOC+sfUy!&0@nudbynvJ52fwB2C(ZXxs2=jui!a6`e z^_=oKgqv&D`3%k616%Qf$^AS5$BgQ8J*&#xXjQf2U}DsQWt~B+XZbhvtwzA ztF~P0jyGcm10HUSN2zl_`HHST(%^Ot!9feQaBDHynVyc$Zjnl>TaH%E=*5J1 zqmaF#^%55vpTj-@r8vsoh9q$eS>5w1ZE6R+))oQ%|9rcXQ&ZLbh8Zq=0~a500TSru zw3saYxQKHZ=+0l)!x2^*(2UI1>gik5)k!~JD#n$}qm`?M{~GMOy4lWMA6fKCthQtX zyr1O}ajXQ@`o?>2-UD8_)X8^)eC7q9oRnshh(zfHifH4{7FBgDFT1Ooz?DH1AsWcgyXVf{(AEEQ(p~8^4rXAQ z5lBGFB_sBDE|P$0Q_b@%NqgKxQ}6m8=j}g)+oNz7%m^aVS3gJV*45oNF5&({&Uu3- zsD|^}Xu1JCCSMxVL!2Lg=rS>l5Wg<^sP{i?EP7e!o)SG!^0VzzF7VG8Z8Sqrr)iDeSgw(g zR-3xAj{Z82Y;lVXebn&$`ODS*HtBb*p5xb=T~s$&)gV?@=YDG*-k%Zu{J+5=z){;D zMDK4rD*%X*U}R*BA9jui5CdvKZ-NBw1%(|}*x>aEPva<)-#_2= zp_`8TzT_qo(UJ1UkM1A{I?WYWI5==5h+OXaJvItEysDSZ#5(6*`&hBmL6Mwnmd>G9 z$XS~9PE2>!dtkCrst`qp*Mqo|#UK%C5w23p=R3D5jSy18t6<~SL{Iw`XHA4Q^XTC% zOQ{C3-TLeyblAT-S!Z)?t-|kF*oG?wC^r>eEn5mx`;z;o^}U?~sx`1{Az!ve8rQPU zDT6d4v|8d#lN28~Dw2(5mpw$RTxQx@^j%k#2XvmB!{S;3o_Dvi4=;(wk^9S%MQk3h z+U)6%K02H-Mi3f=1kO$#Lly;(%M>N+*R@^^dFsP%8Ia18XR+nqes2cvT1%t8o8u~B zfmcFPGIkF#p*qptq8#D&e!#k!fh)XSVv?>%-{n(r7+O;;sF} z`KXo*oJz{oSsxlK^;M^YVwADte7=_3L(heKK5RmIhV>_!zwvFVz4^odemSeE%FYti zBc2F?jUUhwdklP`FvTGDrJ{N`cGnH)>g;|P${q?>$d`!<~U^`B*t2cYBh{>oItM5D_pLq?)sotBvJE0++5S$`f0BWRjxLhF3d8k6)*J6#J(=;5A zVjCz`2@dn(gpKA=nyfxBx2IyK-`Bk&7L^VS7dI2OFgtD0vuqmKQlIV;lrodL71q=e zyB}`hzj`a00Lqi{J)nkC!U5&ZU-J+U*j|QhMeY(n>ZCOeP9idX=-ZV%<+lZTr*h&o8oF#|0`zl{C+eLz@lmUp9+PV~^<(NdW!P_@;R#h~MiExcYZQ#U_Z0 zsK!u_Gg)L>swzdGcqv6Sq<{>X_lebe*n}m1$D#}Ae7`=!17F&tB?w!WZ|vj)P*3-8 zC1;f`)wy@z`fEfR2R;u#Y2JvPuMDfF<0dMhOgP{b+zK@*)jbf@JiLh`GEfvk{;Qkq zR__%h48LLWGb!dj%@p<{U6)F{|3=6BQ+ zsp9`BkNpO_{mT97vlC(yj<3msnu7J3VDe&t@Hlg2uzGgT#X^^ZbKpDXp8cl=Y~vj6 zpFqHF8@I=LkvS!YYS7=;lY!)butEjU9rpn`%fF;pGyQl4bk>!ep?d=4L^F@Y}W5BK6xof3=rw>BmR>&|A)|St=!Y&HG#<02P~E!9JGpmtzq*( zmWBf9lBFE*bMO93W$OV>YVQDDKuim4f4rsa$wJQ8rf7t_SXL}RYvk4`>YKQ+a0iPQ zq!ufDpBlA&;37Ioq}rDs*i*OMej>);Rbrj2{5+5<7cIEDWh^O1@AWivma9L|@2 z!Kp-BP`@5|pL-}j!9b0QGq-Mfc;FaR;ujbce(?Io#E0AM%E>}6eJ^J8FT zs{C6=??dDDGFzPR4>J)H0{sKi9xR**)Ua0TFfg$WJK%r-(b?Wac)oC$ouW@jA*W(5 z7}7W;^Iu4pLbR39&g4m0vx8M?)%ugc}70LI#-VKwK}IN z5y(qs)%F3|-<~#@me7bQ`Iq7oKE(1I`Ao`7?kY(9jwHaQ7vew2cl08pTiFFw$c|*p z=EyP%b896jf-IVS^*&tRK=fS z&R?rL!0>Q@Rsa+=To`@z$(e2Je~NPK7HhfqQUOHJzb<23h(Qn)9ewkkO3gL+oEX4u zNckIn|4AVGmK{b`Ns+`8olR%%msS4k@tSOf!|ndi*OI&58Au+ulU8(~!=c~jiOrs} zIHAHQNm*DOV&gy5M%Pg6M_m`{zJ%A-Uca`En3>j69)Qxs-+Mtw{^p|MeHO0*D-OmN z`fFDG&jN*#gM;JbyaEFfQhj(Md@d}+syT42G(0{=<|0`!1(hg8sYP`B*UAnGV{GUp z1^sRp0dyHrVu@^n-4r-U9EigVzG7~3SQG)NHoWC5Fxu)_aJ`Yh3}CT8zleRrRFVgF z5-4^aDyLP`Psvu8xl7wVrm|hxI$Te~jGnTF2w5JV7?wHW24c4vNw~C~N+q3<*qSdW z>z9v)a({eo`oV5uvwbl|0cCA`rmWCa+I+GWVet{U#crSILqRZdgV%VE>EWcR`tz#a z_-O6?MUF^$B1d+2Q!lyef>!gBN9<09x zHF#A~yL-YvEGHm=BJ6hp#kR49ouea;_74H?iRi`;925=+X#!abHw8kINscy|-Nzjl z-tccq2U`h27Fq$C_ZfDjwKfLt$PkFrEYCWkmQuKe6v^yNIyR-8J)&3qAwFgoz&MZZ zj~)H`ZhIuTE{LPz!>B!a8o00&;*q-X8SJ(p;<26p5ykS>Osh6e@%1Xo<-m2NA|dp+`QX}kmQ&Az$lHEi+cMV& zKm8&bu2Z;~T&Fx4OO&_H@{d+07Rl z4+cErv}p2zc#G2u!fsqirs8+kU(Ny)ni{1KQ0Pb?)%8n}FkC+y0+kJgD3}_i1HtVw z71&0Org$1vsTt_>UzBsH@L@QCS*NRLd_ip^Crf@YN^U`@iAzHxxCL2B-{g`E;3W7a z9a)1Fq&^29n+(KC-OUJv6m~t9;GC^UZx$y`w++0e09$I63-l?iTUk1ej}VUZDowgv z6;XpgT@>8h+-m|>gF9r z?=~33N@3pP6RR)l-e~1+C`T|W^D6Kp@+ij}9pgqSd4JFO=y`CmM_eLT)MKHc&luaz zp~6|&#;>DqXxRNKtDC*&sF(ls`wN*|r3P;GhrW1(8LD?a7hAqR7bGLouue|)a41!a zG^(>Yw)A?D&(tv!q50p~zjw`fXD(j;i&JzdeDECA$gn7iLS*4*t7VA?2abeRWNxWswV#+Ko(N7Jmwgb&6OBx~v#7(mczBX@(8A(C}L&%(<%gJFp8HGqYO zXQZdskCwyf$Fo2;;PrfTv9Lf%pNr>H#v~=x)zl2@1;o}(@JhW-Kv|>$!UmGRR3#v7 zb%F=js}KQrQK0^9fd!##>)z>{`MSc?(!v5zW}WZfW*3GYXEQ(m3xs9pA_F{D*59Eh zfZleF62Se*16kA@s3w5*$|@d^P@TiB23UuLhDu3DbWp8~Gblqads8sKe_xaq@;jY| zF9YNRNvCIRy}G&@@hPhafy6BzspIIVq_OcXP8xt%GR~3o1b_P`EhE!Mbt77>45>j0 zpw2XB%Yo(OpG#+BWXvo=NS(_J)ds{-x@X!2Z!0tjFJPgRD+LNbBr-zEd+)#uzW~SQ z03JZEc>WFTWXX+BR2|wp*Y}3>zZv6~WAO&LJT6!3c|!&=vf4DZV9VxT0k=e>1VUlb z(-#^o6T#Q>UjK;p6;tu61qr&jF;JjDfXNEc`4vNgUIYbbwaHG!8R7o<>A{XdrW6S+ z=)~M^YH5kW+z2!M(#L|XK0@&vtSRMpgf}x!_5)8pB$xN>T05QCMTf7EN$tx;4wC@5 zsIjpz*{dZsk=t+d*nOL~rs6xj>$GqyQqYdeDeqj`*{ds8Ec$&$tHfl13Ph;${V}86 zf-e~R<2DHyWtqsu>PZKWe#$xThZ^s$o%ddjV#~cezoIT?aX#6TWq@+< ze6_P{_r%2q%vkvtRvp?uA>hijy2xCOCo)GElkRC)*(UK-*(+=k|ahVJc;xbqN!fQM1*pjj?343Olv z9o%2DRYH1SQyISPii~{O4({dLd7eacGMztVSxNSN{Rp2}5XuA?w)M=KZ>%Dz$L<|= z4|E7hu_v#}T5L9S?6K)l)y>Y=jQDRMc((VGXHX4hhi=}gno!}c#4;mng>8@P6e>rp zf05AXkBE#4^}pO5@16ZlkL~6Mw!{@c`zWGadKDt5~mvdTx zh4JX7{c*RRwI&v$f3ZHiRoy~LVk_+I7bhc#N>HV7{kD?VvbDt`0u0(Ofl5xEh0^$n{MhSdPybY$ct^*Mfe!dqNa}XQ({LrkE$YoxTk+ zxa!0Gl!e{N8n&HT^62h-nLnu)FEASwIglCN(}u;ockxtsbMCVU?ZA9S6?qSZB;Ii$ zwqu2|(1Yq1_Q9wrKJ^LCZMv8Iq7AaBewJj_d%UH8hb&w1d4BIpilg&*(3+QUS^ixt z?V2nxor}xL*ynJTsHs+obmI4J&+clI6PH0_b-409JDj`Y>0VlF9Xb?g{LcKD0TLF2 zurv`!@b@b)&rbp`@5%R0R-ZSV=|8#l8q!5phg9;}hq&DBT(2ZfV^B529w>?J8mzoA z*Ui4fG=|w(_%T>|iFTvH*JG@p$v;3v*UB>+)`e>skKZBt(Lvv_?s1#H}@S^ z>yFPZA;#NZ?^4^{rzR%z_y+@e*X#1(}gvd#H?%g9G_K&8|NPUQYpR;re)Reu(| zTea7R$EZ{7E`36K=k;=tKTbOd>5Uz`4qbhiN}zM>m)aSTj(Zg)_`F-b&-gR(oxtN0 zI_?T#%y}3dBk#z*0qdU1?e(Xnv?bMiPAYDu`INpKLAeTAc$zot=Zud;(pp(@rb%{i zGaZa3UprsXKIP>?C`e;Kb<)vVSXwYE9L+KijoVbp56YQb7j zL%iGIA}Ci0xZ`GhEb%m)d0PYV_;QriJtCp#4*j`=yvnENbFj0f9&;HV!@Av^$?77d z=0ZtD13Ieq3|_xSRTEsO@G^-w-xWtOQL?Sn0VGalJ@eO%L_(WM;Zf4l>>_Y4V>^MC zNIMlH#;4nea@a=gMwjg9#}i&Opg<<7C=C@&%$$4oc^=!PJKzIVlj#ke)4Q1n2D2iH z!rWW=^T_&GO)D6UeSx}$zIB^24RO1BR+he<%3f~}%E=1+s^`t3u2rG0MCNk6hgOM7 z@5@~`HX(#fc; zt*ROsdmFcI?NrvVlHDqm*2jr^&Yuef`3!BQt}Jxz%Uyeu2TNy{@1=6~>(?CSkKFo+ ztT{o^tjgy(ra#Q|ud(RTcXrkxz-Ma2^OIS)&nzeSAcX0f$Otfj2yutSlH=(m^ z=5Pdu3YpD|m9{%zu!#t2`OFF*j5?*$uifGvB>g4WDg*N{dvW(Yw7npYH|rvnIo<^Y z-JZ}_Q!fWt$ehQ{T@pgL&@??{_sKmTrS&ucr@64p*(D&j8)k z?kmobJ4Yd%{8tSrUndf`7X|90wl_tLOWd0LeMD}C8m_NTi-LAc zr9OmofWBSFS2DkN@&&UhCol6T5)w02!y#3VgKf??A3+?u+O`2e8r+M3n->9be--tf zZ`J8YlDheG3+YqR!%g$D$N2=G`k ztGPJK`NdqtxJ}Kkkyqt2C$jMmOw;QVaQ&av!@sl#esYYTgR&5CArZWWq} zAoUnVW?htLl1Mrp!KXxg&+6V$x-r-4J^@qxNJF{U8921gP1K5Ph11sflpUbI?1C0C zykn=@O&c%7T}@BZZS?$6<-Edb=6VD%(sl|2k-HcN*{3Ng-n6@hb>XyFlM$x0&=nBr zZsTaDUK1x?*ULV7Y-!nl6s^;$%zOBDsU7U6YvLxlq|NXAlr_G2b92KLaS7A6ap%U} zhvifgYK%p=nB+OU10x|`3MEJ?Wv!j_Gg3Q;J0<<~XJlIO!2IwSe@Okh zPWL<&XT7=%@7N4U)QRETtjj<)l7}1`qGzM_M9+cB5cqFs!tK{om?Pe}rMy(yVb!}9 zH{5N0S|df_7@nF|?V!+V!-lWQZ*uvOpfn;KmP`6fWu5Y;I8k@8#$1KvvuWfbo zZMCd*;p;MzsD+(rO)9yX1Cve`)mu zN-kbgsT9Q80?*S`3W|T;=8MhwJW0;n*mKyks?M7-5 zrTJ?1vc#L(gOQRMGZgpke4N6h`IAR=3Q=@fRzNm>o{8FPd24o{jCL}cIBIHy8ck!Q z0}}Z1Y8Z!i70i9~A60FN)wXPi+Z($#D%)GXErINUI(HlDyD%sh)G*avJu0MYcg-Xx zkVkrq1IvB1pz2`tinTY(3y(`oROW<>t{_4lIi#f4R%E63R%O;9KFQ{~1_(O~$e*=t zV%J0>;bjf&)$P${PGqAmxuIkVirEu8L(ZEI_dFu{->Q7a|H{J!)BX?u?YQ@_pB5iu zGf>>|1WWXz*;>I%o^mcA*$ZEdT`h<$ku&64Jn7NcBMf%ZYKDWuJWw|jF|1W(W=2T% z0DA-bo8@v=PsMiGu8PVGho@xUD>(g1a~~PCJ?-7|phH$wH@ke4MFl3mT0^c41p#Vu zrp7oH^`P7;p|8$}W-=GqAKg^k>_Y-c+fN_heY~_&Ejl4zU6JE%IIdK3GD3<>(fWW8 z`@a0_u-je(sg2Q$z`j5w^lXRf=X?+*%LwEzgLyF@MbX(rrcf+G30c}}h`Gr!GrGRF zv3h6;VpZ_e8GkKt&TZY!A?KfO`+!Uxuz$ z0>=SVtQdmCS&peV!{eja)CdP|rM$i`JHh!1m4~vl#*YWX(M-qBvIE;eGsf zcz6}X^OTX@S$?#EV|B;5|hAoWwHYt#O^RfyI?+0LR4|JT-HR)j?HTSNWah z1pby)K()Bw*Ow3X+3N@5Yk_R)4=^dMu)Ow#V>2 zlB_dA=Tp}-Gbd5Z>a}{c@y)dHVUE>ybRg=E5q4kqOP4Fu&lm&Gfl|4^ScL|JcUP)~ z!4EfkK!uJQyX{_OM`<%PdhhizBpw{Ve40Jsmpg2I9|etyN)ROKK>TN#0ru?9`xq@b^zn;5b9l z($aiY$xVLLax zJj4ClUxuJ!ydNKMf=R$$ZIuv^IfS@qkKLTOeP``$Ufhq}&Ju#SZKCnIDDW@qZWw}r z&@T`07N!c=`^yy$u3NtpegDYdx#CyqpL;s(e=7+pb#+rbn2aJUivA>pHa} z0rO!+2CPy*(y2Y3#PyP%s6C#a_y{Z#JytJww!f!Xx6k)W=OG1;40ho^A6T3x4*QI2 zqkFEK_`s-ctumsnBi};nepSQo@+ohjZ(BiFbs+`!?RM0+;jZFCRjpZ{TXy(ZL!)`( z*{l)jMiL+7U5EfxKouuLHXst1y%$PNqoVSwesV9>AvZHqw zz8qIWi=m=H!{N;2t~1#f-YQOGiTXp=s8pEdv_yltrENa0KeY29n#MF~gQB(mw6}k= zUgop6;}c{u90pwpA-zTNgx;)sM;R;(GRBc69T7@r<+iusgHS#i1{#;68kaLcH)OmO z@@-n_+BAF@i@1Tq1N-~N ztlh1xtJ;52iYt7hzqN!rx9j%!0OLeA1@R+0+c25I;>=FodU5k(^ISzJeWy#U;J-b> z2!2Ey|<7vA!=Ci8Bf3|oC^nrgr9tO&lSPt~xuYF(~>aRX`r!H9N{oij-0GS%+ z-|m611+90!nEdxU9}Lf%XC(p>D*2gN^o($aBWb20jnN7%@t%0wQRLewF3FIyYtJRu>bCnSiK1Nq7ore{#`hJ&9(WI!VC4|q93$r!< z$d;BOn~E5?ce`CgbHo=hTRFO28eaDF11Zsu#gr-$A1+M8e3x;fsa5w~GrgQjH>o zaH#U52KHiu81jZ@4d$^}1r_o+#(%viKVVs!U7<}nz%$OW|69#s zEX$x6k0yPz#J4cA2$Ay}mDX<`tqNWEWg@d|Q^go?2#0WoUwyGT`_gDuO_U=|a1r7_ zHhpFrU{EOKmm-#`LLdLJb0t9dY>*wPQMz=x@NLTU%Eh-(@+Oh84;)jVZvn`?Qk&wF z)ZyC_Mxo1GX=b&wtyMv96kcb)&UGl^DD_M-{#LZzH$|a>k0$Az4k|6`vyFLQic1us zpwDX(b#4#fu>R>I$wc5MdNLgG$vF;*55}Lld$n7iprNtV0DUbss&alE-C3Pv01>C0 z?h@BfB+RU zC&Tjymrn8E_~-QO5bAF3#!|{cjr<(vtzAdMxsuw-s$HC^ zS7i#&4xcGr)aOw`hE3^W-U<|vQX%2IriowDh~g8AJWyiUu(__jr->3PR$&UFMLrZi zXQ|bYPN8;DX%eJz#KYl`#imq1jF4H+$UA%It(3z*YI%IbepP~U<>-uS%vY2Mr9hr) z4Wj>?yiKe8<>bpJCm8{s@y<*I@?H5umTtvj@dV*U{~&A7P#LL45HbG0tC;%Buh%5NSWqD{Fn(rj5|oAnS+?`pbNBt!9BQYgnPj2JR}e?8 zFr#qkeGyt?bk11z2u3s|lUbRcKKK@ru+FU@*6bQ*yTgP4qyX-x>cKd9G7!^rm#-6J;%zuB(zcaqhPSJKyZmG-n<-cPiuhut!G^b7xq_oXV z8cjnY!zsm)4YI{DB1}c$oYYWfts)HicT9ArPu1v?31!T+qW^%soB~H% zHCKL4X0CHaeQjY=o&67bl~8;h$pDq!q|*WEVe`bkGnlOHlcAKO$2cFKm9)CJGFRqw zrlqNwrTNwAdAY^8PdMa@ZHco2&pFv+*SIFUrKg94_kPd(%?2d_5VzYT_80rs07Q-Jirhg6tUxwF6rCdmJe|2pd(yD~fxzzZCcpToN^ z{yYB>bAiJdDR3O%qQ$biA)ry1T3)&Ewsk;+je35@L1F6n{Sxp8g5X=UM~rV0qMt=u z6>@)?)sXT6B|;xTu)>BWv{|n=s;<4;VnhPg$tXrF;~4Lj4cUdC!i!-x)e_~cWj;mQB1&p z4XFT0B*p*)dTM_l!vMfzlLLg2(uZo>NK1x;zU2;`+HFVK8psoC!ZkhAtsC3>k7OA3 z&{D8HOWq2VoPVa~cd)Uc-I&2j31#^JFo@>W=_8y%qO@41-0vIPcj!R%*2p;5?%uZZ z>C1@XBuo5REp=7Gf_mD#KO0EQ4FbiD^wrNfA-f<;BHLqnJ+O~ox2|p~%PD|?) zjozvspKV1g)tXDOa0F2ks!i?f>Dh0;DLyS*9X{AO=JnQ~N@BQ_Dxey6=B|g|iq;b^ zR8vzM7#}xfNi=gOY>q-Il^Qc-4!9_FondEzR4nl3bB)KtT4QNS5|U<{5<^Hp)(_7dET{Gb`&Q2_Fs$ zoS*c&Y~YsCCRi`8ziGW)53w1NXW0em-YDolvNvF~x+}ic*-7BVWo>1k5au5-L; zIZP7hkF%4!PF$Bck@@cAG~*176gUXAt`Itn$FYK$=7eZDRqR-Z=A0Iu82~XiMXp+M zGCPVKaCNeqSywkEGsaIGME<`*|UdLsPEZ>ZUxqd!<&c z!v9CsS4PFPZOsM(1P>u}aQ7x?aCZ-c#)1cz;O_4365MIrU4pv@cMtAvZ=d@;8TY*Z zjKS{StLK_kv#Mrjqn*6g@t79UUy|der%KEGgPiGHq2f0$%p@2CC0USjEpOBOO?_NN z7;`xDmiG2lAgF|$9pRIpy^G62a^&ibXs+wS7e0EKkcd6``4HnY!!V*^WgRqj$^O%+ zLq~HlQpkr5`$Dvq^J#i8$oT-0I~P)M5}5y<@e)f<+OVh2>t#nLDgy|6;B~oM>d?HA zN$+JWm?xIO7j=xdQfj3DVakU3dB_gJ$y1TaJM`YK@H$-dIAy->6#m9**X}?3%6)J_ z5Ok$f1ZSXmIGu&EH=g!z^8WSGZ4Jg*^-gJl0R*g#5TrIUGvg#c55^4X$;+d#va;e% zw;XvhpRWY>?mI`+XM>fNjo9guKbBGfa9@-Z)F%0v{(Q&sI*zn^=9L-h<7>VSi@ULj z;CsIRko0o(ELPzky803r%wv3P7sSfVR!=$2wXQ2Av1TGterVCLiOa1N_dHqx(G~S3 zzP9F!Srqv*1kWeWXT@j!@!-n#ME2L=&L93=`|Pc~H4hKQHoYH3JUmkyzVh6WbXyfy z;&68YP!rq(OUbJn)InmHRKf6874XTNOgw&rCwvKg=NxHeJWagrqOEP}gM*r9Q_Oj@KXMfjx6Ul zH=PJ52Kqj9-&Hyk_Twmi4M>hhdT%A3ZuQ_=kdRiqVs&E{@f!-_!mWk-mu5KRHf>rW zIv49%diOL6EJbW)f;#c9bk+i!NgSNXUavQGzb$hF%jV8fSTR#5KQI(<6L_%)%FaFe zD*dg6o%)ehQD!9zQYO*)>7wVvW}{G`SY^CfDxZN~E|!*d1m0E?EJXQwrtrmerQ z){YLhG{X-i0u%Cxb>_R$k)Y^tEqAb;oBWYNho5-+J{cRI*_U&hib~okb zcb&oou6bV%E995B@!R>v05l_nAl{TYJn)#!WR>Pd}}gn`@;JGQ6A> zYCylINH=KOjPYA~!&(wUj;w!{R-Sh$?i+-1Uo zDey@8`Z5OPRc<;%o#S6gQwlyY@j}H*5?Lz4KKIZHI@Wnt`IhnYdUdA{wo`(b*r+*vK6t%&1=G z#J8cu>62fI*1N{{)FLAltW?Ue%zGTm*E*nE!S7^;ENQCQr`K%f`|^B?oedBn(R{I? z9&81|71MO4uANLKTe(OW1O0xqd9YbCMGb9?g70$vikxw$i>R%kV)ZH~>==vurtzfSc_Z9s80RaTS76!Ck5Wp0hnP*ZXeDS# z^(ybi+2AgqHDAFmX2MV$T-*hLOW?7Izfb`%e7g+>P4R3-n4AY@v1;Txq^e2zrrt?V zYQdS;?|q%_t@mZC-#=u}z&pLDJiVxXrSOP|HVOG&hDq8K@JVp&O2sB>k&7SROQi~D z@yCe6o@v+7-7QIs;1t+=SUt;DWgxH;?jPLVlh;ZD0@AmsVnd_!WP2@RWDge-%+!6% zDP>ts8FVgG^qyuKf6$X&pvA43&e+BXR&srkt57(*Bim_t9iZBnT;M&QwSR*MCiNS` z?Bs$WY1!@ER!eQ!l}$(}g#(jlM*+!UF!Mfq7i$IR7LwNKgO} zh;egs|F!3y|Mb=4?WPo82@V{HR*`p$Ov8FD`H5lVPuv=mVwtz!>nX@f;FD@c^Q5?< zZm~!O!Rv**(Df9(p^u>Ua8Lqr)-w=orD-XMuMMAv63`VB6Eie41T+e_f6M*dkp-di z`2S(Y;;Oa4ktyYcT_gQU-tu3`V({?s0oj)c>!OA$SM=cN#Z@=~CBGWej<>95!#1?* zu5EnVX>0zvo%dGb1ztybq~RU9W*@{=s~HL41Ocr|iTS zhg-W@NuF^IB|;~njAKoZlff@LYjR>d%Lb%fBI;#7$ zXXRzbLsQaJa+n>LuMa5{tjK*IzdKX^KH_EvNWp$E`q2dG(+rDRxt0*S7I`L2xwU-S zBX_h2Gl$34z`|dD%q#VB&SK#oxY0%u>SnmS+xR77V!49jLkj4AJi^_-L*LA?Ny4dO zG@7w13{#9OJNw>J3ONyeuLE*o%-&cl1JW^HAg+FUX6SREU^$Q#X3ib`k=#B~@Vc*R zfx9kt9Oj!n^Iwi=lEoBVNuWyPe zSQo{)H5#|Fbk8ItYM8iK62vQFD(gdqvua#IvE6)baVz4G)5R&*?HuoG;)Ms8F4Ysu5$swX?WZn<}OFt#Wv&yQWu% z78Z8;P?=v8$1};AuBh;w;&!|51W6?Q^J&^*~qf zOpE&xs#8AC=XJT^YDvbe8-sUCy!#*@6v)s4ZMbI|PlTpwbO&37G`z_!dp`jmrW$!7 zEf$M=%wrS&`z3fY`m)Q(jo;?58s>NPBo*$$1>%FKjW&FZ9syJmQ}elm-9IT_P&!ae z{mJ1su#ZmVW8fswSyBWGihj#QKMkbj_{)@8sz$y`kdwM`5U~fEeQ+}2{)WP6a@nnM z8M1u1L)?G z0a2#Lf7maXL0M2%CZ=y18ZC{DMM~|*w=xD7Ev$t1A?B26Eglywb>1AZo`rGD8dJ;W zt+9bgG*~0%gKwjLX1jbZPi9w8;P$4DGpc!8-aE&r?;3U_mmyO`s9v~E9f%Mp!R%`h zw`L(7pj}A8>hJkFYV#Uu7$MhS5RXhmwKPM^RA+XdM=86& zD*2Jco0zd*?-+=fm8b28WGx#X6X+)CaYFsaQ+^IHm=hBcnTOi89>snsn%%5EZO&sY zAL_h~6975TRyv1@a!86@#(FofN8=fIbdk5c7l|pURUeaDv(WU z%VBF^GU6qR^N(zjm?m{O z*{Jes+h)80?CMEct8DD^s`w^uGacsYEtH@?$ix+mtqMNU71;U^b66I2Y?mdT2I7?( zG%%@oy6L%K@o3bVmMqxR^0T}9^H6%VX>oEGJ-SWJdzVFi_Qi#}<-sx1k{}Y2@kBoR zyGizT{ScCPEBg?{UCc59zf3mNdUiHPv@Lkw)xwRj4=GxJDEz+4=?D{n_NuO+QDiS| z8t*|RW#BmWOR_6{yI7?fEF3H|-;x_xmIh?RFApC#2uG9yIkr3?n)J_z%^{@vkzmzY}ou#E`2tui2TxVv#&m2V>Cl5ZxRd>QVQh z7#5NNf$Y=q_5!YvVeyrIN}m(7d59-i*l?}vE}|qD7Om`;^JgQ^MY{&OoaM(^inR-) z*YOmITUzE9TR7MFZnqlB#YX020;&pg9!)3G`}s`1<{7b5Q3^0-`lf@t>{jO$J8`71 zn|JQqL#W?z0o>+-uGbVg$tJkM;6GBmT?yyIIHLU(Y9a})E9h^#=m^jSdpir*igeW3T zo+U1B9<3T)JzULxH$NrT@Tk^5O@x_Ewb$OTWFVh?`T^1M%{rx}7E(2>x8o;-ZHeve zF}l^8Hqoj?LNppQQJnb5H+6*P-_?8@p5ga?FGnK5w%tyidfm^cX}sHtbUzhy+=_pg z`4xu#-i?DBnpYbcol0wmc^8U^XmC1D4#goPWP5c1ufmkcRyglP>5moV@s2zt`#^Ub zW~pubo|Wz^AwJz3k`!b~!yiKYZMiNI3+G5NL%4Z(BKSaNv%-3s-#eK=tkxLNvl=f= z4xgu<@N}yIL{10tte+vdbH#~xiYMx;0|#k6ij^WOZPQ_*31%W-d$T_0m}8`<19(i! z^5fOs)Aq_?eKW368+2@ssa;iUx6F4Q=WFAr{KaHnH<&w1as!-sHDW0mAwozCa`JXH|kj z@4$s+d$s~g5hcBy%X65nFtcD5e5RGcj_s?iI#9AzS5Do|_2FCFS1_EP8vh<45$YIy zxC-CHMh8)-X-c7`y(Qx}$>GbsvE#4Wv7tPq<3Wfe#Od{p@}=ZZ!A&j-DS>eo}0>Y~Y*jr@`WNY;H30rc~Xx8FdC(iKcx8Nh&HOAm<7rion=pc8X%3c>%g^VWEl{fH3-ud~&GrX1@}_Y#JVR zfvYvgWkj`a(R53~EKA(bRv@|4miDt2c|N@A7^qtesMF7QD!z4Qb<$-8UuUQaDDBG- z>rYWG8a9=oZ%DibEc7j61WLr;&EFU;aqwIt4b^mAhy~jI6zMiv zs-M@(ZG9e;gTO!x51#|%s`eErx*2T-D61V-8yJ|QEgO3ThjvZhg$33HM%u929JX2- zeSwvJlQpbykLIg^HEauF7Ssrdt2G9|%b{TYriK>@ zsQ)W9=+QI-Io&`(&Kca#n{{1FG3M90SDvIu}JlK?Ta@&=?cgvZA_ zLGD_(xVW3VSr^vC+|SpG6zf0Ilm4Q`KM`@1#4pNZevXMC>`d*CT=KGs3QgSVTXOkLP!-$tq6a5 zImy)}(<+Wf**AxtGwYNQ7$}%HxRy!x=#oXfQ8d;3z~Zbxxswn`7-8bR!Lgoi%Q#Hz z`I=yOmG^sIBG0g*79sQgT0j%gQUge#APv*RgCGZVCYXl?X_~luAP3MXRL^Og@~jl4 z3sq0zXf~0?2}|xtDX)`Ykum5LV^kLXpyWi=f317>!b(cUG z1RNkxX!9%dZZm#APY+;k)B2SFKp7(m2Uh^B_$unvSOwD&&3&=GzS@(1((lakbDo7y zd9s|5_e1e~-ge5W8!L)Bx9eE@tyD6&WhjIWlS_~;-9?YigE!+pXPVN>u(on0m#GJ4 zHDfEeoK)B|1~9yO&D~x2$|Wh@1TtaC+@ABdw;AMyn0rZy-yxKloc7}zM)uFu=G4&d zSm_6JVs_|2dIU-qO8JLV!ME${(Wp zq7VN4jv50ISmXd~kN}b%zp}l-Q|=4uon#RscU4c!NX-5owG*`zVw4sRfcLq#4)N5k zK(eHyQeNkq)2!vOS?Uv22m+Vn5IdCSlItc5CTiq1f7-?kGpc!eea9@_(NqTfcg31A?Bl-S=m%L*w`%%EM2tVbjS@o-L0V{icRNDBjk?rS1k4VSofif*;T3-$)b-B zH?FR@)VvWdE9n7Gc)Xt^%!{l{a5dP>0j#iP#D~P=@$!d5;&Vr>J@P>2N$&CTGH&0* zrheN=gN=^#Yl^P3CoKs(X;ms$^_VQ;t$q06u{-7XVHb{?x`LMTUZ0fpnNGUX6@ym# zkH6HxzH;H_PYEL?SwlRkqU06#;hE0P%3vy!gS~U7j;C`(&h9k=p7Syh^&Nt#>6wKz zucxd1iYOAD)YHhNpxM&*5Qki6T^aouhY}6RU2*{rN1pN@kj6Gv41_)e^OLmK1Ey-y z0lQ^p(h@&@**S;ny5)_nm+ua7!=8qdMxc}vqx*MvwFoLT&bVFWTDr(Qo{BDpw5U zh17v}259ylwD||5LRtC97x~*-GK+9~FYzVByPsCJnniyo%h-i@*y^K*p9_2bXOb9X z0XgrLnwARSih{nmKX-N)5qUd-gy466(+TPl;$u^mas8a}ejcbY;zbsKlYIEqm8Bf} z4mSAYGsrdlNBhI#hKwf{NKtg?o7&lejAaxtb-$a2*KNft+fV(_?!9E?WK#UDu6DT?E@;m-Ehi-`?Gbkx+MH z1+9}fi!MoAL-Ws4pOU&;x4+Vuuk()?r`z`_*I&X3n;NUCUeZJ(J1ENRr+iF0ZI}>` zpvP%0Z>Bg1Dv8Or>x#_YIJ$xExxo9pXW1Gub{%-gHgu0(Vs0q(3&EB5&}Y#vNqUEN zT!U0yT3kML`|@$^kv2O)#;?!l-KSRy$|Xkb1&*p>=TL#MiJS3??HRUwfr?1UBl8~G z#{%Qc42nnofpAIM=G_gVNl9F4siD+VnS%U}tTu)Yl=E&7+t5?Lu2v+U^E2*;#jdS5 zkF5*hq-$QYuM)FJ3UaxZ+a?tApyUmT>`$m7+wZ8@( z@iz$J=GFTIE9A@RDC&^(;m5B^koX02mcN}8FZsVgp?`Y5k7y; z@=VTw|2nuykuOho+4v!sOc@70079QKZ#OW$xPa9H0Gyh_IVk=&oDZ2Vh zZS8pLqtc&?B>g7g1LwS#_ZyaG^y12i8#iuC{(Ycr=SA?x7gwHabA_q7HTNO5&p#1o z)@{H7bW;!G4VfGtXZqqhl>aFnh>GYEmUk*Kzg0c-JpSzVPZPOZ-W!hYANS}6S|WeM|@4#H`=K1DRrdaB{Lr zApylt>3N%*^4!Ko^Xp3lqt{u5NSTR>dkeh1uIx3{uOin?R^ z;5WYo1z#Et{Xgs%XJq8&8kUIuG(!?1r!+I9NKY$O{B|Xc@C}v~A5JgvpX;(4;>=4F zMkh~i2$O5Fzh@Z#<(OQuZ3`BxcvBjBj3Z_nOrh*>mTV3*i+P2x<8mlAkE_|O4jNxs zeTl1HcX^_arGY>&5-87faw`!D_fHlL?$CkZ5FXjN2l|Ot4oQ?0}9Zm@fX7w(%T58$B1(2%*>E2 zHA4qdll&ZYf6DAfVUN9q;;54%v=Ckw>xIW43e9!!eO#TCnZ3Qj%HX$W{F#vk!gp9I zEFvn&$OFq{NW8rKvg-8z;Y((9Qe4w!cNj!oc*=`=(pN%dT3oQ1Jbo0qRHVKxDMA-s z0B>~3n$1N1RKcNG%v3!XQvO9H2I)E62JdtscK}5tD)V|Pl{!&hM9a$m6Ps>>TrV{a z&}^?&yew4+NVvXLTE>b2z%!}9aiyD3^!{>6`KuAx`}w;TKIy8a zBf^Ct9DKnGUXja6VosutPg?k&j=a7Y>S54|s%gczuX59{(cfIQEI7b{XdInA79JN# z_wt%GZf?7NA?8Z5pVz!&-*e9taKU9Kl*B`Mnr<9-3ahSRaQNvw%Rs0lh0}k(?%|*x4f;l< zdvHY3(Sz5B<|80&VUn7s0u>xVnE)2_H1cHhi?Ila(eS&(PzU6s;cTY744ZfX&93d4 z>Ss(EucmsHsgb7Fc+Vd6RLBUbvn=1P_h?zRgQFuEL?}TysUW@iB$Ka>tvv_&Fu7rO zTV2p72tM%#v6UTCBjuT>_TzuBh^TSaDHMt96{Vn7R*D9>oy<;G*KZPc*nds?go{V^ zE3*CKFi6-oDY12Ig?meN)n66$YL=jdD2-JV9-^zi7sK;b9rUzUmWazwvk>_-b1 z_8ey$8L+tOgO$7IzPh^=huVrl`qRQp&(txbN)EBgsS$5wQV0^I5W^(5WQOGNYh#oT zl&i=$C$Ih9ge-j0p7B;`0xRPB-k70@4|llABc7$=v!?bA(A#iMeZ zL}vo#?fO;zR*-p3iK^1aOUaBPB8qVe-NlUohmKfiPvvhJem0Bs=B)Ef>L8seFO@$^ z?oTb=BVya~Uzk>$x0aUPYZUU8bMqLFUrk@d8R+>()OonOd0KW=eF@p2uvS-!7+pw; z1dJ=!n$MlI)nSqLsF*R@C~G-`dBIs>+R9~E-`Yv2DKDzO8qtGSd87l{%W|jq&$Ks= zRCFeWAwoa$^8_5_GI19M{*iIHpH*ssW#<)zsN&Xg6FT}Ym2mpyvOXXhWM1gz=RloG z%d@M>tI8^E^O_?n<*>%e5nIHazmsKlgJc;h@tbii{0Io7$XG{;+5oa+nx_F{chB~T z+TeSaF?RafYKi9HVyVE^&m4Vh_0_nN@G*%P1lt&ME36XXS3EAWv}au@iaJCB4$HY& z7Fv8lbB^ffcRXwNPsuwC{qkCfBXsEr@{s&qTxJRSad&-F!yS<05I=)M^6IkU;R&HS zQxL&1PDs){#ZgZcIj|esvGcG~`PMs`{oxFJ?|F9ZhE~dqd7nLgoQ1$Z2AW=(-D}f- z2lsY3SyG_CyWi_!*Y}wXJF4P{2uqIX;8(T0mklbx{an!4vpp%9McNnXxtqxAWnRy_ z%a#v=7Q@gOBAs;3+fgoT)ei6ONO`*1?Klco^Q__9#H3RLSya8hgOeu`az2=HFV1un zWl=xB<;rs$(SUHPoT4NeBEAWVXwC`n+3$539@d^WH;-6F5wJ%>?{4nYZkL<*V+*`O z;;)#_diJ*lZ~{ewH_3;sCn2T+b24k0Z+2Q%EBf(<_5{9$aeCbRO`>Mh2`@s}u_9oiqnw{)FD`rAas44$ zFuOOvzl8$r*3vyDkg5B`xFVn-7){};j8kr*i1>mE7a&&b4tnqQNAcWKAM7u@@fZP3 z&d6Zbk`It$&HhapvggrbM^r6l)mz+Q_MCx0Tu#aNhi<@x3b98MAZ?jVojpC0X)6Av z(3e}5Lf`pLD$Py6eacAU*qyn?Qem&Jud666oxr_HoSpq-Als_~Z}8H|iO@|AUf5gh zPIV$9ORW^C*!I~l4phzG+=E}iFrpnIUoVbW0*N#p5@+(DX~gl!^ztJ&7ysgY-GqKP z80HhUSOK;nd=UxGYL7<$=Vv-!DZvLiVa+Vh-9&6tlWfr*1HgsU z0G~yWE4n|y-Qg7g--UzQ?hPN9)E$(FjN^#@s0IEf)TF~^KG$b)m$v|RyZ;9hAi?D0 zK10>TfS{-flo=o>19L*#D-sK6#72N#Hya2{z5|dg@myQYxOA znE}$WPEIWOiA|NQa=y{TOH-Q2Ww-mtdM4!-3Mg)3!pGfgs$nnW1ewjK`k~DZYrj?| zsxaL>wd+_js}+AY{d#LHt)*z$22mNtZ8qM2ss-$_F=2TS{ub(^A{la`H0E^cs*#O5 zKV~R|ezRH)3p1s0R>yX@uf;yLODx~_J)EEA#igJm>$ z;=mNNnqhOV4-4YFo54Et4zF*jTln>xj$g|lMWt|up>ApU9!WAldWa510B_ZMhK?EP zlt!E=>l@LT9?X07=Rxl&{4CuV&nKCbSQI=_edTI!V~>Y6&)H}ONISmZgs-ly0#SZI zl9JZw_xJZ#Zz8m+roOcZ%OcrkfX;XU$*f}4SFr5;-LxBk$qcoan1#gBCoMY>aSX}s=2+n}Nac{= zkS)wk`u6KN^4?)$^*CO5B06l^)3kwUtVF4B?WPLI@z{f!SODoTM z=lqg~?=)icxa~CX{g^|}lRAaA39!(gPEjUou)c*B$+V{Yk(y$8$W1RBPv>^%9BQg0 zrdA9#(ug~Ga_+jQz3fi@7KATv)I%n#zqnFjET`SLZ^zix$y4nf+Eqx;?_r|DM;%@H z06VVD6kb$W%exyt+5QGjj+)%yakaYDkZ`GyB=0?MWxLIJk0Hk`lTNBzlNKFjf=MgY z*uzM6+#bXCm9TS^E6IIQSg47!J6$%R>CJga4SY;wAwybK?bE)c^#RQZVPBEp2(BV< zmMAdn=U6iM-U#usWno^JNcsF!eU(LSA07zCigbih=*39>nVi(UOA-80qMa@-dT!E|Uu>#ydx_@8BYG^&{QX4=4gNm$qWGT)!0uyEyJI9V0WLm% z8FI5Nf9VfM`Q#+`R!7ZytG@(rYiWan@L-+t8A)vJ>Xot85L!zDSm;L!dCW@*Y+Ocn zd3#$~r^vco4PAYX*xdY|299cALq2#tru!8;ML(6jht=?UB110 zb`8+$ErRXon zPk$o`UbT`1G$Wb7niKLC1WDKlKc@re#J>FxI@Sx7cv-$esd1XAp9!w%j&y$`U|^Yl z@}F(VDC)nXE_mQca(Tv@1KcrhVp#{|T!yGnr7$xLQK!ll+UVcM|;}GFjR#p(8 z-yqZ|T4QOE#c3Y~CXwF>MDIBrUwS=F%R9c$lwaq%t2f|yr|RSs6t-6$pcGzBQj{pjJYvghV?_SMq2cya)`WkK0)h+0^wLdEddr;F-j&d%I5axSFFl`Z z_ixN!*8ugBj~{KHkJ2xwmDNc=QRwe>-XsZLn(oMawP|1olC@oXdfVz=$JKc-RkqDu zDtd2AKdKF`uWo%P!p&Vgy}kuJ5^^P-=7xgx10^7Yah7GqAFZ)&_=mZwOo4Dh~WI6pJaE$0e9uUHX0j?tF{G0mB8ZK|+| z%pI_WL!~)X*AfjGT4jNBgFprF%Sk^I35Z&j8bsX73+k)-XtG^K@(ISr-QE3+8Dvft z`LMkTe6<6Ua?azIoI(1_1$wUP^UX6(dEe-Se>)uLdz~MYiiQI{@U>vBxU^b|h1BK4 z)5uDYgA86B=GxhMqdYFkKJ;5Pv)vAoWucr##@+7itNp=C&bRXZx;2|f%dSdRSGmXB zi6VcMT%~w8xPENZILWu9g&iHcgfsl3v1aRa_c7-W8KDw>c&sE z=o@HSB5`qXieb*}(Ht2&UPIjY6>pWR)g`r3j_7W=cOJ}tpLy?x{Z$g~TK=w9x<(hPkD%LuibDoyU3$5XbwU4|2$R~Mt3%lTDehR&#NRX8b6=uJ6w(%deFj%cRVCJ9fg=9%~n zTZxU*?iN?1se7Vja*DF}e%BZfycMQyr~CVDJGV2%}Qu*;FW8kz~hAOFDOS z3et0d^iTzaAvM5ebWi{eGNP7Naq$x&JlZ<4u0H-E#PL2X*VRTMhP*jPH3O8=p}|OksdF3iBZ>N+2Xrrp&Xl zq<83wTO4{QM#r?2I__#s#6yF0P@`7ong-i~UjBv@Qr+=LYmZ-LE?UB0)4 zGy|e&mp`n#$>p@~8>F`&QTM5+Gr%O|_8OTJ5u|tW4@H)l2?*}3EG^5S(Ea0M%9voX zm~RxAWu>L4=;*$OPQU{BsD7Dz%;-o!E>#lElo-(wCMU;O&J=zu5FstB{VPqg>zo1^ z>0?-FS~t_*cxAGs37?`3#aSa`W7WTy6DGR4s>W1>*ogy5$O)$NZ_JUulU2v#&HuO` z0QgHmeN{mnje=|eG1D0c*oa65dobV%h-2!`#A6CDmI@bulj8CZP-6v&7}2rXq66{# z-om*o`*~va&!~aF6?`wCbc%{5u`vsVrR$3LirI6+&hend*<(ma>=)XfyxlHuhLuol zjS32kD?c0j&Q|ZyR7*}t`=v!bab|$0TKvcR$w1#TU7VKev#eY>20SJ+N=Fw<>$WEO z)@I`Qz)#^TJTr|am;PEYQg;*rxM~4r>E2Fakr-x>sY^jD@)u%77)Q7?HNHDBA3bNo&iIA5t!=|WI=#-!FyB;*w<(5pB;j5lL%#GmhLY*ZM(HywIdZ)9X7Y~A0(!?&so0m3nZ1|%OE;j#(~3u|k) z`F00_j@%rhLo>tVP{3CfCfTO#;@}&E4=(J~vwVMD@D*zhjl%)iUOz&S`K>T`#6=c< z;JyDlR@Z~W!_Gh}fq#U+HG<;UF*+A4YMK{eDptK#bRCC(01xsCvp_*J-19T9??KiZmqC= z@@f;i^vMiWd3E)SR`+R+Le22-^WDa$Q z@soLI4Yn0e5U2Bs$Am9D4_3_Hg+75GDfakcUPGC5?NmzW-{kF}Tg#@E7M(Wkx$Q&u z$3KIYkubO@REONYtsnnK3C`@JBc4*TpvKAB?AMVR1G{U|3w>kH@=wGzBxt@n>-!^}w(J7Tb z?@0314e666Cxk8G>f@MGm}Jh?7lTf=Qvfq6Oo6+RYvCRW9Y*Z3criG) z2L!QRici<&p`gX2e4v^|YexjTVA+iK4}r4`LxeS~km}ntxftOM z%N_C-wL{Y5aL|QE4~IjWu(kd6K2xtWrF)OyJU~`wA<^Pj=>%}7*$OcILk1|w{^mqH>(h{)h1re@GL(bRwyZrEkq9W+$duRRn z98-yXU)>C30A40@j4Ec6VZ%A!-@C4~VX*Wt+ryMl@@7{>&LLIq$gSyo{uS3w0>a~R zf$~3$rT>v@7O#kvR0^zb5@(IIyAl1tmq9+y08&rzW{Wwpr(^XJ&k-W>TKo%T$}y~H z5an4D&QPBknA3=@$V9=*B6ph`GNm7k**Lc_kBDVe*>>n$>|GS7`M`|WtN^ywG(U_x z#6Cf*RwC(m!*g`(j4T;o0_}T9w%F%gIwN{tCrUH(w?_~RJDr*Wsl*OYD)=V7pdX=D z-f*JA*y)s*3J;)yU4;11Hei?!2o3>*EfepHfi#q9j~PTFFfU_g_k}2GZAL^9C_jT{ z%OYb%&wblY<@j-Hz3na+JoFYUhf?OppU3aKD>NH53GlY}eK2s+ct$_?t%S|G5=%Ui zZ_)Dd^76%TCl%R>SfBfdMT=b_&tzNY95A0po;90{`=M|2{XAz z6~`##hSm9sgvz9)p$k=ZSGMi&og8Y?A2Mqbk7zaKwRA$H$(94d#i>l{QNg^5)8B)( ze1m`0EuvJnJi;wAnw^?}nSX_+NmxqWA_O?!!}FhZ7S|!0dr3|I_Qf&J{_#G(0It#P zE>LuC6lWC+nfWas{~tl40lB@62c$rHkZ_0(|BC^zf|O<#I!~|Oq|IAmJh$&~CbkqE z^&a@G0glSvRp2ne`XtBm#UftMcj}b#g)9i|a-)FJY08`LSE<`SvLnEhnT-DpsDS_1axtE{lOhQoanA^K5@9LR zPoO&+jD^?P_ib@s(5U;AB~H~5<{P&rG(!BZN5Re~J4^}5+kEa*^8R{bl!44kB*4Z7 zk0)<3l^P?vuSV&r0u7C)%y5XIccoEr|8wXAR86@;3^c>$OotItyzz1sR&^|+9UPuE z_S>GNML?l^4^$o5sV&#urpr7O~5f*6PAo=I(4}meode zchc)!Du1Ww)Pwn7XaYQTJ3&*0L$9>>{itNZ|0P4}-Ct^F5DLtF7BM#&uu5Ux-G z7zS8X|J$J6$-cC#Y;YV$UySwDOlb{UI z$Sry(PWPnx)Jhs8Xu_R4B3LZBOs2{4`l{})dO0fBs|F++5U|9e6C>kdTF|M;(B3qz zCrmVP2@t_myZ!5dzCk$+{zBi#02REciOY^i5$2bgjEoE$8{6~qbJjwh+hsg*7bzc` zmb{e0j~o~M`al=3BgcKZ_Wb$8^VFb7e|bUqaLn9faX@k>ZngSbIB^MLnYR0th+>EB z%7$yDzcaQ%k6#`y$E4y!MNQ+$j1*(%*gED-@zP|_FZloU)&N1AzCS=M0d^SR>xc*s z_ePl3uB_M!j;lXp9{CG4u z)Je2ZmF237dE!RmBT01ByMG;ez{v%eli(5jQc_bz$T0@^;s4w1+zS|kgJeGgBI<(8 z^aDqL1i@qFb&JaHDX5dE#H?kWpGpAv+|m3s8-0nNmG(s|{@MOo$lq1R7!H~jgN5w^Km+3J__M`Ua-(>|E3=#%L zB$={_i@o6c2$X8wiqt2$ibVQ3ah+x?E(_jw(ke2sNo6{#Q)Wry3twVJgJEfRY>%FN zzm?3G)**j*gswR?R0j$*i_;U*+*I?PK-i=pCUq=C`K(7b5pJ|4Pi60m62g8>6Icom z!ru!?@eZx~$s{p2^Q&zfA5i@L%}{r0TlfLck-xjglEpE;dXsv3(Aq}C)i(aRoU+~w zvL*lrz&3cNy|Z6&?5RE2CW%_EY8a(}b@}+O?_M0rc_%XAiLZDrXLsx)|CK5(6=17U zQ)#h~X<)Rf$blOPNU?~-%%n)RWs>#WgQ{Pc`A z)?sk06cu5d+ZrQHu91Oz9u?_4JAk}0LfiH+6eieL7Z#TR>h^4?D=LuVhtJ_vLG#*q zxCtInrX^$h&->>4Gq#!62gxanD67OGK{HSCfxh!!S>k; zRi1Jz;avt2?vBsCgeh!mNbna|7RHTLbfiK6CaXH}Gy1A6ruUa#cHVrFM&|8ZYsgQ8?TZ^*!D`)5asEAI$*1K#?@+^U*GVma4~AXi#pb4p0nI?7*Yz*i5PW@$UBv?8q~EnE0Cts^G649D59*Dp-&WLU*7yO z(kLOwnsz6|XZ3!I@o8R{+bh<<_SF{PfM#+?*=lRcdW5 zg+M3%%>6^+7my3Yl=<5=$a^+?Is-^)B|G>Ro!1R7k3H=^W#7xvxQWNuFL}h>dZUFHs&9{h@ki}NLOV6b7*F1x$o2EP-oaJQy%M6R!=li#4lFW|y!lxFA2M>x z%97k`Tqny#s@XBRKk6`+6i-7)q0(a zheih*)19nwTO=%T)J5u?6j|wfFSK$b8^G}!#JwJ-J6u0|wC$?ULOsw8HlowFR9hY0 zPldbZ!ROwcGciNTC7peA6+EGc8}D;^)NaF3W2t3XyI&ufJe3zffJ~-ZU&u?y8#gel zpNmMzaS)zz*eRW!vE7LRT^Tcwh4z2wZ~%M19!}X!-zb%qmbUgMBTx7)q`H8C05kNU zw-NNLFGiwqfLA{8N;I4?F?MJN7^k#}kCx6=r`r4Sw>fGgb;;p~lVlCQG2nbV6t;z_ zJ%TVl(sX$T-~BrnO?#}WX{wQ)Q_SQ~rQ>7!1lv(Ukete`26h4o%0OF{>r&2!GwO%! zj}{ab8ZBF!vo_`w+2*Bh%r)v1Jt@#4a8>;fT@n8|Ihi+--ZHpxq&zVHeNpPghrU(4 z5ZDJ49pNhFs#B9Y9{#~i{2V;`Z@M24t@tt7eR_PxdD`Irb!P&?#F_oBE;1ltWO5U`>=BF^;wzob<`u{qb+R>q{N1uVe*N%j~DXpkT{p;)DsF^%!JhSG+m|Rts30aKbrvKQ9{|jz~(ZLra{D+O*$PTePRTqbC^R1W9Y%sk#Pid?E)x^^-fO*S>Hm>p8XFmz{rqWc zY@9HZv}W7<7Pv|NM>x;$-@^F_)akpweF?!*87dXZpBs4jZ>&1_{})|f8B|xdYzqX} zB)A6&1PKno-CZ^k+=9Ei26wmMx`VsB2bbV3!QK5W@}2wY+;i$yQTam^S!>QUdv=d8 zdNevtd)LGs=3!*bhx&^5u^@Uiw4o`OSEjqexXt|eFy$@ zcDwm?5f073z|%^*Mh;)kN){K+w*~D#7D*Ib(V!hD4x`2t14@1Y&cbBZx(xsw0HfvT zN2VwfBn6s7hqiN~#1X_UYiM~sYgG~r5!a)Su;Ws;E0x3Te;RZfImkGljD@YzYVoWl zV*e3g`kq=j{`!{L>Wpf=-a6pRsl$FF_s;6ex$`PfJ@gOu$17{ECs!9T*=E2Ssa!SY zL8&Ygg($1_BIP?joA3WVtH6301pwA0tw47+$^>AABl9viIJnG(JP_5Ze{gW%D_fyf zQjb>l7IhyCR^Ko_u|xM5tBQy=cw*Bnm*?J;C_Hw;Ky@z_=~Fl z7Yv)Y*f_O>5H7ZNlRQhWm>c!z+)|V)&I7|`VCm-5PpT`LDS7@6&2axav-~DRZ6;0g z+MO35m<@5~%%!3cI5B1KShHisC`q{geX~zxXISlt}r^HN36?=821i^#wDoa z7Cht6(!lT;FaU9R`15vP73;sA(_#_ON-}bDTL8>qxGqC7P@MptNB^x3;A3Um1?&L8 z-~0j{>fL+M`{s{@ryE_$4{U4gneyCb8I8=Ia!#VqwG-)PGz~O=ZNfBZO6!ceZ!Fea zrpo1E#Nm2;BxpsMe{~rA-@rtLjY*IJ^(Faxgs|S6m@hyNzG{&%R#C8Njw$6{OPc=Q z+PD+o^oqJ2;vc|#rxgSY_+BofIXiQ>BXQfP85uS+vUBkrXUR8rmo-h((d|6A@>1jL;C*)BvR7B!E=s}!Qq&gXqw^!GG=UbWEpP*B*YFXm*Bcs7ig=`xZ~L)Dx`zEjuQz+ zHp#cFtRK^cC&mUlP)`h8tl49as%zVah9NYsC-DwqFd7}?pz9kKF)>>1eQmK{Zjmok zRw}^jEf;=NHD|tmh%Zu z0pOz#8*zyD0rO<`Rm0{CxQ6sj+G|{fleWqR6abza{~1M128Sa5eBEo(|p5h!w?+#{o4jequ&V}Y=wXYmKI8HzR z>Z?LxHsrwTIkX;It$`g_j`{XNzXj@C)K%Zg_7rWD@hc;5J?&UV^Km*`f1-~}0)eJw z=-9k{;pZqF1W(=$kV%St#0{~_GMYo9)Aj8){QC3jvVPucOih@eqQyOhHF&L9|FV3Q&aIsV@#4Ep#ns6edEDkU@UK7kBEVrTV2L8 zC`4*aZZ6FD#}|tB=0a?_1IKa>UqmB=k~B;CiE~ipa>9TfRw?5!WJ= z;rv{{^@Srpq(s!|r%JH#;#AlHK2wf|r@tUN9`>|4Ikq@)c?Sq-tcujs~kR7K=sqe$P@;0r;_UfxQL8pKvZ?J=wIgEa`)f&QR*Nf@`C zRoDe-1|JquHV9%pbj+$!sa!D2_M%)2ctdnA3DWG7-7dj!-&2jk6<1DjSQ2}6h z+@~0=sOKet!+fDX^V&-qhVyw{3$QH&wlaeM!vluR&1=8wJU*CVC-#FghV=IJ*pv-E%QSxAd^yKBQGO1RR?0G9z;s$ObU_CDP-mFh60S^(8xMVe>X# zl34x4doKo@i|XVX@aEMW<&W}mq+VD!cC?d>RY z)J+#7KE2asfOQFUc%)tlfp#sD!8iR9weSRF^-bWE0S=98)Nd5^V(Lr)a{M!}KK!ri zlP&*gjZ+K|)mT)0xd7=_&V_^^$TMb3Sc@{{8z=03&8JpObeR#U+s#%xQz(afg$vUa zx#N$W`lzD5UmBXENTJkwzqHef#4CN%P4}pzn&3HIhdLk}ZIP9sN2qPZPhsTb;Ns(3 zRhyN47orD)FpskKY}P_^@;**7;A{pJ*#DTtw$4v%j`~v{JGM>Z;l_Wi*)KM8#)10_4Y8r;Em&N;=C(Jf5D>Ds1KLX*s3Q6CTRMoV(cxif zN5`x2@wX;|+2C>^?rh^f2e^%rUFhraxrU?4ZH53li+#Q@cyg&uV*6?O=z2;ZP?Vx5 zq}>b?&%J-J)hdI;pp+Z6GP3Avp3Lm``K7j_y`vqs&n3FC4V;9wJ5jUgP=ar`tuyWq z{rbBf-o1m&h%EGK$lwr|+{3vNz@~R4zbrYA;F7OUA%BY(irq{E)ZTzsI@K1b}3()OJZ1_)Xq-S|*{iE3EzEocYK096BLq4xDF z!al7$eCp3x|9f+Qmn{)&6=(Tb$Tu}r6+h=rH0!bIJH zoooJxGDDf}EZr~e@+9}8HDmfJfs%bi=Bw7v*2h+@XHxfzLnMhQw5QRXDBDXnOxJ?B zlSiKJ9K!CPI3oo1f(fdOkMALn#H_tfyqpYhlDtsEwYvp_KuSHin<5o&$>xB zvOFK6($mAYus(@szu$GO1*yar{T5$6v_ zS9vj&qASHoYKh@4nSMBJ+6<_Bh`b!~Q~fRSs$fYNImvyTzTmupJPbwsxb7%y#e1+> zdeKfy;bz3eYRlmPiZR})GLWM}rTZ3#G(x+xtDGLsj-Gan{e8EE8$^Il zFqv&k3A}g;$RMTI!56tL6%mR-4$OcTpa^EcgPEgZK(vwY>w^RgWia7^2_dg6r8dko zvc0`M4ssy>2cIS=mw+>cBGp#?{?UKE5m0$&hve(ex4hCI)QQ?GkmQgNfP{ue40?bo-qt`6&%1ic6izoDlr1% zM@5}biYQhbf!iZnNj{;(3MN;%*Fv?Li*eVR%|B>Ed z0fZ>zH4Gkf);EY$cr{ulQ`5Z&#R)@$$^aSk)Fw!^hp!u{+U<$ADYkmX+Mf)WiN%*y z)&h4FuEIF#<^~=FHx5wYIn)f_Y`utTFaI{LgE`RoT0LdFO0`N8@}ceM!n$I! z;O&4rRLR=Q)63n9pZ7$AFCn@Pupzm*xmmRpEiK6Vh@>&%+44XL59@_Oi8@Nh%nF?6 zt$KCcKi3n;C*4OUQaT$IFSt6CL}?YT!y`#?PNH|EVSF~Ts7QQ!2c*^CE#4~yXF!&! z4;I96=sSG)u1=T3lpiiIhKZc@WZ&IdV`SX9U7nXiIK zC5*Vr;D8V1`sNQUX4*1_u2>co1RgXpZ1*S3u&^-exX>>(wmMqP2G7{&F)9t&tSDG) zv7I?Gq_<;p11p-9DUSZ7-;cgo(X|_iEzZ%p;p-MBRUO46t@obm{OPUbN^DBF+&3e$ zUIE^QSK30Y=MPlVMubnQo{Ni%n;YKrdvkO1zNBF*CzVqdZuv|LCzaPDC=ExA83PM; z$xt=Rsk;Rv-|hgdTp9`-%2!D@45S&UymQuBJ><^>U>F*ZO6u}9|J3Y>b5p6zP|hR$ z7HX_%h;$6#e&)XF9&-m2?Ni11NFUdC%6PP4e`P7fi6V_YPx1X|yuqM^@`hYD(aYOu z9sY)Qlk(zRpBd>FsIudK;(bx<-HyIkeMUirVp%h=Ic@#i$%!-;Gtn1n<$dM-w74G3 z*fh6`X@;9Wd~u*d(2hSF$V}csPrax4_4e)*mIyECQ0TfGWT9^XO-9w1&pIyd)yUdz zkan9dY}gFU=|+-a3%p8uSzPEG3b3?7VzSg74nJKWw5<5b;isT2>12)ZdeVYZd?ZC~f0()h;sR-y zIcOXa;M6NAp%;boWBebC+U8&SorG?Hw+*H^S`o>g?mG|7we7_a@kiU>ToO8LV(0f5 zv7f=a65N*fX@n=1n96KqzxQAoCd34sqR@q+V6zq1UB?bw{rZ*12ujpo!t+0m_EE8M zQ7-{Pf0aSgh>O}QkIBXg2G$k4KVCQ5E6I}eKOAQ0+kH_UQ&#EG%1IAU4#oUA1| zn5F-V`gGuAYMryf2STj0lzL;r54pzexdmuCWc_UQ)-8{LH=Dz-FU>XQ`{*@n1<;QU^R9AuRFa^|Iw`Nd7M?LYzCdh@Ogx;!lZb8$XuF@H1eDkv@H+ z&PU3Jtk1D4R)RWiN`hEbZ2g2u$01bmd(_7H!I`qKFY zGTq$hFGmCL10iMnbprDiv$?i!xGbX%r~6<>>TDS_#Qcs|8lZ%=?>~rY-*(_X2ure3 zSS8dc5PTXpqOpBYI9B6@u0lCwO_>`c<|kDP5Y>KF-1JEE=aZV8#{q~Ybvn?&(bUwG zkbo(_oCPj_lk!L>Bj!b_fx2mx`DpcdZ3MuCV1`1R#Gc3aJkr>tRSz!J=LM(bbRO5o zu&Eh>g8;J4u2z&=$>uJt+=_QEsmPIDqL*Fb=esq;C)uZU#U6Nt65Vp#JgCC0xD0pg zs%zPk{*qC-+WaMZ4^U;%bmdRd6K#ZF8Cp2yk##Q@FD=?tuUN!81Z=wAYp)FL}$y>|5c+{*>6A%43-vH_U&_qG->uRGpWzi zVgVQCnMhE*7iDwX5s6yqaR{&i0D9EH1^VlYB-jsD)x=ZUPcEXh@S|{xRR&_II>&FV zX?7t-QA{XxV@t0aQZ38i&`0=&7V_|(Ec+J2J zvUMoHRDm=fv)9}~ANAFH7Sj=sIlii3&c{Ya0d^TEG<^190W;XYl#LPKb@WQvj5gCG zwkn%LTBknBl6A9uTxxmGJNkRSHZ;GWC%66frrOtbh@e!v(@GA-4vGGw)DEv1&#l2XDC6=#F+lU8cC}3?^-Y=2BuKL%!Zm! zA!KY8Ia}{-2pE~@>qYzenFF%6DfE@1hl`=xG~XOd$i+peQ}e&+a(NxSp$`p0dfiNW zK$r>lh5{Jd6oBAP-I4!H1a#lXR2l>SI=(T>|M~N0z4gCLh%7!nSL#j*a354L-f5lU z0~eEx?Ovy>uZR-Vg#OQ?gp$Z-F(NNh%c1Z2M&$=PNE9yA2=%W}9GQ0EH!OBf`$O3! z0@V?Mkp{c2;xJ(y3s*B^%<-^IbIh)6f^u)3Z_Aa#8~P6hRvdYbB@&nFROW1>^VHPd zerz$G&ytro8lA^7EsmRo#LJQ#cG{~3<#T>@l?#SxG-qKw!^${XFy~-^hXjnp zDPOZNBR>UdTBv>*8q7a@1yCTytaZSVYH@!4F80NzJ6bY7E5u)gr|TWy7cVEJTGD^s zew@p5lpu)Z?IKnp-ts>?$|FreKoSIQ21J0RBUl@QwYV>qpz%qy+ZT#@9h z{5~n2#{G^in4scHI%ceXmMlmDnaHw|n`5$f6gd5CpLpF2Rkq4G>$;&tn4qHR^_sy!F@pemrnaR^M_CucanpnfHQxeUM`A)t~NI)m?VU%EM-B_$a5NPxqd4xQWRDy zC9N!_s;ZQ|bC;&a(TZWJ-F4z9a1#v$edD|bB{&;Sk28Tkk9;8o2j~r4z>+uk zx+4sB&()8{-b9+<9vuUU+O*IW9Ob@U<9XP^+W8mRUuS@rA*quBL)l6xRGq_kFl5+ zr|bUKyvFsr^aDSwR(h#XvhllL%Ta!Cccv!K`GI1-&nXwAQ?lj_QTc)$J25+4Jg6^! zRK1@D>08skbFT`Ugx@&a3}#T;?waQ^)?3|LNc39VA0a*Owa)!MgI=_EirJpJcymLS z={erep;ukuiHQJ4DdsjR5go!b%;~pca>)#al73={4v0knwgfOz@=7hM$)Q@Z1^_YdTLZ{fd}PMSg-C7Q%hP0^sR~fE z(*Pt3=sU|qO`OBZ2%ubrCB6p`xEjexo5&~3B-9qo!o*07Rj$jC%IXYAbi+n%$zs{l z8;_;Fcq;6BN!S?|w{(Z>kAK^3jrn;r^PIUlU{NCuGnbbXP$zvY||%-B7atFD41!O%hS#yR^%x`>|My28ZQT;cVw z>eZ0@*p{a_NlBu4jeu$E`_N!cos4%_Snm>|QQ2yuOgrBPA|bhBZ&Pn2H-weK$e?R7 z+P9Ft1+f$|?ao*pbqjz<*iLzbyYMHnZV52bcmJ&i#WdZapUKKwJ z6Q_Oh2Nt&Z5TQGStdhC#jhZzBUocJqw8V0snans^nL;tL0cRogsp0rV;xCp88T|`n zk+KP32DeuFZ^sn5DJ6|yri5_rgt&7CT3XKB3V+f!#^OW$Xhyvsg5IUif5#pWxy=6w zr|R`ED^&mHI4Q#F2_}WP*2{PFNv(qHV;$er!a}2Q0{8D9Q*$%1n2GcCeepvu=rVEw z9BYr=_mP zW0FB)_Zcp@7sigIHlH@PW#ZTy*M(1$7GpPK{E>%BSUl7|N3s822E1|Oh=~c)6IUhO zR?8ZmXffeEhzQ%8A`Pq}lh>+3*pZ9;5)+eVE1{VZ1~-{QXxL#V!vu7?OMDz?GsG#T z1jsVS4Av)FTqv4&prWKG*9R;r5YXlmLoB2;G_)W&R2h=5SV_}IShuomq6L$Cl(`4q zFvZNCv22OoA~RWi!==KJ%JPS<;6N4ngCiBh|AFt#zlx^NH(mvRUY^bfDAc8SfQ*3- z1qDU5TpMUy(os``P#(M38Kc*1cuPctdfohW!lxSo4sGE}k^2Xrikh9uq_Pe1lW;#P z3A30Gs@*T{ggwYF&Z;z=+x_N1YNt?CZ7+zQvV?2*yVT1ye|(Ir&B4Mpuj8o2l18@n zDWOW_IH<%RjomJtV0HH~&Y1`Hi{g*1gC_^&tVwg$+vD(D=OeB}+^sXFmjjYza)jF= zb=>@YFI^LTI6d&>b+{C>b`1#Y54MGSFB^V8Wju^KAKh`Lsi&DYV@*<*vShE|@4C%t z(*Yq7BHvCSm&zZlv3Tn^vpxz3)6*&Y9W;=wphhf~9>!ML8A@M}IL;dq)g?RzQk2}) z7g602QmIl!_&LMjh5ZdRjlAYs>xp>&mdD#s=QdX*yNC>)7|$Ef7Cf8|y4~#OoY)UD z`?b_5(sVi3ff~Rua^`7eQO@~kIFGId=?P7RPg!t)v z{d)N8^0{-5N;_xTV4sew#{u0{!_G7sk-q-m&QfVg=;-E%{+8Q{6oHY7Z50kf_6?7G z1#Avoli^KV{J>q@@a)IARnO4hyCOn+{Xdvg1yX+1vY6A1i76{d(a_lQpq0q-7NrrC zhQ8@%7LWD+Q=?82OLdjAj!fQ;W4pEVK?nfj=y+_^K-Pa_MyC9Ue!*X-0o{oisJ|6;s|!_-z>rECy2pdzNzZgIIi zT@MZpKH{uo?$YD=tRyF+RMLOiXDKqZNYM_csxW_~P{XO3)2D6DjEQ2JrMqxH?0&T- zPRd37N_PHbOlg8q`Q5q^zJk;j?yc^W(#Ai>6O3}|)M4z-AN2-rE5ZY3Z&=vaTLP(L z!c~OlZhJ*|J(d_NSFWaK=x8anytS{&GnYTXI2NC@>8kHL%Zxl8J7tP1s;DOVZlu`H9+#rDkHRgz zDOU7{WezGPB@Bq{9=Z*95t?_w?3l{cq1?|sgy(#=%=yNiU@o36p<;{9q&_)k3;@Y3~URz$Sdom)x5Vgof z$xh0R@UWNhlz1Kl){_ZbM%A7`tJ2sA4W3#c@%#dt&KAYP zM^bgIlDI2>>bymP!tKv>aEs|&UiW_KIu_EPf$jy@HkVeGt~LuSQ=72aH2;%8$LKA| zcf}-~&!p^gaY;~0X@mMG25n>u$GePDL(JH8(BII4l{xd_HQrj;pB+j_(L^N&Wvf)) zv0o3_1)qr5v}M*Y&iJinY^6^4D*5>D$Wd~_VMM&I$o+^ArHCRIw8ttr=wf=gOd}?% zp3!7@qQNz&D3L4^rRl|K-*;Z;Z6-K(bgJklov%76*?ly+((sVwH6c$6Wt`8 zyv^(BNB;I8jg?+$HA}6ENJ^Qs$E}GkN*hhr-mkol@%LRb*{yFLfRis3> z>c0v=z_f~8-hGf3z+fn;>oOJ#j4}2c`RpASpwGYPwo8i0$;o+p^A){XRrBW7*JEq0 z?dCrt{>5%y(V0g;T=Ob`;V9VnxMG=sxI7cblr_3gsR9-9D+*e^I|mMB{^ZaAj6+O} z9oB0C3?V*5>JUMpvwXcK@2Y_gn2HLBGP74SyBKQv-9P20gTo~c0W3%;i%Afmo2O;6 z=oZgfe19SNcb0e|xAb?LMn}az(PMg`B1~cKxI7%L8;GH$S6_Hd`jgl?yLcWbMy6T2 z9kFb750{K2n+zb{4B+Tweu9^>(#gvmwDuFDEZO3zY4`ZEd$t*5-4vjVra!Mqm<31t#%S%uJyaeE(&8rzq&+z9CA1Z%iO0QiiKo|U_f4}Q@tU@Sb zI#ay&dWq%pz~nhd%vAII>4AifhW;5u#hph>FMe)2qJ5L`3=tN1Ls#ZJ!BjYcxh=~G$kfd9xQp^E+_GEg2Kzo zrRykQeK50K&oChrca1|VYT}}Y?_QWr^-#vh76d>;ayd{C;zJg4C z)i*uo%n}%f$ElK%q4m>XRvgPC|KfP}5Ub%W3EOP4F{RPZ%%x_}2ftST+_>tC&-F!R zXL||YHsi5#JlMj-32yqTDi&aBa$b=mYQzcRC(KOL2Tf||;q{#H18hGy1d}F+)dS~0 z>Y(io`6=`rBoa?{EWNVnBe?p4tCZ<9XQ3*$PnwWXJa@Z+mipUk{En%MM@1y0Nn;fC zg>amW+hsOidlKejvOC+_+OBgRjN8x6I_N=SZg&AmrHs3|%5qD`yf`FwFdhryrr}c~ z4J6^VUCr~qY~-xT(Ht9SN1tRjcI}J@Bn~bi3D`;T>N*dCxLh|u6$Tsk`&}-p7vgDS zd@qNT{r$OWOS)fM3Y9l70s?e?5a9}6FUDfq{=sioIrjj!yU%R~PONwolBvd-yWP8S zA{uCp=}068szc7VzupwQSanjp2vZWhVvGe{bHRYt9d=q$*O_ZZl3ud6Ch}{E@zy?$ zNX}Qe%|onT$~vrU;y#{M!xz*vVV~EH+v-DT4>Q$R3WkyE`Dz~aPhOshy{@*i7a4n* z$x0El>!Unhy6c0yn*PL1Gq=ho9XcG!y^ML^2CaG+5NaxB;=A=Sx5J%I zsnDI@y9!KEKBGlEadw+O3^dVWMmuHVIW-&NmKm$Zb=GXA>dgE)NX!3-E<1&qc1<-4 zp{9E-$*!Hdn3qP$dhTfli3eDp`kT>)RZqv6I}f!vg%0GE{DH}Aw_$cl1Gxlom-JTd zk|`q))o+N+V8@n>-X@0oP>dQ{4$QY_3>_0opw-ky(DuqlJE1w|Y$euOZ=Wvlo3`{X zf6q>s=^!2}yo&DlxqS~;*mh>cCN5$k_;hJlJeEL1wQSCf>R#K-boUh>iw6z}m9O~H zd1ZwRHSd>f&>`^cD=8`I3IUC(z=%m|rc=G7#6&e(EI|7I@BmD95-3iu;LXq70U9tl z)$42)lp7c^>)k%{w`8=n-QRl!B=lBZcgY`w>Abky+6i~g4R4rv_bziqRwnR>jwSC= zBcWZ|R5dzo_2;skDOZOvJBHASX)*V8{;Y&bDlap3APtaXAS-dwo5WDfapgVR53>ns2H@W|(~ z=v|9$c^KX_S#^=RA3ExVc$^To+?<`s=BAFA)!&T~Z>14q#08Dk*tRIkXh%oJ#th(v zp%Q!kR0S8SQ3s8EK$jqgjT+mj0z=cLj2IZ~1O|%r@pA~(R?bGv^vP|e=e7Q z%~6b5vzsGv#E1!fKWk0jH!D|CHd@c;^srGrnvagIG{t;jzgatWvdV2wSL?da0JJY> zqGkqyl1Vy+vOos*ec(@*O#|c0Eik!20;9)tRb*j0StC47a{>L z3*b_c?BxZ>dDuEBn77ay3(4@R!s_^<=)*vc0R-b$tCAc-;O1BA7{O?r*7?hOPyj=M zH(&Mr!0YZq$&39Zc7lPCbvHIR@+htSi?r^Q#1cMCEWiFw9-;c05oc2T%|0L# zLLs)!DA6T*+whdK6HGCsOMhf5GdLg?$Ra>V73v=-6SR(!8>2zp`TTn#4RqYe7UW|j zi&J0!PDUK8iB!%e&y&P@0taQRs;gdAMCPaW~;lC3~ui4H!@NL(3#j{F) zgvWe~=lUj=ilcJk_d`cI{+ zPbX6A-!N<>9nO0L#fW@uk)-pZBR?wMQg5=Ai`7gTVZNQLd?X3-hQNqNweC+#TwN(s z`;#ki5+Eu%j9^>ShOWZQT3=PgH2Xt`bxfh{t~@)jye_Y?&;cR3u0W-yx!90J8cQ+b|u#pR#f= zPahDlX#Rdp+nUyRR?ZNq;in?OZ{>DV?%YJn-oFU5Z+}X$PoQ@NbkBI2!P?JFBekTH z;>rE#B?3+AedUqO`uIfNv-7!586@Az$d{V&zt)o{*hqCnin47usvA{4pe5En8RQ6R z(Gl_;TsTC~W5*iDLRmN8y9NaYHZ5vD)DIEyQ%}E_9jk^@agu#rU-$AFooyjPEwNSo z)f#z=$+&GsSlxf!&!;6#5D%{T{ztqpud1=L?;*188ghN&xb3dm;`g;ghX_r`%5zG@ zlzHw)uNjg}ZXvvHbobZg^bJeyZ_&4Rj%+$9iaa9tnKm(L7Kvdl!Y zewfbrO`e9|+2~K-7!&LNSpxB_2^#|sW6fc4Q-UUtQd^?&YKLoOf&_BRE|c%P32!v+s+$k^*p&JV&7M|UD+G-jUH}b#e1pR#TvmYqt6Oc!BC_O z#s`m3>Fz3X7guQI>5tcAg%&wd?(_QjwxxHk#K!*+VqHjz3W^HGq+lF8y!%gmpy81b zU(4Cq*-kHkk1$yL7}H994mHvfMH$c1azl#xn|J?ekq!FCTEJH0YGIaz&ao?|h2Oot z|4nVk&JU(p@<(3`4xu&5Gv{SnNNk9~i_)||!M#Mh zfvw0Ao?q?=o&I#KvbI^LS0$c5Un1sc=j2{BhFKh(SQ*f}_w2B`=nNGq{+=*8)a9j` zBR7!lUAj%lC%TS8-SiQ96h1t)TC+KjNDB2i2ewiCTj)Oy;~x)-?l}gp)zt-yL)xC( zpYP;=nh`L{;q=;CTQ90w5wx)A zX9N&+5%aq*C0#UyJsR6X;!01r*)x>1pXIzBf^@VbHRGtSk{6_asae6?HdgZBtY|zU zw^dYdc5Y#qHsKa_8jp|GL6fz2qY=yx^N-mFgP(`SD=p8F@;1KvufCxVTBIA?q>VXS zV2~6cR>?^kKTw29uL}Gaco`M&M2*RObYwb@qV`j-fD0nCekmp?ex>4zHB&jtkl)by7KQbe>GXkNx!jSZz zw0~9!k^llkVB#@*=p-FrBQ7U1tE7mLY;v4jYO|ogc~YQxrcw^GFV5(8WzJ<7KRw~2 zA?9^K|0;x3F!g1)WcNDjRt-W0?2<~aj}#UD*dGeKS^0#SA!cQGT`s56v)X_^F8AIH z!_QZ<-MhNxSS@d=@F$^nQ}RqD-P8g3a7sA;?A9+4u!=A7NZVr&Sv^@M-DH4NDO%h8 zv%WltSD*xIt>0+RtTj?=-+s8aeI;#J}6M~DV0EPWZNlU9Xn>_ zy~rbpiqxBDW{tA`;Z&kw1ir*W4G8X(@7YK|?%%}i);A>kfZ0nzsfh@-PC!JcKZ;rW zorczztX~={L>fn>l;9NPxvbXI)a0UiZ?x^k(5b0HR z9k}=3E5qv9;);E{fY!wG@+1`7K8GQIHPw4R$k8OchG#Uq;xqQ4R3-uiE$R|vDCWN8 z!Y=#n6z4WY!JxByNEj=O_h$Ghveo?_+E;|EOcrNStYbFw7p4tv^1SkUq(jK_Y~7KX zLU-*@98$7(M2;lOvpn3zX{2k+gXVF4d_w~Rcme)D>?!o@JTSmW{%&ADmafpH6Rsj4>0VM@*Jte!{!FG?&R7%cEK0LEgZOjMT4IMDubT=@ zc6l$=a^yksK+4qMF=?T{HeV9?t;M#TdrMqd(d+B&MAkW#VLc9VVq^EtZ_@OPrVkTc6r6-F0t}ukgm5Ze%a#CHb10oY=oQC%HCHaNOv1gQ1?2JE+&ig z6;8mISm8!hMGn7Iis~VP@ID8VZtGKV(}nS4~`*^zA$KWwnFE zy<;dgXV2lcV)wrU!ADz*c^-!yIJGE$Ho2>nL~y9oDb8TU=I#|A7exYF{ulEKJ92 zhyVyU;4hX2QvJA^9$Mkv@`iVp9>$juQe$F89(3k8q>n8^Y_OJAc7M2#2&_213@btt z*vTcXCg7uq*$i1Wj&Whn>9Trm-36R@;K3s)uk&^?{zgi!+`rt}WcT$MN-g)$b)`01 zl1JQnf`||t=g+fxx!D14VGvOJk*n@XOn_g(i@`z#*ADiFSWi`z8!b)P)#hZu- znHjd{<#sf_r%`|0Aey9$!;cV5hzpsKfl&HJ3H=SqyDz10bfQBSCtwU%{-{d?hglo$ z-MZ8stV>0i!4(2k_QS${Y9NB9L1XyfJtbW|DJ%j3Z`49MwuSfR`na3-A>b_Rss(sj zK5e6odTuWVON#vNG3;%XQb~!3Q$jaz9OMOh7azGhW_<*+vtm92vn8`=4c$0kKC*t+ z-4~=^kp$zWrxI8XUh=)k^OMz9*Zz^2l0sk=>0EgxQVL9D0VS#4ex`yA0MdiHYnU5Tgj{1#aSx5PqsB(Dl!2ZUoUi`A zwzd}ha5FVIv&5DAhp=(#2Zky+e z_t^aH@$upC;pph`bzVlsamMHb$GSzhrQIlpaX1RaPB=>P5BpILGCy*8hi>4bS7kzjIcpaq}r+ zqi>)|isa?$Ais-aO2$Q;xpKvcjoJ~&XWuXS@v2O-n-<6y906nF7J1qz0^;*kzz)a+ z2Gw4=msg==Du2lhp;+-3IM&vj?bb1^OSG}*Yvp+M(sx%diCFrLCiRCC!t!Xu0Xg{B zTDcOa+kO~)IrgWg=NaWHD&%WjPDZpj_b-4rk?fIBql`? z+%JO*Z`M$ml;{A51^HkMi zHh`qYG?V2C29X!=@?^E$D!kf5VUFYco}TtGf|oXsy3utN9~@FRuli;$F*I;tXc@ER z%zSK@dQu#_O7%sB^8B%EH6&Rb?rJglV6fr*Ku7CLx`56v3CoS?>4-ayO4rT11+dUj z=b_VVBGeof2y|}u(G&znF-{_<&#_MHw~NC}&jn%mvJP~oe|Vt* zN=X8G;9*}cn0~)>MOzZq<}IJRjbNaGvX~)dcwu1y(76G9?z05Y!u79DxUgEtHs$Pe@wowfSJtfw2545)OGt0W*EiFzI5rTYMW4Mq8}93^@bX_ zY2;sGaX)8ckDwbRemjV3tRM3{%XPoY5%wE%x{{zjDVMFCIHSX-keNwh9ihvSi-$Q( zM1+QE@7^oXmZVSTnm;r>NmZZXVO>br-`mBQ?Z9A4oqDP*U$#!&r2TAfM!Ia-eI8g? z7!;c8a7FBZbenG5$LHZp)A+NnntN~M^YRaYrf3d4GtYjSRy;md?acj)iI6FN>MccH zwOI-l>=G``_oaozbG%G6!zYDvtvUNRmy{hz`^=Q$hg z=frLifu#n?zAEuJ_77u2GtZL|E3j_&eij$gP*G)1m~d&}j{w9%6jP}Hc zR;>I!I_>dC|H+NSXg+V3nSm)dPgWLATOSfw#q|vNZY`K=R&?W%o%Dr;G<=T-StvJ4 z{Rhc_2G+|>v@tw47whuHvA1u)Hc{n&+V+7z7<*O4rhwbp8+_oysa$*=zM9T*mV{KBz>^3*Vos6t7IhvTkNmm8xE{2 z#q8syu!psgX-!GeoyxyiQ~1 zbFTWm!~8?@=H5549VX6Eq^4P$GfRC5oU2pH+t}{{_yp7+Wu}&VqGMP zV*%Xm)8h}*O$={at2N(I%%Ic9jKQ;vK3Z?%{#b#P0>wU@k+$apzLm4FG!0EMXW`68 z&2Gx7Ncyh^*T#j)QL@qwJ&pUKvkHb9V(>ADIy?_~oa3Z&k=Kbmt~xXJ<%HjSVUt+Z zEL_iiJr({Iip!O$W&I3j9qb;^DKIBRi~^@DwTdeW1_xt06aAJ{GPYpA;wLGE$S|o| z&JpzZc=$hE4{y%U3VlF6j?C$`4zxlsjzJZU*&qU_lX}ppN&=tJCq7A#S5o<9se)H} zsB{u~Wx8M_9vlf~mWP*@mzx`>$s9gDJ}}+3{porUfcPKpuMQ+6B(ic5@}P=+J{v*u&i`XCBLH?h?bE!981=%PLl* z+V4s6QQ@3)kdKKFhA%i{$MY5chHx4P?Dc#-e+4!FKy1w%rE`IQXnLV?g{XBQ9weA%! zm@f+D8Yl9HyhcY42ns^Xf!jLSEy(n&N#%7u@-D}Y3J2VJm2F8uW5##~XBv0)wC8Ph zA82j7VaXQ5s2>~LwicCTs{2I7AH-~RG&tyPSoc&MEfudw!h!BXM8E6~6)K0APSU&g z088wMAp-Ws_4oJp&V)lj36c}IeGwbXIGiacM;_fFr)X%HTXaKT2HB{q-MGtm?2bfs zVq%i5y912xrXoq!U*>DBwLg@5-H$PRhr}Q2TNkk&{wxly&bdt=r182qHn>J!t_Ugb zK93HgETRV?5r^Yv6#R7=|58hwj%H$=MEP1aVJ^LfF3Aw;grawe6F9dUa0$$ql_fC7 z_=t!5iQJmtQ(X9|*v5BE-pmto0=X}QHZrIVwzf_mn@er4zK_0%3t@Z?P@nyY6;E&H zS{5G=V*qj0OIb@x<3HXia5Y%7zuVx^e^sAi+8~(vZEfk?N~^sDGG$4mjh%0A6ye)g zgM)(s2M<1yl=4IZAVwqUftCM^5BerVS+qM(TB2K6rip4Z9=)ym_f8z*oXwA zmRnP_3BA*1r}X~!#lO5SlY5%=WZY`f;!EP%PN&|z+=#jj{sOzcmAp3JH0hTI zN3fx=$rFBe<>BEWCnrBUJ1c~M=ObTe|L*DOIXO9bc=*0TsHV_o3*5OEb__1E;1Eo} zfxt}~NewG?jx)>0WdgXmkY2|KCPy_2J%yz3PZ4?QpPx!rtfmWyawnJwapZ1G{uZA> z`Zy^O9nGlxl1NKK@oR7CE?u?)&7EvLxr%fByRb0he(}@oxgR1Czp`m6EQ_XgS?9a~ zbEv-1hK*TkzW8Mr#&XqY3oH88R9fY77oK@gix(pD}hYPE>#^N<&P+~A zBCW)uvQrMFQ8$#srlzJ2#y%8p((FHuI+$l8FTDDNW2@7Enox2^3ppY;rRya4KEURz zfK1J)8emxWvL-ilQ9bwMSD2m^uMEsSGEVu6YI1F-aY2|UjVpcD>nbKQ)Pp3xL3Je$ z-dwa2sD$zou1e#^9SZKXd9#3=N zeQ{O6Sky~BtWsrmqe-#nr)(&d`zBP47^5XOb5WR#-DE*sz_K8CQ_c)8?6__oTv$fhysTE>$XCbQ;;Oko-SquSSW5+4 z60Rv>l+4?5dX?SeBkBx%;s=-!@>l=bvPHG^IR4RglEsRA99*9C#_c$NJUH~##76U7 zE?jx4)B$$na5_C%&biF{-*ly_6)oe@`i{MPu@Q$SG`;s=5OnFF9NQF+WTcbplP%bB zy6$4mG%yhu7We%7oNM{mBP-fQse+TFskxG$ms0i#NV?!tUO%7Gvae0Oh0b40BY6oU zz5v6`Q=B+EI)WHFQ!-#WRP^fo(os=@L=mDdg#i_@@6+5_O;e?$Ry^*&1^E#)QR%FZc@>hqm#w2kyX}Krp3@q zVL@h?zKwBV;^(K5FA!`SBm7%7Flly;W7bNWle|WPoV*&Rm3mv_FjXD3ON!RhFr`=8 z_-(Z~o|#2V53bWMNKcZt!lWjM=TOtTbr+bKebm&#PMr#Ozxzp#9yV0_#a z`aaRpD4$pP+E-l0xju55KlLVL%&dffVHLr?W%Qt?&P(Ny>uU?!;$4+0RGyB(sokO7 zzXpRt9NOYO&S&r23b+wQO#^#PncGim@h7{ug@wyS+k|Fa1lDmeu*;su3H^_a_NP-4 zi6jz5`^EE8)UD7)K-CTuSqwJqv7}tKIVFK2uIg;D>|y)Z1`j)+=-$~yom$u9#w6BQ zz)rykNOg^alXHGLrCh%rO5<-`BtjRQuCk$gnJd+D_wKU?B87#j$!8P#`k>(01ILr( zGZXVmfv485V*I*bqcB75+oK0y7fpq;Yl!}63vLb#t<9^J8)|sdT8!%bC7`?U*gB;N zAx(=vt>rNT67AYIBt=i87_(HWd3T3VChJ6U9l8KrJC&wKiF#h{n$I`xrtbm-maX@Z@nkKQfySs_1yOc$7Zio+6a2h|v)M1|j5nGBA z&z(P~85jQce9hz)ifThRM}3%fdYZ7dbU7i{C&+J`zJT26Ah+#fbxpDb+t355kFH9W zWhpZ?R$A#TM++9ZjVn4;Qs6jA4QHRjT2^Ex*)omLCXiz=dPu`^=N68N9eLo?YVw5q=h%C$*IbU@9EvT?$x@V=&GyahHvuf z6OiWy2A;p%DD;yINRbje@{^MzPJ<8uwde{m3RgaY@J|TeUri(*A~fJRioml0gI2bI z_=Vhuc%|$Pe?lxJD+_ppD1iRN7l<%yge!~vseEObksAt3P(^mscW`kr^#3@h0@8UC zs+Kzzy}J4pA)M-M= zUlIN;F_MHIL6`BM_zGbql#`3=9T8Cp_^D{axwU(UTQ;BLQb`LdRfEXb>Z!slVZ!g8Ez3h61fhV1B*V3^QoZAc&?yv)$cKU60L@9L!k%Zz{UFo4oX;oQM zOH9|V!hPL%FLYXP*x>TkhMr+{BDA{P?DyB5y@EuG@gbrlN@Gh)txaz7&NH+L$a&S3 zgX^+`2GbU?S8ubcEqgp-_b4*G3gcSB5rj#D0QuMR(w0F0Dus+(`e=4XXc^h3c8G$BFvSa{tbe>4 zRDhaZaT}d9L^A2T3!P>`r6<@5DTH~->IlO`DPRH`$dyz}{7b~*SQwm4NTN`e=QSqn zMSy@k0~enzPMuL`K%W6+w5gHM?PDDSeYd1%o1#3B5@~f(=#Wuy+sN}>eetBx1SR$+ z@e1yW+VpGWVxnkhVKNZth&vVPp@Zh{?wql=_Se%MbM_mGSllZ_%$(7~5As_ob6Z1< zrXhuyU+sFCC}N~k=j|S}&^}e(dXQ>w3`5_FS(bd@pl-SmhuC+FD+>gWDQ-r)P-T4& z{yTRpn=v*z+EC`o*_vJ^X?lvGmVS8o3f;_8dAyk&K7dT@+&e6h-_BVsT`M}PyruVF zV`~`#hI@ek?;>tsupWBd=__j@CMM?L!GGfm9XKiT>oLI#ii$1iPgs{aPvZ6N;&{1-q^JzK7ux8g5O`#A{5*AMbsde7;cjak* zp&U^)t(^JFxrBwGV{VT1BQ=kR1^sQh|7Y-*rsLNq=)=3oh{qY@2`SV5iI#owsMeb1 zme@LQ)T)I`{p=nH@HV*|#Bq+-KaO%4Ev;L}sF0Vt&tBhsQSV16=2#+(vqkHdeL3Eo zxQK!a<}k|La`=F$YO);!>JFUip_@5^FCh!aZf4-@#YD7Lraa_fT{w}XA#RXhu^X-ab19plSZC5$+CnU{1l z#akb}F@FV-vfE;W*oc$}we{hbk60u0N<*X2Ozyy__ecX%r+aY&5g9En<Q*SIi?^L~btiB7@eU!VQN zZl1i$(M@N4L>d4uKW^@&b}vC*UP1@{PUK3FD1&DJVMEPZB48hm93;5O3|a~I)6D|- zFIl)NG$tnWeohVmiPY&^0&-lM0~N2bWVqTp7HyJhjntah=rm3`odIR?9R{e18wu^ zxI8&Q0jw@Ic=;`C;EO1WW6E9=JncdZuln1*=Y?IKA~+@7fy?7V zEM!e7fO2HfTT-6FF?YiE<{am}!y}4%%0ByJXYO1qH_L zx^fm8c$NtY&UaFqiO?$3f(X%Kqp2fKm2+6J1CCT%?mI9x-f9@c+@_0FDax%aOUX~42--ksece9m zBN~))<)j%CpmMY5#j2_ShHK~Z@FJwG7Xoars$rKYQggrfpcMTl8D9@`P3^Vi->;e< zEA?>K(KY`37dvS{QPEfVZo*(_^3lL7yV#8!UyuLe5*u{sQJj+v-=o>4ja(B!$)^_A5_AH zKE?ovFdGIQ(rn62e3i0X+FE3S>D(+w#E2Z|g;p~$NASRWU?Kl)bfOo&y`xdqPFu86 z#owI5{I8NyMbMwBS=W9i3JK;$P}4$c*u_R;)*W5{bRMcS*qjc{&um7Pi_LDjvuo%Q z)|Ewg9pe^v?$}fCIy0=o+4P4)6L-(h`s$1K(x@p0S~5heCU`nDAid9Vim|D~%nF!G z9`BF8XCIuaf~Om5BM&Z@&hU4z>vHXr>zEXfTE+MPJ(3uhV@86iGezT62pqMDlUKBe z(`7w_Hebo^7avJ

;m$7!b?u#$gOHcXHDdn@>E-T2&zb4uyQ9=|)Fy zt-8Y7Lnv>}hN$`3 zjX~%ZNU4CGc!I~qIXlj;wgX|&=P)D77N-B&J~q7Je0ICi8Uu8Md6l%ScWUq0kD z_mGgS)?wx}^^pgB_nXsQGxI$6?a2e8IP<2c)LY8p<+m1;eTwuAh7RIwbflb3YDsyu z@|>JA+w<6t>}3|FS~V^galbsSWL3F-6$-^(Fg1x(cD`eDYIT3|4eYUsEG#6Yxh5Ce zOHlg-sV7VCWmc$PE}1yxGVMc-$bL^# zrS#U1cQ)-Kd{64H4K=ogbrZq1?!Nu1#Ez7(f zV|u7$SPLGk=bK(T2#U8N3D46EFO54y2BThmqf1g{VuQ`+v5_I*$I-=cVuyRM+bqddtFVaPk-}r~uLs)d;OjzH)Tv?j+CXKSI|4TI?o{aVx@?7_= zHD>7Dw4vP`*yXd2^Rd>%XoJHHbD>d8GhO0%5NdYUdKB-lAzF99m;h!-baO=n&GUi$ z+#-!vdS*&S@DxH;q|Lv*f4EKci~WZKu(JmY9T1KRwTNegaGI(ZisTha^!F=(mv5l8 zf<`Xb>|_Ex8e3(Ku{IAf-Yug4a^MvUxHd$QKDl=ssp!uI@135a?bcYQB&@Pe$;ZjG zB6-Fhuq+IEsQE{-T>dv?;qwb=aND&=?wW+k6Ogfv0Rl>&hv!-LK0^Qf2MBo5^Fm;j z9`xB&8b(;nSJgkPLA9hyQm>g_5&I@BYP(;tb<^HQvY$u=8G*a#ANBM2c_c^_MHkR5 z#{%ARo_O@Nj|y_?A3^}3D~r*k%_+!|s0FYiLrm_WW99y1j+tLmo!4dVs)ZOnB45nv zZ&nfgPI%y1v|Rn>Q%u)(##p<1XY#jI!dl$2ID6h!F6+_D!FYuSXg&*82%SM_Ic{%Q zoxQ)8?<-Mn)RX94lRPlF7{}%u6kM#_365xz_m|0lR)6-MD4bE!p z)NuiQIcsL1q7mgFZ06Fh^sQH?;p)rR=7g5ZdKN5hV1tR#FU~%R+4U=0`QEaN?rY+5 z$WV^uyKp@IOz)lW2>{uO*L?j>ul@54gn!Z&J>-g`&GYJBipk81FIcOtZZvumTJHEX zj!rB^xS*tBEd<6%WpT3!jy=6ZBOt(IJLaaGI!mC;ah1Kp0-?po!0yBvR!i>#Ui1h0 zE~M)d>PnJ@8zLoTwq)7vhwM&Zm04OqUV=eSx9oI2#!tahzmekiOBf-rcRd^koJo@o@oY^?vZZ~-;C954%1O^Oz0 zdS)guE>0dgnO^$(4WS-g)=*bn<7ByE0o@#(qGXcGsDtaI9gv_E=$pwyU10EWXXf2j z;o7X!cP!{fd_-?5ED(M_jB6n8$Cg;%VthClP>SCF*2CybG^DiZGR^0nG#ZCo-Oa>M+dYON~@5_K}?D5kEdNSk0+i-EPDi1$_j0N@c*DHmjz$#u&S8F zu_xPwWa$c|gMh@U z*&IV^aI$SoGD^1RdLGvK)GOtTkQu6W%?#@r0DCzK8sV3e5PD~ryGHoOTxa60vpodi zs$TW1c{(^yO^%|Ma(pdNq)pg5L@>`{o~tv9?bp7JvvoG3&xoacyv|)8@5efshDuq> z2+jsGV?v@Cxh)Kw#>`fWgVpy^IA9Kyn{4GdavSpLn>5YklRM<;80$YzH61%>ER8>p z6GgRS1ZY47;cvePfhj{Rqn%z5{B{FA5w3 z9;1B^bYe#<^qD!RaKt;OnaB_@$bIAk;&ZGKo23K&Apt6EAnnUi2W*Fn%ga%8D$9G2 zBs}q2h0)ipQ(oSO16%e7gv;u8!{D~))pJv37<0-HueL%(*-?qsw3P~9z4Sol*H;cI zdjH`TrhyodO36Li{hti|AW7KXcXzYHcNWS&H8|P9TwLJFipKi7*4Tm1OsRch_O*?+ zot>SlwseQAp?$`k)(N-7@yS+7M9GSk)cI4m+gB5~aj0_$r8N9(ls98J1v2aO<0fl0 zjddT#mHwa%6dG@RHebgM{R}OEmOWswR1JkYdfI&b{$+fktv@(_v8G~WW#{5Sf+NO- z(Cz>@-?)!=1Dm`}Yq^a#%unEycXMvnS;D*5Q(;6;0>{V{JA;poCbXzO<3 ze^HK8&OgoXOCUs{e4u-AGNrP&alR?4%eyaph`v4_!MsA?r{PGhFG(=B^kWL8jX7PE z=qw1_zv>kU0{%vG47@ljJe>HH83Z@#;?su4f#}mx@LUNxV|)hFPQ;34mCsL1ECitt zD^FD=pZZ|E6=#>BLchL5Uk_%RLOV_qjYkFB7MA0=7K^%|9ukvG&Ea=#{MxwCZ4`gb z;B4VzQHOekz->}tass6P9_!_>A>~^h&9uD~w%{GW?! zfQ`-KQq=sg2?Du?Tn1i4xz9UcXsV*cpZjxB6W<^8aD<`P=MyeAtP<;rlfRErB1(Zo zp;Wcj))13$hDXy)J{3jrat@(to=!U3o6<;9ELxSU-90t&h&;zPv_eRsCi{xO&CUId zKMe}y{|zN9*()H)?YAn_+N!-)Gp{15@axejZ+>YF?pJ>;e zG=hAxGQ7`s+!ZXuIyp0gLXhvl&II%(bRuFBX;S5Mp6etaV5W2Q9l2AsD}70Hk3IO1 zDv%)_QI^K4Q1;lXyL2%qe#S>TO#>D=sF3bW%C`VBU(4izg8Sk_cA8FCw+xriw*AhUj0=lE7~Y~WA<0i_XoxdO zRj)$Ko!qiWnRD9S3y#L%85&rcXO)-dIBr$Px>+al-+XVjah%{SFfmE}KD_vf&a@B1 zq1INKc%BELI@ZY8>vqt2o89s90-kzHAYjRZYV|oO$b17NJ4DUj+8+n|!!9lmV?rt` zE9)B+;Z?W+;7}3jps$~uo12@HgUH5TZl<4r62B--wH+LXTg_$J=3B3mDH8j~wVmfS z{d@58wn=&7WdFPxb|T+68~TrrH8me#)v8?n@|dmnoBmVJte(o-)$BT{FMXoD?s(-~ zlrduaYmGlY;t{)l7|9C4B$BE1w4cEJ0_$NZXJ+o`_&t2BP!UzJJEIaWvt?VYfF0<0lOL90guI!Dv?d2?jH~m*KUd+K=KFs@Dm0Zm9!UgVV|<($8%O)F$s{%BhlG(4(OO+B1z?_p&-q}w z-+LuyDY6UW&yA*@9%~!HN+xmy{x}@63fq0T^BtNhP{vrj-i=D+a$Z%(!?or=o233G zM9WDbyOm7`AN?#;htv3Ohh(~cbm5|gOCHcVu{Jy{1;=iGNN;zN=%phq$J5=jAEItX z`68~l!#_A1;sXsXqx7n_FllT4wj1N6!5hrOJ05M|eB9MIK_lnkKFFT$lEkBse$mm* zp7$OI5@!h_#QG$Q8zybDkJt; z;zqgH@GPW(etCeYsD_GW@;9vy`9gdF`N(OB*Y4|-g09st9gSW!qoj7tZ;ZNA7mRPs zFVmI?PtR{G+v%^@`qgCc?pZ|nmd=gUVr^A84S1DC&~;6$JNO7c^Q;hjK2fxcG!gY_1B|8Z`Kr*ry5`~8R<2|KHy zU0&KB>)RId#4 zA*hg#A|O)(zB9R=;_9eJg`(}RUdX5^+o;$4F)SQLLU~KfD8{zc%(YrC@>(nNRl-;o z$9B$Un)K!t386yChgV6KK9C6Zuls0eu1#>QHSl+;#Ug>`k6&NXgO}NlE`IE1ef? zXn-SVcXxMId{Rb6{+Q|c`T6tN*u5QK*N+OJB#OWCi?;|QEfx*?6K&9j6^vi2hy>S35*da zh8sd?d3=SyjSA4s-0rZ+K}P>02IJt^*xAi|xmNA5nkgX4net|?pn3$uVtoP+Pvs`MZ0!E(hnayWttx4gN?}*ar*dQ{renwejoR=B3>NMt7-c|ZoqMl4h5E)D8mRtm z58)$5A7>uXJWc?UP)`9LV#{ap@arDD+6eZ~>R_NE0T};@iHQoXZ%_lWG`%HZlao0A z$`|r1b-)iC;C)fNd6`w3l$vVr@tq|{YVZ217YLPVuTi~KkZKsS0{$T&L`e`m#MB|JITnF?;(z<@!kfg{VG zzdh+E5|j(+mUZ{1o4SAZLQKewuv%(H(^pNllM(Xk7dS>|MDm5LI@*hO~x=%lhn{SBYgs~FJ>inbut;A<2%#d0y3(3J^GBDx-|?mwxXnwvDva_z zOzw43%0HLfT~tDer%JcNKw~^m%g_)C)d}okP5pg)aB@ z_Q3S?!q=PZC|_OW`-kN1NTkdZ(7FK=K9zl?E0&nSjQ-=ex66>ig1MZc-OKpf*E57Z z_yJ{gW%&H|d>ZvZx8X^+O%A;jMyvo+aW&BW@=YbwxJ&X7Yj8 zLBVbZBXfzSndkI)abhU_JK^-`L`Ys@i2d#?pgN^ZWr%upypNa=JI8 z=_Wt%S~YKW=SC$`Nn%Ku(Ozod?^L;4?m_LztR69cW}SMa78Ab5-dF6H7y?WGE$F*1 z=d9OKht$92c{5VX=Rwl8#wa1b9nr`4?~SQZSP?J&ZibOXg-~s|}go!FYi&n zqD&ry57)$#rp!-@_VOc|Y&xEln7&!!) z)e+a{x=Ruth*-15i{8N9eRuX~@l?BAv9@-rZzA&)ISZ$K&S49>3S;anGRZ~3_FN_) z4j7gKPfXdhaVOWz3HZ7k|y^Iw$rp0IQiLcCjZRcDa2Hr46E7m9jP%ioOgaBfR z96F&K9|G9$AkI#!TvqxV2PzyJfL9P#QGv7@Fa`KszZrn@3kv=K8{0>y!}to_lwuhm z?5m;G2m@Agd3kvq^iCXXS*{}QTzM;Ms1|OXGHGB(CHu-qUmH zI<`l}LGY~2j#U#jJco0g0lgKZ^^@Tlhf7L0QGZbK*IgT(9R%%jJb5hn0YrKjbAdvf;)kL>E&}HcnlN#{T zCtzqD>*?%DJo%6hG}#k`>$FSEh?Ieujbf(7Acs`BvuI*+)O3R!L@w6zt3D!XfTTe~ zphUb(hE#GiOb0rf5Q6@S>Tg?lX}X`6scF{K<;dk)zeS&txq?ny2<#~?RpZ+Igx{L; zLk6pzTh=^QR!d?_N1gx%o2R^hB3_wE#(XukQWPL-90A>{EuELU)y40!gnt+@=f2On z4EqsbMHW(*nN}PVGHBM?HJ9*4YCkTb?ro;`C<$sgcfSY~=pn&hp4VQp9!2;kliPcX z2F?*XW1g5r?eCu&S8}i&DP7-b~*;vMdo-I*r+bo{pavZ$hK zxn}TaOo??P1g;fRZs)GZ9HFmdFZZpa8wRKrx;p|KZ(C2eO;&+Q*sph>+UswjrAf$3lCno+r4Pr|?rlAKYl99d8 zeOSwpV+*D0OV@Ch5XZB(&gzg>r75cTT2as4uX>HQJw)*8A@BAlX>0M-&$&YiQ7iV{ zwlXGA_k&Dc7|iEqqcUex8j zc=xbYaw-c|%b#r4Vhu0eC)|a;oa8?rJ1pGJ>*`@>%5r@%I`QV%tZesPs7VPeDD_v- zM~`rK+bKpr3jP3fsvOn>^gLf)jf3x--So@iILzcBNsu3uX_csi;e!IZdHjfnL*Y|7 z=P_55z3wSau1g*i6o+$iMbL-5!^}`CsC-{S5UW)?*UwaL%GtOwJ;ln8xL@_w5*2ty zXVMPbww(oMTOr^RY?&iY>1+$PPj1D&7bB0mpJp$rOldy|DNV3cmw7Z)Z?(Z1b&JX% zCp{KKWm;#FbVvC3h2=$s7U^1A0g9)5J0Ez!Ah=2T4)wp;s@_lVJ5+GBdLQ3q$z+Y0 zW+5`Ova<5?%TT`cIgyi<%}xXc`9HkdXkg~!ndbc=BZ?8R?wQs(7oM@T@*Ty5pX*wf z0?xA*3IX#(=x=MweIP(G)vOCgcqZbzZhNy@++P(a0nCCdZmz25p+lGOhhv_9?$3V2 zV9^xxma~{o&!HPvY?BPQ~7_T?D96FLo<;&=sJ?mfM&8WY1B2&Np(?`-=p12MR*~vE#Z4aIQH+SF-S$Y&+kBx z#XpDpx(#)-Qb-24v|d#sglC-BpNO{4HbZc^7oUGzW(;vwt-=+a3WXUKngqJB9sJ`?pe$jrpd#^aq9X=N&3 ze23?P?g?r~od%pvO{i5ToVN~A5q{MAOF7bP`{-q|4I$wO*6kZ&lS!gFVL7LZU%=Ns z$(Dl4XcmGOBE&C&`Fw)+X|d=~N6tkcREmy^Lf)!WU8Z~HsKBwY%}!c8YrD`uzAUfU z?T~D$1vW|3o#wJ!2237x0eTXX=5eXy?|qn#Hr^P0Mvn^m#8~GbS~cP>(k&~4g6>yC zN$Yy~+HaVYTKd+?=*ic{Ho)Kd#>#d=lDAnmbEf8-J$KT=Vv`fYr9o1y1g|3Fbd_b+ zO1|K#)k0SrW&A-0@rl)3f@hSI!#d)6(#Q!m>)IW?s+627y79Q*?mvq)^+Dw@y)-y) zCnVkKk#0Q1y&|vse@Y<1J@%s%^1zKuu8B7bAtAyQp}=XQ;?xAebL;%TO_)U}aem3o z6}A5Rc}aLjlu?0u0be8RGE4<$is;Khtu|QIO$(<+`1}B1t!TMZgBk_<`9Ld->!;7g z8b5!Mjeh(pbqxmu;?fO)_#vw2zCgr+S4ZnM;LVuekf@3F zzdJ>mCzLkW4*eE6OI8S|_!g4P?t!heNUZ{6e9@hF!&p6^K2hVZUCJm=(5UOlhDU~l zMMT!&>{wH^$4Vt^_ha`N#GPP6l&|(dM;B~TuL)#-3FNd z^3tciD!mKd^-d}2$m`+y*d}mNx-84ORv^>R>+vA(JmrP6enpiwvd!v3gsBRIIn=~Ljj#Sfy291-R-GhZhl`5ipNBEoAj^9S3Y-WB zM2NmY^w8Q%)o73YJQ3v3c7{1P!aOB4h8`S}7VQu#l0831{EVQU=$_(r9Z_J}-LkIcaIzC_)(s&^?CgergyxgUniip0h3+D54viD&g zTJgh#C;A)gT7z+nwW5kU<>!Im*@y`N1Nn|CXvannb)0zC3J>l?204rPCESj*rJvIW zfHIO7&%TT>&F)V`)MtzP{&+nseH&bHu4{w^SK{arAO%-(C5|+G1Q_NxqjK%mS$o|b zK-OZ(KSs8m$#UNrfK^mg0m)NHXlSSIsNGj70_Mdaf`t^kwpu*e{r_n-BW={o21X_Z?|&yCj_~V6K@Nx;+L80^C2a#sIw2H5lOC@ zgWmsX+FarHH(>dWHj=rGn4>X&c4asQFLz-GeD`H;qw0IF zCI^+vQ4df3L)+jZjZvdQejkMqD2<$k{{9Bn$H5?0kf^X2{|`IAO1ioA${ceuX=3T? zP1nDtRY$|02f!S;zPnfhJ~#msfp` zzcA@@hHbNe4#77mnuHb>)x9H}wCQjyK6PrElqQ&R_^=Y;;fU920yC+W`mS_sqe+GY ziknHE1>Owp3lehj&uSjm$x<9qA&$7ozc)(y4YQ$OQHtV%$BQ8&6|YqS}hXm9GM=P6Zjs2=iz~aSHs|^%I<@wF3Vv zO%MeLZll1HQ%zSWpeV@O$B96`!t=!jS2cBXuu6s_DjCWPyR^hV#p_|U2;hooVWesE z!VZmCVm(H{Z_stdyIRgMFMD4P2u+Uwy2KYO24-Xg>?1vfy@Upl!0jz9VeFqmTP0Ph zVvt zIm;_2{wNd?nXWF6E?4_E07{@uQ~&9KNMK@rt+fIF0$YjU$}rHybz>w%y!I7G!fG-W zJeHA_UjU{ff)dMj-)=W!)eXDgsKw+BqoUK&uNWDPyg3{(1tK4HR=&;fb5k&XntFl`5og7SYbX%A~miJzdA3Gz_{}%JxysHo>v}H%#?tU)6MtMeWC(k4jn_HqtV!E zdT6cCN7{axw@xIeV_P~b1@qmr!o#GB!}fxl>T4d0kZJlnjPiRp=+Yr`gSq;ZG`kP4 zW^l>wh8Fc!&$Y_#&>2vr_&=cFU`J7|bdg+3%`*>GD;{L`-NW4!<+xSIVaR~%guQNb zQKw~Q!;A3XxqH4CrlMIi^8`fs!Ep~4ACK7f4F6ryV}uQM%mYT0c6#2}=O1&|XaPRZ z(3{cVs;Vl$_ej2fhLb;3Thh4XJCnZIZ;4r(n!g*)lK9P|=XYLSF7PiUn)W35E$4U*5()0#N))HnfOpc zO!x|6m!+M1Y^YD@&*buS&+_7<0zouAd?wUe%jV)Xs7E0j0Sd-ij>JQ#4w~VZHbp0M zLymBAGTvf(x{O^rv;-8eeSC0-wx)7%dJ4yKLV7XnW=#xfh%+oa6RHQyu6 zFFp;B0@Ai`fuVq?%H25AL&*Ly&-2r~8wMcnG&YV9Kx#ctwZq5Gw6GPO=$af}fT^Ds zH?JxioY&-&hBhZb*kC(4r+avGCiko|Hrnjf)wS1W&Ma*wwI-|MF%_KrE5q8__U?cK z(!G6RI2JUD@yg^+yW3NUvIb%R8^OLUd#NgIVyPSiHfL(Fzp${NMyTG5!v4lv4t21l z962FNactjKowE)}682LPCZ%wRN_tFFB?F5wEI%UMNcSe%zRdh(+oORFEN%l)48&XK zNnuzCzDXT$#JaZ%o~D(Qt&2&oY#ff3Lb8L(lVSVFTmMi_q|>uU<{l?ff_k^~0yNCQ zk)vLJBAhBjygu32moB) z1{<20nYGsomcFLHy_FP(S_+sUMY;sUZL|oV&Qjc_TPi~c%+{i&DHMj7hB5E(bus$h zYX}2;VT=t8*IOrt#OAxh*#S%nugskAe)8=L zfR3*`=B5x{{+;xAp|XoCaM#NTCg3Xh!%^**=p1q+OJ56UHzbRH;m^jAD>{1kdDB(o zLZ4lprBlUL+ogDg*m_gGuxau;eCQ(y&@#50^j5UxdTtt%q6`2eoM*NRr6ExK0-G0* zBoA)3=`bb)#Vr;{S|?a?c$)pvcU&|E7#$<@=a9a~HXKRD3( z-rX%~)2!crJU!>X$W<{pJWN5FBp&RPIhAqGiB)3K*xu}HD9pN1o_iO0`_I|vtHY1UQR znNLxLXM&)>#`2E4<0kRo) zF(ko3`Kt%QnG1N9@lQ@YvxiNL#EoUuHgdAw4uG%5ib;sw=ew5<@05?X)R_xwD`?ca z`4jpKFHPL>cLh^$1d3t!m*a{uPi&^|49Kj}BnAH4MfTXZmCH}7zJ z0|BCFO9dRNDPZT(x*-xndj;r92`z__zT||5{n9=`B9WqIlKv}26S79|+ zi=RSXNnq??j$#QXXK&43-s-&{(_ZDCrsZzIF z5HYpcm>g*SR=oV}N&%}cwIb-<_0R6uPa#|1G4e+Ls%cl@EW~Z$XjHM`6a6UK{#jv& zVshHSp5NK)xTAuZ;|<)XEp8--p;`w2b%oR0NqBWzDR33CIDN?xV1HTCdVHV9_AN27 zV#E2uZDIm>*H1dRr~$#DcBWyf^D2-8>GhQDT4em6%Bn>=5WPKUOLzYh+Z!R(bd@9L zaR%G+4d<*Q3r)pJmIDu+8TL|{7CK#$fdQeRIC-K5lcg)C4q3x2Vm3qa*5~EBhl0A*6+H2iL~tMWGSuAG~+| zXk?eC#r4i?Uz4vVQBu4VN-{q)tlMM)IAb2((AEWkRr)x&yEk=k>zPconxG~r^89rS z!pPzb)x9Ez4qfyo^dT~2d2>rWJUJdt_Vyla6cTdlDS%_T97A>H;hl!MnVZ?is}h>opALY~5i>9RNhh)t12^UZC^{jcE?U3dozMBz0fXps z)oAL*;_c|#KJHwV785v^tm}6(JWd48O0B3_{hm?R8jCc~&epH)$}x7cAh!`;&sG-W zwzrKJPo^~3p9lQT{FTD_~|)qiJ_r%Uc00QCN#|MhC8FEEn=Kso~e5yH+d07ZHb zN4{_Gx&joEd@zR{a)kgiJBl~(26pI*a_61Cobgr#rEOgU1#qebS}hsR4F6!%anI*76!}rHT37`+fWK3t+YD?j{k43|RZ2`Z7GtZ*YAo{;iw%=!n%eo(d9`Gxhen@W^`&(-!8Jfc-u7?V`r}K?oM$%5O44|j_Mf=Y5Y6|^ zJBtF&yMYmTwU?2&WzU4!@y0R)-pAr?cD7-Q<=W74{SPIP8?*cV@gKf$fGlp_ELi}q zCNbzp^{ivyx+D=Iw*xD?wU)pwP;ALFVRn}F?2G!061AJNWw+$cU>}~I2cO)`_`=Zb zaH}CeKI1U~)6Yt-7X|htr!rNdUx51GLZ^BkhUY?69WVI^jqz@l=6agy0V5gfRf0%e z`H)ZN2ggfo-*?x7>GKt8Z>G?1d*($x=Qkf6Rwr7UYR+;meZ#b*dX=cI1SQ)NH$WQ) z*#-Wevd%Irj;-6)xLY8E;0_5If(M7-8r87fyYRxt081G2VwbK8+!WWK8TLz~V#%%Y23bnXdKP!2TS$mSr#f@X`93-=0 z=XT7=6&rw&$QHY}tCpi>CnD)?c$&J@CHO7~!T*MICfYqL8k>i{Bv7dJhg%uA!EuZ- zC$+A%qJx(AhV$v7xp!np>|*BRo3Cj`4XZwNussdmI8(8qbM}Yl-4a5)u@&cVrn12X z&|Tl_;}YogzF6cdsf~f}B+f|&BF4QeIyn8AJX%K13aQGm=B{?K)$!$LZjPDQs*)Ro zXHQs+Tj{9_xesGz;qk73B-!s`xPl`;vGbg@?-^7c5HZb0X$M#`+ z8sX1FE(hi;wWj4`B-81C$%^e@{*e_QAB-y-8J4RFa%B-OE z+M&6Ds#oYrTJ|V=7eB}G%V~m!)DaN{Zl~>?^eHtJMidGw&z4x`;egR+vC>!eN-R@!yKGcD(Br57SO><>UF1h@r8QeI@LEz9LGYkRN({XEOHNYBA;}} zoSO;V(`8_q&U76NV&|at-lSWas0+iW@;v|^roEbtm$J<%%TePxfA@)dckeKDT+F-5 zEQBn&)Q~HPh&FmUKxCWE}i;J4?LTjcz=yn1{QBt~bucRqS z&|`R_*svO{vOAq_;sz)f*7nwLS+(l8^uY;ZPX#E}< z#jbq*DlEY_5JdDXdtQALMb(&|!mxQjV{X|X9*WGGwoMBUXEIDawbckm;Zt*UZTzzw z*L(Y?Q~zdimU~e}+aRt^mjYv#Z{_7QJBmDzGo2vw-_TwoE(0hP^hzp7k?lH{cKxbfHZ%|_(~O>U||%W^b0Q$V4dm6^Gz$l6#ie`Rk% z@0Z%x%!F+xQlPH)+p72jNvf7I9ml&pgw)<{pHBD_C7x3P;lW5}m8g2`ZdthL7fmXi z6ksPAX;+FbUP@vuHHS13X_VPf*xyKRRfOh=GjAp1sd)22nhAF+IYek?Q}J`-2MJ=h z?%V3@`TXoWFyG3|NmnuMxkkVG{Vs#T2bL2D)5@Aar=x3_^ZbcYM;NtA@;4E6aU0zI zZt@f<77Vtz41NbLiXJTUGRi-64Kj;t^-<8T?^(9#g$>;qE_H$WYpQZ_q0s1qR$iTH zwwQR%T-{yu^tEEQRgtHrn!J~^iMJzBCD?lr=DU&fb%ym!qkGAgbm1~yNW%|G;yMZi z*z2^MeW-ywa4xwfXV$VbuSy90HJp55NEVFa>j?Zmm?!OPK6m8`Wc=AZtEZ3nm@Q9 zDyEsuz<$^!l#p$A9EV@=wcLlE&FS;V7jB`(dLlMA{SR1 z#b<7LdeU1tAIb0+$y6s~#;mwQO53z64pt{xowPdg!Wua9EPa6pczVxwr98|114QVlGG^9N5&rx^F)9+E&zbsc)MKk^n7kvTN4tf@JF7`;Mz}c*N=;i z7rA)v5x|POSxTrbq`h<@u|Ske%Czi)5sG&Asot@NBZ5p5X99tQ+k)reN&IJEW0Do* zu@OBgB%IpTD<#c0V5)0BAMp-+w(!UqCZ53w;s z72}bD$P5$vXBxG5I?=#2#jG{xjaj}As%bMzn`@wpHB#*8iZB3(;IXX_^w{}0XR!ZX zprS&?#&+K&0D2@JUH(9S-jwTb{i+2%K0W~3<$lESH>VfC$^`@jP+?n`6#`^0E*6#x z>tty!Dc8c7c!r#xA&9aGVvKVD`tXa5BJW#2%N)kjpxi*2StY5*h1DD0fF1; zyGmDH{GtOxJ=LH*ty44)y46QhXTsKYRxawhiaX+?!BGx*&b4N5g2c&9rz1q0x$(+f z{0w7y>7H6;v=9z8_xNwF2(1nNHPH%m|6o`C^PUDu`#`Clj+GZSR{w4BF4NnQjPQae z2`WlTNi%*8o=m<8@dAQRm6@Tue}V~E;fT64(sV2R)(#BE%iLCZet$k=}2Bg z^Zn-rMW+4ohsP&o5LfKypW0mue+A1f)eKTvV;K&=m^F6ma_3(k{S3CK0(n#|ye>4q z_jGsuk{Ny<R2V#G`=V!{iZ|JiC&gvP^lKfw#2hiRA+xxAmsuHBrEyMW`$_E^W zW)RX@8<#sM;C;0mM*N7F?WEDpvh_czWC^uy?Ns$zb^@(N2K|a|^#uL^LoZ)Ou}jYW zxp()dM}??Zjt4M$^#DgsWOnD%fiprZz3v-krsASgT}A7`ZqIkb45pt{jwpcV1vR-= zv){86{dPK(nFBgEf#bqw#J4$9+?nxU*iIpLg|he)=kFmSGw}SOZS~+fp+*>v!0ko< zX2gHpjllla^=S%NWB)p`y}STG4wNLo3Ro^9Zzd+B*cpVI$K^ovB?4q0|9)EkmFEY2 z-Q3=$`X8Use{`z+qyid^#@-Ms2~k9sCwW}~FJ49JSuFmkQz18&_zBhIcoW_BfTm5D zDPJ{+;P$-&Ab5WBuMb&p$)R{^PknKY1LDkB{_@r;Qex{ki0l2R+niR?zYmzf{zY-5 zkNyGCXSG$oy ze|SnI>)R*Q`YD{PD(R=y=?TC{{huw?I2}a?d$oVa77f}Mw~9JCvVeG%U-CAd0ka@x z&17g7J5iibjn*3I9rO2~fa;=^p1xmluD7@>C-Yli{c10bWV*(;@IdlGn}a!n(o6KRd^Iz*pKJ^T!KvMMo6Y(-It6`Bj2pIWCEi>;LF7z z_>a0hCWMw-^siJL*v9QM`5n#xGHhjKsG9F1LV_`CeBT@=bE@+L465Q;if%r7;18IL z0VBYVkyyJH@3bW~^^!a`9k&crE0Rl&Vox=gN`_Xh#k2`U8n>b=lXCUEKwVkhVT<5{ zVuzuuWa`wD0hS5&0b9Z(YIL*vqnGCtv9|Uahr0x<&TeVlP0Wfdh*^V$aGwSLq zs4y*!zA?&n_l!+!HBmpgKXwKmHAE6)6JET1fr*UT+OyocaMmubAMWkb_|rf;^`)fbc3#kpM&=Yf;|RS-|Cab4)KuR5=!3Nq)u7>K-q6 zmh&C0=20V}L{)WbWj}qRYmE{Se@(~b5#}{XLYRzfPNUA;9W&ksYKWxV;$!5Yq;jva zh><`z4`@sCRfpU$k8n#B4qKooCu?u_E-^L)G@~VNt~nFY;{JrxocjP zoTa!uE;RyzW&T$u?yn`wSJ~5bcO96O0W*4iMv_Q1AV5o1l|w)P)3gFFPKqgUNdHsN z*G%QYLm{Rcx`hEL)yy~|3X=Kg=ZNDB{k)Hydep3y2agic9%(Ufb62_nFb7`>=Cy`s zshK-<=PID?XLa4_2!35cQc6S)Rpw~oq`QA?OTl~FvaOsHyJD-pdl!c7U8nnHBu5$@|3&|r_tqBW zWRp`YvE9^Eztf}-MKJ=bRkYVZy?H5UxpUpbFJ_EG1N~DLJ;W?#j7kGV&l8tyJd|2v z;sz7Gqj^lp*)B@+)4u|D-3r?Y9Fc2Sq@F6xKz0Y=q$Q3L+Q+)t;WYycc>>Zb;4y6Lc+7vZf;-_rE-*&k9{~AI# zbOR$4u(_pWVSYZKlP%MG0~mSp(#6Z<+|T5^_i6!%aL=W4@xg%}C1aX$zds~E0;(8piqOZ-1`5MQs#=g;;o?25QJ;+QOXDgC&_ARG> zAQr5UEJR@+ug6nb7++dT0PAu|nL6|{$D)vV4^Jp`9n}iqho@uUe&jD@itl=^+3}JN z@QFFHwR&BbbP|`gt>2fKgcPu;I=ncj6BQxu%td%1#xo`rguhkJf=siwq zbO@&NGv92#$@ut1SL-4%&Mbf+lI!i z)si32zjYhJ`+-YuB-JCt=Yj&`PRr}|G}Ybx6EMFN6j<2Xm#3!cN=cz`;g!!R|1A{Q z{$HCG*q?E|bEjK{(#NRebfrSt{&1e6oE{b#X=Z9#sm@^SjR;gni0J<@WS8jC8|@Zg z;sXA!?SB&U?4tAhhIT$D$yg)6xXZg2C?7-rfBP8wQGgWxmmyY1s6-ww6{(+!(lgor zh5d*7pqa~{2Y8#7dM$Cnk7KWEdzdRHE&$h0FoN!1b=fgcam%%Vl|Oh}O1Ouxhj@n5 z;oJzEkECRHzvBL zm^izpoj*KBN53h)1)|kpxMO^N{ps5>K<9+J`~?*Z@UQBxDHWq*H16pNutIx;ap#{g zfR&LfaJVSjF!JiU#GSH0@b1O%^e@2!=x<#Ef`bKrHAuG|z^ZH9!#b@iTuRf8Ln(JO zGRgvc2U%HLK-xm+(m#%|&t)+{WS_F8rlqOr?!f^!KYs)xly|) z$5A4tXG>{tFhUv{Nr105F>wwk{%Wsn+)Dti!7u=QA|@tI#~ItHpGWwsv+yPI0**`< zb>H{?@zIZ8?Ay0!398P7!uIS=H?(M!PdA(KDA>Whx8R6sQJ^#*I>-_g}1J3_G;0CHh99wDn$+!Yd zgX?VsAcmOZQQoG%Q&CaT*Mjkd(yIQ4^%vzHuRJ_D>UULLT6&seal9GKlJ|^T3RC0ud*ZxFzz!Re}IMJ*J9cbZYb+6+I~e+WSwgVuM@98PP1QA-AKcao5LtDD6Jb zuz&yJy?Mb!FTmQQa1t#=_YMz_We)fU{$6LmJ4SiIDho3b0k@sp$mpoy(0~6P3(0s5 zFdB-=k|{!${XNG2dU+jGbja_$9ARG0nYHEV>G}EjX*S*=9K+Dp#Eq%mzThgNjfm{k zt0|+bZL^2kdzr)gX{tcxcc}GKaJ&|&p$xbe7O}9z{{5Hkoq|rRmp}>zScH{raD4uQ z(-At#`>7RJCA62)yCJiQsL#tfs2}e!tXXxoc!omZo0BSRXHdgWz*}fXT*IU5{SqUCurIik{E1<=-oBL1CEcHHI4S~qPn?}Qw*SBakDLKY6oyzF0Dj+HQrS{#-5nq=x#w~$c#P~|7=KNwnnn8LKUiqHb4`o!Ln;!_0 z*(IN~s?l+1dLL=bxC=KW9wsupQDOsC!+6Ax@hS6HLxUuf_K%6P&hEV@dwH~KEf*ui zSMk*Q(}>T^mo#3J_72Cuw71o6Z}yu@B2mc<$8bEF0(a+OqNC)A4oUu`^S!d|xCI9F zr4SvOTN9=GoPDSb6Wu4w0j%pZ?=B^`AY0QVMx7av=r<$d4dwznT#H z3Or{z`LHU@VR5KNPtRtXd<0mRS0ZWKs$nSjLqD<0nY7lro}s-gE04j&x6SAViFO`D zbEp*6iq1g=3}lAgM(tu|tMVear{kfPXjvp-_q zF75K4zbM8sV;Qz-7*=4BVdcL=>DE_eXT;L?VlDrrK!shXyJv*jLjk=wC6XJUuay4Y zg==!E_hUjUi1mly8d=IUV7OPZVn+PH_>=TJ9f_--VH^P7ViD z_VrT`@6+B6-0!EJ9&rygtZ8U4uyJW)=(AI+-$<@GL(d3xUF4}*?uiVus#d|{e!8Ql zYu>^lo$!1uh2(!M<#=b_d*2+}w9zukY~Kf6$ZEXP3zHE?Pb-yH(#wl1qb4J833eC&^`8_z}p55l3|%lh-3ZKSX2jhT8{$?KaNsP?c)&~6#K;rBf&gW7Pc0ppGEqmz|NzLfuWca-Z=HoMB5^m24@jP2l2<_ zSQlO8hYT9jnl-2+s<2Gd)K?c`B`4E3Y_-D$tmpWYy*%jI3Jil0NIyo#ZQ1N&DROm* z75dvc9>oc{R@q2tdAw6d#%5X&*hk3gj>uWM`3A1t|I%-zwa2I);<-_A1#T;%EfnUB z+jCs%Rz17iS=XefMbr5P?^Qf7JHcC%RB!YoA*v#dVf~J=X5|Z6A3l+*^Tus!?T|rF z)MGkoDn4tih_5}v+Lrj7GQp9%fq6v3Q;p5rLQa^|?x$@7Z0i!*>kKg0Wk%3g%{YE>#Qt z1>7ajvaVdi#$D zpx5v81&%(SW^ne3-G@$ClK4^$jR}5FjKF~ff5^AnG}Sk5JOtB#c$AXoFE2D`j4FH9 zCMmeeObiX{xu!+?m|TC0N{vH?(681jNj8bV6Y&T3U3{3&Y?L!Fif{5=2H3ydkXj*e zM`Qd^)l%HBf0~T1np>fK%&T~zr@+OmW@@BL58(MFu^yAB70Q|nfVDZmOo$81nuG`es+3rQit@JLkl zG;(aK%q7uiK$YJ^PRfcmRgGxSVJ+mO&t;=dG6&e_3F>RJJY84}Nb`IJwq|y`M9UAL zr_Go4(6t5ud=k6SPaKW-@hZX3cPCKDUaw8rh6cXuiU#JUH`!n|&KbwGOIJnH%3Hp~ zNrSTe3)g=4q=*!NXynKz> zYLgpnUTEhZd<-Wp98Kw+Dsd9+7f9ryZ+KRAr9I@z?euOU3DzCj?fL|j2LTy29CLW| z<+)Ir)0dx9{lHmgPe=|nUtU~e*oHA{7>I405U^-EJ5+!oHSjip0c;*B6w-&J^5bo6rz@O2hBg3pF9 zK0{{Q5|s$gMSzj}2sX`wA#@hA@~fBvwS#wgL2-tKy<=q++wQO2)h*RdqKehSB0W79 zsgw64vRCy#MrgvRHeIQ|tTdkJaQV=p&&6?K%HsUm0*`=kih6TtG$+rj4p-0g9W8}r zYKlqO!op%3r5J3VcQ}8s02g`G5vjMwQkm^<1za1?(**fDq7uH9i`fRNXzCW6?1h2H zw>VB^&9%^-`btp^1=5bh@I4*und((TQKNCFsM?RX-%Vqf=4LL}U}YIo^5Hvd&z1_?OF3 zBz5G*!)p>g=HAJ^=_|rH)2Zku&3i)_d&4fXS=dC=*F;Eo)Q-_KnbJCkc|sO*z@S>O zW>K{*=NmMacjLwR$_o8NOo#?fi~ zpQ=MFL{0ukpQ2ZBd1#JNX63tnCwQ>Kf%Yh+CAJpG27l_(cS1(z7A4Mt+mz7tS;gG_ zhT~*y>Nb1gp<1D$1NZ1Go1IwHr?efn8{^o#%-cmL-ZVALR{Xh%7FpH=w~KWQ0z&^= z=&!Oy(c`i#DGFIQwf>mPOHXU5vf|}@XHsZ~t;-iUB2R_?hky8x295K_!rJiRA4I;8 zirlYH$*qNwKa?`3WY;#i$=lf0s~v=k4%@c7!w#_fNM%Fw#M~qUXre;iobvMb_N_8j z#daC71tvegNHdn5BgIue4;FAMRxV(Ai^5%lrhXnTTz-OW+GZLr0iDF7r2RZbL`an7 zRTAgwXNE|ZD(A1WAhU4b*$EUbyp$b*k7H0Y6ZcA*PBnBSAm6&1GeQCv@oWw?QEJ+n z2-gZ4i>v$}Zhty~Ue1^3@6gc0(av=5_XR*^35z4RA$R1sYKoc`_l_W-90-|IrcE1< z2u|w6@`_guI(KJEd)Xr$HOGICk8i2>bm8_2x#{|2abaAsis@#w7&JCxkfuiG48cLV z^6c;gMJ45C$cs7pj7pa&rw_CLI^q#^9@SS1$GT_m)OkinFG)YHjgVQBPW1ZXrX7yO z`UgCwhrvLQX70Wcj{+yBlwFZ3y}cD^ItN4l9d$WZ0#^1c`-2)~QPd$fbkj%8v%0pI zD-)aZ(;K!i(8ZH{smU#in|8r(yU@xRHp#DLyu5BXFea_kv;7~d!@FT_5EV1daM(Xb zj9qfxgfMtKwvTdW1$?c zwi^~6zbe16=w37?CCqACT`}rBxN9aHlxwSpgAp z{^dG>fAnisTQVdTV;Z}`CYa+fA~F>&N$-+z!*4-7Rx35wfuy(h#iXjg5OBFJ?ssPq zY^MxVfaiT$koen;P4t#A2D#@&L0`ns&!!|KbXyk2Tso}F=a z-c48Ft5fG^Z_i)a#E0LPE|GsM`0-5uC<4G0l=Sk2L-K|?@;aQN=r`{VJ&Vd2KBK)S z%q|#hHl{Uq^+|b}S;YMm&@!zi7ODi0vk77=v!rWqn*7vA9E}S{4&ohpa3j@mz~~|f z{ds*n(MnL|Wa?mpV~+3H`s7`vtgIlq34i*%^`%Zzl5fi9AmY{=87G}R3myJI??rcL zm%K4DDCoJ@Hz{dU!b;1CFfni=gFjcTjU8|lhH%?lE#w8E&aNjfdz~4KzhKKPYn@s1XkDV+MsWwb{>*THTlKc4(TVHZCs=<*?uhXyQUc@MBl!!$r9UKH@mD3GuIYZlzw1l zWvz?5f!9F?${4p-vji#_~M6_-M+MyI*hl&f<00K3o+ zTlr=##CDq-tDxSUg{tMfMqZ7FapuQv#n)6Lby*!R5igyfrq<{I2o1r0S!n)Nj_Vv7 zI=FLCXyDIf=I~FyT^i<+WPW@bnPWUH-lfD+_f2PWM)>HEB^voq6*bI7#QbBOEeeGK z37cfCb=E&yVXv3|x~gL-QPSc$etZdL_NQ{ru+XuHjEp8z z<9rh7STk>!4n);3D|&__h(O_1?;Mi)Fa55uTIlaG={+%-|M(R0tB_x0d<_VF}MXYigkja~C9MHxvw4y~@K z&UrbNgF|(%Z?8J$k-qM4HMyu}?V-{2@lw*n$VM(REoTd|Oa8fl`{LUV8zUphsFjxS zOmai{;1v^e@oJfvwj2?`srNd=Yvj1rQV*0*R$_OkPqZpVB;C~sR6KX}B=OC`W=ko| zp3li^dILma5hQMA5i>lM)B1lFx@;_Ce&MrZeivR^DyTtO=1NOR$5wALoUzQ3 zL3*h87)(Hl!P=Z}b5&kmkx|S=|1swe6LxhD&&qV|Kykh;gB(l4%MJ*?=S4-af-JRI zdR)M*hnBIfw&DxlfrC!phYI?k`)2R24qh(bV#0gt(hhnl6(^Eij*5l8nrw|aAT6oU zl|O(Lq51h2)vFIo_?n{pdVgK|eaEzl-L~|@k`OlOJ^(nkHZ4?iHJ`@M9~qnaTy9)y z;8|D#lw?MYMJhWQhIBu2*UZ2JIm7-_Fp4HrAJR|;r}lpRkbBQ0)q4+a8%XpRe(25c7{q39n@pUk|gtqML60nZ@D&ech<-NjmzOFtyP_8RhRc z7kdg&TQKl%AAzv}T%~}ITy+7|mx-B~nZ-q^3N3jjF1`j;8 z>^S;b_ynv|f2Dgy=BfcbRxJuZknb=--H!qiHLK!UdDJkysdj&eYc`{-L+iN6*F zKz>i4!g<~M$ptld)nm$Kfz#4e)#G9Tg2PwL;1w68p4TT;))32Q7DNAqm(t1ET3QuRDmai_zaHpJj(f4Jj63=&{D%wBZ zk(!fT2qfwul|O$z^{1D3zNO=UPVhNM>^&>p@CNCe+;Ix6d*`8ig5JceQ+9ZIxNn&q z+QQVV7of{_(l%O>9{IL=8Nvz6 z;?~PYD?EjML|V?H>0i?^`1Lf6_E3aUGd3)g53=>`>eR+9JYaV1-b)~xZY_uLU3z1w zx9HdIb#tlkw1^RGckH0Iw9$$HI&sh|plQc8&Y*m^##QKbf+h?h#G`6;Rel=$2BGJ{ z+P|HE6oMjt<A((eGLaPkG#y??}|2(?f7{3(vpt1pj>esE1WQ)q0o*J3VSGPKLA`>TnBvx(vJg z5J)!7^wSm*BRq6tY%_+AN$fO4`kQ&a#aBuPeB=~_cb17pJIp1+(z)mk|0`t>yWIp`}Nqeb8T4$vJlQzLukQ;#X03r zm%45X;G-+2Yd+VB$R2%Euf$!b=i#pBX=oBgWfI#%@l%Jiv>HOzH-ay;fkq@b=DL7Y;-_Jy3Q{oeF69 zLuNmpYnB_yB>CBB;!l8dB$ndBip{}jo=;xWlk0}is6A4Oi|+Eo!5-*}br`We;+j6i z)mI{zN8Ijs?vT$9-zS&C%9Rbvb!U(=2ZwPd4-$hpScOQQkP0Y@y!b&8ujzQLokSEL zQqOd@y=E=a!!-ZwiD2}ZZ-@q8Y!=POoS?s~kP2FlwbI!OO6$I}Ob5MA29zxxNBn7a z$@gD97x2u!#UyQefB1SoAPsvLNlJMkpYGO#%gnSuY^haYwekA&7H$%}f>9j%s7-pu zeE1p$r|E5$p9RvpI1Keo=!UTF-xR_e@ChuvxRU9B6iA*|N*N~~UQjRbG~OuN9Whsa zX^bvudwqVE6H52^7Vj>Z|4MY7*QNjqJ^(>rw1QOacwFCl+oUfo)YR}Lw!N3Y9~XLk zP&<6RtyygI%6hR&H+u#zGPfaugz)egIv~$SC8f`JJR<1Ls0>jvZnwM9Dz&gDYm|f_ z$zx9y2wwl{%D6*qSRa)m!yn4g+vfnw!q>6c`SYerHa5FIQfs>*^L&w&bi;L zX+!zCR0@FzPPF{z7vR_Mm*8EyOL5)0M|aBBUWyWmV5Z-}X*w;JjTJ%iEFW%XeMp|` z5Nyq!$Kn(F5Cx%b@!DEmgqObx=fGLEwdK4Zj+`irSVE2?)$vG=_Fpd|=uZ6Az2Nuz@Sl$Hzzlo)!Ks(N1Vi69skB1{N1_9dEyK%U93MhYl;U>4 zgR0`?MTn)&>`6Z!&;-K($L#ykNLQOT(^iY<`_#L!b5X*Iy~ag;QBt(%R(iPB;4AoJ z)qL-X$F1g!uNGG8g>OIZ3`1p3`$XLC21nh;0!x4gKDPykwD<~p2m1ky<0#~**F??p zB=a`BXt8dz(0=(PR0R_*^Fv|GS|de~(TqJTE<#0BjMfb_&y6bV4A(~Z(;GMnwEEaq z^^{B44A(<`jP3!b?fEk@9cQPYRRm5r5nOT&{A7 zC&H@Cdy_cH4QBnS%vbO&6Bq@m+F@jhv}y{qYJ3%{Y`Ye$18knE%1;G55m4Eej^SMt^T=I0;^Z3~ly;FvK{tUG{fgDQxmoj$0{B$BzbR$%~d*ACGRtOV$wS1#C z;vqaj_`0l@GFRVt2N#rP16jdfA9KJGxOxxFZsCGn$E-H(nrUAn$GTrH@LvV^@7pd& zlzR4G_t;@J?RbB^MmEtcBfR#yteY`;rC)Ld+Oj_}rKq5e79u03qs+4?2S~zV=jt1} z{pO%V#Q*7jR3(_GKQti^?MYD>*)oVWv9CK=lRHR zrB9TE=%yGkV>ILS@uxVY{ZSIQ=b8q0h>yRr&Sj)EV6>jQNvyb>=UlMjF|_v~*7`e< zwEMQn!CH=rSoU|4v(Fi%9DNuiF56`(*cE+zg$_}^U^GM&-iHEyBt_-EmI~|p{U682 BX;J_H literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/sc-query-diagtrack.png b/windows/keep-secure/images/sc-query-diagtrack.png new file mode 100644 index 0000000000000000000000000000000000000000..1fd1031ae84cb8108ef682d619d73fd8dd2ce801 GIT binary patch literal 14668 zcmdVBcU05M*EbqbP(j27C{;y7q$yQO;2igpP{z zCJ8k(CA1Ji2?QjxH=J{R&pFTg+GZg2LL$VdR$I)czk{i06h4m@krV5g*9mk2*=-x|GD8!)tTY8{_ocP4JA1Ko0j zw_%}(f!AAj+fiRgNNdB%(ntrZo{nqH_CP*vpC_XzC zy|lA7Bfaq%C_EMT;s^vBVSpVS9)wE&Mifo`L?>_krf!iAC>n=dD+&2(HADG${Zu$C zK*KgcCoAxp$9gDml0j)!*%kM*?nmWI)EDV=#-2z+&K2iyzZ_=KKsDJzc40Nr1Fy$TLSG}*v=SroW9&67?>_HeNY7}x{km7vtXO*) z^|}oy^Lw?3xfC&OS0p`#Jr5pa*m>J2|w?PKpu54y&9$afke)yU* zfk9@z`#&iw~R&Aaks9u=H9aaD2ypWGxhG|hMSNS}&8Y_l0q zdZvwwb~nQu)Q{435bgu7DWuosCzA%arfF*Bb#f&|y;a;K5hw?w`FRq4LZ;=hXcb`q zOYG?AAYx?#f?&b%YF(eZ2zm|%S-lQDssUYgf_}jR`FUxmm4#&_u)YI_>yXo|wh;0v z^0LUSMHn*M3h$0#i0ET$Lxn zRvq)Qgn>bUi|B22cU1Lue6QaH;Q8NK`ZF>*shT`GsY9{?@l`AS!G)Eb)>o#TTxGJ| zNWpZ3_U;kIFbNBJu3I98n(7%(7%bj%q{2s^^3RL*yOF*MPvKT6o7p`19&3bGND;A= zY9*1Zfw70M$LwyT6B*;?foCt_eF8cdsoPm&ID8S>*jm&o1Q?)3o0443b}j9ht!qpq z5-9rD4H=HE7C;FES=#@TR0js3B}30Js-BUeUPCPacW@34v)q`&-Q{KwOY()>g zJR=Cp2||DWQE1O}E)rple_bx~G2Ls$ntCf~zichieJe}aa&J6s(XUbs&t2T!6nQ{? zU7774(=KnExojmnB87KAmPE8rUgq zbci-dNv{=-gHC;x`o4O0x*}ri7#h_zo+$s4zqA^#hFfy#PPd~L>%rT2NYP;_ff9X1 zYmV()Yo=1sQ(6dW{1IkHVxq$;h+*{S-;hKbZLJQz=(r0#))Q+}pd_v5KSBR@&w~xe z5H3ySZ2XVUF@-a2uYg)^O z|9jqa5mWIB-L43j3;k@WRC4;O!nm>JzPY|c@ z?NBz+yxVv9?c)xFgkc)H8>IBagmKf?!`h>1MQRS}Et+doZDR zGy%x3??rzVGra@)cK=1$U0SUk0~hMb3bXs+38B^NW!ffvJB+z8uM=60-tDlMQOSoJ z@DSua@IbRtqz}PX_Y;5HgO`BD7`zc9OqeLG#m|l&Xs>SvlofgK@(xSzA8cixC~@-42{ zJ4OGkmN1kD$2#v86sR1gVKJK;>iX7k-OjxY8HtT89eJ1g71zE78s!DZs)$$-9Y60r zAMJ+{OLZLU;|-`P5=s=Sp7F(|W9680IwH`&nu-+8cKoE(1bsn9gf*#LfydQ^oPF}~ zgT{1kh(RLXci&-ijf>7j^B>eMPA~?bVDTL_ojm+`3hoG+V7Z_d-FBNg4aV}17@Vz+ za$8nKE=z|c`w|U%%*baZ7z4KyC_?8N%-v%+7yoOhzXo)!a~Ki~Z%F5cQ$&9~!totp z2*z@b3DUoFM5+m#EZ6+!j-|S3KNPn()GpzbUI3z2ubE%F?lVfAnir48q1ZMO?KZ8A zj&c338s)#i`ck`R>FI0LYvOZKq1pv*PpfX)N0Z!q{a;*r*tC z#!BB1o>~@`ov%12V{aNqi0{)K`*1uj;3m8GJnKtvkz1v9qFP`#W>adSTJCOmLDzSV z?gSyCxqiWXMb+~_l!CEi_orFcWXytox^OiGUd@#0K7+h{j3BV2Mxg9jlpH(xKk{9| zUHa`mIpC=?UEJMqRRi45UZF<2Oz=GSPYsVO!}UB65&J=z{9;o!!Q`(YC`Qcjrn`Pw zoNFvhM6Rb_Cg}D%f=>WX=&_*lvu1|Z3g*WXJK_~H6QZmUy8&6ERhw1wRueOY)#LG^ zM?G67o1y=x=r47lGMMe`8xvvBmlVFTypEG4IySD8_9ei+K%)SRYHosN@=~mGvdm>p zHM^ZeLh*-&57h+$f11=^hV>_d`p>68*S9!9+bQS!y{)f!KnjW0IS$%?b>b~8*IrtE zB@jNZ$Iwr$Y~Rw&E8~nVyz_5{A76`@oUfU$w0(YhSs}PjZ{*%c)&dQ9XW53g!UKg0 zRasYttOEae{ug)tAL}AcPd`yTo7>up`Q99Sj`C!X_yi{CVZhhAj;+H&a+6A}^qSGU z$x9{z`fv&at$`k_sk9FtPcF@pLm$Dc91`ik{0|=g#^(ROYfR1zt5u*RM`{0`WLch= zIoc50`@rzhDmI1RJv8&$cM|MqpoI#9?F}4}+W>Nh52ZJUnA%>oz>c;H?5?eFJc2WFaqNBe>jO3lEYtr#1@BOmkMJ(ut+1Cl!=HE3)aE!^GM?^!hqcluPPb+Am5$h7wjYe|9Ddi(>1Fna&-1 zTQ6;ssh!J(qx)m*ybtTK&(At1%pgB^&Do zFQC8pnI*#CiCq3JQf|eT*CgR3zc1A!WZrPd91u`t6QHg%{^{~4`Hz8L_}#^GF%}1f zu^N-;Y0SX)Tf82JMC=;X^}4-(T%`xKAtgS87!a?36^mH%6%?Z1jL#k7g(2HRUbpMp z)|Xc^xxNI3EV2A(R0Jla;n~JLvd$ECYnnis8|Uu|HHUI|9Hu{z;~o{Fth+S{qkC z+g0vX^A#KLgf}z}UspR-_+^B`ldt2PkMV3T*L$9D&$5k)vS819F}Wp&JO8D0 zRMkN3y!9QP*Wu0`c;oF+?<2A4!1BPW^U=`?@H~6=7=KN>admQHU}L<7u{~ODdIrmF z)Ubw2(#;WH4iF~@X?b3)~`Cn1MjZ%HY#`wOTEgNHP}sp zT^Ufe%?t+K-hQKFky(*d+dgK4>8w=s;;@-}hO5(>)WtTJeO7yCG49!Q0TD4BzZ1#{ z+jdZ7f2QZ?`T?>{Nf~382HV>K$xeB56>DM|f=2DmL22R6i+)~_6f3CCFZa>w<+1;z zJ)fM~q*0TNm!egQtgG`8@y*!LUi@g6Ux$zfKDJ4;+9Y?E3!^k(*{_QCHRrNcO5Vb{ zeqDW$;^!_m4fn~a9M}!X53G6MFj>U!C6q4KCIThZMJ#4};lvA+AUqmFt#*NZXXWQ< zqB~F0)xJ9(cPiH3dOmyM8SaKVI@=NuJ6hlBdV-$<3>JvF{WcI8QhKqJ-Lzhec?MT8 z$CWGRc%GQlfyr_zW!~nPUM{R5YLd8+LhrE^Sw)%8EYcPm-|d3yGum=}S$o<^QCI>f z*qRU0xp@s?ky_(I3XtZ>=brTwO5;|m{{b!A@^6e;-b;wUhOlvOOO!b(^5o(|Vyc6C z`cv^x@WUhH1>A*!;V2!O;>-#j=M;qq2f2~U6M|{r_aw>tEjkmMKTtZR<5!FOYLX#l zJQf^?iG}8-jeDdEXwJ&w(Jr;7odzU{e2;Vvzb*J!;bkE0)r-mQF{^$@Z7K7UwWn!Z zzJiVyY<5hlrC;rDMd7`ObzEf$p*riwZP<3ax*&qlNS3cO{^ZnxS9RK4XGsCoHX5Ln zy8%O%u%qAWJqI_fu`yWHk~+(~iQ98qzDmfJW?0{cbWf#X-b1U z75X4qR)IEV)a`>>em(Y9T0)>&CK7G#ashUK5)mtxD*K5*(cYm4A zkFu<`kF-PIO|;V3JbA~x<)_dN*3T~{ZnVpZhIBc#^XnOI++&iiW06K3y~%c;PKC_X@%B-~{g}p| zsN@Fe%)_Nr>uWqDe%pY-JNEeCpTBL%@V8|N#haLf#o|BymhX?scbFzWF7*AFwj$Cv z|4UT`Y}MHVB4m4}$=9y6wt57bpqo`jckE-LX4$?7&?flK;%S3|w!BP)g=~0L@^?a` z?}B_n+q$Yu%LmQCiLJxzCS3a^E(l1P$=sjH|2j(-$;~s<>jAV(4U$(z)ReV z_3MCi`9B&*wP`eJjVH2RdT7rYqGpnGr}}?$+7+G2+V)Z3rk4RLZ;m?{@c}>PPzv^D zJvy&&c8upg4)~bnU;Jn={jH+^s~P?6lvO6_CTNPd;U0Qy4gcRZ%ih}CS?fD>yeOy^ z#=a9#7W!L09`rt*_sDOnjM~Nwm{9vcC$I8%F`y^S9B#H8?!gX?4iCzX4qz(?F@}4y z>_HNsrXOoFEy0>XTZM7bPGBUnO-U94w!e?Z&UT<35#|mlM{fKBBX5Uh%VfQ_^H zc1X|4dnH)dxRT&znGN|4>{i>M69Z_A5vK9pMkz$$h)QWy!4C{1!t)?=F4gcM+~SqT zUJND#dtYnz-5gb;ez9L$tr+idVFqv(yf(s!fJZ%sl@LKOgcJjE z?%Anklywib`WX~;?)Acn&=rs(ME1Sudy8M25=E?%d`N!y*&8RL4i9qf+sU3D#Dv9? zRv(5JN`hkwYm}US^t>;8$jm8X@fe4ByG8zO!oeWrYiC4#fE?s$pc?Q9X0cq)>YG!5 zaDKBxpSk*O!#hsAJu7O$g`NFPXCmM^sA5besBL(+RIo@j$Jvcdo&i< z;R6`E@``Qj8m**WMQt=pg)IWg1^JysZ0#nY=K<;8dhDJ$o-zNc+;TdS^}g*iV}l5C z;dUKu;pSZ{qwWZTEc@^Z;V}!^KSF{Ud+=DIMcP^G86~$_f|UKc%gtq-`+=GP2^?A0 zHj)}UJq0mnNdYWmyr4EAiOLQQut+&lH8~UkDmLL5%XmcC&6>B{CYH|Na^$X|c-&OE zn5~17UubLy@2QRFY5r&q3XGe*;bd?J{)f&kv67e9tDu*nRo`Yd8%lbnlxHHph1#0e z;hC$I;HE1QAp_X_+%zwL>W?2=r&0jV$4SnqBSJB}yqF(5hAP7gcZMYT8231rw>XNx z8Ovpx;nG@#S~0<6ZxWQ{Ny8`Cc;)t+8-W_P8k=HXZBI<>5eXl`-J0Ix@0$({v4QU$ zi*-z%&1$`gd(2IPE~y- zeJPGGL9Z*QPlvHBE>*b@*S3q6TjW~BHB4-*{n}dPR-5&?$g8Nr+||l@v8JWcZQE;Z zY98GY&aB3;g@!`*RMYxf$-UU~z%#i0S%pU>r&L6LdS|()roN3$6jV++8Dj1MoI;x! zQQld8k52Sk*Az2~*pN2fEtb|g&=0ExW`V5ViQ9);bbUTdJ+ZzZI=($nBa48v7zvzz z;cLT)<4o|fbJ%Kl{YH7OO?pDe=CRhJKt^-GF^L|(GM@G6{1;`8Y4h)rszMJANxp>8 zX^YD|Z+;Z?{;Y>S+BbMJ`0&<~0GONLB_+2fO`*-|Yq_8ROgN*j?t)MKqp1WD?qqH= zp5l$m5?U8fW6=_PB()c`gePiuQ!dRKPCd+2f;ud`@}u@5uk61_c&hmZfl+hg$C0qI zknxQ>%izvP&5L`kgtVpbPs?`hLDH-Zm2>l6hhrwurzR*pA&B;|3)wsQkZTUSdj;$SIXL~_73^D>$w->d{vSs4rENxYkh2;O3 zu0vq>b0$0XSa4?iPT*WQ%3)M8{ft;x)YV&CF- z*x$K2^x)LenX&S{k3bnrcbLP2>O8`H@pHx91B_^kC+VhfU(njtN1n@j-)v@GTvdPp zRz5p(_=OJVp!4k6FEejA#jIfh@&1j;(ft4ME32F+Qd5KYo}r>eu_pCUOj8x);V~TZ z0kX0?$fV`>snfkHmr0$_2#;*rHQljpX0JI<}QwHftWx&Z@WP0w-10xaYgqV{@iadS#-F!^B5q z$ezr!4YM+l!0)8Rvx2+b?>zCbuc5Mu@2<{@JS_sjigG$P>}9ik@dHWe7GFj2Pr0AD zjOzIE=FUI9@eHmnuv=j3vrSqd#oZQ)dTAr880B+oIbq-N0S_w)@ zl^&9JpDZP!d{CvgbWJFRB<;%q77o+F+?y7j3$A;gzy{;BO_UlY8xvhv@X_b2iB+GW zS0ATPtCwp?K+LW9Db-+!sXkyu%Y@EKhrBWIOiQjRGysY778gH_BUqD4_+b1eZ?TNYUM}d zC$$2Q4=T8O)((sj1*~DaRI8QNDHLps@W}ZXk0z_Q?#D}d|*|(Yb*CMP?i@(?o?-T>!4@PKDCJY zGG%oEWeH@c`B@pq_GRiKD&4eNYyFqx9?&%XIF?x2n$05a(!ejFxn(_W>cvhTnUu#rLb9cG4F@LxP zD{Ec*QZn!+JC^dQ&$r@1DfGqk)nyiT^gi7%>*|aPGxlIu7Q5X)=YeU#+*P>RTVN>M|K+#&fj-A_? z8!Y9{o!anI$WwoOh?P+0Tt4#t5k1G(=?jD0nhr*8`XIKwz_Wik_JWny!nsr$hL0@YQjh-* ze^$9r*tV=7qY=eh7eKw==s#_>s)5SZsNVOF{xGP&CE*jNQ8|L>Y1-QNG{WIFcdSC& ztzJt{cBV4pQUvH-cE5@vUMOu;MHaeI>L%ssNxOR}fz<}Os0NzNj>@s4?t>VI#FY*n zFLixHDke94iu2nIHu+f7liX2Xa;|Q6&Lc!q1F7uhl-q}_76E$AusV6(VEpgvZy*D> zZrSxR`RdFYb}Te}@MDxlRQ!kZ>MLQ(rjWhDOOX zZXo3kYH$5##mnhoANvrlnJl>cl3U66SEC4*v=EaKmnzR_f&nvi!)u;*Ct)e`m2?=C z^|OA&2AjOsU=N<^^J)96>Df$jswwMh>76xp-SYzjR41e8o z(Py%Ze+O$pqJWhz0%DI+tJMnh4mRYw%e1p1za_jR#T{VnPvXzk3B~+ebua0F*$=^{W+;EWjuY7dlqmR3xqjb?Qcfq1>978jIY=RU9&3?1g=oaZx!x-xXZttaKl5^lsFqd zBAnDR{LVykd`mJR=^R+M?6y?J^G;b?>&xgeaSJ1*YvioHC+hm0GD+?Q-wdo0D?d4# z-&#zMfK_f72@afjDu2rqw60B*uPC*U=A$BWRz^>oZ|qh`>!u8v7I#cW@I=o4mgk1_ z+<3qf8ICRRX@A6N;%4943(xtWY{iVlJYw@TqAZKI?H0YoE{bQk!+MP|Md$KC7jJAZ zMu{1He+2m4d2ymZPJj(L=N~LO(HrtDyTb2NNC}ChbiOtnUbu)*Qaio$%U9{XW@1bK z>9ZhppNgk0TI7Aa8c+1Ye&+yLaB)OOT6Uq~9sl~Gjji!>!F!Goow@cIS<5%s1ed=L zNL#1bw>5G~R;QhQsU35^N&&0Wxf~Mn)<|RDSBnM!`@yE|3tuk)!%H=PhZ5Q`BAf4~ zOn@)-S6xp4Oxf*3001Jn!gywp_NG6!0t-v_$MbYdXB7k$Z1Y z5s#zTg!q+WVtkB|Twgev#Ygf_`b%XSIYgUHdENZrS$b{o@#$7{axyw2C0T|w&rHW7 zov@p>@=*UR{avd)qoR`a%DfZ#Y20&V@!C$0ToME!>X?aQR!xvvwVSxR$Har;mYF45 z1UB^X*#R=P>56(12r|N)Ne+J`c-<#Y=Tn-TK}P0%7tk1PHTBFczOpbZ&K?}!$^U%t z5p^I{tm@_27P6tr4#AFASWAyFFrN{ib0pH~7z!E0{uMrt~A}yz*EwSX9X-P3A zssr@Ikwn$Bq4u!7Y6FiJVe_obo6n4W3o-n+A?AgG0*hf==sBUjH5V-mW}JR;!c1nV zL~c*gq~?(h0dg2yjQf@XF72Q_t#pMiA2ctHju170$`1;Fd0C_) zVvs(R^_{9+NP2I*ijB0CvqKXEcmsBYQ;*$glZYvjVj`y(8d`nF| zC}v_Ay^X4&d62iYZck8p-dZEIrG;=bdurC*B9qMYRQ-a*+)t_w$s?K+qrl~)2>pqz zUL&zC9NjRk^;;DQQE2nsC~@vk(6V+4usYwf7WGYo@Z{?G%#>@REz9Qzd^oPR-X%B# zHveTL@fF5z2O|HpfD?au&bEIH{oww+0dR17xYu=R0VHsNgZR+AahSFa?d9e2LwspdOsxeZc41PeMhy-cu zcTw`+^n`yzfmKEGj6S=I+<;k1C*7+NQ8bvlRH<%kB>ug8L%fe(y2 z(RU-c^6f)R%jGLAtP$@WM&$YC;2gx6ugLLbsRRdq{$G`p{z6v`ABuy&Yhl&g!o*yz ztB;kdIQH;gWCE}(9~;;l!>=W|s$9j#uKAu}=o8s;a~7Ce!XJw7K>E>6x8_Bq%m)o^ zISee#ZwVUt8F^<}mWh@mI3z{fIvR@3r>-k#gD$ibGXf?cO`GO!k2tQU>)r3A1Gq>3 z3ErPxtn@UGD_%rxXB81t=pnHXS*a5$Xi)W1s3!1f=E(GuX#dYjqmdi=)f%oCigpsG zMZiRC;j5IE(oKv*J8)=Ja-x5CyZ2pEq<*Dt+45CX#~ZLHe;R98S`j}JCbZ#Kqu;_u zyv8&Af`XGO35ANbKNs``gyl;#bxBBH)0ipawKJb!Vwkma@t1^Lc4UO^9cJu2E$ zA~`@$I!@G;0F|u_(yI2chEfvPtPo|rvX3b}N){}hY9FfccJFyOrl*UpmOWIY_Z5Y+ zo%+73DB1CRf~8R`cv-@Vu!lYNNxMJ&N;;C+1At^1M+Cg*Lt(^oXM(44EO{vXm(aSB zl{~1%F&CPRSyl+t6e~LCLvm(&ZltP{Z&(D%1f5?t@;NctlKxV&;lgbhh#aHrE%wp2EkfC zUEWB}Z9sA`%|e;K1Sy_;ev-`&%)V!qtjI}*-b%eNzVk7&e5DX{nxaV<{*mCwvRZ|L zdb~GUk|06Bti$fCo8j$-79&zeK^7`;h1sco{WXrdM%UE|1{z2~N6s373QB6_t=o(s z-h%#ulm7q1cA@JPHT7tTW|qXTK*bu#=~HO~1DQEG#0IiBWCsq__ihZ{o!vPQ*+b1) zLLnvwW?8%Y8h0-1pO_ryi>W4*Utx)eqF!~_e{dH@J!yuR@xinCo-tQw%$8H+NO7a-W~{bj%q2uh{WF zS_~D_l+hqseY;?E^2&o9h1|px$5J50d=HvNX;&>)L^%B5N!nI65#h=kKow|MW5k9loAs(w zsp(r!v<#lQzb`02=^bThdVIjx4Z5U?E$ua0J!>~*3i^7z9PD%f!Yc#(rS)6yowZ5`lpZb`x{K~mBaZ{D-Smfdd1iyZz2ZX2& z_iAG&q+rwKKpzrfsx) zU`qYRqI-5F^oqz+wgRdSLA&zKwhhd`1XWnu1k>5mwPKiNHTB82N`)2}m+5qfY(2=h zmikLJW-gvqcGw7-G~X6n3iXAB&mhBC3K`;W>@RrwRhS8dEm$z@|6aVGG`b3lCRfjyIcJ1h)xf+sP92jv9vul zv0nMUfhjniJ#(5)WGFYvun%=ttMJ!$y}QbSq0pTL#OeFyYrP}=qXz8nQXf(@tR<@$ z3f`olLK7y8kT)GT^9N7@{4v`yqtZ|F;Q>CBf~`W7vFmudYl?-3MX;O4Qc7uN0lL_I zy_`p9%S>nzsY3JaHi@rD-<6ji?BCnEFac#!K*WUo%khhSsP;SYy#7$nW+x#kL06asGcHI6d z#i3-LL!1_KUvmW|c)<;5fweIgE%1K%SF8{tKe8>8(8Ijsdmvxw`pZuXS}&?-bYXK8 zqN@d;tgVr{V*Kc`3c+yxX_JPVqy5)z6{{QmB|;tn21i?AA0}FKk|Dj<3MpG$FmG+rQwYL%OUD@{@m;lh0r5xO-n z2{(yGq#|WJUw1-L)~to?MPOte8%j+}grEiBqD7c2e(i zXQ$q4Uc-2uJB1J-yj(b`h1F^oWAqlDMM&_`*9m6Lp{7TdIDpWL*;%K`Rbv!J=uG0? z_I)2Xcq_uP)a+I=nG%nj@-JlgUo0}H%E%uiuF2Tgjdt)?6&8JP6F zWiP!=t7X(owGyo9Q# z1S;BX?bS;Ab-h!oXm0s;+TDtTK0;)34C`@V;^sVhbkQM#~*@<#h+Ja@1_!XizNkmt`Ibw2cDpYg3#uSKHKpobk)r<|Dx9eGifzX*swOhWz6F;f%1qWbO%FE0! zsw4U27hBql^K+cJdc=VXBl}}G;f-%Tl)06uP}#g>x`q*%2fi`nc>Jmj%bMWWtZ&qO_Fa;uof zFa@AxO;KLtnrGD<_oe0x4-DRC9APLoQ?i!r2gdVuPh5viR@88lCHZ;PgP*CVYTMa? zMVp38Yeh!;EkYF40v|)u;J}NN%kXZ3n^oxZZZS`XKeZLaJkIh7ROYcZf3nEWvwBd( zA%a1}MYJieW6RvA6e)myeCPsg2qHkAt?ZJm*9*xwfxh)!bHM2Kv3rrQnZ|fYWJ)#v zHeFB~ek!+m+sAGKbH5B|jGo8s#@euL$l}T{hnaHM`*a5oz;SY-uB`6D>6iRGyG?q8 zcWEr?&_9M#-IvnNmzrOH$G1SfKX86gkuTpHPc7azkdMqG0v`lBz!fiUOBRubmaCK? z+J9?`e7sE*Io>z^opJk5)bwBJm;bSE{8s{nGG8Gb6u!1AmJ`ge|JdpX(oE=aq*yqr zOm#O$j5Md$P-o4N*Ml6v`oSJx%LOLg5_F+!_w6pLy|QADVS(?9$WpL*CD{)ExJ_Gw zu%QhcgLmaDDQa8p_s;TVxIRYJgt0Ec2C571^tnJMv=i6XmG}`Qo|tNW!djRCOPfK79J>e*vAA=WYN1 literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/sc-query-sense-autostart.png b/windows/keep-secure/images/sc-query-sense-autostart.png new file mode 100644 index 0000000000000000000000000000000000000000..814513a98cb32abd02f7fce75adf6a473dd052c2 GIT binary patch literal 19663 zcmZ_0bwE_z7B)VJsEB}wfV9#eA>E7uf-sbHH_|N~gHj?T-Hdd1H%jNwUD7o)3=GWh z4e$Hjd%t^s-|r8YIkV5%d!4nO=UHp*IS`_xAdUN&>@ffUz?JzRsSE(z3k3i$v>x3< z|9%wp+a5iD;jAnz4k#U_*g+rMH-9Jp4gjc##JMrTLLXy0e9&?R0Ps5QelU9M^GyK& zIa3+QcdG9Cu(XCaI?m|a(4FZLkkt>a?5FQ1b!dn*3BD%JebW9)C-o&WW~m@IC|N@; zw4Cg04$Geu4?mJyR0MUX_P!m%{}-VC*UcmN%?0H4yo~XtXAuQIHCjYnz~;d>Na`}+ z?ak;u_!e;ti)-~gx!~w?tp6YjZfQkLP#_cqX_|@hrQ=y{P{?`ZC78K?lRW0B$PMt% zP9qX|4L9Gv00vILI>^DTZQj@J;0$o}70nd^+vI1~a7&iyA)5ME4;FnNDA%nOkC=|- zDyqu8Zk#>D38$kc|H5{Z4I*nq%1zioMMiuC#FJQ-1#YsGnrum-zeF2hUf-z+1Uz*| z)-Ara+SM^GX3dkYyVsQouL~szf;=o%m8Ow1=R9wBzu#PCF@M^JKys-r3kxG^FhW4H?M>VJN~r_d#gIO zH9>(T7=z^Arv=`4_%pU}u7MNyANM-9zGFKmLmqTm@2A1M4<}r)3!ZlE+&tfOf6+rIQF^t4AnmJKkU|ErE0Ug4@pyNO;aDtay1y+O&ugIVN2Z+dCKzp>8`P$wG{O zMD$#NeRnw&0}T+?Dp4HR1S{Yns4{=I0Sdt{FR~#5BqFXzf4uwVJ?p&tv;Bv`-2>M> ze_*hqD_BYz^*95#r5Wt&JNAdqXY3=tPxMdIQ%2iLIX@?!al#ZD_?2L}82ExjtpEP* zY;3MfK4d-;>iRvqQVX<`S?anSTSZ?%u_gNU=FPnQmT-mR4V z?|Jafsjhs|5-y>F@CCDoGmiv{!z$q_28HA+F}o(d%u%_^k6#ZcCVqGuB(3=@QJcfH z(qgn47m%*y_f2B*iQ0~6u4a9F4I|)Mxm~#*DCN>-x3oYVn~wy!tE%6o9Kd3Kf}215 zc#?x>@A%3ccy!O0d@Rx4^S6#Uk<&?@<K^1A2ai{}LC>riOBy>VC<13uh7bvE>| z^Ch`_a$66*P~j}M-j$nI;NT$JfB_K)NlW_#{`T{c<0&pP>PAY zw6oZfM@`N%$&n%B7}oZ@yD^7hxobtsiIhX{m*=Qq>HQ9u?6wCZS+jJry`B0>7hi)O z{$|kfQ#>S1G5vFsq<%PRQBq$<2#0&s1!$j5k=N>Tk3UjWHHbxWEgzWGY1#A|B|B)=GAjd+HfCTAhIdmIVA0-NHH~H6cZ(%1(oJN zKZ`x(>k}6q7vh=dvojD3$0_nJGK^t;;!WmUO>Pq%=&WwPOvJ<)CRbH0K}DUQ7B_0P z@^yo_dWH^1IAq-L+h1uV{!TyvDP{(?L-LMMey_r8R9qNUfm2@?Q(aq{9;aaoBn5+8^s1=yw8nfok*&6(HlvnE<+%u zW>fU7eXk>+Cswn(H(mp4Q333Qf&%n_;a>1_J-z=+(bDLBSk z7RjV?i+~0DD$BEsfg}38h9m8l^Qmm5a0^MfefW@}ehJAlsnD!(LOV)xu% z`W3Gk{<)XL9Z?Cw8$Gmf6po)Txm(QlTbAxYKci&mZwp_FouB;zYoEi`PLEK(z=Du~ zn(CYFl>h@a3Nhd^9;EmP)@$AJORZc6Jt^>1!jdN(LVbuDf0;Z(l4O~znr6Z=32ZD8 z4t(C?JVoiyvt=qqhXGaos4uxERN8(qRmI;LU|$tv0enJxJ8SY< zHMptN|My~9Fq%>VE#~N835_>?@*KP{a8>s89?Q(ovLs0qH5|EV(Sm*_-$I zv|q0CK}_Cp+N2g*EvZF1Tjwv;!(~n!SD>C^5F0C~BA{YYYeh)l@0u&%kr`t?XVqsu zYTxq^flZ9Qhuk7~8pLdj)_WeHf#%-Z)W1aI?~tS2^lw)Gjj?;s>hz_{Sr%kW6`Am} zDQ{rMs~dqNJScEmZf}h?{woa4gG9ygh5~4{-miES%}l`r`uyz;a)Ywm7()VI(qW!b z4X_{@Q|gERnc4v*=UnaUG0l5Z>WGlf1hsm~exTsI`SA5Oj!Zv;gj%m^T$sj2HOX1Q z?FT8ZY)I@HBr*_9qA10-*m~dTr1+~SLrCfL1$=_}-KjJrz0A2dnq9(z<80j2)iGxg z4Z__!Ut$fO-QjXLX@|jhRQ7|Qe6CZdCe@mqe`y~l!ZT~nR{euwiN0O=ci)4k&7v@3 zTSBx5$w4l@z1N#GA;q;9t^2mYvnpyOle*KLJ;_()I;v7i*ehqv#&(gUZqyRk_71&9 z@zQ@#|0gwRswPyu>N1jxceGb2Q_y)5%<8ZNeY@e^D6R8xXf8lMCXYrR2DRS%g*J>m z+48$Hq5wm2oW^)7t5N2-SkRfb!dZIxvsrbVMM!p^W=L70W$}{mziEYDAou(S%5u)6 z9FpNQ9Gd1b)6bkED}wXgMX??_wC70MH`h`UM_~<8fXKd)WqojOZztI>%B)S5*7$sRcl@u7g6NI+xNM(`83?I zZ%cmIVx9)eNpO)N5!GY8ll^@&2*%iwxz&D=M=5@t$(8L#I958f0UeW#D##DhHjDqD z$ENlncPDGJsChRM4RbH87HP3{>+YoD;{jVVyk08YDMSXuQvd0VTGO`s5*EolgW_7d++0mlBl<)Ov}b0E0%?Xr@yAr(jKOM*b}Mv7VW>Me`lB} zxzO=(+0x)^Z$65H2`e$5G2jq?g#$5_v#K9dsGl^U-*4a!1`tc!KSKOmimrBBSI-6n zm$%eH9|>}Om>%@W)q9{Dfo9;O*PSH)O#)q>@#h&XX042#;p2SmG-%gdam#ne`9KcgIdjvfU+p@WUAkD7 zYF%oYL_37dXG~I_ON7SUU{XX>^jF@Re!`cO7h?7I`yf8ljlmI5Z1Ae`SqCmho z*RtPx_@?>C$xgFiycM2|1Me^Mv|%h>N0#DcbM0XjOLm`WPNeTaXcGIr(fNh7!_Qy; z5|!VA+$BYsWlPO|rwAMUoU2w@!q#e*!z{P3R0msc&JX-n5OkVFGcK2DkDE;+agRtN zynjf#nX+Ek!Y1Ey#A7$H7H8=8aB`-pDo} zuHAQZU8CKi=prDnt^RMU{r@aAd<;Ka<{TH6HrM`>lzV##e{$=ddy5O0!E&$!xOTPY z++KrGlegEAZMPlYF#vgndGD|WM58qCE{iAQbg(R8Et!`5yaOpKyG5OzMrIqd`FJ6( zV)%T$y>iYX4Onmc1KW7G?NI9__P|Sj9(0qpcAl_%dt78%DK7s(4{^y1Q$pd(zXAJ3 zKdI@m0y`oi^K)UtPsX9qz=kMoN{1b zQW1i}%K0%g2~l8~3*7{GvGb z0Mz2>lKJUjBs?(GNCfQ(asyUAmM=ebY0trM|1jvk5&RROqlCqd+b)rbw?Dj(UC#r+ z4-s;J5+t;qzgDv^q4sMzfnsltorr}#Zu{LCy^MEbMYuU`u+3Ul>|meW_^=e!ZGXih z%0Z`M;PuL~3`7LNUPG*rtDm(nClj7x+omaDo}H=~z;8}glT9LT&f~IWtr^qogEP5| zD7}R(?1Q;JDpm*YGhQvBm@wPv6Cb)Ig2okcn~HrNBrvSg^Q_ZRuXEh+_hb*kK`!Z$ zn1^S{>Liu?3ly4aDhWR+7gLmw--Z3u9YvM{vrNj3iC1zYo%hXTXNgkk&hr%zVYq^Y zUx;y(-^6@WRjlsOfp>e60@#0v)OYC4W%FT5>w$cEf3acA;BEe*oXi<`{fF3{Ac|wD zBZcfh%|+Sl z=IzA15K9@Z^?L>i)t<)DP0fTcy0S?RoE9^?;Km&X8%m#Kcmm%|=e#zi#%4 zuJ%X%pL$A*-D!DlJMP1BkXY1@Q$_jLjwFnT({(eC%Au5V8rk}2^kjBbLW~;)?&JY%8Br||=qA?>e5vc{#uXp#UQ=TKjajZW=r3Fd z!URw~I$gp0E5aTQ57Dp)?i8uVyo)l?i80hWUSEV#gdr@z5J`0z0~ z^_@s*V?ZNMLxAV>)|T|mWB?=aK@ZFB1wz=NNsR$WdmI=*(NrM(+44PoR#stJ?1q{r zDc~Z&!$I060h~B>1WnV*M&$ILM|=<|2odrUl}*KwFB;BgtbMT+8g@q2 z#Zym-4!6PT7_V(p)X@`mc}m7F0?$Q?R~2 z+M#0CSD6$Vq~j~ZcSb>Te!&FK5m=>eB5%->Iaro|kED$})BQbg#DvLeLbc$?n2?KE z`{IGcxbh#W8mj#(L8G|7fSaMTm>ANkv?}0q+Oxy?`G%r2xaYDD4{W>Hq02F1Vsntn z_mwKy*5yIM2r)^l;P;b{k#utrepz>G^2%OcsV(xltai|ovRIjt8Mo#QMK9xP?|Ar@HH*;H8b$2=@S zqou+p;Q` zy!jaOsow@H3=Zh|*17kkU)G4gfv!WTJ+0^Ab?Tjm45v zmQ81!ggcL6hwRENFXR^Fjk_5)!a{kTK@K+c+xw}@XPJOI`$ z=QU2>zxS(|>WB1|`{So(G{*{WV?z*Y@*KjBO#IzbZ`ITX?l}N)XDwQdEK~sG<;yQ0{rOYnj<;W;*wQ*g}lX^3IE0{=eAA z4^Krh#Xj>5vK-Hae_6YqXP(gmRfs|9h}?R!bY$dFS&h%R@%slbOYqyi&7Ky*^Q0Xr z<7J(p?omJA&ePvvwBRvD6)!SLAxyoLi7kV`>|9*tg;q94jf5%T;L#y(Mh4^7{ym>fEwpc%Y7SNr1ytga9)V8ZIdmZzAZu#i08*Ks zc}Y61reGB=l7;-3ezNFaQ{`^G``0v#2@eK-g!WUq*3)Z--sMeC=X|gE2LM9!?H#O- zeRkO1@;o+F#+N<+p^X2sWdc8a&BLjfJOqJ_E{2$NB27$mB;&A^bbNiO_DXL`1b9cO z-Bm#81$;jq3}bI~6voJng$X=b;wamLL_oZ(^Uh+Xuw?Ux48eaZ{$44CoAjc*k47%7 z;_~h1wut};BY%^V|1M*5Xx^qaWQ4XjGH@nA&EuE22o^Xi+ z*-*b`?0Y~d{62}sFtXn-?QhStvM9oRxwst0FTPyg;kX`M1*o8t*1xKNf06H>GEq39 z{_Lpoh^V2)7jW_2!y&lgb2A*&nZk*J=KxQIs~5=ES{5>c?Nd9+ffej(VF~eiZOhTG z&OSwMc6$G|??V>|eH#9!qBAqJZ6xxA4iXRdG12UBwmg0qUj_9BPx{(LEobDkN_KiR zBwsWYpUD{0Eltq(HZ^0nmB`j(8o1-DlVCkNAr3)_1^`5u&=B4nW2hl@z$f-IL&t${ zcMR~?o0Tzu2pxJ9-2_lQ`&Y3ebc8PYQ|{jtJd%|45C186jM&4$m%-rcOE_#9;MW2G zKQIKgLojCWkIVrV5+_@?m)AfPx{27hMNQwLfCwnMjbJoR$i|8HqG^xoZBaJo2)=%pK_F16dVP+ZcJ+&7Xg6%AzsA z$!rUWW#)ow>1roD0Hb4{odn8zA}M47aK-J@f6(u){g`yF0jbiGd~vc(bU+Scn2fSz zu2giXr%_D5kT{iH6hGUFW=IGvT(7FNfM@~1Cr;~JsXtJTO)TTHNO!= zu6Hvs)IZPNMU@^>^B%c>R`o=U!#XsC`8~t@Q?Vu*fC6pfn2fur*zQ=t7v3$XVyKV^ zK<7bgBk?8ojM!a}FmFixkpGFBD;7E6i0Q}j9QhL=xqIlh|B2?AIk+p&_!+=Y`WI3w zO|Y?A1^}SKqOiv-r(S^q_8(qy1FpZ^TtR3fE}fB0`*nY&5EwJ`(l=M9r~YCFOZd$M z?zfi{odd!+odFFrwqS?hFFei70|uYKS2ylkP)z%eLeoAWV*3b<6IV^MA1(ub?>z-cnH%^SV*G0f_E3vvz+$WNHQM#aIyt8*8Wj#ve$iX^ny;=c+&z_(BcM>u*<3ARP^7zqEJB5io^yAh%+iL8< zzr2k7iF9>;#VF_ zN558Pv*h3QCUt8)d%w01rNO;c6Ah4)HVa5L$aA zSmVM*meLbDFunK4HU7IdlA|te?0g@1am;|kQtb5v=OQZwZ0pA1sC|;u945W#aE;G0 zj3GWpRQA`^TjP07lC1$sL@NQ8k;;1vDJF}aikkRR_fM}1V+b+JXg`A9gClG=Dx3l( zOH#%GsYBQ()?VbFgVr-_RO(?(H&S>>hd8^0{t7b=;mZ7&q}^oE!nuKv0bX$;njLa2 zV@&*hNP%cWf4w&7G0wTKmjb2(ULL|Zq+(Ssv}fM4uAx^Yxp`nbuo|plGSsqR=HV14 z!3zytCGaiOu~j(MdSA`Pf`{wwg36e`r_8^gkq3Pv#!Lw#Db{eolbdkD%iv?i!LscD3@s_Mn-s=qp@2qBp8wWbnbX%Iu!Rt_ybw|7kMp2Hm^uW|! zKsmK~8W10u)XJ*bN-6dmXKx5npxSJ9<(}d!^ObHu_<@)hu=kiw#-jzu(J~IA&q_-U zQxihBo0z4+80FLlFz9E815IMUitJ0Ve-t6O3~t`!tG+avbGTZwr+M-qvqirNaZ_BT z8U5PzqWk2PZ}NJN)G1o^!SO4$rip3 zT~?)PC+JlyG)1?V8gYQ1=1#83UF%|Lq@t*xX9dyl?Znfb~bPIx2Z?3NA zG4Hx#;ZMZYTZiO_o&-(Q<14!>o-Y8`7^r5jLd#a<@*@%Ue=wl?7IFPWBS_(Z4NLvB z2DPvhb2dZ*CZ03hZJEveZgLgrOr0`Bxrjf`4%dFjQse`S_Gp-92hmpkV#T5glZSZFoWjeTiE z@Sm<5Z2t&9y}qs{ME*ex!Cs{xJ;K(qTjja~%;==)EC=wl4re)z0&RvM=Z|gWuivXS zOpu!0+YoygwJr!09oJzQK3leE1ERbq9mNfDO`?}|s1D)3A&>yuE9VB_$8ltpHgqasCovlypLgAIw8dy-eXIp@*P{`dj~vcnN%IXyHnWq%yN8*KqB!NEHmPk>5SOrhI~Jp+E>NSroX&<=q5gG+ zR|(5r+abqH{a#M4Qi3CLF5Q5U`xDGb40kH-mWo$L-;Wmcb ziIHbK(!+zwWYN^9ylu4Xp3c#hPz0ZAB^V#YUVSF`+2oRI>#TKKiJvb1#$)1O2ONpu zAvUmTZ{pzgh;Q1T{Z(6Oe!t`+Lx^RDE%mtanOYn zTo?S*%YxHKkYb7Vh7W;bq@PKZKIFeOf$DYzC5QO*d6L;cWITVbtaD<+l%bw$A!?_Z zdkn~5D22Adxl-UbA^xW#P!R^l~h9-XUax|OTHKY|h5_kbkrn8Xo8tIk?I;FL7*WssLRmWkfryJZm zGADWw&rY+Jhu1OOwTY1p3*=7?_J%E}?3oOpJ;6B& zhza1s`geBqt^fveADvO{Cmiip=$`LVTPC*p3-t$Ee|pD|rO~^L7tBg{mbb;Vwpc`n5 za6V2N2Bs}RTwYnMlY{w^{I07Ig#)aYRZHjbPXM)Dt`T(|!Z~Z)rJJC0`+Fo`o4eFx z%&*wRdWdmFom|126!9Sl6`hh-J@339xZV4k>FdyGPjwG-s0ilDf2GEj3CZRFI7_hC z@22-74!rPo5oDC@b zKr>;$9J^=Z|eT$ex>AM^iez%Xw-XjzfnUK!gWXVBc)?o`lROZ-r% z=kO&PQncax@Zuq&Z2|(D4Y7(h*tlgbK6GSUKN!5WUEm-uZ~3qK=g9TGR?EVF@k$CK9Lp%vBh8;e8%t3>Ws2b ztTW5k*(i677RJ~zA7-`v$j=OtwPF~2 z7=4*z{v>kIzRd`f&$;E`n)|by{JCl=!BW-?fLDU$@rf3 z*KX0LGr42G@ZJs1$-B&}$MTRAu+ty$Csn1JIzx>OR^7Su*ZKa+{YLhvF!PjO-2RtO z+I{_i|0;@TQN<)9V?=y_c6F_@EpO^4fO1FmE^|P;gx~4^^kZ#_C&Ejk_RSnwH@&1H z1O~g%3qwCx|DQRXtD(l5{^re7?kC?(1IBtZRZ>PC0Z5={puNBVBE0Zce zdq+2~GpT|eJ`}+xKR0jKvAs4PBJuD__vnL!%E5#DGk`c*J$d%B6>adX%jQzkh#SF~ zWuQi}5*5u^RRtE9>ZW9~+5i#Mzjr!V)%Y<8zLV86-_3^fK=(tSj?VB5qKeIDPGXMop!KzlOLSgA0q*I)kj96qM>?m;!RU+*-+ zxe-q8sy>v^7Oq?R@merjBV@XfLD+Ll@sh!SsgmS4ur?s~am=CRbYtr6Fq!G8s=4sm zV_nNk*z^yTLk)k*qpss5@rayg;5G`8>s7K@hf+U)GjSVyM_{}8AGK~z5dR5zT<6l~ z)yxQoSm$1uH%PIC2L5Ex8%ueFWO2!1nj2YOUWL|S`W!8?EhI0|>If{c!?kx?d$02k zBPf#m;mK_qUIUK6gM4^=Xj%Mn(a|TXP$n)6OXTk1v1^fyOYfn%`f7^>4Zji6xX8jR zij^;?-V>(k9icZzBYL!@R~d4;l>r=2fc4yD?lhh@w3P@f@hwmn+Z{s?t=swx&kikv z8`njmd7w%24p!b5UcEa@T%$ZjSKc!Q_QHfLQnO1j+61U(YX?!AhuJ^y(vw=QPHUFh zkW7ci@tFJ1Q~wv0e>LwIsQ(+N|M^H@9P$w8)XGvfh2PFDxC%W^3jTJRybO^!Lih1N zx^_XtS>#QtCN-#>F`PMVZ;l(gzd#YE^I*jkEzuUkr*S&*klBk<{+zD3#8AZKzg+R_s_&gL7>S( zd*nHxeK3hrbVpAw3q_-k0Y%}z=P-96}oMqpq5?y^aL=f}#ANORF#R0Mu>bECTNuk6@OC}wh7?f#ua9uihc;2P1PCAs6&Zul;=MafxBK`J5)8g|-e?Pagxu??vj_Ul zO5qT-qHavcLFg^B#+MDcp1>JA6P!&tM8;+kv(2zB0H7J9&JJ>6eZKe=ZQ|`l88}OE zo;WCJPmn6Z45r`3Dz4I-Sz`cXdtD(U4(anml4y(TrBVmmd^HNVNQKGW2LOt{ibv)M z5r4M}4mMTP{H0a=eI$0}k?yl&Zmx(Cun5<5EbA2UAX8mxi{mHAlgidkP{kH+&RN=O z_Vn22MW*_($H;-c65k{Wb0gv;1OQ3_C8zPb znoNxZZKod2RUQwDXwGC2j}|%lTD6^%ju59?7FyJ~*PTo;t++UB@xOE`Xy$)6qtFit zYyK$S@co`xC@mkQ{dz)2omYXHXd4Dm&B%T{mEmek#Au#wEs~ToX+uWGZ;J_NH|tI2 z>Iyix#|!s*9>#oX1B#H|zKiD3erGv4#48jLk`{N7^~U}-f_`Zyeiwk=_y^QJ`UelJ z;sa$%cPBUyGOf-nI~d^pHQ?a!S*irDtLM4OPUm~MSdIox2?x{J4tgYld5d2x>5{8sre59fYu-!8Xk^M z$Yfs%Jpo()m!i#NtpJQ36Y8589s~C%pkFl8H7jL_l1#s- z%o1Oij5WQ^H78$eZ%s~1RBczL%~o~>DXYHM3l>N|BLOTaOmX~3(<+<_0JtP$Z^37K zof?(E&zw~1?s%RZH%hMtvHkGw?d#6MkNPozjXd1%RCq1N?4}6UX-B{5X2d0onGQYn z$eHR_<7vD9oPCV~bs+q7qOL=WoT-qjVU+dhzymdM-DF8;oxE+Waz+xZI)N%YBU`wt zC;)K8t9t|DEPupt)k6by<`g4CM{?vJAtLw-IfkK10l7cDo-vDWdHEJV& zUBi1{`i*wI&-4PzX zHzV7!%H7TSK_x?Lvs0`Oh7i018uDN0ChCd?PcQ&02Mes?!mJq}ls7Zm56Lh*6K&qs zG~0s4Ty2uDX(75dHH_zb6i8iTgOE~nTV`(SgcIqZTF(|wc8lua>yZS9j^X+-io=bG zVVSnvE1cSg&5J==VgSHGD7mD?@Z)tgcH)aY147Ep0L`bbRbj#WveTJ1Dx8VVd9UkL zLvpmF`Ob8aII`cA_~Qd**IYwFZX6agYt?NxUy?j-_?Q`6hb7+)o1Z74>jl1f4)((5nvg9}cyf>5|vxCRsPoTp&g*mvwr*c#+bF-E z%tTmbmd#b$G#6bCT>n81;gHO4{GNQL6M*xP97pOK$DgB8AN&%iq&5FdZZ7RJH-Rhnq^>A9(f!mX@=xUX? z*K_XHAJm?1R1K>Pg?Z)I@YFclK?CwrkCFv}J1=HT0>r$+bHDs#jw|kcxbmxA@XWNJ zviL{rXFUb7jOJm#rjD3$J5C0fBsRPUj&mmwPdDLoh_o+GnVGKO@yBahC$HBQc-3nc zc`)-_ORE@v@E*taPpi%)&Ww`?G+>xB04FiqJH9*;)&FApPLN`({|E77{RgtV?2imx z+@B=J>B2EnK%g}4xLRNfTEB1JUFY}or;XwHkQ{3(kjoY-uZ$VJ^D}eeFUGju-Pf%) zmn37d8}1Zbmbu66mHbs)dE${{iI`hDe!Ik%M|#BHBG`c?l2MizGhFf?eh4Vlc{mGl z$&a-BfwdQ2%2l^|DOkdb%Hc{Mec0PxnTJ;F4O*X%)>iXZIp>JRDZTo2rLHnqA{%@$ zAvsX|Mbd(ebKv0$!P|fX^)T@SpdOPcvcORE^0Dc&DO}OuuK`f2#J;RoM&I-KL8=+H z)i5hU%ewC;zY-^^hHuttgILr?JBJHIxs?L}Thqyz1>bOCM%AKSAY%rjtF;9WF#!I* zlKy}5FN!g8WG8*{5=BgSU}kCA*bw)6@F18o6yDi=5}k5*ax5=0HKCd>F8|B82rAQp z?^*O~RPfuJAfp1^?8~kp8%}+;_;9=PS~|U4GZ`>*xGNt~Q0hvbqjexGiFWlal;dJb z=HaBbu%ef=T$3h5z6*V+=4|cH3MhSiAVDHzPcG=z{ar#nD#T7cwJ~#Oy~*3I*b@>|@%9>ztP5mUGtyb5;Kk+iuD%srC24!0Xd*!vbGV#Z|(II@0mw2~r5P za?5z8fOS1dWDnZo+*cnhx;t&{hBLZFz}QoKG$y3#L|xve^x@;aD8=vbtOaF{7d6Ua z&N>XKxwb-{X6y`4j5c%h)lsCJOWiIETa*{Hn1ZP~tWL|#uT8Yru}gyg7-btSab(qj zi@|n^e}rf;+V2SjKR}m?6ozFU4xbgNW?hfo{*NjvQf4s1>zrI$#(4%9jiU^%wSPc5 zG@xNhCfNq3yK%Kn8m#=U^K-Ghq!1yZ%NEwbhgO4|fus?qHu~-wy}TW!7CE0>FGLIg zBD9Ls84p1`=6P|Wd<<93Kcv`7U2@H(ih2`wrVp={k74n9A)+eR4_Wx0q_hlcN5`US zDBGS1`68R;dXfn3+!udN^jtR;dUyb{+oH@|-gj0eN+)vw+8rJ6^q2?C`|+%I1=2z)9?*mpUehGfgVYM^rsxGmkuVFI~_o(5m?3DEV{(-dSKnWPy zC{{vZ^(1}|%PZ(2&xWCB{>2!?g_v(qo0BcCoQI>skqQb@rri$M%`@Z7K+q1609FLh z{=Z9PL;q7Zp}92W6%gn!UfQBqP=~43yhJw0f4_!j@rrymVekO8y2{p3oL8_=H~)=W zdGM;j&P}4~-FfQB@&rC}T}gLlm-^w?7oDPe!RgLnYp&7hUzEldMGPX_SG{HaSXk7r z{BDitu3DCNmQeAE7};xKHr`YYb*tTCl7@{^(N~M7L*^a&EqH_UP3LMpS(fH4LLj2z z*PqXu)P%pWaQdQVtj0C+e<#Ug+5~)#PHN|xtX8m|F6FFU=KE$MoYG%*SZ4DCvTUo< zioMV~nxPvYRByN`d29IG+0COU0y9UFfNlkZ~(9<0OSXKYtB&9P4_l*g9yw<-?~Clns- zx^#nZVqC+ckhr#SlA{XCG;YOh@u?zhRGb%GJF5`60>7>)jr0KvuS$^>VNTbw7732k2=QF6w+!8XIJ-q-fjF~A&s zuWg-D`{mgQwZHMn?SJ$D1sCF~i4EKrZNOkOpPmy0D>vj3rp^%}-n+k3f3xQpze}d~ z(lYzIzO#*@^;;{e3AD~fgY?JjhD_u&&PG$wY3 zRV5cjhI4__Glzdtgm^7ZW9QzTjj7|mFFHQR#nWHiwDy&+j>W`3^(B|3UsVxlX)c{? z2`is*=5k`3>y?LUw?mG;PGN!PG9GJ}#^=?h$;8sd)IW_*eD>id5?HcF1urRW`vd7_ zRihqjP?<_g(pA_*8iwcaReejDW$M3rm!m@eEcAkPq#$K>{J8+37a3vYMDg%9nX0O< zeEht;R&Hs?B&_R{3r9S?N0?F_2_wg{w0SNK3j9-IoasmVSA!f;WUiYqvXZw&o0``$ z`o$zyT1_R05kGZTVjWR(%XQ<)(TUa+XJiGOGcA$$NQp?CaP-Bd1*V$(BU3XnS@bsZ zg+$`E{SY%(l{XCu?nY0pBw@A&L#~U9$&_6&`GxpzYbAw2NLbr?VeSu`IouNoW#K0p zb*TlS0kOROMM=kR1L=E^L$wN(9o}rS+-5VsGDI6*a#ffw7|^Sd?tRW38ip0%y7|Ac zaWe+9Z%g;Rxhf9$abq4a0bABB3t+hXKbi~=AK@5kxlgY*920shUACD6 zy0~t*U|d{n!XF}1Kv#6oof^X0y`b=Gs97#wof0f*+dRngIn1fnor&XX z!D3^>PipjKh6mRmPV_6F81ujT1doG9=r5c3JFh#h*el{YwXf1o8dLfukXljvoYTv( zv1Ejz1KThcqrh}c)hDaXGal3n-GgeF=)ETZK_iYKMUnCIkf@%qGqpY5s1SayoG%3^ z)hfHebAI~3kaSX&kdX8ww96jtwS*X>J7}7x8S}g?xNp~#2(4SCPyM(NNq_oB+3m1(gbOLs9Dy<<{-pXM_O+nihkGlijY z`?CiaOz)dHxsesQ)n>9=h?MBxlF+c1?Dal`qM$Xx6j{%R8MK){*LG+>XFo_+QsSC# zU&oNkOsHaij(e8(%|eIjisd7i{kV}(G;}>m=@?5?;yT2#ErQH})7XFuz28HXvV{f_ zdizKHf3|zCqnQMEYDme_e?0EL!X|NBcd8R`KHh7Q84a0Zq$t$D|VFZ>Fbnl1iGPgMVfXUN;4ipKEy4{k*bUYmUyk;5qHG2y9+n3{sKW z8>F=Ey~|(H#VxYrm}5!{xluJ2K#u@CuUGcD7<;aG{Vxt`wLVU8FSZpw_USrN;-%bj59ZTm3gvr%RkUA$@;vW1MA2GB+V;lRaMm&MRTeHLAuBMo zD}Uw@*NBqMWF?JzP`5{yto|PHweqWNw!PZ`c@BzgO|qkSnvwQN(xZ4a_YbXR5yN}k zgUN0d<3M%sFae56Gn4Pc2x20&NzFET=4@)bhq9{73Rn^R$dMU=k$3&U_`3T}FGT6h zCkSv&K$q$|ZO@hdm5WAqw`@Nq!Yn)Iv^(X*Le&dcfdlw8f?A-;nQuzGkD+tnh^nC| z7Kqu`^aa0|Dr;COuwY>vTLFfRq-lQnI`Lcp@lG2cr zGGbR%OY9A$t--WGYiDe&8cQreEEQ^>Rx_zJV`*$dsA`*%B0Ne7<;83J&gs1O$GpGp zxqsZ>x##@u{oZ@OpL_3`%bSFM1Yl*L*A+p!IIr)kcRfC&5`-j&xK9k1jR{U9s6e7^ z2=Q_pVtO^@mcVAh=H~JHjh2T-1Vy}L7Z30|8i$p+bsv85G+W)amX;J6W5Ysmny^E>1?_nz z=sUXP3T;KJf%hp7^iHc`!|d!zBPJ$`oa#Hjbl$Mc*`Ri^S+3altB-@<88(+wlNpN3 z_1@OXT?hJ$BXfca8Hp@DSeeh5VV%LqtP3mCdD3Z&^Dg6JjgFg7m(pTuIQ7*I;&_|k zQ}@_VdaKn@%YjkXG4V`v$GI4kJvw( z3ZQ2VMo#H1XHgB*o0@-jMXHRvyICIv@k0;jz4whpikG+DIb79H948olH4hW{`m=W+ z^~KQp%Z$EnzOW@5U(Q(JiV?st-U@ns&wlzfXzHMP4Kk5@AX0$V z)@OHqvXD+nzE?aJX&+3I1JuhGo-s9;dolimSeDV4-X9RW|1n>d)wprZ^E>v3#VyBu zZ4(ghjk@JkId-F+f1(gUHtjnFn!iYV|CD;kXff2kpTC5B^i$O{rYbyNPM?Q+Zw>mG z%4i?mmLbLQH)CGq=)$wo`owV@NlHTEW)~~yCP?$Ovwh$-BxI_oQMJ8dP(){= zKp`T}g}2oS-`Hj~9M z|4@D^bW!rpyeNnRShbJd!zf?@8AL50lFv<^_P2grZ>vA5%a z)qc0gV~xGU8A0~>pMEynSb`j7)48nU*!myfhbIsnaYCg{Ij;gQOH$3pN9@^>BX*1e z?XlA9%aC#2==hT193L|&mNcPVU?}KlX~Y*{o>Q@fMa#JQ6%d5oAj;;=w*?pp_GS?Q zxC!B0`RmC{eE(zVWpcZ!70|NUq%M|wzHmk!=S%Pg+(xf|aA=E03e#L01#>egp?;%H z_q}a@5hqHJg<4QkZeCuU^yd7O=X~c4s+K&^Iv$%93rxg*qQqMPW+48@OWObBdZWXt}@uZ2aDem_gD_yEPYG zbRAgbq_3mmi%EFBPS5*x9?L1Y-U@YPDat8T?kK_R&didZ)Z$1#Px)~pew@b(4kUAo z0*nRjISzUDa!q9FiMPemsvE411lo=23A{}R(Z2o>vcnbK8=lxKKfq!N2H-E`5ZB1& z%JXf+OgEh^26KA%qAaz11fS^5jmf4h4-)R5q?{iXT#xXukMeQdPbtcb1A;EuX77vQ zw0aI<{w528{=0|to#BQW*<0b4-B;Tl^TCo7HLEy*Wa7JTTjGGvF7 zbw)bkL})z5-7-sG?QM>;n!}4-NMu_|*jC5NS({l=-=N}3?tftQ@|t_)QjX85FmCv3 zkZ)7;e`Oc_nK24Qi+*8{9Kl*W*5?q{!tOe>Y3SS_JAK~428*)I4$$L&aKSucVV^Ux ZFEIbkyv1O%_2Ae8K%T#ds5AAz{|iPQ(Psbv literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/sc-query-sense-running.png b/windows/keep-secure/images/sc-query-sense-running.png new file mode 100644 index 0000000000000000000000000000000000000000..0e537a3e96f2634e7692d1911efce55f375cf471 GIT binary patch literal 13934 zcmd^mcUY6#w`M#XE6oam6cG{W(u)aEIZ6kmcSL#(y@%*gKtVw%L0WQ95~TOg2}-Y# z-a&{EAq0dZlt97+&%M8U=H8j-nfYgCo@f3@zGUs4Z?C<|`>wTy)yMK&?!U2(fj^t5V4q_I=;9N++hsXSTSrOk zNsyK)eZrw6d}7~kw`_l*#&xH#bfo8&w3jOSAf+`Hl-nBHG}WIvsh(F8;xz1_Z0lxQ zFFr?m{+B#X=2TIHngLei&bNuq3feVy3p1Z_U3;Z*4xw zw+&h-+c?dfp|Te7#bN#e$38+2GFjIOV_JbUePQFSnoC4&UUZsaMCYfbAQJ|P0^Zmj zFs8b1D2*P3-IdRU^-mjxEX%;?nNl;(;Q33)^7S~rvObGuf6)W>*!4{+p0u||A})NE zvFP%kk#}iSDwVc-wMMWs(O-f`QFXS*qbGT?Ap35rv$Yg!#6v+cw6@c+d04hc&E=K- z8^X2r06npHmRvpt5q&$~T4Z%OvDw2&9AxjjMaFMEuOG8Ci&*t23d)^K2-Av9ocyzn zV=EbDC)GqZ<`5)@mIU@~2M!2Gs;TdOL^prUmP-X@$XV83msZ{He5@^ozaNNloJ(ct z1m2#QvYno9Xp(d5ot5e>6Ew4dv=LA-UJx5^SMLpHxj zP+4~1Q*pU%cpe`dA<9Y%lTlgTXR5DF06`3(eLK$_n>qQ&&~NWISUMvGnPV-o^C!W} z%g|>#KV|qUv8HSqnc-7{6x#id?({@x$R}v~kJoSKnup0t~n zY+x1-lDgn4Z^#Yb+RQ+^O;)H0<3+~n+fcF6Qi%WU+X<9X z?r^xIY9?^==JhaC%$3FLqL;rE8jhIy(CI=vzhqvv71#S)`9b_PNK#NjuzKC=M59S;augKNI)w&feX zVMlKSHEk}ln^s0^9D z``~+a(Sw)nl1ybqx2u3V39g+Pp;G4#ng+dIu8{uy)AtP%`)*tQZMXb9ZzaV><-qH6 z-5xj4iKLh$WQgzjn~;hp6oK@RiVu03%h^T0TqO~HWXm|j|GroU)Q^qW4N1hJps_zz zB4nvmiNqcwJH#5%I<0vnNC$$&%fqVIxMVmDISt8sdyI(yh5577+f`B)I!UxO<8{CN zvk?+eyfE6s*oe z85bw^nyskTRiBLZ31{qv_V;#ors=%Ozq1EKdM8G}2f&fAu<|MF4Z?7#H>cULg8W?QY(4%bz2Fg$L{(CHq+ zd-_B~OR;W+uV~oOBO}|2Cpb5pmSm+$U+Ws~OW+T#P1|{ogR<=$bPd9wMd^aB5gF!9 z-~r}3;r|f}c{_m_#e(+UY}i#Gy{NJ`)8Ndr0pSv0^80}*39)PX)mb8mDC_8L!>x&P zlf}6y)6>kX8Hiiy1eV%Y=T*Z3D{y(srmzw_uH3`#m|SZ?>wzTAiANK~gnVT71W!~$ zlMpk21|$9zMrx?MOrFBmZ_KZ>QssX9F(rIRan5OsOIF$~_O4!%z{%WR$SyK?y&~t> zZR-_~Q#;TkHaoLZrB_myNB0O%f9`D=AKF9z`8N_6m@%Enw4(}$9|`KJ&=XOrOxe4S zFzoX0LFc*b*LAoAN)WZh#~ug#QP8HuUtp{ypqp5OGO)%Rcj$G#AugXFIh~MO+r;r2 zcOM=qS|}Sng}eZFZp0F>?r9r*(hqopQ0~)G2CAYIC-Z}4+}tjv{< z*F_R^@AG_iy8A##5KvQoY}owI_suDUIi?E9;o+@3%R>RPMQOW@sA;bgQ**;~9*DKn z$`)3#w9jFunVwg}1W3`2DvITbP__@L-Tu72 zVn)S*RDcqh68v90;vG2pZme{F%A2=)>9_?@^Ajd3XEtFk^!6{=R)(ULO4yjPf&!aZh%(VM! zMi@QZp@a;4jR^~9-nRY65vKhUm412h66im~D1@}=C)4mjBV?~$>8mAbQe#mPEQy(% z+!dOQUFmb4=#BJt)Gs~>9;<)rvoL3NGs!1+8JCupXIOZ+Brl3S<9)Zcr@vucbI9IHXpbx%=478gg{wNyEQC`_c~tWHISRJ`?fV|^O5Z9(IL?Gfk4@Roe1+=UB`wP4K_w{*{< zQVmbPrMPiETUdA`iZ&HWCs)jQcpDnWnB+JmU6HW9rxu<0;H_8k*OcSzTMtv`VnD0j z=Gf(O7QL_+&Sr=_ca2)QUM#QDv6Gg+XKP=xoT&I6Bh{C2+Fi2p{mJe4wobGhnTy2_|qssp9?XLeO zWf<0H`7^Q+)l%lnDs+gdsxdJ&HtTv`yY^*OdFiwF{kSAMxz3Z&0u^U1jaR6YtCA5H z`%9ZGv;D7xm{_pOS!f-{lqQyW=@jY>FL(KORG^|!&!7U2UupVwYD@)?9%KYTH}j(3 zTGxD3!gDaS2<9CEjO|U9aR{-`Tu=P=KfENwQUYqt_+378$9$w$ zFDB*LG{E&LBpSG=o9{|4PE)_5y#j>#+kj($hSWZzN^jd9me*~ozpzrc&ViZp$SQ)ag5B4VhX+Sj^2 znJUTT`h|5Ou-_s(*~zEYnHj6U#gvNWE}gc{I^i^$_C?X-(GY~9y?by0(qO}_erKvu zw0`@dGS-fYL#B;4`Kfwy7Xm+>GCw?0+bzRw_6#)6@LZ3LpWnHuirG%tnW!k06 zNX>Dj5%>yc1K27s>65T)#40QP$Rvun$0E6p+}9*52=s2gohS-MGBr3m6!FMFsVkW< zN#+ot3PZ(`Z^U?ZF&0I#GRp$zr4IU!8n5W4;-c?CcpMsf+NR=WTFITsk)+l)LjGOs`wGg;oc& zS)@9^+zM*fN+&cvMSyy9u8nSUx(V7uB%~ z(_$HpuSl;YK{0*-HYkB!M{7JC!)ONF3%5|FwndD1PMNDqBSJYz@87D^bDqjFT~%^% zXtVmoOoymAiFgJUo;+ckc2oV;dATI`pPSkybRBAd%x(gZ+xN=-Z6T#b>5+QkCyQX;ATg#z~}5~cK2^3 zf2*-c^{_J-|A4oHFVjj1v4PDG zzc04GS8jSKUf|g)#EYjc*x;siF6({{I zj|5F8?l&(?QgvBs`h{!pLdBbJxAwfD(9x3XkUhpNYs}d=bNkGSdmjqdzLc62o^LVB zy}2S1;QmzWQXZT8&GL&^E?zgD{8$ze0$^ck8mbjhGOJZtBJy5L?piDsgrjtL zmihhv*^AS$1LAn8%d@v9e3Fj)CLUdmxFG{}fSl^&xf{=gkgt`;bU~3E1^^hT924${8@KjnLaWOd!N- z_9J&v;3(*Kk81eHRNh4gZ+U;ZnCn1t9JmQfcv{t^S2LD75ySYaYE7_M5e3jxB{&Fg zM&5dVznbNhYu#w9rx85J@fzp4zvm;V#I4JhM3kmX#Xb`2yCG8F{G(n~aqIRvS6;@2 zS>BU2L)8om&@m<8S@goE@7k>4k?vS{o@Z;ICyz_UNiSheMSC^G@0BmAeo~K*a%AjH zp6~th?TYpxW6-xEOa9r&A8Ggh{Ms!gHSJwMGRzPUcvA3CSf>}hS63wjnrG-G=RF82 z(t+fGro7EzJ;LqeiN#610pl8>nc&Q)__l{?I_c@0F@e?3rAm<-@Z-QT*S1x&Hu>$u z&=VbZfh_o|h-ZFhaV;tbY)Vh9h5U%~kH2p60ep@#9r>I&+_nQd0S&~4;jGGM(!kjl(FqV5l_YhUPWM=)xU3VQl*N2FBP=M{M^luYdg+) z-||pP3}V!ZCsy8oLL1T3HB~oygC;vKx1tzt5c5jQu(51#?sTX5bPnds<Z zx66|sH&mnRUp#sB={yd{i8BJW1;h=VZxw^tZWARsoJ#D6q<+7U7$$fQO%X@r72_cO z!Wu&gY9^ZB%cZ;~bXao+k|uuAg1jo$f@}2lQ>RO1+<#~muMF7ggIdE|nPR>|9x;Sa>fvy5m*XmDldKDQONj7gUU1E`NLSeaHxzqyqN5-dhY@ zRCgj)f*QDF5ysk31)>JUQg8{UZtu>f;M`utS_mee+Pro_H|={;SR5)nbO5)lVbW#s zmbEr3Z|V`6T%0l(jLr&^e7|iiv*Vo*X>ZIBN9d<9S6JM;bwMy7?UwoBm#VO!PQHD+ zsn-kHmvH7c$TMHE_E?lU$R$k4tPzmKLX+wBx1sQ_*-NT`nKS>Ev`4=FXE?lceauJP zw1M7GjdHm&Os!I(&VV=t&d52680Ko2nFM z2}`mrMa7T*9PJBveUfz^rf$rv2hYugoLwC(&Nm5JAI4=CFzdQWeIQYnc<``qyoB6}zm+@)l0qZV;Tr}fIKfZkfk*7vjeN--E1hi(! z2!FyEL|267g*Uz4s3{DU?o}6kze!*sB%7yZ27*&}d2~ZHWG~&9yU$}`ALqI%TP|~; zT8U8_N#3cZ*gX&3_2ZdOAUm|Eyd-S$M=-(h)Qt4M1qR*~U)OZQ(oC?|HOEvNOAl}y z#7|pOGb8vLV3Y%Rc4-Asdj)7#A28*-v}2m>LnuVdA5gA5pth0&$Y+Y%NEA!AAp9l} z7IoWpkiApIwSI28jT~64B3*bMCt`aqB1q4*is^A_H-NAhUgAd!2pUzw+tcRDjV{9c7dc`{e zv};&r+sHpv1W)`zu)m`^WJ4ASY?*z@?U{HFxM8c#T^m@e9>p{OzZ zA~pl2MhT?*P)S|nlq}r57sKz1pYlHa~!^U-XxR=UP1p_t%x)>^E4ys_e z#YS&xo2Cc9C~m2n&?b-;rQbk1sQl#EB3YdyB{8%WQe9b~xjYouu(TIE$fr9Kkup?x z*{;?Qh^t&L4;TF0L%^jYJ4b++5|w`Q^b#V2L9em8|Nx&DN^5(8JleW!gC5x6>m zP=iUqmOXE;j)No0odYeqdTm!Sp|@F~@n>Zqs4^7??oD>0-)=&%5z4vj6*>Yz5QXf4 zga!ok4eu%^Vd4Ndsce%r#)~F)=%VqqUGurf;p;Q?f(RsDV&dnWs?Y(~OvNTIYG+6@ z!U-)g>CCkq} zC)@$X(r^g`)iB@mk}J4Z=BdO38(7C{W-21yxb7JXR0uBIwSOW56r4McTTrc3JBu@= zyV|8K)8tEDkR2kFZ;usCD78J-``BIy+?NEpR|fRhoh8(i^N|0p8ap{V$$$F97gl7y6ph!x6=3ZOPzGL6)b@^G5&!YRSb#*@l331;#F;;tzHw}i?;jj zi9fL4wb)yqFbQ6-c~?sMNhPEbyIX?6ytqx?EhAtjP%NgGM#=7GlKjqeS40^-T&`?V zUwwYe+xY`m;e3RoNcD;Gk9(>$V+nyv%rSmK>(gIF(XR+S;)mA+f4eEJ?@GnlX z7sE=&vxG~)_}`)w5W@lZz*$9*#(;c4M!wg=>rnV~6AniWa$$~J`>L~D?v!dL8-S5) zYbXBANJpjh|A?iJ`0E0GZwL}M_c^oV*>u2FL~F>VX-^(319vNatM26rGqER6?^}GK z*iHsbuGajONDq7mUG!%;?9-^P#)&TDzyKDDH-rNov}BaQkI9dv47N(CJaE1jgU`Q2 z^FvjeZ;yRi@qB7Fu~gkX1r{>&;DuOI9KoGP&YbCbtMGlMsX>l$9%FiX?} z8tvF4XpHJ!bvM}_^Z(DS_wRkn|HQce zH-{6>b>ZkqO-`T(( zP$B+AqKA@SL#upM!fd8w|5rKZ?g>Z@!ekPtfpm+YyJG&}@Y@UPlI|P$D&h?0KL*I` z8o~d%gE9Jh#kVU4749+cXayERbm*0S+*epnA5d!LF)2Acci9{wR&LK0)_b-zQ`f4} zlwn485_9ey)-jW-QfRK@pJdhuoVjj-PiQxsm?2}XPfc+ z9cgQa-Kvf&wbT|J0YKJfO49a&|jc8BC81@9)o)sW;5X^ojJ?6O7|U zbE_?GRf~j$hjk}gbg6pF$eb%&EJwSEU+O6~SHwo%(wJvNU#oEA$!n;8c|T5VbEHGJ zvgm!tbF>)|;48py%oT<%d^<}=WWE;J{0`?sb$b&2tDS#lXYiYs3~o7kiK9Suwf|5`@NEW!Taq=$2lc96RYtV#H(ePt+ch6DyTrctYDR^&|2Sh~v}X19&8R}pOpML0 z3IIS*bB!@*g(`BI1tt**&wS3DA%E~({)~BXDKx70Rak`aBdbvgCLK}QEq&b?a|h*# z)k(c%hf!!TDU{zUynccA-IS9Ke-dTeBYJ4|k#}ZaO^tWf=)53B@AmA-Uz0Rzp$M_J z;>gvaD{4!euZ-@D>15th3_{ncm5#h?!)HuGda^baJX+sT0WE$5?{kK)jwG(cPCg|_ z+*{TDIDsclYo-giVz}!X5Bevm5Nn848aq_J>FJ^61VkLYTJd2v5k=X1v2o8Nnv2|d zK3T1JBqcfE9?g0ybvdM3#GSYp(@HA368JD1Y9*oh0ZmbZb(!)z^kGa0e@5f2rXaSi zT|rJDfNxfBQ;ePQ8waHqAS|k2NCHn-Ht`32Gu1$N4RI^iH}RYqEvuRm=6>Myk}9P{deppAmg>EbTjoq`(;%`*V^sH9m{(p7WQ z!VoLhm(wnBN;*E>ygQ1cTicSo#`mcu0rJMHfk=g_uEnuWC5;~RwJ74O0SSx|0H_R1 zZd`0FP%trf+?maUDfvpTy8`eIzXJL1z)R0@9s->?0ypkXHg-UZfb4(9yte-=9!!@H zq|#fLthtF05$Tm6e*^t_E?bzNpSCvZqdqPS|J25By`Y`w-dEnm1zHV7J4>FOByPY{ z_JQ=AUcD(D`LVv36q|nEW~1@pOC_!berr+O7VC@<^o3GwhF-&1s(CN7_2i0T^$fzg zEJ&U2Q7!Ld%bSB86;ifX3%5nQS~AJ59LIZ zev*;1xd>r3D#$Ur>aP;CxDjN_Wkf1t3hD)7f()&BoJlv|_WwaWgZ#L!R7FdwLt5rO zu|Hg~M(mcehmwhTRJrk(I|;SBQp}mR{bWb|#BB1qYr)LKz;uk>rM82h>`oegc(_kEV-+=%Z=jMN~D9n zU_M*;dq7a#SA(tTcTUkGQW&4Fij{xZ-gG&>3{C^58_o{(Y~N~n7EhWPL;O`DR&2>| z&$qI4GsNb63VA5GWM6c$R<-XdS@mmC^_sd=FLorVW7nBr)>p&chGSHQj z5=!Ur5f<$I1ug2V;SK|DDZ3&uy>a<*PVU6Dn5#?qoUI|>VD-Tz7*~TJP1J1Ic8Z+| z4}5CatE(U`LoeS1S)au*bJ67o@J?Vo#p8M$m-1s=hS*)gGj~vN2~Ll7ZSdy-yg;Y) zkGu_pJP9uj40jr))Ezv?E_yRN)`(HJ9H&cF2RKID$hjkeiqQ66H(BwDKu3=aafmxW zQc;25xNd2L2tOD@$#7g$W9VJxjQTV93#LI`|9I+9VU8%L!Rh#_aL6mu9}=V}Z|>1n z@nz08`3Xgyj0H^0HRJoNBpWYWQo)_KLwQM7#sf;zh_-Fl9{Bs4K&X0{Qe-7lpsac-kEEN8!=&b4V97NE~#+w%Sh`ngi0`f=A_JsBc#LmJHnk=oRp}_qwG5 z9DbRQANxHaZee+gK^=iGGgEtBc?I7SoWvh@&emvXWHyahm}id_%^1~}cHP*!5d3JV z)NBe}D~{_ff-?f9<2#95yrYGz=xU<@USK83(&KQ^ zPpT@1*F5INhN~FU7nuhrI>`rQZ{6ghb=<3UYv)2A%H}LnhYC5i zz@gf|Rv+C_*qr6KY8>Oirajp>VH7@dHY6!Y)X!el{2{lSRgI<3n}gBp-2tQLMBYp@ zNreJ#4s+eqCk`5)ih871>A72^!GZCQ-N{Sh@%4917jKeD+EU0ue=%q|C?{OPRLg_^bL@IOvOx92EUaN}*^rndL@M*i13 zY;tkjtRTz%$2+d+;kjp%Ml_=c4h8ZZZ0?Zfw6zGVVY(5Cq7>Oew$f;>J?`qgu%V5Q zHTn(LUEIF0LCer7f4y1vY110|w1D>3#kWL;n|t@5#e$wcL6=QmhggAslN!nG&(Cl- zg&S3N66;wkjYxl4Gz+%PL~$ns*CFcf^j$14+(Ji#RE{QEfJ!{LWv9Jp_acn8X7K&h z>=vJ#2aOoPHGbd)4$`VU#1MM5lIr%M)XKp&f9k@JC1UR2jmJ;|+_-rx|s;7vstXR7h#~yPYtC3V*EShtKPhz6BgulO*B;ApfyIi6lV=_WNc5VdIS z*7+pdwZv!;j+@LdL!07iCK$G2A!w$yb2ba3wBZc(Kr~^=1LvsGKpdN#Hmn4xG3LQ_7FDP5(o+V{G60852(Eo z0)ty?_T;Aj@n<7Sr{uws$t#gu;3zsOGFz^OYrDZs5$lsx_{6=@UI!vog*DthGu?2# zcsd~gG`Hc6am zHh({UPnWzLJX+l;g$m)Cn*ZB#qrNf&CV>u11F|`w&P<6$E0`6Yc_R#yC#*C(v@c)c z#*8@TxtwWr;SDN$k)?3@3SL?#yH_ehInzFbH&a%ms7kYI?0JNw%d|boVd2xFdLn4f z)M|1}{0oA3d%-Oq-5gg(%S^~O8=np^!2vFxEIs0j?qHWEbgs0bD=h>6D18TKabLq# zzwTByZ}%()Ubi<%U?xU59H-M@rS-OgHubkL{Jzl6 zlznW;Rcg#UoptZnw=e6VF$RvlS;yr0^F7tCDO)%GGy4a)SypT_*gkXWF^uQhVrhw<-L&)( z3>CDWSMNC)=dFcNm34`8Ng6Q<*LD5V%Cw|dwB`ZBBfJ4hjB;3GY}x%pZM_yN{u$;5 z*!MjGm?|8^y-L6IArg9mQm*p;0ny3*!Hk+QMmW;C#Flf<`2sRRJ#BkqR3&4rhTSXGHFO=E4t**W#uWhFf-8g1{&bV%mR(N21JHB|IKWk3j zdgD~X71KIT>KsxHZI#{23E&RK9d%v%OiKJ;>bm|ufcj@M=8F5e(2&as6WhY~m8x#r zOJq0yZi%IuhSno%7#FuRSIF7e;osihjg%IpP(9d zP!v?#{MBRo4h$;Y3GZ#}7|Uz4n&NTMoaS`9mP5%kKY;ub@|Uk~G4N zZWLh}i#(e(_JdG}zl!~n{5#Do475Sw*wWhQrX{D_341Yd^;PST63nPR;3@I;4m0A3 zB?7bKCl9I=4fW(=Q?ksEr9Wa?&a{1CGJ}i5*o7Q)zBcQAG4b@?$BCEqcQWm3%!()9 z&g-F8ufY*{b5&BPTrBh_uFMoD?5R2pXnFLH)17}FBK?0Y&fuXj z|0va*LKQn|er#;O8ksJtM|kmV(FNzf-#63WAM@+%46k-{=K6QYXUl0Ej$;|%mo*)v W^S37@nEw$2Xx}&ZqvYP>KmQw^l9GP_ literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/sc-query-sense.png b/windows/keep-secure/images/sc-query-sense.png new file mode 100644 index 0000000000000000000000000000000000000000..0e537a3e96f2634e7692d1911efce55f375cf471 GIT binary patch literal 13934 zcmd^mcUY6#w`M#XE6oam6cG{W(u)aEIZ6kmcSL#(y@%*gKtVw%L0WQ95~TOg2}-Y# z-a&{EAq0dZlt97+&%M8U=H8j-nfYgCo@f3@zGUs4Z?C<|`>wTy)yMK&?!U2(fj^t5V4q_I=;9N++hsXSTSrOk zNsyK)eZrw6d}7~kw`_l*#&xH#bfo8&w3jOSAf+`Hl-nBHG}WIvsh(F8;xz1_Z0lxQ zFFr?m{+B#X=2TIHngLei&bNuq3feVy3p1Z_U3;Z*4xw zw+&h-+c?dfp|Te7#bN#e$38+2GFjIOV_JbUePQFSnoC4&UUZsaMCYfbAQJ|P0^Zmj zFs8b1D2*P3-IdRU^-mjxEX%;?nNl;(;Q33)^7S~rvObGuf6)W>*!4{+p0u||A})NE zvFP%kk#}iSDwVc-wMMWs(O-f`QFXS*qbGT?Ap35rv$Yg!#6v+cw6@c+d04hc&E=K- z8^X2r06npHmRvpt5q&$~T4Z%OvDw2&9AxjjMaFMEuOG8Ci&*t23d)^K2-Av9ocyzn zV=EbDC)GqZ<`5)@mIU@~2M!2Gs;TdOL^prUmP-X@$XV83msZ{He5@^ozaNNloJ(ct z1m2#QvYno9Xp(d5ot5e>6Ew4dv=LA-UJx5^SMLpHxj zP+4~1Q*pU%cpe`dA<9Y%lTlgTXR5DF06`3(eLK$_n>qQ&&~NWISUMvGnPV-o^C!W} z%g|>#KV|qUv8HSqnc-7{6x#id?({@x$R}v~kJoSKnup0t~n zY+x1-lDgn4Z^#Yb+RQ+^O;)H0<3+~n+fcF6Qi%WU+X<9X z?r^xIY9?^==JhaC%$3FLqL;rE8jhIy(CI=vzhqvv71#S)`9b_PNK#NjuzKC=M59S;augKNI)w&feX zVMlKSHEk}ln^s0^9D z``~+a(Sw)nl1ybqx2u3V39g+Pp;G4#ng+dIu8{uy)AtP%`)*tQZMXb9ZzaV><-qH6 z-5xj4iKLh$WQgzjn~;hp6oK@RiVu03%h^T0TqO~HWXm|j|GroU)Q^qW4N1hJps_zz zB4nvmiNqcwJH#5%I<0vnNC$$&%fqVIxMVmDISt8sdyI(yh5577+f`B)I!UxO<8{CN zvk?+eyfE6s*oe z85bw^nyskTRiBLZ31{qv_V;#ors=%Ozq1EKdM8G}2f&fAu<|MF4Z?7#H>cULg8W?QY(4%bz2Fg$L{(CHq+ zd-_B~OR;W+uV~oOBO}|2Cpb5pmSm+$U+Ws~OW+T#P1|{ogR<=$bPd9wMd^aB5gF!9 z-~r}3;r|f}c{_m_#e(+UY}i#Gy{NJ`)8Ndr0pSv0^80}*39)PX)mb8mDC_8L!>x&P zlf}6y)6>kX8Hiiy1eV%Y=T*Z3D{y(srmzw_uH3`#m|SZ?>wzTAiANK~gnVT71W!~$ zlMpk21|$9zMrx?MOrFBmZ_KZ>QssX9F(rIRan5OsOIF$~_O4!%z{%WR$SyK?y&~t> zZR-_~Q#;TkHaoLZrB_myNB0O%f9`D=AKF9z`8N_6m@%Enw4(}$9|`KJ&=XOrOxe4S zFzoX0LFc*b*LAoAN)WZh#~ug#QP8HuUtp{ypqp5OGO)%Rcj$G#AugXFIh~MO+r;r2 zcOM=qS|}Sng}eZFZp0F>?r9r*(hqopQ0~)G2CAYIC-Z}4+}tjv{< z*F_R^@AG_iy8A##5KvQoY}owI_suDUIi?E9;o+@3%R>RPMQOW@sA;bgQ**;~9*DKn z$`)3#w9jFunVwg}1W3`2DvITbP__@L-Tu72 zVn)S*RDcqh68v90;vG2pZme{F%A2=)>9_?@^Ajd3XEtFk^!6{=R)(ULO4yjPf&!aZh%(VM! zMi@QZp@a;4jR^~9-nRY65vKhUm412h66im~D1@}=C)4mjBV?~$>8mAbQe#mPEQy(% z+!dOQUFmb4=#BJt)Gs~>9;<)rvoL3NGs!1+8JCupXIOZ+Brl3S<9)Zcr@vucbI9IHXpbx%=478gg{wNyEQC`_c~tWHISRJ`?fV|^O5Z9(IL?Gfk4@Roe1+=UB`wP4K_w{*{< zQVmbPrMPiETUdA`iZ&HWCs)jQcpDnWnB+JmU6HW9rxu<0;H_8k*OcSzTMtv`VnD0j z=Gf(O7QL_+&Sr=_ca2)QUM#QDv6Gg+XKP=xoT&I6Bh{C2+Fi2p{mJe4wobGhnTy2_|qssp9?XLeO zWf<0H`7^Q+)l%lnDs+gdsxdJ&HtTv`yY^*OdFiwF{kSAMxz3Z&0u^U1jaR6YtCA5H z`%9ZGv;D7xm{_pOS!f-{lqQyW=@jY>FL(KORG^|!&!7U2UupVwYD@)?9%KYTH}j(3 zTGxD3!gDaS2<9CEjO|U9aR{-`Tu=P=KfENwQUYqt_+378$9$w$ zFDB*LG{E&LBpSG=o9{|4PE)_5y#j>#+kj($hSWZzN^jd9me*~ozpzrc&ViZp$SQ)ag5B4VhX+Sj^2 znJUTT`h|5Ou-_s(*~zEYnHj6U#gvNWE}gc{I^i^$_C?X-(GY~9y?by0(qO}_erKvu zw0`@dGS-fYL#B;4`Kfwy7Xm+>GCw?0+bzRw_6#)6@LZ3LpWnHuirG%tnW!k06 zNX>Dj5%>yc1K27s>65T)#40QP$Rvun$0E6p+}9*52=s2gohS-MGBr3m6!FMFsVkW< zN#+ot3PZ(`Z^U?ZF&0I#GRp$zr4IU!8n5W4;-c?CcpMsf+NR=WTFITsk)+l)LjGOs`wGg;oc& zS)@9^+zM*fN+&cvMSyy9u8nSUx(V7uB%~ z(_$HpuSl;YK{0*-HYkB!M{7JC!)ONF3%5|FwndD1PMNDqBSJYz@87D^bDqjFT~%^% zXtVmoOoymAiFgJUo;+ckc2oV;dATI`pPSkybRBAd%x(gZ+xN=-Z6T#b>5+QkCyQX;ATg#z~}5~cK2^3 zf2*-c^{_J-|A4oHFVjj1v4PDG zzc04GS8jSKUf|g)#EYjc*x;siF6({{I zj|5F8?l&(?QgvBs`h{!pLdBbJxAwfD(9x3XkUhpNYs}d=bNkGSdmjqdzLc62o^LVB zy}2S1;QmzWQXZT8&GL&^E?zgD{8$ze0$^ck8mbjhGOJZtBJy5L?piDsgrjtL zmihhv*^AS$1LAn8%d@v9e3Fj)CLUdmxFG{}fSl^&xf{=gkgt`;bU~3E1^^hT924${8@KjnLaWOd!N- z_9J&v;3(*Kk81eHRNh4gZ+U;ZnCn1t9JmQfcv{t^S2LD75ySYaYE7_M5e3jxB{&Fg zM&5dVznbNhYu#w9rx85J@fzp4zvm;V#I4JhM3kmX#Xb`2yCG8F{G(n~aqIRvS6;@2 zS>BU2L)8om&@m<8S@goE@7k>4k?vS{o@Z;ICyz_UNiSheMSC^G@0BmAeo~K*a%AjH zp6~th?TYpxW6-xEOa9r&A8Ggh{Ms!gHSJwMGRzPUcvA3CSf>}hS63wjnrG-G=RF82 z(t+fGro7EzJ;LqeiN#610pl8>nc&Q)__l{?I_c@0F@e?3rAm<-@Z-QT*S1x&Hu>$u z&=VbZfh_o|h-ZFhaV;tbY)Vh9h5U%~kH2p60ep@#9r>I&+_nQd0S&~4;jGGM(!kjl(FqV5l_YhUPWM=)xU3VQl*N2FBP=M{M^luYdg+) z-||pP3}V!ZCsy8oLL1T3HB~oygC;vKx1tzt5c5jQu(51#?sTX5bPnds<Z zx66|sH&mnRUp#sB={yd{i8BJW1;h=VZxw^tZWARsoJ#D6q<+7U7$$fQO%X@r72_cO z!Wu&gY9^ZB%cZ;~bXao+k|uuAg1jo$f@}2lQ>RO1+<#~muMF7ggIdE|nPR>|9x;Sa>fvy5m*XmDldKDQONj7gUU1E`NLSeaHxzqyqN5-dhY@ zRCgj)f*QDF5ysk31)>JUQg8{UZtu>f;M`utS_mee+Pro_H|={;SR5)nbO5)lVbW#s zmbEr3Z|V`6T%0l(jLr&^e7|iiv*Vo*X>ZIBN9d<9S6JM;bwMy7?UwoBm#VO!PQHD+ zsn-kHmvH7c$TMHE_E?lU$R$k4tPzmKLX+wBx1sQ_*-NT`nKS>Ev`4=FXE?lceauJP zw1M7GjdHm&Os!I(&VV=t&d52680Ko2nFM z2}`mrMa7T*9PJBveUfz^rf$rv2hYugoLwC(&Nm5JAI4=CFzdQWeIQYnc<``qyoB6}zm+@)l0qZV;Tr}fIKfZkfk*7vjeN--E1hi(! z2!FyEL|267g*Uz4s3{DU?o}6kze!*sB%7yZ27*&}d2~ZHWG~&9yU$}`ALqI%TP|~; zT8U8_N#3cZ*gX&3_2ZdOAUm|Eyd-S$M=-(h)Qt4M1qR*~U)OZQ(oC?|HOEvNOAl}y z#7|pOGb8vLV3Y%Rc4-Asdj)7#A28*-v}2m>LnuVdA5gA5pth0&$Y+Y%NEA!AAp9l} z7IoWpkiApIwSI28jT~64B3*bMCt`aqB1q4*is^A_H-NAhUgAd!2pUzw+tcRDjV{9c7dc`{e zv};&r+sHpv1W)`zu)m`^WJ4ASY?*z@?U{HFxM8c#T^m@e9>p{OzZ zA~pl2MhT?*P)S|nlq}r57sKz1pYlHa~!^U-XxR=UP1p_t%x)>^E4ys_e z#YS&xo2Cc9C~m2n&?b-;rQbk1sQl#EB3YdyB{8%WQe9b~xjYouu(TIE$fr9Kkup?x z*{;?Qh^t&L4;TF0L%^jYJ4b++5|w`Q^b#V2L9em8|Nx&DN^5(8JleW!gC5x6>m zP=iUqmOXE;j)No0odYeqdTm!Sp|@F~@n>Zqs4^7??oD>0-)=&%5z4vj6*>Yz5QXf4 zga!ok4eu%^Vd4Ndsce%r#)~F)=%VqqUGurf;p;Q?f(RsDV&dnWs?Y(~OvNTIYG+6@ z!U-)g>CCkq} zC)@$X(r^g`)iB@mk}J4Z=BdO38(7C{W-21yxb7JXR0uBIwSOW56r4McTTrc3JBu@= zyV|8K)8tEDkR2kFZ;usCD78J-``BIy+?NEpR|fRhoh8(i^N|0p8ap{V$$$F97gl7y6ph!x6=3ZOPzGL6)b@^G5&!YRSb#*@l331;#F;;tzHw}i?;jj zi9fL4wb)yqFbQ6-c~?sMNhPEbyIX?6ytqx?EhAtjP%NgGM#=7GlKjqeS40^-T&`?V zUwwYe+xY`m;e3RoNcD;Gk9(>$V+nyv%rSmK>(gIF(XR+S;)mA+f4eEJ?@GnlX z7sE=&vxG~)_}`)w5W@lZz*$9*#(;c4M!wg=>rnV~6AniWa$$~J`>L~D?v!dL8-S5) zYbXBANJpjh|A?iJ`0E0GZwL}M_c^oV*>u2FL~F>VX-^(319vNatM26rGqER6?^}GK z*iHsbuGajONDq7mUG!%;?9-^P#)&TDzyKDDH-rNov}BaQkI9dv47N(CJaE1jgU`Q2 z^FvjeZ;yRi@qB7Fu~gkX1r{>&;DuOI9KoGP&YbCbtMGlMsX>l$9%FiX?} z8tvF4XpHJ!bvM}_^Z(DS_wRkn|HQce zH-{6>b>ZkqO-`T(( zP$B+AqKA@SL#upM!fd8w|5rKZ?g>Z@!ekPtfpm+YyJG&}@Y@UPlI|P$D&h?0KL*I` z8o~d%gE9Jh#kVU4749+cXayERbm*0S+*epnA5d!LF)2Acci9{wR&LK0)_b-zQ`f4} zlwn485_9ey)-jW-QfRK@pJdhuoVjj-PiQxsm?2}XPfc+ z9cgQa-Kvf&wbT|J0YKJfO49a&|jc8BC81@9)o)sW;5X^ojJ?6O7|U zbE_?GRf~j$hjk}gbg6pF$eb%&EJwSEU+O6~SHwo%(wJvNU#oEA$!n;8c|T5VbEHGJ zvgm!tbF>)|;48py%oT<%d^<}=WWE;J{0`?sb$b&2tDS#lXYiYs3~o7kiK9Suwf|5`@NEW!Taq=$2lc96RYtV#H(ePt+ch6DyTrctYDR^&|2Sh~v}X19&8R}pOpML0 z3IIS*bB!@*g(`BI1tt**&wS3DA%E~({)~BXDKx70Rak`aBdbvgCLK}QEq&b?a|h*# z)k(c%hf!!TDU{zUynccA-IS9Ke-dTeBYJ4|k#}ZaO^tWf=)53B@AmA-Uz0Rzp$M_J z;>gvaD{4!euZ-@D>15th3_{ncm5#h?!)HuGda^baJX+sT0WE$5?{kK)jwG(cPCg|_ z+*{TDIDsclYo-giVz}!X5Bevm5Nn848aq_J>FJ^61VkLYTJd2v5k=X1v2o8Nnv2|d zK3T1JBqcfE9?g0ybvdM3#GSYp(@HA368JD1Y9*oh0ZmbZb(!)z^kGa0e@5f2rXaSi zT|rJDfNxfBQ;ePQ8waHqAS|k2NCHn-Ht`32Gu1$N4RI^iH}RYqEvuRm=6>Myk}9P{deppAmg>EbTjoq`(;%`*V^sH9m{(p7WQ z!VoLhm(wnBN;*E>ygQ1cTicSo#`mcu0rJMHfk=g_uEnuWC5;~RwJ74O0SSx|0H_R1 zZd`0FP%trf+?maUDfvpTy8`eIzXJL1z)R0@9s->?0ypkXHg-UZfb4(9yte-=9!!@H zq|#fLthtF05$Tm6e*^t_E?bzNpSCvZqdqPS|J25By`Y`w-dEnm1zHV7J4>FOByPY{ z_JQ=AUcD(D`LVv36q|nEW~1@pOC_!berr+O7VC@<^o3GwhF-&1s(CN7_2i0T^$fzg zEJ&U2Q7!Ld%bSB86;ifX3%5nQS~AJ59LIZ zev*;1xd>r3D#$Ur>aP;CxDjN_Wkf1t3hD)7f()&BoJlv|_WwaWgZ#L!R7FdwLt5rO zu|Hg~M(mcehmwhTRJrk(I|;SBQp}mR{bWb|#BB1qYr)LKz;uk>rM82h>`oegc(_kEV-+=%Z=jMN~D9n zU_M*;dq7a#SA(tTcTUkGQW&4Fij{xZ-gG&>3{C^58_o{(Y~N~n7EhWPL;O`DR&2>| z&$qI4GsNb63VA5GWM6c$R<-XdS@mmC^_sd=FLorVW7nBr)>p&chGSHQj z5=!Ur5f<$I1ug2V;SK|DDZ3&uy>a<*PVU6Dn5#?qoUI|>VD-Tz7*~TJP1J1Ic8Z+| z4}5CatE(U`LoeS1S)au*bJ67o@J?Vo#p8M$m-1s=hS*)gGj~vN2~Ll7ZSdy-yg;Y) zkGu_pJP9uj40jr))Ezv?E_yRN)`(HJ9H&cF2RKID$hjkeiqQ66H(BwDKu3=aafmxW zQc;25xNd2L2tOD@$#7g$W9VJxjQTV93#LI`|9I+9VU8%L!Rh#_aL6mu9}=V}Z|>1n z@nz08`3Xgyj0H^0HRJoNBpWYWQo)_KLwQM7#sf;zh_-Fl9{Bs4K&X0{Qe-7lpsac-kEEN8!=&b4V97NE~#+w%Sh`ngi0`f=A_JsBc#LmJHnk=oRp}_qwG5 z9DbRQANxHaZee+gK^=iGGgEtBc?I7SoWvh@&emvXWHyahm}id_%^1~}cHP*!5d3JV z)NBe}D~{_ff-?f9<2#95yrYGz=xU<@USK83(&KQ^ zPpT@1*F5INhN~FU7nuhrI>`rQZ{6ghb=<3UYv)2A%H}LnhYC5i zz@gf|Rv+C_*qr6KY8>Oirajp>VH7@dHY6!Y)X!el{2{lSRgI<3n}gBp-2tQLMBYp@ zNreJ#4s+eqCk`5)ih871>A72^!GZCQ-N{Sh@%4917jKeD+EU0ue=%q|C?{OPRLg_^bL@IOvOx92EUaN}*^rndL@M*i13 zY;tkjtRTz%$2+d+;kjp%Ml_=c4h8ZZZ0?Zfw6zGVVY(5Cq7>Oew$f;>J?`qgu%V5Q zHTn(LUEIF0LCer7f4y1vY110|w1D>3#kWL;n|t@5#e$wcL6=QmhggAslN!nG&(Cl- zg&S3N66;wkjYxl4Gz+%PL~$ns*CFcf^j$14+(Ji#RE{QEfJ!{LWv9Jp_acn8X7K&h z>=vJ#2aOoPHGbd)4$`VU#1MM5lIr%M)XKp&f9k@JC1UR2jmJ;|+_-rx|s;7vstXR7h#~yPYtC3V*EShtKPhz6BgulO*B;ApfyIi6lV=_WNc5VdIS z*7+pdwZv!;j+@LdL!07iCK$G2A!w$yb2ba3wBZc(Kr~^=1LvsGKpdN#Hmn4xG3LQ_7FDP5(o+V{G60852(Eo z0)ty?_T;Aj@n<7Sr{uws$t#gu;3zsOGFz^OYrDZs5$lsx_{6=@UI!vog*DthGu?2# zcsd~gG`Hc6am zHh({UPnWzLJX+l;g$m)Cn*ZB#qrNf&CV>u11F|`w&P<6$E0`6Yc_R#yC#*C(v@c)c z#*8@TxtwWr;SDN$k)?3@3SL?#yH_ehInzFbH&a%ms7kYI?0JNw%d|boVd2xFdLn4f z)M|1}{0oA3d%-Oq-5gg(%S^~O8=np^!2vFxEIs0j?qHWEbgs0bD=h>6D18TKabLq# zzwTByZ}%()Ubi<%U?xU59H-M@rS-OgHubkL{Jzl6 zlznW;Rcg#UoptZnw=e6VF$RvlS;yr0^F7tCDO)%GGy4a)SypT_*gkXWF^uQhVrhw<-L&)( z3>CDWSMNC)=dFcNm34`8Ng6Q<*LD5V%Cw|dwB`ZBBfJ4hjB;3GY}x%pZM_yN{u$;5 z*!MjGm?|8^y-L6IArg9mQm*p;0ny3*!Hk+QMmW;C#Flf<`2sRRJ#BkqR3&4rhTSXGHFO=E4t**W#uWhFf-8g1{&bV%mR(N21JHB|IKWk3j zdgD~X71KIT>KsxHZI#{23E&RK9d%v%OiKJ;>bm|ufcj@M=8F5e(2&as6WhY~m8x#r zOJq0yZi%IuhSno%7#FuRSIF7e;osihjg%IpP(9d zP!v?#{MBRo4h$;Y3GZ#}7|Uz4n&NTMoaS`9mP5%kKY;ub@|Uk~G4N zZWLh}i#(e(_JdG}zl!~n{5#Do475Sw*wWhQrX{D_341Yd^;PST63nPR;3@I;4m0A3 zB?7bKCl9I=4fW(=Q?ksEr9Wa?&a{1CGJ}i5*o7Q)zBcQAG4b@?$BCEqcQWm3%!()9 z&g-F8ufY*{b5&BPTrBh_uFMoD?5R2pXnFLH)17}FBK?0Y&fuXj z|0va*LKQn|er#;O8ksJtM|kmV(FNzf-#63WAM@+%46k-{=K6QYXUl0Ej$;|%mo*)v W^S37@nEw$2Xx}&ZqvYP>KmQw^l9GP_ literal 0 HcmV?d00001 diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index 91775b45fc..4763c3462f 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -18,23 +18,119 @@ author: mjcaparas You might need to troubleshoot the onboarding process if you encounter issues. -##Endpoints not reporting correctly +##Endpoints not reporting to the service correctly -If you have completed the endpoint onboarding process and don't see endpoints in the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md), then this might indicate endpoint onboarding or a connectivity issue that you need to address. +If you have completed the endpoint onboarding process and don't see endpoints in the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) after 20 minutes, it might indicate an endpoint onboarding or a connectivity problem. -Go through the following verification topics to address the issue: -- Ensure that the endpoint is onboarded successfully -- Ensure that the Windows Defender ATP service is enabled -- Ensure that the telemetry and diagnostics service is enabled [in] -- Ensure that the Windows Defender ATP endpoint has internet connection [in] +Go through the following verification topics to address this issue: +- [Ensure that the endpoint is onboarded successfully](#Ensure-that-the-endpoint-is-onboarded-successfully) +- [Ensure that the Windows Defender ATP service is enabled](#Ensure-that-the-Windows-Defender-ATP-service-is-enabled) +- [Ensure that the telemetry and diagnostics service is enabled](#Ensure-that-the-telemetry-and-diagnostics-service-is-enabled) +- [Ensure that the Windows Defender ATP endpoint has internet connection](#Ensure-that-the-Windows-Defender-ATP-endpoint-has-internet-connection) +###Ensure that the endpoint is onboarded successfully +If the endpoints aren't reporting correctly, you might need to check that the Windows Defender Advanced Threat Protection service was successfully onboarded on the endpoint. +**Check the onboarding state in Registry** +1. Click **Start**. + +2. Type **Run**. +3. From the **Run** dialog box, type **regedit** and press **Enter**. +4. In the **Registry Editor** navigate to the Status key under **HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Advanced Threat Protection**. -**Ensure that telemetry and diagnostics service is enabled** +5. Check that the **OnboardingState** value is set to **1**. + + ![Image of OnboardingState status in Registry Editor](images/onbaordingstate.png) + + If the **OnboardingState** value is not set to **1**, follow the instructions on **Identifying and addressing onboarding issues**. + +**Identifying and addressing onboarding errors** + +1. Click **Start**. + +2. Type **Event Viewer**. + +3. In **Event Viewer**, browse to the **Application and Services Logs\Microsoft\Windows\SENSE** directory. + +4. Click the **Operational** log. + +5. In the **Action** pane, click **Filter Current log**. + +6. Select **Critical**, **Warning**, and **Error**, then click **OK**. + + ![Image of Event Viewer log filter](images/filter-log.png) + +7. Review the remaining events which can indicate issues and troubleshoot them based on the corresponding solutions from the following table: + +Event ID | Message | Resolution steps +:---|:---|:--- +5 | Windows Advanced Threat Protection service failed to connect to the server at ```variable```| Ensure that the Windows Defender ATP endpoint has internet access. +6 | Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: ```variable```| Run the onboarding script again. +7 | Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: ```variable```| Ensure that the Windows Defender ATP endpoint has internet access, then run the onboarding script again. +15 | Windows Advanced Threat Protection cannot start command channel with URL: ```variable``` | Ensure that the Windows Defender ATP endpoint has internet access. + +###Ensure that the Windows Defender ATP service is enabled +If the endpoints aren't reporting correctly, you might need to check that the Windows 10 Windows Defender Advanced Threat Protection service is enabled on the endpoint. + +**Check the startup type from the command line** +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command and press **Enter**. + + ``` + sc qc sense + ``` + If the the service is running, then the result should look like the following screenshot: + + ![Result of the sq query sense command](images/sc-query-sense-autostart.png) + +3. If the service **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**: + + ``` + sc config sense start=auto + ``` +4. A success message is displayed. Verify the change by entering the following command and press **Enter**: + + ``` + sc qc sense + ``` + +**Check that the service is running from the command line** +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command and press **Enter**. + + ``` + sc query sense + ``` + If the service is running, the result should look like the following screenshot: + ![Result of the sc query sense command](images/sc-query-sense-running.png) + +3. If the service **STATE** is not set to **RUNNING**, then you'll need to enter the following command and press **Enter**: + + ``` + sc start sense + ``` + +4. A success message is displayed. Verify the change by entering the following command and press **Enter**: + + ``` + sc qc sense + ``` + +###Ensure that telemetry and diagnostics service is enabled If the endpoints aren't reporting correctly, you might need to check that the Windows 10 telemetry and diagnostics service is enabled on the endpoint. The service may have been disabled by other programs or user configuration changes. You will need to check the startup type and verify that the service is running. @@ -54,8 +150,7 @@ There are two ways to check the startup type for the service: from the command l ``` sc qc diagtrack ``` - -3. If the service is enabled, it will be set to automatically start. The result should look like the following: + If the service is enabled, then the result should look like the following screenshot: ![Result of the sc query command for diagtrack](images/windefatp-sc-qc-diagtrack.png) @@ -69,6 +164,7 @@ There are two ways to check the startup type for the service: from the command l ``` sc qc diagtrack ``` + **Check the startup type in the services console:** 1. Open the services console: @@ -94,11 +190,11 @@ ASK ALON HOW SET TO AUTOMATIC IF IT'S NOT SET FROM THE CONSOLE. ``` sc query diagtrack ``` -3. If the service is running, the result should look like the following: + If the service is running, the result should look like the following screenshot: ![Result of the sc query command for sc query diagtrack](images/windefatp-sc-query-diagtrack.png) -4. If the service **STATE** is not set to **RUNNING**, then you'll need to enter the following command and press **Enter**: +3. If the service **STATE** is not set to **RUNNING**, then you'll need to enter the following command and press **Enter**: ``` sc start diagtrack @@ -110,7 +206,7 @@ ASK ALON HOW SET TO AUTOMATIC IF IT'S NOT SET FROM THE CONSOLE. sc query diagtrack ``` -**Ensure that the Windows Defender ATP endpoint has internet connection** +###Ensure that the Windows Defender ATP endpoint has internet connection** The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to be able to report telemetry and communicate with the Windows Defender ATP service. From 486134f7849244d10f6888ddbbb59cb709e8e6e2 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 14:40:43 +1000 Subject: [PATCH 169/439] add configure proxy and internet connectivty settings in In this section for top level topic --- ...oxy-internet-windows-defender-advanced-threat-protection.md | 2 +- ...rd-configure-windows-defender-advanced-threat-protection.md | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md index 731eea65a8..91cc86bb64 100644 --- a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md @@ -20,7 +20,7 @@ author: mjcaparas The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report telemetry and communicate with the Windows Defender ATP service. -The embedded Windows Defender ATP sensor runs in system context using the LocalSystem account. The sensor uses Microsoft Windows HTTP Services (WinHTTP) to enable communication with the Windows Defender ATP cloud service. This is considered as the appropriate method of communication this type of usage scenario. +The embedded Windows Defender ATP sensor runs in system context using the LocalSystem account. The sensor uses Microsoft Windows HTTP Services (WinHTTP) to enable communication with the Windows Defender ATP cloud service. The WinHTTP configuration setting is independent of the Windows Internet (WinINet) internet browsing proxy settings and can only discover a proxy server by using the following discovery methods: diff --git a/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md b/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md index 5ca561a956..a9c306cc68 100644 --- a/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md @@ -32,6 +32,7 @@ Topic | Description :---|:--- [Service onboarding](service-onboarding-windows-defender-advanced-threat-protection.md) | Learn about managing user access to the Windows Defender ATP portal by assigning users to the Windows Defender ATP service application in Azure Active Directory (AAD). [Configure endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) | You'll need to configure endpoints for it to report to the Windows Defender ATP service. Learn how you can use the configuration package to configure endpoints in your enterprise. -[Additional configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md) | Learn how to configure settings for sample sharing used in the deep analysis feature. +[Configure proxy and Internet settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md)| Enable communication with the Windows Defender ATP cloud service by configuring the proxy and Internet connectivity settings. +[Additional configuration settings] (additional-configuration-windows-defender-advanced-threat-protection.md) | Learn how to configure settings for sample sharing used in the deep analysis feature. [Monitor onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) | Learn how you can monitor the onboarding to ensure your endpoints are correctly configured and are sending telemetry reports. [Troubleshoot onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) | Learn about resolving issues that might arise during onboarding. From 795fe9c38f9eb755aa2052d097cb96959a3cd922 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 14:50:10 +1000 Subject: [PATCH 170/439] edit spacing --- windows/keep-secure/other-troubleshooting.md | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index 4763c3462f..aa84ecf7ed 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -22,20 +22,13 @@ You might need to troubleshoot the onboarding process if you encounter issues. If you have completed the endpoint onboarding process and don't see endpoints in the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) after 20 minutes, it might indicate an endpoint onboarding or a connectivity problem. -Go through the following verification topics to address this issue: - -- [Ensure that the endpoint is onboarded successfully](#Ensure-that-the-endpoint-is-onboarded-successfully) -- [Ensure that the Windows Defender ATP service is enabled](#Ensure-that-the-Windows-Defender-ATP-service-is-enabled) -- [Ensure that the telemetry and diagnostics service is enabled](#Ensure-that-the-telemetry-and-diagnostics-service-is-enabled) -- [Ensure that the Windows Defender ATP endpoint has internet connection](#Ensure-that-the-Windows-Defender-ATP-endpoint-has-internet-connection) - -###Ensure that the endpoint is onboarded successfully +### Ensure that the endpoint is onboarded successfully If the endpoints aren't reporting correctly, you might need to check that the Windows Defender Advanced Threat Protection service was successfully onboarded on the endpoint. **Check the onboarding state in Registry** 1. Click **Start**. - + 2. Type **Run**. 3. From the **Run** dialog box, type **regedit** and press **Enter**. @@ -44,7 +37,7 @@ If the endpoints aren't reporting correctly, you might need to check that the Wi 5. Check that the **OnboardingState** value is set to **1**. - ![Image of OnboardingState status in Registry Editor](images/onbaordingstate.png) + ![Image of OnboardingState status in Registry Editor](images/onboardingstate.png) If the **OnboardingState** value is not set to **1**, follow the instructions on **Identifying and addressing onboarding issues**. @@ -73,10 +66,11 @@ Event ID | Message | Resolution steps 7 | Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: ```variable```| Ensure that the Windows Defender ATP endpoint has internet access, then run the onboarding script again. 15 | Windows Advanced Threat Protection cannot start command channel with URL: ```variable``` | Ensure that the Windows Defender ATP endpoint has internet access. -###Ensure that the Windows Defender ATP service is enabled +### Ensure that the Windows Defender ATP service is enabled If the endpoints aren't reporting correctly, you might need to check that the Windows 10 Windows Defender Advanced Threat Protection service is enabled on the endpoint. **Check the startup type from the command line** + 1. Open an elevated command-line prompt on the endpoint: a. Click **Start** and type **cmd**. @@ -104,6 +98,7 @@ If the endpoints aren't reporting correctly, you might need to check that the Wi ``` **Check that the service is running from the command line** + 1. Open an elevated command-line prompt on the endpoint: a. Click **Start** and type **cmd**. From 5f50a3a7b16e13e4af80ccf756b0b56859cc0eb6 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 14:53:53 +1000 Subject: [PATCH 171/439] fix header --- windows/keep-secure/other-troubleshooting.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index aa84ecf7ed..cde33adbfd 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -18,14 +18,14 @@ author: mjcaparas You might need to troubleshoot the onboarding process if you encounter issues. -##Endpoints not reporting to the service correctly +## Endpoints not reporting to the service correctly If you have completed the endpoint onboarding process and don't see endpoints in the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) after 20 minutes, it might indicate an endpoint onboarding or a connectivity problem. ### Ensure that the endpoint is onboarded successfully If the endpoints aren't reporting correctly, you might need to check that the Windows Defender Advanced Threat Protection service was successfully onboarded on the endpoint. -**Check the onboarding state in Registry** +**Check the onboarding state in Registry:** 1. Click **Start**. @@ -41,7 +41,7 @@ If the endpoints aren't reporting correctly, you might need to check that the Wi If the **OnboardingState** value is not set to **1**, follow the instructions on **Identifying and addressing onboarding issues**. -**Identifying and addressing onboarding errors** +**Identifying and addressing onboarding errors:** 1. Click **Start**. @@ -69,7 +69,7 @@ Event ID | Message | Resolution steps ### Ensure that the Windows Defender ATP service is enabled If the endpoints aren't reporting correctly, you might need to check that the Windows 10 Windows Defender Advanced Threat Protection service is enabled on the endpoint. -**Check the startup type from the command line** +**Check the startup type from the command line:** 1. Open an elevated command-line prompt on the endpoint: @@ -97,7 +97,7 @@ If the endpoints aren't reporting correctly, you might need to check that the Wi sc qc sense ``` -**Check that the service is running from the command line** +**Check that the service is running from the command line:** 1. Open an elevated command-line prompt on the endpoint: @@ -125,14 +125,14 @@ If the endpoints aren't reporting correctly, you might need to check that the Wi sc qc sense ``` -###Ensure that telemetry and diagnostics service is enabled +### Ensure that telemetry and diagnostics service is enabled If the endpoints aren't reporting correctly, you might need to check that the Windows 10 telemetry and diagnostics service is enabled on the endpoint. The service may have been disabled by other programs or user configuration changes. You will need to check the startup type and verify that the service is running. There are two ways to check the startup type for the service: from the command line or in the services console. -**Check the startup type from the command line**: +**Check the startup type from the command line:** 1. Open an elevated command-line prompt on the endpoint: @@ -201,7 +201,7 @@ ASK ALON HOW SET TO AUTOMATIC IF IT'S NOT SET FROM THE CONSOLE. sc query diagtrack ``` -###Ensure that the Windows Defender ATP endpoint has internet connection** +### Ensure that the Windows Defender ATP endpoint has internet connection The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to be able to report telemetry and communicate with the Windows Defender ATP service. From d18e17ec5fb01108705c7db8d540255c6198f8b1 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 14:56:18 +1000 Subject: [PATCH 172/439] fix --- windows/keep-secure/other-troubleshooting.md | 166 +------------------ 1 file changed, 4 insertions(+), 162 deletions(-) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index cde33adbfd..c3b5b6132a 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library author: mjcaparas --- -# Troubleshoot Windows Defender Advanced Threat Protection onboarding issues two +#Troubleshoot Windows Defender Advanced Threat Protection onboarding issues two **Applies to:** @@ -18,11 +18,11 @@ author: mjcaparas You might need to troubleshoot the onboarding process if you encounter issues. -## Endpoints not reporting to the service correctly +##Endpoints not reporting to the service correctly If you have completed the endpoint onboarding process and don't see endpoints in the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) after 20 minutes, it might indicate an endpoint onboarding or a connectivity problem. -### Ensure that the endpoint is onboarded successfully +###Ensure that the endpoint is onboarded successfully If the endpoints aren't reporting correctly, you might need to check that the Windows Defender Advanced Threat Protection service was successfully onboarded on the endpoint. **Check the onboarding state in Registry:** @@ -41,167 +41,9 @@ If the endpoints aren't reporting correctly, you might need to check that the Wi If the **OnboardingState** value is not set to **1**, follow the instructions on **Identifying and addressing onboarding issues**. -**Identifying and addressing onboarding errors:** -1. Click **Start**. - -2. Type **Event Viewer**. -3. In **Event Viewer**, browse to the **Application and Services Logs\Microsoft\Windows\SENSE** directory. - -4. Click the **Operational** log. - -5. In the **Action** pane, click **Filter Current log**. - -6. Select **Critical**, **Warning**, and **Error**, then click **OK**. - - ![Image of Event Viewer log filter](images/filter-log.png) - -7. Review the remaining events which can indicate issues and troubleshoot them based on the corresponding solutions from the following table: - -Event ID | Message | Resolution steps -:---|:---|:--- -5 | Windows Advanced Threat Protection service failed to connect to the server at ```variable```| Ensure that the Windows Defender ATP endpoint has internet access. -6 | Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: ```variable```| Run the onboarding script again. -7 | Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: ```variable```| Ensure that the Windows Defender ATP endpoint has internet access, then run the onboarding script again. -15 | Windows Advanced Threat Protection cannot start command channel with URL: ```variable``` | Ensure that the Windows Defender ATP endpoint has internet access. - -### Ensure that the Windows Defender ATP service is enabled -If the endpoints aren't reporting correctly, you might need to check that the Windows 10 Windows Defender Advanced Threat Protection service is enabled on the endpoint. - -**Check the startup type from the command line:** - -1. Open an elevated command-line prompt on the endpoint: - - a. Click **Start** and type **cmd**. - - b. Right-click **Command prompt** and select **Run as administrator**. - -2. Enter the following command and press **Enter**. - - ``` - sc qc sense - ``` - If the the service is running, then the result should look like the following screenshot: - - ![Result of the sq query sense command](images/sc-query-sense-autostart.png) - -3. If the service **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**: - - ``` - sc config sense start=auto - ``` -4. A success message is displayed. Verify the change by entering the following command and press **Enter**: - - ``` - sc qc sense - ``` - -**Check that the service is running from the command line:** - -1. Open an elevated command-line prompt on the endpoint: - - a. Click **Start** and type **cmd**. - - b. Right-click **Command prompt** and select **Run as administrator**. - -2. Enter the following command and press **Enter**. - - ``` - sc query sense - ``` - If the service is running, the result should look like the following screenshot: - ![Result of the sc query sense command](images/sc-query-sense-running.png) - -3. If the service **STATE** is not set to **RUNNING**, then you'll need to enter the following command and press **Enter**: - - ``` - sc start sense - ``` - -4. A success message is displayed. Verify the change by entering the following command and press **Enter**: - - ``` - sc qc sense - ``` - -### Ensure that telemetry and diagnostics service is enabled -If the endpoints aren't reporting correctly, you might need to check that the Windows 10 telemetry and diagnostics service is enabled on the endpoint. The service may have been disabled by other programs or user configuration changes. - -You will need to check the startup type and verify that the service is running. - -There are two ways to check the startup type for the service: from the command line or in the services console. - -**Check the startup type from the command line:** - -1. Open an elevated command-line prompt on the endpoint: - - a. Click **Start** and type **cmd**. - - b. Right-click **Command prompt** and select **Run as administrator**. - -2. Enter the following command and press **Enter**. - - ``` - sc qc diagtrack - ``` - If the service is enabled, then the result should look like the following screenshot: - - ![Result of the sc query command for diagtrack](images/windefatp-sc-qc-diagtrack.png) - -4. If the **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**: - - ``` - sc config diagtrack start=auto - ``` -5. A success message is displayed. Verify the change by entering the following command and press **Enter**: - - ``` - sc qc diagtrack - ``` - -**Check the startup type in the services console:** - -1. Open the services console: - - a. Click **Start** and type **services**. Press **Enter** to open the console. - -2. Scroll through the list of services until you find **Connected User Experiences and Telemetry**. - -3. Check the **Startup type** column - the service should be set as **Automatic**. - -ASK ALON HOW SET TO AUTOMATIC IF IT'S NOT SET FROM THE CONSOLE. - -**Check that the service is running from the command line** - -1. Open an elevated command-line prompt on the endpoint: - - a. Click **Start** and type **cmd**. - - b. Right-click **Command prompt** and select **Run as administrator**. - -2. Enter the following command and press **Enter**. - - ``` - sc query diagtrack - ``` - If the service is running, the result should look like the following screenshot: - - ![Result of the sc query command for sc query diagtrack](images/windefatp-sc-query-diagtrack.png) - -3. If the service **STATE** is not set to **RUNNING**, then you'll need to enter the following command and press **Enter**: - - ``` - sc start diagtrack - ``` - -5. A success message is displayed. Verify the change by entering the following command and press **Enter**: - - ``` - sc query diagtrack - ``` - -### Ensure that the Windows Defender ATP endpoint has internet connection +###Ensure that the Windows Defender ATP endpoint has internet connection The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to be able to report telemetry and communicate with the Windows Defender ATP service. From 03ce493f393716adc7176d4f1938798c61e6e2a3 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 15:04:42 +1000 Subject: [PATCH 173/439] change to ATP --- .../windows-defender-advanced-threat-protection.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/keep-secure/windows-defender-advanced-threat-protection.md b/windows/keep-secure/windows-defender-advanced-threat-protection.md index 0e2829f1c6..a258084d33 100644 --- a/windows/keep-secure/windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/windows-defender-advanced-threat-protection.md @@ -2,7 +2,7 @@ title: Windows Defender Advanced Threat Protection - Windows Defender description: Windows Defender Advanced Threat Protection is an enterprise security service that helps detect and respond to possible cybersecurity threats related to advanced persistent threats. keywords: introduction to Windows Defender Advanced Threat Protection, introduction to Windows Defender ATP, cybersecurity, advanced persistent threat, enterprise security -search.product: eADQiWindows 10XVcnh +search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library @@ -17,7 +17,7 @@ author: mjcaparas [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -Windows Defender Advanced Threat Protection (Windows Defender ATP) is a security service, built into Windows 10 that enables enterprise customers detect, investigate, and respond to advanced threats on their networks. +Windows Defender Advanced Threat Protection (Windows Defender ATP) is a security service, built into Windows 10 that enables enterprise customers detect, investigate, and respond to advanced threats on their networks. Windows Defender ATP uses the following combination of technology built into Windows 10 and Microsoft's robust cloud service: @@ -66,18 +66,18 @@ detect sophisticated cyber-attacks, providing: Finds the attacks that made it past all other defenses (post breach detection),provides actionable, correlated alerts for known and unknown adversaries trying to hide their activities on endpoints. - Rich timeline for forensic investigation and mitigation - + Easily investigate the scope of breach or suspected behaviors on any machine through a rich machine timeline. File, URLs, and network connection inventory across the network. Gain additional insight using deep collection and analysis (“detonation”) for any file or URLs. - + - Built in threat intel knowledge base - + Unparalleled threat optics provides actor details and intent context for every threat intel-based detection – combining first and third-party intelligence sources. ## In this section -Topic | Description +Topic | Description :---|:--- -[Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md) | This overview topic for IT professionals provides information on the minimum requirements to use Windows Defender Advanced Threat Protection such as network and data storage configuration, and endpoint hardware ans software requirements, and deployment channels. +[Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md) | This overview topic for IT professionals provides information on the minimum requirements to use Windows Defender ATP such as network and data storage configuration, and endpoint hardware ans software requirements, and deployment channels. [Onboard endpoints and set up access](onboard-configure-windows-defender-advanced-threat-protection.md) | You'll need to onboard and configure the Windows Defender ATP service and the endpoints in your network before you can use the service. Learn about how you can assign users to the Windows Defender ATP service in Azure Active Directory (AAD) and using a configuration package to configure endpoints. [Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md)| Learn about how Windows Defender ATP collects and handles information and where data is stored. [Portal overview](portal-overview-windows-defender-advanced-threat-protection.md) | Understand the main features of the service and how it leverages Microsoft technology to protect enterprise endpoints from sophisticated cyber attacks. From 7bb4676ab30746a4c0909c186785e91dcff27a9c Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 15:11:43 +1000 Subject: [PATCH 174/439] add \* --- ...ows-defender-advanced-threat-protection.md | 46 +++++++++---------- 1 file changed, 23 insertions(+), 23 deletions(-) diff --git a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md index 91cc86bb64..6d1e74276c 100644 --- a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md @@ -1,6 +1,6 @@ --- title: Configure Windows Defender ATP proxy and Internet connectivity settings -description: Configure the Windows Defender ATP proxy and internet settings to enable communication with the cloud service. +description: Configure the Windows Defender ATP proxy and internet settings to enable communication with the cloud service. keywords: configure, proxy, internet, internet connectivity, settings, proxy settings search.product: eADQiWindows 10XVcnh ms.prod: W10 @@ -18,9 +18,9 @@ author: mjcaparas [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report telemetry and communicate with the Windows Defender ATP service. +The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report telemetry and communicate with the Windows Defender ATP service. -The embedded Windows Defender ATP sensor runs in system context using the LocalSystem account. The sensor uses Microsoft Windows HTTP Services (WinHTTP) to enable communication with the Windows Defender ATP cloud service. +The embedded Windows Defender ATP sensor runs in system context using the LocalSystem account. The sensor uses Microsoft Windows HTTP Services (WinHTTP) to enable communication with the Windows Defender ATP cloud service. The WinHTTP configuration setting is independent of the Windows Internet (WinINet) internet browsing proxy settings and can only discover a proxy server by using the following discovery methods: @@ -39,15 +39,15 @@ Enable the **Automatically detect settings** option in the Windows Proxy setting 3. Select **Proxy**. 4. Verify that the **Automatically detect settings** option is set to On. - + ![Image showing the proxy settings configuration page](images/proxy-settings.png) 5. If the **Use setup script** or **Manual proxy setup** options are enabled then you will need to [configure proxy settings manually by using Netsh](#configure-proxy-server-manually-using-netsh) method for WinHTTP to discover the appropriate proxy settings and connect. -## Configure the proxy server manually using Netsh +## Configure the proxy server manually using Netsh If **Use setup script** or **Manual proxy setup** settings are configured in the Windows Proxy setting, then endpoints will not be discovered by WinHTTP. -Use Netsh to configure the proxy settings to enable connectivity. +Use Netsh to configure the proxy settings to enable connectivity. You can configure the endpoint by using any of these methods: @@ -70,36 +70,36 @@ After configuring the endpoints, you'll need to verify that the correct proxy se netsh winhttp import proxy source=ie ``` An output showing the applied WinHTTP proxy settings is displayed. - - + + **Configure the proxy settings manually to WinHTTP** - + 1. Open an elevated command-line prompt on the endpoint: a. Click **Start** and type **cmd**. b. Right-click **Command prompt** and select **Run as administrator**. - + 2. Enter the following command and press **Enter**: - + ``` proxy [proxy-server=] ProxyServerName:PortNumber ``` - Replace *ProxyServerName* with the fully qualified domain name of the proxy server. - + Replace *ProxyServerName* with the fully qualified domain name of the proxy server. + Replace *PortNumber* with the port number that you want to configure the proxy server with. - + An output showing the applied WinHTTP proxy settings is displayed. - + **Verify that the correct proxy settings were applied** - + 1. Open an elevated command-line prompt on the endpoint: a. Click **Start** and type **cmd**. b. Right-click **Command prompt** and select **Run as administrator**. - + 2. Enter the following command and press **Enter**: ``` @@ -120,7 +120,7 @@ If a proxy or firewall is blocking all traffic by default and allowing only spec - sevillegwneu.microsoft.com - www.microsoft.com - crl.microsoft.com -- *.blob.core.windows.net +- \*.blob.core.windows.net If a proxy or firewall is blocking anonymous traffic, as Windows Defender ATP sensor is connecting from system context, make sure anonymous traffic is permitted to the above listed URLs. @@ -132,15 +132,15 @@ Verify the proxy configuration completed successfully, that WinHTTP can discover - [Download PsTools Suite](https://technet.microsoft.com/en-us/sysinternals/bb896649) - [Download PortQry Command Line Port Scanner Version 2.0 utility](https://www.microsoft.com/en-us/download/details.aspx?id=17148) - + 2. Extract the contents of **PsTools** and **PortQry** to a directory on the computer hard drive. 3. Open an elevated command-line: - + a. Click **Start** and type **cmd**. b. Right-click **Command prompt** and select **Run as administrator**. - + 4. Enter the following command and press **Enter**: ``` @@ -156,7 +156,7 @@ Verify the proxy configuration completed successfully, that WinHTTP can discover ``` Replace *HardDrivePath* with the path where the PortQry utility was extracted to: ![Image showing the command line](images/portqry.png) - + 6. Verify that the output shows that the name is **resolved** and connection status is **listening**. 7. Repeat the same steps for the remaining URLs with the following arguments: @@ -171,4 +171,4 @@ Verify the proxy configuration completed successfully, that WinHTTP can discover 8. Verify that each URL shows that the name is **resolved** and the connection status is **listening**. -If the any of the verification steps indicate a fail, then verify that you have performed the proxy configuration steps to enable server discovery and access to the service URLs. +If the any of the verification steps indicate a fail, then verify that you have performed the proxy configuration steps to enable server discovery and access to the service URLs. From 130b25875f6ffa8b772785fef75281c3ec1da790 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 15:12:49 +1000 Subject: [PATCH 175/439] add space --- windows/keep-secure/other-troubleshooting.md | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index c3b5b6132a..66eae361c4 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library author: mjcaparas --- -#Troubleshoot Windows Defender Advanced Threat Protection onboarding issues two +# Troubleshoot Windows Defender Advanced Threat Protection onboarding issues two **Applies to:** @@ -18,11 +18,11 @@ author: mjcaparas You might need to troubleshoot the onboarding process if you encounter issues. -##Endpoints not reporting to the service correctly +## Endpoints not reporting to the service correctly If you have completed the endpoint onboarding process and don't see endpoints in the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) after 20 minutes, it might indicate an endpoint onboarding or a connectivity problem. -###Ensure that the endpoint is onboarded successfully +### Ensure that the endpoint is onboarded successfully If the endpoints aren't reporting correctly, you might need to check that the Windows Defender Advanced Threat Protection service was successfully onboarded on the endpoint. **Check the onboarding state in Registry:** @@ -42,8 +42,7 @@ If the endpoints aren't reporting correctly, you might need to check that the Wi If the **OnboardingState** value is not set to **1**, follow the instructions on **Identifying and addressing onboarding issues**. - -###Ensure that the Windows Defender ATP endpoint has internet connection +### Ensure that the Windows Defender ATP endpoint has internet connection The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to be able to report telemetry and communicate with the Windows Defender ATP service. From 28681d7bb24cc91fd7218e2b8ddc98a27e2bfe44 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 15:23:17 +1000 Subject: [PATCH 176/439] remove topics to fix error --- windows/keep-secure/other-troubleshooting.md | 19 ------------------- 1 file changed, 19 deletions(-) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index 66eae361c4..709af442ea 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -22,25 +22,6 @@ You might need to troubleshoot the onboarding process if you encounter issues. If you have completed the endpoint onboarding process and don't see endpoints in the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) after 20 minutes, it might indicate an endpoint onboarding or a connectivity problem. -### Ensure that the endpoint is onboarded successfully -If the endpoints aren't reporting correctly, you might need to check that the Windows Defender Advanced Threat Protection service was successfully onboarded on the endpoint. - -**Check the onboarding state in Registry:** - -1. Click **Start**. - -2. Type **Run**. - -3. From the **Run** dialog box, type **regedit** and press **Enter**. - -4. In the **Registry Editor** navigate to the Status key under **HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Advanced Threat Protection**. - -5. Check that the **OnboardingState** value is set to **1**. - - ![Image of OnboardingState status in Registry Editor](images/onboardingstate.png) - - If the **OnboardingState** value is not set to **1**, follow the instructions on **Identifying and addressing onboarding issues**. - ### Ensure that the Windows Defender ATP endpoint has internet connection From ca45cc167d74f3dbc89f4f307297723bc51ae988 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Mon, 9 May 2016 15:30:05 +1000 Subject: [PATCH 177/439] Update other-troubleshooting.md --- windows/keep-secure/other-troubleshooting.md | 11 ----------- 1 file changed, 11 deletions(-) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index 709af442ea..40d977c140 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -23,14 +23,3 @@ You might need to troubleshoot the onboarding process if you encounter issues. If you have completed the endpoint onboarding process and don't see endpoints in the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) after 20 minutes, it might indicate an endpoint onboarding or a connectivity problem. -### Ensure that the Windows Defender ATP endpoint has internet connection - -The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to be able to report telemetry and communicate with the Windows Defender ATP service. - -WinHTTP is independent of the Internet browsing proxy settings and other user context applications and must be able to detect the proxy servers that are available in your particular environment. - -To ensure that sensor has service connectivity, follow the steps described in the [Verify client connectivity to Windows Defender ATP service URLs](configure-proxy-internet-windows-defender-advanced-threat-protection.md# -Verify-client-connectivity-to-Windows-Defender-ATP-service-URLs) topic. - -If the verification fails and your environment is using a proxy to connect to the internet, then follow the steps described in [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md#) topic. - \ No newline at end of file From c467c8d194b056b3c579197af4090a1f97a1d229 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 15:34:51 +1000 Subject: [PATCH 178/439] edits based on raviv n tomer comments --- .../windows-defender-advanced-threat-protection.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/windows-defender-advanced-threat-protection.md b/windows/keep-secure/windows-defender-advanced-threat-protection.md index a258084d33..bd5c2ebc70 100644 --- a/windows/keep-secure/windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/windows-defender-advanced-threat-protection.md @@ -24,8 +24,8 @@ Windows Defender ATP uses the following combination of technology built into Win - **Endpoint behavioral sensors**: Embedded in Windows 10, these sensors collect and process behavioral signals from the operating system (for example, process, registry, file, and network communications) - and sends this telemetry to your Azure Active Directory (AAD) - subscription. + and sends this telemetry to your private, isolated, cloud instance of Windows Defender ATP. + - **Cloud security analytics**: Leveraging big-data, machine-learning, and unique Microsoft optics across the Windows ecosystem (such as the From a1fb2c35989d072232aa26fdd35b9a61b929d8c1 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 15:36:19 +1000 Subject: [PATCH 179/439] edit meta title --- windows/keep-secure/other-troubleshooting.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index 40d977c140..d3db9b3f80 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -1,6 +1,6 @@ --- -title: troubleshoot -description: troubleshoot +title: troubleshoot Windows Defender Advanced Threat Protection onboarding issues two +description: Troubleshoot Windows Defender Advanced Threat Protection onboarding issues keywords: troubleshoot search.product: eADQiWindows 10XVcnh ms.prod: W10 @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library author: mjcaparas --- + # Troubleshoot Windows Defender Advanced Threat Protection onboarding issues two **Applies to:** From 145da36b353505d30d786808b27ad5e7f094efa9 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 15:46:42 +1000 Subject: [PATCH 180/439] add section1 --- windows/keep-secure/other-troubleshooting.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index d3db9b3f80..dc659813ff 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -23,4 +23,5 @@ You might need to troubleshoot the onboarding process if you encounter issues. If you have completed the endpoint onboarding process and don't see endpoints in the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) after 20 minutes, it might indicate an endpoint onboarding or a connectivity problem. - +### Ensure that the endpoint is onboarded successfully +If the endpoints aren't reporting correctly, you might need to check that the Windows Defender Advanced Threat Protection service was successfully onboarded on the endpoint. From 68792d4bb74359775f84895e0f15c85144969148 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Mon, 9 May 2016 15:56:03 +1000 Subject: [PATCH 181/439] Update other-troubleshooting.md --- windows/keep-secure/other-troubleshooting.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index dc659813ff..2d51679efe 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -25,3 +25,19 @@ If you have completed the endpoint onboarding process and don't see endpoints in ### Ensure that the endpoint is onboarded successfully If the endpoints aren't reporting correctly, you might need to check that the Windows Defender Advanced Threat Protection service was successfully onboarded on the endpoint. + +**Check the onboarding state in Registry**: + +1. Click **Start**. + +2. Type **Run**. + +3. From the **Run** dialog box, type **regedit** and press **Enter**. + +4. In the **Registry Editor** navigate to the Status key under **HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Advanced Threat Protection**. + +5. Check that the **OnboardingState** value is set to **1**. + + ![Image of OnboardingState status in Registry Editor](images/onboardingstate.png) + + If the **OnboardingState** value is not set to **1**, follow the instructions on **Identifying and addressing onboarding issues**. From 1ee6c12ea21e13957a8d6e0ab1bcb4041c4900bc Mon Sep 17 00:00:00 2001 From: jcaparas Date: Mon, 9 May 2016 16:17:32 +1000 Subject: [PATCH 182/439] Update other-troubleshooting.md --- windows/keep-secure/other-troubleshooting.md | 60 ++++++++++++++++++++ 1 file changed, 60 insertions(+) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index 2d51679efe..0a0883e259 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -23,6 +23,13 @@ You might need to troubleshoot the onboarding process if you encounter issues. If you have completed the endpoint onboarding process and don't see endpoints in the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) after 20 minutes, it might indicate an endpoint onboarding or a connectivity problem. +Go through the following verification topics to address this issue: + +- [Ensure that the endpoint is onboarded successfully](#Ensure-that-the-endpoint-is-onboarded-successfully) +- [Ensure that the Windows Defender ATP service is enabled](#Ensure-that-the-Windows-Defender-ATP-service-is-enabled) +- [Ensure that the telemetry and diagnostics service is enabled](#Ensure-that-the-telemetry-and-diagnostics-service-is-enabled) +- [Ensure that the Windows Defender ATP endpoint has internet connection](#Ensure-that-the-Windows-Defender-ATP-endpoint-has-internet-connection) + ### Ensure that the endpoint is onboarded successfully If the endpoints aren't reporting correctly, you might need to check that the Windows Defender Advanced Threat Protection service was successfully onboarded on the endpoint. @@ -41,3 +48,56 @@ If the endpoints aren't reporting correctly, you might need to check that the Wi ![Image of OnboardingState status in Registry Editor](images/onboardingstate.png) If the **OnboardingState** value is not set to **1**, follow the instructions on **Identifying and addressing onboarding issues**. + +**Identifying and addressing onboarding errors:** + +1. Click **Start**. + +2. Type **Event Viewer**. + +3. In **Event Viewer**, browse to the **Application and Services Logs\Microsoft\Windows\SENSE** directory. + +4. Click the **Operational** log. + +5. In the **Action** pane, click **Filter Current log**. + +6. Select **Critical**, **Warning**, and **Error**, then click **OK**. + + ![Image of Event Viewer log filter](images/filter-log.png) + +7. Review the remaining events which can indicate issues and troubleshoot them based on the corresponding solutions from the following table: + +Event ID | Message | Resolution steps +:---|:---|:--- +5 | Windows Advanced Threat Protection service failed to connect to the server at ```variable```| Ensure that the Windows Defender ATP endpoint has internet access. +6 | Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: ```variable```| Run the onboarding script again. +7 | Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: ```variable```| Ensure that the Windows Defender ATP endpoint has internet access, then run the onboarding script again. +15 | Windows Advanced Threat Protection cannot start command channel with URL: ```variable``` | Ensure that the Windows Defender ATP endpoint has internet access. + +### Ensure that the Windows Defender ATP service is enabled +If the endpoints aren't reporting correctly, you might need to check that the Windows 10 Windows Defender Advanced Threat Protection service is enabled on the endpoint. + +**Check the startup type from the command line:** + +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start** and type **cmd**. + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command and press **Enter**: + ``` + sc qc sense + ``` + If the the service is running, then the result should look like the following screenshot: + + ![Result of the sq query sense command](images/sc-query-sense-autostart.png) + +3. If the service **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**: + ``` + sc config sense start=auto + ``` +4. A success message is displayed. Verify the change by entering the following command and press **Enter**: + + ``` + sc qc sense + ``` From 6f5dfb67d584909f4cb2d44d87057ef03eded15b Mon Sep 17 00:00:00 2001 From: jcaparas Date: Mon, 9 May 2016 16:21:41 +1000 Subject: [PATCH 183/439] Update other-troubleshooting.md --- windows/keep-secure/other-troubleshooting.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index 0a0883e259..4dc9a484ea 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -82,6 +82,7 @@ If the endpoints aren't reporting correctly, you might need to check that the Wi 1. Open an elevated command-line prompt on the endpoint: a. Click **Start** and type **cmd**. + b. Right-click **Command prompt** and select **Run as administrator**. 2. Enter the following command and press **Enter**: From 20900f39c4061f0e8af79154093643ce1227b6c4 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Mon, 9 May 2016 16:26:29 +1000 Subject: [PATCH 184/439] Update other-troubleshooting.md --- windows/keep-secure/other-troubleshooting.md | 104 +++++++++++++++++++ 1 file changed, 104 insertions(+) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index 4dc9a484ea..124db33fce 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -102,3 +102,107 @@ If the endpoints aren't reporting correctly, you might need to check that the Wi ``` sc qc sense ``` +**Check that the service is running from the command line:** + +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command and press **Enter**. + ``` + sc query sense + ``` + If the service is running, the result should look like the following screenshot: + ![Result of the sc query sense command](images/sc-query-sense-running.png) + +3. If the service **STATE** is not set to **RUNNING**, then you'll need to enter the following command and press **Enter**: + ``` + sc start sense + ``` +4. A success message is displayed. Verify the change by entering the following command and press **Enter**: + ``` + sc qc sense + ``` +### Ensure that telemetry and diagnostics service is enabled +If the endpoints aren't reporting correctly, you might need to check that the Windows 10 telemetry and diagnostics service is enabled on the endpoint. The service may have been disabled by other programs or user configuration changes. + +You will need to check the startup type and verify that the service is running. + +There are two ways to check the startup type for the service: from the command line or in the services console. + +**Check the startup type from the command line:** + +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command and press **Enter**. + ``` + sc qc diagtrack + ``` + If the service is enabled, then the result should look like the following screenshot: + + ![Result of the sc query command for diagtrack](images/windefatp-sc-qc-diagtrack.png) + +4. If the **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**: + ``` + sc config diagtrack start=auto + ``` +5. A success message is displayed. Verify the change by entering the following command and press **Enter**: + ``` + sc qc diagtrack + ``` + +**Check the startup type in the services console:** + +1. Open the services console: + + a. Click **Start** and type **services**. + + b. Press **Enter** to open the console. + +2. Scroll through the list of services until you find **Connected User Experiences and Telemetry**. + +3. Check the **Startup type** column - the service should be set as **Automatic**. + +ASK ALON HOW SET TO AUTOMATIC IF IT'S NOT SET FROM THE CONSOLE. + +**Check that the service is running from the command line** + +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command and press **Enter**. + ``` + sc query diagtrack + ``` + If the service is running, the result should look like the following screenshot: + + ![Result of the sc query command for sc query diagtrack](images/windefatp-sc-query-diagtrack.png) + +3. If the service **STATE** is not set to **RUNNING**, then you'll need to enter the following command and press **Enter**: + ``` + sc start diagtrack + ``` +4. A success message is displayed. Verify the change by entering the following command and press **Enter**: + ``` + sc query diagtrack + ``` + +### Ensure that the Windows Defender ATP endpoint has internet connection + +The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to be able to report telemetry and communicate with the Windows Defender ATP service. + +WinHTTP is independent of the Internet browsing proxy settings and other user context applications and must be able to detect the proxy servers that are available in your particular environment. + +To ensure that sensor has service connectivity, follow the steps described in the [Verify client connectivity to Windows Defender ATP service URLs](configure-proxy-internet-windows-defender-advanced-threat-protection.md# +Verify-client-connectivity-to-Windows-Defender-ATP-service-URLs) topic. + +If the verification fails and your environment is using a proxy to connect to the internet, then follow the steps described in [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md#) topic. From b3e4c14a26402e671d625a3f1a85f5db66256a6c Mon Sep 17 00:00:00 2001 From: jcaparas Date: Mon, 9 May 2016 16:28:43 +1000 Subject: [PATCH 185/439] Update other-troubleshooting.md --- windows/keep-secure/other-troubleshooting.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index 124db33fce..d27dfcbced 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -102,6 +102,7 @@ If the endpoints aren't reporting correctly, you might need to check that the Wi ``` sc qc sense ``` + **Check that the service is running from the command line:** 1. Open an elevated command-line prompt on the endpoint: @@ -125,6 +126,7 @@ If the endpoints aren't reporting correctly, you might need to check that the Wi ``` sc qc sense ``` + ### Ensure that telemetry and diagnostics service is enabled If the endpoints aren't reporting correctly, you might need to check that the Windows 10 telemetry and diagnostics service is enabled on the endpoint. The service may have been disabled by other programs or user configuration changes. @@ -161,9 +163,9 @@ There are two ways to check the startup type for the service: from the command l 1. Open the services console: - a. Click **Start** and type **services**. - - b. Press **Enter** to open the console. + a. Click **Start** and type **services**. + + b. Press **Enter** to open the console. 2. Scroll through the list of services until you find **Connected User Experiences and Telemetry**. From 7c76c570c7af9b9990fd86384763bb201dcb6413 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Mon, 9 May 2016 16:34:58 +1000 Subject: [PATCH 186/439] Update other-troubleshooting.md --- windows/keep-secure/other-troubleshooting.md | 50 ++++++++++---------- 1 file changed, 25 insertions(+), 25 deletions(-) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index d27dfcbced..fadf6fb93d 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -86,22 +86,21 @@ If the endpoints aren't reporting correctly, you might need to check that the Wi b. Right-click **Command prompt** and select **Run as administrator**. 2. Enter the following command and press **Enter**: - ``` + sc qc sense - ``` + If the the service is running, then the result should look like the following screenshot: ![Result of the sq query sense command](images/sc-query-sense-autostart.png) 3. If the service **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**: - ``` + sc config sense start=auto - ``` + 4. A success message is displayed. Verify the change by entering the following command and press **Enter**: - - ``` + sc qc sense - ``` + **Check that the service is running from the command line:** @@ -112,20 +111,20 @@ If the endpoints aren't reporting correctly, you might need to check that the Wi b. Right-click **Command prompt** and select **Run as administrator**. 2. Enter the following command and press **Enter**. - ``` + sc query sense - ``` + If the service is running, the result should look like the following screenshot: ![Result of the sc query sense command](images/sc-query-sense-running.png) 3. If the service **STATE** is not set to **RUNNING**, then you'll need to enter the following command and press **Enter**: - ``` + sc start sense - ``` + 4. A success message is displayed. Verify the change by entering the following command and press **Enter**: - ``` + sc qc sense - ``` + ### Ensure that telemetry and diagnostics service is enabled If the endpoints aren't reporting correctly, you might need to check that the Windows 10 telemetry and diagnostics service is enabled on the endpoint. The service may have been disabled by other programs or user configuration changes. @@ -143,21 +142,21 @@ There are two ways to check the startup type for the service: from the command l b. Right-click **Command prompt** and select **Run as administrator**. 2. Enter the following command and press **Enter**. - ``` + sc qc diagtrack - ``` + If the service is enabled, then the result should look like the following screenshot: ![Result of the sc query command for diagtrack](images/windefatp-sc-qc-diagtrack.png) 4. If the **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**: - ``` + sc config diagtrack start=auto - ``` + 5. A success message is displayed. Verify the change by entering the following command and press **Enter**: - ``` + sc qc diagtrack - ``` + **Check the startup type in the services console:** @@ -182,21 +181,22 @@ ASK ALON HOW SET TO AUTOMATIC IF IT'S NOT SET FROM THE CONSOLE. b. Right-click **Command prompt** and select **Run as administrator**. 2. Enter the following command and press **Enter**. - ``` + sc query diagtrack - ``` + If the service is running, the result should look like the following screenshot: ![Result of the sc query command for sc query diagtrack](images/windefatp-sc-query-diagtrack.png) 3. If the service **STATE** is not set to **RUNNING**, then you'll need to enter the following command and press **Enter**: - ``` + sc start diagtrack - ``` + 4. A success message is displayed. Verify the change by entering the following command and press **Enter**: - ``` + + sc query diagtrack - ``` + ### Ensure that the Windows Defender ATP endpoint has internet connection From 06818984c645cfa95af456f32a5754f94d638468 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Mon, 9 May 2016 16:48:12 +1000 Subject: [PATCH 187/439] Update other-troubleshooting.md --- windows/keep-secure/other-troubleshooting.md | 68 ++++++++++---------- 1 file changed, 35 insertions(+), 33 deletions(-) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index fadf6fb93d..d3bb355913 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -69,10 +69,10 @@ If the endpoints aren't reporting correctly, you might need to check that the Wi Event ID | Message | Resolution steps :---|:---|:--- -5 | Windows Advanced Threat Protection service failed to connect to the server at ```variable```| Ensure that the Windows Defender ATP endpoint has internet access. -6 | Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: ```variable```| Run the onboarding script again. -7 | Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: ```variable```| Ensure that the Windows Defender ATP endpoint has internet access, then run the onboarding script again. -15 | Windows Advanced Threat Protection cannot start command channel with URL: ```variable``` | Ensure that the Windows Defender ATP endpoint has internet access. +5 | Windows Advanced Threat Protection service failed to connect to the server at _variable_| Ensure that the Windows Defender ATP endpoint has internet access. +6 | Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: _variable_ | Run the onboarding script again. +7 | Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: _variable_| Ensure that the Windows Defender ATP endpoint has internet access, then run the onboarding script again. +15 | Windows Advanced Threat Protection cannot start command channel with URL: _variable_ | Ensure that the Windows Defender ATP endpoint has internet access. ### Ensure that the Windows Defender ATP service is enabled If the endpoints aren't reporting correctly, you might need to check that the Windows 10 Windows Defender Advanced Threat Protection service is enabled on the endpoint. @@ -86,21 +86,22 @@ If the endpoints aren't reporting correctly, you might need to check that the Wi b. Right-click **Command prompt** and select **Run as administrator**. 2. Enter the following command and press **Enter**: - - sc qc sense - +``` +sc qc sense +``` If the the service is running, then the result should look like the following screenshot: ![Result of the sq query sense command](images/sc-query-sense-autostart.png) 3. If the service **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**: - - sc config sense start=auto - +``` +sc config sense start=auto +``` + 4. A success message is displayed. Verify the change by entering the following command and press **Enter**: - - sc qc sense - +``` +sc qc sense +``` **Check that the service is running from the command line:** @@ -118,13 +119,14 @@ If the endpoints aren't reporting correctly, you might need to check that the Wi ![Result of the sc query sense command](images/sc-query-sense-running.png) 3. If the service **STATE** is not set to **RUNNING**, then you'll need to enter the following command and press **Enter**: - - sc start sense +``` +sc start sense +``` 4. A success message is displayed. Verify the change by entering the following command and press **Enter**: - - sc qc sense - +``` +sc qc sense +``` ### Ensure that telemetry and diagnostics service is enabled If the endpoints aren't reporting correctly, you might need to check that the Windows 10 telemetry and diagnostics service is enabled on the endpoint. The service may have been disabled by other programs or user configuration changes. @@ -142,21 +144,23 @@ There are two ways to check the startup type for the service: from the command l b. Right-click **Command prompt** and select **Run as administrator**. 2. Enter the following command and press **Enter**. - - sc qc diagtrack +``` +sc qc diagtrack +``` If the service is enabled, then the result should look like the following screenshot: ![Result of the sc query command for diagtrack](images/windefatp-sc-qc-diagtrack.png) 4. If the **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**: - - sc config diagtrack start=auto +``` +sc config diagtrack start=auto +``` 5. A success message is displayed. Verify the change by entering the following command and press **Enter**: - - sc qc diagtrack - +``` +sc qc diagtrack +``` **Check the startup type in the services console:** @@ -181,23 +185,21 @@ ASK ALON HOW SET TO AUTOMATIC IF IT'S NOT SET FROM THE CONSOLE. b. Right-click **Command prompt** and select **Run as administrator**. 2. Enter the following command and press **Enter**. - - sc query diagtrack - +``` +sc query diagtrack +``` If the service is running, the result should look like the following screenshot: ![Result of the sc query command for sc query diagtrack](images/windefatp-sc-query-diagtrack.png) 3. If the service **STATE** is not set to **RUNNING**, then you'll need to enter the following command and press **Enter**: +``` +sc start diagtrack +``` - sc start diagtrack - 4. A success message is displayed. Verify the change by entering the following command and press **Enter**: - - sc query diagtrack - ### Ensure that the Windows Defender ATP endpoint has internet connection The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to be able to report telemetry and communicate with the Windows Defender ATP service. From 31cb523531ed5cc2513a940f14ba065334a21cac Mon Sep 17 00:00:00 2001 From: jcaparas Date: Mon, 9 May 2016 16:52:31 +1000 Subject: [PATCH 188/439] Update other-troubleshooting.md --- windows/keep-secure/other-troubleshooting.md | 9 --------- 1 file changed, 9 deletions(-) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index d3bb355913..b8ec1c80a7 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -92,12 +92,10 @@ sc qc sense If the the service is running, then the result should look like the following screenshot: ![Result of the sq query sense command](images/sc-query-sense-autostart.png) - 3. If the service **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**: ``` sc config sense start=auto ``` - 4. A success message is displayed. Verify the change by entering the following command and press **Enter**: ``` sc qc sense @@ -117,12 +115,10 @@ sc qc sense If the service is running, the result should look like the following screenshot: ![Result of the sc query sense command](images/sc-query-sense-running.png) - 3. If the service **STATE** is not set to **RUNNING**, then you'll need to enter the following command and press **Enter**: ``` sc start sense ``` - 4. A success message is displayed. Verify the change by entering the following command and press **Enter**: ``` sc qc sense @@ -147,16 +143,13 @@ There are two ways to check the startup type for the service: from the command l ``` sc qc diagtrack ``` - If the service is enabled, then the result should look like the following screenshot: ![Result of the sc query command for diagtrack](images/windefatp-sc-qc-diagtrack.png) - 4. If the **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**: ``` sc config diagtrack start=auto ``` - 5. A success message is displayed. Verify the change by entering the following command and press **Enter**: ``` sc qc diagtrack @@ -191,12 +184,10 @@ sc query diagtrack If the service is running, the result should look like the following screenshot: ![Result of the sc query command for sc query diagtrack](images/windefatp-sc-query-diagtrack.png) - 3. If the service **STATE** is not set to **RUNNING**, then you'll need to enter the following command and press **Enter**: ``` sc start diagtrack ``` - 4. A success message is displayed. Verify the change by entering the following command and press **Enter**: sc query diagtrack From 5273d5b205947a7bc861d83bf28d43545b36f450 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Mon, 9 May 2016 16:57:52 +1000 Subject: [PATCH 189/439] Update other-troubleshooting.md --- windows/keep-secure/other-troubleshooting.md | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index b8ec1c80a7..405d24f232 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -88,10 +88,10 @@ If the endpoints aren't reporting correctly, you might need to check that the Wi 2. Enter the following command and press **Enter**: ``` sc qc sense -``` +``` If the the service is running, then the result should look like the following screenshot: - ![Result of the sq query sense command](images/sc-query-sense-autostart.png) + 3. If the service **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**: ``` sc config sense start=auto @@ -110,11 +110,12 @@ sc qc sense b. Right-click **Command prompt** and select **Run as administrator**. 2. Enter the following command and press **Enter**. - - sc query sense - +``` +sc query sense +``` If the service is running, the result should look like the following screenshot: ![Result of the sc query sense command](images/sc-query-sense-running.png) + 3. If the service **STATE** is not set to **RUNNING**, then you'll need to enter the following command and press **Enter**: ``` sc start sense @@ -144,8 +145,8 @@ There are two ways to check the startup type for the service: from the command l sc qc diagtrack ``` If the service is enabled, then the result should look like the following screenshot: - ![Result of the sc query command for diagtrack](images/windefatp-sc-qc-diagtrack.png) + 4. If the **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**: ``` sc config diagtrack start=auto @@ -182,8 +183,8 @@ ASK ALON HOW SET TO AUTOMATIC IF IT'S NOT SET FROM THE CONSOLE. sc query diagtrack ``` If the service is running, the result should look like the following screenshot: - ![Result of the sc query command for sc query diagtrack](images/windefatp-sc-query-diagtrack.png) + 3. If the service **STATE** is not set to **RUNNING**, then you'll need to enter the following command and press **Enter**: ``` sc start diagtrack From 31fcd89097e6d88f2aad211f666ef01b5fe549c2 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 17:06:10 +1000 Subject: [PATCH 190/439] remove ``` --- windows/keep-secure/other-troubleshooting.md | 107 ++++++++++--------- 1 file changed, 54 insertions(+), 53 deletions(-) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index 405d24f232..85323793f7 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -48,11 +48,11 @@ If the endpoints aren't reporting correctly, you might need to check that the Wi ![Image of OnboardingState status in Registry Editor](images/onboardingstate.png) If the **OnboardingState** value is not set to **1**, follow the instructions on **Identifying and addressing onboarding issues**. - + **Identifying and addressing onboarding errors:** 1. Click **Start**. - + 2. Type **Event Viewer**. 3. In **Event Viewer**, browse to the **Application and Services Logs\Microsoft\Windows\SENSE** directory. @@ -64,71 +64,72 @@ If the endpoints aren't reporting correctly, you might need to check that the Wi 6. Select **Critical**, **Warning**, and **Error**, then click **OK**. ![Image of Event Viewer log filter](images/filter-log.png) - + 7. Review the remaining events which can indicate issues and troubleshoot them based on the corresponding solutions from the following table: Event ID | Message | Resolution steps :---|:---|:--- -5 | Windows Advanced Threat Protection service failed to connect to the server at _variable_| Ensure that the Windows Defender ATP endpoint has internet access. +5 | Windows Advanced Threat Protection service failed to connect to the server at _variable_ | Ensure that the Windows Defender ATP endpoint has internet access. 6 | Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: _variable_ | Run the onboarding script again. -7 | Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: _variable_| Ensure that the Windows Defender ATP endpoint has internet access, then run the onboarding script again. +7 | Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: _variable_ | Ensure that the Windows Defender ATP endpoint has internet access, then run the onboarding script again. 15 | Windows Advanced Threat Protection cannot start command channel with URL: _variable_ | Ensure that the Windows Defender ATP endpoint has internet access. ### Ensure that the Windows Defender ATP service is enabled -If the endpoints aren't reporting correctly, you might need to check that the Windows 10 Windows Defender Advanced Threat Protection service is enabled on the endpoint. +If the endpoints aren't reporting correctly, you might need to check that the Windows 10 Windows Defender Advanced Threat Protection service is enabled on the endpoint. **Check the startup type from the command line:** 1. Open an elevated command-line prompt on the endpoint: a. Click **Start** and type **cmd**. - + b. Right-click **Command prompt** and select **Run as administrator**. - + 2. Enter the following command and press **Enter**: -``` -sc qc sense -``` + + sc qc sense + + If the the service is running, then the result should look like the following screenshot: ![Result of the sq query sense command](images/sc-query-sense-autostart.png) - + 3. If the service **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**: -``` -sc config sense start=auto -``` + + sc config sense start=auto + 4. A success message is displayed. Verify the change by entering the following command and press **Enter**: -``` -sc qc sense -``` + + sc qc sense + **Check that the service is running from the command line:** 1. Open an elevated command-line prompt on the endpoint: a. Click **Start** and type **cmd**. - + b. Right-click **Command prompt** and select **Run as administrator**. - + 2. Enter the following command and press **Enter**. -``` -sc query sense -``` + + sc query sense + If the service is running, the result should look like the following screenshot: ![Result of the sc query sense command](images/sc-query-sense-running.png) - + 3. If the service **STATE** is not set to **RUNNING**, then you'll need to enter the following command and press **Enter**: -``` -sc start sense -``` + + sc start sense + 4. A success message is displayed. Verify the change by entering the following command and press **Enter**: -``` -sc qc sense -``` + + sc qc sense + ### Ensure that telemetry and diagnostics service is enabled If the endpoints aren't reporting correctly, you might need to check that the Windows 10 telemetry and diagnostics service is enabled on the endpoint. The service may have been disabled by other programs or user configuration changes. -You will need to check the startup type and verify that the service is running. +You will need to check the startup type and verify that the service is running. There are two ways to check the startup type for the service: from the command line or in the services console. @@ -139,32 +140,32 @@ There are two ways to check the startup type for the service: from the command l a. Click **Start** and type **cmd**. b. Right-click **Command prompt** and select **Run as administrator**. - + 2. Enter the following command and press **Enter**. -``` -sc qc diagtrack -``` + + sc qc diagtrack + If the service is enabled, then the result should look like the following screenshot: ![Result of the sc query command for diagtrack](images/windefatp-sc-qc-diagtrack.png) 4. If the **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**: -``` -sc config diagtrack start=auto -``` + + sc config diagtrack start=auto + 5. A success message is displayed. Verify the change by entering the following command and press **Enter**: -``` -sc qc diagtrack -``` + + sc qc diagtrack + **Check the startup type in the services console:** 1. Open the services console: - a. Click **Start** and type **services**. - + a. Click **Start** and type **services**. + b. Press **Enter** to open the console. -2. Scroll through the list of services until you find **Connected User Experiences and Telemetry**. +2. Scroll through the list of services until you find **Connected User Experiences and Telemetry**. 3. Check the **Startup type** column - the service should be set as **Automatic**. @@ -179,24 +180,24 @@ ASK ALON HOW SET TO AUTOMATIC IF IT'S NOT SET FROM THE CONSOLE. b. Right-click **Command prompt** and select **Run as administrator**. 2. Enter the following command and press **Enter**. -``` -sc query diagtrack -``` + + sc query diagtrack + If the service is running, the result should look like the following screenshot: ![Result of the sc query command for sc query diagtrack](images/windefatp-sc-query-diagtrack.png) - + 3. If the service **STATE** is not set to **RUNNING**, then you'll need to enter the following command and press **Enter**: -``` -sc start diagtrack -``` + + sc start diagtrack + 4. A success message is displayed. Verify the change by entering the following command and press **Enter**: sc query diagtrack ### Ensure that the Windows Defender ATP endpoint has internet connection -The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to be able to report telemetry and communicate with the Windows Defender ATP service. +The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to be able to report telemetry and communicate with the Windows Defender ATP service. -WinHTTP is independent of the Internet browsing proxy settings and other user context applications and must be able to detect the proxy servers that are available in your particular environment. +WinHTTP is independent of the Internet browsing proxy settings and other user context applications and must be able to detect the proxy servers that are available in your particular environment. To ensure that sensor has service connectivity, follow the steps described in the [Verify client connectivity to Windows Defender ATP service URLs](configure-proxy-internet-windows-defender-advanced-threat-protection.md# Verify-client-connectivity-to-Windows-Defender-ATP-service-URLs) topic. From 2b4f7bf8e8c2b23e25107d28c3e4c77fbcb33cd5 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 17:13:49 +1000 Subject: [PATCH 191/439] remove # and topic links --- windows/keep-secure/other-troubleshooting.md | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index 85323793f7..fe36bd92ed 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -23,13 +23,6 @@ You might need to troubleshoot the onboarding process if you encounter issues. If you have completed the endpoint onboarding process and don't see endpoints in the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) after 20 minutes, it might indicate an endpoint onboarding or a connectivity problem. -Go through the following verification topics to address this issue: - -- [Ensure that the endpoint is onboarded successfully](#Ensure-that-the-endpoint-is-onboarded-successfully) -- [Ensure that the Windows Defender ATP service is enabled](#Ensure-that-the-Windows-Defender-ATP-service-is-enabled) -- [Ensure that the telemetry and diagnostics service is enabled](#Ensure-that-the-telemetry-and-diagnostics-service-is-enabled) -- [Ensure that the Windows Defender ATP endpoint has internet connection](#Ensure-that-the-Windows-Defender-ATP-endpoint-has-internet-connection) - ### Ensure that the endpoint is onboarded successfully If the endpoints aren't reporting correctly, you might need to check that the Windows Defender Advanced Threat Protection service was successfully onboarded on the endpoint. @@ -86,7 +79,7 @@ If the endpoints aren't reporting correctly, you might need to check that the Wi b. Right-click **Command prompt** and select **Run as administrator**. 2. Enter the following command and press **Enter**: - + sc qc sense @@ -202,4 +195,4 @@ WinHTTP is independent of the Internet browsing proxy settings and other user co To ensure that sensor has service connectivity, follow the steps described in the [Verify client connectivity to Windows Defender ATP service URLs](configure-proxy-internet-windows-defender-advanced-threat-protection.md# Verify-client-connectivity-to-Windows-Defender-ATP-service-URLs) topic. -If the verification fails and your environment is using a proxy to connect to the internet, then follow the steps described in [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md#) topic. +If the verification fails and your environment is using a proxy to connect to the internet, then follow the steps described in [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) topic. From 79e99bb5ff4b13af1166fcf06924d16d7dc99d88 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 17:24:42 +1000 Subject: [PATCH 192/439] remove sections --- windows/keep-secure/other-troubleshooting.md | 130 ------------------- 1 file changed, 130 deletions(-) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index fe36bd92ed..992824cf4d 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -66,133 +66,3 @@ Event ID | Message | Resolution steps 6 | Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: _variable_ | Run the onboarding script again. 7 | Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: _variable_ | Ensure that the Windows Defender ATP endpoint has internet access, then run the onboarding script again. 15 | Windows Advanced Threat Protection cannot start command channel with URL: _variable_ | Ensure that the Windows Defender ATP endpoint has internet access. - -### Ensure that the Windows Defender ATP service is enabled -If the endpoints aren't reporting correctly, you might need to check that the Windows 10 Windows Defender Advanced Threat Protection service is enabled on the endpoint. - -**Check the startup type from the command line:** - -1. Open an elevated command-line prompt on the endpoint: - - a. Click **Start** and type **cmd**. - - b. Right-click **Command prompt** and select **Run as administrator**. - -2. Enter the following command and press **Enter**: - - sc qc sense - - - If the the service is running, then the result should look like the following screenshot: - ![Result of the sq query sense command](images/sc-query-sense-autostart.png) - -3. If the service **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**: - - sc config sense start=auto - -4. A success message is displayed. Verify the change by entering the following command and press **Enter**: - - sc qc sense - - -**Check that the service is running from the command line:** - -1. Open an elevated command-line prompt on the endpoint: - - a. Click **Start** and type **cmd**. - - b. Right-click **Command prompt** and select **Run as administrator**. - -2. Enter the following command and press **Enter**. - - sc query sense - - If the service is running, the result should look like the following screenshot: - ![Result of the sc query sense command](images/sc-query-sense-running.png) - -3. If the service **STATE** is not set to **RUNNING**, then you'll need to enter the following command and press **Enter**: - - sc start sense - -4. A success message is displayed. Verify the change by entering the following command and press **Enter**: - - sc qc sense - - -### Ensure that telemetry and diagnostics service is enabled -If the endpoints aren't reporting correctly, you might need to check that the Windows 10 telemetry and diagnostics service is enabled on the endpoint. The service may have been disabled by other programs or user configuration changes. - -You will need to check the startup type and verify that the service is running. - -There are two ways to check the startup type for the service: from the command line or in the services console. - -**Check the startup type from the command line:** - -1. Open an elevated command-line prompt on the endpoint: - - a. Click **Start** and type **cmd**. - - b. Right-click **Command prompt** and select **Run as administrator**. - -2. Enter the following command and press **Enter**. - - sc qc diagtrack - - If the service is enabled, then the result should look like the following screenshot: - ![Result of the sc query command for diagtrack](images/windefatp-sc-qc-diagtrack.png) - -4. If the **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**: - - sc config diagtrack start=auto - -5. A success message is displayed. Verify the change by entering the following command and press **Enter**: - - sc qc diagtrack - - -**Check the startup type in the services console:** - -1. Open the services console: - - a. Click **Start** and type **services**. - - b. Press **Enter** to open the console. - -2. Scroll through the list of services until you find **Connected User Experiences and Telemetry**. - -3. Check the **Startup type** column - the service should be set as **Automatic**. - -ASK ALON HOW SET TO AUTOMATIC IF IT'S NOT SET FROM THE CONSOLE. - -**Check that the service is running from the command line** - -1. Open an elevated command-line prompt on the endpoint: - - a. Click **Start** and type **cmd**. - - b. Right-click **Command prompt** and select **Run as administrator**. - -2. Enter the following command and press **Enter**. - - sc query diagtrack - - If the service is running, the result should look like the following screenshot: - ![Result of the sc query command for sc query diagtrack](images/windefatp-sc-query-diagtrack.png) - -3. If the service **STATE** is not set to **RUNNING**, then you'll need to enter the following command and press **Enter**: - - sc start diagtrack - -4. A success message is displayed. Verify the change by entering the following command and press **Enter**: - sc query diagtrack - -### Ensure that the Windows Defender ATP endpoint has internet connection - -The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to be able to report telemetry and communicate with the Windows Defender ATP service. - -WinHTTP is independent of the Internet browsing proxy settings and other user context applications and must be able to detect the proxy servers that are available in your particular environment. - -To ensure that sensor has service connectivity, follow the steps described in the [Verify client connectivity to Windows Defender ATP service URLs](configure-proxy-internet-windows-defender-advanced-threat-protection.md# -Verify-client-connectivity-to-Windows-Defender-ATP-service-URLs) topic. - -If the verification fails and your environment is using a proxy to connect to the internet, then follow the steps described in [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) topic. From a4984b1d2c4e340384369d81ccc71ebdb44b8b34 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Mon, 9 May 2016 17:26:11 +1000 Subject: [PATCH 193/439] Update other-troubleshooting.md --- windows/keep-secure/other-troubleshooting.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index 992824cf4d..ffe6965d9c 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -26,7 +26,7 @@ If you have completed the endpoint onboarding process and don't see endpoints in ### Ensure that the endpoint is onboarded successfully If the endpoints aren't reporting correctly, you might need to check that the Windows Defender Advanced Threat Protection service was successfully onboarded on the endpoint. -**Check the onboarding state in Registry**: +Check the onboarding state in Registry: 1. Click **Start**. @@ -42,7 +42,7 @@ If the endpoints aren't reporting correctly, you might need to check that the Wi If the **OnboardingState** value is not set to **1**, follow the instructions on **Identifying and addressing onboarding issues**. -**Identifying and addressing onboarding errors:** +Identifying and addressing onboarding errors: 1. Click **Start**. From 01134ba3a62820da304e7b4257acee93fe241d46 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 17:32:11 +1000 Subject: [PATCH 194/439] add 2 sections --- windows/keep-secure/other-troubleshooting.md | 38 +++++++++++++++++++- 1 file changed, 37 insertions(+), 1 deletion(-) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index ffe6965d9c..1b192e4fa6 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -65,4 +65,40 @@ Event ID | Message | Resolution steps 5 | Windows Advanced Threat Protection service failed to connect to the server at _variable_ | Ensure that the Windows Defender ATP endpoint has internet access. 6 | Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: _variable_ | Run the onboarding script again. 7 | Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: _variable_ | Ensure that the Windows Defender ATP endpoint has internet access, then run the onboarding script again. -15 | Windows Advanced Threat Protection cannot start command channel with URL: _variable_ | Ensure that the Windows Defender ATP endpoint has internet access. +15 | Windows Advanced Threat Protection cannot start command channel with URL: _variable_ | Ensure that the Windows Defender ATP endpoint has internet access. + +Check the startup type in the services console: + +1. Open the services console: + + a. Click **Start** and type **services**. + + b. Press **Enter** to open the console. + +2. Scroll through the list of services until you find **Connected User Experiences and Telemetry**. + +3. Check the **Startup type** column - the service should be set as **Automatic**. + +ASK ALON HOW SET TO AUTOMATIC IF IT'S NOT SET FROM THE CONSOLE. + +Check that the service is running from the command line: + +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command and press **Enter**. + + sc query diagtrack + + If the service is running, the result should look like the following screenshot: + ![Result of the sc query command for sc query diagtrack](images/windefatp-sc-query-diagtrack.png) + +3. If the service **STATE** is not set to **RUNNING**, then you'll need to enter the following command and press **Enter**: + + sc start diagtrack + +4. A success message is displayed. Verify the change by entering the following command and press **Enter**: + sc query diagtrack From 7f3e5de25124351e0e6033f0edd19680756445b4 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 17:34:23 +1000 Subject: [PATCH 195/439] add internet connection section --- windows/keep-secure/other-troubleshooting.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index 1b192e4fa6..a21b628ff6 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -102,3 +102,14 @@ Check that the service is running from the command line: 4. A success message is displayed. Verify the change by entering the following command and press **Enter**: sc query diagtrack + +### Ensure that the Windows Defender ATP endpoint has internet connection + +The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to be able to report telemetry and communicate with the Windows Defender ATP service. + +WinHTTP is independent of the Internet browsing proxy settings and other user context applications and must be able to detect the proxy servers that are available in your particular environment. + +To ensure that sensor has service connectivity, follow the steps described in the [Verify client connectivity to Windows Defender ATP service URLs](configure-proxy-internet-windows-defender-advanced-threat-protection.md# +Verify-client-connectivity-to-Windows-Defender-ATP-service-URLs) topic. + +If the verification fails and your environment is using a proxy to connect to the internet, then follow the steps described in [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) topic. From df2809ec521d077af39a3465717b1e056746fd71 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 17:43:10 +1000 Subject: [PATCH 196/439] added another section --- windows/keep-secure/other-troubleshooting.md | 26 ++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index a21b628ff6..295a975a52 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -67,6 +67,32 @@ Event ID | Message | Resolution steps 7 | Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: _variable_ | Ensure that the Windows Defender ATP endpoint has internet access, then run the onboarding script again. 15 | Windows Advanced Threat Protection cannot start command channel with URL: _variable_ | Ensure that the Windows Defender ATP endpoint has internet access. +ADDED + +### Ensure that the Windows Defender ATP service is enabled +If the endpoints aren't reporting correctly, you might need to check that the Windows 10 Windows Defender Advanced Threat Protection service is enabled on the endpoint. + +Check the startup type from the command line: + +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command and press **Enter**: sc qc sense + + If the the service is running, then the result should look like the following screenshot: + ![Result of the sq query sense command](images/sc-query-sense-autostart.png) + +3. If the service **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**: sc config sense start=auto + +4. A success message is displayed. Verify the change by entering the following command and press **Enter**: sc qc sense + + TIL HERE + + +FROM HERE DOWNWARDS IS FINE! Check the startup type in the services console: 1. Open the services console: From 48fd6616cd73fcfaa82cdfd95cd4984fd82de647 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 17:45:21 +1000 Subject: [PATCH 197/439] removed section --- windows/keep-secure/other-troubleshooting.md | 26 -------------------- 1 file changed, 26 deletions(-) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index 295a975a52..a21b628ff6 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -67,32 +67,6 @@ Event ID | Message | Resolution steps 7 | Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: _variable_ | Ensure that the Windows Defender ATP endpoint has internet access, then run the onboarding script again. 15 | Windows Advanced Threat Protection cannot start command channel with URL: _variable_ | Ensure that the Windows Defender ATP endpoint has internet access. -ADDED - -### Ensure that the Windows Defender ATP service is enabled -If the endpoints aren't reporting correctly, you might need to check that the Windows 10 Windows Defender Advanced Threat Protection service is enabled on the endpoint. - -Check the startup type from the command line: - -1. Open an elevated command-line prompt on the endpoint: - - a. Click **Start** and type **cmd**. - - b. Right-click **Command prompt** and select **Run as administrator**. - -2. Enter the following command and press **Enter**: sc qc sense - - If the the service is running, then the result should look like the following screenshot: - ![Result of the sq query sense command](images/sc-query-sense-autostart.png) - -3. If the service **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**: sc config sense start=auto - -4. A success message is displayed. Verify the change by entering the following command and press **Enter**: sc qc sense - - TIL HERE - - -FROM HERE DOWNWARDS IS FINE! Check the startup type in the services console: 1. Open the services console: From dd316c122ee73677ed74854040d80fa305f300be Mon Sep 17 00:00:00 2001 From: jcaparas Date: Mon, 9 May 2016 17:55:12 +1000 Subject: [PATCH 198/439] Update other-troubleshooting.md --- windows/keep-secure/other-troubleshooting.md | 46 -------------------- 1 file changed, 46 deletions(-) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index a21b628ff6..01853ea7e5 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -67,49 +67,3 @@ Event ID | Message | Resolution steps 7 | Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: _variable_ | Ensure that the Windows Defender ATP endpoint has internet access, then run the onboarding script again. 15 | Windows Advanced Threat Protection cannot start command channel with URL: _variable_ | Ensure that the Windows Defender ATP endpoint has internet access. -Check the startup type in the services console: - -1. Open the services console: - - a. Click **Start** and type **services**. - - b. Press **Enter** to open the console. - -2. Scroll through the list of services until you find **Connected User Experiences and Telemetry**. - -3. Check the **Startup type** column - the service should be set as **Automatic**. - -ASK ALON HOW SET TO AUTOMATIC IF IT'S NOT SET FROM THE CONSOLE. - -Check that the service is running from the command line: - -1. Open an elevated command-line prompt on the endpoint: - - a. Click **Start** and type **cmd**. - - b. Right-click **Command prompt** and select **Run as administrator**. - -2. Enter the following command and press **Enter**. - - sc query diagtrack - - If the service is running, the result should look like the following screenshot: - ![Result of the sc query command for sc query diagtrack](images/windefatp-sc-query-diagtrack.png) - -3. If the service **STATE** is not set to **RUNNING**, then you'll need to enter the following command and press **Enter**: - - sc start diagtrack - -4. A success message is displayed. Verify the change by entering the following command and press **Enter**: - sc query diagtrack - -### Ensure that the Windows Defender ATP endpoint has internet connection - -The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to be able to report telemetry and communicate with the Windows Defender ATP service. - -WinHTTP is independent of the Internet browsing proxy settings and other user context applications and must be able to detect the proxy servers that are available in your particular environment. - -To ensure that sensor has service connectivity, follow the steps described in the [Verify client connectivity to Windows Defender ATP service URLs](configure-proxy-internet-windows-defender-advanced-threat-protection.md# -Verify-client-connectivity-to-Windows-Defender-ATP-service-URLs) topic. - -If the verification fails and your environment is using a proxy to connect to the internet, then follow the steps described in [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) topic. From 3abaabe081df3c2d1f1ce371dc977db3a98b35ae Mon Sep 17 00:00:00 2001 From: jcaparas Date: Mon, 9 May 2016 18:05:52 +1000 Subject: [PATCH 199/439] Update other-troubleshooting.md --- windows/keep-secure/other-troubleshooting.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index 01853ea7e5..38a1295009 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -67,3 +67,13 @@ Event ID | Message | Resolution steps 7 | Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: _variable_ | Ensure that the Windows Defender ATP endpoint has internet access, then run the onboarding script again. 15 | Windows Advanced Threat Protection cannot start command channel with URL: _variable_ | Ensure that the Windows Defender ATP endpoint has internet access. +### Ensure that the Windows Defender ATP service is enabled +If the endpoints aren't reporting correctly, you might need to check that the Windows 10 Windows Defender Advanced Threat Protection service is enabled on the endpoint. + +Check the startup type from the command line: + +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. From 33f175992691f016484f056195b378a12c85ac85 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Mon, 9 May 2016 18:12:25 +1000 Subject: [PATCH 200/439] Update other-troubleshooting.md --- windows/keep-secure/other-troubleshooting.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index 38a1295009..4235c6c3a9 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -77,3 +77,7 @@ Check the startup type from the command line: a. Click **Start** and type **cmd**. b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command and press **Enter**: sc qc sense + If the the service is running, then the result should look like the following screenshot: + ![Result of the sq query sense command](images/sc-query-sense-autostart.png) From 58cb824ce6ba06c4247e89ed60a6fe8ec8c683e9 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 18:23:22 +1000 Subject: [PATCH 201/439] incorporate Tomer's comments on privacy content --- ...cy-windows-defender-advanced-threat-protection.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md index dd37c4b7bf..e4e7932fae 100644 --- a/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md @@ -36,7 +36,7 @@ We do not mine your data for advertising or for any other purpose other than pro ## Do I have the flexibility to select where to store my data? -Yes. Data for this new service is stored in Microsoft Azure datacenters in the United States and European Union based on the geolocation properties you specify when you onboard to the service. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations in which your data will reside. Microsoft will not transfer the data from the specified geolocation except in specific circumstances during the TAP stage (see the question [Is there a difference between how you handle data for the TAP program and for General Availability?](#Is-there-a-difference-between-how-Microsoft-handles-data-for-the-TAP-program-and-for-General-Availability?). If you have concerns about storage of data in a particular country, please contact [winatp@microsoft.com](mailto:winatp@microsoft.com). +Data for this new service is stored in Microsoft Azure datacenters in the United States and European Union based on the geolocation properties subject to the relevant preview program you may be able to specify your preferred geolocation when you onboard to the service. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations in which your data will reside. Microsoft will not transfer the data from the specified geolocation except in specific circumstances during the preview stage. ## Is my data isolated from other customer data? Yes. The new cloud service provides appropriate segregation at a number of levels, such as isolation of files, configurations, and telemetry data. Aside from data access authentication, simply keeping different data appropriately segregated provides well-recognized protection. @@ -52,17 +52,17 @@ Microsoft developers and administrators have, by design, been given sufficient p Additionally, Microsoft conducts background verification checks of certain operations personnel, and limits access to applications, systems, and network infrastructure in proportion to the level of background verification. Operations personnel follow a formal process when they are required to access a customer’s account or related information in the performance of their duties. ## Is data shared with other customers? -No. Customer data is isolated from other customers and is not shared. However, insights on the data resulting from Microsoft processing (for example, deep file analysis processing), and which don’t contain any customer specific data, might be shared with other customers. Each customer can only access data collected from its own organization and generic data that Microsoft provides. +No. Customer data is isolated from other customers and is not shared. However, insights on the data resulting from Microsoft processing, and which don’t contain any customer specific data, might be shared with other customers. Each customer can only access data collected from its own organization and generic data that Microsoft provides. ## How long will Microsoft store my data? What is Microsoft’s data retention policy? Your data privacy is one of our key commitments for the cloud. For this service, at contract termination or expiration, your data will be erased from Microsoft’s systems to make it unrecoverable after 90 days from contract termination or expiration. -## Can you help us maintain regulatory compliance? +## Can Microsoft help us maintain regulatory compliance? By providing customers with compliant, independently-verified services, Microsoft makes it easier for customers to achieve compliance for the infrastructure and applications they run, including this new Microsoft cloud service. -Microsoft provides customers with detailed information about our security and compliance programs, including audit reports and compliance packages, to help customers assess our services against their own legal and regulatory requirements. Windows Defender ATP has a roadmap for obtaining national, regional and industry-specific certifications, starting with ISO 27001. The service is designed, implemented, and maintained according to the compliance and privacy principles of ISO 27001, as well as Microsoft’s compliance standards. +Microsoft provides customers with detailed information about Microsoft's security and compliance programs, including audit reports and compliance packages, to help customers assess Windows Defender ATP services against their own legal and regulatory requirements. Windows Defender ATP has a roadmap for obtaining national, regional and industry-specific certifications, starting with ISO 27001. The service is designed, implemented, and maintained according to the compliance and privacy principles of ISO 27001, as well as Microsoft’s compliance standards. -## Is there a difference between how Microsoft handles data for the TAP program and for General Availability? -When you onboard your service during TAP, you will be asked to choose to store your data in a datacenter either in Europe or United States. Your data will not be copied or moved outside of the datacenter you choose, except in the following specific circumstance: +## Is there a difference between how Microsoft handles data for the preview programs and for General Availability? +Subject to the preview program you are in, you could be asked to choose to store your data in a datacenter either in Europe or United States. Your data will not be copied or moved outside of the datacenter you choose, except in the following specific circumstance: 1. You choose Europe as your datacenter, and 2. You [submit a file for deep analysis](investigate-files-windows-defender-advanced-threat-protection.md#submit-files-for-analysis). From 1727cb8d15fab89e6225e79d7f1119ca46f29ece Mon Sep 17 00:00:00 2001 From: jcaparas Date: Mon, 9 May 2016 18:26:52 +1000 Subject: [PATCH 202/439] Update data-storage-privacy-windows-defender-advanced-threat-protection.md --- ...orage-privacy-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md index e4e7932fae..c97bdab3d6 100644 --- a/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md @@ -32,7 +32,7 @@ Microsoft uses this data to: - Generate alerts if a possible attack was detected - Provide your security operations with a view into machines, files, and URLs related to threat signals from your network, enabling you to investigate and explore the presence of security threats on the network. -We do not mine your data for advertising or for any other purpose other than providing you the service. +Microsoft does not mine your data for advertising or for any other purpose other than providing you the service. ## Do I have the flexibility to select where to store my data? From 32a9a670b19a8189f05ae0fa699554d79b7378a2 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 18:36:29 +1000 Subject: [PATCH 203/439] add note to portal overview re:Defender must be used for malware feature, edit tile label --- .../dashboard-windows-defender-advanced-threat-protection.md | 4 ++-- ...al-overview-windows-defender-advanced-threat-protection.md | 2 ++ 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md b/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md index 51cec3f418..e55f55d13f 100644 --- a/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md @@ -61,7 +61,7 @@ The **Machines reporting** tile shows a bar graph that represents the number of ![The Machines reporting tile shows the number of machines reporting each day for the past 30 days](images/machines-reporting-tile.png) ## Machines with active malware detections -The **Active malware** tile will only appear if your endpoints are using Windows Defender. +The **Machines with active malware detections** tile will only appear if your endpoints are using Windows Defender. Active malware is defined as threats that are actively executing at the time of detection. @@ -81,7 +81,7 @@ Threats are considered "active" if there is a very high probability that the mal Clicking on any of these categories will navigate to the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md), filtered by the appropriate category. This lets you see a detailed breakdown of which machines have active malware detections, and how many threats were detected per machine. -> **Note**  The **Active malware** tile will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/en-us/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product. +> **Note**  The **Machines with active malware detections** tile will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/en-us/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product. ### Related topics - [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md index dcf0408603..8ae3c6e9b4 100644 --- a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md @@ -35,6 +35,8 @@ When you open the portal, you’ll see the main areas of the application: ![Windows Defender Advanced Threat Protection portal](images/portal-image.png) +> **Note**   Malware related detections will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/en-us/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product. + You can navigate through the portal using the menu options available in all sections. Refer to the following table for a description of each section. Area | Description From c0a92addb1edecd98b62a5afff70763aff4879eb Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 18:40:46 +1000 Subject: [PATCH 204/439] add 2 steps --- windows/keep-secure/other-troubleshooting.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index 4235c6c3a9..2c069743ae 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -79,5 +79,11 @@ Check the startup type from the command line: b. Right-click **Command prompt** and select **Run as administrator**. 2. Enter the following command and press **Enter**: sc qc sense + If the the service is running, then the result should look like the following screenshot: + ![Result of the sq query sense command](images/sc-query-sense-autostart.png) + +3. If the service **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**: sc config sense start=auto + +4. A success message is displayed. Verify the change by entering the following command and press **Enter**: sc qc sense From f5fb65b91636bd172886f61171cdcec6b205edfe Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 18:46:45 +1000 Subject: [PATCH 205/439] comment out yammer in min reqs --- ...ements-windows-defender-advanced-threat-protection.md | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md index cb21dec085..bfd6beddb3 100644 --- a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -2,7 +2,7 @@ title: Minimum requirements for Windows Defender Advanced Threat Protection description: Minimum network and data storage configuration, endpoint hardware and software requirements, and deployment channel requirements for Windows Defender ATP. keywords: minimum requirements, Windows Defender Advanced Threat Protection minimum requirements, network and data storage, endpoint, endpoint configuration, deployment channel -search.product: eADQiWindows 10XVcnh +search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library @@ -24,9 +24,9 @@ There are some minimum requirements for onboarding your network and endpoints. Your organization must use Azure Active Directory (AAD) to manage users. AAD is used during service onboarding to manage user-based access to the [Windows Defender ATP portal](https://seville.windows.com/). -If you’d like help with using AAD to set up user access, contact the + When you run the onboarding wizard for the first time, you must choose where your Windows Defender ATP-related information is stored: in either @@ -65,9 +65,8 @@ manual registry changes. The following describes the minimum operating system or software version required for each deployment channel. -Deployment channel | Minimum server requirements +Deployment channel | Minimum server requirements :---|:--- Group Policy settings | Windows Server 2008 R2 System Center Configuration Manager | SCCM 2012 Manual registry modifications | No minimum requirements - From e0948f01540b6fd29ef96b34aa3eb8bf85fccd48 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Mon, 9 May 2016 18:54:17 +1000 Subject: [PATCH 206/439] Update other-troubleshooting.md --- windows/keep-secure/other-troubleshooting.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index 2c069743ae..f3246175e9 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -87,3 +87,22 @@ Check the startup type from the command line: 3. If the service **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**: sc config sense start=auto 4. A success message is displayed. Verify the change by entering the following command and press **Enter**: sc qc sense + +Check that the service is running from the command line: +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command and press **Enter**: sc query sense + + If the service is running, the result should look like the following screenshot: + + ![Result of the sc query sense command](images/sc-query-sense-running.png) + +3. If the service **STATE** is not set to **RUNNING**, then you'll need to enter the following command and press **Enter**: sc start sense + +4. A success message is displayed. Verify the change by entering the following command and press **Enter**: sc qc sense + + From e2d4fce810093a8019e36e7e54470b66d6dedd69 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Mon, 9 May 2016 18:55:08 +1000 Subject: [PATCH 207/439] Update other-troubleshooting.md --- windows/keep-secure/other-troubleshooting.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index f3246175e9..ee589f024e 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -89,6 +89,7 @@ Check the startup type from the command line: 4. A success message is displayed. Verify the change by entering the following command and press **Enter**: sc qc sense Check that the service is running from the command line: + 1. Open an elevated command-line prompt on the endpoint: a. Click **Start** and type **cmd**. From fb43908d08172e52506bda788a83e99e3773f85b Mon Sep 17 00:00:00 2001 From: jcaparas Date: Mon, 9 May 2016 19:01:01 +1000 Subject: [PATCH 208/439] Update other-troubleshooting.md --- windows/keep-secure/other-troubleshooting.md | 24 ++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index ee589f024e..30794e6303 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -106,4 +106,28 @@ Check that the service is running from the command line: 4. A success message is displayed. Verify the change by entering the following command and press **Enter**: sc qc sense +### Ensure that telemetry and diagnostics service is enabled +If the endpoints aren't reporting correctly, you might need to check that the Windows 10 telemetry and diagnostics service is enabled on the endpoint. The service may have been disabled by other programs or user configuration changes. + +You will need to check the startup type and verify that the service is running. + +There are two ways to check the startup type for the service: from the command line or in the services console. + +Check the startup type from the command line: + +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command and press **Enter**: sc qc diagtrack + + If the service is enabled, then the result should look like the following screenshot: + + ![Result of the sc query command for diagtrack](images/windefatp-sc-qc-diagtrack.png) + +4. If the **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**: sc config diagtrack start=auto + +5. A success message is displayed. Verify the change by entering the following command and press **Enter**: sc qc diagtrack From 34481b526b221c2baa1ee260c92e59c163d833b9 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Mon, 9 May 2016 19:05:21 +1000 Subject: [PATCH 209/439] Update other-troubleshooting.md --- windows/keep-secure/other-troubleshooting.md | 31 ++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index 30794e6303..7e360ec2a0 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -131,3 +131,34 @@ Check the startup type from the command line: 5. A success message is displayed. Verify the change by entering the following command and press **Enter**: sc qc diagtrack +Check the startup type in the services console: + +1. Open the services console: + + a. Click **Start** and type **services**. + + b. Press **Enter** to open the console. + +2. Scroll through the list of services until you find **Connected User Experiences and Telemetry**. + +3. Check the **Startup type** column - the service should be set as **Automatic**. + +ASK ALON HOW SET TO AUTOMATIC IF IT'S NOT SET FROM THE CONSOLE. + +Check that the service is running from the command line: + +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command and press **Enter**: sc query diagtrack + + If the service is running, the result should look like the following screenshot: + + ![Result of the sc query command for sc query diagtrack](images/windefatp-sc-query-diagtrack.png) + +3. If the service **STATE** is not set to **RUNNING**, then you'll need to enter the following command and press **Enter**: sc start diagtrack + +4. A success message is displayed. Verify the change by entering the following command and press **Enter**: sc query diagtrack From a0544933b86e8ff14138851e9fcc959c95140b6f Mon Sep 17 00:00:00 2001 From: jcaparas Date: Mon, 9 May 2016 19:12:33 +1000 Subject: [PATCH 210/439] Update other-troubleshooting.md --- windows/keep-secure/other-troubleshooting.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index 7e360ec2a0..d121264485 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -162,3 +162,15 @@ Check that the service is running from the command line: 3. If the service **STATE** is not set to **RUNNING**, then you'll need to enter the following command and press **Enter**: sc start diagtrack 4. A success message is displayed. Verify the change by entering the following command and press **Enter**: sc query diagtrack + +### Ensure that the Windows Defender ATP endpoint has internet connection + +The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to be able to report telemetry and communicate with the Windows Defender ATP service. + +WinHTTP is independent of the Internet browsing proxy settings and other user context applications and must be able to detect the proxy servers that are available in your particular environment. + +To ensure that sensor has service connectivity, follow the steps described in the [Verify client connectivity to Windows Defender ATP service URLs](configure-proxy-internet-windows-defender-advanced-threat-protection.md# +Verify-client-connectivity-to-Windows-Defender-ATP-service-URLs) topic. + +If the verification fails and your environment is using a proxy to connect to the internet, then follow the steps described in [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) topic. + From e0628dd3720946e114cbbffcf05e2f48c86c20bb Mon Sep 17 00:00:00 2001 From: jcaparas Date: Mon, 9 May 2016 19:19:53 +1000 Subject: [PATCH 211/439] Update other-troubleshooting.md --- windows/keep-secure/other-troubleshooting.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index d121264485..cf7086789f 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -169,8 +169,7 @@ The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to be a WinHTTP is independent of the Internet browsing proxy settings and other user context applications and must be able to detect the proxy servers that are available in your particular environment. -To ensure that sensor has service connectivity, follow the steps described in the [Verify client connectivity to Windows Defender ATP service URLs](configure-proxy-internet-windows-defender-advanced-threat-protection.md# -Verify-client-connectivity-to-Windows-Defender-ATP-service-URLs) topic. +To ensure that sensor has service connectivity, follow the steps described in the Verify client connectivity to Windows Defender ATP service URLs topic. If the verification fails and your environment is using a proxy to connect to the internet, then follow the steps described in [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) topic. From b259a62ef78cb425a2da8f5147fa6a7423668649 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Mon, 9 May 2016 19:28:08 +1000 Subject: [PATCH 212/439] Update other-troubleshooting.md --- windows/keep-secure/other-troubleshooting.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index cf7086789f..aae7819b77 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -169,7 +169,7 @@ The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to be a WinHTTP is independent of the Internet browsing proxy settings and other user context applications and must be able to detect the proxy servers that are available in your particular environment. -To ensure that sensor has service connectivity, follow the steps described in the Verify client connectivity to Windows Defender ATP service URLs topic. +To ensure that sensor has service connectivity, follow the steps described in the [Verify client connectivity to Windows Defender ATP service URLs](configure-proxy-internet-windows-defender-advanced-threat-protection.md#verify-client-connectivity-to-windows-defender-atp-service-urls) topic. If the verification fails and your environment is using a proxy to connect to the internet, then follow the steps described in [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) topic. From f81a983badbd009d8c981c67bfa5a2511fd7c475 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 19:42:19 +1000 Subject: [PATCH 213/439] commented out service onboarding topic as per Tomer's feedback --- windows/keep-secure/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 2b6d9b59ea..8e71d063ac 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -404,7 +404,7 @@ ### [Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md) #### [Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md) #### [Onboard endpoints and set up access](onboard-configure-windows-defender-advanced-threat-protection.md) -##### [Service onboarding](service-onboarding-windows-defender-advanced-threat-protection.md) + ##### [Configure endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) ##### [Configure proxy and Internet settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) ##### [Additional configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md) From b881d9aeedcc910c060262cacac1985356425287 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 19:44:11 +1000 Subject: [PATCH 214/439] comment out service onboarding --- ...configure-windows-defender-advanced-threat-protection.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md b/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md index a9c306cc68..3032ab10da 100644 --- a/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md @@ -19,18 +19,18 @@ author: iaanw You need to onboard to Windows Defender ATP before you can use the service. -There are two stages to onboarding: + ## In this section Topic | Description :---|:--- -[Service onboarding](service-onboarding-windows-defender-advanced-threat-protection.md) | Learn about managing user access to the Windows Defender ATP portal by assigning users to the Windows Defender ATP service application in Azure Active Directory (AAD). + [Configure endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) | You'll need to configure endpoints for it to report to the Windows Defender ATP service. Learn how you can use the configuration package to configure endpoints in your enterprise. [Configure proxy and Internet settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md)| Enable communication with the Windows Defender ATP cloud service by configuring the proxy and Internet connectivity settings. [Additional configuration settings] (additional-configuration-windows-defender-advanced-threat-protection.md) | Learn how to configure settings for sample sharing used in the deep analysis feature. From 15f3b75edfd5d6745f5d0d5716f4133d6dce7dac Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 19:48:28 +1000 Subject: [PATCH 215/439] change Applies to --- ...ard-configure-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md b/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md index 3032ab10da..abea9a41b9 100644 --- a/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md @@ -13,7 +13,7 @@ author: iaanw **Applies to:** -- Windows 10 Insider Preview +- Windows 10 TAP program [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] From b964bc83e8724b196b1e3fcc54fd4ec1564e42f8 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 20:11:46 +1000 Subject: [PATCH 216/439] remove line --- ...oard-configure-windows-defender-advanced-threat-protection.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md b/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md index abea9a41b9..f88a5ed08b 100644 --- a/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md @@ -31,6 +31,7 @@ You need to onboard to Windows Defender ATP before you can use the service. Topic | Description :---|:--- + [Configure endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) | You'll need to configure endpoints for it to report to the Windows Defender ATP service. Learn how you can use the configuration package to configure endpoints in your enterprise. [Configure proxy and Internet settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md)| Enable communication with the Windows Defender ATP cloud service by configuring the proxy and Internet connectivity settings. [Additional configuration settings] (additional-configuration-windows-defender-advanced-threat-protection.md) | Learn how to configure settings for sample sharing used in the deep analysis feature. From 3fffd1093dbb6db00a9ef48a721557cbaf162b39 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 20:21:52 +1000 Subject: [PATCH 217/439] fix table --- ...d-configure-windows-defender-advanced-threat-protection.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md b/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md index f88a5ed08b..09216ea210 100644 --- a/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md @@ -27,11 +27,11 @@ You need to onboard to Windows Defender ATP before you can use the service. 2. Add endpoints to the service with System Center Configuration Manager, scheduled GP updates, or manual registry changes.--> + + ## In this section Topic | Description :---|:--- - - [Configure endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) | You'll need to configure endpoints for it to report to the Windows Defender ATP service. Learn how you can use the configuration package to configure endpoints in your enterprise. [Configure proxy and Internet settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md)| Enable communication with the Windows Defender ATP cloud service by configuring the proxy and Internet connectivity settings. [Additional configuration settings] (additional-configuration-windows-defender-advanced-threat-protection.md) | Learn how to configure settings for sample sharing used in the deep analysis feature. From 3d9b6772ce578fcecc6bae58b71aac1e2a92b764 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 May 2016 20:44:30 +1000 Subject: [PATCH 218/439] add topic links --- windows/keep-secure/other-troubleshooting.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/windows/keep-secure/other-troubleshooting.md b/windows/keep-secure/other-troubleshooting.md index aae7819b77..16bdc09fb1 100644 --- a/windows/keep-secure/other-troubleshooting.md +++ b/windows/keep-secure/other-troubleshooting.md @@ -23,6 +23,14 @@ You might need to troubleshoot the onboarding process if you encounter issues. If you have completed the endpoint onboarding process and don't see endpoints in the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) after 20 minutes, it might indicate an endpoint onboarding or a connectivity problem. +Go through the following verification topics to address this issue: + +- [Ensure that the endpoint is onboarded successfully](#Ensure-that-the-endpoint-is-onboarded-successfully) +- [Ensure that the Windows Defender ATP service is enabled](#Ensure-that-the-Windows-Defender-ATP-service-is-enabled) +- [Ensure that the telemetry and diagnostics service is enabled](#Ensure-that-the-telemetry-and-diagnostics-service-is-enabled) +- [Ensure that the Windows Defender ATP endpoint has internet connection](#Ensure-that-the-Windows-Defender-ATP-endpoint-has-internet-connection) + + ### Ensure that the endpoint is onboarded successfully If the endpoints aren't reporting correctly, you might need to check that the Windows Defender Advanced Threat Protection service was successfully onboarded on the endpoint. From a17c004fe629854b3bdf24b5aabfa2a463bfcb01 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 10 May 2016 13:02:12 +1000 Subject: [PATCH 219/439] update images --- .../images/windefatp-sc-qc-diagtrack.png | Bin 81969 -> 18668 bytes .../images/windefatp-sc-query-diagtrack.png | Bin 59876 -> 14668 bytes windows/keep-secure/other-troubleshooting.md | 68 +++++++--- ...ows-defender-advanced-threat-protection.md | 126 ++++++++++++++++++ 4 files changed, 175 insertions(+), 19 deletions(-) diff --git a/windows/keep-secure/images/windefatp-sc-qc-diagtrack.png b/windows/keep-secure/images/windefatp-sc-qc-diagtrack.png index f1401c96df9eaee54706d739240f2dc4f7aaad4e..45ad95aeb726fc9bf2466baa66551b086a5d1860 100644 GIT binary patch literal 18668 zcmd42WmH_vwl>;8NP>kRA;FX2?ry6vlL*)POsJ0jba9nVvpwb%5HryFbt8kir@~auD*)6s!sN_zu-zC zvLfn;YHajeI(#6IQGY|K6Lj13)SVs7-! zSUTk+ds)euWvbeP%&+rZe3t~J54`A!O7m@DSyhC>cZ_*OL$+fbWQj_*fU=S*r?s+= zN)?&IPrC}tj*L&af-Kl5z%u+-qL|_RlIi?45r0MlsmjV%y(w{s#iDq~fm9x!Xp7Ef z+isLFE~1bqJ&=`^R9EUxb-|Y`_(d3uPnUWEFeoLzcM$Q%m=W$l-l0PW_M^l#CEX(W zN&%?|YN!Sp89-$P-cqMG%1XDQ(8-pWxHVrJp3YLrJtYnG53i^yZ4muHBuuvrnBAG_ z+Rv=WL799yISj}&(AQtX3QhWFa>N7r$fIptreaD3iJ zGJ+7coU6zkZ?6Lx$$+){TKP#j7`b)t(Nh`1NV20PGJY~juG{O2YcDrX9#4-4Xma~cUM=UPQ}Ik=ibLE~^11EQ7m zgKi6=c+zt@1*U2q->Au`-M*)$-H^0I?YmoSnKoa~Sv{H4Yy8ffaN2pdNDxvAER`Oh z2LEi!pzf^lzDOk26tBltnR7}^t1Nd2a71#Y_AHrxZL&2_vPN{1uBkrRe>){!(ITlK zi;ptkW=(SLxN2Zf5_nn9gKlE(9_?)A&c_J7pdXuY8pKsuCzD6*PF^JVd09VuLXtV- zHDz}9$i1AcU2b0~{uZ%cFva3PfrOdKJ>X)R0-XQjT8Publ2zcfIU$E0{;B8>{VM@s7YUg8(Y`Id8^%FPA-9clRwO@CNdPPVP-n z5;JbPDiS)Ks*54CkNX4dJPve_LR+bJPHE*PuhjBdM;mcm?%rzCnq4xgk7F5NjRyx* z-A&`(c#f{qxG&ffo*30CR)enP?5-aXY7E}H9{*RbLN^spIUdpqL;w3I0W_SW_M>Ws z^7{oG=J?G-)u)A;lKsLp^K`8k8l8a3j;M!`*+;39SE~JpB4;ZSslOp~EiztyfgMQD z_rC9t~JxFh6tJGu6c zf}W-ow~#Q$vNMV`M~@Z9$_v%_{f@r5F0B8Oxm@EcbGc?melDpIvRYOQDjTg$3RkZ2 zgqi{m>x;JfD+OUy7n#_V|dO z@1Jem-1qqCrH61dyx^U?#`mQO2`dXxS(Ba{o;YabB4p^f$v~yujggNrz{AGK8@3mI zO2~GY0}Uj{siglfQyL`qS+4T*^ik!&({La&WsmQ!h^W*1OR3zISju@&OxiG2$dgNlE=Ol6;(d-&XL&M z*pyg9jeLo+_RlzJdDWt$3U!PRL={>7^V=2miWh3fOE{I8SzT^Q^m0Avga*BcZd7F| z@EAV~blWJC-r~V=abQWliueI3(fw+J{9jMzNkVm4rudrYt1gw|9|GQNnAAF;KS_W5 zc6!RtU^l2mx%|2H1E>_1aGE8@xqJmBK|(C2xqz7ba0hqoA^-XPPGUQdquH6}1emM!X> z`Yf3z5l(fYC*lxqUS3eCZ%D;@e%YuqSpDF=dLGG(ct^h^j8?Z+MS4j}g`g?T)wF|? z``jW_S2Xt5f4W0))&3w^mtj1cJs3_LF1w)569F{wldiRehe*yPx}N?4wB@aiW8Koe zLSj({4ah);i%30YzFsOCl;}G5=P_)5=f4DkauukgOwS1sSSI#mvzmQpyvuA>WWMaQ zG>F*C4W|UGt`(4HbXE=ngZ>Ovk95W@SGq3_O9&M1tw4fQb@(#Z15=kQjF=Nu(Ge8% zT#bb1d{+$qw!|M?j-Zbu%?jHt_~hhO9iwWSy;G(4&~R@EVxhJRBBtPcP89SZ4LJ|6;LT_8^ew z502ME`FkRB=`!Fw>XCneLHjL`UJ8@b`$8Oh7bSk0>`9@yIN$@PxFUbS1hb>x(I4y` zV5aI@>P$^U`v-C`w=rd#o%6n<)$ry6^-tC3VCMAxrTY4(zl;H^Zsb_gM#lUy-D>$J zs|WhF$$Z%dd8(rlvz%X_KL$5c_!0a;>hJD<8)wq(%3P@jXJT-{dSM{msx8)IrEL>? zE{_I&T7nwo#=>#cW{pejk0Kz9N__-%n_}RdTix=|#L~M8{(F^WstkV8TZNP5i_WPV z$@m)!o2D#uTFbe5Mda{sl5_fa&0}N-bK0FJWynn9LNN*pr1M!3gQHF=|+ zd&QjtB}71NQ{-d+DsNP>}E4w3(*w0fl5Pnm%$nF7sJ zWTg`fx=EK$S}W$1Tv)VC*IKQT79+f0{^&~U3t~N0SKDw1F>)}nz{H=^3&VdJnIyRzZ zS}vM)H2jGq4wgNyKUPY0nLtsny2K0@(t33E>Kv_xVxrhQlfUj8>Hi-@^M``|rP;s5 z+TX$Ze{<9Sry;VD&+jMdMFf{;|K^D9#+S!R??((k72$x%MkC<(=a04Lo0rGjmmBMs zXF@C#z{2A17yT2s!{CT*;`}y%%1N`!+Pi7n8v2CB{qqQVg>@PB)d^I)7~a z?geeyVfjPPaqTYMSRU!ib$U-so`-t0K6VYua0G1G7ZQNa1dKh#^N!9-!*Shj><*>< zs(bKh=3(_Vg~wTHt51-_r>9*wwSk~l6p2+Hq4lRqKTu-OJx$ebG_EOZF+z!6a(!Iv z=t(lah}<0?heaqyIlfiGk}RYUynP&1LXiWIAChMJFUL>NyH>sqM1I5?k?ViG9`<7m zwu)~ZiVEtbMq31Ul8w)@A9Q{C`$%l9rMFTxwzHgF^uY&My{77rv^I3KLTUS$emm%7!=R+()Y1aKVPP(o#9HxZbEQPf|*$x@L7t<$Uo0E=;gg^`9h~nEaOtRA!t>=$%%&miMqjvWJM{>oY%lNqGmNi zz$wlMSXA-Y2cq}yR2;*9o~Nfe^Tr`n3&-_ z<@1YQjA#%8ZT0?0#`+&7f^9QAAh_Me0to%ty;)afL0P_vpqJ?EkJBGivUK2LFDk*( z3U?xHp`F;C+gj#5*f}C^7SU3Brc}UkT!+kCFAdt9{bdW6_@XPXqgCm_t5&%=a-RNa z8Etz}sfry%k#TebZ4(HKfz&|V+>dMQVZ3Siq$?H<8F^ph6V_SZg3zc|V5|$z_-`8; zLuuR|Kw9r|oxyrzXoMq<$sz8^m$tROBh~vn`t*-(sv%oR`;}UWkYbCBauK=C@ZWWq z*NmlaV*Fq2hVQgG?;CF`<9y25nYlM--~G^IH6iCo5(uN(xm-tdOJkdOX{fV9@cx3_ z>WyZYZ$Gp(_nro@K3TOSi+`p8AoyrM{qB|q5E<5N_T~}Gr~l79GQBiT5IQz)I@c$X zQk|04rd%MFSxrIN?qu!Lf|&$If*uXl*kAA$^rOLPiEKmSr&=8ymvn&;=U%DBY#H@} zTON9scOz0DS|6g6Zzg;q+;4&iAeK)kwP4nem!_a7XBM*{ zuhN~n&eI=V_PSP!(T~>!twZ07Y}R(d9%bzUPJgTzSS?nkufYO%q4Vs2dIXJ^a@>mV z<#@1`?zOp%EvJ#4MsGCp^spG$fgE_NY!C%(7ct$8PQVE#XqX`ZL&@I6+I~W*ZTKYD z0fDo|br|+PpM(RhaC+%)iFXU|bv7GWEDVHQUU%e&#tK-35U)Ya@)~{|SdqFry z85WPhsXASnO35whD zp!LBcrS!goX?9g&>7KDyy0Rl9|Fg~9pyJPkK|Sv$4w4h=B}krDnA=Jl3)ry5rpM`Z zqz_a-tvQX3-Qq2}Sg>Wz>TIJ%>+W&07?+<2)Sz1x zUhW^7UTeGt+Z#erCs?zFanXieoNPCqFSBUt^xCuh`0u8!C19QMs~GUsc4AE;34pCzdzYtCmbm z;5lWfkWQ|ZA#P>ReQOXrIv8J{DzvsNes-0f=wSbP-o z!R25P+EIyd{F8B>rESu`!Ku$|ZEU@pay)Q|tUj6kK9Z6_*avL2&}m;<+Z?;lav^X* zQOtX0u8->q=6r69-d7Z;-2$F!deNCw+mEhkhuT@PNlnej*^|`)?#0MBG1(s)6S*r* zr!S|}UFo8hHP{bFhA={ma$ij`rcn-(i5{=tnbW`t1HD+*WOrF0EgXL)3(+VwG1bI} zd9rUVkueYV`n{+wI_Hw^iOx*JH9Y4Y=T?C&2+aBl;Smj(Tm~~8&3jaDvJK)W^M%Z{ zNvU@)C08vX(9RJ@%+16b_|@tuvtKqQ29wgE$i|l7h;b`4eq+D^wUB$dzAdRCjWo)I zEB>V>y8v4<&9_x-=XuJuao5L4HT;jcTrA<9Cj+%K$#7=?GFmTMdQhLI>wsTxriXf2 z;#%NShzqSa8MZ@KA<0f!Lq;TpoX&XhRV(@7!vYeT%szafNUeZk1g=S5T8*Mle zwQ{6RSEwVjcUnK0`xEazdYv|wV0;N-H-(7JhFq_t>^Y*HY1nA| z@td8-MB7rJoaVHzCp7NPle~}sx_{dD8XdlxXWK~OR&tjzkQa1l6XqX^0n54Mk^MOF)bVs&aV4r=s&e_`t56pmT`kLG zmhY^*FA}?xxREfB$y+0c^e&aWZoF+f&qwYD7IWn~UU`yImM2gK*4vhaTv#L2LxPL8 zQlvm6I##i&H%Xz}%d#s3jx%$rPbl=oK#7=pUwjz?M}2&;Z4Oo^AyAIpRJM?(#-s`@ zuYnxNdQeYIG?T)&ezDwBOKF6*2u#J0@0LM-;_eA_W85Z(S<-PGgpZL;HexWGWI9D@ z{<7P_){a@yZ38eHZ0it{KcZp@-%#bJv`+?oDpdzf)-hkClx=C(<k%bg-=dD9RImLA-N7H#z8&YP|ZEC}x^cITrgvXA=p>tS`E4d55`TloQ zumRj_b$sqdrUm^@cn!v&Y~106)Or4gXkynAfaT}bAqSZLV_$O9u7bwXGo~3H70C`` zZH@wxOQtic%(_gP?-_*|y_SjiTd&F{p}yaj6@6rPweBYl1%g}Jp5OSO zq#KpzT&_{Q-l#|%dO`0gFP36PoKQ~3;Ue(2alVCIVggM5A~jyTx+$-LL3qI5F}?sv zt>ANecWe@ghc@O2@lZ`p=lTBNUzq=j7^HE>K$mm)ikz;)IKoWj1Wp0VFZQgeFyH7i z5;ekHqj_v-p6~oyZ918w%y;opaOxCK+wK{6ZL+$~e=u-tn?1+rPm2&HtRy5nNwWD^jD-WrCvCU@5{pwws`2mLDjoHY6RdB{@>{j4vP1dzSW{_pLGzM zmh}MW8fKmaDq*+LHZm^w0o(Zjm$ki=f8Q%aJSXi;3x&qV>!JkOOqYeFRuW{i0m`~E;wnV&M}{9*ea%&>F1@6mwxY;alXg3m;1FB zkry>)fUf__8BNla!1MhP9a0ECQn+clvb|-M>BhrNX2-K?((N7iR{)4%h7Y*?D`8`t zj^m!YL*fJb+1}iZY&MIF9Y7t&TMdh{Ql{jq1L!+V;{Gg_!asLS8@j4l86>2mL8t;0J7_;}Y_1G^_T z68eD_?Cg}=@Tr#3Hb%SS%cBv`%J(?GJ&Wfe zu_eH{jG$J)UY2PAMx}ET9(dhrNnBo8r~R6j=XrEEtI3L)B$Gwt>G-(z9SI#qa5052 zS>hKDCpiFe@UtCSdtU}*DXuF8xL7FMhT}u`=3O%uJB`cx^*X>Y^1s{c_?aHCp8a{R zu78zF(qQ0WDJ-Bt5BPAivGpX?t|Pu~jF;=#>6m7_7#Zn&@8QaI&c6Kwl zEe_gnL0>p6JsNS*L?AvlsA^t1GIZMrg*VaDUR-S*G+dUk3BP$KMtL>doV}HShhuWu zG_9@CvMweMo4B?fzg~#Fa}{H(tL_*pJc`5iD<`ABO&T0>RDZMWnHQLb<1)i&3NU z+3QJH=3%|35jh&5E$qKrl+^SMy5s6?KOCe-OHWWxF7%AwxGh1nD3Oqup`P*T3alY1 zE=v1dq50;i(`MTTsd*aD$7p`nbcO!d$o>qDl>%+a)3@(-kmz9E0Q!kT!^BZk{VTPU;h(@PCm=?B~RFRqeCm$nP8+HB$!j`8cq%_u(++F^%9-gLv?fN|L992GAxs7YP)!K53VdEGJ z_P4mkpG@wN!Li-dkG?xpzv%%? zv`&j(hzgDF8CpbDi3t&pi+x2lTc@W6ch2%Ang>@52FYn^QQ_y_yO*ppuy54?d_?}D zz|VywFL?Sm0G}Y(|6;`dA>iKa)a^9>YV>~RbWsEV=ycXh7woBbqlPHa%8Vowsy;e5 zXBgfET_E#)>Eygero^ALjgFmbGd;d1q_4c0U5Ly#=``!wvN6sN=c7DHYv7*yY8P35 z&f^_X*Uh=JGVmC89Fi7-(Q#H9HMq1h*-Q#{`B2XoM=q1IM)@&YN^sJwID)v_J+Mn# z)!xlw-1YU|M)v7e#@zgR&TgGa2GIxN_%_^T?#-UTVTlnDX|9~@RjzWL+4keQF0Toh zNW5stQuxlq+QSs5{kkh7=?gbE)Y2#p8dL}E;slvUHF2CgH3G@P50Pm~zPsuiV4M8- zizufMN->As39&b)*stGg$g<@mbTU=1lP@os4VvI#tRRhImXgeK$<$84+F<@c>}RF3 z`mZ*H3JwUQ$jw^R8a~`wADkH(c^`=13^B3}CD>%!<6Z}2-L$~}vK`ONSAvV}K;^E= z{oOu+8)cro7_BNjyW&uXn;?MfCv#3OUD_CI(HajX#70CCbS0DY&Nh-Rtxx#aez6h7 z;{8SyVafWWGlGk9DTLLX>-#a1Bll{ijFWssafg0*g83WTjUQYKApv0K)2)DZn{*DaidWp>g>b$t4;wujfVE>19H#*^kf zU*%rN(>Nvn4Ku-fsIW4x_14)Z+-`HxwT%Amp%acv{1}O=H-2ht?Q(hct1@3;m*e_( z%s;8s-Gg=o_ochdq3ZR2@%F8Hq2f4shzzPRDW& z8P4*2hpem)aC)7F<&%EiD~)UQ?jZdA3YnzdY&0&hT*g~IRn&Vr>rtkho!y}kuQn9> zH$@}Qot>`oTBMfUoL|wTI4Rw$oXbDXr-<0Ax4o$KxZ)BWz8b=M8-1mgk%2~oU~c@h{EG+r#^t2BeH*dBxEH7N!L1y)_7IV>6 z4enwOr4EYMxR8P{uvkgOswskM{}E3{RD$h8O6FP?qw!shrq$hmUX$xJMfYf}e@AR| zjU}w#b#=>rTSbd^>h$6$B}wZg!=TB0`N8G9l*co5TkVzCAWUhRlcOu`dI7kK19hWr zRf(6p-@6g?I(dZ)WqcG`Z*$r&mlFGW7C0~3wo7=^IiuwM>d!|GD7rKkG#&jF5r$8h z%2l$;Q{YoLs`A|H6_faDLjIR(Kf5aM_$Y+ebhX$j*?b!xTui$V z)6q;_F?X~&>j{??_9*9&iL7?+T|PBHK5*up-uA2ETDO%X5gYYV;%rCI3E|_4x>?+W zQ%~Z4!Oc}*-51%wxdAhgyMm{2rj?F_-oiE4_RppTSzl>7j+$ojofksPf~#)m8Q|GY+zG!0mY1TK~K; zbNm!Py;YXmtk7q&=4j#Q8ZV#Eb4W@fS4&>6AZaB=sjh(j%dY&FYF5vB-OhHa*(@nt z{Wp8i;7qr%BOa=y4u+@eKonV}5mPEF-S<1>p|Fwb+>q&*B?)YKt{Fz$Fh~nS6B;Dz zcUKEM(SrufJB_)W1$N(QFXM5nhc-kSqNQ@=^#?AT*C6rjSAt%%K?#;DXVWc$ zVou2>i9th8N7iQN6bM&g{X?mAE6FFvn5XFJd;EhBKTiqZZ15uw>UtSC$sF7Ym8`9= za0^+|eYnaw^Ny(5X-?FCRPNYHNA?gHEG$f~)d%U1YWU*HLD`+QsSj~pygz~Sbhe(&+xCAGj9RugNc&ObpN`G~| z?!+b-F!QtqHR?rl@1Ioj`hG=?CO zbmI|QllEQKkKLTB2_a=e4?Yw>@@N}nC39VSiE*Dv`N1yDFIjCpA)>BB$pJHMfzuD}QWY~Wn2zF04WlvX38~+fSUU(^K%{CXvC;8Cmb8o2J#t$5 zp2-%42~4@Cv?ojAqjioSEjkS!erH)s(Gl-?4cyQ{lhWi~TfY!&NhBXnix2Kxv6t7Wr_rVjVe2>v&Yq{d!LJr$v8at0e~p_$xq!MM zs`C0lFEMm{@x15rxFa&ed0vtJQvPhVJ9dV!EYSZ+aneGfKCHlYexCw)zUZiVcFA&xt6PzdWAGg zo~&Yn3;f;+{X?WT93`lJg*#|zPG=FD>^8VTdE@JKT8l-3c6XZGJgf~4ivjVV>kswp z%84iM3?)|+@wjoJk^lCplnS7*UKa^S!_tI){^+%W;sJa|#dvF8DD@DfCsd+&O+SpU z>vbz##1`8vRWN8OeT~59QGBZU&J{rlo%HkxR7btHBs#~F=-yji86&Jw`Q=;;(}uX+ zB|qH#litKp7WH^;aH}KbFL#R(yn+Ry^J;>OUMW{Jf+8F3Ojlaxi#VANDHtWhC(|Wj zb63;?ZQ|-7p+?a9)!>pTM>mqY`=A;u7zoo3H`$L@S=}W(T6{rZfmep_h}yuOw{jcZ z6ZcWh0XF7gG;Ts7tG*E3e7nJ@c9; zCKRa^J^6B^{#{!hTXEPe+Sw6sC*ZXc19abLx)O;mxH;l1^w;LDFWkjVuVViN8$f0t zBMl4i?SDh+e*o|QH%)tzZn2PfS5)ASH<*K5kXS;1U&}( zMi>ry>Q)!YG`&|H33_Gm7Nq{CL8A%;J+cc}vNJA!YV>}I40~2%gx&)%$13YzZYnz} z9~-Mc&(C+@rSUbV34!P}@26@%lIO?!_N-<+cfKaPJ|axANj8=n$&HOrB!CNn>AM=) zet{XRN64JcpTkkPGF(`J-Hp-7841 z3Dmk^$Ab*2oM&XnV4|$V7shM$8aD^;$P6hf=Vp7VXAOB66uV7A=ib7-d#7smX zif}Bka3yI+%^5{J1uTHzjU5PH(###}qQ!*atM?$~!(Bi^lUI2-j8PqEC@nRrIcax| z^XMKEZ*No2MU4s3QEPG}aHwPhC~K14$A~$Zd^l*9c3BX(VUIYx6KPH>fhbP*#rN!W zfHQ{NTj){elxmup>i6|%-aEjB-7`ex@_MR+xkWEKh->1OKlF$9aMFFfCe)w)SC;c% z^wj76Q&u9fRe4^TN<2i=|78SZG2U{skXe$SGRmx&m0I-f zE9ip(M2?t%)H9l^cf2QhYYuT=!{RgKoJ?iGNYv9|siy1|QeNDibKCtX=?fXy)0 z=S=;fy()d$4no;XkI^>i#93S1F$mocGebBA#?X;r*s14?ijcGs=&8M@m{jB|C^Age zpxperZasIo=?wZ5k^Vi6&V+VCt;UVLB_6*Q*I05^CRD0KFIs+hOdS6=21lexg@>0`&d-YPK@k)wCn)GFf}7W_*An! za0#J~l&TD0B0Gh+O?2(uPcbXuGRUWoaRbF99ntl@MVez`-SAW9tN0X3GC7V9Ys16n&nHyxM;b@f zn8*tlIi}0rZ@m`7)l5~i*KVwe9Ts!>HH%ZIP|V72Y4TMFiz6&XT2DVSSgna&S?fcf zG7O-9Yq}#GHtZ}8r$CopZSM3fUDRkvFaa#U;y*l700>^A%hm#tX{g!$qFl=^)zI|g zaxOik`~GmVe3>$LWGsr6$<{VMme?8iUCJZYE@Cm(h@pp@+!%s07z@ec8%j(bgaNE8 zSX6_?jQ5gTV+v;x%CY&zj0PK2#Ri$E@b4bY89dVBkE=%6?T{YO74I#~Uo)K3uLanF z@O%-GhA~=%n03B_JChQb7EMTdWl47|?1@=urpmOZ?<0n!H7(u%0K9|W=ju6acMhC- z6~9xu77$MCsUq(snNw+?sN(T5VE|y(?G-xjr zyO8Dc{bTH_O9yOPORI5KBZ`SKZKh^*MB;p29V5~=03VsE1@)tvFdL)wi$%e zDd$_73Fbg^$LzC|K+J+2F-S`vZ~weXj)ao^(8vYJ9r+Tdf@~ZueAX5J{?phzHd)G6 zeOiLOd}Xmm_A$(Oquw96!wb6QMslCWRTyeA2UA?Vq?2Y1e9fP(#5Zu_hZPY=rVccz z#q=#2qLJLnpWumvL~*wSa%|gw3wh65m1)GXdPWfiq*2IiE(Mcn3FfA!=udTU$Z3rD z4)=46Txe0E0stPN;7TB!9z?y=f8iX&M3mZR;f~hI8%QdM1Pl1KQ46H`!#WB7q^0uu zIuGqvf05HV>^~BeZ#@>Y%RE+DJ@ij!gYI8U)&T$4$SN9DAPfNDWBCsO!(?-dSMSuk ziF9I=U9mn=bS%`anuls5?|BH8X;q-QP8lByw7FtaAFQ`>7hIjFT$4fYOVYs&y3 z1s3Lb0KoMyl%BNR15X8Zjr87k>1T%Z@Hb48oEV=;TtY`z7V2~F8YJwO8q>V7E_uFi za&w0a^m=gEJ)!@0v=^sj_~Ov~>gkh;0=fD}E*o*g(3~>OFIZ0ce8Np$ru-~eG%$e9 z%Zmf|0p7j9;-+L!Pn;F{*U@DQA^5UbG6=gLl2Wr#%&C9O2hXsl6d7`%fo0!1_DpFq zM8)#qi}V<(l*nM&611L8=VH!MiR;duhn z%=oAnPE5ZJ7x@jLGP9(x?hsWjqiaZ*-R007d*BmyxQH}1ay7xUiDmMkm0jX0yB6`u zao)xqbSZk2X;1V706<2ZOj$km&g<@D&X7U-I`RN)?T^9CJEcYFUk$LV?6q^y%D`AG z6oo~=&@MS*u|r=V?JiZc8gnm7v=@zt0dJk4<>%%M>gGBG`D#JK=vs1>(WH4YeJt7t zsX|1-QUKu0V)>*6i~DWsH`Y>p_E!Lajq|_TJ%LOcxRsE5ZY9&cZP{n1&>$uopYnFO zdIfIL3>;{;oZVjWajT%dn?sCuwkapM5x)3!j#q=L8N=4w`m}t12DIYHd|`9KB?I1A7% z#~&wQWJ!}A?2jF;6-+e5L-WZz^)r?R+3I?lWdmEL`lg4M4ps=4Bb=yLDefkmZYCWpYg564O)8AkB$FW)V*-NgUe&c%Z2Q!%CeU zE|?323eeW0%}AY-Cyy8iX)75p9GF`(<}r2fcZ2fpZ9jZR6`tK|#jR0A{8iyn&cm7T zXuPATmLV=0rQ4hzx2c@lb20O6nA%ThfQBI!&PJySBHaqQ*O0Y&BEq{P{)XJAwC`|Pmft5TZx zT+pXvZZgP;CV5b&55wHb|GQED8O+>w>Z#XGeGlIx=PxJc>k#5FMy|t?dfRfV+eI&} zK3O|e=acd)nSaHy_mn>L+E5P9^?YAmOYB4(&!3aJs?V+V6W21Nfmp-XXwWMpe8&PE zd00Qs5a0u!;aa|f;H(ErWv}PIhbu0iGwKj;oR?-{XcD5$H~({&BkkjSR-LgiFQ(?f zFiuJc*j2FX&3-A4wR=8zugiAIdfK@T0q5S9g|_hR6FvT0A})Xr6ZaF3VMdm}Rl?z3 z9Q{(SC>Ga~q4U8q^GqTI>iENI(!42~A-A-=GnyqITfb(*vc0A6mo$szBhL$4j?1%y zkus{+fX{wUi?HMLX79}Q;+WwPu<+$WrI~oNIN3(8xHwEeG6BDtVKMV^X%7=-gAe?7 zr?17AGN~fy4wS~MCRfYS81nZ$?6~0o!O*BkZ7xXVOX0{*)%Orbw2uw>xHn@zauo#s zNxFT{+(|TVs|fp=-=vr zf6#40p*E0=OH*z6Sd+tSobvnKD#-Ua?fl)!K>N_4wEBX`@B*T_SvEJ(!|&+E-NoHs z*tK4Ifne^Vj|7MuM*GN8Ggo8L4@f?qmsdcrZjF&`%GR;&*F6dbb=y)VE+%!szL9pX z@s}}EwsYwrCYqPd-*7#>+A8W(argBfI?xuqJUb+plHs(^+`eVsG_tW=UO0(+(+y08 zhK3~ZKt2M-;VXbtMqed2>A50yo_=Z>wa zI@}fFx)_YwlOh62UKIu>$W6Zk*On|zJACQY-P9r~i>5(rbeIkMzb=S>KYV{5Dks?3H1aTI{wWFpO)0 zlj<}Ocr82+?xC?NH{z1om?6~z(K z#Ym}7J6O>|;*t#6SpBsh1igq6XD7bB*a>Ku7bjX)OH=+R$}F~~F|Er$Pv#uPiML^I zxSUvTX_(;n_Q@5tv=-enthF!k(^pdQYurn`xo4h5?5@^`>X;s49RtPZKvuCF)k5n@ zE)^Xl>5MlhE?VucDfg6w-_~Q5wL7SvpP(=YJBz#B(;i-|{9E~e+h~^>$vD$U9UK>o z`kFK;B`3znsyH~zr$cKzY+B8Ly&+6g7}IzMnIm5)w;N-jimLu@cBa-NL<~!?#%e4g z(s1=Hj>P@PFM<1*uF4^SX$rKxRqcXb7=UcWWu&66qsQFrO%?TiyTPXJ%;d6)o>nnC z$@IJe^co$yza2;v3hr=_c0P{n5MHUws>BJc*mUK=>cGbz4Q+E*rb4ZDJ` zQ|8r1Am+revjqmx_lG0k-|F&DnhM~BA40E~`6Y26EUNn{RkC5sgKSF(_tCP!O!w&N z;;|UWkiRMyS8Oc2{(n|33#{l0KjUqTRL7K)rs4)nYq5UeVV2kkw~JG@rN43X0N;4=e~rN)Sr6n7qoZj0oQfEL8-H2QaC78iR)fcNx zQVc3A?*RZjgtGb-`QN3|ny8yN`g->z2PrIpsP4Hxil5?Y2u8qc3;`kO*b3nx>1ubw z&R@#wS-z^ZeX(%Hfc{(cnOPO6q1OIa+|Q5UQ8iiyW7MSf4>jtT7n{rtndmdb7+e@7 z926<^^rub*J0_4%awYLZ?9E2dI%XUev}mvvfUNf)-0D7yDe*SiZbYa7E_pBBB7*8>37Yb`U zi{isG1N3AM!f3nu_&HjX617*l`~4j zUgB_N(xULWY4X}=PYxFaNMhskQmIJFb^C^R8j#Tl6zTtoK~p$2NC82L=*F%u-!j_V zzxOwFxNK8$x^BU64u6>0n^z=|R}`1u2jBLIrABa%+BFEJ)_y(UDL2d$FFD~LyZjj6 zPvUt(#3gYT_=-YbH6w{>Ql*V7$r+M=@#?7|kBMBYlAVGtcVUTNFH0t8Iu+Cy*RXg9 zQJ5wt`55|@Mx_eVLldPTi0c)weA6Jp;66PvPXIp z4N0_ugcw^bop_E_ldkp;K>-MXQln+SRECs)Sm6cEP}MWN@2C9a`N0KRY^9p#-_%qe z%GK_;B=%G%=E#RA$PFQG4o0pm^U3LDs`aY8;`B5!KGU>uQUlla?S2=A=VdlLTDIeH ze0zeDS7A;2?jZ@ss9P;~R3$Qq3Skd05B1-Vfrsn^Ps7z4uYJpHZ?NZli6{G%O*6O&%RMhH?LD{ zFjSw!ZJz&U=;&y?b*@ZFIwutpr3a~)&4xbU{;0hhJ0^Efv@wf9AOX+w#_Ib%Mr|A4 zDq3citN;LWm)p>NtBD1Rh2NMpw`J|(4|_Ve;8O5F3@5p97bLCv$==BcR;8l+ENNo% zAdC6R=D@)=T-B6~LQ?O=5(#iitqM%%JSs?L)WLFt%`hF#;{wqgUeScc3AD#z`$i^S zq%Wu?9R}p6U@xi6tJCoi7h?-JN(kcCKiwyk{aln{WcT8N1%UkO8#;qnb6KI}>w<-r z$NXh)Pls;M*;u6DPJ6|c$Hb!JOWa--GtG%qOll!PIWW3f8A_06b-Ep(;7h%TbL_a@ z9y9y0%o!zN{hI4L4-=>E>P>lVePPu-r2v!B0{Hv@JHg)(gSLB%G$P0K zJTQR9Z73fC&|AOnet_1N<4+lygnfiTqPI^3ZrzlKBrL(sfN2?nlZDQJNgMEd1EswUTfYeEOry>MY zY$qL^LMddZP%TOXxjv2jKU3Q>D?Ll~;!4M&riJ^0f}g5r>7PASsPpjsH3^1<;+l^hDhCm{kpX)*C}j^-WHZ@whq{GXgCEM)t~Tm)%=UQkE*OGaNE3StEP$L z|MDPd=NgSq+h#1gzCu_@wp9Mr360}Vad#v5CIHj%%4GwTCzu*x4*o@&uI6Po(pFH56O-!`|(N^EcOPpLfh3$xa2DAQ@pn)F4f*4jXA zr|8CO$uR*+%cuQuyC$|6Xj)C%`FGb(vE)9ftg3wV?8c@e7qTAA$~w=dqO^cB>C%ez z2c07JcO0;TZ`sZ%A!i@aco6`b(fWE%bOG@LB3tikZ>ws{9C$q-TFRHXt$Yr#$9K*b(^?gFVdQ&MBb@0KFl8-2eap literal 81969 zcmYhi1CV6F(l$J{ZQHhO+qP}nHg;@t$2NDoW83yOd+&Sy_&cJbqw{2DRh`qFS^4Bs zkqUC+uuxb~00026k`f|H002N5004k05MV!&7a1Y0pASd}2~B4J0Jx!lZ@^S)IP4!G zxQnE$DEJO27#Jo_SNe(de?+1hE`qKu7WPg66}3|mKOz{HACZWuv$2zYrTL-oew!(%ixYpc;Pa-#~Exkvf?g{!=Azv9vV>V10&%{J8@8?~1a$nTxxj zlPQ3%!}mXR=>IskbT+mz{84oRXzOc^{}Ds{6RR6K*;(3|1N31Zh5yLF|7-8+WNZrX z_#J%yKQ&={TU%2*7l5a!wB8>X*grKDOBWkcfby$9q_LXtujkln!$g+UZlL{zJF3&(NpBd^ol?s?}NpIh^o*Bqjw4ep?b{ZS~O zfTtvcgoNGC$;k`u@1Kct#Sw7sIgR|YgZBv+txtd7O?u61+-qnt!VC?VGG)k;$4xpc zOaKN03{*rHrZpx_{v$kvMixK{2?U@nFYod%Mh#aLLI|PnwD_m}bKSoT=56pyAfV(F z46bS{NbxknEWq@?&K^R`JNm;0V}SwD0tg@?h%$Cl|6@Y7fKD70%(zt1%d)U3`(Hmj z?fVTW9$!oUnZ%EIembVXe`my`Yx4hjbVY{7D)#X{O*Zo$f z)4^P$*%bEmbSh#|L@`IcUZ7Y;D6nK*Y1z8=~IG$jIaF zwCvXFz5V^F)8V%cd77%a`u%?XN6JtLNcD2l^P;a_K5<`T{n1jo=fg96Q6*J}AwlF` zr209|HCpp}b$M18jig1En3fnBXxp}HT({VX9q-inY|U}90qEdJoVkS$SRC^*v~u?& zaI2(Xm_BDL&T(k2mW>#lXISv+{gC_EEey7H0CB%#S_n&QT-3AXvk7mqzYqK{y2f#T zT(^yf3A^KDo$1%=19aVi^PRKDpfOKpD~jQX1et82LXF~EH!h2d2{VzX&_^dkqsYg! zsg1WOJ2JY?#KA@2&A5WEihoz~;QKpfw-r|F$Y8bqt0<18G zM-WZyyy`$MTaa{hWqszq0kE{R{CJ1=6EHFw5arwg<$o8IJeVsGPD#VTdC^3fcl~5; z!&c=8>%9ItTSE`yDzD)RqxFZoe`JUqt+c>O>z8=$GZKzQf(e_aH6(Gzaa2QB>lavX z5pf~fWl$6zI&~weGV}>#7-P$k18>|Ra-S$UfV+T{T|$7#jX)yBS!(#L!$FJ0Azr_e zhDaV|67u;nKqbKh*Cr>uMz`f%0CLW*rkr6o7$(SqCA#FAV7p3^>Oc@;B%zT*r=tdJ zFO9jb=bODakBrIAmCJ(2paS#-5JhI-xazo89S~P)VNn@Xc?!`OLn19v7~&!|wCHKT zi@m)HGyHt>Sf?x63W6|l3|$08R0v>2BEV2=5b-lKb`?ZeZGkmdP&x7qc>meJe*Le| z_uEic8aQ;i?3jQ+toZ~Q1lVv$aaWuMMvYj8&o727gZ@J|LqxDAOxQcZI! z2z(Y=QfQ?l0Kt_(cOH6-Ss}oJMpzgU1?9FEd*q}g?^YWI*hm+7Jn8g!ZCf#UyWjDD zzmdmvxd+5WMoTCbhM0vFn#39HS_=1v7M&&+f_` z&SaT0d~P;%CC*bIVn?0=_D1jb@^|6st;m@9;xeA_K_-=UfzKdZwoiWlkJzyWdKdCx9Iyvs_`G?%Eb!i@Lk8ej? z=TeeJSEbXORlfl9-VcjxuH%UP-k|&(?jb7kv?jr2I~Dxjw_Wat{hD1MYO=qEX1{I# zYYDGa07N?7Z-!>`4L*CUP|RVJ?cW%mw^-mR`HU_Hvms(-cXqJPPscI`E3wmm zU49VD+t3VC=!~%U-t*St9UgY)f5%zHhtHHs!Ci34e68RgfvtppT&=a0UpFcFtk}Q2 zPWV*&!rHuCws{ztXE^u(-rIfoe>gNmchmDtx7M&Wmx!-*wxnE$ZtrmG>-L9`gw_UI zd)^eJuc9Z8VKISJ(HW-le+Di@ihMi(QHBMBtjQsyZp~P^eICVk>2687ED~M)Hm8eZ zwZA?8_RUSI#Y>8+J!c3*Dj?aIor?wNh8K<#?C!|Qo=JBoKO{1?<@ zcO5YDXTuFK%wgqV1_jbgfAXE^`OKSi4t>CzHdJj~Hm^0?PpZrRcqrp}JHgkiHz3^p zymFV6X!qzx^@+2@a*-8YVCi}8zDC5ypCyjx8Au|P&S1C4bKmkL4-E~K$>+Il-2{J?kinX?H?xo5hR5t1MDuPY8j4?c6$W zm&YeD+j6SSJ~rB{yV`e0wcK!8!JU$PZrW{tO|dWpdQ?rhs4QGTfKc=88?3t$p3E%sMgT>akcSKbTTD04gb~T3I5MR+Zdq;di`U_d0Equn4Zd|zCu!!- zl4ZGT_4jzN&qn5O%k~Rdn?8HkSsC8$BQI@;@U)HRDQMm{sl%iCl|ff)>igHe;lzUa zU5h<^zglbV@yf+Oyx?qqEYC~tdSZ0#p1vLZ!RNM5>i1vNS=Bb*+|IIf&;5S%)x%h# zjwH&CJvciZPf}#uOB{~}Rw{-YHJjZ?SW}S^+GA~Yxzfwa*y?p1aSD$Fb-zcH%SdER z-*eg+<}(V&CqxuloOo1FK>-97p+LRAR&h=i=kGqns}ea}c`VnAZvM@w#wN~ddy!+L z=bm@&*97SLgKa&Jup@8M8s9@$QeA{ytoV1~+xDgQt3qm<4_m1iK#0t~vvplob;W-;OE%prSx|1E@dL^c-K1Z^711Wpdzl~pI#7KN!{o7^8 z7WngXx!s*6Y1`_Z4yEjRUXPf+X!Uz?uKk`nQ_|D@*F--%Q$5 zNv-@H(KmujF~GtM6;xRAy1kzp+%C0#UME*qWH@j|mRP$E8Q(AQ-#bUy_NASj?;qSS zuJdY7kgifVntc3#C8<|8j8E4*BM*`di!M=PMYTs)ooUIY_M_iNihO7+Dzc+{<7Q8( zlkJ{|swT~=93LCP93wNv^QymNTE#5B>xfw%M8+P55Rl7=i;5&9WAfQjQ`>adrtE0$a!b!U`P7)ahlxFC9!n*E`Ut8rZPG?-qx<{X6pcQmIuBk1NcNq~;BV zTn2miba5D$Hj{pAn=Iepd=_l2p3RbU0@B!v796E4b+QZt0Q^&e?>w95c_4Z$o^QgoZ8L1aQ&4gX{U8XKMi4;|fr7rSZ~s<7MP=wG zQhI!UK4&r*0%fz=?v?R>Que+K(~pgf5fBmvN{|HAVw+zQ!MH5fKW_3~ytU`ved6B$ z5o(=x)}zN2+Ac|eq=R?qQ#LgEh(mfham;s!>BI zPB4C92gDWrm57fXrUN`_zeI9_W%;S6RB&-#S8lWQ;|oj{iZ&dbY12PWL~9?xA*vLE z4Et(<*>KRX)dH^IUpIxX=W;wC`9Ee&FT7k}gE0DzVUZxh9Ycgf6d6UJ8%0U5)cQz~ zmq;(*z|nwRY&c9Tf8j($OkTdIJZtiRdPWXieg(ik%M=-mp(vRIKp2V&sDqkx;wr`? z0T=;O1ucaxP!?2yv5E5tGxG#QQH>-a!`mSW^jo#;Ai=1(s7wp0$x+b(_7TiyN-D)j zKrpyOl7xqlo|PCaK!4mhrgr*y;-3XRuXf0bGrPcS$~nbkV*o;kH>{iD6owgT)N|PU zf{WpaB``t+0g>B6?x-yg+dPo(3e$Ynn;y$h35&-OOTy)10gOHoNpl$xQB17YfL&BT zs7F*YwUOgi8z=Y)fU`1$BS2xLNc&?37S*8yzbJ?t)c_SiW!dZ3a!JTwNZwtaLLkL) z#z0QsK_J42LFgWW|K(V8O)V{~pCUltjgc;6+U@H087=xS=&t2ktFp54<(1xF(nyHN zecO|Ke0;oJ2M^EZgb)EltxhX;-Pch`m`^>alV+0VZj5-t`?~w%sjc^LHyr=yW_NIL zX=#3bK5+Zme7)6{gq+-YmiJjfNonAXojp(Uw->%EX(xvTrP*+NT9ZvRDkx+n`~90X z_nIc6NvSreQfu5Xd%Gq}bJjB)&M)u3Iv|RD3IiY?geZMxB9Ng%V~ViAz_PIjQ5G0P zzo+ne=-rGO%a}P^B9FHGOyZFxt4zPI ziefSk1cXR&;(h^ubg@_w7D6(TXaYC4J|H49)NA2t9O_lV`K2Cs6hdYGbn@ zj>9V738H@;h@uROuVKO=i;0toT+ST7-u~4y+jhWqpW*u2O_IoOi5L&(KVYZ-ppW`S zLqj7ogjD@Q6<1hDMrRup8Zl65(4N% zD@1@n21Gy|GMp$R(Xpf~VSjxJ+rFbgqR7(o9oNlspEB(bSvLfO%WAPNl_3Vw*<8tE zqJ{_qONu23E%KKExwQw;_#IhmZ)c{)@Wj`1@B{fQA^%o?j|70ee?mm1@fg*vM1X+C zFaQj%5JO=hp;5!x!(+-#|A_3tEKGx|Gk4%>RmMrP!Y&G=3ZB8}S7=Yt^3-v0R%y^!?CX^y~fa(cSk4~~CuT9$vb+F*|p zWo-=!7F=v@Mi`YZ^#~OX8Cn#Rt2b3hs*K^>b?#i88umr-?&Z>Wq(4nc>&kQYFuTUz zkg+i!O*u0=Wb2r~MTO5x4Tw#!jyy(3*O$t|Fdf9p7>pU*eNM+^s6GggEc(V{R=1i7&6c6 zRj@UrFe0x(=X;3=ZN$X!5dJH58659$_PYgfGkGw{{xd?_ISDcZc`P?U-YW(MqJ5!h zoEj>@0JHr;lK5`?zRY+~$ZD4&?3e^@2KdO(;?_a}FQ;Q5ZRjQvl!Ua5fyot;`X|G0 ze}4fg{Sjkw--X}_i%H=P;voh`4>&NCFyvc)z%Z&V(sX-9a{GRA_50%2#?ahAvyrBrXE$&~oe818Yhi_`e^iHCNWEqV2W`nj;FRizdd65)9sAYQn=Yp&dSb?f*( zF8LoOq2ap}KKsLxsu<}iD+MHSxMNz?ztF+n-G8GRp~eg>F9bhTC0h4CNI z@fatq$M~51<3t?Zp|~1E5Mho5HhbDl>!$detFn?v5^3H7MGygly(hx|yT6y&d$~E8 zdx5pkkUz>`*v#FbP<(0*LVO^E6`GNbTB|s|R*t@MS~g}lZrZBfC|v=F&}A)b(@<~@ zMd*tmXfSe+sz7uwL>LP#9+?q~2nW1TJQ(|LSmZoVK|vcQ9(jDAUZ;RjduKSdmpax#6k%=#;qKY8=`&-%KwzyG(U za$sD%TTFEH;H8^CWC?ff%DHIT;eA?3RaNxr&rW|v#-C7S(_nD76dJxhE=65INiA?6 zNAYY8M?MBWEql7Xp{UovP_{H$yvS@J|0VzW%4{Z!zsac`Q{W#KeY(eqXQ1nVZYb!7 z2m0!1?)K~pw#nh0)H(ieh;UPU%=jpkSRjYWP-gU>U_0!-D|waAT+h{zOVGEyBVt_Y zuSO&pdav=h?+KxQlgIWSpG_Z!b>qyLUo#Lv5e9H@EdRpvH{m^X*Z*K{Gcb++gWAzE z|9_Y`Ind7*afVYg_`iC|rvu{*2s)HeLdwqf0z;-?TK_fr8b9fXn>HgRB;19b&2#Xv zqQdO6O0=}LKAz=&BQ==O{4Z92njc?k8H2-_^aJC@x3{+=+n4-S2m+`y3t+@BkRUywYBBlUp_#SbRuK)+mjSO?Qbteklu)bp+NvU z$pb?$zzeR-yo7^w6AELf=@L1jgWC8bcuhe#$LSs-@Kv4m5{X<`R+QG!`g3yx!^8_( zYH;lZL=kjJ%!Y_Ty-#4ZBxfYZIp>2_lM-0@X_v$+&Li_^a(Lr55{V_9wFRD))U_n7 z1%^|zWD8g2#m(UjA3Z!pdB%k$lHST~FM<2}6XuP_ouW^I0`N{sE50yle7SC4oqyXk zh6~&C4lWx{=sR%o^K08sjoTsiwn5wP?BT8_Cyv%niR2{3)rz0gQXXogdpUs;rWqoO zCsJXHbk!^_vCScKK7V~RM68a`9_9Upvi@#Q1MVgiAh8>x`8wpcCo=n1{>j+3j6rfn{o$ML(*jMM{bZ{Tak#A*W|>rJu0lwD!IJYZ1B#GaL@9M zTWeP;RR5mp+?Cou#eVta2C=f`#rYfL^h`bSeig#~;y9EQUqNv@*iPE)NOgtT{|w^f zbeNMR?hAfsrA*`@^azS_EK0bTf$M1uQNUs>5c!lh`BjFXS`|h<;C9@Aa5Xa`(DVws7zLC znDJ!@uE3)hRtU?B2XoE35dmo3dt z-^53Ery-Y?C@}01Em7ot$MXHGXgH4J#U+}K(SlU)_Qpl!&YOFl?O5)&%cZ<3Y;Hx6gAy|lgN!u!Qb$d}^P;MMJF*td`)$4GhKgH`nW{P0t1reb$-AY{t%6T0B-5nsRBnkr& z9~T#x7BY~l_o^CW>baPF$;lw`#l@U_o$mbbT*L4|$?rtah=&#>-{O?gfb5hDn7s!( zEGupZpd{YNsT`D?ez!BM4oGP^ru)$(b`rdB8pKQM(l-gp$9a&j!(-;xKbkVQr27hQ zk~S~~FIa2(YO=?Dq64|gQz3|_?Ii@btR)w9XF_d52{{PTMqSvPl*rQiif=Y_Nns?2 zJX%t!P3g5o+@5vs5NwLzjOkT9e!%Q>6vyfGs>rQtl2Yyp?^jrE?86K`TP-xYKD4Od zcxKw2al2BcXG`jd=v+h0vv$R`-^!1K?PFNVB6?ylYJda2HH&H~O50U%Ff|A|#i%ic zI&wrwc*84dvYx8Ay#3G+%Q_V(C~;)m{ZLvN2KwBp;?}1(q4R(_!W48^l2S3aim-EP zz7fJLz9;!D`h7`UQISQBkxi!&MM;Xpt|2I>Ak>ycWejYaqMxNL7qvAUe(w1OvSWn~ z8z5mE!Vk}Eii%2-o!=hOzk;V2MGwqJ2q^`F5MfE@M9t;l(-s+Jvf0xuLmf#fY(21u zM7m^C($xPT)+423#4AG}HJB%{6J@VTFq@i+TU_9_$A@Of{NNg*YF((pw)-cwNN1mA z%`RL_lvESMtjlq~z)s6Kr@pfEezN}Dc03wxIVK}p@-4FX{u#%>F0t$jUGc!bOp2dS zd;Zg}`1|*7f@$VYzPSg}{7Go2?2?1#49*%6zWlynuB2aqpyE`HUO5ruUXe)|tsmJN zoXkTD->=Sk^t@ZK1_&2CBVS7V?o%03Gvcl(Zz+M>@9(Eq7es}S5)G#&o-l7hP>P}j zb#?g$z3~2J@qdy)$WTxb)V)J|!z)k0>mf0;xbtlgCEZFHdDsKPvLJQ?@)cBsS5Sd` zFBj9&6qXNy@2nP6=6$^TEuu=B4e}YW3Z96UYc_>);Z#_VvY)qUvh`#nec3m=5td+w zQhdZTwJXk05t=Dzb8{nFcZ=ci1K$++We-_jX3Kl@q}=cg73WFFWT#B8*OziULdM}5 z#b=NInl9WTkYO!Bw4~1Kt4levBsQdP^p#YMdK|jXHgSOSEB}uRux(AqXAibQM@`gz zFKUJTHjcxaJgh!Nv{_RiLYne4_<|ibhY&$({DLuJHoETs2{TPUkcA~?k6ck(QM5pw zkis84EL}&kfYpE1x|hY6mO-9p;w;a!PuCfWJyOx!5r(jhKCrSG(CGmbI30g~jLuiw z+7wthvrj%R=x9MI+5x@>K)f;751(fyZ_W+)Yh7yy)p>;3s=Tk&?N?h`QX>~sZFg9w zD0m(3HyF4VxHgk1x8~1w$88#B?+{|XUaq`5$H1BMv72fYX)M!?b7hvENcv#`6J|kk zx2&QdE^p`6-iwkf_Y}I$@GQdyrxJcMS5nXj``rJVFY7Uz^AC1N`|ebi73ie6<_YvU1tGoaF4oh^Ll6N$6arLuA6rV5 zT}LYCzAoTnXelZOM>&rLsYGz}Uw`-THBUVOO2%LS(jFkl*B$7ZOx z30Gd8(o;$fmJ|iZyZomfUTITpkZ>&n?$?5|e~bfqEI9lelPQ$4c!`6HJ2MnmqC?1* zLy87tm|@X~)3gjWIGa6DKuoPzBn)3LE*v*p6=>C9>;m9tu&-UvaFCk|Jt|}50a{E! zA#a2k1_Q@R2!WPE`^M@mBALwnJQJ3=oYB5plT8pR{!SK* zL{3rC7`;4MQN4jrUda4%*gceaNV&Vo-!3i?7oID6>Bj2VlJ+*|Pb&l(iMgr&{v{(P zNT~S)ppBIkxvGT0?N6AT^w;C^cRJ@PU=rTQwd!088JxYYyhPOgh!M2+mhND!6~9<> ze%uxVnmb!lou-ta0e5_NJ^FCkaLl>gK@@57>b(ndTmi8pDxb+@99gMuH;(zEoRrjk z2A31YxFfz2cF-cDb7o4qq>dM%ax5)ROG#7!+=*gW?q#sM98=L~{J>sKL7`*46EWWe zTg~uKYw)bHRSG88hcw!}Sh?YpwH5a?z);C=Rr zw2prod{oFHOK5H-_A3+C7;c1Kcet=1x9e^IY@!pzX2IV00H=No>BJDrt$RFLmRQ4S zQa5Hig40wRFnTidkJ9ja=gLB{)WMYgG;Px{V}l92tZSrf#DO1{u8AOl+Q416ZP}lv0h41%5*ilP7 z$+V*Dj!TywEpaeqa?lSj*;lVwUp&00CTAJSS*7>X{c1k3#TF65m+M+Qx1co9-*HNl z!I?GmIo(Xj)lpESg*!AFZ_vdZN?2rMNr4>|Owc2M@tCrRYFy7#mj5e8)yic1im!AU zXJC$nzOgdDHOml#9E;dRSa8WihYlMFVNq^7zt##PEW`)`gN}V1a-VVrHSw-25#1dm z+7JQa5%KcA@iB9Ij?Wx%B?fOeM%s+g-VDy)>jPH`t1Fn>+GP7n>xd3}c(sd!>It^l z0An6t`Vp1I4A%TBM%vP%qU2!5?r$NmtHy78_HZ#>xsh@nB@S|fQ=w^Lc@@tcN#C^n3e#juz{LChh& z>O_>(hz-O6emoMW)d#vgL5JyN3ilJl7gpRQeoF+g+{-s2b0hIzpKv|wI(_d=$DFI{ z;>x<5v6_P!+{S>vr75ug9WcIq-C?) zy97+=$$c0E#v_aS0}=$ssZ~W$&sU0kiKqx0P;=U)$!C}>P6gzjhDTf*J@8mS;FhvL zw`&WiQMob!G{q$3Nasn3#sCU$3}!m~N$h!0f=+ZY1{=K#I8&&h|xoe z&K>IZiNKXLmIW-R-KJH!@s$)w8L3{=2cugT#MbTNH?rjE=8(2HEy|%eGCFeKvFbcv zOI=)2to-c_KK_0~%ll1ydysZrc7H;$xs3LyT-=KhB?fcc!#+5aH|6>Z&uo`xLI82- zM8;FUM^DuM{!tJ*zVOZH0B11c#w+lw<2+i1%PSk;ZAE0$3eQk5#~c7pw%6= zr0FQ|{YzLuf zHw)-5IgxutK#q=J{c(72;K`rE80>7>t~*xJcuIRTA|KtrH4gdWHdK&y{J7J4aifHe z4R|J!T#U-}0XFUi$;0x#jP*%8PF&IHx-$=sr$ZzpNc#6E^Icd0=~YyKmDi}o$7u7=wb!e58U z_Pm@V+5XjrgTL|idxZ9Hsnr^en4pxk%+f|67PVY5ne?HS3t`6KDE<(#PDz|}(9yk_ zy7sAr=7-80gxK2t{005ym4%oTm0@VHh51MjP(c9{T8T?^Qtv6Gh+^7Oe?+Cw#U_Jsm!!NTNAaZ&Cy`M?&`%0I zhpc&CM~-;9ozVtwGPM~=!KxsIx+vdZcy2K$0~e!HZ4ey5&!o_mgYdhdvj zdVtX;qG=)|k^%{|V?PfQPVb^0KoItE|MIl7lRb!(Ft1qzod}Bnk^KAWh_n75{WMB2%=v!VZt~GF`vX zXr)WT_2c$!nQeDW$06TU7Jty{th)0*WCdOr0i;Who|2NXTB{{0Cm~BMCy0#k~T9Wh1ni z%<+@~!U$sZ#1z%BR$Kh~R|tqk&?-?eHkJ-4w*@|XsHUbyi$p=?K1A(4Q+MCk3p$69 zA!Piui7MVjy)-@J9MS6o&e6v3`zc6bo7 zZ*rz7EcO+=m#^KkSyRK1M59)T3Zalxt3jhFiu_PAZJ9cb$lRBG=(3ZdClv%ENQqx5 zX1iN6vjPHn9nskRF6C-5&~}qc8Ff6x8R5h;Mn2cqnt#LCpIM;kb*4}*Tj}}ldAi}) z9(&X^PbW_|Q=>8RO~N9A_8*QcdxmtE)QF@)#F}b*`s-6c)4!8_bJoWCvC60)%CXsQ ziz{z?CY8j%J=t!_&sV-yzijzVT|yQOc_;wm0@FGr((!qk!xF2}86K)%8Rr!ihv8e9B4l$3)RjZ#T&m8eK;*x^ff$BUHMzuG^F znoH3kC2k5SUKV3IG4Vc@H7{bnPq?-AK)6JhK%-`(25mkAUp=>>A}(B?kQuF>aLL-2 z8I{b?K@xmry3Jje;6BM({gQsoC_O({Ow!d?HKO|g9oLto;Pty=Y! z>@WMJ|JCKlFKZt6@YAg*^|$!pIOXKvsMYDoDk>sYRu)n~iHeGDxUJj%kWYWUgc;^M zQJJ59yX(Z@rK>Hkhqu=aSTIPiU{{T) z&1QSv<)JTz!0NhyuQj})pb&i6sWso2_xZM|zBIrf#Qybp@zV{tkCKvj-CkK;Tl!lP z?*+e7u(}KZZNC%?0>Mvj>%?ZK?@88%((-WOwZ}`JKJdZlC^mXn+co43FLEe`1Sd#} z0)=34eX1Z=d)2KyvLEpVBTHbSo~RKA_hS8yZqy4rd}LD22pQQy%VnS+VZMh9&i8{5 zAGeb57n}%)*RSB^CqAI4C@jdmYrBGug4{2IjICuaE+Hf~MN%XvMA)Z=rDX}(?DUAb z=#eZdD{b$SORHTCSz23N-R2c_hvG_LqvVLTXc3^#mv?T?4r5~b%WBfXNDUf09wqMZ zXPm-TZV47FLX?Z5rjp3gG`&JMc)613A6(yjbY4!*b~e$3+;KdTLnPIKL1J}%YWLqV z$`d2NI(oxP-^{uY0mmWcx3}f(#gSucbaQ%F<_I=6#l-94%WIKOD~*mDD1?(pxh5wo zEUx;uw**v^;roFSf09F8`co;_88^SN2N73KDOrcGq6=$OuOYsDZ*O*yICXioHF-pC zaSTdzft^(x&W?gBIiWth?Q|^5WlY=qvtHUYFOEu+-?(bi3h;lHmvGBI4)Q%%JA3{*lRdH!w)|S{@ z5Y+u|Y|?Dwm%j-S2P;YMU}`{4(uLfyT0Y^%x?=gh8KrTv^r?=MaTe zP@lTAi%ZLY{w@joy5iyj;+E9q{VkRI@ZWrO`RRC_*3tdY`BSOY_uM)aQ9xxEBI4u8 ziHU)ASL8pKVS=ZoWOV3OBAXEf0X74?>_L7y)54&5noXJ4I{v49TcD89qIhGM^QtJS z+_o&81P~B8c^ZCT+Blh>uLn>y7u1#nCJ+&Y0fsOnWzazp1Pm`t0Th#CdwmKL2#BI{ ztf;EYau3#dW8R1&B7h7oF2Vu`q9l@7FKl(zBB}D>{6I;=K{QYpSwbqjnLbPkaK;9! zpOpOABYg}$lazHL{d0<_k2#RNN`EOz;oSe|Ifk5FG5na2>TRwM)f0(Pb} z|IpvT!T@8)@P{oR@cW!Acx6|lV7_o7(m)A;gv4^^D3K&GxvaFXk}HgW2=dpdc?F>$ z4#j!oiJrLfBJ+%70*!_VAPj>Gtn31vK{I|pgiRvi{M?=WPMJHZ!t0-=uJ-fQ9guq9 z=KvBY;OFU`ZdXAO$Y>hE6DUR38$T8p7(tOVQ;~j*mwG~?T&Ha~8*1ZJQUUCCcNhT& zW|P~M*Iigm6`oshJ&r{g6^EqW6Fj@@y2jI$-lIq2&)`SCIaG>Bm<|84KE9b3nHtbJi!3IMqvYq|NLNwJXbYb>>;KT9d&y)n`mpW01g)&7 z0tI%O)pt(vy?P=GIWpM&nEI4hgKb-SntG|gg@q&Yyk(v|fvfh3^s=Pg7Kk8%{mbRS z7=hn8Tv2`n)>7rzlyiKpn)8Uje5UX}fc+eII6KA`w);gn&#aX@Lo-_D$EH%4PkgLp zO?|xYX2@{E@yvLMS)}Rk=&GZJ5?tp4Z{OAVY~lbK+@ImMY|F3e#iGjj?seQAMt=T> zqvk9A`}^Vi=G2yTvEPhRmwQqX_LD|%hjMa85x)#wdzYte%k!jsLSS4J1|~)xbl|uL zFTeYI;rvbn7mGZeQ-Is~yF-elGVhCUF(LB?>zte-T)l<(KJBY?hh8hJqu zT-6VjhzyHJ{E!JBDIo+9=8*LwnBp=-ka*y3nnk^B*>v_d^!XMF2@WG92?+?n)nO1XUbk<; zIf-ykMfjyU@2 zaz1f#mC37)ar;!`PKh;PP(l(YfI#!>O73f0-uYWwPJA>GR**I})KBm4Kr2%{u4d*} z-TBAA?SuOb+LP&KTcCdOCJ^8dcDnU;O6|Esp+pc{Yu1fafa~k}TI%=!dC$OLvWZyu zdime(RCTu%KaNGB(UQdE)EHfyY*Bo?%L4B{=>w-AY zD1xy&xEICF6k$t;WHTs(+y~t%N@j9%Q zGkH>qa!h7FYmA%Q-ki2TA&EwISAvR^WB!R1Cs>B^_`JZxAw~d1x0s&A%q@BJ%+Kdt}Vy!5;UkLm%b#0eN4BK=bl_KPWH*#+QIDZ{67$r$*b}S$;QRFsX*l zK{06|o83{bKDY2HvrC0*T)=ehXqPK|laCzUkphHn?7Zs(s$at=i!Wh437VqcbrBCE zb7n><5|&+=)pqs;$Hs&Ni^%(0cNf>6k&6=RjAT85q|aqJjaG8z^Sp3PMt7#jq^M!k zy^ZL)n~|^k2eHE5vZ>e*TE1*fYdoVv-B1l7!MQ>gT>o73ZC=S|`))l22z>$pippP> zTy0->{xDV97oOQKe<~q4WT^@=1{@yQ{9ca`xp;cLKo4oJau#nV+wEl;dy29>FJ17z z6f))szgMlx<6I#ihBqwS&!RvwLvkdmJx&ZKnl3UxASrqJ)^KOrd>=6tbB;dZ&co|AxRp1y%MDLvi&lQxhTst6( zC7#_Hkx(II_$wdHFY+g3O{R5_R#Z$0Ct00uqV%;w<>`nditGz=tcs0|| zhcJv@s#Mf$wveM4581G=x;1bOu;B<6;3%>^YD5K)W2Pv|5cNaL^1|xAxRYr@A_*ea ziSZo1u=qe;hFp~N;L5^iM2du-AfM#ceb?&+Use{k{gj@j5+&U@@w}yA3@FBl#jk>6 zB?4m3F&zHPAQEV=_VkV{u`nSn148?8<&R-vQjb>N$=Nv9J>=Yj6mb zu2`P*nA*2fd;7wQQTQ8_?v26M66 zEh>*f0sQ>EqpkTA*SK5!+C)q}Rbe9?P+3GlNe z3oP=>^vd_;@gzUS*AhEhu=D%A0tF*NYR2#2;t3MwHFn~eeF~8;+54vFvxXytG+eCC zl{e(f{tFc3?UDf{@h$m@we}iDWQ5f5F)W}3y}?^@k6Fh_3&#xZNtq+;{{83SShs-9 zu5(6Bgu1-Ngz-zDNFmzT!pKUc3XJ|hQk&j5e|Vr2mEHw=KBotVN{$mU z?SxLQOWW={pkk6l{=TeLueV1=Msk@kj#=ze`n~S0FFuGzP*)plHbODk_zA^DqL4#) ztZyBsqHmQFHzb9#r|$ZGqj$aN5%W=|-nGa#lC{OV=lcchix^suKOd{P*Fi|T%VQ+9-m4`bvc8NxMlKLW46H}orW z?={}xyNicJpW8|d5K<_k6qo)k8rK}MRJO31Av)*uH_6bcj9xQT^h$VHXKYvpT}lW} zDedokROO@uuPTqz!}K-hidnp*&}zy1_U9gNN;$Ly5^&4ROpmJVgOdF3q`-KHdXY6r zD?h;TOQOUpv_Hrr_W$DoXw^lEj85nb8LcdPDjPEz31vj2%mk4#J1q80Icvu&9AkU; z6#eY(Wcu^k5=a+JXTDD`+46C4CLi2f{+Kigf@~Cu*))eQcQie?{Xg3NvaPP3?HY!G zLV@D$?(XieaJS;_uEnjmySqCScXwGh6o=yO?$0{TYrEfn@P3{%$=s5eWY5^g7}5Lq zM0Q-+C_X$&JYTqB|26CR00o1&o5(r_Y*4wnD5mHwg)U3s z;eS5z??3v>Wc2vFFDvi@T#1^O4sTZWEzP4VGQpiw3Ye|IbnSxWVTnK=aD8-L@NfUF zS{K{#>bJ{Axu+mAxFbWnMG~hMO>E-SAsyLTKtp;-GwES@!rjsGfoJfxrtu;)qepIY zvq?`cjrZnh!yj_D+&Hv3o=W7C<>xc3HP z^A!ex%3T>FedJZ>jWw^=0oEl_Rq(vXLXp~d_}iJZgJ+Ka*Q>@$r@wcIxdqhOPq}^? z*m6p$_Ju<>|E{PJhV6sx+z+s?Hi``ae|{BzIx=HQ3RS8k<8LG-0n%vm$dcYC4|L@p zOXq$!o$pV7RpDV7Hx$lNuv8in`MyL5_0s#=YlQx7f4&esA2|pO>QH$p|4P^&m-TR5 z0))D~z8SP1fRfF6u6u1vD+}I*|uwssmMes z&>XG>m)hucV0@T-u$M}_=oEXwl=yU@`J`H6)Da^hTeE*A_YBI@%HZPS+eJ0 zfbf)$_t>_gtdwp@GUT*=Rvht?XGC}_$>-n?q4DO#OS0MKz)DkTekn$L+GWv)6r5g9 zRW95ctQG3t8y<2=Ty7WJV7i@!6>q`HpjxZrTHOh(TC=57Z_RFJo<_>zon+T{F)D74 zCfM$Cr_bHVtTz8~xgTgu-QM>inUznfOKDRBivAfO9cmzyS-Zr787N$RCfaYAU}wMb zk8pTEx;gHK%V>8bgG-w+I{G`+)oy{Tf*MX0fZG{DTHGpN^rQeSy6hpeoN9-Ren3nfszG`-Z*2qi81m&>0rtonn;wF6pQRr#&z z`Jge2XN@;{#XmsrO$;8&#KU{K&So3+)A>+t-r%e+MHSGsHa0zI2i8Qm0rY=Fx}9As z0qQg*c*-8tyN}v*^%Q~gSn(!N790OKWOf(9S0+hFj&`M_QnYwaZDc>Ao$LSpNU%Eb zh_+PjL>u;~<@f}RO@OO#S!(IG5D)HaZZI?;gDM+o+4=E#>qg zz*5n8Vjm(9OMmCW1i{rn)p$}~e-7Q5%`Uisvfh3Z9i1koEuw@zoi+9%!DH7J;`hG? zabECo5g#p_y?b20x}wk>Y-Z<7ve84Ow&HA+BWck&>dmrkiaAM0tv7CRs>o1=0s|JMI@ofN*UIi<@ak&sBhNqS@$eUa zhb5;CQT9yW3$*9UfnIhsUjEU!eeT;Il++si;Yv?DY6Ir6eWaG_Lq3a>2Y=QoZyeCd zwG+8s9aMtW-jDKedsd2(kn+JC=_RTq9y6e27P?X{Ejj z8BFPdTUR0QHzH{PSRr*jZCcMkGE9LX`cz2)+|TL;s7A8f4OrDWNi$b~SEa(j8b|OC z6P&UFdt8apk=Ukxu=?-j80ECbMewBz`c#HW0U9>zc{i=oW>;?(Je@s8WHv+oCQaL(X-6!Gh#T1O#k4Xf}Q%lIgQcW zv@;Y)1oadvA^+6WYM*SJJ?y+az@yvj>>-Jdy09UqtVxYUt#-3vBAS#UGs^ktsQ;j> z(XerYaee0)eP$pJWe_o|<0Jb;P7q9w>H7}%`8XGj;{tgxH=lEPP(RYQNbDXXB$jdU zYyt>g>I4`TsJ>uo*yxaT-VVayD;z?)DHIIGkFO4hszUz1eVSmknfrwIPt52o4TdL4 zK3kk2b>8@BIfRHDzZ@HXrgJIz+!OgmI1p~jIRB)`>gkA>@n;OYB5Ex%s08yj<5DiH z47E&SdGNl0BH&I6!Bg#44$)K$uN#){k_{=qL!ui;9Z+KMe*BELcziHSg;JxCIlt`} z4Px(p;{R&cmj8LfO87M|!)X`X=g#TkM=n$T!R;XA68f|U*LKz;xmtIL(qu%`yP+4g zttn;6j18Y>+559VSuf(>liJN=4^MS@x{N~NbOBu1ag%RK$=RXH?K+>;H)H}+Obo+| z+Je=uGx=%t4zJ_KRZRgG)^_h$X67G_yD1uQ(={h{d0XGpnLfuE<}JHAWetldF;wKrdO*qP23*QfF(dMr5!$*ohv zKf2Cs>5LV7CfyV)cy(mDT{U~-JU~VSi#;oT4*1L%BD6OKA$aWq@+0PSu49s4o1&gPATv&JW~_ifuu z_Z|=q%L1|4jDPWhFg>d=Q^19&^w|Dl`MiY-3qgRGBG@>tWFTL-bcd%_ zz_k*zI@PJ?vH!NX$U~fG`_252jSeRpCWG--v1yYdya=kJndzLjBi5DPvDpwC@aE%! zzv)zX_qsDz zp_(!`m#%v@;9Js{xVGx{%E$FmqwkD}b*C54{o38W-zQD(Yh_M`-5?|fvKbQOEt{mrSNlg3^-oOhy>NFP<~aFKu_kWE_M8>DG%`k%)ziKM z%sO4)UMM&mipF*uBdEP7nRE`pj2rt1V3Fi%;}`Zv0&@`|Qa?BH985+Mb*_p6vq!Q? z43{*4-YQG!kVjS9^SgWGE=JVKPA+Lq;vr-61{U# zx$}WJE6!Hy^^0(6Rk_18A_b#SWI4Ez&{i_7!!@XO84JSIFyv@_j*#s@y|mZj*sgLzdvK*K2nQ3 zCfoFBwW=~;;>HwXKPksnOoJUHyj}JQX3%+@=SBr*kZ`}y$_!=4XT)pBFMxMf@!bWp z@cQ$*px2V1%9?W%K`Vb0dv^m@Y#i;zrM!(sUhhMJ1Y|HRKIQn_e$qeKwS;ei5%c{9 z86V+3ptO$j*y9qO`Il0=^ZT{;o8<|vNTed=7GyZ3+?>&A);i9u_#8)!p#vHgE-wtg zKGiIWG%`buHm~pax5es`hgEa#xVX8WpeGIIeR?P{%=3C|<3r8nB0{K0)a?4&@8$E6 z3wE+o;tG-P-fNbZcOXlJggO1p%*dM0tBR z-f1PS=3i6ruj;{uLJtg^(ccFkc~7m5RUIih>oQFtDaH&n$mF}h(fvUpyP$tE!*=td zmy))@rKxV;yOiGr9uz+)%2dlq?^p zCou~J5RiI0(X-w1N;G00D4JU2@?+?YjGhv-v9s5ka>#K?H3{|4%xDhSn3TvMbpNl;@7P9Y$0`wQH(*Pvl^ z*g$lA(tgUqN@Ci#~k~7|L+?`sNuBT~6g(h#oORNzP%mCl} z8!=0W_O)a3fB2^o+@zBGx{F0!{)zcz<1*>6 zvq&Mc?DreGOzQmOzr7`NqwyuFj58h$Yw!$#)Wdr9bIpGG-or0ySi%nIb$;e! zeh4-r^kEl^M|bEyx{KZVIP;wKwou`BnD>0SBLWt={O-`x)jv^h(K8$+87f#HpM&t< z(Nky&n85}L`O=itG5#!juh%%UHa76g6MSO)szV)hS|0gx^CyYX*?ik=Ys26x%l~(T zlU#aZVCOQUk+%MK=TZBuPAAN1NtF)8>$NI~12ggBHAr*^p`LQ*Ebn%XK!)6gr988} zLi~+KYO0>QALP8}^#Ta|Z6o z1ivJ&hH!kz^&(g|+30 zmG-ek?W0F==)Y0+|HnAfKF^LI-}!)^RBNz~^}I~G@ZW>~x;RW~fnAOgZTvrTf!g)# zeZ)liBAX5r!~Y`aenV#6(lg#d>Rm@}WXPQskos^oVual_8a@^D2vmL$!BtOkp=lky zuJ-+lGgAQX{|aH-hy4F4*f5d^F#Er@9K&$H|6f4@b4bnqHGmE8p8o&Omp{Pc8|gH^ z`Zj^niX*NkEULPKlSE&n1}jbJx>fJq0=?VG=xGWs^A8)1hCgUpwx3r2uU~FzeeO|N6ZOQmz;u7e>#!#BTDnI999ot2YGvqDy0?k)}XKi+_Lt9j6W-x|gD5_O#kh z1kFuHNh*F6o)&yQ+v~6E1-T5+{{+$$TfT3pOI3P#?nd+D>8etczM`-5oURpIiArN`*xTTZ@R1u z1y`zsRQA|2y*}!#By@VJX9fb-5}j}8xBZ=%eD$FkO}^U*3PcpR8|(!ArSAAgZu3_= zS2sy|9s26_)SCkUCS@^F$pNH0Hhwz1ScLy!I^CW3%Z2r1^@a6H|30bp9OW`kFF;i# z{FL<75p8s9dm_Ve8RZW`;=#yR|+1vh9>z>Pu%dFo|+w>oVR8>SyVC$c|>$-#4}+`v!}ap&hS~JuEF@MFB@SGPj^2dohe_eVTQG z16$<3v9u1C-tEj%Md+8^8HL6IUTB8za-~0%jE+NqylEv@p*s;cuS?0ODOK??-x5nd zVa{Z+7c`m9&4?3jahiBgt=$<(Q(-S>j@NFMqINiW-?F5l;hnH{==R!OZ!;|mO7JU# zTsGHzP9VvXa2kh0^;BS<-ysWWd5NVchaBm2dLDlDeCGX8#fsj%Zjhy<s zXvWfO{$mMICPmw_8YMyklu1cAvb3VEc50<7(it$TG1(|j=G);Q0+}EGn6?-;W+num zx!a8xHyd@2yMRei(sR=Ntip)$r2kxA!ZzxKHXsgmJ~@nNfQnjmz4QIQ`QZKEP^rtc z%}-{iXUIG(2py!LaedYi!tGh{^v6yKnON*K&kRT5{{D?PP2`c1*RusXZrApCGm{~} z5yl`?vGZJE&xxL*l;{y&G>AIAD7U*WSQ%%KU$Pzc#~+D+z<0$K^>U>3`9_B$7+lKm z@cn^)oM?B}MQA^yD2>$+mS=wg9GxBp1xes2?k*~?JLt=;RzD6IyT*Jn#G_Px!eYH$ zL?W5E2L-8rMKhL0(2TT1tH{>>h2!5=HAYOVV4LP(U= zobli`&S?pgAxJhH7b4?@1{zZsGWOh+>Gr7QOAe=9{=XZYsq=uk_Mq(T_wNqpJd?y= zH1r<#3-mdeA@WfqI`rkAehPN}p_$1s{4JKOo>r{84NN!wlceeIcK91NxH<~=JGpHE z7-m*OYEbTT5auNkmV)&uQ&)tAztF44J?V9yxT9ne>vi5;bNL4Trn#$L#pRP3jWZlw za=14(t;mz(7r$*N=x@J*+u;TT)K&ln|Iwz82IY0cozLxc-Q8j;Jcv8I^!#s)zwW#? zx)n_peGXM{>|y(T8`cYaJ#peD-~?)vak&!orwV(yk+_v*4FR~Ee&T@7{z4#UbFzBb zFDq4LHDVnX<$92}1BhP zc3BBDO%V`qyp1tmUTE4jVB7X`bOi`xu%_A?N0fO>f~z6!gHB3*UuZKnQ>R9%iijMdD)DA=Vc{a!v34EkC#HiV!e4=a952MPxfvXLJD?I zn$MOBz_Qy~X}`W)}2Onw0;c`L57-DFEk=>SEh*L@A)mAs-TcvUdnf!5Y+d- z&GlX1=lK^?2Bc3nmFJ64ul#msn8!I&Z~y6ULWN8JoTC;!0JNICm}1662UQPn$XgBQ z6`x5k)8J`9H<$hclWSNuch{ywxwt$IZryK)4w^UogqMJTp$T#V+dxff_r>q_meuGO z-7cqyD>ubYU2x!HB!im7?ew@3W_d<`9)mPeO83V3^Zw5SjOEY!f~a%vkFYKm!P|P5 z97qw-MI* zzj70X_z!`pD}KB90)%v{PN)z+Sny4OnllEbQzLk2u)luRzs00+&!Q6W{aHb#YVk>X z^rh_TZq4kLG2aEQ79S&Yy&lTqpFsb(P)k)1O*S*t>tA+@6|=JgEKsV(qjsCyOf85% zpddB>_LF#5CLKIcOP!`-TL|&&EG4t-R{cr>tpj{#JRCkYlXfUjcq9E%!Gx=J~b$*^-sT{RWdnirELcH#gph z#th^T8!;6IYs%JLK|)RKV4D3=hv|HBzhnXtDDaT}Et2yEx^$H-8F_zJwmZ9fE@fcfpQkVXyI?n(7wUoGM5CfoCwdR$#? zL5hZg=iIjob}kNPhY8!C)r@^yYm+ajf04qV!O`W#)H&EGLcKiqEy^T-#ETB&)F7H;0`A1Bj&nL6STm2D7*MvPnxNbpwH<5lvF# zE)2t~OAoK2a069B5-Cc$ZnTR5IylNEdg04;)%(BVNJSLsXo)#?xCVMsl;LgFnR>A@ z?DkcuRN}pGMe;2gR9qZ$c1JjuhT_g;X1c0zO=C|M+)%LGB$e+}d^uFuQ(|A#R>Nlj2KiIZxGWzo4rh$T&7drGvKhb?U41k+ zSw@IHS_ZSaBhJNJzj)2YWF#@hHnMw+4qE3LH|fv+PC2mmMj*3t)Wcx>TQ4IWg%!f4?&PFNAwxAY5rVd2PBq(oP2+sD9!=%n~ zt=lwu{hr_=tkzjv`1$!oiMXCrdAPgPr@gD$S>9A|6jQp(efC?K$Z-YPky=dEpS*JN zHblOIAB)-iQtQB&YTYaGM#2&fW72vLQYVBr9wj`{{%AH|2#k~i*I4Q??eK&i1>P`G zB7!;?RLUgSByxx!>YcH7V+QnnCqIlDc*dy5$=wdsdtQJ}q^Oo&sH#`%Lzy^@n%uKu zU33XBtX_rzpJ0YDqqYt4$>$@+m~#NUh<4R<7Moy&xX9}7IOi9|Gi;bru+FF$XFX$O z8WfKI-oE1U2rWOK!DQ`9N-N`dCd=6Te=+?{pvRoa8-FfV*joPO+7B=`$E4BP!%oWx zUsvvHY8Y>7Zk=Dl8Z?a&Lxu?M3i6OprIw$fq}miE!{wzZE)FgC^{2za=-J6#5BrFi`_CZSF1Mmn*x_eK^F5RaE+4?NoLLfrd=K_0ZdmTY=6SOeFO*6K5pQT z9JL|8ngweHw;VRILvk|z+Uj-Ve@x9)=M(y(9d`~4;`M_=IusHGO|KI`|4;MelOFQPuW zD?`;;7d)S6EK@dPc(|y-8f<^6?R9fz-{67@+mdr=yN3+!5FQXOrBFHMxS+Mh&np9F z3meg<8u>{c`&_|T%MX# z;M!ot8X

P3J#Js2Lo+eHotaJ|}NTXW@MGWrhrnGMwKf$8ER;<6(e{HC9Abid{rE@~o z{TX~lRQi*VaABnh52KZDefMnX_QfeykTu89T_l;er5GDDcL_Da+3(!VyZ>q&o7s@d zQ|K4iqFa~VU~G8BpCmum)z_Sx8A~CSRcwe0?NapDkLoDkbS1IQBS%u3rhsYg4IR9n z+(aoIT-8?18z|HbU!z9)0JLC;Mnc~bu4TV^U+U{JwXG4oO!k6{6Ei6rn0o~Us)jR{ z9sNKn@aVMjsMZ84xmf+qWs8Iq7s|m7iMppHhFFvf%rqQWb=}oe_3!HYiTVj(zHR4^_AVGMt9Yal zPIx^sW8mhTjm!GxiQsx$ATqc-O_9d0aM0=|gF!ZKoVLWbe!3#^!YU)FG)ee^chfO` zqm#tU3QwPEwCfzZEZ#F2O({lV%#j;=LEs;z8xFGqyg8U9$USn1i5PDASwwk~3Iwyc zH%mHWQ5Y{WdL)~y$*=BE8Pv?^siTh@GDI0J2Py6aA%$FuQ-;k1j7fIaPJzIvb5Evc zYI3&)-Zl2ES@HxS&Gl-`O2=xA=$7*IN9tj;-kXx=zyb4Jna)*g5?9hO8y#Do4Xs{? z12~M)3i4kZ7uY)oJv~D<&cy0g%fQSyPW7}GBq!8BZA6#nZ1p?bE5?iN1zmrZ850IdRQ(vGw z$n=4{ucD|m?7msce!)X4n`b+0qG7-m2#x<@SXcSDXT#CAIMS{#Rh~vDdt%;|$w8{W z>jcr6fh3vYf}W|ch{U#RtXyh<6@buoH@C32inMN>T8s4Z=R@Jkw(YMu+jMx4i}Px> zO)WUQ-Tj(_9R{(>F8~-;4BNOLEO4oca)~_uGJ#pIETfk~_I8M6jvE79x(qvw*M7e> zlY)(FGbkoAme+pWt#8|r{3*7Tn=1z~&FgtvpGUis68YKLl5{Ml5{0?fGhi?H45iMR zH0nZ*V2K?CLl4V@T@1EeMYRtP+C%b3C$ARpK)*DJkE3TNdo^ueHoX~dePgs`-0Co1rXj#mMl)A{wl7fhym#b>oTI4E!MbC6(_`FbtOG z{;VqZa*GiG-sE2fro|XWKU%4S7YvNoxDRLiFID>f+)V#<{(DIL-z+Tt#Q5Y6-f>8B z$@7}U8DW}?Rfh=;EF+EApw&jP3)*>gHOlN(!iA3y7#yJf@BJ9_z-2N-}fMQYvBjXrEUm)xyfKkw+hRs62zSOv>wsIm!kEEl5(=)tday8@sHP?X5C? z5&HP-tw!^2ew+YY;-%7lXk$(89f5?BDqn2Vdq7`O@&t0NucOeZ_2qqXfH5V=a^%%6 zCO1#*#9F3v#hf{>Lf)iGqhr|V@zs+=X)^=k;(EAlCzfmOZm&c^Id-V8!z<4*;*R*; zLGg>SLK6*!R+3f;KQ;G!9ZF_*MW$Zzd7!l{4-N>eiYhn!f8kZzeN!EWe< zn;_B5m`%LfVXYhF#BGSY+2OqsWUtNO4vGJUTzkiXV=m}gQ}XEd=1th%Fv4JF&&kay ziR}q{3sG^cfW81sZU=XH;W5+)qvmEUXp?Z974v%fWuGwHM!t2&9pyoARc4d)0cq6! zH@_bMhq%U>eJNdd(VLEoEE$8Sg=^}DUA=P2;^p^@3#>4*bE%%5AA>^EjOtB=8&)8d9QlVb-`U!rquNA-s%2D_dLX zkM3<_h@5FF?I2fxqYG7``Uh#4}7D^bZSa)4C`hs36uB~=ux3tkOBwR z`UXlOY);rzSz}8*6OVImU2s9J_^mK3QRJ}Od&V15_&;oDvu^sKrbAy|$l>ZW1AWc0 zk0qH^%>DBPTt(}o&B*n(P0g(A&TErbG=jNZWr_kzFjc`lQ9HU6lx0FA{Ea}+$912j zA1_-N8KgsUP{UROaS1r0Qqj4E*kT}e`el=X@iN^QBjl{Fs`?B{`kgtef3OSlQq<5C zfy@|f#c%KJyl{yz!3G<+UATHN1khjbG7%bg8`PZ3xLDVm1Fv6@ z@Seolv9rsu5wAjg6oiw_y)=UlUmKyTe|;JMVgXs2d*`cZ?{=`&#RQWDQfRMP8KKxM zQHHN3?zD>G27KvGY9B4OIPXf3T1Wp%M^NIWUB*tfeHI2wPG#Ebjb+>3%f+@>PtQiU zmKC4K(LW3 zmnfopMy43e(48phCnN&{!sMg6G--jIbIl?PkJ+o*EfLdh`fbGo3{h|?$2)jH%xsEK z+?|a{Ha66akxVDM6%D=%$P5U z0KVb}{XyM;W?`S!v0*=5N67!}> zzm;8mL_bOV7@hevqUSpMGbb!$Y&%R4&S?Z(n`2AHlw6@ArXpI{bfCZ$h4lFPX3Y^v zQBcN%zm*SG1NV_A_S`Wv9@G#sHk#;(FFt1jd!O@{X&bAmXh&D0^DsipBNErPHrP>5 zvuqM{n~EYMk86w|tPNbDKDsezBh0COXN%E@59iTrb669dwm7DpupNt>ut+Ae2Aq>6 zub94tYN$|5CuUGLbM>5fchufh3D25T{mdXgHBvc%wQi!SO2S}8B~_Z83!E$4#hN-g z(MtK;YikUx$n>8@Q0Pf*MzNa1vhhnDKU=US!C=cE{+9-noy0|$2Sa&z9qgXB8GC9?-2CEMEL zlV-xPV5Q%9KI%GerAANvE#E@^Sa^pBCqM#fV+Uk1z>w4-5)Q(B4BF{S%*0H0$(nmY z#YSEQDohfXz6qCS6XcZIbhfo`oeP_trlwblReM);{aGZ1eh(K)Uxr;NE+DdeNsuEo zF%{iKHanU%$ne)Rn2orrbdzUStKRQ^o(OJ>P=x>4BL*6GS zl}>DNu!{2ghg}Kxm@;G$&z9yjWv>pZnxx^UL^=)7jVoY$6OVS^CW-ftl{0Sa`4q{( z)5V>BNzkk+m$C3yWzhgz7A#7+6|>pDt0)K%u4p_}OIGjCIm~T_UCl#%oPb@tG*hxC ztmYmBNi+yDar!0kb7}*i8-1i0T@DkzT1OiA&XwHj!%*Wm0CM(ZNvcd)US0%2=44-c zo)l9B>oy}{*+*YeLFpP#UX07HFq4n0lq5_z7C3}EjUR62-0K=|`#mOEeq6@ZXB^(- zQYWlBd8qUY*EdYlFxX{K(S5JfF?02nS>lu;_nXtDsn|DwW1(Jv9AT9?IX-Gibuskz z*7u5`YeQhx)Vh_fRMzAG_HzsskyGHwS_%1v1?!$ZhYdN=Ofp=aM}LWgMJ5%wtG|r| zL)P)3qK_MJgo}R`u{%SERc7|l{W1$oCcL=122)}bfgu=Li6UwWB01My_!h0&cjGz^ zLC|p^=l^L+Qg{PW{_pd?tH?klu%aU(|pVwd4Nd%G>z1&QkHHzPby?{)X4 z`pXdbgO=*m`aBWRP{FtTv-qmc%cE%;JX(m@d4Dx@(M?scM7y^kEE(nl^LLw8Al<2)Xwv*NukT zjvfHkmPhU$q5@vMpSY=8b~dA?S=R=D?|XWZ*EQOd2>lmkUD`~W%R3Y^b8IYM*^)+h zdP%|No7EQYMD0RV-npGFD?P71nZQ;&6PZ-^iAm*|MnJ$~WPrS4oK3#ab8<;9G^h6| zYjRzay4&Nx<wFOb*NjxG0=dWcSGo^BoY=j7N}!n$psLLpFyK%Fj5&>}5`xAF5Q3YztltaG@_}y}%ZK zZ9TXxSWneQla~AbAlPpj&w5*r?7rOCP7934-<>W> za)}l3fZ1?f7zY*<51U85da;_kKR#&MXb6wOw+li8jI&Kv=^6=Pk`lG|T-LkP@|-xZ zSJ_?*>&?czuRwrd65}-s^%=f-$e_F+#{~XL-cf*R4;$iHIm>7I`jF<37%FJsBUN(h&h8 z<&eJn4|_lCSSMw5MPi!VDG`6nE_x;U)-lpp?&HS9y|0=k*3nxT9k$0 zeG@Y*p11SD(4^wwuU+)|DhF*;ptC}oq5D?p{&zdS-Rb92Ypj_y21wr^e!w#UIw|4i z{YN!`b1GurrjZwiRlq{Fby2lt{3b1AveL0m;Co<%fJX$hy7YsFhj{8C>h}`i8EoX+ zvs&6LNS^OeE5hv<+fW}h_7(sFPKRgTSU#B$_)%BvSi zZzUeAROm0p%uKwfU?e?fA&GZ2T~KcWma~^D9UBRc+p|t_gEr-j)W^Ph`IT2|RAZ+4 zA$;I0bWcUR+(*XMt3?2MtC~lCnr|;Thj#Vi!gnumjC){8W0?nkqpOXt^E^_2Ra$Lj zYy-5%90pIV9;NJJ8>wAX?|vCmW*z1R%N-vRtN@#|Sf z-SCixyB$n3SRCsgPGk~Qt?jGdwB0@ZL})&DRuk*5B;MOs#20r(48Gql3qH|?+yl?= zjH2bUkf8CFRGE&9xBQoXG^|m0;!{5CeX+$CiPEb&?y-GjMnFK&eSZS{)r z4tEHbVPEt$6AFwE=FI4wM8H99XC#n62dc$&uF=m@WxS+8pu3s4S1$%X!k~?Hbt8U% zz28NDz3)3}XMSCyyBR(7pk>YDSZb_GStOQUsAudN4>mtHHFw!F{Pc3nnWY4@ z$g5n6+mK8X0|QgnVK2d9>xinMCd?++!N7*zF}Y+H%`Y-Ax|0onMW`yNvF2;#-`piB z6^@URGi+@#zQ_Mi;UhNEt0rC{7a}jzmz_P<*<5>5*nr{#fc*_TT(I4NBB?c{vR=dQ z7b~q}d;FBF6y81ao$2d^CZJL3dWg+n+C?VF5)TxIxV>4;`q_8vjTjg6RKbUOhDVeE zhrrU2i?`70mGi*c1?NzH2eMfW`*>SRKJ)1U%8q}x1;+HW(aPIvKla@nLY0xiH!-ev z&vCWg;hqFdKl)qdo$6WD7?fMZRuVdj*`R}bzw}EQ+qO@OQ%z;{#95Sd^3V2{Tkoc{ zxSqX|dyv|9pY+i~imry=^=#RHgMxJrovpG=5RD}_0KAZ*^-UKlg)r>(w3J`)Ip;US zH^s$#8%Dzi=M;WWJdU=|$!2_k%d+F_LDX!l*9;IWP`mT373mQ;K|6M%QZ6k-?`O-f zSE!^|`*k2s@bk^;$8VNSmAJX%>r>$$#VSXSB37Ec+A`I*Z~BD4do7T4Qmx6}y1+(z zWXu$3;r_9CK+6twQe-+F>SV*b-@D@!D)!3%^e^sbOhYEZ8Q+NoEx3N0QsiiGtX*^c z)}nObq*N2qfw-f#^vRn#$4w>lr#h=H1EV$8^3uxrU=eWp6L;XTM?J=kVB8RYT55$P z98H<=?nxdT?EYvI&5c6VJRHSoy156Y$0!0&Hp$mz>eQ{c4yw894?;VGqkR8mY-Ad0 zV~>m`oBM-V1BkkBessw^goD9ug0vTna`uuYmE`x`PTt@b5^LuSOpF!#doGcA>mYA8pVaJS8BVEIpGrb2 z@5S&8K4t7*Zs_oW9Y=x&$X^B+rql_DV%;ZKwol7RiA*;L-wb$MenBZi;T`E=Tk?7d3C#a3T2%S z^be-q0fTzsVSoe&&imVkgQPXe>6>5oN{^pMnWsy+4TXhxyL@MF+Ss|nuCRyp#Ck8z z0TFQ8s^0dCDji~#OCrx+6u-zw7ZM^QOk)(;GiwNzXgcwD;+7JvhzGT00HrP#CcXUz z7wND$qOdOnIve~OqD0XusNql*=wq726!-$i1MVx%e zEMll#8E2JLjgBQhTF$A*dcHgPr0z>;pSPad3tit=8M=jJn2>2TeoQHXMF9u5HV`qb z_VzK9Ux5KNFc>AVf3&pAJy42^A&UAect_axnzUAeD5i}jjtfvS8Kv=-5WtW7i+TKl zZa_P?CiTmO;ff9y7Gg{B!B$J~U{+*JW}s@>f)P$`%h)7aofg|Ds!?w@+h}e>83=4k z=(8I6^uFEv>eA@>l$X@QaZ|K%^fRXBDa<+SF7W|WBZAjvKu`BTpK;Tu^vaGb zWQXa?chmLxLM^bJ;CGRTCWf2j$b}fzDnM^D`3%ygKdW&dxqBT8_5u2q8GbwC(jTu( zWBR(gg?q7?Z157D(X6#0_UeO34nxnwZrn6^cx1-Df#uV}X0bU^$jetqoN2hK<_Rs?joHnmnyr>YINDZmDKl zm+ElxB=LM2^^jF6c91K((6Y-XNLO|^Mk0JaP{i^r1Q$0fh@~ht7^Fw8CMs@P2z`&% zBbVpS1gtw}^Doi&#i^bBqU5$%rIEQYL-||BXfecHEdC)yRC}=PRc;|dbychQJ%2F@ zW_Hu}Qs?JKv03D|Yj5kOn&ScBLBhrg%{|PqYLnM8$A@;DuDA1HXtytcyJ9!VNNSHZ#tnHeF@4Ic;(Kia{RNF`Ta@5y~PK4ll z8oP_5ivF=%otNp$n~daPCtP)vAp+7gywUhWEAMstg#(OY-Tk3y-`U-)#H8}1j48th zF2^K66mcn;6%zICQf;1(dV-HS?(Kf&mCa+$NajP^aMVh(5gRq?eAKCLU?b_y%hLTeCUKm_2<4c{W$Ox$GH+-N$I(Z_Y^mpq zOUH}VG$6?4?-#gz>WxhVj7_zWbI~IzU%}snD8`8hTFixKc*+4K6o&)_oM)D0;XL~U zlSE4Qm@{&w$aUn1X>nxNiUat21D)S;Uijjd(8GcyBuDO-`zj}%Ts*y1w{n#I$6{%7 z5<6zN*%a7sFwhC>#}o@I0~HSMs#YFb-;mMqnlZ5U-}hhYwi#KN7FphOK1e@MPG6PB zuKfxTa``4eZI1+|Ove_&kki?^OZoAao8%L6)ip<5#$s6z2eg*raT^!Y(PVz+gV~Jp zr6|Le)XlK{uWQG>oi^SCd#;|Nmi0o?US&Xc6p3eeio5qF}jS*i$vGw<3WgEGLh#&$cdWz^xamDEU?Vo>c$_mJbGuDb404( zT1&njD}^_HMc|iTYO3!R9O#Bw?`IlVQI}5C2dNH)9K+a1MeF@hb>=XNPJHO}8uAl2 zNEiX+&N?);vxcQU0oM5>1Xdc477Pm2ae{`#=jxlYT`|?xS>&m`UK+URD z?TMfHiheq+!c(fu@CIytkZ1?(akYpGiwP*Y$ zLya8II~K4bN4&@#LjHP+$1x>7xd;dBY)nD{DBd26da3RFqL5?Z4RS_Qy|* zLP8>MhI{aI9*?8c4a_LN;A&eB*!dNF+dS*+$3Kt^!(fj%hysC)Ks6EJ=&rkSy9`{7K|@vdZuuSCkpBZ3!izHi From 03896ffad2fd5af5ca24926800633ecfe6b73661 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 10 May 2016 17:28:36 +1000 Subject: [PATCH 229/439] expand first mention of Windows Defender Advanced Threat Protection --- ...s-queue-windows-defender-advanced-threat-protection.md | 2 +- ...shboard-windows-defender-advanced-threat-protection.md | 2 +- ...privacy-windows-defender-advanced-threat-protection.md | 2 +- ...-alerts-windows-defender-advanced-threat-protection.md | 2 +- ...e-files-windows-defender-advanced-threat-protection.md | 2 +- ...achines-windows-defender-advanced-threat-protection.md | 2 +- ...-alerts-windows-defender-advanced-threat-protection.md | 3 +-- ...rements-windows-defender-advanced-threat-protection.md | 4 ++-- ...oarding-windows-defender-advanced-threat-protection.md | 2 +- ...nfigure-windows-defender-advanced-threat-protection.md | 8 ++++---- ...verview-windows-defender-advanced-threat-protection.md | 2 +- ...oarding-windows-defender-advanced-threat-protection.md | 2 +- ...ettings-windows-defender-advanced-threat-protection.md | 2 +- ...oarding-windows-defender-advanced-threat-protection.md | 8 ++++---- ...leshoot-windows-defender-advanced-threat-protection.md | 2 +- .../use-windows-defender-advanced-threat-protection.md | 3 ++- 16 files changed, 24 insertions(+), 24 deletions(-) diff --git a/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md b/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md index b6f5c0c088..d598f44125 100644 --- a/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md @@ -17,7 +17,7 @@ author: mjcaparas [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -As a security operations team member, you can manage Windows Defender ATP alerts as part of your routine activities. Alerts will appear in the respective queues according to their current status. +As a security operations team member, you can manage Windows Defender Advanced Threat Protection alerts as part of your routine activities. Alerts will appear in the respective queues according to their current status. To see a list of alerts, click any of the queues under the **Alerts queue** option in the navigation pane. diff --git a/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md b/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md index e55f55d13f..0bc814cded 100644 --- a/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md @@ -21,7 +21,7 @@ The **Dashboard** displays a snapshot of: - The latest active alerts on your network - Machines reporting - Top machines with active alerts -- The overall status of Windows Defender ATP for the past 30 days +- The overall status of Windows Defender Advanced Threat Protection for the past 30 days - Machines with active malware detections You can explore and investigate alerts and machines to quickly determine if, where, and when suspicious activities occurred in your network to help you understand the context they appeared in. diff --git a/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md index 36b6aa5b3f..5d49aaeb12 100644 --- a/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md @@ -18,7 +18,7 @@ ms.sitesec: library [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] This section covers some of the most frequently asked questions regarding privacy and data handling for Windows Defender ATP. -> **Note**  This document covers the information specific to the Windows Defender ATP service. Other data shared and stored by Windows Defender and Windows 10 is covered under the [Microsoft Privacy Statement](https://privacy.microsoft.com/en-us/privacystatement). See the [Windows 10 privacy FAQ for more information](http://windows.microsoft.com/en-au/windows-10/windows-privacy-faq). +> **Note**  This document covers the information specific to the Windows Defender ATP service. Other data shared and stored by Windows Defender and Windows 10 is covered under the [Microsoft Privacy Statement](https://privacy.microsoft.com/en-us/privacystatement). See the [Windows 10 privacy FAQ for more information](http://windows.microsoft.com/en-au/windows-10/windows-privacy-faq). ## What data does Windows Defender ATP collect? diff --git a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md index 43c25ad0dd..90719ac04e 100644 --- a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md @@ -16,7 +16,7 @@ ms.sitesec: library [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -Alerts in Windows Defender ATP indicate possible security breaches on endpoints in your organization. +Alerts in Windows Defender Advanced Threat Protection indicate possible security breaches on endpoints in your organization. There are three alert severity levels, described in the following table. diff --git a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md index 90383bc9b3..a4f830d411 100644 --- a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md @@ -58,7 +58,7 @@ Results of deep analysis are matched against threat intelligence and any matches Use the deep analysis feature to investigate the details of any file, usually during an investigation of an alert or for any other reason where you suspect malicious behavior. This feature is available in the context of the file view. -In the file's page, **Submit for deep analysis** is enabled when the file is available in the Windows Defender ATP backend sample collection or if it was observed on a Windows 10 machine that supports submitting to deep analysis. +In the file's page, **Submit for deep analysis** is enabled when the file is available in the Windows Defender Advanced Threat Protection backend sample collection or if it was observed on a Windows 10 machine that supports submitting to deep analysis. > **Note**  Only files from Windows 10 can be automatically collected. diff --git a/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md index ccd4c5269f..b378be249e 100644 --- a/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md @@ -88,7 +88,7 @@ When you investigate a specific machine, you'll see: - **Alerts related to this machine** - **Machine timeline** -The machine details, IP, and reporting sections display some attributes of the machine such as its name, domain, OS, IP address, and how long it's been reporting telemetry to the Windows Defender ATP service. +The machine details, IP, and reporting sections display some attributes of the machine such as its name, domain, OS, IP address, and how long it's been reporting telemetry to the Windows Defender Advanced Threat Protection service. The **Alerts related to this machine** section provides a list of alerts that are associated with the machine. This list is a simplified version of the [Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md), and shows the date that the alert was detected, a short description of the alert, the alert's severity, the alert's threat category, and the alert's status in the queue. diff --git a/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md index 8be3991989..9030f5baf3 100644 --- a/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md @@ -16,7 +16,7 @@ ms.sitesec: library [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -Windows Defender ATP notifies you of detected, possible attacks or breaches through alerts. A summary of new alerts is displayed in the **Dashboard**, and you can access all alerts in the **Alerts queue** menu. +Windows Defender Advanced Threat Protection notifies you of detected, possible attacks or breaches through alerts. A summary of new alerts is displayed in the **Dashboard**, and you can access all alerts in the **Alerts queue** menu. See the [Investigate Windows Defender ATP alerts](investigate-alerts-windows-defender-advanced-threat-protection.md#investigate-windows-defender-advanced-threat-protection-alerts) topic for more details on how to investigate alerts. @@ -138,4 +138,3 @@ Changes are indicated by a clock icon (![The changes icon looks like an analog c - [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) - [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md) - [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) - diff --git a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md index 0044cd4e74..994416c82c 100644 --- a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -29,7 +29,7 @@ service onboarding to manage user-based access to the [Windows Defender ATP port or email [winatp@microsoft.com](mailto:winatp@microsoft.com).--> When you run the onboarding wizard for the first time, you must choose -where your Windows Defender ATP-related information is stored: in either +where your Windows Defender Advanced Threat Protection-related information is stored: in either a European or United States datacenter. > **Notes**   @@ -49,7 +49,7 @@ Server and mobile versions of Windows are not supported. Internet connectivity on endpoints is also required. See [Configure Windows Defender ATP endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) - additional proxy configuration settings. + for additional proxy configuration settings. Before you configure endpoints, the telemetry and diagnostics service must be enabled. The service is enabled by default in Windows 10 TAP, but if it has been disabled you can turn it on by following the instructions in the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) section. diff --git a/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md index d5367bfeee..cf392f9b76 100644 --- a/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md @@ -17,7 +17,7 @@ author: mjcaparas [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -You can monitor the onboarding of the Windows Defender ATP service to ensure your endpoints are correctly configured and are sending telemetry reports. +You can monitor the onboarding of the Windows Defender Advanced Threat Protection service to ensure your endpoints are correctly configured and are sending telemetry reports. You might need to monitor the onboarding if the package did not configure the registry correctly, or the reporting client did not start or execute correctly. diff --git a/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md b/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md index 09216ea210..408d36c2fe 100644 --- a/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md @@ -2,14 +2,14 @@ title: Onboard endpoints and set up the Windows Defender ATP user access description: Set up user access in Azure Active Directory and use Group Policy or do manual registry changes to onboard endpoints to the service. keywords: onboarding, windows defender advanced threat protection onboarding, windows atp onboarding -search.product: eADQiWindows 10XVcnh +search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: iaanw --- -# Onboard and set up Windows Defender Advanced Threat Protection +# Onboard and set up Windows Defender Advanced Threat Protection **Applies to:** @@ -17,7 +17,7 @@ author: iaanw [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -You need to onboard to Windows Defender ATP before you can use the service. +You need to onboard to Windows Defender Advanced Threat Protection before you can use the service. - - [Understanding AppLocker rule collections](understanding-applocker-rule-collections.md) - An AppLocker rule collection is a set of rules that apply to one of the following types: executable files, Windows Installer files, scripts, DLLs, and packaged apps. - - [Understanding AppLocker rule condition types](understanding-applocker-rule-condition-types.md) - Rule conditions are criteria that the AppLocker rule is based on. Primary conditions are required to create an AppLocker rule. The three primary rule conditions are publisher, path, and file hash. - - [Understanding the publisher rule condition in AppLocker](understanding-the-publisher-rule-condition-in-applocker.md) - - [Understanding the path rule condition in AppLocker](understanding-the-path-rule-condition-in-applocker.md) - - [Understanding the file hash rule condition in AppLocker](understanding-the-file-hash-rule-condition-in-applocker.md) - - [Understanding AppLocker default rules](understanding-applocker-default-rules.md) - AppLocker includes default rules for each rule collection. These rules are intended to help ensure that the files that are required for Windows to operate properly are allowed in an AppLocker rule collection. - - [Executable rules in AppLocker](executable-rules-in-applocker.md) - - [Windows Installer rules in AppLocker](windows-installer-rules-in-applocker.md) - - [Script rules in AppLocker](script-rules-in-applocker.md) - - [DLL rules in AppLocker](dll-rules-in-applocker.md) - - [Packaged apps and packaged app installer rules in AppLocker](packaged-apps-and-packaged-app-installer-rules-in-applocker.md) - - [Understanding AppLocker rule exceptions](understanding-applocker-rule-exceptions.md) - You can apply AppLocker rules to individual users or a group of users. If you apply a rule to a group of users, all users in that group are affected by that rule. If you need to allow only a subset of a user group to use an application, you can create a special rule for that subset. - - [Understanding AppLocker rule behavior](understanding-applocker-rule-behavior.md) and [Understanding AppLocker allow and deny actions on Rules](understanding-applocker-allow-and-deny-actions-on-rules.md) - Each AppLocker rule collection functions as an allowed list of files. - ### Understanding AppLocker policies - An AppLocker policy is a set of rule collections and their corresponding configured enforcement settings that have been applied to one or more computers. - - [Understand AppLocker enforcement settings](understand-applocker-enforcement-settings.md) - Rule enforcement is applied only to collections of rules, not individual rules. AppLocker divides the rules into four collections: executable files, Windows Installer files, scripts, and DLL files. The options for rule enforcement are **Not configured**, **Enforce rules**, or **Audit only**. Together, all AppLocker rule collections compose the application control policy, or AppLocker policy. By default, if enforcement is not configured and rules are present in a rule collection, those rules are enforced. - ### Understanding AppLocker and Group Policy - Group Policy can be used to create, modify, and distribute AppLocker policies in separate objects or in combination with other policies. - - [Understand AppLocker rules and enforcement setting inheritance in Group Policy](understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md) - When Group Policy is used to distribute AppLocker policies, rule collections that are not configured will be enforced. Group Policy does not overwrite or replace rules that are already present in a linked Group Policy Object (GPO) and applies the AppLocker rules in addition to existing rules. AppLocker processes the explicit deny rule configuration before the allow rule configuration, and for rule enforcement, the last write to the GPO is applied. - ## Related topics - - [AppLocker technical reference](applocker-technical-reference.md) -   -   - - - - - diff --git a/windows/keep-secure/applocker-settings.md b/windows/keep-secure/applocker-settings.md index 03daf2f9c0..527922ad1c 100644 --- a/windows/keep-secure/applocker-settings.md +++ b/windows/keep-secure/applocker-settings.md @@ -2,23 +2,17 @@ title: AppLocker settings (Windows 10) description: This topic for the IT professional lists the settings used by AppLocker. ms.assetid: 9cb4aa19-77c0-4415-9968-bd07dab86839 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # AppLocker settings - - **Applies to** - - Windows 10 - This topic for the IT professional lists the settings used by AppLocker. - The following table describes the settings and values used by AppLocker. - @@ -61,19 +55,8 @@ The following table describes the settings and values used by AppLocker.
-   - ## Related topics - - [AppLocker technical reference](applocker-technical-reference.md) -   -   - - - - - diff --git a/windows/keep-secure/applocker-technical-reference.md b/windows/keep-secure/applocker-technical-reference.md index 417a1e29d0..415b5baa88 100644 --- a/windows/keep-secure/applocker-technical-reference.md +++ b/windows/keep-secure/applocker-technical-reference.md @@ -2,26 +2,18 @@ title: AppLocker technical reference (Windows 10) description: This overview topic for IT professionals provides links to the topics in the technical reference. ms.assetid: 2b2678f8-c46b-4e1d-b8c5-037c0be255ab +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # AppLocker technical reference - - **Applies to** - - Windows 10 - This overview topic for IT professionals provides links to the topics in the technical reference. - AppLocker advances the application control features and functionality of Software Restriction Policies. AppLocker contains new capabilities and extensions that allow you to create rules to allow or deny apps from running based on unique identities of files and to specify which users or groups can run those apps. - ## In this section - - @@ -76,14 +68,6 @@ AppLocker advances the application control features and functionality of Softwar
-   -   -   - - - - - diff --git a/windows/keep-secure/apply-a-basic-audit-policy-on-a-file-or-folder.md b/windows/keep-secure/apply-a-basic-audit-policy-on-a-file-or-folder.md index 23a70a9f8c..cf1717d5af 100644 --- a/windows/keep-secure/apply-a-basic-audit-policy-on-a-file-or-folder.md +++ b/windows/keep-secure/apply-a-basic-audit-policy-on-a-file-or-folder.md @@ -2,25 +2,18 @@ title: Apply a basic audit policy on a file or folder (Windows 10) description: You can apply audit policies to individual files and folders on your computer by setting the permission type to record successful access attempts or failed access attempts in the security log. ms.assetid: 565E7249-5CD0-4B2E-B2C0-B3A0793A51E2 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Apply a basic audit policy on a file or folder - - **Applies to** - - Windows 10 - You can apply audit policies to individual files and folders on your computer by setting the permission type to record successful access attempts or failed access attempts in the security log. - To complete this procedure, you must be logged on as a member of the built-in Administrators group or you must have been granted the **Manage auditing and security log** right. - **To apply or modify auditing policy settings for a local file or folder** - 1. 2.Right-click the file or folder that you want to audit, click **Properties**, and then click the **Security** tab. 2. Click **Advanced**. 3. In the **Advanced Security Settings** dialog box, click the **Auditing** tab, and then click **Continue**. @@ -28,28 +21,15 @@ To complete this procedure, you must be logged on as a member of the built-in Ad - To set up auditing for a new user or group, click **Add**. Click **Select a principal**, type the name of the user or group that you want, and then click **OK**. - To remove auditing for an existing group or user, click the group or user name, click **Remove**, click **OK**, and then skip the rest of this procedure. - To view or change auditing for an existing group or user, click its name, and then click **Edit.** - 5. In the **Type** box, indicate what actions you want to audit by selecting the appropriate check boxes: - To audit successful events, click **Success.** - To audit failure events, click **Fail.** - To audit all events, click **All.** - **Important**  Before setting up auditing for files and folders, you must enable object access auditing by defining auditing policy settings for the object access event category. If you do not enable object access auditing, you will receive an error message when you set up auditing for files and folders, and no files or folders will be audited. -   - ## Additional considerations - - - After object access auditing is enabled, view the security log in Event Viewer to review the results of your changes. - You can set up file and folder auditing only on NTFS drives. - Because the security log is limited in size, select the files and folders to be audited carefully. Also, consider the amount of disk space that you want to devote to the security log. The maximum size for the security log is defined in Event Viewer. -   -   - - - - - diff --git a/windows/keep-secure/audit-account-lockout.md b/windows/keep-secure/audit-account-lockout.md index 0731e562be..206ac496c6 100644 --- a/windows/keep-secure/audit-account-lockout.md +++ b/windows/keep-secure/audit-account-lockout.md @@ -2,30 +2,21 @@ title: Audit Account Lockout (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit Account Lockout, which enables you to audit security events that are generated by a failed attempt to log on to an account that is locked out. ms.assetid: da68624b-a174-482c-9bc5-ddddab38e589 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Account Lockout - - **Applies to** - - Windows 10 - Windows 10 Mobile - This topic for the IT professional describes the advanced security audit policy setting, **Audit Account Lockout**, which enables you to audit security events that are generated by a failed attempt to log on to an account that is locked out. - If you configure this policy setting, an audit event is generated when an account cannot log on to a computer because the account is locked out. Success audits record successful attempts and failure audits record unsuccessful attempts. - Account lockout events are essential for understanding user activity and detecting potential attacks. - Event volume: Low - Default setting: Success - @@ -44,19 +35,8 @@ Default setting: Success
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-application-generated.md b/windows/keep-secure/audit-application-generated.md index 5fac3e3ba7..23e33b3b6b 100644 --- a/windows/keep-secure/audit-application-generated.md +++ b/windows/keep-secure/audit-application-generated.md @@ -2,33 +2,22 @@ title: Audit Application Generated (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Application Generated, which determines whether the operating system generates audit events when applications attempt to use the Windows Auditing application programming interfaces (APIs). ms.assetid: 6c58a365-b25b-42b8-98ab-819002e31871 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Application Generated - - **Applies to** - - Windows 10 - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Application Generated**, which determines whether the operating system generates audit events when applications attempt to use the Windows Auditing application programming interfaces (APIs). - The following events can generate audit activity: - - Creation, deletion, or initialization of an application client context - - Application operations - Applications that are designed to use the Windows Auditing APIs can use this subcategory to log auditing events that are related to those APIs. The level, volume, relevance, and importance of these audit events depend on the application that generates them. The operating system logs the events as they are generated by the application. - Event volume: Depends on the installed app's use of the Windows Auditing APIs - Default: Not configured - @@ -59,19 +48,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-application-group-management.md b/windows/keep-secure/audit-application-group-management.md index 1dbeea62df..15d44e5eab 100644 --- a/windows/keep-secure/audit-application-group-management.md +++ b/windows/keep-secure/audit-application-group-management.md @@ -2,31 +2,21 @@ title: Audit Application Group Management (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit Application Group Management, which determines whether the operating system generates audit events when application group management tasks are performed. ms.assetid: 1bcaa41e-5027-4a86-96b7-f04eaf1c0606 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Application Group Management - - **Applies to** - - Windows 10 - This topic for the IT professional describes the advanced security audit policy setting, **Audit Application Group Management**, which determines whether the operating system generates audit events when application group management tasks are performed. - Application group management tasks include: - - An application group is created, changed, or deleted. - - A member is added to or removed from an application group. - Event volume: Low - Default: Not configured - @@ -81,19 +71,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-audit-policy-change.md b/windows/keep-secure/audit-audit-policy-change.md index 70984b9dcc..beb42d48f1 100644 --- a/windows/keep-secure/audit-audit-policy-change.md +++ b/windows/keep-secure/audit-audit-policy-change.md @@ -2,51 +2,32 @@ title: Audit Audit Policy Change (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Audit Policy Change, which determines whether the operating system generates audit events when changes are made to audit policy. ms.assetid: 7153bf75-6978-4d7e-a821-59a699efb8a9 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Audit Policy Change - - **Applies to** - - Windows 10 - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Audit Policy Change**, which determines whether the operating system generates audit events when changes are made to audit policy. - Changes to audit policy that are audited include: - - Changing permissions and audit settings on the audit policy object (by using **auditpol /set /sd**). - - Changing the system audit policy. - - Registering and unregistering security event sources. - - Changing per-user audit settings. - - Changing the value of **CrashOnAuditFail**. - - Changing audit settings on an object (for example, modifying the system access control list (SACL) for a file or registry key). - **Note**   SACL change auditing is performed when a SACL for an object has changed and the Policy Change category is configured. Discretionary access control list (DACL) and owner change auditing are performed when Object Access auditing is configured and the object's SACL is set for auditing of the DACL or owner change. -   - - Changing anything in the Special Groups list. - **Important**   Changes to the audit policy are critical security events. -   - Event volume: Low - Default: Success - @@ -108,19 +89,8 @@ Default: Success
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-audit-the-access-of-global-system-objects.md b/windows/keep-secure/audit-audit-the-access-of-global-system-objects.md index ead3ed4c81..d9e3f7d10d 100644 --- a/windows/keep-secure/audit-audit-the-access-of-global-system-objects.md +++ b/windows/keep-secure/audit-audit-the-access-of-global-system-objects.md @@ -2,52 +2,31 @@ title: Audit Audit the access of global system objects (Windows 10) description: Describes the best practices, location, values, and security considerations for the Audit Audit the access of global system objects security policy setting. ms.assetid: 20d40a79-ce89-45e6-9bb4-148f83958460 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit: Audit the access of global system objects - - **Applies to** - - Windows 10 - Describes the best practices, location, values, and security considerations for the **Audit: Audit the access of global system objects** security policy setting. - ## Reference - - If you enable this policy setting, a default system access control list (SACL) is applied when the device creates system objects such as mutexes, events, semaphores, and MS-DOS® devices. If you also enable the [Audit object access](basic-audit-object-access.md) audit setting, access to these system objects is audited. - Global system objects, also known as "base system objects" or "base named objects," are temporary kernel objects that have had names assigned to them by the application or system component that created them. These objects are most commonly used to synchronize multiple applications or multiple parts of a complex application. Because they have names, these objects are global in scope and, therefore, visible to all processes on the device. These objects all have a security descriptor; but typically, they do not have a NULL SACL. If you enable this policy setting and it takes effect at startup time, the kernel assigns a SACL to these objects when they are created. - The threat is that a globally visible named object, if incorrectly secured, might be acted on by a malicious program that knows the name of the object. For instance, if a synchronization object such as a mutex has a poorly constructed discretionary access control list (DACL), a malicious program can access that mutex by name and cause the program that created it to malfunction. However, the risk of this occurring is very low. - Enabling this policy setting can generate a large number of security events, especially on busy domain controllers and application servers. This might cause servers to respond slowly and force the security log to record numerous events of little significance. Auditing for access to global system objects is an all-or-nothing affair; there is no way to filter which events get recorded and which do not. Even if an organization has the resources to analyze events generated when this policy setting is enabled, it is unlikely to have the source code or a description of what each named object is used for; therefore, it is unlikely that many organizations could benefit from enabling this policy setting. - ### Possible values - - Enabled - - Disabled - - Not defined - ### Best practices - - Use the advanced security audit policy option, [Audit Kernel Object](audit-kernel-object.md) in Advanced Security Audit Policy Settings\\Object Access, to reduce the number of unrelated audit events that you generate. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -86,34 +65,19 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - A restart of the computer is required before this policy will be effective when changes to this policy are saved locally or distributed through Group Policy. - ### Group Policy - All auditing capabilities are integrated in Group Policy. You can configure, deploy, and manage these settings in the Group Policy Management Console (GPMC) or Local Security Policy snap-in for a domain, site, or organizational unit (OU). - ### Auditing - To audit attempts to access global system objects, you can use one of two security audit policy settings: - - [Audit Kernel Object](audit-kernel-object.md) in Advanced Security Audit Policy Settings\\Object Access - - [Audit object access](basic-audit-object-access.md) under Security Settings\\Local Policies\\Audit Policy - If possible, use the Advanced Security Audit Policy option to reduce the number of unrelated audit events that you generate. - If the [Audit Kernel Object](audit-kernel-object.md) setting is configured, the following events are generated: - @@ -144,11 +108,8 @@ If the [Audit Kernel Object](audit-kernel-object.md) setting is configured, the
-   - If the [Audit Kernel Object](audit-kernel-object.md) setting is configured, the following events are generated. - @@ -216,38 +177,17 @@ If the [Audit Kernel Object](audit-kernel-object.md) setting is configured, the
-   - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - A globally visible named object, if incorrectly secured, could be acted upon by malicious software by using the name of the object. For instance, if a synchronization object such as a mutex had a poorly chosen discretionary access control list (DACL), malicious software could access that mutex by name and cause the program that created it to malfunction. However, the risk of such an occurrence is very low. - ### Countermeasure - Enable the **Audit: Audit the access of global system objects** setting. - ### Potential impact - If you enable the **Audit: Audit the access of global system objects** setting, a large number of security events could be generated, especially on busy domain controllers and application servers. Such an occurrence could cause servers to respond slowly and force the Security log to record numerous events of little significance. This policy setting can only be enabled or disabled, and there is no way to choose which events are recorded from this setting. Even organizations that have the resources to analyze events that are generated by this policy setting are not likely to have the source code or a description of what each named object is used for. Therefore, it is unlikely that most organizations would benefit by enabling this policy setting. - To reduce the number of audit events generated, use the advanced audit policy. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-audit-the-use-of-backup-and-restore-privilege.md b/windows/keep-secure/audit-audit-the-use-of-backup-and-restore-privilege.md index ab4fd042a3..d028cb4d3e 100644 --- a/windows/keep-secure/audit-audit-the-use-of-backup-and-restore-privilege.md +++ b/windows/keep-secure/audit-audit-the-use-of-backup-and-restore-privilege.md @@ -2,46 +2,28 @@ title: Audit Audit the use of Backup and Restore privilege (Windows 10) description: Describes the best practices, location, values, and security considerations for the Audit Audit the use of Backup and Restore privilege security policy setting. ms.assetid: f656a2bb-e8d6-447b-8902-53df3a7756c5 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit: Audit the use of Backup and Restore privilege - - **Applies to** - - Windows 10 - Describes the best practices, location, values, and security considerations for the **Audit: Audit the use of Backup and Restore privilege** security policy setting. - ## Reference - - The **Audit: Audit the use of Backup and Restore privilege** policy setting determines whether to audit the use of all user rights, including Backup and Restore, when the **Audit privilege use** policy setting is configured. Enabling both policy settings generates an audit event for every file that is backed up or restored. - ### Possible values - - Enabled - - Disabled - - Not defined - ### Best practices - - Set **Audit: Audit the use of Backup and Restore privilege** to Disabled. Enabling this policy setting can generate a large number of security events, which might cause servers to respond slowly and force the security event log to record numerous events of little significance. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -80,55 +62,25 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. - ### Auditing - Enabling this policy setting in conjunction with the **Audit privilege use** policy setting records any instance of user rights that are being exercised in the security log. If **Audit privilege use** is enabled but **Audit: Audit the use of Backup and Restore privilege** is disabled, when users use backup or restore user rights, those events will not be audited. - Enabling this policy setting when the **Audit privilege use** policy setting is also enabled generates an audit event for every file that is backed up or restored. This can help you to track down an administrator who is accidentally or maliciously restoring data in an unauthorized manner. - Alternately, you can use the advanced audit policy, [Audit Sensitive Privilege Use](audit-sensitive-privilege-use.md), which can help you manage the number of events generated. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - When the backup and restore function is used, it creates a copy of the file system that is identical to the target of the backup. Making regular backup and restore volumes is an important part of your incident response plan. However, a malicious user could use a legitimate backup copy to gain access to information or to impersonate a legitimate network resource to compromise your enterprise. - ### Countermeasure - Enable the **Audit: Audit the use of Backup and Restore privilege** setting. Alternatively, implement automatic log backup by configuring the **AutoBackupLogFiles** registry key. If you enable this option when the [Audit privilege use](basic-audit-privilege-use.md) setting is also enabled, an audit event is generated for every file that is backed up or restored. This information could help you to identify an account that was used to accidentally or maliciously restore data in an unauthorized manner. - For more information about configuring this key, see Microsoft Knowledge Base article [100879](http://go.microsoft.com/fwlink/p/?LinkId=100879). - ### Potential impact - If you enable this policy setting, a large number of security events could be generated, which could cause servers to respond slowly and force the security event log to record numerous events of little significance. If you increase the security event log size to reduce the chances of a system shutdown, an excessively large log file may affect system performance. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-authentication-policy-change.md b/windows/keep-secure/audit-authentication-policy-change.md index 2a5dc7e290..81c47c8ea2 100644 --- a/windows/keep-secure/audit-authentication-policy-change.md +++ b/windows/keep-secure/audit-authentication-policy-change.md @@ -2,52 +2,32 @@ title: Audit Authentication Policy Change (Windows 10) description: This topic for the IT professional describes this Advanced Security Audit policy setting, Audit Authentication Policy Change, which determines whether the operating system generates audit events when changes are made to authentication policy. ms.assetid: aa9cea7a-aadf-47b7-b704-ac253b8e79be +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Authentication Policy Change - - **Applies to** - - Windows 10 - This topic for the IT professional describes this Advanced Security Audit policy setting, **Audit Authentication Policy Change**, which determines whether the operating system generates audit events when changes are made to authentication policy. - Changes made to authentication policy include: - - Creation, modification, and removal of forest and domain trusts. - - Changes to Kerberos policy under **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Kerberos Policy**. - **Note**   The audit event is logged when the policy is applied, not when settings are modified by the administrator. -   - - When any of the following user rights is granted to a user or group: - - **Access this computer from the network** - - **Allow logon locally** - - **Allow logon through Remote Desktop** - - **Logon as a batch job** - - **Logon as a service** - - Namespace collision, such as when an added trust collides with an existing namespace name. - This setting is useful for tracking changes in domain-level and forest-level trust and privileges that are granted to user accounts or groups. - Event volume: Low - Default: Success - @@ -98,19 +78,8 @@ Default: Success
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-authorization-policy-change.md b/windows/keep-secure/audit-authorization-policy-change.md index 0194d0a071..1a6ce8d810 100644 --- a/windows/keep-secure/audit-authorization-policy-change.md +++ b/windows/keep-secure/audit-authorization-policy-change.md @@ -2,31 +2,21 @@ title: Audit Authorization Policy Change (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Authorization Policy Change, which determines whether the operating system generates audit events when specific changes are made to the authorization policy. ms.assetid: ca0587a2-a2b3-4300-aa5d-48b4553c3b36 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Authorization Policy Change - - **Applies to** - - Windows 10 - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Authorization Policy Change**, which determines whether the operating system generates audit events when specific changes are made to the authorization policy. - Authorization policy changes that can be audited include: - - Assigning or removing user rights (privileges) such as **SeCreateTokenPrivilege**, except for the system access rights that are audited by using the [Audit Authentication Policy Change](audit-authentication-policy-change.md) subcategory. - - Changing the Encrypting File System (EFS) policy. - Event volume: Low - Default: Not configured - @@ -61,19 +51,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-central-access-policy-staging.md b/windows/keep-secure/audit-central-access-policy-staging.md index 61ee3a28e8..525c573cb3 100644 --- a/windows/keep-secure/audit-central-access-policy-staging.md +++ b/windows/keep-secure/audit-central-access-policy-staging.md @@ -2,25 +2,18 @@ title: Audit Central Access Policy Staging (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Central Access Policy Staging, which determines permissions on a Central Access Policy. ms.assetid: D9BB11CE-949A-4B48-82BF-30DC5E6FC67D +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Central Access Policy Staging - - **Applies to** - - Windows 10 - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Central Access Policy Staging**, which determines permissions on a Central Access Policy. - Event volume: Medium - Default: Not configured - @@ -39,19 +32,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-certification-services.md b/windows/keep-secure/audit-certification-services.md index ea8af0a656..4d94779c67 100644 --- a/windows/keep-secure/audit-certification-services.md +++ b/windows/keep-secure/audit-certification-services.md @@ -2,51 +2,31 @@ title: Audit Certification Services (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Certification Services, which determines whether the operating system generates events when Active Directory Certificate Services (AD CS) operations are performed. ms.assetid: cdefc34e-fb1f-4eff-b766-17713c5a1b03 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Certification Services - - **Applies to** - - Windows 10 - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Certification Services**, which determines whether the operating system generates events when Active Directory Certificate Services (AD CS) operations are performed. - Examples of AD CS operations include: - - AD CS starts, shuts down, is backed up, or is restored. - - Certificate revocation list (CRL)-related tasks are performed. - - Certificates are requested, issued, or revoked. - - Certificate manager settings for AD CS are changed. - - The configuration and properties of the certification authority (CA) are changed. - - AD CS templates are modified. - - Certificates are imported. - - A CA certificate is published to Active Directory Domain Services. - - Security permissions for AD CS role services are modified. - - Keys are archived, imported, or retrieved. - - The OCSP Responder Service is started or stopped. - Monitoring these operational events is important to ensure that AD CS role services are functioning properly. - Event volume: Low to medium on servers that host AD CS role services - Default: Not configured - @@ -185,19 +165,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-computer-account-management.md b/windows/keep-secure/audit-computer-account-management.md index a461349a08..60524de373 100644 --- a/windows/keep-secure/audit-computer-account-management.md +++ b/windows/keep-secure/audit-computer-account-management.md @@ -2,27 +2,19 @@ title: Audit Computer Account Management (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit Computer Account Management, which determines whether the operating system generates audit events when a computer account is created, changed, or deleted. ms.assetid: 6c406693-57bf-4411-bb6c-ff83ce548991 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Computer Account Management - - **Applies to** - - Windows 10 - This topic for the IT professional describes the advanced security audit policy setting, **Audit Computer Account Management**, which determines whether the operating system generates audit events when a computer account is created, changed, or deleted. - This policy setting is useful for tracking account-related changes to computers that are members of a domain. - Event volume: Low - Default: Not configured - @@ -49,19 +41,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-credential-validation.md b/windows/keep-secure/audit-credential-validation.md index 3a0818f62d..add71830c8 100644 --- a/windows/keep-secure/audit-credential-validation.md +++ b/windows/keep-secure/audit-credential-validation.md @@ -2,34 +2,23 @@ title: Audit Credential Validation (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit Credential Validation, which determines whether the operating system generates audit events on credentials that are submitted for a user account logon request. ms.assetid: 6654b33a-922e-4a43-8223-ec5086dfc926 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Credential Validation - - **Applies to** - - Windows 10 - Windows 10 Mobile - This topic for the IT professional describes the advanced security audit policy setting, **Audit Credential Validation**, which determines whether the operating system generates audit events on credentials that are submitted for a user account logon request. - These events occur on the computer that is authoritative for the credentials as follows: - - For domain accounts, the domain controller is authoritative. - - For local accounts, the local computer is authoritative. - Event volume: High on domain controllers - Because domain accounts are used much more frequently than local accounts in enterprise environments, most of the Account Logon events in a domain environment occur on the domain controllers that are authoritative for the domain accounts. However, these events can occur on any computer, and they may occur in conjunction with or on separate computers from Logon and Logoff events. - Default: Not configured - @@ -64,19 +53,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-detailed-directory-service-replication.md b/windows/keep-secure/audit-detailed-directory-service-replication.md index 058f7ae1f1..99ff8d4881 100644 --- a/windows/keep-secure/audit-detailed-directory-service-replication.md +++ b/windows/keep-secure/audit-detailed-directory-service-replication.md @@ -2,27 +2,19 @@ title: Audit Detailed Directory Service Replication (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit Detailed Directory Service Replication, which determines whether the operating system generates audit events that contain detailed tracking information about data that is replicated between domain controllers. ms.assetid: 1b89c8f5-bce7-4b20-8701-42585c7ab993 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Detailed Directory Service Replication - - **Applies to** - - Windows 10 - This topic for the IT professional describes the advanced security audit policy setting, **Audit Detailed Directory Service Replication**, which determines whether the operating system generates audit events that contain detailed tracking information about data that is replicated between domain controllers. - This audit subcategory can be useful to diagnose replication issues. - Event volume: These events can create a very high volume of event data. - Default: Not configured - @@ -69,19 +61,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-detailed-file-share.md b/windows/keep-secure/audit-detailed-file-share.md index fc3a48ffb3..b4376be5d3 100644 --- a/windows/keep-secure/audit-detailed-file-share.md +++ b/windows/keep-secure/audit-detailed-file-share.md @@ -2,32 +2,22 @@ title: Audit Detailed File Share (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Detailed File Share, which allows you to audit attempts to access files and folders on a shared folder. ms.assetid: 60310104-b820-4033-a1cb-022a34f064ae +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Detailed File Share - - **Applies to** - - Windows 10 - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Detailed File Share**, which allows you to audit attempts to access files and folders on a shared folder. - The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client computer and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. - **Note**   There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared files and folders on the system is audited. -   - Event volume: High on a file server or domain controller because of SYSVOL network access required by Group Policy - Default: Not configured - @@ -46,19 +36,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-directory-service-access.md b/windows/keep-secure/audit-directory-service-access.md index 5977f8db1c..7448d1b505 100644 --- a/windows/keep-secure/audit-directory-service-access.md +++ b/windows/keep-secure/audit-directory-service-access.md @@ -2,32 +2,22 @@ title: Audit Directory Service Access (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit Directory Service Access, which determines whether the operating system generates audit events when an Active Directory Domain Services (AD DS) object is accessed. ms.assetid: ba2562ba-4282-4588-b87c-a3fcb771c7d0 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Directory Service Access - - **Applies to** - - Windows 10 - This topic for the IT professional describes the advanced security audit policy setting, **Audit Directory Service Access**, which determines whether the operating system generates audit events when an Active Directory Domain Services (AD DS) object is accessed. - These events are similar to the Directory Service Access events in previous versions of the Windows Server operating systems. - **Important**   Audit events are generated only on objects with configured system access control lists (SACLs), and only when they are accessed in a manner that matches the SACL settings. -   - Event volume: High on servers running AD DS role services; none on client computers - Default: Not configured - @@ -46,19 +36,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-directory-service-changes.md b/windows/keep-secure/audit-directory-service-changes.md index 5eb81446dc..a474407c2f 100644 --- a/windows/keep-secure/audit-directory-service-changes.md +++ b/windows/keep-secure/audit-directory-service-changes.md @@ -2,46 +2,29 @@ title: Audit Directory Service Changes (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit Directory Service Changes, which determines whether the operating system generates audit events when changes are made to objects in Active Directory Domain Services (AD DS). ms.assetid: 9f7c0dd4-3977-47dd-a0fb-ec2f17cad05e +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Directory Service Changes - - **Applies to** - - Windows 10 - This topic for the IT professional describes the advanced security audit policy setting, **Audit Directory Service Changes**, which determines whether the operating system generates audit events when changes are made to objects in Active Directory Domain Services (AD DS). - The types of changes that are reported are: - - Create - - Delete - - Modify - - Move - - Undelete - Directory Service Changes auditing, where appropriate, indicates the old and new values of the changed properties of the objects that were changed. - **Important**   Audit events are generated only for objects with configured system access control lists (SACLs), and only when they are accessed in a manner that matches their SACL settings. Some objects and properties do not cause audit events to be generated due to settings on the object class in the schema. -   - This subcategory only logs events on domain controllers. Changes to Active Directory objects are important events to track in order to understand the state of the network policy. - Event volume: High on domain controllers; none on client computers - Default: Not configured - @@ -76,19 +59,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-directory-service-replication.md b/windows/keep-secure/audit-directory-service-replication.md index c316768163..907f50fda7 100644 --- a/windows/keep-secure/audit-directory-service-replication.md +++ b/windows/keep-secure/audit-directory-service-replication.md @@ -2,25 +2,18 @@ title: Audit Directory Service Replication (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit Directory Service Replication, which determines whether the operating system generates audit events when replication between two domain controllers begins and ends. ms.assetid: b95d296c-7993-4e8d-8064-a8bbe284bd56 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Directory Service Replication - - **Applies to** - - Windows 10 - This topic for the IT professional describes the advanced security audit policy setting, **Audit Directory Service Replication**, which determines whether the operating system generates audit events when replication between two domain controllers begins and ends. - Event volume: Medium on domain controllers; none on client computers - Default: Not configured - @@ -43,19 +36,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-distribution-group-management.md b/windows/keep-secure/audit-distribution-group-management.md index 7dcf6a5049..91c5876a9c 100644 --- a/windows/keep-secure/audit-distribution-group-management.md +++ b/windows/keep-secure/audit-distribution-group-management.md @@ -2,38 +2,25 @@ title: Audit Distribution Group Management (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Distribution Group Management, which determines whether the operating system generates audit events for specific distribution-group management tasks. ms.assetid: d46693a4-5887-4a58-85db-2f6cba224a66 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Distribution Group Management - - **Applies to** - - Windows 10 - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Distribution Group Management**, which determines whether the operating system generates audit events for specific distribution-group management tasks. - Tasks for distribution-group management that can be audited include: - - A distribution group is created, changed, or deleted. - - A member is added to or removed from a distribution group. - This subcategory to which this policy belongs is logged only on domain controllers. - **Note**   Distribution groups cannot be used to manage access control permissions. -   - Event volume: Low - Default: Not configured - @@ -104,19 +91,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-dpapi-activity.md b/windows/keep-secure/audit-dpapi-activity.md index 310cb480c6..0d82bf9af5 100644 --- a/windows/keep-secure/audit-dpapi-activity.md +++ b/windows/keep-secure/audit-dpapi-activity.md @@ -2,30 +2,21 @@ title: Audit DPAPI Activity (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit DPAPI Activity, which determines whether the operating system generates audit events when encryption or decryption calls are made into the data protection application interface (DPAPI). ms.assetid: be4d4c83-c857-4e3d-a84e-8bcc3f2c99cd +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit DPAPI Activity - - **Applies to** - - Windows 10 - Windows 10 Mobile - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit DPAPI Activity**, which determines whether the operating system generates audit events when encryption or decryption calls are made into the data protection application interface (DPAPI). - DPAPI is used to protect secret information such as stored passwords and key information. For more information about DPAPI, see [Windows Data Protection](http://go.microsoft.com/fwlink/p/?linkid=121720) (http://go.microsoft.com/fwlink/p/?linkid=121720). - Event volume: Low - Default: Not configured - If this policy setting is configured, the following events appear on computers running the supported versions of the Windows operating system as designated in the **Applies To** list at the beginning of this topic, in addition to Windows Server 2008 and Windows Vista. - @@ -56,19 +47,8 @@ If this policy setting is configured, the following events appear on computers r
-   - ## Related resource - - [Advanced Security Audit Policy Settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-file-share.md b/windows/keep-secure/audit-file-share.md index 9eb592c046..e1d039ce4d 100644 --- a/windows/keep-secure/audit-file-share.md +++ b/windows/keep-secure/audit-file-share.md @@ -2,34 +2,23 @@ title: Audit File Share (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit File Share, which determines whether the operating system generates audit events when a file share is accessed. ms.assetid: 9ea985f8-8936-4b79-abdb-35cbb7138f78 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit File Share - - **Applies to** - - Windows 10 - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit File Share**, which determines whether the operating system generates audit events when a file share is accessed. - Audit events are not generated when shares are created, deleted, or when share permissions change. - **Note**   There are no system access control lists (SACLs) for shares; therefore, after this setting is enabled, access to all shares on the system will be audited. -   - Combined with File System auditing, File Share auditing enables you to track what content was accessed, the source (IP address and port) of the request, and the user account that was used for the access. - Event volume: High on a file server or domain controller (due to SYSVOL access by client computers for policy processing) - Default: Not configured - @@ -71,19 +60,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-file-system.md b/windows/keep-secure/audit-file-system.md index 66dfba0a30..1eaab87e2c 100644 --- a/windows/keep-secure/audit-file-system.md +++ b/windows/keep-secure/audit-file-system.md @@ -2,34 +2,23 @@ title: Audit File System (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit File System, which determines whether the operating system generates audit events when users attempt to access file system objects. ms.assetid: 6a71f283-b8e5-41ac-b348-0b7ec6ea0b1f +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit File System - - **Applies to** - - Windows 10 - Windows 10 Mobile - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit File System**, which determines whether the operating system generates audit events when users attempt to access file system objects. - Audit events are generated only for objects that have configured system access control lists (SACLs), and only if the type of access requested (such as Write, Read, or Modify) and the account making the request match the settings in the SACL. - If success auditing is enabled, an audit entry is generated each time any account successfully accesses a file system object that has a matching SACL. If failure auditing is enabled, an audit entry is generated each time any user unsuccessfully attempts to access a file system object that has a matching SACL. - These events are essential for tracking activity for file objects that are sensitive or valuable and require extra monitoring. - Event volume: Varies, depending on how file system SACLs are configured - No audit events are generated for the default file system SACLs. - Default: Not configured - @@ -56,19 +45,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-filtering-platform-connection.md b/windows/keep-secure/audit-filtering-platform-connection.md index eac628b63b..4931fa3cd4 100644 --- a/windows/keep-secure/audit-filtering-platform-connection.md +++ b/windows/keep-secure/audit-filtering-platform-connection.md @@ -2,37 +2,24 @@ title: Audit Filtering Platform Connection (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Filtering Platform Connection, which determines whether the operating system generates audit events when connections are allowed or blocked by the Windows Filtering Platform. ms.assetid: d72936e9-ff01-4d18-b864-a4958815df59 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Filtering Platform Connection - - **Applies to** - - Windows 10 - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Filtering Platform Connection**, which determines whether the operating system generates audit events when connections are allowed or blocked by the Windows Filtering Platform. - Windows Filtering Platform (WFP) enables independent software vendors (ISVs) to filter and modify TCP/IP packets, monitor or authorize connections, filter Internet Protocol security (IPsec)-protected traffic, and filter remote procedure calls (RPCs). - This security policy enables you to audit the following types of actions: - - The Windows Firewall service blocks an application from accepting incoming connections on the network. - - The Windows Filtering Platform allows or blocks a connection. - - The Windows Filtering Platform permits or blocks a bind to a local port. - - The Windows Filtering Platform permits or blocks an application or service from listening for incoming connections on a port. - Event volume: High - Default: Not configured - @@ -87,19 +74,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-filtering-platform-packet-drop.md b/windows/keep-secure/audit-filtering-platform-packet-drop.md index 2390c68fdd..e9afd9f620 100644 --- a/windows/keep-secure/audit-filtering-platform-packet-drop.md +++ b/windows/keep-secure/audit-filtering-platform-packet-drop.md @@ -2,29 +2,20 @@ title: Audit Filtering Platform Packet Drop (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Filtering Platform Packet Drop, which determines whether the operating system generates audit events when packets are dropped by the Windows Filtering Platform. ms.assetid: 95457601-68d1-4385-af20-87916ddab906 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Filtering Platform Packet Drop - - **Applies to** - - Windows 10 - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Filtering Platform Packet Drop**, which determines whether the operating system generates audit events when packets are dropped by the Windows Filtering Platform. - Windows Filtering Platform (WFP) enables independent software vendors (ISVs) to filter and modify TCP/IP packets, monitor or authorize connections, filter Internet Protocol security (IPsec)-protected traffic, and filter remote procedure calls (RPCs). - A high rate of dropped packets may indicate that there have been attempts to gain unauthorized access to computers on your network. - Event volume: High - Default setting: Not configured - @@ -47,19 +38,8 @@ Default setting: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-filtering-platform-policy-change.md b/windows/keep-secure/audit-filtering-platform-policy-change.md index 98335becd4..07394011e0 100644 --- a/windows/keep-secure/audit-filtering-platform-policy-change.md +++ b/windows/keep-secure/audit-filtering-platform-policy-change.md @@ -2,37 +2,24 @@ title: Audit Filtering Platform Policy Change (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Filtering Platform Policy Change, which determines whether the operating system generates audit events for certain IPsec and Windows Filtering Platform actions. ms.assetid: 0eaf1c56-672b-4ea9-825a-22dc03eb4041 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Filtering Platform Policy Change - - **Applies to** - - Windows 10 - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Filtering Platform Policy Change**, which determines whether the operating system generates audit events for certain IPsec and Windows Filtering Platform actions. - Windows Filtering Platform (WFP) enables independent software vendors (ISVs) to filter and modify TCP/IP packets, monitor or authorize connections, filter Internet Protocol security (IPsec)-protected traffic, and filter remote procedure calls (RPCs). - This security policy setting determines whether the operating system generates audit events for: - - IPsec services status. - - Changes to IPsec settings. - - Status and changes to the Windows Filtering Platform engine and providers. - - IPsec Policy Agent service activities. - Event volume: Low - Default: Not configured - @@ -221,19 +208,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-force-audit-policy-subcategory-settings-to-override.md b/windows/keep-secure/audit-force-audit-policy-subcategory-settings-to-override.md index 4ebdec9654..dd5a17ef22 100644 --- a/windows/keep-secure/audit-force-audit-policy-subcategory-settings-to-override.md +++ b/windows/keep-secure/audit-force-audit-policy-subcategory-settings-to-override.md @@ -2,46 +2,28 @@ title: Audit Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings (Windows 10) description: Describes the best practices, location, values, and security considerations for the Audit Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings security policy setting. ms.assetid: 8ddc06bc-b6d6-4bac-9051-e0d77035bd4e +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings - - **Applies to** - - Windows 10 - Describes the best practices, location, values, and security considerations for the **Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings** security policy setting. - ## Reference - - You can manage your audit policy in a more precise way by using audit policy subcategories. - There are over 40 auditing subcategories that provide precise details about activities on a device. For info about these subcategories, see the [Advanced security audit policy settings](advanced-security-audit-policy-settings.md). - ### Possible values - - Enabled - - Disabled - ### Best practices - - Leave the setting enabled. This provides the ability to audit events at the category level without revising a policy. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -80,64 +62,30 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ### Group Policy - All auditing capabilities are integrated in Group Policy. You can configure, deploy, and manage these settings in the Group Policy Management Console (GPMC) or Local Security Policy snap-in for a domain, site, or organizational unit (OU). - ### Auditing - To manage an audit policy by using subcategories without requiring a change to Group Policy, the SCENoApplyLegacyAuditPolicy registry value , prevents the application of category-level audit policy from Group Policy and from the Local Security Policy administrative tool. - If the category level audit policy that is set here is not consistent with the events that are currently being generated, the cause might be that this registry key is set. - ### Command-line tools - You can use auditpol.exe to display and manage audit policies from a command prompt. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Prior to the introduction of auditing subcategories in Windows Vista, it was difficult to track events at a per-system or per-user level. The larger event categories created too many events, and the key information that needed to be audited was difficult to find. - ### Countermeasure - Enable audit policy subcategories as needed to track specific events. - ### Potential impacts - If you attempt to modify an audit setting by using Group Policy after enabling this setting through the command-line tools, the Group Policy audit setting is ignored in favor of the custom policy setting. To modify audit settings by using Group Policy, you must first disable the **SCENoApplyLegacyAuditPolicy** key. - **Important**   Be very cautious about audit settings that can generate a large volume of traffic. For example, if you enable success or failure auditing for all of the Privilege Use subcategories, the high volume of audit events that are generated can make it difficult to find other types of entries in the security event log. Such a configuration could also have a significant impact on system performance. -   - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-group-membership.md b/windows/keep-secure/audit-group-membership.md index d135909f8c..795f24a6ef 100644 --- a/windows/keep-secure/audit-group-membership.md +++ b/windows/keep-secure/audit-group-membership.md @@ -2,35 +2,23 @@ title: Audit Group Membership (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit Group Membership, which enables you to audit group memberships when they are enumerated on the client PC. ms.assetid: 1CD7B014-FBD9-44B9-9274-CC5715DE58B9 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Group Membership - - **Applies to** - - Windows 10 - This topic for the IT professional describes the advanced security audit policy setting, **Audit Group Membership**, which enables you to audit group memberships when they are enumerated on the client PC. - This policy allows you to audit the group membership information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. - For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. - **Note**  You must also enable the **Audit Logon** setting under **Advanced Audit Policy Configuration\\System Audit Policies\\Logon/Logoff**. -   - Multiple events are generated if the group membership information cannot fit in a single security audit event - Event volume: High - Default: Not configured - @@ -49,19 +37,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-handle-manipulation.md b/windows/keep-secure/audit-handle-manipulation.md index e54f17a6f2..e168f2a962 100644 --- a/windows/keep-secure/audit-handle-manipulation.md +++ b/windows/keep-secure/audit-handle-manipulation.md @@ -2,32 +2,22 @@ title: Audit Handle Manipulation (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Handle Manipulation, which determines whether the operating system generates audit events when a handle to an object is opened or closed. ms.assetid: 1fbb004a-ccdc-4c80-b3da-a4aa7a9f4091 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Handle Manipulation - - **Applies to** - - Windows 10 - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Handle Manipulation**, which determines whether the operating system generates audit events when a handle to an object is opened or closed. - Only objects with configured system access control lists (SACLs) generate these events, and only if the attempted handle operation matches the SACL. - **Important**   Handle Manipulation events are generated only for object types where the corresponding File System or Registry Object Access subcategory is enabled. For more information, see [Audit File System](audit-file-system.md) or [Audit Registry](audit-registry.md). -   - Event volume: High, depending on how SACLs are configured - Default: Not configured - @@ -54,19 +44,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-ipsec-driver.md b/windows/keep-secure/audit-ipsec-driver.md index 8945926bb1..7c7fd0de22 100644 --- a/windows/keep-secure/audit-ipsec-driver.md +++ b/windows/keep-secure/audit-ipsec-driver.md @@ -2,43 +2,27 @@ title: Audit IPsec Driver (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit IPsec Driver, which determines whether the operating system generates audit events for the activities of the IPsec driver. ms.assetid: c8b8c02f-5ad0-4ee5-9123-ea8cdae356a5 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit IPsec Driver - - **Applies to** - - Windows 10 - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit IPsec Driver**, which determines whether the operating system generates audit events for the activities of the IPsec driver. - The IPsec driver, using the IP Filter List from the active IPsec policy, watches for outbound IP packets that must be secured and inbound IP packets that must be verified and decrypted. This security policy setting reports on the following activities of the IPsec driver: - - Startup and shutdown of IPsec services. - - Packets dropped due to integrity-check failure. - - Packets dropped due to replay-check failure. - - Packets dropped due to being in plaintext. - - Packets received with an incorrect Security Parameter Index (SPI). (This can indicate malfunctioning hardware or interoperability problems.) - - Failure to process IPsec filters. - A high rate of packet drops by the IPsec filter driver may indicate attempts to gain access to the network by unauthorized systems. - Failure to process IPsec filters poses a potential security risk because some network interfaces may not get the protection that is provided by the IPsec filter. - Event volume: Medium - Default: Not configured - @@ -97,19 +81,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-ipsec-extended-mode.md b/windows/keep-secure/audit-ipsec-extended-mode.md index 22d1af6a85..9b316c69be 100644 --- a/windows/keep-secure/audit-ipsec-extended-mode.md +++ b/windows/keep-secure/audit-ipsec-extended-mode.md @@ -2,29 +2,20 @@ title: Audit IPsec Extended Mode (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit IPsec Extended Mode, which determines whether the operating system generates audit events for the results of the Internet Key Exchange (IKE) protocol and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. ms.assetid: 2b4fee9e-482a-4181-88a8-6a79d8fc8049 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit IPsec Extended Mode - - **Applies to** - - Windows 10 - This topic for the IT professional describes the advanced security audit policy setting, **Audit IPsec Extended Mode**, which determines whether the operating system generates audit events for the results of the Internet Key Exchange (IKE) protocol and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. - IKE is an Internet standard, defined in RFC 2409, that defines a mechanism to establish IPsec security associations (SAs). An SA is a combination of a mutually agreeable policy and keys that define the security services and mechanisms that help protect communication between IPsec peers. - AuthIP is an enhanced version of IKE that offers additional flexibility with support for user-based authentication, authentication with multiple credentials, improved authentication method negotiation, and asymmetric authentication. Like IKE, AuthIP supports main-mode and quick-mode negotiation. AuthIP also supports Extended Mode, a part of IPsec peer negotiation during which a second round of authentication can be performed. Extended Mode, which is optional, can be used for multiple authentications. For example, with extended mode you can perform separate computer-based and user-based authentications. - Event volume: High - Default: Not configured - @@ -109,19 +100,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-ipsec-main-mode.md b/windows/keep-secure/audit-ipsec-main-mode.md index fb2d8b42d3..2f62f592fd 100644 --- a/windows/keep-secure/audit-ipsec-main-mode.md +++ b/windows/keep-secure/audit-ipsec-main-mode.md @@ -2,31 +2,21 @@ title: Audit IPsec Main Mode (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit IPsec Main Mode, which determines whether the operating system generates events for the results of the Internet Key Exchange (IKE) protocol and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. ms.assetid: 06ed26ec-3620-4ef4-a47a-c70df9c8827b +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit IPsec Main Mode - - **Applies to** - - Windows 10 - This topic for the IT professional describes the advanced security audit policy setting, **Audit IPsec Main Mode**, which determines whether the operating system generates events for the results of the Internet Key Exchange (IKE) protocol and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. - IKE is an Internet standard, defined in RFC 2409, that defines a mechanism to establish IPsec security associations (SAs). An SA is a combination of a mutually agreeable policy and keys that define the security services and mechanisms that help protect communication between IPsec peers. - AuthIP is an enhanced version of IKE that offers additional flexibility with support for user-based authentication, authentication with multiple credentials, improved authentication method negotiation, and asymmetric authentication. Like IKE, AuthIP supports Main Mode and Quick Mode negotiation. - Main Mode Internet Key Exchange (IKE) negotiation establishes a secure channel, known as the Internet Security Association and Key Management Protocol (ISAKMP) security association (SA), between two computers. To establish the secure channel, Main Mode negotiation determines a set of cryptographic protection suites, exchanges keying material to establish the shared secret key, and authenticates computer identities. - Event volume: High - Default: Not configured - @@ -91,19 +81,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-ipsec-quick-mode.md b/windows/keep-secure/audit-ipsec-quick-mode.md index dbbd645b9e..969ea8f4d6 100644 --- a/windows/keep-secure/audit-ipsec-quick-mode.md +++ b/windows/keep-secure/audit-ipsec-quick-mode.md @@ -2,31 +2,21 @@ title: Audit IPsec Quick Mode (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit IPsec Quick Mode, which determines whether the operating system generates audit events for the results of the Internet Key Exchange (IKE) protocol and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. ms.assetid: 7be67a15-c2ce-496a-9719-e25ac7699114 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit IPsec Quick Mode - - **Applies to** - - Windows 10 - This topic for the IT professional describes the advanced security audit policy setting, **Audit IPsec Quick Mode**, which determines whether the operating system generates audit events for the results of the Internet Key Exchange (IKE) protocol and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. - IKE is an Internet standard, defined in RFC 2409, that defines a mechanism to establish IPsec security associations (SAs). An SA is a combination of a mutually agreeable policy and keys that define the security services and mechanisms that help protect communication between IPsec peers. - AuthIP is an enhanced version of IKE that offers additional flexibility with support for user-based authentication, authentication with multiple credentials, improved authentication method negotiation, and asymmetric authentication. Like IKE, AuthIP supports Main Mode and Quick Mode negotiation. - Quick Mode (also known as Phase 2) IKE negotiation establishes a secure channel between two computers to protect data. Because this phase involves the establishment of security associations (SAs) that are negotiated on behalf of the IPsec service, the SAs that are created during Quick Mode are called the IPsec SAs. During Quick Mode, keying material is refreshed or, if necessary, new keys are generated. A protection suite that protects specified IP traffic is also selected. A protection suite is a defined set of data integrity or data encryption settings. Quick Mode is not considered a complete exchange because it is dependent on a Main Mode exchange. - Event volume: High - Default: Not configured - @@ -53,19 +43,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-kerberos-authentication-service.md b/windows/keep-secure/audit-kerberos-authentication-service.md index aaa0076939..59067e3f7a 100644 --- a/windows/keep-secure/audit-kerberos-authentication-service.md +++ b/windows/keep-secure/audit-kerberos-authentication-service.md @@ -2,28 +2,20 @@ title: Audit Kerberos Authentication Service (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Kerberos Authentication Service, which determines whether to generate audit events for Kerberos authentication ticket-granting ticket (TGT) requests. ms.assetid: 990dd6d9-1a1f-4cce-97ba-5d7e0a7db859 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Kerberos Authentication Service - - **Applies to** - - Windows 10 - Windows 10 Mobile - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Kerberos Authentication Service**, which determines whether to generate audit events for Kerberos authentication ticket-granting ticket (TGT) requests. - If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT request. Success audits record successful attempts and Failure audits record unsuccessful attempts. - Event volume: High on Kerberos Key Distribution Center servers - Default: Not configured - @@ -50,19 +42,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-kerberos-service-ticket-operations.md b/windows/keep-secure/audit-kerberos-service-ticket-operations.md index ccd1d1a83b..b174f61378 100644 --- a/windows/keep-secure/audit-kerberos-service-ticket-operations.md +++ b/windows/keep-secure/audit-kerberos-service-ticket-operations.md @@ -2,32 +2,22 @@ title: Audit Kerberos Service Ticket Operations (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Kerberos Service Ticket Operations, which determines whether the operating system generates security audit events for Kerberos service ticket requests. ms.assetid: ddc0abef-ac7f-4849-b90d-66700470ccd6 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Kerberos Service Ticket Operations - - **Applies to** - - Windows 10 - Windows 10 Mobile - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Kerberos Service Ticket Operations**, which determines whether the operating system generates security audit events for Kerberos service ticket requests. - Events are generated every time Kerberos is used to authenticate a user who wants to access a protected network resource. Kerberos service ticket operation audit events can be used to track user activity. - Event volume: - - High on a domain controller that is in a Key Distribution Center (KDC) - - Low on domain members - Default: Not configured - @@ -50,19 +40,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-kernel-object.md b/windows/keep-secure/audit-kernel-object.md index 8eec2824ea..646f5f6d75 100644 --- a/windows/keep-secure/audit-kernel-object.md +++ b/windows/keep-secure/audit-kernel-object.md @@ -2,35 +2,24 @@ title: Audit Kernel Object (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Kernel Object, which determines whether the operating system generates audit events when users attempt to access the system kernel, which includes mutexes and semaphores. ms.assetid: 75619d8b-b1eb-445b-afc9-0f9053be97fb +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Kernel Object - - **Applies to** - - Windows 10 - Windows 10 Mobile - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Kernel Object**, which determines whether the operating system generates audit events when users attempt to access the system kernel, which includes mutexes and semaphores. - Only kernel objects with a matching system access control list (SACL) generate security audit events. The audits generated are usually useful only to developers. - Typically, kernel objects are given SACLs only if the **AuditBaseObjects** or **AuditBaseDirectories** auditing options are enabled. - **Note**   The **Audit: Audit the access of global system objects** policy setting controls the default SACL of kernel objects. -   - Event volume: High if you have enabled one of the Global Object Access Auditing settings - Default setting: Not configured - @@ -61,19 +50,8 @@ Default setting: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-logoff.md b/windows/keep-secure/audit-logoff.md index fca6ed6c10..feac0833b9 100644 --- a/windows/keep-secure/audit-logoff.md +++ b/windows/keep-secure/audit-logoff.md @@ -2,35 +2,24 @@ title: Audit Logoff (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Logoff, which determines whether the operating system generates audit events when logon sessions are terminated. ms.assetid: 681e51f2-ba06-46f5-af8c-d9c48d515432 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Logoff - - **Applies to** - - Windows 10 - Windows 10 Mobile - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Logoff**, which determines whether the operating system generates audit events when logon sessions are terminated. - These events occur on the computer that was accessed. In the case of an interactive logon, these events are generated on the computer that was logged on to. - **Note**   There is no failure event in this subcategory because failed logoffs (such as when a system abruptly shuts down) do not generate an audit record. -   - Logon events are essential to understanding user activity and detecting potential attacks. Logoff events are not 100 percent reliable. For example, the computer can be turned off without a proper logoff and shutdown; in this case, a logoff event is not generated. - Event volume: Low - Default: Success - @@ -53,19 +42,8 @@ Default: Success
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-logon.md b/windows/keep-secure/audit-logon.md index 581f4860fe..396d8cc641 100644 --- a/windows/keep-secure/audit-logon.md +++ b/windows/keep-secure/audit-logon.md @@ -2,38 +2,25 @@ title: Audit Logon (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Logon, which determines whether the operating system generates audit events when a user attempts to log on to a computer. ms.assetid: ca968d03-7d52-48c4-ba0e-2bcd2937231b +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Logon - - **Applies to** - - Windows 10 - Windows 10 Mobile - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Logon**, which determines whether the operating system generates audit events when a user attempts to log on to a computer. - These events are related to the creation of logon sessions and occur on the computer that was accessed. For an interactive logon, events are generated on the computer that was logged on to. For a network logon, such as accessing a share, events are generated on the computer that hosts the resource that was accessed. - The following events are recorded: - - Logon success and failure. - - Logon attempts by using explicit credentials. This event is generated when a process attempts to log on an account by explicitly specifying that account's credentials. This most commonly occurs in batch configurations such as scheduled tasks, or when using the Runas command. - - Security identifiers (SIDs) are filtered. - Logon events are essential to tracking user activity and detecting potential attacks. - Event volume: Low on a client computer; medium on a domain controller or network server - Default: Success for client computers; success and failure for servers - @@ -64,19 +51,8 @@ Default: Success for client computers; success and failure for servers
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-mpssvc-rule-level-policy-change.md b/windows/keep-secure/audit-mpssvc-rule-level-policy-change.md index f448d5882b..c038f872bd 100644 --- a/windows/keep-secure/audit-mpssvc-rule-level-policy-change.md +++ b/windows/keep-secure/audit-mpssvc-rule-level-policy-change.md @@ -2,41 +2,26 @@ title: Audit MPSSVC Rule-Level Policy Change (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit MPSSVC Rule-Level Policy Change, which determines whether the operating system generates audit events when changes are made to policy rules for the Microsoft Protection Service (MPSSVC.exe). ms.assetid: 263461b3-c61c-4ec3-9dee-851164845019 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit MPSSVC Rule-Level Policy Change - - **Applies to** - - Windows 10 - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit MPSSVC Rule-Level Policy Change**, which determines whether the operating system generates audit events when changes are made to policy rules for the Microsoft Protection Service (MPSSVC.exe). - The Microsoft Protection Service, which is used by Windows Firewall, is an integral part of the computer’s threat protection against malware. The tracked activities include: - - Active policies when the Windows Firewall service starts. - - Changes to Windows Firewall rules. - - Changes to the Windows Firewall exception list. - - Changes to Windows Firewall settings. - - Rules ignored or not applied by the Windows Firewall service. - - Changes to Windows Firewall Group Policy settings. - Changes to firewall rules are important for understanding the security state of the computer and how well it is protected against network attacks. - Event volume: Low - Default: Not configured - @@ -107,19 +92,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-network-policy-server.md b/windows/keep-secure/audit-network-policy-server.md index 0901a69905..1a7b659ed3 100644 --- a/windows/keep-secure/audit-network-policy-server.md +++ b/windows/keep-secure/audit-network-policy-server.md @@ -2,27 +2,19 @@ title: Audit Network Policy Server (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Network Policy Server, which determines whether the operating system generates audit events for RADIUS (IAS) and Network Access Protection (NAP) activity on user access requests (Grant, Deny, Discard, Quarantine, Lock, and Unlock). ms.assetid: 43b2aea4-26df-46da-b761-2b30f51a80f7 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Network Policy Server - - **Applies to** - - Windows 10 - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Network Policy Server**, which determines whether the operating system generates audit events for RADIUS (IAS) and Network Access Protection (NAP) activity on user access requests (Grant, Deny, Discard, Quarantine, Lock, and Unlock). - NAP events can be used to help understand the overall health of the network. - Event volume: Medium to high on servers that are running Network Policy Server (NPS); moderate on other servers or on client computers - Default: Success and failure - @@ -73,19 +65,8 @@ Default: Success and failure
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-non-sensitive-privilege-use.md b/windows/keep-secure/audit-non-sensitive-privilege-use.md index ac2879b686..086e940d66 100644 --- a/windows/keep-secure/audit-non-sensitive-privilege-use.md +++ b/windows/keep-secure/audit-non-sensitive-privilege-use.md @@ -2,89 +2,50 @@ title: Audit Non-Sensitive Privilege Use (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Non-Sensitive Privilege Use, which determines whether the operating system generates audit events when non-sensitive privileges (user rights) are used. ms.assetid: 8fd74783-1059-443e-aa86-566d78606627 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Non-Sensitive Privilege Use - - **Applies to** - - Windows 10 - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Non-Sensitive Privilege Use**, which determines whether the operating system generates audit events when non-sensitive privileges (user rights) are used. - The following privileges are non-sensitive: - - **Access Credential Manager as a trusted caller** - - **Access this computer from the network** - - **Add workstations to domain** - - **Adjust memory quotas for a process** - - **Allow log on locally** - - **Allow log on through Terminal Services** - - **Bypass traverse checking** - - **Change the system time** - - **Create a page file** - - **Create global objects** - - **Create permanent shared objects** - - **Create symbolic links** - - **Deny access to this computer from the network** - - **Deny log on as a batch job** - - **Deny log on as a service** - - **Deny log on locally** - - **Deny log on through Terminal Services** - - **Force shutdown from a remote system** - - **Increase a process working set** - - **Increase scheduling priority** - - **Lock pages in memory** - - **Log on as a batch job** - - **Log on as a service** - - **Modify an object label** - - **Perform volume maintenance tasks** - - **Profile single process** - - **Profile system performance** - - **Remove computer from docking station** - - **Shut down the system** - - **Synchronize directory service data** - If you configure this policy setting, an audit event is generated when a non-sensitive privilege is called. Success audits record successful attempts, and failure audits record unsuccessful attempts. - Event volume: Very high - Default: Not configured - @@ -111,19 +72,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-other-account-logon-events.md b/windows/keep-secure/audit-other-account-logon-events.md index 36d1c35cf5..d924a8af0d 100644 --- a/windows/keep-secure/audit-other-account-logon-events.md +++ b/windows/keep-secure/audit-other-account-logon-events.md @@ -2,48 +2,30 @@ title: Audit Other Account Logon Events (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit Other Account Logon Events, which allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets. ms.assetid: c8c6bfe0-33d2-4600-bb1a-6afa840d75b3 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Other Account Logon Events - - **Applies to** - - Windows 10 - This topic for the IT professional describes the advanced security audit policy setting, **Audit Other Account Logon Events**, which allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets. - Examples can include the following: - - Remote Desktop session disconnections - - New Remote Desktop sessions - - Locking and unlocking a workstation - - Invoking a screen saver - - Dismissing a screen saver - - Detection of a Kerberos replay attack, in which a Kerberos request with identical information was received twice - **Note**   This condition could be caused by a network misconfiguration. -   - - Access to a wireless network granted to a user or computer account - - Access to a wired 802.1x network granted to a user or computer account - Event volume: Varies, depending on system use - Default: Not configured - @@ -98,19 +80,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-other-account-management-events.md b/windows/keep-secure/audit-other-account-management-events.md index 78a7da62bd..a5929d83f0 100644 --- a/windows/keep-secure/audit-other-account-management-events.md +++ b/windows/keep-secure/audit-other-account-management-events.md @@ -2,38 +2,25 @@ title: Audit Other Account Management Events (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Other Account Management Events, which determines whether the operating system generates user account management audit events. ms.assetid: 4ce22eeb-a96f-4cf9-a46d-6642961a31d5 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Other Account Management Events - - **Applies to** - - Windows 10 - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Other Account Management Events**, which determines whether the operating system generates user account management audit events. - Events can be generated for user account management auditing when: - - The password hash of an account is accessed. This typically happens when the Active Directory Migration Tool (ADMT) is moving password data. - - The Password Policy Checking application programming interface (API) is called. Calls to this function could be part of an attack from a malicious application that is testing whether password complexity policy settings are being applied. - - Changes are made to domain policy under **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy** or **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Account Lockout Policy**. - **Note**   These events are logged when the domain policy is applied (on refresh or restart), not when settings are modified by an administrator. -   - Event volume: Low - Default: Not configured - @@ -56,19 +43,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-other-logonlogoff-events.md b/windows/keep-secure/audit-other-logonlogoff-events.md index c38d1fcc1a..d1068bc02c 100644 --- a/windows/keep-secure/audit-other-logonlogoff-events.md +++ b/windows/keep-secure/audit-other-logonlogoff-events.md @@ -2,41 +2,26 @@ title: Audit Other Logon/Logoff Events (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Other Logon/Logoff Events, which determines whether Windows generates audit events for other logon or logoff events. ms.assetid: 76d987cd-1917-4907-a739-dd642609a458 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Other Logon/Logoff Events - - **Applies to** - - Windows 10 - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Other Logon/Logoff Events**, which determines whether Windows generates audit events for other logon or logoff events. - These other logon or logoff events include: - - A Remote Desktop session connects or disconnects. - - A workstation is locked or unlocked. - - A screen saver is invoked or dismissed. - - A replay attack is detected. This event indicates that a Kerberos request was received twice with identical information. This condition could also be caused by network misconfiguration. - - A user is granted access to a wireless network. It can either be a user account or the computer account. - - A user is granted access to a wired 802.1x network. It can either be a user account or the computer account. - Logon events are essential to understanding user activity and detecting potential attacks. - Event volume: Low - Default: Not configured - @@ -91,19 +76,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-other-object-access-events.md b/windows/keep-secure/audit-other-object-access-events.md index 4998656c13..0a0b4e92c2 100644 --- a/windows/keep-secure/audit-other-object-access-events.md +++ b/windows/keep-secure/audit-other-object-access-events.md @@ -2,45 +2,28 @@ title: Audit Other Object Access Events (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Other Object Access Events, which determines whether the operating system generates audit events for the management of Task Scheduler jobs or COM+ objects. ms.assetid: b9774595-595d-4199-b0c5-8dbc12b6c8b2 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Other Object Access Events - - **Applies to** - - Windows 10 - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Other Object Access Events**, which determines whether the operating system generates audit events for the management of Task Scheduler jobs or COM+ objects. - For scheduler jobs, the following actions are audited: - - Job created. - - Job deleted. - - Job enabled. - - Job disabled. - - Job updated. - For COM+ objects, the following actions are audited: - - Catalog object added. - - Catalog object updated. - - Catalog object deleted. - Event volume: Low - Default: Not configured - @@ -103,19 +86,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-other-policy-change-events.md b/windows/keep-secure/audit-other-policy-change-events.md index 33f1800b16..297f8250bb 100644 --- a/windows/keep-secure/audit-other-policy-change-events.md +++ b/windows/keep-secure/audit-other-policy-change-events.md @@ -2,35 +2,23 @@ title: Audit Other Policy Change Events (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Other Policy Change Events, which determines whether the operating system generates audit events for security policy changes that are not otherwise audited in the Policy Change category. ms.assetid: 8618502e-c21c-41cc-8a49-3dc1eb359e60 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Other Policy Change Events - - **Applies to** - - Windows 10 - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Other Policy Change Events**, which determines whether the operating system generates audit events for security policy changes that are not otherwise audited in the Policy Change category. - These other activities in the Policy Change category that can be audited include: - - Trusted Platform Module (TPM) configuration changes. - - Kernel-mode cryptographic self tests. - - Cryptographic provider operations. - - Cryptographic context operations or modifications. - Event volume: Low - Default: Not configured - @@ -101,19 +89,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-other-privilege-use-events.md b/windows/keep-secure/audit-other-privilege-use-events.md index 65b5146b7b..145e348e6e 100644 --- a/windows/keep-secure/audit-other-privilege-use-events.md +++ b/windows/keep-secure/audit-other-privilege-use-events.md @@ -2,31 +2,17 @@ title: Audit Other Privilege Use Events (Windows 10) description: This security policy setting is not used. ms.assetid: 5f7f5b25-42a6-499f-8aa2-01ac79a2a63c +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Other Privilege Use Events - - **Applies to** - - Windows 10 - This security policy setting is not used. - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-other-system-events.md b/windows/keep-secure/audit-other-system-events.md index 9b5457b2a3..26c8610d85 100644 --- a/windows/keep-secure/audit-other-system-events.md +++ b/windows/keep-secure/audit-other-system-events.md @@ -2,38 +2,25 @@ title: Audit Other System Events (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Other System Events, which determines whether the operating system audits various system events. ms.assetid: 2401e4cc-d94e-41ec-82a7-e10914295f8b +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Other System Events - - **Applies to** - - Windows 10 - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Other System Events**, which determines whether the operating system audits various system events. - The system events in this category include: - - Startup and shutdown of the Windows Firewall service and driver. - - Security policy processing by the Windows Firewall service. - - Cryptography key file and migration operations. - **Important**   Failure to start the Windows Firewall service may result in a computer that is not fully protected against network threats. -   - Event volume: Low - Default: Success and failure - @@ -136,19 +123,8 @@ Default: Success and failure
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-pnp-activity.md b/windows/keep-secure/audit-pnp-activity.md index e278b54ff1..b0b235fa4c 100644 --- a/windows/keep-secure/audit-pnp-activity.md +++ b/windows/keep-secure/audit-pnp-activity.md @@ -2,29 +2,20 @@ title: Audit PNP Activity (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit PNP Activity, which determines when plug and play detects an external device. ms.assetid: A3D87B3B-EBBE-442A-953B-9EB75A5F600E +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit PNP Activity - - **Applies to** - - Windows 10 - \[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.\] - This topic for the IT professional describes the advanced security audit policy setting, **Audit PNP Activity**, which determines when plug and play detects an external device. - A PnP audit event can be used to track down changes in system hardware and will be logged on the machine where the change took place. For example, when a keyboard is plugged into a PC a PnP event is triggered. - Event volume: Varies, depending on how the computer is used - Default: Not configured - @@ -43,19 +34,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-policy.md b/windows/keep-secure/audit-policy.md index c955e349c7..8456383cb7 100644 --- a/windows/keep-secure/audit-policy.md +++ b/windows/keep-secure/audit-policy.md @@ -2,55 +2,29 @@ title: Audit Policy (Windows 10) description: Provides information about basic audit policies that are available in Windows and links to information about each setting. ms.assetid: 2e8ea400-e555-43e5-89d6-0898cb89da90 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Policy - - **Applies to** - - Windows 10 - Provides information about basic audit policies that are available in Windows and links to information about each setting. - The security audit policy settings under **Security Settings\\Local Policies\\Audit Policy** provide broad security audit capabilities for client devices and servers that cannot use advanced security audit policy settings. - The basic audit policy settings under **Security Settings\\Local Policies\\Audit Policy** are: - [Audit account logon events](basic-audit-account-logon-events.md) - [Audit account management](basic-audit-account-management.md) - [Audit directory service access](basic-audit-directory-service-access.md) - [Audit logon events](basic-audit-logon-events.md) - [Audit object access](basic-audit-object-access.md) - [Audit policy change](basic-audit-policy-change.md) - [Audit privilege use](basic-audit-privilege-use.md) - [Audit process tracking](basic-audit-process-tracking.md) - [Audit system events](basic-audit-system-events.md) - ## Related topics - - [Configure security policy settings](how-to-configure-security-policy-settings.md) - [Security auditing](security-auditing-overview.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-process-creation.md b/windows/keep-secure/audit-process-creation.md index 217836dc17..46977396e4 100644 --- a/windows/keep-secure/audit-process-creation.md +++ b/windows/keep-secure/audit-process-creation.md @@ -2,28 +2,20 @@ title: Audit Process Creation (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Process Creation, which determines whether the operating system generates audit events when a process is created (starts). ms.assetid: 67e39fcd-ded6-45e8-b1b6-d411e4e93019 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Process Creation - - **Applies to** - - Windows 10 - Windows 10 Mobile - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Process Creation**, which determines whether the operating system generates audit events when a process is created (starts). - These audit events can help you track user activity and understand how a computer is being used. Information includes the name of the program or the user that created the process. - Event volume: Low to medium, depending on system usage - Default: Not configured - @@ -46,19 +38,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-process-termination.md b/windows/keep-secure/audit-process-termination.md index ac362e72be..ed81065dfb 100644 --- a/windows/keep-secure/audit-process-termination.md +++ b/windows/keep-secure/audit-process-termination.md @@ -2,32 +2,22 @@ title: Audit Process Termination (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Process Termination, which determines whether the operating system generates audit events when an attempt is made to end a process. ms.assetid: 65d88e53-14aa-48a4-812b-557cebbf9e50 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Process Termination - - **Applies to** - - Windows 10 - Windows 10 Mobile - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Process Termination**, which determines whether the operating system generates audit events when an attempt is made to end a process. - Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when a process ends. - This policy setting can help you track user activity and understand how the computer is used. - Event volume: Varies, depending on how the computer is used - Default: Not configured - @@ -46,19 +36,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-registry.md b/windows/keep-secure/audit-registry.md index f8c60d1b1f..e7b6bdba50 100644 --- a/windows/keep-secure/audit-registry.md +++ b/windows/keep-secure/audit-registry.md @@ -2,30 +2,21 @@ title: Audit Registry (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Registry, which determines whether the operating system generates audit events when users attempt to access registry objects. ms.assetid: 02bcc23b-4823-46ac-b822-67beedf56b32 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Registry - - **Applies to** - - Windows 10 - Windows 10 Mobile - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Registry**, which determines whether the operating system generates audit events when users attempt to access registry objects. - Audit events are generated only for objects that have configured system access control lists (SACLs) specified, and only if the type of access requested (such as Write, Read, or Modify) and the account making the request match the settings in the SACL. - If success auditing is enabled, an audit entry is generated each time any account successfully accesses a registry object that has a matching SACL. If failure auditing is enabled, an audit entry is generated each time any user unsuccessfully attempts to access a registry object that has a matching SACL. - Event volume: Low to medium, depending on how registry SACLs are configured - Default: Not configured - @@ -48,19 +39,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-removable-storage.md b/windows/keep-secure/audit-removable-storage.md index 5c9276822b..d260df3000 100644 --- a/windows/keep-secure/audit-removable-storage.md +++ b/windows/keep-secure/audit-removable-storage.md @@ -2,25 +2,18 @@ title: Audit Removable Storage (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Removable Storage, which determines when there is a read or a write to a removable drive. ms.assetid: 1746F7B3-8B41-4661-87D8-12F734AFFB26 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Removable Storage - - **Applies to** - - Windows 10 - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Removable Storage**, which determines when there is a read or a write to a removable drive. - Event volume: Low - Default: Not configured - @@ -122,19 +115,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-rpc-events.md b/windows/keep-secure/audit-rpc-events.md index de4ec1bad5..1fca2ed810 100644 --- a/windows/keep-secure/audit-rpc-events.md +++ b/windows/keep-secure/audit-rpc-events.md @@ -2,27 +2,19 @@ title: Audit RPC Events (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit RPC Events, which determines whether the operating system generates audit events when inbound remote procedure call (RPC) connections are made. ms.assetid: 868aec2d-93b4-4bc8-a150-941f88838ba6 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit RPC Events - - **Applies to** - - Windows 10 - This topic for the IT professional describes the advanced security audit policy setting, **Audit RPC Events**, which determines whether the operating system generates audit events when inbound remote procedure call (RPC) connections are made. - RPC is a technology for creating distributed client/server programs. RPC is an interprocess communication technique that enables client and server software to communicate. For more information, see [What Is RPC?](http://technet.microsoft.com/library/cc787851.aspx). - Event volume: High on RPC servers - Default: Not configured - @@ -41,19 +33,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-sam.md b/windows/keep-secure/audit-sam.md index 9afb708e33..47d6014e77 100644 --- a/windows/keep-secure/audit-sam.md +++ b/windows/keep-secure/audit-sam.md @@ -2,54 +2,34 @@ title: Audit SAM (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit SAM, which enables you to audit events that are generated by attempts to access Security Account Manager (SAM) objects. ms.assetid: 1d00f955-383d-4c95-bbd1-fab4a991a46e +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit SAM - - **Applies to** - - Windows 10 - Windows 10 Mobile - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit SAM**, which enables you to audit events that are generated by attempts to access Security Account Manager (SAM) objects. - The Security Account Manager (SAM) is a database that is present on computers running Windows operating systems that stores user accounts and security descriptors for users on the local computer. - SAM objects include the following: - - SAM\_ALIAS: A local group - - SAM\_GROUP: A group that is not a local group - - SAM\_USER: A user account - - SAM\_DOMAIN: A domain - - SAM\_SERVER: A computer account - If you configure this policy setting, an audit event is generated when a SAM object is accessed. Success audits record successful attempts, and failure audits record unsuccessful attempts. - **Note**   Only the SACL for SAM\_SERVER can be modified. -   - Changes to user and group objects are tracked by the Account Management audit category. However, user accounts with enough privileges could potentially alter the files in which the account and password information is stored in the system, bypassing any Account Management events. - Event volume: High on domain controllers - **Note**   For information about reducing the number of events generated in this subcategory, see [KB841001](http://go.microsoft.com/fwlink/p/?LinkId=121698). -   - Default setting: Not configured - @@ -80,19 +60,8 @@ Default setting: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-security-group-management.md b/windows/keep-secure/audit-security-group-management.md index c4112315d8..e4ca2e798d 100644 --- a/windows/keep-secure/audit-security-group-management.md +++ b/windows/keep-secure/audit-security-group-management.md @@ -2,35 +2,23 @@ title: Audit Security Group Management (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit Security Group Management, which determines whether the operating system generates audit events when specific security group management tasks are performed. ms.assetid: ac2ee101-557b-4c84-b9fa-4fb23331f1aa +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Security Group Management - - **Applies to** - - Windows 10 - This topic for the IT professional describes the advanced security audit policy setting, **Audit Security Group Management**, which determines whether the operating system generates audit events when specific security group management tasks are performed. - Tasks for security group management include: - - A security group is created, changed, or deleted. - - A member is added to or removed from a security group. - - A group's type is changed. - Security groups can be used for access control permissions and also as distribution lists. - Event volume: Low - Default: Success - @@ -109,19 +97,8 @@ Default: Success
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-security-state-change.md b/windows/keep-secure/audit-security-state-change.md index f20c08fa77..916b17b447 100644 --- a/windows/keep-secure/audit-security-state-change.md +++ b/windows/keep-secure/audit-security-state-change.md @@ -2,41 +2,27 @@ title: Audit Security State Change (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Security State Change, which determines whether Windows generates audit events for changes in the security state of a system. ms.assetid: decb3218-a67d-4efa-afc0-337c79a89a2d +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Security State Change - - **Applies to** - - Windows 10 - Windows 10 Mobile - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Security State Change**, which determines whether Windows generates audit events for changes in the security state of a system. - Changes in the security state of the operating system include: - - System startup and shutdown. - - Change of system time. - - System recovery from **CrashOnAuditFail**. This event is logged after a system reboots following **CrashOnAuditFail**. - **Important**   Some auditable activity may not be recorded when a system restarts due to **CrashOnAuditFail**. -   - System startup and shutdown events are important for understanding system usage. - Event volume: Low - Default: Success - @@ -73,19 +59,8 @@ Default: Success
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-security-system-extension.md b/windows/keep-secure/audit-security-system-extension.md index ace6274636..2144df19fb 100644 --- a/windows/keep-secure/audit-security-system-extension.md +++ b/windows/keep-secure/audit-security-system-extension.md @@ -2,39 +2,26 @@ title: Audit Security System Extension (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Security System Extension, which determines whether the operating system generates audit events related to security system extensions. ms.assetid: 9f3c6bde-42b2-4a0a-b353-ed3106ebc005 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Security System Extension - - **Applies to** - - Windows 10 - Windows 10 Mobile - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Security System Extension**, which determines whether the operating system generates audit events related to security system extensions. - Changes to security system extensions in the operating system include the following activities: - - A security extension code is loaded (such as an authentication, notification, or security package). A security extension code registers with the Local Security Authority and will be used and trusted to authenticate logon attempts, submit logon requests, and be notified of any account or password changes. Examples of this extension code are Security Support Providers, such as Kerberos and NTLM. - - A service is installed. An audit log is generated when a service is registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account. - **Important**   Attempts to install or load security system extensions or services are critical system events that could indicate a security breach. -   - Event volume: Low - These events are expected to appear more on a domain controller than on client computers or member servers. - Default: Not configured - @@ -69,19 +56,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-sensitive-privilege-use.md b/windows/keep-secure/audit-sensitive-privilege-use.md index 339007cdc8..5b79f7bf21 100644 --- a/windows/keep-secure/audit-sensitive-privilege-use.md +++ b/windows/keep-secure/audit-sensitive-privilege-use.md @@ -2,59 +2,35 @@ title: Audit Sensitive Privilege Use (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Sensitive Privilege Use, which determines whether the operating system generates audit events when sensitive privileges (user rights) are used. ms.assetid: 915abf50-42d2-45f6-9fd1-e7bd201b193d +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Sensitive Privilege Use - - **Applies to** - - Windows 10 - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Sensitive Privilege Use**, which determines whether the operating system generates audit events when sensitive privileges (user rights) are used. - Actions that can be audited include: - - A privileged service is called. - - One of the following privileges is called: - **Act as part of the operating system** - **Back up files and directories** - **Create a token object** - **Debug programs** - **Enable computer and user accounts to be trusted for delegation** - **Generate security audits** - **Impersonate a client after authentication** - **Load and unload device drivers** - **Manage auditing and security log** - **Modify firmware environment values** - **Replace a process-level token** - **Restore files and directories** - **Take ownership of files or other objects** - If you configure this policy setting, an audit event is generated when sensitive privilege requests are made. Success audits record successful attempts, and failure audits record unsuccessful attempts. - Event volume: High - Default: Not configured - @@ -81,19 +57,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md b/windows/keep-secure/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md index dd3b82a5bd..6d797a0b65 100644 --- a/windows/keep-secure/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md +++ b/windows/keep-secure/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md @@ -2,28 +2,19 @@ title: Audit Shut down system immediately if unable to log security audits (Windows 10) description: Describes the best practices, location, values, management practices, and security considerations for the Audit Shut down system immediately if unable to log security audits security policy setting. ms.assetid: 2cd23cd9-0e44-4d0b-a1f1-39fc29303826 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit: Shut down system immediately if unable to log security audits - - **Applies to** - - Windows 10 - Describes the best practices, location, values, management practices, and security considerations for the **Audit: Shut down system immediately if unable to log security audits** security policy setting. - ## Reference - - The **Audit: Shut down system immediately if unable to log security audits** policy setting determines whether the system shuts down if it is unable to log security events. This policy setting is a requirement for Trusted Computer System Evaluation Criteria (TCSEC)-C2 and Common Criteria certification to prevent auditable events from occurring if the audit system is unable to log those events. Microsoft has chosen to meet this requirement by halting the system and displaying a Stop message in the case of a failure of the auditing system. Enabling this policy setting stops the system if a security audit cannot be logged for any reason. Typically, an event fails to be logged when the security audit log is full and the value of **Retention method for security log** is **Do not overwrite events (clear log manually)** or **Overwrite events by days**. - With **Audit: Shut down system immediately if unable to log security audits** set to **Enabled**, if the security log is full and an existing entry cannot be overwritten, the following Stop message appears: - @@ -35,33 +26,19 @@ With **Audit: Shut down system immediately if unable to log security audits** se
-   - To recover, you must log on, archive the log (optional), clear the log, and reset this option as desired. - If the computer is unable to record events to the security log, critical evidence or important troubleshooting information might not be available for review after a security incident. - ### Possible values - - Enabled - - Disabled - - Not defined - ### Best practices - - Depending on your security audit requirements, you can enable the **Audit: Shut down system immediately if unable to log security audits** setting to ensure that security auditing information is captured for review. However, enabling this setting will increase the number of events logged. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -100,51 +77,23 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - The administrative burden of enabling this policy setting can be very high, especially if you also set the **Retention method for security log** to **Do not overwrite events (clear log manually)**. This setting turns a repudiation threat (a backup operator could deny that they backed up or restored data) into a denial-of-service threat, because a server can be forced to shut down if it is overwhelmed with logon events and other security events that are written to the security log. Additionally, because the shutdown is not graceful, it is possible that irreparable damage to the operating system, applications, or data could result. Although the NTFS file system will guarantee that the file system's integrity will be maintained during a sudden system shutdown, it cannot guarantee that every data file for every application will still be in a usable form when the system is restarted. - ### Restart requirement - None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. - ### Group Policy - Modifying this setting may affect compatibility with clients, services, and applications. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - If the computer is unable to record events to the security event log, critical evidence or important troubleshooting information may not be available for review after a security incident. Also, an attacker could potentially generate a large volume of security event log events to purposely force a shutdown. - ### Countermeasure - Enable the **Audit: Shut down system immediately if unable to log security audits** setting to ensure that security auditing information is captured for review. - ### Potential impact - If you enable this policy setting, the administrative burden can be significant, especially if you also configure the **Retention method for the Security log** to **Do not overwrite events** (clear log manually). This configuration causes a repudiation threat (a backup operator could deny that they backed up or restored data) to become a denial of service (DoS) vulnerability because a server could be forced to shut down if it is overwhelmed with logon events and other security events that are written to the security event log. Also, because the shutdown is abrupt, it is possible that irreparable damage to the operating system, applications, or data could result. Although the NTFS file system maintains its integrity when this type of computer shutdown occurs, there is no guarantee that every data file for every application will still be in a usable form when the device restarts. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-special-logon.md b/windows/keep-secure/audit-special-logon.md index b95710f26b..5a3e24b4b7 100644 --- a/windows/keep-secure/audit-special-logon.md +++ b/windows/keep-secure/audit-special-logon.md @@ -2,34 +2,23 @@ title: Audit Special Logon (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Special Logon, which determines whether the operating system generates audit events under special sign on (or log on) circumstances. ms.assetid: e1501bac-1d09-4593-8ebb-f311231567d3 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit Special Logon - - **Applies to** - - Windows 10 - Windows 10 Mobile - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Special Logon**, which determines whether the operating system generates audit events under special sign on (or log on) circumstances. - This security policy setting determines whether the operating system generates audit events when: - - A special logon is used. A special logon is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. - - A member of a special group logs on. Special Groups is a Windows feature that enables the administrator to find out when a member of a certain group has logged on. The administrator can set a list of group security identifiers (SIDs) in the registry. If any of these SIDs is added to a token during logon and this auditing subcategory is enabled, a security event is logged. For more information about this feature, see [article 947223](http://go.microsoft.com/fwlink/p/?linkid=120183) in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/p/?linkid=120183). - Users holding special privileges can potentially make changes to the system. We recommend that you track their activity. - Event volume: Low - Default: Success - @@ -48,19 +37,8 @@ Default: Success
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-system-integrity.md b/windows/keep-secure/audit-system-integrity.md index b9e785f0b3..afe5957ade 100644 --- a/windows/keep-secure/audit-system-integrity.md +++ b/windows/keep-secure/audit-system-integrity.md @@ -2,43 +2,28 @@ title: Audit System Integrity (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit System Integrity, which determines whether the operating system audits events that violate the integrity of the security subsystem. ms.assetid: 942a9a7f-fa31-4067-88c7-f73978bf2034 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit System Integrity - - **Applies to** - - Windows 10 - Windows 10 Mobile - This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit System Integrity**, which determines whether the operating system audits events that violate the integrity of the security subsystem. - Activities that violate the integrity of the security subsystem include the following: - - Audited events are lost due to a failure of the auditing system. - - A process uses an invalid local procedure call (LPC) port in an attempt to impersonate a client, reply to a client address space, read to a client address space, or write from a client address space. - - A remote procedure call (RPC) integrity violation is detected. - - A code integrity violation with an invalid hash value of an executable file is detected. - - Cryptographic tasks are performed. - **Important**   Violations of security subsystem integrity are critical and could indicate a potential security attack. -   - Event volume: Low - Default: Success and failure - @@ -97,19 +82,8 @@ Default: Success and failure
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-user-account-management.md b/windows/keep-secure/audit-user-account-management.md index 406ceb5ef9..1a863efc9a 100644 --- a/windows/keep-secure/audit-user-account-management.md +++ b/windows/keep-secure/audit-user-account-management.md @@ -2,41 +2,26 @@ title: Audit User Account Management (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit User Account Management, which determines whether the operating system generates audit events when specific user account management tasks are performed. ms.assetid: f7e72998-3858-4197-a443-19586ecc4bfb +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit User Account Management - - **Applies to** - - Windows 10 - This topic for the IT professional describes the advanced security audit policy setting, **Audit User Account Management**, which determines whether the operating system generates audit events when specific user account management tasks are performed. - Tasks that are audited for user account management include: - - A user account is created, changed, deleted, renamed, disabled, enabled, locked out, or unlocked. - - A user account password is set or changed. - - Security identifier (SID) history is added to a user account. - - The Directory Services Restore Mode password is set. - - Permissions are changed on accounts that are members of administrator groups. - - Credential Manager credentials are backed up or restored. - This policy setting is essential for tracking events that involve provisioning and managing user accounts. - Event volume: Low - Default: Success - @@ -115,19 +100,8 @@ Default: Success
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/audit-user-device-claims.md b/windows/keep-secure/audit-user-device-claims.md index 6d913998df..29bc724e09 100644 --- a/windows/keep-secure/audit-user-device-claims.md +++ b/windows/keep-secure/audit-user-device-claims.md @@ -2,25 +2,18 @@ title: Audit User/Device Claims (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit User/Device Claims, which enables you to audit security events that are generated by user and device claims. ms.assetid: D3D2BFAF-F2C0-462A-9377-673DB49D5486 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit User/Device Claims - - **Applies to** - - Windows 10 - This topic for the IT professional describes the advanced security audit policy setting, **Audit User/Device Claims**, which enables you to audit security events that are generated by user and device claims. - Event volume: - Default: Not configured - @@ -57,19 +50,8 @@ Default: Not configured
-   - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/back-up-files-and-directories.md b/windows/keep-secure/back-up-files-and-directories.md index fa7650f9c0..6e95c6fea2 100644 --- a/windows/keep-secure/back-up-files-and-directories.md +++ b/windows/keep-secure/back-up-files-and-directories.md @@ -2,76 +2,43 @@ title: Back up files and directories (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Back up files and directories security policy setting. ms.assetid: 1cd6bdd5-1501-41f4-98b9-acf29ac173ae +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Back up files and directories - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Back up files and directories** security policy setting. - ## Reference - - This user right determines which users can bypass file and directory, registry, and other persistent object permissions for the purposes of backing up the system. This user right is effective only when an application attempts access through the NTFS backup application programming interface (API) through a backup tool such as NTBACKUP.EXE. Otherwise, standard file and directory permissions apply. - This user right is similar to granting the following permissions to the user or group you have selected on all files and folders on the system: - - Traverse Folder/Execute File - - List Folder/Read Data - - Read Attributes - - Read Extended Attributes - - Read Permissions - Default on workstations and servers: - - Administrators - - Backup Operators - Default on domain controllers: - - Administrators - - Backup Operators - - Server Operators - Constant: SeBackupPrivilege - ### Possible values - - User-defined list of accounts - - Not Defined - ### Best practices - 1. Restrict the **Back up files and directories** user right to members of the IT team who must back up organizational data as part of their daily job responsibilities. Because there is no way to be sure that a user is backing up data, stealing data, or copying data to be distributed, only assign this user right to trusted users. - 2. If you are using backup software that runs under specific service accounts, only these accounts (and not the IT staff) should have the **Back up files and directories** user right. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - By default, this right is granted to Administrators and Backup Operators on workstations and servers. On domain controllers, Administrators, Backup Operators, and Server Operators have this right. - The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - @@ -117,57 +84,26 @@ The following table lists the actual and effective default policy values. Defaul
-   - ## Policy management - - A restart of the device is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - ### Group Policy - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Users who can back up data from a device could take the backup media to a non-domain computer on which they have administrative privileges, and then restore the data. They could take ownership of the files and view any unencrypted data that is contained within the backup set. - ### Countermeasure - Restrict the **Back up files and directories** user right to members of the IT team who must back up organizational data as part of their daily job responsibilities. If you are using backup software that runs under specific service accounts, only these accounts (and not the IT staff) should have the **Back up files and directories** user right. - ### Potential impact - Changes in the membership of the groups that have the **Back up files and directories** user right could limit the abilities of users who are assigned to specific administrative roles in your environment. You should confirm that authorized backup administrators can still perform backup operations. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/backup-tpm-recovery-information-to-ad-ds.md b/windows/keep-secure/backup-tpm-recovery-information-to-ad-ds.md index 0aca86ef95..dfc256208f 100644 --- a/windows/keep-secure/backup-tpm-recovery-information-to-ad-ds.md +++ b/windows/keep-secure/backup-tpm-recovery-information-to-ad-ds.md @@ -2,177 +2,96 @@ title: Backup the TPM recovery Information to AD DS (Windows 10) description: This topic for the IT professional describes how to back up a computer’s Trusted Platform Module (TPM) information to Active Directory Domain Services (AD DS) so that you can use AD DS to administer the TPM from a remote computer. ms.assetid: 62bcec80-96a1-464e-8b3f-d177a7565ac5 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Backup the TPM recovery Information to AD DS - - **Applies to** - - Windows 10 - This topic for the IT professional describes how to back up a computer’s Trusted Platform Module (TPM) information to Active Directory Domain Services (AD DS) so that you can use AD DS to administer the TPM from a remote computer. - ## About administering TPM remotely - - Backing up the TPM owner information for a computer allows administrators in a domain to remotely configure the TPM security hardware on the local computer. For example, administrators might want to reset the TPM to the manufacturer’s defaults when they decommission or repurpose computers, without having to be present at the computer. - You can use AD DS to store TPM owner information for use in recovery situations where the TPM owner has forgotten the password or where you must take control of the TPM. There is only one TPM owner password per computer; therefore, the hash of the TPM owner password can be stored as an attribute of the computer object in AD DS. The attribute has the common name (CN) of **ms-TPM-OwnerInformation**. - **Note**   The TPM owner authorization value is stored in AD DS, and it is present in a TPM owner password file as a SHA-1 hash of the TPM owner password, which is base 64–encoded. The actual owner password is not stored. -   - Domain controllers running Windows Server 2012 R2 or Windows Server 2012 include the required AD DS schema objects by default. However, if your domain controller is running Windows Server 2008 R2, you need to update the schema as described in [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md). - This topic contains procedures, some of which are dependent on Visual Basic scripts, to recover TPM information and decommission TPM on remote computers. Sample scripts are available, which you can customize to meet the requirements of your environment. - In this topic: - 1. [Check status of prerequisites](#bkmk-prereqs) - 2. [Set permissions to back up password information](#bkmk-setperms) - 3. [Configure Group Policy to back up TPM recovery information in AD DS](#bkmk-configuregp) - 4. [Use AD DS to recover TPM information](#bkmk-useit) - 5. [Sample scripts](#bkmk-adds-tpm-scripts) - ##
Check status of prerequisites - - Before you begin your backup, ensure that the following prerequisites are met: - 1. All domain controllers that are accessible by client computers that will be using TPM services are running Windows Server 2012 R2, Windows Server 2012, or Windows Server 2008 R2 with the updated schema. - **Tip**   For more info about the schema extensions that are required for a TPM backup in Active Directory domains that are running Windows Server 2008 R2, see [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md). -   - 2. You have domain administrator rights in the target forest, or you are using an account that has been granted appropriate permissions to extend the schema for the target forest. Members of the Enterprise Admins or Schema Admins groups are examples of accounts that have the appropriate permissions. - ## Set permissions to back up password information - - This procedure uses the sample script [Add-TPMSelfWriteACE.vbs](#bkmk-add-tpmselfwriteace) to add an access control entry (ACE) so that backing up TPM recovery information is possible. A client computer cannot back up TPM owner information until this ACE is added. - This script is run on the domain controller that you will use to administer the TPM recovery information, and it operates under the following assumptions: - - You have domain administrator credentials to set permissions for the top-level domain object. - - Your target domain is the same as the domain for the user account that is running the script. For example, running the script as TESTDOMAIN\\admin will extend permissions for TESTDOMAIN. - **Note**   You might need to modify the sample script if you want to set permissions for multiple domains, but you do not have domain administrator accounts for each of those domains. Find the variable **strPathToDomain** in the script, and modify it for your target domain, for example: - `LDAP://DC=testdomain,DC=nttest,DC=microsoft,DC=com` -   - - Your domain is configured so that permissions are inherited from the top-level domain object to targeted computer objects. - Permissions will not take effect if any container in the hierarchy does not allow inherited permissions. By default, permissions inheritance is set in AD DS. If you are not sure whether your configuration differs from this default, you can continue with the setup steps to set the permissions. You can then verify your configuration as described later in this topic. Or you can click the **Effective Permissions** button while viewing the properties of a computer object, then check that **Self** is approved to write the **msTPM-OwnerInformation** attribute. - **To add an ACE to allow TPM recovery information backup** - 1. Open the sample script **Add-TPMSelfWriteACE.vbs**. - The script contains a permission extension, and you must modify the value of **strPathToDomain** by using your domain name. - 2. Save your modifications to the script. - 3. Type the following at a command prompt, and then press ENTER: - **cscript Add-TPMSelfWriteACE.vbs** - This script adds a single ACE to the top-level domain object. The ACE is an inheritable permission that allows the computer (SELF) to write to the **ms-TPM-OwnerInformation** attribute for computer objects in the domain. - Complete the following procedure to check that the correct permissions are set and to remove TPM and BitLocker ACEs from the top-level domain, if necessary. - **Manage ACEs configured on TPM schema objects** - 1. Open the sample script **List-ACEs.vbs**. - 2. Modify **List-ACEs.vbs**. - You must modify: - - Value of **strPathToDomain**: Use your domain name. - - Filter options: The script sets a filter to address BitLocker and TPM schema objects, so you must modify **If IsFilterActive ()** if you want to list or remove other schema objects. - 3. Save your modifications to the script. - 4. Type the following at a command prompt, and then press ENTER: - **cscript List-ACEs.vbs** - With this script you can optionally remove ACEs from BitLocker and TPM schema objects on the top-level domain. - ## Configure Group Policy to back up TPM recovery information in AD DS - - Use these procedures to configure the [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md#bkmk-tpmgp-addsbu) policy setting on a local computer. In a production environment, an efficient way to do this is to create or edit a Group Policy Object (GPO) that can target client computers in the domain. - **To enable local policy setting to back up TPM recovery information to AD DS** - 1. Sign in to a domain-joined computer by using a domain account that is a member of the local Administrators group. - 2. Open the Local Group Policy Editor (gpedit.msc), and in the console tree, navigate to **Computer Configuration\\Administrative Templates\\System**. - 3. Click **Trusted Platform Module Services**. - 4. Double-click **Turn on TPM backup to Active Directory Domain Services**. - 5. Click **Enabled**, and then click **OK**. - **Important**   When this setting is enabled, the TPM owner password cannot be set or changed unless the computer is connected to the domain and AD DS backup of the TPM recovery information succeeds. -   - ## Use AD DS to recover TPM information - - When you need to recover the TPM owner information from AD DS and use it to manage the TPM, you need to read the **ms-TPM-OwnerInformation** object from AD DS, and then manually create a TPM owner password backup file that can be supplied when TPM owner credentials are required. - **To obtain TPM owner backup information from AD DS and create a password file** - 1. Sign in to a domain controller by using domain administrator credentials. - 2. Copy the sample script file, [Get-TPMOwnerInfo.vbs](#ms-tpm-ownerinformation), to a location on your computer. - 3. Open a Command Prompt window, and change the default location to the location of the sample script files you saved in the previous step. - 4. At the command prompt, type **cscript Get-TPMOwnerInfo.vbs**. - The expected output is a string that is the hash of the password that you created earlier. - **Note**   If you receive the error message, "Active Directory: The directory property cannot be found in the cache," verify that you are using a domain administrator account, which is required to read the **ms-TPM-OwnerInformation** attribute. - The only exception to this requirement is that if users are the Creator Owner of computer objects that they join to the domain, they can possibly read the TPM owner information for their computer objects. -   - 5. Open Notepad or another text editor, and copy the following code sample into the file, and replace *TpmOwnerPasswordHash* with the string that you recorded in the previous step. - ``` syntax @@ -181,24 +100,14 @@ When you need to recover the TPM owner information from AD DS and use it to man                 TpmOwnerPasswordHash ``` - 6. Save this file with a .tpm extension on a removable storage device, such as a USB flash drive. When you access the TPM, and you are required to provide the TPM owner password, choose the option for reading the password from a file and provide the path to this file. - ## Sample scripts - - You can use all or portions of the following sample scripts, which are used in the preceding procedures, to configure AD DS for backing up TPM recovery information. Customization is required depending on how your environment is configured. - - [Add-TPMSelfWriteACE.vbs: Use to add the access control entry (ACE) for the TPM to AD DS](#bkmk-add-tpmselfwriteace) - - [List-ACEs.vbs: Use to list or remove the ACEs that are configured on BitLocker and TPM schema objects](#bkmk-list-aces) - - [Get-TPMOwnerInfo.vbs: Use to retrieve the TPM recovery information from AD DS for a particular computer](#bkmk-get-tpmownerinfo) - ### Add-TPMSelfWriteACE.vbs - This script adds the access control entry (ACE) for the TPM to AD DS so that the computer can back up TPM recovery information in AD DS. - ``` syntax '=============================================================================== ' @@ -232,104 +141,70 @@ This script adds the access control entry (ACE) for the TPM to AD DS so that th ' of such damages. ' ' Version 1.0.2 - Tested and re-released for Windows 8 and Windows Server 2012 - ' '=============================================================================== - ' -------------------------------------------------------------------------------- ' Access Control Entry (ACE) constants ' -------------------------------------------------------------------------------- - '- From the ADS_ACETYPE_ENUM enumeration Const ADS_ACETYPE_ACCESS_ALLOWED_OBJECT = &H5 'Allows an object to do something - '- From the ADS_ACEFLAG_ENUM enumeration Const ADS_ACEFLAG_INHERIT_ACE = &H2 'ACE can be inherited to child objects Const ADS_ACEFLAG_INHERIT_ONLY_ACE = &H8 'ACE does NOT apply to target (parent) object - '- From the ADS_RIGHTS_ENUM enumeration Const ADS_RIGHT_DS_WRITE_PROP = &H20 'The right to write object properties Const ADS_RIGHT_DS_CREATE_CHILD = &H1 'The right to create child objects - '- From the ADS_FLAGTYPE_ENUM enumeration Const ADS_FLAG_OBJECT_TYPE_PRESENT = &H1 'Target object type is present in the ACE Const ADS_FLAG_INHERITED_OBJECT_TYPE_PRESENT = &H2 'Target inherited object type is present in the ACE - ' -------------------------------------------------------------------------------- ' TPM and FVE schema object GUID's ' -------------------------------------------------------------------------------- - '- ms-TPM-OwnerInformation attribute SCHEMA_GUID_MS_TPM_OWNERINFORMATION = "{AA4E1A6D-550D-4E05-8C35-4AFCB917A9FE}" - '- ms-FVE-RecoveryInformation object SCHEMA_GUID_MS_FVE_RECOVERYINFORMATION = "{EA715D30-8F53-40D0-BD1E-6109186D782C}" - '- Computer object SCHEMA_GUID_COMPUTER = "{BF967A86-0DE6-11D0-A285-00AA003049E2}" - 'Reference: "Platform SDK: Active Directory Schema" - - - - ' -------------------------------------------------------------------------------- ' Set up the ACE to allow write of TPM owner information ' -------------------------------------------------------------------------------- - Set objAce1 = createObject("AccessControlEntry") - objAce1.AceFlags = ADS_ACEFLAG_INHERIT_ACE + ADS_ACEFLAG_INHERIT_ONLY_ACE objAce1.AceType = ADS_ACETYPE_ACCESS_ALLOWED_OBJECT objAce1.Flags = ADS_FLAG_OBJECT_TYPE_PRESENT + ADS_FLAG_INHERITED_OBJECT_TYPE_PRESENT - objAce1.Trustee = "SELF" objAce1.AccessMask = ADS_RIGHT_DS_WRITE_PROP objAce1.ObjectType = SCHEMA_GUID_MS_TPM_OWNERINFORMATION objAce1.InheritedObjectType = SCHEMA_GUID_COMPUTER - - - ' -------------------------------------------------------------------------------- ' NOTE: BY default, the "SELF" computer account can create ' BitLocker recovery information objects and write BitLocker recovery properties ' ' No additional ACE's are needed. ' -------------------------------------------------------------------------------- - - ' -------------------------------------------------------------------------------- ' Connect to Discretional ACL (DACL) for domain object ' -------------------------------------------------------------------------------- - Set objRootLDAP = GetObject("LDAP://rootDSE") strPathToDomain = "LDAP://" & objRootLDAP.Get("defaultNamingContext") ' e.g. string dc=fabrikam,dc=com - Set objDomain = GetObject(strPathToDomain) - WScript.Echo "Accessing object: " + objDomain.Get("distinguishedName") - Set objDescriptor = objDomain.Get("ntSecurityDescriptor") Set objDacl = objDescriptor.DiscretionaryAcl - ' -------------------------------------------------------------------------------- ' Add the ACEs to the Discretionary ACL (DACL) and set the DACL ' -------------------------------------------------------------------------------- - objDacl.AddAce objAce1 - objDescriptor.DiscretionaryAcl = objDacl objDomain.Put "ntSecurityDescriptor", Array(objDescriptor) objDomain.SetInfo - WScript.Echo "SUCCESS!" ``` - ### List-ACEs.vbs - This script lists or removes the ACEs that are configured on BitLocker and TPM schema objects for the top-level domain. This enables you to verify that the expected ACEs have been added appropriately or to remove any ACEs that are related to BitLocker or the TPM, if necessary. - ``` syntax '=============================================================================== ' @@ -364,11 +239,9 @@ This script lists or removes the ACEs that are configured on BitLocker and TPM s ' Version 1.0.2 - Tested and re-released for Windows 8 and Windows Server 2012 ' '=============================================================================== - ' -------------------------------------------------------------------------------- ' Usage ' -------------------------------------------------------------------------------- - Sub ShowUsage Wscript.Echo "USAGE: List-ACEs" Wscript.Echo "List access permissions for BitLocker and TPM schema objects" @@ -377,14 +250,10 @@ Sub ShowUsage Wscript.Echo "Removes access permissions for BitLocker and TPM schema objects" WScript.Quit End Sub - - ' -------------------------------------------------------------------------------- ' Parse Arguments ' -------------------------------------------------------------------------------- - Set args = WScript.Arguments - Select Case args.Count Case 0 @@ -399,97 +268,63 @@ Select Case args.Count removeACE = True End If End If - Case Else ShowUsage - End Select - ' -------------------------------------------------------------------------------- ' Configuration of the filter to show/remove only ACE's for BDE and TPM objects ' -------------------------------------------------------------------------------- - '- ms-TPM-OwnerInformation attribute SCHEMA_GUID_MS_TPM_OWNERINFORMATION = "{AA4E1A6D-550D-4E05-8C35-4AFCB917A9FE}" - '- ms-FVE-RecoveryInformation object SCHEMA_GUID_MS_FVE_RECOVERYINFORMATION = "{EA715D30-8F53-40D0-BD1E-6109186D782C}" - ' Use this filter to list/remove only ACEs related to TPM and BitLocker - aceGuidFilter = Array(SCHEMA_GUID_MS_TPM_OWNERINFORMATION, _ SCHEMA_GUID_MS_FVE_RECOVERYINFORMATION) - - ' Note to script source reader: ' Uncomment the following line to turn off the filter and list all ACEs 'aceGuidFilter = Array() - - ' -------------------------------------------------------------------------------- ' Helper functions related to the list filter for listing or removing ACE's ' -------------------------------------------------------------------------------- - Function IsFilterActive() - If Join(aceGuidFilter) = "" Then IsFilterActive = False Else IsFilterActive = True End If - End Function - - Function isAceWithinFilter(ace) - aceWithinFilter = False ' assume first not pass the filter - For Each guid In aceGuidFilter - If ace.ObjectType = guid Or ace.InheritedObjectType = guid Then isAceWithinFilter = True End If Next - End Function - Sub displayFilter For Each guid In aceGuidFilter WScript.echo guid Next End Sub - - ' -------------------------------------------------------------------------------- ' Connect to Discretional ACL (DACL) for domain object ' -------------------------------------------------------------------------------- - Set objRootLDAP = GetObject("LDAP://rootDSE") strPathToDomain = "LDAP://" & objRootLDAP.Get("defaultNamingContext") ' e.g. dc=fabrikam,dc=com - Set domain = GetObject(strPathToDomain) - WScript.Echo "Accessing object: " + domain.Get("distinguishedName") WScript.Echo "" - Set descriptor = domain.Get("ntSecurityDescriptor") Set dacl = descriptor.DiscretionaryAcl - - ' -------------------------------------------------------------------------------- ' Show Access Control Entries (ACE's) ' -------------------------------------------------------------------------------- - ' Loop through the existing ACEs, including all ACEs if the filter is not active - i = 1 ' global index c = 0 ' found count - relevant if filter is active - For Each ace In dacl - If IsFilterActive() = False or isAceWithinFilter(ace) = True Then - ' note to script source reader: ' echo i to show the index of the ACE @@ -501,80 +336,51 @@ For Each ace In dacl WScript.echo "> InheritedObjectType: " & ace.InheritedObjectType WScript.echo "> Trustee: " & ace.Trustee WScript.echo "" - - if IsFilterActive() = True Then c = c + 1 - ' optionally include this ACE in removal list if configured ' note that the filter being active is a requirement since we don't ' want to accidentally remove all ACEs - If removeACE = True Then dacl.RemoveAce ace End If - end if - End If - i = i + 1 - Next - - ' Display number of ACEs found - If IsFilterActive() = True Then - WScript.echo c & " ACE(s) found in " & domain.Get("distinguishedName") _ & " related to BitLocker and TPM" 'note to script source reader: change this line if you configure your own - filter - ' note to script source reader: ' uncomment the following lines if you configure your own filter 'WScript.echo "" 'WScript.echo "The following filter was active: " 'displayFilter 'Wscript.echo "" - Else - i = i - 1 WScript.echo i & " total ACE(s) found in " & domain.Get("distinguishedName") End If - - ' -------------------------------------------------------------------------------- ' Optionally remove ACE's on a filtered list ' -------------------------------------------------------------------------------- - if removeACE = True and IsFilterActive() = True then - descriptor.DiscretionaryAcl = dacl domain.Put "ntSecurityDescriptor", Array(descriptor) domain.setInfo - WScript.echo c & " ACE(s) removed from " & domain.Get("distinguishedName") - else - if removeACE = True then - WScript.echo "You must specify a filter to remove ACEs from " & domain.Get("distinguishedName") end if - - end if ``` - ### Get-TPMOwnerInfo.vbs - This script retrieves TPM recovery information from AD DS for a particular computer so that you can verify that only domain administrators (or delegated roles) can read backed up TPM recovery information and verify that the information is being backed up correctly. - ``` syntax '================================================================================= ' @@ -609,24 +415,18 @@ This script retrieves TPM recovery information from AD DS for a particular comp ' Version 1.1.2 - Tested and re-released for Windows 8 and Windows Server 2012 ' '================================================================================= - - ' -------------------------------------------------------------------------------- ' Usage ' -------------------------------------------------------------------------------- - Sub ShowUsage Wscript.Echo "USAGE: Get-TpmOwnerInfo [Optional Computer Name]" Wscript.Echo "If no computer name is specified, the local computer is assumed." WScript.Quit End Sub - ' -------------------------------------------------------------------------------- ' Parse Arguments ' -------------------------------------------------------------------------------- - Set args = WScript.Arguments - Select Case args.Count Case 0 @@ -643,22 +443,15 @@ Select Case args.Count Case Else ShowUsage - End Select - - ' -------------------------------------------------------------------------------- ' Get path to Active Directory computer object associated with the computer name ' -------------------------------------------------------------------------------- - Function GetStrPathToComputer(strComputerName) - ' Uses the global catalog to find the computer in the forest ' Search also includes deleted computers in the tombstone - Set objRootLDAP = GetObject("LDAP://rootDSE") namingContext = objRootLDAP.Get("defaultNamingContext") ' e.g. string dc=fabrikam,dc=com - strBase = "" Set objConnection = CreateObject("ADODB.Connection") @@ -666,84 +459,52 @@ Function GetStrPathToComputer(strComputerName) objConnection.Provider = "ADsDSOOBject" objConnection.Open "Active Directory Provider" Set objCommand.ActiveConnection = objConnection - strFilter = "(&(objectCategory=Computer)(cn=" & strComputerName & "))" strQuery = strBase & ";" & strFilter & ";distinguishedName;subtree" - objCommand.CommandText = strQuery objCommand.Properties("Page Size") = 100 objCommand.Properties("Timeout") = 100 objCommand.Properties("Cache Results") = False - ' Enumerate all objects found. - Set objRecordSet = objCommand.Execute If objRecordSet.EOF Then WScript.echo "The computer name '" & strComputerName & "' cannot be found." WScript.Quit 1 End If - ' Found object matching name - Do Until objRecordSet.EOF dnFound = objRecordSet.Fields("distinguishedName") GetStrPathToComputer = "LDAP://" & dnFound objRecordSet.MoveNext Loop - - ' Clean up. Set objConnection = Nothing Set objCommand = Nothing Set objRecordSet = Nothing - End Function - ' -------------------------------------------------------------------------------- ' Securely access the Active Directory computer object using Kerberos ' -------------------------------------------------------------------------------- - Set objDSO = GetObject("LDAP:") strPath = GetStrPathToComputer(strComputerName) - - WScript.Echo "Accessing object: " + strPath - Const ADS_SECURE_AUTHENTICATION = 1 Const ADS_USE_SEALING = 64 '0x40 Const ADS_USE_SIGNING = 128 '0x80 - Set objComputer = objDSO.OpenDSObject(strPath, vbNullString, vbNullString, _ ADS_SECURE_AUTHENTICATION + ADS_USE_SEALING + ADS_USE_SIGNING) - ' -------------------------------------------------------------------------------- ' Get the TPM owner information from the Active Directory computer object ' -------------------------------------------------------------------------------- - strOwnerInformation = objComputer.Get("msTPM-OwnerInformation") WScript.echo "msTPM-OwnerInformation: " + strOwnerInformation ``` - ## Additional resources - - [Trusted Platform Module technology overview](trusted-platform-module-overview.md) - [TPM fundamentals](tpm-fundamentals.md) - [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md) - [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx) - [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md) - [Prepare your organization for BitLocker: Planning and Policies](http://technet.microsoft.com/library/jj592683.aspx), see TPM considerations -   -   - - - - - diff --git a/windows/keep-secure/basic-audit-account-logon-events.md b/windows/keep-secure/basic-audit-account-logon-events.md index ebac5ddb27..2cbc711559 100644 --- a/windows/keep-secure/basic-audit-account-logon-events.md +++ b/windows/keep-secure/basic-audit-account-logon-events.md @@ -2,34 +2,22 @@ title: Audit account logon events (Windows 10) description: Determines whether to audit each instance of a user logging on to or logging off from another device in which this device is used to validate the account. ms.assetid: 84B44181-E325-49A1-8398-AECC3CE0A516 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit account logon events - - **Applies to** - - Windows 10 - Determines whether to audit each instance of a user logging on to or logging off from another device in which this device is used to validate the account. - This security setting determines whether to audit each instance of a user logging on to or logging off from another computer in which this computer is used to validate the account. Account logon events are generated when a domain user account is authenticated on a domain controller. The event is logged in the domain controller's security log. Logon events are generated when a local user is authenticated on a local computer. The event is logged in the local security log. Account logoff events are not generated. - If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit the event type at all. Success audits generate an audit entry when an account logon attempt succeeds. Failure audits generate an audit entry when an account logon attempt fails. - To set this value to **No auditing**, in the **Properties** dialog box for this policy setting, select the **Define these policy settings** check box and clear the **Success** and **Failure** check boxes. - **Default**: Success - ## Configure this audit setting - - You can configure this security setting by opening the appropriate policy under Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Audit Policy. - | Logon events | Description | |--------------|--------------------------------------------------------------------------------------------------------------------------------------| | 672 | An authentication service (AS) ticket was successfully issued and validated. | @@ -42,19 +30,8 @@ You can configure this security setting by opening the appropriate policy under | 681 | Logon failure. A domain account logon was attempted. This event is not generated in Windows XP or in the Windows Server 2003 family. | | 682 | A user has reconnected to a disconnected terminal server session. | | 683 | A user disconnected a terminal server session without logging off. | -   - ## Related topics - - [Basic security audit policy settings](basic-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/basic-audit-account-management.md b/windows/keep-secure/basic-audit-account-management.md index 54b8232935..791e8187a9 100644 --- a/windows/keep-secure/basic-audit-account-management.md +++ b/windows/keep-secure/basic-audit-account-management.md @@ -2,42 +2,26 @@ title: Audit account management (Windows 10) description: Determines whether to audit each event of account management on a device. ms.assetid: 369197E1-7E0E-45A4-89EA-16D91EF01689 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit account management - - **Applies to** - - Windows 10 - Determines whether to audit each event of account management on a device. - Examples of account management events include: - - A user account or group is created, changed, or deleted. - - A user account is renamed, disabled, or enabled. - - A password is set or changed. - If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit the event type at all. Success audits generate an audit entry when any account management event succeeds. Failure audits generate an audit entry when any account management event fails. To set this value to **No auditing**, in the **Properties** dialog box for this policy setting, select the Define these policy settings check box and clear the **Success** and **Failure** check boxes. - **Default:** - - Success on domain controllers. - - No auditing on member servers. - ## Configure this audit setting - - You can configure this security setting by opening the appropriate policy under Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Audit Policy. - @@ -236,19 +220,8 @@ You can configure this security setting by opening the appropriate policy under
-   - ## Related topics - - [Basic security audit policy settings](basic-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/basic-audit-directory-service-access.md b/windows/keep-secure/basic-audit-directory-service-access.md index 25799f59ea..d6154e8c8c 100644 --- a/windows/keep-secure/basic-audit-directory-service-access.md +++ b/windows/keep-secure/basic-audit-directory-service-access.md @@ -2,61 +2,33 @@ title: Audit directory service access (Windows 10) description: Determines whether to audit the event of a user accessing an Active Directory object that has its own system access control list (SACL) specified. ms.assetid: 52F02EED-3CFE-4307-8D06-CF1E27693D09 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit directory service access - - **Applies to** - - Windows 10 - \[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.\] - Determines whether to audit the event of a user accessing an Active Directory object that has its own system access control list (SACL) specified. - By default, this value is set to no auditing in the Default Domain Controller Group Policy object (GPO), and it remains undefined for workstations and servers where it has no meaning. - If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit the event type at all. Success audits generate an audit entry when a user successfully accesses an Active Directory object that has a SACL specified. Failure audits generate an audit entry when a user unsuccessfully attempts to access an Active Directory object that has a SACL specified. To set this value to **No auditing,** in the **Properties** dialog box for this policy setting, select the **Define these policy settings** check box and clear the **Success** and **Failure** check boxes. - **Note**   You can set a SACL on an Active Directory object by using the **Security** tab in that object's **Properties** dialog box. This is the same as Audit object access, except that it applies only to Active Directory objects and not to file system and registry objects. -   - **Default:** - - Success on domain controllers. - - Undefined for a member server. - ## Configure this audit setting - - You can configure this security setting under Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Audit Policy. - There is only one directory service access event, which is identical to the Object Access security event message 566. - | Directory service access events | Description | |---------------------------------|----------------------------------------| | 566 | A generic object operation took place. | -   - ## Related topics - - [Basic security audit policy settings](basic-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/basic-audit-logon-events.md b/windows/keep-secure/basic-audit-logon-events.md index 27d4e90250..f434f50087 100644 --- a/windows/keep-secure/basic-audit-logon-events.md +++ b/windows/keep-secure/basic-audit-logon-events.md @@ -2,34 +2,22 @@ title: Audit logon events (Windows 10) description: Determines whether to audit each instance of a user logging on to or logging off from a device. ms.assetid: 78B5AFCB-0BBD-4C38-9FE9-6B4571B94A35 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit logon events - - **Applies to** - - Windows 10 - \[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.\] - Determines whether to audit each instance of a user logging on to or logging off from a device. - Account logon events are generated on domain controllers for domain account activity and on local devices for local account activity. If both account logon and logon audit policy categories are enabled, logons that use a domain account generate a logon or logoff event on the workstation or server, and they generate an account logon event on the domain controller. Additionally, interactive logons to a member server or workstation that use a domain account generate a logon event on the domain controller as the logon scripts and policies are retrieved when a user logs on. For more info about account logon events, see [Audit account logon events](basic-audit-account-logon-events.md). - If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit the event type at all. Success audits generate an audit entry when a logon attempt succeeds. Failure audits generate an audit entry when a logon attempt fails. - To set this value to **No auditing**, in the **Properties** dialog box for this policy setting, select the **Define these policy settings** check box and clear the **Success** and **Failure** check boxes. - ## Configure this audit setting - - You can configure this security setting by opening the appropriate policy under Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Audit Policy. - | Logon events | Description | |--------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 528 | A user successfully logged on to a computer. For information about the type of logon, see the Logon Types table below. | @@ -59,11 +47,8 @@ You can configure this security setting by opening the appropriate policy under | 552 | A user successfully logged on to a computer using explicit credentials while already logged on as a different user. | | 682 | A user has reconnected to a disconnected terminal server session. | | 683 | A user disconnected a terminal server session without logging off. | -   - When event 528 is logged, a logon type is also listed in the event log. The following table describes each logon type. - | Logon type | Logon title | Description | |------------|-------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 2 | Interactive | A user logged on to this computer. | @@ -75,19 +60,8 @@ When event 528 is logged, a logon type is also listed in the event log. The foll | 9 | NewCredentials | A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections. | | 10 | RemoteInteractive | A user logged on to this computer remotely using Terminal Services or Remote Desktop. | | 11 | CachedInteractive | A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials. | -   - ## Related topics - - [Basic security audit policy settings](basic-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/basic-audit-object-access.md b/windows/keep-secure/basic-audit-object-access.md index 84b7afbcea..4df8e47cf1 100644 --- a/windows/keep-secure/basic-audit-object-access.md +++ b/windows/keep-secure/basic-audit-object-access.md @@ -2,36 +2,23 @@ title: Audit object access (Windows 10) description: Determines whether to audit the event of a user accessing an object--for example, a file, folder, registry key, printer, and so forth--that has its own system access control list (SACL) specified. ms.assetid: D15B6D67-7886-44C2-9972-3F192D5407EA +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit object access - - **Applies to** - - Windows 10 - Determines whether to audit the event of a user accessing an object--for example, a file, folder, registry key, printer, and so forth--that has its own system access control list (SACL) specified. - If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit the event type at all. Success audits generate an audit entry when a user successfully accesses an object that has an appropriate SACL specified. Failure audits generate an audit entry when a user unsuccessfully attempts to access an object that has a SACL specified. - To set this value to **No auditing**, in the **Properties** dialog box for this policy setting, select the Define these policy settings check box and clear the **Success** and **Failure** check boxes. - **Note**  You can set a SACL on a file system object using the **Security** tab in that object's **Properties** dialog box. -   - **Default:** No auditing. - ## Configure this audit setting - - You can configure this security setting by opening the appropriate policy under Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Audit Policy. - @@ -228,19 +215,8 @@ You can configure this security setting by opening the appropriate policy under
-   - ## Related topics - - [Basic security audit policy settings](basic-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/basic-audit-policy-change.md b/windows/keep-secure/basic-audit-policy-change.md index 48eb4dc41b..b95dea0e7d 100644 --- a/windows/keep-secure/basic-audit-policy-change.md +++ b/windows/keep-secure/basic-audit-policy-change.md @@ -2,36 +2,23 @@ title: Audit policy change (Windows 10) description: Determines whether to audit every incident of a change to user rights assignment policies, audit policies, or trust policies. ms.assetid: 1025A648-6B22-4C85-9F47-FE0897F1FA31 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit policy change - - **Applies to** - - Windows 10 - Determines whether to audit every incident of a change to user rights assignment policies, audit policies, or trust policies. - If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit the event type at all. Success audits generate an audit entry when a change to user rights assignment policies, audit policies, or trust policies is successful. Failure audits generate an audit entry when a change to user rights assignment policies, audit policies, or trust policies fails. - To set this value to **No auditing**, in the **Properties** dialog box for this policy setting, select the **Define these policy settings** check box and clear the **Success** and **Failure** check boxes. - **Default:** - - Success on domain controllers. - - No auditing on member servers. - ## Configure this audit setting - - You can configure this security setting under Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Audit Policy. - @@ -154,19 +141,8 @@ You can configure this security setting under Computer Configuration\\Windows Se
-   - ## Related topics - - [Basic security audit policy settings](basic-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/basic-audit-privilege-use.md b/windows/keep-secure/basic-audit-privilege-use.md index bf1b98b716..272a6a6fa0 100644 --- a/windows/keep-secure/basic-audit-privilege-use.md +++ b/windows/keep-secure/basic-audit-privilege-use.md @@ -2,48 +2,29 @@ title: Audit privilege use (Windows 10) description: Determines whether to audit each instance of a user exercising a user right. ms.assetid: C5C6DAAF-8B58-4DFB-B1CE-F0675AE0E9F8 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit privilege use - - **Applies to** - - Windows 10 - Determines whether to audit each instance of a user exercising a user right. - If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit this type of event at all. Success audits generate an audit entry when the exercise of a user right succeeds. Failure audits generate an audit entry when the exercise of a user right fails. - To set this value to **No auditing**, in the **Properties** dialog box for this policy setting, select the Define these policy settings check box and clear the **Success** and **Failure** check boxes. - **Default:** No auditing. - Audits are not generated for use of the following user rights, even if success audits or failure audits are specified for **Audit privilege use**. Enabling auditing of these user rights tend to generate many events in the security log which may impede your computer's performance. To audit the following user rights, enable the **FullPrivilegeAuditing** registry key. - - Bypass traverse checking - - Debug programs - - Create a token object - - Replace process level token - - Generate security audits - - Back up files and directories - - Restore files and directories - ## Configure this audit setting - - You can configure this security setting under Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Audit Policy. - @@ -76,19 +57,8 @@ You can configure this security setting under Computer Configuration\\Windows Se
-   - ## Related topics - - [Basic security audit policy settings](basic-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/basic-audit-process-tracking.md b/windows/keep-secure/basic-audit-process-tracking.md index d0efa7d0b8..fe9d851f8d 100644 --- a/windows/keep-secure/basic-audit-process-tracking.md +++ b/windows/keep-secure/basic-audit-process-tracking.md @@ -2,32 +2,21 @@ title: Audit process tracking (Windows 10) description: Determines whether to audit detailed tracking information for events such as program activation, process exit, handle duplication, and indirect object access. ms.assetid: 91AC5C1E-F4DA-4B16-BEE2-C92D66E4CEEA +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit process tracking - - **Applies to** - - Windows 10 - Determines whether to audit detailed tracking information for events such as program activation, process exit, handle duplication, and indirect object access. - If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit the event type at all. Success audits generate an audit entry when the process being tracked succeeds. Failure audits generate an audit entry when the process being tracked fails. - To set this value to **No auditing**, in the **Properties** dialog box for this policy setting, select the Define these policy settings check box and clear the **Success** and **Failure** check boxes. - **Default:** No auditing. - ## Configure this this security setting - - You can configure this security setting under Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Audit Policy. - @@ -92,19 +81,8 @@ You can configure this security setting under Computer Configuration\\Windows Se
-   - ## Related topics - - [Basic security audit policy settings](basic-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/basic-audit-system-events.md b/windows/keep-secure/basic-audit-system-events.md index 34f4206e90..47616b6d5b 100644 --- a/windows/keep-secure/basic-audit-system-events.md +++ b/windows/keep-secure/basic-audit-system-events.md @@ -2,36 +2,23 @@ title: Audit system events (Windows 10) description: Determines whether to audit when a user restarts or shuts down the computer or when an event occurs that affects either the system security or the security log. ms.assetid: BF27588C-2AA7-4365-A4BF-3BB377916447 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Audit system events - - **Applies to** - - Windows 10 - Determines whether to audit when a user restarts or shuts down the computer or when an event occurs that affects either the system security or the security log. - If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit the event type at all. Success audits generate an audit entry when a logon attempt succeeds. Failure audits generate an audit entry when a logon attempt fails. - To set this value to **No auditing**, in the **Properties** dialog box for this policy setting, select the **Define these policy settings** check box and clear the **Success** and **Failure** check boxes. - **Default:** - - Success on domain controllers. - - No auditing on member servers. - ## Configure this audit setting - - You can configure this security setting by opening the appropriate policy under Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Audit Policy. - @@ -88,19 +75,8 @@ You can configure this security setting by opening the appropriate policy under
-   - ## Related topics - - [Basic security audit policy settings](basic-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/basic-security-audit-policies.md b/windows/keep-secure/basic-security-audit-policies.md index 8aaba83b70..fd2a5a1889 100644 --- a/windows/keep-secure/basic-security-audit-policies.md +++ b/windows/keep-secure/basic-security-audit-policies.md @@ -2,23 +2,17 @@ title: Basic security audit policies (Windows 10) description: Before you implement auditing, you must decide on an auditing policy. ms.assetid: 3B678568-7AD7-4734-9BB4-53CF5E04E1D3 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Basic security audit policies - - **Applies to** - - Windows 10 - Before you implement auditing, you must decide on an auditing policy. A basic audit policy specifies categories of security-related events that you want to audit. When this version of Windows is first installed, all auditing categories are disabled. By enabling various auditing event categories, you can implement an auditing policy that suits the security needs of your organization. - The event categories that you can choose to audit are: - - Audit account logon events - Audit account management - Audit directory service access @@ -28,12 +22,8 @@ The event categories that you can choose to audit are: - Audit privilege use - Audit process tracking - Audit system events - If you choose to audit access to objects as part of your audit policy, you must enable either the audit directory service access category (for auditing objects on a domain controller), or the audit object access category (for auditing objects on a member server or workstation). Once you have enabled the object access category, you can specify the types of access you want to audit for each group or user. - ## In this section - - @@ -64,14 +54,6 @@ If you choose to audit access to objects as part of your audit policy, you must
-   -   -   - - - - - diff --git a/windows/keep-secure/basic-security-audit-policy-settings.md b/windows/keep-secure/basic-security-audit-policy-settings.md index f59bbe3000..ccd569896a 100644 --- a/windows/keep-secure/basic-security-audit-policy-settings.md +++ b/windows/keep-secure/basic-security-audit-policy-settings.md @@ -2,24 +2,17 @@ title: Basic security audit policy settings (Windows 10) description: Basic security audit policy settings are found under Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Audit Policy. ms.assetid: 31C2C453-2CFC-4D9E-BC88-8CE1C1A8F900 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Basic security audit policy settings - - **Applies to** - - Windows 10 - Basic security audit policy settings are found under Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Audit Policy. - ## In this section - - @@ -70,19 +63,8 @@ Basic security audit policy settings are found under Computer Configuration\\Win
-   - ## Related topics - - [Basic security audit policy settings](basic-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/bcd-settings-and-bitlocker.md b/windows/keep-secure/bcd-settings-and-bitlocker.md index c245fc0a1b..d9a55ae0f6 100644 --- a/windows/keep-secure/bcd-settings-and-bitlocker.md +++ b/windows/keep-secure/bcd-settings-and-bitlocker.md @@ -2,82 +2,46 @@ title: BCD settings and BitLocker (Windows 10) description: This topic for IT professionals describes the BCD settings that are used by BitLocker. ms.assetid: c4ab7ac9-16dc-4c7e-b061-c0b0deb2c4fa +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # BCD settings and BitLocker - - **Applies to** - - Windows 10 - This topic for IT professionals describes the BCD settings that are used by BitLocker. - When protecting data at rest on an operating system volume, during the boot process BitLocker verifies that the security sensitive boot configuration data (BCD) settings have not changed since BitLocker was last enabled, resumed, or recovered. - ## BitLocker and BCD Settings - - In Windows 7 and Windows Server 2008 R2, BitLocker validated nearly all BCD settings with the winload, winresume, and memtest prefixes. However, this high degree of validation caused BitLocker to go into recovery mode for benign setting changes, for example, when applying a language pack BitLocker would enter recovery. - In Windows 8, Windows Server 2012, and later operating systems BitLocker narrows the set of BCD settings validated to reduce the chance of benign changes causing a BCD validation problem. If you believe that there is a risk in excluding a particular BCD setting from the validation profile, you can increase BCD validation coverage to suit your validation preferences. Alternatively, if a default BCD setting is persistently triggering recovery for benign changes, then you can exclude that BCD setting from the validation profile. - ### When secure boot is enabled - Computers with UEFI firmware can use Secure Boot to provide enhanced boot security. When BitLocker is able to use Secure Boot for platform and BCD integrity validation, as defined by the **Allow Secure Boot for integrity validation** group policy setting, the **Use enhanced Boot Configuration Data validation profile** group policy is ignored. - One of the benefits of using Secure Boot is that it can correct BCD settings during boot without triggering recovery events. Secure Boot enforces the same BCD settings as BitLocker. Secure Boot BCD enforcement is not configurable from within the operating system. - ## Customizing BCD validation settings - - To modify the BCD settings BitLocker validates the IT Pro will add or exclude BCD settings from the platform validation profile by enabling and configuring the **Use enhanced Boot Configuration Data validation profile** Group Policy setting. - For the purposes of BitLocker validation, BCD settings are associated with a specific set of Microsoft boot applications. BCD settings are either associated with a specific boot application or can apply to all boot applications by associating a prefix to the BCD setting entered in the Group Policy setting. Prefix values include: - - winload - - winresume - - memtest - - all - All BCD settings are specified by combining the prefix value with either a hexadecimal (hex) value or a “friendly name.” - The BCD setting hex value is reported when BitLocker enters recovery mode and is stored in the event log (event ID 523). The hex value uniquely identifies which BCD setting caused the recovery event. - You can quickly obtain the friendly name for the BCD settings on your computer by using the command “`bcdedit.exe /enum all`”. - Not all BCD settings have friendly names, for those settings the hex value is the only way to configure an exclusion policy. - When specifying BCD values in the **Use enhanced Boot Configuration Data validation profile** Group Policy setting, use the following syntax: - - Prefix the setting with the boot application prefix - - Append a colon ‘:’ - - Append either the hex value or the friendly name - - If entering more than one BCD setting, you will need to enter each BCD setting on a new line - For example, either “`winload:hypervisordebugport`” or “`winload:0x250000f4`” yield the same value. - Setting that applies to all boot applications may be applied only to an individual application, however the reverse is not true. For example, one can specify either: “`all:locale`” or “`winresume:locale`”, but as the bcd setting “`win-pe`” does not apply to all boot applications, “`winload:winpe`” is valid, but “`all:winpe`” is not valid. The setting that controls boot debugging (“`bootdebug`” or 0x16000010) will always be validated and will have no effect if it is included in the provided fields. - **Note**   Take care when configuring BCD entries in the Group Policy setting. The Local Group Policy Editor does not validate the correctness of the BCD entry. BitLocker will fail to be enabled if the Group Policy setting specified is invalid. -   - ### Default BCD validation profile - The following table contains the default BCD validation profile used by BitLocker in Windows 8, Windows Server 2012, and later operating systems: - @@ -219,18 +183,12 @@ The following table contains the default BCD validation profile used by BitLocke
-   - ### Full list of friendly names for ignored BCD settings - This following is a full list of BCD settings with friendly names which are ignored by default. These settings are not part of the default BitLocker validation profile, but can be added if you see a need to validate any of these settings before allowing a BitLocker–protected operating system drive to be unlocked. - **Note**   Additional BCD settings exist that have hex values but do not have friendly names. These settings are not included in this list. -   - @@ -992,14 +950,6 @@ Additional BCD settings exist that have hex values but do not have friendly name
-   -   -   - - - - - diff --git a/windows/keep-secure/bitlocker-basic-deployment.md b/windows/keep-secure/bitlocker-basic-deployment.md index e6eceae5d1..995b7a87ce 100644 --- a/windows/keep-secure/bitlocker-basic-deployment.md +++ b/windows/keep-secure/bitlocker-basic-deployment.md @@ -2,63 +2,37 @@ title: BitLocker basic deployment (Windows 10) description: This topic for the IT professional explains how BitLocker features can be used to protect your data through drive encryption. ms.assetid: 97c646cb-9e53-4236-9678-354af41151c4 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # BitLocker basic deployment - - **Applies to** - - Windows 10 - This topic for the IT professional explains how BitLocker features can be used to protect your data through drive encryption. - The following sections provide information that will help you put together your basic deployment plan for implementing BitLocker in your organization: - - [Using BitLocker to encrypt volumes](#bkmk-dep1) - - [Down-level compatibility](#bkmk-dep2) - - [Using manage-bde to encrypt volumes with BitLocker](#bkmk-dep3) - - [Using PowerShell to encrypt volumes with BitLocker](#bkmk-dep4) - ## Using BitLocker to encrypt volumes - - BitLocker provides full volume encryption (FVE) for operating system volumes, as well as fixed and removable data volumes. To support fully encrypted operating system volumes, BitLocker uses an unencrypted system volume for the files required to boot, decrypt, and load the operating system. This volume is automatically created during a new installation of both client and server operating systems. - In the event that the drive was prepared as a single contiguous space, BitLocker requires a new volume to hold the boot files. BdeHdCfg.exe can create these volumes. - **Note**   For more info about using this tool, see [Bdehdcfg](http://technet.microsoft.com/library/ee732026.aspx) in the Command-Line Reference. -   - BitLocker encryption can be done using the following methods: - - BitLocker control panel - - Windows Explorer - - manage-bde command line interface - - BitLocker Windows PowerShell cmdlets - ### Encrypting volumes using the BitLocker control panel - Encrypting volumes with the BitLocker control panel is how many users will utilize BitLocker. The name of the BitLocker control panel is BitLocker Drive Encryption. The BitLocker control panel supports encrypting operating system, fixed data and removable data volumes. The BitLocker control panel will organize available drives in the appropriate category based on how the device reports itself to Windows. Only formatted volumes with assigned drive letters will appear properly in the BitLocker control panel applet. - To start encryption for a volume, select **Turn on BitLocker** for the appropriate drive to initialize the BitLocker Drive Encryption Wizard. BitLocker Drive Encryption Wizard options vary based on volume type (operating system volume or data volume). - ### Operating system volume - Upon launch, the BitLocker Drive Encryption Wizard verifies the computer meets the BitLocker system requirements for encrypting an operating system volume. By default, the system requirements are: - @@ -104,65 +78,35 @@ Upon launch, the BitLocker Drive Encryption Wizard verifies the computer meets t
-   - Upon passing the initial configuration, users are required to enter a password for the volume. If the volume does not pass the initial configuration for BitLocker, the user is presented with an error dialog describing the appropriate actions to be taken. - Once a strong password has been created for the volume, a recovery key will be generated. The BitLocker Drive Encryption Wizard will prompt for a location to save this key. A BitLocker recovery key is a special key that you can create when you turn on BitLocker Drive Encryption for the first time on each drive that you encrypt. You can use the recovery key to gain access to your computer if the drive that Windows is installed on (the operating system drive) is encrypted using BitLocker Drive Encryption and BitLocker detects a condition that prevents it from unlocking the drive when the computer is starting up. A recovery key can also be used to gain access to your files and folders on a removable data drive (such as an external hard drive or USB flash drive) that is encrypted using BitLocker To Go, if for some reason you forget the password or your computer cannot access the drive. - You should store the recovery key by printing it, saving it on removable media, or saving it as a file in a network folder or on your OneDrive, or on another drive of your computer that you are not encrypting. You cannot save the recovery key to the root directory of a non-removable drive and cannot be stored on the encrypted volume. You cannot save the recovery key for a removable data drive (such as a USB flash drive) on removable media. Ideally, you should store the recovery key separate from your computer. After you create a recovery key, you can use the BitLocker control panel to make additional copies. - When the recovery key has been properly stored, the BitLocker Drive Encryption Wizard will prompt the user to choose how to encrypt the drive. There are two options: - - Encrypt used disk space only - Encrypts only disk space that contains data - - Encrypt entire drive - Encrypts the entire volume including free space - It is recommended that drives with little to no data utilize the **used disk space only** encryption option and that drives with data or an operating system utilize the **encrypt entire drive** option. - **Note**   Deleted files appear as free space to the file system, which is not encrypted by **used disk space only**. Until they are wiped or overwritten, deleted files hold information that could be recovered with common data forensic tools. -   - Selecting an encryption type and choosing **Next** will give the user the option of running a BitLocker system check (selected by default) which will ensure that BitLocker can properly access the recovery and encryption keys before the volume encryption begins. It is recommended to run this system check before starting the encryption process. If the system check is not run and a problem is encountered when the operating system attempts to start, the user will need to provide the recovery key to start Windows. - After completing the system check (if selected), the BitLocker Drive Encryption Wizard will restart the computer to begin encryption. Upon reboot, users are required to enter the password chosen to boot into the operating system volume. Users can check encryption status by checking the system notification area or the BitLocker control panel. - Until encryption is completed, the only available options for managing BitLocker involve manipulation of the password protecting the operating system volume, backing up the recovery key, and turning BitLocker off. - ### Data volume - Encrypting data volumes using the BitLocker control panel interface works in a similar fashion to encryption of the operating system volumes. Users select **Turn on BitLocker** within the control panel to begin the BitLocker Drive Encryption wizard. - Unlike for operating system volumes, data volumes are not required to pass any configuration tests for the wizard to proceed. Upon launching the wizard, a choice of authentication methods to unlock the drive appears. The available options are **password** and **smart card** and **automatically unlock this drive on this computer**. Disabled by default, the latter option will unlock the data volume without user input when the operating system volume is unlocked. - After selecting the desired authentication method and choosing **Next**, the wizard presents options for storage of the recovery key. These options are the same as for operating system volumes. - With the recovery key saved, selecting **Next** in the wizard will show available options for encryption. These options are the same as for operating system volumes; **used disk space only** and **full drive encryption**. If the volume being encrypted is new or empty, it is recommended that used space only encryption is selected. - With an encryption method chosen, a final confirmation screen displays before beginning the encryption process. Selecting **Start encrypting** will begin encryption. - Encryption status displays in the notification area or within the BitLocker control panel. - ### OneDrive option - There is a new option for storing the BitLocker recovery key using the OneDrive. This option requires that computers are not members of a domain and that the user is using a Microsoft Account. Local accounts do not give the option to utilize OneDrive. Using the OneDrive option is the default, recommended recovery key storage method for computers that are not joined to a domain. - Users can verify the recovery key was saved properly by checking their OneDrive for the BitLocker folder which is created automatically during the save process. The folder will contain two files, a readme.txt and the recovery key. For users storing more than one recovery password on their OneDrive, they can identify the required recovery key by looking at the file name. The recovery key ID is appended to the end of the file name. - ### Using BitLocker within Windows Explorer - Windows Explorer allows users to launch the BitLocker Drive Encryption wizard by right clicking on a volume and selecting **Turn On BitLocker**. This option is available on client computers by default. On servers, you must first install the BitLocker and Desktop-Experience features for this option to be available. After selecting **Turn on BitLocker**, the wizard works exactly as it does when launched using the BitLocker control panel. - ## Down-level compatibility - - The following table shows the compatibility matrix for systems that have been BitLocker enabled then presented to a different version of Windows. - Table 1: Cross compatibility for Windows 10, Windows 8.1, Windows 8, and Windows 7 encrypted volumes - @@ -203,84 +147,51 @@ Table 1: Cross compatibility for Windows 10, Windows 8.1, Windows 8, and Window
-   - ### Encrypting volumes using the manage-bde command line interface - Manage-bde is a command-line utility that can be used for scripting BitLocker operations. Manage-bde offers additional options not displayed in the BitLocker control panel. For a complete list of the options, see [Manage-bde](http://technet.microsoft.com/library/ff829849.aspx). - Manage-bde offers a multitude of wider options for configuring BitLocker. This means that using the command syntax may require care and possibly later customization by the user. For example, using just the `manage-bde -on` command on a data volume will fully encrypt the volume without any authenticating protectors. A volume encrypted in this manner still requires user interaction to turn on BitLocker protection, even though the command successfully completed because an authentication method needs to be added to the volume for it to be fully protected. - Command line users need to determine the appropriate syntax for a given situation. The following section covers general encryption for operating system volumes and data volumes. - ### Operating system volume - Listed below are examples of basic valid commands for operating system volumes. In general, using only the `manage-bde -on ` command will encrypt the operating system volume with a TPM-only protector and no recovery key. However, many environments require more secure protectors such as passwords or PIN and expect to be able to recover information with a recovery key. - **Determining volume status** - A good practice when using manage-bde is to determine the volume status on the target system. Use the following command to determine volume status: - ``` syntax manage-bde -status ``` - This command returns the volumes on the target, current encryption status and volume type (operating system or data) for each volume. Using this information, users can determine the best encryption method for their environment. - **Enabling BitLocker without a TPM** - For example, suppose that you want to enable BitLocker on a computer without a TPM chip. To properly enable BitLocker for the operating system volume, you will need to use a USB flash drive as a startup key to boot (in this example, the drive letter E). You would first create the startup key needed for BitLocker using the –protectors option and save it to the USB drive on E: and then begin the encryption process. You will need to reboot the computer when prompted to complete the encryption process. - ``` syntax manage-bde –protectors -add C: -startupkey E: manage-bde -on C: ``` - **Enabling BitLocker with a TPM only** - It is possible to encrypt the operating system volume without any defined protectors using manage-bde. The command to do this is: - ``` syntax manage-bde -on C: ``` - This will encrypt the drive using the TPM as the protector. If a user is unsure of the protector for a volume, they can use the -protectors option in manage-bde to list this information with the command: - ``` syntax manage-bde -protectors -get ``` - **Provisioning BitLocker with two protectors** - Another example is a user on non-TPM hardware who wishes to add a password and SID-based protector to the operating system volume. In this instance, the user adds the protectors first. This is done with the command: - ``` syntax manage-bde -protectors -add C: -pw -sid ``` - This command will require the user to enter and then confirm the password protector before adding them to the volume. With the protectors enabled on the volume, the user just needs to turn BitLocker on. - ### Data volume - Data volumes use the same syntax for encryption as operating system volumes but they do not require protectors for the operation to complete. Encrypting data volumes can be done using the base command: `manage-bde -on ` or users can choose to add protectors to the volume. It is recommended that at least one primary protector and a recovery protector be added to a data volume. - **Enabling BitLocker with a password** - A common protector for a data volume is the password protector. In the example below, we add a password protector to the volume and turn BitLocker on. - ``` syntax manage-bde -protectors -add -pw C: manage-bde -on C: ``` - ## Using manage-bde to encrypt volumes with BitLocker - - ### Encrypting volumes using the BitLocker Windows PowerShell cmdlets - Windows PowerShell cmdlets provide an alternative way to work with BitLocker. Using Windows PowerShell's scripting capabilities, administrators can integrate BitLocker options into existing scripts with ease. The list below displays the available BitLocker cmdlets. - @@ -407,125 +318,78 @@ Windows PowerShell cmdlets provide an alternative way to work with BitLocker. Us
-   - Similar to manage-bde, the Windows PowerShell cmdlets allow configuration beyond the options offered in the control panel. As with manage-bde, users need to consider the specific needs of the volume they are encrypting prior to running Windows PowerShell cmdlets. - A good initial step is to determine the current state of the volume(s) on the computer. You can do this using the `Get-BitLocker` volume cmdlet. The output from this cmdlet displays information on the volume type, protectors, protection status, and other useful information. - Occasionally, all protectors may not be shown when using **Get-BitLockerVolume** due to lack of space in the output display. If you do not see all of the protectors for a volume, you can use the Windows PowerShell pipe command (|) to format a listing of the protectors. - **Note**   In the event that there are more than four protectors for a volume, the pipe command may run out of display space. For volumes with more than four protectors, use the method described in the section below to generate a listing of all protectors with protector ID. -   - ``` syntax Get-BitLockerVolume C: | fl ``` - If you wanted to remove the existing protectors prior to provisioning BitLocker on the volume, you can utilize the `Remove-BitLockerKeyProtector` cmdlet. Accomplishing this requires the GUID associated with the protector to be removed. - A simple script can pipe the values of each **Get-BitLockerVolume** return out to another variable as seen below: - ``` syntax $vol = Get-BitLockerVolume $keyprotectors = $vol.KeyProtector ``` - Using this, we can display the information in the **$keyprotectors** variable to determine the GUID for each protector. - Using this information, we can then remove the key protector for a specific volume using the command: - ``` syntax Remove-BitLockerKeyProtector : -KeyProtectorID "{GUID}" ``` - **Note**   The BitLocker cmdlet requires the key protector GUID enclosed in quotation marks to execute. Ensure the entire GUID, with braces, is included in the command. -   - ### Operating system volume - Using the BitLocker Windows PowerShell cmdlets is similar to working with the manage-bde tool for encrypting operating system volumes. Windows PowerShell offers users a lot of flexibility. For example, users can add the desired protector as part command for encrypting the volume. Below are examples of common user scenarios and steps to accomplish them using the BitLocker cmdlets for Windows PowerShell. - To enable BitLocker with just the TPM protector. This can be done using the command: - ``` syntax Enable-BitLocker C: ``` - The example below adds one additional protector, the StartupKey protectors, and chooses to skip the BitLocker hardware test. In this example, encryption starts immediately without the need for a reboot. - ``` syntax Enable-BitLocker C: -StartupKeyProtector -StartupKeyPath -SkipHardwareTest ``` - ### Data volume - Data volume encryption using Windows PowerShell is the same as for operating system volumes. You should add the desired protectors prior to encrypting the volume. The following example adds a password protector to the E: volume using the variable $pw as the password. The $pw variable is held as a SecureString value to store the user defined password. Last, encryption begins. - ``` syntax $pw = Read-Host -AsSecureString Enable-BitLockerKeyProtector E: -PasswordProtector -Password $pw ``` - ### Using a SID based protector in Windows PowerShell - The ADAccountOrGroup protector is an Active Directory SID-based protector. This protector can be added to both operating system and data volumes, although it does not unlock operating system volumes in the pre-boot environment. The protector requires the SID for the domain account or group to link with the protector. BitLocker can protect a cluster-aware disk by adding a SID-based protector for the Cluster Name Object (CNO) that lets the disk properly failover and be unlocked to any member computer of the cluster. - **Warning**   The SID-based protector requires the use of an additional protector (such as TPM, PIN, recovery key, etc.) when used on operating system volumes. -   - To add an ADAccountOrGroup protector to a volume requires either the actual domain SID or the group name preceded by the domain and a backslash. In the example below, the CONTOSO\\Administrator account is added as a protector to the data volume G. - ``` syntax Enable-BitLocker G: -AdAccountOrGroupProtector -AdAccountOrGroup CONTOSO\Administrator ``` - For users who wish to use the SID for the account or group, the first step is to determine the SID associated with the account. To get the specific SID for a user account in Windows PowerShell, use the following command: - ``` syntax get-aduser -filter {samaccountname -eq "administrator"} ``` - **Note**   Use of this command requires the RSAT-AD-PowerShell feature. -   - **Tip**   In addition to the Windows PowerShell command above, information about the locally logged on user and group membership can be found using: WHOAMI /ALL. This does not require the use of additional features. -   - In the example below, the user wishes to add a domain SID based protector to the previously encrypted operating system volume. The user knows the SID for the user account or group they wish to add and uses the following command: - ``` syntax Add-BitLockerKeyProtector C: -ADAccountOrGroupProtector -ADAccountOrGroup "" ``` - **Note**   Active Directory-based protectors are normally used to unlock Failover Cluster enabled volumes. -   - ## Using PowerShell to encrypt volumes with BitLocker - - ### Checking BitLocker status - To check the BitLocker status of a particular volume, administrators can look at the status of the drive in the BitLocker control panel applet, Windows Explorer, manage-bde command line tool, or Windows PowerShell cmdlets. Each option offers different levels of detail and ease of use. We will look at each of the available methods in the following section. - ### Checking BitLocker status with the control panel - Checking BitLocker status with the control panel is the most common method used by most users. Once opened, the status for each volume will display next to the volume description and drive letter. Available status return values with the control panel include: - @@ -554,112 +418,59 @@ Checking BitLocker status with the control panel is the most common method used
-   - If a drive is pre-provisioned with BitLocker, a status of "Waiting for Activation" displays with a yellow exclamation icon on volume E. This status means that there was only a clear protector used when encrypting the volume. In this case, the volume is not in a protected state and needs to have a secure key added to the volume before the drive is fully protected. Administrators can use the control panel, manage-bde tool, or WMI APIs to add an appropriate key protector. Once complete, the control panel will update to reflect the new status. - Using the control panel, administrators can choose **Turn on BitLocker** to start the BitLocker Drive Encryption wizard and add a protector, like PIN for an operating system volume (or password if no TPM exists), or a password or smart card protector to a data volume. - The drive security window displays prior to changing the volume status. Selecting **Activate BitLocker** will complete the encryption process. - Once BitLocker protector activation is completed, the completion notice is displayed. - ### Checking BitLocker status with manage-bde - Administrators who prefer a command line interface can utilize manage-bde to check volume status. Manage-bde is capable of returning more information about the volume than the graphical user interface tools in the control panel. For example, manage-bde can display the BitLocker version in use, the encryption type, and the protectors associated with a volume. - To check the status of a volume using manage-bde, use the following command: - ``` syntax manage-bde -status ``` - **Note**   If no volume letter is associated with the -status command, all volumes on the computer display their status. -   - ### Checking BitLocker status with Windows PowerShell - Windows PowerShell commands offer another way to query BitLocker status for volumes. Like manage-bde, Windows PowerShell includes the advantage of being able to check the status of a volume on a remote computer. - Using the Get-BitLockerVolume cmdlet, each volume on the system will display its current BitLocker status. To get information that is more detailed on a specific volume, use the following command: - ``` syntax Get-BitLockerVolume -Verbose | fl ``` - This command will display information about the encryption method, volume type, key protectors, etc. - ### Provisioning BitLocker during operating system deployment - Administrators can enable BitLocker prior to operating system deployment from the Windows Pre-installation Environment. This is done with a randomly generated clear key protector applied to the formatted volume and encrypting the volume prior to running the Windows setup process. If the encryption uses the Used Disk Space Only option described later in this document, this step takes only a few seconds and incorporates well into regular deployment processes. - ### Decrypting BitLocker volumes - Decrypting volumes removes BitLocker and any associated protectors from the volumes. Decryption should occur when protection is no longer required. BitLocker decryption should not occur as a troubleshooting step. BitLocker can be removed from a volume using the BitLocker control panel applet, manage-bde, or Windows PowerShell cmdlets. We will discuss each method further below. - ### Decrypting volumes using the BitLocker control panel applet - BitLocker decryption using the control panel is done using a Wizard. The control panel can be called from Windows Explorer or by opening the directly. After opening the BitLocker control panel, users will select the Turn off BitLocker option to begin the process. - Once selected, the user chooses to continue by clicking the confirmation dialog. With Turn off BitLocker confirmed, the drive decryption process will begin and report status to the control panel. - The control panel does not report decryption progress but displays it in the notification area of the task bar. Selecting the notification area icon will open a modal dialog with progress. - Once decryption is complete, the drive will update its status in the control panel and is available for encryption. - ### Decrypting volumes using the manage-bde command line interface - Decrypting volumes using manage-bde is very straightforward. Decryption with manage-bde offers the advantage of not requiring user confirmation to start the process. Manage-bde uses the -off command to start the decryption process. A sample command for decryption is: - ``` syntax manage-bde -off C: ``` - This command disables protectors while it decrypts the volume and removes all protectors when decryption is complete. If a user wishes to check the status of the decryption, they can use the following command: - ``` syntax manage-bde -status C: ``` - ### Decrypting volumes using the BitLocker Windows PowerShell cmdlets - Decryption with Windows PowerShell cmdlets is straightforward, similar to manage-bde. The additional advantage Windows PowerShell offers is the ability to decrypt multiple drives in one pass. In the example below, the user has three encrypted volumes, which they wish to decrypt. - Using the Disable-BitLocker command, they can remove all protectors and encryption at the same time without the need for additional commands. An example of this command is: - ``` syntax DisableBitLocker ``` - If a user did not want to input each mount point individually, using the `-MountPoint` parameter in an array can sequence the same command into one line without requiring additional user input. An example command is: - ``` syntax Disable-BitLocker -MountPoint E:,F:,G: ``` - ## See also - - [Prepare your organization for BitLocker: Planning and p\\olicies](prepare-your-organization-for-bitlocker-planning-and-policies.md) - - [BitLocker recovery guide](bitlocker-recovery-guide-plan.md) - - [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md) - - [BitLocker overview](bitlocker-overview.md) - -   -   - - - - - diff --git a/windows/keep-secure/bitlocker-countermeasures.md b/windows/keep-secure/bitlocker-countermeasures.md index 2b1a79a0b6..4f52324123 100644 --- a/windows/keep-secure/bitlocker-countermeasures.md +++ b/windows/keep-secure/bitlocker-countermeasures.md @@ -2,171 +2,87 @@ title: BitLocker Countermeasures (Windows 10) description: Windows uses technologies including TPM, Secure Boot, Trusted Boot, and Early Launch Antimalware (ELAM) to protect against attacks on the BitLocker encryption key. ms.assetid: ebdb0637-2597-4da1-bb18-8127964686ea +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # BitLocker Countermeasures - - **Applies to** - - Windows 10 - Windows uses technologies including TPM, Secure Boot, Trusted Boot, and Early Launch Antimalware (ELAM) to protect against attacks on the BitLocker encryption key. - BitLocker is part of a strategic approach to securing mobile data through encryption technology. Data on a lost or stolen computer is vulnerable to unauthorized access, either by running a software attack tool against it or by transferring the computer’s hard disk to a different computer. Today, BitLocker helps mitigate unauthorized data access on lost or stolen computers before the operating system is started by: - - **Encrypting the hard drives on your computer.** For example, you can turn on BitLocker for your operating system drive, a fixed data drive, or a removable data drive (such as a USB flash drive). Turning on BitLocker for your operating system drive encrypts all system files on the operating system drive, including the swap files and hibernation files. - - **Ensuring the integrity of early boot components and boot configuration data.** On devices that have a TPM version 1.2 or higher, BitLocker uses the enhanced security capabilities of the TPM to help ensure that your data is accessible only if the computer’s boot components appear unaltered and the encrypted disk is located in the original computer. - The sections that follow provide more detailed information about the different technologies that Windows uses to protect against attacks on the BitLocker encryption key in four different boot phases: before startup, during pre-boot, during startup, and finally after startup. - ### Protection before startup - Before Windows starts, you must rely on security features implemented as part of the device hardware, including TPM andSecure Boot. Fortunately, many modern computers feature TPM. - **Trusted Platform Module** - Software alone isn’t sufficient to protect a system. After an attacker has compromised software, the software might be unable to detect the compromise. Therefore, a single successful software compromise results in an untrusted system that might never be detected. Hardware, however, is much more difficult to modify. - A TPM is a microchip designed to provide basic security-related functions, primarily involving encryption keys. The TPM is usually installed on the motherboard of a computer and communicates with the rest of the system through a hardware bus. Physically, TPMs are designed to be tamper-proof. If an attacker tries to physically retrieve data directly from the chip, they’ll probably destroy the chip in the process. - By binding the BitLocker encryption key with the TPM and properly configuring the device, it’s nearly impossible for an attacker to gain access to the BitLocker-encrypted data without obtaining an authorized user’s credentials. Therefore, computers with a TPM can provide a high level of protection against attacks that attempt to directly retrieve the BitLocker encryption key. - For more info about TPM, see [Trusted Platform Module](trusted-platform-module-overview.md). - **UEFI and Secure Boot** - No operating system can protect a device when the operating system is offline. For that reason, Microsoft worked closely with hardware vendors to require firmware-level protection against boot and rootkits that might compromise an encryption solution’s encryption keys. - The UEFI is a programmable boot environment introduced as a replacement for BIOS, which has for the most part remained unchanged for the past 30 years. Like BIOS, PCs start UEFI before any other software; it initializes devices, and UEFI then starts the operating system’s bootloader. As part of its introduction into the pre–operating system environment, UEFI serves a number of purposes, but one of the key benefits is to protect newer devices against a sophisticated type of malware called a bootkit through the use of its Secure Boot feature. - Recent implementations of UEFI (starting with version 2.3.1) can verify the digital signatures of the device’s firmware before running it. Because only the PC’s hardware manufacturer has access to the digital certificate required to create a valid firmware signature, UEFI can prevent firmware-based bootkits. Thus, UEFI is the first link in the chain of trust. - Secure Boot is the foundation of platform and firmware security and was created to enhance security in the pre-boot environment regardless of device architecture. Using signatures to validate the integrity of firmware images before they are allowed to execute, Secure Boot helps reduce the risk of bootloader attacks. The purpose of Secure Boot is to block untrusted firmware and bootloaders (signed or unsigned) from being able to start on the system. - With the legacy BIOS boot process, the pre–operating system environment is vulnerable to attacks by redirecting bootloader handoff to possible malicious loaders. These loaders could remain undetected to operating system and antimalware software. The diagram in Figure 1 contrasts the BIOS and UEFI startup processes. - ![the bios and uefi startup processes](images/bitlockerprebootprotection-bios-uefi-startup.jpg) - **Figure 1.** The BIOS and UEFI startup processes - With Secure Boot enabled, UEFI, in coordination with the TPM, can examine the bootloader and determine whether it’s trustworthy. To determine whether the bootloader is trustworthy, UEFI examines the bootloader’s digital signature. Using the digital signature, UEFI verifies that the bootloader was signed using a trusted certificate. - If the bootloader passes these two tests, UEFI knows that the bootloader isn’t a bootkit and starts it. At this point, Trusted Boot takes over, and the Windows bootloader, using the same cryptographic technologies that UEFI used to verify the bootloader, then verifies that the Windows system files haven’t been changed. - All Windows 8–certified devices must meet several requirements related to UEFI-based Secure Boot: - - They must have Secure Boot enabled by default. - - They must trust Microsoft’s certificate (and thus any bootloader Microsoft has signed). - - They must allow the user to configure Secure Boot to trust other signed bootloaders. - - Except for Windows RT devices, they must allow the user to completely disable Secure Boot. - These requirements help protect you from rootkits while allowing you to run any operating system you want. You have three options for running non-Microsoft operating systems: - - **Use an operating system with a certified bootloader.** Microsoft can analyze and sign non-Microsoft bootloaders so that they can be trusted. The Linux community is using this process to enable Linux to take advantage of Secure Boot on Windows-certified devices. - - **Configure UEFI to trust your custom bootloader.** Your device can trust a signed, non-certified bootloader that you specify in the UEFI database, allowing you to run any operating system, including homemade operating systems. - - **Turn off Secure Boot.** You can turn off Secure Boot. This does not help protect you from bootkits, however. - To prevent malware from abusing these options, the user has to manually configure the UEFI firmware to trust a non-certified bootloader or to turn off Secure Boot. Software cannot change the Secure Boot settings. - Any device that doesn’t require Secure Boot or a similar bootloader-verification technology, regardless of the architecture or operating system, is vulnerable to bootkits, which can be used to compromise the encryption solution. - UEFI is secure by design, but it’s critical to protect the Secure Boot configuration by using password protection. In addition, although several well-publicized attacks against UEFI have occurred, they were exploiting faulty UEFI implementations. Those attacks are ineffective when UEFI is implemented properly. - For more information about Secure Boot, refer to [Securing the Windows 8.1 Boot Process](http://technet.microsoft.com/windows/dn168167.aspx). - ### Protection during pre-boot: Pre-boot authentication - Pre-boot authentication with BitLocker is a process that requires the use of either a Trusted Platform Module (TPM), user input, such as a PIN, or both, depending on hardware and operating system configuration, to authenticate prior to making the contents of the system drive accessible. In the case of BitLocker, BitLocker encrypts the entire drive, including all system files. BitLocker accesses and stores the encryption key in memory only after a pre-boot authentication is completed using one or more of the following options: Trusted Platform Module (TPM), user provides a specific PIN, USB startup key. - If Windows can’t access the encryption key, the device can’t read or edit the files on the system drive. Even if an attacker takes the disk out of the PC or steals the entire PC, they won’t be able to read or edit the files without the encryption key. The only option for bypassing pre-boot authentication is entering the highly complex, 48-digit recovery key. - The BitLocker pre-boot authentication capability is not specifically designed to prevent the operating system from starting: That’s merely a side effect of how BitLocker protects data confidentiality and system integrity. Pre-boot authentication is designed to prevent the encryption key from being loaded to system memory on devices that are vulnerable to certain types of cold boot attacks. Many modern devices prevent an attacker from easily removing the memory, and Microsoft expects those devices to become even more common in the future. - On computers with a compatible TPM, operating system drives that are BitLocker-protected can be unlocked in four ways: - - **TPM-only.** Using TPM-only validation does not require any interaction with the user to decrypt and provide access to the drive. If the TPM validation succeeds, the user logon experience is the same as a standard logon. If the TPM is missing or changed or if the TPM detects changes to critical operating system startup files, BitLocker enters its recovery mode, and the user must enter a recovery password to regain access to the data. - - **TPM with startup key.** In addition to the protection that the TPM provides, part of the encryption key is stored on a USB flash drive, referred to as a startup key. Data on the encrypted volume cannot be accessed without the startup key. - - **TPM with PIN.** In addition to the protection that the TPM provides, BitLocker requires that the user enter a PIN. Data on the encrypted volume cannot be accessed without entering the PIN. - - **TPM with startup key and PIN.** In addition to the core component protection that the TPM provides, part of the encryption key is stored on a USB flash drive, and a PIN is required to authenticate the user to the TPM. This configuration provides multifactor authentication so that if the USB key is lost or stolen, it cannot be used for access to the drive, because the correct PIN is also required. - For many years, Microsoft has recommended using pre-boot authentication to protect against DMA and memory remanence attacks. Today, Microsoft only recommends using pre-boot authentication on PCs where the mitigations described in this document cannot be implemented. These mitigations may be inherent to the device or may come by way of configurations that IT can provision to devices and Windows itself. - Although effective, pre-boot authentication is inconvenient to users. In addition, if a user forgets their PIN or loses their startup key, they’re denied access to their data until they can contact their organization’s support team to obtain a recovery key. Today, most new PCs running Windows 10, Windows 8.1, or Windows 8 provide sufficient protection against DMA attacks without requiring pre-boot authentication. For example, most modern PCs include USB port options (which are not vulnerable to DMA attacks) but do not include FireWire or Thunderbolt ports (which are vulnerable to DMA attacks). - BitLocker-encrypted devices with DMA ports enabled, including FireWire or Thunderbolt ports, should be configured with pre-boot authentication if they are running Windows 10, Windows 7, Windows 8, or Windows 8.1 and disabling the ports using policy or firmware configuration is not an option. Windows 8.1 and later InstantGo devices do not need pre-boot authentication to defend against DMA-based port attacks, as the ports will not be present on certified devices. A non-InstantGo Windows 8.1 and later device requires pre-boot authentication if DMA ports are enabled on the device and additional mitigations described in this document are not implemented. Many customers find that the DMA ports on their devices are never used, and they choose to eliminate the possibility of an attack by disabling the DMA ports themselves, either at the hardware level or through Group Policy. - Many new mobile devices have the system memory soldered to the motherboard, which helps prevent the cold boot–style attack, where the system memory is frozen, removed, and then placed into another device. Those devices, and most PCs, can still be vulnerable when booting to a malicious operating system, however. - You can mitigate the risk of booting to a malicious operating system: - - **Windows 10 (without Secure Boot), Windows 8.1 (without Secure Boot), Windows 8 (without UEFI-based Secure Boot), or Windows 7 (with or without a TPM).** Disable booting from external media, and require a firmware password to prevent the attacker from changing that option. - - **Windows 10, Windows 8.1, or Windows 8 (certified or with Secure Boot).** Password protect the firmware, and do not disable Secure Boot. - ### Protection During Startup - During the startup process, Windows 10 uses Trusted Boot and Early Launch Antimalware (ELAM) to examine the integrity of every component. The sections that follow describe these technologies in more detail. - **Trusted Boot** - Trusted Boot takes over where UEFI-based Secure Boot leaves off—during the operating system initialization phase. The bootloader verifies the digital signature of the Windows kernel before loading it. The Windows kernel, in turn, verifies every other component of the Windows startup process, including the boot drivers, startup files, and ELAM driver. If a file has been modified or is not properly signed with a Microsoft signature, Windows detects the problem and refuses to load the corrupted component. Often, Windows can automatically repair the corrupted component, restoring the integrity of Windows and allowing the PC to start normally. - Windows 10 uses Trusted Boot on any hardware platform: It requires neither UEFI nor a TPM. However, without Secure Boot, it’s possible for malware to compromise the startup process prior to Windows starting, at which point Trusted Boot protections could be bypassed or potentially disabled. - **Early Launch Antimalware** - Because UEFI-based Secure Boot has protected the bootloader and Trusted Boot has protected the Windows kernel or other Windows startup components, the next opportunity for malware to start is by infecting a non-Microsoft boot-related driver. Traditional antimalware apps don’t start until after the boot-related drivers have been loaded, giving a rootkit disguised as a driver the opportunity to work. - The purpose of ELAM is to load an antimalware driver before drivers that are flagged as boot-start can be executed. This approach provides the ability for an antimalware driver to register as a trusted boot-critical driver. It is launched during the Trusted Boot process, and with that, Windows ensures that it is loaded before any other non-Microsoft software. - With this solution in place, boot drivers are initialized based on the classification that the ELAM driver returns according to an initialization policy. IT pros have the ability to change this policy through Group Policy. - ELAM classifies drivers as follows: - - **Good.** The driver has been signed and has not been tampered with. - - **Bad.** The driver has been identified as malware. It is recommended that you not allow known bad drivers to be initialized. - - **Bad but required for boot.** The driver has been identified as malware, but the computer cannot successfully boot without loading this driver. - - **Unknown.** This driver has not been attested to by your malware-detection application or classified by the ELAM boot-start driver. - While the features listed above protect the Windows boot process from malware threats that could compromise BitLocker security, it is important to note that DMA ports may be enabled during the window of time between when BitLocker unlocks the drive and Windows boots to the point that Windows can set any port related policies that have been configured. This period of time where the encryption key could be exposed to a DMA attack could be less than a minute on recent devices or longer depending on system performance. The use of pre-boot authentication with a PIN can be used to successfully mitigate against an attack. - ### Protection After Startup: eliminate DMA availability - Windows InstantGo–certified devices do not have DMA ports, eliminating the risk of DMA attacks. On other devices, you can disable FireWire, Thunderbolt, or other ports that support DMA. - ## See also - - - [Types of Attacks for Volume Encryption Keys](types-of-attacks-for-volume-encryption-keys.md) - - [Choose the right BitLocker countermeasure](choose-the-right-bitlocker-countermeasure.md) - - [Protect BitLocker from pre-boot attacks](protect-bitlocker-from-pre-boot-attacks.md) - - [BitLocker overview](bitlocker-overview.md) -   -   - - - - - diff --git a/windows/keep-secure/bitlocker-frequently-asked-questions.md b/windows/keep-secure/bitlocker-frequently-asked-questions.md index 0d127689fd..d9dd86cdc9 100644 --- a/windows/keep-secure/bitlocker-frequently-asked-questions.md +++ b/windows/keep-secure/bitlocker-frequently-asked-questions.md @@ -2,116 +2,63 @@ title: BitLocker frequently asked questions (FAQ) (Windows 10) description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # BitLocker frequently asked questions (FAQ) - - **Applies to** - - Windows 10 - This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. - BitLocker is a data protection feature that encrypts the hard drives on your computer to provide enhanced protection against data theft or exposure on computers and removable drives that are lost or stolen, and more secure data deletion when BitLocker-protected computers are decommissioned as it is much more difficult to recover deleted data from an encrypted drive than from a non-encrypted drive. - - [Overview and requirements](#bkmk-overview) - - [Upgrading](#bkmk-upgrading) - - [Deployment and administration](#bkmk-deploy) - - [Key management](#bkmk-keymanagement) - - [BitLocker To Go](#bkmk-btgsect) - - [Active Directory Domain Services (AD DS)](#bkmk-adds) - - [Security](#bkmk-security) - - [BitLocker Network Unlock](#bkmk-bnusect) - - [Other questions](#bkmk-other) - ## Overview and requirements - - ### How does BitLocker work? - **How BitLocker works with operating system drives** - You can use BitLocker to mitigate unauthorized data access on lost or stolen computers by encrypting all user files and system files on the operating system drive, including the swap files and hibernation files, and checking the integrity of early boot components and boot configuration data. - **How BitLocker works with fixed and removable data drives** - You can use BitLocker to encrypt the entire contents of a data drive. You can use Group Policy to require that BitLocker be enabled on a drive before the computer can write data to the drive. BitLocker can be configured with a variety of unlock methods for data drives, and a data drive supports multiple unlock methods. - ### Does BitLocker support multifactor authentication? - Yes, BitLocker supports multifactor authentication for operating system drives. If you enable BitLocker on a computer that has a TPM version 1.2 or later, you can use additional forms of authentication with the TPM protection. - ### What are the BitLocker hardware and software requirements? - **Note**   Dynamic disks are not supported by BitLocker. Dynamic data volumes will not be displayed in the Control Panel. Although the operating system volume will always be displayed in the Control Panel, regardless of whether it is a Dynamic disk, if it is a dynamic disk it is cannot be protected by BitLocker. -   - ### Why are two partitions required? Why does the system drive have to be so large? - Two partitions are required to run BitLocker because pre-startup authentication and system integrity verification must occur on a separate partition from the encrypted operating system drive. This configuration helps protect the operating system and the information in the encrypted drive. - ### Which Trusted Platform Modules (TPMs) does BitLocker support? - BitLocker supports TPM version 1.2 or higher. - ### How can I tell if a TPM is on my computer? - Open the TPM MMC console (tpm.msc) and look under the **Status** heading. - ### Can I use BitLocker on an operating system drive without a TPM? - Yes, you can enable BitLocker on an operating system drive without a TPM version 1.2 or higher, if the BIOS or UEFI firmware has the ability to read from a USB flash drive in the boot environment. This is because BitLocker will not unlock the protected drive until BitLocker's own volume master key is first released by either the computer's TPM or by a USB flash drive containing the BitLocker startup key for that computer. However, computers without TPMs will not be able to use the system integrity verification that BitLocker can also provide. - To help determine whether a computer can read from a USB device during the boot process, use the BitLocker system check as part of the BitLocker setup process. This system check performs tests to confirm that the computer can properly read from the USB devices at the appropriate time and that the computer meets other BitLocker requirements. - ### How do I obtain BIOS support for the TPM on my computer? - Contact the computer manufacturer to request a Trusted Computing Group (TCG)-compliant BIOS or UEFI boot firmware that meets the following requirements: - - It is compliant with the TCG standards for a client computer. - - It has a secure update mechanism to help prevent a malicious BIOS or boot firmware from being installed on the computer. - ### What credentials are required to use BitLocker? - To turn on, turn off, or change configurations of BitLocker on operating system and fixed data drives, membership in the local **Administrators** group is required. Standard users can turn on, turn off, or change configurations of BitLocker on removable data drives. - ### What is the recommended boot order for computers that are going to be BitLocker-protected? - You should configure the startup options of your computer to have the hard disk drive first in the boot order, before any other drives such ach as CD/DVD drives or USB drives. If the hard disk is not first and you typically boot from hard disk, then a boot order change may be detected or assumed when removable media is found during boot. The boot order typically affects the system measurement that is verified by BitLocker and a change in boot order will cause you to be prompted for your BitLocker recovery key. For the same reason, if you have a laptop with a docking station, ensure that the hard disk drive is first in the boot order both when docked and undocked.  - ## Upgrading - - ### Can I upgrade my Windows 7 or Windows 8 computer to Windows 10 with BitLocker enabled? - Yes. Open the **BitLocker Drive Encryption** Control Panel, click **Manage BitLocker**, and then and click **Suspend**. Suspending protection does not decrypt the drive; it disables the authentication mechanisms used by BitLocker and uses a clear key on the drive to enable access. After the upgrade has completed, open Windows Explorer, right-click the drive, and then click **Resume Protection**. This reapplies the BitLocker authentication methods and deletes the clear key. - ### What is the difference between suspending and decrypting BitLocker? - **Decrypt** completely removes BitLocker protection and fully decrypts the drive. - **Suspend** keeps the data encrypted but encrypts the BitLocker volume master key with a clear key. The clear key is a cryptographic key stored unencrypted and unprotected on the disk drive. By storing this key unencrypted, the **Suspend** option allows for changes or upgrades to the computer without the time and cost of decrypting and re-encrypting the entire drive. After the changes are made and BitLocker is again enabled, BitLocker will reseal the encryption key to the new values of the measured components that changed as a part of the upgrade, the volume master key is changed, the protectors are updated to match and the clear key is erased. - ### Do I have to decrypt my BitLocker-protected drive to download and install system updates and upgrades? - The following table lists what action you need to take before you perform an upgrade or update installation. - @@ -147,361 +94,178 @@ The following table lists what action you need to take before you perform an upg
-   - **Note**   If you have suspended BitLocker, you can resume BitLocker protection after you have installed the upgrade or update. Upon resuming protection, BitLocker will reseal the encryption key to the new values of the measured components that changed as a part of the upgrade or update. If these types of upgrades or updates are applied without suspending BitLocker, your computer will enter recovery mode when restarting and will require a recovery key or password to access the computer. -   - ## Deployment and administration - - ### Can BitLocker deployment be automated in an enterprise environment? - Yes, you can automate the deployment and configuration of BitLocker and the TPM using either WMI or Windows PowerShell scripts. How you choose to implement the scripts depends on your environment. You can also use Manage-bde.exe to locally or remotely configure BitLocker. For more info about writing scripts that use the BitLocker WMI providers, see [BitLocker Drive Encryption Provider](http://go.microsoft.com/fwlink/p/?LinkId=80600). For more info about using Windows PowerShell cmdlets with BitLocker Drive Encryption, see [BitLocker Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj649829.aspx). - ### Can BitLocker encrypt more than just the operating system drive? - Yes. - ### Is there a noticeable performance impact when BitLocker is enabled on a computer? - Generally it imposes a single-digit percentage performance overhead. - ### How long will initial encryption take when BitLocker is turned on? - Although BitLocker encryption occurs in the background while you continue to work, and the system remains usable, encryption times vary depending on the type of drive that is being encrypted, the size of the drive, and the speed of the drive. If you are encrypting very large drives, you may want to set encryption to occur during times when you will not be using the drive. - You can also choose whether or not BitLocker should encrypt the entire drive or just the used space on the drive when you turn on BitLocker. On a new hard drive, encrypting just the used spaced can be considerably faster than encrypting the entire drive. When this encryption option is selected, BitLocker automatically encrypts data as it is saved, ensuring that no data is stored unencrypted. - ### What happens if the computer is turned off during encryption or decryption? - If the computer is turned off or goes into hibernation, the BitLocker encryption and decryption process will resume where it stopped the next time Windows starts. This is true even if the power is suddenly unavailable. - ### Does BitLocker encrypt and decrypt the entire drive all at once when reading and writing data? - No, BitLocker does not encrypt and decrypt the entire drive when reading and writing data. The encrypted sectors in the BitLocker-protected drive are decrypted only as they are requested from system read operations. Blocks that are written to the drive are encrypted before the system writes them to the physical disk. No unencrypted data is ever stored on a BitLocker-protected drive. - ### How can I prevent users on a network from storing data on an unencrypted drive? - You can can Group Policy settings to require that data drives be BitLocker-protected before a BitLocker-protected computer can write data to them. For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). - When these policy settings are enabled, the BitLocker-protected operating system will mount any data drives that are not protected by BitLocker as read-only. - ### What system changes would cause the integrity check on my operating system drive to fail? - The following types of system changes can cause an integrity check failure and prevent the TPM from releasing the BitLocker key to decrypt the protected operating system drive: - - Moving the BitLocker-protected drive into a new computer. - - Installing a new motherboard with a new TPM. - - Turning off, disabling, or clearing the TPM. - - Changing any boot configuration settings. - - Changing the BIOS, UEFI firmware, master boot record, boot sector, boot manager, option ROM, or other early boot components or boot configuration data. - ### What causes BitLocker to start into recovery mode when attempting to start the operating system drive? - Because BitLocker is designed to protect your computer from numerous attacks, there are numerous reasons why BitLocker could start in recovery mode. In BitLocker, recovery consists of decrypting a copy of the volume master key using either a recovery key stored on a USB flash drive or a cryptographic key derived from a recovery password. The TPM is not involved in any recovery scenarios, so recovery is still possible if the TPM fails boot component validation, malfunctions, or is removed. - ### Can I swap hard disks on the same computer if BitLocker is enabled on the operating system drive? - Yes, you can swap multiple hard disks on the same computer if BitLocker is enabled, but only if the hard disks were BitLocker-protected on the same computer. The BitLocker keys are unique to the TPM and operating system drive, so if you want to prepare a backup operating system or data drive for use in case of disk failure, you need to make sure that they were matched with the correct TPM. You can also configure different hard drives for different operating systems and then enable BitLocker on each one with different authentication methods (such as one with TPM-only and one with TPM+PIN) without any conflicts. - ### Can I access my BitLocker-protected drive if I insert the hard disk into a different computer? - Yes, if the drive is a data drive, you can unlock it from the **BitLocker Drive Encryption** Control Panel item just as you would any other data drive by using a password or smart card. If the data drive was configured for automatic unlock only, you will have to unlock it by using the recovery key. The encrypted hard disk can be unlocked by a data recovery agent (if one was configured) or it can be unlocked by using the recovery key. - ### Why is "Turn BitLocker on" not available when I right-click a drive? - Some drives cannot be encrypted with BitLocker. Reasons a drive cannot be encrypted include insufficient disk size, an incompatible file system, if the drive is a dynamic disk, or a drive is designated as the system partition. By default, the system drive (or system partition) is hidden from display. However, if it is not created as a hidden drive when the operating system was installed due to a custom installation process, that drive might be displayed but cannot be encrypted. - ### What type of disk configurations are supported by BitLocker? - Any number of internal, fixed data drives can be protected with BitLocker. On some versions ATA and SATA-based, direct-attached storage devices are also supported. - ## Key management - - ### What is the difference between a TPM owner password, recovery password, recovery key, password, PIN, enhanced PIN, and startup key? - There are multiple keys that can be generated and used by BitLocker. Some keys are required and some are optional protectors you can choose to use depending on the level of security you require. - ### How can the recovery password and recovery key be stored? - The recovery password and recovery key for an operating system drive or a fixed data drive can be saved to a folder, saved to one or more USB devices, saved to your Microsoft Account, or printed. - For removable data drives, the recovery password and recovery key can be saved to a folder, saved to your Microsoft Account, or printed. By default, you cannot store a recovery key for a removable drive on a removable drive. - A domain administrator can additionally configure Group Policy to automatically generate recovery passwords and store them in Active Directory Domain Services (AD DS) for any BitLocker-protected drive. - ### Is it possible to add an additional method of authentication without decrypting the drive if I only have the TPM authentication method enabled? - You can use the Manage-bde.exe command-line tool to replace your TPM-only authentication mode with a multifactor authentication mode. For example, if BitLocker is enabled with TPM authentication only and you want to add PIN authentication, use the following commands from an elevated command prompt, replacing *<4-20 digit numeric PIN>* with the numeric PIN you want to use: - **manage-bde –protectors –delete %systemdrive% -type tpm** - **manage-bde –protectors –add %systemdrive% -tpmandpin** *<4-20 digit numeric PIN>* - ### If I lose my recovery information, will the BitLocker-protected data be unrecoverable? - BitLocker is designed to make the encrypted drive unrecoverable without the required authentication. When in recovery mode, the user needs the recovery password or recovery key to unlock the encrypted drive. - **Important**   Store the recovery information in AD DS, along with your Microsoft Account, or another safe location. -   - ### Can the USB flash drive that is used as the startup key also be used to store the recovery key? - While this is technically possible, it is not a best practice to use one USB flash drive to store both keys. If the USB flash drive that contains your startup key is lost or stolen, you also lose access to your recovery key. In addition, inserting this key would cause your computer to automatically boot from the recovery key even if TPM-measured files have changed, which circumvents the TPM's system integrity check. - ### Can I save the startup key on multiple USB flash drives? - Yes, you can save a computer's startup key on multiple USB flash drives. Right-clicking a BitLocker-protected drive and selecting **Manage BitLocker** will provide you the options to duplicate the recovery keys as needed. - ### Can I save multiple (different) startup keys on the same USB flash drive? - Yes, you can save BitLocker startup keys for different computers on the same USB flash drive. - ### Can I generate multiple (different) startup keys for the same computer? - You can generate different startup keys for the same computer through scripting. However, for computers that have a TPM, creating different startup keys prevents BitLocker from using the TPM's system integrity check. - ### Can I generate multiple PIN combinations? - You cannot generate multiple PIN combinations. - ### What encryption keys are used in BitLocker? How do they work together? - Raw data is encrypted with the full volume encryption key, which is then encrypted with the volume master key. The volume master key is in turn encrypted by one of several possible methods depending on your authentication (that is, key protectors or TPM) and recovery scenarios. - ### Where are the encryption keys stored? - The full volume encryption key is encrypted by the volume master key and stored in the encrypted drive. The volume master key is encrypted by the appropriate key protector and stored in the encrypted drive. If BitLocker has been suspended, the clear key that is used to encrypt the volume master key is also stored in the encrypted drive, along with the encrypted volume master key. - This storage process ensures that the volume master key is never stored unencrypted and is protected unless you disable BitLocker. The keys are also saved to two additional locations on the drive for redundancy. The keys can be read and processed by the boot manager. - ### Why do I have to use the function keys to enter the PIN or the 48-character recovery password? - The F1 through F10 keys are universally mapped scan codes available in the pre-boot environment on all computers and in all languages. The numeric keys 0 through 9 are not usable in the pre-boot environment on all keyboards. - When using an enhanced PIN, users should run the optional system check during the BitLocker setup process to ensure that the PIN can be entered correctly in the pre-boot environment. - ### How does BitLocker help prevent an attacker from discovering the PIN that unlocks my operating system drive? - It is possible that a personal identification number (PIN) can be discovered by an attacker performing a brute force attack. A brute force attack occurs when an attacker uses an automated tool to try different PIN combinations until the correct one is discovered. For BitLocker-protected computers, this type of attack, also known as a dictionary attack, requires that the attacker have physical access to the computer. - The TPM has the built-in ability to detect and react to these types of attacks. Because different manufacturers' TPMs may support different PIN and attack mitigations, contact your TPM's manufacturer to determine how your computer's TPM mitigates PIN brute force attacks. - After you have determined your TPM's manufacturer, contact the manufacturer to gather the TPM's vendor-specific information. Most manufacturers use the PIN authentication failure count to exponentially increase lockout time to the PIN interface. However, each manufacturer has different policies regarding when and how the failure counter is decreased or reset. - ### How can I determine the manufacturer of my TPM? - You can determine your TPM manufacturer in the TPM MMC console (tpm.msc) under the **TPM Manufacturer Information** heading. - ### How can I evaluate a TPM's dictionary attack mitigation mechanism? - The following questions can assist you when asking a TPM manufacturer about the design of a dictionary attack mitigation mechanism: - - How many failed authorization attempts can occur before lockout? - - What is the algorithm for determining the duration of a lockout based on the number of failed attempts and any other relevant parameters? - - What actions can cause the failure count and lockout duration to be decreased or reset? - ### Can PIN length and complexity be managed with Group Policy? - Yes and No. You can configure the minimum personal identification number (PIN) length by using the **Configure minimum PIN length for startup** Group Policy setting and allow the use of alphanumeric PINs by enabling the **Allow enhanced PINs for startup** Group Policy setting. However, you cannot require PIN complexity by Group Policy. - For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). - ## BitLocker To Go - - BitLocker To Go is BitLocker Drive Encryption on removable data drives. This includes the encryption of USB flash drives, SD cards, external hard disk drives, and other drives formatted by using the NTFS, FAT16, FAT32, or exFAT file systems. - ## Active Directory Domain Services (AD DS) - - ### What if BitLocker is enabled on a computer before the computer has joined the domain? - If BitLocker is enabled on a drive before Group Policy has been applied to enforce backup, the recovery information will not be automatically backed up to AD DS when the computer joins the domain or when Group Policy is subsequently applied. However, you can use the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed drives can be recovered** and **Choose how BitLocker-protected removable drives can be recovered** Group Policy settings to require that the computer be connected to a domain before BitLocker can be enabled to help ensure that recovery information for BitLocker-protected drives in your organization is backed up to AD DS. - For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). - The BitLocker Windows Management Instrumentation (WMI) interface does allow administrators to write a script to back up or synchronize an online client's existing recovery information; however, BitLocker does not automatically manage this process. The manage-bde command-line tool can also be used to manually back up recovery information to AD DS. For example, to back up all of the recovery information for the C: drive to AD DS, you would use the following command from an elevated command prompt: **manage-bde -protectors -adbackup C:**. - **Important**   Joining a computer to the domain should be the first step for new computers within an organization. After computers are joined to a domain, storing the BitLocker recovery key to AD DS is automatic (when enabled in Group Policy). -   - ### Is there an event log entry recorded on the client computer to indicate the success or failure of the Active Directory backup? - Yes, an event log entry that indicates the success or failure of an Active Directory backup is recorded on the client computer. However, even if an event log entry says "Success," the information could have been subsequently removed from AD DS, or BitLocker could have been reconfigured in such a way that the Active Directory information can no longer unlock the drive (such as by removing the recovery password key protector). In addition, it is also possible that the log entry could be spoofed. - Ultimately, determining whether a legitimate backup exists in AD DS requires querying AD DS with domain administrator credentials by using the BitLocker password viewer tool. - ### If I change the BitLocker recovery password on my computer and store the new password in AD DS, will AD DS overwrite the old password? - No. By design, BitLocker recovery password entries do not get deleted from AD DS; therefore, you might see multiple passwords for each drive. To identify the latest password, check the date on the object. - ### What happens if the backup initially fails? Will BitLocker retry the backup? - If the backup initially fails, such as when a domain controller is unreachable at the time when the BitLocker setup wizard is run, BitLocker does not try again to back up the recovery information to AD DS. - When an administrator selects the **Require BitLocker backup to AD DS** check box of the **Store BitLocker recovery information in Active Directory Domain Service (Windows 2008 and Windows Vista)** policy setting, or the equivalent **Do not enable BitLocker until recovery information is stored in AD DS for (operating system | fixed data | removable data) drives** check box in any of the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed data drives can be recovered**, **Choose how BitLocker-protected removable data drives can be recovered** policy settings, this prevents users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. With these settings configured if the backup fails, BitLocker cannot be enabled, ensuring that administrators will be able to recover BitLocker-protected drives in the organization. - For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). - When an administrator clears these check boxes, the administrator is allowing a drive to be BitLocker-protected without having the recovery information successfully backed up to AD DS; however, BitLocker will not automatically retry the backup if it fails. Instead, administrators can create a script for the backup, as described earlier in [What if BitLocker is enabled on a computer before the computer has joined the domain?](#bkmk-adretro) to capture the information after connectivity is restored. - ## Security - - ### What form of encryption does BitLocker use? Is it configurable? - BitLocker uses Advanced Encryption Standard (AES) as its encryption algorithm with configurable key lengths of 128 or 256 bits. The default encryption setting is AES-128, but the options are configurable by using Group Policy. - ### What is the best practice for using BitLocker on an operating system drive? - The recommended practice for BitLocker configuration on an operating system drive is to implement BitLocker on a computer with a TPM version 1.2 or higher and a Trusted Computing Group (TCG)-compliant BIOS or UEFI firmware implementation, plus a PIN. By requiring a PIN that was set by the user in addition to the TPM validation, a malicious user that has physical access to the computer cannot simply start the computer. - ### What are the implications of using the sleep or hibernate power management options? - BitLocker on operating system drives in its basic configuration (with a TPM but without advanced authentication) provides additional security for the hibernate mode. However, BitLocker provides greater security when it is configured to use an advanced authentication mode (TPM+PIN, TPM+USB, or TPM+PIN+USB) with the hibernate mode. This method is more secure because returning from hibernation requires BitLocker authentication. As a best practice, we recommend that sleep mode be disabled and that you use TPM+PIN for the authentication method. - ### What are the advantages of a TPM? - Most operating systems use a shared memory space and rely on the operating system to manage physical memory. A TPM is a hardware component that uses its own internal firmware and logic circuits for processing instructions, thus shielding it from external software vulnerabilities. Attacking the TPM requires physical access to the computer. Additionally, the tools and skills necessary to attack hardware are often more expensive, and usually are not as available as the ones used to attack software. And because each TPM is unique to the computer that contains it, attacking multiple TPM computers would be difficult and time-consuming. - **Note**   Configuring BitLocker with an additional factor of authentication provides even more protection against TPM hardware attacks. -   - ## BitLocker Network Unlock - - BitLocker Network Unlock enables easier management for BitLocker-enabled desktops and servers that use the TPM+PIN protection method in a domain environment. When a computer that is connected to a wired corporate network is rebooted, Network Unlock allows the PIN entry prompt to be bypassed. It automatically unlocks BitLocker-protected operating system volumes by using a trusted key that is provided by the Windows Deployment Services server as its secondary authentication method. - To use Network Unlock you must also have a PIN configured for your computer. When your computer is not connected to the network you will need to provide the PIN to unlock it. - BitLocker Network Unlock has software and hardware requirements for both client computers, Windows Deployment services, and domain controllers that must be met before you can use it. - Network Unlock uses two protectors, the TPM protector and the one provided by the network or by your PIN, whereas automatic unlock uses a single protector, the one stored in the TPM. If the computer is joined to a network without the key protector it will prompt you to enter your PIN. If the PIN is not available you will need to use the recovery key to unlock the computer if it can ot be connected to the network. - For more info, see [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md). - ## Other questions - - ### Can I run a kernel debugger with BitLocker? - Yes. However, the debugger should be turned on before enabling BitLocker. Turning on the debugger ensures that the correct measurements are calculated when sealing to the TPM, allowing the computer to start properly. If you need to turn debugging on or off when using BitLocker, be sure to suspend BitLocker first to avoid putting your computer into recovery mode. - ### How does BitLocker handle memory dumps? - BitLocker has a storage driver stack that ensures memory dumps are encrypted when BitLocker is enabled. - ### Can BitLocker support smart cards for pre-boot authentication? - BitLocker does not support smart cards for pre-boot authentication. There is no single industry standard for smart card support in the firmware, and most computers either do not implement firmware support for smart cards, or only support specific smart cards and readers. This lack of standardization makes supporting them very difficult. - ### Can I use a non-Microsoft TPM driver? - Microsoft does not support non-Microsoft TPM drivers and strongly recommends against using them with BitLocker. Attempting to use a non-Microsoft TPM driver with BitLocker may cause BitLocker to report that a TPM is not present on the computer and not allow the TPM to be used with BitLocker. - ### Can other tools that manage or modify the master boot record work with BitLocker? - We do not recommend modifying the master boot record on computers whose operating system drives are BitLocker-protected for a number of security, reliability, and product support reasons. Changes to the master boot record (MBR) could change the security environment and prevent the computer from starting normally, as well as complicate any efforts to recover from a corrupted MBR. Changes made to the MBR by anything other than Windows might force the computer into recovery mode or prevent it from booting entirely. - ### Why is the system check failing when I am encrypting my operating system drive? - The system check is designed to ensure your computer's BIOS or UEFI firmware is compatible with BitLocker and that the TPM is working correctly. The system check can fail for several reasons: - - The computer's BIOS or UEFI firmware cannot read USB flash drives. - - The computer's BIOS, uEFI firmware, or boot menu does not have reading USB flash drives enabled. - - There are multiple USB flash drives inserted into the computer. - - The PIN was not entered correctly. - - The computer's BIOS or UEFI firmware only supports using the function keys (F1–F10) to enter numerals in the pre-boot environment. - - The startup key was removed before the computer finished rebooting. - - The TPM has malfunctioned and fails to unseal the keys. - ### What can I do if the recovery key on my USB flash drive cannot be read? - Some computers cannot read USB flash drives in the pre-boot environment. First, check your BIOS or UEFI firmware and boot settings to ensure that the use of USB drives is enabled. If it is not enabled, enable the use of USB drives in the BIOS or UEFI firmware and boot settings and then try to read the recovery key from the USB flash drive again. If it still cannot be read, you will have to mount the hard drive as a data drive on another computer so that there is an operating system to attempt to read the recovery key from the USB flash drive. If the USB flash drive has been corrupted or damaged, you may need to supply a recovery password or use the recovery information that was backed up to AD DS. Also, if you are using the recovery key in the pre-boot environment, ensure that the drive is formatted by using the NTFS, FAT16, or FAT32 file system. - ### Why am I unable to save my recovery key to my USB flash drive? - The **Save to USB** option is not shown by default for removable drives. If the option is unavailable, it means that a system administrator has disallowed the use of recovery keys. - ### Why am I unable to automatically unlock my drive? - Automatic unlocking for fixed data drives requires that the operating system drive also be protected by BitLocker. If you are using a computer that does not have a BitLocker-protected operating system drive, the drive cannot be automatically unlocked. For removable data drives, you can add automatic unlocking by right-clicking the drive in Windows Explorer and clicking **Manage BitLocker**. You will still be able to use the password or smart card credentials you supplied when you turned on BitLocker to unlock the removable drive on other computers. - ### Can I use BitLocker in Safe Mode? - Limited BitLocker functionality is available in Safe Mode. BitLocker-protected drives can be unlocked and decrypted by using the **BitLocker Drive Encryption** Control Panel item. Right-clicking to access BitLocker options from Windows Explorer is not available in Safe Mode. - ### How do I "lock" a data drive? - Both fixed and removable data drives can be locked by using the Manage-bde command-line tool and the –lock command. - **Note**   Ensure all data is saved to the drive before locking it. Once locked, the drive will become inaccessible. -   - The syntax of this command is: - **manage-bde** *<driveletter>* **-lock** - Outside of using this command, data drives will be locked on shutdown and restart of the operating system. A removable data drive will also be locked automatically when the drive is removed from the computer. - ### Can I use BitLocker with the Volume Shadow Copy Service? - Yes. However, shadow copies made prior to enabling BitLocker will be automatically deleted when BitLocker is enabled on software-encrypted drives. If you are using a hardware encrypted drive, the shadow copies are retained. - ### Does BitLocker support virtual hard disks (VHDs)? - BitLocker is not supported on bootable VHDs, but BitLocker is supported on data volume VHDs, such as those used by clusters, if you are running Windows 10, Windows 8.1, Windows 8, Windows Server 2012, or Windows Server 2012 R2. - ## More information - - - [Prepare your organization for BitLocker: Planning and Policies](prepare-your-organization-for-bitlocker-planning-and-policies.md) - - [BitLocker Group Policy settings](bitlocker-group-policy-settings.md) - - [BCD settings and BitLocker](bcd-settings-and-bitlocker.md) - - [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md) - - [BitLocker: How to deploy on Windows Server 2012](bitlocker-how-to-deploy-on-windows-server.md) - - [BitLocker: Use BitLocker Drive Encryption Tools to manage BitLocker](bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md) - - [BitLocker: Use BitLocker Recovery Password Viewer](bitlocker-use-bitlocker-recovery-password-viewer.md) - - [BitLocker Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/6f49f904-e04d-4b90-afbc-84bc45d4d30d) -   -   - - - - - diff --git a/windows/keep-secure/bitlocker-group-policy-settings.md b/windows/keep-secure/bitlocker-group-policy-settings.md index ca750b9147..2179049ec9 100644 --- a/windows/keep-secure/bitlocker-group-policy-settings.md +++ b/windows/keep-secure/bitlocker-group-policy-settings.md @@ -2,133 +2,72 @@ title: BitLocker Group Policy settings (Windows 10) description: This topic for IT professionals describes the function, location, and effect of each Group Policy setting that is used to manage BitLocker Drive Encryption. ms.assetid: 4904e336-29fe-4cef-bb6c-3950541864af +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # BitLocker Group Policy settings - - **Applies to** - - Windows 10 - This topic for IT professionals describes the function, location, and effect of each Group Policy setting that is used to manage BitLocker Drive Encryption. - To control what drive encryption tasks the user can perform from the Windows Control Panel or to modify other configuration options, you can use Group Policy administrative templates or local computer policy settings. How you configure these policy settings depends on how you implement BitLocker and what level of user interaction will be allowed. - **Note**   A separate set of Group Policy settings supports the use of the Trusted Platform Module (TPM). For details about those settings, see [Trusted Platform Module Group Policy settings](trusted-platform-module-services-group-policy-settings.md). -   - BitLocker Group Policy settings can be accessed using the Local Group Policy Editor and the Group Policy Management Console (GPMC) under **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption**. - Most of the BitLocker Group Policy settings are applied when BitLocker is initially turned on for a drive. If a computer is not compliant with existing Group Policy settings, BitLocker may not be turned on or modified until the computer is in a compliant state. When a drive is out of compliance with Group Policy settings (for example, if a Group Policy setting was changed after the initial BitLocker deployment in your organization, and then the setting was applied to previously encrypted drives), no change can be made to the BitLocker configuration of that drive except a change that will bring it into compliance. - If multiple changes are necessary to bring the drive into compliance, you must suspend BitLocker protection, make the necessary changes, and then resume protection. This situation could occur, for example, if a removable drive was initially configured to be unlocked with a password and then Group Policy settings are changed to disallow passwords and require smart cards. In this situation, you need to suspend BitLocker protection by using the [Manage-bde](http://technet.microsoft.com/library/ff829849.aspx) command-line tool, delete the password unlock method, and add the smart card method. After this is complete, BitLocker is compliant with the Group Policy setting and BitLocker protection on the drive can be resumed. - ## BitLocker Group Policy settings - - The following sections provide a comprehensive list of BitLocker Group Policy settings that are organized by usage. BitLocker Group Policy settings include settings for specific drive types (operating system drives, fixed data drives, and removable data drives) and settings that are applied to all drives. - The following policy settings can be used to determine how a BitLocker-protected drive can be unlocked. - - [Allow network unlock at startup](#bkmk-netunlock) - - [Require additional authentication at startup](#bkmk-unlockpol1) - - [Allow enhanced PINs for startup](#bkmk-unlockpol2) - - [Configure minimum PIN length for startup](#bkmk-unlockpol3) - - [Disallow standard users from changing the PIN or password](#bkmk-dpinchange) - - [Configure use of passwords for operating system drives](#bkmk-ospw) - - [Require additional authentication at startup (Windows Server 2008 and Windows Vista)](#bkmk-unlockpol4) - - [Configure use of smart cards on fixed data drives](#bkmk-unlockpol5) - - [Configure use of passwords on fixed data drives](#bkmk-unlockpol6) - - [Configure use of smart cards on removable data drives](#bkmk-unlockpol7) - - [Configure use of passwords on removable data drives](#bkmk-unlockpol8) - - [Validate smart card certificate usage rule compliance](#bkmk-unlockpol9) - - [Enable use of BitLocker authentication requiring preboot keyboard input on slates](#bkmk-slates) - The following policy settings are used to control how users can access drives and how they can use BitLocker on their computers. - - [Deny write access to fixed drives not protected by BitLocker](#bkmk-driveaccess1) - - [Deny write access to removable drives not protected by BitLocker](#bkmk-driveaccess2) - - [Control use of BitLocker on removable drives](#bkmk-driveaccess3) - The following policy settings determine the encryption methods and encryption types that are used with BitLocker. - - [Choose drive encryption method and cipher strength](#bkmk-encryptmeth) - - [Configure use of hardware-based encryption for fixed data drives](#bkmk-hdefxd) - - [Configure use of hardware-based encryption for operating system drives](#bkmk-hdeosd) - - [Configure use of hardware-based encryption for removable data drives](#bkmk-hderdd) - - [Enforce drive encryption type on fixed data drives](#bkmk-detypefdd) - - [Enforce drive encryption type on operating system drives](#bkmk-detypeosd) - - [Enforce drive encryption type on removable data drives](#bkmk-detyperdd) - The following policy settings define the recovery methods that can be used to restore access to a BitLocker-protected drive if an authentication method fails or is unable to be used. - - [Choose how BitLocker-protected operating system drives can be recovered](#bkmk-rec1) - - [Choose how users can recover BitLocker-protected drives (Windows Server 2008 and Windows Vista)](#bkmk-rec2) - - [Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista)](#bkmk-rec3) - - [Choose default folder for recovery password](#bkmk-rec4) - - [Choose how BitLocker-protected fixed drives can be recovered](#bkmk-rec6) - - [Choose how BitLocker-protected removable drives can be recovered](#bkmk-rec7) - - [Configure the pre-boot recovery message and URL](#bkmk-configurepreboot) - The following policies are used to support customized deployment scenarios in your organization. - - [Allow Secure Boot for integrity validation](#bkmk-secboot) - - [Provide the unique identifiers for your organization](#bkmk-depopt1) - - [Prevent memory overwrite on restart](#bkmk-depopt2) - - [Configure TPM platform validation profile for BIOS-based firmware configurations](#bkmk-tpmbios) - - [Configure TPM platform validation profile (Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2)](#bkmk-depopt3) - - [Configure TPM platform validation profile for native UEFI firmware configurations](#bkmk-tpmvaluefi) - - [Reset platform validation data after BitLocker recovery](#bkmk-resetrec) - - [Use enhanced Boot Configuration Data validation profile](#bkmk-enbcd) - - [Allow access to BitLocker-protected fixed data drives from earlier versions of Windows](#bkmk-depopt4) - - [Allow access to BitLocker-protected removable data drives from earlier versions of Windows](#bkmk-depopt5) - ### Allow network unlock at startup - This policy controls a portion of the behavior of the Network Unlock feature in BitLocker. This policy is required to enable BitLocker Network Unlock on a network because it allows clients running BitLocker to create the necessary network key protector during encryption. This policy is used in addition to the BitLocker Drive Encryption Network Unlock Certificate security policy (located in the **Public Key Policies** folder of Local Computer Policy) to allow systems that are connected to a trusted network to properly utilize the Network Unlock feature. - @@ -165,24 +104,15 @@ This policy controls a portion of the behavior of the Network Unlock feature in
-   - **Reference** - To use a network key protector to unlock the computer, the computer and the server that hosts BitLocker Drive Encryption Network Unlock must be provisioned with a Network Unlock certificate. The Network Unlock certificate is used to create a network key protector and to protect the information exchange with the server to unlock the computer. You can use the Group Policy setting **Computer Configuration\\Windows Settings\\Security Settings\\Public Key Policies\\BitLocker Drive Encryption Network Unlock Certificate** on the domain controller to distribute this certificate to computers in your organization. This unlock method uses the TPM on the computer, so computers that do not have a TPM cannot create network key protectors to automatically unlock by using Network Unlock. - **Note**   For reliability and security, computers should also have a TPM startup PIN that can be used when the computer is disconnected from the wired network or cannot connect to the domain controller at startup. -   - For more information about Network Unlock, see [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md). - ### Require additional authentication at startup - This policy setting is used to control which unlock options are available for operating system drives. - @@ -221,61 +151,33 @@ This policy setting is used to control which unlock options are available for op
-   - **Reference** - If you want to use BitLocker on a computer without a TPM, select the **Allow BitLocker without a compatible TPM** check box. In this mode, a USB drive is required for startup. Key information that is used to encrypt the drive is stored on the USB drive, which creates a USB key. When the USB key is inserted, access to the drive is authenticated and the drive is accessible. If the USB key is lost or unavailable, you need to use one of the BitLocker recovery options to access the drive. - On a computer with a compatible TPM, four types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use: - - only the TPM for authentication - - insertion of a USB flash drive containing the startup key - - the entry of a 4-digit to 20-digit personal identification number (PIN) - - a combination of the PIN and the USB flash drive - There are four options for TPM-enabled computers or devices: - - Configure TPM startup - - Allow TPM - - Require TPM - - Do not allow TPM - - Configure TPM startup PIN - - Allow startup PIN with TPM - - Require startup PIN with TPM - - Do not allow startup PIN with TPM - - Configure TPM startup key - - Allow startup key with TPM - - Require startup key with TPM - - Do not allow startup key with TPM - - Configure TPM startup key and PIN - - Allow TPM startup key with PIN - - Require startup key and PIN with TPM - - Do not allow TPM startup key with PIN - ### Allow enhanced PINs for startup - This policy setting permits the use of enhanced PINs when you use an unlock method that includes a PIN. - @@ -312,22 +214,14 @@ This policy setting permits the use of enhanced PINs when you use an unlock meth
-   - **Reference** - Enhanced startup PINs permit the use of characters (including uppercase and lowercase letters, symbols, numbers, and spaces). This policy setting is applied when you turn on BitLocker. - **Important**   Not all computers support enhanced PIN characters in the preboot environment. It is strongly recommended that users perform a system check during the BitLocker setup to verify that enhanced PIN characters can be used. -   - ### Configure minimum PIN length for startup - This policy setting is used to set a minimum PIN length when you use an unlock method that includes a PIN. - @@ -364,17 +258,11 @@ This policy setting is used to set a minimum PIN length when you use an unlock m
-   - **Reference** - This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 4 digits and can have a maximum length of 20 digits. - ### Disallow standard users from changing the PIN or password - This policy setting allows you to configure whether standard users are allowed to change the PIN or password that is used to protect the operating system drive. - @@ -411,17 +299,11 @@ This policy setting allows you to configure whether standard users are allowed t
-   - **Reference** - To change the PIN or password, the user must be able to provide the current PIN or password. This policy setting is applied when you turn on BitLocker. - ### Configure use of passwords for operating system drives - This policy controls how non-TPM based systems utilize the password protector. Used in conjunction with the **Password must meet complexity requirements** policy, this policy allows administrators to require password length and complexity for using the password protector. By default, passwords must be eight characters in length. Complexity configuration options determine how important domain connectivity is for the client. For the strongest password security, administrators should choose **Require password complexity** because it requires domain connectivity, and it requires that the BitLocker password meets the same password complexity requirements as domain sign-in passwords. - @@ -465,34 +347,20 @@ This policy controls how non-TPM based systems utilize the password protector. U
-   - **Reference** - If non-TPM protectors are allowed on operating system drives, you can provision a password, enforce complexity requirements on the password, and configure a minimum length for the password. For the complexity requirement setting to be effective, the Group Policy setting **Password must meet complexity requirements**, which is located at **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy\\** must be also enabled. - **Note**   These settings are enforced when turning on BitLocker, not when unlocking a volume. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. -   - When set to **Require complexity**, a connection to a domain controller is necessary when BitLocker is enabled to validate the complexity the password. When set to **Allow complexity**, a connection to a domain controller is attempted to validate that the complexity adheres to the rules set by the policy. If no domain controllers are found, the password will be accepted regardless of actual password complexity, and the drive will be encrypted by using that password as a protector. When set to **Do not allow complexity**, there is no password complexity validation. - Passwords must be at least 8 characters. To configure a greater minimum length for the password, enter the desired number of characters in the **Minimum password length** box. - When this policy setting is enabled, you can set the option **Configure password complexity for operating system drives** to: - - Allow password complexity - - Do not allow password complexity - - Require password complexity - ### Require additional authentication at startup (Windows Server 2008 and Windows Vista) - This policy setting is used to control what unlock options are available for computers running Windows Server 2008 or Windows Vista. - @@ -529,41 +397,23 @@ This policy setting is used to control what unlock options are available for com
-   - **Reference** - On a computer with a compatible TPM, two authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can require users to insert a USB drive that contains a startup key. It can also require users to enter a 4-digit to 20-digit startup PIN. - A USB drive that contains a startup key is needed on computers without a compatible TPM. Without a TPM, BitLocker-encrypted data is protected solely by the key material that is on this USB drive. - There are two options for TPM-enabled computers or devices: - - Configure TPM startup PIN - - Allow startup PIN with TPM - - Require startup PIN with TPM - - Do not allow startup PIN with TPM - - Configure TPM startup key - - Allow startup key with TPM - - Require startup key with TPM - - Do not allow startup key with TPM - These options are mutually exclusive. If you require the startup key, you must not allow the startup PIN. If you require the startup PIN, you must not allow the startup key. Otherwise, a policy error will occur. - To hide the advanced page on a TPM-enabled computer or device, set these options to **Do not allow** for the startup key and for the startup PIN. - ### Configure use of smart cards on fixed data drives - This policy setting is used to require, allow, or deny the use of smart cards with fixed data drives. - @@ -604,20 +454,13 @@ This policy setting is used to require, allow, or deny the use of smart cards wi
-   - **Reference** - **Note**   These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive by using any of the protectors that are available on the drive. -   - ### Configure use of passwords on fixed data drives - This policy setting is used to require, allow, or deny the use of passwords with fixed data drives. - @@ -658,39 +501,23 @@ This policy setting is used to require, allow, or deny the use of passwords with
-   - **Reference** - When set to **Require complexity**, a connection to a domain controller is necessary to validate the complexity of the password when BitLocker is enabled. - When set to **Allow complexity**, a connection to a domain controller is attempted to validate that the complexity adheres to the rules set by the policy. However, if no domain controllers are found, the password is accepted regardless of the actual password complexity, and the drive is encrypted by using that password as a protector. - When set to **Do not allow complexity**, no password complexity validation is performed. - Passwords must be at least 8 characters. To configure a greater minimum length for the password, enter the desired number of characters in the **Minimum password length** box. - **Note**   These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. -   - For the complexity requirement setting to be effective, the Group Policy setting **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy\\Password must meet complexity requirements** must also be enabled. - This policy setting is configured on a per-computer basis. This means that it applies to local user accounts and domain user accounts. Because the password filter that is used to validate password complexity is located on the domain controllers, local user accounts cannot access the password filter because they are not authenticated for domain access. When this policy setting is enabled, if you sign in with a local user account, and you attempt to encrypt a drive or change a password on an existing BitLocker-protected drive, an "Access denied" error message is displayed. In this situation, the password key protector cannot be added to the drive. - Enabling this policy setting requires that connectivity to a domain be established before adding a password key protector to a BitLocker-protected drive. Users who work remotely and have periods of time in which they cannot connect to the domain should be made aware of this requirement so that they can schedule a time when they will be connected to the domain to turn on BitLocker or to change a password on a BitLocker-protected data drive. - **Important**   Passwords cannot be used if FIPS compliance is enabled. The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting in **Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** specifies whether FIPS compliance is enabled. -   - ### Configure use of smart cards on removable data drives - This policy setting is used to require, allow, or deny the use of smart cards with removable data drives. - @@ -731,20 +558,13 @@ This policy setting is used to require, allow, or deny the use of smart cards wi
-   - **Reference** - **Note**   These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. -   - ### Configure use of passwords on removable data drives - This policy setting is used to require, allow, or deny the use of passwords with removable data drives. - @@ -785,37 +605,22 @@ This policy setting is used to require, allow, or deny the use of passwords with
-   - **Reference** - If you choose to allow the use of a password, you can require a password to be used, enforce complexity requirements, and configure a minimum length. For the complexity requirement setting to be effective, the Group Policy setting **Password must meet complexity requirements**, which is located at **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy** must also be enabled. - **Note**   These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. -   - Passwords must be at least 8 characters. To configure a greater minimum length for the password, enter the desired number of characters in the **Minimum password length** box. - When set to **Require complexity**, a connection to a domain controller is necessary when BitLocker is enabled to validate the complexity the password. - When set to **Allow complexity**, a connection to a domain controller will be attempted to validate that the complexity adheres to the rules set by the policy. However, if no domain controllers are found, the password will still be accepted regardless of actual password complexity and the drive will be encrypted by using that password as a protector. - When set to **Do not allow complexity**, no password complexity validation will be done. - **Note**   Passwords cannot be used if FIPS compliance is enabled. The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting in **Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** specifies whether FIPS compliance is enabled. -   - For information about this setting, see [System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing](http://technet.microsoft.com/library/jj852211.aspx). - ### Validate smart card certificate usage rule compliance - This policy setting is used to determine what certificate to use with BitLocker. - @@ -852,26 +657,16 @@ This policy setting is used to determine what certificate to use with BitLocker.
-   - **Reference** - This policy setting is applied when you turn on BitLocker. - The object identifier is specified in the enhanced key usage (EKU) of a certificate. BitLocker can identify which certificates can be used to authenticate a user certificate to a BitLocker-protected drive by matching the object identifier in the certificate with the object identifier that is defined by this policy setting. - The default object identifier is 1.3.6.1.4.1.311.67.1.1. - **Note**   BitLocker does not require that a certificate have an EKU attribute; however, if one is configured for the certificate, it must be set to an object identifier that matches the object identifier configured for BitLocker. -   - ### Enable use of BitLocker authentication requiring preboot keyboard input on slates - This policy setting allows users to enable authentication options that require user input from the preboot environment even if the platform indicates a lack of preboot input capability. - @@ -908,29 +703,17 @@ This policy setting allows users to enable authentication options that require u
-   - **Reference** - The Windows touch keyboard (such as used by tablets) is not available in the preboot environment where BitLocker requires additional information, such as a PIN or password. - It is recommended that administrators enable this policy only for devices that are verified to have an alternative means of preboot input, such as attaching a USB keyboard. - When the Windows Recovery Environment is not enabled and this policy is not enabled, you cannot turn on BitLocker on a device that uses the Windows touch keyboard. - If you do not enable this policy setting, the following options in the **Require additional authentication at startup** policy might not be available: - - Configure TPM startup PIN: Required and Allowed - - Configure TPM startup key and PIN: Required and Allowed - - Configure use of passwords for operating system drives - ### Deny write access to fixed drives not protected by BitLocker - This policy setting is used to require encryption of fixed drives prior to granting Write access. - @@ -967,31 +750,18 @@ This policy setting is used to require encryption of fixed drives prior to grant
-   - **Reference** - This policy setting is applied when you turn on BitLocker. - Conflict considerations include: - 1. When this policy setting is enabled, users receive "Access denied" error messages when they try to save data to unencrypted fixed data drives. See the Reference section for additional conflicts. - 2. If BdeHdCfg.exe is run on a computer when this policy setting is enabled, you could encounter the following issues: - - If you attempted to shrink the drive and create the system drive, the drive size is successfully reduced and a raw partition is created. However, the raw partition is not formatted. The following error message is displayed: "The new active drive cannot be formatted. You may need to manually prepare your drive for BitLocker." - - If you attempt to use unallocated space to create the system drive, a raw partition will be created. However, the raw partition will not be formatted. The following error message is displayed: "The new active drive cannot be formatted. You may need to manually prepare your drive for BitLocker." - - If you attempt to merge an existing drive into the system drive, the tool fails to copy the required boot file onto the target drive to create the system drive. The following error message is displayed: "BitLocker setup failed to copy boot files. You may need to manually prepare your drive for BitLocker." - 3. If this policy setting is enforced, a hard drive cannot be repartitioned because the drive is protected. If you are upgrading computers in your organization from a previous version of Windows, and those computers were configured with a single partition, you should create the required BitLocker system partition before you apply this policy setting to the computers. - ### Deny write access to removable drives not protected by BitLocker - This policy setting is used to require that removable drives are encrypted prior to granting Write access, and to control whether BitLocker-protected removable drives that were configured in another organization can be opened with Write access. - @@ -1028,30 +798,18 @@ This policy setting is used to require that removable drives are encrypted prior
-   - **Reference** - If the **Deny write access to devices configured in another organization** option is selected, only drives with identification fields that match the computer's identification fields are given Write access. When a removable data drive is accessed, it is checked for a valid identification field and allowed identification fields. These fields are defined by the **Provide the unique identifiers for your organization** policy setting. - **Note**   You can override this policy setting with the policy settings under **User Configuration\\Administrative Templates\\System\\Removable Storage Access**. If the **Removable Disks: Deny write access** policy setting is enabled, this policy setting will be ignored. -   - Conflict considerations include: - 1. Use of BitLocker with the TPM plus a startup key or with the TPM plus a PIN and startup key must be disallowed if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled. - 2. Use of recovery keys must be disallowed if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled. - 3. You must enable the **Provide the unique identifiers for your organization** policy setting if you want to deny Write access to drives that were configured in another organization. - ### Control use of BitLocker on removable drives - This policy setting is used to prevent users from turning BitLocker on or off on removable data drives. - @@ -1092,25 +850,15 @@ This policy setting is used to prevent users from turning BitLocker on or off on
-   - **Reference** - This policy setting is applied when you turn on BitLocker. - For information about suspending BitLocker protection, see [BitLocker Basic Deployment](http://technet.microsoft.com/library/dn383581.aspx). - The options for choosing property settings that control how users can configure BitLocker are: - - **Allow users to apply BitLocker protection on removable data drives**   Enables the user to run the BitLocker Setup Wizard on a removable data drive. - - **Allow users to suspend and decrypt BitLocker on removable data drives**   Enables the user to remove BitLocker from the drive or to suspend the encryption while performing maintenance. - ### Choose drive encryption method and cipher strength - This policy setting is used to control the encryption method and cipher strength. - @@ -1147,26 +895,16 @@ This policy setting is used to control the encryption method and cipher strength
-   - **Reference** - By default, BitLocker uses AES 128-bit encryption. Available options are AES-128 and AES-256. The values of this policy determine the strength of the cipher that BitLocker uses for encryption. Enterprises may want to control the encryption level for increased security (AES-256 is stronger than AES-128). - Changing the encryption method has no effect if the drive is already encrypted or if encryption is in progress. In these cases, this policy setting is ignored. - **Warning**   This policy does not apply to encrypted drives. Encrypted drives utilize their own algorithm, which is set by the drive during partitioning. -   - When this policy setting is disabled, BitLocker uses AES with the same bit strength (128-bit or 256-bit) as specified in the policy setting **Choose drive encryption method and cipher strength (Windows Vista, Windows Server 2008, Windows 7)**. If neither policy is set, BitLocker uses the default encryption method, AES-128, or the encryption method that is specified in the setup script. - ### Configure use of hardware-based encryption for fixed data drives - This policy controls how BitLocker reacts to systems that are equipped with encrypted drives when they are used as fixed data volumes. Using hardware-based encryption can improve the performance of drive operations that involve frequent reading or writing of data to the drive. - @@ -1207,26 +945,16 @@ This policy controls how BitLocker reacts to systems that are equipped with encr
-   - **Reference** - **Note**   The **Choose drive encryption method and cipher strength** policy setting does not apply to hardware-based encryption. -   - The encryption algorithm that is used by hardware-based encryption is set when the drive is partitioned. By default, BitLocker uses the algorithm that is configured on the drive to encrypt the drive. The **Restrict encryption algorithms and cipher suites allowed for hardware-based encryption** option of this setting enables you to restrict the encryption algorithms that BitLocker can use with hardware encryption. If the algorithm that is set for the drive is not available, BitLocker disables the use of hardware-based encryption. Encryption algorithms are specified by object identifiers (OID), for example: - - Advanced Encryption Standard (AES) 128 in Cipher Block Chaining (CBC) mode OID: 2.16.840.1.101.3.4.1.2 - - AES 256 in CBC mode OID: 2.16.840.1.101.3.4.1.42 - ### Configure use of hardware-based encryption for operating system drives - This policy controls how BitLocker reacts when encrypted drives are used as operating system drives. Using hardware-based encryption can improve the performance of drive operations that involve frequent reading or writing of data to the drive. - @@ -1267,28 +995,17 @@ This policy controls how BitLocker reacts when encrypted drives are used as oper
-   - **Reference** - If hardware-based encryption is not available, BitLocker software-based encryption is used instead. - **Note**   The **Choose drive encryption method and cipher strength** policy setting does not apply to hardware-based encryption. -   - The encryption algorithm that is used by hardware-based encryption is set when the drive is partitioned. By default, BitLocker uses the algorithm that is configured on the drive to encrypt the drive. The **Restrict encryption algorithms and cipher suites allowed for hardware-based encryption** option of this setting enables you to restrict the encryption algorithms that BitLocker can use with hardware encryption. If the algorithm that is set for the drive is not available, BitLocker disables the use of hardware-based encryption. Encryption algorithms are specified by object identifiers (OID), for example: - - Advanced Encryption Standard (AES) 128 in Cipher Block Chaining (CBC) mode OID: 2.16.840.1.101.3.4.1.2 - - AES 256 in CBC mode OID: 2.16.840.1.101.3.4.1.42 - ### Configure use of hardware-based encryption for removable data drives - This policy controls how BitLocker reacts to encrypted drives when they are used as removable data drives. Using hardware-based encryption can improve the performance of drive operations that involve frequent reading or writing of data to the drive. - @@ -1329,28 +1046,17 @@ This policy controls how BitLocker reacts to encrypted drives when they are used
-   - **Reference** - If hardware-based encryption is not available, BitLocker software-based encryption is used instead. - **Note**   The **Choose drive encryption method and cipher strength** policy setting does not apply to hardware-based encryption. -   - The encryption algorithm that is used by hardware-based encryption is set when the drive is partitioned. By default, BitLocker uses the algorithm that is configured on the drive to encrypt the drive. The **Restrict encryption algorithms and cipher suites allowed for hardware-based encryption** option of this setting enables you to restrict the encryption algorithms that BitLocker can use with hardware encryption. If the algorithm that is set for the drive is not available, BitLocker disables the use of hardware-based encryption. Encryption algorithms are specified by object identifiers (OID), for example: - - Advanced Encryption Standard (AES) 128 in Cipher Block Chaining (CBC) mode OID: 2.16.840.1.101.3.4.1.2 - - AES 256 in CBC mode OID: 2.16.840.1.101.3.4.1.42 - ### Enforce drive encryption type on fixed data drives - This policy controls whether fixed data drives utilize Used Space Only encryption or Full encryption. Setting this policy also causes the BitLocker Setup Wizard to skip the encryption options page so no encryption selection displays to the user. - @@ -1387,24 +1093,15 @@ This policy controls whether fixed data drives utilize Used Space Only encryptio
-   - **Reference** - This policy setting is applied when you turn on BitLocker. Changing the encryption type has no effect if the drive is already encrypted or if encryption is in progress. Choose Full encryption to require that the entire drive be encrypted when BitLocker is turned on. Choose Used Space Only encryption to require that only the portion of the drive that is used to store data is encrypted when BitLocker is turned on. - **Note**   This policy is ignored when you are shrinking or expanding a volume and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space is not wiped as it would be for a drive that is using Full encryption. The user could wipe the free space on a Used Space Only drive by using the following command: **manage-bde -w**. If the volume is shrunk, no action is taken for the new free space. -   - For more information about the tool to manage BitLocker, see [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx). - ### Enforce drive encryption type on operating system drives - This policy controls whether operating system drives utilize Full encryption or Used Space Only encryption. Setting this policy also causes the BitLocker Setup Wizard to skip the encryption options page, so no encryption selection displays to the user. - @@ -1441,24 +1138,15 @@ This policy controls whether operating system drives utilize Full encryption or
-   - **Reference** - This policy setting is applied when you turn on BitLocker. Changing the encryption type has no effect if the drive is already encrypted or if encryption is in progress. Choose Full encryption to require that the entire drive be encrypted when BitLocker is turned on. Choose Used Space Only encryption to require that only the portion of the drive that is used to store data is encrypted when BitLocker is turned on. - **Note**   This policy is ignored when shrinking or expanding a volume, and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space is not wiped as it would be for a drive that uses Full encryption. The user could wipe the free space on a Used Space Only drive by using the following command: **manage-bde -w**. If the volume is shrunk, no action is taken for the new free space. -   - For more information about the tool to manage BitLocker, see [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx). - ### Enforce drive encryption type on removable data drives - This policy controls whether fixed data drives utilize Full encryption or Used Space Only encryption. Setting this policy also causes the BitLocker Setup Wizard to skip the encryption options page, so no encryption selection displays to the user. - @@ -1495,24 +1183,15 @@ This policy controls whether fixed data drives utilize Full encryption or Used S
-   - **Reference** - This policy setting is applied when you turn on BitLocker. Changing the encryption type has no effect if the drive is already encrypted or if encryption is in progress. Choose Full encryption to require that the entire drive be encrypted when BitLocker is turned on. Choose Used Space Only encryption to require that only the portion of the drive that is used to store data is encrypted when BitLocker is turned on. - **Note**   This policy is ignored when shrinking or expanding a volume, and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space is not wiped as it would be for a drive that is using Full Encryption. The user could wipe the free space on a Used Space Only drive by using the following command: **manage-bde -w**. If the volume is shrunk, no action is taken for the new free space. -   - For more information about the tool to manage BitLocker, see [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx). - ### Choose how BitLocker-protected operating system drives can be recovered - This policy setting is used to configure recovery methods for operating system drives. - @@ -1550,34 +1229,20 @@ This policy setting is used to configure recovery methods for operating system d
-   - **Reference** - This policy setting is applied when you turn on BitLocker. - The **Allow data recovery agent** check box is used to specify whether a data recovery agent can be used with BitLocker-protected operating system drives. Before a data recovery agent can be used, it must be added from **Public Key Policies**, which is located in the Group Policy Management Console (GPMC) or in the Local Group Policy Editor. - For more information about adding data recovery agents, see [BitLocker basic deployment](bitlocker-basic-deployment.md). - In **Configure user storage of BitLocker recovery information**, select whether users are allowed, required, or not allowed to generate a 48-digit recovery password. - Select **Omit recovery options from the BitLocker setup wizard** to prevent users from specifying recovery options when they enable BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you enable BitLocker. Instead, BitLocker recovery options for the drive are determined by the policy setting. - In **Save BitLocker recovery information to Active Directory Domain Services**, choose which BitLocker recovery information to store in Active Directory Domain Services (AD DS) for operating system drives. If you select **Store recovery password and key packages**, the BitLocker recovery password and the key package are stored in AD DS. Storing the key package supports recovering data from a drive that is physically corrupted. If you select **Store recovery password only**, only the recovery password is stored in AD DS. - Select the **Do not enable BitLocker until recovery information is stored in AD DS for operating system drives** check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. - **Note**   If the **Do not enable BitLocker until recovery information is stored in AD DS for operating system drives** check box is selected, a recovery password is automatically generated. -   - ### Choose how users can recover BitLocker-protected drives (Windows Server 2008 and Windows Vista) - This policy setting is used to configure recovery methods for BitLocker-protected drives on computers running Windows Server 2008 or Windows Vista. - @@ -1614,33 +1279,20 @@ This policy setting is used to configure recovery methods for BitLocker-protecte
-   - **Reference** - This policy is only applicable to computers running Windows Server 2008 or Windows Vista. This policy setting is applied when you turn on BitLocker. - Two recovery options can be used to unlock BitLocker-encrypted data in the absence of the required startup key information. Users can type a 48-digit numerical recovery password, or they can insert a USB drive that contains a 256-bit recovery key. - Saving the recovery password to a USB drive stores the 48-digit recovery password as a text file and the 256-bit recovery key as a hidden file. Saving it to a folder stores the 48-digit recovery password as a text file. Printing it sends the 48-digit recovery password to the default printer. For example, not allowing the 48-digit recovery password prevents users from printing or saving recovery information to a folder. - **Important**   If TPM initialization is performed during the BitLocker setup, TPM owner information is saved or printed with the BitLocker recovery information. - The 48-digit recovery password is not available in FIPS-compliance mode. -   - **Important**   To prevent data loss, you must have a way to recover BitLocker encryption keys. If you do not allow both recovery options, you must enable the backup of BitLocker recovery information to AD DS. Otherwise, a policy error occurs. -   - ### Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista) - This policy setting is used to configure the storage of BitLocker recovery information in AD DS. This provides an administrative method of recovering data that is encrypted by BitLocker to prevent data loss due to lack of key information. - @@ -1677,33 +1329,19 @@ This policy setting is used to configure the storage of BitLocker recovery infor
-   - **Reference** - This policy is only applicable to computers running Windows Server 2008 or Windows Vista. - This policy setting is applied when you turn on BitLocker. - BitLocker recovery information includes the recovery password and unique identifier data. You can also include a package that contains an encryption key for a BitLocker-protected drive. This key package is secured by one or more recovery passwords, and it can help perform specialized recovery when the disk is damaged or corrupted. - If you select **Require BitLocker backup to AD DS**, BitLocker cannot be turned on unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. This option is selected by default to help ensure that BitLocker recovery is possible. - A recovery password is a 48-digit number that unlocks access to a BitLocker-protected drive. A key package contains a drive’s BitLocker encryption key, which is secured by one or more recovery passwords. Key packages may help perform specialized recovery when the disk is damaged or corrupted. - If the **Require BitLocker backup to AD DS** option is not selected, AD DS backup is attempted, but network or other backup failures do not prevent the BitLocker setup. The Backup process is not automatically retried, and the recovery password might not be stored in AD DS during BitLocker setup. - TPM initialization might be needed during the BitLocker setup. Enable the **Turn on TPM backup to Active Directory Domain Services** policy setting in **Computer Configuration\\Administrative Templates\\System\\Trusted Platform Module Services** to ensure that TPM information is also backed up. - For more information about this setting, see [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md). - If you are using domain controllers running Windows Server 2003 with Service Pack 1, you must first set up appropriate schema extensions and access control settings on the domain before a backup to AD DS can succeed. For more info, see [Backup the TPM recovery Information to AD DS](backup-tpm-recovery-information-to-ad-ds.md). - ### Choose default folder for recovery password - This policy setting is used to configure the default folder for recovery passwords. - @@ -1740,22 +1378,14 @@ This policy setting is used to configure the default folder for recovery passwor
-   - **Reference** - This policy setting is applied when you turn on BitLocker. - **Note**   This policy setting does not prevent the user from saving the recovery password in another folder. -   - ### Choose how BitLocker-protected fixed drives can be recovered - This policy setting is used to configure recovery methods for fixed data drives. - @@ -1793,34 +1423,20 @@ This policy setting is used to configure recovery methods for fixed data drives.
-   - **Reference** - This policy setting is applied when you turn on BitLocker. - The **Allow data recovery agent** check box is used to specify whether a data recovery agent can be used with BitLocker-protected fixed data drives. Before a data recovery agent can be used, it must be added from **Public Key Policies**, which is located in the Group Policy Management Console (GPMC) or in the Local Group Policy Editor. - In **Configure user storage of BitLocker recovery information**, select whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key. - Select **Omit recovery options from the BitLocker setup wizard** to prevent users from specifying recovery options when they enable BitLocker on a drive. This means that you cannot specify which recovery option to use when you enable BitLocker. Instead, BitLocker recovery options for the drive are determined by the policy setting. - In **Save BitLocker recovery information to Active Directory Doman Services**, choose which BitLocker recovery information to store in AD DS for fixed data drives. If you select **Backup recovery password and key package**, the BitLocker recovery password and the key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. To recover this data, you can use the **Repair-bde** command-line tool. If you select **Backup recovery password only**, only the recovery password is stored in AD DS. - For more information about the BitLocker repair tool, see [Repair-bde](http://technet.microsoft.com/library/ff829851.aspx). - Select the **Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives** check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. - **Note**   If the **Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives** check box is selected, a recovery password is automatically generated. -   - ### Choose how BitLocker-protected removable drives can be recovered - This policy setting is used to configure recovery methods for removable data drives. - @@ -1858,32 +1474,19 @@ This policy setting is used to configure recovery methods for removable data dri
-   - **Reference** - This policy setting is applied when you turn on BitLocker. - The **Allow data recovery agent** check box is used to specify whether a data recovery agent can be used with BitLocker-protected removable data drives. Before a data recovery agent can be used, it must be added from **Public Key Policies** , which is accessed using the GPMC or the Local Group Policy Editor. - In **Configure user storage of BitLocker recovery information**, select whether users are allowed, required, or not allowed to generate a 48-digit recovery password. - Select **Omit recovery options from the BitLocker setup wizard** to prevent users from specifying recovery options when they enable BitLocker on a drive. This means that you cannot specify which recovery option to use when you enable BitLocker. Instead, BitLocker recovery options for the drive are determined by the policy setting. - In **Save BitLocker recovery information to Active Directory Domain Services**, choose which BitLocker recovery information to store in AD DS for removable data drives. If you select **Backup recovery password and key package**, the BitLocker recovery password and the key package are stored in AD DS. If you select **Backup recovery password only**, only the recovery password is stored in AD DS. - Select the **Do not enable BitLocker until recovery information is stored in AD DS for removable data drives** check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. - **Note**   If the **Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives** check box is selected, a recovery password is automatically generated. -   - ### Configure the pre-boot recovery message and URL - This policy setting is used to configure the entire recovery message and to replace the existing URL that is displayed on the pre-boot recovery screen when the operating system drive is locked. - @@ -1920,35 +1523,21 @@ This policy setting is used to configure the entire recovery message and to repl
-   - **Reference** - Enabling the **Configure the pre-boot recovery message and URL** policy setting allows you to customize the default recovery screen message and URL to assist customers in recovering their key. - Once you enable the setting you have three options: - - If you select the **Use default recovery message and URL** option, the default BitLocker recovery message and URL will be displayed on the pre-boot recovery screen. - - If you select the **Use custom recovery message** option, type the custom message in the **Custom recovery message option** text box. The message that you type in the **Custom recovery message option** text box will be displayed on the pre-boot recovery screen. If a recovery URL is available, include it in the message. - - If you select the **Use custom recovery URL** option, type the custom message URL in the **Custom recovery URL option** text box. The URL that you type in the **Custom recovery URL option** text box replaces the default URL in the default recovery message, which will be displayed on the pre-boot recovery screen. - **Important**   Not all characters and languages are supported in the pre-boot environment. We strongly recommended that you verify the correct appearance of the characters that you use for the custom message and URL on the pre-boot recovery screen. -   - **Important**   Because you can alter the BCDEdit commands manually before you have set Group Policy settings, you cannot return the policy setting to the default setting by selecting the **Not Configured** option after you have configured this policy setting. To return to the default pre-boot recovery screen leave the policy setting enabled and select the **Use default message** options from the **Choose an option for the pre-boot recovery message** drop-down list box. -   - ### Allow Secure Boot for integrity validation - This policy controls how BitLocker-enabled system volumes are handled in conjunction with the Secure Boot feature. Enabling this feature forces Secure Boot validation during the boot process and verifies Boot Configuration Data (BCD) settings according to the Secure Boot policy. - @@ -1986,24 +1575,15 @@ This policy controls how BitLocker-enabled system volumes are handled in conjunc
-   - **Reference** - Secure Boot ensures that the computer's preboot environment loads only firmware that is digitally signed by authorized software publishers. Secure Boot also provides more flexibility for managing preboot configurations than BitLocker integrity checks prior to Windows Server 2012 and Windows 8. - When this policy is enabled and the hardware is capable of using Secure Boot for BitLocker scenarios, the **Use enhanced Boot Configuration Data validation profile** Group Policy setting is ignored, and Secure Boot verifies BCD settings according to the Secure Boot policy setting, which is configured separately from BitLocker. - **Warning**   Enabling this policy might result in BitLocker recovery when manufacturer-specific firmware is updated. If you disable this policy, suspend BitLocker prior to applying firmware updates. -   - ### Provide the unique identifiers for your organization - This policy setting is used to establish an identifier that is applied to all drives that are encrypted in your organization. - @@ -2040,29 +1620,17 @@ This policy setting is used to establish an identifier that is applied to all dr
-   - **Reference** - These identifiers are stored as the identification field and the allowed identification field. The identification field allows you to associate a unique organizational identifier to BitLocker-protected drives. This identifier is automatically added to new BitLocker-protected drives, and it can be updated on existing BitLocker-protected drives by using the [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx) command-line tool. - An identification field is required to manage certificate-based data recovery agents on BitLocker-protected drives and for potential updates to the BitLocker To Go Reader. BitLocker manages and updates data recovery agents only when the identification field on the drive matches the value that is configured in the identification field. In a similar manner, BitLocker updates the BitLocker To Go Reader only when the identification field on the drive matches the value that is configured for the identification field. - For more information about the tool to manage BitLocker, see [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx). - The allowed identification field is used in combination with the **Deny write access to removable drives not protected by BitLocker** policy setting to help control the use of removable drives in your organization. It is a comma-separated list of identification fields from your organization or external organizations. - You can configure the identification fields on existing drives by using the [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx) command-line tool. - When a BitLocker-protected drive is mounted on another BitLocker-enabled computer, the identification field and the allowed identification field are used to determine whether the drive is from an outside organization. - Multiple values separated by commas can be entered in the identification and allowed identification fields. The identification field can be any value up to 260 characters. - ### Prevent memory overwrite on restart - This policy setting is used to control whether the computer's memory will be overwritten the next time the computer is restarted. - @@ -2099,17 +1667,11 @@ This policy setting is used to control whether the computer's memory will be ove
-   - **Reference** - This policy setting is applied when you turn on BitLocker. BitLocker secrets include key material that is used to encrypt data. This policy setting applies only when BitLocker protection is enabled. - ### Configure TPM platform validation profile for BIOS-based firmware configurations - This policy setting determines what values the TPM measures when it validates early boot components before it unlocks an operating system drive on a computer with a BIOS configuration or with UEFI firmware that has the Compatibility Support Module (CSM) enabled. - @@ -2146,71 +1708,39 @@ This policy setting determines what values the TPM measures when it validates ea
-   - **Reference** - This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker has already been turned on with TPM protection. - **Important**   This Group Policy setting only applies to computers with BIOS configurations or to computers with UEFI firmware with the CSM enabled. Computers that use a native UEFI firmware configuration store different values in the Platform Configuration Registers (PCRs). Use the **Configure TPM platform validation profile for native UEFI firmware configurations** Group Policy setting to configure the TPM PCR profile for computers that use native UEFI firmware. -   - A platform validation profile consists of a set of PCR indices that range from 0 to 23. The default platform validation profile secures the encryption key against changes to the following: - - Core Root of Trust of Measurement (CRTM), BIOS, and Platform Extensions (PCR 0) - - Option ROM Code (PCR 2) - - Master Boot Record (MBR) Code (PCR 4) - - NTFS Boot Sector (PCR 8) - - NTFS Boot Block (PCR 9) - - Boot Manager (PCR 10) - - BitLocker Access Control (PCR 11) - **Note**   Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker’s sensitivity to platform modifications (malicious or authorized) is increased or decreased depending on inclusion or exclusion (respectively) of the PCRs. -   - The following list identifies all of the PCRs available: - - PCR 0: Core root-of-trust for measurement, BIOS, and Platform extensions - - PCR 1: Platform and motherboard configuration and data. - - PCR 2: Option ROM code - - PCR 3: Option ROM data and configuration - - PCR 4: Master Boot Record (MBR) code - - PCR 5: Master Boot Record (MBR) partition table - - PCR 6: State transition and wake events - - PCR 7: Computer manufacturer-specific - - PCR 8: NTFS boot sector - - PCR 9: NTFS boot block - - PCR 10: Boot manager - - PCR 11: BitLocker access control - - PCR 12-23: Reserved for future use - ### Configure TPM platform validation profile (Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2) - This policy setting determines what values the TPM measures when it validates early boot components before unlocking a drive on a computer running Windows Vista, Windows Server 2008, or Windows 7. - @@ -2247,71 +1777,39 @@ This policy setting determines what values the TPM measures when it validates ea
-   - **Reference** - This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker is already turned on with TPM protection. - A platform validation profile consists of a set of PCR indices that range from 0 to 23. The default platform validation profile secures the encryption key against changes to the following: - - Core Root of Trust of Measurement (CRTM), BIOS, and Platform Extensions (PCR 0) - - Option ROM Code (PCR 2) - - Master Boot Record (MBR) Code (PCR 4) - - NTFS Boot Sector (PCR 8) - - NTFS Boot Block (PCR 9) - - Boot Manager (PCR 10) - - BitLocker Access Control (PCR 11) - **Note**   The default TPM validation profile PCR settings for computers that use an Extensible Firmware Interface (EFI) are the PCRs 0, 2, 4, and 11 only. -   - The following list identifies all of the PCRs available: - - PCR 0: Core root-of-trust for measurement, EFI boot and run-time services, EFI drivers embedded in system ROM, ACPI static tables, embedded SMM code, and BIOS code - - PCR 1: Platform and motherboard configuration and data. Hand-off tables and EFI variables that affect system configuration - - PCR 2: Option ROM code - - PCR 3: Option ROM data and configuration - - PCR 4: Master Boot Record (MBR) code or code from other boot devices - - PCR 5: Master Boot Record (MBR) partition table. Various EFI variables and the GPT table - - PCR 6: State transition and wake events - - PCR 7: Computer manufacturer-specific - - PCR 8: NTFS boot sector - - PCR 9: NTFS boot block - - PCR 10: Boot manager - - PCR 11: BitLocker access control - - PCR 12 - 23: Reserved for future use - **Warning**   Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker's sensitivity to platform modifications (malicious or authorized) is increased or decreased depending on inclusion or exclusion (respectively) of the PCRs. -   - ### Configure TPM platform validation profile for native UEFI firmware configurations - This policy setting determines what values the TPM measures when it validates early boot components before unlocking an operating system drive on a computer with native UEFI firmware configurations. - @@ -2350,65 +1848,36 @@ This policy setting determines what values the TPM measures when it validates ea
-   - **Reference** - This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker is already turned on with TPM protection. - **Important**   This Group Policy setting only applies to computers with a native UEFI firmware configuration. Computers with BIOS or UEFI firmware with a Compatibility Support Module (CSM) enabled store different values in the Platform Configuration Registers (PCRs). Use the **Configure TPM platform validation profile for BIOS-based firmware configurations** Group Policy setting to configure the TPM PCR profile for computers with BIOS configurations or for computers with UEFI firmware with a CSM enabled. -   - A platform validation profile consists of a set of Platform Configuration Register (PCR) indices ranging from 0 to 23. The default platform validation profile secures the encryption key against changes to the core system firmware executable code (PCR 0), extended or pluggable executable code (PCR 2), boot manager (PCR 4), and the BitLocker access control (PCR 11). - The following list identifies all of the PCRs available: - - PCR 0: Core System Firmware executable code - - PCR 1: Core System Firmware data - - PCR 2: Extended or pluggable executable code - - PCR 3: Extended or pluggable firmware data - - PCR 4: Boot Manager - - PCR 5: GPT/Partition Table - - PCR 6: Resume from S4 and S5 Power State Events - - PCR 7: Secure Boot State - For more information about this PCR, see [Platform Configuration Register (PCR)](#bkmk-pcr) in this topic. - - PCR 8: Initialized to 0 with no Extends (reserved for future use) - - PCR 9: Initialized to 0 with no Extends (reserved for future use) - - PCR 10: Initialized to 0 with no Extends (reserved for future use) - - PCR 11: BitLocker access control - - PCR 12: Data events and highly volatile events - - PCR 13: Boot Module Details - - PCR 14: Boot Authorities - - PCR 15 – 23: Reserved for future use - **Warning**   Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker's sensitivity to platform modifications (malicious or authorized) is increased or decreased depending on inclusion or exclusion (respectively) of the PCRs. -   - ### Reset platform validation data after BitLocker recovery - This policy setting determines if you want platform validation data to refresh when Windows is started following a BitLocker recovery. A platform validation data profile consists of the values in a set of Platform Configuration Register (PCR) indices that range from 0 to 23. - @@ -2449,17 +1918,11 @@ This policy setting determines if you want platform validation data to refresh w
-   - **Reference** - For more information about the recovery process, see the [BitLocker recovery guide](bitlocker-recovery-guide-plan.md). - ### Use enhanced Boot Configuration Data validation profile - This policy setting determines specific Boot Configuration Data (BCD) settings to verify during platform validation. A platform validation uses the data in the platform validation profile, which consists of a set of Platform Configuration Register (PCR) indices that range from 0 to 23. - @@ -2500,20 +1963,13 @@ This policy setting determines specific Boot Configuration Data (BCD) settings t
-   - **Reference** - **Note**   The setting that controls boot debugging (0x16000010) is always validated, and it has no effect if it is included in the inclusion or the exclusion list. -   - ### Allow access to BitLocker-protected fixed data drives from earlier versions of Windows - This policy setting is used to control whether access to drives is allowed by using the BitLocker To Go Reader, and if the application is installed on the drive. - @@ -2550,22 +2006,14 @@ This policy setting is used to control whether access to drives is allowed by us
-   - **Reference** - **Note**   This policy setting does not apply to drives that are formatted with the NTFS file system. -   - When this policy setting is enabled, select the **Do not install BitLocker To Go Reader on FAT formatted fixed drives** check box to help prevent users from running BitLocker To Go Reader from their fixed drives. If BitLocker To Go Reader (bitlockertogo.exe) is present on a drive that does not have an identification field specified, or if the drive has the same identification field as specified in the **Provide unique identifiers for your organization** policy setting, the user is prompted to update BitLocker, and BitLocker To Go Reader is deleted from the drive. In this situation, for the fixed drive to be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2, BitLocker To Go Reader must be installed on the computer. If this check box is not selected, BitLocker To Go Reader will be installed on the fixed drive to enable users to unlock the drive on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2. - ### Allow access to BitLocker-protected removable data drives from earlier versions of Windows - This policy setting controls access to removable data drives that are using the BitLocker To Go Reader and whether the BitLocker To Go Reader can be installed on the drive. - @@ -2602,23 +2050,14 @@ This policy setting controls access to removable data drives that are using the
-   - **Reference** - **Note**   This policy setting does not apply to drives that are formatted with the NTFS file system. -   - When this policy setting is enabled, select the **Do not install BitLocker To Go Reader on FAT formatted removable drives** check box to help prevent users from running BitLocker To Go Reader from their removable drives. If BitLocker To Go Reader (bitlockertogo.exe) is present on a drive that does not have an identification field specified, or if the drive has the same identification field as specified in the **Provide unique identifiers for your organization** policy setting, the user will be prompted to update BitLocker, and BitLocker To Go Reader is deleted from the drive. In this situation, for the removable drive to be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2, BitLocker To Go Reader must be installed on the computer. If this check box is not selected, BitLocker To Go Reader will be installed on the removable drive to enable users to unlock the drive on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2 that do not have BitLocker To Go Reader installed. - ## FIPS setting - - You can configure the Federal Information Processing Standard (FIPS) setting for FIPS compliance. As an effect of FIPS compliance, users cannot create or save a BitLocker password for recovery or as a key protector. The use of a recovery key is permitted. - @@ -2655,70 +2094,30 @@ You can configure the Federal Information Processing Standard (FIPS) setting for
-   - **Reference** - This policy needs to be enabled before any encryption key is generated for BitLocker. Note that when this policy is enabled, BitLocker prevents creating or using recovery passwords, so recovery keys should be used instead. - You can save the optional recovery key to a USB drive. Because recovery passwords cannot be saved to AD DS when FIPS is enabled, an error is caused if AD DS backup is required by Group Policy. - You can edit the FIPS setting by using the Security Policy Editor (Secpol.msc) or by editing the Windows registry. You must be an administrator to perform these procedures. - For more information about setting this policy, see [System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing](http://technet.microsoft.com/library/jj852197.aspx). - ## Power management Group Policy settings: Sleep and Hibernate - - PCs default power settings for a computer will cause the computer to enter Sleep mode frequently to conserve power when idle and to help extend the system’s battery life. When a computer transitions to Sleep, open programs and documents are persisted in memory. When a computer resumes from Sleep, users are not required to re-authenticate with a PIN or USB startup key to access encrypted data. This might lead to conditions where data security is compromised. - However, when a computer hibernates the drive is locked, and when it resumes from hibernation the drive is unlocked, which means that users will need to provide a PIN or a startup key if using multifactor authentication with BitLocker. Therefore, organizations that use BitLocker may want to use Hibernate instead of Sleep for improved security. This setting does not have an impact on TPM-only mode, because it provides a transparent user experience at startup and when resuming from the Hibernate states. - You can use disable the following Group Policy settings, which are located in **Computer Configuration\\Administrative Templates\\System\\Power Management** to disable all available sleep states: - - Allow Standby States (S1-S3) When Sleeping (Plugged In) - - Allow Standby States (S1-S3) When Sleeping (Battery) - ## About the Platform Configuration Register (PCR) - - A platform validation profile consists of a set of PCR indices that range from 0 to 23. The scope of the values can be specific to the version of the operating system. - Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker’s sensitivity to platform modifications (malicious or authorized) is increased or decreased depending on inclusion or exclusion (respectively) of the PCRs. - **About PCR 7** - PCR 7 measures the state of Secure Boot. With PCR 7, BitLocker can leverage Secure Boot for integrity validation. Secure Boot ensures that the computer's preboot environment loads only firmware that is digitally signed by authorized software publishers. PCR 7 measurements indicate whether Secure Boot is on and which keys are trusted on the platform. If Secure Boot is on and the firmware measures PCR 7 correctly per the UEFI specification, BitLocker can bind to this information rather than to PCRs 0, 2, and 4 which have the measurements of the exact firmware and Bootmgr images loaded. This reduces the likelihood of BitLocker starting in recovery mode as a result of firmware and image updates, and it provides you with greater flexibility to manage the preboot configuration. - PCR 7 measurements must follow the guidance that is described in [Appendix A Trusted Execution Environment EFI Protocol](http://msdn.microsoft.com/library/windows/hardware/jj923068.aspx). - PCR 7 measurements are a mandatory logo requirement for systems that support InstantGo (also known as Always On, Always Connected PCs), such as the Microsoft Surface RT. On such systems, if the TPM with PCR 7 measurement and Secure Boot are correctly configured, BitLocker binds to PCR 7 and PCR 11 by default. - ## See also - - [Trusted Platform Module](trusted-platform-module-overview.md) - - [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md) - - [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md) - - [BitLocker overview](bitlocker-overview.md) - - [Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md) - -   -   - - - - - diff --git a/windows/keep-secure/bitlocker-how-to-deploy-on-windows-server.md b/windows/keep-secure/bitlocker-how-to-deploy-on-windows-server.md index 0a0de22f5c..5c66b70012 100644 --- a/windows/keep-secure/bitlocker-how-to-deploy-on-windows-server.md +++ b/windows/keep-secure/bitlocker-how-to-deploy-on-windows-server.md @@ -2,155 +2,87 @@ title: BitLocker How to deploy on Windows Server 2012 and later (Windows 10) description: This topic for the IT professional explains how to deploy BitLocker and Windows Server 2012 and later. ms.assetid: 91c18e9e-6ab4-4607-8c75-d983bbe2542f +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # BitLocker: How to deploy on Windows Server 2012 and later - - **Applies to** - - Windows 10 - This topic for the IT professional explains how to deploy BitLocker and Windows Server 2012 and later. - For all Windows Server editions, BitLocker must be installed using Server Manager. However, you can still provision BitLocker before the server operating system is installed as part of your deployment. - ## Installing BitLocker - - BitLocker requires administrator privileges on the server to install. You can install BitLocker either by using Server Manager or Windows PowerShell cmdlets. - - To install BitLocker using Server Manager - - To install BitLocker using Windows PowerShell - ### To install BitLocker using Server Manager - 1. Open Server Manager by selecting the Server Manager icon or running servermanager.exe. - 2. Select **Manage** from the **Server Manager Navigation** bar and select **Add Roles and Features** to start the **Add Roles and Features Wizard.** - 3. With the **Add Roles and Features Wizard** open, select **Next** at the **Before you begin** pane (if shown). - 4. Select **Role-based or feature-based installation** on the **Installation type** pane of the **Add Roles and Features Wizard** pane and select **Next** to continue. - 5. Select the **Select a server from the server pool option** in the **Server Selection** pane and confirm the server for the BitLocker feature install. - 6. Server roles and features install using the same wizard in Server Manager. Select **Next** on the **Server Roles** pane of the **Add Roles and Features** wizard to proceed to the **Features** pane. - 7. Select the check box next to **BitLocker Drive Encryption** within the **Features** pane of the **Add Roles and Features Wizard**. The wizard will show the additional management features available for BitLocker. If you do not want to install these features, deselect the **Include management tools option** and select **Add Features**. Once optional features selection is complete, select **Next** to proceed in the wizard. - **Note**   The **Enhanced Storage** feature is a required feature for enabling BitLocker. This feature enables support for Encrypted Hard Drives on capable systems. -   - 8. Select **Install** on the **Confirmation** pane of the **Add Roles and Features Wizard** to begin BitLocker feature installation. The BitLocker feature requires a restart to complete. Selecting the **Restart the destination server automatically if required** option in the **Confirmation** pane will force a restart of the computer after installation is complete. - 9. If the **Restart the destination server automatically if required** check box is not selected, the **Results pane** of the **Add Roles and Features Wizard** will display the success or failure of the BitLocker feature installation. If required, a notification of additional action necessary to complete the feature installation, such as the restart of the computer, will be displayed in the results text. - ### To install BitLocker using Windows PowerShell - Windows PowerShell offers administrators another option for BitLocker feature installation. Windows PowerShell installs features using the `servermanager` or `dism` module; however, the `servermanager` and `dism` modules do not always share feature name parity. Because of this, it is advisable to confirm the feature or role name prior to installation. - **Note**   You must restart the server to complete the installation of BitLocker. -   - ### Using the servermanager module to install BitLocker - The `servermanager` Windows PowerShell module can use either the `Install-WindowsFeature` or `Add-WindowsFeature` to install the BitLocker feature. The `Add-WindowsFeature` cmdlet is merely a stub to the `Install-WindowsFeature`. This example uses the `Install-WindowsFeature` cmdlet. The feature name for BitLocker in the `servermanager` module is `BitLocker`. This can be determined using the `Get-WindowsFeature` cmdlet with a query such as: - ``` syntax Get-WindowsFeature Bit ``` - The results of this command displays a table of all of the feature names beginning with “Bit” as their prefix. This allows you to confirm that the feature name is `BitLocker` for the BitLocker feature. - By default, installation of features in Windows PowerShell does not include optional sub-features or management tools as part of the install process. This can be seen using the `-WhatIf` option in Windows PowerShell. - ``` syntax Install-WindowsFeature BitLocker -WhatIf ``` - The results of this command show that only the BitLocker Drive Encryption feature installs using this command. - To see what would be installed with the BitLocker feature including all available management tools and sub-features, use the following command: - ``` syntax Install-WindowsFeature BitLocker -IncludeAllSubFeature -IncludeManagementTools -WhatIf | fl ``` - The result of this command displays the following list of all the administration tools for BitLocker that would be installed along with the feature, including tools for use with Active Directory Domain Services (AD DS) and Active Directory Lightweight Directory Services (AD LDS). - - BitLocker Drive Encryption - - BitLocker Drive Encryption Tools - - BitLocker Drive Encryption Administration Utilities - - BitLocker Recovery Password Viewer - - AD DS Snap-Ins and Command-Line Tools - - AD DS Tools - - AD DS and AD LDS Tools - The command to complete a full installation of the BitLocker feature with all available features and then rebooting the server at completion is: - ``` syntax Install-WindowsFeature BitLocker -IncludeAllSubFeature -IncludeManagementTools -Restart ``` - **Important**   Installing the BitLocker feature using Windows PowerShell does not install the Enhanced Storage feature. Administrators wishing to support Encrypted Hard Drives in their environment will need to install the Enhanced Storage feature separately. -   - ### Using the dism module to install BitLocker - The `dism` Windows PowerShell module uses the `Enable-WindowsOptionalFeature` cmdlet to install features. The BitLocker feature name for BitLocker is `BitLocker`. The `dism` module does not support wildcards when searching for feature names. To list feature names for the `dism` module, use the `Get-WindowsOptionalFeatures` cmdlet. The following command will list all of the optional features in an online (running) operating system. - ``` syntax Get-WindowsOptionalFeature -Online | ft ``` - From this output, we can see that there are three BitLocker related optional feature names: BitLocker, BitLocker-Utilities and BitLocker-NetworkUnlock. To install the BitLocker feature, the BitLocker and BitLocker-Utilities features are the only required items. - To install BitLocker using the `dism` module, use the following command: - ``` syntax Enable-WindowsOptionalFeature -Online -FeatureName BitLocker -All ``` - This command will prompt the user for a reboot. The Enable-WindowsOptionalFeature cmdlet does not offer support for forcing a reboot of the computer. This command does not include installation of the management tools for BitLocker. For a complete installation of BitLocker and all available management tools, use the following command: - ``` syntax Enable-WindowsOptionalFeature -Online -FeatureName BitLocker, BitLocker-Utilities -All ``` - ## More information - - [BitLocker overview](bitlocker-overview.md) - [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md) - [Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md) - [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md) -   -   - - - - - diff --git a/windows/keep-secure/bitlocker-how-to-enable-network-unlock.md b/windows/keep-secure/bitlocker-how-to-enable-network-unlock.md index 20a2231f7e..c74d7c12a8 100644 --- a/windows/keep-secure/bitlocker-how-to-enable-network-unlock.md +++ b/windows/keep-secure/bitlocker-how-to-enable-network-unlock.md @@ -2,196 +2,106 @@ title: BitLocker How to enable Network Unlock (Windows 10) description: This topic for the IT professional describes how BitLocker Network Unlock works and how to configure it. ms.assetid: be45bc28-47db-4931-bfec-3c348151d2e9 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # BitLocker: How to enable Network Unlock - - **Applies to** - - Windows 10 - This topic for the IT professional describes how BitLocker Network Unlock works and how to configure it. - Network Unlock was introduced in Windows 8 and Windows Server 2012 as a BitLocker protector option for operating system volumes. Network Unlock enables easier management for BitLocker enabled desktops and servers in a domain environment by providing automatic unlock of operating system volumes at system reboot when connected to a wired corporate network. This feature requires the client hardware to have a DHCP driver implemented in its UEFI firmware. - Without Network Unlock, operating system volumes protected by TPM+PIN protectors require a PIN to be entered when a computer reboots or resumes from hibernation (for example, by Wake on LAN). This can make it difficult to enterprises to roll out software patches to unattended desktops and remotely administered servers. - Network Unlock allows BitLocker-enabled systems with TPM+PIN and that meet the hardware requirements to boot into Windows without user intervention. Network Unlock works in a similar fashion to the TPM+StartupKey at boot. Rather than needing to read the StartupKey from USB media, however, the key for Network Unlock is composed from a key stored in the TPM and an encrypted network key that is sent to the server, decrypted and returned to the client in a secure session. - This topic contains: - - [Network Unlock core requirements](#bkmk-nunlockcorereqs) - - [Network Unlock sequence](#bkmk-networkunlockseq) - - [Configure Network Unlock](#bkmk-configuringnetworkunlock) - - [Create the certificate template for Network Unlock](#bkmk-createcerttmpl) - - [Turning off Network Unlock](#bkmk-turnoffnetworkunlock) - - [Update Network Unlock certificates](#bkmk-updatecerts) - - [Troubleshoot Network Unlock](#bkmk-troubleshoot) - - [Configure Network Unlock on unsupported systems](#bkmk-unsupportedsystems) - ## Network Unlock core requirements - - Network Unlock must meet mandatory hardware and software requirements before the feature can automatically unlock domain joined systems. These requirements include: - - You must be running at least Windows 8 or Windows Server 2012. - - Any supported operating system with UEFI DHCP drivers can be Network Unlock clients. - - A server running the Windows Deployment Services (WDS) role on any supported server operating system. - - BitLocker Network Unlock optional feature installed on any supported server operating system. - - A DHCP server, separate from the WDS server. - - Properly configured public/private key pairing. - - Network Unlock Group Policy settings configured. - The network stack must be enabled to use the Network Unlock feature. Equipment manufacturers deliver their products in various states and with different BIOS menus, so you need to confirm that the network stack has been enabled in the BIOS before starting the computer. - **Note**   To properly support DHCP within UEFI, the UEFI-based system should be in native mode without a compatibility support module (CSM) enabled. - For Network Unlock to work reliably on computers running Windows 8 and later, the first network adapter on the computer, usually the onboard adapter, must be configured to support DHCP and used for Network Unlock. This is especially worth noting when you have multiple adapters, and you wish to configure one without DHCP, such as for a lights-out management protocol. This configuration is necessary because Network Unlock will stop enumerating adapters when it reaches one with a DHCP port failure for any reason. Thus, if the first enumerated adapter does not support DHCP, is not plugged into the network, or fails to report availability of the DHCP port for any reason, then Network Unlock will fail. -   - The Network Unlock server component installs on supported versions of Windows Server 2012 and later as a Windows feature using Server Manager or Windows PowerShell cmdlets. The feature name is BitLocker Network Unlock in Server Manager and BitLocker-NetworkUnlock in Windows PowerShell. This feature is a core requirement. - Network Unlock requires Windows Deployment Services (WDS) in the environment where the feature will be utilized. Configuration of the WDS installation is not required; however, the WDS service needs to be running on the server. - The network key is stored on the system drive along with an AES 256 session key, and encrypted with the 2048-bit RSA public key of the unlock server's certificate. The network key is decrypted with the help of a provider on a supported version of Windows Server running WDS, and returned encrypted with its corresponding session key. - ## Network Unlock sequence - - The unlock sequence starts on the client side, when the Windows boot manager detects the existence of Network Unlock protector. It leverages the DHCP driver in UEFI to obtain an IP address for IPv4 and then broadcasts a vendor-specific DHCP request that contains the network key and a session key for the reply, all encrypted by the server's Network Unlock certificate, as described above. The Network Unlock provider on the supported WDS server recognizes the vendor-specific request, decrypts it with the RSA private key, and returns the network key encrypted with the session key via its own vendor-specific DHCP reply. - On the server side, the WDS server role has an optional plugin component, like a PXE provider, which is what handles the incoming Network Unlock requests. The provider can also be configured with subnet restrictions, which would require that the IP address provided by the client in the Network Unlock request belong to a permitted subnet in order to release the network key to the client. In instances where the Network Unlock provider is unavailable, BitLocker fails over to the next available protector to unlock the drive. In a typical configuration, this means the standard TPM+PIN unlock screen is presented to unlock the drive. - The server side configuration to enable Network Unlock also requires provisioning a 2048-bit RSA public/private key pair in the form of an X.509 certificate, and for the public key certificate to be distributed to the clients. This certificate must be managed and deployed through the Group Policy editor directly on a domain controller with at least a Domain Functional Level of Windows Server 2012. This certificate is the public key that encrypts the intermediate network key (which is one of the two secrets required to unlock the drive; the other secret is stored in the TPM). - ![bitlocker network unlock sequence](images/bitlockernetworkunlocksequence.png) - **Phases in the Network Unlock process** - 1. The Windows boot manager detects that a Network Unlock protector exists in the BitLocker configuration. - 2. The client computer uses its DHCP driver in the UEFI to obtain a valid IPv4 IP address. - 3. The client computer broadcasts a vendor-specific DHCP request that contains the Network Key (a 256-bit intermediate key) and an AES-256 session key for the reply. Both of these keys are encrypted using the 2048-bit RSA Public Key of the Network Unlock certificate from the WDS server. - 4. The Network Unlock provider on the WDS server recognizes the vendor-specific request. - 5. The provider decrypts it with the WDS server’s BitLocker Network Unlock certificate RSA private key. - 6. The WDS provider then returns the network key encrypted with the session key using its own vendor-specific DHCP reply to the client computer. This forms an intermediate key. - 7. The returned intermediate key is then combined with another local 256-bit intermediate key that can only be decrypted by the TPM. - 8. This combined key is used to create an AES-256 key that unlocks the volume. - 9. Windows continues the boot sequence. - ## Configure Network Unlock - - The following steps allow an administrator to configure Network Unlock in a domain where the Domain Functional Level is at least Windows Server 2012. - ### Step One: Install the WDS Server role - The BitLocker Network Unlock feature will install the WDS role if it is not already installed. If you want to install it separately before you install BitLocker Network Unlock you can use Server Manager or Windows PowerShell. To install the role using Server Manager, select the **Windows Deployment Services** role in Server Manager. - To install the role using Windows PowerShell, use the following command: - ``` syntax Install-WindowsFeature WDS-Deployment ``` - You must configure the WDS server so that it can communicate with DHCP (and optionally Active Directory Doman Services) and the client computer. You can do using the WDS management tool, wdsmgmt.msc, which starts the Windows Deployment Services Configuration Wizard. - ### Step Two: Confirm the WDS Service is running - To confirm the WDS service is running, use the Services Management Console or Windows PowerShell. To confirm the service is running in Services Management Console, open the console using **services.msc** and check the status of the Windows Deployment Services service. - To confirm the service is running using Windows PowerShell, use the following command: - ``` syntax Get-Service WDSServer ``` - ### Step Three: Install the Network Unlock feature - To install the Network Unlock feature, use Server Manager or Windows PowerShell. To install the feature using Server Manager, select the **BitLocker Network Unlock** feature in the Server Manager console. - To install the feature using Windows PowerShell, use the following command: - ``` syntax Install-WindowsFeature BitLocker-NetworkUnlock ``` - ### Step Four: Create the Network Unlock certificate - Network Unlock can use imported certificates from an existing PKI infrastructure, or you can use a self-signed certificate. - To enroll a certificate from an existing certification authority (CA), do the following: - 1. Open Certificate Manager on the WDS server using **certmgr.msc** - 2. Under the Certificates - Current User item, right-click Personal - 3. Select All Tasks, then **Request New Certificate** - 4. Select **Next** when the Certificate Enrollment wizard opens - 5. Select Active Directory Enrollment Policy - 6. Choose the certificate template created for Network Unlock on the Domain controller and select **Enroll**. When prompted for more information, add the following attribute to the certificate: - - Select the **Subject Name** pane and provide a friendly name value. It is suggested that this friendly name include information for the domain or organizational unit for the certificate. For example "BitLocker Network Unlock Certificate for Contoso domain" - 7. Create the certificate. Ensure the certificate appears in the Personal folder. - 8. Export the public key certificate for Network Unlock - 1. Create a .cer file by right-clicking the previously created certificate, choosing **All Tasks**, then **Export**. - 2. Select **No, do not export the private key**. - 3. Select **DER encoded binary X.509** and complete exporting the certificate to a file. - 4. Give the file a name such as BitLocker-NetworkUnlock.cer. - 9. Export the public key with a private key for Network Unlock - 1. Create a .pfx file by right-clicking the previously created certificate, choosing **All Tasks**, then **Export**. - 2. Select **Yes, export the private key**. - 3. Complete the wizard to create the .pfx file. - To create a self-signed certificate, do the following: - 1. Create a text file with an .inf extension. For example, notepad.exe BitLocker-NetworkUnlock.inf - 2. Add the following contents to the previously created file: - ``` syntax [NewRequest] - Subject="CN=BitLocker Network Unlock certificate" Exportable=true RequestType=Cert @@ -201,141 +111,77 @@ To create a self-signed certificate, do the following: Keyspec="AT_KEYEXCHANGE" SMIME=FALSE HashAlgorithm=sha512 - [Extensions] 1.3.6.1.4.1.311.21.10 = "{text}" _continue_ = "OID=1.3.6.1.4.1.311.67.1.1" - 2.5.29.37 = "{text}" _continue_ = "1.3.6.1.4.1.311.67.1.1" ``` - 3. Open an elevated command prompt and use the certreq tool to create a new certificate using the following command, specifying the full path to the file created previously, along with the file name: - ``` syntax certreq -new BitLocker-NetworkUnlock.inf BitLocker-NetworkUnlock.cer ``` - 4. Verify the previous command properly created the certificate by confirming the .cer file exists - 5. Launch the Certificate Manager by running **certmgr.msc** - 6. Create a .pfx file by opening the **Certificates – Current User\\Personal\\Certificates** path in the navigation pane, right-clicking the previously imported certificate, selecting **All Tasks**, then **Export**. Follow through the wizard to create the .pfx file. - ### Step Five: Deploy the private key and certificate to the WDS server - With the certificate and key created, deploy them to the infrastructure to properly unlock systems. To deploy the certificates, do the following: - 1. On the WDS server, open a new MMC and add the certificates snap-in. Select the computer account and local computer when given the options. - 2. Right-click the Certificates (Local Computer) - BitLocker Drive Encryption Network Unlock item, choose All Tasks, then **Import** - 3. In the **File to Import** dialog, choose the .pfx file created previously. - 4. Enter the password used to create the .pfx and complete the wizard. - ### Step Six: Configure Group Policy settings for Network Unlock - With certificate and key deployed to the WDS server for Network Unlock, the final step is to use Group Policy settings to deploy the public key certificate to computers that you want to be able to unlock using the Network Unlock key. Group Policy settings for BitLocker can be found under **\\Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption** using the Local Group Policy Editor or the Microsoft Management Console. - The following steps describe how to enable the Group Policy setting that is a requirement for configuring Network Unlock. - 1. Open Group Policy Management Console (gpmc.msc) - 2. Enable the policy **Require additional authentication at startup** and select the **Require startup PIN with TPM** option - 3. Turn on BitLocker with TPM+PIN protectors on all domain-joined computers - The following steps describe how to deploy the required Group Policy setting: - **Note**   The Group Policy settings **Allow network unlock at startup** and **Add Network Unlock Certificate** were introduced in Windows Server 2012. -   - 1. Copy the .cer file created for Network Unlock to the domain controller - 2. On the domain controller, launch Group Policy Management Console (gpmc.msc) - 3. Create a new Group Policy Object or modify an existing object to enable the **Allow network unlock at startup** setting. - 4. Deploy the public certificate to clients - 1. Within Group Policy Management Console, navigate to the following location: **Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Public Key Policies\\BitLocker Drive Encryption Network Unlock Certificate** - 2. Right-click the folder and choose **Add Network Unlock Certificate** - 3. Follow the wizard steps and import the .cer file that was copied earlier. - **Note**   Only one network unlock certificate can be available at a time. If a new certificate is required, delete the current certificate before deploying a new one. The Network Unlock certificate is located in the **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\FVE\_NKP** key on the client computer. -   - ### Step Seven: Require TPM+PIN protectors at startup - An additional step is for enterprises to use TPM+PIN protectors for an extra level of security. To require TPM+PIN protectors in an environment, do the following: - 1. Open Group Policy Management Console (gpmc.msc) - 2. Enable the policy **Require additional authentication at startup** and select the **Require startup PIN with TPM** option - 3. Turn on BitLocker with TPM+PIN protectors on all domain-joined computers - ### Create the certificate template for Network Unlock - The following steps detail how to create a certificate template for use with BitLocker Network Unlock. A properly configured Active Directory Services Certification Authority can use this certificate to create and issue Network Unlock certificates. - 1. Open the Certificates Template snap-in (certtmpl.msc). - 2. Locate the User template. Right-click the template name and select **Duplicate Template** - 3. On the **Compatibility** tab, change the **Certification Authority** and **Certificate recipient** fields to Windows Server 2012 and Windows 8respectively. Ensure the **Show resulting changes** dialog box is selected. - 4. Select the **General** tab of the template. The **Template display name** and **Template name** should clearly identify that the template will be used for Network Unlock. Clear the checkbox for the **Publish certificate in Active Directory** option. - 5. Select the **Request Handling** tab. Select **Encryption** from the **Purpose** drop down menu. Ensure the **Allow private key to be exported** option is selected. - 6. Select the **Cryptography** tab. Set the **Minimum key size** to 2048. (Any Microsoft cryptographic provider that supports RSA can be used for this template, but for simplicity and forward compatibility we recommend using the **Microsoft Software Key Storage Provider**.) - 7. Select the **Requests must use one of the following providers** option and clear all options except for the cryptography provider you selected, such as the **Microsoft Software Key Storage Provider**. - 8. Select the **Subject Name** tab. Select **Supply in the request**. Select **OK** if the certificate templates pop-up dialog appears. - 9. Select the **Issuance Requirements** tab. Select both **CA certificate manager approval** and **Valid existing certificate** options. - 10. Select the **Extensions** tab. Select **Application Policies** and choose **Edit…**. - 11. In the **Edit Application Policies Extension** options dialog box, select **Client Authentication**, **Encrypting File System**, **and Secure Email** and choose **Remove**. - 12. On the **Edit Application Policies Extension** dialog box, select **Add**. - 13. On the **Add Application Policy** dialog box, select **New**. In the **New Application Policy** dialog box enter the following information in the space provided and then click **OK** to create the BitLocker Network Unlock application policy: - - **Name:** **BitLocker Network Unlock** - - **Object Identifier:** **1.3.6.1.4.1.311.67.1.1** - 14. Select the newly created **BitLocker Network Unlock** application policy and select **OK** - 15. With the **Extensions** tab still open, select the **Edit Key Usage Extension** dialog, select the **Allow key exchange only with key encryption (key encipherment)** option. Select the **Make this extension critical** option. - 16. Select the **Security** tab. Confirm that the **Domain Admins** group has been granted **Enroll** permission - 17. Select **OK** to complete configuration of the template. - To add the Network Unlock template to the Certification Authority, open the Certification Authority snap-in (certsrv.msc). Right-click the **Certificate Templates** item and choose **New, Certificate Template to issue**. Select the previously created BitLocker Network Unlock certificate. - After adding the Network Unlock template to the Certification Authority, this certificate can be used to configure BitLocker Network Unlock. - ### Subnet policy configuration files on WDS Server (Optional) - By default, all clients with the correct Network Unlock Certificate and valid Network Unlock protectors that have wired access to a Network Unlock-enabled WDS server via DHCP are unlocked by the server. A subnet policy configuration file on the WDS server can be created to limit which subnet(s) Network Unlock clients can use to unlock. - The configuration file, called bde-network-unlock.ini, must be located in the same directory as the Network Unlock provider DLL and it applies to both IPv6 and IPv4 DHCP implementations. If the subnet configuration policy becomes corrupted, the provider will fail and stop responding to requests. - The subnet policy configuration file must use a “\[SUBNETS\]” section to identify the specific subnets. The named subnets may then be used to specify restrictions in certificate subsections. Subnets are defined as simple name-value pairs, in the common INI format, where each subnet has its own line, with the name on the left of the equals sign, and the subnet identified on the right of the equal sign as a Classless Inter-Domain Routing (CIDR) address or range. The key word “ENABLED” is disallowed for subnet names. - ``` syntax [SUBNETS] SUBNET1=10.185.250.0/24 ; comment about this subrange could be here, after the semi-colon @@ -343,18 +189,12 @@ SUBNET2=10.185.252.200/28 SUBNET3= 2001:4898:a:2::/64 ; an IPv6 subnet SUBNET4=2001:4898:a:3::/64; in production, the admin would likely give more useful names, like BUILDING9-EXCEPT-RECEP. ``` - Following the \[SUBNETS\] section, there can be sections for each Network Unlock certificate, identified by the certificate thumbprint formatted without any spaces, which define subnets clients can be unlocked from with that certificate. - **Note**   When specifying the certificate thumbprint, do not include any spaces. If spaces are included in the thumbprint the subnet configuration will fail because the thumbprint will not be recognized as valid. -   - Subnet restrictions are defined within each certificate section by denoting the allowed list of permitted subnets. If any subnet is listed in a certificate section, then only those subnets listed are permitted for that certificate. If no subnet is listed in a certificate section, then all subnets are permitted for that certificate. If a certificate does not have a section in the subnet policy configuration file, then no subnet restrictions are applied for unlocking with that certificate. This means for restrictions to apply to every certificate, there must be a certificate section for every Network Unlock certificate on the server, and an explicit allowed list set for each certificate section. - Subnet lists are created by putting the name of a subnet from the \[SUBNETS\] section on its own line below the certificate section header. Then, the server will only unlock clients with this certificate on the subnet(s) specified as in the list. For troubleshooting, a subnet can be quickly excluded without deleting it from the section by simply commenting it out with a prepended semi-colon. - ``` syntax [‎2158a767e1c14e88e27a4c0aee111d2de2eafe60] ;Comments could be added here to indicate when the cert was issued, which Group Policy should get it, and so on. @@ -363,102 +203,56 @@ SUBNET1 ;SUBNET2 SUBNET3 ``` - To disallow the use of a certificate altogether, its subnet list may contain the line “DISABLED". - ### Turning off Network Unlock - To turn off the unlock server, the PXE provider can be unregistered from the WDS server or uninstalled altogether. However, to stop clients from creating Network Unlock protectors the **Allow Network Unlock at startup** Group Policy setting should be disabled. When this policy setting is updated to disabled on client computers any Network Unlock key protectors on the computer will be deleted. Alternatively, the BitLocker Network Unlock certificate policy can be deleted on the domain controller to accomplish the same task for an entire domain. - **Note**   Removing the FVENKP certificate store that contains the Network Unlock certificate and key on the WDS server will also effectively disable the server’s ability to respond to unlock requests for that certificate. However, this is seen as an error condition and is not a supported or recommended method for turning off the Network Unlock server. -   - ### Update Network Unlock certificates - To update the certificates used by Network Unlock, administrators need to import or generate the new certificate for the server and then update the Network Unlock certificate Group Policy setting on the domain controller. - ## Troubleshoot Network Unlock - - Troubleshooting Network Unlock issues begins by verifying the environment. Many times, a small configuration issue will be the root cause of the failure. Items to verify include: - - Verify client hardware is UEFI-based and is on firmware version is 2.3.1 and that the UEFI firmware is in native mode without a Compatibility Support Module (CSM) for BIOS mode enabled. Do this by checking that the firmware does not have an option enabled such as "Legacy mode" or "Compatibility mode" or that the firmware does not appear to be in a BIOS-like mode. - - All required roles and services are installed and started - - Public and private certificates have been published and are in the proper certificate containers. The presence of the Network Unlock certificate can be verified in the Microsoft Management Console (MMC.exe) on the WDS server with the certificate snap-ins for the local computer enabled. The client certificate can be verified by checking the registry key **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\FVE\_NKP** on the client computer. - - Group policy for Network Unlock is enabled and linked to the appropriate domains - - Verify group policy is reaching the clients properly. This can be done using the GPRESULT.exe or RSOP.msc utilities. - - Verify the **Network (Certificate Based)** protector is listed on the client. This can be done using either manage-bde or Windows PowerShell cmdlets. For example the following command will list the key protectors currently configured on the C: drive of the lcoal computer: - ``` syntax Manage-bde –protectors –get C: ``` - **Note**   Use the output of manage-bde along with the WDS debug log to determine if the proper certificate thumbprint is being used for Network Unlock -   - Files to gather when troubleshooting BitLocker Network Unlock include: - 1. The Windows event logs. Specifically the BitLocker event logs and the Microsoft-Windows-Deployment-Services-Diagnostics-Debug log - Debug logging is turned off by default for the WDS server role, so you will need to enable it first. You can use either of the following two methods to turn on WDS debug logging. - 1. Start an elevated command prompt and run the following command: - ``` syntax wevtutil sl Microsoft-Windows-Deployment-Services-Diagnostics/Debug /e:true ``` - 2. Open Event Viewer on the WDS server. - In the left pane, click **Applications and Services Logs**, click **Microsoft**, click **Windows**, click **Deployment-Services-Diagnostics**, and then click **Debug**. - In the right pane, click **Enable Log**. - 2. The DHCP subnet configuration file (if one exists). - 3. The output of the BitLocker status on the volume, this can be gathered into a text file using **manage-bde -status** or **Get-BitLockerVolume** in Windows PowerShell - 4. Network Monitor capture on the server hosting the WDS role, filtered by client IP address - ## Configure Network Unlock Group Policy settings on earlier versions - - Network Unlock and the accompanying Group Policy settings were introduced in Windows Server 2012 but can be deployed using operating systems running Windows Server 2008 R2 and Windows Server 2008. - **Requirements** - - The server hosting WDS must be running any of the server operating systems designated in the **Applies To** list at the beginning of this topic. - - Client computers must be running any of the client operating systems designated in the **Applies To** list at the beginning of this topic. - The following steps can be used to configure Network Unlock on these older systems. - 1. [Step One: Install the WDS Server role](#bkmk-stepone) - 2. [Step Two: Confirm the WDS Service is running](#bkmk-steptwo) - 3. [Step Three: Install the Network Unlock feature](#bkmk-stepthree) - 4. [Step Four: Create the Network Unlock certificate](#bkmk-stepfour) - 5. [Step Five: Deploy the private key and certificate to the WDS server](#bkmk-stepfive) - 6. **Step Six: Configure registry settings for Network Unlock** - Apply the registry settings by running the following certutil script on each computer running any of the client operating systems designated in the **Applies To** list at the beginning of this topic. - ``` syntax certutil -f -grouppolicy -addstore FVE_NKP BitLocker-NetworkUnlock.cer - reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v OSManageNKP /t REG_DWORD /d 1 /f reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseAdvancedStartup /t REG_DWORD /d 1 /f reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UsePIN /t REG_DWORD /d 2 /f @@ -467,29 +261,13 @@ The following steps can be used to configure Network Unlock on these older syste reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMKey /t REG_DWORD /d 2 /f reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMKeyPIN /t REG_DWORD /d 2 /f ``` - 7. [Create the Network Unlock certificate](#bkmk-stepfour) - 8. [Deploy the private key and certificate to the WDS server](#bkmk-stepfive) - 9. [Create the certificate template for Network Unlock](#bkmk-createcerttmpl) - 10. [Require TPM+PIN protectors at startup](#bkmk-stepseven) - ## See also - - - [BitLocker overview](bitlocker-overview.md) - - [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md) - - [Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md) -   -   - - - - - diff --git a/windows/keep-secure/bitlocker-overview.md b/windows/keep-secure/bitlocker-overview.md index 80f734fc4e..66039b8143 100644 --- a/windows/keep-secure/bitlocker-overview.md +++ b/windows/keep-secure/bitlocker-overview.md @@ -2,76 +2,41 @@ title: BitLocker (Windows 10) description: This topic provides a high-level overview of BitLocker, including a list of system requirements, practical applications, and deprecated features. ms.assetid: 40526fcc-3e0d-4d75-90e0-c7d0615f33b2 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # BitLocker - - **Applies to** - - Windows 10 - This topic provides a high-level overview of BitLocker, including a list of system requirements, practical applications, and deprecated features. - ## - - BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned computers. - BitLocker provides the most protection when used with a Trusted Platform Module (TPM) version 1.2 or later. The TPM is a hardware component installed in many newer computers by the computer manufacturers. It works with BitLocker to help protect user data and to ensure that a computer has not been tampered with while the system was offline. - On computers that do not have a TPM version 1.2 or later, you can still use BitLocker to encrypt the Windows operating system drive. However, this implementation will require the user to insert a USB startup key to start the computer or resume from hibernation. Starting with Windows 8, you can use an operating system volume password to protect the operating system volume on a computer without TPM. Both options do not provide the pre-startup system integrity verification offered by BitLocker with a TPM. - In addition to the TPM, BitLocker offers the option to lock the normal startup process until the user supplies a personal identification number (PIN) or inserts a removable device, such as a USB flash drive, that contains a startup key. These additional security measures provide multifactor authentication and assurance that the computer will not start or resume from hibernation until the correct PIN or startup key is presented. - ## Practical applications - - Data on a lost or stolen computer is vulnerable to unauthorized access, either by running a software-attack tool against it or by transferring the computer's hard disk to a different computer. BitLocker helps mitigate unauthorized data access by enhancing file and system protections. BitLocker also helps render data inaccessible when BitLocker-protected computers are decommissioned or recycled. - There are two additional tools in the Remote Server Administration Tools, which you can use to manage BitLocker. - - **BitLocker Recovery Password Viewer**. The BitLocker Recovery Password Viewer enables you to locate and view BitLocker Drive Encryption recovery passwords that have been backed up to Active Directory Domain Services (AD DS). You can use this tool to help recover data that is stored on a drive that has been encrypted by using BitLocker. The BitLocker Recovery Password Viewer tool is an extension for the Active Directory Users and Computers Microsoft Management Console (MMC) snap-in. - By using this tool, you can examine a computer object's **Properties** dialog box to view the corresponding BitLocker recovery passwords. Additionally, you can right-click a domain container and then search for a BitLocker recovery password across all the domains in the Active Directory forest. To view recovery passwords, you must be a domain administrator, or you must have been delegated permissions by a domain administrator. - - **BitLocker Drive Encryption Tools**. BitLocker Drive Encryption Tools include the command-line tools, manage-bde and repair-bde, and the BitLocker cmdlets for Windows PowerShell. Both manage-bde and the BitLocker cmdlets can be used to perform any task that can be accomplished through the BitLocker control panel, and they are appropriate to use for automated deployments and other scripting scenarios. Repair-bde is provided for disaster recovery scenarios in which a BitLocker protected drive cannot be unlocked normally or by using the recovery console. - ## New and changed functionality - - To find out what's new in BitLocker for Windows 10, see [What's new in BitLocker?](../whats-new/bitlocker.md) -   - ## System requirements - - BitLocker has the following hardware requirements: - For BitLocker to use the system integrity check provided by a Trusted Platform Module (TPM), the computer must have TPM 1.2 or later. If your computer does not have a TPM, enabling BitLocker requires that you save a startup key on a removable device, such as a USB flash drive. - A computer with a TPM must also have a Trusted Computing Group (TCG)-compliant BIOS or UEFI firmware. The BIOS or UEFI firmware establishes a chain of trust for the pre-operating system startup, and it must include support for TCG-specified Static Root of Trust Measurement. A computer without a TPM does not require TCG-compliant firmware. - The system BIOS or UEFI firmware (for TPM and non-TPM computers) must support the USB mass storage device class, including reading small files on a USB flash drive in the pre-operating system environment. - The hard disk must be partitioned with at least two drives: - - The operating system drive (or boot drive) contains the operating system and its support files. It must be formatted with the NTFS file system. - - The system drive contains the files that are needed to load Windows after the firmware has prepared the system hardware. BitLocker is not enabled on this drive. For BitLocker to work, the system drive must not be encrypted, must differ from the operating system drive, and must be formatted with the FAT32 file system on computers that use UEFI-based firmware or with the NTFS file system on computers that use BIOS firmware. We recommend that system drive be approximately 350 MB in size. After BitLocker is turned on it should have approximately 250 MB of free space. - When installed on a new computer, Windows will automatically create the partitions that are required for BitLocker. - When installing the BitLocker optional component on a server you will also need to install the Enhanced Storage feature, which is used to support hardware encrypted drives. - ## In this section - - @@ -134,14 +99,6 @@ When installing the BitLocker optional component on a server you will also need
-   -   -   - - - - - diff --git a/windows/keep-secure/bitlocker-recovery-guide-plan.md b/windows/keep-secure/bitlocker-recovery-guide-plan.md index 31c4fb595f..ef750b5769 100644 --- a/windows/keep-secure/bitlocker-recovery-guide-plan.md +++ b/windows/keep-secure/bitlocker-recovery-guide-plan.md @@ -2,438 +2,234 @@ title: BitLocker recovery guide (Windows 10) description: This topic for IT professionals describes how to recover BitLocker keys from AD DS. ms.assetid: d0f722e9-1773-40bf-8456-63ee7a95ea14 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # BitLocker recovery guide - - **Applies to** - - Windows 10 - This topic for IT professionals describes how to recover BitLocker keys from AD DS. - Organizations can use BitLocker recovery information saved in Active Directory Domain Services (AD DS) to access BitLocker-protected data. Creating a recovery model for BitLocker while you are planning your BitLocker deployment is recommended. - This article assumes that you understand how to set up AD DS to back up BitLocker recovery information automatically, and what types of recovery information are saved to AD DS. - This article does not detail how to configure AD DS to store the BitLocker recovery information. - This article contains the following topics: - - [What Is BitLocker Recovery?](#bkmk-whatisrecovery) - - [Testing Recovery](#bkmk-testingrecovery) - - [Planning Your Recovery Process](#bkmk-planningrecovery) - - [Using Additional Recovery Information](#bkmk-usingaddrecovery) - - [Resetting Recovery Passwords](#bkmk-appendixb) - - [Retrieving the BitLocker Key Package](#bkmk-appendixc) - ## What is BitLocker recovery? - - BitLocker recovery is the process by which you can restore access to a BitLocker-protected drive in the event that you cannot unlock the drive normally. In a recovery scenario you have the following options to restore access to the drive: - - The user can supply the recovery password. If your organization allows users to print or store recovery passwords, the user can type in the 48-digit recovery password that they printed or stored on a USB drive or with your Microsoft Account online. (Saving a recovery password with your Microsoft Account online is only allowed when BitLocker is used on a PC that is not a member of a domain). - - A data recovery agent can use their credentials to unlock the drive. If the drive is an operating system drive, the drive must be mounted as a data drive on another computer for the data recovery agent to unlock it. - - A domain administrator can obtain the recovery password from AD DS and use it to unlock the drive. Storing recovery passwords in AD DS is recommended to provide a way for IT professionals to be able to obtain recovery passwords for drives in their organization if needed. This method requires that you have enabled this recovery method in the BitLocker Group Policy setting **Choose how BitLocker-protected operating system drives can be recovered** located at **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption\\Operating System Drives** in the Local Group Policy Editor. For more information, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). - ### What causes BitLocker recovery? - The following list provides examples of specific events that will cause BitLocker to enter recovery mode when attempting to start the operating system drive: - - On PCs that use either BitLocker or Device Encryption when an attack is detected the device will immediately reboot and enter into BitLocker recovery mode. To take advantage of this functionality Administrators can set the **Interactive logon: Machine account lockout threshold** Group Policy setting located in **\\Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** in the Local Group Policy Editor, or use the **MaxFailedPasswordAttempts** policy of [Exchange ActiveSync](http://technet.microsoft.com/library/aa998357.aspx) (also configurable through [Windows Intune](http://technet.microsoft.com/library/jj733621.aspx)), to limit the number of failed password attempts before the device goes into Device Lockout. - - Changing the boot order to boot another drive in advance of the hard drive. - - Having the CD or DVD drive before the hard drive in the BIOS boot order and then inserting or removing a CD or DVD. - - Failing to boot from a network drive before booting from the hard drive. - - Docking or undocking a portable computer. In some instances (depending on the computer manufacturer and the BIOS), the docking condition of the portable computer is part of the system measurement and must be consistent to validate the system status and unlock BitLocker. This means that if a portable computer is connected to its docking station when BitLocker is turned on, then it might also need to be connected to the docking station when it is unlocked. Conversely, if a portable computer is not connected to its docking station when BitLocker is turned on, then it might need to be disconnected from the docking station when it is unlocked. - - Changes to the NTFS partition table on the disk including creating, deleting, or resizing a primary partition. - - Entering the personal identification number (PIN) incorrectly too many times so that the anti-hammering logic of the TPM is activated. Anti-hammering logic is software or hardware methods that increase the difficulty and cost of a brute force attack on a PIN by not accepting PIN entries until after a certain amount of time has passed. - - Turning off the support for reading the USB device in the pre-boot environment from the BIOS or UEFI firmware if you are using USB-based keys instead of a TPM. - - Turning off, disabling, deactivating, or clearing the TPM. - - Upgrading critical early startup components, such as a BIOS or UEFI firmware upgrade, causing the related boot measurements to change. - - Forgetting the PIN when PIN authentication has been enabled. - - Updating option ROM firmware. - - Upgrading TPM firmware. - - Adding or removing hardware; for example, inserting a new card in the computer, including some PCMIA wireless cards. - - Removing, inserting, or completely depleting the charge on a smart battery on a portable computer. - - Changes to the master boot record on the disk. - - Changes to the boot manager on the disk. - - Hiding the TPM from the operating system. Some BIOS or UEFI settings can be used to prevent the enumeration of the TPM to the operating system. When implemented, this option can make the TPM hidden from the operating system. When the TPM is hidden, BIOS and UEFI secure startup are disabled, and the TPM does not respond to commands from any software. - - Using a different keyboard that does not correctly enter the PIN or whose keyboard map does not match the keyboard map assumed by the pre-boot environment. This can prevent the entry of enhanced PINs. - - Modifying the Platform Configuration Registers (PCRs) used by the TPM validation profile. For example, including **PCR\[1\]** would result in BitLocker measuring most changes to BIOS settings, causing BitLocker to enter recovery mode even when non-boot critical BIOS settings change. - **Note**   Some computers have BIOS settings that skip measurements to certain PCRs, such as **PCR\[2\]**. Changing this setting in the BIOS would cause BitLocker to enter recovery mode because the PCR measurement will be different. -   - - Moving the BitLocker-protected drive into a new computer. - - Upgrading the motherboard to a new one with a new TPM. - - Losing the USB flash drive containing the startup key when startup key authentication has been enabled. - - Failing the TPM self-test. - - Having a BIOS, UEFI firmware, or an option ROM component that is not compliant with the relevant Trusted Computing Group standards for a client computer. For example, a non-compliant implementation may record volatile data (such as time) in the TPM measurements, causing different measurements on each startup and causing BitLocker to start in recovery mode. - - Changing the usage authorization for the storage root key of the TPM to a non-zero value. - **Note**   The BitLocker TPM initialization process sets the usage authorization value to zero, so another user or process must explicitly have changed this value. -   - - Disabling the code integrity check or enabling test signing on Windows Boot Manager (Bootmgr). - - Pressing the F8 or F10 key during the boot process. - - Adding or removing add-in cards (such as video or network cards), or upgrading firmware on add-in cards. - - Using a BIOS hot key during the boot process to change the boot order to something other than the hard drive. - **Note**   Before you begin recovery, we recommend that you determine what caused recovery. This might help prevent the problem from occurring again in the future. For instance, if you determine that an attacker has modified your computer by obtaining physical access, you can create new security policies for tracking who has physical presence. After the recovery password has been used to recover access to the PC, BitLocker will reseal the encryption key to the current values of the measured components. -   - For planned scenarios, such as a known hardware or firmware upgrades, you can avoid initiating recovery by temporarily suspending BitLocker protection. Because suspending BitLocker leaves the drive fully encrypted, the administrator can quickly resume BitLocker protection after the planned task has been completed. Using suspend and resume also reseals the encryption key without requiring the entry of the recovery key. - **Note**   If suspended BitLocker will automatically resume protection when the PC is rebooted, unless a reboot count is specified using the manage-bde command line tool. - If software maintenance requires the computer be restarted and you are using two-factor authentication, you can enable BitLocker Network Unlock to provide the secondary authentication factor when the computers do not have an on-premise user to provide the additional authentication method. -   - Recovery has been described within the context of unplanned or undesired behavior, but you can also cause recovery as an intended production scenario, in order to manage access control. For example, when you redeploy desktop or laptop computers to other departments or employees in your enterprise, you can force BitLocker into recovery before the computer is given to a new user. - ## Testing recovery - - Before you create a thorough BitLocker recovery process, we recommend that you test how the recovery process works for both end users (people who call your helpdesk for the recovery password) and administrators (people who help the end user get the recovery password). The –forcerecovery command of manage-bde is an easy way for you to step through the recovery process before your users encounter a recovery situation. - **To force a recovery for the local computer** - 1. Click the **Start** button, type **cmd** in the **Start Search** box, right-click **cmd.exe**, and then click **Run as administrator**. - 2. At the command prompt, type the following command and then press ENTER: - **manage-bde -forcerecovery** *<Volume>* - **To force recovery for a remote computer** - 1. On the Start screen, type **cmd.exe**, and then click **Run as administrator**. - 2. At the command prompt, type the following command and then press ENTER: - **manage-bde. -ComputerName** *<ComputerName>***-forcerecovery** *<Volume>* - **Note**   *<ComputerName>* represents the name of the remote computer. *<Volume>* represents the volume on the remote computer that is protected with BitLocker. -   - ## Planning your recovery process - - When planning the BitLocker recovery process, first consult your organization's current best practices for recovering sensitive information. For example: How does your enterprise handle lost Windows passwords? How does your organization perform smart card PIN resets? You can use these best practices and related resources (people and tools) to help formulate a BitLocker recovery model. - Organizations that rely on BitLocker Drive Encryption and BitLocker To Go to protect data on a large number of computers and removable drives running the Windows 10, Windows 8, or Windows 7 operating systems and Windows to Go should consider using the Microsoft BitLocker Administration and Monitoring (MBAM) Tool version 2.0, which is included in the Microsoft Desktop Optimization Pack (MDOP) for Microsoft Software Assurance. MBAM makes BitLocker implementations easier to deploy and manage and allows administrators to provision and monitor encryption for operating system and fixed drives. MBAM prompts the user before encrypting fixed drives. MBAM also manages recovery keys for fixed and removable drives, making recovery easier to manage. MBAM can be used as part of a Microsoft System Center deployment or as a stand-alone solution. For more info, see [Microsoft BitLocker Administration and Monitoring](http://technet.microsoft.com/windows/hh826072.aspx). - After a BitLocker recovery has been initiated, users can use a recovery password to unlock access to encrypted data. You must consider both self-recovery and recovery password retrieval methods for your organization. - When you determine your recovery process, you should: - - Become familiar with how you can retrieve the recovery password. See: - - [Self-recovery](#bkmk-selfrecovery) - - [Recovery password retrieval](#bkmk-recoveryretrieval) - - Determine a series of steps for post-recovery, including analyzing why the recovery occurred and resetting the recovery password. See: - - [Post-recovery analysis](#bkmk-planningpostrecovery) - ### Self-recovery - In some cases, users might have the recovery password in a printout or a USB flash drive and can perform self-recovery. We recommend that your organization create a policy for self-recovery. If self-recovery includes using a password or recovery key stored on a USB flash drive, the users should be warned not to store the USB flash drive in the same place as the PC, especially during travel, for example if both the PC and the recovery items are in the same bag it would be very easy for access to be gained to the PC by an unauthorized user. Another policy to consider is having users contact the Helpdesk before or after performing self-recovery so that the root cause can be identified. - ### Recovery password retrieval - If the user does not have a recovery password in a printout or on a USB flash drive, the user will need to be able to retrieve the recovery password from an online source. If the PC is a member of a domain the recovery password can be backed up to AD DS. However, this does not happen by default, you must have configured the appropriate Group Policy settings before BitLocker was enabled on the PC. BitLocker Group Policy settings can be found in the Local Group Policy Editor or the Group Policy Management Console (GPMC) under **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption**. The following policy settings define the recovery methods that can be used to restore access to a BitLocker-protected drive if an authentication method fails or is unable to be used. - - **Choose how BitLocker-protected operating system drives can be recovered** - - **Choose how BitLocker-protected fixed drives can be recovered** - - **Choose how BitLocker-protected removable drives can be recovered** - In each of these policies, select **Save BitLocker recovery information to Active Directory Domain Services** and then choose which BitLocker recovery information to store in Active Directory Domain Services (AD DS). Select the **Do not enable BitLocker until recovery information is stored in AD DS** check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information for the drive to AD DS succeeds. - **Note**   If the PCs are part of a workgroup, users should be advised to save their BitLocker recovery password with their Microsoft Account online. Having an online copy of your BitLocker recovery password is recommended to help ensure that you do not lose access to your data in the event that recovery is required. -   - The BitLocker Recovery Password Viewer for Active Directory Users and Computers tool allows domain administrators to view BitLocker recovery passwords for specific computer objects in Active Directory. - You can use the following list as a template for creating your own recovery process for recovery password retrieval. This sample process uses the BitLocker Recovery Password Viewer for Active Directory Users and Computers tool. - - [Record the name of the user's computer](#bkmk-recordcomputername) - - [Verify the user's identity](#bkmk-verifyidentity) - - [Locate the recovery password in AD DS](#bkmk-locatepassword) - - [Gather information to determine why recovery occurred](#bkmk-gatherinfo) - - [Give the user the recovery password](#bkmk-givepassword) - ### Record the name of the user's computer - You can use the name of the user's computer to locate the recovery password in AD DS. If the user does not know the name of the computer, ask the user to read the first word of the **Drive Label** in the **BitLocker Drive Encryption Password Entry** user interface. This is the computer name when BitLocker was enabled and is probably the current name of the computer. - ### Verify the user's identity - You should verify that the person that is asking for the recovery password is truly the authorized user of that computer. You may also wish to verify that the computer with the name the user provided belongs to the user. - ### Locate the recovery password in AD DS - Locate the Computer object with the matching name in AD DS. Because Computer object names are listed in the AD DS global catalog, you should be able to locate the object even if you have a multi-domain forest. - ### Multiple recovery passwords - If multiple recovery passwords are stored under a computer object in AD DS, the name of the BitLocker recovery information object includes the date that the password was created. - If at any time you are unsure what password to provide, or if you think you might be providing the incorrect password, ask the user to read the eight character password ID that is displayed in the recovery console. - Since the password ID is a unique value that is associated with each recovery password stored in AD DS, running a query using this ID will find the correct password to unlock the encrypted volume. - ### Gather information to determine why recovery occurred - Before you give the user the recovery password, you should gather any information that will help determine why the recovery was needed, in order to analyze the root cause during the post-recovery analysis. For more info about post-recovery analysis, see [Post-recovery analysis](#bkmk-planningpostrecovery). - ### Give the user the recovery password - Because the recovery password is 48 digits long the user may need to record the password by writing it down or typing it on a different computer. If you are using MBAM, the recovery password will be regenerated after it is recovered from the MBAM database to avoid the security risks associated with an uncontrolled password. - **Note**   Because the 48-digit recovery password is long and contains a combination of digits, the user might mishear or mistype the password. The boot-time recovery console uses built-in checksum numbers to detect input errors in each 6-digit block of the 48-digit recovery password, and offers the user the opportunity to correct such errors. -   - ### Post-recovery analysis - When a volume is unlocked using a recovery password, an event is written to the event log and the platform validation measurements are reset in the TPM to match the current configuration. Unlocking the volume means that the encryption key has been released and is ready for on-the-fly encryption when data is written to the volume, and on-the-fly decryption when data is read from the volume. After the volume is unlocked, BitLocker behaves the same way, regardless of how the access was granted. - If you notice that a computer is having repeated recovery password unlocks, you might want to have an administrator can perform post-recovery analysis to determine the root cause of the recovery and refresh BitLocker platform validation so that the user no longer needs to enter a recovery password each time that the computer starts up. See: - - [Determine the root cause of the recovery](#bkmk-determinecause) - - [Refresh BitLocker protection](#bkmk-refreshprotection) - ### Determine the root cause of the recovery - If a user needed to recover the drive, it is important to determine the root cause that initiated the recovery as soon as possible. Properly analyzing the state of the computer and detecting tampering may reveal threats that have broader implications for enterprise security. - While an administrator can remotely investigate the cause of recovery in some cases, the end user might need to bring the computer that contains the recovered drive on site to analyze the root cause further. - Review and answer the following questions for your organization: - 1. What BitLocker protection mode is in effect (TPM, TPM + PIN, TPM + startup key, startup key only)? Which PCR profile is in use on the PC? - 2. Did the user merely forget the PIN or lose the startup key? If a token was lost, where might the token be? - 3. If TPM mode was in effect, was recovery caused by a boot file change? - 4. If recovery was caused by a boot file change, is this due to an intended user action (for example, BIOS upgrade), or to malicious software? - 5. When was the user last able to start the computer successfully, and what might have happened to the computer since then? - 6. Might the user have encountered malicious software or left the computer unattended since the last successful startup? - To help you answer these questions, use the BitLocker command-line tool to view the current configuration and protection mode (for example, **manage-bde -status**). Scan the event log to find events that help indicate why recovery was initiated (for example, if boot file change occurred). Both of these capabilities can be performed remotely. - ### Resolve the root cause - After you have identified what caused recovery, you can reset BitLocker protection and avoid recovery on every startup. - The details of this reset can vary according to the root cause of the recovery. If you cannot determine the root cause, or if malicious software or a rootkit might have infected the computer, Helpdesk should apply best-practice virus policies to react appropriately. - **Note**   You can perform a BitLocker validation profile reset by suspending and resuming BitLocker. -   - - [Unknown PIN](#bkmk-unknownpin) - - [Lost startup key](#bkmk-loststartup) - - [Changes to boot files](#bkmk-changebootknown) - ### Unknown PIN - If a user has forgotten the PIN, you must reset the PIN while you are logged on to the computer in order to prevent BitLocker from initiating recovery each time the computer is restarted. - **To prevent continued recovery due to an unknown PIN** - 1. Unlock the computer using the recovery password. - 2. Reset the PIN: - 1. - 2. Right-click the drive and then click **Change PIN** - 3. In the BitLocker Drive Encryption dialog, click **Reset a forgotten PIN**. If you are not logged in with an administrator account you must provide administrative credentials at this time. - 4. In the PIN reset dialog, provide and confirm the new PIN to use and then click **Finish**. - 3. You will use the new PIN the next time you unlock the drive. - ### Lost startup key - If you have lost the USB flash drive that contains the startup key, then you must unlock the drive by using the recovery key and then create a new startup key. - **To prevent continued recovery due to a lost startup key** - 1. Log on as an administrator to the computer that has the lost startup key. - 2. Open Manage BitLocker. - 3. Click **Duplicate start up key**, insert the clean USB drive on which you are going to write the key and then click **Save**. - ### Changes to boot files - This error might occur if you updated the firmware. As a best practice you should suspend BitLocker before making changes the firmware and then resume protection after the update has completed. This prevents the computer from going into recovery mode. However if changes were made when BitLocker protection was on you can simply log on to the computer using the recovery password and the platform validation profile will be updated so that recovery will not occur the next time. - ## Windows RE and BitLocker - - Windows Recovery Environment (RE) can be used to recover access to a drive protected by BitLocker or by Device Encryption. If a PC is unable to boot after two failures, Startup Repair will automatically start. When Startup Repair is launched automatically due to boot failures, it will only execute operating system and driver file repairs, provided that the boot logs or any available crash dump point to a specific corrupted file. In Windows 8.1 and later, devices that include firmware to support specific TPM measurements for PCR\[7\] the TPM can validate that Windows RE is a trusted operating environment and will unlock any BitLocker-protected drives if Windows RE has not been modified. If the Windows RE environment has been modified, for example the TPM has been disabled, the drives will stay locked until the BitLocker recovery key is provided. If Startup Repair is not able to be run automatically from the PC and instead Windows RE is manually started from a repair disk, the BitLocker recovery key must be provided to unlock the BitLocker–protected drives. - ## Using additional recovery information - - Besides the 48-digit BitLocker recovery password, other types of recovery information are stored in Active Directory. This section describes how this additional information can be used. - ### BitLocker key package - If the recovery methods discussed earlier in this document do not unlock the volume, you can use the BitLocker Repair tool to decrypt the volume at the block level. The tool uses the BitLocker key package to help recover encrypted data from severely damaged drives. You can then use this recovered data to salvage encrypted data, even after the correct recovery password has failed to unlock the damaged volume. We recommend that you still save the recovery password. A key package cannot be used without the corresponding recovery password. - **Note**   You must use the BitLocker Repair tool **repair-bde** to use the BitLocker key package. -   - The BitLocker key package is not saved by default. To save the package along with the recovery password in AD DS you must select the **Backup recovery password and key package** option in the Group Policy settings that control the recovery method. You can also export the key package from a working volume. For more details on how to export key packages, see [Retrieving the BitLocker Key Package](#bkmk-appendixc). - ## Resetting recovery passwords - - You should invalidate a recovery password after it has been provided and used. It should also be done when you intentionally want to invalidate an existing recovery password for any reason. - You can reset the recovery password in two ways: - - **Use manage-bde** You can use manage-bde to remove the old recovery password and add a new recovery password. The procedure identifies the command and the syntax for this method. - - **Run a script** You can run a script to reset the password without decrypting the volume. The sample script in the procedure illustrates this functionality. The sample script creates a new recovery password and invalidates all other passwords. - **To reset a recovery password using manage-bde** - 1. Remove the previous recovery password - ``` syntax Manage-bde –protectors –delete C: –type RecoveryPassword ``` - 2. Add the new recovery password - ``` syntax Manage-bde –protectors –add C: -RecoveryPassword ``` - 3. Get the ID of the new recovery password. From the screen copy the ID of the recovery password. - ``` syntax Manage-bde –protectors –get C: -Type RecoveryPassword ``` - 4. Backup the new recovery password to AD DS - ``` syntax Manage-bde –protectors –adbackup C: -id {EXAMPLE6-5507-4924-AA9E-AFB2EB003692} ``` - **Warning**   You must include the braces in the ID string. -   - **To run the sample recovery password script** - 1. Save the following sample script in a VBScript file. For example: ResetPassword.vbs. - 2. At the command prompt, type a command similar to the following: - **cscript ResetPassword.vbs** - **Important**   This sample script is configured to work only for the C volume. You must customize the script to match the volume where you want to test password reset. -   - **Note**   To manage a remote computer, you can specify the remote computer name rather than the local computer name. -   - You can use the following sample script to create a VBScript file to reset the recovery passwords. - ``` syntax ' Target drive letter strDriveLetter = "c:" - ' Target computer name ' Use "." to connect to the local computer strComputerName = "." - - ' -------------------------------------------------------------------------------- ' Connect to the BitLocker WMI provider class ' -------------------------------------------------------------------------------- - strConnectionStr = "winmgmts:" _ & "{impersonationLevel=impersonate,authenticationLevel=pktPrivacy}!\\" _ & strComputerName _ @@ -441,71 +237,46 @@ strConnectionStr = "winmgmts:" _ On Error Resume Next 'handle permission errors - Set objWMIService = GetObject(strConnectionStr) - - If Err.Number <> 0 Then WScript.Echo "Failed to connect to the BitLocker interface (Error 0x" & Hex(Err.Number) & ")." Wscript.Echo "Ensure that you are running with administrative privileges." WScript.Quit -1 End If - On Error GoTo 0 - strQuery = "Select * from Win32_EncryptableVolume where DriveLetter='" & strDriveLetter & "'" Set colTargetVolumes = objWMIService.ExecQuery(strQuery) - - If colTargetVolumes.Count = 0 Then WScript.Echo "FAILURE: Unable to find BitLocker-capable drive " & strDriveLetter & " on computer " & strComputerName & "." WScript.Quit -1 End If - - ' there should only be one volume found For Each objFoundVolume in colTargetVolumes set objVolume = objFoundVolume Next - - ' objVolume is now our found BitLocker-capable disk volume - - ' -------------------------------------------------------------------------------- ' Perform BitLocker WMI provider functionality ' -------------------------------------------------------------------------------- - - ' Add a new recovery password, keeping the ID around so it doesn't get deleted later ' ---------------------------------------------------------------------------------- - nRC = objVolume.ProtectKeyWithNumericalPassword("Recovery Password Refreshed By Script", , sNewKeyProtectorID) - If nRC <> 0 Then WScript.Echo "FAILURE: ProtectKeyWithNumericalPassword failed with return code 0x" & Hex(nRC) WScript.Quit -1 End If - ' Removes the other, "stale", recovery passwords ' ---------------------------------------------------------------------------------- - nKeyProtectorTypeIn = 3 ' type associated with "Numerical Password" protector - nRC = objVolume.GetKeyProtectors(nKeyProtectorTypeIn, aKeyProtectorIDs) - If nRC <> 0 Then WScript.Echo "FAILURE: GetKeyProtectors failed with return code 0x" & Hex(nRC) WScript.Quit -1 End If - ' Delete those key protectors other than the one we just added. - For Each sKeyProtectorID In aKeyProtectorIDs - If sKeyProtectorID <> sNewKeyProtectorID Then nRC = objVolume.DeleteKeyProtector(sKeyProtectorID) - If nRC <> 0 Then WScript.Echo "FAILURE: DeleteKeyProtector on ID " & sKeyProtectorID & " failed with return code 0x" & Hex(nRC) WScript.Quit -1 @@ -514,42 +285,26 @@ Else 'WScript.Echo "SUCCESS: Key protector with ID " & sKeyProtectorID & " deleted" End If End If - Next - WScript.Echo "A new recovery password has been added. Old passwords have been removed." - ' - some advanced output (hidden) 'WScript.Echo "" 'WScript.Echo "Type ""manage-bde -protectors -get " & strDriveLetter & " -type recoverypassword"" to view existing passwords." ``` - ## Retrieving the BitLocker key package - - You can use two methods to retrieve the key package, as described in [Using Additional Recovery Information](#bkmk-usingaddrecovery): - - **Export a previously-saved key package from AD DS.** You must have Read access to BitLocker recovery passwords that are stored in AD DS. - - **Export a new key package from an unlocked, BitLocker-protected volume.** You must have local administrator access to the working volume, before any damage has occurred. - The following sample script exports all previously-saved key packages from AD DS. - **To run the sample key package retrieval script** - 1. Save the following sample script in a VBScript file. For example: GetBitLockerKeyPackageADDS.vbs. - 2. At the command prompt, type a command similar to the following: - **cscript GetBitLockerKeyPackageADDS.vbs -?** - You can use the following sample script to create a VBScript file to retrieve the BitLocker key package from AD DS. - ``` syntax ' -------------------------------------------------------------------------------- ' Usage ' -------------------------------------------------------------------------------- - Sub ShowUsage Wscript.Echo "USAGE: GetBitLockerKeyPackageAD [Path To Saved Key Package] [Optional Computer Name]" Wscript.Echo "If no computer name is specified, the local computer is assumed." @@ -557,13 +312,10 @@ Sub ShowUsage Wscript.Echo "Example: GetBitLockerKeyPackageAD E:\bitlocker-ad-key-package mycomputer" WScript.Quit End Sub - ' -------------------------------------------------------------------------------- ' Parse Arguments ' -------------------------------------------------------------------------------- - Set args = WScript.Arguments - Select Case args.Count Case 1 If args(0) = "/?" Or args(0) = "-?" Then @@ -584,23 +336,15 @@ Select Case args.Count End If Case Else ShowUsage - End Select - - - ' -------------------------------------------------------------------------------- ' Get path to Active Directory computer object associated with the computer name ' -------------------------------------------------------------------------------- - Function GetStrPathToComputer(strComputerName) - ' Uses the global catalog to find the computer in the forest ' Search also includes deleted computers in the tombstone - Set objRootLDAP = GetObject("LDAP://rootDSE") namingContext = objRootLDAP.Get("defaultNamingContext") ' e.g. string dc=fabrikam,dc=com - strBase = "" Set objConnection = CreateObject("ADODB.Connection") @@ -608,107 +352,72 @@ Function GetStrPathToComputer(strComputerName) objConnection.Provider = "ADsDSOOBject" objConnection.Open "Active Directory Provider" Set objCommand.ActiveConnection = objConnection - strFilter = "(&(objectCategory=Computer)(cn=" & strComputerName & "))" strQuery = strBase & ";" & strFilter & ";distinguishedName;subtree" - objCommand.CommandText = strQuery objCommand.Properties("Page Size") = 100 objCommand.Properties("Timeout") = 100 objCommand.Properties("Cache Results") = False - ' Enumerate all objects found. - Set objRecordSet = objCommand.Execute If objRecordSet.EOF Then WScript.echo "The computer name '" & strComputerName & "' cannot be found." WScript.Quit 1 End If - ' Found object matching name - Do Until objRecordSet.EOF dnFound = objRecordSet.Fields("distinguishedName") GetStrPathToComputer = "LDAP://" & dnFound objRecordSet.MoveNext Loop - - ' Clean up. Set objConnection = Nothing Set objCommand = Nothing Set objRecordSet = Nothing - End Function - - ' -------------------------------------------------------------------------------- ' Securely access the Active Directory computer object using Kerberos ' -------------------------------------------------------------------------------- - - Set objDSO = GetObject("LDAP:") strPathToComputer = GetStrPathToComputer(strComputerName) - WScript.Echo "Accessing object: " + strPathToComputer - Const ADS_SECURE_AUTHENTICATION = 1 Const ADS_USE_SEALING = 64 '0x40 Const ADS_USE_SIGNING = 128 '0x80 - - ' -------------------------------------------------------------------------------- ' Get all BitLocker recovery information from the Active Directory computer object ' -------------------------------------------------------------------------------- - ' Get all the recovery information child objects of the computer object - Set objFveInfos = objDSO.OpenDSObject(strPathToComputer, vbNullString, vbNullString, _ ADS_SECURE_AUTHENTICATION + ADS_USE_SEALING + ADS_USE_SIGNING) - objFveInfos.Filter = Array("msFVE-RecoveryInformation") - ' Iterate through each recovery information object and saves any existing key packages - nCount = 1 strFilePathCurrent = strFilePath & nCount - For Each objFveInfo in objFveInfos - strName = objFveInfo.Get("name") - strRecoveryPassword = objFveInfo.Get("msFVE-RecoveryPassword") strKeyPackage = objFveInfo.Get("msFVE-KeyPackage") - WScript.echo WScript.echo "Recovery Object Name: " + strName WScript.echo "Recovery Password: " + strRecoveryPassword - ' Validate file path Set fso = CreateObject("Scripting.FileSystemObject") - If (fso.FileExists(strFilePathCurrent)) Then WScript.Echo "The file " & strFilePathCurrent & " already exists. Please use a different path." WScript.Quit -1 End If - ' Save binary data to the file SaveBinaryDataText strFilePathCurrent, strKeyPackage WScript.echo "Related key package successfully saved to " + strFilePathCurrent - - ' Update next file path using base name nCount = nCount + 1 strFilePathCurrent = strFilePath & nCount - Next - - '---------------------------------------------------------------------------------------- ' Utility functions to save binary data '---------------------------------------------------------------------------------------- - Function SaveBinaryDataText(FileName, ByteArray) 'Create FileSystemObject object Dim FS: Set FS = CreateObject("Scripting.FileSystemObject") @@ -720,7 +429,6 @@ Function SaveBinaryDataText(FileName, ByteArray) 'Convert binary data To text And write them To the file TextStream.Write BinaryToString(ByteArray) End Function - Function BinaryToString(Binary) Dim I, S For I = 1 To LenB(Binary) @@ -728,32 +436,22 @@ Function BinaryToString(Binary) Next BinaryToString = S End Function - WScript.Quit - The following sample script exports a new key package from an unlocked, encrypted volume. - To run this script, start by saving the code into a VBS file (for example, GetBitLockerKeyPackage.vbs). Then, open an administrator command prompt and use “cscript” to run the saved file (for example, type "cscript GetBitLockerKeyPackage.vbs -?"). - - - ' -------------------------------------------------------------------------------- ' Usage ' -------------------------------------------------------------------------------- - Sub ShowUsage Wscript.Echo "USAGE: GetBitLockerKeyPackage [VolumeLetter/DriveLetter:] [Path To Saved Key Package]" Wscript.Echo Wscript.Echo "Example: GetBitLockerKeyPackage C: E:\bitlocker-backup-key-package" WScript.Quit End Sub - ' -------------------------------------------------------------------------------- ' Parse Arguments ' -------------------------------------------------------------------------------- - Set args = WScript.Arguments - Select Case args.Count Case 2 If args(0) = "/?" Or args(0) = "-?" Then @@ -764,28 +462,19 @@ Select Case args.Count End If Case Else ShowUsage - End Select - ' -------------------------------------------------------------------------------- ' Other Inputs ' -------------------------------------------------------------------------------- - ' Target computer name ' Use "." to connect to the local computer strComputerName = "." - ' Default key protector ID to use. Specify "" to let the script choose. - strDefaultKeyProtectorID = "" - ' strDefaultKeyProtectorID = "{001298E0-870E-4BA0-A2FF-FC74758D5720}" ' sample - - ' -------------------------------------------------------------------------------- ' Connect to the BitLocker WMI provider class ' -------------------------------------------------------------------------------- - strConnectionStr = "winmgmts:" _ & "{impersonationLevel=impersonate,authenticationLevel=pktPrivacy}!\\" _ & strComputerName _ @@ -793,93 +482,63 @@ strConnectionStr = "winmgmts:" _ On Error Resume Next 'handle permission errors - Set objWMIService = GetObject(strConnectionStr) - - If Err.Number <> 0 Then WScript.Echo "Failed to connect to the BitLocker interface (Error 0x" & Hex(Err.Number) & ")." Wscript.Echo "Ensure that you are running with administrative privileges." WScript.Quit -1 End If - On Error GoTo 0 - strQuery = "Select * from Win32_EncryptableVolume where DriveLetter='" & strDriveLetter & "'" Set colTargetVolumes = objWMIService.ExecQuery(strQuery) - - If colTargetVolumes.Count = 0 Then WScript.Echo "FAILURE: Unable to find BitLocker-capable drive " & strDriveLetter & " on computer " & strComputerName & "." WScript.Quit -1 End If - - ' there should only be one volume found For Each objFoundVolume in colTargetVolumes set objVolume = objFoundVolume Next - - ' objVolume is now our found BitLocker-capable disk volume - - ' -------------------------------------------------------------------------------- ' Perform BitLocker WMI provider functionality ' -------------------------------------------------------------------------------- - - ' Collect all possible valid key protector ID's that can be used to get the package ' ---------------------------------------------------------------------------------- - nNumericalKeyProtectorType = 3 ' type associated with "Numerical Password" protector - nRC = objVolume.GetKeyProtectors(nNumericalKeyProtectorType, aNumericalKeyProtectorIDs) If nRC <> 0 Then WScript.Echo "FAILURE: GetKeyProtectors failed with return code 0x" & Hex(nRC) WScript.Quit -1 End If - nExternalKeyProtectorType = 2 ' type associated with "External Key" protector - nRC = objVolume.GetKeyProtectors(nExternalKeyProtectorType, aExternalKeyProtectorIDs) If nRC <> 0 Then WScript.Echo "FAILURE: GetKeyProtectors failed with return code 0x" & Hex(nRC) WScript.Quit -1 End If - - ' Get first key protector of the type "Numerical Password" or "External Key", if any ' ---------------------------------------------------------------------------------- - if strDefaultKeyProtectorID = "" Then - ' Save first numerical password, if exists If UBound(aNumericalKeyProtectorIDs) <> -1 Then strDefaultKeyProtectorID = aNumericalKeyProtectorIDs(0) End If - ' No numerical passwords exist, save the first external key If strDefaultKeyProtectorID = "" and UBound(aExternalKeyProtectorIDs) <> -1 Then strDefaultKeyProtectorID = aExternalKeyProtectorIDs(0) End If - ' Fail case: no recovery key protectors exist. If strDefaultKeyProtectorID = "" Then WScript.Echo "FAILURE: Cannot create backup key package because no recovery passwords or recovery keys exist. Check that BitLocker protection is on for this drive." WScript.Echo "For help adding recovery passwords or recovery keys, type ""manage-bde -protectors -add -?""." WScript.Quit -1 End If - End If - ' Get some information about the chosen key protector ID ' ---------------------------------------------------------------------------------- - ' is the type valid? - nRC = objVolume.GetKeyProtectorType(strDefaultKeyProtectorID, nDefaultKeyProtectorType) - If Hex(nRC) = "80070057" Then WScript.Echo "The key protector ID " & strDefaultKeyProtectorID & " is not valid." WScript.Echo "This ID value may have been provided by the script writer." @@ -887,79 +546,56 @@ ElseIf nRC <> 0 Then WScript.Echo "FAILURE: GetKeyProtectorType failed with return code 0x" & Hex(nRC) WScript.Quit -1 End If - ' what's a string that can be used to describe it? - strDefaultKeyProtectorType = "" - Select Case nDefaultKeyProtectorType - Case nNumericalKeyProtectorType strDefaultKeyProtectorType = "recovery password" - Case nExternalKeyProtectorType strDefaultKeyProtectorType = "recovery key" - Case Else WScript.Echo "The key protector ID " & strDefaultKeyProtectorID & " does not refer to a valid recovery password or recovery key." WScript.Echo "This ID value may have been provided by the script writer." - End Select - - ' Save the backup key package using the chosen key protector ID ' ---------------------------------------------------------------------------------- - nRC = objVolume.GetKeyPackage(strDefaultKeyProtectorID, oKeyPackage) If nRC <> 0 Then WScript.Echo "FAILURE: GetKeyPackage failed with return code 0x" & Hex(nRC) WScript.Quit -1 End If - ' Validate file path Set fso = CreateObject("Scripting.FileSystemObject") If (fso.FileExists(strFilePath)) Then WScript.Echo "The file " & strFilePath & " already exists. Please use a different path." WScript.Quit -1 End If - Dim oKeyPackageByte, bKeyPackage For Each oKeyPackageByte in oKeyPackage 'WScript.echo "key package byte: " & oKeyPackageByte bKeyPackage = bKeyPackage & ChrB(oKeyPackageByte) Next - ' Save binary data to the file SaveBinaryDataText strFilePath, bKeyPackage - ' Display helpful information ' ---------------------------------------------------------------------------------- - WScript.Echo "The backup key package has been saved to " & strFilePath & "." - WScript.Echo "IMPORTANT: To use this key package, the " & strDefaultKeyProtectorType & " must also be saved." - ' Display the recovery password or a note about saving the recovery key file - If nDefaultKeyProtectorType = nNumericalKeyProtectorType Then - nRC = objVolume.GetKeyProtectorNumericalPassword(strDefaultKeyProtectorID, sNumericalPassword) If nRC <> 0 Then WScript.Echo "FAILURE: GetKeyProtectorNumericalPassword failed with return code 0x" & Hex(nRC) WScript.Quit -1 End If WScript.Echo "Save this recovery password: " & sNumericalPassword - ElseIf nDefaultKeyProtectorType = nExternalKeyProtectorType Then WScript.Echo "The saved key file is named " & strDefaultKeyProtectorID & ".BEK" WScript.Echo "For help re-saving this external key file, type ""manage-bde -protectors -get -?""" End If - - '---------------------------------------------------------------------------------------- ' Utility functions to save binary data '---------------------------------------------------------------------------------------- - Function SaveBinaryDataText(FileName, ByteArray) 'Create FileSystemObject object Dim FS: Set FS = CreateObject("Scripting.FileSystemObject") @@ -971,7 +607,6 @@ Function SaveBinaryDataText(FileName, ByteArray) 'Convert binary data To text And write them To the file TextStream.Write BinaryToString(ByteArray) End Function - Function BinaryToString(Binary) Dim I, S For I = 1 To LenB(Binary) @@ -980,17 +615,7 @@ Function BinaryToString(Binary) BinaryToString = S End Function ``` - ## See also - - - [BitLocker overview](bitlocker-overview.md) -   -   - - - - - diff --git a/windows/keep-secure/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md b/windows/keep-secure/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md index 7a8babc248..ab1c7f7bb2 100644 --- a/windows/keep-secure/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md +++ b/windows/keep-secure/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md @@ -2,133 +2,79 @@ title: BitLocker Use BitLocker Drive Encryption Tools to manage BitLocker (Windows 10) description: This topic for the IT professional describes how to use tools to manage BitLocker. ms.assetid: e869db9c-e906-437b-8c70-741dd61b5ea6 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # BitLocker: Use BitLocker Drive Encryption Tools to manage BitLocker - - **Applies to** - - Windows 10 - This topic for the IT professional describes how to use tools to manage BitLocker. - BitLocker Drive Encryption Tools include the command line tools manage-bde and repair-bde and the BitLocker cmdlets for Windows PowerShell. - Both manage-bde and the BitLocker cmdlets can be used to perform any task that can be accomplished through the BitLocker control panel and are appropriate to use for automated deployments and other scripting scenarios. - Repair-bde is a special circumstance tool that is provided for disaster recovery scenarios in which a BitLocker protected drive cannot be unlocked normally or using the recovery console. - 1. [Manage-bde](#bkmk-managebde) - 2. [Repair-bde](#bkmk-repairbde) - 3. [BitLocker cmdlets for Windows PowerShell](#bkmk-blcmdlets) - ## Manage-bde - - Manage-bde is a command-line tool that can be used for scripting BitLocker operations. Manage-bde offers additional options not displayed in the BitLocker control panel. For a complete list of the manage-bde options, see the [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx) command-line reference. - Manage-bde includes less default settings and requires greater customization for configuring BitLocker. For example, using just the `manage-bde -on` command on a data volume will fully encrypt the volume without any authenticating protectors. A volume encrypted in this manner still requires user interaction to turn on BitLocker protection, even though the command successfully completed because an authentication method needs to be added to the volume for it to be fully protected. The following sections provide examples of common usage scenarios for manage-bde. - ### Using manage-bde with operating system volumes - Listed below are examples of basic valid commands for operating system volumes. In general, using only the `manage-bde -on ` command will encrypt the operating system volume with a TPM-only protector and no recovery key. However, many environments require more secure protectors such as passwords or PIN and expect to be able to recover information with a recovery key. It is recommended that at least one primary protector and a recovery protector be added to an operating system volume. - A good practice when using manage-bde is to determine the volume status on the target system. Use the following command to determine volume status: - ``` syntax manage-bde -status ``` - This command returns the volumes on the target, current encryption status and volume type (operating system or data) for each volume. - The following example illustrates enabling BitLocker on a computer without a TPM chip. Before beginning the encryption process you must create the startup key needed for BitLocker and save it to the USB drive. When BitLocker is enabled for the operating system volume, the BitLocker will need to access the USB flash drive to obtain the encryption key (in this example, the drive letter E represents the USB drive). You will be prompted to reboot to complete the encryption process. - ``` syntax manage-bde –protectors -add C: -startupkey E: manage-bde -on C: ``` - **Note**   After the encryption is completed, the USB startup key must be inserted before the operating system can be started. -   - An alternative to the startup key protector on non-TPM hardware is to use a password and an **ADaccountorgroup** protector to protect the operating system volume. In this scenario, you would add the protectors first. This is done with the command: - ``` syntax manage-bde -protectors -add C: -pw -sid ``` - This command will require you to enter and then confirm the password protector before adding them to the volume. With the protectors enabled on the volume, you can then turn BitLocker on. - On computers with a TPM it is possible to encrypt the operating system volume without any defined protectors using manage-bde. The command to do this is: - ``` syntax manage-bde -on C: ``` - This will encrypt the drive using the TPM as the default protector. If you are not sure if a TPM protector is available, to list the protectors available for a volume, run the following command: - ``` syntax manage-bde -protectors -get ``` - ### Using manage-bde with data volumes - Data volumes use the same syntax for encryption as operating system volumes but they do not require protectors for the operation to complete. Encrypting data volumes can be done using the base command: `manage-bde -on ` or you can choose to add additional protectors to the volume first. It is recommended that at least one primary protector and a recovery protector be added to a data volume. - A common protector for a data volume is the password protector. In the example below, we add a password protector to the volume and turn BitLocker on. - ``` syntax manage-bde -protectors -add -pw C: manage-bde -on C: ``` - ## Repair-bde - - You may experience a problem that damages an area of a hard disk on which BitLocker stores critical information. This kind of problem may be caused by a hard disk failure or if Windows exits unexpectedly. - The BitLocker Repair Tool (Repair-bde) can be used to access encrypted data on a severely damaged hard disk if the drive was encrypted by using BitLocker. Repair-bde can reconstruct critical parts of the drive and salvage recoverable data as long as a valid recovery password or recovery key is used to decrypt the data. If the BitLocker metadata data on the drive has become corrupt, you must be able to supply a backup key package in addition to the recovery password or recovery key. This key package is backed up in Active Directory Domain Services (AD DS) if you used the default setting for AD DS backup. With this key package and either the recovery password or recovery key, you can decrypt portions of a BitLocker-protected drive if the disk is corrupted. Each key package will work only for a drive that has the corresponding drive identifier. You can use the BitLocker Recovery Password Viewer to obtain this key package from AD DS. - **Tip**   If you are not backing up recovery information to AD DS or if you want to save key packages alternatively, you can use the command `manage-bde -KeyPackage` to generate a key package for a volume. -   - The Repair-bde command-line tool is intended for use when the operating system does not start or when you cannot start the BitLocker Recovery Console. You should use Repair-bde if the following conditions are true: - 1. You have encrypted the drive by using BitLocker Drive Encryption. - 2. Windows does not start, or you cannot start the BitLocker recovery console. - 3. You do not have a copy of the data that is contained on the encrypted drive. - **Note**   Damage to the drive may not be related to BitLocker. Therefore, we recommend that you try other tools to help diagnose and resolve the problem with the drive before you use the BitLocker Repair Tool. The Windows Recovery Environment (Windows RE) provides additional options to repair computers. -   - The following limitations exist for Repair-bde: - - The Repair-bde command-line tool cannot repair a drive that failed during the encryption or decryption process. - - The Repair-bde command-line tool assumes that if the drive has any encryption, then the drive has been fully encrypted. - For more information about using repair-bde see [Repair-bde](http://technet.microsoft.com/library/ff829851.aspx) - ## BitLocker cmdlets for Windows PowerShell - - Windows PowerShell cmdlets provide a new way for administrators to use when working with BitLocker. Using Windows PowerShell's scripting capabilities, administrators can integrate BitLocker options into existing scripts with ease. The list below displays the available BitLocker cmdlets. - @@ -255,130 +201,76 @@ Windows PowerShell cmdlets provide a new way for administrators to use when work
-   - Similar to manage-bde, the Windows PowerShell cmdlets allow configuration beyond the options offered in the control panel. As with manage-bde, users need to consider the specific needs of the volume they are encrypting prior to running Windows PowerShell cmdlets. - A good initial step is to determine the current state of the volume(s) on the computer. You can do this using the `Get-BitLockerVolume` cmdlet. - The `Get-BitLockerVolume` cmdlet output gives information on the volume type, protectors, protection status and other details. - **Tip**   Occasionally, all protectors may not be shown when using `Get-BitLockerVolume` due to lack of space in the output display. If you do not see all of the protectors for a volume, you can use the Windows PowerShell pipe command (|) to format a full listing of the protectors. - `Get-BitLockerVolume C: | fl` -   - If you want to remove the existing protectors prior to provisioning BitLocker on the volume, you could use the `Remove-BitLockerKeyProtector` cmdlet. Accomplishing this requires the GUID associated with the protector to be removed. - A simple script can pipe the values of each Get-BitLockerVolume return out to another variable as seen below: - ``` syntax $vol = Get-BitLockerVolume $keyprotectors = $vol.KeyProtector ``` - Using this, you can display the information in the $keyprotectors variable to determine the GUID for each protector. - Using this information, you can then remove the key protector for a specific volume using the command: - ``` syntax Remove-BitLockerKeyProtector : -KeyProtectorID "{GUID}" ``` - **Note**   The BitLocker cmdlet requires the key protector GUID enclosed in quotation marks to execute. Ensure the entire GUID, with braces, is included in the command. -   - ### Using the BitLocker Windows PowerShell cmdlets with operating system volumes - Using the BitLocker Windows PowerShell cmdlets is similar to working with the manage-bde tool for encrypting operating system volumes. Windows PowerShell offers users a lot of flexibility. For example, users can add the desired protector as part command for encrypting the volume. Below are examples of common user scenarios and steps to accomplish them in BitLocker Windows PowerShell. - The following example shows how to enable BitLocker on an operating system drive using only the TPM protector: - ``` syntax Enable-BitLocker C: ``` - In the example below, adds one additional protector, the StartupKey protector and chooses to skip the BitLocker hardware test. In this example, encryption starts immediately without the need for a reboot. - ``` syntax Enable-BitLocker C: -StartupKeyProtector -StartupKeyPath -SkipHardwareTest ``` - ### Using the BitLocker Windows PowerShell cmdlets with data volumes - Data volume encryption using Windows PowerShell is the same as for operating system volumes. You should add the desired protectors prior to encrypting the volume. The following example adds a password protector to the E: volume using the variable $pw as the password. The $pw variable is held as a SecureString value to store the user defined password. - ``` syntax $pw = Read-Host -AsSecureString Enable-BitLockerKeyProtector E: -PasswordProtector -Password $pw ``` - ### Using an AD Account or Group protector in Windows PowerShell - The **ADAccountOrGroup** protector, introduced in Windows 8 and Windows Server 2012, is an Active Directory SID-based protector. This protector can be added to both operating system and data volumes, although it does not unlock operating system volumes in the pre-boot environment. The protector requires the SID for the domain account or group to link with the protector. BitLocker can protect a cluster-aware disk by adding a SID-based protector for the Cluster Name Object (CNO) that lets the disk properly failover to and be unlocked by any member computer of the cluster. - **Warning**   The **ADAccountOrGroup** protector requires the use of an additional protector for use (such as TPM, PIN, or recovery key) when used on operating system volumes -   - To add an **ADAccountOrGroup** protector to a volume requires either the actual domain SID or the group name preceded by the domain and a backslash. In the example below, the CONTOSO\\Administrator account is added as a protector to the data volume G. - ``` syntax Enable-BitLocker G: -AdAccountOrGroupProtector -AdAccountOrGroup CONTOSO\Administrator ``` - For users who wish to use the SID for the account or group, the first step is to determine the SID associated with the account. To get the specific SID for a user account in Windows PowerShell, use the following command: - **Note**   Use of this command requires the RSAT-AD-PowerShell feature. -   - ``` syntax get-aduser -filter {samaccountname -eq "administrator"} ``` - **Tip**   In addition to the PowerShell command above, information about the locally logged on user and group membership can be found using: WHOAMI /ALL. This does not require the use of additional features. -   - The following example adds an **ADAccountOrGroup** protector to the previously encrypted operating system volume using the SID of the account: - ``` syntax Add-BitLockerKeyProtector C: -ADAccountOrGroupProtector -ADAccountOrGroup S-1-5-21-3651336348-8937238915-291003330-500 ``` - **Note**   Active Directory-based protectors are normally used to unlock Failover Cluster enabled volumes. -   - ## More information - - [BitLocker overview](bitlocker-overview.md) - [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md) - [Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md) - [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md) - [BitLocker: How to deploy on Windows Server 2012](bitlocker-how-to-deploy-on-windows-server.md) -   -   - - - - - diff --git a/windows/keep-secure/bitlocker-use-bitlocker-recovery-password-viewer.md b/windows/keep-secure/bitlocker-use-bitlocker-recovery-password-viewer.md index b3d3843cf4..de1b0e8a2c 100644 --- a/windows/keep-secure/bitlocker-use-bitlocker-recovery-password-viewer.md +++ b/windows/keep-secure/bitlocker-use-bitlocker-recovery-password-viewer.md @@ -2,78 +2,40 @@ title: BitLocker Use BitLocker Recovery Password Viewer (Windows 10) description: This topic for the IT professional describes how to use the BitLocker Recovery Password Viewer. ms.assetid: 04c93ac5-5dac-415e-b636-de81435753a2 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # BitLocker: Use BitLocker Recovery Password Viewer - - **Applies to** - - Windows 10 - This topic for the IT professional describes how to use the BitLocker Recovery Password Viewer. - The BitLocker Recovery Password Viewer tool is an optional tool included with the Remote Server Administration Tools (RSAT). It lets you locate and view BitLocker recovery passwords that are stored in Active Directory Domain Services (AD DS). You can use this tool to help recover data that is stored on a drive that has been encrypted by using BitLocker. The BitLocker Active Directory Recovery Password Viewer tool is an extension for the Active Directory Users and Computers Microsoft Management Console (MMC) snap-in. Using this tool, you can examine a computer object's **Properties** dialog box to view the corresponding BitLocker recovery passwords. Additionally, you can right-click a domain container and then search for a BitLocker recovery password across all the domains in the Active Directory forest. You can also search for a password by password identifier (ID). - ## Before you start - - To complete the procedures in this scenario: - - You must have domain administrator credentials. - - Your test computers must be joined to the domain. - - On the test computers, BitLocker must have been turned on after joining the domain. - The following procedures describe the most common tasks performed by using the BitLocker Recovery Password Viewer. - **To view the recovery passwords for a computer** - 1. In **Active Directory Users and Computers**, locate and then click the container in which the computer is located. - 2. Right-click the computer object, and then click **Properties**. - 3. In the **Properties** dialog box, click the **BitLocker Recovery** tab to view the BitLocker recovery passwords that are associated with the computer. - **To copy the recovery passwords for a computer** - 1. Follow the steps in the previous procedure to view the BitLocker recovery passwords. - 2. On the **BitLocker Recovery** tab of the **Properties** dialog box, right-click the BitLocker recovery password that you want to copy, and then click **Copy Details**. - 3. Press CTRL+V to paste the copied text to a destination location, such as a text file or spreadsheet. - **To locate a recovery password by using a password ID** - 1. In Active Directory Users and Computers, right-click the domain container, and then click **Find BitLocker Recovery Password**. - 2. In the **Find BitLocker Recovery Password** dialog box, type the first eight characters of the recovery password in the **Password ID (first 8 characters)** box, and then click **Search**. - By completing the procedures in this scenario, you have viewed and copied the recovery passwords for a computer and used a password ID to locate a recovery password. - ## More information - - [BitLocker Overview](bitlocker-overview.md) - [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md) - [Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md) - [BitLocker: How to deploy on Windows Server 2012](bitlocker-how-to-deploy-on-windows-server.md) - [BitLocker: Use BitLocker Drive Encryption Tools to manage BitLocker](bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md) -   -   - - - - - diff --git a/windows/keep-secure/bypass-traverse-checking.md b/windows/keep-secure/bypass-traverse-checking.md index b0d84bfa72..17fb337e5a 100644 --- a/windows/keep-secure/bypass-traverse-checking.md +++ b/windows/keep-secure/bypass-traverse-checking.md @@ -2,48 +2,29 @@ title: Bypass traverse checking (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Bypass traverse checking security policy setting. ms.assetid: 1c828655-68d3-4140-aa0f-caa903a7087e +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Bypass traverse checking - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Bypass traverse checking** security policy setting. - ## Reference - - This policy setting determines which users (or a process that acts on behalf of the user’s account) have permission to navigate an object path in the NTFS file system or in the registry without being checked for the Traverse Folder special access permission. This user right does not allow the user to list the contents of a folder. It only allows the user to traverse folders to access permitted files or subfolders. - Constant: SeChangeNotifyPrivilege - ### Possible values - - User-defined list of accounts - - Not Defined - ### Best practices - 1. Use access–based enumeration when you want to prevent users from seeing any folder or file to which they do not have access. - 2. Use the default settings of this policy in most cases. If you change the settings, verify your intent through testing. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - @@ -107,59 +88,27 @@ The following table lists the actual and effective default policy values. Defaul
-   - ## Policy management - - Permissions to files and folders are controlled though the appropriate configuration of file system access control lists (ACLs).The ability to traverse the folder does not provide any Read or Write permissions to the user. - A restart of the computer is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - ### Group Policy - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - The default configuration for the **Bypass traverse checking** setting is to allow all users to bypass traverse checking. Permissions to files and folders are controlled though the appropriate configuration of file system access control lists (ACLs) because the ability to traverse the folder does not provide any Read or Write permissions to the user. The only scenario in which the default configuration could lead to a mishap would be if the administrator who configures permissions does not understand how this policy setting works. For example, the administrator might expect that users who are unable to access a folder are unable to access the contents of any child folders. Such a situation is unlikely, and, therefore, this vulnerability presents little risk. - ### Countermeasure - Organizations that are extremely concerned about security may want to remove the Everyone group, and perhaps the Users group, from the list of groups that have the **Bypass traverse checking** user right. Taking explicit control over traversal assignments can be an effective way to limit access to sensitive information. Access–based enumeration can also be used. If you use access–based enumeration, users cannot see any folder or file to which they do not have access. For more info about this feature, see [Access-based Enumeration](http://go.microsoft.com/fwlink/p/?LinkId=100745). - ### Potential impact - The Windows operating systems and many applications were designed with the expectation that anyone who can legitimately access the computer will have this user right. Therefore, we recommend that you thoroughly test any changes to assignments of the **Bypass traverse checking** user right before you make such changes to production systems. In particular, IIS requires this user right to be assigned to the Network Service, Local Service, IIS\_WPG, IUSR\_*<ComputerName>*, and IWAM\_*<ComputerName>* accounts. (It must also be assigned to the ASPNET account through its membership in the Users group.) We recommend that you leave this policy setting at its default configuration. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/change-the-system-time.md b/windows/keep-secure/change-the-system-time.md index e654e9d952..f34f347c76 100644 --- a/windows/keep-secure/change-the-system-time.md +++ b/windows/keep-secure/change-the-system-time.md @@ -2,48 +2,29 @@ title: Change the system time (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Change the system time security policy setting. ms.assetid: f2f6637d-acbc-4352-8ca3-ec563f918e65 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Change the system time - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Change the system time** security policy setting. - ## Reference - - This policy setting determines which users can adjust the time on the device's internal clock. This right allows the computer user to change the date and time associated with records in the event logs, database transactions, and the file system. This right is also required by the process that performs time synchronization. This setting does not impact the user’s ability to change the time zone or other display characteristics of the system time. For info about assigning the right to change the time zone, see [Change the time zone](change-the-time-zone.md). - Constant: SeSystemtimePrivilege - ### Possible values - - User-defined list of accounts - - Not Defined - ### Best practices - - Restrict the **Change the system time** user right to users with a legitimate need to change the system time. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - By default, members of the Administrators and Local Service groups have this right on workstations and servers. Members of the Administrators, Server Operators, and Local Service groups have this right on domain controllers. - The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - @@ -89,81 +70,38 @@ The following table lists the actual and effective default policy values. Defaul
-   - ## Policy management - - This section describes features, tools and guidance to help you manage this policy. - A restart of the device is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - ### Group Policy - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Users who can change the time on a computer could cause several problems. For example: - - Time stamps on event log entries could be made inaccurate - - Time stamps on files and folders that are created or modified could be incorrect - - Computers that belong to a domain might not be able to authenticate themselves - - Users who try to log on to the domain from devices with inaccurate time might not be able to authenticate. - Also, because the Kerberos authentication protocol requires that the requester and authenticator have their clocks synchronized within an administrator-defined skew period, an attacker who changes a device's time may cause that computer to be unable to obtain or grant Kerberos protocol tickets. - The risk from these types of events is mitigated on most domain controllers, member servers, and end-user computers because the Windows Time Service automatically synchronizes time with domain controllers in the following ways: - - All desktop client devices and member servers use the authenticating domain controller as their inbound time partner. - - All domain controllers in a domain nominate the primary domain controller (PDC) emulator operations master as their inbound time partner. - - All PDC emulator operations masters follow the hierarchy of domains in the selection of their inbound time partner. - - The PDC emulator operations master at the root of the domain is authoritative for the organization. Therefore, we recommend that you configure this computer to synchronize with a reliable external time server. - This vulnerability becomes much more serious if an attacker is able to change the system time and then stop the Windows Time Service or reconfigure it to synchronize with a time server that is not accurate. - ### Countermeasure - Restrict the **Change the system time** user right to users with a legitimate need to change the system time, such as members of the IT team. - ### Potential impact - There should be no impact because time synchronization for most organizations should be fully automated for all computers that belong to the domain. Computers that do not belong to the domain should be configured to synchronize with an external source, such as a web service. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/change-the-time-zone.md b/windows/keep-secure/change-the-time-zone.md index 63a5424dc7..fafb6d6293 100644 --- a/windows/keep-secure/change-the-time-zone.md +++ b/windows/keep-secure/change-the-time-zone.md @@ -2,46 +2,28 @@ title: Change the time zone (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Change the time zone security policy setting. ms.assetid: 3b1afae4-68bb-472f-a43e-49e300d73e50 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Change the time zone - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Change the time zone** security policy setting. - ## Reference - - This policy setting determines which users can adjust the time zone that is used by the device for displaying the local time, which includes the device's system time plus the time zone offset. - Constant: SeTimeZonePrivilege - ### Possible values - - User-defined list of accounts - - Not Defined - ### Best practices - None. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - @@ -85,57 +67,26 @@ The following table lists the actual and effective default policy values for the
-   - ## Policy management - - A restart of the device is not required for this policy setting to be effective. - Any change to the account for this user right assignment becomes effective the next time the account logs on. - ### Group Policy - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Changing the time zone represents little vulnerability because the system time is not affected. This setting merely enables users to display their preferred time zone while being synchronized with domain controllers in different time zones. - ### Countermeasure - Countermeasures are not required because system time is not affected by this setting. - ### Potential impact - None. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/change-the-tpm-owner-password.md b/windows/keep-secure/change-the-tpm-owner-password.md index dbbd1ff048..e76c48aac1 100644 --- a/windows/keep-secure/change-the-tpm-owner-password.md +++ b/windows/keep-secure/change-the-tpm-owner-password.md @@ -2,96 +2,49 @@ title: Change the TPM owner password (Windows 10) description: This topic for the IT professional describes how to change the password or PIN for the owner of the Trusted Platform Module (TPM) that is installed on your system. ms.assetid: e43dcff3-acb4-4a92-8816-d6b64b7f2f45 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Change the TPM owner password - - **Applies to** - - Windows 10 - This topic for the IT professional describes how to change the password or PIN for the owner of the Trusted Platform Module (TPM) that is installed on your system. - ## About the TPM owner password - - The owner of the TPM is the user who possesses the owner password and is able to set it and change it. Only one owner password exists per TPM. The owner of the TPM can make full use of TPM capabilities. When an owner is set, no other user or software can claim ownership of the TPM. Only the TPM owner can enable, disable, or clear the TPM without having physical access to the computer, for example, by using the command-line tools remotely. Taking ownership of the TPM can be performed as part of the initialization process. Ownership can change when you share the password or clear your ownership of the TPM so someone else can initialize it. - Applications, including BitLocker Drive Encryption, can automatically start the initialization process. If you enable BitLocker without manually initializing the TPM, the TPM owner password is automatically created and saved in the same location as the BitLocker recovery password. - The TPM owner password can be saved as a file on a removable storage device, or on another computer. The password can also be printed. The TPM MMC gives the TPM owner the sole ability to choose the appropriate option to type the password or to use the saved password. - As with any password, you should change your TPM owner password if you suspect that it has become compromised and is no longer a secret. - **Other TPM management options** - Instead of changing your owner password, you can also use the following options to manage your TPM: - - **Clear the TPM**   If you want to invalidate all of the existing keys that have been created since you took ownership of the TPM, you can clear it. For more info, see [Initialize and Configure Ownership of the TPM](initialize-and-configure-ownership-of-the-tpm.md#bkmk-clear1). - **Important**   Clearing the TPM can result in the loss of data. To avoid data loss, make sure you have a backup or recovery method for any data protected or encrypted by the TPM. -   - - **Turn off the TPM**   If you want to keep all existing keys and data intact, and you want to disable the services that are provided by the TPM, you can turn it off. For more info, see [Initialize and Configure Ownership of the TPM](initialize-and-configure-ownership-of-the-tpm.md#bkmk-onoff). - ## Change the TPM owner password - - The following procedure provides the steps that are necessary to change the TPM owner password. - **To change the TPM owner password** - 1. Open the TPM MMC (tpm.msc). If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. - 2. In the **Actions** pane, click **Change Owner Password**. - 3. In the **Manage the TPM security hardware** dialog box, select a method to enter your current TPM owner password. - - If you saved your TPM owner password on a removable storage device, insert it, and then click **I have the owner password file**. In the **Select backup file with the TPM owner password** dialog box, use **Browse** to navigate to the .tpm file that is saved on your removable storage device. Click **Open**, and then click **Create New Password**. - - If you do not have the removable storage device with your saved password, click **I want to enter the owner password**. In the **Type your TPM owner password** dialog box, enter your password (including hyphens), and click **Create New Password**. - 4. On the **Create the TPM owner password** page, select a method for creating a new TPM owner password. - 1. Click **Automatically create the password** to have a new owner password generated for you. - 2. Click **Manually create the password** if you want to specify a password. - **Note**   The TPM owner password must have a minimum of eight characters. -   - 5. After the new password is created, you can choose **Save the password** to save the password in a password backup file on a removable storage device or **Print the password** to print a copy of the password for later reference. - 6. Click **Change password** to apply the new owner password to the TPM. - ## Use the TPM cmdlets - - If you are using Windows PowerShell to manage your computers, you can also manage the TPM by using Windows PowerShell. To install the TPM cmdlets, type the following command: - **dism /online /enable-feature /FeatureName:tpm-psh-cmdlets** - For details about the individual cmdlets, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx). - ## Additional resources - - For more info about TPM, see [Trusted Platform Module technology overview](trusted-platform-module-overview.md#bkmk-additionalresources). -   -   - - - - - diff --git a/windows/keep-secure/choose-the-right-bitlocker-countermeasure.md b/windows/keep-secure/choose-the-right-bitlocker-countermeasure.md index c59d12e4db..374b255db6 100644 --- a/windows/keep-secure/choose-the-right-bitlocker-countermeasure.md +++ b/windows/keep-secure/choose-the-right-bitlocker-countermeasure.md @@ -2,61 +2,32 @@ title: Choose the right BitLocker countermeasure (Windows 10) description: This section outlines the best countermeasures you can use to protect your organization from bootkits and rootkits, brute force sign-in, Direct Memory Access (DMA) attacks, Hyberfil.sys attacks, and memory remanence attacks. ms.assetid: b0b09508-7885-4030-8c61-d91458afdb14 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Choose the right BitLocker countermeasure - - **Applies to** - - Windows 10 - This section outlines the best countermeasures you can use to protect your organization from bootkits and rootkits, brute force sign-in, Direct Memory Access (DMA) attacks, Hyberfil.sys attacks, and memory remanence attacks. - You can use BitLocker to protect your Windows 10 PCs. Whichever operating system you’re using, Microsoft and Windows-certified devices provide countermeasures to address attacks and improve your data security. In most cases, this protection can be implemented without the need for pre-boot authentication. - Figures 2, 3, and 4 summarize the recommended mitigations for different types of attacks against PCs running recent versions of Windows. The orange blocks indicate that the system requires additional configuration from the default settings. - ![how to choose best countermeasures for windows 7](images/bitlockerprebootprotection-counterwin7.jpg) - **Figure 2.** How to choose the best countermeasures for Windows 7 - ![how to choose countermeasures for windows 8](images/bitlockerprebootprotection-counterwin8.jpg) - **Figure 3.** How to choose the best countermeasures for Windows 8 - ![how to choose countermeasures for windows 8.1](images/bitlockerprebootprotection-counterwin81.jpg) - **Figure 4.** How to choose the best countermeasures for Windows 8.1 - The latest InstantGo devices, primarily tablets, are designed to be secure by default against all attacks that might compromise the BitLocker encryption key. Other Windows devices can be, too. DMA port–based attacks, which represent the attack vector of choice, are not possible on InstantGo devices, because these port types are prohibited. The inclusion of DMA ports on even non-InstantGo devices is extremely rare on recent devices, particularly on mobile ones. This could change if Thunderbolt is broadly adopted, so IT should consider this when purchasing new devices. In any case DMA ports can be disabled entirely, which is an increasingly popular option because the use of DMA ports is infrequent in the non-developer space. - Memory remanence attacks can be mitigated with proper configuration; in cases where the system memory is fixed and non-removable, they are not possible using published techniques. Even in cases where system memory can be removed and loaded into another device, attackers will find the attack vector extremely unreliable, as has been shown in the DRDC Valcartier group’s analysis (see [An In-depth Analysis of the Cold Boot Attack](http://www.dtic.mil/cgi-bin/GetTRDoc?AD=ADA545078)). - Windows 7 PCs share the same security risks as newer devices but are far more vulnerable to DMA and memory remanence attacks, because Windows 7 devices are more likely to include DMA ports, lack support for UEFI-based Secure Boot, and rarely have fixed memory. To eliminate the need for pre-boot authentication on Windows 7 devices, disable the ability to boot to external media, password-protect the BIOS configuration, and disable the DMA ports. If you believe that your devices may be a target of a memory remanence attack, where the system memory may be removed and put into another computer to gain access to its contents, consider testing your devices to determine whether they are susceptible to this type of attack. - In the end, many customers will find that pre-boot authentication improves security only for a shrinking subset of devices within their organization. Microsoft recommends a careful examination of the attack vectors and mitigations outlined in this document along with an evaluation of your devices before choosing to implement pre-boot authentication, which may not enhance the security of your devices and instead will only compromise the user experience and add to support costs. - ## See also - - - [Types of attacks for volume encryption keys](types-of-attacks-for-volume-encryption-keys.md) - - [BitLocker Countermeasures](bitlocker-countermeasures.md) - - [Protect BitLocker from pre-boot attacks](protect-bitlocker-from-pre-boot-attacks.md) - - [BitLocker overview](bitlocker-overview.md) -   -   - - - - - diff --git a/windows/keep-secure/configure-an-applocker-policy-for-audit-only.md b/windows/keep-secure/configure-an-applocker-policy-for-audit-only.md index f554bbf9cb..5de6e0fbde 100644 --- a/windows/keep-secure/configure-an-applocker-policy-for-audit-only.md +++ b/windows/keep-secure/configure-an-applocker-policy-for-audit-only.md @@ -2,47 +2,26 @@ title: Configure an AppLocker policy for audit only (Windows 10) description: This topic for IT professionals describes how to set AppLocker policies to Audit only within your IT environment by using AppLocker. ms.assetid: 10bc87d5-cc7f-4500-b7b3-9006e50afa50 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Configure an AppLocker policy for audit only - - **Applies to** - - Windows 10 - This topic for IT professionals describes how to set AppLocker policies to **Audit only** within your IT environment by using AppLocker. - After AppLocker rules are created within the rule collection, you can configure the enforcement setting to **Enforce rules** or **Audit only**. - When AppLocker policy enforcement is set to **Enforce rules**, rules are enforced for the rule collection and all events are audited. When AppLocker policy enforcement is set to **Audit only**, rules are only evaluated but all events generated from that evaluation are written to the AppLocker log. - **Note**   There is no audit mode for the DLL rule collection. DLL rules affect specific apps. Therefore, test the impact of these rules first before deploying them to production. To enable the DLL rule collection, see [Enable the DLL rule collection](enable-the-dll-rule-collection.md). -   - You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). - **To audit rule collections** - 1. From the AppLocker console, right-click **AppLocker**, and then click **Properties**. - 2. On the **Enforcement** tab, select the **Configured** check box for the rule collection that you want to enforce, and then verify that **Audit only** is selected in the list for that rule collection. - 3. Repeat the above step to configure the enforcement setting to **Audit only** for additional rule collections. - 4. Click **OK**. -   -   - - - - - diff --git a/windows/keep-secure/configure-an-applocker-policy-for-enforce-rules.md b/windows/keep-secure/configure-an-applocker-policy-for-enforce-rules.md index acea4f15df..cd7c80e04b 100644 --- a/windows/keep-secure/configure-an-applocker-policy-for-enforce-rules.md +++ b/windows/keep-secure/configure-an-applocker-policy-for-enforce-rules.md @@ -2,45 +2,25 @@ title: Configure an AppLocker policy for enforce rules (Windows 10) description: This topic for IT professionals describes the steps to enable the AppLocker policy enforcement setting. ms.assetid: 5dbbb290-a5ae-4f88-82b3-21e95972e66c +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Configure an AppLocker policy for enforce rules - - **Applies to** - - Windows 10 - This topic for IT professionals describes the steps to enable the AppLocker policy enforcement setting. - **Note**   When AppLocker policy enforcement is set to **Enforce rules**, rules are enforced for the rule collection and all events are audited. -   - For info about how AppLocker policies are applied within a GPO structure, see [Understand AppLocker rules and enforcement setting inheritance in Group Policy](understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md). - You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). - **To enable the Enforce rules enforcement setting** - 1. From the AppLocker console, right-click **AppLocker**, and then click **Properties**. - 2. On the **Enforcement** tab of the **AppLocker Properties** dialog box, select the **Configured** check box for the rule collection that you are editing, and then verify that **Enforce rules** is selected. - 3. Click **OK**. - For info about viewing the events generated from rules enforcement, see [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md). -   -   - - - - - diff --git a/windows/keep-secure/configure-exceptions-for-an-applocker-rule.md b/windows/keep-secure/configure-exceptions-for-an-applocker-rule.md index 126647dac7..34f5707623 100644 --- a/windows/keep-secure/configure-exceptions-for-an-applocker-rule.md +++ b/windows/keep-secure/configure-exceptions-for-an-applocker-rule.md @@ -2,48 +2,26 @@ title: Add exceptions for an AppLocker rule (Windows 10) description: This topic for IT professionals describes the steps to specify which apps can or cannot run as exceptions to an AppLocker rule. ms.assetid: d15c9d84-c14b-488d-9f48-bf31ff7ff0c5 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Add exceptions for an AppLocker rule - - **Applies to** - - Windows 10 - This topic for IT professionals describes the steps to specify which apps can or cannot run as exceptions to an AppLocker rule. - Rule exceptions allow you to specify files or folders to exclude from the rule. For more information about exceptions, see [Understanding AppLocker rule exceptions](understanding-applocker-rule-exceptions.md). - You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). - **To configure exceptions for a rule** - 1. Open the AppLocker console. - 2. Expand the rule collection, right-click the rule that you want to configure exceptions for, and then click **Properties**. - 3. Click the **Exceptions** tab. - 4. In the **Add exception** box, select the rule type that you want to create, and then click **Add**. - - For a publisher exception, click **Browse**, select the file that contains the publisher to exclude, and then click **OK**. - - For a path exception, choose the file or folder path to exclude, and then click **OK**. - - For a file hash exception, edit the file hash rule, and click **Remove**. - - For a packaged apps exception, click **Add** to create the exceptions based on reference app and rule scope. -   -   - - - - - diff --git a/windows/keep-secure/configure-s-mime.md b/windows/keep-secure/configure-s-mime.md index 205f3823db..0f76c34cac 100644 --- a/windows/keep-secure/configure-s-mime.md +++ b/windows/keep-secure/configure-s-mime.md @@ -2,103 +2,55 @@ title: Configure S/MIME for Windows 10 and Windows 10 Mobile (Windows 10) description: In Windows 10, S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients who have a digital identification (ID), also known as a certificate, can read them. ms.assetid: 7F9C2A99-42EB-4BCC-BB53-41C04FBBBF05 +ms.pagetype: security keywords: ["encrypt", "digital signature"] ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: jdeckerMS --- - # Configure S/MIME for Windows 10 and Windows 10 Mobile - - **Applies to** - - Windows 10 - Windows 10 Mobile - S/MIME stands for Secure/Multipurpose Internet Mail Extensions, and provides an added layer of security for email sent to and from an Exchange ActiveSync (EAS) account. In Windows 10, S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients who have a digital identification (ID), also known as a certificate, can read them. Users can digitally sign a message, which provides the recipients with a way to verify the identity of the sender and that the message hasn't been tampered with. - ## About message encryption - - Users can send encrypted message to people in their organization and people outside their organization if they have their encryption certificates. However, users using Windows 10 Mail app can only read encrypted messages if the message is received on their Exchange account and they have corresponding decryption keys. - Encrypted messages can be read only by recipients who have a certificate. If you try to send an encrypted message to recipient(s) whose encryption certificate are not available, the app will prompt you to remove these recipients before sending the email. - ## About digital signatures - - A digitally signed message reassures the recipient that the message hasn't been tampered with and verifies the identity of the sender. Recipients can only verify the digital signature if they’re using an email client that supports S/MIME. - ## Prerequisites - - - [S/MIME is enabled for Exchange accounts](http://go.microsoft.com/fwlink/p/?LinkId=718217) (on-premises and Office 365). Users can’t use S/MIME signing and encryption with a personal account such as Outlook.com. - Valid Personal Information Exchange (PFX) certificates are installed on the device. - - [How to Create PFX Certificate Profiles in Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkID=718215) - [Enable access to company resources using certificate profiles with Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkId=718216) - [Install digital certificates on Windows 10 Mobile](installing-digital-certificates-on-windows-10-mobile.md) - ## Choose S/MIME settings - - On the device, perform the following steps: (add select certificate) - 1. Open the Mail app. (In Windows 10 Mobile, the app is Outlook Mail.) 2. Open **Settings** by tapping the gear icon on a PC, or the ellipsis (...) and then the gear icon on a phone. - ![settings icon in mail app](images/mailsettings.png) - 3. Tap **Email security**. - ![email security settings](images/emailsecurity.png) - 4. In **Select an account**, select the account for which you want to configure S/MIME options. 5. Make a certificate selection for digital signature and encryption. - - Select **Automatically** to let the app choose the certificate. - Select **Manually** to specify the certificate yourself from the list of valid certificates on the device. - 6. (Optional) Select **Always sign with S/MIME**, **Always encrypt with S/MIME**, or both, to automatically digitally sign or encrypt all outgoing messages. **Note**  The option to sign or encrypt can be changed for individual messages, unless EAS policies prevent it. -   - 7. Tap the back arrow. - ## Encrypt or sign individual messages - - 1. While composing a message, choose **Options** from the ribbon. On phone, **Options** can be accessed by tapping the the ellipsis (...). 2. Use **Sign** and **Encrypt** icons to turn on digital signature and encryption for this message. - ![sign or encrypt message](images/signencrypt.png) - ## Read signed or encrypted messages - - When you receive an encrypted message, the mail app will check whether there is a certificate available on your computer. If there is a certificate available, the message will be decrypted when you open it. If your certificate is stored on a smartcard, you will be prompted to insert the smartcard to read the message. Your smartcard may also require a PIN to access the certificate. - ## Install certificates from a received message - - When you receive a signed email, the app provide feature to install corresponding encryption certificate on your device if the certificate is available. This certificate can then be used to send encrypted email to this person. - 1. Open a signed email. - 2. Tap or click the digital signature icon in the reading pane. - 3. Tap **Install.** - ![message security information](images/installcert.png) -   -   - - - - - diff --git a/windows/keep-secure/configure-the-appLocker-reference-device.md b/windows/keep-secure/configure-the-appLocker-reference-device.md index 3d1f849430..d3dd0de7e5 100644 --- a/windows/keep-secure/configure-the-appLocker-reference-device.md +++ b/windows/keep-secure/configure-the-appLocker-reference-device.md @@ -2,66 +2,36 @@ title: Configure the AppLocker reference device (Windows 10) description: This topic for the IT professional describes the steps to create an AppLocker policy platform structure on a reference computer. ms.assetid: 034bd367-146d-4956-873c-e1e09e6fefee +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Configure the AppLocker reference device - - **Applies to** - - Windows 10 - This topic for the IT professional describes the steps to create an AppLocker policy platform structure on a reference computer. - An AppLocker reference device that is used for the development and deployment of AppLocker policies should mimic the directory structure and corresponding applications in the organizational unit (OU) or business group for the production environment. On a reference device, you can: - - Maintain an application list for each business group. - - Develop AppLocker policies by creating individual rules or by creating a policy by automatically generating rules. - - Create the default rules to allow the Windows system files to run properly. - - Run tests and analyze the event logs to determine the affect of the policies that you intend to deploy. - The reference device does not need to be joined to a domain, but it must be able to import and export AppLocker policies in XML format. The reference computer must be running one of the supported editions of Windows as listed in [Requirements to use AppLocker](requirements-to-use-applocker.md). - **Warning**   Do not use operating system snapshots when creating AppLocker rules. If you take a snapshot of the operating system, install an app, create AppLocker rules, and then revert to a clean snapshot and repeat the process for another app, there is a chance that duplicate rule GUIDs can be created. If duplicate GUIDs are present, AppLocker policies will not work as expected. -   - **To configure a reference device** - 1. If the operating system is not already installed, install one of the supported editions of Windows on the device. - **Note**   If you have the Group Policy Management Console (GPMC) installed on another device to test your implementation of AppLocker policies, you can export the policies to that device -   - 2. Configure the administrator account. - To update local policies, you must be a member of the local Administrators group. To update domain policies, you must be a member of the Domain Admins group or have been delegated privileges to use Group Policy to update a Group Policy Object (GPO). - 3. Install all apps that run in the targeted business group or OU by using the same directory structure. - The reference device should be configured to mimic the structure of your production environment. It depends on having the same apps in the same directories to accurately create the rules. - ### See also - - After you configure the reference computer, you can create the AppLocker rule collections. You can build, import, or automatically generate the rules. For procedures to do this, see [Working with AppLocker rules](working-with-applocker-rules.md). - - [Use a reference device to create and maintain AppLocker policies](use-a-reference-computer-to-create-and-maintain-applocker-policies.md) -   -   - - - - - diff --git a/windows/keep-secure/configure-the-application-identity-service.md b/windows/keep-secure/configure-the-application-identity-service.md index d09240e41c..b6aad003cd 100644 --- a/windows/keep-secure/configure-the-application-identity-service.md +++ b/windows/keep-secure/configure-the-application-identity-service.md @@ -2,55 +2,30 @@ title: Configure the Application Identity service (Windows 10) description: This topic for IT professionals shows how to configure the Application Identity service to start automatically or manually. ms.assetid: dc469599-37fd-448b-b23e-5b8e4f17e561 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Configure the Application Identity service - - **Applies to** - - Windows 10 - This topic for IT professionals shows how to configure the Application Identity service to start automatically or manually. - The Application Identity service determines and verifies the identity of an app. Stopping this service will prevent AppLocker policies from being enforced. - **Important**   When using Group Policy, you must configure it to start automatically in at least one Group Policy Object (GPO) that applies AppLocker rules. This is because AppLocker uses this service to verify the attributes of a file. -   - **To start the Application Identity service automatically using Group Policy** - 1. On the **Start** screen, type **gpmc.msc** to open the Group Policy Management Console (GPMC). - 2. Locate the GPO to edit, right-click the GPO, and then click **Edit**. - 3. In the console tree under **Computer Configuration\\Windows Settings\\Security Settings**, click **System Services**. - 4. In the details pane, double-click **Application Identity**. - 5. In **Application Identity Properties**, configure the service to start automatically. - Membership in the local **Administrators** group, or equivalent, is the minimum required to complete this procedure. - **To start the Application Identity service manually** - 1. Right-click the taskbar, and click **Task Manager**. - 2. Click the **Services** tab, right-click **AppIDSvc**, and then click **Start Service**. - 3. Verify that the status for the Application Identity service is **Running**. -   -   - - - - - diff --git a/windows/keep-secure/configure-windows-defender-in-windows-10.md b/windows/keep-secure/configure-windows-defender-in-windows-10.md index 73036c2430..b4f9e3572b 100644 --- a/windows/keep-secure/configure-windows-defender-in-windows-10.md +++ b/windows/keep-secure/configure-windows-defender-in-windows-10.md @@ -2,54 +2,34 @@ title: Configure Windows Defender in Windows 10 (Windows 10) description: IT professionals can configure definition updates and cloud-based protection in Windows Defender in Windows 10 through Microsoft Active Directory and Windows Server Update Services (WSUS). ms.assetid: 22649663-AC7A-40D8-B1F7-5CAD9E49653D +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library author: jasesso --- - # Configure Windows Defender in Windows 10 - - **Applies to** - - Windows 10 - IT professionals can configure definition updates and cloud-based protection in Windows Defender in Windows 10 through Microsoft Active Directory and Windows Server Update Services (WSUS). - ## Configure definition updates - - It is important to update definitions regularly to ensure that your endpoints are protected. Definition updates can be configured to suit the requirements of your organization. - Windows Defender supports the same updating options (such as using multiple definition sources) as other Microsoft endpoint protection products; for more information, see [Configuring Definition Updates](https://technet.microsoft.com/library/gg412502.aspx). - When you configure multiple definition sources in Windows Defender, you can configure the fallback order using the following values through *Group Policy* settings: - - InternalDefinitionUpdateServer - WSUS - MicrosoftUpdateServer - Microsoft Update - MMPC - [Microsoft Malware Protection Center definitions page](http://www.microsoft.com/security/portal/definitions/adl.aspx) - FileShares - file share - Read about deploying administrative template files for Windows Defender in the article [Description of the Windows Defender Group Policy administrative template settings](https://support.microsoft.com/kb/927367). - You can also manage your Windows Defender update configuration settings through System Center Configuration Manager. See [How to Configure Definition Updates for Endpoint Protection in Configuration Manager](https://technet.microsoft.com/library/jj822983.aspx) for details. - ## Definition update logic - - You can update Windows Defender definitions in four ways depending on your business requirements: - - WSUS, the managed server. You can manage the distribution of updates that are released through Microsoft Update to computers in your enterprise environment; read more on the [Windows Server Update Services](https://technet.microsoft.com/windowsserver/bb332157.aspx) website. - Microsoft Update, the unmanaged server. You can use this method to get regular updates from Microsoft Update. - The [Microsoft Malware Protection Center definitions page](http://www.microsoft.com/security/portal/definitions/adl.aspx), as an alternate download location. You can use this method if you want to download the latest definitions. - File share, where the definition package is downloaded. You can retrieve definition updates from a file share. The file share must be provisioned on a regular basis with the update files. - ## Update Windows Defender definitions through Active Directory and WSUS - - This section details how to update Windows Defender definitions for Windows 10 endpoints through Active Directory and WSUS. - @@ -127,99 +107,52 @@ This section details how to update Windows Defender definitions for Windows 10
-   - ## Manage cloud-based protection - - Windows Defender offers improved cloud-based protection and threat intelligence for endpoint protection clients using the Microsoft Active Protection Service. Read more about the Microsoft Active Protection Service community in [Join the Microsoft Active Protection Service community](http://windows.microsoft.com/windows-8/join-maps-community). - You can enable or disable the Microsoft Active Protection Service using *Group Policy* settings and administrative template files. - More information on deploying administrative template files for Windows Defender is available in the article [Description of the Windows Defender Group Policy administrative template settings](https://support.microsoft.com/kb/927367). - The Microsoft Active Protection Service can be configured with the following *Group Policy* settings: - 1. Open the **Group Policy Editor**. 2. In the **Local Computer Policy** tree, expand **Computer Configuration**, then **Administrative Templates**, then **Windows Components**, then **Windows Defender**. 3. Click on **MAPS**. 4. Double-click on **Join Microsoft MAPS**. 5. Select your configuration option from the **Join Microsoft MAPS** list. **Note**  Any settings modified on an endpoint will be overridden by the administrator's policy setting. -   - Use the Windowsdefender.adm *Group Policy* template file to control the policy settings for Windows Defender in Windows 10: - Policy setting: **Configure Microsoft SpyNet Reporting** - Registry key name: **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\SpyNet\\SpyNetReporting** - Policy description: **Adjusts membership in Microsoft Active Protection Service** - You can also configure preferences using the following PowerShell parameters: - - Turn Microsoft Active Protection Service off: *Set-MpPreference -MAPSReporting 0* - Turn Microsoft Active Protection Service on: *Set-MpPreference -MAPSReporting 2* - Read more about this in: - - [Scripting with Windows PowerShell](https://technet.microsoft.com/library/bb978526.aspx) - [Defender Cmdlets](https://technet.microsoft.com/library/dn433280.aspx) - **Note**  Any information that Windows Defender collects is encrypted in transit to our servers, and then stored in secure facilities. Microsoft takes several steps to avoid collecting any information that directly identifies you, such as your name, email address, or account ID. -   - Read more about how to manage your privacy settings in [Setting your preferences for Windows 10 services](http://windows.microsoft.com/windows-10/services-setting-preferences). - ## Opt-in to Microsoft Update - - You can use Microsoft Update to keep definitions on mobile computers running Windows Defender in Windows 10 up to date when they are not connected to the corporate network. If the mobile computer doesn't have a [Windows Server Update Service](https://technet.microsoft.com/windowsserver/bb332157.aspx) (WSUS) connection, the signatures will still come from Microsoft Update. This means that signatures can be pushed down (via Microsoft Update) even if WSUS overrides Windows Update. - You need to opt-in to Microsoft Update on the mobile computer before it can retrieve the definition updates from Microsoft Update. - There are two ways you can opt-in to Microsoft Update in Windows Defender for Windows 10: - 1. Use a VBScript to create a script, then run it on each computer in your network. 2. Manually opt-in every computer on your network through the **Settings** menu. - You can create a VBScript and run it on each computer on your network; this is an efficient way to opt-in to Microsoft Update. - **Use a VBScript to opt in to Microsoft Update** - 1. Use the instructions in the MSDN article [Opt-In to Microsoft Update](https://msdn.microsoft.com/library/windows/desktop/aa826676.aspx) to create the VBScript. 2. Run the VBScript you created on each computer in your network. - You can manually opt-in each individual computer on your network to receive Microsoft Update. - **Manually opt-in to Microsoft Update** - 1. Open **Windows Update** in **Update & security** settings on the computer you want to opt-in. 2. Click **Advanced** options. 3. Select the checkbox for **Give me updates for other Microsoft products when I update Windows**. - ## Schedule updates for Microsoft Update - - Opting-in to Microsoft Update means that your system administrator can schedule updates to your mobile computer, so that it keeps up-to-date with the latest software versions and security definitions, even when you’re on the road. - For more information on scheduling updates, see [Configure definition updates](https://technet.microsoft.com/library/mt622088.aspx#configure-definition-updates). - ## Related topics - - [Update and manage Windows Defender in Windows 10](get-started-with-windows-defender-for-windows-10.md) - [Troubleshoot Windows Defender in Windows 10](troubleshoot-windows-defender-in-windows-10.md) -   -   - - - - - diff --git a/windows/keep-secure/create-a-basic-audit-policy-settings-for-an-event-category.md b/windows/keep-secure/create-a-basic-audit-policy-settings-for-an-event-category.md index bf422552a0..08b1dfb88d 100644 --- a/windows/keep-secure/create-a-basic-audit-policy-settings-for-an-event-category.md +++ b/windows/keep-secure/create-a-basic-audit-policy-settings-for-an-event-category.md @@ -2,36 +2,26 @@ title: Create a basic audit policy for an event category (Windows 10) description: By defining auditing settings for specific event categories, you can create an auditing policy that suits the security needs of your organization. ms.assetid: C9F52751-B40D-482E-BE9D-2C61098249D3 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Create a basic audit policy for an event category - - **Applies to** - - Windows 10 - By defining auditing settings for specific event categories, you can create an auditing policy that suits the security needs of your organization. On devices that are joined to a domain, auditing settings for the event categories are undefined by default. On domain controllers, auditing is turned on by default. - To complete this procedure, you must be logged on as a member of the built-in Administrators group. - **To define or modify auditing policy settings for an event category for your local computer** - 1. Open the Local Security Policy snap-in (secpol.msc), and then click **Local Policies**. 2. Click **Audit Policy**. 3. In the results pane, double-click an event category that you want to change the auditing policy settings for. 4. Do one or both of the following, and then click **OK.** - To audit successful attempts, select the **Success** check box. - To audit unsuccessful attempts, select the **Failure** check box. - To complete this procedure, you must be logged on as a member of the Domain Admins group. - **To define or modify auditing policy settings for an event category for a domain or organizational unit, when you are on a member server or on a workstation that is joined to a domain** - 1. Open the Group Policy Management Console (GPMC). 2. In the console tree, double-click **Group Policy objects** in the forest and domain containing the **Default Domain Policy** Group Policy object (GPO) that you want to edit. 3. Right-click the **Default Domain Policy** GPO, and then click **Edit**. @@ -41,19 +31,9 @@ To complete this procedure, you must be logged on as a member of the Domain Admi 7. Do one or both of the following, and then click **OK.** - To audit successful attempts, select the **Success** check box. - To audit unsuccessful attempts, select the **Failure** check box. - ## Additional considerations - - - To audit object access, enable auditing of the object access event category by following the steps above. Then, enable auditing on the specific object. - After your audit policy is configured, events will be recorded in the Security log. Open the Security log to view these events. - The default auditing policy setting for domain controllers is **No Auditing**. This means that even if auditing is enabled in the domain, the domain controllers do not inherit auditing policy locally. If you want domain auditing policy to apply to domain controllers, you must modify this policy setting. -   -   - - - - - diff --git a/windows/keep-secure/create-a-pagefile.md b/windows/keep-secure/create-a-pagefile.md index ffa275db74..31839c324f 100644 --- a/windows/keep-secure/create-a-pagefile.md +++ b/windows/keep-secure/create-a-pagefile.md @@ -2,50 +2,30 @@ title: Create a pagefile (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Create a pagefile security policy setting. ms.assetid: dc087897-459d-414b-abe0-cd86c8dccdea +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Create a pagefile - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Create a pagefile** security policy setting. - ## Reference - - Windows designates a section of the hard drive as virtual memory known as the page file, or more specifically, as pagefile.sys. It is used to supplement the computer’s Random Access Memory (RAM) to improve performance for programs and data that are used frequently. Although the file is hidden from browsing, you can manage it using the system settings. - This policy setting determines which users can create and change the size of a page file. It determines whether users can specify a page file size for a particular drive in the **Performance Options** box located on the **Advanced** tab of the **System Properties** dialog box or through using internal application interfaces (APIs). - Constant: SeCreatePagefilePrivilege - ### Possible values - - User-defined list of accounts - - Administrators - ### Best practices - - Restrict the **Create a pagefile** user right to Administrators, which is the default. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - By default, members of the Administrators group have this right. - The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - @@ -84,57 +64,26 @@ The following table lists the actual and effective default policy values for the
-   - ## Policy management - - A restart of the device is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - ### Group Policy - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Users who can change the page file size could make it extremely small or move the file to a highly fragmented storage volume, which could cause reduced device performance. - ### Countermeasure - Restrict the **Create a pagefile** user right to members of the Administrators group. - ### Potential impact - None. Restricting this right to members of the Administrators group is the default configuration. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/create-a-rule-for-packaged-apps.md b/windows/keep-secure/create-a-rule-for-packaged-apps.md index f16c4fcee9..2474296f59 100644 --- a/windows/keep-secure/create-a-rule-for-packaged-apps.md +++ b/windows/keep-secure/create-a-rule-for-packaged-apps.md @@ -2,47 +2,29 @@ title: Create a rule for packaged apps (Windows 10) description: This topic for IT professionals shows how to create an AppLocker rule for packaged apps with a publisher condition. ms.assetid: e4ffd400-7860-47b3-9118-0e6853c3dfa0 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Create a rule for packaged apps - - **Applies to** - - Windows 10 - This topic for IT professionals shows how to create an AppLocker rule for packaged apps with a publisher condition. - Packaged apps, also known as Universal Windows apps, are based on an app model that ensures that all the files within an app package share the same identity. Therefore, it is possible to control the entire app using a single AppLocker rule as opposed to the non-packaged apps where each file within the app could have a unique identity. Windows does not support unsigned packaged apps which implies all packaged apps must be signed. AppLocker supports only publisher rules for packaged apps. A publisher rule for a packaged app is based on the following information: - - Publisher of the package - - Package name - - Package version - All the files within a package as well as the package installer share these attributes. Therefore, an AppLocker rule for a packaged app controls both the installation as well as the running of the app. Otherwise, the publisher rules for packaged apps are no different than the rest of the rule collections; they support exceptions, can be increased or decreased in scope, and can be assigned to users and groups. - For info about the publisher condition, see [Understanding the publisher rule condition in AppLocker](understanding-the-publisher-rule-condition-in-applocker.md). - You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). - **To create a packaged app rule** - 1. Open the AppLocker console. - 2. On the **Action** menu, or by right-clicking on **Packaged app Rules**, click **Create New Rule**. - 3. On the **Before You Begin** page, click **Next**. - 4. On the **Permissions** page, select the action (allow or deny) and the user or group that the rule should apply to, and then click **Next**. - 5. On the **Publisher** page, you can select a specific reference for the packaged app rule and set the scope for the rule. The following table describes the reference options. - @@ -69,11 +51,8 @@ You can perform this task by using the Group Policy Management Console for an Ap
-   - The following table describes setting the scope for the packaged app rule. - @@ -116,20 +95,9 @@ You can perform this task by using the Group Policy Management Console for an Ap
-   - 6. Click **Next**. - 7. (Optional) On the **Exceptions** page, specify conditions by which to exclude files from being affected by the rule. This allows you to add exceptions based on the same rule reference and rule scope as you set before. Click **Next**. - 8. On the **Name** page, either accept the automatically generated rule name or type a new rule name, and then click **Create**. -   -   - - - - - diff --git a/windows/keep-secure/create-a-rule-that-uses-a-file-hash-condition.md b/windows/keep-secure/create-a-rule-that-uses-a-file-hash-condition.md index 19f8350862..f5a2a1ed28 100644 --- a/windows/keep-secure/create-a-rule-that-uses-a-file-hash-condition.md +++ b/windows/keep-secure/create-a-rule-that-uses-a-file-hash-condition.md @@ -2,55 +2,30 @@ title: Create a rule that uses a file hash condition (Windows 10) description: This topic for IT professionals shows how to create an AppLocker rule with a file hash condition. ms.assetid: eb3b3524-1b3b-4979-ba5a-0a0b1280c5c7 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Create a rule that uses a file hash condition - - **Applies to** - - Windows 10 - This topic for IT professionals shows how to create an AppLocker rule with a file hash condition. - File hash rules use a system-computed cryptographic hash of the identified file. - For info about the file hash condition, see [Understanding the File Hash Rule Condition in AppLocker](understanding-the-file-hash-rule-condition-in-applocker.md). - You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). - **To create a new rule with a file hash condition** - 1. Open the AppLocker console, and then click the rule collection that you want to create the rule for. - 2. On the **Action** menu, click **Create New Rule**. - 3. On the **Before You Begin** page, click **Next**. - 4. On the **Permissions** page, select the action (allow or deny) and the user or group that the rule should apply to, and then click **Next**. - 5. On the **Conditions** page, select the **File hash** rule condition, and then click **Next**. - 6. **Browse Files** to locate the targeted application file. - **Note**   You can also click **Browse Folders** which calculates the hash for all the appropriate files relative to the rule collection. To remove hashes individually, click the **Remove** button. -   - 7. Click **Next**. - 8. On the **Name** page, either accept the automatically generated rule name or type a new rule name, and then click **Create**. -   -   - - - - - diff --git a/windows/keep-secure/create-a-rule-that-uses-a-path-condition.md b/windows/keep-secure/create-a-rule-that-uses-a-path-condition.md index 59f864fa6e..3130eeb9a7 100644 --- a/windows/keep-secure/create-a-rule-that-uses-a-path-condition.md +++ b/windows/keep-secure/create-a-rule-that-uses-a-path-condition.md @@ -2,62 +2,34 @@ title: Create a rule that uses a path condition (Windows 10) description: This topic for IT professionals shows how to create an AppLocker rule with a path condition. ms.assetid: 9b2093f5-5976-45fa-90c3-da1e0e845d95 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Create a rule that uses a path condition - - **Applies to** - - Windows 10 - This topic for IT professionals shows how to create an AppLocker rule with a path condition. - The path condition identifies an app by its location in the file system of the computer or on the network. - **Important**   When creating a rule that uses a deny action, path conditions are less secure for preventing access to a file because a user could easily copy the file to a different location than what is specified in the rule. Because path rules correspond to locations within the file system, you should ensure that there are no subdirectories that are writable by non-administrators. For example, if you create a path rule for C:\\ with the allow action, any file within C:\\ will be allowed to run, including users' profiles. -   - For info about the path condition, see [Understanding the path rule condition in AppLocker](understanding-the-path-rule-condition-in-applocker.md). - You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For information how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). - **To create a new rule with a path condition** - 1. Open the AppLocker console, and then click the rule collection that you want to create the rule for. - 2. On the **Action** menu, click **Create New Rule**. - 3. On the **Before You Begin** page, click **Next**. - 4. On the **Permissions** page, select the action (allow or deny) and the user or group that the rule should apply to, and then click **Next**. - 5. On the **Conditions** page, select the **Path** rule condition, and then click **Next**. - 6. Click **Browse Files** to locate the targeted folder for the app. - **Note**   When you browse to a file or folder location, the wizard automatically converts absolute file paths to use AppLocker path variables. You may edit the path after browsing to specify an absolute path, or you may type the path directly into the **Path** box. To learn more about AppLocker path variables, see [Understanding the path rule condition in AppLocker](understanding-the-path-rule-condition-in-applocker.md). -   - 7. Click **Next**. - 8. (Optional) On the **Exceptions** page, specify conditions by which to exclude files from being affected by the rule. Click **Next**. - 9. On the **Name** page, either accept the automatically generated rule name or type a new rule name, and then click **Create**. -   -   - - - - - diff --git a/windows/keep-secure/create-a-rule-that-uses-a-publisher-condition.md b/windows/keep-secure/create-a-rule-that-uses-a-publisher-condition.md index cbbec57db2..11baddf574 100644 --- a/windows/keep-secure/create-a-rule-that-uses-a-publisher-condition.md +++ b/windows/keep-secure/create-a-rule-that-uses-a-publisher-condition.md @@ -2,54 +2,29 @@ title: Create a rule that uses a publisher condition (Windows 10) description: This topic for IT professionals shows how to create an AppLocker rule with a publisher condition. ms.assetid: 345ad45f-2bc1-4c4c-946f-17804e29f55b +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Create a rule that uses a publisher condition - - **Applies to** - - Windows 10 - This topic for IT professionals shows how to create an AppLocker rule with a publisher condition. - You can use publisher conditions only for files that are digitally signed; the publisher condition identifies an app based on its digital signature and extended attributes. The digital signature contains information about the company that created the app (the publisher). The extended attributes, which are obtained from the binary resource, contain the name of the product that the file is part of and the version number of the application. The publisher may be a software development company, such as Microsoft, or the information technology department of your organization. - Packaged app rules are by definition rules that use publisher conditions. For info about creating a packaged app rule, see [Create a rule for packaged apps](create-a-rule-for-packaged-apps.md). - For info about the publisher condition, see [Understanding the publisher rule condition in AppLocker](understanding-the-publisher-rule-condition-in-applocker.md). - You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). - **To create a new rule with a publisher condition** - 1. Open the AppLocker console, and then click the rule collection that you want to create the rule for. - 2. On the **Action** menu, click **Create New Rule**. - 3. On the **Before You Begin** page, click **Next**. - 4. On the **Permissions** page, select the action (allow or deny) and the user or group that the rule should apply to, and then click **Next**. - 5. On the **Conditions** page, select the **Publisher** rule condition, and then click **Next**. - 6. On the **Publisher** page, click **Browse** to select a signed file, and then use the slider to specify the scope of the rule. To use custom values in any of the fields or to specify a specific file version, select the **Use custom values** check box. For example, you can use the asterisk (\*) wildcard character within a publisher rule to specify that any value should be matched. - 7. Click **Next**. - 8. (Optional) On the **Exceptions** page, specify conditions by which to exclude files from being affected by the rule. Click **Next**. - 9. On the **Name** page, either accept the automatically generated rule name or type a new rule name, and then click **Create**. -   -   - - - - - diff --git a/windows/keep-secure/create-a-token-object.md b/windows/keep-secure/create-a-token-object.md index f5be6bd569..1c972b491b 100644 --- a/windows/keep-secure/create-a-token-object.md +++ b/windows/keep-secure/create-a-token-object.md @@ -2,50 +2,30 @@ title: Create a token object (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Create a token object security policy setting. ms.assetid: bfbf52fc-6ba4-442a-9df7-bd277e55729c +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Create a token object - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Create a token object** security policy setting. - ## Reference - - This policy setting determines which accounts a process can use to create a token, and which accounts it can then use to gain access to local resources when the process uses NtCreateToken() or other token-creation APIs. - When a user logs on to the local device or connects to a remote device through a network, Windows builds the user’s access token. Then the system examines the token to determine the level of the user's privileges. When you revoke a privilege, the change is immediately recorded, but the change is not reflected in the user's access token until the next time the user logs on or connects. - Constant: SeCreateTokenPrivilege - ### Possible values - - User-defined list of accounts - - Not Defined - ### Best practices - - This user right is used internally by the operating system. Unless it is necessary, do not assign this user right to a user, group, or process other than Local System. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - This user right is used internally by the operating system. By default, it is not assigned to any user groups. - The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - @@ -84,62 +64,29 @@ The following table lists the actual and effective default policy values. Defaul
-   - ## Policy management - - A restart of the device is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - ### Group Policy - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - **Caution**   A user account that is given this user right has complete control over the system, and it can lead to the system being compromised. We highly recommend that you do not assign this right to any user accounts. -   - Windows examines a user's access token to determine the level of the user's privileges. Access tokens are built when users log on to the local device or connect to a remote device over a network. When you revoke a privilege, the change is immediately recorded, but the change is not reflected in the user's access token until the next time the user logs on or connects. Users with the ability to create or modify tokens can change the level of access for any account on a computer if they are currently logged on. They could escalate their privileges or create a DoS condition. - ### Countermeasure - Do not assign the **Create a token object** user right to any users. Processes that require this user right should use the Local System account, which already includes it, instead of a separate user account that has this user right assigned. - ### Potential impact - None. Not Defined is the default configuration. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/create-applocker-default-rules.md b/windows/keep-secure/create-applocker-default-rules.md index d701502116..15c82719f5 100644 --- a/windows/keep-secure/create-applocker-default-rules.md +++ b/windows/keep-secure/create-applocker-default-rules.md @@ -2,43 +2,24 @@ title: Create AppLocker default rules (Windows 10) description: This topic for IT professionals describes the steps to create a standard set of AppLocker rules that will allow Windows system files to run. ms.assetid: 21e9dc68-a6f4-4ebe-ac28-4c66a7ab6e18 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Create AppLocker default rules - - **Applies to** - - Windows 10 - This topic for IT professionals describes the steps to create a standard set of AppLocker rules that will allow Windows system files to run. - AppLocker includes default rules for each rule collection. These rules are intended to help ensure that the files that are required for Windows to operate properly are allowed to run. - **Important**   You can use the default rules as a template when creating your own rules to allow files within the Windows folders to run. However, these rules are only meant to function as a starter policy when you are first testing AppLocker rules. The default rules can be modified in the same way as other AppLocker rule types. -   - You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For information how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). - **To create default rules** - 1. Open the AppLocker console. - 2. Right-click the appropriate rule type for which you want to automatically generate default rules. You can automatically generate rules for executable, Windows Installer, script rules and Packaged app rules. - 3. Click **Create Default Rules**. -   -   - - - - - diff --git a/windows/keep-secure/create-global-objects.md b/windows/keep-secure/create-global-objects.md index dd10fb6763..7e51c7a813 100644 --- a/windows/keep-secure/create-global-objects.md +++ b/windows/keep-secure/create-global-objects.md @@ -2,50 +2,30 @@ title: Create global objects (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Create global objects security policy setting. ms.assetid: 9cb6247b-44fc-4815-86f2-cb59b6f0221e +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Create global objects - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Create global objects** security policy setting. - ## Reference - - This policy setting determines which users can create global objects that are available to all sessions. Users can still create objects that are specific to their own session if they do not have this user right. - A global object is an object that is created to be used by any number of processes or threads, even those not started within the user’s session. Remote Desktop Services uses global objects in its processes to facilitate connections and access. - Constant: SeCreateGlobalPrivilege - ### Possible values - - User-defined list of accounts - - Default accounts listed below - ### Best practices - - Do not assign any user accounts this right. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - By default, members of the Administrators group have this right, as do Local Service and Network Service accounts on the supported versions of Windows. Service is included for backwards compatibility with earlier versions of Windows. - The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - @@ -99,62 +79,29 @@ The following table lists the actual and effective default policy values. Defaul
-   - ## Policy management - - A restart of the device is not required for this policy setting to take effect. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - ### Group Policy - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - **Caution**   A user account that is given this user right has complete control over the system, and it can lead to the system being compromised. We highly recommend that you do not assign this right to any user accounts. -   - Windows examines a user's access token to determine the level of the user's privileges. Access tokens are built when users log on to the local device or connect to a remote device over a network. When you revoke a privilege, the change is immediately recorded, but the change is not reflected in the user's access token until the next time the user logs on or connects. Users with the ability to create or modify tokens can change the level of access for any currently logged on account. They could escalate their privileges or create a denial-of-service (DoS) condition. - ### Countermeasure - Do not assign the **Create a token object** user right to any users. Processes that require this user right should use the Local System account, which already includes it, instead of a separate user account with this user right assigned. - ### Potential impact - None. Not Defined is the default domain policy configuration. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/create-list-of-applications-deployed-to-each-business-group.md b/windows/keep-secure/create-list-of-applications-deployed-to-each-business-group.md index 64fb148309..6afbbb8eb8 100644 --- a/windows/keep-secure/create-list-of-applications-deployed-to-each-business-group.md +++ b/windows/keep-secure/create-list-of-applications-deployed-to-each-business-group.md @@ -2,91 +2,47 @@ title: Create a list of apps deployed to each business group (Windows 10) description: This topic describes the process of gathering app usage requirements from each business group in order to implement application control policies by using AppLocker. ms.assetid: d713aa07-d732-4bdc-8656-ba616d779321 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Create a list of apps deployed to each business group - - **Applies to** - - Windows 10 - This topic describes the process of gathering app usage requirements from each business group in order to implement application control policies by using AppLocker. - ## Determining app usage - - For each business group, determine the following: - - The complete list of apps used, including different versions of an app - - The full installation path of the app - - The publisher and signed status of each app - - The type of requirement the business groups set for each app, such as business critical, business productivity, optional, or personal. It might also be helpful during this effort to identify which apps are supported or unsupported by your IT department, or supported by others outside your control. - - A list of files or apps that require administrative credentials to install or run. If the file requires administrative credentials to install or run, users who cannot provide administrative credentials will be prevented from running the file even if the file is explicitly allowed by an AppLocker policy. Even with AppLocker policies enforced, only members of the Administrators group can install or run files that require administrative credentials. - ### How to perform the app usage assessment - Although you might already have a method in place to understand app usage for each business group, you will need to use this information to help create your AppLocker rule collection. AppLocker includes the Automatically Generate Rules wizard and the **Audit only** enforcement configuration to assist you with planning and creating your rule collection. - **Application inventory methods** - Using the Automatically Generate Rules wizard quickly creates rules for the applications you specify. The wizard is designed specifically to build a rule collection. You can use the Local Security Policy snap-in to view and edit the rules. This method is very useful when creating rules from a reference computer, and when creating and evaluating AppLocker policies in a testing environment. However, it does require that the files be accessible on the reference computer or through a network drive. This might mean additional work in setting up the reference computer and determining a maintenance policy for that computer. - Using the **Audit only** enforcement method permits you to view the logs because it collects information about every process on the computers receiving the Group Policy Object (GPO). Therefore, you can see what the enforcement will be on the computers in a business group. AppLocker includes Windows PowerShell cmdlets that you can use to analyze the events from the event log and cmdlets to create rules. However, when you use Group Policy to deploy to several computers, a means to collect events in a central location is very important for manageability. Because AppLocker logs information about files that users or other processes start on a computer, you could miss creating some rules initially. Therefore, you should continue your evaluation until you can verify that all required applications that are allowed to run are accessed successfully. - **Tip**   If you run Application Verifier against a custom application with any AppLocker policies enabled, it might prevent the application from running. You should either disable Application Verifier or AppLocker. - You can create an inventory of Universal Windows apps on a device by using two methods: the **Get-AppxPackage** Windows PowerShell cmdlet or the AppLocker console. -   - The following topics in the [AppLocker Step-by-Step Guide](http://go.microsoft.com/fwlink/p/?LinkId=160261) describe how to perform each method: - - [Automatically generating executable rules from a reference computer](http://go.microsoft.com/fwlink/p/?LinkId=160264) - - [Using auditing to track which apps are used](http://go.microsoft.com/fwlink/p/?LinkId=160281) - ### Prerequisites to completing the inventory - Identify the business group and each organizational unit (OU) within that group to which you will apply application control policies. In addition, you should have identified whether or not AppLocker is the most appropriate solution for these policies. For info about these steps, see the following topics: - - [Understand AppLocker policy design decisions](understand-applocker-policy-design-decisions.md) - - [Determine your application control objectives](determine-your-application-control-objectives.md) - ## Next steps - - Identify and develop the list of apps. Record the name of the app, whether it is signed or not as indicated by the publisher's name, and whether or not it is a mission critical, business productivity, optional, or personal application. Record the installation path of the apps. For info about how to do this, see [Document your app list](document-your-application-list.md). - After you have created the list of apps, the next step is to identify the rule collections, which will become the policies. This information can be added to the table under columns labeled: - - Use default rule or define new rule condition - - Allow or deny - - GPO name - To do this, see the following topics: - - [Select the types of rules to create](select-types-of-rules-to-create.md) - - [Determine the Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md) -   -   - - - - - diff --git a/windows/keep-secure/create-permanent-shared-objects.md b/windows/keep-secure/create-permanent-shared-objects.md index 79fc9f07f7..ee6979dbe5 100644 --- a/windows/keep-secure/create-permanent-shared-objects.md +++ b/windows/keep-secure/create-permanent-shared-objects.md @@ -2,48 +2,29 @@ title: Create permanent shared objects (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Create permanent shared objects security policy setting. ms.assetid: 6a58438d-65ca-4c4a-a584-450eed976649 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Create permanent shared objects - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Create permanent shared objects** security policy setting. - ## Reference - - This user right determines which accounts can be used by processes to create a directory object by using the object manager. Directory objects include Active Directory objects, files and folders, printers, registry keys, processes, and threads. Users who have this capability can create permanent shared objects, including devices, semaphores, and mutexes. This user right is useful to kernel-mode components that extend the object namespace. Because components that are running in kernel-mode inherently have this user right assigned to them, it is not necessary to specifically assign it. - Constant: SeCreatePermanentPrivilege - ### Possible values - - User-defined list of accounts - - Not Defined - ### Best practices - - Users who have the **Create permanent shared objects** user right could create new shared objects and expose sensitive data to the network. Therefore, do not assign this right to any users. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - By default, **LocalSystem** is the only account that has this right. - The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - @@ -82,59 +63,27 @@ The following table lists the actual and effective default policy values for the
-   - ## Policy management - - This section describes different features and tools available to help you manage this policy. - A restart of the device is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - ### Group Policy - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Users who have the **Create permanent shared objects** user right could create new shared objects and expose sensitive data to the network. - ### Countermeasure - Do not assign the **Create permanent shared objects** user right to any users. Processes that require this user right should use the System account, which already includes this user right, instead of a separate user account. - ### Potential impact - None. Not Defined is the default configuration. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/create-symbolic-links.md b/windows/keep-secure/create-symbolic-links.md index 38de1ae084..618cd6c90a 100644 --- a/windows/keep-secure/create-symbolic-links.md +++ b/windows/keep-secure/create-symbolic-links.md @@ -2,52 +2,31 @@ title: Create symbolic links (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Create symbolic links security policy setting. ms.assetid: 882922b9-0ff8-4ee9-8afc-4475515ee3fd +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Create symbolic links - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Create symbolic links** security policy setting. - ## Reference - - This user right determines if users can create a symbolic link from the device they are logged on to. - A symbolic link is a file-system object that points to another file-system object. The object that is pointed to is called the target. Symbolic links are transparent to users. The links appear as normal files or directories, and they can be acted upon by the user or application in exactly the same manner. Symbolic links are designed to aid in migration and application compatibility with UNIX operating systems. Microsoft has implemented symbolic links to function just like UNIX links. - **Warning**   This privilege should only be given to trusted users. Symbolic links can expose security vulnerabilities in applications that aren't designed to handle them. - Constant: SeCreateSymbolicLinkPrivilege - ### Possible values - - User-defined list of accounts - - Not Defined - ### Best practices - - This user right should only be given to trusted users. Symbolic links can expose security vulnerabilities in applications that are not designed to handle them. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - By default, members of the Administrators group have this right. - The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - @@ -86,63 +65,29 @@ The following table lists the actual and effective default policy values. Defaul
-   - ## Policy management - - This section describes different features and tools available to help you manage this policy. - A restart of the device is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - ### Group Policy - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ### Command-line tools - This setting can be used in conjunction with a symbolic link file system setting that can be manipulated with the command-line tool to control the kinds of symlinks that are allowed on the device. For more info, type **fsutil behavior set symlinkevalution /?** at the command prompt. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Users who have the **Create symbolic links** user right could inadvertently or maliciously expose your system to symbolic link attacks. Symbolic link attacks can be used to change the permissions on a file, to corrupt data, to destroy data, or as a DoS attack. - ### Countermeasure - Do not assign the **Create symbolic links** user right to standard users. Restrict this right to trusted administrators. You can use the **fsutil** command to establish a symbolic link file system setting that controls the kind of symbolic links that can be created on a computer. - ### Potential impact - None. Not defined is the default configuration. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/create-your-applocker-planning-document.md b/windows/keep-secure/create-your-applocker-planning-document.md index c05e7740c9..990887b439 100644 --- a/windows/keep-secure/create-your-applocker-planning-document.md +++ b/windows/keep-secure/create-your-applocker-planning-document.md @@ -2,64 +2,37 @@ title: Create your AppLocker planning document (Windows 10) description: This planning topic for the IT professional summarizes the information you need to research and include in your AppLocker planning document. ms.assetid: 41e49644-baf4-4514-b089-88adae2d624e +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Create your AppLocker planning document - - **Applies to** - - Windows 10 - This planning topic for the IT professional summarizes the information you need to research and include in your AppLocker planning document. - ## The AppLocker deployment design - - The design process and the planning document help you investigate application usage in your organization and record your findings so you can effectively deploy and maintain application control policies by using AppLocker. - You should have completed these steps in the design and planning process: - 1. [Determine your application control objectives](determine-your-application-control-objectives.md) - 2. [Create a list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md) - 3. [Select types of rules to create](select-types-of-rules-to-create.md) - 4. [Determine Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md) - 5. [Plan for AppLocker policy management](plan-for-applocker-policy-management.md) - ### AppLocker planning document contents - Your planning document should contain: - - A list of business groups that will participate in the application control policy project, their requirements, a description of their business processes, and contact information. - - Application control policy project target dates, both for planning and deployment. - - A complete list of apps used by each business group (or organizational unit), including version information and installation paths. - - What condition to apply to rules governing each application (or whether to use the default set provided by AppLocker). - - A strategy for using Group Policy to deploy the AppLocker policies. - - A strategy in processing the application usage events generated by AppLocker. - - A strategy to maintain and manage AppLocker polices after deployment. - ### Sample template for an AppLocker planning document - You can use the following form to construct your own AppLocker planning document. - **Business group**: - **Operating system environment**: (Windows and non-Windows) - @@ -94,11 +67,8 @@ You can use the following form to construct your own AppLocker planning document
-   - **Rules** - @@ -138,11 +108,8 @@ You can use the following form to construct your own AppLocker planning document
-   - **Event processing** - @@ -170,11 +137,8 @@ You can use the following form to construct your own AppLocker planning document
-   - **Policy maintenance** - @@ -203,13 +167,9 @@ You can use the following form to construct your own AppLocker planning document
-   - ### Example of an AppLocker planning document - **Rules** - @@ -306,11 +266,8 @@ You can use the following form to construct your own AppLocker planning document
-   - **Event processing** - @@ -345,11 +302,8 @@ You can use the following form to construct your own AppLocker planning document
-   - **Policy maintenance** - @@ -392,20 +346,9 @@ You can use the following form to construct your own AppLocker planning document
-   - ### Additional resources - - The AppLocker Policies Design Guide is the predecessor to the AppLocker Policies Deployment Guide. When planning is complete, see the [AppLocker policies deployment guide](applocker-policies-deployment-guide.md). - - For more general info, see [AppLocker](applocker-overview.md). -   -   - - - - - diff --git a/windows/keep-secure/create-your-applocker-policies.md b/windows/keep-secure/create-your-applocker-policies.md index d08dbfd31a..cc275dc563 100644 --- a/windows/keep-secure/create-your-applocker-policies.md +++ b/windows/keep-secure/create-your-applocker-policies.md @@ -2,96 +2,45 @@ title: Create Your AppLocker policies (Windows 10) description: This overview topic for the IT professional describes the steps to create an AppLocker policy and prepare it for deployment. ms.assetid: d339dee2-4da2-4d4a-b46e-f1dfb7cb4bf0 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Create Your AppLocker policies - - **Applies to** - - Windows 10 - This overview topic for the IT professional describes the steps to create an AppLocker policy and prepare it for deployment. - Creating effective application control policies with AppLocker starts by creating the rules for each app. Rules are grouped into one of five rule collections. The rule collection can be configured to be enforced or to run in **Audit only** mode. An AppLocker policy includes the rules in the five rule collections and the enforcement settings for each rule collection. - ## Step 1: Use your plan - - You can develop an application control policy plan to guide you in making successful deployment decisions. For more info about how to do this and what you should consider, see the [AppLocker Design Guide](applocker-policies-design-guide.md). This guide is intended for security architects, security administrators, and system administrators. It contains the following topics to help you create an AppLocker policy deployment plan for your organization that will address your specific application control requirements by department, organizational unit, or business group: - 1. [Understand the AppLocker policy deployment process](understand-the-applocker-policy-deployment-process.md) - 2. [Understand AppLocker policy design decisions](understand-applocker-policy-design-decisions.md) - 3. [Determine your application control objectives](determine-your-application-control-objectives.md) - 4. [Create a list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md) - 5. [Select the types of rules to create](select-types-of-rules-to-create.md) - 6. [Determine the Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md) - 7. [Plan for AppLocker policy management](plan-for-applocker-policy-management.md) - 8. [Create your AppLocker planning document](create-your-applocker-planning-document.md) - ## Step 2: Create your rules and rule collections - - Each rule applies to one or more apps, and it imposes a specific rule condition on them. Rules can be created individually or they can be generated by the Automatically Generate Rules Wizard. For the steps to create the rules, see [Create Your AppLocker rules](create-your-applocker-rules.md). - ## Step 3: Configure the enforcement setting - - An AppLocker policy is a set of rule collections that are configured with a rule enforcement setting. The enforcement setting can be **Enforce rules**, **Audit only**, or **Not configured**. If an AppLocker policy has at least one rule, and it is set to **Not configured**, all the rules in that policy will be enforced. For info about configuring the rule enforcement setting, see [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md) and [Configure an AppLocker policy for enforce rules](configure-an-applocker-policy-for-enforce-rules.md). - ## Step 4: Update the GPO - - AppLocker policies can be defined locally on a device or applied through Group Policy. To use Group Policy to apply AppLocker policies, you must create a new Group Policy Object (GPO) or you must update an existing GPO. You can create or modify AppLocker policies by using the Group Policy Management Console (GPMC), or you can import an AppLocker policy into a GPO. For the procedure to do this, see [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md). - ## Step 5: Test the effect of the policy - - In a test environment or with the enforcement setting set at **Audit only**, verify that the results of the policy are what you intended. For info about testing a policy, see [Test and update an AppLocker policy](test-and-update-an-applocker-policy.md). - ## Step 6: Implement the policy - - Depending on your deployment method, import the AppLocker policy to the GPO in your production environment, or if the policy is already deployed, change the enforcement setting to your production environment value—**Enforce rules** or **Audit only**. - ## Step 7: Test the effect of the policy and adjust - - Validate the effect of the policy by analyzing the AppLocker logs for application usage, and then modify the policy as necessary. To do this, see [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md). - ## Next steps - - Follow the steps described in the following topics to continue the deployment process: - 1. [Create Your AppLocker rules](create-your-applocker-rules.md) - 2. [Test and update an AppLocker policy](test-and-update-an-applocker-policy.md) - 3. [Deploy the AppLocker policy into production](deploy-the-applocker-policy-into-production.md) - ## See also - - [AppLocker deployment guide](applocker-policies-deployment-guide.md) - -   -   - - - - - diff --git a/windows/keep-secure/create-your-applocker-rules.md b/windows/keep-secure/create-your-applocker-rules.md index f1aa18a539..15de4246f0 100644 --- a/windows/keep-secure/create-your-applocker-rules.md +++ b/windows/keep-secure/create-your-applocker-rules.md @@ -2,107 +2,54 @@ title: Create Your AppLocker rules (Windows 10) description: This topic for the IT professional describes what you need to know about AppLocker rules and the methods that you can to create rules. ms.assetid: b684a3a5-929c-4f70-8742-04088022f232 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Create Your AppLocker rules - - **Applies to** - - Windows 10 - This topic for the IT professional describes what you need to know about AppLocker rules and the methods that you can to create rules. - ## Creating AppLocker rules - - AppLocker rules apply to the targeted app, and they are the components that make up the AppLocker policy. Depending on your IT environment and the business group that requires application control policies, setting these access rules for each application can be time-consuming and prone to error. With AppLocker, you can generate rules automatically or create rules individually. Creating rules that are derived from your planning document can help you avoid unintended results. For info about this planning document and other planning activities, see [AppLocker Design Guide](applocker-policies-design-guide.md). - ### Automatically generate your rules - You can use a reference device to automatically create a set of default rules for each of the installed apps, test and modify each rule as necessary, and deploy the policies. Creating most of the rules for all the installed apps gives you a starting point to build and test your policies. For info about performing this task, see the following topics: - - [Configure the AppLocker reference device](configure-the-appLocker-reference-device.md) - - [Run the Automatically Generate Rules wizard](run-the-automatically-generate-rules-wizard.md) - - [Create AppLocker default rules](create-applocker-default-rules.md) - - [Edit AppLocker rules](edit-applocker-rules.md) - - [Add exceptions for an AppLocker rule](configure-exceptions-for-an-applocker-rule.md) - ### Create your rules individually - You can create rules and set the mode to **Audit only** for each installed app, test and update each rule as necessary, and then deploy the policies. Creating rules individually might be best when you are targeting a small number of applications within a business group. - **Note**   AppLocker includes default rules for each rule collection. These rules are intended to help ensure that the files that are required for Windows to operate properly are allowed in an AppLocker rule collection. You can also edit the default rules. For information about creating the default rules for the Windows operating system, see [Create AppLocker default rules](create-applocker-default-rules.md). -   - For information about performing this task, see: - 1. [Create a rule that uses a publisher condition](create-a-rule-that-uses-a-publisher-condition.md) - 2. [Create a rule that uses a path condition](create-a-rule-that-uses-a-path-condition.md) - 3. [Create a rule that uses a file hash condition](create-a-rule-that-uses-a-file-hash-condition.md) - 4. [Edit AppLocker rules](edit-applocker-rules.md) - 5. [Enforce AppLocker rules](enforce-applocker-rules.md) - 6. [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md) - ## About selecting rules - - AppLocker policies are composed of distinct rules for specific apps. These rules are grouped by collection, and they are implemented through an AppLocker policy definition. AppLocker policies are managed by using Group Policy or by using the Local Security Policy snap-in for a single computer. - When you determine what types of rules to create for each of your business groups or organizational units (OUs), you should also determine what enforcement setting to use for each group. Certain rule types are more applicable for some apps, depending on how the apps are deployed in a specific business group. - For info about how to determine and document your AppLocker rules, see [AppLocker Design Guide](applocker-policies-design-guide.md). - For info about AppLocker rules and AppLocker policies, see the following topics: - - [Understanding AppLocker rule behavior](understanding-applocker-rule-behavior.md) - - [Understanding AppLocker rule exceptions](understanding-applocker-rule-exceptions.md) - - [Understanding AppLocker rule collections](understanding-applocker-rule-collections.md) - - [Understanding AppLocker allow and deny actions on rules](understanding-applocker-allow-and-deny-actions-on-rules.md) - - [Understanding AppLocker rule condition types](understanding-applocker-rule-condition-types.md) - - [Understanding AppLocker default rules](understanding-applocker-default-rules.md) - ## Next steps - - 1. [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md) - 2. [Import an AppLocker policy from another computer](import-an-applocker-policy-from-another-computer.md) - 3. [Test and update an AppLocker policy](test-and-update-an-applocker-policy.md) - 4. [Deploy the AppLocker policy into production](deploy-the-applocker-policy-into-production.md) - ## Related topics - - [Create Your AppLocker policies](create-your-applocker-policies.md) -   -   - - - - - diff --git a/windows/keep-secure/creating-a-device-guard-policy-for-signed-apps.md b/windows/keep-secure/creating-a-device-guard-policy-for-signed-apps.md index b0079da964..7c7ee70851 100644 --- a/windows/keep-secure/creating-a-device-guard-policy-for-signed-apps.md +++ b/windows/keep-secure/creating-a-device-guard-policy-for-signed-apps.md @@ -2,50 +2,33 @@ title: Create a Device Guard code integrity policy based on a reference device (Windows 10) description: To implement Device Guard app protection, you will need to create a code integrity policy. Code integrity policies determine what apps are considered trustworthy and are allowed to run on a protected device. ms.assetid: 6C94B14E-E2CE-4F6C-8939-4B375406E825 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Create a Device Guard code integrity policy based on a reference device - - **Applies to** - - Windows 10 - To implement Device Guard app protection, you will need to create a code integrity policy. Code integrity policies determine what apps are considered trustworthy and are allowed to run on a protected device. - ## Create a Device Guard code integrity policy based on a reference device - - To create a code integrity policy, you'll first need to create a reference image that includes the signed applications you want to run on your protected devices. For information on how to sign applications, see [Getting apps to run on Device Guard-protected devices](getting-apps-to-run-on-device-guard-protected-devices.md). - **Note**  Before creating a code integrity policy, make sure your reference device is clean of viruses and malware. -   - **To create a code integrity policy based on a reference device** - 1. On your reference device, start PowerShell as an administrator. - 2. In PowerShell, initialize variables by typing: - ``` syntax $CIPolicyPath=$env:userprofile+"\Desktop\" $InitialCIPolicy=$CIPolicyPath+"InitialScan.xml" $CIPolicyBin=$CIPolicyPath+"DeviceGuardPolicy.bin" ``` - 3. Scan your device for installed applications and create a new code integrity policy by typing: - ``` syntax New-CIPolicy -Level -FilePath $InitialCIPolicy -UserPEs -Fallback Hash 3> Warningslog.txt ``` - Where *<RuleLevel>* can be set to any of the following options: - @@ -110,31 +93,15 @@ To create a code integrity policy, you'll first need to create a reference image
-   - 4. Type the following to convert the code integrity policy to a binary format: - ``` syntax ConvertFrom-CIPolicy $InitialCIPolicy $CIPolicyBin ``` - Once you have completed these steps, the Device Guard policy binary file (DeviceGuardPolicy.bin) and original xml file (InitialScan.xml) will be available on your desktop. - **Note**  We recommend that you keep a copy of InitialScan.xml to use if you need to merge this code integrity policy with another policy, or update policy rule options. -   - ## Related topics - - [Getting apps to run on Device Guard-protected devices](getting-apps-to-run-on-device-guard-protected-devices.md) -   -   - - - - - diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index 387655a9a5..76c99f5114 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -2,55 +2,32 @@ title: Protect derived domain credentials with Credential Guard (Windows 10) description: Introduced in Windows 10 Enterprise, Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. ms.assetid: 4F1FE390-A166-4A24-8530-EA3369FEB4B1 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: explore ms.sitesec: library author: brianlic-msft --- - # Protect derived domain credentials with Credential Guard - - **Applies to** - - Windows 10 - Windows Server 2016 Technical Preview - Introduced in Windows 10 Enterprise, Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Unauthorized access to these secrets can lead to credential theft attacks, such as Pass-the-Hash or Pass-The-Ticket. Credential Guard prevents these attacks by protecting NTLM password hashes and Kerberos Ticket Granting Tickets. - Credential Guard offers the following features and solutions: - - **Hardware security** Credential Guard increases the security of derived domain credentials by taking advantage of platform security features including, Secure Boot and virtualization. - - **Virtualization-based security** Windows services that manage derived domain credentials and other secrets run in a protected environment that is isolated from the running operating system. - - **Better protection against advanced persistent threats** Securing derived domain credentials using the virtualization-based security blocks the credential theft attack techniques and tools used in many targeted attacks. Malware running in the operating system with administrative privileges cannot extract secrets that are protected by virtualization-based security. While Credential Guard is a powerful mitigation, persistent threat attacks will likely shift to new attack techniques and you should also incorporate Device Guard and other security strategies and architectures. - - **Manageability** You can manage Credential Guard by using Group Policy, WMI, from a command prompt, and Windows PowerShell. - ## How it works - - Credential Guard isolates secrets that previous versions of Windows stored in the Local Security Authority (LSA) by using virtualization-based security. Prior to Windows 10, the LSA stored secrets used by the operating system in its process memory. With Credential Guard, the LSA process in the operating system talks to a new component called the isolated LSA process that stores and protects those secrets. Data stored by the isolated LSA process is protected using virtualization-based security and is not accessible to the rest of the operating system. LSA uses remote procedure calls to communicate with the isolated LSA process - For security reasons, the isolated LSA process doesn't host any device drivers. Instead, it only hosts a small subset of operating system binaries that are needed for security and nothing else. All of these binaries are signed with a certificate that is trusted by virtualization-based security and these signatures are validated before launching the file in the protected environment. - Credential Guard also does not allow older variants of NTLM, unconstrained Kerberos delegation, and Kerberos authentication protocols and cipher suites when using default derived credentials, including NTLMv1, MS-CHAPv2, and weaker Kerberos encryption types, such as DES. - Here's a high-level overview on how the LSA is isolated by using virtualization-based security: - ![Credential Guard oveview](images/credguard.png) - ## New and changed functionality - - To see what was added or changed in Credential Guard, see [What's new in Credential Guard?](../whats-new/credential-guard.md). - ## Hardware and software requirements - - The PC must meet the following hardware and software requirements to use Credential Guard: - @@ -123,120 +100,65 @@ The PC must meet the following hardware and software requirements to use Credent
-   - ¹ If you choose the **Secure Boot and DMA protection** option in the Group Policy setting, an IOMMU is required. The **Secure Boot** Group Policy option enables Credential Guard on devices without an IOMMU. - ## Manage Credential Guard - - Credential Guard uses virtualization-based security features that must be enabled on each PC before you can use it. - ### Turn on Credential Guard by using Group Policy - You can use Group Policy to enable Credential Guard because it will add the virtualization-based security features for you. - 1. From the Group Policy Management Console, go to **Computer Configuration** -> **Administrative Templates** -> **System** -> **Device Guard**. - 2. Double-click **Turn On Virtualization Based Security**, and then click the **Enabled** option. - 3. **Select Platform Security Level** box, choose **Secure Boot** or **Secure Boot and DMA Protection**. - 4. In the **Credential Guard Configuration** box, click **Enabled with UEFI lock**, and then click **OK**. If you want to be able to turn off Credential Guard remotely, choose **Enabled without lock**. - ![](images/credguard-gp.png) - 5. Close the Group Policy Management Console. - ### Add Credential Guard to an image - If you would like to add Credential Guard to an image, you can do this by adding the virtualization-based security features and then turning on Credential Guard. - ### Add the virtualization-based security features - First, you must add the virtualization-based security features. You can do this by using either the Control Panel or the Deployment Image Servicing and Management tool (DISM). - **Note**  If you enable Credential Guard by using Group Policy, these steps are not required. Group Policy will install the features for you. -   - **Add the virtualization-based security features by using Programs and Features** - 1. Open the Programs and Features control panel. - 2. Click **Turn Windows feature on or off**. - 3. Select the **Isolated User Mode** check box. - 4. Go to **Hyper-V** -> **Hyper-V Platform**, and then select the **Hyper-V Hypervisor** check box. - 5. Click **OK**. - **Add the virtualization-based security features to an offline image by using DISM** - 1. Open an elevated command prompt. - 2. Add the Hyper-V Hypervisor by running the following command: - ``` syntax dism /image: /Enable-Feature /FeatureName:Microsoft-Hyper-V-Hypervisor /all ``` - 3. Add Isolated User Mode by running the following command: - ``` syntax dism /image: /Enable-Feature /FeatureName:IsolatedUserMode ``` - **Note**   You can also add these features to an online image by using either DISM or Configuration Manager. -   - ### Turn on Credential Guard - If you don't use Group Policy, you can enable Credential Guard by using the registry. - **Turn on Credential Guard by using the registry** - 1. Open Registry Editor. - 2. Enable virtualization-based security: - - Go to HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\DeviceGuard. - - Add a new DWORD value named **EnableVirtualizationBasedSecurity**. Set the value of this registry setting to 1 to enable virtualization-based security and set it to 0 to disable it. - - Add a new DWORD value named **RequirePlatformSecurityFeatures**. Set the value of this registry setting to 1 to use **Secure Boot** only or set it to 2 to use **Secure Boot and DMA protection**. - 3. Enable Credential Guard: - - Go to HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\LSA. - - Add a new DWORD value named **LsaCfgFlags**. Set the value of this registry setting to 1 to enable Credential Guard with UEFI lock, set it to 2 to enable Credential Guard without lock, and set it to 0 to disable it. - 4. Close Registry Editor. - **Note**   You can also turn on Credential Guard by setting the registry entries in the [FirstLogonCommands](http://msdn.microsoft.com/library/windows/hardware/dn922797.aspx) unattend setting. -   - ### Remove Credential Guard - If you have to remove Credential Guard on a PC, you need to do the following: - 1. If you used Group Policy, disable the Group Policy setting that you used to enable Credential Guard (**Computer Configuration** -> **Administrative Templates** -> **System** -> **Device Guard** -> **Turn on Virtualization Based Security**). - 2. Delete the following registry setting: HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DeviceGuard\\LsaCfgFlags - 3. Delete the Credential Guard EFI variables by using bcdedit. - **Delete the Credential Guard EFI variables** - 1. From an elevated command prompt, type the following commands: - ``` syntax mountvol X: /s copy %WINDIR%\System32\SecConfig.efi X:\EFI\Microsoft\Boot\SecConfig.efi /Y @@ -247,250 +169,135 @@ If you have to remove Credential Guard on a PC, you need to do the following: bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} device partition=X: mountvol X: /d ``` - 2. Restart the PC. - 3. Accept the prompt to disable Credential Guard. - 4. Alternatively, you can disable the virtualization-based security features to turn off Credential Guard. - **Note**   The PC must have one-time access to a domain controller to decrypt content, such as files that were encrypted with EFS. - If you want to turn off both Credential Guard and virtualization-based security, run the following bcdedit command after turning off all virtualization-based security Group Policy and registry settings: - **bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS** - For more info on virtualization-based security and Device Guard, see [Device Guard deployment guide](device-guard-deployment-guide.md). -   - ### Check that Credential Guard is running - You can use System Information to ensure that Credential Guard is running on a PC. - 1. Click **Start**, type **msinfo32.exe**, and then click **System Information**. - 2. Click **System Summary**. - 3. Confirm that **Credential Guard** is shown next to **Device Guard Security Services Running**. - Here's an example: - ![](images/credguard-msinfo32.png) - ## Considerations when using Credential Guard - - - If Credential Guard is enabled on a device after it's joined to a domain, the user and device secrets may already be compromised. We recommend that Credential Guard is enabled before the PC is joined to a domain. - - You should perform regular reviews of the PCs that have Credential Guard enabled. This can be done with security audit policies or WMI queries. Here's a list of WinInit event IDs to look for: - - **Event ID 13** Credential Guard (LsaIso.exe) was started and will protect LSA credentials. - - **Event ID 14** Credential Guard (LsaIso.exe) configuration: 0x1, 0 - - The first variable: 0x1 means Credential Guard is configured to run. 0x0 means it’s not configured to run. - The second variable: 0 means it’s configured to run in protect mode. 1 means it's configured to run in test mode. This variable should always be 0. - **Event ID 15** Credential Guard (LsaIso.exe) is configured but the secure kernel is not running; continuing without Credential Guard. - - **Event ID 16** Credential Guard (LsaIso.exe) failed to launch: \[error code\] - - **Event ID 17** Error reading Credential Guard (LsaIso.exe) UEFI configuration: \[error code\] - You can also verify that TPM is being used for key protection by checking the following event in the **Microsoft** -> **Windows** -> **Kernel-Boot** event source. If you are running with a TPM, the TPM PCR mask value will be something other than 0. - - **Event ID 51** VSM Master Encryption Key Provisioning. Using cached copy status: 0x0. Unsealing cached copy status: 0x1. New key generation status: 0x1. Sealing status: 0x1. TPM PCR mask: 0x0. - - Passwords are still weak so we recommend that your organization deploy Credential Guard and move away from passwords and to other authentication methods, such as physical smart cards, virtual smart cards, Microsoft Passport, or Microsoft Passport for Work. - - Some 3rd party Security Support Providers (SSPs and APs) might not be compatible with Credential Guard. Credential Guard does not allow 3rd party SSPs to ask for password hashes from LSA. However, SSPs and APs still get notified of the password when a user logs on and/or changes their password. Any use of undocumented APIs within custom SSPs and APs are not supported. We recommend that custom implementations of SSPs/APs are tested against Credential Guard to ensure that the SSPs and APs do not depend on any undocumented or unsupported behaviors. For example, using the KerbQuerySupplementalCredentialsMessage API is not supported. You should not replace the NTLM or Kerberos SSPs with custom SSPs and APs. For more info, see [Restrictions around Registering and Installing a Security Package](http://msdn.microsoft.com/library/windows/desktop/dn865014.aspx) on MSDN. - - As the depth and breadth of protections provided by Credential Guard are increased, subsequent releases of Windows 10 with Credential Guard running may impact scenarios that were working in the past. For example, Credential Guard may block the use of a particular type of credential or a particular component to prevent malware from taking advantage of vulnerabilities. Therefore, we recommend that scenarios required for operations in an organization are tested before upgrading a device that has Credential Guard running. - - If you are using Wi-Fi and VPN end points that are based on MS-CHAPv2, they are subject to similar attacks as NTLMv1. We recommend that organizations use certificated-based authentication for Wi-Fi and VPN connections. - - Starting with Windows 10, version 1511, domain credentials that are stored with Credential Manager are protected with Credential Guard. Credential Manager allows you to store credentials, such as user names and passwords that you use to log on to websites or other computers on a network. The following considerations apply to the Credential Guard protections for Credential Manager: - - Credentials saved by Remote Desktop Services cannot be used to remotely connect to another machine without supplying the password. - - Applications that extract derived domain credentials from Credential Manager will no longer be able to use those credentials. - - You cannot restore credentials using the Credential Manager control panel if the credentials were backed up from a PC that has Credential Guard turned on. If you need to back up your credentials, you must do this before you enable Credential Guard. Otherwise, you won't be able to restore those credentials. - ## Scenarios not protected by Credential Guard - - Some ways to store credentials are not protected by Credential Guard, including: - - Software that manages credentials outside of Windows feature protection - - Local accounts and Microsoft Accounts - - Credential Guard does not protect the Active Directory database running on Windows Server 2016 Technical Preview domain controllers. It also does not protect credential input pipelines, such as Windows Server 2016 Technical Preview servers running Remote Desktop Gateway. If you're using a Windows Server 2016 Technical Preview server as a client PC, it will get the same protection as it would be running Windows 10 Enterprise. - - Key loggers - - Physical attacks - - Does not prevent an attacker with malware on the PC from using the privileges associated with any credential. We recommend using dedicated PCs for high value accounts, such as IT Pros and users with access high value assets in your organization. - ## Additional mitigations - - Credential Guard can provide mitigations against attacks on derived credentials and prevent the use of stolen credentials elsewhere. However, PCs can still be vulnerable to certain attacks, even if the derived credentials are protected by Credential Guard. These attacks can include abusing privileges and use of derived credentials directly from a compromised device, reusing previously stolen credentials prior to Device Guard, and abuse of management tools and weak application configurations. Because of this, additional mitigations also need to be deployed to make the domain environment more robust. - Credential theft attacks allow the attacker to steal secrets from one device and use them from another device. By deploying authentication policies with compound authentication in Windows Server 2012 R2 or later domains, users can be restricted to only sign on from specific domain-joined devices. However, since devices also use shared secrets for authentication, attackers can steal those secrets as well. By deploying device certificates with Credential Guard, authentication policies can require that the device authenticates with its private key. This prevents shared secrets on stolen devices to be used with stolen user passwords or Kerberos secret keys to sign on as the user. - Device certificate authentication has the following requirements: - - Device domains are Windows Server 2012 or higher and all domain controllers have certificates, which satisfy strict KDC validation (KDC EKU present and the DNS domain name matches the DNSName field of the SubjectAltName (SAN) extension). - - Windows 10 devices have the CA issuing the domain controller certificates in the enterprise store. - - A process is established to ensure the identity and trustworthiness of the device in a similar manner as you would establish the identity and trustworthiness of a user before issuing them a smartcard. - ### Additional Group Policy settings - There are a few Group Policy settings that you can enable that provide more protection against credential attacks: - - On the domain controllers, configure the KDC support for claims, compound authentication, and Kerberos armoring system by using Group Policy. Set the **KDC support for claims, compound authentication, and Kerberos armoring** Group Policy setting to either **Supported** or **Always provide claims**. - - On devices running Windows 10, you can turn it on by using Group Policy as well. To do this, enable the **Kerberos client support for claims, compound authentication and Kerberos armoring** & **Always send compound authentication first system** Group Policy settings under **Computer Configuration** -> **Administrative Templates** -> **System** -> **Kerberos**. - ### Compound authentication - Compound authentication adds the device identity to the user’s during authentication to the domain and resources. Without compound authentication, only the user’s secrets are validated. With compound authentication, the Kerberos client has to have both the user’s and device’s secrets. - Enabling compound authentication also enables Kerberos armoring, which provides two additional benefits: - - User authentication on domain-joined devices will be armored. This means that network captures will contain encrypted Kerberos initial authentication. Without the appropriate device key, Kerberos AS-REQs are protected against offline dictionary attacks. - - KDC errors are signed, which provides protection against error spoofing attacks. - ### Deploying machine certificates - If the domain controllers in your organization are running Windows Server 2016 Technical Preview, devices running Windows 10 will automatically enroll a machine certificate when Credential Guard is enabled and the PC is joined to the domain. - If the domain controllers are running Windows Server 2012 R2, the machine certificates must be provisioned manually on each device. You can do this by creating a certificate template on the domain controller or certificate authority and deploying the machine certificates to each device. - The same security procedures used for issuing smart cards to users should be applied to machine certificates. - 1. From the Certificate Manager console, right-click **Certificate Templates**, and then click **Manage.** - 2. Right-click **Workstation Authentication**, and then click **Duplicate Template**. - 3. Right-click the new template, and then click **Properties**. - 4. On the **Extensions** tab, click **Application Policies**, and then click **Edit**. - 5. Click **Client Authentication**, and then click **Remove**. - 6. Add the ID-PKInit-KPClientAuth EKU. Click **Add**, click **New**, and then specify the following values: - - Name: Kerberos Client Auth - - Object Identifier: 1.3.6.1.5.2.3.4 - 7. On the **Extensions** tab, click **Issuance Policies**, and then click **Edit**. - 8. Under **Issuance Policies**, click**High Assurance**. - 9. On the **Subject name** tab, clear the **DNS name** check box, and then select the **User Principal Name (UPN)** check box. - On devices that are running Credential Guard, enroll the devices using the machine authentication certificate by running the following command: - ``` syntax CertReq -EnrollCredGuardCert MachineAuthentication ``` - **Note**   You must restart the device after enrolling the machine authentication certificate. -   - ### Link the issuance policies to a group - By using an authentication policy, you can ensure that users only sign into devices that are running Credential Guard. Before you deploy the authentication policy though, you must first run a couple of scripts that set up your environment. - - The [get-IssuancePolicy.ps1](#bkmk-getscript) shows all of the issuance policies that are available on the certificate authority. - From a Windows PowerShell command prompt, run the following command: - ``` syntax .\get-IssuancePolicy.ps1 –LinkedToGroup:All ``` - - The [set-IssuancePolicyToGroupLink.ps1](#bkmk-setscript) creates a Universal security group, creates an organizational unit, and links the issuance policy to that Universal security group. - From a Windows PowerShell command prompt, run the following command: - ``` syntax .\set-IssuancePolicyToGroupLink.ps1 –IssuancePolicyName:”” –groupOU:”” –groupName:”” ``` - ### Deploy the authentication policy - Before setting up the authentication policy, you should log any failed attempt to apply an authentication policy on the KDC. To do this in Event Viewer, navigate to **Applications and Services Logs\\Microsoft\\Windows\\Authentication, right-click AuthenticationPolicyFailures-DomainController**, and then click **Enable Log**. - Now you can set up an authentication policy to use Credential Guard. - **To add an authentication policy for Credential Guard** - 1. Ensure that your domain controllers are running at least the Windows Server 2012 R2 domain functional level. - 2. Create a security group that will be used to identify the PCs that will have this authentication policy applied to them. - 3. Add the computer account to this security group. - 4. Open Active Directory Administrative Center. - 5. Click **Authentication**, click **New**, and then click **Authentication Policy**. - 6. In the **Display name** box, enter a name for this authentication policy. - 7. Under the **Accounts** heading, click **Add**. - 8. In the **Select Users, Computers, or Service Accounts** dialog box, type the name of the user account, and then click **OK**. - 9. Under the **User** heading, click the **Edit** button that applies to user account. - 10. Click **Add a condition**. - 11. In the **Edit Access Control Conditions** box, ensure that it reads **User** > **Group** > **Member of each** > **Value**, and then click **Add items**. - 12. In the **Select Users, Computers, or Service Accounts** dialog box, type the name of the security group that you created with the set-IssuancePolicyToGroupLink script, and then click **OK**. - 13. Click **OK** to close the **Edit Access Control Conditions** box. - 14. Click **OK** to create the authentication policy. - 15. Close Active Directory Administrative Center. - **Note**   When authentication policies in enforcement mode are deployed with Credential Guard, users will not be able to sign in using devices that do not have the machine authentication certificate provisioned. This applies to both local and remote sign in scenarios. -   - ### Appendix: Scripts - Here is a list of scripts that are mentioned in this topic. - ### Get the available issuance policies on the certificate authority - Save this script file as get-IssuancePolicy.ps1. - ``` syntax ####################################### ## Parameters to be defined ## ## by the user ## ####################################### - Param ( $Identity, $LinkedToGroup ) - ####################################### ## Strings definitions ## ####################################### @@ -521,19 +328,12 @@ dn = distinguishedName : {0} NonLinkedIPs = The following Issuance Policies are NOT linked to groups: '@ } - ##Import-LocalizedData getIP_strings - - import-module ActiveDirectory - - ####################################### ## Help ## ####################################### - function Display-Help { - "" $getIP_strings.help1 "" @@ -557,34 +357,25 @@ $getIP_strings.help11 " " + '$' + "myIP = .\get-IssuancePolicy.ps1 -Identity:""Medium Assurance""" "" } - - $root = get-adrootdse $domain = get-addomain -current loggedonuser $configNCDN = [String]$root.configurationNamingContext - - if ( !($Identity) -and !($LinkedToGroup) ) { display-Help break } - if ($Identity) { $OIDs = get-adobject -Filter {(objectclass -eq "msPKI-Enterprise-Oid") -and ((name -eq $Identity) -or (displayname -eq $Identity) -or (distinguishedName -like $Identity)) } -searchBase $configNCDN -properties * - if ($OIDs -eq $null) { $errormsg = $getIP_strings.ErrorIPNotFound -f $Identity write-host $errormsg -ForegroundColor Red } - foreach ($OID in $OIDs) { - if ($OID."msDS-OIDToGroupLink") { # In case the Issuance Policy is linked to a group, it is good to check whether there is any problem with the mapping. $groupDN = $OID."msDS-OIDToGroupLink" $group = get-adgroup -Identity $groupDN $groupName = $group.Name - # Analyze the group if ($group.groupCategory -ne "Security") { $errormsg = $getIP_strings.ErrorNotSecurity -f $Identity, $groupName @@ -603,16 +394,13 @@ write-host $errormsg -ForegroundColor Red } } } - } return $OIDs break } - if (($LinkedToGroup -eq "yes") -or ($LinkedToGroup -eq "all")) { $LDAPFilter = "(&(objectClass=msPKI-Enterprise-Oid)(msDS-OIDToGroupLink=*)(flags=2))" $LinkedOIDs = get-adobject -searchBase $configNCDN -LDAPFilter $LDAPFilter -properties * - write-host "" write-host "*****************************************************" write-host $getIP_strings.LinkedIPs @@ -620,20 +408,16 @@ if (($LinkedToGroup -eq "yes") -or ($LinkedToGroup -eq "all")) { write-host "" if ($LinkedOIDs -ne $null){ foreach ($OID in $LinkedOIDs) { - # Display basic information about the Issuance Policies "" $getIP_strings.displayName -f $OID.displayName $getIP_strings.Name -f $OID.Name $getIP_strings.dn -f $OID.distinguishedName - - # Get the linked group. $groupDN = $OID."msDS-OIDToGroupLink" $group = get-adgroup -Identity $groupDN $getIP_strings.InfoName -f $group.Name $getIP_strings.InfoDN -f $groupDN - # Analyze the group $OIDName = $OID.displayName $groupName = $group.Name @@ -663,11 +447,9 @@ write-host "There are no issuance policies that are mapped to a group" break } } - if (($LinkedToGroup -eq "no") -or ($LinkedToGroup -eq "all")) { $LDAPFilter = "(&(objectClass=msPKI-Enterprise-Oid)(!(msDS-OIDToGroupLink=*))(flags=2))" $NonLinkedOIDs = get-adobject -searchBase $configNCDN -LDAPFilter $LDAPFilter -properties * - write-host "" write-host "*********************************************************" write-host $getIP_strings.NonLinkedIPs @@ -675,7 +457,6 @@ if (($LinkedToGroup -eq "no") -or ($LinkedToGroup -eq "all")) { write-host "" if ($NonLinkedOIDs -ne $null) { foreach ($OID in $NonLinkedOIDs) { - # Display basic information about the Issuance Policies write-host "" $getIP_strings.displayName -f $OID.displayName @@ -692,32 +473,24 @@ write-host "There are no issuance policies which are not mapped to groups" } } ``` - **Note**   If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter. -   - ### Link an issuance policy to a group - Save the script file as set-IssuancePolicyToGroupLink.ps1. - ``` syntax ####################################### ## Parameters to be defined ## ## by the user ## ####################################### - Param ( $IssuancePolicyName, $groupOU, $groupName ) - ####################################### ## Strings definitions ## ####################################### - Data ErrorMsg { # culture="en-US" ConvertFrom-StringData -stringdata @' @@ -758,9 +531,7 @@ LinkError = The certificate issuance policy could not be linked to the specified ExitNoLinkReplacement = Exiting without setting the new link. '@ } - # import-localizeddata ErrorMsg - function Display-Help { "" write-host $ErrorMsg.help1 @@ -784,30 +555,22 @@ write-host $ErrorMsg.help10 '.\Set-IssuancePolicyToGroupMapping.ps1 -IssuancePolicyName "402.164959C40F4A5C12C6302E31D5476062" -groupName $null ' "" } - - - # Assumption: The group to which the Issuance Policy is going # to be linked is (or is going to be created) in # the domain the user running this script is a member of. import-module ActiveDirectory $root = get-adrootdse $domain = get-addomain -current loggedonuser - - if ( !($IssuancePolicyName) ) { display-Help break } - ####################################### ## Find the OID object ## ## (aka Issuance Policy) ## ####################################### - $searchBase = [String]$root.configurationnamingcontext $OID = get-adobject -searchBase $searchBase -Filter { ((displayname -eq $IssuancePolicyName) -or (name -eq $IssuancePolicyName)) -and (objectClass -eq "msPKI-Enterprise-Oid")} -properties * - if ($OID -eq $null) { $tmp = $ErrorMsg.NoIP -f $IssuancePolicyName, $searchBase write-host $tmp -ForeGroundColor Red @@ -822,13 +585,9 @@ else { $tmp = $ErrorMsg.IPFound -f $IssuancePolicyName, $OID.distinguishedName write-host $tmp -ForeGroundColor Green } - - - ####################################### ## Find the container of the group ## ####################################### - if ($groupOU -eq $null) { # default to the Users container $groupContainer = $domain.UsersContainer @@ -867,11 +626,9 @@ $tmp = $ErrorMsg.OUFoundSuccess -f $groupContainer.name write-host $tmp -ForegroundColor Green } } - ####################################### ## Find the group ## ####################################### - if (($groupName -ne $null) -and ($groupName -ne "")){ ##$searchBase = [String]$groupContainer.DistinguishedName $searchBase = $groupContainer @@ -936,14 +693,11 @@ write-host $tmp -ForeGroundColor Yellow } break; } - - ####################################### ## Verify that the group is ## ## Universal, Security, and ## ## has no members ## ####################################### - if ($group.GroupScope -ne "Universal") { $tmp = $ErrorMsg.ErrorNotUniversal -f $IssuancePolicyName, $groupName write-host $tmp -ForeGroundColor Red @@ -961,14 +715,11 @@ write-host $tmp -ForeGroundColor Red foreach ($member in $members) {write-host " $member.name" -ForeGroundColor Red} break; } - - ####################################### ## We have verified everything. We ## ## can create the link from the ## ## Issuance Policy to the group. ## ####################################### - if ($OID."msDS-OIDToGroupLink" -ne $null) { $tmp = $ErrorMsg.ConfirmLinkReplacement -f $IssuancePolicyName, $OID."msDS-OIDToGroupLink", $group.distinguishedName write-host $tmp "( (y)es / (n)o )" -ForegroundColor Yellow -nonewline @@ -1001,31 +752,17 @@ write-host $tmp -Foreground Red } } ``` - **Note**   If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter. -   - ## Related topics - - [Isolated User Mode in Windows 10 with Dave Probert (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/Isolated-User-Mode-in-Windows-10-with-Dave-Probert) - [Isolated User Mode Processes and Features in Windows 10 with Logan Gabriel (Channel 9)](http://channel9.msdn.com/Blogs/Seth-Juarez/Isolated-User-Mode-Processes-and-Features-in-Windows-10-with-Logan-Gabriel) - [More on Processes and Features in Windows 10 Isolated User Mode with Dave Probert (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/More-on-Processes-and-Features-in-Windows-10-Isolated-User-Mode-with-Dave-Probert) - [Mitigating Credential Theft using the Windows 10 Isolated User Mode (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/Mitigating-Credential-Theft-using-the-Windows-10-Isolated-User-Mode) - [Enabling Strict KDC Validation in Windows Kerberos](http://www.microsoft.com/download/details.aspx?id=6382) - [What's New in Kerberos Authentication for Windows Server 2012](http://technet.microsoft.com/library/hh831747.aspx) - [Authentication Mechanism Assurance for AD DS in Windows Server 2008 R2 Step-by-Step Guide](http://technet.microsoft.com/library/dd378897.aspx) - [Trusted Platform Module](trusted-platform-module-overview.md) -   -   diff --git a/windows/keep-secure/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md b/windows/keep-secure/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md index 33a9de5798..5d4da312b6 100644 --- a/windows/keep-secure/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md +++ b/windows/keep-secure/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md @@ -2,50 +2,30 @@ title: DCOM Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax (Windows 10) description: Describes the best practices, location, values, and security considerations for the DCOM Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax policy setting. ms.assetid: 0fe3521a-5252-44df-8a47-8d92cf936e7c +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax - - **Applies to** - - Windows 10 - Describes the best practices, location, values, and security considerations for the **DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax** policy setting. - ## Reference - - This policy setting allows you to define additional computer-wide controls that govern access to all Distributed Component Object Model (DCOM)–based applications on a device. These controls restrict call, activation, or launch requests on the device. A simple way to think about these access controls is as an additional access check that is performed against a device-wide access control list (ACL) on each call, activation, or launch of any COM-based server. If the access check fails, the call, activation, or launch request is denied. (This check is in addition to any access check that is run against the server-specific ACLs.) In effect, it provides a minimum authorization standard that must be passed to access any COM-based server. This policy setting controls access permissions to cover call rights. - These device-wide ACLs provide a way to override weak security settings that are specified by an application through the CoInitializeSecurity function or application-specific security settings. They provide a minimum security standard that must be passed, regardless of the settings of the specific server. - These ACLs also provide a centralized location for an administrator to set a general authorization policy that applies to all COM-based servers on the device. - This policy setting allows you to specify an ACL in two different ways. You can type the security descriptor in SDDL, or you can grant or deny Local Access and Remote Access permissions to users and groups. We recommend that you use the built-in user interface to specify the ACL contents that you want to apply with this setting. The default ACL settings vary, depending on the version of Windows you are running. - ### Possible values - - *User-defined input* of the SDDL representation of the groups and privileges - When you specify the users or groups that are to be given permissions, the security descriptor field is populated with the Security Descriptor Definition Language representation of those groups and privileges. Users and groups can be given explicit Allow or Deny privileges for local access and remote access. - - Blank - This represents how the local security policy deletes the policy enforcement key. This value deletes the policy and then sets it as Not defined. The Blank value is set by using the ACL editor to empty the list, and then pressing OK. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -84,53 +64,24 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. - ### Group Policy - The registry settings that are created as a result of enabling the **DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax** policy setting take precedence over the previous registry settings when this policy setting was configured. The Remote Procedure Call (RPC) service checks the new registry keys in the Policies section for the computer restrictions, and these registry entries take precedence over the existing registry keys under OLE. This means that previously existing registry settings are no longer effective, and if you make changes to the existing settings, device access permissions for users are not changed. Use care in configuring the list of users and groups. - If the administrator is denied permission to access DCOM applications due to the changes made to DCOM in the Windows operating system, the administrator can use the **DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax** policy setting to manage DCOM access to the computer. The administrator can use this setting to specify which users and groups can access the DCOM application on the computer locally and remotely. This will restore control of the DCOM application to the administrator and users. To do this, open the **DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax** setting, and click **Edit Security**. Specify the users or groups you want to include and the computer access permissions for those users or groups. This defines the setting and sets the appropriate SDDL value. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Many COM applications include some security-specific code (for example, to call CoInitializeSecurity), but they use weak settings that allow unauthenticated access to the process. Administrators cannot override these settings to force stronger security in earlier versions of Windows without modifying the application. An attacker could attempt to exploit weak security in an individual application by attacking it through COM calls. - Also, the COM infrastructure includes the Remote Procedure Call Services (RPCSS), a system service that runs during and after computer startup. This service manages activation of COM objects and the running object table and provides helper services to DCOM remoting. It exposes RPC interfaces that can be called remotely. Because some COM-based servers allow unauthenticated remote access, these interfaces can be called by anyone, including unauthenticated users. As a result, RPCSS can be attacked by malicious users who use remote, unauthenticated computers. - ### Countermeasure - To protect individual COM-based applications or services, set the **DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax** setting to an appropriate device-wide ACL. - ### Potential impact - Windows implements default COM ACLs when they are installed. Modifying these ACLs from the default may cause some applications or components that communicate by using DCOM to fail. If you implement a COM-based server and you override the default security settings, confirm that the application-specific call permissions that ACL assigns are the correct permissions for appropriate users. If it does not, you must change your application-specific permission ACL to provide appropriate users with activation rights so that applications and Windows components that use DCOM do not fail. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md b/windows/keep-secure/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md index 3ec93358be..ec95e60bb9 100644 --- a/windows/keep-secure/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md +++ b/windows/keep-secure/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md @@ -2,48 +2,29 @@ title: DCOM Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax (Windows 10) description: Describes the best practices, location, values, and security considerations for the DCOM Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax security policy setting. ms.assetid: 4b95d45f-dd62-4c34-ba32-43954528dabe +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax - - **Applies to** - - Windows 10 - Describes the best practices, location, values, and security considerations for the **DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax** security policy setting. - ## Reference - - This policy setting is similar to the [DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax](dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md) setting in that it allows you to define additional computer-wide controls that govern access to all DCOM–based applications on a device. However, the ACLs that are specified in this policy setting control local and remote COM launch requests (not access requests) on the device. A simple way to think about this access control is as an additional access check that is performed against a device-wide ACL on each launch of any COM-based server. If the access check fails, the call, activation, or launch request is denied. (This check is in addition to any access check that is run against the server-specific ACLs.) In effect, it provides a minimum authorization standard that must be passed to launch any COM-based server. The DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax policy setting differs in that it provides a minimum access check that is applied to attempts to access an already launched COM-based server. - These device-wide ACLs provide a way to override weak security settings that are specified by an application through CoInitializeSecurity or application-specific security settings. They provide a minimum security standard that must be passed, regardless of the settings of the specific COM-based server. These ACLs provide a centralized location for an administrator to set a general authorization policy that applies to all COM-based servers. - The **DCOM: Machine Launch Restrictions in the Security Descriptor Definition Language (SDDL) syntax** setting allows you to specify an ACL in two ways. You can type the security descriptor in SDDL, or you can grant or deny Local Access and Remote Access permissions to users and groups. We recommend that you use the built-in user interface to specify the ACL contents that you want to apply with this setting. The default ACL settings vary, depending on the version of Windows you are running. - ### Possible values - - Blank - This represents how the local security policy deletes the policy enforcement key. This value deletes the policy and then sets it to Not defined. The Blank value is set by using the ACL editor to empty the list, and then pressing OK. - - *User-defined input* of the SDDL representation of the groups and privileges - When you specify the users or groups that are to be given permission, the security descriptor field is populated with the Security Descriptor Definition Language representation of those groups and privileges. Users and groups can be given explicit Allow or Deny privileges on both local access and remote access. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -82,55 +63,25 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. - ### Group Policy - The registry settings that are created as a result of this policy take precedence over the previous registry settings in this area. The Remote Procedure Call (RPC) service (RpcSs) checks the new registry keys in the Policies section for the computer restrictions; these entries take precedence over the existing registry keys under OLE. - If you are denied access to activate and launch DCOM applications due to the changes made to DCOM in the Windows operating system, this policy setting can be used to control the DCOM activation and launch to the device. - You can specify which users and groups can launch and activate DCOM applications on the device locally and remotely by using the **DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax** policy setting. This restores control of the DCOM application to the administrator and specified users. To do this, open the **DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax** setting, and click **Edit Security**. Specify the groups that you want to include and the device launch permissions for those groups. This defines the setting and sets the appropriate SDDL value. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Many COM applications include some security-specific code (for example, to call CoInitializeSecurity), but they use weak settings that allow unauthenticated access to the process. You cannot override these settings to force stronger security in earlier versions of Windows without modifying the application. An attacker could attempt to exploit weak security in an individual application by attacking it through COM calls. - Also, the COM infrastructure includes the Remote Procedure Call Service (RPCSS), a system service that runs during computer startup and always runs after that. This service manages activation of COM objects and the running object table and provides helper services to DCOM remoting. It exposes RPC interfaces that can be called remotely. Because some COM-based servers allow unauthenticated remote component activation, these interfaces can be called by anyone, including unauthenticated users. As a result, RPCSS can be attacked by malicious users using remote, unauthenticated computers. - ### Countermeasure - To protect individual COM-based applications or services, set this policy setting to an appropriate computer-wide ACL. - ### Potential impact - Windows implements default COM ACLs when they are installed. Modifying these ACLs from the default may cause some applications or components that communicate by using DCOM to fail. If you implement a COM-based server and you override the default security settings, confirm that the application-specific launch permissions ACL assigns include activation permissions to appropriate users. If it does not, you must change your application-specific launch permission ACL to provide appropriate users with activation rights so that applications and Windows components that use DCOM do not fail. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/debug-programs.md b/windows/keep-secure/debug-programs.md index 2950e96f89..cfcafef2b9 100644 --- a/windows/keep-secure/debug-programs.md +++ b/windows/keep-secure/debug-programs.md @@ -2,48 +2,29 @@ title: Debug programs (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Debug programs security policy setting. ms.assetid: 594d9f2c-8ffc-444b-9522-75615ec87786 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Debug programs - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Debug programs** security policy setting. - ## Reference - - This policy setting determines which users can attach to or open any process, even those they do not own. Developers who are debugging their own applications do not need to be assigned this user right. Developers who are debugging new system components need this user right. This user right provides access to sensitive and critical operating-system components. - Constant: SeDebugPrivilege - ### Possible values - - User-defined list of accounts - - Not defined - ### Best practices - - Assign this user right only to trusted users to reduce security vulnerabilities. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - By default, members of the Administrators group have this right. - The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - @@ -82,59 +63,27 @@ The following table lists the actual and effective default policy values for the
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - A restart of the device is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - ### Group Policy - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - The **Debug programs** user right can be exploited to capture sensitive device information from system memory or to access and modify kernel or application structures. Some attack tools exploit this user right to extract hashed passwords and other private security information or to insert malware. By default, the **Debug programs** user right is assigned only to administrators, which helps mitigate risk from this vulnerability. - ### Countermeasure - Remove the accounts of all users and groups that do not require the **Debug programs** user right. - ### Potential impact - If you revoke this user right, no one can debug programs. However, typical circumstances rarely require this capability on production devices. If an issue arises that requires an application to be debugged on a production server, you can move the server to a different organizational unit (OU) temporarily and assign the **Debug programs** user right to a separate Group Policy for that OU. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/delete-an-applocker-rule.md b/windows/keep-secure/delete-an-applocker-rule.md index bed27aa9de..7b34477fad 100644 --- a/windows/keep-secure/delete-an-applocker-rule.md +++ b/windows/keep-secure/delete-an-applocker-rule.md @@ -2,47 +2,26 @@ title: Delete an AppLocker rule (Windows 10) description: This topic for IT professionals describes the steps to delete an AppLocker rule. ms.assetid: 382b4be3-0df9-4308-89b2-dcf9df351eb5 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Delete an AppLocker rule - - **Applies to** - - Windows 10 - This topic for IT professionals describes the steps to delete an AppLocker rule. - As older apps are retired and new apps are deployed in your organization, it will be necessary to modify the application control policies. If an app becomes unsupported by the IT department or is no longer allowed due to the organization's security policy, then deleting the rule or rules associated with that app will prevent the app from running. - For info about testing an AppLocker policy to see what rules affect which files or applications, see [Test an AppLocker policy by Using Test-AppLockerPolicy](test-an-applocker-policy-by-using-test-applockerpolicy.md). - You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). - **To delete a rule in an AppLocker policy** - 1. Open the AppLocker console. - 2. Click the appropriate rule collection for which you want to delete the rule. - 3. In the details pane, right-click the rule to delete, click **Delete**, and then click **Yes**. - **Note**   When using Group Policy, for the rule deletion to take effect on computers within the domain, the GPO must be distributed or refreshed. - When this procedure is performed on the local device, the AppLocker policy takes effect immediately. -   -   -   - - - - - diff --git a/windows/keep-secure/deny-access-to-this-computer-from-the-network.md b/windows/keep-secure/deny-access-to-this-computer-from-the-network.md index e4e6d176a7..07247e4be1 100644 --- a/windows/keep-secure/deny-access-to-this-computer-from-the-network.md +++ b/windows/keep-secure/deny-access-to-this-computer-from-the-network.md @@ -2,48 +2,29 @@ title: Deny access to this computer from the network (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Deny access to this computer from the network security policy setting. ms.assetid: 935e9f89-951b-4163-b186-fc325682bb0b +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Deny access to this computer from the network - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Deny access to this computer from the network** security policy setting. - ## Reference - - This security setting determines which users are prevented from accessing a device over the network. - Constant: SeDenyNetworkLogonRight - ### Possible values - - User-defined list of accounts - - Guest - ### Best practices - - Because all Active Directory Domain Services programs use a network logon for access, use caution when you assign this user right on domain controllers. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - By default, this setting is Guest on domain controllers and on stand-alone servers. - The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - @@ -82,71 +63,33 @@ The following table lists the actual and effective default policy values. Defaul
-   - ## Policy management - - This section describes features and tools available to help you manage this policy. - A restart of the device is not required for this policy setting to be effective. - This policy setting supersedes the **Access this computer from the network** policy setting if a user account is subject to both policies. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - ### Group Policy - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Users who can log on to the device over the network can enumerate lists of account names, group names, and shared resources. Users with permission to access shared folders and files can connect over the network and possibly view or modify data. - ### Countermeasure - Assign the **Deny access to this computer from the network** user right to the following accounts: - - Anonymous logon - - Built-in local Administrator account - - Local Guest account - - All service accounts - An important exception to this list is any service accounts that are used to start services that must connect to the device over the network. For example, let’s say you have configured a shared folder for web servers to access, and you present content within that folder through a website. You may need to allow the account that runs IIS to log on to the server with the shared folder from the network. This user right is particularly effective when you must configure servers and workstations on which sensitive information is handled because of regulatory compliance concerns. - ### Potential impact - If you configure the **Deny access to this computer from the network** user right for other accounts, you could limit the abilities of users who are assigned to specific administrative roles in your environment. You should verify that delegated tasks are not negatively affected. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/deny-log-on-as-a-batch-job.md b/windows/keep-secure/deny-log-on-as-a-batch-job.md index c7a4c65273..11dbb9313f 100644 --- a/windows/keep-secure/deny-log-on-as-a-batch-job.md +++ b/windows/keep-secure/deny-log-on-as-a-batch-job.md @@ -2,50 +2,30 @@ title: Deny log on as a batch job (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Deny log on as a batch job security policy setting. ms.assetid: 0ac36ebd-5e28-4b6a-9b4e-8924c6ecf44b +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Deny log on as a batch job - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Deny log on as a batch job** security policy setting. - ## Reference - - This policy setting determines which accounts are prevented from logging on by using a batch-queue tool to schedule and start jobs automatically in the future. The ability to log on by using a batch-queue tool is needed for any account that is used to start scheduled jobs by means of the Task Scheduler. - Constant: SeDenyBatchLogonRight - ### Possible values - - User-defined list of accounts - - Not defined - ### Best practices - 1. When you assign this user right, thoroughly test that the effect is what you intended. - 2. Within a domain, modify this setting on the applicable Group Policy Object (GPO). - 3. **Deny log on as a batch job** prevents administrators or operators from using their personal accounts to schedule tasks, which helps with business continuity when that person transitions to other positions or responsibilities. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - @@ -84,65 +64,30 @@ The following table lists the actual and effective default policy values for the
-   - ## Policy management - - This section describes features and tools available to help you manage this policy. - A restart of the device is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - This policy setting might conflict with and negate the **Log on as a batch job** setting. - ### Group Policy - On a domain-joined device, including the domain controller, this policy can be overwritten by a domain policy, which will prevent you from modifying the local policy setting. - For example, if you are trying to configure Task Scheduler on your domain controller, check the Settings tab of your two domain controller policy and domain policy GPOs in the Group Policy Management Console (GPMC). Verify the targeted account is not present in the **Deny log on as a batch job** User Rights Assignment and also correctly configured in the **Log on as a batch job** setting. - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Accounts that have the **Deny log on as a batch job** user right could be used to schedule jobs that could consume excessive computer resources and cause a denial-of-service condition. - ### Countermeasure - Assign the **Deny log on as a batch job** user right to the local Guest account. - ### Potential impact - If you assign the **Deny log on as a batch job** user right to other accounts, you could deny the ability to perform required job activities to users who are assigned specific administrative roles. You should confirm that delegated tasks are not affected adversely. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/deny-log-on-as-a-service.md b/windows/keep-secure/deny-log-on-as-a-service.md index 005a760cfe..af4556d1b8 100644 --- a/windows/keep-secure/deny-log-on-as-a-service.md +++ b/windows/keep-secure/deny-log-on-as-a-service.md @@ -2,50 +2,30 @@ title: Deny log on as a service (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Deny log on as a service security policy setting. ms.assetid: f1114964-df86-4278-9b11-e35c66949794 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Deny log on as a service - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Deny log on as a service** security policy setting. - ## Reference - - This policy setting determines which users are prevented from logging on to the service applications on a device. - A service is an application type that runs in the system background without a user interface. It provides core operating system features, such as web serving, event logging, file serving, printing, cryptography, and error reporting. - Constant: SeDenyServiceLogonRight - ### Possible values - - User-defined list of accounts - - Not defined - ### Best practices - 1. When you assign this user right, thoroughly test that the effect is what you intended. - 2. Within a domain, modify this setting on the applicable Group Policy Object (GPO). - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - @@ -84,63 +64,29 @@ The following table lists the actual and effective default policy values for the
-   - ## Policy management - - This section describes features and tools available to help you manage this policy. - A restart of the computer is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - ### Group Policy - On a domain-joined device, including the domain controller, this policy can be overwritten by a domain policy, which will prevent you from modifying the local policy setting. - This policy setting might conflict with and negate the **Log on as a service** setting. - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Accounts that can log on to a service application could be used to configure and start new unauthorized services, such as a keylogger or other malware. The benefit of the specified countermeasure is somewhat reduced by the fact that only users with administrative rights can install and configure services, and an attacker who has already attained that level of access could configure the service to run by using the System account. - ### Countermeasure - We recommend that you not assign the **Deny log on as a service** user right to any accounts. This is the default configuration. Organizations that are extremely concerned about security might assign this user right to groups and accounts when they are certain that they will never need to log on to a service application. - ### Potential impact - If you assign the **Deny log on as a service** user right to specific accounts, services may not start and a denial-of-service condition could result. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/deny-log-on-locally.md b/windows/keep-secure/deny-log-on-locally.md index 82391e79b2..e8bc095116 100644 --- a/windows/keep-secure/deny-log-on-locally.md +++ b/windows/keep-secure/deny-log-on-locally.md @@ -2,48 +2,29 @@ title: Deny log on locally (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Deny log on locally security policy setting. ms.assetid: 00150e88-ec9c-43e1-a70d-33bfe10434db +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Deny log on locally - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Deny log on locally** security policy setting. - ## Reference - - This policy setting determines which users are prevented from logging on directly at the device's console. - Constant: SeDenyInteractiveLogonRight - ### Possible values - - User-defined list of accounts - - Not defined - ### Best practices - 1. Assign the **Deny log on locally** user right to the local guest account to restrict access by potentially unauthorized users. - 2. Test your modifications to this policy setting in conjunction with the **Allow log on locally** policy setting to determine if the user account is subject to both policies. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - @@ -82,63 +63,29 @@ The following table lists the actual and effective default policy values for the
-   - ## Policy management - - This section describes features, tools, and guidance to help you manage this policy. - A restart of the device is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - If you apply this policy setting to the Everyone group, no one will be able to log on locally. - ### Group Policy - This policy setting supersedes the **Allow log on locally** policy setting if a user account is subject to both policies. - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Any account with the ability to log on locally could be used to log on at the console of the device. If this user right is not restricted to legitimate users who must log on to the console of the device, unauthorized users might download and run malicious software that elevates their user rights. - ### Countermeasure - Assign the **Deny log on locally** user right to the local Guest account. If you have installed optional components such as ASP.NET, you may want to assign this user right to additional accounts that are required by those components. - ### Potential impact - If you assign the **Deny log on locally** user right to additional accounts, you could limit the abilities of users who are assigned to specific roles in your environment. However, this user right should explicitly be assigned to the ASPNET account on device that are configured with the Web Server role. You should confirm that delegated activities are not adversely affected. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/deny-log-on-through-remote-desktop-services.md b/windows/keep-secure/deny-log-on-through-remote-desktop-services.md index 952c471dfd..85f6651839 100644 --- a/windows/keep-secure/deny-log-on-through-remote-desktop-services.md +++ b/windows/keep-secure/deny-log-on-through-remote-desktop-services.md @@ -2,46 +2,28 @@ title: Deny log on through Remote Desktop Services (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Deny log on through Remote Desktop Services security policy setting. ms.assetid: 84bbb807-287c-4acc-a094-cf0ffdcbca67 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Deny log on through Remote Desktop Services - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Deny log on through Remote Desktop Services** security policy setting. - ## Reference - - This policy setting determines which users are prevented from logging on to the device through a Remote Desktop connection through Remote Desktop Services. It is possible for a user to establish a Remote Desktop connection to a particular server, but not be able to log on to the console of that server. - Constant: SeDenyRemoteInteractiveLogonRight - ### Possible values - - User-defined list of accounts - - Not defined - ### Best practices - - To control who can open a Remote Desktop connection and log on to the device, add the user account to or remove user accounts from the Remote Desktop Users group. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - @@ -80,63 +62,29 @@ The following table lists the actual and effective default policy values for the
-   - ## Policy management - - This section describes features, tools, and guidance to help you manage this policy. - A restart of the computer is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - The **Remote System** property controls settings for Remote Desktop Services (**Allow or prevent remote connections to the computer**) and for Remote Assistance (**Allow Remote Assistance connections to this computer**). - ### Group Policy - This policy setting supersedes the [Allow log on through Remote Desktop Services](allow-log-on-through-remote-desktop-services.md) policy setting if a user account is subject to both policies. - Group Policy settings are applied in the following order. They overwrite settings on the local device at the next Group Policy update. - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. Organizational unit policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Any account with the right to log on through Remote Desktop Services could be used to log on to the remote console of the device. If this user right is not restricted to legitimate users who need to log on to the console of the computer, malicious users might download and run software that elevates their user rights. - ### Countermeasure - Assign the **Deny log on through Remote Desktop Services** user right to the built-in local guest account and all service accounts. If you have installed optional components, such as ASP.NET, you may want to assign this user right to additional accounts that are required by those components. - ### Potential impact - If you assign the **Deny log on through Remote Desktop Services** user right to other groups, you could limit the abilities of users who are assigned to specific administrative roles in your environment. Accounts that have this user right cannot connect to the device through Remote Desktop Services or Remote Assistance. You should confirm that delegated tasks are not negatively affected. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/deploy-applocker-policies-by-using-the-enforce-rules-setting.md b/windows/keep-secure/deploy-applocker-policies-by-using-the-enforce-rules-setting.md index dee2747b62..cfd595104f 100644 --- a/windows/keep-secure/deploy-applocker-policies-by-using-the-enforce-rules-setting.md +++ b/windows/keep-secure/deploy-applocker-policies-by-using-the-enforce-rules-setting.md @@ -2,69 +2,34 @@ title: Deploy AppLocker policies by using the enforce rules setting (Windows 10) description: This topic for IT professionals describes the steps to deploy AppLocker policies by using the enforcement setting method. ms.assetid: fd3a3d25-ff3b-4060-8390-6262a90749ba +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Deploy AppLocker policies by using the enforce rules setting - - **Applies to** - - Windows 10 - This topic for IT professionals describes the steps to deploy AppLocker policies by using the enforcement setting method. - ## Background and prerequisites - - These procedures assume that you have already deployed AppLocker policies with the enforcement set to **Audit only**, and you have been collecting data through the AppLocker event logs and other channels to determine what effect these policies have on your environment and the policy's adherence to your application control design. - For info about the AppLocker policy enforcement setting, see [Understand AppLocker enforcement settings](understand-applocker-enforcement-settings.md). - For info about how to plan an AppLocker policy deployment, see [AppLocker Design Guide](applocker-policies-design-guide.md). - ## Step 1: Retrieve the AppLocker policy - - Updating an AppLocker policy that is currently enforced in your production environment can have unintended results. Using Group Policy, you can export the policy from the Group Policy Object (GPO) and then update the rule or rules by using AppLocker on your AppLocker reference or test PC. For the procedure to do this, see [Export an AppLocker policy from a GPO](export-an-applocker-policy-from-a-gpo.md) and [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md). For local AppLocker policies, you can update the rule or rules by using the Local Security policy snap-in (secpol.msc) on your AppLocker reference or test PC. For the procedures to do this, see [Export an AppLocker policy to an XML file](export-an-applocker-policy-to-an-xml-file.md) and [Import an AppLocker policy from another computer](import-an-applocker-policy-from-another-computer.md). - ## Step 2: Alter the enforcement setting - - Rule enforcement is applied only to a collection of rules, not to individual rules. AppLocker divides the rules into collections: executable files, Windows Installer files, packaged apps, scripts, and DLL files. By default, if enforcement is not configured and rules are present in a rule collection, those rules are enforced. For information about the enforcement setting, see [Understand AppLocker Enforcement Settings](understand-applocker-enforcement-settings.md). For the procedure to alter the enforcement setting, see [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md). - ## Step 3: Update the policy - - You can edit an AppLocker policy by adding, changing, or removing rules. However, you cannot specify a version for the AppLocker policy by importing additional rules. To ensure version control when modifying an AppLocker policy, use Group Policy management software that allows you to create versions of GPOs. An example of this type of software is the [Advanced Group Policy Management](http://go.microsoft.com/fwlink/p/?LinkId=145013) feature from the Microsoft Desktop Optimization Pack. - **Caution**   You should not edit an AppLocker rule collection while it is being enforced in Group Policy. Because AppLocker controls what files are allowed to run, making changes to a live policy can create unexpected behavior. -   - For the procedure to update the GPO, see [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md). - For the procedures to distribute policies for local PCs by using the Local Security Policy snap-in (secpol.msc), see [Export an AppLocker policy to an XML file](export-an-applocker-policy-to-an-xml-file.md) and [Import an AppLocker policy from another computer](import-an-applocker-policy-from-another-computer.md). - ## Step 4: Monitor the effect of the policy - - When a policy is deployed, it is important to monitor the actual implementation of that policy. You can do this by monitoring your support organization's app access request activity and reviewing the AppLocker event logs. To monitor the effect of the policy, see [Monitor Application Usage with AppLocker](monitor-application-usage-with-applocker.md). - ## Additional resources - - - For steps to perform other AppLocker policy tasks, see [Administer AppLocker](administer-applocker.md). -   -   - - - - - diff --git a/windows/keep-secure/deploy-the-applocker-policy-into-production.md b/windows/keep-secure/deploy-the-applocker-policy-into-production.md index da107fefad..1fbb0a2cc3 100644 --- a/windows/keep-secure/deploy-the-applocker-policy-into-production.md +++ b/windows/keep-secure/deploy-the-applocker-policy-into-production.md @@ -2,60 +2,31 @@ title: Deploy the AppLocker policy into production (Windows 10) description: This topic for the IT professional describes the tasks that should be completed before you deploy AppLocker application control settings. ms.assetid: ebbb1907-92dc-499e-8cee-8e637483c9ae +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Deploy the AppLocker policy into production - - **Applies to** - - Windows 10 - This topic for the IT professional describes the tasks that should be completed before you deploy AppLocker application control settings. - After successfully testing and modifying the AppLocker policy for each Group Policy Object (GPO), you are ready to deploy the enforcement settings into production. For most organizations, this means switching the AppLocker enforcement setting from **Audit only** to **Enforce rules**. However, it is important to follow the deployment plan that you created earlier. For more info, see the [AppLocker Design Guide](applocker-policies-design-guide.md). Depending on the needs of different business groups in your organization, you might deploy different enforcement settings for linked GPOs. - ### Understand your design decisions - Before you deploy an AppLocker policy, you should determine: - - For each business group, which applications will be controlled and in what manner. For more info, see [Create a list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md). - - How to handle requests for application access. For info about what to consider when developing your support policies, see [Plan for AppLocker policy management](plan-for-applocker-policy-management.md). - - How to manage events, including forwarding events. For info about event management in AppLocker, see [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md). - - Your GPO structure, including how to include policies generated by Software Restriction Policies and AppLocker policies. For more info, see [Determine the Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md). - For info about how AppLocker deployment is dependent on design decisions, see [Understand AppLocker policy design decisions](understand-applocker-policy-design-decisions.md). - ### AppLocker deployment methods - If you have configured a reference device, you can create and update your AppLocker policies on this device, test the policies, and then export the policies to the appropriate GPO for distribution. Another method is to create the policies and set the enforcement setting on **Audit only**, then observe the events that are generated. - - [Use a reference device to create and maintain AppLocker policies](use-a-reference-computer-to-create-and-maintain-applocker-policies.md) - This topic describes the steps to use an AppLocker reference computer to prepare application control policies for deployment by using Group Policy or other means. - - [Deploy AppLocker policies by using the enforce rules setting](deploy-applocker-policies-by-using-the-enforce-rules-setting.md) - This topic describes the steps to deploy the AppLocker policy by changing the enforcement setting to **Audit only** or to **Enforce rules**. - ## See also - - [AppLocker deployment guide](applocker-policies-deployment-guide.md) - -   -   - - - - - diff --git a/windows/keep-secure/determine-group-policy-structure-and-rule-enforcement.md b/windows/keep-secure/determine-group-policy-structure-and-rule-enforcement.md index 8fc14ddac0..68200b376d 100644 --- a/windows/keep-secure/determine-group-policy-structure-and-rule-enforcement.md +++ b/windows/keep-secure/determine-group-policy-structure-and-rule-enforcement.md @@ -2,24 +2,17 @@ title: Determine the Group Policy structure and rule enforcement (Windows 10) description: This overview topic describes the process to follow when you are planning to deploy AppLocker rules. ms.assetid: f435fcbe-c7ac-4ef0-9702-729aab64163f +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Determine the Group Policy structure and rule enforcement - - **Applies to** - - Windows 10 - This overview topic describes the process to follow when you are planning to deploy AppLocker rules. - ## In this section - - @@ -46,29 +39,14 @@ This overview topic describes the process to follow when you are planning to dep
-   - When you are determining how many Group Policy Objects (GPOs) to create when you apply an AppLocker policy in your organization, you should consider the following: - - Whether you are creating new GPOs or using existing GPOs - - Whether you are implementing Software Restriction Policies (SRP) policies and AppLocker policies in the same GPO - - GPO naming conventions - - GPO size limits - **Note**   There is no default limit on the number of AppLocker rules that you can create. However, in Windows Server 2008 R2, GPOs have a 2 MB size limit for performance. In subsequent versions, that limit is raised to 100 MB. -   -   -   - - - - - diff --git a/windows/keep-secure/determine-which-applications-are-digitally-signed-on-a-reference-computer.md b/windows/keep-secure/determine-which-applications-are-digitally-signed-on-a-reference-computer.md index b909f207d6..ad2925ee0a 100644 --- a/windows/keep-secure/determine-which-applications-are-digitally-signed-on-a-reference-computer.md +++ b/windows/keep-secure/determine-which-applications-are-digitally-signed-on-a-reference-computer.md @@ -2,45 +2,24 @@ title: Determine which apps are digitally signed on a reference device (Windows 10) description: This topic for the IT professional describes how to use AppLocker logs and tools to determine which applications are digitally signed. ms.assetid: 24609a6b-fdcb-4083-b234-73e23ff8bcb8 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Determine which apps are digitally signed on a reference device - - **Applies to** - - Windows 10 - This topic for the IT professional describes how to use AppLocker logs and tools to determine which applications are digitally signed. - The Windows PowerShell cmdlet **Get-AppLockerFileInformation** can be used to determine which apps installed on your reference devices are digitally signed. Perform the following steps on each reference computer that you used to define the AppLocker policy. The device does not need to be joined to the domain. - Membership in the local **Administrators** group, or equivalent, is the minimum required to complete this procedure. - **To determine which apps are digitally signed on a reference device** - 1. Run **Get-AppLockerFileInformation** with the appropriate parameters. - The **Get-AppLockerFileInformation** cmdlet retrieves the AppLocker file information from a list of files or from an event log. File information that is retrieved can include publisher information, file hash information, and file path information. File information from an event log may not contain all of these fields. Files that are not signed do not have any publisher information. - 2. Analyze the publisher's name and digital signature status from the output of the command. - For command parameters, syntax, and examples, see [Get-AppLockerFileInformation](http://technet.microsoft.com/library/ee460961.aspx). - ## Related topics - - [Use a reference device to create and maintain AppLocker policies](use-a-reference-computer-to-create-and-maintain-applocker-policies.md) -   -   - - - - - diff --git a/windows/keep-secure/determine-your-application-control-objectives.md b/windows/keep-secure/determine-your-application-control-objectives.md index 653b1b4585..55e77bdb3b 100644 --- a/windows/keep-secure/determine-your-application-control-objectives.md +++ b/windows/keep-secure/determine-your-application-control-objectives.md @@ -2,27 +2,19 @@ title: Determine your application control objectives (Windows 10) description: This topic helps you with the decisions you need to make to determine what applications to control and how to control them by comparing Software Restriction Policies (SRP) and AppLocker. ms.assetid: 0e84003e-6095-46fb-8c4e-2065869bb53b +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Determine your application control objectives - - **Applies to** - - Windows 10 - This topic helps you with the decisions you need to make to determine what applications to control and how to control them by comparing Software Restriction Policies (SRP) and AppLocker. - AppLocker is very effective for organizations with app restriction requirements whose environments have a simple topography and the application control policy goals are straightforward. For example, AppLocker can benefit an environment where non-employees have access to computers connected to the organizational network, such as a school or library. Large organizations also benefit from AppLocker policy deployment when the goal is to achieve a detailed level of control on the PCs that they manage for a relatively small number of apps. - There are management and maintenance costs associated with a list of allowed apps. In addition, the purpose of application control policies is to allow or prevent employees from using apps that might actually be productivity tools. Keeping employees or users productive while implementing the policies can cost time and effort. Lastly, creating user support processes and network support processes to keep the organization productive are also concerns. - Use the following table to develop your own objectives and determine which application control feature best addresses those objectives. - @@ -155,16 +147,7 @@ Use the following table to develop your own objectives and determine which appli
-   - For more general info, see [AppLocker](applocker-overview.md). -   -   - - - - - diff --git a/windows/keep-secure/device-guard-certification-and-compliance.md b/windows/keep-secure/device-guard-certification-and-compliance.md index 4fba3a5dc4..d9d3bedae8 100644 --- a/windows/keep-secure/device-guard-certification-and-compliance.md +++ b/windows/keep-secure/device-guard-certification-and-compliance.md @@ -2,70 +2,40 @@ title: Device Guard certification and compliance (Windows 10) description: Device Guard is a combination of hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications. ms.assetid: 94167ECA-AB08-431D-95E5-7A363F42C7E3 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Device Guard certification and compliance - - **Applies to** - - Windows 10 - Device Guard is a combination of hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications. If the app isn’t trusted it can’t run, period. It also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code after the computer restarts because of how decisions are made about what can run and when. - Device Guard uses the new virtualization-based security in Windows 10 to isolate the Code Integrity service from the Windows kernel itself, letting the service use signatures defined by your enterprise-controlled policy to help determine what is trustworthy. In effect, the Code Integrity service runs alongside the kernel in a Windows hypervisor-protected container. - For details on how to implement Device Guard, see [Device Guard deployment guide](device-guard-deployment-guide.md). - ## Why use Device Guard - - With thousands of new malicious files created every day, using traditional methods like signature-based detection to fight against malware provides an inadequate defense against new attacks. Device Guard on Windows 10 changes from a mode where apps are trusted unless blocked by an antivirus or other security solutions, to a mode where the operating system trusts only apps authorized by your enterprise. - Device Guard also helps protect against [zero day attacks](http://go.microsoft.com/fwlink/p/?linkid=534209) and works to combat the challenges of [polymorphic viruses](http://go.microsoft.com/fwlink/p/?LinkId=534210). - ### Advantages to using Device Guard - You can take advantage of the benefits of Device Guard, based on what you turn on and use: - - Helps provide strong malware protection with enterprise manageability - Helps provide the most advanced malware protection ever offered on the Windows platform - Offers improved tamper resistance - ## How Device Guard works - - Device Guard restricts the Windows 10 operating system to only running code that’s signed by trusted signers, as defined by your Code Integrity policy through specific hardware and security configurations, including: - - User Mode Code Integrity (UMCI) - - New kernel code integrity rules (including the new Windows Hardware Quality Labs (WHQL) signing constraints) - - Secure Boot with database (db/dbx) restrictions - - Virtualization-based security to help protect system memory and kernel mode apps and drivers from possible tampering. - - Optional: Trusted Platform Module (TPM) 1.2 or 2.0 - Device Guard works with your image-building process, so you can turn the virtualization-based security feature on for capable devices, configure your Code Integrity policy, and set any other operating system settings you require for Windows 10. After that, Device Guard works to help protect your devices: - 1. Your device starts up using Universal Extensible Firmware Interface (UEFI) Secure Boot, so that boot kits can’t run and so that Windows 10 starts before anything else. - 2. After securely starting up the Windows boot components, Windows 10 can start the Hyper-V virtualization-based security services, including Kernel Mode Code Integrity. These services help protect the system core (kernel), privileged drivers, and system defenses, like anti-malware solutions, by preventing malware from running early in the boot process, or in kernel after startup. - 3. Device Guard uses UMCI to make sure that anything that runs in User mode, such as a service, a Universal Windows Platform (UWP) app, or a Classic Windows application is trusted, allowing only trusted binaries to run. - 4. At the same time that Windows 10 starts up, so too does the trusted platform module (TPM). TPM provides an isolated hardware component that helps protect sensitive information, such as user credentials and certificates. - ## Required hardware and software - - The following table shows the hardware and software you need to install and configure to implement Device Guard. - @@ -124,21 +94,9 @@ The following table shows the hardware and software you need to install and conf
-   - ## Related topics - - [Get apps to run on Device Guard-protected devices](getting-apps-to-run-on-device-guard-protected-devices.md) - [Create a Device Guard code integrity policy based on a reference device](creating-a-device-guard-policy-for-signed-apps.md) -   -   - - - - - diff --git a/windows/keep-secure/device-guard-deployment-guide.md b/windows/keep-secure/device-guard-deployment-guide.md index 5bace9eb68..828d6e54a0 100644 --- a/windows/keep-secure/device-guard-deployment-guide.md +++ b/windows/keep-secure/device-guard-deployment-guide.md @@ -2,177 +2,95 @@ title: Device Guard deployment guide (Windows 10) description: Microsoft Device Guard is a feature set that consists of both hardware and software system integrity hardening features that revolutionize the Windows operating system’s security. ms.assetid: 4BA52AA9-64D3-41F3-94B2-B87EC2717486 +ms.pagetype: devices keywords: virtualization, security, malware ms.prod: W10 ms.mktglfcycl: deploy author: challum --- - # Device Guard deployment guide - **Applies to** - - Windows 10 - Microsoft Device Guard is a feature set that consists of both hardware and software system integrity hardening features that revolutionize the Windows operating system’s security. Windows 10 employs Device Guard as well as code integrity and advanced hardware features such as CPU virtualization extensions, Trusted Platform Module, and second-level address translation to offer comprehensive modern security to its users. This guide explores the individual features in Device Guard as well as how to plan for, configure, and deploy them. - ## Introduction to Device Guard - Today’s security threat landscape is more aggressive than ever before. Modern malicious attacks are focused on revenue generation, intellectual property theft, and targeted system degradation, which results in financial loss. Many of these modern attackers are sponsored by nation states with unknown motives and large cyber terrorism budgets. These threats can enter a company through something as simple as an email message and can permanently damage its reputation for securing its software assets, as well as having significant financial impact. Windows 10 introduces several new security features that help mitigate a large percentage of today’s known threats. - It is estimated that more than 300,000 new malware variants are discovered daily. Unfortunately, companies currently use an ancient method to discover this infectious software and prevent its use. In fact, current PCs trust everything that runs until malware signatures determine whether a threat exists; then, the antimalware software attempts to clean the PC, often after the malicious software’s effect has already been noticed. This signature-based system focuses on reacting to an infection and ensuring that the particular infection does not happen again. In this model, the system that drives malware detection relies on the discovery of malicious software; only then can a signature be provided to the client to remediate it, which implies that a computer must be infected first. The time between the detection of the malware and a client being issued a signature could mean the difference between losing data and staying safe. - In addition to antimalware solutions, there are some “whitelisting” technologies available, including AppLocker. These technologies perform single instance, or blanket-allow or blanket-deny rules for running applications. Although this is more preventative than signature-based detection, it requires significant ongoing maintenance. In Windows 10, these applications are most effective when they are deployed alongside Microsoft Device Guard. - Device Guard breaks the current model of detection first-block later, and allows only trusted applications to run, period. This methodology is consistent with the successful prevention strategy for mobile phone security. With Device Guard, Microsoft has changed how the Windows operating system handles untrusted applications, which makes its defenses difficult for malware to penetrate. This new prevention versus detection model provides Windows clients with the necessary security for modern threats and, when implemented, makes most of today’s threats completely obsolete from day one. - Device Guard's features revolutionize the Windows operating system’s security by taking advantage of new virtualization-based security (VBS) options and the trust-nothing mobile device operating system model, which makes its defenses much more difficult for malware to penetrate. By using configurable code integrity policies, organizations are able to choose exactly which applications are allowed to run in their environment. Configurable code integrity is not limited to Windows Store applications and can be used with existing unsigned or signed Win32 applications, without the requirement that the application be repackaged. In addition, configurable code integrity can be deployed as an individual feature if organizations don’t possess the required hardware for Device Guard. Along with code integrity, Windows 10 leverages advanced hardware features such as CPU virtualization extensions, input/output memory management units (IOMMUs), Trusted Platform Module (TPM), and second-level address translation (SLAT) to offer comprehensive modern security to its users. Device Guard deployed with configurable code integrity and Credential Guard will be among the most impactful client-side security deployments an organization can implement today. In this guide, you learn about the individual features found within Device Guard as well as how to plan for, configure, and deploy them. Device Guard with configurable code integrity is intended for deployment alongside additional threat-mitigating Windows features such as Credential Guard and AppLocker. - ## Device Guard overview - Device Guard is a feature set that consists of both hardware and software system integrity hardening features. These features revolutionize the Windows operating system’s security by taking advantage of new virtualization-based security options and the trust-nothing mobile device operating system model. A key feature in this model is called *configurable code integrity*, which allows your organization to choose exactly which software or trusted software publishers are allowed to run code on your client machines—exactly what has made mobile phone security so successful. In addition, Device Guard offers organizations a way to sign existing line-of-business (LOB) applications so that they can trust their own code, without the requirement that the application be repackaged. Also, this same method of signing provides organizations with a way to trust individual third-party applications. Device Guard—with configurable code integrity, Credential Guard, and AppLocker—is the most complete security defense that any Microsoft product has ever been able to offer a Windows client. - Advanced hardware features such as CPU virtualization extensions, IOMMUs, and SLAT, drive these new client security offerings. By integrating these hardware features further into the core operating system, Windows 10 leverages them in new ways. For example, the same type 1 hypervisor technology that is used to run virtual machines in Microsoft Hyper-V is used to isolate core Windows services into a virtualization-based, protected container. This is just one example of how Windows 10 integrates advanced hardware features deeper into the operating system to offer comprehensive modern security to its users. These hardware features are now available in consumer and enterprise PC markets and are discussed in detail in the [Hardware considerations](#hardware-considerations) section. - Along with these new features, some components of Device Guard are existing tools or technologies that have been included in this strategic security offering to provide customers with the most secure Windows operating system possible. Device Guard is intended as a set of client security features to be used in conjunction with the other threat-resistance features available in the Windows operating system, some of which are mentioned in this guide. In addition to an overview of each feature, this guide walks you through the configuration and deployment of them. - **Configurable code integrity** - The Windows operating system consists of two operating modes: user mode and kernel mode. The base of the operating system runs within the kernel mode, which is where the Windows operating system directly interfaces with hardware resources. User mode is primarily responsible for running applications and brokering information to and from the kernel mode for hardware resource requests. For example, when an application that is running in user mode needs additional memory, the user mode process must request the resources from kernel mode, not directly from RAM. - Code integrity is the component of the Windows operating system that verifies that the code Windows is running is trusted and safe. Like the operating system, Windows code integrity also contains two primary components: kernel mode code integrity (KMCI) and user mode code integrity (UMCI). KMCI has been used in recent versions of the Windows operating system to protect the kernel mode from running unsigned drivers. Although effective, drivers are not the only route that malware can take to penetrate the kernel mode space of the operating system. In Windows 10, however, Microsoft has raised the standard for kernel mode code out of the box as well as provided enterprises with a way to set their own UMCI and KMCI standards. Beginning with the Code Integrity service itself and continuing through the policies a Windows client uses to verify that an application should be allowed to run, Microsoft has made Windows 10 more secure than any previous Windows release. Historically, UMCI has been available only in Windows RT and on Windows Phone devices, which has made it difficult for these devices to be infected with viruses and malware. In Windows 10, these same successful UMCI standards are available. - Historically, most malware has been unsigned. By simply deploying code integrity policies, organizations will immediately protect themselves against unsigned malware, which is estimated to be responsible for more than 95 percent of current attacks. By using code integrity policies, an enterprise can select exactly which binaries are allowed to run in both user mode and kernel mode, from the signer to the hash level. When completely enforced, it makes user mode in Windows function like a mobile phone, by allowing only specific applications or specific signatures to be trusted and run. This feature alone fundamentally changes the security in an enterprise. This additional security is not limited to Windows apps and does not require that an application be rewritten to be compatible with your existing, unsigned applications. You can implement configurable code integrity without enabling Device Guard, but it is intended to run in conjunction with Device Guard when supported hardware is available. For more information about how to configure, deploy, and manage code integrity policies, see the [Code integrity policies](#code-integrity-policies) section. - **Hardware security features and virtualization-based security** - The Device Guard core functionality and protection start at the hardware level. Devices that have processors equipped with SLAT technologies and virtualization extensions, such as Intel Virtualization Technology (VT-x) and AMD-V, will be able to take advantage of virtualization-based security (VBS) features that enhance Windows security. Device Guard leverages VBS to isolate core Windows services that are critical to the security and integrity of the operating system. This isolation removes the vulnerability of these services from both the user and kernel modes and acts as an impenetrable barrier for most malware used today. One of these isolated services, called the Windows Code Integrity service, drives the Device Guard kernel mode configurable code integrity feature. This prevents code that has penetrated the kernel mode operations from compromising the code integrity service. - Another Windows 10 feature that employs VBS is Credential Guard. Credential Guard provides additional protection to Active Directory domain users by storing domain credentials within the virtualization container that hosts the Windows security services, such as code integrity. By isolating these domain credentials from the active user mode and kernel mode, they have a much lower risk of being stolen. For more information about how Credential Guard complements Device Guard, see the [Device Guard with Credential Guard](#device-guard-with-credential-guard) section. For information about how to enable Credential Guard, see the [Enable Credential Guard](#enable-credential-guard) section. - **Device Guard with AppLocker** - Although AppLocker is not considered a new Device Guard feature, it complements Device Guard functionality when enforced code integrity cannot be fully implemented or its functionality does not cover every desired scenario. There are many scenarios in which code integrity policies would be used alongside AppLocker rules. As a best practice, you should enforce code integrity policies at the most restrictive level possible for your organization, and then you can use AppLocker to fine-tune the restrictions to an even lower level. - **Note**  One example in which Device Guard functionality needs AppLocker supplementation is when your organization would like to limit universal applications. Universal applications have already been validated by Microsoft to be trustworthy to run, but an organization may not want to allow specific universal applications to run in their environment. You can accomplish this enforcement by using an AppLocker rule. - AppLocker and Device Guard should run side-by-side in your organization, which offers the best of both security features at the same time and provides the most comprehensive security to as many devices as possible. In addition to these features, Microsoft recommends that you continue to maintain an enterprise antivirus solution for a well-rounded enterprise security portfolio. - **Device Guard with Credential Guard** - Although Credential Guard is not a feature within Device Guard, many organizations will likely deploy Credential Guard alongside Device Guard for additional protection against credential theft. Similar to virtualization-based protection of kernel mode code integrity, Credential Guard leverages hypervisor technology to protect domain credentials. This mitigation is targeted at resisting the use of pass-the-hash and pass-the-ticket techniques. By employing multifactor authentication with Credential Guard, organizations can gain additional protection against such threats. For information about how to deploy Credential Guard to your Windows 10 Enterprise clients, see the [Enable Credential Guard](#enable-cg) section. In addition to the client-side enablement of Credential Guard, organizations can deploy mitigations at both the CA and domain controller level to help prevent credential theft. Microsoft will be releasing details about these additional mitigations in the future. - **Unified manageability** - You can easily manage Device Guard features by using the familiar enterprise and client-management tools that IT pros use every day. Use the following management tools to enable and manage Device Guard: - - **Group Policy**. Windows 10 provides an administrative template to configure and deploy the configurable code integrity policies for your organization. This template also allows you to specify which hardware-based security features you would like to enable and deploy. You can manage these settings along with your existing Group Policy Objects (GPOs), which makes it simple to implement Device Guard features. In addition to these code integrity and hardware-based security features, you can use Group Policy to help you manage your catalog files. For more information about catalog files, see the [Catalog files](#catalog-files) section. - - **Microsoft System Center Configuration Manager**. You can use System Center Configuration Manager to simplify deployment and management of catalog files, code integrity policies, and hardware-based security features, as well as provide version control. For more information about how to deploy catalog files by using System Center Configuration Manager, see the [Deploy catalog files with System Center Configuration Manager](#deploy-cat-sccm) section. - - **Microsoft Intune**. In a future release of Microsoft Intune, organizations will be able to leverage Intune for deployment and management of code integrity policies and catalog files. - - **Windows PowerShell**. Windows PowerShell is primarily used to create and service code integrity policies. These policies represent the most powerful component of Device Guard. For a step-by-step walkthrough of how to create, audit, service, enforce, and deploy code integrity policies, see the [Code integrity policies](#code-integrity-policies) section. - These options provide the same experience you are used to in order to manage your existing enterprise management solutions. For more information about how to manage and deploy Device Guard hardware and code integrity features in your organization, see the [Device Guard deployment](#dg-deployment) section. - ## Plan for Device Guard - In this section, you will learn about the following topics: - - [Approach enterprise code integrity deployment](#approach-enterprise-code-integrity-deployment). Device Guard deployment in your organization requires a planned approach. In this section, you get high-level recommendations for how to approach enterprise code integrity deployment in your organization. - - [Device Guard deployment scenarios](#device-guard-deployment-scenarios). When you plan for Device Guard deployment, Microsoft recommends that you categorize each device in your organization into a deployment scenario. These scenarios will provide a roadmap for your Device Guard deployment. - - [Code signing adoption](#code-signing-adoption). Code signing is important to the security that Device Guard provides. This section outlines the options for code signing and the benefits and disadvantages of each method. - - [Hardware considerations](#hardware-considerations). Several Device Guard features require advanced hardware. This section outlines the requirements for each of those features and what to look for during your next hardware refresh. - ## Approach enterprise code integrity deployment - Enterprises that want to consider Device Guard should not expect deployment to their entire organization overnight. Device Guard implementation requires that you plan for both end-user and IT pro impact. In addition, the deployment of Device Guard features to your enterprise requires a planned, phased approach to ensure that end-user systems are fully capable and ready to enforce these new security restrictions. Perform the following high-level tasks to approach the deployment of Device Guard to your enterprise: - 1. **Group devices into similar functions**. Categorize machines into the groups described in the [Device Guard deployment scenarios](#device-guard-deployment-scenarios) section. This begins the roadmap for your Device Guard deployment and provides groups of easier and more difficult implementations. From there, assess the quantity of necessary Device Guard policies. The easiest solution is to lock down your entire enterprise, but it might not fit your individual departments’ needs. - To discover an appropriate number of policies for your organization, try to separate the defined groups into departments or roles. Then ask some questions: What software does each department or role need to do their job? Should they be able to install and run other departments’ software? Do we need to create a base code integrity policy that aligns with our application catalog? Should users be able to install any application or only choose from an “allowed” list? Do we allow users to use their own peripheral devices? These questions will help you discover the number of necessary policies for your organization. Finally, try to focus on which people or departments would require an additional level of privileges. For example, should department x be able to install and run application xyz, even though no other department does? If the answer is yes and justifiable, you will need a secondary code integrity policy for that group. If not, you will likely be able to merge several policies to simplify management. For more information about configurable code integrity policies, see the [Code integrity policies](#code-integrity-policies) section. - 2. **Create code integrity policies from “golden” PCs**. After you create the groups of devices, you can create code integrity policies to align with those groups, similar to the way you would manage corporate images. When you have separated these groups and set up golden PCs that mimic the software and hardware those individual groups require, create code integrity policies from each of them. After you create these, you can merge these code integrity policies to create a master policy, or you can manage and deploy them individually. For step-by-step instructions about how to create code integrity policies, see the [Create code integrity policies from golden PCs](#create-code-integrity-policies-from-golden-pcs) section. - 3. **Audit and merge code integrity policies**. Microsoft recommends that you test code integrity policies in audit mode before you enforce them. Audit mode allows administrators to run the code integrity policy on a system but not actually block anything. Rather than not allowing applications to run, events are logged with each exception to the policy. This way, you can easily highlight any issues that were not discovered during the initial scan. You can create additional code integrity policies by using the audit events and merge them into the existing policy. For more information about how to audit code integrity policies, see the [Audit code integrity policies](#audit-code-integrity-policies) section. - 4. **Assess LOB applications that are currently unsigned, and create a catalog file for them**. Catalog files allow organizations to sign applications that do not currently possess digitally signed binaries or applications that a customer would want to add a secondary signature to. These applications can be in-house applications or from third parties, and the process does not require any repackaging of the application. When you create code integrity policies at a rule level above hash values, you will not discover unsigned applications. To include these applications in your code integrity policies, simply create, sign, and deploy a catalog file. For information about catalog files, see the [Catalog files](#catalog-files) section. - 5. **Enable desired hardware security features**. Each type of device found in the [Device Guard deployment scenarios](#device-guard-deployment-scenarios) section takes advantage of different software and hardware integrity configurations. You should assess hardware-based security features separately from code integrity policies because they provide complementary functionality. For information about how to configure Device Guard hardware-based security features, see the [Configure hardware-based security features](#configure-hardware-based-security-features) section. - 6. **Deploy code integrity policies and catalog files**. After you have created and signed the necessary catalog files and created and audited code integrity policies, you are ready to deploy them in phases. Microsoft strongly recommends that you deploy these components to a test group of users, even after your IT organization has tested and vetted them. This provides a final quality control validation before you deploy the catalog files and policies more broadly. For information about how to deploy catalog files with Group Policy, see the [Deploy catalog files with Group Policy](#deploy-catalog-files-with-group-policy) section. For additional information about how to deploy code integrity policies, see the [Deploy code integrity policies with Group Policy](#deploy-code-integrity-policies-with-group-policy) section. - ## Device Guard deployment scenarios - To help simplify the deployment of Device Guard to your organization, Microsoft recommends that you group devices into the deployment scenarios described in this section. Device Guard is not a feature that organizations will just simply “turn on”; rather, it typically requires a phased implementation approach. To see where these scenarios fit into an overall Device Guard deployment approach, see the [Approach to enterprise code integrity deployment](#approach-to-enterprise-code-integrity-deployment) section. - **Fixed-workload devices** - The lists of approved applications on fixed-workload devices rarely change as they perform the same tasks day after day. Examples of such devices include kiosks, point-of-sale systems, and call center PCs. These devices could easily employ the full capabilities of Device Guard and would require little management or policy modification. Device Guard implementation to these devices is painless and requires little ongoing administration. With Device Guard fully implemented, users are able to run only those applications that the IT department installs, manages, and trusts. - Device Guard components that are applicable to fixed-workload devices include: - - KMCI VBS protection - - Enforced UMCI policy - **Fully managed devices** - Fully managed devices are those for which the IT department restricts the software that is installed and run on them, but allows users to request installation of additional software or provides a list of approved software in an application catalog. Examples of such devices include locked-down, company-owned desktops and laptops. With these devices, establish an initial baseline code integrity policy and enforce the code integrity policy. The IT department manages the policies and updates the devices when new applications are approved or are provided in the System Center Configuration Manager catalog. - Device Guard components that are applicable to fully managed devices include: - - KMCI VBS protection - - Enforced UMCI policy - In this scenario, an application list is provided and trusted, and the trust policy is constantly re-evaluated when a user requests a new application. When an application is trusted across all of these devices, new user requests for that application do not require a policy update (alignment with application catalog). In addition, you can couple this with an onboarding process for new applications that you should add to the central application catalog. Initial implementation of Device Guard to fully managed devices is simple but does require more administrative overhead to manage trusted signatures of newly requested and approved applications. - **Lightly managed devices** - Lightly managed devices are company-owned machines over which users have full control, which includes what is installed on them. These devices run the organization’s antivirus solution and client management tools but are not restricted by software request or compliance policies. - Device Guard components that are applicable to lightly managed devices include: - - KMCI VBS protection - - UMCI policy in Audit mode - **Bring Your Own Device** - Device Guard is not a good way to manage devices in a Bring Your Own Device (BYOD) model. When employees are allowed to bring their own devices, the management of user-mode applications on them can make it difficult for users to use their own devices when they are not at work. In addition, Device Guard functionality is difficult to maintain from an administrative perspective. For devices in this group, explore alternate hardening and security features with MDM-based conditional access solutions, such as Microsoft Intune. - ## Code signing adoption - Code signing is crucial to the successful implementation of configurable code integrity policies. These policies can trust the signing certificates from both independent software vendors and customers. In Windows 10, all Windows Store applications are signed. Also, you can easily trust any other signed application by adding the signing certificate to the code integrity policy. - For unsigned applications, customers have multiple options for signing them so that code integrity policies can trust them. The first option is traditional embedded code signing. Organizations that have in-house development teams can incorporate binary code signing into their application development process, and then simply add the signing certificate to their code integrity policies. The second option for signing unsigned applications is to use catalog files. In Windows 10, customers have the ability to create catalog files as they monitor the installation and initial run of an application. For more information about signing existing unsigned LOB applications or third-party applications, see the [Existing line-of-business applications](#existing-line-of-business-applications) section. - ### Existing line-of-business applications - Until now, existing LOB applications were difficult to trust if they were signed by a source other than the Windows Store or not signed at all. With Windows 10, signing your existing LOB and third-party unsigned applications is simplified. This new signing method does not require that applications be repackaged in any way. With catalog files, administrators can sign these unsigned applications simply by monitoring for an installation and initial startup. By using this monitoring information, an administrator can generate a catalog file. Catalog files are simply Secure Hash Algorithm 2 (SHA2) hash lists of discovered binaries. These binaries’ hash values are updated every time an application is updated and therefore require an updated catalog file. For simplified administration, consider incorporating embedded code signing into your application development process. For more information about how to generate catalog files, see the [Catalog files](#catalog-files) section. - **Note**   Catalog files are lists of individual binaries’ hash values. If the scanned application is updated, you will need to create a new catalog file. That said, binary signing is still highly recommended for any future applications so that no catalog files are needed. -   When you create a catalog file, you must sign it by using enterprise public key infrastructure (PKI), or a purchased code signing certificate. When signed, code integrity policies can trust the signer or signing certificate of those files. For information about catalog file signing, see the [Catalog files](#catalog-files) section. - **Application development** - Although in-house applications can be signed after packaging by using catalog files, Microsoft strongly recommends that embedded code signing be incorporated into your application development process. When signing applications, simply add the code signing certificate used to sign your applications to your code integrity policy. This ensures that your code integrity policy will trust any future application that is signed with that certificate. Embedding code signing into any in-house application development process is beneficial to your IT organization as you implement code integrity policies. - ## Hardware considerations - - Careful consideration about which hardware vendor and specific models to purchase during your next hardware refresh is vitally important to the success of your organization’s Device Guard implementation efforts. In alignment with your current hardware life cycle, consider the process that is discussed in the [Approach enterprise code integrity deployment](#approach-enterprise-code-integrity-deployment) section when you determine the appropriate order of hardware replacement in your organization. Device Guard should be deployed in phases; therefore, you have time to methodically plan for its implementation. - Different hardware features are required to implement the various features of Device Guard. There will likely be some individual features that you will be able to enable with your current hardware and some that you will not. However, for organizations that want to implement Device Guard in its entirety, several advanced hardware features will be required. For additional details about the hardware features that are required for Device Guard components, see the following table. - @@ -231,228 +149,122 @@ Different hardware features are required to implement the various features of De
- ## Device Guard deployment - In this section, you learn about the following topics: - - [Configure hardware-based security features](#configure-hardware-based-security-features). This section explains how to enable the hardware-based security features in Device Guard. Also, you verify that the features are enabled by using both Windows Management Infrastructure (WMI) and Msinfo32.exe. - - [Catalog files](#catalog-files). In this section, you create, sign, and deploy catalog files. You deploy the catalog files by using both Group Policy and System Center Configuration Manager. Also, you use System Center Configuration Manager to inventory the deployed catalog files for reporting purposes. - - [Code integrity policies](#code-integrity-policies). This section provides information on how to create, audit, service, merge, deploy, and remove signed and unsigned configurable code integrity policies. - ## Configure hardware-based security features - Hardware-based security features make up a large part of Device Guard security offerings. VBS reinforces the most important feature of Device Guard: configurable code integrity. There are three steps to configure hardware-based security features in Device Guard: - 1. **Verify that hardware requirements are met and enabled**. Verify that your client machines possess the necessary hardware to run these features. A list of hardware requirements for the hardware-based security features is available in the [Hardware considerations](#hardware-considerations) section. - 2. **Enable the necessary Windows features**. There are several ways to enable the Windows features required for hardware-based security. For details on which Windows features are needed, see the [Windows feature requirements for virtualization-based security](#windows-feature-requirements-for-virtualization-based-security) section. - 3. **Enable desired features**. When the necessary hardware and Windows features have been enabled, you are ready to enable the desired hardware-based security features. For UEFI Secure Boot, see the [Enable UEFI Secure Boot](#enable-unified-extensible-interface-secure-boot) section. For information about how to enable VBS protection of the KMCI service, see the [Enable virtualization-based protection of kernel mode code integrity](#enable-virtualbased) section. Finally, for information about how to enable Credential Guard, see the [Enable Credential Guard](#enable-credential-guard) section. - ### Windows feature requirements for virtualization-based security - In addition to the hardware requirements found in the [Hardware considerations](#hardware-considerations) section, you must enable certain operating system features before you can enable VBS: Microsoft Hyper-V and isolated user mode (shown in Figure 1). - **Note**   You can configure these features manually by using Windows PowerShell or Deployment Image Servicing and Management. For specific information about these methods, refer to the [Credential Guard documentation](http://go.microsoft.com/fwlink/p/?LinkId=624529). -   ![figure 1](images/dg-fig1-enableos.png) - Figure 1. Enable operating system features for VBS - After you enable these features, you can configure any hardware-based security features you want. For information about how to enable virtualization-based protection of kernel-mode code integrity, see the [Enable virtualization-based protection of kernel-mode code integrity](#enable-virtualization-based-protection-of-kernel-mode-code-integrity) section. For information about how to enable UEFI Secure Boot, see the [Enable UEFI Secure Boot](#enable-unified-extensible-interface-secure-boot) section. Finally, for additional information about how to enable Credential Guard, see the [Enable Credential Guard](#enable-credential-guard) section. - ### Enable Unified Extensible Firmware Interface Secure Boot - Before you begin this process, verify that the target device meets the hardware requirements for UEFI Secure Boot that are laid out in the [Hardware considerations](#hardware-considerations) section. There are two options to configure UEFI Secure Boot: manual configuration of the appropriate registry keys and Group Policy deployment. Complete the following steps to manually configure UEFI Secure Boot on a computer running Windows 10: - **Note**   There are two platform security levels for Secure Boot: stand-alone Secure Boot and Secure Boot with DMA protection. DMA protection provides additional memory protection but will be enabled only on systems whose processors include DMA protection (IOMMU) technologies. Without the presence of IOMMUs and with DMA protection disabled, customers will lose protection from driver-based attacks. - - 1. Navigate to the **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard** registry subkey. - 2. Set the **EnableVirtualizationBasedSecurity DWORD** value to **1**. - 3. Set the **RequirePlatformSecurityFeatures DWORD** value as appropriate: - - Set this value to **1** to enable the **Secure Boot** option. - - Set this value to **2** to enable the **Secure Boot with DMA Protection** option. - 4. Restart the client machine. - Unfortunately, it would be time consuming to perform these steps manually on every protected machine in your enterprise. Group Policy offers a much simpler way to deploy UEFI Secure Boot to your organization. This example creates a test organizational unit (OU) called *DG Enabled PCs*. If you prefer to link the policy to an existing OU, and then scope the GPO by using appropriately named computer security groups, you can certainly do so. - **Note**   Microsoft recommends that you test-enable this feature on a group of test machines before you deploy it to machines that are currently deployed to users. - **Use Group Policy to deploy Secure Boot** - 1. To create a new GPO, right-click the OU to which you want to link the GPO, and then click **Create a GPO in this domain, and Link it here**. - ![figure 2](images/dg-fig2-createou.png) - Figure 2. Create a new OU-linked GPO - 2. Name the new GPO **Contoso Secure Boot GPO Test**. This example uses *Contoso Secure Boot GPO Test* as the name of the GPO. You can choose any name for this example. Ideally, the name would align with your existing GPO naming convention. - 3. To open the Group Policy Management Editor, right-click the new GPO, and then click **Edit**. - 4. Within the selected GPO, navigate to Computer Configuration\\Administrative Templates\\System\\Device Guard. Then, right-click **Turn On Virtualization Based Security**, and then click **Edit**. - ![figure 3](images/dg-fig3-enablevbs.png) - Figure 3. Enable VBS - 5. Select the **Enabled** option, and then select **Secure Boot and DMA Protection** from the **Select Platform Security Level** list. - ![figure 4](images/device-guard-gp.png) - Figure 4. Enable Secure Boot - **Note**   Device Guard Secure Boot is maximized when combined with DMA protection. If your hardware contains the IOMMUs required for DMA protection, be sure to select the **Secure Boot and DMA Protection** platform security level. If your hardware does not contain IOMMU, there are several mitigations provided by leveraging Secure Boot without DMA Protection. -   - 6. Close the Group Policy Management Editor, and then restart the Windows 10 test computer. After you configure this setting, UEFI Secure Boot will be enabled upon restart. - 7. Check the test computer’s event log for Device Guard GPOs. - Processed Device Guard policies are logged in event viewer at Application and Services Logs\\Microsoft\\Windows\\DeviceGuard-GPEXT\\Operational. When the **Turn On Virtualization Based Security** policy is successfully processed, event ID 7000 is logged, which contains the selected settings within the policy. - ### Enable virtualization-based security of kernel-mode code integrity - Before you begin this process, verify that the desired computer meets the hardware requirements for VBS found in the [Hardware considerations](#hardware-considerations) section, and enable the Windows features discussed in the [Virtualization-based security Windows feature requirements](#virtualization-based-security-windows-featurerrequirements) section. When validated, you can enable virtualization-based protection of KMCI in one of two ways: manual configuration of the appropriate registry subkeys and Group Policy deployment. - **Note**   All drivers on the system must be compatible with virtualization-based protection of code integrity; otherwise, your system may fail. Microsoft recommends that you enable this feature on a group of test machines before you enable it on deployed machines. - To configure virtualization-based protection of KMCI manually: - 1. Navigate to the **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard** registry subkey. - 2. Set the **HypervisorEnforcedCodeIntegrity DWORD** value to **1**. - 3. Restart the client computer. - It would be time consuming to perform these steps manually on every protected machine in your enterprise. Instead, use Group Policy to deploy virtualization-based protection of KMCI. This example creates a test OU called *DG Enabled PCs*, which you will use to link the GPO. If you prefer to link the policy to an existing OU rather than create a test OU and scope the policy by using appropriately named computer security groups, that is another option. - **Note**   Microsoft recommends that you test-enable this feature on a group of test computers before you deploy it to machines that are currently deployed to users. If untested, there is a possibility that this feature can cause system instability and ultimately cause the client operating system to fail. - To use Group Policy to configure VBS of KMCI: - 1. Create a new GPO: Right-click the OU to which you want to link the GPO, and then click **Create a GPO in this domain, and Link it here**. - ![figure 5](images/dg-fig5-createnewou.png) - Figure 5. Create a new OU-linked GPO - 2. Name the new GPO **Contoso VBS CI Protection GPO Test**. - This example uses *Contoso VBS CI Protection GPO Test* as the name of the GPO. You can choose any name you prefer for this example. Ideally, this name would align with your existing GPO naming convention. - 3. Open the Group Policy Management Editor: Right-click the new GPO, and then click **Edit**. - 4. Within the selected GPO, navigate to Computer Configuration\\Administrative Templates\\System\\Device Guard. Then, right-click **Turn On Virtualization Based Security**, and then click **Edit**. - ![figure 6](images/dg-fig6-enablevbs.png) - Figure 6. Enable VBS - 5. Select the **Enabled** option, and then select the **Enable Virtualization Based Protection of Code Integrity** check box. - ![figure 7](images/dg-fig7-enablevbsofkmci.png) - Figure 7. Enable VBS of KMCI - 6. Close the Group Policy Management Editor, and then restart the Windows 10 test computer. With this setting configured, the VBS of the KMCI will take effect upon restart. - 7. Check the test client event log for Device Guard GPOs. - Processed Device Guard policies are logged in event viewer under Application and Services Logs\\Microsoft\\Windows\\DeviceGuard-GPEXT\\Operational. When the **Turn On Virtualization Based Security** policy has been successfully processed, event ID 7000 is logged, which contains the selected settings within the policy. - ### Enable Credential Guard - Credential Guard provides an additional layer of credential protection specifically for domain users by storing the credentials within the virtualized container, away from both the kernel and user mode operating system. This makes it difficult for even a compromised system to obtain access to the credentials. In addition to the client-side enablement of Credential Guard, you can deploy additional mitigations at both the Certification Authority and domain controller level to prevent credential theft. Microsoft will be releasing details about these additional mitigations in the future. - Before you begin this process, verify that the desired system meets the hardware requirements for VBS found in the [Hardware considerations](#hardware) section, and that you have enabled the Windows features laid out in the [Virtualization-based security Windows feature requirements](#virtualization-based-security-windows-feature-requirements) section. When validated, you can enable Credential Guard manually, by configuring the appropriate registry subkeys, or through Group Policy deployment. - To configure VBS of Credential Guard manually: - 1. Navigate to the **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa** registry subkey. - 2. Set the **LsaCfgFlags DWORD** value to **1**. - 3. Restart the client computer. - To avoid spending an unnecessary amount of time in manual deployments, use Group Policy to deploy Credential Guard to your organization. This example creates a test OU called *DG Enabled PCs*. To enable Credential Guard, you can link to any OU, and then scope the GPO’s application by using security groups. - **Note**   Microsoft recommends that you enable Credential Guard before you join a machine to the domain to ensure that all credentials are properly protected. Setting the appropriate registry subkeys during your imaging process would be ideal to achieve this protection. - To use Group Policy to enable Credential Guard: - 1. Create a new GPO: right-click the OU to which you want to link the GPO, and then click **Create a GPO in this domain, and Link it here** . - ![figure 8](images/dg-fig8-createoulinked.png) - Figure 8. Create a new OU-linked GPO - 2. Name the new GPO **Contoso Credential Guard GPO Test**. - This example uses *Contoso Credential Guard GPO Test* as the name of the GPO. You can choose any name you prefer for this example. Ideally, this name would align with your existing GPO naming convention. - 3. Open the Group Policy Management Editor: right-click the new GPO, and then click **Edit**. - 4. Within the selected GPO, navigate to Computer Configuration\\Administrative Templates\\System\\Device Guard. Right-click **Turn On Virtualization Based Security**, and then click **Edit**. - ![figure 9](images/dg-fig9-enablevbs.png) - Figure 9. Enable VBS - 5. Select the **Enabled** option, and then select the **Enable Credential Guard** check box. - ![figure 10](images/dg-fig10-enablecredentialguard.png) - Figure 10. Enable Credential Guard - 6. Close Group Policy Management Editor, and then restart the Windows 10 test computer. - **Note**   The default platform security level is **Secure Boot**. If IOMMUs are available within the protected machines, it is recommended that you select **Secure Boot and DMA Protection** to maximize the mitigations that are available through Credential Guard. - 7. Check the test client event log for Device Guard GPOs. - **Note**   All processed Device Guard policies are logged in event viewer under Application and Services Logs\\Microsoft\\Windows\\DeviceGuard-GPEXT\\Operational. -   - For additional information about how Credential Guard works as well as additional configuration options, please refer to the [Credential Guard documentation](http://go.microsoft.com/fwlink/p/?LinkId=624529). - **Validate enabled Device Guard hardware-based security features** - Windows 10 and Windows Server 2016 and later have a WMI class for Device Guard–related properties and features: *Win32\_DeviceGuard*. This class can be queried from an elevated Windows PowerShell session by using the following command: - `Get-CimInstance –ClassName Win32_DeviceGuard –Namespace root\Microsoft\Windows\DeviceGuard` - **Note**   The *Win32\_DeviceGuard* WMI class is only available on the Enterprise edition of Windows 10. - The output of this command provides details of the available hardware-based security features as well as those features that are currently enabled. For detailed information about what each property means, refer to Table 1. -   - Table 1. Win32\_DeviceGuard properties - @@ -531,336 +343,181 @@ Table 1. Win32\_DeviceGuard properties
- Another method to determine the available and enabled Device Guard features is to run msinfo32.exe from an elevated PowerShell session. When you run this program, the Device Guard properties are displayed at the bottom of the **System Summary** section, as shown in Figure 11. - ![figure 11](images/dg-fig11-dgproperties.png) - Figure 11. Device Guard properties in the System Summary - ## Catalog files - Enforcement of Device Guard on a system requires that every trusted application have a signature or its binary hashes added to the code integrity policy. For many organizations, this can be an issue when considering unsigned LOB applications. To avoid the requirement that organizations repackage and sign these applications, Windows 10 includes a tool called Package Inspector that monitors an installation process for any deployed and executed binary files. If the tool discovers such files, it itemizes them in a catalog file. These catalog files offer you a way to trust your existing unsigned applications, whether developed in house or by a third party, as well as trust signed applications for which you do not want to trust the signer but rather the specific application. When created, these files can be signed, the signing certificates added to your existing code integrity policies, and the catalog files themselves distributed to the clients. - **Note**   The Enterprise edition of Windows 10 or Windows Server 2016 is required to create and use catalog files. - ### Create catalog files - The creation of catalog files is the first step to add an unsigned application to a code integrity policy. To create a catalog file, copy each of the following commands into an elevated Windows PowerShell session, and then complete the steps: - **Note**   When you establish a naming convention it makes it easier to detect deployed catalog files in the future. In this guide, you will use *\*-Contoso.cat* as the naming convention. For more information about why this practice is helpful to inventory or detect catalog files, see the [Inventory catalog files with System Center Configuration Manager](#inventory-catalog-files-with-system-center-configuration-manager) section. -   - 1. Be sure that a code integrity policy is currently running in audit mode. - Package Inspector does not always detect installation files that have been removed from the machine during the installation process. To ensure that these binaries are also trusted, the code integrity policy that you created and audited in the [Create code integrity policies from golden PCs](#create-code-integrity-policies-from-golden-pcs) and [Audit code integrity policies](#audit-code-integrity-policies) sections should be deployed, in audit mode, to the system on which you are running Package Inspector. - **Note**   This process should **not** be performed on a system running an enforced Device Guard policy, only with a policy running in audit mode. If a policy is currently being enforced, you will not be able to install and run the application. - 2. Start Package Inspector, and then scan drive C: - `PackageInspector.exe Start C:` - **Note**   Package inspector can monitor installations on any local drive. In this example, we install the application on drive C, but any other drive can be used.   3. Copy the installation media to drive C. - By copying the installation media to drive C, you ensure that Package Inspector detects and catalogs the actual installer. If you skip this step, the future code integrity policy may trust the application to run but not be installed. - 4. Install and launch the application. - Install the application to drive C. When the installation is finished, launch the application and ensure that any product updates are installed and any downloadable content caught during the scan. When finished, close and reopen the application once again to ensure that the scan has captured all binaries. - **Note**   Every binary that is run while Package Inspector is running will be captured in the catalog. Therefore, be sure not to run additional installations or updates during the scan to minimize the risk of trusting the incorrect binaries. Alternatively, if you want to add multiple applications to a single catalog file, simply repeat the installation and run process while the current scan is running. -   - 5. Stop the scan, and then generate definition and catalog files. When application installation and initial setup are finished, stop the Package Inspector scan and generate the catalog and definition files on your desktop by using the following commands: - `$ExamplePath=$env:userprofile+"\Desktop"` - `$CatFileName=$ExamplePath+"\LOBApp-Contoso.cat"` - `$CatDefName=$ExamplePath+"\LOBApp.cdf"` - `PackageInspector.exe Stop C: -Name $CatFileName -cdfpath $CatDefName` - **Note**   This scan catalogs the hash values for each discovered binary file. If the applications that were scanned are updated, complete this process again to trust the new binaries’ hash values. - When finished, the files will be saved to your desktop. To trust this catalog file within a code integrity policy, the catalog must first be signed. Then, the signing certificate can be included in the code integrity policy, and the catalog file can be distributed to the individual client machines. Catalog files can be signed by using a certificate and SignTool.exe, a free tool available in the Windows SDK. For more information about signing catalog files with SignTool.exe, see the [Catalog signing with SignTool.exe](#catalog-signing-with-signtool.exe) section. - ### Catalog signing with SignTool.exe - Device Guard makes it easy for organizations to sign and trust existing unsigned LOB applications. In this section, you sign a catalog file you generated in a previous section by using PackageInspector.exe. For information about how to create catalog files, see the [Create catalog files](#create-catalog-files) section. In this example, you need the following: - - SignTool.exe, found in the Windows software development kit (SDK—Windows 7 or later) - - The catalog file that you generated in the [Create catalog files](#create-catalog-files) section, or another catalog file that you have created - - Internal certification authority (CA) code signing certificate or purchased code signing certificate - If you do not have a code signing certificate, please see the [Create a Device Guard code signing certificate](#create-a-device-guard-code-signing-certificate) section for a walkthrough of how to create one. In addition to using the certificate you create in the Create a Device Guard code signing certificate section, this example signs the catalog file that you created in the [Create catalog files](#create-catalog-files) section. If you are using an alternate certificate or catalog file, update the following steps with the appropriate variables and certificate. To sign the existing catalog file, copy each of the following commands into an elevated Windows PowerShell session: - 1. Initialize the variables that will be used: - '$ExamplePath=$env:userprofile+"\Desktop"' '$CatFileName=$ExamplePath+"\LOBApp-Contoso.cat"' - **Note**   In this example, you use the catalog file you created in the [Create catalog files](#create-catalog-files) section. If you are signing another catalog file, be sure to update the *$ExamplePath* and *$CatFileName* variables with the correct information. - 2. Import the code signing certificate. Import the code signing certificate that will be used to sign the catalog file to the signing user’s personal store. In this example, you use the certificate that you created in the [Create a Device Guard code signing certificate](#create-a-device-guard-code-signing-certificate) section. - 3. Sign the catalog file with Signtool.exe: - ` sign /n "ContosoDGSigningCert" /fd sha256 /v $CatFileName` - **Note**   The *<Path to signtool.exe>* variable should be the full path to the Signtool.exe utility. *ContosoDGSigningCert* is the subject name of the certificate that you will use to sign the catalog file. This certificate should be imported to your personal certificate store on the machine on which you are attempting to sign the catalog file. - **Note**   For additional information about Signtool.exe and all additional switches, visit [MSDN Sign Tool page](http://go.microsoft.com/fwlink/p/?LinkId=624163). -   - 4. Verify the catalog file digital signature. Right-click the catalog file, and then click **Properties**. On the **Digital Signatures** tab, verify that your signing certificate exists with a **sha256** algorithm, as shown in Figure 12. - ![figure 12](images/dg-fig12-verifysigning.png) - Figure 12. Verify that the signing certificate exists - 5. Copy the catalog file to C:\\Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}. - For testing purposes, you can manually copy signed catalog files to their intended folder. For large-scale implementations, Microsoft recommends that you use Group Policy File Preferences to copy the appropriate catalog files to all desired machines or an enterprise systems management product such as System Center Configuration Manager. Doing this simplifies the management of catalog versions, as well. - ### Deploy catalog files with Group Policy - To simplify the management of catalog files, you can use Group Policy preferences to deploy catalog files to the appropriate PCs in your organization. The following process walks you through the deployment of a signed catalog file called LOBApp-Contoso.cat to a test OU called DG Enabled PCs with a GPO called **Contoso DG Catalog File GPO Test**. - **Note**   This walkthrough requires that you have previously created a signed catalog file and have a Windows 10 client PC on which to test a Group Policy deployment. For more information about how to create and sign a catalog file, see the [Catalog files](#catalog-files) section. - To deploy a catalog file with Group Policy: - 1. From either a domain controller or a client PC that has Remote Server Administration Tools (RSAT) installed, open the Group Policy Management Console (GPMC) by running **GPMC.MSC** or by searching for Group Policy Management. - 2. Create a new GPO: right-click the DG Enabled PCs OU, and then click **Create a GPO in this domain, and Link it here**, as shown in Figure 13. - **Note**   The DG Enabled PCs OU is just an example of where to link the test GPO that you created in this section. You can use any OU name. Also, security group filtering is an option when you consider policy partitioning options based on the strategy discussed in the [Approach enterprise code integrity deployment](#approach-enterprise-code-integrity-deployment) section. - ![figure 13](images/dg-fig13-createnewgpo.png) - Figure 13. Create a new GPO - 3. Name the new GPO **Contoso DG Catalog File GPO Test**. - This example uses *Contoso DG Catalog File GPO Test* as the name of the GPO. You can choose any name you prefer for this example. - 4. Open the Group Policy Management Editor: right-click the new GPO, and then click **Edit**. - 5. Within the selected GPO, navigate to Computer Configuration\\Preferences\\Windows Settings\\Files. Right-click **Files**, point to **New**, and then click **File**, as shown in Figure 14. - ![figure 14](images/dg-fig14-createnewfile.png) - Figure 14. Create a new file - 6. Configure the catalog file share. - To use this setting to provide consistent deployment of LOBApp-Contoso.cat, the source file should be on a share that is accessible to the computer account of every deployed machine. This example uses a share on a Windows 10 client machine called \\\\Contoso-Win10\\Share. The catalog file being deployed is copied to this share. - 7. To keep versions consistent, in the **New File Properties** dialog box (Figure 15), select **Replace** from the **Action** list so that the newest version is always used. - ![figure 15](images/dg-fig15-setnewfileprops.png) - Figure 15. Set the new file properties - 8. In the **Source file(s)** box, type the name of your accessible share, with the catalog file name included (for example, \\\\Contoso-Win10\\share\\LOBApp-Contoso.cat). - 9. In the **Destination File** box, type **C:\\Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\LOBApp-Contoso.cat**. - **Note**   LOBApp-Contoso.cat is not a required catalog name: This name was used in the [Create catalog files](#create-catalog-files) section, and so it was used here, as well. -   - 10. On the **Common** tab of the **New File Properties** dialog box, select the **Remove this item when it is no longer applied** option. Doing this ensures that the catalog file is removed from every system, in case you ever need to stop trusting this application. - 11. Click **OK** to complete file creation. - 12. Close the Group Policy Management Editor, and then update the policy on the test Windows 10 machine by running GPUpdate.exe. When the policy has been updated, verify that the catalog file exists in C:\\Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE} on the Windows 10 machine. - ### Deploy catalog files with System Center Configuration Manager - As an alternative to Group Policy, you can use System Center Configuration Manager to deploy catalog files to the managed machines in your environment. This approach can simplify the deployment and management of multiple catalog files as well as provide reporting around which catalog each client or collection has deployed. In addition to the deployment of these files, System Center Configuration Manager can also be used to inventory the currently deployed catalog files for reporting and compliance purposes. Complete the following steps to create a new deployment package for catalog files: - **Note**   The following example uses a network share named \\\\Shares\\CatalogShare as a source for the catalog files. If you have collection specific catalog files, or prefer to deploy them individually, use whichever folder structure works best for your organization. - 1. Open the Configuration Manager console, and select the Software Library workspace. - 2. Navigate to Overview\\Application Management, right-click **Packages**, and then click **Create Package**. - 3. Name the package, set your organization as the manufacturer, and select an appropriate version number (Figure 16). - ![figure 16](images/dg-fig16-specifyinfo.png) - Figure 16. Specify information about the new package - 4. Click **Next**, and then select **Standard program** as the program type. - 5. On the **Standard Program** page, select a name, and then set the **Command Line** property to **XCopy \\\\Shares\\CatalogShare C:\\Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE} /H /K /E /Y**. - 6. On the **Standard Program** page, select the following options (Figure 17): - - In **Name**, type **Contoso Catalog File Copy Program**. - - In **Command line**, browse to the program location. - - In **Startup folder**, type **C:\\Windows\\System32**. - - From the **Run** list, select **Hidden**. - - From the **Program can run** list, select **Whether or not a user is logged on**. - - From the **Drive mode** list, select **Runs with UNC name**. - ![figure 17](images/dg-fig17-specifyinfo.png) - Figure 17. Specify information about the standard program - 7. Accept the defaults for the rest of the wizard, and then close the wizard. - After you create the deployment package, deploy it to a collection so that the clients will receive the catalog files. In this example, you deploy the package you just created to a test collection: - 1. In the Software Library workspace, navigate to Overview\\Application Management\\Packages, right-click the catalog file package, and then click **Deploy**. - 2. On the **General** page, select the test collection to which the catalog files will be deployed, and then click **Next**. - 3. On the **Content** page, click **Add** to select the distribution point that will serve content to the selected collection, and then click **Next**. - 4. On the **Deployment Settings** page, select **Required** in the **Purpose** box. - 5. On the **Scheduling** page, click **New**. - 6. In the **Assignment Schedule** dialog box, select **Assign immediately after this event**, set the value to **As soon as possible**, and then click **OK**. - 7. On the **Scheduling** page, click **Next**. - 8. On the **User Experience** page (Figure 18), set the following options, and then click **Next**: - - Select the **Software installation** check box. - - Select the **Commit changes at deadline or during a maintenance window (requires restarts)** check box. - ![figure 18](images/dg-fig18-specifyux.png) - Figure 18. Specify the user experience - 9. On the **Distribution Points** page, in the **Deployment options** box, select **Run program from distribution point**, and then click **Next**. - 10. On the **Summary** page, review the selections, and then click **Next**. - 11. Close the wizard. - ### Inventory catalog files with System Center Configuration Manager - When catalog files have been deployed to the machines within your environment, whether by using Group Policy or System Center Configuration Manager, you can inventory them with the software inventory feature of System Center Configuration Manager. The following process walks you through the enablement of software inventory to discover catalog files on your managed systems through the creation and deployment of a new client settings policy. - **Note**   A standard naming convention for your catalog files will significantly simplify the catalog file software inventory process. In this example, *-Contoso* has been added to all catalog file names. - 1. Open the Configuration Manager console, and select the Administration workspace. - 2. Navigate to **Overview\\Client Settings**, right-click **Client Settings**, and then click **Create Custom Client Device Settings**. - 3. Name the new policy, and select the **Software Inventory** check box from the **Select and then configure the custom settings for client devices** list, as shown in Figure 19. - ![figure 19](images/dg-fig19-customsettings.png) - Figure 19. Select custom settings - 4. In the navigation pane, click **Software Inventory**, and then click **Set Types**, as shown in Figure 20. - ![figure 20](images/dg-fig20-setsoftwareinv.png) - Figure 20. Set the software inventory - 5. In the **Configure Client Setting** dialog box, click the **Start** button to open the **Inventories File Properties** dialog box. - 6. In the **Name** box, type **\*Contoso.cat**, and then click **Set**. - **Note**   **\*Contoso.cat** is the naming convention used in this example. This should mimic the naming convention you use for your catalog files. -   - 7. In the **Path Properties** dialog box, select **Variable or path name**, and then type **C:\\Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}** in the box, as shown in Figure 21. - ![figure 21](images/dg-fig21-pathproperties.png) - Figure 21. Set the path properties - 8. Click **OK**. - 9. Now that you have created the client settings policy, right-click the new policy, click **Deploy**, and then choose the collection on which you would like to inventory the catalog files. - At the time of the next software inventory cycle, when the targeted clients receive the new client settings policy, you will be able to view the inventoried files in the built-in System Center Configuration Manager reports or Resource Explorer. To view the inventoried files on a client within Resource Explorer, complete the following steps: - 1. Open the Configuration Manager console, and select the Assets and Compliance workspace. - 2. Navigate to Overview\\Devices, and search for the device on which you want to view the inventoried files. - 3. Right-click the computer, point to **Start**, and then click **Resource Explorer**. - 4. In Resource Explorer, navigate to Software\\File Details to view the inventoried catalog files. - **Note**   If nothing is displayed in this view, navigate to Software\\Last Software Scan in Resource Explorer to verify that the client has recently completed a software inventory scan. -   - ## Code integrity policies - - Code integrity policies maintain the standards by which a computer running Windows 10 determines whether an application is trustworthy and can be run. For an overview of code integrity, see the [Configurable code integrity](#configurable-code-integrity) section. - A common system imaging practice in today’s IT organization is to establish a “golden” image as a reference for what an ideal system should look like, and then use that image to clone additional company assets. Code integrity policies follow a similar methodology, that begins with the establishment of a golden PC. Like when imaging, you can have multiple golden PCs based on model, department, application set, and so on. Although the thought process around the creation of code integrity policies is similar to imaging, these policies should be maintained independently. Assess the necessity of additional code integrity policies based on what should be allowed to be installed and run and for whom. - **Note**   Each machine can have only **one** code integrity policy at a time. Whichever way you deploy this policy, it is renamed to SIPolicy.p7b and copied to C:\\Windows\\System32\\CodeIntegrity. Keep this in mind when you create your code integrity policies. - Optionally, code integrity policies can align with your software catalog as well as any IT department–approved applications. One simple method to implement code integrity policies is to use existing images to create one master code integrity policy. You do so by creating a code integrity policy from each image, and then by merging the policies. This way, what is installed on all of those images will be allowed to run, should the applications be installed on a computer based on a different image. Alternatively, you may choose to create a base applications policy and add policies based on the computer’s role or department. Organizations have a choice of how their policies are created, merged or serviced, and managed. - **Note**   The following section assumes that you will deploy code integrity policies as part of your Device Guard deployment. Alternatively, configurable code integrity is available without the enablement of Device Guard. - ### Code integrity policy rules - Code integrity policies consist of several components. The two major components, which are configurable, are called *policy rules* and *file rules*, respectively. Code integrity policy rules are options that the code integrity policy creator can specify on the policy. These options include the enablement of audit mode, UMCI, and so on. You can modify these options in a new or existing code integrity policy. File rules are the level to which the code integrity policy scan ties each binary trust. For example, the hash level is going to itemize each discovered hash on the system within the generated code integrity policy. This way, when a binary prepares to run, the code integrity service will validate its hash value against the trusted hashes found in the code integrity policy. Based on that result, the binary will or will not be allowed to run. - To modify the policy rule options of an existing code integrity policy, use the **Set-RuleOption** Windows PowerShell cmdlet. Note the following examples of how to use this cmdlet to add and remove a rule option on an existing code integrity policy: - - To enable UMCI, add rule option 0 to an existing policy by running the following command: - `Set-RuleOption -Option 0 -FilePath ` - - To disable UMCI on an existing code integrity policy, remove rule option 0 by running the following command: - ` Set-RuleOption -Option 0 -FilePath -Delete` - You can set several rule options within a code integrity policy. Table 2 lists each rule and its high-level meaning. - Table 2. Code integrity policy - policy rule options - | Rule option | Description | |------------ | ----------- | | **0 Enabled:UMCI** | Code integrity policies restrict both kernel-mode and user-mode binaries. By default, only kernel-mode binaries are restricted. Enabling this rule option validates user mode executables and scripts. | @@ -874,11 +531,8 @@ Table 2. Code integrity policy - policy rule options | **8 Required:EV Signers** | In addition to being WHQL signed, this rule requires that drivers must have been submitted by a partner that has an Extended Verification (EV) certificate. All future Windows 10 and later drivers will meet this requirement. | | **9 Enabled:Advanced Boot Options Menu** | The F8 preboot menu is disabled by default for all code integrity policies. Setting this rule option allows the F8 menu to appear to physically present users. | | **10 Enabled:Boot Audit on Failure** | Used when the code integrity policy is in enforcement mode. When a driver fails during startup, the code integrity policy will be placed in audit mode so that Windows will load. Administrators can validate the reason for the failure in the CodeIntegrity event log. | - File rule levels allow administrators to specify the level at which they want to trust their applications. This level of trust could be as low as the hash of each binary and as high as a PCA certificate. File rule levels are specified both when you create a new code integrity policy from a scan and when you create a policy from audit events. In addition, to combine rule levels found in multiple policies, you can merge the policies. When merged, code integrity policies combine their file rules. Each file rule level has its benefit and disadvantage. Use Table 3 to select the appropriate protection level for your available administrative resources and Device Guard deployment scenario. - Table 3. Code integrity policy - file rule levels - | Rule level | Description | |----------- | ----------- | | **Hash** | Specifies individual hash values for each discovered binary. Although this level is specific, it can cause additional administrative overhead to maintain the current product versions’ hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. | @@ -892,478 +546,258 @@ Table 3. Code integrity policy - file rule levels | **WHQL** | Trusts binaries if they have been validated and signed by WHQL. This is primarily for kernel binaries. | | **WHQLPublisher** | This is a combination of the WHQL and the CN on the leaf certificate and is primarily for kernel binaries. | | **WHQLFilePublisher** | Specifies that the binaries are validated and signed by WHQL, with a specific publisher (WHQLPublisher), and that the binary is the specified version or newer. This is primarily for kernel binaries. | - **Note**   When you create code integrity policies with the **New-CIPolicy** cmdlet, you can specify a primary file rule level by including the **–Level** parameter. For discovered binaries that cannot be trusted based on the primary file rule criteria, use the **–Fallback** parameter. For example, if the primary file rule level is PCACertificate but you would like to trust the unsigned applications as well, using the Hash rule level as a fallback adds the hash values of binaries that did not have a signing certificate. - ### Create code integrity policies from golden PCs - The process to create a golden code integrity policy from a reference system is straightforward. This section outlines the process that is required to successfully create a code integrity policy with Windows PowerShell. First, for this example, you must initiate variables to be used during the creation process. Rather than using variables, you can simply use the full file paths in the command. Next, you create the code integrity policy by scanning the system for installed applications. When created, the policy file is converted to binary format so that Windows can consume its contents. - **Note**   Before you begin this procedure, ensure that the reference PC is clean of viruses or malware. Each piece of installed software should be validated as trustworthy before you create this policy. Also, be sure that any software that you would like to be scanned is installed on the system before you create the code integrity policy. - To create a code integrity policy, copy each of the following commands into an elevated Windows PowerShell session, in order: - 1. Initialize variables that you will use: - `$CIPolicyPath=$env:userprofile+"\Desktop\"` - `$InitialCIPolicy=$CIPolicyPath+"InitialScan.xml"` - `$CIPolicyBin=$CIPolicyPath+"DeviceGuardPolicy.bin"` - 2. Create a new code integrity policy by scanning the system for installed applications: - `New-CIPolicy -Level PcaCertificate -FilePath $InitialCIPolicy –UserPEs 3> CIPolicyLog.txt ` - **Note**   By specifying the *–UserPEs* parameter, rule option **0 Enabled:UMCI** is automatically added to the code integrity policy. If you do not specify this parameter, use the following command to enable UMCI: - `Set-RuleOption -Option 0 -FilePath $InitialCIPolicy` - **Note**   You can add the *–Fallback* parameter to catch any applications not discovered using the primary file rule level specified by the *–Level* parameter. For more information about file rule level options, see the [Code integrity policy rules](#code-integrity-policy-rules) section. - **Note**   If you would like to specify the code integrity policy scan to look only at a specific drive, you can do so by using the *–ScanPath* parameter. Without this parameter, as shown in the example, the entire system is scanned. - 3. Convert the code integrity policy to a binary format: - `ConvertFrom-CIPolicy $InitialCIPolicy $CIPolicyBin` - After you complete these steps, the Device Guard binary file (DeviceGuardPolicy.bin) and original .xml file (IntialScan.xml) will be available on your desktop. You can use the binary version as a code integrity policy or sign it for additional security. - **Note**   Microsoft recommends that you keep the original .xml file of the policy for use when you need to merge the code integrity policy with another policy or update its rule options. Alternatively, you would have to create a new policy from a new scan for servicing. For more information about how to merge code integrity policies, see the [Merge code integrity policies](#merge-code-integrity-policies) section. - Microsoft recommends that every code integrity policy be run in audit mode before being enforced. Doing so allows administrators to discover any issues with the policy without receiving error message dialog boxes. For information about how to audit a code integrity policy, see the [Audit code integrity policies](#audit-code-integrity-policies) section. - ### Audit code integrity policies - When code integrity policies are run in audit mode, it allows administrators to discover any applications that were missed during an initial policy scan and to identify any new applications that have been installed and run since the original policy was created. While a code integrity policy is running in audit mode, any binary that runs and would have been denied had the policy been enforced is logged in the Applications and Services Logs\\Microsoft\\CodeIntegrity\\Operational event log. When these logged binaries have been validated, they can easily be added to a new code integrity policy. When the new exception policy is created, you can merge it with your existing code integrity policies. - **Note**   Before you begin this process, you need to create a code integrity policy binary file. If you have not already done so, see the [Create a code integrity policy](#create-a-code-integrity-policy) section for a step-by-step walkthrough of the process to create a code integrity policy and convert it to binary format. - To audit a code integrity policy with local policy: - 1. Copy the DeviceGuardPolicy.bin file that you created in the [Create code integrity policies from golden PCs](#create-code-integrity-policies-from-golden-pcs) section to C:\\Windows\\System32\\CodeIntegrity. - 2. On the system you want to run in audit mode, open the Local Group Policy Editor by running **GPEdit.msc**. - 3. Navigate to Computer Configuration\\Administrative Templates\\System\\Device Guard, and then select **Deploy Code Integrity Policy**. Enable this setting by using the file path C:\\Windows\\System32\\CodeIntegrity\\DeviceGuardPolicy.bin, as shown in Figure 22. - **Note**   *DeviceGuardPolicy.bin* is not a required policy name. This name was simply used in the [Create code integrity policies from golden PCs](#create-code-golden) section and so was used here. Also, this policy file does not need to be copied to every system. Alternatively, you can copy the code integrity policies to a file share to which all computer accounts have access. - **Note**   Any policy you select here is converted to SIPolicy.p7b when it is deployed to the individual computers. - ![figure 22](images/dg-fig22-deploycode.png) - Figure 22. Deploy your code integrity policy - **Note**   You may have noticed that the GPO setting references a .p7b file and this policy uses a .bin file. Regardless of the type of policy you deploy (.bin, .p7b, or .p7), they are all converted to SIPolicy.p7b when dropped on the Windows 10 computers. Microsoft recommends that you make your code integrity policies friendly and allow the system to convert the policy names for you. By doing this, it ensures that the policies are easily distinguishable when viewed in a share or any other central repository. - 4. Restart reference system for the code integrity policy to take effect. - 5. Monitor the CodeIntegrity event log. While in audit mode, any exception to the deployed code integrity policy will be logged in the Applications and Services Logs\\Microsoft\\CodeIntegrity\\Operational event log, as shown in Figure 23. - ![figure 23](images/dg-fig23-exceptionstocode.png) - Figure 23. Exceptions to the deployed code integrity policy - 6. Validate any code integrity policy exceptions. - After you run a code integrity policy in audit mode, Microsoft recommends that each logged exception be researched and validated. In addition to discovering which application is causing the exception and ensuring that it should be added to the code integrity policy, be sure to check which file level should be used to trust each application. Although the Hash file rule level will catch all of these exceptions, it may not be the best way to trust all of the exceptions. For information about file rule levels and their purpose, see the [Code integrity policy rules](#code-integrity-policy-rules) section. - 7. Create code integrity policy from audit events. - For information about how to create code integrity policies from audit events, see the [Create code integrity policies from golden PCs](#create-code-golden) section. - **Note**   An alternative method to test a policy is to rename the test file to SIPolicy.p7b and drop it into C:\\Windows\\System32\\CodeIntegrity, rather than deploy it with the local machine policy. - ### Create an audit code integrity policy - When you run code integrity policies in audit mode, validate any exceptions and determine whether you will need to add them to the code integrity policy you want to audit. Use the system as you normally would to ensure that any use exceptions are logged. When you are ready to create a code integrity policy from the auditing events, complete the following steps in an elevated Windows PowerShell session: - 1. Initialize the variables that will be used: - `$CIPolicyPath=$env:userprofile+"\Desktop\"` - `$CIAuditPolicy=$CIPolicyPath+"DeviceGuardAuditPolicy.xml"` - 2. Analyze audit results. - Before you create a code integrity policy from audit events, Microsoft recommends that each exception be analyzed, as discussed in steps 5 and 6 of the [Audit code integrity policies](#audit-code-integrity-policies) section. - 3. Generate a new code integrity policy from logged audit events: - `New-CIPolicy -Audit -Level Hash -FilePath $CIAuditPolicy –UserPEs 3> CIPolicylog.txt` - **Note**   When you create policies from audit events, you should carefully consider the file rule level that you select to trust. In this example, you use the Hash rule level, which should be used as a last resort. - After you complete these steps, the Device Guard audit policy .xml file (DeviceGuardAuditPolicy.xml) will be available on your desktop. You can now use this file to update the existing code integrity policy that you ran in audit mode by merging the two policies. For instructions on how to merge this audit policy with the existing code integrity policy, see the [Merge code integrity policies](#merge-code-integrity-policies) section. - **Note**   You may have noticed that you did not generate a binary version of this policy as you did in the [Create code integrity policies from golden PCs](#create-code-integrity-policies-from-golden-pcs) section. This is because code integrity policies created from an audit log are not intended to run as stand-alone policies but rather to update existing code integrity policies. - ### Merge code integrity policies - When you develop code integrity policies, you will occasionally need to merge two policies. A common example is when a code integrity policy is initially created and audited. Another example is when you create a single master policy by using multiple code integrity policies previously created from golden PCs. Because each Windows 10 machine can have only one code integrity policy, it is important to properly maintain these policies. In this example, audit events have been saved into a secondary code integrity policy that you then merge with the initial code integrity policy. - **Note**   The following example uses the code integrity policy .xml files that you created in the [Create code integrity policies from golden PCs](#create-code-integrity-policies-from-golden-pcs) and [Audit code integrity policies](#audit-code-integrity-policies) sections. You can follow this process, however, with any two code integrity policies you would like to combine. - To merge two code integrity policies, complete the following steps in an elevated Windows PowerShell session: - 1. Initialize the variables that will be used: - ` $CIPolicyPath=$env:userprofile+"\Desktop\"` - `$InitialCIPolicy=$CIPolicyPath+"InitialScan.xml"` - `$AuditCIPolicy=$CIPolicyPath+"DeviceGuardAuditPolicy.xml"` - `$MergedCIPolicy=$CIPolicyPath+"MergedPolicy.xml"` - ` $CIPolicyBin=$CIPolicyPath+"NewDeviceGuardPolicy.bin"` - **Note**   The variables in this section specifically expect to find an initial policy on your desktop called InitialScan.xml and an audit code integrity policy called DeviceGuardAuditPolicy.xml. If you want to merge other code integrity policies, update the variables accordingly. -   - 2. Merge two policies to create a new code integrity policy: - `Merge-CIPolicy -PolicyPaths $InitialCIPolicy,$AuditCIPolicy -OutputFilePath $MergedCIPolicy` - 3. Convert the merged code integrity policy to binary format: - ` ConvertFrom-CIPolicy $MergedCIPolicy $CIPolicyBin ` - Now that you have created a new code integrity policy called NewDeviceGuardPolicy.bin, you can deploy the policy to systems manually or by using Group Policy or Microsoft client management solutions. For information about how to deploy this new policy with Group Policy, see the [Deploy and manage code integrity policies with Group Policy](#deploy-manage-code-gp) section. - **Enforce code integrity policies** - Every code integrity policy is created with audit mode enabled. After you have successfully deployed and tested a code integrity policy in audit mode and are ready to test the policy in enforced mode, complete the following steps in an elevated Windows PowerShell session: - **Note**   Every code integrity policy should be tested in audit mode first. For information about how to audit code integrity policies, see the [Audit code integrity policies](#audit-code-integrity) section. - 1. Initialize the variables that will be used: - `$CIPolicyPath=$env:userprofile+"\Desktop\"` - `$InitialCIPolicy=$CIPolicyPath+"InitialScan.xml" ` - `$EnforcedCIPolicy=$CIPolicyPath+"EnforcedPolicy.xml"` - `$CIPolicyBin=$CIPolicyPath+"EnforcedDeviceGuardPolicy.bin"` - **Note**   The initial code integrity policy that this section referenced was created in the [Create code integrity polices from golden PCs](#create-code-golden) section. If you are using a different code integrity policy, update the **CIPolicyPath** and **InitialCIPolicy** variables. -   - 2. Copy the initial file to maintain an original copy: - `cp $InitialCIPolicy $EnforcedCIPolicy` - 3. Remove the audit mode rule option: - `Set-RuleOption -Option 3 -FilePath $EnforcedCIPolicy -Delete` - **Note**   Rather than adding an **Enforced** option, code integrity policies are implicitly enforced if no **Audit Mode Enabled** option is present. -   - 4. Convert the new code integrity policy to binary format: - `ConvertFrom-CIPolicy $EnforcedCIPolicy $CIPolicyBin` - **Note**   Microsoft strongly recommends that you enable rule options 9 and 10 before you run any enforced policy for the first time. If already present in the policy, do not remove it. Doing so allows Windows to start if the code integrity policy blocks a kernel-mode driver from running and provides administrators with a pre-boot command prompt. When ready for enterprise deployment, you can remove these options. -   - Now that this policy has been enforced, you can deploy it to your test machines. Rename the policy to SIPolicy.p7b and copy it to C:\\Windows\\System32\\CodeIntegrity for testing, or deploy the policy through Group Policy by following the instructions in the [Deploy and manage code integrity policies with Group Policy](#deploy-and-manage-code-integrity-policies-with-group-policy) section, or through client management software by following the instructions in the section “Deploying and managing code integrity policies by using Microsoft client management solutions.” - **Signing code integrity policies with SignTool.exe** - Signed code integrity policies give organizations the highest level of malware protection available in Windows 10. In addition to their enforced policy rules, signed policies cannot be modified or deleted by a user or administrator on the machine. These policies are designed to prevent administrative tampering and kernel mode exploit access. With this in mind, it is much more difficult to remove signed code integrity policies than unsigned ones. Before you sign and deploy a signed code integrity policy, Microsoft recommends that you audit the policy to discover any blocked applications that should be allowed to run. For more information about how to audit code integrity policies, see the [Audit code integrity policies](#audit-code-integrity-policies) section. - Signing code integrity policies by using an on-premises CA-generated certificate or a purchased code signing certificate is straightforward. If you do not currently have a code signing certificate exported in .pfx format (containing private keys, extensions, and root certificates), see [Create a Device Guard code signing certificate](#create-a-device-guard-code-signing-certificate) to create one with your on-premises CA. Before signing code integrity policies for the first time, be sure to enable rule options 9 and 10 to leave troubleshooting options available to test administrators. When validated and ready for enterprise deployment, you can remove these options. For information about how to add rule options, see the [Code integrity policy rules](#code-integrity-policy-rules) section. - **Note**   Signing code integrity policies is the last step in a code integrity deployment. It is much more difficult to remove a signed code integrity policy than an unsigned one. Before you deploy a signed code integrity policy to deployed client computers, be sure to test its effect on a subset of machines. - To sign a code integrity policy with SignTool.exe, you need the following components: - - SignTool.exe, found in the Windows SDK (Windows 7 or later) - - The binary format of the code integrity policy that you generated in the [Create code integrity policies from golden PCs](#create-code-golden) section or another code integrity policy that you have created - - An internal CA code signing certificate or a purchased code signing certificate - If you do not have a code signing certificate, see the [Create a Device Guard code signing certificate](#create-dg-code) section for instructions on how to create one. If you use an alternate certificate or code integrity policy, be sure to update the following steps with the appropriate variables and certificate so that the commands will function properly. To sign the existing code integrity policy, copy each of the following commands into an elevated Windows PowerShell session: - 1. Initialize the variables that will be used: - `$CIPolicyPath=$env:userprofile+"\Desktop\" $InitialCIPolicy=$CIPolicyPath+"InitialScan.xml" $CIPolicyBin=$CIPolicyPath+"DeviceGuardPolicy.bin"` - **Note**   This example uses the code integrity policy that you created in the [Create code integrity policies from golden PCs](#create-code-golden) section. If you are signing another policy, be sure to update the **$CIPolicyPath** and **$CIPolicyBin** variables with the correct information. - 2. Import the .pfx code signing certificate. Import the code signing certificate that you will use to sign the code integrity policy into the signing user’s personal store on the machine that will be doing the signing. In this example, you use the certificate that was created in the [Create a Device Guard code signing certificate](#create-dg-code) section. - 3. Export the .cer code signing certificate. After the code signing certificate has been imported, export the .cer version to your desktop. This version will be added to the policy so that it can be updated later. - 4. Navigate to your desktop as the working directory: - `cd $env:USERPROFILE\Desktop ` - 5. Add an update signer certificate to the code integrity policy: - `Add-SignerRule -FilePath $InitialCIPolicy -CertificatePath -Kernel -User –Update` - **Note**   *<Path to exported .cer certificate>* should be the full path to the certificate that you exported in step 3. **Note**   Adding update signers is crucial to being able to modify or disable this policy in the future. For more information about how to disable signed code integrity policies, see the [Disable signed code integrity policies within Windows](#disable-signed-code) section. - 6. Remove the unsigned policy rule option: - `Set-RuleOption -Option 6 -FilePath $InitialCIPolicy -Delete` - 7. Convert the policy to binary format: - `ConvertFrom-CIPolicy $InitialCIPolicy $CIPolicyBin` - 8. Sign the code integrity policy by using SignTool.exe: - ` sign -v /n "ContosoDGSigningCert" -p7 . -p7co 1.3.6.1.4.1.311.79.1 -fd sha256 $CIPolicyBin` - **Note**   The *<Path to signtool.exe>* variable should be the full path to the SignTool.exe utility. **ContosoDGSigningCert** is the subject name of the certificate that will be used to sign the code integrity policy. You should import this certificate to your personal certificate store on the machine you use to sign the policy. - 9. Validate the signed file. When complete, the commands should output a signed policy file called DeviceGuardPolicy.bin.p7 to your desktop. You can deploy this file the same way you deploy an enforced or non-enforced policy. For information about how to deploy code integrity policies, see the [Deploy and manage code integrity policies with Group Policy](#deploy-and-manage-code-integrity-policies-with-group-policy) section. - ### Disable unsigned code integrity policies - There may come a time when an administrator wants to disable a code integrity policy. For unsigned code integrity policies, this process is simple. Depending on how the code integrity policy was deployed, unsigned policies can be disabled in one of two ways. If a code integrity policy was manually enabled and copied to the code integrity folder location, simply delete the file and restart the machine. The following locations can contain executing code integrity policies: - - <EFI System Partition>\\Microsoft\\Boot\\ - - <OS Volume>\\Windows\\System32\\CodeIntegrity\\ - If the code integrity policy was deployed by using Group Policy, the GPO that is currently enabling and deploying the policy must be set to disabled. Then, the code integrity policy will be disabled on the next computer restart. - ### Disable signed code integrity policies within Windows - Signed policies protect Windows from administrative manipulation as well as malware that has gained administrative-level access to the system. For this reason, signed code integrity policies are intentionally more difficult to remove than unsigned policies. They inherently protect themselves from modification or removal and therefore are difficult even for administrators to remove successfully. If the signed code integrity policy is manually enabled and copied to the CodeIntegrity folder, to remove the policy, you must complete the following steps: - **Note**   For reference, signed code integrity policies should be replaced and removed from the following locations: - - <EFI System Partition>\\Microsoft\\Boot\\ - - <OS Volume>\\Windows\\System32\\CodeIntegrity\\ - - 1. Replace the existing policy with another signed policy that has the **6 Enabled: Unsigned System Integrity Policy** rule option enabled. - **Note**   To take effect, this policy must be signed with a certificate previously added to the **UpdatePolicySigners** section of the original signed policy you want to replace. - 2. Restart the client computer. - 3. Verify that the new signed policy exists on the client. - **Note**   If the signed policy that contains rule option 6 has not been processed on the client, the addition of an unsigned policy may cause boot failures. - 4. Delete the new policy. - 5. Restart the client computer. - If the signed code integrity policy has been deployed using by using Group Policy, you must complete the following steps: - 1. Replace the existing policy in the GPO with another signed policy that has the **6 Enabled: Unsigned System Integrity Policy** rule option enabled. - **Note**   To take effect, this policy must be signed with a certificate previously added to the **UpdatePolicySigners** section of the original signed policy you want to replace. -   - 2. Restart the client computer. - 3. Verify that the new signed policy exists on the client. - **Note**   If the signed policy that contains rule option 6 has not been processed on the client, the addition of an unsigned policy may cause boot failures. - 4. Set the GPO to disabled. - 5. Delete the new policy. - 6. Restart the client computer. - ### Disable signed code integrity policies within the BIOS - There may be a time when signed code integrity policies cause a boot failure. Because code integrity policies enforce kernel mode drivers, it is important that they be thoroughly tested on each software and hardware configuration before being enforced and signed. Signed code integrity policies are validated in the pre-boot sequence by using Secure Boot. When you disable the Secure Boot feature in the BIOS, and then delete the file from the following locations on the operating system disk, it allows the system to boot into Windows: - - <EFI System Partition>\\Microsoft\\Boot\\ - - <OS Volume>\\Windows\\System32\\CodeIntegrity\\ - ### - **Deploy and manage code integrity policies with Group Policy** - Code integrity policies can easily be deployed and managed with Group Policy. A Device Guard administrative template will be available in Windows Server 2016 that allows you to simplify deployment of Device Guard hardware-based security features and code integrity policies. The following procedure walks you through how to deploy a code integrity policy called **DeviceGuardPolicy.bin** to a test OU called *DG Enabled PCs* by using a GPO called **Contoso GPO Test**. - **Note**   This walkthrough requires that you have previously created a code integrity policy and have a Windows 10 client PC on which to test a Group Policy deployment. For more information about how to create a code integrity policy, see the [Create code integrity polices from golden PCs](#create-code-integrity-polices-from-golden-pcs) section. - **Note**   Signed code integrity policies can cause boot failures when deployed. Microsoft recommends that signed code integrity policies be thoroughly tested on each hardware platform before enterprise deployment. - To deploy and manage a code integrity policy with Group Policy: - 1. On a domain controller on a client computer on which RSAT is installed, open the GPMC by running **GPMC.MSC** or searching for “Group Policy Management” in Windows Search. - 2. Create a new GPO: right-click the DG Enabled PCs OU, and then click **Create a GPO in this domain, and Link it here**, as shown in Figure 24. - **Note**   The DG Enabled PCs OU is just an example of where to link the test GPO created in this section. Any OU name can be used. Also, security group filtering is an option when considering policy partitioning options based on the strategy discussed in the [Approach enterprise code integrity deployment](#approach-enterprise) section. - ![figure 24](images/dg-fig24-creategpo.png) - Figure 24. Create a GPO - 3. Name new GPO **Contoso GPO Test**. This example uses Contoso GPO Test as the name of the GPO. You can choose any name that you prefer for this example. - 4. Open the Group Policy Management Editor: right-click the new GPO, and then click **Edit**. - 5. In the selected GPO, navigate to Computer Configuration\\Administrative Templates\\System\\Device Guard. Then, right-click **Deploy Code Integrity Policy**, and then click **Edit**. - ![figure 25](images/dg-fig25-editcode.png) - Figure 25. Edit the code integration policy - 6. In the **Display Code Integrity Policy** dialog box, select the **Enabled** option, and then specify the code integrity policy deployment path. - In this policy setting, you specify either the local path in which the policy will exist on the client computer or a Universal Naming Convention (UNC) path that the client computers will look to retrieve the latest version of the policy. This example copied the DeviceGuardPolicy.bin file onto the test machine and will enable this setting and use the file path C:\\Windows\\System32\\CodeIntegrity\\DeviceGuardPolicy.bin, as shown in Figure 26. - **Note**   *DeviceGuardPolicy.bin* is not a required policy name: It was simply used in the [Create code integrity policies from golden PCs](#create-code-golden) section and so is used here, as well. Also, this policy file does not need to be copied to every computer. Alternatively, you can copy the code integrity policies to a file share to which the computer accounts have access. Any policy selected here is converted to SIPolicy.p7b when it is deployed to the individual client computers. - ![figure 26](images/dg-fig26-enablecode.png) - Figure 26. Enable the code integrity policy - **Note**   You may have noticed that the GPO setting references a .p7b file and this example uses a .bin file for the policy. Regardless of the type of policy you deploy (.bin, .p7b, or .p7), they are all converted to SIPolicy.p7b when dropped on the Windows 10 client computers. Make your code integrity policies friendly and allow the system to convert the policy names for you to ensure that the policies are easily distinguishable when viewed in a share or any other central repository. - 7. Close the Group Policy Management Editor, and then restart the Windows 10 test machine. Restarting the client computer updates the code integrity policy. For information about how to audit code integrity policies, see the [Audit code integrity policies](#audit-code-integrity-policies)section. - ## Create a Device Guard code signing certificate - To sign catalog files or code integrity policies internally, you will either need a publicly issued code signing certificate or an internal CA. If you have purchased a code signing certificate, you can skip these steps and proceed to the sections that outline the steps to sign catalog files and code integrity policies. If you have not purchased a certificate but have an internal CA, complete these steps to create a code signing certificate: - 1. Open the Certification Authority Microsoft Management Console (MMC) snap-in, and then select your issuing CA. - 2. When connected, right-click **Certificate Templates**, and then click **Manage** to open the Certification Templates Console. - ![figure 27](images/dg-fig27-managecerttemp.png) - Figure 27. Manage the certificate templates - 3. In the navigation pane, right-click the Code Signing certificate, and then click **Duplicate Template**. - 4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** from the **Certification Authority** list, and then select **Windows 8 / Windows Server 2012** from the **Certificate recipient** list. - 5. On the **General** tab, specify the **Template display name** and **Template name**. This example uses **DG Catalog Signing Certificate**. - 6. On the **Request Handling** tab, select the **Allow private key to be exported** check box. - 7. On the **Extensions** tab, select the **Basic Constraints** check box, and then click **Edit**. - 8. In the **Edit Basic Constraints Extension** dialog box, select the **Enable the extension** check box, as shown in Figure 28. - ![figure 28](images/dg-fig29-enableconstraints.png) - Figure 28. Enable constraints on the new template - 9. If a certificate manager is required to approve any issued certificates, on the **Issuance Requirements** tab, select **CA certificate manager approval**. - 10. On the **Subject Name** tab, select **Supply in the request**. - 11. On the **Security** tab, verify that whatever account will be used to request the certificate has the right to enroll the certificate. - 12. Click **OK** to create the template, and then close the Certificate Template Console. - When this certificate template has been created, you must publish it to the CA published template store. To do so, complete the following steps: - 1. In the Certification Authority MMC snap-in, right-click **Certification Templates**, point to **New**, and then click **Certificate Template to Issue**, as shown in Figure 29. - A list of available templates to issue appears, including the template you just created. - ![figure 29](images/dg-fig30-selectnewcert.png) - Figure 29. Select the new certificate template to issue - 2. Select the DG Catalog signing certificate, and then click **OK**. - Now that the template is available to be issued, you must request one from the Windows 10 computer that you use to create and sign catalog files. To begin, open the MMC, and then complete the following steps: - 1. In MMC, from the **File** menu, click **Add/Remove Snap-in**. Double-click **Certificates**, and then select **My user account**. - 2. In the Certificates snap-in, right-click the Personal store folder, point to **All Tasks**, and then click **Request New Certificate**. - 3. Click **Next** twice to get to the certificate selection list. - 4. In the **Request Certificate** list, select your newly created code signing certificate, and then select the blue text that requests additional information, as shown in Figure 30. - ![figure 30](images/dg-fig31-getmoreinfo.png) - Figure 30. Get more information for your code signing certificate - 5. In the **Certificate Properties** dialog box, for **Type**, select **Common name**. For **Value**, select **ContosoDGSigningCert**, and then click **Add**. When added, click **OK.** - 6. Enroll and finish. - **Note**   If a certificate manager is required to approve any issued certificates and you selected to require management approval on the template, the request will need to be approved in the CA before it will be issued to the client. - This certificate must be installed in the user’s personal store on the computer that will be signing the catalog files and code integrity policies. If the signing is going to be taking place on the machine on which you just requested the certificate, exporting the certificate to a .pfx file will not be required because it already exists in your personal store. If you are signing on another computer, you will need to export the .pfx certificate with the necessary keys and properties. To do so, complete the following steps: - 1. Right-click the certificate, point to **All Tasks**, and then click **Export**. - 2. Click **Next**, and then select **Yes, export the private key**. - 3. Choose the default settings, and then select **Export all extended properties**. - 4. Set a password, select an export path, and then select **DGCatSigningCert.pfx** as the file name. - When the certificate has been exported, import it into the personal store for the user who will be signing the catalog files or code integrity policies on the specific computer that will be signing them. - ## Related topics - - [AppLocker overview](applocker-overview.md) - [Code integrity](http://go.microsoft.com/fwlink/p/?LinkId=624173) - [Credential guard](credential-guard.md) - [Driver compatibility with Device Guard in Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=624843) - [Dropping the Hammer Down on Malware Threats with Windows 10’s Device Guard](http://go.microsoft.com/fwlink/p/?LinkId=624844) diff --git a/windows/keep-secure/devices-allow-undock-without-having-to-log-on.md b/windows/keep-secure/devices-allow-undock-without-having-to-log-on.md index 5b03d0aedc..1283cb2181 100644 --- a/windows/keep-secure/devices-allow-undock-without-having-to-log-on.md +++ b/windows/keep-secure/devices-allow-undock-without-having-to-log-on.md @@ -2,53 +2,32 @@ title: Devices Allow undock without having to log on (Windows 10) description: Describes the best practices, location, values, and security considerations for the Devices Allow undock without having to log on security policy setting. ms.assetid: 1d403f5d-ad41-4bb4-9f4a-0779c1c14b8c +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Devices: Allow undock without having to log on - - **Applies to** - - Windows 10 - Describes the best practices, location, values, and security considerations for the **Devices: Allow undock without having to log on** security policy setting. - ## Reference - - This policy setting enables or disables the ability of a user to remove a portable device from a docking station without logging on. If you enable this policy setting, users can press a docked portable device's physical eject button to safely undock the device. If you disable this policy setting, the user must log on to receive permission to undock the device. Only users who have the **Remove Computer from Docking Station** privilege can obtain this permission. - **Note**   Disabling this policy setting only reduces theft risk for portable devices that cannot be mechanically undocked. Devices that can be mechanically undocked can be physically removed by the user whether or not they use the Windows undocking functionality. -   - Enabling this policy setting means that anyone with physical access to a device that has been placed in its docking station can remove the computer and possibly tamper with it. For devices that do not have docking stations, this policy setting has no impact. However, for users with a mobile computer that is normally docked while they are in the office, this policy setting will help lower the risk of equipment theft or a malicious user gaining physical access to these devices - ### Possible values - - Enabled - - Disabled - - Not defined - ### Best practices - It is advisable to disable the **Devices: Allow undock without having to log on** policy setting. Users who have docked their devices will have to log on to the local console before they can undock their systems. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -87,45 +66,20 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - If this policy setting is enabled, anyone with physical access to portable computers in docking stations could remove them and possibly tamper with them. - ### Countermeasure - Disable the **Devices: Allow undock without having to log on** setting. - ### Potential impact - Users who have docked their device must log on to the local console before they can undock their computers. For devices that do not have docking stations, this policy setting has no impact. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/devices-allowed-to-format-and-eject-removable-media.md b/windows/keep-secure/devices-allowed-to-format-and-eject-removable-media.md index 40c23ebc27..146ef13dde 100644 --- a/windows/keep-secure/devices-allowed-to-format-and-eject-removable-media.md +++ b/windows/keep-secure/devices-allowed-to-format-and-eject-removable-media.md @@ -2,50 +2,30 @@ title: Devices Allowed to format and eject removable media (Windows 10) description: Describes the best practices, location, values, and security considerations for the Devices Allowed to format and eject removable media security policy setting. ms.assetid: d1b42425-7244-4ab1-9d46-d68de823459c +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Devices: Allowed to format and eject removable media - - **Applies to** - - Windows 10 - Describes the best practices, location, values, and security considerations for the **Devices: Allowed to format and eject removable media** security policy setting. - ## Reference - - This policy setting determines who is allowed to format and eject removable media. - Users can move removable disks to a different device where they have administrative user rights and then take ownership of any file, assign themselves full control, and view or modify any file. The advantage of configuring this policy setting is diminished by the fact that most removable storage devices will eject media with the press of a button. - ### Possible values - - Administrators - - Administrators and Power Users - - Administrators and Interactive Users (not applicable to Windows Server 2008 R2 or Windows 7 and later) - - Not defined - ### Best practices - - It is advisable to set **Allowed to format and eject removable media** to **Administrators**. Only administrators will be able to eject NTFS-formatted removable media. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -84,45 +64,20 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Users could move data on removable disks to a different computer where they have administrative privileges. The user could then take ownership of any file, grant themselves full control, and view or modify any file. The fact that most removable storage devices eject media when a mechanical button is pressed diminishes the advantage of this policy setting. - ### Countermeasure - Configure the **Devices: Allowed to format and eject removable media** setting to **Administrators**. - ### Potential impact - Only administrators can format and eject removable media. If users are in the habit of using removable media for file transfers and storage, they must be informed of the change in policy. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/devices-prevent-users-from-installing-printer-drivers.md b/windows/keep-secure/devices-prevent-users-from-installing-printer-drivers.md index b6c244f268..9a31968fed 100644 --- a/windows/keep-secure/devices-prevent-users-from-installing-printer-drivers.md +++ b/windows/keep-secure/devices-prevent-users-from-installing-printer-drivers.md @@ -2,50 +2,30 @@ title: Devices Prevent users from installing printer drivers (Windows 10) description: Describes the best practices, location, values, and security considerations for the Devices Prevent users from installing printer drivers security policy setting. ms.assetid: ab70a122-f7f9-47e0-ad8c-541f30a27ec3 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Devices: Prevent users from installing printer drivers - - **Applies to** - - Windows 10 - Describes the best practices, location, values, and security considerations for the **Devices: Prevent users from installing printer drivers** security policy setting. - ## Reference - - For a device to print to a network printer, the driver for that network printer must be installed locally. The **Devices: Prevent users from installing printer drivers** policy setting determines who can install a printer driver as part of adding a network printer. When you set the value to **Enabled**, only Administrators and Power Users can install a printer driver as part of adding a network printer. Setting the value to **Disabled** allows any user to install a printer driver as part of adding a network printer. This setting prevents unprivileged users from downloading and installing an untrusted printer driver. - This setting has no impact if you have configured a trusted path for downloading drivers. When using trusted paths, the print subsystem attempts to use the trusted path to download the driver. If the trusted path download succeeds, the driver is installed on behalf of any user. If the trusted path download fails, the driver is not installed and the network printer is not added. - Although it might be appropriate in some organizations to allow users to install printer drivers on their own workstations, this is not suitable for servers. Installing a printer driver on a server can cause the system to become less stable. Only administrators should have this user right on servers. A malicious user might deliberately try to damage the system by installing inappropriate printer drivers. - ### Possible values - - Enabled - - Disabled - - Not defined - ### Best practices - - It is advisable to set **Devices: Prevent users from installing printer drivers** to Enabled. Only users in the Administrative, Power User, or Server Operator groups will be able to install printers on servers. If this policy setting is enabled, but the driver for a network printer already exists on the local computer, users can still add the network printer. This policy setting does not affect a user's ability to add a local printer. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -84,45 +64,20 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - It may be appropriate in some organizations to allow users to install printer drivers on their own workstations. However, you should allow only administrators, not users, to do so on servers because printer driver installation on a server may unintentionally cause the computer to become less stable. A malicious user could install inappropriate printer drivers in a deliberate attempt to damage the computer, or a user might accidentally install malicious software that masquerades as a printer driver. - ### Countermeasure - Enable the **Devices: Prevent users from installing printer drivers** setting. - ### Potential impact - Only members of the Administrator, Power Users, or Server Operator groups can install printers on the servers. If this policy setting is enabled but the driver for a network printer already exists on the local computer, users can still add the network printer. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md b/windows/keep-secure/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md index 4a6476a263..d4a806d762 100644 --- a/windows/keep-secure/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md +++ b/windows/keep-secure/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md @@ -2,50 +2,30 @@ title: Devices Restrict CD-ROM access to locally logged-on user only (Windows 10) description: Describes the best practices, location, values, and security considerations for the Devices Restrict CD-ROM access to locally logged-on user only security policy setting. ms.assetid: 8b8f44bb-84ce-4f18-af30-ab89910e234d +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Devices: Restrict CD-ROM access to locally logged-on user only - - **Applies to** - - Windows 10 - Describes the best practices, location, values, and security considerations for the **Devices: Restrict CD-ROM access to locally logged-on user only** security policy setting. - ## Reference - - This policy setting determines whether a CD is accessible to local and remote users simultaneously. If you enable this policy setting, only the interactively logged-on user is allowed to access removable CDs. If this policy setting is enabled and no one is logged on interactively, the CD can be accessed over the network. - The security benefit of enabling this policy setting is small because it only prevents network users from accessing the drive when someone is logged on to the local console of the system at the same time. Additionally, CD drives are not automatically made available as network shared drives; you must deliberately choose to share the drive. This is important when administrators are installing software or copying data from a CD-ROM, and they do not want network users to be able to execute the applications or view the data. - If this policy setting is enabled, users who connect to the server over the network will not be able to use any CD drives that are installed on the server when anyone is logged on to the local console of the server. Enabling this policy setting is not suitable for a system that serves as a CD jukebox for network users. - ### Possible values - - Enabled - - Disabled - - Not defined - ### Best practices - - Best practices are dependent on your security and user accessibility requirements for CD drives. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -84,45 +64,20 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - A remote user could potentially access a mounted CD that contains sensitive information. This risk is small because CD drives are not automatically made available as shared drives; you must deliberately choose to share the drive. However, you can deny network users the ability to view data or run applications from removable media on the server. - ### Countermeasure - Enable the **Devices: Restrict CD-ROM drive access to locally logged-on user only** setting. - ### Potential impact - Users who connect to the server over the network cannot use any CD drives that are installed on the server when anyone is logged on to the local console of the server. System tools that require access to the CD drive will fail. For example, the Volume Shadow Copy service attempts to access all CD and floppy disk drives that are present on the computer when it initializes, and if the service cannot access one of these drives, it fails. This condition causes the Windows Backup tool to fail if volume shadow copies were specified for the backup job. Any non-Microsoft backup products that use volume shadow copies also fail. This policy setting would not be suitable for a computer that serves as a CD jukebox for network users. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/devices-restrict-floppy-access-to-locally-logged-on-user-only.md b/windows/keep-secure/devices-restrict-floppy-access-to-locally-logged-on-user-only.md index ade06f8756..c031c438a6 100644 --- a/windows/keep-secure/devices-restrict-floppy-access-to-locally-logged-on-user-only.md +++ b/windows/keep-secure/devices-restrict-floppy-access-to-locally-logged-on-user-only.md @@ -2,50 +2,30 @@ title: Devices Restrict floppy access to locally logged-on user only (Windows 10) description: Describes the best practices, location, values, and security considerations for the Devices Restrict floppy access to locally logged-on user only security policy setting. ms.assetid: 92997910-da95-4c03-ae6f-832915423898 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Devices: Restrict floppy access to locally logged-on user only - - **Applies to** - - Windows 10 - Describes the best practices, location, values, and security considerations for the **Devices: Restrict floppy access to locally logged-on user only** security policy setting. - ## Reference - - This policy setting determines whether removable floppy disks are accessible to local and remote users simultaneously. Enabling this policy setting allows only the interactively logged-on user to access removable floppy disks. If this policy setting is enabled and no one is logged on interactively, the floppy disk can be accessed over the network. - The security benefit of enabling this policy setting is small because it only prevents network users from accessing the floppy disk drive when someone is logged on to the local console of the system at the same time. Additionally, floppy disk drives are not automatically made available as network shared drives; you must deliberately choose to share the drive. This becomes important when you are installing software or copying data from a floppy disk and they do not want network users to be able to execute the applications or view the data. - If this policy setting is enabled, users who connect to the server over the network will not be able to use any floppy disk drives that are installed on the server when anyone is logged on to the local console of the server. - ### Possible values - - Enabled - - Disabled - - Not defined - ### Best practices - - Best practices are dependent on your security and user accessibility requirements for CD drives. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -84,45 +64,20 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - A remote user could potentially access a mounted floppy disk that contains sensitive information. This risk is small because floppy disk drives are not automatically shared; administrators must deliberately choose to share the drive. However, you can deny network users the ability to view data or run applications from removable media on the server. - ### Countermeasure - Enable the **Devices: Restrict floppy access to locally logged-on user only** setting. - ### Potential impact - Users who connect to the server over the network cannot use any floppy disk drives that are installed on the device when anyone is logged on to the local console of the server. System tools that require access to floppy disk drives fail. For example, the Volume Shadow Copy service attempts to access all CD-ROM and floppy disk drives that are present on the computer when it initializes, and if the service cannot access one of these drives, it fails. This condition causes the Windows Backup tool to fail if volume shadow copies were specified for the backup job. Any non-Microsoft backup products that use volume shadow copies also fail. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md b/windows/keep-secure/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md index 1cd3b2b2c5..ea5e8e17a8 100644 --- a/windows/keep-secure/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md +++ b/windows/keep-secure/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md @@ -2,46 +2,25 @@ title: Display a custom URL message when users try to run a blocked app (Windows 10) description: This topic for IT professionals describes the steps for displaying a customized message to users when an AppLocker policy denies access to an app. ms.assetid: 9a2534a5-d1fa-48a9-93c6-989d4857cf85 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Display a custom URL message when users try to run a blocked app - - **Applies to** - - Windows 10 - This topic for IT professionals describes the steps for displaying a customized message to users when an AppLocker policy denies access to an app. - Using Group Policy, AppLocker can be configured to display a message with a custom URL. You can use this URL to redirect users to a support site that contains info about why the user received the error and which apps are allowed. If you do not display a custom message when an apps is blocked, the default access denied message is displayed. - To complete this procedure, you must have the **Edit Setting** permission to edit a GPO. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. - **To display a custom URL message when users try to run a blocked app** - 1. On the **Start** screen, type **gpmc.msc** to open the Group Policy Management Console (GPMC). - 2. Navigate to the Group Policy Object (GPO) that you want to edit. - 3. Right-click the GPO, and then click **Edit**. - 4. In the console tree under **Policies\\Administrative Templates\\Windows Components**, click **File Explorer**. - 5. In the details pane, double-click **Set a support web page link**. - 6. Click **Enabled**, and then type the URL of the custom Web page in the **Support Web page URL** box. - 7. Click **OK** to apply the setting. -   -   - - - - - diff --git a/windows/keep-secure/dll-rules-in-applocker.md b/windows/keep-secure/dll-rules-in-applocker.md index aeabe9379e..545d8c5359 100644 --- a/windows/keep-secure/dll-rules-in-applocker.md +++ b/windows/keep-secure/dll-rules-in-applocker.md @@ -2,29 +2,20 @@ title: DLL rules in AppLocker (Windows 10) description: This topic describes the file formats and available default rules for the DLL rule collection. ms.assetid: a083fd08-c07e-4534-b0e7-1e15d932ce8f +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # DLL rules in AppLocker - - **Applies to** - - Windows 10 - This topic describes the file formats and available default rules for the DLL rule collection. - AppLocker defines DLL rules to include only the following file formats: - - .dll - - .ocx - The following table lists the default rules that are available for the DLL rule collection. - @@ -61,29 +52,14 @@ The following table lists the default rules that are available for the DLL rule
-   - **Important**   If you use DLL rules, a DLL allow rule has to be created for each DLL that is used by all of the allowed apps -   - **Caution**   When DLL rules are used, AppLocker must check each DLL that an app loads. Therefore, users may experience a reduction in performance if DLL rules are used. -   - ## Related topics - - [Understanding AppLocker default rules](understanding-applocker-default-rules.md) -   -   - - - - - diff --git a/windows/keep-secure/document-group-policy-structure-and-applocker-rule-enforcement.md b/windows/keep-secure/document-group-policy-structure-and-applocker-rule-enforcement.md index a3e357256e..e97b186290 100644 --- a/windows/keep-secure/document-group-policy-structure-and-applocker-rule-enforcement.md +++ b/windows/keep-secure/document-group-policy-structure-and-applocker-rule-enforcement.md @@ -2,38 +2,24 @@ title: Document the Group Policy structure and AppLocker rule enforcement (Windows 10) description: This planning topic describes what you need to investigate, determine, and record in your application control policies plan when you use AppLocker. ms.assetid: 389ffa8e-11fc-49ff-b0b1-89553e6fb6e5 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Document the Group Policy structure and AppLocker rule enforcement - - **Applies to** - - Windows 10 - This planning topic describes what you need to investigate, determine, and record in your application control policies plan when you use AppLocker. - ## Record your findings - - To complete this AppLocker planning document, you should first complete the following steps: - 1. [Determine your application control objectives](determine-your-application-control-objectives.md) - 2. [Create a list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md) - 3. [Select the types of rules to create](select-types-of-rules-to-create.md) - 4. [Determine the Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md) - After you determine how to structure your Group Policy Objects (GPOs) so that you can apply AppLocker policies, you should record your findings. You can use the following table to determine how many GPOs to create (or edit) and which objects they are linked to. If you decided to create custom rules to allow system files to run, note the high-level rule configuration in the **Use default rule or define new rule condition** column. - The following table includes the sample data that was collected when you determined your enforcement settings and the GPO structure for your AppLocker policies. - @@ -123,23 +109,10 @@ The following table includes the sample data that was collected when you determi
-   - ## Next steps - - After you have determined the Group Policy structure and rule enforcement strategy for each business group's apps, the following tasks remain: - - [Plan for AppLocker policy management](plan-for-applocker-policy-management.md) - - [Create your AppLocker planning document](create-your-applocker-planning-document.md) -   -   - - - - - diff --git a/windows/keep-secure/document-your-application-control-management-processes.md b/windows/keep-secure/document-your-application-control-management-processes.md index c5d5c7ecf4..b5a9cd95a7 100644 --- a/windows/keep-secure/document-your-application-control-management-processes.md +++ b/windows/keep-secure/document-your-application-control-management-processes.md @@ -2,52 +2,31 @@ title: Document your application control management processes (Windows 10) description: This planning topic describes the AppLocker policy maintenance information to record for your design document. ms.assetid: 6397f789-0e36-4933-9f86-f3f6489cf1fb +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Document your application control management processes - - **Applies to** - - Windows 10 - This planning topic describes the AppLocker policy maintenance information to record for your design document. - ## Record your findings - - To complete this AppLocker planning document, you should first complete the following steps: - 1. [Determine your application control objectives](determine-your-application-control-objectives.md) - 2. [Create a list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md) - 3. [Select the types of rules to create](select-types-of-rules-to-create.md) - 4. [Determine the Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md) - 5. [Plan for AppLocker policy management](plan-for-applocker-policy-management.md) - The three key areas to determine for AppLocker policy management are: - 1. Support policy - Document the process that you will use for handling calls from users who have attempted to run a blocked app, and ensure that support personnel know recommended troubleshooting steps and escalation points for your policy. - 2. Event processing - Document whether events will be collected in a central location, how that store will be archived, and whether the events will be processed for analysis. - 3. Policy maintenance - Detail how rules will be added to the policy, in which Group Policy Object (GPO) the rules should be defined, and how to modify rules when apps are retired, updated, or added. - The following table contains the added sample data that was collected when determining how to maintain and manage AppLocker policies. - @@ -144,17 +123,11 @@ The following table contains the added sample data that was collected when deter
-   - The following two tables illustrate examples of documenting considerations to maintain and manage AppLocker policies. - **Event processing policy** - One discovery method for app usage is to set the AppLocker enforcement mode to **Audit only**. This will write events to the AppLocker logs, which can be managed and analyzed like other Windows logs. After apps have been identified, you can begin to develop policies regarding the processing and access to AppLocker events. - The following table is an example of what to consider and record. - @@ -189,15 +162,10 @@ The following table is an example of what to consider and record.
-   - **Policy maintenance policy** - When applications are identified and policies are created for application control, then you can begin documenting how you intend to update those policies. - The following table is an example of what to consider and record. - @@ -240,21 +208,9 @@ The following table is an example of what to consider and record.
-   - ## Next steps - - After you have determined your application control management strategy for each of the business group's applications, the following task remains: - - [Create your AppLocker planning document](create-your-applocker-planning-document.md) -   -   - - - - - diff --git a/windows/keep-secure/document-your-application-list.md b/windows/keep-secure/document-your-application-list.md index 89cf353d55..1b7c7906fa 100644 --- a/windows/keep-secure/document-your-application-list.md +++ b/windows/keep-secure/document-your-application-list.md @@ -2,34 +2,22 @@ title: Document your app list (Windows 10) description: This planning topic describes the app information that you should document when you create a list of apps for AppLocker policies. ms.assetid: b155284b-f75d-4405-aecf-b74221622dc0 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Document your app list - - **Applies to** - - Windows 10 - This planning topic describes the app information that you should document when you create a list of apps for AppLocker policies. - ## Record your findings - - **Apps** - Record the name of the app, whether it is signed as indicated by the publisher's name, and whether it is a mission critical, business productivity, optional, or personal app. Later, as you manage your rules, AppLocker displays this information in the format shown in the following example: *MICROSOFT OFFICE INFOPATH signed by O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US*. - **Installation path** - Record the installation path of the apps. For example, Microsoft Office 2016 installs files to *%programfiles%\\Microsoft Office\\Office16\\*, which is *C:\\Program Files\\Microsoft Office\\Office16\\* on most devices. - The following table provides an example of how to list applications for each business group at the early stage of designing your application control policies. Eventually, as more planning information is added to the list, the information can be used to build AppLocker rules. - @@ -92,62 +80,30 @@ The following table provides an example of how to list applications for each bus
-   - **Note**   AppLocker only supports publisher rules for Universal Windows apps. Therefore, collecting the installation path information for Universal Windows apps is not necessary. -   - **Event processing** - As you create your list of apps, you need to consider how to manage the events that are generated by user access, or you need to deny running those apps to make your users as productive as possible. The following list is an example of what to consider and what to record: - - Will event forwarding be implemented for AppLocker events? - - What is the location of the AppLocker event collection? - - Should an event archival policy be implemented? - - Will the events be analyzed and how often? - - Should a security policy be in place for event collection? - **Policy maintenance** - As you create your list of apps, you need to consider how to manage and maintain the policies that you will eventually create. The following list is an example of what to consider and what to record: - - How will rules be updated for emergency app access and permanent access? - - How will apps be removed? - - How many older versions of the same app will be maintained? - - How will new apps be introduced? - ## Next steps - - After you have created the list of applications, the next step is to identify the rule collections, which will become the application control policies. This information can be added to the table under the following columns: - - Use default rule or define new rule condition - - Allow or deny - - GPO name - To identify the rule collections, see the following topics: - - [Select the types of rules to create](select-types-of-rules-to-create.md) - - [Determine Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md) -   -   - - - - - diff --git a/windows/keep-secure/document-your-applocker-rules.md b/windows/keep-secure/document-your-applocker-rules.md index 9abb8817ee..97bd6545ef 100644 --- a/windows/keep-secure/document-your-applocker-rules.md +++ b/windows/keep-secure/document-your-applocker-rules.md @@ -2,40 +2,25 @@ title: Document your AppLocker rules (Windows 10) description: This topic describes what rule conditions to associate with each file, how to associate the rule conditions with each file, the source of the rule, and whether the file should be included or excluded. ms.assetid: 91a198ce-104a-45ff-b49b-487fb40cd2dd +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Document your AppLocker rules - - **Applies to** - - Windows 10 - This topic describes what rule conditions to associate with each file, how to associate the rule conditions with each file, the source of the rule, and whether the file should be included or excluded. - ## Record your findings - - To complete this AppLocker planning document, you should first complete the following steps: - 1. [Determine your application control objectives](determine-your-application-control-objectives.md) - 2. [Create a list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md) - 3. [Select the types of rules to create](select-types-of-rules-to-create.md) - Document the following items for each business group or organizational unit: - - Whether your organization will use the built-in default AppLocker rules to allow system files to run. - - The types of rule conditions that you will use to create rules, stated in order of preference. - The following table details sample data for documenting rule type and rule condition findings. In addition, you should now consider whether to allow an app to run or deny permission for it to run. For info about these settings, see [Understanding AppLocker allow and deny actions on rules](understanding-applocker-allow-and-deny-actions-on-rules.md). - @@ -114,25 +99,11 @@ The following table details sample data for documenting rule type and rule condi
-   - ## Next steps - - For each rule, determine whether to use the allow or deny option. Then, three tasks remain: - - [Determine Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md) - - [Plan for AppLocker policy management](plan-for-applocker-policy-management.md) - - [Create your AppLocker planning document](create-your-applocker-planning-document.md) -   -   - - - - - diff --git a/windows/keep-secure/domain-controller-allow-server-operators-to-schedule-tasks.md b/windows/keep-secure/domain-controller-allow-server-operators-to-schedule-tasks.md index de5c0393cd..9830087bd1 100644 --- a/windows/keep-secure/domain-controller-allow-server-operators-to-schedule-tasks.md +++ b/windows/keep-secure/domain-controller-allow-server-operators-to-schedule-tasks.md @@ -2,55 +2,33 @@ title: Domain controller Allow server operators to schedule tasks (Windows 10) description: Describes the best practices, location, values, and security considerations for the Domain controller Allow server operators to schedule tasks security policy setting. ms.assetid: 198b12a4-8a5d-48e8-a752-2073b8a2cb0d +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Domain controller: Allow server operators to schedule tasks - - **Applies to** - - Windows 10 - Describes the best practices, location, values, and security considerations for the **Domain controller: Allow server operators to schedule tasks** security policy setting. - ## Reference - - This policy setting determines whether server operators can use the**at** command to submit jobs. If you enable this policy setting, jobs that are created by server operators by means of the **at** command run in the context of the account that runs the Task Scheduler service. By default, that is the Local System account. - **Note**   This security option setting affects only the scheduler tool for the **at** command. It does not affect the Task Scheduler tool. -   - Enabling this policy setting means jobs that are created by server operators through the **at** command will be executed in the context of the account that is running that service—by default, that is the Local System account. This means that server operators can perform tasks that the Local System account is able to do, but server operators would normally not be able to do, such as add their account to the local Administrators group. - The impact of enabling this policy setting should be small for most organizations. Users, including those in the Server Operators group, will still be able to create jobs by using the Task Scheduler Wizard, but those jobs will run in the context of the account that the user authenticates with when setting up the job. - ### Possible values - - Enabled - - Disabled - - Not defined - ### Best practices - - Best practices for this policy are dependent on your security and operational requirements for task scheduling. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -89,49 +67,22 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ### Command-line tools - The **at** command schedules commands and programs to run on a computer at a specified time and date. The Schedule service must be running to use the **at** command. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Tasks that run under the context of the Local System account can affect resources that are at a higher privilege level than the user account that scheduled the task. - ### Countermeasure - Disable the **Domain controller: Allow server operators to schedule tasks** setting. - ### Potential impact - The impact should be small for most organizations. Users (including those in the Server Operators group) can still create jobs by means of the Task Scheduler snap-in. However, those jobs run in the context of the account that the user authenticates with when setting up the job. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/domain-controller-ldap-server-signing-requirements.md b/windows/keep-secure/domain-controller-ldap-server-signing-requirements.md index 72848b8339..50f94a37d3 100644 --- a/windows/keep-secure/domain-controller-ldap-server-signing-requirements.md +++ b/windows/keep-secure/domain-controller-ldap-server-signing-requirements.md @@ -2,57 +2,34 @@ title: Domain controller LDAP server signing requirements (Windows 10) description: Describes the best practices, location, values, and security considerations for the Domain controller LDAP server signing requirements security policy setting. ms.assetid: fe122179-7571-465b-98d0-b8ce0f224390 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Domain controller: LDAP server signing requirements - - **Applies to** - - Windows 10 - Describes the best practices, location, values, and security considerations for the **Domain controller: LDAP server signing requirements** security policy setting. - ## Reference - - This policy setting determines whether the Lightweight Directory Access Protocol (LDAP) server requires LDAP clients to negotiate data signing. - Unsigned network traffic is susceptible to man-in-the-middle attacks, where an intruder captures packets between the server and the client device and modifies them before forwarding them to the client device. In the case of an LDAP server, this means that a malicious user can cause a client device to make decisions based on false records from the LDAP directory. You can lower the risk of a malicious user accomplishing this in a corporate network by implementing strong physical security measures to protect the network infrastructure. Furthermore, implementing Internet Protocol security (IPsec) Authentication Header mode, which provides mutual authentication and packet integrity for IP traffic, can make all types of man-in-the-middle attacks extremely difficult. - This setting does not have any impact on LDAP simple bind or LDAP simple bind through SSL. - If signing is required, then LDAP simple bind and LDAP simple bind through SSL requests are rejected. - **Caution**   If you set the server to Require signature, you must also set the client device. Not setting the client device results in loss of connection with the server. -   - ### Possible values - - None. Data signatures are not required to bind with the server. If the client computer requests data signing, the server supports it. - - Require signature. The LDAP data-signing option must be negotiated unless Transport Layer Security/Secure Sockets Layer (TLS/SSL) is in use. - - Not defined. - ### Best practices - - It is advisable to set **Domain controller: LDAP server signing requirements** to **Require signature**. Clients that do not support LDAP signing will be unable to execute LDAP queries against the domain controllers. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -91,45 +68,20 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Unsigned network traffic is susceptible to man-in-the-middle attacks. In such attacks, an intruder captures packets between the server and the client device, modifies them, and then forwards them to the client device. Where LDAP servers are concerned, an attacker could cause a client device to make decisions that are based on false records from the LDAP directory. To lower the risk of such an intrusion in an organization's network, you can implement strong physical security measures to protect the network infrastructure. You could also implement Internet Protocol security (IPsec) Authentication Header mode, which performs mutual authentication and packet integrity for IP traffic to make all types of man-in-the-middle attacks extremely difficult. - ### Countermeasure - Configure the **Domain controller: LDAP server signing requirements** setting to **Require signature**. - ### Potential impact - Client device that do not support LDAP signing cannot run LDAP queries against the domain controllers. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/domain-controller-refuse-machine-account-password-changes.md b/windows/keep-secure/domain-controller-refuse-machine-account-password-changes.md index 8b810e64e2..acab069b02 100644 --- a/windows/keep-secure/domain-controller-refuse-machine-account-password-changes.md +++ b/windows/keep-secure/domain-controller-refuse-machine-account-password-changes.md @@ -2,52 +2,31 @@ title: Domain controller Refuse machine account password changes (Windows 10) description: Describes the best practices, location, values, and security considerations for the Domain controller Refuse machine account password changes security policy setting. ms.assetid: 5a7fa2e2-e1a8-4833-90f7-aa83e3b456a9 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Domain controller: Refuse machine account password changes - - **Applies to** - - Windows 10 - Describes the best practices, location, values, and security considerations for the **Domain controller: Refuse machine account password changes** security policy setting. - ## Reference - - This policy setting enables or disables blocking a domain controller from accepting password change requests for machine accounts. By default, devices joined to the domain change their machine account passwords every 30 days. If enabled, the domain controller will refuse machine account password change requests. - ### Possible values - - Enabled - When enabled, this setting does not allow a domain controller to accept any changes to a machine account's password. - - Disabled - When disabled, this setting allows a domain controller to accept any changes to a machine account's password. - - Not defined - Same as Disabled. - ### Best practices - - Enabling this policy setting on all domain controllers in a domain prevents domain members from changing their machine account passwords. This, in turn, leaves those passwords susceptible to attack. Make sure that this conforms to your overall security policy for the domain. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -86,45 +65,20 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - If you enable this policy setting on all domain controllers in a domain, domain members cannot change their machine account passwords, and those passwords are more susceptible to attack. - ### Countermeasure - Disable the **Domain controller: Refuse machine account password changes** setting. - ### Potential impact - None. This is the default configuration. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md b/windows/keep-secure/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md index 951b940928..b6ebe0166a 100644 --- a/windows/keep-secure/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md +++ b/windows/keep-secure/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md @@ -2,81 +2,46 @@ title: Domain member Digitally encrypt or sign secure channel data (always) (Windows 10) description: Describes the best practices, location, values, and security considerations for the Domain member Digitally encrypt or sign secure channel data (always) security policy setting. ms.assetid: 4480c7cb-adca-4f29-b4b8-06eb68d272bf +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Domain member: Digitally encrypt or sign secure channel data (always) - - **Applies to** - - Windows 10 - Describes the best practices, location, values, and security considerations for the **Domain member: Digitally encrypt or sign secure channel data (always)** security policy setting. - ## Reference - - This setting determines whether all secure channel traffic that is initiated by the domain member meets minimum security requirements. Specifically, it determines whether all secure channel traffic that is initiated by the domain member must be signed or encrypted. Logon information that is transmitted over the secure channel is always encrypted regardless of whether the encryption of all other secure channel traffic is negotiated. - The following policy settings determine whether a secure channel can be established with a domain controller that is not capable of signing or encrypting secure channel traffic: - - Domain member: Digitally encrypt or sign secure channel data (always) - - [Domain member: Digitally encrypt secure channel data (when possible)](domain-member-digitally-encrypt-secure-channel-data-when-possible.md) - - [Domain member: Digitally sign secure channel data (when possible)](domain-member-digitally-sign-secure-channel-data-when-possible.md) - Setting **Domain member: Digitally encrypt or sign secure channel data (always)** to **Enabled** prevents establishing a secure channel with any domain controller that cannot sign or encrypt all secure channel data. - To protect authentication traffic from man-in-the-middle, replay, and other types of network attacks, Windows-based computers create a communication channel through NetLogon called secure channels. These channels authenticate machine accounts. They also authenticate user accounts when a remote user connects to a network resource and the user account exists in a trusted domain. This is called pass-through authentication, and it allows a device running Windows othat has joined a domain to have access to the user account database in its domain and in any trusted domains. - To enable the **Domain member: Digitally encrypt or sign secure channel data (always)** policy setting on a member workstation or server, all domain controllers in the domain that the member belongs to must be capable of signing or encrypting all secure-channel data. - Enabling the **Domain member: Digitally encrypt or sign secure channel data (always)** policy setting automatically enables the [Domain member: Digitally sign secure channel data (when possible)](domain-member-digitally-sign-secure-channel-data-when-possible.md) policy setting. - When a device joins a domain, a machine account is created. After joining the domain, the device uses the password for that account to create a secure channel with the domain controller for its domain every time it restarts. This secure channel is used to perform operations such as NTLM pass-through authentication and LSA SID/name Lookup. Requests that are sent on the secure channel are authenticated—and sensitive information such as passwords are encrypted—but the integrity of the channel is not checked, and not all information is encrypted. If a system is set to always encrypt or sign secure channel data, a secure channel cannot be established with a domain controller that is not capable of signing or encrypting all secure channel traffic. If the computer is configured to encrypt or sign secure channel data when possible, a secure channel can be established, but the level of encryption and signing is negotiated. - ### Possible values - - Enabled - The policy [Domain member: Digitally sign secure channel data (when possible)](domain-member-digitally-sign-secure-channel-data-when-possible.md) is assumed to be enabled regardless of its current setting. This ensures that the domain member attempts to negotiate at least signing of the secure channel traffic. - - Disabled - The encryption and signing of all secure channel traffic is negotiated with the domain controller, in which case the level of signing and encryption depends on the version of the domain controller and the settings of the following policies: - 1. [Domain member: Digitally encrypt secure channel data (when possible)](domain-member-digitally-encrypt-secure-channel-data-when-possible.md) - 2. [Domain member: Digitally sign secure channel data (when possible)](domain-member-digitally-sign-secure-channel-data-when-possible.md) - - Not defined - ### Best practices - - Set **Domain member: Digitally encrypt or sign secure channel data (always)** to **Enabled**. - - Set [Domain member: Digitally encrypt secure channel data (when possible)](domain-member-digitally-encrypt-secure-channel-data-when-possible.md) to **Enabled**. - - Set [Domain member: Digitally sign secure channel data (when possible)](domain-member-digitally-sign-secure-channel-data-when-possible.md) to **Enabled**. - **Note**   You can enable the policy settings [Domain member: Digitally encrypt secure channel data (when possible)](domain-member-digitally-encrypt-secure-channel-data-when-possible.md) and [Domain member: Digitally sign secure channel data (when possible)](domain-member-digitally-sign-secure-channel-data-when-possible.md) on all devices in the domain that support these policy settings without affecting earlier-version clients and applications. -   - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -115,55 +80,25 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ### Group Policy - Distribution of this policy through Group Policy overrides the Local Security Policy setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - When a device joins a domain, a machine account is created. After it joins the domain, the device uses the password for that account to create a secure channel with the domain controller for its domain every time it restarts. Requests that are sent on the secure channel are authenticated—and sensitive information such as passwords are encrypted—but the channel is not integrity-checked, and not all information is encrypted. If a device is configured to always encrypt or sign secure channel data but the domain controller cannot sign or encrypt any portion of the secure channel data, the computer and domain controller cannot establish a secure channel. If the device is configured to encrypt or sign secure channel data, when possible, a secure channel can be established, but the level of encryption and signing is negotiated. - ### Countermeasure - Select one of the following settings as appropriate for your environment to configure the computers in your domain to encrypt or sign secure channel data. - - **Domain member: Digitally encrypt or sign secure channel data (always)** - - [Domain member: Digitally encrypt secure channel data (when possible)](domain-member-digitally-encrypt-secure-channel-data-when-possible.md) - - [Domain member: Digitally sign secure channel data (when possible)](domain-member-digitally-sign-secure-channel-data-when-possible.md) - ### Potential impact - Digital encryption and signing of the secure channel is a good idea because the secure channel protects domain credentials as they are sent to the domain controller. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/domain-member-digitally-encrypt-secure-channel-data-when-possible.md b/windows/keep-secure/domain-member-digitally-encrypt-secure-channel-data-when-possible.md index d27e70e4a0..693a34601d 100644 --- a/windows/keep-secure/domain-member-digitally-encrypt-secure-channel-data-when-possible.md +++ b/windows/keep-secure/domain-member-digitally-encrypt-secure-channel-data-when-possible.md @@ -2,73 +2,42 @@ title: Domain member Digitally encrypt secure channel data (when possible) (Windows 10) description: Describes the best practices, location, values, and security considerations for the Domain member Digitally encrypt secure channel data (when possible) security policy setting. ms.assetid: 73e6023e-0af3-4531-8238-82f0f0e4965b +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Domain member: Digitally encrypt secure channel data (when possible) - - **Applies to** - - Windows 10 - Describes the best practices, location, values, and security considerations for the **Domain member: Digitally encrypt secure channel data (when possible)** security policy setting. - ## Reference - - This setting determines whether all secure channel traffic that is initiated by the domain member meets minimum security requirements. Specifically, it determines whether all secure channel traffic that is initiated by the domain member must be encrypted. Logon information that is transmitted over the secure channel is always encrypted regardless of whether the encryption of all other secure channel traffic is negotiated. - In addition to this policy setting, the following policy settings determine whether a secure channel can be established with a domain controller that is not capable of signing or encrypting secure channel traffic: - - [Domain member: Digitally encrypt or sign secure channel data (always)](domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md) - - [Domain member: Digitally sign secure channel data (when possible)](domain-member-digitally-sign-secure-channel-data-when-possible.md) - Setting **Domain member: Digitally encrypt or sign secure channel data (always)** to **Enabled** prevents establishing a secure channel with any domain controller that cannot sign or encrypt all secure channel data. - To protect authentication traffic from man-in-the-middle, replay, and other types of network attacks, Windows-based computers create a communication channel through NetLogon called secure channels. These channels authenticate machine accounts. They also authenticate user accounts when a remote user connects to a network resource and the user account exists in a trusted domain. This is called pass-through authentication, and it allows a computer running the Windows operating system that has joined a domain to have access to the user account database in its domain and in any trusted domains. - Enabling the [Domain member: Digitally encrypt or sign secure channel data (always)](domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md) policy setting automatically enables the **Domain member: Digitally sign secure channel data (when possible)** policy setting. - When a device joins a domain, a machine account is created. After joining the domain, the device uses the password for that account to create a secure channel with the domain controller for its domain every time it restarts. This secure channel is used to perform operations such as NTLM pass through authentication and LSA SID/name Lookup. Requests that are sent on the secure channel are authenticated—and sensitive information such as passwords are encrypted—but the integrity of the channel is not checked, and not all information is encrypted. If a system is set to always encrypt or sign secure channel data, a secure channel cannot be established with a domain controller that is not capable of signing or encrypting all secure channel traffic. If the computer is configured to encrypt or sign secure channel data when possible, a secure channel can be established, but the level of encryption and signing is negotiated. - ### Possible values - - Enabled - The domain member will request encryption of all secure channel traffic. If the domain controller supports encryption of all secure channel traffic, then all secure channel traffic will be encrypted. Otherwise, only logon information that is transmitted over the secure channel will be encrypted. - - Disabled - The domain member will not attempt to negotiate secure channel encryption. - **Note**   If the security policy setting [Domain member: Digitally encrypt or sign secure channel data (always)](domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md) is enabled, this setting will be overwritten. -   - - Not defined - ### Best practices - - Set [Domain member: Digitally encrypt or sign secure channel data (always)](domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md) to **Enabled**. - - Set **Domain member: Digitally encrypt secure channel data (when possible)** to **Enabled**. - - Set [Domain member: Digitally sign secure channel data (when possible)](domain-member-digitally-sign-secure-channel-data-when-possible.md) to **Enabled**. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -107,55 +76,25 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ### Group Policy - Distribution of this policy through Group Policy does not override the Local Security Policy setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - When a device joins a domain, a machine account is created. After it joins the domain, the device uses the password for that account to create a secure channel with the domain controller for its domain every time it restarts. Requests that are sent on the secure channel are authenticated—and sensitive information such as passwords are encrypted—but the channel is not integrity-checked, and not all information is encrypted. If a device is configured to always encrypt or sign secure channel data but the domain controller cannot sign or encrypt any portion of the secure channel data, the computer and domain controller cannot establish a secure channel. If the computer is configured to encrypt or sign secure channel data when possible, a secure channel can be established, but the level of encryption and signing is negotiated. - ### Countermeasure - Select one of the following settings as appropriate for your environment to configure the computers in your domain to encrypt or sign secure channel data: - - [Domain member: Digitally encrypt or sign secure channel data (always)](domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md) - - **Domain member: Digitally encrypt secure channel data (when possible)** - - [Domain member: Digitally sign secure channel data (when possible)](domain-member-digitally-sign-secure-channel-data-when-possible.md) - ### Potential impact - Digital signing of the secure channel is a good idea because it protects domain credentials as they are sent to the domain controller. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/domain-member-digitally-sign-secure-channel-data-when-possible.md b/windows/keep-secure/domain-member-digitally-sign-secure-channel-data-when-possible.md index d3e4df1b1f..670f0b9024 100644 --- a/windows/keep-secure/domain-member-digitally-sign-secure-channel-data-when-possible.md +++ b/windows/keep-secure/domain-member-digitally-sign-secure-channel-data-when-possible.md @@ -2,75 +2,43 @@ title: Domain member Digitally sign secure channel data (when possible) (Windows 10) description: Describes the best practices, location, values, and security considerations for the Domain member Digitally sign secure channel data (when possible) security policy setting. ms.assetid: a643e491-4f45-40ea-b12c-4dbe47e54f34 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Domain member: Digitally sign secure channel data (when possible) - - **Applies to** - - Windows 10 - Describes the best practices, location, values, and security considerations for the **Domain member: Digitally sign secure channel data (when possible)** security policy setting. - ## Reference - - This setting determines whether all secure channel traffic that is initiated by the domain member meets minimum security requirements. Specifically, it determines whether all secure channel traffic that is initiated by the domain member must be signed. Logon information that is transmitted over the secure channel is always encrypted regardless of whether the encryption of all other secure channel traffic is negotiated. - The following policy settings determine whether a secure channel can be established with a domain controller that is not capable of signing or encrypting secure channel traffic: - - [Domain member: Digitally encrypt or sign secure channel data (always)](domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md) - - [Domain member: Digitally encrypt secure channel data (when possible)](domain-member-digitally-encrypt-secure-channel-data-when-possible.md) - - Domain member: Digitally sign secure channel data (when possible) - Setting [Domain member: Digitally encrypt or sign secure channel data (always)](domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md) to **Enabled** prevents establishing a secure channel with any domain controller that cannot sign or encrypt all secure channel data. - To protect authentication traffic from man-in-the-middle, replay, and other types of network attacks, Windows-based computers create a communication channel through NetLogon called secure channels. These channels authenticate computer accounts. They also authenticate user accounts when a remote user connects to a network resource and the user account exists in a trusted domain. This is called pass-through authentication, and it allows a computer running the Windows operating system that has joined a domain to have access to the user account database in its domain and in any trusted domains. - Enabling the [Domain member: Digitally encrypt or sign secure channel data (always)](domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md) policy setting automatically enables the **Domain member: Digitally sign secure channel data (when possible)** policy setting. - When a device joins a domain, a machine account is created. After joining the domain, the device uses the password for that account to create a secure channel with the domain controller for its domain every time it restarts. This secure channel is used to perform operations such as NTLM pass through authentication and LSA SID/name Lookup. Requests that are sent on the secure channel are authenticated—and sensitive information such as passwords are encrypted—but the integrity of the channel is not checked, and not all information is encrypted. If a system is set to always encrypt or sign secure channel data, a secure channel cannot be established with a domain controller that is not capable of signing or encrypting all secure channel traffic. If the computer is configured to encrypt or sign secure channel data when possible, a secure channel can be established, but the level of encryption and signing is negotiated. - ### Possible values - - Enabled - The domain member will request signing of all secure channel traffic. If the domain controller supports signing of all secure channel traffic, then all secure channel traffic will be signed which ensures that it cannot be tampered with in transit. - - Disabled - Signing will not be negotiated unless the policy [Domain member: Digitally encrypt or sign secure channel data (always)](domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md) is enabled. - - Not defined - ### Best practices - - Set [Domain member: Digitally encrypt or sign secure channel data (always)](domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md) to **Enabled**. - - Set [Domain member: Digitally encrypt secure channel data (when possible)](domain-member-digitally-encrypt-secure-channel-data-when-possible.md) to **Enabled**. - - Set **Domain member: Digitally sign secure channel data (when possible)** to **Enabled**. - **Note**   You can enable the other two policy settings, Domain member: [Domain member: Digitally encrypt secure channel data (when possible)](domain-member-digitally-encrypt-secure-channel-data-when-possible.md) and **Domain member: Digitally sign secure channel data (when possible)**, on all devices joined to the domain that support these policy settings without affecting earlier-version clients and applications. -   - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -109,55 +77,25 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ### Group Policy - Distribution of this policy through Group Policy does not override the Local Security Policy setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - When a device joins a domain, a machine account is created. After it joins the domain, the device uses the password for that account to create a secure channel with the domain controller for its domain every time it restarts. Requests that are sent on the secure channel are authenticated—and sensitive information such as passwords are encrypted—but the channel is not integrity-checked, and not all information is encrypted. If a device is configured to always encrypt or sign secure channel data but the domain controller cannot sign or encrypt any portion of the secure channel data, the computer and domain controller cannot establish a secure channel. If the computer is configured to encrypt or sign secure channel data when possible, a secure channel can be established, but the level of encryption and signing is negotiated. - ### Countermeasure - Because these policies are closely related and useful depending on your environment, select one of the following settings as appropriate to configure the devices in your domain to encrypt or sign secure channel data when possible. - - [Domain member: Digitally encrypt or sign secure channel data (always)](domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md) - - [Domain member: Digitally encrypt secure channel data (when possible)](domain-member-digitally-encrypt-secure-channel-data-when-possible.md) - - **Domain member: Digitally sign secure channel data (when possible)** - ### Potential impact - Digital signing of the secure channel is a good idea because the secure channel protects domain credentials as they are sent to the domain controller. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/domain-member-disable-machine-account-password-changes.md b/windows/keep-secure/domain-member-disable-machine-account-password-changes.md index e25f87d1fa..39fdae996b 100644 --- a/windows/keep-secure/domain-member-disable-machine-account-password-changes.md +++ b/windows/keep-secure/domain-member-disable-machine-account-password-changes.md @@ -2,50 +2,30 @@ title: Domain member Disable machine account password changes (Windows 10) description: Describes the best practices, location, values, and security considerations for the Domain member Disable machine account password changes security policy setting. ms.assetid: 1f660300-a07a-4243-a09f-140aa1ab8867 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Domain member: Disable machine account password changes - - **Applies to** - - Windows 10 - Describes the best practices, location, values, and security considerations for the **Domain member: Disable machine account password changes** security policy setting. - ## Reference - - The **Domain member: Disable machine account password changes** policy setting determines whether a domain member periodically changes its machine account password. Setting its value to **Enabled** prevents the domain member from changing the machine account password. Setting it to **Disabled** allows the domain member to change the machine account password as specified by the value of the [Domain member: Maximum machine account password age](domain-member-maximum-machine-account-password-age.md) policy setting, which is every 30 days by default. - By default, devices that belong to a domain are automatically required to change the passwords for their accounts every 30 days. Devices that are no longer able to automatically change their machine password are at risk of a malicious user determining the password for the system's domain account. - Verify that the **Domain member: Disable machine account password changes** option is set to **Disabled**. - ### Possible values - - Enabled - - Disabled - ### Best practices - 1. Do not enable this policy setting. Machine account passwords are used to establish secure channel communications between members and domain controllers and between the domain controllers within the domain. After it is established, the secure channel transmits sensitive information that is necessary for making authentication and authorization decisions. - 2. Do not use this policy setting in an attempt to support dual-boot scenarios that use the same machine account. If you want to dual-boot installations that are joined to the same domain, give the two installations different computer names. This policy setting was added to the Windows operating system to make it easier for organizations that stockpile pre-built computers that are put into production months later; those devices do not have to be rejoined to the domain. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -84,45 +64,20 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - By default, devices running Windows Server that belong to a domain automatically change their passwords for their accounts every certain number of days, typically 30. If you disable this policy setting, devices that run Windows Server retain the same passwords as their machine accounts. Devices that cannot automatically change their account password are at risk from an attacker who could determine the password for the machine's domain account. - ### Countermeasure - Verify that the **Domain member: Disable machine account password changes** setting is configured to **Disabled**. - ### Potential impact - None. This is the default configuration. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/domain-member-maximum-machine-account-password-age.md b/windows/keep-secure/domain-member-maximum-machine-account-password-age.md index 78a8d9b843..9deffaa2c2 100644 --- a/windows/keep-secure/domain-member-maximum-machine-account-password-age.md +++ b/windows/keep-secure/domain-member-maximum-machine-account-password-age.md @@ -2,48 +2,29 @@ title: Domain member Maximum machine account password age (Windows 10) description: Describes the best practices, location, values, and security considerations for the Domain member Maximum machine account password age security policy setting. ms.assetid: 0ec6f7c1-4d82-4339-94c0-debb2d1ac109 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Domain member: Maximum machine account password age - - **Applies to** - - Windows 10 - Describes the best practices, location, values, and security considerations for the **Domain member: Maximum machine account password age** security policy setting. - ## Reference - - The **Domain member: Maximum machine account password age** policy setting determines the maximum allowable age for a machine account password. - In Active Directory–based domains, each device has an account and password, just like every user. By default, the domain members automatically change their domain password every 30 days. Increasing this interval significantly, or setting it to **0** so that the device no longer change their passwords, gives a malicious user more time to undertake a brute-force password-guessing attack against one of the machine accounts. - ### Possible values - - User-defined number of days between 0 and 999 - - Not defined. - ### Best practices - 1. It is often advisable to set **Domain member: Maximum machine account password age** to about 30 days. - 2. Some organizations pre-build devices and then store them for later use or ship them to remote locations. If the machine's account has expired, it will no longer be able to authenticate with the domain. Devices that cannot authenticate with the domain must be removed from the domain and rejoined to it. For this reason, some organizations might want to create a special organizational unit (OU) for computers that are prebuilt, and configure the value for this policy setting to a larger number of days. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -82,45 +63,20 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - In Active Directory–based domains, each device has an account and password, just as every user does. By default, the domain members automatically change their domain password every 30 days. If you increase this interval significantly, or set it to 0 so that the computers no longer change their passwords, an attacker has more time to undertake a brute-force attack to guess the password of one or more computer accounts. - ### Countermeasure - Configure the **Domain member: Maximum machine account password age** setting to 30 days. - ### Potential impact - None. This is the default configuration. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/domain-member-require-strong-windows-2000-or-later-session-key.md b/windows/keep-secure/domain-member-require-strong-windows-2000-or-later-session-key.md index b230c318e1..2a95144b2d 100644 --- a/windows/keep-secure/domain-member-require-strong-windows-2000-or-later-session-key.md +++ b/windows/keep-secure/domain-member-require-strong-windows-2000-or-later-session-key.md @@ -2,52 +2,31 @@ title: Domain member Require strong (Windows 2000 or later) session key (Windows 10) description: Describes the best practices, location, values, and security considerations for the Domain member Require strong (Windows 2000 or later) session key security policy setting. ms.assetid: 5ab8993c-5086-4f09-bc88-1b27454526bd +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Domain member: Require strong (Windows 2000 or later) session key - - **Applies to** - - Windows 10 - Describes the best practices, location, values, and security considerations for the **Domain member: Require strong (Windows 2000 or later) session key** security policy setting. - ## Reference - - The **Domain member: Require strong (Windows 2000 or later) session key** policy setting determines whether a secure channel can be established with a domain controller that is not capable of encrypting secure channel traffic with a strong, 128-bit session key. Enabling this policy setting prevents establishing a secure channel with any domain controller that cannot encrypt secure channel data with a strong key. Disabling this policy setting allows 64-bit session keys. - Whenever possible, you should take advantage of these stronger session keys to help protect secure channel communications from eavesdropping and session-hijacking network attacks. Eavesdropping is a form of hacking in which network data is read or altered in transit. The data can be modified to hide or change the name of the sender, or it can be redirected. - ### Possible values - - Enabled - When enabled on a member workstation or server, all domain controllers in the domain that the member belongs to must be capable of encrypting secure channel data with a strong, 128-bit key. This means that all such domain controllers must be running at least Windows 2000 Server. - - Disabled - Allows 64-bit session keys to be used. - - Not defined. - ### Best practices - - It is advisable to set **Domain member: Require strong (Windows 2000 or later) session key** to Enabled. Enabling this policy setting ensures that all outgoing secure channel traffic will require a strong encryption key. Disabling this policy setting requires that key strength be negotiated. Only enable this option if the domain controllers in all trusted domains support strong keys. By default, this value is disabled. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -86,55 +65,25 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ### Group Policy - Misuse of this policy setting is a common error that can cause data loss or problems with data access or security. - You will you be able to join devices that do not support this policy setting to domains where the domain controllers have this policy setting enabled. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Session keys that are used to establish secure channel communications between domain controllers and member computers are much stronger starting with Windows 2000. - Whenever possible, you should take advantage of these stronger session keys to help protect secure channel communications from attacks that attempt to hijack network sessions and eavesdrop. (Eavesdropping is a form of hacking in which network data is read or altered in transit. The data can be modified to hide or change the sender, or be redirected.) - ### Countermeasure - Enable the **Domain member: Require strong (Windows 2000 or later) session key** setting. - If you enable this policy setting, all outgoing secure channel traffic requires a strong encryption key. If you disable this policy setting, the key strength is negotiated. You should enable this policy setting only if the domain controllers in all trusted domains support strong keys. By default, this policy setting is disabled. - ### Potential impact - Devices that do not support this policy setting cannot join domains in which the domain controllers have this policy setting enabled. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/edit-an-applocker-policy.md b/windows/keep-secure/edit-an-applocker-policy.md index b878d37679..725e1f5ac0 100644 --- a/windows/keep-secure/edit-an-applocker-policy.md +++ b/windows/keep-secure/edit-an-applocker-policy.md @@ -2,135 +2,70 @@ title: Edit an AppLocker policy (Windows 10) description: This topic for IT professionals describes the steps required to modify an AppLocker policy. ms.assetid: dbc72d1f-3fe0-46c2-aeeb-96621fce7637 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Edit an AppLocker policy - - **Applies to** - - Windows 10 - This topic for IT professionals describes the steps required to modify an AppLocker policy. - You can edit an AppLocker policy by adding, changing, or removing rules. However, you cannot create a new version of the policy by importing additional rules. To modify an AppLocker policy that is in production, you should use Group Policy management software that allows you to version Group Policy Objects (GPOs). If you have created multiple AppLocker policies and need to merge them to create one AppLocker policy, you can either manually merge the policies or use the Windows PowerShell cmdlets for AppLocker. You cannot automatically merge policies by using the AppLocker snap-in. You must create one rule collection from two or more policies. The AppLocker policy is saved in XML format, and the exported policy can be edited with any text or XML editor. For info about merging policies, see [Merge AppLocker policies manually](merge-applocker-policies-manually.md) or [Merge AppLocker policies by using Set-ApplockerPolicy](merge-applocker-policies-by-using-set-applockerpolicy.md). - There are two methods you can use to edit an AppLocker policy: - - [Editing an AppLocker policy by using Group Policy](#bkmk-editapppolingpo) - - [Editing an AppLocker policy by using the Local Security Policy snap-in](#bkmk-editapplolnotingpo) - ## Editing an AppLocker policy by using Group Policy - - The steps to edit an AppLocker policy distributed by Group Policy include the following: - ### Step 1: Use Group Policy management software to export the AppLocker policy from the GPO - AppLocker provides a feature to export and import AppLocker policies as an XML file. This allows you to modify an AppLocker policy outside your production environment. Because updating an AppLocker policy in a deployed GPO could have unintended consequences, you should first export the AppLocker policy to an XML file. For the procedure to do this, see [Export an AppLocker policy from a GPO](export-an-applocker-policy-from-a-gpo.md). - ### Step 2: Import the AppLocker policy into the AppLocker reference PC or the PC you use for policy maintenance - After exporting the AppLocker policy to an XML file, you should import the XML file onto a reference PC so that you can edit the policy. For the procedure to import an AppLocker policy, see [Import an AppLocker policy from another computer](import-an-applocker-policy-from-another-computer.md). - **Caution**   Importing a policy onto another PC will overwrite the existing policy on that PC. -   - ### Step 3: Use AppLocker to modify and test the rule - AppLocker provides ways to modify, delete, or add rules to a policy by modifying the rules within the collection. - - For the procedure to modify a rule, see [Edit AppLocker rules](edit-applocker-rules.md). - - For the procedure to delete a rule, see [Delete an AppLocker rule](delete-an-applocker-rule.md). - - For procedures to create rules, see: - - [Create a rule that uses a publisher condition](create-a-rule-that-uses-a-publisher-condition.md) - - [Create a rule that uses a path condition](create-a-rule-that-uses-a-path-condition.md) - - [Create a rule that uses a file hash condition](create-a-rule-that-uses-a-file-hash-condition.md) - - [Enable the DLL rule collection](enable-the-dll-rule-collection.md) - - For steps to test an AppLocker policy, see [Test and update an AppLocker policy](test-and-update-an-applocker-policy.md). - - For procedures to export the updated policy from the reference computer back into the GPO, see [Export an AppLocker policy to an XML file](export-an-applocker-policy-to-an-xml-file.md) and [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md). - ### Step 4: Use AppLocker and Group Policy to import the AppLocker policy back into the GPO - For procedures to export the updated policy from the reference computer back into the GPO, see [Export an AppLocker policy to an XML file](export-an-applocker-policy-to-an-xml-file.md) and [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md). - **Caution**   You should never edit an AppLocker rule collection while it is being enforced in Group Policy. Because AppLocker controls what files are allowed run, making changes to a live policy can create unexpected behavior. For info about testing policies, see [Test and update an AppLocker policy](test-and-update-an-applocker-policy.md). -   - **Note**   If you are performing these steps by using Microsoft Advanced Group Policy Management (AGPM), check out the GPO before exporting the policy. -   - ## Editing an AppLocker policy by using the Local Security Policy snap-in - - The steps to edit an AppLocker policy distributed by using the Local Security Policy snap-in (secpol.msc) include the following tasks. - ### Step 1: Import the AppLocker policy - On the PC where you maintain policies, open the AppLocker snap-in from the Local Security Policy snap-in (secpol.msc). If you exported the AppLocker policy from another PC, use AppLocker to import it onto the PC. - After exporting the AppLocker policy to an XML file, you should import the XML file onto a reference PC so that you can edit the policy. For the procedure to import an AppLocker policy, see [Import an AppLocker policy from another computer](import-an-applocker-policy-from-another-computer.md). - **Caution**   Importing a policy onto another PC will overwrite the existing policy on that PC. -   - ### Step 2: Identify and modify the rule to change, delete, or add - AppLocker provides ways to modify, delete, or add rules to a policy by modifying the rules within the collection. - - For the procedure to modify a rule, see [Edit AppLocker rules](edit-applocker-rules.md). - - For the procedure to delete a rule, see [Delete an AppLocker rule](delete-an-applocker-rule.md). - - For procedures to create rules, see: - - [Create a rule that uses a publisher condition](create-a-rule-that-uses-a-publisher-condition.md) - - [Create a rule that uses a path condition](create-a-rule-that-uses-a-path-condition.md) - - [Create a rule that uses a file hash condition](create-a-rule-that-uses-a-file-hash-condition.md) - - [Enable the DLL rule collection](enable-the-dll-rule-collection.md) - ### Step 3: Test the effect of the policy - For steps to test an AppLocker policy, see [Test and update an AppLocker policy](test-and-update-an-applocker-policy.md). - ### Step 4: Export the policy to an XML file and propagate it to all targeted computers - For procedures to export the updated policy from the reference computer to targeted computers, see [Export an AppLocker policy to an XML file](export-an-applocker-policy-to-an-xml-file.md) and [Import an AppLocker policy from another computer](import-an-applocker-policy-from-another-computer.md). - ## Additional resources - - - For steps to perform other AppLocker policy tasks, see [Administer AppLocker](administer-applocker.md). -   -   - - - - - diff --git a/windows/keep-secure/edit-applocker-rules.md b/windows/keep-secure/edit-applocker-rules.md index e5b8372c9d..69c9a61c3a 100644 --- a/windows/keep-secure/edit-applocker-rules.md +++ b/windows/keep-secure/edit-applocker-rules.md @@ -2,80 +2,42 @@ title: Edit AppLocker rules (Windows 10) description: This topic for IT professionals describes the steps to edit a publisher rule, path rule, and file hash rule in AppLocker. ms.assetid: 80016cda-b915-46a0-83c6-5e6b0b958e32 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Edit AppLocker rules - - **Applies to** - - Windows 10 - This topic for IT professionals describes the steps to edit a publisher rule, path rule, and file hash rule in AppLocker. - For more info about these rule types, see [Understanding AppLocker rule condition types](understanding-applocker-rule-condition-types.md). - You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). - **To edit a publisher rule** - 1. Open the AppLocker console, and then click the appropriate rule collection. - 2. In the **Action** pane, right-click the publisher rule, and then click **Properties**. - 3. Click the appropriate tab to edit the rule properties. - - Click the **General** tab to change the rule name, add a rule description, configure whether the rule is used to allow or deny applications, and set the security group for which this rule should apply. - - Click the **Publisher** tab to configure the certificate's common name, the product name, the file name, or file version of the publisher. - - Click the **Exceptions** tab to create or edit exceptions. - - When you finish updating the rule, click **OK**. - **To edit a file hash rule** - 1. Open the AppLocker console, and then click the appropriate rule collection. - 2. Choose the appropriate rule collection. - 3. In the **Action** pane, right-click the file hash rule, and then click **Properties**. - 4. Click the appropriate tab to edit the rule properties. - - Click the **General** tab to change the rule name, add a rule description, configure whether the rule is used to allow or deny applications, and set the security group in which this rule should apply. - - Click the **File Hash** tab to configure the files that should be used to enforce the rule. You can click **Browse Files** to add a specific file or click **Browse Folders** to add all files in a specified folder. To remove hashes individually, click **Remove**. - - When you finish updating the rule, click **OK**. - **To edit a path rule** - 1. Open the AppLocker console, and then click the appropriate rule collection. - 2. Choose the appropriate rule collection. - 3. In the **Action** pane, right-click the path rule, and then click **Properties**. - 4. Click the appropriate tab to edit the rule properties. - - Click the **General** tab to change the rule name, add a rule description, configure whether the rule is used to allow or deny applications, and set the security group in which this rule should apply. - - Click the **Path** tab to configure the path on the computer in which the rule should be enforced. - - Click the **Exceptions** tab to create exceptions for specific files in a folder. - - When you finish updating the rule, click **OK**. -   -   - - - - - diff --git a/windows/keep-secure/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md b/windows/keep-secure/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md index 34680d437c..af9eb0fbc6 100644 --- a/windows/keep-secure/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md +++ b/windows/keep-secure/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md @@ -2,52 +2,31 @@ title: Enable computer and user accounts to be trusted for delegation (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Enable computer and user accounts to be trusted for delegation security policy setting. ms.assetid: 524062d4-1595-41f3-8ce1-9c85fd21497b +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Enable computer and user accounts to be trusted for delegation - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Enable computer and user accounts to be trusted for delegation** security policy setting. - ## Reference - - This policy setting determines which users can set the **Trusted for Delegation** setting on a user or computer object. - Security account delegation provides the ability to connect to multiple servers, and each server change retains the authentication credentials of the original client. Delegation of authentication is a capability that client and server applications use when they have multiple tiers. It allows a public-facing service to use client credentials to authenticate to an application or database service. For this configuration to be possible, the client and the server must run under accounts that are trusted for delegation. - Only administrators who have the **Enable computer and user accounts to be trusted for delegation** credential can set up delegation. Domain admins and Enterprise admins have this credential. The procedure to allow a user to be trusted for delegation depends on the functionality level of the domain. - The user or machine object that is granted this right must have write access to the account control flags. A server process running on a device (or under a user context) that is trusted for delegation can access resources on another computer by using the delegated credentials of a client. However, the client account must have Write access to the account control flags on the object. - Constant: SeEnableDelegationPrivilege - ### Possible values - - User-defined list of accounts - - Not defined - ### Best practices - - There is no reason to assign this user right to anyone on member servers and workstations that belong to a domain because it has no meaning in those contexts. It is only relevant on domain controllers and stand-alone devices. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - @@ -86,68 +65,32 @@ The following table lists the actual and effective default policy values for the
-   - ## Policy management - - This section describes features, tools and guidance to help you manage this policy. - Modifying this setting might affect compatibility with clients, services, and applications. - A restart of the device is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - ### Group Policy - This user right is defined in the Default Domain Controller Group Policy Object (GPO) and in the local security policy of workstations and servers. - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Misuse of the **Enable computer and user accounts to be trusted for delegation** user right could allow unauthorized users to impersonate other users on the network. An attacker could exploit this privilege to gain access to network resources and make it difficult to determine what has happened after a security incident. - ### Countermeasure - The **Enable computer and user accounts to be trusted for delegation** user right should be assigned only if there is a clear need for its functionality. When you assign this right, you should investigate the use of constrained delegation to control what the delegated accounts can do. On domain controllers, this right is assigned to the Administrators group by default. - **Note**   There is no reason to assign this user right to anyone on member servers and workstations that belong to a domain because it has no meaning in those contexts. It is only relevant on domain controllers and stand-alone computers. -   - ### Potential impact - None. Not defined is the default configuration. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/enable-the-dll-rule-collection.md b/windows/keep-secure/enable-the-dll-rule-collection.md index 903c1b67bf..bf0a849440 100644 --- a/windows/keep-secure/enable-the-dll-rule-collection.md +++ b/windows/keep-secure/enable-the-dll-rule-collection.md @@ -2,43 +2,24 @@ title: Enable the DLL rule collection (Windows 10) description: This topic for IT professionals describes the steps to enable the DLL rule collection feature for AppLocker. ms.assetid: 88ef9561-6eb2-491a-803a-b8cdbfebae27 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Enable the DLL rule collection - - **Applies to** - - Windows 10 - This topic for IT professionals describes the steps to enable the DLL rule collection feature for AppLocker. - The DLL rule collection includes the .dll and .ocx file formats. - For info about these rules, see [DLL rules in AppLocker](dll-rules-in-applocker.md). - You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). - **To enable the DLL rule collection** - 1. From the AppLocker console, right-click **AppLocker**, and then click **Properties.** - 2. Click the **Advanced** tab, select the **Enable the DLL rule collection** check box, and then click **OK**. - **Important**   Before you enforce DLL rules, make sure that there are allow rules for each DLL that is used by any of the allowed apps. -   -   -   - - - - - diff --git a/windows/keep-secure/encrypted-hard-drive.md b/windows/keep-secure/encrypted-hard-drive.md index b283dc1b4c..a47495f67c 100644 --- a/windows/keep-secure/encrypted-hard-drive.md +++ b/windows/keep-secure/encrypted-hard-drive.md @@ -2,130 +2,66 @@ title: Encrypted Hard Drive (Windows 10) description: Encrypted Hard Drive uses the rapid encryption that is provided by BitLocker Drive Encryption to enhance data security and management. ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Encrypted Hard Drive - - **Applies to** - - Windows 10 - Encrypted Hard Drive uses the rapid encryption that is provided by BitLocker Drive Encryption to enhance data security and management. - By offloading the cryptographic operations to hardware, Encrypted Hard Drives increase BitLocker performance and reduce CPU usage and power consumption. Because Encrypted Hard Drives encrypt data quickly, enterprise devices can expand BitLocker deployment with minimal impact on productivity. - Encrypted Hard Drives are a new class of hard drives that are self-encrypting at a hardware level and allow for full disk hardware encryption. In Windows 8, Windows Server 2012, and later you can install to these devices without additional modification. - Some of the benefits of Encrypted Hard Drives include: - - **Better performance**: Encryption hardware, integrated into the drive controller, allows the drive to operate at full data rate with no performance degradation. - - **Strong security based in hardware**: Encryption is always "on" and the keys for encryption never leave the hard drive. User authentication is performed by the drive before it will unlock, independently of the operating system - - **Ease of use**: Encryption is transparent to the user because it is on by default. There is no user interaction needed to enable encryption. Encrypted Hard Drives are easily erased using on-board encryption key; there is no need to re-encrypt data on the drive. - - **Lower cost of ownership**: There is no need for new infrastructure to manage encryption keys, since BitLocker leverages your Active Directory Domain Services infrastructure to store recovery information. Your device operates more efficiently because processor cycles do not need to be used for the encryption process. - Encrypted Hard Drives are supported natively in the operating system through the following mechanisms: - - **Identification**: The operating system can identify that the drive is an Encrypted Hard Drive device type - - **Activation**: The operating system disk management utility can activate, create and map volumes to ranges/bands as appropriate - - **Configuration**: The operating system can create and map volumes to ranges/bands as appropriate - - **API**: API support for applications to manage Encrypted Hard Drives independently of BitLocker Drive Encryption (BDE) - - **BitLocker support**: Integration with the BitLocker Control Panel provides a seamless BitLocker end user experience. - **Warning**   Self-Encrypting Hard Drives and Encrypted Hard Drives for Windows are not the same type of device. Encrypted Hard Drives for Windows require compliance for specific TCG protocols as well as IEEE 1667 compliance; Self-Encrypting Hard Drives do not have these requirements. It is important to confirm the device type is an Encrypted Hard Drive for Windows when planning for deployment. -   - If you are a storage device vendor who is looking for more info on how to implement Encrypted Hard Drive, see the [Encrypted Hard Drive Device Guide](http://msdn.microsoft.com/library/windows/hardware/dn653989.aspx). - ## System Requirements - - To use Encrypted Hard Drive, the following system requirements apply: - For Encrypted Hard Drives used as **data drives**: - - The drive must be in an uninitialized state. - - The drive must be in a security inactive state. - For Encrypted Hard Drives used as **startup drives**: - - The drive must be in an uninitialized state. - - The drive must be in a security inactive state. - - The computer must be UEFI 2.3.1 based and have the EFI\_STORAGE\_SECURITY\_COMMAND\_PROTOCOL defined. (This protocol is used to allow programs running in the EFI boot services environment to send security protocol commands to the drive). - - The computer must have the Compatibility Support Module (CSM) disabled in UEFI. - - The computer must always boot natively from UEFI. - **Warning**   All Encrypted Hard Drives must be attached to non-RAID controllers to function properly. -   - ## Technical overview - - Rapid encryption in BitLocker directly addresses the security needs of enterprises while offering significantly improved performance. In versions of Windows earlier than Windows Server 2012, BitLocker required a two-step process to complete read/write requests. In Windows Server 2012, Windows 8, or later, Encrypted Hard Drives offload the cryptographic operations to the drive controller for much greater efficiency. When the operating system an Encrypted Hard Drive, it activates the security mode. This activation lets the drive controller generate a media key for every volume that the host computer creates. This media key, which is never exposed outside the disk, is used to rapidly encrypt or decrypt every byte of data that is sent or received from the disk. - ## Configuring Encrypted Hard Drives as Startup drives - - Configuration of Encrypted Hard Drives as startup drives is done using the same methods as standard hard drives. These methods include: - - **Deploy from media**: Configuration of Encrypted Hard Drives happens automatically through the installation process. - - **Deploy from network**: This deployment method involves booting a Windows PE environment and using imaging tools to apply a Windows image from a network share. Using this method, the Enhanced Storage optional component needs to be included in the Windows PE image. You can enable this component using Server Manager, Windows PowerShell, or the DISM command line tool. If this component is not present, configuration of Encrypted Hard Drives will not work. - - **Deploy from server**: This deployment method involves PXE booting a client with Encrypted Hard Drives present. Configuration of Encrypted Hard Drives happens automatically in this environment when the Enhanced Storage component is added to the PXE boot image. During deployment, the [TCGSecurityActivationDisabled](http://msdn.microsoft.com/library/windows/hardware/dn923247.aspx) setting in unattend.xml controls the encryption behavior of Encrypted Hard Drives. - - **Disk Duplication**: This deployment method involves use of a previously configured device and disk duplication tools to apply a Windows image to an Encrypted Hard Drive. Disks must be partitioned using at least Windows 8 or Windows Server 2012 for this configuration to work. Images made using disk duplicators will not work. - ### Encrypted Hard Drive Architecture - Encrypted Hard Drives utilize two encryption keys on the device to control the locking and unlocking of data on the drive. These are the Data Encryption Key (DEK) and the Authentication Key (AK). - The Data Encryption Key is the key used to encrypt all of the data on the drive. The drive generates the DEK and it never leaves the device. It is stored in an encrypted format at a random location on the drive. If the DEK is changed or erased, data encrypted using the DEK is irrecoverable. - The Authentication Key is the key used to unlock data on the drive. A hash of the key is stored on drive and requires confirmation to decrypt the DEK. - When a computer with an Encrypted Hard Drive is in a powered off state, the drive locks automatically. As a computer powers on, the device remains in a locked state and is only unlocked after the Authentication Key decrypts the Data Encryption Key. Once the Authentication Key decrypts the Data Encryption Key, read-write operations can take place on the device. - When writing data to the drive, it passes through an encryption engine before the write operation completes. Likewise, reading data from the drive requires the encryption engine to decrypt the data before passing that data back to the user. In the event that the DEK needs to be changed or erased, the data on the drive does not need to be re-encrypted. A new Authentication Key needs to be created and it will re-encrypt the DEK. Once completed, the DEK can now be unlocked using the new AK and read-writes to the volume can continue. - ## Re-configuring Encrypted Hard Drives - - Many Encrypted Hard Drive devices come pre-configured for use. If reconfiguration of the drive is required, use the following procedure after removing all available volumes and reverting the drive to an uninitialized state: - 1. Open Disk Management (diskmgmt.msc) - 2. Initialize the disk and select the appropriate partition style (MBR or GPT) - 3. Create one or more volumes on the disk. - 4. Use the BitLocker setup wizard to enable BitLocker on the volume. -   -   - - - - - diff --git a/windows/keep-secure/enforce-applocker-rules.md b/windows/keep-secure/enforce-applocker-rules.md index 0e2fcdd077..e71f69a725 100644 --- a/windows/keep-secure/enforce-applocker-rules.md +++ b/windows/keep-secure/enforce-applocker-rules.md @@ -2,39 +2,22 @@ title: Enforce AppLocker rules (Windows 10) description: This topic for IT professionals describes how to enforce application control rules by using AppLocker. ms.assetid: e1528b7b-77f2-4419-8e27-c9cc3721d96d +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Enforce AppLocker rules - - **Applies to** - - Windows 10 - This topic for IT professionals describes how to enforce application control rules by using AppLocker. - After AppLocker rules are created within the rule collection, you can configure the enforcement setting to **Enforce rules** or **Audit only** on the rule collection. - When AppLocker policy enforcement is set to **Enforce rules**, rules are enforced for the rule collection and all events are audited. When AppLocker policy enforcement is set to **Audit only**, rules are only evaluated but all events generated from that evaluation are written to the AppLocker log. - There is no audit mode for the DLL rule collection. DLL rules affect specific apps. Therefore, test the impact of these rules first before deploying them to production. - To enforce AppLocker rules by configuring an AppLocker policy to **Enforce rules**, see [Configure an AppLocker policy for enforce rules](configure-an-applocker-policy-for-enforce-rules.md). - **Caution**   AppLocker rules will be enforced immediately on the local device or when the Group Policy object (GPO) is updated by performing this procedure. If you want to see the effect of applying an AppLocker policy before setting the enforcement setting to **Enforce rules**, configure the policy to **Audit only**. For info about how to do this, see [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md)or [Test an AppLocker policy by Using Test-AppLockerPolicy](test-an-applocker-policy-by-using-test-applockerpolicy.md). -   -   -   - - - - - diff --git a/windows/keep-secure/enforce-password-history.md b/windows/keep-secure/enforce-password-history.md index 8a06a8f98b..aaf1fdefe7 100644 --- a/windows/keep-secure/enforce-password-history.md +++ b/windows/keep-secure/enforce-password-history.md @@ -2,52 +2,31 @@ title: Enforce password history (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Enforce password history security policy setting. ms.assetid: 8b2ab871-3e52-4dd1-9776-68bb1e935442 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Enforce password history - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Enforce password history** security policy setting. - ## Reference - - The **Enforce password history** policy setting determines the number of unique new passwords that must be associated with a user account before an old password can be reused. - Password reuse is an important concern in any organization. Many users want to reuse the same password for their account over a long period of time. The longer the same password is used for a particular account, the greater the chance that an attacker will be able to determine the password through brute force attacks. If users are required to change their password, but they can reuse an old password, the effectiveness of a good password policy is greatly reduced. - Specifying a low number for **Enforce password history** allows users to continually use the same small number of passwords repeatedly. If you do not also set [Minimum password age](minimum-password-age.md), users can change their password as many times in a row as necessary to reuse their original password. - ### Possible values - - User-specified number from 0 through 24 - - Not defined - ### Best practices - - Set **Enforce password history** to 24. This will help mitigate vulnerabilities that are caused by password reuse. - - Set [Maximum password age](maximum-password-age.md) to expire passwords between 60 and 90 days. Try to expire the passwords between major business cycles to prevent work loss. - - Configure [Minimum password age](minimum-password-age.md) so that you do not allow passwords to be changed immediately. - ### Location - **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy** - ### Default values - The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - @@ -86,54 +65,25 @@ The following table lists the actual and effective default policy values. Defaul
-   - ## Policy management - - This section describes features, tools, and guidance to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - The longer a user uses the same password, the greater the chance that an attacker can determine the password through brute force attacks. Also, any accounts that may have been compromised remain exploitable for as long as the password is left unchanged. If password changes are required but password reuse is not prevented, or if users continually reuse a small number of passwords, the effectiveness of a good password policy is greatly reduced. - If you specify a low number for this policy setting, users can use the same small number of passwords repeatedly. If you do not also configure the [Minimum password age](minimum-password-age.md) policy setting, users might repeatedly change their passwords until they can reuse their original password. - **Note**   After an account has been compromised, a simple password reset might not be enough to restrict a malicious user because the malicious user might have modified the user's environment so that the password is changed back to a known value automatically at a certain time. If an account has been compromised, it is best to delete the account and assign the user a new account after all affected systems have been restored to normal operations and verified that they are no longer compromised. -   - ### Countermeasure - Configure the **Enforce password history** policy setting to 24 (the maximum setting) to help minimize the number of vulnerabilities that are caused by password reuse. - For this policy setting to be effective, you should also configure effective values for the [Minimum password age](minimum-password-age.md) and [Maximum password age](maximum-password-age.md) policy settings. - ### Potential impact - The major impact of configuring the **Enforce password history** setting to 24 is that users must create a new password every time they are required to change their old one. If users are required to change their passwords to new unique values, there is an increased risk of users who write their passwords somewhere so that they do not forget them. Another risk is that users may create passwords that change incrementally (for example, password01, password02, and so on) to facilitate memorization, but this makes them easier for an attacker to guess. Also, an excessively low value for the [Maximum password age](maximum-password-age.md) policy setting is likely to increase administrative overhead because users who forget their passwords might ask the Help Desk to reset them frequently. - ## Related topics - - [Password Policy](password-policy.md) -   -   - - - - - diff --git a/windows/keep-secure/enforce-user-logon-restrictions.md b/windows/keep-secure/enforce-user-logon-restrictions.md index 18dd084c4c..ed3f79446b 100644 --- a/windows/keep-secure/enforce-user-logon-restrictions.md +++ b/windows/keep-secure/enforce-user-logon-restrictions.md @@ -2,48 +2,29 @@ title: Enforce user logon restrictions (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Enforce user logon restrictions security policy setting. ms.assetid: 5891cb73-f1ec-48b9-b703-39249e48a29f +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Enforce user logon restrictions - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Enforce user logon restrictions** security policy setting. - ## Reference - - The **Enforce user logon restrictions** policy setting determines whether the Kerberos V5 Key Distribution Center (KDC) validates every request for a session ticket against the user rights policy of the user account. Validating each request for a session ticket is optional because the extra step takes time, and that can slow network access to services. - The possible values for this Group Policy setting are: - - Enabled - - Disabled - - Not defined - ### Best practices - - If this policy setting is disabled, users might be granted session tickets for services that they do not have the right to use. - It is advisable to set **Enforce user logon restrictions** to Enabled. - ### Location - **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Kerberos Policy** - ### Default Values - The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - @@ -82,59 +63,27 @@ The following table lists the actual and effective default policy values. Defaul
-   - ## Policy management - - This section describes features, tools, and guidance to help you manage this policy. - A restart of the device is not required for this policy setting to be effective. - ### Group Policy - Client devices will get the new setting during the next scheduled and successful Group Policy refresh. But for domain controllers to assign these new settings immediately, a gpupdate.exe /force is required. On the local device, the Security Configuration Engine will refresh this setting in about five minutes. - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - If you disable this policy setting, users could receive session tickets for services that they no longer have the right to use because the right was removed after they logged on. - ### Countermeasure - Enable the **Enforce user logon restrictions** setting. - ### Potential impact - None. This is the default configuration. - ## Related topics - - [Kerberos Policy](kerberos-policy.md) -   -   - - - - - diff --git a/windows/keep-secure/executable-rules-in-applocker.md b/windows/keep-secure/executable-rules-in-applocker.md index 9bc04a00e9..b215d8ffe5 100644 --- a/windows/keep-secure/executable-rules-in-applocker.md +++ b/windows/keep-secure/executable-rules-in-applocker.md @@ -2,23 +2,17 @@ title: Executable rules in AppLocker (Windows 10) description: This topic describes the file formats and available default rules for the executable rule collection. ms.assetid: 65e62f90-6caa-48f8-836a-91f8ac9018ee +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Executable rules in AppLocker - - **Applies to** - - Windows 10 - This topic describes the file formats and available default rules for the executable rule collection. - AppLocker defines executable rules as any files with the .exe and .com extensions that are associated with an app. Because all of the default rules for the executable rule collection are based on folder paths, all files under those paths will be allowed. The following table lists the default rules that are available for the executable rule collection. - @@ -55,19 +49,8 @@ AppLocker defines executable rules as any files with the .exe and .com extension
-   - ## Related topics - - [Understanding AppLocker Default Rules](understanding-applocker-default-rules.md) -   -   - - - - - diff --git a/windows/keep-secure/export-an-applocker-policy-from-a-gpo.md b/windows/keep-secure/export-an-applocker-policy-from-a-gpo.md index 4d3bebaea0..565c1d0597 100644 --- a/windows/keep-secure/export-an-applocker-policy-from-a-gpo.md +++ b/windows/keep-secure/export-an-applocker-policy-from-a-gpo.md @@ -2,42 +2,23 @@ title: Export an AppLocker policy from a GPO (Windows 10) description: This topic for IT professionals describes the steps to export an AppLocker policy from a Group Policy Object (GPO) so that it can be modified. ms.assetid: 7db59719-a8be-418b-bbfd-22cf2176c9c0 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Export an AppLocker policy from a GPO - - **Applies to** - - Windows 10 - This topic for IT professionals describes the steps to export an AppLocker policy from a Group Policy Object (GPO) so that it can be modified. - Updating an AppLocker policy that is currently enforced in your production environment can have unintended results. Therefore, export the policy from the GPO and update the rule or rules by using AppLocker on your AppLocker reference device - To complete this procedure, you must have the **Edit Setting** permission to edit a GPO. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. - **Export the policy from the GPO** - 1. In the Group Policy Management Console (GPMC), open the GPO that you want to edit. - 2. In the console tree under **Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Application Control Policies**, click **AppLocker**. - 3. Right-click **AppLocker**, and then click **Export Policy**. - 4. In the **Export Policy** dialog box, type a name for the exported policy (for example, the name of the GPO), select a location to save the policy, and then click **Save**. - 5. The **AppLocker** dialog box will notify you of how many rules were exported. Click **OK**. -   -   - - - - - diff --git a/windows/keep-secure/export-an-applocker-policy-to-an-xml-file.md b/windows/keep-secure/export-an-applocker-policy-to-an-xml-file.md index db8273ad60..5812fda7ae 100644 --- a/windows/keep-secure/export-an-applocker-policy-to-an-xml-file.md +++ b/windows/keep-secure/export-an-applocker-policy-to-an-xml-file.md @@ -2,36 +2,20 @@ title: Export an AppLocker policy to an XML file (Windows 10) description: This topic for IT professionals describes the steps to export an AppLocker policy to an XML file for review or testing. ms.assetid: 979bd23f-6815-478b-a6a4-a25239cb1080 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Export an AppLocker policy to an XML file - - **Applies to** - - Windows 10 - This topic for IT professionals describes the steps to export an AppLocker policy to an XML file for review or testing. - Membership in the local **Administrators** group, or equivalent, is the minimum required to complete this procedure. - **To export an AppLocker policy to an XML file** - 1. From the AppLocker console, right-click **AppLocker**, and then click **Export Policy**. - 2. Browse to the location where you want to save the XML file. - 3. In the **File name** box, type a file name for the XML file, and then click **Save**. -   -   - - - - - diff --git a/windows/keep-secure/file-system-global-object-access-auditing.md b/windows/keep-secure/file-system-global-object-access-auditing.md index b9eaa059fb..8d1bf75dc2 100644 --- a/windows/keep-secure/file-system-global-object-access-auditing.md +++ b/windows/keep-secure/file-system-global-object-access-auditing.md @@ -2,37 +2,20 @@ title: File System (Global Object Access Auditing) (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, File System (Global Object Access Auditing), which enables you to configure a global system access control list (SACL) on the file system for an entire computer. ms.assetid: 4f215d61-0e23-46e4-9e58-08511105d25b +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # File System (Global Object Access Auditing) - - **Applies to** - - Windows 10 - This topic for the IT professional describes the Advanced Security Audit policy setting, **File System (Global Object Access Auditing)**, which enables you to configure a global system access control list (SACL) on the file system for an entire computer. - If you select the **Configure security** check box on the policy’s property page, you can add a user or group to the global SACL. This enables you to define computer system access control lists (SACLs) per object type for the file system. The specified SACL is then automatically applied to every file system object type. - If both a file or folder SACL and a global SACL are configured on a computer, the effective SACL is derived by combining the file or folder SACL and the global SACL. This means that an audit event is generated if an activity matches either the file or folder SACL or the global SACL. - This policy setting must be used in combination with the **File System** security policy setting under Object Access. For more information, see [Audit File System](audit-file-system.md). - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/force-shutdown-from-a-remote-system.md b/windows/keep-secure/force-shutdown-from-a-remote-system.md index 28d7bc97d6..4f4d1d9ed6 100644 --- a/windows/keep-secure/force-shutdown-from-a-remote-system.md +++ b/windows/keep-secure/force-shutdown-from-a-remote-system.md @@ -2,48 +2,29 @@ title: Force shutdown from a remote system (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Force shutdown from a remote system security policy setting. ms.assetid: 63129243-31ea-42a4-a598-c7064f48a3df +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Force shutdown from a remote system - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Force shutdown from a remote system** security policy setting. - ## Reference - - This security setting determines which users are allowed to shut down a device from a remote location on the network. This allows members of the Administrators group or specific users to manage computers (for tasks such as a restart) from a remote location. - Constant: SeRemoteShutdownPrivilege - ### Possible values - - User-defined list of accounts - - Administrators - ### Best practices - - Explicitly restrict this user right to members of the Administrators group or other specifically assigned roles that require this capability, such as non-administrative operations staff. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - By default this setting is Administrators and Server Operators on domain controllers and Administrators on stand-alone servers. - The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - @@ -84,63 +65,29 @@ The following table lists the actual and effective default policy values for the
-   - ## Policy management - - This section describes features, tools, and guidance to help you manage this policy. - A restart of the computer is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - This policy setting must be applied on the computer that is being accessed remotely. - ### Group Policy - This user right is defined in the Default Domain Controller Group Policy Object (GPO) and in the local security policy of workstations and servers. - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Any user who can shut down a device could cause a denial-of-service condition to occur. Therefore, this user right should be tightly restricted. - ### Countermeasure - Restrict the **Force shutdown from a remote system** user right to members of the Administrators group or other specifically assigned roles that require this capability, such as non-administrative operations staff. - ### Potential impact - On a domain controller, if you remove the **Force shutdown from a remote system** user right from the Server Operator group, you could limit the abilities of users who are assigned to specific administrative roles in your environment. You should confirm that delegated activities are not adversely affected. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/generate-security-audits.md b/windows/keep-secure/generate-security-audits.md index db7aaf05aa..71e55bf774 100644 --- a/windows/keep-secure/generate-security-audits.md +++ b/windows/keep-secure/generate-security-audits.md @@ -2,50 +2,30 @@ title: Generate security audits (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Generate security audits security policy setting. ms.assetid: c0e1cd80-840e-4c74-917c-5c2349de885f +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Generate security audits - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Generate security audits** security policy setting. - ## Reference - - This policy setting determines which accounts can be used by a process to generate audit records in the security event log. The Local Security Authority Subsystem Service (LSASS) writes events to the log. You can use the information in the security event log to trace unauthorized device access. - Constant: SeAuditPrivilege - ### Possible values - - User-defined list of accounts - - Local Service - - Network Service - ### Best practices - - Because the audit log can potentially be an attack vector if an account is compromised, ensure that only the Local Service and Network Service accounts have the **Generate security audits** user right assigned to them. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - By default, this setting is Local Service and Network Service on domain controllers and stand-alone servers. - The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - @@ -89,61 +69,28 @@ The following table lists the actual and effective default policy values for the
-   - ## Policy management - - This section describes features, tools, and guidance to help you manage this policy. - A restart of the computer is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - Misuse of this user right can result in the generation of many auditing events, potentially hiding evidence of an attack or causing a denial-of-service (DoS) if the [Audit: Shut down system immediately if unable to log security audits](audit-shut-down-system-immediately-if-unable-to-log-security-audits.md) security policy setting is enabled. - ### Group Policy - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - A malicious user could use accounts that can write to the Security log to fill that log with meaningless events. If the computer is configured to overwrite events as needed, malicious users could use this method to remove evidence of their unauthorized activities. If the computer is configured to shut down when it is unable to write to the Security log, and it is not configured to automatically back up the log files, this method could be used to create a DoS condition. - ### Countermeasure - Ensure that only the Local Service and Network Service accounts have the **Generate security audits** user right assigned to them. - ### Potential impact - None. Restricting the **Generate security audits** user right to the Local Service and Network Service accounts is the default configuration. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/get-started-with-windows-defender-for-windows-10.md b/windows/keep-secure/get-started-with-windows-defender-for-windows-10.md index 90a0b0d76a..228813557c 100644 --- a/windows/keep-secure/get-started-with-windows-defender-for-windows-10.md +++ b/windows/keep-secure/get-started-with-windows-defender-for-windows-10.md @@ -2,231 +2,132 @@ title: Update and manage Windows Defender in Windows 10 (Windows 10) description: IT professionals can manage Windows Defender on Windows 10 endpoints in their organization using Microsoft Active Directory or Windows Server Update Services (WSUS), apply updates to endpoints, and manage scans using Group Policy SettingsWindows Management Instrumentation (WMI)PowerShell. ms.assetid: 045F5BF2-87D7-4522-97E1-C1D508E063A7 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library author: jasesso --- - # Update and manage Windows Defender in Windows 10 - - **Applies to** - - Windows 10 - IT professionals can manage Windows Defender on Windows 10 endpoints in their organization using Microsoft Active Directory or Windows Server Update Services (WSUS), apply updates to endpoints, and manage scans using: - - Group Policy Settings - Windows Management Instrumentation (WMI) - PowerShell - ## Manage Windows Defender endpoints through Active Directory and WSUS - - All Windows 10 endpoints are installed with Windows Defender and include support for management through: - - Active Directory - WSUS - You can use the Active Directory to configure the settings; Group policies can be used for centralized configuration and enforcement of many Windows Defender settings including client user interface, scan settings, and exclusions. - WSUS can be used to view basic update compliance and deploy updates manually or through automatic rules. - Note that System Center 2012 R2 Configuration Manager SP1, System Center 2012 Configuration Manager SP2, and Microsoft Intune can provide centralized management of Windows Defender, including: - - Settings management - Definition update management - Alerts and alert management - Reports and reporting - When you enable *Endpoint Protection* on your clients, it will install an additional management layer on Windows Defender to manage the in-box Windows Defender agent. While the client user interface will still appear as Windows Defender, the management layer for System Center Endpoint Protection or Intune will be listed in the **Add/Remove Programs** control panel, though it will appear as if the full product is installed. Learn more about managing *Endpoint Protection*: - [Help secure Windows PCs with Endpoint Protection for Microsoft Intune](https://technet.microsoft.com/library/dn646970.aspx) - [Endpoint Protection in Configuration Manager](https://technet.microsoft.com/library/hh508760.aspx) - Read more about System Center Configuration Manager in [Introduction to Endpoint Protection in Configuration Manager](https://technet.microsoft.com/library/hh508781.aspx). - **Important**  You must be licensed to use *Endpoint Protection* to manage clients in your Configuration Manager hierarchy. -   - ## Apply updates to Windows Defender endpoints - - It is important to keep Windows Defender endpoints updated to ensure they are protected. All Windows Defender updates, including General Distribution Release (GDR) updates, are now applied as operating system updates. - You can manage the distribution of updates through the [Windows Server Update Services (WSUS)](https://technet.microsoft.com/windowsserver/bb332157). - ## Manage email scans in Windows Defender - - You can use Windows Defender to scan email files. Malware can install itself and hide in email files, and although real-time protection offers you the best protection from email malware, you can also scan emails stored on your PC or server with Windows Defender. - **Important**  Mail scanning only applies to on-demand and scheduled scans, not on-access scans. -   - Windows Defender scans Microsoft Office Outlook 2003 and older email files. We identify the file type at run-time based on the content of the file, not on location or extension. - **Note**  Scanning email files might increase the time required to complete a scan. -   - Windows Defender can extract embedded objects within a file (attachments and archived files, for example) and scan internally. - **Note**  While Windows Defender can be configured to scan email files, it can only remediate threats detected inside certain files, for example: - DBX - MBX - MIME -   - You can configure Windows Defender to scan PST files used by Outlook 2003 or older versions (where the archive type is set to non-uni-code), but Windows Defender cannot remediate threats detected inside PST files. We recommend using real-time protection to protect against email malware. - If Windows Defender detects a threat inside an email, it will show you the following information to assist you in identifying the compromised email, so you can remediate the threat: - - Email subject - Attachment name - Email scanning in Windows Defender is turned off by default. There are three ways you can manage scans through Windows Defender: - - *Group Policy* settings - WMI - PowerShell - **Important**  There are some risks associated with scanning some Microsoft Outlook files and email messages. You can read about tips and risks associated with scanning Outlook files and email messages in the following articles: - [Scanning Outlook files in Outlook 2013](https://technet.microsoft.com/library/dn769141.aspx#bkmk-1) - [Scanning email messages in Outlook 2013](https://technet.microsoft.com/library/dn769141.aspx#bkmk-2) -   - ## Use *Group Policy* settings to enable email scans - - This policy setting allows you to turn on email scanning. When email scanning is enabled, the engine will parse the mailbox and mail files to analyze the mail bodies and attachments. - Turn on email scanning with the following *Group Policy* settings: - 1. Open the **Group Policy Editor**. 2. In the **Local Computer Policy** tree, expand **Computer Configuration**, then **Administrative Templates**, then **Windows Components**, then **Windows Defender**. 3. Click **Scan**. 4. Double-click **Turn on e-mail scanning**. - This will open the **Turn on e-mail scanning** window: ![turn on e-mail scanning window](images/defender-scanemailfiles.png) - 5. Select **Enabled**. 6. Click **OK** to apply changes. - ## Use WMI to disable email scans - - You can write a WMI script or application to disable email scanning. Read more about [WMI in this article](https://msdn.microsoft.com/library/windows/desktop/dn439477.aspx), and read about [Windows Preference classes in this article](https://msdn.microsoft.com/library/windows/desktop/dn455323.aspx). - Use the **DisableEmailScanning** property of the **MSFT\_MpPreference** class (part of the Windows DefenderWMI provider) to enable or disable this setting: - **DisableEmailScanning** Data type: **boolean** Access type: Read-only Disable email scanning. ## Use PowerShell to enable email scans - - You can also enable email scanning using the following PowerShell parameter: - 1. Open PowerShell or PowerShellIntegrated Scripting Environment (ISE). 2. Type **Set-MpPreference -DisableEmailScanning $false**. - Read more about this in: - - • [Scripting with Windows PowerShell](https://technet.microsoft.com/library/bb978526.aspx) - • [Defender Cmdlets](https://technet.microsoft.com/library/dn433280.aspx) - ## Manage archive scans in Windows Defender - - You can use Windows Defender to scan archive files. Malware can install itself and hide in archive files, and although real-time protection offers you the best protection from malware, you can also scan archives stored on your PC or server with Windows Defender. - **Important**  Archive scanning only applies to on-demand and scheduled scans, not on-access scans. -   - Archive scanning in Windows Defender is turned on by default. There are four ways you can manage scans through Windows Defender: - - *Group Policy* settings - WMI - PowerShell - Endpoint Protection - **Note**  Scanning archive files might increase the time required to complete a scan. -   - If you exclude an archive file type by using the **Extensions** box, Windows Defender will not scan files with that extension (no matter what the content is), even when you have selected the **Scan archive files** check box. For example, if you exclude .rar files but there’s a .r00 file that’s actually .rar content, it will still be scanned if archive scanning is enabled. - ## Use *Group Policy* settings to enable archive scans - - This policy setting allows you to turn on archive scanning. - Turn on email scanning with the following *Group Policy* settings: - 1. Open the **Group Policy Editor**. 2. In the **Local Computer Policy** tree, expand **Computer Configuration**, then **Administrative Templates**, then **Windows Components**, then **Windows Defender**. 3. Click **Scan**. 4. Double-click **Scan archive files**. - This will open the **Scan archive files** window: ![scan archive files window](images/defender-scanarchivefiles.png) - 5. Select **Enabled**. 6. Click **OK** to apply changes. - There are a number of archive scan settings in the **Scan** repository you can configure through *Group Policy*, for example: - - Maximum directory depth level into which archive files are unpacked during scanning ![specify the maximum depth to scan archive files window](images/defender-scanarchivedepth.png) - Maximum size of archive files that will be scanned ![specify the maximum size of archive files to be scanned window](images/defender-scanarchivesize.png) - Maximum percentage CPU utilization permitted during a scan ![specify the maximum percentage od cpu utilization during a scan window](images/defender-scanarchivecpu.png) - ## Use WMI to disable archive scans - - You can write a WMI script or application to disable archive scanning. Read more about [WMI in this article](https://msdn.microsoft.com/library/windows/desktop/dn439477.aspx), and read about [Windows Preference classes in this article](https://msdn.microsoft.com/library/windows/desktop/dn455323.aspx). - Use the **DisableArchiveScanning** property of the **MSFT\_MpPreference** class (part of the Windows DefenderWMI provider) to enable or disable this setting: - **DisableArchiveScanning** Data type: **boolean** Access type: Read-only Disable archive scanning. ## Use PowerShell to enable archive scans - - You can also enable archive scanning using the following PowerShell parameter: - 1. Open PowerShell or PowerShellISE. 2. Type **Set-MpPreference -DisableArchiveScanning $false**. - Read more about this in: - - • [Scripting with Windows PowerShell](https://technet.microsoft.com/library/bb978526.aspx) - • [Defender Cmdlets](https://technet.microsoft.com/library/dn433280.aspx) - ## Use Endpoint Protection to configure archive scans - - In Endpoint Protection, you can use the advanced scanning options to configure archive scanning. For more information, see [What are advanced scanning options?](https://technet.microsoft.com/library/ff823807.aspx) - ## Related topics - - [Configure Windows Defender in Windows 10](configure-windows-defender-in-windows-10.md) - [Troubleshoot Windows Defender in Windows 10](troubleshoot-windows-defender-in-windows-10.md) -   -   - - - - - diff --git a/windows/keep-secure/getting-apps-to-run-on-device-guard-protected-devices.md b/windows/keep-secure/getting-apps-to-run-on-device-guard-protected-devices.md index 2780dd8b05..3c60db513e 100644 --- a/windows/keep-secure/getting-apps-to-run-on-device-guard-protected-devices.md +++ b/windows/keep-secure/getting-apps-to-run-on-device-guard-protected-devices.md @@ -2,69 +2,43 @@ title: Get apps to run on Device Guard-protected devices (Windows 10) description: Windows 10 introduces several new features and settings that when combined all equal what we're calling, Device Guard. ms.assetid: E62B68C3-8B9F-4842-90FC-B4EE9FF8A67E +ms.pagetype: security keywords: ["Package Inspector", "packageinspector.exe", "sign catalog file"] ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Get apps to run on Device Guard-protected devices - - **Applies to** - - Windows 10 - Windows 10 introduces several new features and settings that when combined all equal what we're calling, Device Guard. Device Guard can help to protect your enterprise devices against the accidental running of malicious apps by requiring all of your apps to be signed by a trusted entity. - To use Device Guard in an enterprise, you must be able to get your existing line-of-business and Independent Software Vendor (ISV)-developed apps to run on a protected device. Unfortunately, many line-of-business apps aren't signed, and in many cases, aren't even being actively developed. Similarly, you may have unsigned software from an ISV that you want to run, or you want to run certain applications from an ISV while not trusting all applications from that ISV. As part of the Device Guard features, Windows 10 includes a new tool called Package Inspector. Package Inspector scans your unsigned apps, and creates catalog files of the installed and running binaries, which can then be signed by the Sign Tool Windows SDK utility and distributed using Group Policy so that your apps will run on Device Guard-protected devices. - ## What you need to run your apps on Device-Guard protected devices - - Before you can get your apps to run on Device Guard-protected devices, you must have: - - A device running Windows 10 Enterprise, Windows 10 Education, or Windows Server 2016 Technical Preview. - - Determined which unsigned apps you need to include in your catalog file. - - Created a code integrity policy for use by Device Guard. - - A [code signing certificate](http://go.microsoft.com/fwlink/p/?LinkId=619282), created using an internal public key infrastructure (PKI). - - [SignTool]( http://go.microsoft.com/fwlink/p/?LinkId=619283). A command-line tool that digitally signs files, verifies signatures in files, or time stamps files. The tool is installed in the \\Bin folder of the Microsoft Windows Software Development Kit (SDK) installation path. - ## Create a catalog file for unsigned apps - - You must run Package Inspector on a device that's running a temporary Code Integrity Policy in audit mode, created explicitly for this purpose. Audit mode lets this policy catch any binaries missed by the inspection tool, but because it's audit mode, allows everything to continue running. - **Important**  This temporary policy, shouldn't be used for normal business purposes. -   - **To create a catalog file for an existing app** - 1. Start PowerShell as an administrator, and create your temporary policy file by typing: - ``` syntax mkdir temp New-CIPolicy -l FileName -f .\tempdeny.xml -s .\temp -u ConvertFrom-CIPolicy .\tempdeny.xml .\tempdeny.bin cp .\tempdeny.bin C:\Windows\System32\CodeIntegrity\SIPolicy.p7b ``` - 2. Restart your device. - 3. Start PowerShell as an administrator, and start scanning your file system by typing: - ``` syntax PackageInspector.exe start c: ``` - Where: - @@ -87,41 +61,26 @@ You must run Package Inspector on a device that's running a temporary Code Integ
-   - 4. Copy the app installation media to your C:\\ drive, and then install and run the program. - Copying the media to your local drive helps to make sure that the installer and its related files are included in your catalog file. If you miss the install files, your Code Integrity Policy might trust the app to run, but not to install. After you've installed the app, you should check for updates. If updates happen while the app is open, you should close and restart the app to make sure everything is caught during the inspection process. - **Note**   Because the Package Inspector creates a log entry in the catalog for every binary laid down on the file system, we recommend that you don't run any other installations or updates during the scanning process. -   - 5. **Optional:** If you want to create a multi-app catalog (many apps included in a single catalog file), you can continue to run Steps 2-3 for each additional app. After you've added all of the apps you want to add, you can continue to Step 5. - **Note**  To streamline your process, we suggest: - **Actively supported and updated apps.** Create a single catalog file for each app. - - **Legacy apps, non-active or not updated.** Create a single catalog file for all of your legacy apps. -   - 6. Stop the scanning process and create the .\\InspectedPackage.cat and InspectedPackage.cdf files for your single app in your specified location, by typing: - ``` syntax PackageInspector.exe stop c: ``` - You can also use the `scan` command in place of using both `start` and `stop` if you want to create a catalog of files that are already present on your hard drive. The `scan` command recursively scans a specified directory and includes all signable files in the catalog. You can scan a specified directory by typing: - ``` syntax PackageInspector.exe scan c:\ ``` - The following table shows the available options for both the `scan` and `stop` commands. - @@ -181,42 +140,25 @@ The following table shows the available options for both the `scan` and `stop` c
-   - You can add additional parameters to your catalog beyond what's listed here. For more info, see the [MakeCat](http://go.microsoft.com/fwlink/p/?LinkId=618024) topic. - ## Sign your catalog file using Sign Tool - - You can sign your catalog file using Sign Tool, located in the Windows 7 or later Windows Software Development Kit (SDK) or by using the Device Guard signing portal. For details on using the Device Guard signing portal, see [Device Guard signing](http://go.microsoft.com/fwlink/p/?LinkID=698760). - This process shows how to use a password-protected Personal Information Exchange (.pfx) file to sign the catalog file. - **Important**  To use this tool, you must have an internal certificate authority code signing certificate, or a code signing certificate issued by an external third-party certificate authority. -   - **To use Sign Tool** - 1. Check that your code signing certificates have been imported into your certificate store or that they're on the file system. - 2. Open SignTool.exe and sign the catalog file, based on where your certificate is stored. - If you are using the PFX from a file system location: - ``` syntax signtool sign /f <\\SignCertLocation> /p <\\password> /fd sha256 /v ``` - If you have imported the certificate into your cert store: - ``` syntax signtool sign /n <\\CertSubjectName> /fd sha256 /v ``` - Where: - @@ -260,44 +202,25 @@ This process shows how to use a password-protected Personal Information Exchange
-   - For more detailed info and examples using the available options, see the [SignTool.exe (Sign Tool)](http://go.microsoft.com/fwlink/p/?LinkId=618026) topic. - 3. In File Explorer, right-click your catalog file, click **Properties**, and then click the **Digital Signatures** tab to make sure your catalog file's digital signature is accurate. - 4. Copy your catalog file to C:\\Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE} and test the file. - **Note**  For testing purposes, you can manually copy your file to this location. However, we recommend that you use Group Policy to copy the catalog file to all of your devices for large-scale implementations. -   - ## Troubleshooting the Package Inspector - - If you see "Error 1181" while stopping the Package Inspector, you'll need to increase your USN journal size and then clear all of the cached data before re-scanning the impacted apps. - You must make sure that you clear the cache by creating and setting a new temporary policy. If you reuse the same policy, the Package Inspector will fail. - **To increase your journal size** - 1. Open a command-prompt window, and then type: - ``` syntax fsutil usn createjournal m=0x8000000 a=0x800000 C: ``` - Where the "m" value needs to be increased. We recommend that you change the value to at least 4 times the default value of m=0x2000000. - 2. Re-run the failed app installation(s). - **To clear your cached data and re-scan your apps** - 1. Delete the SIPolicy.p7b file from the C:\\Windows\\System32\\CodeIntegrity\\ folder. - 2. Create a new temporary Code Integrity Policy to clear all of the cached data by starting Windows Powershell as an administrator and typing: - ``` syntax mkdir temp cp C:\Windows\System32\PackageInspector.exe .\temp\ @@ -305,19 +228,8 @@ You must make sure that you clear the cache by creating and setting a new tempor ConvertFrom-CIPolicy .\DenyPackageInspector.xml .\DenyPackageInspector.bin cp .\DenyPackageInspector.bin C:\Windows\System32\SIPolicy.p7b ``` - 3. Restart your device and follow the steps in the [Create a catalog file for unsigned apps](#create-a-catalog-file-for-unsigned-apps) section. - ## Related topics - - [Download SignTool]( http://go.microsoft.com/fwlink/p/?LinkId=619283) -   -   - - - - - diff --git a/windows/keep-secure/how-applocker-works-techref.md b/windows/keep-secure/how-applocker-works-techref.md index 344c66263f..c482e1a4bc 100644 --- a/windows/keep-secure/how-applocker-works-techref.md +++ b/windows/keep-secure/how-applocker-works-techref.md @@ -2,71 +2,37 @@ title: How AppLocker works (Windows 10) description: This topic for the IT professional provides links to topics about AppLocker architecture and components, processes and interactions, rules and policies. ms.assetid: 24bb1d73-0ff5-4af7-8b8a-2fa44d4ddbcd +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # How AppLocker works - - **Applies to** - - Windows 10 - This topic for the IT professional provides links to topics about AppLocker architecture and components, processes and interactions, rules and policies. - The following topics explain how AppLocker policies for each of the rule condition types are evaluated: - - [AppLocker architecture and components](applocker-architecture-and-components.md) - - [AppLocker processes and interactions](applocker-processes-and-interactions.md) - The following topics explain how AppLocker rules and policies work: - - [Understanding AppLocker rule behavior](understanding-applocker-rule-behavior.md) - - [Understanding AppLocker rule exceptions](understanding-applocker-rule-exceptions.md) - - [Understanding AppLocker rule collections](understanding-applocker-rule-collections.md) - - [Understanding AppLocker allow and deny actions on rules](understanding-applocker-allow-and-deny-actions-on-rules.md) - - [Understanding AppLocker rule condition types](understanding-applocker-rule-condition-types.md) - - [Understanding the publisher rule condition in AppLocker](understanding-the-publisher-rule-condition-in-applocker.md) - - [Understanding the path rule condition in AppLocker](understanding-the-path-rule-condition-in-applocker.md) - - [Understanding the file hash rule condition in AppLocker](understanding-the-file-hash-rule-condition-in-applocker.md) - - [Understanding AppLocker default rules](understanding-applocker-default-rules.md) - - [Executable rules in AppLocker](executable-rules-in-applocker.md) - - [Windows Installer rules in AppLocker](windows-installer-rules-in-applocker.md) - - [Script rules in AppLocker](script-rules-in-applocker.md) - - [DLL rules in AppLocker](dll-rules-in-applocker.md) - - [Packaged apps and packaged app installer rules in AppLocker](packaged-apps-and-packaged-app-installer-rules-in-applocker.md) - ## Additional resources - - - [AppLocker Design Guide](applocker-policies-design-guide.md) - - [AppLocker deployment guide](applocker-policies-deployment-guide.md) - - [Administer AppLocker](administer-applocker.md) -   -   - - - - - diff --git a/windows/keep-secure/how-to-configure-security-policy-settings.md b/windows/keep-secure/how-to-configure-security-policy-settings.md index 43a7e1c656..9ba376ff63 100644 --- a/windows/keep-secure/how-to-configure-security-policy-settings.md +++ b/windows/keep-secure/how-to-configure-security-policy-settings.md @@ -2,114 +2,59 @@ title: Configure security policy settings (Windows 10) description: Describes steps to configure a security policy setting on the local device, on a domain-joined device, and on a domain controller. ms.assetid: 63b0967b-a9fe-4d92-90af-67469ee20320 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Configure security policy settings - - **Applies to** - - Windows 10 - Describes steps to configure a security policy setting on the local device, on a domain-joined device, and on a domain controller. - You must have Administrators rights on the local device, or you must have the appropriate permissions to update a Group Policy Object (GPO) on the domain controller to perform these procedures. - When a local setting is inaccessible, it indicates that a GPO currently controls that setting. - ## To configure a setting using the Local Security Policy console - - 1. To open Local Security Policy, on the **Start** screen, type **secpol.msc**, and then press ENTER. - 2. Under **Security Settings** of the console tree, do one of the following: - - Click **Account Policies** to edit the **Password Policy** or **Account Lockout Policy**. - - Click **Local Policies** to edit an **Audit Policy**, a **User Rights Assignment**, or **Security Options**. - 3. When you find the policy setting in the details pane, double-click the security policy that you want to modify. - 4. Modify the security policy setting, and then click **OK**. - **Note**   - Some security policy settings require that the device be restarted before the setting takes effect. - - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. -   - ## To configure a security policy setting using the Local Group Policy Editor console - - You must have the appropriate permissions to install and use the Microsoft Management Console (MMC), and to update a Group Policy Object (GPO) on the domain controller to perform these procedures. - 1. Open the Local Group Policy Editor (gpedit.msc). - 2. In the console tree, click **Computer Configuration**, click **Windows Settings**, and then click **Security Settings**. - 3. Do one of the following: - - Click **Account Policies** to edit the **Password Policy** or **Account Lockout Policy**. - - Click **Local Policies** to edit an **Audit Policy**, a **User Rights Assignment**, or **Security Options**. - 4. In the details pane, double-click the security policy setting that you want to modify. - **Note**      If this security policy has not yet been defined, select the **Define these policy settings** check box. -   - 5. Modify the security policy setting, and then click **OK**. - **Note**  If you want to configure security settings for many devices on your network, you can use the Group Policy Management Console. -   - ## To configure a setting for a domain controller - - The following procedure describes how to configure a security policy setting for only a domain controller (from the domain controller). - 1. To open the domain controller security policy, in the console tree, locate *GroupPolicyObject \[ComputerName\]* Policy, click **Computer Configuration**, click **Windows Settings**, and then click **Security Settings**. - 2. Do one of the following: - - Double-click **Account Policies** to edit the **Password Policy**, **Account Lockout Policy**, or **Kerberos Policy**. - - Click **Local Policies** to edit the **Audit Policy**, a **User Rights Assignment**, or **Security Options**. - 3. In the details pane, double-click the security policy that you want to modify. - **Note**   If this security policy has not yet been defined, select the **Define these policy settings** check box. -   - 4. Modify the security policy setting, and then click **OK**. - **Important**   - Always test a newly created policy in a test organizational unit before you apply it to your network. - - When you change a security setting through a GPO and click **OK**, that setting will take effect the next time you refresh the settings. -   - ## Related topics - - [Security policy settings reference](security-policy-settings-reference.md) -   -   - - - - - diff --git a/windows/keep-secure/how-user-account-control-works.md b/windows/keep-secure/how-user-account-control-works.md index c410eb2314..488f2bf4e5 100644 --- a/windows/keep-secure/how-user-account-control-works.md +++ b/windows/keep-secure/how-user-account-control-works.md @@ -2,277 +2,143 @@ title: How User Account Control works (Windows 10) description: User Account Control (UAC) is a fundamental component of Microsoft's overall security vision. UAC helps mitigate the impact of malware. ms.assetid: 9f921779-0fd3-4206-b0e4-05a19883ee59 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: operate ms.sitesec: library author: brianlic-msft --- - # How User Account Control works - - **Applies to** - - Windows 10 - User Account Control (UAC) is a fundamental component of Microsoft's overall security vision. UAC helps mitigate the impact of malware. - ## UAC process and interactions - - Each app that requires the administrator access token must prompt for consent. The one exception is the relationship that exists between parent and child processes. Child processes inherit the user's access token from the parent process. Both the parent and child processes, however, must have the same integrity level. Windows 10 protects processes by marking their integrity levels. Integrity levels are measurements of trust. A "high" integrity application is one that performs tasks that modify system data, such as a disk partitioning application, while a "low" integrity application is one that performs tasks that could potentially compromise the operating system, such as a Web browser. Apps with lower integrity levels cannot modify data in applications with higher integrity levels. When a standard user attempts to run an app that requires an administrator access token, UAC requires that the user provide valid administrator credentials. - In order to better understand how this process happens, let's look at the Windows logon process. - ### Logon process - The following shows how the logon process for an administrator differs from the logon process for a standard user. - ![uac windows logon process](images/uacwindowslogonprocess.gif) - By default, standard users and administrators access resources and run apps in the security context of standard users. When a user logs on to a computer, the system creates an access token for that user. The access token contains information about the level of access that the user is granted, including specific security identifiers (SIDs) and Windows privileges. - When an administrator logs on, two separate access tokens are created for the user: a standard user access token and an administrator access token. The standard user access token contains the same user-specific information as the administrator access token, but the administrative Windows privileges and SIDs are removed. The standard user access token is used to start apps that do not perform administrative tasks (standard user apps). The standard user access token is then used to display the desktop (explorer.exe). Explorer.exe is the parent process from which all other user-initiated processes inherit their access token. As a result, all apps run as a standard user unless a user provides consent or credentials to approve an app to use a full administrative access token. - A user that is a member of the Administrators group can log on, browse the Web, and read e-mail while using a standard user access token. When the administrator needs to perform a task that requires the administrator access token, Windows 10 automatically prompts the user for approval. This prompt is called an elevation prompt, and its behavior can be configured by using the Local Security Policy snap-in (Secpol.msc) or Group Policy. For more info, see [User Account Control security policy settings](user-account-control-security-policy-settings.md). - ### The UAC User Experience - When UAC is enabled, the user experience for standard users is different from that of administrators in Admin Approval Mode. The recommended and more secure method of running Windows 10 is to make your primary user account a standard user account. Running as a standard user helps to maximize security for a managed environment. With the built-in UAC elevation component, standard users can easily perform an administrative task by entering valid credentials for a local administrator account. The default, built-in UAC elevation component for standard users is the credential prompt. - The alternative to running as a standard user is to run as an administrator in Admin Approval Mode. With the built-in UAC elevation component, members of the local Administrators group can easily perform an administrative task by providing approval. The default, built-in UAC elevation component for an administrator account in Admin Approval Mode is called the consent prompt. - **The consent and credential prompts** - With UAC enabled, Windows 10 prompts for consent or prompts for credentials of a valid local administrator account before starting a program or task that requires a full administrator access token. This prompt ensures that no malicious software can be silently installed. - **The consent prompt** - The consent prompt is presented when a user attempts to perform a task that requires a user's administrative access token. The following is an example of the UAC consent prompt. - ![uac consent prompt](images/uacconsentprompt.gif) - **The credential prompt** - The credential prompt is presented when a standard user attempts to perform a task that requires a user's administrative access token. Administrators can also be required to provide their credentials by setting the **User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode** policy setting value to **Prompt for credentials**. - The following is an example of the UAC credential prompt. - ![uac credential prompt](images/uaccredentialprompt.gif) - **UAC elevation prompts** - The UAC elevation prompts are color-coded to be app-specific, enabling for immediate identification of an application's potential security risk. When an app attempts to run with an administrator's full access token, Windows 10 first analyzes the executable file to determine its publisher. Apps are first separated into three categories based on the file's publisher: Windows 10, publisher verified (signed), and publisher not verified (unsigned). The following diagram illustrates how Windows 10 determines which color elevation prompt to present to the user. - The elevation prompt color-coding is as follows: - - Red background with a red shield icon: The app is blocked by Group Policy or is from a publisher that is blocked. - - Blue background with a blue and gold shield icon: The application is a Windows 10 administrative app, such as a Control Panel item. - - Blue background with a blue shield icon: The application is signed by using Authenticode and is trusted by the local computer. - - Yellow background with a yellow shield icon: The application is unsigned or signed but is not yet trusted by the local computer. - **Shield icon** - Some Control Panel items, such as **Date and Time Properties**, contain a combination of administrator and standard user operations. Standard users can view the clock and change the time zone, but a full administrator access token is required to change the local system time. The following is a screen shot of the **Date and Time Properties** Control Panel item. - ![uac shield icon](images/uacshieldicon.png) - The shield icon on the **Change date and time** button indicates that the process requires a full administrator access token and will display a UAC elevation prompt. - **Securing the elevation prompt** - The elevation process is further secured by directing the prompt to the secure desktop. The consent and credential prompts are displayed on the secure desktop by default in Windows 10. Only Windows processes can access the secure desktop. For higher levels of security, we recommend keeping the **User Account Control: Switch to the secure desktop when prompting for elevation** policy setting enabled. - When an executable file requests elevation, the interactive desktop, also called the user desktop, is switched to the secure desktop. The secure desktop dims the user desktop and displays an elevation prompt that must be responded to before continuing. When the user clicks **Yes** or **No**, the desktop switches back to the user desktop. - Malware can present an imitation of the secure desktop, but when the **User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode** policy setting is set to **Prompt for consent**, the malware does not gain elevation if the user clicks **Yes** on the imitation. If the policy setting is set to **Prompt for credentials**, malware imitating the credential prompt may be able to gather the credentials from the user. However, the malware does not gain elevated privilege and the system has other protections that mitigate malware from taking control of the user interface even with a harvested password. - While malware could present an imitation of the secure desktop, this issue cannot occur unless a user previously installed the malware on the PC. Because processes requiring an administrator access token cannot silently install when UAC is enabled, the user must explicitly provide consent by clicking **Yes** or by providing administrator credentials. The specific behavior of the UAC elevation prompt is dependent upon Group Policy. - ## UAC Architecture - - The following diagram details the UAC architecture. - ![uac architecture](images/uacarchitecture.gif) - To better understand each component, review the table below: - Component Description **User** - User performs operation requiring privilege - If the operation changes the file system or registry, Virtualization is called. All other operations call ShellExecute. - ShellExecute - ShellExecute calls CreateProcess. ShellExecute looks for the ERROR\_ELEVATION\_REQUIRED error from CreateProcess. If it receives the error, ShellExecute calls the Application Information service to attempt to perform the requested task with the elevated prompt. - CreateProcess - If the application requires elevation, CreateProcess rejects the call with ERROR\_ELEVATION\_REQUIRED. - **System** - Application Information service - A system service that helps start apps that require one or more elevated privileges or user rights to run, such as local administrative tasks, and apps that require higher integrity levels. The Application Information service helps start such apps by creating a new process for the application with an administrative user's full access token when elevation is required and (depending on Group Policy) consent is given by the user to do so. - Elevating an ActiveX install - If ActiveX is not installed, the system checks the UAC slider level. If ActiveX is installed, the **User Account Control: Switch to the secure desktop when prompting for elevation** Group Policy setting is checked. - Check UAC slider level - UAC has four levels of notification to choose from and a slider to use to select the notification level: - - High - If the slider is set to **Always notify**, the system checks whether the secure desktop is enabled. - - Medium - If the slider is set to **Notify me only when programs try to make changes to my computer**, the **User Account Control: Only elevate executable files that are signed and validated** policy setting is checked: - - If the policy setting is enabled, the public key infrastructure (PKI) certification path validation is enforced for a given file before it is permitted to run. - - If the policy setting is not enabled (default), the PKI certification path validation is not enforced before a given file is permitted to run. The **User Account Control: Switch to the secure desktop when prompting for elevation** Group Policy setting is checked. - - Low - If the slider is set to **Notify me only when apps try to make changes to my computer (do not dim by desktop)**, the CreateProcess is called. - - Never Notify - If the slider is set to **Never notify me when**, UAC prompt will never notify when an app is trying to install or trying to make any change on the computer. - **Important**   This setting is not recommended. This setting is the same as setting the **User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode** policy setting to **Elevate without prompting**. -   - Secure desktop enabled - The **User Account Control: Switch to the secure desktop when prompting for elevation** policy setting is checked: - - If the secure desktop is enabled, all elevation requests go to the secure desktop regardless of prompt behavior policy settings for administrators and standard users. - - If the secure desktop is not enabled, all elevation requests go to the interactive user's desktop, and the per-user settings for administrators and standard users are used. - CreateProcess - CreateProcess calls AppCompat, Fusion, and Installer detection to assess if the app requires elevation. The file is then inspected to determine its requested execution level, which is stored in the application manifest for the file. CreateProcess fails if the requested execution level specified in the manifest does not match the access token and returns an error (ERROR\_ELEVATION\_REQUIRED) to ShellExecute. - AppCompat - The AppCompat database stores information in the application compatibility fix entries for an application. - Fusion - The Fusion database stores information from application manifests that describe the applications. The manifest schema is updated to add a new requested execution level field. - Installer detection - Installer detection detects setup files, which helps prevent installations from being run without the user's knowledge and consent. - **Kernel** - Virtualization - Virtualization technology ensures that non-compliant apps do not silently fail to run or fail in a way that the cause cannot be determined. UAC also provides file and registry virtualization and logging for applications that write to protected areas. - File system and registry - The per-user file and registry virtualization redirects per-computer registry and file write requests to equivalent per-user locations. Read requests are redirected to the virtualized per-user location first and to the per-computer location second. -   - The slider will never turn UAC completely off. If you set it to **Never notify**, it will: - - Keep the UAC service running. - - Cause all elevation request initiated by administrators to be auto-approved without showing a UAC prompt. - - Automatically deny all elevation requests for standard users. - **Important**   In order to fully disable UAC you must disable the policy **User Account Control: Run all administrators in Admin Approval Mode**. -   - **Warning**   Universal Windows apps will not work when UAC is disabled. -   - ### Virtualization - Because system administrators in enterprise environments attempt to secure systems, many line-of-business (LOB) applications are designed to use only a standard user access token. As a result, you do not need to replace the majority of apps when UAC is turned on. - Windows 10 includes file and registry virtualization technology for apps that are not UAC-compliant and that require an administrator's access token to run correctly. When an administrative apps that is not UAC-compliant attempts to write to a protected folder, such as Program Files, UAC gives the app its own virtualized view of the resource it is attempting to change. The virtualized copy is maintained in the user's profile. This strategy creates a separate copy of the virtualized file for each user that runs the non-compliant app. - Most app tasks operate properly by using virtualization features. Although virtualization allows a majority of applications to run, it is a short-term fix and not a long-term solution. App developers should modify their apps to be compliant as soon as possible, rather than relying on file, folder, and registry virtualization. - Virtualization is not an option in the following scenarios: - - Virtualization does not apply to apps that are elevated and run with a full administrative access token. - - Virtualization supports only 32-bit apps. Non-elevated 64-bit apps simply receive an access denied message when they attempt to acquire a handle (a unique identifier) to a Windows object. Native Windows 64-bit apps are required to be compatible with UAC and to write data into the correct locations. - - Virtualization is disabled if the app includes an app manifest with a requested execution level attribute. - ### Request execution levels - An app manifest is an XML file that describes and identifies the shared and private side-by-side assemblies that an app should bind to at run time. The app manifest includes entries for UAC app compatibility purposes. Administrative apps that include an entry in the app manifest prompt the user for permission to access the user's access token. Although they lack an entry in the app manifest, most administrative app can run without modification by using app compatibility fixes. App compatibility fixes are database entries that enable applications that are not UAC-compliant to work properly. - All UAC-compliant apps should have a requested execution level added to the application manifest. If the application requires administrative access to the system, then marking the app with a requested execution level of "require administrator" ensures that the system identifies this program as an administrative app and performs the necessary elevation steps. Requested execution levels specify the privileges required for an app. - ### Installer detection technology - Installation programs are apps designed to deploy software. Most installation programs write to system directories and registry keys. These protected system locations are typically writeable only by an administrator in Installer detection technology, which means that standard users do not have sufficient access to install programs. Windows 10 heuristically detects installation programs and requests administrator credentials or approval from the administrator user in order to run with access privileges. Windows 10 also heuristically detects updates and programs that uninstall applications. One of the design goals of UAC is to prevent installations from being run without the user's knowledge and consent because installation programs write to protected areas of the file system and registry. - Installer detection only applies to: - - 32-bit executable files. - - Applications without a requested execution level attribute. - - Interactive processes running as a standard user with UAC enabled. - Before a 32-bit process is created, the following attributes are checked to determine whether it is an installer: - - The file name includes keywords such as "install," "setup," or "update." - - Versioning Resource fields contain the following keywords: Vendor, Company Name, Product Name, File Description, Original Filename, Internal Name, and Export Name. - - Keywords in the side-by-side manifest are embedded in the executable file. - - Keywords in specific StringTable entries are linked in the executable file. - - Key attributes in the resource script data are linked in the executable file. - - There are targeted sequences of bytes within the executable file. - **Note**   The keywords and sequences of bytes were derived from common characteristics observed from various installer technologies. -   - **Note**   The User Account Control: Detect application installations and prompt for elevation policy setting must be enabled for installer detection to detect installation programs. For more info, see [User Account Control security policy settings](user-account-control-security-policy-settings.md). -   -   -   - - - - - diff --git a/windows/keep-secure/impersonate-a-client-after-authentication.md b/windows/keep-secure/impersonate-a-client-after-authentication.md index c43d7641b6..45f008dc87 100644 --- a/windows/keep-secure/impersonate-a-client-after-authentication.md +++ b/windows/keep-secure/impersonate-a-client-after-authentication.md @@ -2,64 +2,37 @@ title: Impersonate a client after authentication (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Impersonate a client after authentication security policy setting. ms.assetid: 4cd241e2-c680-4b43-8ed0-3b391925cec5 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Impersonate a client after authentication - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Impersonate a client after authentication** security policy setting. - ## Reference - - This policy setting determines which programs are allowed to impersonate a user or another specified account and act on behalf of the user. If this user right is required for this type of impersonation, an unauthorized user cannot cause a client to connect (for example, by remote procedure call (RPC) or named pipes) to a service that they have created to impersonate that client. (Such an action could elevate the unauthorized user's permissions to administrative or system levels.) - Impersonation is the ability of a thread to run in a security context that is different from the context of the process that owns the thread. Impersonation is designed to meet the security requirements of client/server applications. When running in a client's security context, a service "is" the client, to some degree. One of the service's threads uses an access token representing the client's credentials to obtain access to the objects to which the client has access. - The primary reason for impersonation is to cause access checks to be performed against the client's identity. Using the client's identity for access checks can cause access to be either restricted or expanded, depending on what the client has permission to do. - Services that are started by the Service Control Manager have the built-in Service group added by default to their access tokens. COM servers that are started by the COM infrastructure and configured to run under a specific account also have the Service group added to their access tokens. As a result, these processes are assigned this user right when they are started. - Constant: SeImpersonatePrivilege - ### Possible values - - User-defined list of accounts - - Default values - - Not defined - ### Best practices - - A user can impersonate an access token if any of the following conditions exist: - - The access token that is being impersonated is for this user. - - The user in this session logged on to the network with explicit credentials to create the access token. - - The requested level is less than Impersonate, such as Anonymous or Identify. - Because of these factors, users do not usually need to have this user right assigned. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - By default, this setting is Administrators, Local Service, Network Service, and Service on domain controllers and stand-alone servers. - The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - @@ -113,59 +86,27 @@ The following table lists the actual and effective default policy values. Defaul
-   - ## Policy management - - This section describes features, tools, and guidance to help you manage this policy. - A restart of the computer is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - ### Group Policy - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - An attacker with the **Impersonate a client after authentication** user right could create a service, mislead a client into connecting to the service, and then impersonate that computer to elevate the attacker's level of access to that of the device. - ### Countermeasure - On member servers, ensure that only the Administrators and Service groups (Local Service, Network Service, and Service) have the **Impersonate a client after authentication** user right assigned to them. - ### Potential impact - In most cases, this configuration has no impact. If you have installed optional components such as ASP.NET or IIS, you may need to assign the **Impersonate a client after authentication** user right to additional accounts that are required by those components, such as IUSR\_*<ComputerName>*, IIS\_WPG, ASP.NET, or IWAM\_*<ComputerName>*. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/implement-microsoft-passport-in-your-organization.md b/windows/keep-secure/implement-microsoft-passport-in-your-organization.md index e7c4e15101..de7ca83f3f 100644 --- a/windows/keep-secure/implement-microsoft-passport-in-your-organization.md +++ b/windows/keep-secure/implement-microsoft-passport-in-your-organization.md @@ -2,33 +2,23 @@ title: Implement Microsoft Passport in your organization (Windows 10) description: You can create a Group Policy or mobile device management (MDM) policy that will implement Microsoft Passport on devices running Windows 10. ms.assetid: 47B55221-24BE-482D-BD31-C78B22AC06D8 +ms.pagetype: security keywords: ["identity", "PIN", "biometric", "Hello"] ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: jdeckerMS --- - # Implement Microsoft Passport in your organization - - **Applies to** - - Windows 10 - Windows 10 Mobile - You can create a Group Policy or mobile device management (MDM) policy that will implement Microsoft Passport on devices running Windows 10. - **Important**   The Group Policy setting **Turn on PIN sign-in** does not apply to Windows 10. Use **Microsoft Passport for Work** policy settings to manage PINs. -   - ## Group Policy settings for Passport - - The following table lists the Group Policy settings that you can configure for Passport use in your workplace. These policy settings are available in **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **Microsoft Passport for Work**. - @@ -142,12 +132,8 @@ The following table lists the Group Policy settings that you can configure for P
Policy
- ## MDM policy settings for Passport - - The following table lists the MDM policy settings that you can configure for Passport use in your workplace. These MDM policy settings use the [PassportForWork configuration service provider (CSP)](http://go.microsoft.com/fwlink/p/?LinkId=692070). - @@ -290,17 +276,11 @@ The following table lists the MDM policy settings that you can configure for Pas
Policy
- **Note**   If policy is not configured to explicitly require letters or special characters, users will be restricted to creating a numeric PIN. -   - ## Prerequisites - - You’ll need this software to set Microsoft Passport policies in your enterprise. - @@ -355,44 +335,20 @@ You’ll need this software to set Microsoft Passport policies in your enterpris
-   - Configuration Manager and MDM provide the ability to manage Passport policy and to deploy and manage certificates protected by Passport. - Azure AD provides the ability to register devices with your enterprise and to provision Passport for organization accounts. - Active Directory provides the ability to authorize users and devices using keys protected by Passport if domain controllers are running Windows 10 and the Microsoft Passport provisioning service in Windows 10 AD FS. - ## Passport for BYOD - - Passport can be managed on personal devices that your employees use for work purposes using MDM. On personal devices, users can create a personal Passport PIN for unlocking the device and a separate work PIN for access to work resources. - The work PIN is managed using the same Passport policies that you can use to manage Passport on organization owned devices. The personal PIN is managed separately using DeviceLock policy. DeviceLock policy can be used to control length, complexity, history, and expiration requirements and can be configured using the [Policy configuration service provider](http://go.microsoft.com/fwlink/p/?LinkID=623244). - ## Related topics - - [Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) - [Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) - [Manage identity verification using Microsoft Passport](manage-identity-verification-using-microsoft-passport.md) - [Prepare people to use Microsoft Passport](prepare-people-to-use-microsoft-passport.md) - [Microsoft Passport and password changes](microsoft-passport-and-password-changes.md) - [Microsoft Passport errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) - [Event ID 300 - Passport successfully created](passport-event-300.md) -   -   - - - - - diff --git a/windows/keep-secure/import-an-applocker-policy-from-another-computer.md b/windows/keep-secure/import-an-applocker-policy-from-another-computer.md index f8a57d092a..02cf23e310 100644 --- a/windows/keep-secure/import-an-applocker-policy-from-another-computer.md +++ b/windows/keep-secure/import-an-applocker-policy-from-another-computer.md @@ -2,45 +2,25 @@ title: Import an AppLocker policy from another computer (Windows 10) description: This topic for IT professionals describes how to import an AppLocker policy. ms.assetid: b48cb2b2-8ef8-4cc0-89bd-309d0b1832f6 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Import an AppLocker policy from another computer - - **Applies to** - - Windows 10 - This topic for IT professionals describes how to import an AppLocker policy. - Before completing this procedure, you should have exported an AppLocker policy. For more information, see [Export an AppLocker policy to an XML file](export-an-applocker-policy-to-an-xml-file.md). - Membership in the local **Administrators** group, or equivalent, is the minimum required to complete this procedure. - **Caution**   Importing a policy will overwrite the existing policy on that computer. -   - **To import an AppLocker policy** - 1. From the AppLocker console, right-click **AppLocker**, and then click **Import Policy**. - 2. In the **Import Policy** dialog box, locate the file that you exported, and then click **Open**. - 3. The **Import Policy** dialog box will warn you that importing a policy will overwrite the existing rules and enforcement settings. If acceptable, click **OK** to import and overwrite the policy. - 4. The **AppLocker** dialog box will notify you of how many rules were overwritten and imported. Click **OK**. -   -   - - - - - diff --git a/windows/keep-secure/import-an-applocker-policy-into-a-gpo.md b/windows/keep-secure/import-an-applocker-policy-into-a-gpo.md index 5124290a7d..94411b2263 100644 --- a/windows/keep-secure/import-an-applocker-policy-into-a-gpo.md +++ b/windows/keep-secure/import-an-applocker-policy-into-a-gpo.md @@ -2,47 +2,26 @@ title: Import an AppLocker policy into a GPO (Windows 10) description: This topic for IT professionals describes the steps to import an AppLocker policy into a Group Policy Object (GPO). ms.assetid: 0629ce44-f5e2-48a8-ba47-06544c73261f +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Import an AppLocker policy into a GPO - - **Applies to** - - Windows 10 - This topic for IT professionals describes the steps to import an AppLocker policy into a Group Policy Object (GPO). - AppLocker policies can be created as local security policies and modified like any other local security policy, or they can be created as part of a GPO and managed by using Group Policy. You can create AppLocker policies on any supported computer. For info about which Windows editions are supported, see [Requirements to Use AppLocker](requirements-to-use-applocker.md). - **Important**   Follow your organization's standard procedures for updating GPOs. For info about specific steps to follow for AppLocker policies, see [Maintain AppLocker policies](maintain-applocker-policies.md). -   - To complete this procedure, you must have the **Edit Setting** permission to edit a GPO. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. - **To import an AppLocker policy into a GPO** - 1. In the Group Policy Management Console (GPMC), open the GPO that you want to edit. - 2. In the console tree under **Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Application Control Policies**, click **AppLocker**. - 3. Right-click **AppLocker**, and then click **Import Policy**. - 4. In the **Import Policy** dialog box, locate the XML policy file, and click **Open**. - 5. The **AppLocker** dialog box will notify you of how many rules were imported. Click **OK**. -   -   - - - - - diff --git a/windows/keep-secure/increase-a-process-working-set.md b/windows/keep-secure/increase-a-process-working-set.md index de979e2f5a..8b8320a5d9 100644 --- a/windows/keep-secure/increase-a-process-working-set.md +++ b/windows/keep-secure/increase-a-process-working-set.md @@ -2,48 +2,29 @@ title: Increase a process working set (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Increase a process working set security policy setting. ms.assetid: b742ad96-37f3-4686-b8f7-f2b48367105b +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Increase a process working set - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Increase a process working set** security policy setting. - ## Reference - - This policy setting determines which users can increase or decrease the size of the working set of a process. The working set of a process is the set of memory pages currently visible to the process in physical RAM. These pages are resident, and they are available for an application to use without triggering a page fault. The minimum and maximum working set sizes affect the virtual memory paging behavior of a process. - Constant: SeIncreaseWorkingSetPrivilege - ### Possible values - - User-defined list of accounts - - Not Defined - ### Best practices - - You should make users aware that adverse performance issues may occur if they modify this security setting. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - By default, standard users have this right. - The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - @@ -82,59 +63,27 @@ The following table lists the actual and effective default policy values. Defaul
-   - ## Policy management - - This section describes features, tools, and guidance to help you manage this policy. - A restart of the computer is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - ### Group Policy - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Increasing the working set size for a process decreases the amount of physical memory that is available to the rest of the system. - ### Countermeasure - Increase user’s awareness about the impact of increasing the working set of a process and how to recognize that their system is adversely affected if they change this setting. - ### Potential impact - None. Allowing standard users to increase the working set of a process is the default configuration. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/increase-scheduling-priority.md b/windows/keep-secure/increase-scheduling-priority.md index 62107e69fa..187e8ef3a7 100644 --- a/windows/keep-secure/increase-scheduling-priority.md +++ b/windows/keep-secure/increase-scheduling-priority.md @@ -2,52 +2,31 @@ title: Increase scheduling priority (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Increase scheduling priority security policy setting. ms.assetid: fbec5973-d35e-4797-9626-d0d56061527f +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Increase scheduling priority - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Increase scheduling priority** security policy setting. - ## Reference - - This policy setting determines which user accounts can increase the base priority class of a process. It is not a privileged operation to increase relative priority within a priority class. This user right is not required by administrative tools that are supplied with the operating system, but it might be required by software development tools. - Specifically, this security setting determines which accounts can use a process with Write Property access to another process to increase the run priority that is assigned to the other process. A user with this privilege can change the scheduling priority of a process through the Task Manager user interface. - Constant: SeIncreaseBasePriorityPrivilege - ### Possible values - - User-defined list of accounts - - Not defined - - Administrators - ### Best practices - - Allow the default value, Administrators, as the only account responsible for controlling process scheduling priorities. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - By default this setting is Administrators on domain controllers and on stand-alone servers. - The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - @@ -86,59 +65,27 @@ The following table lists the actual and effective default policy values. Defaul
-   - ## Policy management - - This section describes features, tools, and guidance to help you manage this policy. - A restart of the computer is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - ### Group Policy - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - A user who is assigned this user right could increase the scheduling priority of a process to Real-Time, which would leave little processing time for all other processes and could lead to a denial-of-service condition. - ### Countermeasure - Verify that only Administrators have the **Increase scheduling priority** user right assigned to them. - ### Potential impact - None. Restricting the **Increase scheduling priority** user right to members of the Administrators group is the default configuration. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/index.md b/windows/keep-secure/index.md index f2a2ac4b8c..0093a7cda3 100644 --- a/windows/keep-secure/index.md +++ b/windows/keep-secure/index.md @@ -2,20 +2,15 @@ title: Keep Windows 10 secure (Windows 10) description: Learn about keeping Windows 10 and Windows 10 Mobile secure. ms.assetid: EA559BA8-734F-41DB-A74A-D8DBF36BE920 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Keep Windows 10 secure - - Learn about keeping Windows 10 and Windows 10 Mobile secure. - ## In this section - - @@ -82,19 +77,8 @@ Learn about keeping Windows 10 and Windows 10 Mobile secure.
-   - ## Related topics - - [Windows 10 and Windows 10 Mobile](../index.md) -   -   - - - - - diff --git a/windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md b/windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md index 5a4aa84615..4325b85cc9 100644 --- a/windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md +++ b/windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md @@ -2,125 +2,70 @@ title: Initialize and configure ownership of the TPM (Windows 10) description: This topic for the IT professional describes how to initialize and set the ownership the Trusted Platform Module (TPM), turn the TPM on and off, and clear TPM keys. ms.assetid: 1166efaf-7aa3-4420-9279-435d9c6ac6f8 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Initialize and configure ownership of the TPM - - **Applies to** - - Windows 10 - This topic for the IT professional describes how to initialize and set the ownership the Trusted Platform Module (TPM), turn the TPM on and off, and clear TPM keys. It also explains how to troubleshoot issues that you might encounter as a result of using these procedures. - ## About TPM initialization and ownership - - The TPM must be initialized and ownership must be taken before it can be used to help secure your computer. The owner of the TPM is the user who possesses the owner password and is able to set it and change it. Only one owner password exists per TPM. The owner of the TPM can make full use of TPM capabilities. Taking ownership of the TPM can be done as part of the initialization process. - When you start the TPM Initialization Wizard, which is accessed through the TPM Microsoft Management Console (MMC), you can determine whether the computer's TPM has been initialized. You can also view the TPM properties. - This topic contains procedures for the following tasks: - - [Initialize the TPM and set ownership](#bkmk-initializetpm) - - [Troubleshoot TPM initialization](#bkmk-troubleshootinit) - - [Turn on or turn off the TPM](#bkmk-onoff) - - [Clear all the keys from the TPM](#bkmk-clear1) - - [Use the TPM cmdlets](#bkmk-tpmcmdlets) - ## Initialize the TPM and set ownership - - Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. In addition, the computer must be equipped with a Trusted Computing Group-compliant BIOS. - **To start the TPM Initialization Wizard** - 1. Open the TPM Management console (tpm.msc). If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. - 2. On the **Action** menu, click **Initialize TPM** to start the TPM Initialization Wizard. - 3. If the TPM has never been initialized or is turned off, the TPM Initialization Wizard displays the **Turn on the TPM security hardware** dialog box. This dialog box provides guidance for initializing or turning on the TPM. Follow the instructions in the wizard. - **Note**   If the TPM is already turned on, the TPM Initialization Wizard displays the **Create the TPM owner password** dialog box. Skip the remainder of this procedure and continue with the [To set ownership of the TPM](#bkmk-setownership) procedure. -   - **Note**   If the TPM Initialization Wizard detects that you do not have a compatible BIOS, you cannot continue with the TPM Initialization Wizard, and you are alerted to consult the computer manufacturer's documentation for instructions to initialize the TPM. -   - 4. Click **Restart**. - 5. Follow the BIOS screen prompts. An acceptance prompt is displayed to ensure that a user has physical access to the computer and that no malicious software is attempting to turn on the TPM. - **Note**   BIOS screen prompts and the required keystrokes vary by computer manufacturer. -   - 6. After the computer restarts, sign in to the computer with the same administrative credentials that you used to start this procedure. - 7. The TPM Initialization Wizard automatically restarts. If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. - 8. Continue with the next procedure to take ownership of the TPM. - To finish initializing the TPM for use, you must set an owner for the TPM. The process of taking ownership includes creating an owner password for the TPM. - **To set ownership of the TPM** - 1. If you are not continuing immediately from the last procedure, start the TPM Initialization Wizard. If you need to review the steps to do so, see the previous procedure [To start the TPM Initialization Wizard](#bkmk-starttpminitwizard). - 2. In the **Create the TPM owner password** dialog box, click **Automatically create the password (recommended)**. - 3. In the **Save your TPM owner password** dialog box, click **Save the password**. - 4. In the **Save As** dialog box, select a location to save the password, and then click **Save**. The password file is saved as *computer\_name.tpm*. - **Important**   We highly recommend saving the TPM owner password to a removable storage device and storing it in a safe location. -   - 5. Click **Print the password** if you want to print a copy of your password. - **Important**   We highly recommend printing a copy of your TPM owner password and storing it in a safe location. -   - 6. Click **Initialize**. - **Note**   The process of initializing the TPM might take a few minutes to complete. -   - 7. Click **Close**. - **Caution**   Do not lose your password. If you do, you will be unable to make administrative changes unless you clear the TPM, which can result in data loss. -   - ## Troubleshoot TPM initialization - - Managing the Trusted Platform Module (TPM) is usually a straightforward procedure. If are unable to complete the initialization procedure, review the following information: - - If the TPM is not detected by Windows, verify that your computer hardware contains a Trusted Computing Group-compliant BIOS. Ensure that no BIOS settings have been used to hide the TPM from the operating system. - - If you are attempting to initialize the TPM as part of the BitLocker setup, check which TPM driver is installed on the computer. We recommend always using one of the TPM drivers that is provided by Microsoft and is protected with BitLocker. If a non-Microsoft TPM driver is installed, it may prevent the default TPM driver from loading and cause BitLocker to report that a TPM is not present on the computer. If you have a non-Microsoft driver installed, remove it and then try to initialize the TPM. The following table lists the three standard TPM drivers that are provided by Microsoft. - @@ -147,134 +92,66 @@ Managing the Trusted Platform Module (TPM) is usually a straightforward procedur
-   - - If the TPM has been previously initialized and you do not have the owner password, you may have to clear or reset the TPM to the factory default values. For more information, see [Clear all the keys from the TPM](#bkmk-clear1). - **Caution**   Clearing the TPM can result in data loss. To avoid data loss, make sure that you have a backup or recovery method for any data that is protected or encrypted by the TPM. -   - Because your TPM security hardware is a physical part of your computer, you may want to read the manuals or instructions that came with your computer, or search the manufacturer's website. - **Network connection** - You cannot complete the initialization of the Trusted Platform Module (TPM) when your computer is disconnected from your organization's network if either of the following conditions exist: - - An administrator has configured your computer to require that TPM recovery information be saved in Active Directory Domain Services (AD DS). This requirement can be configured through Group Policy. - - A domain controller cannot be reached. This can occur on a computer that is currently disconnected from the network, separated from the domain by a firewall, or experiencing a network component failure (such as an unplugged cable or a faulty network adapter). - In either case, an error message appears, and you cannot complete the initialization process. To avoid this issue, initialize the TPM while you are connected to the corporate network and you can contact a domain controller. - **Systems with multiple TPMs** - Some systems may have multiple TPMs and the active TPM may be toggled in the BIOS. Windows 10 does not support this behavior. If you switch TPMs, functionality that depends on the TPM will not work with the new TPM unless it is cleared and put through provisioning. Performing this clear may cause data loss, in particular of keys and certificates associated with the previous TPM. For example, toggling TPMs will cause Bitlocker to enter recovery mode. It is strongly recommended that, on systems with two TPMs, one TPM is selected to be used and the selection is not changed. - ## Turn on or turn off the TPM - - Normally, the TPM is turned on as part of the TPM initialization process. You do not normally need to turn the TPM on or off. However, if necessary you can do so by using the TPM MMC. - ### Turn on the TPM - If the TPM has been initialized but has never been used, or if you want to use the TPM after you have turned it off, you can use the following procedure to turn on the TPM. - **To turn on the TPM** - 1. Open the TPM MMC (tpm.msc). - 2. In the **Action** pane, click **Turn TPM On** to display the **Turn on the TPM Security Hardware** page. Read the instructions on this page. - 3. Click **Shutdown** (or **Restart**), and then follow the BIOS screen prompts. - After the computer restarts, but before you sign in to Windows, you will be prompted to accept the reconfiguration of the TPM. This ensures that the user has physical access to the computer and that malicious software is not attempting to make changes to the TPM. - ### Turn off the TPM - If you want to stop using the services that are provided by the TPM, you can use the TPM MMC to turn off the TPM. If you have the TPM owner password, physical access to the computer is not required to turn off the TPM. If you do not have the TPM owner password, you must have physical access to the computer to turn off the TPM. - **To turn off the TPM** - 1. Open the TPM MMC (tpm.msc). - 2. In the **Action** pane, click **Turn TPM Off** to display the **Turn off the TPM security hardware** page. - 3. In the **Turn off the TPM security hardware** dialog box, select a method to enter your owner password and turning off the TPM: - - If you saved your TPM owner password on a removable storage device, insert it, and then click **I have the owner password file**. In the **Select backup file with the TPM owner password** dialog box, click **Browse** to locate the .tpm file that is saved on your removable storage device, click **Open**, and then click **Turn TPM Off**. - - If you do not have the removable storage device with your saved TPM owner password, click **I want to enter the password**. In the **Type your TPM owner password** dialog box, type your password (including hyphens), and then click **Turn TPM Off**. - - If you do not know your TPM owner password, click **I do not have the TPM owner password**, and follow the instructions that are provided in the dialog box and subsequent BIOS screens to turn off the TPM without entering the password. - ## Clear all the keys from the TPM - - Clearing the TPM resets it to an unowned state. After clearing the TPM, you need to complete the TPM initialization process before using software that relies on the TPM, such as BitLocker Drive Encryption. By default, the TPM is initialized automatically. - **Important**   Clearing the TPM can result in data loss. To avoid data loss, make sure that you have a backup or recovery method for any data that is protected or encrypted by the TPM. -   - After the TPM is cleared, it is also turned off. - To temporarily suspend TPM operations, turn off the TPM instead of clearing it. - Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. - **To clear the TPM** - 1. Open the TPM MMC (tpm.msc). - 2. If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. - 3. Under **Actions**, click **Clear TPM**. - **Warning**   If the TPM is off, reinitialize it before clearing it. - Clearing the TPM resets it to factory defaults and turns it off. You will lose all created keys and data that is protected by those keys. -   - 4. In the **Clear the TPM security hardware** dialog box, select one of the following methods to enter your password and clear the TPM: - - If you have the removable storage device with your saved TPM owner password, insert it, and click **I have the owner password file**. In the **Select backup file with the TPM owner password** dialog box, use **Browse** to navigate to the .tpm file that is saved on your removable storage device. Click **Open**, and then click **Clear TPM**. - - If you do not have the removable storage device with your saved password, click **I want to enter the owner password**. In the **Type your TPM owner password** dialog box, type your password (including hyphens), and click **Clear TPM**. - - If you do not know your TPM owner password, click **I don't have the TPM owner password**, and follow the instructions that are provided to clear the TPM without entering the password. - **Note**   If you have physical access to the computer, you can clear the TPM and perform a limited number of management tasks without entering the TPM owner password. -   - The status of your TPM is displayed under **Status** in TPM MMC. - ## Use the TPM cmdlets - - If you are using Windows PowerShell to manage your computers, you can also manage the TPM by using Windows PowerShell. To install the TPM cmdlets, type the following command: - **dism /online /enable-feature /FeatureName:tpm-psh-cmdlets** - For details about the individual cmdlets, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx). - ## Additional resources - - For more info about TPM, see [Trusted Platform Module Technology Overview](trusted-platform-module-overview.md#bkmk-additionalresources). -   -   - - - - - diff --git a/windows/keep-secure/installing-digital-certificates-on-windows-10-mobile.md b/windows/keep-secure/installing-digital-certificates-on-windows-10-mobile.md index b7e631595a..b87cd6ac93 100644 --- a/windows/keep-secure/installing-digital-certificates-on-windows-10-mobile.md +++ b/windows/keep-secure/installing-digital-certificates-on-windows-10-mobile.md @@ -2,50 +2,31 @@ title: Install digital certificates on Windows 10 Mobile (Windows 10) description: Digital certificates bind the identity of a user or computer to a pair of keys that can be used to encrypt and sign digital information. ms.assetid: FF7B1BE9-41F4-44B0-A442-249B650CEE25 +ms.pagetype: security keywords: ["S/MIME", "PFX", "SCEP"] ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: jdeckerMS --- - # Install digital certificates on Windows 10 Mobile - - **Applies to** - - Windows 10 Mobile - Digital certificates bind the identity of a user or computer to a pair of keys that can be used to encrypt and sign digital information. Certificates are issued by a certification authority (CA) that vouches for the identity of the certificate holder, and they enable secure client communications with websites and services. - Certificates in Windows 10 Mobile are primarily used for the following purposes: - - To create a secure channel using Secure Sockets Layer (SSL) between a phone and a web server or service. - To authenticate a user to a reverse proxy server that is used to enable Microsoft Exchange ActiveSync (EAS) for email. - For installation and licensing of applications (from the Windows Phone Store or a custom company distribution site). - ## Install certificates using Internet Explorer - - A certificate can be posted on a website and made available to users through a device-accessible URL that they can use to download the certificate. When a user accesses the page and taps the certificate, it opens on the device. The user can inspect the certificate, and if they choose to continue, the certificate is installed on the Windows 10 Mobile device. - ## Install certificates using email - - The Windows 10 Mobile certificate installer supports .cer, .p7b, .pem, and .pfx files. To install certificates via email, make sure your mail filters do not block .cer files. Certificates that are sent via email appear as message attachments. When a certificate is received, a user can tap to review the contents and then tap to install the certificate. Typically, when an identity certificate is installed, the user is prompted for the password (or passphrase) that protects it. - ## Install certificates using mobile device management (MDM) - - Windows 10 Mobile supports root, CA, and client certificate to be configured via MDM. Using MDM, an administrator can directly add, delete, or query root and CA certificates, and configure the device to enroll a client certificate with a certificate enrollment server that supports Simple Certificate Enrollment Protocol (SCEP). SCEP enrolled client certificates are used by Wi-Fi, VPN, email, and browser for certificate-based client authentication. An MDM server can also query and delete SCEP enrolled client certificate (including user installed certificates), or trigger a new enrollment request before the current certificate is expired. - **Warning**   Do not use SCEP for encryption certificates for S/MIME. You must use a PFX certificate profile to support S/MIME on Windows 10 Mobile. For instructions on creating a PFX certificate profile in Microsoft Intune, see [Enable access to company resources using certificate profiles with Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkID=718216). -   - **Process of installing certificates using MDM** - 1. The MDM server generates the initial cert enroll request including challenge password, SCEP server URL, and other enrollment related parameters. 2. The policy is converted to the OMA DM request and sent to the device. 3. The trusted CA certificate is installed directly during MDM request. @@ -53,35 +34,17 @@ Do not use SCEP for encryption certificates for S/MIME. You must use a PFX certi 5. The device generates private/public key pair. 6. The device connects to Internet facing point exposed by MDM server. 7. MDM server creates a certificate that is signed with proper CA certificate and returns it to device. - **Note**   The device supports the pending function to allow server side to do additional verification before issuing the cert. In this case, a pending status is sent back to the device. The device will periodically contact the server, based on preconfigured retry count and retry period parameters. Retrying ends when either: - A certificate is successfully received from the server - The server returns an error - The number of retries reaches the preconfigured limit -   - 8. The cert is installed in the device. Browser, Wi-Fi, VPN, email, and other first party applications have access to this certificate. - **Note**   If MDM requested private key being stored in Trusted Process Module (TPM) (configured during enrollment request), the private key will be saved in TPM. Note that SCEP enrolled cert protected by TPM isn’t guarded by a PIN. However, if the certificate is imported to the Passport for Work Key Storage Provider (KSP), it is guarded by the Passport PIN. -   - ## Related topics - - [Configure S/MIME](configure-s-mime.md) -   -   - - - - - diff --git a/windows/keep-secure/interactive-logon-display-user-information-when-the-session-is-locked.md b/windows/keep-secure/interactive-logon-display-user-information-when-the-session-is-locked.md index fc7f8995ad..094e59fedf 100644 --- a/windows/keep-secure/interactive-logon-display-user-information-when-the-session-is-locked.md +++ b/windows/keep-secure/interactive-logon-display-user-information-when-the-session-is-locked.md @@ -2,56 +2,33 @@ title: Interactive logon Display user information when the session is locked (Windows 10) description: Describes the best practices, location, values, and security considerations for the Interactive logon Display user information when the session is locked security policy setting. ms.assetid: 9146aa3d-9b2f-47ba-ac03-ff43efb10530 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Interactive logon: Display user information when the session is locked - - **Applies to** - - Windows 10 - Describes the best practices, location, values, and security considerations for the **Interactive logon: Display user information when the session is locked** security policy setting. - ## Reference - - When a session is locked in a Windows operating system (meaning the user at the computer pressed CTRL+ALT+DEL and the Secure Desktop is displayed), user information is displayed. By default, this information is in the form of **<user name> is logged on**. The displayed user name is the user’s full name as set on the Properties page for that user. These settings do not apply to the logon tiles, which are displayed on the desktop after using the **Switch User** feature. The information that is displayed can be changed to meet your security requirements using the following possible values. - ### Possible values - - **User display name, domain and user names** - If this is a local logon, the user’s full name is displayed on the Secure Desktop. If it is a domain logon, the user’s domain and user’s account name is displayed. - - **User display name only** - The name of the user who locked the session is displayed on the Secure Desktop as the user’s full name. - - **Do not display user information** - No names are displayed on the Secure Desktop, but user’s full names will be displayed on the **Switch user** desktop. - - Blank. - Default setting. This translates to “Not defined,” but it will display the user’s full name in the same manner as the **User display name, domain and user names** option. When an option is set, you cannot reset this policy to blank, or not defined. - ### Best practices - Your implementation of this policy depends on your security requirements for displayed logon information. If you have devices that store sensitive data, with monitors displayed in unsecured locations, or if you have computers with sensitive data that are remotely accessed, revealing logged on user’s full names or domain account names might contradict your overall security policy. - Depending on your security policy, you might also want to enable the [Interactive logon: Do not display last user name](interactive-logon-do-not-display-last-user-name.md) policy, which will prevent the Windows operating system from displaying the logon name and logon tile of the last user to logon. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - @@ -90,57 +67,26 @@ Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Sec
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ### Policy conflict considerations - None - ### Group Policy - This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local computer by using the Local Security Policy snap-in. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - When a computer displays the Secure Desktop in an unsecured area, certain user information can be readily available to anyone looking at the monitor, either physically or through a remote connection. The displayed user information could include the domain user account name or the full name of the user who locked the session or who had logged on last. - ### Countermeasure - Enabling this policy setting allows the operating system to hide certain user information from being displayed on the Secure Desktop (after the device has been booted or when the session has been locked by using CTRL+ALT+DEL). However, user information is displayed if the **Switch user** feature is used so that the logon tiles are displayed for each logged on user. - You might also want to enable the [Interactive logon: Do not display last user name](interactive-logon-do-not-display-last-user-name.md) policy, which will prevent the Windows operating system from displaying the logon name and logon tile of the last user to logon. - ### Potential impact - If you do not enable this policy, the effect will be the same as enabling the policy and selecting the **User display name, domain and user names** option. - If the policy is enabled and set to **Do not display user information**, an observer cannot see who is logged onto the Secure Desktop, but the logon tile is still present if the [Interactive logon: Do not display last user name](interactive-logon-do-not-display-last-user-name.md) policy is not enabled. Depending on how the logon tiles are configured, they could provide visual clues as to who is logged on. In addition, if the Interactive logon: Do not display last user name policy is not enabled, then the **Switch user** feature will show user information. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/interactive-logon-do-not-display-last-user-name.md b/windows/keep-secure/interactive-logon-do-not-display-last-user-name.md index c8547849bb..65a5067ae3 100644 --- a/windows/keep-secure/interactive-logon-do-not-display-last-user-name.md +++ b/windows/keep-secure/interactive-logon-do-not-display-last-user-name.md @@ -2,50 +2,30 @@ title: Interactive logon Do not display last user name (Windows 10) description: Describes the best practices, location, values, and security considerations for the Interactive logon Do not display last user name security policy setting. ms.assetid: 98b24b03-95fe-4edc-8e97-cbdaa8e314fd +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Interactive logon: Do not display last user name - - **Applies to** - - Windows 10 - Describes the best practices, location, values, and security considerations for the **Interactive logon: Do not display last user name** security policy setting. - ## Reference - - This security policy setting determines whether the name of the last user to log on to the device is displayed on the Secure Desktop. - If this policy is enabled, the full name of the last user to successfully log on is not displayed on the Secure Desktop, nor is the user’s logon tile displayed. Additionally, if the **Switch user** feature is used, the full name and logon tile are not displayed. The logon screen requests a qualified domain account name (or local user name) and password. - If this policy is disabled, the full name of the last user to log on is displayed, and the user’s logon tile is displayed. This behavior is the same when the **Switch user** feature is used. - ### Possible values - - Enabled - - Disabled - - Not defined - ### Best practices - Your implementation of this policy depends on your security requirements for displayed logon information. If you have devices that store sensitive data, with monitors displayed in unsecured locations, or if you have devices with sensitive data that are remotely accessed, revealing logged on user’s full names or domain account names might contradict your overall security policy. - Depending on your security policy, you might also want to enable the [Interactive logon: Display user information when the session is locked](interactive-logon-display-user-information-when-the-session-is-locked.md) policy, which will prevent the Windows operating system from displaying the logon name when the session is locked or started. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - @@ -84,53 +64,24 @@ Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Sec
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ### Policy conflict considerations - None. - ### Group Policy - This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local computer by using the Local Security Policy snap-in. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - An attacker with access to the console (for example, someone with physical access or someone who can connect to the device through Remote Desktop Session Host) could view the name of the last user who logged on. The attacker could then try to guess the password, use a dictionary, or use a brute-force attack to try to log on. - ### Countermeasure - Enable the **Interactive logon: Do not display last user name** setting. - ### Potential impact - Users must always type their user names and passwords when they log on locally or to the domain. The logon tiles of all logged on users are not displayed. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/interactive-logon-do-not-require-ctrl-alt-del.md b/windows/keep-secure/interactive-logon-do-not-require-ctrl-alt-del.md index daac336396..19bd4de7a1 100644 --- a/windows/keep-secure/interactive-logon-do-not-require-ctrl-alt-del.md +++ b/windows/keep-secure/interactive-logon-do-not-require-ctrl-alt-del.md @@ -2,54 +2,32 @@ title: Interactive logon Do not require CTRL+ALT+DEL (Windows 10) description: Describes the best practices, location, values, and security considerations for the Interactive logon Do not require CTRL+ALT+DEL security policy setting. ms.assetid: 04e2c000-2eb2-4d4b-8179-1e2cb4793e18 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Interactive logon: Do not require CTRL+ALT+DEL - - **Applies to** - - Windows 10 - Describes the best practices, location, values, and security considerations for the **Interactive logon: Do not require CTRL+ALT+DEL** security policy setting. - ## Reference - - This security setting determines whether pressing CTRL+ALT+DEL is required before a user can log on. - If this policy setting is enabled on a device, a user is not required to press CTRL+ALT+DEL to log on. Not having to press CTRL+ALT+DEL leaves users susceptible to attacks that attempt to intercept the users' passwords. Requiring CTRL+ALT+DEL before users log on ensures that users are communicating by means of a trusted path when entering their passwords. - If this policy is disabled, any user is required to press CTRL+ALT+DEL before logging on to the Windows operating system (unless they are using a smart card for logon). - Microsoft developed this feature to make it easier for users with certain types of physical impairments to log on to device running the Windows operating system; however, not having to press the CTRL+ALT+DELETE key combination leaves users susceptible to attacks that attempt to intercept their passwords. Requiring CTRL+ALT+DELETE before users log on ensures that users are communicating by means of a trusted path when entering their passwords. - A malicious user might install malware that looks like the standard logon dialog box for the Windows operating system, and capture a user's password. The attacker can then log on to the compromised account with whatever level of user rights that user has. - ### Possible values - - Enabled - - Disabled - - Not defined - ### Best practices - - It is advisable to set **Disable CTRL+ALT+DEL requirement for logon** to **Disabled**. Unless they are using a smart card to log on, users will have to simultaneously press three keys before the logon dialog box appears. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -88,55 +66,25 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ### Policy conflict considerations - Beginning with Windows Server 2008 and Windows Vista, the CTRL+ALT+DELETE key combination is required to authenticate if this policy is disabled. - ### Group Policy - This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local computer by using the Local Security Policy snap-in. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - This setting makes it easier for users with certain types of physical impairments to log on to devices that run the Windows operating system. However, if users are not required to press CTRL+ALT+DEL, they are susceptible to attacks that attempt to intercept their passwords. If CTRL+ALT+DEL is required before logon, user passwords are communicated by means of a trusted path. - If this setting is enabled, an attacker could install malware that looks like the standard logon dialog box in the Windows operating system, and capture the user's password. The attacker would then be able to log on to the compromised account with whatever level of privilege that user has. - ### Countermeasure - Disable the **Interactive logon: Do not require CTRL+ALT+DEL** setting. - ### Potential impact - Unless they use a smart card to log on, users must simultaneously press the three keys before the logon dialog box is displayed. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/interactive-logon-machine-account-lockout-threshold.md b/windows/keep-secure/interactive-logon-machine-account-lockout-threshold.md index 871200c86d..baa13fc5c0 100644 --- a/windows/keep-secure/interactive-logon-machine-account-lockout-threshold.md +++ b/windows/keep-secure/interactive-logon-machine-account-lockout-threshold.md @@ -2,46 +2,28 @@ title: Interactive logon Machine account lockout threshold (Windows 10) description: Describes the best practices, location, values, management, and security considerations for the Interactive logon Machine account lockout threshold security policy setting. ms.assetid: ebbd8e22-2611-4ebe-9db9-d49344e631e4 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Interactive logon: Machine account lockout threshold - - **Applies to** - - Windows 10 - Describes the best practices, location, values, management, and security considerations for the **Interactive logon: Machine account lockout threshold** security policy setting. - ## Reference - - Beginning with Windows Server 2012 and Windows 8, the **Interactive logon: Machine account threshold** security policy setting enforces the lockout policy on those computers that have BitLocker enabled to protect operating system volumes. - The security setting allows you to set a threshold for the number of failed logon attempts that causes the device to be locked by using BitLocker. This means, if the specified maximum number of failed logon attempts is exceeded, the device will invalidate the Trusted Platform Module (TPM) protector and any other protector except the 48-digit recovery password, and then reboot. During Device Lockout mode, the computer or device only boots into the touch-enabled Windows Recovery Environment (WinRE) until an authorized user enters the recovery password to restore full access. - Failed password attempts on workstations or member servers that have been locked by using either Ctrl+Alt+Delete or password-protected screen savers count as failed logon attempts. - ### Possible values - You can set the **invalid logon attempts** value between 1 and 999. Values from 1 to 3 are interpreted as 4. If you set the value to 0, or leave blank, the computer or device will never be locked as a result of this policy setting. - ### Best practices - Use this policy setting in conjunction with your other failed account logon attempts policy. For example, if the [Account lockout threshold](account-lockout-threshold.md) policy setting is set at 4, then setting **Interactive logon: Machine account lockout threshold** at 6 allows the user to restore access to resources without having to restore access to the device resulting from a BitLocker lock out. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -80,53 +62,24 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - A restart is required for changes to this policy to become effective when they are saved locally or distributed through Group Policy. - ### Group Policy - Because this policy setting was introduced in Windows Server 2012 and Windows 8, it can only be set locally on those devices that contain this policy setting, but it can be set and distributed through Group Policy to any computer running the Windows operating system that supports Group Policy and is BitLocker-enabled. - When setting this policy, consider the [Account lockout threshold](account-lockout-threshold.md) policy setting, which determines the number of failed logon attempts that will cause a user account to be locked out. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - This policy setting helps protect a BitLocker-encrypted device from attackers attempting to brute-force guess the Windows sign-in password. If not set, then attackers can attempt innumerable passwords, if no other account protection mechanisms are in place. - ### Countermeasure - Use this policy setting in conjunction with your other failed account logon attempts policy. For example, if the [Account lockout threshold](account-lockout-threshold.md) policy setting is set at 4, then setting **Interactive logon: Machine account lockout threshold** at 6 allows the user to restore access to resources without having to restore access to the device resulting from a BitLocker lock out. - ### Potential impact - If not set, the device could be compromised by an attacker using brute-force password cracking software. - If set too low, productivity might be hindered because users who become locked out will be unable to access the device without providing the 48-digit BitLocker recovery password. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/interactive-logon-machine-inactivity-limit.md b/windows/keep-secure/interactive-logon-machine-inactivity-limit.md index ac48acba83..969511b2b4 100644 --- a/windows/keep-secure/interactive-logon-machine-inactivity-limit.md +++ b/windows/keep-secure/interactive-logon-machine-inactivity-limit.md @@ -2,44 +2,27 @@ title: Interactive logon Machine inactivity limit (Windows 10) description: Describes the best practices, location, values, management, and security considerations for the Interactive logon Machine inactivity limit security policy setting. ms.assetid: 7065b4a9-0d52-41d5-afc4-5aedfc4162b5 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Interactive logon: Machine inactivity limit - - **Applies to** - - Windows 10 - Describes the best practices, location, values, management, and security considerations for the **Interactive logon: Machine inactivity limit** security policy setting. - ## Reference - - Beginning with Windows Server 2012 and Windows 8, Windows detects user-input inactivity of a sign-in (logon) session by using the security policy setting **Interactive logon: Machine inactivity limit**. If the amount of inactive time exceeds the inactivity limit set by this policy, then the user’s session locks by invoking the screen saver. This policy setting allows you to control the locking time by using Group Policy. - ### Possible values - The automatic lock of the device is set in elapsed seconds of inactivity, which can range from zero (0) to 599,940 seconds (166.65 hours). - If no value (blank) or zero (0) is present in the **Machine will be locked after** input field, then the policy setting is disabled and no action is taken on user-input inactivity for the session. - ### Best practices - Set the time for elapsed user-input inactivity based on the device’s usage and location requirements. For example, if the device or device is in a public area, you might want to have the device automatically lock after a short period of inactivity to prevent unauthorized access. However, if the device is used by an individual or group of trusted individuals, such as in a restricted manufacturing area, automatically locking the device might hinder productivity. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -78,49 +61,22 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - Restart is required for changes to this policy to become effective when they are saved locally or distributed through Group Policy. - ### Group Policy - Because this policy setting was introduced in Windows Server 2012 and Windows 8, it can only be set locally on those computers that contain this policy setting, but it can be set and distributed through Group Policy to any computer running the Windows operating system that supports Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - This policy setting helps you prevent unauthorized access to devices under your control when the currently signed-in user leaves without deliberately locking the desktop. In versions earlier than Windows Server 2012 and Windows 8, the desktop-locking mechanism was set on individual computers in Personalization in Control Panel. - ### Countermeasure - Set the time for elapsed user-input inactivity time by using the security policy setting **Interactive logon: Machine inactivity limit** based on the device’s usage and location requirements. - ### Potential impact - This security policy setting can limit unauthorized access to unsecured computers; however, that requirement must be balanced with the productivity requirements of the intended user. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/interactive-logon-message-text-for-users-attempting-to-log-on.md b/windows/keep-secure/interactive-logon-message-text-for-users-attempting-to-log-on.md index c3ae488699..b8962d626a 100644 --- a/windows/keep-secure/interactive-logon-message-text-for-users-attempting-to-log-on.md +++ b/windows/keep-secure/interactive-logon-message-text-for-users-attempting-to-log-on.md @@ -2,59 +2,35 @@ title: Interactive logon Message text for users attempting to log on (Windows 10) description: Describes the best practices, location, values, management, and security considerations for the Interactive logon Message text for users attempting to log on security policy setting. ms.assetid: fcfe8a6d-ca65-4403-b9e6-2fa017a31c2e +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Interactive logon: Message text for users attempting to log on - - **Applies to** - - Windows 10 - Describes the best practices, location, values, management, and security considerations for the **Interactive logon: Message text for users attempting to log on** security policy setting. - ## Reference - - The **Interactive logon: Message text for users attempting to log on** and [Interactive logon: Message title for users attempting to log on](interactive-logon-message-title-for-users-attempting-to-log-on.md) policy settings are closely related. **Interactive logon: Message text for users attempting to log on** specifies a text message to be displayed to users when they log on. Interactive logon: Message title for users attempting to log on specifies a title to appear in the title bar of the window that contains the text message. This text is often used for legal reasons—for example, to warn users about the ramifications of misusing company information, or to warn them that their actions might be audited. - Not using this warning-message policy setting leaves your organization legally vulnerable to trespassers who unlawfully penetrate your network. Legal precedents have established that organizations that display warnings to users who connect to their servers over a network have a higher rate of successfully prosecuting trespassers. - When these policy settings are configured, users will see a dialog box before they can log on to the server console. - ### Possible values - The possible values for this setting are: - - User-defined text - - Not defined - ### Best practices - - It is advisable to set **Interactive logon: Message text for users attempting to log on** to a value similar to one of the following: - 1. IT IS AN OFFENSE TO CONTINUE WITHOUT PROPER AUTHORIZATION. - 2. This system is restricted to authorized users. Individuals who attempt unauthorized access will be prosecuted. If you are unauthorized, terminate access now. Click OK to indicate your acceptance of this information. - **Important**   Any warning that you display in the title or text should be approved by representatives from your organization's legal and human resources departments. -   - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -93,58 +69,27 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes different requirements to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - There are two policy settings that relate to logon displays: - - **Interactive logon: Message text for users attempting to log on** - - [Interactive logon: Message title for users attempting to log on](interactive-logon-message-title-for-users-attempting-to-log-on.md) - The first policy setting specifies a text message that displays to users when they log on, and the second policy setting specifies a title for the title bar of the text message window. Many organizations use this text for legal purposes; for example, to warn users about the ramifications of misuse of company information, or to warn them that their actions may be audited. - ### Vulnerability - Users often do not understand the importance of security practices. However, the display of a warning message before logon may help prevent an attack by warning malicious or uninformed users about the consequences of their misconduct before it happens. It may also help reinforce corporate policies by notifying employees of appropriate policies during the logon process. - ### Countermeasure - Configure the **Interactive logon: Message text for users attempting to log on** and [Interactive logon: Message title for users attempting to log on](interactive-logon-message-title-for-users-attempting-to-log-on.md) settings to an appropriate value for your organization. - **Note**   Any warning message that displays should be approved by your organization's legal and human resources representatives. -   - ### Potential impact - Users see a message in a dialog box before they can log on to the server console. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/interactive-logon-message-title-for-users-attempting-to-log-on.md b/windows/keep-secure/interactive-logon-message-title-for-users-attempting-to-log-on.md index 7c09c135ab..dcc618ac81 100644 --- a/windows/keep-secure/interactive-logon-message-title-for-users-attempting-to-log-on.md +++ b/windows/keep-secure/interactive-logon-message-title-for-users-attempting-to-log-on.md @@ -2,58 +2,34 @@ title: Interactive logon Message title for users attempting to log on (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Interactive logon Message title for users attempting to log on security policy setting. ms.assetid: f2596470-4cc0-4ef1-849c-bef9dc3533c6 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Interactive logon: Message title for users attempting to log on - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **Interactive logon: Message title for users attempting to log on** security policy setting. - ## Reference - - This security setting allows you to specify a title that appears in the title bar of the window that contains the **Interactive logon: Message title for users attempting to log on**. This text is often used for legal reasons—for example, to warn users about the ramifications of misusing company information, or to warn them that their actions might be audited. - The **Interactive logon: Message title for users attempting to log on** and [Interactive logon: Message text for users attempting to log on](interactive-logon-message-text-for-users-attempting-to-log-on.md) policy settings are closely related. **Interactive logon: Message title for users attempting to log on** specifies a message title to be displayed to users when they log on. - Not using this warning-message policy setting leaves your organization legally vulnerable to trespassers who unlawfully penetrate your network. Legal precedents have established that organizations that display warnings to users who connect to their servers over a network have a higher rate of successfully prosecuting trespassers. - When these policy settings are configured, users will see a dialog box before they can log on to the server console. - ### Possible values - - *User-defined title* - - Not defined - ### Best practices - 1. It is advisable to set **Interactive logon: Message title for users attempting to log on** to a value similar to one the following: - - RESTRICTED SYSTEM - or - - WARNING: This system is restricted to authorized users. - 2. Set the policy [Interactive logon: Message text for users attempting to log on](interactive-logon-message-text-for-users-attempting-to-log-on.md) to reinforce the meaning of the message’s title. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -92,58 +68,27 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - There are two policy settings that relate to logon displays: - - [Interactive logon: Message text for users attempting to log on](interactive-logon-message-text-for-users-attempting-to-log-on.md) - - **Interactive logon: Message title for users attempting to log on** - The first policy setting specifies a text message that displays to users when they log on, and the second policy setting specifies a title for the title bar of the text message window. Many organizations use this text for legal purposes; for example, to warn users about the ramifications of misuse of company information, or to warn them that their actions may be audited. - ### Vulnerability - Users often do not understand the importance of security practices. However, the display of a warning message with an appropriate title before logon may help prevent an attack by warning malicious or uninformed users about the consequences of their misconduct before it happens. It may also help reinforce corporate policies by notifying employees of appropriate policies during the logon process. - ### Countermeasure - Configure the [Interactive logon: Message text for users attempting to log on](interactive-logon-message-text-for-users-attempting-to-log-on.md) and **Interactive logon: Message title for users attempting to log on** settings to an appropriate value for your organization. - **Note**   Any warning message that displays should be approved by your organization's legal and human resources representatives. -   - ### Potential impact - Users see a message in a dialog box before they can log on to the server console. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md b/windows/keep-secure/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md index 2fa2d1f18d..14605564d2 100644 --- a/windows/keep-secure/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md +++ b/windows/keep-secure/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md @@ -2,56 +2,33 @@ title: Interactive logon Number of previous logons to cache (in case domain controller is not available) (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Interactive logon Number of previous logons to cache (in case domain controller is not available) security policy setting. ms.assetid: 660e925e-cc3e-4098-a41e-eb8db8062d8d +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Interactive logon: Number of previous logons to cache (in case domain controller is not available) - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **Interactive logon: Number of previous logons to cache (in case domain controller is not available)** security policy setting. - ## Reference - - The **Interactive logon: Number of previous logons to cache (in case domain controller is not available**) policy setting determines whether a user can log on to a Windows domain by using cached account information. Logon information for domain accounts can be cached locally so that, if a domain controller cannot be contacted on subsequent logons, a user can still log on. This policy setting determines the number of unique users whose logon information is cached locally. - If a domain controller is unavailable and a user's logon information is cached, the user is prompted with the following message: - A domain controller for your domain could not be contacted. You have been logged on using cached account information. Changes to your profile since you last logged on might not be available. - If a domain controller is unavailable and a user's logon information is not cached, the user is prompted with this message: - The system cannot log you on now because the domain *DOMAIN NAME* is not available. - The value of this policy setting indicates the number of users whose logon information the server caches locally. If the value is 10, the server caches logon information for 10 users. When an eleventh user logs on to the device, the server overwrites the oldest cached logon session. - Users who access the server console will have their logon credentials cached on that server. A malicious user who is able to access the file system of the server can locate this cached information and use a brute-force attack to determine user passwords. Windows mitigates this type of attack by encrypting the information and keeping the cached credentials in the system's registries, which are spread across numerous physical locations. - ### Possible values - - A user-defined number from 0 through 50 - - Not defined - ### Best practices - It is advisable to set **Interactive logon: Number of previous logons to cache (in case domain controller is not available)** to 0. Setting this value to 0 disables the local caching of logon information. Additional countermeasures include enforcing strong password policies and physically securing the computers. If the value is set to 0, users will be unable to log on to any computers if there is no domain controller available to authenticate them. Organizations might want to set **Interactive logon: Number of previous logons to cache (in case domain controller is not available)** to 2 for end-user systems, especially for mobile users. Setting this value to 2 means that the user's logon information will still be in the cache even if a member of the IT department has recently logged on to their device to perform system maintenance. This way, those users will be able to log on to their devices when they are not connected to the corporate network. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -90,57 +67,26 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. - ### Policy conflict considerations - None - ### Group Policy - This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local computer by using the Local Security Policy snap-in. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - The number that is assigned to this policy setting indicates the number of users whose logon information is cache locally by the servers. If the number is set to 10, the server caches logon information for 10 users. When an eleventh user logs on to the device, the server overwrites the oldest cached logon session. - Users who access the server console have their logon credentials cached on that server. An attacker who is able to access the file system of the server could locate this cached information and use a brute force attack to attempt to determine user passwords. - To mitigate this type of attack, Windows encrypts the information and obscures its physical location. - ### Countermeasure - Configure the **Interactive logon: Number of previous logons to cache (in case domain controller is not available)** setting to 0, which disables the local caching of logon information. Additional countermeasures include enforcement of strong password policies and physically secure locations for the computers. - ### Potential impact - Users cannot log on to any devices if there is no domain controller available to authenticate them. Organizations can configure this value to 2 for end-user computers, especially for mobile users. A configuration value of 2 means that the user's logon information is still in the cache, even if a member of the IT department has recently logged on to the device to perform system maintenance. This method allows users to log on to their computers when they are not connected to the organization's network. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/interactive-logon-prompt-user-to-change-password-before-expiration.md b/windows/keep-secure/interactive-logon-prompt-user-to-change-password-before-expiration.md index 55d44d3f87..f499d1b051 100644 --- a/windows/keep-secure/interactive-logon-prompt-user-to-change-password-before-expiration.md +++ b/windows/keep-secure/interactive-logon-prompt-user-to-change-password-before-expiration.md @@ -2,48 +2,29 @@ title: Interactive logon Prompt user to change password before expiration (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Interactive logon Prompt user to change password before expiration security policy setting. ms.assetid: 8fe94781-40f7-4fbe-8cfd-5e116e6833e9 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Interactive logon: Prompt user to change password before expiration - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **Interactive logon: Prompt user to change password before expiration** security policy setting. - ## Reference - - The **Interactive logon: Prompt user to change password before expiration** policy setting determines how many days in advance users are warned that their passwords are about to expire. With this advance warning, the user has time to construct a password that is sufficiently strong. - ### Possible values - - A user-defined number of days from 0 through 999. - - Not defined. - ### Best practices - 1. Configure user passwords to expire periodically. Users will need warning that their passwords are going to expire, or they might inadvertently get locked out of the system. This could lead to confusion for users who access the network locally, or make it impossible for users who access the network through dial-up or virtual private network (VPN) connections to log on. - 2. Set **Interactive logon: Prompt user to change password before expiration** to 5 days. When their password expiration date is 5 or fewer days away, users will see a dialog box each time they log on to the domain. - 3. Do not set the value to 0, which results in displaying the password expiration warning every time the user logs on. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -82,53 +63,24 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ### Policy conflict considerations - None. - ### Group Policy - This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local computer by using the Local Security Policy snap-in. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - If user passwords are configured to expire periodically in your organization, users need to be warned when this is about to happen, or they may be locked out of the device inadvertently when their passwords expire. This condition could lead to confusion for users who access the network locally, or make it impossible for users to access your organization's network through dial-up or virtual private network (VPN) connections. - ### Countermeasure - Configure the **Interactive logon: Prompt user to change password before expiration** setting to 14 days. - ### Potential impact - Users see a dialog-box prompt to change their password each time that they log on to the domain when their password is configured to expire in 14 or fewer days. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md b/windows/keep-secure/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md index d32bae622c..97aa85187c 100644 --- a/windows/keep-secure/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md +++ b/windows/keep-secure/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md @@ -2,52 +2,31 @@ title: Interactive logon Require Domain Controller authentication to unlock workstation (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Interactive logon Require Domain Controller authentication to unlock workstation security policy setting. ms.assetid: 97618ed3-e946-47db-a212-b5e7a4fc6ffc +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Interactive logon: Require Domain Controller authentication to unlock workstation - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Interactive logon: Require Domain Controller authentication to unlock workstation** security policy setting. - ## Reference - - Unlocking a locked device requires logon information. For domain accounts, the **Interactive logon: Require Domain Controller authentication to unlock workstation** policy setting determines whether it is necessary to contact a domain controller to unlock a device. Enabling this policy setting requires a domain controller to authenticate the domain account that is being used to unlock the device. Disabling this policy setting allows a user to unlock the device without the computer verifying the logon information with a domain controller. However, if [Interactive logon: Number of previous logons to cache (in case domain controller is not available)](interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md) is set to a value greater than zero, the user's cached credentials will be used to unlock the system. - The device caches (locally in memory) the credentials of any users who have been authenticated. The device uses these cached credentials to authenticate anyone who attempts to unlock the console. - When cached credentials are used, any changes that have recently been made to the account (such as user rights assignments, account lockout, or the account being disabled) are not considered or applied after this authentication process. This means not only that user rights are not updated, but more importantly that disabled accounts are still able to unlock the console of the system. - It is advisable to set **Interactive logon: Require Domain Controller authentication to unlock workstation** to Enabled and set [Interactive logon: Number of previous logons to cache (in case domain controller is not available)](interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md) to 0. When the console of a device is locked by a user or automatically by a screen saver time-out, the console can only be unlocked if the user is able to re-authenticate to the domain controller. If no domain controller is available, users cannot unlock their devices. - ### Possible values - - Enabled - - Disabled - - Not defined - ### Best practices - - Set **Interactive logon: Require Domain Controller authentication to unlock workstation** to Enabled and set [Interactive logon: Number of previous logons to cache (in case domain controller is not available)](interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md) to 0. When the console of a device is locked by a user or automatically by a screen saver time-out, the console can only be unlocked if the user is able to re-authenticate to the domain controller. If no domain controller is available, users cannot unlock their devices. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -86,53 +65,24 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ### Policy conflict considerations - None - ### Group Policy - This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local computer by using the Local Security Policy snap-in. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - By default, the device caches locally in memory the credentials of any users who are authenticated. The device uses these cached credentials to authenticate anyone who attempts to unlock the console. When cached credentials are used, any changes that have recently been made to the account—such as user rights assignments, account lockout, or the account being disabled—are not considered or applied after the account is authenticated. User privileges are not updated, and disabled accounts are still able to unlock the console of the device - ### Countermeasure - Configure the **Interactive logon: Require Domain Controller authentication to unlock workstation** setting to Enabled and configure the [Interactive logon: Number of previous logons to cache (in case domain controller is not available)](interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md) setting to 0. - ### Potential impact - When the console on a device is locked by a user or automatically by a screen-saver timeout, the console can be unlocked only if the user can re-authenticate to the domain controller. If no domain controller is available, users cannot unlock their workstations. If you configure the [Interactive logon: Number of previous logons to cache (in case domain controller is not available)](interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md) setting to 0, users whose domain controllers are unavailable (such as mobile or remote users) cannot log on. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/interactive-logon-require-smart-card.md b/windows/keep-secure/interactive-logon-require-smart-card.md index 275ffa00b6..417a99a5a3 100644 --- a/windows/keep-secure/interactive-logon-require-smart-card.md +++ b/windows/keep-secure/interactive-logon-require-smart-card.md @@ -2,48 +2,29 @@ title: Interactive logon Require smart card (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Interactive logon Require smart card security policy setting. ms.assetid: c6a8c040-cbc7-472d-8bc5-579ddf3cbd6c +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Interactive logon: Require smart card - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **Interactive logon: Require smart card** security policy setting. - ## Reference - - The **Interactive logon: Require smart card** policy setting requires users to log on to a device by using a smart card. - Requiring users to use long, complex passwords for authentication enhances network security, especially if the users must change their passwords regularly. This reduces the chance that a malicious user will be able to guess a user's password through a brute-force attack. Using smart cards rather than passwords for authentication dramatically increases security because, with today's technology, it is nearly impossible for a malicious user to impersonate another user. Smart cards that require personal identification numbers (PINs) provide two-factor authentication: the user who attempts to log on must possess the smart card and know its PIN. A malicious user who captures the authentication traffic between the user's device and the domain controller will find it extremely difficult to decrypt the traffic: even if they do, the next time the user logs on to the network, a new session key will be generated for encrypting traffic between the user and the domain controller. - ### Possible values - - Enabled - - Disabled - - Not defined - ### Best practices - - Set **Interactive logon: Require smart card** to Enabled. All users will have to use smart cards to log on to the network. This means that the organization must have a reliable public key infrastructure (PKI) in place, and provide smart cards and smart card readers for all users. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -82,53 +63,24 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ### Policy conflict considerations - None. - ### Group Policy - This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local computer by using the Local Security Policy snap-in. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - It can be difficult to make users choose strong passwords, and even strong passwords are vulnerable to brute-force attacks if an attacker has sufficient time and computing resources. - ### Countermeasure - For users with access to computers that contain sensitive data, issue smart cards to users and configure the **Interactive logon: Require smart card** setting to Enabled. - ### Potential impact - All users of a device with this setting enabled must use smart cards to log on locally. This means that the organization must have a reliable public key infrastructure (PKI) as well as smart cards and smart card readers for these users. These requirements are significant challenges because expertise and resources are required to plan for and deploy these technologies. Active Directory Certificate Services (AD CS) can be used to implement and manage certificates. You can use automatic user and device enrollment and renewal on the client. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/interactive-logon-smart-card-removal-behavior.md b/windows/keep-secure/interactive-logon-smart-card-removal-behavior.md index 59ca4aad03..e7daf35333 100644 --- a/windows/keep-secure/interactive-logon-smart-card-removal-behavior.md +++ b/windows/keep-secure/interactive-logon-smart-card-removal-behavior.md @@ -2,60 +2,35 @@ title: Interactive logon Smart card removal behavior (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Interactive logon Smart card removal behavior security policy setting. ms.assetid: 61487820-9d49-4979-b15d-c7e735999460 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Interactive logon: Smart card removal behavior - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **Interactive logon: Smart card removal behavior** security policy setting. - ## Reference - - This policy setting determines what happens when the smart card for a logged-on user is removed from the smart card reader. - If smart cards are used for authentication, the device should automatically lock itself when the card is removed—that way, if users forget to manually lock their devices when they are away from them, malicious users cannot gain access. - If you select **Force Logoff** in the property sheet for this policy setting, the user is automatically logged off when the smart card is removed. Users will have to reinsert their smart cards and reenter their PINs when they return to their workstations. - ### Possible values - - No Action - - Lock Workstation - If you select this, the workstation is locked when the smart card is removed, allowing users to leave the area, take their smart card with them, and still maintain a protected session. - - Force Logoff - If you select this, the user is automatically logged off when the smart card is removed. - - Disconnect if a remote Remote Desktop Services session - If you select this, removal of the smart card disconnects the session without logging the user off. This allows the user to insert the smart card and resume the session later, or at another smart card reader-equipped computer, without having to log on again. If the session is local, this policy functions identically to Lock Workstation. - - Not Defined - ### Best practices - - Set **Interactive logon: Smart card removal behavior** to **Lock Workstation**. If you select **Lock Workstation** in the property sheet for this policy setting, the workstation is locked when the smart card is removed. This allows users to leave the area, take their smart card with them, and still maintain a protected session. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -94,57 +69,26 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ### Policy conflict considerations - None - ### Group Policy - This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local computer by using the Local Security Policy snap-in. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Users sometimes forget to lock their workstations when they are away from them, allowing the possibility for malicious users to access their devices. If smart cards are used for authentication, the device should automatically lock itself when the card is removed to ensure that only the user with the smart card is accessing resources by using those credentials. - ### Countermeasure - Configure the **Interactive logon: Smart card removal behavior** setting to **Lock Workstation**. - If you select **Lock Workstation** for this policy setting, the device locks when the smart card is removed. Users can leave the area, take their smart card with them, and still maintain a protected session. This behavior is similar to the setting that requires users to log on when resuming work on the device after the screen saver has started. - If you select **Force Logoff** for this policy setting, the user is automatically logged off when the smart card is removed. This setting is useful when a device is deployed as a public access point, such as a kiosk or other type of shared device - ### Potential impact - If you select **Force Logoff**, users must insert their smart cards and enter their PINs when they return to their workstations. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/kerberos-policy.md b/windows/keep-secure/kerberos-policy.md index 7462552b9e..7fc388203f 100644 --- a/windows/keep-secure/kerberos-policy.md +++ b/windows/keep-secure/kerberos-policy.md @@ -2,30 +2,20 @@ title: Kerberos Policy (Windows 10) description: Describes the Kerberos Policy settings and provides links to policy setting descriptions. ms.assetid: 94017dd9-b1a3-4624-af9f-b29161b4bf38 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Kerberos Policy - - **Applies to** - - Windows 10 - Describes the Kerberos Policy settings and provides links to policy setting descriptions. - The Kerberos version 5 authentication protocol provides the default mechanism for authentication services and the authorization data necessary for a user to access a resource and perform a task on that resource. By reducing the lifetime of Kerberos tickets, you reduce the risk of a legitimate user's credentials being stolen and successfully used by an attacker. However, this also increases the authorization overhead. In most environments, these settings should not need to be changed. - These policy settings are located in **\\Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Kerberos Policy**. - The following topics provide a discussion of implementation and best practices considerations, policy location, default values for the server type or GPO, relevant differences in operating system versions, security considerations (including the possible settings vulnerabilities of each setting), countermeasures you can take, and the potential impact for each setting. - ## In this section - - @@ -60,19 +50,8 @@ The following topics provide a discussion of implementation and best practices c
-   - ## Related topics - - [Configure security policy settings](how-to-configure-security-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/load-and-unload-device-drivers.md b/windows/keep-secure/load-and-unload-device-drivers.md index b76083e989..fb07375002 100644 --- a/windows/keep-secure/load-and-unload-device-drivers.md +++ b/windows/keep-secure/load-and-unload-device-drivers.md @@ -2,54 +2,32 @@ title: Load and unload device drivers (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Load and unload device drivers security policy setting. ms.assetid: 66262532-c610-470c-9792-35ff4389430f +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Load and unload device drivers - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Load and unload device drivers** security policy setting. - ## Reference - - This policy setting determines which users can dynamically load and unload device drivers. This user right is not required if a signed driver for the new hardware already exists in the driver.cab file on the device. Device drivers run as highly privileged code. - Windows supports the Plug and Play specifications that define how a computer can detect and configure newly added hardware, and then automatically install the device driver. Prior to Plug and Play, users needed to manually configure devices before attaching them to the device. This model allows a user to plug in the hardware, then Windows searches for an appropriate device driver package and automatically configures it to work without interfering with other devices. - Because device driver software runs as if it is a part of the operating system with unrestricted access to the entire computer, it is critical that only known and authorized device drivers be permitted. - Constant: SeLoadDriverPrivilege - ### Possible values - - User-defined list of accounts - - Default values - - Not Defined - ### Best practices - - Because of the potential security risk, do not assign this user right to any user, group, or process that you do not want to take over the system. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - By default this setting is Administrators and Print Operators on domain controllers and Administrators on stand-alone servers. - The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - @@ -90,64 +68,30 @@ The following table lists the actual and effective default policy values. Defaul
-   - ## Policy management - - This section describes features, tools, and guidance to help you manage this policy. - A restart of the device is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - ### Group Policy - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Device drivers run as highly privileged code. A user who has the **Load and unload device drivers** user right could unintentionally install malware that masquerades as a device driver. Administrators should exercise care and install only drivers with verified digital signatures. - **Note**   You must have this user right or be a member of the local Administrators group to install a new driver for a local printer or to manage a local printer and configure defaults for options such as duplex printing. -   - ### Countermeasure - Do not assign the **Load and unload device drivers** user right to any user or group other than Administrators on member servers. On domain controllers, do not assign this user right to any user or group other than Domain Admins. - ### Potential impact - If you remove the **Load and unload device drivers** user right from the Print Operators group or other accounts, you could limit the abilities of users who are assigned to specific administrative roles in your environment. You should ensure that delegated tasks are not negatively affected. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/lock-pages-in-memory.md b/windows/keep-secure/lock-pages-in-memory.md index 6454978bd9..3bf58d8f5e 100644 --- a/windows/keep-secure/lock-pages-in-memory.md +++ b/windows/keep-secure/lock-pages-in-memory.md @@ -2,55 +2,33 @@ title: Lock pages in memory (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Lock pages in memory security policy setting. ms.assetid: cc724979-aec0-496d-be4e-7009aef660a3 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Lock pages in memory - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Lock pages in memory** security policy setting. - ## Reference - - This policy setting determines which accounts can use a process to keep data in physical memory, which prevents the computer from paging the data to virtual memory on a disk. - Normally, an application running on Windows can negotiate for more physical memory, and in response to the request, the application begins to move the data from RAM (such as the data cache) to a disk. When the pageable memory is moved to a disk, more RAM is free for the operating system to use. - Enabling this policy setting for a specific account (a user account or a process account for an application) prevents paging of the data. Thereby, the amount of memory that Windows can reclaim under pressure is limited. This could lead to performance degradation. - **Note**   By configuring this policy setting, the performance of the Windows operating system will differ depending on if applications are running on 32-bit or 64-bit systems, and if they are virtualized images. Performance will also differ between earlier and later versions of the Windows operating system. -   - Constant: SeLockMemoryPrivilege - ### Possible values - - User-defined list of accounts - - Not defined - ### Best practices - Best practices are dependent on the platform architecture and the applications running on those platforms. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - @@ -89,59 +67,27 @@ The following table lists the actual and effective default policy values for the
-   - ## Policy management - - This section describes features, tools, and guidance to help you manage this policy. - A restart of the computer is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - ### Group Policy - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Users with the **Lock pages in memory** user right could assign physical memory to several processes, which could leave little or no RAM for other processes and result in a denial-of-service condition. - ### Countermeasure - Do not assign the **Lock pages in memory** user right to any accounts. - ### Potential impact - None. Not defined is the default configuration. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/log-on-as-a-batch-job.md b/windows/keep-secure/log-on-as-a-batch-job.md index d2a27b6c9c..1d61c2f659 100644 --- a/windows/keep-secure/log-on-as-a-batch-job.md +++ b/windows/keep-secure/log-on-as-a-batch-job.md @@ -2,50 +2,30 @@ title: Log on as a batch job (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Log on as a batch job security policy setting. ms.assetid: 4eaddb51-0a18-470e-9d3d-5e7cd7970b41 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Log on as a batch job - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Log on as a batch job** security policy setting. - ## Reference - - This policy setting determines which accounts can log on by using a batch-queue tool such as the Task Scheduler service. When you use the Add Scheduled Task Wizard to schedule a task to run under a particular user name and password, that user is automatically assigned the **Log on as a batch job** user right. When the scheduled time arrives, the Task Scheduler service logs on the user as a batch job instead of as an interactive user, and the task runs in the user's security context. - Constant: SeBatchLogonRight - ### Possible values - - User-defined list of accounts - - Default values - - Not Defined - ### Best practices - - Use discretion when assigning this right to specific users for security reasons. The default settings are sufficient in most cases. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - By default, this setting is for Administrators, Backup Operators, and Performance Log Users on domain controllers and on stand-alone servers. - The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - @@ -92,61 +72,28 @@ The following table lists the actual and effective default policy values. Defaul
-   - ## Policy management - - This section describes features, tools, and guidance to help you manage this policy. - A restart of the computer is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - ### Group Policy - Task Scheduler automatically grants this right when a user schedules a task. To override this behavior use the [Deny log on as a batch job](deny-log-on-as-a-batch-job.md) User Rights Assignment setting. - Group Policy settings are applied in the following order, which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - The **Log on as a batch job** user right presents a low-risk vulnerability. For most organizations, the default settings are sufficient. Members of the local Administrators group have this right by default. - ### Countermeasure - You should allow the computer to manage this user right automatically if you want to allow scheduled tasks to run for specific user accounts. If you do not want to use the Task Scheduler in this manner, configure the **Log on as a batch job** user right for only the Local Service account. - For IIS servers, you should configure this policy locally instead of through domain–based Group Policy settings so that you can ensure the local IUSR\_*<ComputerName>* and IWAM\_*<ComputerName>* accounts have this user right. - ### Potential impact - If you configure the **Log on as a batch job** setting by using domain-based Group Policy settings, the computer cannot assign the user right to accounts that are used for scheduled jobs in the Task Scheduler. If you install optional components such as ASP.NET or IIS, you may need to assign this user right to additional accounts that are required by those components. For example, IIS requires assignment of this user right to the IIS\_WPG group and the IUSR\_*<ComputerName>*, ASPNET, and IWAM\_*<ComputerName>* accounts. If this user right is not assigned to this group and these accounts, IIS cannot run some COM objects that are necessary for proper functionality. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/log-on-as-a-service.md b/windows/keep-secure/log-on-as-a-service.md index ad2eda2c3f..ac574fb9c8 100644 --- a/windows/keep-secure/log-on-as-a-service.md +++ b/windows/keep-secure/log-on-as-a-service.md @@ -2,48 +2,29 @@ title: Log on as a service (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Log on as a service security policy setting. ms.assetid: acc9a9e0-fd88-4cda-ab54-503120ba1f42 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Log on as a service - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Log on as a service** security policy setting. - ## Reference - - This policy setting determines which service accounts can register a process as a service. Running a process under a service account circumvents the need for human intervention. - Constant: SeServiceLogonRight - ### Possible values - - User-defined list of accounts - - Not Defined - ### Best practices - - Minimize the number of accounts that are granted this user right. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - By default this setting is Network Service on domain controllers and Network Service on stand-alone servers. - The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - @@ -82,59 +63,27 @@ The following table lists the actual and effective default policy values. Defaul
-   - ## Policy management - - This section describes features, tools, and guidance to help you manage this policy. - A restart of the computer is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - ### Group Policy - The policy setting **Deny logon as a service** supersedes this policy setting if a user account is subject to both policies. - Group Policy settings are applied in the following order, which will overwrite settings on the local device at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - The **Log on as a service** user right allows accounts to start network services or services that run continuously on a computer, even when no one is logged on to the console. The risk is reduced by the fact that only users with administrative privileges can install and configure services. An attacker who has already attained that level of access could configure the service to run with the Local System account. - ### Countermeasure - By definition, the Network Service account has the **Log on as a service** user right. This right is not granted through the Group Policy setting. You should minimize the number of other accounts that are granted this user right. - ### Potential impact - On most computers, restricting the **Log on as a service** user right to the Local System, Local Service, and Network Service built-in accounts is the default configuration, and there is no negative impact. However, if you have installed optional components such as ASP.NET or IIS, you may need to assign the **Log on as a service** user right to additional accounts that are required by those components. IIS requires that this user right be explicitly granted to the ASPNET user account. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/maintain-applocker-policies.md b/windows/keep-secure/maintain-applocker-policies.md index edc7834283..d028b6c454 100644 --- a/windows/keep-secure/maintain-applocker-policies.md +++ b/windows/keep-secure/maintain-applocker-policies.md @@ -2,126 +2,64 @@ title: Maintain AppLocker policies (Windows 10) description: This topic describes how to maintain rules within AppLocker policies. ms.assetid: b4fbfdfe-ef3d-49e0-a390-f2dfe74602bc +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Maintain AppLocker policies - - **Applies to** - - Windows 10 - This topic describes how to maintain rules within AppLocker policies. - Common AppLocker maintenance scenarios include: - - A new app is deployed, and you need to update an AppLocker policy. - - A new version of an app is deployed, and you need to either update an AppLocker policy or create a new rule to update the policy. - - An app is no longer supported by your organization, so you need to prevent it from being used. - - An app appears to be blocked but should be allowed. - - An app appears to be allowed but should be blocked. - - A single user or small subset of users needs to use a specific app that is blocked. - There are two methods you can use to maintain AppLocker policies: - - [Maintaining AppLocker policies by using Group Policy](#bkmk-applkr-use-gp) - - [Maintaining AppLocker policies on the local computer](#bkmk-applkr-use-locsnapin) - As new apps are deployed or existing apps are removed by your organization or updated by the software publisher, you might need to make revisions to your rules and update the Group Policy Object (GPO) to ensure that your policy is current. - You can edit an AppLocker policy by adding, changing, or removing rules. However, you cannot specify a version for the AppLocker policy by importing additional rules. To ensure version control when modifying an AppLocker policy, use Group Policy management software that allows you to create versions of GPOs. - **Caution**   You should not edit an AppLocker rule collection while it is being enforced in Group Policy. Because AppLocker controls what files are allowed to run, making changes to a live policy can create unexpected behavior. -   - ## Maintaining AppLocker policies by using Group Policy - - For every scenario, the steps to maintain an AppLocker policy distributed by Group Policy include the following tasks. - ### Step 1: Understand the current behavior of the policy - Before modifying a policy, evaluate how the policy is currently implemented. For example, if a new version of the application is deployed, you can use **Test-AppLockerPolicy** to verify the effectiveness of your current policy for that app. - ### Step 2: Export the AppLocker policy from the GPO - Updating an AppLocker policy that is currently enforced in your production environment can have unintended results. Therefore, export the policy from the GPO and update the rule or rules by using AppLocker on your AppLocker reference or test computer. To prepare an AppLocker policy for modification, see [Export an AppLocker policy from a GPO](export-an-applocker-policy-from-a-gpo.md) - ### Step 3: Update the AppLocker policy by editing the appropriate AppLocker rule - After the AppLocker policy has been exported from the GPO into the AppLocker reference or test computer, or has been accessed on the local computer, the specific rules can be modified as required. - To modify AppLocker rules, see the following: - - [Edit AppLocker rules](edit-applocker-rules.md) - - [Merge AppLocker policies by using Set-ApplockerPolicy](merge-applocker-policies-by-using-set-applockerpolicy.md) or [Merge AppLocker policies manually](merge-applocker-policies-manually.md) - - [Delete an AppLocker rule](delete-an-applocker-rule.md) - - [Enforce AppLocker rules](enforce-applocker-rules.md) - ### Step 4: Test the AppLocker policy - You should test each collection of rules to ensure that the rules perform as intended. (Because AppLocker rules are inherited from linked GPOs, you should deploy all rules for simultaneous testing in all test GPOs.) For steps to perform this testing, see [Test and update an AppLocker policy](test-and-update-an-applocker-policy.md). - ### Step 5: Import the AppLocker policy into the GPO - After testing, import the AppLocker policy back into the GPO for implementation. To update the GPO with a modified AppLocker policy, see [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md). - ### Step 6: Monitor the resulting policy behavior - After deploying a policy, evaluate the policy's effectiveness. - ## Maintaining AppLocker policies by using the Local Security Policy snap-in - - For every scenario, the steps to maintain an AppLocker policy by using the Local Group Policy Editor or the Local Security Policy snap-in include the following tasks. - ### Step 1: Understand the current behavior of the policy - Before modifying a policy, evaluate how the policy is currently implemented. - ### Step 2: Update the AppLocker policy by modifying the appropriate AppLocker rule - Rules are grouped into a collection, which can have the policy enforcement setting applied to it. By default, AppLocker rules do not allow users to open or run any files that are not specifically allowed. - To modify AppLocker rules, see the appropriate topic listed on [Administer AppLocker](administer-applocker.md). - ### Step 3: Test the AppLocker policy - You should test each collection of rules to ensure that the rules perform as intended. For steps to perform this testing, see [Test and update an AppLocker policy](test-and-update-an-applocker-policy.md). - ### Step 4: Deploy the policy with the modified rule - You can export and then import AppLocker policies to deploy the policy to other computers running Windows 8 or later. To perform this task, see [Export an AppLocker policy to an XML file](export-an-applocker-policy-to-an-xml-file.md) and [Import an AppLocker policy from another computer](import-an-applocker-policy-from-another-computer.md). - ### Step 5: Monitor the resulting policy behavior - After deploying a policy, evaluate the policy's effectiveness. - ## Additional resources - - - For steps to perform other AppLocker policy tasks, see [Administer AppLocker](administer-applocker.md). -   -   - - - - - diff --git a/windows/keep-secure/manage-auditing-and-security-log.md b/windows/keep-secure/manage-auditing-and-security-log.md index 8eb5c90fc8..f6bfc0e575 100644 --- a/windows/keep-secure/manage-auditing-and-security-log.md +++ b/windows/keep-secure/manage-auditing-and-security-log.md @@ -2,52 +2,31 @@ title: Manage auditing and security log (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Manage auditing and security log security policy setting. ms.assetid: 4b946c0d-f904-43db-b2d5-7f0917575347 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Manage auditing and security log - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Manage auditing and security log** security policy setting. - ## Reference - - This policy setting determines which users can specify object access audit options for individual resources such as files, Active Directory objects, and registry keys. These objects specify their system access control lists (SACL). A user who is assigned this user right can also view and clear the Security log in Event Viewer. For more info about the Object Access audit policy, see [Audit object access](basic-audit-object-access.md). - Constant: SeSecurityPrivilege - ### Possible values - - User-defined list of accounts - - Administrators - - Not Defined - ### Best practices - 1. Before removing this right from a group, investigate whether applications are dependent on this right. - 2. Generally, assigning this user right to groups other than Administrators is not necessary. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - By default this setting is Administrators on domain controllers and on stand-alone servers. - The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - @@ -86,68 +65,32 @@ The following table lists the actual and effective default policy values for the
-   - ## Policy management - - This section describes features, tools, and guidance to help you manage this policy. - A restart of the computer is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - Audits for object access are not performed unless you enable them by using the Local Group Policy Editor, the Group Policy Management Console (GPMC), or the Auditpol command-line tool. - For more information about the Object Access audit policy, see [Audit object access](basic-audit-object-access.md). - ### Group Policy - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Anyone with the **Manage auditing and security log** user right can clear the Security log to erase important evidence of unauthorized activity. - ### Countermeasure - Ensure that only the local Administrators group has the **Manage auditing and security log** user right. - ### Potential impact - Restricting the **Manage auditing and security log** user right to the local Administrators group is the default configuration. - **Warning**   If groups other than the local Administrators group have been assigned this user right, removing this user right might cause performance issues with other applications. Before removing this right from a group, investigate whether applications are dependent on this right. -   - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md b/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md index 52200ca0ed..aac4a2f380 100644 --- a/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md +++ b/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md @@ -2,139 +2,70 @@ title: Manage identity verification using Microsoft Passport (Windows 10) description: In Windows 10, Microsoft Passport replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a Windows Hello (biometric) or PIN. ms.assetid: 5BF09642-8CF5-4FBC-AC9A-5CA51E19387E +ms.pagetype: security keywords: ["identity", "PIN", "biometric", "Hello"] ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: jdeckerMS --- - # Manage identity verification using Microsoft Passport - - **Applies to** - - Windows 10 - Windows 10 Mobile - In Windows 10, Microsoft Passport replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a Windows Hello (biometric) or PIN. - Passport addresses the following problems with passwords: - - Passwords can be difficult to remember, and users often reuse passwords on multiple sites. - - Server breaches can expose symmetric network credentials. - - Passwords can be subject to [replay attacks](http://go.microsoft.com/fwlink/p/?LinkId=615673). - - Users can inadvertently expose their passwords due to [phishing attacks](http://go.microsoft.com/fwlink/p/?LinkId=615674). - Passport lets users authenticate to: - - a Microsoft account. - - an Active Directory account. - - a Microsoft Azure Active Directory (AD) account. - - Identity Provider Services or Relying Party Services that support [Fast ID Online (FIDO) v2.0](http://go.microsoft.com/fwlink/p/?LinkId=533889) authentication - After an initial two-step verification of the user during Passport enrollment, Passport is set up on the user's device and the user is asked to set a gesture, which can be Windows Hello or a PIN. The user provides the gesture to verify their identity. Windows then uses Passport to authenticate users and help them to access protected resources and services. - As an administrator in an enterprise or educational organization, you can create policies to manage Passport use on Windows 10-based devices that connect to your organization. - ## Benefits of Microsoft Passport - - Reports of identity theft and large-scale hacking are frequent headlines. Nobody wants to be notified that their user name and password have been exposed. - You may wonder [how a PIN can help protect a device better than a password](why-a-pin-is-better-than-a-password.md). Passwords are shared secrets; they are entered on a device and transmitted over the network to the server. An intercepted account name and password can be used by anyone. Because they're stored on the server, a server breach can reveal those stored credentials. - In Windows 10, Passport replaces passwords. The Passport provisioning process creates two cryptographic keys bound to the Trusted Platform Module (TPM), if a device has a TPM, or in software. Access to these keys and obtaining a signature to validate user possession of the private key is enabled only by the PIN or biometric gesture. The two-step verification that takes place during Passport enrollment creates a trusted relationship between the identity provider and the user when the public portion of the public/private key pair is sent to an identity provider and associated with a user account. When a user enters the gesture on the device, the identify provider knows from the combination of Passport keys and gesture that this is a verified identity and provides an authentication token that allows Windows 10 to access resources and services. In addition, during the registration process, the attestation claim is produced for every identity provider to cryptographically prove that the Passport keys are tied to TPM. During registration, when the attestation claim is not presented to the identity provider, the identity provider must assume that the Passport key is created in software. - ![how authentication works in microsoft passport](images/authflow.png) - Imagine that someone is looking over your shoulder as you get money from an ATM and sees the PIN that you enter. Having that PIN won't help them access your account because they don't have your ATM card. In the same way, learning your PIN for your device doesn't allow that attacker to access your account because the PIN is local to your specific device and doesn't enable any type of authentication from any other device. - Passport helps protect user identities and user credentials. Because no passwords are used, it helps circumvent phishing and brute force attacks. It also helps prevent server breaches because Passport credentials are an asymmetric key pair, which helps prevent replay attacks when these keys are generated within isolated environments of TPMs. - Microsoft Passport also enables Windows 10 Mobile devices to be used as [a remote credential](prepare-people-to-use-microsoft-passport.md#bmk-remote) when signing into Windows 10 PCs. During the sign-in process, the Windows 10 PC can connect using Bluetooth to access Microsoft Passport on the user’s Windows 10 Mobile device. Because users carry their phone with them, Microsoft Passport makes implementing two-factor authentication across the enterprise less costly and complex than other solutions. - **Note**  Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants. -   - ## How Microsoft Passport works: key points - - - Passport credentials are based on certificate or asymmetrical key pair. Passport credentials are bound to the device, and the token that is obtained using the credential is also bound to the device. - - Identify provider (such as Active Directory, Azure AD, or a Microsoft account) validates user identity and maps Microsoft Passport's public key to a user account during the registration step. - - Keys can be generated in hardware (TPM 1.2 or 2.0 for enterprises, and TPM 2.0 for consumers) or software, based on the policy. - - Authentication is the two-factor authentication with the combination of a key or certificate tied to a device and something that the person knows (a PIN) or something that the person is (Windows Hello). The Passport gesture does not roam between devices and is not shared with the server; it is stored locally on a device. - - Private key never leaves a device. The authenticating server has a public key that is mapped to the user account during the registration process. - - PIN entry and Hello both trigger Windows 10 to verify the user's identity and authenticate using Passport keys or certificates. - - Personal (Microsoft account) and corporate (Active Directory or Azure AD) accounts use separate containers for keys. Non-Microsoft identity providers can generate keys for their users in the same container as the Microsoft account; however, all keys are separated by identity providers' domains to help ensure user privacy. - - Certificates are added to the Passport container and are protected by the Passport gesture. - - Windows Update behavior: After a reboot is required by Windows Update, the last interactive user is automatically signed on without any user gesture and the session is locked so the user's lock screen apps can run. - ## Comparing key-based and certificate-based authentication - - Passport can use either keys (hardware or software) or certificates with keys in hardware or software to confirm identity. Enterprises that have a public key infrastructure (PKI) for issuing and managing certificates can continue to use PKI in combination with Passport. Enterprises that do not use PKI or want to reduce the effort associated with managing certificates can rely on key-based credentials for Passport. - Hardware-based keys, which are generated by TPM, provide the highest level of assurance. When the TPM is manufactured, an Endorsement Key (EK) certificate is resident in the TPM. This EK certificate creates a root trust for all other keys that are generated on this TPM. - EK certification is used to generate an attestation identity key (AIK) certificate issued by a Microsoft certificate authority. This AIK certificate can be used as an attestation claim to prove to identity providers that the Passport keys are generated on the same TPM. The Microsoft certificate authority (CA) generates the AIK certificate per device, per user, and per IDP to help ensure that user privacy is protected. - When identity providers such as Active Directory or Azure AD enroll a certificate in Passport, Windows 10 will support the same set of scenarios as a smart card. When the credential type is a key, only key-based trust and operations will be supported. - ## Learn more - - [Introduction to Windows Hello](http://go.microsoft.com/fwlink/p/?LinkId=786649), video presentation on Microsoft Virtual Academy - [What's new in Active Directory Domain Services (AD DS) in Windows Server Technical Preview](http://go.microsoft.com/fwlink/p/?LinkId=708533) - [Windows Hello face authentication](http://go.microsoft.com/fwlink/p/?LinkId=626024) - [Biometrics hardware guidelines](http://go.microsoft.com/fwlink/p/?LinkId=626995) - [Windows 10: Disrupting the Revolution of Cyber-Threats with Revolutionary Security!](http://go.microsoft.com/fwlink/p/?LinkId=533890) - [Windows 10: The End Game for Passwords and Credential Theft?](http://go.microsoft.com/fwlink/p/?LinkId=533891) - [Authenticating identities without passwords through Microsoft Passport](http://go.microsoft.com/fwlink/p/?LinkId=616778) - [Microsoft Passport guide](http://go.microsoft.com/fwlink/p/?LinkId=691928) - ## Related topics - - [Implement Microsoft Passport in your organization](implement-microsoft-passport-in-your-organization.md) - [Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) - [Prepare people to use Microsoft Passport](prepare-people-to-use-microsoft-passport.md) - [Microsoft Passport and password changes](microsoft-passport-and-password-changes.md) - [Microsoft Passport errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) - [Event ID 300 - Passport successfully created](passport-event-300.md) -   -   - - - - - diff --git a/windows/keep-secure/manage-packaged-apps-with-applocker.md b/windows/keep-secure/manage-packaged-apps-with-applocker.md index 0db2b96b96..33641e9491 100644 --- a/windows/keep-secure/manage-packaged-apps-with-applocker.md +++ b/windows/keep-secure/manage-packaged-apps-with-applocker.md @@ -2,91 +2,47 @@ title: Manage packaged apps with AppLocker (Windows 10) description: This topic for IT professionals describes concepts and lists procedures to help you manage Packaged apps with AppLocker as part of your overall application control strategy. ms.assetid: 6d0c99e7-0284-4547-a30a-0685a9916650 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Manage packaged apps with AppLocker - - **Applies to** - - Windows 10 - This topic for IT professionals describes concepts and lists procedures to help you manage Packaged apps with AppLocker as part of your overall application control strategy. - ## Understanding Packaged apps and Packaged app installers for AppLocker - - Packaged apps, also known as Universal Windows apps, are based on a model that ensures all the files within an app package share the same identity. With classic Windows apps, each file within the app could have a unique identity. With packaged apps, it is possible to control the entire app by using a single AppLocker rule. - **Note**   AppLocker supports only publisher rules for packaged apps. All packaged apps must be signed by the software publisher because Windows does not support unsigned packaged apps. -   - Typically, an app consists of multiple components: the installer that is used to install the app, and one or more exes, dlls, or scripts. With classic Windows apps, not all these components always share common attributes such as the software’s publisher name, product name, and product version. Therefore, AppLocker controls each of these components separately through different rule collections, such as exe, dll, script, and Windows Installer rules. In contrast, all the components of a packaged app share the same publisher name, package name, and package version attributes. Therefore, you can control an entire app with a single rule. - ### Comparing classic Windows apps and packaged apps - AppLocker policies for packaged apps can only be applied to apps installed on computers running at least Windows Server 2012 or Windows 8, but classic Windows apps can be controlled on devices running at least Windows Server 2008 R2 or Windows 7. The rules for classic Windows apps and packaged apps can be enforced in tandem. The differences between packaged apps and classic Windows apps that you should consider include: - - **Installing the apps**   All packaged apps can be installed by a standard user, whereas a number of classic Windows apps require administrative privileges to install. In an environment where most of the users are standard users, you might not have numerous exe rules (because classic Windows apps require administrative privileges to install), but you might want to have more explicit policies for packaged apps. - - **Changing the system state**   Classic Windows apps can be written to change the system state if they are run with administrative privileges. Most packaged apps cannot change the system state because they run with limited privileges. When you design your AppLocker policies, it is important to understand whether an app that you are allowing can make system-wide changes. - - **Acquiring the apps**   Packaged apps can be acquired through the Store, or by loading using Windows PowerShell cmdlets (which requires a special enterprise license). Classic Windows apps can be acquired through traditional means. - AppLocker uses different rule collections to control packaged apps and classic Windows apps. You have the choice to control one type, the other type, or both. - For info about controlling classic Windows apps, see [Administer AppLocker](administer-applocker.md). - For more info about packaged apps, see [Packaged apps and packaged app installer rules in AppLocker](packaged-apps-and-packaged-app-installer-rules-in-applocker.md). - ## Design and deployment decisions - - You can use two methods to create an inventory of packaged apps on a computer: the AppLocker console or the **Get-AppxPackage** Windows PowerShell cmdlet. - **Note**   Not all packaged apps are listed in AppLocker’s application inventory wizard. Certain app packages are framework packages that are leveraged by other apps. By themselves, these packages cannot do anything, but blocking such packages can inadvertently cause failure for apps that you want to allow. Instead, you can create Allow or Deny rules for the packaged apps that use these framework packages. The AppLocker user interface deliberately filters out all the packages that are registered as framework packages. For info about how to create an inventory list, see [Create list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md). -   - For info about how to use the **Get-AppxPackage** Windows PowerShell cmdlet, see the [AppLocker PowerShell Command Reference](http://technet.microsoft.com/library/hh847210.aspx). - For info about creating rules for Packaged apps, see [Create a rule for packaged apps](create-a-rule-for-packaged-apps.md). - Consider the following info when you are designing and deploying apps: - - Because AppLocker supports only publisher rules for packaged apps, collecting the installation path information for packaged apps is not necessary. - - You cannot create hash- or path-based rules for packaged apps because all packaged apps and packaged app installers are signed by the software publisher of the package. Classic Windows apps were not always consistently signed; therefore, AppLocker has to support hash- or path-based rules. - - By default, if there are no rules in a particular rule collection, AppLocker allows every file that is included in that rule collection. For example, if there are no Windows Installer rules, AppLocker allows all .msi, .msp, and .mst files to run. An existing AppLocker policy that was targeted at computers running Windows Server 2008 R2 and Windows 7 would not have rules for Packaged apps. Therefore, when a computer running at least Windows Server 2012 or Windows 8 joins a domain where an AppLocker policy is already configured, users would be allowed to run any packaged app. This might be contrary to your design. - To prevent all packaged apps from running on a newly domain-joined computer, by default AppLocker blocks all packaged apps on a computer running at least Windows Server 2012 or Windows 8 if the existing domain policy has rules configured in the exe rule collection. You must take explicit action to allow packaged apps in your enterprise. You can allow only a select set of packaged apps. Or if you want to allow all packaged apps, you can create a default rule for the packaged apps collection. - ## Using AppLocker to manage packaged apps - - Just as there are differences in managing each rule collection, you need to manage the packaged apps with the following strategy: - 1. Gather information about which Packaged apps are running in your environment. For information about how to do this, see [Create list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md). - 2. Create AppLocker rules for specific packaged apps based on your policy strategies. For more information, see [Create a rule for packaged apps](create-a-rule-for-packaged-apps.md) and [Packaged Apps Default Rules in AppLocker](http://technet.microsoft.com/library/ee460941(WS.10).aspx). - 3. Continue to update the AppLocker policies as new package apps are introduced into your environment. To do this, see [Add rules for packaged apps to existing AppLocker rule-set](add-rules-for-packaged-apps-to-existing-applocker-rule-set.md). - 4. Continue to monitor your environment to verify the effectiveness of the rules that are deployed in AppLocker policies. To do this, see [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md). -   -   - - - - - diff --git a/windows/keep-secure/manage-tpm-commands.md b/windows/keep-secure/manage-tpm-commands.md index 1d9de633fa..0683127abc 100644 --- a/windows/keep-secure/manage-tpm-commands.md +++ b/windows/keep-secure/manage-tpm-commands.md @@ -2,105 +2,54 @@ title: Manage TPM commands (Windows 10) description: This topic for the IT professional describes how to manage which Trusted Platform Module (TPM) commands are available to domain users and to local users. ms.assetid: a78e751a-2806-43ae-9c20-2e7ca466b765 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Manage TPM commands - - **Applies to** - - Windows 10 - This topic for the IT professional describes how to manage which Trusted Platform Module (TPM) commands are available to domain users and to local users. - ## - - After a computer user takes ownership of the TPM, the TPM owner can limit which TPM commands can be run by creating a list of blocked TPM commands. The list can be created and applied to all computers in a domain by using Group Policy, or a list can be created for individual computers by using the TPM MMC. Because some hardware vendors might provide additional commands or the Trusted Computing Group may decide to add commands in the future, the TPM MMC also supports the ability to block new commands. - Domain administrators can configure a list of blocked TPM commands by using Group Policy. Local administrators cannot allow TPM commands that are blocked through Group Policy. For more information about this Group Policy setting, see [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md#bkmk-tpmgp-clbtc). - Local administrators can block commands by using the TPM MMC, and commands on the default block list are also blocked unless the Group Policy settings are changed from the default settings. - Two policy settings control the enforcement which allows TPM commands to run. For more information about these policy settings, see [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md#bkmk-tpmgp-idlb). - The following procedures describe how to manage the TPM command lists. You must be a member of the local Administrators group. - **To block TPM commands by using the Local Group Policy Editor** - 1. Open the Local Group Policy Editor (gpedit.msc). If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. - **Note**   Administrators with appropriate rights in a domain can configure a Group Policy Object (GPO) that can be applied through Active Directory Domain Services (AD DS). -   - 2. In the console tree, under **Computer Configuration**, expand **Administrative Templates**, and then expand **System**. - 3. Under **System**, click **Trusted Platform Module Services**. - 4. In the details pane, double-click **Configure the list of blocked TPM commands**. - 5. Click **Enabled**, and then click **Show**. - 6. For each command that you want to block, click **Add**, enter the command number, and then click **OK**. - **Note**   For a list of commands, see the [Trusted Platform Module (TPM) Specifications](http://go.microsoft.com/fwlink/p/?linkid=139770). -   - 7. After you have added numbers for each command that you want to block, click **OK** twice. - 8. Close the Local Group Policy Editor. - **To block or allow TPM commands by using the TPM MMC** - 1. Open the TPM MMC (tpm.msc) - 2. If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. - 3. In the console tree, click **Command Management**. A list of TPM commands is displayed. - 4. In the list, select a command that you want to block or allow. - 5. Under **Actions**, click **Block Selected Command** or **Allow Selected Command** as needed. If **Allow Selected Command** is unavailable, that command is currently blocked by Group Policy. - **To block new commands** - 1. Open the TPM MMC (tpm.msc). - If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. - 2. In the console tree, click **Command Management**. A list of TPM commands is displayed. - 3. In the **Action** pane, click **Block New Command**. The **Block New Command** dialog box is displayed. - 4. In the **Command Number** text box, type the number of the new command that you want to block, and then click **OK**. The command number you entered is added to the blocked list. - ## Use the TPM cmdlets - - If you are using Windows PowerShell to manage your computers, you can also manage the TPM by using Windows PowerShell. To install the TPM cmdlets, type the following command: - **dism /online /enable-feature /FeatureName:tpm-psh-cmdlets** - For details about the individual cmdlets, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx) - ## Additional resources - - For more info about TPM, see [Trusted Platform Module technology overview](trusted-platform-module-overview.md#bkmk-additionalresources). -   -   - - - - - diff --git a/windows/keep-secure/manage-tpm-lockout.md b/windows/keep-secure/manage-tpm-lockout.md index 2753d3dffc..efe696a11e 100644 --- a/windows/keep-secure/manage-tpm-lockout.md +++ b/windows/keep-secure/manage-tpm-lockout.md @@ -2,96 +2,48 @@ title: Manage TPM lockout (Windows 10) description: This topic for the IT professional describes how to manage the lockout feature for the Trusted Platform Module (TPM) in Windows. ms.assetid: bf27adbe-404c-4691-a644-29ec722a3f7b +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Manage TPM lockout - - **Applies to** - - Windows 10 - This topic for the IT professional describes how to manage the lockout feature for the Trusted Platform Module (TPM) in Windows. - ## About TPM lockout - - The TPM will lock itself to prevent tampering or malicious attacks. TPM lockout often lasts for a variable amount of time or until the computer is turned off. While the TPM is in lockout mode, it generally returns an error message when it receives commands that require an authorization value. One exception is that the TPM always allows the owner at least one attempt to reset the TPM lockout when it is in lockout mode. - TPM ownership is commonly taken the first time BitLocker Drive Encryption is turned on for the computer. In this case, the TPM owner authorization password is saved with the BitLocker recovery key. When the BitLocker recovery key is saved to a file, BitLocker also saves a TPM owner password file (.tpm) with the TPM owner password hash value. When the BitLocker recovery key is printed, the TPM owner password is printed at the same time. You can also save your TPM owner password hash value to Active Directory Domain Services (AD DS) if your organization's Group Policy settings are configured to do so. - In some cases, encryption keys are protected by a TPM by requiring a valid authorization value to access the key. A common example is configuring BitLocker Drive Encryption to use the TPM plus PIN key protector. In this scenario, the user must type the correct PIN during the boot process to access the volume encryption key protected by the TPM. To prevent malicious users or software from discovering authorization values, TPMs implement protection logic. The protection logic is designed to slow or stop responses from the TPM if it detects that an entity might be trying to guess authorization values. - The industry standards from the Trusted Computing Group (TCG) specify that TPM manufacturers must implement some form of protection logic in TPM 1.2 and TPM 2.0 chips. TPM manufacturers implement different protection mechanisms and behavior. The general guidance is for the TPM chip to take exponentially longer to respond if incorrect authorization values are sent to the TPM. Some TPM chips may not store failed attempts over time. Other TPM chips may store every failed attempt indefinitely. Therefore, some users may experience increasingly longer delays when they mistype an authorization value that is sent to the TPM. This can prevent them from using the TPM for a period of time. - If your TPM has entered lockout mode or is responding slowly to commands, you can reset the lockout value by using the following procedures. Resetting the TPM lockout requires the TPM owner’s authorization. - ## Reset the TPM lockout by using the TPM MMC - - The following procedure explains the steps to reset the TPM lockout by using the TPM MMC. - **To reset the TPM lockout** - 1. Open the TPM MMC (tpm.msc). - 2. In the **Action** pane, click **Reset TPM Lockout** to start the Reset TPM Lockout Wizard. - 3. Choose one of the following methods to enter the TPM owner password: - - If you saved your TPM owner password to a .tpm file, click **I have the owner password file**, and then type the path to the file, or click **Browse** to navigate to the file location. - - If you want to manually enter your TPM owner password, click **I want to enter the owner password**, and then type the password in the text box provided. - **Note**   If you enabled BitLocker and your TPM at the same time, and you printed your BitLocker recovery password when you turned on BitLocker, your TPM owner password may have printed with it. -   - ## Use Group Policy to manage TPM lockout settings - - The TPM Group Policy settings in the following list are located at: - **Computer Configuration\\Administrative Templates\\System\\Trusted Platform Module Services\\** - - [Standard User Lockout Duration](trusted-platform-module-services-group-policy-settings.md#bkmk-individual) - This policy setting allows you to manage the duration in minutes for counting standard user authorization failures for TPM commands that require authorization. An authorization failure occurs each time a user sends a command to the TPM and receives an error message that indicates an authorization failure occurred. Authorization failures that are older than the duration you set are ignored. If the number of TPM commands with an authorization failure within the lockout duration equals a threshold, the user is prevented from sending commands to the TPM that require authorization. - - [Standard User Individual Lockout Threshold](trusted-platform-module-services-group-policy-settings.md#bkmk-tpmgp-suld) - This policy setting allows you to manage the maximum number of authorization failures for the TPM for each user. This value is the maximum number of authorization failures that each user can have before the user is not allowed to send commands to the TPM that require authorization. If the number of authorization failures equals the duration that is set for the policy setting, the user is prevented from sending commands to the TPM that require authorization. - - [Standard User Total Lockout Threshold](trusted-platform-module-services-group-policy-settings.md#bkmk-total) - This policy setting allows you to manage the maximum number of authorization failures for the TPM for all standard users. If the total number of authorization failures for all users equals the duration that is set for the policy, all users are prevented from sending commands to the TPM that require authorization. - For information about mitigating dictionary attacks that use the lockout settings, see [TPM fundamentals](tpm-fundamentals.md#bkmk-howtpmmitigates). - ## Use the TPM cmdlets - - If you are using Windows PowerShell to manage your computers, you can also manage the TPM by using Windows PowerShell. To install the TPM cmdlets, type the following command: - **dism /online /enable-feature /FeatureName:tpm-psh-cmdlets** - For details about the individual cmdlets, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx). - ## Additional resources - - For more info about TPM, see [TPM technology overview](trusted-platform-module-overview.md#bkmk-additionalresources). -   -   - - - - - diff --git a/windows/keep-secure/maximum-lifetime-for-service-ticket.md b/windows/keep-secure/maximum-lifetime-for-service-ticket.md index d1ddb01b51..35118cc805 100644 --- a/windows/keep-secure/maximum-lifetime-for-service-ticket.md +++ b/windows/keep-secure/maximum-lifetime-for-service-ticket.md @@ -2,48 +2,29 @@ title: Maximum lifetime for service ticket (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Maximum lifetime for service ticket security policy setting. ms.assetid: 484bf05a-3858-47fc-bc02-6599ca860247 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Maximum lifetime for service ticket - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Maximum lifetime for service ticket** security policy setting. - ## Reference - - The **Maximum lifetime for service ticket** policy setting determines the maximum number of minutes that a granted session ticket can be used to access a particular service. The value must be 10 minutes or greater, and it must be less than or equal to the value of the **Maximum lifetime for service ticket** policy setting. - The possible values for this Group Policy setting are: - - A user-defined number of minutes from 10 through 99,999, or 0 (in which case service tickets do not expire). - - Not defined. - If a client presents an expired session ticket when it requests a connection to a server, the server returns an error message. The client must request a new session ticket from the Kerberos V5 KDC. After a connection is authenticated, however, it no longer matters whether the session ticket remains valid. Session tickets are used only to authenticate new connections with servers. Ongoing operations are not interrupted if the session ticket that authenticated the connection expires during the connection. - If the value for this policy setting is too high, users might be able to access network resources outside of their logon hours. In addition, users whose accounts have been disabled might be able to continue accessing network services by using valid service tickets that were issued before their account was disabled. If the value is set to 0, service tickets never expire. - ### Best practices - - It is advisable to set **Maximum lifetime for service ticket** to **600** minutes. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Kerberos Policy - ### Default values - The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - @@ -82,61 +63,28 @@ The following table lists the actual and effective default policy values. Defaul
-   - ## Policy management - - This section describes features, tools, and guidance to help you manage this policy. - A restart of the device is not required for this policy setting to be effective. - This policy setting is configured on the domain controller. - ### Group Policy - Client computers will get the new setting during the next scheduled and successful Group Policy refresh. But for domain controllers to assign these new settings immediately, a gpupdate.exe /force is required. On the local device, the Security Configuration Engine will refresh this setting in about five minutes. - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - If you configure the value for the **Maximum lifetime for service ticket** setting too high, users might be able to access network resources outside of their logon hours. Also, users whose accounts were disabled might continue to have access to network services with valid service tickets that were issued before their accounts were disabled. - ### Countermeasure - Configure the **Maximum lifetime for service ticket** setting to 600 minutes. - ### Potential impact - None. This is the default configuration. - ## Related topics - - [Kerberos Policy](kerberos-policy.md) -   -   - - - - - diff --git a/windows/keep-secure/maximum-lifetime-for-user-ticket-renewal.md b/windows/keep-secure/maximum-lifetime-for-user-ticket-renewal.md index 2a1b0a18e3..bcb1a344e6 100644 --- a/windows/keep-secure/maximum-lifetime-for-user-ticket-renewal.md +++ b/windows/keep-secure/maximum-lifetime-for-user-ticket-renewal.md @@ -2,46 +2,28 @@ title: Maximum lifetime for user ticket renewal (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Maximum lifetime for user ticket renewal security policy setting. ms.assetid: f88cd819-3dd1-4e38-b560-13fe6881b609 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Maximum lifetime for user ticket renewal - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Maximum lifetime for user ticket renewal** security policy setting. - ## Reference - - The **Maximum lifetime for user ticket renewal** policy setting determines the period of time (in days) during which a user’s ticket-granting ticket can be renewed. - The possible values for this Group Policy setting are: - - A user-defined number of days from 0 through 99,999 - - Not defined - ### Best practices - - If the value for this policy setting is too high, users may be able to renew very old user ticket-granting tickets. If the value is 0, ticket-granting tickets never expire. - It is advisable to set **Maximum lifetime for user ticket renewal** to **7** days. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Kerberos Policy - ### Default values - The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - @@ -80,60 +62,28 @@ The following table lists the actual and effective default policy values. Defaul
-   - ### Policy management - This section describes features, tools, and guidance to help you manage this policy. - A restart of the device is not required for this policy setting to be effective. - This policy setting is configured on the domain controller. - ### Group Policy - Client devices will get the new setting during the next scheduled and successful Group Policy refresh. But for domain controllers to assign these new settings immediately, a gpupdate.exe /force is required. On the local device, the Security Configuration Engine will refresh this setting in about five minutes. - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - If the value for the **Maximum lifetime for user ticket renewal** setting is too high, users might be able to renew very old user tickets. - ### Countermeasure - Configure the **Maximum lifetime for user ticket renewal** setting to 7 days. - ### Potential impact - None. This is the default configuration. - ## Related topics - - [Kerberos Policy](kerberos-policy.md) -   -   - - - - - diff --git a/windows/keep-secure/maximum-lifetime-for-user-ticket.md b/windows/keep-secure/maximum-lifetime-for-user-ticket.md index 7301401239..4d15d5cbd8 100644 --- a/windows/keep-secure/maximum-lifetime-for-user-ticket.md +++ b/windows/keep-secure/maximum-lifetime-for-user-ticket.md @@ -2,46 +2,28 @@ title: Maximum lifetime for user ticket (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Maximum lifetime for user ticket policy setting. ms.assetid: bcb4ff59-334d-4c2f-99af-eca2b64011dc +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Maximum lifetime for user ticket - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Maximum lifetime for user ticket** policy setting. - ## Reference - - The **Maximum lifetime for user ticket** policy setting determines the maximum amount of time (in hours) that a user’s ticket-granting ticket can be used. When a user’s ticket-granting ticket expires, a new one must be requested or the existing one must be renewed. - The possible values for this Group Policy setting are: - - A user-defined number of hours from 0 through 99,999 - - Not defined - If the value for this policy setting is too high, users might be able to access network resources outside of their logon hours, or users whose accounts have been disabled might be able to continue to access network services by using valid service tickets that were issued before their account was disabled. If the value is set to 0, ticket-granting tickets never expire. - ### Best practices - - It is advisable to set **Maximum lifetime for user ticket** to 10 hours. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Kerberos Policy - ### Default Values - The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - @@ -80,61 +62,28 @@ The following table lists the actual and effective default policy values. Defaul
-   - ## Policy management - - This section describes features, tools, and guidance to help you manage this policy. - A restart of the computer is not required for this policy setting to be effective. - This policy setting is configured on the domain controller. - ### Group Policy - Client devices will get the new setting during the next scheduled and successful Group Policy refresh. But for domain controllers to assign these new settings immediately, a gpupdate.exe /force is required. On the local computer, the Security Configuration Engine will refresh this setting in about five minutes. - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - If you configure the value for the **Maximum lifetime for user ticket** setting too high, users might be able to access network resources outside of their logon hours. Also, users whose accounts were disabled might continue to have access to network services with valid user tickets that were issued before their accounts were disabled. If you configure this value too low, ticket requests to the KDC may affect the performance of your KDC and present an opportunity for a DoS attack. - ### Countermeasure - Configure the **Maximum lifetime for user ticket** setting with a value between 4 and 10 hours. - ### Potential impact - Reducing this setting from the default value reduces the likelihood that the ticket-granting ticket will be used to access resources that the user does not have rights to. However, it requires more frequent requests to the KDC for ticket-granting tickets on behalf of users. Most KDCs can support a value of four hours without too much additional burden. - ## Related topics - - [Kerberos Policy](kerberos-policy.md) -   -   - - - - - diff --git a/windows/keep-secure/maximum-password-age.md b/windows/keep-secure/maximum-password-age.md index b80a337270..2c384dcf41 100644 --- a/windows/keep-secure/maximum-password-age.md +++ b/windows/keep-secure/maximum-password-age.md @@ -2,49 +2,30 @@ title: Maximum password age (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Maximum password age security policy setting. ms.assetid: 2d6e70e7-c8b0-44fb-8113-870c6120871d +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Maximum password age - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Maximum password age** security policy setting. - ## Reference - - The **Maximum password age** policy setting determines the period of time (in days) that a password can be used before the system requires the user to change it. You can set passwords to expire after a number of days between 1 and 999, or you can specify that passwords never expire by setting the number of days to 0. If **Maximum password age** is between 1 and 999 days, the minimum password age must be less than the maximum password age. If **Maximum password age** is set to 0, [Minimum password age](minimum-password-age.md) can be any value between 0 and 998 days. - **Note**   Setting **Maximum password age** to -1 is equivalent to 0, which means it never expires. Setting it to any other negative number is equivalent to setting it to **Not Defined**. -   - ### Possible values - - User-specified number of days between 0 and 999 - - Not defined - ### Best practices - Set **Maximum password age** to a value between 30 and 90 days, depending on your environment. This way, an attacker has a limited amount of time in which to compromise a user's password and have access to your network resources. - ### Location - **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy** - ### Default values - The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - @@ -83,45 +64,20 @@ The following table lists the actual and effective default policy values. Defaul
-   - ## Policy management - - This section describes features, tools, and guidance to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - The longer a password exists, the higher the likelihood that it will be compromised by a brute force attack, by an attacker gaining general knowledge about the user, or by the user sharing the password. Configuring the **Maximum password age** policy setting to 0 so that users are never required to change their passwords is a major security risk because that allows a compromised password to be used by the malicious user for as long as the valid user is authorized access. - ### Countermeasure - Configure the **Maximum password age** policy setting to a value that is suitable for your organization's business requirements. - ### Potential impact - If the **Maximum password age** policy setting is too low, users are required to change their passwords very often. Such a configuration can reduce security in the organization because users might keep their passwords in an unsecured location or lose them. If the value for this policy setting is too high, the level of security within an organization is reduced because it allows potential attackers more time in which to discover user passwords or to use compromised accounts. - ## Related topics - - [Password Policy](password-policy.md) -   -   - - - - - diff --git a/windows/keep-secure/maximum-tolerance-for-computer-clock-synchronization.md b/windows/keep-secure/maximum-tolerance-for-computer-clock-synchronization.md index 9fc39fe52d..5923108470 100644 --- a/windows/keep-secure/maximum-tolerance-for-computer-clock-synchronization.md +++ b/windows/keep-secure/maximum-tolerance-for-computer-clock-synchronization.md @@ -2,46 +2,28 @@ title: Maximum tolerance for computer clock synchronization (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Maximum tolerance for computer clock synchronization security policy setting. ms.assetid: ba2cf59e-d69d-469e-95e3-8e6a0ba643af +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Maximum tolerance for computer clock synchronization - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Maximum tolerance for computer clock synchronization** security policy setting. - ## Reference - - This security setting determines the maximum time difference (in minutes) that Kerberos V5 tolerates between the time on the client clock and the time on the domain controller that provides Kerberos authentication. - To prevent "replay attacks," the Kerberos v5 protocol uses time stamps as part of its protocol definition. For time stamps to work properly, the clocks of the client and the domain controller need to be in sync as much as possible. In other words, both devices must be set to the same time and date. Because the clocks of two computers are often out of sync, you can use this policy setting to establish the maximum acceptable difference to the Kerberos protocol between a client clock and domain controller clock. If the difference between a client computer clock and the domain controller clock is less than the maximum time difference that is specified in this policy, any time stamp that is used in a session between the two devices is considered to be authentic. - The possible values for this Group Policy setting are: - - A user-defined number of minutes from 1 through 99,999 - - Not defined - ### Best practices - - It is advisable to set **Maximum tolerance for computer clock synchronization** to a value of 5 minutes. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Kerberos Policy - ### Default values - The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - @@ -80,61 +62,28 @@ The following table lists the actual and effective default policy values. Defaul
-   - ## Policy management - - This section describes features, tools, and guidance to help you manage this policy. - A restart of the device is not required for this policy setting to be effective. - This policy setting is configured on the domain controller. - ### Group Policy - Client devices will get the new setting during the next scheduled and successful Group Policy refresh. But for domain controllers to assign these new settings immediately, a gpupdate.exe /force is required. On the local device, the Security Configuration Engine will refresh this setting in about five minutes. - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - To prevent "replay attacks" (which are attacks in which an authentication credential is resubmitted by a malicious user or program to gain access to a protected resource), the Kerberos protocol uses time stamps as part of its definition. For time stamps to work properly, the clocks of the client computer and the domain controller need to be closely synchronized. Because the clocks of two computers are often not synchronized, administrators can use this policy to establish the maximum acceptable difference to the Kerberos protocol between a client computer clock and a domain controller clock. If the difference between the client computer clock and the domain controller clock is less than the maximum time difference specified in this setting, any time stamp that is used in a session between the two computers is considered to be authentic. - ### Countermeasure - Configure the **Maximum tolerance for computer clock synchronization** setting to 5 minutes. - ### Potential impact - None. This is the default configuration. - ## Related topics - - [Kerberos Policy](kerberos-policy.md) -   -   - - - - - diff --git a/windows/keep-secure/merge-applocker-policies-by-using-set-applockerpolicy.md b/windows/keep-secure/merge-applocker-policies-by-using-set-applockerpolicy.md index 746254c18e..3b95f2b434 100644 --- a/windows/keep-secure/merge-applocker-policies-by-using-set-applockerpolicy.md +++ b/windows/keep-secure/merge-applocker-policies-by-using-set-applockerpolicy.md @@ -2,49 +2,27 @@ title: Merge AppLocker policies by using Set-ApplockerPolicy (Windows 10) description: This topic for IT professionals describes the steps to merge AppLocker policies by using Windows PowerShell. ms.assetid: f1c7d5c0-463e-4fe2-a410-844a404f18d0 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Merge AppLocker policies by using Set-ApplockerPolicy - - **Applies to** - - Windows 10 - This topic for IT professionals describes the steps to merge AppLocker policies by using Windows PowerShell. - The **Set-AppLockerPolicy** cmdlet sets the specified Group Policy Object (GPO) to contain the specified AppLocker policy. If no Lightweight Directory Access Protocol (LDAP) is specified, the local GPO is the default. When the Merge parameter is used, rules in the specified AppLocker policy will be merged with the AppLocker rules in the target GPO specified in the LDAP path. The merging of policies will remove rules with duplicate rule IDs, and the enforcement setting specified by the AppLocker policy in the target GPO will be preserved. If the Merge parameter is not specified, then the new policy will overwrite the existing policy. - For info about using **Set-AppLockerPolicy**, including syntax descriptions and parameters, see [Set-AppLockerPolicy](http://technet.microsoft.com/library/hh847212.aspx). - For info about using Windows PowerShell for AppLocker, including how to import the AppLocker cmdlets into Windows PowerShell, see [Use the AppLocker Windows PowerShell cmdlets](use-the-applocker-windows-powershell-cmdlets.md). - You can also manually merge AppLocker policies. For the procedure to do this, see [Merge AppLocker policies manually](merge-applocker-policies-manually.md). - **To merge a local AppLocker policy with another AppLocker policy by using LDAP paths** - 1. Open the PowerShell command window. For info about performing Windows PowerShell commands for AppLocker, see [Use the AppLocker Windows PowerShell cmdlets](use-the-applocker-windows-powershell-cmdlets.md). - 2. At the command prompt, type **C:\\PS>Get-AppLockerPolicy -Local | Set-AppLockerPolicy -LDAP "LDAP: //***<string>***"** **-Merge** where *<string>* specifies the LDAP path of the unique GPO. - ## Example - - Gets the local AppLocker policy, and then merges the policy with the existing AppLocker policy in the GPO specified in the LDAP path. - ``` syntax C:\PS>Get-AppLockerPolicy -Local | Set-AppLockerPolicy -LDAP "LDAP://DC13.Contoso.com/CN={31B2F340-016D-11D2-945F-00C044FB984F9},CN=Policies,CN=System,DC=Contoso,DC=com" -Merge ``` -   -   - - - - - diff --git a/windows/keep-secure/merge-applocker-policies-manually.md b/windows/keep-secure/merge-applocker-policies-manually.md index dc7b2e2f7c..160ae52209 100644 --- a/windows/keep-secure/merge-applocker-policies-manually.md +++ b/windows/keep-secure/merge-applocker-policies-manually.md @@ -2,25 +2,18 @@ title: Merge AppLocker policies manually (Windows 10) description: This topic for IT professionals describes the steps to manually merge AppLocker policies to update the Group Policy Object (GPO). ms.assetid: 3605f293-e5f2-481d-8efd-775f9f23c30f +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Merge AppLocker policies manually - - **Applies to** - - Windows 10 - This topic for IT professionals describes the steps to manually merge AppLocker policies to update the Group Policy Object (GPO). - If you have created multiple AppLocker policies and need to merge them to create one AppLocker policy, you can either manually merge the policies or use the Windows PowerShell cmdlets for AppLocker. You cannot automatically merge policies by using the AppLocker console. You must create one rule collection from two or more policies. For info about merging policies by using the cmdlet, see [Merge AppLocker policies by using Set-ApplockerPolicy](merge-applocker-policies-by-using-set-applockerpolicy.md). - The AppLocker policy is saved in XML format, and the exported policy can be edited with any text or XML editor. Rule collections are specified within the **RuleCollection Type** element. The XML schema includes five attributes for the different rule collections, as shown in the following table: - @@ -55,11 +48,8 @@ The AppLocker policy is saved in XML format, and the exported policy can be edit
-   - Rule enforcement is specified with the **EnforcementMode** element. The three enforcement modes in the XML correspond to the three enforcement modes in the AppLocker console, as shown in the following table: - @@ -86,34 +76,16 @@ Rule enforcement is specified with the **EnforcementMode** element. The three en
-   - Each of the three condition types use specific elements. For XML examples of the different rule types, see Merge AppLocker policies manually. - Membership in the local **Administrators** group, or equivalent, is the minimum required to complete this procedure. - **To merge two or more AppLocker policies** - 1. Open an XML policy file in a text editor or XML editor, such as Notepad. - 2. Select the rule collection where you want to copy rules from. - 3. Select the rules that you want to add to another policy file, and then copy the text. - 4. Open the policy where you want to add the copied rules. - 5. Select and expand the rule collection where you want to add the rules. - 6. At the bottom of the rule list for the collection, after the closing element, paste the rules that you copied from the first policy file. Verify that the opening and closing elements are intact, and then save the policy. - 7. Upload the policy to a reference computer to ensure that it is functioning properly within the GPO. -   -   - - - - - diff --git a/windows/keep-secure/microsoft-network-client-digitally-sign-communications-always.md b/windows/keep-secure/microsoft-network-client-digitally-sign-communications-always.md index 5eed7b34b9..ae89b2c502 100644 --- a/windows/keep-secure/microsoft-network-client-digitally-sign-communications-always.md +++ b/windows/keep-secure/microsoft-network-client-digitally-sign-communications-always.md @@ -2,72 +2,41 @@ title: Microsoft network client Digitally sign communications (always) (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Microsoft network client Digitally sign communications (always) security policy setting. ms.assetid: 4b7b0298-b130-40f8-960d-60418ba85f76 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Microsoft network client: Digitally sign communications (always) - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **Microsoft network client: Digitally sign communications (always)** security policy setting. - ## Reference - - The Server Message Block (SMB) protocol provides the basis for file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with the Server service is permitted. - Implementation of digital signatures in high-security networks helps prevent the impersonation of client computers and servers, which is known as "session hijacking." But misuse of these policy settings is a common error that can cause data loss or problems with data access or security. - If server-side SMB signing is required, a client device will not be able to establish a session with that server, unless it has client-side SMB signing enabled. By default, client-side SMB signing is enabled on workstations, servers, and domain controllers. Similarly, if client-side SMB signing is required, that client device will not be able to establish a session with servers that do not have packet signing enabled. By default, server-side SMB signing is enabled only on domain controllers. - If server-side SMB signing is enabled, SMB packet signing will be negotiated with client computers that have SMB signing enabled. - Using SMB packet signing can impose up to a 15 percent performance degradation on file service transactions. - There are three other policy settings that relate to packet-signing requirements for Server Message Block (SMB) communications: - - [Microsoft network server: Digitally sign communications (always)](microsoft-network-server-digitally-sign-communications-always.md) - - [Microsoft network client: Digitally sign communications (if server agrees)](microsoft-network-client-digitally-sign-communications-if-server-agrees.md) - - [Microsoft network server: Digitally sign communications (if client agrees)](microsoft-network-server-digitally-sign-communications-if-client-agrees.md) - ### Possible values - - Enabled - - Disabled - - Not defined - ### Best practices - 1. Configure the following security policy settings as follows: - - Disable **Microsoft network client: Digitally sign communications (always)**. - - Disable [Microsoft network server: Digitally sign communications (always)](microsoft-network-server-digitally-sign-communications-always.md). - - Enable [Microsoft network client: Digitally sign communications (if server agrees)](microsoft-network-client-digitally-sign-communications-if-server-agrees.md). - - Enable [Microsoft network server: Digitally sign communications (if client agrees)](microsoft-network-server-digitally-sign-communications-if-client-agrees.md). - 2. Alternately, you can set all of these policy settings to Enabled, but enabling them can cause slower performance on client devices and prevent them from communicating with legacy SMB applications and operating systems. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -106,64 +75,30 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Session hijacking uses tools that allow attackers who have access to the same network as the client device or server to interrupt, end, or steal a session in progress. Attackers can potentially intercept and modify unsigned Server Message Block (SMB) packets and then modify the traffic and forward it so that the server might perform objectionable actions. Alternatively, the attacker could pose as the server or client computer after legitimate authentication, and gain unauthorized access to data. - SMB is the resource-sharing protocol that is supported by many Windows operating systems. It is the basis of NetBIOS and many other protocols. SMB signatures authenticate users and the servers that host the data. If either side fails the authentication process, data transmission does not take place. - ### Countermeasure - Configure the settings as follows: - - Disable **Microsoft network client: Digitally sign communications (always)**. - - Disable [Microsoft network server: Digitally sign communications (always)](microsoft-network-server-digitally-sign-communications-always.md). - - Enable [Microsoft network client: Digitally sign communications (if server agrees)](microsoft-network-client-digitally-sign-communications-if-server-agrees.md). - - Enable [Microsoft network server: Digitally sign communications (if client agrees)](microsoft-network-server-digitally-sign-communications-if-client-agrees.md). - In highly secure environments, we recommend that you configure all of these settings to Enabled. However, that configuration may cause slower performance on client devices and prevent communications with earlier SMB applications and operating systems. - **Note**   An alternative countermeasure that could protect all network traffic is to implement digital signatures with IPsec. There are hardware-based accelerators for IPsec encryption and signing that could be used to minimize the performance impact on the servers' CPUs. No such accelerators are available for SMB signing. -   - ### Potential impact - Implementations of the SMB file and print-sharing protocol support mutual authentication. This prevents session hijacking attacks and supports message authentication to prevent man-in-the-middle attacks. SMB signing provides this authentication by placing a digital signature into each SMB, which is then verified by the client and the server. - Implementation of SMB signing may negatively affect performance because each packet must be signed and verified. If these settings are enabled on a server that is performing multiple roles, such as a small business server that is serving as a domain controller, file server, print server, and application server, performance may be substantially slowed. Additionally, if you configure devices to ignore all unsigned SMB communications, older applications and operating systems cannot connect. However, if you completely disable all SMB signing, computers are vulnerable to session-hijacking attacks. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/microsoft-network-client-digitally-sign-communications-if-server-agrees.md b/windows/keep-secure/microsoft-network-client-digitally-sign-communications-if-server-agrees.md index d9567dee32..287afc0542 100644 --- a/windows/keep-secure/microsoft-network-client-digitally-sign-communications-if-server-agrees.md +++ b/windows/keep-secure/microsoft-network-client-digitally-sign-communications-if-server-agrees.md @@ -2,72 +2,41 @@ title: Microsoft network client Digitally sign communications (if server agrees) (Windows 10) description: Describes the best practices, location, values, and security considerations for the Microsoft network client Digitally sign communications (if server agrees) security policy setting. ms.assetid: e553f700-aae5-425c-8650-f251c90ba5dd +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Microsoft network client: Digitally sign communications (if server agrees) - - **Applies to** - - Windows 10 - Describes the best practices, location, values, and security considerations for the **Microsoft network client: Digitally sign communications (if server agrees)** security policy setting. - ## Reference - - The Server Message Block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with the Server service is permitted. - Implementation of digital signatures in high-security networks helps to prevent the impersonation of client computers and servers, which is known as "session hijacking." But misuse of these policy settings is a common error that can cause data loss or problems with data access or security. - If server-side SMB signing is required, a client computer will not be able to establish a session with that server, unless it has client-side SMB signing enabled. By default, client-side SMB signing is enabled on workstations, servers, and domain controllers. Similarly, if client-side SMB signing is required, that client device will not be able to establish a session with servers that do not have packet signing enabled. By default, server-side SMB signing is enabled only on domain controllers. - If server-side SMB signing is enabled, SMB packet signing will be negotiated with client computers that have SMB signing enabled. - Using SMB packet signing can impose up to a 15 percent performance degradation on file service transactions. - There are three other policy settings that relate to packet-signing requirements for Server Message Block (SMB) communications: - - [Microsoft network server: Digitally sign communications (always)](microsoft-network-server-digitally-sign-communications-always.md) - - [Microsoft network client: Digitally sign communications (always)](microsoft-network-client-digitally-sign-communications-always.md) - - [Microsoft network server: Digitally sign communications (if client agrees)](microsoft-network-server-digitally-sign-communications-if-client-agrees.md) - ### Possible values - - Enabled - - Disabled - - Not defined - ### Best practices - 1. Configure the following security policy settings as follows: - - Disable [Microsoft network client: Digitally sign communications (always)](microsoft-network-client-digitally-sign-communications-always.md). - - Disable [Microsoft network server: Digitally sign communications (always)](microsoft-network-server-digitally-sign-communications-always.md). - - Enable **Microsoft Network Client: Digitally Sign Communications (If Server Agrees)**. - - Enable [Microsoft network server: Digitally sign communications (if client agrees)](microsoft-network-server-digitally-sign-communications-if-client-agrees.md). - 2. Alternately, you can set all of these policy settings to Enabled, but enabling them can cause slower performance on client devices and prevent them from communicating with legacy SMB applications and operating systems. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -106,64 +75,30 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Session hijacking uses tools that allow attackers who have access to the same network as the client or server to interrupt, end, or steal a session in progress. Attackers can potentially intercept and modify unsigned Server Message Block (SMB) packets and then modify the traffic and forward it so that the server might perform objectionable actions. Alternatively, the attacker could pose as the server or client device after legitimate authentication and gain unauthorized access to data. - SMB is the resource-sharing protocol that is supported by many Windows operating systems. It is the basis of NetBIOS and many other protocols. SMB signatures authenticate users and the servers that host the data. If either side fails the authentication process, data transmission does not take place. - ### Countermeasure - Configure the settings as follows: - - Disable [Microsoft network client: Digitally sign communications (always)](microsoft-network-client-digitally-sign-communications-always.md). - - Disable [Microsoft network server: Digitally sign communications (always)](microsoft-network-server-digitally-sign-communications-always.md). - - Enable **Microsoft network client: Digitally sign communications (if server agrees)**. - - Enable [Microsoft network server: Digitally sign communications (if client agrees)](microsoft-network-server-digitally-sign-communications-if-client-agrees.md). - In highly secure environments we recommend that you configure all of these settings to Enabled. However, that configuration may cause slower performance on client devices and prevent communications with earlier SMB applications and operating systems. - **Note**   An alternative countermeasure that could protect all network traffic is to implement digital signatures with IPsec. There are hardware-based accelerators for IPsec encryption and signing that could be used to minimize the performance impact on the servers' CPUs. No such accelerators are available for SMB signing. -   - ### Potential impact - Implementations of the SMB file and print-sharing protocol support mutual authentication. This prevents session hijacking attacks and supports message authentication to prevent man-in-the-middle attacks. SMB signing provides this authentication by placing a digital signature into each SMB, which is then verified by the client and the server. - Implementation of SMB signing may negatively affect performance because each packet must be signed and verified. If these settings are enabled on a server that is performing multiple roles, such as a small business server that is serving as a domain controller, file server, print server, and application server, performance may be substantially slowed. Additionally, if you configure devices to ignore all unsigned SMB communications, older applications and operating systems cannot connect. However, if you completely disable all SMB signing, devices are vulnerable to session-hijacking attacks. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md b/windows/keep-secure/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md index d65dfe9610..c14351f372 100644 --- a/windows/keep-secure/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md +++ b/windows/keep-secure/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md @@ -2,50 +2,30 @@ title: Microsoft network client Send unencrypted password to third-party SMB servers (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Microsoft network client Send unencrypted password to third-party SMB servers security policy setting. ms.assetid: 97a76b93-afa7-4dd9-bb52-7c9e289b6017 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Microsoft network client: Send unencrypted password to third-party SMB servers - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **Microsoft network client: Send unencrypted password to third-party SMB servers** security policy setting. - ## Reference - - The Server Message Block (SMB) protocol provides the basis for file and print sharing and many other networking operations, such as remote Windows administration. This policy setting allows or prevents the SMB redirector to send plaintext passwords to a non-Microsoft server service that does not support password encryption during authentication. - ### Possible values - - Enabled - The Server Message Block (SMB) redirector is allowed to send plaintext passwords to a non-Microsoft server service that does not support password encryption during authentication. - - Disabled - The Server Message Block (SMB) redirector only sends encrypted passwords to non-Microsoft SMB server services. If those server services do not support password encryption, the authentication request will fail. - - Not defined - ### Best practices - - It is advisable to set **Microsoft network client: Send unencrypted password to connect to third-party SMB servers** to Disabled. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -84,45 +64,20 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - If you enable this policy setting, the server can transmit plaintext passwords across the network to other computers that offer SMB services. These other devices might not use any of the SMB security mechanisms that are included with Windows Server 2003 or later. - ### Countermeasure - Disable the **Microsoft network client: Send unencrypted password to connect to third-party SMB servers** setting. - ### Potential impact - Some older applications may not be able to communicate with the servers in your organization by means of the SMB protocol. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md b/windows/keep-secure/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md index 4b1e5d32b1..754051399a 100644 --- a/windows/keep-secure/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md +++ b/windows/keep-secure/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md @@ -2,48 +2,29 @@ title: Microsoft network server Amount of idle time required before suspending session (Windows 10) description: Describes the best practices, location, values, and security considerations for the Microsoft network server Amount of idle time required before suspending session security policy setting. ms.assetid: 8227842a-569d-480f-b43c-43450bbaa722 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Microsoft network server: Amount of idle time required before suspending session - - **Applies to** - - Windows 10 - Describes the best practices, location, values, and security considerations for the **Microsoft network server: Amount of idle time required before suspending session** security policy setting. - ## Reference - - Each Server Message Block (SMB) session consumes server resources. Establishing numerous null sessions will cause the server to slow down or possibly fail. A malicious user might repeatedly establish SMB sessions until the server stops responding; at this point, SMB services will become slow or unresponsive. - The **Microsoft network server: Amount of idle time required before suspending session** policy setting determines the amount of continuous idle time that must pass in an SMB session before the session is suspended due to inactivity. You can use this policy setting to control when a device suspends an inactive SMB session. The session is automatically reestablished when client device activity resumes. - ### Possible values - - A user-defined number of minutes from 0 through 99,999 - For this policy setting, a value of 0 means to disconnect an idle session as quickly as is reasonably possible. The maximum value is 99999, which is 208 days. In effect, this value disables the policy. - - Not defined - ### Best practices - - It is advisable to set this policy to 15 minutes. There will be little impact because SMB sessions will be reestablished automatically if the client resumes activity. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -82,45 +63,20 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Each SMB session consumes server resources, and numerous null sessions slow the server or possibly cause it to fail. An attacker could repeatedly establish SMB sessions until the server's SMB services become slow or unresponsive. - ### Countermeasure - The default behavior on a server mitigates this threat by design. - ### Potential impact - There is little impact because SMB sessions are reestablished automatically if the client computer resumes activity. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md b/windows/keep-secure/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md index ce20b1229e..5a59300d6c 100644 --- a/windows/keep-secure/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md +++ b/windows/keep-secure/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md @@ -2,58 +2,34 @@ title: Microsoft network server Attempt S4U2Self to obtain claim information (Windows 10) description: Describes the best practices, location, values, management, and security considerations for the Microsoft network server Attempt S4U2Self to obtain claim information security policy setting. ms.assetid: e4508387-35ed-4a3f-a47c-27f8396adbba +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Microsoft network server: Attempt S4U2Self to obtain claim information - - **Applies to** - - Windows 10 - Describes the best practices, location, values, management, and security considerations for the **Microsoft network server: Attempt S4U2Self to obtain claim information** security policy setting. - ## Reference - - This security setting supports client devices running a version of Windows prior to Windows 8 that are trying to access a file share that requires user claims. This setting determines whether the local file server will attempt to use Kerberos Service-for-User-to-Self (S4U2Self) functionality to obtain a network client principal’s claims from the client’s account domain. This setting should only be enabled if the file server is using user claims to control access to files, and if the file server will support client principals whose accounts might be in a domain that has client computers and domain controllers running a version of Windows prior to Windows 8 or Windows Server 2012. - When enabled, this security setting causes the Windows file server to examine the access token of an authenticated network client principal and determines if claim information is present. If claims are not present, the file server will then use the Kerberos S4U2Self feature to attempt to contact a Windows Server 2012 domain controller in the client’s account domain and obtain a claims-enabled access token for the client principal. A claims-enabled token might be needed to access files or folders that have claim-based access control policy applied. - If this setting is disabled, the Windows file server will not attempt to obtain a claim-enabled access token for the client principal. - ### Possible values - - **Default** - The Windows file server will examine the access token of an authenticated network client principal and determine if claim information is present. - - **Enabled** - Same as **Default**. - - **Disabled** - - **Not defined** - Same as **Disabled**. - ### Best practices - This setting should be set to **Default** so that the file server can automatically evaluate whether claims are needed for the user. You should explicitly configure this setting to **Enabled** only if there are local file access policies that include user claims. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -92,49 +68,22 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ### Group Policy - This setting should only be enabled if the file server is using user claims to control access to files, and if the file server will support client principals whose accounts might be in a domain that has client computers and domain controllers running a version of Windows prior to Windows 8 or Windows Server 2012. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - None. Enabling this policy setting allows you take advantage of features in Windows Server 2012 and Windows 8 for specific scenarios to use claims-enabled tokens to access files or folders that have claim-based access control policy applied on Windows operating systems prior to Windows Server 2012 and Windows 8. - ### Countermeasure - Not applicable. - ### Potential impact - None. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/microsoft-network-server-digitally-sign-communications-always.md b/windows/keep-secure/microsoft-network-server-digitally-sign-communications-always.md index 91004a814c..224f74984a 100644 --- a/windows/keep-secure/microsoft-network-server-digitally-sign-communications-always.md +++ b/windows/keep-secure/microsoft-network-server-digitally-sign-communications-always.md @@ -2,74 +2,42 @@ title: Microsoft network server Digitally sign communications (always) (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Microsoft network server Digitally sign communications (always) security policy setting. ms.assetid: 2007b622-7bc2-44e8-9cf1-d34b62117ea8 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Microsoft network server: Digitally sign communications (always) - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **Microsoft network server: Digitally sign communications (always)** security policy setting. - ## Reference - - The Server Message Block (SMB) protocol provides the basis for file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with the Server service is permitted. - Implementation of digital signatures in high-security networks helps to prevent the impersonation of client computers and servers, which is known as "session hijacking." But misuse of these policy settings is a common error that can cause data loss or problems with data access or security. - For this policy to take effect on computers running Windows 2000, client-side packet signing must also be enabled. To enable client-side SMB packet signing, set [Microsoft network client: Digitally sign communications (if server agrees)](microsoft-network-client-digitally-sign-communications-if-server-agrees.md). Devices that have this policy set will not be able to communicate with devices that do not have server-side packet signing enabled. By default, server-side packet signing is enabled only on domain controllers. Server-side packet signing can be enabled on devices by setting [Microsoft network server: Digitally sign communications (if client agrees)](microsoft-network-server-digitally-sign-communications-if-client-agrees.md). - If server-side SMB signing is required, a client device will not be able to establish a session with that server, unless it has client-side SMB signing enabled. By default, client-side SMB signing is enabled on workstations, servers, and domain controllers. Similarly, if client-side SMB signing is required, that client device will not be able to establish a session with servers that do not have packet signing enabled. By default, server-side SMB signing is enabled only on domain controllers. - If server-side SMB signing is enabled, SMB packet signing will be negotiated with client devices that have SMB signing enabled. - Using SMB packet signing can impose up to a 15 percent performance degradation on file service transactions. - There are three other policy settings that relate to packet-signing requirements for Server Message Block (SMB) communications: - - [Microsoft network client: Digitally sign communications (always)](microsoft-network-client-digitally-sign-communications-always.md) - - [Microsoft network client: Digitally sign communications (if server agrees)](microsoft-network-client-digitally-sign-communications-if-server-agrees.md) - - [Microsoft network server: Digitally sign communications (if client agrees)](microsoft-network-server-digitally-sign-communications-if-client-agrees.md) - ### Possible values - - Enabled - - Disabled - - Not defined - ### Best practices - 1. Configure the following security policy settings as follows: - - Disable [Microsoft network client: Digitally sign communications (always)](microsoft-network-client-digitally-sign-communications-always.md). - - Disable **Microsoft network server: Digitally sign communications (always)**. - - Enable [Microsoft network client: Digitally sign communications (if server agrees)](microsoft-network-client-digitally-sign-communications-if-server-agrees.md). - - Enable [Microsoft network server: Digitally sign communications (if client agrees)](microsoft-network-server-digitally-sign-communications-if-client-agrees.md). - 2. Alternately, you can set all of these policy settings to Enabled, but enabling them can cause slower performance on client devices and prevent them from communicating with legacy SMB applications and operating systems. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -108,64 +76,30 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Session hijacking uses tools that allow attackers who have access to the same network as the client device or server to interrupt, end, or steal a session in progress. Attackers can potentially intercept and modify unsigned Server Message Block (SMB) packets and then modify the traffic and forward it so that the server might perform objectionable actions. Alternatively, the attacker could pose as the server or client device after legitimate authentication and gain unauthorized access to data. - SMB is the resource-sharing protocol that is supported by many Windows operating systems. It is the basis of NetBIOS and many other protocols. SMB signatures authenticate users and the servers that host the data. If either side fails the authentication process, data transmission does not take place. - ### Countermeasure - Configure the settings as follows: - - Disable [Microsoft network client: Digitally sign communications (always)](microsoft-network-client-digitally-sign-communications-always.md). - - Disable **Microsoft network server: Digitally sign communications (always)**. - - Enable [Microsoft network client: Digitally sign communications (if server agrees)](microsoft-network-client-digitally-sign-communications-if-server-agrees.md). - - Enable [Microsoft network server: Digitally sign communications (if client agrees)](microsoft-network-server-digitally-sign-communications-if-client-agrees.md). - In highly secure environments we recommend that you configure all of these settings to Enabled. However, that configuration may cause slower performance on client devices and prevent communications with earlier SMB applications and operating systems. - **Note**   An alternative countermeasure that could protect all network traffic is to implement digital signatures with IPsec. There are hardware-based accelerators for IPsec encryption and signing that could be used to minimize the performance impact on the servers' CPUs. No such accelerators are available for SMB signing. -   - ### Potential impact - Implementations of the SMB file and print-sharing protocol support mutual authentication. This prevents session hijacking attacks and supports message authentication to prevent man-in-the-middle attacks. SMB signing provides this authentication by placing a digital signature into each SMB, which is then verified by the client and the server. - Implementation of SMB signing may negatively affect performance because each packet must be signed and verified. If these settings are enabled on a server that is performing multiple roles, such as a small business server that is serving as a domain controller, file server, print server, and application server, performance may be substantially slowed. Additionally, if you configure computers to ignore all unsigned SMB communications, older applications and operating systems cannot connect. However, if you completely disable all SMB signing, devices are vulnerable to session-hijacking attacks. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/microsoft-network-server-digitally-sign-communications-if-client-agrees.md b/windows/keep-secure/microsoft-network-server-digitally-sign-communications-if-client-agrees.md index 2a46117e2c..d63b5a83c1 100644 --- a/windows/keep-secure/microsoft-network-server-digitally-sign-communications-if-client-agrees.md +++ b/windows/keep-secure/microsoft-network-server-digitally-sign-communications-if-client-agrees.md @@ -2,72 +2,41 @@ title: Microsoft network server Digitally sign communications (if client agrees) (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Microsoft network server Digitally sign communications (if client agrees) security policy setting. ms.assetid: c92b2e3d-1dbf-4337-a145-b17a585f4fc1 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Microsoft network server: Digitally sign communications (if client agrees) - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **Microsoft network server: Digitally sign communications (if client agrees)** security policy setting. - ## Reference - - The Server Message Block (SMB) protocol provides the basis for file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with the Server service is permitted. - Implementation of digital signatures in high-security networks helps to prevent the impersonation of client computers and servers, which is known as "session hijacking." But misuse of these policy settings is a common error that can cause data loss or problems with data access or security. - If server-side SMB signing is required, a client device will not be able to establish a session with that server, unless it has client-side SMB signing enabled. By default, client-side SMB signing is enabled on workstations, servers, and domain controllers. Similarly, if client-side SMB signing is required, that client device will not be able to establish a session with servers that do not have packet signing enabled. By default, server-side SMB signing is enabled only on domain controllers. - If server-side SMB signing is enabled, SMB packet signing will be negotiated with client computers that have SMB signing enabled. - Using SMB packet signing can impose up to a 15 percent performance degradation on file service transactions. - There are three other policy settings that relate to packet-signing requirements for Server Message Block (SMB) communications: - - [Microsoft network server: Digitally sign communications (always)](microsoft-network-server-digitally-sign-communications-always.md) - - [Microsoft network client: Digitally sign communications (if server agrees)](microsoft-network-client-digitally-sign-communications-if-server-agrees.md) - - [Microsoft network client: Digitally sign communications (always)](microsoft-network-client-digitally-sign-communications-always.md) - ### Possible values - - Enabled - - Disabled - - Not defined - ### Best practices - 1. Configure the following security policy settings as follows: - - Disable [Microsoft network client: Digitally sign communications (always)](microsoft-network-client-digitally-sign-communications-always.md). - - Disable [Microsoft network server: Digitally sign communications (always)](microsoft-network-server-digitally-sign-communications-always.md). - - Enable [Microsoft network server: Digitally sign communications (always)](microsoft-network-server-digitally-sign-communications-always.md). - - Enable **Microsoft Network Server: Digitally Sign Communications (If Client Agrees)**. - 2. Alternately, you can set all of these policy settings to Enabled, but enabling them can cause slower performance on client devices and prevent them from communicating with legacy SMB applications and operating systems. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -106,64 +75,30 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Session hijacking uses tools that allow attackers who have access to the same network as the client device or server to interrupt, end, or steal a session in progress. Attackers can potentially intercept and modify unsigned Server Message Block (SMB) packets and then modify the traffic and forward it so that the server might perform objectionable actions. Alternatively, the attacker could pose as the server or client computer after legitimate authentication and gain unauthorized access to data. - SMB is the resource-sharing protocol that is supported by many Windows operating systems. It is the basis of NetBIOS and many other protocols. SMB signatures authenticate users and the servers that host the data. If either side fails the authentication process, data transmission does not take place. - ### Countermeasure - Configure the settings as follows: - - Disable [Microsoft network client: Digitally sign communications (always)](microsoft-network-client-digitally-sign-communications-always.md). - - Disable [Microsoft network server: Digitally sign communications (always)](microsoft-network-server-digitally-sign-communications-always.md). - - Enable [Microsoft network client: Digitally sign communications (if server agrees)](microsoft-network-client-digitally-sign-communications-if-server-agrees.md). - - Enable **Microsoft network server: Digitally sign communications (if client agrees)**. - In highly secure environments we recommend that you configure all of these settings to Enabled. However, that configuration may cause slower performance on client devices and prevent communications with earlier SMB applications and operating systems. - **Note**   An alternative countermeasure that could protect all network traffic is to implement digital signatures with IPsec. There are hardware-based accelerators for IPsec encryption and signing that could be used to minimize the performance impact on the servers' CPUs. No such accelerators are available for SMB signing. -   - ### Potential impact - SMB file and print-sharing protocol support mutual authentication. This prevents session hijacking attacks and supports message authentication to prevent man-in-the-middle attacks. SMB signing provides this authentication by placing a digital signature into each SMB, which is then verified by the client and the server. - Implementation of SMB signing may negatively affect performance because each packet must be signed and verified. If these settings are enabled on a server that is performing multiple roles, such as a small business server that is serving as a domain controller, file server, print server, and application server, performance may be substantially slowed. Additionally, if you configure computers to ignore all unsigned SMB communications, older applications and operating systems cannot connect. However, if you completely disable all SMB signing, computers are vulnerable to session-hijacking attacks. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md b/windows/keep-secure/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md index 18b1bba108..054c5a3be3 100644 --- a/windows/keep-secure/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md +++ b/windows/keep-secure/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md @@ -2,50 +2,30 @@ title: Microsoft network server Disconnect clients when logon hours expire (Windows 10) description: Describes the best practices, location, values, and security considerations for the Microsoft network server Disconnect clients when logon hours expire security policy setting. ms.assetid: 48b5c424-9ba8-416d-be7d-ccaabb3f49af +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Microsoft network server: Disconnect clients when logon hours expire - - **Applies to** - - Windows 10 - Describes the best practices, location, values, and security considerations for the **Microsoft network server: Disconnect clients when logon hours expire** security policy setting. - ## Reference - - This policy setting enables or disables the forced disconnection of users who are connected to the local device outside their user account's valid logon hours. It affects the SMB component. If you enable this policy setting, client computer sessions with the SMB service are forcibly disconnected when the client's logon hours expire. If you disable this policy setting, established client device sessions are maintained after the client device's logon hours expire. - ### Possible values - - Enabled - Client device sessions with the SMB service are forcibly disconnected when the client device's logon hours expire. If logon hours are not used in your organization, enabling this policy setting will have no impact. - - Disabled - The system maintains an established client device session after the client device's logon hours have expired. - - Not defined - ### Best practices - - If you enable this policy setting, you should also enable [Network security: Force logoff when logon hours expire](network-security-force-logoff-when-logon-hours-expire.md). - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -84,49 +64,22 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ### Group Policy - This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local computer by using the Local Security Policy snap-in. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - If your organization configures logon hours for users, it makes sense to enable this policy setting. Otherwise, users who should not have access to network resources outside of their logon hours can continue to use those resources with sessions that were established during allowed hours. - ### Countermeasure - Enable the **Microsoft network server: Disconnect clients when logon hours expire** setting. - ### Potential impact - If logon hours are not used in your organization, this policy setting has no impact. If logon hours are used, existing user sessions are forcibly terminated when their logon hours expire. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/microsoft-network-server-server-spn-target-name-validation-level.md b/windows/keep-secure/microsoft-network-server-server-spn-target-name-validation-level.md index b53e9c7660..1cd20cf6fd 100644 --- a/windows/keep-secure/microsoft-network-server-server-spn-target-name-validation-level.md +++ b/windows/keep-secure/microsoft-network-server-server-spn-target-name-validation-level.md @@ -2,63 +2,37 @@ title: Microsoft network server Server SPN target name validation level (Windows 10) description: Describes the best practices, location, and values, policy management and security considerations for the Microsoft network server Server SPN target name validation level security policy setting. ms.assetid: 18337f78-eb45-42fd-bdbd-f8cd02c3e154 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Microsoft network server: Server SPN target name validation level - - **Applies to** - - Windows 10 - Describes the best practices, location, and values, policy management and security considerations for the **Microsoft network server: Server SPN target name validation level** security policy setting. - ## Reference - - This policy setting controls the level of validation that a server with shared folders or printers performs on the service principal name (SPN) that is provided by the client device when the client device establishes a session by using the Server Message Block (SMB) protocol. The level of validation can help prevent a class of attacks against SMB services (referred to as SMB relay attacks). This setting affects both SMB1 and SMB2. - Servers that use SMB provide availability to their file systems and other resources, such as printers, to networked client devices. Most servers that use SMB validate user access to resources by using NT Domain authentication (NTLMv1 and NTLMv2) and the Kerberos protocol. - ### Possible values - The options for validation levels are: - - **Off** - The SPN from a SMB client is not required or validated by the SMB server. - - **Accept if provided by client** - The SMB server will accept and validate the SPN provided by the SMB client and allow a session to be established if it matches the SMB server’s list of SPN’s. If the SPN does not match, the session request for that SMB client will be denied. - - **Required from client** - The SMB client must send a SPN name in session setup, and the SPN name provided must match the SMB server that is being requested to establish a connection. If no SPN is provided by the client device, or the SPN provided does not match, the session is denied. - The default setting is Off. - ### Best practices - This setting affects the server SMB behavior, and its implementation should be carefully evaluated and tested to prevent disruptions to file and print serving capabilities. - **Note**   All Windows operating systems support a client-side SMB component and a server-side SMB component. -   - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -97,55 +71,25 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ### Policy conflict considerations - None. - ### Group Policy - This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local computer by using the Local Security Policy snap-in. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - This policy setting controls the level of validation that a server with shared folders or printers performs on the service principal name (SPN) that is provided by the client device when the client device establishes a session by using the SMB protocol. The level of validation can help prevent a class of attacks against SMB servers (referred to as SMB relay attacks). This setting will affect both SMB1 and SMB2. - ### Countermeasure - For countermeasures that are appropriate to your environment, see **Possible values** above. - ### Potential impact - All Windows operating systems support a client-side SMB component and a server-side SMB component. This setting affects the server SMB behavior, and its implementation should be carefully evaluated and tested to prevent disruptions to file and print serving capabilities. - Because the SMB protocol is widely deployed, setting the options to **Accept if provided by client** or **Required from client** will prevent some clients from successfully authenticating to some servers in your environment. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/microsoft-passport-and-password-changes.md b/windows/keep-secure/microsoft-passport-and-password-changes.md index f099cdf2ac..e4f15fc502 100644 --- a/windows/keep-secure/microsoft-passport-and-password-changes.md +++ b/windows/keep-secure/microsoft-passport-and-password-changes.md @@ -2,71 +2,37 @@ title: Microsoft Passport and password changes (Windows 10) description: When you set up Microsoft Passport, the PIN or biometric (Windows Hello) gesture that you use is specific to that device. ms.assetid: 83005FE4-8899-47A6-BEA9-C17CCA0B6B55 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: jdeckerMS --- - # Microsoft Passport and password changes - - **Applies to** - - Windows 10 - Windows 10 Mobile - When you set up Microsoft Passport, the PIN or biometric (Windows Hello) gesture that you use is specific to that device. You can set up Passport for the same account on multiple devices. If the PIN or biometric is configured as part of a Microsoft Passport for Work, changing the account password will not impact sign-in or unlock with these gestures since it uses a key or certificate. However, if Microsoft Passport for Work is not deployed and the password for that account changes, you must provide the new password on each device to continue to use Passport. - ## Example - - Let's suppose that you have set up a PIN for your Microsoft account on **Device A**. You use your PIN to sign in on **Device A** and then change the password for your Microsoft account. - Because you were using **Device A** when you changed your password, the PIN on **Device A** will continue to work with no other action on your part. - Suppose instead that you sign in on **Device B** and change your password for your Microsoft account. The next time that you try to sign in on **Device A** using your PIN, sign-in will fail because the account credentials that Passport on **Device A** knows will be outdated. - **Note**   This example also applies to an Active Directory account when [Passport for Work is not implemented](implement-microsoft-passport-in-your-organization.md). -   - ## How to update Passport after you change your password on another device - - 1. When you try to sign in using your PIN or biometric, you will see the following message: **Your password was changed on a different device. You must sign in to this device once with your new password, and then you can sign in with your PIN.** - 2. Click **OK.** - 3. Click **Sign-in options**. - 4. Click the **Password** button. - 5. Sign in with new password. - 6. The next time that you sign in, you can select **Sign-in options** and then select **PIN** to resume using your PIN. - ## Related topics - - [Manage identity verification using Microsoft Passport](manage-identity-verification-using-microsoft-passport.md) - [Implement Microsoft Passport in your organization](implement-microsoft-passport-in-your-organization.md) - [Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) - [Prepare people to use Microsoft Passport](prepare-people-to-use-microsoft-passport.md) - [Microsoft Passport errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) - [Event ID 300 - Passport successfully created](passport-event-300.md) -   -   - - - - - diff --git a/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md b/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md index af9f471ce3..dc5497f7c0 100644 --- a/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md +++ b/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md @@ -2,47 +2,29 @@ title: Microsoft Passport errors during PIN creation (Windows 10) description: When you set up Microsoft Passport in Windows 10, you may get an error during the Create a work PIN step. ms.assetid: DFEFE22C-4FEF-4FD9-BFC4-9B419C339502 +ms.pagetype: security keywords: ["PIN", "error", "create a work PIN"] ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: jdeckerMS --- - # Microsoft Passport errors during PIN creation - - **Applies to** - - Windows 10 - Windows 10 Mobile - When you set up Microsoft Passport in Windows 10, you may get an error during the **Create a work PIN** step. This topic lists some of the error codes with recommendations for mitigating the problem. If you get an error code that is not listed here, contact Microsoft Support. - ## Where is the error code? - - The following image shows an example of an error during **Create a work PIN**. - ![](images/pinerror.png) - ## Error mitigations - - When a user encounters an error when creating the work PIN, advise the user to try the following steps. Many errors can be mitigated by one of these steps. - 1. Try to create the PIN again. Some errors are transient and resolve themselves. - 2. Log out, log in, and try to create the PIN again. - 3. Reboot the device and then try to create the PIN again. - 4. Unjoin the device from Azure Active Directory (Azure AD), rejoin, and then try to create the PIN again. To unjoin a desktop PC, go to **Settings** > **System** > **About** and select **Disconnect from organization**. To unjoin a device running Windows 10 Mobile, you must [reset the device](http://go.microsoft.com/fwlink/p/?LinkId=715697). - 5. On mobile devices, if you are unable to setup a PIN after multiple attempts, reset your device and start over. For help on how to reset your phone go to [Reset my phone](http://go.microsoft.com/fwlink/p/?LinkId=715697). - If the error occurs again, check the error code against the following table to see if there is another mitigation for that error. When no mitigation is listed in the table, contact Microsoft Support for assistance. - @@ -203,14 +185,9 @@ If the error occurs again, check the error code against the following table to s
-   - ## Errors with unknown mitigation - - For errors listed in this table, contact Microsoft Support for assistance. - | Hex | Cause | |-------------|-------------------------------------------------------------------------------------------------------| | 0x80072f0c | Unknown | @@ -231,29 +208,13 @@ For errors listed in this table, contact Microsoft Support for assistance. | 0x801C03F0 | ​There is no key registered for the user | | 0x801C03F1 | ​There is no UPN in the token | | ​0x801C044C | There is no core window for the current thread | -   - ## Related topics - - [Manage identity verification using Microsoft Passport](manage-identity-verification-using-microsoft-passport.md) - [Implement Microsoft Passport in your organization](implement-microsoft-passport-in-your-organization.md) - [Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) - [Prepare people to use Microsoft Passport](prepare-people-to-use-microsoft-passport.md) - [Microsoft Passport and password changes](microsoft-passport-and-password-changes.md) - [Event ID 300 - Passport successfully created](passport-event-300.md) -   -   - - - - - diff --git a/windows/keep-secure/microsoft-passport-guide.md b/windows/keep-secure/microsoft-passport-guide.md index d2d62ba501..87b60d6e5d 100644 --- a/windows/keep-secure/microsoft-passport-guide.md +++ b/windows/keep-secure/microsoft-passport-guide.md @@ -2,360 +2,183 @@ title: Microsoft Passport guide (Windows 10) description: This guide describes the new Windows Hello and Microsoft Passport technologies that are part of the Windows 10 operating system. ms.assetid: 11EA7826-DA6B-4E5C-99FB-142CC6BD9E84 +ms.pagetype: security keywords: ["security", "credential", "password", "authentication"] ms.prod: W10 ms.mktglfcycl: plan ms.sitesec: library author: challum --- - # Microsoft Passport guide - - **Applies to** - - Windows 10 - This guide describes the new Windows Hello and Microsoft Passport technologies that are part of the Windows 10 operating system. It highlights specific capabilities of these technologies that help mitigate threats from conventional credentials and provides guidance about how to design and deploy these technologies as part of your Windows 10 rollout. - A fundamental assumption about information security is that a system can identify who’s using it. In identifying a user, the system can decide whether the user has identified himself or herself appropriately (a process known as authentication), and then determine what that properly authenticated user should be able to do (a process known as authorization). The overwhelming majority of computer systems deployed throughout the world depend on user credentials as a means of making authentication and authorization decisions, and that means that these systems depend on reusable, user-created passwords for their security. The oft-cited maxim that authentication can involve “something you know, something you have, or something you are” neatly highlights the issue: a reusable password is an authentication factor all by itself, so anyone who knows the password can impersonate the user who owns it. - ## Problems with traditional credentials - - Ever since the mid-1960s, when Fernando Corbató and his team at the Massachusetts Institute of Technology championed the introduction of the password, users and administrators have had to deal with the use of passwords for user authentication and authorization. Over time, the state of the art for password storage and use has advanced somewhat (with password hashing and salt being the two most noticeable improvements), but we’re still faced with two serious problems: passwords are easy to clone and easy to steal. Implementation faults may render them insecure, and users have a hard time balancing convenience and security. - **Credential theft** - The biggest risk of passwords is simple: an attacker can steal them easily. Every place a password is entered, processed, or stored is vulnerable. For example, an attacker can steal a collection of passwords or hashes from an authentication server by eavesdropping on network traffic to an application server, by implanting malware in an application or on a device, by logging user keystrokes on a device, or by watching to see which characters a user types — and those are just the most common attack methods. One can enact more exotic attacks to steal one or many passwords. - The risk of theft is driven by the fact that the authentication factor the password represents is the password. Without additional authentication factors, the system assumes that anyone who knows the password is the authorized user. - Another, related risk is that of credential replay, in which an attacker captures a valid credential by eavesdropping on an insecure network, and then replays it later to impersonate a valid user. Most authentication protocols (including Kerberos and OAuth) protect against replay attacks by including a time stamp in the credential exchange process, but that protects the token that the authentication system issues, not the password that the user provides to get the ticket in the first place. - **Credential reuse** - - - The common approach of using an email address as the user name makes a bad problem worse. An attacker who successfully recovers a user name–password pair from a compromised system can then try that same pair on other systems. Surprisingly often, this tactic works to allow attackers to springboard from a compromised system into other systems. The use of email addresses as user names leads to other problems, too, which we’ll explore later in this guide. - ### - **Trading convenience for complexity** - Most security is a tradeoff between convenience and security: the more secure a system is, the less convenient it will typically be for users. Although system designers and implementers have a broad range of tools to make their systems more secure, users get a vote, too. When users perceive that a security mechanism gets in the way of what they want to do, they often look for ways to circumvent it. This behavior leads to an arms race of sorts, with users adopting strategies to minimize the effort required to comply with their organization’s password policies as those policies evolve. - **Password complexity** - If the major risk to passwords is that an attacker might guess them through brute-force analysis, it might seem reasonable to require users to include a broader character set in their passwords or make them longer, but as a practical matter, password length and complexity requirements have two negative side effects. First, they encourage password reuse. Estimates by [Herley, Florêncio, and van Oorschot](http://go.microsoft.com/fwlink/p/?LinkId=627392) calculate that the stronger a password is, the more likely it is to be reused. Because users put more effort into the creation and memorization of strong passwords, they are much more likely to use the same credential across multiple systems. Second, adding length or character set complexity to passwords does not necessarily make them more difficult to guess. For example, P@ssw0rd1 is nine characters long and includes uppercase and lowercase letters, numbers, and special characters, but it’s easily guessed by many of the common password-cracking tools now available on the Internet. These tools can attack passwords by using a pre-computed dictionary of common passwords, or they can start with a base word such as password, and then apply common character substitutions. A completely random eight-character password might therefore actually take longer to guess than P@ssw0rd123. - **Password expiration** - Because a reusable password is the only authentication factor in password-based systems, designers have attempted to reduce the risk of credential theft and reuse. One common method for doing so is the use of limited-lifetime passwords. Some systems allow for passwords that can be used only once, but by far the more common approach is to make passwords expire after a certain period. Limiting the useful lifetime of a password puts a cap on how long a stolen password will be useful to an attacker. This practice helps protect against cases where a long-lived password is stolen, held, and used for a long time, but it also harkens back to the time when password cracking was impractical for everyone except nation state-level attackers. A smart attacker would attempt to steal passwords rather than crack them because of the time penalty associated with password cracking. - The widespread availability of commodity password-cracking tools and the massive computing power available through mechanisms such as GPU-powered crackers or distributed cloud-based cracking tools has reversed this equation so that it is often more effective for an attacker to crack a password than to try to steal it. In addition, the widespread availability of self-service [password-reset mechanisms](#password-reset) means that an attacker needs only a short window of time during which the password is valid to change the password and thus reset the validity period. Relatively few enterprise networks provide self-service password-reset mechanisms, but they are common for Internet services. In addition, many users use the secure credential store on Windows and Mac OS X systems to store valuable passwords for Internet services, so an attacker who can compromise the operating system password may be able to obtain a treasure trove of other service passwords at no cost. - Finally, overly short timelines for password expiration can tempt users to make small changes in their passwords at each expiration period — for example, moving from password123 to password456 to password789. This approach reduces the work necessary to crack the password, especially if the attacker knows any of the old passwords. - ### - **Password-reset mechanisms** - To let users better manage their own passwords, some services provide a way for users to change their own password. Some implementations require users to log on with their current password, while others allow users to select the **Forgot my password** option, which sends an email to the user’s registered email address. The problem with these mechanisms is that many of them are implemented such that an attacker can exploit them. For example, an attacker who can successfully guess or steal a user’s email password can merrily request password resets for all of the victim’s other accounts, because the reset emails go to the compromised account. For this reason, most enterprise networks are configured so that only administrators can reset user passwords; for example, Active Directory supports the use of a **Password must be changed on next logon** flag so that after the administrator resets a password, the user can reset the password only after providing the administrator-set password. Some mobile device management (MDM) systems support similar functionality for mobile devices. - **User password carelessness** - An insidious problem makes these design and implementation weaknesses worse: some users just aren’t careful with their passwords. They write them down in insecure locations, choose easy-to-guess passwords, take minimal (if any) precautions against malware, or even give their passwords to other people. These users aren’t necessarily careless because they don’t care; they want to get things done, and overly stringent password length or expiration policies or too many passwords hinders them. - **Mitigate credential risks** - Given the issues described so far, it might seem obvious that reusable passwords are a security hazard. The argument is simple: adding authentication factors reduces the value of the passwords themselves, because even a successful password theft won’t let an attacker log on to a system unless he or she also has the associated additional factors. Unfortunately, this simple argument has many practical complications. Security and operating system vendors have tried to solve the problems that reusable credentials pose for decades — with limited success. - The most obvious mitigation to the risks reusable passwords pose is to add one or more authentication factors. At different times over the past 30 years, different vendors have attempted to solve this problem by calling for the use of biometric identifiers (including fingerprints, iris and retina scans, and hand geometry), software-based and hardware-based tokens, physical and virtual smart cards, and voice or Short Message Service (SMS) authentication through the user’s mobile phone. A detailed description of each of these authenticators and its pros and cons is outside the scope of this guide, but no matter which authentication method you choose, core challenges have limited adoption of all Multi-Factor Authentication (MFA) solutions, including: - - **Infrastructure complexity and cost.** Any system that requires the user to provide an additional authentication factor at the point of access has to have a way to collect that information. Although it’s possible to retrofit fielded hardware by adding fingerprint readers, eye scanners, smart card readers, and so on, few enterprises have been willing to take on the cost and support burden required to do so. - - **Lack of standardization.** Although Microsoft included operating system–level smart card support as part of the Windows Vista operating system, smart card and reader vendors were free to continue to ship their own drivers, as were manufacturers of other authentication devices. Lack of standardization led to both application and support fragmentation, which means that it wasn’t always possible to mix and match solutions within an enterprise, even when the manufacturers of those solutions advertised them as being compatible. - - **Backward compatibility.** Retrofitting already-deployed operating systems and applications to use MFA has proven an extremely difficult task. Nearly three years after its release, Microsoft Office 2013 is finally getting support for MFA. The vast majority of both commercial and custom line-of-business (LOB) applications will never be retrofitted to take advantage of any authentication system other than what the underlying operating system provides. - - **User inconvenience.** Solutions that require users to obtain, keep track of, and use physical tokens are often unpopular. If users have to have a particular token for remote access or other scenarios that are supposed to make things more convenient, they tend to become quickly dissatisfied with the burden of keeping up with an additional device. This pushback is multiplied for solutions that have to be attached to computers (such as smart card readers) because such solutions introduce problems of portability, driver support, and operating system and application integration. - - **Device compatibility.** Not every hardware form factor supports every authentication method. For example, despite occasional feeble efforts from vendors, no market for mobile phone-compatible smart card readers ever emerged. So when Microsoft first implemented smart cards as an authenticator for remote network access, one key limitation was that employees could log on only from desktop or laptop computers that had smart card readers. Any authentication method that relies on additional hardware or software may run into this problem. For example, several popular “soft token” systems rely on mobile apps that run on a limited number of mobile hardware platforms. - Another pesky problem has to do with institutional knowledge and maturity. Strong authentication systems are complex. They have lots of components, and they can be expensive to design, maintain, and operate. For some enterprises, the additional cost and overhead of maintaining an in-house public key infrastructure (PKI) to issue smart cards or the burden of managing add-on devices exceeds the value they perceive in having stronger authentication. This is a special case of the common problem that financial institutions face: if the cost of fraud reduction is higher than the cost of the fraud itself, it’s hard to justify the economics of better fraud-prevention measures. - ## Solve credential problems - - Solving the problems that passwords pose is tricky. Tightening password policies alone won’t do it: users may just recycle, share, or write down passwords. Although user education is critical for authentication security, education alone doesn’t eliminate the problem, either. - As you’ve seen, additional authenticators won’t necessarily help if the new authentication systems add complexity, cost, or fragility. In Windows 10, Microsoft addresses these problems with two new technologies: Windows Hello and Microsoft Passport. Working together, these technologies help increase both security and user convenience: - - Microsoft Passport replaces passwords with strong two-factor authentication (2FA) by verifying existing credentials and by creating a device-specific credential that a user gesture (either biometric or PIN-based) protects. This combination effectively replaces physical and virtual smart cards as well as reusable passwords for logon and access control. - - Windows Hello provides reliable, fully integrated biometric authentication based on facial recognition or fingerprint matching. Windows Hello uses a combination of special infrared (IR) cameras and software to increase accuracy and guard against spoofing. Major hardware vendors are shipping devices that have integrated Windows Hello-compatible cameras, and fingerprint reader hardware can be used or added to devices that don’t currently have it. On devices that support Windows Hello, an easy biometric gesture unlocks users’ Microsoft Passport credentials. - ## What is Windows Hello? - - Windows Hello is the name Microsoft has given to the new biometric sign-in system built into Windows 10. Because it is built directly into the operating system, Windows Hello allows face or fingerprint identification to unlock users’ devices. Authentication happens when the user supplies his or her unique biometric identifier to access the device-specific Microsoft Passport credentials, which means that an attacker who steals the device can’t log on to it unless that attacker has the PIN. The Windows secure credential store protects biometric data on the device. By using Windows Hello to unlock a device, the authorized user gains access to all of his or her Windows experience, apps, data, websites, and services. - The Windows Hello authenticator is known as a Hello. A Hello is unique to the combination of an individual device and a specific user; it doesn’t roam among devices, isn’t shared with a server, and cannot easily be extracted from a device. If multiple users share a device, each user gets a unique Hello for that device. You can think of a Hello as a token you can use to unlock (or release) a stored credential: the Hello itself doesn’t authenticate you to an app or service, but it releases credentials that can. - At the launch of Windows 10, the operating system supported three Hello types: - - **PIN.** Before you can use Windows Hello to enable biometrics on a device, you must choose a PIN as your initial Hello gesture. After you’ve set a PIN, you can add biometric gestures if you want to. You can always use the PIN gesture to release your credentials, so you can still unlock and use your device even if you can’t use your preferred biometric because of an injury or because the sensor is unavailable or not working properly. - - **Facial recognition.** This type uses special cameras that see in IR light, which allows them to reliably tell the difference between a photograph or scan and a living person. Several vendors are shipping external cameras that incorporate this technology, and major laptop manufacturers are incorporating it into their devices, as well. - - **Fingerprint recognition.** This type uses a capacitive fingerprint sensor to scan your fingerprint. Fingerprint readers have been available for Windows computers for years, but the current generation of sensors is significantly more reliable and less error-prone. Most existing fingerprint readers (whether external or integrated into laptops or USB keyboards) work with Windows 10. - Biometric data used to implement these Hello gestures is stored securely on the local device only. It doesn’t roam and is never sent to external devices or servers. Because Windows Hello only stores biometric identification data on the device, there’s no single collection point an attacker can compromise to steal biometric data. Breaches that expose biometrics collected and stored for other uses (such as fingerprints collected and stored for law enforcement or background check purposes) don’t pose a significant threat: an attacker who steals biometrics literally has only a template of the identifier, and that template cannot easily be converted to a form that the attacker can present to a biometric sensor. The data path for Windows Hello-compatible sensors is resistant to tampering, too, which further reduces the chance that an attacker will be able to successfully inject faked biometric data. In addition, before an attacker can even attempt to inject data into the sensor pipeline, that attacker must gain physical access to the device — and an attacker who can do that can mount several other, less difficult attacks. - Windows Hello offers several major benefits. First, when combined with Microsoft Passport, it effectively solves the problems of credential theft and sharing. Because an attacker must obtain both the device and the selected biometric, it is much more difficult to gain access without the user’s knowledge. Second, the use of biometrics means that users benefit from having a simple authenticator that’s always with them: there’s nothing to forget, lose, or leave behind. Instead of worrying about memorizing long, complex passwords, users can take advantage of a convenient, secure method for signing in to all their Windows devices. Finally, in many cases, there’s nothing additional to deploy or manage to use Windows Hello (although Microsoft Passport may require additional deployment, as described later in this guide). Windows Hello support is built directly into the operating system, and users or enterprises can add compatible biometric devices to provide biometric gesture recognition, either as part of a coordinated rollout or as individual users or groups decide to add the necessary sensors. Windows Hello is part of Windows, so no additional deployment is required to start using it. - ## What is Microsoft Passport? - - Windows Hello provides a robust way for a device to recognize an individual user; that addresses the first part of the path between a user and a requested service or data item. After the device has recognized the user, however, it still must authenticate the user before deciding whether to grant access to a requested resource. Microsoft Passport provides strong 2FA, fully integrated into Windows, that replaces reusable passwords with the combination of a specific device and a Hello or PIN. Microsoft Passport isn’t just a replacement for traditional 2FA systems, though. It’s conceptually similar to smart cards: authentication is performed by using cryptographic primitives instead of string comparisons, and the user’s key material is secure inside tamper-resistant hardware. Microsoft Passport doesn’t require the extra infrastructure components required for smart card deployment, either. In particular, you don’t need a PKI if you don’t currently have one. Microsoft Passport combines the major advantage of smart cards — deployment flexibility for virtual smart cards and robust security for physical smart cards — without any of their drawbacks. - Microsoft Passport offers four significant advantages over the current state of Windows authentication: it’s more flexible, it’s based on industry standards, it’s an effective risk mitigator, and it’s ready for the enterprise. Let’s look at each of these advantages in more detail. - **It’s flexible** - Microsoft Passport offers unprecedented flexibility. Although the format and use of reusable passwords are fixed, Microsoft Passport gives both administrators and users options to manage authentication. First and foremost, Microsoft Passport works with both biometric identifiers and PINs, so users’ credentials are protected even on devices that don’t support biometrics. Users can even use their phone to release their credentials instead of a PIN or biometric gesture on the main device. Microsoft Passport seamlessly takes advantage of the hardware of the devices in use; as users upgrade to newer devices, Microsoft Passport is ready to use them, and organizations can upgrade existing devices by adding biometric sensors where appropriate. - Microsoft Passport offers flexibility in the datacenter, too. To deploy it, in some modes you must add Windows Server 2016 Technical Preview domain controllers to your Active Directory environment, but you don’t have to replace or remove your existing Active Directory servers — the servers required for Microsoft Passport build on and add capability to your existing infrastructure. You don’t have to change the domain or forest functional level, and you can either add on-premises servers or use Microsoft Azure Active Directory to deploy Microsoft Passport on your network. The choice of which users you should enable for Microsoft Passport use is completely up to you: you choose the policies and devices to support and which authentication factors you want users to have access to. This makes it easy to use Microsoft Passport to supplement existing smart card or token deployments by adding strong credential protection to users who don’t currently have it or to deploy Microsoft Passport in scenarios that call for extra protection for sensitive resources or systems (described in the [Design a Microsoft Passport deployment](#design) section). - **It’s standardized** - Both software vendors and enterprise customers have come to realize that proprietary identity and authentication systems are a dead end. The future lies with open, interoperable systems that allow secure authentication across a variety of devices, LOBs, and external applications and websites. To this end, a group of industry players formed the Fast IDentity Online Alliance (FIDO), a nonprofit organization intended to address the lack of interoperability among strong authentication devices as well as the problems users face when they have to create and remember multiple user names and passwords. The FIDO Alliance plans to change the nature of authentication by developing specifications that define an open, scalable, interoperable set of mechanisms that supplant reliance on passwords to securely authenticate users of online services. This new standard for security devices and browser plug ins will allow any website or cloud application to interface with a broad variety of existing and future FIDO-enabled devices that the user has for online security. For more information, see the [FIDO Alliance website](http://go.microsoft.com/fwlink/p/?LinkId=627393). - In 2013, Microsoft joined the FIDO Alliance. FIDO standards enable a universal framework that a global ecosystem delivers for a consistent and greatly improved user experience of strong passwordless authentication. The FIDO 1.0 specifications, published in December 2014, provide for two types of authentications: passwordless (known as the Universal Authentication Framework \[UAF\]) and 2nd Factor (U2F). The FIDO Alliance is working on a set of 2.0 proposals to combine the best parts of the U2F and UAF FIDO 1.0 standards. Microsoft is actively contributing to the proposals, and Windows 10 is a reference implementation of these concepts. In addition to supporting those protocols, the Windows implementation covers other aspects of the end-to-end experience that the specification does not cover, including user interface to, storage of, and protection for users’ device keys and the tokens issued after authentication; supporting administrator policies; and providing deployment tools. Microsoft expects to continue working with the FIDO Alliance as the FIDO 2.0 specification moves forward. Interoperability of FIDO products is a hallmark of FIDO authentication. Microsoft believes that bringing a FIDO solution to market will help solve a critical need for enterprises and consumers alike. - **It’s effective** - Microsoft Passport effectively mitigates two major security risks. First, by eliminating the use of reusable passwords for logon, it reduces the risk that a user’s credential will be copied or reused. On devices that support the Trusted Platform Module (TPM) standard, user key material can be stored in the user device’s TPM, which makes it more difficult for an attacker to capture the key material and reuse it. For devices that lack TPM, Microsoft Passport can encrypt and store credential data in software, but administrators can disable this feature to force a “TPM or nothing” deployment. - Second, because Microsoft Passport doesn’t depend on a single, centralized server, the risk of compromise from a breach of that server is removed. Although an attacker could theoretically compromise a single device, there’s no single point of attack that an intruder can leverage to gain widespread access to the environment. - **It’s enterprise-ready** - Every edition of Windows 10 includes Microsoft Passport functionality for individual use; enterprise and personal users can take advantage of Microsoft Passport to protect their individual credentials with compatible applications and services. In addition, enterprises whose users are running Windows 10 Professional and Windows 10 Enterprise have the ability to use Microsoft Passport for Work, an enhanced version of Microsoft Passport that includes the ability to centrally manage Microsoft Passport settings for PIN strength and biometric use through Group Policy Objects (GPOs). - ## How Microsoft Passport works - - To use Microsoft Passport to sign in with an identity provider (IDP), a user needs a configured device, which means that the Microsoft Passport life cycle starts when you configure a device for Microsoft Passport use. When the device is set up, its user can use the device to authenticate to services. In this section, we explore how device registration works, what happens when a user requests authentication, how key material is stored and processed, and which servers and infrastructure components are involved in different parts of this process. - **Register a new user or device** - A goal of Microsoft Passport is to allow a user to open a brand-new device, securely join an organizational network to download and manage organizational data, and create a new Hello gesture to secure the device. Microsoft refers to the process of setting up a device for use with Microsoft Passport as registration. - **Note**   This is separate from the organizational configuration required to use Microsoft Passport with Active Directory or Azure AD; that configuration is discussed later in this guide. This configuration must be completed before users can begin to register. -   - The registration process works like this: - 1. The user configures an account on the device. - This account can be a local account on the device, a domain account stored in the on-premises Active Directory domain, a Microsoft account, or an Azure AD account. For a new device, this step may be as simple as logging on with a Microsoft account. Logging on with a Microsoft account on a Windows 10 device automatically sets up Microsoft Passport on the device; users don’t have to do anything extra to enable it. - 2. To log on using that account, the user has to enter the existing credentials for it. - The IDP that “owns” the account receives the credentials and authenticates the user. This IDP authentication may include the use of an existing second authentication factor, or proof. For example, a user who registers a new device by using an Azure AD account will have to provide an SMS-based proof that Azure AD sends. - 3. When the user has provided the proof to the IDP, the user enables PIN authentication (Figure 1). - The PIN will be associated with this particular credential. - ![figure 1](images/passport-fig1.png) - Figure 1. Set up a PIN in the **Account Settings** control panel item - When the user sets the PIN, it becomes usable immediately (Figure 2). - ![figure 2](images/passport-fig2-pinimmeduse.png) - Figure 2. When set, the PIN is immediately usable - Remember that Microsoft Passport depends on pairing a device and a credential, so the PIN chosen is associated only with the combination of the active account and that specific device. The PIN must comply with whatever length and complexity policy the account administrator has configured; this policy is enforced on the device side. Other registration scenarios that Microsoft Passport supports are: - - A user who upgrades from the Windows 8.1 operating system will log on by using his or her existing enterprise password. That triggers MFA from the IDP side; after receiving and returning a proof, such as a text message or voice code, the IDP authenticates the user to the upgraded Windows 10 device, and the user can set his or her PIN. - - A user who typically uses a smart card to log on will be prompted to set up a PIN the first time he or she logs on to a Windows 10 device the user has not previously logged on to. - - A user who typically uses a virtual smart card to log on will be prompted to set up a PIN the first time he or she logs on to a Windows 10 device the user has not previously logged on to. - When the user has completed this process, Microsoft Passport generates a new public–private key pair on the device. The TPM generates and stores this private key; if the device doesn’t have a TPM, the private key is encrypted and stored in software. This initial key is referred to as the protector key. It’s associated only with a single gesture; in other words, if a user registers a PIN, a fingerprint, and a face on the same device, each of those gestures will have a unique protector key. The protector key securely wraps the authentication key for a specific container. Each container has only one authentication key, but there can be multiple copies of that key wrapped with different unique protector keys (each of which is associated with a unique gesture). Microsoft Passport also generates an administrative key that the user or administrator can use to reset credentials, when necessary. In addition to the protector key, TPM-enabled devices generate a block of data that contains attestations from the TPM. - At this point, the user has a PIN gesture defined on the device and an associated protector key for that PIN gesture. That means he or she is able to securely log on to the device with the PIN and thus that he or she can establish a trusted session with the device to add support for a biometric gesture as an alternative for the PIN. When you add a biometric gesture, it follows the same basic sequence: the user authenticates to the system by using his or her PIN, and then registers the new biometric (“smile for the camera!”), after which Windows generates a unique key pair and stores it securely. Future logons can then use either the PIN or the registered biometric gestures. - **What’s a container?** - You’ll often hear the term *container* used in reference to MDM solutions. Microsoft Passport uses the term, too, but in a slightly different way. Container in this context is shorthand for a logical grouping of key material or data. Windows 10 supports two containers: the default container holds user key material for personal accounts, including key material associated with the user’s Microsoft account or with other consumer identity providers, and the enterprise container holds credentials associated with a workplace or school account. - The enterprise container exists only on devices that have been registered with an organization; it contains key material for the enterprise IDP, such as on-premises Active Directory or Azure AD. The enterprise container contains only key data for Active Directory or Azure AD. If the enterprise container is present on a device, it’s unlocked separately from the default container, which maintains separation of data and access across personal and enterprise credentials and services. For example, a user who uses a biometric gesture to log on to a managed computer can separately unlock his or her personal container by entering a PIN when logging on to make a purchase from a website. - These containers are logically separate. Organizations don’t have any control over the credentials users store in the default container, and applications that authenticate against services in the default container can’t use credentials from the enterprise container. However, individual Windows applications can use the Microsoft Passport application programming interfaces (APIs) to request access to credentials as appropriate, so that both consumer and LOB applications can be enhanced to take advantage of Microsoft Passport. - It’s important to keep in mind that there are no physical containers on disk, in the registry, or elsewhere. Containers are logical units used to group related items. The keys, certificates, and credentials Microsoft Passport stores are protected without the creation of actual containers or folders. - Each container actually contains a set of keys, some of which are used to protect other keys. Figure 3 shows an example: the protector key is used to encrypt the authentication key, and the authentication key is used to encrypt the individual keys stored in the container. - ![figure 3](images/passport-fig3-logicalcontainer.png) - Figure 3. Each logical container holds one or more sets of keys - Containers can contain several types of key material: - - An *authentication key*, which is always an asymmetric public–private key pair. This key pair is generated during registration. It must be unlocked each time it’s accessed, by using either the user’s PIN or a previously generated biometric gesture. The authentication key exists until the user resets the PIN, at which time a new key will be generated. When the new key is generated, all the key material that the old key previously protected must be decrypted and re-encrypted using the new key. - - *Virtual smart card keys* are generated when a virtual smart card is generated and stored securely in the container. They’re available whenever the user’s container is unlocked. - - *Secure/Multipurpose Internet Mail Extensions (S/MIME) keys and certificates*, which a certification authority (CA) generates. The keys associated with the user’s S/MIME certificate can be stored in a Microsoft Passport container so they’re available to the user whenever the container is unlocked. - - The *IDP key*. These keys can be either symmetric or asymmetric, depending on which IDP you use. A single container may contain zero or more IDP keys, with some restrictions (for example, the enterprise container can contain zero or one IDP keys). IDP keys are stored in the container as illustrated in Figure 3. For certificate-based Microsoft Passport for Work, when the container is unlocked, applications that require access to the IDP key or key pair can request access. IDP keys are used to sign or encrypt authentication requests or tokens sent from this machine to the IDP. IDP keys are typically long lived but could have a shorter lifetime than the authentication key. - Microsoft accounts, Active Directory accounts, and Azure AD accounts all require the use of asymmetric key pairs. The device generates public and private keys, registers the public key with the IDP (which stores it for later verification), and securely stores the private key. For enterprises, the IDP keys can be generated in two ways: - - The IDP key pair can be associated with an enterprise CA through the Windows Network Device Enrollment Service (NDES), described more fully in [Network Device Enrollment Service Guidance](http://go.microsoft.com/fwlink/p/?LinkId=733947). In this case, Microsoft Passport requests a new certificate with the same key as the certificate from the existing PKI. This option lets organizations that have an existing PKI continue to use it where appropriate. Given that many applications, such as popular virtual private network systems, require the use of certificates, when you deploy Microsoft Passport in this mode, it allows a faster transition away from user passwords while still preserving certificate-based functionality. This option also allows the enterprise to store additional certificates in the protected container. - - The IDP can generate the IDP key pair directly, which allows quick, lower-overhead deployment of Microsoft Passport in environments that don’t have or need a PKI. - **How keys are protected** - Any time key material is generated, it must be protected against attack. The most robust way to do this is through specialized hardware. There’s a long history of using hardware security modules (HSMs) to generate, store, and process keys for security-critical applications. Smart cards are a special type of HSM, as are devices that are compliant with the Trusted Computing Group TPM standard. Wherever possible, the Microsoft Passport for Work implementation takes advantage of onboard TPM hardware to generate, store, and process keys. However, Microsoft Passport and Microsoft Passport for Work do not require an onboard TPM. Administrators can choose to allow key operations in software, in which case any user who has (or can escalate to) administrative rights on the machine can use the IDP keys to sign requests. As an alternative, in some scenarios, devices that don’t have a TPM can be remotely authenticated by using a device that does have a TPM, in which case all the sensitive operations are performed with the TPM and no key material is exposed. - Whenever possible, Microsoft recommends the use of TPM hardware. The TPM protects against a variety of known and potential attacks, including PIN brute-force attacks. The TPM provides an additional layer of protection after an account lockout, too. When the TPM has locked the key material, the user will have to reset the PIN (which means he or she will have to use MFA to reauthenticate to the IDP before the IDP allows him or her to re-register). Resetting the PIN means that all keys and certificates encrypted with the old key material will be removed. - **Authentication** - When a user wants to access protected key material — perhaps to use an Internet site that requires a logon or to access protected resources on a corporate intranet — the authentication process begins with the user entering a PIN or biometric gesture to unlock the device, a process sometimes called *releasing the key*. Think of it like using a physical key to unlock a door: before you can unlock the door, you need to remove the key from your pocket or purse. On a personal device that’s connected to an organizational network, users will use their personal PIN or biometric to release the key; on a device joined to an on-premises or Azure AD domain, they will use the organizational PIN. - This process unlocks the protector key for the primary container on the device. When that container is unlocked, applications (and thus the user) can use whatever IDP keys reside inside the container. - These keys are used to sign requests that are sent to the IDP, requesting access to specified resources. It’s important to understand that although the keys are unlocked, applications cannot use them at will. Applications can use specific APIs to request operations that require key material for particular actions (for example, decrypt an email message or log on to a website). Access through these APIs doesn’t require explicit validation through a user gesture, and the key material isn’t exposed to the requesting application. Rather, the application asks for authentication, encryption, or decryption, and the Microsoft Passport layer handles the actual work and returns the results. Where appropriate, an application can request a forced authentication even on an unlocked device. Windows prompts the user to reenter the PIN or perform an authentication gesture, which adds an extra level of protection for sensitive data or actions. For example, you can configure the Windows Store to require reauthentication any time a user purchases an application, even though the same account and PIN or gesture were already used to unlock the device. - The actual authentication process works like this: - 1. The client sends an empty authentication request to the IDP. (This is merely for the handshake process.) - 2. The IDP returns a challenge, known as a *nonce*. - 3. The device signs the nonce with the appropriate private key. - 4. The device returns the original nonce, the signed nonce, and the ID of the key used to sign the nonce. - 5. The IDP fetches the public key that the key ID specified, uses it to verify the signature on the nonce, and verifies that the nonce the device returned matches the original. - 6. If all the checks in step 5 succeed, the IDP returns two data items: a symmetric key, which is encrypted with the device’s public key, and a security token, which is encrypted with the symmetric key. - 7. The device uses its private key to decrypt the symmetric key, and then uses that symmetric key to decrypt the token. - 8. The device makes a normal authentication request for the original resource, presenting the token from the IDP as its proof of authentication. - When the IDP validates the signature, it is verifying that the request came from the specified user and device. The private key specific to the device signs the nonce, which allows the IDP to determine the identity of the requesting user and device so that it can apply policies for content access based on user, device type, or both together. For example, an IDP could allow access to one set of resources only from mobile devices and a different set from desktop devices. - Remote unlock, which is planned for a future release of Windows 10, builds on these scenarios by enabling seamless remote authentication from a mobile device as a second factor. For example, suppose that you’re visiting another office at your company and you need to borrow a computer there temporarily, but you don’t want to potentially expose your credentials to capture. Rather than type in your credentials, you can click **other user** on the Windows 10 logon screen, type your user name, pick the tile for remote authentication, and use an app on your phone, which you already unlocked by using its built-in facial-recognition sensors. The phone and computer are paired and handshake via Bluetooth, you type your authentication PIN on the phone, and the computer gets confirmation of your identity from the IDP. All this happens without typing a password anywhere or typing your PIN on the PC. - **The infrastructure** - Microsoft Passport depends on having compatible IDPs available to it. As of this writing, that means you have four deployment possibilities: - - Use an existing Windows-based PKI centered around Active Directory Certificate Services. This option requires additional infrastructure, including a way to issue certificates to devices. You can use NDES to register devices directly, Microsoft System Center Configuration Manager Technical Preview or later for on-premises environments, or Microsoft Intune where it’s available to manage mobile device participation in Microsoft Passport. - - You can configure Windows Server 2016 Technical Preview domain controllers to act as IDPs for Microsoft Passport. In this mode, the Windows Server 2016 Technical Preview domain controllers act as IDPs alongside any existing Windows Server 2008 R2 or later domain controllers. There is no requirement to replace all existing domain controllers, merely to introduce at least one Windows Server 2016 Technical Preview domain controller per Active Directory site and update the forest Active Directory Domain Services (AD DS) schema to Windows Server 2016 Technical Preview. - - The normal discovery mechanism that clients use to find domain controllers and global catalogs relies on Domain Name System (DNS) SRV records, but those records don’t contain version data. Windows 10 computers will query DNS for SRV records to find all available Active Directory servers, and then query each server to identify those that can act as Microsoft Passport IDPs. The number of authentication requests your users generate, where your users are located, and the design of your network all drive the number of Windows Server 2016 Technical Preview domain controllers required. - - Azure AD can act as an IDP either by itself or alongside an on-premises AD DS forest. Organizations that use Azure AD can register devices directly without having to join them to a local domain by using the capabilities the Azure AD Device Registration service provides. - In addition to the IDP, Microsoft Passport requires an MDM system. This system can be the cloud-based Intune if you use Azure AD, or an on-premises System Center Configuration Manager deployment that meets the system requirements described in the [Deployment requirements](#deployreq) section of this document. - ## Design a Microsoft Passport for Work deployment - - Microsoft Passport for Work is designed for integration with your existing and future directory infrastructure and device deployments, but this flexibility means there are many considerations to think about when you design your deployment. Some of these decisions are technical, while others are organizational or even political. In this section, we examine the key points where you have to make decisions about how to implement Microsoft Passport for Work. Remember, individual devices can use the individual version of Microsoft Passport without any infrastructure changes on your part. Microsoft Passport for Work allows you to control and centrally manage user authentication and device registration. To use the initial version of Microsoft Passport for Work, each device must have an Azure AD identity, so automatic registration of devices provides a means both to register new devices and to apply optional policies to manage Microsoft Passport for Work. - **One deployment strategy** - Different organizations will necessarily take different approaches to the deployment of Microsoft Passport depending on their capabilities and needs, but there is only one strategy: deploy Microsoft Passport for Work throughout the organization to get maximum protection for the maximum number of devices and resources. Organizations can take one of three basic routes to accomplish that strategy: - - Deploy Microsoft Passport for Work everywhere according to whatever device or user deployment strategy works best for the organization. - - Deploy Microsoft Passport for Work first to high-value or high-risk targets, by using conditional access policies to restrict access to key resources only to users who hold strong authentication credentials. - - Blend Microsoft Passport for Work into an existing multi-factor environment, using it as an additional form of strong authentication alongside physical or virtual smart cards. - **Deploy Microsoft Passport for Work everywhere** - In this approach, you deploy Microsoft Passport throughout the organization in a coordinated rollout. In some ways, this method is similar to any other desktop deployment project; the only real difference is that you must already have the Microsoft Passport infrastructure in place to support device registration before you can start using Microsoft Passport on Windows 10 devices. - **Note**   You can still upgrade to Windows 10 or add new Windows 10 devices without changing your infrastructure. You just can’t use Microsoft Passport for Work on a device until the device joins Azure AD and receives the appropriate policy. -   - The major benefit of this approach is that it provides uniform protection for all parts of the organization. Sophisticated attackers have shown a great deal of skill in breaching large organizations by identifying weak points in their security, including users and systems that don’t have high-value information but that can be exploited to get it. Applying consistent protection across every device that an attacker could use to access enterprise data is excellent protection against these types of attacks. - The downside to this approach is its complexity. Smaller organizations may find that managing the rollout of a new operating system across all devices is beyond the scope of their experience and capability. For these organizations, users can self-upgrade, and new users may end up with Windows 10 because they get new devices when they join. Larger organizations, especially those that are highly decentralized or have operations across many physical sites, may have more deployment knowledge and resources but face the challenge of coordinating rollout efforts across a larger user base and footprint. - For more information about desktop deployment of Windows 10, visit the [Windows 10 TechCenter](http://go.microsoft.com/fwlink/p/?LinkId=626581). - One key aspect of this deployment strategy is how to get Windows 10 in users’ hands. Because different organizations have wildly differing strategies to refresh hardware and software, there’s no one-size-fits-all strategy. For example, some organizations pursue a coordinated strategy that puts new desktop operating systems in users’ hands every 2–3 years on existing hardware, supplementing with new hardware only where and when required. Others tend to replace hardware and deploy whatever version of the Windows client operating system ships on the purchased devices. In both cases, there are typically separate deployment cycles for servers and server operating systems, and the desktop and server cycles may or may not be coordinated. - In addition to the issue of Windows 10 deployment to users, you must consider how and when (or if!) you’ll deploy biometric devices to users. Because Windows Hello can take advantage of multiple biometric identifiers, you have a flexible range of device options, which includes the purchase of new devices that incorporate your selected biometric, seeding select users with appropriate devices, rollout of biometric devices as part of a scheduled hardware refresh and using PIN gestures until users get devices, or relying on remote unlock as a second authentication factor. - **Deploy to high-value or high-risk targets** - This strategy takes into account the fact that in most networks, not every asset is equally protected or equally valuable. There are two ways to think about this. One is that you can focus on protecting the users and services that are most at risk of compromise because of their value. Examples include sensitive internal databases or the user accounts of your key executives. The other option is that you can focus on areas of your network that are the most vulnerable, such as users who travel frequently (and thus run a higher risk of lost or stolen devices or drive-by credential theft). Either way, the strategy is the same: selectively and quickly deploy Microsoft Passport to protect specific people and resources. For example, you might issue new Windows 10 devices with biometric sensors to all users who need access to a sensitive internal database, and then deploy the minimum required infrastructure to support Microsoft Passport–secured access to that database for those users. - One of the key design capabilities of Microsoft Passport for Work is that it supports Bring Your Own Device (BYOD) environments by allowing users to register their own devices with the organizational IDP (whether on premises, hybrid, or Azure AD). You may be able to take advantage of this capability to quickly deploy Microsoft Passport to protect your most vulnerable users or assets, ideally by using biometrics as an additional safety measure for the most valuable potential targets. - **Blend Microsoft Passport with your infrastructure** - Organizations that have already invested in smart cards, virtual smart cards, or token-based systems can still benefit from Microsoft Passport. Of those organizations, many use physical tokens and smart cards to protect only critical assets because of the expense and complexity of their deployment. Microsoft Passport offers a valuable complement to these systems because it protects users who currently rely on reusable credentials; protection of all users’ credentials is an important step toward blunting attacks that seek to leverage compromise of any credential into a widespread breach. This approach also gives you a great deal of flexibility in scheduling and deployment. - Some enterprises have deployed multi-use smart cards that provide building-access control, access to copiers or other office equipment, stored value for lunchroom purchases, remote network access, and other services. Deployment of Microsoft Passport in such environments doesn’t prevent you from continuing to use smart cards for these services. You can leave the existing smart card infrastructure in place for its existing use cases, and then register desktop and mobile devices in Microsoft Passport and use Microsoft Passport to secure access to network and Internet resources. This approach requires a more complicated infrastructure and a greater degree of organizational maturity because it requires you to link your existing PKI with an enrollment service and Microsoft Passport itself. - Smart cards can act as a useful complement to Microsoft Passport in another important way: to bootstrap the initial logon for Microsoft Passport registration. When a user registers with Microsoft Passport on a device, part of that registration process requires a conventional logon. Rather than using a traditional password, organizations that have previously deployed the necessary infrastructure for smart cards or virtual smart cards can allow their users to register new devices by logging on with a smart card or virtual smart card. After the user has proved his or her identity to the organizational IDP with the smart card, the user can set up a PIN and proceed to use Microsoft Passport for future logons. - **Choose a rollout method** - Which rollout method you choose depends on several factors: - - **How many devices you need to deploy.** This number has a huge influence on your overall deployment. A global rollout for 75,000 users has different requirements than a phased rollout for groups of 200–300 users in different cities. - - **How quickly you want to deploy Microsoft Passport for Work protection.** This is a classic cost–benefit tradeoff. You have to balance the security benefits of Microsoft Passport for Work against the cost and time required to deploy it broadly, and different organizations may make entirely different decisions depending on how they rate the costs and benefits involved. Getting the broadest possible Microsoft Passport coverage in the shortest time possible maximizes security benefits. - - **The type of devices you want to deploy.** Windows device manufacturers are aggressively introducing new devices optimized for Windows 10, leading to the possibility that you might deploy Microsoft Passport first on newly purchased tablets and portable devices, and then deploy it on the desktop as part of your normal refresh cycle. - - **What your current infrastructure looks like.** The individual version of Microsoft Passport doesn’t require changes to your Active Directory environment, but to support Microsoft Passport for Work, you may need a compatible MDM system. Depending on the size and composition of your network, mobile enrollment and management services deployment may be a major project in its own right. - - **Your plans for the cloud.** If you’re already planning a move to the cloud, Azure AD eases the process of Microsoft Passport for Work deployment, because you can use Azure AD as an IDP alongside your existing on-premises AD DS setup without making significant changes to your on-premises environment. Future versions of Microsoft Passport for Work will support the ability to simultaneously register devices that are already members of an on-premises AD DS domain in an Azure AD partition so that they use Microsoft Passport for Work from the cloud. Hybrid deployments that combine AD DS with Azure AD give you the ability to keep machine authentication and policy management against your local AD DS domain while providing the full set of Microsoft Passport for Work services (and Microsoft Office 365 integration) for your users. If you plan to use on-premises AD DS only, then the design and configuration of your on-premises environment will dictate what kind of changes you may need to make. - ### - **Deployment requirements** - Table 1 lists six scenarios for deployment of Microsoft Passport for Work in the enterprise. The initial release of Windows 10 supports Azure AD–only scenarios, with support for on-premises Microsoft Passport for Work planned for a future release (see the [Roadmap](#roadmap) section for more details). - Depending on the scenario you choose, Microsoft Passport for Work deployment may require four elements: - - An organizational IDP that supports Microsoft Passport. This can be Azure AD or a set of on-premises Windows Server 2016 Technical Preview domain controllers in an existing AD DS forest. Using Azure AD means that you can establish hybrid identity management, with Azure AD acting as a Microsoft Passport IDP and your on-premises AD DS environment handling older authentication requests. This approach provides all the flexibility of Azure AD with the ability to manage computer accounts and devices running older versions of Windows and on-premises applications such as Microsoft Exchange Server or Microsoft SharePoint. - - If you use certificates, an MDM system is required to allow policy management of Microsoft Passport for Work. Domain-joined devices in on-premises or hybrid deployments require Configuration Manager Technical Preview or later. Deployments with Azure AD must use either Intune or a compatible non-Microsoft MDM solution. - - On-premises deployments require the forthcoming Active Directory Federation Services (AD FS) version included in Windows Server 2016 Technical Preview to support provisioning of Microsoft Passport credentials to devices. In this scenario, AD FS takes the place of the provisioning that Azure AD performs in cloud-based deployments. - - Certificate-based Microsoft Passport deployments require a PKI, including CAs that are accessible to all devices that need to register. If you deploy certificate-based Microsoft Passport on premises, you don’t actually need Windows Server 2016 Technical Preview domain controllers. On-premises deployments do need to apply the Windows Server 2016 Technical Preview AD DS schema and have the Windows Server 2016 Technical Preview version of AD FS installed. - Table 1. Deployment requirements for Microsoft Passport - @@ -402,88 +225,42 @@ Table 1. Deployment requirements for Microsoft Passport
-   - Note that the current release of Windows 10 supports the Azure AD–only scenarios. Microsoft provides the forward-looking guidance in Table 1 to help organizations prepare their environments for planned future releases of Microsoft Passport for Work capabilities. - **Select policy settings** - Another key aspect of Microsoft Passport for Work deployment involves the choice of which policy settings to apply to the enterprise. There are two parts to this choice: which policies you deploy to manage Microsoft Passport itself and which policies you deploy to control device management and registration. A complete guide to selecting effective policies is beyond the scope of this guide, but one example reference that may be useful is [Mobile device management capabilities in Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkId=733877). - ## Implement Microsoft Passport - - No configuration is necessary to use Windows Hello or Microsoft Passport on individual user devices if those users just want to protect their personal credentials. Unless the enterprise disables the feature, users have the option to use Microsoft Passport for their personal credentials, even on devices that are registered with an organizational IDP. However, when you make Microsoft Passport for Work available for users, you must add the necessary components to your infrastructure, as described earlier in the [Deployment requirements](#deployreq) section. - **How to use Azure AD** - There are three scenarios for using Microsoft Passport for Work in Azure AD–only organizations: - - **Organizations that use the version of Azure AD included with Office 365.** For these organizations, no additional work is necessary. When Windows 10 was released to general availability, Microsoft changed the behavior of the Office 365 Azure AD stack. When a user selects the option to join a work or school network (Figure 4), the device is automatically joined to the Office 365 tenant’s directory partition, a certificate is issued for the device, and it becomes eligible for Office 365 MDM if the tenant has subscribed to that feature. In addition, the user will be prompted to log on and, if MFA is enabled, to enter an MFA proof that Azure AD sends to his or her phone. - - **Organizations that use the free tier of Azure AD.** For these organizations, Microsoft has not enabled automatic domain join to Azure AD. Organizations that have signed up for the free tier have the option to enable or disable this feature, so automatic domain join won’t be enabled unless and until the organization’s administrators decide to enable it. When that feature is enabled, devices that join the Azure AD domain by using the **Connect to work or school** dialog box shown in Figure 4 will be automatically registered with Microsoft Passport for Work support, but previously joined devices will not be registered. - - **Organizations that have subscribed to Azure AD Premium have access to the full set of Azure AD MDM features.** These features include controls to manage Microsoft Passport for Work. You can set policies to disable or force the use of Microsoft Passport for Work, require the use of a TPM, and control the length and strength of PINs set on the device. - ![figure 4](images/passport-fig4-join.png) - Figure 4: Joining an Office 365 organization automatically registers the device in Azure AD - **Enable device registration** - If you want to use Microsoft Passport at Work with certificates, you’ll need a device registration system. That means that you set up Configuration Manager Technical Preview, Intune, or a compatible non-Microsoft MDM system and enable it to enroll devices. This is a prerequisite step to use Microsoft Passport for Work with certificates, no matter the IDP, because the enrollment system is responsible for provisioning the devices with the necessary certificates. - **Set Microsoft Passport policies** - As of the initial release of Windows 10, you can control the following settings for the use of Microsoft Passport for Work: - - You can require that Microsoft Passport be available only on devices that have TPM security hardware, which means the device uses TPM 1.2 or TPM 2.0. - - You can enable Microsoft Passport with a hardware-preferred option, which means that keys will be generated on TPM 1.2 or TPM 2.0 when available and by software when TPM is not available. - - You can configure whether certificate-based Microsoft Passport is available to users. You do this as part of the device deployment process, not through a separately applied policy. - - You can define the complexity and length of the PIN that users generate at registration. - - You can control whether Windows Hello use is enabled in your organization. - These settings can be implemented through GPOs or through configuration service providers (CSPs) in MDM systems, so you have a familiar and flexible set of tools you can use to apply them to exactly the users you want. (For details about the Microsoft Passport for Work CSP, see [PassportForWork CSP)](http://go.microsoft.com/fwlink/p/?LinkId=733876). - ## Roadmap - - The speed at which Universal Windows apps and services evolve means that the traditional design-build-test-release cycle for Windows is too slow to meet customers’ needs. As part of the release of Windows 10, Microsoft is changing how it engineers, tests, and distributes Windows. Rather than large, monolithic releases every 3–5 years, the Windows engineering team is committed to smaller, more frequent releases to get new features and services into the marketplace more rapidly without sacrificing security, quality, or usability. This model has worked well in Office 365 and the Xbox ecosystem. - In the Windows 10 initial release, Microsoft supports the following Microsoft Passport and Windows Hello features: - - Biometric authentication, with fingerprint readers that use the Windows fingerprint reader framework - - Facial-recognition capability on devices that have compatible IR-capable cameras - - Microsoft Passport for personal credentials on individually owned and corporate-managed devices - - Microsoft Passport for Work support for organizations that have cloud-only Azure AD deployments - - Group Policy settings to control Microsoft Passport PIN length and complexity - In future releases of Windows 10, we plan to add support for additional features: - - Additional biometric identifier types, including iris recognition - - Key-based Microsoft Passport for Work credentials for on-premises Azure AD deployments and hybrid on-premises/Azure AD deployments - - Microsoft Passport for Work certificates issued by a trusted PKI, including smart card and virtual smart card certificates - - TPM attestation to protect keys so that a malicious user or program can’t create keys in software (because those keys won’t be TPM attested and can thus be identified as fake) - In the longer term, Microsoft will continue to improve on and expand the features of both Microsoft Passport and Windows Hello to cover additional customer requirements for manageability and security. We also are working with the FIDO Alliance and a variety of third parties to encourage adoption of Microsoft Passport by both web and LOB application developers. -   -   - - - - - diff --git a/windows/keep-secure/minimum-password-age.md b/windows/keep-secure/minimum-password-age.md index e3b03a77c1..e132b39e0f 100644 --- a/windows/keep-secure/minimum-password-age.md +++ b/windows/keep-secure/minimum-password-age.md @@ -2,46 +2,28 @@ title: Minimum password age (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Minimum password age security policy setting. ms.assetid: 91915cb2-1b3f-4fb7-afa0-d03df95e8161 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Minimum password age - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Minimum password age** security policy setting. - ## Reference - - The **Minimum password age** policy setting determines the period of time (in days) that a password can be used before the system requires the user to change it. You can set passwords to expire after a number of days between 1 and 999, or you can specify that passwords never expire by setting the number of days to 0. If [Maximum password age](maximum-password-age.md) is between 1 and 999 days, the minimum password age must be less than the maximum password age. If Maximum password age is set to 0, **Minimum password age** can be any value between 0 and 998 days. - ### Possible values - - User-specified number of days between 0 and 998 - - Not defined - ### Best practices - Set **Minimum password age** to a value of 2 days. Setting the number of days to 0 allows immediate password changes, which is not recommended. - If you set a password for a user and you want that user to change the administrator-defined password, you must select the **User must change password at next logon** check box. Otherwise, the user will not be able to change the password until the number of days specified by **Minimum password age**. - ### Location - **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy** - ### Default values - The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - @@ -80,47 +62,21 @@ The following table lists the actual and effective default policy values. Defaul
-   - ## Policy management - - This section describes features, tools, and guidance to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Users may have favorite passwords that they like to use because they are easy to remember and they believe that their password choice is secure from compromise. Unfortunately, passwords can be compromised and if an attacker is targeting a specific individual user account, with knowledge of data about that user, reuse of old passwords can cause a security breach. - To address password reuse, you must use a combination of security settings. Using this policy setting with the [Enforce password history](enforce-password-history.md) policy setting prevents the easy reuse of old passwords. For example, if you configure the Enforce password history policy setting to ensure that users cannot reuse any of their last 12 passwords, but you do not configure the **Minimum password age** policy setting to a number that is greater than 0, users could change their password 13 times in a few minutes and reuse their original password. You must configure this policy setting to a number that is greater than 0 for the Enforce password history policy setting to be effective. - ### Countermeasure - Configure the **Minimum password age** policy setting to a value of at least 2 days. Users should know about this limitation and contact the Help Desk if they need to change their password during that two-day period. If you configure the number of days to 0, immediate password changes would be allowed, which we do not recommend. - ### Potential impact - If you set a password for a user but wants that user to change the password when the user first logs on, the administrator must select the **User must change password at next logon** check box, or the user cannot change the password until the next day. - ## Related topics - - [Password Policy](password-policy.md) -   -   - - - - - diff --git a/windows/keep-secure/minimum-password-length.md b/windows/keep-secure/minimum-password-length.md index 903f9b16ae..30bd818de2 100644 --- a/windows/keep-secure/minimum-password-length.md +++ b/windows/keep-secure/minimum-password-length.md @@ -2,48 +2,29 @@ title: Minimum password length (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Minimum password length security policy setting. ms.assetid: 3d22eb9a-859a-4b6f-82f5-c270c427e17e +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Minimum password length - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Minimum password length** security policy setting. - ## Reference - - The **Minimum password length** policy setting determines the least number of characters that can make up a password for a user account. You can set a value of between 1 and 14 characters, or you can establish that no password is required by setting the number of characters to 0. - ### Possible values - - User-specified number of characters between 0 and 14 - - Not defined - ### Best practices - Set Minimum password length to at least a value of 8. If the number of characters is set to 0, no password is required. In most environments, an eight-character password is recommended because it is long enough to provide adequate security and still short enough for users to easily remember. This value will help provide adequate defense against a brute force attack. Adding complexity requirements will help reduce the possibility of a dictionary attack. For more info, see [Password must meet complexity requirements](password-must-meet-complexity-requirements.md). - Permitting short passwords reduces security because short passwords can be easily broken with tools that perform dictionary or brute force attacks against the passwords. Requiring very long passwords can result in mistyped passwords that might cause an account lockout and subsequently increase the volume of Help Desk calls. - In addition, requiring extremely long passwords can actually decrease the security of an organization because users might be more likely to write down their passwords to avoid forgetting them. However, if users are taught that they can use passphrases (sentences such as "I want to drink a $5 milkshake"), they should be much more likely to remember. - ### Location - **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy** - ### Default values - The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - @@ -82,52 +63,24 @@ The following table lists the actual and effective default policy values. Defaul
-   - ## Policy management - - This section describes features, tools, and guidance to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Types of password attacks include dictionary attacks (which attempt to use common words and phrases) and brute force attacks (which try every possible combination of characters). Also, attackers sometimes try to obtain the account database so they can use tools to discover the accounts and passwords. - ### Countermeasure - Configure the **** policy setting to a value of 8 or more. If the number of characters is set to 0, no password will be required. - In most environments, we recommend an eight-character password because it is long enough to provide adequate security, but not too difficult for users to easily remember. This configuration provides adequate defense against a brute force attack. Using the [Password must meet complexity requirements](password-must-meet-complexity-requirements.md) policy setting in addition to the **Minimum password length** setting helps reduce the possibility of a dictionary attack. - **Note**   Some jurisdictions have established legal requirements for password length as part of establishing security regulations. -   - ### Potential impact - Requirements for extremely long passwords can actually decrease the security of an organization because users might leave the information in an unsecured location or lose it. If very long passwords are required, mistyped passwords could cause account lockouts and increase the volume of Help Desk calls. If your organization has issues with forgotten passwords due to password length requirements, consider teaching your users about passphrases, which are often easier to remember and, due to the larger number of character combinations, much harder to discover. - ## Related topics - - [Password Policy](password-policy.md) -   -   - - - - - diff --git a/windows/keep-secure/modify-an-object-label.md b/windows/keep-secure/modify-an-object-label.md index 4fbd65119c..4f06c8a9e8 100644 --- a/windows/keep-secure/modify-an-object-label.md +++ b/windows/keep-secure/modify-an-object-label.md @@ -2,62 +2,36 @@ title: Modify an object label (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Modify an object label security policy setting. ms.assetid: 3e5a97dd-d363-43a8-ae80-452e866ebfd5 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Modify an object label - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Modify an object label** security policy setting. - ## Reference - - This privilege determines which user accounts can modify the integrity label of objects, such as files, registry keys, or processes owned by other users. Processes running under a user account can modify the label of an object owned by that user to a lower level without this privilege. - The integrity label is used by the Windows Integrity Controls (WIC) feature, which was introduced in Windows Server 2008 and Windows Vista. WIC keeps lower integrity processes from modifying higher integrity processes by assigning one of six possible labels to objects on the system. Although similar to NTFS file and folder permissions, which are discretionary controls on objects, the WIC integrity levels are mandatory controls that are put in place and enforced by the operating system. The following list describes the integrity levels from lowest to highest: - - **Untrusted**   Default assignment for processes that are logged on anonymously. - - **Low**   Default assignment for processes that interact with the Internet. - - **Medium**   Default assignment for standard user accounts and any object that is not explicitly designated with a lower or higher integrity level. - - **High**  Default assignment for administrator accounts and processes that request to run using administrative rights. - - **System**   Default assignment for Windows kernel and core services. - - **Installer**   Used by setup programs to install software. It is important that only trusted software is installed on computers because objects that are assigned the Installer integrity level can install, modify, and uninstall all other objects. - Constant: SeRelabelPrivilege - ### Possible values - - User-defined list of accounts - - Not Defined - ### Best practices - - Do not give any group this user right. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - By default this setting is Not defined on domain controllers and on stand-alone servers. - The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - @@ -96,61 +70,28 @@ The following table lists the actual and effective default policy values for the
-   - ## Policy management - - This section describes features, tools, and guidance to help you manage this policy. - A restart of the computer is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - ### Group Policy - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Anyone with the **Modify an object label** user right can change the integrity level of a file or process so that it becomes elevated or decreased to a point where it can be deleted by lower integrity processes. Either of these states effectively circumvents the protection that is offered by Windows Integrity Controls and makes your system vulnerable to attacks by malicious software. - If malicious software is set with an elevated integrity level such as Trusted Installer or System, administrator accounts do not have sufficient integrity levels to delete the program from the system. In that case, use of the **Modify an object label** right is mandated so that the object can be re-labeled. However, the re-labeling must occur by using a process that is at the same or a higher level of integrity than the object that you are attempting to re-label. - ### Countermeasure - Do not give any group this right. If necessary, implement it for a constrained period of time to a trusted individual to respond to a specific organizational need. - ### Potential impact - None. Not defined is the default configuration. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/modify-firmware-environment-values.md b/windows/keep-secure/modify-firmware-environment-values.md index b3679b1056..8662f8166e 100644 --- a/windows/keep-secure/modify-firmware-environment-values.md +++ b/windows/keep-secure/modify-firmware-environment-values.md @@ -2,58 +2,34 @@ title: Modify firmware environment values (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Modify firmware environment values security policy setting. ms.assetid: 80bad5c4-d9eb-4e3a-a5dc-dcb742b83fca +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Modify firmware environment values - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Modify firmware environment values** security policy setting. - ## Reference - - This security setting determines who can modify firmware environment values. Firmware environment values are settings that are stored in the nonvolatile RAM of non-x86-based computers. The effect of the setting depends on the processor. - On x86-based computers, the only firmware environment value that can be modified by assigning this user right is the **Last Known Good Configuration** setting, which should only be modified by the system. - On Itanium-based computers, boot information is stored in nonvolatile RAM. Users must be assigned this user right to run bootcfg.exe and to change the **Default Operating System** setting using the **Startup and Recovery** feature on the **Advanced** tab of **System Properties**. - The exact setting for firmware environment values is determined by the boot firmware. The location of these values is also specified by the firmware. For example, on a UEFI-based system, NVRAM contains firmware environment values that specify system boot settings. - On all computers, this user right is required to install or upgrade Windows. - Constant: SeSystemEnvironmentPrivilege - ### Possible values - - User-defined list of accounts - - Administrators - - Not Defined - ### Best practices - - Ensure that only the local Administrators group is assigned the **Modify firmware environment values** user right. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - By default this setting is Administrators on domain controllers and on stand-alone servers. - The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - @@ -92,61 +68,28 @@ The following table lists the actual and effective default policy values. Defaul
-   - ## Policy management - - This section describes features, tools, and guidance to help you manage this policy. - A restart of the device is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - This security setting does not affect who can modify the system environment values and user environment values that are displayed on the **Advanced** tab of **System Properties**. - ### Group Policy - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Anyone who is assigned the **Modify firmware environment values** user right could configure the settings of a hardware component to cause it to fail, which could lead to data corruption or a denial-of-service condition. - ### Countermeasure - Ensure that only the local Administrators group is assigned the **Modify firmware environment values** user right. - ### Potential impact - None. Restricting the **Modify firmware environment values** user right to the members of the local Administrators group is the default configuration. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/monitor-application-usage-with-applocker.md b/windows/keep-secure/monitor-application-usage-with-applocker.md index 2343d692f3..4a0e489d50 100644 --- a/windows/keep-secure/monitor-application-usage-with-applocker.md +++ b/windows/keep-secure/monitor-application-usage-with-applocker.md @@ -2,98 +2,51 @@ title: Monitor app usage with AppLocker (Windows 10) description: This topic for IT professionals describes how to monitor app usage when AppLocker policies are applied. ms.assetid: 0516da6e-ebe4-45b4-a97b-31daba96d1cf +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Monitor app usage with AppLocker - - **Applies to** - - Windows 10 - This topic for IT professionals describes how to monitor app usage when AppLocker policies are applied. - Once you set rules and deploy the AppLocker policies, it is good practice to determine if the policy implementation is what you expected. - ### Discover the effect of an AppLocker policy - You can evaluate how the AppLocker policy is currently implemented for documentation or audit purposes, or before you modify the policy. Updating your AppLocker Policy Deployment Planning document will help you track your findings. For information about creating this document, see [Create your AppLocker planning document](create-your-applocker-planning-document.md). You can perform one or more of the following steps to understand what application controls are currently enforced through AppLocker rules. - - **Analyze the AppLocker logs in Event Viewer** - When AppLocker policy enforcement is set to **Enforce rules**, rules are enforced for the rule collection and all events are audited. When AppLocker policy enforcement is set to **Audit only**, rules are not enforced but are still evaluated to generate audit event data that is written to the AppLocker logs. - For the procedure to access the log, see [View the AppLocker Log in Event Viewer](#bkmk-applkr-view-log). - - **Enable the Audit only AppLocker enforcement setting** - By using the **Audit only** enforcement setting, you can ensure that the AppLocker rules are properly configured for your organization. When AppLocker policy enforcement is set to **Audit only**, rules are only evaluated but all events generated from that evaluation are written to the AppLocker log. - For the procedure to do this, see [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md). - - **Review AppLocker events with Get-AppLockerFileInformation** - For both event subscriptions and local events, you can use the **Get-AppLockerFileInformation** Windows PowerShell cmdlet to determine which files have been blocked or would have been blocked (if you are using the audit-only enforcement mode) and how many times the event has occurred for each file. - For the procedure to do this, see [Review AppLocker Events with Get-AppLockerFileInformation](#bkmk-applkr-review-events). - - **Review AppLocker events with Test-AppLockerPolicy** - You can use the **Test-AppLockerPolicy** Windows PowerShell cmdlet to determine whether any of the rules in your rule collections will be blocked on your reference device or the device on which you maintain policies. - For the procedure to do this, see [Test an AppLocker policy by using Test-AppLockerPolicy](test-an-applocker-policy-by-using-test-applockerpolicy.md). - ### Review AppLocker events with Get-AppLockerFileInformation - For both event subscriptions and local events, you can use the **Get-AppLockerFileInformation** Windows PowerShell cmdlet to determine which files have been blocked or would have been blocked (if the **Audit only** enforcement setting is applied) and how many times the event has occurred for each file. - Membership in the local **Administrators** group, or equivalent, is the minimum required to complete this procedure. - **Note**   If the AppLocker logs are not on your local device, you will need permission to view the logs. If the output is saved to a file, you will need permission to read that file. -   - **To review AppLocker events with Get-AppLockerFileInformation** - 1. At the command prompt, type **PowerShell**, and then press ENTER. - 2. Run the following command to review how many times a file would have been blocked from running if rules were enforced: - `Get-AppLockerFileInformation –EventLog –EventType Audited –Statistics` - 3. Run the following command to review how many times a file has been allowed to run or prevented from running: - `Get-AppLockerFileInformation –EventLog –EventType Allowed –Statistics` - ### View the AppLocker Log in Event Viewer - When AppLocker policy enforcement is set to **Enforce rules**, rules are enforced for the rule collection and all events are audited. When AppLocker policy enforcement is set to **Audit only**, rules are only evaluated but all events generated from that evaluation are written to the AppLocker log. - Membership in the local **Administrators** group, or equivalent, is the minimum required to complete this procedure. - **To view events in the AppLocker log by using Event Viewer** - 1. Open Event Viewer. To do this, click **Start**, type **eventvwr.msc**, and then press ENTER. - 2. In the console tree under **Application and Services Logs\\Microsoft\\Windows**, double-click **AppLocker**. - AppLocker events are listed in either the **EXE and DLL** log, the **MSI and Script** log, or the **Packaged app-Deployment** or **Packaged app-Execution** log. Event information includes the enforcement setting, file name, date and time, and user name. The logs can be exported to other file formats for further analysis. - ## Related topics - - [AppLocker](applocker-overview.md) -   -   - - - - - diff --git a/windows/keep-secure/monitor-central-access-policy-and-rule-definitions.md b/windows/keep-secure/monitor-central-access-policy-and-rule-definitions.md index b8e3992188..228daa4fa2 100644 --- a/windows/keep-secure/monitor-central-access-policy-and-rule-definitions.md +++ b/windows/keep-secure/monitor-central-access-policy-and-rule-definitions.md @@ -2,83 +2,44 @@ title: Monitor central access policy and rule definitions (Windows 10) description: This topic for the IT professional describes how to monitor changes to central access policy and central access rule definitions when you use advanced security auditing options to monitor dynamic access control objects. ms.assetid: 553f98a6-7606-4518-a3c5-347a33105130 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Monitor central access policy and rule definitions - - **Applies to** - - Windows 10 - This topic for the IT professional describes how to monitor changes to central access policy and central access rule definitions when you use advanced security auditing options to monitor dynamic access control objects. - Central access policies and rules determine access permissions for multiple files on multiple file servers. Therefore, it is important to monitor changes to them. Like user claim and device claim definitions, central access policy and rule definitions reside in Active Directory Domain Services (AD DS), and they can be monitored just like any other object in Active Directory. Central access policies and rules are critical elements in a Dynamic Access Control deployment. These policies and rules are stored in AD DS, so they should be less likely to be tampered with than other network objects. However, it is important to monitor these objects for potential changes in security auditing and to verify that policies are being enforced. - Use the following procedures to configure settings to monitor changes to central access policy and central access rule definitions and to verify the changes. These procedures assume that you have configured and deployed Dynamic Access Control, including central access policies, claims, and other components, in your network. If you have not yet deployed Dynamic Access Control in your network, see [Deploy a Central Access Policy (Demonstration Steps)](http://technet.microsoft.com/library/hh846167.aspx). - **Note**   Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. -   - **To configure settings to monitor changes to central access policy and rule definitions** - 1. Sign in to your domain controller by using domain administrator credentials. - 2. In Server Manager, point to **Tools**, and then click **Group Policy Management**. - 3. In the console tree, right-click the default domain controller Group Policy Object, and then click **Edit**. - 4. Double-click **Computer Configuration**, click **Security Settings**, expand **Advanced Audit Policy Configuration**, expand **System Audit Policies**, click **DS Access**, and then double-click **Audit directory service changes**. - 5. Select the **Configure the following audit events** check box, select the **Success** check box (and the **Failure** check box, if desired), and then click **OK**. - 6. Close the Group Policy Management Editor. - 7. Open the Active Directory Administrative Center. - 8. Under Dynamic Access Control, right-click **Central Access Policies**, and then select **Properties**. - 9. Click the **Security** tab, click **Advanced** to open the **Advanced Security Settings** dialog box, and then click the **Auditing** tab. - 10. Click **Add**, add a security auditing setting for the container, and then close all Security properties dialog boxes. - After you configure settings to monitor changes to central access policy and central access rule definitions, verify that the changes are being monitored. - **To verify that changes to central access policy and rule definitions are monitored** - 1. Sign in to your domain controller by using domain administrator credentials. - 2. Open the Active Directory Administrative Center. - 3. Under **Dynamic Access Control**, right-click **Central Access Policies**, and then click **Properties**. - 4. Click the **Security** tab, click **Advanced** to open the **Advanced Security Settings** dialog box, and then click the **Auditing** tab. - 5. Click **Add**, add a security auditing setting for the container, and then close all Security properties dialog boxes. - 6. In the **Central Access Policies** container, add a new central access policy (or select one that exists), click **Properties** in the **Tasks** pane, and then change one or more attributes. - 7. Click **OK**, and then close the Active Directory Administrative Center. - 8. In Server Manager, click **Tools**, and then click **Event Viewer**. - 9. Expand **Windows Logs**, and then click **Security**. Verify that event 4819 appears in the security log. - ### Related resource - [Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md) -   -   - - - - - diff --git a/windows/keep-secure/monitor-claim-types.md b/windows/keep-secure/monitor-claim-types.md index 67265eeab9..88650d8745 100644 --- a/windows/keep-secure/monitor-claim-types.md +++ b/windows/keep-secure/monitor-claim-types.md @@ -2,73 +2,39 @@ title: Monitor claim types (Windows 10) description: This topic for the IT professional describes how to monitor changes to claim types that are associated with dynamic access control when you are using advanced security auditing options. ms.assetid: 426084da-4eef-44af-aeec-e7ab4d4e2439 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Monitor claim types - - **Applies to** - - Windows 10 - This topic for the IT professional describes how to monitor changes to claim types that are associated with dynamic access control when you are using advanced security auditing options. - Claim types are one of the basic building blocks of Dynamic Access Control. Claim types can include attributes such as the departments in an organization or the levels of security clearance that apply to classes of users. You can use security auditing to track whether claims are added, modified, enabled, disabled, or deleted. - Use the following procedures to configure settings to monitor changes to claim types in AD DS. These procedures assume that you have configured and deployed Dynamic Access Control, including central access policies, claims, and other components, in your network. If you have not yet deployed Dynamic Access Control in your network, see [Deploy a Central Access Policy (Demonstration Steps)](http://technet.microsoft.com/library/hh846167.aspx). - **Note**   Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. -   - **To configure settings to monitor changes to claim types** - 1. Sign in to your domain controller by using domain administrator credential. - 2. In Server Manager, point to **Tools**, and then click **Group Policy Management**. - 3. In the console tree, right-click the default domain controller Group Policy Object, and then click **Edit**. - 4. Double-click **Computer Configuration**, click **Security Settings**, expand **Advanced Audit Policy Configuration**, expand **System Audit Policies**, click **DS Access**, and then double-click **Audit directory service changes**. - 5. Select the **Configure the following audit events** check box, select the **Success** check box (andthe **Failure** check box, if desired), and then click **OK**. - After you configure settings to monitor changes to claim types in AD DS, verify that the changes are being monitored. - **To verify that changes to claim types are monitored** - 1. Sign in to your domain controller by using domain administrator credentials. - 2. Open the Active Directory Administrative Center. - 3. Under **Dynamic Access Control**, right-click **Claim Types**, and then click **Properties**. - 4. Click the **Security** tab, click **Advanced** to open the **Advanced Security Settings** dialog box, and then click the **Auditing** tab. - 5. Click **Add**, add a security auditing setting for the container, and then close all the Security properties dialog boxes. - 6. In the **Claim Types** container, add a new claim type or select an existing claim type. In the **Tasks** pane, click **Properties**, and then change one or more attributes. - Click **OK**, and then close the Active Directory Administrative Center. - 7. Open Event Viewer on this domain controller, expand **Windows Logs**, and select the **Security** log. - Look for event 5137. Key information to look for includes the name of the new attribute that was added, the type of claim that was created, and the user who created the claim. - ### Related resource - [Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md) -   -   - - - - - diff --git a/windows/keep-secure/monitor-resource-attribute-definitions.md b/windows/keep-secure/monitor-resource-attribute-definitions.md index 2412bd06b9..71c872ac0f 100644 --- a/windows/keep-secure/monitor-resource-attribute-definitions.md +++ b/windows/keep-secure/monitor-resource-attribute-definitions.md @@ -2,81 +2,43 @@ title: Monitor resource attribute definitions (Windows 10) description: This topic for the IT professional describes how to monitor changes to resource attribute definitions when you are using advanced security auditing options to monitor dynamic access control objects. ms.assetid: aace34b0-123a-4b83-9e09-f269220e79de +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Monitor resource attribute definitions - - **Applies to** - - Windows 10 - This topic for the IT professional describes how to monitor changes to resource attribute definitions when you are using advanced security auditing options to monitor dynamic access control objects. - Resource attribute definitions define the basic properties of resource attributes, such as what it means for a resource to be defined as “high business value.” Resource attribute definitions are stored in AD DS under the Resource Properties container. Changes to these definitions could significantly change the protections that govern a resource, even if the resource attributes that apply to the resource remain unchanged. Changes can be monitored like any other AD DS object. - For information about monitoring changes to the resource attributes that apply to files, see [Monitor the resource attributes on files and folders](monitor-the-resource-attributes-on-files-and-folders.md). - Use the following procedures to configure settings to monitor changes to resource attribute definitions in AD DS and to verify the changes. These procedures assume that you have configured and deployed Dynamic Access Control, including central access policies, claims, and other components, in your network. If you have not yet deployed Dynamic Access Control in your network, see [Deploy a Central Access Policy (Demonstration Steps)](http://technet.microsoft.com/library/hh846167.aspx). - **Note**   Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. -   - **To configure settings to monitor changes to resource attributes** - 1. Sign in to your domain controller by using domain administrator credentials. - 2. In Server Manager, point to **Tools**, and then click **Group Policy Management**. - 3. In the console tree, right-click the Group Policy Object for the default domain controller, and then click **Edit**. - 4. Double-click **Computer Configuration**, click **Security Settings**, expand **Advanced Audit Policy Configuration**, expand **System Audit Policies**, click **DS Access**, and then double-click **Audit directory service changes**. - 5. Select the **Configure the following audit events** check box, select the **Success** check box (and the **Failure** check box, if desired), and then click **OK**. - 6. Close the Group Policy Management Editor. - 7. Open the Active Directory Administrative Center. - 8. Under **Dynamic Access Control**, right-click **Resource Properties**, and then click **Properties**. - 9. Click the **Security** tab, click **Advanced** to open the **Advanced Security Settings** dialog box, and then click the **Auditing** tab. - 10. Click **Add**, add a security auditing setting for the container, and then close all Security properties dialog boxes. - After you configure settings to monitor changes to resource attributes in AD DS, verify that the changes are being monitored. - **To verify that changes to resource definitions are monitored** - 1. Sign in to your domain controller by using domain administrator credentials. - 2. Open the Active Directory Administrative Center. - 3. Under **Dynamic Access Control**, click **Resource Properties**, and then double-click a resource attribute. - 4. Make changes to this resource attribute. - 5. Click **OK**, and then close the Active Directory Administrative Center. - 6. In Server Manager, click **Tools**, and then click **Event Viewer**. - 7. Expand **Windows Logs**, and then click **Security**. Verify that event 5137 appears in the security log. - ### Related resource - [Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md) -   -   - - - - - diff --git a/windows/keep-secure/monitor-the-central-access-policies-associated-with-files-and-folders.md b/windows/keep-secure/monitor-the-central-access-policies-associated-with-files-and-folders.md index 322fd4217e..3aff0a5708 100644 --- a/windows/keep-secure/monitor-the-central-access-policies-associated-with-files-and-folders.md +++ b/windows/keep-secure/monitor-the-central-access-policies-associated-with-files-and-folders.md @@ -2,100 +2,53 @@ title: Monitor the central access policies associated with files and folders (Windows 10) description: This topic for the IT professional describes how to monitor changes to the central access policies that are associated with files and folders when you are using advanced security auditing options to monitor dynamic access control objects. ms.assetid: 2ea8fc23-b3ac-432f-87b0-6a16506e8eed +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Monitor the central access policies associated with files and folders - - **Applies to** - - Windows 10 - This topic for the IT professional describes how to monitor changes to the central access policies that are associated with files and folders when you are using advanced security auditing options to monitor dynamic access control objects. - This security audit policy and the event that it records are generated when the central access policy that is associated with a file or folder is changed. This security audit policy is useful when an administrator wants to monitor potential changes on some, but not all, files and folders on a file server. - For info about monitoring potential central access policy changes for an entire file server, see [Monitor the central access policies that apply on a file server](monitor-the-central-access-policies-that-apply-on-a-file-server.md). - Use the following procedures to configure settings to monitor central access policies that are associated with files. These procedures assume that you have configured and deployed Dynamic Access Control in your network. For more information about how to configure and deploy Dynamic Access Control, see [Dynamic Access Control: Scenario Overview](http://technet.microsoft.com/library/hh831717.aspx). - **Note**   Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. -   - **To configure settings to monitor central access policies associated with files or folders** - 1. Sign in to your domain controller by using domain administrator credentials. - 2. In Server Manager, point to **Tools**, and then click **Group Policy Management**. - 3. In the console tree, right-click the flexible access Group Policy Object, and then click **Edit**. - 4. Double-click **Computer Configuration**, double-click **Security Settings**, double-click **Advanced Audit Policy Configuration**, double-click **Policy Change**, and then double-click **Audit Authorization Policy Change**. - 5. Select the **Configure the following audit events** check box, select the **Success** check box (and the **Failure** check box, if desired), and then click **OK**. - 6. Enable auditing for a file or folder as described in the following procedure. - **To enable auditing for a file or folder** - 1. Sign in as a member of the local administrators group on the computer that contains the files or folders that you want to audit. - 2. Right-click the file or folder, click **Properties**, and then click the **Security** tab. - 3. Click **Advanced**, click the **Auditing** tab, and then click **Continue**. - If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. - 4. Click **Add**, click **Select a principal**, type a user name or group name in the format **contoso\\user1**, and then click **OK**. - 5. In the **Auditing Entry for** dialog box, select the permissions that you want to audit, such as **Full Control** or **Delete**. - 6. Click **OK** four times to complete the configuration of the object SACL. - 7. Open a File Explorer window and select or create a file or folder to audit. - 8. Open an elevated command prompt, and run the following command: - **gpupdate /force** - After you configure settings to monitor changes to the central access policies that are associated with files and folders, verify that the changes are being monitored. - **To verify that changes to central access policies associated with files and folders are monitored** - 1. Sign in as a member of the local administrators group on the computer that contains the files or folders that you want to audit. - 2. Open a File Explorer window and select the file or folder that you configured for auditing in the previous procedure. - 3. Right-click the file or folder, click **Properties**, click the **Security** tab, and then click **Advanced**. - 4. Click the **Central Policy** tab, click **Change**, and select a different central access policy (if one is available) or select **No Central Access Policy**, and then click **OK** twice. - **Note**   You must select a setting that is different than your original setting to generate the audit event. -   - 5. In Server Manager, click **Tools**, and then click **Event Viewer**. - 6. Expand **Windows Logs**, and then click **Security**. - 7. Look for event 4913, which is generated when the central access policy that is associated with a file or folder is changed. This event includes the security identifiers (SIDs) of the old and new central access policies. - ### Related resource - [Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md) -   -   - - - - - diff --git a/windows/keep-secure/monitor-the-central-access-policies-that-apply-on-a-file-server.md b/windows/keep-secure/monitor-the-central-access-policies-that-apply-on-a-file-server.md index d19126daa6..54838b32b6 100644 --- a/windows/keep-secure/monitor-the-central-access-policies-that-apply-on-a-file-server.md +++ b/windows/keep-secure/monitor-the-central-access-policies-that-apply-on-a-file-server.md @@ -2,81 +2,43 @@ title: Monitor the central access policies that apply on a file server (Windows 10) description: This topic for the IT professional describes how to monitor changes to the central access policies that apply to a file server when using advanced security auditing options to monitor dynamic access control objects. ms.assetid: 126b051e-c20d-41f1-b42f-6cff24dcf20c +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Monitor the central access policies that apply on a file server - - **Applies to** - - Windows 10 - This topic for the IT professional describes how to monitor changes to the central access policies that apply to a file server when using advanced security auditing options to monitor dynamic access control objects. Central access policies are created on a domain controller and then applied to file servers through Group Policy management. - Use the following procedures to configure and verify security auditing settings that are used to monitor changes to the set of central access policies on a file server. The following procedures assume that you have configured and deployed dynamic access control, including central access policies, and claims in your network. If you have not yet deployed dynamic access control in your network, see [Deploy a Central Access Policy (Demonstration Steps)](http://technet.microsoft.com/library/hh846167.aspx). - **To configure settings to monitor changes to central access policies** - 1. Sign in to your domain controller by using domain administrator credentials. - 2. In Server Manager, point to **Tools**, and then click **Group Policy Management**. - 3. In the console tree, right-click the flexible access Group Policy Object, and then click **Edit**. - 4. Double-click **Computer Configuration**, double-click **Security Settings**, double-click **Advanced Audit Policy Configuration**, double-click **Policy Change**, and then double-click **Other Policy Change Events**. - **Note**   This policy setting monitors policy changes that might not be captured otherwise, such as central access policy changes or trusted platform module configuration changes. -   - 5. Select the **Configure the following audit events** check box, select the **Success** check box (and the **Failure** check box, if desired), and then click **OK**. - After you modify the central access policies on the domain controller, verify that the changes have been applied to the file server and that the proper events are logged. - **To verify changes to the central access policies** - 1. Sign in to your domain controller by using domain administrator credentials. - 2. Open the Group Policy Management Console. - 3. Right-click **Default domain policy**, and then click **Edit**. - 4. Double-click **Computer Configuration**, double-click **Policies**, and then double-click **Windows Settings**. - 5. Double-click **Security Settings**, right-click **File system**, and then click **Manage CAPs**. - 6. In the wizard that appears, follow the instructions to add a new central access policy (CAP), and then click **OK**. - 7. Use local administrator credentials to sign in to the server that hosts resources that are subject to the central access policies you changed. - 8. Press the Windows key + R, then type **cmd** to open a Command Prompt window. - **Note**   If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. -   - 9. Type **gpupdate /force**, and press ENTER. - 10. In Server Manager, click **Tools**, and then click **Event Viewer**. - 11. Expand **Windows Logs**, and then click **Security**. Verify that event 4819 appears in the security log. - ## Related resource - - [Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md) -   -   - - - - - diff --git a/windows/keep-secure/monitor-the-resource-attributes-on-files-and-folders.md b/windows/keep-secure/monitor-the-resource-attributes-on-files-and-folders.md index 0e52151278..8c4c23bf12 100644 --- a/windows/keep-secure/monitor-the-resource-attributes-on-files-and-folders.md +++ b/windows/keep-secure/monitor-the-resource-attributes-on-files-and-folders.md @@ -2,79 +2,42 @@ title: Monitor the resource attributes on files and folders (Windows 10) description: This topic for the IT professional describes how to monitor attempts to change settings to the resource attributes on files when you are using advanced security auditing options to monitor dynamic access control objects. ms.assetid: 4944097b-320f-44c7-88ed-bf55946a358b +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Monitor the resource attributes on files and folders - - **Applies to** - - Windows 10 - This topic for the IT professional describes how to monitor attempts to change settings to the resource attributes on files when you are using advanced security auditing options to monitor dynamic access control objects. - If your organization has a carefully thought out authorization configuration for resources, changes to these resource attributes can create potential security risks. Examples include: - - Changing files that have been marked as high business value to low business value. - - Changing the Retention attribute of files that have been marked for retention. - - Changing the Department attribute of files that are marked as belonging to a particular department. - Use the following procedures to configure settings to monitor changes to resource attributes on files and folders. These procedures assume that have configured and deployed central access policies in your network. For more information about how to configure and deploy central access policies, see [Dynamic Access Control: Scenario Overview](http://technet.microsoft.com/library/hh831717.aspx) . - **Note**   Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. -   - **To monitor changes to resource attributes on files** - 1. Sign in to your domain controller by using domain administrator credentials. - 2. In Server Manager, point to **Tools**, and then click **Group Policy Management**. - 3. In the console tree, right-click the flexible access Group Policy Object, and then click **Edit**. - 4. Double-click **Computer Configuration**, double-click **Security Settings**, double-click **Advanced Audit Policy Configuration**, double-click **Policy Change**, and then double-click **Audit Authorization Policy Change**. - 5. Select the **Configure the following audit events** check box, select the **Success** and **Failure** check boxes, and then click **OK**. - After you configure settings to monitor resource attributes on files, verify that the changes are being monitored. - **To verify that changes to resource attributes on files are monitored** - 1. Use administrator credentials to sign in to the server that hosts the resource you want to monitor. - 2. From an elevated command prompt, type **gpupdate /force**, and then press ENTER. - 3. Attempt to change resource properties on one or more files and folders. - 4. In Server Manager, click **Tools**, and then click **Event Viewer**. - 5. Expand **Windows Logs**, and then click **Security**. - 6. Depending on which resource attributes you attempted to change, you should look for the following events: - - Event 4911, which tracks changes to file attributes - - Event 4913, which tracks changes to central access policies - Key information to look for includes the name and account domain of the principal attempting to change the resource attribute, the object that the principal is attempting to modify, and information about the changes that are being attempted. - ### Related resource - [Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md) -   -   - - - - - diff --git a/windows/keep-secure/monitor-the-use-of-removable-storage-devices.md b/windows/keep-secure/monitor-the-use-of-removable-storage-devices.md index 4a241ac162..b465dfccb6 100644 --- a/windows/keep-secure/monitor-the-use-of-removable-storage-devices.md +++ b/windows/keep-secure/monitor-the-use-of-removable-storage-devices.md @@ -2,83 +2,45 @@ title: Monitor the use of removable storage devices (Windows 10) description: This topic for the IT professional describes how to monitor attempts to use removable storage devices to access network resources. It describes how to use advanced security auditing options to monitor dynamic access control objects. ms.assetid: b0a9e4a5-b7ff-41c6-96ff-0228d4ba5da8 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Monitor the use of removable storage devices - - **Applies to** - - Windows 10 - This topic for the IT professional describes how to monitor attempts to use removable storage devices to access network resources. It describes how to use advanced security auditing options to monitor dynamic access control objects. - If you configure this policy setting, an audit event is generated each time a user attempts to copy, move, or save a resource to a removable storage device. - Use the following procedures to monitor the use of removable storage devices and to verify that the devices are being monitored. - **Note**   Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. -   - **To configure settings to monitor removable storage devices** - 1. Sign in to your domain controller by using domain administrator credentials. - 2. In Server Manager, point to **Tools**, and then click **Group Policy Management**. - 3. In the console tree, right-click the flexible access Group Policy Object on the domain controller, and then click **Edit**. - 4. Double-click **Computer Configuration**, double-click **Security Settings**, double-click **Advanced Audit Policy Configuration**, double-click **Object Access**, and then double-click **Audit Removable Storage**. - 5. Select the **Configure the following audit events** check box, select the **Success** check box (and the **Failure** check box, if desired), and then click **OK**. - 6. If you selected the **Failure** check box, double-click **Audit Handle Manipulation**, select the **Configure the following audit events check box**, and then select **Failure**. - 7. Click **OK**, and then close the Group Policy Management Editor. - After you configure the settings to monitor removable storage devices, use the following procedure to verify that the settings are active. - **To verify that removable storage devices are monitored** - 1. Sign in to the computer that hosts the resources that you want to monitor. Press the Windows key + R, and then type **cmd** to open a Command Prompt window. - **Note**   If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. -   - 2. Type **gpupdate /force**, and press ENTER. - 3. Connect a removable storage device to the targeted computer and attempt to copy a file that is protected with the Removable Storage Audit policy. - 4. In Server Manager, click **Tools**, and then click **Event Viewer**. - 5. Expand **Windows Logs**, and then click **Security**. - 6. Look for event 4663, which logs successful attempts to write to or read from a removable storage device. Failures will log event 4656. Both events include **Task Category = Removable Storage device**. - Key information to look for includes the name and account domain of the user who attempted to access the file, the object that the user is attempting to access, resource attributes of the resource, and the type of access that was attempted. - **Note**   We do not recommend that you enable this category on a file server that hosts file shares on a removable storage device. When Removable Storage Auditing is configured, any attempt to access the removable storage device will generate an audit event. -   - ### Related resource - [Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md) -   -   - - - - - diff --git a/windows/keep-secure/monitor-user-and-device-claims-during-sign-in.md b/windows/keep-secure/monitor-user-and-device-claims-during-sign-in.md index cee27df860..43db7d7f40 100644 --- a/windows/keep-secure/monitor-user-and-device-claims-during-sign-in.md +++ b/windows/keep-secure/monitor-user-and-device-claims-during-sign-in.md @@ -2,67 +2,36 @@ title: Monitor user and device claims during sign-in (Windows 10) description: This topic for the IT professional describes how to monitor user and device claims that are associated with a user’s security token when you are using advanced security auditing options to monitor dynamic access control objects. ms.assetid: 71796ea9-5fe4-4183-8475-805c3c1f319f +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Monitor user and device claims during sign-in - - **Applies to** - - Windows 10 - This topic for the IT professional describes how to monitor user and device claims that are associated with a user’s security token when you are using advanced security auditing options to monitor dynamic access control objects. - Device claims are associated with the system that is used to access resources that are protected with Dynamic Access Control. User claims are attributes that are associated with a user. User claims and device claims are included in the user’s security token used at sign-on. For example, information about Department, Company, Project, or Security clearances might be included in the token. - Use the following procedures to monitor changes to user claims and device claims in the user’s sign-on token and to verify the changes. These procedures assume that you have configured and deployed Dynamic Access Control, including central access policies, claims, and other components, in your network. If you have not yet deployed Dynamic Access Control in your network, see [Deploy a Central Access Policy (Demonstration Steps)](http://technet.microsoft.com/library/hh846167.aspx). - **Note**   Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. -   - **To monitor user and device claims in user logon token** - 1. Sign in to your domain controller by using domain administrator credentials. - 2. In Server Manager, point to **Tools**, and then click **Group Policy Management**. - 3. In the console tree, right-click the flexible access Group Policy Object, and then click **Edit**. - 4. Double-click **Computer Configuration**, click **Security Settings**, expand **Advanced Audit Policy Configuration**, expand **System Audit Policies**, click **Logon/Logoff**, and then double-click **Audit User/Device claims**. - 5. Select the **Configure the following audit events** check box, select the **Success** check box (and the **Failure** check box, if desired), and then click **OK**. - 6. Close the Group Policy Management Editor. - After you configure settings to monitor user and device claims, verify that the changes are being monitored. - **To verify that user and device claims in user logon token are monitored** - 1. With local administrator credentials, sign in to a file server that is subject to the flexible access Group Policy Object. - 2. Open an elevated command prompt, and run the following command: - **gpupdate force** - 3. From a client computer, connect to a file share on the file server as a user who has access permissions to the file server. - 4. On the file server, open Event Viewer, expand **Windows Logs**, and select the **Security** log. Look for event 4626, and confirm that it contains information about user claims and device claims. - ### Related resource - [Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md) -   -   - - - - - diff --git a/windows/keep-secure/network-access-allow-anonymous-sidname-translation.md b/windows/keep-secure/network-access-allow-anonymous-sidname-translation.md index 286cf227fe..ce3d50eac0 100644 --- a/windows/keep-secure/network-access-allow-anonymous-sidname-translation.md +++ b/windows/keep-secure/network-access-allow-anonymous-sidname-translation.md @@ -2,54 +2,32 @@ title: Network access Allow anonymous SID/Name translation (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network access Allow anonymous SID/Name translation security policy setting. ms.assetid: 0144477f-22a6-4d06-b70a-9c9c2196e99e +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Network access: Allow anonymous SID/Name translation - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **Network access: Allow anonymous SID/Name translation** security policy setting. - ## Reference - - This policy setting enables or disables the ability of an anonymous user to request security identifier (SID) attributes for another user. - If this policy setting is enabled, a user might use the well-known Administrators SID to get the real name of the built-in Administrator account, even if the account has been renamed. That person might then use the account name to initiate a brute-force password-guessing attack. - Misuse of this policy setting is a common error that can cause data loss or problems with data access or security. - ### Possible values - - Enabled - An anonymous user can request the SID attribute for another user. An anonymous user with knowledge of an administrator's SID could contact a computer that has this policy enabled and use the SID to get the administrator's name. This setting affects the SID-to-name translation as well as the name-to-SID translation - - Disabled - Prevents an anonymous user from requesting the SID attribute for another user. - - Not defined - ### Best practices - - Set this policy to Disabled. This is the default value on member computers; therefore, it will have no impact on them. The default value for domain controllers is Enabled. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -88,57 +66,26 @@ The following table lists the actual and effective default values for this polic
-   - ### Operating system version differences - The default value of this setting has changed between operating systems as follows: - - The default on domain controllers running Windows Server 2003 R2 or earlier was set to Enabled. - - The default on domain controllers running Windows Server 2008 and later is set to Disabled. - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ### Group Policy - Modifying this setting may affect compatibility with client computers, services, and applications. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - If this policy setting is enabled, a user with local access could use the well-known Administrator's SID to learn the real name of the built-in Administrator account, even if it has been renamed. That person could then use the account name to initiate a password-guessing attack. - ### Countermeasure - Disable the **Network access: Allow anonymous SID/Name translation** setting. - ### Potential impact - Disabled is the default configuration for this policy setting on member devices; therefore, it has no impact on them. The default configuration for domain controllers is Enabled. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md b/windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md index 9b2363c07f..95f97f704f 100644 --- a/windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md +++ b/windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md @@ -2,48 +2,29 @@ title: Network access Do not allow anonymous enumeration of SAM accounts and shares (Windows 10) description: Describes the best practices, location, values, and security considerations for the Network access Do not allow anonymous enumeration of SAM accounts and shares security policy setting. ms.assetid: 3686788d-4cc7-4222-9163-cbc7c3362d73 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Network access: Do not allow anonymous enumeration of SAM accounts and shares - - **Applies to** - - Windows 10 - Describes the best practices, location, values, and security considerations for the **Network access: Do not allow anonymous enumeration of SAM accounts and shares** security policy setting. - ## Reference - - This policy setting determines which additional permissions will be assigned for anonymous connections to the device. Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares. This is convenient, for example, when an administrator wants to give access to users in a trusted domain that does not maintain a reciprocal trust. However, even with this policy setting enabled, anonymous users will have access to resources with permissions that explicitly include the built-in group, ANONYMOUS LOGON. - This policy setting has no impact on domain controllers. - Misuse of this policy setting is a common error that can cause data loss or problems with data access or security. - ### Possible values - - Enabled - - Disabled - No additional permissions can be assigned by the administrator for anonymous connections to the device. Anonymous connections will rely on default permissions. However, an unauthorized user could anonymously list account names and use the information to attempt to guess passwords or perform social-engineering attacks. - - Not defined - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -82,53 +63,24 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ### Policy conflicts - Even with this policy setting enabled, anonymous users will have access to resources with permissions that explicitly include the built-in group, ANONYMOUS LOGON (on systems earlier than Windows Server 2008 and Windows Vista). - ### Group Policy - This policy has no impact on domain controllers. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - An unauthorized user could anonymously list account names and shared resources and use the information to attempt to guess passwords or perform social-engineering attacks. - ### Countermeasure - Enable the **Network access: Do not allow anonymous enumeration of SAM accounts and shares** setting. - ### Potential impact - It is impossible to grant access to users of another domain across a one-way trust because administrators in the trusting domain are unable to enumerate lists of accounts in the other domain. Users who access file and print servers anonymously are unable to list the shared network resources on those servers; the users must be authenticated before they can view the lists of shared folders and printers. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md b/windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md index 70eb372dcb..2324359e3a 100644 --- a/windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md +++ b/windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md @@ -2,48 +2,29 @@ title: Network access Do not allow anonymous enumeration of SAM accounts (Windows 10) description: Describes the best practices, location, values, and security considerations for the Network access Do not allow anonymous enumeration of SAM accounts security policy setting. ms.assetid: 6ee25b33-ad43-4097-b031-7be680f64c7c +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Network access: Do not allow anonymous enumeration of SAM accounts - - **Applies to** - - Windows 10 - Describes the best practices, location, values, and security considerations for the **Network access: Do not allow anonymous enumeration of SAM accounts** security policy setting. - ## Reference - - This policy setting determines which additional permissions will be assigned for anonymous connections to the device. Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares. This is convenient, for example, when an administrator wants to give access to users in a trusted domain that does not maintain a reciprocal trust. - This policy setting has no impact on domain controllers. - Misuse of this policy setting is a common error that can cause data loss or problems with data access or security. - ### Possible values - - Enabled - - Disabled - No additional permissions can be assigned by the administrator for anonymous connections to the device. Anonymous connections will rely on default permissions. - - Not defined - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -82,53 +63,24 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ### Policy conflicts - Even with this policy setting enabled, anonymous users will have access to resources with permissions that explicitly include the built-in group, ANONYMOUS LOGON (on systems earlier than Windows Server 2008 and Windows Vista). - ### Group Policy - This policy has no impact on domain controllers. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - An unauthorized user could anonymously list account names and use the information to perform social engineering attacks or attempt to guess passwords. Social engineering attackers try to deceive users in some way to obtain passwords or some form of security information. - ### Countermeasure - Enable the **Network access: Do not allow anonymous enumeration of SAM accounts** setting. - ### Potential impact - It is impossible to grant access to users of another domain across a one-way trust because administrators in the trusting domain are unable to enumerate lists of accounts in the other domain. Users who access file and print servers anonymously are unable to list the shared network resources on those servers; the users must be authenticated before they can view the lists of shared folders and printers. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md b/windows/keep-secure/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md index 6fd38c9352..16fa1842da 100644 --- a/windows/keep-secure/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md +++ b/windows/keep-secure/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md @@ -2,50 +2,30 @@ title: Network access Do not allow storage of passwords and credentials for network authentication (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network access Do not allow storage of passwords and credentials for network authentication security policy setting. ms.assetid: b9b64360-36ea-40fa-b795-2d6558c46563 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Network access: Do not allow storage of passwords and credentials for network authentication - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **Network access: Do not allow storage of passwords and credentials for network authentication** security policy setting. - ## Reference - - This security setting determines whether Credential Manager saves passwords and credentials for later use when it gains domain authentication. - ### Possible values - - Enabled - Credential Manager does not store passwords and credentials on the device - - Disabled - Credential Manager will store passwords and credentials on this computer for later use for domain authentication. - - Not defined - ### Best practices - It is a recommended practice to disable the ability of the Windows operating system to cache credentials on any device where credentials are not needed. Evaluate your servers and workstations to determine the requirements. Cached credentials are designed primarily to be used on laptops that require domain credentials when disconnected from the domain. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -84,61 +64,29 @@ The following table lists the actual and effective default values for this polic
-   - ### Policy management - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - A restart of the device is required before this policy will be effective when changes to this policy are saved locally or distributed through Group Policy. - ### Group Policy - This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local computer by using the Local Security Policy snap-in. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Passwords that are cached can be accessed by the user when logged on to the device. Although this information may sound obvious, a problem can arise if the user unknowingly runs malicious software that reads the passwords and forwards them to another, unauthorized user. - **Note**   The chances of success for this exploit and others that involve malicious software are reduced significantly for organizations that effectively implement and manage an enterprise antivirus solution combined with sensible software restriction policies. -   - Regardless of what encryption algorithm is used to encrypt the password verifier, a password verifier can be overwritten so that an attacker can authenticate as the user to whom the verifier belongs. Therefore, the administrator's password may be overwritten. This procedure requires physical access to the device. Utilities exist that can help overwrite the cached verifier. By using one of these utilities, an attacker can authenticate by using the overwritten value. - Overwriting the administrator's password does not help the attacker access data that is encrypted by using that password. Also, overwriting the password does not help the attacker access any Encrypting File System (EFS) data that belongs to other users on that device. Overwriting the password does not help an attacker replace the verifier, because the base keying material is incorrect. Therefore, data that is encrypted by using Encrypting File System or by using the Data Protection API (DPAPI) will not decrypt. - ### Countermeasure - Enable the **Network access: Do not allow storage of passwords and credentials for network authentication** setting. - To limit the number of changed domain credentials that are stored on the computer, set the **cachedlogonscount** registry entry. By default, the operating system caches the verifier for each unique user's ten most recent valid logons. This value can be set to any value between 0 and 50. By default, all versions of the Windows operating system remember 10 cached logons, except Windows Server 2008 and later, which are set at 25. - When you try to log on to a domain from a Windows-based client device, and a domain controller is unavailable, you do not receive an error message. Therefore, you may not notice that you logged on with cached domain credentials. You can set a notification of logon that uses cached domain credentials with the ReportDC registry entry. - ### Potential impact - Users are forced to type passwords whenever they log on to their Microsoft Account or other network resources that are not accessible to their domain account. This policy setting should have no impact on users who access network resources that are configured to allow access with their Active Directory–based domain account. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/network-access-let-everyone-permissions-apply-to-anonymous-users.md b/windows/keep-secure/network-access-let-everyone-permissions-apply-to-anonymous-users.md index a1cbd0efd4..84c96fe8a5 100644 --- a/windows/keep-secure/network-access-let-everyone-permissions-apply-to-anonymous-users.md +++ b/windows/keep-secure/network-access-let-everyone-permissions-apply-to-anonymous-users.md @@ -2,52 +2,31 @@ title: Network access Let Everyone permissions apply to anonymous users (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network access Let Everyone permissions apply to anonymous users security policy setting. ms.assetid: cdbc5159-9173-497e-b46b-7325f4256353 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Network access: Let Everyone permissions apply to anonymous users - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **Network access: Let Everyone permissions apply to anonymous users** security policy setting. - ## Reference - - This policy setting determines what additional permissions are granted for anonymous connections to the device. If you enable this policy setting, anonymous users can enumerate the names of domain accounts and shared folders and perform certain other activities. This capability is convenient, for example, when an administrator wants to grant access to users in a trusted domain that does not maintain a reciprocal trust. - By default, the token that is created for anonymous connections does not include the Everyone SID. Therefore, permissions that are assigned to the Everyone group do not apply to anonymous users. - ### Possible values - - Enabled - The Everyone SID is added to the token that is created for anonymous connections, and anonymous users can access any resource for which the Everyone group has been assigned permissions. - - Disabled - The Everyone SID is removed from the token that is created for anonymous connections. - - Not defined - ### Best practices - - Set this policy to **Disabled**. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Polices\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -86,45 +65,20 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - An unauthorized user could anonymously list account names and shared resources and use the information to attempt to guess passwords, perform social engineering attacks, or launch DoS attacks. - ### Countermeasure - Disable the **Network access: Let Everyone permissions apply to anonymous users** setting. - ### Potential impact - None. This is the default configuration. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/network-access-named-pipes-that-can-be-accessed-anonymously.md b/windows/keep-secure/network-access-named-pipes-that-can-be-accessed-anonymously.md index 3d5c222290..3046386e99 100644 --- a/windows/keep-secure/network-access-named-pipes-that-can-be-accessed-anonymously.md +++ b/windows/keep-secure/network-access-named-pipes-that-can-be-accessed-anonymously.md @@ -2,46 +2,28 @@ title: Network access Named Pipes that can be accessed anonymously (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network access Named Pipes that can be accessed anonymously security policy setting. ms.assetid: 8897d2a4-813e-4d2b-8518-fcee71e1cf2c +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Network access: Named Pipes that can be accessed anonymously - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **Network access: Named Pipes that can be accessed anonymously** security policy setting. - ## Reference - - This policy setting determines which communication sessions, or pipes, have attributes and permissions that allow anonymous access. - Restricting access over named pipes such as COMNAP and LOCATOR helps prevent unauthorized access to the network. - ### Possible values - - User-defined list of shared folders - - Not defined - ### Best practices - - Set this policy to a null value; that is, enable the policy setting, but do not enter named pipes in the text box. This will disable null session access over named pipes, and applications that rely on this feature or on unauthenticated access to named pipes will no longer function. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -80,31 +62,17 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes different features and tools available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ### Group Policy - For this policy setting to take effect, you must also enable the [Network access: Restrict anonymous access to Named Pipes and Shares](network-access-restrict-anonymous-access-to-named-pipes-and-shares.md) setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - You can restrict access over named pipes such as COMNAP and LOCATOR to help prevent unauthorized access to the network. The following list describes available named pipes and their purpose. These pipes were granted anonymous access in earlier versions of Windows and some legacy applications may still use them. - @@ -151,27 +119,12 @@ You can restrict access over named pipes such as COMNAP and LOCATOR to help prev
-   - ### Countermeasure - Configure the **Network access: Named Pipes that can be accessed anonymously** setting to a null value (enable the setting but do not specify named pipes in the text box). - ### Potential impact - This configuration disables null-session access over named pipes, and applications that rely on this feature or on unauthenticated access to named pipes no longer function. This may break trust between Windows Server 2003 domains in a mixed mode environment. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/network-access-remotely-accessible-registry-paths-and-subpaths.md b/windows/keep-secure/network-access-remotely-accessible-registry-paths-and-subpaths.md index b38246a85a..c4154f266c 100644 --- a/windows/keep-secure/network-access-remotely-accessible-registry-paths-and-subpaths.md +++ b/windows/keep-secure/network-access-remotely-accessible-registry-paths-and-subpaths.md @@ -2,48 +2,29 @@ title: Network access Remotely accessible registry paths and subpaths (Windows 10) description: Describes the best practices, location, values, and security considerations for the Network access Remotely accessible registry paths and subpaths security policy setting. ms.assetid: 3fcbbf70-a002-4f85-8e86-8dabad21928e +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Network access: Remotely accessible registry paths and subpaths - - **Applies to** - - Windows 10 - Describes the best practices, location, values, and security considerations for the **Network access: Remotely accessible registry paths and subpaths** security policy setting. - ## Reference - - This policy setting determines which registry paths and subpaths are accessible when an application or process references the WinReg key to determine access permissions. - The registry is a database for device configuration information, much of which is sensitive. A malicious user can use it to facilitate unauthorized activities. The chance of this happening is reduced by the fact that the default ACLs that are assigned throughout the registry are fairly restrictive, and they help protect it from access by unauthorized users. - To allow remote access, you must also enable the Remote Registry service. - ### Possible values - - User-defined list of paths - - Not Defined - ### Best practices - - Set this policy to a null value; that is, enable the policy setting, but do not enter any paths in the text box. Remote management tools, such as the Microsoft Baseline Security Analyzer and Configuration Manager, require remote access to the registry. Removing the default registry paths from the list of accessible paths might cause these and other management tools to fail. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -82,74 +63,35 @@ The following table lists the actual and effective default values for this polic
-   - The combination of all the following registry keys apply to the previous settings: - 1. System\\CurrentControlSet\\Control\\Print\\Printers - 2. System\\CurrentControlSet\\Services\\Eventlog - 3. Software\\Microsoft\\OLAP Server - 4. Software\\Microsoft\\Windows NT\\CurrentVersion\\Print - 5. Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows - 6. System\\CurrentControlSet\\Control\\ContentIndex - 7. System\\CurrentControlSet\\Control\\Terminal Server - 8. System\\CurrentControlSet\\Control\\Terminal Server\\UserConfig - 9. System\\CurrentControlSet\\Control\\Terminal Server\\DefaultUserConfiguration - 10. Software\\Microsoft\\Windows NT\\CurrentVersion\\Perflib - 11. System\\CurrentControlSet\\Services\\SysmonLog - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - The registry contains sensitive device configuration information that could be used by an attacker to facilitate unauthorized activities. The fact that the default ACLs that are assigned throughout the registry are fairly restrictive and help to protect the registry from access by unauthorized users reduces the risk of such an attack. - ### Countermeasure - Configure the **Network access: Remotely accessible registry paths and sub-paths** setting to a null value (enable the setting but do not enter any paths in the text box). - ### Potential impact - Remote management tools such as MBSA and Configuration Manager require remote access to the registry to properly monitor and manage those computers. If you remove the default registry paths from the list of accessible ones, such remote management tools could fail. - **Note**   If you want to allow remote access, you must also enable the Remote Registry service. -   - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/network-access-remotely-accessible-registry-paths.md b/windows/keep-secure/network-access-remotely-accessible-registry-paths.md index dbc8008031..33f15de3de 100644 --- a/windows/keep-secure/network-access-remotely-accessible-registry-paths.md +++ b/windows/keep-secure/network-access-remotely-accessible-registry-paths.md @@ -2,48 +2,29 @@ title: Network access Remotely accessible registry paths (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network access Remotely accessible registry paths security policy setting. ms.assetid: 977f86ea-864f-4f1b-9756-22220efce0bd +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Network access: Remotely accessible registry paths - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **Network access: Remotely accessible registry paths** security policy setting. - ## Reference - - This policy setting determines which registry paths are accessible when an application or process references the WinReg key to determine access permissions. - The registry is a database for device configuration information, much of which is sensitive. A malicious user can use the registry to facilitate unauthorized activities. To reduce the risk of this happening, suitable access control lists (ACLs) are assigned throughout the registry to help protect it from access by unauthorized users. - To allow remote access, you must also enable the Remote Registry service. - ### Possible values - - User-defined list of paths - - Not Defined - ### Best practices - - Set this policy to a null value; that is, enable the policy setting but do not enter any paths in the text box. Remote management tools, such as the Microsoft Baseline Security Analyzer and Configuration Manager, require remote access to the registry. Removing the default registry paths from the list of accessible paths might cause these and other management tools to fail. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -82,58 +63,27 @@ The following table lists the actual and effective default values for this polic
-   - The combination of all the following registry keys apply to the previous settings: - 1. System\\CurrentControlSet\\Control\\ProductOptions - 2. System\\CurrentControlSet\\Control\\Server Applications - 3. Software\\Microsoft\\Windows NT\\CurrentVersion - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - An attacker could use information in the registry to facilitate unauthorized activities. To reduce the risk of such an attack, suitable ACLs are assigned throughout the registry to help protect it from access by unauthorized users. - ### Countermeasure - Configure the **Network access: Remotely accessible registry paths** setting to a null value (enable the setting, but do not enter any paths in the text box). - ### Potential impact - Remote management tools such as the Microsoft Baseline Security Analyzer (MBSA) and Configuration Manager require remote access to the registry to properly monitor and manage those computers. If you remove the default registry paths from the list of accessible ones, such remote management tools could fail. - **Note**   If you want to allow remote access, you must also enable the Remote Registry service. -   - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md b/windows/keep-secure/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md index baaacfe3a8..ab84cb8711 100644 --- a/windows/keep-secure/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md +++ b/windows/keep-secure/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md @@ -2,48 +2,29 @@ title: Network access Restrict anonymous access to Named Pipes and Shares (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network access Restrict anonymous access to Named Pipes and Shares security policy setting. ms.assetid: e66cd708-7322-4d49-9b57-1bf8ec7a4c10 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Network access: Restrict anonymous access to Named Pipes and Shares - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **Network access: Restrict anonymous access to Named Pipes and Shares** security policy setting. - ## Reference - - This policy setting enables or disables the restriction of anonymous access to only those shared folders and pipes that are named in the **Network access: Named pipes that can be accessed anonymously** and [Network access: Shares that can be accessed anonymously](network-access-shares-that-can-be-accessed-anonymously.md) settings. The setting controls null session access to shared folders on your computers by adding RestrictNullSessAccess with the value 1 in the registry key **HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\LanManServer\\Parameters**. This registry value toggles null session shared folders on or off to control whether the Server service restricts unauthenticated clients' access to named resources. - Null sessions are a weakness that can be exploited through the various shared folders on the devices in your environment. - ### Possible values - - Enabled - - Disabled - - Not defined - ### Best practices - - Set this policy to Enabled. Enabling this policy setting restricts null session access to unauthenticated users to all server pipes and shared folders except those listed in the **NullSessionPipes** and **NullSessionShares** registry entries. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -82,45 +63,20 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Null sessions are a weakness that can be exploited through shared folders (including the default shared folders) on devices in your environment. - ### Countermeasure - Enable the **Network access: Restrict anonymous access to Named Pipes and Shares** setting. - ### Potential impact - You can enable this policy setting to restrict null-session access for unauthenticated users to all server pipes and shared folders except those that are listed in the NullSessionPipes and NullSessionShares entries. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/network-access-shares-that-can-be-accessed-anonymously.md b/windows/keep-secure/network-access-shares-that-can-be-accessed-anonymously.md index 14290aa358..604898a019 100644 --- a/windows/keep-secure/network-access-shares-that-can-be-accessed-anonymously.md +++ b/windows/keep-secure/network-access-shares-that-can-be-accessed-anonymously.md @@ -2,44 +2,27 @@ title: Network access Shares that can be accessed anonymously (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network access Shares that can be accessed anonymously security policy setting. ms.assetid: f3e4b919-8279-4972-b415-5f815e2f0a1a +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Network access: Shares that can be accessed anonymously - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **Network access: Shares that can be accessed anonymously** security policy setting. - ## Reference - - This policy setting determines which shared folders can be accessed by anonymous users. - ### Possible values - - User-defined list of shared folders - - Not Defined - ### Best practices - - Set this policy to a null value. There should be little impact because this is the default value. All users will have to be authenticated before they can access shared resources on the server. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -78,45 +61,20 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Any shared folders that are listed can be accessed by any network user, which could lead to the exposure or corruption of sensitive data. - ### Countermeasure - Configure the **Network access: Shares that can be accessed anonymously** setting to a null value. - ### Potential impact - There should be little impact because this is the default configuration. Only authenticated users have access to shared resources on the server. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/network-access-sharing-and-security-model-for-local-accounts.md b/windows/keep-secure/network-access-sharing-and-security-model-for-local-accounts.md index e76dbe2316..c1f32eb9c3 100644 --- a/windows/keep-secure/network-access-sharing-and-security-model-for-local-accounts.md +++ b/windows/keep-secure/network-access-sharing-and-security-model-for-local-accounts.md @@ -2,57 +2,34 @@ title: Network access Sharing and security model for local accounts (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network access Sharing and security model for local accounts security policy setting. ms.assetid: 0b3d703c-ea27-488f-8f59-b345af75b994 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Network access: Sharing and security model for local accounts - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **Network access: Sharing and security model for local accounts** security policy setting. - ## Reference - - This policy setting determines how network logons that use local accounts are authenticated. If you configure this policy setting to Classic, network logons that use local account credentials authenticate with those credentials. If you configure this policy setting to Guest only, network logons that use local accounts are automatically mapped to the Guest account. The Classic model provides precise control over access to resources, and it enables you to grant different types of access to different users for the same resource. Conversely, the Guest only model treats all users equally, and they all receive the same level of access to a given resource, which can be either Read Only or Modify. - **Note**   This policy setting does not affect network logons that use domain accounts. Nor does this policy setting affect interactive logons that are performed remotely through services such as Telnet or Remote Desktop Services. - When the device is not joined to a domain, this policy setting also tailors the **Sharing** and **Security** tabs in Windows Explorer to correspond to the sharing and security model that is being used. -   - When the value of this policy setting is **Guest only - local users authenticate as Guest**, any user who can access your device over the network does so with Guest user rights. This means that they will probably be unable to write to shared folders. Although this does increase security, it makes it impossible for authorized users to access shared resources on those systems. When the value is **Classic - local users authenticate as themselves**, local accounts must be password-protected; otherwise, anyone can use those user accounts to access shared system resources. - ### Possible values - - Classic - Local users authenticate as themselves - - Guest only - Local users authenticate as Guest - - Not defined - ### Best practices - 1. For network servers, set this policy to **Classic - local users authenticate as themselves**. - 2. On end-user systems, set this policy to **Guest only - local users authenticate as Guest**. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -91,49 +68,22 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ### Group Policy - This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local computer by using the Local Security Policy snap-in. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - With the Guest only model, any user who can authenticate to your device over the network does so with Guest privileges, which probably means that they do not have Write access to shared resources on that device. Although this restriction does increase security, it makes it more difficult for authorized users to access shared resources on those computers because ACLs on those resources must include access control entries (ACEs) for the Guest account. With the Classic model, local accounts should be password protected. Otherwise, if Guest access is enabled, anyone can use those user accounts to access shared system resources. - ### Countermeasure - For network servers, configure the **Network access: Sharing and security model for local accounts setting** to **Classic – local users authenticate as themselves**. On end-user computers, configure this policy setting to **Guest only – local users authenticate as guest**. - ### Potential impact - None. This is the default configuration. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/network-list-manager-policies.md b/windows/keep-secure/network-list-manager-policies.md index 82b2e0ecd4..931739dc93 100644 --- a/windows/keep-secure/network-list-manager-policies.md +++ b/windows/keep-secure/network-list-manager-policies.md @@ -2,96 +2,50 @@ title: Network List Manager policies (Windows 10) description: Network List Manager policies are security settings that you can use to configure different aspects of how networks are listed and displayed on one device or on many devices. ms.assetid: bd8109d4-b07c-4beb-a9a6-affae2ba2fda +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Network List Manager policies - - **Applies to** - - Windows 10 - Network List Manager policies are security settings that you can use to configure different aspects of how networks are listed and displayed on one device or on many devices. - To configure Network List Manager Policies for one device, you can use the Microsoft Management Console (MMC) with the Group Policy Object Editor snap-in, and edit the local computer policy. The Network List Manager Policies are located at the following path in Group Policy Object Editor: - **Computer Configuration | Windows Settings | Security Settings | Network List Manager Policies** - To configure Network List Manager Policies for many computers, such as for all of the Domain Computers in an Active Directory domain, follow Group Policy documentation to learn how to edit the policies for the object that you require. The path to the Network List Manager Policies is the same as the path listed above. - ### Policy settings for Network List Manager Policies - The following policy settings are provided for Network List Manager Policies. These policy settings are located in the details pane of the Group Policy Object Editor, in **Network Name**. - ### Unidentified Networks - This policy setting allows you to configure the **Network Location**, including the location type and the user permissions, for networks that Windows cannot identify due to a network issue or a lack of identifiable characters in the network information received by the operating system from the network. A network location identifies the type of network that a computer is connected to and automatically sets the appropriate firewall settings for that location. You can configure the following items for this policy setting: - - **Location type**. For this item, the following options are available: - - **Not configured**. If you select this option, this policy setting does not apply a location type to unidentified network connections. - - **Private**. If you select this option, this policy setting applies a location type of Private to unidentified network connections. A private network, such as a home or work network, is a location type that assumes that you trust the other computers on the network. Do not select this item if there is a possibility that an active, unidentified network is in a public place. - - **Public**. If you select this option, this policy setting applies a location type of Public to unidentified network connections. A public network, such as a wireless network at an airport or coffee shop, is a location type that assumes that you do not trust the other computers on the network. - - **User permissions**. For this item, the following options are available: - - **Not configured**. If you select this option, this policy setting does not specify whether users can change the location for unidentified network connections. - - **User can change location**. If you select this option, this policy setting allows users to change an unidentified network connection location from Private to Public or from Public to Private. - - **User cannot change location**. If you select this option, this policy setting does not allow users to change the location of an unidentified network connection. - ### Identifying Networks - This policy setting allows you to configure the **Network Location** for networks that are in a temporary state while Windows works to identify the network and location type. A network location identifies the type of network that a computer is connected to and automatically sets the appropriate firewall settings for that location. You can configure the following items for this policy setting: - - **Location type**. For this item, the following options are available: - - **Not configured**. If you select this option, this policy setting does not apply a location type to network connections that are in the process of being identified by Windows. - - **Private**. If you select this option, this policy setting applies a location type of Private to network connections that are in the process of being identified. A private network, such as a home or work network, is a location type that assumes that you trust the other devices on the network. Do not select this item if there is a possibility that an active, unidentified network is in a public place. - - **Public**. If you select this option, this policy setting applies a location type of Public to network connections that are in the process of being identified by Windows. A public network, such as a wireless network at an airport or coffee shop, is a location type that assumes that you do not trust the other devices on the network. - ### All Networks - This policy setting allows you to specify the **User Permissions** that control whether users can change the network name, location, or icon, for all networks to which the user connects. You can configure the following items for this policy setting: - - **Network name**. For this item, the following options are available: - - **Not configured**. If you select this option, this policy setting does not specify whether users can change the network name for all network connections. - - **User can change name**. If you select this option, users can change the network name for all networks to which they connect. - - **User cannot change name**. If you select this option, users cannot change the network name for any networks to which they connect. - - **Network location**. For this item, the following options are available: - - **Not configured**. If you select this option, this policy setting does not specify whether users can change the location for all network connections. - - **User can change location**. If you select this option, this policy setting allows users to change all network locations from Private to Public or from Public to Private. - - **User cannot change location**. If you select this option, this policy setting does not allow users to change the location for any networks to which they connect. - - **Network icon**. For this item, the following options are available: - - **Not configured**. If you select this option, this policy setting does not specify whether users can change the network icon for all network connections. - - **User can change icon**. If you select this option, this policy setting allows users to change the network icon for all networks to which the user connects. - - **User cannot change icon**. If you select this option, this policy setting does not allow users to change the network icon for any networks to which the user connects. -   -   - - - - - diff --git a/windows/keep-secure/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md b/windows/keep-secure/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md index 3933e3f9ff..532768f78b 100644 --- a/windows/keep-secure/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md +++ b/windows/keep-secure/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md @@ -2,30 +2,20 @@ title: Network security Allow Local System to use computer identity for NTLM (Windows 10) description: Describes the location, values, policy management, and security considerations for the Network security Allow Local System to use computer identity for NTLM security policy setting. ms.assetid: c46a658d-b7a4-4139-b7ea-b9268c240053 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Network security: Allow Local System to use computer identity for NTLM - - **Applies to** - - Windows 10 - Describes the location, values, policy management, and security considerations for the **Network security: Allow Local System to use computer identity for NTLM** security policy setting. - ## Reference - - When services connect to devices that are running versions of the Windows operating system earlier than Windows Vista or Windows Server 2008, services that run as Local System and use SPNEGO (Negotiate) that revert to NTLM will authenticate anonymously. In Windows Server 2008 R2 and Windows 7 and later, if a service connects to a computer running Windows Server 2008 or Windows Vista, the system service uses the computer identity. - When a service connects with the device identity, signing and encryption are supported to provide data protection. (When a service connects anonymously, a system-generated session key is created, which provides no protection, but it allows applications to sign and encrypt data without errors. Anonymous authentication uses a NULL session, which is a session with a server in which no user authentication is performed; and therefore, anonymous access is allowed.) - ### Possible values - @@ -57,17 +47,11 @@ When a service connects with the device identity, signing and encryption are sup
-   - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -106,59 +90,27 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ### Policy conflict considerations - The policy [Network security: Allow LocalSystem NULL session fallback](network-security-allow-localsystem-null-session-fallback.md), if enabled, will allow NTLM or Kerberos authentication to be used when a system service attempts authentication. This will increase the success of interoperability at the expense of security. - The anonymous authentication behavior is different for Windows Server 2008 and Windows Vista than later versions of Windows. Configuring and applying this policy setting on those systems might not produce the same results. - ### Group Policy - This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local computer by using the Local Security Policy snap-in. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - When a service connects to computers running versions of Windows earlier than Windows Vista or Windows Server 2008, services that run as Local System and use SPNEGO (Negotiate) that revert to NTLM will use NULL session. In Windows Server 2008 R2 and Windows 7 and later, if a service connects to a computer running Windows Server 2008 or Windows Vista, the system service uses the computer identity. - When a service connects with the computer identity, signing and encryption are supported to provide data protection. When a service connects with a NULL session, a system-generated session key is created, which provides no protection, but it allows applications to sign and encrypt data without errors. - ### Countermeasure - You can configure the **Network security: Allow Local System to use computer identity for NTLM** security policy setting to allow Local System services that use Negotiate to use the computer identity when reverting to NTLM authentication. - ### Potential impact - If you do not configure this policy setting on Windows Server 2008 and Windows Vista, services running as Local System that use the default credentials will use the NULL session and revert to NTLM authentication for Windows operating systems earlier than Windows Vista or Windows Server 2008. - Beginning with Windows Server 2008 R2 and Windows 7, the system allows Local System services that use Negotiate to use the computer identity when reverting to NTLM authentication. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/network-security-allow-localsystem-null-session-fallback.md b/windows/keep-secure/network-security-allow-localsystem-null-session-fallback.md index ca4c87257c..393c0a9382 100644 --- a/windows/keep-secure/network-security-allow-localsystem-null-session-fallback.md +++ b/windows/keep-secure/network-security-allow-localsystem-null-session-fallback.md @@ -2,50 +2,30 @@ title: Network security Allow LocalSystem NULL session fallback (Windows 10) description: Describes the best practices, location, values, and security considerations for the Network security Allow LocalSystem NULL session fallback security policy setting. ms.assetid: 5b72edaa-bec7-4572-b6f0-648fc38f5395 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Network security: Allow LocalSystem NULL session fallback - - **Applies to** - - Windows 10 - Describes the best practices, location, values, and security considerations for the **Network security: Allow LocalSystem NULL session fallback** security policy setting. - ## Reference - - This policy affects session security during the authentication process between devices running Windows Server 2008 R2 and Windows 7 and later and those devices running earlier versions of the Windows operating system. For computers running Windows Server 2008 R2 and Windows 7 and later, services running as Local System require a service principal name (SPN) to generate the session key. However, if [Network security: Allow Local System to use computer identity for NTLM](network-security-allow-local-system-to-use-computer-identity-for-ntlm.md) is set to disabled, services running as Local System will fall back to using NULL session authentication when they transmit data to servers running versions of Windows earlier than Windows Vista or Windows Server 2008. NULL session does not establish a unique session key for each authentication; and thus, it cannot provide integrity or confidentiality protection. The setting **Network security: Allow LocalSystem NULL session fallback** determines whether services that request the use of session security are allowed to perform signature or encryption functions with a well-known key for application compatibility. - ### Possible values - - **Enabled** - When a service running as Local System connects with a NULL session, a system-generated session key is created, which provides no protection but allows applications to sign and encrypt data without errors. This increases application compatibility, but it degrades the level of security. - - **Disabled** - When a service running as Local System connects with a NULL session, session security will be unavailable. Calls seeking encryption or signing will fail. This setting is more secure, but at the risk of degrading application incompatibility. Calls that are using the device identity instead of a NULL session will still have full use of session security. - - Not defined. When this policy is not defined, the default takes effect. This is Enabled for versions of the Windows operating system earlier than Windows Server 2008 R2 and Windows 7, and it is Disabled otherwise. - ### Best practices - When services connect with the device identity, signing and encryption are supported to provide data protection. When services connect with a NULL session, this level of data protection is not provided. However, you will need to evaluate your environment to determine the Windows operating system versions that you support. If this policy is enabled, some services may not be able to authenticate. - This policy applies to Windows Server 2008 and Windows Vista (SP1 and later). When your environment no longer requires support for Windows NT 4, this policy should be disabled. By default, it is disabled in Windows 7 and Windows Server 2008 R2 and later. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - @@ -84,36 +64,16 @@ Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Sec
-   - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - If this setting is Enabled, when a service connects with a NULL session, a system-generated session key is created, which provides no protection but allows applications to sign and encrypt data without errors. Data that is intended to be protected might be exposed. - ### Countermeasure - You can configure the computer to use the computer identity for Local System with the policy **Network security: Allow Local System to use computer identity for NTLM**. If that is not possible, this policy can be used to prevent data from being exposed in transit if it was protected with a well-known key. - ### Potential impact - If you enable this policy, services that use NULL session with Local System could fail to authenticate because they will be prohibited from using signing and encryption. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md b/windows/keep-secure/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md index 7072c876dd..a5ffb6243d 100644 --- a/windows/keep-secure/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md +++ b/windows/keep-secure/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md @@ -2,59 +2,35 @@ title: Network security Allow PKU2U authentication requests to this computer to use online identities (Windows 10) description: Describes the best practices, location, and values for the Network Security Allow PKU2U authentication requests to this computer to use online identities security policy setting. ms.assetid: e04a854e-d94d-4306-9fb3-56e9bd7bb926 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Network security: Allow PKU2U authentication requests to this computer to use online identities - - **Applies to** - - Windows 10 - Describes the best practices, location, and values for the **Network Security: Allow PKU2U authentication requests to this computer to use online identities** security policy setting. - ## Reference - - Starting with Windows Server 2008 R2 and Windows 7, the Negotiate Security Support Provider (SSP) supports an extension SSP, Negoexts.dll. This extension SSP is treated as an authentication protocol by the Windows operating system, and it supports SSPs from Microsoft, including PKU2U. You can also develop or add other SSPs. - When devices are configured to accept authentication requests by using online IDs, Negoexts.dll calls the PKU2U SSP on the computer that is used to log on. The PKU2U SSP obtains a local certificate and exchanges the policy between the peer computers. When validated on the peer computer, the certificate within the metadata is sent to the logon peer for validation. It associates the user's certificate to a security token, and then the logon process completes. - **Note**   The ability to link online IDs can be performed by anyone with an account that has standard user’s credentials through **Credential Manager**. -   - This policy is not configured by default on domain-joined devices. This would disallow the online identities to be able to authenticate to the domain-joined computers in Windows 7 and later. - ### Possible values - - **Enabled** - This will allow authentication to successfully complete between the two (or more) computers that have established a peer relationship through the use on online IDs. The PKU2U SSP obtains a local certificate and exchanges the policy between the peer devices. When validated on the peer computer, the certificate within the metadata is sent to the logon peer for validation. It associates the user's certificate to a security token, and then the logon process completes. - - **Disabled** - This will prevent online IDs from being used to authenticate the user to another computer in a peer-to-peer relationship. - - Not set. Not configuring this policy prevents online IDs from being used to authenticate the user. This is the default on domain-joined devices - ### Best practices - Within a domain, domain accounts should be used for authentication. Set this policy to **Disabled** or do not configure this policy to exclude online identities from being used to authenticate. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -93,36 +69,16 @@ The following table lists the actual and effective default values for this polic
-   - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Enabling this policy setting allows a user’s account on one computer to be associated with an online identity, such as Microsoft Account, so that account can log on to a peer device (if the peer device is likewise configured) without the use of a Windows logon account (domain or local). Although this is beneficial for workgroups or home groups, using this feature in a domain-joined environment might circumvent your established security policies. - ### Countermeasure - Set this policy to Disabled or do not configure this security policy for domain-joined devices. - ### Potential impact - If you do not set or disable this policy, the PKU2U protocol will not be used to authenticate between peer devices, which forces users to follow domain defined access control policies. If you enable this policy, you will allow your users to authenticate by using local certificates between systems that are not part of a domain that uses PKU2U. This will allow users to share resources between devices - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/network-security-configure-encryption-types-allowed-for-kerberos.md b/windows/keep-secure/network-security-configure-encryption-types-allowed-for-kerberos.md index 981f5cdd24..6fa8240e2e 100644 --- a/windows/keep-secure/network-security-configure-encryption-types-allowed-for-kerberos.md +++ b/windows/keep-secure/network-security-configure-encryption-types-allowed-for-kerberos.md @@ -2,30 +2,20 @@ title: Network security Configure encryption types allowed for Kerberos Win7 only (Windows 10) description: Describes the best practices, location, values and security considerations for the Network security Configure encryption types allowed for Kerberos Win7 only security policy setting. ms.assetid: 303d32cc-415b-44ba-96c0-133934046ece +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Network security: Configure encryption types allowed for Kerberos Win7 only - - **Applies to** - - Windows 10 - Describes the best practices, location, values and security considerations for the **Network security: Configure encryption types allowed for Kerberos Win7 only** security policy setting. - ## Reference - - This policy setting allows you to set the encryption types that the Kerberos protocol is allowed to use. If it is not selected, the encryption type will not be allowed. This setting might affect compatibility with client computers or services and applications. Multiple selections are permitted. - For more information, see [article 977321](http://support.microsoft.com/kb/977321) in the Microsoft Knowledge Base. - The following table lists and explains the allowed encryption types. - @@ -69,37 +59,21 @@ The following table lists and explains the allowed encryption types.
-   - ### Possible values - The encryption type options include: - - DES\_CBC\_CRC - - DES\_CBC\_MD5 - - RC4\_HMAC\_MD5 - - AES128\_HMAC\_SHA1 - - AES256\_HMAC\_SHA1 - - Future encryption types - As of the release of Windows 7 and Windows Server 2008 R2, this is reserved by Microsoft for additional encryption types that might be implemented. - ### Best practices - You must analyze your environment to determine which encryption types will be supported and then select those that meet that evaluation. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - @@ -138,40 +112,18 @@ Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Sec
-   - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Windows Server 2008 R2 and Windows 7 do not support the DES cryptographic suites because stronger ones are available. To enable Kerberos interoperability with non-Windows versions of the Kerberos protocol, these suites can be enabled. However, doing so might open attack vectors on computers running Windows Server 2008 R2 and Windows 7. You can also disable DES for your computers running Windows Vista and Windows Server 2008. - ### Countermeasure - Do not configure this policy. This will force the computers running Windows Server 2008 R2 and Windows 7 to use the AES or RC4 cryptographic suites. - ### Potential impact - If you do not select any of the encryption types, computers running Windows Server 2008 R2 and Windows 7 might have Kerberos authentication failures when connecting with computers running non-Windows versions of the Kerberos protocol. - If you do select any encryption type, you will lower the effectiveness of encryption for Kerberos authentication but you will improve interoperability with computers running older versions of Windows. - Contemporary non-Windows implementations of the Kerberos protocol support RC4 and AES 128-bit and AES 256-bit encryption. Most implementations, including the MIT Kerberos protocol and the Windows Kerberos protocol, are deprecating DES encryption. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md b/windows/keep-secure/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md index 2585a9b1fe..97a0897fcf 100644 --- a/windows/keep-secure/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md +++ b/windows/keep-secure/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md @@ -2,50 +2,30 @@ title: Network security Do not store LAN Manager hash value on next password change (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network security Do not store LAN Manager hash value on next password change security policy setting. ms.assetid: 6452b268-e5ba-4889-9d38-db28f919af51 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Network security: Do not store LAN Manager hash value on next password change - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **Network security: Do not store LAN Manager hash value on next password change** security policy setting. - ## Reference - - This policy setting determines whether LAN Manager is prevented from storing hash values for the new password the next time the password is changed. Hash values are a representation of the password after the encryption algorithm is applied that corresponds to the format that is specified by the algorithm. To decrypt the hash value, the encryption algorithm must be determined and then reversed. The LAN Manager hash is relatively weak and prone to attack compared to the cryptographically stronger NTLM hash. Because the LM hash is stored on the local device in the security database, the passwords can be compromised if the security database, Security Accounts Manager (SAM), is attacked. - By attacking the SAM file, attackers can potentially gain access to user names and password hashes. Attackers can use a password-cracking tool to determine what the password is. After they have access to this information, they can use it to gain access to resources on your network by impersonating users. Enabling this policy setting will not prevent these types of attacks, but it will make them much more difficult. - ### Possible values - - Enabled - - Disabled - - Not defined - ### Best practices - 1. Set **Network security: Do not store LAN Manager hash value on next password change** to **Enabled**. - 2. Require all users to set new passwords the next time they log on to the domain so that LAN Manager hashes are removed. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -84,45 +64,20 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - The SAM file can be targeted by attackers who seek access to user names and password hashes. Such attacks use special tools to discover passwords, which can then be used to impersonate users and gain access to resources on your network. These types of attacks are not prevented by enabling this policy setting because LAN Manager hashes are much weaker than NTLM hashes, but it is much more difficult for these attacks to succeed. - ### Countermeasure - Enable the **Network security: Do not store LAN Manager hash value on next password change** setting. Require all users to set new passwords the next time they log on to the domain so that LAN Manager hashes are removed. - ### Potential impact - Some non-Microsoft applications might not be able to connect to the system. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/network-security-force-logoff-when-logon-hours-expire.md b/windows/keep-secure/network-security-force-logoff-when-logon-hours-expire.md index 2b6ab3ada7..410ead1171 100644 --- a/windows/keep-secure/network-security-force-logoff-when-logon-hours-expire.md +++ b/windows/keep-secure/network-security-force-logoff-when-logon-hours-expire.md @@ -2,52 +2,31 @@ title: Network security Force logoff when logon hours expire (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network security Force logoff when logon hours expire security policy setting. ms.assetid: 64d5dde4-58e4-4217-b2c4-73bd554ec926 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Network security: Force logoff when logon hours expire - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **Network security: Force logoff when logon hours expire** security policy setting. - ## Reference - - This security setting determines whether to disconnect users who are connected to the local device outside their user account's valid logon hours. This setting affects the Server Message Block (SMB) component. - This policy setting does not apply to administrator accounts, but it behaves as an account policy. For domain accounts, there can be only one account policy. The account policy must be defined in the Default Domain Policy, and it is enforced by the domain controllers that make up the domain. A domain controller always pulls the account policy from the Default Domain Policy Group Policy Object (GPO), even if there is a different account policy that is applied to the organizational unit that contains the domain controller. By default, workstations and servers that are joined to a domain (for example, member devices) also receive the same account policy for their local accounts. However, local account policies for member devices can be different from the domain account policy by defining an account policy for the organizational unit that contains the member devices. Kerberos settings are not applied to member devices. - ### Possible values - - Enabled - When enabled, this policy causes client sessions with the SMB server to be forcibly disconnected when the client's logon hours expire. - - Disabled - When disabled, this policy allows for the continuation of an established client session after the client's logon hours have expired. - - Not defined - ### Best practices - - Set **Network security: Force logoff when logon hours expire** to Enabled. SMB sessions will be terminated on member servers when a user's logon time expires, and the user will be unable to log on to the system until their next scheduled access time begins. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -86,45 +65,20 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - If you disable this policy setting, users can remain connected to the computer outside of their allotted logon hours. - ### Countermeasure - Enable the **Network security: Force logoff when logon hours expire** setting. This policy setting does not apply to administrator accounts. - ### Potential impact - When a user's logon time expires, SMB sessions terminate. The user cannot log on to the device until the next scheduled access time commences. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/network-security-lan-manager-authentication-level.md b/windows/keep-secure/network-security-lan-manager-authentication-level.md index 5915894ae2..1b3103d943 100644 --- a/windows/keep-secure/network-security-lan-manager-authentication-level.md +++ b/windows/keep-secure/network-security-lan-manager-authentication-level.md @@ -2,56 +2,33 @@ title: Network security LAN Manager authentication level (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network security LAN Manager authentication level security policy setting. ms.assetid: bbe1a98c-420a-41e7-9d3c-3a2fe0f1843e +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Network security: LAN Manager authentication level - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **Network security: LAN Manager authentication level** security policy setting. - ## Reference - - This policy setting determines which challenge or response authentication protocol is used for network logons. LAN Manager (LM) includes client computer and server software from Microsoft that allows users to link personal devices together on a single network. Network capabilities include transparent file and print sharing, user security features, and network administration tools. In Active Directory domains, the Kerberos protocol is the default authentication protocol. However, if the Kerberos protocol is not negotiated for some reason, Active Directory uses LM, NTLM, or NTLM version 2 (NTLMv2). - LAN Manager authentication includes the LM, NTLM, and NTLMv2 variants, and it is the protocol that is used to authenticate all client devices running the Windows operating system when they perform the following operations: - - Join a domain - - Authenticate between Active Directory forests - - Authenticate to domains based on earlier versions of the Windows operating system - - Authenticate to computers that do not run Windows operating systems, beginning with Windows 2000 - - Authenticate to computers that are not in the domain - ### Possible values - - Send LM & NTLM responses - - Send LM & NTLM - use NTLMv2 session security if negotiated - - Send NTLM responses only - - Send NTLMv2 responses only - - Send NTLMv2 responses only. Refuse LM - - Send NTLMv2 responses only. Refuse LM & NTLM - - Not Defined - The **Network security: LAN Manager authentication level** setting determines which challenge/response authentication protocol is used for network logons. This choice affects the authentication protocol level that clients use, the session security level that the computers negotiate, and the authentication level that servers accept. The following table identifies the policy settings, describes the setting, and identifies the security level used in the corresponding registry setting if you choose to use the registry to control this setting instead of the policy setting. - @@ -98,21 +75,13 @@ The **Network security: LAN Manager authentication level** setting determines wh
-   - ### Best practices - - Best practices are dependent on your specific security and authentication requirements. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -151,49 +120,22 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ### Group Policy - Modifying this setting may affect compatibility with client devices, services, and applications. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - In Windows 7 and Windows Vista, this setting is undefined. In Windows Server 2008 R2 and later, this setting is configured to **Send NTLMv2 responses only**. - ### Countermeasure - Configure the **Network security: LAN Manager Authentication Level** setting to **Send NTLMv2 responses only**. Microsoft and a number of independent organizations strongly recommend this level of authentication when all client computers support NTLMv2. - ### Potential impact - Client devices that do not support NTLMv2 authentication cannot authenticate in the domain and access domain resources by using LM and NTLM. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/network-security-ldap-client-signing-requirements.md b/windows/keep-secure/network-security-ldap-client-signing-requirements.md index ed336b244a..533858f613 100644 --- a/windows/keep-secure/network-security-ldap-client-signing-requirements.md +++ b/windows/keep-secure/network-security-ldap-client-signing-requirements.md @@ -2,56 +2,33 @@ title: Network security LDAP client signing requirements (Windows 10) description: This security policy reference topic for the IT professional describes the best practices, location, values, policy management and security considerations for this policy setting. ms.assetid: 38b35489-eb5b-4035-bc87-df63de50509c +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Network security: LDAP client signing requirements - - **Applies to** - - Windows 10 - This security policy reference topic for the IT professional describes the best practices, location, values, policy management and security considerations for this policy setting. This information applies to computers running at least the Windows Server 2008 operating system. - ## Reference - - This policy setting determines the level of data signing that is requested on behalf of client devices that issue LDAP BIND requests. The levels of data signing are described in the following list: - - **None**. The LDAP BIND request is issued with the caller-specified options. - - **Negotiate signing**. If Transport Layer Security/Secure Sockets Layer (TLS/SSL) has not been started, the LDAP BIND request is initiated with the LDAP data signing option set in addition to the caller-specified options. If TLS/SSL has been started, the LDAP BIND request is initiated with the caller-specified options. - - **Require signing**. This level is the same as **Negotiate signing**. However, if the LDAP server's intermediate saslBindInProgress response does not indicate that LDAP traffic signing is required, the caller is returned a message that the LDAP BIND command request failed. - Misuse of this policy setting is a common error that can cause data loss or problems with data access or security. - ### Possible values - - None - - Negotiate signing - - Require signature - - Not Defined - ### Best practices - - Set **Domain controller: LDAP server signing requirements** to **Require signature**. If you set the server to require LDAP signatures, you must also set the client devices to do so. Not setting the client devices will prevent client computers from communicating with the server. This can cause many features to fail, including user authentication, Group Policy, and logon scripts. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -90,49 +67,22 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ### Group Policy - Modifying this setting may affect compatibility with client devices, services, and applications. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Unsigned network traffic is susceptible to man-in-the-middle attacks in which an intruder captures the packets between the client computer and server, modifies them, and then forwards them to the server. For an LDAP server, this susceptibility means that an attacker could cause a server to make decisions that are based on false or altered data from the LDAP queries. To lower this risk in your network, you can implement strong physical security measures to protect the network infrastructure. Also, you can make all types of man-in-the-middle attacks extremely difficult if you require digital signatures on all network packets by means of IPsec authentication headers. - ### Countermeasure - Configure the **Network security: LDAP server signing requirements** setting to **Require signature**. - ### Potential impact - If you configure the server to require LDAP signatures, you must also configure the client computers. If you do not configure the client devices, they cannot communicate with the server, which could cause many features to fail, including user authentication, Group Policy, and logon scripts. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md b/windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md index 0f6aa65a9c..1fcbb6bbc4 100644 --- a/windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md +++ b/windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md @@ -2,48 +2,29 @@ title: Network security Minimum session security for NTLM SSP based (including secure RPC) clients (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network security Minimum session security for NTLM SSP based (including secure RPC) clients security policy setting. ms.assetid: 89903de8-23d0-4e0f-9bef-c00cb7aebf00 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Network security: Minimum session security for NTLM SSP based (including secure RPC) clients - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **Network security: Minimum session security for NTLM SSP based (including secure RPC) clients** security policy setting. - ## Reference - - This policy setting allows a client device to require the negotiation of 128-bit encryption or NTLMv2 session security. These values are dependent on the **Network security: LAN Manager Authentication Level policy** setting value. - ### Possible values - - Require NTLMv2 session security - The connection fails if strong encryption (128-bit) is not negotiated. - - Require 128-bit encryption - The connection fails if the NTLMv2 protocol is not negotiated. - ### Best practices - Practices in setting this policy are dependent on your security requirements. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -82,49 +63,22 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ### Policy conflicts - The settings for this security policy are dependent on the **Network security: LAN Manager Authentication Level policy** setting value. For info about this policy, see [Network security: LAN Manager authentication level](network-security-lan-manager-authentication-level.md). - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Network traffic that uses the NTLM Security Support Provider (NTLM SSP) could be exposed such that an attacker who has gained access to the network can create man-in-the-middle attacks. - ### Countermeasure - Enable all options that are available for the **Network security: Minimum session security for NTLM SSP based (including secure RPC) clients policy** setting. - ### Potential impact - Client devices that enforce these settings cannot communicate with older servers that do not support them. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md b/windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md index 09698504bc..581c58aa2d 100644 --- a/windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md +++ b/windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md @@ -2,48 +2,29 @@ title: Network security Minimum session security for NTLM SSP based (including secure RPC) servers (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network security Minimum session security for NTLM SSP based (including secure RPC) servers security policy setting. ms.assetid: c6a60c1b-bc8d-4d02-9481-f847a411b4fc +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Network security: Minimum session security for NTLM SSP based (including secure RPC) servers - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **Network security: Minimum session security for NTLM SSP based (including secure RPC) servers** security policy setting. - ## Reference - - This policy setting allows a client device to require the negotiation of 128-bit encryption or NTLMv2 session security. These values are dependent on the [Network security: LAN Manager authentication level](network-security-lan-manager-authentication-level.md) policy setting value. - Setting all of these values for this policy setting will help protect network traffic that uses the NTLM Security Support Provider (NTLM SSP) from being exposed or tampered with by a malicious user who has gained access to the same network. That is, these settings help protect against man-in-the-middle attacks. - ### Possible values - - Require 128-bit encryption. The connection fails if strong encryption (128-bit) is not negotiated. - - Require NTLMv2 session security. The connection fails if the NTLMv2 protocol is not negotiated. - - Not Defined. - ### Best practices - - Enable all values that are available for this security policy. Legacy client devices that do not support these policy settings will be unable to communicate with the server. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -82,49 +63,22 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ### Policy dependencies - The settings for this security policy are dependent on the [Network security: LAN Manager authentication level](network-security-lan-manager-authentication-level.md) setting value. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Network traffic that uses the NTLM Security Support Provider (NTLM SSP) could be exposed such that an attacker who has gained access to the network can create man-in-the-middle attacks. - ### Countermeasure - Enable all options that are available for the **Network security: Minimum session security for NTLM SSP based (including secure RPC) servers** policy setting. - ### Potential impact - Older client devices that do not support these security settings cannot communicate with the computer on which this policy is set. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md b/windows/keep-secure/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md index cd2bf1d88c..64151c9c05 100644 --- a/windows/keep-secure/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md +++ b/windows/keep-secure/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md @@ -2,54 +2,32 @@ title: Network security Restrict NTLM Add remote server exceptions for NTLM authentication (Windows 10) description: Describes the best practices, location, values, management aspects, and security considerations for the Network security Restrict NTLM Add remote server exceptions for NTLM authentication security policy setting. ms.assetid: 9b017399-0a54-4580-bfae-614c2beda3a1 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication - - **Applies to** - - Windows 10 - Describes the best practices, location, values, management aspects, and security considerations for the **Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication** security policy setting. - ## Reference - - The **Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication** policy setting allows you to create an exception list of remote servers to which client devices are allowed to use NTLM authentication if the [Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers](network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md) policy setting is configured. - If you configure this policy setting, you can define a list of remote servers to which client devices are allowed to use NTLM authentication. - If you do not configure this policy setting, no exceptions will be applied, and if [Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers](network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md) is enabled, NTLM authentication attempts from the client devices will fail. - List the NetBIOS server names that are used by the applications as the naming format, one per line. To ensure exceptions, the names that are used by all applications need to be in the list. A single asterisk (\*) can be used anywhere in the string as a wildcard character. - ### Possible values - - User-defined list of remote servers - When you enter a list of remote servers to which clients are allowed to use NTLM authentication, the policy is defined and enabled. - - Not defined - If you do not configure this policy setting by defining a list of servers, the policy is undefined and no exceptions will be applied. - ### Best practices - 1. First enforce the [Network Security: Restrict NTLM: Audit incoming NTLM traffic](network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md) or [Network Security: Restrict NTLM: Audit NTLM authentication in this domain](network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md) policy setting and then review the operational event log to understand which servers are involved in these authentication attempts so you can decide which servers to exempt. - 2. After you have set the server exception list, enforce the [Network Security: Restrict NTLM: Audit incoming NTLM traffic](network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md) or [Network Security: Restrict NTLM: Audit NTLM authentication in this domain](network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md) policy setting and then review the operational event log again before setting the policies to block NTLM traffic. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - @@ -88,59 +66,27 @@ Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Sec
-   - ## Policy management - - This section describes the features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ### Group Policy - Setting and deploying this policy through Group Policy takes precedence over the setting on the local device. If the Group Policy setting is set to **Not Configured**, local settings will apply. - ### Auditing - View the operational event log to see if your server exception list is functioning as intended. Audit and block events are recorded on this device in the operational event log located in **Applications and Services Log\\Microsoft\\Windows\\NTLM**. - There are no security audit policies that can be configured to view output from this policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - When it has been determined that the NTLM authentication protocol should not be used from a client device to any remote servers because you are required to use a more secure protocol such as Kerberos, there might be some client applications that still use NTLM. If so, and you set [Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers](network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md) to any of the deny options, those applications will fail because the outbound NTLM authentication traffic from the client computer will be blocked. - If you define an exception list of servers to which client devices are allowed to use NTLM authentication, then NTLM authentication traffic will continue to flow between those client applications and servers. The servers then are vulnerable to any malicious attack that takes advantage of security weaknesses in NTLM. - ### Countermeasure - When you use [Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers](network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md) in audit-only mode, you can determine by reviewing which client applications are making NTLM authentication requests to the remote servers in your environment. When assessed, you will have to determine on a case-by-case basis if NTLM authentication still minimally meets your security requirements. If not, the client application has to be upgraded to use something other than NTLM authentication. - ### Potential impact - Defining a list of servers for this policy setting will enable NTLM authentication traffic from the client application that uses those servers, and this might result in a security vulnerability. - If this list is not defined and [Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers](network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md) is enabled, then client applications that use NTLM will fail to authenticate to those servers that they have previously used. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md b/windows/keep-secure/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md index dfb2288ae6..a9dd8ee023 100644 --- a/windows/keep-secure/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md +++ b/windows/keep-secure/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md @@ -2,54 +2,32 @@ title: Network security Restrict NTLM Add server exceptions in this domain (Windows 10) description: Describes the best practices, location, values, management aspects, and security considerations for the Network security Restrict NTLM Add server exceptions in this domain security policy setting. ms.assetid: 2f981b68-6aa7-4dd9-b53d-d88551277cc0 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Network security: Restrict NTLM: Add server exceptions in this domain - - **Applies to** - - Windows 10 - Describes the best practices, location, values, management aspects, and security considerations for the **Network security: Restrict NTLM: Add server exceptions in this domain** security policy setting. - ## Reference - - The **Network security: Restrict NTLM: Add server exceptions in this domain** policy setting allows you to create an exception list of servers in this domain to which client device are allowed to use NTLM pass-through authentication if any of the deny options are set in the [Network Security: Restrict NTLM: NTLM authentication in this domain](network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md) policy setting. - If you configure this policy setting, you can define a list of servers in this domain to which client devices are allowed to use NTLM authentication. - If you do not configure this policy setting, no exceptions will be applied, and if **Network Security: Restrict NTLM: NTLM authentication in this domain** is enabled, all NTLM authentication attempts in the domain will fail. - List the NetBIOS server names as the naming format, one per line. A single asterisk (\*) can be used anywhere in the string as a wildcard character. - ### Possible values - - User-defined list of servers - When you enter a list of servers in this domain to which clients are allowed to use NTLM authentication, the policy is defined and enabled. - - Not defined - If you do not configure this policy setting by defining a list of servers, the policy is undefined and no exceptions will be applied. - ### Best practices - 1. First enforce the **Network Security: Restrict NTLM: Audit NTLM authentication in this domain** policy setting, and then review the operational event log to understand what domain controllers are involved in these authentication attempts so you can decide which servers to exempt. - 2. After you have set the server exception list, enforce the **Network Security: Restrict NTLM: Audit NTLM authentication in this domain** policy setting, and then review the operational event log again before setting the policies to block NTLM traffic. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - @@ -88,59 +66,27 @@ Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Sec
-   - ## Policy management - - This section describes different features and tools available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a restart when saved locally or distributed through Group Policy. - ### Group Policy - Setting and deploying this policy via Group Policy takes precedence over the setting on the local device. If the Group Policy is set to **Not Configured**, local settings will apply. - ### Auditing - View the operational event log to see if your server exception list is functioning as intended. Audit and block events are recorded on this computer in the operational event log located in **Applications and Services Log\\Microsoft\\Windows\\NTLM**. - There are no security audit policies that can be configured to view output from this policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - When it has been determined that the NTLM authentication protocol should not be used within a domain because you are required to use a more secure protocol such as Kerberos, there might be some NTLM authentication traffic that is still present in the domain. If so, and you set Network Security: [Network Security: Restrict NTLM: NTLM authentication in this domain](network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md) to any of the deny options, any NTLM authentication request will fail because the pass-through member server will block the NTLM request. - If you define an exception list of servers in this domain to which client computers are allowed to use NTLM pass-through authentication, then NTLM authentication traffic will continue to flow between those servers, which make them vulnerable to any malicious attack that takes advantage of security weaknesses in NTLM. - ### Countermeasure - When you use **Network Security: Restrict NTLM: NTLM authentication in this domain** in audit-only mode, you can determine by reviewing which client applications are making NTLM authentication requests to the pass-through authentication servers. When assessed, you will have to determine on a case-by-case basis if NTLM authentication still minimally meets your security requirements. - ### Potential impact - Defining a list of servers for this policy setting will enable NTLM authentication traffic between those servers might result in a security vulnerability. - If this list is not defined and **Network Security: Restrict NTLM: NTLM authentication in this domain** is enabled, then NTLM authentication will fail on those pass-through servers in the domain that they have previously used - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md b/windows/keep-secure/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md index f801658d52..1f01809e6d 100644 --- a/windows/keep-secure/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md +++ b/windows/keep-secure/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md @@ -2,60 +2,35 @@ title: Network security Restrict NTLM Audit incoming NTLM traffic (Windows 10) description: Describes the best practices, location, values, management aspects, and security considerations for the Network Security Restrict NTLM Audit incoming NTLM traffic security policy setting. ms.assetid: 37e380c2-22e1-44cd-9993-e12815b845cf +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Network security: Restrict NTLM: Audit incoming NTLM traffic - - **Applies to** - - Windows 10 - Describes the best practices, location, values, management aspects, and security considerations for the **Network Security: Restrict NTLM: Audit incoming NTLM traffic** security policy setting. - ## Reference - - The **Network Security: Restrict NTLM: Audit incoming NTLM traffic** policy setting allows you to audit incoming NTLM traffic. - When this audit policy is enabled within Group Policy, it is enforced on any server where that Group Policy is distributed. The events will be recorded in the operational event log located in **Applications and Services Log\\Microsoft\\Windows\\NTLM**. Using an audit event collection system can help you collect the events for analysis more efficiently. - When you enable this policy on a server, only authentication traffic to that server will be logged. - When you enable this audit policy, it functions in the same way as the [Network Security: Restrict NTLM: Incoming NTLM traffic](network-security-restrict-ntlm-incoming-ntlm-traffic.md) policy, but it does not actually block any traffic. Therefore, you can use it effectively to understand the authentication traffic in your environment, and when you are ready to block that traffic, you can enable the Network Security: Restrict NTLM: Incoming NTLM traffic policy setting and select **Deny all accounts** or **Deny all domain accounts**. - ### Possible values - - Disable - The server on which this policy is set will not log events for incoming NTLM traffic. - - Enable auditing for domain accounts - The server on which this policy is set will log events for NTLM pass-through authentication requests only for accounts in the domain that would be blocked when the [Network Security: Restrict NTLM: Incoming NTLM traffic](network-security-restrict-ntlm-incoming-ntlm-traffic.md) policy setting is set to **Deny all domain accounts**. - - Enable auditing for all accounts - The server on which this policy is set will log events for all NTLM authentication requests that would be blocked when the [Network Security: Restrict NTLM: Incoming NTLM traffic](network-security-restrict-ntlm-incoming-ntlm-traffic.md) policy setting is set to **Deny all accounts**. - - Not defined - This is the same as **Disable**, and it results in no auditing of NTLM traffic. - ### Best practices - Depending on your environment and the duration of your testing, monitor the log size regularly. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - @@ -94,57 +69,26 @@ Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Sec
-   - ## Policy management - - This section describes different features and tools available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a restart when saved locally or distributed through Group Policy. - ### Group Policy - Setting and deploying this policy using Group Policy takes precedence over the setting on the local device. If the Group Policy is set to **Not Configured**, local settings will apply. - ### Auditing - View the operational event log to see if this policy is functioning as intended. Audit and block events are recorded on this computer in the operational event log located in **Applications and Services Log\\Microsoft\\Windows\\NTLM**. Using an audit event collection system can help you collect the events for analysis more efficiently. - There are no security audit event policies that can be configured to view output from this policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - NTLM and NTLMv2 authentication is vulnerable to a variety of malicious attacks, including SMB relay, man-in-the-middle attacks, and brute force attacks. Reducing and eliminating NTLM authentication from your environment forces the Windows operating system to use more secure protocols, such as the Kerberos version 5 protocol, or different authentication mechanisms, such as smart cards. - ### Vulnerability - Enabling this policy setting will reveal through logging which servers and client computers within your network or domain handle NTLM traffic. The identity of these devices can be used in malicious ways if NTLM authentication traffic is compromised. The policy setting does not prevent or mitigate any vulnerability because it is for audit purposes only. - ### Countermeasure - Restrict access to the log files when this policy setting is enabled in your production environment. - ### Potential impact - If you do not enable or configure this policy setting, no NTLM authentication traffic information will be logged. If you do enable this policy setting, only auditing functions will occur; no security enhancements will be implemented. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md b/windows/keep-secure/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md index e8a80b5166..6f7df9f011 100644 --- a/windows/keep-secure/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md +++ b/windows/keep-secure/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md @@ -2,58 +2,34 @@ title: Network security Restrict NTLM Audit NTLM authentication in this domain (Windows 10) description: Describes the best practices, location, values, management aspects, and security considerations for the Network Security Restrict NTLM Audit NTLM authentication in this domain security policy setting. ms.assetid: 33183ef9-53b5-4258-8605-73dc46335e6e +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Network security: Restrict NTLM: Audit NTLM authentication in this domain - - **Applies to** - - Windows 10 - Describes the best practices, location, values, management aspects, and security considerations for the **Network Security: Restrict NTLM: Audit NTLM authentication in this domain** security policy setting. - ## Reference - - The **Network Security: Restrict NTLM: Audit NTLM authentication in this domain** policy setting allows you to audit on the domain controller NTLM authentication in that domain. - When you enable this policy setting on the domain controller, only authentication traffic to that domain controller will be logged. - When you enable this audit policy, it functions in the same way as the **Network Security: Restrict NTLM: NTLM authentication in this domain** policy setting, but it does not actually block any traffic. Therefore, you can use it effectively to understand the authentication traffic to your domain controllers and when you are ready to block that traffic, you can enable the **Network Security: Restrict NTLM: NTLM authentication in this domain** policy setting and select **Deny for domain accounts to domain servers**, **Deny for domain servers**, or **Deny for domain accounts**. - ### Possible values - - **Disable** - The domain controller on which this policy is set will not log events for incoming NTLM traffic. - - **Enable for domain accounts to domain servers** - The domain controller on which this policy is set will log events for NTLM authentication logon attempts for accounts in the domain to domain servers when NTLM authentication would be denied because the **Network security: Restrict NTLM: NTLM authentication in this domain** policy setting is set to **Deny for domain accounts to domain servers**. - - **Enable for domain accounts** - The domain controller will log events for NTLM authentication logon attempts that use domain accounts when NTLM authentication would be denied because the **Network security: Restrict NTLM: NTLM authentication in this domain** policy setting is set to **Deny for domain accounts**. - - Not defined - This is the same as **Disable** and results in no auditing of NTLM traffic. - ### Best practices - Depending on your environment and the duration of your testing, monitor the operational event log size regularly. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - @@ -92,57 +68,26 @@ Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Sec
-   - ## Policy management - - This section describes different features and tools available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a restart when saved locally or distributed through Group Policy. - ### Group Policy - Setting and deploying this policy using Group Policy takes precedence over the setting on the local device. If the Group Policy is set to **Not Configured**, local settings will apply. - ### Auditing - View the operational event log to see if this policy is functioning as intended. Audit and block events are recorded on this computer in the operational event log located in **Applications and Services Log\\Microsoft\\Windows\\NTLM**. Using an audit event collection system can help you collect the events for analysis more efficiently. - There are no security audit event policies that can be configured to view output from this policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - NTLM and NTLMv2 authentication is vulnerable to a variety of malicious attacks, including SMB replay, man-in-the-middle attacks, and brute force attacks. Reducing and eliminating NTLM authentication from your environment forces the Windows operating system to use more secure protocols, such as the Kerberos version 5 protocol, or different authentication mechanisms, such as smart cards. - ### Vulnerability - Enabling this policy setting will reveal through logging which devices within your network or domain handle NTLM traffic. The identity of these devices can be used in malicious ways if NTLM authentication traffic is compromised. The policy setting does not prevent or mitigate any vulnerability because it is for audit purposes only. - ### Countermeasure - Restrict access to the log files when this policy setting is enabled in your production environment. - ### Potential impact - If you do not enable or configure this policy setting, no NTLM authentication traffic information will be logged. If you do enable this policy setting, only auditing functions will occur; no security enhancements will be implemented. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/network-security-restrict-ntlm-incoming-ntlm-traffic.md b/windows/keep-secure/network-security-restrict-ntlm-incoming-ntlm-traffic.md index 11866f1750..500af92295 100644 --- a/windows/keep-secure/network-security-restrict-ntlm-incoming-ntlm-traffic.md +++ b/windows/keep-secure/network-security-restrict-ntlm-incoming-ntlm-traffic.md @@ -2,54 +2,32 @@ title: Network security Restrict NTLM Incoming NTLM traffic (Windows 10) description: Describes the best practices, location, values, management aspects, and security considerations for the Network Security Restrict NTLM Incoming NTLM traffic security policy setting. ms.assetid: c0eff7d3-ed59-4004-908a-2205295fefb8 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Network security: Restrict NTLM: Incoming NTLM traffic - - **Applies to** - - Windows 10 - Describes the best practices, location, values, management aspects, and security considerations for the **Network Security: Restrict NTLM: Incoming NTLM traffic** security policy setting. - ## Reference - - The **Network Security: Restrict NTLM: Incoming NTLM traffic** policy setting allows you to deny or allow incoming NTLM traffic from client computers, other member servers, or a domain controller. - ### Possible values - - **Allow all** - The server will allow all NTLM authentication requests. - - **Deny all domain accounts** - The server will deny NTLM authentication requests for domain logon, return an NTLM blocked error message to the client device, and log the error, but the server will allow local account logon. - - **Deny all accounts** - The server will deny NTLM authentication requests from all incoming traffic (whether domain account logon or local account logon), return an NTLM blocked error message to the client device, and log the error. - - Not defined - This is the same as **Allow all**, and the server will allow all NTLM authentication requests. - ### Best practices - If you select **Deny all domain accounts** or **Deny all accounts**, incoming NTLM traffic to the member server will be restricted. It is better to set the **Network Security: Restrict NTLM: Audit Incoming NTLM traffic** policy setting and then review the Operational log to understand what authentication attempts are made to the member servers, and subsequently what client applications are using NTLM. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - @@ -88,57 +66,26 @@ Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Sec
-   - ## Policy management - - This section describes different features and tools available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a restart when saved locally or distributed through Group Policy. - ### Group Policy - Setting and deploying this policy using Group Policy takes precedence over the setting on the local device. If the Group Policy is set to **Not Configured**, local settings will apply. - ### Auditing - View the operational event log to see if this policy is functioning as intended. Audit and block events are recorded on this computer in the operational event log located in **Applications and Services Log\\Microsoft\\Windows\\NTLM**. - There are no Security Audit Event policies that can be configured to view event output from this policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - NTLM and NTLMv2 authentication is vulnerable to a variety of malicious attacks, including SMB replay, man-in-the-middle attacks, and brute force attacks. Reducing and eliminating NTLM authentication from your environment forces the Windows operating system to use more secure protocols, such as the Kerberos version 5 protocol, or different authentication mechanisms, such as smart cards. - ### Vulnerability - Malicious attacks on NTLM authentication traffic that result in a compromised server can occur only if the server handles NTLM requests. If those requests are denied, brute force attacks on NTLM are eliminated. - ### Countermeasure - When it has been determined that the NTLM authentication protocol should not be used within a network because you are required to use a more secure protocol such as Kerberos, you can select one of several options that this security policy setting offers to restrict NTLM usage. - ### Potential impact - If you configure this policy setting, numerous NTLM authentication requests could fail within your network, which could degrade productivity. Before implementing this change through this policy setting, set **Network security: Restrict NTLM: Audit Incoming NTLM traffic** to the same option so that you can review the log for the potential impact, perform an analysis of servers, and create an exception list of servers to exclude from this policy setting [Network security: Restrict NTLM: Add server exceptions in this domain](network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md). - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md b/windows/keep-secure/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md index 47e59383c0..27500c1d95 100644 --- a/windows/keep-secure/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md +++ b/windows/keep-secure/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md @@ -2,64 +2,37 @@ title: Network security Restrict NTLM NTLM authentication in this domain (Windows 10) description: Describes the best practices, location, values, management aspects, and security considerations for the Network Security Restrict NTLM NTLM authentication in this domain security policy setting. ms.assetid: 4c7884e9-cc11-4402-96b6-89c77dc908f8 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Network security: Restrict NTLM: NTLM authentication in this domain - - **Applies to** - - Windows 10 - Describes the best practices, location, values, management aspects, and security considerations for the **Network Security: Restrict NTLM: NTLM authentication in this domain** security policy setting. - ## Reference - - The **Network Security: Restrict NTLM: NTLM authentication in this domain** policy setting allows you to deny or allow NTLM authentication within a domain from this domain controller. This policy setting does not affect interactive logon to this domain controller. - ### Possible values - - **Disable** - The domain controller will allow all NTLM pass-through authentication requests within the domain. - - **Deny for domain accounts to domain servers** - The domain controller will deny all NTLM authentication logon attempts using accounts from this domain to all servers in the domain. The NTLM authentication attempts will be blocked and will return an NTLM blocked error unless the server name is on the exception list in the **Network security: Restrict NTLM: Add server exceptions in this domain** policy setting. - NTLM can be used if the users are connecting to other domains. This depends on if any Restrict NTLM policies have been set on those domains. - - **Deny for domain accounts** - Only the domain controller will deny all NTLM authentication logon attempts from domain accounts and will return an NTLM blocked error unless the server name is on the exception list in the **Network security: Restrict NTLM: Add server exceptions in this domain** policy setting. - - **Deny for domain servers** - The domain controller will deny NTLM authentication requests to all servers in the domain and will return an NTLM blocked error unless the server name is on the exception list in the **Network security: Restrict NTLM: Add server exceptions in this domain** policy setting. Servers that are not joined to the domain will not be affected if this policy setting is configured. - - **Deny all** - The domain controller will deny all NTLM pass-through authentication requests from its servers and for its accounts and return an NTLM blocked error unless the server name is on the exception list in the **Network security: Restrict NTLM: Add server exceptions in this domain** policy setting. - - Not defined - The domain controller will allow all NTLM authentication requests in the domain where the policy is deployed. - ### Best practices - If you select any of the deny options, incoming NTLM traffic to the domain will be restricted. First, set the **Network Security: Restrict NTLM: Audit NTLM authentication in this domain** policy setting, and then review the Operational log to understand what authentication attempts are made to the member servers. You can then add those member server names to a server exception list by using the [Network security: Restrict NTLM: Add server exceptions in this domain](network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md) policy setting. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - @@ -98,57 +71,26 @@ Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Sec
-   - ## Policy management - - This section describes different features and tools available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a restart when saved locally or distributed through Group Policy. - ### Group Policy - Setting and deploying this policy using Group Policy takes precedence over the setting on the local device. If the Group Policy is set to **Not Configured**, local settings will apply. - ### Auditing - View the operational event log to see if this policy is functioning as intended. Audit and block events are recorded on this computer in the operational event log located in **Applications and Services Log\\Microsoft\\Windows\\NTLM**. - There are no security audit event policies that can be configured to view output from this policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - NTLM and NTLMv2 authentication is vulnerable to a variety of malicious attacks, including SMB replay, man-in-the-middle attacks, and brute force attacks. Reducing and eliminating NTLM authentication from your environment forces the Windows operating system to use more secure protocols, such as the Kerberos version 5 protocol, or different authentication mechanisms, such as smart cards. - ### Vulnerability - Malicious attacks on NTLM authentication traffic resulting in a compromised server or domain controller can occur only if the server or domain controller handles NTLM requests. If those requests are denied, this attack vector is eliminated. - ### Countermeasure - When it has been determined that the NTLM authentication protocol should not be used within a network because you are required to use a more secure protocol such as the Kerberos protocol, then you can select one of several options that this security policy setting offers to restrict NTLM usage within the domain. - ### Potential impact - If you configure this policy setting, numerous NTLM authentication requests could fail within the domain, which could degrade productivity. Before implementing this change through this policy setting, set **Network security: Restrict NTLM: Audit NTLM authentication in this domain** to the same option so that you can review the log for the potential impact, perform an analysis of servers, and create an exception list of servers to exclude from this policy setting by using [Network security: Restrict NTLM: Add server exceptions in this domain](network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md). - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md b/windows/keep-secure/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md index defbe6351f..b73aff9db6 100644 --- a/windows/keep-secure/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md +++ b/windows/keep-secure/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md @@ -2,59 +2,35 @@ title: Network security Restrict NTLM Outgoing NTLM traffic to remote servers (Windows 10) description: Describes the best practices, location, values, management aspects, and security considerations for the Network Security Restrict NTLM Outgoing NTLM traffic to remote servers security policy setting. ms.assetid: 63437a90-764b-4f06-aed8-a4a26cf81bd1 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers - - **Applies to** - - Windows 10 - Describes the best practices, location, values, management aspects, and security considerations for the **Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers** security policy setting. - ## Reference - - The **Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers** policy setting allows you to deny or audit outgoing NTLM traffic from a computer running Windows 7, Windows Server 2008, or later to any remote server running the Windows operating system. - **Warning**   Modifying this policy setting may affect compatibility with client computers, services, and applications. -   - ### Possible values - - **Allow all** - The device can authenticate identities to a remote server by using NTLM authentication because no restrictions exist. - - **Audit all** - The device that sends the NTLM authentication request to a remote server logs an event for each request. This allows you to identify those servers that receive NTLM authentication requests from the client device - - **Deny all** - The device cannot authenticate any identities to a remote server by using NTLM authentication. You can use the [Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication](network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md) policy setting to define a list of remote servers to which client devices are allowed to use NTLM authentication while denying others. This setting will also log an event on the device that is making the authentication request. - - Not defined - This is the same as **Allow all**, and the device will allow all NTLM authentication requests when the policy is deployed. - ### Best practices - If you select **Deny all**, the client device cannot authenticate identities to a remote server by using NTLM authentication. First, select **Audit all** and then review the operational event log to understand which servers are involved in these authentication attempts. You can then add those server names to a server exception list by using the [Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication](network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md) policy setting. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - @@ -93,57 +69,26 @@ Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Sec
-   - ## Policy management - - This section describes different features and tools available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a restart when saved locally or distributed through Group Policy. - ### Group Policy - Setting and deploying this policy using Group Policy takes precedence over the setting on the local device. If the Group Policy is set to **Not Configured**, local settings will apply. - ### Auditing - View the operational event log to see if this policy is functioning as intended. Audit and block events are recorded on this computer in the operational event log located in **Applications and Services Log\\Microsoft\\Windows\\NTLM**. - There are no security audit event policies that can be configured to view event output from this policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - NTLM and NTLMv2 authentication is vulnerable to a variety of malicious attacks, including SMB replay, man-in-the-middle attacks, and brute force attacks. Reducing and eliminating NTLM authentication from your environment forces the Windows operating system to use more secure protocols, such as the Kerberos version 5 protocol, or different authentication mechanisms, such as smart cards. - ### Vulnerability - Malicious attacks on NTLM authentication traffic that result in a compromised server or domain controller can occur only if the server or domain controller handles NTLM requests. If those requests are denied, this attack vector is eliminated. - ### Countermeasure - When it has been determined that the NTLM authentication protocol should not be used within a network because you are required to use a more secure protocol such as Kerberos, then you can select from several options to restrict NTLM usage to servers. - ### Potential impact - If you configure this policy setting to deny all requests, numerous NTLM authentication requests to remote servers could fail, which could degrade productivity. Before implementing this restriction through this policy setting, select **Audit all** so that you can review the log for the potential impact, perform an analysis of servers, and create an exception list of servers to exclude from this policy setting by using [Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication](network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md). - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/optimize-applocker-performance.md b/windows/keep-secure/optimize-applocker-performance.md index 87143fb82f..f8eb1d4d8e 100644 --- a/windows/keep-secure/optimize-applocker-performance.md +++ b/windows/keep-secure/optimize-applocker-performance.md @@ -2,41 +2,22 @@ title: Optimize AppLocker performance (Windows 10) description: This topic for IT professionals describes how to optimize AppLocker policy enforcement. ms.assetid: a20efa20-bc98-40fe-bd81-28ec4905e0f6 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Optimize AppLocker performance - - **Applies to** - - Windows 10 - This topic for IT professionals describes how to optimize AppLocker policy enforcement. - ## Optimization of Group Policy - - AppLocker policies can be implemented by organization unit (OU) using Group Policy. If so, your Group Policy infrastructure should be optimized and retested for performance when AppLocker policies are added to existing Group Policy Objects (GPOs) or new GPOs are created, as you do with adding any policies to your GPOs. - For more info, see the [Optimizing Group Policy Performance](http://go.microsoft.com/fwlink/p/?LinkId=163238) article in TechNet Magazine. - ### AppLocker rule limitations - The more rules per GPO, the longer AppLocker requires for evaluation. There is no set limitation on the number of rules per GPO, but the number of rules that can fit into a 100 MB GPO varies based on the complexity of the rule, such as the number of file hashes included in a single file hash condition. - ### Using the DLL rule collection - When the DLL rule collection is enabled, AppLocker must check each DLL that an application loads. The more DLLs, the longer AppLocker requires to complete the evaluation. -   -   - - - - - diff --git a/windows/keep-secure/packaged-apps-and-packaged-app-installer-rules-in-applocker.md b/windows/keep-secure/packaged-apps-and-packaged-app-installer-rules-in-applocker.md index 428029452b..64303436c2 100644 --- a/windows/keep-secure/packaged-apps-and-packaged-app-installer-rules-in-applocker.md +++ b/windows/keep-secure/packaged-apps-and-packaged-app-installer-rules-in-applocker.md @@ -2,48 +2,26 @@ title: Packaged apps and packaged app installer rules in AppLocker (Windows 10) description: This topic explains the AppLocker rule collection for packaged app installers and packaged apps. ms.assetid: 8fd44d08-a0c2-4c5b-a91f-5cb9989f971d +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Packaged apps and packaged app installer rules in AppLocker - - **Applies to** - - Windows 10 - This topic explains the AppLocker rule collection for packaged app installers and packaged apps. - Universal Windows apps can be installed through the Windows Store or can be sideloaded using the Windows PowerShell cmdlets. Universal Windows apps can be installed by a standard user unlike some Classic Windows applications that sometimes require administrative privileges for installation. - Typically, an app consists of multiple components – the installer used to install the app and one or more exes, dlls or scripts. With Classic Windows applications, not all those components always share common attributes such as the publisher name, product name and product version. Therefore, AppLocker has to control each of these components separately through different rule collections – exe, dll, script and Windows Installers. In contrast, all the components of a Universal Windows app share the same attributes: Publisher name, Package name and Package version. It is therefore possible to control an entire app with a single rule. - AppLocker enforces rules for Universal Windows apps separately from Classic Windows applications. A single AppLocker rule for a Universal Windows app can control both the installation and the running of an app. Because all Universal Windows apps are signed, AppLocker supports only publisher rules for Universal Windows apps. A publisher rule for a Universal Windows app is based on the following attributes of the app: - - Publisher name - - Package name - - Package version - In summary, including AppLocker rules for Universal Windows apps in your policy design provides: - - The ability to control the installation and running of the app - - The ability to control all the components of the app with a single rule rather than controlling individual binaries within the app - - The ability to create application control policies that survive app updates - - Management of Universal Windows apps through Group Policy. -   -   - - - - - diff --git a/windows/keep-secure/passport-event-300.md b/windows/keep-secure/passport-event-300.md index d5f6dd3808..dfcc826405 100644 --- a/windows/keep-secure/passport-event-300.md +++ b/windows/keep-secure/passport-event-300.md @@ -2,26 +2,19 @@ title: Event ID 300 - Passport successfully created (Windows 10) description: This event is created when a Microsoft Passport for Enterprise is successfully created and registered with Azure Active Directory (Azure AD). ms.assetid: 0DD59E75-1C5F-4CC6-BB0E-71C83884FF04 +ms.pagetype: security keywords: ["ngc"] ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: jdeckerMS --- - # Event ID 300 - Passport successfully created - - **Applies to** - - Windows 10 - Windows 10 Mobile - This event is created when a Microsoft Passport for Enterprise is successfully created and registered with Azure Active Directory (Azure AD). Applications or services can trigger actions on this event. For example, a certificate provisioning service can listen to this event and trigger a certificate request. - ## Event details - - | | | |--------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Product:** | Windows 10 operating system | @@ -29,34 +22,15 @@ This event is created when a Microsoft Passport for Enterprise is successfully c | **Source:** | Microsoft Azure Device Registration Service | | **Version:** | 10 | | **Message:** | The NGC key was successfully registered. Key ID: {4476694e-8e3b-4ef8-8487-be21f95e6f07}. UPN:test@contoso.com. Attestation: ATT\_SOFT. Client request ID: . Server request ID: db2da6bd-3d70-4b9b-b26b-444f669902da. Server response: {"kid":"4476694e-8e3b-4ef8-8487-be21f95e6f07","upn":"test@contoso.com"} | -   - ## Resolve - - This is a normal condition. No further action is required. - ## Related topics - - [Manage identity verification using Microsoft Passport](manage-identity-verification-using-microsoft-passport.md) - [Implement Microsoft Passport in your organization](implement-microsoft-passport-in-your-organization.md) - [Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) - [Prepare people to use Microsoft Passport](prepare-people-to-use-microsoft-passport.md) - [Microsoft Passport and password changes](microsoft-passport-and-password-changes.md) - [Microsoft Passport errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) -   -   - - - - - diff --git a/windows/keep-secure/password-must-meet-complexity-requirements.md b/windows/keep-secure/password-must-meet-complexity-requirements.md index c4b7b4420c..fba24e4fb4 100644 --- a/windows/keep-secure/password-must-meet-complexity-requirements.md +++ b/windows/keep-secure/password-must-meet-complexity-requirements.md @@ -2,76 +2,43 @@ title: Password must meet complexity requirements (Windows 10) description: Describes the best practices, location, values, and security considerations for the Password must meet complexity requirements security policy setting. ms.assetid: 94482ae3-9dda-42df-9782-2f66196e6afe +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Password must meet complexity requirements - - **Applies to** - - Windows 10 - Describes the best practices, location, values, and security considerations for the **Password must meet complexity requirements** security policy setting. - ## Reference - - The **Passwords must meet complexity requirements** policy setting determines whether passwords must meet a series of guidelines that are considered important for a strong password. Enabling this policy setting requires passwords to meet the following requirements: - 1. Passwords may not contain the user's samAccountName (Account Name) value or entire displayName (Full Name value). Both checks are not case sensitive. - The samAccountName is checked in its entirety only to determine whether it is part of the password. If the samAccountName is less than three characters long, this check is skipped. - The displayName is parsed for delimiters: commas, periods, dashes or hyphens, underscores, spaces, pound signs, and tabs. If any of these delimiters are found, the displayName is split and all parsed sections (tokens) are confirmed to not be included in the password. Tokens that are less than three characters are ignored, and substrings of the tokens are not checked. For example, the name "Erin M. Hagens" is split into three tokens: "Erin", "M", and "Hagens". Because the second token is only one character long, it is ignored. Therefore, this user could not have a password that included either "erin" or "hagens" as a substring anywhere in the password. - 2. The password contains characters from three of the following categories: - - Uppercase letters of European languages (A through Z, with diacritic marks, Greek and Cyrillic characters) - - Lowercase letters of European languages (a through z, sharp-s, with diacritic marks, Greek and Cyrillic characters) - - Base 10 digits (0 through 9) - - Non-alphanumeric characters (special characters) (for example, !, $, \#, %) - - Any Unicode character that is categorized as an alphabetic character but is not uppercase or lowercase. This includes Unicode characters from Asian languages. - Complexity requirements are enforced when passwords are changed or created. - The rules that are included in the Windows Server password complexity requirements are part of Passfilt.dll, and they cannot be directly modified. - Enabling the default Passfilt.dll may cause some additional Help Desk calls for locked-out accounts because users might not be used to having passwords that contain characters other than those found in the alphabet. However, this policy setting is liberal enough that all users should be able to abide by the requirements with a minor learning curve. - Additional settings that can be included in a custom Passfilt.dll are the use of non–upper-row characters. Upper-row characters are those that are typed by holding down the SHIFT key and typing any of the digits from 1 through 10. - ### Possible values - - Enabled - - Disabled - - Not defined - ### Best practices - Set **Passwords must meet complexity requirements** to Enabled. This policy setting, combined with a minimum password length of 8, ensures that there are at least 218,340,105,584,896 different possibilities for a single password. This makes a brute force attack difficult, but still not impossible. - The use of ALT key character combinations can greatly enhance the complexity of a password. However, requiring all users in an organization to adhere to such stringent password requirements can result in unhappy users and an extremely busy Help Desk. Consider implementing a requirement in your organization to use ALT characters in the range from 0128 through 0159 as part of all administrator passwords. (ALT characters outside of this range can represent standard alphanumeric characters that do not add additional complexity to the password.) - Passwords that contain only alphanumeric characters are easy to compromise by using publicly available tools. To prevent this, passwords should contain additional characters and meet complexity requirements. - ### Location - **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy** - ### Default values - The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - @@ -110,42 +77,19 @@ The following table lists the actual and effective default policy values. Defaul
-   - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Passwords that contain only alphanumeric characters are extremely easy to discover with several publicly available tools. - ### Countermeasure - Configure the **Passwords must meet complexity requirements** policy setting to Enabled and advise users to use a variety of characters in their passwords. - When combined with a [Minimum password length](minimum-password-length.md) of 8, this policy setting ensures that the number of different possibilities for a single password is so great that it is difficult (but not impossible) for a brute force attack to succeed. (If the Minimum password length policy setting is increased, the average amount of time necessary for a successful attack also increases.) - ### Potential impact - If the default password complexity configuration is retained, additional Help Desk calls for locked-out accounts could occur because users might not be accustomed to passwords that contain non-alphabetical characters, or they might have problems entering passwords that contain accented characters or symbols on keyboards with different layouts. However, all users should be able to comply with the complexity requirement with minimal difficulty. - If your organization has more stringent security requirements, you can create a custom version of the Passfilt.dll file that allows the use of arbitrarily complex password strength rules. For example, a custom password filter might require the use of non-upper-row symbols. (Upper-row symbols are those that require you to press and hold the SHIFT key and then press any of the digits between 1 and 0.) A custom password filter might also perform a dictionary check to verify that the proposed password does not contain common dictionary words or fragments. - The use of ALT key character combinations can greatly enhance the complexity of a password. However, such stringent password requirements can result in additional Help Desk requests. Alternatively, your organization could consider a requirement for all administrator passwords to use ALT characters in the 0128–0159 range. (ALT characters outside of this range can represent standard alphanumeric characters that would not add additional complexity to the password.) - ## Related topics - - [Password Policy](password-policy.md) -   -   - - - - - diff --git a/windows/keep-secure/password-policy.md b/windows/keep-secure/password-policy.md index 742ac0e7dd..4d1c366110 100644 --- a/windows/keep-secure/password-policy.md +++ b/windows/keep-secure/password-policy.md @@ -2,42 +2,26 @@ title: Password Policy (Windows 10) description: An overview of password policies for Windows and links to information for each policy setting. ms.assetid: aec1220d-a875-4575-9050-f02f9c54a3b6 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Password Policy - - **Applies to** - - Windows 10 - An overview of password policies for Windows and links to information for each policy setting. - In many operating systems, the most common method to authenticate a user's identity is to use a secret passphrase or password. A secure network environment requires all users to use strong passwords, which have at least eight characters and include a combination of letters, numbers, and symbols. These passwords help prevent the compromise of user accounts and administrative accounts by unauthorized users who use manual methods or automated tools to guess weak passwords. Strong passwords that are changed regularly reduce the likelihood of a successful password attack. - Introduced in Windows Server 2008 R2 and Windows Server 2008, Windows supports fine-grained password policies. This feature provides organizations with a way to define different password and account lockout policies for different sets of users in a domain. Fine-grained password policies apply only to user objects (or inetOrgPerson objects if they are used instead of user objects) and global security groups. - To apply a fine-grained password policy to users of an OU, you can use a shadow group. A shadow group is a global security group that is logically mapped to an OU to enforce a fine-grained password policy. You add users of the OU as members of the newly created shadow group and then apply the fine-grained password policy to this shadow group. You can create additional shadow groups for other OUs as needed. If you move a user from one OU to another, you must update the membership of the corresponding shadow groups. - Fine-grained password policies include attributes for all the settings that can be defined in the default domain policy (except Kerberos settings) in addition to account lockout settings. When you specify a fine-grained password policy, you must specify all of these settings. By default, only members of the Domain Admins group can set fine-grained password policies. However, you can also delegate the ability to set these policies to other users. The domain must be running at least Windows Server 2008 R2 or Windows Server 2008 to use fine-grained password policies. Fine-grained password policies cannot be applied to an organizational unit (OU) directly. - You can enforce the use of strong passwords through an appropriate password policy. There are password policy settings that control the complexity and lifetime of passwords, such as the **Passwords must meet complexity requirements** policy setting. - You can configure the password policy settings in the following location by using the Group Policy Management Console: - **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy** - If individual groups require distinct password policies, these groups should be separated into another domain or forest, based on additional requirements. - The following topics provide a discussion of password policy implementation and best practices considerations, policy location, default values for the server type or GPO, relevant differences in operating system versions, security considerations (including the possible vulnerabilities of each setting), countermeasures that you can take, and the potential impact for each setting. - ## In this section - - @@ -76,19 +60,8 @@ The following topics provide a discussion of password policy implementation and
-   - ## Related topics - - [Configure security policy settings](how-to-configure-security-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/perform-volume-maintenance-tasks.md b/windows/keep-secure/perform-volume-maintenance-tasks.md index 6c1b779093..8080674711 100644 --- a/windows/keep-secure/perform-volume-maintenance-tasks.md +++ b/windows/keep-secure/perform-volume-maintenance-tasks.md @@ -2,50 +2,30 @@ title: Perform volume maintenance tasks (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Perform volume maintenance tasks security policy setting. ms.assetid: b6990813-3898-43e2-8221-c9c06d893244 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Perform volume maintenance tasks - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Perform volume maintenance tasks** security policy setting. - ## Reference - - This policy setting determines which users can perform volume or disk management tasks, such as defragmenting an existing volume, creating or removing volumes, and running the Disk Cleanup tool. - Use caution when assigning this user right. Users with this user right can explore disks and extend files in to memory that contains other data. When the extended files are opened, the user might be able to read and modify the acquired data. - Constant: SeManageVolumePrivilege - ### Possible values - - User-defined list of accounts - - Not Defined - ### Best practices - - Ensure that only the local Administrators group is assigned the **Perform volume maintenance tasks** user right. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - By default this setting is Administrators on domain controllers and on stand-alone servers. - The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - @@ -84,59 +64,27 @@ The following table lists the actual and effective default policy values. Defaul
-   - ## Policy management - - This section describes features, tools, and guidance to help you manage this policy. - A restart of the device is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - ### Group Policy - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - A user who is assigned the **Perform volume maintenance tasks** user right could delete a volume, which could result in the loss of data or a denial-of- service condition. Also, disk maintenance tasks can be used to modify data on the disk, such as user rights assignments that might lead to escalation of privileges. - ### Countermeasure - Ensure that only the local Administrators group is assigned the **Perform volume maintenance tasks** user right. - ### Potential impact - None. Restricting the **Perform volume maintenance tasks** user right to the local Administrators group is the default configuration. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/plan-for-applocker-policy-management.md b/windows/keep-secure/plan-for-applocker-policy-management.md index e3f5b525a5..d7b423cdb3 100644 --- a/windows/keep-secure/plan-for-applocker-policy-management.md +++ b/windows/keep-secure/plan-for-applocker-policy-management.md @@ -2,139 +2,71 @@ title: Plan for AppLocker policy management (Windows 10) description: This topic for describes the decisions you need to make to establish the processes for managing and maintaining AppLocker policies. ms.assetid: dccc196f-6ae0-4ae4-853a-a3312b18751b +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Plan for AppLocker policy management - - **Applies to** - - Windows 10 - This topic for describes the decisions you need to make to establish the processes for managing and maintaining AppLocker policies. - ## Policy management - - Before you begin the deployment process, consider how the AppLocker rules will be managed. Developing a process for managing AppLocker rules helps assure that AppLocker continues to effectively control how applications are allowed to run in your organization. - ### Application and user support policy - Developing a process for managing AppLocker rules helps assure that AppLocker continues to effectively control how applications are allowed to run in your organization. Considerations include: - - What type of end-user support is provided for blocked applications? - - How are new rules added to the policy? - - How are existing rules updated? - - Are events forwarded for review? - **Help desk support** - If your organization has an established help desk support department in place, consider the following when deploying AppLocker policies: - - What documentation does your support department require for new policy deployments? - - What are the critical processes in each business group both in work flow and timing that will be affected by application control policies and how could they affect your support department's workload? - - Who are the contacts in the support department? - - How will the support department resolve application control issues between the end user and those who maintain the AppLocker rules? - **End-user support** - Because AppLocker is preventing unapproved apps from running, it is important that your organization carefully plan how to provide end-user support. Considerations include: - - Do you want to use an intranet site as a first line of support for users who have tried to run a blocked app? - - How do you want to support exceptions to the policy? Will you allow users to run a script to temporarily allow access to a blocked app? - **Using an intranet site** - AppLocker can be configured to display the default message but with a custom URL. You can use this URL to redirect users to a support site that contains information about why the user received the error and which applications are allowed. If you do not display a custom URL for the message when an app is blocked, the default URL is used. - The following image shows an example of the error message for a blocked app. You can use the **Set a support web link** policy setting to customize the **More information** link. - ![applocker blocked application error message](images/blockedappmsg.gif) - For steps to display a custom URL for the message, see [Display a custom URL message when users try to run a blocked app](display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md). - **AppLocker event management** - Each time that a process requests permission to run, AppLocker creates an event in the AppLocker event log. The event details which file tried to run, the attributes of that file, the user that initiated the request, and the rule GUID that was used to make the AppLocker execution decision. The AppLocker event log is located in the following path: **Applications and Services Logs\\Microsoft\\Windows\\AppLocker**. The AppLocker log includes three logs: - 1. **EXE and DLL**. Contains events for all files affected by the executable and DLL rule collections (.exe, .com, .dll, and .ocx). - 2. **MSI and Script**. Contains events for all files affected by the Windows Installer and script rule collections (.msi, .msp, .ps1, .bat, .cmd, .vbs, and .js). - 3. **Packaged app-Deployment** or **Packaged app-Execution**, contains events for all Universal Windows apps affected by the packaged app and packed app installer rule collection (.appx). - Collecting these events in a central location can help you maintain your AppLocker policy and troubleshoot rule configuration problems. Event collection technologies such as those available in Windows allow administrators to subscribe to specific event channels and have the events from source computers aggregated into a forwarded event log on a Windows Server operating system collector. For more info about setting up an event subscription, see [Configure Computers to Collect and Forward Events](http://go.microsoft.com/fwlink/p/?LinkId=145012). - ### Policy maintenance - As new apps are deployed or existing apps are updated by the software publisher, you will need to make revisions to your rule collections to ensure that the policy is current. - You can edit an AppLocker policy by adding, changing, or removing rules. However, you cannot specify a version for the policy by importing additional rules. To ensure version control when modifying an AppLocker policy, use Group Policy management software that allows you to create versions of Group Policy Objects (GPOs). An example of this type of software is the Advanced Group Policy Management feature from the Microsoft Desktop Optimization Pack. For more info about Advanced Group Policy Management, see [Advanced Group Policy Management Overview](http://go.microsoft.com/fwlink/p/?LinkId=145013) (http://go.microsoft.com/fwlink/p/?LinkId=145013). - **Caution**   You should not edit an AppLocker rule collection while it is being enforced in Group Policy. Because AppLocker controls what files are allowed to run, making changes to a live policy can create unexpected behavior. -   - **New version of a supported app** - When a new version of an app is deployed in the organization, you need to determine whether to continue to support the previous version of that app. To add the new version, you might only need to create a new rule for each file that is associated with the app. If you are using publisher conditions and the version is not specified, then the existing rule or rules might be sufficient to allow the updated file to run. You must ensure, however, that the updated app has not altered the file names or added files to support new functionality. If so, then you must modify the existing rules or create new rules. To continue to reuse a publisher-based rule without a specific file version, you must also ensure that the file's digital signature is still identical to the previous version—the publisher, product name, and file name (if configured in your rule) must all match for the rule to be correctly applied. - To determine whether a file has been modified during an app update, review the publisher's release details provided with the update package. You can also review the publisher's web page to retrieve this information. Each file can also be inspected to determine the version. - For files that are allowed or denied with file hash conditions, you must retrieve the new file hash. To add support for a new version and maintain support for the older version, you can either create a new file hash rule for the new version or edit the existing rule and add the new file hash to the list of conditions. - For files with path conditions, you should verify that the installation path has not changed from what is stated in the rule. If the path has changed, you need to update the rule before installing the new version of the app - **Recently deployed app** - To support a new app, you must add one or more rules to the existing AppLocker policy. - **App is no longer supported** - If your organization has determined that it will no longer support an application that has AppLocker rules associated with it, the easiest way to prevent users from running the app is to delete these rules. - **App is blocked but should be allowed** - A file could be blocked for three reasons: - - The most common reason is that no rule exists to allow the app to run. - - There may be an existing rule that was created for the file that is too restrictive. - - A deny rule, which cannot be overridden, is explicitly blocking the file. - Before editing the rule collection, first determine what rule is preventing the file from running. You can troubleshoot the problem by using the **Test-AppLockerPolicy** Windows PowerShell cmdlet. For more info about troubleshooting an AppLocker policy, see [Testing and Updating an AppLocker Policy](http://go.microsoft.com/fwlink/p/?LinkId=160269) (http://go.microsoft.com/fwlink/p/?LinkId=160269). - ## Next steps - - After deciding how your organization will manage your AppLocker policy, record your findings. - - **End-user support policy.** Document the process that you will use for handling calls from users who have attempted to run a blocked app, and ensure that support personnel have clear escalation steps so that the administrator can update the AppLocker policy, if necessary. - - **Event processing.** Document whether events will be collected in a central location called a store, how that store will be archived, and whether the events will be processed for analysis. - - **Policy maintenance.** Detail how rules will be added to the policy and in which GPO the rules are defined. - For information and steps how to document your processes, see [Document your application control management processes](document-your-application-control-management-processes.md). -   -   - - - - - diff --git a/windows/keep-secure/planning-and-deploying-advanced-security-audit-policies.md b/windows/keep-secure/planning-and-deploying-advanced-security-audit-policies.md index 6895bda120..8a2a90eb1f 100644 --- a/windows/keep-secure/planning-and-deploying-advanced-security-audit-policies.md +++ b/windows/keep-secure/planning-and-deploying-advanced-security-audit-policies.md @@ -2,135 +2,72 @@ title: Planning and deploying advanced security audit policies (Windows 10) description: This topic for the IT professional explains the options that security policy planners must consider and the tasks they must complete to deploy an effective security audit policy in a network that includes advanced security audit policies. ms.assetid: 7428e1db-aba8-407b-a39e-509671e5a442 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Planning and deploying advanced security audit policies - - **Applies to** - - Windows 10 - This topic for the IT professional explains the options that security policy planners must consider and the tasks they must complete to deploy an effective security audit policy in a network that includes advanced security audit policies. - Organizations invest a large portion of their information technology budgets on security applications and services, such as antimalware software, firewalls, and encryption. But no matter how much security hardware or software you deploy, how tightly you control the rights of users, or how carefully you configure security permissions on your data, you should not consider the job complete unless you have a well-defined, timely auditing strategy to track the effectiveness of your defenses and identify attempts to circumvent them. - To be well defined and timely, an auditing strategy must provide useful tracking data for an organization's most important resources, critical behaviors, and potential risks. In a growing number of organizations, it must also provide absolute proof that IT operations comply with corporate and regulatory requirements. - Unfortunately, no organization has unlimited resources to monitor every resource and activity on a network. If you do not plan well, you will likely have gaps in your auditing strategy. However, if you try to audit every resource and activity, you may find yourself with far too much monitoring data, including thousands of benign audit entries that an analyst needs to sift through to identify the narrow set of entries that warrant closer examination. This could cause delays or even prevent auditors from identifying suspicious activity. Thus, too much monitoring can leave an organization as vulnerable as not enough monitoring. - Here are some features that can help you focus your effort: - - **Advanced audit policy settings**. You can apply and manage detailed audit policy settings through Group Policy. - - **"Reason for access" auditing**. You can specify and identify the permissions that were used to generate a particular object access security event. - - **Global object access auditing**. You can define system access control lists (SACLs) for an entire computer file system or registry. - To deploy these features and plan an effective security auditing strategy, you need to: - - Identify your most critical resources and the most important activities that need to be tracked. - - Identify the audit settings that can be used to track these activities. - - Assess the advantages and potential costs associated with each. - - Test these settings to validate your choices. - - Develop plans for deploying and managing your audit policy. - ## About this guide - - This document will guide you through the steps needed to plan a security auditing policy that uses Windows auditing features. This policy must identify and address vital business needs, including: - - Network reliability - - Regulatory requirements - - Protection of the organization's data and intellectual property - - Users, including employees, contractors, partners, and customers - - Client computers and applications - - Servers and the applications and services running on those servers - The audit policy also must identify processes for managing audit data after it has been logged, including: - - Collecting, evaluating, and reviewing audit data - - Storing and (if required) disposing of audit data - By carefully planning, designing, testing, and deploying a solution based on your organization's business requirements, you can provide the standardized functionality, security, and management control that your organization needs. - ## Understanding the security audit policy design process - - The process of designing and deploying a Windows security audit policy involves the following tasks, which are described in greater detail throughout this document: - - [Identifying your Windows security audit policy deployment goals](#bkmk-1) - This section helps define the business objectives that will guide your Windows security audit policy. It also helps you define the resources, users, and computers that will be the focus of your security auditing. - - [Mapping the security audit policy to groups of users, computers, and resources in your organization](#bkmk-2) - This section explains how to integrate security audit policy settings with domain Group Policy settings for different groups of users, computers, and resources. In addition, if your network includes multiple versions of Windows client and server operating systems, it also explains when to use basic audit policy settings and when to use advanced security audit policy settings. - - [Mapping your security auditing goals to a security audit policy configuration](#bkmk-3) - This section explains the categories of Windows security auditing settings that are available. It also identifies individual Windows security auditing policy settings that can be of particular value to address auditing scenarios. - - [Planning for security audit monitoring and management](#bkmk-4) - This section helps you plan to collect, analyze, and store Windows audit data. Depending on the number of computers and types of activity that you want to audit, Windows event logs can fill up quickly. In addition, this section explains how auditors can access and aggregate event data from multiple servers and desktop computers. It also explains how to address storage requirements, including how much audit data to store and how it must be stored. - - [Deploying the security audit policy](#bkmk-5) - This section provides recommendations and guidelines for the effective deployment of a Windows security audit policy. Configuring and deploying Windows audit policy settings in a test lab environment can help you confirm that the settings you have selected will produce the type of audit data you need. However, only a carefully staged pilot and incremental deployments based on your domain and organizational unit (OU) structure will enable you to confirm that the audit data you generate can be monitored and that it meets your organization's audit needs. - ## Identifying your Windows security audit policy deployment goals - - A security audit policy must support and be a critical and integrated aspect of an organization's overall security design and framework. - Every organization has a unique set of data and network assets (such as customer and financial data and trade secrets), physical resources (such as desktop computers, portable computers, and servers), and users (which can include various internal groups such as finance and marketing, and external groups such as partners, customers, and anonymous users on the website). Not all of these assets, resources, and users justify the cost of an audit. Your task is to identify which assets, resources, and users provide the strongest justification for the focus of a security audit. - To create your Windows security audit plan, begin by identifying: - - The overall network environment, including the domains, OUs, and security groups. - - The resources on the network, the users of those resources, and how those resources are being used. - - Regulatory requirements. - ### Network environment - An organization's domain and OU structure provide a fundamental starting point for thinking about how to apply a security audit policy because it likely provides a foundation of Group Policy Objects (GPOs) and logical grouping of resources and activities that you can use to apply the audit settings that you choose. It is also likely that certain portions of your domain and OU structure already provide logical groups of users, resources, and activities that justify the time and resources needed to audit them. For information about how to integrate a security audit policy with your domain and OU structure, see [Mapping security audit policy to groups of users, computers, and resources in your organization](#bkmk-2) later in this document. - In addition to your domain model, you should also find out whether your organization creates and maintains a systematic threat model. A good threat model can help you identify threats to key components in your infrastructure, so you can define and apply audit settings that enhance the organization's ability to identify and counter those threats. - **Important**   Including auditing within your organization's security plan also makes it possible to budget your resources on the areas where auditing can achieve the most positive results. -   - For additional details about how to complete each of these steps and how to prepare a detailed threat model, download the [IT Infrastructure Threat Modeling Guide](http://go.microsoft.com/fwlink/p/?LinkId=163432). - ### Data and resources - For data and resource auditing, you need to identify the most important types of data and resources (such as patient records, accounting data, or marketing plans) that can benefit from the closer monitoring that Windows auditing can provide. Some of these data resources might already be monitored through auditing features in products such as Microsoft SQL Server and Exchange Server. If so, you may want to consider how Windows auditing features can enhance the existing audit strategy. As with the domain and OU structure discussed previously, security auditing should focus on your most critical resources. You also must consider how much audit data you will be able to manage. - You can record if these resources have high business impact, medium business impact, or low business impact, the cost to the organization if these data resources are accessed by unauthorized users, and the risk that this access can pose to the organization. The type of access by users (such as Read, Modify, or Copy) can also pose different levels of risk to an organization. - Increasingly, data access and use is governed by regulations, and a breach can result in severe penalties and a loss in credibility for the organization. If regulatory compliance plays a role in how you manage your data, be sure to also document this information. - The following table provides an example of a resource analysis for an organization. - @@ -176,23 +113,14 @@ The following table provides an example of a resource analysis for an organizati
-   - ### Users - Many organizations find it useful to classify the types of users they have and base permissions on this classification. This same classification can help you identify which user activities should be the subject of security auditing and the amount of audit data they will generate. - Organizations can create distinctions based on the type of rights and permissions needed by users to perform their jobs. For example, under the classification Administrators, larger organizations might assign local administrator responsibilities for a single computer, for specific applications such as Exchange Server or SQL Server, or for an entire domain. Under Users, permissions and Group Policy settings can apply to as many as all users in an organization or as few as a subset of the employees in a given department. - Also, if your organization is subject to regulatory requirements, user activities such as accessing medical records or financial data may need to be audited to verify that you are complying with these requirements. - To effectively audit user activity, begin by listing the different types of users in your organization and the types of data they need access to—in addition to the data they should not have access to. - Also, if external users can access any of your organization's data, be sure to identify them, including if they belong to a business partner, customer, or general user, the data they have access to, and the permissions they have to access that data. - The following table illustrates an analysis of users on a network. Although our example contains a single column titled "Possible auditing considerations," you may want to create additional columns to differentiate between different types of network activity, such as logon hours and permission use. - @@ -224,35 +152,21 @@ The following table illustrates an analysis of users on a network. Although our
-   - ### Computers - Security and auditing requirements and audit event volume can vary considerably for different types of computers in an organization. These requirements can be based on: - - If the computers are servers, desktop computers, or portable computers. - - The important applications the computers run, such as Exchange Server, SQL Server, or Forefront Identity Manager. - **Note**   If the server applications (including Exchange Server and SQL Server) have audit settings. For more information about auditing in Exchange Server, see the [Exchange 2010 Security Guide](http://go.microsoft.com/fwlink/p/?linkid=128052). For more information about auditing in SQL Server 2008, see [Auditing (Database Engine)](http://go.microsoft.com/fwlink/p/?LinkId=163434). For SQL Server 2012, see [SQL Server Audit (Database Engine)](http://technet.microsoft.com/library/cc280386.aspx). -   - - The operating system versions. - **Note**   The operating system version determines which auditing options are available and the volume of audit event data. -   - - The business value of the data. - For example, a web server that is accessed by external users requires different audit settings than a root certification authority (CA) that is never exposed to the public Internet or even to regular users on the organization's network. - The following table illustrates an analysis of computers in an organization. - @@ -289,265 +203,133 @@ The following table illustrates an analysis of computers in an organization.
-   - ### Regulatory requirements - Many industries and locales have strict and specific requirements for network operations and how resources are protected. In the health care and financial industries, for example, there are strict guidelines for who has access to records and how they are used. Many countries have strict privacy rules. To identify regulatory requirements, work with your organization's legal department and other departments responsible for these requirements. Then consider the security configuration and auditing options that can be used to comply with and verify compliance with these regulations. - For more info, see the [System Center Process Pack for IT GRC](http://technet.microsoft.com/library/dd206732.aspx). - ## Mapping the security audit policy to groups of users, computers, and resources in your organization - - By using Group Policy, you can apply your security audit policy to defined groups of users, computers, and resources. To map a security auditing policy to these defined groups in your organization, you should understand the following considerations for using Group Policy to apply security audit policy settings: - - The policy settings you identify can be applied by using one or more GPOs. To create and edit a GPO, use the Group Policy Management Console (GPMC). By using the GPMC to link a GPO to selected Active Directory sites, domains, and OUs, you apply the policy settings in the GPO to the users and computers in those Active Directory objects. An OU is the lowest-level Active Directory container to which you can assign Group Policy settings. - - For every policy setting that you select, you need to decide whether it should be enforced across the organization, or whether it should apply only to selected users or computers. You can then combine these audit policy settings into GPOs and link them to the appropriate Active Directory containers. - - By default, options set in GPOs that are linked to higher levels of Active Directory sites, domains, and OUs are inherited by all OUs at lower levels. However, a GPO that is linked at a lower level can overwrite inherited policies. - For example, you might use a domain GPO to assign an organization-wide group of audit settings, but want a certain OU to get a defined group of additional settings. To accomplish this, you can link a second GPO to that specific lower-level OU. Therefore, a logon audit setting that is applied at the OU level will override a conflicting logon audit setting that is applied at the domain level (unless you have taken special steps to apply Group Policy loopback processing). - - Audit policies are computer policies. Therefore, they must be applied through GPOs that are applied to computer OUs, not to user OUs. However, in most cases you can apply audit settings for only specified resources and groups of users by configuring SACLs on the relevant objects. This enables auditing for a security group that contains only the users you specify. - For example, you could configure a SACL for a folder called Payroll Data on Accounting Server 1. This can audit attempts by members of the Payroll Processors OU to delete objects from this folder. The **Object Access\\Audit File System** audit policy setting applies to Accounting Server 1, but because it requires a corresponding resource SACL, only actions by members of the Payroll Processors OU on the Payroll Data folder generates audit events. - - Advanced security audit policy settings were introduced in Windows Server 2008 R2 or Windows 7 and can be applied to those operating systems and later. These advanced audit polices can only be applied by using Group Policy. - **Important**   Whether you apply advanced audit policies by using Group Policy or by using logon scripts, do not use both the basic audit policy settings under **Local Policies\\Audit Policy** and the advanced settings under **Security Settings\\Advanced Audit Policy Configuration**. Using both basic and advanced audit policy settings can cause unexpected results in audit reporting. - If you use **Advanced Audit Policy Configuration** settings or use logon scripts to apply advanced audit policies, be sure to enable the **Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings** policy setting under **Local Policies\\Security Options**. This will prevent conflicts between similar settings by forcing basic security auditing to be ignored. -   - The following are examples of how audit policies can be applied to an organization's OU structure: - - Apply data activity settings to an OU that contains file servers. If your organization has servers that contain particularly sensitive data, consider putting them in a separate OU so that you can configure and apply a more precise audit policy to these servers. - - Apply user activity audit policies to an OU that contains all computers in the organization. If your organization places users in OUs based on the department they work in, consider configuring and applying more detailed security permissions on critical resources that are accessed by employees who work in more sensitive areas, such as network administrators or the legal department. - - Apply network and system activity audit policies to OUs that contain the organization's most critical servers, such as domain controllers, CAs, email servers, or database servers. - ## Mapping your security auditing goals to a security audit policy configuration - - After you identify your security auditing goals, you can begin to map them to a security audit policy configuration. This audit policy configuration must address your most critical security auditing goals, but it also must address your organization's constraints, such as the number of computers that need to be monitored, the number of activities that you want to audit, the number of audit events that your desired audit configuration will generate, and the number of administrators available to analyze and act upon audit data. - To create your audit policy configuration, you need to: - 1. Explore all of the audit policy settings that can be used to address your needs. - 2. Choose the audit settings that will most effectively address the audit requirements identified in the previous section. - 3. Confirm that the settings you choose are compatible with the operating systems running on the computers that you want to monitor. - 4. Decide which configuration options (Success, Failure, or both Success and Failure) you want to use for the audit settings. - 5. Deploy the audit settings in a lab or test environment to verify that they meet your desired results in terms of volume, supportability, and comprehensiveness. Then deploy the audit settings in a pilot production environment to ensure that your estimates of how much audit data your audit plan will generate are realistic and that you can manage this data. - ### Exploring audit policy options - Security audit policy settings in the supported versions of Windows can be viewed and configured in the following locations: - - **Security Settings\\Local Policies\\Audit Policy**. - - **Security Settings\\Local Policies\\Security Options**. - - **Security Settings\\Advanced Audit Policy Configuration**. For more information, see [Advanced security audit policy settings](advanced-security-audit-policy-settings.md). - ### Choosing audit settings to use - Depending on your goals, different sets of audit settings may be of particular value to you. For example, some settings under **Security Settings\\Advanced Audit Policy Configuration** can be used to monitor the following types of activity: - - Data and resources - - Users - - Network - **Important**   Settings that are described in the Reference might also provide valuable information about activity audited by another setting. For example, the settings used to monitor user activity and network activity have obvious relevance to protecting your data resources. Likewise, attempts to compromise data resources have huge implications for overall network status, and potentially for how well you are managing the activities of users on the network. -   - ### Data and resource activity - For many organizations, compromising the organization's data resources can cause tremendous financial losses, in addition to lost prestige and legal liability. If your organization has critical data resources that need to be protected against any breach, the following settings can provide extremely valuable monitoring and forensic data: - - Object Access\\[Audit File Share](audit-file-share.md). This policy setting allows you to track what content was accessed, the source (IP address and port) of the request, and the user account that was used for the access. The volume of event data generated by this setting will vary depending on the number of client computers that attempt to access the file share. On a file server or domain controller, volume may be high due to SYSVOL access by client computers for policy processing. If you do not need to record routine access by client computers that have permissions on the file share, you may want to log audit events only for failed attempts to access the file share. - - Object Access\\[Audit File System](audit-file-system.md). This policy setting determines whether the operating system audits user attempts to access file system objects. Audit events are only generated for objects (such as files and folders) that have configured SACLs, and only if the type of access requested (such as Write, Read, or Modify) and the account that is making the request match the settings in the SACL. - If success auditing is enabled, an audit entry is generated each time any account successfully accesses a file system object that has a matching SACL. If failure auditing is enabled, an audit entry is generated each time any user unsuccessfully attempts to access a file system object that has a matching SACL. The amount of audit data generated by the **Audit File System** policy setting can vary considerably, depending on the number of objects that have been configured to be monitored. - **Note**   To audit user attempts to access all file system objects on a computer, use the Global Object Access Auditing settings [Registry (Global Object Access Auditing)](registry-global-object-access-auditing.md) or [File System (Global Object Access Auditing)](file-system-global-object-access-auditing.md). -   - - Object Access\\[Audit Handle Manipulation](audit-handle-manipulation.md). This policy setting determines whether the operating system generates audit events when a handle to an object is opened or closed. Only objects with configured SACLs generate these events, and only if the attempted handle operation matches the SACL. - Event volume can be high, depending on how SACLs are configured. When used together with the **Audit File System** or **Audit Registry** policy settings, the **Audit Handle Manipulation** policy setting can provide an administrator with useful "reason for access" audit data that details the precise permissions on which the audit event is based. For example, if a file is configured as a Read-only resource but a user attempts to save changes to the file, the audit event will log not only the event, but also the permissions that were used (or attempted to be used) to save the file changes. - - **Global Object Access Auditing**. A growing number of organizations are using security auditing to comply with regulatory requirements that govern data security and privacy. But demonstrating that strict controls are being enforced can be extremely difficult. To address this issue, the supported versions of Windows include two **Global Object Access Auditing** policy settings, one for the registry and one for the file system. When you configure these settings, they apply a global system access control SACL on all objects of that class on a system, which cannot be overridden or circumvented. - **Important**   The **Global Object Access Auditing** policy settings must be configured and applied in conjunction with the **Audit File System** and **Audit Registry** audit policy settings in the **Object Access** category. -   - ### User activity - The settings in the previous section relate to activity involving the files, folders, and network shares that are stored on a network, and the settings in this section focus on the users, including employees, partners, and customers, who may try to access those resources. - In the majority of cases, these attempts will be legitimate and a network needs to make vital data readily available to legitimate users. However in other cases, employees, partners, and others may attempt to access resources that they have no legitimate reason to access. Security auditing can be used to track a wide variety of user activities on a particular computer to diagnose and resolve problems for legitimate users and identify and address illegitimate activities. The following are a few important settings that you should evaluate to track user activity on your network: - - Account Logon\\[Audit Credential Validation](audit-credential-validation.md). This is an extremely important policy setting because it enables you to track every successful and unsuccessful attempt to present credentials for a user logon. In particular, a pattern of unsuccessful attempts may indicate that a user or application is using credentials that are no longer valid, or attempting to use a variety of credentials in succession in hope that one of these attempts will eventually be successful. These events occur on the computer that is authoritative for the credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. - - Detailed Tracking\\[Audit Process Creation](audit-process-creation.md) and Detailed Tracking\\[Audit Process Termination](audit-process-termination.md). These policy settings can enable you to monitor the applications that a user opens and closes on a computer. - - DS Access\\[Audit Directory Service Access](audit-directory-service-access.md) and DS Access\\[Audit Directory Service Changes](audit-directory-service-changes.md). These policy settings provide a detailed audit trail of attempts to access create, modify, delete, move, or undelete objects in Active Directory Domain Services (AD DS). Only domain administrators have permissions to modify AD DS objects, so it is extremely important to identify malicious attempts to modify these objects. In addition, although domain administrators should be among an organization's most trusted employees, the use of **Audit Directory Service Access** and **Audit Directory Service Changes** settings allow you to monitor and verify that only approved changes are made to AD DS. These audit events are logged only on domain controllers. - - Logon/Logoff\\[Audit Account Lockout](audit-account-lockout.md). Another common security scenario occurs when a user attempts to log on with an account that has been locked out. It is important to identify these events and to determine whether the attempt to use an account that has been locked out is malicious. - - Logon/Logoff\\[Audit Logoff](audit-logoff.md) and Logon/Logoff\\[Audit Logon](audit-logon.md). Logon and logoff events are essential to tracking user activity and detecting potential attacks. Logon events are related to the creation of logon sessions, and they occur on the computer that was accessed. For an interactive logon, events are generated on the computer that was logged on to. For network logon, such as accessing a shared resource, events are generated on the computer that hosts the resource that was accessed. Logoff events are generated when logon sessions are terminated. - **Note**   There is no failure event for logoff activity because failed logoffs (such as when a system abruptly shuts down) do not generate an audit record. Logoff events are not 100 percent reliable. For example, the computer can be turned off without a proper logoff and shutdown, and a logoff event is not generated. -   - - Logon/Logoff\\[Audit Special Logon](audit-special-logon.md). A special logon has administrator-equivalent rights and can be used to elevate a process to a higher level. It is recommended to track these types of logons. For more information about this feature, see [article 947223](http://go.microsoft.com/fwlink/p/?linkid=120183) in the Microsoft Knowledge Base. - - Object Access\\[Audit Certification Services](audit-certification-services.md). This policy setting allows you to track and monitor a wide variety of activities on a computer that hosts Active Directory Certificate Services (AD CS) role services to ensure that only authorized users are performing or attempting to perform these tasks, and that only authorized or desired tasks are being performed. - - Object Access\\[Audit File System](audit-file-system.md) and Object Access\\[Audit File Share](audit-file-share.md). These policy settings are described in the previous section. - - Object Access\\[Audit Handle Manipulation](audit-handle-manipulation.md). This policy setting and its role in providing "reason for access" audit data is described in the previous section. - - Object Access\\[Audit Registry](audit-registry.md). Monitoring for changes to the registry is one of the most critical means that an administrator has to ensure malicious users do not make changes to essential computer settings. Audit events are only generated for objects that have configured SACLs, and only if the type of access that is requested (such as Write, Read, or Modify) and the account making the request match the settings in the SACL. - **Important**   On critical systems where all attempts to change registry settings need to be tracked, you can combine the **Audit Registry** policy setting with the **Global Object Access Auditing** policy settings to ensure that all attempts to modify registry settings on a computer are tracked. -   - - Object Access\\[Audit SAM](audit-sam.md). The Security Accounts Manager (SAM) is a database that is present on computers running Windows that stores user accounts and security descriptors for users on the local computer. Changes to user and group objects are tracked by the **Account Management** audit category. However, user accounts with the proper user rights could potentially alter the files where the account and password information is stored in the system, bypassing any **Account Management** events. - - Privilege Use\\[Audit Sensitive Privilege Use](audit-sensitive-privilege-use.md). **Privilege Use** policy settings and audit events allow you to track the use of certain rights on one or more systems. If you configure this policy setting, an audit event is generated when sensitive rights requests are made. - ### Network activity - The following network activity policy settings allow you to monitor security-related issues that are not necessarily covered in the data or user activity categories, but that can be equally important for network status and protection. - - **Account Management**. The policy settings in this category can be used to track attempts to create, delete, or modify user or computer accounts, security groups, or distribution groups. Monitoring these activities complements the monitoring strategies you select in the user activity and data activity sections. - - Account Logon\\[Audit Kerberos Authentication Service](audit-kerberos-authentication-service.md) and Account Logon\\[Audit Kerberos Service Ticket Operations](audit-kerberos-service-ticket-operations.md). Audit policy settings in the **Account Logon** category monitor activities that relate to the use of domain account credentials. These policy settings complement the policy settings in the **Logon/Logoff** category. The **Audit Kerberos Authentication Service** policy setting allows you to monitor the status of and potential threats to the Kerberos service. The Audit **Kerberos Service Ticket Operations** policy setting allows you to monitor the use of Kerberos service tickets. - **Note**   **Account Logon** policy settings apply only to specific domain account activities, regardless of the computer that is accessed, whereas **Logon/Logoff** policy settings apply to the computer that hosts the resources being accessed. -   - - Account Logon\\[Audit Other Account Logon Events](audit-other-account-logon-events.md). This policy setting can be used to track a number of different network activities, including attempts to create Remote Desktop connections, wired network connections, and wireless connections. - - **DS Access**. Policy settings in this category allow you to monitor the AD DS role services, which provide account data, validate logons, maintain network access permissions, and provide other services that are critical to the secure and proper functioning of a network. Therefore, auditing the rights to access and modify the configuration of a domain controller can help an organization maintain a secure and reliable network. In addition, one of the key tasks performed by AD DS is the replication of data between domain controllers. - - Logon/Logoff\\[Audit IPsec Extended Mode](audit-ipsec-extended-mode.md), Logon/Logoff\\[Audit IPsec Main Mode](audit-ipsec-main-mode.md), and Logon/Logoff\\[Audit IPsec Quick Mode](audit-ipsec-quick-mode.md). Many networks support large numbers of external users, including remote employees and partners. Because these users are outside the organization's network boundaries, IPsec is often used to help protect communications over the Internet by enabling network-level peer authentication, data origin authentication, data integrity, data confidentiality (encryption), and protection against replay attacks. You can use these settings to ensure that IPsec services are functioning properly. - - Logon/Logoff\\[Audit Network Policy Server](audit-network-policy-server.md). Organizations that use RADIUS (IAS) and Network Access Protection (NAP) to set and maintain security requirements for external users can use this policy setting to monitor the effectiveness of these policies and to determine whether anyone is attempting to circumvent these protections. - - **Policy Change**. These policy settings and events allow you to track changes to important security policies on a local computer or network. Because policies are typically established by administrators to help secure network resources, any changes or attempts to change these policies can be an important aspect of security management for a network. - - Policy Change\\[Audit Audit Policy Change](audit-audit-policy-change.md). This policy setting allows you to monitor changes to the audit policy. If malicious users obtain domain administrator credentials, they can temporarily disable essential security audit policy settings so that their other activities on the network cannot be detected. - - Policy Change\\[Audit Filtering Platform Policy Change](audit-filtering-platform-policy-change.md). This policy setting can be used to monitor a large variety of changes to an organization's IPsec policies. - - Policy Change\\[Audit MPSSVC Rule-Level Policy Change](audit-mpssvc-rule-level-policy-change.md). This policy setting determines if the operating system generates audit events when changes are made to policy rules for the Microsoft Protection Service (MPSSVC.exe), which is used by Windows Firewall. Changes to firewall rules are important for understanding the security state of the computer and how well it is protected against network attacks. - ### Confirm operating system version compatibility - Not all versions of Windows support advanced audit policy settings or the use of Group Policy to apply and manage these settings. For more info, see [Which editions of Windows support advanced audit policy configuration](which-editions-of-windows-support-advanced-audit-policy-configuration.md). - The audit policy settings under **Local Policies\\Audit Policy** overlap with audit policy settings under **Security Settings\\Advanced Audit Policy Configuration**. However, the advanced audit policy categories and subcategories make it possible to focus your auditing efforts on the most critical activities while reducing the amount of audit data that is less important to your organization. - For example, **Local Policies\\Audit Policy** contains a single setting called [Audit account logon events](http://technet.microsoft.com/library/cc787176.aspx). When this setting is configured, it generates at least 10 types of audit events. - In comparison, the Account Logon category under **Security Settings\\Advanced Audit Policy Configuration** provides the following advanced settings, which allow you to focus your auditing: - - Credential Validation - - Kerberos Authentication Service - - Kerberos Service Ticket Operations - - Other Account Logon Events - These settings allow you to exercise much tighter control over which activities or events generate event data. Some activities and events will be more important to your organization, so define the scope of your security audit policy as narrowly as possible. - ### Success, failure, or both - Whichever event settings you include in your plan, you also have to decide whether you want to log an event when the activity fails, when an activity succeeds, or both successes and failures. This is an important question, and the answer will be based on the criticality of the event and the implications of the decision on event volume. - For example, on a file server that is accessed frequently by legitimate users, you may be interested in logging an event only when an unsuccessful attempt to access data takes place, because this could be evidence of an unauthorized or malicious user. And in this instance, logging successful attempts to access the server would quickly fill the event log with benign events. - On the other hand, if the file share has extremely sensitive and valuable information, such as trade secrets, you may want to log every access attempt, whether successful or unsuccessful, so that you have an audit trail of every user who accessed the resource. - ## Planning for security audit monitoring and management - - Networks can contain hundreds of servers running critical services or storing critical data, all of which need to be monitored. The number of client computers on the network can easily range into the tens or even hundreds of thousands. This may not be an issue if the ratio of servers or client computers per administrator is low. Even if an administrator who is responsible for auditing security and performance issues has relatively few computers to monitor, you need to decide how an administrator will obtain event data to review. Following are some options for obtaining the event data. - - Will you keep event data on a local computer until an administrator logs on to review this data? If so, then the administrator needs to have physical or remote access to the Event Viewer on each client computer or server, and the remote access and firewall settings on each client computer or server need to be configured to enable this access. In addition, you need to decide how often an administrator can visit each computer, and adjust the size of the audit log so that critical information is not deleted if the log reaches its maximum capacity. - - Will you collect event data so that it can be reviewed from a central console? If so, there are a number of computer management products, such as the Audit Collection Services in Operations Manager 2007 and 2012, which can be used to collect and filter event data. Presumably this solution enables a single administrator to review larger amounts of data than using the local storage option. But in some cases, this can make it more difficult to detect clusters of related events that can occur on a single computer. - In addition, whether you choose to leave audit data on an individual computer or consolidate it at a central location, you need to decide how large the log file should be and what should happen when the log reaches its maximum size. To configure these options, open Event Viewer, expand **Windows Logs**, right-click **Security**, and click **Properties**. You can configure the following properties: - - **Overwrite events as needed (oldest events first)**. This is the default option, which is an acceptable solution in most situations. - - **Archive the log when full, do not overwrite events**. This option can be used when all log data needs to be saved, but it also suggests that you may not be reviewing audit data frequently enough. - - **Do not overwrite events (Clear logs manually)**. This option stops the collection of audit data when the log file reaches its maximum size. Older data is retained at the expense of the most recent audit events. Use this option only if you do not want to lose any audit data, do not want to create an archive of the event log, and are committed to reviewing data before the maximum log size is reached. - You can also configure the audit log size and other key management options by using Group Policy settings. You can configure the event log settings in the following locations within the GPMC: **Computer Configuration\\Administrative Templates\\Windows Components\\Event Log Service\\Security**. These options include: - - **Maximum Log Size (KB)**. This policy setting specifies the maximum size of the log files. The user interfaces in the Local Group Policy Editor and Event Viewer allow you to enter values as large as 2 TB. If this setting is not configured, event logs have a default maximum size of 20 megabytes. - - **Log Access**. This policy setting determines which user accounts have access to log files and what usage rights are granted. - - **Retain old events**. This policy setting controls event log behavior when the log file reaches its maximum size. When this policy setting is enabled and a log file reaches its maximum size, new events are not written to the log and are lost. When this policy setting is disabled and a log file reaches its maximum size, new events overwrite old events. - - **Backup log automatically when full**. This policy setting controls event log behavior when the log file reaches its maximum size and takes effect only if the **Retain old events** policy setting is enabled. If you enable these policy settings, the event log file is automatically closed and renamed when it is full. A new file is then started. If you disable or do not configure this policy setting and the **Retain old events** policy setting is enabled, new events are discarded and the old events are retained. - In addition, a growing number of organizations are being required to store archived log files for a number of years. You should consult with regulatory compliance officers in your organization to determine whether such guidelines apply to your organization. For more information, see the [IT Compliance Management Guide](http://go.microsoft.com/fwlink/p/?LinkId=163435). - ## Deploying the security audit policy - - Before deploying the audit policy in a production environment, it is critical that you determine the effects of the policy settings that you have configured. - The first step in assessing your audit policy deployment is to create a test environment in a lab and use it to simulate the various use scenarios that you have identified to confirm that the audit settings you have selected are configured correctly and generate the type of results you intend. - However, unless you are able to run fairly realistic simulations of network usage patterns, a lab setup cannot provide you with accurate information about the volume of audit data that the audit policy settings you selected will generate and how effective your plan for monitoring audit data will be. To provide this type of information, you need to conduct one or more pilot deployments. These pilot deployments could involve: - - A single OU that contains critical data servers or an OU that contains all desktop computers in a specified location. - - A limited set of security audit policy settings, such as **Logon/Logoff** and **Account Logon**. - - A combination of limited OUs and audit policy settings—for example, targeting servers in only the Accounting OU with **Object Access** policy settings. - After you have successfully completed one or more limited deployments, you should confirm that the audit data that is collected is manageable with your management tools and administrators. When you have confirmed that the pilot deployment is effective, you need to confirm that you have the necessary tools and staff to expand the deployment to include additional OUs and sets of audit policy settings until the production deployment is complete. -   -   - - - - - diff --git a/windows/keep-secure/prepare-people-to-use-microsoft-passport.md b/windows/keep-secure/prepare-people-to-use-microsoft-passport.md index e0d3c44e7e..11496345a8 100644 --- a/windows/keep-secure/prepare-people-to-use-microsoft-passport.md +++ b/windows/keep-secure/prepare-people-to-use-microsoft-passport.md @@ -2,121 +2,61 @@ title: Prepare people to use Microsoft Passport (Windows 10) description: When you set a policy to require Microsoft Passport in the workplace, you will want to prepare people in your organization. ms.assetid: 5270B416-CE31-4DD9-862D-6C22A2AE508B +ms.pagetype: security keywords: ["identity", "PIN", "biometric", "Hello"] ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: jdeckerMS --- - # Prepare people to use Microsoft Passport - - **Applies to** - - Windows 10 - Windows 10 Mobile - When you set a policy to require Microsoft Passport in the workplace, you will want to prepare people in your organization by explaining how to use Passport. - After enrollment in Passport, users should use their gesture (such as a PIN or fingerprint) for access to corporate resources. Their gesture is only valid on the enrolled device. - Although the organization may require users to change their Active Directory or Azure Active Directory (AD) account password at regular intervals, changes to their passwords have no effect on Passport. - People who are currently using virtual smart cards for authentication can use their virtual smart card to verify their identity when they set up Passport. - ## On devices owned by the organization - - When someone sets up a new device, they are prompted to choose who owns the device. For corporate devices, they select **This device belongs to my organization**. - ![who owns this pc](images/corpown.png) - Next, they select a way to connect. Tell the people in your enterprise which option they should pick here. - ![choose how you'll connect](images/connect.png) - They sign in, and are then asked to verify their identity. People have options to choose from, such as a text message, phone call, or authentication app. After verification, they create their PIN. The **Create a work PIN** screen displays any complexity requirements that you have set, such as minimum length. - After Passport is set up, people use their PIN to unlock the device, and that will automatically log them on. - ## On personal devices - - People who want to access work resources on their personal devices can add a work or school account in **Settings** > **Accounts** > **Work or school**, and then sign in with work credentials. The person selects the method for receiving the verification code, such as text message or email. The verification code is sent and the person then enters the verification code. After verification, the person enters and confirms new PIN. The person can access any token-based resource using this device without being asked for credentials. (This work account gesture doesn't affect the device unlock PIN.) - Assure people that their work credentials and personal credentials are stored in separate containers; the enterprise has no access to their personal credentials. - People can go to **Settings** > **Accounts** > **Work or school**, select the work account, and then select **Unjoin** to remove the account from their device. - ## Using Windows Hello and biometrics - - If your policy allows it, people can add Windows Hello to their Passport. Windows Hello can be fingerprint, iris, and facial recognition, and is available to users only if the hardware supports it. - ![sign in to windows, apps, and services using fingerprint or face](images/hellosettings.png) - ## Use a phone to sign in to a PC - - If your enterprise enables phone sign-in, users can pair a phone running Windows 10 Mobile to a PC running Windows 10 and then use an app on the phone to sign in to the PC using their Microsoft Passport credentials. - **Note**  Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants. -   - **Prerequisites:** - - The PC must be joined to the Active Directory domain or Azure AD cloud domain. - - The PC must have Bluetooth connectivity. - - The phone must be joined to the Azure AD cloud domain, or the user must have added a work account to their personal phone. - - The free **Phone Sign-in** app must be installed on the phone. - **Pair the PC and phone** - 1. On the PC, go to **Settings** > **Devices** > **Bluetooth**. Tap the name of the phone and then tap **Pair** to begin pairing. - ![bluetooth pairing](images/btpair.png) - 2. On the phone, go to **Settings** > **Devices** > **Bluetooth**, and verify that the passcode for **Pairing accessory** on the phone matches the passcode displayed on the PC, and then tap **ok**. - ![bluetooth pairing passcode](images/bt-passcode.png) - 3. On the PC, tap **Yes**. - **Sign in to PC using the phone** - 1. Open the **Phone Sign-in** app and tap the name of the PC to sign in to. - **Note**  The first time that you run the Phone-Sign app, you must add an account. -   - 2. Enter the work PIN that you set up when you joined the phone to the cloud domain or added a work account. - ## Related topics - - [Manage identity verification using Microsoft Passport](manage-identity-verification-using-microsoft-passport.md) - [Implement Microsoft Passport in your organization](implement-microsoft-passport-in-your-organization.md) - [Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) - [Microsoft Passport and password changes](microsoft-passport-and-password-changes.md) - [Microsoft Passport errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) - [Event ID 300 - Passport successfully created](passport-event-300.md) -   -   - - - - - diff --git a/windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies.md b/windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies.md index 2a4deccef8..56db3e6526 100644 --- a/windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies.md +++ b/windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies.md @@ -2,77 +2,43 @@ title: Prepare your organization for BitLocker Planning and policies (Windows 10) description: This topic for the IT professional explains how can you plan your BitLocker deployment. ms.assetid: 6e3593b5-4e8a-40ac-808a-3fdbc948059d +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Prepare your organization for BitLocker: Planning and policies - - **Applies to** - - Windows 10 - This topic for the IT professional explains how can you plan your BitLocker deployment. - When you design your BitLocker deployment strategy, define the appropriate policies and configuration requirements based on the business requirements of your organization. The following topics will help you collect information that you can use to frame your decision-making process about deploying and managing BitLocker systems. - - [Audit your environment](#bkmk-audit) - - [Encryption keys and authentication](#bkk-encrypt) - - [TPM hardware configurations](#bkmk-tpmconfigurations) - - [Non-TPM hardware configurations](#bkmk-nontpm) - - [Disk configuration considerations](#bkmk-disk) - - [BitLocker provisioning](#bkmk-prov) - - [Used Disk Space Only encryption](#bkk-used) - - [Active Directory Domain Services considerations](#bkmk-addscons) - - [FIPS support for recovery password protector](#bkmk-fipssupport) - - [BitLocker Group Policy settings](bitlocker-group-policy-settings.md) - ## Audit your environment - - To plan your enterprise deployment of BitLocker, you must first understand your current environment. Conduct an informal audit to define your current policies, procedures, and hardware environment. Begin by reviewing your existing corporate security policies as they relate to disk encryption software. If your organization is not currently using disk encryption software, none of these policies will exist. If you are using disk encryption software, then you might need to modify your organization's policies to address the capabilities of BitLocker. - Use the following questions to help you document your organization's current disk encryption security policies: - 1. Are there policies to address which computers will use BitLocker and which computers will not use BitLocker? - 2. What policies exist to control recovery password and recovery key storage? - 3. What are the policies for validating the identity of users that need to perform BitLocker recovery? - 4. What policies exist to control who in the organization has access to recovery data? - 5. What policies exist to control computer decommissioning or retirement? - ## Encryption keys and authentication - - BitLocker helps prevent unauthorized access to data on lost or stolen computers by: - - Encrypting the entire Windows operating system volume on the hard disk. - - Verifying the boot process integrity. - The trusted platform module (TPM)is a hardware component installed in many newer computers by the computer manufacturers. It works with BitLocker to help protect user data and to ensure that a computer has not been tampered with while the system was offline. - In addition, BitLocker offers the option to lock the normal startup process until the user supplies a personal identification number (PIN) or inserts a removable USB device, such as a flash drive, that contains a startup key. These additional security measures provide multifactor authentication and assurance that the computer will not start or resume from hibernation until the correct PIN or startup key is presented. - On computers that do not have a TPM version 1.2 or higher, you can still use BitLocker to encrypt the Windows operating system volume. However, this implementation will require the user to insert a USB startup key to start the computer or resume from hibernation, and does not provide the pre-startup system integrity verification offered by BitLocker working with a TPM. - **BitLocker key protectors** - @@ -111,11 +77,8 @@ On computers that do not have a TPM version 1.2 or higher, you can still use Bi
-   - **BitLocker authentication methods** - @@ -157,36 +120,20 @@ On computers that do not have a TPM version 1.2 or higher, you can still use Bi
-   - **Will you support computers without TPM version 1.2 or higher?** - Determine whether you will support computers that do not have a TPM version 1.2 or higher in your environment. If you choose to support BitLocker on this type of computer, a user must use a USB startup key to boot the system. This requires additional support processes similar to multifactor authentication. - **What areas of your organization need a baseline level of data protection?** - The TPM-only authentication method will provide the most transparent user experience for organizations that need a baseline level of data protection to meet security policies. It has the lowest total cost of ownership. TPM-only might also be more appropriate for computers that are unattended or that must reboot unattended. - However, TPM-only authentication method offers the lowest level of data protection. This authentication method protects against attacks that modify early boot components, but the level of protection can be affected by potential weaknesses in hardware or in the early boot components. BitLocker’s multifactor authentication methods significantly increase the overall level of data protection. - **What areas of your organization need a more secure level of data protection?** - If there are areas of your organization where data residing on user computers is considered highly-sensitive, consider the best practice of deploying BitLocker with multifactor authentication on those systems. Requiring the user to input a PIN significantly increases the level of protection for the system. You can also use BitLocker Network Unlock to allow these computers to automatically unlock when connected to a trusted wired network that can provide the Network Unlock key. - **What multifactor authentication method does your organization prefer?** - The protection differences provided by multifactor authentication methods cannot be easily quantified. Consider each authentication method's impact on Helpdesk support, user education, user productivity, and automated systems management processes. - ## TPM hardware configurations - - In your deployment plan, identify what TPM-based hardware platforms will be supported. Document the hardware models from an OEM of your choice, so that their configurations can be tested and supported. TPM hardware requires special consideration during all aspects of planning and deployment. - ### TPM states of existence - For each of the TPM states of existence, the TPM can transition into another state (for example, moving from disabled to enabled). The states are not exclusive. - @@ -227,85 +174,43 @@ For each of the TPM states of existence, the TPM can transition into another sta
-   - **Important**   BitLocker cannot use the TPM until it is in the following state: enabled, activated, and owned. When the TPM is in this state and only when it is in this state, all operations are available. -   - The state of the TPM exists independent of the computer’s operating system. Once the TPM is enabled, activated, and owned, the state of the TPM is preserved if the operating system is reinstalled. - ### Endorsement keys - For a TPM to be usable by BitLocker, it must contain an endorsement key, which is an RSA key pair. The private half of the key pair is held inside the TPM and is never revealed or accessible outside the TPM. If the TPM does not contain an endorsement key, BitLocker will force the TPM to generate one automatically as part of BitLocker setup. - An endorsement key can be created at various points in the TPM’s lifecycle, but needs to be created only once for the lifetime of the TPM. If an endorsement key does not exist for the TPM, it must be created before TPM ownership can be taken. - For more information about the TPM and the TCG, see the Trusted Computing Group: Trusted Platform Module (TPM) Specifications (). - ## Non-TPM hardware configurations - - Devices that do not include a TPM can still be protected by drive encryption. Windows To Go workspaces can be BitLocker protected using a startup password and PCs without a TPM can use a startup key. - Use the following questions to identify issues that might affect your deployment in a non-TPM configuration: - - Are password complexity rules in place? - - Do you have budget for USB flash drives for each of these computers? - - Do your existing non-TPM devices support USB devices at boot time? - Test your individual hardware platforms with the BitLocker system check option while you are enabling BitLocker. The system check will ensure that BitLocker can read the recovery information from a USB device and encryption keys correctly before it encrypts the volume. CD and DVD drives cannot act as a block storage device and cannot be used to store the BitLocker recovery material. - ## Disk configuration considerations - - To function correctly, BitLocker requires a specific disk configuration. BitLocker requires two partitions that meet the following requirements: - - The operating system partition contains the operating system and its support files; it must be formatted with the NTFS file system - - The system partition (or boot partition) contains the files that are needed to load Windows after the BIOS or UEFI firware has prepared the system hardware. BitLocker is not enabled on this partition. For BitLocker to work, the system partition must not be encrypted and must be on a different partition than the operating system. On UEFI platforms the system partition must be formatted with the FAT 32 file system. On BIOS platforms the system partition must be formatted with the NTFS file system. It should be at least 350 MB in size - Windows setup will automatically configure the disk drives of your computer to support BitLocker encryption. - Windows Recovery Environment (Windows RE) is an extensible recovery platform that is based on Windows Pre-installation Environment (Windows PE). When the computer fails to start, Windows automatically transitions into this environment, and the Startup Repair tool in Windows RE automates the diagnosis and repair of an unbootable Windows installation. Windows RE also contains the drivers and tools that are needed to unlock a volume protected by BitLocker by providing a recovery key or recovery password. To use Windows RE in conjunction with BitLocker, the Windows RE boot image must reside on a volume that is not protected by BitLocker. - Windows RE can also be used from boot media other than the local hard disk. If you choose not to install Windows RE on the local hard disk of BitLocker-enabled computers, you can use alternate boot methods, such as Windows Deployment Services, CD-ROM, or USB flash drive, for recovery. - ## BitLocker provisioning - - In Windows Vista and Windows 7, BitLocker was provisioned post installation for system and data volumes through either the manage-bde command line interface or the Control Panel user interface. With newer operating systems, BitLocker can be easily provisioned before the operating system is installed. Preprovisioning requires that the computer have a TPM. - To check the BitLocker status of a particular volume, administrators can look at the status of the drive in the BitLocker control panel applet or Windows Explorer. A status of "Waiting For Activation" with a yellow exclamation icon means that the drive was preprovisioned for BitLocker. This status means that there was only a clear protector used when encrypting the volume. In this case, the volume is not protected and needs to have a secure key added to the volume before the drive is considered fully protected. Administrators can use the control panel options, manage-bde tool or WMI APIs to add an appropriate key protector and the volume status will be updated. - When using the control panel options, administrators can choose to **Turn on BitLocker** and follow the steps in the wizard to add a protector, such as a PIN for an operating system volume (or a password if no TPM exists), or a password or smart card protector to a data volume. Then the drive security window is presented prior to changing the volume status. - Administrators can enable BitLocker prior to operating system deployment from the Windows Pre-installation Environment (WinPE). This is done with a randomly generated clear key protector applied to the formatted volume and encrypting the volume prior to running the Windows setup process. If the encryption uses the Used Disk Space Only option this step takes only a few seconds and so incorporates well into regular deployment processes. - ## Used Disk Space Only encryption - - The BitLocker Setup wizard provides administrators the ability to choose the Used Disk Space Only or Full encryption method when enabling BitLocker for a volume. Administrators can use the new BitLocker Group Policy setting to enforce either Used Disk Space Only or Full disk encryption. - Launching the BitLocker Setup wizard prompts for the authentication method to be used (password and smart card are available for data volumes). Once the method is chosen and the recovery key is saved, you are asked to choose the drive encryption type, either Used Disk Space Only or Full drive encryption. - Used Disk Space Only means that only the portion of the drive that contains data will be encrypted, unused space will remain unencrypted. This causes the encryption process to be much faster, especially for new PCs and data drives. When BitLocker is enabled with this method as data is added to the drive the portion of the drive used will be encrypted, so there is never unencrypted data stored on the drive. - Full drive encryption means that the entire drive will be encrypted, regardless of whether data is stored on it or not. This is useful for drives that have been repurposed and may contain data remnants from their previous use. - ## Active Directory Domain Services considerations - - BitLocker integrates with Active Directory Domain Services (AD DS) to provide centralized key management. By default, no recovery information is backed up to Active Directory. Administrators can configure Group Policy settings to enable backup of BitLocker or TPM recovery information. Before configuring these settings verify that access permissions have been granted to perform the backup. - By default, domain administrators are the only users that will have access to BitLocker recovery information. When you plan your support process, define what parts of your organization need access to BitLocker recovery information. Use this information to define how the appropriate rights will be delegated in your AD DS environment. - It is a best practice to require backup of recovery information for both the TPM and BitLocker to AD DS. You can implement this practice by configuring the Group Policy settings below for your BitLocker-protected computers. - @@ -328,127 +233,63 @@ It is a best practice to require backup of recovery information for both the TPM
-   - The following recovery data will be saved for each computer object: - - **Recovery password** - A 48-digit recovery password used to recover a BitLocker-protected volume. Users enter this password to unlock a volume when BitLocker enters recovery mode. - - **Key package data** - With this key package and the recovery password, you will be able decrypt portions of a BitLocker-protected volume if the disk is severely damaged. Each key package will only work with the volume it was created on, which can be identified by the corresponding volume ID. - - **TPM owner authorization password hash** - When ownership of the TPM is taken a hash of the ownership password can be taken and stored in AD DS. This information can then be used to reset ownership of the TPM. - Starting in Windows 8, a change to how the TPM owner authorization value is stored in AD DS was implemented in the AD DS schema. The TPM owner authorization value is now stored in a separate object which is linked to the Computer object. This value was stored as a property in the Computer object itself for the default Windows Server 2008 R2 and later schemas. - To take advantage of this integration, you must upgrade your domain controllers to Windows Server 2012 or extend the Active Directory schema and configure BitLocker-specific Group Policy objects. - **Note**   The account that you use to update the Active Directory schema must be a member of the Schema Admins group. -   - Windows Server 2012 domain controllers have the default schema to backup TPM owner authorization information in the separate object. If you are not upgrading your domain controller to Windows Server 2012 you need to extend the schema to support this change. - **To support Windows 8 and later computers that are managed by a Windows Server 2003 or Windows 2008 domain controller** - There are two schema extensions that you can copy down and add to your AD DS schema: - - **TpmSchemaExtension.ldf** - This schema extension brings parity with the Windows Server 2012 schema. With this change, the TPM owner authorization information is stored in a separate TPM object linked to the corresponding computer object. Only the Computer object that has created the TPM object can update it. This means that any subsequent updates to the TPM objects will not succeed in dual boot scenarios or scenarios where the computer is reimaged resulting in a new AD computer object being created. To support such scenarios, an update to the schema was created. - - **TpmSchemaExtensionACLChanges.ldf** - This schema update modifies the ACLs on the TPM object to be less restrictive so that any subsequent operating system which takes ownership of the computer object can update the owner authorization value in AD DS. However, this is less secure as any computer in the domain can now update the OwnerAuth of the TPM object (although it cannot read the OwnerAuth) and DOS attacks can be made from within the enterprise. The recommended mitigation in such a scenario is to do regular backup of TPM objects and enable auditing to track changes for these objects. - To download the schema extensions, see [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md). - If you have a Windows Server 2012 domain controller in your environment, the schema extensions are already in place and do not need to be updated. - **Caution**   To configure Group Policy objects to backup TPM and BitLocker information in AD DS at least one of the domain controllers in your forest must be running at least Windows Server 2008 R2. - If Active Directory backup of the TPM owner authorization value is enabled in an environment without the required schema extensions, the TPM provisioning will fail and the TPM will remain in a Not Ready state for computers running Windows 8 and later. -   - **Setting the correct permissions in AD DS** - To initialize the TPM successfully so that you can turn on BitLocker requires that the correct permissions for the SELF account in be set in AD DS for the **ms-TPMOwnerInformation** attribute. The following steps detail setting these permissions as required by BitLocker: - 1. Open **Active Directory Users and Computers**. - 2. Select the organizational unit (OU) which contains the computer accounts that will have BitLocker turned on. - 3. Right-click the OU and click **Delegate Control** to open the **Delegation of Control** wizard. - 4. Click **Next** to go to the **Users or Groups** page and then click **Add**. - 5. In the **Select Users, Computers, or Groups** dialog box, type **SELF** as the object name and then click **OK** Once the object has been validated you will be returned to the **Users or Groups** wizard page and the SELF account will be listed. Click **Next**. - 6. On the **Tasks to Delegate** page, choose **Create a custom task to delegate** and then click **Next**. - 7. On the **Active Directory Object Type** page, choose **Only the following objects in the folder** and then check **Computer Objects** and then click **Next**. - 8. On the **Permissions** page, for **Show these permissions**, check **General**, **Property-specific**, and **Creation/deletion of specific child objects**. Scroll down the **Permissions** list and check both **Write msTPM-OwnerInformation** and **Write msTPM-TpmInformationForComputer** then click **Next**. - 9. Click **Finish** to apply the permissions settings. - ## FIPS support for recovery password protector - - Functionality introduced in Windows Server 2012 R2 and Windows 8.1, allows BitLocker to be fully functional in FIPS mode. - **Note**   The United States Federal Information Processing Standard (FIPS) defines security and interoperability requirements for computer systems that are used by the U.S. federal government. The FIPS 140 standard defines approved cryptographic algorithms. The FIPS 140 standard also sets forth requirements for key generation and for key management. The National Institute of Standards and Technology (NIST) uses the Cryptographic Module Validation Program (CMVP) to determine whether a particular implementation of a cryptographic algorithm is compliant with the FIPS 140 standard. An implementation of a cryptographic algorithm is considered FIPS 140-compliant only if it has been submitted for and has passed NIST validation. An algorithm that has not been submitted cannot be considered FIPS-compliant even if the implementation produces identical data as a validated implementation of the same algorithm.  -   - Prior to these supported versions of Windows, when Windows was in FIPS mode, BitLocker prevented the creation or use of recovery passwords and instead forced the user to use recovery keys. For more information about these issues, see the support article [kb947249](http://support.microsoft.com/kb/947249). - But on computers running these supported systems with BitLocker enabled: - - FIPS-compliant recovery password protectors can be created when Windows is in FIPS mode. These protectors use the FIPS 140 NIST SP800-132 algorithm. - - Recovery passwords created in FIPS mode on Windows 8.1 can be distinguished from recovery passwords created on other systems. - - Recovery unlock using the FIPS-compliant algorithm based recovery password protector work in all cases that currently work for recovery passwords. - - When FIPS-compliant recovery passwords unlock volumes, the volume is unlocked to allow read/write access even while in FIPS mode. - - FIPS-compliant recovery password protectors can be exported and stored in AD a while in FIPS mode. - The BitLocker Group Policy settings for recovery passwords work the same for all Windows versions that support BitLocker, whether in FIPs mode or not. - However, you cannot use recovery passwords generated on a system in FIPS mode for systems earlier than Windows Server 2012 R2 and Windows 8.1. Recovery passwords created on Windows Server 2012 R2 and Windows 8.1 are incompatible with BitLocker on operating systems prior to Windows Server 2012 R2 and Windows 8.1; so recovery keys should be used instead. - ## More information - - [Trusted Platform Module](trusted-platform-module-overview.md) - [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md) - [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md) - [BitLocker](bitlocker-overview.md) - [BitLocker Group Policy settings](bitlocker-group-policy-settings.md) - [BitLocker basic deployment](bitlocker-basic-deployment.md) -   -   - - - - - diff --git a/windows/keep-secure/profile-single-process.md b/windows/keep-secure/profile-single-process.md index 5144e6d70c..bcdfcfa6c0 100644 --- a/windows/keep-secure/profile-single-process.md +++ b/windows/keep-secure/profile-single-process.md @@ -2,50 +2,30 @@ title: Profile single process (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Profile single process security policy setting. ms.assetid: c0963de4-4f5e-430e-bfcd-dfd68e66a075 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Profile single process - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Profile single process** security policy setting. - ## Reference - - This policy setting determines which users can view a sample performance of an application process. Typically, you do not need this user right to use the performance reporting tools included in the operating system. However, you do need this user right if the system’s monitor components are configured to collect data through Windows Management Instrumentation (WMI). - Constant: SeProfileSingleProcessPrivilege - ### Possible values - - User-defined list of accounts - - Administrators - - Not Defined - ### Best practices - - This right should not be granted to individual users. It should be granted only for trusted applications that monitor other programs. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - By default this setting is Administrators on domain controllers and on stand-alone servers. - The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - @@ -84,59 +64,27 @@ The following table lists the actual and effective default policy values. Defaul
-   - ## Policy management - - This section describes features, tools, and guidance to help you manage this policy. - A restart of the device is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - ### Group Policy - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - The **Profile single process** user right presents a moderate vulnerability. Attackers with this user right could monitor a computer's performance to help identify critical processes that they might want to attack directly. Attackers may be able to determine what processes run on the computer so that they could identify countermeasures that they may need to avoid, such as anti-virus software or an intrusion-detection system. They could also identify other users who are logged on to a computer. - ### Countermeasure - Ensure that only the local Administrators group is assigned the **Profile single process** user right. - ### Potential impact - If you remove the **Profile single process** user right from the Power Users group or other accounts, you could limit the abilities of users who are assigned to specific administrative roles in your environment. You should ensure that delegated tasks are not negatively affected. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/profile-system-performance.md b/windows/keep-secure/profile-system-performance.md index e9fdad2be0..c35951cd49 100644 --- a/windows/keep-secure/profile-system-performance.md +++ b/windows/keep-secure/profile-system-performance.md @@ -2,50 +2,30 @@ title: Profile system performance (Windows 10) description: This security policy reference topic for the IT professional describes the best practices, location, values, policy management, and security considerations for the Profile system performance security policy setting. ms.assetid: ffabc3c5-9206-4105-94ea-84f597a54b2e +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Profile system performance - - **Applies to** - - Windows 10 - This security policy reference topic for the IT professional describes the best practices, location, values, policy management, and security considerations for the **Profile system performance** security policy setting. - ## Reference - - This security setting determines which users can use Windows performance monitoring tools to monitor the performance of system processes. - Constant: SeSystemProfilePrivilege - ### Possible values - - User-defined list of accounts - - Administrators - - Not defined - ### Best practices - - Ensure that only the local Administrators group is assigned the **Profile system performance** user right. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - By default this setting is Administrators on domain controllers and on stand-alone servers. - The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - @@ -84,61 +64,28 @@ The following table lists the actual and effective default policy values for the
-   - ## Policy management - - This section describes features, tools, and guidance to help you manage this policy. - A restart of the device is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - Depending on your version of Windows and your environment, you might need to add this user right to the Local System account or the Local Service account if you encounter access errors when you use the Administrators account. - ### Group Policy - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - The **Profile system performance** user right poses a moderate vulnerability. Attackers with this user right could monitor a computer's performance to help identify critical processes that they might want to attack directly. Attackers might also be able to determine what processes are active on the computer so that they could identify countermeasures to avoid, such as anti-virus software or an intrusion detection system. - ### Countermeasure - Ensure that only the local Administrators group is assigned the **Profile system performance** user right. - ### Potential impact - None. Restricting the **Profile system performance** user right to the local Administrators group is the default configuration. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/protect-bitlocker-from-pre-boot-attacks.md b/windows/keep-secure/protect-bitlocker-from-pre-boot-attacks.md index 028698ebd6..8edf687f07 100644 --- a/windows/keep-secure/protect-bitlocker-from-pre-boot-attacks.md +++ b/windows/keep-secure/protect-bitlocker-from-pre-boot-attacks.md @@ -2,52 +2,27 @@ title: Protect BitLocker from pre-boot attacks (Windows 10) description: This detailed guide will help you understand the circumstances under which the use of pre-boot authentication is recommended for devices running Windows 10, Windows 8.1, Windows 8, or Windows 7; and when it can be safely omitted from a device’s configuration. ms.assetid: 24d19988-fc79-4c45-b392-b39cba4ec86b +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Protect BitLocker from pre-boot attacks - - **Applies to** - - Windows 10 - This detailed guide will help you understand the circumstances under which the use of pre-boot authentication is recommended for devices running Windows 10, Windows 8.1, Windows 8, or Windows 7; and when it can be safely omitted from a device’s configuration. - BitLocker uses encryption to protect the data on your drive, but BitLocker security is only effective when the encryption key is protected. Many users have relied on pre-boot authentication to protect the operating system’s integrity, disk encryption solution (for example, encryption keys), and the PC’s data from offline attacks. With pre-boot authentication, users must provide some form of credential before unlocking encrypted volumes and starting Windows. Typically, they authenticate themselves using a PIN or a USB flash drive as a key. - Full-volume encryption using BitLocker Drive Encryption is vital for protecting data and system integrity on devices running the Windows 10, Windows 8.1, Windows 8, or Windows 7 operating system. It is equally important to protect the BitLocker encryption key. On Windows 7 devices, sufficiently protecting that key often required pre-boot authentication, which many users find inconvenient and complicates device management. - Pre-boot authentication provides excellent startup security, but it inconveniences users and increases IT management costs. Every time the PC is unattended, the device must be set to hibernate (in other words, shut down and powered off); when the computer restarts, users must authenticate before the encrypted volumes are unlocked. This requirement increases restart times and prevents users from accessing remote PCs until they can physically access the computer to authenticate, making pre-boot authentication unacceptable in the modern IT world, where users expect their devices to turn on instantly and IT requires PCs to be constantly connected to the network. - If users lose their USB key or forget their PIN, they can’t access their PC without a recovery key. With a properly configured infrastructure, the organization’s support will be able to provide the recovery key, but doing so increases support costs, and users might lose hours of productive work time. - Starting with Windows 8, Secure Boot and Windows Trusted Boot startup process ensures operating system integrity, allowing Windows to start automatically while minimizing the risk of malicious startup tools and rootkits. In addition, many modern devices are fundamentally physically resistant to sophisticated attacks against the computer’s memory, and now Windows authenticates the user before making devices that may represent a threat to the device and encryption keys available for use. - ## In this topic - - The sections that follow help you understand which PCs still need pre-boot authentication and which can meet your security requirements without the inconvenience of it. - - [Types of attacks for volume encryption keys](types-of-attacks-for-volume-encryption-keys.md) - - [BitLocker countermeasures](bitlocker-countermeasures.md) - - [Choose the right BitLocker countermeasure](choose-the-right-bitlocker-countermeasure.md) - ## See also - - - [BitLocker overview](bitlocker-overview.md) -   -   - - - - - diff --git a/windows/keep-secure/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md b/windows/keep-secure/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md index 5d96128049..bc3658f201 100644 --- a/windows/keep-secure/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md +++ b/windows/keep-secure/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md @@ -2,98 +2,54 @@ title: Control the health of Windows 10-based devices (Windows 10) description: This article details an end-to-end solution that helps you protect high-value assets by enforcing, controlling, and reporting the health of Windows 10-based devices. ms.assetid: 45DB1C41-C35D-43C9-A274-3AD5F31FE873 +ms.pagetype: security; devices keywords: ["security", "BYOD", "malware", "device health attestation", "mobile"] ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library author: arnaudjumelet --- - # Control the health of Windows 10-based devices - - **Applies to** - - Windows 10 - This article details an end-to-end solution that helps you protect high-value assets by enforcing, controlling, and reporting the health of Windows 10-based devices. - ## Introduction - - In Bring Your Own Device (BYOD) scenarios, employees bring commercially available devices to access both work-related resources and their personal data. Users want to use the device of their choice to access the organization’s applications, data, and resources not only from the internal network but also from anywhere. This phenomenon is also known as the consumerization of IT. - Users want to have the best productivity experience when accessing corporate applications and working on organization data from their devices. That means they will not tolerate being prompted to enter their work credentials each time they access an application or a file server. From a security perspective, it also means that users will manipulate corporate credentials and corporate data on unmanaged devices. - With the increased use of BYOD, there will be more unmanaged and potentially unhealthy systems accessing corporate services, internal resources, and cloud apps. - Even managed devices can be compromised and become harmful. Organizations need to detect when security has been breached and react as early as possible in order to protect high-value assets. - As Microsoft moves forward, security investments are increasingly focused on security preventive defenses and also on detection and response capabilities. - Windows 10 is an important component of an end-to-end security solution that focuses not only on the implementation of security preventive defenses, but adds device health attestation capabilities to the overall security strategy. - ## Description of a robust end-to-end security solution - - Today’s computing threat landscape is increasing at a speed never encountered before. The sophistication of criminal attacks is growing, and there is no doubt that malware now targets both consumers and professionals in all industries. - During recent years, one particular category of threat has become prevalent: advanced persistent threats (APTs). The term APT is commonly used to describe any attack that seems to target individual organizations on an on-going basis. In fact, this type of attack typically involves determined adversaries who may use any methods or techniques necessary. - With the BYOD phenomena, a poorly maintained device represents a target of choice. For an attacker, it’s an easy way to breach the security network perimeter, gain access to, and then steal high-value assets. - The attackers target individuals, not specifically because of who they are, but because of who they work for. An infected device will bring malware into an organization, even if the organization has hardened the perimeter of networks or has invested in its defensive posture. A defensive strategy is not sufficient against these threats. - ### A different approach - Rather than the traditional focus on the prevention of compromise, an effective security strategy assumes that determined adversaries will successfully breach any defenses. It means that it’s necessary to shift focus away from preventative security controls to detection of, and response to, security issues. The implementation of the risk management strategy, therefore, balances investment in prevention, detection, and response. - Because mobile devices are increasingly being used to access corporate information, some way to evaluate device security or health is required. This section describes how to provision device health assessment in such a way that high-value assets can be protected from unhealthy devices. - Devices that are used to access corporate resources must be trusted. An efficient end-to-end security approach is able to evaluate device health and use the current security state when granting access to a high-value asset. - ![figure 1](images/hva-fig1-endtoend1.png) - A robust design needs to establish the user’s identity, strengthen the authentication method if needed, and learn behavior like the network location the user regularly connects from. Also, a modern approach must be able to release sensitive content only if user devices are determined to be healthy and secure. - The following figure shows a solution built to assess device health from the cloud. The device authenticates the user through a connection to an identity provider in the cloud. If the managed asset contains highly confidential information, the conditional access engine of the identity provider may elect to verify the security compliance of the mobile device before access is granted. The user’s device is able to prove its health status that can be sent at any time or when mobile device management (MDM) requests it. - ![figure 2](images/hva-fig2-assessfromcloud2.png) - Windows devices can be protected from low-level rootkits and bootkits by using low-level hardware technologies such as Unified Extensible Firmware Interface (UEFI) Secure Boot. - Secure Boot is a firmware validation process that helps prevent rootkit attacks; it is part of the UEFI specification. The intent of UEFI is to define a standard way for the operating system to communicate with modern hardware, which can perform faster and with more efficient input/output (I/O) functions than older, software interrupt-driven BIOS systems. - A device health attestation module can communicate measured boot data that is protected by a Trusted Platform Module (TPM) to a remote service. After the device successfully boots, boot process measurement data is sent to a trusted cloud service (Health Attestation Service) using a more secure and tamper-resistant communication channel. - Remote health attestation service performs a series of checks on the measurements. It validates security related data points, including boot state (Secure Boot, Debug Mode, and so on), and the state of components that manage security (BitLocker, Device Guard, and so on). It then conveys the health state of the device by sending a health encrypted blob back to the device. - An MDM solution typically applies configuration policies and deploys software to devices. MDM defines the security baseline and knows the level of compliance of the device with regular checks to see what software is installed and what configuration is enforced, as well as determining the health status of the device. - An MDM solution asks the device to send device health information and forward the health encrypted blob to the remote health attestation service. The remote health attestation service verifies device health data, checks that MDM is communicating to the same device, and then issues a device health report back to the MDM solution. - An MDM solution evaluates the health assertions and, depending on the health rules belonging to the organization, can decide if the device is healthy. If the device is healthy and compliant, MDM passes that information to the identity provider so the organization’s access control policy can be invoked to grant access. - Access to content is then authorized to the appropriate level of trust for whatever the health status and other conditional elements indicate. - Depending on the requirements and the sensitivity of the managed asset, device health status can be combined with user identity information when processing an access request. Access to content is then authorized to the appropriate level of trust. The Conditional Access engine may be structured to allow additional verification as needed by the sensitivity of the managed asset. For example, if access to high-value data is requested, additional security authentication may need to be established by querying the user to answer a phone call before access is granted. - ### Microsoft’s security investments in Windows 10 - In Windows 10, there are three pillars of investments: - - **Secure identities.** Microsoft is part of the FIDO Alliance which aims to provide an interoperable method of secure authentication by moving away from the use of passwords for authentication, both on the local system as well as for services like on-premises resources and cloud resources. - - **Information protection.** Microsoft is making investments to allow organizations to have better control over who has access to important data and what they can do with that data. With Windows 10, organizations can take advantage of policies that specify which applications are considered to be corporate applications and can be trusted to access secure data. - - **Threat resistance.** Microsoft is helping organizations to better secure enterprise assets against the threats of malware and attacks by using security defenses relying on hardware. - ### Protect, control, and report on the security status of Windows 10-based devices - This section is an overview that describes different parts of the end-to-end security solution that helps protect high-value assets and information from attackers and malware. - ![figure 3](images/hva-fig3-endtoendoverview3.png) - @@ -140,266 +96,138 @@ This section is an overview that describes different parts of the end-to-end sec
-   - The combination of Windows 10-based devices, identity provider, MDM, and remote health attestation creates a robust end-to-end-solution that provides validation of health and compliance of devices that access high-value assets. - ## Protect devices and enterprise credentials against threats - - This section describes what Windows 10 offers in terms of security defenses and what control can be measured and reported to. - ### Windows 10 hardware-based security defenses - The most aggressive forms of malware try to insert themselves into the boot process as early as possible so that they can take control of the operating system early and prevent protection mechanisms and antimalware software from working. This type of malicious code is often called a rootkit or bootkit. The best way to avoid having to deal with low-level malware is to secure the boot process so that the device is protected from the very start. - Windows 10 supports multiple layers of boot protection. Some of these features are available only if specific types of hardware are installed. For more information, see the [Hardware requirements](#hardware-req) section. - ![figure 4](images/hva-fig4-hardware.png) - Windows 10 supports features to help prevent sophisticated low-level malware like rootkits and bootkits from loading during the startup process: - - **Trusted Platform Module.** A Trusted Platform Module (TPM) is a hardware component that provides unique security features. - Windows 10 leverages security characteristics of a TPM for measuring boot integrity sequence (and based on that, unlocking automatically BitLocker protected drives), for protecting credentials or for health attestation. - A TPM implements controls that meet the specification described by the Trusted Computing Group (TCG). At the time of this writing, there are two versions of TPM specification produced by TCG that are not compatible with each other: - - The first TPM specification, version 1.2, was published in February 2005 by the TCG and standardized under ISO / IEC 11889 standard. - - The latest TPM specification, referred to as TPM 2.0, was released in April 2014 and has been approved by the ISO/IEC Joint Technical Committee (JTC) as ISO/IEC 11889:2015. - Windows 10 uses the TPM for cryptographic calculations as part of health attestation and to protect the keys for BitLocker, Microsoft Passport, virtual smart cards, and other public key certificates. For more information, see [TPM requirements in Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=733948). - Windows 10 recognizes versions 1.2 and 2.0 TPM specifications produced by the TCG. For the most recent and modern security features, Windows 10 supports only TPM 2.0. TPM 2.0 is required for device health attestation. - TPM 2.0 provides a major revision to the capabilities over TPM 1.2: - - Update crypto strength to meet modern security needs - - Support for SHA-256 for PCRs - - Support for HMAC command - - Cryptographic algorithms flexibility to support government needs - - TPM 1.2 is severely restricted in terms of what algorithms it can support - - TPM 2.0 can support arbitrary algorithms with minor updates to the TCG specification documents - - Consistency across implementations - - The TPM 1.2 specification allows vendors wide latitude when choosing implementation details - - TPM 2.0 standardizes much of this behavior - - **Secure Boot.** Devices with UEFI firmware can be configured to load only trusted operating system bootloaders. Secure Boot does not require a TPM. - The most basic protection is the Secure Boot feature, which is a standard part of the UEFI 2.2+ architecture. On a PC with conventional BIOS, anyone who can take control of the boot process can boot by using an alternative OS loader, and potentially gain access to system resources. When Secure Boot is enabled, you can boot using only an OS loader that’s signed using a certificate stored in the UEFI Secure Boot DB. Naturally, the Microsoft certificate used to digitally sign the Windows 10 OS loaders are in that store, which allows UEFI to validate the certificate as part of its security policy. Secure Boot must be enabled by default on all computers that are certified for Windows 10 under the Windows Hardware Compatibility Program. - Secure Boot is a UEFI firmware-based feature, which allows for the signing and verification of critical boot files and drivers at boot time. Secure Boot checks signature values of the Windows Boot Manager, BCD store, Windows OS loader file, and other boot critical DLLs at boot time before the system is allowed to fully boot into a usable operating system by using policies that are defined by the OEM at build time. Secure Boot prevents many types of boot-based rootkit, malware, and other security-related attacks against the Windows platform. Secure Boot protects the operating system boot process whether booting from local hard disk, USB, PXE, or DVD, or into full Windows or Windows Recovery Environment (RE). - Secure Boot protects the boot environment of a Windows 10 installation by verifying the signatures of the critical boot components to confirm malicious activity did not compromise them. Secure Boot protection ends after the Windows kernel file (ntoskrnl.exe) has been loaded. - **Note**   Secure Boot protects the platform until the Windows kernel is loaded. Then protections like ELAM take over. -   - - **Secure Boot configuration policy.** Extends Secure Boot functionality to critical Windows 10 configuration. - Examples of protected configuration information include protecting Disable Execute bit (NX option) or ensuring that the test signing policy (code integrity) cannot be enabled. This ensures that the binaries and configuration of the computer can be trusted after the boot process has completed. - Secure Boot configuration policy does this with UEFI policy. These signatures for these policies are signed in the same way that operating system binaries are signed for use with Secure Boot. - The Secure Boot configuration policy must be signed by a private key that corresponds to one of the public keys stored in the Key Exchange Key (KEK) list. The Microsoft Certificate Authority (CA) will be present in the KEK list of all Windows certified Secure Boot systems. By default, a policy signed by the Microsoft KEK shall be work on all Secure Boot systems. BootMgr must verify the signature against the KEK list before applying a signed policy. With Windows 10, the default Secure Boot configuration policy is embedded in bootmgr. - The bootloader verifies the digital signature of the Windows 10 kernel before loading it. The Windows 10 kernel, in turn, verifies every other component of the Windows startup process, including the boot drivers, startup files, and the ELAM component. This step is important and protects the rest of the boot process by verifying that all Windows boot components have integrity and can be trusted. - - **Early Launch Antimalware (ELAM).** ELAM tests all drivers before they load and prevents unapproved drivers from loading. - Traditional antimalware apps don’t start until after the boot drivers have been loaded, which gives a rootkit that is disguised as a driver the opportunity to work. ELAM is a Windows mechanism introduced in a previous version of Windows that allows antimalware software to run very early in the boot sequence. Thus, the antimalware component is the first third-party component to run and control the initialization of other boot drivers until the Windows operating system is operational. When the system is started with a complete runtime environment (network access, storage, and so on), then a full-featured antimalware is loaded. - ELAM can load a Microsoft or non-Microsoft antimalware driver before all non-Microsoft boot drivers and applications, thus continuing the chain of trust established by Secure Boot and Trusted Boot. Because the operating system hasn’t started yet, and because Windows needs to boot as quickly as possible, ELAM has a simple task: Examine every boot driver and determine whether it is on the list of trusted drivers. If it’s not trusted, Windows won’t load it. - **Note**   Windows Defender, Microsoft's antimalware included by default in Windows 10, supports ELAM; it can be replaced with a third-party antimalware compatible solution. The name of the Windows Defender ELAM driver is WdBoot.sys. Windows Defender in Windows 10 uses its ELAM driver to roll back any malicious changes made to the Windows Defender driver at the next reboot. This prevents kernel mode malware making lasting changes to Windows Defender’s mini-filter driver before shutdown or reboot. -   - The ELAM signed driver is loaded before any other third-party drivers or applications, which allows the antimalware software to detect and block any attempts to tamper with the boot process by trying to load unsigned or untrusted code. - The ELAM driver is a small driver with a small policy database that has a very narrow scope, focused on drivers that are loaded early at system launch. The policy database is stored in a registry hive that is also measured to the TPM, to record the operational parameters of the ELAM driver. An ELAM driver must be signed by Microsoft and the associated certificate must contain the complementary EKU (1.3.6.1.4.1.311.61.4.1). - - **Virtualization-based security (Hyper-V + Secure Kernel).** Virtualization-based security is a completely new enforced security boundary that allows you to protect critical parts of Windows 10. - Virtualization-based security isolates sensitive code like Kernel Mode Code Integrity or sensitive corporate domain credentials from the rest of the Windows operating system. For more information, refer to the [Virtualization-based security](#virtual) section. - - **Hyper-V Code Integrity (HVCI).** Hyper-V Code Integrity is a feature of Device Guard that ensures only drivers, executables, and DLLs that comply with the Device Guard Code Integrity policy are allowed to run. - When enabled and configured, Windows 10 can start the Hyper-V virtualization-based security services, including Hyper-V Code Integrity (HVCI). HVCI helps protect the system core (kernel), privileged drivers, and system defenses, like antimalware solutions, by preventing malware from running early in the boot process, or after startup. - HVCI uses virtualization-based security to isolate Code Integrity, the only way kernel memory can become executable is through a Code Integrity verification. This means that kernel memory pages can never be Writable and Executable (W+X) and executable code cannot be directly modified. - **Note**   Device Guard devices that run Kernel Mode Code Integrity with virtualization-based security must have compatible drivers. For additional information, please read the [Driver compatibility with Device Guard in Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=691612) blog post. -   - The Device Guard Code Integrity feature lets organizations control what code is trusted to run into the Windows kernel and what applications are approved to run in user mode. It’s configurable by using a policy. - Device Guard Code Integrity policy is a binary file that Microsoft recommends you sign. The signing of the Code Integrity policy aids in the protection against a malicious user with Administrator privileges trying to modify or remove the current Code Integrity policy. - - **Credential Guard.** Credential Guard protects corporate credentials with hardware-based credential isolation. - In Windows 10, Credential Guard aims to protect domain corporate credentials from theft and reuse by malware. With Credential Guard, Windows 10 implemented an architectural change that fundamentally prevents the current forms of the pass-the-hash (PtH) attack. - This is accomplished by leveraging Hyper-V and the new virtualization-based security feature to create a protected container where trusted code and secrets are isolated from the Windows kernel. That means that even if the Windows kernel is compromised an attacker has no way to read and extract the data required to initiate a PtH attack. Credential Guard prevents this because the memory where secrets are stored is no longer accessible from the regular OS, even in kernel mode - the hypervisor controls who can access the memory. - - **Health attestation.** The device’s firmware logs the boot process, and Windows 10 can send it to a trusted server that can check and assess the device’s health. - Windows 10 takes measurements of the UEFI firmware and each of the Windows and antimalware components are made as they load during the boot process. Additionally, they are taken and measured sequentially, not all at once. When these measurements are complete, their values are digitally signed and stored securely in the TPM and cannot be changed unless the system is reset. - For more information, see [Secured Boot and Measured Boot: Hardening Early Boot Components Against Malware](http://go.microsoft.com/fwlink/p/?LinkId=733950). - During each subsequent boot, the same components are measured, which allows comparison of the measurements against an expected baseline. For additional security, the values measured by the TPM can be signed and transmitted to a remote server, which can then perform the comparison. This process, called *remote device health attestation*, allows the server to verify health status of the Windows device. - Health attestation requires the presence of TPM 2.0. On Windows 10, TPM 2.0 also requires UEFI firmware. - Although Secure Boot is a proactive form of protection, health attestation is a reactive form of boot protection. Health attestation ships disabled in Windows and is enabled by an antimalware or an MDM vendor. Unlike Secure Boot, health attestation will not stop the boot process and enter remediation when a measurement does not work. But with conditional access control, health attestation will help to prevent access to high-value assets. - ### Virtualization-based security - Virtualization-based security provides a new trust boundary for Windows 10. leverages Hyper-V hypervisor technology to enhance platform security. Virtualization-based security provides a secure execution environment to run specific Windows trusted code (trustlet) and to protect sensitive data. - Virtualization-based security helps to protect against a compromised kernel or a malicious user with Administrator privileges. Note that virtualization-based security is not trying to protect against a physical attacker. - The following Windows 10 services are protected with virtualization-based security: - - **Credential Guard** (LSA Credential Isolation): prevents pass-the-hash attacks and enterprise credential theft that happens by reading and dumping the content of lsass memory - - **Device Guard** (Hyper-V Code Integrity): Device Guard uses the new virtualization-based security in Windows 10 to isolate the Code Integrity service from the Windows kernel itself, which lets the service use signatures defined by your enterprise-controlled policy to help determine what is trustworthy. In effect, the Code Integrity service runs alongside the kernel in a Windows hypervisor-protected container. - - **Other isolated services**: for example, on Windows Server Technical Preview 2016, there is the vTPM feature that allows you to have encrypted virtual machines (VMs) on servers. - **Note**   Virtualization-based security is only available with Windows 10 Enterprise. Virtualization-based security requires devices with UEFI (2.3.1 or higher) with Secure Boot enabled, x64 processor with Virtualization Extensions and SLAT enabled. IOMMU, TPM 2.0. and support for Secure Memory overwritten are optional, but recommended. -   - The schema below is a high-level view of Windows 10 with virtualization-based security. - ![figure 5](images/hva-fig5-virtualbasedsecurity.png) - ### Credential Guard - In Windows 10, when Credential Guard is enabled, Local Security Authority Subsystem Service (lsass.exe) runs sensitive code in an Isolated user mode to help protect data from malware that may be running in the normal user mode. This helps ensure that protected data is not stolen and reused on remote machines, which mitigates many PtH-style attacks. - Credential Guard helps protect credentials by encrypting them with either a per-boot or persistent key: - - **The per-boot key** is used for any in-memory credentials that do not require persistence. An example of such a credential would be a ticket-granting ticket (TGT) session key. This key is negotiated with a Key Distribution Center (KDC) every time authentication occurs and is protected with a per-boot key. - - **The persistent key**, or some derivative, is used to help protect items that are stored and reloaded after a reboot. Such protection is intended for long-term storage, and must be protected with a consistent key. - Credential Guard is activated by a registry key and then enabled by using an UEFI variable. This is done to protect against remote modifications of the configuration. The use of a UEFI variable implies that physical access is required to change the configuration. When lsass.exe detects that credential isolation is enabled, it then spawns LsaIso.exe as an isolated process, which ensures that it runs within isolated user mode. The startup of LsaIso.exe is performed before initialization of a security support provider, which ensures that the secure mode support routines are ready before any authentication begins. - ### Device Guard - Device Guard is a new feature of Windows 10 Enterprise that allows organizations to lock down a device to help protect it from running untrusted software. In this configuration, the only applications allowed to run are those that are trusted by the organization. - The trust decision to execute code is performed by using Hyper-V Code Integrity, which runs in virtualization-based security, a Hyper-V protected container that runs alongside regular Windows. - Hyper-V Code Integrity is a feature that validates the integrity of a driver or system file each time it is loaded into memory. Code integrity detects whether an unsigned driver or system file is being loaded into the kernel, or whether a system file has been modified by malicious software that is being run by a user account with Administrator privileges. On x64-based versions of Windows 10 kernel-mode drivers must be digitally signed. - **Note**   Independently of activation of Device Guard Policy, [Windows 10 by default raises the bar for what runs in the kernel](http://go.microsoft.com/fwlink/p/?LinkId=691613). Windows 10 drivers must be signed by Microsoft, and more specifically, by the WHQL (Windows Hardware Quality Labs) portal. Additionally, starting in October 2015, the WHQL portal will only accept driver submissions, including both kernel and user mode driver submissions, that have a valid Extended Validation (“EV”) Code Signing Certificate. -   - With Device Guard in Windows 10, organizations are now able to define their own Code Integrity policy for use on x64 systems running Windows 10 Enterprise. Organizations have the ability to configure the policy that determines what is trusted to run. These include drivers and system files, as well as traditional desktop applications and scripts. The system is then locked down to only run applications that the organization trusts. - Device Guard is a built-in feature of Windows 10 Enterprise that prevents the execution of unwanted code and applications. Device Guard can be configured using two rule actions - allow and deny: - - **Allow** limits execution of applications to an allowed list of code or trusted publisher and blocks everything else. - - **Deny** completes the allow trusted publisher approach by blocking the execution of a specific application. - At the time of this writing, and according to Microsoft’s latest research, more than 90 percent of malware is unsigned completely. So implementing a basic Device Guard policy can simply and effectively help block the vast majority of malware. In fact, Device Guard has the potential to go further, and can also help block signed malware. - Device Guard needs to be planned and configured to be truly effective. It is not just a protection that is enabled or disabled. Device Guard is a combination of hardware security features and software security features that, when configured together, can lock down a computer to help ensure the most secure and resistant system possible. - There are three different parts that make up the Device Guard solution in Windows 10: - - The first part is a base **set of hardware security features** introduced with the previous version of Windows. TPM for hardware cryptographic operations and UEFI with modern firmware, along with Secure Boot, allows you to control what the device is running when the systems start. - - After the hardware security feature, there is the code integrity engine. In Windows 10, **Code Integrity is now fully configurable** and now resides in Isolated user mode, a part of the memory that is protected by virtualization-based security. - - The last part of Device Guard is **manageability**. Code Integrity configuration is exposed through specific Group Policy Objects, PowerShell cmdlets, and MDM configuration service providers (CSPs). - For more information on how to deploy Device Guard in an enterprise, see the [Device Guard deployment guide](device-guard-deployment-guide.md). - ### Device Guard scenarios - As previously described, Device Guard is a powerful way to lock down systems. Device Guard is not intended to be used broadly and it may not always be applicable, but there are some high-interest scenarios. - Device Guard is useful and applicable on fixed workloads systems like cash registers, kiosk machines, Secure Admin Workstations (SAWs), or well managed desktops. Device Guard is highly relevant on systems that have very well-defined software that are expected to run and don’t change too frequently. It could also help protect Information Workers (IWs) beyond just SAWs, as long as what they need to run is known and the set of applications is not going to change on a daily basis. - SAWs are computers that are built to help significantly reduce the risk of compromise from malware, phishing attacks, bogus websites, and PtH attacks, among other security risks. Although SAWs can’t be considered a “silver bullet” security solution to these attacks, these types of clients are helpful as part of a layered, defense-in-depth approach to security. - To protect high-value assets, SAWs are used to make secure connections to those assets. - Similarly, on corporate fully-managed workstations, where applications are installed by using a distribution tool like System Center Configuration Manager, Intune, or any third-party device management, then Device Guard is very applicable. In that type of scenario, the organization has a good idea of the software that an average user is running. - It could be challenging to use Device Guard on corporate, lightly-managed workstations where the user is typically allowed to install software on their own. When an organization offers great flexibility, it’s quite difficult to run Device Guard in enforcement mode. Nevertheless, Device Guard can be run in Audit mode, and in that case, the event log will contain a record of any binaries that violated the Device Guard policy. When Device Guard is used in Audit mode, organizations can get rich data about drivers and applications that users install and run. - Before you can benefit from the protection included in Device Guard, Code Integrity policy must be created by using tools provided by Microsoft, but the policy can be deployed with common management tools, like Group Policy. The Code Integrity policy is a binary-encoded XML document that includes configuration settings for both the User and Kernel-modes of Windows 10, along with restrictions on Windows 10 script hosts. Device Guard Code Integrity policy restricts what code can run on a device. - **Note**   Device Guard policy can be signed in Windows 10, which adds additional protection against administrative users changing or removing this policy. -   - Signed Device Guard policy offers stronger protection against a malicious local administrator trying to defeat Device Guard. - When the policy is signed, the GUID of the policy is stored in a UEFI pre-OS secure variable which offers tampering protection. The only way to update the Device Guard policy subsequently is to provide a new version of the policy signed by the same signer or from a signer specified as part of the Device Guard policy into the UpdateSigner section. - ### The importance of signing applications - On computers with Device Guard, Microsoft proposes to move from a world where unsigned apps can be run without restriction to a world where only signed and trusted code is allowed to run on Windows 10. - With Windows 10, organizations will make line-of-business (LOB) apps available to members of the organization through the Windows Store infrastructure. More specifically, LOB apps will be available in a private store within the public Windows Store. Windows Store signs and distributes Universal Windows apps and Classic Windows apps. All apps downloaded from the Windows Store are signed. - In organizations today, the vast majority of LOB applications are unsigned. Code signing is frequently viewed as a tough problem to solve for a variety of reasons, like the lack of code signing expertise. Even if code signing is a best practice, a lot of internal applications are not signed. - Windows 10 includes tools that allow IT pros to take applications that have been already packaged and run them through a process to create additional signatures that can be distributed along with existing applications. - ### Why are antimalware and device management solutions still necessary? - Although allow-list mechanisms are extremely efficient at ensuring that only trusted applications can be run, they cannot prevent the compromise of a trusted (but vulnerable) application by malicious content designed to exploit a known vulnerability. Device Guard doesn’t protect against user mode malicious code run by exploiting vulnerabilities. - Vulnerabilities are weaknesses in software that could allow an attacker to compromise the integrity, availability, or confidentiality of the device. Some of the worst vulnerabilities allow attackers to exploit the compromised device by causing it to run malicious code without the user’s knowledge. - It’s common to see attackers distributing specially crafted content in an attempt to exploit known vulnerabilities in user mode software like web browsers (and their plug-ins), Java virtual machines, PDF readers, or document editors. As of today, 90 percent of discovered vulnerabilities affect user mode applications compared to the operating system and kernel mode drivers that host them. - To combat these threats, patching is the single most effective control, with antimalware software forming complementary layers of defense. - Most application software has no facility for updating itself, so even if the software vendor publishes an update that fixes the vulnerability, the user may not know that the update is available or how to obtain it, and therefore remains vulnerable to attack. Organizations still need to manage devices and to patch vulnerabilities. - MDM solutions are becoming prevalent as a light-weight device management technology. Windows 10 extends the management capabilities that have become available for MDMs. One key feature Microsoft has added to Windows 10 is the ability for MDMs to acquire a strong statement of device health from managed and registered devices. - ### Device health attestation - Device health attestation leverages the TPM 2.0 to provide cryptographically strong and verifiable measurements of the chain of software used to boot the device. - For Windows 10-based devices, Microsoft introduces a new public API that will allow MDM software to access a remote attestation service called Windows Health Attestation Service. A health attestation result, in addition with other elements, can be used to allow or deny access to networks, apps, or services, based on whether devices prove to be healthy. - For more information on device health attestation, see the [Detect an unhealthy Windows 10-based device](#detect-unhealthy) section. - ### Hardware requirements - The following table details the hardware requirements for both virtualization-based security services and the health attestation feature. For more information, see [Minimum hardware requirements](http://go.microsoft.com/fwlink/p/?LinkId=733951). - @@ -444,264 +272,137 @@ The following table details the hardware requirements for both virtualization-ba
-   - This section presented information about several closely related controls in Windows 10. The multi-layer defenses and in-depth approach helps to eradicate low-level malware during boot sequence. Virtualization-based security is a fundamental operating system architecture change that adds a new security boundary. Device Guard and Credential Guard respectively help to block untrusted code and protect corporate domain credentials from theft and reuse. This section also briefly discussed the importance of managing devices and patching vulnerabilities. All these technologies can be used to harden and lock down devices while limiting the risk of attackers compromising them. - ## Detect an unhealthy Windows 10-based device - - As of today, many organizations only consider devices to be compliant with company policy after they’ve passed a variety of checks that show, for example, that the operating system is in the correct state, properly configured, and has security protection enabled. Unfortunately, with today’s systems, this form of reporting is not entirely reliable because malware can spoof a software statement about system health. A rootkit, or a similar low-level exploit, can report a false healthy state to traditional compliance tools. - The biggest challenge with rootkits is that they can be undetectable to the client. Because they start before antimalware, and they have system-level privileges, they can completely disguise themselves while continuing to access system resources. As a result, traditional computers infected with rootkits appear to be healthy, even with antimalware running. - As previously discussed, the health attestation feature of Windows 10 uses the TPM 2.0 hardware component to securely record a measurement of every boot-related component, including firmware, Windows 10 kernel, and even early boot drivers. Because, health attestation leverages the hardware-based security capabilities of TPM, the log of all boot measured components remains out of the reach of any malware. - By attesting a trusted boot state, devices can prove that they are not running low-level malware that could spoof later compliance checks. TPM-based health attestation provides a reliable anchor of trust for assets that contain high-value data. - ### What is the concept of device health? - To understand the concept of device health, it’s important to know traditional measures that IT pros have taken to prevent the breach of malware. Malware control technologies are highly focused on the prevention of installation and distribution. - However, the use of traditional malware prevention technologies like antimalware or patching solutions brings a new set of issues for IT pros: the ability to monitor and control the compliance of devices accessing organization’s resources. - The definition of device compliance will vary based on an organization’s installed antimalware, device configuration settings, patch management baseline, and other security requirements. But health of the device is part of the overall device compliance policy. - The health of the device is not binary and depends on the organization’s security implementation. The Health Attestation Service provides information back to the MDM on which security features are enabled during the boot of the device by leveraging trustworthy hardware TPM. - But health attestation only provides information, which is why an MDM solution is needed to take and enforce a decision. - ### Remote device health attestation - In Windows 10, health attestation refers to a feature where Measured Boot data generated during the boot process is sent to a remote device health attestation service operated by Microsoft. - This is the most secure approach available for Windows 10-based devices to detect when security defenses are down. During the boot process, the TCG log and PCRs values are sent to a remote Microsoft cloud service. Logs are then checked by the Health Attestation Service to determine what changes have occurred on the device. - A relying party like an MDM can inspect the report generated by the remote health attestation service. - **Note**   To use the health attestation feature of Windows 10, the device must be equipped with a discrete or firmware TPM 2.0. There is no restriction on any particular edition of Windows 10. -   - Windows 10 supports health attestation scenarios by allowing applications access to the underlying health attestation configuration service provider (CSP) so that applications can request a health attestation token. The measurement of the boot sequence can be checked at any time locally by an antimalware or an MDM agent. - Remote device health attestation combined with an MDM provides a hardware-rooted method for reporting the current security status and detecting any changes, without having to trust the software running on the system. - In the case where malicious code is running on the device, the use of a remote server is required. If a rootkit is present on the device, the antimalware is no longer reliable, and its behavior can be hijacked by a malicious code running early in the startup sequence. That's why it's important to use Secure Boot and Device Guard, to control which code is loaded during the boot sequence. - The antimalware software can search to determine whether the boot sequence contains any signs of malware, such as a rootkit. It can also send the TCG log and the PCRs to a remote health attestation server to provide a separation between the measurement component and the verification component. - Health attestation logs the measurements in various TPM Platform Configuration Registers (PCRs) and TCG logs during the boot process. - ![figure 6](images/hva-fig6-logs.png) - When starting a device equipped with a TPM, a measurement of different components is performed. This includes firmware, UEFI drivers, CPU microcode, and also all the Windows 10 drivers whose type is Boot Start. The raw measurements are stored in the TPM PCR registers while the details of all events (executable path, authority certification, and so on) are available in the TCG log. - ![figure 7](images/hva-fig7-measurement.png) - The health attestation process works as follows: - 1. Hardware boot components are measured. - 2. Operating system boot components are measured. - 3. If Device Guard is enabled, current Device Guard policy is measured. - 4. Windows kernel is measured. - 5. Antivirus software is started as the first kernel mode driver. - 6. Boot start drivers are measured. - 7. MDM server through the MDM agent issues a health check command by leveraging the Health Attestation CSP. - 8. Boot measurements are validated by the Health Attestation Service - **Note**   By default, the last 100 system boot logs and all associated resume logs are archived in the %SystemRoot%\\logs\\measuredboot folder. - The number of retained logs may be set with the registry **REG\_DWORD** value **PlatformLogRetention** under the **HKLM\\SYSTEM\\CurrentControlSet\\Services\\TPM** key. A value of **0** will turn off log archival and a value of **0xffffffff** will keep all logs. -   - The following process describes how health boot measurements are sent to the health attestation service: - 1. The client (a Windows 10-based device with a TPM 2.0) initiates the request with the remote device health attestation service. Because the health attestation server is expected to be a Microsoft cloud service, the URI is already pre-provisioned in the client. - 2. The client then sends the TCG log, the AIK signed data (PCR values, boot counter) and the AIK certificate information. - 3. The remote device heath attestation service then: - 1. Verifies that the AIK certificate is issued by a known and trusted CA and the certificate is valid and not revoked. - 2. Verifies that the signature on the PCR quotes is correct and consistent with the TCG log value. - 3. Parses the properties in the TCG log. - 4. Issues the device health token that contains the health information, the AIK information, and the boot counter information. The health token also contains valid issuance time. The device health token is encrypted and signed, that means that the information is protected and only accessible to issuing health attestation service. - 4. The client stores the health encrypted blob in its local store. The device health token contains device health status, a device ID (the Windows AIK), and the boot counter. - ![figure 8](images/hva-fig8a-healthattest8a.png) - ### Device health attestation components - The device health attestation solution involves different components that are TPM, Health Attestation CSP, and the Windows Health Attestation Service. Those components are described in this section. - ### Trusted Platform Module - *It’s all about TPM 2.0 and endorsement certificates.* This section describes how PCRs (that contain system configuration data), endorsement key (EK) (that act as an identity card for TPM), SRK (that protect keys) and AIKs (that can report platform state) are used for health attestation reporting. - In a simplified manner, the TPM is a passive component with limited resources. It can calculate random numbers, RSA keys, decrypt short data, store hashes taken when booting the device. - A TPM incorporates in a single component: - - A RSA 2048-bit key generator - - A random number generator - - Nonvolatile memory for storing EK, SRK, and AIK keys - - A cryptographic engine to encrypt, decrypt, and sign - - Volatile memory for storing the PCRs and RSA keys - ### Endorsement key - The TPM has an embedded unique cryptographic key called the endorsement key. The TPM endorsement key is a pair of asymmetric keys (RSA size 2048 bits). - The endorsement key public key is generally used for sending securely sensitive parameters, such as when taking possession of the TPM that contains the defining hash of the owner password. The EK private key is used when creating secondary keys like AIKs. - The endorsement key acts as an identity card for the TPM. For more information, see [Understand the TPM endorsement key](http://go.microsoft.com/fwlink/p/?LinkId=733952). - The endorsement key is often accompanied by one or two digital certificates: - - One certificate is produced by the TPM manufacturer and is called the **endorsement certificate**. The endorsement certificate is used to prove the authenticity of the TPM (for example, that it’s a real TPM manufactured by a specific chip maker) to local processes, applications, or cloud services. The endorsement certificate is created during manufacturing or the first time the TPM is initialized by communicating with an online service. - - The other certificate is produced by the platform builder and is called the **platform certificate** to indicate that a specific TPM is integrated with a certain device. - For certain devices that use firmware-based TPM produced by Intel or Qualcomm, the endorsement certificate is created when the TPM is initialized during the OOBE of Windows 10. - **Note**   Secure Boot protects the platform until the Windows kernel is loaded. Then protections like Trusted Boot, Hyper-V Code Integrity and ELAM take over. A device that uses Intel TPM or Qualcomm TPM gets a signed certificate online from the manufacturer that has created the chip and then stores the signed certificate in TPM storage. For the operation to succeed, if you are filtering Internet access from your client devices, you must authorize the following URLs: - - For Intel firmware TPM: **https://ekop.intel.com/ekcertservice** - - For Qualcomm firmware TPM: **https://ekcert.spserv.microsoft.com/** -   - ### Attestation Identity Keys - Because the endorsement certificate is unique for each device and does not change, the usage of it may present privacy concerns because it's theoretically possible to track a specific device. To avoid this privacy problem, Windows 10 issues a derived attestation anchor based on the endorsement certificate. This intermediate key, which can be attested to an endorsement key, is the Attestation Identity Key (AIK) and the corresponding certificate is called the AIK certificate. This AIK certificate is issued by a Microsoft cloud service. - **Note**   Before the device can report its health using the TPM 2.0 attestation functions, an AIK certificate must be provisioned in conjunction with a third-party service like the Microsoft Cloud CA service. After it is provisioned, the AIK private key can be used to report platform configuration. Windows 10 creates a signature over the platform log state (and a monotonic counter value) at each boot by using the AIK. -   - The AIK is an asymmetric (public/private) key pair that is used as a substitute for the EK as an identity for the TPM for privacy purposes. The private portion of an AIK is never revealed or used outside the TPM and can only be used inside the TPM for a limited set of operations. Furthermore, it can only be used for signing, and only for limited, TPM-defined operations. - Windows 10 creates AIKs protected by the TPM, if available, that are 2048-bit RSA signing keys. Microsoft is hosting a cloud service called Microsoft Cloud CA to establish cryptographically that it is communicating with a real TPM and that the TPM possesses the presented AIK. After the Microsoft Cloud CA service has established these facts, it will issue an AIK certificate to the Windows 10-based device. - Many existing devices that will upgrade to Windows 10 will not have a TPM, or the TPM will not contain an endorsement certificate. **To accommodate those devices, Windows 10 allows the issuance of AIK certificates without the presence of an endorsement certificate.** Such AIK certificates are not issued by Microsoft Cloud CA. Note that this is not as trustworthy as an endorsement certificate that is burned into the device during manufacturing, but it will provide compatibility for advanced scenarios like Microsoft Passport without TPM. - In the issued AIK certificate, a special OID is added to attest that endorsement certificate was used during the attestation process. This information can be leveraged by a relying party to decide whether to reject devices that are attested using AIK certificates without an endorsement certificate or accept them. Another scenario can be to not allow access to high-value assets from devices that are attested by an AIK certificate that is not backed by an endorsement certificate. - ### Storage root key - The storage root key (SRK) is also an asymmetric key pair (RSA with a minimum of 2048 bits length). The SRK has a major role and is used to protect TPM keys, so that these keys cannot be used without the TPM. The SRK key is created when the ownership of the TPM is taken. - ### Platform Configuration Registers - The TPM contains a set of registers that are designed to provide a cryptographic representation of the software and state of the system that booted. These registers are called Platform Configuration Registers (PCRs). - The measurement of the boot sequence is based on the PCR and TCG log. To establish a static root of trust, when the device is starting, the device must be able to measure the firmware code before execution. In this case, the Core Root of Trust for Measurement (CRTM) is executed from the boot, calculates the hash of the firmware, then stores it by expanding the register PCR\[0\] and transfers execution to the firmware. - PCRs are set to zero when the platform is booted, and it is the job of the firmware that boots the platform to measure components in the boot chain and to record the measurements in the PCRs. Typically, boot components take the hash of the next component that is to be run and record the measurements in the PCRs. The initial component that starts the measurement chain is implicitly trusted. This is the CRTM. Platform manufacturers are required to have a secure update process for the CRTM or not permit updates to it. The PCRs record a cumulative hash of the components that have been measured. - The value of a PCR on its own is hard to interpret (it is just a hash value), but platforms typically keep a log with details of what has been measured, and the PCRs merely ensure that the log has not been tampered with. The logs are referred as a TCG log. Each time a register PCR is extended, an entry is added to the TCG log. Thus, throughout the boot process, a trace of the executable code and configuration data is created in the TCG log. - ### TPM provisioning - For the TPM of a Windows 10-based device to be usable, it must first be provisioned. The process of provisioning differs somewhat based on TPM versions, but, when successful, it results in the TPM being usable and the owner authorization data (ownerAuth) for the TPM being stored locally on the registry. - When the TPM is provisioned, Windows 10 will first attempt to determine the EK and locally stored **ownerAuth** values by looking in the registry at the following location: **HKLM\\SYSTEM\\CurrentControlSet\\Services\\TPM\\WMI\\Endorsement** - During the provisioning process, the device may need to be restarted. - Note that the **Get-TpmEndorsementKeyInfo PowerShell** cmdlet can be used with administrative privilege to get information about the endorsement key and certificates of the TPM. - If the TPM ownership is not known but the EK exists, the client library will provision the TPM and will store the resulting **ownerAuth** value into the registry if the policy allows it will store the SRK public portion at the following location: **HKLM\\SYSTEM\\CurrentControlSet\\Services\\TPM\\WMI\\Admin\\SRKPub** - As part of the provisioning process, Windows 10 will create an AIK with the TPM. When this operation is performed, the resulting AIK public portion is stored in the registry at the following location: **HKLM\\SYSTEM\\CurrentControlSet\\Services\\TPM\\WMI\\WindowsAIKPub** - **Note**   For provisioning AIK certificates and filtering Internet access, you must authorize the following wildcard URL: **https://\*.microsoftaik.azure.net** -   - ### Windows 10 Health Attestation CSP - Windows 10 contains a configuration service provider (CSP) specialized for interacting with the health attestation feature. A CSP is a component that plugs into the Windows MDM client and provides a published protocol for how MDM servers can configure settings and manage Windows-based devices. The management protocol is represented as a tree structure that can be specified as URIs with functions to perform on the URIs such as “get”, “set”, “delete”, and so on. - The following is a list of functions performed by the Windows 10 Health Attestation CSP: - - Collects data that is used to verify a device’s health status - - Forwards the data to the Health Attestation Service - - Provisions the Health Attestation Certificate that it receives from the Health Attestation Service - - Upon request, forwards the Health Attestation Certificate (received from the Health Attestation Service) and related runtime information to the MDM server for verification - During a health attestation session, the Health Attestation CSP forwards the TCG logs and PCRs values that are measured during the boot, by using a secure communication channel to the Health Attestation Service. - When an MDM server validates that a device has attested to the Health Attestation Service, it will be given a set of statements and claims about how that device booted, with the assurance that the device did not reboot between the time that it attested its health and the time that the MDM server validated it. - ### Windows Health Attestation Service - The role of Windows Health Attestation Service is essentially to evaluate a set of health data (TCG log and PCR values), make a series of detections (based on available health data) and generate encrypted health blob or produce report to MDM servers. - **Note**   Both device and MDM servers must have access to **has.spserv.microsoft.com** using the TCP protocol on port 443 (HTTPS). -   - Checking that a TPM attestation and the associated log are valid takes several steps: - 1. First, the server must check that the reports are signed by **trustworthy AIKs**. This might be done by checking that the public part of the AIK is listed in a database of assets, or perhaps that a certificate has been checked. - 2. After the key has been checked, the signed attestation (a quote structure) should be checked to see whether it is a **valid signature over PCR values**. - 3. Next the logs should be checked to ensure that they match the PCR values reported. - 4. Finally, the logs themselves should be examined by an MDM solution to see whether they represent **known or valid security configurations**. For example, a simple check might be to see whether the measured early OS components are known to be good, that the ELAM driver is as expected, and that the ELAM driver policy file is up to date. If all of these checks succeed, an attestation statement can be issued that later can be used to determine whether or not the client should be granted access to a resource. - The Health Attestation Service provides the following information to an MDM solution about the health of the device: - - Secure Boot enablement - - Boot and kernel debug enablement - - BitLocker enablement - - VSM enabled - - Signed or unsigned Device Guard Code Integrity policy measurement - - ELAM loaded - - Safe Mode boot, DEP enablement, test signing enablement - - Device TPM has been provisioned with a trusted endorsement certificate - For completeness of the measurements, see [Health Attestation CSP](http://go.microsoft.com/fwlink/p/?LinkId=733949). - The following table presents some key items that can be reported back to MDM depending on the type of Windows 10-based device. - @@ -743,267 +444,134 @@ The following table presents some key items that can be reported back to MDM dep
-   - ### Leverage MDM and the Health Attestation Service - To make device health relevant, the MDM solution evaluates the device health report and is configured to the organization’s device health requirements. - A solution that leverages MDM and the Health Attestation Service consists of three main parts: - 1. A device with health attestation enabled. This will usually be done as a part of enrollment with an MDM provider (health attestation will be disabled by default). - 2. After this is enabled, and every boot thereafter, the device will send health measurements to the Health Attestation Service hosted by Microsoft, and it will receive a health attestation blob in return. - 3. At any point after this, an MDM server can request the health attestation blob from the device and ask Health Attestation Service to decrypt the content and validate that it’s been attested. - ![figure 9](images/hva-fig8-evaldevicehealth8.png) - Interaction between a Windows 10-based device, the Health Attestation Service, and MDM can be performed as follows: - 1. The client initiates a session with the MDM server. The URI for the MDM server would be part of the client app that initiates the request. The MDM server at this time could request the health attestation data by using the appropriate CSP URI. - 2. The MDM server specifies a nonce along with the request. - 3. The client then sends the AIK quoted nonce + the boot counter and the health blob information. This health blob is encrypted with a Health Attestation Service public key that only the Health Attestation Service can decrypt. - 4. The MDM server: - 1. Verifies that the nonce is as expected. - 2. Passes the quoted data, the nonce and the encrypted health blob to the Health Attestation Service server. - 5. The Health Attestation Service: - 1. Decrypts the health blob. - 2. Verifies that the boot counter in the quote is correct using the AIK in the health blob and matches the value in the health blob. - 3. Verifies that the nonce matches in the quote and the one that is passed from MDM. - 4. Because the boot counter and the nonce are quoted with the AIK from the health blob, it also proves that the device is the same one as the one for which the health blob has been generated. - 5. Sends data back to the MDM server including health parameters, freshness, and so on. - **Note**   The MDM server (relying party) never performs the quote or boot counter validation itself. It gets the quoted data and the health blob (which is encrypted) and sends the data to the Health Attestation Service for validation. This way, the AIK is never visible to the MDM, which thereby addresses privacy concerns. -   - Setting the requirements for device compliance is the first step to ensure that registered devices that do not meet health and compliance requirements are detected, tracked, and have actions enforced by the MDM solution. - Devices that attempt to connect to resources must have their health evaluated so that unhealthy and noncompliant devices can be detected and reported. To be fully efficient, an end-to-end security solution must impose a consequence for unhealthy devices like refusing access to high-value assets. That is the purpose of conditional access control, which is detailed in the next section. - ## Control the security of a Windows 10-based device before access is granted - - Today’s access control technology, in most cases, focuses on ensuring that the right people get access to the right resources. If users can authenticate, they get access to resources using a device that the organization’s IT staff and systems know very little about. Perhaps there is some check such as ensuring that a device is encrypted before giving access to email, but what if the device is infected with malware? - The remote device health attestation process uses measured boot data to verify the health status of the device. The health of the device is then available for an MDM solution like Intune. - **Note**   For the latest information on Intune and Windows 10 features support, see the [Microsoft Intune blog](http://go.microsoft.com/fwlink/p/?LinkId=691614) and [What's new in Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkId=733956). -   - The figure below shows how the Health Attestation Service is expected to work with Microsoft’s cloud-based Intune MDM service. - ![figure 10](images/hva-fig9-intune.png) - An MDM solution can then leverage health state statements and take them to the next level by coupling with client policies that will enable conditional access to be granted based on the device’s ability to prove that it’s malware free, its antimalware system is functional and up to date, the firewall is running, and the devices patch state is compliant. - Finally, resources can be protected by denying access to endpoints that are unable to prove they’re healthy. This feature is much needed for BYOD devices that need to access organizational resources. - ### Built-in support of MDM in Windows 10 - Windows 10 has an MDM client that ships as part of the operating system. This enables MDM servers to manage Windows 10-based devices without requiring a separate agent. - ### Third-party MDM server support - Third-party MDM servers can manage Windows 10 by using the MDM protocol. The built-in management client is able to communicate with a compatible server that supports the OMA-DM protocol to perform enterprise management tasks. For additional information, see [Azure Active Directory integration with MDM](http://go.microsoft.com/fwlink/p/?LinkId=733954). - **Note**   MDM servers do not need to create or download a client to manage Windows 10. For more information, see [Mobile device management](http://go.microsoft.com/fwlink/p/?LinkId=733955). -   - The third-party MDM server will have the same consistent first-party user experience for enrollment, which also provides simplicity for Windows 10 users. - ### Management of Windows Defender by third-party MDM - This management infrastructure makes it possible for IT pros to use MDM-capable products like Intune, to manage health attestation, Device Guard, or Windows Defender on Windows 10-based devices, including BYODs that aren’t domain joined. IT pros will be able to manage and configure all of the actions and settings they are familiar with customizing by using Intune with Intune Endpoint Protection on down-level operating systems. Admins that currently only manage domain joined devices through Group Policy will find it easy to transition to managing Windows 10-based devices by using MDM because many of the settings and actions are shared across both mechanisms. - For more information on how to manage Windows 10 security and system settings with an MDM solution, see [Custom URI settings for Windows 10 devices](http://go.microsoft.com/fwlink/p/?LinkId=733953). - ### Conditional access control - On most platforms, the Azure Active Directory (Azure AD) device registration happens automatically during enrollment. The device states are written by the MDM solution into Azure AD, and then read by Office 365 (or by any authorized Windows app that interacts with Azure AD) the next time the client tries to access an Office 365 compatible workload. - If the device is not registered, the user will get a message with instructions on how to register (also known as enrolling). If the device is not compliant, the user will get a different message that redirects them to the MDM web portal where they can get more information on the compliance problem and how to resolve it. - **Azure AD** authenticates the user and the device, **MDM** manages the compliance and conditional access policies, and the **Health Attestation Service** reports about the health of the device in an attested way. - ![figure 11](images/hva-fig10-conditionalaccesscontrol.png) - ### Office 365 conditional access control - Azure AD enforces conditional access policies to secure access to Office 365 services. A tenant admin can create a conditional access policy that blocks a user on a non-compliant device from accessing an Office 365 service. The user must conform to the company’s device policies before access can be granted to the service. Alternately, the admin can also create a policy that requires users to just enroll their devices to gain access to an Office 365 service. Policies may be applied to all users of an organization, or limited to a few target groups and enhanced over time to include additional target groups. - When a user requests access to an Office 365 service from a supported device platform, Azure AD authenticates the user and device from which the user launches the request; and grants access to the service only when the user conforms to the policy set for the service. Users that do not have their device enrolled are given remediation instructions on how to enroll and become compliant to access corporate Office 365 services. - When a user enrolls, the device is registered with Azure AD, and enrolled with a compatible MDM solution like Intune. - **Note**   Microsoft is working with third-party MDM ISVs to support automated MDM enrollment and policy based access checks. Steps to turn on auto-MDM enrollment with Azure AD and Intune are explained in the [Windows 10, Azure AD And Microsoft Intune: Automatic MDM Enrollment Powered By The Cloud!](http://go.microsoft.com/fwlink/p/?LinkId=691615) blog post. -   - When a user enrolls a device successfully, the device becomes trusted. Azure AD provides single-sign-on to access company applications and enforces conditional access policy to grant access to a service not only the first time the user requests access, but every time the user requests to renew access. - The user will be denied access to services when sign-in credentials are changed, a device is lost/stolen, or the compliance policy is not met at the time of request for renewal. - Depending on the type of email application that employees use to access Exchange online, the path to establish secured access to email can be slightly different. However, the key components: Azure AD, Office 365/Exchange Online, and Intune, are the same. The IT experience and end-user experience also are similar. - ![figure 12](images/hva-fig11-office365.png) - Clients that attempt to access Office 365 will be evaluated for the following properties: - - Is the device managed by an MDM? - - Is the device registered with Azure AD? - - Is the device compliant? - To get to a compliant state, the Windows 10-based device needs to: - - Enroll with an MDM solution. - - Register with Azure AD. - - Be compliant with the device policies set by the MDM solution. - **Note**   At the present time, conditional access policies are selectively enforced on users on iOS and Android devices. For more information, see the [Azure AD, Microsoft Intune and Windows 10 – Using the cloud to modernize enterprise mobility!](http://go.microsoft.com/fwlink/p/?LinkId=691616) blog post. -   - ### Cloud and on-premises apps conditional access control - Conditional access control is a powerful policy evaluation engine built into Azure AD. It gives IT pros an easy way to create access rules beyond Office 365 that evaluate the context of a user's logon to make real-time decisions about which applications they should be allowed to access. - IT pros can configure conditional access control policies for cloud SaaS applications secured by Azure AD and even on-premises applications. Access rules in Azure AD leverage the conditional access engine to check device health and compliance state reported by a compatible MDM solution like Intune in order to determine whether to allow access. - For more information about conditional access, see [Azure Conditional Access Preview for SaaS Apps.](http://go.microsoft.com/fwlink/p/?LinkId=524807) - **Note**   Conditional access control is an Azure AD Premium feature that's also available with EMS. If you don't have an Azure AD Premium subscription, you can get a trial from the [Microsoft Azure](http://go.microsoft.com/fwlink/p/?LinkId=691617) site. -   - For on-premises applications there are two options to enable conditional access control based on a device's compliance state: - - For on-premises applications that are published through the Azure AD Application Proxy, you can configure conditional access control policies as you would for cloud applications. For more details, see the [Azure AD Conditional Access preview updated: Now supports On-Premises and Custom LOB apps](http://go.microsoft.com/fwlink/p/?LinkId=691618) blog post. - - Additionally, Azure AD Connect will sync device compliance information from Azure AD to on-premises AD. ADFS on Windows Server Technical Preview 2016 will support conditional access control based on a device's compliance state. IT pros will configure conditional access control policies in ADFS that use the device's compliance state reported by a compatible MDM solution to secure on-premises applications. - ![figure 13](images/hva-fig12-conditionalaccess12.png) - The following process describes how Azure AD conditional access works: - 1. User has already enrolled with MDM through Workplace Access/Azure AD join which registers device with Azure AD. - 2. When the device boots or resumes from hibernate, a task “Tpm-HASCertRetr” is triggered to request in background a health attestation blob. Device sends TPM boot measurements to the Health Attestation Service. - 3. Health Attestation Service validates device state and issues an encrypted blob to the device based on the health state with details on failed checks (if any). - 4. User logs on and the MDM agent contacts the Intune/MDM server. - 5. MDM server pushes down new policies if available and queries health blob state and other inventory state. - 6. Device sends a health attestation blob previously acquired and also the value of the other state inventory requested by the Intune/MDM server. - 7. Intune/MDM server sends the health attestation blob to Health Attestation Service to be validated. - 8. Health Attestation Service validates that the device which sent the health attestation blob is healthy, and returns this result to Intune/MDM server. - 9. Intune/MDM server evaluates compliance based on the compliance and the queried inventory/health attestation state from device. - 10. Intune/MDM server updates compliance state against device object in Azure AD. - 11. User opens app, attempts to access a corporate managed asset. - 12. Access gated by compliance claim in Azure AD. - 13. If the device is compliant and the user is authorized, an access token is generated. - 14. User can access the corporate managed asset. - For more information about Azure AD join, see the [Azure AD & Windows 10: Better Together for Work or School](http://go.microsoft.com/fwlink/p/?LinkId=691619) white paper. - Conditional access control is a topic that many organizations and IT pros may not know as well as they should. The different attributes that describe a user, a device, compliance, and context of access are very powerful when used with a conditional access engine. Conditional access control is an essential step that helps organizations secure their environment. - ## Takeaways and summary - - The following list contains high-level key take-aways to improve the security posture of any organization. However, the few take-aways presented in this section should not be interpreted as an exhaustive list of security best practices. - - **Understand that no solution is 100 percent secure** - If determined adversaries with malicious intent gain physical access to the device, they could eventually break through its security layers and control it. - - **Use health attestation with an MDM solution** - Devices that attempt to connect to high-value assets must have their health evaluated so that unhealthy and noncompliant devices can be detected, reported, and eventually blocked. - - **Use Credential Guard** - Credential Guard is a feature that greatly helps protect corporate domain credentials from pass-the-hash attacks. - - **Use Device Guard** - Device Guard is a real advance in security and an effective way to help protect against malware. The new Device Guard feature in Windows 10 blocks untrusted apps (apps not authorized by your organization). - - **Sign Device Guard policy** - Signed Device Guard policy helps protect against a user with administrator privileges trying to defeat the current policy. When a policy is signed, the only way to modify Device Guard subsequently is to provide a new version of the policy signed by the same signer or from a signer specify as part of the Device Guard policy. - - **Use virtualization-based security** - When you have Kernel Mode Code Integrity protected by virtualization-based security, the code integrity rules are still enforced even if a vulnerability allows unauthorized kernel mode memory access. Keep in mind that Device Guard devices that run Kernel Code Integrity with virtualization-based security must have compatible drivers. - - **Start to deploy Device Guard with Audit mode** - Deploy Device Guard policy to targeted computers and devices in Audit mode. Monitor the Code Integrity event log that indicates a program or a driver would have been blocked if Device Guard was configured in Enforcement mode. Adjust Device Guard rules until a high level of confidence has been reached. After the testing phase has been completed, Device Guard policy can be switched to Enforcement mode. - - **Build an isolated reference machine when deploying Device Guard** - Because the corporate network can contain malware, you should start to configure a reference environment that is isolated from your main corporate network. After that, you can create a code integrity policy that includes the trusted applications you want to run on your protected devices. - - **Use AppLocker when it makes sense** - Although AppLocker is not considered a new Device Guard feature, it complements Device Guard functionality for some scenarios like being able to deny a specific Universal Windows apps for a specific user or a group of users. - - **Lock down firmware and configuration** - After Windows 10 is installed, lock down firmware boot options access. This prevents a user with physical access from modifying UEFI settings, disabling Secure Boot, or booting other operating systems. Also, in order to protect against an administrator trying to disable Device Guard, add a rule in the current Device Guard policy that will deny and block execution of the **C:\\Windows\\System32\\SecConfig.efi** tool. - Health attestation is a key feature of Windows 10 that includes client and cloud components to control access to high-value assets based on a user and their device’s identity and compliance with corporate governance policy. Organizations can choose to detect and report unhealthy devices, or to configure health enforcement rules based on their needs. Health attestation provides an end-to-end security model and integration points, which vendors and software developers can use to build and integrate a customized solution. - ## Related topics - - [Protect derived domain credentials with Credential Guard](credential-guard.md) - [Device Guard deployment guide](device-guard-deployment-guide.md) - [Trusted Platform Module technology overview](http://go.microsoft.com/fwlink/p/?LinkId=733957) -   -   - - - - - diff --git a/windows/keep-secure/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md b/windows/keep-secure/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md index 5ed8ed7a78..a1a5ed3f34 100644 --- a/windows/keep-secure/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md +++ b/windows/keep-secure/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md @@ -2,191 +2,112 @@ title: Protecting cluster shared volumes and storage area networks with BitLocker (Windows 10) description: This topic for IT pros describes how to protect CSVs and SANs with BitLocker. ms.assetid: ecd25a10-42c7-4d31-8a7e-ea52c8ebc092 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Protecting cluster shared volumes and storage area networks with BitLocker - - **Applies to** - - Windows 10 - This topic for IT pros describes how to protect CSVs and SANs with BitLocker. - BitLocker can protect both physical disk resources and cluster shared volumes version 2.0 (CSV2.0). BitLocker on clustered volumes allows for an additional layer of protection for administrators wishing to protect sensitive, highly available data. By adding additional protectors to the clustered volume, administrators can also add an additional barrier of security to resources within an organization by allowing only certain user accounts access to unlock the BitLocker volume. - ## Configuring BitLocker on Cluster Shared Volumes - - ### Using BitLocker with Clustered Volumes - BitLocker on volumes within a cluster are managed based on how the cluster service "views" the volume to be protected. The volume can be a physical disk resource such as a logical unit number (LUN) on a storage area network (SAN) or network attached storage (NAS). - **Important**   SANs used with BitLocker must have obtained Windows Hardware Certification. For more info, see [Windows Hardware Lab Kit](https://msdn.microsoft.com/library/windows/hardware/dn930814.aspx). -   - Alternatively, the volume can be a cluster-shared volume, a shared namespace, within the cluster. Windows Server 2012 expanded the CSV architecture, now known as CSV2.0, to enable support for BitLocker. When using BitLocker with volumes designated for a cluster, the volume will need to turn on BitLocker before its addition to the storage pool within cluster or put the resource into maintenance mode before BitLocker operations will complete. - Windows PowerShell or the manage-bde command line interface is the preferred method to manage BitLocker on CSV2.0 volumes. This is recommended over the BitLocker Control Panel item because CSV2.0 volumes are mount points. Mount points are an NTFS object that is used to provide an entry point to other volumes. Mount points do not require the use of a drive letter. Volumes that lack drive letters do not appear in the BitLocker Control Panel item. Additionally, the new Active Directory-based protector option required for cluster disk resource or CSV2.0 resources is not available in the Control Panel item. - **Note**   Mount points can be used to support remote mount points on SMB based network shares. This type of share is not supported for BitLocker encryption. -   - For thinly provisioned storage, such as a Dynamic Virtual Hard Disk (VHD), BitLocker runs in Used Disk Space Only encryption mode. You cannot use the **manage-bde –WipeFreeSpace** command to transition the volume to full-volume encryption on these types of volumes. This occurs because Full Encryption requires an end marker for the volume and dynamically expanding VHDs do not have a static end of volume marker. - ### Active Directory-based protector - You can also use an Active Directory Domain Services (AD DS) protector for protecting clustered volumes held within your AD DS infrastructure. The **ADAccountOrGroup** protector is a domain security identifier (SID)-based protector that can be bound to a user account, machine account or group. When an unlock request is made for a protected volume, the BitLocker service interrupts the request and uses the BitLocker protect/unprotect APIs to unlock or deny the request. BitLocker will unlock protected volumes without user intervention by attempting protectors in the following order: - 1. Clear key - 2. Driver-based auto-unlock key - 3. ADAccountOrGroup protector - 1. Service context protector - 2. User protector - 4. Registry-based auto-unlock key - **Note**   A Windows Server 2012 or later domain controller is required for this feature to work properly. -   - ### Turning on BitLocker before adding disks to a cluster using Windows PowerShell - BitLocker encryption is available for disks before or after addition to a cluster storage pool. The advantage of encrypting volumes prior to adding them to a cluster is that the disk resource does not require suspending the resource to complete the operation. To turn on BitLocker for a disk before adding it to a cluster, do the following: - 1. Install the BitLocker Drive Encryption feature if it is not already installed. - 2. Ensure the disk is formatted NTFS and has a drive letter assigned to it. - 3. Enable BitLocker on the volume using your choice of protector. A password protector is used in the Windows PowerShell script example below. - ``` syntax Enable-BitLocker E: -PasswordProtector -Password $pw ``` - 4. Identify the name of the cluster with Windows PowerShell. - ``` syntax Get-Cluster ``` - 5. Add an **ADAccountOrGroup**protector to the volume using the cluster name using a command such as: - ``` syntax Add-BitLockerProtector E: -ADAccountOrGroupProtector -ADAccountOrGroup CLUSTER$ ``` - **Warning**   You must add an **ADAccountOrGroup** protector using the cluster CNO for a BitLocker enabled volume to either be shared in a Cluster Shared Volume or to failover properly in a traditional failover cluster. -   - 6. Repeat steps 1-6 for each disk in the cluster. - 7. Add the volume(s) to the cluster. - ### Turning on BitLocker for a clustered disk using Windows PowerShell - When the cluster service owns a disk resource already, it needs to be set into maintenance mode before BitLocker can be enabled. Use the following steps for turning BitLocker on for a clustered disk: - 1. Install the BitLocker Drive Encryption feature if it is not already installed. - 2. Check the status of the cluster disk using Windows PowerShell. - ``` syntax Get-ClusterResource "Cluster Disk 1" ``` - 3. Put the physical disk resource into maintenance mode using Windows PowerShell. - ``` syntax Get-ClusterResource "Cluster Disk 1" | Suspend-ClusterResource ``` - 4. Enable BitLocker on the volume using your choice of protector. A password protector is used in the example below. - ``` syntax Enable-BitLocker E: -PasswordProtector -Password $pw ``` - 5. Identify the name of the cluster with Windows PowerShell - ``` syntax Get-Cluster ``` - 6. Add an **ADAccountOrGroup** protector with the Cluster Name Object (CNO) to the volume using a command such as: - ``` syntax Add-BitLockerProtector E: -ADAccountOrGroupProtector -ADAccountOrGroup CLUSTER$ ``` - **Warning**   You must add an **ADAccountOrGroup** protector using the cluster CNO for a BitLocker enabled volume to either be shared in a Cluster Shared Volume or to failover properly in a traditional failover cluster. -   - 7. Repeat steps 1-6 for each disk in the cluster. - 8. Add the volume(s) to the cluster - ### Adding BitLocker encrypted volumes to a cluster using manage-bde - You can also use manage-bde to enable BitLocker on clustered volumes. The steps needed to add a physical disk resource or CSV2.0 volume to an existing cluster includes the following: - 1. Verify the BitLocker Drive Encryption feature is installed on the computer. - 2. Ensure new storage is formatted as NTFS. - 3. Encrypt the volume, add a recovery key and add the cluster administrator as a protector key using the manage-bde command line interface (see example): - - `Manage-bde -on -used -RP -sid domain\CNO$ -sync` - 1. BitLocker will check to see if the disk is already part of a cluster. If it is, administrators will encounter a hard block. Otherwise, the encryption will continue. - 2. Using the -sync parameter is optional. Using it ensures the command waits until the encryption for the volume is completed before releasing the volume for use in the cluster storage pool. - 4. Open the Failover Cluster Manager snap-in or cluster PowerShell cmdlets to enable the disk to be clustered - - Once the disk is clustered it can also be enabled for CSV. - 5. During the resource online operation, cluster will check to see if the disk is BitLocker encrypted. - 1. If the volume is not BitLocker enabled, traditional cluster online operations occur. - 2. If the volume is BitLocker enabled, the following check occurs: - - If volume is **locked**, BitLocker will impersonate the CNO and unlock the volume using the CNO protector. If this operation fails an event will be logged that the volume could not be unlocked and the online operation will fail. - 6. Once the disk is online in the storage pool, it can be added to a CSV by right clicking on the disk resource and choosing "**Add to cluster shared volumes**". - CSVs can include both encrypted and unencrypted volumes. To check the status of a particular volume for BitLocker encryption, administrators can utilize the manage-bde -status command with a path to the volume inside the CSV namespace as seen in the example command line below. - ``` syntax manage-bde -status "C:\ClusterStorage\volume1" ``` - ### Physical Disk Resources - Unlike CSV2.0 volumes, physical disk resources can only be accessed by one cluster node at a time. This means that operations such as encrypting, decrypting, locking or unlocking volumes require context to perform. For example, you cannot unlock or decrypt a physical disk resource if you are not administering the cluster node that owns the disk resource because the disk resource is not available. - ### Restrictions on BitLocker actions with cluster volumes - The following table contains information about both Physical Disk Resources (i.e. traditional failover cluster volumes) and Cluster Shared Volumes (CSV) and the actions that are allowed by BitLocker in each situation. - @@ -289,39 +210,19 @@ The following table contains information about both Physical Disk Resources (i.e
-   - **Note**   Although the manage-bde -pause command is Blocked in clusters, the cluster service will automatically resume a paused encryption or decryption from the MDS node -   - In the case where a physical disk resource experiences a failover event during conversion, the new owning node will detect the conversion is not complete and will complete the conversion process. - ### Other considerations when using BitLocker on CSV2.0 - Some other considerations to take into account for BitLocker on clustered storage include the following: - - BitLocker volumes have to be initialized and beginning encryption before they are available to add to a CSV2.0 volume. - - If an administrator needs to decrypt a CSV volume, remove the volume from the cluster or put into disk maintenance mode. You can add the CSV back to the cluster while waiting for decryption to complete. - - If an administrator needs to start encrypting a CSV volume, remove the volume from the cluster or put it in maintenance mode. - - If conversion is paused with encryption in progress and the CSV volume is offline from the cluster, the cluster thread (health check) will automatically resume conversion when the volume is online to the cluster. - - If conversion is paused with encryption in progress and a physical disk resource volume is offline from the cluster, the BitLocker driver will automatically resume conversion when the volume is online to the cluster. - - If conversion is paused with encryption in progress, while the CSV volume is in maintenance mode, the cluster thread (health check) will automatically resume conversion when moving the volume back from maintenance. - - If conversion is paused with encryption in progress, while the disk resource volume is in maintenance mode, the BitLocker driver will automatically resume conversion when the volume is moved back from maintenance mode. -   -   - - - - - diff --git a/windows/keep-secure/recovery-console-allow-automatic-administrative-logon.md b/windows/keep-secure/recovery-console-allow-automatic-administrative-logon.md index c67329f99a..e1f339479c 100644 --- a/windows/keep-secure/recovery-console-allow-automatic-administrative-logon.md +++ b/windows/keep-secure/recovery-console-allow-automatic-administrative-logon.md @@ -2,54 +2,32 @@ title: Recovery console Allow automatic administrative logon (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Recovery console Allow automatic administrative logon security policy setting. ms.assetid: be2498fc-48f4-43f3-ad09-74664e45e596 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Recovery console: Allow automatic administrative logon - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **Recovery console: Allow automatic administrative logon** security policy setting. - ## Reference - - This policy setting determines whether the built-in Administrator account password must be provided before access to the device is granted. If you enable this setting, the built-in Administrator account is automatically logged on to the computer at the Recovery Console; no password is required. - The Recovery Console can be very useful when troubleshooting and repairing systems that cannot be restarted. However, enabling this policy setting so a user can automatically log on to the console is dangerous. Anyone can walk up to the server, shut it down by disconnecting the power, reboot it, select **Recovery Console** from the **Restart** menu, and then assume full control of the server. - ### Possible values - - Enabled - The built-in Administrator account is automatically logged on to the computer at the Recovery Console; no password is required - - Disabled - Automatic administrative logon is not allowed. - - Not defined - Automatic administrative logon is not allowed. - ### Best practices - - Set **Recovery Console: Allow automatic administrative logon** to **Disabled**. This requires a user to enter a user name and password to access the Recovery Console account. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -88,53 +66,24 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ### Group Policy - Setting and deploying this policy using Group Policy takes precedence over the setting on the local device - ### Policy conflicts - None. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - The Recovery Console can be very useful when you must troubleshoot and repair device that do not start. However, allowing automatic logon to the Recovery Console can make it possible for someone to assume full control of the server. - ### Countermeasure - Disable the **Recovery console: Allow automatic administrative logon** setting. - ### Potential impact - Users must enter a user name and password to access the Recovery Console. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md b/windows/keep-secure/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md index f881d30d6d..113bafb66c 100644 --- a/windows/keep-secure/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md +++ b/windows/keep-secure/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md @@ -2,56 +2,33 @@ title: Recovery console Allow floppy copy and access to all drives and folders (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Recovery console Allow floppy copy and access to all drives and folders security policy setting. ms.assetid: a5b4ac0c-f33d-42b5-a866-72afa7cbd0bd +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Recovery console: Allow floppy copy and access to all drives and folders - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **Recovery console: Allow floppy copy and access to all drives and folders** security policy setting. - ## Reference - - This policy setting enables or disables the Recovery Console SET command, which allows you to set the following Recovery Console environment variables. - - **AllowWildCards**. Enables wildcard support for some commands, such as the DEL command. - - **AllowAllPaths**. Allows access to all files and folders on the device. - - **AllowRemovableMedia**. Allows files to be copied to removable media, such as a floppy disk. - - **NoCopyPrompt**. Suppresses the prompt that typically displays before an existing file is overwritten. - You might forget to remove removable media, such as CD or floppy disk, with sensitive data or applications that a malicious user could then steal. Or you could accidentally leave a startup disk in the computer after using the Recovery Console. If the device is restarted for any reason and the BIOS has been configured to boot from the removable media before the hard disk drive, the server will start from the removable disk. This causes the server's network services to be unavailable. - ### Possible values - - Enabled - - Disabled - - Not defined - ### Best practices - - Set **Recovery Console: Allow floppy copy and access to drives and folders** to **Disabled**. Users who have started a server by using the Recovery Console and logged in with the built-in Administrator account will not be able to copy files and folders to a floppy disk. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -90,65 +67,30 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ### Group Policy - Setting and deploying this policy using Group Policy takes precedence over the setting on the local device. - ### Policy conflicts - None. - ### Command-line tools - Enabling this security option makes the Recovery Console SET command available, which allows you to set the following Recovery Console environment variables: - - AllowWildCards: Enable wildcard support for some commands (such as the DEL command). - - AllowAllPaths: Allow access to all files and folders on the device. - - AllowRemovableMedia: Allow files to be copied to removable media, such as a floppy disk. - - NoCopyPrompt: Do not prompt when overwriting an existing file. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - An attacker who can cause the system to restart into the Recovery Console could steal sensitive data and leave no audit or access trail. - ### Countermeasure - Disable the **Recovery console: Allow floppy copy and access to drives and folders** setting. - ### Potential impact - Users who have started a server through the Recovery Console and logged in with the built-in Administrator account cannot copy files and folders to a floppy disk. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/refresh-an-applocker-policy.md b/windows/keep-secure/refresh-an-applocker-policy.md index f134252dff..b94e1582a1 100644 --- a/windows/keep-secure/refresh-an-applocker-policy.md +++ b/windows/keep-secure/refresh-an-applocker-policy.md @@ -2,73 +2,39 @@ title: Refresh an AppLocker policy (Windows 10) description: This topic for IT professionals describes the steps to force an update for an AppLocker policy. ms.assetid: 3f24fcbc-3926-46b9-a1a2-dd036edab8a9 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Refresh an AppLocker policy - - **Applies to** - - Windows 10 - This topic for IT professionals describes the steps to force an update for an AppLocker policy. - If you update the rule collection on a local computer by using the Local Security Policy snap-in, the policy will take effect immediately. If Group Policy is used to distribute the AppLocker policy and you want to immediately implement the policy, you must manually refresh the policy. The Group Policy refresh might take several minutes, depending upon the number of policies within the Group Policy Object (GPO) and the number of target computers. - To use Group Policy to distribute the AppLocker policy change, you need to retrieve the deployed AppLocker policy first. To prepare for the update and subsequent refresh, see [Edit an AppLocker policy](edit-an-applocker-policy.md) - [Edit an AppLocker policy](edit-an-applocker-policy.md) and [Use the AppLocker Windows PowerShell cmdlets](use-the-applocker-windows-powershell-cmdlets.md). - To complete this procedure, you must have Edit Setting permission to edit a GPO. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. - **To manually refresh the AppLocker policy by using Group Policy** - 1. From a command prompt, type **gpupdate /force**, and then press ENTER. - 2. When the command finishes, close the command prompt window, and then verify that the intended rule behavior is correct. You can do this by checking the AppLocker event logs for events that include "policy applied." - To change a policy on an individual computer, or to implement that policy on other computers, without using Group Policy, you first need to update the rule within the rule collection. For information about updating existing rules, see [Edit AppLocker rules](edit-applocker-rules.md). For information about creating a new rule for an existing policy, see: - - [Create a rule that uses a publisher condition](create-a-rule-that-uses-a-publisher-condition.md) - - [Create a rule that uses a file hash condition](create-a-rule-that-uses-a-file-hash-condition.md) - - [Create a rule that uses a path condition](create-a-rule-that-uses-a-path-condition.md) - Membership in the local **Administrators** group, or equivalent, is the minimum required to complete this procedure. - **To refresh the AppLocker policy on the local computer** - - Update the rule collection by using the Local Security Policy console with one of the following procedures: - - [Edit AppLocker rules](edit-applocker-rules.md) - - [Delete an AppLocker rule](delete-an-applocker-rule.md) - - [Add exceptions for an AppLocker rule](configure-exceptions-for-an-applocker-rule.md) - When finished, the policy is in effect. - To make the same change on another device, you can use any of the following methods: - - From the device that you made the change on, export the AppLocker policy, and then import the policy onto the other device. To do this, use the AppLocker **Export Policy** and **Import Policy** features to copy the rules from the changed computer. - **Caution**   When importing rules from another computer, all the rules will be applied, not just the one that was updated. Merging policies allows both existing and updated (or new) rules to be applied. -   - - Merge AppLocker policies. For procedures to do this, see [Merge AppLocker policies manually](merge-applocker-policies-manually.md) and [Merge AppLocker policies by using Set-ApplockerPolicy](merge-applocker-policies-by-using-set-applockerpolicy.md). -   -   - - - - - diff --git a/windows/keep-secure/registry-global-object-access-auditing.md b/windows/keep-secure/registry-global-object-access-auditing.md index f544039c14..cf9eaa2938 100644 --- a/windows/keep-secure/registry-global-object-access-auditing.md +++ b/windows/keep-secure/registry-global-object-access-auditing.md @@ -2,35 +2,19 @@ title: Registry (Global Object Access Auditing) (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Registry (Global Object Access Auditing), which enables you to configure a global system access control list (SACL) on the registry of a computer. ms.assetid: 953bb1c1-3f76-43be-ba17-4aed2304f578 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Registry (Global Object Access Auditing) - - **Applies to** - - Windows 10 - This topic for the IT professional describes the Advanced Security Audit policy setting, **Registry (Global Object Access Auditing)**, which enables you to configure a global system access control list (SACL) on the registry of a computer. - If you select the **Configure security** check box on this policy’s property page, you can add a user or group to the global SACL. This enables you to define computer system access control lists (SACLs) per object type for the registry. The specified SACL is then automatically applied to every registry object type. - This policy setting must be used in combination with the **Registry** security policy setting under Object Access. For more info, see [Audit Registry](audit-registry.md). - ## Related topics - - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/remove-computer-from-docking-station.md b/windows/keep-secure/remove-computer-from-docking-station.md index 10454b9cdd..fa16818895 100644 --- a/windows/keep-secure/remove-computer-from-docking-station.md +++ b/windows/keep-secure/remove-computer-from-docking-station.md @@ -2,50 +2,30 @@ title: Remove computer from docking station (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Remove computer from docking station security policy setting. ms.assetid: 229a385a-a862-4973-899a-413b1b5b6c30 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Remove computer from docking station - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Remove computer from docking station** security policy setting. - ## Reference - - This security setting determines whether a user can undock a portable device from its docking station without logging on. This policy setting only affects scenarios that involve a portable computer and its docking station. - If this user right is assigned to the user’s account (or if the user is a member of the assigned group), the user must log on before removing the portable device from its docking station. Otherwise, as a security measure, the user will not be able to log on after the device is removed from the docking station. If this policy is not assigned, the user may remove the portable device from its docking station without logging on, and then have the ability to start and log on to the device afterwards in its undocked state. - Constant: SeUndockPrivilege - ### Possible values - - User-defined list of accounts - - Not Defined - ### Best practices - - Assign this user right to only those accounts that are permitted to use the portable device. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - Although this portable device scenario does not normally apply to servers, by default this setting is Administrators on domain controllers and on stand-alone servers. - The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - @@ -84,67 +64,31 @@ The following table lists the actual and effective default policy values. Defaul
-   - ## Policy management - - This section describes features, tools, and guidance to help you manage this policy. - A restart of the device is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - ### Group Policy - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Anyone who has the **Remove computer from docking station** user right can log on and then remove a portable device from its docking station. If this setting is not defined, it has the same effect as if everyone was granted this right. However, the value of implementing this countermeasure is reduced by the following factors: - - If attackers can restart the device, they could remove it from the docking station after the BIOS starts but before the operating system starts. - - This setting does not affect servers because they typically are not installed in docking stations. - - An attacker could steal the device and the docking station together. - - Devices that can be mechanically undocked can be physically removed by the user whether or not they use the Windows undocking functionality. - ### Countermeasure - Ensure that only the local Administrators group and the user account to which the device is allocated are assigned the **Remove computer from docking station** user right. - ### Potential impact - By default, only members of the local Administrators group are granted this right. Other user accounts must be explicitly granted this user right as necessary. If your organization's users are not members of the local Administrators groups on their portable devices, they cannot remove their portable devices from their docking stations if they do not first shut down the device. Therefore, you may want to assign the **Remove computer from docking station** privilege to the local Users group for portable devices. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/replace-a-process-level-token.md b/windows/keep-secure/replace-a-process-level-token.md index e3a17bfad2..237f74debf 100644 --- a/windows/keep-secure/replace-a-process-level-token.md +++ b/windows/keep-secure/replace-a-process-level-token.md @@ -2,54 +2,32 @@ title: Replace a process level token (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Replace a process level token security policy setting. ms.assetid: 5add02db-6339-489e-ba21-ccc3ccbe8745 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Replace a process level token - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Replace a process level token** security policy setting. - ## Reference - - This policy setting determines which parent processes can replace the access token that is associated with a child process. - Specifically, the **Replace a process level token** setting determines which user accounts can call the CreateProcessAsUser() application programming interface (API) so that one service can start another. An example of a process that uses this user right is Task Scheduler, where the user right is extended to any processes that can be managed by Task Scheduler. - An access token is an object that describes the security context of a process or thread. The information in a token includes the identity and privileges of the user account that is associated with the process or thread. With this user right, every child process that runs on behalf of this user account would have its access token replaced with the process level token. - Constant: SeAssignPrimaryTokenPrivilege - ### Possible values - - User-defined list of accounts - - Defaults - - Not defined - ### Best practices - - For member servers, ensure that only the Local Service and Network Service accounts have the **Replace a process level token** user right. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - By default this setting is Network Service and Local Service on domain controllers and on stand-alone servers. - The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - @@ -93,59 +71,27 @@ The following table lists the actual and effective default policy values for the
-   - ## Policy management - - This section describes features, tools, and guidance to help you manage this policy. - A restart of the device is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - ### Group Policy - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Users with the **Replace a process level token** user right can start processes as another user if they know the user’s credentials. - ### Countermeasure - For member servers, ensure that only the Local Service and Network Service accounts have the **Replace a process level token** user right. - ### Potential impact - On most computers, restricting the **Replace a process level token** user right to the Local Service and the Network Service built-in accounts is the default configuration, and there is no negative impact. However, if you have installed optional components such as ASP.NET or IIS, you may need to assign the **Replace a process level token** user right to additional accounts. For example, IIS requires that the Service, Network Service, and IWAM\_*<ComputerName>* accounts be explicitly granted this user right. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/requirements-for-deploying-applocker-policies.md b/windows/keep-secure/requirements-for-deploying-applocker-policies.md index c4f0103ef7..996718cd10 100644 --- a/windows/keep-secure/requirements-for-deploying-applocker-policies.md +++ b/windows/keep-secure/requirements-for-deploying-applocker-policies.md @@ -2,35 +2,23 @@ title: Requirements for deploying AppLocker policies (Windows 10) description: This deployment topic for the IT professional lists the requirements that you need to consider before you deploy AppLocker policies. ms.assetid: 3e55bda2-3cd7-42c7-bad3-c7dfbe193d48 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Requirements for deploying AppLocker policies - - **Applies to** - - Windows 10 - This deployment topic for the IT professional lists the requirements that you need to consider before you deploy AppLocker policies. - The following requirements must be met or addressed before you deploy your AppLocker policies: - - [Deployment plan](#bkmk-reqdepplan) - - [Supported operating systems](#bkmk-reqsupportedos) - - [Policy distribution mechanism](#bkmk-reqpolicydistmech) - - [Event collection and analysis system](#bkmk-reqeventcollectionsystem) - ### Deployment plan - An AppLocker policy deployment plan is the result of investigating which applications are required and necessary in your organization, which apps are optional, and which apps are forbidden. To develop this plan, see [AppLocker Design Guide](applocker-policies-design-guide.md). The following table is an example of the data you need to collect and the decisions you need to make to successfully deploy AppLocker policies on the supported operating systems (as listed in [Requirements to use AppLocker](requirements-to-use-applocker.md). - @@ -126,11 +114,8 @@ An AppLocker policy deployment plan is the result of investigating which applica
-   - **Event processing policy** - @@ -166,11 +151,8 @@ An AppLocker policy deployment plan is the result of investigating which applica
-   - **Policy maintenance policy** - @@ -210,38 +192,17 @@ An AppLocker policy deployment plan is the result of investigating which applica
-   - ### Supported operating systems - AppLocker is supported only on certain operating systems. Some features are not available on all operating systems. For more information, see [Requirements to use AppLocker](requirements-to-use-applocker.md). - ### Policy distribution mechanism - You need a way to distribute the AppLocker policies throughout the targeted business groups. AppLocker uses Group Policy management architecture to effectively distribute application control policies. AppLocker policies can also be configured on individual computers by using the Local Security Policy snap-in. - ### Event collection and analysis system - Event processing is important to understand application usage. You must have a process in place to collect and analyze AppLocker events so that application usage is appropriately restricted and understood. For procedures to monitor AppLocker events, see: - - [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md) - - [Configure an AppLocker policy for enforce rules](configure-an-applocker-policy-for-enforce-rules.md) - - [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md) - ## See also - - [AppLocker deployment guide](applocker-policies-deployment-guide.md) - -   -   - - - - - diff --git a/windows/keep-secure/requirements-to-use-applocker.md b/windows/keep-secure/requirements-to-use-applocker.md index 2921b46a0e..db3259ce0a 100644 --- a/windows/keep-secure/requirements-to-use-applocker.md +++ b/windows/keep-secure/requirements-to-use-applocker.md @@ -2,42 +2,26 @@ title: Requirements to use AppLocker (Windows 10) description: This topic for the IT professional lists software requirements to use AppLocker on the supported Windows operating systems. ms.assetid: dc380535-071e-4794-8f9d-e5d1858156f0 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Requirements to use AppLocker - - **Applies to** - - Windows 10 - This topic for the IT professional lists software requirements to use AppLocker on the supported Windows operating systems. - ## General requirements - - To use AppLocker, you need: - - A device running a supported operating system to create the rules. The computer can be a domain controller. - - For Group Policy deployment, at least one device with the Group Policy Management Console (GPMC) or Remote Server Administration Tools (RSAT) installed to host the AppLocker rules. - - Devices running a supported operating system to enforce the AppLocker rules that you create. - **Note**   You can use Software Restriction Policies with AppLocker, but with some limitations. For more info, see [Use AppLocker and Software Restriction Policies in the same domain](use-applocker-and-software-restriction-policies-in-the-same-domain.md). -   - ## Operating system requirements - - The following table show the on which operating systems AppLocker features are supported. - @@ -215,37 +199,14 @@ The following table show the on which operating systems AppLocker features are s
-   - AppLocker is not supported on versions of the Windows operating system not listed above. Software Restriction Policies can be used with those versions. However, the SRP Basic User feature is not supported on the above operating systems. - ## See also - - [Administer AppLocker](administer-applocker.md) - - [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md) - - [Optimize AppLocker performance](optimize-applocker-performance.md) - - [Use AppLocker and Software Restriction Policies in the same domain](use-applocker-and-software-restriction-policies-in-the-same-domain.md) - - [Manage packaged apps with AppLocker](manage-packaged-apps-with-applocker.md) - - [AppLocker Design Guide](applocker-policies-design-guide.md) - -   -   - - - - - diff --git a/windows/keep-secure/reset-account-lockout-counter-after.md b/windows/keep-secure/reset-account-lockout-counter-after.md index 4267057664..04fdcce682 100644 --- a/windows/keep-secure/reset-account-lockout-counter-after.md +++ b/windows/keep-secure/reset-account-lockout-counter-after.md @@ -2,46 +2,28 @@ title: Reset account lockout counter after (Windows 10) description: Describes the best practices, location, values, and security considerations for the Reset account lockout counter after security policy setting. ms.assetid: d5ccf6dd-5ba7-44a9-8e0b-c478d8b1442c +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Reset account lockout counter after - - **Applies to** - - Windows 10 - Describes the best practices, location, values, and security considerations for the **Reset account lockout counter after** security policy setting. - ## Reference - - The **Reset account lockout counter after** policy setting determines the number of minutes that must elapse from the time a user fails to log on before the failed logon attempt counter is reset to 0. If [Account lockout threshold](account-lockout-threshold.md) is set to a number greater than zero, this reset time must be less than or equal to the value of [Account lockout duration](account-lockout-duration.md). - A disadvantage to setting this too high is that users lock themselves out for an inconveniently long period if they exceed the account lockout threshold through logon errors. Users may make excessive Help Desk calls. - ### Possible values - - A user-defined number of minutes from 1 through 99,999 - - Not defined - ### Best practices - - You need to determine the threat level for your organization and balance that against the cost of your Help Desk support for password resets. Each organization will have specific requirements. - ### Location - **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Account Lockout Policy** - ### Default values - The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - @@ -80,36 +62,16 @@ The following table lists the actual and effective default policy values. Defaul
-   - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Users can accidentally lock themselves out of their accounts if they mistype their password multiple times. - ### Countermeasure - Configure the **Reset account lockout counter after** policy setting to 30. - ### Potential impact - If you do not configure this policy setting or if the value is configured to an interval that is too long, an attacker could attempt to log on to each user's account numerous times and lock out their accounts, a denial-of-service (DoS) attack might succeed, or administrators might have to manually unlock all locked-out accounts. If you configure this policy setting to a reasonable value, users can perform new attempts to log on after a failed logon within a reasonable time, without making brute force attacks feasible at high speeds. Be sure that you notify users of the values that are used for this policy setting so that they wait for the lockout timer to expire before they call the Help Desk. - ## Related topics - - [Account Lockout Policy](account-lockout-policy.md) -   -   - - - - - diff --git a/windows/keep-secure/restore-files-and-directories.md b/windows/keep-secure/restore-files-and-directories.md index e0941e62be..dc9f47c01a 100644 --- a/windows/keep-secure/restore-files-and-directories.md +++ b/windows/keep-secure/restore-files-and-directories.md @@ -2,56 +2,33 @@ title: Restore files and directories (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Restore files and directories security policy setting. ms.assetid: c673c0fa-6f49-4edd-8c1f-c5e8513f701d +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Restore files and directories - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Restore files and directories** security policy setting. - ## Reference - - This security setting determines which users can bypass file, directory, registry, and other persistent object permissions when they restore backed up files and directories, and it determines which users can set valid security principals as the owner of an object. - Granting this user right to an account is similar to granting the account the following permissions to all files and folders on the system: - - **Traverse folder / execute file** - - **Write** - Constant: SeRestorePrivilege - ### Possible values - - User-defined list of accounts - - Defaults - - Not Defined - ### Best practices - - Users with this user right can overwrite registry settings, hide data, and gain ownership of system objects, so only assign this user right to trusted users. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - By default, this right is granted to the Administrators, Backup Operators, and Server Operators groups on domain controllers, and to the Administrators and Backup Operators groups on stand-alone servers. - The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - @@ -97,64 +74,30 @@ The following table lists the actual and effective default policy values. Defaul
-   - ## Policy management - - This section describes features, tools, and guidance to help you manage this policy. - A restart of the computer is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - ### Group Policy - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - An attacker with the **Restore files and directories** user right could restore sensitive data to a computer and overwrite data that is more recent, which could lead to loss of important data, data corruption, or a denial-of-service condition. Attackers could overwrite executable files that are used by legitimate administrators or system services with versions that include malicious software to grant themselves elevated privileges, compromise data, or install programs that provide continued access to the device - **Note**   Even if the following countermeasure is configured, an attacker could restore data to a computer in a domain that is controlled by the attacker. Therefore, it is critical that organizations carefully protect the media that are used to back up data. -   - ### Countermeasure - Ensure that only the local Administrators group is assigned the **Restore files and directories** user right unless your organization has clearly defined roles for backup and for restore personnel. - ### Potential impact - If you remove the **Restore files and directories** user right from the Backup Operators group and other accounts, users who are not members of the local Administrators group cannot load data backups. If restoring backups is delegated to a subset of IT staff in your organization, you should verify that this change does not negatively affect the ability of your organization's personnel to do their jobs. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/run-the-automatically-generate-rules-wizard.md b/windows/keep-secure/run-the-automatically-generate-rules-wizard.md index 63611e7155..105d076374 100644 --- a/windows/keep-secure/run-the-automatically-generate-rules-wizard.md +++ b/windows/keep-secure/run-the-automatically-generate-rules-wizard.md @@ -2,64 +2,35 @@ title: Run the Automatically Generate Rules wizard (Windows 10) description: This topic for IT professionals describes steps to run the wizard to create AppLocker rules on a reference device. ms.assetid: 8cad1e14-d5b2-437c-8f88-70cffd7b3d8e +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Run the Automatically Generate Rules wizard - - **Applies to** - - Windows 10 - This topic for IT professionals describes steps to run the wizard to create AppLocker rules on a reference device. - AppLocker allows you to automatically generate rules for all files within a folder. It will scan the specified folder and create the condition types that you choose for each file in that folder. - You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local device or in a security template. For info how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). - **To automatically generate rules** - 1. Open the AppLocker console. - 2. Right-click the appropriate rule type for which you want to automatically generate rules. You can automatically generate rules for executable, Windows Installer, script and packaged app rules. - 3. Click **Automatically Generate Rules**. - 4. On the **Folder and Permissions** page, click **Browse** to choose the folder to be analyzed. By default, this is the Program Files folder. - 5. Click **Select** to choose the security group in which the default rules should be applied. By default, this is the **Everyone** group. - 6. The wizard provides a name in the **Name to identify this set of rules** box based on the name of the folder that you have selected. Accept the provided name or type a different name, and then click **Next**. - 7. On the **Rule Preferences** page, choose the conditions that you want the wizard to use while creating rules, and then click **Next**. For more info about rule conditions, see [Understanding AppLocker rule condition types](understanding-applocker-rule-condition-types.md). - **Note**   The **Reduce the number of rules created by grouping similar files** check box is selected by default. This helps you organize AppLocker rules and reduce the number of rules that you create by performing the following operations for the rule condition that you select: - - One publisher condition is created for all files that have the same publisher and product name. - - One path condition is created for the folder that you select. For example, if you select *C:\\Program Files\\ProgramName\\* and the files in that folder are not signed, the wizard creates a rule for *%programfiles%\\ProgramName\\\**. - - One file hash condition is created that contains all of the file hashes. When rule grouping is disabled, the wizard creates a file hash rule for each file. -   - 8. Review the files that were analyzed and the rules that will be automatically created. To make changes, click **Previous** to return to the page where you can change your selections. After reviewing the rules, click **Create**. - **Note**   If you are running the wizard to create your first rules for a GPO, you will be prompted to create the default rules, which allow critical system files to run, after completing the wizard. You may edit the default rules at any time. If your organization has decided to edit the default rules or create custom rules to allow the Windows system files to run, ensure that you delete the default rules after replacing them with your custom rules. -   -   -   - - - - - diff --git a/windows/keep-secure/script-rules-in-applocker.md b/windows/keep-secure/script-rules-in-applocker.md index d1c18e6cfb..5f1570086a 100644 --- a/windows/keep-secure/script-rules-in-applocker.md +++ b/windows/keep-secure/script-rules-in-applocker.md @@ -2,35 +2,23 @@ title: Script rules in AppLocker (Windows 10) description: This topic describes the file formats and available default rules for the script rule collection. ms.assetid: fee24ca4-935a-4c5e-8a92-8cf1d134d35f +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Script rules in AppLocker - - **Applies to** - - Windows 10 - This topic describes the file formats and available default rules for the script rule collection. - AppLocker defines script rules to include only the following file formats: - - .ps1 - - .bat - - .cmd - - .vbs - - .js - The following table lists the default rules that are available for the script rule collection. - @@ -67,19 +55,8 @@ The following table lists the default rules that are available for the script ru
-   - ## Related topics - - [Understanding AppLocker default rules](understanding-applocker-default-rules.md) -   -   - - - - - diff --git a/windows/keep-secure/secpol-advanced-security-audit-policy-settings.md b/windows/keep-secure/secpol-advanced-security-audit-policy-settings.md index 6cc38ffbeb..768c9de4a0 100644 --- a/windows/keep-secure/secpol-advanced-security-audit-policy-settings.md +++ b/windows/keep-secure/secpol-advanced-security-audit-policy-settings.md @@ -2,40 +2,22 @@ title: Advanced security audit policy settings (Windows 10) description: Provides information about the advanced security audit policy settings that are available in Windows and the audit events that they generate. ms.assetid: 6BF9A642-DBC3-4101-94A3-B2316C553CE3 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Advanced security audit policy settings - - **Applies to** - - Windows 10 - Provides information about the advanced security audit policy settings that are available in Windows and the audit events that they generate. - The security audit policy settings under **Security Settings\\Advanced Audit Policy Configuration** can help your organization audit compliance with important business-related and security-related rules by tracking precisely defined activities, such as: - - A group administrator has modified settings or data on servers that contain finance information. - - An employee within a defined group has accessed an important file. - - The correct system access control list (SACL) is applied to every file and folder or registry key on a computer or file share as a verifiable safeguard against undetected access. - You can access these audit policy settings through the Local Security Policy snap-in (secpol.msc) on the local device or by using Group Policy. - These Advanced Audit policy settings allow you to select only the behaviors that you want to monitor. You can exclude audit results for behaviors that are of little or no concern to you, or behaviors that create an excessive number of log entries. In addition, because security audit policies can be applied by using domain Group Policy Objects, audit policy settings can be modified, tested, and deployed to selected users and groups with relative simplicity. - For more info, see [Advanced security audit policies](advanced-security-auditing.md). -   -   - - - - - diff --git a/windows/keep-secure/security-auditing-overview.md b/windows/keep-secure/security-auditing-overview.md index bc9ff675c5..ee62474c85 100644 --- a/windows/keep-secure/security-auditing-overview.md +++ b/windows/keep-secure/security-auditing-overview.md @@ -2,31 +2,20 @@ title: Security auditing (Windows 10) description: Topics in this section are for IT professionals and describes the security auditing features in Windows and how your organization can benefit from using these technologies to enhance the security and manageability of your network. ms.assetid: 2d9b8142-49bd-4a33-b246-3f0c2a5f32d4 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Security auditing - - **Applies to** - - Windows 10 - Topics in this section are for IT professionals and describes the security auditing features in Windows and how your organization can benefit from using these technologies to enhance the security and manageability of your network. - ## - - Security auditing is one of the most powerful tools that you can use to maintain the integrity of your system. As part of your overall security strategy, you should determine the level of auditing that is appropriate for your environment. Auditing should identify attacks (successful or not) that pose a threat to your network, and attacks against resources that you have determined to be valuable in your risk assessment. - For info on the changes that were added in Windows 10, see [Security auditing](../whats-new/security-auditing.md). - ## In this section - - @@ -49,14 +38,6 @@ For info on the changes that were added in Windows 10, see [Security auditing](
-   -   -   - - - - - diff --git a/windows/keep-secure/security-considerations-for-applocker.md b/windows/keep-secure/security-considerations-for-applocker.md index 0fddbefbdc..023305b4f1 100644 --- a/windows/keep-secure/security-considerations-for-applocker.md +++ b/windows/keep-secure/security-considerations-for-applocker.md @@ -2,61 +2,33 @@ title: Security considerations for AppLocker (Windows 10) description: This topic for the IT professional describes the security considerations you need to address when implementing AppLocker. ms.assetid: 354a5abb-7b31-4bea-a442-aa9666117625 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Security considerations for AppLocker - - **Applies to** - - Windows 10 - This topic for the IT professional describes the security considerations you need to address when implementing AppLocker. - The purpose of AppLocker is to restrict the access to software, and therefore, the data accessed by the software, to a specific group of users or within a defined business group. The following are security considerations for AppLocker: - AppLocker is deployed within an enterprise and administered centrally by those in IT with trusted credentials. This makes its policy creation and deployment conform to similar policy deployment processes and security restrictions. - AppLocker policies are distributed through known processes and by known means within the domain through Group Policy. But AppLocker policies can also be set on individual computers if the person has administrator privileges, and those policies might be contrary to the organization's written security policy. The enforcement settings for local policies are overridden by the same AppLocker policies in a Group Policy Object (GPO). However, because AppLocker rules are additive, a local policy that is not in a GPO will still be evaluated for that computer. - Microsoft does not provide a way to develop any extensions to AppLocker. The interfaces are not public. A user with administrator credentials can automate some AppLocker processes by using Windows PowerShell cmdlets. For info about the Windows PowerShell cmdlets for AppLocker, see the [AppLocker Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/ee460962.aspx). - AppLocker runs in the context of Administrator or LocalSystem, which is the highest privilege set. This security context has the potential of misuse. If a user with administrative credentials makes changes to an AppLocker policy on a local device that is joined to a domain, those changes could be overwritten or disallowed by the GPO that contains the AppLocker rule for the same file (or path) that was changed on the local device. However, because AppLocker rules are additive, a local policy that is not in a GPO will still be evaluated for that computer. If the local computer is not joined to a domain and is not administered by Group Policy, a person with administrative credentials can alter the AppLocker policy. - When securing files in a directory with a rule of the path condition type, whether using the allow or deny action on the rule, it is still necessary and good practice to restrict access to those files by setting the access control lists (ACLs) according to your security policy. - AppLocker does not protect against running 16-bit DOS binaries in the Virtual DOS Machine (NTVDM). This technology allows running legacy DOS and 16-bit Windows programs on computers that are using Intel 80386 or later when there is already another operating system running and controlling the hardware. The result is that 16-bit binaries can still run on Windows Server 2008 R2 and Windows 7 when AppLocker is configured to otherwise block binaries and libraries. If it is a requirement to prevent 16-bit applications from running, you must configure the Deny rule in the executable rule collection for NTVDM.exe. - You cannot use AppLocker (or Software Restriction Policies) to prevent code from running outside the Win32 subsystem. In particular, this applies to the (POSIX) subsystem in Windows NT. If it is a requirement to prevent applications from running in the POSIX subsystem, you must disable the subsystem. - AppLocker can only control VBScript, JScript, .bat files, .cmd files, and Windows PowerShell scripts. It does not control all interpreted code that runs within a host process, for example, Perl scripts and macros. Interpreted code is a form of executable code that runs within a host process. For example, Windows batch files (\*.bat) run within the context of the Windows Command Host (cmd.exe). To control interpreted code by using AppLocker, the host process must call AppLocker before it runs the interpreted code, and then enforce the decision returned by AppLocker. Not all host processes call into AppLocker and, therefore, AppLocker cannot control every kind of interpreted code, such as Microsoft Office macros. - **Important**   You should configure the appropriate security settings of these host processes if you must allow them to run. For example, configure the security settings in Microsoft Office to ensure that only signed and trusted macros are loaded. -   - AppLocker rules either allow or prevent an application from launching. AppLocker does not control the behavior of applications after they are launched. Applications could contain flags passed to functions that signal AppLocker to circumvent the rules and allow another .exe or .dll to be loaded. In practice, an application that is allowed by AppLocker could use these flags to bypass AppLocker rules and launch child processes. You must thoroughly examine each application before allowing them to run by using AppLocker rules. - **Note**   Two flags that illustrate this condition are `SANDBOX_INERT`, which can be passed to `CreateRestrictedToken`, and `LOAD_IGNORE_CODE_AUTHZ_LEVEL`, which can be passed to `LoadLibraryEx`. Both of these flags signal AppLocker to circumvent the rules and allow a child .exe or .dll to be loaded. -   - ## Related topics - - [AppLocker technical reference](applocker-technical-reference.md) -   -   - - - - - diff --git a/windows/keep-secure/security-options.md b/windows/keep-secure/security-options.md index b6d6747c20..1e083a249a 100644 --- a/windows/keep-secure/security-options.md +++ b/windows/keep-secure/security-options.md @@ -2,30 +2,20 @@ title: Security Options (Windows 10) description: Provides an introduction to the settings under Security Options of the local security policies and links to information about each setting. ms.assetid: 405ea253-8116-4e57-b08e-14a8dcdca92b +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Security Options - - **Applies to** - - Windows 10 - Provides an introduction to the settings under **Security Options** of the local security policies and links to information about each setting. - The **Security Options** contain the following groupings of security policy settings that allow you to configure the behavior of the local computer. Some of these policies can be included in a Group Policy Object and distributed over your organization. - If you edit policy settings locally on a device, you will affect the settings on only that one device. If you configure the settings in a Group Policy Object (GPO), the settings apply to all devices that are subject to that GPO. - For info about setting security policies, see [Configure security policy settings](how-to-configure-security-policy-settings.md). - ## In this section - - @@ -420,21 +410,9 @@ For info about setting security policies, see [Configure security policy setting
-   - ## Related topics - - [Security policy settings reference](security-policy-settings-reference.md) - [Security policy settings](security-policy-settings.md) -   -   - - - - - diff --git a/windows/keep-secure/security-policy-settings-reference.md b/windows/keep-secure/security-policy-settings-reference.md index 62c40372cc..83e2f87051 100644 --- a/windows/keep-secure/security-policy-settings-reference.md +++ b/windows/keep-secure/security-policy-settings-reference.md @@ -2,28 +2,19 @@ title: Security policy settings reference (Windows 10) description: This reference of security settings provides information about how to implement and manage security policies, including setting options and security considerations. ms.assetid: ef5a4579-15a8-4507-9a43-b7ccddcb0ed1 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Security policy settings reference - - **Applies to** - - Windows 10 - This reference of security settings provides information about how to implement and manage security policies, including setting options and security considerations. - This reference focuses on those settings that are considered security settings. This reference examines only the settings and features in the Windows operating systems that can help organizations secure their enterprises against malicious software threats. Management features and those security features that you cannot configure are not described in this reference. - Each policy setting described contains referential content such as a detailed explanation of the settings, best practices, default settings, differences between operating system versions, policy management considerations, and security considerations that include a discussion of vulnerability, countermeasures, and potential impact of those countermeasures. - ## In this section - - @@ -58,14 +49,6 @@ Each policy setting described contains referential content such as a detailed ex
-   -   -   - - - - - diff --git a/windows/keep-secure/security-policy-settings.md b/windows/keep-secure/security-policy-settings.md index 67592a65d4..fb4adf5d9d 100644 --- a/windows/keep-secure/security-policy-settings.md +++ b/windows/keep-secure/security-policy-settings.md @@ -2,454 +2,232 @@ title: Security policy settings (Windows 10) description: This reference topic describes the common scenarios, architecture, and processes for security settings. ms.assetid: e7ac5204-7f6c-4708-a9f6-6af712ca43b9 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Security policy settings - - **Applies to** - - Windows 10 - This reference topic describes the common scenarios, architecture, and processes for security settings. - Security policy settings are rules that administrators configure on a computer or multiple devices for the purpose of protecting resources on a device or network. The Security Settings extension of the Local Group Policy Editor snap-in allows you to define security configurations as part of a Group Policy Object (GPO). The GPOs are linked to Active Directory containers such as sites, domains, or organizational units, and they enable you to manage security settings for multiple devices from any device joined to the domain. Security settings policies are used as part of your overall security implementation to help secure domain controllers, servers, clients, and other resources in your organization. - Security settings can control: - - User authentication to a network or device. - - The resources that users are permitted to access. - - Whether to record a user’s or group’s actions in the event log. - - Membership in a group. - To manage security configurations for multiple devices, you can use one of the following options: - - Edit specific security settings in a GPO. - - Use the Security Templates snap-in to create a security template that contains the security policies you want to apply, and then import the security template into a Group Policy Object. A security template is a file that represents a security configuration, and it can be imported to a GPO, applied to a local device, or used to analyze security. - For more info about managing security configurations, see [Administer security policy settings](administer-security-policy-settings.md). - The Security Settings extension of the Local Group Policy Editor includes the following types of security policies: - - **Account Policies.** These polices are defined on devices; they affect how user accounts can interact with the computer or domain. Account policies include the following types of policies: - - **Password Policy.** These policies determine settings for passwords, such as enforcement and lifetimes. Password policies are used for domain accounts. - - **Account Lockout Policy.** These policies determine the conditions and length of time that an account will be locked out of the system. Account lockout policies are used for domain or local user accounts. - - **Kerberos Policy.** These policies are used for domain user accounts; they determine Kerberos-related settings, such as ticket lifetimes and enforcement. - - **Local Policies.** These policies apply to a computer and include the following types of policy settings: - - **Audit Policy.** Specify security settings that control the logging of security events into the Security log on the computer, and specifies what types of security events to log (success, failure, or both). - **Note**   For devices running Windows 7 and later, we recommend to use the settings under Advanced Audit Policy Configuration rather than the Audit Policy settings under Local Policies. -   - - **User Rights Assignment.** Specify the users or groups that have logon rights or privileges on a device - - **Security Options.** Specify security settings for the computer, such as Administrator and Guest Account names; access to floppy disk drives and CD-ROM drives; installation of drivers; logon prompts; and so on. - - **Windows Firewall with Advanced Security.** Specify settings to protect the device on your network by using a stateful firewall that allows you to determine which network traffic is permitted to pass between your device and the network. - - **Network List Manager Policies.** Specify settings that you can use to configure different aspects of how networks are listed and displayed on one device or on many devices. - - **Public Key Policies.** Specify settings to control Encrypting File System, Data Protection, and BitLocker Drive Encryption in addition to certain certificate paths and services settings. - - **Software Restriction Policies.** Specify settings to identify software and to control its ability to run on your local device, organizational unit, domain, or site. - - **Application Control Policies.** Specify settings to control which users or groups can run particular applications in your organization based on unique identities of files. - - **IP Security Policies on Local Computer.** Specify settings to ensure private, secure communications over IP networks through the use of cryptographic security services. IPsec establishes trust and security from a source IP address to a destination IP address. - - **Advanced Audit Policy Configuration.** Specify settings that control the logging of security events into the security log on the device. The settings under Advanced Audit Policy Configuration provide finer control over which activities to monitor as opposed to the Audit Policy settings under Local Policies. - ## Policy-based security settings management - - The Security Settings extension to Group Policy provides an integrated policy-based management infrastructure to help you manage and enforce your security policies. - You can define and apply security settings policies to users, groups, and network servers and clients through Group Policy and Active Directory Domain Services (AD DS). A group of servers with the same functionality can be created (for example, a Microsoft Web (IIS) server), and then Group Policy Objects can be used to apply common security settings to the group. If more servers are added to this group later, many of the common security settings are automatically applied, reducing deployment and administrative labor. - ### Common scenarios for using security settings policies - Security settings policies are used to manage the following aspects of security: accounts policy, local policy, user rights assignment, registry values, file and registry Access Control Lists (ACLs), service startup modes, and more. - As part of your security strategy, you can create GPOs with security settings policies configured specifically for the various roles in your organization, such as domain controllers, file servers, member servers, clients, and so on. - You can create an organizational unit (OU) structure that groups devices according to their roles. Using OUs is the best method for separating specific security requirements for the different roles in your network. This approach also allows you to apply customized security templates to each class of server or computer. After creating the security templates, you create a new GPO for each of the OUs, and then import the security template (.inf file) into the new GPO. - Importing a security template to a GPO ensures that any accounts to which the GPO is applied automatically receive the template’s security settings when the Group Policy settings are refreshed. On a workstation or server, the security settings are refreshed at regular intervals (with a random offset of at most 30 minutes), and, on a domain controller, this process occurs every few minutes if changes have occurred in any of the GPO settings that apply. The settings are also refreshed every 16 hours, whether or not any changes have occurred. - **Note**   These refresh settings vary between versions of the operating system and can be configured. -   - By using Group Policy−based security configurations in conjunction with the delegation of administration, you can ensure that specific security settings, rights, and behavior are applied to all servers and computers within an OU. This approach makes it simple to update a number of servers with any additional changes required in the future. - ### Dependencies on other operating system technologies - For devices that are members of a Windows Server 2008 or later domain, security settings policies depend on the following technologies: - - **Active Directory Domain Services (AD DS)** - The Windows-based directory service, AD DS, stores information about objects on a network and makes this information available to administrators and users. By using AD DS, you can view and manage network objects on the network from a single location, and users can access permitted network resources by using a single logon. - - **Group Policy** - The infrastructure within AD DS that enables directory-based configuration management of user and computer settings on devices running Windows Server. By using Group Policy, you can define configurations for groups of users and computers, including policy settings, registry-based policies, software installation, scripts, folder redirection, Remote Installation Services, Internet Explorer maintenance, and security. - - **Domain Name System (DNS)** - A hierarchical naming system used for locating domain names on the Internet and on private TCP/IP networks. DNS provides a service for mapping DNS domain names to IP addresses, and IP addresses to domain names. This allows users, computers, and applications to query DNS to specify remote systems by fully qualified domain names rather than by IP addresses. - - **Winlogon** - A part of the Windows operating system that provides interactive logon support. Winlogon is designed around an interactive logon model that consists of three components: the Winlogon executable, a credential provider, and any number of network providers. - - **Setup** - Security configuration interacts with the operating system setup process during a clean installation or upgrade from earlier versions of Windows Server. - - **Security Accounts Manager (SAM)** - A Windows service used during the logon process. SAM maintains user account information, including groups to which a user belongs. - - **Local Security Authority (LSA)** - A protected subsystem that authenticates and logs users onto the local system. LSA also maintains information about all aspects of local security on a system, collectively known as the Local Security Policy of the system. - - **Windows Management Instrumentation (WMI)** - A feature of the Microsoft Windows operating system, WMI is the Microsoft implementation of Web-Based Enterprise Management (WBEM), which is an industry initiative to develop a standard technology for accessing management information in an enterprise environment. WMI provides access to information about objects in a managed environment. Through WMI and the WMI application programming interface (API), applications can query for and make changes to static information in the Common Information Model (CIM) repository and dynamic information maintained by the various types of providers. - - **Resultant Set of Policy (RSoP)** - An enhanced Group Policy infrastructure that uses WMI in order to make it easier to plan and debug policy settings. RSoP provides public methods that expose what an extension to Group Policy would do in a what-if situation, and what the extension has done in an actual situation. This allows administrators to easily determine the combination of policy settings that apply to, or will apply to, a user or device. - - **Service Control Manager (SCM)** - Used for configuration of service startup modes and security. - - **Registry** - Used for configuration of registry values and security. - - **File system** - Used for configuration of security. - - **File system conversions** - Security is set when an administrator converts a file system from FAT to NTFS. - - **Microsoft Management Console (MMC)** - The user interface for the Security Settings tool is an extension of the Local Group Policy Editor MMC snap-in. - ### Security settings policies and Group Policy - The Security Settings extension of the Local Group Policy Editor is part of the Security Configuration Manager tool set. The following components are associated with Security Settings: a configuration engine; an analysis engine; a template and database interface layer; setup integration logic; and the secedit.exe command-line tool. The security configuration engine is responsible for handling security configuration editor-related security requests for the system on which it runs. The analysis engine analyzes system security for a given configuration and saves the result. The template and database interface layer handles reading and writing requests from and to the template or database (for internal storage). The Security Settings extension of the Local Group Policy Editor handles Group Policy from a domain-based or local device. The security configuration logic integrates with setup and manages system security for a clean installation or upgrade to a more recent Windows operating system. Security information is stored in templates (.inf files) or in the Secedit.sdb database. - The following diagram shows Security Settings and related features. - **Security Settings Policies and Related Features** - ![components related to security policies](images/secpol-components.gif) - - **Scesrv.dll** - Provides the core security engine functionality. - - **Scecli.dll** - Provides the client-side interfaces to the security configuration engine and provides data to Resultant Set of Policy (RSoP). - - **Wsecedit.dll** - The Security Settings extension of Local Group Policy Editor. scecli.dll is loaded into wsecedit.dll to support the Security Settings user interface. - - **Gpedit.dll** - The Local Group Policy Editor MMC snap-in. - ## Security Settings extension architecture - - The Security Settings extension of the Local Group Policy Editor is part of the Security Configuration Manager tools, as shown in the following diagram. - **Security Settings Architecture** - ![architecture of security policy settings](images/secpol-architecture.gif) - The security settings configuration and analysis tools include a security configuration engine, which provides local computer (non-domain member) and Group Policy−based configuration and analysis of security settings policies. The security configuration engine also supports the creation of security policy files. The primary features of the security configuration engine are scecli.dll and scesrv.dll. - The following list describes these primary features of the security configuration engine and other Security Settings−related features. - - **scesrv.dll** - This .dll is hosted in services.exe and runs under local system context. scesrv.dll provides core Security Configuration Manager functionality, such as import, configure, analyze, and policy propagation. - Scesrv.dll performs configuration and analysis of various security-related system parameters by calling corresponding system APIs, including LSA, SAM, and the registry. - Scesrv.dll exposes APIs such as import, export, configure, and analyze. It checks that the request is made over LRPC (Windows XP) and fails the call if it is not. - Communication between parts of the Security Settings extension occurs by using the following methods: - - Component Object Model (COM) calls - - Local Remote Procedure Call (LRPC) - - Lightweight Directory Access Protocol (LDAP) - - Active Directory Service Interfaces (ADSI) - - Server Message Block (SMB) - - Win32 APIs - - Windows Management Instrumentation (WMI) calls - On domain controllers, scesrv.dll receives notifications of changes made to SAM and the LSA that need to be synchronized across domain controllers. Scesrv.dll incorporates those changes into the Default Domain Controller Policy GPO by using in-process scecli.dll template modification APIs. - Scesrv.dll also performs configuration and analysis operations. - - **Scecli.dll** - This is the client-side interface or wrapper to scesrv.dll. scecli.dll is loaded into Wsecedit.dll to support MMC snap-ins. It is used by Setup to configure default system security and security of files, registry keys, and services installed by the Setup API .inf files. - The command-line version of the security configuration and analysis user interfaces, secedit.exe, uses scecli.dll. - Scecli.dll implements the client-side extension for Group Policy. - Scesrv.dll uses scecli.dll to download applicable Group Policy files from SYSVOL in order to apply Group Policy security settings to the local device. - Scecli.dll logs application of security policy into WMI (RSoP). - Scesrv.dll policy filter uses scecli.dll to update Default Domain Controller Policy GPO when changes are made to SAM and LSA. - - **Wsecedit.dll** - The Security Settings extension of the Group Policy Object Editor snap-in. You use this tool to configure security settings in a Group Policy Object for a site, domain, or organizational unit. You can also use Security Settings to import security templates to a GPO. - - **Secedit.sdb** - This is a permanent system database used for policy propagation including a table of persistent settings for rollback purposes. - - **User databases** - A user database is any database other than the system database created by administrators for the purposes of configuration or analysis of security. - - **.Inf Templates** - These are text files that contain declarative security settings. They are loaded into a database before configuration or analysis. Group Policy security policies are stored in .inf files on the SYSVOL folder of domain controllers, where they are downloaded (by using file copy) and merged into the system database during policy propagation. - ## Security settings policy processes and interactions - - For a domain-joined device, where Group Policy is administered, security settings are processed in conjunction with Group Policy. Not all settings are configurable. - ### Group Policy processing - When a computer starts and a user logs on, computer policy and user policy are applied according to the following sequence: - 1. The network starts. Remote Procedure Call System Service (RPCSS) and Multiple Universal Naming Convention Provider (MUP) start. - 2. An ordered list of Group Policy Objects is obtained for the device. The list might depend on these factors: - - Whether the device is part of a domain and, therefore, subject to Group Policy through Active Directory. - - The location of the device in Active Directory. - - Whether the list of Group Policy Objects has changed. If the list of Group Policy Objects has not changed, no processing is done. - 3. Computer policy is applied. These are the settings under Computer Configuration from the gathered list. This is a synchronous process by default and occurs in the following order: local, site, domain, organizational unit, child organizational unit, and so on. No user interface appears while computer policies are processed. - 4. Startup scripts run. This is hidden and synchronous by default; each script must complete or time out before the next one starts. The default time-out is 600 seconds. You can use several policy settings to modify this behavior. - 5. The user presses CTRL+ALT+DEL to log on. - 6. After the user is validated, the user profile loads; it is governed by the policy settings that are in effect. - 7. An ordered list of Group Policy Objects is obtained for the user. The list might depend on these factors: - - Whether the user is part of a domain and, therefore, subject to Group Policy through Active Directory. - - Whether loopback policy processing is enabled, and if so, the state (Merge or Replace) of the loopback policy setting. - - The location of the user in Active Directory. - - Whether the list of Group Policy Objects has changed. If the list of Group Policy Objects has not changed, no processing is done. - 8. User policy is applied. These are the settings under User Configuration from the gathered list. This is synchronous by default and in the following order: local, site, domain, organizational unit, child organizational unit, and so on. No user interface appears while user policies are processed. - 9. Logon scripts run. Group Policy−based logon scripts are hidden and asynchronous by default. The user object script runs last. - 10. The operating system user interface that is prescribed by Group Policy appears. - ### Group Policy Objects storage - A Group Policy Object (GPO) is a virtual object that is identified by a Globally Unique Identifier (GUID) and stored at the domain level. The policy setting information of a GPO is stored in the following two locations: - - **Group Policy containers in Active Directory.** - The Group Policy container is an Active Directory container that contains GPO properties, such as version information, GPO status, plus a list of other component settings. - - **Group Policy templates in a domain’s system volume folder (SYSVOL).** - The Group Policy template is a file system folder that includes policy data specified by .admx files, security settings, script files, and information about applications that are available for installation. The Group Policy template is located in the SYSVOL folder in the domain\\Policies subfolder. - The **GROUP\_POLICY\_OBJECT** structure provides information about a GPO in a GPO list, including the version number of the GPO, a pointer to a string that indicates the Active Directory portion of the GPO, and a pointer to a string that specifies the path to the file system portion of the GPO. - ### Group Policy processing order - Group Policy settings are processed in the following order: - 1. **Local Group Policy Object.** - Each device running a Windows operating system beginning with Windows XP has exactly one Group Policy Object that is stored locally. - 2. **Site.** - Any Group Policy Objects that have been linked to the site are processed next. Processing is synchronous and in an order that you specify. - 3. **Domain.** - Processing of multiple domain-linked Group Policy Objects is synchronous and in an order you speciy. - 4. **Organizational units.** - Group Policy Objects that are linked to the organizational unit that is highest in the Active Directory hierarchy are processed first, then Group Policy Objects that are linked to its child organizational unit, and so on. Finally, the Group Policy Objects that are linked to the organizational unit that contains the user or device are processed. - At the level of each organizational unit in the Active Directory hierarchy, one, many, or no Group Policy Objects can be linked. If several Group Policy Objects are linked to an organizational unit, their processing is synchronous and in an order that you specify. - This order means that the local Group Policy Object is processed first, and Group Policy Objects that are linked to the organizational unit of which the computer or user is a direct member are processed last, which overwrites the earlier Group Policy Objects. - This is the default processing order and administrators can specify exceptions to this order. A Group Policy Object that is linked to a site, domain, or organizational unit (not a local Group Policy Object) can be set to **Enforced** with respect to that site, domain, or organizational unit, so that none of its policy settings can be overridden. At any site, domain, or organizational unit, you can mark Group Policy inheritance selectively as **Block Inheritance**. Group Policy Object links that are set to **Enforced** are always applied, however, and they cannot be blocked. - ### Security settings policy processing - In the context of Group Policy processing, security settings policy is processed in the following order. - 1. During Group Policy processing, the Group Policy engine determines which security settings policies to apply. - 2. If security settings policies exist in a GPO, Group Policy invokes the Security Settings client-side extension. - 3. The Security Settings extension downloads the policy from the appropriate location such as a specific domain controller. - 4. The Security Settings extension merges all security settings policies according to precedence rules. The processing is according to the Group Policy processing order of local, site, domain, and organizational unit (OU), as described earlier in the “Group Policy processing order” section. If multiple GPOs are in effect for a given device and there are no conflicting policies, then the policies are cumulative and are merged. - This example uses the Active Directory structure shown in the following figure. A given computer is a member of OU2, to which the **GroupMembershipPolGPO** GPO is linked. This computer is also subject to the **UserRightsPolGPO** GPO, which is linked to OU1, higher in the hierarchy. In this case, no conflicting policies exist so the device receives all of the policies contained in both the **UserRightsPolGPO** and the **GroupMembershipPolGPO** GPOs. - **Multiple GPOs and Merging of Security Policy** - ![multiple gpos and merging of security policy](images/secpol-multigpomerge.gif) - 5. The resultant security policies are stored in secedit.sdb, the security settings database. The security engine gets the security template files and imports them to secedit.sdb. - 6. The security settings policies are applied to devices. - The following figure illustrates the security settings policy processing. - **Security Settings Policy Processing** - ![process and interactions of security policy settin](images/secpol-processes.gif) - ### Merging of security policies on domain controllers - Password policies, Kerberos, and some security options are only merged from GPOs that are linked at the root level on the domain. This is done to keep those settings synchronized across all domain controllers in the domain. The following security options are merged: - - Network Security: Force logoff when logon hours expire - - Accounts: Administrator account status - - Accounts: Guest account status - - Accounts: Rename administrator account - - Accounts: Rename guest account - Another mechanism exists that allows security policy changes made by administrators by using net accounts to be merged into the Default Domain Policy GPO. User rights changes that are made by using Local Security Authority (LSA) APIs are filtered into the Default Domain Controllers Policy GPO. - ### Special considerations for domain controllers - If an application is installed on a primary domain controller (PDC) with operations master role (also known as flexible single master operations or FSMO) and the application makes changes to user rights or password policy, these changes must be communicated to ensure that synchronization across domain controllers occurs. Scesrv.dll receives a notification of any changes made to the security account manager (SAM) and LSA that need to be synchronized across domain controllers and then incorporates the changes into the Default Domain Controller Policy GPO by using scecli.dll template modification APIs. - ### When security settings are applied - After you have edited the security settings policies, the settings are refreshed on the computers in the organizational unit linked to your Group Policy Object in the following instances: - - When a device is restarted. - - Every 90 minutes on a workstation or server and every 5 minutes on a domain controller. This refresh interval is configurable. - - By default, Security policy settings delivered by Group Policy are also applied every 16 hours (960 minutes) even if a GPO has not changed. - ### Persistence of security settings policy - Security settings can persist even if a setting is no longer defined in the policy that originally applied it. - Security settings might persist in the following cases: - - The setting has not been previously defined for the device. - - The setting is for a registry security object. - - The settings are for a file system security object. - All settings applied through local policy or through a Group Policy Object are stored in a local database on your computer. Whenever a security setting is modified, the computer saves the security setting value to the local database, which retains a history of all the settings that have been applied to the computer. If a policy first defines a security setting and then no longer defines that setting, then the setting takes on the previous value in the database. If a previous value does not exist in the database then the setting does not revert to anything and remains defined as is. This behavior is sometimes referred to as “tattooing.” - Registry and file security settings will maintain the values applied through Group Policy until that setting is set to other values. - ### Permissions required for policy to apply - Both Apply Group Policy and Read permissions are required to have the settings from a Group Policy Object apply to users or groups, and computers. - ### Filtering security policy - By default, all GPOs have Read and Apply Group Policy both Allowed for the Authenticated Users group. The Authenticated Users group includes both users and computers. Security settings policies are computer-based. To specify which client computers will or will not have a Group Policy Object applied to them, you can deny them either the Apply Group Policy or Read permission on that Group Policy Object. Changing these permissions allows you to limit the scope of the GPO to a specific set of computers within a site, domain, or OU. - **Note**   Do not use security policy filtering on a domain controller as this would prevent security policy from applying to it. -   - ### Migration of GPOs containing security settings - In some situations, you might want to migrate GPOs from one domain environment to another environment. The two most common scenarios are test-to-production migration, and production-to-production migration. The GPO copying process has implications for some types of security settings. - Data for a single GPO is stored in multiple locations and in various formats; some data is contained in Active Directory and other data is stored on the SYSVOL share on the domain controllers. Certain policy data might be valid in one domain but might be invalid in the domain to which the GPO is being copied. For example, Security Identifiers (SIDs) stored in security policy settings are often domain-specific. So copying GPOs is not as simple as taking a folder and copying it from one device to another. - The following security policies can contain security principals and might require some additional work to successfully move them from one domain to another. - - User rights assignment - - Restricted groups - - Services - - File system - - Registry - - The GPO DACL, if you choose to preserve it during a copy operation - To ensure that data is copied correctly, you can use Group Policy Management Console (GPMC). When migrating a GPO from one domain to another, GPMC ensures that all relevant data is properly copied. GPMC also offers migration tables, which can be used to update domain-specific data to new values as part of the migration process. GPMC hides much of the complexity involved in the migrating GPO operations, and it provides simple and reliable mechanisms for performing operations such as copy and backup of GPOs. - ## In this section - - @@ -476,14 +254,6 @@ To ensure that data is copied correctly, you can use Group Policy Management Con
-   -   -   - - - - - diff --git a/windows/keep-secure/security-technologies.md b/windows/keep-secure/security-technologies.md index 81f5647bf1..9dfd3f9d76 100644 --- a/windows/keep-secure/security-technologies.md +++ b/windows/keep-secure/security-technologies.md @@ -2,20 +2,15 @@ title: Security technologies (Windows 10) description: Learn more about the different security technologies that are available in Windows 10 and Windows 10 Mobile. ms.assetid: BFE2DE22-B0CE-465B-8CF6-28F64464DF08 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Security technologies - - Learn more about the different security technologies that are available in Windows 10 and Windows 10 Mobile. - ## In this section - - @@ -62,14 +57,6 @@ Learn more about the different security technologies that are available in Windo
-   -   -   - - - - - diff --git a/windows/keep-secure/select-types-of-rules-to-create.md b/windows/keep-secure/select-types-of-rules-to-create.md index b40dc6855b..7f3a82de40 100644 --- a/windows/keep-secure/select-types-of-rules-to-create.md +++ b/windows/keep-secure/select-types-of-rules-to-create.md @@ -2,59 +2,35 @@ title: Select the types of rules to create (Windows 10) description: This topic lists resources you can use when selecting your application control policy rules by using AppLocker. ms.assetid: 14751169-0ed1-47cc-822c-8c01a7477784 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Select the types of rules to create - - **Applies to** - - Windows 10 - This topic lists resources you can use when selecting your application control policy rules by using AppLocker. - When determining what types of rules to create for each of your groups, you should also determine what enforcement setting to use for each group. Different rule types are more applicable for some apps, depending on the way that the applications are deployed in a specific business group. - The following topics provide additional information about AppLocker rules that can help you decide what rules to use for your applications: - - [Understanding AppLocker rule behavior](understanding-applocker-rule-behavior.md) - - [Understanding AppLocker rule exceptions](understanding-applocker-rule-exceptions.md) - - [Understanding AppLocker rule collections](understanding-applocker-rule-collections.md) - - [Understanding AppLocker allow and deny actions on rules](understanding-applocker-allow-and-deny-actions-on-rules.md) - - [Understanding AppLocker rule condition types](understanding-applocker-rule-condition-types.md) - - [Understanding AppLocker default rules](understanding-applocker-default-rules.md) - ### Select the rule collection - The rules you create will be in one of the following rule collections: - - Executable files: .exe and .com - - Windows Installer files: .msi, .msp, and .mst - - Scripts: .ps1, .bat, .cmd, .vbs, and .js - - Packaged apps and packaged app installers: .appx - - DLLs: .dll and .ocx - By default, the rules will allow a file to run based upon user or group privilege. If you use DLL rules, a DLL allow rule has to be created for each DLL that is used by all of the allowed apps. The DLL rule collection is not enabled by default. - In the Woodgrove Bank example, the line-of-business app for the Bank Tellers business group is C:\\Program Files\\Woodgrove\\Teller.exe, and this app needs to be included in a rule. In addition, because this rule is part of a list of allowed applications, all the Windows files under C:\\Windows must be included as well. - ### Determine the rule condition - A rule condition is criteria upon which an AppLocker rule is based and can only be one of the rule conditions in the following table. - @@ -86,37 +62,17 @@ A rule condition is criteria upon which an AppLocker rule is based and can only
-   - In the Woodgrove Bank example, the line-of-business app for the Bank Tellers business group is signed and is located at C:\\Program Files\\Woodgrove\\Teller.exe. Therefore, the rule can be defined with a publisher condition. If the rule is defined to a specific version and above (for example, Teller.exe version 8.0 and above), then this will allow any updates to this app to occur without interruption of access to the users if the app's name and signed attributes stay the same. - ### Determine how to allow system files to run - Because AppLocker rules build a list of allowed apps, a rule or rules must be created to allow all Windows files to run. AppLocker provides a means to ensure system files are properly considered in your rule collection by generating the default rules for each rule collection. You can use the default rules as a template when creating your own rules. However, these rules are only meant to function as a starter policy when you are first testing AppLocker rules so that the system files in the Windows folders will be allowed to run. When a default rule is created, it is denoted with "(Default rule)" in its name as it appears in the rule collection. - You can also create a rule for the system files based on the path condition. In the preceding example, for the Bank Tellers group, all Windows files reside under C:\\Windows and can be defined with the path rule condition type. This will permit access to these files whenever updates are applied and the files change. If you require additional application security, you might need to modify the rules created from the built-in default rule collection. For example, the default rule to allow all users to run .exe files in the Windows folder is based on a path condition that allows all files within the Windows folder to run. The Windows folder contains a Temp subfolder to which the Users group is given the following permissions: - - Traverse Folder/Execute File - - Create Files/Write Data - - Create Folders/Append Data - These permissions settings are applied to this folder for application compatibility. However, because any user can create files in this location, allowing apps to be run from this location might conflict with your organization's security policy. - ## Next steps - - After you have selected the types of rules to create, record your findings as explained in [Document your AppLocker rules](document-your-applocker-rules.md). - After recording your findings for the AppLocker rules to create, you will need to consider how to enforce the rules. For info about how to do this, see [Determine Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md). -   -   - - - - - diff --git a/windows/keep-secure/shut-down-the-system.md b/windows/keep-secure/shut-down-the-system.md index 146683721a..fc101c8428 100644 --- a/windows/keep-secure/shut-down-the-system.md +++ b/windows/keep-secure/shut-down-the-system.md @@ -2,56 +2,33 @@ title: Shut down the system (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Shut down the system security policy setting. ms.assetid: c8e8f890-153a-401e-a957-ba6a130304bf +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Shut down the system - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Shut down the system** security policy setting. - ## Reference - - This security setting determines if a user who is logged on locally to a device can shut down Windows. - Shutting down domain controllers makes them unavailable to perform functions such as processing logon requests, processing Group Policy settings, and answering Lightweight Directory Access Protocol (LDAP) queries. Shutting down domain controllers that have been assigned operations master roles (also known as flexible single master operations or FSMO roles) can disable key domain functionality; for example, processing logon requests for new passwords, which is performed by the primary domain controller (PDC) emulator master. - The **Shut down the system** user right is required to enable hibernation support, to set the power management settings, and to cancela shutdown. - Constant: SeShutdownPrivilege - ### Possible values - - A user-defined list of accounts - - Defaults - - Not defined - ### Best practices - 1. Ensure that only Administrators and Backup Operators have the **Shut down the system** user right on member servers, and that only Administrators have the user right on domain controllers. Removing these default groups might limit the abilities of users who are assigned to specific administrative roles in your environment. Ensure that their delegated tasks will not be negatively affected. - 2. The ability to shut down domain controllers should be limited to a very small number of trusted administrators. Even though a system shutdown requires the ability to log on to the server, you should be very careful about the accounts and groups that you allow to shut down a domain controller. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - By default this setting is Administrators, Backup Operators, Server Operators, and Print Operators on domain controllers, and Administrators and Backup Operators on stand-alone servers. - The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - @@ -100,65 +77,30 @@ The following table lists the actual and effective default policy values for the
-   - ## Policy management - - This section describes features, tools, and guidance to help you manage this policy. - A restart of the computer is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - ### Group Policy - This user right does not have the same effect as **Force shutdown from a remote system**. For more information, see [Force shutdown from a remote system](force-shutdown-from-a-remote-system.md). - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - The ability to shut down domain controllers should be limited to a very small number of trusted administrators. Although the **Shut down the system** user right requires the ability to log on to the server, you should be very careful about which accounts and groups you allow to shut down a domain controller. - When a domain controller is shut down, it is no longer available to process logon requests, process Group Policy settings, and answer Lightweight Directory Access Protocol (LDAP) queries. If you shut down domain controllers that possess operations master roles, you can disable key domain functionality, such as processing logon requests for new passwords, which is performed by the PDC master. - For other server roles, especially those where non-administrators have rights to log on to the server (such as RD Session Host servers), it is critical that this user right be removed from users that do not have a legitimate reason to restart the servers. - ### Countermeasure - Ensure that only the Administrators and Backup Operators groups are assigned the **Shut down the system** user right on member servers, and ensure that only the Administrators group is assigned the user right on domain controllers. - ### Potential impact - The impact of removing these default groups from the **Shut down the system** user right could limit the delegated abilities of assigned roles in your environment. You should confirm that delegated activities are not adversely affected. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md b/windows/keep-secure/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md index 90d093a627..ad159693ce 100644 --- a/windows/keep-secure/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md +++ b/windows/keep-secure/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md @@ -2,54 +2,32 @@ title: Shutdown Allow system to be shut down without having to log on (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Shutdown Allow system to be shut down without having to log on security policy setting. ms.assetid: f3964767-5377-4416-8eb3-e14d553a7315 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Shutdown: Allow system to be shut down without having to log on - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **Shutdown: Allow system to be shut down without having to log on** security policy setting. - ## Reference - - This policy setting determines whether a device can be shut down without having to log on to Windows. If you enable this policy setting, the **Shut Down** option is available on the logon screen in Windows. If you disable this policy setting, the **Shut Down** option is removed from the logon screen. This configuration requires that users are able to log on to the device successfully and that they have the **Shut down the system** user right before they can perform a shutdown. - Users who can access the console locally can shut down the system. Attackers or misguided users can connect to the server by using Remote Desktop Services, and then shut it down or restart it without having to identify themselves. A malicious user might also cause a temporary denial-of-service condition by walking up to the local console and restarting the server, or shutting down the server and thus rendering unavailable all its applications and services. - ### Possible values - - Enabled - The shut down command is available on the logon screen. - - Disabled - The shut down option is removed from the logon screen and users must have the **Shut down the system** user right before they can perform a shutdown. - - Not defined - ### Best practices - 1. On servers, set this policy to **Disabled**. You must log on to servers to shut them down or restart them. - 2. On client devices, set this policy to **Enabled** and define the list of those with the right to shut them down or restart them with the User Rights Assignment policy **Shut down the system**. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -88,51 +66,23 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. - ### Group Policy - For info about the User Rights Assignment policy, **Shut down the system**, see [Shut down the system](shut-down-the-system.md). - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Users who can access the console locally could shut down the device - Attackers who have access to the local console could restart the server, which would cause a temporary DoS condition. Attackers could also shut down the server and leave all of its applications and services unavailable. - ### Countermeasure - Disable the **Shutdown: Allow system to be shut down without having to log on** setting. - ### Potential impact - You must log on to servers to shut them down or restart them. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/shutdown-clear-virtual-memory-pagefile.md b/windows/keep-secure/shutdown-clear-virtual-memory-pagefile.md index 1076dedd2f..042254e9c7 100644 --- a/windows/keep-secure/shutdown-clear-virtual-memory-pagefile.md +++ b/windows/keep-secure/shutdown-clear-virtual-memory-pagefile.md @@ -2,50 +2,30 @@ title: Shutdown Clear virtual memory pagefile (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Shutdown Clear virtual memory pagefile security policy setting. ms.assetid: 31400078-6c56-4891-a6df-6dfb403c4bc9 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Shutdown: Clear virtual memory pagefile - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **Shutdown: Clear virtual memory pagefile** security policy setting. - ## Reference - - This policy setting determines whether the virtual memory paging file is cleared when the device is shut down. Virtual memory support uses a system paging file to swap pages of memory to disk when they are not used. On a running device, this paging file is opened exclusively by the operating system, and it is well protected. However, devices that are configured to allow other operating systems to start should verify that the system paging file is cleared as the device shuts down. This confirmation ensures that sensitive information from process memory that might be placed in the paging file is not available to an unauthorized user who manages to directly access the paging file after shutdown. - Important information that is kept in real memory might be written periodically to the paging file. This helps devices handle multitasking functions. A malicious user who has physical access to a server that has been shut down can view the contents of the paging file. The attacker can move the system volume into a different computer and then analyze the contents of the paging file. This is a time-consuming process, but it can expose data that is cached from RAM to the paging file. A malicious user who has physical access to the server can bypass this countermeasure by simply unplugging the server from its power source. - ### Possible values - - Enabled - The system paging file is cleared when the system shuts down normally. Also, this policy setting forces the computer to clear the hibernation file (hiberfil.sys) when hibernation is disabled on a portable device. - - Disabled - - Not defined - ### Best practices - - Set this policy to **Enabled**. This causes Windows to clear the paging file when the system is shut down. Depending on the size of the paging file, this process might take several minutes before the system completely shuts down. This delay in shutting down the server is especially noticeable on servers with large paging files. For a server with 2 gigabytes (GB) of RAM and a 2-GB paging file, this setting can add more than 30 minutes to the shutdown process. For some organizations, this downtime violates their internal service level agreements. Use caution when implementing this countermeasure in your environment. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -84,50 +64,23 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Important information that is kept in real memory may be written periodically to the paging file to help Windows handle multitasking functions. An attacker who has physical access to a server that has been shut down could view the contents of the paging file. The attacker could move the system volume into a different device and then analyze the contents of the paging file. Although this process is time consuming, it could expose data that is cached from random access memory (RAM) to the paging file. - **Caution**   An attacker who has physical access to the device could bypass this countermeasure by unplugging the computer from its power source. -   - ### Countermeasure - Enable the **Shutdown: Clear virtual memory page file** setting. This configuration causes the operating system to clear the paging file when the device is shut down. The amount of time that is required to complete this process depends on the size of the page file. Because the process overwrites the storage area that is used by the page file several times, it could be several minutes before the device completely shuts down. - ### Potential impact - It takes longer to shut down and restart the device, especially on devices with large paging files. For a device with 2 gigabytes (GB) of RAM and a 2-GB paging file, this policy setting could increase the shutdown process by more than 30 minutes. For some organizations this downtime violates their internal service level agreements. Therefore, use caution before you implement this countermeasure in your environment. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/store-passwords-using-reversible-encryption.md b/windows/keep-secure/store-passwords-using-reversible-encryption.md index 57c859368c..1d0ae2465b 100644 --- a/windows/keep-secure/store-passwords-using-reversible-encryption.md +++ b/windows/keep-secure/store-passwords-using-reversible-encryption.md @@ -2,53 +2,32 @@ title: Store passwords using reversible encryption (Windows 10) description: Describes the best practices, location, values, and security considerations for the Store passwords using reversible encryption security policy setting. ms.assetid: 57f958c2-f1e9-48bf-871b-0a9b3299e238 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Store passwords using reversible encryption - - **Applies to** - - Windows 10 - Describes the best practices, location, values, and security considerations for the **Store passwords using reversible encryption** security policy setting. - ## Reference - - The **Store password using reversible encryption** policy setting provides support for applications that use protocols that require the user's password for authentication. Storing encrypted passwords in a way that is reversible means that the encrypted passwords can be decrypted. A knowledgeable attacker who is able to break this encryption can then log on to network resources by using the compromised account. For this reason, never enable **Store password using reversible encryption** for all users in the domain unless application requirements outweigh the need to protect password information. - If you use the Challenge Handshake Authentication Protocol (CHAP) through remote access or Internet Authentication Services (IAS), you must enable this policy setting. CHAP is an authentication protocol that is used by remote access and network connections. Digest Authentication in Internet Information Services (IIS) also requires that you enable this policy setting. - ### Possible values - - Enabled - - Disabled - - Not defined - ### Best practices - Set the value for **Store password using reversible encryption** to Disabled. If you use CHAP through remote access or IAS, or Digest Authentication in IIS, you must set this value to **Enabled**. This presents a security risk when you apply the setting by using Group Policy on a user-by-user basis because it requires opening the appropriate user account object in Active Directory Users and Computers. - **Note**   Do not enable this policy setting unless business requirements outweigh the need to protect password information. -   - ### Location - **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy\\** - ### Default values - The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - @@ -87,36 +66,16 @@ The following table lists the actual and effective default policy values. Defaul
-   - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Enabling this policy setting allows the operating system to store passwords in a format that can weaken your overall security. - ### Countermeasure - Disable the **Store password using reversible encryption** policy setting. - ### Potential impact - If your organization uses CHAP through remote access or IAS, or Digest Authentication in IIS, you must configure this policy setting to Enabled. This presents a security risk when you apply the setting through Group Policy on a user-by-user basis because it requires the appropriate user account object to be opened in Active Directory Users and Computers. - ## Related topics - - [Password Policy](password-policy.md) -   -   - - - - - diff --git a/windows/keep-secure/switch-pcr-banks-on-tpm-2-0-devices.md b/windows/keep-secure/switch-pcr-banks-on-tpm-2-0-devices.md index 3da96de40b..a0af51cade 100644 --- a/windows/keep-secure/switch-pcr-banks-on-tpm-2-0-devices.md +++ b/windows/keep-secure/switch-pcr-banks-on-tpm-2-0-devices.md @@ -2,55 +2,28 @@ title: Switch PCR banks on TPM 2.0 devices (Windows 10) description: A Platform Configuration Register (PCR) is a memory location in the TPM that has some unique properties. ms.assetid: 743FCCCB-99A9-4636-8F48-9ECB3A3D10DE +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Switch PCR banks on TPM 2.0 devices - - **Applies to** - - Windows 10 - A Platform Configuration Register (PCR) is a memory location in the TPM that has some unique properties. The size of the value that can be stored in a PCR is determined by the size of a digest generated by an associated hashing algorithm. A SHA-1 PCR can store 20 bytes – the size of a SHA-1 digest. Multiple PCRs associated with the same hashing algorithm are referred to as a PCR bank. - To store a new value in a PCR, the existing value is extended with a new value as follows: - PCR\[N\] = HASHalg( PCR\[N\] || ArgumentOfExtend ) - The existing value is concatenated with the argument of the TPM Extend operation. The resulting concatenation is then used as input to the associated hashing algorithm, which computes a digest of the input. This computed digest becomes the new value of the PCR. - The [TCG PC Client Specific Platform TPM Profile for TPM 2.0](http://go.microsoft.com/fwlink/p/?LinkId=746577) defines the inclusion of at least one PCR bank with 24 registers. The only way to reset the first 16 PCRs is to reset the TPM itself. This restriction helps ensure that the value of those PCRs can only be modified via the TPM Extend operation. - Some TPM PCRs are used as checksums of log events. The log events are extended in the TPM as the events occur. Later, an auditor can validate the logs by computing the expected PCR values from the log and comparing them to the PCR values of the TPM. Since the first 16 TPM PCRs cannot be modified arbitrarily, a match between an expected PCR value in that range and the actual TPM PCR value provides assurance of an unmodified log. - ## How does Windows 10 use PCRs? - - To bind the use of a TPM based key to a certain state of the PC, the key can be sealed to an expected set of PCR values. For instance, PCRs 0 through 7 have a well-defined value after the boot process – when the OS is loaded. When the hardware, firmware, or boot loader of the machine changes, the change can be detected in the PCR values. Windows 10 uses this capability to make certain cryptographic keys only available at certain times during the boot process. For instance, the BitLocker key can be used at a certain point in the boot, but not before or after. - It is important to note that this binding to PCR values also includes the hashing algorithm used for the PCR. For instance, a key can be bound to a specific value of the SHA-1 PCR\[12\], if using SHA-256 PCR banks, even with the same system configuration otherwise, the PCR values will not match. - ## What happens when PCR banks are switched? - - When the PCR banks are switched, the algorithm used to compute the hashed values stored in the PCRs during extend operations is changed. For the same input, each hash algorithm will return a different cryptographic signature for the same inputs. - As a result, if the currently used PCR bank is switched all keys that have been bound to the previous PCR values will no longer work. For example, if you had a key bound to the SHA-1 value of PCR\[12\] and subsequently changed the PCR banks to SHA-256, the banks wouldn’t match, and you would be unable to use that key. The BitLocker key is secured using the PCR banks and Windows 10 will not be able to unseal it if the PCR banks are switched while BitLocker is enabled. - ## What can I do to switch PCRs when BitLocker is already active? - - Before switching PCR banks you should suspend or disable BitLocker – or have your recovery key ready. For steps on how to switch PCR banks on your PC, you should contact your OEM or UEFI vendor. -   -   - - - - - diff --git a/windows/keep-secure/synchronize-directory-service-data.md b/windows/keep-secure/synchronize-directory-service-data.md index f27a3177b6..4554452349 100644 --- a/windows/keep-secure/synchronize-directory-service-data.md +++ b/windows/keep-secure/synchronize-directory-service-data.md @@ -2,48 +2,29 @@ title: Synchronize directory service data (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Synchronize directory service data security policy setting. ms.assetid: 97b0aaa4-674f-40f4-8974-b4bfb12c232c +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Synchronize directory service data - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Synchronize directory service data** security policy setting. - ## Reference - - This policy setting determines which users and groups have authority to synchronize all directory service data, regardless of the protection for objects and properties. This privilege is required to use LDAP directory synchronization (dirsync) services. Domain controllers have this user right inherently because the synchronization process runs in the context of the **System** account on domain controllers. - Constant: SeSyncAgentPrivilege - ### Possible values - - User-defined list of accounts - - Not defined - ### Best practices - - Ensure that no accounts are assigned the **Synchronize directory service data** user right. Only domain controllers need this privilege, which they inherently have. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - By default this setting is not defined on domain controllers and on stand-alone servers. - The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - @@ -82,59 +63,27 @@ The following table lists the actual and effective default policy values. Defaul
-   - ## Policy management - - This section describes features, tools, and guidance to help you manage this policy. - A restart of the device is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - ### Group Policy - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - The **Synchronize directory service data** user right affects domain controllers (only domain controllers should be able to synchronize directory service data). Domain controllers have this user right inherently because the synchronization process runs in the context of the **System** account on domain controllers. Attackers who have this user right can view all information that is stored within the directory. They could then use some of that information to facilitate additional attacks or expose sensitive data, such as direct telephone numbers or physical addresses. - ### Countermeasure - Ensure that no accounts are assigned the **Synchronize directory service data** user right. - ### Potential impact - None. Not defined is the default configuration. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md b/windows/keep-secure/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md index ccdb41c94f..811570c873 100644 --- a/windows/keep-secure/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md +++ b/windows/keep-secure/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md @@ -2,50 +2,30 @@ title: System cryptography Force strong key protection for user keys stored on the computer (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the System cryptography Force strong key protection for user keys stored on the computer security policy setting. ms.assetid: 8cbff267-881e-4bf6-920d-b583a5ff7de0 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # System cryptography: Force strong key protection for user keys stored on the computer - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **System cryptography: Force strong key protection for user keys stored on the computer** security policy setting. - ## Reference - - This policy setting determines whether users can use private keys, such as their Secure/Multipurpose Internet Mail Extensions (S/MIME) key, without a password. - Configuring this policy setting so that users must provide a password every time they use a key (in addition to their domain password) makes it more difficult for a malicious user to access locally-stored user keys, even if the attacker takes control of the user's device and determines their logon password. - ### Possible values - - **User input is not required when new keys are stored and used** - - **User is prompted when the key is first used** - - **User must enter a password each time they use a key** - - Not defined - ### Best practices - - Set this policy to **User must enter a password each time they use a key**. Users must enter their password every time they access a key that is stored on their computer. For example, if users use an S/MIME certificate to digitally sign their email, they will be forced to enter the password for that certificate every time they send a signed email message. For some organizations, the overhead that is caused by using this value might be too high, but they should set the value at a minimum to **User is prompted when the key is first used**. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -84,45 +64,20 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - If a user's account is compromised or the user's device is inadvertently left unsecured, the malicious user can use the keys that are stored for the user to access protected resources. - ### Countermeasure - Configure the **System cryptography: Force strong key protection for user keys stored on the computer** setting to **User must enter a password each time they use a key** so that users must provide a password that is distinct from their domain password every time they use a key. This configuration makes it more difficult for an attacker to access locally stored user keys, even if the attacker takes control of the user's computer and determines the logon password. - ### Potential impact - Users must type their password every time they access a key that is stored on their device. For example, if users use an S/MIME certificate to digitally sign their email, they are forced to type the password for that certificate every time they send a signed email message. For some organizations, the overhead that is involved by using this configuration may be too high. At a minimum, this setting should be set to **User is prompted when the key is first used**. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md b/windows/keep-secure/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md index 8c2c61ba3e..b762727564 100644 --- a/windows/keep-secure/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md +++ b/windows/keep-secure/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md @@ -2,64 +2,37 @@ title: System cryptography Use FIPS compliant algorithms for encryption, hashing, and signing (Windows 10) description: This security policy reference topic for the IT professional describes the best practices, location, values, policy management and security considerations for this policy setting. ms.assetid: 83988865-dc0f-45eb-90d1-ee33495eb045 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing - - **Applies to** - - Windows 10 - This security policy reference topic for the IT professional describes the best practices, location, values, policy management and security considerations for this policy setting. - ## Reference - - The Federal Information Processing Standard (FIPS) 140 is a security implementation that is designed for certifying cryptographic software. Windows implements these certified algorithms to meet the requirements and standards for cryptographic modules for use by departments and agencies of the United States federal government. - **TLS/SSL** - This policy setting determines whether the TLS/SSL security provider supports only the FIPS-compliant strong cipher suite known as TLS\_RSA\_WITH\_3DES\_EDE\_CBC\_SHA, which means that the provider only supports the TLS protocol as a client computer and as a server, if applicable. It uses only the Triple Data Encryption Standard (3DES) encryption algorithm for the TLS traffic encryption, only the Rivest-Shamir-Adleman (RSA) public key algorithm for the TLS key exchange and authentication, and only the Secure Hash Algorithm version 1 (SHA-1) hashing algorithm for the TLS hashing requirements. - **Encrypting File System (EFS)** - For the EFS service, this policy setting supports the 3DES and Advanced Encryption Standard (AES) encryption algorithms for encrypting file data supported by the NTFS file system. To encrypt file data, by default EFS uses the Advanced Encryption Standard (AES) algorithm with a 256-bit key in the Windows Server 2003, Windows Vista, and later, and it uses a DESX algorithm in Windows XP. - **Remote Desktop Services (RDS)** - For encrypting Remote Desktop Services network communication, this policy setting supports only the Triple DES encryption algorithm. - **BitLocker** - For BitLocker, this policy setting needs to be enabled before any encryption key is generated. - Recovery passwords created on Windows Server 2012 R2 and Windows 8.1 and later when this policy is enabled are incompatible with BitLocker on operating systems prior to Windows Server 2012 R2 and Windows 8.1; BitLocker will prevent the creation or use of recovery passwords on these systems, so recovery keys should be used instead. - ### Possible values - - Enabled - - Disabled - - Not defined - ### Best practices - - For use with TLS, set this policy to **Enabled**. Client devices with this policy setting enabled will be unable to communicate through digitally encrypted or signed protocols with servers that do not support these algorithms. Client devices that are connected to the network and do not support these algorithms cannot use servers that require the algorithms for network communications. If you enable this policy setting, you must also configure Internet Explorer to use TLS. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -98,15 +71,10 @@ The following table lists the actual and effective default values for this polic
-   - ### Operating system version differences - When this setting is enabled, the Encrypting File System (EFS) service supports only the Triple DES encryption algorithm for encrypting file data. By default, the Windows Vista and the Windows Server 2003 implementation of EFS uses the Advanced Encryption Standard (AES) with a 256-bit key. The Windows XP implementation uses DESX. - When this setting is enabled, BitLocker generates recovery password or recovery keys applicable to versions listed in the following: - @@ -137,49 +105,22 @@ When this setting is enabled, BitLocker generates recovery password or recovery
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ### Group Policy - Setting and deploying this policy using Group Policy takes precedence over the setting on the local device. If the Group Policy is set to **Not Configured**, local settings will apply. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - You can enable this policy setting to ensure that the device uses the most powerful algorithms that are available for digital encryption, hashing, and signing. Use of these algorithms minimize the risk of compromise of digitally encrypted or signed data by an unauthorized user. - ### Countermeasure - Enable the **System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing** setting. - ### Potential impact - Client devices that have this policy setting enabled cannot communicate by means of digitally encrypted or signed protocols with servers that do not support these algorithms. Network clients that do not support these algorithms cannot use servers that require them for network communications. For example, many Apache-based Web servers are not configured to support TLS. If you enable this setting, you must also configure Internet Explorer® to use TLS. This policy setting also affects the encryption level that is used for the Remote Desktop Protocol (RDP). The Remote Desktop Connection tool uses the RDP protocol to communicate with servers that run Terminal Services and client computers that are configured for remote control; RDP connections fail if both devices are not configured to use the same encryption algorithms. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/system-objects-require-case-insensitivity-for-non-windows-subsystems.md b/windows/keep-secure/system-objects-require-case-insensitivity-for-non-windows-subsystems.md index d26e95bbce..ed8f8e7cdb 100644 --- a/windows/keep-secure/system-objects-require-case-insensitivity-for-non-windows-subsystems.md +++ b/windows/keep-secure/system-objects-require-case-insensitivity-for-non-windows-subsystems.md @@ -2,52 +2,31 @@ title: System objects Require case insensitivity for non-Windows subsystems (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the System objects Require case insensitivity for non-Windows subsystems security policy setting. ms.assetid: 340d6769-8f33-4067-8470-1458978d1522 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # System objects: Require case insensitivity for non-Windows subsystems - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **System objects: Require case insensitivity for non-Windows subsystems** security policy setting. - ## Reference - - This policy setting determines whether case insensitivity is enforced for all subsystems. The Microsoft Win32 subsystem is not case sensitive; however, the kernel supports case sensitivity for other subsystems, such as Portable Operating System Interface for UNIX (POSIX). Enabling this policy setting enforces case insensitivity for all directory objects, symbolic links, and input/output (I/O) objects, including file objects. Disabling this policy setting does not allow the Win32 subsystem to become case sensitive. - Because Windows is case insensitive but the POSIX subsystem will support case sensitivity, if this policy setting is not enforced, it is possible for a user of that subsystem to create a file with the same name as another file but with a different mix of capital letters. That might confuse users when they try to access these files by using normal Win32 tools, because only one of the files will be available. - ### Possible values - - Enabled - Case insensitivity is enforced for all directory objects, symbolic links, and IO objects, including file objects. - - Disabled - Will not allow the Win32 subsystem to become case sensitive. - - Not defined - ### Best practices - - Set this policy to **Enabled**. All subsystems will be forced to observe case insensitivity. However, this might confuse users who are familiar with one of the UNIX-based operating systems and are used to a case sensitive operating system. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -86,45 +65,20 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Because Windows is case insensitive but the POSIX subsystem supports case sensitivity, failure to enable this policy setting makes it possible for a user of that subsystem to create a file with the same name as another file but with a different mix of uppercase and lowercase letters. Such a situation could potentially confuse users when they try to access such files from normal Win32 tools because only one of the files is available. - ### Countermeasure - Enable the **System objects: Require case insensitivity for non-Windows subsystems** setting. - ### Potential impact - All subsystems are forced to observe case insensitivity. This configuration may confuse users who are familiar with any UNIX-based operating systems that are case sensitive. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/system-objects-strengthen-default-permissions-of-internal-system-objects.md b/windows/keep-secure/system-objects-strengthen-default-permissions-of-internal-system-objects.md index 3927b70a25..1aee1c46fa 100644 --- a/windows/keep-secure/system-objects-strengthen-default-permissions-of-internal-system-objects.md +++ b/windows/keep-secure/system-objects-strengthen-default-permissions-of-internal-system-objects.md @@ -2,46 +2,28 @@ title: System objects Strengthen default permissions of internal system objects (e.g. Symbolic Links) (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the System objects Strengthen default permissions of internal system objects (e.g. Symbolic Links) security policy setting. ms.assetid: 3a592097-9cf5-4fd0-a504-7cbfab050bb6 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links) - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)** security policy setting. - ## Reference - - This policy setting determines the strength of the default discretionary access control list (DACL) for objects. Windows maintains a global list of shared system resources such as MS-DOS device names, mutexes, and semaphores. By using this list, processes can locate and share objects. Each type of object is created with a default DACL that specifies who can access the objects with what permissions. Enabling this policy setting strengthens the default DACL and allows users who are not administrators to read, but not to modify, shared objects that they did not create. - ### Possible values - - Enabled - - Disabled - - Not defined - ### Best practices - - It is advisable to set this policy to **Enabled**. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\ Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -80,45 +62,20 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - This policy setting is enabled by default to protect against a known vulnerability that can be used with hard links or symbolic links. Hard links are actual directory entries in the file system. With hard links, the same data in a file system can be referred to by different file names. Symbolic links are text files that provide a pointer to the file that is interpreted and followed by the operating system as a path to another file or directory. Because symbolic links are a separate file, they can exist independently of the target location. If a symbolic link is deleted, its target location remains unaffected. When this setting is disabled, it is possible for a malicious user to destroy a data file by creating a link that looks like a temporary file that the system automatically creates, such as a sequentially named log file, but it points to the data file that the malicious user wants to eradicate. When the system writes the files with that name, the data is overwritten. Enabling **System objects: Strengthen default permissions of internal system objects (e.g., Symbolic Links)** prevents an attacker from exploiting programs that create files with predictable names by not allowing them to write to objects that they did not create. - ### Countermeasure - Enable the **System objects: Strengthen default permissions of global system objects (for example, Symbolic Links)** setting. - ### Potential impact - None. This is the default configuration. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/system-settings-optional-subsystems.md b/windows/keep-secure/system-settings-optional-subsystems.md index 6dc7df6ae0..96633aece6 100644 --- a/windows/keep-secure/system-settings-optional-subsystems.md +++ b/windows/keep-secure/system-settings-optional-subsystems.md @@ -2,46 +2,28 @@ title: System settings Optional subsystems (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the System settings Optional subsystems security policy setting. ms.assetid: 5cb6519a-4f84-4b45-8072-e2aa8a72fb78 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # System settings: Optional subsystems - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **System settings: Optional subsystems** security policy setting. - ## Reference - - This policy setting determines which subsystems support your applications. You can use this security setting to specify as many subsystems as your environment demands. - The subsystem introduces a security risk that is related to processes that can potentially persist across logons. If a user starts a process and then logs out, the next user who logs on to the system might access the process that the previous user started. This is dangerous, because the process started by the first user can retain that user's system user rights; therefore, anything that the second user does using that process is performed with the user rights of the first user. This makes it difficult to trace who creates processes and objects, which is essential for post-security incident forensics. - ### Possible values - - User-defined list of subsystems - - Not defined - ### Best practices - - Set this policy setting to a null value. The default value is **POSIX**, so applications that rely on the POSIX subsystem will no longer run. For example, Microsoft Services for UNIX 3.0 installs an updated version of the POSIX subsystem. Reset this policy setting in Group Policy for any servers that use Services for UNIX 3.0. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -80,47 +62,21 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - The POSIX subsystem is an Institute of Electrical and Electronic Engineers (IEEE) standard that defines a set of operating system services. The POSIX subsystem is required if the server supports applications that use that subsystem. - The POSIX subsystem introduces a security risk that relates to processes that can potentially persist across logons. If a user starts a process and then logs out, there is a potential that the next user who logs on to the computer could access the previous user's process. This would allow the second user to take actions on the process by using the privileges of the first user. - ### Countermeasure - Configure the **System settings: Optional subsystems setting** to a null value. The default value is POSIX. - ### Potential impact - Applications that rely on the POSIX subsystem no longer operate. For example, Microsoft Services for UNIX (SFU) installs an updated version of the POSIX subsystem that is required, so you must reconfigure this setting in Group Policy for any servers that use SFU. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md b/windows/keep-secure/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md index 278033dbc8..ce05d099f5 100644 --- a/windows/keep-secure/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md +++ b/windows/keep-secure/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md @@ -2,46 +2,28 @@ title: System settings Use certificate rules on Windows executables for Software Restriction Policies (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the System settings Use certificate rules on Windows executables for Software Restriction Policies security policy setting. ms.assetid: 2380d93b-b553-4e56-a0c0-d1ef740d089c +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # System settings: Use certificate rules on Windows executables for Software Restriction Policies - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **System settings: Use certificate rules on Windows executables for Software Restriction Policies** security policy setting. - ## Reference - - This policy setting determines whether digital certificates are processed when software restriction policies are enabled and a user or process attempts to run software with an .exe file name extension. This security setting enables or disables certificate rules (which are a type of software restriction policy). With a software restriction policy, you can create a certificate rule that allows or disallows Microsoft Authenticode®-signed software to run, based on the digital certificate that is associated with the software. For certificate rules to work in software restriction policies, you must enable this security setting. - ### Possible values - - Enabled - - Disabled - - Not defined - ### Best practices - - Set this policy to **Enabled**. Enabling certificate rules results in software restriction policies checking a certificate revocation list (CRL) to make sure that the software's certificate and signature are valid. When you start signed programs, this setting can decrease system performance. You can disable CRLs by editing the software restriction policies in the desired GPO. In the **Trusted Publishers Properties** dialog box, clear the **Publisher** and **Timestamp** check boxes. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -80,45 +62,20 @@ The following table lists the actual and effective default values for this polic
-   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Without the use of software restriction policies, users and device might be exposed to unauthorized software that could include malware. - ### Countermeasure - Enable the **System settings: Use certificate rules on Windows executables for Software Restriction Policies** setting. - ### Potential impact - If you enable certificate rules, software restriction policies check a certificate revocation list (CRL) to verify that the software's certificate and signature are valid. This checking process may negatively affect performance when signed programs start. To disable this feature, you can edit the software restriction policies in the appropriate GPO. In the **Trusted Publishers Properties** dialog box, clear the **Publisher** and **Timestamp** check boxes. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/take-ownership-of-files-or-other-objects.md b/windows/keep-secure/take-ownership-of-files-or-other-objects.md index 6ec1df5665..5274e1f278 100644 --- a/windows/keep-secure/take-ownership-of-files-or-other-objects.md +++ b/windows/keep-secure/take-ownership-of-files-or-other-objects.md @@ -2,52 +2,31 @@ title: Take ownership of files or other objects (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Take ownership of files or other objects security policy setting. ms.assetid: cb8595d1-74cc-4176-bb15-d97663eebb2d +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Take ownership of files or other objects - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management, and security considerations for the **Take ownership of files or other objects** security policy setting. - ## Reference - - This policy setting determines which users can take ownership of any securable object in the device, including Active Directory objects, NTFS files and folders, printers, registry keys, services, processes, and threads. - Every object has an owner, whether the object resides in an NTFS volume or Active Directory database. The owner controls how permissions are set on the object and to whom permissions are granted. - By default, the owner is the person who or the process which created the object. Owners can always change permissions to objects, even when they are denied all access to the object. - Constant: SeTakeOwnershipPrivilege - ### Possible values - - User-defined list of accounts - - Not defined - ### Best practices - - Assigning this user right can be a security risk. Because owners of objects have full control of them, only assign this user right to trusted users. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - ### Default values - By default this setting is Administrators on domain controllers and on stand-alone servers. - The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - @@ -86,75 +65,35 @@ The following table lists the actual and effective default policy values. Defaul
-   - ## Policy management - - This section describes features, tools, and guidance to help you manage this policy. - A restart of the device is not required for this policy setting to be effective. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - Ownership can be taken by: - - An administrator. By default, the Administrators group is given the **Take ownership of files or other objects** user right. - - Anyone or any group who has the **Take ownership** user right on the object. - - A user who has the **Restore files and directories** user right. - Ownership can be transferred in the following ways: - - The current owner can grant the **Take ownership** user right to another user if that user is a member of a group defined in the current owner's access token. The user must take ownership to complete the transfer. - - An administrator can take ownership. - - A user who has the **Restore files and directories** user right can double-click **Other users and groups** and choose any user or group to assign ownership to. - ### Group Policy - Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: - 1. Local policy settings - 2. Site policy settings - 3. Domain policy settings - 4. OU policy settings - When a local setting is greyed out, it indicates that a GPO currently controls that setting. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Any users with the **Take ownership of files or other objects user right** can take control of any object, regardless of the permissions on that object, and then make any changes that they want to make to that object. Such changes could result in exposure of data, corruption of data, or a denial-of-service condition. - ### Countermeasure - Ensure that only the local Administrators group has the **Take ownership of files or other objects** user right. - ### Potential impact - None. Restricting the **Take ownership of files or other objects** user right to the local Administrators group is the default configuration. - ## Related topics - - [User Rights Assignment](user-rights-assignment.md) -   -   - - - - - diff --git a/windows/keep-secure/test-an-applocker-policy-by-using-test-applockerpolicy.md b/windows/keep-secure/test-an-applocker-policy-by-using-test-applockerpolicy.md index 288b71b44d..09ccf98b7d 100644 --- a/windows/keep-secure/test-an-applocker-policy-by-using-test-applockerpolicy.md +++ b/windows/keep-secure/test-an-applocker-policy-by-using-test-applockerpolicy.md @@ -2,52 +2,28 @@ title: Test an AppLocker policy by using Test-AppLockerPolicy (Windows 10) description: This topic for IT professionals describes the steps to test an AppLocker policy prior to importing it into a Group Policy Object (GPO) or another computer. ms.assetid: 048bfa38-6825-4a9a-ab20-776cf79f402a +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Test an AppLocker policy by using Test-AppLockerPolicy - - **Applies to** - - Windows 10 - This topic for IT professionals describes the steps to test an AppLocker policy prior to importing it into a Group Policy Object (GPO) or another computer. - The **Test-AppLockerPolicy** Windows PowerShell cmdlet can be used to determine whether any of the rules in your rule collections will be blocked on your reference computer or the computer on which you maintain policies. Perform the following steps on any computer where the AppLocker policies are applied. - Any user account can be used to complete this procedure. - **To test an AppLocker policy by using Test-AppLockerPolicy** - 1. Export the effective AppLocker policy. To do this, you must use the **Get-AppLockerPolicy** Windows PowerShell cmdlet. - 1. Open a Windows PowerShell command prompt window as an administrator. - 2. Use the **Get-AppLockerPolicy** cmdlet to export the effective AppLocker policy to an XML file: - `Get-AppLockerPolicy –Effective –XML > ` - 2. Use the **Get-ChildItem** cmdlet to specify the directory that you want to test, specify the **Test-AppLockerPolicy** cmdlet with the XML file from the previous step to test the policy, and use the **Export-CSV** cmdlet to export the results to a file to be analyzed: - `Get-ChildItem -Filter -Recurse | Convert-Path | Test-AppLockerPolicy –XMLPolicy -User -Filter | Export-CSV ` - The following shows example input for **Test-AppLockerPolicy**: - `PS C:\ Get-AppLockerPolicy –Effective –XML > C:\Effective.xml` - `PS C:\ Get-ChildItem 'C:\Program Files\Microsoft Office\' –filter *.exe –Recurse | Convert-Path | Test-AppLockerPolicy –XMLPolicy C:\Effective.xml –User contoso\zwie –Filter Denied,DeniedByDefault | Export-CSV C:\BlockedFiles.csv` - In the example, the effective AppLocker policy is exported to the file C:\\Effective.xml. The **Get-ChildItem** cmdlet is used to recursively gather path names for the .exe files in C:\\Program Files\\Microsoft Office\\. The XMLPolicy parameter specifies that the C:\\Effective.xml file is an XML AppLocker policy file. By specifying the User parameter, you can test the rules for specific users, and the **Export-CSV** cmdlet allows the results to be exported to a comma-separated file. In the example, `-FilterDenied,DeniedByDefault` displays only those files that will be blocked for the user under the policy. -   -   - - - - - diff --git a/windows/keep-secure/test-and-update-an-applocker-policy.md b/windows/keep-secure/test-and-update-an-applocker-policy.md index 5157667a41..4ae1a87af2 100644 --- a/windows/keep-secure/test-and-update-an-applocker-policy.md +++ b/windows/keep-secure/test-and-update-an-applocker-policy.md @@ -2,77 +2,37 @@ title: Test and update an AppLocker policy (Windows 10) description: This topic discusses the steps required to test an AppLocker policy prior to deployment. ms.assetid: 7d53cbef-078c-4d20-8b00-e821e33b6ea1 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Test and update an AppLocker policy - - **Applies to** - - Windows 10 - This topic discusses the steps required to test an AppLocker policy prior to deployment. - You should test each set of rules to ensure that the rules perform as intended. If you use Group Policy to manage AppLocker policies, complete the following steps for each Group Policy Object (GPO) where you have created AppLocker rules. Because AppLocker rules are inherited from linked GPOs, you should deploy all of the rules for simultaneous testing in all of your test GPOs. - ## Step 1: Enable the Audit only enforcement setting - - By using the **Audit only** enforcement setting, you can ensure that the AppLocker rules that you have created are properly configured for your organization. This setting can be enabled on the **Enforcement** tab of the **AppLocker Properties** dialog box. For the procedure to do this, see [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md). - ## Step 2: Configure the Application Identity service to start automatically - - Because AppLocker uses the Application Identity service to verify the attributes of a file, you must configure it to start automatically in any one GPO that applies AppLocker rules. For the procedure to do this, see [Configure the Application Identity Service](configure-the-application-identity-service.md). For AppLocker policies that are not managed by a GPO, you must ensure that the service is running on each PC in order for the policies to be applied. - ## Step 3: Test the policy - - Test the AppLocker policy to determine if your rule collection needs to be modified. Because you have created AppLocker rules, enabled the Application Identity service, and enabled the **Audit only** enforcement setting, the AppLocker policy should be present on all client PC that are configured to receive your AppLocker policy. - The **Test-AppLockerPolicy** Windows PowerShell cmdlet can be used to determine whether any of the rules in your rule collection will be blocked on your reference PCs. For the procedure to do this, see [Test an AppLocker policy by using Test-AppLockerPolicy](test-an-applocker-policy-by-using-test-applockerpolicy.md). - ## Step 4: Analyze AppLocker events - - You can either manually analyze AppLocker events or use the **Get-AppLockerFileInformation** Windows PowerShell cmdlet to automate the analysis. - **To manually analyze AppLocker events** - You can view the events either in Event Viewer or a text editor and then sort those events to perform an analysis, such as looking for patterns in application usage events, access frequencies, or access by user groups. If you have not configured an event subscription, then you will have to review the logs on a sampling of computers in your organization. For more information about using Event Viewer, see [Monitor application usage with AppLocker](monitor-application-usage-with-applocker.md). - **To analyze AppLocker events by using Get-AppLockerFileInformation** - You can use the **Get-AppLockerFileInformation** Windows PowerShell cmdlet to analyze AppLocker events from a remote computer. If an app is being blocked and should be allowed, you can use the AppLocker cmdlets to help troubleshoot the problem. - For both event subscriptions and local events, you can use the **Get-AppLockerFileInformation** cmdlet to determine which files have been blocked or would have been blocked (if you are using the **Audit only** enforcement mode) and how many times the event has occurred for each file. For the procedure to do this, see [Monitor Application Usage with AppLocker](monitor-application-usage-with-applocker.md). - After using **Get-AppLockerFileInformation** to determine how many times that a file would have been blocked from running, you should review your rule list to determine whether a new rule should be created for the blocked file or whether an existing rule is too strictly defined. Ensure that you check which GPO is currently preventing the file from running. To determine this, you can use the Group Policy Results Wizard to view rule names. - ## Step 5: Modify the AppLocker policy - - After you have identified which rules need to be edited or added to the policy, you can use the Group Policy Management Console to modify the AppLocker rules in the relevant GPOs. For AppLocker policies that are not managed by a GPO, you can use the Local Security Policy snap-in (secpol.msc). For info how to modify an AppLocker policy, see, [Edit an AppLocker policy](edit-an-applocker-policy.md). - ## Step 6: Repeat policy testing, analysis, and policy modification - - Repeat the previous steps 3–5 until all the rules perform as intended before applying enforcement. - ## Additional resources - - - For steps to perform other AppLocker policy tasks, see [Administer AppLocker](administer-applocker.md). -   -   - - - - - diff --git a/windows/keep-secure/tools-to-use-with-applocker.md b/windows/keep-secure/tools-to-use-with-applocker.md index bef26fd57a..ed1080877e 100644 --- a/windows/keep-secure/tools-to-use-with-applocker.md +++ b/windows/keep-secure/tools-to-use-with-applocker.md @@ -2,63 +2,33 @@ title: Tools to use with AppLocker (Windows 10) description: This topic for the IT professional describes the tools available to create and administer AppLocker policies. ms.assetid: db2b7cb3-7643-4be5-84eb-46ba551e1ad1 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Tools to use with AppLocker - - **Applies to** - - Windows 10 - This topic for the IT professional describes the tools available to create and administer AppLocker policies. - The following tools can help you administer the application control policies created by using AppLocker on the local device or by using Group Policy. For info about the basic requirements for using AppLocker, see [Requirements to use AppLocker](requirements-to-use-applocker.md). - - **AppLocker Local Security Policy MMC snap-in** - The AppLocker rules can be maintained by using the Local Security Policy snap-in (secpol.msc) of the Microsoft Management Console (MMC). For procedures to create, modify, and delete AppLocker rules, see [Working with AppLocker rules](working-with-applocker-rules.md). - - **Generate Default Rules tool** - AppLocker includes default rules for each rule collection accessed through the Local Security Policy snap-in. These rules are intended to help ensure that the files that are required for Windows to operate properly are allowed in an AppLocker rule collection. For info about how to use this tool, see [Create AppLocker default rules](create-applocker-default-rules.md). - - **Automatically Generate AppLocker Rules wizard** - By using the Local Security Policy snap-in, you can automatically generate rules for all files within a folder. The wizard will scan the specified folder and create the condition types that you choose for each file in that folder. For info about how to use this wizard, see [Run the Automatically Generate Rules wizard](run-the-automatically-generate-rules-wizard.md). - - **Group Policy** - You can edit an AppLocker policy by adding, changing, or removing rules by using the Group Policy Management Console (GPMC). - If you want additional features to manage AppLocker policies, such as version control, use Group Policy management software that allows you to create versions of Group Policy Objects (GPOs). An example of this type of software is the Advanced Group Policy Management feature from the Microsoft Desktop Optimization Pack. - - **Remote Server Administration Tools (RSAT)** - You can use a device with a supported operating system that has the Remote Server Administration Tools (RSAT) installed to create and maintain AppLocker policies. - - **Event Viewer** - The AppLocker log contains information about applications that are affected by AppLocker rules. For info about using Event Viewer to review the AppLocker logs, see [Using Event Viewer with AppLocker](using-event-viewer-with-applocker.md), and [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md). - - **AppLocker PowerShell cmdlets** - The AppLocker Windows PowerShell cmdlets are designed to streamline the administration of AppLocker policy. They can be used to help create, test, maintain, and troubleshoot an AppLocker policy. The cmdlets are intended to be used in conjunction with the AppLocker user interface that is accessed through the Local Security Policy snap-in and the GPMC. For information about the cmdlets, see the [AppLocker PowerShell Command Reference](http://technet.microsoft.com/library/hh847210.aspx). - ## Related topics - - [AppLocker technical reference](applocker-technical-reference.md) -   -   - - - - - diff --git a/windows/keep-secure/tpm-fundamentals.md b/windows/keep-secure/tpm-fundamentals.md index 13e2bd4415..26e6b4403e 100644 --- a/windows/keep-secure/tpm-fundamentals.md +++ b/windows/keep-secure/tpm-fundamentals.md @@ -2,100 +2,53 @@ title: TPM fundamentals (Windows 10) description: This topic for the IT professional provides a description of the components of the Trusted Platform Module (TPM 1.2 and TPM 2.0) and explains how they are used to mitigate dictionary attacks. ms.assetid: ac90f5f9-9a15-4e87-b00d-4adcf2ec3000 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # TPM fundamentals - - **Applies to** - - Windows 10 - This topic for the IT professional provides a description of the components of the Trusted Platform Module (TPM 1.2 and TPM 2.0) and explains how they are used to mitigate dictionary attacks. - A Trusted Platform Module (TPM) is a microchip designed to provide basic security-related functions, primarily involving encryption keys. The TPM is usually installed on the motherboard of a computer, and it communicates with the remainder of the system by using a hardware bus. - Computers that incorporate a TPM can create cryptographic keys and encrypt them so that they can only be decrypted by the TPM. This process, often called wrapping or binding a key, can help protect the key from disclosure. Each TPM has a master wrapping key, called the storage root key, which is stored within the TPM itself. The private portion of a storage root key or endorsement key that is created in a TPM is never exposed to any other component, software, process, or user. - You can specify whether encryption keys that are created by the TPM can be migrated or not. If you specify that they can be migrated, the public and private portions of the key can be exposed to other components, software, processes, or users. If you specify that encryption keys cannot be migrated, the private portion of the key is never exposed outside the TPM. - Computers that incorporate a TPM can also create a key that has not only been wrapped, but is also tied to certain platform measurements. This type of key can be unwrapped only when those platform measurements have the same values that they had when the key was created. This process is referred to as “sealing the key to the TPM.” Decrypting the key is called unsealing. The TPM can also seal and unseal data that is generated outside the TPM. With this sealed key and software, such as BitLocker Drive Encryption, you can lock data until specific hardware or software conditions are met. - With a TPM, private portions of key pairs are kept separate from the memory that is controlled by the operating system. Keys can be sealed to the TPM, and certain assurances about the state of a system (assurances that define the trustworthiness of a system) can be made before the keys are unsealed and released for use. Because the TPM uses its own internal firmware and logic circuits to process instructions, it does not rely on the operating system, and it is not exposed to vulnerabilities that might exist in the operating system or application software. - For info about which versions of Windows support which versions of the TPM, see [Trusted Platform Module technology overview](trusted-platform-module-overview.md). The features that are available in the versions are defined in specifications by the Trusted Computing Group (TCG). For more info, see the Trusted Platform Module page on the Trusted Computing Group website: [Trusted Platform Module](http://www.trustedcomputinggroup.org/developers/trusted_platform_module). - The following sections provide an overview of the technologies that support the TPM: - - [TPM-based Virtual Smart Card](#bkmk-vsc) - - [Measured Boot with support for attestation](#bkmk-measuredboot) - - [Automated provisioning and management of the TPM](#bkmk-autoprov) - - [TPM-based certificate storage](#bkmk-tpmcs) - - [Physical presence interface](#bkmk-physicalpresenceinterface) - - [TPM Cmdlets](#bkmk-tpmcmdlets) - - [TPM Owner Authorization Value](#bkmk-authvalue) - - [States of existence in a TPM](#bkmk-stateex) - - [Endorsement keys](#bkmk-endorsementkeys) - - [TPM Key Attestation](#bkmk-ketattestation) - - [How the TPM mitigates dictionary attacks](#bkmk-howtpmmitigates) - - [How do I check the state of my TPM?](#bkmk-checkstate) - - [What can I do if my TPM is in reduced functionality mode?](#bkmk-fixrfm) - The following topic describes the TPM Services that can be controlled centrally by using Group Policy settings: - [Trusted Platform Module Services Group Policy Settings](trusted-platform-module-services-group-policy-settings.md) - ## Automated provisioning and management of the TPM - - TPM provisioning can be streamlined to make it easier to deploy systems that are ready for BitLocker and other TPM-dependent features. These enhancements include simplifying the TPM state model to report **Ready**, **Ready with reduced functionality**, or **Not ready**. You can also automatically provision TPMs in the **Ready** state, remote provisioning to remove the requirement for the physical presence of a technician for the initial deployment. In addition, the TPM stack is available in the Windows Preinstallation Environment (Windows PE). - A number of management settings have been added for easier management and configuration of the TPM through Group Policy. The primary new settings include Active Directory-based backup of TPM owner authentication, the level of owner authentication that should be stored locally on the TPM, and the software-based TPM lockout settings for standard users. For more info about backing up owner authentication to Windows Server 2008 R2 AD DS domains, see [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md). - ## Measured Boot with support for attestation - - The Measured Boot feature provides antimalware software with a trusted (resistant to spoofing and tampering) log of all boot components. Antimalware software can use the log to determine whether components that ran before it are trustworthy versus infected with malware. It can also send the Measured Boot logs to a remote server for evaluation. The remote server can initiate remediation actions by interacting with software on the client or through out-of-band mechanisms, as appropriate. - ## TPM-based Virtual Smart Card - - The Virtual Smart Card emulates the functionality of traditional smart cards, but Virtual Smart Cards use the TPM chip that is available on an organization’s computers, rather than requiring the use of a separate physical smart card and reader. This greatly reduces the management and deployment cost of smart cards in an enterprise. To the end user, the Virtual Smart Card is always available on the computer. If a user needs to use more than one computer, a Virtual Smart Card must be issued to the user for each computer. A computer that is shared among multiple users can host multiple Virtual Smart Cards, one for each user. - ## TPM-based certificate storage - - The TPM can be used to protect certificates and RSA keys. The TPM key storage provider (KSP) provides easy, convenient use of the TPM as a way of strongly protecting private keys. The TPM KSP can be used to generate keys when an organization enrolls for certificates, and the KSP is managed by templates in the UI. The TPM can also be used to protect certificates that are imported from an outside source. TPM-based certificates can be used exactly as standard certificates with the added functionality that the certificate can never leave the TPM from which the keys were generated. The TPM can now be used for crypto-operations through Cryptography API: Next Generation (CNG). For more info, see [Cryptography API: Next Generation](http://msdn.microsoft.com/library/windows/desktop/aa376210.aspx). - ## TPM Owner Authorization Value - - For Windows 8 a change to how the TPM owner authorization value is stored in AD DS was implemented in the AD DS schema. The TPM owner authorization value is now stored in a separate object which is linked to the Computer object. This value was stored as a property in the Computer object itself for the default Windows Server 2008 R2 schemas. Windows Server 2012 domain controllers have the default schema to backup TPM owner authorization information in the separate object. If you are not upgrading your domain controller to Windows Server 2012 you need to extend the schema to support this change. If Active Directory backup of the TPM owner authorization value is enabled in a Windows Server 2008 R2 environment without extending the schema, the TPM provisioning will fail and the TPM will remain in a Not Ready state for computers running Windows 8. - If your computer is not being joined to a domain the TPM owner authorization value will be stored in the local computer registry. Using BitLocker to encrypt the operating system drive will protect the owner authorization value from being disclosed when the computer is at rest, but there is a risk that a malicious user could obtain the TPM owner authorization value when the computer is unlocked. Therefore, we recommend that in this situation you configure your computer to automatically lock after 30 seconds of inactivity. If automatic locking is not used, then you should consider removing full owner authorization from the computer registry. - **Registry information** - Registry key: HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\TPM - DWORD: OSManagedAuthLevel - @@ -122,40 +75,23 @@ DWORD: OSManagedAuthLevel
-   - **Note**   If the operating system managed TPM authentication setting is changed from "Full" to "Delegated" the full TPM owner authorization value will be regenerated and any copies of the original TPM owner authorization value will be invalid. If you are backing up the TPM owner authorization value to AD DS, the new owner authorization value will be automatically backed up to AD DS when it is changed. -   - ## TPM Cmdlets - - If you are using PowerShell to script and manage your computers, you can now manage the TPM using Windows PowerShell as well. To install the TPM cmdlets use the following command: - **dism /online /enable-feature /FeatureName:tpm-psh-cmdlets** - For details about the individual cmdlets, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx) - ## Physical presence interface - - The TCG specifications for TPMs require physical presence to perform some TPM administrative functions, such as turning on and turning off the TPM. Physical presence means a person must physically interact with the system and the TPM interface to confirm or reject changes to TPM status. This typically cannot be automated with scripts or other automation tools unless the individual OEM supplies them. Here are some are examples of TPM administrative tasks that require physical presence: - - Activating the TPM - Clearing the existing owner information from the TPM without the owner’s password - Deactivating the TPM - Disabling the TPM temporarily without the owner’s password - ## States of existence in a TPM - - For each of these TPM 1.2 states of existence, the TPM can transition into another state (for example, moving from disabled to enabled). The states are not exclusive. - These states of existence do not apply for Trusted Platform Module 2.0 because it cannot be turned off from within the operating system environment. - @@ -196,117 +132,56 @@ These states of existence do not apply for Trusted Platform Module 2.0 because
-   - **Important**   Applications cannot use the TPM until the state is enabled, activated, and owned. All operations are available only when the TPM is in this state. -   - The state of the TPM exists independently of the computer’s operating system. When the TPM is enabled, activated, and owned, the state of the TPM is preserved if the operating system is reinstalled. - ## Endorsement keys - - For a TPM to be usable by a trusted application, it must contain an endorsement key, which is an RSA key pair. The private half of the key pair is held inside the TPM, and it is never revealed or accessible outside the TPM. If the TPM does not contain an endorsement key, the application might cause the TPM to generate one automatically as part of the setup. - An endorsement key can be created at various points in the TPM’s lifecycle, but it needs to be created only once for the lifetime of the TPM. The existence of an endorsement key is a requirement before TPM ownership can be taken. - ## Key attestation - - TPM key attestation allows a certification authority to verify that a private key is actually protected by a TPM and that the TPM is one that the certification authority trusts. Endorsement keys which have been proven valid can be used to bind the user identity to a device. Moreover, the user certificate with a TPM attested key provides higher security assurance backed up by the non-exportability, anti-hammering, and isolation of keys provided by a TPM. - ## How the TPM mitigates dictionary attacks - - When a TPM processes a command, it does so in a protected environment, for example, a dedicated microcontroller on a discrete chip or a special hardware-protected mode on the main CPU. A TPM can be used to create a cryptographic key that is not disclosed outside the TPM, but is able to be used in the TPM after the correct authorization value is provided. - TPMs have dictionary attack logic that is designed to prevent brute force attacks that attempt to determine authorization values for using a key. The basic approach is for the TPM to allow only a limited number of authorization failures before it prevents more attempts to use keys and locks. Providing a failure count for individual keys is not technically practical, so TPMs have a global lockout when too many authorization failures occur. - Because many entities can use the TPM, a single authorization success cannot reset the TPM’s dictionary attack logic. This prevents an attacker from creating a key with a known authorization value and then using it to reset the TPM’s dictionary attack logic. Generally TPMs are designed to forget about authorization failures after a period of time so the TPM does not enter a lockout state unnecessarily. A TPM owner password can be used to reset the TPM’s lockout logic. - ### TPM 2.0 dictionary attack behavior - TPM 2.0 has well defined dictionary attack logic behavior. This is in contrast to TPM 1.2 for which the dictionary attack logic was set by the manufacturer, and the logic varied widely throughout the industry. - **Warning**   For the purposes of this topic, Windows 8 Certified Hardware also pertains to Windows 8.1 systems. The following references to “Windows” include these supported Windows versions. -   - For Windows 8 Certified Hardware systems with TPM 2.0, the TPM is configured by Windows to lock after 32 authorization failures and to forget one authorization failure every two hours. This means that a user could quickly attempt to use a key with the wrong authorization value 32 times. For each of the 32 attempts, the TPM records if the authorization value was correct or not. This inadvertently causes the TPM to enter a locked state after 32 failed attempts. - Attempts to use a key with an authorization value for the next two hours would not return success or failure; instead the response indicates that the TPM is locked. After two hours, one authorization failure is forgotten and the number of authorization failures remembered by the TPM drops to 31, so the TPM leaves the locked state and returns to normal operation. With the correct authorization value, keys could be used normally if no authorization failures occur during the next two hours. If a period of 64 hours elapses with no authorization failures, the TPM does not remember any authorization failures, and 32 failed attempts could occur again. - Windows 8 Certification does not require TPM 2.0 systems to forget about authorization failures when the system is fully powered off or when the system has hibernated. Windows does require that authorization failures are forgotten when the system is running normally, in a sleep mode, or in low power states other than off. If a Windows system with TPM 2.0 is locked, the TPM leaves lockout mode if the system is left on for two hours. - The dictionary attack logic for TPM 2.0 can be fully reset immediately by sending a reset lockout command to the TPM and providing the TPM owner password. By default, Windows automatically provisions TPM 2.0 and stores the TPM owner password for use by system administrators. - In some enterprise situations, the TPM owner authorization value is configured to be stored centrally in Active Directory, and it is not stored on the local system. An administrator can launch the TPM MMC and choose to reset the TPM lockout time. If the TPM owner password is stored locally, it is used to reset the lockout time. If the TPM owner password is not available on the local system, the administrator needs to provide it. If an administrator attempts to reset the TPM lockout state with the wrong TPM owner password, the TPM does not allow another attempt to reset the lockout state for 24 hours. - TPM 2.0 allows some keys to be created without an authorization value associated with them. These keys can be used when the TPM is locked. For example, BitLocker with a default TPM-only configuration is able to use a key in the TPM to start Windows, even when the TPM is locked. - ### Rationale behind the Windows 8.1 and Windows 8 defaults - Windows relies on the TPM 2.0 dictionary attack protection for multiple features. The defaults that are selected for Windows 8 balance trade-offs for different scenarios. - For example, when BitLocker is used with a TPM plus PIN configuration, it needs the number of PIN guesses to be limited over time. If the computer is lost, someone could make only 32 PIN guesses immediately, and then only one more guess every two hours. This totals about 4415 guesses per year. This makes a good standard for system administrators to determine how many PIN characters to use for BitLocker deployments. - The Windows TPM-based smart card, which is a virtual smart card, can be configured to allow sign in to the system. In contrast with physical smart cards, the sign-in process uses a TPM-based key with an authorization value. The following list shows the advantages of virtual smart cards: - Physical smart cards can enforce lockout for only the physical smart card PIN, and they can reset the lockout after the correct PIN is entered. With a virtual smart card, the TPM’s dictionary attack is not reset after a successful authentication. The allowed number of authorization failures before the TPM enters lockout includes many factors. - Hardware manufacturers and software developers have the option to use the security features of the TPM to meet their requirements. - The intent of selecting 32 failures as the lock-out threshold is so users rarely lock the TPM (even when learning to type new passwords or if they frequently lock and unlock their computers). If users lock the TPM, they must to wait two hours or use some other credential to sign in, such as a user name and password. - ## How do I check the state of my TPM? - - You can check the state of the TPM on a PC by running the Trusted Platform Module snap-in (tpm.msc). The **Status** heading tells you the state of your TPM. The TPM can be in one of the following states: **Ready for use**, **Ready for use, with reduced functionality**, and **Not ready for use**. To take advantage of most of the TPM features in Windows 10, the TPM must be **Ready for use**. - ## What can I do if my TPM is in reduced functionality mode? - - If your TPM is in reduced functionality mode, some features that rely on the TPM will not function correctly. This is most often caused by doing a clean installation of Windows 10 on a device where Windows 8.1, Windows 8, or Windows 7 had previously been installed on the same hardware. If your TPM is in reduced functionality mode, the Status heading in the Trusted Platform Module snap-in shows **The TPM is ready for use, with reduced functionality**. You can fix this by clearing the TPM. - **To clear the TPM** - 1. Open the Trusted Platform Module snap-in (tpm.msc). - 2. Click **Clear TPM**, and then click **Restart.** - 3. When the PC is restarting, you might be prompted to press a button on the keyboard to clear the TPM. - 4. After the PC restarts, your TPM will be automatically prepared for use by Windows 10. - **Note**   Clearing the TPM causes you to lose all TPM keys and data protected by those keys, such as a virtual smart card. You should not perform this procedure on a device you do not own, such as a work or school PC, without being instructed to do so by your IT administrator. -   - ## Additional resources - - [Trusted Platform Module Technology Overview](trusted-platform-module-overview.md) - [Trusted Platform Module Services Group Policy Settings](trusted-platform-module-services-group-policy-settings.md) - [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx) - [Schema Extensions for Windows Server 2008 R2 to support AD DS backup of TPM information from Windows 8 clients](ad-ds-schema-extensions-to-support-tpm-backup.md) - [TPM WMI providers](http://go.microsoft.com/fwlink/p/?LinkId=93478) - [Prepare your organization for BitLocker: Planning and Policies - TPM configurations](http://technet.microsoft.com/library/jj592683.aspx) -   -   - - - - - diff --git a/windows/keep-secure/tpm-recommendations.md b/windows/keep-secure/tpm-recommendations.md index 651ed1468f..b9e5bc42f5 100644 --- a/windows/keep-secure/tpm-recommendations.md +++ b/windows/keep-secure/tpm-recommendations.md @@ -2,59 +2,37 @@ title: TPM recommendations (Windows 10) description: This topic provides recommendations for Trusted Platform Module (TPM) technology for Windows 10. ms.assetid: E85F11F5-4E6A-43E7-8205-672F77706561 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # TPM recommendations - - **Applies to** - - Windows 10 - Windows 10 Mobile - Windows Server 2016 Technical Preview - Windows 10 IoT Core (IoT Core) - This topic provides recommendations for Trusted Platform Module (TPM) technology for Windows 10. - ## Overview - - Trusted Platform Module (TPM) technology is designed to provide hardware-based, security-related functions. It has a security-related crypto-processor that is designed to carry out cryptographic operations in a variety of devices and form factors. It includes multiple physical security mechanisms to help prevent malicious software from tampering with the security functions of the TPM. Some of the key advantages of using TPM technology are that you can: - 1. Generate, store, use, and protected cryptographic keys, 2. Use TPM technology for platform device authentication by using a unique endorsement key (EK), and 3. Help enhance platform integrity by taking and storing security measurements. - The most common TPM functions are used for system integrity measurements and for key creation and use. During the boot process of a system, the boot code that is loaded (including firmware and the operating system components) can be measured and recorded in the TPM. The integrity measurements can be used as evidence for how a system started and to make sure that a TPM-based key was used only when the correct software was used to boot the system. - Traditionally, TPMs have been discrete chips soldered to a computer’s motherboard. Such implementations allow the computer’s original equipment manufacturer (OEM) to evaluate and certify the TPM separate from the rest of the system. Although discrete TPM implementations are still common, they can be problematic for integrated devices that are small or have low power consumption. Some newer TPM implementations integrate TPM functionality into the same chipset as other platform components while still providing logical separation similar to discrete TPM chips. - TPMs are passive: they receive commands and return responses. To realize the full benefit of a TPM, the OEM must carefully integrate system hardware and firmware with the TPM to send it commands and react to its responses. TPMs were originally designed to provide security and privacy benefits to a platform’s owner and users, but newer versions can provide security and privacy benefits to the system hardware itself. Before it can be used for advanced scenarios, however, a TPM must be provisioned. Windows 10 automatically provisions a TPM, but if the user reinstalls the operating system, he or she may need to tell the operating system to explicitly provision the TPM again before it can use all the TPM’s features. - The Trusted Computing Group (TCG) is the nonprofit organization that publishes and maintains the TPM specification. The TCG exists to develop, define, and promote vendor-neutral, global industry standards that support a hardware-based root of trust for interoperable trusted computing platforms. The TCG also publishes the TPM specification as the international standard ISO/IEC 11889, using the Publicly Available Specification Submission Process that the Joint Technical Committee 1 defines between the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). - OEMs implement the TPM as a component in a trusted computing platform, such as a PC, tablet, or phone. Trusted computing platforms use the TPM to support privacy and security scenarios that software alone cannot achieve. For example, software alone cannot reliably report whether malware is present during the system startup process. The close integration between TPM and platform increases the transparency of the startup process and supports evaluating device health by enabling reliable measuring and reporting of the software that starts the device. Implementation of a TPM as part of a trusted computing platform provides a hardware root of trust—that is, it behaves in a trusted way. For example, if a key stored in a TPM has properties that disallow exporting the key, that key truly cannot leave the TPM. - The TCG designed the TPM as a low-cost, mass-market security solution that addresses the requirements of different customer segments. There are variations in the security properties of different TPM implementations just as there are variations in customer and regulatory requirements for different sectors. In public-sector procurement, for example, some governments have clearly defined security requirements for TPMs whereas others do not. - **Note**   Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -   - ## TPM 1.2 vs. 2.0 comparison - - From an industry standard, Microsoft has been an industry leader in moving and standardizing on TPM 2.0, which has many key realized benefits across algorithms, crypto, hierarchy, root keys, authorization and NV RAM. - ## Why TPM 2.0? - TPM 2.0 products and systems have important security advantages over TPM 1.2, including: - - The TPM 1.2 spec only allows for the use of RSA and the SHA-1 hashing algorithm. - For security reasons, some entities are moving away from SHA-1. Notably, NIST has required many federal agencies to move to SHA-256 as of 2014, and technology leaders, including Microsoft and Google have announced they will remove support for SHA-1 based signing or certificates in 2017. - TPM 2.0 **enables greater crypto agility** by being more flexible with respect to cryptographic algorithms. @@ -69,49 +47,31 @@ TPM 2.0 products and systems have important security advantages over TPM 1.2, in - For AMD chips, it is the AMD Security Processor - For ARM chips, it is a Trustzone Trusted Application (TA). - In the case of firmware TPM for desktop Windows systems, the chip vendor provides the firmware TPM implementation along with the other chip firmware to OEMs. - ## Discrete or firmware TPM? - Windows uses discrete and firmware TPM in the same way. Windows gains no functional advantage or disadvantage from either option. - From a security standpoint, discrete and firmware share the same characteristics; - - Both use hardware based secure execution. - Both use firmware for portions of the TPM functionality. - Both are equipped with tamper resistance capabilities. - Both have unique security limitations/risks. - For more info, see [fTPM: A Firmware-based TPM 2.0 Implementation](http://research.microsoft.com/apps/pubs/?id=258236). - ## Is there any importance for TPM for consumer? For end consumers, TPM is behind the scenes but still very relevant for Hello, Passport and in the future, many other key features in Windows 10. It offers the best Passport experience, helps encrypt passwords, secures streaming high quality 4K content and builds on our overall Windows 10 experience story for security as a critical pillar. Using Windows on a system with a TPM enables a deeper and broader level of security coverage. - ## TPM 2.0 Compliance for Windows 10 - ### Windows 10 for desktop editions (Home, Pro, Enterprise, and Education) - - As of July 28, 2016, all new device models, lines or series (or if you are updating the hardware configuration of a existing model, line or series with a major update, such as CPU, graphic cards) must implement and enable by default TPM 2.0 (details in section 3.7, https://msdn.microsoft.com/library/windows/hardware/dn915086(v=vs.85).aspx) ## Two implementation options: • Discrete TPM chip as a separate discrete component • Firmware TPM solution using Intel PTT (platform trust technology) or AMD - ### Windows 10 Mobile - - All devices shipping with Windows 10 Mobile must implement TPM 2.0 and ship with the TPM 2.0 enabled. - ### IoT Core - - TPM is optional on IoT Core. - ### Windows Server 2016 Technical Preview - - TPM is optional for Windows Server SKUs unless the SKU meets the additional qualification (AQ) criteria for the Host Guardian Services scenario in which case TPM 2.0 is required. - ## TPM and Windows Features - The following table defines which Windows features require TPM support. Some features are not applicable to Windows 7/8/8.1 and are noted accordingly. - @@ -223,16 +183,10 @@ The following table defines which Windows features require TPM support. Some fea
-   - ## Chipset options for TPM 2.0 - - There are a variety of TPM manufacturers for both discrete and firmware. - ### Discrete TPM - @@ -254,11 +208,8 @@ There are a variety of TPM manufacturers for both discrete and firmware.
-   - ### Firmware TPM - @@ -302,25 +253,11 @@ There are a variety of TPM manufacturers for both discrete and firmware.
-   - ## OEM Feedback and Status on TPM 2.0 system availability - - ### Certified TPM parts - Government customers and enterprise customers in regulated industries may have acquisition standards that require use of common certified TPM parts. As a result, OEMs, who provide the devices, may be required to use only certified TPM components on their commercial class systems. Discrete TPM 2.0 vendors have completion certification. - ### Windows 7 32-bit support - Even though Windows 7 shipped before the TPM 2.0 spec or products existed, Microsoft backported TPM 2.0 support to Windows 7 64-bit and released it in summer 2014 as a downloadable Windows hotfix for UEFI based Windows 7 systems. Microsoft is not currently planning to backport support to Windows 7 32-bit support. -   -   - - - - - diff --git a/windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md b/windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md index 6928c30828..24182d9e16 100644 --- a/windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md +++ b/windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md @@ -2,43 +2,30 @@ title: Troubleshoot Windows Defender in Windows 10 (Windows 10) description: IT professionals can review information about event IDs in Windows Defender for Windows 10 and see any relevant action they can take. ms.assetid: EE488CC1-E340-4D47-B50B-35BD23CB4D70 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library author: jasesso --- - # Troubleshoot Windows Defender in Windows 10 - - **Applies to** - - Windows 10 - IT professionals can review information about event IDs in Windows Defender for Windows 10 and see any relevant action they can take. - ## Windows Defender client event IDs - - This section provides the following information about Windows Defender client events: - - The text of the message as it appears in the event - The name of the source of the message - The symbolic name that identifies each message in the programming source code - Additional information about the message - Use the information in this table to help troubleshoot Windows Defender client events; these are located in the **Windows Event Viewer**, under **Windows Logs**. - **To view a Windows Defender client event** - 1. Open **Event Viewer**. 2. In the console tree, expand **Applications and Services Logs**, then **Microsoft**, then **Windows**, then **Windows Defender**. 3. Double-click on **Operational**. 4. In the details pane, view the list of individual events to find your event. 5. Click the event to see specific details about an event in the lower pane, under the **General** and **Details** tabs. - You can find a complete list of the Microsoft antimalware event IDs, the symbol, and the description of each ID in [Windows Server Antimalware Events TechNet](https://technet.microsoft.com/library/dn913615.aspx). - @@ -314,7 +301,6 @@ Description of the error.
Event ID: 1000

The Windows Defender client encountered an error, and the current scan has stopped. The scan might fail due to a client-side issue. This event record includes the scan ID, type of scan (antivirus, antispyware, antimalware), scan parameters, the user that started the scan, the error code, and a description of the error. -

To troubleshoot this event:

    @@ -1476,7 +1462,6 @@ Description of the error.
  1. Click the Update definitions button on the Update tab in Windows Defender. Update definitions in Windows Defender

    Or,

  2. Download the latest definitions from the Microsoft Malware Protection Center. -

    Note: The size of the definitions file downloaded from the Microsoft Malware Protection Center can exceed 60 MB and should not be used as a long-term solution for updating definitions.

@@ -1580,7 +1565,6 @@ Description of the error.
  • Click the Update definitions button on the Update tab in Windows Defender. Update definitions in Windows Defender

    Or,

  • Download the latest definitions from the Microsoft Malware Protection Center. -

    Note: The size of the definitions file downloaded from the Microsoft Malware Protection Center can exceed 60 MB and should not be used as a long-term solution for updating definitions.

  • @@ -1637,7 +1621,6 @@ Description of the error.
    1. Restart the computer and try again.
    2. Download the latest definitions from the Microsoft Malware Protection Center. -

      Note: The size of the definitions file downloaded from the Microsoft Malware Protection Center can exceed 60 MB and should not be used as a long-term solution for updating definitions.

    3. Contact Microsoft Technical Support. @@ -2469,9 +2452,6 @@ or Hang
    4. Try to restart the service.
      • For antimalware, antivirus and spyware, at an elevated command prompt, type net stop msmpsvc, and then type net start msmpsvc to restart the antimalware engine.
      • For the Network Inspection System, at an elevated command prompt, type net start nissrv, and then type net start nissrv to restart the Network Inspection System engine by using the NiSSRV.exe file. - - -
    5. @@ -2672,20 +2652,13 @@ Description of the error.
    - ## Windows Defender client error codes - - If Windows Defender experiences any issues it will usually give you an error code to help you troubleshoot the issue. Most often an error means there was a problem installing an update. - This section provides the following information about Windows Defender client errors. - - The error code - The possible reason for the error - Advice on what to do now - Use the information in these tables to help troubleshoot Windows Defender error codes. - @@ -2737,7 +2710,6 @@ Use the information in these tables to help troubleshoot Windows Defender error
  • Click the Update definitions button on the Update tab in Windows Defender. Update definitions in Windows Defender

    Or,

  • Download the latest definitions from the Microsoft Malware Protection Center. -

    Note: The size of the definitions file downloaded from the Microsoft Malware Protection Center can exceed 60 MB and should not be used as a long-term solution for updating definitions.

  • @@ -2981,7 +2953,6 @@ article.

  • Click the Update definitions button on the Update tab in Windows Defender. Update definitions in Windows Defender

    Or,

  • Download the latest definitions from the Microsoft Malware Protection Center. -

    Note: The size of the definitions file downloaded from the Microsoft Malware Protection Center can exceed 60 MB and should not be used as a long-term solution for updating definitions.

  • @@ -3286,18 +3257,8 @@ article.

    External error codes
    - ## Related topics - [Configure Windows Defender in Windows 10](configure-windows-defender-in-windows-10.md) - [Update and manage Windows Defender in Windows 10](get-started-with-windows-defender-for-windows-10.md) -   -   - - - - - diff --git a/windows/keep-secure/trusted-platform-module-overview.md b/windows/keep-secure/trusted-platform-module-overview.md index 8d48e9a658..02ba8d12dc 100644 --- a/windows/keep-secure/trusted-platform-module-overview.md +++ b/windows/keep-secure/trusted-platform-module-overview.md @@ -2,74 +2,41 @@ title: Trusted Platform Module Technology Overview (Windows 10) description: This topic for the IT professional describes the Trusted Platform Module (TPM) and how Windows uses it for access control and authentication. The topic provides links to other resources about the TPM. ms.assetid: face8932-b034-4319-86ac-db1163d46538 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Trusted Platform Module Technology Overview - - **Applies to** - - Windows 10 - This topic for the IT professional describes the Trusted Platform Module (TPM) and how Windows uses it for access control and authentication. The topic provides links to other resources about the TPM. - ## Feature description - - Trusted Platform Module (TPM) technology is designed to provide hardware-based, security-related functions. A TPM chip is a secure crypto-processor that is designed to carry out cryptographic operations. The chip includes multiple physical security mechanisms to make it tamper resistant, and malicious software is unable to tamper with the security functions of the TPM. Some of the key advantages of using TPM technology are that you can: - - Generate, store, and limit the use of cryptographic keys. - - Use TPM technology for platform device authentication by using the TPM’s unique RSA key, which is burned into itself. - - Help ensure platform integrity by taking and storing security measurements. - The most common TPM functions are used for system integrity measurements and for key creation and use. During the boot process of a system, the boot code that is loaded (including firmware and the operating system components) can be measured and recorded in the TPM. The integrity measurements can be used as evidence for how a system started and to make sure that a TPM-based key was used only when the correct software was used to boot the system. - TPM-based keys can be configured in a variety of ways. One option is to make a TPM-based key unavailable outside the TPM. This is good to mitigate phishing attacks because it prevents the key from being copied and used without the TPM. TPM-based keys can also be configured to require an authorization value to use them. If too many incorrect authorization guesses occur, the TPM will activate its dictionary attack logic and prevent further authorization value guesses. - Different versions of the TPM are defined in specifications by the Trusted Computing Group (TCG). For more information, consult the TCG Web site (). - Windows can automatically provision and manage the TPM. Group Policy settings can be configured to control whether the TPM owner authorization value is backed up in Active Directory. Because the TPM state persists across operating system installations, TPM information is stored in a location in Active Directory that is separate from computer objects. Depending on an enterprise’s security goals, Group Policy can be configured to allow or prevent local administrators from resetting the TPM’s dictionary attack logic. Standard users can use the TPM, but Group Policy controls limit how many authorization failures standard users can attempt so that one user is unable to prevent other users or the administrator from using the TPM. TPM technology can also be used as a virtual smart card and for secure certificate storage. With BitLocker Network Unlock, domain-joined computers are not prompted for a BitLocker PIN. - ## Practical applications - - Certificates can be installed or created on computers that are using the TPM. After a computer is provisioned, the RSA private key for a certificate is bound to the TPM and cannot be exported. The TPM can also be used as a replacement for smart cards, which reduces the costs associated with creating and disbursing smart cards. - Automated provisioning in the TPM reduces the cost of TPM deployment in an enterprise. New APIs for TPM management can determine if TPM provisioning actions require physical presence of a service technician to approve TPM state change requests during the boot process. - Antimalware software can use the boot measurements of the operating system start state to prove the integrity of a computer running Windows 10, Windows 8.1, Windows 8, Windows Server 2012 R2, or Windows Server 2012. These measurements include the launch of Hyper-V to test that datacenters using virtualization are not running untrusted hypervisors. With BitLocker Network Unlock, IT administrators can push an update without concerns that a computer is waiting for PIN entry. - The TPM has several Group Policy settings that can be used to manage how it is used. These settings can be used to manage the owner authorization value, the blocked TPM commands, the standard user lockout, and the backup of the TPM to AD DS. For more info, see [Trusted Platform Module Services Group Policy Settings](trusted-platform-module-services-group-policy-settings.md). - ## New and changed functionality - - For more info on new and changed functionality for Trusted Platform Module in Windows 10, see [What's new in Trusted Platform Module?](../whats-new/trusted-platform-module.md). - ## Device health attestation - - Device health attestation enables enterprises to establish trust based on hardware and software components of a managed device. With device heath attestation, you can configure an MDM server to query a health attestation service that will allow or deny a managed device access to a secure resource. - Some things that you can check on the device are: - - Is Data Execution Prevention supported and enabled? - Is BitLocker Drive Encryption supported and enabled? - Is SecureBoot supported and enabled? - **Note**  The device must be running Windows 10 and it must support at least TPM 2.0. -   - ## Supported versions - - @@ -104,27 +71,12 @@ Some things that you can check on the device are:
    -   - ## Additional Resources - - [TPM Fundamentals](tpm-fundamentals.md) - [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md) - [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx) - [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md) - [Prepare your organization for BitLocker: Planning and Policies - TPM configurations](http://technet.microsoft.com/library/jj592683.aspx) -   -   - - - - - diff --git a/windows/keep-secure/trusted-platform-module-services-group-policy-settings.md b/windows/keep-secure/trusted-platform-module-services-group-policy-settings.md index e03f0a8624..4b274eecc5 100644 --- a/windows/keep-secure/trusted-platform-module-services-group-policy-settings.md +++ b/windows/keep-secure/trusted-platform-module-services-group-policy-settings.md @@ -2,28 +2,19 @@ title: TPM Group Policy settings (Windows 10) description: This topic for the IT professional describes the Trusted Platform Module (TPM) Services that can be controlled centrally by using Group Policy settings. ms.assetid: 54ff1c1e-a210-4074-a44e-58fee26e4dbd +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # TPM Group Policy settings - - **Applies to** - - Windows 10 - This topic for the IT professional describes the Trusted Platform Module (TPM) Services that can be controlled centrally by using Group Policy settings. - ## - - The TPM Services Group Policy settings are located at: - **Computer Configuration\\Administrative Templates\\System\\Trusted Platform Module Services\\** - @@ -110,114 +101,63 @@ The TPM Services Group Policy settings are located at:
    -   - ### Turn on TPM backup to Active Directory Domain Services - This policy setting allows you to manage the Active Directory Domain Services (AD DS) backup of TPM owner information. - **Note**   This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). -   - TPM owner information includes a cryptographic hash of the TPM owner password. Certain TPM commands can be run only by the TPM owner. This hash authorizes the TPM to run these commands. - **Important**   To back up TPM owner information from a computer running Windows 10, Windows 8.1, or Windows 8, you might need to first set up appropriate schema extensions and access control settings on the domain so that the AD DS backup can succeed. Windows Server 2012 R2 and Windows Server 2012 include the required schema extensions by default. For more information, see [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md). -   - The TPM cannot be used to provide enhanced security features for BitLocker Drive Encryption and other applications without first setting an owner. To take ownership of the TPM with an owner password, on a local computer at the command prompt, type **tpm.msc** to open the TPM Management Console and select the action to **Initialize TPM**. If the TPM owner information is lost or is not available, limited TPM management is possible by running **tpm.msc**. - If you enable this policy setting, TPM owner information will be automatically and silently backed up to AD DS when you use Windows to set or change a TPM owner password. When this policy setting is enabled, a TPM owner password cannot be set or changed unless the computer is connected to the domain and the AD DS backup succeeds. - If you disable or do not configure this policy setting, TPM owner information will not be backed up to AD DS. - ### Configure the list of blocked TPM commands - This policy setting allows you to manage the Group Policy list of Trusted Platform Module (TPM) commands that are blocked by Windows. - **Note**   This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). -   - If you enable this policy setting, Windows will block the specified commands from being sent to the TPM on the computer. TPM commands are referenced by a command number. For example, command number 129 is **TPM\_OwnerReadInternalPub**, and command number 170 is **TPM\_FieldUpgrade**. To find the command number that is associated with each TPM command, at the command prompt, type **tpm.msc**to open the TPM Management Console and navigate to the **Command Management** section. - If you disable or do not configure this policy setting, only those TPM commands that are specified through the default or local lists can be blocked by Windows. The default list of blocked TPM commands is preconfigured by Windows. - - You can view the default list by typing **tpm.msc** at the command prompt, navigating to the **Command Management** section, and exposing the **On Default Block List** column. - - The local list of blocked TPM commands is configured outside of Group Policy by running the TPM Management Console or scripting using the **Win32\_Tpm** interface. - For information how to enforce or ignore the default and local lists of blocked TPM commands, see - - [Ignore the default list of blocked TPM commands](#bkmk-tpmgp-idlb) - - [Ignore the local list of blocked TPM commands](#bkmk-tpmgp-illb) - ### Ignore the default list of blocked TPM commands - This policy setting allows you to enforce or ignore the computer's default list of blocked Trusted Platform Module (TPM) commands. - **Note**   This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). -   - The default list of blocked TPM commands is preconfigured by Windows. You can view the default list by typing **tpm.msc** at the command prompt to open the TPM Management Console, navigating to the **Command Management** section, and exposing the **On Default Block List** column. Also see the related policy setting, [Configure the list of blocked TPM commands](#bkmk-tpmgp-clbtc). - If you enable this policy setting, the Windows operating system will ignore the computer's default list of blocked TPM commands, and it will block only those TPM commands that are specified by Group Policy or the local list. - If you disable or do not configure this policy setting, Windows will block the TPM commands in the default list, in addition to the commands that are specified by Group Policy and the local list of blocked TPM commands. - ### Ignore the local list of blocked TPM commands - This policy setting allows you to enforce or ignore the computer's local list of blocked Trusted Platform Module (TPM) commands. - **Note**   This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). -   - The local list of blocked TPM commands is configured outside of Group Policy by typing **tpm.msc** at the command prompt to open the TPM Management Console, or scripting using the **Win32\_Tpm** interface. (The default list of blocked TPM commands is preconfigured by Windows.) Also see the related policy setting to **Configure the list of blocked TPM commands**. - If you enable this policy setting, the Windows operating system will ignore the computer's local list of blocked TPM commands, and it will block only those TPM commands that are specified by Group Policy or the default list. - If you disable or do not configure this policy setting, Windows will block the TPM commands in the local list, in addition to the commands that are specified in Group Policy and the default list of blocked TPM commands. - ### Configure the level of TPM owner authorization information available to the operating system - This policy setting configures how much of the TPM owner authorization information is stored in the registry of the local computer. Depending on the amount of TPM owner authorization information that is stored locally, the Windows operating system and TPM-based applications can perform certain actions in the TPM that require TPM owner authorization without requiring the user to enter the TPM owner password. - **Note**   This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). -   - There are three TPM owner authentication settings that are managed by the Windows operating system. You can choose a value of **Full**, **Delegate**, or **None**. - - **Full**   This setting stores the full TPM owner authorization, the TPM administrative delegation blob, and the TPM user delegation blob in the local registry. With this setting, you can use the TPM without requiring remote or external storage of the TPM owner authorization value. This setting is appropriate for scenarios that do not require you to reset the TPM anti-hammering logic or change the TPM owner authorization value. Some TPM-based applications may require that this setting is changed before features that depend on the TPM anti-hammering logic can be used. - - **Delegated**   This setting stores only the TPM administrative delegation blob and the TPM user delegation blob in the local registry. This setting is appropriate for use with TPM-based applications that depend on the TPM antihammering logic. When you use this setting, we recommend using external or remote storage for the full TPM owner authorization value—for example, backing up the value in Active Directory Domain Services (AD DS). - - **None**   This setting provides compatibility with previous operating systems and applications. You can also use it for scenarios when TPM owner authorization cannot be stored locally. Using this setting might cause issues with some TPM-based applications. - **Note**   If the operating system managed TPM authentication setting is changed from **Full** to **Delegated**, the full TPM owner authorization value will be regenerated, and any copies of the previously set TPM owner authorization value will be invalid. If you are backing up the TPM owner authorization value to AD DS, the new owner authorization value is automatically backed up to AD DS when it is changed. -   - **Registry information** - Registry key: HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\TPM - DWORD: OSManagedAuthLevel - The following table shows the TPM owner authorization values in the registry. - @@ -244,96 +184,48 @@ The following table shows the TPM owner authorization values in the registry.
    -   - If you enable this policy setting, the Windows operating system will store the TPM owner authorization in the registry of the local computer according to the TPM authentication setting you choose. - If you disable or do not configure this policy setting, and the **Turn on TPM backup to Active Directory Domain Services** policy setting is also disabled or not configured, the default setting is to store the full TPM authorization value in the local registry. If this policy is disabled or not configured, and the **Turn on TPM backup to Active Directory Domain Services** policy setting is enabled, only the administrative delegation and the user delegation blobs are stored in the local registry. - ### Standard User Lockout Duration - This policy setting allows you to manage the duration in minutes for counting standard user authorization failures for Trusted Platform Module (TPM) commands requiring authorization. An authorization failure occurs each time a standard user sends a command to the TPM and receives an error response that indicates an authorization failure occurred. Authorization failures that are older than the duration you set are ignored. If the number of TPM commands with an authorization failure within the lockout duration equals a threshold, a standard user is prevented from sending commands that require authorization to the TPM. - **Note**   This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). -   - The TPM is designed to protect itself against password guessing attacks by entering a hardware lockout mode when it receives too many commands with an incorrect authorization value. When the TPM enters a lockout mode, it is global for all users (including administrators) and for Windows features such as BitLocker Drive Encryption. - The number of authorization failures that a TPM allows and how long it stays locked vary by TPM manufacturer. Some TPMs may enter lockout mode for successively longer periods of time, with fewer authorization failures, depending on past failures. Some TPMs may require a system restart to exit the lockout mode. Other TPMs may require that the system is on so enough clock cycles elapse before the TPM exits the lockout mode. - This setting helps administrators prevent the TPM hardware from entering a lockout mode by slowing the speed at which standard users can send commands that require authorization to the TPM. - For each standard user, two thresholds apply. Exceeding either threshold prevents the user from sending a command that requires authorization to the TPM. Use the following policy settings to set the lockout duration: - - [Standard User Individual Lockout Threshold](#bkmk-individual)   This value is the maximum number of authorization failures that each standard user can have before the user is not allowed to send commands that require authorization to the TPM. - - [Standard User Total Lockout Threshold](#bkmk-total)   This value is the maximum total number of authorization failures that all standard users can have before all standard users are not allowed to send commands that require authorization to the TPM. - An administrator with the TPM owner password can fully reset the TPM's hardware lockout logic by using the TPM Management Console (tpm.msc). Each time an administrator resets the TPM's hardware lockout logic, all prior standard user TPM authorization failures are ignored. This allows standard users to immediately use the TPM normally. - If you do not configure this policy setting, a default value of 480 minutes (8 hours) is used. - ### Standard User Individual Lockout Threshold - This policy setting allows you to manage the maximum number of authorization failures for each standard user for the Trusted Platform Module (TPM). This value is the maximum number of authorization failures that each standard user can have before the user is not allowed to send commands that require authorization to the TPM. If the number of authorization failures for the user within the duration that is set for the **Standard User Lockout Duration** policy setting equals this value, the standard user is prevented from sending commands that require authorization to the Trusted Platform Module (TPM). - **Note**   This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). -   - This setting helps administrators prevent the TPM hardware from entering a lockout mode by slowing the speed at which standard users can send commands that require authorization to the TPM. - An authorization failure occurs each time a standard user sends a command to the TPM and receives an error response indicating an authorization failure occurred. Authorization failures older than the duration are ignored. - An administrator with the TPM owner password can fully reset the TPM's hardware lockout logic by using the TPM Management Console (tpm.msc). Each time an administrator resets the TPM's hardware lockout logic, all prior standard user TPM authorization failures are ignored. This allows standard users to immediately use the TPM normally. - If you do not configure this policy setting, a default value of 4 is used. A value of zero means that the operating system will not allow standard users to send commands to the TPM, which might cause an authorization failure. - ### Standard User Total Lockout Threshold - This policy setting allows you to manage the maximum number of authorization failures for all standard users for the Trusted Platform Module (TPM). If the total number of authorization failures for all standard users within the duration that is set for the **Standard User Lockout Duration** policy equals this value, all standard users are prevented from sending commands that require authorization to the Trusted Platform Module (TPM). - **Note**   This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). -   - This setting helps administrators prevent the TPM hardware from entering a lockout mode because it slows the speed standard users can send commands requiring authorization to the TPM. - An authorization failure occurs each time a standard user sends a command to the TPM and receives an error response indicating an authorization failure occurred. Authorization failures older than the duration are ignored. - For each standard user two thresholds apply. Exceeding either threshold will prevent the standard user from sending a command to the TPM that requires authorization. - 1. The standard user individual lockout value is the maximum number of authorization failures each standard user may have before the user is not allowed to send commands requiring authorization to the TPM. - 2. The standard user total lockout threshold value is the maximum total number of authorization failures all standard users may have before all standard users are not allowed to send commands requiring authorization to the TPM. - The TPM is designed to protect itself against password guessing attacks by entering a hardware lockout mode when it receives too many commands with an incorrect authorization value. When the TPM enters a lockout mode, it is global for all users (including administrators) and for Windows features such as BitLocker Drive Encryption.. - The number of authorization failures a TPM allows and how long it stays locked out vary by TPM manufacturer. Some TPMs may enter lockout mode for successively longer periods of time with fewer authorization failures depending on past failures. Some TPMs may require a system restart to exit the lockout mode. Other TPMs may require the system to be on so enough clock cycles elapse before the TPM exits the lockout mode. - An administrator with the TPM owner password can fully reset the TPM's hardware lockout logic by using the TPM Management Console (tpm.msc). Each time an administrator resets the TPM's hardware lockout logic, all prior standard user TPM authorization failures are ignored. This allows standard users to immediately use the TPM normally. - If you do not configure this policy setting, a default value of 9 is used. A value of zero means that the operating system will not allow standard users to send commands to the TPM, which might cause an authorization failure. - ## Additional resources - - [Trusted Platform Module Technology Overview](trusted-platform-module-overview.md) - [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx) - [Prepare your organization for BitLocker: Planning and Policies - TPM configurations](http://technet.microsoft.com/library/jj592683.aspx) -   -   - - - - - diff --git a/windows/keep-secure/types-of-attacks-for-volume-encryption-keys.md b/windows/keep-secure/types-of-attacks-for-volume-encryption-keys.md index b9da17ac68..057ed8dad2 100644 --- a/windows/keep-secure/types-of-attacks-for-volume-encryption-keys.md +++ b/windows/keep-secure/types-of-attacks-for-volume-encryption-keys.md @@ -2,159 +2,81 @@ title: Types of attacks for volume encryption keys (Windows 10) description: There are many ways Windows helps protect your organization from attacks, including Unified Extensible Firmware Interface (UEFI) secure boot, Trusted Platform Module (TPM), Group Policy, complex passwords, and account lockouts. ms.assetid: 405060a9-2009-44fc-9f84-66edad32c6bc +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Types of attacks for volume encryption keys - - **Applies to** - - Windows 10 - There are many ways Windows helps protect your organization from attacks, including Unified Extensible Firmware Interface (UEFI) secure boot, Trusted Platform Module (TPM), Group Policy, complex passwords, and account lockouts. - The next few sections describe each type of attack that could be used to compromise a volume encryption key, whether for BitLocker or a non-Microsoft encryption solution. After an attacker has compromised a volume encryption key, the attacker can read data from your system drive or even install malware while Windows is offline. Each section begins with a graphical overview of the attack’s strengths and weaknesses as well as suggested mitigations. - ### Bootkit and rootkit attacks - Rootkits are a sophisticated and dangerous type of malware that runs in kernel mode, using the same privileges as the operating system. Because rootkits have the same or possibly even more rights than the operating system, they can completely hide themselves from Windows and even an antimalware solution. Often, rootkits are part of an entire suite of malware that can bypass local logins, record passwords, transfer private files, and capture cryptography keys. - Different types of bootkits and rootkits load at different software levels: - - **Kernel level.** Rootkits running at the kernel level have the highest privilege in the operating system. They may be able to inject malicious code or replace portions of the core operating system, including both the kernel and device drivers. - - **Application level.** These rootkits are aimed to replace application binaries with malicious code, such as a Trojan, and can even modify the behavior of existing applications. - - **Library level.** The purpose of library-level rootkits is to hook, patch, or replace system calls with malicious code that can hide the malware’s presence. - - **Hypervisor level.** Hypervisor rootkits target the boot sequence. Their primary purpose is to modify the boot sequence to load themselves as a hypervisor. - - **Firmware level.** These rootkits overwrite the PC’s BIOS firmware, giving the malware low-level access and potentially the ability to install or hide malware, even if it’s cleaned or removed from the hard disk. - Regardless of the operating system or encryption method, rootkits have access to confidential data once installed. Application-level rootkits can read any files the user can access, bypassing volume-level encryption. Kernel-, library-, hypervisor-, and firmware-level rootkits have direct access to system files on encrypted volumes and can also retrieve an encryption key from memory. - Windows offers substantial protection from bootkits and rootkits, but it is possible to bypass operating system security when an attacker has physical access to the device and can install the malware to the device while Windows is offline. For example, an attacker might boot a PC from a USB flash drive containing malware that starts before Windows. The malware can replace system files or the PC’s firmware or simply start Windows under its control. - To sufficiently protect a PC from boot and rootkits, devices must use pre-boot authentication or Secure Boot, or the encryption solution must use the device’s Trusted Platform Module (TPM) as a means of monitoring the integrity of the end-to-end boot process. Pre-boot authentication is available for any device, regardless of the hardware, but because it is inconvenient to users, it should be used only to mitigate threats that are applicable to the device. On devices with Secure Boot enabled, you do not need to use pre-boot authentication to protect against boot and rootkit attacks. - Although password protection of the UEFI configuration is important for protecting a device’s configuration and preventing an attacker from disabling Secure Boot, use of a TPM and its Platform Configuration Register (PCR) measurements (PCR7) to ensure that the system’s bootloader (whether a Windows or non-Microsoft encryption solution) is tamper free and the first code to start on the device is critical. An encryption solution that doesn’t use a device’s TPM to protect its components from tampering may be unable to protect itself from bootkit-level infections that could log a user’s password or acquire encryption keys. - For this reason, when BitLocker is configured on devices that include a TPM, the TPM and its PCRs are always used to secure and confirm the integrity of the pre–operating system environment before making encrypted volumes accessible. - Any changes to the UEFI configuration invalidates the PCR7 and require the user to enter the BitLocker recovery key. Because of this feature, it’s not critical to password-protect your UEFI configuration. If an attacker successfully turns off Secure Boot or otherwise changes the UEFI configuration, they will need to enter the BitLocker recovery key, but UEFI password protection is a best practice and is still required for systems not using a TPM (such as non-Microsoft alternatives). - ### Brute-force Sign-in Attacks - Attackers can find any password if you allow them to guess enough times. The process of trying millions of different passwords until you find the right one is known as a *brute-force sign-in attack*. In theory, an attacker could obtain any password by using this method. - Three opportunities for brute-force attacks exist: - - **Against the pre-boot authenticator.** An attacker could attack the device directly by attempting to guess the user’s BitLocker PIN or an equivalent authenticator. The TPM mitigates this approach by invoking an anti-hammering lockout capability that requires the user to wait until the lockout period ends or enter the BitLocker recovery key. - - **Against the recovery key.** An attacker could attempt to guess the 48-digit BitLocker recovery key. Even without a lockout period, the key is long enough to make brute-force attacks impractical. Specifically, the BitLocker recovery key has 128 bits of entropy; thus, the average brute-force attack would succeed after 18,446,744,073,709,551,616 guesses. If an attacker could guess 1 million passwords per second, the average brute-force attack would require more than 580,000 years to be successful. - - **Against the operating system sign-in authenticator.** An attacker can attempt to guess a valid user name and password. Windows implements a delay between password guesses, slowing down brute-force attacks. In addition, all recent versions of Windows allow administrators to require complex passwords and password lockouts. Similarly, administrators can use Microsoft Exchange ActiveSync policy or Group Policy to configure Windows 8.1 and Windows 8 to automatically restart and require the user to enter the BitLocker 48-digit recovery key after a specified number of invalid password attempts. When these settings are enabled and users follow best practices for complex passwords, brute-force attacks against the operating system sign-in are impractical. - In general, brute-force sign-in attacks are not practical against Windows when administrators enforce complex passwords and account lockouts. - ### Direct Memory Access Attacks - Direct memory access (DMA) allows certain types of hardware devices to communicate directly with a device’s system memory. For example, if you use Thunderbolt to connect another device to your computer, the second device automatically has Read and Write access to the target computer’s memory. - Unfortunately, DMA ports don’t use authentication and access control to protect the contents of the computer’s memory. Whereas Windows can often prevent system components and apps from reading and writing to protected parts of memory, a device can use DMA to read any location in memory, including the location of any encryption keys. - DMA attacks are relatively easy to execute and require little technical skills. Anyone can download a tool from the Internet, such as those made by [Passware](http://www.lostpassword.com/), [ElcomSoft](http://elcomsoft.com/), and others, and then use a DMA attack to read confidential data from a PC’s memory. Because encryption solutions store their encryption keys in memory, they can be accessed by a DMA attack. - Not all port types are vulnerable to DMA attacks. USB in particular does not allow DMA, but devices that have any of the following port types are vulnerable: - - FireWire - - Thunderbolt - - ExpressCard - - PCMCIA - - PCI - - PCI-X - - PCI Express - To perform a DMA attack, attackers typically connect a second PC that is running a memory-scanning tool (for example, Passware, ElcomSoft) to the FireWire or Thunderbolt port of the target computer. When connected, the software scans the system memory of the target and locates the encryption key. Once acquired, the key can be used to decrypt the drive and read or modify its contents. - A much more efficient form of this attack exists in theory: An attacker crafts a custom FireWire or Thunderbolt device that has the DMA attack logic programmed on it. Now, the attacker simply needs to physically connect the device. If the attacker does not have physical access, they could disguise it as a free USB flash drive and distribute it to employees of a target organization. When connected, the attacking device could use a DMA attack to scan the PC’s memory for the encryption key. It could then transmit the key (or any data in the PC’s memory) using the PC’s Internet connection or its own wireless connection. This type of attack would require an extremely high level of sophistication, because it requires that the attacker create a custom device (devices of these types are not readily available in the marketplace at this time). - Today, one of the most common uses for DMA ports on Windows devices is for developer debugging, a task that some developers need to perform and one that few consumers will ever perform. Because USB; DisplayPort; and other, more secure port types satisfy consumers, most new mobile PCs do not include DMA ports. Microsoft’s view is that because of the inherent security risks of DMA ports, they do not belong on mobile devices, and Microsoft has prohibited their inclusion on any InstantGo-certified devices. InstantGo devices offer mobile phone–like power management and instant-on capabilities; at the time of writing, they are primarily found in Windows tablets. - DMA-based expansion slots are another avenue of attack, but these slots generally appear only on desktop PCs that are designed for expansion. Organizations can use physical security to prevent outside attacks against their desktop PCs. In addition, a DMA attack on the expansion slot would require a custom device; as a result, an attacker would most likely insert an interface with a traditional DMA port (for example, FireWire) into the slot to attack the PC. - To mitigate a port-based DMA attack an administrator can configure policy settings to disable FireWire and other device types that have DMA. Also, many PCs allow those devices to be disabled by using firmware settings. Although the need for pre-boot authentication can be eliminated at the device level or through Windows configuration, the BitLocker pre-boot authentication feature is still available when needed. When used, it successfully mitigates all types of DMA port and expansion slot attacks on any type of device. - ### Hyberfil.sys Attacks - The hyberfil.sys file is the Windows hibernation file. It contains a snapshot of system memory that is generated when a device goes into hibernation and includes the encryption key for BitLocker and other encryption technologies. Attackers have claimed that they have successfully extracted encryption keys from the hyberfil.sys file. - Like the DMA port attack discussed in the previous section, tools are available that can scan the hyberfile.sys file and locate the encryption key, including a tool made by [Passware](http://www.lostpassword.com/). Microsoft does not consider Windows to be vulnerable to this type of attack, because Windows stores the hyberfil.sys file within the encrypted system volume. As a result, the file would be accessible only if the attacker had both physical and sign-in access to the PC. When an attacker has sign-in access to the PC, there are few reasons for the attacker to decrypt the drive, because they would already have full access to the data within it. - In practice, the only reason an attack on hyberfil.sys would grant an attacker additional access is if an administrator had changed the default Windows configuration and stored the hyberfil.sys file on an unencrypted drive. By default, Windows 10 is designed to be secure against this type of attack. - ### Memory Remanence Attacks - A memory remanence attack is a side-channel attack that reads the encryption key from memory after restarting a PC. Although a PC’s memory is often considered to be cleared when the PC is restarted, memory chips don’t immediately lose their memory when you disconnect power. Therefore, an attacker who has physical access to the PC’s memory might be able to read data directly from the memory—including the encryption key. - When performing this type of cold boot attack, the attacker accesses the PC’s physical memory and recovers the encryption key within a few seconds or minutes of disconnecting power. This type of attack was demonstrated by researchers at [Princeton University](http://www.youtube.com/watch?v=JDaicPIgn9U). With the encryption key, the attacker would be able to decrypt the drive and access its files. - To acquire the keys, attackers follow this process: - 1. Freeze the PC’s memory. For example, an attacker can freeze the memory to −50°C by spraying it with aerosol air duster spray. - 2. Restart the PC. - 3. Instead of restarting Windows, boot to another operating system. Typically, this is done by connecting a bootable flash drive or loading a bootable DVD. - 4. The bootable media loads the memory remanence attack tools, which the attacker uses to scan the system memory and locate the encryption keys. - 5. The attacker uses the encryption keys to access the drive’s data. - If the attacker is unable to boot the device to another operating system (for example, if bootable flash drives have been disabled or Secure Boot is enabled), the attacker can attempt to physically remove the frozen memory from the device and attach it to a different, possibly identical device. Fortunately, this process has proven extremely unreliable, as evidenced by the Defence Research and Development Canada (DRDC) Valcartier group’s analysis (see [An In-depth Analysis of the Cold Boot Attack](http://www.dtic.mil/cgi-bin/GetTRDoc?AD=ADA545078)). On an increasing portion of modern devices, this type of attack is not even possible, because memory is soldered directly to the motherboard. - Although Princeton’s research proved that this type of attack was possible on devices that have removable memory, device hardware has changed since the research was published in 2008: - - Secure Boot prevents the malicious tools that the Princeton attack depends on from running on the target device. - - Windows systems with BIOS or UEFI can be locked down with a password, and booting to a USB drive can be prevented. - - If booting to USB is required on the device, it can be limited to starting trusted operating systems by using Secure Boot. - - The discharge rates of memory are highly variable among devices, and many devices have memory that is completely immune to memory remanence attacks. - - Increased density of memory diminishes their remanence properties and reduces the likelihood that the attack can be successfully executed, even when memory is physically removed and placed in an identical system where the system’s configuration may enable booting to the malicious tools. - Because of these factors, this type of attack is rarely possible on modern devices. Even in cases where the risk factors exist on legacy devices, attackers will find the attack unreliable. For detailed info about the practical uses for forensic memory acquisition and the factors that make a computer vulnerable or resistant to memory remanence attacks, read [An In-depth Analysis of the Cold Boot Attack](http://www.dtic.mil/cgi-bin/GetTRDoc?AD=ADA545078). - The BitLocker pre-boot authentication feature can successfully mitigate memory remanence attacks on most devices, but you can also mitigate such attacks by protecting the system UEFI or BIOS and prevent the PC from booting from external media (such as a USB flash drive or DVD). The latter option is often a better choice, because it provides sufficient protection without inconveniencing users with pre-boot authentication. - ## See also - - - [BitLocker countermeasures](bitlocker-countermeasures.md) - - [Choose the right BitLocker countermeasure](choose-the-right-bitlocker-countermeasure.md) - - [Protect BitLocker from pre-boot attacks](protect-bitlocker-from-pre-boot-attacks.md) - - [BitLocker overview](bitlocker-overview.md) -   -   - - - - - diff --git a/windows/keep-secure/understand-applocker-enforcement-settings.md b/windows/keep-secure/understand-applocker-enforcement-settings.md index 7b977fc57a..f62646c2e9 100644 --- a/windows/keep-secure/understand-applocker-enforcement-settings.md +++ b/windows/keep-secure/understand-applocker-enforcement-settings.md @@ -2,23 +2,17 @@ title: Understand AppLocker enforcement settings (Windows 10) description: This topic describes the AppLocker enforcement settings for rule collections. ms.assetid: 48773007-a343-40bf-8961-b3ff0a450d7e +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Understand AppLocker enforcement settings - - **Applies to** - - Windows 10 - This topic describes the AppLocker enforcement settings for rule collections. - Rule enforcement is applied only to a collection of rules, not to individual rules. AppLocker divides the rules into four collections: executable files, Windows Installer files, scripts, and DLL files. For more info about rule collections, see [Understanding AppLocker rule collections](understanding-applocker-rule-collections.md). By default, if enforcement is not configured and rules are present in a rule collection, those rules are enforced. The following table details the three AppLocker rule enforcement settings in Group Policy for each rule collection. - @@ -45,18 +39,8 @@ Rule enforcement is applied only to a collection of rules, not to individual rul
    -   - For the AppLocker policy to be enforced on a device, the Application Identity service must be running. For more info about the Application Identity service, see [Configure the Application Identity service](configure-the-application-identity-service.md). - When AppLocker policies from various GPOs are merged, the enforcement modes are merged by using the standard Group Policy order of inheritance, which is local, domain, site, and organizational unit (OU). The Group Policy setting that was last written or applied by order of inheritance is used for the enforcement mode, and all rules from linked GPOs are applied. -   -   - - - - - diff --git a/windows/keep-secure/understand-applocker-policy-design-decisions.md b/windows/keep-secure/understand-applocker-policy-design-decisions.md index d34824f7d7..ea6833ec44 100644 --- a/windows/keep-secure/understand-applocker-policy-design-decisions.md +++ b/windows/keep-secure/understand-applocker-policy-design-decisions.md @@ -2,43 +2,27 @@ title: Understand AppLocker policy design decisions (Windows 10) description: This topic for the IT professional lists the design questions, possible answers, and ramifications of the decisions when you plan a deployment of application control policies by using AppLocker within a Windows operating system environment. ms.assetid: 3475def8-949a-4b51-b480-dc88b5c1e6e6 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Understand AppLocker policy design decisions - - **Applies to** - - Windows 10 - This topic for the IT professional lists the design questions, possible answers, and ramifications of the decisions when you plan a deployment of application control policies by using AppLocker within a Windows operating system environment. - When you begin the design and planning process, you should consider the ramifications of your design choices. The resulting decisions will affect your policy deployment scheme and subsequent application control policy maintenance. - You should consider using AppLocker as part of your organization's application control policies if all the following are true: - - You have deployed or plan to deploy the supported versions of Windows in your organization. For specific operating system version requirements, see [Requirements to Use AppLocker](requirements-to-use-applocker.md). - - You need improved control over the access to your organization's applications and the data your users access. - - The number of applications in your organization is known and manageable. - - You have resources to test policies against the organization's requirements. - - You have resources to involve Help Desk or to build a self-help process for end-user application access issues. - - The group's requirements for productivity, manageability, and security can be controlled by restrictive policies. - The following questions are not in priority or sequential order. They should be considered when you deploy application control policies (as appropriate for your targeted environment). - ### Which apps do you need to control in your organization? - You might need to control a limited number of apps because they access sensitive data, or you might have to exclude all applications except those that are sanctioned for business purposes. There might be certain business groups that require strict control, and others that promote independent application usage. - @@ -78,47 +62,27 @@ You might need to control a limited number of apps because they access sensitive
    -   - **Important**   The following list contains files or types of files that cannot be managed by AppLocker: - - AppLocker does not protect against running 16-bit DOS binaries in a NT Virtual DOS Machine (NTVDM). This technology allows running legacy DOS and 16-bit Windows programs on computers that are using Intel 80386 or higher when there is already another operating system running and controlling the hardware. The result is that 16-bit binaries can still run on Windows Server 2008 R2 and Windows 7 when AppLocker is configured to otherwise block binaries and libraries. If it is a requirement to prevent 16-bit applications from running, you must configure the Deny rule in the Executable rule collection for NTVDM.exe. - - You cannot use AppLocker to prevent code from running outside the Win32 subsystem. In particular, this applies to the (POSIX) subsystem in Windows NT. If it is a requirement to prevent applications from running in the POSIX subsystem, you must disable the subsystem. - - AppLocker can only control VBScript, JScript, .bat files, .cmd files and Windows PowerShell scripts. It does not control all interpreted code that runs within a host process, for example Perl scripts and macros. Interpreted code is a form of executable code that runs within a host process. For example, Windows batch files (\*.bat) run within the context of the Windows Command Host (cmd.exe). To use AppLocker to control interpreted code, the host process must call AppLocker before it runs the interpreted code, and then enforce the decision that is returned by AppLocker. Not all host processes call into AppLocker. Therefore, AppLocker cannot control every kind of interpreted code, for example Microsoft Office macros. - **Important**   You should configure the appropriate security settings of these host processes if you must allow them to run. For example, configure the security settings in Microsoft Office to ensure that only signed and trusted macros are loaded. -   - - AppLocker rules allow or prevent an app from launching. AppLocker does not control the behavior of apps after they are launched. Applications could contain flags that are passed to functions that signal AppLocker to circumvent the rules and allow another .exe or .dll file to be loaded. In practice, an app that is allowed by AppLocker could use these flags to bypass AppLocker rules and launch child processes. You must follow a process that best suits your needs to thoroughly vet each app before allowing them to run using AppLocker rules. - For more info, see [Security considerations for AppLocker](security-considerations-for-applocker.md). -   - ### Comparing Classic Windows applications and Universal Windows apps for AppLocker policy design decisions - AppLocker policies for Universal Windows apps can only be applied to apps that are installed on computers running Windows operating systems that support Windows Store apps. However, Classic Windows applications can be controlled in Windows Server 2008 R2 and Windows 7, in addition to those computers that support Universal Windows apps. The rules for Classic Windows applications and Universal Windows apps can be enforced together. The differences you should consider for Universal Windows apps are: - - All Universal Windows apps can be installed by a standard user, whereas a number of Classic Windows applications require administrative credentials to install. So in an environment where most of the users are standard users, you might not need numerous exe rules, but you might want more explicit policies for packaged apps. - - Classic Windows applications can be written to change the system state if they run with administrative credentials. Most Universal Windows apps cannot change the system state because they run with limited permissions. When you design your AppLocker policies, it is important to understand whether an app that you are allowing can make system-wide changes. - - Universal Windows apps can be acquired through the Store, or they can be side-loaded by using Windows PowerShell cmdlets. If you use Windows PowerShell cmdlets, a special Enterprise license is required to acquire Universal Windows apps. Classic Windows applications can be acquired through traditional means, such as through software vendors or retail distribution. - AppLocker controls Universal Windows apps and Classic Windows applications by using different rule collections. You have the choice to control Universal Windows apps, Classic Windows applications, or both. - For more info, see [Packaged apps and packaged app installer rules in AppLocker](packaged-apps-and-packaged-app-installer-rules-in-applocker.md). - ### How do you currently control app usage in your organization? - Most organizations have evolved app control policies and methods over time. With heightened security concerns and an emphasis on tighter IT control over desktop use, your organization might decide to consolidate app control practices or design a comprehensive application control scheme. AppLocker includes improvements over SRP in the architecture and management of application control policies. - @@ -153,13 +117,9 @@ Most organizations have evolved app control policies and methods over time. With
    -   - ### Which Windows desktop and server operating systems are running in your organization? - If your organization supports multiple Windows operating systems, app control policy planning becomes more complex. Your initial design decisions should consider the security and management priorities of applications that are installed on each version of the operating system. - @@ -210,13 +170,9 @@ If your organization supports multiple Windows operating systems, app control po
    -   - ### Are there specific groups in your organization that need customized application control policies? - Most business groups or departments have specific security requirements that pertain to data access and the applications used to access that data. You should consider the scope of the project for each group and the group’s priorities before you deploy application control policies for the entire organization. - @@ -241,13 +197,9 @@ Most business groups or departments have specific security requirements that per
    -   - ### Does your IT department have resources to analyze application usage, and to design and manage the policies? - The time and resources that are available to you to perform the research and analysis can affect the detail of your plan and processes for continuing policy management and maintenance. - @@ -270,13 +222,9 @@ The time and resources that are available to you to perform the research and ana
    -   - ### Does your organization have Help Desk support? - Preventing your users from accessing known, deployed, or personal applications will initially cause an increase in end-user support. It will be necessary to address the various support issues in your organization so security policies are followed and business workflow is not hampered. - @@ -299,13 +247,9 @@ Preventing your users from accessing known, deployed, or personal applications w
    -   - ### Do you know what applications require restrictive policies? - Any successful application control policy implementation is based on your knowledge and understanding of app usage within the organization or business group. In addition, the application control design is dependent on the security requirements for data and the apps that access that data. - @@ -328,13 +272,9 @@ Any successful application control policy implementation is based on your knowle
    -   - ### How do you deploy or sanction applications (upgraded or new) in your organization? - Implementing a successful application control policy is based on your knowledge and understanding of application usage within the organization or business group. In addition, the application control design is dependent on the security requirements for data and the applications that access that data. Understanding the upgrade and deployment policy will help shape the construction of the application control policies. - @@ -361,13 +301,9 @@ Implementing a successful application control policy is based on your knowledge
    -   - ### Does your organization already have SRP deployed? - Although SRP and AppLocker have the same goal, AppLocker is a major revision of SRP. - @@ -397,13 +333,9 @@ Although SRP and AppLocker have the same goal, AppLocker is a major revision of
    -   - ### What are your organization's priorities when implementing application control policies? - Some organizations will benefit from application control policies as shown by an increase in productivity or conformance, while others will be hindered in performing their duties. Prioritize these aspects for each group to allow you to evaluate the effectiveness of AppLocker. - @@ -430,13 +362,9 @@ Some organizations will benefit from application control policies as shown by an
    -   - ### How are apps currently accessed in your organization? - AppLocker is very effective for organizations that have application restriction requirements if they have environments with a simple topography and application control policy goals that are straightforward. For example, AppLocker can benefit an environment where non-employees have access to computers that are connected to the organizational network, such as a school or library. Large organizations also benefit from AppLocker policy deployment when the goal is to achieve a detailed level of control on the desktop computers with a relatively small number of applications to manage, or when the applications are manageable with a small number of rules. - @@ -468,13 +396,9 @@ AppLocker is very effective for organizations that have application restriction
    -   - ### Is the structure in Active Directory Domain Services based on the organization's hierarchy? - Designing application control policies based on an organizational structure that is already built into Active Directory Domain Services (AD DS) is easier than converting the existing structure to an organizational structure. Because the effectiveness of application control policies is dependent on the ability to update policies, consider what organizational work needs to be accomplished before deployment begins. - @@ -497,23 +421,10 @@ Designing application control policies based on an organizational structure that
    -   - ## Record your findings - - The next step in the process is to record and analyze your answers to the preceding questions. If AppLocker is the right solution for your goals, tyou can set your application control policy objectives and plan your AppLocker rules. This process culminates in creating your planning document. - - For info about setting your policy goals, see [Determine your application control objectives](determine-your-application-control-objectives.md). - - For info about creating your planning document, see [Create your AppLocker planning document](create-your-applocker-planning-document.md). -   -   - - - - - diff --git a/windows/keep-secure/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md b/windows/keep-secure/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md index ac54fef39f..c4438ba57b 100644 --- a/windows/keep-secure/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md +++ b/windows/keep-secure/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md @@ -2,63 +2,34 @@ title: Understand AppLocker rules and enforcement setting inheritance in Group Policy (Windows 10) description: This topic for the IT professional describes how application control policies configured in AppLocker are applied through Group Policy. ms.assetid: c1c5a3d3-540a-4698-83b5-0dab5d27d871 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Understand AppLocker rules and enforcement setting inheritance in Group Policy - - **Applies to** - - Windows 10 - This topic for the IT professional describes how application control policies configured in AppLocker are applied through Group Policy. - Rule enforcement is applied only to collections of rules, not individual rules. AppLocker divides the rules into the following collections: executable files, Windows Installer files, scripts, packaged apps and packaged app installers, and DLL files. The options for rule enforcement are **Not configured**, **Enforce rules**, or **Audit only**. Together, all AppLocker rule collections compose the application control policy, or AppLocker policy. - Group Policy merges AppLocker policy in two ways: - - **Rules.** Group Policy does not overwrite or replace rules that are already present in a linked Group Policy Object (GPO). For example, if the current GPO has 12 rules and a linked GPO has 50 rules, 62 rules are applied to all computers that receive the AppLocker policy. - **Important**   When determining whether a file is permitted to run, AppLocker processes rules in the following order: - 1. **Explicit deny.** An administrator created a rule to deny a file. - 2. **Explicit allow.** An administrator created a rule to allow a file. - 3. **Implicit deny.** This is also called the default deny because all files that are not affected by an allow rule are automatically blocked. -   - - **Enforcement settings.** The last write to the policy is applied. For example, if a higher-level GPO has the enforcement setting configured to **Enforce rules** and the closest GPO has the setting configured to **Audit only**, **Audit only** is enforced. If enforcement is not configured on the closest GPO, the setting from the closest linked GPO will be enforced. - Because a computer's effective policy includes rules from each linked GPO, duplicate rules or conflicting rules could be enforced on a user's computer. Therefore, you should carefully plan your deployment to ensure that only rules that are necessary are present in a GPO. - The following figure demonstrates how AppLocker rule enforcement is applied through linked GPOs. - ![applocker rule enforcement inheritance chart](images/applocker-plan-inheritance.gif) - In the preceding illustration, note that all GPOs linked to Contoso are applied in order as configured. The rules that are not configured are also applied. For example, the result of the Contoso and Human Resources GPOs is 33 rules enforced, as shown in the client HR-Term1. The Human Resources GPO contains 10 non-configured rules. When the rule collection is configured for **Audit only**, no rules are enforced. - When constructing the Group Policy architecture for applying AppLocker policies, it is important to remember: - - Rule collections that are not configured will be enforced. - - Group Policy does not overwrite or replace rules that are already present in a linked GPO. - - AppLocker processes the explicit deny rule configuration before the allow rule configuration. - - For rule enforcement, the last write to the GPO is applied. -   -   - - - - - diff --git a/windows/keep-secure/understand-the-applocker-policy-deployment-process.md b/windows/keep-secure/understand-the-applocker-policy-deployment-process.md index 71a486b003..225dc8c0c2 100644 --- a/windows/keep-secure/understand-the-applocker-policy-deployment-process.md +++ b/windows/keep-secure/understand-the-applocker-policy-deployment-process.md @@ -2,45 +2,24 @@ title: Understand the AppLocker policy deployment process (Windows 10) description: This planning and deployment topic for the IT professional describes the process for using AppLocker when deploying application control policies. ms.assetid: 4cfd95c1-fbd3-41fa-8efc-d23c1ea6fb16 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Understand the AppLocker policy deployment process - - **Applies to** - - Windows 10 - This planning and deployment topic for the IT professional describes the process for using AppLocker when deploying application control policies. - To successfully deploy AppLocker policies, you need to identify your application control objectives and construct the policies for those objectives. The key to the process is taking an accurate inventory of your organization's applications, which requires investigation of all the targeted business groups. With an accurate inventory, you can create rules and set enforcement criteria that will allow the organization to use the required applications and allow the IT department to manage a controlled set of applications. - The following diagram shows the main points in the design, planning, and deployment process for AppLocker. - ![applocker quick reference guide](images/applocker-plandeploy-quickreference.gif) - ## Resources to support the deployment process - - The following topics contain information about designing, planning, deploying, and maintaining AppLocker policies: - - For info about the AppLocker policy design and planning requirements and process, see [AppLocker Design Guide](applocker-policies-design-guide.md). - - For info about the AppLocker policy deployment requirements and process, see [AppLocker deployment guide](applocker-policies-deployment-guide.md). - - For info about AppLocker policy maintenance and monitoring, see [Administer AppLocker](administer-applocker.md). - - For info about AppLocker policy architecture, components, and processing, see [AppLocker technical reference](applocker-technical-reference.md). -   -   - - - - - diff --git a/windows/keep-secure/understanding-applocker-allow-and-deny-actions-on-rules.md b/windows/keep-secure/understanding-applocker-allow-and-deny-actions-on-rules.md index aba279a4c9..30f5de5bcc 100644 --- a/windows/keep-secure/understanding-applocker-allow-and-deny-actions-on-rules.md +++ b/windows/keep-secure/understanding-applocker-allow-and-deny-actions-on-rules.md @@ -2,32 +2,21 @@ title: Understanding AppLocker allow and deny actions on rules (Windows 10) description: This topic explains the differences between allow and deny actions on AppLocker rules. ms.assetid: ea0370fa-2086-46b5-a0a4-4a7ead8cbed9 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Understanding AppLocker allow and deny actions on rules - - **Applies to** - - Windows 10 - This topic explains the differences between allow and deny actions on AppLocker rules. - ## Allow action versus deny action on rules - - Unlike Software Restriction Policies (SRP), each AppLocker rule collection functions as an allowed list of files. Only the files that are listed within the rule collection are allowed to run. This configuration makes it easier to determine what will occur when an AppLocker rule is applied. - You can also create rules that use the deny action. When applying rules, AppLocker first checks whether any explicit deny actions are specified in the rule list. If you have denied a file from running in a rule collection, the deny action will take precedence over any allow action, regardless of which Group Policy Object (GPO) the rule was originally applied in. Because AppLocker functions as an allowed list by default, if no rule explicitly allows or denies a file from running, AppLocker's default deny action will block the file. - ### Deny rule considerations - Although you can use AppLocker to create a rule to allow all files to run and then use rules to deny specific files, this configuration is not recommended. The deny action is generally less secure than the allow action because a malicious user could modify the file to invalidate the rule. Deny actions can also be circumvented. For example, if you configure a deny action for a file or folder path, the user can still run the file from any other path. The following table details security concerns for different rule conditions with deny actions. - @@ -54,24 +43,11 @@ Although you can use AppLocker to create a rule to allow all files to run and th
    -   - **Important**   If you choose to use the deny action on rules, you must ensure that you first create rules that allow the Windows system files to run. AppLocker enforces rules for allowed applications by default, so after one or more rules have been created for a rule collection (affecting the Windows system files), only the apps that are listed as being allowed will be permitted to run. Therefore, creating a single rule in a rule collection to deny a malicious file from running will also deny all other files on the computer from running. -   - ## Related topics - - [How AppLocker works](how-applocker-works-techref.md) -   -   - - - - - diff --git a/windows/keep-secure/understanding-applocker-default-rules.md b/windows/keep-secure/understanding-applocker-default-rules.md index 8cfd4ceadc..cf10480b26 100644 --- a/windows/keep-secure/understanding-applocker-default-rules.md +++ b/windows/keep-secure/understanding-applocker-default-rules.md @@ -2,41 +2,26 @@ title: Understanding AppLocker default rules (Windows 10) description: This topic for IT professional describes the set of rules that can be used to ensure that required Windows system files are allowed to run when the policy is applied. ms.assetid: bdb03d71-05b7-41fb-96e3-a289ce1866e1 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Understanding AppLocker default rules - - **Applies to** - - Windows 10 - This topic for IT professional describes the set of rules that can be used to ensure that required Windows system files are allowed to run when the policy is applied. - AppLocker includes default rules for each rule collection. These rules are intended to help ensure that the files that are required for Windows to operate properly are allowed in an AppLocker rule collection. - **Important**   You can use the default rules as a template when creating your own rules. However, these rules are only meant to function as a starter policy when you are first testing AppLocker rules so that the system files in the Windows folders will be allowed to run. -   - If you require additional app security, you might need to modify the rules created from the built-in default rule collection. For example, the default rule to allow all users to run .exe files in the Windows folder is based on a path condition that allows all files within the Windows folder to run. The Windows folder contains a Temp subfolder to which the Users group is given the following permissions: - - Traverse Folder/Execute File - - Create Files/Write Data - - Create Folders/Append Data - These permissions settings are applied to this folder for app compatibility. However, because any user can create files in this location, allowing applications to be run from this location might conflict with your organization's security policy. - ## In this section - - @@ -71,19 +56,8 @@ These permissions settings are applied to this folder for app compatibility. How
    -   - ## Related topics - - [How AppLocker works](how-applocker-works-techref.md) -   -   - - - - - diff --git a/windows/keep-secure/understanding-applocker-rule-behavior.md b/windows/keep-secure/understanding-applocker-rule-behavior.md index e641befe4b..b065509210 100644 --- a/windows/keep-secure/understanding-applocker-rule-behavior.md +++ b/windows/keep-secure/understanding-applocker-rule-behavior.md @@ -2,44 +2,24 @@ title: Understanding AppLocker rule behavior (Windows 10) description: This topic describes how AppLocker rules are enforced by using the allow and deny options in AppLocker. ms.assetid: 3e2738a3-8041-4095-8a84-45c1894c97d0 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Understanding AppLocker rule behavior - - **Applies to** - - Windows 10 - This topic describes how AppLocker rules are enforced by using the allow and deny options in AppLocker. - If no AppLocker rules for a specific rule collection exist, all files with that file format are allowed to run. However, when an AppLocker rule for a specific rule collection is created, only the files explicitly allowed in a rule are permitted to run. For example, if you create an executable rule that allows .exe files in *%SystemDrive%\\FilePath* to run, only executable files located in that path are allowed to run. - A rule can be configured to use either an allow or deny action: - - **Allow**. You can specify which files are allowed to run in your environment and for which users or groups of users. You can also configure exceptions to identify files that are excluded from the rule. - - **Deny**. You can specify which files are not allowed to run in your environment and for which users or groups of users. You can also configure exceptions to identify files that are excluded from the rule. - **Important**   You can use a combination of allow actions and deny actions. However, we recommend using allow actions with exceptions because deny actions override allow actions in all cases. Deny actions can also be circumvented. For example, if you configure a deny action for a file or folder path, the user can still run the file from any other path. -   - ## Related topics - - [How AppLocker works](how-applocker-works-techref.md) -   -   - - - - - diff --git a/windows/keep-secure/understanding-applocker-rule-collections.md b/windows/keep-secure/understanding-applocker-rule-collections.md index a6f772c351..950a47ebfe 100644 --- a/windows/keep-secure/understanding-applocker-rule-collections.md +++ b/windows/keep-secure/understanding-applocker-rule-collections.md @@ -2,52 +2,28 @@ title: Understanding AppLocker rule collections (Windows 10) description: This topic explains the five different types of AppLocker rules used to enforce AppLocker policies. ms.assetid: 03c05466-4fb3-4880-8d3c-0f6f59fc5579 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Understanding AppLocker rule collections - - **Applies to** - - Windows 10 - This topic explains the five different types of AppLocker rules used to enforce AppLocker policies. - An AppLocker rule collection is a set of rules that apply to one of five types: - - Executable files: .exe and .com - - Windows Installer files: .msi, mst, and .msp - - Scripts: .ps1, .bat, .cmd, .vbs, and .js - - DLLs: .dll and .ocx - - Packaged apps and packaged app installers: .appx - If you use DLL rules, a DLL allow rule has to be created for each DLL that is used by all of the allowed apps. - **Important**   Each app can load several DLLs, and AppLocker must check each DLL before it is allowed to run. Therefore, creating DLL rules might cause performance problems on some computers. Denying some DLLs from running can also create app compatibility problems. As a result, the DLL rule collection is not enabled by default. -   - For info about how to enable the DLL rule collection, see [Enable the DLL rule collection](enable-the-dll-rule-collection.md). - ## Related topics - - [How AppLocker works](how-applocker-works-techref.md) -   -   - - - - - diff --git a/windows/keep-secure/understanding-applocker-rule-condition-types.md b/windows/keep-secure/understanding-applocker-rule-condition-types.md index 6969952dce..e6b6e8505a 100644 --- a/windows/keep-secure/understanding-applocker-rule-condition-types.md +++ b/windows/keep-secure/understanding-applocker-rule-condition-types.md @@ -2,73 +2,39 @@ title: Understanding AppLocker rule condition types (Windows 10) description: This topic for the IT professional describes the three types of AppLocker rule conditions. ms.assetid: c21af67f-60a1-4f7d-952c-a6f769c74729 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Understanding AppLocker rule condition types - - **Applies to** - - Windows 10 - This topic for the IT professional describes the three types of AppLocker rule conditions. - Rule conditions are criteria that the AppLocker rule is based on. Primary conditions are required to create an AppLocker rule. The three primary rule conditions are publisher, path, and file hash. - **Publisher** - To use a publisher condition, the files must be digitally signed by the software publisher, or you must do so by using an internal certificate. Rules that are specified to the version level might have to be updated when a new version of the file is released. For more info about this rule condition, see [Understanding the publisher rule condition in AppLocker](understanding-the-publisher-rule-condition-in-applocker.md). - **Path** - Any file can be assigned this rule condition; however, because path rules specify locations within the file system, any subdirectory will also be affected by the rule (unless explicitly exempted). For more info about this rule condition, see [Understanding the path rule condition in AppLocker](understanding-the-path-rule-condition-in-applocker.md). - **File hash** - Any file can be assigned this rule condition; however, the rule must be updated each time a new version of the file is released because the hash value is unique to that the version of the file. For more info about this rule condition, see [Understanding the file hash rule condition in AppLocker](understanding-the-file-hash-rule-condition-in-applocker.md). - ### Considerations - Selecting the appropriate condition for each rule depends on the overall application control policy goals of the organization, the AppLocker rule maintenance goals, and the condition of the existing (or planned) application deployment. The following questions can help you decide which rule condition to use. - 1. Is the file digitally signed by a software publisher? - If the file is signed by a software publisher, we recommend that you create rules with publisher conditions. You may still create file hash and path conditions for signed files. However, if the file is not digitally signed by a software publisher, you can: - - Sign the file by using an internal certificate. - - Create a rule by using a file hash condition. - - Create a rule by using a path condition. - **Note**   To determine how many applications on a reference computer are digitally signed, you can use the **Get-AppLockerFileInformation** Windows PowerShell cmdlet for a directory of files. For example, `Get-AppLockerFileInformation –Directory C:\Windows\ -FileType EXE -recurse` displays the properties for all .exe and .com files within the Windows directory. -   - 2. What rule condition type does your organization prefer? - If your organization is already using Software Restriction Policies (SRP) to restrict what files users can run, rules using file hash or path conditions are probably already in place. - **Note**   For a list of supported operating system versions and editions to which SRP and AppLocker rules can be applied, see [Requirements to use AppLocker](requirements-to-use-applocker.md). -   - ## Related topics - - [How AppLocker works](how-applocker-works-techref.md) -   -   - - - - - diff --git a/windows/keep-secure/understanding-applocker-rule-exceptions.md b/windows/keep-secure/understanding-applocker-rule-exceptions.md index a5a24f0b8f..0a89f17cc7 100644 --- a/windows/keep-secure/understanding-applocker-rule-exceptions.md +++ b/windows/keep-secure/understanding-applocker-rule-exceptions.md @@ -2,35 +2,19 @@ title: Understanding AppLocker rule exceptions (Windows 10) description: This topic describes the result of applying AppLocker rule exceptions to rule collections. ms.assetid: e6bb349f-ee60-4c8d-91cd-6442f2d0eb9c +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Understanding AppLocker rule exceptions - - **Applies to** - - Windows 10 - This topic describes the result of applying AppLocker rule exceptions to rule collections. - You can apply AppLocker rules to individual users or a group of users. If you apply a rule to a group of users, all users in that group are affected by that rule. If you need to allow a subset of a user group to use an app, you can create a special rule for that subset. - For example, the rule "Allow Everyone to run Windows except Registry Editor" allows everyone in the organization to run Windows but does not allow anyone to run Registry Editor. The effect of this rule would prevent users such as help desk personnel from running a program that is necessary for their support tasks. To resolve this problem, create a second rule that applies to the Helpdesk user group: "Allow Helpdesk to run Registry Editor." If you create a deny rule that does not allow any users to run Registry Editor, the deny rule will override the second rule that allows the Helpdesk user group to run Registry Editor. - ## Related topics - - [How AppLocker works](how-applocker-works-techref.md) -   -   - - - - - diff --git a/windows/keep-secure/understanding-the-file-hash-rule-condition-in-applocker.md b/windows/keep-secure/understanding-the-file-hash-rule-condition-in-applocker.md index d014968a92..1be8c8cc55 100644 --- a/windows/keep-secure/understanding-the-file-hash-rule-condition-in-applocker.md +++ b/windows/keep-secure/understanding-the-file-hash-rule-condition-in-applocker.md @@ -2,23 +2,17 @@ title: Understanding the file hash rule condition in AppLocker (Windows 10) description: This topic explains the AppLocker file hash rule condition, the advantages and disadvantages, and how it is applied. ms.assetid: 4c6d9af4-2b1a-40f4-8758-1a6f9f147756 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Understanding the file hash rule condition in AppLocker - - **Applies to** - - Windows 10 - This topic explains the AppLocker file hash rule condition, the advantages and disadvantages, and how it is applied. - File hash rules use a system-computed cryptographic hash of the identified file. For files that are not digitally signed, file hash rules are more secure than path rules. The following table describes the advantages and disadvantages of the file hash condition. - @@ -37,21 +31,9 @@ File hash rules use a system-computed cryptographic hash of the identified file.
    -   - For an overview of the three types of AppLocker rule conditions and explanations of the advantages and disadvantages of each, see [Understanding AppLocker rule condition types](understanding-applocker-rule-condition-types.md). - ## Related topics - - [How AppLocker works](how-applocker-works-techref.md) -   -   - - - - - diff --git a/windows/keep-secure/understanding-the-path-rule-condition-in-applocker.md b/windows/keep-secure/understanding-the-path-rule-condition-in-applocker.md index 80c9494b0b..2adb70d6c6 100644 --- a/windows/keep-secure/understanding-the-path-rule-condition-in-applocker.md +++ b/windows/keep-secure/understanding-the-path-rule-condition-in-applocker.md @@ -2,25 +2,18 @@ title: Understanding the path rule condition in AppLocker (Windows 10) description: This topic explains the AppLocker path rule condition, the advantages and disadvantages, and how it is applied. ms.assetid: 3fa54ded-4466-4f72-bea4-2612031cad43 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Understanding the path rule condition in AppLocker - - **Applies to** - - Windows 10 - This topic explains the AppLocker path rule condition, the advantages and disadvantages, and how it is applied. - The path condition identifies an application by its location in the file system of the computer or on the network. - When creating a rule that uses a deny action, path conditions are less secure than publisher and file hash conditions for preventing access to a file because a user could easily copy the file to a different location than the location specified in the rule. Because path rules specify locations within the file system, you should ensure that there are no subdirectories that are writable by non-administrators. For example, if you create a path rule for C:\\ with the allow action, any file under that location will be allowed to run, including within users' profiles. The following table describes the advantages and disadvantages of the path condition. - @@ -45,15 +38,10 @@ When creating a rule that uses a deny action, path conditions are less secure th
    -   - AppLocker does not enforce rules that specify paths with short names. You should always specify the full path to a file or folder when creating path rules so that the rule will be properly enforced. - The asterisk (\*) wildcard character can be used within **Path** field. The asterisk (\*) character used by itself represents any path. When combined with any string value, the rule is limited to the path of the file and all the files under that path. For example, %ProgramFiles%\\Internet Explorer\\\* indicates that all files and subfolders within the Internet Explorer folder will be affected by the rule. - AppLocker uses path variables for well-known directories in Windows. Path variables are not environment variables. The AppLocker engine can only interpret AppLocker path variables. The following table details these path variables. - @@ -100,21 +88,9 @@ AppLocker uses path variables for well-known directories in Windows. Path variab
    -   - For an overview of the three types of AppLocker rule conditions and explanations of the advantages and disadvantages of each, see [Understanding AppLocker rule condition types](understanding-applocker-rule-condition-types.md). - ## Related topics - - [How AppLocker works](how-applocker-works-techref.md) -   -   - - - - - diff --git a/windows/keep-secure/understanding-the-publisher-rule-condition-in-applocker.md b/windows/keep-secure/understanding-the-publisher-rule-condition-in-applocker.md index 263db51284..053ee2e59c 100644 --- a/windows/keep-secure/understanding-the-publisher-rule-condition-in-applocker.md +++ b/windows/keep-secure/understanding-the-publisher-rule-condition-in-applocker.md @@ -2,25 +2,18 @@ title: Understanding the publisher rule condition in AppLocker (Windows 10) description: This topic explains the AppLocker publisher rule condition, what controls are available, and how it is applied. ms.assetid: df61ed8f-a97e-4644-9d0a-2169f18c1c4f +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Understanding the publisher rule condition in AppLocker - - **Applies to** - - Windows 10 - This topic explains the AppLocker publisher rule condition, what controls are available, and how it is applied. - Publisher conditions can be made only for files that are digitally signed; this condition identifies an app based on its digital signature and extended attributes. The digital signature contains information about the company that created the app (the publisher). The extended attributes, which are obtained from the binary resource, contain the name of the product that the app is part of and the version number of the app. The publisher may be a software development company, such as Microsoft, or the Information Technology department of your organization. - Publisher conditions are easier to maintain than file hash conditions and are generally more secure than path conditions. Rules that are specified to the version level might have to be updated when a new version of the file is released. The following table describes the advantages and disadvantages of the publisher condition. - @@ -47,35 +40,20 @@ Publisher conditions are easier to maintain than file hash conditions and are ge
    -   - Wildcard characters can be used as values in the publisher rule fields according to the following specifications: - - **Publisher** - The asterisk (\*) character used by itself represents any publisher. When combined with any string value, the rule is limited to the publisher with a value in the signed certificate that matches the character string. In other words, the asterisk is not treated as a wildcard character if used with other characters in this field. For example, using the characters "M\*" limits the publisher name to only a publisher with the name "M\*." Using the characters "\*x\*" limits the publisher name only to the name “\*x\*”. A question mark (?) is not a valid wildcard character in this field. - - **Product name** - The asterisk (\*) character used by itself represents any product name. When combined with any string value, the rule is limited to the product of the publisher with a value in the signed certificate that matches the character string. In other words, the asterisk is not treated as a wildcard character if used with other characters in this field. A question mark (?) is not a valid wildcard character in this field. - - **File name** - Either the asterisk (\*) or question mark (?) characters used by themselves represent any and all file names. When combined with any string value, the string is matched with any file name containing that string. - - **File version** - The asterisk (\*) character used by itself represents any file version. If you want to limit the file version to a specific version or as a starting point, you can state the file version and then use the following options to apply limits: - - **Exactly**. The rule applies only to this version of the app - - **And above**. The rule applies to this version and all later versions. - - **And Below**. The rule applies to this version and all earlier versions. - The following table describes how a publisher condition is applied. - @@ -125,21 +103,9 @@ The following table describes how a publisher condition is applied.
    -   - For an overview of the three types of AppLocker rule conditions and explanations of the advantages and disadvantages of each, see [Understanding AppLocker rule condition types](understanding-applocker-rule-condition-types.md). - ## Related topics - - [How AppLocker works](how-applocker-works-techref.md) -   -   - - - - - diff --git a/windows/keep-secure/use-a-reference-computer-to-create-and-maintain-applocker-policies.md b/windows/keep-secure/use-a-reference-computer-to-create-and-maintain-applocker-policies.md index 070851aa6b..4b888e3d71 100644 --- a/windows/keep-secure/use-a-reference-computer-to-create-and-maintain-applocker-policies.md +++ b/windows/keep-secure/use-a-reference-computer-to-create-and-maintain-applocker-policies.md @@ -2,125 +2,62 @@ title: Use a reference device to create and maintain AppLocker policies (Windows 10) description: This topic for the IT professional describes the steps to create and maintain AppLocker policies by using a reference computer. ms.assetid: 10c3597f-f44c-4c8e-8fe5-105d4ac016a6 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Use a reference device to create and maintain AppLocker policies - - **Applies to** - - Windows 10 - This topic for the IT professional describes the steps to create and maintain AppLocker policies by using a reference computer. - ## Background and prerequisites - - An AppLocker reference device is a baseline device you can use to configure policies and can subsequently be used to maintain AppLocker policies. For the procedure to configure a reference device, see [Configure the AppLocker reference device](configure-the-appLocker-reference-device.md). - An AppLocker reference device that is used to create and maintain AppLocker policies should contain the corresponding apps for each organizational unit (OU) to mimic your production environment. - **Important**   The reference device must be running one of the supported editions of Windows. For information about operating system requirements for AppLocker, see [Requirements to use AppLocker](requirements-to-use-applocker.md). -   - You can perform AppLocker policy testing on the reference device by using the **Audit only** enforcement setting or Windows PowerShell cmdlets. You can also use the reference device as part of a testing configuration that includes policies that are created by using Software Restriction Policies. - ## Step 1: Automatically generate rules on the reference device - - With AppLocker, you can automatically generate rules for all files within a folder. AppLocker scans the specified folder and creates the condition types that you choose for each file in that folder. For the procedure to do this, see [Run the Automatically Generate Rules wizard](run-the-automatically-generate-rules-wizard.md). - **Note**   If you run this wizard to create your first rules for a Group Policy Object (GPO), after you complete the wizard, you will be prompted to create the default rules, which allow critical system files to run. You can edit the default rules at any time. If your organization has decided to edit the default rules or create custom rules to allow the Windows system files to run, ensure that you delete the default rules after you replace them with your custom rules. -   - ## Step 2: Create the default rules on the reference device - - AppLocker includes default rules for each rule collection. These rules are intended to help ensure that the files that are required for Windows to operate properly are allowed in an AppLocker rule collection. You must run the default rules for each rule collection. For info about default rules and considerations for using them, see [Understanding AppLocker default rules](understanding-applocker-default-rules.md). For the procedure to create default rules, see [Create AppLocker default rules](create-applocker-default-rules.md). - **Important**   You can use the default rules as a template when you create your own rules. This allows files within the Windows directory to run. However, these rules are only meant to function as a starter policy when you are first testing AppLocker rules. -   - ## Step 3: Modify rules and the rule collection on the reference device - - If AppLocker policies are currently running in your production environment, export the policies from the corresponding GPOs and save them to the reference device. For the procedure to do this, see [Export an AppLocker policy from a GPO](export-an-applocker-policy-from-a-gpo.md). If no AppLocker policies have been deployed, create the rules and develop the policies by using the following procedures: - - [Create a rule that uses a publisher condition](create-a-rule-that-uses-a-publisher-condition.md) - - [Create a rule that uses a file hash condition](create-a-rule-that-uses-a-file-hash-condition.md) - - [Create a rule that uses a path condition](create-a-rule-that-uses-a-path-condition.md) - - [Edit AppLocker rules](edit-applocker-rules.md) - - [Add exceptions for an AppLocker rule](configure-exceptions-for-an-applocker-rule.md) - - [Delete an AppLocker rule](delete-an-applocker-rule.md) - - [Enable the DLL rule collection](enable-the-dll-rule-collection.md) - - [Enforce AppLocker rules](enforce-applocker-rules.md) - ## Step 4: Test and update AppLocker policy on the reference device - - You should test each set of rules to ensure that they perform as intended. The **Test-AppLockerPolicy** Windows PowerShell cmdlet can be used to determine whether any of the rules in your rule collection will be blocked on your reference device. Perform the steps on each reference device that you used to define the AppLocker policy. Ensure that the reference device is joined to the domain and that it is receiving the AppLocker policy from the appropriate GPO. Because AppLocker rules are inherited from linked GPOs, you should deploy all of the rules to simultaneously test all of your test GPOs. Use the following procedures to complete this step: - - [Test an AppLocker Policy with Test-AppLockerPolicy](http://technet.microsoft.com/library/ee791772(WS.10).aspx) - - [Discover the Effect of an AppLocker Policy](http://technet.microsoft.com/library/ee791823(WS.10).aspx) - **Caution**   If you have set the enforcement setting on the rule collection to **Enforce rules** or you have not configured the rule collection, the policy will be implemented when the GPO is updated in the next step. If you have set the enforcement setting on the rule collection to **Audit only**, application access events are written to the AppLocker log, and the policy will not take effect. -   - ## Step 5: Export and import the policy into production - - When the AppLocker policy has been tested successfully, it can be imported into the GPO (or imported into individual computers that are not managed by Group Policy) and checked for its intended effectiveness. To do this, perform the following procedures: - - [Export an AppLocker policy to an XML file](export-an-applocker-policy-to-an-xml-file.md) - - [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md) or - - [Discover the Effect of an AppLocker Policy](http://technet.microsoft.com/library/ee791823(WS.10).aspx) - If the AppLocker policy enforcement setting is **Audit only** and you are satisfied that the policy is fulfilling your intent, you can change it to **Enforce rules**. For info about how to change the enforcement setting, see [Configure an AppLocker policy for enforce rules](configure-an-applocker-policy-for-enforce-rules.md). - ## Step 6: Monitor the effect of the policy in production - - If additional refinements or updates are necessary after a policy is deployed, use the appropriate following procedures to monitor and update the policy: - - [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md) - - [Edit an AppLocker policy](edit-an-applocker-policy.md) - - [Refresh an AppLocker policy](refresh-an-applocker-policy.md) - ## See also - - [Deploy the AppLocker policy into production](deploy-the-applocker-policy-into-production.md) - -   -   - - - - - diff --git a/windows/keep-secure/use-applocker-and-software-restriction-policies-in-the-same-domain.md b/windows/keep-secure/use-applocker-and-software-restriction-policies-in-the-same-domain.md index 973405d6cf..01e857dfe3 100644 --- a/windows/keep-secure/use-applocker-and-software-restriction-policies-in-the-same-domain.md +++ b/windows/keep-secure/use-applocker-and-software-restriction-policies-in-the-same-domain.md @@ -2,28 +2,19 @@ title: Use AppLocker and Software Restriction Policies in the same domain (Windows 10) description: This topic for IT professionals describes concepts and procedures to help you manage your application control strategy using Software Restriction Policies and AppLocker. ms.assetid: 2b7e0cec-df62-49d6-a2b7-6b8e30180943 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Use AppLocker and Software Restriction Policies in the same domain - - **Applies to** - - Windows 10 - This topic for IT professionals describes concepts and procedures to help you manage your application control strategy using Software Restriction Policies and AppLocker. - ## Using AppLocker and Software Restriction Policies in the same domain - - AppLocker is supported on systems running Windows 7 and above. Software Restriction Policies (SRP) is supported on systems running Windows Vista or earlier. You can continue to use SRP for application control on your pre-Windows 7 computers, but use AppLocker for computers running Windows Server 2008 R2, Windows 7 and later. It is recommended that you author AppLocker and SRP rules in separate GPOs and target the GPO with SRP policies to systems running Windows Vista or earlier. When both SRP and AppLocker policies are applied to computers running Windows Server 2008 R2, Windows 7 and later, the SRP policies are ignored. - The following table compares the features and functions of Software Restriction Policies (SRP) and AppLocker. - @@ -157,14 +148,6 @@ The following table compares the features and functions of Software Restriction
    -   -   -   - - - - - diff --git a/windows/keep-secure/use-the-applocker-windows-powershell-cmdlets.md b/windows/keep-secure/use-the-applocker-windows-powershell-cmdlets.md index 22eddb11d1..4ccedff7ca 100644 --- a/windows/keep-secure/use-the-applocker-windows-powershell-cmdlets.md +++ b/windows/keep-secure/use-the-applocker-windows-powershell-cmdlets.md @@ -2,58 +2,30 @@ title: Use the AppLocker Windows PowerShell cmdlets (Windows 10) description: This topic for IT professionals describes how each AppLocker Windows PowerShell cmdlet can help you administer your AppLocker application control policies. ms.assetid: 374e029c-5c0a-44ab-a57a-2a9dd17dc57d +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Use the AppLocker Windows PowerShell cmdlets - - **Applies to** - - Windows 10 - This topic for IT professionals describes how each AppLocker Windows PowerShell cmdlet can help you administer your AppLocker application control policies. - ## AppLocker Windows PowerShell cmdlets - - The five AppLocker cmdlets are designed to streamline the administration of an AppLocker policy. They can be used to help create, test, maintain, and troubleshoot an AppLocker policy. The cmdlets are intended to be used in conjunction with the AppLocker user interface that is accessed through the Microsoft Management Console (MMC) snap-in extension to the Local Security Policy snap-in and Group Policy Management Console. - To edit or update a Group Policy Object (GPO) by using the AppLocker cmdlets, you must have Edit Setting permission. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. To perform tasks by using the Local Security policy snap-in, you must be a member of the local **Administrators** group, or equivalent, on the computer. - ### Retrieve application information - The [Get-AppLockerFileInformation](http://technet.microsoft.com/library/hh847209.aspx) cmdlet retrieves the AppLocker file information from a list of files or from an event log. File information that is retrieved can include publisher information, file hash information, and file path information. File information from an event log may not contain all of these fields. Files that are not signed do not have any publisher information. - ### Set AppLocker policy - The [Set-AppLockerPolicy](http://technet.microsoft.com/library/hh847212.aspx) cmdlet sets the specified GPO to contain the specified AppLocker policy. If no Lightweight Directory Access Protocol (LDAP) is specified, the local GPO is the default. - ### Retrieve an AppLocker policy - The [Get-AppLockerPolicy](http://technet.microsoft.com/library/hh847214.aspx) cmdlet gets the AppLocker policy from the local GPO, from a specified GPO, or from the effective AppLocker policy on the device. The output of the AppLocker policy is an AppLockerPolicy object or an XML-formatted string. - ### Generate rules for a given user or group - The [New-AppLockerPolicy](http://technet.microsoft.com/library/hh847211.aspx) cmdlet uses a list of file information to automatically generate rules for a given user or group. It can generate rules based on publisher, hash, or path information. Use **Get-AppLockerFileInformation** to create the list of file information. - ### Test the AppLocker Policy against a file set - The [Test-AppLockerPolicy](http://technet.microsoft.com/library/hh847213.aspx) cmdlet uses the specified AppLocker policy to test whether a specified list of files are allowed to run or not on the local device for a specific user. - ## Additional resources - - - For steps to perform other AppLocker policy tasks, see [Administer AppLocker](administer-applocker.md). -   -   - - - - - diff --git a/windows/keep-secure/use-windows-event-forwarding-to-assist-in-instrusion-detection.md b/windows/keep-secure/use-windows-event-forwarding-to-assist-in-instrusion-detection.md index 402e4a6ddb..cc7a0adbb4 100644 --- a/windows/keep-secure/use-windows-event-forwarding-to-assist-in-instrusion-detection.md +++ b/windows/keep-secure/use-windows-event-forwarding-to-assist-in-instrusion-detection.md @@ -2,376 +2,202 @@ title: Use Windows Event Forwarding to help with intrusion detection (Windows 10) description: Learn about an approach to collect events from devices in your organization. This article talks about events in both normal operations and when an intrusion is suspected. ms.assetid: 733263E5-7FD1-45D2-914A-184B9E3E6A3F +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: tedhardyMSFT --- - # Use Windows Event Forwarding to help with intrusion detection - - **Applies to** - - Windows 10 - Learn about an approach to collect events from devices in your organization. This article talks about events in both normal operations and when an intrusion is suspected. - Windows Event Forwarding (WEF) reads any operational or administrative event log on a device in your organization and forwards the events you choose to a Windows Event Collector (WEC) server. - To accomplish this, there are two different of subscriptions published to client devices - the Baseline subscription and the suspect subscription. The Baseline subscription enrolls all devices in your organization, and a Suspect subscription only includes devices that have been added by you. The Suspect subscription collects additional events to help build context for system activity and can quickly be updated to accommodate new events and/or scenarios as needed without impacting baseline operations. - This implementation helps differentiate where events are ultimately stored. Baseline events can be sent to devices with online analytical capability, such as Security Event Manager (SEM), while also sending events to a MapReduce system, such as HDInsight or Hadoop, for long-term storage and deeper analysis. Events from the Suspect subscription are sent directly to a MapReduce system due to volume and lower signal/noise ratio, they are largely used for host forensic analysis. - An SEM’s strength lies in being able to inspect, correlate events, and generate alerts for known patterns manner and alert security staff at machine speed. - A MapReduce system has a longer retention time (years versus months for an SEM), larger ingress ability (hundreds of terabytes per day), and the ability to perform more complex operations on the data like statistical and trend analysis, pattern clustering analysis, or apply Machine Learning algorithms. - Here's an approximate scaling guide for WEF events: - | Events/second range | Data store | |---------------------|----------------------------| | 0 - 5,000 | SQL or SEM | | 5,000 - 50,000 | SEM | | 50,000+ | Hadoop/HDInsight/Data Lake | -   - Event generation on a device must be enabled either separately or as part of the GPO for the baseline WEF implementation, including enabling of disabled event logs and setting channel permissions. For more info, see [Appendix C - Event channel settings (enable and channel access) methods](#bkmk-appendixc). This is because WEF is a passive system with regards to the event log. It cannot change the size of event log files, enable disabled event channels, change channel permissions, or adjust a security audit policy. WEF only queries event channels for existing events. Additionally, having event generation already occurring on a device allows for more complete event collection building a complete history of system activity. Otherwise, you'll be limited to the speed of GPO and WEF subscription refresh cycles to make changes to what is being generated on the device. On modern devices, enabling additional event channels and expanding the size of event log files has not resulted in noticeable performance differences. - For the minimum recommended audit policy and registry system ACL settings, see [Appendix A - Minimum recommended minimum audit policy](#bkmk-appendixa) and [Appendix B - Recommended minimum registry system ACL policy](#bkmk-appendixb). - **Note**   These are only minimum values need to meet what the WEF subscription selects. -   - From a WEF subscription management perspective, the event queries provided should be used in two separate subscriptions for ease of maintenance; only machines meeting specific criteria would be allowed access to the targeted subscription, this access would be determined by an algorithm or an analysts’ direction. All devices should have access to the Baseline subscription. - This means you would create two base subscriptions: - - **Baseline WEF subscription**. Events collected from all hosts, this includes some role-specific events, which will only be emitted by those machines. - **Targeted WEF subscription**. Events collected from a limited set of hosts due to unusual activity and/or heightened awareness for those systems. - Each using the respective event query below. Note that for the Targeted subscription enabling the “read existing events” option should be set to true to allow collection of existing events from systems. By default, WEF subscriptions will only forward events generated after the WEF subscription was received by the client. - In [Appendix E – Annotated Baseline Subscription Event Query](#bkmk-appendixe) and [Appendix F – Annotated Suspect Subscription Event Query](#bkmk-appendixf), the event query XML is included when creating WEF subscriptions. These are annotated for query purpose and clarity. Individual <Query> element can be removed or edited without affecting the rest of the query. - ### Common WEF questions - This section addresses common questions from IT pros and customers. - ### Will the user notice if their machine is enabled for WEF or if WEF encounters an error? - The short answer is: No. - The longer answer is: The **Eventlog-forwardingPlugin/Operational** event channel logs the success, warning, and error events related to WEF subscriptions present on the device. Unless the user opens Event Viewer and navigates to that channel, they will not notice WEF either through resource consumption or Graphical User Interface pop-ups. Even if there is an issue with the WEF subscription, there is no user interaction or performance degradation. All success, warning, and failure events are logged to this operational event channel. - ### Is WEF Push or Pull? - A WEF subscription can be configured to be push or pull, but not both. The simplest, most flexible IT deployment with the greatest scalability can be achieved by using a push, or source initiated, subscription. WEF clients are configured by using a GPO and the built-in forwarding client is activated. For pull, collector initiated, the subscription on the WEC server is pre-configured with the names of the WEF Client devices from which events are to be selected. Those clients also have to be configured ahead of time to allow the credentials used in the subscription to access their event logs remotely (normally by adding the credential to the **Event Log Readers** built-in local security group.) A useful scenario: closely monitoring a specific set of machines. - ### Will WEF work over VPN or RAS? - WEF handles VPN, RAS, and DirectAccess scenarios well and will reconnect and send any accumulated backlog of events when the connection to the WEF Collector is re-established. - ### How is client progress tracked? - The WEC server maintains in its registry the bookmark information and last heartbeat time for each event source for each WEF subscription. When an event source re-connects to a WEC server, the last bookmark position is sent to the device to use as a starting point to resume forwarding events. If a WEF client has no events to send, the WEF client will connect periodically to send a Heartbeat to the WEC server to indicate it is active. This heartbeat value can be individually configured for each subscription. - ### Will WEF work in an IPv4, IPv6, or mixed IPv4/IPv6 environment? - Yes. WEF is transport agnostic and will work over IPv4 or IPv6. - ### Are WEF events encrypted? I see an HTTP/HTTPS option! - In a domain setting, the connection used to transmit WEF events is encrypted using Kerberos, by default (with NTLM as a fallback option, which can be disabled by using a GPO). Only the WEF collector can decrypt the connection. Additionally, the connection between WEF client and WEC server is mutually authenticated regardless of authentication type (Kerberos or NTLM.) There are GPO options to force Authentication to use Kerberos Only. - This authentication and encryption is performed regardless if HTTP or HTTPS is selected. - The HTTPS option is available if certificate based authentication is used, in cases where the Kerberos based mutual authentication is not an option. The SSL certificate and provisioned client certificates are used to provide mutual authentication. - ### Do WEF Clients have a separate buffer for events? - The WEF client machines local event log is the buffer for WEF for when the connection to the WEC server is lost. To increase the “buffer size”, increase the maximum file size of the specific event log file where events are being selected. For more info, see [Appendix C – Event Channel Settings (enable and Channel Access) methods](#bkmk-appendixc). - When the event log overwrites existing events (resulting in data loss if the device is not connected to the Event Collector), there is no notification sent to the WEF collector that events are lost from the client. Neither is there an indicator that there was a gap encountered in the event stream. - ### What format is used for forwarded events? - WEF has two modes for forwarded events. The default is “Rendered Text” which includes the textual description of the event as you would see it in Event Viewer. This means that the event size is effectively doubled or tripled depending on the size of the rendered description. The alternative mode is “Events” (also sometimes referred to as “Binary” format) – which is just the event XML itself sent in binary XML format (as it would be written to the evtx file.) This is very compact and can more than double the event volume a single WEC server can accommodate. - A subscription “testSubscription” can be configured to use the Events format through the WECUTIL utility: - ``` syntax @rem required to set the DeliveryMaxItems or DeliveryMaxLatencyTime Wecutil ss “testSubscription” /cf:Events ``` - ### How frequently are WEF events delivered? - Event delivery options are part of the WEF subscription configuration parameters – There are three built-in subscription delivery options: Normal, Minimize Bandwidth, and Minimize Latency. A fourth, catch-all called “Custom” is available but cannot be selected or configured through the WEF UI by using Event Ciewer. The Custom delivery option must be selected and configured using the WECUTIL.EXE command-line application. All subscription options define a maximum event count and maximum event age, if either limit is exceeded then the accumulated events are sent to the event collector. - This table outlines the built-in delivery options: - | Event delivery optimization options | Description | |-------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Normal | This option ensures reliable delivery of events and does not attempt to conserve bandwidth. It is the appropriate choice unless you need tighter control over bandwidth usage or need forwarded events delivered as quickly as possible. It uses pull delivery mode, batches 5 items at a time and sets a batch timeout of 15 minutes. | | Minimize bandwidth | This option ensures that the use of network bandwidth for event delivery is strictly controlled. It is an appropriate choice if you want to limit the frequency of network connections made to deliver events. It uses push delivery mode and sets a batch timeout of 6 hours. In addition, it uses a heartbeat interval of 6 hours. | | Minimize latency | This option ensures that events are delivered with minimal delay. It is an appropriate choice if you are collecting alerts or critical events. It uses push delivery mode and sets a batch timeout of 30 seconds. | -   - For more info about delivery options, see [Configure Advanced Subscription Settings](http://technet.microsoft.com/library/cc749167.aspx). - The primary difference is in the latency which events are sent from the client. If none of the built-in options meet your requirements you can set Custom event delivery options for a given subscription from an elevated command prompt: - ``` syntax @rem required to set the DeliveryMaxItems or DeliveryMaxLatencyTime Wecutil ss “SubscriptionNameGoesHere” /cm:Custom - @rem set DeliveryMaxItems to 1 event Wecutil ss “SubscriptionNameGoesHere” /dmi:1 - @rem set DeliveryMaxLatencyTime to 10 ms Wecutil ss “SubscriptionNameGoesHere” /dmlt:10 ``` - ### How do I control which devices have access to a WEF Subscription? - For source initiated subscriptions: Each WEF subscription on a WEC server has its own ACL for machine accounts or security groups containing machine accounts (not user accounts) that are explicitly allowed to participate in that subscription or are explicitly denied access. This ACL applies to only a single WEF subscription (since there can be multiple WEF subscriptions on a given WEC server), other WEF Subscriptions have their own separate ACL. - For collector initiated subscriptions: The subscription contains the list of machines from which the WEC server is to collect events. This list is managed at the WEC server, and the credentials used for the subscription must have access to read event logs from the WEF Clients – the credentials can be either the machine account or a domain account. - ### Can a client communicate to multiple WEF Event Collectors? - Yes. If you desire a High-Availability environment, simply configure multiple WEC servers with the same subscription configuration and publish both WEC Server URIs to WEF clients. WEF Clients will forward events simultaneously to the configured subscriptions on the WEC servers, if they have the appropriate access. - ### What are the WEC server’s limitations? - There are three factors that limit the scalability of WEC servers. The general rule for a stable WEC server on commodity hardware is “10k x 10k” – meaning, no more than 10,000 concurrently active WEF Clients per WEC server and no more than 10,000 events/second average event volume. - - **Disk I/O**. The WEC server does not process or validate the received event, but rather buffers the received event and then logs it to a local event log file (EVTX file). The speed of logging to the EVTX file is limited by the disk write speed. Isolating the EVTX file to its own array or using high speed disks can increase the number of events per second that a single WEC server can receive. - - **Network Connections**. While a WEF source does not maintain a permanent, persistent connection to the WEC server, it does not immediately disconnect after sending its events. This means that the number of WEF sources that can simultaneously connect to the WEC server is limited to the open TCP ports available on the WEC server. - - **Registry size**. For each unique device that connects to a WEF subscription, there is a registry key (corresponding to the FQDN of the WEF Client) created to store bookmark and source heartbeat information. If this is not pruned to remove inactive clients this set of registry keys can grow to an unmanageable size over time. - - When a subscription has >1000 WEF sources connect to it over its operational lifetime, also known as lifetime WEF sources, Event Viewer can become unresponsive for a few minutes when selecting the **Subscriptions** node in the left-navigation, but will function normally afterwards. - - At >50,000 lifetime WEF sources, Event Viewer is no longer an option and wecutil.exe (included with Windows) must be used to configure and manage subscriptions. - - At >100,000 lifetime WEF sources, the registry will not be readable and the WEC server will likely have to be rebuilt. - ## Subscription information - - Below lists all of the items that each subscription collects, the actual subscription XML is available in an Appendix. These are separated out into Baseline and Targeted. The intent is to subscribe all hosts to Baseline, and then enroll (and remove) hosts on an as needed basis to the Targeted subscription. - ### Baseline subscription - While this appears to be the largest subscription, it really is the lowest volume on a per-device basis. (Exceptions should be allowed for unusual devices – a device performing complex developer related tasks can be expected to create an unusually high volume of process create and AppLocker events.) This subscription does not require special configuration on client devices to enable event channels or modify channel permissions. - The subscription is essentially a collection of query statements applied to the Event Log. This means that it is modular in nature and a given query statement can be removed or changed without impacting other query statement in the subscription. Additionally, suppress statements which filter out specific events, only apply within that query statement and are not to the entire subscription. - ### Baseline subscription requirements - To gain the most value out of the baseline subscription we recommend to have the following requirements set on the device to ensure that the clients are already generating the required events to be forwarded off the system. - - Apply a security audit policy that is a super-set of the recommended minimum audit policy. For more info, see [Appendix A – Minimum Recommended minimum Audit Policy](#bkmk-appendixa). This ensures that the security event log is generating the required events. - - Apply at least an Audit-Only AppLocker policy to devices. - - If you are already whitelisting or blacklisting events by using AppLocker, then this requirement is met. - - AppLocker events contain extremely useful information, such as file hash and digital signature information for executables and scripts. - - Enable disabled event channels and set the minimum size for modern event files. - - Currently, there is no GPO template for enabling or setting the maximum size for the modern event files. This must be done by using a GPO. For more info, see [Appendix C – Event Channel Settings (enable and Channel Access) methods](#bkmk-appendixc). - The annotated event query can be found in the following. For more info, see [Appendix F – Annotated Baseline Subscription Event Query](#bkmk-appendixf). - - Anti-malware events from Microsoft Antimalware or Windows Defender. This can be configured for any given anti-malware product easily if it writes to the Windows event log. - - Security event log Process Create events. - - AppLocker Process Create events (EXE, script, packaged App installation and execution). - - Registry modification events. For more info, see [Appendix B – Recommended minimum Registry System ACL Policy](#bkmk-appendixb). - - OS startup and shutdown - - Startup event include operating system version, service pack level, QFE version, and boot mode. - - Service install - - Includes what the name of the service, the image path, and who installed the service. - - Certificate Authority audit events - - This is only applicable on systems with the Certificate Authority role installed. - - Logs certificate requests and responses. - - User profile events - - Use of a temporary profile or unable to create a user profile may indicate an intruder is interactively logging into a device but not wanting to leave a persistent profile behind. - - Service start failure - - Failure codes are localized, so you have to check the message DLL for values. - - Network share access events - - Filter out IPC$ and /NetLogon file shares, which are expected and noisy. - - System shutdown initiate requests - - Find out what initiated the restart of a device. - - User initiated interactive logoff event - - Remote Desktop Services session connect, reconnect, or disconnect. - - EMET events, if EMET is installed. - - Event forwarding plugin events - - For monitoring WEF subscription operations, particularly Partial Success events. This is useful for diagnosing deployment issues. - - Network share create and delete - - Enables detection of unauthorized share creation. - **Note**  All shares are re-created when the device starts. -   - - Logon sessions - - Logon success for interactive (local and Remote Interactive/Remote Desktop) - - Logon success for services for non-built-in accounts, such as LocalSystem, LocalNetwork, and so on. - - Logon success for batch sessions - - Logon session close, which are logoff events for non-network sessions. - - Windows Error Reporting (Application crash events only) - - This can help detect early signs of intruder not familiar with enterprise environment using targeted malware. - Event log service events - - Errors, start events, and stop events for the Windows Event Log service. - - Event log cleared (including the Security Event Log) - - This could indicate an intruder that are covering their tracks. - - Special privileges assigned to new logon - - This indicates that at the time of logon a user is either an Administrator or has the sufficient access to make themselves Administrator. - - Outbound Remote Desktop Services session attempts - - Visibility into potential beachhead for intruder - - System time changed - - SMB Client (mapped drive connections) - - Account credential validation - - Local accounts or domain accounts on domain controllers - - A user was added or removed from the local Administrators security group. - - Crypto API private key accessed - - Associated with signing objects using the locally stored private key. - - Task Scheduler task creation and delete - - Task Scheduler allows intruders to run code at specified times as LocalSystem. - - Logon with explicit credentials - - Detect credential use changes by intruders to access additional resources. - - Smartcard card holder verification events - - This detects when a smartcard is being used. - ### Suspect subscription - This adds some possible intruder-related activity to help analyst further refine their determinations about the state of the device. - - Logon session creation for network sessions - - Enables time-series analysis of network graphs. - - RADIUS and VPN events - - Useful if you use a Microsoft IAS RADIUS/VPN implementation. It shows user-> IP address assignment with remote IP address connecting to the enterprise. - - Crypto API X509 object and build chain events - - Detects known bad certificate, CA, or sub-CA - - Detects unusual process use of CAPI - - Groups assigned to local logon - - Gives visibility to groups which enable account wide access - - Allows better planning for remediation efforts - - Excludes well known, built-in system accounts. - - Logon session exit - - Specific for network logon sessions. - - Client DNS lookup events - - Returns what process performed a DNS query and the results returned from the DNS server. - - Process exit - - Enables checking for processes terminating unexpectedly. - - Local credential validation or logon with explicit credentials - - Generated when the local SAM is authoritative for the account credentials being authenticated. - - Noisy on domain controllers - - On client devices this is only generated when local accounts log on. - - Registry modification audit events - - Only when a registry value is being created, modified, or deleted. - - Wireless 802.1x authentication - - Detect wireless connection with a peer MAC address - - Windows PowerShell logging - - Covers Windows PowerShell 2.0 and later and includes the Windows PowerShell 5.0 logging improvements for in-memory attacks using Windows PowerShell. - - Includes Windows PowerShell remoting logging - - User Mode Driver Framework “Driver Loaded” event - - Can possibly detect a USB device loading multiple device drivers. For example, a USB\_STOR device loading the keyboard or network driver. - ## Appendix A - Minimum recommended minimum audit policy - - If your organizational audit policy enables additional auditing to meet its needs, that is fine. The policy below is the minimum audit policy settings needed to enable events collected by both baseline and targeted subscriptions. - | Category | Subcategory | Audit settings | |--------------------|---------------------------------|---------------------| | Account Logon | Credential Validation | Success and Failure | @@ -404,59 +230,30 @@ If your organizational audit policy enables additional auditing to meet its need | System | Security State Change | Success and Failure | | System | Security System Extension | Success and Failure | | System | System Integrity | Success and Failure | -   - ## Appendix B - Recommended minimum registry system ACL policy - - The Run and RunOnce keys are useful for intruders and malware persistence. It allows code to be run (or run only once then removed, respectively) when a user logs into the system. - This can easily be extended to other Auto-Execution Start Points keys in the registry. - Use the following figures to see how you can configure those registry keys. - ![default acl for run key](images/runkey.png)![default acl for runonce key](images/runoncekey.png) - ## Appendix C - Event channel settings (enable and channel access) methods - - Some channels are disabled by default and have to be enabled. Others, such as Microsoft-Windows-CAPI2/Operational must have the channel access modified to allow the Event Log Readers built-in security group to read from it. - The recommended and most effective way to do this is to configure the baseline GPO to run a scheduled task to configure the event channels (enable, set maximum size, and adjust channel access.) This will take effect at the next GPO refresh cycle and has minimal impact on the client device. - The following GPO snippet performs the following: - - Enables the **Microsoft-Windows-Capi2/Operational** event channel. - - Sets the maximum file size for **Microsoft-Windows-Capi2/Operational** to 100MB. - - Sets the maximum file size for **Microsoft-Windows-AppLocker/EXE and DLL** to 100MB. - - Sets the maximum channel access for **Microsoft-Windows-Capi2/Operational** to include the built-in Event Log Readers security group. - - Enables the **Microsoft-Windows-DriverFrameworks-UserMode/Operational** event channel. - - Sets the maximum file size for **Microsoft-Windows-DriverFrameworks-UserMode/Operational** to 50MB. - ![configure event channels](images/capi-gpo.png) - ## Appendix D - Minimum GPO for WEF Client configuration - - Here are the minimum steps for WEF to operate: - 1. Configure the collector URI(s). - 2. Start the WinRM service. - 3. Add the Network Service account to the built-in Event Log Readers security group. This allows reading from secured event channel, such as the security event channel. - ![configure the wef client](images/wef-client-config.png) - ## Appendix E – Annotated baseline subscription event query - - ``` syntax @@ -619,10 +416,7 @@ Here are the minimum steps for WEF to operate: ``` - ## Appendix F – Annotated Suspect Subscription Event Query - - ``` syntax @@ -691,25 +485,11 @@ Here are the minimum steps for WEF to operate: ``` - ## Appendix G - Online resources - - You can get more info with the following links: - - [Event Selection](http://msdn.microsoft.com/library/aa385231(VS.85).aspx) - - [Event Queries and Event XML](http://msdn.microsoft.com/library/bb399427(VS.90).aspx) - - [Event Query Schema](http://msdn.microsoft.com/library/aa385760(VS.85).aspx) - - [Windows Event Collector](http://msdn.microsoft.com/library/windows/desktop/bb427443.aspx) -   -   - - - - - diff --git a/windows/keep-secure/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md b/windows/keep-secure/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md index 84909d2ff2..9f31ef56eb 100644 --- a/windows/keep-secure/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md +++ b/windows/keep-secure/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md @@ -2,55 +2,33 @@ title: User Account Control Admin Approval Mode for the Built-in Administrator account (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Admin Approval Mode for the Built-in Administrator account security policy setting. ms.assetid: d465fc27-1cd2-498b-9cf6-7ad2276e5998 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # User Account Control: Admin Approval Mode for the Built-in Administrator account - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Admin Approval Mode for the Built-in Administrator account** security policy setting. - ## Reference - - This policy setting determines the behavior of Admin Approval Mode for the built-in administrator account. - When the Admin Approval Mode is enabled, the local administrator account functions like a standard user account, but it has the ability to elevate privileges without logging on by using a different account. In this mode, any operation that requires elevation of privilege displays a prompt that allows the administrator to permit or deny the elevation of privilege. If Admin Approval Mode is not enabled, the built-in Administrator account logs on in Windows XP Mode, and it runs all applications by default with full administrative privileges. By default, this setting is set to **Disabled**. - **Note**   If a computer is upgraded from a previous version of the Windows operating system, and the administrator account is the only account on the computer, the built-in administrator account remains enabled, and this setting is also enabled. -   - ### Possible values - - Enabled - The built-in administrator account logs on in Admin Approval Mode so that any operation that requires elevation of privilege displays a prompt that provides the administrator the option to permit or deny the elevation of privilege. - - Disabled - The built-in administrator account logs on in Windows XP Mode, and it runs all applications by default with full administrative privileges. - ### Best practices - - Do not enable the built-in administrator account on the client computer, but use the standard user account and User Account Control (UAC). - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -89,49 +67,22 @@ The following table lists the actual and effective default values for this polic
    -   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - One of the risks of the User Account Control (UAC) feature is that it is intended to mitigate malicious software running under elevated credentials without the user or administrator being aware of its activity. An attack vector for malicious programs is to discover the password of the administrator account because that user account was created for all installations of the Windows. To address this risk, the built-in administrator account is disabled in computers running at least Windows Vista. In computers running at least Windows Server 2008, the administrator account is enabled, and the password must be changed the first time the Administrator logs on. In a default installation of a computer running at least Windows Vista, accounts with administrative control over the computer are initially set up in one of two ways: - - If the computer is not joined to a domain, the first user account you create has the equivalent permissions as a local administrator. - - If the computer is joined to a domain, no local administrator accounts are created. The enterprise or domain administrator must log on to the computer and create a local administrator account if one is warranted. - ### Countermeasure - Enable the **User Account Control: Admin Approval Mode for the Built-in Administrator account** setting if you have the built-in Administrator account enabled. - ### Potential impact - Users who log on by using the local administrator account are prompted for consent whenever a program requests an elevation in privilege. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md b/windows/keep-secure/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md index 3dea249901..3215dba248 100644 --- a/windows/keep-secure/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md +++ b/windows/keep-secure/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md @@ -2,77 +2,44 @@ title: User Account Control Allow UIAccess applications to prompt for elevation without using the secure desktop (Windows 10) description: Describes the best practices, location, values, and security considerations for the User Account Control Allow UIAccess applications to prompt for elevation without using the secure desktop security policy setting. ms.assetid: fce20472-3c93-449d-b520-13c4c74a9892 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop - - **Applies to** - - Windows 10 - Describes the best practices, location, values, and security considerations for the **User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop** security policy setting. - ## Reference - - This security setting controls whether User Interface Accessibility (UIAccess or UIA) programs can automatically disable the secure desktop for elevation prompts that are used by a standard user. - **Note**   This setting does not change the behavior of the UAC elevation prompt for administrators. -   - **Background** - User Interface Privilege Isolation (UIPI) implements restrictions in the Windows subsystem that prevent lower-privilege applications from sending messages or installing hooks in higher-privilege processes. Higher-privilege applications are permitted to send messages to lower-privilege processes. UIPI does not interfere with or change the behavior of messages between applications at the same privilege (or integrity) level. - Microsoft UI Automation is the current model to support accessibility requirements in the Windows operating systems. Applications that are designed to support an accessible user experience control the behavior of other Windows applications on behalf of the user. When all applications on the automation client computer and server are running as a standard user (that is, at a medium integrity level), the UIPI restrictions do not interfere with the Microsoft UI automation model. - However, there might be times when an administrative user runs an application with elevated privilege based on UAC in Admin Approval Mode. Microsoft UI Automation cannot drive the UI graphics of elevated applications on the desktop without the ability to bypass the restrictions that UIPI implements. The ability to bypass UIPI restrictions across privilege levels is available for UI automation programs by using UIAccess. - If an application presents a UIAccess attribute when it requests privileges, the application is stating a requirement to bypass UIPI restrictions for sending messages across privilege levels. Devices implement the following policy checks before starting an application with UIAccess privilege. - 1. The application must have a digital signature that can be verified by using a digital certificate that is associated with the Trusted Root Certification Authorities store on the local computer. - 2. The application must be installed in a local folder that is writeable only by administrators, such as the Program Files directory. The allowed directories for UI automation applications are: - 1. %ProgramFiles% and its subdirectories. - 2. %WinDir% and its subdirectories, except a few subdirectories that are excluded because standard users have write access. - **Resulting behavior** - When this setting is enabled, UIAccess programs (including Windows Remote Assistance) can automatically disable the secure desktop for elevation prompts. Unless you have also disabled elevation prompts, the prompts appear on the interactive user's desktop instead of on the secure desktop. The prompts also appear on the remote administrator's view of the desktop during a Windows Remote Assistance session, and the remote administrator can provide the appropriate credentials for elevation. - If you disable this setting, the secure desktop can only be disabled by the user of the interactive desktop or by disabling the [User Account Control: Switch to the secure desktop when prompting for elevation](user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md) setting, which by default is enabled. - ### Possible values - - Enabled - UIA programs can automatically disable the secure desktop for elevation prompts, and unless you have also disabled elevation prompts, the prompts appear on the interactive user's desktop instead of on the secure desktop. Prompts will also appear on the remote administrator's view of the desktop during a Windows Remote Assistance session, and the remote administrator can provide the appropriate credentials for elevation. - - Disabled - The secure desktop can be disabled only by the user of the interactive desktop or by disabling the **User Account Control: Switch to the secure desktop when prompting for elevation** policy setting. - ### Best practices - - Best practices are dependent on your security policies and your remote operational requirements. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -111,61 +78,28 @@ The following table lists the actual and effective default values for this polic
    -   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. - ### Group Policy - All auditing capabilities are integrated in Group Policy. You can configure, deploy, and manage these settings in the Group Policy Management Console (GPMC) or Local Security Policy snap-in for a domain, site, or organizational unit (OU). - ### Policy interactions - If you plan to enable this setting, you should also review the effect of the [User Account Control: Behavior of the elevation prompt for standard users](user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md) setting. If it is configured as **Automatically deny elevation requests**, elevation requests are not presented to the user. If you disable this setting, the secure desktop can only be disabled by the user of the interactive desktop or by disabling the [User Account Control: Switch to the secure desktop when prompting for elevation](user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md) setting, which by default is enabled. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - UIA programs are designed to interact with Windows and application programs on behalf of a user. This setting allows UIA programs to bypass the secure desktop to increase usability in certain cases, but it allows elevation requests to appear on the regular interactive desktop instead of on the secure desktop. This increases the risk that a malicious program could intercept data that is being transferred between the UI and the application. Because UIA programs must be able to respond to prompts regarding security issues, such as the UAC elevation prompt, UIA programs must be highly trusted. To be considered trusted, a UIA program must be digitally signed. By default, UIA programs can be run only from the following protected paths: - - ..\\Program Files\\ (and subfolders) - - ..\\Program Files (x86)\\ (and subfolders, in 64-bit versions of Windows only) - - ..\\Windows\\System32\\ - The requirement to be in a protected path can be disabled by the [User Account Control: Only elevate UIAccess applications that are installed in secure locations](user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md) setting. Although this setting applies to any UIA program, it is used primarily in certain Windows Remote Assistance scenarios. - ### Countermeasure - Disable the **User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop** setting. - ### Potential impact - If a user requests remote assistance from an administrator and the remote assistance session is established, elevation prompts appear on the interactive user's secure desktop and the administrator's remote session is paused. To avoid pausing the remote administrator’s session during elevation requests, the user can select the "Allow IT Expert to respond to User Account Control prompts" check box when setting up the remote assistance session. However, selecting this check box requires that the interactive user respond to an elevation prompt on the secure desktop. If the interactive user is a standard user, the user does not have the required credentials to allow elevation. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md b/windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md index d60ccc6dc6..2f01c9ecc5 100644 --- a/windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md +++ b/windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md @@ -2,69 +2,40 @@ title: User Account Control Behavior of the elevation prompt for administrators in Admin Approval Mode (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Behavior of the elevation prompt for administrators in Admin Approval Mode security policy setting. ms.assetid: 46a3c3a2-1d2e-4a6f-b5e6-29f9592f535d +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode** security policy setting. - ## Reference - - This policy setting determines the behavior of the elevation prompt for accounts that have administrative credentials. - ### Possible values - - **Elevate without prompting** - Assumes that the administrator will permit an operation that requires elevation, and additional consent or credentials are not required. - **Note**   Selecting **Elevate without prompting** minimizes the protection that is provided by UAC. We do not recommend selecting this value unless administrator accounts are tightly controlled and the operating environment is highly secure. -   - - **Prompt for credentials on the secure desktop** - When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a privileged user name and password. If the user enters valid credentials, the operation continues with the user's highest available privilege. - - **Prompt for consent on the secure desktop** - When an operation requires elevation of privilege, the user is prompted on the secure desktop to select **Permit** or **Deny**. If the user selects **Permit**, the operation continues with the user's highest available privilege. - - **Prompt for credential**s - An operation that requires elevation of privilege prompts the administrator to type the user name and password. If the administrator enters valid credentials, the operation continues with the applicable privilege. - - **Prompt for consent** - An operation that requires elevation of privilege prompts the administrator to select **Permit** or **Deny**. If the administrator selects **Permit**, the operation continues with the administrator's highest available privilege. - - **Prompt for consent for non-Windows binaries** - This is the default. When an operation for a non-Microsoft application requires elevation of privilege, the user is prompted on the secure desktop to select **Permit** or **Deny**. If the user selects **Permit**, the operation continues with the user's highest available privilege. - ### Best practices - - Selecting the option **Elevate without prompting** minimizes the protection that is provided by UAC. We do not recommend selecting this value unless administrator accounts are tightly controlled and the operating environment is highly secure. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -103,49 +74,22 @@ The following table lists the actual and effective default values for this polic
    -   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. - ### Group Policy - All auditing capabilities are integrated in Group Policy. You can configure, deploy, and manage these settings in the Group Policy Management Console (GPMC) or Local Security Policy snap-in for a domain, site, or organizational unit (OU). - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - One of the risks that the UAC feature tries to mitigate is that of malicious software running under elevated credentials without the user or administrator being aware of its activity. This setting raises awareness to the administrator of elevated privilege operations, and it permits the administrator to prevent a malicious program from elevating its privilege when the program attempts to do so. - ### Countermeasure - Configure the **User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode** setting to **Prompt for consent**. - ### Potential impact - Administrators should be made aware that they will be prompted for consent when all binaries attempt to run. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md b/windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md index 38d421d5f1..727d8b7ba1 100644 --- a/windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md +++ b/windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md @@ -2,54 +2,32 @@ title: User Account Control Behavior of the elevation prompt for standard users (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Behavior of the elevation prompt for standard users security policy setting. ms.assetid: 1eae7def-8f6c-43b6-9474-23911fdc01ba +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # User Account Control: Behavior of the elevation prompt for standard users - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Behavior of the elevation prompt for standard users** security policy setting. - ## Reference - - This policy setting determines the behavior of the elevation prompt for standard users. - ### Possible values - - **Automatically deny elevation requests** - This option returns an “Access denied” error message to standard users when they try to perform an operation that requires elevation of privilege. Most organizations that run desktops as standard users configure this policy to reduce Help Desk calls. - - **Prompt for credentials on the secure desktop** - This is the default. When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a different user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. - - **Prompt for credentials** - An operation that requires elevation of privilege prompts the user to type an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. - ### Best practices - 1. Configure the **User Account Control: Behavior of the elevation prompt for standard users** to **Automatically deny elevation requests**. This setting requires the user to log on with an administrative account to run programs that require elevation of privilege. - 2. As a security best practice, standard users should not have knowledge of administrative passwords. However, if your users have both standard and administrator-level accounts, set **Prompt for credentials** so that the users do not choose to always log on with their administrator accounts, and they shift their behavior to use the standard user account. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -88,49 +66,22 @@ The following table lists the actual and effective default values for this polic
    -   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. - ### Group Policy - All auditing capabilities are integrated in Group Policy. You can configure, deploy, and manage these settings in the Group Policy Management Console (GPMC) or Local Security Policy snap-in for a domain, site, or organizational unit (OU). - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - One of the risks that the UAC feature tries to mitigate is that of malicious programs running under elevated credentials without the user or administrator being aware of their activity. This setting raises awareness to the user that a program requires the use of elevated privilege operations, and it requires that the user supply administrative credentials for the program to run. - ### Countermeasure - Configure the **User Account Control: Behavior of the elevation prompt for standard users** to **Automatically deny elevation requests**. This setting requires the user to log on with an administrative account to run programs that require elevation of privilege. As a security best practice, standard users should not have knowledge of administrative passwords. However, if your users have both standard and administrator-level accounts, we recommend setting **Prompt for credentials** so that the users do not choose to always log on with their administrator accounts, and they shift their behavior to use the standard user account. - ### Potential impact - Users must provide administrative passwords to run programs with elevated privileges. This could cause an increased load on IT staff while the programs that are affected are identified and standard operating procedures are modified to support least privilege operations. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/user-account-control-detect-application-installations-and-prompt-for-elevation.md b/windows/keep-secure/user-account-control-detect-application-installations-and-prompt-for-elevation.md index 53b4161dd7..067ec3619c 100644 --- a/windows/keep-secure/user-account-control-detect-application-installations-and-prompt-for-elevation.md +++ b/windows/keep-secure/user-account-control-detect-application-installations-and-prompt-for-elevation.md @@ -2,52 +2,31 @@ title: User Account Control Detect application installations and prompt for elevation (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Detect application installations and prompt for elevation security policy setting. ms.assetid: 3f8cb170-ba77-4c9f-abb3-c3ed1ef264fc +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # User Account Control: Detect application installations and prompt for elevation - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Detect application installations and prompt for elevation** security policy setting. - ## Reference - - This policy setting determines the behavior of application installation detection for the entire system. - Some software might attempt to install itself after being given permission to run. The user may give permission for the program to run because the program is trusted. Then the user is prompted to install an unknown component. This security policy provides another way to identify and stop these attempted software installations before they can do damage. - ### Possible values - - **Enabled** - Application installation packages that require an elevation of privilege to install are detected and the user is prompted for administrative credentials. - - **Disabled** - Application installation packages that require an elevation of privilege to install are not detected and the user is not prompted for administrative credentials. - ### Best practices - 1. Installer detection is unnecessary when enterprises run standard user desktops that capitalize on delegated installation technologies like Group Policy Software Install (GPSI) or Configuration Manager. Therefore you can set this security policy to **Disabled**. - 2. Enable the **User Account Control: Detect application installations and prompt for elevation** setting so standard users must provide administrative credentials before software is installed. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -86,45 +65,20 @@ The following table lists the actual and effective default values for this polic
    -   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Some malicious software might attempt to install itself after being given permission to run, for example, malicious software with a trusted application shell. The user may give permission for the program to run because the program is trusted. Then the user is prompted to install an unknown component. This policy provides another way to trap the software before it can do damage. - ### Countermeasure - Enable the **User Account Control: Detect application installations and prompt for elevation** setting. - ### Potential impact - Users must provide administrative passwords to install programs. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/user-account-control-only-elevate-executables-that-are-signed-and-validated.md b/windows/keep-secure/user-account-control-only-elevate-executables-that-are-signed-and-validated.md index 94fac9972b..7c3f3ccfae 100644 --- a/windows/keep-secure/user-account-control-only-elevate-executables-that-are-signed-and-validated.md +++ b/windows/keep-secure/user-account-control-only-elevate-executables-that-are-signed-and-validated.md @@ -2,54 +2,32 @@ title: User Account Control Only elevate executables that are signed and validated (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Only elevate executables that are signed and validated security policy setting. ms.assetid: 64950a95-6985-4db6-9905-1db18557352d +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # User Account Control: Only elevate executables that are signed and validated - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Only elevate executables that are signed and validated** security policy setting. - ## Reference - - This policy setting enforces public key infrastructure (PKI) signature checks on any interactive application that requests elevation of privilege. You can control the apps that are allowed to run through the population of certificates in the local computer's Trusted Publishers store. - A trusted publisher is a certificate issuer that the computer’s user has chosen to trust and that has certificate details that have been added to the store of trusted publishers. - Windows maintains certificates in certificate stores. These stores can be represented by containers in the file system or the registry, or they can be implemented as physical stores such as smart cards. Certificate stores are associated with the computer object or they are owned by a distinct user who has a security context and profile on that computer. In addition, services can have certificate stores. A certificate store will often contain numerous certificates, possibly issued from a number of different certification authorities (CAs). - When certificate path discovery is initiated, Windows attempts to locate the issuing CA for the certificates, and it builds a certificate path to the trusted root certificate. Intermediate certificates are included as part of the application protocol or are picked up from Group Policy or through URLs that are specified in the Authority Information Access (AIA) extension. When the path is built, each certificate in the path is verified for validity with respect to various parameters, such as name, time, signature, revocation status, and other constraints. - ### Possible values - - **Enabled** - Enforces the PKI certificate chain validation of a given executable file before it is permitted to run. - - **Disabled** - Does not enforce PKI certificate chain validation before a given executable file is permitted to run. - ### Best practices - - Best practices are dependent on your security and performance goals. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -88,51 +66,23 @@ The following table lists the actual and effective default values for this polic
    -   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. - ### Group Policy - All auditing capabilities are integrated in Group Policy. You can configure, deploy, and manage these settings in the Group Policy Management Console (GPMC) or Local Security Policy snap-in for a domain, site, or organizational unit (OU). - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Intellectual property, personally identifiable information, and other confidential data are normally manipulated by applications on the computer, and elevated credentials are required to access the information. Users and administrators inherently trust applications that are used with these information sources, and they provide their credentials. If one of these applications is replaced by a rogue application that appears identical to the trusted application, the confidential data could be compromised and the user's administrative credentials would also be compromised. - ### Countermeasure - Enable the **User Account Control: Only elevate executables that are signed and validated**. - ### Potential impact - Enabling this setting requires that you have a PKI infrastructure and that your enterprise administrators have populated the Trusted Publishers store with the certificates for the allowed applications. Some older applications are not signed, and they cannot be used in an environment that is hardened with this setting. You should carefully test your applications in a preproduction environment before implementing this setting. - Control over the applications that are installed on the desktops and the hardware that joins your domain should provide similar protection from the vulnerability that is addressed by this setting. Additionally, the level of protection that is provided by this setting is not an assurance that all rogue applications will be found. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md b/windows/keep-secure/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md index c6776e5433..b79b29a94b 100644 --- a/windows/keep-secure/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md +++ b/windows/keep-secure/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md @@ -2,77 +2,44 @@ title: User Account Control Only elevate UIAccess applications that are installed in secure locations (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Only elevate UIAccess applications that are installed in secure locations security policy setting. ms.assetid: 4333409e-a5be-4f2f-8808-618f53abd22c +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # User Account Control: Only elevate UIAccess applications that are installed in secure locations - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Only elevate UIAccess applications that are installed in secure locations** security policy setting. - ## Reference - - This policy setting enforces the requirement that apps that request running with a UIAccess integrity level (by means of a marking of UIAccess=true in their app manifest), must reside in a secure location on the file system. Relatively secure locations are limited to the following directories: - - \\Program Files\\ including subdirectories - - \\Windows\\system32\\ - - \\Program Files (x86)\\ including subdirectories for 64-bit versions of Windows - **Note**   Windows enforces a PKI signature check on any interactive application that requests running with a UIAccess integrity level, regardless of the state of this security setting. -   - **Background** - User Interface Privilege Isolation (UIPI) implements restrictions in the Windows subsystem that prevent lower-privilege applications from sending messages or installing hooks in higher-privilege processes. Higher-privilege applications are permitted to send messages to lower-privilege processes. UIPI does not interfere with or change the behavior of messages between applications at the same privilege (or integrity) level. - Microsoft UI Automation is the current model to support accessibility requirements in the Windows operating systems. Applications that are designed to support an accessible user experience control the behavior of other Windows applications on behalf of the user. When all applications on the automation client computer and server are running as a standard user (that is, at a medium integrity level), the UIPI restrictions do not interfere with the Microsoft UI automation model. - However, there might be times when an administrative user runs an application with elevated privilege based on UAC in Admin Approval Mode. Microsoft UI Automation cannot drive the UI graphics of elevated applications on the desktop without the ability to bypass the restrictions that UIPI implements. The ability to bypass UIPI restrictions across privilege levels is available for UI automation programs by using UIAccess. - If an application presents a UIAccess attribute when it requests privileges, the application is stating a requirement to bypass UIPI restrictions for sending messages across privilege levels. Devices implement the following policy checks before starting an application with UIAccess privilege. - 1. The application must have a digital signature that can be verified by using a digital certificate that is associated with the Trusted Root Certification Authorities store on the local device - 2. The application must be installed in a local folder that is writeable only by administrators, such as the Program Files directory. The allowed directories for UI automation applications are: - 1. %ProgramFiles% and its subdirectories. - 2. %WinDir% and its subdirectories, except a few subdirectories that are excluded because standard users have write access. - ### Possible values - - **Enabled** - An application can start with UIAccess integrity only if it resides in a secure location in the file system. - - **Disabled** - An application can start with UIAccess integrity even if it does not reside in a secure location in the file system. - ### Best practices - - Set this policy to **Enabled** to permit applications that are located in one of the designated secure directories to run with UIAccess integrity. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -111,59 +78,27 @@ The following table lists the actual and effective default values for this polic
    -   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they aresaved locally or distributed through Group Policy. - ### Group Policy - All auditing capabilities are integrated in Group Policy. You can configure, deploy, and manage these settings in the Group Policy Management Console (GPMC) or Local Security Policy snap-in for a domain, site, or organizational unit (OU). - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - UIAccess integrity allows an application to bypass User Interface Privilege Isolation (UIPI) restrictions when an application is elevated in privilege from a standard user to an administrator. When this setting is enabled, an application that has the UIAccess flag set to true in its manifest can interchange information with applications that are running at a higher privilege level, such as logon prompts and privilege elevation prompts. This ability is required to support accessibility features such as screen readers that are transmitting user interfaces to alternative forms, but it is not required by most applications. A process that is started with UIAccess rights has the following abilities: - - Set the foreground window. - - Drive any application window by using the SendInput function. - - Use read input for all integrity levels by using low-level hooks, raw input, GetKeyState, GetAsyncKeyState, and GetKeyboardInput. - - Set journal hooks. - - Use AttachThreadInput to attach a thread to a higher integrity input queue. - ### Countermeasure - Enable the **User Account Control: Only elevate UIAccess applications that are installed in secure locations** setting. - ### Potential impact - If the application that requests UIAccess meets the UIAccess setting requirements, computers running at least the Windows Vista operating system start the application with the ability to bypass most of the UIPI restrictions. If the application does not meet the security restrictions, the application is started without UIAccess rights, and it can interact only with applications at the same or lower privilege level. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/user-account-control-overview.md b/windows/keep-secure/user-account-control-overview.md index 5220e7b05d..f2eb1a4824 100644 --- a/windows/keep-secure/user-account-control-overview.md +++ b/windows/keep-secure/user-account-control-overview.md @@ -2,50 +2,30 @@ title: User Account Control (Windows 10) description: User Account Control (UAC) helps prevent malware from damaging a PC and helps organizations deploy a better-managed desktop. ms.assetid: 43ac4926-076f-4df2-84af-471ee7d20c38 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: operate ms.sitesec: library author: brianlic-msft --- - # User Account Control - **Applies to** - - Windows 10 - Windows Server 2016 Technical Preview - User Account Control (UAC) helps prevent malware from damaging a PC and helps organizations deploy a better-managed desktop. With UAC, apps and tasks always run in the security context of a non-administrator account, unless an administrator specifically authorizes administrator-level access to the system. UAC can block the automatic installation of unauthorized apps and prevent inadvertent changes to system settings. - UAC allows all users to log on to their computers using a standard user account. Processes launched using a standard user token may perform tasks using access rights granted to a standard user. For instance, Windows Explorer automatically inherits standard user level permissions. Additionally, any apps that are started using Windows Explorer (for example, by double-clicking a shortcut) also run with the standard set of user permissions. Many apps, including those that are included with the operating system itself, are designed to work properly in this way. - Other apps, especially those that were not specifically designed with security settings in mind, often require additional permissions to run successfully. These types of apps are referred to as legacy apps. Additionally, actions such as installing new software and making configuration changes to the Windows Firewall, require more permissions than what is available to a standard user account. - When an app needs to run with more than standard user rights, UAC can restore additional user groups to the token. This enables the user to have explicit control of apps that are making system level changes to their computer or device. - ## Practical applications - Admin Approval Mode in UAC helps prevent malware from silently installing without an administrator's knowledge. It also helps protect from inadvertent system-wide changes. Lastly, it can be used to enforce a higher level of compliance where administrators must actively consent or provide credentials for each administrative process. - ## New and changed functionality - To find out what's new in UAC for Windows 10, see [User Account Control](../whats-new/user-account-control.md). - ## In this section - | Topic | Description | | - | - | | [How User Account Control works](how-user-account-control-works.md) | User Account Control (UAC) is a fundamental component of Microsoft's overall security vision. UAC helps mitigate the impact of malware. | | [User Account Control security policy settings](user-account-control-security-policy-settings.md) | You can use security policies to configure how User Account Control works in your organization. They can be configured locally by using the Local Security Policy snap-in (secpol.msc) or configured for the domain, OU, or specific groups by Group Policy. | | [User Account Control Group Policy and registry key settings](user-account-control-group-policy-and-registry-key-settings.md) | Here's a list of UAC Group Policy and registry key settings that your organization can use to manage UAC. | -   -   -   - - - - - diff --git a/windows/keep-secure/user-account-control-run-all-administrators-in-admin-approval-mode.md b/windows/keep-secure/user-account-control-run-all-administrators-in-admin-approval-mode.md index 9219e967ee..0c53ba8b97 100644 --- a/windows/keep-secure/user-account-control-run-all-administrators-in-admin-approval-mode.md +++ b/windows/keep-secure/user-account-control-run-all-administrators-in-admin-approval-mode.md @@ -2,53 +2,32 @@ title: User Account Control Run all administrators in Admin Approval Mode (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Run all administrators in Admin Approval Mode security policy setting. ms.assetid: b838c561-7bfc-41ef-a7a5-55857259c7bf +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # User Account Control: Run all administrators in Admin Approval Mode - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Run all administrators in Admin Approval Mode** security policy setting. - ## Reference - - This policy setting determines the behavior of all User Account Control (UAC) policies for the entire system. This is the setting that turns UAC on or off. - ### Possible values - - **Enabled** - Admin Approval Mode and all other UAC policies are dependent on this option being enabled. Changing this setting requires restarting the system. - - **Disabled** - Admin Approval Mode and all related UAC policies are disabled. - **Note**   If this security setting is configured to **Disabled**, the Security Center notifies the user that the overall security of the operating system has been reduced. -   - ### Best practices - - Enable this policy to allow all other UAC features and policies to function. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -87,49 +66,22 @@ The following table lists the actual and effective default values for this polic
    -   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - A restart of the computer is required before this policy will be effective when changes to this policy are saved locally or distributed through Group Policy. - ### Group Policy - All auditing capabilities are integrated in Group Policy. You can configure, deploy, and manage these settings in the Group Policy Management Console (GPMC) or Local Security Policy snap-in for a domain, site, or organizational unit (OU). - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - This is the setting that turns UAC on or off. If this setting is disabled, UAC is not used, and any security benefits and risk mitigations that are dependent on UAC are not present on the computer. - ### Countermeasure - Enable the **User Account Control: Run all users, including administrators, as standard users** setting. - ### Potential impact - Users and administrators must learn to work with UAC prompts and adjust their work habits to use least privilege operations. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/user-account-control-security-policy-settings.md b/windows/keep-secure/user-account-control-security-policy-settings.md index 4b14dad1b3..d1a286bf5e 100644 --- a/windows/keep-secure/user-account-control-security-policy-settings.md +++ b/windows/keep-secure/user-account-control-security-policy-settings.md @@ -2,137 +2,66 @@ title: User Account Control security policy settings (Windows 10) description: You can use security policies to configure how User Account Control works in your organization. They can be configured locally by using the Local Security Policy snap-in (secpol.msc) or configured for the domain, OU, or specific groups by Group Policy. ms.assetid: 3D75A9AC-69BB-4EF2-ACB3-1769791E1B98 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: operate ms.sitesec: library author: brianlic-msft --- - # User Account Control security policy settings - - **Applies to** - - Windows 10 - You can use security policies to configure how User Account Control works in your organization. They can be configured locally by using the Local Security Policy snap-in (secpol.msc) or configured for the domain, OU, or specific groups by Group Policy. - ## User Account Control: Admin Approval Mode for the Built-in Administrator account - - This policy setting controls the behavior of Admin Approval Mode for the built-in Administrator account. - - **Enabled** The built-in Administrator account uses Admin Approval Mode. By default, any operation that requires elevation of privilege will prompt the user to approve the operation. - - **Disabled** (Default) The built-in Administrator account runs all applications with full administrative privilege. - ## User Account Control: Allow UIAccess application to prompt for elevation without using the secure desktop - - This policy setting controls whether User Interface Accessibility (UIAccess or UIA) programs can automatically disable the secure desktop for elevation prompts used by a standard user. - - **Enabled** UIA programs, including Windows Remote Assistance, automatically disable the secure desktop for elevation prompts. If you do not disable the "User Account Control: Switch to the secure desktop when prompting for elevation" policy setting, the prompts appear on the interactive user's desktop instead of the secure desktop. - - **Disabled** (Default) The secure desktop can be disabled only by the user of the interactive desktop or by disabling the "User Account Control: Switch to the secure desktop when prompting for elevation" policy setting. - ## User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode - - This policy setting controls the behavior of the elevation prompt for administrators. - - **Elevate without prompting** Allows privileged accounts to perform an operation that requires elevation without requiring consent or credentials. - **Note**  Use this option only in the most constrained environments. -   - - **Prompt for credentials on the secure desktop** When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a privileged user name and password. If the user enters valid credentials, the operation continues with the user's highest available privilege. - - **Prompt for consent on the secure desktop** When an operation requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. - - **Prompt for credentials** When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. - - **Prompt for consent** When an operation requires elevation of privilege, the user is prompted to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. - - **Prompt for consent for non-Windows binaries** (Default) When an operation for a non-Microsoft application requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. - ## User Account Control: Behavior of the elevation prompt for standard users - - This policy setting controls the behavior of the elevation prompt for standard users. - - **Prompt for credentials** (Default) When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. - - **Automatically deny elevation requests** When an operation requires elevation of privilege, a configurable access denied error message is displayed. An enterprise that is running desktops as standard user may choose this setting to reduce help desk calls. - - **Prompt for credentials on the secure desktop** When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a different user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. - ## User Account Control: Detect application installations and prompt for elevation - - This policy setting controls the behavior of application installation detection for the computer. - - **Enabled** (Default) When an app installation package is detected that requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. - - - **Disabled** App installation packages are not detected and prompted for elevation. Enterprises that are running standard user desktops and use delegated installation technologies, such as Group Policy or System Center Configuration Manager should disable this policy setting. In this case, installer detection is unnecessary. - ## User Account Control: Only elevate executable files that are signed and validated - - This policy setting enforces public key infrastructure (PKI) signature checks for any interactive applications that request elevation of privilege. Enterprise administrators can control which applications are allowed to run by adding certificates to the Trusted Publishers certificate store on local computers. - - **Enabled** Enforces the certificate certification path validation for a given executable file before it is permitted to run. - - **Disabled** (Default) Does not enforce the certificate certification path validation before a given executable file is permitted to run. - ## User Account Control: Only elevate UIAccess applications that are installed in secure locations - - This policy setting controls whether applications that request to run with a User Interface Accessibility (UIAccess) integrity level must reside in a secure location in the file system. Secure locations are limited to the following: - …\\Program Files\\, including subfolders - …\\Windows\\system32\\ - …\\Program Files (x86)\\, including subfolders for 64-bit versions of Windows - **Note**   Windows enforces a digital signature check on any interactive app that requests to run with a UIAccess integrity level regardless of the state of this security setting. -   - - **Enabled** (Default) If an app resides in a secure location in the file system, it runs only with UIAccess integrity. - - **Disabled** An app runs with UIAccess integrity even if it does not reside in a secure location in the file system. - ## User Account Control: Turn on Admin Approval Mode - - This policy setting controls the behavior of all User Account Control (UAC) policy settings for the computer. If you change this policy setting, you must restart your computer. - - **Enabled** (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the Administrators group to run in Admin Approval Mode. - - **Disabled** Admin Approval Mode and all related UAC policy settings are disabled. Note: If this policy setting is disabled, the Security Center notifies you that the overall security of the operating system has been reduced. - ## User Account Control: Switch to the secure desktop when prompting for elevation - - This policy setting controls whether the elevation request prompt is displayed on the interactive user's desktop or the secure desktop. - - **Enabled** (Default) All elevation requests go to the secure desktop regardless of prompt behavior policy settings for administrators and standard users. - - **Disabled** All elevation requests go to the interactive user's desktop. Prompt behavior policy settings for administrators and standard users are used. - ## User Account Control: Virtualize file and registry write failures to per-user locations - - This policy setting controls whether application write failures are redirected to defined registry and file system locations. This policy setting mitigates applications that run as administrator and write run-time application data to %ProgramFiles%, %Windir%, %Windir%\\system32, or HKLM\\Software. - - **Enabled** (Default) App write failures are redirected at run time to defined user locations for both the file system and registry. - - **Disabled** Apps that write data to protected locations fail. -   -   - - - - - diff --git a/windows/keep-secure/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md b/windows/keep-secure/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md index e5bebae839..9475c83eba 100644 --- a/windows/keep-secure/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md +++ b/windows/keep-secure/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md @@ -2,52 +2,31 @@ title: User Account Control Switch to the secure desktop when prompting for elevation (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Switch to the secure desktop when prompting for elevation security policy setting. ms.assetid: 77a067db-c70d-4b02-9861-027503311b8b +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # User Account Control: Switch to the secure desktop when prompting for elevation - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Switch to the secure desktop when prompting for elevation** security policy setting. - ## Reference - - This policy setting determines whether the elevation request prompts on the interactive user desktop or on the secure desktop. - The secure desktop presents the logon UI and restricts functionality and access to the system until the logon requirements are satisfied. - The secure desktop’s primary difference from the user desktop is that only trusted processes running as SYSTEM are allowed to run here (that is, nothing is running at the user’s privilege level). The path to get to the secure desktop from the user desktop must also be trusted through the entire chain. - ### Possible values - - **Enabled** - All elevation requests by default go to the secure desktop. - - **Disabled** - All elevation requests go to the interactive user desktop. - ### Best practices - - Enable the **User Account Control: Switch to the secure desktop when prompting for elevation setting**. The secure desktop helps protect against input and output spoofing by presenting the credentials dialog box in a protected section of memory that is accessible only by trusted system processes. - ### Location - Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -86,49 +65,22 @@ The following table lists the actual and effective default values for this polic
    -   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ### Group Policy - All auditing capabilities are integrated in Group Policy. You can configure, deploy, and manage these settings in the Group Policy Management Console (GPMC) or Local Security Policy snap-in for a domain, site, or organizational unit (OU). - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Elevation prompt dialog boxes can be spoofed, causing users to disclose their passwords to malicious software. Mouse cursors can be spoofed by hiding the real cursor and replacing it with an offset so the cursor is actually pointing to the **Allow** button. - ### Countermeasure - Enable the **User Account Control: Switch to the secure desktop when prompting for elevation setting**. The secure desktop helps protect against input and output spoofing by presenting the credentials dialog box in a protected section of memory that is accessible only by trusted system processes. - ### Potential impact - None. This is the default configuration. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md b/windows/keep-secure/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md index 72e15ea4d5..ffb892226b 100644 --- a/windows/keep-secure/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md +++ b/windows/keep-secure/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md @@ -2,52 +2,31 @@ title: User Account Control Virtualize file and registry write failures to per-user locations (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Virtualize file and registry write failures to per-user locations security policy setting. ms.assetid: a7b47420-cc41-4b1c-b03e-f67a05221261 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # User Account Control: Virtualize file and registry write failures to per-user locations - - **Applies to** - - Windows 10 - Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Virtualize file and registry write failures to per-user locations** security policy setting. - ## Reference - - This policy setting enables or disables the redirection of the write failures of earlier applications to defined locations in the registry and the file system. This feature mitigates applications that historically ran as administrator and wrote runtime application data to %ProgramFiles%, %Windir%, %Windir%\\system32, or HKEY\_LOCAL\_MACHINE\\Software\\. - This feature can be disabled for applications on devices running at least Windows Vista because it is unnecessary. - ### Possible values - - **Enabled** - Setting this value facilitates the runtime redirection of application write failures to defined user locations for the file system and the registry. - - **Disabled** - Applications that write data to protected locations fail. - ### Best practices - 1. If you run applications that are not Windows Vista-compliant, enable this security policy to prevent the possibility that these older applications could write data to unsecure locations. - 2. If you only run at least Windows Vista–compliant applications, this feature is unnecessary so you can disable this policy. - ### Location - \\Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options - ### Default values - The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - @@ -86,49 +65,22 @@ The following table lists the actual and effective default values for this polic
    -   - ## Policy management - - This section describes features and tools that are available to help you manage this policy. - ### Restart requirement - None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. - ### Group Policy - All auditing capabilities are integrated in Group Policy. You can configure, deploy, and manage these settings in the Group Policy Management Console (GPMC) or Local Security Policy snap-in for a domain, site, or organizational unit (OU). - ## Security considerations - - This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. - ### Vulnerability - Earlier applications might not write data to secure locations. - ### Countermeasure - Enable the **User Account Control: Virtualize file and registry write failures to per-user locations** setting. - ### Potential impact - None. This is the default configuration. - ## Related topics - - [Security Options](security-options.md) -   -   - - - - - diff --git a/windows/keep-secure/user-rights-assignment.md b/windows/keep-secure/user-rights-assignment.md index 7b4f1dff2f..3e96944b76 100644 --- a/windows/keep-secure/user-rights-assignment.md +++ b/windows/keep-secure/user-rights-assignment.md @@ -2,29 +2,20 @@ title: User Rights Assignment (Windows 10) description: Provides an overview and links to information about the User Rights Assignment security policy settings user rights that are available in Windows. ms.assetid: 99340252-60be-4c79-b0a5-56fbe1a9b0c5 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # User Rights Assignment - - **Applies to** - - Windows 10 - Provides an overview and links to information about the User Rights Assignment security policy settings user rights that are available in Windows. - User rights govern the methods by which a user can log on to a system. User rights are applied at the local device level, and they allow users to perform tasks on a device or in a domain. User rights include logon rights and permissions. Logon rights control who is authorized to log on to a device and how they can log on. User rights permissions control access to computer and domain resources, and they can override permissions that have been set on specific objects. User rights are managed in Group Policy under the **User Rights Assignment** item. - Each user right has a constant name and a Group Policy name associated with it. The constant names are used when referring to the user right in log events. You can configure the user rights assignment settings in the following location within the Group Policy Management Console (GPMC) under **Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment**, or on the local device by using the Local Group Policy Editor (gpedit.msc). - For information about setting security policies, see [Configure security policy settings](how-to-configure-security-policy-settings.md). - The following table links to each security policy setting and provides the constant name for each. Setting descriptions contain reference information, best practices for configuring the policy setting, default values, differences between operating system versions, and considerations for policy management and security. - @@ -215,19 +206,8 @@ The following table links to each security policy setting and provides the const
    -   - ## Related topics - - [Security policy settings reference](security-policy-settings-reference.md) -   -   - - - - - diff --git a/windows/keep-secure/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md b/windows/keep-secure/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md index 30c91a3be8..fe7a396637 100644 --- a/windows/keep-secure/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md +++ b/windows/keep-secure/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md @@ -2,31 +2,20 @@ title: Using advanced security auditing options to monitor dynamic access control objects (Windows 10) description: This guide explains the process of setting up advanced security auditing capabilities that are made possible through settings and events that were introduced in Windows 8 and Windows Server 2012. ms.assetid: 0d2c28ea-bdaf-47fd-bca2-a07dce5fed37 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Using advanced security auditing options to monitor dynamic access control objects - - **Applies to** - - Windows 10 - This guide explains the process of setting up advanced security auditing capabilities that are made possible through settings and events that were introduced in Windows 8 and Windows Server 2012. - These procedures can be deployed with the advanced security auditing capabilities described in [Deploy Security Auditing with Central Audit Policies (Demonstration Steps)](http://technet.microsoft.com/library/hh831542.aspx). - ## In this guide - - Domain administrators can create and deploy expression-based security audit policies by using file classification information (resource attributes), user claims, and device claims to target specific users and resources to monitor potentially significant activities on one or more computers. These policies can be deployed centrally by using Group Policy, or directly on a computer, in a folder, or in individual files. - ## In this section - - @@ -73,24 +62,11 @@ Domain administrators can create and deploy expression-based security audit poli
    -   - **Important**   This procedure can be configured on computers running any of the supported Windows operating systems. The other monitoring procedures can be configured only as part of a functioning dynamic access control deployment. -   - ## Related topics - - [Security auditing](security-auditing-overview.md) -   -   - - - - - diff --git a/windows/keep-secure/using-event-viewer-with-applocker.md b/windows/keep-secure/using-event-viewer-with-applocker.md index ae4dc7e8a1..304915e207 100644 --- a/windows/keep-secure/using-event-viewer-with-applocker.md +++ b/windows/keep-secure/using-event-viewer-with-applocker.md @@ -2,47 +2,29 @@ title: Using Event Viewer with AppLocker (Windows 10) description: This topic lists AppLocker events and describes how to use Event Viewer with AppLocker. ms.assetid: 109abb10-78b1-4c29-a576-e5a17dfeb916 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Using Event Viewer with AppLocker - - **Applies to** - - Windows 10 - This topic lists AppLocker events and describes how to use Event Viewer with AppLocker. - The AppLocker log contains information about applications that are affected by AppLocker rules. Each event in the log contains detailed info about: - - Which file is affected and the path of that file - - Which packaged app is affected and the package identifier of the app - - Whether the file or packaged app is allowed or blocked - - The rule type (path, file hash, or publisher) - - The rule name - - The security identifier (SID) for the user or group identified in the rule - Review the entries in the Event Viewer to determine if any applications are not included in the rules that you automatically generated. For instance, some line-of-business apps are installed to non-standard locations, such as the root of the active drive (for example: %SystemDrive%). - For info about what to look for in the AppLocker event logs, see [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md). - **To review the AppLocker log in Event Viewer** - 1. Open Event Viewer. - 2. In the console tree under **Application and Services Logs\\Microsoft\\Windows**, click **AppLocker**. - The following table contains information about the events that you can use to determine which apps are affected by AppLocker rules. - @@ -157,19 +139,8 @@ The following table contains information about the events that you can use to de
    -   - ## Related topics - - [Tools to use with AppLocker](tools-to-use-with-applocker.md) -   -   - - - - - diff --git a/windows/keep-secure/using-software-restriction-policies-and-applocker-policies.md b/windows/keep-secure/using-software-restriction-policies-and-applocker-policies.md index ce10693cfd..e07957331b 100644 --- a/windows/keep-secure/using-software-restriction-policies-and-applocker-policies.md +++ b/windows/keep-secure/using-software-restriction-policies-and-applocker-policies.md @@ -2,38 +2,24 @@ title: Use Software Restriction Policies and AppLocker policies (Windows 10) description: This topic for the IT professional describes how to use Software Restriction Policies (SRP) and AppLocker policies in the same Windows deployment. ms.assetid: c3366be7-e632-4add-bd10-9df088f74c6d +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Use Software Restriction Policies and AppLocker policies - - **Applies to** - - Windows 10 - This topic for the IT professional describes how to use Software Restriction Policies (SRP) and AppLocker policies in the same Windows deployment. - ## Understand the difference between SRP and AppLocker - - You might want to deploy application control policies in Windows operating systems earlier than Windows Server 2008 R2 or Windows 7. You can use AppLocker policies only on the supported versions and editions of Windows as listed in [Requirements to use AppLocker](requirements-to-use-applocker.md). However, you can use SRP on those supported editions of Windows plus Windows Server 2003 and Windows XP. To compare features and functions in SRP and AppLocker so that you can determine when to use each technology to meet your application control objectives, see [Determine your application control objectives](determine-your-application-control-objectives.md). - ## Use SRP and AppLocker in the same domain - - SRP and AppLocker use Group Policy for domain management. However, when policies are generated by SRP and AppLocker exist in the same domain, and they are applied through Group Policy, AppLocker policies take precedence over policies generated by SRP on computers that are running an operating system that supports AppLocker. For info about how inheritance in Group Policy applies to AppLocker policies and policies generated by SRP, see [Understand AppLocker rules and enforcement setting inheritance in Group Policy](understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md). - **Important**   As a best practice, use separate Group Policy Objects to implement your SRP and AppLocker policies. To reduce troubleshooting issues, do not combine them in the same GPO. -   - The following scenario provides an example of how each type of policy would affect a bank teller software app, where the app is deployed on different Windows desktop operating systems and managed by the Tellers GPO. - @@ -70,48 +56,22 @@ The following scenario provides an example of how each type of policy would affe
    -   - **Note**   For info about supported versions and editions of the Windows operating system, see [Requirements to use AppLocker](requirements-to-use-applocker.md). -   - ## Test and validate SRPs and AppLocker policies that are deployed in the same environment - - Because SRPs and AppLocker policies function differently, they should not be implemented in the same GPO. This makes testing the result of the policy straightforward, which is critical to successfully controlling application usage in the organization. Configuring a testing and policy distribution system can help you understand the result of a policy. The effects of policies generated by SRP and AppLocker policies need to be tested separately and by using different tools. - ### Step 1: Test the effect of SRPs - You can use the Group Policy Management Console (GPMC) or the Resultant Set of Policy (RSoP) snap-in to determine the effect of applying SRPs by using GPOs. - ### Step 2: Test the effect of AppLocker policies - You can test AppLocker policies by using Windows PowerShell cmdlets. For info about investigating the result of a policy, see: - - [Test an AppLocker policy by using Test-AppLockerPolicy](test-an-applocker-policy-by-using-test-applockerpolicy.md) - - [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md) - Another method to use when determining the result of a policy is to set the enforcement mode to **Audit only**. When the policy is deployed, events will be written to the AppLocker logs as if the policy was enforced. For info about using the **Audit only** mode, see: - [Understand AppLocker enforcement settings](understand-applocker-enforcement-settings.md) - [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md) - ## See also - - [AppLocker deployment guide](applocker-policies-deployment-guide.md) - -   -   - - - - - diff --git a/windows/keep-secure/view-the-security-event-log.md b/windows/keep-secure/view-the-security-event-log.md index 2ec26e4bc2..3c67e1191b 100644 --- a/windows/keep-secure/view-the-security-event-log.md +++ b/windows/keep-secure/view-the-security-event-log.md @@ -2,32 +2,19 @@ title: View the security event log (Windows 10) description: The security log records each event as defined by the audit policies you set on each object. ms.assetid: 20DD2ACD-241A-45C5-A92F-4BE0D9F198B9 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # View the security event log - - **Applies to** - - Windows 10 - The security log records each event as defined by the audit policies you set on each object. - **To view the security log** - 1. Open Event Viewer. 2. In the console tree, expand **Windows Logs**, and then click **Security**. The results pane lists individual security events. 3. If you want to see more details about a specific event, in the results pane, click the event. -   -   - - - - - diff --git a/windows/keep-secure/vpn-profile-options.md b/windows/keep-secure/vpn-profile-options.md index 6c71e30d5a..dd626ba989 100644 --- a/windows/keep-secure/vpn-profile-options.md +++ b/windows/keep-secure/vpn-profile-options.md @@ -2,89 +2,45 @@ title: VPN profile options (Windows 10) description: Virtual private networks (VPN) let you give your users secure remote access to your company network. Windows 10 adds useful new VPN profile options to help you manage how users connect. ms.assetid: E3F99DF9-863D-4E28-BAED-5C1B1B913523 +ms.pagetype: networking ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: jdeckerMS --- - # VPN profile options - - **Applies to** - - Windows 10 - Windows 10 Mobile - Virtual private networks (VPN) let you give your users secure remote access to your company network. Windows 10 adds useful new VPN profile options to help you manage how users connect. - ## Always On - - Always On is a new feature in Windows 10 which enables the active VPN profile to connect automatically on the following triggers: - - User sign-on - - Network change - When a device has multiple profiles with Always On triggers, the user can specify the active profile in **Settings** > **Network & Internet** > **VPN** > *VPN profile* > **Let apps automatically use this VPN connection**. - ## App-triggered VPN - - VPN profiles in Windows 10 can be configured to connect automatically on the launch of a specified set of applications. This feature was included in Windows 8.1 as "On demand VPN". The applications can be defined using the following: - - Package family name for Universal Windows Platform (UWP) apps - - File path for Classic Windows applications - ## Traffic filters - - Traffic Filters give enterprises the ability to decide what traffic is allowed into the corporate network based on policy . With the ever-increasing landscape of remote threats on the corporate network and lesser IT controls on machines, it becomes essential to control the traffic that is allowed through. While server-side layers of firewalls and proxies help, by adding traffic filters the first layer of filtering can be moved onto the client with more advanced filtering on the server side. There are two types of Traffic Filter rules: - - **App-based rules**. With app-based rules, a list of applications can be marked such that only traffic originating from these apps is allowed to go over the VPN interface. - - **Traffic-based rules**. Traffic-based rules are 5-tuple policies (ports, addresses, protocol) that can be specified such that only traffic matching these rules is allowed to go over the VPN interface. - There can be many sets of rules which are linked by **OR**. Within each set, there can be app-based rules and traffic-based rules; all the properties within the set will be linked by **AND**. This gives the IT admins a lot of power to craft the perfect policy befitting their use case. - ## LockDown VPN - - A VPN profile configured with LockDown secures the device to only allow network traffic over the VPN interface. It has the following features: - - The system attempts to keep the VPN connected at all times. - - The user cannot disconnect the VPN connection. - - The user cannot delete or modify the VPN profile. - - The VPN LockDown profile uses forced tunnel connection. - - If the VPN connection is not available, outbound network traffic is blocked. - - Only one VPN LockDown profile is allowed on a device. - **Note**   For inbox VPN, Lockdown VPN is only available for the Internet Key Exchange version 2 (IKEv2) tunnel type. -   - ## Learn more - - [VPNv2 configuration service provider (CSP) reference](http://go.microsoft.com/fwlink/p/?LinkId=617588) - [How to Create VPN Profiles in Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=618028) - [Help users connect to their work using VPN profiles with Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkId=618029) -   -   - - - - - diff --git a/windows/keep-secure/what-is-applocker.md b/windows/keep-secure/what-is-applocker.md index 28bc523226..cfa573d478 100644 --- a/windows/keep-secure/what-is-applocker.md +++ b/windows/keep-secure/what-is-applocker.md @@ -2,50 +2,30 @@ title: What Is AppLocker (Windows 10) description: This topic for the IT professional describes what AppLocker is and how its features differ from Software Restriction Policies. ms.assetid: 44a8a2bb-0f83-4f95-828e-1f364fb65869 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # What Is AppLocker? - - **Applies to** - - Windows 10 - This topic for the IT professional describes what AppLocker is and how its features differ from Software Restriction Policies. - AppLocker advances the app control features and functionality of Software Restriction Policies. AppLocker contains new capabilities and extensions that allow you to create rules to allow or deny apps from running based on unique identities of files and to specify which users or groups can run those apps. - Using AppLocker, you can: - - Control the following types of apps: executable files (.exe and .com), scripts (.js, .ps1, .vbs, .cmd, and .bat), Windows Installer files (.mst, .msi and .msp), and DLL files (.dll and .ocx), and packaged apps and packaged app installers (appx). - - Define rules based on file attributes derived from the digital signature, including the publisher, product name, file name, and file version. For example, you can create rules based on the publisher attribute that is persistent through updates, or you can create rules for a specific version of a file. - - Assign a rule to a security group or an individual user. - - Create exceptions to rules. For example, you can create a rule that allows all Windows processes to run except Registry Editor (Regedit.exe). - - Use audit-only mode to deploy the policy and understand its impact before enforcing it. - - Import and export rules. The import and export affects the entire policy. For example, if you export a policy, all of the rules from all of the rule collections are exported, including the enforcement settings for the rule collections. If you import a policy, all criteria in the existing policy are overwritten. - - Streamline creating and managing AppLocker rules by using Windows PowerShell cmdlets. - AppLocker helps reduce administrative overhead and helps reduce the organization's cost of managing computing resources by decreasing the number of help desk calls that result from users running unapproved apps - For information about the application control scenarios that AppLocker addresses, see [AppLocker policy use scenarios](applocker-policy-use-scenarios.md). - ## What features are different between Software Restriction Policies and AppLocker? - - **Feature differences** - The following table compares AppLocker to Software Restriction Policies. - @@ -117,13 +97,9 @@ The following table compares AppLocker to Software Restriction Policies.
    -   - **Application control function differences** - The following table compares the application control functions of Software Restriction Policies (SRP) and AppLocker. - @@ -189,19 +165,8 @@ The following table compares the application control functions of Software Restr
    -   - ## Related topics - - [AppLocker technical reference](applocker-technical-reference.md) -   -   - - - - - diff --git a/windows/keep-secure/which-editions-of-windows-support-advanced-audit-policy-configuration.md b/windows/keep-secure/which-editions-of-windows-support-advanced-audit-policy-configuration.md index fed78d4afa..35a67350b8 100644 --- a/windows/keep-secure/which-editions-of-windows-support-advanced-audit-policy-configuration.md +++ b/windows/keep-secure/which-editions-of-windows-support-advanced-audit-policy-configuration.md @@ -2,46 +2,25 @@ title: Which editions of Windows support advanced audit policy configuration (Windows 10) description: This reference topic for the IT professional describes which versions of the Windows operating systems support advanced security auditing policies. ms.assetid: 87c71cc5-522d-4771-ac78-34a2a0825f31 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Which editions of Windows support advanced audit policy configuration - - **Applies to** - - Windows 10 - This reference topic for the IT professional describes which versions of the Windows operating systems support advanced security auditing policies. - Versions of the Windows operating system that cannot join a domain do not have access to these features. There is no difference in security auditing support between 32-bit and 64-bit versions. - ## Are there any special considerations? - - In addition, the following special considerations apply to the various tasks associated with advanced security auditing enhancements: - - **Creating an audit policy.** To create an advanced security auditing policy, you must use a computer running any supported version of Windows. You can use the Group Policy Management Console (GPMC) on a computer running a supported version of the Windows client operating system after installing the Remote Server Administration Tools. - - **Applying audit policy settings.** If you are using Group Policy to apply the advanced audit policy settings and global object access settings, client computers must be running any supported version of the Windows server operating system or Windows client operating system. In addition, only computers running any of these supported operating systems can provide "reason for access" reporting data. - - **Developing an audit policy model.** To plan advanced security audit settings and global object access settings, you must use the GPMC that targets a domain controller running a supported version of the Windows server operating system. - - **Distributing the audit policy.** After a Group Policy Object (GPO) that includes advanced security auditing settings is developed, it can be distributed by using domain controllers running any Windows Server operating system. However, if you cannot put client computers running a supported version of the Windows client operating system into a separate organizational unit (OU), you should use Windows Management Instrumentation (WMI) filtering to ensure that the advanced security auditing policy settings are applied only to client computers running a supported version of the Windows client operating system. - **Important**   Using both the basic auditing policy settings under **Local Policies\\Audit Policy** and the advanced auditing policy settings under **Advanced Audit Policy Configuration** can cause unexpected results in audit reporting. Therefore, the two sets of audit policy settings should not be combined. If you use advanced audit policy configuration settings, you should enable the **Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings** policy setting under **Local Policies\\Security Options**. This will prevent conflicts between similar settings by forcing basic security auditing to be ignored.   -   -   -   - - - - - diff --git a/windows/keep-secure/why-a-pin-is-better-than-a-password.md b/windows/keep-secure/why-a-pin-is-better-than-a-password.md index b571b9abd8..558cbc221c 100644 --- a/windows/keep-secure/why-a-pin-is-better-than-a-password.md +++ b/windows/keep-secure/why-a-pin-is-better-than-a-password.md @@ -2,102 +2,51 @@ title: Why a PIN is better than a password (Windows 10) description: Microsoft Passport in Windows 10 enables users to sign in to their device using a PIN. How is a PIN different from (and better than) a password . ms.assetid: A6FC0520-01E6-4E90-B53D-6C4C4E780212 +ms.pagetype: security keywords: ["pin", "security", "password"] ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: jdeckerMS --- - # Why a PIN is better than a password - - **Applies to** - - Windows 10 - Windows 10 Mobile - Microsoft Passport in Windows 10 enables users to sign in to their device using a PIN. How is a PIN different from (and better than) a password? - On the surface, a PIN looks much like a password. A PIN can be a set of numbers, but enterprise policy might allow complex PINs that include special characters and letters, both upper-case and lower-case. Something like **t758A!** could be an account password or a complex Passport PIN. It isn't the structure of a PIN (length, complexity) that makes it better than a password, it's how it works. - ## PIN is tied to the device - - One important difference between a password and a Passport PIN is that the PIN is tied to the specific device on which it was set up. That PIN is useless to anyone without that specific hardware. Someone who steals your password can sign in to your account from anywhere, but if they steal your PIN, they'd have to steal your physical device too! - Even you can't use that PIN anywhere except on that specific device. If you want to sign in on multiple devices, you have to set up Passport on each device. - ## PIN is local to the device - - A password is transmitted to the server -- it can be intercepted in transmission or stolen from a server. A PIN is local to the device -- it isn't transmitted anywhere and it isn't stored on the server. - When the PIN is created, it establishes a trusted relationship with the identity provider and creates an asymmetric key pair that is used for authentication. When you enter your PIN, it unlocks the authentication key and uses the key to sign the request that is sent to the authenticating server. - **Note**   For details on how Passport uses asymetric key pairs for authentication, see [Microsoft Passport guide](http://go.microsoft.com/fwlink/p/?LinkId=691928). -   - ## PIN is backed by hardware - - The Passport PIN is backed by a Trusted Platform Module (TPM) chip, which is a secure crypto-processor that is designed to carry out cryptographic operations. The chip includes multiple physical security mechanisms to make it tamper resistant, and malicious software is unable to tamper with the security functions of the TPM. All Windows 10 Mobile phones and many modern laptops have TPM. - User key material is generated and available within the Trusted Platform Module (TPM) of the user device, which protects it from attackers who want to capture the key material and reuse it. Because Microsoft Passport uses asymmetrical key pairs, users credentials can’t be stolen in cases where the identity provider or websites the user accesses have been compromised. - The TPM protects against a variety of known and potential attacks, including PIN brute-force attacks. After too many incorrect guesses, the device is locked. - ## PIN can be complex - - The Passport PIN is subject to the same set of IT management policies as a password, such as complexity, length, expiration, and history. Although we generally think of a PIN as a simple four-digit code, administrators can set [policies](implement-microsoft-passport-in-your-organization.md) for managed devices to require a PIN complexity similar to a password. You can require or block: special characters, uppercase characters, lowercase characters, and digits. - ## What if someone steals the laptop or phone? - - To compromise a Microsoft Passport credential that TPM protects, an attacker must have access to the physical device, and then must find a way to spoof the user’s biometrics or guess his or her PIN—and all of this must be done before TPM anti-hammer capabilities lock the device. - You can provide additional protection for laptops that don't have TPM by enablng BitLocker and setting a policy to limit failed sign-ins. - **Configure BitLocker without TPM** - 1. Use the Local Group Policy Editor (gpedit.msc) to enable the following policy: - **Computer Configuration** > **Administrative Templates** > **Windows Components** > **BitLocker Drive Encryption** > **Operating System Drives** > **Require additional authentication at startup** - 2. In the policy option, select **Allow BitLocker without a compatible TPM**, and then click **OK.** - 3. Go to Control Panel > **System and Security** > **BitLocker Drive Encryption** and select the operating system drive to protect. - **Set account lockout threshold** - 1. Use the Local Group Policy Editor (gpedit.msc) to enable the following policy: - **Computer Configuration** >**Windows Settings** ?**Security Settings** >**Account Policies** > **Account Lockout Policy** > **Account lockout threshold** - 2. Set the number of invalid logon attempts to allow, and then click OK. - ## Why do you need a PIN to use Windows Hello? - - Windows Hello is the biometric sign-in for Microsoft Passport in Windows 10: fingerprint, iris, or facial recognition. When you set up Windows Hello, you're asked to create a PIN first. This PIN enables you to sign in using Passport when you can’t use your preferred biometric because of an injury or because the sensor is unavailable or not working properly. - If you only had a biometric sign-in configured and, for any reason, were unable to use that method to sign in, you would have to sign in using your account name and password, which doesn't provide you the same level of protection as Passport. - ## Related topics - - [Manage identity verification using Microsoft Passport](manage-identity-verification-using-microsoft-passport.md) - [Implement Microsoft Passport in your organization](implement-microsoft-passport-in-your-organization.md) -   -   - - - - - diff --git a/windows/keep-secure/windows-10-enterprise-security-guides.md b/windows/keep-secure/windows-10-enterprise-security-guides.md index 75dfd59ad1..dffeabae7b 100644 --- a/windows/keep-secure/windows-10-enterprise-security-guides.md +++ b/windows/keep-secure/windows-10-enterprise-security-guides.md @@ -2,23 +2,16 @@ title: Enterprise security guides (Windows 10) description: Get proven guidance to help you better secure and protect your enterprise by using technologies such as Credential Guard, Device Guard, Microsoft Passport, and Windows Hello. This section offers technology overviews and step-by-step guides. ms.assetid: 57134f84-bd4b-4b1d-b663-4a2d36f5a7f8 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: challum --- - # Enterprise security guides - - ## Purpose - - Get proven guidance to help you better secure and protect your enterprise by using technologies such as Credential Guard, Device Guard, Microsoft Passport, and Windows Hello. This section offers technology overviews and step-by-step guides. - ## In this section - - @@ -53,14 +46,6 @@ Get proven guidance to help you better secure and protect your enterprise by usi
    -   -   -   - - - - - diff --git a/windows/keep-secure/windows-10-mobile-security-guide.md b/windows/keep-secure/windows-10-mobile-security-guide.md index 7995030e49..fe2c16b438 100644 --- a/windows/keep-secure/windows-10-mobile-security-guide.md +++ b/windows/keep-secure/windows-10-mobile-security-guide.md @@ -2,52 +2,31 @@ title: Windows 10 Mobile security guide (Windows 10) description: This guide provides a detailed description of the most important security features in the Windows 10 Mobile operating system—identity access and control, data protection, malware resistance, and app platform security. ms.assetid: D51EF508-699E-4A68-A7CD-91D821A97205 +ms.pagetype: security; mobile keywords: ["data protection, encryption, malware resistance, smartphone, device, Windows Store"] ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library author: AMeeus --- - # Windows 10 Mobile security guide - - **Applies to** - - Windows 10 Mobile - This guide provides a detailed description of the most important security features in the Windows 10 Mobile operating system—identity access and control, data protection, malware resistance, and app platform security. - ## Overview - - Windows 10 Mobile is specifically designed for smartphones and small tablets. It uses the same security technologies as the Windows 10 operating system to help protect against known and emerging security threats across the spectrum of attack vectors. Several broad categories of security work went into Windows 10 Mobile: - - **Identity and access control.** Microsoft has greatly enhanced identity and access control features to simplify and improve the security of user authentication. These features include Windows Hello and Microsoft Passport, which better protect user identities through easy-to-deploy and easy-to-use multifactor authentication (MFA). (Windows Hello requires either a specialized illuminated infrared \[IR\] camera for facial recognition and iris detection or a finger print reader that supports the Windows Biometric Framework.) - - **Data protection.** Confidential data is better protected from compromise than ever before. Windows 10 Mobile uses several data-protection technologies and delivers them in a user-friendly and IT-manageable way. - - **Malware resistance.**Windows 10 Mobile helps protect critical system resources and apps to reduce the threat of malware, including support for enterprise-grade secure hardware and Secure Boot. - - **App platform security.** The Windows 10 Mobile enterprise-grade secure app platform provides multiple layers of security. For example, Windows Store checks all apps for malware to help prevent malware from reaching devices. In addition, AppContainer application isolation helps prevent any malicious app from compromising other apps. - This guide explains each of these technologies and how they help protect your Windows 10 Mobile devices. - ## Identity and access control - - A fundamental component of security is the notion that a user has a unique identity and that that identity is either allowed or denied access to resources. This notion is traditionally known as access control, which has three parts: - - **Identification.** The user (subject) asserts a unique identity to the computer system for the purpose of accessing a resource (object), such as a file or an app. - - **Authentication.** Authentication is the process of proving the asserted identity and verifying that the subject is indeed the subject. - - **Authorization.** The system compares the authenticated subject’s access rights against the object’s permissions and either allows or denies the requested access. - The way an operating system implements these components makes a difference in preventing attackers from accessing corporate data. Only users who prove their identities and are authorized to access that data can access it. In security, however, there are varying degrees of identity proof and many different requirements for authorization limits. The access control flexibility most corporate environments need presents a challenge for any operating system. Table 1 lists typical Windows access control challenges and the solutions that Windows 10 Mobile offers. - Table 1. Windows 10 Mobile solutions for typical access control challenges - @@ -78,83 +57,44 @@ Table 1. Windows 10 Mobile solutions for typical access control challenges
    -   - The following sections describe these challenges and solutions in more detail. - ### Microsoft Passport - Microsoft Passport provides strong MFA, fully integrated into Windows devices, to replace passwords. To authenticate, the user must have a Microsoft Azure Active Directory (Azure AD)–registered device and either a PIN or Windows Hello biometric gesture to unlock the device. Microsoft Passport is conceptually similar to a smart card but more flexible, as it doesn’t require a public key infrastructure or the implementation of additional hardware and supports biometric identification. - Microsoft Passport offers three significant advantages over the previous state of Windows authentication: it’s more flexible, it’s based on industry standards, and it more effectively mitigates risks. - ### It's effective - Microsoft Passport eliminates the use of passwords for logon and so reduces the risk that an attacker will steal and reuse a user’s credentials. User key material, which includes the user’s private key, is available only on the device that generated it. The key material is protected with the TPM, which protects the key material from attackers who want to capture and reuse it. It is a Windows Hardware Certification Program requirement that every Windows 10 Mobile device include a TPM. - To compromise a Microsoft Passport credential that the TPM protects, an attacker must have access to the physical device, and then find a way to spoof the user’s biometrics identity or guess his or her PIN—and all of this must be done before TPM brute-force resistance capabilities lock the mobile device, the theft-protection mechanism kicks in, or the user or corporate administrator remotely wipes the device. This technology greatly reduces an attacker’s window of opportunity for compromising a user’s credentials. - ### It's flexible - Microsoft Passport offers unprecedented flexibility along with enterprise-grade security. - Most importantly, Microsoft Passport works with biometrics or PINs and gives you options beyond long, complex passwords. Instead of users memorizing and retyping often-changed passwords, Microsoft Passport enables PIN- and biometrics-based identification through Windows Hello to identify users more securely. - The Windows 10 Mobile device that the user logs on to is an authentication factor, as well. The credentials used and the private key on the device are device specific and bound to the device’s TPM. - In the future, Microsoft Passport will also enable people to use Windows 10 Mobile devices as a remote credential when signing in to PCs running Windows 10. Users will use their PINs or biometrics to unlock their phones, and their phones will unlock their PCs. Phone sign-in with Microsoft Passport will make implementing MFA for scenarios where the user’s credentials must be physically separate from the PC the user is signing in to less costly and complex than other solutions. Phone sign-in will also make it easier for users and IT pros because users can use their phones to sign in to any corporate device instead of enrolling a user credential on each. - With Microsoft Passport, you gain flexibility in the data center, too. To deploy it for Windows 10 Mobile devices, you must set up Azure AD, but you don’t have to replace or remove your existing Active Directory environment. Using Azure AD Connect, organizations can synchronize these two directory services. Microsoft Passport builds on and adds to your existing infrastructure and allows you to federate with Azure AD. - Microsoft Passport is also supported on the desktop, giving organizations a uniform way to implement strong authentication on all devices. This flexibility makes it simpler for Microsoft Passport to supplement existing smart card or token deployments for on-premises Windows PC scenarios, adding MFA to mobile devices and users who don’t currently have it for extra protection of sensitive resources or systems that these mobile devices access. - ### It's standardized - Both software vendors and enterprise customers have come to realize that proprietary identity and authentication systems are a dead end: the future lies with open, interoperable systems that allow secure authentication across a variety of devices, line-of-business (LOB) apps, and external applications and websites. To this end, a group of industry players formed the Fast Identity Online (FIDO) Alliance. The FIDO Alliance is a nonprofit organization that works to address the lack of interoperability among strong authentication devices as well as the problems users face in creating and remembering multiple user names and passwords. The FIDO Alliance plans to change the nature of authentication by developing specifications that define an open, scalable, interoperable set of mechanisms that supplant reliance on passwords to authenticate users of online services securely. This new standard can allow any business network, app, website, or cloud application to interface with a broad variety of existing and future FIDO-enabled devices and operating system platforms using a standardized set of interfaces and protocols. - In 2014, Microsoft joined the board of the FIDO Alliance. FIDO standards enable a universal framework that a global ecosystem delivers for a consistent and greatly improved user experience of strong password-less authentication. The FIDO 1.0 specifications, published in December 2014, provide for two types of authentications: password-less (known as UAF) and second factor (U2F). The FIDO Alliance is working on a set of 2.0 proposals that incorporate the best ideas from its U2F and UAF FIDO 1.0 standards and of course new ideas. Microsoft has contributed Microsoft Passport technology to the FIDO 2.0 specification workgroup for review and feedback and continues to work with the FIDO Alliance as the FIDO 2.0 specification moves forward. Interoperability of FIDO products is a hallmark of FIDO authentication. Microsoft believes that bringing a FIDO solution to market will help solve a critical need for enterprises and consumers alike. - ### Windows Hello - Windows Hello is the new biometric framework for Windows 10. Because biometric identification is built directly into the operating system, it allows you to use your iris, face, or fingerprint to unlock your mobile device. Windows Hello unlocks Microsoft Passport credentials, which enable authentication to resources or relying parties such as software-as-a-service applications like Microsoft Office 365. - Windows Hello supports three biometric sensor options that are suitable for enterprise scenarios: - - **Facial recognition** uses special IR cameras to reliably tell the difference between a photograph or scan and a living person. Several vendors are shipping external cameras that incorporate this technology, and major manufacturers are already shipping laptops with integrated facial-recognition technology. Both Surface Pro 4 and Surface Book support this technology. - - **Fingerprint recognition** uses a sensor to scan the user’s fingerprint. Although fingerprint readers have been available for computers running the Windows operating system for years, the detection, anti-spoofing, and recognition algorithms in Windows 10 are more advanced than in previous Windows versions. Most existing fingerprint readers (whether external to or integrated into laptops or USB keyboards) that support the Windows Biometric Framework will work with Windows Hello. - - **Iris scanning** uses cameras designed to scan the user’s iris, the colorful and highly detailed portion of the eye. Because the data must be accurate, iris scanning uses a combination of an IR light source and a high-quality camera. Microsoft Lumia 950 and 950 XL devices support this technology. - **Note**   Users must create an unlock PIN before they enroll a biometric gesture. The device uses this PIN as a fallback mechanism in situations where it cannot capture the biometric gesture. -   - All three of these biometric factors—the face, the finger, and the iris—are unique to an individual. To capture enough data to uniquely identify an individual, a biometric scanner might initially capture images in multiple conditions or with additional details. For example, an iris scanner will capture images of both eyes; or both with and without eyeglasses or contact lenses. - Spoofing biometric data is often a big concern in enterprise environments. Microsoft employs several anti-spoofing techniques in Windows 10 Mobile that verify the trustworthiness of the biometric device as well as guard against intentional collision with stored biometric measurements. These techniques help improve the false-acceptance rate (the rate at which spoofed biometric data is accepted as authentic) while maintaining the overall usability and manageability of MFA. - The biometric image collected at enrollment is converted into an algorithmic form that cannot be converted back into the original image. Only the algorithmic form is kept; the actual biometric image is removed from the device after conversion. Windows 10 Mobile devices both encrypt the algorithmic form of the biometric data and bind the encrypted data to the device, both of which help prevent someone from removing the data from the phone. As a result, the biometric information that Windows Hello uses is a local gesture and doesn’t roam among the user’s devices. - Windows Hello offers several major benefits. First, it helps to address the problems of credential theft and sharing because an attacker must obtain the mobile phone and impersonate the user’s biometric identity, which is more difficult than stealing a device unlock password. Second, the use of biometrics gives users an authenticator that’s always with them—there’s nothing to forget, lose, or leave behind. Instead of worrying about memorizing long, complex passwords, users can take advantage of a convenient, enterprise-grade secure method for logging on to their Windows 10 Mobile device. Finally, there’s nothing additional to deploy, because Microsoft built Windows Hello support directly into the operating system. All you need is a device that includes a supported biometric sensor. - The device that senses the biometric factors must report the data to Windows Hello quickly and accurately. For this reason, Microsoft determines which factors and devices are trustworthy and accurate prior to their inclusion in Windows Hello. For more information, see [Windows 10 specifications](http://go.microsoft.com/fwlink/p/?LinkId=722908). - ## Data protection - - Windows 10 Mobile continues to provide solutions that help protect information against unauthorized access and disclosure. - ### Device encryption - Windows 10 Mobile uses device encryption, based on BitLocker technology, to encrypt all internal storage, including operating system and data storage partitions. The user can activate device encryption, or the IT department can activate and enforce encryption for company-managed devices through MDM tools. When device encryption is turned on, all data stored on the phone is encrypted automatically. A Windows 10 Mobile device with encryption turned on helps protect the confidentiality of data stored if the device is lost or stolen. The combination of Windows Hello lock and data encryption makes it extremely difficult for an unauthorized party to retrieve sensitive information from the device. - You can customize how device encryption works to meet your unique security requirements. Device encryption even enables you to define your own cipher suite. For example, you can specify the algorithm and key size that Windows 10 Mobile uses for data encryption, which Transport Layer Security (TLS) cipher suites are permitted, and whether Federal Information Processing Standard (FIPS) policy is enabled. Table 2 lists the policies you can change to customize device encryption on Windows 10 Mobile devices. - Table 2. Windows 10 cryptography policies - @@ -186,103 +126,54 @@ Table 2. Windows 10 cryptography policies
    -   - For a complete list of policies available, see [Policy CSP](http://go.microsoft.com/fwlink/p/?LinkId=733963). - ### Enterprise data protection - Enterprises have seen huge growth in the convergence of personal and corporate data storage. Personal data is frequently stored on corporate devices and vice versa. This situation increases the potential for compromise of sensitive corporate data. - One growing risk is authorized users’ accidental disclosure of sensitive data—a risk that is rapidly becoming the biggest source of confidential data leakage as organizations allow personal devices to access corporate resources. One example is common among organizations: an employee connects his or her personal phone to the company’s Microsoft Exchange Server instance for email. He or she uses the phone to work on email that includes attachments with sensitive data. When sending the email, the user accidentally copies a supplier. Content protection is only as strong as the weakest link, and in this example, the unintended sharing of sensitive data with unauthorized people might not have been prevented with standard data encryption. - In Windows 10 Mobile, enterprise data protection (EDP) helps separate personal and enterprise data and prevent data leakage. Key features include its ability to: - - Automatically tag personal and corporate data. - - Protect data while it’s at rest on local or removable storage. - - Control which apps can access corporate data. - - Control which apps can access a virtual private network (VPN) connection. - - Prevent users from copying corporate data to public locations. - **Note**   EDP is currently being tested in select customer evaluation programs. For more information about EDP, see [Enterprise data protection overview](../whats-new/edp-whats-new-overview.md). -   - ### Enlightenment - Third-party data loss protection solutions usually require developers to wrap their apps. In contrast, EDP puts the intelligence in Windows 10 Mobile so that it doesn’t require wrappers. As a result, most apps require nothing extra to work with EDP. - EDP can enforce policy without the need for an app to change. This means that an app that always handles business data (such as an LOB app) can be added to the allowed list and will always encrypt all data that it handles. However, if the app does not use common controls, cut and paste operations from this app to a non-enterprise app will silently fail. In addition, if the app needs to handle personal data, this data will also be encrypted. - Therefore, to improve the user experience, in some cases, developers should enlighten their apps by adding code to and compiling them to use the EDP application programming interfaces. Those cases include apps that: - - Don’t use common controls for saving files. - - Don’t use common controls for text boxes. - - Work on personal and enterprise data simultaneously (for example, contact apps that display personal and enterprise data in a single view; a browser that displays personal and enterprise web pages on tabs within a single instance). - Figure 1 summarizes when an app might require enlightenment to work with EDP. Microsoft Word is a good example. Not only can Word access personal and enterprise data simultaneously, but it can also transmit enterprise data (for example, email attachments containing enterprise data). - In any case, most apps don’t require enlightenment for them to use EDP protection. Simply adding them to the EDP allow list is all you must do. Because unenlightened apps cannot automatically tag data as personal or enterprise, if they are in an EDP policy, they treat all data as enterprise data. An LOB app is a good example. Adding an LOB app to an EDP policy protects all data that the app handles. Another example is a legacy app that cannot be updated, which you can add to an EDP policy and use without even being aware that EDP exists. - ![figure 1](images/mobile-security-guide-fig1.png) - Figure 1. When is enlightenment required? - ### Data leakage control - To configure EDP in an MDM solution that supports it, add authorized apps to the EDP allow list. When a device running Windows 10 Mobile enrolls in the MDM solution, apps that this policy doesn’t authorize won’t have access to enterprise data. - EDP works seamlessly until users try to access enterprise data with or try to paste enterprise data into unauthorized apps or locations on the web. For example, copying enterprise data from an authorized app to another authorized app works as usual, but EDP blocks users from copying enterprise data from an authorized app to an unauthorized app. Likewise, EDP blocks users from using an unauthorized app to open a file that contains enterprise data. - In addition, users cannot copy and paste data from authorized apps to unauthorized apps or locations on the Web without triggering one of the EDP protection levels: - - **Block.** EDP blocks users from completing the operation. - - **Override.** EDP notifies users that the operation is inappropriate but allows them to override the policy, although it logs the operation in the audit log. - - **Audit.** EDP does not block or notify users but logs the operation in the audit log. - - **Off.** EDP does not block or notify users and does not log operations in the audit log. - ### Data separation - As the name suggests, data separation separates personal from enterprise data. Most third-party solutions require an app wrapper, and from here, enterprise data goes in a container while personal data is outside the container. Often, people must use two different apps for the same purpose: one for personal data and another for enterprise data. - EDP provides the same data separation but neither uses containers nor requires a special version of an app to access business data, and then a second instance of it to access personal data. There are no containers, partitions, or special folders to physically separate personal and business data. Instead, Windows 10 Mobile is the access control broker, identifying enterprise data because it’s encrypted to the enterprise. Therefore, EDP provides data separation by virtue of encrypting enterprise data. - ### Visual cues - In Windows 10 Mobile, visual cues indicate the status of EDP to users (see Figure 2): - - **Start screen.** On the Start screen, apps that an EDP policy manages display a visual cue. - - **Files.** In File Explorer, a visual cue indicates whether a file or folder contains enterprise data and is therefore encrypted. - For example, Erwin is an employee at Fabrikam. He opens Microsoft Edge from the Start screen and sees that the tile indicates that an EDP policy manages the browser. Erwin opens the Fabrikam sales website and downloads a spreadsheet. In File Explorer, Erwin sees that the file he downloaded has a visual cue which indicates that it’s encrypted and contains enterprise data. When Erwin tries to paste data from that spreadsheet into an app that no EDP policy manages (for example, his Twitter app), Erwin might see a message that allows him to override protection while logging the action, depending on the protection level configured in the EDP policy. - ![figure 2](images/mobile-security-guide-fig2.png) - Figure 2. Visual cues in EDP - ## Malware resistance - - Just as software has automated so much of our lives, malware has automated attacks on our devices. Those attacks are relentless. Malware is constantly changing, and when it infects a device, it can be difficult to detect and remove. - The best way to fight malware is to prevent the infection from happening. Windows 10 Mobile provides strong malware resistance because it takes advantage of secured hardware and protects both the startup process and the core operating system architecture. - Table 3 lists specific malware threats and the mitigation that Windows 10 Mobile provides. - Table 3. Threats and Windows 10 Mobile mitigations - @@ -334,304 +225,151 @@ Table 3. Threats and Windows 10 Mobile mitigations
    -   - **Note**   Windows 10 Mobile devices use a System on a Chip (SoC) design provided by SoC vendors such as Qualcomm. With this architecture, the SoC vendor and device manufacturers provide the pre-UEFI bootloaders and the UEFI environment. The UEFI environment implements the UEFI Secure Boot standard described in section 27 of the UEFI specification, which can be found at [http://www.uefi.org/specsandtesttools](http://go.microsoft.com/fwlink/p/?LinkId=722912). This standard describes the process by which all UEFI drivers and applications are validated against keys provisioned into a UEFI-based device before they are executed. -   - The following sections describe these improvements in more detail. - ### Enterprise-grade secure hardware - Taking full advantage of Windows 10 Mobile security features requires advancements in hardware-based security. These advances include UEFI with Secure Boot, TPM, and biometric sensors (hardware dependent). - ### UEFI with Secure Boot - When a Windows 10 Mobile device starts, it begins the process of loading the operating system by locating the bootloader in the device’s storage system. Without safeguards in place, the phone might simply hand control over to the bootloader without even determining whether it’s a trusted operating system or malware. - UEFI is a standards-based solution that offers a modern-day replacement for the BIOS. In fact, it provides the same functionality as BIOS while adding security features and other advanced capabilities. Like BIOS, UEFI initializes devices, but UEFI components with the Secure Boot feature (version 2.3.1 or later) also help ensure that only trusted firmware in Option ROMs, UEFI apps, and operating system bootloaders can start on the mobile phone. - UEFI can run internal integrity checks that verify the firmware’s digital signature before running it. Because only the mobile phone’s manufacturer has access to the digital certificate required to create a valid firmware signature, UEFI has protection against firmware-based malware that loads before Windows 10 Mobile and can successfully hide its malicious behavior from Windows 10 Mobile. Firmware-based malware of this nature is typically called a bootkit. - When a mobile device with UEFI and Secure Boot starts, the UEFI firmware verifies the bootloader’s digital signature to verify that no one has modified it after it was digitally signed. The firmware also verifies that a trusted authority issued the bootloader’s digital signature. This check helps to ensure that the system starts only after checking that the bootloader is both trusted and unmodified since signing. - All Windows 10 Mobile devices always have Secure Boot enabled. In addition, they trust only the Windows operating system signature. - Neither Windows 10 Mobile, apps, or even malware can change the UEFI configuration. For more information about UEFI with Secure Boot, read [Protecting the pre-OS environment with UEFI](http://go.microsoft.com/fwlink/p/?LinkId=722909). - ### Trusted Platform Module - A Trusted Platform Module is a tamper-resistant cryptographic module that enhances the security and privacy of computing platforms. The TPM is incorporated as a component in a trusted computing platform like a PC, tablet, or mobile phone. A trusted computing platform is specially designed to work with the TPM to support privacy and security scenarios that software alone cannot achieve. It is a Windows 10 Mobile device hardware certification requirement to include a TPM in every Windows 10 Mobile device. - A proper implementation of a TPM as part of a trusted computing platform provides a hardware root of trust, meaning that the hardware behaves in a trusted way. For example, if you create a key in a TPM with the property that no one can export that key from the TPM, the key absolutely cannot leave the TPM. The close integration of a TPM with a platform increases the transparency of the boot process and supports device health scenarios by enabling reliable report of the software used to start a platform. - The following list describes key functionality that a TPM provides in Windows 10 Mobile: - - **Manage cryptographic keys.** A TPM can create, store, and permit the use of keys in defined ways. Windows 10 Mobile uses the TPM to protect the encryption keys for BitLocker volumes, virtual smart cards, certificates, and various other keys. - - **Safeguard and report integrity measurements.**Windows 10 Mobile uses the TPM to record and help protect integrity-related measurements of select hardware and Windows boot components for the Measured Boot feature. In this scenario, Measured Boot measures each component, from firmware up through the drivers, and then stores those measurements in the device’s TPM. From here, you can test the measurement log remotely so that a separate system verifies the boot state of the Windows 10 Mobile device. - - **Prove a TPM is really a TPM.** Managing cryptographic keys and measuring integrity are so central to protecting privacy and security that a TPM must differentiate itself from malware that masquerades as a TPM. - Windows 10 Mobile supports TPM implementations that comply with the 2.0 standard. The TPM 2.0 standard includes several improvements that make it superior to the 1.2 standard, the most notable of which is cryptographic agility. TPM 1.2 is restricted to a fixed set of encryption and hash algorithms. At the time the TPM 1.2 standard appeared in the early 2000s, the security community considered these algorithms cryptographically strong. Since that time, advances in cryptographic algorithms and cryptanalysis attacks have increased expectations for stronger cryptography. TPM 2.0 supports additional algorithms that offer stronger cryptographic protection as well as the ability to plug in algorithms that certain geographies or industries may prefer. It also opens the possibility for inclusion of future algorithms without changing the TPM component itself. - Many people assume that original equipment manufacturers (OEMs) must implant a TPM in hardware on a motherboard as a discrete module, but TPM can also be effective when implemented in firmware. Windows 10 Mobile supports only firmware TPM that complies with the 2.0 standard. Windows does not differentiate between discrete and firmware-based solutions because both must meet the same implementation and security requirements; therefore, any Windows 10 feature that can take advantage of TPM can be used with Windows 10 Mobile. - **Note**   Microsoft requires TPM 2.0 on devices running any version of Windows 10 Mobile. For more information, see [Minimum hardware requirements](http://go.microsoft.com/fwlink/p/?LinkId=733964). -   - Several Windows 10 Mobile security features require TPM: - - Virtual smart cards - - Measured Boot - - Health attestation (requires TPM 2.0 or later) - Still other features will use the TPM if it is available. For example, Microsoft Passport does not require TPM but uses it if it’s available. Organizations can configure policy to require TPM for Microsoft Passport. - ### Biometrics - Windows 10 Mobile makes biometrics a core security feature. Microsoft has fully integrated biometrics into the Windows 10 Mobile security components, not just tacked it on top of the platform (as was the case in previous versions of Windows). This is a big change. Earlier biometric implementations were largely front-end methods that simplified authentication. Under the hood, the system used biometrics to access a password, which it then used for authentication behind the scenes. Biometrics may have provided convenience but not necessarily enterprise-grade authentication. - Microsoft has been evangelizing the importance of enterprise-grade biometric sensors to the OEMs that create Windows 10 Mobile devices. These facial-recognition and iris-scanning sensors are fully supported by MFA features such as Microsoft Passport and Windows Hello. - In the future, Microsoft expects OEMs to produce even more advanced enterprise-grade biometric sensors and to continue to integrate them into mobile devices. As a result, biometrics will become a commonplace authentication method as part of an MFA system. - ### Enterprise-grade secure Windows startup - UEFI with Secure Boot uses hardware technologies to help protect users from bootkits. Secure Boot can validate the integrity of the devices, firmware, and bootloader. After the bootloader launches, users must rely on the operating system to protect the integrity of the remainder of the system. - ### Trusted Boot - When UEFI with Secure Boot verifies that it trusts the bootloader and starts Windows 10 Mobile, the Windows Trusted Boot feature protects the rest of the startup process by verifying that all Windows startup components are trustworthy (for example, signed by a trusted source) and have integrity. The bootloader verifies the digital signature of the Windows kernel before loading it. The Windows kernel, in turn, verifies every other component of the Windows startup process, including the boot drivers, and startup files. - If someone has modified a file (for example, if malware has tampered with it or it has been corrupted), Trusted Boot will detect the problem and attempt to automatically repair the corrupted component. When repaired, Windows will start normally after only a brief delay. - ### Measured Boot - The biggest challenge with rootkits and bootkits in earlier versions of Windows was that they could frequently be undetectable to the client. Because they often started before Windows defenses and the antimalware solution—and they had system-level privileges—rootkits and bootkits could completely disguise themselves while continuing to access system resources. Although UEFI with Secure Boot and Trusted Boot could prevent most rootkits and bootkits, intruders could still potentially exploit a few attack vectors (for example, if someone compromised the signature used to sign a boot component, such as a non-Microsoft driver, and used it to sign a malicious one). - Windows 10 Mobile implements the Measured Boot feature, which uses the TPM hardware component to record a series of measurements for critical startup-related components, including firmware, Windows boot components, and drivers. Because Measured Boot uses the hardware-based security capabilities of TPM, which isolates and protects the measurement data against malware attacks, the log data is well protected against even sophisticated attacks. - Measured Boot focuses on acquiring the measurement data and protecting it against tampering. You must couple it, however, with a service that can analyze the data to determine device health and provide a more complete security service. The next section introduces just such a service. - ### Device health attestation - Device health attestation is new feature in Windows 10 Mobile that helps prevent low-level malware infections. Device health attestation uses a device’s TPM and firmware to measure the critical security properties of the device’s BIOS and Windows startup processes. These measurements are made in such a way that even on a system infected with kernel-level malware or a rootkit, an attacker is unlikely to spoof the properties. - You can integrate Device health attestation with Microsoft Intune or non-Microsoft MDM solutions and combine these hardware-measured security properties with other device properties to gain an overall view of the device’s health and compliance state. From there, you can use this integration in a variety of scenarios, from detecting jailbroken devices to monitoring device compliance, generating compliance reports, alerting users or administrators, initiating corrective action on the device, and managing conditional access to resources such as Office 365. - ### Conditional Access - The example that follows shows how Windows 10 protective measures integrate and work with Intune and non-Microsoft MDM solutions. It demonstrates how the phone security architecture in Windows 10 Mobile helps you monitor and verify compliance and how the security and trust rooted in the device hardware protect corporate resources end to end. - When a user turns on a phone: - 1. The Secure Boot feature in Windows 10 Mobile helps protect the startup sequence, allows the device to boot into a defined and trusted configuration, and loads a factory-trusted boot loader. - 2. Windows 10 Mobile Trusted Boot takes control when the Secure Boot process is complete, verifying the digital signature of the Windows kernel and the components that are loaded and executed during the startup process. - 3. In parallel to steps 1 and 2, the phone’s TPM runs independently in a hardware-protected security zone (isolated from the boot execution path, which monitors boot activities). It creates a protected, tamper-evident audit trail, signed with a secret that only the TPM can access. - 4. Devices that a Device health attestation-enabled MDM solution manage send a copy of this audit trail to the Microsoft Health Attestation Service (HAS) in a protected, tamper-resistant, and tamper-evident communication channel. - 5. HAS reviews the audit trails, issues an encrypted and signed report, and forwards it to the device. - 6. From your Device health attestation-enabled MDM solution, you can review the report in a protected, tamper-resistant, and tamper-evident communication channel to assess whether the device is running in a compliant (healthy) state, allow access, or trigger corrective action aligned with the organization’s security needs and policies. - Because this solution can detect and prevent low-level malware that may be extremely difficult to detect any other way, Microsoft recommends that you consider implementing a Device health attestation-enabled MDM system like Intune that takes advantage of the Windows 10 Mobile cloud-based health attestation server feature to detect and block devices infected with advanced malware. - ## App platform security - - Applications built for Windows are designed to be secure and free of defects, but the reality is that human error can create vulnerabilities in code. When malicious users and software identify such vulnerabilities, they may attempt to manipulate data in memory in the hope that they can compromise the system and take control. - To mitigate these risks, Windows 10 Mobile includes a series of improvements to make it more difficult for malware to compromise the device. Windows 10 Mobile even enables organizations to choose which apps are allowed to run on mobile devices. In addition, it includes improvements that can dramatically reduce the likelihood that newly discovered vulnerabilities can be successful exploited. It takes detailed knowledge of operating system architecture and malware exploit techniques to fully appreciate the impact of these improvements, but the sections that follow explain them at a high level. - ### Device Guard - Device Guard is a feature set that consists of both hardware and software system integrity-hardening features. These features revolutionize Windows operating system security by moving the entire operating system to a trust-nothing model. - All apps on Windows 10 Mobile must be digitally signed and come from Windows Store or a trusted enterprise store. Device Guard implements policies that further restrict this. By default, Device Guard supports all apps from Windows Store. You can create policies that define the apps that can and cannot run on the Windows 10 Mobile device. If the app doesn’t have a digital signature or is prevented by policy, or it does not come from a trusted store, it will not run on Windows 10 Mobile. - Advanced hardware features (described earlier in the [Enterprise-grade secure hardware](#secure-hardware) section) drive these security offerings. By integrating these hardware features further into the core operating system, Windows 10 Mobile can use them in new ways. To deliver this additional security, Device Guard requires UEFI with Secure Boot. - ### AppContainer - The Windows 10 Mobile security model is based on the principle of least privilege and uses isolation to achieve it. Every app and even portions of the operating system itself run inside their own isolated sandbox called an AppContainer—a secured isolation boundary within which an app and its processes can run. Each AppContainer is defined and implemented through a security policy. - The security policy of a specific AppContainer defines the operating system capabilities that apps have access to from within the AppContainer. A capability is a Windows 10 Mobile device resource such as geographical location information, camera, microphone, networking, and sensors. - A set of default permissions are granted to all AppContainers, including access to a unique, isolated storage location. In addition, access to other capabilities can be declared within the app code itself. Access to additional capabilities and privileges cannot be requested at run time, as can be done with traditional desktop applications. - The AppContainer concept is advantageous for the following reasons: - - **Attack surface reduction.** Apps can access only those capabilities that are declared in the application code and needed to perform their functions. - - **User consent and control.** Capabilities that apps use are automatically published to the app details page in the Windows Store. App access to capabilities that may expose sensitive information automatically prompt the user to acknowledge and provide consent. - - **App isolation.** Communication between Windows apps is tightly controlled. Apps are isolated from one another and can communicate only by using predefined communications channels and data types. - Apps receive the minimal privileges they need to perform their legitimate tasks. This means that even if a malicious attacker exploits an app, the potential damage is limited because the app cannot elevate its privileges and is contained within its AppContainer. Windows Store displays the permissions that the app requires along with the app’s age rating and publisher. - The combination of Device Guard and AppContainer help to prevent unauthorized apps from running. In the event malware slips into the app ecosystem, the AppContainer helps to constrain the app and limit potential damage. The Windows 10 Mobile trust-nothing model doesn’t assume that any component is perfect, however, potential vulnerabilities in apps, AppContainers, and Windows 10 Mobile itself could give an attacker a chance to compromise a system. For this reason, we need redundant vulnerability mitigations. The next several topics describe some of the redundant mitigations in Windows 10 Mobile. - ### Address Space Layout Randomization - One of the most common techniques attackers use to gain access to a system is to find a vulnerability in a privileged process that is already running, guess or find a location in memory where important system code and data reside, and then overwrite that information with a malicious payload. In the early days of operating systems, any malware that could write directly to the system memory could do such a thing; the malware would simply overwrite system memory in well-known and predictable locations. - Address Space Layout Randomization (ASLR) makes that type of attack much more difficult because it randomizes how and where important data is stored in memory. With ASLR, it is more difficult for malware to find the specific location it needs to attack. Figure 3 illustrates how ASLR works, showing how the locations of different critical Windows components can change in memory between restarts. - ![figure 3](images/mobile-security-guide-figure3.png) - Figure 3. ASLR at work - Microsoft has substantively improved the ASLR implementation in Windows 10 Mobile over previous versions, especially with 64-bit system and application processes that can take advantage of a vastly increased memory space, making it even more difficult for malware to predict where Windows 10 Mobile stores vital data. When used on systems that have TPMs, ASLR memory randomization will be increasingly unique across devices, making it even more difficult for a successful exploit that works on one system to work reliably on another. Microsoft also holistically applied ASLR across the entire system in Windows 10 Mobile rather than it working only on specific apps. - ### Data Execution Prevention - Malware depends on its ability to put a malicious payload into memory with the hope that an unsuspecting user will execute it later. ASLR makes that much more difficult. - Extending that protection, it would be great if you could prevent malware from running if it wrote to an area that you have allocated solely for the storage of information. Data Execution Prevention (DEP) does exactly that, substantially reducing the range of memory that malicious code can use for its benefit. DEP uses the **No execute** bit on modern CPUs to mark blocks of memory as read only so that malware can’t use those blocks to execute malicious code. All Windows 10 and Windows 10 Mobile devices support DEP. - ### Windows heap - The heap is a location in memory that Windows uses to store dynamic application data. Microsoft continues to improve on earlier Windows heap designs by further mitigating the risk of heap exploits that an attacker could use. - Windows 10 Mobile has several important improvements to the security of the heap over previous versions of Windows: - - Internal data structures that the heap uses are better protected against memory corruption. - - Heap memory allocations have randomized locations and sizes, making it more difficult for an attacker to predict the location of critical memory to overwrite. Specifically, Windows 10 Mobile adds a random offset to the address of a newly allocated heap, which makes the allocation much less predictable. - - Windows 10 Mobile uses “guard pages” before and after blocks of memory as tripwires. If an attacker attempts to write past a block of memory (a common technique known as a buffer overflow), the attacker will have to overwrite a guard page. Any attempt to modify a guard page is considered a memory corruption, and Windows 10 Mobile responds by instantly terminating the app. - ### Memory reservations - Microsoft reserves the lowest 64 KB of process memory for the operating system. Apps are no longer allowed to allocate that portion of the memory, which makes it more difficult for malware to overwrite critical system data structures in memory. - ### Control Flow Guard - When Windows loads applications into memory, it allocates space to those applications based on the size of the code, requested memory, and other factors. When an application begins to execute code, it calls additional code located in other memory addresses. The relationships among the code locations are well known—they are written in the code itself—but until Windows 10 Mobile, the operating system didn’t enforce the flow among these locations, giving attackers the opportunity to change the flow to meet their needs. In other words, an application exploit takes advantage of this behavior by running code that the application may not typically run. - Windows 10 Mobile mitigates this kind of threat through the Control Flow Guard (CFG) feature. When a trusted application that its creator compiled to use CFG calls code, CFG verifies that the code location called is trusted for execution. If CFG doesn’t trust the location, it immediately terminates the application as a potential security risk. - You cannot configure CFG; rather, an application developer can take advantage of CFG by configuring it when he or she compiles the application. Consider asking application developers and software vendors to deliver trustworthy Windows applications compiled with CFG enabled. Of course, browsers are a key entry point for attacks; thus Microsoft Edge and other Windows features take full advantage of CFG. - ### Protected processes - In general, preventing a computer security incident is more cost-effective than repairing the damage an incident can cause. For malware in particular, most security controls are designed to prevent an attack from being initially successful. The reasoning is that if malware cannot infect the system, the system is immune to malware. - Unfortunately, no device is immune to malware. Despite all the best preventative controls, malware can eventually find a way to infect any operating system or hardware platform. So, although prevention with a defense-in-depth strategy is important, it cannot be the only type of malware control. - The key security scenario is to assume that malware is running on a system but limit what it can do. Windows 10 Mobile has security controls and design features in place to reduce compromise from existing malware infections. Protected Processes is one such feature. - With Protected Processes, Windows 10 Mobile prevents untrusted processes from interacting or tampering with those that have been specially signed. Protected Processes defines levels of trust for processes: it prevents less trusted processes from interacting with and therefore attacking more trusted processes. Windows 10 Mobile uses Protected Processes more broadly across the operating system. - ### Store for Business - Store for Business allows IT pros to find, acquire, distribute, and manage apps for their organization. The model provides flexible ways to distribute apps, depending on the size of your organization, and does not require additional infrastructure in some scenarios. - UWP apps are inherently more secure than typical applications because they are sandboxed, which restricts the app’s risk of compromise or tampering with in a way that would put the system, data, and other applications at risk. Windows Store can further reduce the likelihood that malware will infect devices by reviewing all applications that enter the Windows Store ecosystem before making them available. Store for Business extends this concept by enabling you to distribute custom LOB apps, and even some Windows Store apps, to Windows 10 Mobile devices through the same Windows Store infrastructure. - Regardless of how users acquire UWP apps, they can use them with increased confidence. UWP apps run in an AppContainer sandbox with limited privileges and capabilities. For example, the apps have no system-level access, have tightly controlled interactions with other apps, and have no access to data unless the user explicitly grants the application permission. - In addition, all UWP apps follow the security principle of least privilege. Apps receive only the minimum privileges they need to perform their legitimate tasks, so even if an attacker exploits an app, the damage the exploit can do is significantly limited and should be contained within the sandbox. Windows Store displays the exact capabilities the app requires (for example, access to the camera), along with the app’s age rating and publisher. - The Windows Store app-distribution process and the app sandboxing capabilities of Windows 10 Mobile can dramatically reduce the likelihood that users encounter malicious apps on the system. - For more information about Store for Business, see [Windows Store for Business overview](../whats-new/windows-store-for-business-overview.md). - ### App management - An enterprise typically exerts some configuration and control over the apps installed on devices. In this way, the organization accomplishes several business goals, such managing software licenses, ensuring mandatory app deployment on required devices, and preventing the installation of unacceptable apps on corporate devices. - An important component in delivering on these goals is Store for Business, which builds on the Windows Store infrastructure that Microsoft hosts and enables you to deploy Windows Store apps across your Windows 10-based devices. Store for Business is both powerful and highly flexible. It allows you to extend and customize features without having to stand up new on-premises infrastructure. It supports and integrates with your existing MDM service but doesn’t require one. (Ask your MDM service vendor about integration with Store for Business.) You can configure Store for Business for a wide variety of scenarios, including online and offline licensing and different app-distribution options. For a more detailed description of the available Store for Business scenarios, see [Windows Store for Business overview](../whats-new/windows-store-for-business-overview.md). - A web-based portal for IT pros simplifies Windows 10 Mobile app deployment. The familiar look of Windows Store was used to design the Store for Business experience. It showcases apps relevant to business use, hand-selected and sorted by category. The store can use Azure AD accounts for all users, linking them to a single, unique organizational identity. - Another key benefit is licensing. Store for Business enables you to track and manage licenses for all UWP apps. You can easily determine which users have installed specific apps, track remaining licenses left, and acquire new licenses directly through the web interface. Those new licenses are added within Store for Business and do not require complex export and import processes. As long as your clients are online and have Internet connectivity, the licensing scenario with Store for Business is a great improvement over manual licensing tasks. - Store for Business allows you to find the right apps for your users, acquire them, manage app licenses, and distribute apps to individuals. The best way to understand Store for Business is to look at the steps involved in a common scenario: delivering apps to Windows 10 Mobile users without an MDM—specifically, deploying apps to Windows 10 Mobile users. In this scenario, you identify several apps that must be on each mobile device that are currently available for free in the Windows Store (for example, a VPN app for your Dell SonicWALL solution) and some internally developed LOB apps. - ### The IT side - You begin the app deployment process by preparing the private store and the apps before your users receive their new Windows 10 Mobile devices. - First, you open [Windows Store for Business](http://go.microsoft.com/fwlink/p/?LinkId=722910) and use an Azure AD account to log in. This account is linked to the company’s unique organizational identity and must have an Azure AD tenant. In addition, the account must have Azure AD Enterprise Admin permissions if this is the first time you’re using Store for Business. You can delegate later access through permissions within Store for Business. - Next, you locate and acquire any apps you want to deploy to the mobile devices, adding the apps and licenses to the organization’s inventory. - Along with existing Windows Store apps, you can use Store for Business to manage custom LOB apps that are developed for your organization. First, you grant permission for a trusted app developer to submit the apps. You and the developer submit these apps through the [Windows Dev Center](http://go.microsoft.com/fwlink/p/?LinkId=722911), and they must be digitally signed with a trusted certificate. These apps are not published to the retail Windows Store catalog and are not visible to anyone outside the organization. - You can deliver the apps through a private store within Windows Store. The next step, then, is for you to mark the app to be available in the private store, which you do through the Store for Business web portal. - Alternatively, you can choose one of two other app-distribution options in Store for Business web portal: - - Assign the app to people in your organization by selecting one or more Azure AD identities - - Add the app to the organization’s private store, and allow all users to discover and install it. - For details about app distribution, see [Distribute apps using your private store](../manage/distribute-apps-from-your-private-store.md). - The IT process for preparing Store for Business for app deployment is shown in Figure 4. - ![figure 4](images/mobile-security-guide-figure4.png) - Figure 4. The IT process for Store for Business - For details about the process of distributing apps through Store for Business, see [Find and acquire apps](../manage/find-and-acquire-apps-overview.md). - ### The user side - After you have prepared Store for Business, the user side of the process takes over. This side of the process is designed to be user friendly, with the primary app deployment method—through Store for Business—streamlined and straightforward. This process doesn’t require an MDM system or any on-premises infrastructure. In fact, the user never sees the “for Business” label, just the familiar Windows Store. - 1. The user opens the Windows Store app on his or her Windows 10 Mobile device. - 2. The same Windows Store interface appears, with the addition of the private store you created. The private store appears as a new page, similar to Games and Music. The interface integrates the public Windows Store with the organization’s private store, which contains curated apps. - 3. The user simply selects and installs apps as usual. - If the user wants to make a private purchase of apps, music, movies, or TV shows with his or her Microsoft account, that’s an option, as well. The user pays for and owns his or her purchase, independent of the company. This flexibility enables hybrid scenarios for devices in many bring your own device environments. - ### Microsoft Edge - Windows 10 Mobile includes critical improvements designed to thwart attacks and malware. The environment is now more resistant to malware thanks to significant improvements to SmartScreen Filters. Internet browsing is a safer experience thanks to Microsoft Edge, a completely new browser. - Windows 10 Mobile includes Microsoft Edge, an entirely new web browser that goes beyond browsing with features like Reading View. Microsoft Edge is more secure than previous Microsoft web browsers in several ways: - - **Microsoft Edge does not support non-Microsoft binary extensions.** Microsoft Edge supports Flash content and PDF viewing by default through built-in extensions but includes no non-Microsoft binary extensions, such as ActiveX controls or Java. - - **Microsoft Edge is designed as a UWP app.** It is inherently compartmentalized and runs in an AppContainer that sandboxes the browser from the system, data, and other apps. - - **Microsoft Edge simplifies security configuration tasks.** Because Microsoft Edge uses a simplified application structure and a single sandbox configuration, fewer security settings are required. In addition, Microsoft established Microsoft Edge default settings that align with security best practices, making it more secure by design. - The web browser is a critical component of any security strategy, and for good reason: it is the user’s interface to the Internet, an environment teeming with malicious sites and nefarious content. Most users cannot perform at least part of their job without a browser, and many users are completely reliant on one. This reality has made the browser the number one pathway from which malicious hackers initiate their attacks. - ## Related topics - - [Windows 10 security overview](windows-10-security-guide.md) - [Windows 10 Mobile and MDM](../manage/windows-10-mobile-and-mdm.md) - [Windows 10 and Windows 10 Mobile](../index.md) - [Windows Store for Business](http://go.microsoft.com/fwlink/p/?LinkId=722910) - [Windows Store for Business overview](../whats-new/windows-store-for-business-overview.md) -   -   - - - - - diff --git a/windows/keep-secure/windows-10-security-guide.md b/windows/keep-secure/windows-10-security-guide.md index 586d509b57..2e8afda0f6 100644 --- a/windows/keep-secure/windows-10-security-guide.md +++ b/windows/keep-secure/windows-10-security-guide.md @@ -2,48 +2,29 @@ title: Windows 10 security overview (Windows 10) description: This guide provides a detailed description of the most important security improvements in the Windows 10 operating system, with links to more detailed articles about many of its security features. ms.assetid: 4561D80B-A914-403C-A17C-3BE6FC95B59B +ms.pagetype: security keywords: ["configure", "feature", "file encryption"] ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library author: challum --- - # Windows 10 security overview - - **Applies to** - - Windows 10 - This guide provides a detailed description of the most important security improvements in the Windows 10 operating system, with links to more detailed articles about many of its security features. Wherever possible, specific recommendations are provided to help you implement and configure Windows 10 security features. - ## Introduction - - Windows 10 is designed to protect against known and emerging security threats across the spectrum of attack vectors. Three broad categories of security work went into Windows 10: - - [**Identity and access control**](#identity) features have been greatly expanded to both simplify and enhance the security of user authentication. These features include Windows Hello and Microsoft Passport, which better protect user identities through easy-to-deploy and easy-to-use multifactor authentication (MFA). Another new feature is Credential Guard, which uses virtualization-based security (VBS) to help protect the Windows authentication subsystems and users’ credentials. - - [**Information protection**](#information) that guards information at rest, in use, and in transit. In addition to BitLocker and BitLocker To Go for protection of data at rest, Windows 10 includes file-level encryption with Enterprise Data Protection that performs data separation and containment and, when combined with Rights Management services, can keep data encrypted when it leaves the corporate network. Windows 10 can also help keep data secure by using virtual private networks (VPNs) and Internet Protocol Security. - - [**Malware resistance**](#malware) includes architectural changes that can isolate critical system and security components from threats. Several new features in Windows 10 help reduce the threat of malware, including VBS, Device Guard, Microsoft Edge, and an entirely new version of Windows Defender. In addition, the many antimalware features from the Windows 8.1 operating system— including AppContainers for application sandboxing and numerous boot-protection features, such as Trusted Boot—have been carried forward and improved in Windows 10. - ## Identity and access control - - Traditionally, access control is a process that has three components: - - **Identification** - when a user asserts a unique identity to the computer system for the purpose of gaining access to a resource, such as a file or a printer. In some definitions, the user is called the subject and the resource is the object. - - **Authentication** - the process of proving the asserted identity and verification that the subject is indeed *the* subject. - - **Authorization** - performed by the system to compare the authenticated subject’s access rights against the object’s permissions and either allow or deny the requested access. - The way these components are implemented makes the difference in stopping attackers from accessing secret data. Only a user who proves his or her identity – and is authorized to access that data – will access it. But in security, there are varying degrees of identity proof and many different requirements for authorization limits. The access control flexibility needed in most corporate environments presents a challenge for any operating system. Table 1 lists typical Windows access control challenges and the Windows 10 solutions. - Table 1. Windows 10 solutions to typical access control challenges - @@ -80,80 +61,42 @@ Table 1. Windows 10 solutions to typical access control challenges
    -   - The sections that follow describe these challenges and solutions in more detail. - **Microsoft Passport** - Microsoft Passport provides strong two-factor authentication (2FA), fully integrated into Windows, and replaces passwords with the combination of an enrolled device and either a PIN or Windows Hello. Microsoft Passport is conceptually similar to smart cards but more flexible. Authentication is performed by using an asymmetric key pair instead of a string comparison (for example, password), and the user’s key material can be secured by using hardware. - Unlike smart cards, Microsoft Passport does not require the extra infrastructure components required for smart card deployment. In particular, you do not need public key infrastructure (PKI). If you already use PKI – for example, in secure email or VPN authentication – you can use the existing infrastructure with Microsoft Passport. Microsoft Passport combines the major advantages of smart card technology – deployment flexibility for virtual smart cards and robust security for physical smart cards – without any of their drawbacks. - Microsoft Passport offers three significant advantages over the current state of Windows authentication: It’s more flexible, it’s based on industry standards, and it effectively mitigates risks. The sections that follow look at each of these advantages in more detail. - **It’s flexible** - Microsoft Passport offers unprecedented flexibility. Although the format and use of passwords and smart cards is fixed, Microsoft Passport gives both administrators and users options to manage authentication. First and foremost, Microsoft Passport works with biometric sensors and PINs. Next, you can use your PC or even your phone as one of the factors to authenticate on your PC. Finally, your user credentials can come from your PKI infrastructure, or Windows can create the credential itself. - Microsoft Passport gives you options beyond long, complex passwords. Instead of requiring users to memorize and retype frequently-changed passwords, Microsoft Passport enables PIN- and biometrics-based authentication through Windows Hello to securely identify users. - With Microsoft Passport, you gain flexibility in the data center, too. To deploy it, you must add Windows Server 2016 domain controllers to your Active Directory environment, but you do not have to replace or remove your existing Active Directory servers: Microsoft Passport builds on and adds to your existing infrastructure. You can either add on premises servers or use Microsoft Azure Active Directory to deploy Microsoft Passport to your network. The choice of which users to enable for Microsoft Passport use is completely up to you – you choose which items to protect and which authentication factors you want to support. This flexibility makes it easy to use Microsoft Passport to supplement existing smart card or token deployments by adding 2FA to users who do not currently have it, or to deploy Microsoft Passport in scenarios that call for extra protection for sensitive resources or systems. - **It’s standardized** - Both software vendors and enterprise customers have come to realize that proprietary identity and authentication systems are a dead end: The future lies with open, interoperable systems that allow secure authentication across a variety of devices, line of business (LOB) apps, and external applications and websites. To this end, a group of industry players formed FIDO, the Fast IDentity Online Alliance. The FIDO Alliance is a nonprofit organization intended to address the lack of interoperability among strong authentication devices, as well as the problems users face when they need to create and remember multiple user names and passwords. The FIDO Alliance plans to change the nature of authentication by developing specifications that define an open, scalable, interoperable set of mechanisms that supplant reliance on passwords to securely authenticate users of online services. This new standard for security devices and browser plug ins will allow any website or cloud application to interface with a broad variety of existing and future FIDO-enabled devices that the user has for online security. - In 2014, Microsoft joined the board of the [FIDO Alliance](http://go.microsoft.com/fwlink/p/?LinkId=626934). FIDO standards enable a universal framework that a global ecosystem delivers for a consistent and greatly improved user experience of strong password-less authentication. The FIDO 1.0 specifications, published in December 2014, provide for two types of authentications: password-less (known as UAF) and second factor (U2F). The FIDO Alliance is working on a set of 2.0 proposals that incorporate the best ideas from its U2F and UAF FIDO 1.0 standards, and of course, on new ideas. Microsoft has contributed Microsoft Passport technology to the FIDO 2.0 specification workgroup for review and feedback and continues to work with the FIDO Alliance as the FIDO 2.0 specification moves forward. Interoperability of FIDO products is a hallmark of FIDO authentication. Microsoft believes that bringing a FIDO solution to market will help solve a critical need for enterprises and consumers alike. - **It’s effective** - Microsoft Passport effectively mitigates two major security risks. First, it eliminates the use of passwords for logon and so reduces the risk that a nefarious attacker will steal and reuse the user’s credentials. User key material is generated and available within the Trusted Platform Module (TPM) of the user device, which protects it from attackers who want to capture the key material and reuse it. Second, because Microsoft Passport uses asymmetrical key pairs, users credentials can’t be stolen in cases where the identity provider or websites the user accesses have been compromised. - To compromise a Microsoft Passport credential that TPM protects, an attacker must have access to the physical device, and then must find a way to spoof the user’s biometrics or guess his or her PIN—and all of this must be done before TPM anti-hammer capabilities lock the device. This sets the bar magnitudes of order higher than password phishing attacks. - ### - **Windows Hello** - Windows Hello is the name given to the new biometric sign-in option for Microsoft Passport. Because biometric authentication is built directly into the operating system, Windows Hello allows users to unlock their devices by using their face or fingerprint. From here, authentication to the devices and resources is enabled through a combination of the user’s unique biometric identifier and the device itself. - The user’s biometric data that is used for Windows Hello is considered a local gesture and consequently doesn’t roam among a user’s devices and is not centrally stored. The biometric image of the user the sensor takes is converted into an algorithmic form that cannot be converted back into the original image that the sensor took. Devices that have TPM 2.0 encrypt the biometric data in a form that makes it unreadable if the data is ever removed from the device. If multiple users share a device, each user will be able to enroll and use Windows Hello for his or her Windows profile. - Windows Hello supports two biometric sensor options that are suitable for enterprise scenarios: - - **Facial recognition** uses special infrared cameras to reliably tell the difference between a photograph or scan and a living person. Several vendors are shipping external cameras that incorporate this technology, and major manufacturers are already shipping integrated devices with facial-recognition technology. - - **Fingerprint recognition** uses a fingerprint sensor to scan the user’s fingerprint. Although fingerprint readers have been available for computers running Windows for years, the detection, antispoofing, and recognition algorithms in Windows 10 are more advanced than previous Windows versions. Most existing fingerprint readers (whether external or integrated into laptops or USB keyboards) can be used with Windows Hello. - Windows Hello offers several major benefits. First, it addresses the problems of credential theft and sharing, because an attacker must obtain the device and impersonate the user’s biometric identity, which is more difficult than stealing a password or PIN. Second, the use of biometrics gives users an authenticator that’s always with them – there’s nothing to forget, lose, or leave behind. Instead of worrying about memorizing long, complex passwords, users can take advantage of a convenient, secure method for logging in to all their Windows devices. Finally, there’s nothing additional to deploy or manage. Because Windows Hello support is built directly into the operating system, there are no additional drivers to deploy. - **Brute-force attack resistance** - A brute-force attack is the process used to break into a device simply by guessing a user’s password, PIN, or even his or her biometric identity over and over until the attacker gets it right. Over the last several versions of Windows, Microsoft has added features that dramatically reduce the chances that such an attack would succeed. - The Windows 7 operating system and previous versions defended against brute-force attacks in a straightforward way: they slowed or prevented additional guesses after multiple mistakes. When users use a full password to log on, Windows forces users to wait several seconds between attempts if they type their password incorrectly multiple times. You can even choose to have Windows lock out an account for a period of time when it detects a brute-force attack. - Windows 8.1 and Windows 10 support an even more powerful – but optional – form of brute-force protection when the credentials are tied to TPM. If the operating system detects a brute-force attack against the Windows sign-in and BitLocker protects the system drive, Windows can automatically restart the device and put it in BitLocker recovery mode until someone enters a recovery key password. This password is a virtually unguessable 48-character recovery code that must be used before Windows will be able to start normally. - If you’re interested in learning how to configure brute-force protection, use a test Windows 10 PC on which BitLocker protection is enabled for the system drive, and then print the BitLocker recovery key to ensure that you have it available. Then, open the Local Group Policy Editor by running **gpedit.msc**, and go to Computer Configuration\\Windows Settings\\Security Settings\\Security Options. Open the policy **Interactive Login: Machine Account Lockout Threshold**, and set the value to **5**, as shown in Figure 1. - ![figure 1](images/security-fig1-invalidaccess.png) - Figure 1. Set the number of invalid access attempts prior to lockout - Now, your PC is configured with brute-force protection. Restart your PC. When prompted to log on, mistype your password until the PC restarts. Now, try to guess the 48-character recovery key. You will be glad you printed it out beforehand. - ## Information protection - - When users travel, their organization’s confidential data goes with them. Wherever confidential data is stored, it must be protected against unauthorized access. Windows has a long history of providing at-rest data-protection solutions that guard against nefarious attackers, beginning with the Encrypting File System in the Windows 2000 operating system. More recently, BitLocker has provided encryption for full drives and portable drives; in Windows 10, BitLocker will even protect individual files, with data loss prevention capabilities. Windows consistently improves data protection by improving existing options and by providing new strategies. - Table 2 lists specific data-protection concerns and how they are addressed in Windows 10 and Windows 7. - Table 2. Data Protection in Windows 10 and Windows 7 - @@ -202,148 +145,76 @@ Table 2. Data Protection in Windows 10 and Windows 7
    -   - The sections that follow describe these improvements in more detail. - **Prepare for drive and file encryption** - The best type of security measures are transparent to the user during implementation and use. Every time there is a possible delay or difficulty because of a security feature, there is strong likelihood that users will try to bypass security. This situation is especially true for data protection, and that’s a scenario that organizations need to avoid. - Whether you’re planning to encrypt entire volumes, removable devices, or individual files, Windows 10 meets your needs by providing streamlined, usable solutions. In fact, you can take several steps in advance to prepare for data encryption and make the deployment quick and smooth. - **TPM pre-provisioning** - In Windows 7, preparing the TPM for use offered a couple of challenges: - - You can turn on the TPM in the BIOS, which requires someone to either go into the BIOS settings to turn it on or to install a driver to turn it on from within Windows. - - When you enable the TPM, it may require one or more restarts. - Basically, it was a big hassle. If IT staff were provisioning new PCs, they could handle all of this, but if you wanted to add BitLocker to devices that were already in users’ hands, those users would have struggled with the technical challenges and would either call IT for support or simply leave BitLocker disabled. - Microsoft includes instrumentation in Windows 10 that enables the operating system to fully manage the TPM. There is no need to go into the BIOS, and all scenarios that required a restart have been eliminated. - **Deploy hard drive encryption** - BitLocker is capable of encrypting entire hard drives, including both system and data drives. BitLocker pre-provisioning can drastically reduce the time required to provision new PCs with BitLocker enabled. With Windows 10, administrators can turn on BitLocker and the TPM from within the Windows Preinstallation Environment before they install Windows or as part of an automated deployment task sequence without any user interaction. Combined with Used Disk Space Only encryption and a mostly empty drive (because Windows is not yet installed), it takes only a few seconds to enable BitLocker. - With earlier versions of Windows, administrators had to enable BitLocker after Windows had been installed. Although this process could be automated, BitLocker would need to encrypt the entire drive, a process that could take anywhere from several hours to more than a day depending on drive size and performance, which significantly delayed deployment. Microsoft has improved this process through multiple features in Windows 10. - **Device encryption** - Beginning in Windows 8.1, Windows automatically enables BitLocker device encryption on devices that support InstantGo. With Windows 10, Microsoft offers device encryption support on a much broader range of devices, including those that are InstantGo. Microsoft expects that most devices in the future will pass the testing requirements, which makes device encryption pervasive across modern Windows devices. Device encryption further protects the system by transparently implementing device-wide data encryption. - Unlike a standard BitLocker implementation, device encryption is enabled automatically so that the device is always protected. The following list outlines how this happens: - - When a clean installation of Windows 10 is completed and the out-of-box experience is finished, the computer is prepared for first use. As part of this preparation, device encryption is initialized on the operating system drive and fixed data drives on the computer with a clear key (this is the equivalent of standard BitLocker suspended state). - - If the device is not domain joined, a Microsoft account that has been granted administrative privileges on the device is required. When the administrator uses a Microsoft account to sign in, the clear key is removed, a recovery key is uploaded to the online Microsoft account, and a TPM protector is created. Should a device require the recovery key, the user will be guided to use an alternate device and navigate to a recovery key access URL to retrieve the recovery key by using his or her Microsoft account credentials. - - If the user uses a domain account to sign in, the clear key is not removed until the user joins the device to a domain and the recovery key is successfully backed up to Active Directory Domain Services (AD DS). You must enable the **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption\\Operating System Drives** Group Policy setting, and select the **Do not enable BitLocker until recovery information is stored in AD DS for operating system drives** option. With this configuration, the recovery password is created automatically when the computer joins the domain, and then the recovery key is backed up to AD DS, the TPM protector is created, and the clear key is removed. - - Similar to signing in with a domain account, the clear key is removed when the user logs on to an Azure AD account on the device. As described in the bullet point above, the recovery password is created automatically when the user authenticates to Azure AD. Then, the recovery key is backed up to Azure AD, the TPM protector is created, and the clear key is removed. - Microsoft recommends that device encryption be enabled on any systems that support it, but the automatic device encryption process can be prevented by changing the following registry setting: - - **Subkey**: HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\BitLocker - - **Value**: PreventDeviceEncryption equal to True (1) - - **Type**: REG\_DWORD - Administrators can manage domain-joined devices that have device encryption enabled through Microsoft BitLocker Administration and Monitoring (MBAM). In this case, device encryption automatically makes additional BitLocker options available. No conversion or encryption is required, and MBAM can manage the full BitLocker policy set if any configuration changes are required. - **Used Disk Space Only encryption** - BitLocker in earlier Windows versions could take a long time to encrypt a drive, because it encrypted every byte on the volume (including parts that did not have data). That is still the most secure way to encrypt a drive, especially if a drive has previously contained confidential data that has since been moved or deleted, in which case traces of the confidential data could remain on portions of the drive marked as unused. - But why encrypt a new drive when you can simply encrypt the data as it is being written? To reduce encryption time, BitLocker in Windows 10 lets users choose to encrypt just their data. Depending on the amount of data on the drive, this option can reduce encryption time by more than 99 percent. - Exercise caution when encrypting only used space on an existing volume on which confidential data may have already been stored in an unencrypted state, however, because those sectors can be recovered through disk-recovery tools until they are overwritten by new encrypted data. In contrast, encrypting only used space on a brand-new volume can significantly decrease deployment time without the security risk because all new data will be encrypted as it is written to the disk. - **Encrypted hard drive support** - SEDs have been available for years, but Microsoft couldn’t support their use with some earlier versions of Windows because the drives lacked important key management features. Microsoft worked with storage vendors to improve the hardware capabilities, and now BitLocker supports the next generation of SEDs, which are called encrypted hard drives. - Encrypted hard drives provide onboard cryptographic capabilities to encrypt data on drives, which improves both drive and system performance by offloading cryptographic calculations from the PC’s processor to the drive itself and rapidly encrypting the drive by using dedicated, purpose-built hardware. If you plan to use whole-drive encryption with Windows 10, Microsoft recommends that you investigate hard drive manufacturers and models to determine whether any of their encrypted hard drives meet your security and budget requirements. - For more information about encrypted hard drives, see [Encrypted Hard Drive](http://go.microsoft.com/fwlink/p/?LinkId=733880). - **Preboot information protection** - An effective information protection implementation, like most security controls, considers usability as well as security. Users typically prefer a simple security experience. In fact, the more transparent a security solution becomes, the more likely users are to conform to it. - It is crucial that organizations protect information on their PCs regardless of the state of the computer or the intent of users. This protection should not be cumbersome to users. One undesirable and previously commonplace situation is when the user is prompted for input during preboot, and then again during Windows logon. Challenging users for input more than once should be avoided. - Windows 10 can enable a true SSO experience from the preboot environment on modern devices and in some cases even on older devices when robust information protection configurations are in place. The TPM in isolation is able to securely protect the BitLocker encryption key while it is at rest, and it can securely unlock the operating system drive. When the key is in use and thus in memory, a combination of hardware and Windows capabilities can secure the key and prevent unauthorized access through cold-boot attacks. Although other countermeasures like PIN-based unlock are available, they are not as user-friendly; depending on the devices’ configuration they may not offer additional security when it comes to key protection. For more information about how to configure BitLocker for SSO, see [BitLocker Countermeasures](bitlocker-countermeasures.md). - **Manage passwords and PINs** - When BitLocker is enabled on a system drive and the PC has a TPM, you can choose to require that users type a PIN before BitLocker will unlock the drive. Such a PIN requirement can prevent an attacker who has physical access to a PC from even getting to the Windows logon, which makes it virtually impossible for the attacker to access or modify user data and system files. - Requiring a PIN at startup is a useful security feature because it acts as a second authentication factor (a second “something you know”). This configuration comes with some costs, however. One of the most significant is the need to change the PIN regularly. In enterprises that used BitLocker with Windows 7 and the Windows Vista operating system, users had to contact systems administrators to update their BitLocker PIN or password. This requirement not only increased management costs but made users less willing to change their BitLocker PIN or password on a regular basis. - Windows 10 users can update their BitLocker PINs and passwords themselves, without administrator credentials. Not only will this feature reduce support costs, but it could improve security, too, because it encourages users to change their PINs and passwords more often. In addition, InstantGo devices do not require a PIN for startup: They are designed to start infrequently and have other mitigations in place that further reduce the attack surface of the system. - For more information about how startup security works and the countermeasures that Windows 10 provides, see [Protect BitLocker from pre-boot attacks](protect-bitlocker-from-pre-boot-attacks.md). - **Configure Network Unlock** - Some organizations have location-specific data security requirements. This is most common in environments where high-value data is stored on PCs. The network environment may provide crucial data protection and enforce mandatory authentication; therefore, policy states that those PCs should not leave the building or be disconnected from the corporate network. Safeguards like physical security locks and geofencing may help enforce this policy as reactive controls. Beyond these, a proactive security control that grants data access only when the PC is connected to the corporate network is necessary. - Network Unlock enables BitLocker-protected PCs to start automatically when connected to a wired corporate network on which Windows Deployment Services runs. Anytime the PC is not connected to the corporate network, a user must type a PIN to unlock the drive (if PIN-based unlock is enabled). - Network Unlock requires the following infrastructure: - - Client PCs that have Unified Extensible Firmware Interface (UEFI) firmware version 2.3.1 or later, which supports Dynamic Host Configuration Protocol (DHCP) - - A server running Windows Server 2012 with the Windows Deployment Services role - - A server with the DHCP server role installed - For more information about how to configure Network Unlock, see [BitLocker: How to enable Network Unlock](http://go.microsoft.com/fwlink/p/?LinkId=733905). - **Microsoft BitLocker Administration and Monitoring** - Part of the Microsoft Desktop Optimization Pack, MBAM makes it easier to manage and support BitLocker and BitLocker To Go. MBAM 2.5 with Service Pack 1, the latest version, has the following key features: - - Enables administrators to automate the process of encrypting volumes on client computers across the enterprise. - - Enables security officers to quickly determine the compliance state of individual computers or even of the enterprise itself. - - Provides centralized reporting and hardware management with Microsoft System Center Configuration Manager. - - Reduces the workload on the help desk to assist end users with BitLocker recovery requests. - - Enables end users to recover encrypted devices independently by using the Self-Service Portal. - - Enables security officers to easily audit access to recovery key information. - - Empowers Windows Enterprise users to continue working anywhere with the assurance that their corporate data is protected. - - Enforces the BitLocker encryption policy options that you set for your enterprise. - - Integrates with existing management tools, such as System Center Configuration Manager. - - Offers an IT-customizable recovery user experience. - - Supports Windows 10. - For more information about MBAM, including how to obtain it, see [Microsoft BitLocker Administration and Monitoring](http://go.microsoft.com/fwlink/p/?LinkId=626935) on the MDOP TechCenter. - ## Malware resistance - - In movies, security threats always seem to be initiated by a nefarious hacker sitting in front of a monitor with green text scrolling across it. In the real world, the vast majority of security threats occur without any human interaction at all. Just as software has automated so much of our lives, malware has automated attacks on our PCs. Those attacks are relentless. Malware is constantly changing, and when it infects a PC, it can in some cases be extremely difficult to detect and remove. - Prevention is the best bet, and Windows 10 provides strong malware resistance because it takes advantage of secure hardware, which secures the startup process, the core operating system architecture, and the desktop. - Table 3 lists specific malware threats and the mitigation that Windows 10 provides. - Table 3. Threats and Windows 10 mitigations - @@ -389,546 +260,273 @@ Table 3. Threats and Windows 10 mitigations
    -   - The sections that follow describe these improvements in more detail. - **SMB hardening improvements for SYSVOL and NETLOGON connections** - In Windows 10 and Windows Server 2016 Technical Preview, client connections to the Active Directory Domain Services default SYSVOL and NETLOGON shares on domain controllers now require Server Message Block (SMB) signing and mutual authentication (such as Kerberos). - - **What value does this change add?** This change reduces the likelihood of man-in-the-middle attacks. - - **What works differently?** If SMB signing and mutual authentication are unavailable, a Windows 10 or Windows Server 2016 computer won’t process domain-based Group Policy and scripts. - - > **Note:** The registry values for these settings aren’t present by default, but the hardening rules still apply until overridden by Group Policy or other registry values. - For more information on these security improvements, (also referred to as UNC hardening), see [Microsoft Knowledge Base article 3000483](http://go.microsoft.com/fwlink/p/?LinkId=789216) and [MS15-011 & MS15-014: Hardening Group Policy](http://go.microsoft.com/fwlink/p/?LinkId=789215). - **Secure hardware** - Although Windows 10 is designed to run on almost any hardware capable of running Windows 8, Windows 7, or Windows Vista, taking full advantage of Windows 10 security requires advancements in hardware-based security, including UEFI with Secure Boot, CPU virtualization features (for example, Intel VT-x), CPU memory-protection features (for example, Intel VT-d), TPM, and biometric sensors. - **UEFI with Secure Boot** - When a PC starts, it begins the process of loading the operating system by locating the bootloader on the PC’s hard drive. Without safeguards in place, the PC may simply hand control over to the bootloader without even determining whether it is a trusted operating system or malware. - UEFI is a standards-based solution that offers a modern-day replacement for the BIOS. In fact, it provides the same functionality as BIOS while adding security features and other advanced capabilities. Like BIOS, UEFI initializes devices, but UEFI components with the Secure Boot feature (version 2.3.1 or later) also ensure that only trusted firmware in Option ROMs, UEFI apps, and operating system bootloaders can start on the device. - UEFI can run internal integrity checks that verify the firmware’s digital signature before running it. Because only the PC’s hardware manufacturer has access to the digital certificate required to create a valid firmware signature, UEFI has protection from firmware bootkits. Thus, UEFI is the first link in the chain of trust. - UEFI with Secure Boot became a hardware requirement starting with Windows 8 devices. If a PC supports UEFI, it must be enabled by default. It is possible to disable the Secure Boot feature on many devices, but Microsoft strongly discourages doing so because it dramatically reduces the security of the startup process. - When a PC with UEFI and Secure Boot starts, the UEFI firmware verifies the bootloader’s digital signature to verify that it has not been modified after it was digitally signed. The firmware also verifies that a trusted authority issued the bootloader’s digital signature. This check helps to ensure that the system starts only after checking that the bootloader is both trusted and unmodified since signing. - All Windows 8 certified PCs must meet several requirements related to Secure Boot: - - They must have Secure Boot enabled by default. - - They must trust Microsoft’s certification authority (CA) and thus any bootloader Microsoft has signed. - - They must allow the user to add signatures and hashes to the UEFI database. - - They must allow the user to completely disable Secure Boot (although administrators can restrict this). - This behavior doesn’t limit the choice of operating system. In fact, users typically have three options for running non-Microsoft operating systems: - - **Use an operating system with a Microsoft-signed bootloader.** Microsoft offers a service to sign non-Microsoft bootloaders so that they can be used on the device. In this case, a signature from the Microsoft third-party UEFI CA is used to sign the non-Microsoft bootloader, and the signature itself is added to the UEFI database. Several non-Microsoft operating systems, including several varieties of Linux, have had their bootloaders signed by Microsoft so that they can take advantage of the Secure Boot capability. For more information about the Microsoft third-party UEFI signing policy, read [Microsoft UEFI CA Signing policy updates](http://go.microsoft.com/fwlink/p/?LinkId=626936) and [Pre-submission testing for UEFI submissions](http://go.microsoft.com/fwlink/p/?LinkId=626937). - **Note**   PCs configured to use Device Guard boot only a secured version of Windows and do not permit a third-party bootloader. For more information, see the [Device Guard](#device-guard) section of this document. -   - - **Configure UEFI to trust a non–Microsoft-signed bootloader or hashes.** Some Certified For Windows 8 or later PCs allow users to add noncertified bootloaders through a signature or hashes sent to the UEFI database, which allows them to run any operating system without Microsoft signing it. - - **Turn off Secure Boot.**Windows 8 certified PCs allow users to turn off Secure Boot so they can run unsigned operating systems. In this mode, the behavior is identical to PCs that have BIOS: The PC simply runs the bootloader without any verification. Microsoft strongly recommends that Secure Boot remain enabled whenever the device starts so that it can help prevent bootkit infections. - **Note**   With Windows 10, original equipment manufacturers (OEMs) have the ability to ship built-to-order PCs that lock down UEFI Secure Boot so that it cannot be disabled and allows only the operating system of the customer’s choice to start on the device. -   - Windows, apps, and even malware cannot change the UEFI configuration. Instead, users must be physically present to manually boot a PC into a UEFI shell, and then change UEFI firmware settings. For more information about UEFI Secure Boot, read [Protecting the pre-OS environment with UEFI](http://go.microsoft.com/fwlink/p/?LinkId=626938). - **Virtualization-based security** - One of the most powerful changes to Windows 10 is virtual-based security. Virtual-based security (VBS) takes advantage of advances in PC virtualization to change the game when it comes to protecting system components from compromise. VBS is able to isolate some of the most sensitive security components of Windows 10. These security components aren’t just isolated through application programming interface (API) restrictions or a middle-layer: They actually run in a different virtual environment and are isolated from the Windows 10 operating system itself. - VBS and the isolation it provides is accomplished through the novel use of the Hyper V hypervisor. In this case, instead of running other operating systems on top of the hypervisor as virtual guests, the hypervisor supports running the VBS environment in parallel with Windows and enforces a tightly limited set of interactions and access between the environments. - Think of the VBS environment as a miniature operating system: It has its own kernel and processes. Unlike Windows, however, the VBS environment runs a micro-kernel and only two processes called trustlets: - - **Local Security Authority (LSA)** enforces Windows authentication and authorization policies. LSA is a well-known security component that has been part of Windows since 1993. Sensitive portions of LSA are isolated within the VBS environment and are protected by a new feature called Credential Guard. - - **Hypervisor-enforced code integrity** verifies the integrity of kernel-mode code prior to execution. This is a part of the [Device Guard](#device-guard) feature described later in this document. - VBS provides two major improvements in Windows 10 security: a new trust boundary between key Windows system components and a secure execution environment within which they run. A trust boundary between key Windows system components is enabled though the VBS environment’s use of platform virtualization to isolate the VBS environment from the Windows operating system. Running the VBS environment and Windows operating system as guests on top of Hyper-V and the processor’s virtualization extensions inherently prevents the guests from interacting with each other outside the limited and highly structured communication channels between the trustlets within the VBS environment and Windows operating system. - VBS acts as a secure execution environment because the architecture inherently prevents processes that run within the Windows environment – even those that have full system privileges – from accessing the kernel, trustlets, or any allocated memory within the VBS environment. In addition, the VBS environment uses TPM 2.0 to protect any data that is persisted to disk. Similarly, a user who has access to the physical disk is unable to access the data in an unencrypted form. - The VBS architecture is illustrated in Figure 2. - ![figure 2](images/security-fig2-vbsarchitecture.png) - Figure 2. The VBS architecture - Note that VBS requires a system that includes: - - Windows 10 Enterprise Edition - - A-64-bit processor - - UEFI with Secure Boot - - Second-Level Address Translation (SLAT) technologies (for example, Intel Extended Page Tables \[EPT\], AMD Rapid Virtualization Indexing \[RVI\]) - - Virtualization extensions (for example, Intel VT-x, AMD RVI) - - I/O memory management unit (IOMMU) chipset virtualization (Intel VT-d or AMD-Vi) - - TPM 2.0 - **Trusted Platform Module** - A TPM is a tamper-resistant cryptographic module designed to enhance the security and privacy of computing platforms. The TPM is incorporated as a component in a trusted computing platform like a personal computer, tablet, or phone. The computing platform is specially designed to work with the TPM to support privacy and security scenarios that cannot be achieved through software alone. A proper implementation of a TPM as part of a trusted computing platform provides a hardware root of trust, meaning that the hardware behaves in a trusted way. For example, a key created in a TPM with the property that it can never be exported from the TPM really means the key cannot leave the TPM. The close integration of a TPM with a platform increases the transparency of the boot process and supports device health scenarios by enabling reliable report of the software used to start a platform. - The functionality a TPM provides includes: - - **Cryptographic key management.** Create, store, and permit the use of keys in defined ways. - - **Safeguarding and reporting integrity measurements.** Software used to boot the platform can be recorded in the TPM and used to establish trust in the software running on the platform. - - **Prove a TPM is really a TPM.** The TPM’s capabilities are so central to protecting privacy and security that a TPM needs to be able to differentiate itself from malware that masquerades as a TPM. - Microsoft combined this small list of TPM benefits with Windows 10 and other hardware security technologies to provide practical security and privacy benefits. - Among other functions, Windows 10 uses the TPM to protect the encryption keys for BitLocker volumes, virtual smart cards, certificates, and the many other keys that the TPM is used to generate. Windows 10 also uses the TPM to securely record and protect integrity-related measurements of select hardware and Windows boot components for the [Measured Boot](#measure-boot) feature described later in this document. In this scenario, Measured Boot measures each component, from firmware up through the drivers, and then stores those measurements in the PC’s TPM. From there, you can test the measurement log remotely so that a separate system verifies the boot state of the Windows 10 PC. - Windows 10 supports TPM implementations that comply with either the 1.2 or 2.0 standards. Several improvements have been made in the TPM 2.0 standard, the most notable of which is cryptographic agility. TPM 1.2 is restricted to a fixed set of encryption and hash algorithms. At the time the TPM 1.2 standard was created in the early 2000s, these algorithms were considered cryptographically strong. Since that time, advances in cryptographic algorithms and cryptanalysis attacks have increased expectations for stronger cryptography. TPM 2.0 supports additional algorithms that offer stronger cryptographic protection as well as the ability to plug in algorithms that may be preferred in certain geographies or industries. It also opens the possibility for inclusion of future algorithms without changing the TPM component itself. - TPM is usually assumed to be implanted in hardware on a motherboard as a discrete module, but TPM can also be effective when implemented in firmware. Windows 10 supports both discrete and firmware TPM that complies with the 2.0 standard (1.2 can only be discrete). Windows does not differentiate between discrete and firmware-based solutions because they must meet the same requirements; therefore, any Windows feature that can take advantage of TPM can use either implementation. - **Note**   Microsoft will not initially require new Windows 10 PCs to include TPM support. Microsoft will require systems to include a TPM 2.0 beginning one year from the launch of Windows 10, however, to give manufacturers enough time to incorporate this critical functionality and to give IT pros enough time to determine which benefits they will leverage. -   - Several Windows 10 security features require TPM: - - Virtual smart cards - - Measured Boot - - Health attestation (requires TPM 2.0 or later) - - InstantGo (requires TPM 2.0 or later) - Other Windows 10 security features like BitLocker may take advantage of TPM if it is available but do not require it to work. An example of this is Microsoft Passport. - All of these features are covered in this document. - **Biometrics** - You read in the [Windows Hello](#windows-hello) section of this document that Windows 10 has built-in support for biometric hardware. Windows has included some amount of built-in biometric support since the Windows XP operating system, so what’s different about this in Windows 10? - Windows 10 makes biometrics a core security feature. Biometrics is fully integrated into the Windows 10 security components, not just tacked on as an extra part of a larger scheme. This is a big change. Earlier biometric implementations were largely front-end methods to simplify authentication. Under the hood, biometrics was used to access a password, which was then used for authentication behind the scenes. Biometrics may have provided convenience but not necessarily enterprise-grade authentication. - Microsoft has evangelized the importance of enterprise-grade biometric sensors to the OEMs that create Windows PCs and peripherals. Many OEMs already ship systems that have integrated fingerprint sensors and are transitioning from swipe-based to touch-based sensors. Facial-recognition sensors were already available when Windows 10 launched and are becoming more commonplace as integrated system components. - In the future, Microsoft expects OEMs to produce even more enterprise-grade biometric sensors and to continue to integrate them into systems as well as provide separate peripherals. As a result, biometrics will become a commonplace authentication method as part of an MFA system. - **Secure Windows startup** - UEFI Secure Boot uses hardware technologies to help protect users from bootkits. Secure Boot can validate the integrity of the devices, firmware, and bootloader. After the bootloader launches, users must rely on the operating system to protect the integrity of the remainder of the system. - **Trusted Boot** - When UEFI Secure Boot verifies that the bootloader is trusted and starts Windows, the Windows Trusted Boot feature protects the rest of the startup process by verifying that all Windows startup components are trustworthy (for example, signed by a trusted source) and have integrity. The bootloader verifies the digital signature of the Windows kernel before loading it. The Windows kernel, in turn, verifies every other component of the Windows startup process, including the boot drivers, startup files, and ELAM component. - If a file has been modified (for example, if malware has tampered with it or it has been corrupted), Trusted Boot will detect the problem and automatically repair the corrupted component. When repaired, Windows will start normally after only a brief delay. - **Early Launch Antimalware** - Malware that targeted previous versions of Windows often attempted to start before the antimalware solution. To do this, some types of malware would update or replace a non-Microsoft–related driver that starts during the Windows startup process. The malicious driver would then use its system access privileges to modify critical parts of the system and disguise its presence so it could not be detected when the antimalware solution later started. - Early Launch Antimalware (ELAM) is part of the Trusted Boot feature set and is designed to enable the antimalware solution to start before all non-Microsoft drivers and apps. ELAM checks the integrity of non-Microsoft drivers to determine whether the drivers are trustworthy. Because Windows needs to start as fast as possible, ELAM cannot be a complicated process of checking the driver files against known malware signatures; doing so would delay startup too much. Instead, ELAM has the simple task of examining every boot driver and determining whether it is on the list of trusted drivers. If malware modifies a boot-related driver, ELAM will detect the change, and Windows will prevent the driver from starting, thus blocking driver-based rootkits. ELAM also allows the registered antimalware provider to scan drivers that are loaded after the boot process is complete. - The design is simple but effective. ELAM is a component of a full-featured antimalware solution, and it helps prevent malicious drivers and apps from starting before the rest of the antimalware solution starts later during the boot process. Indeed, ELAM runs only for a few seconds each time a PC starts. Windows Defender in Windows 10 supports ELAM, as does Microsoft System Center 2012 Endpoint Protection and several non-Microsoft antimalware apps. - If you want to learn how to configure ELAM, you can use Group Policy settings to configure how ELAM responds to potentially malicious boot drivers. In the Group Policy Management Editor, go to Computer Configuration\\Administrative Templates\\System\\Early Launch Antimalware, and enable the **Boot-Start Driver Initialization Policy** setting. Now, you can select which driver classifications ELAM loads. When you select the **Good Only** setting, it provides the highest level of security, but test it thoroughly to ensure that it does not prevent users with healthy PCs from starting. - ### - **Measured Boot** - The biggest challenge with rootkits and bootkits in earlier versions of Windows is that they can frequently be undetectable to the client. Because they often start before Windows defenses and the antimalware solution and they have system-level privileges, rootkits and bootkits can completely disguise themselves while continuing to access system resources. Although UEFI Secure Boot and Trusted Boot can prevent most rootkits and bootkits, intruders could still potentially exploit a few attack vectors (for example, if UEFI with Secure Boot is disabled or if the signature used to sign a boot component, such as a non-Microsoft driver, has been compromised and is used to sign a malicious one). - Windows 10 implements the Measured Boot feature, which uses the TPM hardware component built into newer PCs to record a series of measurements for critical startup-related components, including firmware, Windows boot components, drivers, and even the ELAM driver. Because Measured Boot leverages the hardware-based security capabilities of TPM, which isolates and protects the measurement data from malware attacks, the log data is well protected against even sophisticated attacks. - Measured Boot focuses on acquiring the measurement data and protecting it from tampering. It must be coupled with a service that can analyze the data to determine device health and provide a more complete security service. The next section introduces just such a service. - **Verify device compliance for conditional access to corporate resources** - Measured Boot itself does not prevent malware from loading during the startup process – that is the job of Secure Boot, Device Guard, and ELAM. Instead, Measured Boot provides a TPM-protected audit log that allows a trusted remote health attestation service to evaluate the PC’s startup components, state, and overall configuration. If the health attestation service detects that the PC loaded an untrustworthy component and is therefore out of compliance, the service can block the PC’s access to specific network resources or the entire network. You can even couple a health attestation service with a management system to facilitate conditional access capabilities that can initiate the quarantine and remediation processes to fix an infected PC and return it to a compliant state. - ![figure 3](images/security-fig3-healthattestation.png) - Figure 3. Health Attestation in Windows 10 - Figure 3 illustrates the following process for device compliance verification and conditional access implementation: - 1. The PC uses the TPM to record measurements of the bootloader, boot drivers, and ELAM driver. The TPM prevents anyone from tampering with these measurements, so even if malware is successfully loaded, it will not be able to modify the measurements. These measurements are signed with an Attestation Identity Key (AIK) that is stored in the TPM. Because the TPM hardware has signed the measurements, malware cannot modify them without being detected. - 2. Health Attestation is not enabled by default and requires an enrollment with a mobile device management (MDM) server in order to enable it. If it is enabled, the health attestation client will contact a remote server, called a health attestation server. Microsoft provides a cloud-based Windows Health Attestation service that can help evaluate the health of a device. The health attestation client sends the signed measurements, the device’s TPM boot log, and an AIK certificate (if present), which lets the health attestation server verify that the key used to sign the measurements was issued to a trusted TPM. - 3. The health attestation server analyzes the measurements and boot log and creates a statement of device health. This statement is encrypted to help ensure the confidentiality of the data. - 4. A management system, such as an MDM server, can request that an enrolled device present a statement of device health. Windows 10 supports both Microsoft and non-Microsoft MDM server requests for device health. To prevent theft of device health statements and reuse from other devices, an MDM server sends the enrolled device a “number used only once” (nonce) request along with this request for the device health statement. - 5. The enrolled device digitally signs the nonce with its AIK (which is stored in the TPM) and sends the MDM server the encrypted statement of device health, the digitally signed nonce, and a signed boot counter, which asserts that the device has not been restarted since it obtained the statement of health. - 6. The MDM server can send the same data to the health attestation server. The server decrypts the statement of health, asserts that the boot counter in the statement matches the boot counter that was sent to the MDM server, and compiles a list of health attributes. - 7. The health attestation server sends this list of health attributes back to the MDM server. The MDM server now enforces access and compliance policies if configured to do so. - For a list of data points that the health attestation server verifies, along with a description of the data, see the [HealthAttestation CSP article on MSDN](http://go.microsoft.com/fwlink/p/?LinkId=626940). - The management system’s implementation determines which attributes within the statement of device health are evaluated when assessing a device’s health. Broadly speaking, the management server receives information about how the device booted, what kind of policy is enforced on the device, and how data on the device is secured. Depending on the implementation, the management server may add checks that go beyond what the statement of device health provides—for example, Windows patch level and other device attributes. - Based on these data points, the management server can determine whether the client is healthy and grant it access to either a limited quarantine network or to the full network. Individual network resources, such as servers, can also grant or deny access based on whether the remote attestation client were able to retrieve a valid health certification from the remote attestation server. - Because this solution can detect and prevent low-level malware that may be extremely difficult to detect any other way, Microsoft recommends that you consider the implementation of a management system, like Microsoft Intune, or any management solutions that take advantage of the Windows 10 cloud-based Health Attestation Server feature to detect and block devices that have been infected with advanced malware from network resources. - ## Secure the Windows core - - Applications built for Windows are designed to be secure and free of defects, but the reality is that as long as human beings are writing code, vulnerabilities will continue to crop up. When identified, malicious users and software may attempt to exploit vulnerabilities by manipulating data in memory in the hope that they can bootstrap a successful exploit. - To mitigate these risks, Windows 10 includes core improvements to make it more difficult for malware to perform buffer overflow, heap spraying, and other low-level attacks and even which code is allowed to run on the PC. In addition, these improvements dramatically reduce the likelihood that newly discovered vulnerabilities result in a successful exploit. It takes detailed knowledge of operating system architecture and malware exploit techniques to fully appreciate the impact of these improvements, but the sections that follow explain them at a high level. - ### - **Device Guard** - Today’s security threat landscape is more aggressive than ever before. Modern malicious attacks are focused on revenue generation, intellectual property theft, and targeted system degradation resulting in financial loss. Many of these nefarious attackers are sponsored by nation states that have ulterior motives and large cyber-terrorism budgets. These threats can enter a company through something as simple as an email and can permanently damage the organization’s reputation for securing employee and customer data and intellectual property, not to mention having a significant financial impact. The Windows 10 operating system introduces several new security features that help mitigate a large percentage of today’s known threats. - It is estimated that more than 300,000 new malware variants are discovered daily. Unfortunately, companies currently use an ancient method to discover this infectious software and prevent its use. In fact, current PCs trust everything that runs until antimalware signatures determine whether a threat exists; then, the antimalware software attempts to clean the PC, often after the malicious software’s effect has already occurred. This signature-based system focuses on reacting to an infection and then ensuring that that particular infection does not happen again. In this model, the system that drives malware detection relies on the discovery of malicious software; only then can a signature be provided to the client to remediate it, which implies that a computer has often already been infected. The time between detection of the malware and a client being issued a signature could mean the difference between losing data and staying safe. - In addition to antimalware solutions, “app control” or “whitelisting” technologies are available, including AppLocker. These perform single-instance or blanket allow or deny rules for running applications. In Windows 10, these types of solutions are most effective when deployed alongside the Windows 10 Device Guard feature. - Device Guard breaks the current model of detection first-block later and allows only trusted applications to run, period. This methodology is consistent with the successful prevention strategy for mobile phone security. With Device Guard, Microsoft has changed how the Windows operating system handles untrusted applications, which makes its defenses difficult for malware to penetrate. This new prevention versus detection model will provide Windows clients with the necessary security for modern threats and, when implemented, mitigates many of today’s threats from day one. - **Device Guard overview** - Device Guard is a feature set that consists of both hardware and software system integrity hardening features. These features revolutionize the Windows operating system’s security by taking advantage of new VBS options to protect the system core and the processes and drivers running in kernel mode—the trust-nothing model you see in mobile device operating systems. A key feature used with Device Guard is *configurable code integrity*, which allows your organization to choose exactly which software from trusted software publishers is allowed to run code on your client machines—exactly what has made mobile phone security on some platforms, such as Windows Mobile, so successful. Trusted applications are those signed directly (in other words, binaries) or indirectly by using a signed file that lists the hash values for application binaries that are considered trustworthy. In addition, Device Guard offers organizations a way to sign existing LOB applications so that they can trust their own code without the requirement that the application be rebuilt or packaged. Also, this same method of signing can provide organizations a way to trust non-Microsoft applications, including those that may not have been signed directly. Device Guard with configurable code integrity, Credential Guard, and AppLocker present the most complete security defense that any Microsoft product has ever been able to offer a Windows client. - Advanced hardware features such as CPU virtualization extensions, IOMMUs, and SLAT drive these new client security offerings. By integrating these hardware features further into the core operating system, Windows 10 can leverage them in new ways. For example, the same type 1 hypervisor technology that is used to run virtual machines in Hyper V isolates core Windows services into a virtualization-based, protected container. This is just one example of how Windows 10 integrates advanced hardware features deeper into the operating system to offer comprehensive modern security to its users. - To deliver this additional security, Device Guard has the following hardware and software requirements: - - UEFI Secure Boot (optionally with a non-Microsoft UEFI CA removed from the UEFI database) - - Virtualization support enabled by default in the system firmware (BIOS): - - Virtualization extensions (for example, Intel VT-x, AMD RVI) - - SLAT (for example, Intel EPT, AMD RVI) - - IOMMU (for example, Intel VT-d, AMD-Vi) - - UEFI BIOS configured to prevent an unauthorized user from disabling Device Guard–dependent hardware security features (for example, Secure Boot) - - Kernel mode drivers signed and compatible with hypervisor-enforced code integrity - - Windows 10 Enterprise only - - X64 version of Windows - Along with these new features, some components of Device Guard are existing tools or technologies that have been included in this strategic security offering to provide customers with the most secure Windows operating system possible. Device Guard is intended as a set of client security features to be used in conjunction with the other threat-resistance features available in the Windows operating system, some of which are mentioned in this guide. - **Configurable code integrity** - The Windows operating system consists of two operating modes: user mode and kernel mode. The base of the operating system runs within the kernel mode, which is where the Windows operating system directly interfaces with hardware resources. User mode is primarily responsible for running applications and brokering information to and from the kernel mode for hardware resource requests. For example, when an application running in user mode needs additional memory, the user mode process must request the resources from the kernel, not directly from RAM. - Code integrity is the component of the Windows operating system that verifies that the code Windows is running came from a trusted source and is tamper free. Like the operating system, Windows code integrity contains two primary components: kernel mode code integrity (KMCI) and user mode code integrity (UMCI). KMCI has been used in recent versions of the Windows operating system to protect the kernel mode from executing unsigned drivers. Although effective, drivers are not the only route that malware can take to penetrate the kernel mode space of the operating system. In Windows 10, however, Microsoft has raised the requirements for kernel mode code out of the box as well as provided enterprises with a way to set their own UMCI and KMCI policies. Starting with the Code Integrity service itself and continuing through the policies a Windows client uses to verify that an application should be allowed to run, Microsoft has made Windows 10 more secure than any previous Windows release. Historically, UMCI has been available only in Windows RT and on Windows Mobile devices, which has made it difficult to infect these devices with viruses and malware. These same successful UMCI policies are available in Windows 10Windows 10. - Historically, most malware has been unsigned. Simply by deploying code integrity policies, organizations will immediately protect themselves against unsigned malware, which is estimated to be responsible for the vast majority of current attacks. By using code integrity policies, an enterprise can also select exactly which binaries are allowed to run in both user mode and kernel mode based on the signer, binary hash, or both. When completely enforced, it makes user mode in Windows function like some mobile platforms, trusting and running only specific applications or specific signatures. This feature alone fundamentally changes security in an enterprise. This additional security is *not* limited to Windows apps and does *not* require an application rewrite to be compatible with your existing and possibly unsigned applications. You can run configurable code integrity independent of Device Guard, thus making it available to devices that don’t meet Device Guard hardware requirements. - **Hardware security features and VBS** - The core functionality and protection of Device Guard starts at the hardware level. Devices that have processors equipped with SLAT technologies and virtualization extensions, such as Intel VT x and AMD V, will be able to take advantage of a VBS environment that dramatically enhances Windows security by isolating critical Windows services from the operating system itself. This isolation is necessary, because you must assume that the operating system kernel will be compromised, and you need assurance that some processes will remain secure. - Device Guard leverages VBS to isolate its Hypervisor Code Integrity (HVCI) service, which enables Device Guard to protect all kernel mode processes and drivers from vulnerability exploits and zero days. HVCI uses the processor’s IOMMU functionality to force all software running in kernel mode to safely allocate memory. This means that after memory has been allocated, its state must be changed from writable to read only or execute only. By forcing memory into these states, it helps ensure that attacks are unable to inject malicious code into kernel mode processes and drivers through techniques such as buffer overruns or heap spraying. In the end, the VBS environment protects the Device Guard HVCI service from tampering even if the operating system’s kernel has been fully compromised, and HVCI protects kernel mode processes and drivers so that a compromise of this magnitude can’t happen in the first place. - Another Windows 10 feature that employs VBS is Credential Guard. Credential Guard protects credentials by running the Windows authentication service known as LSA, and then storing the user’s derived credentials (for example, NTLM hashes; Kerberos tickets) within the same VBS environment that Device Guard uses to protect its HVCI service. By isolating the LSA service and the user’s derived credentials from both user mode and kernel mode, an attacker that has compromised the operating system core will still be unable to tamper with authentication or access derived credential data. Credential Guard prevents pass-the-hash and ticket types of attacks, which are central to the success of nearly every major network breach you’ve read about, which makes Credential Guard one of the most impactful and important features to deploy within your environment. For more information about how Credential Guard complements Device Guard, see the [Device Guard with Credential Guard](#dgwithcg) section. - **Device Guard with AppLocker** - Although AppLocker is not considered a new Device Guard feature, you can use it to complement configurable code integrity functionality when enforced code integrity cannot be fully implemented or its functionality does not cover every desired scenario. There are many scenarios in which you could use code integrity policies alongside AppLocker rules. As a best practice, enforce code integrity policies at the most restrictive level possible for your organization, and then use AppLocker to fine-tune the restrictions to an even lower level. - **Note**   One example in which Device Guard functionality needs AppLocker supplementation is when your organization would like to limit which universal applications from the Windows Store users can install on a device. Microsoft has already validated universal applications from the Windows Store as trustworthy to run, but an organization may not want to allow specific universal applications to run in its environment. You could use an AppLocker rule to enforce such a stance. - In another example, you could enable a configurable code integrity policy to allow users to run all the apps from a specific publisher. To do so, you would add the publisher’s signature to the policy. If your organization decides that only specific apps from that publisher should be allowed to run, you would add the signature for the publisher to the configurable code integrity policy, and then use AppLocker to determine which specific apps can run. -   - AppLocker and Device Guard can run side-by-side in your organization, which offers the best of both security features at the same time and provides the most comprehensive security to as many devices as possible. In addition to these features, Microsoft recommends that you continue to maintain an enterprise antivirus solution for a well-rounded enterprise security portfolio. - ### - **Device Guard with Credential Guard** - Although Credential Guard isn’t a feature within Device Guard, many organizations will likely deploy Credential Guard alongside Device Guard for additional protection against derived credential theft. Similar to virtualization-based protection of kernel mode through the Device Guard HVCI service, Credential Guard leverages hypervisor technology to protect the Windows authentication service (the LSA) and users’ derived credentials. This mitigation is targeted at preventing the use of pass-the-hash and pass-the-ticket techniques. - Because Credential Guard uses VBS, it is decisive in its ability to prevent pass-the-hash and pass-the-ticket attacks from occurring on Windows 10 devices. Microsoft recognizes, however, that most organizations will have a blend of Windows versions running in their environments. Mitigations for devices not capable of running Credential Guard on both the client side and the server side are available to help with this scenario. Microsoft will be releasing details to TechNet regarding these additional mitigations in the near future. - **Unified manageability through Device Guard** - You can easily manage Device Guard features through the familiar enterprise and client-management tools that IT pros use every day. Use the following management tools to enable and manage Device Guard: - - **Group Policy.**Windows 10 provides an administrative template that you can use to configure and deploy the configurable code integrity policies for your organization. This template also allows you to specify which hardware-based security features you would like to enable and deploy. You can manage these settings with your existing Group Policy objects, which makes it simple to implement Device Guard features. In addition to the code integrity and hardware-based security features, Group Policy can help you manage your catalog files. - - **System Center Configuration Manager.** Use System Center Configuration Manager to simplify deployment and management of catalog files, code integrity policies, and hardware-based security features as well as to provide version control. - - **MDM systems.** Organizations will be able to use Microsoft Intune and non-Microsoft MDM systems for deployment and management of code integrity policies and catalog files. - - **Windows PowerShell.** You use Windows PowerShell primarily to create and service code integrity policies. These policies represent the most impactful component of Device Guard. - These options provide the same experience you’re used to for management of your existing enterprise management solutions. - **Address Space Layout Randomization** - One of the most common techniques used to gain access to a system is to find a vulnerability in a privileged process that is already running, guess or find a location in memory where important system code and data have been placed, and then overwrite that information with a malicious payload. In the early days of operating systems, any malware that could write directly to the system memory could do such a thing; the malware would simply overwrite system memory in well-known and predictable locations. - Address Space Layout Randomization (ASLR) makes that type of attack much more difficult because it randomizes how and where important data is stored in memory. With ASLR, it is more difficult for malware to find the specific location it needs to attack. Figure 4 illustrates how ASLR works by showing how the locations of different critical Windows components can change in memory between restarts. - ![image 4](images/security-fig4-aslr.png) - Figure 4. ASLR at work - Although the ASLR implementation in Windows 7 was effective, it wasn’t applied holistically across the operating system, and the level of entropy (cryptographic randomization) wasn’t always at the highest possible level. To decrease the likelihood that sophisticated attacks such as heap spraying could succeed in the Windows 8 operating system, Microsoft applied ASLR holistically across the system and increased the level of entropy many times. - The ASLR implementation in Windows 8 and Windows 10 is greatly improved over Windows 7, especially with 64-bit system and application processes that can take advantage of a vastly increased memory space, which makes it even more difficult for malware to predict where Windows 10 stores vital data. When used on systems that have TPMs, ASLR memory randomization will be increasingly unique across devices, which makes it even more difficult for a successful exploit that works on one system to work reliably on another. - **Data Execution Prevention** - Malware depends on its ability to put a malicious payload into memory with the hope that it will be executed later, and ASLR will make that much more difficult. Wouldn’t it be great if you could prevent malware from running if it wrote to an area that has been allocated solely for the storage of information? - Data Execution Prevention (DEP) does exactly that, by substantially reducing the range of memory that malicious code can use for its benefit. DEP uses the No eXecute bit on modern CPUs to mark blocks of memory as read-only so that those blocks can’t be used to execute malicious code that may be inserted within through a vulnerability exploit. - Because of the importance of DEP, users cannot install Windows 10 on a computer that does not have DEP capability. Fortunately, most processors released since the mid-2000s support DEP. - If you want to see which apps use DEP, complete these steps: - 1. Open Task Manager: Press Ctrl+Alt+Esc or by searching the Start screen. - 2. Click **More Details** (if necessary), and then click the **Details** tab. - 3. Right-click any column heading, and then click **Select Columns**. - 4. In the **Select Columns** dialog box, select the last **Data Execution Prevention** check box. - 5. Click **OK**. - You can now see which processes have DEP enabled. Figure 5 shows the processes running on a Windows 10 PC with a single process that does not support DEP. - ![figure 5](images/security-fig5-dep.png) - Figure 5. Processes on which DEP has been enabled in Windows 10 - **Windows Heap** - The *heap* is a location in memory that Windows uses to store dynamic application data. Windows 10 continues to improve on earlier Windows heap designs by further mitigating the risk of heap exploits that could be used as part of an attack. - Windows 10 has several important improvements to the security of the heap over Windows 7: - - Internal data structures that the heap uses are now better protected against memory corruption. - - Heap memory allocations now have randomized locations and sizes, which makes it more difficult for an attacker to predict the location of critical memory to overwrite. Specifically, Windows 10 adds a random offset to the address of a newly allocated heap, which makes the allocation much less predictable. - - Windows 10 uses “guard pages” before and after blocks of memory as tripwires. If an attacker attempts to write past a block of memory (a common technique known as a buffer overflow), the attacker will have to overwrite a guard page. Any attempt to modify a guard page is considered a memory corruption, and Windows 10 responds by instantly terminating the app. - Windows 10 resolves known heap attacks that could be used to compromise a PC running previous versions of Windows. - **Memory reservations** - The lowest 64 KB of process memory is reserved for the system. Apps are no longer allowed to allocate that portion of the memory, which makes it more difficult for malware to overwrite critical system data structures in memory. - **Control Flow Guard** - When applications are loaded into memory, they are allocated space based on the size of the code, requested memory, and other factors. When an application begins to execute code, it calls additional code located in other memory addresses. The relationships between the code locations are well known—they are written in the code itself—but previous to Windows 10, the flow between these locations was not enforced, which gives attackers the opportunity to change the flow to meet their needs. In other words, an application exploit takes advantage of this behavior by running code that the application may not typically run. - This kind of threat is mitigated in Windows 10 through the Control Flow Guard (CFG) feature. When a trusted application that was compiled to use CFG calls code, CFG verifies that the code location called is trusted for execution. If the location is not trusted, the application is immediately terminated as a potential security risk. - An administrator cannot configure CFG; rather, an application developer can take advantage of CFG by configuring it when the application is compiled. Administrators should consider asking application developers and software vendors to deliver trustworthy Windows applications compiled with CFG enabled. Of course, browsers are a key entry point for attacks; thus Microsoft Edge, IE, and other Windows features take full advantage of CFG. - **Protected Processes** - Benjamin Franklin once said that "an ounce of prevention is worth a pound of cure." His wisdom directly applies to PC security. Most security controls are designed to prevent the initial infection point. The reasoning is that if malware cannot infect the system, the system is immune to malware. - No computer is immune to malware, however. Despite all the best preventative controls, malware can eventually find a way to infect any operating system or hardware platform. So, although prevention with a defense-in-depth strategy is important, it cannot be the only type of malware control. - The key security scenario is to assume that malware is running on a system but limit what it can do. Windows 10 has security controls and design features in place to reduce compromise from existing malware infections. Protected Processes is one such feature. - With Protected Processes, Windows 10 prevents untrusted processes from interacting or tampering with those that have been specially signed. Protected Processes defines levels of trust for processes. Less trusted processes are prevented from interacting with and therefore attacking more trusted processes. Windows 10 uses Protected Processes more broadly across the operating system, and for the first time, you can put antimalware solutions into the protected process space, which helps make the system and antimalware solutions less susceptible to tampering by malware that does manage to get on the system. - ## Secure the Windows desktop - - Windows 10 includes critical improvements to the Windows core and the desktop environment, where attacks and malware most frequently enter. The desktop environment is now more resistant to malware thanks to significant improvements to Windows Defender and SmartScreen Filters. Internet browsing is a safer experience because of Microsoft Edge, a completely new browser. The Windows Store reduces the likelihood that malware will infect devices by ensuring that all applications that enter the Windows Store ecosystem have been thoroughly reviewed before being made available. Universal Windows applications are inherently more secure than typical applications because they are sandboxed. Sandboxing restricts the application’s risk of being compromised or tampered with in a way that would put the system, data, and other applications at risk. - The sections that follow describe Windows 10 improvements to application security in more detail. - **Microsoft Edge and Internet Explorer 11** - Browser security is a critical component of any security strategy, and for good reason: The browser is the user’s interface to the Internet, an environment that is quite literally overwhelmed with malicious sites and content waiting to attack. Most users cannot perform at least part of their job without a browser, and many users are completely reliant on one. This reality has made the browser the number one pathway from which malicious hackers initiate their attacks. - All browsers enable some amount of extensibility to do things beyond the original scope of the browser. Two common examples of this are Flash and Java extensions that enable their respective applications to run inside a browser. Keeping Windows 10 secure for web browsing and applications, especially for these two content types, is a priority. - Microsoft includes an entirely new browser, Microsoft Edge, in Windows 10. Microsoft Edge is more secure in several ways, especially: - - **Microsoft Edge does not support non-Microsoft binary extensions.** Microsoft Edge supports Flash content and PDF viewing by default through built-in extensions but no other binary extensions, including ActiveX controls and Java. - - **Microsoft Edge runs 64-bit processes.** A 64-bit PC running an older version of Windows often runs in 32-bit compatibility mode to support older and less secure extensions. When Microsoft Edge runs on a 64-bit PC, it runs only 64-bit processes, which are much more secure when vulnerabilities are discovered and attempts are made to exploit them. - - **Microsoft Edge is designed as a Universal Windows app.** It is inherently compartmentalized and runs in an AppContainer that sandboxes the browser from the system, data, and other apps. IE11 on Windows 10 can also take advantage of the same AppContainer technology through Enhanced Protect Mode. However, because it can run ActiveX and BHOs, the browser and sandbox are susceptible to a much broader range of attacks than Microsoft Edge. - - **Microsoft Edge simplifies security configuration tasks.** Because Microsoft Edge uses a simplified application structure and a single sandbox configuration, there are fewer required security settings. In addition, Microsoft created Microsoft Edge default settings that align with security best practices, which makes it secure by default. - In addition to Microsoft Edge, Microsoft includes IE11 in Windows 10 primarily for backwards-compatibility with websites and binary extensions that do not work with Microsoft Edge. It should not be configured as the primary browser but rather as an optional or automatic switchover, as shown in Figure 6. - ![figure 6](images/security-fig6-edge2.png) - Figure 6. Configure Windows 10 to switch from Microsoft Edge to IE11 for backwards-compatibility. - Microsoft’s recommendation is to use Microsoft Edge as the primary web browser because it provides compatibility with the modern web and the best possible security. For sites that require IE11 compatibility, including those that require binary extensions and plug ins, enable Enterprise mode and use the Enterprise Mode Site List to define which sites have the dependency. When configured, when users use Microsoft Edge and it identifies a site that requires IE11, they will automatically be switched to IE11. - **The SmartScreen Filter** - Recent versions of Windows have many effective techniques to prevent malware from installing itself without the user’s knowledge. To work around those restrictions, malware attacks often use social engineering techniques to trick users into running software. For example, malware known as a Trojan horse pretends to be something useful, such as a utility, but carries an additional, malicious payload. - Starting with Windows Internet Explorer 8, the SmartScreen Filter has helped protect users from both malicious applications and nefarious websites by using the SmartScreen Filter’s application and URL reputation services. The SmartScreen Filter in Internet Explorer would check URLs and newly downloaded apps against an online reputation service that Microsoft maintained. If the app or URL were not known to be safe, SmartScreen Filter would warn the user or even prevent the app or URL from loading, depending on how systems administrators had configured Group Policy settings. - For Windows 10, Microsoft further developed the SmartScreen Filter by integrating its app reputation abilities into the operating system itself, which allows the filter to protect users regardless of the web browser they are using or the path that the app uses to arrive on the device (for example, email, USB flash drive). The first time a user runs an app that originates from the Internet, even if the user copied it from another PC, the SmartScreen Filter checks the reputation of the application by using digital signatures and other factors against a service that Microsoft maintains. If the app lacks a reputation or is known to be malicious, the SmartScreen Filter warns the user or blocks execution entirely, depending on how the administrator has configured Group Policy (see Figure 7). - ![figure 7](images/security-fig7-smartscreenfilter.png) - Figure 7. The SmartScreen Filter at work in Windows 10 - By default, users have the option to bypass SmartScreen Filter protection so that it will not prevent a user from running a legitimate app. You can use Control Panel or Group Policy settings to disable the SmartScreen Filter or to completely prevent users from running apps that the SmartScreen Filter does not recognize. The Control Panel settings are shown in Figure 8. - ![figure 8](images/security-fig8-smartscreenconfig.png) - Figure 8. The Windows SmartScreen configuration options in Control Panel - If you want to try the SmartScreen Filter, use Windows 7 to download this simulated (but not dangerous) malware file:[freevideo.exe](http://go.microsoft.com/fwlink/p/?LinkId=626943). Save it to your computer, and then run it from Windows Explorer. As shown in Figure 9, Windows runs the app without much warning. In Windows 7, you might receive a warning message about the app not having a certificate, but you can easily bypass it. - ![figure 9](images/security-fig9-windows7allow.png) - Figure 9. Windows 7 allows the app to run - Now, repeat the test on a computer running Windows 10 by copying the file to a Windows 10 PC or by downloading the file again and saving it to your local computer. Run the file directly from File Explorer, and the SmartScreen Filter will warn you before it allows it to run. Microsoft’s data shows that for a vast majority of users, that extra warning is enough to save them from a malware infection. - **Universal Windows apps** - The good news is that the download and use of Universal Windows apps or even Windows Classic applications (Win32) from the Windows Store will dramatically reduce the likelihood that you encounter malware on your PC because all apps go through a careful screening process before being made available in the store. Apps that organizations build and distribute through sideloading processes will need to be reviewed internally to ensure that they meet organizational security requirements. - Regardless of how users acquire Universal Windows apps, they can use them with increased confidence. Unlike Windows Classic applications, which can run with elevated privileges and have potentially sweeping access to the system and data, Universal Windows apps run in an AppContainer sandbox with limited privileges and capabilities. For example, Universal Windows apps have no system-level access, have tightly controlled interactions with other apps, and have no access to data unless the user explicitly grants the application permission. - In addition, all Universal Windows apps follow the security principle of least privilege. Apps receive only the minimum privileges they need to perform their legitimate tasks, so even if an attacker exploits an app, the damage the exploit can do is severely limited and should be contained within the sandbox. The Windows Store displays the exact capabilities the app requires (for example, access to the camera), along with the app’s age rating and publisher. - In the end, the Windows Store app distribution process and the app sandboxing capabilities of Windows 10 will dramatically reduce the likelihood that users encounter malicious apps on the system. - **Windows Defender** - Antimalware software, also generically called virus scanners, antivirus, and a host of other names, has been around for a long time. Microsoft shipped its first program in this category, Microsoft Anti-Virus, in 1993 for MS DOS 6.0. At the time, the approach of running a standalone MS DOS program to locate and remove viruses was sufficient. - Times change and technology progresses, and antimalware software has also evolved. It is crucial to have multilayered defense with interoperability when you manage modern threats. Windows Defender uses the operating system extensively to achieve interoperability across the varying layers of defense. It is important to have an effective antimalware solution in place as an important obstacle between malware and enterprise assets, and it complements features like Device Guard. For example, an antimalware solution could help detect malicious behavior in memory or even within trusted applications, an area that Device Guard is not designed to address. - Windows Defender has evolved to meet the growing complexity of IT and the challenges that come with this complexity. Windows included Windows Defender, a robust inbox antimalware solution, starting with Windows 8. Now, with Windows 10, Microsoft has significantly improved Windows Defender. - Windows Defender in Windows 10 uses a four-pronged approach to improve antimalware: rich local context, extensive global sensors, tamper proofing, and the empowerment of IT security professionals. This section explains each prong. - **Rich, local context** improves how malware is identified. Windows 10 informs Windows Defender not only about content like files and processes but also where the content came from, where it has been stored, and more. The information about source and history enables Windows Defender to apply different levels of scrutiny to different content. - For example, an application downloaded from the Internet would be more heavily scrutinized than an application installed from a trusted server. Windows 10 persists the history of the Internet-sourced application at the operating system level so that the app cannot erase its own tracks. The history is tracked and stored by the Persisted Store, a new feature in Windows 10 that securely manages the rich local context and prevents unauthorized modification or deletion. The rich local context improvements also help prevent malware from using tactics such as obfuscation as a means to evade detection. - Local context also extends to how antimalware software exposes interfaces. Windows Defender implements the Antimalware Scan Interface (AMSI), a generic public interface standard that allows applications and services to request Windows Defender to scan and analyze obfuscated code before execution. AMSI is available for any application and antimalware solution to implement. In Windows 10, AMSI is accessible through Windows PowerShell, the Windows Script Host, JavaScript, and Microsoft JScript. - In Windows 10, Microsoft implemented a new technology that allows Windows Defender to work closely with User Account Control (UAC) requests. When the UAC system is triggered, it requests a scan from Windows Defender before it prompts for elevation. Windows Defender scans the file or process and determines whether it's malicious. If it’s malicious, the user will see a message that explains that Windows Defender blocked the file or process from executing; if it's not malicious, then UAC will run and display the usual elevation request prompt. - **Extensive global sensors** help keep Windows Defender current and aware of even the newest malware. This is accomplished in two ways: by collecting the rich local context data from end points and by centrally analyzing that data. The goal is to identify new, emerging malware and block it in the first critical hours of its lifetime to limit exposure to the broader PC ecosystem. - With Windows Defender in Windows 8, Microsoft first introduced Windows Defender Cloud Protection, which helps to better react in the quickly evolving malware landscape. The goal is to block malware the "first time it’s seen" in the first critical hours of a malware attack. - To help preserve the privacy of customers, Microsoft allows customers to opt in or out of the system. To participate, you simply opt into the program. To opt in for Windows 10, click **Settings**, click **Update & Security**, and then click **Windows Defender**. The opt-in choices are shown in Figure 10. - ![figure 10](images/security-fig10-optinsettings.png) - Figure 10. Windows Defender opt-in settings in Windows 10 - Of course, system administrators have centralized control of all Windows Defender settings through Group Policy. The Windows Defender configuration settings are shown under Computer Configuration/Windows Components/Windows Defender, as shown in Figure 11. - ![figure 11](images/security-fig11-defendersettings.png) - Figure 11. Windows Defender settings in Group Policy– the sample submission options are listed under MAPS - **Tamper proofing** is the safeguarding of Windows Defender itself against malware attacks. Malware creators assume that antimalware software is implemented on most PCs. Many malware creators choose to overcome that obstacle by designing malware that modifies the antimalware software in some way, such as disabling real-time scanning or by hiding specific processes. Some malware goes as far as completely disabling the antimalware software while making it appear fully functional to the user. - Windows Defender is designed to resist tampering; it uses several security technologies available in Windows 10, the primary of which is Protected Processes, which prevents untrusted processes from attempting to tamper with Windows Defender components, its registry keys, and so on. Tamper proofing in Windows Defender is also the indirect result of system-wide security components, including UEFI with Secure Boot and ELAM. These components help provide a more secure environment in which Windows Defender can launch in before it begins to defend itself. - **Empowerment of IT security professionals** means that Windows Defender gives IT pros the tools and configuration options necessary to make it an enterprise-class antimalware solution. It has numerous enterprise-level features that put it on par with the top products in this category: - - Integration with centralized management software, including Microsoft Intune, System Center Configuration Manager, and Microsoft System Center Operations Manager. Unlike Windows 8.1, no additional client is necessary, because Windows Defender is now integrated into Windows and only a management layer needs to be added. - - Windows Defender supports the Open Mobile Alliance Device Management standard for centralized management by many non-Microsoft device management solutions. - - It includes integrated classic command-line and Windows PowerShell cmdlet support. - - Support for Windows Management Instrumentation reporting and application management is built in. - - Full integration with Group Policy offers complete IT configuration management. - In addition, Windows Defender now integrates the Windows Defender Offline Tool, which formerly required the creation of a bootable, standalone version of Windows Defender into the Windows Recovery Environment. This simplifies the process of remediating low-level malware infections, which may prove difficult to detect and remove with the antimalware solution running on the Windows desktop. You can update signatures for this environment automatically from within the Windows Defender Offline experience. - Beyond Windows Defender, Windows 10 provides deep operating system access for antimalware products. Non-Microsoft antimalware vendors can take advantage of Microsoft’s new APIs and interfaces to gain unprecedented access to Windows 10 resources for malware detection and removal. Non-Microsoft antimalware solutions can implement ELAM drivers, which scan Windows 10 while it’s in its initial startup process. The broad set of new low-level interfaces lets non-Microsoft antimalware solutions perform advanced malware detection in a way that enables them to retain application compatibility even when Microsoft makes significant changes to Windows internals, such as are often made between major operating system versions. - This access presents a security challenge, however: How does Windows 10 grant antimalware software generous access while ensuring that malware doesn’t take advantage of the very same access? Microsoft has been hard at work with several non-Microsoft software vendors to meet this challenge. If a third party wants this level of access, it must meet certain criteria and vetting requirements, and then Microsoft must digitally sign its software. This allows Microsoft to verify the authenticity of the software vendors and prevent nefarious individuals from creating their own self-signed fake malware scanners. - To be clear, Microsoft is not restricting the antimalware vendors or their innovations. Nor is Microsoft changing software distribution channels. When Microsoft has signed the antimalware application, you can deploy and install it through any means. Microsoft is basically ensuring that these software developers are authentic, industry-recognized entities before signing their antimalware software and, in doing so, granting extended privileges to it. - Another security threat that customers face particularly in consumer and bring your own device (BYOD) scenarios is a disabled or outdated antimalware product. A BYOD computer that has an installed but ineffective antimalware product can be more dangerous than no product at all, because it gives the illusion of security. Windows Defender in Windows 10 mitigates this threat by helping ensure that either Windows Defender or the customer’s preferred non-Microsoft solution is running and in a healthy state. - Whenever non-Microsoft real-time protection is in an inoperable state (for example, disabled, expired) for 24 hours, Windows Defender automatically turns on to ensure that the device is protected. Windows attempts to help the user remediate the issue with the non-Microsoft antimalware solution by notifying him or her as early as 5 days before the software expires. If the solution expires, Windows enables Windows Defender and continues to remind the user to renew the non-Microsoft solution. When the user updates or reactivates the solution, Windows Defender is automatically disabled. In the end, the goal is to make sure that an operable antimalware solution is running at all times. - ## Conclusion - - Windows 10 is the culmination of many years of effort from Microsoft, and its impact from a security perspective will be significant. Many of us still remember the years of Windows XP, when the attacks on the Windows operating system, applications, and data increased in volume and matured into serious threats. With the existing platforms and security solutions that you’ve likely deployed, you’re better defended than ever. But as attackers have become more advanced, there is no doubt that they have exceeded your ability to defend your organization and users. Evidence of this fact can be found in the news virtually every day as yet another major organization falls victim. Microsoft specifically designed Windows 10 to address these modern threats and tactics from the most advanced adversaries. It can truly change the game for your organization, and it can restore your advantage against those would like to make you their next victim. - ## Related topics - - [Windows 10 Specifications](http://go.microsoft.com/fwlink/p/?LinkId=625077 ) - [HealthAttestation CSP](http://go.microsoft.com/fwlink/p/?LinkId=626940 ) - [Making Windows 10 More Personal and More Secure with Windows Hello](http://go.microsoft.com/fwlink/p/?LinkId=626945) - [Protect BitLocker from pre-boot attacks](protect-bitlocker-from-pre-boot-attacks.md) -   -   - - - - - diff --git a/windows/keep-secure/windows-defender-in-windows-10.md b/windows/keep-secure/windows-defender-in-windows-10.md index 585300bcd8..e2f59150de 100644 --- a/windows/keep-secure/windows-defender-in-windows-10.md +++ b/windows/keep-secure/windows-defender-in-windows-10.md @@ -2,62 +2,39 @@ title: Windows Defender in Windows 10 (Windows 10) description: This topic provides an overview of Windows Defender, including a list of system requirements and new features. ms.assetid: 6A9EB85E-1F3A-40AC-9A47-F44C4A2B55E2 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library author: jasesso --- - # Windows Defender in Windows 10 - - **Applies to** - - Windows 10 - Windows Defender in Windows 10 is a built-in antimalware solution that provides security and antimalware management for desktops, portable computers, and servers. - This topic provides an overview of Windows Defender, including a list of system requirements and new features. - For more important information about running Windows Defender on a server platform, see [Windows Defender Overview for Windows Server Technical Preview](https://technet.microsoft.com/library/dn765478.aspx). - Take advantage of Windows Defender by configuring the settings and definitions using the following tools: - - Microsoft Active Directory *Group Policy* for settings - Windows Server Update Services (WSUS) for definitions - Windows Defender provides the most protection when cloud-based protection is enabled. Learn how to enable cloud-based protection in [Configure Windows Defender in Windows 10](configure-windows-defender-in-windows-10.md). - **Note**  System Center 2012 R2 Configuration Manager SP1, System Center 2012 Configuration Manager SP2, and Microsoft Intune can provide centralized management of Windows Defender, including: - Settings management - Definition update management - Alerts and alert management - Reports and report management - When you enable endpoint protection for your clients, it will install an additional management layer on Windows Defender to manage the in-box Windows Defender agent. While the client user interface will still appear as Windows Defender, the management layer for Endpoint Protection will be listed in the **Add/Remove Programs** control panel, though it will appear as if the full product is installed. -   - ### Minimum system requirements - Windows Defender has the same hardware requirements as Windows 10. For more information, see: - - [Minimum hardware requirements](https://msdn.microsoft.com/library/windows/hardware/dn915086.aspx) - [Hardware component guidelines](https://msdn.microsoft.com/library/windows/hardware/dn915049.aspx) - ### New and changed functionality - - **Improved detection for unwanted applications and emerging threats using cloud-based protection.** Use the Microsoft Active Protection Service to improve protection against unwanted applications and advanced persistent threats in your enterprise. - - **Windows 10 integration.** All Windows Defender in Windows 10 endpoints will show the Windows Defender user interface, even when the endpoint is managed. - - **Operating system, enterprise-level management, and bring your own device (BYOD) integration.** Windows 10 introduces a mobile device management (MDM) interface for devices running Windows 10. Administrators can use MDM-capable products, such as Intune, to manage Windows Defender on Windows 10 devices. - For more information about what's new in Windows Defender in Windows 10, see [Windows Defender in Windows 10: System integration](https://www.microsoft.com/security/portal/enterprise/threatreports_august_2015.aspx) on the Microsoft Active Protection Service website. - ## In this section - - @@ -89,14 +66,6 @@ For more information about what's new in Windows Defender in Windows 10, see [W
    -   -   -   - - - - - diff --git a/windows/keep-secure/windows-installer-rules-in-applocker.md b/windows/keep-secure/windows-installer-rules-in-applocker.md index 5bab8afeaf..05f9214263 100644 --- a/windows/keep-secure/windows-installer-rules-in-applocker.md +++ b/windows/keep-secure/windows-installer-rules-in-applocker.md @@ -2,31 +2,21 @@ title: Windows Installer rules in AppLocker (Windows 10) description: This topic describes the file formats and available default rules for the Windows Installer rule collection. ms.assetid: 3fecde5b-88b3-4040-81fa-a2d36d052ec9 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Windows Installer rules in AppLocker - - **Applies to** - - Windows 10 - This topic describes the file formats and available default rules for the Windows Installer rule collection. - AppLocker defines Windows Installer rules to include only the following file formats: - - .msi - - .msp - - .mst - The purpose of this collection is to allow you to control the installation of files on client computers and servers through Group Policy or the Local Security Policy snap-in. The following table lists the default rules that are available for the Windows Installer rule collection. - @@ -63,19 +53,8 @@ The purpose of this collection is to allow you to control the installation of fi
    -   - ## Related topics - - [Understanding AppLocker default rules](understanding-applocker-default-rules.md) -   -   - - - - - diff --git a/windows/keep-secure/working-with-applocker-policies.md b/windows/keep-secure/working-with-applocker-policies.md index 815ea0211f..af1edcf35e 100644 --- a/windows/keep-secure/working-with-applocker-policies.md +++ b/windows/keep-secure/working-with-applocker-policies.md @@ -2,24 +2,17 @@ title: Working with AppLocker policies (Windows 10) description: This topic for IT professionals provides links to procedural topics about creating, maintaining, and testing AppLocker policies. ms.assetid: 7062d2e0-9cbb-4cb8-aa8c-b24945c3771d +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Working with AppLocker policies - - **Applies to** - - Windows 10 - This topic for IT professionals provides links to procedural topics about creating, maintaining, and testing AppLocker policies. - ## In this section - - @@ -86,14 +79,6 @@ This topic for IT professionals provides links to procedural topics about creati
    -   -   -   - - - - - diff --git a/windows/keep-secure/working-with-applocker-rules.md b/windows/keep-secure/working-with-applocker-rules.md index 5fad689a53..9ee115544d 100644 --- a/windows/keep-secure/working-with-applocker-rules.md +++ b/windows/keep-secure/working-with-applocker-rules.md @@ -2,24 +2,17 @@ title: Working with AppLocker rules (Windows 10) description: This topic for IT professionals describes AppLocker rule types and how to work with them for your application control policies. ms.assetid: 3966b35b-f2da-4371-8b5f-aec031db6bc9 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- - # Working with AppLocker rules - - **Applies to** - - Windows 10 - This topic for IT professionals describes AppLocker rule types and how to work with them for your application control policies. - ## In this section - - @@ -78,11 +71,8 @@ This topic for IT professionals describes AppLocker rule types and how to work w
    -   - The three AppLocker enforcement modes are described in the following table. The enforcement mode setting defined here can be overwritten by the setting derived from a linked Group Policy Object (GPO) with a higher precedence. - @@ -109,16 +99,10 @@ The three AppLocker enforcement modes are described in the following table. The
    -   - When AppLocker policies from various GPOs are merged, the rules from all the GPOs are merged and the enforcement mode setting of the winning GPO is applied. - ## Rule collections - - The AppLocker console is organized into rule collections, which are executable files, scripts, Windows Installer files, packaged apps and packaged app installers, and DLL files. These collections give you an easy way to differentiate the rules for different types of apps. The following table lists the file formats that are included in each rule collection. - @@ -161,60 +145,34 @@ The AppLocker console is organized into rule collections, which are executable f
    -   - **Important**   If you use DLL rules, you need to create an allow rule for each DLL that is used by all of the allowed apps. - When DLL rules are used, AppLocker must check each DLL that an application loads. Therefore, users may experience a reduction in performance if DLL rules are used. - The DLL rule collection is not enabled by default. To learn how to enable the DLL rule collection, see [DLL rule collections](#bkmk-dllrulecollections). -   - ## Rule conditions - - Rule conditions are criteria that help AppLocker identify the apps to which the rule applies. The three primary rule conditions are publisher, path, and file hash. - - [Publisher](#bkmk-publisher): Identifies an app based on its digital signature - - [Path](#bkmk-path): Identifies an app by its location in the file system of the computer or on the network - - [File hash](#bkmk-filehash): Represents the system computed cryptographic hash of the identified file - ### Publisher - This condition identifies an app based on its digital signature and extended attributes when available. The digital signature contains info about the company that created the app (the publisher). Executable files, dlls, Windows installers, packaged apps and packaged app installers also have extended attributes, which are obtained from the binary resource. In case of executable files, dlls and Windows installers, these attributes contain the name of the product that the file is a part of, the original name of the file as supplied by the publisher, and the version number of the file. In case of packaged apps and packaged app installers, these extended attributes contain the name and the version of the app package. - **Note**   Rules created in the packaged apps and packaged app installers rule collection can only have publisher conditions since Windows does not support unsigned packaged apps and packaged app installers. -   - **Note**   Use a publisher rule condition when possible because they can survive app updates as well as a change in the location of files. -   - When you select a reference file for a publisher condition, the wizard creates a rule that specifies the publisher, product, file name, and version number. You can make the rule more generic by moving the slider up or by using a wildcard character (\*) in the product, file name, or version number fields. - **Note**   To enter custom values for any of the fields of a publisher rule condition in the Create Rules Wizard, you must select the **Use custom values** check box. When this check box is selected, you cannot use the slider. -   - The **File version** and **Package version** control whether a user can run a specific version, earlier versions, or later versions of the app. You can choose a version number and then configure the following options: - - **Exactly.** The rule applies only to this version of the app - - **And above.** The rule applies to this version and all later versions. - - **And below.** The rule applies to this version and all earlier versions. - The following table describes how a publisher condition is applied. - @@ -264,17 +222,11 @@ The following table describes how a publisher condition is applied.
    -   - ### Path - This rule condition identifies an application by its location in the file system of the computer or on the network. - AppLocker uses custom path variables for well-known paths, such as Program Files and Windows. - The following table details these path variables. - @@ -322,148 +274,72 @@ The following table details these path variables.
    -   - **Important**   Because a path rule condition can be configured to include a large number of folders and files, path conditions should be carefully planned. For example, if an allow rule with a path condition includes a folder location that non-administrators are allowed to write data into, a user can copy unapproved files into that location and run the files. For this reason, it is a best practice to not create path conditions for standard user writable locations, such as a user profile. -   - ### File hash - When you choose the file hash rule condition, the system computes a cryptographic hash of the identified file. The advantage of this rule condition is that because each file has a unique hash, a file hash rule condition applies to only one file. The disadvantage is that each time the file is updated (such as a security update or upgrade) the file's hash will change. As a result, you must manually update file hash rules. - ## AppLocker default rules - - AppLocker allows you to generate default rules for each rule collection. - Executable default rule types include: - - Allow members of the local **Administrators** group to run all apps. - - Allow members of the **Everyone** group to run apps that are located in the Windows folder. - - Allow members of the **Everyone** group to run apps that are located in the Program Files folder. - Script default rule types include: - - Allow members of the local **Administrators** group to run all scripts. - - Allow members of the **Everyone** group to run scripts that are located in the Program Files folder. - - Allow members of the **Everyone** group to run scripts that are located in the Windows folder. - Windows Installer default rule types include: - - Allow members of the local **Administrators** group to run all Windows Installer files. - - Allow members of the **Everyone** group to run all digitally signed Windows Installer files. - - Allow members of the **Everyone** group to run all Windows Installer files that are located in the Windows\\Installer folder. - DLL default rule types: - - Allow members of the local **Administrators** group to run all DLLs. - - Allow members of the **Everyone** group to run DLLs that are located in the Program Files folder. - - Allow members of the **Everyone** group to run DLLs that are located in the Windows folder. - Packaged apps default rule types: - - Allow members of the **Everyone** group to install and run all signed packaged apps and packaged app installers. - ## AppLocker rule behavior - - If no AppLocker rules for a specific rule collection exist, all files with that file format are allowed to run. However, when an AppLocker rule for a specific rule collection is created, only the files explicitly allowed in a rule are permitted to run. For example, if you create an executable rule that allows .exe files in *%SystemDrive%\\FilePath* to run, only executable files located in that path are allowed to run. - A rule can be configured to use allow or deny actions: - - **Allow.** You can specify which files are allowed to run in your environment, and for which users or groups of users. You can also configure exceptions to identify files that are excluded from the rule. - - **Deny.** You can specify which files are *not* allowed to run in your environment, and for which users or groups of users. You can also configure exceptions to identify files that are excluded from the rule. - **Important**   For a best practice, use allow actions with exceptions. You can use a combination of allow and deny actions but understand that deny actions override allow actions in all cases, and can be circumvented. -   - **Important**   If you join a computer running at least Windows Server 2012 or Windows 8 to a domain that already enforces AppLocker rules for executable files, users will not be able to run any packaged apps unless you also create rules for packaged apps. If you want to allow any packaged apps in your environment while continuing to control executable files, you should create the default rules for packaged apps and set the enforcement mode to Audit-only for the packaged apps rule collection. -   - ## Rule exceptions - - You can apply AppLocker rules to individual users or to a group of users. If you apply a rule to a group of users, all users in that group are affected by that rule. If you need to allow a subset of a user group to use an app, you can create a special rule for that subset. For example, the rule "Allow everyone to run Windows except Registry Editor" allows everyone in the organization to run the Windows operating system, but it does not allow anyone to run Registry Editor. - The effect of this rule would prevent users such as Help Desk personnel from running a program that is necessary for their support tasks. To resolve this problem, create a second rule that applies to the Help Desk user group: "Allow Help Desk to run Registry Editor." If you create a deny rule that does not allow any users to run Registry Editor, the deny rule will override the second rule that allows the Help Desk user group to run Registry Editor. - ## DLL rule collection - - Because the DLL rule collection is not enabled by default, you must perform the following procedure before you can create and enforce DLL rules. - Membership in the local **Administrators** group, or equivalent, is the minimum required to complete this procedure. - **To enable the DLL rule collection** - 1. Click **Start**, type **secpol.msc**, and then press ENTER. - 2. If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. - 3. In the console tree, double-click **Application Control Policies**, right-click **AppLocker**, and then click **Properties**. - 4. Click the **Advanced** tab, select the **Enable the DLL rule collection** check box, and then click **OK**. - **Important**   Before you enforce DLL rules, make sure that there are allow rules for each DLL that is used by any of the allowed apps. -   - ## AppLocker wizards - - You can create rules by using two AppLocker wizards: - 1. The Create Rules Wizard enables you to create one rule at a time. - 2. The Automatically Generate Rules Wizard allows you to create multiple rules at one time. You can either select a folder and let the wizard create rules for the relevant files within that folder or in case of packaged apps let the wizard create rules for all packaged apps installed on the computer. You can also specify the user or group to which to apply the rules. This wizard automatically generates allow rules only. - ## Additional considerations - - - By default, AppLocker rules do not allow users to open or run any files that are not specifically allowed. Administrators should maintain an up-to-date list of allowed applications. - - There are two types of AppLocker conditions that do not persist following an update of an app: - - **A file hash condition** File hash rule conditions can be used with any app because a cryptographic hash value of the app is generated at the time the rule is created. However, the hash value is specific to that exact version of the app. If there are several versions of the application in use within the organization, you need to create file hash conditions for each version in use and for any new versions that are released. - - **A publisher condition with a specific product version set** If you create a publisher rule condition that uses the **Exactly** version option, the rule cannot persist if a new version of the app is installed. A new publisher condition must be created, or the version must be edited in the rule to be made less specific. - - If an app is not digitally signed, you cannot use a publisher rule condition for that app. - - AppLocker rules cannot be used to manage computers running a Windows operating system earlier than Windows Server 2008 R2 or Windows 7. Software Restriction Policies must be used instead. If AppLocker rules are defined in a Group Policy Object (GPO), only those rules are applied. To ensure interoperability between Software Restriction Policies rules and AppLocker rules, define Software Restriction Policies rules and AppLocker rules in different GPOs. - - The packaged apps and packaged apps installer rule collection is available on devices running at least Windows Server 2012 and Windows 8. - - When the rules for the executable rule collection are enforced and the packaged apps and packaged app installers rule collection does not contain any rules, no packaged apps and packaged app installers are allowed to run. In order to allow any packaged apps and packaged app installers, you must create rules for the packaged apps and packaged app installers rule collection. - - When an AppLocker rule collection is set to **Audit only**, the rules are not enforced. When a user runs an application that is included in the rule, the app is opened and runs normally, and information about that app is added to the AppLocker event log. - - A custom configured URL can be included in the message that is displayed when an app is blocked. - - Expect an increase in the number of Help Desk calls initially because of blocked apps until users understand that they cannot run apps that are not allowed. -   -   - - - - - diff --git a/windows/manage/application-development-for-windows-as-a-service.md b/windows/manage/application-development-for-windows-as-a-service.md index bc011ba032..1e068642c7 100644 --- a/windows/manage/application-development-for-windows-as-a-service.md +++ b/windows/manage/application-development-for-windows-as-a-service.md @@ -2,159 +2,95 @@ title: Application development for Windows as a service (Windows 10) description: In today’s environment, where user expectations frequently are set by device-centric experiences, complete product cycles need to be measured in months, not years. ms.assetid: 28E0D103-B0EE-4B14-8680-6F30BD373ACF +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library author: jdeckerMS --- - # Application development for Windows as a service - - **Applies to** - - Windows 10 - Windows 10 Mobile - Windows 10 IoT Core (IoT Core) - In today’s environment, where user expectations frequently are set by device-centric experiences, complete product cycles need to be measured in months, not years. Additionally, new releases must be made available on a continual basis, and must be deployable with minimal impact on users. Microsoft designed Windows 10 to meet these requirements by implementing a new approach to innovation, development, and delivery called [Windows as a service (WaaS)](introduction-to-windows-10-servicing.md). The key to enabling significantly shorter product cycles while maintaining high quality levels is an innovative community-centric approach to testing that Microsoft has implemented for Windows 10. The community, known as Windows Insiders, is comprised of millions of users around the world. When Windows Insiders opt in to the community, they test many builds over the course of a product cycle and provide feedback to Microsoft through an iterative methodology called flighting. - Builds distributed as flights provide the Windows engineering team with significant data regarding how well builds are performing in actual use. Flighting with Windows Insiders also enables Microsoft to test builds in much more diverse hardware, application, and networking environments than in the past, and to identify issues far more quickly. As a result, Microsoft believes that community-focused flighting will enable both a faster pace of innovation delivery and better public release quality than ever. - ## Windows 10 release types and cadences - - Although Microsoft releases flight builds to Windows Insiders, Microsoft will publish two types of Windows 10 releases broadly to the public on an ongoing basis: - **Feature updates** install the latest new features, experiences, and capabilities on devices that are already running Windows 10. Because feature updates contain an entire copy of Windows, they are also what customers use to install Windows 10 on existing devices running Windows 7 or Windows 8.1, and on new devices where no operating system is installed. Microsoft expects to publish an average of one to two new feature updates per year. - **Quality updates** deliver security issue resolutions and other important bug fixes. Quality updates will be provided to improve each feature currently in support, on a cadence of one or more times per month. Microsoft will continue publishing quality updates on Update Tuesday (sometimes referred to as Patch Tuesday). Additionally, Microsoft may publish additional quality updates for Windows 10 outside the Update Tuesday process when required to address customer needs. - During Windows 10 development, Microsoft streamlined the Windows product engineering and release cycle so that we can deliver the features, experiences, and functionality customers want, more quickly than ever. We also created new ways to deliver and install feature updates and quality updates that simplify deployments and on-going management, broaden the base of employees who can be kept current with the latest Windows capabilities and experiences, and lower total cost of ownership. Hence we have implemented new servicing options – referred to as Current Branch (CB), Current Branch for Business (CBB), and Long-Term Servicing Branch (LTSB) – that provide pragmatic solutions to keep more devices more current in enterprise environments than was previously possible. - The following table shows describes the various servicing branches and their key attributes. - | Servicing option | Availability of new feature upgrades for installation | Minimum length of servicing lifetime | Key benefits | Supported editions | |-----------------------------------|-----------------------------------------------------------|--------------------------------------|-------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------| | Current Branch (CB) | Immediately after first published by Microsoft | Approximately 4 months | Makes new features available to users as soon as possible | Home, Pro, Education, Enterprise, Mobile, IoT Core, Windows 10 IoT Core Pro (IoT Core Pro) | | Current Branch for Business (CBB) | Approximately 4 months after first published by Microsoft | Approximately 8 months | Provides additional time to test new feature upgrades before deployment | Pro, Education, Enterprise, Mobile Enterprise, IoT Core Pro | | Long-Term Servicing Branch (LTSB) | Immediately after published by Microsoft | 10 Years | Enables long-term deployment of selected Windows 10 releases in low-change configurations | Enterprise LTSB | -   - For more information, see [Windows 10 servicing options for updates and upgrades](introduction-to-windows-10-servicing.md). - ## Supporting apps in Windows as a service - - The traditional approach for supporting apps has been to release a new app version in response to a Windows release. This assumes that there are breaking changes in the underlying OS that could potentially cause a regression with the application. This model involves a dedicated development and validation cycle that requires our ISV partners to align with the Windows release cadence. - In the Windows as a service model, Microsoft is making a commitment to maintaining the compatibility of the underlying OS. This means Microsoft will make a concerted effort to ensure that there are no breaking changes that impact the app ecosystem negatively. In this scenario, when there is a release of a Windows build, most apps (those with no kernel dependencies) will continue to work. - In view of this change, Microsoft recommends that our ISV partners decouple their app release and support from specific Windows builds. Our mutual customers are better served by an application lifecycle approach. This means when an application version is released it will be supported for a certain period of time irrespective of however many Windows builds are released in the interim. The ISV makes a commitment to provide support for that specific version of the app as long as it is supported in the lifecycle. Microsoft follows a similar lifecycle approach for Windows that can be referenced [here](http://go.microsoft.com/fwlink/?LinkID=780549). - This approach will reduce the burden of maintaining an app schedule that aligns with Windows releases. ISV partners should be free to release features or updates at their own cadence. We feel that our partners can keep their customer base updated with the latest app updates independent of a Windows release. In addition, our customers do not have to seek an explicit support statement whenever a Windows build is released. Here is an example of a support statement that covers how an app may be supported across different versions of the OS: - | Example of an application lifecycle support statement | |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Contoso is a software development company and is the owner of the popular Mojave app which has a major share in the enterprise space. Contoso releases its next major release Mojave 14.0 and declares mainstream support for a period of three years from the release date. During mainstream support all updates and support are complimentary for the licensed product. Contoso also declares an additional two years of extended support where customers can purchase updates and support for a grace period. Beyond the extended support end date this product version is no longer supported. During the period of mainstream support Contoso will support Mojave 14.0 on all released builds of Windows. Contoso will also release updates to Mojave as necessary and independent of the Windows product releases. | -   - In the following sections, you will find additional information about the steps Microsoft takes to maintain the compatibility of the underlying OS. You will also find guidance on steps you can take to help maintain the compatibility of the combined OS and app ecosystem. There is a section on how to leverage Windows flighting builds to detect app regressions before a Windows build is released. Lastly, we describe how we use an instrumentation and telemetry-driven approach to increase the quality of Windows builds. We recommend ISVs adopt a similar approach with their app portfolio. - ## Key changes since Windows 7 to ensure app compatibility - - We understand that compatibility matters to developers. ISVs and developers want to ensure their apps will run as expected on all supported versions of the Windows OS. Consumers and businesses have a key investment here—they want to ensure that the apps they have paid for will continue to work. We know that compatibility is the primary criteria for purchase decisions. Apps that are well written based on best practices will lead to much less code churn when a new Windows version is released and will reduce fragmentation—these apps have a reduced engineering investment to maintain, and a faster time to market. - In the Windows 7 timeframe, compatibility was very much a reactive approach. In Windows 8 we started looking at this differently, working within Windows to ensure that compatibility was by design rather than an afterthought. Windows 10 is the most compatible-by-design version of the OS to date. Here are some key ways we accomplished this: - - **App telemetry**: This helps us understand app popularity in the Windows ecosystem to inform compatibility testing. - **ISV partnerships**: Work directly with external partners to provide them with data and help fix issues that our users experience. - **Design reviews, upstream detection**: Partner with feature teams to reduce the number of breaking changes in Windows. Compatibility review is a gate that our feature teams must pass. - **Communication**: Tighter control over API changes and improved communication. - **Flighting and feedback loop**: Windows insiders receive flighted builds that help improve our ability to find compatibility issues before a final build is released to customers. This feedback process not only exposes bugs, but ensures we are shipping features our users want. - ## Microsoft uses data to make Windows 10 better - - Microsoft uses diagnostic and usage data to identify and troubleshoot problems, improve our products and services, and provide our users with personalized experiences. The usage data we collect also extends to the apps that PCs in the Windows ecosystem are running. Based on what our customers use, we build our list to test these apps, devices, and drivers against new versions of the Windows OS. Windows 10 has been the most compatible version of Windows to-date, with over 90% compatibility against thousands of popular apps. The Windows Compatibility team commonly reaches out to our ISV partners to provide feedback if issues are discovered, so that we can partner together on solutions. Ideally, we’d like our common customers to be able to update Windows seamlessly and without losing functionality in either their OS or the apps they depend on for their productivity or entertainment. - The following sections contain some best practices Microsoft recommends so you can ensure your apps are compatible with Windows 10. - **Windows version check** - The OS version has been incremented with Windows 10. This means that the internal version number has been changed to 10.0. As in the past, we go to great lengths to maintain application and device compatibility after an OS version change. For most app categories (without any kernel dependencies) the change will not negatively impact app functionality, and existing apps will continue to work fine on Windows 10. - The manifestation of this change is app-specific. This means any app that specifically checks for the OS version will get a higher version number, which can lead to one or more of the following situations: - - App installers might not be able to install the app, and apps might not be able to start. - Apps might become unstable or crash. - Apps might generate error messages, but continue to function properly. - Some apps perform a version check and simply pass a warning to users. However, there are apps that are bound very tightly to a version check (in the drivers, or in kernel mode to avoid detection). In these cases, the app will fail if an incorrect version is found. Rather than a version check, we recommend one of the following approaches: - - If the app is dependent on specific API functionality, ensure you target the correct API version. - Ensure you detect the change via APISet or another public API, and do not use the version as a proxy for some feature or fix. If there are breaking changes and a proper check is not exposed, then that is a bug. - Ensure the app does NOT check for version in odd ways, such as via the registry, file versions, offsets, kernel mode, drivers, or other means. If the app absolutely needs to check the version, use the GetVersion APIs, which should return the major, minor, and build number. - If you are using the [GetVersion](http://go.microsoft.com/fwlink/?LinkID=780555) API, remember that the behavior of this API has changed since Windows 8.1. - If you own apps such as antimalware or firewall apps, you should work through your usual feedback channels and via the Windows Insider program. - **Undocumented APIs** - Your apps should not call undocumented Windows APIs, or take dependency on specific Windows file exports or registry keys. This can lead to broken functionality, data loss, and potential security issues. If there is functionality your app requires that is not available, this is an opportunity to provide feedback through your usual feedback channels and via the Windows Insider program. - **Develop Universal Windows Platform (UWP) and Centennial apps** - We encourage all Win32 app ISVs to develop [Universal Windows Platform (UWP)](http://go.microsoft.com/fwlink/?LinkID=780560) and, specifically, [Centennial](http://go.microsoft.com/fwlink/?LinkID=780562) apps moving forward. There are great benefits to developing these app packages rather than using traditional Win32 installers. UWP apps are also supported in the [Windows Store](http://go.microsoft.com/fwlink/?LinkID=780563), so it’s easier for you to update your users to a consistent version automatically, lowering your support costs. - If your Win32 app types do not work with the Centennial model, we highly recommend that you use the right installer and ensure this is fully tested. An installer is your user or customer’s first experience with your app, so ensure that this works well. All too often, this doesn’t work well or it hasn’t been fully tested for all scenarios. The [Windows App Certification Kit](http://go.microsoft.com/fwlink/?LinkID=780565) can help you test the install and uninstall of your Win32 app and help you identify use of undocumented APIs, as well as other basic performance-related best-practice issues, before your users do. - **Best pratcices:** - - Use installers that work for both 32-bit and 64-bit versions of Windows. - Design your installers to run on multiple scenarios (user or machine level). - Keep all Windows redistributables in the original packaging – if you repackage these, it’s possible that this will break the installer. - Schedule development time for your installers—these are often overlooked as a deliverable during the software development lifecycle. - ## Optimized test strategies and flighting - - Windows OS flighting refers to the interim builds available to Windows Insiders before a final build is released to the general population. The more Insiders that flight these interim builds, the more feedback we receive on the build quality, compatibility, etc., and this helps improve quality of the final builds. You can participate in this flighting program to ensure that your apps work as expected on iterative builds of the OS. We also encourage you to provide feedback on how these flighted builds are working for you, issues you run into, and so on. - If your app is in the Store, you can flight your app via the Store, which means that your app will be available for our Windows Insider population to install. Users can install your app and you can receive preliminary feedback on your app before you release it to the general population. The follow sections outline the steps for testing your apps against Windows flighted builds. - **Step 1: Become a Windows Insider and participate in flighting** - As a [Windows Insider,](http://go.microsoft.com/fwlink/p/?LinkId=521639) you can help shape the future of Windows—your feedback will help us improve features and functionality in the platform. This is a vibrant community where you can connect with other enthusiasts, join forums, trade advice, and learn about upcoming Insider-only events. - Since you’ll have access to preview builds of Windows 10, Windows 10 Mobile, and the latest Windows SDK and Emulator, you’ll have all the tools at your disposal to develop great apps and explore what's new in the Universal Windows Platform and the Windows Store. - This is also a great opportunity to build great hardware, with preview builds of the hardware development kits so you can develop universal drivers for Windows. The IoT Core Insider Preview is also available on supported IoT development boards, so you can build amazing connected solutions using the Universal Windows Platform. - Before you become a Windows Insider, please note that participation is intended for users who: - - Want to try out software that’s still in development. - Want to share feedback about the software and the platform. - Don’t mind lots of updates or a UI design that might change significantly over time. - Really know their way around a PC and feel comfortable troubleshooting problems, backing up data, formatting a hard drive, installing an operating system from scratch, or restoring an old one if necessary. - Know what an ISO file is and how to use it. - Aren't installing it on their everyday computer or device. - **Step 2: Test your scenarios** - Once you have updated to a flighted build, the following are some sample test cases to help you get started on testing and gathering feedback. For most of these tests, ensure you cover both x86 and AMD64 systems. - **Clean install test:** On a clean install of Windows 10, ensure your app is fully functional. If your app fails this test and the upgrade test, then it’s likely that the issue is caused by underlying OS changes or bugs in the app. If after investigation, the former is the case, be sure to use the Windows Insider program to provide feedback and partner on solutions. - **Upgrade Test:** Check that your app works after upgrading from a down-level version of Windows (i.e. Windows 7 or Windows 8.1) to Windows 10. Your app shouldn’t cause roll backs during upgrade, and should continue to work as expected after upgrade—this is crucial to achieve a seamless upgrade experience. - **Reinstall Test:** Ensure that app functionality can be restored by reinstalling your app after you upgrade the PC to Windows 10 from a down-level OS. If your app didn’t pass the upgrade test and you have not been able to narrow down the cause of these issues, it’s possible that a reinstall can restore lost functionality. A passing reinstall test indicates that parts of the app may not have been migrated to Windows 10. - **OS\\Device Features Test:** Ensure that your app works as expected if your app relies on specific functionality in the OS. Common areas for testing include the following, often against a selection of the commonly used PC models to ensure coverage: - - Audio - USB device functionality (keyboard, mouse, memory stick, external hard disk, and so on) - Bluetooth @@ -165,25 +101,11 @@ Once you have updated to a flighted build, the following are some sample test ca - Print\\Scan - Sensors (accelerometer, fusion, and so on) - Camera - **Step 3: Provide feedback** - Let us know how your app is performing against flighted builds. As you discover issues with your app during testing, please log bugs via the partner portal if you have access, or through your Microsoft representative. We encourage this information so that we can build a quality experience for our users together. - **Step 4: Register on Windows 10** - The [Ready for Windows 10](http://go.microsoft.com/fwlink/?LinkID=780580) website is a directory of software that supports Windows 10. It’s intended for IT administrators at companies and organizations worldwide that are considering Windows 10 for their deployments. IT administrators can check the site to see whether software deployed in their enterprise is supported in Windows 10. - ## Related topics - - [Windows 10 servicing options for updates and upgrades](introduction-to-windows-10-servicing.md) -   -   - - - - - diff --git a/windows/manage/index.md b/windows/manage/index.md index 35e01bcb09..fff9fb7281 100644 --- a/windows/manage/index.md +++ b/windows/manage/index.md @@ -2,23 +2,17 @@ title: Manage and update Windows 10 (Windows 10) description: Learn about managing and updating Windows 10. ms.assetid: E5716355-02AB-4B75-A962-14B1A7F7BDA0 +ms.pagetype: security keywords: ["Windows 10", "MDM", "WSUS", "Windows update"] ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library author: jdeckerMS --- - # Manage and update Windows 10 - - Learn about managing and updating Windows 10. - ## In this section - - - @@ -72,19 +66,8 @@ Learn about managing and updating Windows 10.
    Topic
    -   - ## Related topics - - [Windows 10 and Windows 10 Mobile](../index.md) -   -   - - - - - diff --git a/windows/manage/introduction-to-windows-10-servicing.md b/windows/manage/introduction-to-windows-10-servicing.md index a473efd209..a22f5bb81f 100644 --- a/windows/manage/introduction-to-windows-10-servicing.md +++ b/windows/manage/introduction-to-windows-10-servicing.md @@ -2,290 +2,152 @@ title: Windows 10 servicing options for updates and upgrades (Windows 10) description: This article describes the new servicing options available in Windows 10. ms.assetid: D1DEB7C0-283F-4D7F-9A11-EE16CB242B42 +ms.pagetype: security keywords: ["update", "LTSB", "lifecycle", "Windows update", "upgrade"] ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library author: jdeckerMS --- - # Windows 10 servicing options for updates and upgrades - - **Applies to** - - Windows 10 - Windows 10 Mobile - Windows 10 IoT Core (IoT Core) - This article describes the new servicing options available in Windows 10, Windows 10 Mobile, and IoT Core and how they enable enterprises to keep their devices current with the latest feature upgrades. It also covers related topics, such as how enterprises can make better use of Windows Update, and what the new servicing options mean for support lifecycles. - **Note**   Several of the figures in this article show multiple feature upgrades of Windows being released by Microsoft over time. Be aware that these figures were created with dates that were chosen for illustrative clarity, not for release roadmap accuracy, and should not be used for planning purposes. -   - ## Introduction - - In enterprise IT environments, the desire to provide users with the latest technologies needs to be balanced with the need for manageability and cost control. In the past, many enterprises managed their Windows deployments homogeneously and performed large-scale upgrades to new releases of Windows (often in parallel with large-scale hardware upgrades) about every three to six years. Today, the rapid evolution of Windows as a platform for device-like experiences is causing businesses to rethink their upgrade strategies. Especially with the release of Windows 10, there are good business reasons to keep a significant portion of your enterprise's devices *current* with the latest release of Windows. For example, during the development of Windows 10, Microsoft: - - Streamlined the Windows product engineering and release cycle so that Microsoft can deliver the features, experiences, and functionality customers want, more quickly than ever. - - Created new ways to deliver and install feature upgrades and servicing updates that simplify deployments and on-going management, broaden the base of employees who can be kept current with the latest Windows capabilities and experiences, and lower total cost of ownership. - - Implemented new servicing options – referred to as Current Branch (CB), Current Branch for Business (CBB), and Long-Term Servicing Branch (LTSB) – that provide pragmatic solutions to keep more devices more current in enterprise environments than was previously possible. - The remainder of this article provides additional information about each of these areas. This article also provides an overview of the planning implications of the three Windows 10 servicing options (summarized in Table 1) so that IT administrators can be well-grounded conceptually before they start a Windows 10 deployment project. - Table 1. Windows 10 servicing options - | Servicing option | Availability of new feature upgrades for installation | Minimum length of servicing lifetime | Key benefits | Supported editions | |-----------------------------------|-----------------------------------------------------------|--------------------------------------|-------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------| | Current Branch (CB) | Immediately after first published by Microsoft | Approximately 4 months | Makes new features available to users as soon as possible | Home, Pro, Education, Enterprise, Mobile, IoT Core, Windows 10 IoT Core Pro (IoT Core Pro) | | Current Branch for Business (CBB) | Approximately 4 months after first published by Microsoft | Approximately 8 months | Provides additional time to test new feature upgrades before deployment | Pro, Education, Enterprise, Mobile Enterprise, IoT Core Pro | | Long-Term Servicing Branch (LTSB) | Immediately after published by Microsoft | 10 Years | Enables long-term deployment of selected Windows 10 releases in low-change configurations | Enterprise LTSB | -   - ## Streamlined product development and release cycles - - **Product cycles and builds** - The Windows engineering team adds new features and functionality to Windows through *product cycles* comprised of development, testing, and release phases. Each day during a product cycle, the team compiles the source code for Windows and assembles the output into a *build* that users can install on their devices. The first recipients of builds are Microsoft employees who begin what Microsoft calls *selfhost* testing. - **Testing and release prior to Windows 10** - Prior to Windows 10, Microsoft issued and extensively tested many builds internally before selecting one for testing outside Microsoft. After repeating the external test cycle several times against builds of progressively better quality, the engineering team selected a build to enter the release phase. At the end of this phase, the team published the build as a new version of Windows – an event referred to as the *Release to Manufacturing* (RTM) milestone. In total, product cycles took between one and three years to complete, with testing and release processes taking up as much as half of the total investment in time. - **A different approach for Windows 10** - In today’s environment, where user expectations frequently are set by device-centric experiences, complete product cycles need to be measured in months, not years. Additionally, new releases must be made available on a continual basis, and must be deployable with minimal impact on users. Microsoft designed Windows 10 to meet these requirements by implementing a new approach to innovation development and delivery called *Windows as a Service* (WaaS). - The key to enabling significantly shorter product cycles while maintaining high quality levels is an innovative community-centric approach to testing that Microsoft has implemented for Windows 10. The community, known as Windows Insiders, is comprised of millions of users around the world. When Windows Insiders opt in to the community, they test many builds over the course of a product cycle, and provide feedback to Microsoft through an iterative methodology called *flighting*. - Builds distributed as *flights* provide the Windows engineering team with significant data regarding how well builds are performing in actual use. Flighting with Windows Insiders also enables Microsoft to test builds in much more diverse hardware, application, and networking environments than in the past, and to identify issues far more quickly. As a result, Microsoft believes that community-focused flighting will enable both a faster pace of innovation delivery, and better public release quality than ever. - **Windows 10 release types and cadences** - Although Microsoft releases flight builds to Windows Insiders, Microsoft will publish two types of Windows 10 releases broadly to the public on an ongoing basis: - - **Feature upgrades** that install the latest new features, experiences, and capabilities on devices that are already running Windows 10. Because feature upgrades contain an entire copy of Windows, they are also what customers use to install Windows 10 on existing devices running Windows 7 or Windows 8.1, and on new devices where no operating system is installed. - - **Servicing updates** that focus on the installation of security fixes and other important updates. - Microsoft expects to publish an average of two to three new feature upgrades per year, and to publish servicing updates as needed for any feature upgrades that are still in support. Microsoft will continue publishing servicing updates on Update Tuesday (sometimes referred to as Patch Tuesday). Additionally, Microsoft may publish additional servicing updates for Windows 10 outside the Update Tuesday process when required to address customer needs. - **The cumulative nature of all Windows 10 releases** - It is important to note that, in order to improve release quality and simplify deployments, all new releases that Microsoft publishes for Windows 10 will be *cumulative*. This means new feature upgrades and servicing updates will contain the *payloads* of all previous releases (in an optimized form to reduce storage and networking requirements), and installing the release on a device will bring it completely up to date. Also, unlike earlier versions of Windows, you cannot install a subset of the contents of a Windows 10 servicing update. For example, if a servicing update contains fixes for three security vulnerabilities and one reliability issue, deploying the update will result in the installation of all four fixes.   - ## New Windows 10 delivery and installation alternatives - - As with earlier releases of Windows, Windows 10 includes support for the deployment of new releases using Windows Update, Windows Server Update Services, System Center Configuration Manager, and third-party configuration management tools. Because of the importance of the Windows as a Service (WaaS) approach to delivering innovations to businesses, and the proven ability of Windows Update to deploy releases quickly and seamlessly to consumers and small businesses, several of the largest investments in Windows 10 focus on enabling broader use of Windows Update within enterprises. - **Windows Update use by consumers and small businesses** - Since Microsoft introduced the first generation of Windows Update with Windows 95, Windows Update has evolved to become the standard way for consumers and small businesses to help keep devices running Windows secure and running reliably. Almost one billion Windows devices communicate with the Windows Update service on a regular basis. The process of downloading and installing updates has evolved to be less and less obtrusive to users. More recently, Microsoft also has used Windows Update to deliver larger, feature-centric updates, such as the upgrade from Windows 8 to Windows 8.1, and is using Windows Update to upgrade devices running Windows 7 and Windows 8.1 to Windows 10. - **Windows Update use within enterprises** - Although Windows Update greatly simplifies and accelerates update deployment, enterprises are not using Windows Update as broadly as consumers and small businesses. This is largely because Windows Update maintains control over which updates are installed and the timing of installation. This makes it difficult for IT administrators to test updates before deployment in their specific environment. - **The role of Windows Server Update Services** - To help address the concerns of IT administrators, Microsoft released Windows Server Update Services in 2005. Windows Server Update Services enables IT administrators to obtain the updates that Windows Update determines are applicable to the devices in their enterprise, perform additional testing and evaluation on the updates, and select the updates they want to install. Windows Server Update Services also provides IT administrators with an all or nothing way to specify when they want an approved update to be installed. Because IT administrators ultimately select and install most updates identified by Windows Update, the role of Windows Server Update Services in many enterprises is to provide IT administrators with the additional time they need to gain confidence in the quality of updates prior to deployment. - **New Windows Update capabilities in Windows 10** - To enable enterprises to manage more of their devices using Windows Update directly, Windows 10 provides IT administrators with a way to configure devices so that Windows Update will defer new feature upgrade installations until approximately four months after Microsoft first publishes them. The additional time can be used to perform testing or enable releases to gain additional time in market prior to deployment. - At the end of each approximately four month period, Microsoft executes a set of processes that require no action from enterprise IT administrators. First, Microsoft creates new installation media for the feature upgrade by combining the original installation media with all the servicing updates published by Microsoft since the original media’s release. This reduces the time it can take to install a feature upgrade on a device. Second, Microsoft *republishes* the new media to Windows Update with *targeting* instructions that state (in effect) “install this media on devices that are configured for deferred installation of new feature upgrades.” At this point, devices configured to defer installation will begin receiving and installing the feature upgrade automatically. - **The role of Windows Update for Business** - Although Windows 10 will enable IT administrators to defer installation of new feature upgrades using Windows Update, enterprises may also want additional control over how and when Windows Update installs releases. With this need in mind, Microsoft [announced Windows Update for Business](http://go.microsoft.com/fwlink/p/?LinkId=624798) in May of 2015. Microsoft designed Windows Update for Business to provide IT administrators with additional Windows Update-centric management capabilities, such as the ability to deploy updates to groups of devices and to define maintenance windows for installing releases. This article will be updated with additional information about the role of Windows Update for Business in servicing Windows 10 devices as it becomes available. - ## Windows 10 servicing options - - Historically, because of the length of time between releases of new Windows versions, and the relatively low number of enterprise devices that were upgraded to newer versions of Windows during their deployment lifetimes, most IT administrators defined servicing as installing the updates that Microsoft published every month. Looking forward, because Microsoft will be publishing new feature upgrades on a continual basis, *servicing* will also include (on some portion of an enterprise's devices) installing new feature upgrades as they become available. - In fact, when planning to deploy Windows 10 on a device, one of the most important questions for IT administrators to ask is, “What should happen to this device when Microsoft publishes a new feature upgrade?” This is because Microsoft designed Windows 10 to provide businesses with multiple servicing options, centered on enabling different rates of feature upgrade adoption. In particular, IT administrators can configure Windows 10 devices to: - - Receive feature upgrades immediately after Microsoft makes them available publicly, so that users gain access to new features, experiences, and functionality as soon as possible. For more information, see [Immediate feature upgrade installation with Current Branch (CB) servicing](#immediate-upgrade-cb). - - Defer receiving feature upgrades for a period of approximately four months after Microsoft makes them available publicly, to provide IT administrators with time to perform pre-deployment testing and provide feature upgrades releases with additional time-in-market to mature. For more information, see [Deferred feature upgrade installation with Current Branch for Business (CBB) servicing](#deferred-upgrade-cbb). - - Receive only servicing updates for the duration of their Windows 10 deployment in order to reduce the number of non-essential changes made to the device. For more information, see [Install servicing updates only by using Long-Term Servicing Branch (LTSB) servicing](#install-updates-ltsb). - The breakout of a company’s devices by the categories above is likely to vary significantly by industry and other factors. What is most important is that companies can decide what works best for them and can choose different options for different devices. - ## Plan for Windows 10 deployment - - The remainder of this article focuses on the description of the three options outlined above, and their planning implications, in more detail. In practice, IT administrators have to focus on two areas when planning a Windows 10 device deployment: - - **When should new feature upgrades be deployed?** Should the device install new feature upgrades when they are published by Microsoft? If so, should installation occur immediately or on a deferred basis? - - **How will releases be installed on devices?** Will Windows Update or Windows Server Update Services be used to install new releases, or will installation be performed using a configuration management system such as Configuration Manager? - The content that follows will provide IT administrators with the context needed to understand why these areas are pivotal, and the choices available to them. - **How Microsoft releases Windows 10 feature upgrades** - When it is time to release a build as a new feature upgrade for Windows 10, Microsoft performs several processes in sequence. The first process involves creating either one or two servicing branches in a source code management system. These branches (shown in Figure 1) are required to produce feature upgrade installation media and servicing update packages that can be deployed on different Windows 10 editions, running in different configurations. - ![figure 1](images/w10servicing-f1-branches.png) - Figure 1. Feature upgrades and servicing branches - In all cases, Microsoft creates a servicing branch (referred to in Figure 1 as Servicing Branch \#1) that is used to produce releases for approximately one year (although the lifetime of the branch will ultimately depend on when Microsoft publishes subsequent feature upgrade releases). If Microsoft has selected the feature upgrade to receive long-term servicing-only support, Microsoft also creates a second servicing branch (referred to in Figure 1 as Servicing Branch \#2) that is used to produce servicing update releases for up to 10 years. - As shown in Figure 2, when Microsoft publishes a new feature upgrade, Servicing Branch \#1 is used to produce the various forms of media needed by OEMs, businesses, and consumers to install Windows 10 Home, Pro, Education, and Enterprise editions. Microsoft also produces the files needed by Windows Update to distribute and install the feature upgrade, along with *targeting* information that instructs Windows Update to only install the files on devices configured for *immediate* installation of feature upgrades. - ![figure 2](images/win10servicing-fig2-featureupgrade.png) - Figure 2. Producing feature upgrades from servicing branches - Approximately four months after publishing the feature upgrade, Microsoft uses Servicing Branch \#1 again to *republish* updated installation media for Windows 10 Pro, Education, and Enterprise editions. The updated media contains the exact same feature upgrade as contained in the original media except Microsoft also includes all the servicing updates that were published since the feature upgrade was first made available. This enables the feature upgrade to be installed on a device more quickly, and in a way that is potentially less obtrusive to users. - Concurrently, Microsoft also changes the way the feature upgrade is published in the Windows Update service. In particular, the files used by Windows Update to distribute and install the feature upgrade are refreshed with the updated versions, and the targeting instructions are changed so that the updated feature upgrade will now be installed on devices configured for *deferred* installation of feature upgrades. - **How Microsoft publishes the Windows 10 Enterprise LTSB Edition** - If Microsoft has selected the feature upgrade to receive long-term servicing support, Servicing Branch \#2 is used to publish the media needed to install the Windows 10 Enterprise LTSB edition. The time between releases of feature upgrades with long-term servicing support will vary between one and three years, and is strongly influenced by input from customers regarding the readiness of the release for long-term enterprise deployment. Figure 2 shows the Windows 10 Enterprise LTSB edition being published at the same time as the other Windows 10 editions, which mirrors the way editions were actually published for Windows 10 in July of 2015. It is important to note that this media is never published to Windows Update for deployment. Installations of the Enterprise LTSB edition on devices must be performed another way. - **How Microsoft releases Windows 10 servicing updates** - As shown in Figure 3, servicing branches are also used by Microsoft to produce servicing updates containing fixes for security vulnerabilities and other important issues. Servicing updates are published in a way that determines the Windows 10 editions on which they can be installed. For example, servicing updates produced from a given servicing branch can only be installed on devices running a Windows 10 edition produced from the same servicing branch. In addition, because Windows 10 Home does not support deferred installation of feature upgrades, servicing updates produced from Servicing Branch \#1 are targeted at devices running Windows 10 Home only until Microsoft publishes feature upgrades for deferred installation. - ![figure 3](images/win10servicing-fig3.png) - Figure 3. Producing servicing updates from servicing branches - **Release installation alternatives** - When IT administrators select Windows Update and/or Windows Server Update Services to deploy feature upgrades and servicing updates, Windows 10 and Windows Update will determine and deploy the correct releases for each of the three servicing options at the appropriate times. If there are multiple feature upgrades receiving long-term servicing support at the same time, Windows Update will select updates for each device that are appropriate for the feature upgrades they are running. - When IT administrators manage deployments of feature upgrades and servicing updates directly with configuration management products such as Configuration Manager, they are responsible for the timing of installation of both feature upgrades and servicing updates. It is important to note that until IT administrators install a new servicing update, devices may remain exposed to security vulnerabilities. Therefore, when managing deployments directly, IT administrators should deploy new servicing updates as soon as possible. - ## Servicing options and servicing branch designations - - Servicing options have several different attributes that affect deployment planning decisions. For example, each servicing option: - - Is supported on a selected set of Windows 10 editions (and no Windows 10 edition supports all three servicing options). - - Has a policy that determines the periods of time during which Microsoft will produce servicing updates for a given feature upgrade. - - Has a policy that determines when devices being managed by Windows Update or Windows Server Update Services will install new feature upgrades when they become available from Microsoft. - Because the servicing lifetime of a feature upgrade typically ends when the servicing lifetime of the subsequent feature upgrade begins, the length of servicing lifetimes will also vary. To simplify referring to these ranges, Microsoft created *servicing branch designations* for each of the three time range/servicing branch combinations. The designations are Current Branch (CB), Current Branch for Business (CBB), and Long-Term Servicing Branch (LTSB). - Because there is a one-to-one mapping between servicing options and servicing branch designations, Microsoft occasionally refers to servicing options using servicing branch-centric terminology. The following sections describe servicing options and servicing branch designations, including terminology, servicing lifetime policies, upgrade behavior, and edition support, in more detail. - **Service lifetime and feature upgrade installation paths** - Although Microsoft is currently planning to release approximately two to three feature upgrades per year, the actual frequency and timing of releases will vary. Because the servicing lifetimes of feature upgrades typically end when the servicing lifetimes of other, subsequent feature upgrades begin, the lengths of servicing lifetimes will also vary. - ![figure 4](images/win10servicing-fig4-upgradereleases.png) - Figure 4. Example release cadence across multiple feature upgrades - To show the variability of servicing lifetimes, and show the paths that feature upgrade installations will take when Windows Update and Windows Server Update Services are used for deployments, Figure 4 contains three feature upgrade releases (labeled *X*, *Y*, and *Z*) and their associated servicing branches. The time period between publishing X and Y is four months, and the time period between publishing Y and Z is six months. X and Z have long-term servicing support, and Y has shorter-term servicing support only. - The same underlying figure will be used in subsequent figures to show all three servicing options in detail. It is important to note that Figure 4 is provided for illustration of servicing concepts only and should not be used for actual Windows 10 release planning. - To simplify the servicing lifetime and feature upgrade behavior explanations that follow, this document refers to branch designations for a specific feature upgrade as the +0 versions, the designations for the feature upgrade after the +0 version as the +1 (or successor) versions, and the designation for the feature upgrade after the +1 version as the +2 (or second successor) versions. - ### - **Immediate feature upgrade installation with Current Branch (CB) servicing** - As shown in Figure 5, the Current Branch (CB) designation refers to Servicing Branch \#1 during the period that starts when Microsoft publishes a feature upgrade targeted for devices configured for *immediate* installation and ends when Microsoft publishes the *successor* feature upgrade targeted for devices configured for *immediate* installation. - ![figure 5](images/win10servicing-fig5.png) - Figure 5. Immediate installation with Current Branch Servicing - The role of Servicing Branch \#1 during the CB period is to produce feature upgrades and servicing updates for Windows 10 devices configured for *immediate* installation of new feature upgrades. Microsoft refers to devices configured this way as being *serviced from CBs*. The Windows 10 editions that support servicing from CBs are Home, Pro, Education, and Enterprise. The Current Branch designation is intended to reflect the fact that devices serviced using this approach will be kept as current as possible with respect to the latest Windows 10 feature upgrade release. - Windows 10 Home supports Windows Update for release deployment. Windows 10 editions (Pro, Education, and Enterprise) support Windows Update, Windows Server Update Services, Configuration Manager, and other configuration management systems: - - When IT administrators use Windows Update to manage deployments, devices will receive new feature upgrades and servicing updates as soon as they are published by Microsoft in the Windows Update service, targeted to devices configured for *immediate* feature upgrade installation. - - When devices are being managed by using Windows Server Update Services, the same workflows are executed as with Windows Update except IT administrators must approve releases before installations begin. - - When using configuration management systems such as Configuration Manager to manage deployments, IT administrators can obtain installation media from Microsoft and deploy new feature upgrades immediately by using standard change control processes. IT administrators who use configuration management systems should also make sure to obtain and deploy all servicing updates published by Microsoft as soon as possible. - It is important to note that devices serviced from CBs must install two to three feature upgrades per year to remain current and continue to receive servicing updates. - ### - **Deferred feature upgrade installation with Current Branch for Business (CBB) servicing** - As shown in Figure 6, the Current Branch for Business (CBB) designation refers to Servicing Branch \#1 during the period that starts when Microsoft republishes a feature upgrade targeted for devices configured for *deferred* installation and ends when Microsoft republishes the *second successor* feature upgrade targeted for devices configured for *deferred* installation. - ![figure 6](images/win10servicing-fig6.png) - Figure 6. Deferred installation with Current Branch for Business Servicing - The role of Servicing Branch \#1 during the CBB period is to produce feature upgrades and servicing updates for Windows 10 devices configured for *deferred* installation of new feature upgrades. Microsoft refers to devices configured this way as being *serviced from CBBs*. The Windows 10 editions that support servicing from CBBs are Pro, Education, and Enterprise. The Current Branch for Business designation is intended to reflect the fact that many businesses require IT administrators to test feature upgrades prior to deployment, and servicing devices from CBBs is a pragmatic solution for businesses with testing constraints to remain as current as possible. - Windows 10 (Pro, Education, and Enterprise editions) support release deployment by using Windows Update, Windows Server Update Services, Configuration Manager, and other configuration management systems: - - When IT administrators use Windows Update to manage deployments, devices will receive new feature upgrades and servicing updates as soon as they are published by Microsoft in the Windows Update service, targeted to devices configured for *deferred* feature upgrade installation. It is important to note that, even when devices are configured to defer installations, all servicing updates that are applicable to the feature upgrade that is running on a device will be installed immediately after being published by Microsoft in the Windows Update service. - - When devices are being managed through Windows Server Update Services, the same workflows are executed as with Windows Update except IT administrators must approve releases before installations begin. - - When using configuration management systems such as Configuration Manager to manage deployments, IT administrators can obtain media published for deferred installation from Microsoft and deploy new feature upgrades by using standard change control processes. When deferring feature upgrade installations, IT administrators should still deploy all applicable servicing updates as soon as they become available from Microsoft. - Microsoft designed Windows 10 servicing lifetime policies so that CBBs will receive servicing updates for approximately twice as many months as CBs. This enables two CBBs to receive servicing support at the same time, which provides businesses with more flexibility when deploying new feature upgrades. That said, it is important to note that Microsoft will not produce servicing updates for a feature upgrade after its corresponding CBB reaches the end of its servicing lifetime. This means that feature upgrade deployments cannot be extended indefinitely and IT administrators should ensure that they deploy newer feature upgrades onto devices before CBBs end. - ### - **Install servicing updates only by using Long-Term Servicing Branch (LTSB) servicing** - As shown in Figure 7, the Long-Term Servicing Branch (LTSB) designation refers to Servicing Branch \#2 from beginning to end. LTSBs begin when a feature upgrade with long-term support is published by Microsoft and end after 10 years. It is important to note that only the Windows 10 Enterprise LTSB edition supports long-term servicing, and there are important differences between this edition and other Windows 10 editions regarding upgradability and feature set (described below in the [Considerations when configuring devices for servicing updates only](#servicing-only) section). - ![figure 7](images/win10servicing-fig7.png) - Figure 7. Servicing updates only using LTSB Servicing - The role of LTSBs is to produce servicing updates for devices running Windows 10 configured to install servicing updates only. Devices configured this way are referred to as being *serviced from LTSBs*. The Long-Term Servicing Branch designation is intended to reflect the fact that this servicing option is intended for scenarios where changes to software running on devices must be limited to essential updates (such as those for security vulnerabilities and other important issues) for the duration of deployments. - Windows 10 Enterprise LTSB supports release deployment by using Windows Update, Windows Server Update Services, Configuration Manager, and other configuration management systems: - - When IT administrators use Windows Update to manage deployments, Windows Update will install only servicing updates, and do so as soon as they are published by Microsoft in the Windows Update service. Windows Update does not install feature upgrades on devices configured for long-term servicing. - - When devices are being managed using Windows Server Update Services, the same workflows are executed as with Windows Update except IT administrators must approve releases before installations begin. - - When using configuration management systems such as System Center Configuration Manager to manage deployments, IT administrators should make sure to obtain and deploy all servicing updates published by Microsoft as soon as possible. - **Note**   It is important to note again that not all feature upgrades will have an LTSB. The initial release of Windows 10, published in July 2015, has an LTSB and Microsoft expects to designate one additional feature upgrade in the next 12 months for long-term support. After that, Microsoft expects to publish feature upgrades with long-term servicing support approximately every two to three years. Microsoft will provide additional information in advance of publishing new feature upgrades so that IT administrators can make informed deployment planning decisions. -   - ### - **Considerations when configuring devices for servicing updates only** - Before deciding to configure a device for LTSB-based servicing, IT administrators should carefully consider the implications of changing to a different servicing option later, and the effect of using Windows 10 Enterprise LTSB on the availability of *in-box* applications. - Regarding edition changes, it is possible to reconfigure a device running Windows 10 Enterprise LTSB to run Windows 10 Enterprise while preserving the data and applications already on the device. Reconfiguring a device running Windows 10 Enterprise LTSB to run other editions of Windows 10 may require IT administrators to restore data and/or reinstall applications on the device after the other edition has been installed. - Regarding in-box applications, Windows 10 Enterprise LTSB does not include all the universal apps that are included with other Windows 10 editions. This is because the universal apps included with Windows 10 will be continually upgraded by Microsoft, and new releases of in-box universal apps are unlikely to remain compatible with a feature upgrade of Windows 10 Enterprise LTSB for the duration of its servicing lifetime. Examples of apps that Windows 10 Enterprise LTSB does not include are Microsoft Edge, Windows Store Client, Cortana (limited search capabilities remain available), Outlook Mail, Outlook Calendar, OneNote, Weather, News, Sports, Money, Photos, Camera, Music, and Clock. - Windows 10 Enterprise LTSB does include Internet Explorer 11, and is compatible with Windows 32 versions of Microsoft Office. IT administrators can also install universal apps on devices when apps are compatible with the feature upgrades running on the device. They should do so with care, however, as servicing updates targeted for devices running Windows 10 Enterprise LTSB will not include security or non-security fixes for universal apps. Additionally, Microsoft will not provide servicing updates for specific releases of apps on any Windows 10 edition after the feature upgrade of Windows 10 with which the apps were included reaches the end of its servicing lifetime. - **Servicing option summary** - Table 2. Servicing option summary - @@ -372,21 +234,9 @@ universal apps removed
    Comparison
      - ## Related topics - - [Plan for Windows 10 deployment](../plan/index.md) - [Deploy Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=624776) - [Manage and update Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=624796) -   -   - - - - - diff --git a/windows/manage/windows-10-mobile-and-mdm.md b/windows/manage/windows-10-mobile-and-mdm.md index 0e347899ad..a818434444 100644 --- a/windows/manage/windows-10-mobile-and-mdm.md +++ b/windows/manage/windows-10-mobile-and-mdm.md @@ -2,85 +2,48 @@ title: Windows 10 Mobile and mobile device management (Windows 10) description: This guide provides an overview of the mobile device and app management technologies in the Windows 10 Mobile operating system. ms.assetid: 6CAA1004-CB65-4FEC-9B84-61AAD2125E5E +ms.pagetype: mobile; devices keywords: ["telemetry", "BYOD", "MDM"] ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library author: AMeeus --- - # Windows 10 Mobile and mobile device management - - **Applies to** - - Windows 10 Mobile - This guide provides an overview of the mobile device and app management technologies in the Windows 10 Mobile operating system. It describes how mobile device management (MDM) systems use the built-in device management client to deploy, configure, maintain, and support phones and small tablets running Windows 10 Mobile. - Bring Your Own Device (BYOD—that is, personal devices) and corporate devices are key scenarios that Windows 10 Mobile MDM capabilities support. The operating system offers a flexible approach to registering devices with directory services and MDM systems, and IT organizations can provision comprehensive device-configuration profiles based on their company’s need to control and secure mobile business data. - Windows 10 Mobile not only delivers more comprehensive, restrictive configuration settings than Windows Phone 8.1 did but also provides capabilities to deploy and manage apps built on the Universal Windows Platform (UWP). Companies can distribute apps directly from Windows Store or by using their MDM system. They can control and distribute custom line-of-business (LOB) apps the same way. - ## Overview - - Organizations’ users increasingly depend on their mobile devices, but phones and tablets bring new and unfamiliar challenges for IT departments. IT must be able to deploy and manage mobile devices and apps quickly to support the business while balancing the growing need to protect corporate data because of evolving laws, regulations, and cybercrime. IT must ensure that the apps and data on those mobile devices are safe, especially on personal devices. Windows 10 Mobile helps organizations address these challenges by providing a robust, flexible, built-in MDM client. IT departments can use the MDM system of their choice to manage this client. - ### Built-in MDM client - The built-in MDM client is common to all editions of the Windows 10 operating system, including desktop, mobile, and Internet of Things (IoT). The client provides a single interface through which you can manage any device that runs Windows 10. The client has two important roles: device enrollment in an MDM system and device management. - - **Device enrollment.** Users can enroll in the MDM system. On Windows 10, a user can register a device with Microsoft Azure Active Directory (Azure AD) and enroll in an MDM system at the same time so that the system can manage the device, the apps running on it, and the confidential data it holds. Enrollment establishes the management authority for the device. Only one management authority (or MDM enrollment) is possible at a time, which helps prevent unauthorized access to devices and ensures their stability and reliability. - - **Device management.** The MDM client allows the MDM system to configure policy settings; deploy apps and updates; and perform other management tasks, such as remotely wiping the device. The MDM system sends configuration requests and collects inventory through the MDM client. The client uses [configuration service providers (CSPs)](http://go.microsoft.com/fwlink/p/?LinkId=734049) to configure and inventory settings. A CSP is an interface to read, set, modify, or delete configuration settings on the device. These settings map to registry keys or files. (The security architecture of Windows 10 Mobile prevents direct access to registry settings and operating system files. For more information, see the [Windows 10 Mobile security guide](../keep-secure/windows-10-mobile-security-guide.md).) - The MDM client is an integral part of Windows 10 Mobile. As a result, there is no need for an additional, custom MDM app to enroll the device or to allow an MDM system to manage it. All MDM systems have equal access to Windows 10 Mobile MDM application programming interfaces (APIs), so you can choose Microsoft Intune or a third-party MDM product to manage Windows 10 Mobile devices. For more information about Windows 10 Mobile device management APIs, see [Mobile device management](http://go.microsoft.com/fwlink/p/?LinkId=734050). - ### Windows 10 Mobile editions - Every device that runs Windows 10 Mobile includes all the enterprise mobile device security and management capabilities the MDM client provides. Microsoft also offers an Enterprise edition of Windows 10 Mobile, which includes three additional capabilities. To enable these capabilities, you can provision a license file without reinstalling the operating system: - - **Ability to postpone software updates.**Windows 10 Mobile gets software updates directly from Windows Update, and you cannot curate updates prior to deployment. Windows 10 Mobile Enterprise, however, allows you to curate and validate updates prior to deploying them. - - **No limit on the number of self-signed LOB apps that you can deploy to a single device.** To use an MDM system to deploy LOB apps directly to devices, you must cryptographically sign the software packages with a code signing certificate that your organization’s certificate authority (CA) generates. You can deploy a maximum of 20 self-signed LOB apps to a Windows 10 Mobile device, more than 20 if your organization’s devices run Windows 10 Mobile Enterprise. - - **Set telemetry to security level.** The telemetry security level configures the operating system to gather only the telemetry information required to keep devices secured. - **Note**   Your organization can opt to purchase a code signing certificate from Verisign to sign LOB apps or use [Windows Store for Business](windows-store-for-business.md) to obtain apps. With either method, you can distribute more than 20 apps to a single device without activating Windows 10 Mobile Enterprise on that device by using your MDM system. -   - To activate Windows 10 Mobile Enterprise on any Windows 10 Mobile device, use your company’s MDM system or a provisioning package to inject a license onto the device. You can download a Windows 10 Mobile Enterprise license from the Business Support Portal. - ### Lifecycle management - Windows 10 Mobile supports end-to-end lifecycle device management to give companies control of their devices, data, and apps. Comprehensive MDM systems use the built-in MDM client to manage devices throughout their lifecycle, as Figure 1 illustrates. The remainder of this guide describes the operating system’s mobile device and app management capabilities through each phase of the lifecycle, showing how MDM systems use specific features. - ![figure 1](images/win10-mobile-mdm-fig1.png) - Figure 1. Device management lifecycle - ## Device deployment - - Device deployment includes the initial registration and configuration of the device, including its enrollment with an MDM system. Sometimes, companies preinstall apps. The major factors in how you deploy devices and which controls you put in place are device ownership and how the user will use the device. This guide covers two scenarios: - 1. Companies allow users to personalize their devices because the users own the devices or because company policy doesn’t require tight controls (defined as *personal devices* in this guide). - 2. Companies don’t allow users to personalize their devices or they limit personalization, usually because the organization owns the devices and security considerations are high (defined as *corporate devices* in this guide). - Often, employees can choose devices from a list of supported models, or companies provide devices that they preconfigure, or bootstrap, with a baseline configuration. - Microsoft recommends Azure AD Join and MDM enrollment and management for corporate devices and Azure AD Registration and MDM enrollment and management for personal devices. - ### Deployment scenarios - Most organizations support both personal and corporate device scenarios. The infrastructure for these scenarios is similar, but the deployment process and configuration policies differ. Table 1 describes characteristics of the personal and corporate device scenarios. Activation of a device with an organizational identity is unique to Windows 10 Mobile. - Table 1. Characteristics of personal and corporate device scenarios - @@ -110,19 +73,12 @@ Table 1. Characteristics of personal and corporate device scenarios
    -   - ### Identity management - People can use only one account to activate a device, so it’s imperative that your organization control which account you enable first. The account you choose will determine who controls the device and influence your management capabilities. The following list describes the impact that users’ identities have on management (Table 2 summarizes these considerations): - - **Personal identity.** In this scenario, employees use their Microsoft account to activate the device. Then, they use their Azure AD account (organizational identity) to register the device in Azure AD and enroll it with the company’s MDM solution. You can apply policies to help protect and contain corporate apps and data on the devices, designed to prevent intellectual property leaks, but users keep full control over personal activities, such as downloading and installing apps and games. - - **Organizational identity.** In this scenario, employees use their Azure AD account to register the device to Azure AD and automatically enroll it with the organization’s MDM solution. In this case, companies can block personal use of devices. Using organizational Identities to initialize devices gives organizations complete control over devices and allows them to prevent personalization. - Table 2. Personal vs. organizational identity - @@ -169,99 +125,53 @@ Table 2. Personal vs. organizational identity
    -   - ### Infrastructure requirements - For both device scenarios, the essential infrastructure and tools required to deploy and manage Windows 10 Mobile devices include an Azure AD subscription and an MDM system. - Azure AD is a cloud-based directory service that provides identity and access management. You can integrate it with existing on-premises directories to create a hybrid solution. Azure AD has three editions: Free, Basic, and Premium (see [Azure Active Directory editions](http://go.microsoft.com/fwlink/p/?LinkId=723980)). All editions support Azure AD device registration, but the Premium edition is required to enable MDM auto-enrollment and conditional access based on device state. Organizations that use Microsoft Office 365 or Intune are already using Azure AD. - **Note**   Most industry-leading MDM vendors already support integration with Azure AD or are working on integration. You can find the MDM vendors that support Azure AD in [Azure Marketplace](http://go.microsoft.com/fwlink/p/?LinkId=723981). -   - Users can enroll Windows 10 Mobile devices in third-party MDM systems without using an Azure AD organizational account. (By default, Intune uses Azure AD and includes a license). If your organization doesn’t use Azure AD, you must use a personal identity to activate devices and enable common scenarios, such as downloading apps from Windows Store. - Multiple MDM systems that support Windows 10 Mobile are available. Most support personal and corporate device deployment scenarios. Microsoft offers [Intune](http://go.microsoft.com/fwlink/p/?LinkId=723983), which is part of the [Enterprise Mobility Suite](http://go.microsoft.com/fwlink/p/?LinkId=723984) and a cloud-based MDM system that manages devices off premises. Like Office 365, Intune uses Azure AD for identity management, so employees use the same credentials to enroll devices in Intune or sign in to Office 365. Intune supports devices that run other operating systems, as well, such as iOS and Android, to provide a complete MDM solution. - You can also integrate Intune with System Center Configuration Manager to gain a single console in which to manage all devices—in the cloud and on premises. For more information, see [Manage Mobile Devices with Configuration Manager and Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkId=734051). For guidance on choosing between a stand-alone Intune installation and Intune integrated with Configuration Manager, see [Choose between Intune by itself or integrating Intune with System Center Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=723985). - In addition to Intune, other MDM providers support Windows 10 Mobile. Currently, the following MDM systems claim to support Windows 10 and Windows 10 Mobile: [AirWatch](http://go.microsoft.com/fwlink/p/?LinkId=723986), [Citrix](http://go.microsoft.com/fwlink/p/?LinkId=723987), [Lightspeed Systems](http://go.microsoft.com/fwlink/p/?LinkId=723988), [Matrix42](http://go.microsoft.com/fwlink/p/?LinkId=723989), [MobileIron](http://go.microsoft.com/fwlink/p/?LinkId=723990), [SAP](http://go.microsoft.com/fwlink/p/?LinkId=723991), [SOTI](http://go.microsoft.com/fwlink/p/?LinkId=723992), and [Symantec](http://go.microsoft.com/fwlink/p/?LinkId=723993). - All MDM vendors have equal access to the [Windows 10 MDM APIs](http://go.microsoft.com/fwlink/p/?LinkId=734050). The extent to which they implement these APIs depends on the vendor. Contact your preferred MDM vendor to determine its level of support. - **Note**   Although not covered in this guide, you can use Exchange ActiveSync (EAS) to manage mobile devices instead of using a full-featured MDM system. EAS is available in Microsoft Exchange Server 2010 or later and Office 365. - In addition, Microsoft recently added MDM capabilities powered by Intune to Office 365. MDM for Office 365 supports mobile devices only, such as those running Windows 10 Mobile, iOS, and Android. MDM for Office 365 offers a subset of the management capabilities found in Intune, including the ability to remotely wipe a device, block a device from accessing Exchange Server email, and configure device policies (for example, passcode requirements). For more information about MDM for Office 365 capabilities, see [Overview of Mobile Device Management for Office 365](http://go.microsoft.com/fwlink/p/?LinkId=734052). -   - ### Provisioning - Provisioning is new to Windows 10 and uses the MDM client in Windows 10 Mobile. You can create a runtime provisioning package to apply settings, profiles, and file assets to a device running Windows 10. - To assist users with MDM system enrollment, use a provisioning package. To do so, use the [Windows Imaging and Configuration Designer](http://go.microsoft.com/fwlink/p/?LinkId=733911) to create a provisioning package, and then install that package on the device. - Users can perform self-service MDM enrollment based on the following deployment scenarios: - - **Corporate device.** During the out-of-the-box experience (OOBE), you can instruct the user to select **This device is owned by my organization** and join the device to Azure AD and the MDM system. - - **Personal device.** The user activates the device with a Microsoft account, but you can instruct him or her to register the device with Azure AD and enroll in Intune. To do so in Windows 10 Mobile, the user clicks, **Settings**, clicks **Accounts**, and then clicks **Work access**. - To automate MDM enrollment, use provisioning packages as follows: - - **Corporate device.** You can create a provisioning package and apply it to a corporate device before delivery to the user, or instruct the user to apply the package during OOBE. After application of the provisioning package, the OOBE process automatically chooses the enterprise path and requires the user to register the device with Azure AD and enroll it in the MDM system. - - **Personal device.** You can create a provisioning package and make it available to users who want to enroll their personal device in the enterprise. The user enrolls the device in the corporate MDM for further configuration by applying the provisioning package. To do so in Windows 10 Mobile, the user clicks **Settings**, clicks **Accounts**, and then clicks **Provisioning**). - Distribute provisioning packages to devices by publishing them in an easily accessible location (e.g., an email attachment or a web page). You can cryptographically sign or encrypt provisioning packages and require that the user enter a password to apply them. - See [Build and apply a provisioning package](http://go.microsoft.com/fwlink/p/?LinkId=734054) for more information on creating provisioning packages. - ## Device configuration - - The following sections describe the device configuration capabilities of the built-in Windows 10 Mobile MDM client. This client exposes the capabilities to any MDM system compatible with Windows 10. Configurable settings include: - - [Email accounts](#email) - - [Account restrictions](#restrictions) - - [Device lock restrictions](#device-lock) - - [Hardware restrictions](#hardware) - - [Certificate management](#certificate) - - [Wi-Fi](#wifi) - - [Proxy](#proxy) - - [Virtual private network (VPN)](#vpn) - - [Access point name (APN) profiles](#apn) - - [Data leak prevention](#data) - - [Storage management](#storage) - **Note**   Although all the MDM settings this section describes are available in Windows 10 Mobile, not all MDM systems may show them in their user interface. In addition, naming may vary among MDM systems. Consult your MDM system’s documentation for more information. -   - ### Email accounts - You can use your corporate MDM system to manage corporate email accounts. Define email account profiles in the MDM system, and then deploy them to devices. You would usually deploy these settings immediately after enrollment, regardless of scenario. - This capability extends to email systems that use EAS. Table 3 lists settings that you can configure in EAS email profiles. - Table 3. Windows 10 Mobile settings for EAS email profiles - | Setting | Description | |----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Email Address | The email address associated with the EAS account | @@ -279,13 +189,9 @@ Table 3. Windows 10 Mobile settings for EAS email profiles | Use SSL | Establishes whether Secure Sockets Layer (SSL) is required when syncing | | Mail Age Filter | The age of messages to be synchronized with the device (for example, synchronizing messages within the past 7 days) | | Content Types | The content type that is synchronized (e.g., email, contacts, calendar, task items) | -   - Table 4 lists settings that you can configure in other email profiles. - Table 4. Windows 10 Mobile settings for other email profiles - | Setting | Description | |-------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------| | User logon name | The user logon name for the email account | @@ -316,36 +222,23 @@ Table 4. Windows 10 Mobile settings for other email profiles | Alternate SMTP account enabled | Whether the user’s alternative SMTP account is enabled | | Alternate SMTP password | The password for the user’s alternative SMTP account | | Incoming and outgoing servers require SSL | A group of properties that specify whether the incoming and outgoing email servers use SSL | -   - ### Account restrictions - On a corporate device registered with Azure AD and enrolled in the MDM system, you can control whether users can use a Microsoft account or add other consumer email accounts. Table 5 lists the settings that you can use to manage accounts on Windows 10 Mobile devices. - Table 5. Windows 10 Mobile account management settings - | Setting | Description | |-------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Allow Microsoft Account | Specifies whether users are allowed to add a Microsoft account to the device after MDM enrollment and use this account for connection authentication and services, such as purchasing apps in Windows Store, or cloud-based consumer services, such as Xbox or Groove. If a device was activated with a Microsoft account, the MDM system would not be able to block that account from being used. | | Allow Adding Non Microsoft Accounts | Specifies whether users are allowed to add email accounts other than Microsoft accounts after MDM enrollment. If **Allow Microsoft Account** is applied, user can also not use a Microsoft account. | | Allow “Your Account” | Specifies whether users are able to change account configuration in the **Your Email and Accounts** panel in Settings. | -   - ### Device lock restrictions - It’s common sense to lock a device when it is not in use. Microsoft recommends that you secure Windows 10 Mobile devices and implement a device lock policy. A device password or PIN lock is a best practice for securing apps and data on devices. [Windows Hello](http://go.microsoft.com/fwlink/p/?LinkId=723994) is the name given to the new biometric sign-in option that allows users to use their face, iris, or fingerprints to unlock their compatible device, all of which Windows 10 supports. - **Note**   In addition to the device lock restrictions discussed in this section, Windows 10 supports Microsoft Passport for Work, which lets you access apps and services without a password. -   - Table 6 lists the MDM settings in Windows 10 Mobile that you can use to configure device lock restrictions. - Table 6. Windows 10 Mobile device lock restrictions - @@ -419,20 +312,13 @@ Table 6. Windows 10 Mobile device lock restrictions
    -   - ### Hardware restrictions - Windows 10 Mobile devices use state-of-the-art technology that includes popular hardware features such as cameras, global positioning system (GPS) sensors, microphones, speakers, near-field communication (NFC) radios, storage card slots, USB interfaces, Bluetooth interfaces, cellular radios, and Wi-Fi. You can also use hardware restrictions to control the availability of these features. Table 7 lists the MDM settings that Windows 10 Mobile supports to configure hardware restrictions. - **Note**   Some of these hardware restrictions provide connectivity and assist in data protection. Enterprise data protection is currently being tested in select customer evaluation programs. -   - Table 7. Windows 10 Mobile hardware restrictions - | Setting | Description | |--------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------| | Allow NFC | Whether the NFC radio is enabled | @@ -450,15 +336,10 @@ Table 7. Windows 10 Mobile hardware restrictions | Allow Storage Card | Whether the storage card slot is enabled | | Allow Voice Recording | Whether the user can use the microphone to create voice recordings | | Allow Location | Whether the device can use the GPS sensor or other methods to determine location so applications can use location information | -   - ### Certificate management - Managing certificates can be difficult for users, but certificates are pervasive for a variety of uses, including, account authentication, Wi-Fi authentication, VPN encryption, and SSL encryption of web content. Although users could manage certificates on devices manually, it’s a best practice to use your MDM system to manage those certificates for their entire life cycle, from enrollment through renewal to revocation. You can use the Simple Certificate Enrollment Protocol (SCEP) and Personal Information Exchange (PFX) certificates files to install certificates on Windows 10 Mobile. Certificate management through SCEP and MDM systems is fully transparent to users and requires no user intervention, so it helps improve user productivity and reduce support calls. Your MDM system can automatically deploy these certificates to the devices’ certificate stores after you enroll the device. Table 8 lists the SCEP settings that the MDM client in Windows 10 Mobile provides. - Table 8. Windows 10 Mobile SCEP certificate enrollment settings - | Setting | Description | |------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Certificate enrollment server URLs | The certificate enrollment servers (to specify multiple server URLs, separate the URLs with semicolons \[;\]) | @@ -478,13 +359,9 @@ Table 8. Windows 10 Mobile SCEP certificate enrollment settings | Valid period units | The number of units of time that the certificate is considered valid (Use this setting with the **Valid Period** setting. For example, if this setting is **3** and **Valid Period** is **Years**, the certificate is valid for 3 years.) | | Custom text to show in Microsoft Passport PIN prompt | The custom text to show on the Microsoft Passport PIN prompt during certificate enrollment | | Thumbprint | The current certificate thumbprint, if certificate enrollment succeeds | -   - In addition to SCEP certificate management, Windows 10 Mobile supports deployment of PFX certificates. Table 9 lists the Windows 10 Mobile PFX certificate deployment settings. - Table 9. Windows 10 Mobile PFX certificate deployment settings - | Setting | Description | |-----------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Private key storage | Where to store the private key (in other words, the TPM, a software KSP, or the Microsoft Passport KSP) | @@ -494,36 +371,21 @@ Table 9. Windows 10 Mobile PFX certificate deployment settings | PFX packet password encryption | Whether the MDM system encrypts the PFX certificate password with the MDM certificate | | PFX private key export | Whether the PFX private key can be exported | | Thumbprint | The thumbprint of the installed PFX certificate | -   - Use the **Allow Manual Root Certificate Installation** setting to prevent users from manually installing root and intermediate CA certificates intentionally or accidently. - **Note**   To diagnose certificate-related issues on Windows 10 Mobile devices, use the free [Certificates app](http://go.microsoft.com/fwlink/p/?LinkId=723996) in Windows Store. This Windows 10 Mobile app can help you: - - View a summary of all personal certificates. - - View the details of individual certificates. - - View the certificates used for VPN, Wi-Fi, and email authentication. - - Identify which certificates may have expired. - - Verify the certificate path and confirm that you have the correct intermediate and root CA certificates. - - View the certificate keys stored in the device TPM. -   - ### Wi-Fi - People use Wi-Fi on their mobile devices as much as or more than cellular data. Most corporate Wi-Fi networks require certificates and other complex information to restrict and secure user access. This advanced Wi-Fi information is difficult for typical users to configure, but you can use your MDM system to fully configure Wi-Fi settings without user intervention. - Table 10 lists the Windows 10 Mobile Wi-Fi connection profile settings. Use the information in this table to help you create Wi-Fi connection profiles in your MDM system. - Table 10. Windows 10 Mobile Wi-Fi connection profile settings - @@ -592,35 +454,23 @@ Table 10. Windows 10 Mobile Wi-Fi connection profile settings
    -   - Table 11 lists the Windows 10 Mobile settings for managing Wi-Fi connectivity. - Table 11. Windows 10 Mobile Wi-Fi connectivity settings - | Setting | Configuration | |--------------------------------------------|----------------------------------------------------------------------------| | Allow Auto Connect To Wi-Fi Sense Hotspots | Whether the device will automatically detect and connect to Wi-Fi networks | | Allow Manual Wi-Fi Configuration | Whether the user can manually configure Wi-Fi settings | | Allow Wi-Fi | Whether the Wi-Fi hardware is enabled | | WLAN Scan Mode | How actively the device scans for Wi-Fi networks | -   - ### Proxy - Apps running on Windows 10 Mobile (for example, Microsoft Edge) can use proxy connections to access Internet content, but Wi-Fi connections on the corporate intranet most typically use proxy connections, instead. You can define multiple proxies in Windows 10 Mobile. - **Note**   Windows 10 Mobile also supports proxy auto-configuration (PAC) files, which can automatically configure proxy settings. The Web Proxy Auto-Discovery Protocol (WPAD) lets apps use Dynamic Host Configuration Protocol and Domain Name System (DNS) lookups to locate the PAC file. -   - Table 12 lists the Windows 10 Mobile settings for proxy connections. - Table 12. Windows 10 Mobile proxy connection settings - @@ -686,27 +536,16 @@ Table 12. Windows 10 Mobile proxy connection settings
    -   - ### VPN - In addition to Wi-Fi, users often use a VPN to securely access apps and resources on their company’s intranet behind a firewall. Windows 10 Mobile supports several VPN vendors in addition to native Microsoft VPNs (such as Point to Point Tunneling Protocol \[PPTP\], Layer 2 Tunneling Protocol \[L2TP\], and Internet Key Exchange Protocol version 2 \[IKEv2\]), including: - - IKEv2 - - IP security - - SSL VPN connections (which require a downloadable plug-in from the VPN server vendor) - You can configure Windows 10 Mobile to use auto-triggered VPN connections, as well. You define a VPN connection for each app that requires intranet connectivity. When users switch between apps, the operating system automatically establishes the VPN connection for that app. In the event the device drops the VPN connection, Windows 10 Mobile automatically reconnects to the VPN without user intervention. - With always-on VPN, Windows 10 Mobile can automatically start a VPN connection when a user signs-in, as well. The VPN stays connected until the user manually disconnects it. - MDM support for VPN connections in Windows 10 Mobile includes provisioning and updating VPN connection profiles and associating VPN connections with apps. You can create and provision VPN connection profiles, and then deploy them to managed devices that run Windows 10 Mobile. Table 13 lists the Windows 10 Mobile fields for VPN connection profiles. - Table 13. Windows 10 Mobile VPN connection profile settings - @@ -839,31 +678,20 @@ Table 13. Windows 10 Mobile VPN connection profile settings
    -   - Table 14 lists the Windows 10 Mobile settings for managing VPN connections. These settings help you manage VPNs over cellular data connections, which in turn help reduce costs associated with roaming or data plan charges. - Table 14. Windows 10 Mobile VPN management settings - | Setting | Description | |--------------------------------------|---------------------------------------------------------------------------------| | Allow VPN | Whether users can change VPN settings | | Allow VPN Over Cellular | Whether users can establish VPN connections over cellular networks | | Allow VPN Over Cellular when Roaming | Whether users can establish VPN connections over cellular networks when roaming | -   - ### APN profiles - An APN defines network paths for cellular data connectivity. Typically, you define just one APN for a device in collaboration with a mobile operator, but you can define multiple APNs if your company uses multiple mobile operators. - An APN provides a private connection to the corporate network that is unavailable to other companies on the mobile operator network. Corporations in Europe and the Asia-Pacific use APNs, but they are not common in the United States. - You can define and deploy APN profiles in MDM systems that configure cellular data connectivity for Windows 10 Mobile. Devices running Windows 10 Mobile can have only one APN profile. Table 15 lists the MDM settings that Windows 10 Mobile supports for APN profiles. - Table 15. Windows 10 Mobile APN profile settings - @@ -923,15 +751,10 @@ Table 15. Windows 10 Mobile APN profile settings
    -   - ### Data leak protection - Some user experiences can risk corporate data stored on corporate devices. For example, allowing users to copy and paste information out of the organization’s LOB app can put data at risk. To mitigate the risk, you can restrict the Windows 10 Mobile user experience to help protect corporate data and prevent data leaks. For example, you can prevent settings synchronization, copy-and-paste operations, and screen captures. Table 16 lists the MDM settings in Windows 10 Mobile that you can use to help prevent data leaks. - Table 16. Windows 10 Mobile data leak protection settings - | Setting | Description | |----------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Allow copy and paste | Whether users can copy and paste content | @@ -944,25 +767,15 @@ Table 16. Windows 10 Mobile data leak protection settings | Allow sync my settings | Whether the user experience settings are synchronized between devices (works with Microsoft accounts only) | | Allow toasts notifications above lock screen | Whether users are able to view toast notification on the device lock screen | | Allow voice recording | Whether users are allowed to perform voice recordings. | -   - ### Storage management - Protecting the apps and data stored on a device is critical to device security. One method for helping protect your apps and data is to encrypt internal device storage by using the device encryption in Windows 10 Mobile. This encryption helps protect corporate data against unauthorized access, even when an unauthorized user has physical possession of the device. - A feature in Windows 10 Mobile is the ability to install apps on a secure digital (SD) card. The operating system stores apps on a partition specifically designated for that purpose. This feature is always on, so you don’t need to set a policy explicitly to enable it. - The SD card is uniquely paired with a device. No other devices can see the apps or data on the encrypted partition, but they can access the data stored on the unencrypted partition of the SD card, such as music or photos. - You can disable the **Allow Storage Card** setting to prevent users from using SD cards altogether, but the primary advantage of the SD card app partition–encryption feature is that organizations can give users the flexibility to use an SD card while still protecting the confidential apps and data on it. - If you don’t encrypt storage, you can help protect your corporate apps and data by using the **Restrict app data to the system volume** and **Restrict apps to the system volume** settings. They help ensure that users cannot copy your apps and data to SD cards. - Table 17 lists the MDM storage-management settings that Windows 10 Mobile provides. - Table 17. Windows 10 Mobile storage management settings - @@ -1011,66 +824,35 @@ Table 17. Windows 10 Mobile storage management settings
    -   - ## App management - - Apps help improve user productivity on mobile devices. New to Windows 10 is the ability for organizations purchase apps from Windows Store for their employees and deploy those apps from Windows Store or an MDM system. App management is becoming a key capability of MDM systems, helping reduce the effort required to perform common app-related tasks, such as distributing apps, and protecting data through app policies. This section describes the app management features in Windows 10 Mobile and includes the following topics: - - [Universal Windows Platform (UWP)](#uwp) - - [Sourcing the right app](#sourcing) - - [Windows Store for Business](#store) - - [Mobile application management (MAM) policies](#mam) - - [Microsoft Edge](#edge) - ### Universal Windows Platform - Windows 10 introduces UWP, converging the application platform for all devices running some edition of Windows 10. UWP apps run without modification on all editions of Windows 10, and Windows Store now has apps that you can license and purchased for all your Windows 10 devices. Windows Phone 8.1 and Windows 8.1 apps still run on Windows 10 devices, but the MAM improvements in Windows 10 work only with UWP apps. See the [Guide to Universal Windows Platform (UWP) apps](http://go.microsoft.com/fwlink/p/?LinkId=734056) for additional information. - ### Sourcing the right app - The first step in app management is to obtain the apps your users need, and you can now acquire apps from Windows Store. Developers can also create apps specific to an organization, known as *line-of-business (LOB) apps* (the developers of these apps are *LOB publishers*). An LOB developer (internal or external) can now publish these apps to Windows Store at your request, or you can obtain the app packages offline and distribute them through your MDM system. - To install Windows Store or LOB apps, use the Windows Store cloud service or your MDM system to distribute the app packages. Your MDM system can deploy apps online by redirecting the user to a licensed app in Windows Store or offline by distributing a package that you downloaded from Windows Store (also called *sideloading*) on Windows 10 Mobile devices. You can fully automate the app deployment process so that no user intervention is required. - IT administrators can obtain apps through Store for Business. Most apps can be distributed online, meaning that the user must be logged in to the device with an Azure AD account and have Internet access at the time of installation. To distribute an app offline, the developer must opt in. If the app developer doesn’t allow download of the app from Windows Store, then you must obtain the files directly from the developer or use the online method. See [Windows Store for Business](windows-store-for-business.md) for additional information about apps obtained through Store for Business. - Windows Store apps are automatically trusted. For custom LOB apps developed internally or by a trusted software vendor, ensure that the device trusts the app signing certificate. There are two ways to establish this trust: use a signing certificate from a trusted source, or generate your own signing certificate and add your chain of trust to the trusted certificates on the device. You can install up to 20 self-signed apps on a Windows 10 Mobile device. When you purchase a signing certificate from a public CA, you can install more than 20 apps on a device, although you can install more than 20 self-signed apps per device with [Windows 10 Mobile Enterprise](#mobile-edition). - Users can install apps from Windows Store that the organization purchases through the Store app on their device. If you allow your users to log in with a Microsoft account, the Store app on the device provides a unified method for installing personal and corporate apps. - ### Store for Business - [Windows Store for Business](http://go.microsoft.com/fwlink/p/?LinkId=722910) is a web portal that IT pros and purchasers use to find, acquire, manage, and distribute apps to Windows 10 devices. This online portal gives Azure AD authenticated managers access to Store for Business functionality and settings. Store managers can create a private section of Windows Store in which organizations can manage apps specific and private to them. Store for Business allows organizations to make apps available to their users and purchase app licenses for them. They can also integrate their Store for Business subscriptions with their MDM systems, so the MDM system can deploy apps from their free Store for Business subscription. - The process for using Store for Business is as follows: - 1. Create a Store for Business subscription for your organization. - 2. In the Store for Business portal, acquire apps from Windows Store (only free apps are available at this time). - 3. In Store for Business, distribute apps to users, and manage the app licenses for the apps acquired in the previous step. - 4. Integrate your MDM system with your organization’s Store for Business subscription. - 5. Use your MDM system to deploy the apps. - For more information about Store for Business, see [Windows Store for Business](windows-store-for-business.md). - ### Mobile application management (MAM) policies - With MDM, you can manage Device Guard on Windows 10 Mobile and create an allow (whitelist) or deny (blacklist) list of apps. This capability extends to built-in apps, as well, such as phone, text messaging, email, and calendar. The ability to allow or deny apps helps to ensure that people use their mobile devices for their intended purposes. - You can also control users’ access to Windows Store and whether the Store service updates apps automatically. You can manage all these capabilities through your MDM system. Table 18 lists the Windows 10 Mobile app management settings. - Table 18. Windows 10 Mobile app management settings - | Setting | Description | |------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Allow All Trusted Apps | Whether users can sideload apps on the device | @@ -1084,17 +866,11 @@ Table 18. Windows 10 Mobile app management settings | Restrict App Data To System Volume | Whether app data is allowed only on the system drive | | Restrict App To System Volume | Whether app installation is allowed only to the system drive | | Start screen layout | An XML blob used to configure the Start screen (See [Start layout for Windows 10 Mobile editions](http://go.microsoft.com/fwlink/p/?LinkId=734057) for more information.) | -   - One potential security issue is that users can register as Windows 10 Mobile app developers and turn on developer features on their device, potentially installing apps from unknown sources and opening the device to malware threats. To prevent users from turning on developer features on their devices, set the **Disable development unlock (side loading)** policy, which you can configure through your MDM system. - ### Microsoft Edge - MDM systems give you the ability to manage Microsoft Edge on mobile devices. Table 19 lists the Microsoft Edge settings for Windows 10 Mobile. - Table 19. Microsoft Edge settings for Windows 10 Mobile - | Setting | Description | |-------------------------------------------------|-------------------------------------------------------------------------------------------------------| | Allow Active Scripting | Whether active scripting is allowed | @@ -1111,32 +887,18 @@ Table 19. Microsoft Edge settings for Windows 10 Mobile | Include UNC Paths In Intranet Sites | Whether URL paths can represent Universal Naming Convention (UNC) paths in the Intranet security zone | | Intranet Sites | A list of the websites that are in the Intranet security zone | | Prevent Smart Screen Prompt Override For Files | Whether users can override the SmartScreen Filter warnings about downloading unverified files | -   - ## Device operations - - In this section, you learn how MDM settings in Windows 10 Mobile enable the following scenarios: - - [Device update](#device-update) - - [Device compliance monitoring](#device-comp) - - [Device inventory](#data-inv) - - [Remote assistance](#remote-assist) - - [Cloud services](#cloud-serv) - ### Device update - To help protect mobile devices and their data, you must keep those devices updated. Windows Update automatically installs updates and upgrades when they become available. - The device update features described in this section are available only in [Windows 10 Mobile Enterprise](#mobile-edition). You can use your MDM system to postpone system upgrades when you activate an Enterprise license on managed Windows 10 Mobile devices and control how updates and upgrades are applied. For example, you can disable updates altogether, defer updates and upgrades, and schedule the day and time to install updates, as you would with Windows Server Update Services (WSUS) on Windows 10 desktops running the [Current Branch for Business](introduction-to-windows-10-servicing.md). Table 20 lists the Windows 10 Mobile Enterprise settings that you can use to configure updates and upgrades. - Table 20. Windows 10 Mobile Enterprise update management settings - @@ -1207,13 +969,9 @@ Table 20. Windows 10 Mobile Enterprise update management settings
    -   - In addition to configuring how Windows 10 Mobile Enterprise obtains updates, you can manage individual Windows 10 Mobile updates. Table 21 provides information about approved updates to help you control the rollout of new updates to Windows 10 Mobile Enterprise devices. - Table 21. Windows 10 Mobile Enterprise approved update information - @@ -1269,47 +1027,26 @@ Table 21. Windows 10 Mobile Enterprise approved update information
    -   - ### Device compliance monitoring - You can use your MDM system to monitor compliance. Windows 10 Mobile provides audit information to track issues or perform remedial actions. This information helps you ensure that devices are configured to comply with organizational standards. - You can also assess the health of devices that run Windows 10 Mobile and take enterprise policy actions. The process that the health attestation feature in Windows 10 Mobile uses is as follows: - 1. The health attestation client collects data used to verify device health. - 2. The client forwards the data to the Health Attestation Service (HAS). - 3. The HAS generates a Health Attestation Certificate. - 4. The client forwards the Health Attestation Certificate and related information to the MDM system for verification. - For more information about health attestation in Windows 10 Mobile, see the [Windows 10 Mobile security guide](../keep-secure/windows-10-mobile-security-guide.md). - Depending on the results of the health state validation, an MDM system can take one of the following actions: - - Allow the device to access resources. - - Allow the device to access resources but identify the device for further investigation. - - Prevent the device from accessing resources. - Table 21 lists data points that the HAS collects and evaluates from devices that run Windows 10 Mobile to determine the action to perform. For most of these data points, the MDM system can take one of the following actions: - - Disallow all access. - - Disallow access to high-business-impact assets. - - Allow conditional access based on other data points that are present at evaluation time—for example, other attributes on the health certificate or a device’s past activities and trust history. - - Take one of the previous actions, and also place the device on a watch list to monitor it more closely for potential risks. - - Take corrective action, such as informing IT administrators to contact the owner and investigate the issue. - Table 21. Windows 10 Mobile HAS data points - | Data point | Description | |----------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Attestation Identity Key (AIK) present | Indicates that an AIK is present (in other words, the device can be trusted more than a device without an AIK). | @@ -1326,17 +1063,11 @@ Table 21. Windows 10 Mobile HAS data points | Code integrity version | Specifies the version of code that is performing integrity checks during the boot sequence. The HAS can check this version to determine whether the most current version of code is running, which is more secure (trusted). | | Secure Boot Configuration Policy (SBCP) present | Whether the hash of the custom SBCP is present. A device with an SBCP hash present is more trustworthy than a device without an SBCP hash. | | Boot cycle whitelist | The view of the host platform between boot cycles as defined by the manufacturer compared to a published whitelist. A device that complies with the whitelist is more trustworthy (secure) than a device that is noncompliant. | -   - ### Device inventory - Device inventory helps organizations better manage devices because it provides in-depth information about those devices. MDM systems collect inventory information remotely, and you can use the system’s reporting capabilities to analyze device resources and information. With this information, you can determine the current hardware and software resources of the device (for example, installed updates). - Table 22 lists examples of the Windows 10 Mobile software and hardware information that a device inventory provides. In addition to this information, the MDM system can read any of the configuration settings described in this guide. - Table 22. Windows 10 Mobile software and hardware inventory examples - | Setting | Description | |----------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Installed enterprise apps | List of the enterprise apps installed on the device | @@ -1357,116 +1088,63 @@ Table 22. Windows 10 Mobile software and hardware inventory examples | Wi-Fi DNS suffix and subnet mask | DNS suffix and IP subnet mask assigned to the Wi-Fi adapter in the device | | Secure Boot state | Indicates whether Secure Boot is enabled | | Enterprise encryption policy compliance | Indicates whether the device is encrypted | -   - ### Remote assistance - The remote assistance features in Windows 10 Mobile help resolve issues that users might encounter even when the help desk does not have physical access to the device. These features include: - - **Remote lock.** Support personnel can remotely lock a device. This ability can help when a user loses his or her mobile device and can retrieve it but not immediately (for example, leaving the device at a customer site). - - **Remote PIN reset.** Support personnel can remotely reset the PIN, which helps when users forget their PIN and are unable to access their device. No corporate or user data is lost, and users are able to gain access to their devices quickly. - - **Remote ring.** Support personnel can remotely make devices ring. This ability can help users locate misplaced devices and, in conjunction with the Remote Lock feature, help ensure that unauthorized users are unable to access the device if they find it. - - **Remote find.** Support personnel can remotely locate a device on a map, which helps identify the geographic location of the device. To configure Windows 10 Mobile remote find, use the settings in Table 23. The remote find feature returns the most current latitude, longitude, and altitude of the device. - These remote management features help organizations reduce the IT effort required to manage devices. They also help users quickly regain use of their device should they misplace it or forget the device password. - Table 23. Windows 10 Mobile remote find settings - | Setting | Description | |---------------------------|---------------------------------------------------------------------------------------------------------------------------------| | Desired location accuracy | The desired accuracy as a radius value in meters; has a value between 1 and 1,000 meters | | Maximum remote find | Maximum length of time in minutes that the server will accept a successful remote find; has a value between 0 and 1,000 minutes | | Remote find timeout | The number of seconds devices should wait for a remote find to finish; has a value between 0 and 1,800 seconds | -   - ### Cloud services - On mobile devices that run Windows 10 Mobile, users can easily connect to apps and data. As a result, they frequently connect to cloud services that provide user notifications and collect telemetry (usage data). Windows 10 Mobile enables organizations to manage how devices consume these cloud services. - **Manage push notifications** - The Windows Push Notification Services enable software developers to send toast, tile, badge, and raw updates from their cloud services. It provides a mechanism to deliver updates to users in a power-efficient and dependable way. - Push notifications can affect battery life, however, so the battery saver in Windows 10 Mobile limits background activity on the devices to extend battery life. Users can configure battery saver to turn on automatically when the battery drops below a set threshold. When battery saver is on, Windows 10 Mobile disables the receipt of push notifications to save energy. - There is an exception to this behavior, however. In Windows 10 Mobile, the **Always allowed** battery saver settings (found in the Settings app) allow apps to receive push notifications even when battery saver is on. Users can manually configure this list, or you can use the MDM system to configure it—that is, you can use the battery saver settings URI scheme in Windows 10 Mobile (**ms-settings:batterysaver-settings**) to configure these settings. - For more information about push notifications, see [Windows Push Notification Services (WNS) overview](http://go.microsoft.com/fwlink/p/?LinkId=734060). - **Manage telemetry** - As people use Windows 10 Mobile, it can collect performance and usage telemetry that helps Microsoft identify and troubleshoot problems as well as improve its products and services. Microsoft recommends that you select **Full** for this setting. - Microsoft employees, contractors, vendors, and partners might have access to relevant portions of the information that Windows 10 Mobile collects, but they are permitted to use the information only to repair or improve Microsoft products and services or third-party software and hardware designed for use with Microsoft products and services. - You can control the level of data that MDM systems collect. Table 24 lists the data levels that Windows 10 Mobile collects and provides a brief description of each. To configure devices, specify one of these levels in the **Allow Telemetry** setting. - Table 24. Windows 10 Mobile data collection levels - | Level of data | Description | |---------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Security | Collects only the information required to keep Windows 10 Mobile enterprise-grade secure, including information about telemetry client settings, the Malicious Software Removal Tool, and Windows Defender. This level is available only on Windows 10 Enterprise, Windows 10 Education, and Windows 10 IoT Core. For Windows 10 Mobile, this setting disables Windows 10 Mobile telemetry. | | Basic | Provides only the data vital to the operation of Windows 10 Mobile. This data level helps keep Windows 10 Mobile and apps running properly by letting Microsoft know the device’s capabilities, what’s installed, and whether Windows is operating correctly. This option also turns on basic error reporting back to Microsoft. By selecting this option, you allow Microsoft to provide updates through Windows Update, including malicious software protection through the Malicious Software Removal Tool. | | Enhanced | Includes all Basic data plus data about how users use Windows 10 Mobile, such as how frequently or how long they use certain features or apps and which apps they use most often. This option also lets operating system collect enhanced diagnostic information, such as the memory state of a device when a system or app crash occurs, and measure reliability of devices, the operating system, and apps. | | Full | Includes all Basic and Enhanced data and also turns on advanced diagnostic features that collect additional data from devices, such as system files or memory snapshots, which may unintentionally include parts of documents user are working on when a problem occurred. This information helps Microsoft further troubleshoot and fix problems. If an error report contains personal data, Microsoft does not use that information to identify, contact, or target advertising to users. | -   - ## Device retirement - - Device retirement (unenrollment) is the last phase of the device life cycle. Historically, mobile device retirement has been a complex and difficult process for organizations. When the organization no longer needs devices, it must remove (wipe) corporate data from them. BYOD scenarios make retirement even more complex because users expect their personal apps and data to remain untouched. Therefore, organizations must remove their data without affecting users’ data. - You can remotely remove all corporate data from devices that run Windows 10 Mobile without affecting existing user data (partial or enterprise wipe). The help desk or the devices’ users can initiate device retirement. When retirement is complete, Windows 10 Mobile returns the devices to a consumer state, as they were before enrollment. The following list summarizes the corporate data removed from a device when it’s retired: - - Email accounts - - Enterprise-issued certificates - - Network profiles - - Enterprise-deployed apps - - Any data associated with the enterprise-deployed apps - **Note**   All these features are in addition to the device’s software and hardware factory reset features, which users can use to restore devices to their factory configuration. -   - To specify whether users can delete the workplace account in Control Panel and unenroll from the MDM system, enable the **Allow Manual MDM Unenrollment** setting. Table 25 lists additional Windows 10 remote wipe settings that you can use the MDM system to configure. - Table 25. Windows 10 Mobile remote wipe settings - | Setting | Description | |-------------------------------|----------------------------------------------------------------------------------------------------------------------| | Wipe | Specifies that a remote wipe of the device should be performed | | Allow manual MDM unenrollment | Whether users are allowed to delete the workplace account (in other words, unenroll the device from the MDM system) | | Allow user to reset phone | Whether users are allowed to use Control Panel or hardware key combinations to return the device to factory defaults | -   - ## Related topics - - [Mobile device management](http://go.microsoft.com/fwlink/p/?LinkId=734050) - [Enterprise Mobility Suite](http://go.microsoft.com/fwlink/p/?LinkId=723984) - [Overview of Mobile Device Management for Office 365](http://go.microsoft.com/fwlink/p/?LinkId=734052) - [Windows Store for Business](http://go.microsoft.com/fwlink/p/?LinkId=722910) -   -   - - - - - diff --git a/windows/plan/chromebook-migration-guide.md b/windows/plan/chromebook-migration-guide.md index e56979fdef..53321a4c48 100644 --- a/windows/plan/chromebook-migration-guide.md +++ b/windows/plan/chromebook-migration-guide.md @@ -2,71 +2,41 @@ title: Chromebook migration guide (Windows 10) description: In this guide you will learn how to migrate a Google Chromebook-based learning environment to a Windows 10-based learning environment. ms.assetid: 7A1FA48A-C44A-4F59-B895-86D4D77F8BEA +ms.pagetype: edu; devices keywords: ["migrate", "automate", "device"] ms.prod: W10 ms.mktglfcycl: plan ms.sitesec: library author: craigash --- - # Chromebook migration guide - - **Applies to** - - Windows 10 - In this guide you will learn how to migrate a Google Chromebook-based learning environment to a Windows 10-based learning environment. You will learn how to perform the necessary planning steps, including Windows device deployment, migration of user and device settings, app migration or replacement, and cloud storage migration. You will then learn the best method to perform the migration by using automated deployment and migration tools. - ## Plan Chromebook migration - - Before you begin to migrate Chromebook devices, plan your migration. As with most projects, there can be an urge to immediately start doing before planning. When you plan your Chromebook migration before you perform the migration, you can save countless hours of frustration and mistakes during the migration process. - In the planning portion of this guide, you will identify all the decisions that you need to make and how to make each decision. At the end of the planning section, you will have a list of information you need to collect and what you need to do with the information. You will be ready to perform your Chromebook migration. - ## Plan for app migration or replacement - - App migration or replacement is an essential part of your Chromebook migration. In this section you will plan how you will migrate or replace Chromebook (Chrome OS) apps that are currently in use with the same or equivalent Windows apps. At the end of this section, you will have a list of the active Chrome OS apps and the Windows app counterparts. - **Identify the apps currently in use on Chromebook devices** - Before you can do any analysis or make decisions about which apps to migrate or replace, you need to identify which apps are currently in use on the Chromebook devices. You will create a list of apps that are currently in use (also called an app portfolio). - **Note**   The majority of Chromebook apps are web apps. For these apps you need to first perform Microsoft Edge compatibility testing and then publish the web app URL to the Windows users. For more information, see the [Perform app compatibility testing for web apps](#perform-testing-webapps) section. -   - You can divide the apps into the following categories: - - **Apps installed and managed by the institution.** These apps are typically managed in the Apps section in the Google Admin Console. You can record the list of these apps in your app portfolio. - - **Apps installed by faculty or students.** Faculty or students might have installed these apps as a part of a classroom curriculum. Obtain the list of these apps from faculty or students. Ensure you only record apps that are legitimately used as a part of classroom curriculum (and not for personal entertainment or use). - Record the following information about each app in your app portfolio: - - App name - - App type (such as offline app, online app, web app, and so on) - - App publisher or developer - - App version currently in use - - App priority (how necessary is the app to the day-to-day process of the institution or a classroom? Rank as high, medium, or low) - Throughout the entire app migration or replacement process, focus on the higher priority apps. Focus on lower priority apps only after you have determined what you will do with the higher priority apps. - ### - **Select Google Apps replacements** - Table 1 lists the Windows device app replacements for the common Google Apps on Chromebook devices. If your users rely on any of these Google Apps, use the corresponding app on the Windows device. Use the information in Table 1 to select the Google App replacement on a Windows device. - Table 1. Google App replacements - | If you use this Google app on a Chromebook | Use this app on a Windows device | |--------------------------------------------|--------------------------------------| | Google Docs | Word 2016 or Word Online | @@ -76,50 +46,27 @@ Table 1. Google App replacements | Google Hangouts | Microsoft Skype for Business | | Chrome | Microsoft Edge | | Google Drive | Microsoft OneDrive for Business | -   - It may be that you will decide to replace Google Apps after you deploy Windows devices. For more information on making this decision, see the [Select cloud services migration strategy](#select-cs-migrationstrat) section of this guide. - **Find the same or similar apps in the Windows Store** - In many instances, software vendors will create a version of their app for multiple platforms. You can search the Windows Store to find the same or similar apps to any apps not identified in the [Select Google Apps replacements](#select-googleapps) section. - In other instances, the offline app does not have a version written for the Windows Store or is not a web app. In these cases, look for an app that provides similar functions. For example, you might have a graphing calculator offline Android app published on the Chrome OS, but the software publisher does not have a version for Windows devices. Search the Windows Store for a graphing calculator app that provides similar features and functionality. Use that Windows Store app as a replacement for the graphing calculator offline Android app published on the Chrome OS. - Record the Windows app that replaces the Chromebook app in your app portfolio. - ### - **Perform app compatibility testing for web apps** - The majority of Chromebook apps are web apps. Because you cannot run native offline Chromebook apps on a Windows device, there is no reason to perform app compatibility testing for offline Chromebook apps. However, you may have a number of web apps that will run on both platforms. - Ensure that you test these web apps in Microsoft Edge. Record the level of compatibility for each web app in Microsoft Edge in your app portfolio. - ## Plan for migration of user and device settings - - Some institutions have configured the Chromebook devices to make the devices easier to use by using the Google Chrome Admin Console. You have also probably configured the Chromebook devices to help ensure the user data access and ensure that the devices themselves are secure by using the Google Chrome Admin Console. - However, in addition to your centralized configuration in the Google Admin Console, Chromebook users have probably customized their device. In some instances, users may have changed the web content that is displayed when the Chrome browser starts. Or they may have bookmarked websites for future reference. Or users may have installed apps for use in the classroom. - In this section, you will identify the user and device configuration settings for your Chromebook users and devices. Then you will prioritize these settings to focus on the configuration settings that are essential to your educational institution. - At the end of this section, you should have a list of Chromebook user and device settings that you want to migrate to Windows, as well as a level of priority for each setting. You may discover at the end of this section that you have few or no higher priority settings to be migrated. If this is the case, you can skip the [Perform migration of user and device settings](#migrate-user-device-settings) section of this guide. - **Identify Google Admin Console settings to migrate** - You use the Google Admin Console (as shown in Figure 1) to manage user and device settings. These settings are applied to all the Chromebook devices in your institution that are enrolled in the Google Admin Console. Review the user and device settings in the Google Admin Console and determine which settings are appropriate for your Windows devices. - ![figure 1](images/chromebook-fig1-googleadmin.png) - Figure 1. Google Admin Console - Table 2 lists the settings in the Device Management node in the Google Admin Console. Review the settings and determine which settings you will migrate to Windows. - Table 2. Settings in the Device Management node in the Google Admin Console - @@ -166,13 +113,9 @@ Table 2. Settings in the Device Management node in the Google Admin Console
    -   - Table 3 lists the settings in the Security node in the Google Admin Console. Review the settings and determine which settings you will migrate to Windows. - Table 3. Settings in the Security node in the Google Admin Console - @@ -208,19 +151,12 @@ Table 3. Settings in the Security node in the Google Admin Console
    -   - **Identify locally-configured settings to migrate** - In addition to the settings configured in the Google Admin Console, users may have locally configured their devices based on their own personal preferences (as shown in Figure 2). Table 4 lists the Chromebook user and device settings that you can locally configure. Review the settings and determine which settings you will migrate to Windows. Some of the settings listed in Table 4 can only be seen when you click the **Show advanced settings** link (as shown in Figure 2). - ![figure 2](images/fig2-locallyconfig.png) - Figure 2. Locally-configured settings on Chromebook - Table 4. Locally-configured settings - | Section | Settings | |------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Internet connections | These settings configure the Internet connection for the devices, such as Wi-Fi and VPN connections. Record the network connection currently in use and configure the Windows device to use the same network connection settings. | @@ -241,187 +177,94 @@ Table 4. Locally-configured settings | Accessibility | These settings configure the Chromebook ease of use (such as display of large mouse cursor, use of high contrast mode, enablement of the screen magnifier, and so on). Record these settings and configure the Windows device with similar settings. | | Powerwash | This action removes all user accounts and resets the Chromebook device back to factory settings. You don’t have to migrate any settings in this section. | | Reset settings | This action retains all user accounts, but restores all settings back to their default values. You don’t have to migrate any settings in this section. | -   - Determine how many users have similar settings and then consider managing those settings centrally. For example, a large number of users may have many of the same Chrome web browser settings. You can centrally manage these settings in Windows after migration. - Also, as a part of this planning process, consider settings that may not be currently managed centrally, but should be managed centrally. Record the settings that are currently being locally managed, but you want to manage centrally after the migration. - **Prioritize settings to migrate** - After you have collected all the Chromebook user, app, and device settings that you want to migrate, you need to prioritize each setting. Evaluate each setting and assign a priority to the setting based on the levels of high, medium, and low. - Assign the setting-migration priority based on how critical the setting is to the faculty performing their day-to-day tasks and how the setting affects the curriculum in the classrooms. Focus on the migration of higher priority settings and put less effort into the migration of lower priority settings. There may be some settings that are not necessary at all and can be dropped from your list of settings entirely. Record the setting priority in the list of settings you plan to migrate. - ## Plan for email migration - - Many of your users may be using Google Apps Gmail to manage their email, calendars, and contacts. You need to create the list of users you will migrate and the best time to perform the migration. - Office 365 supports automated migration from Google Apps Gmail to Office 365. For more information, see [Migrate Google Apps mailboxes to Office 365](http://go.microsoft.com/fwlink/p/?LinkId=690252). - **Identify the list of user mailboxes to migrate** - In regards to creating the list of users you will migrate, it might seem that the answer “all the users” might be the best one. However, depending on the time you select for migration, only a subset of the users may need to be migrated. For example, you may not persist student email accounts between semesters or between academic years. In this case you would only need to migrate faculty and staff. - Also, when you perform a migration it is a great time to verify that all user mailboxes are active. In many environments there are a significant number of mailboxes that were provisioned for users that are no longer a part of the institution (such as interns or student assistants). You can eliminate these users from your list of user mailboxes to migrate. - Create your list of user mailboxes to migrate in Excel 2016 based on the format described in step 7 in [Create a list of Gmail mailboxes to migrate](http://go.microsoft.com/fwlink/p/?LinkId=690253). If you follow this format, you can use the Microsoft Excel spreadsheet to perform the actual migration later in the process. - **Identify companion devices that access Google Apps Gmail** - In addition to Chromebook devices, users may have companion devices (smartphones, tablets, desktops, laptops, and so on) that also access the Google Apps Gmail mailbox. You will need to identify those companion devices and identify the proper configuration for those devices to access Office 365 mailboxes. - After you have identified each companion device, verify the settings for the device that are used to access Office 365. You only need to test one type of each companion device. For example, if users use Android phones to access Google Apps Gmail mailboxes, configure the device to access Office 365 and then record those settings. You can publish those settings on a website or to your helpdesk staff so that users will know how to access their Office 365 mailbox. - In most instances, users will only need to provide in their Office 365 email account and password. However, you should verify this on each type of companion device. For more information about how to configure a companion device to work with Office 365, see [Compare how different mobile devices work with Office 365](http://go.microsoft.com/fwlink/p/?LinkId=690254). - **Identify the optimal timing for the migration** - Typically, the best time to perform the migration is between academic years or during semester breaks. Select the time of least activity for your institution. And during that time, the optimal time to perform the migration might be during an evening or over a weekend. - Ensure that you communicate the time the migration will occur to your users well in advance. Also, ensure that users know how to access their Office 365 email after the migration is complete. Finally, ensure that your users know how to perform the common tasks they performed in Google Apps Gmail in Office 365 and/or Outlook 2016. - ## Plan for cloud storage migration - - Chromebook devices have limited local storage. So, most of your users will store data in cloud storage, such as Google Drive. You will need to plan how to migrate your cloud storage as a part of the Chromebook migration process. - In this section, you will create a list of the existing cloud services, select the Microsoft cloud services that best meet your needs, and then optimize your cloud storage services migration plan. - **Identify cloud storage services currently in use** - Typically, most Chromebook users use Google Drive for cloud storage services because your educational institution purchased other Google cloud services and Google Drive is a part of those services. However, some users may use cloud storage services from other vendors. For each member of your faculty and staff and for each student, create a list of cloud storage services that includes the following: - - Name of the cloud storage service - - Cloud storage service vendor - - Associated licensing costs or fees - - Approximate storage currently in use per user - Use this information as the requirements for your cloud storage services after you migrate to Windows devices. If at the end of this discovery you determine there is no essential data being stored in cloud storage services that requires migration, then you can skip to the [Plan for cloud services migration](#plan-cloud-services) section. - **Optimize cloud storage services migration plan** - Now that you know the current cloud storage services configuration, you need to optimize your cloud storage services migration plan for Microsoft OneDrive for Business. Optimization helps ensure that your use only the cloud storage services resources that are necessary for your requirements. - Consider the following to help optimize your cloud storage services migration plan: - - **Eliminate inactive user storage.** Before you perform the cloud storage services migration, identify cloud storage that is currently allocated to inactive users. Remove this storage from your list of cloud storage to migrate. - - **Eliminate or archive inactive files.** Review cloud storage to identify files that are inactive (have not been accessed for some period of time). Eliminate or archive these files so that they do not consume cloud storage. - - **Consolidate cloud storage services.** If multiple cloud storage services are in use, reduce the number of cloud storage services and standardize on one cloud storage service. This will help reduce management complexity, support time, and typically will reduce cloud storage costs. - Record your optimization changes in your cloud storage services migration plan. - ## Plan for cloud services migration - - Many of your users may use cloud services on their Chromebook device, such as Google Apps, Google Drive, or Google Apps Gmail. You have planned for these individual cloud services in the [Plan for app migration or replacement](#plan-app-migrate-replace), [Plan for Google Apps Gmail to Office 365 migration](#plan-email-migrate), and [Plan for cloud storage migration](#plan-cloud-storage-migration) sections. - In this section, you will create a combined list of these cloud services and then select the appropriate strategy to migrate these cloud services. - ### - **Identify cloud services currently in use** - You have already identified the individual cloud services that are currently in use in your educational institution in the [Plan for app migration or replacement](#plan-app-migrate-replace), [Plan for Google Apps Gmail to Office 365 migration](#plan-email-migrate), and [Plan for cloud storage migration](#plan-cloud-storage-migration) sections. Create a unified list of these cloud services and record the following about each service: - - Cloud service name - - Cloud service provider - - Number of users that use the cloud service - **Select cloud services to migrate** - One of the first questions you should ask after you identify the cloud services currently in use is, “Why do we need to migrate from these cloud services?” The answer to this question largely comes down to finances and features. - Here is a list of reasons that describe why you might want to migrate from an existing cloud service to Microsoft cloud services: - - **Better integration with Office 365.** If your long-term strategy is to migrate to Office 365 apps (such as Word 2016 or Excel 2016) then a migration to Microsoft cloud services will provide better integration with these apps. The use of existing cloud services may not be as intuitive for users. For example, Office 365 apps will integrate better with OneDrive for Business compared to Google Drive. - - **Online apps offer better document compatibility.** Microsoft Office online apps (such as Word Online and Excel Online) provide the highest level of compatibility with Microsoft Office documents. The Office online apps allow you to open and edit documents directly from SharePoint or OneDrive for Business. Users can access the Office online app from any device with Internet connectivity. - - **Reduce licensing costs.** If you pay for Office 365 licenses, then Office 365 apps and cloud storage are included in those licenses. Although you could keep existing cloud services, you probably would pay more to keep those services. - - **Improve storage capacity and cross-platform features.** Microsoft cloud services provide competitive storage capacity and provide more Windows-centric features than other cloud services providers. While the Microsoft cloud services user experience is highly optimized for Windows devices, Microsoft cloud services are also highly optimized for companion devices (such as iOS or Android devices). - Review the list of existing cloud services that you created in the [Identify cloud services currently in use](#identify-cloud-services-inuse) section and identify the cloud services that you want to migrate to Microsoft cloud services. If you determine at the end of this task that there are no cloud services to be migrated, then skip to the [Plan for Windows device deployment](#plan-windevice-deploy) section. Also, skip the [Perform cloud services migration](#perform-cloud-services-migration) section later in this guide. - **Prioritize cloud services** - After you have created your aggregated list of cloud services currently in use by Chromebook users, prioritize each cloud service. Evaluate each cloud service and assign a priority based on the levels of high, medium, and low. - Assign the priority based on how critical the cloud service is to the faculty and staff performing their day-to-day tasks and how the cloud service affects the curriculum in the classrooms. Also, make cloud services that are causing pain for the users a higher priority. For example, if users experience outages with a specific cloud service, then make migration of that cloud service a higher priority. - Focus on the migration of higher priority cloud services first and put less effort into the migration of lower priority cloud services. There may be some cloud services that are unnecessary and you can remove them from your list of cloud services to migrate entirely. Record the cloud service migration priority in the list of cloud services you plan to migrate. - ### - **Select cloud services migration strategy** - When you deploy the Windows devices, should you migrate the faculty, staff, and students to the new cloud services? Perhaps. But, in most instances you will want to select a migration strategy that introduces a number of small changes over a period of time. - Consider the following when you create your cloud services migration strategy: - - **Introduce small changes.** The move from Chrome OS to Windows will be simple for most users as most will have exposure to Windows from home, friends, or family. However, users may not be as familiar with the apps or cloud services. Consider the move to Windows first, and then make other changes as time progresses. - - **Start off by using existing apps and cloud services.** Immediately after the migration to Windows devices, you may want to consider running the existing apps and cloud services (such Google Apps, Google Apps Gmail, and Google Drive). This gives users a familiar method to perform their day-to-day tasks. - - **Resolve pain points.** If some existing apps or cloud services cause problems, you may want to migrate them sooner rather than later. In most instances, users will be happy to go through the learning curve of a new app or cloud service if it is more reliable or intuitive for them to use. - - **Migrate classrooms or users with common curriculum.** Migrate to Windows devices for an entire classroom or for multiple classrooms that share common curriculum. You must ensure that the necessary apps and cloud services are available for the curriculum prior to the migration of one or more classrooms. - - **Migrate when the fewest number of active users are affected.** Migrate your cloud services at the end of an academic year or end of a semester. This will ensure you have minimal impact on faculty, staff, and students. Also, a migration during this time will minimize the learning curve for users as they are probably dealing with new curriculum for the next semester. Also, you may not need to migrate student apps and data because many educational institutions do not preserve data between semesters or academic years. - - **Overlap existing and new cloud services.** For faculty and staff, consider overlapping the existing and new cloud services (having both services available) for one business cycle (end of semester or academic year) after migration. This allows you to easily recover any data that might not have migrated successfully from the existing cloud services. At a minimum, overlap the user of existing and new cloud services until the user can verify the migration. Of course, the tradeoff for using this strategy is the cost of the existing cloud services. However, depending on when license renewal occurs, the cost may be minimal. - ## Plan for Windows device deployment - - You need to plan for Windows device deployment to help ensure that the devices are successfully installed and configured to replace the Chromebook devices. Even if the vendor that provides the devices pre-loads Windows 10 on them, you still will need to perform other tasks. - In this section you will select a Windows device deployment strategy; plan for Active Directory Domain Services (AD DS) and Azure AD services; plan for device, user, and app management; and plan for any necessary network infrastructure remediation. - ### - **Select a Windows device deployment strategy** - What decisions need to be made about Windows device deployment? You just put the device on a desk, hook up power, connect to Wi-Fi, and then let the users operate the device, right? That is essentially correct, but depending on the extent of your deployment and other factors, you need to consider different deployment strategies. - For each classroom that has Chromebook devices, select a combination of the following device deployment strategies: - - **Deploy one classroom at a time.** In most cases you will want to perform your deployment in batches of devices and a classroom is an excellent way to batch devices. You can treat each classroom as a unit and check each classroom off your list after you have deployed the devices. - - **Deploy based on curriculum.** Deploy the Windows devices after you have confirmed that the curriculum is ready for the Windows devices. If you deploy Windows devices without the curriculum installed and tested, you could significantly reduce the ability for students and teachers to perform effectively in the classroom. Also, deployment based on curriculum has the advantage of letting you move from classroom to classroom quickly if multiple classrooms use the same curriculum. - - **Deploy side-by-side.** In some instances you may need to have both the Chromebook and Windows devices in one or more classrooms. You can use this strategy if some of the curriculum only works on Chromebook and other parts of the curriculum works on Windows devices. This is a good method to help prevent delays in Windows device deployment, while ensuring that students and teachers can make optimal use of technology in their curriculum. - - **Deploy after apps and cloud services migration.** If you deploy a Windows device without the necessary apps and cloud services to support the curriculum, this provides only a portion of your complete solution. Ensure that the apps and cloud services are tested, provisioned, and ready for use prior to the deployment of Windows devices. - - **Deploy after the migration of user and device settings.** Ensure that you have identified the user and device settings that you plan to migrate and that those settings are ready to be applied to the new Windows devices. For example, you would want to create Group Policy Objects (GPOs) to apply the user and device settings to Windows devices. - If you ensure that Windows devices closely mirror the Chromebook device configuration, you will ease user learning curve and create a sense of familiarity. Also, when you have the settings ready to be applied to the devices, it helps ensure you will deploy your new Windows devices in a secure configuration. - Record the combination of Windows device deployment strategies that you selected. - ### - **Plan for AD DS and Azure AD services** - The next decision you will need to make concerns AD DS and Azure AD services. You can run AD DS on-premises, in the cloud by using Azure AD, or a combination of both (hybrid). The decision about which of these options is best is closely tied to how you will manage your users, apps, and devices and if you will use Office 365 and other Azure-based cloud services. - In the hybrid configuration, your on-premises AD DS user and group objects are synchronized with Azure AD (including passwords). The synchronization happens both directions so that changes are made in both your on-premises AD DS and Azure AD. - Table 5 is a decision matrix that helps you decide if you can use only on-premises AD DS, only Azure AD, or a combination of both (hybrid). If the requirements you select from the table require on-premises AD DS and Azure AD, then you should select hybrid. For example, if you plan to use Office 365 and use Group Policy for management, then you would select hybrid. However, if you plan to use Office 365 and use Intune for management, then you would select only Azure AD. - Table 5. Select on-premises AD DS, Azure AD, or hybrid - @@ -476,21 +319,13 @@ Table 5. Select on-premises AD DS, Azure AD, or hybrid
    -   - ### - **Plan device, user, and app management** - You may ask the question, “Why plan for device, user, and app management before you deploy the device?” The answer is that you will only deploy the device once, but you will manage the device throughout the remainder of the device's lifecycle. - Also, planning management before deployment is essential to being ready to support the devices as you deploy them. You want to have your management processes and technology in place when the first teachers, facility, or students start using their new Windows device. - Table 6 is a decision matrix that lists the device, user, and app management products and technologies and the features supported by each product or technology. The primary device, user, and app management products and technologies include Group Policy, System Center Configuration Manager, Intune, and the Microsoft Deployment Toolkit (MDT). Use this decision matrix to help you select the right combination of products and technologies for your plan. - Table 6. Device, user, and app management products and technologies - @@ -596,69 +431,36 @@ Table 6. Device, user, and app management products and technologies
    -   - You can use Configuration Manager and Intune in conjunction with each other to provide features from both products and technologies. In some instances you may need only one of these products or technologies. In other instances, you may need two or more to meet the device, user, and app management needs for your institution. - Record the device, user, and app management products and technologies that you selected. - ### - **Plan network infrastructure remediation** - In addition to AD DS, Azure AD, and management components, there are other network infrastructure services that Windows devices need. In most instances, Windows devices have the same network infrastructure requirements as the existing Chromebook devices. - Examine each of the following network infrastructure technologies and services and determine if any remediation is necessary: - - **Domain Name System (DNS)** provides translation between a device name and its associated IP address. For Chromebook devices, public facing, Internet DNS services are the most important. For Windows devices that only access the Internet, they have the same requirements. - However, if you intend to communicate between Windows devices (peer-to-peer or client/server) then you will need local DNS services. Windows devices will register their name and IP address with the local DNS services so that Windows devices can locate each other. - - **Dynamic Host Configuration Protocol (DHCP)** provides automatic IP configuration for devices. Your existing Chromebook devices probably use DHCP for configuration. If you plan to immediately replace the Chromebook devices with Windows devices, then you only need to release all the DHCP reservations for the Chromebook devices prior to the deployment of Windows devices. - If you plan to run Chromebook and Windows devices side-by-side, then you need to ensure that your DHCP service has adequate IP addresses available for both sets of devices. - - **Wi-Fi.** Chromebook devices are designed to connect to Wi-Fi networks. Windows devices are the same. Your existing Wi-Fi network for the Chromebook devices should be adequate for the same number of Windows devices. - If you plan to significantly increase the number of Windows devices or you plan to run Chromebook and Windows devices side-by-side, then you need to ensure that Wi-Fi network can support the number of devices. - - **Internet bandwidth.** Chromebook devices consume more Internet bandwidth (up to 700 times more) than Windows devices. This means that if your existing Internet bandwidth is adequate for the Chromebook devices, then the bandwidth will be more than adequate for Windows devices. - However, if you plan to significantly increase the number of Windows devices or you plan to run Chromebook and Windows devices side-by-side, then you need to ensure that your Internet connection can support the number of devices. - For more information that compares Internet bandwidth consumption for Chromebook and Windows devices, see the following resources: - - [Chromebook vs. Windows Notebook Network Traffic Analysis](http://go.microsoft.com/fwlink/p/?LinkId=690255) - - [Hidden Cost of Chromebook Deployments](http://go.microsoft.com/fwlink/p/?LinkId=690256) - - [Microsoft Windows 8.1 Notebook vs. Chromebooks for Education](http://go.microsoft.com/fwlink/p/?LinkId=690257) - - **Power.** Although not specifically a network infrastructure, you need to ensure your classrooms have adequate power. Chromebook and Windows devices should consume similar amounts of power. This means that your existing power outlets should support the same number of Windows devices. - If you plan to significantly increase the number of Windows devices or you plan to run Chromebook and Windows devices side-by-side, you need to ensure that the power outlets, power strips, and other power management components can support the number of devices. - At the end of this process, you may determine that no network infrastructure remediation is necessary. If so, you can skip the [Perform network infrastructure remediation](#network-infra-remediation) section of this guide. - ## Perform Chromebook migration - - Thus far, planning has been the primary focus. Believe it or not most of the work is now done. The rest of the Chromebook migration is just the implementation of the plan you have created. - In this section you will perform the necessary steps for the Chromebook device migration. You will perform the migration based on the planning decision that you made in the [Plan Chromebook migration](#plan-migration) section earlier in this guide. - You must perform some of the steps in this section in a specific sequence. Each section has guidance about when to perform a step. You can perform other steps before, during, or after the migration. Again, each section will tell you if the sequence is important. - ## Perform network infrastructure remediation - - The first migration task is to perform any network infrastructure remediation. In the [Plan network infrastructure remediation](#plan-network-infra-remediation) section, you determined the network infrastructure remediation (if any) that you needed to perform. - It is important that you perform any network infrastructure remediation first because the remaining migration steps are dependent on the network infrastructure. Table 7 lists the Microsoft network infrastructure products and technologies and deployment resources for each. - Table 7. Network infrastructure products and technologies and deployment resources - @@ -687,20 +489,12 @@ Table 7. Network infrastructure products and technologies and deployment resourc
    -   - If you use network infrastructure products and technologies from other vendors, refer to the vendor documentation on how to perform the necessary remediation. If you determined that no remediation is necessary, you can skip this section. - ## Perform AD DS and Azure AD services deployment or remediation - - It is important that you perform AD DS and Azure AD services deployment or remediation right after you finish network infrastructure remediation. Many of the remaining migration steps are dependent on you having your identity system (AD DS or Azure AD) in place and up to necessary expectations. - In the [Plan for Active Directory services](#plan-adservices) section, you determined the AD DS and/or Azure AD deployment or remediation (if any) that needed to be performed. Table 8 list AD DS, Azure AD, and the deployment resources for both. Use the resources in this table to deploy or remediate on-premises AD DS, Azure AD, or both. - Table 8. AD DS, Azure AD and deployment resources - @@ -730,20 +524,12 @@ Table 8. AD DS, Azure AD and deployment resources
    -   - If you decided not to migrate to AD DS or Azure AD as a part of the migration, or if you determined that no remediation is necessary, you can skip this section. If you use identity products and technologies from another vendor, refer to the vendor documentation on how to perform the necessary steps. - ## Prepare device, user, and app management systems - - In the [Plan device, user, and app management](#plan-userdevapp-manage) section of this guide, you selected the products and technologies that you will use to manage devices, users, and apps on Windows devices. You need to prepare your management systems prior to Windows 10 device deployment. You will use these management systems to manage the user and device settings that you selected to migrate in the [Plan for migration of user and device settings](#plan-migrate-user-device-settings) section. You need to prepare these systems prior to the migration of user and device settings. - Table 9 lists the Microsoft management systems and the deployment resources for each. Use the resources in this table to prepare (deploy or remediate) these management systems. - Table 9. Management systems and deployment resources - @@ -795,20 +581,12 @@ Table 9. Management systems and deployment resources
    -   - If you determined that no new management system or no remediation of existing systems is necessary, you can skip this section. If you use a management system from another vendor, refer to the vendor documentation on how to perform the necessary steps. - ## Perform app migration or replacement - - In the [Plan for app migration or replacement](#plan-app-migrate-replace) section, you identified the apps currently in use on Chromebook devices and selected the Windows apps that will replace the Chromebook apps. You also performed app compatibility testing for web apps to ensure that web apps on the Chromebook devices would run on Microsoft Edge and Internet Explorer. - In this step, you need to configure your management system to deploy the apps to the appropriate Windows users and devices. Table 10 lists the Microsoft management systems and the app deployment resources for each. Use the resources in this table to configure these management systems to deploy the apps that you selected in the [Plan for app migration or replacement](#plan-app-migrate-replace) section of this guide. - Table 10. Management systems and app deployment resources - @@ -845,118 +623,55 @@ Table 10. Management systems and app deployment resources
    -   - If you determined that no deployment of apps is necessary, you can skip this section. If you use a management system from another vendor, refer to the vendor documentation on how to perform the necessary steps. - ## Perform migration of user and device settings - - In the [Plan for migration of user and device settings](#plan-migrate-user-device-settings) section, you determined the user and device settings that you want to migrate. You selected settings that are configured in the Google Admin Console and locally on the Chromebook device. - Perform the user and device setting migration by using the following steps: - 1. From the list of institution-wide settings that you created in the [Plan for migration of user and device settings](#plan-migrate-user-device-settings) section, configure as many as possible in your management system (such as Group Policy, Configuration Manager, or Intune). - 2. From the list of device-specific settings that you created in the [Plan for migration of user and device settings](#plan-migrate-user-device-settings) section, configure device-specific setting for higher priority settings. - 3. From the list of user-specific settings that you created in the [Plan for migration of user and device settings](#plan-migrate-user-device-settings) section, configure user-specific setting for higher priority settings. - 4. Verify that all higher-priority user and device settings have been configured in your management system. - If you do no want to migrate any user or device settings from the Chromebook devices to the Windows devices, you can skip this section. - ## Perform email migration - - In the [Plan for email migration](#plan-email-migrate) section, you identified the user mailboxes to migrate, identified the companion devices that access Google Apps Gmail, and identified the optimal timing for migration. You can perform this migration before or after you deploy the Windows devices. - Office 365 supports automated migration from Google Apps Gmail to Office 365. For more information on how to automate the migration from Google Apps Gmail to Office 365, see [Migrate Google Apps mailboxes to Office 365](http://go.microsoft.com/fwlink/p/?LinkId=690252). - Alternatively, if you want to migrate to Office 365 from: - - **On-premises Microsoft Exchange Server.** Use the following resources to migrate to Office 365 from an on-premises Microsoft Exchange Server: - - [Cutover Exchange Migration and Single Sign-On](http://go.microsoft.com/fwlink/p/?LinkId=690266) - - [Step-By-Step: Migration of Exchange 2003 Server to Office 365](http://go.microsoft.com/fwlink/p/?LinkId=690267) - - [Step-By-Step: Migrating from Exchange 2007 to Office 365](http://go.microsoft.com/fwlink/p/?LinkId=690268) - - **Another on-premises or cloud-based email service.** Follow the guidance from that vendor. - ## Perform cloud storage migration - - In the [Plan for cloud storage migration](#plan-cloud-storage-migration) section, you identified the cloud storage services currently in use, selected the Microsoft cloud storage services that you will use, and optimized your cloud storage services migration plan. You can perform the cloud storage migration before or after you deploy the Windows devices. - Manually migrate the cloud storage migration by using the following steps: - 1. Install both Google Drive app and OneDrive for Business or OneDrive app on a device. - 2. Sign in as the user in the Google Drive app. - 3. Sign in as the user in the OneDrive for Business or OneDrive app. - 4. Copy the data from the Google Drive storage to the OneDrive for Business or OneDrive storage. - 5. Optionally uninstall the Google Drive app. - There are also a number of software vendors who provide software that helps automate the migration from Google Drive to OneDrive for Business, Office 365 SharePoint, or OneDrive. For more information about these automated migration tools, contact the vendors. - ## Perform cloud services migration - - In the [Plan for cloud services migration](#plan-cloud-services)section, you identified the cloud services currently in use, selected the cloud services that you want to migrate, prioritized the cloud services to migrate, and then selected the cloud services migration strategy. You can perform the cloud services migration before or after you deploy the Windows devices. - Migrate the cloud services that you currently use to the Microsoft cloud services that you selected. For example, you could migrate from a collaboration website to Office 365 SharePoint. Perform the cloud services migration based on the existing cloud services and the Microsoft cloud services that you selected. - There are also a number of software vendors who provide software that helps automate the migration from other cloud services to Microsoft cloud services. For more information about these automated migration tools, contact the vendors. - ## Perform Windows device deployment - - In the [Select a Windows device deployment strategy](#select-windows-device-deploy) section, you selected how you wanted to deploy Windows 10 devices. The other migration task that you designed in the [Plan for Windows device deployment](#plan-windevice-deploy) section have already been performed. Now it's time to deploy the actual devices. - For example, if you selected to deploy Windows devices by each classroom, start with the first classroom and then proceed through all of the classrooms until you’ve deployed all Windows devices. - In some instances, you may receive the devices with Windows 10 already deployed, and want to use provisioning packages. In other cases, you may have a custom Windows 10 image that you want to deploy to the devices by using Configuration Manager and/or MDT. For information on how to deploy Windows 10 images to the devices, see the following resources: - - [Windows Imaging and Configuration Designer](http://go.microsoft.com/fwlink/p/?LinkId=733911) - - [Build and apply a provisioning package](http://go.microsoft.com/fwlink/p/?LinkId=733918) - - [MDT documentation in the Microsoft Deployment Toolkit (MDT) 2013](http://go.microsoft.com/fwlink/p/?LinkId=690324) - - [Step-By-Step: Installing Windows 8.1 From A USB Key](http://go.microsoft.com/fwlink/p/?LinkId=690265) - - [Operating System Deployment in Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=733916) - In addition to the Windows 10 image deployment, you may need to perform the following tasks as a part of device deployment: - - Enroll the device with your management system. - - Ensure that Windows Defender is enabled and configured to receive updates. - - Ensure that Windows Update is enabled and configured to receive updates. - - Deploy any apps that you want the user to immediately be able to access when they start the device (such as Word 2016 or Excel 2016). - After you complete these steps, your management system should take over the day-to-day maintenance tasks for the Windows 10 devices. Verify that the user and device settings migrated correctly as you deploy each batch of Windows 10 devices. Continue this process until you deploy all Windows 10 devices. - ## Related topics - - [Try it out: Windows 10 deployment (for education)](http://go.microsoft.com/fwlink/p/?LinkId=623254) - [Try it out: Windows 10 in the classroom](http://go.microsoft.com/fwlink/p/?LinkId=623255) -   -   - - - - - diff --git a/windows/plan/integration-with-management-solutions-.md b/windows/plan/integration-with-management-solutions-.md index 195b8d4828..a08986d154 100644 --- a/windows/plan/integration-with-management-solutions-.md +++ b/windows/plan/integration-with-management-solutions-.md @@ -2,68 +2,35 @@ title: Integration with management solutions (Windows 10) description: You can integrate Windows Update for Business deployments with existing management tools such as Windows Server Update Services (WSUS), System Center Configuration Manager, and Microsoft Intune. ms.assetid: E0CB0CD3-4FE1-46BF-BA6F-5A5A8BD14CC9 +ms.pagetype: servicing; devices keywords: ["update", "upgrade", "deployment", "manage", "tools"] ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library author: TrudyHa --- - # Integration with management solutions - - **Applies to** - - Windows 10 - You can integrate Windows Update for Business deployments with existing management tools such as Windows Server Update Services (WSUS), System Center Configuration Manager, and Microsoft Intune. - ## System Center Configuration Manager - - For Windows 10, version 1511, organizations that already manage their systems with Configuration Manager can also have their devices configured for Windows Update for Business (in other words, set deferral policies on those machines). For Windows 10, version 1511, such devices will be visible in the Configuration Manager console, however they will appear with a detection state of “Unknown”. - ![figure 1](images/wuforbusiness-fig10-sccmconsole.png) - ## WSUS standalone - - For Windows 10, version 1511, you cannot configure devices for both Windows Update for Business *and* to receive updates from WSUS. If both group policies are set (for both deferrals as well as WSUS scanning), Windows Update for Business settings will NOT be respected and devices will continue to scan against WSUS. - ## Enterprise Mobility Suite: Intune - - You can configure Windows Update for Business by using MDM policy. To configure Windows Update for Business with Intune: - 1. Create a new Windows 10 custom policy. (Add a policy, and choose **Custom Configuration for Windows 10 Desktop and phone…**). - ![figure 2](images/wuforbusiness-fig11-intune.png) - 2. Configure the device to Consumer Branch for Business by selecting to defer upgrades (as described in [Setup and deployment](setup-and-deployment.md). - **Note**   As noted, because WSUS and Windows Update for Business are mutually exclusive policies, do not set **UpdateServiceUrl** if you want to configure to defer upgrades. -   - 3. Establish deferral windows for updates and upgrades. - ![figure 3](images/wuforbusiness-fig12a-updates.png) - ![figure 4](images/wuforbusiness-fig13a-upgrades.png) - ## Related topics - - [Windows Update for Business](windows-update-for-business.md) - [Setup and deployment](setup-and-deployment.md) -   -   - - - - - diff --git a/windows/plan/setup-and-deployment.md b/windows/plan/setup-and-deployment.md index a023b39573..fbcf7657bc 100644 --- a/windows/plan/setup-and-deployment.md +++ b/windows/plan/setup-and-deployment.md @@ -2,38 +2,24 @@ title: Setup and deployment (Windows 10) description: This article describes the basic features of a Windows Update for Business deployment. ms.assetid: E176BB36-3B1B-4707-9665-968D80050DD1 +ms.pagetype: servicing; devices keywords: ["update", "upgrade", "deployment"] ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library author: TrudyHa --- - # Setup and deployment - - **Applies to** - - Windows 10 - This article describes the basic features of a Windows Update for Business deployment. Use this information to familiarize yourself with a simple deployment with a single group of machines connected to Windows Update, in addition to more complex scenarios such as the creation of Windows Update for Business validation groups that receive updates from Windows Update at different time intervals, as well as Windows Update for Business deployments integrated with existing management tools such as Windows Server Update Services (WSUS), System Center Configuration Manager, or Microsoft Intune. - ## Configure your systems to receive updates on CBB - - To use Windows Update for Business, Windows 10-based devices must first be configured for the Current Branch for Business (CBB). You can configure devices manually, by using Group Policy, or by using mobile device management (MDM). - ![figure 1](images/wuforbus-fig1-manuallyset.png) - ![figure 2](images/wuforbusiness-fig2-gp.png) - ![figure 3](images/wuforbusiness-fig3-mdm.png) - ## Defer OS upgrade and update deployments - - Windows Update for Business allows administrators to control when upgrades and updates are deployed to their Windows 10 clients by specifying deferral windows from when they are initially made available on the Windows Update service. As mentioned, there are restrictions as to how long you can delay upgrades and updates. The following table details these restrictions, per deployment category type: -
    @@ -44,7 +30,6 @@ Windows Update for Business allows administrators to control when upgrades and u
    • Values: 0-8 where each unit for upgrade is a month -

    @@ -90,32 +75,19 @@ Windows Update for Business allows administrators to control when upgrades and u
    -   - Administrators can control deferral periods with Group Policy Objects by using the [Local Group Policy Editor (GPEdit)](http://go.microsoft.com/fwlink/p/?LinkId=734030) or, for domain joined systems, [Group Policy Management Console (GPMC)](http://go.microsoft.com/fwlink/p/?LinkId=699325). For additional details on Group Policy management see [Group Policy management for IT pros](http://go.microsoft.com/fwlink/p/?LinkId=699282). - **Set different deferrals based on update classification in GPedit.msc** - ![figure 4](images/wuforbusiness-fig4-localpoleditor.png) - ![figure 5](images/wuforbusiness-fig5-deferupgrade.png) - ## Pause upgrades and updates - - Although administrators can use deferral periods to stagger the rate at which deployments go out to their organization (which provides time to verify quality and address any issues), there may be cases where additional time is needed before an update is set to deploy to a machine, or group of machines. Windows Update for Business provides a means for administrators to *pause* updates and upgrades on a per-machine basis. This pause functionality ensures that no updates or upgrades will be made available for the specified machine; the machine will remain in this state until the machine is specifically “unpaused”, or when a period of five weeks (35 days) has passed, at which point updates are auto-resumed. - **Note**   The five-week period ensures that pause functionality overlaps a possible subsequent Update Tuesday release. -   - **Note**   Group Policy does not allow you to set a future "unpause” — administrators must actively select to unpause a deployment if they wish to do so before the time expiration. -   - @@ -136,94 +108,44 @@ Group Policy does not allow you to set a future "unpause” — administrators m
    -   - ![figure 6](images/wuforbusiness-fig6-pause.png) - ## Create validation groups for deployments - - By grouping machines into similar deferral periods, administrators are able to cluster devices into deployment or validation groups which can be used as a quality control measure as updates are deployed in Windows 10. With deferral windows and the ability to pause, administrators can effectively control and measure update deployments by rolling out to a small pool of devices first to verify quality, prior to a broader roll-out to their organization. - Administrators can establish validation groups to maintain a level of control over update/driver deployments which allows them to: - - Control the date, time, and frequency updates will be applied and devices rebooted - - Deploy a small set of machines to verify quality prior to broad roll-out - - Stage broad roll-out in waves to continue quality verification and minimize disruptions - - Manage membership of waves based on criteria defined by IT - - Halt and roll-back deployment of updates/drivers that may be causing trouble - ![figure 7](images/wuforbusiness-fig7-validationgroup.png) - ## Peer-to-peer networking for deployments - - Windows Update Delivery Optimization enables Windows Update for Business enrolled devices to download Windows updates and Windows Store apps from sources other than Microsoft. With multiple devices, Delivery Optimization can reduce the amount of Internet bandwidth that is required to keep all of your Windows Update for Business enrolled systems up to date. It can also help ensure that devices get updates and apps more quickly if they have a limited or unreliable Internet connection. - In addition to downloading updates and apps from Microsoft, Windows will get updates and apps from other PCs that already have them. You can choose which PCs you get these updates from. - ### How Delivery Optimization works - - **PCs on your local network.** When Windows downloads an update or app, it will look for other PCs on your local network that have already downloaded the update or app using Delivery Optimization. Windows then downloads parts of the file from those PCs and parts of the file from Microsoft. Windows doesn’t download the entire file from one place. Instead, the download is broken down into smaller parts. Windows uses the fastest, most reliable download source for each part of the file. - - **PCs on your local network and PCs on the Internet.** Windows uses the same process as when getting updates and apps from PCs on your local network, and also looks for PCs on the Internet that can be used as a source to download parts of updates and apps. - ### Delivery Optimization settings - Delivery Optimization is turned on by default for the Enterprise and Education editions of Windows 10, where the default option is that updates will only be pulled and shared from PCs on your LAN and not the Internet. - Delivery Optimization configuration settings can be viewed by going to: Settings > Update and Security > Advanced Options > Choose how your updates are delivered - ![figure 8](images/wuforbusiness-fig8a-chooseupdates.png) - ## Use Group Policy to configure Windows Update Delivery Optimization - - You can use Group Policy to configure Windows Update Delivery Optimization. To do this, use the following steps: - 1. Download the [Administrative Templates (.admx) file for Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=699283) from the Microsoft Download Center. - 2. Copy the following files to the SYSVOL central store: - - DeliveryOptimization.admx from C:\\Program Files (x86)\\Microsoft Group Policy\\Windows 10\\PolicyDefinitions - - DeliveryOptimization.adml from C:\\Program Files (x86)\\Microsoft Group Policy\\Windows 10\\PolicyDefinitions\\en-US - 3. Start the Gpeditor tool. - 4. Browse to the following location: - - Computer Configuration\\Administrative Templates\\Windows Components\\Delivery Optimization - 5. Make the following Windows Update Delivery Optimization settings, as appropriate. - ![figure 9](images/wuforbusiness-fig9-dosettings.jpg) - **Virus-scan claim** - Microsoft scanned this file for viruses, using the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to it. - For more information about Windows Update Delivery Optimization in Windows 10, see the [Windows Update Delivery Optimization FAQ](http://go.microsoft.com/fwlink/p/?LinkId=699284). - For additional resources, see [How to use Group Policy to configure Windows Update Delivery Optimization in Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=699288). - ## Related topics - - [Windows Update for Business](windows-update-for-business.md) - [Integration with management solutions](integration-with-management-solutions-.md) -   -   - - - - - diff --git a/windows/plan/windows-10-guidance-for-education-environments.md b/windows/plan/windows-10-guidance-for-education-environments.md index 716217d420..0e34d984eb 100644 --- a/windows/plan/windows-10-guidance-for-education-environments.md +++ b/windows/plan/windows-10-guidance-for-education-environments.md @@ -2,20 +2,15 @@ title: Guidance for education environments (Windows 10) description: Find resources to help you plan your deployment of Windows 10 to desktops, laptops, tablets, and other devices in educational institutions. ms.assetid: 225C9D6F-9329-4DDF-B447-6CE7804E314E +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: plan ms.sitesec: library author: craigash --- - # Guidance for education environments - - Find resources to help you plan your deployment of Windows 10 to desktops, laptops, tablets, and other devices in educational institutions. - ## In this section - - @@ -34,14 +29,6 @@ Find resources to help you plan your deployment of Windows 10 to desktops, lapt
    -   -   -   - - - - - diff --git a/windows/plan/windows-update-for-business.md b/windows/plan/windows-update-for-business.md index b936f37735..474b33cfb4 100644 --- a/windows/plan/windows-update-for-business.md +++ b/windows/plan/windows-update-for-business.md @@ -2,69 +2,39 @@ title: Windows Update for Business (Windows 10) description: Get an overview of how you can implement and deploy a Windows Update for Business solution and how to maintain enrolled systems. ms.assetid: DF61F8C9-A8A6-4E83-973C-8ABE090DB8C6 +ms.pagetype: servicing; devices keywords: ["update", "upgrade", "deployment", "WSUS"] ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library author: TrudyHa --- - # Windows Update for Business - - **Applies to** - - Windows 10 - Get an overview of how you can implement and deploy a Windows Update for Business solution and how to maintain enrolled systems. - ## Introduction - - Windows Update for Business enables information technology administrators to keep the Windows 10-based devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Microsoft’s Windows Update service. By using [Group Policy Objects](http://go.microsoft.com/fwlink/p/?LinkId=699279), Windows Update for Business is an easily established and implemented system which enables organizations and administrators to exercise control on how their Windows 10-based devices are updated, by allowing: - - **Deployment and validation groups**; where administrators can specify which devices go first in an update wave, and which devices will come later (to ensure any quality bars are met). - - **Peer-to-peer delivery**, which administrators can enable to make delivery of updates to branch offices and remote sites with limited bandwidth very efficient. - - **Use with existing tools** such as System Center Configuration Manager and the [Enterprise Mobility Suite](http://go.microsoft.com/fwlink/p/?LinkId=699281). - Together, these Windows Update for Business features help reduce device management costs, provide controls over update deployment, offer quicker access to security updates, as well as provide access to the latest innovations from Microsoft on an ongoing basis. Windows Update for Business is a free service for all Windows 10 Pro, Enterprise, and Education editions, and can be used independent of, or in conjunction with, existing device management solutions such as [Windows Server Update Services (WSUS)](http://go.microsoft.com/fwlink/p/?LinkId=734043) and [System Center Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=734044). - ## Deploy Windows Update for Business in your organization - - For Windows 10, version 1511, Windows Update for Business is enabled using a set of client-side configurations, allowing you to manage how and when Windows-based devices receive updates and upgrades. These capabilities use the Windows Update service like any other Windows 10 clients, but provides controls to help businesses validate update quality as well as time their update deployments to machines through the use of Group Policy Objects. Windows Update for Business also incorporates smart peer-to-peer networking for distribution of Windows updates, which will help maintain bandwidth efficiency in the absence of a WSUS solution. - ## Eligible devices - - All devices running Windows 10 Pro, Enterprise, and Education on the Current Branch for Business (CBB) are Windows Update for Business eligible. - ## OS upgrades and updates - - In Windows 10, Windows Update for Business recognizes three deployment categories that clients receive from Windows Update: - - **Upgrades** - - Examples: Windows 10 (Build 10240) to Windows 10, version 1511; CBB 1 to CBB 2 - **Note**   In the Windows 10 servicing model, new CBBs will be declared 2-3 times per year. -   - - **Updates** - - General OS updates, typically released the second Tuesday of each month. These include Security, Critical, and Driver updates. - - **Other/non-deferrable** - - Definition updates (these cannot be deferred) - Both upgrades and updates can be deferred from deployment to client machines by a Windows Update for Business administrator within a bounded rage of time from when those updates are first made available on the Windows Update service. This deferral capability allows administrators to validate deployments as they are pushed to all their Windows Update for Business enrolled clients. The following table defines maximum deferral periods allowed by deployment type: - @@ -103,21 +73,9 @@ Both upgrades and updates can be deferred from deployment to client machines by
    CategoryE0789628-CE08-4437-BE74-2495B842F43B
    - ## Related topics - - [Setup and deployment](setup-and-deployment.md) - [Integration with management solutions](integration-with-management-solutions-.md) - [Windows 10 servicing options for updates and upgrades](../manage/introduction-to-windows-10-servicing.md) -   -   - - - - - diff --git a/windows/whats-new/applocker.md b/windows/whats-new/applocker.md index 1921961c20..bd120e6f15 100644 --- a/windows/whats-new/applocker.md +++ b/windows/whats-new/applocker.md @@ -2,40 +2,22 @@ title: What's new in AppLocker (Windows 10) description: AppLocker helps you control which apps and files users can run. These include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers. ms.assetid: 6F836FF6-7794-4E7B-89AA-1EABA1BF183F +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: explore ms.sitesec: library author: brianlic-msft --- - # What's new in AppLocker? - - **Applies to** - - Windows 10 - Windows 10 Mobile - AppLocker helps you control which apps and files users can run. These include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers. - In Windows 10, AppLocker has added some improvements. - ## New features in Windows 10 - - - A new parameter was added to the [New-AppLockerPolicy](http://technet.microsoft.com/library/hh847211.aspx) Windows PowerShell cmdlet that lets you choose whether executable and DLL rule collections apply to non-interactive processes. To enable this, set the **ServiceEnforcement** to **Enabled**. - - A new [AppLocker](http://msdn.microsoft.com/library/windows/hardware/dn920019.aspx) configuration service provider was add to allow you to enable AppLocker rules by using an MDM server. - - You can manage Windows 10 Mobile devices by using the new [AppLocker CSP](http://msdn.microsoft.com/library/windows/hardware/dn920019.aspx). - [Learn how to manage AppLocker within your organization](../keep-secure/applocker-overview.md). -   -   - - - - - diff --git a/windows/whats-new/bitlocker.md b/windows/whats-new/bitlocker.md index 2d2adc6cff..d84850daca 100644 --- a/windows/whats-new/bitlocker.md +++ b/windows/whats-new/bitlocker.md @@ -2,59 +2,31 @@ title: What's new in BitLocker (Windows 10) description: BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned computers. ms.assetid: 3F2DE365-68A1-4CDB-AB5F-C65574684C7B +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: explore ms.sitesec: library author: brianlic-msft --- - # What's new in BitLocker? - - **Applies to** - - Windows 10 - Windows 10 Mobile - BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned computers. - ## New features in Windows 10, version 1511 - - - **XTS-AES encryption algorithm**. BitLocker now supports the XTS-AES encryption algorithm. XTS-AES provides additional protection from a class of attacks on encryption that rely on manipulating cipher text to cause predictable changes in plain text. BitLocker supports both 128-bit and 256-bit XTS-AES keys. - It provides the following benefits: - - The algorithm is FIPS-compliant. - - Easy to administer. You can use the BitLocker Wizard, manage-bde, Group Policy, MDM policy, Windows PowerShell, or WMI to manage it on devices in your organization. - **Note**   Drives encrypted with XTS-AES will not be accessible on older version of Windows. This is only recommended for fixed and operating system drives. Removable drives should continue to use the AES-CBC 128-bit or AES-CBC 256-bit algorithms. -   - ## New features in Windows 10 - - - **Encrypt and recover your device with Azure Active Directory**. In addition to using a Microsoft Account, automatic [Device Encryption](http://technet.microsoft.com/library/dn306081.aspx#bkmk-encryption) can now encrypt your devices that are joined to an Azure Active Directory domain. When the device is encrypted, the BitLocker recovery key is automatically escrowed to Azure Active Directory. This will make it easier to recover your BitLocker key online. - - **DMA port protection**. You can use the [DataProtection/AllowDirectMemoryAccess](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) MDM policy to block DMA ports when the device is starting up. Also, when a device is locked, all unused DMA ports are turned off, but any devices that are already plugged into a DMA port will continue to work. When the device is unlocked, all DMA ports are turned back on. - - **New Group Policy for configuring pre-boot recovery**. You can now configure the pre-boot recovery message and recover URL that is shown on the pre-boot recovery screen. For more info, see the "Configure pre-boot recovery message and URL" section in [BitLocker Group Policy settings](../keep-secure/bitlocker-group-policy-settings.md). - [Learn how to deploy and manage BitLocker within your organization](../keep-secure/bitlocker-overview.md). - ## Related topics - - [Trusted Platform Module](../keep-secure/trusted-platform-module-overview.md) -   -   - - - - - diff --git a/windows/whats-new/credential-guard.md b/windows/whats-new/credential-guard.md index 27c035b5ad..3e2f96703b 100644 --- a/windows/whats-new/credential-guard.md +++ b/windows/whats-new/credential-guard.md @@ -2,43 +2,23 @@ title: What's new in Credential Guard (Windows 10) description: Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. ms.assetid: 59C206F7-2832-4555-97B4-3070D93CC3C5 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: explore ms.sitesec: library author: brianlic-msft --- - # What's new in Credential Guard? - - **Applies to** - - Windows 10 - Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. - ## New features in Windows 10, version 1511 - - - **Credential Manager support**. Credentials that are stored with Credential Manager, including domain credentials, are protected with Credential Guard with the following considerations: - - Credentials that are saved by the Remote Desktop Protocol cannot be used. Employees in your organization can manually store credentials in Credential Manager as generic credentials. - - Applications that extract derived domain credentials using undocumented APIs from Credential Manager will no longer be able to use those saved derived credentials. - - You cannot restore credentials using the Credential Manager control panel if the credentials were backed up from a PC that has Credential Guard turned on. If you need to back up your credentials, you must do this before you enable Credential Guard. Otherwise, you won't be able to restore those credentials. - - **Enable Credential Guard without UEFI lock**. You can enable Credential Guard by using the registry. This allows you to disable Credential Guard remotely. However, we recommend that Credential Guard is enabled with UEFI lock. You can configure this by using Group Policy. - - **CredSSP/TsPkg credential delegation**. CredSSP/TsPkg cannot delegate default credentials when Credential Guard is enabled. - [Learn how to deploy and manage Credential Guard within your organization](../keep-secure/credential-guard.md). -   -   - - - - - diff --git a/windows/whats-new/device-guard-overview.md b/windows/whats-new/device-guard-overview.md index e9bb342203..3f96f76b76 100644 --- a/windows/whats-new/device-guard-overview.md +++ b/windows/whats-new/device-guard-overview.md @@ -2,72 +2,42 @@ title: Device Guard overview (Windows 10) description: Device Guard is a combination of enterprise-related hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications. ms.assetid: FFE244EE-5804-4CE8-A2A9-48F49DC3AEF2 +ms.pagetype: security keywords: ["Device Guard"] ms.prod: W10 ms.mktglfcycl: explore ms.sitesec: library author: brianlic-msft --- - # Device Guard overview - - **Applies to** - - Windows 10 - Windows 10 Mobile - Device Guard is a combination of enterprise-related hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications. If the app isn’t trusted it can’t run, period. It also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code after the computer restarts because of how decisions are made about what can run and when. - Device Guard uses the new virtualization-based security in Windows 10 Enterprise to isolate the Code Integrity service from the Microsoft Windows kernel itself, letting the service use signatures defined by your enterprise-controlled policy to help determine what is trustworthy. In effect, the Code Integrity service runs alongside the kernel in a Windows hypervisor-protected container. - For details on how to implement Device Guard, see [Device Guard deployment guide](../keep-secure/device-guard-deployment-guide.md). - ## Why use Device Guard - - With thousands of new malicious files created every day, using traditional methods like signature-based detection to fight against malware provides an inadequate defense against new attacks. Device Guard on Windows 10 Enterprise changes from a mode where apps are trusted unless blocked by an antivirus or other security solutions, to a mode where the operating system trusts only apps authorized by your enterprise. - Device Guard also helps protect against [zero day attacks](http://go.microsoft.com/fwlink/p/?linkid=534209) and works to combat the challenges of [polymorphic viruses](http://go.microsoft.com/fwlink/p/?LinkId=534210). - ### Advantages to using Device Guard - You can take advantage of the benefits of Device Guard, based on what you turn on and use: - - Helps provide strong malware protection with enterprise manageability - Helps provide the most advanced malware protection ever offered on the Windows platform - Offers improved tamper resistance - ## How Device Guard works - - Device Guard restricts the Windows 10 Enterprise operating system to only running code that’s signed by trusted signers, as defined by your Code Integrity policy through specific hardware and security configurations, including: - - User Mode Code Integrity (UMCI) - - New kernel code integrity rules (including the new Windows Hardware Quality Labs (WHQL) signing constraints) - - Secure Boot with database (db/dbx) restrictions - - Virtualization-based security to help protect system memory and kernel mode apps and drivers from possible tampering. - - **Optional:** Trusted Platform Module (TPM) 1.2 or 2.0 - Device Guard works with your image-building process, so you can turn the virtualization-based security feature on for capable devices, configure your Code Integrity policy, and set any other operating system settings you require for Windows 10 Enterprise. After that, Device Guard works to help protect your devices: - 1. Your device starts up using Universal Extensible Firmware Interface (UEFI) Secure Boot, so that boot kits can’t run and so that Windows 10 Enterprise starts before anything else. - 2. After securely starting up the Windows boot components, Windows 10 Enterprise can start the Hyper-V virtualization-based security services, including Kernel Mode Code Integrity. These services help protect the system core (kernel), privileged drivers, and system defenses, like anti-malware solutions, by preventing malware from running early in the boot process, or in kernel after startup. - 3. Device Guard uses UMCI to make sure that anything that runs in User mode, such as a service, a Universal Windows Platform (UWP) app, or a Classic Windows application is trusted, allowing only trusted binaries to run. - 4. At the same time that Windows 10 Enterprise starts up, so too does the trusted platform module (TPM). TPM provides an isolated hardware component that helps protect sensitive information, such as user credentials and certificates. - ## Required hardware and software - - The following table shows the hardware and software you need to install and configure to implement Device Guard. - @@ -114,51 +84,24 @@ The following table shows the hardware and software you need to install and conf
    -   - ## Before using Device Guard in your company - - Before you can successfully use Device Guard, you must set up your environment and your policies. - ### Signing your apps - Device Guard mode supports both UWP apps and Classic Windows applications. Trust between Device Guard and your apps happen when your apps are signed using a signature that you determine to be trustworthy. Not just any signature will work. - This signing can happen by: - - **Using the Windows Store publishing process.** All apps that come out of the Microsoft Store are automatically signed with special signatures that can roll-up to our certificate authority (CA) or to your own. - - **Using your own digital certificate or public key infrastructure (PKI).** ISV's and enterprises can sign their own Classic Windows applications themselves, adding themselves to the trusted list of signers. - - **Using a non-Microsoft signing authority.** ISV's and enterprises can use a trusted non-Microsoft signing authority to sign all of their own Classic Windows applications. - - **Use the Device Guard signing portal**. Available in the Windows Store for Business, you can use a Microsoft web service to sign your Classic Windows applications. For more info, see [Device Guard signing](../manage/device-guard-signing-portal.md). - ### Code Integrity policy - Before you can use the app protection included in Device Guard, you must create a Code Integrity policy using tools provided by Microsoft, but deployed using your current management tools, like Group Policy. The Code Integrity policy is a binary-encoded XML document that includes configuration settings for both the User and Kernel-modes of Windows 10 Enterprise, along with restrictions on Windows 10 script hosts. This policy restricts what code can run on a device. - For the Device Guard feature, devices should only have Code Integrity pre-configured if the settings are provided by a customer for a customer-provided image. - **Note**  This XML document can be signed in Windows 10 Enterprise, helping to add additional protection against administrative users changing or removing this policy. -   - ### Virtualization-based security using Windows 10 Enterprise Hypervisor - Windows 10 Enterprise Hypervisor introduces new capabilities around virtual trust levels, which helps Windows 10 Enterprise services to run in a protected environment, in isolation from the running operating system. Windows 10 Enterprise virtualization-based security helps protect kernel code integrity and helps to provide credential isolation for the local security authority (LSA). Letting the Kernel Code Integrity service run as a hypervisor-hosted service increases the level of protection around the root operating system, adding additional protections against any malware that compromises the kernel layer. - **Important**  Device Guard devices that run Kernel Code Integrity with virtualization-based security must have compatible drivers - legacy drivers can be updated - and have all virtualization capabilities turned on. This includes virtualization extensions and input/output memory management unit (IOMMU) support. -   -   -   - - - - - diff --git a/windows/whats-new/edp-whats-new-overview.md b/windows/whats-new/edp-whats-new-overview.md index 11e9b2a883..897cfe191b 100644 --- a/windows/whats-new/edp-whats-new-overview.md +++ b/windows/whats-new/edp-whats-new-overview.md @@ -2,103 +2,63 @@ title: Enterprise data protection (EDP) overview (Windows 10) description: With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data disclosure through apps and services that are outside of the enterprise’s control like email, social media, and the public cloud. ms.assetid: 428A3135-CB5E-478B-B1FF-B6EB76F0DF14 +ms.pagetype: security keywords: ["EDP Overview", "EDP"] ms.prod: W10 ms.mktglfcycl: explore ms.sitesec: library author: eross-msft --- - # Enterprise data protection (EDP) overview **Applies to:** - - Windows 10 Insider Preview - Windows 10 Mobile Preview - [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows 10 Anniversary SDK Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.] - With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data disclosure through apps and services that are outside of the enterprise’s control like email, social media, and the public cloud. - Many of the existing solutions try to address this issue by requiring employees to switch between personal and work containers and apps, which can lead to a less than optimal user experience. The feature code-named enterprise data protection (EDP) offers a better user experience, while helping to better separate and protect enterprise apps and data against disclosure risks across both company and personal devices, without requiring changes in environments or apps. Additionally, EDP when used with Rights Management Services (RMS), can help to protect your enterprise data locally, persisting the protection even when your data roams or is shared. - ## Benefits of EDP EDP provides: - Additional protection against enterprise data leakage, with minimal impact on employees’ regular work practices. - - Obvious separation between personal and corporate data, without requiring employees to switch environments or apps. - - Additional data protection for existing line-of-business apps without a need to update the apps. - - Ability to wipe corporate data from devices while leaving personal data alone. - - Use of audit reports for tracking issues and remedial actions. - - Integration with your existing management system (Microsoft Intune, System Center Configuration Manager (version 1511 or later)’, or your current mobile device management (MDM) system) to configure, deploy, and manage EDP for your company. - - Additional protection for your data (through RMS integration) while roaming and sharing, like when you share encrypted content through Outlook or move encrypted files to USB keys. - - Ability to manage Office universal apps on Windows 10 devices using an MDM solution to help protect corporate data. To manage Office mobile apps for Android and iOS devices, see technical resources [here]( http://go.microsoft.com/fwlink/p/?LinkId=526490). - ## Enterprise scenarios - EDP currently addresses these enterprise scenarios: - - You can encrypt enterprise data on employee-owned and corporate-owned devices. - - You can remotely wipe enterprise data off managed computers, including employee-owned computers, without affecting the personal data. - - You can select specific apps that can access enterprise data, called "protected apps" that are clearly recognizable to employees. You can also block non-protected apps from accessing enterprise data. - - Your employees won't have their work otherwise interrupted while switching between personal and enterprise apps while the enterprise policies are in place. Switching environments or signing in multiple times isn’t required. - ### Enterprise data security As an enterprise admin, you need to maintain the security and confidentiality of your corporate data. Using EDP you can help ensure that your corporate data is protected on your employee-owned computers, even when the employee isn’t actively using it. In this case, when the employee initially creates the content on a managed device he’s asked whether it’s a work document. If it's a work document, it becomes locally-protected as enterprise data. - ### Persistent data encryption EDP helps keep your enterprise data protected, even when it roams. Apps like Office and OneNote work with EDP to persist your data encryption across locations and services. For example, if an employee opens EDP-encrypted content from Outlook, edits it, and then tries to save the edited version with a different name to remove the encryption, it won’t work. Outlook automatically applies EDP to the new document, keeping the data encryption in place. - ### Remotely wiping devices of enterprise data EDP also offers the ability to remotely wipe your corporate data from all devices managed by you and used by an employee, while leaving personal data alone. This is a benefit when an employee leaves your company, or in the case of a stolen computer. - In this case, documents are stored locally, and encrypted with an enterprise identity. When you verify that you have to wipe the device, you can send a remote wipe command through your mobile device management system so when the device connects to the network, the encryption keys are revoked and the enterprise data is removed. This action only affects devices that have been targeted by the command. All other devices will continue to work normally. - ### Protected apps and restrictions Using EDP you can control the set of apps that are made "protected apps", or apps that can access and use your enterprise data. After you add an app to your **Protected App** list, it’s trusted to use enterprise data. All apps not on this list are treated as personal and are potentially blocked from accessing your corporate data, depending on your EDP protection-mode. - As a note, your existing line-of-business apps don’t have to change to be included as protected apps. You simply have to include them in your list. - ### Great employee experiences EDP can offer a great user experience by not requiring employees to switch between apps to protect corporate data. For example, while checking work emails in Microsoft Outlook, an employee gets a personal message. Instead of having to leave Outlook, both the work and personal messages appear on the screen, side-by-side. - #### Using protected apps Protected apps are allowed to access your enterprise data and will react differently with other non-protected or personal apps. For example, if your EDP-protection mode is set to block, your protected apps will let the employee copy and paste information between other protected apps, but not with personal apps. Imagine an HR person wants to copy a job description from a protected app to an internal career website, an enterprise-protected location, but goofs and tries to paste into a personal app instead. The paste action fails and a notification pops up, saying that it couldn’t paste because of a policy restriction. The HR person then correctly pastes to the career website and it works without a problem. - #### Copying or downloading enterprise data Downloading content from a location like SharePoint or a network file share, or an enterprise web location, such as Office365.com automatically determines that the content is enterprise data and is encrypted as such, while it’s stored locally. The same applies to copying enterprise data to something like a USB drive. Because the content is already marked as enterprise data locally, the encryption is persisted on the new device. - #### Changing the EDP protection Employees can change enterprise data protected documents back to personal if the document is wrongly marked as enterprise. However, this requires the employee to take an action and is audited and logged for you to review - ### Deciding your level of data access EDP lets you decide to block, allow overrides, or silently audit your employee's data sharing actions. Blocking the action stops it immediately, while allowing overrides let the employee know there's a problem, but lets the employee continue to share the info, and silent just logs the action without stopping it, letting you start to see patterns of inappropriate sharing so you can take educative action. - ### Helping prevent accidental data disclosure to public spaces EDP helps protect your enterprise data from being shared to public spaces, like the public cloud, accidentally. For example, if an employee stores content in the **Documents** folder, which is automatically synched with OneDrive (an app on your Protected Apps list), then the document is encrypted locally and not synched it to the user’s personal cloud. Likewise, if other synching apps, like Dropbox™, aren’t on the Protected Apps list, they also won’t be able to sync encrypted files to the user’s personal cloud. - ### Helping prevent accidental data disclosure to other devices EDP helps protect your enterprise data from leaking to other devices while transferring or moving between them. For example, if an employee puts corporate data on a USB key that also includes personal data, the corporate data remains encrypted even though the personal information remains open. Additionally, the encryption continues when the employee copies the encrypted content back to another corporate-managed device. - ## Turn off EDP You can turn off all enterprise data protection and restrictions, reverting to where you were pre-EDP, with no data loss. However, turning off EDP isn't recommended. If you choose to turn it off, you can always turn it back on, but EDP won't retain your decryption and policies info. - ## Related topics - [Protect your enterprise data using enterprise data protection (EDP)](../keep-secure/protect-enterprise-data-using-edp.md) -   -   - - - - - diff --git a/windows/whats-new/lockdown-features-windows-10.md b/windows/whats-new/lockdown-features-windows-10.md index ad706275ab..f349f81f95 100644 --- a/windows/whats-new/lockdown-features-windows-10.md +++ b/windows/whats-new/lockdown-features-windows-10.md @@ -2,23 +2,18 @@ title: Lockdown features from Windows Embedded 8.1 Industry (Windows 10) description: Many of the lockdown features available in Windows Embedded 8.1 Industry have been modified in some form for Windows 10. ms.assetid: 3C006B00-535C-4BA4-9421-B8F952D47A14 +ms.pagetype: security keywords: ["lockdown", "embedded"] ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: jdeckerMS --- - # Lockdown features from Windows Embedded 8.1 Industry - - **Applies to** - - Windows 10 - Windows 10 Mobile - Many of the lockdown features available in Windows Embedded 8.1 Industry have been modified in some form for Windows 10. This table maps Windows Embedded Industry 8.1 features to Windows 10 Enterprise features, along with links to documentation. - @@ -111,14 +106,6 @@ Many of the lockdown features available in Windows Embedded 8.1 Industry have be
    -   -   -   - - - - - diff --git a/windows/whats-new/microsoft-passport.md b/windows/whats-new/microsoft-passport.md index f50638ea29..887187318a 100644 --- a/windows/whats-new/microsoft-passport.md +++ b/windows/whats-new/microsoft-passport.md @@ -2,55 +2,29 @@ title: Microsoft Passport overview (Windows 10) description: In Windows 10, Microsoft Passport replaces passwords with strong two-factor authentication. ms.assetid: 292F3BE9-3651-4B20-B83F-85560631EF5B +ms.pagetype: security keywords: ["password", "hello", "fingerprint", "iris", "biometric"] ms.prod: W10 ms.mktglfcycl: explore ms.sitesec: library author: jdeckerMS --- - # Microsoft Passport overview - - **Applies to** - - Windows 10 - Windows 10 Mobile - In Windows 10, Microsoft Passport replaces passwords with strong two-factor authentication that consists of an enrolled device and a Windows Hello (biometric) or PIN. - Microsoft Passport lets users authenticate to a Microsoft account, an Active Directory account, a Microsoft Azure Active Directory (AD) account, or non-Microsoft service that supports [Fast ID Online (FIDO)](http://go.microsoft.com/fwlink/p/?LinkId=533889) authentication. After an initial two-step verification during Microsoft Passport enrollment, a Microsoft Passport is set up on the user's device and the user sets a gesture, which can be Windows Hello or a PIN. The user provides the gesture to verify identity; Windows then uses Microsoft Passport to authenticate users and help them to access protected resources and services. - Microsoft Passport also enables Windows 10 Mobile devices to be used as a remote credential when signing into Windows 10 PCs. During the sign-in process, the Windows 10 PC can connect using Bluetooth to access Microsoft Passport on the user’s Windows 10 Mobile device. Because users carry their phone with them, Microsoft Passport makes implementing two-factor authentication across the enterprise less costly and complex than other solutions - ## Benefits of Microsoft Passport - - - **User convenience**. The employee provides credentials (such as account and password, or other credentials), and is then guided to set up Microsoft Passport and Hello. From that point on, the employee can access enterprise resources by providing a gesture. - - **Security**. Microsoft Passport helps protect user identities and user credentials. Because no passwords are used, it helps circumvent phishing and brute force attacks. It also helps prevent server breaches because Microsoft Passport credentials are an asymmetric key pair, which helps prevent replay attacks when these keys are generated within isolated environments of Trusted Platform Modules (TPMs). - [Learn how to implement and manage Microsoft Passport in your organization.](../keep-secure/implement-microsoft-passport-in-your-organization.md) - ## Learn more - - [Why a PIN is better than a password](../keep-secure/why-a-pin-is-better-than-a-password.md) - [Windows 10: Disrupting the Revolution of Cyber-Threats with Revolutionary Security!](http://go.microsoft.com/fwlink/p/?LinkId=533890) - [Windows 10: The End Game for Passwords and Credential Theft?](http://go.microsoft.com/fwlink/p/?LinkId=533891) - ## Related topics - - [Device management](device-management.md) -   -   - - - - - diff --git a/windows/whats-new/security-auditing.md b/windows/whats-new/security-auditing.md index 9d88b459f9..62101772be 100644 --- a/windows/whats-new/security-auditing.md +++ b/windows/whats-new/security-auditing.md @@ -2,141 +2,76 @@ title: What's new in security auditing (Windows 10) description: Security auditing is one of the most powerful tools that you can use to maintain the integrity of your system. ms.assetid: CB35A02E-5C66-449D-8C90-7B73C636F67B +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: explore ms.sitesec: library author: brianlic-msft --- - # What's new in security auditing? - - **Applies to** - - Windows 10 - Windows 10 Mobile - Security auditing is one of the most powerful tools that you can use to maintain the integrity of your system. As part of your overall security strategy, you should determine the level of auditing that is appropriate for your environment. Auditing should identify attacks (successful or not) that pose a threat to your network, and attacks against resources that you have determined to be valuable in your risk assessment. - ## New features in Windows 10, version 1511 - - - The [WindowsSecurityAuditing](http://go.microsoft.com/fwlink/p/?LinkId=690517) and [Reporting](http://go.microsoft.com/fwlink/p/?LinkId=690525) configuration service providers allow you to add security audit policies to mobile devices. - ## New features in Windows 10 - - In Windows 10, security auditing has added some improvements: - - [New audit subcategories](#bkmk-auditsubcat) - [More info added to existing audit events](#bkmk-moreinfo) - ### New audit subcategories - In Windows 10, two new audit subcategories were added to the Advanced Audit Policy Configuration to provide greater granularity in audit events: - - [Audit Group Membership](../keep-secure/audit-group-membership.md) Found in the Logon/Logoff audit category, the Audit Group Membership subcategory allows you to audit the group membership information in a user's logon token. Events in this subcategory are generated when group memberships are enumerated or queried on the PC where the logon session was created. For an interactive logon, the security audit event is generated on the PC that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the PC hosting the resource. - When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the **Audit Logon** setting under **Advanced Audit Policy Configuration\\System Audit Policies\\Logon/Logoff**. Multiple events are generated if the group membership information cannot fit in a single security audit event. - - [Audit PNP Activity](../keep-secure/audit-pnp-activity.md) Found in the Detailed Tracking category, the Audit PNP Activity subcategory allows you to audit when plug and play detects an external device. - Only Success audits are recorded for this category. If you do not configure this policy setting, no audit event is generated when an external device is detected by plug and play. - A PnP audit event can be used to track down changes in system hardware and will be logged on the PC where the change took place. A list of hardware vendor IDs are included in the event. - ### More info added to existing audit events - With Windows 10, we've added more info to existing audit events to make it easier for you to put together a full audit trail and come away with the information you need to protect your enterprise. Improvements were made to the following audit events: - - [Changed the kernel default audit policy](#bkmk-kdal) - - [Added a default process SACL to LSASS.exe](#bkmk-lsass) - - [Added new fields in the logon event](#bkmk-logon) - - [Added new fields in the process creation event](#bkmk-logon) - - [Added new Security Account Manager events](#bkmk-sam) - - [Added new BCD events](#bkmk-bcd) - - [Added new PNP events](#bkmk-pnp) - ### Changed the kernel default audit policy - In previous releases, the kernel depended on the Local Security Authority (LSA) to retrieve info in some of its events. In Windows 10, the process creation events audit policy is automatically enabled until an actual audit policy is received from LSA. This results in better auditing of services that may start before LSA starts. - ### Added a default process SACL to LSASS.exe - In Windows 10, a default process SACL was added to LSASS.exe to log processes attempting to access LSASS.exe. The SACL is L"S:(AU;SAFA;0x0010;;;WD)". You can enable this under **Advanced Audit Policy Configuration\\Object Access\\Audit Kernel Object**. - This can help identify attacks that steal credentials from the memory of a process. - ### New fields in the logon event - The logon event ID 4624 has been updated to include more verbose information to make them easier to analyze. The following fields have been added to event 4624: - 1. **MachineLogon** String: yes or no - If the account that logged into the PC is a computer account, this field will be yes. Otherwise, the field is no. - 2. **ElevatedToken** String: yes or no - If the account that logged into the PC is an administrative logon, this field will be yes. Otherwise, the field is no. Additionally, if this is part of a split token, the linked login ID (LSAP\_LOGON\_SESSION) will also be shown. - 3. **TargetOutboundUserName** String - **TargetOutboundUserDomain** String - The username and domain of the identity that was created by the LogonUser method for outbound traffic. - 4. **VirtualAccount** String: yes or no - If the account that logged into the PC is a virtual account, this field will be yes. Otherwise, the field is no. - 5. **GroupMembership** String - A list of all of the groups in the user's token. - 6. **RestrictedAdminMode** String: yes or no - If the user logs into the PC in restricted admin mode with Remote Desktop, this field will be yes. - For more info on restricted admin mode, see [Restricted Admin mode for RDP](http://blogs.technet.com/b/kfalde/archive/2013/08/14/restricted-admin-mode-for-rdp-in-windows-8-1-2012-r2.aspx). - ### New fields in the process creation event - The logon event ID 4688 has been updated to include more verbose information to make them easier to analyze. The following fields have been added to event 4688: - 1. **TargetUserSid** String - The SID of the target principal. - 2. **TargetUserName** String - The account name of the target user. - 3. **TargetDomainName** String - The domain of the target user.. - 4. **TargetLogonId** String - The logon ID of the target user. - 5. **ParentProcessName** String - The name of the creator process. - 6. **ParentProcessId** String - A pointer to the actual parent process if it's different from the creator process. - ### New Security Account Manager events - In Windows 10, new SAM events were added to cover SAM APIs that perform read/query operations. In previous versions of Windows, only write operations were audited. The new events are event ID 4798 and event ID 4799. The following APIs are now audited: - - SamrEnumerateGroupsInDomain - SamrEnumerateUsersInDomain - SamrEnumerateAliasesInDomain @@ -149,11 +84,8 @@ In Windows 10, new SAM events were added to cover SAM APIs that perform read/qu - SamrGetMembersInGroup - SamrGetMembersInAlias - SamrGetUserDomainPasswordInformation - ### New BCD events - Event ID 4826 has been added to track the following changes to the Boot Configuration Database (BCD): - - DEP/NEX settings - Test signing - PCAT SB simulation @@ -161,18 +93,8 @@ Event ID 4826 has been added to track the following changes to the Boot Configur - Boot debug - Integrity Services - Disable Winload debugging menu - ### New PNP events - Event ID 6416 has been added to track when an external device is detected through Plug and Play. One important scenario is if an external device that contains malware is inserted into a high-value machine that doesn’t expect this type of action, such as a domain controller. - [Learn how to manage your security audit policies within your organization](../keep-secure/security-auditing-overview.md). -   -   - - - - - diff --git a/windows/whats-new/security.md b/windows/whats-new/security.md index 49711ce074..356121713b 100644 --- a/windows/whats-new/security.md +++ b/windows/whats-new/security.md @@ -2,215 +2,114 @@ title: What's new in Windows 10 security (Windows 10) description: There are several key client security improvements Microsoft has made in Windows 10. ms.assetid: 6B8A5F7A-ABD3-416C-87B0-85F68B214C81 +ms.pagetype: security keywords: ["secure", "data loss prevention", "multifactor authentication"] ms.prod: W10 ms.mktglfcycl: explore ms.sitesec: library author: TrudyHa --- - # What's new in Windows 10 security - - There are several key client security improvements Microsoft has made in Windows 10. These improvements focus on three key areas — threat resistance, information protection, and identity protection and access control. In addition to an overview of the features themselves, this article discusses the hardware requirements for each new feature and offers configuration recommendations and links to more detailed resources. - Microsoft designed the Windows 10 operating system to be the most secure version of the Windows operating system to date. To achieve this goal, Windows 10 employs advanced and now widely available hardware features to help protect users and devices against modern cyber threats. With thousands of new malware variants discovered daily and malicious hacking techniques evolving rapidly, never before has Windows client security been more important. In Windows 10, organizations can deploy new threat-resistant security features that harden the operating system in ways that can benefit Bring Your Own Device (BYOD) and corporate-owned device scenarios, as well as devices for special use cases, such as kiosks, ATMs, and point-of-sale (PoS) systems. These new threat-resistant features are modular—that is, they’re designed to be deployed together, although you can also implement them individually. With all these new features enabled together, organizations can protect themselves immediately against a majority of today’s most sophisticated threats and malware. - In addition to new, impactful threat mitigations, Windows 10 includes several improvements in built-in information protection, including a new data loss-prevention (DLP) component. These improvements allow organizations to separate business and personal data easily, define which apps have access to business data, and determine how data can be shared (for example, copy and paste). Unlike other DLP solutions, Microsoft integrated this functionality deeply into the Windows platform, offering the same type of security capabilities that container-based solutions offer but without altering such user experiences as requiring mode changes or switching applications. - Finally, new identity-protection and access control features make it easier to implement two-factor authentication (2FA) across the entire enterprise, which empowers organizations to transition away from passwords. Windows 10 introduces Microsoft Passport, a new 2FA user credential built directly into the operating system that users can access with either a PIN or a new biometrics-driven capability called Windows Hello. Together, these technologies provide a simple logon experience for users, with the robust security of multifactor authentication (MFA). Unlike third-party multifactor solutions, Microsoft Passport is designed specifically to integrate with Microsoft Azure Active Directory (Azure AD) and hybrid Active Directory environments and requires minimal administrative configuration and maintenance. - ## Threat resistance - - Today’s security threat landscape is one of aggressive and tenacious threats. In previous years, malicious attackers mostly focused on gaining community recognition through their attacks and the personal enjoyment of temporarily taking a system offline. Since then, attacker’s motives have shifted toward monetizing their attacks, which includes holding machines and data hostage until the owners pay the demanded ransom and exploiting the valuable information the attackers discover for monetary gain. Unlike these examples, modern attacks increasingly focus on large-scale intellectual property theft; targeted system degradation that results in financial loss; and now even cyberterrorism that threatens the security of individuals, businesses, and national interests all over the world. These attackers are typically highly trained individuals and security experts, some of whom are in the employ of nation states that have large budgets, seemingly unlimited human resources, and unknown motives. Threats like these require a different approach and mitigations that can meet the challenge. - Windows 10 introduces several new security features that help mitigate modern threats and protect organizations against cyber attackers, regardless of their motive. Microsoft has made significant investments in Windows 10 to make it the most malware-resistant Windows operating system to date. Rather than simply adding defenses to the operating system, as was the case in previous Windows releases, Microsoft introduces architectural changes in Windows 10 that address entire classes of threats. By fundamentally changing the way the operating system works, Microsoft seeks to make Windows 10 much more difficult for modern attackers to exploit. New features in Windows 10 include Device Guard, configurable code integrity, virtualization-based security (VBS), and improvements to Windows Defender, to name just a few. By enabling all these new features together, organizations can immediately protect themselves against the types of malware responsible for approximately 95 percent of modern attacks. - ### Virtualization-based security - In the server world, virtualization technologies like Microsoft Hyper-V have proven extremely effective in isolating and protecting virtual machines (VMs) in the data center. Now, with those virtualization capabilities becoming more pervasive in modern client devices, there is an incredible opportunity for new Windows client security scenarios. Windows 10 can use virtualization technology to isolate core operating system services in a segregated, virtualized environment, similar to a VM. This additional level of protection, called virtualization-based security, ensures that no one can manipulate those services, even if the kernel mode of the host operating system is compromised. - Just like with client Hyper-V, Windows itself can now take advantage of processors equipped with second-level address translation (SLAT) technology and virtualization extensions, such as Intel Virtualization Technology (VT) x and AMD V, to create a secure execution environment for sensitive Windows functions and data. This VBS environment protects the following services: - - **Hypervisor Code Integrity (HVCI).** The HVCI service in Windows 10 determines whether code executing in kernel mode is securely designed and trustworthy. It offers Zero Day and vulnerability exploit protection capabilities by ensuring that all software running in kernel mode, including drivers, securely allocate memory and operate as they are intended. In Windows 10, kernel mode code integrity is configurable, which allows organizations to scope preboot code execution to their desired configuration. For more information about configurable code integrity in Windows 10, see the [Configurable code integrity](#config-code) section. - - **Local Security Authority (LSA).** The LSA service in Windows manages authentication operations, including NT LAN Manager (NTLM) and Kerberos mechanisms. In Windows 10, the Credential Guard feature isolates a portion of this service and helps mitigate the pass-the-hash and pass-the-ticket techniques by protecting domain credentials. In addition to logon credentials, this protection is extended to credentials stored within Credential Manager. For more information about Credential Guard, see the [Credential Guard](#credential-guard) section. - **Note**   To determine whether virtualization is supported for a client machine model, simply run **systeminfo** from a command prompt window. -   - VBS provides the core framework for some of the most impactful mitigations Windows 10 offers. Having client machines within your organization that can employ this functionality is crucial to modern threat resistance. For more information about the specific hardware features that each Windows 10 feature requires, including VBS, see the [Windows 10 hardware considerations](#hardware) section. - ### Device Guard - Microsoft Device Guard is a feature set that combines system integrity–hardening features that revolutionize Windows security by taking advantage of new VBS options to protect the system core and a trust-nothing model often seen in mobile operating systems. This feature set takes advantage of the best preexisting Windows hardening features (for example, Unified Extensible Firmware Interface \[UEFI\] Secure Boot, Windows Trusted Boot), and then combines them with powerful new app control features like the VBS-powered HVCI service and configurable code integrity, which together help prevent vulnerability exploits and unauthorized apps from running on the device in both user and kernel modes. For more information about VBS in Windows 10 and the additional features that use it, see the [Virtualization-based security](#virtualization-security) section. For more information about configurable code integrity, see the [Configurable code integrity](#config-code) section. - Although Microsoft intends the Device Guard feature set to run alongside new Windows security features such as Credential Guard, it can run independently. Depending on your organization’s client resources, you can selectively choose which features make sense for your environment and device compatibility. For information about the hardware requirements for Device Guard and other Windows 10 security features, see the [Windows 10 hardware considerations](#hardware) section. For more information about Credential Guard, see the [Credential Guard](#credential-guard) section. - For most organizations, implementing specific Device Guard functionality will depend on the role of the device and its primary user, employing more features on single-workload devices, such as kiosks, and fewer features on administrative machines over which users are allowed full control. By using this model, IT organizations can categorize users into groups that align with Device Guard security policies relating to device security and code integrity restrictions. For more information about configurable code integrity, see the [Configurable code integrity](#config-code) section. - New desktops and laptops will be available to expedite your Device Guard implementation efforts. Device Guard-ready devices will require the least amount of physical interaction with the actual device before it’s ready for use. Going forward, all devices will fall into one of the following three categories: - - **Device Guard capable**. These devices will meet all the hardware requirements for Device Guard. You will still need to properly prepare devices with components that require enablement or configuration for Device Guard deployment. Device drivers on the device must be compatible with HVCI and may require updates from the original equipment manufacturer (OEM). - - **Device Guard ready**. Device Guard-ready devices will come directly from the OEM with all necessary hardware components and drivers to run Device Guard. In addition, all of these components will be pre-configured and enabled, which minimizes the effort needed to deploy Device Guard. No interaction with the BIOS is necessary to deploy these devices, and you can use Group Policy, System Center Configuration Manager, or Microsoft Intune to manage them. - - **Not supported for Device Guard**. Many current devices cannot take advantage of all Device Guard features because they don’t have the required hardware components or HVCI-compatible drivers. However, most of these devices can enable some Device Guard features, such as configurable code integrity. - For more information about how to prepare for, manage, and deploy Device Guard, see the [Device Guard deployment guide](../keep-secure/device-guard-deployment-guide.md). - ### Configurable code integrity - *Code integrity* is the Windows component that verifies that the code Windows is running is trusted and safe. Like the operating modes found in Windows itself, Windows code integrity contains two primary components: kernel mode code integrity (KMCI) and user mode code integrity (UMCI). Microsoft has used KMCI in recent versions of Windows to prevent the Windows kernel from executing unsigned drivers. Although this approach is effective, drivers aren’t the only route malware can take to penetrate the operating system’s kernel mode space. So, for Windows 10, Microsoft has raised the standard for kernel mode code out of the box by requiring the use of security best practices regarding memory management and has provided enterprises with a way to set their own UMCI and KMCI standards. - Historically, UMCI has been available only for Windows RT and Windows Phone devices, which made it difficult for attackers to infect such devices with viruses and malware. This reduced infection rate results from the way the operating system determines which code to execute. Natively, binaries follow a process to prove to the operating system that they are trustworthy before the operating system allows them to execute. This process is intended to restrict the execution of arbitrary code and thereby decrease the risk of malware infection. This successful trust-nothing operating system model is now available in Windows 10 through a feature called *configurable code integrity*. - Configurable code integrity allows IT organizations to create and deploy code integrity policies that stipulate exactly which binaries can run in their environment. Administrators can manage this trust at a certification authority or publisher level down to the individual hash values for each executed binary. This level of customization allows organizations to create policies that are as restrictive as they desire. In addition, organizations can choose to provide different levels of restriction for certain types of machines. For example, fixed-workload devices such as kiosks and PoS systems would likely receive a strict policy, because their purpose is to provide the same service day after day. Administrators can manage devices that have more variable workloads, such as users’ PCs, at a higher level, providing certain software publishers’ applications for installation or aligning those devices with the organization’s software catalog. - **Note**   Configurable code integrity is not intended to replace technologies that allow or block programs such as AppLocker or an organization’s antivirus software. Rather, it complements such technologies by establishing a baseline of security, and then using those additional technologies to fine-tune client security. -   - Configurable code integrity is not limited to Windows Store applications. In fact, it is not even limited to existing signed applications. Windows 10 gives you a way to sign line-of-business or third-party applications without having to repackage them: you can monitor the application’s installation and initial execution to create a list of binaries called a catalog file. When created, you sign these catalog files and add the signing certificate to the code integrity policy so that those binaries contained within the catalog files are allowed to execute. Then, you can use Group Policy, Configuration Manager, or any other familiar management tool to distribute these catalog files to your client machines. Historically, most malware has been unsigned; simply by deploying code integrity policies, your organization can immediately protect itself against unsigned malware, which is responsible for most modern attacks. - **Note**   For detailed deployment and planning information about configurable code integrity, see the [Device Guard deployment guide](../keep-secure/device-guard-deployment-guide.md). -   - The process to create, test, and deploy a code integrity policy is as follows: - 1. **Create a code integrity policy.** Use the Windows PowerShell cmdlet **New-CIPolicy**, available in Windows 10, to create a new code integrity policy. This cmdlet scans a PC for all listings of a specific policy level. For example, if you set the rule level to **Hash**, the cmdlet would add hash values for all discovered binaries to the policy that resulted from the scan. When you enforce and deploy the policy, this list of hash values determines exactly which binaries are allowed to run on the machines that receive the policy. Code integrity policies can contain both a kernel mode and user mode execution policy, restricting what can run in either or both modes. Finally, when created, this policy is converted to binary format so that the managed client can consume it when the policy is copied to the client’s code integrity folder. - 2. **Audit the code integrity policy for exceptions.** When you first create a code integrity policy, audit mode is enabled by default so that you can simulate the effect of a code integrity policy without actually blocking the execution of any binaries. Instead, policy exceptions are logged in the CodeIntegrity event log so that you can add the exceptions to the policy later. Be sure to audit any policy to discover potential issues before you deploy it. - 3. **Merge the audit results with the existing policy.** After you have audited a policy, you can use the audit events to create an additional code integrity policy. Because each machine processes just one code integrity policy, you must merge the file rules within this new code integrity policy with the original policy. To do so, run the **Merge-CIPolicy** cmdlet, which is available in Windows 10 Enterprise. - 4. **Enforce and sign the policy.** After you create, audit, and merge the resulting code integrity policies, it’s time to enforce your policy. To do so, run the **Set-RuleOption** cmdlet to remove the **Unsigned Policy** rule. When enforced, no binaries that are exceptions to the policy will be allowed to run. In addition to enforcing a policy, signed policies offer an additional level of protection. Signed code integrity policies inherently protect themselves against manipulation and deletion, even by administrators. - 5. **Deploy the code integrity policy.** When you have enforced and optionally signed your code integrity policy, it’s ready for deployment. To deploy your code integrity policies, you can use Microsoft client management technologies, mobile device management solutions, or Group Policy, or you can simply copy the file to the correct location on your client computers. For Group Policy deployment, a new administrative template is available in Windows 10 and the Windows Server 2016 operating system to simplify the deployment process. - **Note**   Configurable code integrity is available in Windows 10 Enterprise and Windows 10 Education. -   - You can enable configurable code integrity as part of a Device Guard deployment or as a stand-alone component. In addition, you can run configurable code integrity on hardware that is compatible with the Windows 7 operating system, even if such hardware is not Device Guard ready. Code integrity policies can align with an existing application catalog, existing corporate imaging strategy, or with any other method that provides the organization’s desired levels of restriction. For more information about configurable code integrity with Device Guard, see the [Device Guard deployment guide](../keep-secure/device-guard-deployment-guide.md). - ### Measured Boot and remote attestation - Although software-based antimalware and antivirus solutions are effective, they have no way to detect pre–operating system resource modification or infection such as by bootkits and rootkits—malicious software that can manipulate a client before the operating system and antimalware solutions load. Bootkits and rootkits and similar software are nearly impossible to detect using software-based solutions alone, so Windows 10 uses the client’s Trusted Platform Module (TPM) and the Windows Measured Boot feature to analyze the overall boot integrity. When requested, Windows 10 reports integrity information to the Windows cloud-based device health attestation service, which can then be used in coordination with management solutions such as Intune to analyze the data and provide conditional access to resources based on the device’s health state. - Measured Boot uses one of TPM’s key functionalities and provides unique benefits to secure organizations. The feature can accurately and securely report the state of a machine’s trusted computing base (TCB). By measuring a system’s TCB, which consists of crucial startup-related security components such as firmware, the Operating System Loader, and drivers and software, the TPM can store the current device state in platform configuration registers (PCRs). When this measurement process is complete, the TPM cryptographically signs this PCR data so that Measured Boot information can be sent to either the Windows cloud-based device health attestation service or a non-Microsoft equivalent for signing or review. For example, if a company only wants to validate a computer’s BIOS information before allowing network access, PCR\[0\], which is the PCR that contains BIOS information, would be added to the policy for the attestation server to validate. This way, when the attestation server receives the manifest from the TPM, the server knows which values that PCR should contain. - Measured Boot by itself does not prevent malware from loading during the startup process, but it does provide a TPM-protected audit log that allows a trusted remote attestation server to evaluate the PC’s startup components and determine its trustworthiness. If the remote attestation server indicates that the PC loaded an untrusted component and is therefore out of compliance, a management system can use the information for conditional access scenarios to block the PC’s access to network resources or perform other quarantine actions. - ### Improvements in Windows Defender - For Windows 10, Microsoft has revamped Windows Defender and combined it with Microsoft System Center Endpoint Protection. Unlike with Microsoft System Center 2012 R2, there will be no System Center Endpoint Protection client to deploy to Windows 10 machines because Windows Defender is built into the operating system and enabled by default. - In addition to simplified deployment, Windows Defender contains several improvements. The most important improvements to Windows Defender are: - - **Early Launch Antimalware (ELAM) compatible.** After Secure Boot has verified that the loading operating system is trusted, ELAM can start a registered and signed antimalware application before any other operating system components. Windows Defender is compatible with ELAM. - - **Local context for detections and centralized sensory data.** Unlike most antimalware software and previous versions of Windows Defender, Windows Defender in Windows 10 reports additional information about the context of discovered threats. This information includes the source of the content that contains the threat as well as the historical movement of the malware throughout the system. When collection is complete, Windows Defender reports this information (when users elect to enable cloud-based protection) and uses it to mitigate threats more quickly. - - **User Account Control (UAC) integration.** Windows Defender is now closely integrated with the UAC mechanism in Windows 10. Whenever a UAC request is made, Windows Defender automatically scans the threat before prompting the user, which helps prevent users from providing elevated privileges to malware. - - **Simplified management.** In Windows 10, you can manage Windows Defender much more easily than ever before. Manage settings through Group Policy, Intune, or Configuration Manager. - ## Information protection - - Protecting the integrity of company data as well as preventing the inappropriate disclosure and sharing of that data are a top priority for IT organizations. Trends like BYOD and mobility make the task of information protection more challenging than ever before. Windows 10 includes several improvements to built-in information protection, including a new Enterprise Data Protection (EDP) feature that offers DLP capability. This feature allows an organizations’ users to classify data themselves and gives you the ability to automatically classify data as it ingresses from business resources. It can also help prevent users from copying business content to unauthorized locations such as personal documents or websites. - Unlike some current DLP solutions, EDP does not require users to switch modes or apps or work within containers to protect data, and the protection happens behind the scenes without altering the user experience that your users have grown accustomed to in Windows. For more information about EDP in Windows 10, see the [Enterprise Data Protection](#enterprise) section. - In addition to EDP, Microsoft has made substantial improvements to BitLocker, including simplified manageability through Microsoft BitLocker Administration and Monitoring (MBAM), used-space-only encryption, and single sign-on (SSO) capability. For more information about BitLocker improvements in Windows 10, see the [Improvements to BitLocker](#bitlocker) section. - ### Enterprise Data Protection - DLP systems are intended to protect sensitive corporate data through encryption and managed use while the data is in use, in motion, or at rest. Traditional DLP software is typically invasive and frustrating for users and can be complicated for administrators to configure and deploy. Windows 10 now includes an EDP feature that offers DLP capabilities and is built in and simple to use. This solution gives you the flexibility to define policies that will help determine what kind of data to protect as business data and what should be considered personal. Based on these policies, you can also choose what to do, either automatically or manually, whenever you suspect that data is about to be or has been compromised. For example, if an employee has a personal but managed device that contains business data, an IT organization could block that user from copying and pasting business data to nonbusiness documents and locations or could even selectively wipe the business data from the device at any time without affecting the personal data on the device. - You can configure EDP policies to encrypt and protect files automatically based on the network source from which the content was acquired, such as an email server, file share, or a Microsoft SharePoint site. The policies can work with on-premises resources as well as those that originate from the Internet. When specified, any data retrieved from internal network resources will always be protected as business data; even if that data is copied to portable storage, such as a flash drive or CD, the protection remains. In an effort to allow easy corrections of misclassified data, users who feel that EDP has incorrectly protected their personal data can modify the data’s classification. When such a modification occurs, you have access to audit data on the client machine. You can also use a policy to prevent users from reclassifying data. The EDP feature in Windows 10 also includes policy controls that allow you to define which apps have access to business data and even which have access to the corporate virtual private network (VPN). - To manage EDP, you use the same system management tools you probably already use to manage your Windows client computers, such as Configuration Manager and Intune. For more information about EDP, see [Enterprise data protection (EDP) overview](edp-whats-new-overview.md). - ### Improvements in BitLocker - With so many laptops stolen annually, protecting data at rest should be a top priority for any IT organization. Microsoft has provided an encryption solution called BitLocker directly in Windows since 2004. If your last encounter with BitLocker was in Windows 7, you’ll find that the manageability and SSO capabilities that were previously lacking are now included in Windows 10. These and other improvements make BitLocker one of the best choices on the marketplace for protecting data on Windows devices. Windows 10 builds on the BitLocker improvements made in the Windows 8.1 and Windows 8 operating systems to make BitLocker more manageable and to simplify its deployment even further. - Microsoft has made the following key improvements to BitLocker: - - **Automatic drive encryption through Device Encryption.** By default, BitLocker is automatically enabled on clean installations of Windows 10 if the device has passed the Device Encryption Requirements test from the Windows Hardware Certification Kit. Many Windows 10–compatible PCs will meet this requirement. This version of BitLocker is called Device Encryption. Whenever devices on which Drive Encryption is enabled join your domain, the encryption keys can be escrowed in either Active Directory or MBAM. - - **MBAM improvements.** MBAM provides a simplified management console for BitLocker administration. It also simplifies recovery requests by providing a self-service portal in which users can recover their drives without calling the help desk. - - **SSO.** BitLocker for Windows 7 often required the use of a pre-boot PIN to access the protected drive’s encryption key and allow Windows to start. In Windows 10, user input-based preboot authentication (in other words, a PIN) is not required because the TPM maintains the keys. In addition, modern hardware often mitigates the cold boot attacks (for example, port-based direct memory access attacks) that have previously necessitated PIN protection. For more information to determine which cases and device types require the use of PIN protection, refer to [BitLocker Countermeasures](../keep-secure/bitlocker-countermeasures.md). - - **Used-space-only encryption.** Rather than encrypting an entire hard drive, you can configure BitLocker to encrypt only the used space on a drive. This option drastically reduces the overall encryption time required. - ## Identity protection and access control - - User credentials are vital to the overall security of an organization’s domain. Until Windows 10, user name-password combinations were the primary way for a person to prove his or her identity to a machine or system. Unfortunately, passwords are easily stolen, and attackers can use them remotely to spoof a user’s identity. Some organizations deploy public key infrastructure (PKI)-based solutions, like smart cards, to address the weaknesses of passwords. Because of the complexity and costs associated with these solutions, however, they’re rarely deployed and, even when they are used, frequently used only to protect top-priority assets such as the corporate VPN. Windows 10 introduces new identity-protection and access control features that address the weaknesses of today’s solutions and can effectively remove the need for user passwords in an organization. - Windows 10 also includes a feature called Microsoft Passport, a new 2FA mechanism built directly into the operating system. The two factors of authentication include a combination of something you know (for example, a PIN), something you have (for example, your PC, your phone), or something about the user (for example, biometrics). With Microsoft Passport enabled, when you log on to a computer, Microsoft Passport is responsible for brokering user authentication around the network, providing the same SSO experience with which you’re familiar. For more information about Microsoft Passport, see the [Microsoft Passport](#passport) section. - The biometrics factor available for Microsoft Passport is driven by another new feature in Windows 10 called Windows Hello. Windows Hello uses a variety of biometric sensors to accept different points of biometric measurement, such as the face, iris, and fingerprints, which allows organizations to choose from various options when they consider what makes the most sense for their users and devices. By combining Windows Hello with Microsoft Passport, users no longer need to remember a password to access corporate resources. For more information about Windows Hello, see the [Windows Hello](#hello) section. - Finally, Windows 10 uses VBS to isolate the Windows service responsible for maintaining and brokering a user’s derived credentials (for example, Kerberos ticket, NTLM hash) through a feature called Credential Guard. In addition to service isolation, the TPM protects credential data while the machine is running and while it’s off. Credential Guard provides a comprehensive strategy to protect user-derived credentials at runtime as well as at rest, thus preventing them from being accessed and used in pass-the-hash–type attacks. For more information about Credential Guard, see the [Credential Guard](#credential-guard) section. - ### Microsoft Passport - Historically, companies have mitigated the risk of credential theft by implementing 2FA. In this method, a combination of something you know (for example, a PIN), something you have (traditionally a smart card or token), or possibly something about the user (for example, biometrics) strengthens the logon process. The additional factor beyond something you know requires that a credential thief acquire a physical device or, in the case of biometrics, the actual user. - Microsoft Passport introduces a strong 2FA mechanism integrated directly into Windows. Many organizations use 2FA today but don’t integrate its functionality into their organization because of the expense and time required to do so. Therefore, most organizations use MFA only to secure VPN connections and the highest-value resources on their network, and then use traditional passwords for logon to devices and to navigate the rest of the network. Microsoft Passport is unlike these other forms of 2FA in that Microsoft designed it specifically to address the complexity, cost, and user experience challenges of traditional 2FA solutions, making it simple to deploy throughout the enterprise through existing infrastructure and devices. - Microsoft Passport can use the biometric information from Windows Hello or a unique PIN with cryptographic signing keys stored in the device’s TPM. For organizations that don’t have an existing PKI, the TPM—or Windows, when no TPM is present—can generate and protect these keys. If your organization has an on-premises PKI or wants to deploy one, you can use certificates from the PKI to generate the keys, and then store them in the TPM. When the user has registered the device and uses Windows Hello or a PIN to log in to the device, the Microsoft Passports private key fulfills any subsequent authentication requests. Microsoft Passport combines the deployment flexibility of virtual smart cards with the robust security of physical smart cards without requiring the extra infrastructure components needed for traditional smart card deployments and hardware such as cards and readers. - In Windows 10, the physical factor of authentication is the user’s device—either his or her PC or mobile phone. By using the new phone sign-in capability which will available to Windows Insiders as a preview in early 2016, users can unlock their PC without ever touching it. Users simply enroll their phone with Microsoft Passport by pairing it with the PC via Wi-Fi or Bluetooth and install a simple-to-use application on their phone that allows them to select which PC to unlock. When selected, users can enter a PIN or their biometric login from their phone to unlock their PC. - ### Windows Hello - Passwords represent a losing identity and access control mechanism. When an organization relies on password-driven Windows authentication, attackers only have to determine a single string of text to access anything on a corporate network that those credentials protect. Unfortunately, attackers can use several methods to retrieve a user’s password, making credential theft relatively easy for determined attackers. By moving to an MFA mechanism to verify user identities, organizations can remove the threats that single-factor options like passwords represent. - Windows Hello is the enterprise-grade biometric integration feature in Windows 10. This feature allows users to use their face, iris, or fingerprint rather than a password to authenticate. Although biometric logon capabilities have been around since the Windows XPoperating system, they have never been as easy, seamless, and secure as they are in Windows 10. In previous uses of biometrics in Windows, the operating system used the biometric information only to unlock the device; then, behind the scenes the user’s traditional password was used to access resources on the organization’s network. Also, the IT organization had to run additional software to configure the biometric devices to log in to Windows or applications. Windows Hello is integrated directly into the operating system and so doesn’t require additional software to function. However, as with any other biometrics-based login, Windows Hello requires specific hardware to function: - - **Facial recognition.** To establish facial recognition, Windows Hello uses special infrared (IR) cameras and anti-spoofing technology to reliably tell the difference between a photograph and a living person. This requirement ensures that no one can take a person’s PC and spoof his or her identity simply by obtaining a high-definition picture. Many manufacturers already offer PC models that include such cameras and are therefore compatible with Windows Hello. For those machines that don’t currently include these special cameras, several external cameras are available. - - **Fingerprint recognition.** Fingerprint sensors already exist in a large percentage of consumer and business PCs. Most of them (whether external or integrated into laptops or USB keyboards) work with Windows Hello. The detection and anti-spoofing technology available in Windows 10 is much more advanced than in previous versions of Windows, making it more difficult for attackers to deceive the operating system. - - **Iris recognition.** Like facial recognition, iris-based recognition uses special IR cameras and anti-spoofing technology to reliably tell the difference between the user’s iris and an impostor. Iris recognition will be available in mobile devices by the end of 2016 but is also available for independent hardware vendors and OEMs to incorporate into PCs. - With Windows Hello in conjunction with Microsoft Passport, users have the same SSO experience they would if they logged on with domain credentials: they simply use biometrics, instead. In addition, because no passwords are involved, users won’t be calling the help desk saying that they have forgotten their password. For an attacker to spoof a user’s identity, he or she would have to have physical possession of both the user and the device on which the user is set up for Windows Hello. From a privacy perspective, organizations can rest assured that the biometric data Windows Hello uses is not centrally stored; can’t be converted to images of the user’s fingerprint, face, or iris; and is designed never to leave the device. In the end, Windows Hello and Microsoft Passport can completely remove the necessity for passwords for Azure AD and hybrid Azure AD/Active Directory environments and the apps and web services that depend on them for identity services. For more information about Microsoft Passport, see the [Microsoft Passport](#passport) section. - ### Credential Guard - Pass the hash is the most commonly used derived credential attack today. This attack begins with an attacker extracting a user account’s derived credentials (hash value) from memory. Then, by using a product such as Mimikatz, the attacker reuses (passes) those credentials to other machines and resources on the network to gain additional access. Microsoft designed Credential Guard specifically to eliminate derived credential theft and abuse in pass-the-hash–type attacks. - Credential Guard is another new feature in Windows 10 Enterprise that employs VBS to protect domain credentials against theft, even when the host operating system is compromised. To achieve such protection, Credential Guard isolates a portion of the LSA service, which is responsible for managing authentication, inside a virtualized container. This container is similar to a VM running on a hypervisor but is extremely lightweight and contains only those files and components required to operate the LSA and other isolated services. By isolating a portion of the LSA service within this virtualized environment, credentials are protected even if the system kernel is compromised, removing the attack vector for pass the hash. - For more information about the hardware requirements for Credential Guard, see the [Windows 10 hardware considerations](#hardware) section. For more information about VBS in Windows 10, see the [Virtualization-based security](#virtualization-security) section. - **Note**   Because it requires isolated user mode and a Hyper-V hypervisor, you cannot configure Credential Guard on a VM, only on a physical computer. -   - The Credential Guard feature is targeted at resisting the use of pass-the-hash and pass-the-ticket techniques. By employing a MFA option such as Microsoft Passport with Credential Guard, you can gain additional protection against such threats. For more in-depth information about how Credential Guard works and the specific mitigations it provides, see [Protect derived domain credentials with Credential Guard](../keep-secure/credential-guard.md). - ## Windows 10 hardware considerations - - Most of the features this article describes rely on specific hardware to maximize their capabilities. By purchasing hardware that includes these features during your next purchase cycle, you will be able to take advantage of the most comprehensive client security package Windows 10 has to offer. Careful consideration about which hardware vendor and specific models to purchase is vital to the success of your organization’s client security portfolio. Table 1 contains a list of each new Windows 10 security feature and its hardware requirements. - Table 1. Windows 10 hardware requirements - | Windows 10 feature | TPM | Input/output memory management unit | Virtualization extensions | SLAT | UEFI 2.3.1 | x64 architecture only | |-------------------------------------------------|-----|-------------------------------------|---------------------------|------|------------|-----------------------| | Credential Guard | R | N | Y | Y | Y | Y | @@ -222,36 +121,17 @@ Table 1. Windows 10 hardware requirements | VBS | N | Y | Y | Y | N | Y | | UEFI Secure Boot | R | N | N | N | Y | N | | Device health attestation through Measured Boot | Y\* | N | N | N | Y | Y | -   - \* Requires use of TPM 2.0. - **Note**   In this table, **R** stands for *recommended*, **Y** means that the hardware component is *required* for that Windows 10 feature, and **N** means that the hardware component is *not used* with that Windows 10 feature. -   - ## Related topics - - [Windows 10 Specifications](http://go.microsoft.com/fwlink/p/?LinkId=717550) - [Making Windows 10 More Personal and More Secure with Windows Hello](http://go.microsoft.com/fwlink/p/?LinkId=717551) - [Protect BitLocker from pre-boot attacks](../keep-secure/protect-bitlocker-from-pre-boot-attacks.md) - [BitLocker Countermeasures](../keep-secure/bitlocker-countermeasures.md) - [Device Guard deployment guide](../keep-secure/device-guard-deployment-guide.md) - [Protect derived domain credentials with Credential Guard](../keep-secure/credential-guard.md) -   -   - - - - - diff --git a/windows/whats-new/trusted-platform-module.md b/windows/whats-new/trusted-platform-module.md index e1ba634071..63176f7c02 100644 --- a/windows/whats-new/trusted-platform-module.md +++ b/windows/whats-new/trusted-platform-module.md @@ -2,59 +2,33 @@ title: What's new in Trusted Platform Module (Windows 10) description: This topic for the IT professional describes new features for the Trusted Platform Module (TPM) in Windows 10. ms.assetid: CE8BBC2A-EE2D-4DFA-958E-2A178F2E6C44 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: explore ms.sitesec: library author: brianlic-msft --- - # What's new in Trusted Platform Module? - - **Applies to** - - Windows 10 - Windows 10 Mobile - This topic for the IT professional describes new features for the Trusted Platform Module (TPM) in Windows 10. - ## New features in Windows 10, version 1511 - - - Key Storage Providers (KSPs) and srvcrypt support elliptical curve cryptography (ECC). - ## New features in Windows 10 - - The following sections describe the new and changed functionality in the TPM for Windows 10: - - [Device health attestation](#bkmk-dha) - [Microsoft Passport](microsoft-passport.md) support - [Device Guard](device-guard-overview.md) support - [Credential Guard](credential-guard.md) support - ## Device health attestation - - Device health attestation enables enterprises to establish trust based on hardware and software components of a managed device. With device heath attestation, you can configure an MDM server to query a health attestation service that will allow or deny a managed device access to a secure resource. - Some things that you can check on the device are: - - Is Data Execution Prevention supported and enabled? - Is BitLocker Drive Encryption supported and enabled? - Is SecureBoot supported and enabled? - **Note**  The device must be running Windows 10 and it must support at least TPM 2.0. -   - [Learn how to deploy and manage TPM within your organization](../keep-secure/trusted-platform-module-overview.md). -   -   - - - - - diff --git a/windows/whats-new/user-account-control.md b/windows/whats-new/user-account-control.md index 1133a6ea3b..3ebef21b0e 100644 --- a/windows/whats-new/user-account-control.md +++ b/windows/whats-new/user-account-control.md @@ -2,39 +2,21 @@ title: What's new in User Account Control (Windows 10) description: User Account Control (UAC) helps prevent malware from damaging a computer and helps organizations deploy a better-managed desktop environment. ms.assetid: 9281870C-0819-4694-B4F1-260255BB8D07 +ms.pagetype: security ms.prod: W10 ms.mktglfcycl: explore ms.sitesec: library author: brianlic-msft --- - # What's new in User Account Control? - - **Applies to** - - Windows 10 - User Account Control (UAC) helps prevent malware from damaging a computer and helps organizations deploy a better-managed desktop environment. - You should not turn off UAC because this is not a supported scenario for devices running Windows 10. If you do turn off UAC, all Univeral Windows Platform apps stop working. You must always set the **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA** registry value to 1. If you need to provide auto elevation for programmatic access or installation, you could set the **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorAdmin** registry value to 0, which is the same as setting the UAC slider Never Notify. This is not recommended for devices running Windows 10. - For more info about how manage UAC, see [UAC Group Policy Settings and Registry Key Settings](../keep-secure/user-account-control-group-policy-and-registry-key-settings.md). - In Windows 10, User Account Control has added some improvements. - ## New features in Windows 10 - - - **Integration with the Antimalware Scan Interface (AMSI)**. The [AMSI](http://msdn.microsoft.com/library/windows/desktop/dn889587.aspx) scans all UAC elevation requests for malware. If malware is detected, the admin privilege is blocked. - [Learn how to manage User Account Control within your organization](../keep-secure/user-account-control-overview.md). -   -   - - - - - From 37961dc791634ecbab1e836a4ef859acd00a8ae7 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 11 May 2016 10:55:46 +1000 Subject: [PATCH 231/439] comment out There are no users in ADD & windef atp app doesn't appear in portal --- ...ot-onboarding-windows-defender-advanced-threat-protection.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index 0dcc745ea6..08b5ac1f24 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -453,6 +453,7 @@ See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defen + ## Related topics - [Windows Defender ATP service onboarding](service-onboarding-windows-defender-advanced-threat-protection.md) From 6a27eb181e47ef168032cd61e3f7da3b40d16276 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 11 May 2016 11:03:14 +1000 Subject: [PATCH 232/439] comment out AAD sentence --- ...ot-onboarding-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index 08b5ac1f24..375f3f74e6 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -18,7 +18,7 @@ author: mjcaparas [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] You might need to troubleshoot the Windows Defender Advanced Threat Protection boarding process if you encounter issues. -This page provides detailed steps for troubleshooting endpoints that aren't reporting correctly, common error codes encountered during onboarding, and steps for resolving problems with Azure Active Directory (AAD). +This page provides detailed steps for troubleshooting endpoints that aren't reporting correctly and common error codes encountered during onboarding. ## Endpoints are not reporting to the service correctly From 210f6874285e2b01cf1d764b59c9db4c57f8c536 Mon Sep 17 00:00:00 2001 From: Iaan Date: Wed, 11 May 2016 11:03:22 +1000 Subject: [PATCH 233/439] testing merge --- ...-onboarding-windows-defender-advanced-threat-protection.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index 08b5ac1f24..209aadfb78 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -18,7 +18,9 @@ author: mjcaparas [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] You might need to troubleshoot the Windows Defender Advanced Threat Protection boarding process if you encounter issues. -This page provides detailed steps for troubleshooting endpoints that aren't reporting correctly, common error codes encountered during onboarding, and steps for resolving problems with Azure Active Directory (AAD). +This page provides detailed steps for troubleshooting endpoints that aren't reporting correctly, common error codes encountered during onboarding, and steps for resolving problems with Azure Active Directory (AAD). However, AAD may rise from the dead later. + +This is some random test text. ## Endpoints are not reporting to the service correctly From 8ae23a3694f668c2d3e9e9f1f0412ba45de5f58a Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 11 May 2016 14:10:42 +1000 Subject: [PATCH 234/439] put in Windows Defender Advanced Threat Protection (Windows Defender ATP) in Applies to --- ...ndows-defender-advanced-threat-protection.md | 1 + ...ndows-defender-advanced-threat-protection.md | 3 ++- ...ndows-defender-advanced-threat-protection.md | 1 + ...ndows-defender-advanced-threat-protection.md | 3 ++- ...ndows-defender-advanced-threat-protection.md | 2 +- ...ndows-defender-advanced-threat-protection.md | 3 ++- ...ndows-defender-advanced-threat-protection.md | 15 ++++++++------- ...ndows-defender-advanced-threat-protection.md | 3 ++- ...ndows-defender-advanced-threat-protection.md | 17 +++++++++-------- ...ndows-defender-advanced-threat-protection.md | 3 ++- ...ndows-defender-advanced-threat-protection.md | 3 ++- ...ndows-defender-advanced-threat-protection.md | 3 ++- ...ndows-defender-advanced-threat-protection.md | 5 +++-- ...ndows-defender-advanced-threat-protection.md | 3 ++- ...ndows-defender-advanced-threat-protection.md | 3 ++- ...ndows-defender-advanced-threat-protection.md | 3 ++- ...ndows-defender-advanced-threat-protection.md | 1 + ...ndows-defender-advanced-threat-protection.md | 3 ++- 18 files changed, 46 insertions(+), 29 deletions(-) diff --git a/windows/keep-secure/additional-configuration-windows-defender-advanced-threat-protection.md b/windows/keep-secure/additional-configuration-windows-defender-advanced-threat-protection.md index f8ee0d9239..d15039fdd7 100644 --- a/windows/keep-secure/additional-configuration-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/additional-configuration-windows-defender-advanced-threat-protection.md @@ -14,6 +14,7 @@ author: mjcaparas **Applies to** - Windows 10 Insider Preview +- Windows Defender Advanced Threat Protection (Windows Defender ATP) [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] diff --git a/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md b/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md index d598f44125..aa20462fbb 100644 --- a/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md @@ -14,10 +14,11 @@ author: mjcaparas **Applies to:** - Windows 10 Insider Preview +- Windows Defender Advanced Threat Protection (Windows Defender ATP) [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -As a security operations team member, you can manage Windows Defender Advanced Threat Protection alerts as part of your routine activities. Alerts will appear in the respective queues according to their current status. +As a security operations team member, you can manage Windows Defender ATP alerts as part of your routine activities. Alerts will appear in the respective queues according to their current status. To see a list of alerts, click any of the queues under the **Alerts queue** option in the navigation pane. diff --git a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md index 45d894c1e5..36891c04a1 100644 --- a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md @@ -15,6 +15,7 @@ author: mjcaparas **Applies to:** - Windows 10 Insider Preview +- Windows Defender Advanced Threat Protection (Windows Defender ATP) [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] diff --git a/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md b/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md index 0bc814cded..027fb1dad5 100644 --- a/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md @@ -13,6 +13,7 @@ ms.sitesec: library **Applies to:** - Windows 10 Insider Preview +- Windows Defender Advanced Threat Protection (Windows Defender ATP) [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] @@ -21,7 +22,7 @@ The **Dashboard** displays a snapshot of: - The latest active alerts on your network - Machines reporting - Top machines with active alerts -- The overall status of Windows Defender Advanced Threat Protection for the past 30 days +- The overall status of Windows Defender ATP for the past 30 days - Machines with active malware detections You can explore and investigate alerts and machines to quickly determine if, where, and when suspicious activities occurred in your network to help you understand the context they appeared in. diff --git a/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md index 5d49aaeb12..94ab04f8bb 100644 --- a/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md @@ -13,7 +13,7 @@ ms.sitesec: library **Applies to:** - Windows 10 Insider Preview -- Windows Defender Advanced Threat Protection +- Windows Defender Advanced Threat Protection (Windows Defender ATP) [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] diff --git a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md index 90719ac04e..11667c6d43 100644 --- a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md @@ -13,10 +13,11 @@ ms.sitesec: library **Applies to:** - Windows 10 Insider Preview +- Windows Defender Advanced Threat Protection (Windows Defender ATP) [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -Alerts in Windows Defender Advanced Threat Protection indicate possible security breaches on endpoints in your organization. +Alerts in Windows Defender ATP indicate possible security breaches on endpoints in your organization. There are three alert severity levels, described in the following table. diff --git a/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md index 1604e9f83b..fc87139836 100644 --- a/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md @@ -1,8 +1,8 @@ --- title: Investigate Windows Defender Advanced Threat Protection domains description: Use the investigation options to see if machines and servers have been communicating with malicious domains. -keywords: investigate domain, domain, malicious domain, windows defender atp, alert -search.product: eADQiWindows 10XVcnh +keywords: investigate domain, domain, malicious domain, windows defender atp, alert +search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library @@ -13,10 +13,11 @@ author: mjcaparas **Applies to:** - Windows 10 Insider Preview +- Windows Defender Advanced Threat Protection (Windows Defender ATP) [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -Investigate a domain to see if machines and servers in your enterprise network have been communicating with a known malicious domain. +Investigate a domain to see if machines and servers in your enterprise network have been communicating with a known malicious domain. You can see information from the following sections in the URL view: @@ -27,14 +28,14 @@ You can see information from the following sections in the URL view: The URL address details section shows attributes of the URL such as its contacts and nameservers. -The **URL in organization** section provides details on the prevalence of the URL in the organization. +The **URL in organization** section provides details on the prevalence of the URL in the organization. The **Communication with URL in organization** section provides a chronological view on the events and associated alerts that were observed on the URL. **Investigate a domain:** -1. Select **URL** from the **Search bar** drop-down menu. -2. Enter the URL in the **Search** field. +1. Select **URL** from the **Search bar** drop-down menu. +2. Enter the URL in the **Search** field. 3. Click the search icon or press **Enter**. Details about the URL are displayed. Note: search results will only be returned for URLs observed in communications from machines in the organization. 4. Use the search filters to define the search criteria. You can also use the timeline search box to filter the displayed results of all machines in the organization observed communicating with the URL, the file associated with the communication and the last date observed. 5. Clicking any of the machine names will take you to that machine's view, where you can continue investigate reported alerts, behaviors, and events. @@ -46,4 +47,4 @@ The **Communication with URL in organization** section provides a chronological - [Investigate machines in the Windows Defender ATP Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) - [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) - [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md) -- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) \ No newline at end of file +- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md index a4f830d411..6429c89aa0 100644 --- a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md @@ -13,6 +13,7 @@ author: mjcaparas **Applies to:** - Windows 10 Insider Preview +- Windows Defender Advanced Threat Protection (Windows Defender ATP) [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] @@ -58,7 +59,7 @@ Results of deep analysis are matched against threat intelligence and any matches Use the deep analysis feature to investigate the details of any file, usually during an investigation of an alert or for any other reason where you suspect malicious behavior. This feature is available in the context of the file view. -In the file's page, **Submit for deep analysis** is enabled when the file is available in the Windows Defender Advanced Threat Protection backend sample collection or if it was observed on a Windows 10 machine that supports submitting to deep analysis. +In the file's page, **Submit for deep analysis** is enabled when the file is available in the Windows Defender ATP backend sample collection or if it was observed on a Windows 10 machine that supports submitting to deep analysis. > **Note**  Only files from Windows 10 can be automatically collected. diff --git a/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md index 3e935d061c..9d94cbc155 100644 --- a/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md @@ -2,7 +2,7 @@ title: Investigate Windows Defender Advanced Threat Protection IP address description: Use the investigation options to examine possible communication between machines and external IP addresses. keywords: investigate, investigation, IP address, alert, windows defender atp -search.product: eADQiWindows 10XVcnh +search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library @@ -13,6 +13,7 @@ author: mjcaparas **Applies to:** - Windows 10 Insider Preview +- Windows Defender Advanced Threat Protection (Windows Defender ATP) [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] @@ -29,23 +30,23 @@ You can information from the following sections in the IP address view: The IP address details section shows attributes of the IP address such as its ASN and its reverse IPs. -The **IP in organization** section provides details on the prevalence of the IP address in the organization. +The **IP in organization** section provides details on the prevalence of the IP address in the organization. -The **Communication with IP in organization** section provides a chronological view on the events and associated alerts that were observed on the IP address. +The **Communication with IP in organization** section provides a chronological view on the events and associated alerts that were observed on the IP address. **Investigate an external IP:** 1. Select **IP** from the **Search bar** drop-down menu. -2. Enter the IP address in the **Search** field. -3. Click the search icon or press **Enter**. +2. Enter the IP address in the **Search** field. +3. Click the search icon or press **Enter**. -Details about the IP address are displayed, including: registration details (if available), reverse IPs (for example, domains), prevalence of machines in the organization that communicated with this IP Address (during selectable time period), and the machines in the organization that were observed communicating with this IP address. +Details about the IP address are displayed, including: registration details (if available), reverse IPs (for example, domains), prevalence of machines in the organization that communicated with this IP Address (during selectable time period), and the machines in the organization that were observed communicating with this IP address. > **Note**  Search results will only be returned for IP addresses observed in communication with machines in the organization. Use the search filters to define the search criteria. You can also use the timeline search box to filter the displayed results of all machines in the organization observed communicating with the IP address, the file associated with the communication and the last date observed. -Clicking any of the machine names will take you to that machine's view, where you can continue investigate reported alerts, behaviors, and events. +Clicking any of the machine names will take you to that machine's view, where you can continue investigate reported alerts, behaviors, and events. ## Related topics - [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) @@ -54,4 +55,4 @@ Clicking any of the machine names will take you to that machine's view, where yo - [Investigate machines in the Windows Defender ATP Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) - [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) - [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) -- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) \ No newline at end of file +- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md index b378be249e..78e8334b98 100644 --- a/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md @@ -14,6 +14,7 @@ author: mjcaparas **Applies to:** - Windows 10 Insider Preview +- Windows Defender Advanced Threat Protection (Windows Defender ATP) [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] @@ -88,7 +89,7 @@ When you investigate a specific machine, you'll see: - **Alerts related to this machine** - **Machine timeline** -The machine details, IP, and reporting sections display some attributes of the machine such as its name, domain, OS, IP address, and how long it's been reporting telemetry to the Windows Defender Advanced Threat Protection service. +The machine details, IP, and reporting sections display some attributes of the machine such as its name, domain, OS, IP address, and how long it's been reporting telemetry to the Windows Defender ATP service. The **Alerts related to this machine** section provides a list of alerts that are associated with the machine. This list is a simplified version of the [Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md), and shows the date that the alert was detected, a short description of the alert, the alert's severity, the alert's threat category, and the alert's status in the queue. diff --git a/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md index 9030f5baf3..5fba779661 100644 --- a/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md @@ -13,10 +13,11 @@ ms.sitesec: library **Applies to:** - Windows 10 Insider Preview +- Windows Defender Advanced Threat Protection (Windows Defender ATP) [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -Windows Defender Advanced Threat Protection notifies you of detected, possible attacks or breaches through alerts. A summary of new alerts is displayed in the **Dashboard**, and you can access all alerts in the **Alerts queue** menu. +Windows Defender ATP notifies you of detected, possible attacks or breaches through alerts. A summary of new alerts is displayed in the **Dashboard**, and you can access all alerts in the **Alerts queue** menu. See the [Investigate Windows Defender ATP alerts](investigate-alerts-windows-defender-advanced-threat-protection.md#investigate-windows-defender-advanced-threat-protection-alerts) topic for more details on how to investigate alerts. diff --git a/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md index cf392f9b76..c690ff33dc 100644 --- a/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md @@ -14,10 +14,11 @@ author: mjcaparas **Applies to:** - Windows 10 Insider Preview +- Windows Defender Advanced Threat Protection (Windows Defender ATP) [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -You can monitor the onboarding of the Windows Defender Advanced Threat Protection service to ensure your endpoints are correctly configured and are sending telemetry reports. +You can monitor the onboarding of the Windows Defender ATP service to ensure your endpoints are correctly configured and are sending telemetry reports. You might need to monitor the onboarding if the package did not configure the registry correctly, or the reporting client did not start or execute correctly. diff --git a/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md b/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md index 408d36c2fe..a6aa4e4472 100644 --- a/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md @@ -14,10 +14,11 @@ author: iaanw **Applies to:** - Windows 10 TAP program +- Windows Defender Advanced Threat Protection (Windows Defender ATP) [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -You need to onboard to Windows Defender Advanced Threat Protection before you can use the service. +You need to onboard to Windows Defender ATP before you can use the service. ## In this section -Topic | Description +Topic | Description :---|:--- [Configure endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) | You'll need to configure endpoints for it to report to the Windows Defender ATP service. Learn how you can use the configuration package to configure endpoints in your enterprise. [Configure proxy and Internet settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md)| Enable communication with the Windows Defender ATP cloud service by configuring the proxy and Internet connectivity settings. diff --git a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md index d63cbc5e4e..5e9f9204cf 100644 --- a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md @@ -14,11 +14,12 @@ author: DulceMV **Applies to:** - Windows 10 Insider Preview +Windows Defender Advanced Threat Protection (Windows Defender ATP) [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -Enterprise security teams can use the Windows Defender Advanced Threat Protection portal to monitor and assist in responding to alerts of potential advanced persistent threat (APT) activity or data breaches. +Enterprise security teams can use the Windows Defender ATP portal to monitor and assist in responding to alerts of potential advanced persistent threat (APT) activity or data breaches. You can use the [Windows Defender ATP portal](https://securitycenter.windows.com/) to: - View, sort, and triage alerts from your endpoints diff --git a/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md index cf4d6db60a..73150c185e 100644 --- a/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md @@ -15,10 +15,11 @@ author: mjcaparas - Windows 10 Insider Preview - Azure Active Directory +- Windows Defender Advanced Threat Protection (Windows Defender ATP) [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -You have to assign users to the Windows Defender Advanced Threat Protection Service application in Azure Active Directory (AAD) before they can access the portal. +You have to assign users to the Windows Defender ATP Service application in Azure Active Directory (AAD) before they can access the portal. **Manage user access to the Windows Defender ATP portal**: diff --git a/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md b/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md index e9273d47ca..5c4aeb34ad 100644 --- a/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md @@ -14,6 +14,7 @@ author: DulceMV **Applies to:** - Windows 10 Insider Preview +- Windows Defender Advanced Threat Protection (Windows Defender ATP) [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] @@ -24,7 +25,7 @@ The aspect of time is important in the assessment and analysis of perceived and Cyberforensic investigations often rely on time stamps to piece together the sequence of events. It’s important that your system reflects the correct time zone settings. -Windows Defender Advanced Threat Protection can display either Coordinated Universal Time (UTC) or local time. +Windows Defender ATP can display either Coordinated Universal Time (UTC) or local time. Your current time zone setting is shown in the Windows Defender ATP menu. You can change the displayed time zone in the **Settings** menu ![Settings icon](images/settings.png). diff --git a/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md index 3507931e5a..10afdbfb92 100644 --- a/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md @@ -13,6 +13,7 @@ author: mjcaparas **Applies to:** - Windows 10 Insider Preview +- Windows Defender Advanced Threat Protection (Windows Defender ATP) [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] diff --git a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md index 82e4e30592..291ea6dd16 100644 --- a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md @@ -14,6 +14,7 @@ author: mjcaparas **Applies to:** - Windows 10 Insider Preview +- Windows Defender Advanced Threat Protection (Windows Defender ATP) [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] @@ -26,7 +27,7 @@ A typical security breach investigation requires a member of a security operatio ![Flowchart describing the four stages of investigation](images/overview.png) -Security operation teams can use Windows Defender Advanced Threat Protection portal to carry out this end-to-end process without having to leave the portal. +Security operation teams can use Windows Defender ATP portal to carry out this end-to-end process without having to leave the portal. Teams can monitor the overall status of enterprise endpoints from the **Dashboard**, gain insight on the various alerts, their category, when they were observed, and how long they’ve been in the network at a glance. From c72df49d22d2125e35f7d74347936ed7ce1e0d0a Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 11 May 2016 15:48:36 +1000 Subject: [PATCH 235/439] comment out service onboarding, add Configure proxy & internet in Related Topics --- windows/keep-secure/TOC.md | 3 +-- ...ows-defender-advanced-threat-protection.md | 3 ++- ...ows-defender-advanced-threat-protection.md | 9 ++++++++- windows/keep-secure/images/timeline.png | Bin 33060 -> 40226 bytes ...ows-defender-advanced-threat-protection.md | 3 ++- 5 files changed, 13 insertions(+), 5 deletions(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 29887bde01..fe18116b84 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -403,6 +403,7 @@ #### [User Account Control security policy settings](user-account-control-security-policy-settings.md) ### [Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md) #### [Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md) +#### [Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) #### [Onboard endpoints and set up access](onboard-configure-windows-defender-advanced-threat-protection.md) ##### [Configure endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) @@ -410,7 +411,6 @@ ##### [Additional configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md) ##### [Monitor onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) ##### [Troubleshoot onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) -#### [Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) #### [Portal overview](portal-overview-windows-defender-advanced-threat-protection.md) #### [Use the Windows Defender ATP portal](use-windows-defender-advanced-threat-protection.md) ##### [View the Dashboard](dashboard-windows-defender-advanced-threat-protection.md) @@ -433,4 +433,3 @@ ### [Microsoft Passport guide](microsoft-passport-guide.md) ### [Windows 10 Mobile security guide](windows-10-mobile-security-guide.md) ### [Windows 10 security overview](windows-10-security-guide.md) - diff --git a/windows/keep-secure/additional-configuration-windows-defender-advanced-threat-protection.md b/windows/keep-secure/additional-configuration-windows-defender-advanced-threat-protection.md index d15039fdd7..27f9ba0d01 100644 --- a/windows/keep-secure/additional-configuration-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/additional-configuration-windows-defender-advanced-threat-protection.md @@ -39,7 +39,8 @@ You can use Group Policy (GP) to configure settings, such as settings for the sa 6. Choose to enable or disable sample sharing from your endpoints. ## Related topics -- [Windows Defender ATP service onboarding](service-onboarding-windows-defender-advanced-threat-protection.md) + - [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +- [Configure Windows Defender ATP endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) - [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) - [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md index 36891c04a1..4112e61248 100644 --- a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md @@ -1,5 +1,5 @@ --- -title: Configure Windows Defender ATP endpoint proxy and Internet connectivity settings +title: Configure Windows Defender ATP endpoint proxy and Internet connection description: Configure the Windows Defender ATP proxy and internet settings to enable communication with the cloud service. keywords: configure, proxy, internet, internet connectivity, settings, proxy settings search.product: eADQiWindows 10XVcnh @@ -175,3 +175,10 @@ Verify the proxy configuration completed successfully, that WinHTTP can discover 8. Verify that each URL shows that the name is **resolved** and the connection status is **listening**. If the any of the verification steps indicate a fail, then verify that you have performed the proxy configuration steps to enable server discovery and access to the service URLs. + +## Related topics + +- [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +- [Additional Windows Defender ATP configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md) +- [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) +- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/images/timeline.png b/windows/keep-secure/images/timeline.png index aac0e87a638a8dc1f1cf1ce2e2f4021241deab00..83ac56f312d0aac4d09a5f797e5e2b3099355596 100644 GIT binary patch literal 40226 zcmd?Rbx@b>_dm#EfJ&)|fCz{ZigY&$(gI3KqjcAsE)m3{yFRpUA&|LLTD~!%hs8xRfx)_+`vX%oKQ-2@L1EgkPba z+Mo=~t!GUh0HA+tPJ%HP-t1W&D^jT z=X|e~?rY@GdniLwT{N~m+^g`*Rpb{rb3K&ZYb#web&E6PaLn_I8(M3dyoN)q&`N8I z{9yMLWVh05D>FkgeY9HQ*$=P}LB z4N)e#XlbjR)M#k;(8QlTmA8*x9&xjmpK(7sk=c)Ub{G5QWT05P?1SKZ{EPThA>p@g zsIuh=#`;K(bPq_mIh&e1S1eb5qOCeWRo~KO^vOp!jC&*=cU+17y4;&QA}w++3D%GI z38mVf30h#0KhcU6D464s6X^fN$v{C#`G}6rH1Es#ncqHcbL)snNXR-n zS6W$HJE^hr^Si#NL-T7$+~2p?)z!sTA@WjD?(FP@^BHpcc+zIhZ-`ata8Q-OJ#2D>)nvOh}bj)KW^pkh8L4&c--D+@o=6XHit(FkrShB2h`xMPaEg zSLx|f_l(R;jLO!*RR8Z27HK6Villz2O}aFXAJ15Dww7z@KVV~1z{kgLY--|3J=!^N z7D}Nd$yO&ZYQBqPqotvATZJgUO94s;{xpjUn+V*I*%Tf2>pwU&r3nO-8F6zAtEA4ZuH@9Y6 z_$<`!Bhll`rDH@jlZ!#_YZPz#<|kDM@-}{+o+7Pgz-6s40e| zh4)UypsQ#-y9<9@Mn(p$wk%5Nwsy21k5U z%zRgwne*Yqiscw{mP<%TP;af7^5yC7?q=0GTC@J`9}`0-u2O0iqg&oE_0rTd8;ppD zs$w(lO^c6z0=CFVOM4+9@%i(YFLWW!iSI~=iH+%%Uc6{GRNdIva9qxBXg=VN%T+p& zXl!hhS64SR8(Kio2ndYHKHanDZT$TkIk_ylZepI@;CE{)dzdwM%&a3{h;C!>quB!f zI2mzqaX2ckQWX3l=AFOq+RHa@zA`g2AF`!si->sLrc=>*Bx+?U}Wk&Ib{HBo-3OE^3{)L2Os&}Gu7%Tg}nrZcV-4V0IY!$UQH z>F@7%Wph~gRx>|u&@@*6B$i~%IuVQaCLZ!UUZH=2sF&<&j$&p+%Ha0!iaFmVKhqOq z^uK=QrU+95EE)hm*xHu#W~)+vsC!+;G8Vu@`b1AJ<>1|gihJN&+o=z4Yvh({%E&O% zY={tTZf%9c#f{BadHk8%O3%t_X0Cqsy*1Slj{H4im7bsfl0S}N{`5lFMdS&vs)vWw zR{HaW!0|Wjc_kzy0>RYJpL@@?M5S(TZ~rsmRwIZm4mJpY3(suW%PT6T{QUWoK8)>f zb&pm0yVe&UpAa2vL9aVt2g9zEm_pGvA|fJ<5C)2hwxgHN?cOc`mme(9{c`QvwOa%P z91l4>k9yPvjn)dTbK*Ra2^saZ8}P}wN>a+<@7Fp1Y2zQ%UGuM{%O>LOBmBE-V*=wx zOkjL?pANe73FejO`%j(Lg5B?X#R9FJb6YkC{SqE8Ut%xg7N8b7_+Bac&&OJTHmbdojXxSJSI5sHmyYmJW?fS?%oX(9qK>T3Y5)q{qj{%eBL_&Q>ne zd-UKz9W(lq@gQvUNT!@;TFR8lv4`y;3Ym%#9x4(SyZC;B`Qd~vr)d;7M%I@Gm?k07 z(ZhynUJ0Womyyw+M-g+F-DUpAgW~=EiR+mb0rIxB?WL)QZ_UE3R3>*a*O7LqGBjyHj^aS*B%EgLk!&sPvF-f1s9zO>sQ|}W zSy>%cox=GKXZzMvQ~0W?#C>OuD8w-})22?4B#J)pag?4A4=-_NsSj62xm{Am+&oZw zn{kD|o4a3_DA25oN=>y(n^K%ya(8iIW#Vw7`Qtxh<|{QWHnn?}Oh@zckGMo|ySj#= zTK~);ZyCSlNWy$6C@Si4Zr{)&XU6guIyySP&nI9vvw9#i3rk33q>J=2?9UUD;hK3#9L@Y&G-!H%nGT2=nm}M6f5>j~aLd(qj zPavg{kx?MUuV23&v9QP)_vQ3JB*P~r&IH_HxH?=mSZgF~5Ou10p5^<3nd z912wwN~fwvuc@Szs$OAhxH0+5$iQHJJ7RinE;AwF`|)$frOpn5zPtzSBhKD?0{xW> zU8zkgwo!3Dui-gV^0eG%3UN!EwIt&xB|{B5lfCk&LkhdAd(`rK5}RJCp?Bc4q>!Y+mBBV9Uc5rk8^y(J~%Ee zx4TP4Wt&BjaDju zAz)Ax6clVfKx_v#Z%I4emZ|TM-fzl(@cbQTQf0Ha4f&xKAQbMRiD( zoN&o>q`bIKchn_K;jtMRwK$E#*{j^Xr7ym@Jk->pTwGl6pat?0O-)Ud=|g=yW@=8# zcB{kbKYj=nepS)X$iaWC_z(`9YVhN@7z)|IOdx3VaKOtE{Ey{v68LSWjK*nq^jY_a zQpA>#fVtf7z^cHcTw$NyA%P0Tz-GhxZL+bu32~Lj>Bo<$qPnzU*67uH8JpK#l_KR( zVHhPQL8)s;!Tdl??Z2q9%oE0?@>ckB)UYjma#g%nkO}~X! z4z~A|B4bp`)wwiO39&zviRh4d^j*VLK-~nR>fNN26dEcj5r`;(v|H~0moUv$sL^x9 zNSh9oNNvrvaj0^Lb)KFau|c7r5!M8Ew@IE^DIHT(Q;R+*1 z(#~LMago-}aB6aLd*TCGq#MSlF8#xY^9ql>YCms%*%OHh=^EV!OPUV$nM9NrYFf8% zTp4veGL?$sA35fE^hn&t$45d;?8UQZo?Ko(T4Q+diH9^EtuE}`nefQ>0eoB9RA77j z9Okyu$marRl~}Pu>DPNjxe?=!`i2Z^ z#U5(}ufE#Jr!dqQCWNub8Z$HQtS`#sp&RP#{0dP-S;dr4H12AKrcIAVjl`TeJfF;r=rS`QW} z9WDK2WS#m#h#OP|Bp<|IIevb7beyp-Ac<^j*!8)O1`{?Xld07PaYPLUFmE7$uFxMm(FW2sAaMZdzLI(zZ>&|#@gp&KSukWhW z`0wH2VSe-6^mK8#l;;86qXh{`NzVcT0w5l##Fd8l`^S5FUMdu~&ui=tcpysaMke4| zsWi0GZ#SZaikSDaTa=lPImElBys7(sXMUrrO2bWium`ytxBYZ5d*#qwRxSS|BtFHt zh?{xZvgdEckpXTGvR)=s~#uMl>mekal==zXPf zmr#bue$(ltqix?yB$-y=7B}u0ti20vs`J8#S=D4xhRlito|tk;!q-1YGWmO3@P5d5 zp(NTyx9pyl;&HNjZIpJCPF^;aV$^FUJaDd-?y9S+<009q->kQEp@(eqGA1{>>1`S{ za)w@e-c;h0qn6^cFmi0fQiUw>iIY9uMI5*?Qc?;KzX$lf=0e%hyh;S&0z!%2-lyed zlb-HwgR|3{W8Gr>JN5;TEBY7{xmGH>T*+Uvfi{)$WB&%xc(4(Nr{AJ?i^T!SGJr|eW7QlM7G^wF?GnkP?Ul59o31{;+;(M9 znvS}>t8-H~^SXAl-zqN*oK1C!bc1t|_Om$Bj>Ba>x75fKxl0JGQj12M7mC%DA|(eo z9zuz{ib}@2cLOx6=-U0=YKb*foQNlA&9NuHN(2-txL8|?3| zMfA9K#dfJZK}e6|?fm?F{0Il6i#P9~wxw0Sa+^V8IF%WFP^0V30?q4vm2Lz4wFNct zHEEfV#}Kg~!B;q|xZkM0RDzmcTZ-Yf$zV4h&D!2ZwM28t4V9XgF0+u6KjpDoUEVQf zsn_uztdJ(m-TCgBf7rJ90RHV(Y`c3fp$A!c2njeG$i1f>$TVoU(iBAF?clD>e`%BN zPAY;MZ&SO^T-h$f-qCYN+Wr2}BZ7b;u7;KDYh1FRM@V_K6~~ow+2@PlTiD5&#C(7&mX8KM{r0DQvp8FseN0|igQJdL92bQ^Q1yD8k3|# z28%V368)d^;s;G}PG`KqJuo^tYj9AdDe>NlqP%?f!c{oT`24iDm`N3v&bJ7i=UnX0 z@irPG>wi;-{Ev?LPt}5UXx5}TCO@&o5apISW>;E$k{w0cbc=WEYb8(SyVjtjBhvj4 zUoru5ajO;!nkmiOyN*MFMZc?>kI(vYYDAg}JDY3Vf@4zasWjUi>Z|L7M3?r;ltUN% zX0tna)<}aX-oN+h-Ksee=2*Mnbw}l#s;hNKTR#Z1*;~1)A{YFi4=eT5xFs_tG(F2P zw`m8tn6Y+)vD8c7&b12F(HMon%{~rF@w4Jtg)%+Pijmz!hsn zb&vslyVd+svoPoL=c4DBxFn{Eo0|3uY%VHe{pnxcO>`ZK2#avicF~jIeQxmPtmIS@dwlDU>8u#K z?(Z=dVsX0tb%ol?volIfHf`#qyG|!#b9(6oi+pg9oNkX3UkUwh$LUAvL=I&G1z!bl z$PU!VdU}^i2D*w<9*WwH#cD15aNoK}e(tntPh5jzsQa+=+uiRtX@k3T!);vLI#!S& zSYs$x|1#WEp0zx-SDTC4*|%(Tnx@v5GZ8O9{Zj@uzC|?AKIDWOy<=;+`tNf&%vv=N z!mArZ^maN5HmLY!=KrByYo#e{a_{CB(;2tNRuUGDlyPNr?il`>+2Gd&=Nkw<4+o_S zA#ukX*LBR9*<(Y-$nDZh)!uLlneN;Ic*-FRwych)5O{20Hz}dBylSqun{wLYdW{qq zUAm*Av=R-(`j^`((~!wPVb~Q)Qhv1S8Ba$=_466>f3st2l}<0Nj#VZM^`X}IO4E~f zJh^b{Fd3>+>Z#%=Yirv%-u%mY&sS8K%d|J;hAzR-Q2xQX<#;|{dU3$!_tL8h+`z47 zQOIOl9Cb1)#QJH!+;7=*n!LM;Q`6QWJNiI?3B!W5cTH-~2eJJ7wi;S6ocPMbl~#s- zqtbcwK${aNm;Af+f5&31qs}ADlNV9DY{tKqdwJ1An)j z_)UAFb2Yxccgv8Q|9#zMeVu~Oscp<~3OA=$Mo(lO^7M(lo+sq@oVY4kp!|Pb7yQf0 z3r01S_`KqVtejG zmrAz zZmvs81m2HrK>>Z&Z6iU8vNXmOoQ8+FDuCRhe4KvG84Kac9$oDUyIg z@4Cc?gwLxtk?X&e4jsOezK0Xn4O9nri<6^Mke>9F2U<_4|Mp{Y)%JyCTrUm1DeCvRs; z)g4-Qcjk@bVhUZpYn+~iJ4^2hNuKlPXj+(m4ePgB@JHyS7p-=vW+6rD#GG_;a?|C5bx4@qDDP2}jLbbtNy zE#1Ek`@h_%eG6>~SrwH*;3?7GVyXZs2h=-y1)&EqvyQIrBYu7jQojb~k)<7)N00vW zxW)9Q%ic>K)K}kUY@OoZ7hgdujv4 z#bBWh!ta41nI3|+gBcGKQwQ&cQdzo%uDOT;p1G5Jh0`;>I7xfzGG%(Z@%@#Kfdjv)R|q z(MPwdvy(fUfL5xtwY5ZTSvrbc3fT9+LAP&!nDtv#p(}Ba7y{%aR1NW(-Szb%@Pa!V zJ(JG)t|yL2muLguUiAKYj)eK@D7wbmwm1PzXoCe7nT>D*x5IJ|dPs6m(N${Xs?jTj zQHMuHM#dAced9#+TqEb=QbxLg+H8bjO}bn;NW(KFg-TpjT>MjV;H+&0uy?vSeLYOd z^72W+!MA?Uqn!A$cx@}nc}VQ5QRl6jmr_zb6zLfm5@w}C(Q)D7X@P+^t@)<(p5B8| zij2IY>Tx|9hMH;fz&XY@IV&qmx=)`khPcA$*G+p9=$}Q^bigA(4~Qw3ys)s4@(-<~ z(m$#|f4|YzZke&1fR2q7=iSgl5AuHVf*axBXf#}01H5`X=!Oms4xwXmsa@$%z=@B< zVQg(~%D;ShqsUiQQBkDUF?O;4KKHtFe?IBWw9HUAys@zLHIM~yRBuu!jsdF~ewT>|tYhDJuRmX?;K1e=^SWoq=9(ThHP`qXb|q{K9e=sGJqyAiY_Ll1C1)K$i>N~o*H7#SNo zRlaI?-^58~i&gjeOH-Kd+<&wHUv~Pn{nEdF{n}@z2<>G28#jP@9=>fqVWu{{-A$63 zk|F{g!75tw8;K^Al)^BNpzkLSl_VDw=@LL_Tpbil;DIvzGc>CDmO|<#^3?1_g@q&j zQC0$iDFu2~9U*hPQ1S5=-qcOY%EEHQORKQfHdo0f3=t8}$jx2rj_jGR2oI^skylcB z%*2*E!0xCBvak+KTR%d!i{Pmk33uYa9mHEm~SXjH8(m zWn*Gveq3^=CXQr@9NMq5sB9Qw*_hx;rl1D7#L?hfhx_QZmI#?uNZR1e*E zvE>x0D7|WNc%l(kWgooC5vljyjntamm@>e!Lhzm5I-n)!7TMa+qPtNZ7!{S7EEzV) z@A}SCFhA3r#;dyaY2yXFrD{lWosn$D@7S5v{A$U*J8aGF5L%2M-{zzevbD8My{(9Z z#_VjiFb9V4T&-HJq@dO@i&XV?hUg{aS>A|mKj zSD5G(XWQa(8yh7GiC!p`m%p-vFv9Q(%=YHZo7Uar@e5jNKY!NO+uqUX_?EW1xWD`m zBqBXMJu&D5pS->0ZET8lBirV*Yk5&`)Vv|N|5@5mQIXvdRZ1`hV^Zc_>t!vh*qoTe zCn3oW4-c1~Ys_iYmy(it%1~R8u?%4X991%YEDDphUZ$LJdS(WqWMk#MReQCVma_cJ zS~eP*47pc>`BA2f-!HJK*@O2|zH0gX+ds*yf*hsr8mnXlWG#HV{o0|#X(xQRBBG*u z-(;|))NK-dKYx~$mk&<<6-v=G24fNWf$S2}S%IcXUuG=Y2~!d@v|}QfTEXF9B8D=^ zK`S>xi`cvo8P$|Q*&{zu=!>*tl7uxSOGU9qxaBGrrYM=C#;5WTJVWu%k8yDc3FfF2 zqB!F`G9TZD)P||6hhn`5EA^--z>#=KUsu)o%ZjfeN|-=8O$FGrNQ(B%Ys=Sgg@$|^-(@%U_K!(xvR6ORw#l)s(N(5NY*?>r17`;w{^FcyV z5=q~Si$;Z4KXolE_YkWCWXjPt!JNwlyGgQq1*u5W2Equ!a5pjOpq%FIooy>QbJEk9 zf>xi@^F#NtdB@3#mgu6yWwS5WM&46Dek=*Y3VBgaEF>&U-*C4#4pS-7T(3d908}>V z>FF6+S*&xQNZHPa&;!JB5UrnHWynInKoIvY>&St5q0JCvEs|mMY;I!}*KR_}n~65c zsxa!I0o78Y$>F2)J{eXf^hV}JT_pnYXjNdf;b3gXsyO*_)F4Q_0JrP1rw-)B)5$6IX*i2E<||o!%a^z`#yd? zz7dm?>zsU`8hEUj#o70Z%nHsfw%>R|NkJiIbQX}6ks%AfE;VUXY~I?+iWPb*Y^zNyeTy`70(Dt`7iG}XkG*0(ffUUx!n4%CO{UTA2bSj77pQ-=tD?L0l-dt zw$Q~~x3bX-770YbOhoVwHq*avY^_008vpif8d}=t2L}g$@Vd7bx{%}o`^!em0QIG( zq|~b^8VMX|F2hO1)^pNZYeFAz{w$y}Dl65ZILvz|e|=GS^$IDJpnLLD&FtTv#WhS! zxKIwSAmXL)yeMAtQDdP zfYeekA_MkSQBi5O`F8&BMebyPpD2{2vp_8;XKiiWKC`zrmOD_WALZ5-&Lo75jeSw| zH+f1zHtblkV^c?_&&^CP=FQfsa8z*25ab(g))_qzhF$IF=4(1g0V*63ebaNZ3Z>>7qHW<*zFVxkAV z+ws07BIfA4OLzbN8!b$(pO=iKOF^~)G698|nHk5u5xbVX+_JI(EK2a3b{^eGM5c^Sv) zh`8C=FrCpYK~tye>|UF56RFlXV7}_=>CsSAH+0@@v0wc8>#O!2#?%h6Iu%lUIl#@Jh- zKNz=u8I2(DUqT0-5#ij&;`#oK)oQQ)TgnAF@qg!MM7H%3_&9Xi zjSr#!5ikFrXxD!kuK!Lv_CM;`{J(XuH{ov|U_p@7=*DvwCnPjfB~)BmS`ljYn|OFg zdXJbp7uT4dlKfRvNe03nAo*s8%a<=Bb-@k~J>ECJ)n43T^YQJ`O44)F&?{aX415he z#lR$(U_b=`90kx2u>}Pil%o}D0(oD_;DS)mAw@Mn3MhI35j=YIDAeV$+0fh;B4&c9 z6PN@r1?sNk zUPlC`iBLC*%L0ZebN$O=0G?`jalgIXW(oR5;(xV#S?IJnj6Xbqb`lR%9^m+amdGXu zD8GFtGc%L27~^Unt8p)_wTre2fO;YkLUKVR?-Np9`@F7A_kW(rg*^7}qHcwPV?VU+Q2-3o82udkN~)U6etIui-=)dF5EX|+QB{4N$u#CiS+ zQ*S>5J_^(+;b%N0(q^WhqG|-4*c3@KlnjB*Pw!M|C@Uw2a3A7pi&NrYcd~QGsD1z8zgTqef5mWb zo|)eslylLFZ~E(BUjD=>YD052g2%2kZfK3?3R5(CX4JnD)&Cg*{ok$;_nWJ*{~J?CR)4C=g-$5*C_)#bcf9-IHzKj8%ggsW z2(YW#ZR>Np^pRc&EA8~~D$mcgy`#1jP`}px(wS)t;kFomyIQ_P4*|z$e|_Tc7lSKP z|F6XmyHN+xL=m4(rJBQ@@AQqr3m&-qK#&9h+w$>-OAUuDWLO17MWfB>KX*Wx#(%sn z1bkQ{=oh-vUS51LnXr&uI@)=(R+IZkF2!JbzJuF&KM&E>W0Uc#IqfdL1W^n;YWa71 zDlh+@Or@orK20TXhMcNhl^9+JS;(f{-#svPy5dgdHID}S&?`P(nFPtr;Aw~D%JKZS z61U-uS-e!6p5zC?j7(}QIXGP)hG`WaXN;#KinX7-%ErMV8JJUZ>WECcE$|(i{q@%; z)6@c2%UA1th>PvkH2AjLg=ULVV;vfFe!ZZrD=P?`Y_oWg-AJU3wO~Rkac4 zt(M)&Cx8+XaRrWF08RK3Bzj)BWH}*^l_IyKFmfurWYr+O#b+_26I+wo+l4-l8V z#;6aU^{n^lW>}3ugD**7(p5Yv11NW|;o`1Y#Q?L)w>NB!+>A;(I!#H#K^QKiQmE$x zkO2hoxyCtVB7VG^zquUo2^WD*fKXWsD-+b6R*Gl0Vd^^YlEPCg28fb&^yh11^~M8yek)JuqJy0y5-AnM&4_9nsc)_hLm}ms&hu|Wb!!E^ z;GG{rXouN4n6Lc-NJW!Yr|k|=HUP)(z0ln({RB?!Q&A3pTLP12n!=*KKh^r(-gCP8 zZ3@S_Y;y8V)xm6(CzjAp^AghDrk<9~Q-e1(y=Q$s*n_HL83M;A_Sj@pBc~01!F)Wj zXKj59g{ARAFH}{dAW#C8-;w);zV0F}Z~Ty1g%tRze)~b3+i4m9!8BeBm$gXU2i!iT z>dg@PH3|{|SG5l~B%Pn|sGAL89`z_FsZ)w`+bjk{`m+HqZgK>Ogym?7+ME`z+U}He zTq*8jbv?Epaa_s<6yCi#(*$vR=O>=bJeW(R#6;Om^OP$Hgs8v`o{VD%K67f9K8}+ActfD44g~j>Mpe{`upX!<@AU|-Zjs}T(aJ!f=-FZJS;phsO6GZH7;L{#TIH{hIb1^)oVR_OuR)(%0K-hYm|nLt_PT*?UOY(&DXDAJDwiQ?X>c&860fR z0HA%|Zo_Umm_)>)_wd03p+H#OkV{X1Bcy=ZvcIh7<_AGrUej}M^R^#d&TQ)}{Rp}gzG;UoFX7(iG zN@F`T1xz{~xE(yVtz@z^f6 zN10a}N;@s4r=ou0D?J2uT;S}Wjk37(IpbYk`xhJ|sGy|Xajmt{szI3AIHbG=(9bx% zV0n{-TRJAxH*V3*JSHghgnM*0OfyhZw&_vLVC!~K@B4}Qj>N`4e>$r6Ml)gQl&ksN z&rf*V0GQhy;#?2Y;r+Ofc=kZlS6)FOq?=G`3_OC9v_a;G!O(r zG+GLh;SU&E=|%P=iux^v)f^`SH->P_Ii(g8KjO)STwJQyP5R?MkUEMXj|?>uE0FcV zkm`+a>7-+M2iE#r>5=GYYHC_yx>nf6-zDRADEF(O!Fc$aCG=Lf9kT>*g25aKlei$$gPlgRau;uH#Y z4U7wL4{pmz&+?^D{m5dokM!s;*RNf@+5yXnav^d{?u|O-QY^shv?GBU=0{p~wiJZO zJP4i1s%B-$eM9_K(;pG1fm>k{vp)y5F;LtJAZE|0+>~(H{6meTpZgCU>>zQH+kQP> z!(~U|y_Z+xjFpYieGPT>Y$&~u2|c!7&%tWa&j{A8Y&vm+Kr>kBP>94{nAeNDL*`)= zfRUHr(UfFm1Ci;5%;v+z%<{#IOjhlBEb$d}CZHQ;_KtRTa^2Kn8RW8+K%DdDC;roY zZR?Ryz?)GeT|qMl*^8X^%)~n()JwUXENO;ypE^M5 zgs!OsBtlSSx5wCxruX(LB7?;Z78CKkn+|;G{9~>0-Dr;(%kvvm6klj<)%UaLD+xkmZUkEiFh9U+J*L`sU}As-0d{Kwq8jE@L*2 zWkCvg@985+h#Q#N}CVd$Gqpm()6{@ud`hZrJT7SJU=WC9w2$c0Xh z=LGs-0b=u#j>kr9HTb|GFgO6pXhtj>NDznN-ygpS#0l!aDc@#Eab>7f22xuWUFqVbuLl-F841+6sIP$#?F$?W?=r zr&de7Y}Z1({1vs3-&xl<;`q#Oj7eG`0zctK=;`&9vzp1kiO92J$(x+Dq7T(-J7iLi#QQ@x{eGofi@+^5UmX5s1KdIG>2XlGU2C(?S{y##^uy z36}lg%=7z_@@2qqFQy8dq?0BoBL_=g02lMFXQvK>H%E_nFE?zQTI0$E(XZGXr?w}^<+W%v)C ztyLf85HUlUiL6}(<@4d%*{OLl+z!`m-vgP63#oBN5by^p>~hPhYEE}@RjQrKK$@HK z`?pxt>ERNxiUk~$2z6#&x#8uylc~7?uTehv`SJ9I{q_$`1~DUCK{AKw8?aPTJg~%M z;A?7}>mXLVhQka#FfR*%lJp$_hB5#=Eruv*ENm9Xa@$D2qa}qhXy!mFPwiXl00&1h zn9)eNP5JR=6B}f%likvqp19L(YU>E#c^1Y_SH`yCS!tM=WuaoN+5g3`U0QP@MNUrc zcrX*T)6CKquIo1C!vSlga==SLl0M@I#1_QVK#G%tHn(0m8NOtACm%v4LFDcS{CBxg zVt|`I!qUC&-d-vgr8fSf=VzyDXE_M)LyWaQ<)@&oPM2OqS+_b;fpoNdNO%+xUM1DP&KMiBkBdK7?eOD00H_lw3MK&zPY(My?0~-a3LFjB2Zp| zNh1|@OP{D?8QVk=yOO$WzXW-%1ai}@xU;OeSf`vOml#e%#|Q0H9Cn-ue4qN9NBpZ0sJ$U2L|?uaFmn34S=k;08gaS9*-2W-J%T#H#fl znD98=urRau&97?^ktB=+d_gk73f5MKT)gR6MbNy4Q+*2`KN*n=YyriS44F&Cj8OgK z>3YS5b9H5 zG?R%Fg?75mRC6ED@oCEKG`tm1{|ePKvPdN#|J{O-iB~L2jiLY4`;35q0I|k=KJ8pk zeP~zt!Wm!unuc4tk#DU0*3}xE(xL@{S)VSu+#2~n)MAllY>i7!Pe@$mig&m3ruS+j zuLu$z@JwC#);Ci@6fOpuIj6#1&6?8)_GP}5kgeQKY&U|8zEShuKq+j;jZp)2n+36x zu|8(RIC(92@g$ z$6R)*O94>v=cGPKl?L*4{9J|HT5!MAn z5_5$bocNomR_4*J{qHV;vVCxj=qa zDYHsO&PA@Tq;3;pyEd8)bKVHt6v3z`dtCK)$K-XX5W8ddLpl_t(`l%*WUgDfs#F)$&xnP^DjY2zJ18@7=SA#LuI@l|DhPP z3=Vrst0|$S*+Ax|1~b>9okzaj$!)%!9Kj$6usYo!J9`2kc$U}S3Ab9Nwb*5K?0EwocGGE)BrLiUCg#&?K`*$OIw*PN`FBTJCYDppF&#&Q8Uj@VE6AQcvZbxKDaC84hRwpzI* zZ8}gOjHG>=F_*oC-vJK*P81Bg*zZq#*a^vX7M48{UV}1ML00xFq=l__+h_V~m35g9 zchAna>E@E6x23OdRh8hDjN|BG1a$dZ6@uV+D z-LN-{2)H4^gH)Ng(@ax}`}Z$=diDc@%=rl@v(|A|SK6|(vm@9|@8ICzG)HpJsb0nl3?|Bjk(cZVg7SAqy)q#FPX$~=GmJllO2O0)hVLp%=iQ62b@!p~p7n4n69 zZ$~H>8{vcO=*iB#Q$YB2Lqipc5!mP#VP)X!(Mku%?r#_g=eyH`lp}$@^CjV_2gr4~ zE&9d-kt>f6U>QeZLBUN`RaFpwI6!VcE2&^MV7-Hd?h&CRGuIjet@BA3GQrHAn^5nK zhl~L1Qp`~k*U_PX33mES-(kC!F8^60SAXKidm!NA06D?~ z5OSj)o*j*yUBSVj5)g>HjCq^Ueq9Ul{bhNXk21hn%u!?%6$Qg$$j%x!H*}o4SDw6j zMF>d*9S8{2>Tm>;cD=v9|C1+A&|rm!{twTq&qPIoLPP5zSJgv5g`PH^lbgE$av4CG zyuwV9-MOi$I_fy*9{_K|dF<%FfB%j}#60c(E|@0d8U_Xi+(PWdi|c5lq@-CIRgt88 zj`50_%4JrRQjx3^@I?yz9Owg(Hign@L%zkj!}<}@t0yeJkB*5Emy)7<`0%6kTx&^H;B4F>2MKz4P!`7%F8zhInsv1TcIkw5tkXH7hKMq1`S7 zwVcUd(I=pu(TTHxzpqh-h#racVPl)`{CT>tUWs! zJG<(#`BnJKM?XJmX68Wi>I3v*l@^%X?u%o?xekXPkNFJya!6E5&60u1C>A{1T^T|o zXLROY-EIj)Psn!K-2TO&H`T0wD}5H;PCT)N`HQtcfiYQf<#NEuqZwLmmEX9ztRiL` zO=}|(!;@+5TOel)yF?C8Ep?9hJV zg+oGv6?`VH6E^>czBhl>P-eK>syB{qQebQ};Zx$}?>Q3HWh#xwb(c*Dr^SQ)D2d*y z)UP!sJU7<)9%SbEEuGVy*Gzve^9l(SwTFaS4=!40RLpo5aLuXFj1BPqqV)Ic0g+e7!PQ4EM_imJg(r;5`JM z@=KGa3IXtu1vK8^-)-5drJne~9}+;iv43!|G3vC&WID)t;lc&6=g+hHS}Nn?-$K~D zPE6c1{U->@{MVoXy~}Cw)@-DF<6tf>v1?&}I!Fe@YxgNBlUvm{{SXj!`N6HfM#!CwWgMqzQn{JzB&W#XlFnKAk?u0zKu#I_Bkl0UiAL@ zLV$Psc0DuYF0-BiO2%<3lv2VLeXPmW4%fF zA|Y693|qJLRJ@@L5W9kf^|PZRV0u~yXtR14_;AM8@5W>KpooRcPROE%1vb$K<~FUz z2*Fngd>EH5tq&UK{*#A<+o`FIy}jHS@~&cIB{em*a6Tt?kehzBoT>+n5)<4S$i_cl z9)B?kXQ*kAY_~V&Muv-vTgVF)#H&25e;_tP3eM~ zqP)@xAKk$MX){#+-z=xl&1+6<>6GSc9>}H#g9r$gRbS41f5&6VpIoT<(pR!)j*i^O z!gzeVtQQYKBKlK@xg$%NWnyG#aBy;FMwfj8)VX+<5_2`GK7ZF@#Ozt$-cABxpv^81 zkUPWGE>R#Wu$rpJeolo4V+Trc|EMTQNIly1-sBG+cmO5h0rB?AotI$@npD)(A3(TZ z30@yRXgv$MkD5E^v&+lPo>%b@;{h%32n=!`LLua^ZsVk`1r+ct{U$f>+`RejIn@I` zKKO7DF?`ZM&Um@IP+vyF?ZgIzYX$=alvF{Vpx+6z0ff)m(AZG>X7P`YNF4|rfl0qC zksJum83;igGWz>+_*@V_Li}_wE+3YO0ISe~5X=-YwJdY3r&Jg=YPL z@gr>khISt~7G${L&zq2G()|uAFn8d~A&_aAL4uH#y=3dqyR- zS{>j$!k<%7+`J0bzWw8I1#003lGuR-B4pP2IN)^SV6GkPmZMqI3bB4+ppY7}3E&>9 z!)?RXSiYtvh8ne{sJ(`le}*Hr<_GnuUhX-g?;YD=q_$FTtZs|Hx^QgaHSr}3O-om| zF6mL`#@-R-$}HVgn^@JtWo??g`|S;%T2yadxpHl0WFcrjN#T}O&Vya02U|J5LWcO2 z?SnWWmA-i|K3(!@^(^qUHg%!BYAI*MT)4TWtCM!a$RzEbkZb_r*!>L|5Zgi z3aNHow&zB7xA*nc3%mT zyt?(GV``4sZoTkFmtrf2Ql_7bx6Sl>&!H?H)t{}8lbaV7K9^R#Bl$!*9Rf?9>uwjz zdZ|20)W&;UE%PY1>$e32ylx{lSgb6ZF8@`Y1~jX;6lKHlb{QZ#h|j3m`G;yHuHG zjVlm$rB8S4k9JMrgC4^6_M9yc@!HwI-JN#_^ifN_*mibyh?dlVHA}rB6hh&J@x{eP zV1|}R?y?0(;vYi_ycQzyUX4B#v`^7|PNBdOLlf{JRy-meEFISX?Ek*!40Ut;#WN#pQE{?JIn8=q{gQutrtJ)CrUvu%^N^ z&wT|LaTDznFP!`3)~16F}pWp(d$G+;(+tq z7el^5VDb+LAfJ8|AZ9R9&Q@Jr{UaX zHa6JN<9}=K&EK&M_x4exM5d64B9u9^NalnjNh--0A(SZ*LYXrqNurQMnKRGxlsTcn z5K=;>%o+B1ul2si-rql9AN!Z>SnF6TJw4C;-1l{ThI9B_xQSDL{!HG}f+j{#P;ken zUfYRO4kT(I#}|x@jIzjT%NagmDigl;Dd^gLYU~ku0*ta!EIVE*Z^FAinwC{TR9vVy zs{}Vtg<%8#00yGS8DVnsW*hq3Dlk5N5<^~Fa)5;%Bp#NLc}{3(H`njFEsSr|4bI!> zU74?>M{9*G{2q|3?aiAzrJPW*6OC*&YeM2DO+Bx(7q^VED3ZDYo6YINde#lQrEqV| zY;3Ly9Jr9x*Z2EFW|x&Ve^j1LpVoNoYaPCG3LAMMbMFfZ8j#$P{zPw&YY!U%-9y*# z@!ds%#C6BwIK*d(CWQJ}C{m9g@Kf*mlSVh2!Iz@TpZx9}AWO=Wp0 z-le4{kf6tcg)2-jXw3tZco`aKlv1Rh=DmxTujJ_;g^30dV^!C4DDjI*O0L=1v>+w2 z=}BpCyu2>9A6r3rh%-WcyeBPsRvy2=J6obxx&7zsMb{bqjD1lWr|{XG0jCes6L3a# z=}2EwYwPQ>vN#Zz=3-y6mVC732KCTAE-ftyUM-l4@V(u$a04;f_3qu6dptH17x<$- zW*IA#m6uaI$YdEVDJ~Hw??7%BAMqeyY{)P6h|K$k z&UrTLEiSX`N2%4s`5$Qfu(J5EuTxuyj`uW9D8KGa+#~+_}ICqPFN>_o_;4uBv(d((6G?wJfm**Tq zNLf93ExN;xXiiM2{NnDF*1woisH^UflX=UZoS&52bI^iyk!wmXiNZjaW15OuWoTtl;3Spm0m17E(dU~h%?_;ewSNl<$xaIPT1?;& zO?jB7d{o%$MX(O{>Z%Mw1&#BTZKgr7GO&npQX{nX;?Xsbxe)mgJd^jt#kS{4g<2`2 zh%i%w(ARJ!4FW9_|2ZqOt@K=op zzc>1eMA653eXmaL z5iK`5ht~esv11F9ec{;pbD#&rP;8ZJQWbrXfkz;lt)c<&~hzFUk_?>h2z! z@p7QF=2=99l8z2NVjaU*AEPX(tG^$&j4i(N?ZcO?LPe0BlT(e09<5quBHRiIcOqb4pXg(w$(2}0P zAEl87C9HrLc__o<#$6s=>~*7kg@wWEVaR5SwJzUlJg>}(O!#f;2JVZ)NT z!E*Ov&kY%tP*uITTjY=y6MO0G_M=CSI^4dU-Yvi@AV5i!zMu-t4?*_}$mkgb2WzNm zqNmO6)0-4z^MJ-5KY5}O&L#)UOlk*dx^kkcl^sv&F&(@qp5d+DLODT6WS5TcQkNN2 ze>^|X$rPcD%AkQ{R?rJ$Wfpp0+5Or4jw#<`-V;{v8d>ox3@Rh z%=2qvG149@BJRu6$*HMVQEPKCE!sS za9@w#oqs(m*JYjW>gFc@gmM)`=jTE@c63yjt&wff_I#KBNiauoew0jN=1qH`Z5jOT zE*JQGE+9IZiC_Q=X%fCFVit!!sPiVcD*}UqxnyM4BBDGg*uzpEFSHMu>e(k^oeGV1vIew%f3=gB2A zWEXquo6|)@MOirZLe9n2a`~XD%4g9e_kpXWJ%_gGI#LXfrt5udJb0pIXmB>lk$Ldr z)8-d1&VR6>z4UH@JCn(JuHeEW!}Jt&v#Mr|uw-RrC#fT>WbS*uuYcc`jYXO|K!a4> zcJ1!W5o`^h*nz0Ba-alBaAWdc!w@^{C4Z{@HE7Z%T02ZcKGC<9dYx!?@3N90awdkC ziFmBom$=Lbxl(PgEKlt34_Dz-O4ix9)#3N=Jb%;>_c2}oLho{^(N0t| zb40h;?0-K^%U&E0StQZW1J%_la}`D7QU;)$c2$C!i;ph|fG5@`fhRyZZI!Q2u>0Fd zNw2&&rvOa9XygS1AFN+Hh5+52%qT=BGzMP4Zg%4$KO;ynXO@!_4-+rH)g1@Su&_Lt zfU>j`u&|rU&D9ip$hqYIO^LfLPMk6_Vgu=!1dzE>paaEOce%R@IEjt`cF(}1B(BR@ zM)hC6vaqwWOR$7qi8tU9xjXZ(NGdcdOZcdMo(Y6?nlEMdWBxA07m64P``z!(>iqRP zQ=hBBfm4u^AL8cr$L2OQGxLd$XUCO83WDok2M(cEWY1CVzWfs)2@hftP+U>V_5=9R zH_&C~T6X*-aOLXi`xrrpR0~Wq!|9^5q+}Gz5qc&jH3;)r`@`Sq@(USPXnJ_aZv0zL z$)u7`&QT7M+p01zi2kWZSJ974r?`0!x@0Z#NHr>4G+4iDjilJXcG9i8TL zi6BgFqvW(l-6LWBDG)5M7+}i1yLS?|z+8-ufx)NC3PRqG=~+NNFsm3o8)gX>YS{Ud zJ)v#QUrT&$rkyc4he|~puDii|%Z8|Ci_pyKXFP?UAVif5RgQ(~It+DqTM)XfFHS^5 z6hI+6}2q+TTM$tp=7Tc=*4BbdJv!hq3 z?Z?*?xY8sHG)2qOYpWL1_%NPlT5C!3g;<sZfI}r+bC6jst?@g~zeb z18eX)2z{bjx0s&wI)&o+OTG;gD&GfbUWNqwf$j>=&POXHP4ZA~L4j&YcLW*)WIzZU zf!RqG9RQ>Pz#m9cj{+4SLKJqfs7uPq%1{|_ zV?;w4WI4)BUFBqC#Rf)`8%AZW5$NMguNJ$T)v+q0AOkGR1#^=~5w-&^*lwS^4iP9I z?n#8n(6w*bjYY}1b&F`}`1#!uf)|Ejz?8m3V(tcGqx5-knPop3TH(rdF_2n>#zQ?> zM~UjwhYt_Ge>V|V(z3L)grv#$4hJAd8k&9mUl1PwjE#(jD_Ed#P(MtMVUQ+oTnGwH zU!Mh+frLQ}S?tX+?!eGZ?X(_dDze0T_i&ST?A%H5&A9@qiki$_XuPghKiDZ~P^3Mp z{?SST2xo~AT{(bM3K==tlK^%RR?r@bL-K|&0izD!C*|1{qF%jq>z3{3>}?2}!1}O} z#Jf{w|NaFJ2@;Fn^>3b4*8`Nv-4*xTIfT{J)QC6_EYlT4Sx$DgVp`Aq+GG}K&xS38 zz%gptcr?Zyb31p@98k>agM5X@)Ny)j>=aaWF~jv89p^-*j-NP@3%3=aH2&HCB3PHd z9wLT4-05^N>8EFY|K=N4L(OYH_JI-A@FR_6tS61nr)mZVU!qEay2%%O2IR<%xT#*C zwn=3Fwu)m-&7lULhiYZ^XRO_Oi#8S{-Xk9IGfdDv;I1RJt!vM8TS<(}%ygiGBWOO+ z7|jPv=0Kr9L1|~$STER4ZyYTuEoER~d8o;Kk~3n@-o1zG`rO^zi1$OP<+kb|9*5iH z(S)y`3ElCN57xAOKyoX!hOb6c@<@J*)QS-syWIF5oYP@(@yNC(OVl_u;J;dcSSg5* z`zsZTLXJef>DYUF|D7!tOK0gF-+%mQNIxe((v?Od>j^@`w}|hH+gsnwqwoIF=j%Mw zzalr3lk-UDt$0`6>HEso719QYlJngMsmmYOYV&!Uf$8XX@hk0CxbKM=k#o zA`t9GHTHWd9WUkhgoS@Wqp&d1Lkaw)1i&l)l34gjUD@av+zg-O>mLR5!&pFC>JluK zuOAu^&}gR*`tVd1OjTi*`=ih zGy?bn5PwhJRsb4R-_jC%^lHH@6i~!&fNsDr%c^gqsHmv3(9Reoj(1_96v7}uDOj)% zRaGg%MM$6&pcH{2Izo}5|CKuYIYJM1k{v>SfP)pi45#Mc zv`f#-=bWS%qcEMf=IF;1owx4Tt)Z%U?)L}7D}C{~2Eno9nC2y~(Aer7_UZ>||+j<2yeYlfDm`M39MtUY8DnDFpIA8PIMExlb96z^1FG=c|_5S_6FOPDTs+_C*9w2TYwf74~Zd=FQCSl@8A27|;Ou-vL}ZVYlvJ)IGQjw48K|uZJO|}n zjRI&JR0uX#GHgcf)z;KZ#8t&=a-%DN_{L)O%GIlV#eI%#hcdAA^{!r}Bprjw3#0}b z5~7Ro_9iiH`G71Azav`2`u6rP2+M$Op*9-^R*3-;ySL{$-(W-41c0gt9}0k-(1jp$ zgB1WvtHK#U{%}#!Ay;yYih`mV?|`s}zmj&DK7b2^BB-nEt`jU(AqYwQQ4gV_%+t@% z=FZnYi_Z2@vpG6YL^d>B8GYos;#HIgv%S3q?Ijm@_xk$zQ5cCKkU+G zpKZ!HGc~0NsZ6wxA?NYq`_X`ca_;(lyXIZ4Y7z%jAbajPIyh7#V1pBc4ekb52f%uS zM20BAI=XRDf=7?~DcRWDXPX#&w9YRoE~aB<4pdIu^VP`Bt)x>6J(n^XqMW?Ey*0O> z980U3AZ+BHse=|tfkqp1o` z2)H0P0r~?61eu5MZGytW_WAwC4b}K?-}X}V zTu!kYUkopqTFwP#1X&goHu2ex8wvBW{A^2KJnal+Ka`XyWUb9-Os=qRXw8&2mTzsQ zx=Sn+H4ViRl{8ie$o|c$Jft=7-@6IHP5CO@!QCG;rh!9oTzfgi7bqn(SaOiZQtGSA zg!jmY>mNTDI@~7VHEUcNsB1X;`n;2x<1O>-t*Yos1Ioj7jiYod50A`_#&nNscNS;~ z_`Wm?2p^srK4ssTWyiE$WHn_~ooSOiRdGpc$b{AQ$w&8gzVZF$K2gda$`!tF?e7UL zIv4PDUcH}`1vyCfN27K;45A^Ld2hp_yIrS>D@NQxc z2O$KJQuV7`&TxNVq%e`*{hb``8M*6uU|`dh0_ZP}D2>Shtu;?z83~k2jXLF_*RSd9 zCh7Vk!!SO&(6aC8vaK=2vq>@S^0Q-!3@LtP@=opHvccp zK`i(2`Kxxr7DvsL>@I&@?ftWAAy&QAlB~HR6Tr-V<`~snoz`Nb>){|(|H|X9B9v5A zew=ssUbPLftsT^1$l{NlJgI|2g1uP%4MbZ1`DscTUT@Pd(rDtyRd0Osw4iQHf7m9g z%1SIz{JDC2_xnlx{m|98W=6@eFFMyYjD%C(r4Oa@a{7?3x{poBL_78Q9v6q}>iDQa zSUelyZiVP%`#ZB3_l0p&?oMt9wEpum-)Lk zhmB%nQ2c*C?tlI_d`DN)q5t!D^Xhv-ss7JjasGe(viX#R9&2_Ny8nC~w(XJ4zL(NY zrF6?pzY1IreWWnG{eK?TdM+O?uL-n61fG?8p3BH}cqcF?HkX|L{L6`ID+xzDZ(zRa zNH4qnwnGv@M#~n0Lw81n2ICu^UuPfv!O&FYS z;3#t}hqKktFM1$ed?OmjVRyVE&wn39#Fj9D0z#HYbx`IB$_;{qz*_RU{1QM9%8TKN z2@Op0V>^GERST>I=m3IbE;eY#C<4$euMsA_+^%fWps&RwwkaIA%wO5;&fKBzV^ zfwdK8=8vef);BgVa%luGTAcj7=a6r7VO2F6wkkZ4Y?1%j8PrWe#d2)k&eU8w;!1O4 zLdwUUh z@YAmrYDr%KuVkC1@+98Uh)XwTK5HTo)5Is4Ema)i zr?y-Au~BtH;!CuUTiNr0|GQ%%6rO;r&cS>Ul+i_Qi~NLqkpvMRq84AIW3ZN}-hV>z ziCnmJ|E`R*boTX@eXlwR0DE3u2w^f1q6%a@pGJNXAk5G*y zCGj~B3g7t^Y1i39_tq9f#YH|55-_-@n&C^>4`pY(_H&J&?Qv>-^5Q`yjW5f7Ri2P` zmJf1CIafoE`jE=FYzK*e04w*|E1@{h?uL}z>D0gdSeX~@Gv1fivK@S^sHn|5qZMDr zlkv*?gTnBtr-Dt#zPSdeV%fg0FMkijIpjU=(HOPn;%PnEoS=PG)vo;1*4Zx}avy^C zc|A&0k`N1A=RXxiM&|XjZT!-mkia~z{`%Eg2ptHu6H@B%vllN8q6ZAm(fx_C2lr~n zutba|EE&7N)J=WO4~Abw6h>m`9N1)Lps{xZWB*j}?R1z=RxBn2@Ua-$Q!;9n9fXE}*!7qQK?0C8f{@~3Rqguu zwr_Hk;P46yd5#@>iYp<63P9D5L$p|EH`GvH?+1SqNAzV{7l6R-5MG{4>goi(gx)+8u9yy zPkc~Tp+c&eD{1=hffI!vXg$hRN#6@8S`LuPpbTHx{5R7zxkyxB2wdBH*hDc|QjI@K z2TFL%r-L&3Frm1*c#)2s{hX(#JY;Lo{6o%R`qT?C7bp`>f!iC|tOD}QYN$ev1fBF) z=}bl1MJdT;L(pzO%u)6NUr>guoP^MZ{OX8rG#5h?eXi1TgKZ+_)aKS})E7p=JFzH3 zL#Z(@)64O#r(cLfL#9ES%~sIXmp$j32TFTVtV8G~M@Dy=)dlA^KHtxx6)){u*r5)Y zBKx^juU)_FZajN09G-IW=4y60>wEX9>D4hZ$Cia1rFw^=F0t0dO7pKcx^lT?bc`6E za9Ww(X(z}S?kP;};6f3xOD9u2QCxmnXFbQD((?tj_FrhX-ow3!Slj?ut^>vaHkU4M zYnKu5;5nFD3cpAj4i~Hidf}lQEa0nfP^(5HkK8KMxn2QFs222kers52bvvV9iTh3?%rKJ zDOcERJ_0Oy4F63A#RO&kUrac5j=0p4^Mo(f=69zHF1q2JnsbTT30@4U8bYQBu)Gd&<2?VQk>m+PYJg8kn6g6L z3~UY{D*+G$XI#pK&%5B(!0syWK>&IXhL|Fo>mU>Z=OT_Efs^fs)Q3lAG?S}wn4VzR zK>Z!J|E^d*Oe{9(S^ut`9%)fEy z;1m?LgbPWo-MAi#Q>mC}Xh{CUY$vI1O#LD0+@BZB zL^Wc3Pn8?CQBje&KmOnlKw#rHZGx2;hlHJnB)_8_TMmW<|g8~C( z-LP8R$_HD?nOIrRz=i`)a|0B;r7m`+JC~FIoPDy+|9AfH)hQKuvdV*nDF^PJB*`1sXeFR z$pQDt22%u|uNhirJRMbp@%_^FhtQka4wNto2nZ1RQV;^DWscyP;|vl4dYAo${75Vp zgjMHE^+MY(kAYX@z>fe^?7DIjF+fDZ}90~|51*8Z($GMc=>y5yyhv|y!g^%eoRJtJ}nv=8s3HDWPGsv1SFLw-|BuW zaxjD4*8k+9U;s)0QW4Cp+I=;iqRUiTLB#D3{)J=L6;H!;aB`6^=AF09LH#4RGMUTt@ged%rrljKL) zKX1?q^?wv`_F{AJ>@{eA%UP&-4xMyOKOy$;ZMUlF(QlZz&jy%K$}dhw&TgiCO!fRC ze?fr0s$YR82r0-^AFBUYh20+BitE(%<8AugdpTF`e!G!%1CyJ zcD71c$n^J|GEH)HlDM}%-}O7^m^kHZw(5c(K6Hif0HE=A+ym_dap)@=0FtP(o zJ(M2=&z5v44RTsy=_5!&_@oB9ji^0*cF}tB7M?CQ>cCP93J?E<3&MUy7eYuAFoS>! z)8D=$55ERe_#`Sy)L}#gl_nw1N8rUqj>7iff?O6L69czqs`!$ATF-m?VP!;TKg(DI zY;*v4Lqht7-O48*kOaDg;NP76d8ALApd3D;{U^r(w+%-vRzqo(Q&{*5uJCF|w9pj& zg~xst#*^Ko#aOI4s0*KH96?bHJ4G%d;bA7k$kx{U5TF7ti^*`DSagGBr5<+|_$R?z z0);~{bsw-d6t*CI?gJggJT*QcA#Nd|Fw~uNP)xypT+|ldqyXYl13^;e1x?1KUv!UbfB^T~^I%BhEV&A`Xbwu6$a&8jfLKX8J|Jl zAd$deyeca@0M#A_CfaBD120iQQ3p#5;{q3)15oGnm%B3|dctP!HHT3vv#49aHfJHY z?9gT9#jtn1_vS$&#{qQLLf!R3>$2U}O*^{|j3TH5PoYkRkVc)oG5sm+=8348LY=4R-HJbY_Mg+|z`La!bC?Wg~eJa1pv z^}Q1-zqJ^3DAu1`_3J{9GA0HU*zOqL_RULrP4E6~^Wvd|zLoEtgo)jiZ|ZaI=-~l! z<*BNA-3^8$_D<-Ws*qpO{;1TWug62}kDhDEJ^Dv)>B)&$FTs&~JI5PCpC4Z&?RUtJ z=ypEKedb*MbsZia{B!P^(%JzH(k<4@a?kYcyn2*1;gAF`p6Kx80evYQ(TrG1;tIdr z3C_0+c1=rS$jWp2;p4NqU}x$xXfmR4i!s=(^qM8#^`+|V^iC4C2dDisI7}NhJ-BDu z%x3;Ndwm9*4`GlQL^KFlmv|Q0kf=fD`0Th7 zHxj?H$EZ({^W;8_Wcp;C)0oN(OH19rzzaCb2mw243&O%etPGHcii;*6p$9_GNQi6E zb-9iN@xZIY1ueZ%x!ZXIgH}}CkiNlU%93g{K-2_?0re&#cw(n*Z3UtKP)^o~00ari z6Er;3V7qi*kS3tIM)+#Ph|T8KR>JN}_}K6gr{!rwV%7^3xQz))K7{2A)D?IRXl=hG zta(pl6O{&08WD;zpy-HfjR-@KdLZHvgR+2J5w-$Qz;g@T=SZ_LGyx<9yXOiA8bv5$ zashr|B2ckD=@`^e=m=WiWG8v1;3W?mo;i*JKtRex%pm-;=-~;*tj}JTVcGB`7*Y&o zLb<|-(i3}zU{JxAFeo3iu4xcfG9w{jEkCWIq^p8t&;S;-$$h3=4gFr>t$`6JwU|OU zv7^_Awl>%Sp1~l_47L2Pc&~OSO#J>~O2a%(<|KG*Y!wX@X=t!(pzQnnSq~5n;lo11 zkLF_zO$c=SRA`}8fN0_C0tS>=*$50=kHYSHgUF5IY-D1BU-LQC`*&g8_LB79G%f1O z*2|?gcA8SyTBSuPW`a-~a`41cI5%b?P=?UnI%5_?KJYv*?E#M@-XY5scu9UrBfHw9 z3feg6onLA5!pe&j250ZiT8B_Nh&{fwk|*>{-hfJra3Gj`&&$rP>gt-izx^S;ED@IQ zq(P_LfK$7?54i~l0j@IhugBRd)`BkjNm*NnyIY*Qk(VYkgAA9PmSb0375c^BBjKtP>J0oUP2 zBfM-#*^tBC!20$%8Nznti`4R-o(ZOtx0gcGzXs`_qGPWND;EFdAnHK7nRs9K;?u|T zq!zCtw)XNnt4hd3#=NN+UU0Nv=T}r-l+DSmsru$VeMmAU`+T#sMDMQPcAS~=WNn=?AK%aNh~`yau8U>$!uHR;5H{9W;qG;)K6Fy&xJzp^AD!K~iGP=l;Ywm zg5j`VmGffj%q}lCVgj<-r%Vjga2<=f409hrIug44oE$o|@Ozm|kvi>NTpF=WhetA!vKM4>>LQ*m@EsYZU6Q0C#BgRgorlr+_5=CjUrqpuRXeVQrV7~Z)X;!`x6-q;|ZVsR9?|MYZq zl>0z`zpdLRqCkZ<mr}g-X@FVUF9S2%1fhag~S7JA{msi5azLCs(1EPZ&T@BR-IylFt~MX z2g~+jF47)gOw>NrBta_Mfda+G@I!G*feRsQ#)KFKw$%{T(WA>d{{8zmioBuyR=3kS zKQJsz6`&{7i}h`T#+&m@sBhr`qC&meh;2)=z*&cpzmEOt#|$Y19gC(Z%1~8O zTxPkEUAHP)%~$@lU=$wWzN`<^dZFdrr9vGH7BnwEA7-i3wyZcYsk?$SMw7b?qq|W< zQa~ZI9aSwRgE69{FZxZzf%@-Qd?Yf}?c2AhVmDy8BG#uv*(DrX&^fsXs`r6v65Ip? zSnF@gN&Q>wkcsss76X6Q8cH%1t}m>at$&QPo{XFzthH=^EyU0 z)g$d^L$+52wGuH_0sXiyWNwEfB^e>EsxTd3_@~1qZz{XwRm60&H$@}-nwLZ6%%@)| z=P%gYOHgwvzgeraPf~OKX)t+zsQ2==+%Mai@~ITgF4b*KS$iuB)er64p~MlL zU})!`Ss!?jz3}_F`g_I>k@ee+E%z_Tom}1ny$uNcF9yWEH$%fUQb+8i?lk0B>)Z-W z?$Y1Q&X~moJ%&hZo9mAVwb{;-v`RwJNtu~6Ko^eXo=w%|U-|bh2@yqcD0CJrs69-{ zaQ|@v#`40{5MsK>&z~01rzvGzN-8fuh-jpT<6@=dk=uyJ-IaPNZP%ie<};CP5RGG| zeKmRuU!oa>x{A(h3~~^aj@=}pAv?xPIRJn*AiC7gVQw>#gwKR!j_oXWWKs5kRG7$7|HFl&>f|JzX;jYd z=8Fv#5f$Z!BY$CXA;tI*pUTQDYWMGJg+Y>s4n;Nt4-KGl#0pQWs9;0jD7;yKgK`*e zdO+lc&i&!-$@^J$5-eSvo!)@CM&72pq$iY{oU*b8wxi?Yyh5)Sckle+xLSF+-h%T4 zB*``3>?%VsP9@>Z8!`YZ^rQdmqU*0ISz4y>Hdu?rbar)_IjQu%rmJNt`q9aXAxs;Gab-KMsHv%mxqx|0(Xsddu#H+M^de$n2zM&h zLF-F7R=~zs`{UEo1vdl`yrHh#3vBXpiL(F%d5DMM@NOau?T0SfUzh(BWa)@7JKz(8 z-2_wIYEaW1JxYzPr50VmFhUm+TyVi%>?MM~`Sj`2Asl#Y9*h%!USUlF4tg?@Po}0Tn7Z1-aWMx7b2}6sWeoGyjg?YQ;-7lwQ zSFi6HAZ@;}qSS8ihSqDol6R%sEhoeIpS$UbN?<7| zXZc>&tPzdjo*bFglrQ zFVKM9J8B%5<>RCKz~*O#N!5#qU2Y>=l_CBb>B;0@eUnJRU6U|ug zG%-(aWN^zpQsD%AQ-{kY@E_TYg>Hf?2HfM^y_^h(BZf`MZms|2D%sB-rje|yp|Kl7 z7sRGcU2%6m0ULbRr%%3!RsgdxM+8L#F)BsstntpZhr6L?rA4zOjShCUnJ4}`NSA#x zN2H{fperLV49~e><3so(+NJjt@B1l|bts53A;{N&7;qenj0~h5t(OTDp06zLVHgy_=>nyJm%#@XJycev2#>Rii}gS*khg`5 z6l7(I`6!%vwi#2j3mf~87SK##_Y=2<*erys6a5W-FIu?{L2<;37e{w%$wLFLSMDZ> z32X$Gj6pNoh$;r0+@T0{hzp!+`Q$NnE#lcT*Oosqv9ZA@Q33yq#BZ(h01!ox!RrWs z8ZhJ6yh$`Jwr?~mwl@Erx{A9E$EYbt72@Lo+o2?z&5hsCjLU7c5Qp^cP;?7NWb-T- zE&^v`_n6&=7hz`+w*}WuG<2e(bnwEZt{4NL8wQ#~;OuCZ?t=tQ0QQ6i%{pH{Z$?{L zSsC-0Tv~on<$ejlm#gjWW`G_8^)6^Vl{rf{%A}y%Z}o2 zgW<(*lbL@dc_;R5Z`@YTJ|yc*ZFx1c=}hH`e939+M~TP`7~ZaoGqF--Y>DZPz*=cf zJO#4R<0GGqC`aOr%tI$V&Th_p%Zq46CNUEHRbJl0OA4{W0jW7_Rg6!hCg^6oEXApd z(yn(dKRf@$R`Hpo@wdyyqOUS<+VdA1@GBLikWPGc>ojF{Gw78pr&x_I7#^O>ly*yG zt^D_k(Y9&9&u6c_umM4B#tQEBODEv*9NOMWl`0fx~AD2dpP&7laUT=Z72!+Wmt7ccrj zkT`emJnvo@P)=G}{t9fU4`q{M0oC3JisqF5)E_7}>(OQ*8c6*3bP8j1tI%^3U?DM~ ztp@e82&Slj?L3*)7c8@1iXdS}F`brSQ9S(%=LWzTQ%vzeZ%zt1eJIrSr91Zns-Q!< z$Aq8YU%;@!AO)c_$Lc|yj53ODKSy7dG1KpA%uE9YPD~Z+?C$<68Rs3ed9N7X3-OP* zD5RsCxAg3y5#kum$#SsmA|s=DK957;c7s`nbB&9RmYSNp>+b$7ozg^`M|~@{26Uwv z6x$;XTQR(_?jG6ApdU_5k)3<=&#=HYrfn2&nS}GdWNFCBnQt3NIr8Mv9O2;!cGCAE z{ic-GLu1|2$mZVqGbbr&H2a0R;?SN@Xn4QMLK`gGig_}fCB07N7^aM9FuZe4FIi{6 z-k5Yiqk42R{eA?>B`Q4mC{8IUm!|7z?l1(QhuYW+=R?-^o_53Z!Cm>Joy+^#t>2kJ z_5nfffW4OrDG_QB+qu?4+nbuIpkD~anuD$Kr;W4>%LiKSqT&4aX)DbqqGub{Nu-xb zv!3rC3pveUo%*9-S^wfu)%6kfqbrwExh$+-?5cQe*x&P<3KCyVCk`C1`;+s8u&`Yx z?G4N-cqX-m);Pb}gk^yP7SdkF%W7!=DVPwtg9k$~2MXax6|nPpWs^K+ryPZ)^$u6DrERXC&baoJI|Q@Q!ozbryAPr>>HhXK>Sr)SMN>bxz$^7wqlALq@L>uJncrJBQ-rn>n0Ca z8`j<>JUR3IH?P{&!u<}L{B^rh=`zoMk1VCGr$;1W7%y%L;nN`m;qwS!(L)fzQ5`DBxs!=>Iqx1u*L! zTAP#Hk;Bk}q-JKS!chqkc>UQFO>Q4RrNB<=n9o7+p(nTx+;U|bWim;`NJaQy=B&g0PAYTIL@s2TBo{y>=#TJOVCaQ@3z)EWe`KGSC+Vgm6y zQSGB@L_tteQbNc=aOIc-%1SFc>&?6`q036-R=+gKJxMwg(cdxAuDACRaytjYGq5a3 zXij0p%5SYZ;h*6`4*>B=&B_X>Hc>>?fqDjN)XuM8ccXCuuzmwMmVOob!HC#cN+^5)h@pFYNYaR9ECLfYP_F(w=BsvgSyq=PA4Q;q0cb!N zpE!FiruEc7WrOw+cok#MmlttyC=yALV4)-eaJ>!N%@zkz8x9^zw8}crxDE$najlG*N zY6JawW7{pIV`nE!I8AU?M(jwq%JM@Xk?1zVTsP2G(J>9ZDdqX97UWQ|+g7&U|KM2P zp{Q*Zl$|(=zVxisZ;8Y*rErCPg~QD*&qaFGg8JAgRI(fYTz3xjt(%vm+B_;Kr~OoAb5OO)t`WF|-i-`b>yX6;{R`<@&GsdhJb@;jwFG4g$N+IV&EG zRLpqvs?YZRUd4beDyHPUlneuNb);6EPTG##Q;B`qMYPX~$QUaR0Xtztt?5+T2%feDDY-9(dpX;mfnKQx9mgtKd zoNxU1>Nrc}jL)1U``@+4T_3N2FU^C1(&2 z5E>fEv0--O{eAP*)XY0?eKj-x3|05qJbj*Y&OSS=wKi{`K9N30N=-^cM05@z^GK11 z=;SpbqGL{HPQwweTU{3L4~e~uh7%Fd`LBfkjzzJbzYYh9oe}c?5dS=R{n#<#<=!jD zj}HB#?tI_H+1$>ND7&Cd1`eHdhC`1`oQxbT?42#_Y>6(D++c*`q=e%S?d&}qEzHcF ziSo$XMBwQ8qoa-{285vu&K5Q%M1ou7B=8Lh;Tt78Q)f2=M-w6)`$NKTvZISzI2lSLA$b@L)&>#DsVGr$WY)ovOi8kA! z(QxcEVVJUov$Y9P7OtC>h=_p*@#wy?`-jCbUuR{Lq~$$@E9V%Zo9}*Q=~J~zwFq;R z$JD=xvM}`QdWY#bT@WU^A~OD=K(I1Dm(_-)Or&S)g^k$Kk6gZn57*)%HD=nER@CQC zi~0Fbg_(Z+nO0B6+rdX2#NawaV#N2-{Oz$T?Rdsg`mF-`onsUc^?PMkt)A^+N|W)7 zUXq<|lAWdeui@t;JSY*7eG*r~;@P8*et{?M6PAmJDC{a>_2B28<^|)U4@4IC!;T$& zN;~yG2Jy3qo**2{2q+f`ed2nRNc&znca6s=_U}nNrgMt(L_GKpR!_rmmyS+m;5@^3 z^uZ6s@a^aWQTGdmql*y9kiGc(91NTpDq$&ARhp+xor+8hwn(X{P@kEZiA+34IHR7~ zxb6PysVPH>D_3q&oein7zJI?V?evK+lSQPYq{=!v;uapUmL9jcxz+C9e||IkTiWc= z^?6pRs;ZQAbqlFev$`LWb&SbRG&#$8@s-qOk{vU4t>*Zb(5SyXwb-cKy6X=ud7MaRTsW@NCO zJAXbzJrf>=l+Rs^u2P$8X}nf+eqWy_OPwQQe}5lkeE#UvARRTem?y~+OJ{fn#aF*E z-o~!a^Wboo*j4kMN=r+3+g=Wrd8At?H1F9zcyiM>d)HrmT2lQm!lj{zTS;5{Ls;nc zdcO0EhL4O(#usU<@XGU;((a%p!-e0!?Sl}!in@6Ymlj9fOt|LYSXVIS9AoN>)5hu^ zA&+jd-M)RzMK6Ctx|NdfB>Jm0E6vyAg`G@WcDBacl24yL&0@VbeV*^+@neYY{(LRk zp2o?ds_N=8@14~&tj#bAaqiqXm88Rlt%8OhZ(KMNJ5!@u zs9}ey;n1%5!ErsXNm*MvuchTNhS$=<0&(W$SNhaXpKhwCswVY(42g=0(kwL%W~7JJ z4>4(JZSCvsp1RA*$;o+=`skJ3RZfS9I`6K}zh84(98Af}%Oe>%5cc`fjorwptsUdF z*}{!ER*&6IFt#4~+|EmPkKsaC>x^Sssq2zv<(RFYpkSPZL^8L5n14p zS4`{7U}#m92-v}^2PqD7sqmdc2VvI6#%zvXowQe{rKQcu$>D2N$JC^!n~aVe8Lixh zni?@3r*^^H7@h5nLf^y^hkGI)l)@U8w?x^-z%byf)bngq6BG<^KQwxxEwITDrldV< zB$V9v*RNkewC?Jf9_}C8+VKXvURYY9?Q!j3=I)mmbs5khY1PEYM11Np z@8;zeqw5qF^msd=YinCDT`m}Aw$EF>TF=T$a25KN8b$ig4>s)%`&T}RU3!~^LMadE z`TDdpADicy)>d7Gi&u}mdvufZmX^*qR-(*0lgLWM2{);)BsuNxITNMU z`{T#QnwlDf#|`f%W6WujTx6RLL{hoy&1jSIDweOALgC5XRKYICr!Warxz3-Ns4T8a zhtS0RSyFd&bi5MS^!w_Oe^pZV_A@B?;1qVB`rv~J$5q*#p~rzL&&sxlHL6{0y4S&+ zX!JPWJi1A_&VIU|l6H#NgJy|8I^sQ8ceE`%Bgx6*3pm`9?RY5<5094T;vH^Yw&hyz zWyt)by}O*=I^m&-4$ZsR=*U`K4xQU8$Gd1?@~EFt}7@clv`P;5dm)#cESA2 z$>UYnf@);YZ%u>Q4LWm~FlzLQ7M7NL{+f?3_lSR;TLag4W0K0FcANw| zRcteIC+husrl3}yzG^}^B&u(+#e~o*vD7mlu04dG$V5UgCQ_QvN|bil`;x#adYy>N z&k64(S@>_DAiDZLg28_)VwlRg9)&JBdOH`o#6=FG*e`s9AjcwlnQ$i}{oT~+zX9)m z3N!z$EB}8ysDu66g|nwso<3zjkOnleadAD7%~;II%~jFWP1T3k^1HNNw$?bHN*n` zXFB}poOIdltEBJWhAaB|``NCLrZeZ81V1zBrQthlc04<(K;J(-;??Ojg3Bbg>Uy0z zm)Ow+qq0AL-uy72hnmcS5w3D06~6ZhSgV*2xq81Rw+S97(z;ol5`5b5XPc2nv!{$u z4u^i)aWV7lMwzUl>`L8Rw(a7cBWFl^czhPr%SNdEaW7-hJ08Rd{DKnST~fOTLHH+EdZfD~x1SupFy$F|CBa6}e@+H!?h&GneeEyEW<* zD*U9fvQo3$Hc_K4GgF$FoUXT#Tr#h&uI{CiBAi-RC*ky@d10YV)@tygmk>R6n>C@_ zeZ_DGk94x-AY4E-UvuW}*7xZ0^7ZWO?5_QtwVACwr33Nafq~rI+}2-4D^pD(u8Xlu z!UgHdbQ9yb*9&VO43%=Lt!eQdZNd60F1q($D-RD36DBe<$+P9;S#YKD_6!h@>*{n( zOiUuua5&o?ZwZ(aX8FR@)Q1qGEx|iHe_4&IlHJ+aSy)^YXtf!uQqe7R)AksHX{SSO z8&F)m%94mSX}wA-=Ke!DXNp}js<~ZT%^A{F*#MN(uBW z@>K;<8Q8a6K5pZ3wVMqek(%y_uJi|T%j-$uzpP*J>ZUyXc9LWfQ&Cj(LwPaZh=%kP zO#{7E;?bhoak`DU48%DJM;QB(tEi}uzIs4d9TK*nOzc-&W3olVsN9&(nsr~zsL=RB z!k+ti{Mwq;I4l4r_U!aEyBjp;Ati~sN(}1);T3#H#IM+xppm6JYd#XmkS%R4jbui# ztHt-9i*Ww+?INdMop;+#$@)fm0jdVSIRa@BKN^ojmy~?4d$wFTN4Mq+8QS=d&Gq%W zqnfLi>k{}1SLV`kaxB~OsdV@B zpI#FTSeL_++7kp2Ga+}nmW8qj+0#-xUA#(1Ivd+dN0UgsHpM&dhz#~Fqw4%txd#K$n_~S z%c5S%+O2bX39!W@1iXXHIzD8>mIC{O*%L0{Mo$!;AU=OfNNAwABS$6oQiqR$fx(wb z8bl5{z#ZG4e_e_FG{Q4;E9j2o`&{W5)9+CpL$R12gWwp;3TYH#lNKuo1?^qmIYE}j zI-k8}l&yk7D2XD|v}0w&lk%@>3(VQ&7T&nsEqZE>j&F~%Ie1g(T)@vg+B6VQ2jcL-`+ z)#{i>hm*yrTZ?nX8%tcJAxz?)bAJSDCl6@EdpsWm-k}lXq+O(2*UjIHN7{8fTVlsh zh~lGEf3+j3=r?g}(dr!0s8e6QN3sgqjn}-K_xJa&!c}1-xFoNsqJN~0IP$eGrzZ^= z**2{G?&iS%Zt_)uOO)aE24o`$uZeV|9OEPeiMKpA#+avOW@j^K?(#uJC|djc`7uuI zil^Q7t*^(b-PlD%wZI8YKglgBdiv_ss|+0~?k7|g&TsAh{7N}|fcu_y>@*@?-0Sna8GYySR_>=y5AyT# z;{~mv=ljDfee;RFsxynS&JDXvjSQ*fEdR0(yD=bWr0vhoWfdf%Nu#dEI|z%EB)VOE z2S@)S0rP}?^Vi_<+XEd{V)N@@6{b(!#zxEhD(Pbc(#R}!Pc1!(sM zsrv0K?!Jl16Kwb(>;zfkr3?s#qLcCE(d7kLG7Delr{cw>w@*Au^}sdQ#olYg(kFE* z;94GEOCw~L_DB|IWQIw89hOl8{~**+ho44%JD{KYslsBOhnK`v z(H3;JTIl(Vvph20H6Cj;I?twHKUwT;F2zgw))@_}Zwcv^v=rb!5Q0!fhUw^h-Na$# zY)4$mxvjY@R#(^2$w=0=`uB@Jfq+>{X_5B*>Xd0 zx%>ti{D&#pc+?+}+QVheTZ>>|UGU1(y!HCUnhe%MB~99yNVJ}~xHwBiAB0v2_RO-; zSrGhAKL2bz^a(?p2_3)tn+Am;>;J9W6Nb`OM)}}XB z;+DZ>psWVCpwKa&?@k{^`=X5!!1zV%f7ZutwNpplr^bmGEMXPM3VZnTS;5)<(em8W z5BmOo9M^5c?UNQ1|FFfS-QGL&~e z@ew;ZE8kA+9?(xrs%K0t3$Z(XWSkd6c>ZEV_hu`ZF(K-hbyW_A7I-r`5mx)ywnMwU z4tdW{Ripa{4j-T3PZX!E<=J#5#bu+(R7Eo+H3rh$#_{(e1gumuka(fPxiiwol+JM; z-Bh32a(_eC^XK>j8`8d(@~^qRgX@l8_?Bpw)3pyV&qc--<1*z_G*!e_{caMAthY#_ zZy6+eEqhx{*47;8#>fGjO3)%N_|Kra(v@myc!SNbHWSIN5?fl5xF)b4B=l#XXS%`b3iN64%tx=G5I5Bbf%V)zS(@Y7?SEWG|;jX@3Z^UE_IzM}Na z4fWi+Ty;xbVqr^WbwM)$z6;I4hGLrm2{l@(zkQZ!2W zXpg+L_)hjv%>4fDyj&~V@iN#1@$@4B@>+_Dm zNPci{NQ0}^=l5@q%s{e$|4ha})$H%oaU=%S&||hf^z-%x`PVDLKMbm9WE%Y+4P&e- zZm^Dc?=-B!Z1^~hYs2|jw$5|046g)rA9|Zi&;=DW+Z9Dix-0}S-U`q2lCHrPR-4jD z6Dd*rXPwy&t;=?a4O#4e{Mkwn^fJvr9`r~G>X{ZDAR3cDdc*Sn23r#cLtQ>xp>64K zoc~_Mf@nPE4~wd@W0vcJcNzHIh||SvN-W~~HU@N3U!y1Tq>-z#i0%$G-GLKZS6OU$ z9a2T5MfE(!_K|aA4}-1wnz2T%Wefr>Nph=_AYD_rgOy7JhjGW0oRmwWjS&u_3P4ZN0s^i4TP>2b2OZ( ztQ4Epj~*@*3Qg?KG^>kX8uK2b*q!{6TQ(^81z zUBlDaBAUr!!x!6Cu=Qj?)Hf{qgyc^DFVjm(=f{|jE`DCL`biG13_0e6rK#0%Dg8_@ za(k;Mpe*Ykt47E;XD3CQR(z!rw}x9w( zIeLodRR`^UUT!| z@}YHIlGmT>!z;;k*_dck3n(eYs{~}7=Clhihi1#hW|T^2{@RXT<2?84b$_iw#fk5w zyPGa*BC|Hzp~9vYzImwWr3|7E>BIiL%Tya&8SS&ouj4XfvOvGz&1(k#?i$gJ1 z%ZHP3zeWw&Zu})OWQrEiQhk!!>Ei`e!Up3|NAAuaF80ZWR+Qbe>tOnIUWwx0g(0!T zb@Y2-BnMy&$r>RM?7nVxQUBiYzmS*TN%qy**kZ~>!Z$EXt$l1L@;$$t$-kTog4wG5 z9{cH_mwz`lL-uz6S(IVD`M(pSSW<5Kk>Z3@sqd{*C$f zqsgIq2G=DV%ctUD`}fWlHH`RquAY$MHyC5)L%N#Zj5tLYJ1Dl|FIk~K;<;LW=-Tl4 z)jIWV-wU!5TFw6sm-F8WrT@X|E^|(s1qiI?0`GH9`%A@XUKIx$L$;}^udlvtyv}}u zy)@0+S3vo{c;Bgr?U#S&B-S1EU(j0r7u=Uz*202iR7{M5>m4GZiYyg1wcM&I&yrH! z%KNY38v-3gb6zw<`sPInO3F+ZEvS0gZryr%|Ni|4_c1NfKt?@&{PTio1kA6ktEzU{n2>n?tov~Tg)bYTpC6L(}2;r1|f1`u_ z9YhZ&8yg=Mm@=COTgNW9BDny{65!zp>rb%r^+hA9v$DR8Zo~UQg4_oHv-7wNIVW%( z-%2~@WVMhE4uOwuwsdsd83@5l^G21}-_4tyolRSls$zk20Jm!|8}0AUfck^%vqHt6 z#jWIwj0{xzb<$UIRRnIy*7goXHDG^GYsBpUtCQhqcIx80ckeEBqY4a?hI*887(Bha zyfnL)0gf7wvarbRFVL}?1$GFi6t?-A7cY*xxVi$o$egC}7c-1?#x5*$N2tk(6Bxeg zF^l{Qs%mPYNtr8KRmxlU+24dECnpQEL$MUQ0Z>)s=l!XD0yQMIwm7pl?>!N_&ft%k z4#!MiTOsE^kS{E=22lQs=l4(FpWmy0HrU?Tsb*(am^Mi~@Q#ALtwzwQKQ=&>;lfib zEv;_JUZ68(fRk~uTDwm#IoSInIyjTr( zI@1~>dhihl$!UYImT*StHhMjdt35hyV2)OuV&C)7uE~O#a^wLtLp`js0*H>Sg3}68X z^?0_|*9on~&R^TnJaCKIq`R7a64b$LLPA>~mi>Wh1U7kwj9*S?B_Ee>mbGRWgtQz-;0=(o-ViQP_O~`X1?;FbK>Z>_Hk|Iao2kf#tUS z0Vm(e@=fbMG3TAys# zdsv~)z1>pHp+Pe2m3VI2O(8SjD}@?(5F!01!AgNpyT+Rjej_?MdJWkMd@#+}3&Y|; z6i)U{R}-4Hn9ZyopP!c}XInlpngG@qXNC?9NlQy(N;%7;TU%QTtTFGY{O)c==|3lw z^k64SO9xDI7WG}~w@vdhDzO##4v>ZD_@(4PfS9Dy>#-Y`+-qfkY#@Lo5wEo#V~86U zx45wfW;&S7y%`xmQ-Kob$R#rb8?iWMP-xGWG|)@=_7Tli8ZZ}Y`$2X#Giy6ETOwY8 zR911oa{T!OlOK=0tCJxY1_U?L(w*=etrrx+2~VfS~dMqbutySuu&c0YKdqOMWtm<~oR&;L4Jg}c{X>X4jS$a~TmQj^_?(A76PQT2YMPN9<-Ado{yV=#w%~83v<^hg)&GhW`F%+Iw?C{J;V~p@$q$_0@EdjldA0O?93KlZO>%01%2=4 zx^?S^l7je*`*Y8Nt%lLj(P!mvvu~>iEqwSu1J3@grZvKG9|qZb@7HrlO6qBq+tMm2 z_&M>Wzc?Fl2{0$^N<|25A(9!hv!<6DKA&&NkWYw^DodXXkhZX}=zbB>IoH#XDB8XZ z>l{3PZ$vT_7G3<@RMfuCWc!N=YE2U^i^}O0=J~(#EMXf)7%r> z+n89eXcsrPOzRu^=z&*_2Jo5H#;3xfC*%F}hr3I ziA}ngtbzhpls6RuA{IEIZj;U#33X84sB@U&d>P05dCRuFB``bZ0~#|n4#3mTxYzx2 zGyG-0fa+8BI=WIYOIl&aM_uO54+{LRStzWCojQK3hgg?dq6n_WB692Y4Sju=I2jfF z-#}f+$_7rqUOpoJ>0lhB3GpmUKxWAii@4UrPw=w?i-$qQu{7ncxIyE#Ss zvR%_=y-3Ju2xO&~S9RQ+Yc-}?fOc6tF=X~s_M+-m(@KyjJ4@r9j_d}p3i5t zk1qmc#`AkWKNKVyZ#|RRKv$%Z(!g6{?rQXZEbZQ2AOqJNf_<{PD|N z>Y20B(jG}9hx&eSQ%EBrk%p*ndD!Ij|4@CSx6NGX>1(H7x zl$YEo0wG?YQ++8z=+2!G3;gh~CVX$#ySfNGnw+o=ujzaU1I+Nk8+Z{ z>r%#3tbbk`nr<;E9Kf3}fuF79J*t{=Cg+TT~U`;Eu z+ukhSgllAM`1^Q5MC>or^Gzw0oB=t{@5umqRiGZzCIgHinge-%>E?#&%ev2>Rh?$r zp6Tfkq-#tF0_nE9yW6%(coIQ^kv3RH6}c_zUN)9d#pMBY4jH1Sr>FCupA9cpBiA>` zJ`;$8A+D&v z!F?q9K}r~eZ4FiGx*fd*M<*wjpY_Mq_6CcMRy}J8ivn}E{-=>Vx48Hj)C@V<*}SbV z=N8{1m@VPLAh&{gBUL3=bsk=?zb%fxZ*cJ2334JLZ9cg8{A@zbXeAQw38a`M+?H?( zOu;yE&!%*AswuDx619uvmq}j<+`VhwpHg$`ry;+^3CU(CCLBlA=QoYR?`}-ZDM3+p4mc8dhNv6Y@ofdkt*9cbdjIyTsWz&o! zf;wat)E7VGI@{ajtM;>%G6@uhv=a&<&)fE2S0eL-$H0D2uqIWRD1{yI8` zxiL?p6lFcccX}G}WqRdz{qqwd9;<0rIW?IO@j$Y!uC78ZF8I9?99QfvoY>wPUmPt8 z1=_~`T4%yaao$8~af=yD4lI$u2VNq|D6(OlFI6jCx;2Ax3BVNYplgTFOrYeiFnS*xy!!Z&M@7yyPyW4rkS$HEea?j({Wf;u(5R5XVOjr*xbu8@3wK| z{Rdh)EI=&Bm0R|)5v;O!UtNlu3#JKF06SG6h^jD8l<*Nr3A&;uC9i_hMwy4ZE)AR1 z{fQ#5PaFyF@VOM-e<5kFnX``^fqJFMu}ieE*YR`Tqjh`G0m$Q_x#Eg4_{! zzkSzA?cq|hP@}krh)a+T2n^22Q3UNRQ#J@|K?@4PCAb0`0k9$VzmI5aAokL4G(1HG zRS^`RP`XO_{auCx5;8vZDDU!-e8}$zz(GXs__%E}$*Tvq2g=#-a1VeKy5b2%aRkbK z@&RNH2uIZ8FhYR?dYf!0x4P}w&mi7Or2^F)#snpO+(vbEH3+N;6zS#nMI%rnGQ~w- zIeO1}i!U$Es`3~Bo)lrswx`NdZyEd)RGH5Bj*cgY#^)yy1W97sZa)fszZ_Kb;!L*s z2>z!(`K9P`Vg{*^WPowjI>*_LY|2k|EbZ(*)%gI(u?(x&g49558j09VeOdCzm#-#53bC*V<@UKR)LS620SPCedbPETZRj3LHOX%zjD%M`*Z8B2Q z2reycZR_Y@di7Op(AmKRo<=Op&kHXL98FsVm7IFm4OUj^Bb5!}vHSEyS62!=8{~;H z)V37hE^TMc%*x)E)#+-6m#~f#i`qQr071EFN#l}egx_F>({4C^8i9(!uUn@ zALet>ey`BxLNK~zAI;TI#XAP~UvD3y0DsPj$k=$k(McVd0!D^JPXxIYL5_>y^B0i1 zc@fdQI@2ouYJ!way>)$aGY9HAFgeqjmyk?jGC4sRbj|+;)mf3#u{3W5KYxXqf@TEO z{O;eI2&IfMgY_^WKt>8nNTo(elH6(5Y<=r*xd^Eq$nr8k8umD%cXZUc3h_QVnhh$0 zJUgG~Uo@L{)!<#5?aXa$Rh^tlp9Ey+u;&n(scbkIUkT`9;bWdy{#`Wu176?S$_g)I|F4rm%#52bn)Rvt}+C zJ7^g*v`nnqP;mJ|&f)4R(=SpYp1!Ul_emn*yYp(YpRBZiuP5)&cVp5^q-TBI*yJ1$ z&#R*m`lMt5jbK;L7%s?IRhdnA%j+G;T76k>JuG_q&}WQ#;n3Xu3x%3xvyJTfjMw3( zRy+K|L>sTZykw1oHPkE#5f8pg$B-JZw%ti`-z=eV_lIty4gtuugo(6TBJiv%YJeOA zd_cf2`<*3ycoeP;7_-XJ@22Ug9Rx_P@5tWZUn;q7*B5m-so=7^e8A1m$+&mA-NRN- zb4_3fpgUd9dFDi6Cn!48JOh&*rZBIJ+C^(V*yNOzZ%FaXJ=)V z@NzV0tfV;$1Y$e}yZ*W{yHAq(tmw~Ln&V%*+yND8S0F8~_+I@v0yzd^1>sq(9%c*B zuM$K(2)DI|l_3I5^PfM+)#A6?O?|vPHe#TiDUx#td;g51mVTX;Qa% zC}T!`5V?~$+0tzSIppjsbbru`YI)h$LAly$e|{r^UdCv)NCp4m9`-d z%e#v=8(ISKmBP>R#F`|P6r*T4Kp%_+rIScVfItm5L6^7Lu4{{M2~kWh%j3=2+LKgJ z$F!7gXkTC2iCY}a5TVSDE?=I2Rl@KVFQ@+ESXLkCgqc^`Vl`9J<=&iG94Rg3F5UZM z#z;4?Z6#Jm6J;&BGKVuP0U_~0vXDeq^`UF?zPMhZM_k<+aoq02az(R4t+q_icb;>A z4hcfTks>-}FpyZ{aX54L&ouY?_NFePkvxvL zmWv=;Tpkn9A_(PnDqQ<#2v?Nkta;K&yYJqM0#=~h2VLch4BQb%A)kZD3bpI1)-sci zchA^(X;k~rr;)s6e>BcC9wgJ4l@j`%ZQ_rD`06#&cpp@z9mVOq<82`9ksHqw(;!Gt zg}M5RLnk`mIc6uVI|m5=-Z#M?jLVl2gjLe*%Q9FFt02n(FIL)-A)jr2e(u!SFzvVw z=|0$Twl$mYUSiErPG{w$6Ykh_gW~Pi)?S&@T*umDY_IP@ct>5AAyN-HLeH#&TOB!& zxuzl99mF2M>V36m=(C#OmFquZmT7oe+qZFB9qf`y|1ezw9ZwITuL_!Mv;>O4NC6@n@e_Go=-My41a0CRj{_b?qD~b=24wsd+4D+sv)K)n|6N za%Gsktt>Lf8~A_Sh^Qf^xM>Q#@#3V$>$px{?)Q0Sg)SUZF|sVkIADoITZA@I5jxWW zdy;N6jC)9psm`&cDQWJ5TuWVCPaZp8uXeOm$U`TM0#lvvl=zsv^;F737sXYnFazqA zwl+cqd7fS(4|q1{sK~0V)d?V{SA~Oo{QQ_iQxNe%T<)kQ;va(k6jo8Pm^6@0Zp;?< zgjlE=FdrPVD?YM6b6@8l%0KCK;sv!+d{d-Bj=o--V4C1kCu)~LkS2qP-g2E~kCd8U z;<~(nTpP3iDW|>3pyx+WdI_0m8W~UoDT*_2uGkSV#eIqM8M8CfvpDdrI9z-A*qP61 zj>*pba~`kdrqu?ScoipW&&d+oL((VS2Ur+ClJ&JG=O{Q1{9`hH~J*KzfiF7@4+ zXh&c3RnIDvco*->e^B(Jt(61+_I-Ft3O5>+&bu$<0wGpcd75`ni*<3Zm~rwDO6RJL zel2cwB*CRux^Zo^sUH4}VdO&Zq)d`FmrvuCeONo=Enw-o`au6ZR~mJYDqBj^xq$Dw zpO1FK#jXwStICmk>L4a!k)E^c{Iz?Lr6gNxZ@ckpT9=YI`;l5E0ksrKFB$5ch$UUc zq&dJF?Bc}c_&X1*tHDw(^&_JCq2D6%NqGzPrjvo)F^8@8Qi{E;xx_N=6;37)O|z@b zny}b`u(suWr(#rS+GKra=W?CI4F&q-T}7PLrB-@)MmDd_85V9eGhNe;HMhBTWzb2G zw5DG|2l*t|CHkZz*!u)+CCS|;#6CN@@n-qVR3!PXT~_hs*79N((+n5Fv}uJ4NyF!y z1KrPrulnj7ycM%8lNp48YlfJ1#2AnJbYb9*%j@x6f)uH-MnAps~LvaF#h~OHe)5@BfIUqg#TPMjz5OPX2HC6;v zIH~}?GJRiim5l(Bjer+}fD-^#0@?oAqP8#e(M^y7I_HUA1zg`tW<+q-^X z`k~a~NJv5GyyjD1K6Zzt@4XiBe(lv}*Gf>=;1m=y z1+P|<`_8HhUCVtTdDV_iG@qWcu74l*Hc_x^N4cG3>3QrnD(^)vv>Rlsa-Ng4j-)*V z9jt}NPn^WQ#+ODUYJYe@c)*(@Ho-#kO&&5uy0TzWdT8f^kv?0ACa?PQQ=n-lkV7u} z=_!%PGI}4nDBKRYcc=OedH44wbSigweO49@f2iSWyJO4(&;pQI%#2qHu>TRVXl+#P zhUOOEeT?sWrrNa*(cQ(;&Py!`jKyxjr9vB@(a+0-Sj*jHi-c@CUD|m%dtnc8Zk$z1 zno1~SwZhq%p~*EVTDJB5e5xqE!b}aw|Hz+H%qg%TyykL8g2iUnf~Nt#BTG0fm!F&e z*d$0$3DI^P;*&hHZyJ~DrVol<+G=mph;Q81QT4|R=%6(Fsro>j#2cmAN@(4HdB*SK zu$OhS)W_$=joAJ~C}x<@VqxM5UtwzI&Li^%BRw3&yP}-0Z^m3AxWc7H_V$&c5IwI> z3yhOTBVO1O0xZd6CU*MZ*|`48gx@NYmImCRX^9ZCVa?hcP%U@AM+ZulPgGmDe&KW7 zj3G7Z+E;CRCPC9$nNYBxiybhMEk)t>-ZtE5tyT2`E^0yhs+n3%#mvqbW zR>C(BSQL|(TSF%<2s9$0@o#g-JELAnQSp-u)2Do`@&$nVNGMeH21x-PfF>1=%jW~2 z?W_PI^k0p{V^CI*L@m1my`AyJdLjwG4SN(sFvH3}K%fCB6HP-90A?@i??G}2v;|`* zr1P_GP;GxV1NjT!tN<%y0Fm_cmcZ-_{T!oW?;Xd;3?2Axs30AJ8|+|Hja;jDE_vyb z_qw49MFF#fafECR+KCiBJSwkpX}do;H3)41A?3~V$o*I2$o<*(0?mc0_DkZR?v-=T!4~&?gt)~y1c>8B5cHXP2*RU6OBBDMtFP3X4Z_x6p?t3#uB7)}cbDcls%(0Cucux;@zaVNyULh8{dr+vwcVUg9$+nNYjs zKFAb9-c2u1dOBw<2MrN>y>f$!N)vSdxH^x|gjNQPxs|0_P3Q`Q#V{pwFP!;0QhhO` z+4F`$Vq_opdTc!gx(PRs@VHu&h~M#wYmR!|(X^YSr9OL%=_W4OLCY=W=8ezBoU9hC zS~Uld2aD4NoWu6YkQvjK_0_u%VIJCxcbOCjS)uc+?C`Zt@|C~6gxc@SeXIN6QZv=5 z;;nf#mwidSs$bnm-g`M?C#3t=#|sYM1F?owf+EAO?ekWrh*7F{}kGQmQV zYt&;dG2~;zWd*Ttp8B7qof1}T?|gS+eCN#@7!dT{f1cwirq2W9^fcas=wmU++ z87{X=4xthL1dL};MZVA8CiH#Bxd3NI5iCV`t>>d<&>U z;POF%&|b2F!4!b@YJXyGjUd~JNQ2!jaxe=_!OkJ1^3Vqs&O0X<)lNRM06myLz>zZE zk#7Y*Oz^;KgY&%P#x6GoG3rH>-ioz03ZM67+BG12nM4=-8jOeiNFr1s%%YUciO-Tm*V=UVSX1;;GT2E$U z$HSmx7+4JKyENIC>d#VdV}qgAW7R0a!<5-udkJ8d6LTp=4NcD;&$aqOa52${ycXY* z0tVQ94q^d$Esi-TLT4@1yRxyi!NOrVd^WV1+pBMDTbow33c4|wQaDAYIwWd)_+>w( z>H!o8PVa9-1mEZ$cM`D>3OBxLb2sOqk6E+!6I63oL>+R7x4SX{rz;#$#caVh(NU*Z zNK;ufCe8hAfZ26%FubH&QZ-W{*%ft<>bCj?w0Q3Iri}r;tjk09L$z5C}! ze))I~!RD{I4L9ijcowJ7uPveR@y3wa?Pif}MQ!7gyC)5u^YgCZL73@h3JMA>J99VtVt64E$UV=@$}(@8egc0E0uUToYTFr} z?##}P8F$t-=;i5yEC`~0BA?@jMVm&*yoIYY)!WDSh|$VkodfM7d8U3iE7QAG$JAdX zAC_|rC@19yyi*|(?sa3a&`d3k9}1quC76lEhld!0JGgvWmnOLHR~MHlwv_!`d0G)E zD&kUA)Zh%Ec`f407k70|l|_tK+J19kWU?s#Jdu3r{M$sAE6s$iPJ&}w%4_YMhq@ye z9D9v(x#``Wbrj#Mb}GA?WJafuB=$F#L-uy0LKPO4%^9hFN@Pz#lG+`94)1i09tte)r;}=*qkYUW4P*7o8$JGw#?gi9td2VWU zp60lC`L&Pu_xy$4b@itwmZcujJ&5}1CTkg#k!d)&!lk^AqTTh|FgpD40Y{;vBtW9Zwuylczaj}#_sn+vzE}jLSD0ViseMfexA)pah%pMl4w_eM)gJv@zQ;AL6VxN;s zZ0iqVsTA(m48IJdje+sikGI{91p!8~$!gSYjflo*mm8 zy7NR&H8tP;`ejUX&)S+pL{u7iqf^_wA-lEi^^*NfjO7anUOJS!%?B2Pi$7Z>!zzDF z#T3ab+3-kmJs9VCb5cf2(MYb9^ieN!tj$mawf~O8MWn)JQ*dOwi>9RM({Hzy|B%s~ zsZ>dfH-0Mhkh%9{?7g2!=V_A~E;9Qmmp58_LmRni>y^S_e`doMdaibDeh+vxgpk=E$bip)gd4KA+p4i0XwN2bVVM_;pYhzSQH$;o|(64Av z;~~e6K0;3J>+S~jnX>ZBuU{X@|1kwZ8NmN$485H@kwx%X5@AjqSfm zQ*TNYNl+K;aCY8W4nt=yxG==>&PKl>S&hFH9e0fux5e_(Np07}aNJ$C!kPo?JJ;m$ zkd{uE)wP7>u>DoXvBs0$QZ7m{$Gng2ktLppPjdC+zR*2+ZJq3nn1oHl#Pw@0%CN>l zNpX~%Ud~x|_cb>kT`Abt+>5@waZYQ`(o4|g;?C=~mW6{okNEkK=qE9a%8wKzS0;Mj zklfM`B5Sgm{xj5c{q?zj@W@M8$!$e35i$Sx`J2fBL-=P!=e-?NqSNEA(H00(vUhl$ z4QPx{T+SKIc_Np<=b(P<^oI7h+DPE}PKF#kpV9R}@i*&skJhd-2Yc8}K3n?!R8jFb z(ZkbJFD_oY_O{flvt|4&@a3@*IwLdYSsNy%rc*$1izNx^Fu?Y9t>$QtCwlD3ncYyR<(_r+Xx zMBF|vUSfY!5MGCis|&2w)Dz^5(9~;K^ck1BmQbG7{PS13g#0R}pni(P{h`m!Ri=A= z8ysFYTTl+VBmHKYtfjlBH8b$-mGS$eey(jr7abOx4!j$XLVpBCjpPKzsWuGXgbs|` z2jmDnTz}3_b!+66mhZm!E)sw9hZ}9=K~ErguNLErGLJP=cQLxS>yHVhi!DTlfS~T& zj^F)c?$dwp{ia-~{q=;tmtc}-ulz2QtshIeusc8H<}~o#R#-gNxbbGWzo*WHoipoL z3UunO$=51M@vFBBeHN-V2JG=0O)@LPcWJh#awa~%!Nz(9Q`Cw-?r)D6@F`9zbTYH* z7gwH=-gsL$NXeM4t2BrC=VV(jui`G<`TDV!F$+k=0kqA$bGx%(azGdU8N;sEiBx>L zU)lboqC2Xpitsy}oDH%sHl6dT1V;BxLPmTv0)ALlQO+uOdU=(YDU=2-6FmuhS2 zNkKR^-gRsHcUNkK_fEA4}`zILk&0*eIs?Z z`;7?qcaIYN?(DE!yco|i_U*$H)`f+IKf_jqDf#*5psGA_-{U;@9|;WiPRc%ilY)4DTrkz3*ON~h zjiiNC+kJ1Td`19o#Sy^B&wm*p{*oHABoCIX4Is!{2Xv3urA2O4Ltg*0Pff2WGa2~~ z9-o1a?-J}k_ucu-6;O9fr-n*UW7)dzKGW2sUQPMms{87ws21qmK@da<0i`7s@Je@w zASR_(0hLlfq=rViqyz*MMY_B&2!eog4BZGwgD^A_GIYmpAHDDQ-g@u-^=hp*Yw1!L z&Kb_x@$GMad!Gv`Dx%W$E7hQVt78w`dk*icTj&rJs(Fprk99?Uy+fi;t5?0^jKWyL z$~}BQpnvn?w1YGiD{DCH8bhm~7dbc>)ppyStd1;L*WZaT+v^WkV*KbMxC-iRJ+Z@=T<)vMD>qvdoUr~RXSd|M|Tdt6lv((CoznP`KpM;X$cAULW7@YR2(r&Hwd744jjM0pR_`nEWs zVU~%xeizC1e#gCy=lIrlSHybikHn=0?gBOOfL{(U?auLlaQ$AKR- z4o4O@e>rRAf-14a{wd%+J8Y&Gq@gxPj8{lmkn2f%**=da;>YkaxtX~zPSAU8ltRln z&BI*u5I&XoVe!YDd!zi0teKks5M4cnGg}lXN3qXp zb*3r)`IT>k*Ii-}h8YS^4FTYlr|&&q)s?+KOHEC!X<#6rP+U}0Yh7%S4h<}eRtAC4 zqG!CY$Zi7W-jzCYaaeCWsoc1mFj|FKyLf~gq8~Yvc(dc9&krOM)S0CnP61^d(I&}E z5ie>|rJ^%2nHbE< zVmG_1KBjHhQhe7Lv_A9lcN-cT8Pz*GJEQlT=N;gqwPoz32KpqH9ZlRVuA8tSx^GZm z0w~o;gCnmKrc}t>nm0B!*rcQwyz#Qsa*Uqegt$03I8p;C{m3X|K#ij2t@JJ-Aq;w~ zs4D($^^AL-b2gG)!^5Xh`9fu`o90p-Gj=fcd}2kcOGOGUlZ|u&*s{{CTc^MG^q9o( zN8eWO{PwNC_nIEprAybuZ}jp1goE7EcXgEp_kb?eVQU{+gKc3g6%kKbkBD4Gmc5$@?VL1Ib@?cnqC z!w(Evio;+^n@K~@qrBfnI^h71IV({?*tnNY)uFiDVL z`S_WMNy}jp@R%)njzo)du}VKeJp{s zfKp5BgNA`@t_pDZr|0J4mY-_jKoxA;CwWfkBB+8tC~Qi^Ds+|R5YxbiH>PB~4>X^w z1_93YT-!x%?)`)-;I&!WxfHHU>uYPGj+)`QA95%(GzVb1f-gf`TRSZ$hXU*(c3e4m zFP5*TyPL}4(0^mY0e;w`$RD{3W+n8-B^t0eWE?=*T7j;!jhqm_0zDXaY~H|RX4#&o z-n2RWP5A&t4NO>lQ&XF2anHQU)vG6%DM&ya-90$S!}J+K{NNWOKb#;jm_ti@d#@-( zpLfj-(0sK>qm)Tx{sw>_NO3{<*I$&?U%EfBnzNr!5)u-MeN353cgx+qf=iQQVP_#L z7bLM}3%q4rk9cX}%BrdlQ1S_a*4w;{?-T4$AxhBT1m>CoNBX|IizK`$O)C27)2AlM zq~5qM)bHd6MX4v49s_V>fsTm%OdC~YPw-( zCk%Cvc(#=g#|bI8Z?L{BR_GU8XdXU3^0I9BDI`mOvG8K!NJ+y4n#tzsR}Kp_vu$0n zkudycOI-8qAuQ;Gm;w=g_mUD>)VlInM^f?Pm!sALvj32{m&${da#mKn&4le6UmDvW z5{Bjqx;06~2+}cFU5!APcR@;ULa!%rpLu$KE3H#UtcGzs*{J`4M+n;DC`y?smJ{%gx0_40eEW zC$EMmAcY1Q_xu+9W#BFlDf=k2)9b7yKbb(?XwDc4ki;`=R#8RSO;T@%zz~S#8yXtX zn`iemvG~5d!&wPzRm z8&+z{#jfkb?*o8}^?oD$SZP`kK8Ho&_H|H?8BoT7gCq5-$%Aa26jB|GV{=jx#L+!JJEE^a>3bSJ$j!fCVe&rU>? z1PdZtYUt<0Jx>pFO0dt8wq2SyHoUbJ zGFH?q9|+maP`y(<)x*V*qfC~z^Rb4odf;v9Vq-GzJ-*JetdkcKm2}fzOjafDP(MlI znuLP@jd3~&T~w2w#xOv#+$cyez z;w3ZHmNMNH+DkQ$qFxdjJU%(jgyT=IG%PlRPcC(Q#_3GOwVON-Meg<3h(63H<{?EW zxUd^&E$a7jRF~QiOYKR&69rSiIv2Cc9~v{v`p;RL7#wWhh+z&k?lCYJoZC_UtwZ?op`Ntv_?=yXs^C+I+yLA;< zn2sah<0clui}S#+;7FqT6XUm62en78*vkjagC|5h>LcwO3H|`}@ufx6nsp}*#LR&B zdHevsSAD_dfKMhi@CWPr3mq>^^}jyGHylU>6~E*x{zOwfs(*o_S`diJcx{DxHrUme-Z{uDUkitxsDLbFD5cN#djoGZ(n7$Nsin zRbQomzz=4FjgM+go>~}K<+?NSGbSSjLj3Uq*9oF0WoGpV%XUx_m4O}30BpT(TQ4VuQ1zn4t#c&HStLQo_6=o^RZ>bq6qifBl;S6rslni z9ifWA+V||Sx?g6&=~wy#OQ2JQaC~4F&_- z)s4E+&-sm}x;VF9UP4AYaS-z$4s=uANyDU)Hs#OKT zSIzrgdWdsefwCWB805r{qZ$O^^3+YwQ78<)VdQlCim8_}b+V>q!87JBfomb`oT<(q zkN2l_6OLH&fY1}?e$~1^?6JGR80O0*F=B9GwdmcX{g*qd&)<7c@BBKc1Lz@LVR=B&D4H@<}8HI*%B%N*%qU*7bQlFzxtZm3M z0<6&yof0D}zN5bBIRr!HO0ugY?z^H7zHNEgDM&a8%PP$9?3A8JpbKFMsrQ|{9s5+Y z*EWVmhJmCL*HIdwHI_p9AQQbb=$OxB|Ad>;#rjiEN5E~&qM-)y?~K&-RD<}$_~M(Y z&1UE3&kHKuu`vpcH@C%3Oz};adD-*Nf(?9hTZjmM{9PI3xGSQwh5FV9)h|tUIC3LQK=|``I1S7vzg*XLCRf+iv z3gE)1sI<&px>V}pb+mnb-zFtd2G;oiX(!b&wJP?BOCvF~`Gx_fbx*q5&dyXgFgg=L zncQ-ZxB9l80D0S^*kzN6_WP5+_s_Tq|9GYzFX;nSUX94&msZ3JTs_$5hNCx2-Bq^Y*gu2ujUG!ro|K<;kp9ge1Cw44&BoRFjHG}A;+Jqe8Xo}DAr# zCKlc156fl@4GmGKvoth*NVkTM&nnbHRmI`hP$OVJ0!l$8B?71eZI=dxp!$VLoLbX@ z=T(#!Wn`F;;{Q1?3Kxp$x}oN@9Q;B6r9tfc-Y;lcf?lM2pzq8ubd8{_KS&?w>kCt| z@-2p}sIIrX9(M#GDTm2V(y^2h5<3N$c@l8KZs;p@5<^%o|?<@Qe~ta=?1l2)c-G;ou%8ms#tH zuT9rJD*zky^4xO<(-w2VD|J7zZRP}O z(6T5w2d_Mj+vZw!c)aC7U*S($VClL3V|kat&*0#A&HlqBVj9!Nr^yF|FEg^EQFLtEtZ-nCH5sA11^#ft4>+eQ!}QdGW9D5d(FL|kH=XIqeT$Uf(x1-AW+at?I(ieUW z5UX|4Im#C-=1F%3zh^zMtbHhD?L?XKowb~#1un@!PxQb_?y(Ttv7AQO2XBL;`$YQs z2bfv+(&!IwC*VQB^RPP#U88V+vFEm%0AN#1ujfTa&o9#8q5=Mg7w9IO?5w`v?$)QE z`?%uL<9iAyv-#3YDS>*SedubMjzMQ0Frw(IfyU?QXt+h1a06?jVc?{WY_^J3YQ~n$#QtqLYe2p)+=nlg>aQx^{9zF6 zk&@II-6Y=x$SM>YTquzuB^m*p>R%7M z0V@O6i!?Fj|Jsb%h9eBFMG2T+;WvYTmTnUBe1WlAWIc6e4$L*Bs;)R}?}h@(g(hA8 zGpHaY5i5TNt}ymkO1a>%stXB%#ctR`4O3|4jNYmj_pBP?LO&?_*a#MXaeGJ;&X_#( z9&8FDiN~dxnr@7Kvx1A~sZj^-8DH-Z?~%@G<9Fqy4%djAcJ47zsa(~Ol4-R`L>hlv z3w(7$4r@ z&o)ctZLS}Qrw^xg^*GCnACMTVi3!futM}i*mkIG?oX-ub13qDGkE0d$hB2-5!9dYw zidjc{^5R3=F+aK`+B)uZq}G{-peAJ1TA$o@C^d|WU)=7M?sB{@xzcdIqtX{41!(1H zGh@>A%K=}vpcxAC5u_N;pL2g9PZNLn!ME4Ga~a%yPabW^U4#O|DEI^0Vv*}I=h{*G z($OiwDg^@XEQPUvO|9eCcs&VXDkd?leiNu+T;ic|9}J1lb3LZJGtIguey}B35YN3q~;+hR;Lym2i8OL_-IeWiRZNgAQ z@4%q4%~XJZ-A0?i5jBugYvs`Nb8vQk3jMBtHWoS8bFj2!u*#!6{=wb5zRT7)b=S2P z?$samo#dreY1hLiLj*lAx{viw?9G+DVl#-vsH zFY9-Z?ewd&ynvl`2kAN%}oZH z41O>Q0t)Xs=sWaZPF#TLa(G6N*?V$TH8q4UJ5%k&TJp&MF#ub{MNRJ?!g*H!%#&)x51c^2ZTM$$@`e?^oSiAXa8r;_h; zA=Jo0Va};^ey4aXf0R(6D>on9SQl_XKPI#$H~ijue5P3a zsAhYY`>jaPWPgjoxVi?nja%1tI_YgPuHk6ITQy#kx)&PX!b+!uHtfL})OfA`nH^Z{ zaj+~ws1=x=saM&@{l(nb&QZsAxKNMiM#w;8O3`P^OmTy$7Rys{44V(R8Kd?rf~56` zR<{!>M^5TFC=5`Noa^b-n{R>~H6#8ig>KSb$A~6f^-hFdDU{F%zvq;&^ghhpab#1O zsMqT6?X>Q$GQ$8TOz+~t+MyLfW?1%~27%Nn)cO^rb^$oT^AlI+yl15?9=snMfUArh z3xcBSG$64rOJ?Gauix%e)A2m52(`W;#Q0K$`lBrT&jHa|__z~LN48n~(|y>jDKC2{ z2Y)JMlltss|IkFgnW)tt?>sAj(y80sXmSG5$#Wg!x@T>%ED?~34LmhFIGXE}v{2LE zOMh_KborUE%YJb>S=%|`&3jTO_tZb4c_JZ^!?_~)M%rbNKk z&_hCcx}ewcB)>0K>X5sz#XzlP@F+QFGY5(Hdh9 zL}OeyPcWEQWDXrXY4#D+-u}u)KS_K)${w&rZ1s)6XPO1_wuJnR!Tcc9S|RS{#Rr}; zC5627(&L%iOvjr4Hy@+XR-u0mQxj4D7f2xqgo-3CM}7V-H68bR}*V8~~mKuFoQI&w#bW?_*3=W0~1G+T5`HOo}Sk=?9LJ z<1XO`pS6o+z|0XIi1yNR#@CRd%@!CVMv}!}(48|tJ`p6RS|5QN^R;7ysRscVCy=t} zic0!Py7of;E=Muo5^)

    LI0gD&GUh!?3la$<)3ld)w3`IOY8wi_@7`0u038H`_in zX;kv_!$E*s^et0hpb%sAHMw3Oi>r4Ew$C-|xZ}cF2o#-5Xzy#*xfi1yR+YD$j%G52326l^h&IU$e;l6@BKb{5xI4DNoRY5<%M?>Y_S4 z4K=l4!H_ZAlM*O}K}BmE?gyCz7BN;&t;kQer5J^v07dtfGN*nCM<#pW^U!y_)!_?{e|A z4HZe3Ov>M24ym$cHNTV85*#PGDhrk8ctS;1=SJPVBe9@_nI$=W#q#?!ukh^?rJ!`g z&Ogyf(S7=GiQCqT1Eb9UpwmM|MAlyPceZ$}37)l<$gN2cx%b+$&WJ-5fZx@71BzYS z!K&M5eO`|qE^B;N*db>kHHNHoklE)Rv|?7mjgAI6Bj$OUg3jULVJyojAK#OEo54os zL`>TSFC^Mx5#b0R7D6tTSP3*s)!ssuQS>hdX|XVuwBm6NrT!i>F`sK{GE@vO$#q)LuMl-SCA^<4ppRU^WbCs0G=U3+FF z>CrwVySvBvlT;4|Kf2iQTPp&HAp;S3SbzYy|Hl|Afcm$3^!`Re*I{F0ltS9i*0NWn zqwAz2PcztL=>>>;S}!UrROoKst|yAG=;e;?qjWy2Qhcl0SxLA}mkRR@8ZB*1D(r*f zr^d_Y3zyBi<0-*PbfCh+xI~C%24naDz zHPjt8!GR5cSc9OOEDKKov5OrnmT_LLhsAM$0A^E*i=CTOXjIW^X9rH&9^UgS-7A(x z9r^V635-@2S;?*Gb+xb&9IKX;s4pft^gC~)Ri&|lAX_wM?>^FR0Xj!GFu?~Y~&B_?NMS4B$Yiy5M$32%=AFf0%`YD`zy{x|-RnHqX9k%Tw5Y6RGf3Wh{` z^!TIOchBAcHekuAJiEBT&RKTXCSQpa*Z`;U-$4~LPqV>5g1xDfyV_!Da0&=dXsIh( zSY$1Yo^5|54crfqH8YE9C%fwiP%xSp86QuE3JMFm_H3?MU^?aupQPi^z&Nw|QysNh zj8m~T4J|+NT(ALWGX+{63V|T zWUnThf4@~7-C2!Ms$4YQj?lZ@@smbmA?fH0__Q$F3h@0vCYo74xh8PFKst-`<3{D> z6QgXOTG+Sywo>avFfI=rQ|zk+=V}p>i^3loRaS#@9AJ(3hO=~Zfh8s7$Hf0z(+bxW z+SMfrJlGYfUoVL6x+93-Jtix zyjrzr1{BcI*5bNkkdcG=Syu=?YDWpsFiXGbzWIAzLCO>P?Z&)`c22NECkbm2OwS=f zJz4e_j9Q`t{>&-3=9rf41$>5*J+>^~Y*(r3(|1hvGB)Yi&V!2pyjLm`FuT@Jr$YbP zAM*9i(j<9ZK&q!g@Fvp0gQIph2z~5YI^xj*sQ!r|kq18GKzzvgIk|v3qmFOR_pR@9 zLxWy28|Bw6r?Qz99>-En68W=*{hNdbx;szslN3r#2V%>FC598stX@!O7A+8RV+RsIpWR{Zg(uSnZ)lSp} znhbcXdcg3k<>Qe0aKOMih34Q* z6oFi<{y+8dK+y_6(2R%aWU@9rtY>9AIwfP7Dev#M-g(CE!&(fTvU|lA&J*J*0u2B^2(2ZXO}I4tfWQfl0ik(?${oc@F%BKr zs~G^Gs5Ipz0N{$Fy+uSEA3;gKfi3jLOYqyLoJ25u68|fl=%FKN$q3C=1-%1tyz~%X z28jssooOdcuiR_$Ck|a33a?{Bb+(a$vBb@BbkAa^=%1cI%L+iWb%0OztU^k-KDoS6 zL5II_ESPpQ$esggKh}}*-Hy=T1NTudDgfF3#B3w|n=t*;=;e*7pKVeE?^M9C9@EE6_-E^%? z(^~0HyKcL?X3{f33UyvXw1MYktia{VH4s5XE2-so#t9h&HF2u88$Y!Uc00WQl2))s z$4NVyS8oOj1Flo1-k`q?>#Si&;Y?RgPg?0&(`U~(#l>k2ybi^HGnEez`?z}b;_A6z zX#%S?H4y6?gnFihouCA57*f(#r`Wi9U_Gf&qBoh*9<#Nd?;YRsO#HfpHT*83OAzf6 zA(fyGrPxH_fWGphM@&#@<-zV_qe>&+AhWNTbucsE^@i+hhE+4Lr^#dG1~A&(`&8 zZoaXxy*&kOrN;G6h466sJ+thr8&fI(R+|Hz&Qf*%JX=Qyi>Jv0nHMrPx3?*?Bj$ToQaG#}H(;6jUGmsTeHhJnfLs z{JX~wP*0>$@p$zaY{{JC(+HnGy~UsM1t7&a-k1?PSo9)m{+JK_p7Cg}^FGmZ3eu)6 zxeR~gR?xhQpx@Niq5iGXq3W*lQTpBVhOXXeQeyakzh68T|5axpZ#VoerwF?0`#*nk ztzXQ%`_w<(IV69MN)^U==It{|w-`Z?lwa^K`*#?kTREWa(tn=eh_cIVXoSb}l0FJv NH?OIy - [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +- [Configure Windows Defender ATP endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) - [Additional Windows Defender ATP configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md) - [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) From 736a484570121c79d890626df5c092f831892274 Mon Sep 17 00:00:00 2001 From: Iaan Date: Wed, 11 May 2016 17:56:53 +1000 Subject: [PATCH 236/439] Updates to include services troubleshooting --- ...ows-defender-advanced-threat-protection.md | 1 + .../images/windef-utc-console-start.png | Bin 0 -> 7836 bytes .../windefatp-utc-console-autostart.png | Bin 0 -> 22317 bytes ...ows-defender-advanced-threat-protection.md | 41 +-- ...ows-defender-advanced-threat-protection.md | 295 ++++++++++++------ 5 files changed, 220 insertions(+), 117 deletions(-) create mode 100644 windows/keep-secure/images/windef-utc-console-start.png create mode 100644 windows/keep-secure/images/windefatp-utc-console-autostart.png diff --git a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md index 4f5cf021ce..c26707df8f 100644 --- a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md @@ -14,6 +14,7 @@ author: mjcaparas **Applies to:** - Windows 10 Insider Preview +- Windows Defender Advanced Threat Protection (Windows Defender ATP) [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] diff --git a/windows/keep-secure/images/windef-utc-console-start.png b/windows/keep-secure/images/windef-utc-console-start.png new file mode 100644 index 0000000000000000000000000000000000000000..0dcf33a47cdd833c39bf1728dadfd59cb4de959c GIT binary patch literal 7836 zcmcI|XH=8x)@=X#`{LQ(`Su<6oHNd!`;H_dW4$X+o@C86=Uh*?j+Pn?6$=#z1fqdKRdhih zl33vV=_PXDl~G0y2!JTvpeCLm5bdY)CrP3ZEh`YD@PcWoQvA3`O(8-4NyGy6JEUst zb3YFH zl=gSj!`AvdmCFl`umwr)(NO|-D9`Wcx!QU8SbNxl%-zn;)2V+i4)?Tiwgyr?K$s7; zF+ljzdDzI>!v*eQ5Bk759|puI{_%Nl4;x$1&e@BV|4CDJMIdZlyg<9XNmw98ex9Ze z_j0xc6|Up>Kp=K|n94nU-}JSKU^lb5j16MUOr;c2UzwDDoo1QaVA+bNXoTl&UQ=@F zC*&e&li7%D?K(nyf|vcO8aE~c+=yvkW7nkF&gZv-to-pNIb(&Hb!Nh>Q>M!1@}vOc zixofA>yB`iSE#5Q-L{DPZLdc6=-9ieMaKFWV94Gh>6shgg}Vz+w_j`xZb495{fmo> zg&@#-C2Gm4Z#(`HRYsr>kE*R2$zvc#j>l6gd(fuLgHY}zHAKsWi=co=&AVg=M}b(J zVrH{NvJbod7VFCP2QmF7UOLfD&;u)N?ql7o5#Gxi5FJzjJ@h*i#?a+`3v&>Y6(l$j$^uKdgQB>*7Ss^1J4< zdM)k1HD!adSq}u;X z7l-?m8dwA;6APR&WPRptk``g7vqM*I+E~mdACx)qvr244uVhlYNXeFa=T-? z!gw=Rk}_*fAtM&7o(TDUUk%eXQ>>a}p|6?G**3%BE-F~_QcNM|ck^=B;Q5hFFY~N3 z;??%$hGVV3ts_mCT;bF;ni%(u$f-D%1*k6w)XSam?7RP(_0z^-hk<#zy1F$n?~@G{ z9(;_`)*kjmZ>?NDXD#EPacz^#Z#}iKOU_hqqFKf7adBm(9Y4C>g*V9>iAap5gPKL; zU>Gzm>6N9uAE4NaY{~gkIB#bcI(|)rY(k$0aaXi#BlGdm%Q;tCsOz8Zn0yKMKjf5) zj=t9!;M|w;6K6KQ=pVHn(5zIssaFIln2LU{HvmuGnrL=+KK=%=U^tqL-Cy^KKMcDtj3 zo}=L9!kMnvRT~#|7A{LHJjz3i6*pW@da|E{sk5F}F1D8l%r2J(2C`g!JgD?xoRDYe=?)Ox)? zP#I)nV+@cOJVEkwf*21O-iqCq?RmEW??_vI3On2{7&qeYnvsh0{;DbQa;PHe%~RTf zhABxnLojWrJ9`YIRq`oK!LPQLf#35Nw_2yEic)lMOYp-(*g6kTG6CCXUT0guWnrz` z{tdxFbwS&So`>s_m`<~x2d(R@UdbzwLHjuTc=HcDtE%Pgj&I8~6^_?;vBRo`O};*K0Q;h#1X7 ztp(rsH7DFm!aj?sptlQ~<$8Bg%J&T~c^Td#2aebv-$1Wn>`xjy&d$>8-aT%J+&>eH!b&Wp5Xa1M-<7gE{RR~-$&f?DMZ4RwEvhYJVW9& z4i~f?HZ{%$d{?%bqNc>CHf}AxGW%Kx7A`eL;L~S1;1L1A!aVrc%3)GK3Ng z|Acs6#94QvC7#~ctMHm>D)W;v&Y@XARe%J}$(-j&6ow$}gh_ z&qg;#o5mMnH0XHK-~L&5(x15~Ye~2UnI22aK3izaOZ0)3Rc+m;-1B)nHun*t7xNSx zzMwS87HeUArL07eZ)q`P$S=%mX!$5gh*8lf(Rfl~iSQ&%KPDI#cp`H!!*~^ydEC5n z4V~o2*MF!R<^O8Hx_iyu4XcUnNm;e|>12Q!E?+hBY}+#oIx`c{#*HVkVA$Sm;|*;&kV@( z%<LVT0XU20}Q`+McNYyzKILnALhyIu3hpiQTzO9YT49@zsEv1m4yNz;78EP`tb zrPiDKvYlKDScd>Mh@ZY|%TChGxYzv|as@^G9+$a5A@Ae)w3q3E_g^UN{~*gy3=Zn9 zzi=sJ+wXv*!PWT5$wbbGy}$f>t_|#2YkwxBBu3#7nv;{$s|0$|WfrqE=%43`^>}b< z)Zcm5TStWzh8^LN?R|d4GU|z}C8W5tgoFgb?b9y-VbIc6)70XAqm#Gy>aO(O;+v7) z`H)x`uu$$m6lR5*V&mIcpdc}sZLehQ6?RbLFb|BahOWOlLFJCHGDjsgmfBWbS2Jtx z8*c0(Sg%`=lX6ALz_*0Lwtr5QCmwylUFCq}^xbj6%^RJnHfG&B7-+tXj$`!e@7##X z&Ki7o72Dcnx~Gxx$Q^oWluq;x|7(%H^uwPs_OrqBS2CJ?;>Ins28DyFPh7Wg@0o)0 ze`4M8M=yC&l8|yqmN%$bP7&?>mOgXm6}a;e=!!hdcf-QosD*%_=wwcf{ZIPPFuG%1 zA*0gN@1n#fM`ns6A3m-e^2=5 zXZ9JHL$;~vdkA2M34YzE3e$2E_RA8Xz~rDX9l~Ok$AT7PVVMpgz1KBIRXjns)zoB> zw>!qcjr*PA8YZ3YI$}^o*wrPq;kX5qG{&hc!qg1U>{g_Z$#$>K-%Oex7F5yr#&Na; zscJ8D>Ox~y7U39BjQl*l*J)9sMPZh+veh#|dDQ;sBg_i~pVh4!DD$Q`+4O61qytP@ zA@o4d=O}wR>)rUtgsI_7{J=u|fO)xISrpYvo1^Q7J~6dprUmQuFTLLi0lyz^X9N!v zW_)}@;+|}&o*-^~bj;hoNQRk4=ondgueJM5a(AW|`#crt1tq&tjk*ST%NJoNp3cxq zLIHvzx9+E2;R50Ku0i>wLz(1dO9PG!;t6AGrup|i*YL3E3|O^Asbmw&kZ z1otwft5C!$h&HuZR5Vu+RHZi)$9cx;>I)6ZDES6UCgvQszl_h9d^bn`3XBU7p~iHr zu-7AJW}3J?bnUO_gh(h{?>@!nxylZ|Iz~{8czM#m6QRE^Ul|-oG2MK4(w^H z9GYDT=ANV#`nqVe=jP0SE;dKCkw_ml*_ykkOSd|T%1ToM<+#p3yX_zzoblc8q}yOE zzQQyjROQ`}^v*$?mC{5HfC=r$Frcs$b^U94E#|tF=26coAEi5VfzNkDQ$pARNZb+yvcz*o^%nw zLRAl{n2?Ds!YB-$l_om-CevrbD50lJMIH9ZPmJoC9z_LVo2yt1k6+4H3)p)BS3L#E zheyG|SSl(iZrH6`w@lXjKaxgV+v@uIHP+AHf6h%--`JQxtUar_S$=MQo)u`GmNXH3JKiB<;d}>ChOM0W&r;$(zdJ+xvt(UrW z`H7U+Z8DPByC0QVdM){URyXSb8aSDVu!s~#nv7SHMg@7B8SzIZH3N(8c5+~)Tz(=} zrleQADy17MvRTmT?NOU%a$RED&9D5b72;^m3&LuMnJRG+@XPyfI64h3M4sI%^E}db zO~kN}SvRbbc#CN`-)UFy8}3@$>f&%t#^6iz=3EW}kR{H{I+eAi<@$kIjaG7hp6|RD zOpy)jCycQasX9drYX|39({!|{q9TUXMgIW{?YGjsxiNit)fz;JlnGnJifPHs9e%c? zN9uzGmtwuR02IG!(NF7P#mlU-2UpXhG5x{lX-F6^V2krnCV(blpa5qR@5% zLG_a7cmMBPK%pOEl81ZDGb{9_D|1Vp3~(CmBb;o1eSIH8J`e!X+Y5iw{>KF+@&tQY7W5Rc0c4M2%s(b;C6$6_IOc-;!mfT@sQ&km|SXG3h18(z( zcsx*3Q?vKK4C>w4+benZP6;I?A%ViTUKM`#`ZoFx8k!;u#t4vr(9lp1S+?$;9z7Qq z7u>G=(SOtQ{{khyoSH#6{z9bd%6qhh_Sp_Z+(;ZKz1=zC&TbvdmI&aioSL3rZH{?2 z-V)XLtH<}P3kBd$LVBx2@378?D2P35BmG~bMEnCOEJ;$xqOspVQM+1PnE$}BuGOi-Z=Irgi<*Y#l%t{Bv)@-Q0Xjr(Ukb-u*jD-c`h~e|q7#$2kPXXzw6lACc1J zZ60G}%N9waTBwQ#o4cLs%jJ&f0Q_)JGlVLkvDCXAZ0pmrQ1fMk$0e*6ki%S) z*6xWNK?9|zQ)Mc{rdd?3n{k0u=||)DP~Ab(E?c8hs}hzq7reIj5M4drqeB_XIm(kV z&p76qXMp%!-_=Eky6T&82^+~@du&^xB8op!XQGwrUSZcdEh_tqUhET_$E!WAic6nU z$vIhythl@h66|&vk)SE&`>d9`nz!STys)BQExG=eRHDwM&lKIU&YR=Lv2Qdp6dRHs9zcpc}D7f;&AV z{{KH_juR+BHhfy?Z`W>c(Ikmky413hkbZc(^o(MQj7RuCc#wZujB_0roU8AeUr&9n z?_!pcdY|D8Vl79Q#a4&Y6s$v*TH`DL0BloBFHN`C6+@1HUF7^EbbLkiCh%Y{HV9`S z&&JRV-IbIaemXl^Wpg-;Y0XnSCB~R6#Q>#3W}Rf{&LI&M3E(|Rn$9GH62q<~FUK#@ z>?V|eK~hQ$t;OmUf1ge8)XN)cuw06Wb)PHqeJY%rUtKj9Uu?IGlA8=_tWQ>m`4V4u z`5ZY$4p^{3k){@`U$a=h04Gg(-DuLWs@ulAY0l)EwMa~-p!(CnO(bD9z~Z5_{DyiQ#pW1yZn0rxAJnya^?GjI$S@hmrlX&B(*S2G9^ zc$2&0%#3=q8QQyRgaVr{(M#n`>)j5D=iRW3bJ0d0%6}$GJgh3vb{s2t6CJA)pB*3m z`eq!7bb@hDhBx?fc%cb_HzDtkJF##BdfzzLSuS{$fYFYD?7rm)+gd=dC&*JAY}*h?jlrzA%*?Q4+tZj|L(soc9~ujtton5iS_4P-cV z!gvQ{c`+HB(d=?bb-!ZI&DBsHMwN%SX%MNGCa5vwQAMd+WlpnMIBFMEQ8FOT~PoY0%B5Y<7fB#!;%Mh>`^%%udU&A(K)Nj<*;21(87dJMH?%jLF z4S({4yChJ|_=Eq~gC`CS(3X}Kfa3&(g%jGRbu270Jv=?*>lel-{vW6Nca;6j51Ysm z$UtsOVE3P&oasp5l>rAHIcvaA==hUP{w*iqZT>s61kDj`K*)^IpME!&9P4FASPtiY zRo%19&woRpw0jMJ&yL6O+G~FLaDLpwk|aS)et)cJLy4(A;mX5VrHphF79LR!V1)1# zbTKHST^X&Fd`@4+dspNn1cuIt-2H}gOMj4R@@OiNb1 z-}PUg`ZA60i%>Z(hBlf*m&Zj0Qll5Ep(>{lFHbp>Qp@N~(e`^%JW_9O0)S8PrhW46 z9*>Cs7uv}z8*utHQ3H`>Ig}$(C%b#JmIsgQ#|y%X)Fs;aA1c={nM#UgeY|i!8KrwW zy2!F+h zBymH>t~$O5<2lU!RY^IVR1!mQ_g)#Y?vLxkLZpma0~!XAfVH;Cr{L(N102)8oTdPT{SAcYT%rvWS0>FlJlIx~ zs&Dr_YRRL=uBNCIt`)tGQUb<9EQ*{)f3km$Fw0doXf>G&EKkPdDZP*o zev$<-^IgA)9wy@7M4#%4lC(CTii;hpGZH}!=`v+7G5Yf+chMiF3^N{imPa#B%YROH zLjw)x)BK8`O>B^HaH0?CAxDH8EH!?9Dh@yu~7W`T|hH znu4|ps2XBBqoptZu{K(rgZ zpyXxz;*3%LcgtisBix)4Va^vFSN_ShV?vYQu zFy$N7U?JyCf2o%LZw($Wc>M*o)^J)Ym!D}rJvsj4^dCbc6-WO36h6j5inBV{oO?h3 zG$1mC!&h8Ur;YT#qtMs~<{pIZA;#3DO=`r8hX3o3VeG1-Zb~0-+WDib97a>>VK`#k zB;jc0Nei$--{Gu4bg1%bg}MlF$K2zpPq7DAHk3OX8n*3*b6bpGur9hw{}AAtP3M{8 zPPX$ik{WvHPi;3&N3zC8m%rX-*ZL!+n0bdCmh=aYqeFST9xC0t5nHbfOS2vZ$j|Ox z8JM1|!}7M~QEW7OfAWL-Pl{FM;lpfWylG_vj`UX!Zez}AwebEaw7UKHp97o`CLky;TXC4acgtcHvnUm+Xx2q}?XH?cMMw8<7P<)-*E+q^e86HX=@3Aw=v4 rugBK6iC7qco(lwG2%!6)qo{*3^kt>Ae7+t%5OBd%wN%RQTRs0j2&b!w literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/windefatp-utc-console-autostart.png b/windows/keep-secure/images/windefatp-utc-console-autostart.png new file mode 100644 index 0000000000000000000000000000000000000000..fc9c01ff7960ab7e44c310bebb9c80080e34bad3 GIT binary patch literal 22317 zcmb5WbyyrvyDd6caCc{rkl^m_1cD|=aCdhnxO>%*^xDRQFU@SFiV7>s>XW3UZRj2m}Zq5C~aXN=yj^f=C2jQ*dv97JO5bGvEW> zR!ZFg1VZV4eL;MqMIi(lVI8GEio>qKAi{#*u6?U4Z?&6QvmG*{Qq!WZ z_8U}q;2ZeYZ$P)dr6DIfDJwnnhuDDErNFYP2ShB?N$=)z{0lE)mUpe$n2?d)Ts(csesghpf8%{JTd`WPdg9bh&F63< z2Ni%OA|d;kv`y^Qe{^S4jj;pK#T|uu++_adDN-;_&nUP+Az=#zbE)I+h%yZ zr-spZ7*2oaHh1rNHaQn?)kgjs$yrdd%SelM@irfJOUvpGB~@Ul)7mYBWBJZZ6W4=y zhT!F*x@@h!TB6fwjzUt$H#hh~TFVm5a6)bP7UZ9?@8QVi?y>GmA zcB(%B57A1R z{GTh;z&e!zdAUEeGAH2um;I#E_-JplMxzLL6B&3SSSD{P3I;EpBjd?u0u0j3uK7`- z-k#V@4SBD1a|2$%$Yo9++_F(V1YI4Xu<{Q{XU8vZb}Tm-K_Jz~3RyT;YDpC*zuivlby8A#N-=TWySt#AsHZ$>tNK zKqKuZdF5V3OOLrll|NjP9jS#bf7T69cC0}Lg0o&uJsm;P}gfumaA`qy18@g`orzLdZ!CoN(;2az@^s0R@iW64iKgFFX0o~og+PP zov9<-*jXMU`J_4AiK-S{9`_n^Z=p;ic@(ccxy+gF6iPZiBCK52*Qb+n{Avqlp?=4C zRG~N8)%-jA!~(+T=keM)<=2l%+%Keghg?@z@qyO7>`OZvKRv$2leW$fAbXj0RBwz; zYn*UdvW7$$rFruOFF#atrS|J7ukm#;k=%#messgn(n5;&UR?Tq<+I|z%;)!ZAJ&Nh zos`r1&sASWXT8VE!qdCM5%~?4d64$B9eRU7>Y>!?#nir>AJs+m)2!PBFzy9v{_`^) zhGQ;Y;>7aQ>m8zOFg3lVrx&iXr)T+-)Sr4U*wgC`NiE#|9tyKs62ZWaFWW!YSYY+v zG@rb#-I|V8p8%_)J^~lL#R~QFvbmFa2`R5GyxnBb!%fUqb$t9#Md#uXQ`ZPv{n07! zg5-(R4%6nX_Epq|X1Pdj52+_^Gu=2{QMtQA#Yf44)<&+HtCeufsJ&HAnFj1>jk_~;AAz!l#h`snb?D}*+I(zsG^W04glaEKJNDdG{cK(l zolbO=bH<+b9AmUGDgVbZFEnm5yAdTwJWU%Z#C-qB8RZMg%U!m17AdE}jd4B7nk< zMb46|uX=@{gVkiDls6q#FL%lT@6r>0afe8~ob0hC5~!$O!0deS&2HB zg+6?+6r0=vYy5lFBsLqa`<4xPm0<_d;JYMZy@uZ3MPc@pWh zHPWao>Lq&evnBWzw#T@cnB~Tk1I%?Hm(^hE%ofz<*)OOf`ji5FaWoCQ9{8Y38k)#A zVR2iQdE^9<2tNow>c2Dx9Xw6F`}+I2f5e8FcB??3mY>R?OL|Q<=$G7BUuz_OO;sqG>fbI%m1{uO6u6cHKy=d_F~iPsWUE z9|Uh6!At8djmuTM^Yr9;K0e1}a)$Z{TKq0(oZQ6AAE}vcHofK|<6YNQB&$x`B)N`P zU~Ms|&pL=7AevEjqCgKP9Z=Lz`z;Rwzn3qFNW40yPB$^5*PA@HZC8)U?m!t9f4)~} zT)P#SJMBs;dhL?@UdEkmy_;^_PQ!V@d0srJKLbr`)?BW zkdnwI>rL;VLcqSD#iKz`#t;7>lF{=f5Pu&%!WJCX!XJjl+CLbs<~*Fqb>SY8=0l)- zy(?~kY|?Fi4$l`RdYgwmwBWTPurx7YHxW+~qVsM)FDmirDG`n(XFbJ(%W+7wh@@`+ zbjg9sHGV_xp-J+rThWI2T7>(C@>o1 z=73J+gW&L?Mp@h4?(;rs;IfPUDn0$~3b140vy(kOAzR>) z;pVMw>s|@c+}UFS3Z>V}0iLL30CRGc)S-`{dj;v(ttc$F`J`LG<5K^ivd*-idEXYR zr_5yy0(xrx$7K40um1xoYwibbR=S#v%wO6`3FCI~AOS7ndqEhSi zX?25AGuYBQy+#}l8W^r=xLmqDqk9GeL`MZfADp4Od?E&r(mzGhC}i;I%i-`k&LQen z&=NQ9^m8jW`0_xhyxSwItT-Ze-Vo5aLtU$s$!zUkf~qZVa&VFta2pxtmmCqEUlfhj z_`=oVM0@SAkNNS$d3br}F;Sz`t*+?GrT?tvVH$O9oXM^EYY8fUSgQ3xm_Nvx`;sqX zlfuyO_uue!mSOYQf71s5x9n2&T@{0)Yi&r`G}6fXF2c~#mmd7+oW{B^+32RPa|dp( z_{(^Dg?#$%fnf`8xvAL5|I>C{aK1EVsPugZjJ|~aoq~r7E zQ>UPJb*mAz%)71T=&K+f9+xNL);KEc{A-t1$rPINP8vxwe=<3}pW}YpcvZJEWil=h zA{FRSLnLmS{+n;oNnO2n;1Xg&4MMV+&;x%4S&E-KHu8L^89`IW`KDgtV8#}!#xiNq z^oHhh&CqxWHk}tq{5S8@GwTI_!9rqu zhsf3T#Z$on8!j_%7Ip%Vq_U%wDq&X-tyPgTVVd<$-K9neJyHVZGqP`*c<;WEl0$k_ z^B0H&ZpoWcRmHDhqi$A_+#XQ)1;P>73`Fh{;0 zh}~3eVBnSLHuIOVFT0?CFvSAHo6&7=D`rW84axDBH+qZlHwoyIIm@C3bh~`@TzKTV zk*bTbeyAvZEo4RQk#x>8XeQ+dalC2!!4e$M=2ws=)R$LMtbym>Kb&oBs_@-RfJ&-A zfQ79uCn@e&QhC~lZV+Bd|BbpE`cOGu`zl{Rh%C;#f^Z>@4U{Cc3(jDzvq#DgAvC-p zX0r1zW@RHGR1y7G_}D707Au7M=fxUH#IWEn&4Wi%&?YqH0fhf&K`JRYe3_tawQdn& z_B>w9X0t36MxlTZk=8ePN2k)j%Jd--`E3Xmm8iF9T#wa5kQ9z!Ximl2PIx#p8`JuI|P&ffGPLZd- zmw6*^JU1lU1T(lD-Y6?8Q>cWN;+vCno+GV(1_#_$S6BNTEj9#i-@U>_90MWY4aF~! zpL^a?erO_ZbX^&x;+%vKjJkx}%BINzWU+|;dx7ge9?JirDmHjZ6z(we<)G#VG1L`C zoOI^XL1t}o zbqxp8F=~|zY8*f2#$=?WzLj>3Y`@X4m|-sOb2uV+_S(`D!cHYyWp>xv`-o4e=-OG_mo@E*#i;lYi%#qYdZ4lJYAgV@{&3QGW#Pj7pD1vU<{I8F5o~S&4 zKwLXG%@hl9ctSAhjz>$D8xx}w)cq*nYxs&n*7m3gOW?skkMo+vb1Y?TJ)w`aLeHqj z{FHH^DZ$HVuI;;4EZT-O!Qqj(NMFHg4`Bg$sJ{$VVUs;04=|{h^VL zrsf)rFR)tg#G_p$8F$`sxGxIA`BWbDM`4r_3-VMNxKUkK`zsyo*gi~%ULTJmt9cW| z{?4qk$cS|F$Gfy7;9@PT$xsuJrwYQ8>5HwjhVY?lhvBx&5jL;g;0FnHUl@27(~C0G zd@TlrZ9PzVUP`!C^=73RJuW?-KF6xt*9%5Jd0e4Va!9oJ=LM-45U|EQwFd;Wgw$5T zsgEmgBKT@|`Ykmf;604F^_g3%~Ro0p> z$}{;ul~-f@s}Mqe(FzRz&KW`IGovouLW#CG3_@b*eOL*`@xcW^GN<90Q%3LG&I=|k_gdJ;p0%d2vnf)cV zeB&4mS&C((Cf+M5A#J>WaFXlNbo+CfVYSdW_7|p&GdFr59CBH{-?Zt2gPvA)9O4}M zn3H$qQ>tACJ*U|{!S$vuTE}c2LlII-J^AA0IBF_v4P_Ih~esmY2Z zGLJWVyTdl~>H$7l;zIk?;X^rI^)3fyBXB!3r?+GG*A~$v_Ttz>$R$r^@T1KBm#Btl z0Vc;QW-U8}g6B_Xzf)L~zkeqvlK`?Cb=?8R?dAA!r(Hv+>L2yeGbGojB}PU@FpCW~ zsKXZ<(OQDSGCzyl;6w;M8bw70p{)l!bxGm3qXXrLm@31K$k*yb1kC>sum4st{yUKW zhHmpwcHP*_%&hD)SwIALO-&62eRPx&B%V_)@H>eux^JI*@E0H&6QChKdp|J1D`6r$xRMhK7-PBz;h_E4cXezy6@mWsO z;uVE~*!3*Um55%r3 z(;4p)tKPA}FiaBY@b&T}$e zghxJ)Ixj6c55$EjRnInE*9ulV5qG(=pV*{Eb^`%Z-ZQ0Yi# z`91Yd#t-=Gsjtw?r>*>5YLR-jp~d@ZOz}g(*YB**oQS_^V~k+Fw1Suq)q<@h=sA7I zKM^s=rGjxkLWBip2hEp`i|G&e>LrY0rYeCK((KbXA{ELD zgsd}@vRWXnPpWH{L+=O9YQj_H=4kfsbcUPur=xP`QT~-ozNsCeVUZcR-l=+7uQo!& z9t!9Fjq7*Zzh0bWQqi5u2*@wJW{1u1bOtk~~?VlOQiKXr4%DsY>M^COHE4-lRdnClQ?N|0_p}4N_E)(wWycC+Ol~}py7)lh9QWZQ;O4s{%mGBE=hfH_W zy5Gxkei`!>FlZF8({0DA;r!UI0Y`le4I2?IO@8 z?|>_eV#Lvd%b+gJVIud6pVOUUNOCmV)U7e7%3chv%&Ew%8THM7eoa&^m|;1{1|r6S z;g3?`*iAx)&*vt1ifo zlLJ9F%MCJ5;W|9Gf)`*N+qqrad1f%`WzE_Ebkl3t{YFpT$xf@5$ecM-qC&LFx;2g= z$#4Wj%>8$H1x(BDL@>@3x}u!+g8t&SsQxeJm#P@1129fy9!Ol;mrSb2FsZcpYK7w< z$0DjHK|QTJI}K84i=ZGJBQ99Ocd6TNt$=3i_w}MIaFfKD3)y1p4^p%b_0o2C zXyTr=u82?5V2G)C7BiEujO~5Xh9lSr^m)J8A^1apUS(;!<0bCZ(NIk4h_B;VqKVj| z4pcJ{MD`LNm67n7*6#a*a?FCrQ(uO{aLD`Ot$l8`r?Euqhr;7H>AY-ZkiG?zxSIkn zYsa*G6mi+PzZgWhyvVugFv{QN<*eYYnZ{*DKBhC5`5HMQoVzEY^q~BEY+ z7KEy{vYfCzpZk7ym~tV+fuj5ciT=;nAj(>WNemSU*0$_H7W9960a6p_nw+)0sPaSr za>-)+RzCyK9)kS;Ga6%tZCUH`N%y#qrD|v!HhmOtq~<$rjJD&-VFWW_r50+slkwy< z12B2*k3&_vRsS2$>Fx?rGadEh{mIeq7n55(YCecR>wuRx`(>Zkbbe(Pr+0kCqTi5S zWT59(WmKXv`wDGf>C1tz>`e7=kK(mNqw#$JMIyXzB@E^hj(I`DiyBPr1!2WDJcu>Yw&RY&?^Pf{`yhVxH*vZ*|= zN8L9mr_(keBBLtV%ts|(?Q#}>Z8_((UmbxA4^y-1^~)Td3%WW-Stm*5)R;W~`f21T zd*n~0>>97n=TeKoe3&=xJI9F={SduyTn5Ms0miDJM9g|MeFURncfFZ+6xcZy4RQjA z=x@gBFNjp`XA}>;i#e;8I~@;OL-KrxTNu$`=@aoUJF7Otx3%jLJ-M4iZ8i2Jbr^+@ zT1g2}&nK=7UjueBA{2s@3TqLeQC_L|+bF4*QNX;PuJt*|qsN8{T0 zl2!Ri?3=9{y9QC!@>opo93{P(yMr$_>aT^F1&b<6-YmUUzKsBD5{NYM(eeEKu=cG8XjW3p+E?o)(#)|nq0X4 z67$HGuIpQ&)w)#cU@^b5x>swdJP4fS(yqOVN8j-a>vG3$)FD{qy4am zhQUq`|M6x!RJc#!UhQ)H24*vc2YOz>wCZ7BM(Fv3qk_k*=->g^fTG>;BQRm5 z#=pdv;{%cK=ga?m$V9{nB3^VjYp?7<#9iE54%b5Ysiu#m1?6Z@FSa{SGj`dOO03W~ z27~G`N58AK$|AbI*8I*`!95^Qnqs;b7i^W!=+z2ccjIkIG`n8f3jd|YRa1pCqZF5t zlMM68k5ZjC=+=H;LCxm=I`jrcdhzQmeacCLHl9ulB_Pbf@1VqOKugjc5JjoMrFcFj zI-WVa6)qwCTYAc))~04*klBWMtq8?94K*H( zm(~=JctBGvoMNvU*K7K=+1ORF?cZrCaHo~sz~`B3UCsx{crv)r5iR?fvtr^agewZf1AONs#LWj*q+^|b3`35ye?m`vLlc<^`NNY4(A;J42W-P61T-K!RdFpPCNCkc z$rDP%Hg#e}B>*_KU#BTKLiuAsZc2H|9eaML<7_|_AO`>nP-2R>Q9X3AWfq54x23ez z(7VFNi~WD)Z)HBnfP8mO97M&mQ>^ULTE@eU^YxBw+20Yu7i&-gzxZ|ps6Uo|A0Mv5 zbHWm%U3P=|(rfyFj5V0lYkMZgfUqbRp0WI#`dZklpg(|J7ti15$ zb}Vj{B`ORsks>5NC?br5x-ZvSGVFhIM^Sz_ItVq$kE#v4{ZzCg;@wnkJ05913|IrIJs6ZU9{o#5pT3o!%LfwrxKaaQK zeczoDuxJfuA!7hFdzL)XyZvU4LSmTL+huTHnKASHw_`g`@D?e*dB=KYxj5SejmSYY z!OVd()WK&P5q)FRC~-zA@aO8Nx=wSUg+=uOrlc~i6+>7MdP-@;c9@sjevt}D-8v_} z*6*!-@|hQH<=1t~{+^>R?Xp1blO6v(I7Y(c4vRiK%#b(9`)XgiGe2cS^s3B3?Kz}- zy13XaFSS0>+&AA}`vZC8mqqIjtdT7QpOTn$Tb<4iKI({w;C(kJRsr>V8J?pA6r$vC zJ{~m03ttl`COdP2$Pd#WCdWi@F4VL1D_V-`#`=eE+pQRA6$--9d3hba89IE^BhC+e zi#2?P)2t@c$`P4ERm#|UiOse}$C4wOcoo#5liqb6o$v`isI`-gl9I0PJI_{sw0!nSnFh=Piz1o0s_`;_;uemcq+G5~k?a8cE zF{xEvcEV2cp*cE3nB!}ddH&bE_u~x=*2|a2X!!>|nNL=9o;Mrtb1sF2{F?iHRgChC zrS5J+(Ty(hF+v%a5%U{lS~02f(S&O&xWZc{{m zDXnI^Eu}%KS^9d3p;%G|BcS20kc6h}=2Jo!hwOd1DUxO!&e>fm==h8~ox7-4qz`e?B;jFL2t0(F+lpwS z*9~XO(bT4^#5O6~9*wopdO8`}Mg53~Ql>!$m$*SLCmEpTUFNw&Q5hD<-pyjB6Riq3 z2QppfnQby55lHM$PRR7D&8E@a_VoH8y>ZmP>IQ8IJ*1!hj$H%S*=m9HW<#)j>YEOo zu7F9Ibt!`ZGp9e+Uw#GyF<@T6Ylu@D9R8*Q-#Xr3@|%A43O_7N-;(+=@%G_Vk50o> z+EI(_;(LeUaxX{ChsE2YKFr1wIaCj^s*i#X=dJ{w9{|c4R@bCO5Z-k6tAPWqIvmg6 zs%aS#A41fDPW`e0|Jx0UcG~ye^>e-21u%Pwaz%L-K3n^G=i#9-YC~tuyvEybe8Y6i zGmebAw69n8LF177LjN zudYT=Xa76b?c?;`CWjqQL29`)CKdmJ{x`nY)T%W;#rWKt5npD}M;wP04DqUS+`N;J zRpScqs!Q>{-!v=3?wp`_E%D5YZxXe84DL%Zb}^ZAo2YwVIn8p@`Oxn$Oqyx1wi<70 z_RYTl9!f*n=;bu`IisIW4lmnf;S>298fK!$)$z*m2cE8@xvHwX?G*BC9?e1)c* zZ!TOK(z34CI&vF|m2a5K4@45n3_3@23e%luYvdO(suASUxX^bQ4@X&DPS_erhkp7J zx}%HCkN_0n{l5h;xj?jP1~vb(P-&gKL8gfFFBX88H};u22HZCCkfh(0%dh?F6ZlFy z19)ZL`r`VyT4t?E^q`6Aks~-E&xdX9#)xAjV)a);mTCLKk$tWgF>-FS{AEuR`4&UQ z_&ci)nX`A7Zvk7Z^T*xBA^P9%V{nt`gR}JAn1k<{#C(y6^VLnH7y)a~(UQ`;=#6)W z31PV>&t!3EcG%BEqZuMMA%CV+?bbvyJ8%&kZpY8K4;`ZD7*+#P8DC#7(EB4Tq%4!D zkE`-)qYJCU=!#FQ*UZ~Hi1Mugf)0bu-(H~G)&_aaq0pzU7081;D)F- zH`)tQwZrkvdZuP~)hxsM_=AsMr%47=4ap09IgM6#l?f`;%?pICPlJTm0OR*QB9CF& zS#0cvpN5Mq0fG->NT<}!&qix5T)1LVpE%kb5D_v}PY>gL{@63f3!dR+c%3sU+_v}) zpDa}e5k#F2KTILn?-`j&abfUcK02Wn#HU0S^KnDG|CCNNF+^iL7QmwVrV@jkB6xu- zO4id2epKLj^{oHwqieU^LhgEDJNln7WtymUCIO%3yA$koJI-<+O;$;KkK^95W>DI> zrw!@DXQD_xMU^-sRwD78za3HE3RC;afX z^e480!`RT7{Rp*3w7=Cke|c}opW039SJTk*%4apKe_wexV240OnGrPT|cyR{Y z75a7`dd6KCT_jK|*w5P6N6!w2y67(9J^#!I_N|!kQY0P(s}q5{+3oSE3n7ult3m>K z%%xo3ZchpUYw{gXlUEF&+{`8q zz+;1hD}nO^Dv&xI{#A@(m}C^cnGIJoT-+c2nG^wSh-$$m(z%Dj>GE1y?+xp<8C<*R zCqdyq=O2yNGhX0lHU>UzGq%s{I;)2rdCYx=gVFL8LlgLbQ2uqkA9p>E+jW;HWDb+A6g>-LEa{?*g= zc0Pw~q=JG1iP8y>nggp$YX(t`;sx47cnmi3mEW9l5E)#XK2n!jKr%NsFJeU%RC-ExEb@7XZ5FD6cSM4omW31W3ggn4fEx?~Ks+Mo$pK^AhwAir6 zb){wV*R(GeJpmnYG&I^${D{L^LdC0#~Jk@ zu8M|^K%iIM-JsV6pTl9Y{yNBZqqDMpU2a&|EC@JIN^B%kFghHUaeYVdh5PwR=f$ar zHf*d)mH@zsJ^VZ}FocCD%PM{PMZZUVsB^G=DO!Zd;*O!Tc=6M6!dz=>tqG#J>K)B_ zYp3|g@a&_lbtYP)6&s{u%|wfaa?+))x^U`vlOsW=%2I)@>_^^uD>6eNxlDn`_J`*7 zuAXq*Gsc&5Mp63kD5K7?5^UMg(d$2^1_Ug1hmq7<)rPLl%*L(GOu<0++b{MM z!O(AVwv;vI2SjWSszr|W^N3BdwOlV)-1hlANGTdJQr)5Etc+jp9rJyRFK4*$U7qt!f><`3NpQ z))$~G_16=XKr!jxucSVdtU`t(9_r3ow?*%FUw;pj zL9jHWZmsqX7s}_|7Y0#s@2pM^Wjd}Wv^0dFv=;eNA3nPTcPg>=)AM8mm}7zKs9UIN zw~>>71X>Xi=cHbxdRXj}scScPxFj&Al{J37R`%YgQ+yB3mhDA}BgFf&7LM7J2T;}Z z(@(^)o{K^NH5f_`-H2V&%h?9gjdtK=fcxJFaov))JqrG4To0qQJ*t}pKFT|`hf~jH z8rtd@xfNYvHbVjOC+ZS!x4URS7J5C?O zj!4kqN%L>?@rLN{eM>E-1t&k@T_-3Ow{LDV`ZVs&yhmWrS+0Z1= z5?sq8q^-}0XZzON$Bq)v=}ke`-6YW|1W4x&rSjm(I74t5=J9&mbSp8v`e-~%vVK@K z3RF4Bl?Zi8Y>_7lmx9*_x5Xm~th;MXcDL6Uu)c9Sq!|zg!~~w8_#4cQsw}HHcrdiD zt!?d=-Ct8Zunq4mJm3W(Yi#Hbj8X!s^>o6hd`!LPl8Pu`!_sVn6gESAdx!kVri0I) zax6>b0Lc)jF54N#rk7`#d*GD8Y}&Uy)B?&D(`zVTVVx{e%MjPHCg+VeeJR+6ffLz@ zR~<*u`*!}kmp(4PbkNA8#A^$63}GCK1qR{bMB(O70bHRZXPJMC zgY&(An5#7~tmTui%0UF%n^ccb8Q?@1z?CQfWld9Ag8~aImdN)WaJhAzk_78m1%&jb zr$ej3L?Zn``ldE3jP&%#GHiBd7S99v5KdjG$(?D{AZaun>1qt}#dw`WFa@(O&{x7Q zT%p_n2$!8)-Qw@y!N1^Oo8YJbCD;k+uOR%tHYmggTr9_Nt%RU{`Bc5y^R|hL3QUN= zlPE2!k~MGBO-O)&2r*Ox+@hE@2_4MHkj^;2e|xXWu7JIf&|LZ{j)zG^#1uHK36{Zw zaa0yngB{{j8eD0$lNY;TrA?hSfE1hQ$Z!W-fnSu-dTdNgs+w85K*hSP9Ra(=dmJoO zQSrI;gz%1*l=Al<^IB6whIx{l2Xa_6{7_zbO@W1qd!z?7W_2uZ4_(=62_}=xD{Se& zU`BF!xPM9-zEa`Jub!Wtt&t+}e_0s0qbxotd@d>Ks4B`&So@+MU`Yn7CSos`kKA8J z2JZj@<3P#08drL%LK^ompc7V}uK_%m5Lg7Ey$I67xI8jD2UL`0O)&s# z2h1rsP+!A8@Ze-m0Vd6~p;JJI*b=8Jk(+lb0*bL%c4|&UoZVkAM0ybgusO`w0Hcfk z!>Z=65I0P1CMyo28c<@Rgb)W+=VUX4jX~jl(-ixnW?5)!`Mg;BDlZFwMeZjC%4AVynuj67l4?!kCr$8OpiZ$`#j zaq}ET6v(W)Pet_Z5x(2wI5-QfxcI~fpx?!1l6L;WoqgS2V#dnXM{XPw7%;E&=E`sP zc^I3Vb>kc+AtudAk04yll50Yo*9T_)3(hwf-C}^%VY`8mY41;xWlm$4KYL;*jSpr| z#gt)0YNIi12 z>a~V11Roh)PfngGyiabPbsm3_K0 zQtOK_3@Gbw9t0(Uz{Gn@`C$QLje2o>&siI-lp;SVCLxhI|9uQ`dW{;8%9kAiE}nUs z?L@3khkWkuvqrS%gR^l4rNDvJ%-sW2qXGQ3Ak>%3i^j!Rhjl9;K7h6Ulnf!iToC|v$Q9xwQ z?^~Ed=P?ebf2HyK)xQwxe=y)Gr^Haw3Zb5*ik*B$CP>7wU4S84#2BJOpWv zgFgh7w~a;jTO}Kp1<;X=-otdb6G(IFbZD60Osn*jCBxdB??J1zFxk zFn4M5f+=tnYf*(6l1Os>u-*QPljDin^H-{O*_9yJaM*2eaV5y5WrO%OU*|smy2wZ^ z;@EEEABx)HSv-P?Ga)l$+AZ>%EL{E5=PW=T;0#$;GUgxjGq~M!&>)~&Dt8o0fxDUzq{4$NZJKSIz`S!) zo%LEt6CzO$iV*7<3hrQ{K6ye5cn{ca_^!q9UsBI~gnn+uMP+n4xgKah2!mGcXByVa zK&LYeYA-h*Q171z9vM+-r9LD%5+sy5o}-I!V0C#3$63loEBy2Vfw0$J{}*72FJLQW z#Pk~)3wp#a#5lu^tnayE5AoI_DY?pE!(2dWlS0Z<;6O_7Frf^v1aayAUvJ0%kHX^r zN6^28x< z`lNc=&!8r^O_p)r7Es}daC=SxTWJx=t~qNNYn!@!&9Liw4MU8}V5AWNQ~3H5#&21% zod1|`wQngMR%-Mcqc;>-gKQ-9x2J}&%Ec0B86S?z&(AEMA1#6)x1XM zyBq{BdG8A^UA;%1T}!>)wv)Uk_-u68bjq5xT8&Tc%L%zyX5e^)XC>-`BX41ButL6U ztc_W2JBB0Gu#8|w!D$=p0eR2vyEOi*X%d>~Y`Cn<2}8qY64 zm9Uu)&lFszTcdv#j}(&kOv~MNvH9$IZTEjQpRV}J|M|w}yFpFn^@80}Jrp|v{~cwA zozIFxcg~8dcKQDNjiVK!wd``33?pz~%!qA5$i1)qs6RdWMG+Ggr#D+7f|CC9P9e`l zAdY!iU5r@s9>Y~7)}Xq5fn9hSFw;bHS-T8a^bsLO)a6M^aDzSXMa^!@G6=p|zmQwE ziY;wd!8__Ka?~05U4OMrvL8tdU z$Tncyx%C8U?&6O6Y$|(^+q~**1ZobtPQwR0*RloElGSFtLSI6&Pcg5zw>oOHFw_ByCmoW;L3D7%hb`70MQ}dsi zHLMJnJUqY3EHHT}9iPg9OZ@@-pDaRGjRR!;qS+vCMzJAgTaq-+ z#L$~xhuXl%FIfK`;2D^<@~rWvjD`I_2$pWYtzfl&EwS=_``^Jp_ih=uJG^L(2#o7W zp%u0$p-p5_61VN8AurWcn>xp{kkgskGopmh;>0&4*n&Lm_4RfCeMe0ERjGri7LiOoqXtUkzp}`PgZN^I+{dkR`Rd3$ud4+imMUK~h zfqY4{*0f=a%u`CKF3L^!hqAIC`T~yXj;JZFnpsy138^I$Ibegc2u@=nI82c~cj|X?|sl>jtKP}xtLA*bek}O!z!hn;=OE$ojxQb%5z{npg0LVoT@3ZzUt| z!o7U#>84ZuSc1{U;~G)dz1T)J*)||JHRajNPdm6gsUa&dNfqk9DtTGY2F62>|B&E3 zWkIxMmb4l3fu}PEQc3fIqd1B}a=Br9rH#(fAN#EKje?1XXDf}p(^Htx$)vG*&llxT zcRRmtwV2|d4}q=9>==*ZP4xGb&mOgj9vdwjVI$WbpPEi^;;PMB$Qp~uA~k!6)~Zcg zM3C?t1*78Sd!K6No$T+zHpYylqE!rK?scMuKQ6mTXGe7dT;(ZBBn5RMW+q(4I9+TX zma!3;fFu_oj6}@tKH`~fHEFUbK)v!iZ!1!$U$oHv+OO8ww>f(<&Qy+VYLxfhhoP|D zQl;I8enG*Ug!s77@3gC|dG@UXAKm2wqDQdmLu#z|bgtFwM?Zl!`!aTqO3rsmKAu)D zV1|)n9XW}$EXi|fk_Ajk8z#Mev#!(*oK9qt6Rkrw{88DtMhY|O5@w8MR`K+#KmFQr z{))V9J~U-mgL?;)imTUBX}dLO>e>?F1}#vqxXRUCOOIJ z^!ao2^eEN`FpcUA*lgv}lf@HWq7$&b{3R%v8sWl9FXg5#nr9*226?geih}?Jr7``h zl88DbeD~o+nOu8GB^ZP>rizf_Il6(pC=_oQoeOnm-KqJaU5R;_L$x7-XNKLtzwV8L zt!hL-1b-pFH27XaQ3dLLXZ9g$4ajL3ynP;-guHsVT9e`acyfcNn?*zvK6ay#Mn^TZMac)9TTiFlp#!@UkJ|7PT@l6b$^#Hf1*|;6rISVJB+Ou;vlXZFj$UYIGd+?ZrqzJt)Wk_qhMy>g5P~&5`Gc z;_fDk!f<&IvmF$AKLK0TTurV*;bG_pc7^FcYxu++v%WLXBYZ1fbk9d7w;vR8bR$Jc zqtSFt1#d^wv_Pt7raBB?=W=zx*n5g9gsh)Te-;5)v`A>|fV)QH^4S4Q&|AbnxgvR+Za+wlZ zI{8PFXeLw}ltZKZelG8+rX7U7m%JatKlTqSOaW$_ zj~|DHgtG5$y*~X}Cx2v4#4YkUyjCtjb8X$_=3}AjvwU)uOjOeEQ>AzJiM^%|2cneo zl;p>8KrffLTVxp&VtcXaF@z50A9HUW>7liNzwmn!7R&B2->ND<7_aV6Dd?+uB`~IP zhA*~Awi6T2*m1os4><;SBme9(1B4`SP@jkZGIJ=0T}=C#vSKYdzND_990oZ~yG20& zq4toEg4}sPLs-!Unxpv_Gw%Ls(x}`fMBI~&4>FUUH}I2u=lEu3p+|t%%FNU)Wd9u6 zVyBMrW<$TwG#V*e6Lj=N57@YnGV-1Ly$tfoY!j}(CQ&R^$^v%Ve%m;W69exHcW@Yt9r+>7`&TRz+o_Iw;fSl4}?TYqz|0=?X5P$>TO^zgy@hEVH|}R zeg7*MHb7dlVi(}9O2dpOj4mxU0tzRokv@p0ngmQ8*s?Hz!FSX)ucX}6&M}H&(S$Rl z`kqu^^pdMUQ1=Y~gYjtp*Y1lQUgy>A$XV!&uc&2+NZ_k>8O%w#-`y|B zlLqKmzI)%SM)wixtg)2Yj?ASW^Q5d6+?nMqQ)iklRiiDPXRa!`W~0Xwfpx+@I71i( z=8|M>Ex-T$LWdh_B`^9Tk2iW!W=;imi0j!)n(}Uh$>y(Iwjf(0f%A~UwHGY1DxaHL zjsJmJiBh{m-;}v88*})(s4VR@Mdm58YgbMIG%LM`P&th(8JY@ zeMitusfdKVxW7XhOVlS>JKt?DbT&50@LlLRo}Z(H3#V*4T?ygv@*~iC6;~mcL`ycK z{z%q(&&Wsz_foWY_{<68S=0o-gDor4t@5a%eJN&6%`9P{dEZ>;y|Tqmje!Tdlh?BL z>Y5`jDVQduqi{{0I<8hgAXu!qIX3%Vqw%Z(HNp_iJcqNb9@~0s+)9B7b@e1pXvGAmLEsO620ifL=`(2%gl7NW827f@WC>09pCfn$05U7Anq82 ze-8ahD)yG(cL(jM%`O=tyvo&mawqjD+a+zs3i>zV{enii$Z5cv?)K;0Pj+RV7DrOFT9P$=c|_Y5TN^1`&b6u6jOuo5V5Cqw0JaUDmP>@)FV1q5L+eFFPpD;?oK=p)zH5Bi7>AUXHIu z$5t4D%WsRzF1z@0dMCVhd+D%ded$GH0}-0K`>lu%*V7%UM|2hy5aBX5 z7LUI^D)QN(^lzA@2Nq~q>~0pR7OP4Tm2VQt(U80~!{wN`^0V>EwS#ZUp(7=e3o%D>tiS@% z#RkuqDA;h97dO;BYhEs$IZSPyKep2@ZDl%!J`ofv$qu`H6>PXSp^GL72$0N)sqfNz z-{vs_ zvlbO@gy!~{p4MtbqTxHU$wj#mUlY=`x%jN&kcjg1Z@n>*t?}T}ln>%19Bk-0k0*4>=-+1XJeoJE>+o zG6#i|1DGIrL0xr+>s~6eQ&Usnb^R}nHalj)*^q*=<&y1(X%lK4mZPhp8S`T*3{EhX zz8T2zC}}IL3iP(+dYs%|nscH0aYV4W5l#q9Ah2P`r-5YJr>pkjxP|tH8Tw~X$M$5= zw?pS=$=n=UR3IIhyKN(%w91|o$2wAJF6HsO!K`wB+ip&a15!)FR-DMpR;zN(!#7p| wDxaJXcmG|Y9aDT0a=hVy;XVW6RryKtu7?Y;iZ?$5row`BwT*6+YdVJg54It(G5`Po literal 0 HcmV?d00001 diff --git a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md index 994416c82c..28d5b89736 100644 --- a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -6,6 +6,7 @@ search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +author: iaanw --- # Minimum requirements for Windows Defender ATP @@ -13,6 +14,7 @@ ms.sitesec: library **Applies to:** - Windows 10 Insider Preview +- Windows Defender Advanced Threat Protection (Windows Defender ATP) [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] @@ -21,45 +23,28 @@ There are some minimum requirements for onboarding your network and endpoints. ## Minimum requirements ### Network and data storage and configuration requirements - + - + -When you run the onboarding wizard for the first time, you must choose -where your Windows Defender Advanced Threat Protection-related information is stored: in either -a European or United States datacenter. +When you run the onboarding wizard for the first time, you must choose where your Windows Defender Advanced Threat Protection-related information is stored: in either a European or United States datacenter. > **Notes**   -- You cannot change your data storage location after the - first-time setup. -- Review the [Windows Defender ATP data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) for more information on where and how - Microsoft stores your data. +- You cannot change your data storage location after the first-time setup. +- Review the [Windows Defender ATP data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) for more information on where and how Microsoft stores your data. ### Endpoint hardware and software requirements -Endpoints on your network must run the Testing and Adoption Program -version of Windows 10 (Windows 10 TAP). The hardware requirements for -Windows Defender ATP on endpoints is the same as those for Windows 10 -TAP. +Endpoints on your network must be running the pre-release version of Windows build 14332 or greater. The hardware requirements for Windows Defender ATP on endpoints is the same as those for Windows build 14332. -> **Note**   Endpoints that are running Windows -Server and mobile versions of Windows are not supported. +> **Note**  Endpoints that are running Windows Server and mobile versions of Windows are not supported. -Internet connectivity on endpoints is also required. See -[Configure Windows Defender ATP endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) - for additional proxy configuration settings. +Internet connectivity on endpoints is also required. See [Configure Windows Defender ATP endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) for additional proxy configuration settings. -Before you configure endpoints, the telemetry and diagnostics service must be enabled. The service is enabled by default in Windows 10 TAP, but if it has been disabled you can turn it on by following the instructions in the -[Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) section. +Before you configure endpoints, the telemetry and diagnostics service must be enabled. The service is enabled by default in Windows 10, but if it has been disabled you can turn it on by following the instructions in the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) section. ### Deployment channel operating system requirements -You can choose to onboard endpoints with a scheduled Group Policy -(GP) or System Center Configuration Manager (SCCM) update (using a configuration package that you -download from the portal or during the service onboarding wizard), or by making -manual registry changes. +You can choose to onboard endpoints with a scheduled Group Policy (GP) or System Center Configuration Manager (SCCM) update (using a configuration package that you download from the portal or during the service onboarding wizard), or by manually running a script to modify the registry. The following describes the minimum operating system or software version required for each deployment channel. @@ -68,4 +53,4 @@ Deployment channel | Minimum server requirements :---|:--- Group Policy settings | Windows Server 2008 R2 System Center Configuration Manager | SCCM 2012 - +Manual (script) | No minimum requirements diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index 375f3f74e6..c29d81114e 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -14,6 +14,7 @@ author: mjcaparas **Applies to:** - Windows 10 Insider Preview +- Windows Defender Advanced Threat Protection (Windows Defender ATP) [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] @@ -53,7 +54,7 @@ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Advanced Threat Protection ![Image of OnboardingState status in Registry Editor](images/onboardingstate.png) - If the **OnboardingState** value is not set to `1`, follow the instructions on **Identifying and addressing onboarding issues**. + If the **OnboardingState** value is not set to **1**, follow the instructions on **Identifying and addressing onboarding issues**. **Identifying and addressing onboarding errors**: @@ -81,67 +82,12 @@ Event ID | Message | Resolution steps 15 | Windows Advanced Threat Protection cannot start command channel with URL: _variable_ | Ensure that the Windows Defender ATP endpoint has internet access. -### Ensure that the Windows Defender ATP service is enabled -If the endpoints aren't reporting correctly, you might need to check that the Windows Defender ATP service is enabled on the endpoint. You can use the SC comman line program for querying and managing the service. +### Ensure the Windows Defender ATP service is enabled +If the endpoints aren't reporting correctly, you might need to check that the Windows Defender ATP service is set to automatically start and is running on the endpoint. -**Check the startup type from the command line**: +You can use the SC command line program for checking and managing the startup type and running state of the service. -1. Open an elevated command-line prompt on the endpoint: - - a. Click **Start** and type **cmd**. - - b. Right-click **Command prompt** and select **Run as administrator**. - -2. Enter the following command and press **Enter**: - ``` - sc qc sense - ``` - If the the service is running, then the result should look like the following screenshot: - - ![Result of the sq query sense command](images/sc-query-sense-autostart.png) - -3. If the service `START\_TYPE` is not set to `AUTO\_START`, then you'll need to enter the following command and press **Enter**: - ``` - sc config sense start=auto - ``` -4. A success message is displayed. Verify the change by entering the following command and press **Enter**: - ``` - sc qc sense - ``` - -**Check that the service is running from the command line**: - -1. Open an elevated command-line prompt on the endpoint: - - a. Click **Start** and type **cmd**. - - b. Right-click **Command prompt** and select **Run as administrator**. - -2. Enter the following command and press **Enter**: - ``` - sc query sense - ``` - If the service is running, the result should look like the following screenshot: - - ![Result of the sc query sense command](images/sc-query-sense-running.png) - -3. If the service **STATE** is not set to **RUNNING**, then you'll need to enter the following command and press **Enter**: - ``` - sc start sense - ``` -4. A success message is displayed. Verify the change by entering the following command and press **Enter**: - ``` - sc qc sense - ``` - -### Ensure that telemetry and diagnostics service is enabled -If the endpoints aren't reporting correctly, you might need to check that the Windows 10 telemetry and diagnostics service is enabled on the endpoint. The service may have been disabled by other programs or user configuration changes. - -You will need to check the startup type and verify that the service is running. - -There are two ways to check the startup type for the service: from the command line or in the services console. - -**Check the startup type from the command line**: +**Check the Windows Defender ATP service startup type from the command line:** 1. Open an elevated command-line prompt on the endpoint: @@ -150,24 +96,131 @@ There are two ways to check the startup type for the service: from the command l b. Right-click **Command prompt** and select **Run as administrator**. 2. Enter the following command and press **Enter**: - ``` - sc qc diagtrack - ``` - If the service is enabled, then the result should look like the following screenshot: - ![Result of the sc query command for diagtrack](images/windefatp-sc-qc-diagtrack.png) + ```text + sc qc sense + ``` -4. If the **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**: - ``` - sc config diagtrack start=auto - ``` +If the the service is running, then the result should look like the following screenshot: -5. A success message is displayed. Verify the change by entering the following command and press **Enter**: - ``` - sc qc diagtrack - ``` + ![Result of the sq query sense command](images/sc-query-sense-autostart.png) -**Check the startup type in the services console**: +If the service **START_TYPE** is not set to **AUTO_START**, then you'll need to set the service to automatically start. + +**Change the Windows Defender ATP service startup type from the command line:** + +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command and press **Enter**: + + ```text + sc config sense start=auto + ``` + +3. A success message is displayed. Verify the change by entering the following command and press **Enter**: + + ```text + sc qc sense + ``` + +**Check the Windows Defender ATP service is running from the command line:** + +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command and press **Enter**: + + ```text + sc query sense + ``` + +If the service is running, the result should look like the following screenshot: + +![Result of the sc query sense command](images/sc-query-sense-running.png) + +If the service **STATE** is not set to **RUNNING**, then you'll need to start it. + +**Start the Windows Defender ATP service from the command line:** + +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command and press **Enter**: + + ```text + sc start sense + ``` + +3. A success message is displayed. Verify the change by entering the following command and press **Enter**: + + ```text + sc qc sense + ``` + +### Ensure the telemetry and diagnostics service is enabled +If the endpoints aren't reporting correctly, you might need to check that the Windows 10 telemetry and diagnostics service is set to automatically start and is running on the endpoint. The service may have been disabled by other programs or user configuration changes. + + +First, you should check that the service is set to start automatically when Windows starts, then you should check that the service is currently running (and start it if it isn't.) + + +#### Ensure the service is set to automatically start + + + +**Use the command line to check the Windows 10 telemetry and diganostics service startup type**: + +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command and press **Enter**: + + ```doscon + sc qc diagtrack + ``` + +If the service is enabled, then the result should look like the following screenshot: + +![Result of the sc query command for diagtrack](images/windefatp-sc-qc-diagtrack.png) + +If the **START_TYPE** is not set to **AUTO_START**, then you'll need to set the service to automatically start. + + + +**Use the command line to set the Windows 10 telemetry and diganostics service to automatically start:** + +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command and press **Enter**: + + ```doscon + sc config diagtrack start=auto + ``` + +3. A success message is displayed. Verify the change by entering the following command and press **Enter**: + + ```doscon + sc qc diagtrack + ``` + +**Use the Windows Services console to check the Windows 10 telemetry and diganostics service startup type**: 1. Open the services console: @@ -179,9 +232,28 @@ There are two ways to check the startup type for the service: from the command l 3. Check the **Startup type** column - the service should be set as **Automatic**. -**ASK ALON HOW SET TO AUTOMATIC FROM THE CONSOLE.** +If the startup type is not set to **Automatic**, you'll need to change it so the service starts when the endpoint does. -**Check that the service is running from the command line**: + +**Use the Windows Services console to set the Windows 10 telemetry and diganostics service to automatically start:** + +1. Open the services console: + + a. Click **Start** and type **services**. + + b. Press **Enter** to open the console. + +2. Scroll through the list of services until you find **Connected User Experiences and Telemetry**. + +3. Right-click on the entry and click **Properties**. + +4. On the **General** tab, change the **Startup type:** to **Automatic**, as shown in the following image. Click OK. + +![Select Automatic to change the startup type in the Properties dialog box for the service](images/windefatp-utc-console-autostart.png) + +#### Ensure the service is running + +**Use the command line to check the Windows 10 telemetry and diganostics service is running**: 1. Open an elevated command-line prompt on the endpoint: @@ -190,22 +262,67 @@ There are two ways to check the startup type for the service: from the command l b. Right-click **Command prompt** and select **Run as administrator**. 2. Enter the following command and press **Enter**: - ``` - sc query diagtrack - ``` - If the service is running, the result should look like the following screenshot: - ![Result of the sc query command for sc query diagtrack](images/windefatp-sc-query-diagtrack.png) + ```doscon + sc query diagtrack + ``` -3. If the service **STATE** is not set to **RUNNING**, then you'll need to enter the following command and press **Enter**: - ``` - sc start diagtrack - ``` +If the service is running, the result should look like the following screenshot: + +![Result of the sc query command for sc query diagtrack](images/windefatp-sc-query-diagtrack.png) + +If the service **STATE** is not set to **RUNNING**, then you'll need to start it. + + +**Use the command line to start the Windows 10 telemetry and diganostics service:** + +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command and press **Enter**: + + ```doscon + sc start diagtrack + ``` + +3. A success message is displayed. Verify the change by entering the following command and press **Enter**: + + ```doscon + sc query diagtrack + ``` + +**Use the Windows Services console to check the Windows 10 telemetry and diganostics service is running**: + +1. Open the services console: + + a. Click **Start** and type **services**. + + b. Press **Enter** to open the console. + +2. Scroll through the list of services until you find **Connected User Experiences and Telemetry**. + +3. Check the **Status** column - the service should be marked as **Running**. + +If the service is not running, you'll need to start it. + + +**Use the Windows Services console to start the Windows 10 telemetry and diganostics service:** + +1. Open the services console: + + a. Click **Start** and type **services**. + + b. Press **Enter** to open the console. + +2. Scroll through the list of services until you find **Connected User Experiences and Telemetry**. + +3. Right-click on the entry and click **Start**, as shown in the following image. + +![Select Start to start the service](images/windefatp-utc-console-start.png) -4. A success message is displayed. Verify the change by entering the following command and press **Enter**: - ``` - sc query diagtrack - ``` ### Ensure that the Windows Defender ATP endpoint has internet connection From e42d0f55393868a7b5778e6abd9c0b0875a412fb Mon Sep 17 00:00:00 2001 From: Iaan Date: Wed, 11 May 2016 18:11:20 +1000 Subject: [PATCH 237/439] fix build numbers --- ...ows-defender-advanced-threat-protection.md | 33 +++++++++++-------- ...ows-defender-advanced-threat-protection.md | 2 +- 2 files changed, 20 insertions(+), 15 deletions(-) diff --git a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md index c26707df8f..273f4235e3 100644 --- a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md @@ -6,7 +6,7 @@ search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library -author: mjcaparas +author: iaanw --- # Configure Windows Defender ATP endpoints @@ -18,7 +18,7 @@ author: mjcaparas [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -You can use a Group Policy (GP) configuration package or an automated script to configure endpoints. You can deploy the GP configuration package or script with a GP update, or manually through the command line. +You can use a System Center Configuration Manager (SCCM) package, a Group Policy (GP) configuration package, or an automated script to configure endpoints. ## Configure with System Center Configuration Manager (SCCM) @@ -26,7 +26,7 @@ You can use a Group Policy (GP) configuration package or an automated script to a. Click **Client onboarding** on the **Navigation pane**. - b. Select **SCCM**, click **Download package**, and save the .zip file. + b. Select **System Center Configuration Manager**, click **Download package**, and save the .zip file. 2. Copy the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. @@ -40,15 +40,15 @@ You can use a Group Policy (GP) configuration package or an automated script to ## Configure with Group Policy Using the GP configuration package ensures your endpoints will be correctly configured to report to the Windows Defender ATP service. -> **Note**   To use GP updates to deploy the package, you must be on Windows Server 2008 R2 or later. The endpoints must be running Windows 10 TAP. +> **Note**  To use GP updates to deploy the package, you must be on Windows Server 2008 R2 or later. The endpoints must be running Windows 10 build 14332. 1. Open the GP configuration package .zip file (*WindowsATPOnboardingPackage_GroupPolicy.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): a. Click **Client onboarding** on the **Navigation pane**. - b. Select **GP**, click **Download package** and save the .zip file. + b. Select **Group Policy**, click **Download package** and save the .zip file. -2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the endpoints. You should have a folder called *OptionalParamsPolicy* and the file *WindowsATPOnboardingScript.cmd*. +2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the endpoints. You should have a folder called *OptionalParamsPolicy* and the file *WindowsDefenderATPOnboardingScript.cmd*. 3. Open the [Group Policy Management Console](https://technet.microsoft.com/en-us/library/cc731212.aspx) (GPMC), right-click the Group Policy Object (GPO) you want to configure and click **Edit**. @@ -60,7 +60,7 @@ Using the GP configuration package ensures your endpoints will be correctly conf 7. Select **Run whether user is logged on or not** and check the **Run with highest privileges** check box. -8. Go to the **Actions** tab and click **New...** Ensure that **Start a program** is selected in the **Action** field. Enter the file name and location of the shared *WindowsATPOnboardingScript.cmd* file. +8. Go to the **Actions** tab and click **New...** Ensure that **Start a program** is selected in the **Action** field. Enter the file name and location of the shared *WindowsDefenderATPOnboardingScript.cmd* file. 9. Click **OK** and close any open GPMC windows. @@ -69,11 +69,17 @@ For additional settings, see the [Additional configuration settings section](add ## Configure endpoints manually with registry changes You can also manually onboard individual endpoints to Windows Defender ATP. You might want to do this first when testing the service before you commit to onboarding all endpoints in your network. -1. Extract the contents of the configuration package to a location on - the endpoint you want to onboard (for example, the Desktop). -2. Open an elevated command-line prompt on the endpoint and run the - script: +1. Open the GP configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): + + a. Click **Client onboarding** on the **Navigation pane**. + + b. Select **Manually on-board local machine**, click **Download package** and save the .zip file. + + +2. Extract the contents of the configuration package to a location on the endpoint you want to onboard (for example, the Desktop). You should have a file called *WindowsDefenderATPOnboardingScript.cmd*. + +2. Open an elevated command-line prompt on the endpoint and run the script: a. Click **Start** and type **cmd**. @@ -81,10 +87,9 @@ You can also manually onboard individual endpoints to Windows Defender ATP. You ![Window Start menu pointing to Run as administrator](images/run-as-admin.png) -3. Type the location of the script file. If you copied the file to the - desktop, type: *```%userprofile%\Desktop\WindowsATPOnboardingScript.cmd```* +3. Type the location of the script file. If you copied the file to the desktop, type: *`%userprofile%\Desktop\WindowsDefenderATPOnboardingScript.cmd`* -4. Press the **Enter** key or click **OK**. +4. Press the **Enter** key or click **OK**. See the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) topic for details on how you can manually validate that the endpoint is compliant and correctly reports telemetry. diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index c29d81114e..815597e8e9 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -6,7 +6,7 @@ search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library -author: mjcaparas +author: iaanw --- # Troubleshoot Windows Defender Advanced Threat Protection onboarding issues From 06394da8fc133fb28c445b907545e227a101f668 Mon Sep 17 00:00:00 2001 From: Iaan Date: Wed, 11 May 2016 18:50:26 +1000 Subject: [PATCH 238/439] anchor xrefs, image update, final proof of troublshooting --- ...ows-defender-advanced-threat-protection.md | 5 +- .../images/windef-utc-console-start.png | Bin 7836 -> 7836 bytes ...ows-defender-advanced-threat-protection.md | 111 +++++++++--------- 3 files changed, 56 insertions(+), 60 deletions(-) diff --git a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md index 273f4235e3..83a54f04e9 100644 --- a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md @@ -20,7 +20,7 @@ author: iaanw You can use a System Center Configuration Manager (SCCM) package, a Group Policy (GP) configuration package, or an automated script to configure endpoints. -## Configure with System Center Configuration Manager (SCCM) +## Configure with System Center Configuration Manager 1. Open the SCCM configuration package .zip file (*WindowsATPOnboardingPackage_ConfigurationManager.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): @@ -66,7 +66,8 @@ Using the GP configuration package ensures your endpoints will be correctly conf For additional settings, see the [Additional configuration settings section](additional-configuration-windows-defender-advanced-threat-protection.md). -## Configure endpoints manually with registry changes +## Configure endpoints individually with an automated script + You can also manually onboard individual endpoints to Windows Defender ATP. You might want to do this first when testing the service before you commit to onboarding all endpoints in your network. diff --git a/windows/keep-secure/images/windef-utc-console-start.png b/windows/keep-secure/images/windef-utc-console-start.png index 0dcf33a47cdd833c39bf1728dadfd59cb4de959c..57c2020b044063514e4fed60180f83f80d8531e6 100644 GIT binary patch delta 17 YcmbPZJI8i{6B~z?Sis$h8$Ckg05)(1`~Uy| delta 17 YcmbPZJI8i{6C1k`+Y#NkjUFL#05m%Vga7~l diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index 815597e8e9..92624f61fb 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -18,68 +18,66 @@ author: iaanw [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -You might need to troubleshoot the Windows Defender Advanced Threat Protection boarding process if you encounter issues. -This page provides detailed steps for troubleshooting endpoints that aren't reporting correctly and common error codes encountered during onboarding. +You might need to troubleshoot the Windows Defender Advanced Threat Protection onboarding process if you encounter issues. +This page provides detailed steps for troubleshooting endpoints that aren't reporting correctly, and common error codes encountered during onboarding. ## Endpoints are not reporting to the service correctly -If you have completed the endpoint onboarding process and don't see endpoints in the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) after 20 minutes, it might indicate an endpoint onboarding or a connectivity problem. +If you have completed the endpoint onboarding process and don't see endpoints in the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) after 20 minutes, it might indicate an endpoint onboarding or connectivity problem. Go through the following verification topics to address this issue: -- [Ensure that the endpoint is onboarded successfully](#Ensure-that-the-endpoint-is-onboarded-successfully) -- [Ensure that the Windows Defender ATP service is enabled](#Ensure-that-the-Windows-Defender-ATP-service-is-enabled) -- [Ensure that telemetry and diagnostics service is enabled](#Ensure-that-telemetry-and-diagnostics-service-is-enabled) -- [Ensure that the Windows Defender ATP endpoint has internet connection](#Ensure-that-the-Windows-Defender-ATP-endpoint-has-internet-connection) +- [Ensure the endpoint is onboarded successfully](#Ensure-that-the-endpoint-is-onboarded-successfully) +- [Ensure the Windows Defender ATP service is enabled](#Ensure-that-the-Windows-Defender-ATP-service-is-enabled) +- [Ensure the telemetry and diagnostics service is enabled](#Ensure-that-telemetry-and-diagnostics-service-is-enabled) +- [Ensure the endpoint has an Internet connection](#Ensure-that-the-Windows-Defender-ATP-endpoint-has-internet-connection) -### Ensure that the endpoint is onboarded successfully -If the endpoints aren't reporting correctly, you might need to check that the Windows Defender ATP service was successfully onboarded on the endpoint. +### Ensure the endpoint is onboarded successfully +If the endpoints aren't reporting correctly, you might need to check that the Windows Defender ATP service was successfully onboarded onto the endpoint. **Check the onboarding state in Registry**: -1. Click **Start**. +1. Click **Start**, type **Run**, and press **Enter** -2. Type **Run**. +2. From the **Run** dialog box, type **regedit** and press **Enter**. -3. From the **Run** dialog box, type **regedit** and press **Enter**. +4. In the **Registry Editor** navigate to the Status key under: -4. In the **Registry Editor** navigate to the Status key under - - ``` + ```text HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Advanced Threat Protection ``` -5. Check that the **OnboardingState** value is set to **1**. +5. Check the **OnboardingState** value is set to **1**. ![Image of OnboardingState status in Registry Editor](images/onboardingstate.png) - If the **OnboardingState** value is not set to **1**, follow the instructions on **Identifying and addressing onboarding issues**. +If the **OnboardingState** value is not set to **1**, you can use Event Viewer to review errors on the endpoint. -**Identifying and addressing onboarding errors**: +**Use Event Viewer to identify and adress onboarding errors**: -1. Click **Start**. +1. Click **Start**, type **Event Viewer**, and press **Enter**. -2. Type **Event Viewer**. +2. In the **Event Viewer (Local)** pane, expand the **Applications and Services Logs** section, and then browse to the **Microsoft\Windows\SENSE** directory. -3. In **Event Viewer**, browse to the **Application and Services Logs\Microsoft\Windows\SENSE** directory. + > **Note**  SENSE is the internal name used to refer to the behavioral sensor that powers Windows Defender ATP. -4. Click the **Operational** log. +3. Select **Operational** to load the log. -5. In the **Action** pane, click **Filter Current log**. +4. In the **Action** pane, click **Filter Current log**. -6. Select **Critical**, **Warning**, and **Error**, then click **OK**. +5. On the **Filter** tab, under **Event level:** select **Critical**, **Warning**, and **Error**, and click **OK**. ![Image of Event Viewer log filter](images/filter-log.png) -7. Review the remaining events which can indicate issues and troubleshoot them based on the corresponding solutions from the following table: +6. Events which can indicate issues will appear in the **Operational** pane. You can attempt to troubleshoot them based on the solutions in the following table: Event ID | Message | Resolution steps :---|:---|:--- -5 | Windows Advanced Threat Protection service failed to connect to the server at _variable_ | Ensure that the Windows Defender ATP endpoint has internet access. -6 | Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: _variable_ | Run the onboarding script again. -7 | Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: _variable_ | Ensure that the Windows Defender ATP endpoint has internet access, then run the onboarding script again. -15 | Windows Advanced Threat Protection cannot start command channel with URL: _variable_ | Ensure that the Windows Defender ATP endpoint has internet access. +5 | Windows Advanced Threat Protection service failed to connect to the server at _variable_ | [Ensure the endpoint has Internet access](#ensure-the-endpoint-has-an-internet-connection). +6 | Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: _variable_ | [Run the onboarding script again](configure-endpoints-windows-defender-advanced-threat-protection.md#manual). +7 | Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: _variable_ | [Ensure the endpoint has Internet access](#ensure-the-endpoint-has-an-internet-connection), then [run the onboarding script again](configure-endpoints-windows-defender-advanced-threat-protection.md#manual). +15 | Windows Advanced Threat Protection cannot start command channel with URL: _variable_ | [Ensure the endpoint has Internet access](#ensure-the-endpoint-has-an-internet-connection). ### Ensure the Windows Defender ATP service is enabled @@ -91,11 +89,11 @@ You can use the SC command line program for checking and managing the startup ty 1. Open an elevated command-line prompt on the endpoint: - a. Click **Start** and type **cmd**. + a. Click **Start**, type **cmd**, and press **Enter**. b. Right-click **Command prompt** and select **Run as administrator**. -2. Enter the following command and press **Enter**: +2. Enter the following command, and press **Enter**: ```text sc qc sense @@ -111,11 +109,11 @@ If the service **START_TYPE** is not set to **AUTO_START**, then you'll need to 1. Open an elevated command-line prompt on the endpoint: - a. Click **Start** and type **cmd**. + a. Click **Start**, type **cmd**, and press **Enter**. b. Right-click **Command prompt** and select **Run as administrator**. -2. Enter the following command and press **Enter**: +2. Enter the following command, and press **Enter**: ```text sc config sense start=auto @@ -131,11 +129,11 @@ If the service **START_TYPE** is not set to **AUTO_START**, then you'll need to 1. Open an elevated command-line prompt on the endpoint: - a. Click **Start** and type **cmd**. + a. Click **Start**, type **cmd**, and press **Enter**. b. Right-click **Command prompt** and select **Run as administrator**. -2. Enter the following command and press **Enter**: +2. Enter the following command, and press **Enter**: ```text sc query sense @@ -151,11 +149,11 @@ If the service **STATE** is not set to **RUNNING**, then you'll need to start it 1. Open an elevated command-line prompt on the endpoint: - a. Click **Start** and type **cmd**. + a. Click **Start**, type **cmd**, and press **Enter**. b. Right-click **Command prompt** and select **Run as administrator**. -2. Enter the following command and press **Enter**: +2. Enter the following command, and press **Enter**: ```text sc start sense @@ -171,22 +169,19 @@ If the service **STATE** is not set to **RUNNING**, then you'll need to start it If the endpoints aren't reporting correctly, you might need to check that the Windows 10 telemetry and diagnostics service is set to automatically start and is running on the endpoint. The service may have been disabled by other programs or user configuration changes. -First, you should check that the service is set to start automatically when Windows starts, then you should check that the service is currently running (and start it if it isn't.) - - -#### Ensure the service is set to automatically start - +First, you should check that the service is set to start automatically when Windows starts, then you should check that the service is currently running (and start it if it isn't). +### Ensure the service is set to start **Use the command line to check the Windows 10 telemetry and diganostics service startup type**: 1. Open an elevated command-line prompt on the endpoint: - a. Click **Start** and type **cmd**. + a. Click **Start**, type **cmd**, and press **Enter**. b. Right-click **Command prompt** and select **Run as administrator**. -2. Enter the following command and press **Enter**: +2. Enter the following command, and press **Enter**: ```doscon sc qc diagtrack @@ -204,17 +199,17 @@ If the **START_TYPE** is not set to **AUTO_START**, then you'll need to set the 1. Open an elevated command-line prompt on the endpoint: - a. Click **Start** and type **cmd**. + a. Click **Start**, type **cmd**, and press **Enter**. b. Right-click **Command prompt** and select **Run as administrator**. -2. Enter the following command and press **Enter**: +2. Enter the following command, and press **Enter**: ```doscon sc config diagtrack start=auto ``` -3. A success message is displayed. Verify the change by entering the following command and press **Enter**: +3. A success message is displayed. Verify the change by entering the following command, and press **Enter**: ```doscon sc qc diagtrack @@ -249,19 +244,19 @@ If the startup type is not set to **Automatic**, you'll need to change it so the 4. On the **General** tab, change the **Startup type:** to **Automatic**, as shown in the following image. Click OK. -![Select Automatic to change the startup type in the Properties dialog box for the service](images/windefatp-utc-console-autostart.png) + ![Select Automatic to change the startup type in the Properties dialog box for the service](images/windefatp-utc-console-autostart.png) -#### Ensure the service is running +### Ensure the service is running **Use the command line to check the Windows 10 telemetry and diganostics service is running**: 1. Open an elevated command-line prompt on the endpoint: - a. Click **Start** and type **cmd**. + a. **Click **Start** and type **cmd**.** b. Right-click **Command prompt** and select **Run as administrator**. -2. Enter the following command and press **Enter**: +2. Enter the following command, and press **Enter**: ```doscon sc query diagtrack @@ -278,17 +273,17 @@ If the service **STATE** is not set to **RUNNING**, then you'll need to start it 1. Open an elevated command-line prompt on the endpoint: - a. Click **Start** and type **cmd**. + a. **Click **Start** and type **cmd**.** b. Right-click **Command prompt** and select **Run as administrator**. -2. Enter the following command and press **Enter**: +2. Enter the following command, and press **Enter**: ```doscon sc start diagtrack ``` -3. A success message is displayed. Verify the change by entering the following command and press **Enter**: +3. A success message is displayed. Verify the change by entering the following command, and press **Enter**: ```doscon sc query diagtrack @@ -321,18 +316,18 @@ If the service is not running, you'll need to start it. 3. Right-click on the entry and click **Start**, as shown in the following image. -![Select Start to start the service](images/windefatp-utc-console-start.png) +![Select Start to start the service](images/windef-utc-console-start.png) -### Ensure that the Windows Defender ATP endpoint has internet connection +### Ensure the endpoint has an Internet connection -The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to be able to report telemetry and communicate with the Windows Defender ATP service. +The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report telemetry and communicate with the Windows Defender ATP service. WinHTTP is independent of the Internet browsing proxy settings and other user context applications and must be able to detect the proxy servers that are available in your particular environment. To ensure that sensor has service connectivity, follow the steps described in the [Verify client connectivity to Windows Defender ATP service URLs](configure-proxy-internet-windows-defender-advanced-threat-protection.md#verify-client-connectivity-to-windows-defender-atp-service-urls) topic. -If the verification fails and your environment is using a proxy to connect to the internet, then follow the steps described in [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) topic. +If the verification fails and your environment is using a proxy to connect to the Internet, then follow the steps described in [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) topic. From ab8f97b74784e6bd0b62961e639b07fbfffb1fa2 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 11 May 2016 08:30:15 -0700 Subject: [PATCH 239/439] Updating based on tech reviews --- .../protect-enterprise-data-using-edp.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/windows/keep-secure/protect-enterprise-data-using-edp.md b/windows/keep-secure/protect-enterprise-data-using-edp.md index 132514c566..96b22f4c6d 100644 --- a/windows/keep-secure/protect-enterprise-data-using-edp.md +++ b/windows/keep-secure/protect-enterprise-data-using-edp.md @@ -19,7 +19,7 @@ author: eross-msft With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control. For example, when an employee sends the latest engineering pictures from their personal email account, copies and pastes product info into a tweet, or saves an in-progress sales report to their public cloud storage. -Enterprise data protection (EDP) helps to protect against this potential data leakage without otherwise interfering with the employee experience. EDP also helps to protect enterprise apps and data against accidental data leak on enterprise-owned devices and personal devices that employees bring to work without requiring changes to your environment or other apps. Finally, another data protection technology, Azure Rights Management also works alongside EDP to extend data protection for data that leaves the device, such as when email attachments are sent from an enterprise aware version of a rights management mail client. +Enterprise data protection (EDP) helps to protect against this potential data leakage without otherwise interfering with the employee experience. EDP also helps to protect enterprise apps and data against accidental data leak on enterprise-owned devices and personal devices that employees bring to work without requiring changes to your environment or other apps. Finally, another data protection technology, Azure Rights Management, can help to extend protection for data that leaves the device, such as when email attachments are sent from an enterprise aware version of a rights management mail client. ## Prerequisites You’ll need this software to run EDP in your enterprise: @@ -37,23 +37,23 @@ EDP helps address your everyday challenges in the enterprise. Including: - Helping to maintain the ownership and control of your enterprise data. -- Managing apps that aren’t enterprise aware. +- Help control apps that aren’t enterprise aware. ### EDP-protection modes You can set EDP to 1 of 4 protection and management modes: |Mode|Description| |----|-----------| -|Block |EDP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.| +|Block |EDP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between apps or attempting to share outside of your organization’s network.| |Override |EDP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log, accessible through the [Reporting CSP](http://go.microsoft.com/fwlink/p/?LinkID=746459). | -|Silent |EDP runs silently, logging inappropriate data sharing, without blocking anything.| +|Silent |EDP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or EDP-protected data, are still blocked.| |Off |EDP is turned off and doesn't help to protect or audit your data.

    After you turn off EDP, an attempt is made to decrypt any closed EDP-tagged files on the locally attached drives. |

    **Note**
    For more info about setting your EDP-protection modes, see either [Create an enterprise data protection (EDP) policy using Intune](create-edp-policy-using-intune.md) or [Create and deploy an enterprise data protection (EDP) policy using Configuration Manager](create-edp-policy-using-sccm.md), depending on your management solution. ## Why use EDP? -EDP gives you a new way to manage data security for apps and documents, along with the ability to remove access to enterprise data from both enterprise and personal devices (after enrollment in an enterprise management solution, like Intune). +EDP gives you a new way to manage data policy enforcement for apps and documents, along with the ability to remove access to enterprise data from both enterprise and personal devices (after enrollment in an enterprise management solution, like Intune). -- **Change the way you think about data security.** As an enterprise admin, you need to maintain the security and confidentiality of your enterprise data. EDP helps make sure that your enterprise data is protected on employee-owned devices, even when the employee isn’t using the device. When employees create content on an enterprise-protected device, they can choose to save it as a work document. If it's a work document, it becomes locally-maintained as enterprise data. +- **Change the way you think about data policy enforcement.** As an enterprise admin, you need to maintain compliance in your data policy and data access. EDP helps make sure that your enterprise data is protected on both corporate and employee-owned devices, even when the employee isn’t using the device. When employees create content on an enterprise-protected device, they can choose to save it as a work document. If it's a work document, it becomes locally-maintained as enterprise data. - **Manage your enterprise documents, apps, and encryption modes.** @@ -61,10 +61,10 @@ EDP gives you a new way to manage data security for apps and documents, along wi - **Using protected apps.** Managed apps (apps that you've included on the **Protected Apps** list in your EDP policy) are allowed to access your enterprise data and will interact differently when used with unallowed, non-enterprise aware, or personal-only apps. For example, if EDP management is set to **Block**, your employees can copy and paste from one protected app to another protected app, but not to personal apps. Imagine an HR person wants to copy a job description from a protected app to the internal career website, an enterprise-protected location, but goofs and tries to paste into a personal app instead. The paste action fails and a notification pops up, saying that the app couldn’t paste because of a policy restriction. The HR person then correctly pastes to the career website without a problem. - - **Managed apps and restrictions.** With EDP you can control which apps can access and use your enterprise data. After adding an app to your **Protected App** list, the app is trusted with enterprise data. All apps not on this list are potentially blocked from accessing your enterprise data, depending on your EDP management-mode.

    + - **Managed apps and restrictions.** With EDP you can control which apps can access and use your enterprise data. After adding an app to your **Protected App** list, the app is trusted with enterprise data. All apps that aren’t on this list are potentially blocked from accessing your enterprise network resources and your EDP-protected data.

    You don’t have to modify line-of-business apps that never touch personal data to list them as protected apps; just include them in the **Protected App** list. - - **Deciding your level of data access.** EDP lets you block, allow overrides, or audit employees' data sharing actions. Blocking the action stops it immediately. Allowing overrides let the employee know there's a risk, but lets him or her continue to share the data while recording and auditing the action. Silent just logs the action without stopping it; collecting info that can help you to see patterns of inappropriate sharing so you can take educative action or find apps that should be added to your **Protected App** list. + - **Deciding your level of data access.** EDP lets you block, allow overrides, or audit employees' data sharing actions. Blocking the action stops it immediately. Allowing overrides let the employee know there's a risk, but lets him or her continue to share the data while recording and auditing the action. Silent just logs the action without blocking anything that the employee could've overridden while using that setting; collecting info that can help you to see patterns of inappropriate sharing so you can take educative action or find apps that should be added to your **Protected App** list. - **Continuous data encryption.** EDP helps protect enterprise data when it leaves a device. For example, when an employee saves to public cloud storage, or synchronizes with another device.

    Apps such as Microsoft Word work with EDP to continue your data encryption across locations and services. These apps are being referred to as, *enterprise aware*. For example, if an employee opens EDP-encrypted content from Word, edits the content, and then tries to save the edited version with a different name, Word automatically applies EDP to the new document, maintaining the encryption. From 68b2425e4a4e896bcc4ca9c97c904f4006352416 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 11 May 2016 09:06:36 -0700 Subject: [PATCH 240/439] Updated based on tech review --- windows/keep-secure/protect-enterprise-data-using-edp.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/keep-secure/protect-enterprise-data-using-edp.md b/windows/keep-secure/protect-enterprise-data-using-edp.md index 96b22f4c6d..f75a7a1faa 100644 --- a/windows/keep-secure/protect-enterprise-data-using-edp.md +++ b/windows/keep-secure/protect-enterprise-data-using-edp.md @@ -71,7 +71,7 @@ EDP gives you a new way to manage data policy enforcement for apps and documents - **Helping prevent accidental data disclosure to public spaces.** EDP helps protect your enterprise data from being accidentally shared to public spaces, such as public cloud storage. For example, if Dropbox™ isn’t on your **Protected App** list, employees won’t be able to sync encrypted files to their personal cloud storage. Instead, if the employee stores the content to an app on your **Protected Apps** list, like Microsoft OneDrive for Business, the encrypted files can sync freely to the cloud, while maintaining the encryption. - - **Helping prevent accidental data disclosure to other devices.** EDP helps prevent enterprise data from leaking when it's copied or transferred to other devices. For example, if an employee puts enterprise data on a Universal Serial Bus (USB) drive that also has personal data, the enterprise data remains encrypted while the personal data doesn’t. + - **Helping prevent accidental data disclosure to other devices.** EDP helps prevent enterprise data from leaking when it's copied or transferred to removable media. For example, if an employee puts enterprise data on a Universal Serial Bus (USB) drive that also has personal data, the enterprise data remains encrypted while the personal data doesn’t. - **Remove access to enterprise data from enterprise-protected devices.** EDP gives admins the ability to revoke enterprise data from one or many MDM-enrolled devices, while leaving personal data alone. This is a benefit when an employee leaves your company, or in the case of a stolen device. After determining that the data access needs to be removed, you can unenroll the device so when it connects to the network, the user's encryption key for the device is revoked and the enterprise data becomes unreadable.

    **Note**
    System Center Configuration Manager also allows you to revoke enterprise data. However, it does it by performing a factory reset of the device. @@ -83,7 +83,6 @@ Use the following table to identify the scenarios that require Azure Rights Mana |EDP scenario |Without Azure Rights Management |Workaround | |-------------|--------------------------------|-----------| |Saving enterprise data to USB drives |Data in the new location remains encrypted, but becomes inaccessible on other devices or for other users. For example, the file won't open or the file opens, but doesn't contain readable text. |Share files with fellow employees through enterprise file servers or enterprise cloud locations. If data must be shared via USB, employees can decrypt protected files, but it will be audited.

    We strongly recommend educating employees about how to limit or eliminate the need for this decryption. | -|Sharing enterprise data through email attachments |The attachment is sent unprotected. |Store documents on enterprise cloud or network sites, and share links. | |Synchronizing data to other services or public cloud storage |Synchronized files aren't protected on additional services or as part of public cloud storage. |Stop the app from synchronizing or don't add the app to your **Protected App** list.

    For more info about adding apps to the **Protected App** list, see either the [Create an enterprise data protection (EDP) policy using Intune](create-edp-policy-using-intune.md) or the [Create and deploy an enterprise data protection (EDP) policy using Configuration Manager](create-edp-policy-using-sccm.md) topic, depending on your management solution. ## Next steps From 76beeb2c364824ddb6e768d09f736886583f43f6 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 11 May 2016 09:52:31 -0700 Subject: [PATCH 241/439] Updated changed topics topic --- windows/keep-secure/change-history-for-keep-windows-10-secure.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/keep-secure/change-history-for-keep-windows-10-secure.md b/windows/keep-secure/change-history-for-keep-windows-10-secure.md index 6b506dbfd5..8bcf425315 100644 --- a/windows/keep-secure/change-history-for-keep-windows-10-secure.md +++ b/windows/keep-secure/change-history-for-keep-windows-10-secure.md @@ -17,6 +17,7 @@ This topic lists new and updated topics in the [Keep Windows 10 secure](index.md |----------------------|-------------| | [Microsoft Passport errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) | Added errors 0x80090029 and 0x80070057, and merged entries for error 0x801c03ed. | | [User Account Control Group Policy and registry key settings](user-account-control-group-policy-and-registry-key-settings.md) | Updated for Windows 10 and Windows Server 2016 Technical Preview | +|[Protect your enterprise data using enterprise data protection (EDP)](protect-enterprise-data-using-edp.md) |Updated info based on changes to the features and functionality.| ## April 2016 From c682f0bb72def2ad26bbb660ec51455601d92968 Mon Sep 17 00:00:00 2001 From: Xiaokai He Date: Wed, 11 May 2016 10:50:03 -0700 Subject: [PATCH 242/439] provision the education docset --- .openpublishing.publish.config.json | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/.openpublishing.publish.config.json b/.openpublishing.publish.config.json index e58deb3585..efa5e8940f 100644 --- a/.openpublishing.publish.config.json +++ b/.openpublishing.publish.config.json @@ -52,7 +52,7 @@ "Conceptual": "Content" } }, - { + { "docset_name": "mdop", "build_output_subfolder": "mdop", "locale": "en-us", @@ -61,6 +61,16 @@ "type_mapping": { "Conceptual": "Content" } + }, + { + "docset_name": "education", + "build_output_subfolder": "win-cpub-itpro-docs/education", + "locale": "en-us", + "version": 0, + "open_to_public_contributors": "false", + "type_mapping": { + "Conceptual": "Content" + } } ], "notification_subscribers": ["brianlic@microsoft.com"], From 9fbbcf081be10b6a68be8790a03e9b3e77b6b544 Mon Sep 17 00:00:00 2001 From: Xiaokai He Date: Wed, 11 May 2016 11:05:17 -0700 Subject: [PATCH 243/439] update the path of the folder --- .openpublishing.publish.config.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.openpublishing.publish.config.json b/.openpublishing.publish.config.json index efa5e8940f..71ec186e86 100644 --- a/.openpublishing.publish.config.json +++ b/.openpublishing.publish.config.json @@ -64,7 +64,7 @@ }, { "docset_name": "education", - "build_output_subfolder": "win-cpub-itpro-docs/education", + "build_output_subfolder": "education", "locale": "en-us", "version": 0, "open_to_public_contributors": "false", From d7eb435f59b612ba0a609a791e287e2224bccab4 Mon Sep 17 00:00:00 2001 From: Xiaokai He Date: Wed, 11 May 2016 11:28:14 -0700 Subject: [PATCH 244/439] update the configuration file --- .openpublishing.publish.config.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.openpublishing.publish.config.json b/.openpublishing.publish.config.json index 71ec186e86..469c22cfdc 100644 --- a/.openpublishing.publish.config.json +++ b/.openpublishing.publish.config.json @@ -52,7 +52,7 @@ "Conceptual": "Content" } }, - { + { "docset_name": "mdop", "build_output_subfolder": "mdop", "locale": "en-us", From 00171b6ec839dfd96d78b0e0c03541871014b4c1 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 11 May 2016 13:11:59 -0700 Subject: [PATCH 245/439] Updated based on tech review --- .../add-apps-to-protected-list-using-custom-uri.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/keep-secure/add-apps-to-protected-list-using-custom-uri.md b/windows/keep-secure/add-apps-to-protected-list-using-custom-uri.md index 4936bb7028..3f9700cfb4 100644 --- a/windows/keep-secure/add-apps-to-protected-list-using-custom-uri.md +++ b/windows/keep-secure/add-apps-to-protected-list-using-custom-uri.md @@ -1,6 +1,6 @@ --- title: Add multiple apps to your enterprise data protection (EDP) Protected Apps list (Windows 10) -description: Add multiple apps to your enterprise data protection (EDP) Protected Apps list at the same time, by using the Microsoft Intune Custom URI functionality and the AppLocker Group Policy. +description: Add multiple apps to your enterprise data protection (EDP) Protected Apps list at the same time, by using the Microsoft Intune Custom URI functionality and the AppLocker. ms.assetid: b50db35d-a2a9-4b78-a95d-a1b066e66880 keywords: ["EDP", "Enterprise Data Protection", "protected apps", "protected app list"] ms.prod: W10 @@ -17,7 +17,7 @@ author: eross-msft [Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -Add multiple apps to your enterprise data protection (EDP) **Protected Apps** list at the same time, by using the Microsoft Intune Custom URI functionality and the AppLocker Group Policy. For more info about how to create a custom URI using Intune, see [Windows 10 custom policy settings in Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkID=691330). +Add multiple apps to your enterprise data protection (EDP) **Protected Apps** list at the same time, by using the Microsoft Intune Custom URI functionality and AppLocker. For more info about how to create a custom URI using Intune, see [Windows 10 custom policy settings in Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkID=691330). **Important**   Results can be unpredictable if you configure your policy using both the UI and the Custom URI method together. We recommend using a single method for each policy. @@ -26,7 +26,7 @@ If you only want to add one app at a time, you can follow the instructions in th **To add Universal Windows Platform (UWP) apps** -1. Go to the AppLocker Group Policy UI by opening a command line window and running secpol.msc. The local security policy MMC snap-in opens showing the **Security Settings**. +1. Go to the AppLocker UI by opening a command line window and running secpol.msc. The local security policy MMC snap-in opens showing the **Security Settings**. 2. Double-click **Application Control Policies**, double-click **AppLocker**, right-click **Packaged app Rules**, and then click **Automatically Generate Rules**.

    The **Automatically Generate Packaged app Rules** wizard opens, letting you create EDP-protected app polices for all of the installed apps on the device or for packaged apps within a specific folder. @@ -69,7 +69,7 @@ After saving the policy, you’ll need to deploy it to your employee’s devices **To add Classic Windows applications** -1. Go to the AppLocker Group Policy UI by opening a command line window and running secpol.msc. The local security policy MMC snap-in opens showing the **Security Settings**. +1. Go to the AppLocker UI by opening a command line window and running secpol.msc. The local security policy MMC snap-in opens showing the **Security Settings**. 2. Double-click **Application Control Policies**, double-click **AppLocker**, right-click **Executable Rules**, and then click **Automatically Generate Rules**.

    The **Automatically Generate Executable Rules** wizard opens, letting you create EDP-protected app polices by analyzing the files within a specific folder. From 88a4475080a0015760320a5dd8e84de2b9512ebb Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 11 May 2016 13:46:30 -0700 Subject: [PATCH 246/439] Updating based on tech review --- .../keep-secure/create-edp-policy-using-intune.md | 15 --------------- 1 file changed, 15 deletions(-) diff --git a/windows/keep-secure/create-edp-policy-using-intune.md b/windows/keep-secure/create-edp-policy-using-intune.md index 71d19b6949..e2dab16028 100644 --- a/windows/keep-secure/create-edp-policy-using-intune.md +++ b/windows/keep-secure/create-edp-policy-using-intune.md @@ -18,21 +18,6 @@ author: eross-msft Microsoft Intune helps you create and deploy your enterprise data protection (EDP) policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network. -## In this topic: -- [Add an EDP policy](#add-an-edp-policy) - -- [Add individual apps to your Protected App list](#add-individual-apps-to-your-protected-app-list) - -- [Exempt apps from EDP restrictions](#exempt-apps-from-EDP-restrictions) - -- [Manage the EDP protection level for your enterprise data](#manage-the-edp-protection-level-for-your-enterprise-data) - -- [Define your enterprise-managed identity domains](#define-your-enterprise-managed-identity-domains) - -- [Choose where apps can access enterprise data](#choose-where-apps-can-access-enterprise-data) - -- [Choose your optional EDP-related settings](#choose-your-optional-EDP-related-settings) - ## Add an EDP policy After you’ve installed and set up Intune for your organization, you must create an EDP-specific policy. From 9c0da90b0bd53d5426bc10b01098711f7cf7ea68 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 11 May 2016 13:51:28 -0700 Subject: [PATCH 247/439] index + TOC --- education/TOC.md | 1 + education/index.md | 20 ++++++++++++++++++++ 2 files changed, 21 insertions(+) create mode 100644 education/TOC.md create mode 100644 education/index.md diff --git a/education/TOC.md b/education/TOC.md new file mode 100644 index 0000000000..364dd264fa --- /dev/null +++ b/education/TOC.md @@ -0,0 +1 @@ +# [Windows 10 for education](index.md) \ No newline at end of file diff --git a/education/index.md b/education/index.md new file mode 100644 index 0000000000..8bfca9f8a3 --- /dev/null +++ b/education/index.md @@ -0,0 +1,20 @@ +--- +title: Windows 10 for Education (Windows 10) +description: Learn about using Windows 10 in schools. +ms.prod: W10 +ms.mktglfcycl: deploy +ms.sitesec: library +author: jdeckerMS +--- + +# Windows 10 for Education +Learn about using Windows 10 in schools. + +## In this section + +|Topic |Description | +|------|------------| +| tbd | tbd | + +## Related topics +- [Windows 10 and Windows 10 Mobile](../index.md) \ No newline at end of file From b0ab633a64c5c17e90b3e9c3e57a62e568ed9494 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 11 May 2016 13:54:32 -0700 Subject: [PATCH 248/439] added folder duh --- education/{ => windows}/TOC.md | 0 education/{ => windows}/index.md | 0 2 files changed, 0 insertions(+), 0 deletions(-) rename education/{ => windows}/TOC.md (100%) rename education/{ => windows}/index.md (100%) diff --git a/education/TOC.md b/education/windows/TOC.md similarity index 100% rename from education/TOC.md rename to education/windows/TOC.md diff --git a/education/index.md b/education/windows/index.md similarity index 100% rename from education/index.md rename to education/windows/index.md From 2b66ffbc4fd8d936247edcac842ec2307a24f4d5 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 12 May 2016 11:32:50 +1000 Subject: [PATCH 249/439] incorporate Michael Shalev's feedback --- ...ows-defender-advanced-threat-protection.md | 26 +++++++++++-------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md index 11667c6d43..0fa1932083 100644 --- a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md @@ -12,7 +12,7 @@ ms.sitesec: library **Applies to:** -- Windows 10 Insider Preview +- Windows 10 Insider Preview Build 14332 or later - Windows Defender Advanced Threat Protection (Windows Defender ATP) [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] @@ -23,11 +23,11 @@ There are three alert severity levels, described in the following table. Alert severity | Description :---|:--- -High (Red) | Threats often associated with APT. These alerts pose a high risk due to the severity of the damage they might inflict on endpoints. -Medium (Orange) | Threats considered to be abnormal or suspicious in nature such as anomalous registry modifications and loading of executable files. -Low (Yellow) | Threats associated with prevalent malware and hack-tools that pose a lower risk to endpoints. +High (Red) | Threats often associated with Advanced Persistent Threats (APT). These alerts indicate a high risk due to the severity of damage they can inflict on endpoints. +Medium (Orange) | Threats rarely observed in the organization, such as anomalous registry change, execution of suspicious files, and observed behaviors typical of attack stages. +Low (Yellow) | Threats associated with prevalent malware and hack-tools that do not appear to indicate an advanced threat targeting the organization. -Reviewing the various alerts and their severity can help you take the appropriate action to protect your organization's endpoints. +Reviewing the various alerts and their severity can help you decide on the appropriate action to protect your organization's endpoints. Alerts are organized in three queues, by their workflow status: @@ -35,18 +35,22 @@ Alerts are organized in three queues, by their workflow status: - **In progress** - **Resolved** -You can investigate alerts by clicking an alert in [any of the alert queues](alerts-queue-windows-defender-advanced-threat-protection.md). +To begin investigating, click on an alert in [any of the alert queues](alerts-queue-windows-defender-advanced-threat-protection.md). -Details about the alert is displayed such as: -- Alert information such as when it was last observed +Details displayed about the alert include: +- When the alert was last observed - Alert description - Recommended actions -- The scope of the breach -- The alert timeline +- The potential scope of breach +- The indicators that triggered the alert ![A detailed view of an alert when clicked](images/alert-details.png) -Depending on the type of alert, you click on the name to see a detailed report about the threat. You'll see information such as a brief introduction of the threat, its interests, tools, tactics, and processes, and the areas it affects worldwide. +Alerts attributed to an adversary or actor display a colored tile with the actor name. + +Click on the actor's name to see a threat intelligence profile of the actor, including a brief overview of the actor, their interests or targets, tools, tactics, and processes (TTPs) as well as areas where it's active worldwide. You will also see a set of recommended actions to take. + +Some actor profiles include a link to download a more comprehensive threat intelligence report. ### Related topics - [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) From 6c9aeaff064c777ce6634a41f2dbfbdc02f29a4c Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 12 May 2016 11:39:15 +1000 Subject: [PATCH 250/439] change image to remove 1 machine, change amirlaptop from image --- windows/keep-secure/images/alert-details.png | Bin 74297 -> 75431 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/keep-secure/images/alert-details.png b/windows/keep-secure/images/alert-details.png index 8048f85371b962e2fef640fd9cb060593c6e40ea..7d23ae0374439a30305be9fabd8ef0d8e797cf26 100644 GIT binary patch literal 75431 zcmce;1yCGayDdCG@BqQxgS$HfC%C&4+}$C;bqK){+}+)R4DRmk?(TPz_xsK{|6lji zty6XDR?XBfPjB`-y?giW)oZP%!xiNvkr40@0002eXDKmd0043k0D!WCg8@gVLFL=v z4|oSDEoT4#x%B7qJW9~^{r`79?6yAJ&xf|6C)mdEpNNL|hJ#7vz{oGcw&EbZ+8=@=ioKbOyOEPAK+oarPjke-om)Da*cgGEIsqCwYGc4*xIbYHBPTmc zJ99t>{%$BZ2K&$dyE>Ve0&d;{kN(|E)ZW(C)XoKPJDk`Kj=}tCrfTV8V+trdoumQ) zNC2P3gjGFKkAHi|f7I~Zd$6r*)?@2-(b`du?FYldLr+`aq zHb=$jIhDMkA3-`6o(}*s)1qs}o9n zSc$EkiKv1_nsN$~)nkFyFlzcogu_bJEbRE4^bJQHa59hBhS1YUXjtit|77f@&aUs0W`%|MRD`C# z{jJ*cr?*Oi$luHy+2MA-m^*W5uFNC24WYj)DM{&+cOsdW&09mN=Tr}z8Tr_AIxEpU zyi#W9Y|WMC=gKkPPn1F_`MG(eEV|aGMW?g((CR~EO$(+?solHJYR7lIFiDh?qQz;Y zNZv}I0ib3H@nVEi=fZ*)rDR`DVfhY|kfR2&bu|Qw7(LU< zcDfHLDnHok#MY(HwYDzTPk3g${LV-m5|K6@YrH|W(ZL8$FSCqP?*+#~dtXYogcnA8 zeQ;m{RQvd8NNOi=`rAx-=nWx}cT1$>(5D#mpLHzc(Uw^;SnuU=icB&&PK~|QE&PZC z7I|y^2yIIOb73HgX?KQ}>=(-6=``wtfD_52+#ut4y!D+SmS>tF*kdE&LawUBLF!Cps9xRP`Hks@3Bra<4EB8W z0iw8Zi@c%F8$f0ps4|Jw2@F~e!&y0y?mW)zH!oKT9VptmcxD_Hqwk4k&@;U2a%S|h zzeHnByXmCZBoTLMyxBW&IJTP&^CE^{{x#QQP5ccA7f{OKwGNDR?Yo@3hPCQl!?b^h zDSB6uh)#%Ib7Zd8E2C;>_Ww$abHt9AA0bwN7Nu~BA{8r(N!%bg!<%!gJe0XCQ&kFe z{|<>bu=Xx~e2(O{Zh6DY8Q98p-MAO?E!nA(X<~Rv@`e_f8}jezMp8~K<6N7Qha_+Q zh!${!LBQ#w9edV14sB(uVaN?T_Zw%4i%#HA6 z0%IM#z2-kT16jd2Yy718$*o)uoJO;4WOjY+>2MHm+(~J=l&rKla!t&1@om!(QI7Q&LCHe7CL{8{NpX|W z+a82vT3MiASQr!Ib?E1^Yb)O8f%MIyPeF-jaEjhoByu&&hotm(<7X%8FMe8htqiE;CgQxj;vh;Ps4HW+gM4scz^9Z-WVEAQP-uSYMK{s#5w{agc- zO?cRZa%NukA{sBfkyV=8Z`&-cnpIq{FFaYd1gb793Hht_AMCww4-=z#JGKlAfl z)w}))%72DGjN+4Z?LS8w&KO=%>_67%|E4wbTnLAO=eqS!V&K2}Etg*P*gHaq8T-xl znA^icGeGw$Hv&Jy*Z zTYi{q8el#7I~%W~oM$sV;tuJu|Cm7Ip1VJh&|Ayhdb)R`|3%f)#dxW4`YV~&+mrXX z+l8$KZUzV!u=jS_4!U0;?po?@*uoav-KkD(aDBeaNY#?a0UuHz!I#l_s3haHV6 z@#=&=hhx{J5|Q z!3Ao1OG!k{E-VC~lTpUm4V#;Yuf09o1SO>J>@f+>?rEeO*YEi=fp;G#u;B2Cd(^#z z+j~y(1OF?k`kthapuy6p0F3H=N)Y%5Y++SYXsXard0;rNQv(&#HS|FLX&vK4!k(Rt<~7|Qkbn6Wk0emCXead*_j ze}^=deX+){IIjnzi|%yVJ046k=4pblFg-l7q(ss5ZDfsqv>)DA`;kIVC+y{%ew6;j9cD~l;&Zy^t*6i3GX?+Sz31}_8@9?`I^P?Ay2tLMX}lSa&q>@H!rNio&Qc+9 z$PtPj$hHEC@tGz4ship0Ug*_V*L^GSfxn>*nhK!%vnFDzAsvS3joV?56PWe{H`;T% zvBm9w_TnJOK!+tvKh}Hdh zd5x-70tc|UuY=JqwbL~$V8RptO&|%ci>c?=M~{?SFb%9-!D6nZ|h}&=Q;an$>S-z#OKuW`Cv^j+WmFC ztTC9+XU)7V__xL~i#dOut1>Wg0SKA}Xea&y3i^#J!&xuJuW6&EXZ{QOVtXehh=lF=1cA)us;SiZwCl1)(` z{Il1lt`M6vl^2OGtkXqKJ8<32uV`SyaL@p#hFvjUCD5Bs@RL|%MNEY^Qm z03ilb%%)LttvOmXzIWF2XE~zEtdT@am-B=cJ%`0?hoq_NUIkw2HkQDw3A0aEt#hP@BO9Q!(5Rv_^R z4V0$PJmGGe$BefhuKSuV*J<06UF)0P8R+TEPiXa~{BG;?t{w5r>uu$J=dRVt3u4b8 zYLM=%3l^STKZ4^Xq1;8_w$wvZ!`scz^l>O=jVkN^Yabw_P{jz^e(PGg^jo88vl;7 zwKsN;yOYg4KoaD-2w)vl(`bH;<9Ehpex8!yOR&}o;D5MRxxc$h?<9WZ7;=A|Fu!

    W#=G^ydWc1|8U|$qf@B?G~PT!wC4x``qPCX}wBHm9M2z--F zhbFpC@4#+4xj4xfOLPsXWvO@ryXz1#H6ur+K;litf!Wm)@pj_wP)B6QR6QN zY3FTFO|ZRN=aS85kmT4V1iV6#kdfP6|ArfbKy(imkg^uK<=%$UH~PG~taSe}J{Lj! zLJ_lPjT5Eo*26qs)sKqf?#m8dvhnGWLVut1#k7@(qL)t_#SGh`cg;`in*hqTm7X|Z z*Y^hB+HFM-H7yzzD^rm_&d=W_RHoC0Y~<+B zY1@sfWR1#Z^cSlML}AbJF}-`IdMO-tAeB}b6Kb=JfGNuW;vkI_W%r_Ir993N!D2Cw zJ^R&UL%3OqI+W=9e3H!CZA5H%d3?w(#41@kTO^gq!$9mF?9~J^{N(Bu9$ixWl@ptw%D1 zMQU1G>b)NIv-dk?SiE|pMaufD;H~9A4O7llBkKm`q2?cXTC!9yT;^zeX$JM;1dahR z_g7=DP;K|yH}?~B=^a;V9tbN>M15&%S7fal_gXgouS!0>z8LQA)Q!zm^XQYN2Q(6|{zN@iiAo`hyXInb-1VVJ{)MufRsGNFj zi|0IKye^mRrd9pWAhN!mp6(-2bn&q40J}9<9i+^ThI~kO&5MJ`n zVK@3)pJ_ZJzFZjXW0Ge-7vb^oJJy{>bPwO?I<o!V>J zn)uRTtuWSqH#4@Okl~5Gdim0@e$ei|A^1qS><8A+zLXAPIMeP+`5jvM zbnoo3`|O$e0D6mDt8a$|shz6ATdUoZW1sd*I;S0-2@t=Oqb;e~Z&sVCR1H{-Xo*Jd zpwbr3q-dglC$>)twBmF7k>f~Pc+~N|;eul{QQG2sLeV{-7{q`Wi&v<3%K2gEd1ddS zNWqu(?(E8+OL7%4>0D#2F|46{1@Zz`KkAH+aQ!*b4x}(^*Ufk4!9wJBNaMrRh1u>LezekI^-B!pxBFR}BVdtI@cTIdGaosnr(& z46z1gXd~wzU|lzK}CjF?IxMOo&ZSXg#&vD>fNvQ-zn0((e1USB+}4a!tOU-a{c zv(CF#V~Mu2CsOvYH^J385B%3qgD30fu+`qBw&&1$T&3=%)t8dSw^0KStlu$brg|5O z(6!Ee(XRIe-<>}q(?b=TkY*?-?>`wnU%>i8ty)&l$T~V7uu@*V*2@5F6f7Zmwmd(P zA}_2pes_3-^Y%c6MuiRc_Hsk_%qAsE4mmZHhner}Tfpd(uw>&DxBUcDU z-FKsD?Lp?Fu-q{KY$gc0hLx|xWh+sSau9-MLJ@PV2NaD5XBi#lZBAJJZg05H2L?jG ziuB(^_8t#Kd6v)h#IHQh%P35HJ@H-b?|BkZ9F8%$Ak4WN_P)8M(z$4YFX@!nEcI*O zoG)Vj0D$K;@zDoZ$I)%S-NVlr?e`PzB!2F*ez2pv`sv#{8<&ZL?S?@d>`2hrg%F0Z z*7IICE9E)1MIEcPNz?BN7vZX@MWB9~EaHHQt@eumU!ZpJ=)4WX_JLjO!$QUsg?P!; zkX4Ax1$xkpcMrh`nbc%Hucq>rgtm0?E&7s#asV`51RdD^MdPdjgu+kX$R3$fk!xcK z8tP2B_s?DDmMXmtqplIGjN{vYUS*E`$R1gp`UuC{Ktx4v$UFCYN*g8ZA}Gnt7)qwm z+tg?4Fp<7*@f9Be7G-!Ul|S<`LV1Pn0qXX04ZKvnHzM@}Fv4O>R1Ue1B}8cpHJlLi z3w4Q-Mg@Z_{I6*Eqf|T&Oi-W-^dtI+VC2)hc)nI_71gM$-U{7FJRh%QfX4EXU-@7A zA0A|z8@7@j{lg8kYtJ<>Ac~a(QQX)t_+JuPb3TYRmwYQFNdIM zji)Gvig#GpaC;-Yb9vFS5eYJMQ@$`VBoz1z*G@Fk#cOp=Kik$ysIX*K`<|Qdo39fr z;KRZJ#MF%1YwlKYXFDwME8_YM_8XvG<;Qljw?E;1f)EYU*1YR|_^$PNb^8k=5wH7u zI`>wbc4eV(A+K`+JD(Yua|Qo(iBukEw6V>1Urj82-4zW|$gkhurGwbU^n(5jh8wEK^D@P<hgE;hw7sD~n<93+b!)ehxO(DIv#J)v(4Vgc{$Ms0>9{QO`@WI)gfci~? z=pOGc#WhAKn5~C{^oKb^?z`J!5RzwP7jFH~bWpDmxV%5qceHwAe_^k5Oii5FC0QFz zprP<@I*t4N6xre*{PHgX&M{i#{{q|fUn#oX)yj~65o}@nruehNJO5T*-c<=%9Kih_ zsI~P+Pqc}l@Bd0qNp@lAyED(?6vDr|#HRg!#^L?fz51^-<^O)bbaR09|42x>MYeiD z)Da(Cy$75|Lahfsn4({O_TL{QiR3N!7_$A{I#Q49NXoi6E{^Mr3|6wrIdsu4g>8<6 zuSUL=5vN(B2!Dt)rvY+0>kbi+@4jQ2s|54B$X>TJ`;{L~QgBUL zD8Ma%=`7_R^lM{U-nq0!ijZ3#RwLgXr(WJF&z@L8pykcvTE1Kt zN&3!Y<%;(x^r zZe)VKPi5BQafD!Y56-A^%F(b+#;333XCBXDof$e#6stQ1qwJ7q%ZfBHhv}(ZNMu0B z5Z>@PKO$rh>IJi}qhV@Z_-K_y?#K?}*-sn7?8zRFDeP6fU?okJnCKpdMI|@z&Kn=@N-6W20~MWJ zBY*t;M_nt2!PjXis*YRZ>)bt*=tu)1z}IvBXm;n+2vlQS0e7POcB)=kRfQ=ger#vU zj9bInSAA)_2+ygZ!Dc(~3S6v5x9P?G<)g&s*1-9Le__pepK2yi#JAGv$6=Gp0xN5E zo=ZZkt-Ce(440)|;*H!leV!HDk7@C>DKaTDYFZ1ywsHgUMC7gd?hTyETNIOB5|$=# zn{aVejx_javQo_^B$m&}Lc9r70b9$QoiXp9Kk^&5npUqRsXX#e6&H!nws7-R3i zNn7s<-tS)ZO8jFO9sK3zg=HE>u6cM)8QV=C*{isuN7meFi!6J`*nT5ohF}BlW3aYo zfxG;uBOE+=Xo9o$y&+S~x~%JF`r=IYOMa@Cj%d7`RV~0?xzew%*A3gkIyGvNcM->M zyBFF>pf0r>=;rdtDl_5f#AuUMi|>M$AHsU%(I#teItDd?t~5)FX(Du5SosBSa>m*8 z)7Ro!W}>KdiKDruo4|nL%o$=vs$v~`Q5oLwDZK#2qJ(S0zUlgq`KA4UBN-#45nc@g znNEJ0XZX!x5+ARR5oBUe;Uc-_|L(#$75!Q)^gJ|?R|pA=sgQ6MH7Q> zx0DX#eEoWSxe|z5^W!r-DGc9Coe>u)Kg}!}?ixz}Qn@lk&2*bIC85tKis365^*Y=A zaO;|9S?X4eW<1u{SP`sb2EEc2BOn~CUe_pfP2|H~g{3gV!QMFr1z|0R zBAT*Lqb*9yIG5I8&9Uj3G`!X0@FF5J1Qxz*adBu~yv+aY1!$su_p`Ed~+w7GvtEDEia*Jz6niWrhZ4$hHv&zuD4Iq0E3~uRF9FW?MGboc zb;K`lh0}ocMz^2Upt6{XoLVn^p{AQ7y223T1E;yVicIb4&&sf~Vj*O13(ZrYB#Awn zqsF1Z4T}>9>(KaAu(oiaTa^`wS8t0cay){$G%esCrJd7XemZBy6w*eSoq>hMNZaH> z*ShiZ;#JP^SIt#krE5I~WA+T764qZ=H0v?n>6158;Xdy1L_-Kx6y5VBw=e;maIiA^ zFJJAV>{ZtBp*HGLuwwtUY=~KdUDb$%SOu^SWd6iqIuuk#8D)!3&R$gx=@2Llyi_6LIx@Q$n`pfWVOFR zlz^j3wjNZxmfnqi@vW^h#b`S@OCI{33|`RDczZu&n;PpOoLGd*)!i_&rt;OmrPLaL zb->>N1+tv=1*Sub6#~R2ss%|0$!wPwGe;lFXz8h1>lb*tJ$%h?wOLU@$IGU_k-Kiz zozZE$B$b3=lPULgD8?IU3s|V(X5%!EFhGqyzN?<>;eKR*`#Kv`8fHk!<`zeD?k235 zWfNIhj5U4Uz&RMd6kEAkpBYBR4k(*7CSM$S1J+M}Dya}YY8dZ-V7Gx6H`vlAfhS(t znIiL{9}ljoak!RE6}(t%D7zIh-s1v=M!mu z6ue8UK+-$PnfVTqjPtc9!e(Q*?vkVz$?Hx08Dz^E?EtAu8Icq_Y-KIQ&3KSTx(OXR z{Y?q+WFI4imO~ro%7Cg$?&oQ?&7|K4FfFpkIF=B-P|;mqm50kVl$y*G&3Exto5IcF z#3-K8pP_0*>yk;Tp*AY0aqv6uGdd1DVdx3~(TeF=S@|AbR#-gd4JkLKN5Sc%OC!Eq zQQYgYbNTXcm3#r)+FsV)mjP5;fT24A(JUgdDZCX5*7m(TqzbV&yrMUZkCO0Zw|`a4 zKrRq!-?%#0P#D$4EeUHtPqHL|e-%R&nn5XWzG1xHt0)igX-dKJggydup2HZPKFZ&Cai%p^}KEEg6Q^F;)e@p zto|QKtp783_TO|Z<4~*jvl>q6{o4U2SO<0WK1H+93prraXQfkv!>x~qbH_>eP*3Xy}$G>83l;q|L9uRIs{-R{{26$R6L#a8sIXCXe5l$_^fnZP;2j)1Nl;%;clLbL6N> z4Rb5|VD@#1L{L#D$`-Q*s|v6Elc*y%wYV@_>D#f)xZ@9IL+X$hpWyGTEs+$hq5 zeh^X@ZGA-w_q`nvBzz<&hwsvu=il6&BXTnYSjL(D}>7uOZnInu85@*?G^kg`o zi}gEnv}QIVc664MRxsY8)zp;-8@5tFgI|*+68F~JKo<9I*>$SWwaPbMt@`{y=EEFg zlJ7xSnRyPyavHyVrli-;atqd_aTWL1(x_a1-29>U-*6@0Ar4mEd<^)I78BK0CVBvz zm_r~7*PWJJy>04pDz+`B5j~2TQ0qQ7&Pd>!@>2>er`rcUjg!5cqvmTOmlOE@w2TL9 zLF2^kSz+Pi9N}Lg4|j$VSu9Z#mu33npDwK zn^hYDo`j3hZ`LBaZ?h-!RdqGKQ1LM;b3vsyET^=(1`3;Pz_fPID-xJ7ya{b;Tkp%W z9vpWiG@hR;g7Z+VC==xz(YzBkVRKtm0a|8b>m-3i7W$SHLIqshE2Vqis4I`<#c@-@ zW`4fpjB6x!la??+I6?%yy}r$O7Tw9!FO9iV42Suaw0}u^3ptr>P%VFL8S-TthfqUY zmHiQ`Y#i~M=Tcn5oz#I0=ZJAj*O;h-7cCwYjii7hpvF0;a^#sKpoA%w&q`7i#{c)C zgv|?L?{{#LBl{kz^52kXa)F1^RrH>GgS$nzd2}{?E=^_&yT>C|<%AR`W4mifgrs5C z!G_3f&s-=Yar9rf<`*@Q)HN2`qsvxE{=h3vch&)r3G|*D7(mXP&!5i1(2=|Pk%yt2 z*uc;q$X7O1VIJGq2DSepa9mB3Q#aFH1IL>Eu8w#JoLeTA0^3Jh+q8!Tl|UqQ z$8x5Ku! zr60q2n-^nCL~S0UtL9@#^J!wMQuRL^f23Vq=&trJ#8R)BZD{I8?|Cn9P`TQ<)6M^6 z4f%tvJ@J=ne>f&L*}>^CGLbzR?wq7pt2I7!sbiVrih#*2!)#QW8aWhiAhn9d)HN z0zSH65GPkS#PI1TW>3vUa07*N*<^6(?XY_!re-(Uo#2!G0AGiW&_2ApQsR z{r=^&^wWcZU7C38v=b!40AuN(D*{SD;k&Xrt<5K-Nv)`Q4y%pA;c= zn=%@yG?{?3`+NIM5k(GF2FC295rawC+iuYkRT{Q!#=}rq0cG+MmcQU}si(if_&3CR z3C3g6{A(m;-&Cw|Wl-N3o#Be&bo+uV8ZQt^5-RFPp+aei0I@|mX|f|o8(rz!%`LBW zyJ9E74=hDVXE^{#rgG#fjCyhZ5P@U^hD#q2WjUXBsQ%K`$gF~K%jXkC- zoXu&6R<$CcEGnR9Thy^P5g2Xh;AB8xvaSJ`HQd)rS=55u##mmRZw1*T3P?Guz}jEO zYHwyUjL{-DP1Z87o5ra=He8e5=rFZ1WH*XsT3K~=Hi7mqn8HbHPA(_-l{pGQf&W%a z0&Jur;|UEru7jS z&rS}J+4zP@)Dk(=7Z8!Vf_*D6I0t!Xijls2^t>(%mYB;BY=(_M@MM>aQr>56hd%M`+*|JldCy!Eeq35T+R#i zVArB`;qVp>_QKOJPFh4QFkdKu=UODxW{^8P@T2#6-xY>FGJ2IJXqv}82!ic3lt2_W z*R@svF@MO;@X(g7%3NTVWbgQ#y9#Nd6`R#EtkcQnPaWvUqNN3<(n7eQ>o>&cUh(92r8Al7+KN zGx6v|7vHZ3sFi>QON|m|mt+~0g1E)Lp~j6D=FM4{YZZApE-_RPap1^R7)HB^5o9Sc zTa*{1D$dqr$#0e?Y=yyKV2b=%^rQ%J#*OtZ4>M@ojfA8$?WrC@#LWyeMW>FsD&S=O z_q&F8ihR~EjyQs+KQYt^a%)%`z4hkK=FpyFx?QRBGj{eGI)9MN!Z7&th(;&G85ekD z;jQfjJVk`S6pLksQi8AP^F$A{u%i}?AJ3Ai%u>J|Q^E6W6x7u8j=`!=H*lvb6wq7- zv$Fcl3|Pg%M~&p%OM#Hy8Mrys2l7>Xkh8^5E?Y+;1Kg;p)OCd@^kQZknQ+A+yCe~0 z1%0WRv^Mw;m+5Y$D@Ba!Qfnhl(pm>z?=w((LfxGDWt}ReJVq45%^7o|I6$N~+1NW~amV$8XAs|gU=3t_ z`xa)KO!7?Tf{P^gvh_@u#_qcHRMOA*?hbTQTPgM;kKZu6Ic{D?{B@XKC2q(njEd~v z_S$FU2{@45vdC$KVa^H2C)87dV-eYFVg1IY`2 zJFvxTo%|RNcN@?hL>gBEW@cmiz1p`7hJXoz02GP z83NaWla`=tM(k|V0*JW0Ip)*50 zXau&i;rZ!6;76tC&3*}+(EN5qJsC8#hLA`aoxc6D1Wn-T3eVY$I`io37Cj|rgCk$KOne7!? zYk!SJcB)K6z1twUaHD`VAG&`?4lkFeZ?RY{u=^xKkn=Gk>cnI7%9*-qpq{ad{pNZZ zP1Qve;xGKY;>!<_t)4^klOLj7mi@@&cbQbzqs6dO&Sg3`f%f9e$!|*Tx!|$lc-bEg zQhro8*15&g_VK07)$fsxrT--uS^iRO*?WMn#G=NC@rbfhFR%vOyv1IyA#5ffbVhVB zm{cfYQRElYQwgz?u+&OhIHG4Vcl19RH${4JbPKh>HtW1-wP#r|fclz0*=@+jvjy~F zPvP)ze5E$1r=u0gkrPry*D5i8N(nD z3~pVu5q_A}P3{~&01B{;%HZR#S2`V7F0?Jq$9^JfQVmgx{TeUD{upudGyX`PAIlOO z?2-u)T&tkQXF}tRKpD|!OgqYtit)YmR7yMT7Nt{<50bFXmxc=njMgH@biG1mPHV~| zht-cDF)TYUvIteW32|}Ii5sLcEYsRU?#m;k0aL*i?}GLrIj|qB;fckkAHfoVtew3@ zsEirj_dy#L$&H)*bzW^o?Jr##9b!ZCDHsRNU_eVBNi5;swQnd?tss8FNTtndT>FR< zqO|c`hoD$TTPj=IwyKX(A*1APT7iOwSGK>HoJ4mdG+cdRS@#cu^o_~^mV`c{(-w;R zn?TR7rku*J*WvXW>_+rbfdO?M5}g``6+dtp3^jd^h?ZyM7|{chKRmMq?KY&q4u&#G0m1q zhOfSAfnre>G2LKqrNNJ1Bw!X!(Fdx_fg%sQ+lhX;c1H*>BR6>!6=22;Cm9FH>R5!| zbhQtAP=L6}GHr0r7(@O!Uf^qFa0(-!UQmoYHAli_3ryx8AQ^!dy*Y~b#m%tEqY6ovad$f>=|`mZ0B?i$;x=V0->{E!kR zt*saRf0`~$S0naG2ANqT5W)u(%nV*GA;}uw%K&vujW0cK&kOlFo)5 z=P8Z=I=Rjp0X>xiR~9eHT$XsF=FszB;G>~O(O&C%&?W~mb*_b06P=;ezZ*th6QB(o zm%0GMMC5UC7jtT(-zUMbkWhi*17xaS_ZjDS#mW}e`#KL?z!9F4s8s0voyzfA(!ie?I5MOoxLLQcY9Q%4G zdPW&X%x)c|!LPGm?;<5Sy__`Dyu+U6%2p{>tb-%uVxxEE9ash1Ozo=#sZqZ_FX)18 z50T`>ejy7aX!>;neb_#Z@1&&48#LX>TTjxh> zrH@22mzXe3N8XhF8?LcBF=fKvXool0@?7HW?E5xM;cnQb8ng(&*G4!qisbrGKF5Tu zJfrDV0vm&=iTR^MPt?1d0zn|)}8*Hli-IZX5ca8}=Y9z!#U&x(HO~5FN$n1r-o?JMyFzQ=O;;<($ZLM}YHM`KO z3XFSnYb(t~-Q0$J-gl&?4Bf~t$+B%#!~Kev!l;qbHkE7!O}=C z0lvSs(q71T^w6uzMX|;EtB1u2a|*GTxaRWDHOpIdTRd;q=kUVOXH>@tY^Wx9z|ed_ zYy|PBfxi~fjYihKjF97}?NEC01P7_LZ&V8cw)oiK5h&hu-%Ic?t(IZZo0H*fnk1YR zc9Sq@j*pWqA&?|?2vT^1Q@EIfCwk&4Ku9b6r|67?h_kN4s3 zTk8q-KJ}y!U4azQTzuA%S7{Q6hcty5u~(dy@XaN1%E-&E#;-=n#(gq&`{Sb?_gT}W z%n6E6uPa-5N|M4C+)S6ged~cUDP+GW`lA7~zf*IL`voGC2bmxzo}0Ca<_r?wljL;W!iR2YHj9ZHi00rB>8&IUQ@r0`Xv1 zGr_eN-ePRcA&|L{W*PW{QI;p_BOh{VIzm=qtK|vUi&spy{0*~|LqO~f>b5>6MEkS+ zT=E9ik>$HOSR{$w0kD?o`LnSoXdjnhdI>9a6hYSHtJ%kPa5+#I0U#Wr5t zV8k=!en;S~X0b6(lh^{+#-RHAMHG1o*2k4Z*HS7GSvAzR@0)WVtdLffRs&;dw{$dD1(z5K5e%y=ih?D0y-ptH z=|<*EfXfc6H?6o2;JQ!Lgf)?zb$x0u%cmDbuGeF!C)*m}bHh2SWuB#+LaKlxj3JIH z-GJiHRI%k*#5K2>5@g&IxxNG<8w4|>(~svMzQjV^EM=KP%_7KGqRKs! z#{t1mG$KT?da&B{w)q%r<7=wK=;$jaF-Cgz=g1*{9mAn{Z74mc*Wt^O)!mJ4L1N=4za4EngrP-s+J zK~E1ybXpFq71zc>7h!FC3*&7r(LNGmXthd24>Acy&n7noagdiYpzC}>R;@qP&$c(m zY<1z6yo4W^fh*RekvUDC55bbuze4``Rk|#u2x3d?G6=O>%Ab&?VvC@rcU-n9^23Gr z$H;$s0Thd>!m8OMF*qzmFmKe+He6GYbG1yIi7!o)gciC4tr8ZTns(iAn%oTQ3TD2~ zHt^wnAzOS(GEe78{HQ(w_6boO_DIPT5Xq=c{<`?kf-oXXm# zJXE`k3S$Cr=u{<;s4XbwUcmzUC5rQEPCLf`+QgXH!A_#y)F`hd5fn)EMJx=Zpb*|e z*UVpoV03T!303?(5^Qu)u#9HR5Tth5W?>eZ(4K9lgDL2D+g!+RVO>;cSaBKm&CZabe+(@N@ktOxrW&eC+i zuE(t6X{hP8Bx1=Ov9d4o@3iY<_!i-u=0juo zJqb%Jrp2f?0k$Q5H{KIC$qJ`rxj@h?2Nd9sXfOMQ%^?}g`Gb@d8o&T0Z{9mkAFE(B zO+rfsV@o#;3n+pzq3+$8Tf*`}V?H{KR_k=pWKva5MJom!oAFqCy!y$vK*QkQ#n&sOJ?JzaaICOa>V19OxnV5 zCI7ndVyLfQ5#klwz7QZ-%i%=8Ia+jlMv$rtj*jhVSNEca3oumAw)AfN^JE1vmg9gE zx`(w3I8{m?muiFe7&G6 zopHV1N%0eVttbSJP%2>L5+5c{n z(Z+8UJ>fgpVUOq^MEdth5pa%1+Mi0)>si91v$(v6PQ*zHfAh4B(PeGXZ#erDA+`bP z+`ryB$#?kJ{tC#<=DMme9hwwRgyKy$9o>m_;bqfBVkHWLzT1&S=9Z{%dWrkG8@$g0c6rodO!zX_o5wp z{4eU>GA^qAZTlU%OS(&uPU%hq1*AJfLZrJxQept5ySq~wsi8}1=#XYWy5U*ib^Sm0 zv-f`XzVDaYS4$ljSnIcb=W%|I<6NWLWnzDuF?Y%3%ft=e&dB49vHJ=mEv60T;HCaT z+;Pj^ad0RijE?fp`Yyv}f!PLcb%g_Y_4txq))vbSr)uZmHotc#&yr31 zSJDT0o$2HX1r2i28({5Ks2j@zKF6aXeGlxHz6anQ6^(#ri3|WJfEgtVtNg0^^^lb_ zjZ$pDw~ULat!@DLRKTe$#D&iva6z9QY$#}+S!j+}SJYPGS;F=KY?XMG)eI0MIaM?L z)u&6trWIs;6q~OHnks8`7*)pizu5Z&*5N#A0weir{npkeZWlFs2jTkkl>635IAe!cc)mAxgtLj_z}h;kzn%`=a&3$`+U78(WO$=KxJLarxyL*THK#cbp4qwivh zn@}h#xkhw2(ye+9qzafj4YztXwO?WXy>(?kaeUulk6`#R>uksj1si}miGLNT0NXQN z=L+T2s)*_c*glCDTex;sJBdyOZxe z0RaiEnR}pU#fIVr?OjSZSd~RE?!cVRG_?yddUB-bb&-v6L|;q?NF`=i6llx7U!{95 z^&0SR=uLW}g^?C2gI{Yo4nBm*zP;R3Mksyt9QaAns=io!dj5I~@FhA5T#^cK)Qe6p zY%-O@t{J!eZIj)6I2OcEQE~G72Y8u6shIVEv8W8BXS&SQ%8LmiiLFGgaCDYpRr|&q z`QP_6?YRznwwR4hlpl=ID1cKv`#O*A0QRfd&pOo6MVaQjFsD;4t(XemG@?+OydrsN zRT}&$5Zz*INmG(g>ywm?YIklbAbWuIwGC0*yaX30IV4@cr$c3~^R!*#y9ycUo4iDk4@7 zQ&Yk=IM)Sg0lG;-1{*a_J&&n?Pnf?He!n3k3CH%tiy`C1lw$}o1Y1_Vh5u{R378Bq z<3Dp(74I;_1hEfVNdP4h94oLCXjPIiMa=+C5tV6Ehb~z=E2DtdB>erP*>os_705vk zC6Q(O?5C{j4~pq7z8cr&z0O>AhF{ax3Lx^U3cRz_XaO^=)SMnbz&@zOA0tqAH#AC! zUp5@_z>8@TMmfepdTWxRSBoCDfKLn8KE-7j;1;ef*&s`>osr|2`9-@0i-l|##kIa; zD%d>Wa+Ao80iKz6Uv7~qOPu%Cn~{qC80xn!@z67NVMKi42$P9UBQe5yH^OYt#OP!w z5jHKQt%lK%I*zNFyYx)krIeSwe~T1xmCv!Nr?sV}{K47}KX&@Lg9V1e4!r002Z-QoSB&cBOq7 z+uXS$Ydri#gJT@HBfG~wTZ>v#yjDjxFOx?yHpGUyl@d(+Bm}7ycH`M}mRBZ!i)9vJ zBg0rs;b)c=Vq{7WJ0mWq+`Ov#s9mbs;@YgO?`7>ZD5Y)l+=?1r#p}XrQX_|Y&;%t8 z$?B)VL(_fTJ(ZZ<-1Tba=&|WEh^@k}u5fZ*^C;k0(3R6w30h^bJ#+fyR+F&t+`uQ% zg!W;tE5_FeE|A4(0771r_Nrg${Yt}L1(}koZ<Z;da&ONB7M4Y~;UM;8&QnLqLT>EJISOEXy!U^2FjL6qlsnKU z1q#?0l!Q(GV23~Eo(O!%`E(P4aGr^nss(2{h{#RbR2W;~sGAmln0~=&t_?hE0jwU# zj|?KtjQ&Gh+lmlm-+kFHz(QKc3=WoFagnm4)mf^qVS6Z|6z(Ix^h*&pN!h>+z+=oOTh=7JSI9 z2^Z3qQ!eLG>;~3}2Hd0c`7uRGg4<*ak{Gb1fr}!j+b07l*>vs{D%IkBe2+;#%SNJL zW;zBWkQtb9n?O5kH9H_0iOHlWLOi`PRye*ojDb9&E)WFXM3*urCL%(fq{YK zcT5)@l+qa?TMw--Y0l7pB-%U}4$-Tq#sq zAC~ylkL;9x|MDA~bClunpZ{k^Q3r2Ve{y4z1i?uMtgTC3>ce)@)hrXih-oG(BlCo! z0R>lM0?e4Y+}+bfG=`_)#8M>i;_`u^UH+4>i%~AnS2M3sIW&>oDKV_bfp?{@>Ya){ zepog}U3ms9ECJ?&)2)$SqM0PE*fkp}yF$t_2YUWJpS(Vc~35u zh#nfYysd1jXv%4bJ-cv9nCbC>?#J_o5AaGEwflu#*i`Gqcln!8SNt*VN?#md@-u5O zY+SmV(S0RyVOz-`_PNIhP8_V`zdz-0vG>F!no0_}fvQo=2N)z|jqaEdeI_wNfIafrpLx1pM39hMBy4L^P9%YLNeYPVB&B|+ zP5m$SP7yHP_2-<{U_{!0@^+4ov(PY1dl;s(9qVFQ#cY$N#peqi(B+Cb}(Yu3dj_Dlie`3z#<5T46)_ z)8IDL+Hw}(C41+l2AiCEtr2O-5276K>rxPTuk(lb>s)$FLk3GDYwH4ZhD}nUn6Xz~ z!}^c}^*R_!5f;~Pj^26gl1;R=>ONce$^PZuT+A^W4ul3qA+)BT2SfU|B6cA-rYAPO zetfh6o({mG580SmqB22vWvig}mRxPHG-9xNjZHX*!&ZIG8=zEGD{X&1^0GxSkM7OxEeD3Db7lP zzwqZYatK#Y(JnT zTs_ViPxCF!yLl=cuR7l#xFUC7L4&EIQEFp1u`WSM^fP#YR_+w1{c-Ym#Lbg{RK1VN zsTsK_pd9G6Zw7`~J|X0kY2t{7K}l(@dT&lKiP~m3mw42yN|73HY<7FwS#nJJ--X)qG%e6v z>|14v1fwMdQDkaHWpBTrFN@TcO6_qVzuy-G@Or(KeHR?MT-qP(Y{g8AUFK{`h)2mF z)5P*iDxOIC>T&F4?>~6u&feyb|J5S{+WHa}{yN2`;tTov*JcAh3+L=|<5)2m>Uo z?VEBJZ-jkvSsltgn4RA`Wr2ccaRsP28=F_3q<=U5P_}Ovc~fyV^;xM2)+*kgM|G{3 zpR~oYw?=X(a>XS6qy^ar^EE2%QXC?r6YXc8#BwkF>}+r<^bcWMydHXrbHo0n5{WH5 zXtd(&+}FAz0;mHeHIBxXsYtAI?Fv+WlJ{ZOTcRFL zb?NdNlB1N|_RxRu3JUz($w~L)@Wx&x)0bBG>9t2S7<9s9ILGM>dVxhoq|W}I#B){8 z_iD^u%0mX{>4FMwG1onvD$HlhwtHrFj!?#=VS_~MmYov6d(6QhVsy_bIJacrvRpuo z&7T5+bOAUM0aMrijO8RP0jpN;%6LR>7(R}TGh$O>xgGV*y4s7d0 zTstn7bqK^18O1WsfvSA_A{C9cz7q&@(FWYq0qZ<|n=0O*zSy|-e$<&qwwAES!YIHI zMz6mOQm2leqz|YVcAY2IG4Od4;OpdlQ)yL{@{ijf?MX3)Gk{9WTRjlWR$JWb8L45>aelOvM!# za+hv=!P6Px(BW_P8v4~t(lyuG1e%5O6=eX;b{5JhGt-a#JWUPyCIHqZ?-3}qqkaC& z&rA?iL3l<^+*t4YJxvkLlrbH7krOj)fwCIU0w7`*Ef`*8FfM$B-rK)*ndJ(-&SE8@ zBx4s1426#@#_a&j3k0F{`pO4zmRk{~QP?TzbzO7UiZpjS*^5Xx8LM`GqsOHHiOZD? z&?p5kP>ry23&+i|Jf{kXH-sl{U8T3SOcs%z9Wg(5gj*a?Nek=jc-cH{vIO7GHvF3R z!&av6;S;_(6a%9JQ?)aJ!<(!ycxO|3YZzS1%jR#l#8Y^EZ%}MI*sJj%IzZ{2MmX~z zhAPPk6WA^jaZ97pBT>=TPx94A@uPE~o?6L22aOuz>kw$&;c^C7-LPHewmetDW}bJA zv^ddMF1aOn8;5UikTAv&5M>iCs9`6-AaU`-IWQQ?l@NCNGY$6_LMHlj6lAK{no`Hewa?m>DhJ9=Nn~~Uu(#cI=hdu%J z?;i^G3Y94?Sx{#DJsJTMS>JLay*>MU#Yvpr7hDE$&-*Q#A{Lms8~ACQ@)j3Uqs}le zcUWOqB@{^B^qoLx;iL1dj4!S|H3_hsdtG`wyXb^F!jwsUcT@@_RZ)H#1xTbyq1g6^ zHrv|E3DLYUfZ;*7Hr`j>WT3ymPbo$hQokm#69F>%b`cU{;qV12l=!lp;}Lj}?zYme zU*X+UY!O8D(6zb0(PQV&4ZfJ^QI*BzrN6|bOClC((gaU6tC@x{f_xDdF_yakL142$ z5%aVPv?>rJu4*W=IlefmF$3XRbyH<^?!sQShoREC_{+aUrTwjwZJhVR9xVVH z#879A*vYvJ@&&Sb{BUn8&a6m+5X{M5u+DyXf)m%$i3W;e|F9rab!J44OkqCy!Vs>Z zlJrP+nh$%o9#>mc9?^AjF>XV7yZe?`!cIP-4j3DvykB+VH)_| z)7#w91VpjuhJH_cSZ@b!5-&@udVS!4&0VE73OdW?Zz}d66vx%#Eh=r2aJzQ^$CzLMr}zEBJJN^6$DcPZ z$p!Xe#pX!AR=!~zTJD=yPtJG>K~UvyZDo41`tvHWiO{>Q#Z=TQ@Ydj})!N}YY;nvR zB?x|HDa~NRgQ4z_h~dwn;0d8nFy44=EgFS1*C|f|^ zbopZ)lqE7u$$LczPC;15G^w9sS?O`#TiA1lAF(j)mO=&8(sH}`#{uvVU%!1I_%=K) zW?KzzPd@~%(ZhWVPV{rI8o3{>4r1;lC5XGlW)5ML+ zvx~5bnnaD*`sN&1cHqdFV>wD5Rd60^kMOM-L0VNwUzO35PTeN1ttPrbD6`l&ZA|g>bs%c zw{8oCp7pGAe-?&sEOuPZ$%}80?~dE<&*MG-3&UGj|9GfV`tDCfp8*Ha-0$S+Do?#L zr{gGb(YE!=UAa4h{`qG0DwCG_o6Bt`AMb%Vlclud=UOyA9^OTBuI|H2p~uN@tQU)U zrh0bs%!_k9p3(StyB9dQF8szx)?li)tRLOnzARnPFNW3MxE-goIsI<2M)zuT=lkdq zsdg1t_h|~Yy);(NR4xb}@{WZV@Ske(&$=#%^j57O=5OAx`3&*n)KV6E*Uofn`%tljm9m2P@}GrhlHT zfZdJZZR6t1*SfzN zn6i1***Xb5^u(U|&|HAX+_}^R4CgQ6Vp!GLH!pWz;Fqq{G2=>QS%YAWh?-*vUQdaOinTO3hIeWt) z>}TRGca#PfrgfU2mCok7*P;g#W#M)}#_a52@BOnF&Huh;;7VOf3gu^E$&w@>MdeVV z+mHPkpu?W-Xf%^nGkH9GYHgql5wZ6fvFQ)eT;xRw^-!Y~f%_+nUWO+rzn*Q>+78Au zFUX;ek|q}!@NYX6`49gN zk+va?1{adiSg@LXg(v)l1CD3_iXiqfdVq8t#bG%^W(X(8&W{1w1tqe4LYi7wYzEch zEb(IXub1xhHp-OkR;3)TmRmpyhjYQFxz}ZJX=vc!%rlf8xpb+?sXr`pu*&i0N;Eb~ zCSwR<70u<-y!LQxaz- z4=4J>6-1B~mX8hmSN{|k2M1cuWZ8{LEPUB1d>m9DZi(& zy}T*@Df7DcI4Msu)x}At-_9aD_XLvH;+souT#QhmMpEaeC%s5=WeGRUXDGw2E6_b3 zU1uKCLEt=Ahx`tKC>vg*LM@xQNf+C!=GquxtIm^K*%23Lmei^_2G*xhzFt|lf&(}- zc80VadLzOu=4)#sThKhW;%7GKr@RFt<4A13o33dJVrT~Hy}2KaUQV5s;rurXAfV}q zJ`^D>iL~=TE6vJv7)NF29!({-;BE&EDO2!}avBaiMj2L=O)%^8b7kMNJbx zGAnoxnX?!@%85y`O3!h3%MbuRH3^e$djoV4PpI8nj(kU#dhVr+migj=--#M_j-$M9 z$<#&Z)Zk^=pGqb>bLWZkWTY{9kM_b{9C*8&oEcSFWIy)it{XoW#e3R=<2$vdFF%I8 z42OA~^G=4JjB2Qnp=`-$x+laGF45JPl!%EZ{ z(X}#3VpU?9oW2oSKxG3Z^_UxoM9POVrcB7I%9X7p)7q>1uVl|`B<`)rGb<{Ek!;<) zV)zbaAa}7XbH?Kq`R{vw}Eqz;O}RPUK5zXSbbo zkV&4)o=$x{zyWa)jHgZlgGTf8YvG-sQqy@$B(*=wF1%5V&`^s-)OY8{T@1soTIU9T z;|!6yEwVtYIazM}yqzG=2!M->2!$CLnS^E88P6$?A+iT0ZMfK zk>>l2?aOy*9AKASQPDOhq)o--Y2X#d@80hN_1#8)0KWWk!{~b(-?039#Rkhacj7X; zy3n&IZ0SZ3OZ&nOox7V8PNj3+rHMDrI>Y=pIG3FdLP2Tw&)JRY`7TUwNu=%cl-hEQ z&BvShbh}=qzhqC`(BE2^O-~!vx{*ATXYB&i`vuNntK>c|Pj~O#dLGkC<+kZ}cS`+* zvy^cQb?@u%Z7z?$$6TJ>JiV=*HtifKYOS%lJ!|euU$W48=fP{DUR8E=_qmnHYZWHw zQ*@Jkb}(+bW~{2bD!72BoKTbnyw;Bv{NX2?;;#X+fFyVXwvL$ z%#LR)X_bpW?xtKG+fPBg5Bj1lyj%u(0+AmhhX8&@H86#x?wbnj)GAVr{~hiq$U!9t zR1kTs{gl<3>ag%Q|BPIhX-#&Z%V|T#eyO!1`W@Og*rvJtXzY(c4j%s8tlQ)>L#5rsZ#pK)^H*Im&J~@ribC0n< zVVc0GTA#UOOqDIt`t&s@NprYq08Yr;beJ}`m7XPy3NQ{lh-o~0UIrnVM&ye330n2N z0NTyK@A}7H=7FqU=(RWDXapZ!ZOmt=vs(|a&vJRq;wr*;ClEhxh;0_f$@ZW=XCs) zQGjL(Zi7#bm4$|4TsB<_D~p*ElfFTtR!l9k)JqF^-GPQiz38+C-^2ojRIdcUj+|~w zp}+1stx|TDOKN-==?25DtO+w6VL8UNk$4aXnYds?hK(IKj_5B9O#TyF&%VoZTa#|$ zC7;d}l1@4Fh8S1jQ&a;%0NTm7I}XGPm1|~3h)hoKvN|0RyLPil_>2O}GfMhE4YqhL zOM;}7Z_pCqw&cvVM7b;PFs%DqeDR6-t2N*kzrvUPIE=lo;}jNK zFtG(r&r<;^1^U_pghvQJH>zPvgfe5o$6Q_6wodGGMZj1syPxSYJKrdgc**O@ct^zW zR;26~-SK)>iCSrP4UVQrU3J{X8rdgWNGS_2g4elVgR8C)1*bcCjVZEe3VNk2jO!KoH^6Y_+2nkN-X%R^6q~AY)0x%Z63CgNFnDY z^A~~y(5M;uIEY)b=~GIu72kwHUsReg9|c9^A0(9A=uZZMniP8$o;)5thbRT_?m6iQ zl$}Z_a;pjl8FqoXNU_(WZR&tQtiY?#y1G{EBRyTMH|>(_MVi7heZhOXvpZUQJ~Q*e z;+Y7oc-JKzqD?JpmnG z;#GYJgo%Q1hZd$n9bkG`CQ2*;V{?*~if-ao;nI&LI@;fgeh+Bia*nee(EQPAV)UXgLt?1u^H+8X zAj7Yhqr;(UXLFLa{eQqNA2ki9LR`N)gqjrF=ZA}R!jmp?6g1R?(YR+x?7G0~2>UPe z7d@O7q{q`Tl@dibW@)cboDJN-6vDnNxBy$4CG!S)B;&3_s^YO1cBptmVfO5CAYU{B z3R}yrrmF`^MC|C;|MVqAh9Nv?yFoMQ2)q|C$5kJ)MuM%2S_XKiH$k@Bz}50J9)$3E z&iSr@lJej%dc$k*L7F?>J4v()XLpiKD4h_9r zH`5T)p8a_VJI4>bK0vrY#3RXVh%VAzMLWMka%!8MbVlWDQ9|`hsIk>%z6)A zg)r)MMxJYK({|;Oe_M+1Knb9ZyC?L!J`h80Yw~U*e;_6XRgn|<)(k#uk6U!|cUShR z2CUQ0Q&!Xw|H*#)U|f?8oq#Q5O0^zVf{FlN6B69a7&X(uxux#_v4}P)Zhb`#Q+1k^ z)Lqp&as{{td=KDKDEsbEzb>_$bh8n>`y*c&4>{x&DgR`PO|jeR&I>NX~hs_ z=WHBfKWL@rH>I;;=)vlYgm}@NAb?|L8u+JtyMor*cgbjjs!CYhcq6R}pt%1>E)~iqK8CTe8ze{%7yn z3Z2aROLl9jhGO?=1D?^8?9cFmHQb#Xx4>rd-h zpK!LTB$dS<&Y!?P(E5SFbHdDgRX=>lj6x1Jx6Z!w*Cfe&aBS(SEi3$raZq>mS0w?7 zSR)s>%{Or`KpS@9Ui5_N6gWy4q}Q?RR(6{0k?UMOcD}oC#VujE3_P>fJ)1CHS@*b~ z3IWe>`!ZI-kxYdQtubzIc*hwnnZLNUbu|6SypSao?vyV_c)nNFFkzC~asH%t&p?+l zti#V+HBZOrfE_5BUDt#s?(Mh`_KAfsOx*=cXC{@eJ@MEHa~9!Kp8_ga#0mbye%Lc6 zhx&>q=um&QLgNQti@D6wCi7c~PZ+fDQn82zRD8abPZx%956aJ7Q;)D~cSf#LaN^b#u-%D_jkx!wP;Fw&_VBn;2<1zj2z46%yqYzL8IJ@&02qH z6BC+tIBY;i74L^Oj8ArUO&Lh*G=`La>_r${|1OBB>mg=~b&dYWw(E0ItE_Lh3**5P z1|Q^`P?s4(b=^N$8=0NG+fA(Pemmtg63QC$kAC6DNIIqyKs~fq;{1jGKu2O{88!w8 zHsxV#n=KsrUh5Kvb+cFRsea{Cdn+TnxM@5otylmH z8mOBTv$o4o!sAQwV1N8b!g)eAiY&%vrky)xobB)dQd4vzyY!>I z%JSpZ>@i;YE&N~S;F)J3)f&0n;g4&Kskr{PWe7iHmtB|-Gvwa5m3svD&o5c-h7DcgnvO=9f}BXgk8 zPp2h&onbtBg-fwJW0jsc%@b39&RLqnGM!?Fa_QrzTjHRZfR_8K_7Ys|NQ$z{ml^N2 z+}}TFGHhX0EjEW;_*gM90w0WOO;cslueT>hBf`72iP(na8M`b3VbZZ*t9d+VE_k^# zc2Da!bY-L9ze_=0_+nn1GAWt5Ed12(oS*IO4?l~5@-V4SF?F9^jahueuC0}8dXC5P z(r-!6L0HK;lv^H30?E5!#-Gtlo;yaNtdUP7M0?~UxDb?paSALIjB{I&00wal0~n?sVTmz2eY3yY~n{GMTn8%aoX-G ze-_9I7VD&An=;>JnX!Prr1p>Z&-|>Y*ao+BDfJI+X}jCJ|3iI$XXB#s1yF(p3XFy_ z$LUq3-)_*QP%XmNr*xQmb07iTgIp*UtcWLTtM~c`hE)Rc&Z?R-S%L z{U?9!b6>XP@n%VM<=gDKHuogI?-ync-&jUk2Kz!J`qnoN}X}> zw6d8TZkeMA&<%bFkVGv7;I3jgm)&^HDcFh>*uHczvn-+~OGdwa(**E)L}Wnc9;FsK zOBTCKVgw?MutZL4t+}H}VQ@e*I75n?e)5{|^~Y~d$~Bzr#{l(whM~1GY_(yc(1PQ^ zuC`Bbtsrv`%<84Use|r?`EJ#TPNaAFKSK;KYCr1Gj`XAXQD@>M_8?n93NG=z`y|h( zSf96lGQ-)L+VhbfF3>X(Ph4R5O&q<{?sIp3zo;AzTnn24fF9KJ861oFEQmZ90d6M% zq;U5hIIiEk+1?iPDef2hEgLO&n}2gz>b525Guyo3c9&#Bm9qzQ05?wb>uuIKd!f^w zDz(v@<;ilXi*AL|TK7)$r*44naO&xdj-VlA)EV`+p>vdr`G$eiC>-#aQDInjV z(`?JR5al+}S#cqb3}oS?dT`Qcab4ywhpgMx9}q+c5XQ=v{9yn>Gk zI#J^}<0+{zn#VKp6h`gL4KzQMkB%_PFMBO&ohiiv6!B<`mXO!kX^M0Nd@W5?gRbArn&Lauw#YS==OJ|S7oGOr)GOml)~DR$(mVbOOl3adtuDP~~g$X-Zhb_KIFJmlA7!lBVz+?z@+&IbI9uLipqfS(63FWmm1r2pqf ztvnIuqU6(y+4Ic8C*YkVC4wrcF;|;oj^#zzbE=ZX>(;Qfc+3}4CiOUz4I)GalB-(c zrVuXSTc!Z`9^YvEkw(kwX!lN_srADJvYGsz`EG*u2QbU?W$CriVoW2{0FV^zpUIZ{ zY2pET;HFN_EW5=Z&m#zc4?_51=efkzgpV^dKybZ}%-IHnDz0xMQGxc9BVk{>jj*wy zWhCKmoFMAGSxaxJNV%4|vC6BAN-3k2n~TF#RdK1u z#KqoyR3UU#WsT;w2(|4wrymDS72IRU#N#-PwndxKZ!=%>TKcCUs-1D1@L`E}gK3;D z>R<1aQz$Xpw1JK%=^+wHW%ChKO!*uu#9TA7QNL84krma5(CYc0l178Lc*m*_CR1Di zj6Ahil%??{Ms#CwziQGR8Eg`tVBGp=@_-LFh0>{Nv5l@KT6kyNeQIY-`6}6Malua? zQKj$?4_3H#r;lWtnWaI_X~MrPQxJ(<T| zZLcpCM{L~g&QiqHkmTK*E*lF?8@OU~_v$zEwKoA|TH$83t+aD~G7rQl%5xp`&R~~? z?+*a<>fWEew0N|cFXf!O`MK2%;J`)P5q#R4@?Ju>L*(2TlvJU28bUzs?-Vw(349TW z|Fq|^68L4QA}>)aJAx3_OiNsHJ*3j4Y2yNC>ldqzC)HUZ;Pw{Q`82&XNRP9&8M!ny z49~sfpVV}@HRJ0`p94nh zWyAp04r?Ml03`ZZVT6vL1jbQN2K}!T4wPKAQ*EKonu90G3p+d+#&w`77eMTUGO|)- z*N^KS^j1h{$)>Yecme6A*nRr5!qE!v82i&gbSAp)PiDk*4!Aj+hqc4AWL1seETO@M z&`vJ64%F=r$X>6W17z!NGXF`S5%ZjAS?#J!DpQTi^PKF|=HEQ>Gu^YnU$Y`6I3^jZ z`h(y)7ioJJUpkGVdz}_)d-cdjuFD`@S^B*|kEY;ZjC5GGm3bofBW`%_a@n;{|6bcW zZ=_-i_0=#_+`?J0WvT!2L~4Bep3ZfBLv1t^K@nSwJAW5DL%-7A&2#+_jiB_V#JFhc zsP@#D%Vj`tddkC9zrXE`@H>Lis}jY@I*uJZai5p!BJaO><2x>_?*Fw_1J3te*vla& z08?pzDU5}y=BE|HsKiC7{aomM2HOI2LF5|S+XvUxTKgQBiv;{qVG3bl=30}W_nev~ zcSn>{Zdnq@`9Q?yf%^6v4t8?s5WrcfA)sS376ai9gq1l6=A3wHd##gZX0@#9 z{gPv$bXMhK`%a&LWbc?>yu0u}Mez#7(V|4f$#9_EqfTO0H!M8s-XampCAzRG{))h9 z3CF3)p;kA0VQ)A>>{n)CWUGC~g_Qxt)CzrXC2AFuBjCoODkCijSdX%&%NRhF2J#85 zk!yEnH-M*@%ZUTrEWb)mkZ`a;yL7CzyLIx){MuLc8hmKH1~eou$}sBd#Dn6lCR2o2 zQx@NCZ#6f^rlkY)7yV{`_AV5S08@16TIm0#$W{G;3VTWBy*R?`_J2j$ zh#s@bLiy4V|@;^ zGGorQ!b|ySAb=k}_9nlDv(M@itW&x^@TC}~F-lC$#?So2RUTSYI(#Zfh;e=8N+(+3 zDh-%?j(eA7Z{Zn0TwR69r+FU;)~z>=PpQ#%Pe@pk?|)_kyz#b(6R!loMrItc*KnMX zcn5P(SFhS~M>QM>9jdrd{16Zwv^ZVw$gkrE&rK)16ah?(F16G^|u&F`$LBgg{3z>uZ91B1vP5YbSAtd{tyMKSz4gG#;{OVDfOYMUm&i6yR{Qr-m%V9u| z8%^A^;-G@Dip#1fGIf?rA1Zqmx{2QOu&D&nG(tWJZa z-T_Vi9{yLemFZ$(zD@RBgY7#V=uPouiq-5*+Hv4RukYy)XB{pOcYo6jSBDC>r3nMT zzBs#q0j%;KUD6*Iqyplz-O4(hk$|Z}v=Lu-7|n4UIeNF+=2(3MF|x+9X>%rMO>c2l3%FYlInYE+qnR#mSVwB+VE$ zEi0T6DJLd|{RFWVh+7j|==b^VQhq6hofJeYMSA1pi^H?TV zy58n*j-tO6duzr*QHFmD7$F0sIptoK!GomU-wYH1_KlkZL~$_G>UiORzmRp6Aa z-5GMwaIV)5sM#hmZ+M5%;pbC`xWG)5 zp2<(0*Dt&Rz3k@Ia0Hy&3VU*45=V9<%_fw?Le}*5`hBVP3&-4-Rn40hKk`I;$F!c?1Y)i zsbzzWsBt=0IUBF#3gvJq1QKlA*EZHHlsn|qUIo=>2Wd#e*sHhb0#q49?k8z< z;o(C}YCx#E?z{JrO&E{DjLC74jW>%B8o4u=i@M_NcVG?*-5?Bx$&tD|G*7e%7zjNX zRLcanvn$UKpNw=HtqfFwzno0)%0d=FUl4%r^g*Lr0eyRpUT`&|@o2^y3Gm>`2^5t- z%s}OZg_B%ual%$_D4=E8y{Mg6kt2~}Udc3ohahEYN$-IcJwIoV^F9|-K#fy>c#|;c zELw3w*X9evVwgdIN_7Tnp{K{W*QIPozM8)tM>B@|1_^urHa_XE1`S2rRPC-gO#S>2 zS5JNR1`xc*m4@}hG=e|TpdOnwb?t9aG88l8(z*P;U>>->RR0){+3DMYQFOHii#X37 zbcZ(Kj~@*i3C6=&*vn~q2Z3W-Vm6m}fX^i9HHXe1kNKL|2tGIDyN)+@oq-wbft2Ph-Zuc)C&`97t--f1pv-@sc;U9^>4E| zhYJU}$pIOU=I&fnm41euf1-;hIlzpY%t#hmX2`{oqM2@#sdvyluK!y2ErEGpRGR1s zAw_pN&ktaf>k~>-)#q!5S|yqOz^{-~tkCcsaWQdZ_g~eo?G@~1p|U;{h})z;>f2ah z77f7w=U>wr+Klr8c|9~MTh)Qh(Qm*41;fQv$?LO%z*M)CWm?WiU|X9pILT)O1tI*N*rmT90fn&d0aQqmcX4osumu zMTPvHP&eRx^llR4Xq@$=w@=G?6c|WsD47j)7Q_oS6)85o_;^T{T?z-}(Xu0+07*V7 z-Z(s9k1{!XvBTQ(Lx@k~8at)moJEknWgMe$I3yJ=13hLbI<;TSV)EB_{W#vkKgu6J z8T&-YtEVuwXTJT(@RGt>{^@xDCREx0X5uVXwQPi5du1iTT3zF=gNzNa5FDt??0u$# zy?bwbES+97I_15Pev5vUdYemSEO@q~deBz@Ljd}VjJF@7lI8w@Nr@siBx1{~f;=J3 zLL9>V5|V37x(|b548*%P0{4y8oidb(|%O2Vviz=NCUuR{gvE?UQ zAMh1YYp~s@OB5Z@3Jg*ewHj^HEhZ(f>COcC^+r@uj*fZicGhE&C~I;!@RdYO-B^%6`bL~d3&K~T#N`#C|R%>fL8M!g!INP<3ACHyaNJg_RoBFFWa=aeC+g}^Wxe4RBv{9*|HgX&HLTsHM$L=I!>kH zolZZDYyCTT(8Jio8Mj~8Zm*_hpw}Bx<*?XWct9POHx6M(!ZHqY6XSgs6X!5AyG7Vw z9_8tF@i*T$-MmXjeQrnYSH$mbm-b80AFObkC$4e2_cvAsvwxZ%djR3qzzr9M08SwB zBD$D%NdC?BA@}E?tQY<`+<<$875&rcbgqVOPOf+Qi4=)K?MF$S>zO+&NxlZs|Fi>7 zfgH%AR{HPKyxwzwB{h0z;!u+3&cp1?HClvm`_FkJcQm%Cq#XIEC0Bp$P+hwt(Rz;( zWpWl-HTr}jrkS7fAC_=@^HN0a*>8$+t+1x@1qQM8WOcaP+fOLvj)T;hTlbnXB^Eka_>+1;=Lgn;54rnlO`|j1=vV z2M(%dh+TB6?|ulu{ac7J6W1;KS=%P0jU-Vqf{cDvJrrZh>~iTz)ocSgvg*D{qwn^` zW;p87{4@a-E&@mjV{JkEY92>&k|E>BCdi%w7-AD`8-mXTjLgV!jjn^TNDII!(`bOV zfR80A1nsnVOYTMX2Lq4ck2aspA_>;DT74uC-S>$%CJdcTlk-yQ-v#fYY!6t^)Fj@P z-_!^@!}h#@`)1JHTlt~|moq%m&f?;|^x}KRs|E6~;a~px8FLf$miz$~hyiN7l%utJ z2JI}6;-mUJ-R%8p{NF2jx zBquE%|GNj#v%5jN)Z9N}GopCe`OD!hu5BY3m?$V^uI@7kJ2rtP0hH@?+Q{*==l|mF zEu*T6x^Q6&P*O!oN@=7!4k1WLOLup}q3a+b4IC)d2b#?@gtxyxfs&G4FanY){Dn@scWMvHa8 z%~{OUOx?@W?E2hQDSJfjo^|DN>rC0^!DdXb{K!@(*{yZ^3TC3pxk^$D`L!(}7}sO* z0#yTjVkJqE-LYOt%Oi&soPW=-uy(zd%Pr^Nsa%&P75P^0wCe?(Ps_^pO4Azo1*@jF z3#L!TK&fO){Stnl#_sfPedCQxi!04)=!Ii9tV)hg$$H!&XS_tv1+speL+oG7fR0>9ospAEovcHCrZl(h)qGy6za{c9^H5JEivM{eOzgth}<{ zm-rG{#(=aeQ25QEr=HEDeS*?><^ETojL|b+QecQEwSQd03M-8EU5FNv94(E<;M0W- z2cyUQx9E>_)Wt~DWR4kqvf;-_N;UCA>|@y9))&4{z#86lN?hG5aZ@8OnuWU?=)1zcb(MqHh$GWukPF}Wh0EsJp&It?DlSdrb5wMxH3Q_lmV%0?A=njtv1p#+1m60i8KmlSOeFs zXTQ&yJpRKqG5ixnx;MV=Ey_5hRVpIL($b;JFR^-a1ZsV(wTU#p7S)gpdJiAaU_Z!f zDV=9aMm9>A!MEReVB=yg3N%${URqjrKcjigq-s#hmt4^lfpC&+bPfZ#Kt<@;%a3E! zpDHP5#eR?Lh|iXhBTDh+-6n{~_lk@=7~YcZ=;CBiapz8;!oLL7x&QhT^1uU$m^bIA zf0gbw-GqM<$T(J>hw&?r9u{Do$RmW1zGUDDKy6=GB+C@5o!7%?0!If-4i6!vC#AlI zxx=L&$z8kAL&ULvaR^>kcC{O(m*|myap8Nvi+qHrwf8lAh`mcL{x@M^`TVoUm^2~O z-M-1kh7))WA>7{a zDH&1Kv`76^)LXj_)V`hk`&HkacRzYCz*7pL4@P(O4N{o#HY=XX*nV*JudsehUeW)? zjd9(1TOt6+jZ_j`xfId(!Tvsd?bt9wdi-L$&-R_^YsCYH<7OUY(!(aEh5xU>a%K3< zA^l{+TyN#P5_an9qais@sRx&a7md1Jg2HbH+GnodjCy= zH3v)CAGN^B89~YpBLgo1nU4wK2A~BC=H>UuANxIs()X0`(-mI99aZ=%hlX1+3BaGd z`8|Hna@`@tr*>AXVNvb4EcmXc8TtQV`2PQkG#^u>avTWkoL!bVq;KqfR&5cVq;c-1 zTO~|cZoy8+pX!Wy4#oZ#nLYW_FLu9lg-0y7ep-Z?oVRrNh8vfyy7^j&Lr6o~(dJdJ zEw&G!s%+jFoUOrc8FD@cJ3@)sH zep>dE^i=k9(STc(l-Z9VTVHPjOv|=n6|p!&OE3 z(YlS0h<}0f5FsXIHjLNo`LR#=WZ>R(e`qR)4URm;_chAXHQu1DL4(6 zF^nLS-%>{Hcay54v&{RgkNT}0_GLD2{Q_*g7bn=yCnzQ6DuZavwYfBRCt0c^?5%$7 zJVFobG!uF${M6?x;m^+cd4SrJz`=25;l{LZl<==S{pSvtSY5VW7peOXzcqavIkNbv zi|^{YqM@@G!y&^5KN@%+P;J3s89Xkpt&OZy=I(^^yDc$iRY_I#5l5kRQ*2_N&*6fW znzrH~-Fic>a!YOBDFZ3~^$m=}(hWBE!`fo<~0(EWW4}ZF73-e)qA-N^S ztMywUw#|iF;!?XzG_I>i?+R2Z%2vhpFWyso{-OKS%c^2swB*;#~+ec4AWl-NGP%d|L{qy8a@trmp7o>pBN^k zrh1ENoa`~OFs)pup$;i+g8rCaEs2)zqC>wqR4u!@)E>=iU_8pt&txEDwHW)Y&=4xR z4%L|oUZrnXyTgOD6pWK*<~uEnL{c6zA}<_k53e#o3#*NPRA`n*n!eNjp$HMdVW@gM zw;PQ5?wv|mbG2XMIMufzU8lW@)yCT9pmCw@=pr@IKlM_Oiirk+2O3FwpPC+D6D@bH zuJhIxj4RGOqEo>sv-xCNd*rvu&Okcad!O|aW?zggz>K?Hqf>a_c3PZiHiyw{P;d0? zxbK06Ij{G8FluZ|?Oj{iaJd85o0hzlwtFVJcwuX)L7ekUtNE8^7TMrWiy9T7K}Jql zb@osFel{2H#z`AahChf15FlB$M`{X)Avh7x;WbR%>MANPwg$sa98f)uvWbNCTN@D#>yGGwv`#@y;#1 zK5&K$NmyP0{OcmW$oxruW3-5*ijqf-D0X(KE-FiEVnZp)^!|GNP9$9#AwYz0z(aAh6}Tt$LehMRECi9BvaMZ zJ&Gaq{$cB9gG@i0ezRz+LPSCt={_H)Y;q8m%))wqg~UT)-<(&`=xsG%n>X-soWge+ zF7|r|#*1f5o{P$*o=CfUV>pJY&85ggy1JbfKl@ZlEqcXbv0iTr*IczF?+6{& ztF|8D7~`#fXM(#jy6Ql&1Bk9Am92{S;XVQ`{c8;A&U3jtkyy!_2H<50?kRVz0ov|@ zv0My-=f8{z=wjPL0O%e|l9S)<{C2(SeWO~OK}N>a#w;_^I4?Wl9?%dNI7?zNE--uq zHX;0k^)(q8lw+c=*BxI$#OPIl`ZZs_E}!$B3z)N_?+j$n0-ArbVN5qvLh+W2tR`^{ z{2%-}e7;m8{{BdWIN|@=1Cut6-H!tZm(&9gW9-Q@h|e*ns(<JC%~3z{y&u%&IscR=8(( zt&4ZMNQQ_`y{)lzu@c(3i>G3#k!OsGRHHdZ27b_)y0RZBx+1-0VLSC*$-%&lVkN2^ z-Mp{y(0e?Ll?sLSj)uNdQRN$+PHY`fKqiLRJsKAf+_>15&d<}}cXgLS!gDUskm)?a zH7OLC5x$GaOD(s$%OVV4IYpaT-3vY6 z%c3J_MdOX;ntuoc{pwceID5Tsa9xMjd(8)qB>>N+)KP)A#tp3ZrLi%Q+(ll_E|e8J zhxsDcX3aZHIFzOKZ}XpDqj3t2m_x-+)O#m%FE`}~z!^FO}EXtpJ6Hjc$=#zf3F z!J*BKeor4>UU9L>Tx1x1OIEu^CzHl{ zJO|CTJ}0J6ZuTfDv4y6VIG-v)!n$M2ZrX@qSXJnCyRM2pIAs=0);F*GZDzQYF`KMh>9}u?ua=VMfpD4?!lTN85&%mh@s)DCmb|ZqGDWI{ zJ6CalPyn!5HRGA$zD7z11 z=ryW?oftSixt%U}o__ZzLV1bOMi+t~PpDHKsa#T63zKdZ``kjd0}oBa9g1V?_yM|M z++V=7Ij#GtDlynew6LI&Z48mwvpcIAax%zs43igr5s13S>=wi9mi15E&9c<@ggJyGFqtJ9#XiHAo;_J zM9MXSgX`qY!gHt5LgT@ZQlohpktstaXj$^>@nW|Z$Z{BUo};4uYAqHU9G#XL7W$H{ zes8ovEb1PzrBCXPj65yW;J=ujm`}Bg`nTC|Yzi~MR@yy6eTO^X4JtdJ;IL7g{;qVYP0!DIpZ zo?%-WGu`bc2pb}E`Dw|K#o>hL>HmH&{eMcd_`j(izhXBYiHO*!u)iigawr&c51~UC z0xz((I_ryXEyMRW1!>=-BRN(CyHBgrmLf`EaqvVg8?~+we=^s0mA{c;LZrx(rE_wB zjJR^A9}mRGcHv)N?#j>KER?~d@cyS3fPR?{8lUhoz?(U=W74HOO`wpT9vaDhLk|21 zGcfyz88JCc2AMUZJNwg#kHiMo-glj-Ti>eNlzpouz{kx6Lc-JyBLgqmiFN|NM{Q;? zPrca)|4khD7q^U=zq@UGm)fnVvz;qd)-d_nvxaYAk(X&NgME*&TK|fChabDsyk?>L zYd-&8r{K_s4r^n{)W_jS1A1S>heUe%?Z0m`bI-lV;&>2sOzb*<-+V_iI47^by8Ei0 z5&6W7S=h8k_*=KIscqnRMbnPOm*&(rni^U+=b{Od0oPO^fjy=2hynQPS4AbJN;q4* z8+u!9YGU%+xp_lm@LMLNn1m(vz=YzC26cW%t^Z+N!TP& zs#uhV;uZXjH6+(JY@JUfr2R zXAt=k{h)o=Vf` zv3zyP*1DcGli&p-en`s>kUr4C0Wj(b2>z4P5bn4SV3B&7Ih0(w~R8oSmMJ;hF78X%oV>nyQ285%*u{eE*$>MRk9j4h9oON zM$j18Q+77RogP&aEGkh1rP*x%+H^ixtur^u zF9LLc0YQ#=;>676uSH}N*)&(WEwFrlyGT95yytC=uWFSt{`gGw`s*`a&Lv(7?A#1P*AsB+(1J|*I*!+H0Z2z?rxVX%Iq^Rn`A`HEF zvZlXOI*F;@TryQ;(Jw3N4CZ2oi5v!?N6y8jr-_6oI3gKjO=4Vqpz5`u(?Hb{SvkuF zlS;vOb#*n_=*G6+c#P?;*&g5E?XYL+ zuwX@~ z{94!3ZFA-A(5uY4x^Qx07K;W0>6A5n^X8N;e;pl5%!rt^m0ntj$}|?*1ikfzG6AhA z^Ux|+9^&%F4Xne0dS`+g{DlbXDvfFcTjBS3-?`Xi&G9rH~dhpv2lR~wnGe5tkH@X(QY>=qu7grkhG zv&djKjL7IK2;#QCdHHCEmXF>0S+19zTysE;4&2{m(@3G1TQeHVrSdqPAqvh=aadq& z-GMr5WsB}Ge8XNJetO^>7j{+rJk2HNa1AB*W1{h*PhV*%LoaV?lTa2_EocC(!DZZX~|wm*6s^iAAJ9mjiGy?>G7O&(oXs?d{BNw zBLA7-9!A70Y3CkP?*apgM#RTF*xMLt1#|q>KW@U5T8W=sXRahG-8r|mJh-gw=o%HD ziqx7#pes}~Uw!eCGWI4$tu9GRrjnO)C4hqRDw_K5!M?CglxSm)05wN1qjj41f%$U%=j zv@CVKF%ffXIivsfJqGS-%?A;TQ9XA&=x@(=4L@gvN#e$+2w5YLYYhACOM+U#+g6%APwH$hmNsWJ zV?};?N59KKkB1rZQ6JH_uw0JVT6#|;XdV5fCA%n(UHwzIYEn$rvgl>Uol7%2h78R) zS+$)dP3zRuev~*NMg{L7I|{0*u0ERg*k>{9LSGw5h}wWMG8@V>)7LU3HK*)28;BU9 zH<8r@wOcS#nWS^*9n5BEnV3%E$E_KA83wW_vbhreQ8u5DfIX9K!dc$i^O>dg*^VPrNyM>^2}1F3;usW7%`!M4BpVk~S3i@-qE7 z!`zD-b=kY^C8FRFYd)8fB=i6YcB|F-8;VJIdr&H~IVa&J(k6XMa$AB5srEOD=E%(z z!6f12jc@iYslG-9^RcvKtS|A`FdC7T{@=J1G1GCl+&u-{SqL7JN!!+S z_8RWF<`T}MwjYf=Y5zR0$l&_8;v%F47E5=%r$7IbH;e~H)Sp9}7aZ6VR;MDXBCaW7 zGhJrbJy~Um7ZVe+vbsuHpG=2uPI=SH1$%EQcTagNB2AxVypH~&{9$CCCk^SyrykrF z5sT@-e{-#F{K?#zsR zemCxqjR1~)0}2v5G4?83krn^ZiHYOI0Mc^ckNvDbs!8|*G(0gjKR*=9pqW=#NI_0c z{$~|LwOL$1*R3SFdw5LM+LL4PpFF?3ybNLloZd<`qB9dGdky=nZbwF4;iPFB3g8Yl zbci6Oyx(+AGBq_dki^CGCmYd_Gib=@V*n;`Mny$bX9ym3{VQ5HK1AX+xc_HM}|H?_Y(;s3>ghU=WV; z0Ahd!SXfxJZJ)AQju(o=fswGj0|T7(0Z5?1Wj`k)<57sH?qhKL@W*{y@T?CesX%D| zs=+_w``0qasOs7QBmm9C3wp!;)8#Qlmzja1)ZdvbGcq;(&uqxc2x+ch{v8=<2WFhW zWvla_lTQ&Rzd^*$tSpiKO9bM11lG_caC}^)zP`TpdavO>{UsJcTn~y=gN5o9rBhb_ z#c0izX5zr8+>0t+uD zCib863=!wC>XgKFb%_lQ0v<+!87!o{$@$(K=wwuK@_&|h&#YPm?+sadF0kS1YR**m zt$dNVm!xGh0=8I9^AFaZC++ST{Z$zGSdYW-WQ5{5r-Wp=-WVDeh~ZBW}@T#SL}+UJ*KJD0-H1Y+os*U_zu){hct_zGGm6gS;yu` z?&ikE0@y*)j8Fl8`>Kw?wc$}C{H1}gPf|HLp*Ud^(Q(^OuMH}_ zd?KW6)Jg0x)Si`TeJT9;3)}DE9t;CLav677q`B>FC}XA<>s`$7emaxbZr+`9z@hnv zBNn;L)*tr;&DT)Ylr@FujBj9rQr=q8oO!{ve6FJq-x?JaM zO+B4m47+Omif&$pbaS1XudZ*1tYve0N)4)nXkMo`Q;JAEmxN}x&T?kV>%giRI+E+m zpR^0jyViu5JB--RNINGVICyhrIu--AX@pycyRUy_bq0 zRMjznl2_=Xv9Ym%L=LnNV|FHrR|dziDakyr_!iBPZ-ce$*024Ax`UjxX5g8(Y}ujq zTJDvd`q^;8g{sVlYrN!7${c=VC%JW!oTWWgh~NLQX7~NmlYu-8!WV7&QT}WXrypbD z&c?Jp`Wzou<0X%pK_x$uwP=TByT7^alWk~zjIw#?KjoYi-q^@&{Q~bCZ+hbd89&W9 zw~-qUd>7-Ua%N$QjPM#F(ShX1pJQ1N}}9bHZw%MkR3``*PGs z*tX1)BKn$u)&)sh-5|)Hu!BTsXlW&Y`BiOp!&gu|v~IiwJ%fa6{Nmlz|FWZp#;4VI zU$k6q-ODbe>0EsHi{jNj#j53bn=ak#ofoH=FHu;_h1H#o39D`hSjtdpW}XvD9D4&t zrI?B5=^fmeeRXzvR$4+nK)yUgeNM49e8S909aPB*@zMLL_AM$!{E9om(0Fr}{_Gt2 zVzrwkc4%;|`3uEtm%4!2NmR_@(q_3MF3Cw*E;b2`l%Zr|5X4Kbet3Y^T%>|==+7Q6 z;Tu-Ylzn=qqqAy(={BmU6bU{7Heb&GlCQ5`5Nx84G~TqRsPfv?`Xr15tkc3?5C}wk z{Hm(!72}77r=X@5zX1hr-lDT~bt{RJ&J|jjoqbj?CP|OGd@~WRulAAE%h8x=fvM$= zK0mXrm5GduysZja&O6QeE;%34vlmWya2~)kW6&BC(cOlE7s-SAVFKi%Ag{?3FnUby z3d2E5Z8>3Ufrt06wlR;+;Q)LIe7>09c}q(o{I(k_fzA6}?D73aLwtOBriL0)y)Ikt zsC(DVnP~Le;oGBueeZ&sOpD zh*Ycot-|p7zDMHijP6=U8l)3mc>CgfE&N+mfXnW5CqNXvJv|>CY1fh7crkUh)$1Q5}c*rH%ge@YKCx-^^nsy~dhNy5$ZHv8ROVPVKR ziCd`dnB&~lqX2b~?o-R9W@TiMfxX_@u-`02^U7drG(TCuD>00ai**I$gn`rUwX}I^v@twhTR>fjf{+ZaCdhn zV-f;G$e{uEGpQ0b#csK2P;oY3|d9xE;5=*P9&5rlo=+5F-f zny5zaKfIpV)Re+zI<#ogDalBwnPl`=|rsr9xzdPq#=W!m!F8OY6UxXx;U z)ZI<>m6Tp06~uYxM@EK0M`JS8>oDlqj{5ZU^v2#^*Y@elFfj=k8A^Ws6p(@}9J(I3 z@^KNxMny(WR+wS|JBZKeeT>Ct=O6^xTFCaKeN0|Ny`)9(I}{?+4S4KejR^-j%;pYvj*k@Fg6A? zGZJ!g)LdL~;NG5FDC}rxXteb7StTX=*hMriw{PMx_HQ7Dd$*|S5<2s)r)d|fLne1u z-kuR{PZ*1dQNMD}nZ6b5?)o0S;-5L{B;F%a_IEKXGH&@7tRUpoiwJ!Oh%tJE{_-xC zLFo5y2Vq-VTT49=4nnxNE$9nLS!Da3o5n-BTZsq3|k1iLQq?(&LKSpKwo>XgdY-=flRnKrCrT!jVYU|9x!kt*b=dM>L=HG~TgaPIS=sJ{C zFcla!5oY%(*0%~Xc1dsVdp~o^9CL#*wX)a9Wgqcv@yny=r3aI~Kq!O09Ei=|EJ6lu z_wZ_=WRjtYA5wOBv6rLqP^ohdAR}5z-lM&QxnxGQyPo>~zEQab15N#%vDzsVcqZ~j zo2#xZF|WM8PHeYJzmr+)<)gcAu1E^(92&@=uy}oY;-1WxVDfen-VbjfY_qI7%EdBz zAuu)=Zuuz7DCZ!Xk8Y3RaY*Mc6E;S^Ny06(qrQ0(4MR>?!Dw%Hm_SaP@re3_#J(Dy zi`$2rx3;(Q3kt}IFcp=Q zI&LnHm&fbwvWPHIs;a7LwHT#GC~!j}B4c|gTwL|01hL-)HLMBrXuo$Aqq>Dpi9h#$ zIxUY$w6&IJihe)wh){59bZ9s!g=n|zpffumIe*h=IrX{B{BusZ&|MVXQjsXv&u<8) zeNX(X_*4?xN}N->czA&5Q=s`&1lPm4%I*zMLP;z|)ZE-~!jBlHXphN@dGotfU*>eS zx51`4e-7>O1g-5OqS=3^b8)wPk&V~2wpun5do7jxcHDEal~l(0Agx6ph<~nkY4m|* z_4(msGCk)mf2XAlM3?@LZzgc+K;6>wbOH_^1`LhsN`&~504OaP-{0M`b8sv=H_$RL zWY^ZZb`&e~n+_3W{Mn$iv?9bs8?TuAP~0#Fhs%u`ELx~8Ln+JjJl`#s%dDBUi5J0+ z92^o7Q#(e<@Wuij%|@klK&~6&wG)NnY6AHEliXw>f*a4+>I5Yv?0M^OdtMuwLQ})a zDK94lw-#6ViRlRm^{*yh^|5L@hB=frcS_YTJyR_SVxUgYl8O%3K-uCP^wDK$t2`Hb z3Xy)jtFk67Y1pa+5xg9<&yg9{*O(lRcptiX_tdYGK-zxOQd`6*>o-?<&(j*WV-qU5 zRB2gR+1V~;nW)Don4f?X6B9#5B$ae@bT-Qvcm-p@WA3Ylek{KXDx#oMQD0M|jjYxQ z=TwkPD&c)-m~|S?{iR%sdhqK4G&Q!ru#XzYNfZrPfnN9aK{ZR8C!{ zKz+TEuI%t}q1{snl7S2MplT47qQApQcQ*o)%}El;V0j?Ch@a3&JG+cAg3sDJ=xirv z5~|CE!YordMbA#e-QRM79y=Q&)}8QllU8vam3K)~FE-9cS>ck6`Spe^PP<8F)7^uT+b!a* z24voL|A%uj;$|BXEq!=tL1XOksj1RJ#eU);vnvpc<_LXLDXG8#T9Q78$TvHS*TcEr z)1pKUBZb$*ce1hwJdJ}=_)W>w3X#u}U+LsIMp(TsnfuahxE>yx!@@I_Rb-}DS?2(a zU#*O=7MmP>P8M(UT*m2eJ)FDOj$p;u!%kBMnu$x5J@e80=+Das^vJ6f-ONs*k8Mkm zWJ6-IMQK6G(N;;&VZeM6Nd;6l1+-@Ud3uR@71X*;lD}5@Y`T95k;lXLO|Q>(`Hp(X z?Gx(lmpYz-MAdiBW*u-?lw4dclieR*kz2l&^E|`K6U1&>IbLbZ=er$CKyON}7Siw! zX*gDNwfoz7y?er~rop?>I!r<6w+_RVkahmD24MzSWr zDU>Ho^1h7Y!^>}jraZ95|5S5qJtTe4OYY{=;sW=IQ?D>#0r`+Vzpbq;Q-kwvMnglA z+wmF;>}L1+-Bm$3cY=WJCQj?gwAHLPeB)9dNLF6TA@Gz3>|E}mKgeTq8%wuF5j3p9 z8DftU9y;0b0B{do7FDdkwdq4l!LEikdyS5dvjSod@b|1%>mWmppbHyKehXEkqWAnN zsEvQG%wyvRs1t#^3&T{mwFGdTq9Qhk)o-Y&1BPK|6}5Bjcy&Mw*9ew^xTu8fm-syX zd030&L8w3X?5nqQBW($?Q9+`Nv-Y093u|iP7&NO77JRWV`_c3Pgh}GGCVT$0)NZlu z504C>UyQ!K?p0J0Wen8fB&2xVP=-PZeYbBSB#TtuKr7o}O{)OzdB~JQlxp zv$Vt$*SJz^sR|f6FkWxznk<{-;KWq6Wbf0oZ4xy%r(Ny}YpC-Lu-o|kcHVuPK|xW` z?WmU;ryOuBHY`q+#v&eu4ulO27*;0HEQWtCZ&4xp*1Y{F0>05obS;VtM&hR5*VjxB zqA;vqDI2k5=B8yn#1s47Z#(@VwBPP{stgy_Sb?T#!&*U)47qA|E!Xnw(x-%ucf*SX zWxP7N?%nB$E7AkJt-eJX)f{!IBNH&vNvNPP2J~KXX`XvrUtEsEUVkX991!)03g79S zQcE2Eosio5q-23D4_b$VphnBF-Arfw|k!+CpC^TKQy2;13cU+CoT=hQItq-J^% z@$cpCFT>_-5259^?Du6%A4SWO{K>U%G@bCQ_37x|DLivJ*9+pgD9X>z(tl|`rGD4# z*_Zr3wE(~H_kvyB?%y-PXQtXK4{fw^uP@g5n<#jgnk9Z4AO#*CK}_??xbu2~4vrag zsKTZ6k7Kc|Hfz}Ui^9EUXS=mUZN7x@-)#IiuUD-%AE9d0VG6-zxLR@PXGbu4+Y=?Z zd3k}ksqT_*fx3{w2Qe~+UVTG@Zx~5*LCHpR#M&$d3AlWmzC?ImBZ&rjnJ?ptygWBk zr8!4WzDKUE?UlVHQ;FL9+*)`<-*tAf0I?+ROzBt-$6c77>1=797~(fX?=sTpm1c?8 z(aUbf%M^?ii4*MmnxDY;oxo^)?HPTQ&x4j+s4Ek8>QfoNaJnN=Zop5PS!_ByMhYcA!|hp=V%VB|kT{ZTZkM z;}}s*Jdpn#`(n_i7X?zkIY~+$9XmieRC8!c*r3+*HkjJrzz_5{0J3pGBixFP*Z94GMFsH{i`6eWieddG|`ENn{`|fp5b^+A1d?gC=JpyP%jw%(GW{hgDsE# znZg7y74_gybaa8>Xf4QxUK0|kS6dM{Uk|p}b!?yNs9^)XaNp!;r8n(D2Z)_|4p;~J z(;gAF`LtsUBnup>jFPhk_PW4eMB6LUButKMv@^1i55JNV@e{t~7?f!C&}(`ByJNBR zIa>Dy*PBigpHI=5DK82oa8da=rQ17VjM59JJMv*sjr1r4oKelCLEScQiM|<7sh1fl zz)8pgg@h7ua`pApFf!z^+nIwp=qVuRyzauudt4F@1hv*GtdT_>!tz(rXyy`BRixz4L z>DhR>mIQF5!2RVg{6HyuBv-D&beQBz>l-$cfgf2}6hkoxQrQmF3hR($Q~7#9kK(!Q z$&S|s8`2E{qs{Gk!R+PbC7mV!Sm?jpstDe^T|!8c;#dg=hp`oF{hqi#u|DBxtsHsT^c;new zEfUy;KIoT?eJ8l=B^Khc6_8pXSl;(?w{sCfQ6tx`mXhi}H7L*N)mpXi^ z*srgyxSh6Mf$a!Z;5Qt>IFON(`vwQ2LLD4zJ1GGd{_zW7vXZe;{am+;YQTUetvCg) zHpof5Zw{q&o-Q9>ZftL7g8IeUnhB_q*f-39azI2vf&{=(`z`kZARkks#|8G()6??< z_^O>9tH{X6m#%)Gt57;bD5NFA907NR@8`C(kdClV0r$Ye!!zrBfBOL7uY4 z5vT|Fynj$KAqB{M%mClsC~8GDwU6%Zyeb7aB@-dt%ld#o$jZ%KhSq^^2DGZa1MLTa zsmRn}#s`N3zJ0@-o|!px2fc|!dpl`S1r!Dc?oFVx+T4spn9Gj5fYl(!M}LWq{Orji zU}iv7P^MATVZZ|Bt5pv$@X=`N=mG8AMBfNuv|$KtLIC9K?=C$B5Ml&t>(2di!!osx zApHg@@X3ketPPiJ?r~&35gH!jN*LGtLQ&0pn?)5AWQ)ybRV9muu8cbl%>`atqqM+< z0P_YpbYxtdI26k2^Zqk7wJc&eIt^M)Dk4%+WOQ`q{TOQybtD4x5%$6DU7%%r%$6(H zh;tg~X#fle?9$;LMMLWy9BiVX*OdZxke==X(on!RU?~1KOoicw>MlSF0yx zX8I$@#m&HISE2F>3T=QLDx0#|6`Vxaqb~~9(y4m_yZOrslfinU>&w+!z)Y9{nFYxE zz!*RmK=G`mQUy_IB0)@^Ta(V&-dukIn`zJRu<3NAxsj0(MLqpcDu2JvW0Z}Z9l#NN zSz20pd%nG~QG3vq_>n?bRu*$4M~0k@?RXrQ9xQTN{Fmy`cYvPLZg92-=G_%W*qzMd zP~0%@M8?j^dGtq|G$J{90Bk#8ysC3GpmO2wj||p~sZfg*c5|VrRs@FV`4aTUf(YUq z3brYm^Nt#*-+qvkl+2K-FD8aK+udB)<1%PC&K(d1iR2X(Wdk9M8hzK-XV^3h3{9&e zdH|8FbZOC1Z@0`tH4m

    Sa9_VFt0c8C5qDc^sKnEBzA2CGt*1LF*<8>;1+iOusA7!FE*kis;!eX zB6Q9AyAQ3`;*64Fc=GC`CaVSR!Jg`@L}tawy-BPh6`Mj?)eb*`?@raU78NFLG2Lll zmoW((rW}<3qr}WfW7DIXlE!w7MS0X=F0+*?W`oZTeW@ZH#rk1UcS(rRu!6NVE~P*8 zgN03b`-%d2QFbIL)n{&06XMpcW8MEy3nDTyvLH!9Pe_mlJ3VG+4XaEbSSF%f5elT< z@-L|8tL3Mg*0?`ZBwLZiL5wgk){s}nFlm$2pyN>1;O|XiQBr z`*!t1oy*jC58F+biBTNoaaHbwZ zba|rnzqm&uW?W=H@*yR#Z^dU(;_2P+-SB=k22+RU55v3&cm&qhlk{b6Lg`6jO|4u| zHaUiev$lB6;vWq#mIFjdAfvts?2@5(-aaslV^(vbbyVh`k#?X``cxEu3k+B_9tA`@ zvWFVF{cBpUO9w!T2y2i+e(3w`Ozwq{Qbu7!X%S;0qD5@JMslz24q;pkRYT)E0+7YQ z1u!WpBUbh{(=N@Du~|V>HxVMTp87Sz#9?vKE`p?LRBQxf5QSWxB(Wo~_v=V8q3$b; zzq2t`S-$UFw}0Em1;Ka5FZavCBE3FC5tY-Ol(8x}UmW(e%R}r(p>4l)f>MzYX?+$w zQ@mZ<-dRN)S>h(Dy>VuXZAn!X9Fjt|6tChxJRk9!YL;nt{_RZ!9z;ef(&Ua1z3 zT|0<`fHXq@8wCA-6MX~a;NYO^;jd0{NeK!Jq&;7sidxPG!&Vh#dr?6!KL}}fsCJQ$ zK)wdRY}~J67xXQ$&HifAMBe5|n&&Xy0jt0Mm1X@yWCpoEj^8e(&LO?->UH$jq7;|| zx#MQCO+?!wY_i-qiGG_K$TL0||GfBARN&iIAIDqdE58r7FRz#uSMB*9$(PA2aqUPYH5EWtc23JGu>Kv&mHr_zh5R|D1T&*0Ha*GB8>F zk$I7>8;M5it(NEyYv?8BL}Kn6-ok_|40NuG))D^??t7jkaty#I?KH;{`aBZg!XZUR zc1ie!Pb_#Xsl_xug9PIv*m5QQwfLx9(s-rBV4 ze=y)P!n+8xCXp<&QFBZRhEfVOE@}h$?^@I-fC%PXp>l2BABL=&@Q%R3(=kjqN@-Da z*G0{A!)F;`Dw)!HR^*0Y;(%J3p~8eLMKG@SIaGObQ}*O^XR#yjq@~|WZKkEIJqIkQm}i$mD30A|&{+$m*`-tHIHtfOel!(gtZ! z4Gc8`;7@2w&+5{!QUGjNE!MdtybLG`)I-!DKjej>CA4IYAa-2jTmm!#0t7zyY=4^zACT z1-CF1IDuY3cxzh6Uh|MTkh16Q8z+%vcZ0M7jV#s_v8%OEjJ9CPWN9KY94eZ4uqKhZ zH=`oxKQCm>A zfi8i)HrvyMZrp{Ydv|{wC|>NSStKWl zBe7D=M1}_(UX^|BBMO#3#6gLcszuTrvb3^7M+psBzQH2m^UA-~s6}DWn=00tDwxq& zVIt_^6uy4=;@iO{3fM93F?6e`=MYp$LjRjEKfJ$@>M{BbY^TqqR`oq64y$^bl{TK3 zmr;>may)f~8zh=T?@M6+-T9NLu&Qa?jm<>DtYcNEg})0 zSk|)W-}?~yY(d0Ue6qmk3MhMEU^w<^+2f)hqW&?J^}DYH^Sgqs0m^M$RBh22NSCAPxcsd;OCwzG=NtzH z2F`NZi>-$(!@_2oxs!B+oYp5YQY|e7Va7R*d!yHhTmw)U9ihQubIL@Ke<&NBE^yy; zqf5QI+XlkP96^0<*7aj;DLPaLCeU)gy49p{taYPKCtlC=C%whsAQFgb)NQND69sW} zaQX}p5pq!NyKi);C-e{=Nfk3ws9mRLfL2u zx#N@aW>y-GX9DNFFU=%kVa1n(7y2?457r)hPVe%J#HGJug4Kr)Bh?($I^Afx&T5k%URAvdFfbACFYz{GYp4${j`T^!AsGRn?lR#bQ zOvZm>S^cNYRpr=eA|fYx8;!PzJg|p!>ut^%&5krK7IJ09&MbI>PdtSBx(Y1_#1U3> ze;a(HNYN?^4G^NC> z$SGSgheMT1EhULeRY_$vS6}+GauZVDUDQjR*7S%9*38-ht2IqGh2?l#Ewx&&0B_p6 zx}t&#+zxY}M^LuT#(x8+TKL;rD|;PLIs4R5t=++>5O46)Jkg_t|0i5S?=5#+O`gPq zqM}J&S71uxe1+!&o^8#EiA0FZQG{OC>jqpltjPQZ)9t;+A*=ryqrwFd=KK6GSlI&4fcs4D{Q#2woN5<7(pl=&k0RDH@yJiJ1h))?q{QQ70KnwbZ4U-e z3470v48x1zuny$>;N=i^iB$`XQH}(9nuFmqu_lW(p8sdPX!MmWPg_D7GH`^ zXfPB2Z2ygZJ$#G356b2VqY`S2<#F*Uk9+)wFfuEL84pFT9bBHj`w&YS>w!XVhtHcP zS}G7WuS-YpOIZ|LsNeD2B&(k+;7@1j!XLrWD2@OZ-n@^vuffCzmlYRhwgRc(-*;i2 zFBy4Gf4{L+3+)?V&KPez7CkSdHP}m|T6~>>a+?YEebdnh28Z=aRT)k_Njp|m?cSv^ zaN93bejZI&2+U;|@pNZn4Z-L*r3Wi-@6S|MvtII>DUd(P7z+!@CtCc!Q2s3IW(7t~ z(whG*?3A*41{Zqo_p>isssM?4Tt3^_G>K5_vY5*V#dn-^-b!0`rh|I~yxbajNx6NlCmV-Bz`bX)?m@I zy(Z}{7gX6e(dg-WwP75uZy(gB-1B+cR5N-IU4b=j|?p!Z-}C; zNY9p3@xg7^sv!UBkftYq*aF*;!bX96Nx^IL7ZGHviXJo{zUoCiSOKzPHo`VeIZZW3 zHpm=Z7Qvg!8{Y=Y(Q7B$n1@EN-c<1HV=5H-NMKr@8O3tMhOi7WVDb2ZMmWH*!30gb z5a4jU?I)n)MJO%}flwCf>}Pn+V%C;>iiy+$grG+x$XkxGmnrnP#Qix1Bwb}B`+=IE zgxpWd>{A%|w=U^j8cjMrxLz=))oU9PnbBY6wLAJgrZ8iu{!%$Ibbq2apFHipsRDf@ z#Imx+oSR-rlM}`JOk|5^+1qN5_=02fL=8k)68s%)%azdawCY6D1`+<)JiD?KrI>~c z1*>Dsh(?K-n3SbxZ%%u|iSirSHwViq4uj_PleQfcNBMF6Zz$>H?rsS1wcjZS->PPm_^@~W;W;?%s1&H_Ewgm8jxjOzopGsl zIifoKwnuD*N1lg_uO`Q0+UE* zT$=0ta=RAuq+Nr3Ilx4N1=51 z%_fOqnNr>hTJjEH$>l;>8a+jvX^w_h_`zLKL(xnZAQ)4<2bEpHMj2t#mhD)IUx z>tgk4`_)AH^@NM}?86P+vXyq4WocW3(b$8PMBCw1xp6hKtL`9TaAaaHCOF&vN19$C zu=?@@TD3i&=^Y;4-RaBD!POj#yeHp03kKP=jhSE`LEPyJvpu}g<7=OMILWe35-TES zeLbYQT2fA*)F7Qxt*0kA>8ejyA))s}c_}ev4%EmhO|LLftrdyFm8n=Px5iE*n5pF7 z3EX792-!7)gThk6k598gg@2eoeCEPq?j0{JXQ26X{~2ff=5oo>rjHe+-7_ym;d2gO zcr)13HA&w+aA#g6C-Di##SJV(b}vrM))GnZibhNDp)|{pL>7g7|Lu-gS&Lm8Zg}Hl zen(j9=T5j6*-&JH(BRcO_dr5Z;0~#{7s}f zGGLWr;eJxr>q?GGRV z+M}Vkz*A zp&Q$t!898WF$BDNKN(oUY!yF6Wqkv~Wu(m>RI$2#e1Z$-MbC&DLra1HuN_@5g4Xr8 zi`lW|R8|yyG~m>t&pq9f%I*KeWs|OxF_@s50{~-KoNOoS&gOGY6nuK}upM!wv|k+z z>GN*Bnm=(R!Vu`gHEH5;vMzPsf-;XLk(>&jI8Y@(HLv@j zzIWL8Zk})n2E#%mKp^i5FY!P#FoS^N{-{g%Veque`(opFy+;7AH>oVaR^e&3Z+@t% zpQ`vXHmWk@4(2cC{QR2qW`7O-WUk^?bPByA@X|@2J*zQb z@4U8g<6}i7QilFMpAk%H@u`!*DTTi?X|0KxGzYTdF6QiRMwx;i;jygspNh+Z{ z*PWD^4fE{}RkGA4YZIw$ftJmCv-I3@xG|E`$enkHkyLSIH6!63DM*F==Y7`UPM?c} zkAJ%!9H62x`CviZB-G!3H@p09-9C*ke5<){eD#H#g4rgo3_rSCjkynhm_L_ol7ASoY+kh3$9->)}XDT_Cj3%v~04QBI-R;T!U{9^smh z0{P0~3$r1kGeaq5+HO^0IhT~Txut-q3ewVu6^Lk+)udVrG)>RkAlCNZ9i-W3wXy|Y zVy^%W^ST#!4tQkmFb7Wx?EIn|__gZ;)gQ|I1P|<$z5u!Fmg&)YWM8`}S2I%zXE5YbB0>iNMa#LJsL?;2>5dvqWk|*)nCyZeUK)>3lT1U`k>=cd z*#3~WX|-FjRJnYk?!j#7Z3_B$$VE~&Gq`DWdDIk`F2>A!M;Q=B8&%*SvzEVy!~l4+ znl+}f^{$9J=0mIQp#EL4_7s>^P<$h1;Aqx-`=A!CcH(-|o3p^znUfX3cGJ$xiLSjs=6{c|Dc2Rn!4EXChcX-ki_q zZG4sB(CeUxq3=GQa@~dS+pc$*r=Znf-5yi!89qfA?!}qS{`oyH6sVp&H3dk4*w2bbvWvn2R%Q`sdt9 z!anABJmp{tTSW&R#-h-7Ms@p_$y#LKRDpzJJZ8{X7#VU=Grr){{?(U7pzjqwA=(W! zNiSSkD0k-{2b6FiD7)eXx)+iS5EP673XB8JpJvxDNQ$jtD6w$bSBo_vNw)~KJHsOU zkKsn6`517*&_@=oC<<|$%1U?G0XL5b$jSJ{7FhA7(a5nA;pTj9691VCG7~4n9|GWC zZ@w3mhp(uxO0`%=-#_iB+7=%jC0gQa8c~IXo?IM{P{sAs(y=5Ilfz|N4_R}NMC6YI z!MpupVRnAN>ot|8>?Hn{25$TtoR{wvwt`sdCu$;EU8E8JH~qrEkm6*uYDk>hXyO$D z%?On1803Y%V;M?{{?OC2vhAlWAvbtRs!K>Xr){v$RtkSW^`+^?A@`OMQvx@!rnHP= zKk8N444Qa9z*+>{3K314KDg{pjNtYG2GUJ;J!*K1e zQC3$UE|t%cl9eSx{}JP+(k2lI)=*eqHv9)#lQ-uQ%^X_!oCf*4#L{dnk}K}{+i zW@X1MDL+YkE7>D7B!5y}k!(t7sK(^&EHacYj$_R?czIeI_bUF2ce89m62tIBHTb`Z z%vd|6XBfq zJ${|I@@~Er{okixAhkN#PD)H)umlw9RcibW$RB};c}@@l4m7%R2v5~6TMAlw=nR{I zr+AG0fz|*u`fcGGeU8FY#C$TdpyG38RFj{paWp(aJ{AM$4_*%1qLnOL0JV^FNmgo6 z$IRyR;)R)NVS=U3&Li`5llHt>;I~o2<@A*4d>$!Bjw#N(Rl6Lgx+#zG@`1dMN?J9KVO%=}SpRW9B!<>V0*%H?aS`F0W!TQz{rg*s)0y@Qm8{ z^UEmee#hVcIb~`cnz#3ds0QY_IZC|{F`D&QVxY#u@ThBfCEgS3<%W>1gi6tO@TAf9_MCuKaaJJ?WSqDmKJo+?Wvoy~f>jA|CsAiq)-9_GV~*4WAk` zfq~?F6sT)zfJBh9c@I)A!wv~AD3R)W@$y~UxKT1`4i^K2><9$lp966|Gi1n_sfn6kkqA3JJ}zx7ixctR z&#Brt8vz+3g+B|rWn!OO$#r`&u(<%E@8L=Ir_3%cCd;L||GLc)1zM7t&C6G(^JJ{r z{A8wB=YJFj-J*3X`ja6?bYvKsk2=$djf*Kms)Kpp+E7T3fIxGU;qcJv1^Kw3$Og<` zv)^*s1A44~x6R-6L4Iuv&qGo_7pJc7ym_e*jFm6qzoTNy{>vjgbV zrY`p&XrPAoHS&r^;KETweS)Vmxjb%OtR)&S@20N!hYGdK&Uw0nT241zm-uK5j79}k z2X>}l7( zb%4D#2h!flvd4`u*>0Cvc@L+8y>~*IjXL}iOV7g-QoZ3EH{#+GvbZRIrO9L!9?vEr z{$_5am4+RS^BzdXq*i~JOR|*z5gx!5`%6 z6#cqM0I1!2!JMLztE44YYRw4U4^jJR+E8@?ff6H2fx0D%jF4{ZXN_c6dH^HmGF?Pn zld1Q|uGn5!OdWuFRCD+^EWP;IOLY5w!^p1sqtW5*M{BkAVDu}IOZnI4sHtML;bY*q z=Jb2wa;^ZtLRUB$QV9bcgLmelsH}gWtwbTwoQJ3D0jgz5QV9bJika$&wO~y>LM7JgxURmNUt2e*~1q16Zk>L9e| z$&2r^G41Jtme!wz6MJMXkMC7sxmzT_0|V2Gb6b^c%;?N${-0KAs%E=4+$>rm$`W6E zgi&Z|DRZ0RwWO2^ARl$U$-mt}N#FQR6Wu9Pt!o^bAe<*g{$Ww9V?rgmhsE zTm~0k+-`_$dLA1v0n2TUP!$;pTs#&9VKjV_bqA!a`Ch1rT9Xa{^@SEx)Kci+PM>|N z5$E+ZL$GT!W){8S<1Ge#dScuGZk)=1pSE?Z%EI4KDS8?H@&X(R@*?M)ndShV_CTu= zqtm!WmoEF@fy!}HJaBe)brI!7y4wD^FRryJ)s(#HuB@Dlebe^d5;({U+Ft!O{^8IIz2$vseAn=ep!(~dHE%}3|4ZlD-=ABm z_iFw<;D5SES{V)e93|FRp7d<)+(XZ)q?zGt(zyD~J0u>@uU z9smAGzB6oPCP9`&YEqb8%M$Y~0}63zbVfq&3jH`a|2@K%oEp=?&_D5txZU3V1F<7> zU6J_};fb)`Dzr2e|FXHWZYpRQ{yzW`LG8YKyBScyjEtH+kB6Vgp+BG?s1a&k`ynqJ z30#~O)m=`-+kJ?q{P|N$+33sWvxFK}{3ztvF(R+fU=Y|Mh&+{x8Nv)hrwzrNK z&UMl6t;4gZf=M}lq^bE`8lJxc@y%;*>?fLJGEk6~M0{w7!OJ2OMe!4j8n9R_yuF{) zB@xd#UVi!)cvs)T+DE_3P2M&R?s|<)d+P86$5y4i?ej9mltgx6KCVDJXHM1N7MoDF;E&8GQ-+jJmL<8N_ z9Pa)=M~kjp7T@&{%ZdUV_~jPPc11qo@m)zUr!r}335us0At8wbb2kIA)l8n6%S+8c zU@T*G@d#x!izJGO?~z*5REuRX0UcAul6_7R9M1<@;NNH z>tT{oHu0P1_tX2fUR0Nu-I_n8G$KX%soDDm4epg} zC`-aW9KipcpKqN`r~7bj_y7xlk#5eN?&ch)X-)ht|NP)0W^R0q3yqiE?B4p*-jPQ^ zNj_zjcFgxCG6O3qIr${|ibzj3(-u(BOG`Hay>#-;ZB7(Px!+W=L ze(*yK>;@tlEI8eEgjf)NAad<_NLvOo?|6XK#WH(;^)sG7)b<`Zo{xs;9#3UKBH8xa zc_L#mG0918ej4hO$)s*PfQAu^-Gbp_5=X-9uwX=e%aqxbQ`u@fPE*Gqrg^#KTA?-u zU?VMiCV44dcJ=zNX?(H4R;mYEsXo!dNZL19KckBBoyY0z3|_q0ue|0ZtciIP7v?ZN z;TFD>Ih&|0i*ZE>boUpNEYzV20z!C@*4m@|v2lp(zy2m`*371*b1My3G;qJ#^t?`| z(_On8JHRr!$;wF^Yl^BN2u3n9?D!kb(=>P~C=nzB7MmT#c*JwJh85ffj6F^deB7f z#4@5j4}CqO&7MDc5{VNgQ7km@#xt*Tv}1^fW+Qj{Z9Keo0gH?GbM$;Kv1Ju3T|b@h zxe!vubY|oTbnm`E`(@3J4Q3m5i;0VuUOd9!k+ZZdznS~)I?r$R4`OuZvt~^>ffLWL z@BDj>OTb`HCMz=qr&&Z%G(>9_X{IQ>&Fyr(*$7&={PQyQ!jg;3vJz4w^=x@|Gy9u{ zhzm(fTCsuE6Q)p=zlVCkh}mYx;kJYCINJ_hVD5eES$VRBo}K3j$fIL0TI|>~1Mg!q zs7|NTy{j8Lz_ORJ@Yc1=D0D+yMG!#@o#)p-`U58}o61w7LHfJeQT>;uDUuV+DBTV0 z*tv~!O=FL3jZ;*f!?@%mtfmqA+S@Pi@BN_%R zO2@um@w3+&2rrBLWs@5z{7QVKHbp%a?H1xTTn^QQD8}WYY_~ zX}%ss$3&5gR100zhuL}LAkE&<3!^*Wq@rRSnWa|RHvfTNC2nBD7arn~*>UXlFz0tY z&+lJ8eMQCdkf)1I!As=g$0Uxgbqi1Z#LRB&h`LB1;`<`h%347KQ zR^ELxl^GUdVHJ~EroZk0&%Lyh^WNCl<1`}vL3(>5_{TD?SWG0^q4Vrfb{;rH<5Ko$!H@UIy#IDhg3wMVb2zJS3N|2VJa#1^8|dLX$t=ScDf>g>(EqMr_{UCtx8$AS7e4JCKwS{DCMc5=NVo1iMJYKTII1fgobC+OZi0qM-oc z`1=d83^o@I6GTEIL}FLo6$H_U&FR9Vj^G=KUJSAf78g#NKy1WEF!uK6l&mfi+)f;3 z0|)|wrV{h_zb#PHT_PE5xRM-*(Ewgw_!`!$2}lMT3CT{(MhQWXFo+_8s1ObK85;5v zy&fl95U@Ivu@b~L5=I%jWCY2KBf*U^=4B`lLo_)^PEWxu2?%P4p#jguqP1@_Ig@aT zG5jMV#IJb6R+6$)ahW8LBLuvIcmmf@P|D;YEj0nVNkmmaB+kh2AOrr((q;k}ElwQf z(a%dLrXffMYz`MjHB2CQ*?ThDa67H2kpN-UjKgLi9`cX<7%}2VOu{Ax@cKf;WIzzH zIuo&KL3|@o6ut19PItqqs;XksrcI=!r4b5+M#~jlBS8RJ(b&`Czrh2nPa&fvje-fq zKWxc6M*|(9%7u@9NWihS*5W zo66#~Q*j3(ms$ad2FyYn&-vZ-_H;2EdWV#%PN&m-M(F|8r;0|{TgTRCTi9(B-?DR2 zKtLfD4HMI&E8S;`mkTF0@}t^K2ydBr697ey5{~G7X>>Z>=ZhX-eadKRoJc6n^{s}a z(|w#&5Rtvk%-*H7WWMrQe3mQIwYJ${grEdjtq>FjA_ z#v3`&XrOA@5~k+4hW(iGnt`d2dN!Y5M22zTDzJlsTKrbfa=X#*78H*TiY~kphQ*^}u zQwHU8=P)BH$g!OVIM*8-8<>Tp(h4S}#A!NPPlqr1p6^4a)9F6#ZuksV!laelf6IK* z-A1Bu1x-^?RTU7hCYQ7N-uqcm=^`8!NE^492fuP3a|>;Nnc|tZaQB9r7?&6)tfnw) z?Y(?y!+g^0fRx694PWBHbyc`b8YC95aKnA9pP7Rsn#ieK${p)hP>~L*F^OqQzrX`` zEhR7U8e-mr0_HyObskwalYEeK9ur6@TFCv6KET2f2Oy9+ZW)g}eh;&YZ3Lo_GkXp9-@S^mBm<~c(x=_b zhShV(cbl*0Kj~+L5$E_t-1D`s^QHUllnq~gjP(l(2#xp=bEmWZ;rm!w>;{aKF8BiX-9C?Or$RWE!kpV5 z=F!`xVK*5t=Pu-dhaTdt+b3ZMoEhb;d*bWdyKDi4W4)d&+2t%*b_e&|xty6*Ww_rQ znCKvF%1zw1dOoGe*Z(}|bUNMjcEe||1VMoAWBm4)zvO)1<%>iFBuPRG4pO)MSN!7T zK3o;+_>1q{!!7f6aVALF&({EY2wcIH0%H++5G0?PNEVZ?P4x2-Orf8$U2 z_t(!5HfOW+?#EcMY8jI|HlnH;q3#-X{{F{os&z5*zOVD;`3sqK{1olOeeW@18^yEM zvwlf3y|4b9Uu`TB=%JKokc! z(^rVmQb<)Eyxy#UrlJWFreHTmHa)`;VE&&>#ckQnuYdL`ZzdTMa*c?QA#Hno$mADhRaeA&46Bkcacz8nDcoNvYX_rpd&jQN)A{%FD9xS8wN! z^ z)A(#IoDRU8L(%vQB+ogv?(WB)lgGHC#IccSXsSAPeO&j`pwsDe*WC@D!BSNjwO|E* z{ew#UQP5%msyF=;zdaI0mSr?YCbRGR0spcLWdAUA&;27W?&$&&(G(fS_?3M1dj+iX z7?FMZc=oBy)c8e~=caC<+0vPD&-eM4#WJ$rPt)`N$i{tLWK3Q{wj@$LJan-} zmmr3SL}G|m3r3?rOjAeq<$tbdcsmdB^S>FyG*FN48jp(ldZ|0r3#LqREhaudE6NW> zkdTmxw(sY}_~k5}S;HR(MB=iF(`hF?!H&0cfXiDmN238$Ed!I)#z;JZed29==lhlP zdu?d`Kl0NTc5)%0k(`-|%^zj(q=(7(ET-~gh%;wmRF+sVS;3T*Picl3&!ID%s!3<+ z>Ljwq6_aq{I9@%d(&==cGdFw&OAthaKqto!?Pc?pt?b;rkF(vQL6Im32=O3YXAf|w zp_jDc9ORB>I{g45f*=wfYUTLhU9=lr6+h$srg zhC4WW`Y^3wkyN*duBHyIy0+J1#$vHxdZ!zb29anSMN_ZHJZWfSZEiHsB+RY|jYp4i z!6%VdR)RAob4?R7f`A~0={|Rm!}Xmc7v~~$wb1F;0GVi9MiMSvQX1M=wo2f07+H%Wzzjs6h? z5Cn<%a5G2uZ>P(dL4i5Mne!gvvWUTE#W2`RQ}0=N4AUqMpW|G}fQW*Mk<9!Ok{RNB zbrbQCTI!kuICIJYvs-)3lML{Gs(8%%4uknj#cQcT)j19}maA`iy_Y8r}f!p|IlF&|q ztBj1)5F`F!L_tCxZsWw(=XvJ0duVq|W6i3WWL$0i_fRL@Eh?t`BvRAfa%+}lI(r9* zTWzF^my(k%R~flk3PFDlnx-Ne90=h?PIYRemP}_#PMo;PRi|bIK|+X)(0yhr8=rlF zP3J^r+;KnC6QQ@)OHVXLvist)Wkj)*yzE3ob%;<{K@dlar;ctS&;g@U)MF9M$97%> z2|lxd*%coQS}vsrUf32vi=Eq4OT*3QA& zd77h50VJalgV~DBVj$3Vh!agiGZ+wKcUU6W6oh*2R?CB_zp6`ux@0 zJSiRVTrHihsjOR5Nup80kW|9b+n15;t>NGiA7DT-7_p(ya=4zbYNenuACxPjD?yYH z-?r#lKr|Re&qu6_llwN~$zI92o6AsJ8))fsP`+|0v$G{6$xPLnHO$M6a^_ea-9ZCp zvxF#$NJb-)Bq2$co$Jpmk;L4EeB+;g$af!@N8;5FxJVF1Bysed2$G0sG$M+^_04Dr z0-_{gGzf%8`Z#sCox-Y8tZq9(e=jZ79-MPla@(vFBuOH9^3B|Kb0MB%$EfzISj-Xz zg9(cTqGx~4jur!R*WN)zij$n=B#dS=S|rFo>p5CIQ3N%D(UeHa_(>!s#p&GfKm7PV z|C?X^>S_M#H#=z*vY9%u04H%21Vl+hG8!&jAJ={1zfPyqT^~368Z1qY5zAZ7-~69x zjKn~c!(7<*BmQY)1B$Am$}%b& z9mlc8Lv+9ERG~uaf#33Dlfc7kAL8%-^M0bL$Vl66p8L&y`r7yK^iP~T@{Nc2m-&xj zHEKk=Px7mOd!EKX0@-M&W9ze&z7y1j=d&y^k7QZCqQ9Z0$S8{XmWe|ZMV1jY0Z`~W zdz@`2R`JEf%b2tKr)>MxZ%O+4J$&P5&!P^55!D{H{^l2KJkm#8aub&&k|(a=&;HLm zJYfx^(ogk{Kl1d8hZ&MTyHi9)YYIi>6(sq0UGoRZ;7DcR-G9Oz^Cys&Xu@fLum0as z=I(x#-#xvZ#_LrNOI1;11x*w|4b#_ng!ZIm%oOUd8+V?}mYEy~H8i<$H25PE?Acz#?} zIkN3Vj?|28B*Oq{s8IGuV?zNp$0|NTVeiG?mD3HyxfZqR~!bvJ*xI@r=lT z0gF4CWSfj{z(dTELXus-!9MzYQ9#7v zOu%Uq2>XT@iD)3%NJw&HQG5&xg|6PrS+tOto=&pEj3_|d*GrejPfP|dl9-uElGB1g zlL-#@(=|APh5=hb0(L2i-xDATm>fx@Bs)=k19*HP;$v}+H6b0BFoMSyL>{}hi3U3f zDNcl-2TvdlNSIy8q&PJE0|Nx&0v2}$85u52szN+8L{HBU5fu==TKp498bUMhA&$Zlti6!J*(aHR2W|Bkt5JlAUG*IZ8|wF`6JA7^c79N8~!K zNfL|>l9MdNy2zS!Vkm-vn1ArHmN^C-3CY-uVSGaY zWOE|v$!_ds2~7|XkqP>S7#Q>u)7NO}bh?j8RaF(6Hf3|11tO}zTz|L{NCYl&P-nnb75>2x~XCqfUfK2Wi(YL5*m5`^^|lvold9IeQM}s8g#nP7{O#E zB`c5IR5zv@A@`kU%l8{DjZVrjIkF5s)07gp^*#!lp+CSEp{mil? zWRRDaO@j549*ORgaD!*COeE(QlAE4_-3Wr9685xEQ`buj5Y0C7%Bsk5C`4m11cMc` z;-|BvffkQMMo}R-)&Nb-9Snz5L_;E31<44$UU~;ch$CT6%w}9sGRj~F4ef(tyX7Pt z$ywy)XOmztV30H-z8)ISH{(^D15I7{-gPIvh|!%zNp2#7zk~A~UKGuU zBPpGpV`c3PmK3scQ!qw)>FD$lm29Nu6_9QW($m_G zM{tvsmrrhz1EWCzK|~&Ep}wUHZ|Kv#yTL&(Fwgp2H1rv(MN^yX{pN`fG zw0lOkV7iMJaPKXX=-Kn%Jh!urk8V`&EunBJkA8a@y}x{v|2+KBKff&@owOty!TweT zMn3yndGZ#1k*_UEVEZq>$1AlT@pqBYN@_+Hc6FHEz9FtxWf$ECCw=dG-}{~l9Ib0% z%k$5C(&PDrv*{eC1z3iI!HoDC}%vS$4T7EQ_} zKh4facOCWK67Kr*@A3VwOkudThPnXx{_Z<>FeMw# zA3cXBrh@2Z@`^|J_FsI3MdLCkDxc2M1yf1V`f2DhvGDG%@$jmA2J5TGZng$8XKvuh zC%?!9wTm-#ZH&B2fMs$X9+{m003ZNKL_t&(bNiqEZ@#j2GR1l0m^5z=OO{T<(bht9 z_t5Cnqhlf~?t7BI{mwGn-cHWev=ahwjAz;UTUoVaCJWcx%k7IR$S)|Oq#yx*Lp_nn z_w$!un?nD~2WV3PQmI<`Wxn!25&b)k(DAO{@@7(}-^<^B|7)xn2h~Sw7!2E(xcC7c zexQQ*=@VS=E10t9aL;2;@~!))p!T#;-`GbCiKOCnJo%T8v%DXj1PNE^Jl5R*6&_hOgYt@U z#+4P2Wb)JB(N7@u)*57&XptxpA%Srf`3U{ZH1>>Ke5|8#Enj=^RXFLUaL2k;tXqFKYv+|yn43*vyp8?mB8*@AO@8{%_fZ({;oylTqFN@4 zANe--Es!~TMq>4!eV4DUsvbI4P62JLva!dODIZFX{~F*f7!Jrnw*r*SjmPju4nPg$y8QOVRCUYil>?L?cNVv z0>qd%lgFNXk~05x4!2ybm({gPE}72C_4l)U)&wdl=Q3wfF2+a`E$t)3jcz8)zLN(Y zUdO^2)0sJQHf2eES{pj>MpZ_JW4Mb-DN0soZ)n2%PQB`{16#@jrq3?GfBZF0c7OEG zpF8IczI68rENwfe9r);<|KpZaI+JPnW?D|}rD53tSXT?U)_jL53oKm znVFf~bI(24?RMhv`1{^PsA|yWjo#=PEI`#b|H}9I$6watBaJ)$;oo`aiwk(I_BjIH z9$x;pKVeJmG#>xP6Y$!T{KuZ~=y6HK#G>8Q`I9KhET!1iMx87p$6{#m=*>||%%m*e zLi7IDX%*9`C~(tQ<3ScgL_uSyb_c)v@eg>T+0MKN|C~ox-%iunAM)z&Um@cgE4gWY z6%8%>=(S8_(ZXqPVGA#BJxK36G-rO3AQ>U%=fv-Sz`woFM%b9a+Q0l)9{R>Tbbsp~ zc-^DmnmCCf;{~>CmWieoQ!!Cn>oCwczgPx3r4>xrN9faOL0_fNJk7z1#SSE3=u zV#pVJ>Zr(aj95&*N|r!CQ2g`;hlox;z1baRJG0#4>!A7hZUp=k~OI1Q*5oAz*f8 zQ$D2xlc$kW=eoF-Td>hRku?uI!s>)GJpI={Wou6q60<3vP)xGbNKZgU70jd+jH4vi z%3wo17kd4S{ss;+(B4E#sEWzc$5T^3KvQruko5U{gd;IbR>u_;;Z-?CAP_}U73yF6 zDc{@TV)-}!FE{(1;(z_($k>?EFsOr^9||KnE4is)8!t7>+@$?5!9kW?``wHym{*&)Kb^3~C(*Q&}sB88yWpM>_#~V995|XLdkg~MZ9?W`ms+eM(S#&uBMURnqB;7&91R==CJx}f6D4LYiO?d zCCB1+Ty7r+p87t!PqmS_;Bmfv_i~m_Zlrr(JK;zNwT)h;E-hzH*$Fz14_ukmlkDVG zR52kh8LQEN8tkL#%wf*;7|AS~NRD-w*7_y}B7l%c(UdZh!mTtk_TpCnR}pijjVH}* z0wsp0=`aUshtN=oM`TQ{3??m|MX^g}u=y-!s@pC$I!`Q^O4XzyoI)Hq)=SOale7g# z@BV_6K*syQr~Gm(tcRFuW*2^U0By=_#VJ5TpDM39Dr zY$_&KQJ7>v9qFX{L=CM&5sdC4CQr`8I9SK=+CJh2I|WmwlW+2I;rJQ4Vk$V&shB#A zqGT&ZxtE$Fr)d}nUiCGvO4G)A(5iqy`h+=5E_E?@>JVo;e7x(s5{x8d6p@!MG1yp3 zcTm8ToJ&!bgLr=@gJKrb7A|30Q3@%MsVuuqV!#`wuk9SC8+%4)J|q{p<&&9Qkc>$b z2=$-m)Y1ASotH~Evtldg2p zP~VAH=Kp8!y#wp0&b~FK1P4-RMKtd8qLNBJ+U~FvMdy$JIt9M=L>K0wy-tV3H{UNzf?d$>uJfD9o-)U#& zoH^$^&w0-CfO#DA=2cUYrALv|_`43Xx5-KJ^F3kknRCGlEJaa3(2P2x#qs&V48*&U z<Gc{B;K0D=TyL>6SCi4GTw(pth!d(N*1xOILy%(cX8Z# zwvJ{bp|q&gW70r08KC(3lS2 zf$Y*HeEVnLCwte=`PM(aiu0_;=*TXe&E%XR_PqWoI|oN4nRkH3eFLX=lQNib_1F2q zou%yf`NRBb{fSdm5p%Uuf1-~$m(6ABxO#e;hDQe2M1oi}Mlu$Hf=Z@jYZ&hDLaWyk z342JyN3W&Rp_c?CtpSq(;<1r?(HYYW)U`0wm8Rq)#R(2NXpdNtFX62yoz) zH`q7(F6Lb{kwHTZIsM!Ci-1p!OM7BRhZ?_Yn;tKA&=UPm17(o_Mq8_yU zTdDIJD5_pa&9n*RT8yMCX0Rkn#2jqHJJ3d}J&dJv3b(GlkEz9afg>kuR!nZV9ie-W_|w|#WaJ0hhck!hy-};9DMubQ=8Mn zULwj=G73#-MTn*obl2C?v+!mn&YVVJ-FECJZ(C!eZ042RdFwKAv=QXAj?_>K$^Kdz z2lZ55ayt($2=K;lf6eO+L4+|EargJ{CS%v{_*IvKfOP^(SAUDIO;&J)(S#u3e9sk!oAill6eSw$4YX0i6sU-NofgxvCF-0`*Rn4G5&3B)jt%VSagt32`A zcDlm?<@0akoA+FV9P*M*$b{`J1UnDW7tf`9%3P*Zm5`NbM4CJg^H`Z+mw>Ie^Q;0( zpF56aD{teXX=NDXIF@W3bIRV~iPyH`G8Hpx*=m;N9piWZ`2_XGi&_2s2Ptb=!y|PK zI7}s6dj0Jzol}VvkC9uN$>NI5Jods{w0WW*d);$FNfV7qWL2%;p}$>4e!7cowmMoq zR$!T_oV${*UTtCTum6QNIyG3UmvHOKNd(?~f!AE)nKFF_<%OAOVr5LL$%2@Rqw*k4 zU4z8MY$}%C#(m3YQlfF3yN)>ZU2YC5+hX^N6iw5CC{sIv}0KryAdvXlrQ|D9J;w6$)FvtpN z(MU=4c=AH6yk2WZG(@?4;dCl2M>!ryk(Sfw3#YMk)i){jZe}GCAWTqnHmeOW7{}*+{w9Gft7S>B&xe)rLwvLQ?!!-rwrx^R99Mv+uAsKD8z&n zS5ZA_Jo$U1xszD&^?R9=NTDd%RLmTYDSC*rzE`3KO~iw@ryX&A z4Rb2IbO>qEX%ShL(B_v@IYx`Wu92hlnN%&D&A9S%49B|AWM`mwBRJapR4$l;b-=}7 zTa1zgCNi@m2quW=i;RI3u-V35< zoX(dhdV8^ZG+a8qf@$eoBDNj$38yWbvf?EXGm?@lc*0S}X!DpbeG&Jq%46U2Ptd36 z&}h>H-G|w|c@JZ6xr+P$E}w-B4eUF3i2cp3Q}SK$bko>2#H4AHm{N8aXZOg{4ttKV zed8{2Z@7Zh-^*kEiDnKQI>4@aJ2Ebg@7_;WRSn~+%Fs17QB*UXEaw5Bt`@WzLzedfG7nr0g7O86msSshU`hzM+Af{_TGJeqwTro|@_CI`| zx7w2ErrgF)9$dneU9CL7eGh+mG)3ZXZsvyD?qP;z0$J_rc;fMwsSitxyYdEBUR=Qb z$9~95brC4Jk^g*n8CP^R)4!pC|5X<3!1_~$!Er$FW76+rmt(jQ! zi^$i@1bsuqPe$3Lq5ChFSd0|KUse7=P4d}HR zFlNA+0aSG3sTh-uE^i#y+;uk#1QSwr0lESUQ^r{76hZ_CyExLJqh$5~u3#PY(Q#a1 z(i5;)fMGO73wdLT$i|6lAVTKYDU9nrNUvwKoM&Te zaIUWVQXz$fW3c3zS#aI`jPa+@WR_DB>o1>(1p!GH$6kMs9otXf z0pwH?UC9Ezx@b1`9nbS`zu$b?()d@Rj7~S6x^1fkvq6Ur6J{%%o*Ne_9y^YVKnr^h zH}C;hwqyj`(Vgt6xSHF(_0L@9>!-bb7wh(Ql9D0N)4=iWc`Pg}CW}61%qk(-xrd`I zPSO~dJ!KreKyY6@?~W!-OQ+Mw zih?4)Uw{Y*8ZCa;5gLPwm^(R}Omm1n8O(*%OrKoA_~ILRAb&CBRWPl%2;-D-=o-5a zB#B7hA=dro*BrL4;>X{aSy*5hG*LB&thusVvLmpu_nwmM8&9lOiy9kY|7P zd+GqtG3oM$`1(zH&SkN{}jWT-3tY z$<>UFhAAqxFc6HBmIK%WCun;kN|v`3XP$*h&RUN1jvOP} zJ%oSBWb#W5=-N0ZzpW3D@X*@ajBDa-W>=Td=x!qti4uuM$*Pz}LF-2L?$uLdt)zOQ zfmC~v#OQ?-Sw@x>6j>(y9tS!FL1RV^cXO=E#nlyysL4v45!_ZmmgQ6JM9C|sI5*8; zQy-0joh20+WCA0$6g_536?xfV98Np&Y!RWd5|gWrBZoYYKZTj)T6&tI#776@MAvSf zdvrI?8Rzh|fBO#C-*grB=3e#=Mp1xhe-p=TbGWQ(29t7|IPN+9PR9EW^XeZD^Qvwd zcmM0(bN$WB8EWoeQ*S?woj&HzEMeN^MNH7yX>RCZVAM3>JMk`0Jrd@oD{B~ESk9Gq zO~zz?ny24s7?}YG&hePMRD6(givsNryovAW0e| ztscF^NMADg$lcBRc%gY800qmw#XqgO8QImrQ+pjC8X33rcJ8`bUstdr?PTt6;|uZtliN>G}ytB`TjIaOqJ11Z`UA$5r9n0CM|}f4&8@|a796ov=~l?X%IvtAg#!t$SAUiM$()ivbAWX zQTwQzqJQ_xJRXd2^Cc4~DxJ$$=1jo!{4=aOIAYHd1YyKUIQ`cwPDvxn3Zke*6t(D# z5<;?%LvJ0Yv$1bPbc%XR+7w|&8-4l&hRl5QlACxsjm*f$t|)2H8nx&Y7f05G~7$w z@h&Dz&!TYB1S%~-?8o}(3jvrh8+8~29eOol%2~PKACV}E7_8ak7y)$T8We*5ATjy0 z)Q}_zjif=NIa7}ch>~WsGYQeq;3229l=8|966i2b7)wE-mzM5fd@&hc{~#UC2nCa8 zQDxMSmIXAXOmeey#Cnf$)D~gtW!H02WyYy1B$NO{cK=ASTjAW~m7vj~71MO>_!GbW z)&JuczkOmtDTS#HCp431GEv^*tpbuMHA6|U{ z)25DRT)rMtMlRa$5FJN$QQPIjACIBYSTLE*h?0yV8L(#Op_fk9&S!;ywQx4KKJ-2A zT`>deIUN(n-*S-la1rxvx`j)}S)u>Xg6|B@L2BgGQ2&G-nJ4 zqJ$)AF_Nagv5#;fi|GqXK$b@b3ki)z8ZF-hR@`$VbF__Y+}=d{pEH3& zM}EsAzki%(UVM|a%h=`{j`N%(-0?P8U5M?ica1zjyw{Ru* z-nxX0x-~rc>^roD6yD#mmAIXTV>Xh7RZN>$^qvkq+_8r>kN=8?|La+fMM}A}W)fDN z03_*Y93(*=SA1nYn*JUdT6;&Qx4m@sI?0)RIdk%J(7m@-KoAin>2&!K5G4sot3?R6 z(rObanLUT8xg$GFy5ef)6$WWYiJgybM3scQA>21a4dmf z&R|S&>Bw*Ixm^iMehs&L=X*T#jTKDEGK_3ayRrB8FxcD8p11zOqmMqqBab}B<9~jc zZS@2A(|WS!tl+D+&Ly(-6<*#KW%g~iv7#me4PI>hy}0ay)NXo?M;>{E-#+>nfBe(a zY^?3Ydsg527{kq*c;Yv|;WxkeHNX7DW4!!s9VcgbC9Q#E|6$&E{C8~dj^l>E{d?}H zDdwzU#N-&UxF4;tfWk4E2&PIFUbKk0m1bh2bB1y(PB^WQm0wIjhVf)|04W@fJ|bD= zOs}5Km{Xmiz?qBT;ywF#?aANpZ~yrOJ3M2!eE!Myk)prNP9U1iRd+1F;Ih%s&@tLR zLUeZ9u}oje+%W~{IpeY_AK(JFU@4@MF^U%6%XbT}B9zvXoda8+ew+GO3XL_NOK$ll zS56;8d3he(_(Og&xtYE1u4RiYiJX>6kNB!HT)&U56^odXX(dM^F}^sTp=0a$(;qgU za>gyY?Av_rD-)Skkwa4|Njhx+t%wrq;_$8`%$slp3on|?p`Jsy6CesAl14;4vqL@` zvVyEAXiZsU8wYWp;iG9RDWbASOWpb>`Td5z(O*q;n18|7r%hp8{sA0=Bg2lOq)E%~ z6LpG0T2{`ma*bFs(&zHEDJ!JqksdY`anaR&0^jX-k{fKMs4$N)`T)CM{vChb=NZ}G zP|a7qy_&f*C!u()q*F1{XTHX=j8}?Cd$po@U1f<39y#G&XiovveABs&~_M*pJ7fVN8yKTO$*2bu*B(V9CfQ zQzMf`qWrQuxN-4xrcTQzFLfLLSh#?W{crHcjl;<4G-+8z0#f#)G&|?Be9Qv!l50pQ zDdN#gX5I2NelTs2xW1eM@i4FaaT5poLde2ao_}L3tMC624=?qiw-_+UwLJgWR=Ql- zj1MT}Wgrs5g!B54HT9b0*PeFKR^l5|=|Q9zbQtl%gz>12v{(m-DImE7`` z%P0}zAX&%|+|<3ZfnDvx7&7K?&B~QrI@OBJJDZ!nHxpx~g5&sJHov`}uE^e_QE4gGwF~)Qfjn#zYt7YBBS^_66g*|&X?))m>xM~{5pWaQU z?c{U`|8oQY03ZNKL_t(fgocez^K!x0Sn-V?u`m%QnU2uA|0VviwHH}dkkccJN=6v5 zg34&nFwEiC-eKwk*Yfp$AJ1T4jMDMhw5(stwk9`e<2bIm^Hvs=SrOAIB%MO4=UtwE zw{5h3Wt`2&INCmw<#+vrpDpZSsP8CmZ{9(ZJqn1JvZ`77mD`!_-%8IrdujH?fEYbT z-sRA^yIK0ZpR&j^jGR_T+iQ8{t?k&%m$Le{>zNpQjsLfKFD;s3GRA$MoA0=Xg#U5g zKDLGJ6|1@OoBz%Xx09rz!yIVf<#n4l*7@Ewsedi9B7-)Ayl6igp8YM)X8i+qeCz*U zdHz3ndUrp;k94Yy)8F1qi)RVfeCJ_GJA>%7di>peghwr8O2|pW{=>|?{TlB1@eFRU zw{z^^R@U!n#?!KsmpA5d+x%Pk(d4V}r_uyEcd>Tk4!ZnV)U3FfB{RliQIbd|BiiUO zUVrltfzcJ}N!uZg+A8?YH4ABa=}DTpgQv>Xy5(7(EB!h*-2FplMT5kYG|t1X@bs2; zqH3s!_i%y7!AcPv>Z8x@!#nK9=W)`q{~gxtX(OV5pwVK<$RX)&=g7W2)c1Occpdcg z_2cyT@Vjhuv~@G+jgU?Sae4-6KYEm=#tsG@PMVuqa0H^Gad-q$eh0n1Hu?q!u{#Fn z>ujZ?*F_*E6Y`7%60{B2a1I5D%b+Bqcn5pw=iZ==r@WW>i=CK(>0zpaf<`w$TY zAWbafq_?A;?tx*VA6dRM$%q$6cPE{FP6F`+vB)reJ?*p{K1OHXAhxbIMf`r0`!vdApW8RKfhQm2!jcu{kL4`QV&!ouhG-+kR%HqkB z{wTu_#7N^6 zQv2TZWCNC6tMZ(pq8w?NO$zh;omQ??tXhgu(WpJfEQ6t2ggdRF z`VSvNDm}<9kVj76d}S!&-IZ3s%k@$J6~r!E5Rg$R(;g4*dzf6E6^-Ii=fdut+81~G zqB>&Aj>7W#SUaBe@5Z7&xX;h?C^BY}^PiVl??^BAxI(Iki=`lHu`AJ{kq|$jUVb_x zTy4zcr7aqKoJ2)_Zi8+1)7}&ij0VMDg3$!4el2QjN~oAJ`Fao*G>l4Fxq(UZpB9&w zqZrak3m%($jm7)cCn9IZ)>n(+J6K+|=yUq0(~cY4Z9yPd@dXnh@$yh#eYuu1K;GiR{1?J-hNsL$5;-`tIU)cP8*#8c5&qea! z4)Dwk2JUP!>9%+Ife zswktvyk4l9Pu<`mJm~Dmg96kI21fV6PmZ#$R2|P_v&j;p?cH%FDlKC ze)N#c7y8)6pVVd?9UP*njZX!GQ- zR+7mYSInQ+x1DbM!olCX1F^gn4gDyp9I~T_Nhtg$dL<NY6l@-4biu)fa{arZVX>fUw1isnO4y7 zUGIljo&n_Ev!2H*QSc(eFemn{Ld@98C~iI9wTyaD)JTqmoU<^V^hFeh5BtDbu)Ou&`mq^v1g<*)623p0v(aAWCXIB zvq(Y@Si}IGTNwnqG}NMj}IAI8rt!f z7g}rJnR0FI`F?c1NdGH^f5{w>!=7pf1d4<&HrV{6q_)TZd8C}@>rZ3<@!9koj9ZcA zipB6#Un%^DBs)B%9g>}o2U7ONRtl5O@PBo{BD)s66-hv}gKJxso2f%+wc&KZ_iZWDQ=sFM>*MW7;bi0)oSr@1?$) zsFP8W)4FJFVLlJ>3&&YD^ek~eUy{U&d8^Cpl50jmB0Hu6dgFz~bS!~&wDP~QtIr^Y zNwu~M1IX?O*(HgidR*2 z*RMAL0Nh_X%`vGsN>06;U0q3no`NrB^s&T{pZoGoi*ZH1aDsJ%>q z&V-kvmTbgXx&vD@WVWl%o=5y+;cCB#L^kFllLUfOJvYZIJ7G@VJ_HaabSBD`jTI{+ zM?N7<=||N)iV|zvf@bVQqgon2qtjQn_eV7vGdg>I$G{+we|>DY-wz4Pn?#$bw8!Z> zc4lpU*1Vr2f3$IxGIrZzrPt_5&#KoI zH`|FI)$+OCEA7vFd7)so^jjX3TBD^@qUPR({^o;LmwiGZfxH*I4gS4<(_LA*EWKIg zp~8<4K23O`(u7D#WCin?^%;v+Qee5izd0YnI(D~2_;}j6JZgoAl z(2t&DBultMFiUU3V!GseeZy7m1?N4=-Z9@)g3xrBOI3zWUMx2r4LbbZ6Tfr2-l`rL zc}SELI$A2`jaFFDXz1igLGR1AvlSvT1J3X)IUU(j*&zx@KZi{R9*1;{RvuYD4S`ai zGe}2@xtyTYHtBPhHpU?Kfssi{S7)$M;i#Z4Ft^-bN3LoyeDdV)Sf>D=1p#H@QqfQm zB*Y*up#wCb1frCh6(yX+HYByuxaISzCilh3z%K6Jp&p_?k8ml|wPlPna zXyW0vCarcHg|1VBjFxo6vAGp_)wq_DVoBN(DdKlJVOGSssAy9W>#=iE!mwKa;--QJ z@}a28iAm#erRyh_Z4N!#gr^DV@><*hh$+Zo$nkTLiBKtm%X^7_`ax5rzBo}TYfPD} zZ!&1*#R0A69|!5c7wCW#L`ZN1?x}W zm&R*MY4`n^U|bkP=081iF5N5Pl8!0YpNPq(SFHw)xm=h|_G7@V;i%G=9-m!_5KYP< z@1a1VxgxM;4$$6?D&5CZ7A&1GS#hz&9Z;FsqI*Ra4+%dUqr%@5#1{*+8atdFDd3vO z{clPJ2GQ3GgR7#>TXS{oXv=^5Zl)F!TqFm?13orwSWsMGoZRRSrbJ_5UY)+oqj!pa3ow33|S z!078N@ZXAKYwy(_c~J$`pXNM~cMGQI*ua5a!$1NA>XxRPp;4L0M8vo2AxZerl%!#Y zN06oyvYlQZ&*uSlwFMENLQEFYYVDo3*LQOI-S?AaMb8Hdh;LZnJ~nAYD<3f&23Z0o zHbF*1gHXdN$_NHf<{(D~lchia2T;cU^9L+OMKHoEP?PGKhxPjlwt6t==l68*$CG}W z;H$LyKTA)b5+#kcaEX9bo1aN)f)`4Q}Y7>{1xW2o6{Dsh`ADNYeH*f|<>*y*zT;C?bQ(aift4PFE% zqG<)33n}kq{+O!D6b~rNoO;jHYqa9dYzW}DLskPI7taT+75x=z$juefVeYWt!}(!W ztSY*2!lpBwF^y-Is6X_B!NS<>Pve;+DkT$sH(2aa%(&Tr8Mi6->0De3C?1li;~_6s zzjyErmpD1u^xsgcoY@P*IW&1&{wjIHYp2Tu>75=fl-yr|aiO|Kmr&EzBJ zJ$-7b63j1EaQL_F3{f&=O51>3Z+n4^4~>x$%RVj%uRTXjtBh>7)^Dy}TVw&MpR-pj z`lV-K;K>0k1Ft@V8?)!@W%}WfH7IHjC%QiH4z+UoW0H_E7j4Zsj!EEY;X)25KN3x2 zE{O)qb^SO}Jk`0+kDa(9_tfxLCQ?wAm$&D{ePWXM?_TF;T9IkIWaB6Y8^bu7XGU8! zMQRi<1xiwGWUVV(KOU!{>yVuK!aL&i;w{5#l&bpu(0|IkFQd_KV0vS%u_`{#D{fr^ z*zVWwa>x9n9WKI&7oy&1p@S?xDS0IH$t6J_juJ2i2JhUVwAe99 z3*HY|fVel&*b<>TFYyUC@h!Kx^&WNJ%!r$Ta^HbJfynG@mpdmJ@+K;K`w`hkUkor$ z>rjr6KRcY%9b3E2-0@0r+}Ol6{$CEd$#~F%-(ODF`{d-@oY%U~=63-CidyTPJ~zoJ zWz4r=xp@n6EYRRFmO!CH>LmT2Pog)3 z{lkj%e?EeON>-c}D24Rd=kfiq)??WSh@p8?_7gNUuvguzW0Z-YFyX3;jRY_}IL- zxhgBuOW+wu^DvriWq)Q&OAo={s8G&c>Xd|3=TOX%JlWMA{>@6>(&YdPVeG^w-O|uI z5+c5aGvCT=a=qryhLBDDI0AHX^`4a9zTszTZ@0TJ-jQ2e!qf!R6fVs|hc#0+%8F}O z14?397~b6xTa&DBaBs$c!(iygY=^K+2Z_j!7H=|O6!v#qkH&|=wETxUro-R)&_Ts~ z`tO{U$b1Am07hb&AISF?yz;t?z|-N_OjUC#yR*WYp1j(^J0A)9e6pJ;;4;PUj847c z@rqdxo4uYv7#nAlkk-)N0S=q>1g3>KW%Q&pJ3E)`^}KcT|Dti>rwZ^hp{^C%i6m9| zhi5zJC&v-2yG7NVsH-yVshJH>O%vq;rJA+qKu+rH>WyoL*Bbe0KFQ%4ll}ATtWt$v z*%&0Wt@r0oB-j&POO-H4SW*h3sl2hhRP8WzGQp3B^GjkQaV6m*<-wP+%8LJ1(d~F4 ze08Fvg7gjJp)yINc6)N&0i9Vw?#wd)k#LF6?(C5@We$*?9T_c*-_k4QIEec6d2FMo z4PA1l@0U7@D5Z>!ln=bH33H1v(;7(8m5*>mNfc=f=J$Mh%>>7iJ`ezeN9LRwwbXZ#O#=# zRn4;XJnQOx&8cK=FN-l2hgf6bBil!z3)FcQ->#9FjOWiF8FuDZccUSnJJ9$oo0@^= zcCKApP_-Ji#zcO4lg)?4X*7ksl*nH-VsXUnSJzl&0$^Od5^K#2uu=onjiivBjrm3-+N zs~`;w`|i_w3{W3;g=hYCdvFkXaioW$2vn>TlllRg-92^{%9sD2F|F+TUs?oo^OrEy za#+wWW+1?ew!@Yx$gq&m5~>zU@;O6FMghiR|0J88saPoieBQ9o=Dkk*riI=iU{2V!3B<)ZnJ@ ziUmf6frps&Wm$^>kuhK;`3z0dtfokLcoGR?iRCawRioZu>iHljXPPWH4^{RbuL9yv zqIL3KFJcKvG($(f6-<}EP7t(FI|lI>tV`Nnn}$Hzvg4}j$fn6D@MBX4BZrE`CME1O zJnY5z`H3?Ou4*&(9!N9S*7x-he_r2L5uWh*lBTPG*U*I`0@EZ{RcI@j3;0MtgU8Sm zvC-2R!{?3OZ$zlNV0?XfkZj2_zrHWUYR>WWTG!-PgjT$UctdLJi?G36ZLD8|U}}LE zTiY3L%lu1{B%ZV!1CcNw^=P}&Tvj0SjKnWUL0*bH7_~@_a@9BIw@Tf9##Z8Yc3@SV zzNo{fMV?>zNvQH|Q8*xz=X!1hhpff^FfmX^rBg)gG0a@h=?rtdwWp6ETSt0OEF;5t z5Mq;0Xdr?n&r~Ko66I>cHN)+N=UJo`yZ&rgkntDZ`O|c^=JO$y{VdSL1I8K z?~M2rI`D}Iq4%>_#fhACC=Vw>O{+or7%n}rV#@qM7Xf^ecXGN@o+X%%+y?9wBvo%1*hK5fw{+(#rW#M zFUT3nh?=`UAsKVm1LG{w#h?u)>>Kp)*I8G+zalK| zlyk{Zi4pE)>EKCwA?-PUDO>v~F!*hxO3&*6?vcA~ZUJFTWtvQ&B|I-E1~YY}0>qC~ zL;Ch=^~j!x$dy^+!ssq{}a$qm`5DN<+={rCsB zj?k+y3q?F7?ErdiiH!bB=}KLgI>0P|KkIhD3=t3}d_J`OCrn|YsF^mMPJKibU}8G+ zF3b+?hM5>TQRWbm4(>IKrD$RofixiD*2*=vj?+=J=M^JAnryttie-U8LH9hkB4^8# z5v?Rg!L%9tqQ;9T)(A+-Qm(`fSA}6sN)pHliG!?`hFiKStEvf32=F!o=Ntj3b7q}O z5{MVXu4h?5i&NxjD~Ll!-_O&Ssi|d%#a)&*{YvwgeOR<7Fj*XHZR5Rtbvix2Y$x;imVJO}W2^^JY0 zR{4C})?gQr%`BdtnrA)&^}MWhBtf78LVAy*soo2Q?cflAjT3%&QP^Ia8O%T^6fs0j zouE8S8+{yrbHSwK=FJ>0IB%VTok%@gxp(GR+EJK2Cs4_m%G9gf9seTI#W9jLFgp~6<-REa*{aiy?qn8nBRrE`)q9j zH<{H#)a$qo_NBgkiQuaXF|;$Y)S84vRZGh1PpBFD<8-uU=l8!-(y5GzvSI=MB<`LT z<~9>-wFdFiWf3L3;;k_cEYYfv=a#i(%2!0~bg<&yTad%_R2rd@krD%>#XxT`$iO2r7|Cx|BTCg zjw57WP?D{6@ae4e;6MmTAiUr8XjxoXj_>^-gc+SWXozk%8^yKy$pylct8P1@;zUi- znkf?h$q`m&rH>rg)0szufv`Zkxq~ z6WMv!3?gC|azsV`@A)TdBS@@+*;lbKLzoFz_`2fN^r3v2r6InMiOe6$4=!=vu4{FZ z#%ikw{m^g|#zH(mrd6NuO<&^CZBZvMdHXWkTqR!Apc+1rb^wFn7z9{lvovlpVvO9 zZo4w3w# zgo-taj}NF(nqa!ZQ9q|@j;F0!ca3cY(mAOf3v;J{lTvTL%iF*Mnh#bGB)`$~wbkTa z2H;I+4LyffX*U?L|B}uek_?ZnbJ$z!wse9abzk=P^T>%rRzQ?j zS@a}Y<3w6oRC4{0^69MWG9slmg>Mz<$SD~SxgOlfBhBCm9sS%@7|MMY>b1kC^f=Y8 z*5wLcEtLM3<5$ELepxKwWxYt8^$tE>Ox?71`IeD^5kCFbvh6^SrMEFRW?4+JU0v(9 z8G7aoeu zmUD>RSY0QX1t7>lQpzv0OkxCS^2UWT~T{>W-Ad)=QS7Pt^+QY2E4%T2#_Tas}uW_9E`wVWu-BsN#hb) z4+-NTVsU?@h3}>i;IU@L$rc4s>;I}nu2jA_JkOBP`dD&I3aAdba>7*oUzI z?k=~K?Z(LGa&vXM@v5@l{8LlEQP>njCR76I5pc#C-==u9yB&mazFY+^R|OC2{F9)Z z%e`-V4a!``f=a@#kwTdXj}CV7`akEMw9`$GhL5;i3Ux;dpz!XkwM=5QZm#(ks`CB{ zWX~Eal8k1J3Xgs;*uEs<*o@`3#4NR9s(nqMta$}w+-rN@Jnvx^F$L<_xPi@?;|-&# zj2CTW02d~kdcCqJE{vP2ZEvMfVD?Q(H@<|-Y%@2>B5A_u?mbUvZ5psH2;RZ`18@m8`hmIPSDjQQ zX*rGBV!I;m!JF!amrek7Z?e1Yk4JA%*B&EGRik8TuLVV!i#xq3IEP$DL3QU!l`%@dE~Mn^Y2 z5&8rd@$P_A88Ey28lYe_;09(b*H{7Ka~cJkDc-zxqd5@Mw}x>JRf?Mbf=_#JxH=dP zp07$9ygwk@e4H?9HKk#}flHr2L&(CTL#v9WAZARFQ!w*^*{b1r3VI2!jef@V2G%5m z6?yv|Ha*?+0r&%2N+aeXHLM#C8{M{i-~|l#M@0nUR?=oqWqSLB7zmutVU4H9sOa6m z-(H~QEp`%K-jyr6(Z~6`OUn4hwOT^d+C$2Fzxb!s*q&;86H6y87VjpAk?miZgg(x+ zd3b;w{w(#KMd|hEBRuC2Z1|>n(B`hA82qi7hVQT1ii^a1v9?zhH#dRifvy6Dx|XWK z+=>27N*NR7Y{GPX?V<5*QY|#o5o^jwDap4PktD zSLTm7lP7BOS?LQ@m{2nWFlqFYD~ob++F=dyFIKOrziD4TXbMQn=XmF2-Rhpa6!n(Xb? z2r&Ez?UR(G@Ntk9@yg}(e$?Axs1{_hz)g9Dv+|8T{A0m^t6o=dje`;JnHcG~lba#@ zpn}&tAwm;zX76I)_w@vqJw+G@{AcByB8xqLGb~HsJR0fo<(|m{H*(I|5S8}vH6(3( zG|e_`0iF`#GST0EdHy+9j}jU*5)m#7)tXcD#k34c!<)HN)#0t=XPOH@bX+cHWRBui zSK6wKMvYY04Ibx`i*;hGAs)h^3nVfSrtz`!rsocgqGf6=jwN2k{qN{Uau%y}p@RiuT*4Y8{*bZn;fNJ2}2A4kfn zYlUFrm{_SvX%^-c6**XP=2nLqfDsjw{*3ON%5(7*4RQVQwd;HA8D8iHXylv6LT5J= z>lFgQIdrGM^Qjf{bX>Fv*#Y?-e#xUJt^H}@Qb=g45( zl=@|zHY|~?7e$RoaS%8a`N;|{s?6HC*e(c7vX^JZr<+)DOQv#@GsboSc%=df&Welk z-8F>5ZSggc^f$PIIlLK)he_E<&{^mM8!M5vb27Zr5Fd?z{c#3HGA1TyM`JvOz0o3k zH95xYu`XwCLV=%=)wG->KFJrOy3ViD$3)DC#cHyP#=KPda^BpP+X2b`(<}EVrp%@L zBY>RE;fmXrp_JHTI*?EVy}8FO_l)P`-*cM*J_mNsI{1aT{esmJ%Dz$})EpDc2KFnSqOOlo&B z$byfD3tu#H=66l&M}ZqXnJ4Dm5dXQZT5X^oLtlcCo;kd_wn*#O9kGr=_$0|lw@6C@ zjA2R{+>~N~MPMr_p;iZo#Ir>rqvJc2_jJdYV$D-p>X(#PCZts(I9nbKTxl%aFOQMGKbN?kyQ_lU6Gj~6t@i085NsS72M`~otYqP@oN+r65 zAQ8`X+6Tc_U(gKV@h2BXNe=U1NCp-kIXqfnRH+!O!>Lm60LdQ?^sU0#v`(;M4@P%P!X0Gt+BRIgEi=zaXYQ(TYUb@8UU#8JQ0oYWS(j+$J zwY|XHIvNViyg~uySfg*8M3kXm{XeEJ^?UbGB7Im1BsI9=-pL}}gprQ3(eJ0G;~&DN6V8;*-Vqcttw*(;p5L+IbhDbe}-oFcVLq{blQ_SxbF9=-+FZ{Q0e62lg zBQN4gu!@Ca@i;pEypAmnH$Fr~kmQ?tZ}klyIy9=^XpjF>4^m7L)jg#? zt|-AzQ{7CwGQq6DXsNsTJRsUK;%B4Hh!=K>ipk+Wa&G(WnRy#Hpjn@l0%=_dVz!D5 z4ifK-LErX;I5t$#x9KgZyHd##uoX6g=My-$i&q#V$oZgo_uv%+A3zP(2Zg@@9EG8W zc?8T!y(c<*dh!0~7D1bzI>i%N@0%a2G+I1sR%PgT#IOkkn?OEWq1J#jN7=6C%o>3c zlvxQRobjqeo$t5&Zy=tUfCFt*x8_OgPO$+q)b@@-#tbBC#TMRM>2%`<>*J8*nV7p~ zx5vUL^dizCXo$EdDq~c4H+_jYsiJDU5=j{6wrxu?y{LW@Zqs-bs@~=>%22G(f5oqJ z+UF2pkRgA%J}FgRR$OQQ!A+6y#J?=Uuh!ovDf6_8Xv`MzMK`{9-u2m=*1zVudD)u{ zWq&7vuSAv>6ICAwTT0GOr$p0V6ia25qC&IBFY4YBxCN&Sc3>xmCns?bHbjAdc17fF zg5z=|G|!|4_55jDUvee)0J-0Fgce#qdgQbTIkPXPxim>ke^~#<*iEcQmu4^}NGele zkqS~tdfwel6@)^e1R?>~q{VH7O-H2A*fZE(h;r&`2Jw>6zQxW*MIlGwLT*nx)5F46 zgl!7(M#$)?K|FqR-3x%}uZViit)81a-s{ComVM7bA5vA9^54lXto$nWOTpy3k{Rj~ z?-%)JY)0aNen;Gqe$pZx;NSR>Tf7q*8u~23K5z}A$e$Ir;~ShCd8);2ioYhOiHMB0 zv@)6L-+R!mAKzvUc9EN`g8MQ*@EjT0wti+qMlBTDY(?bfJY;EsZpvANZ)b*u2_SOK z3l@XIE$A#yPou{g?fWYuyTq|K+_+a*X%jS#F^MNIBE2G)DQZJ!ss;i1;XFiXX`C7d z39~7gn5pP}E7ir#5z-&DvouhP6NnqoHiP-F`hVZ%K4`%z)4#~-bno=24eqA0#OM6a3{=MpS_bwJfDJCPj~ zT;Wk`LS}e>=WGCrolFiy{+{3!$o#PADQL`p3@WFMp%}>~4Pw1*-LoyTl_e|nfDs9} z#T{IU!oGScpg!aX(4!l8>3GTw0LPc488&UVx&03Nq`B{;BC&RdDYAanrK2!EoB|0| zq^=eP@meZ)IGf!+G-XU*hchUVCKgXcA(E>FM1~JD0glT@OM61%E(gz%#=mi2$NCeH z`g8BRKbltSuZ@SVf4H^7+&sOmeVnVTss<{Z!9oKh!Q9YPJGwM}760O~VMTx~B-`xX zvVy<5xC_5)d&+CzZS4~MF#x|D@ab{>)f1jjpFkQ!A9-Ww0x5-stp-4g|M(6w6OdX6 zhVzhGcbk2r>{RoD2Be8UKS7hC1j7_v{9SbcHH%7Yn3NQ+@ng*awmbA03L`M_paMB8osB1 zNZkeZN(YisKYIMqRZ8od?3N*UsX5nyJ4{U!a_e zmZF{mml*EJ-OnNf_}v16Ovr_W8c2rz6d{oKc8r`;3wpqgP(4Xdz(tj4hNz*?R;a1- zQY~rvQWl&f_}I^EB}7#Gk}@urh*NwyD?^uACIKE(ikK- zk#cHqk#4n0cs0g-S^Q}r>DySr4uay6{j=JCtG}2Rq>oIU^Y+%t^ADV|NurDw{CD;k zCd)Zo2b}Sd`Cw0s>PJusijCM1R`e%u#RdqmWc=ddY5R1&a~^Mi?e?#FVNKbzdED{y zCLFo}Z?-KfNCgxoGo8S|w>6(jJ&!mbp7+qn&wL-ucx<&rjvH!_azyZ|YLoWe^G>n@ ziZQ98;TG8=VO`mix-Z~6DYGkf{>LSctl)jV--$FLqg#Z2`D%An+>pTXb^H~U`py*% zE$y=a17FJ>B+gU5@g`_dyw=gV-HW;yAWI*4d*s=fjtOSAwP_XUk0i@!vKmFlkj-_=Yg(d zC_7J{e#O;T+F)dJ3Ky9l=k2RA;rqW8eeIyW-izIopGK2(vqF{X25q+gT3- zK#EpR|2#Y9lUY&z)Z5RpW#x!TDj>o&sN#Nw{g&^yqPF=XxEwexnn@8ACLQ>oYbUa- z=ygxu^BfM7$^H!fwG***e@HO?bs6gSG$|bL@J{wl79OVB)OJ)wz8DIvwtxYvL2MfM z1818I#WI1@Wp)qdS?7`QH4+nXH{g^$q5euwpu>uqnmeKXpc|w~o+bYBKCDP2lGb>8 z6W54&{WPzgBOH*SPeag<@0aabdY1VywgbFyDkL+0_|xD&i-zCf#>fUY^cr`Cs|BEn z81f>~Y!WRf4ggL4;xg`@X?KRO5lU9?3ud`)nbTQ}bB@q8v?USR-KmP$>*rJNmp>BkkBx!LpLuU> z2QOzuwqwF9VEQB=4e^{DuZKXdmnaM*)Oha3n2}_9qy;_K;50B)a}@mxCSK?`GfeCx zpq&)(2dY~a6U}OiJ4yTpnWU=Z{2gUQVIgC?*HH?FVfC#rGBPLz zSFE{@^vv8I7#d&$h`tfm$Q@3+>&GrHGJ>-m6HY1&@zcngJZ{YrGK+rqzq!?R76$7N zjb(pa-+QQnX#14wq*eB%l$V?T0%e5jklXR@U+|6{3R_AeFAsH234b!?+u(nK(I_Dy zxp`v_7>7H_O3&lLZJyec56^r4>QSNL$L}YjaX+H3uy%K*XsxU=_Q7XaI7T#zX)(s+ zObJ%DnIYU4PfsNKiKG7^#waJJm4sKHe>lD3>C&?iNeW9Fz=P~dVXw?W=EmtAmA6cd zPvj4Y84f}=DtW*#=RI7lI#B9 zHmOQEO7Iya&Uhnu5Ydfi@f6WSS#c;tzTl4B z(LOMigNPW?6w|u>#f(zQc&@(y`Fo%XivY?GwvrJ3O(lg^7&`u7USL#E5T?ic+Qs(kd&2kuR)#OMY zD~HC#rK?UGl6}WgCbZIKTrYmCfxr zYK^h%E3zZf9J)SHm3agFikVLJ#;#G zaxH$}kycQEfvAkmSfxemNGO4F<`b|wBNo*ZBe*Qx;0v>BL9@qw>HhUQ^mCWB1KkW% zV%%|fi85A%DmjrcRbrQWN>S(9_;JWy&(6;7^*0zMDj`8S?I5vPgBF%T*J2%70=A>} z4E{Qs>Fs$WYxwILI!E&VVgY>7Wuj2Y#KROQ*&iN9+gw{lJ`F$O{I^zE(8vZ1k?692 z?7U+uOkoM$?aaFFhPIjo&}RyIv+K4xP%$wf<C_Tw&r|v z67lEn7aM;z%|@0C0b|7~&&_Qo{ zhFZ3xs?@u`pGF}b#&G>)DsqSY$U)Ldnvd-84l5M~3%dXRx`cpyuOA%JnQ~-I_C4Dc zg8o}bl-mnzYi;q#dgs~+6qqV1T3B)r@GAPiW%%JK<-_S0s-&?bv%Z9XJ}KMP1X4$B zq3sI7nwR@W(X&CjOb9=G!7nR4K(1}i*Wf)EY|&6>x=5uS58i-mHG!KwCHkjfU15yQi3AB+}g_HT+VuUuJ;5*N~iH8Jvf8Z`_H~vXs>o zQP3E>35$0ACvYB1xS930s>@qEiJZf+k*rB3#H51;1fH~tURk7spiGu zac#QyWjs7|DE~+i-)64|6N17XDkqX8gv62I;R;KaRJk{q;mf-HzlW=XNR=M3*(6EL z7yHd_{?zrOuf9A@JhA}7*6rQ|caFs*DF*pP<~*NA^O=@#-0s^+KZ_+qb|x}ReaS!K zh?-pkp84yEvl&C@4_|$jmQ=;o^dV-Ho8AdL2Hr75I3KX$flMIxw=u&sfjfa<1 zDMNCkxYsLPBUd2mpvoCp_J;pP|Jl|Fv^_7Qyp^wMw)aV6I$DR-QD}cUL%Ac_k=rl- zx)qEEq~70~m84y~U$?`9(mel+UwyGi6T?Cm39;cvZkfqsdw{Y6eHVj9fuS6`G z^eM@>@N8#Q^R~NCMhjv}U~rF#q#I|Wf)G?9DIFbp>`~>;IK}Rd|EImT`im>* zx`dGsAb4;mxVyW%1`qC#;O_2$#@*fB-QC@_ad(&LJn!>;f57}^?xt_*qWjc2U0qds z?Nz(ivLn#2+&`<^0v78G==)wN67p?EwPbuIp@_of&48u))9MLyeDgJyC#9i5U-Bw4OX=V9TvjwuuF*l7n6)! zv8bEnaLZIAzJW4K4<$#)FB^Av9k`czteVxS5lOuH)b_&)SA08}B>$FaZ`SC9mHshK z`0jv3)7Gf8WeGFCI&=j>MZJ5@<-Kye z&mZtSxY(M8yPQBschh(O^E?c#4J)4NpkjoXeP(S6LZxqjIwI2T2I zo07_ZkmM?C^v4JXHU^Bal0a4dVqy<%$JI+e*QULLM8z#*N3+{9jP9uijO@d>)FTT= zC=CQU^;z>MHb>LT5g*=89^2j7LlNtp9q07@ZIOGyDewu*oe-Ifou(DHWVgtQLST++ zqk1~YQ_m)r%t^RoP$<5e&}h`}S_i?g_B03C!xKEV(r|aGno4@fWRSfL?P$(eS?(Bkdq6-S6p9c6uQ`X&UkLpHl0Zze))rBP7dSSzln{%SBiBo5iHe zu*Iry;^_~w`07~~)$G7m1|i)JW4cGPUjhx6h~7nd()72Y7-Lz^AmjYI2yt484CF?$ zvx%VDTyUV2_~sXvc42>$iczpw@9>TnW$uMt+UQrivLP{OjP$BOGi2iAnm@bqx6uYX zR0!-G7PVemPzz;2qenihlCaV};XIb#X5;7qMf-?4E_P6WQp`%#hI~y0E;p})@98Jj z4E~h4K@ccF>iVF-9BQ zt(8XMG9+dy{O<%bEQtxImliwc!SoQVusY$y9)rI=yvOOjs6cKe8d-WASRl4Ki7H84 zvnj3+{bY862ZnP;3y>aH6c!&zN`6I|C+aK~PTc%dHC@LL#Ux#Q{D`H{L+w=CMs@wI5kz5rEYSY^rZPui9`f?bIMmmgRW@QZ}I3uc*n z`XSPDn`Tdk7XEnkFje8x!X1o%`K$bNkRni=+ zx*pKc9FVp65cUrdMTPu3dnla=o+wATc@|>TkAXH{?(nnWb;7}7Vn)N(-&0YOUSVGJ zsf*_^i4+8`y~Qr-C9Y z5QPJOdwKN`B8|hAidORf)@n?)y41Z`)Kq;e2wBTst4%dVY!~a>V=Rh&QS`89abuGu zDJ9q+3Lr>~c_$K2VUoI1(!uaI@6LBM_kK0`I0!>sIx^bZ$|=Qvd;IkH`&k1x%&hVO z41HdgEq~mrTXt;kiPw^S=!q_=^b#_KWDuo9_YzPyeS{Z1xF>&hFJY;(`{l>sJHkg{ z@s#3`q7f)nQo=Q=l-G0LD?5KIgC!AWZZKE zs`Z+SLn zsF--Ve<1Y=bMJuQClqYJkC>Uc!|LG^B0RP<4>i%bMl(2@M)Q9jrEGwRSc~yg6S3F` z^AG;jGbcxPLFQB@>@SKc^N)7=Fb7ya9VlvSrK07df`tgW4Q%qYFry>L$4yZUIVIIq z(JNc(QgoOB#Z8DgzrQa&;eliUda!w9SDRaCN9-J4Ci2pcVMS5{e~@R?C?C{H4wILM zQCjmX$k8K<%95jE#D!(ICAG2~YSf+R?!q^Sra(H*cMi-v_?SL-Y>C%d0wc6YTPz{M z@QXO@vmuyj;+42YWa*@TET{~&2NC?zI#Xf4&pzSy=K|dAT8w8H31gBv`Un6HxbZ}k zi~;n8lqBEy%CoV@_vGk=&AEnRMiKctq})YgZxU~!y56b7Bz!=AsAGTbHU+7Kq8U>s zG-%mngONdp^tpyB0!$9q_Te-fxx)tIVQ%qL=^?v~Kebeh<>6 zj_8#68`mQtF9zE+E*iM}Cfx_*GID^|ft8lVFnWIt^TJ&585GhRmUX|zx{1w0R>d~_ zsibYSoaR1r7o%bOpKM}h>hOTQ8UkONceQss?6$?h-^5ypUF;(noC z0ek5EF$uI)4ridBt+70;_~szN*K{iU>B^{o)ECYQ+lzT`E&$a z40_`=Bxvjr_#Xwf%cYl<5KUmn*q9;ly+cIOp(eALFd@k{pqy|I&F&Q?0%)=lzQ+&OHMlA-gPE~TN-swz(fjA=nmK&`J_4TZt{Dl6tK#G1Sa5U9J{V_#jB(*@8EKX5y zAy&g$jhYo}YYK;dfay(-jM-fx^h!zuX=cvRU&J6`5&ZlmE9zg&0eznM>%Yrb?~w6T zp^u7RnxXy^j9`4IW5{~{|J1aL5d~?H?2C{f@)t+?f|iyO(F9*2FbEj#qgL;G17{&Y zG{^d=+Efx4k}y^JC9(+5kV+koco|V-a5;}G$h*tYph>b78x1f~6vr>k>8sG-LTJd2 z(~jq{$w_cgmAs+xY+kDYx{G-L@~T>=w*ih zG8$>n_z6s1wEGHpTBV~HLf z5^Er3c3Uvh&>;xPwIIS)^eE-3c3_dvia?v{2uK(skIR2i`T{=!I7l`c$c7S^&1fz#(zp>~egx}}B{O+v zvffb~5rKtj(3Amu-7?k_elhroBiT;cn`{d^;M8DQI>uar*R}W zY`_PNV0$P1r*XbHa}k}fl)P`;D?n+B@M-I{vTRz(6Y{Qw*Ep&zVGY$|xwh+u8j_|) zAA@G8Tt8k_h(#m&6>Y7lYorArphtKN#AL2w^(z#qvYUK1Q^)+zgw?RVA?y8Oy76g3 zkd6{rRuG(;iu3#Q#Nr%3jDu`>mnwrj3L6{z_n$u{6(u=~n?hZB(3ZwgX+ymhT%leK z^Yffx1Wn;neDx9jUs!tL?PxpRG04eu0R{vji$?>rn*1s0l-MTAk$u)?-N`-6yV`-B zzi?LFufD1>QZOC>B%XI)w1&TN7nhb6nhp!z6f=hd<&tA1Sj>K5!~SAGXaL<|etP<% zm$0=Hj?QG9n!wu?swF%lHTBo;va%8@J7zS9`5&!XxFsbeLL(Vt5fCJki@#1zw2p40 zWV?ULegm4)8Eh`oN*~f0dXDd>Rv1U7^z|OQVd;Q6b~d2tNEjmcC1n?mZPFao7|i_} zRMV4`wIRB`Xb+VHrYARuc^GD9UM+jWkpR@E7)$#pFmN{S(C_^>X8MxKHUX0)SX z8bM?5HogK9uoo@8|9PBWL;I^aa7~?oh+#B>i#)`wOx`3S_#$SOao-1Z>$>{ksuX2&kWclS8I@W6@PsAz2Ath>pr!HEIWCA|X18M&pM(P4d~a zUK|Jss%KleP&H8IOq%&i*1#5gI*w>WrEVhl>1h=OTg7}zh73**7Vs?0Ds>{#GV@Th zgs2}qF0pcJ%9OIhq!fJLB>oci6z^P?Wv`~oNy&42*%R0S`qIN|x7*?yC2=he&#vh# zSC5}yT0PY}pUzs!UvJL)=i5gwvjir$5fbJ=swli7-o2M`Fk113R4HxYs$)fQCJTzf zI_ch4JZ%cB5%nQVe!W~}%|6$z%!YJ<8_s~vh9C}kN95TbUb}{B^c_L7XsC(BLX+*) zVI1=Fvpy@DDvP@b8sLnKkO;rJm%b zz^Mv`zLs8XM@3=L5%D^tlY z3t$(}jtFfd352|KDRc#zAiasxe$D2I=>Exk-^zOjVYaimj7ln@{*ePQNAq0noZYzOry7e@)*tVxwnM8i&umYvtH)a!N z!Bu{IuO7#LamTf5_1|~`5F3H|Uv8+Vr^sj?xet?yS9XJ~}IZb<4qB{LTM-Or{SHppWvV;p^E;WNPsQ)YS%3ye?V5BDX!&(Jx;fDpl z{=_k&WogRvp`G|;%Z9Y_X?POS5?A>?T1!RV*_qxA3Tn^P%}(dO3m&R3O+w6xjiu;7 z@4X2|K;u;!3Tt4fToqJbMYo{gWOF@;duiLu(tX2oY3k(!zMW@0@y_f1==8LPbo+8z zb-S1;GT#_!2qFF~jWIP&u3ZFz9e$r(>| z1$iv0$L_;1nT(jKP28c*e;;3W#J#=scfAun7|)u_-yV_|h56xqT6z6#kuoIfwd?MY zf6|5BEAF!v;(GrgoQ)n4bI$GK5I3NVU_H+N zNd=l>G(nTf@Pm1A<6ZTj64oeh&g}{|(+fyywWGkJ_qWr*=JxiorTMb5f%om)gqL-8 zoTiF*>aPdxvn$H>O~4#P%Xle$0E>ccZe5b*A-Cj4W8kyjdpl-LjTP?Y{Qmm${pTQp z8vpNGXWge2=ilxEXKg@j?wztrW-A(c&sAi)ibF}c3jK$2O>M`r{5f{#*5(jIQZLnVxZ9;o^<@ z_B;;>OeYykevX0NmYM=Dd52M_I=fe*Jdb9uEqCv7)Xs)s@~Ci0_yZdBvgEww!SMO_ z9r)QrCZJt!JotkzUm%d)KlB`?Y@yqnd8d?Z7L1D4R-VT)%AXJ5OAGfM+VzZP+97Zr z1SY}`I2(teC>VTm3t_W(r6$ai&3o~DDqBl<*5&4Tg2K}cx=#oYhb6q2m6mhXx_R@h^+O6Uu4ldNdpcySnfR1N_H4RCRk&2=}@=t?Jm;~6Xt)=gO@ z%EY311mR}mpem|3Q8xS~b0jMfiJG)Sr47}-fqBxzWPL5)lU_3frN>PzUWaTbF*Zqr zrrBqyod=*g8Vi%?>2r?Hp_I2If+^~qhUhOIY^*7SU%62io1||1gitLO_FmI#?tYoe zLrYC_{H7J1NonedKkhrk!_KtuQBNV+0~EeZ0VL!&QDmqqFi1NFHJX z2&>+Qxxa{x$*7wlnI(b+` z$Yar&t>nw$uGQ9zUpESZ>hfC1-Ivxy2X0d07oBFlL&Gz8SHTgJEQg0@5)?FikcLFP zuLTT!aTUb()2T4m_)OBmx(r6G8mJ5bU&Bk6oOeVh3Sy^tkh zR~Z6QFxw0;t42fTnUw*S%vf|b7+S^Wz5>Gs!*z`lB@4$&jSLs{dh!~UCA>r zuB`ZI2$--hsS5UQPXj)4Gsl&*H{@n{17DBNqpqZYKNvW?ovh;Oo!ssR01=Eh4OeKg zrm?uevD+glz3~v3BdLsiN^tAC-(+Nl?+J=NYoj7h$8}v8T&hM7$F)93KW_7i9jy0} zY#0QW;$bs3@MjYvjneYx2tR+hxfds-=BWL~k^OeylXjXoxqXk{z^WCA$Hg?f>n5|T zs2K69E$Y^)&!}gjG1PJX`bFU*@nzTYrjYh9hruUuO9uW{eeDDcdJKHRME?j!JKV!! zc8C8fbZaqRTfq4%E-X+#g({as1pd`jxpbwc0St^FT1r$%W#?vlmJMD?BrX>lPttGaH{0d-WM-b5rN_r5vbSNDgbPm`>j27@hSy-ShEd`Q> z9A7j`>U~j}=st&wO+aA1FnXLxdkVOBsXf@%%;cJtGt5r{9=^D3BeDOqeSn#=ZWCPo zqG${40J1klR7F>&q`YIS`;Bt0#(|%q1K-#_6>~e*^7+DWy`4RH!Lp%IP)BJeVX@Mb z^im(RPouxszE3O18e6Y&W{XLe@h-~mM4IzgzXz>Q9ySN4Ul99bI@!IUHMC=dDR2gc zP#g@X`~#ATkBS;`khcBZc@3U*ZvptKbOXo&TIu73F#$&o+tJA#gDF{o^HE5;{3|EsD{87h@#b{P3|Fbb6{Gn zQ7$g?D~f{PD6}-)Zw=YkXM(C$Ob5do#vcGzlPk`x&{mV|thKf)((F|@KbF}8Ehw-+ zg;idH1LyaKnkeNeXe=oM>r`TBd#BmH0rJ)(D&HtDS&B%r6h9m>=(Gj3WLPk{jh=48 zsTf8EZSl$-zbib;3X@FWad~E1LwDzTA6l<2^7lgC_VM0RIMquGeg_nqDXA!lOUlGa zlZ6((T3o{C=~5f~x^r=2%AGXpInin{XGc~*m|I*NF`tt9Jw?AC-2T&FQ||6Qt(i%R zBDep(Mkye;GM5@BxH6}dy3~4`*-=I8dm{2~-Qg;tM(6Rm?b^Av0N)o2TroRIBs?I6 zfP0XGonYk5%;Mlx?y1||%s_Fg--?qzhu#}h+av|{NxPtxmutHP{YZ_=rs33H!ycL` z%6uEPyu=ZgXQ)?^e<04*p`(LkxtpTWFjdx6VcUh7w>J)4tWPdCo*-EM&1EE>C%SZm2;XpQ}*J3&g@SFM@Q`Od*9y>*%V%ee#U zZ;IMpBuMK_QM5yY_Kpzl46okLqzw3-lAgUDznkyzoGSTaf%{lG>ccFrD@_g@MQN); zNk1je=*$|cqRTyzA~O)?7g8eRj^nrcFEY+j+5zQKE5^qe@X7jQB#x{LsHd>EC3P&? zhTjP<@}GrMFREb|VJdXYINiMY3;6h+RQ`&3Ktf019jNp{&lINVc$n4E?+u1O+E$jt zncwua#>TdV#oK2P{(Z+cQF z^=n`9?`W<+mwRx3M@N_q9ZTj~ElST4-~YmJv9ojYd-;;s@DD6* z95V0`E_Pd-wCa?rofP995&Qwg8yi@f3(r7wF>6~|v_Hwgc~jTplZ7%x8$Jg*o9<@c zT(-P1yI9JyHeVn?nhsj?&Q3Lt`$^XVZ$wSr&svmJs3e;suROZ?YboH|xVST~5}^?% z+U>5euR2RV@Xc89$SeR9NPQB{l%Ye4c0ZYV^GNz9wu`|Kw$;5bLdYuK8 zRCznWNc;Nd2s@`$CL)*q=#v5S(J^%)e}-|EAXSD;{r&r8M&sKUcA0p~y0r?A6tRhX z^1{2ab=*a-N%3;Y-g3hXd^`ig9$7|FuwL7pzE zQotHeh{>pb?i;<0ukTV&P8pD;Y!C|@Ax=_n$lP|neM{@ z;OvlD1BcXLZiM)*(G*~ZBp$!N!Y?J1kr%I{{dwjp2KC$aVndA|(u`7XP0c&*Cao|y z187gg2N-g(7p9P#P`iq(d|Bt#pqd2)YpFA$8hjO3#@ZxW(aeOMlJJkoG1x_QE;nV^ z{qyV!uytup^`rcAF*=1R_VV_f@Q$!_Y6(8b6No zxTXnW6pmni@T)VUS67~s_fBEUO_{v37ibHR5GI-E;Zz(I(?cwRvEA9{=6td|2;W7s zxUtJD(dT#DR}Tst9TnpckWFkuB|JPhe>DP$-TZtDnROV`sJ17$6+XB8OtQj@wIu`1 zdr64J!_XAVy$p)a7(R8Z#>#Dd%>%QmAWmUmSkm)Qs(RIO{qZtJp_>!%rr)RBwa+{A zf>{TROf?@N-U}HZbVnD+J(baSB`mKfJmF}{(B?RMT5V8z^w&RIOx}~Lugj%u^(q`t}AIh zO!K_;GYJe%wXn1{9Og;k`kSb9@nTCRrlh2bF7|xILBlKwEODPLpwaw=vD-(S=wD>Z zJ+`zte9v;ruPt<|#Oi{LyQn=hj~BU<$?hKabq=%KShwbH&!+Q>_-^tq@VZL9J{`T4 zUi>lYlzhKZ%v${o_rwW0;wo4AG7h=|PA+K=5f(2~g40IN00|o%NwBMgt!{M!kLUtr z%T$K>nTo01MTU*3Qeut|s=v)fbM}RMuH<-0e`gEQnoU;V{oNMUZ>B}o8L4D%2QXGw ze_31-5T#?uAip2}HirpGZqTP9%TjDmW`#^zi(ES&G{G_-U1n2KL04_DltNP#QC5wY zIX!9CHacz9`I`ETlDc(=xX2LuRE?o1m(h3VeDHi$iDDC33|DJuA4lslz>6}wlsa`s zSXoes%@Nq=6qonz=mM%@m=%^#4=q6Qj9jZk%7OTu9i8Cf855N0Oz#|cJ-*WI^=OrE z`L>=wb-Us?)nTctF>F#q4w}B&M)a!HO05&NQIoG6XhJ}w7;#QwB}&|_@SEkCFQih-M9v1v&va`Esc1# zv$JtI^XLKxg1zUvK|*o|E-eng`*hBkfX79xX8P$N<9i&mR9Juypx#?XDfPhw`--kne4|lfdo$RdK!{Y}2 zXGtCShpQjpf-AKbUvqM>rpZ-=oMnxC$vc^;uD7dLAF;r((TllQsW0Ct;>?(ao@bF> zna6uSYCY*9uE@)!V)aJM!H_DQNg;iB%*XrsCgk3soZO}VLxx6J!$kFIiXca3fl7-z zsRv(crL!vYf^(t;Eti@KvEcWV(j(m|mcvrL?G5 z(8pTbfC%FmU&4RuuaJj{;tVxP7X8#n46@K9jU!Jy_k{@0%smxEfXo~jPga!|Y?4f~ zuw3i0v!osCmDXA|P3^yO1DtV5cj@-dIxW>zlM0TNK%Uv)lUt>dLMzzTdk3~#I4IVW zitJD}Rzy2&yj!kt{?uYDd{6-^6<{-4dlhp_c5WX<)9CLnh`>&&P{`%hG-c3#>~q~7oi)uZoo%G zFkZ*+)^LX75Ls~Ldx3w8EQzPp94s9LqnPaUmskiBZ-aHo*f-mH{lT$eN7MCM%F!78TqFviPtU9L3Y>{SF|>d_D!3LU z9BF?Zzi#33GN-UviqMAy0Jle~j0aY!=TptNoXY|6vysZp(HEY$;rbD=XHf{tp~0BU}$-Fy^n5hYHzX`TjR;!r@B zE7h$hTY9ajk}6v7{7+FM*t2@MsTlQ@MI{*>DXu!qjp0I@cY@T@L*7T{bJx0K%0v0Z z*)B^iRfi&n;)YDLZBciw)_03<7w*2$T^~isG3@eZJ_%MH42*aROtw3Cn5#4?0%hST z2pwoavGti{Io{pit(_?0#`Ti;81B?hHq$A><0h0493*)#x%sM?%t0|b2 z`y{^ckS(3=gy~By!_{zx$lLY^A3XUGcikyeUGx3*mWiqwzLwA1*9k%k==$I`bN)5i zw+FWJbx%khq=mUTj8}9HO%ObMdc%U#pf27~5|3(PthZ*8Ieg`G<94<{(d&--PWaLXtpXagz6(g7us*jOTc+oC=`@zJ#@X-0Z0A&_^qP`6 zh-$o%2ct$kHx_~E2J&at!Zc<1_AA2VMMk9f0g5xM)HF0ybhP^R$FdlcW%|;YNa*N& z=RK!(z(!QoPCYocII1ib{H~nbY#m6SYhoS6D=h7= zsSX#~oZ8x0Tu=^+J8GD|>=3+INcy|lU(05!==KcR%4Q+kvN;ajWaY?$u{JzeQ&Y;s zgv{Y^vfy`*vG6e?ozujf?0CWmI3UBaH-$NE6#JRdHy1itoBwahzz_KEcL|&z@fi>cc&=~38&Ai^81o(0+S5KbJ2nZAV z1D6hY2FSFuMrtPL2?-795v2)qvb!7DyBWu^a@p!GNG&r%9cRG^;nO|X2PR)zAvaW;9K zmz7ImGipz5o@=FO6f3GA=qwEu;XQGB6vy2TP1f9eG_2R|VJYC_7Cw5?;5!7si+UVk zM@}y+%1O9|N*V{|(+rO9^U5a5H9p!sa%8oWlIcH=S z`an6f^7f18iiSWRo!=@tJ@&~ev?(gT&v(6bxp^zVNzJCOe6V(1ZS++%35f3(OHpDS z4&MqGo@Qdig8s)pt*~(COdpKePb`=ICqfDDBwL^YCA~8hx~tt^d!WY|jn_T?AaCjx zX{vKb!aa-0epd%j{=rwN)e)=gwAPZ1R<}DzS6(_S&Z1l_9r2LL@w^XkAN;k7XUHeV z%7G9=J9l(x(~P#N-9tsY;wivEpX|RTo98hLsxKQGv&k~HZLh_wTp7@U4sUk4=kv7E z40jyk|9DQ}D7LyZ{aiGobiI?|eTob!ZuFlb*gLDFc<$MR5!t}6M-r2wKxpOW!HOUc zMRK;SsfgMsPAVC*-uJ^jjFrP#n~`F*1Xk(s3MvSbX=qHGKt1>8*@dfbi~-B|nj=sq zFTFA<);5c}^f4R?O=ddZDc;6zp|M{i?UX?av{{W30OTaUdR%k9-gspP+eSqH8NDyA z+AS}Ng@Z%tUILS|GcnqG=^Tm>_5IZxbq88zf6C-MgQJeKJ&Lf)*1wrYkg^zs5dTLk zm;$5dbXhDOK6&~VJ$e2We#jwdVDZ;r!|&MG#*~J;uwQIfsB&jG$+y29Am5zi_w@zJ zMGC6HbS(u{mU13riFkR5lHZ-q@(SJD)LxrYCo6q*hYn3e%mz-4kY^WRW8;w-lsq}u zUt^Qc?4bN~XOFvqJOTvdQBpd`&g6gx=c%8t9uV6sU_PHPNA@vT8!0HKpY;mYt{ah2 z49TP5V;eK_=Jdsu#cL6KV*I(CygCyQ7zz8R$x_`AVdM$Po)UyYn-vWX#)7AyPdih+ z{W3C%u(PBpDRzX5_ahT0O}ICWC2ZXnS58T>S~3E0n&tQIJ+$qbU9VJvV0RF9RLtz# zmko@V7*2OJdJs)jvv;o1AJTgKSHsu85PF2}Dra?cd0n&A-(QNDw|83+ZEl}p?Xoul z0X0Vc90UElyD}S%l+Cl6A!PdxJm*OKGtWl=-@W7Zw)EHS2=kUmtJx;uH*1$%_=SO#6ZnK;9D3@G&HaCAPfrLjrO+YZ-v0jeQC`&d zNO30k00{!Oz_&Ng*pWT-rT>zl*EIcxO!f{AE43zY!3NPuNfN{{PyPF3|HGYX2f6af zOG&|k09=ixE%E<17E~GXdJFbR5Q{}}kM#d2RXe(BI#eh{bj86>?TWB5y>A+&rMnNV zES|}rbsmWP`DyF%u7Q|O2R&!+eeP?rY6L|yV24KmDs;G4!QF|8p^;Dg4>fB?H|>~F ot`DZFigpP{z zCJ8k(CA1Ji2?QjxH=J{R&pFTg+GZg2LL$VdR$I)czk{i06h4m@krV5g*9mk2*=-x|GD8!)tTY8{_ocP4JA1Ko0j zw_%}(f!AAj+fiRgNNdB%(ntrZo{nqH_CP*vpC_XzC zy|lA7Bfaq%C_EMT;s^vBVSpVS9)wE&Mifo`L?>_krf!iAC>n=dD+&2(HADG${Zu$C zK*KgcCoAxp$9gDml0j)!*%kM*?nmWI)EDV=#-2z+&K2iyzZ_=KKsDJzc40Nr1Fy$TLSG}*v=SroW9&67?>_HeNY7}x{km7vtXO*) z^|}oy^Lw?3xfC&OS0p`#Jr5pa*m>J2|w?PKpu54y&9$afke)yU* zfk9@z`#&iw~R&Aaks9u=H9aaD2ypWGxhG|hMSNS}&8Y_l0q zdZvwwb~nQu)Q{435bgu7DWuosCzA%arfF*Bb#f&|y;a;K5hw?w`FRq4LZ;=hXcb`q zOYG?AAYx?#f?&b%YF(eZ2zm|%S-lQDssUYgf_}jR`FUxmm4#&_u)YI_>yXo|wh;0v z^0LUSMHn*M3h$0#i0ET$Lxn zRvq)Qgn>bUi|B22cU1Lue6QaH;Q8NK`ZF>*shT`GsY9{?@l`AS!G)Eb)>o#TTxGJ| zNWpZ3_U;kIFbNBJu3I98n(7%(7%bj%q{2s^^3RL*yOF*MPvKT6o7p`19&3bGND;A= zY9*1Zfw70M$LwyT6B*;?foCt_eF8cdsoPm&ID8S>*jm&o1Q?)3o0443b}j9ht!qpq z5-9rD4H=HE7C;FES=#@TR0js3B}30Js-BUeUPCPacW@34v)q`&-Q{KwOY()>g zJR=Cp2||DWQE1O}E)rple_bx~G2Ls$ntCf~zichieJe}aa&J6s(XUbs&t2T!6nQ{? zU7774(=KnExojmnB87KAmPE8rUgq zbci-dNv{=-gHC;x`o4O0x*}ri7#h_zo+$s4zqA^#hFfy#PPd~L>%rT2NYP;_ff9X1 zYmV()Yo=1sQ(6dW{1IkHVxq$;h+*{S-;hKbZLJQz=(r0#))Q+}pd_v5KSBR@&w~xe z5H3ySZ2XVUF@-a2uYg)^O z|9jqa5mWIB-L43j3;k@WRC4;O!nm>JzPY|c@ z?NBz+yxVv9?c)xFgkc)H8>IBagmKf?!`h>1MQRS}Et+doZDR zGy%x3??rzVGra@)cK=1$U0SUk0~hMb3bXs+38B^NW!ffvJB+z8uM=60-tDlMQOSoJ z@DSua@IbRtqz}PX_Y;5HgO`BD7`zc9OqeLG#m|l&Xs>SvlofgK@(xSzA8cixC~@-42{ zJ4OGkmN1kD$2#v86sR1gVKJK;>iX7k-OjxY8HtT89eJ1g71zE78s!DZs)$$-9Y60r zAMJ+{OLZLU;|-`P5=s=Sp7F(|W9680IwH`&nu-+8cKoE(1bsn9gf*#LfydQ^oPF}~ zgT{1kh(RLXci&-ijf>7j^B>eMPA~?bVDTL_ojm+`3hoG+V7Z_d-FBNg4aV}17@Vz+ za$8nKE=z|c`w|U%%*baZ7z4KyC_?8N%-v%+7yoOhzXo)!a~Ki~Z%F5cQ$&9~!totp z2*z@b3DUoFM5+m#EZ6+!j-|S3KNPn()GpzbUI3z2ubE%F?lVfAnir48q1ZMO?KZ8A zj&c338s)#i`ck`R>FI0LYvOZKq1pv*PpfX)N0Z!q{a;*r*tC z#!BB1o>~@`ov%12V{aNqi0{)K`*1uj;3m8GJnKtvkz1v9qFP`#W>adSTJCOmLDzSV z?gSyCxqiWXMb+~_l!CEi_orFcWXytox^OiGUd@#0K7+h{j3BV2Mxg9jlpH(xKk{9| zUHa`mIpC=?UEJMqRRi45UZF<2Oz=GSPYsVO!}UB65&J=z{9;o!!Q`(YC`Qcjrn`Pw zoNFvhM6Rb_Cg}D%f=>WX=&_*lvu1|Z3g*WXJK_~H6QZmUy8&6ERhw1wRueOY)#LG^ zM?G67o1y=x=r47lGMMe`8xvvBmlVFTypEG4IySD8_9ei+K%)SRYHosN@=~mGvdm>p zHM^ZeLh*-&57h+$f11=^hV>_d`p>68*S9!9+bQS!y{)f!KnjW0IS$%?b>b~8*IrtE zB@jNZ$Iwr$Y~Rw&E8~nVyz_5{A76`@oUfU$w0(YhSs}PjZ{*%c)&dQ9XW53g!UKg0 zRasYttOEae{ug)tAL}AcPd`yTo7>up`Q99Sj`C!X_yi{CVZhhAj;+H&a+6A}^qSGU z$x9{z`fv&at$`k_sk9FtPcF@pLm$Dc91`ik{0|=g#^(ROYfR1zt5u*RM`{0`WLch= zIoc50`@rzhDmI1RJv8&$cM|MqpoI#9?F}4}+W>Nh52ZJUnA%>oz>c;H?5?eFJc2WFaqNBe>jO3lEYtr#1@BOmkMJ(ut+1Cl!=HE3)aE!^GM?^!hqcluPPb+Am5$h7wjYe|9Ddi(>1Fna&-1 zTQ6;ssh!J(qx)m*ybtTK&(At1%pgB^&Do zFQC8pnI*#CiCq3JQf|eT*CgR3zc1A!WZrPd91u`t6QHg%{^{~4`Hz8L_}#^GF%}1f zu^N-;Y0SX)Tf82JMC=;X^}4-(T%`xKAtgS87!a?36^mH%6%?Z1jL#k7g(2HRUbpMp z)|Xc^xxNI3EV2A(R0Jla;n~JLvd$ECYnnis8|Uu|HHUI|9Hu{z;~o{Fth+S{qkC z+g0vX^A#KLgf}z}UspR-_+^B`ldt2PkMV3T*L$9D&$5k)vS819F}Wp&JO8D0 zRMkN3y!9QP*Wu0`c;oF+?<2A4!1BPW^U=`?@H~6=7=KN>admQHU}L<7u{~ODdIrmF z)Ubw2(#;WH4iF~@X?b3)~`Cn1MjZ%HY#`wOTEgNHP}sp zT^Ufe%?t+K-hQKFky(*d+dgK4>8w=s;;@-}hO5(>)WtTJeO7yCG49!Q0TD4BzZ1#{ z+jdZ7f2QZ?`T?>{Nf~382HV>K$xeB56>DM|f=2DmL22R6i+)~_6f3CCFZa>w<+1;z zJ)fM~q*0TNm!egQtgG`8@y*!LUi@g6Ux$zfKDJ4;+9Y?E3!^k(*{_QCHRrNcO5Vb{ zeqDW$;^!_m4fn~a9M}!X53G6MFj>U!C6q4KCIThZMJ#4};lvA+AUqmFt#*NZXXWQ< zqB~F0)xJ9(cPiH3dOmyM8SaKVI@=NuJ6hlBdV-$<3>JvF{WcI8QhKqJ-Lzhec?MT8 z$CWGRc%GQlfyr_zW!~nPUM{R5YLd8+LhrE^Sw)%8EYcPm-|d3yGum=}S$o<^QCI>f z*qRU0xp@s?ky_(I3XtZ>=brTwO5;|m{{b!A@^6e;-b;wUhOlvOOO!b(^5o(|Vyc6C z`cv^x@WUhH1>A*!;V2!O;>-#j=M;qq2f2~U6M|{r_aw>tEjkmMKTtZR<5!FOYLX#l zJQf^?iG}8-jeDdEXwJ&w(Jr;7odzU{e2;Vvzb*J!;bkE0)r-mQF{^$@Z7K7UwWn!Z zzJiVyY<5hlrC;rDMd7`ObzEf$p*riwZP<3ax*&qlNS3cO{^ZnxS9RK4XGsCoHX5Ln zy8%O%u%qAWJqI_fu`yWHk~+(~iQ98qzDmfJW?0{cbWf#X-b1U z75X4qR)IEV)a`>>em(Y9T0)>&CK7G#ashUK5)mtxD*K5*(cYm4A zkFu<`kF-PIO|;V3JbA~x<)_dN*3T~{ZnVpZhIBc#^XnOI++&iiW06K3y~%c;PKC_X@%B-~{g}p| zsN@Fe%)_Nr>uWqDe%pY-JNEeCpTBL%@V8|N#haLf#o|BymhX?scbFzWF7*AFwj$Cv z|4UT`Y}MHVB4m4}$=9y6wt57bpqo`jckE-LX4$?7&?flK;%S3|w!BP)g=~0L@^?a` z?}B_n+q$Yu%LmQCiLJxzCS3a^E(l1P$=sjH|2j(-$;~s<>jAV(4U$(z)ReV z_3MCi`9B&*wP`eJjVH2RdT7rYqGpnGr}}?$+7+G2+V)Z3rk4RLZ;m?{@c}>PPzv^D zJvy&&c8upg4)~bnU;Jn={jH+^s~P?6lvO6_CTNPd;U0Qy4gcRZ%ih}CS?fD>yeOy^ z#=a9#7W!L09`rt*_sDOnjM~Nwm{9vcC$I8%F`y^S9B#H8?!gX?4iCzX4qz(?F@}4y z>_HNsrXOoFEy0>XTZM7bPGBUnO-U94w!e?Z&UT<35#|mlM{fKBBX5Uh%VfQ_^H zc1X|4dnH)dxRT&znGN|4>{i>M69Z_A5vK9pMkz$$h)QWy!4C{1!t)?=F4gcM+~SqT zUJND#dtYnz-5gb;ez9L$tr+idVFqv(yf(s!fJZ%sl@LKOgcJjE z?%Anklywib`WX~;?)Acn&=rs(ME1Sudy8M25=E?%d`N!y*&8RL4i9qf+sU3D#Dv9? zRv(5JN`hkwYm}US^t>;8$jm8X@fe4ByG8zO!oeWrYiC4#fE?s$pc?Q9X0cq)>YG!5 zaDKBxpSk*O!#hsAJu7O$g`NFPXCmM^sA5besBL(+RIo@j$Jvcdo&i< z;R6`E@``Qj8m**WMQt=pg)IWg1^JysZ0#nY=K<;8dhDJ$o-zNc+;TdS^}g*iV}l5C z;dUKu;pSZ{qwWZTEc@^Z;V}!^KSF{Ud+=DIMcP^G86~$_f|UKc%gtq-`+=GP2^?A0 zHj)}UJq0mnNdYWmyr4EAiOLQQut+&lH8~UkDmLL5%XmcC&6>B{CYH|Na^$X|c-&OE zn5~17UubLy@2QRFY5r&q3XGe*;bd?J{)f&kv67e9tDu*nRo`Yd8%lbnlxHHph1#0e z;hC$I;HE1QAp_X_+%zwL>W?2=r&0jV$4SnqBSJB}yqF(5hAP7gcZMYT8231rw>XNx z8Ovpx;nG@#S~0<6ZxWQ{Ny8`Cc;)t+8-W_P8k=HXZBI<>5eXl`-J0Ix@0$({v4QU$ zi*-z%&1$`gd(2IPE~y- zeJPGGL9Z*QPlvHBE>*b@*S3q6TjW~BHB4-*{n}dPR-5&?$g8Nr+||l@v8JWcZQE;Z zY98GY&aB3;g@!`*RMYxf$-UU~z%#i0S%pU>r&L6LdS|()roN3$6jV++8Dj1MoI;x! zQQld8k52Sk*Az2~*pN2fEtb|g&=0ExW`V5ViQ9);bbUTdJ+ZzZI=($nBa48v7zvzz z;cLT)<4o|fbJ%Kl{YH7OO?pDe=CRhJKt^-GF^L|(GM@G6{1;`8Y4h)rszMJANxp>8 zX^YD|Z+;Z?{;Y>S+BbMJ`0&<~0GONLB_+2fO`*-|Yq_8ROgN*j?t)MKqp1WD?qqH= zp5l$m5?U8fW6=_PB()c`gePiuQ!dRKPCd+2f;ud`@}u@5uk61_c&hmZfl+hg$C0qI zknxQ>%izvP&5L`kgtVpbPs?`hLDH-Zm2>l6hhrwurzR*pA&B;|3)wsQkZTUSdj;$SIXL~_73^D>$w->d{vSs4rENxYkh2;O3 zu0vq>b0$0XSa4?iPT*WQ%3)M8{ft;x)YV&CF- z*x$K2^x)LenX&S{k3bnrcbLP2>O8`H@pHx91B_^kC+VhfU(njtN1n@j-)v@GTvdPp zRz5p(_=OJVp!4k6FEejA#jIfh@&1j;(ft4ME32F+Qd5KYo}r>eu_pCUOj8x);V~TZ z0kX0?$fV`>snfkHmr0$_2#;*rHQljpX0JI<}QwHftWx&Z@WP0w-10xaYgqV{@iadS#-F!^B5q z$ezr!4YM+l!0)8Rvx2+b?>zCbuc5Mu@2<{@JS_sjigG$P>}9ik@dHWe7GFj2Pr0AD zjOzIE=FUI9@eHmnuv=j3vrSqd#oZQ)dTAr880B+oIbq-N0S_w)@ zl^&9JpDZP!d{CvgbWJFRB<;%q77o+F+?y7j3$A;gzy{;BO_UlY8xvhv@X_b2iB+GW zS0ATPtCwp?K+LW9Db-+!sXkyu%Y@EKhrBWIOiQjRGysY778gH_BUqD4_+b1eZ?TNYUM}d zC$$2Q4=T8O)((sj1*~DaRI8QNDHLps@W}ZXk0z_Q?#D}d|*|(Yb*CMP?i@(?o?-T>!4@PKDCJY zGG%oEWeH@c`B@pq_GRiKD&4eNYyFqx9?&%XIF?x2n$05a(!ejFxn(_W>cvhTnUu#rLb9cG4F@LxP zD{Ec*QZn!+JC^dQ&$r@1DfGqk)nyiT^gi7%>*|aPGxlIu7Q5X)=YeU#+*P>RTVN>M|K+#&fj-A_? z8!Y9{o!anI$WwoOh?P+0Tt4#t5k1G(=?jD0nhr*8`XIKwz_Wik_JWny!nsr$hL0@YQjh-* ze^$9r*tV=7qY=eh7eKw==s#_>s)5SZsNVOF{xGP&CE*jNQ8|L>Y1-QNG{WIFcdSC& ztzJt{cBV4pQUvH-cE5@vUMOu;MHaeI>L%ssNxOR}fz<}Os0NzNj>@s4?t>VI#FY*n zFLixHDke94iu2nIHu+f7liX2Xa;|Q6&Lc!q1F7uhl-q}_76E$AusV6(VEpgvZy*D> zZrSxR`RdFYb}Te}@MDxlRQ!kZ>MLQ(rjWhDOOX zZXo3kYH$5##mnhoANvrlnJl>cl3U66SEC4*v=EaKmnzR_f&nvi!)u;*Ct)e`m2?=C z^|OA&2AjOsU=N<^^J)96>Df$jswwMh>76xp-SYzjR41e8o z(Py%Ze+O$pqJWhz0%DI+tJMnh4mRYw%e1p1za_jR#T{VnPvXzk3B~+ebua0F*$=^{W+;EWjuY7dlqmR3xqjb?Qcfq1>978jIY=RU9&3?1g=oaZx!x-xXZttaKl5^lsFqd zBAnDR{LVykd`mJR=^R+M?6y?J^G;b?>&xgeaSJ1*YvioHC+hm0GD+?Q-wdo0D?d4# z-&#zMfK_f72@afjDu2rqw60B*uPC*U=A$BWRz^>oZ|qh`>!u8v7I#cW@I=o4mgk1_ z+<3qf8ICRRX@A6N;%4943(xtWY{iVlJYw@TqAZKI?H0YoE{bQk!+MP|Md$KC7jJAZ zMu{1He+2m4d2ymZPJj(L=N~LO(HrtDyTb2NNC}ChbiOtnUbu)*Qaio$%U9{XW@1bK z>9ZhppNgk0TI7Aa8c+1Ye&+yLaB)OOT6Uq~9sl~Gjji!>!F!Goow@cIS<5%s1ed=L zNL#1bw>5G~R;QhQsU35^N&&0Wxf~Mn)<|RDSBnM!`@yE|3tuk)!%H=PhZ5Q`BAf4~ zOn@)-S6xp4Oxf*3001Jn!gywp_NG6!0t-v_$MbYdXB7k$Z1Y z5s#zTg!q+WVtkB|Twgev#Ygf_`b%XSIYgUHdENZrS$b{o@#$7{axyw2C0T|w&rHW7 zov@p>@=*UR{avd)qoR`a%DfZ#Y20&V@!C$0ToME!>X?aQR!xvvwVSxR$Har;mYF45 z1UB^X*#R=P>56(12r|N)Ne+J`c-<#Y=Tn-TK}P0%7tk1PHTBFczOpbZ&K?}!$^U%t z5p^I{tm@_27P6tr4#AFASWAyFFrN{ib0pH~7z!E0{uMrt~A}yz*EwSX9X-P3A zssr@Ikwn$Bq4u!7Y6FiJVe_obo6n4W3o-n+A?AgG0*hf==sBUjH5V-mW}JR;!c1nV zL~c*gq~?(h0dg2yjQf@XF72Q_t#pMiA2ctHju170$`1;Fd0C_) zVvs(R^_{9+NP2I*ijB0CvqKXEcmsBYQ;*$glZYvjVj`y(8d`nF| zC}v_Ay^X4&d62iYZck8p-dZEIrG;=bdurC*B9qMYRQ-a*+)t_w$s?K+qrl~)2>pqz zUL&zC9NjRk^;;DQQE2nsC~@vk(6V+4usYwf7WGYo@Z{?G%#>@REz9Qzd^oPR-X%B# zHveTL@fF5z2O|HpfD?au&bEIH{oww+0dR17xYu=R0VHsNgZR+AahSFa?d9e2LwspdOsxeZc41PeMhy-cu zcTw`+^n`yzfmKEGj6S=I+<;k1C*7+NQ8bvlRH<%kB>ug8L%fe(y2 z(RU-c^6f)R%jGLAtP$@WM&$YC;2gx6ugLLbsRRdq{$G`p{z6v`ABuy&Yhl&g!o*yz ztB;kdIQH;gWCE}(9~;;l!>=W|s$9j#uKAu}=o8s;a~7Ce!XJw7K>E>6x8_Bq%m)o^ zISee#ZwVUt8F^<}mWh@mI3z{fIvR@3r>-k#gD$ibGXf?cO`GO!k2tQU>)r3A1Gq>3 z3ErPxtn@UGD_%rxXB81t=pnHXS*a5$Xi)W1s3!1f=E(GuX#dYjqmdi=)f%oCigpsG zMZiRC;j5IE(oKv*J8)=Ja-x5CyZ2pEq<*Dt+45CX#~ZLHe;R98S`j}JCbZ#Kqu;_u zyv8&Af`XGO35ANbKNs``gyl;#bxBBH)0ipawKJb!Vwkma@t1^Lc4UO^9cJu2E$ zA~`@$I!@G;0F|u_(yI2chEfvPtPo|rvX3b}N){}hY9FfccJFyOrl*UpmOWIY_Z5Y+ zo%+73DB1CRf~8R`cv-@Vu!lYNNxMJ&N;;C+1At^1M+Cg*Lt(^oXM(44EO{vXm(aSB zl{~1%F&CPRSyl+t6e~LCLvm(&ZltP{Z&(D%1f5?t@;NctlKxV&;lgbhh#aHrE%wp2EkfC zUEWB}Z9sA`%|e;K1Sy_;ev-`&%)V!qtjI}*-b%eNzVk7&e5DX{nxaV<{*mCwvRZ|L zdb~GUk|06Bti$fCo8j$-79&zeK^7`;h1sco{WXrdM%UE|1{z2~N6s373QB6_t=o(s z-h%#ulm7q1cA@JPHT7tTW|qXTK*bu#=~HO~1DQEG#0IiBWCsq__ihZ{o!vPQ*+b1) zLLnvwW?8%Y8h0-1pO_ryi>W4*Utx)eqF!~_e{dH@J!yuR@xinCo-tQw%$8H+NO7a-W~{bj%q2uh{WF zS_~D_l+hqseY;?E^2&o9h1|px$5J50d=HvNX;&>)L^%B5N!nI65#h=kKow|MW5k9loAs(w zsp(r!v<#lQzb`02=^bThdVIjx4Z5U?E$ua0J!>~*3i^7z9PD%f!Yc#(rS)6yowZ5`lpZb`x{K~mBaZ{D-Smfdd1iyZz2ZX2& z_iAG&q+rwKKpzrfsx) zU`qYRqI-5F^oqz+wgRdSLA&zKwhhd`1XWnu1k>5mwPKiNHTB82N`)2}m+5qfY(2=h zmikLJW-gvqcGw7-G~X6n3iXAB&mhBC3K`;W>@RrwRhS8dEm$z@|6aVGG`b3lCRfjyIcJ1h)xf+sP92jv9vul zv0nMUfhjniJ#(5)WGFYvun%=ttMJ!$y}QbSq0pTL#OeFyYrP}=qXz8nQXf(@tR<@$ z3f`olLK7y8kT)GT^9N7@{4v`yqtZ|F;Q>CBf~`W7vFmudYl?-3MX;O4Qc7uN0lL_I zy_`p9%S>nzsY3JaHi@rD-<6ji?BCnEFac#!K*WUo%khhSsP;SYy#7$nW+x#kL06asGcHI6d z#i3-LL!1_KUvmW|c)<;5fweIgE%1K%SF8{tKe8>8(8Ijsdmvxw`pZuXS}&?-bYXK8 zqN@d;tgVr{V*Kc`3c+yxX_JPVqy5)z6{{QmB|;tn21i?AA0}FKk|Dj<3MpG$FmG+rQwYL%OUD@{@m;lh0r5xO-n z2{(yGq#|WJUw1-L)~to?MPOte8%j+}grEiBqD7c2e(i zXQ$q4Uc-2uJB1J-yj(b`h1F^oWAqlDMM&_`*9m6Lp{7TdIDpWL*;%K`Rbv!J=uG0? z_I)2Xcq_uP)a+I=nG%nj@-JlgUo0}H%E%uiuF2Tgjdt)?6&8JP6F zWiP!=t7X(owGyo9Q# z1S;BX?bS;Ab-h!oXm0s;+TDtTK0;)34C`@V;^sVhbkQM#~*@<#h+Ja@1_!XizNkmt`Ibw2cDpYg3#uSKHKpobk)r<|Dx9eGifzX*swOhWz6F;f%1qWbO%FE0! zsw4U27hBql^K+cJdc=VXBl}}G;f-%Tl)06uP}#g>x`q*%2fi`nc>Jmj%bMWWtZ&qO_Fa;uof zFa@AxO;KLtnrGD<_oe0x4-DRC9APLoQ?i!r2gdVuPh5viR@88lCHZ;PgP*CVYTMa? zMVp38Yeh!;EkYF40v|)u;J}NN%kXZ3n^oxZZZS`XKeZLaJkIh7ROYcZf3nEWvwBd( zA%a1}MYJieW6RvA6e)myeCPsg2qHkAt?ZJm*9*xwfxh)!bHM2Kv3rrQnZ|fYWJ)#v zHeFB~ek!+m+sAGKbH5B|jGo8s#@euL$l}T{hnaHM`*a5oz;SY-uB`6D>6iRGyG?q8 zcWEr?&_9M#-IvnNmzrOH$G1SfKX86gkuTpHPc7azkdMqG0v`lBz!fiUOBRubmaCK? z+J9?`e7sE*Io>z^opJk5)bwBJm;bSE{8s{nGG8Gb6u!1AmJ`ge|JdpX(oE=aq*yqr zOm#O$j5Md$P-o4N*Ml6v`oSJx%LOLg5_F+!_w6pLy|QADVS(?9$WpL*CD{)ExJ_Gw zu%QhcgLmaDDQa8p_s;TVxIRYJgt0Ec2C571^tnJMv=i6XmG}`Qo|tNW!djRCOPfK79J>e*vAA=WYN1 literal 59876 zcma&OW0WP!7ByN{muYWVnKyI2;T%3=j|yoTP+^5)crG1`rUiDip*w!i*T7{rv;&Aff3D1Oz|u z&lfoHCp^wK2552=T(-V(Q%}ZY0d&lBeB`#p#B8oN!>|(MqjO66=)EH&S86 zi&QkT>UN2$gVOkqFFyp)c}=eZXw`W}5D7pKO<+k6@;^QWpWp7yN;etEvb_~teqsC< z%FHUU|8T^dHJ)&Kic?Zj(r3by`KvW1CMbwhviMVfiB*7{ zgd{qz4}?)j@t-pY`ocUyt+BE?<5ba;baZ5#wYX;sgC4KTdciRq?k3s&CJWyx+%`QRo7X1M z)OCK3AG}W7mX%Q_(P;KPEa}U;x;}cW9C3ovB+N>fiD7@dq9enH^4IGmk%Ih2bi9Ec z805Tp3FN?IlM%zJUwMDQd1S9Moy4(uL}z>gw8F~ptR;9ZznwabCDIJ(`2vGaIaAez z3ja*5^{fsqb<^#yd7g%L`~2W}nxUSkuQL7&=H!?%9RH%+FeSJdima}0ZHtUEMs!Bk zpH578HTX)l+*duRcut8;QUi1u!0)}18iLI5{;Bqf?C!ip8tyQZd4wI(a|B(Q!kN;P zhy16{3FK5&vpi3!%%-zs)zlWvlcWIyF?ihWpD#yWR3K_PI=IvPUp$$and^?jcmo3i z8Cq)U>cfFwcZja-7tZ~=TYKvuNhzaGhj0UM; zveWr3-QgVb7=JUcbob#dLm5|GlR$HKtMsPp_z8@cr>{&3E^u9cfNi{K-aM<}Iv+8a zy0axYYhU~T3jCnDz&D~;h6N_(a&>I7}`=ADk4kA}i=k~cYQwIda%BXIEj7ciGhGP{4LVVRMToM((2=7i71m(Xe5~=MIHDl*!(CW0 zE?NVRt8&=&Zs+G(+-1ve!B#dJKn!vW@`4J3Mh&K_&~G55N&l709zzIwXRP$3s)0oH zzPQ{KlMx_l;Ogv>GUJBT8tqAmKdDuPTBlsgQ$B{73L1H|GtZy=PI zHC!1Qa<~|(3vs4!-SlC04Z98+3^RkX57y5)ZS=wHaum!%{_ph4+>}rO*AD{q=!mukL` z8`@aun*HT&U%}fMYb{P?nFxL!^z^p2L4R$E=-U8``W?NGReOInz4$M$HhULN>9RbG z;D+ZTDDmCE)nWO^&bnVo&a{mkqgw$4wAccBTbpLK8}I@0A0ccB316xD0@FoD?#H7D zB~RiK1WbuIS1)`C%xx<#bLAb)rwmyYJazL?Eym1P%vR(-#EP>xq&9Fje1ovB+z)kK zZ^9kG4T#v9n(bsxHhX`>^7M1B{e;%Mi0XJ1>~i~nn)tP*@tB?n7E12Cy>Y-|9<`fx zR@GN`H2r?C0b1f?b~kzT8T1puzLMkmG&Q`}(=r-K;#>zdXfJ{VVP(6=V9dS?@4kRorq~b>(IjxUR@I(0;2mthN+J zH+1s=q1!Jpwv&sKlQTt?offtAs)e%66Mg^2i*<6}}%0^^Zh)l{kR3ZR*Drb5yE z#qVwe&v<7UV)K0?v?O0?x%u3ddQZ%uKh|$V<%+xG?Nh8Nq)E}&o~QfcvvT4TBajfP zZ;1*Qetv#FuHiOWAb{k zfP;gZR}}kQez^6uY&7D+ktQT@$A<^Mn3S{rZD2tJDpTti!Li3D^m_fZ&eMuWr6S#! zM=T8^+pd0HeB^3~<;AH!DPy*f|8#Tw+r6soz^n*EMC0Y&=}{cyIaXb{tujLnE`Sy1 zWe;!>bVq+seW{@u1f$AqYQT z0*bN}@Tj@<>0ca=FN|)}`5TqPbr1GtJ??;zjAL~P z+3&|lk3;m^Q}+5|-Vbu0kFV%FBloy^gID;v@(ouuc5g!rO?(fuz8$k;_o8l&PX!uk zpF3!5&EUOBJ#mrt+hx{=Osfl`C(6%2+cd z+bK$$VYRz=<8ehuy|L!*4_mPkw2rR{WcZd3_cOjjdOs~;?IBY1ErzsP^~{)rdz`#_l6jpW?=2w4uxI| z-?wnwzy%Sz%5>XZYu#^*s#*`RtJ*Kyrr+HT64h@zuY6+X=H~od6u(Rl4iEDzsl{V( ziCD?NlYc&rtG{w*7{evSRGq<6VF}sl;*BTK=2un0#|{S$?+MPcfcyq}+VbOvM8Gd- zY|nCY%2Bh^w5cXvm=#vuA+$m!g0k-M;P#tY`ZIz2qp zx6CkRG$nV5p3HK!oe0Zh{1~+AJ9ddDu*lV%GVGlZG@;-eN#V-K!|0c3H9;mZMM!@j zef{%269xK_i!}>p01}rYs1Su$16+<=%n+oG*M)n3!G;{3^3qdM zz-;N*rz_l3If1;s3y;V+&r`<^4njJ~zi7mVonm zTprPLr;4n`jg0;g#_hzJuAO!qUJn3pXS6Qq^uM>Rz``#$8Azj%F`F~-TQfawM0Y4T z2C0P@Gnq5_9;#Gz8nS^#wVr?O0c%AJIlQbBrI4pv|_uu~^Fj|S&aHqzJ zPxx`%>%WpQRig;na#A)L#cncFd!VkOj#rdBFPO*z&{W?X?280gMsrTZXTHUeDE>vE z$R-`fr12edqcJ^uAV4;sH2SN$wY~boIX;%4KaIm*a{kD9GN=pJ_d@ry{f+4=O?2YS z+}zBFwOiXGZncLcD#=Ammn9-NlHS~?&%r8dMN)GL%4{l2X#M!R=U!oD;qdz)a882r zvHbQPbesf1l;>8T59VP6;LP-Ju4$pha zsum6@DXA20H#!_P8-wfZUYnJ=;81+eu&uApClgcC9TzS|RW#Y9*~aNbBXDl(aH6>KtTU>Y@8a2Edf@wLOtjH&X~DlUpT86vlfXf~U?F`piLlI*}D zP@-g{qJ0*Pd8djX{*G`~0`Y%9yPMh9dt4q*99 zU`8%P$u5RjK**r~04#FfvP1#r(_|{zmRVy<4Tvd@;-dR}F}=3UQ64J`M9AhTCo)L7 z!a`&sBBAOInXu&sd&ZhlTJ=~p8!{dTk)Y2pDTOhg37{6UX0CHE6ZH_pht-c@=5du3 z7}u>z$ee!={&InY4ywRx1lshEHK2_8%HTu&XA!P1B?Y5gEcYRfu_v8rlUt|3*WL7e zYMIJ@7uC|XwzS>e&xSVe+|8R#%ve}hExWtV3nblQkam32L}%X%2thUjrqt&%=IQH7 zd!NYSEYAr3j}v)Zj+*S#Q>)drweZ+j^Sz9!GwYTNL=x$unIBcqEjMNh?7%T$jOGzL@(IcpIB`;wopZk=NIy5N9CLFA(<1TYa~ULmSocF4pBS zI|?5Np)@>U;BrFl`!s|S^szBPE!mIEBUZl|3&{0=#W~&UpPOP=fp~4#y{2 z3^qFhu>`4R_<+G>3>=p8LuZ!tk41_FhYT1q*2`$YitF`F+5_n^ywsA*>;b0y7Z^oo zA0JOVp`hrQkIxR_@3=V}y++F3nt+I?*@B%bD&vi@SWHZXl}|-HyJ2s!!L-tPEGSnz zld~)crnka`ZI0$Gg6|RbWl1VYj0<1y^XBT!w`G1f(x6p|%i*w{O>Us7u6{Q{(mixp z<9zkhEiWbpF|&5_5&HDuumAPBbeuM2+q@Cc@90Zz`zoc5_|1Xj$MTJxRd>sYih`#V z&90n45Te4|^nfBD!iSbtRgt5@#HaiT=r!PQCW&YGEsz47AHra|$pJB(?e6WLz}6i* zxj}t0f5cE(nl`NG6Xeq$qBLVq%?!DZXk8b#UQPe960QLp$eEQv^ub8B77uK#gDu+s z8fU_|BQu`s9u~{75|*SbQJW-E0o)_>+Vcr^yUS=yX1z?f%cLW*VEsG@I<2^3M*7p4 zZL5_q8CKT(zJULB8AYBD>*{c|gYTYp)&Zm-%6KPAm*-`IWL=LhiU|AzbAugTT?ROx zUd~{ztoz2rhQQb3B5~ct4TIlrmk}Ro1U0%njr%G?u&F*VZ5;$g*pdTi5?NTuC=Bzg zcoW$fJptnjr2ft$%j*K+eQ6xY0d~7?4U&PAJQM55Cp1a_JviC#6If9k9b@Z(kom0$ zsWP0x&7GfVSH?exmn?mEM-4F1Y40T@NDwiZy37DrujUtp9;Lu0%rrs3l3-Z)4IC#E zjv93=@1#WR@sjNH@y35x{B%LW*GYgeNkfWGq9sQ(xN$Q8f|+4*|5Hrbd4~nvdBxUw zLq7M~@f6-DRX@o{k#m{3zm&`Gebt+ZQYCE=3};BYN<7T`F!dc{z2a%psbAI^Lo!o z|Mmw2Np#DlBC+&iemVtz+lAZh>fkpd{{HrFpOLz#Jj#^GL*~AOB1_7M?=eV-98M^S z3vBed!l_RoolM!nw zgC-p1Ct+D{)PkMZTpm~_5otMI`Jg{O91<*LN(Q_MnFwWpad@L3gMdb2Etf4OS#;cR ztW|?SJr2~<^K7MS#j~Z|8F`-nN|KCN8Xk0JTyyXve$5aCz(55mq-VG8X=(@care?; zuUAed3N3UaV$?ziuIvl!K6adatSSy#Z3z!2F(sj?Y5Ys7`mEG))QR2aJr?uqmnG#fBwWt0h$ zV8bFQlG4bnSssBNTm4ZWgeCuhUS8U4srX~h&UzR{p_YO)9`#5-jAHi=B{53lTrCP9 zHG(3*tXaD%BcTg)I93BmusFC(eQz`Z9S7s1VVVhJU0j+1G~Ehz~- zpfSJ$_Z`==i`(0AVuzge9TX#5OO48+BUzdT%u@=hvv z=O%&&OOMcNV(`nidwTmdDi@tM!>i6L(&T*g*o37ZK9u2?P(SA_SZsXa^?jW2jFWiA zcYVK}iKf15>g$f32VLZ3MS7&7E|6Cwx>e8cxG@<)-jRAXHgoj!z7;$R_=s{UoF*^N^EToZ@_Okj5_{-MP` zv%~c|zU%t_9Hst`Rsa7V!FFcO^4mv1{6ngL^S0%TQh=a5N){Hj2f16yB9;H3{843P z8Z_w0$jA(su;!Tp591kKF|#IrPL9v_y%2a|)2Km`{;lK75ml6ko<5e~^E#B2f&v9T zw0rIq02Wb}f5wGuzyhRK9b0Hm_u@xY^RIbdcfk9*_hs7|9Wn|^xCpVn<;FZHdPWMQ zbP}0KAd;-=l%M7IdhDO`0AId%RDRO@EOX0^FJQ(29;6idw;;&*TJ_a5+@I{FQQ&CklWJ;ZCtNLHhnG;DO^YZeNl9JX~ z%o0PuVGs2D25sF5!I6-a9Xz`8u`_p@75U}`zpt(Xdagp)#Dokwt=7QxPQM~*umy|M z_c&+YbSDW952uWn^YY4&pOpSz*Yy=k07NKJi76;TJ34q+WQFHhTy!aL;hDeJ7b>cv zic`KAxc{GT3j5^mE=?=S^psKjqx|*BlLztNWD5&`G}Dp3Z>RYwH-Wr$WpX^FeQaXMoy5cbk+k&GGW+_iWY`{ z+J+N(*;O0$LqHd&flm&vELUd!OPKquy7@461BSChPi zqZCUNUJ%62?YXXQ~ZBuZ83g|x6&1F^ZLL7cL+J;TWC~(T9}-)G zk8f^@WXc1t^!89iYVuH|2Uhcrm*d1Becsaga7y-FO7#i))7b-wesJ~0h^*%PXfZMJ z!{+k_B%12q1`~fX(g?0~2#e~KyR zN%t;7VG&RwtyK~o9y?MG?y(aqE=Q_36ToZq!CYj>OxFq4=H{BSQMFve(6p(Up1*8* z6C!2CWFxa!{H2P53be2r8jf1`C}2`BM8})iO|JR2*P8zJunmSdgr`WyjVhd#pr(x{ z)q{P?RH6gePodv(;e@9thQGTje$N)4MHx1*c*^+lJe)KLba^g{rQ?a5zM~Usuf@8x zQ2&Rto?m2L5{mwFU2s>u-O=hZ9?$gzn@%uF>uZw7K6c-6-EWI=qD5N2RD?012KHaV zeGDP6XTytS{UTE@w9no3=<++KH;(7}A6(ky)B1gqw5da?%wh?KKk_Z$|E`+ye5`Vn zaj7t@j^ee%rFU@#Etg;kmm~(3XCEFkPIhAWYV%OtsG+(sU)FCWNj~%VqA7cGdEDqO zM^X6FS^~d+5)vH@lqB9Y((4vG9I~gFKF3k$uk|h^##UC5);ZrnaSrsDeuqtFOyGu+ zh|z^u%Vxh&aLZx$uT=KsP2gIO!TljP(&4#@Tp<7O_ z0qIr?3HU@>G(m_~(!Z)_dCKQ?G5vY7)17U5|0 z8^dph;E7S={#^E`sq`&>a<8=42jm<6gg!|vc;u*UN0yLQC++UygY^hp-(q;_eTY|WlxafBPoLa^iIV}VA)&E1FA@0* zIhij$cq>Kz{F47}O_nz$iV3h=++NQv6^sL4Q*H+03>jlQ5Rz|m_IzJBCZi;%f2(Z7 zAjO5$onDkCr3H$vQz|)djK7-J4h;;T3Mpt1IiI!D(rSY?CMGJ5>$rEffdHKqfQ(*1 zV-YnP85uR7Nr{KWHxYLt5SP9o0$-!7w(GgLpiSp&4g2(<;(#+;mrcYiy#fx5UdDuU zWORkSDNR{Dy&gf|Wk!ZtQg`l{l)md)=uoN$PbdKS(7X;jYxPy*?e=+~1da^MGvs9H zej=SF_%&m{Dnysv9ycZ|Uzf`YbMqq8WyU6&b;0v=D$er8?^Bj4IYv)T&x&3ThU7;v z`Ae1MiIO7ik8Dd_6Qbivz(;m%;Rf_-g%Fpxt~(HWcv~3}q#VNc8fGKRGgw6eRa#=!@iC znb@3pK9p=Ie?uXuiq}!ZC8!God?8-()Ca$=hR84INpj4;Dg4Qdm`Ba2&rK?Oost*o zqRn~_08uiQ6#?bzYlCiV4`CY=wGyMt4}~)#v>RF&2SWw-^P(+Oy|5sMgr?*6Tn@zE zO8&h9-)Gy1TW&YxwhNg=L>Jl>%sG&nALKo$f?GE1^{S1UAS<~Ai%X8hx}V$F70@QD02%R5nxYpf=hPLsp3Y>hhq9f(E5h{cy>n77 znpQ=VcBI&f6dAMm8giXc_b3_?|L~!cmI8n2rXjJu^Pbo)ogr!cf))4l6b^UC0IGT^ zvg%|c1`Ke))LSE@GJoyS83dxI(k&({i${yMaZLN5qQbrx10)8WpPSxEummuXBIn-{ zRTT}gAQe)X1&Wp^2~AqHvPxT>N#lxVf^eL!`1}J~F4Ap)*|f*)?l;PXohLA_q=uHr zV881yX4UEL!-lFG*kW@lqs!vSN~*HD#vM0_wSP}5uy$EkoQu9y9GkJ(yO|l9%Hxh| zJhWeDExJI_2n@kY^@7s6`zlQ-#gZqk@-ACgp{*wDMH*~~L2oAJi6))p9o)HrT>G-u z;m1Eq)260qovGnqoY?NM7j zFs5lOhcBWL6IfHQepDHYBxP!Z#;pH}QYY~HP1{8(Wv0{LNFw7xiV;7vE+wwc9KJWS zt$)Yj=i`W{%4>^zWyyU*%vJKJGfgUuY__N9{adc7^8<{)YaPrbJja-$o;*6gVEHdj zjn+6NFHc9XMXW3&xK&gC!K**lD_cjw@Z9Gy(c%DhlElzPmPI2DI*#v^c3_IVSKXEV zdvf}2Zq2ko#CW9Z*y{3pYee7oiCo--JJ^`caI7u6(&ZS<^nU z9kzAR_#Xi&8JO=;YjvQ_^RUaMHAmq*+$_cMJPi4wU5a2s1)J*gc_2XYuEpH~;;~98spAv7ye)u&ua<51PCA9< z7qu~rl4D_tf;P40$8LHBtv#WItik!9I@4Vr(SQ|EhU5w9vWwJ~Z;D%5T`GeivT=kC z>1lpydk%u%kFo7JS~ZWfn=A} zLjRg;xgwM`7H24ds~Vt9k0*^*coz8xp7o!l zG-gO;NZtO+UNst~)D=rz92xLQR>1y{W1(e_^-BQ2m^P{5Pso=Ri&wOh7yc)TAOhRG z$ZiV>KHC#o4?CT^#>50=5zRA?+I3Rs6P(@2{Dv;e+Y-l-k&ZY^t|L>`yTK9S&g>I| zU)nt(7M|77PVj;VxCD0O{DDt0|v!xiqID{JS%j1&wei?~Bv z85!f;RD~+eiR8+E)G@M9u4+5T5>d5$0hrE^DQQo zaP{_-D2B774=a6TwHUkRC>DEiZ6(3=@?NYGwfs&uL2HtS*VA2cps9+8Iisr#lC<oYwjuB&w{= zt&UFcqqU3kYE3BF$9d*gIPW`!)ZRBF8V+x8GM)DzW99mVjbAQwsTu-zhvqMLLwoy^ z?V;S_AE7jO|zZ#>)u`^VVcW;Se0J0;EfLoT7eBDn^)X^w|mrRJ@PxRq*2r zEvN`}Z6ZVk#b7ViP$V-P1O&@SSnp=?(;LqBnu)}IFF-%>9@vo5WK)~~VUcV;lHywI z+)2Dcn{EQ(-mlh-0qrk9Z)L;GKDz>dNA@}7g<0SQBMPFfIHDrhTWKW=?xfI)*OQyq zFy9?`GEx~0I98iw{P7gWmHlE(2I|+NDf!$|L*laEDVUIHD^c>i^(ZZ6lon}7XmCau zr0o#ODh9obF1W#0=fefZ?jLr28@3hidw$BycUE=;?1A8*6+z@aJ=s~h(jN2Se+pIW zo$c{Z=y677fUP;(+RL9D$t1L`K`(tlQ#ftmU!oWOTx|6#^81GxLq0kjN=S?U*!X}+;qbseiC(~6ZVtUQ!wW;c6}7y2M1f7cX<4&4ameluu=>DX2?^QmXIr zShmq|1r&?Zmx0Q4Mms%D$tYgS$3aU}X|<(Qr#UAjMirs9^synZT%5D(1UvxL zYQNVP-uHH<{QLxdX3-b-si#XOl`Xj<#A@vEs;EO1a>8UEHO|<=^eqHodBs61;6n)- z6@fQhR61jTw>DN*gAvn( ztj)T{5XMp~R+uD~j9#1ALxk<0rH0*Rjg#x38C?pBib&*RyZpk9Xo|QP&(~Ib7iG6= z!b8Eqs1!a-P-qhlQyD`%(wbp%gT=N|`YmzmVlj15=3D?KsxC1yG}4Jh{u%+1(RprX zW%T2Gx)T{F`o?6u?A6`-+(pBQ+@qaFEN^>i99TR_I|nJ8+064eCZS~s9SVAVj7?np zc4%&t1JHf7{`A^QG9B7aGcvOlffFW)4HaidLjxZ8g|U2BnEu5K&!F@rl31` zFaP)0F*G~_y@vGJhTU7T&wz2x!v<13WQweuFhnL)PGd>_;XRS`BtfpHNW-WShE`k) z8p}%}!PI2iMBT7`K6r33{PKjzLS`tAJ!1VDVo^obRKbvK!x6Xxzp>eMVrwA28ULW` z33(KcDRk|sJxUux%>6z*5m((aR{U%y^N)OI$nI}pNzRt6CMd+qo$cErk6yp;D2F@L z@Vg(2ohF-oORGOCLN2e8_3x6KvW7z6HE<*88t>mLei2)!oJirHdV2?#D--z2eSZNv zQMgJ2+E-O(@*Y2s;AqH6n2<4}Fga3vNKNul+E>CzI^*JE9`jw&$e2vg zR2LL#34bExm4(pZ#F0T4Y)%dT(oVWAzL1V5O$-1>aJpJRo@}I7-rUeGOkptMYu<7t zn*y!Ae&_ajo*{m#QN|um1})0z*jI)W@EfYFDp%TU zf}EQzJ@9WH(FhVs8z~BhYh0NzEu}xrsKh0D*+v!$@CAcCuO}D_nk@S^XG=oc3kI{N z1RJEYbIoG4vGGN6;z|@5EmG)TS=I8`&8lc@v4oQeXMH9Ew)EqRyU)?RIt03l{ea6N=RtEw5=1H*FHdB~mlmSNN)aJXH7#Y58%rQ*GW(90qL0bl9BVCa?Pm zv+eR&!XvTmjqz-FJ=3|Y^a|u>77-#wHzrl>9$cD-c4=B2lsAl+4di*)DN&pSWD@r- zO&JH`T355o100GKt^vJJYK*Gi5~#1kC?Kbr$jeS{%Z^L4Lt355PYkIOh?;?f^z2|A zbtzfI9=XMwT-b?#vW>UW^Jf+9u*3XXZ~9R3^|5Ehmx^j0i5VP1;#5ieKm9kLZ!3>k zu>qsbSQ^CjK9*F!Q4Hz!Z?@q=!f#w>eNMT`v!CaK6z%r}G{XP@ow~Y872KJbUo(vi zdT!=d!DBiDQ7`jUac+0FX`Ka=={?}aVhqn8ytvoERq+!oCG=VkkSzF$H#Q9?M5zRK zhO$=&qIYgi4ll~MI`D@Rk zj_#kxi|AVcz>wJ5H0bkDp6%Sn-CyTDl#P*UxJhmK(i5U@*!9C&{7Iy+4+t z!)6U=NwhxZFwRF7(4| z1$`ppN=8ebD-A$yxa-0tieRwe_u%s)E$~LzPg90^yYBRfDaxj08W?1R+fQw4j=33u zx6?`7mqQjik8Qq~#UKevYymX`jPaz4;=)pbx=Mul;iv28Y}B^0*loXKGqd5R855@6 ziEe*sdO9LG2wg~J8Q9WAm`x8K&;|3q+mu3pXrE0eXOAF1w>Pa|nFVl9<_(9W8a7d-w<{&bstngd_=oOS>~VmJfFMyN1d zF~o|T7sWM$h4>+t{3ClMZ1$9xPfthW4`UFUIj!8! zo1Yy{ZFxOyx?$~Vzz}-Y#U0~pDRD0GZz$H%#z+SU{}ta2g<5i!jol*S3Nsd?Ew%97 zZX8MHFv+6!;O~A~kw28t;%v2DEXkJ1zS-HZRz2ln4(b<1drh4zE`Eyq73h!l93v^| z#kI%7r83K^<4w~s9pGah4>B*+w}zz`5g9-CV-Eg<$Jook;bVwIg)vC)vZ_Z$Co z4dnieJ=%U&W)2MinKwNB#WjDi@G#`mo zX)+}7C#9AH9RI7Y-)SGUqC9gbpWa~77$HPtAcs0^(om)iHLIe-G#*XcRk2COCyV`6 z$tm97e`t04f$MKU1W!$IUHp@tHy~tA_piI{Kr7Ah2qoUa`Bqan)6)q?E5k*j>G_(v zT;vhWR)kcTz<}85v1C-Nt(m+fD1K~m%#iWus_FC|ZA zz2zPMsyYfi%vk8~P{Z>ItRR=3@B=*kHU{4CZ@yTw%Aclyy**|I@a{@V~fo`n1+Vml* z|31S)ZPuHXrSWB^LJn6Aw5~hRn05H%7UHC&vOv`tfJ_iLN@)yG@vdaWwR6Z1>1v-*eqU6N)l6s>tI}5E?eT+?(GJ z6rJ)d!l?^r?u<`MV-t!oL8kSMsqlzY4b_@D4mDvI1}JJscm{x?7^t*UZ8e3UX~!Zd z2;4O)D|_H(GbR;ipa80n&aDcXaP=3)Fld5_EQ^*1bwmpRHZLw3k%c3PsD3&C&$+28li>sH=-Rt3&C|L%ID` zbgg)-59IQccU3StVfG|_tvYglbC||RdLX4;l{Ge|P^?eDY?qqfiG4A+priizv&71Y zWY7el9`~DMMn+VW)fOLoa!X8h!*P{Mi(~U#jCmjq(Ym0xFwG~Oy}rF6Q9*jn09AnY`$==w-`XdLdg9Ta_$bJ`9f}*x@87BaqX3|U_-)gM7(p5~3 zCD&(_+G*KOPT!8Ki0_Ln_ESq8O?9{(Dx#g}dy>c#va%+YSGB=N0-!?s^*!=tQ&Kdv zK(Rd}Nd`9?dEU-ptoWO^(ytTmQ>Xp5^n~`>tM68m^1T=IboEtl&IxWZIn6eG zj|KT`-u*ULl564i%Lu;wTZ%P$Ny^J^^xw~yhz8NrjuO~e6 zVIO?=Pwm`07kPXcIZOi(GYHK63}9kJM5s7o2~*9c^G5H*SMSYXH{Zpb$NkO??l+n% zt?y);G_fcnG#GS%NK7CPD6Ib|=kQc+TiInS*7x>DN`V52cfRTVBch`AGGATYjfY42 zj_T{@vZ|`X!sKtMHED<56(n6^LSm-$hC_yG;k>W(U>3=qOD3<#lD+9sclv!67ySMD zm&fC|X2n`lWOQU5Lwoi0(6rnPRY1A;@ae#wBeR(*f$rm7d#S6L%`{w5HLe?%mdlJ@FBf)<1;95ZBe@cb0aG?KY%#l!l|D&GhBO(8vPjQ+5`G`${s`*!l zfQZkCWB~nd)||(P_`mxg-3R_}9iBG){H;X#u004cAH*OHvn`yY6=19Ho92`pLsdQi zS?#ocq0TvrPLgXvrOj?@;Myjs0E!mf+t%6Pos)%B9|qU%R#(FSExHs3OJIA1aC`gt zQzP=Q&e0NWFL~3z@8f!3vC@t@*(Qg4a{7e%DBhfJw5iav1sXZwoYVp|gS#ucS&kiL z&VQe2k*_u@(ez{l5LEp_Sl#g}s>w0y*s5I%QV1 z_fX#6EIj}B)%!bP=N_ZVn@!gHu8sHAJD|Uk2o~35$_GGiOP}*KvDWc?Xxaxlx_89I_zx`ZXJW6@;StUH^i1iZgp$(%8F1&kOlNW5!QZd7Ud?BL zQso90hgMp{YbEwL1;5?{)Tg5P0X~~g zDO0Fp7}e&v9)QIVu8;tNF~fgEE<3p+Ky46J_rW}O3-mS18?wgA%#+d44K9z2_)I_! z2dZ^uj$~9f_-X0smNs^|#xvqFkm=mnFXclgWCn=b&Ff=O@^AqR(Fcx$HrCD)yKP~_IZH``m zbZk*jTbsJGuT&OUFWJB~LaE=kI;JA#nPy>UQ&8KO*;PC8@wSHxPP1NR$KgnD!598mb7YLv~7KAqXX!)pC?HoGjp7Sa-%1&cJ^vt z#)OIuI(O@Wv?g2spoTrlq--=xvm5jI0)w4(0IB4+@QzfH;Mz7JPW7i+I$UTT$~`2M z*u&@&jkZFA-s9)I{+;^Q1%}Rp_*Q+TQLSO~TCJw)rn8A;uTi~Wvu14xOqrFSDyfNP zZ$i>!N8>jslo~#1_AL#{qn?}mkYZmot2JuYR48b7v+Xr=HmKL!y2Avji}*INt2eBd zX`Bp0fquS$BpHatk*_ys>~j11XX0JA3xUu4LUZ$ki%dS6`;7jI#*piJ3OD14=sp7( z{@$mm*KM|blcLQC9drM^CxQO?b9#*d1bsBRvy}6aYX+|qc(w^xr_bT7!#8mV^1!ft z9+(Q?T|gA>9pj9`w7lOv_TG@!+J|*2Hqn-<9(S79!UXXg9o!5~>^4C*VZjNefY6vs z*==CQ+uZaCwP!@|g56ZceW0vhEXzF4c5jx3+-3uk5=dr4Q;=mWbqP#Lui@$x{^9Tz zf6w!qsFxJ7>X~bettmEKb>~Qy^Tsj4@_p3lgN=s~t!XKflM&qkRVRxjBa0-N@hn}I zzP@bJdEwoz?`ic0RxoKIjmh0(aY`nh7uXH+lvz0Ve6J7oM}DqrC|061Jb7 z78z~L-LkrKa#{MivW`gszZTSA((9m{azg7N^$wGZUvDOK`c~6)NNJ<2U$K)+hL1U# zlhrqQ#LhT05}Y+^Kk6&0Mo4?nbEY_r>)qV{wm0bAw8+;Rt-_hTM$v;m7%5&PWbzX8|-fwFD zj<-b@zM^@0hDorF3=ppzMA9ql0bP3|J35RQn`!*kmz7s8UhU7BU5a)CE)V&JDiDe zZOR^Pa|mt#Ne%(x1ZVGQ003nPx!dgqiK~lL4+LmUR?Ky`jNH^8Dapw(<6*`U$SDxy zu5)HnMFR^{x%q*xp(;{G(?hJSQ~=yV&w7k>YwVxRDu|XB<}E*?xYwdLjB?Vc9}8?? zBIX?_$Wsixzu$%MpZ5a9?@RXNZZ6V|N;$bgFR<2+$p7LM@S-SG;q6W4>&%LpQH{an z8u^`|ev%zVNCi`8iFj(eJ+Z>|id?Q)-x475R>`h7njt#54uhL{bvxC5=F)3i}ste>?Y1q^>MAkxB4LAuK*g8kf^G>M)m3cuC&jc!mfbpMSV9 zt7l(3QK@GaPyayPjh@8t80>8-Dz5!<{#-{(D&UmR?NSQH_#(s4jle$JhRksjK5MP^ zk4t&fAH~s-BfjB;K}Wjo{|6C4?!Nmj2M!(P^yN+_G>~NpOdTy^;x1gkr$4`&xt{`SeVyWs8aARdzWaS%I?zHui(^{d%vk+J{=6)VtcAJ$_P_GN!FFPXL2qvdt-kq` zl$4Nmv6K9wJY??`Iy%SR+xuYN_7_hg?o<_}$;8xD;I130X%N#ToHN$&hksf@K(~Rn zg`=U@h-l+R2vX71WPe(BmeiVW2vaDXlI-y7nV3_6<{VtruHYT4i2LB_mI#I77-|Jx&Xo=rW578>H>`M3DR&yFw_uO@NE^JIHGI1G)! zD`z+;dl~nJh$PM+Va8n6<)&b_Sx7G~XKtoM{Tn~zdxwYa*stQ!iA8jhOP2Gc*;Zl$ zm-)#*y}*Uu$OD}*K@bE%_$W+Ha+eg)4Mtjy@XEK^X_;Qg^vaDq{fB>w!}1;e<>d?L zl8iLoLhboidFOfv3>{zpAVC9ERYB5%bk@Gko(pjnY}r9df)oGL{H;(=Hyusml+Bz) z^&ExlG@0@1ZFEfBr*)=@VOX)+RV>Q;jQ>drs%#SOKFh0nk1`TbF=Kv)x?()gXrUw{ zSpzieIl!X7TENWAVQi*G+)#0+lryI^m9cjwNY8ZPFh@Na#=Pz5hDuS~1Y{I5%4p+J_8zFEKOhkgj?q6Dztt{N!#CWGZ}`F9C;;RPrcG1u zc6Bp6HuVxbPOPc|rg z3DZtmb`76?ekBD7CgGTklr#(DwSJ<8LRw-5wn#6n-FF680A^f6x4Oxlzl7w_CEk4V z6wM;I5(GgIe#fad|4)*^)WO?D{e>>-uTJ2s`cG_MT*2!vUtri&ki)}Vzj%ssS7LYU z#I49+X!v@sa{QfEx)bK|7u$EUqq&Wr*N&rydgy4oPN-%v>o(`$^N-Nj)^>Av5FoDW z=(>Rs*NETfsPcBuem%hAd8L$tNsIjvB*SnrI4FuMXxN!-J>BPV_G6~oP33E z)tLlh1`D+)x^6+W$S9^paG;6P$ImkKe(jP}9PT8N+$xcYF(!hs`_CmZH8dS;HYXNY z1{4Yl^O%;BK>O_hmSLdj2Br~5({8LFl*paCh3B5CWc0vydHrG#vtR{ZdA1sxDgy?J z6d>ZN=2N>ptkP5xM)&bQUOvS{WOC1@35FzNwOQZWGyp?FRh6kG1Q{KeoJr?MU&g1N z-AvBJTfF$wYYa<;to-yw$`lm^lel5xNKGemS}L@T-g%l78xBHTJ^Uh2J*Tg}M2kO6M|&sT@g00&O%W%4 z{B8EMO)c|RtR$vpP*7e<-n3Mbv39wGAU&h zB(4G|KE2`5|qI(k|^K0o2TY3Vs%d|$%&~1B?U7y#!v{by0NHMQqoeeTNMo1 zPI6uaa~Jf}K5C#CVaA4f8Jw6Jwo{UryY;JlX-~A_kc&O#>0nqm{yJ)=F%knL= zS-zZWc6HD`5Jh!(kd+Xji9yCk zlPRmoBR|W|fTUxRO2#yerek|(yw*v;p%S0yBce%D{Z|kT2I%e|X34xKSXpmnG!|iE zxQE{HD3YXLu~|`-yK~n{C~5*0n?a<{N6;U^nv+LKo(I*dBIz349rZN%%cxrVBHNi1n573F1A z&Z=V0+y%@jNy8XxrlmhL*)GY>w1OEFX32D2x=2IM!~?8`GnnWdLr*GV-s;sXpAPkx zS{Ur_rmdlYHm{YM?a#C8iKUbznuIOs%&sUQogvO&>%%)bLeP@O@|91pa&;B<@c{!-QU6jG{C*l4+Xezr1mhukYSYlG}nR0Z5=n@q5P! zL?>@wl4`^0O2B2epvV%KCR*6bgg;E&wBT^rk>e4pe%ZJ*ji zvEgu9LDw))ARZhk=D9NU7$N@z{_s@3Dr77+J9e9l z77i299yCb}-=iAg!0nNqiJ^t?-SJ!l zEfPe#dw#MJC*&O=^uGJOwZDjejEMief7hcye9<7jJN_<{kXAxzWgdx&gn9c|p{!yJ z_j9SCkwI_pj(x@a6Wp9G6?<=k3_VKlJ&8MSY;I1zz8n9J1ek~f?(v!ov}g$J*X-_I z^k{&wq4(c+XkvtWT@rfK$MB%Zf5!T3F1j2>oUG|aDG*I*F#ju3v&Y1fH`gWNui%?NuL4d4AdK@bE%_}y`H zlDj0UnEEFruaE_IS_uo*E+^k2Vd%F7Sc(nj*m(weI~nvoni4Xf2z{scw;y=WH!Wqw z<{4-P82T{BzW)>6ZT8=PewZK#f*=StsrP@%$5E8Q<^%lj8%N%gssI2}Cl(XI)g26- z;N`dYLE}NJQ#EKzBTg);Jy^;MK@bE%5N`T}23TO|8c|&YQ6G$n9*ZDG-vmJr1mWR) zVgs!El2mMVD;7mYk82pnsEPvU#G@LfB4fm2#P6CxtypX*=)~g&ip_>aQII9jwFu$p zt${RIQBhS37IkWpyP*@0MTy2me~@sCtXfbc6J3kHr>9W0Ik8(LbS-+vwe=exOR*p` znQ!jaWi25q3bLuABV(~Sut+*_T}M)^SR|cjG)gRPBC9GYIh6|f+`urb^Ydo8Cg+~FfjD{ERc{S6xBMF&IL>}PBeU@=(vO=%cvF$7F9)-O!U}o zi(YQ*!eYm1Q;|#qEgB|z_ZNz4!)3Q1nNvS*G<|a4%4DH+>(uuLrj8bi64Q*Ei)5@0 z$IaemBOW6b(})|l7A4&*xNaJg-#wZx7K8}Ghv@MQue10 zc^g<$m5Wo+&J{6l z$(~FWi>zV|c60LBK`wN9sM)xl<>>?L-FJ+Z!3f9&EZJ6#dF3!?+e4JB*vZl&7m5T% zaFmt{`#5^lj}FL|G-k|M%ChD8*h3oL?(>{Hd4cwc2YE#nGRqgSWJwj7b_t9zt{*wV zsa7AE)k`RIj&SK>9RvQU4^~1pb81R)hQ{eta#&Mtr}@H3j@S2LkVM7mrDTN~xp=;X zk$WU3b|jUsbn|LT5+vffiQN^a|H^re9I9v3RLQAc&C124BpMMkQ$-E8arm8+G!6zZ z0gJPcW!u+NnruNL%0%B)j=fn+@6?JBHFY}km#<_=o}F+^!`EHMsnZu}_o`%8uV8h} z3{tHc5iBUdL9SgmO6|2_qNat684Fmlq?#-TV44KFFL3PCMLNghSQ65iwPX!*ic_&k zGIDg3=8H!-cDbMEgD+MV1mPjwofY!&A%P^xND>q+e}<=4mEo~ZuBb#(aThP=>Cf+A zUfR?tl0B5I-No*0HKa-^*>j#?>k~^Ta_X3pOx}XceCA8LS(fQQlAIJT+03U_SCZ;f znEbUX@xT?Gg^vwMR1GArA4kDcDPr6kT;%d=aTlaqSuSlB$wT)v%MD`rgg(qQ1sp2gZH zce1$H0hmY_V9RIG)}4IukAIIRX60j-0H(9@nWtD)nu;BBvhE^1le80!Y#Ylwz3rW{l0-Dm5lOL?B2bDB_+wovW%->E}OP(X3_La z3T7?i$&Je>NVVPC#+}RjmFrota4w~bR`c{%zru6t7m)7+NTz!IcAi)^gLK=kJLn|W zv?|u`e2PW+V44QjX=QBs;#YZQQ2{n2^5#Fu?wu8ylFQoN zU*Ngbr8pD`$(~Hrx~F+&%`6;%C9{HcpZN;Ut}Z7?{5jwjd7 zCpSsKG$%_@NfMZ*O8Sgd?AWo6>Kw<^`JVjG#6YoSvS7p0Y+pG8j|C)2n%wq-UM_+l zJhaER2P@Rd@n5xa99Ur1kYL@*55IGOk*Q1rmVf&(Ie-3pJilW;4c|M1JaZkJmK4(R z@_*-*`W`B08T4K_z$@STA!h@Syx=SR^?zE!ss-Z!+y202iVH$$)s|A1qtCkYEOZZ6`bro1(1`OF>f97vO^sDhrj3b zHjVTpzt3O(!74T{y-N2hbv#g~&wH4RjSLde3=Bm9ivx!lCJaP_K8B(J;=Uoyz41e? zv^;^uE;IJp|K$6pr}C<}CA4re2QOq%oL|Juv=-`zBZU0{q_~M0k8^eZkGVQ^G)w+w z{_5{O%ZiehIMwaPj1N$M^hNfaKhL02#P2#?s~+kt+{GwRSlb+FAC# z*+>LCR!op@-4`cD$C>a(P;4r)Y+#_`NX=(PX+F7m`Q&7#;jxKdlAkORR#z6Ym#<=R zWiIvy-74m#>)5aO`OjYC%uo!;W<|a+_?MVRPEi`+#*17Za+6&=p9QlDNlBVUer^UC z&fmPXA%BoaG>W7vIIWvDZH_l{wQUSrRuOg=_vGaAb`)uUT zsvt#{i5m}=oYrLW^D5o=mJInA?Hj{T6%@eKbre?y`6anbOP@t?VvNp~tBi!8aP}o{ zpS-LL5*-Q>QAT>N(HSjd@up9)t}>sj6vxf)6)oILbH@Nu@n)X+)NE$vr{l4SZyiDS zC_KJBSoam9>%yBH>-;lz|H&6=m{6#FwKWzD}ZQVnC5H4 zV9TT+!H#T3Ze0^D2R6HeRViY@wn7TZGf;zJM%wxaW5r?v?v=mx9&HVW!^CVZ((Q#* zEMLKzOefbnj^I#KLV+>NdtR6($TsZW^BfHC%F=Yw zQygebFHk>nS7u?!O2yjsES;g!^u`%l?$vt*BqTUUm1M@kVZt}!1ldH_Bj~z=kP$&s z9b~(Usamy$Dpg_N&0#D?oIuEnj+Mk%BWK$asj4ogG^+tgGw)NU^u|k$gX$nPZ#sqJ zI595#N64XZ!L|FXzS+w~Lta_?!nMn&OHLHIC<0P7w!-!)FW zd4+9%zmB{&zRUl4e0XYD!9+Jq5{qZEdRK&!kdqW;lq0`9%>JuG7}hkb#0d?z(s21A z0|AM+Z-7C+SjF?nViF4t(r{+*q4oi{P0!Ob;$|u(3p3HBS}vV_n=98R$X~aM`ECXI zVHTn4I&o(rN!fEKLL2r7+9DDf#I01(0+JtH+@I%qbkDtI3^FLZZb4 z^Zvb9Mm&b(%Aj)XZYVcNPk`ZbFYxbgT*8MPi=v?W`e>=IW3;l8N{5~Ckq}x;!5@tv zxfC#Olu8FPZpZ2XBNjn2?bxgql=nTdj4By~N4sdea*5_q2{SxMzjw0krXCpK+JPT1 z*gl(irRB_BI-gx%nTGoZKjZClo%q^o+53}r+Nb;s|j{6AM6UeMC!r$;y4zrHu7uOIOSPv2@JgoTvq zwLHCb8Pd65@;`t2I@j(OT>*iiF?xLlbMmrCk?ZN#0cSDgGxJb`2N>$qD6F1M`iw9g zmrl~*C}BxWIUaSCdY_J62g%|>4YhE#bp_k9iYUsp5F9h^+lwX1Dn?|2&dVn`+peI5 z25Gu_nQk9I0_S(Cz$d{$%Mws`eeG$$Os~t%4vtG9thNEKWCW zyY+puzDt$}TGWR9jyih^Hb(;ZI=Oi82&eC^;b@x3&SY|nma=|hoUREIN%J$<(@OV9 zw>Q(PDLC8-xNJ6Tz|})nc;@#vFtaRyVN7J% zNnUvc*=`j~8CTjYW?5UQz0yStE6L^S_`=u!m?y1`y!cKpYUx525@4XMliso5ub*%} z*2T5UgDlvzl3mYeTBtTzE{7er-Q?QY%Y=9BWO_{ny{-FD?(;cRZ7!T@obHQt(ECw~wF180%}H#W7062HYKB#lsACx6_lC$Nc3RDAOeHb#m@dA3b-^NfAEQOw&M% zX=wU`kKIYCo!nVVSUZ0PY0dz>!xH(6mas(8@%5af`_en?Nlj+Unw4zH4PyE`IQ;qn zjx-ECR82_3-@~;F&1B^C(&CE{3Ab^fz6+^!i}t)nMicB54C6wPdcx& zKiExg+bEq^ui+o`q5)dlQBHQ2gx~O{R45Iu_?TkWC3i3ovl--+1LvBXL}$ zr)86_jMCBg=Ge@tCF|H!u49wDoPFbU-nr0C z*quh(#j7N_n&}HnFs60WP}ht#){8G1K<{j$$<~h#2_`Oav8$5l4ao$$#t7bL8DTUq zK~>cv85f zv6=t?AOJ~3K~!*C;{+xq2;F_!WCeR-I@3~;NU*EOvV;)}GB()5z(h=Z$$f&z78fb$ zNvKgTBcp)_3V7eWO0*~pGTTgCOXkid(SAb zhrV#EBxa=Ju|yah94Bljc+xZRSYmhw2MI_{GIFPrYK={NlkZvq2h4ZP-QT* zAS1m!4EpYo?eoTYwxyC+l!eD45f2X2)j2>=2T5^|l$wlFi7+-iM%c8IoSs2~9As?7 zkLh&dlwCY*cc%V zkQ^jursL9v85j){H*KU96_S}?gLsIsflm7Fh}L8hbEcD*>OeB$ghqPl8T1l06>Odq z(o<7NbgD?Qf)o!iHrP%7xPdDzo9t>tGghC%|VTdF_TsNuh39zOtO9WVgAbf<>X;dt%VtTe4 zDH5NY6AmEBsG66~<_0de52HQu4CEe)=g(ngPBPXz(l*Gb#PD`s;qawyQRrL{9y5r6L7l7&lWfsMsQd#K$^l=y;HsZ6B12wA?~wlx5>I42&DA zTqFgn8D&uK=4gF4hKR5PLHG@c080>rk4!w=&AE48<@#|I?kdf^}FKF??O^l6f{PgPI2(~SvtqXxWwZ_#Z$15&Ff}hbYJA%qgNP@KHQ|APe%$4(c3q`;LsqW{urid z5|8>B>g&a)+o@XlB=gck^z{xf>J4z?9_TEb!^)*AShsO0H5JoI0>DI%1{fRcXFQ@% zvS2;)3#|A?`WYJY5i%qavS+ev#Zt=Bbq4$U85kI3WFkmZEaLnal8|H>N&4UgbuI2< z7H$6=yLN42%i`&z+AI&(n7fV*YsyG*rct@}37-G`FR-Da02_c* zz@jHNvv_(ER$aqCHpqC`WX7_sEY33+8XjiUuYoO%k|mq?%vYXc zCJZD=M#jJ}3?jW3*!S8c+ zbzB_Ni4HYzWbbuOXO{BmwCUtFzss*)Z(uy4qwA2OT95;M)E)m7FTC45)t*NeH47gW z30GPbTb^4_Qr8iF@%s4(FN>tQDPOgo73CJ%uJ_>#fogg9P(rfUP(nSNJ@_g=KR!sN zH=V!#%mU^Y9Hp&YpIoJPM=&UXBq1SVQA2c%`3S`FSusnc?ScVFNRotvf<+nTTvrAq zd3j7vY2oUafhauR$D%E^J+Ob zY62#4!^DwW!?Gt=l0SZm7k=^@7ly;&Ng^{fg=kFYRy99C5QLA9$G8WpkAZ<dd zx+s^l1RIJOzm<{Oh@-_~#Nu)EcpOdBh{a-PaeXp3PC^mo6{*DgF7x)GArgy=DJe(+ zz%+C;Ek-=9q3dzt@i>vl)V3yofnn%Kii*?e#OZKgRTc3|{bNVM?k-@_6I)ojpcv-^ zZztm^UBkvz1^6!R<>=Kxf>===K^S2g264>**^0yNWLlaBGcv+NFo=$cq3gF&5=?G@ zu1{W@v#Bvat{)8rLzVYCjoM*SoH3 z#N%)v~crc;s-q4Q`RS1;tT;#2d0=Y9T9f zyBLbx7T(BKEMuoQ9$v)qswysC@e_?1+&-{*`{(86C6A0EndlQuG`Q_do+{>Ti>tEZ!%mn2=Te>NpQ9+tDOfaaBnc-)|XC-I)4003icT@>kmXX3E zG}j&H&Ao5%=Dv5RZRo>$|B4~P?-Y|*aDXePPH^^WFAr2@QgV{FWDA?Btn^%NW86q4 zBRK(w(@oN}R1$3RL-k}ziWNCB%+*u-IoaVSIVl(V&`!D%_{$MqW3-;375V-ZL`R-r*&Rhzn7gJW1jN>^Mb8wKBS4?VPh|CNR zS0--H>T`E*frKo{5FDiO!eNdd8~LrhG~u^TR%|3Bx{$RHKK}#swAifV7nPEoS4zhA z=P2A@Cp|BhY*z)($KbV>Uf_6Z_}3Rdz7I*UAVo%KZ>Z(f>qBJz<=5G=WhpHk`)G+8 z$TkNKJ4696(Cv1d78xUMf@y&4Kr;Kd-qBCl+{G+T_Y>Bpu3^&z*+NV|#hIaPtgW)( zPK?uiTY0^3Fib426OV=Otjj3L$g)Bx)JD_LYPMI-CN;5#mc}sMtvz^`t)_Bj9>-d) za{b&p_@x{Qa?_EN$ND#*AP660k8gmbx|x~cg?R-RP3H~ z3Z|Dab8r|5gIHjc!QpX2nwZY}@gd>KT*B}FAD<=t`Y-tJ-`vmrin>U#09W>Wo4-5m z#;zEc&RlA?Y~zXK9u6Hm!R5Z_Lk)+?stu>pMS|M}-t)YBx`}0U83;T2O&= zha33RbIT~4;b8~^Ns>s)nof3BF4<|xOv@`_R*8l2(E<8Q8P#UTrPxr>Xm4mGGIt^6 zi<9ZUa+=}GCppu#oM*Owj$OeQIoBU1dqx&XHWO1f#RPXj5I&Y3-vG-|!iw$NSUNKW zGo~Xc5^A)KfB)t$s2z&le3~8$Guq!n(0{8>Atl*?GThFA1N*t$GWFcnFohKb%t=co z$q8eAFtiBcL;ct$!nc*(Fo*>v7>YVszG63DovmXb#z5UZe)+~BnnuL!a!US1ruh_<45C&mhGUL7DR`e=x0$^ZQ@mC+7qB zh6fo?0>pu6?=`OW^-%521#gf@u%E;K{(U^pf0@<0|CoiL0M---zQ!YT5B}!8d4eDa zA0^2&P4ioCoZxFaR%7UoQ6eVAMQVBqZl{W5m>_{38l!j6cgGjHY_XEyPDGB3F%g=4 z#Oie8wp$4K#t7d$WeU#3WSmL_pEp2E2U)e^N^m2`{rCg7Rzt~F2kyjV5}nq``B)fe zp>amXyo7HXZV`U>$*P0I6c0+w&%{KC5Bv#|Rcx*VT#AO@7eX^0F2J@pJh+_-v5=2o zSjWUdLUIZ&Il#n3kf^SZkd{HR+kpk0SYV94VLt{k)&vi3t4?6dPZUt>9#T?0$iY!Y z{BazKZq!H+Unq)!j59fnM2AdhbQoXE#GR2#ibF<^$1r3oRy2a%5r%v^PLCTqQM}#| zIx==oGKmRRw24u?p%^+~^Q4oW?8Yh^7^X(Z>t$jhNKB+J5d`5wGHcc>_Uze1Zf-82 zQ0N0~D@hR7O=^1rtSQTSi~}q|5ClOGgxfsI087ju6$C*L1VMPjM1Upy|Lom&d>r+i z@bS--t=e6!dbO%0%aYtH#^46VHZHgUHV{Yx38Zn!-92}&=kA`n%iWW^B$trzTu6lw zz!XDljE%7Y+qm~`xk$2lU6t*tZ8P)yA-Q6(Ia7i?@BgIT+4=2nW@oC91 zIQiCV)HhyuCI6QBOc|Dk!zducLo^?Hn>Y8lNiCbqoEc?UqkRN|eTbGsoDPxBW82xf z?KmAVNE$kYnYWD~)1(mcoo3U@52))?kW3j2pK=?Oc^TM^fa<65_;xn!tS5|t)ci`u zO&-f2yAh)S!o9WZd4C%xI{OAnC1J^|;P%Nwuyj@N!S2&|qADQa%pJ<;iDM{AwPBW3 z!d++BwrLmD-C+<+Bo>r0JX@soK~;9mf?>06T+5l#_4rQFHhVoiP<~P&|Gl8Sy4gpJ<>r3fbfC zX2z&O5{-ZoqvO~+ytTK9XdJ+Rqi{U4ZqLPibUT}mv<=L(*lf^>L1woRQO*Ik5@_ zxP@EFvT#@=kj)5P$JnxUCnwwbb5&%Fx|12>%1Ab-XqrlI)dp7WY(z^R#^hl}YTrLV zlcE78Qu8V)FNssVrw&v3Nb=Pd4jruT-@b`L%$q6`Y z20|UD*!95yys4wO{gzTv5-b>nIDw|4Y}&G$CjW(FSUCO;ZXZ`dsxe4Q)jl@8e}o=q z0i%ZI5^JsEOp}}Fz*K%qP9@_C%rw`YrlB+NnXR>_w_xdXHy~5aB<9Z>L8RdTdrr0x z(f}cWA-CPnvbp2QOfn)!5|Z4XI}ijABv9kn^M)~d$ug#tC8B5|lBl65kX}BUZ$EJ_ zBMTiwVj6>Pzn90BPbb$bAsF(Rvg9k=HOzrYRIz0jGxr%9?jBh2@z0CECpLvLsCf(0zT zcP7Jg>;w5ClPJAyHuuaLPrmWor9YXGcP(b#v@%i+2J*)(XnYqMIokw}8b9CNtRCM@&m+{M@hb`10vw+C{*CWB5!SSU8z{ z+r`-{`&qNgm_BzAGe=~CARBSB|P@shZ&z?M^Y3JMa+q*jGw)n`I8F!9{>O_ zl9D%u`S&ei@(>52C?d%+k|&htghW8&P!%)X_F zL@kCYh?pH|jGMiT1(Qo~S_CvrKs2Q?_}1AhoHLGWSwJ)wT#S^0wzwqn;GMauwHc9C6r8J$%4D6%ul}V)9d5tEm%6; z4JUGjK?~6n6~EdgGW4#8Sw1D711o;cnv>VIYtdjN)OwU{FaL^lCnKbeS;mu3&SBc* zgH$!Ra3y3gq%0Fp%~l%aBnnEhIneCE69dptRrR8(($G**)fiDFn~4kWquBfZ_@}3K z;<`cupCz@J;iU$SZ+(kK>qy29Hd1rC|Ba$##9h6WKmYDo_Vk(<{m2jbhl%4T+`N+x zztX?2D>fAfh@t?#Cid@nfoIm$f3jn76_PcLvY|NyYPZm2%A#O!770xrJTZ~9@>wih zG7`hS-}3W6?xL{|40#m{wfKpu$&6p{b(U6kvhnGsdE=0W7!s+&Cz2CY(Igq88lvOS zTm1KbZ@X--35b#bZ|x3NKl=x^cR}WfC-|rD&tT@5ot$2Ogtz{91lgI*lJDd(toe0* zv*Iw`I6yjMZ=b{Mqcqh- z0qbC<8pE_5-@;43e2p4R6i<1WC%$?ovu>%T%vyf-$MrNv?2KLfI16r> z%6L;PvJyr%+Ahgys;L@2zmG`dvKH@8ncjk>)7@w?Dw$Ydp}qD5C)+Q&fT%sVLn4`D z?q$w!(?@PD0Gg^^lCnq6AI``mA6qwX=Cr3jOz~8$XHT=0p~D7aw?Zr)Lqk9W6px3h z<7bIl5=k5#vH+<4$5p*J(9s6|CxGU~yx(PX=;D^H$gxEd}kY|Z}DPqTCmE15+@c3;`0I6a3on#qaLCP zfPkRJ=nGw`+suc@7b3CpUKWgVe&~$VG?iE^OfY(``!#^y-$zVS(KODVdlzl-q5p}3 zfTk&E+QqGx1Mkx``WsUt)E(Zz?nB+A4WGd6lZIjoHnMByKAQUg)z9f8hv`t$$SBMr z8u8)xc~G({m^f(?71>r2EJoCLoJcgnXGw3t(&=t6*%jp!B&Zzd?!bG||23tR_nv=> z(1Ne?$Y1@8$(=n^Z+o4m-a2u~_M#{t2m*q5;h8TzE1h&D#x}qIqD%*Vg25;TQzDWS z0Zk(wiT2-!Y&J%Y8j7L!O&Wq=kw8=8MEi$vkW*SrSw;d)o7?HdOi5WG>9J0>9k0bz zSi#i0ODIa+MZGsbG#18DGM$J2sf77qi6q(2rnPUeyDkEP`D5!sh==ePa+$XLZz-MO zK{MKLAAW_E>vmGxdz}?68ZfwavBxxmF(bxtw8}*=s$i2ON;1>XdTVJ@FVvQz`Upov z%n262H;@2ZL=Xf-QG{zw3M8PZF(Tpq%1kO9%#f@EdJlBtk}PBmE@2QZUO#>oSAIEn zj4Yuv%fcyN|BdcSv78{t7-bK;Uiula#oy-fZ~cU^_qu7^wTd6VeyIOuYe}NGq6A0# zCbpmIX4vQewo#)fSy{#DxP}t#BX#s5zV{!M^u+9BSvq;`Pw#QED-Pnv9VZP%QBaf0 zxbu;JB6oHSQ4Q0$Z!POK?xEp&VlK%{+TbA+h+VvXqMp|5p=e`E8Iob*q}NGewiVge zfTvsFLrtJr*9C@fn%*bc+M41?C+u%L=o|Pb4QT618?%|%ZV(U@dJKyTO)@KZfDh+cR1dDEsqHU z=SQeNuc@`Pl=5sV-a{UGqH*GyK*ogS{L52!5Q;!w{cAk;-p>A{?P>&%n9kINf5lHG zxDiYa0#$GF#+rAja(UVF%74)p`Yzx4+K(8%$VbcGH~G&Mdx)Z-#K4+5fv^4aCoE7@ zz(8U~4rccz;@3FJ>3n?%7uQGsck2J02%u;X_2TIbVl2+25)C=*rz3PB&{fnBN?bru zjRXaOWHFJ_>_TQQ8A8MQPL3IkL_%Fe`l6p{u2Vh0(&=s}0x8ZUV&NVZ#tv z+rMq2b9e#VMt=6vJ2b=uDm0a}%DZ^%-}6}%6R_an=-bcn=k4{Vj#7peq~Sfgmxh*3 zx;RNocn-yb)7ahM10-Vp4r-5X=UA(XV^BU>6}K|B(aqNCkH0`_qJ&Wm(ouh!orlg6 z!9=9J6;JqoTE7<)ku5zOdglNo-!7vtU&I)Wqo5IqM$t5FV64}<5~^q_TrtAAW*YHG z2wTxzeC2-+WnM_dCI>mXRE%Daanj{QJMnKWDwc@1Nd4ud{%mg$dMb*i0W0&Q=}9HGUGKhrGh+ zDh)xDi1yY|y>A0Yx-I0DRZuZ`25oI?In*BenBycM3L;|EOKa~E7Hyiz=SxcD&ay4*@{3q)<|pN3dZ%^(`)3(PPwlDk(0_L2TAASS*+Y;mY01_5`d3 z1OAUJxPU~QK-+1yZas-08;N^bX!irCD6t5sBNyLLA?0Om29p4@bCI!@kju3!7Lv5yE0}46cP;~j&FaB zRhv%ZR?;xYBEj}k9IkRvFm@V=4ZR#X)7u~3OA&C$ZCQ z#9|u6!!#d#kBx_Wh=jv*)*Yp)Ees?gi6Wt{I%>DR!M;utcpErz>MXrs0mqP1%F2gw zYkDq&MlU5|PNp#1LUmU@mTiq_fD`O|&)KQ77rx zwmVKvY+D`Mwr$&X(m}_zeLA+2j&1up&wcM5-x%lD*|kTFy{mRrt-02mQwJ#YsLBEF z;{M=H<`ZEtROAIRKnz{9uB>S_6A(?92=Vpi+RX(H?Xc%WqO6hrWFuf`;^hGriSqn3 z7%`)#;-DSSY<=5U`by>_mHu9oM=6j05kQ6jM%v>huaaBH^E)v?TU1kux%igwVEZQ) z8atJ8%GGZ^l^Ev_M|8jpAmy&VDJUp_7#2$!&0_c86eVIq`aCaCV8fp(nf=@>+ZdaS zHcC?N3n@>Jm~?%fW(rv`3{ymvAj^b&#VN+tTHv3-w-7TbfzNQqn9b(oJ=^LJ4hK2B z$@A=enc3x_#N5F*}+mnWH_Ns_HtY&yvi- zHZU^T+yP2u2ogs##9-WTska4I+nL+H+XN+AUghR5B9f!fNYQr-?v_+G>v$bc=tB0m zORGI<9xlu`LV@=Yy3+2>cz2Uf$%4dg>!mpX(n(QcKzRSS$&hokLY7xyrJm9Za^jFR zd@ta_$Gym8oRo|z(cujRF%Jb>Ia8=%_{V)&i{nbPqyopxoJzO?o~*PG)YL!m$16_3 zB;E)^kzCQ!Hy9{^!^l15g82Uq5!AQ{)sy$b^qe_=bogoHkiU0)LG~dRDkLjyZn}6d z;Nr2)n7ZDyNMGQ{cQ&^9_N)Aye-$tuN(#?Nngx+Q9y|t6S(LPpdZ)vlS{pn^w*vqD zDDY?h)m9crMs#kl4xPQ?_6(Z3f|7lC>0(CL=vUnxLE8df;EbO)7;2Xm{aPAAo=F%= zN+_Zb;>9?~QnE6XN|+I%1EPh!-eSoAbe2mUW}jmNYveWA@28VGz-O6qOuw$l{2s@z zSonthfCek^>@(G5lGqUq{@!eH8~7}6%8J5F-eB@4|X!hEku&S7(3H?V0$K*)?@XBB!&>-(l1Ugc(I{KOYkI<0h5z$etK4nPFyPF*aG6m)?bm}lDio3 z$<)%=F^BPOt5KXR_ItDbU(5oZ%i)osU+ujx|>R5kMf|?n1250m2H`IXS!=q+Lu7AKU3sbz3Ul;Xhj;Jgn{`E7uuM{ z+_@5>r1)k&hf@Q{QxZ%;5bdzytTW}{X|*#NFQkQ5Kbqc_`Sf)BuoxPKarDm!7=2=v z@wiWhr&Q6$Q|;U~9xO##>AFI%5%ec^ta+O>XfVY1?=;(2ugDHk!zmquDG#6~!HZFU zC(!ZQ02R%PUc1fC;z`VcB$-AGII+|+Ueh-c#2{Od^vg1Hlm>C~w*BAdDPw-K$Q3l! z1lLq9NPHzgfyp5w@9WrgT7xx8Smtc>r1HJ3M{-MNx{O-fPJ#zHGbx)Xkg8w&Te-t_ zgnm9GXwk~Z7zqgA6<6qtU+-d%Zn_JL?AO1`t*~_Wi^?=V?(-eqAG+Ub^|z%q2!^dL zcQ4HI3^%11vjzhKqKNUB2TXN|akEMTh{^Pq$|<#~;c3Q*mwaN}Ic)w73GQh`CyB4B z|D>UxEM#2@Z}wo<{}33|#8*ODWI(L)P8PVb66}{GuQHm-{>$;{N$wnMzybAVwI|K| zt10oY=NsQI26ut$rJ0=!>&wB}C{_SFQ>h-VldODR=dr*dihUoB?43@HBaU%WopzUpFzTWIunv z<-gO+_s|%zL2=f9BIs>8q!5m45I!%VQX;iGZ;>hwaZaJf&By zy1N*JOTci2vAlj7!qfVMEBg@vi?Qy4^Wz2yl9^y_ZTxn`mU2(UF%T>&B8;!;J}=Am zZbVf~h9^%5Dqk*SI$=hQsHIFd9-942T!i2=u?a?(?oQ7@#3fw_mDi$fi%1b{rGLM< z-66tt1LLo(STkvU0wtVscRnVs9LkG(OHYH?|AtK%t%UU3=soaH^V%LImfV3pp|1RAb|6>W>JHePX)Urw|gx)O-GQ#+IDsm=^wbp0f;b7v- zf-`LU-dlKkLZw&pNfM*y>k9PrJgJH>ubX>mWp*<2?P+7UaKosd5e*^O7ytgf)iyW{ zO4YDm$tkM>AjyMKAV?TuPnteIBEcI_c6G~E8&2Sh(`C(0#}*fsppGe1SEK#=u1cR3 z5!gdY<=#(TuvWHo28yWCSe;eajdZ|-hJLd(KK?OZojV`QqI#?qa3Zm~+$Lh7oE_g< z*8fL;#6tLag{8TLBaW(juJZs+>&~X5C9W#c{S00BbI2GLecMam>pfgk6p*PnuDA5= zL~(`hfD+@a`SFY8$=8nSum(TMrITH^T*u99;N-#{`nW)nuw7&5*rb}AqQ#CItY zYwOv1wI;U6D*f=gciXpj>u)gK-d{AAh%PR#URgQE{>l#; zG6#GQDnNZ`x3Ia>K~;>P!~@FXNf*GmU+=0zR?%>ol&vSKrh4cjP0DSGeiLfgm6a2P zcbmm)^O3BKSUnsv#DINpLu-3xA;WdxOlGze;@$dIA9z+_(v+BDBZA-sOD&%COW6?w znJf1f^K)zQT#LV!=>gTK{?LFlV9CJ2i^`E7A7_@fWJFn#GjhbE27{DPXCP6kYs1~t zIX?L@AaRn1rH4fX_OHx-RK2bHA1rq0)vQI6WjU5o7#-iupTQLpCncnbNe7AQtMhF3 zW8nrfs@?mWgLdk;a9x4;-TH(If$QJ1&5S>Ken(c=BNs=p(3LtFb@I)AP5C` z%!v6m;)$^& zI3?w##tqU1mCh}1N*XIbLgH9EeLs<>rPPEJ3b9BaREOIHLulj+6^#z+U6wm0v#Sm= z=}SxrVm>SxT@J4RD}vQ_;$F3cg|Yf#`EIo$V=h6pb-hUDXe^8xsg@|&7u>7RzTZk6 z@%>ziMk5s2Ea(w;}VAl!fmn*PXnu)rz3pr0A%I3`Dw#=qDW%EOlq5reQ6V~KI< zc$ArF^}M=$hu8#}45VZ!`Gx~miAgMe3c2%K)I^(q&vq~~OUknmQ!{?{)@^F{p$?!S z$xKm!bIi}SbB9^Y6V_@#Slkwiry4ql)xf~OsM76B+t|<%E=0}`Ar{n`U0Fvp(9%pJ z{4Y~Q+OIgaLDe&T-=tgRV~62=DzLuFqOWH3ik|1;M1vL{vU+*xc~Y}K4_|lBAe?*o{rB*xr}^-iiH|Gii)Uz#1?L@eW1*d%)il2v zuWQtDC{rE-(K46iMMtI$#>CeM#6(s~@bQTV*YYN5rX&nUgX?BxSKSSEAY(^CekEtm zE0V{h{u9}-h{r}?Wh>KGfou!OgqH``T`2}}zJLG#0F2>V`}_D%dpqzt=t1@x|G^me zKd5ORJSA%oE){0yQmTcEKDiK+L4y_(9tDH$qmJMVI>-pcclKGLDx#)y78XKx&1@cH z3JLTt|0^l;$9o&17hIZrStn)vSXslr>XN0#F|c^rB;r^n8b7P=98;_ zLf}gZ?wYE0Z49}oNphx9=ZNLRf2n&=BAt#1Ew&jYju^Q7=vNbT+2_6OG2^B4iS)Hfh}=N)s;7e{nC z6ZpN8!5gAhvN*`872Sz0{{|fOfBVw^MS71EkA^{HD}+S2XK{!?IA%l?j}lFTHD?Yu z|JN*VNuk3ZdV=OWvtIxI`a0paF@R4CpdJO45fq#jWEb&B7*I&R>#!_GdnnkL+oz}A zq7;w4J&Qj6-{X|PwZn+v1lJ~CHa54xnK^l9Wjee|JM(3i+aC`zm*))dj$`O8|G!7+ zY|lligA_GUPDnc(#NVp?<#^;!)xUzVG=*Z}=!&M`kdT@2-j1pE-+SWDy&MX3(0NA_Ek=^tuu&OLG7B4RyZgEQnE)N`055c5w&HEM)eDSb9=3 zUo=p|-!`%`iG#QCZcVo~{ohLg$1t0Spw+pXMH^grd!1V z)cD}S|7VD~H^axikuv+pjdIPn?1U;R5WKN3=)N8%S<-3pgU8jF-R;C>vlqAjZ{yMS zI>a=W=C0{Tl^8-Xqc;?_-sWsXU!TtZy^f(vU(q2M(xO}WJYPz<=3Shx8~MMZ)w9np z6o64$*}lU{8}Yx*V|Q;cuw6izv_U~5=^yghP$#V0=>g>0Qb0*Eq27vP&?PF%{*HQ$ zUky^sAtxs%C0833zCuG;Nm3Qq1&aifT&*GSv_r;9fK?FYG`l$~+^J4ZLzWDX$(VA( z+Nz5pUXuj65P#pie=S;Zjv8~)N`wscSW$4-hSTkL9@iQpCof6nqsC~&C0ke*${v^7 z#=vy#&M|06Ov;kCDuU8P7erQiCjc}*A-9?(CEF0s%*v`O3W*HuPmptHj?AxxXxAkt zW=k|EQ4p#lo1jrHO328-@d?3czO4S{lr5iSVwM{rmMI85v8^a$EzmJk{Ti3V{N;Q* z=9s0J!s**>+tki`PZMB3O2H8iUj~(l{kesxwZ0+BM)sKE!ZL@SVS<7Zo6#G6$d1*I zO)RZ}IzJ{UH)4i9BZ|XJ__uPWR_y7W+9qJq2?DJ4nB`l5X0_;gwObtH{F zF4BfTMoliBMsH)>zrL?Ynqcgd#0X6l7;hd+i_7jqSlR}%+DV?{`ePi+G&l|a~{bW;!xjJai=baqy)J~`-)3|=d zM@8%&iE>>;SJ3=hC2n-L3YU#X}&4C-pog-R{&nD|1*Z^(M5(+k^Uw z$3(DKs*}viUi(#|sqEO?wFd-sQQ!>FmG|ux^WAjb^FGmXh~q2j%kO}gVVrnG;9i&T zZ?)m@wBI^UCw|IkEd3DPfi`97YRM4L_9sp!}BJ9pW3F@jhZc@B?YGu&=Zb){(S^ z)yC&imA#c4yZf5Cho3dwAUiw5pbyvjFj($P^X*fqD=E3KvF9(xC2kn=f|UJ442|OG z6auZMwL4j%HH`GvE=+_su4{mYYLC zbF4FM1-VHo%UPg33)g7WDxHDS)a@zb=UCXIUIVM2d>codo!;R57%gWPFf-x>fWnxE5?duq60q<|-T_3O6L|bZO zv%Ru!>Zo6Tie%Wi*;j`^qnSE{lAK^H*uDw=+tss;kmL&iFeDi?^O< zGDJ7>0bRDT zqp-563VSTOE@QOU4SKHh=q290@>mrrNqStW*_64QGkO?lnyl3oqWA4iuS0ULWq7>J zcosfOjd0K=dXM{&p_aEb(+#z}?F=l9!5cF9>WJ5!IBwI5{8w+Rx_US84+EG|EXofL zSpS`~jUQu&=s#qfnZK`>bDiyKmHK0&L9_1lK;zh!8x1oq%}~Rezbqd$dKhBW9I?+F zcWyCKGP^v|QF3Olb~&Lz;|+d{D!4d}e{35)7MSUM9E_{bSWfudcW%60>#BS#=bx}2 zDCbeltGZ{E>Os+v#1<8bW$3V}u(kim_=0>=kTw{<@*g_PVj@fbKtSSeis*>jZs;Tl zz`Z<}&}M8Hx$!;Zb>Q*N(~>aX=kAUAZx%>xHWgEV^E37vWVDr%{!UR$Ob-DP6I=bL zsbNUb$Pu)Mw$0sq1{dPpBxrJd{CA-&807IgdT`we<}VFAPGSf$B1+sy1kKN^(%GYv zqQ>IfxH!bM_sM&&-SR9brQl1}PR-U=SN?L#lKNNp*b8R5)z#nJwT1t(gu566);Gnh zy{QNY2--HlilW4MXQpaYX;)@4#&Ya=hl-KnBv$Ue*ZR&#F(GR42Gw>3x5#4!8X()d z<5lN&Lz4ZpK=I*YSX*B^ar1_K?glxP&(F?=G8XyyJQe5&njXL;b++D({Cz67vMuiJ zPEF?FH&CdCK05}c;Nq<|__0dhX<1rx4z$oipUB~iWc(G42)*v~KC!bduC5NV#p7@; zUmQy?3naI#QcA0vGw_kR5~`Bh_yM;6!R zm{R)Wxcl+M=};QWo*s?a8~OfsHU`+D_ob|`Ye5+=HLC3#P+aCc?OyyBXpEz6_}lEm z%5AB6e(SunkS3sb7qb*A+Yx=^Z-YHQkOM1rh#Y2LPHW=n>&APcT2cs828W9s>FM&p zW>rbVyDT5%CAJHN*4{`8_15nDw$9n+$iqeK$B2HEJfV`4PUj!)iy%4!SDlxsu zp0IMF=#e12H%`5E7g1!xH^tT7#(b`qZ|ZoA-S2*jKPa6o0vmxPiJSya*1^wY3hKL* zXbL=bjJnUu;IChjf0tku)Rf(C-cqrZAmF8)i`?>xN|*gVOC-w){7rb>%yIdO0{+Wm zg6-le*^^aQlZ2U>C1$x~7^n>KTaeFRos!jJ4Jksqmc=`^kiGwj(|p|r6cxI~U2REO z8`CbQtOx=O>8FU9FUuIxM#_N)DRDUC)lje&Q8>{e9hYT!zi)qh&)&PFqZyd=+0az z0eyJBC{c+!FG{-ap}mOmBTZz ztccnLaT5Sxw=P7VT_`E!SHeq0_Z_+xL_FBif+>*5cwB9xLj+H0EKPIY3aQuHYqWzi z&yx~kYA1$@+D;yDB&TG5^UpZ<91N$Z0&``|l`O4xW8IPFJ?Py@<%AN?O)%4#m$Ibr zA#}sD{#YL))d@nCAo)|vlcQ5o>)EO-m-U(TpVlSLIEAJ$C=D4Tpg^^~tAbSv;4TJ4 zcXUBrY~+I%pe~ckO0}mT5y@!{#jN=zSsYp7eu9Hn1)MR_`Z;<0tFoBAe0%t4EnjNNy2)@~x3UrIxbf;SA>i3c!;=I4jfupXJ8 z14|;3VlW>RA3o2jrk)W6JZ@n(yq9mnv9?Ot;U&SX#srtD8$nK-F~hrNPavNb-CJs? zB$S(?J*+r!3-`BnzFHV6uYi*I6FYeh+W;|Y(R^YfT$U`r^qUQ*4_5Iw^q$-gv}@X< z-~tc2xFW0azXx|!qL9IY3hP4h?Gh|qRrsA0A^IqXZkM5oh z@*y4DHovLBe`&$C(s$)+&wZSGT$r|~cGg~er_Yo+t~8&2#q#vEhEPHPTnwcBx`i=g z?9K*Uk;FxbZS)?q>nQm5t*(SV4PjuYsw(Z~|7suu;l8a=B&^9QuwK&=eBebzbLXcN zc}7EafNv;*LrDoDNqq7$`ADGVY^l$EHUMCj_^+tQjOAEH6VgHKva@3?J*^vVD&23m zYgk*LlsFY#G%f`$y5txG3H|F2fzKz5^UD}Tri*M@S!B!8XnpsYaxiJ$xFVfbsR|BB zy85KZmZz61|2Hn{X;DXXMw2eN5>`&+C`+Y*OZg5j?i*;MA!cx;>o=IO;TQtXApNhq zY0dWDVE!}FJX!YQhv7)wE?PM<+)J`jsG2`uDxgE7ohZizHl3F*q%2NMc3SkAC`9-& z0g2^b8*z-x2rr{@aO?>+8(2(PGcwG|SjfuuUOYH3DRu)u2J(&5ZA|)tkXQ0*2y>56!64>qiY|ArPWl7uSON38`FAABp>9>>VGXWT~ zuS?ZsF-xZBeJ?WUbD%fn(ob*B;aiH(@}zP$gQr|HBk4Dzs;ml1f`{ul_2P{bX)|?! zrHO+)|09y&F-{MH4!ATgz*mDP`hynj2F<1o?`@TFa`ATWchH)=OeZKI%w)jTtidT8 zaiUjalrU?%ee!WYdT=2;SN;iN^MC7g=h>BnV@Jy?EDQepfr}?iOkhd5*^{pCn06|q z@W|!jXY1(b>`w@p&vXJJ=~xSl)OR4RWuID{GA9{~n>{bA0}*mf^yMHI&wtxocGKk& zH(X?5agodIf7(x#jggSK}S(shN@L-$S9Uf=eF%YKPvu6Tjoafe; zV!lKUKw)i1_MqHG(82IUv(qRwhjvHNbC&#k&hxiaOo8we>LQ@@YLj;+3tjvifHo{r zM$_(3q1CpUo2zK#Xz>s_2G}uoOMIB+Ub%yr5zKeRebJw06Q(wK1X3tXK6plL$!P0t&gDI4d*(&MZ`aX4_-tMzn$Bcwmc-I- zn+-qwz3a@0Ue@TthhEb=6h=RO1J_xNye@khXYOoGM=j%p>iJASP15;2K-PUDo~A6y zmd8!mbvDI|jgSIYnO|r;CjB(nzP|82dxQB&+o$sxn?4JwalhDWobr)iz2Cd@N2dP~ zYLD8A(9k~<#jI%C%IzbE+`j#`M074+>i??+h#^7CXyt{9&yjYM&Uu}*UU8_4Y)g;_ zlp0PE3~oltsl19#pkS#&x70tSM2{WKK)lXER!NCuex!m}dgKFn^i;4qu6VJ6^9<}Y zj3zJdnj23V%y~@Y<7_q>Utm;TH3A5#M?kckTun(eadw~)pDu*!?^lJJtqN6iUf$qg zB=dQUMeLN-!S&i|Q~fg8+iDq4i${lD9)BPnQO*$d-;(G0Ro5YH6oN{<(p~TI z%!fXAYW{U`yU2;c=E_x{(x;@FF~~Oqr}?*Xy?M9E%~BAM;9i{gd7uyaA*ygRel8x( z^85XpjTJi~!@i&OI)#C*I6aOHf$@ZBS|mI;zOm{sHfxX;Pa^UB!{Zt9y){A%X2;69 z0Ej_Mcr&A>uAp3&?m-v8u_fW|%T|U+P{w6K>g>S0Di4=bfO5(`2yI_$X5Ng%v{#3t z2k4J@hEF5AZml8!6+ug!E)#~Waj9c{7DAU6M!oK#)sI+wl1v0dD?myJ~_69mV4y( zk3=FRgb#l3=5$M3CG+OU|t2~h7wV%Iqo$OG06rN=F<()Mr)ks4L8yfSNeCn zBp}Qz1qGd>%&o@wAq>q$0!)YmA9j8jO9c5yf8u9x0WjN@ma*({E;VE&q#AMmLASj!EsC64XilZg6=HJ z)}Ym$zM|0bt@bPqH})VC5-wUeiBYg6+YJSCY*K9gau3UTJagrFnc`DcN@d)uh~+@;58{?_C){ ztm#^nSz!=9Tr9WeLYS>@x2Mzv0=t~>PT1uG8y(wKg? zd4hxg@xj{VP;|z+Rs7#Ev;!pApxNn0|388a`E*2~|3CJ-B)1{$cS{b0(!8t6y_mor#%6s044O^b^~S)z(fftUa=A#{{MU6;4}gN`rMha8P@ z+F9OxL1fi`Ys-nxL?|<_9h{AqVr~QiaYv0CssBAF>@nDqeu9QR50zW9^KLZ57zMy6 z(d)5G_e%^*^eHmbqKf~6>q3SM^>lwBacbJqAN1`#rC%KCmI{@1?nsfBmL_LehNh)mxayazJ6fhKpPTz3N+>o zF$Lbh_W{xzqX{c+V1{9O}I3GwDb>2_Y5TnUBKe<+-YnuP+rT7eU%1r zLL5aXA;LTBkEP8ZUdP`Qf#A^n7@_@At~zWANTo0X9=2xJw%A~5U_F{mMd>2Z)s-Ae z$**52@=eWIX$g|zK*{f`fB|12KyfT2iKzLV=4pr699%TbUs+;8c+|MyS*u}5qMBE3 zt&aEQ1V~Lv=GqhzE~zmqcz<((=E=?b2Xh)q=GKti9F;1kjJ!jTJkSI3a0DMk@Oh33 zD6>^WT;z$%#0f2SS3I+Fq(INn#}X=z_o zy!CLxFm4I#$)%9_akAAI>HY-G$>E|P%}`Lqlq@O&ui#BkhFj~HsQpbFvm_W!vY8sP z6OU8%jFh{szCUq#=z{fR z*}T-4RAfg2Q)H>Q4+MG%CMh+n=P*liyUeT}1Eho<_H-jHS~@$BbEq5VKHeDiSI$a4 zqfUpE%hz*vm7I%s(Bw&XR1NoAe<0oY#w$9=!?xMOVa4QaFd>)~@Z`!KQO{2bIIssZ zl%{^;IJZ@@fbc@HqGv8|1J)~Beo^yRCNoCuu@x5#P|6LTY^O2%q{-FCbyYGZ08U?Y0N+)~cTLE5l!&P>iF__h&gf+AAx28I zE(1WSYii?bjis(l^vha)-2t;ocj`C>uWNmM{6hSbS+m%~Wsp@?CRM4*3{{ri=If@G zbI#=}l1a`nb7J+H7fzzo@EQEK$urmID_)m#eJ1ty#DZY6+Rzfb9zpeSnR9D2-wh}s z?5^*Q0jZPca*TCM59s#Y-pQ8%aWO)m)av3lAgYL#8ar%W_xXw=hDZ|0d10qA1ReQr ztR$?Xqx%yAe7h*~(~e0x{mz`UQvLZg1g>~_v)x3pg-341NUClJ(&0hlwz^S?g7wLl zU>?|M{eI&;v_IV4!DI)BYr2LhDBre-#?jOyEzth`m=>Y z-smpM@jmwpmZPJ%Tq!qeo+r{J#$d8hpXAS{Y73!FVeL9xhv?qHppAW$>2ud)6%LuQ zvkxAXedx8z!`9IW8(d~Fk?G)}>3%bz@zc7gixCMWAI@-=u=uA#T8+NgA0;4<_VjFt z36t%O(II`l%qAX(6pifgsonm}RPh3|EPQTvoN9Jn|L!YFZ~IIfUv+@6HBxQY9U*-; zZUf5j{GN{_5}ahl1r0j<^yr~|Sxwq& zA+wfG{v)#zoY-AD3r}Z!;}!nCaIibEH^%7DqC%sMNrZ9jRUvy;-$L`5W~U=qs=!t- zqb20tU157s3?|YTvn4zpM--<7!NG$r`lNr5tMgo2`(A6#9|UHj;dwe=AE?$f{XL^> zBKjF%v#q_O$vB5bgCAwOzgGm|EHp@JNXQBqS|dS+GlWhXN?Zm9BlpT*VL1R8vp zGAy-4KC@|6Fo4ds;~^m3%<=JZE64;X0=7WQVc2_+^hxVBk3>46Vk8&kcbTES1b7z( zyj1mRr;>>m*!UH}Cs$>Cx4fvR7NoAD{dar){l(p0qxocoWWvn8@+H3akEKR{Czwjk zWNOiqzshcL&*rzOHQ$Se`(_bQ3*JR3_{i9d&ZiN+I>+)^JcxtDTc9h9ahXZ9(?x>pkXHA+?S^p#^tH_97 zu9UL4Q&$5X-}&gK8gMmv*+JkwCRNmD1km%$p-)wIZVF=8xXpNOyH1e9=Z=IJs^PkK zjf1j=2I@GCr;cjV8R925jZKT?`8DRMI?T>y`zTcc6ED`e?j4)7mdPF_UWjp~ zY!)U-Eb9{$P!|CTry)k~JHM|ze=IKZ2^rY%` zPR+)J9=8$WrPG7w5$K{;2I(miUV(Duq^Jek2}Kn>`9~Z zRs?^^kc#~B=Is2!Hnjzdv7k4dBw50Yr{JlH380TI+R%8d7`N==eYk^RVUO|7F(Kat@uqCcgK3ToYC#sK&nZrCyc zc8TN@Ae^%qv}!bP8<0BnOZexXb~V!2W)+Uj}jZXu}d3oJ&RGkfV6PZFA z)yDWeOMzM4AtX|SxKEu@w3*ZQ5@t$S##HD{2^mJipn}0#O^Dh%?p7U{Ocr1AtHm_` z!;e;wwikaqXr(Vv@^_+Tbnk=};0~Gy3Z2N-m;SqCd(NjAsKCKQ4rOhG>G`5WzA7u| z=sdpB+Y%UP6HCQhnefM$DsjF&JO6@5rV%NDPesSt?B!MIKc==hp0r(8{AmN`C4F+o zdX?`##v~kND|}`%9IkhsHB21t3L`QuviSG9&~n4lWmkyk+i&4E*cM5d&na}bxA3wp z9zHu-HcwTR9bPxsG~~09jOecp$WG>E0^9`m|L(9JlXs0Gq*@GZXJ=xO0M;xtD;PL{ z+~aPAejMB|vjD?O``l>9X)UE9C4yBGF*R}~cyezRPbiVP7gv~(e>I*ONYl8_`0Ac_ z`act!k^7-F#lUrw>L}2eja7M#i@|hqRdY7C`|E(9&=~Eu>{OE?F*!R}%z1wO?B7~*lPLF1qNX|EhL;n|?CEh#oo~T~qd^nRy1@~1yy|+bEa`JnNhyWx(;WP|k0#khN zH@3fbJKnTqOm_Q@HSR4av%&XjdWCFtaY;C6j+LP+Ue;~1xNSW5#@N_lU>l!kOr)Y- zL83AEM)PtRJA;}i!!djd{i&>-9#1NKC?djeo;UoG68^)oF-sB;tGZo1ogH7mu{xyf zT&;b8nf;dNAD2AchZDN>x_~hMb-B=|%grsO*I=BzWbt3U!8><*?m;=I3SFB4-tlDk zCF6S}SrjO=+p*vmj{wx&{*v|?wu>ph2N@E!Vflp%a`Xiybg1eNmh~;4^in+xm)JUi zcjN|jh__k^*jIj`!bD7pQ}wzMjD&wZL(}?ez(q_V*kpE=5eDOs2L)Xpd*)1`ABEOG zpGK@YsA6zAlIlYxJnl;LLHwrJJkI=CHw1shQ+@XR;_01%IxC9~q5DVUx}I-Brqsh^ zHI6qD_KmGw!Fhd>JzY{lh-Vu-<7sx1qJu&J8uAA9AYyo}A|y=Y+jfV0o!x5;tjA~3 z-HDGARGi%MR_L<9$ibb0BaF|d z-mjpV0XE)FH$t4l&g_UVk@Bp-!jCvGW+~yMSNkO-VRyE9o%t|cH1H5SZkIfLW+WlfXpH&YYld_qN1uK%=9Rr ziSQ3^3;PR@`q#hni$N?ujbRPc$DtiMk9R4xNgS~ah-x&-nP2iEt#GZy!E0d*ULsO4 zxh!!_f^clrfza7ZukI|zr_KhFH$xQU-B$$NAGjPm!J>TCDf(waJ89GzjS)uOd2r2s zE;i_NTH|}l6o~J8jBQ2oMw@BF`x$|kcq$yOdk-M(WmSprd4<1ZGMRb%zpIua-}0{V z7mY}HNKn+(;qnw*=|EC2{$1bgztg&*$JgYHhXg^!lz(p!6;2DC?_K-*XNfvYE@%Zl zOu-{dAUYR13U+g~@5PvhYuSQ0yLxCyNS1fz*Wm0PhsS<&vHP+J=Km!SA;Zs}&RNty^cLYs zpkto#%-p;pD4;c_0O|J|YcO{Io$5|)6TUvgyL&mi@=2@>-+aH?bdAw^r;DcAS7KpD z(w=L5_7mbWJwj~w(t65`SCmz=VTU>p3Znya!D>$5HomHJNvnBf@aHQ`w9^%WYj)fl zGi1;a7@swSs?vDH-zM4)wv#6zW9|#x3~y7!GuTQ(7oX7UPfwDVt1eAU#4R{j(LU$Z zjb;STm>9xhJk78=TM-_1*Xj8rydDfyLL@^$H=;ICa}8(_s`I;l$Bw&CZ#U3E&t9Dt z)|RE~l|^CQE&w%U)pcq8nZEgXId^v~-RjsTH_u4ypNTzs+?}WGjyr&(ajk2_`|ou_ z*})l=J144G+5|s7xrJC7r3gqU`1Bg`JGs; zGZGRqv{M0yVd8bIsb^G3j>obX{HkQA*E2^>J2x*k zZ+rl~wb3aEbxYSuh_}7s<&&YSyPZ2|7!O^S*3DhD)~`a@NptLy?R`y}!@_U*|eA1ZJA?!x`#rIMq zs*)Q)cN8l~Q8tVw(J|i6#7-K={<1AX*#!>+awlF=T>QHN-vc@xmeUVE6Il29#?z&^#nQU zq`24qrnoADGz67NL3WU>_9qo}B04%ya9(BMDYr3DD=$!so*b%iI7TXwU#HC$RNtI3 z)@Lr=0Nbc3!~*X^|N3c7lFgL;Hl2wZyLDph`i4s*{pGn-l=x&``uo$1E18rG0e$GK zLR!UJ<0~T}!Q><_t3yFhjVW99Lu5AbSY+}sgVpS2Lp`6o?22H^=M1|U@#FF&-9*-m z_3yyb$kT!f!$ebrFR;fn}|K_Fnm-PseC9-Nt7c*45g zdfS4&Dhn$t_9cceJbslJ!oZy!`}l?N!O@GvXbQ6Zs;KF<-=>&XJhamRPAFw+sD8*7 zm{FVU0yt8S+-`1re%!}vV11MOICd_ycDF0iy5HKpj$iry1gZAn9ZKN_FO#n~)r2A? zxdpQ(s6$0#Hu0&(K)5|Vwk~&qI>1L!G^2xO;@@7>g1D=mFcrm^#tjj z@3}V8Eq^a}Q_RO!geF;nZRWJi_2~snL?Sjsz~SRHcnt|kG)!8>_shv@zxb=So+8%Z z^4+mbp=+vBUCe<3X5b&Y2Sk+sTSs&$Uiu8ru40pSBgPL*;d=lNzaw0z!n9yKC{B8y z>o?;GS$r~mOes%aVqYfmk?#|b!{t+Vzwu&%172L(JKtpHnZvTpOg&UHI+wO2**VIA zAfA2EfCs99nYZ#zue1(<`#7Hf+>_t8K2$`Pp^QF{Ismoy%ia|cLu7<|Md$9Lr~CiZ z)bj0%? zI?c&3&|+&nj55Q&j#4T#mXsl9CyuK2&e_R*a>M%!$yNI7;>0>1ks5sO=010VO3w!c zikTF?y9b!cksl?>`M7&B!?Fh}iViy(L-%et5>%Ve>+3VzZGHKK%4C6&Gdqp!@v;w& z=lOdjckDEJKDNur%HPhMEY?XXaWh=}TfWLISw%?u4K7W%K7nO^P*||%-s*5MwtmjH zDYllvMwbbb?th1CzTr8s{fsXo4&u8t>N{0%1cxg4XO@&$9{Uoepz{R2j-S6T%1?1T zAlH+#ywp=^u=|tZM8$EDh%Rc|-ySBOxm5lTF{|2za~?^^Hj-d2I`)HB9rd5=J-0AD zt~z=?Grw(bdZ5trDT`tHBl|YsEUP4cH_{?6t!`uFDD_j#n%9jch!L3--C}Q_ma(C1 z?Q5nZAIU38ROeALjrWG)Fix66&1qiOGf91WLqhJ!mvSS~#Hdk%*?&?TGiHj6jUk}% z7SQWui?!VOPSjiTpXsgle?bo13tZljcec#+#S2$$u5EwuP@;e%YVq7zTWW^5USZ@4 z&v1<-{=wq>=8%R7X^$R0zhc$u#Kt{6yZlVsXZF{=g9wqy zzH)+^s9y{m4S#G5JVqm1*gH;i1`l^$*kEVd-0^T0M_x<{r;h2>%~afc+gw@w>kE~K zlXJ>ezRfU)EuS`K{O{9e?Jm!DSZ|-DIMB9t|4=WIX8N7)43+VAefeqb zI0pF`A(Co>O@?qJNG!R2%Oe!aJ-5uR0LtB38&6G_#5hEr^LW&`3@aHgeN;i? zg6L;5d~SJJa%t9?OY^ojNH+a%{uJ3Bng!1zsXb9|pfYsUTAOKOk%gN0*-s(=kdU2{ z32zhX8n|^2?`hXA!7lPbvG;pdw%LsZk>%>U9O^t^-5g|t3}phhF?QjpGybM`lvh5Y zoHiH#doQc`8uhJJ_8%us3oDk{oqLw1+SHC$Gv1#8F{`^J?@k2w!>oQzKaUW_BgBhE zF(9PouesK)!7>q%^qP}PM=002dV6JVM9fR2Jx-*TWOFA%?&R*_wFlG09Cf_jM&DnX(r4rO2A$#NxW4A|odAjx z8KgY)Wm`sHi&g^`DihkkWaTo}yK}CV^mZ{OI?$};VgfD63#32hbpe-cVsCtR+1Mlk zBu29USnXZpQbujzEHh#$=KZ+oVZuMcWxc%^H!rd|jY(S*#7QW_s}8w;#gWq9>3&%p z3^XIYUT$2t6crLHt;Qgd?<*Jtt_s`Eb3GFF^yLE0$PZM0(fnU6z#jn*xX^1PfLly# zw3r&%5QVv-$()6S-R~2(C!6Z*M?1!r!quS>&3=?)`?#OuW0YuSa2s}7Dq3?|D@pIa4- z!3eTOCagaflpSDMHO4~+Oipw7;5ddhP8rVpoB^TI zSRC@{N(XI6$%`;yTyX=DG8)CPlvz20ZHe3mR5gl=se_`87!VL2Zi3{2xT?(XcY2I=p_lpPDJ53R8XSo^fAy9O;RGROp{d>94(DQS{-k<9Q~( zl0qHaG0Iw7lhm_31}4DIiu;fGfk<)KV?T zwv0!+HJkS_3L>oqa7;^CprRsc$`28;>f6B z%QN#m(vc!Rwlj?z&sNKsjy1t>h~xZN6hiUmCr`pBkjW)>j4D%bW+o!chWsGbFrp_p z|LeImr^+pf)0kC1&r&$giGQ6e* zMZgzMKhtca3ITF!*Xaky3Z)-mi(jMqsBH;f0XX71G12kX;JQLSVzvT0wtC)z>j@Mp zW;m?G3!saolf(b{8p1Io^4+vOo<$BcNN`Yr=8L&HG}YRlozUaUM{%F3i;XcX#zCzl zHZBM|<#OF8KJvcPyj?(>kZpWqG;1M~@S+j8W)XOOBl`c^`>Lq8g6B;FNeBc98Y~cC zaA$CLcXxLPPOu?JkYGb#a2ecnaCdhncyI_LxZ8jD?SIeNr#*Z2ZO_@4e(8Jb-mb3O z_p9pa`p&*T-y3^bPH?WMW)*%(2zTI$LKccl+48N{pZ?i7YJYSv^H{ zWtLAKmg&WRdaVKMK5}$TKFD>7jyb(5wGO;7d6&)>%e=E#@;WUR@9@PMmx*ovx=gNl zLC&?8PvWFp4!m5qh5qQbtvIziy>QZAo1a)!?f;&=(xwA#M1l_PVG4Fflr}Q7R+t~x zZTp?TRJ?r>QL;JyTn6viV6p&eyX05mu%9X%-#zr7qT-tos5#Q-Xn0*K5T%bLF^&X> z)ET(X9y>^tLVzMN^C+I0&folzBbWl?ana@N38m}X1{#lrCl;QD!55X4&f-Z`{WKrU z*?xoyvo>T`LTh|k*sVs;p!cGrW1mc?Lu1J6wm3Rg-5^&1DdfN;pr;(lj8$|t>kWrL zmT*caaoC~{eb6GQw3-+iTR`O|VuM^kwNJl5S%VVAx|?}@FEu3HM4GU5;~FXM$3*(D zoBySMtmp0eZT}qgKViHv@lC1mwct7?{^*8g& zqMiM45+?kxk)Mix)q05<%GUS|>i2hUrRc9{xFW^8qnKFk-mnnH+L7cO2Sr;$QR8Cp zq0$Lf*XpW_qUL)?MQKeB4n<_yt}>Zm-!xmBgZ__E)4G1q&7{$d+g=Va0sx>(i|Iz0!b0)U+qg8Q%JYmCU!8e8f;si|Kl$`I=lo z+{e%&+yyzfU8)Zc4*o7Kgi?@`2ijbS5*@El$z~Bx?uN5+Fp&^D)s(1ATVnN~l zpi7=toN$%|{hN_JsY%d2_rrFy+Y0oa$N!Fq%V}-&*Ds-m)F8>}6OGmZH83vNO{ z*J-7+LscIzq}Tw25ZT<)2LgVh)nUoKV;{X4IjaLitbI^ z;$=@2+syGTWhXPMKs@otprN3qOP=SeX)gMpe9(@*J?&NIZ?bRgNmoJ{QK}xI)zj|=LPqgf=qs+1!M7s($c`Fnb|b2QsdpnzZE<~htE@;Q3(^(4voXG zzbtOm)3Sy93bX#;^@rL}%8*>0>aUc9iu&H?&b)>gn126aS_0{HaH!&V$CH-O*-PnYB^7^)c^$p46k2ubx@Kh{x`^*Q%&xS*c z7-1>6_?U$(LZfq~Ew{FZY}GWCI|qH{HhedkM~zGJy>p7!H1^lzXg>jjeR%=d*~Mf> zKc1)Jf1%+E-hY~pn&!PYdlrwZi>D!dMx1#4_~39a32H`x})zn~!;bsm@6j{#K;Nm@=Ub7QLtim2+w zy5i>do&C8=sl@5E_kjNKKjL=9`42v;Nba})G9y`uP;kH!`!U`*65Uu7s=#JIZs^^< z-Kk0Q9GG&TyL`#jk;?}m#Y?j1@XM}6#^{gOTY$ko@r4`-N_qnNSDrKtE0amH5pJ&3 z<>=hS<)?mctv#!L%8q8hmujo`Dey93n9tQQ|B!WPgub9|g)SEh-=W?sC1U+F0Dy@G z?uuuUz3Re5hNPg-Vwa1{kBcsxgUOo4RwLD>D-S!$i_0k^gE>5U6YWD!>I=>@lCD!; zTuRWcqxag2h8r6=qfxXkj)T&}Qd|JnBv4Gp-89G*2Tv_7PL-0JL!GhM zT%I6D!*yGQY}FK}henBF!%sh!EzQD0x69%7#9D{R3RhQ*D+Q)U=FowL1W-o{C)C|8 zD1^X|vP;>KXc10&I8LlOu+a@x2Mswi`C{P_1_|9U$8UXle5XDg7mJRb@pS8dTxPHJ z(~@u}_p9EG1Yj|^&uYMmi+t7J^JJgoG2R$hLlNrWlizwN{LCLr^%+(r#wH+Z2)fn&@IC<>ZghazlH~F zvA1|qK`uw%K0UB(*)Z^T&wE~}64$EJ9!el$%R->r$P+PuIb+3JsOM?a5AnKRDnf_i zFN-nhU>16nil&BcH-|e>-x(daVLaQ*hOa%D^(jCBbjCxCTe!(vq|U*ZS=;+LB0v5# zpN@o>fEsjz%gBa`HNaWl)|&8FTki*U&wgK;E^tN!mJ+*R9u{B$L1Ef1I2-kjASF|F zsSJGcH_+~Tu=4n%W_P9qwum?tc72?YK;(4PR_n#YGsF*15RfP|lz6&G8yfuj#(sph z6xtI76W=c>&dSk5(hwsD+V<6?053=?p9a>?#{0N7sfC8l`-YO)dOhIdxJf5yeWj($ z;jMWcfloHnSWO9{eJSSN27T(IV@2n?u)eXh4q6;c5vP=StYi~f%rJk#k)sY z#*7~&*@r~2VVAF=uS2u3ukKH89`|i-kW@8#f&p%OZ;8Mq`^{n;*rbDY=&h7P$qB5a zo`N3Wxw6zO;fYRM=gGCH0l!SVNlJ-kKAXQsogUu8(iL@^ znJxM3s-m?uvCr5mj7-N~aeAuU z$RXH;OI^>i2t@JyivhNY>VKEyQHU2v6d;oKjEp$f;H{8-pOTy)2a1YrWxFl>c>g=myo;dxPaBY1MFBDYa|cot4H4XfgovtR^?*KDn z8^Ry8o`%jB#g(k7SV zms!0xP5NHqmQ)o5m61}T*!6WKjx*~vt20rP_<4CS2-q3hx);9XeO~v(hdhZK!p|;V zxm`GXsz*80ZL)fGuEl7w!AdLqEe;+RVJG#D+nZPJG4TJ9`Mj?Q=1NVjw?eWX$p2s~ zI1Z~xkfGGB0bPQ2%Y34!a&hS=(s$i+wQ(EaS^+7ct)V40#2)TdKn~nha87UvQcA-r zAwOrNwMD3=7RIxy-@C6=7^}6|2zaK?g!AsBV6$DJ2wZKeM^#_`KB13i1f^zs!>cef zAfLSML9h|UY@n~)_~M3hd$U>mie6M2IJYC(eE)z%9ve|u10Hq_!I%DEzl*zD?iXac z$j~QtNG)EkehhK2%5yW3fq03XLaMyJd-5NyFU*a z3$qb$zB%~Qo(AEh!q>x!j|qPt?i2p{?|;I2!D|~p4zElKI9m?el1Eb#=c9kikUa-Cd7OKv{C^)FelS@5dxOoa(&X5}#+-q8Tjh zu7_4!J3Lfefj&~iKP7ZS@tNrR%98-x8uU`j&njFT6kVUO z9v?@N|H5?eCUZ^2Oz|Em8vrkG`unm-z{{S9P8@A2EFO<4Jec#%*qp>-h`E6y8VK~0 zYEhO2I`RjNxP0tbWx?~lo&lo4nmQeO+gJj2spI|iTx~|v;)P9RYg%IehwaQ7Sm{pd zqV}`Mq95PI`TR^)DG`}2Ss+Hz+_D17JJe@~92z$i{01ldFI{e#Ab7~Fke!j~t#}el z-n7|n9Cql=8TjMvU|w|kC}mB-PfPZy-Vj@XZ&A70L@;=2+E**GkK=|pJ;17t>XcTx zkz_*siK|>q+M%B08Z#`(ujt}&s`rjAe~(NnY9&;$;dBDJbYIlaJ;M0Cy-dd+7tiFq zExZ_+cJ_)6A_Qvx7DPk)T4nq4bl{}kL6!eL9A}jGd_n}^gr`7sYri5M#G#BWi|#Z% zrkA|Gs4UZ|N)>r8ts;D-{vSJ2&O|e@A<|K&GlGTeagAmVT4f#b&5wel;-hGmLB1|1 zkiJmC{!rZ}ex8C`-zIp$$c%8DWOhcJNO#ZM;wOiLNkjSga@g2ZD%H??eOjGt0*y7PI9Q7Y{$yL7`dTHR% zh9<#TI#Zbo8el#NDLg@$p|H?A5y1^{Yq!GG2O31aI7Dwaj6;mic648m< ztHOBwy!Ns}bZ2tl1mJ7R3`5862FS>tPJ~adS&X}0eaI9wRpN_4lz4?r(6H}J#h9y+EU&BcKKk7l=>D(f64IolE2D zIv6ISF5~0w`bi(&Ic>*uV7nPr4LeEegXeR9VEyM`Qq`x({^PB9>if3#J;Xl-R1{3A zu_z_qnPr87YCSHnAnbwC+RFX+TQs+~Ym;FU2DJ$c+Q)GsB}!`S`S z#Hi8ayXaGX@Raa)I%6iaEyj;R2dWoy2gkYCEKlFEQ@_pLqvpqi7S#8IVMF>G-;}2C z3Peljo4yA-UIT{+y_G!O1HyfqDm2m$T9% zUiIkv>y&wT`Wrl4ibW{G-3Q?)3l_NKYw_p*VDQST#kQnfb|&MdTWP$AZZwTQq#O7C zo(uP~Ud1~byUvDw%MAy)8u&KWIasI?QxPId${r#aGj8Po4r0`woMYWkdH#?zX4U6d zXA&OX_jRJcGE#Kn*1pzO7LAEiDo#>t4*5?3nh3jTOn4v0hl9f7?jL|r2IKJN3=V5PN2yPt(Xnfg$?%l5hG|#uEfdKV%$6M za^`$+NT&O#J>m*Zsm!9XCu`B0S8PFl-D;_rXK}h!mX;XZP#D`BDy7Gl;YG<8N)Acp z2YbttS(*jD0Wj#ATUXg=(JfxlVyRP5oom5-w6H>JVwdjT>Mi-6grK8w2CwgA^&E5^ zUvC`Q6}Gi~zastE^&=wh7h#LdCwrR0ndK!B^R$?47Y46~DOK76oipn)^PX-OH2E0Q zKcRcNTopea9%M&Tgu{dK0u7aADES+HcB264;)i)XVPOGpgWELHd1ac2J0)7p#HFcx zT1Go6V{`TW$M_T8&OmRl({{l$>Uq^K(OLn;#RhbCi` zSck5E9o_kfX#Kdj>dEtg*+d}sFAbtR+ufh)A^OSDR%{z*ca7ISDY`y<2s1{b zofm#Fx|7@G5#EX`^;#62K!cAECCd?IP|W;r&C#zNi(60EDVEIL!Ako;lMsQ^~P%LQKFD?X+QOpG+b*9PeE2@N>H zj`Wo3cMTRcM4^jdLHpMsuvZ46+&a<;B-oTVv~g(msMU^=R!s@pd2#vCcBt*LPoKk|MY zv~pLX|Em5Wi93KaaJ=;RA`FPoyg!|bmc)HEm7(7#`rvF)}T!)j4ln9pBvuv z=voy+eE+SdeHS-T=n1d=aqgp+<0?lr#34Y+Ngc1Q;Q@d~Hc<2cs)leZ{c)WBjo2+{ zAY2=XREG`G@{1OJ-d(uayyM+2TwCM|hiSn*nX5*ff7Igug)0GeGpZx;0@!VnwbxZ~ z!ssZsvo|0PQcl}UoHQdE#`1P(QLeBjM7|!|x+a_U@qpUcnlgc#+3nzjxK%rCAOf#u zD5CA2Znq439&{={DpRyQnTBkG_U*U*hok(udXyNZ?=CYmDnIR{Utr~1VnPuNpHsui zu2`WI!kE03Hd}f8P4#Kn=9$qh2?IH9WAd{Hxyk%h^Eh`}5v z_k)Ox*<8#d?ci9hpwlfiRY9Sk2I*r&QN#_}jew-ijQAOmUGe(BO0c~mD(`Iwt`&n# z^V)j7Xbkp=&%S>mQ~2hPI-%L&Zg)!BEHA}2K3<$(;S+z@w2P!p?%zhD<`q(p9U*>0?p0%{_Xzb?iPboU+aiB&bzUFJxTu`93M2t*SrW#sTGSp=JEZw& zZ9mO?Sf2Q*_K%B|jv5Z#O9@$1*wV(5Es+#w?vS*y8lKo`Fxm&8NCUk8CM=)QWw!^= z3=Z?M8NZnUfo15ew-e99;O3S^AVOJqlu>(#lK@-D@2AYu7~y4Q%}Sf?7f%CCh#CR1 zQP^#Qrms1Py(5Z=DOzGx{1QfLKrg~R(|)1|O+h+-I*;+%le$LcD%^A| zFDxVP3@wHX33^8sh`g3nvRt_UG-Dp`w&ARfKG!J5kIMCWKd_SbNXTux3ysO_O3ner zZ5FaR)ysMNA)#Xs)-Z+gw4k@(=KoQ{TLK;uXvM`mmm$W5|H?CvQqCNTQXs1zbzw}i zEZjLW8aJr;%&?39o_pMCW=2R!t5KHOs5=NmmbBI==JthI>cN>*pVV}@#W7W{vM13A z$Uxo=rA>ysC*)@*Zh75YVXibx)ipC*w?x0@Ijj1Sn|Z#)S6#Q|b3*R(t-T}1rF3cpRbW{+xdoN(WDhBy z0kZ&k6@yiLpa`sC2Vcn&H@_xvBixqy_hD8^`9%>= zXC4_&W5i9#fNy4I4ogu?W`qHHiD`9yOnmD8@u0zIBSMcO722e0B$}ozS&hefII_Ms zK{~S6Pb^$8B9v|mq1Ga9C$1_%8)~$W!#E?*WaE+F2r!7kGTdMp>8U13+@*-TwKz-#c z(iyjgYJQPUj$AAeVsV6~XmN=Mu3FZc>Z+ywU!x|iV_vPJLf02v082vTpGr2HAmKRU zf9XJIEaPpd?=i2ZTyAdenSdA?LY3UvKSpkQ!N= zr`lHLs+GA$dAugQ{USQ^*k=4&Wl+)Sm&3ZtmVr5cp3>O^Am6!4WKc#l0>V3eSqV{% z+_;p|)KM!ApN&=_N2j@71wCHwGR>F^yP0NbO=HsAM+`vA@y6? z*kR^EVnq&7TE6nzuYdktGneY1+n#J^kus0(8*o*MIl`mQtz`xCQEI%olaGQ+Ct{VU zesR`$CPg_1U9T=X+!TP^ewQIN(jMExdTl31)Pml3Oc|*$huI!!7a2}mL&nTQE|IBx zP0GkmE=nQx(W=SKd9kszsF>0T(AKP>vuPJ@l7&s6-pg00b5*xJnHmU(ugNX4;<5XAYM7M0iCK-7fGG`S=?_ zdaOMPl2yq+PM+MJ4_oYV9ve(bXKr)EUY6GF*$Q48#F)_!0kN8rFl`0`G2Qcj)8QJI zLoqtkdc^f?{KV24)(TZjRC8(8=6X*wcMg~57Kt>^GM(%emcux_|4uu}tLGZ|U20xl zU9El40dEZwe1#WK581pf%_q-0 zJIb4W(_uEoWM|i^Y}!$3_f4xfmd&zqT~-KJdk^W89U5|8ca)TLTq=XSn#d(nxgA;( zhhVH$#ZggqzTv5jO+PEff|Rq5>#)CjDhJ3E`erZ_rxH(o(B-=1fD8R~J@8GwPV zo#5qMmwNnu*jj+FGHY}$Pwn84f}&AQc;(6diyd#FaL1{1M!Fu~(R+!x^nDF`0g45J zTMZ2#f#MNh6Y;lP7830oV0J-s7U;H?IiH#%Nx!64Mm|YvolL#cV>>kh-%5=LI#|k# zub!c+;WMSmXjC}doqqP@!zn3fS-6L1bD-gC-xkEqUQp6B`zCr!i;DLQIdvA+Yy{p@ zr^VKs+#7Tm)>BZXPmn7m2ruQtSK|d{FCP9YJ>1`)Tx;{a90g9yKIkvD`8M3$-NldW z*tKIIbhe%SGLNxcZ}-!yvzs$~Hg+W`R^#MLHJCgX{QLaAZ2jrN_pBuG>i1U=>MSQM z=>cioh*n1AS)y+uknqup^D?CMHc5l3a&&Y|{*U8M zC~^FaRKq++g2%r}(Z|PMeR#y$aqw5>U}epknwm;YdKW{&t9HJ|h=9;O+@9RoT|Ioj z_UQY}oZ%rqJf2tA*sXkQS)<$bba#jv)+1kvS9!}(b#~h-*RYC)ju23Zk9bIWKJ0B- zcsBghAv`F!=?!I18U2flh)@-D<0$+Z0Rh4DdnY0SLRHlNZ~u21__@skCK-TJR=vhY zKnSq>f4dbyhwjl4pwVN84-&ZboZ4`dn6P^FoE~E7!0mxESd5$sB5T;{r8;G!F|B6M zXU2w(fdT*8hCEhN-B94B7?4I_jvFn-$yRf~yzGg^KfXlJn8_(eL_!A$+c6Mu582?P_uLPILA~@g@ zKe0Erx>_Dh%>CzNqi3nkJ_#h03I4=ifKJR+)Y78AV{hQM*xM;lw#|$Iy9lW}_x?&y1`E+@cR|p8RCkMJ^ySr9j*4qtlK}HF3lJHyP z0N5k_2@)^;pb7)#!k7N#dPVRSZLCa@3N7d#3F3PMgx_4QP3g_e%>dbawS)St{|ugA zrC8&i*HK+3`&o&n5DEfxbVC`cL3ORYZ~1~FbSnv9PSVs>g%%4}L3_c9 zhzj0Bk(%LM6ET=lvqWmGPI`}LM{e%nayGfbNS0aM9j|g-n5zIo zKq+W!y}%mX0I**}AU7bU89r=dV<|P*rtFA7=dIEW2pm+Q{QL& Date: Tue, 10 May 2016 13:06:33 +1000 Subject: [PATCH 220/439] merge content into troubleshoot onboarding topic --- ...ows-defender-advanced-threat-protection.md | 261 +++++++++--------- 1 file changed, 128 insertions(+), 133 deletions(-) diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index 4dd8fa04df..efb7cee306 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -9,7 +9,7 @@ ms.sitesec: library author: iaanw --- -# Troubleshoot Windows Defender Advanced Threat Protection onboarding issues +# Troubleshoot Windows Defender Advanced Threat Protection onboarding issues two **Applies to:** @@ -19,128 +19,197 @@ author: iaanw You might need to troubleshoot the onboarding process if you encounter issues. +## Endpoints not reporting to the service correctly +If you have completed the endpoint onboarding process and don't see endpoints in the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) after 20 minutes, it might indicate an endpoint onboarding or a connectivity problem. +Go through the following verification topics to address this issue: +- [Ensure that the endpoint is onboarded successfully](#Ensure-that-the-endpoint-is-onboarded-successfully) +- [Ensure that the Windows Defender ATP service is enabled](#Ensure-that-the-Windows-Defender-ATP-service-is-enabled) +- [Ensure that the telemetry and diagnostics service is enabled](#Ensure-that-the-telemetry-and-diagnostics-service-is-enabled) +- [Ensure that the Windows Defender ATP endpoint has internet connection](#Ensure-that-the-Windows-Defender-ATP-endpoint-has-internet-connection) +### Ensure that the endpoint is onboarded successfully +If the endpoints aren't reporting correctly, you might need to check that the Windows Defender Advanced Threat Protection service was successfully onboarded on the endpoint. +**Check the onboarding state in Registry**: +1. Click **Start**. +2. Type **Run**. +3. From the **Run** dialog box, type **regedit** and press **Enter**. +4. In the **Registry Editor** navigate to the Status key under **HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Advanced Threat Protection**. +5. Check that the **OnboardingState** value is set to **1**. + ![Image of OnboardingState status in Registry Editor](images/onboardingstate.png) + If the **OnboardingState** value is not set to **1**, follow the instructions on **Identifying and addressing onboarding issues**. +**Identifying and addressing onboarding errors**: +1. Click **Start**. +2. Type **Event Viewer**. +3. In **Event Viewer**, browse to the **Application and Services Logs\Microsoft\Windows\SENSE** directory. +4. Click the **Operational** log. +5. In the **Action** pane, click **Filter Current log**. +6. Select **Critical**, **Warning**, and **Error**, then click **OK**. + ![Image of Event Viewer log filter](images/filter-log.png) +7. Review the remaining events which can indicate issues and troubleshoot them based on the corresponding solutions from the following table: +Event ID | Message | Resolution steps +:---|:---|:--- +5 | Windows Advanced Threat Protection service failed to connect to the server at _variable_ | Ensure that the Windows Defender ATP endpoint has internet access. +6 | Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: _variable_ | Run the onboarding script again. +7 | Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: _variable_ | Ensure that the Windows Defender ATP endpoint has internet access, then run the onboarding script again. +15 | Windows Advanced Threat Protection cannot start command channel with URL: _variable_ | Ensure that the Windows Defender ATP endpoint has internet access. +### Ensure that the Windows Defender ATP service is enabled +If the endpoints aren't reporting correctly, you might need to check that the Windows 10 Windows Defender Advanced Threat Protection service is enabled on the endpoint. +**Check the startup type from the command line**: +1. Open an elevated command-line prompt on the endpoint: + a. Click **Start** and type **cmd**. + b. Right-click **Command prompt** and select **Run as administrator**. +2. Enter the following command and press **Enter**: + ``` + sc qc sense + ``` + If the the service is running, then the result should look like the following screenshot: + ![Result of the sq query sense command](images/sc-query-sense-autostart.png) +3. If the service **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**: + ``` + sc config sense start=auto + ``` +4. A success message is displayed. Verify the change by entering the following command and press **Enter**: + ``` + sc qc sense + ``` +**Check that the service is running from the command line**: +1. Open an elevated command-line prompt on the endpoint: + a. Click **Start** and type **cmd**. + b. Right-click **Command prompt** and select **Run as administrator**. +2. Enter the following command and press **Enter**: + ``` + sc query sense + ``` + If the service is running, the result should look like the following screenshot: + + ![Result of the sc query sense command](images/sc-query-sense-running.png) + +3. If the service **STATE** is not set to **RUNNING**, then you'll need to enter the following command and press **Enter**: + ``` + sc start sense + ``` +4. A success message is displayed. Verify the change by entering the following command and press **Enter**: + ``` + sc qc sense + ``` +### Ensure that telemetry and diagnostics service is enabled +If the endpoints aren't reporting correctly, you might need to check that the Windows 10 telemetry and diagnostics service is enabled on the endpoint. The service may have been disabled by other programs or user configuration changes. +You will need to check the startup type and verify that the service is running. +There are two ways to check the startup type for the service: from the command line or in the services console. +**Check the startup type from the command line**: +1. Open an elevated command-line prompt on the endpoint: + a. Click **Start** and type **cmd**. + b. Right-click **Command prompt** and select **Run as administrator**. +2. Enter the following command and press **Enter**: + ``` + sc qc diagtrack + ``` + If the service is enabled, then the result should look like the following screenshot: + + ![Result of the sc query command for diagtrack](images/windefatp-sc-qc-diagtrack.png) +4. If the **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**: + ``` + sc config diagtrack start=auto + ``` +5. A success message is displayed. Verify the change by entering the following command and press **Enter**: + ``` + sc qc diagtrack + ``` + +**Check the startup type in the services console**: +1. Open the services console: + a. Click **Start** and type **services**. + b. Press **Enter** to open the console. +2. Scroll through the list of services until you find **Connected User Experiences and Telemetry**. +3. Check the **Startup type** column - the service should be set as **Automatic**. +**ASK ALON HOW SET TO AUTOMATIC IF IT'S NOT SET FROM THE CONSOLE.** +**Check that the service is running from the command line**: +1. Open an elevated command-line prompt on the endpoint: + a. Click **Start** and type **cmd**. + b. Right-click **Command prompt** and select **Run as administrator**. +2. Enter the following command and press **Enter**: + ``` + sc query diagtrack + ``` + If the service is running, the result should look like the following screenshot: + + ![Result of the sc query command for sc query diagtrack](images/windefatp-sc-query-diagtrack.png) +3. If the service **STATE** is not set to **RUNNING**, then you'll need to enter the following command and press **Enter**: + ``` + sc start diagtrack + ``` +4. A success message is displayed. Verify the change by entering the following command and press **Enter**: + ``` + sc query diagtrack + ``` +### Ensure that the Windows Defender ATP endpoint has internet connection +The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to be able to report telemetry and communicate with the Windows Defender ATP service. +WinHTTP is independent of the Internet browsing proxy settings and other user context applications and must be able to detect the proxy servers that are available in your particular environment. +To ensure that sensor has service connectivity, follow the steps described in the [Verify client connectivity to Windows Defender ATP service URLs](configure-proxy-internet-windows-defender-advanced-threat-protection.md#verify-client-connectivity-to-windows-defender-atp-service-urls) topic. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +If the verification fails and your environment is using a proxy to connect to the internet, then follow the steps described in [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) topic. @@ -173,80 +242,6 @@ Log in to the application in the Azure Management Portal again: 3. Go to the [Azure Management Portal](https://manage.windowsazure.com/) and navigate to your directory. You will see the **Windows ATP Service** application in the **Applications** section again. -## Ensure that the telemetry and diagnostics service is enabled - -If the endpoints aren't reporting correctly, you might need to check that the Windows 10 telemetry and diagnostics service is enabled on the endpoint. The service may have been disabled by other programs or user configuration changes. - -There are two ways to check the startup type for the service: from the command line or in the services console. - -**Check the startup type from the command line:** - -1. Open an elevated command-line prompt on the endpoint: - - a. Click **Start** and type **cmd**. - - b. Right-click **Command prompt** and select **Run as administrator**. - - ![Window Start menu pointing to Run as administrator](images/run-as-admin.png) - -2. Enter the following command and press **Enter**. - - ``` - sc qc query diagtrack - ``` - -3. If the service is enabled, it will be set to automatically start. The result should look like the following: - - ![Result of the sc query command for diagtrack](images/windefatp-sc-query.png) - - ``` - SERVICE_NAME: diagtrack - TYPE : 10 WIN32_OWN_PROCESS - START_TYPE : 2 AUTO_START - ERROR_CONTROL : 1 NORMAL - BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k utcsvc - LOAD_ORDER_GROUP : - TAG : 0 - DISPLAY_NAME : Connected User Experiences and Telemetry - DEPENDENCIES : RpcSs - SERVICE_START_NAME : LocalSystem - ``` - -**Check the startup type in the services console:** - -1. Open the services console: - - a. Click **Start** and type **services**. Press **Enter** to open the console. - -2. Scroll through the list of services until you find **Connected User Experiences and Telemetry**. - -3. Check the **Startup type** column - the service should be set as **Automatic**. - - -If the service is not set for automatic startup, you will need to set it. - -**Set the service to automatically start:** Naama: Should we also include instructions for doing this in the services console? I can write that up. - -1. Open an elevated command-line prompt on the endpoint: - - a. Click **Start** and type **cmd**. - - b. Right-click **Command prompt** and select **Run as administrator**. - - ![Window Start menu pointing to Run as administrator](images/run-as-admin.png) - -2. Enter the following command and press the **Enter**. - - ``` - sc config diagtrack start=auto - ``` - -3. You will receive a success message. Confirm the change by typing **```sc qc query diagtrack```** and press **Enter**. - -4. Now attempt to [onboard the endpoint](onboard-configure-windows-defender-advanced-threat-protection.md#onboard-endpoints-and-set-up-the-windows-defender-atp-user-access). - -For more information about the telemetry service used in Windows 10, see **Manage your telemetry settings** at the [Configure telemetry and other settings in your organization](https://technet.microsoft.com/itpro/windows/manage/disconnect-your-organization-from-microsoft#bkmk-utc) topic. - ## Review events and errors on endpoints with Event Viewer From b5a18f4348904bbe9f1169c0a47dd5fc1c3cfa62 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 10 May 2016 13:07:23 +1000 Subject: [PATCH 221/439] remove duplicate troubleshoot onboarding topic --- windows/keep-secure/TOC.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 8e71d063ac..29887bde01 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -410,7 +410,6 @@ ##### [Additional configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md) ##### [Monitor onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) ##### [Troubleshoot onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) -##### [Troubleshoot onboarding - updated](other-troubleshooting.md) #### [Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) #### [Portal overview](portal-overview-windows-defender-advanced-threat-protection.md) #### [Use the Windows Defender ATP portal](use-windows-defender-advanced-threat-protection.md) From a77ca0e0b0bc72c07952dbbb3d1854c8b760171b Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 10 May 2016 13:12:35 +1000 Subject: [PATCH 222/439] shorten header of a topic --- ...-internet-windows-defender-advanced-threat-protection.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md index 6d1e74276c..2df5b585fd 100644 --- a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md @@ -24,11 +24,13 @@ The embedded Windows Defender ATP sensor runs in system context using the LocalS The WinHTTP configuration setting is independent of the Windows Internet (WinINet) internet browsing proxy settings and can only discover a proxy server by using the following discovery methods: -- Configure Web Proxy Auto Detect (WPAD) settings in the environment and configure Windows to automatically detect the proxy server through Policy or the local Windows settings +- Configure Web Proxy Auto Detect (WPAD) settings and configure Windows to automatically detect the proxy server - Configure the proxy server manually using Netsh -## Configure Web Proxy Auto Detect (WPAD) settings in the environment and configure Windows to automatically detect the proxy server through Policy or the local Windows settings +## Configure Web Proxy Auto Detect (WPAD) settings and proxy server + +Configure WPAD in the environment and configure Windows to automatically detect the proxy server through Policy or the local Windows settings. Enable the **Automatically detect settings** option in the Windows Proxy settings so that WinHTTP can use the WPAD feature to locate a proxy server. From 878e5090369af3173bb2c1510ab18916f089ab90 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 10 May 2016 13:26:15 +1000 Subject: [PATCH 223/439] update title to remove "two", edit question to Alon --- ...arding-windows-defender-advanced-threat-protection.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index efb7cee306..2f6f60f97c 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -6,10 +6,10 @@ search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library -author: iaanw +author: mjcaparas --- -# Troubleshoot Windows Defender Advanced Threat Protection onboarding issues two +# Troubleshoot Windows Defender Advanced Threat Protection onboarding issues **Applies to:** @@ -27,7 +27,7 @@ Go through the following verification topics to address this issue: - [Ensure that the endpoint is onboarded successfully](#Ensure-that-the-endpoint-is-onboarded-successfully) - [Ensure that the Windows Defender ATP service is enabled](#Ensure-that-the-Windows-Defender-ATP-service-is-enabled) -- [Ensure that the telemetry and diagnostics service is enabled](#Ensure-that-the-telemetry-and-diagnostics-service-is-enabled) +- [Ensure that telemetry and diagnostics service is enabled](#Ensure-that-telemetry-and-diagnostics-service-is-enabled) - [Ensure that the Windows Defender ATP endpoint has internet connection](#Ensure-that-the-Windows-Defender-ATP-endpoint-has-internet-connection) @@ -75,6 +75,7 @@ Event ID | Message | Resolution steps 7 | Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: _variable_ | Ensure that the Windows Defender ATP endpoint has internet access, then run the onboarding script again. 15 | Windows Advanced Threat Protection cannot start command channel with URL: _variable_ | Ensure that the Windows Defender ATP endpoint has internet access. + ### Ensure that the Windows Defender ATP service is enabled If the endpoints aren't reporting correctly, you might need to check that the Windows 10 Windows Defender Advanced Threat Protection service is enabled on the endpoint. @@ -173,7 +174,7 @@ There are two ways to check the startup type for the service: from the command l 3. Check the **Startup type** column - the service should be set as **Automatic**. -**ASK ALON HOW SET TO AUTOMATIC IF IT'S NOT SET FROM THE CONSOLE.** +**ASK ALON HOW SET TO AUTOMATIC FROM THE CONSOLE.** **Check that the service is running from the command line**: From af13a6cf74d4091e748bc00f3faf9f92a59d802a Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 10 May 2016 13:40:05 +1000 Subject: [PATCH 224/439] update portal URL to https://securitycenter.windows.com --- ...ows-defender-advanced-threat-protection.md | 8 ++-- ...ows-defender-advanced-threat-protection.md | 1 - ...ows-defender-advanced-threat-protection.md | 2 +- ...ows-defender-advanced-threat-protection.md | 4 +- ...ows-defender-advanced-threat-protection.md | 2 +- ...ows-defender-advanced-threat-protection.md | 4 +- ...ows-defender-advanced-threat-protection.md | 43 +++++++++---------- ...ows-defender-advanced-threat-protection.md | 4 +- 8 files changed, 33 insertions(+), 35 deletions(-) diff --git a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md index 332166ff68..4f5cf021ce 100644 --- a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md @@ -21,15 +21,15 @@ You can use a Group Policy (GP) configuration package or an automated script to ## Configure with System Center Configuration Manager (SCCM) -1. Open the SCCM configuration package .zip file (*WindowsATPOnboardingPackage_ConfigurationManager.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://seville.windows.com): +1. Open the SCCM configuration package .zip file (*WindowsATPOnboardingPackage_ConfigurationManager.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): a. Click **Client onboarding** on the **Navigation pane**. - b. Select **SCCM**, click **Download package**, and save the .zip file. + b. Select **SCCM**, click **Download package**, and save the .zip file. 2. Copy the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. -3. Import the configuration package by following the steps in the [How to Create Packages and Programs in Configuration Manager](https://technet.microsoft.com/en-us/library/gg682112.aspx#BKMK_Import) topic. +3. Import the configuration package by following the steps in the [How to Create Packages and Programs in Configuration Manager](https://technet.microsoft.com/en-us/library/gg682112.aspx#BKMK_Import) topic. 4. Deploy the package by following the steps in the [How to Deploy Packages and Programs in Configuration Manager](https://technet.microsoft.com/en-us/library/gg682178.aspx) topic. @@ -41,7 +41,7 @@ Using the GP configuration package ensures your endpoints will be correctly conf > **Note**   To use GP updates to deploy the package, you must be on Windows Server 2008 R2 or later. The endpoints must be running Windows 10 TAP. -1. Open the GP configuration package .zip file (*WindowsATPOnboardingPackage_GroupPolicy.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://seville.windows.com): +1. Open the GP configuration package .zip file (*WindowsATPOnboardingPackage_GroupPolicy.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): a. Click **Client onboarding** on the **Navigation pane**. diff --git a/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md index c97bdab3d6..37d117a5d1 100644 --- a/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md @@ -6,7 +6,6 @@ search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library -author: DulceMV --- # Windows Defender ATP data storage and privacy diff --git a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md index bfd6beddb3..45afdb8c1b 100644 --- a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -22,7 +22,7 @@ There are some minimum requirements for onboarding your network and endpoints. ### Network and data storage and configuration requirements Your organization must use Azure Active Directory (AAD) to manage users. AAD is used during -service onboarding to manage user-based access to the [Windows Defender ATP portal](https://seville.windows.com/). +service onboarding to manage user-based access to the [Windows Defender ATP portal](https://securitycenter.windows.com/). From 341cc38d504fc1748848c7513b48b5ba8e0dcfdf Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 10 May 2016 16:45:36 +1000 Subject: [PATCH 227/439] remove value prop image, expand APT word --- ...lerts-queue-windows-defender-advanced-threat-protection.md | 4 ++-- .../windows-defender-advanced-threat-protection.md | 4 +--- 2 files changed, 3 insertions(+), 5 deletions(-) diff --git a/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md b/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md index ed73779e04..b6f5c0c088 100644 --- a/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md @@ -45,7 +45,7 @@ There are three mechanisms to pivot the queue against: 2. Filter alerts by their **Severity** by opening the drop-down menu in the **Filter by** field and selecting one or more of the check boxes: - - High (Red) - Threats often associated with APT. These alerts pose a high risk due to the severity of the damage they might inflict on endpoints. + - High (Red) - Threats often associated with advanced persistent threat (APT). These alerts pose a high risk due to the severity of the damage they might inflict on endpoints. - Medium (Orange) - Threats considered to be abnormal or suspicious in nature such as anomalous registry modifications and loading of executable files. - Low (Yellow) - Threats associated with prevalent malware and hack-tools that pose a lower risk to endpoints. @@ -67,4 +67,4 @@ There are three mechanisms to pivot the queue against: - [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) - [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md) - [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) -- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) \ No newline at end of file +- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/windows-defender-advanced-threat-protection.md b/windows/keep-secure/windows-defender-advanced-threat-protection.md index e7ae541fd7..19fecb3e08 100644 --- a/windows/keep-secure/windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/windows-defender-advanced-threat-protection.md @@ -59,8 +59,6 @@ antimalware products. Windows Defender ATP leverages Microsoft technology and expertise to detect sophisticated cyber-attacks, providing: -![Image to show the protection service that Windows Defender ATP provides](images/value-prop.png) - - Behavior-based, cloud-powered, advanced attack detection Finds the attacks that made it past all other defenses (post breach detection),provides actionable, correlated alerts for known and unknown adversaries trying to hide their activities on endpoints. @@ -69,7 +67,7 @@ detect sophisticated cyber-attacks, providing: Easily investigate the scope of breach or suspected behaviors on any machine through a rich machine timeline. File, URLs, and network connection inventory across the network. Gain additional insight using deep collection and analysis (“detonation”) for any file or URLs. -- Built in threat intel knowledge base +- Built in unique threat intelligence knowledge base Unparalleled threat optics provides actor details and intent context for every threat intel-based detection – combining first and third-party intelligence sources. From e9612c333f8c7406b55c208ff13fce2b2d983d0c Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 10 May 2016 17:06:12 +1000 Subject: [PATCH 228/439] update scope of breach to add more data --- windows/keep-secure/images/alert-details.png | Bin 52295 -> 74297 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/keep-secure/images/alert-details.png b/windows/keep-secure/images/alert-details.png index d762e722a03b2a96dc2c6b6030ad78bc8ad0a300..8048f85371b962e2fef640fd9cb060593c6e40ea 100644 GIT binary patch delta 36748 zcmc$GWmHw&*RP6#(g>0VP*4!*KD0;+a% z!`cMbm7~lwmnGUW%VavU-e}$C&i2Vgt$AnjlBa#8r;c37yZwkOy@LP?i(!|ih$|1l zzl)iCGaIQG z?)|^L0R7KA=Ku7RE~ui=<-k;oW*Z+h-K00zeWm$^Bu{9-hvU~bM{(5W>20EN3Dh?a zUy5q{H(!AM??x@8HML%x`t$L}(2ZbUK>Ju6oFcu!?usHk=OUPdFEy-|#qPX={+pMR zrnVMpLWoZ*$>aP;8b!gHsCTSmZ&XfN%qg^2JKA23jq$+Dc@Cf*&I-XRWgNxupS7qt z8rIiT66}uCDa04)A9gG`45+NI=2KZ^#*-0+SN(g(Y)$1CEwxvOp75R8*NPoWBpKD; z3RZ*dv*$L5586AJ=@ZJ0Ex=3CyBr>LSTc}Ux?5q?pSMfQKytDj0Vb?g*5B8We^9U7 zV{H#bI|?4#Uh*wy+o?AM>Z}I;F>yWgwf9_Zd&R1KQ+mPLz(O*{so#)LS*BUP6HF2_ zH;h^vnu(6u_uEaz%$n81AI{IQ#xwhfDczP1Wp#9Jd`?=Q^p)Z^=n6I3WS&%psrLD_zZ*-FLV`9{AOGK0tnmxHiMsRJ zf}7-ugXLq?W{P6ppSBLrJce;|bJv%Dq*c`BXsz|WLGlP*^{bFfSBRK0^3|I|wDc3g zL-yt@(*xOxDveg#60}uof>$H<`8CCN6cdUJw$T?4Sa{Mk`(ifS-~Mp<(^HW@!#`sB z7rnBOv8g=bN1lt_t_+X1<@0O1HO1o*iF;7_eCW0}j>d%2_22A-@u9%%n|FdIv;J;B zh>Nn2hJ*#TK$vqJ&0Vjv4BiPrC%^r#G(G0V1$#%==*>PhoR0qU@~gF#DNk6HPk!Tl zbNz@m^j@T=OoCfb)unLXwd20$P=P!>11m$l1%^bwE-kZaeN<^k7TK_a6$W*=TmDK? zs44^N5^V}KRZT=|w4DM^h4z*%bksXJ;T)J_Fl&|`0 zLlaUj70n6h`(&$k{se(f_g&jL(aTise6>q#)(Thvw<_+SDsGKx-IGI27o&R{Zf$)T z>q*ptCx`5a7q_oz^={l?R!ePmlJMseoVvR)+zDaR8C6T_KXhI!KDKcn=DqEAOY zE+>gkrJfsaNJ8x+h;XQ)BErJuv^3?Mr`VCQ|M`z)%}wE+s*I-1+!nmt>z^O$LyjDW zG)s2_OfvN5rXP`fcna^Sx;bve4Ak*Rw?5{IEWG`LxGco_7|A_%AO4CGgco7m_M>Bh zz(~<61#1nq-m%eyLsAu>>Gk`Ox%yduw|xk;)pvg~i4EVs(2^DfA7ZKXM@Rk(oi5HH zZI3cl&GzRS7=S%dX&d7 z<)+@C3eB`6Z@7G4dyt-A*f>0|e9gsrwaD-z-7UIeZ0JqH-fZ+yg*k&rlinl6v^qG+ zU<1-j+wBkk$4CF{@V;WEzSr|hyayI1vay=hr2nK@vX#OWf*n+FY3vIAlQ|#v6wv;2 zi7-a;e@~_$|NZx-*JfL0MoPiy&zt2qZJ4ymu z44o3J0cuS`(lSYrWt2~hhvevoPL}LqCKh(}Upuncs}LUe>oE;Ba<*aXo2Un4Y;01C zii=A|f!!2Fab;P-rEY|5E7PH|^jo_*8O!@7FpsHbPefD- zw3Z3)cnk~sMZ#egI+Yk_Zm@mISwFtK!HAc~Id!&V>KdEvc-!OI)~xcMX3WmX8M9^E zse`Gk-|3k6sXO%RWt`c~;S1>R;hoomr1xs9j^@yJ=kz{^y?MXcY286a&SSR6DKlWF zw9|k;JYW-+9u%(G6rS#Vzd#FZ=c7-{HN>`G;eyCuEVT(gl^`aFQp*0qOtTW8=NuIu zC86+vJe?rk#K>r5qqi6^p;O34qgxu4>)Sr%q^@Iv__ zlU-&_9eq-%$TNi3{M3YEvkAU{#me5j@4wSXzi=9sHqQ6>^08lAnfq;xYNc+59ma9r zTb*QbGa&xHgugH)+&%q*b^FX;{qiMM6W@TsrVG6eKPgT6@K0tMnv8g>0HP?{wiR20 zfWS>GbTTTc#vS_Z<~R2P-M`+)E!l(cX9O&eMMG z1pke_EwPe?po5e!RGj;1HuILq^g{1C9ahs&M@jrGj5>qZ_1Z)D&hJWpxBw}X{hT*O zr26NlXI3$mCV_l!1)3vqu}2b;T2+6*kR1V5>$6F1%nVK+w=d3}#KQ94uZExNiGjR^ z8*UofU9IH4bHA&~a`g<_e$LWXYnY@*nkrnIkX7#MN0oFHh5vC1`y!AAX31OA@#qBNKuVWSZckY%F| zrsm}3AKvp&XIhVKcM-!6wZ1OMkuTwTZEP6lTi|$7dyRHvTt!Mr*O)$hXi^!O_d^9S zbH+azySE$~db~9=(UH->E+^U;sH47U;7dk7cT1BeX2B5glDh2| zmc1zj^?af#?Iz8PxJUon({~F}UX)|%~v#H6+579Abkrf%+QPMUjnZP!YRahWX+ z;nU!tpfCo^X&O5*aTv zuCFU=Xvj)P+!M~&H;8x)I9w$t>(Z}qaB=N6ho4MOPfN?n8XT?m#Ky*Ia>I+%N+6%y zT)NuY+Um=_I))c7Y8!n6_+1c}3+t=8EM^gGmO^xl)ClhP?~J^9%McFzi85^ZpO?$R zJ?PzLvv`T<$BfuuCDMmezuqp=(5xgFQxZh^k-}hxeeuloC*vBV0WCk?{Zy;?_$V$e zZi0(nOIf+K)gP-!#1QSUkuKSNx(2%XCFQdEtHSVn@PPH^RHzbWcKI}q<72I&^HHQV zjy58^$|PuG9^UtBUAVELFno|gJr#t7A9eb_&D7Y_gJ{Oa#~(GL;Vm9M-Q!!L9mupK zbwVb&5|ONN1`~zk4z#8l9gf^w2Bsq8M3yJsCxjR0!3PF>VcQWZGZavses0E?KMOep zx=RkU_3v?~ z`ON)%7TOb9cTQJG3S(cO^nC3FMv;{{t@f&cyFu)l?8uhD6f~65fcwXtR&ZHnMJ>lPM0GpY9uVRx~~y=ZVO`#0-Zbp1 zWND-h*R8~mNlJbVdGd-_9xdC>uwxfbVTa-UaXa3y+_A|kZhf@Qx`1V)8qg9s;UA=K z)0avL)d@7GLPv5=W2yHx45?n&(*Lau4eG8?8YYfXDlzE7B_}6WYxLmD$;sheO+4Nh zYFhQ?i8s=7hL?1(r029h&NC(FdkJUmzIMjdi>T&3aMhaS6iUfi!?)Zu+CKDpElXc! z`~yRf4yxnr?$`8n#yw>(>mSlBj$DZke2vv8fd9m35^7&_G`Nd%6goT0KH9e254%R_ zekvHajoh+*aXhNd$&8~jgI|>KCr4n>@I8-Tn!*T7DSrv8>}TrsP{f-Va{b3$Qd*d5 z3{-m>slB7nLUZcas5&{ta*cM(@1^HX85q`YSAf!F;17V2$BP!-&jTsED|R*Kvm3$* z!#q)aP)=T6OnUlt)I`B)8La{aDQ+OUcNDd)0e+Pn&zRFv#3aJCxy3+s#Kl#SSA;KF za`E>q6=TD)PO8=8BFAHsNcl`BcTVdXWyFOh#${!)oPs@j9+y8N6Mw;yi!4NJ(#piE zF(o1LuL>uQeu@2r3EX0t@$VZxQu;roO7E6Tpd{Yjp@j!}$;2h_-_*NHQlg>iqbgg$ zYO#t6OV@HFMb_pfdw(qke>;_B&vtlj;g;63yx4G6fB&`05v0IZ``t80!4;L2M}q?U z0M%F!GpT*vu^TK~rX%I?NT{&RI~OE1PK`2It+biJIa=oVAch`U)NSIG>)W$+dz@Pm z>i*fi?9G9PJ##*NMP;nuq*7h_DI_r=^_75PC#8j1B*!Y7+MCU_Gb{UOW8aIG=XvN% zUWXBPh>hC6r#M)(yAI|v<>uBt=V?QpOZ&w)lD1gj-540LqkcBG^f>#u@0ihdhf3UE+fGLm>JZiSPlnd5MtBubwM@yj86d?5-g;VXDvxog zEOqzt&3Ln@2*~Ia()c^#nKjgE?4GIQDabqVB@|yM9`P=mLz{iIX&$U<#H8rhsg_Uh zle<)Jmf3~*_o&vwady>I=*paOeSU!SpYn6f5S6qX1zeAw);aC!4rx}x zM*0vZMMz4atG0x{!D^GzLp_vF4AJ1~_Nq_fGd}|ymn{ZrO<~{RO4n4CHFXA}-=w>@ z_q7wBYHV_p?8nX%%N3hV$yXq02%+l5z@I;V;0~Mk<`ad_n3#3_l3su)y0gBjZ6DLfg>XU325~PC{2^qwzST3 zjwJs6{yi*GKqQ+5@@Ujgx69os21Z7M-dKhn7BH5fChF)ix^1L6clY$@9WHnLdwCXh znShed&M!Tk>V2VR(vC8UnLYyr5dj75?OC1f&Gj{$&4*@URD(D5ph3+cSdFQ(Zojc_ zxg+%O^6I}Hs|*H`wOD9O`}^17#fulwTA;9YSLXuAzLCc77_z=@Y}IsiYM20+Hpd== zY3Ti1OE!sV0?ws&Yp+ukO#YqL8JO1HPvB~FMus9}YinC73uc>y4=($~#}j|}@IkFa zU*g}3Y~Z4mU9Q>D_2qt<2g0r*3>8Y6dzMitv*|+a-GhU<<>g#cIpC_?bMV@{C5?^3 zAo?J0x&AwX4Qd4anJVkN($Z*9cK?03B~X@Uza}RqL-+6A=}+Nh{dWjy)DW32f`fZ= zb>9mMJB>$YJ^^k{v#FyNl`{M*Tk6oQK`xD-``^3OPgv-vA^=t%$ct*M(v2)E41HJ0Q>%CRuSp+3sJm$docF%g*K3X<0OXjx zg&H<^eEhweyL-)AyvDy#mKQ}0proSGR_}Uj1Bd;yw5z#azA)Pn!X5t*<(ergDMkIW zvR33^1j1A!^_{u81jO-%0jcCak*_fWvzD{zilpvZvs3!;AsO5a^be~SsM{0Gl0i}X z3}W|BgzQGarb%kXrQ{d?`0>TPd-wk9d4QgAh)U29M8No3vm`?Q>)m8TH4J_DT@D`e z@$s#$tv&l^$|=!4mECuVu+hK&{5hIE4mN1CG`Q~$zs=$;1Oj1bY)n^21cBJ3#G`H` zynol!!s4wpkVB-S!QPQ$t8?B5s|(ib-$k=iv42{33mh@?dl(ncw_J&DshvtU`ji?}I4QeV(gxR#8&&p4gUmVtDWi zvZHJ|tbm|w(`koPS|$;D2Wn>z1oio{)~Mu~%hJoBh|i(RsiDzzWUEpXci#5Pn|!fO zRDVRanhMc}A6ko;=PgIPBEBSyY4jCq+kq3B{Bof7dgcLiSFqHEKBm^zd3ALu0{iux zQ#nuj-{@c%FIgfNL~b6^dd9jSZjhLc%v#NlARi~DPIpI9bPI*?Sl6w6+|pf(uvS6p zF$6BZK!6!eGMALa><4|5zWDcE9{h1d!tovXVR-W_;c&||J-QSpW0J47-VH zqO}uWn|S+|E<~qOdDi7ml$Of~HgQV6KWqI>L;WrZH-Z-(PWB05BphNvH!!F4$4w6D z3Q-YnXrJFF!1Ci`*EMj;jJeMasF)Y>pbHx zW|dp12ru{>XZ(hrXw}6Y^H~689U6@>6m}7RpIPtu5clCFEYTaVTIN$xWvBsuKA+2y!kD;e`R2U8v~O*6zR z5fZ|cO=IDf@=vA!)YnV=!;P3a6(-MvPuce_V&SbFo`=Z%{+reT`|d0Wk|0Ecn$?$z zia1@i?o>YeXsy?;a?WS59Wz#?wS=}R`=;rbLNCS@!dx2(s=^%t`KTNYWiiMULoQvrZx>BwHTGL$m#f=}3xjRD63U6(YG zG*3_adSCC5~rwN_rV9Udmx z=-2i0W=d3z9*7B5E~&!cnuDzQ;Iw_Ybijb-clU=6lU^UqCRkb8 z&yeBzxvaSaNu-nNX~HbF3~aw=pyjm@k<{{eaLGMIkKbw*4Kw|nmB}eC)jcr6m&9~0 z2*bs``)hYO8*^wt_Emk2Nut1e#VlshToHVunG#V<%&hW``dRIrFZB5OuPa0Sa}d~R zJIjHd=#g=7_^<&)!2N_+$eE?2TB6(7Kq)6f;#QkdqYjDwI*~xvDSGwEDYkOSeLs19 z%o%_T(m|qttLo?|G7)Fj*9(G!^?QB)`UzCk)pv82M)Lf0Do7*YnS5Jw5Qgiq0MxpV z432?3_IP`$Hz^0Bw$}QbjSdTF(Ng8@kA4^2tB!OyhO+0bV&lIaBGj!$cG3Nv9(T0N zZV9h%p!&J=+$PvK>Hpc&fUQ51m=>Z0VYUyDy^?O`BUchaHiP#)%64F(%bREhuE?i z)qg8=*@7mvJJ`5t8NmpVK9zF!QyNd0nvi(=Wx6u=D)E}WvSVX&Ht+3XBwd9<-BA63 zNo=G?#%whara#dY_9gs-|CN{@~qs54;y z<{}46|3uJkrVTcE?b&!xQ-&N1z3DITCp6ew(yDV}H|izg;N*irffPO~#p6$y$w z5E|60ZJsD>NKq>hhIRyX=*xV21GIw``DWJ9HDg0k^mrpLhn53;w81-#$X4|0FFz8x z_G=pdg{buHQOy+6+;@3S&717 zWn5Xzgn>qSw-ee6T~gJ!d}ynDx~`8NVZQdtU==wbZCF6EG}Su1j>f$D>$Er9ldoQO z;3C+=vX+d4hesGJe&7GqU0+ckQrr)06Q_wf7O~kA6K5he*qyGp1)<3E3iVCm^|coV z2S>CkCJ4}kgs27`PaUOO@_EmKpqQ=`i|`py2pa3rZ!PEHvr%3|!@Ea4g$K21!k)>Q znVIaDHpu|93=iW|Qc^lNIX%QiAF6U`*Js~x5@29paB0vMq{7oKB1!1;?^|m%E+YsQ zpDZ^cbaZr#jfdh#hKD~HsjvJI^A8HT|J<}sd}DB<>1tWb0`3rIsS#-~x$~730dwY? zUoN^q7&jplhM)%L%tQ5yB*`B$y-RF^%WGs*2(p-smavphn~x5vEd(>b+}=HZby zSCfz21}=R)u6DJ(%#|=%_c4$DLX5cwo$=2BBSB%Q)X7Rqig)kc@gf77!M=^46p+-> zq5l5;yIc~7e{}T2S*x=y>r~xbGY&yPkH&)bQYH%?0jIXdRG|-pUPX*bO0+=O9^Vy0 zvM5}y1guLoDKa*)!=KyYQg7+0nxvN9e$FDhmSF7meQKdiaj3KVZ_PQ<0vwx8b*`>H z_c}LehQZu+p62g*0^eImi^imqw3B*$?>Sw2nozT+gw{M$z~x0JJ8*Ylo0D{L`PAeo z@T%Er<7~g1&aE28Q3lA-(zW;&vc^)CbQK+Dx@PuNBJSPg1+yixP<)xMuW#*fpdsxJ?pI4G{WjsBF zz}^`A{q+34SlS&(Q+HjtBKMRr7G`E!B2$E5`&EbjW9kl6dwMJB_vO9s<3g#s7Hpeq8Gf~CDP*FZlJ0h~X2-w1&K_Fj=P%M~j z=*)*d+zNZc&zrUf5jG%;J3>cYt^DQ}+sGWU>T65FSCY2!kHlTBudJ@!lTvOjrpPqO zsNU!LyLeqbK4b1SKAtbDU$#H=x0{2%py40}s6NcLt*vcmvc%VYuZDi9i$gvJ4Fh-h z_iw+UjcmYsMn*>11yoOb?qRXXA4l_5;-uiXt1bi`Tj4=?cm~rJnp+n2+Vrw{U)lM( z^ks;5tZ|eRGZZBPVnQCWa!b8pVs$tg_tsulH6EeZG>Kd?DCz20IFVwY;9+1Lc)Wl< z<;v2F342@cqP?OiV}F0kc=s!58C{NY+**!vX^JEB?Tdg^7Yrs?4a4e;+-X(%&zaJ} ztM=d#c6?gsPo=5DlscPGTFxVu#e$&qeneZ|n_7GXlq@}T$T2K=+oeiVd zt$?l>8y6Rql9Ezv0P;wSF9skNw4gS`F{(zVrKJ_GgcH}zMa*6Qn!#N8G_XW-QY!G^ z>N^8m7`AzRAC1lR*p$Lk%PGQt4%un>9cgL~;VsM(x9-4<=Y0gNxY3YTg^%%=hiGaG zg3l;fyv#CN8V7uC>a1q*|2=kmwIX!w>H4c_DA)`uMd$ zJB>)!z)?P2#2i;oebHvp6h7I}giV&89HZcD5*GFrugbU%(Gu^pm(TKL?=5eNiHi#t z)Fsi+l^DBkbb8nI=zCDNI3RQ!0b^rh>~MH@GPn6dr?8c-Nc-~xJ+OvA{xEulb``D< zhdKPFUX4>-&<{DA?Jm}PsWZw>e!*FI&}pJqg>7u~^-Zkx%KSrWe=6T1!&;Z3XRpSw zMX>DC@K25l=#?4z9hGZ;BtBy&`Mw3AH*` zSfFEVY$!!-(6KFMcNv>F%DhPVK%<81>jINZ9|5w171uq>Bzz_;SYa$<;JN5{ufSEN1qhC{2~L)ZK#Y3t95@`&CZ z9PIZSt!|a$jBqy0Dkt`)jk0Q5M=lKf=?%3)I`BWgUM!P-9g-4@r#;wvT6~ekdOJjD zW5lZEDeJu$miqJz$Gs-AYX~oJMr&61xOLdQ6T|YL5f2x!gnVB1S~<~Cz2mzXi}LN_ zGPhj1J46Iz=0xR2uZmN|ED${zM=lmPx{`4*6wvWki#J3>h~je5^LiLM?^3HE=ezo2dT`v*4bHPenLhCr)VPaeQStw%c7 zme&r`+USAV)B?(uq;J%@BYVcq!lpz%0pe;tU$l7>!-js)pt=WCQp)1XK zp6>;o-vh8z^Yuw@p0}48_0bup0PUrllsjJIt;Arc);NxSXVI=?C!Vpgz`loSun|G1 zMmaC;L8QC82**b0$)iZU1Yc8f_#A`^<#|7btRnlTYkPF zut+AV4)3E>1`6wXQ2;0KgwMac0@^?~PA-8Z*{D}-PWYTBI&R-nR#sn~0;j{lb(VQb z4r%$aV_69*r@wx#9x`+b8Viy#jyz?TfVLg!`=KH0X}(tC4LiN0>a~YM(jo3eT* z%6Oa{%&$D3WJ%Pl){2Q^hqmbXZXMet@=v*r+0WKFvjP<MDEF>rJmHODW$hWjq^-jW)m5^CZ+GKT?rGSg`!o6{q|pm!*F4?XhkcUoE83} z3f>9sY*XwIY1^)IDZE28nKPozidJYKtFSV37foBZiOZLImv@Vzl%0XQAKJxc+dsXd zAAVIok=&Df#OCO!WH+kSFWqn?AAWhdn_W^8Rbf7{Y^QaDCUwWV8NpX#U9(2q+uJLA zSOJ=%qJ9~vB`n#N<*x3bI1Vg7^%=?L3VCCHwH-PPjM8)rA z4m(>lyqRp>tt5!-B;$EJrso^fbC^!*lozhwgw|Jlz;F5YR0=L&q4ar|Zd8w*wBn%7 zLOh!;el!9r^djQE9(Ksct_wC=o0V=daey8{=!~>2g~OSYDRrgv8TmQPi9=|(UqzX7}yPQi;(XAL5SoV4tXs>;iYf$Mi`eJG=7 z>jI^g!+}mjVQ6X^G@%1g7EScgMhe;u6j1H%?(R&L1=_&-!50QrRz;f}@Om8NC|UOt zr^(;}Q1#g@r@4q(wLRo#%FD}b{%$IvV_+n4n-c?1_5oCg(&8m!d@7~y0O$%78(QYh|7`QO#OI}{!BgXe{ z-oE8pcGJ?*0_PfC*#^9f^ zpRDRs!Qz{nn~NX-8sZ>8+}2OhyJo zs~`iy6)g_5aI`3CKi+v4w2Yy^wk6%0>#JGl<|;uD-x#b>ON(f2U7eYgm9ehwt&AZl zCnp|tb#-i9+)}eqI$)?2Pg#7;&5ceUD~RbM%^;n)VgjSDETnyE|E^ZOo<}9!~lr|4vGz2?m1EG_DOVHoIe8e5CM(ANi(ooN3MAlkvAHa4aQ1fYZIdNpM%FY5y! z$NHd873frErl!qY@~>rOA=|n+Rjnql7l8FMm@XvCMVQ8fM#Y)9L@k9_K)8l4T^-nUW27fe^XDB|wer_I)&shH3G zlqnFGk_P`io9BfCC|%AyM|gQ>=H}+v1qI%HYD_&0l3=)QWX)19soTvSqLfz#OnbOY}QJB5{Vm zv6`O#08V~z*9tJG;y~u7m`6u-yiTlxFx|NIRpVo$Pc?c9fbE(io1m z0t6c~pw3?wuz|TfdJ_pT{avn3CTt-%Y}S5Ah>*n)jY+-K516{z(3PW4%c7&D#)l8R zppf)~xT6f%nMzCAhrv(3DWlN#SHK12w)XbcD<-tFtE&?M{RFf3OXjtv02heXx)gQ!y;zVZSesf+eW~* zA3w5y={2G49{%RJ!`zH}gZBF(?Ez50CV}&84eV8V%w4bm92clpFf}#R1q(3ix{(GJ zfp%(b_6-&Z%h%%K&o~r39?PC!2On)_M@GlQv@sUdw|b*tNR|MbngH>XsQlTMLWVFj z0IbfM{l?2gL07xdKA8{{kxowT1=jCn@R=SdI_Ue@05vQJI3%h%o^h3xmA@EKC95#h zr}F7LdwWieN{gkvx_vr&ditrgr(;0c69uIOoV$y+m!NlRx$$x@J3l{+S);PpenTPa z*XHwgC=qz#wWvn)dOwuJX)#&s4dmCWT)e4UJSpJ-$Dn$p$SEj9POg9a_~CNUfU9dGNcR@8uIQeuV{q&aC(OYAwKD7kRDLJ@*5E}2+ZjKT4R!EHXF7KMz{_>GoUxE^VC=?z6k2==evlP^sc*l2~!`qH8$ zd;XFcy6j}z3vw!OS+zMHzTG=y)4=n4&SYm_E7ab9y0-X3Y^&-%^7#WL1+F-LYM`A9Ye&}{3yFud06f#D50 zCae;HEDan`F?Dq^fQ96o_zaTuNM{`QjACo z!6~t#rRI?7^MRSG`pP9H`g*G{-7o~F@_k;Z$&rV;>Io@pQwpuNXc;)lDloOS+g@Hz zC6!7-p$uni6?grh=-1RS4aHWfB$qAesKYX1|^;nN5I)!bnIIu+s zb+uioD>are%ekfdj_aMbaU+P#xirNMUk%qG67daZwr>W{ZmvYme?@Aqo6fZFWO{;b z44WEFCaqe~rVxe&^!R+unrP64WS~yV{n`WK2L(v*e9;%kS|ye*wYRav~%AvNuiWnCUj{KP^#TmBQI*yDY)-&7F z@)jhSFjZ1q&zwJQ<<9O>QRQEoZ}cHudb&w;1wu-%UtA%7z2Y77*G^B*kZ9+qwujWI zhUP^cm`I5%6qzlB*TP4S1z`odCK~Rs>Jr+ok+`^N1%ITOiT*!Y_5MNxF)fo?|KGfKQq zUHHtt(z)GIp75g8_6~b<5Mcxv_Ke&uA0@05%6eR1%?uoqcG(DlcF;!52E%~OmN6x` z-|D|LBi5EkOp5DkqZ&lLhg*z{@HiS>!S-KXO?=4}VCEdXbxRR?4GU~*5&L<()c^Q~ z{jO}8#Uys~Cs+|0+rj0|UBZJ*(2pA3cHIRb!9QEZ3g=S}2Hs=zSbM@h0==O{I~$=o zS6Z(FG=dTe)|ZTOz|7yK!EJqj`g*YFi??i71BzO;%9}UMK(y)U>jRvI`$-oYwl8om zUobL~!5|o_Z506dMF6Ql_336WO5mIAXu8=xGu;Vi8=jZc+LifeZa#GLdyJRORMO09 zSARUKWA!{W!NU5CUmD9F@qXZO;B?k3J8S4Db3?t`({A-V-yv4{6$^L2Wiu~3eRc&L z(zhfvu4P`IrE6nC{^E5$%O?%Dq(j7LPSQZ=X$@`l)8u*fk6(K}ZvC3rk@q;?6 z9G)VzVT`{+x$Kf5(Qm^hGO;La9{Y)mo_nk%UryjjUt8)!dgk3W7dwx)x#rjaJk?i! zP~gcoKUcW;7X|YC@s~+u7C};cwBO$db^dxp-*nkUByu2;D{#j!VeXZY%xU#Lw2P{u z;k@&U>F#?^SXo)8*1|M^dcU*Klp#gsx*E_=q_0j4E~E;&MuS!xfQ`O=`zEb6+!PSv zvcd}a7g4`hRD||byKN7noXFeQ*n$qOo38job~KtJn@*a#sh$+!N-c}y_;PL3Y)^_< zL@!t99Bwy!Bcl)So)A8Q9C=spOPFYW!JX^hIN6rdUP8Igfhwu4E>Lex0focoBuGmj=64lm?+P{xoUhtiujFGWRf z1BQSKaHPmJlvrI2FD)zU>FH_Nb&{%&zJdF6&qryOTxlPXxG{D_Ou}8to*rCmDu9{AYsizfG#xYTsHYc(}pT^ER4TE zLL6P>#8fI=bZi>hC`dE8?>OUnigCkxn!SIJLBa0|T_E;3xLg;{917IS0wyQb0F-D9 z%GmB6A43}3-=h?|4Zn=$Nn+FMjEn9v7`o=kMnB)o174T#`63#X=U*j3sv$}dNKp|l zPazG}Cq6i+0K>%q>jr~3a-Sm&~Vhd>3 z7PCx#M__%`pCp6!Siy-%vU|Kh14SLLkqGBik0#`NHgcX7w|KEcCXoeux`lWiGJj+n zld+s|gW%`1$2g7AP*M^FJRP)JgnpzH&WI$WSFl-be*j38EgaU~*$LXt#3d!ssUk5# z*T#v%*|B{K3k!eZs!r9razenMd`gFVpr`~OovzuYbdzB#?BiP6*@V)lAuZ3f@bx0p z-@$o*?~$O#IUBt~YIQbem>-i>t_Z>e*+sF?U^pa0JkGLO-V{JB*!YPW*=OhVlj|g6 z%&{(76{Sr1HWGJgNUGE!Le88Cf6AymD?(EHQqtRTx z=Qc_HjBC)#%|AN0qyY~S=z{~(ue5SWzK*zN`GgBZ*bI$A?OAzrT8^;Imw=r1cZO4_ z18mF!O|0dqhu)2O;B(D_y_hvQHZN}fJbvM#PRDMD1OmSXnJ6&|%@(2UlyxW$V zt*Q(vK9qbY03uxedqyDsc_7vj@cewH2r8l802~UJosuptb3mlAK`&udewt3h zp|c0sG5(F?#T$?7#WiZ<%4JO6qv_J7yov(?FuUc!j2?<6*Uv2@)EmbLwJIx0K*^qg z&-B_~4(wN%kM-Oi#x$K(Sq!>|?<0GFKGM|5xX=jHtGU?JRG7Yj0W{U%enwfteq;MPP!eTmg~78;dP_oKjC75Q75b+#x_|e9neE`HQzmB2Cyag#fX!lwXp)8{O~}R zUA(4&hvdAL!lkp3=q>n9u=Kx_f4hMHp(g{N+;Odba=7v;~js zqxnXG&Q+M|jUqjCak-H5l-^BfMV_Agd`L)vc&M)RZy2){a&wd?ogr9nV2>(Y9mQ%Nz!~`PU4xDJ7Nv>WxOK7e}~1K|E_mwjLnast$Uqj zE~4|LDFBu{S?g$CE*nf9)8n_x0V&eSJvG8MLRS9@V|iihu=RA0Qt#l5^@iQrTEx?T z9GjfH_B;G{3u{$H$Vzvp*Sf1E&Q=v@kqwz-6EwGF>3(M|LB z*9V3)+#|94Ctbh#R=5kmr>JyS(s{1SYD0OfgDS_Z=I6&c1u*Jv-*FnCOSBGsOLBJVXQO7o!@L9_h{{x!nF7FwAE?F-TRe)57svdEckbu<`jW< zKYQoIbm0f2OMem=sdP9h(s63W(lY$$LRy|UzlCnx;=BHO|GI#Nfgg|>!HMq@I-AXo zqs}&*t+oZCZV*VapJQSOckTAzK#c_`GB`34!!6KQEuSaa*Nd(79QkRkXEjSE^$(j0 z%v^sZW!uGY#NNZx(EYO`g`x`8QL(OH9Pb1)vCM2!W~IZ6Fj$7yG$p-rbi(C6SBEou zKl-V#OqwttXOHnS`HlA9Xk|@rrO+I@}9LV z->K4LJZwpx#v|8v@HZ*>k7Tud2ZEJiU7n=kbPAq_`p4^T!npj2iwDP%8Umzdm`b+L zq^xsb2Ej_I#nha;cx!Y-pg|#F>srgy7MvwWaFa%=Lkqk3SpaxYDK?%AD9sL4u{Kel9bRSOX$}7Hh0KMu2L_x z;U&iTvJJ@qgMxzJE7*~Si<#5Io2v@iur%(}OEInfg5xqaA!*faId_WBWJw#~k6>7Z z`JBpg)aRZ5DqGN3S-#T?9nwZyFHTDBQ@73fhZe(ce5r-m*~I=-TF!vBE6@+~Y&vK5 zBmj>Zh>Y%V(1M&T6&c~g2RXl0P#83FKMJpp{{_^w>P5FjJm9_62!-NE@N`t9|(%Y6O=@H#~t8u@aoGkG;xq4)_is6!u zrw5@cPo`TJWkQz-M39$-bfm^UZ}!7brKiipV>xrQUHMd1; z!gpFnJ{2AXNT>>=rZ&k+ToTMf3v0EgAaL%vkExhS5vpf{*iXaO&!@|u6CI!MOH_*Q z{40mCRZ>u|Iw#}y0X7sC-ZHMY+$3M7l(<1N7W>+bExvz=IQ^ue^tzlRPo#g-0%IuQ z*)n^Z_voC58%J|J!V$bzGh;#V*RryV%EH;IB{n9 z_nbUcX%#}QVDuqe`bf$z2WF)!ANaS{AN*l;F+FWgiQfeUyw`G za6>{iSxWs{lksW?n1iT63v^24OVi3g|nM9&f-zzDP!D`YQt);9%@oLHfy^%KrW$3A34CJhhUBa)8c?*dv<8g^uCE#E z1vc)d32kf;@TADA$uHu0LP9PYy9&_(3D~tFpFp=l`ehaQbJ;TRrx38;`!bvSrO=ua z#SSI2cD|J{_d0&Y&MISp0@5knsnXpY8>FP9 zySuyY+J4`;Kkgl8j5F@JB~z28{xv(|c^`OG=rYa?nZs<80z<``{{uHhe!{Y5kY z{=4~pOIv@_N49i54KdnllsGT0@I|XQ3{I0|E=NeYhLU|>4we;s^72Jb_V%MI16gFK zHtSnWL4pj)}xd>&BJD!#B-Z_CsQ2{HTxcESuKQ_SV(=rwZ zRS>$ADXEQt8$#h_e!j73lu|fN1kswFS~;FdP|_?@U=Ea%7Mw)uMZAW_4s#+Fx0t>f z_j3@~EI;r&?MS*@dis#)%cBSQuTm32D^Pj1*dN691UbG|m*&4MX%3`o?t|)SLtg1~ z-_{fowd$|7+t?7_{0#mE_r~Z7ng0=v$+cyXlSbdumFnYj+7?OVc;cInwE40IUy#qU zKrz3}kHHO68hLBf^>}3o9tK0tKt4k}i8@qxkT_pMVwtaph^_?(_Mx7EU3 zo$S9yp3?L2`ug}pE_4-3oEX){#^QsP(>PG60`xIxts21AOTQR|F9t$A?DJ7aILpG4 zp?D|MU;b>AJwN5;OKa(U<9Km{T$pc*bAuPs#cbV@%zx}FIM(=t%8jYA{Auw^;D6B> zG;iV;>PJhZ`)Nn_d`9kL4^1AU)?HRu2&uVIXnQj_e{?j( zxibO;$K)$Z)>UIGqG1i@m8?uN{Z=Oq0}j~<#}+8)a2H9KnhEbzn|$RdOZD&Gi+-X9 zwP_VK2^QK8i<0*5${WKK-(XZj^Ku?`o&DGMEg42VURp|lt{CV=(bCgP>z9L$9K{;w zUWrODJ$s;NBha=aWfO(tf=_5Q7Z^N0a2JnV!kOpKj9iYc(N3pWHm0neL7hm`T~Pt$ z4x+4#C)U4D)eLp&2i7;+EJ57cc4)0Ca z&K6WZx28S!^TuV*G-2E}ilfk>+TJCle^0HhPwOPcT)-?edb4 zgN06#&{&;i1bA&mPn~~eWO$F{szfFwk<@36xI^S2XK5MPNyy|x{n0$m#+rhx849t< zW(%r0{zDG=XLp%eZkQ@AWQZq5JF}JfLxYOvKCvoBE$eN4#V>K!ygH2Wh_FDR&#mhr zO!!jWkl=7^^fEVrXW{F7^YG&oC7%Z;9Y@(&uuCY$F|BT-9wIGh=S zdhH?Bg6F<_>zHQ5nAzE}XQs}AQtOs3HCIcB)eFzBwmLXCM^`2&&SLrw4G%_qD`tm5 zO{~%yMX!yq&}?>gcFCtvCSME!ugUEO%2gmVte(_hq@_2}?ljO_DpGwK^xQ!geKA0w zhhS$(QX0w8mSL8dNW!enJCOr*pVdeK8`@ej;w6Y#NbRtf3`$NZz#*g91jBR-xX3l^BcT`bICLnUADi9gRt?qG}h)x;%RuIjkP`umX5 z7**rPfiKR4OzKinj!V@|dZDpgiMW_^;YQIYMwv7hsW%zC+hu1hm!1sCJ^-uQ=AS}w|v)wc^peqQEzm zN#^)7fi_T|K$s$g>QgLs5;=n$dWPLpkaXz)E(<;@TR5s;O{ZM3T?xG;EF{4XT|bWH zWeCsfvakn*Z+sFkz&Mhgahd~vX%yOZTIoZ_uk5GSXa#>d~1oa2&n*8(@%OOY@ z>527n>Y!5PnIfh#U|TGnd_hXopGd(?j%@VIdGEd#hihxqG+zHJY$@Ep`>ibB3krZB zb8Z3^Z2O&$Y5^QhFj_32WjONWZGi9eNlPYlwvk(i-~*GOPP)5&GGmL3*si?paeVvY*#dXt z`6C3{L{CpYfe;vD@Bw%_-eHMJ1;CMjM+ExNG_1vt`zPHt-m_`cK`A?R3VU`>{~q#U z0URqGQ1jU*G_ydlLVU@|VV;vol3o@%%y5fhRp4v^bTF?GR)b5JioYAA%YoQ(A5I3) z)Yhx>!{W(H?ZW&nGb70_+G%or-x%ONw4CA3xT|g$9zJ}CXi`gr5bKVyxU*9Od@u*2 zK#Y8Jxych*Nm&_zZ+X;CWK0PemBtMYDgc}Z>H@kW);JUxb3GWdS81v4c%Tc2Fw_8L z|4L7s=&-qO-y5<~T# z#b!Yahds6dYjflZ7;3m%fy4p;G6Vn(E(KH$!7yHM zeD8R#ljj3~a|=Y`yfzC6j1@pxH1f$Z;7^%!q(|H0K8yJn3n)lCys?Dvw{1Z>f&u|! zFpqS=cmd5ZAlCuSz|q8^iOpjL6%`5a5J86<;FzF&4+tmQ+JSu-EVS~ZtAW$5Xnv16 zf|v~2zCIaXTCV^xpx+*VGdwyP31~F`9GMXuSO>%z07lthTdJUkqy~IILIqFoEh`fM z-vpSB0MisG6EyY#X3odYzkluqz|n=pMbM)pXJ==hXzciGgpUGn^`+iQp{7V)!rIpM zLKVw}f$qm0bVFa5%|iJ)04_RoMxi}3#foG6J<(&hD>l#Y38fYBi8PUq!s zDw0xCX<+dM*gc?hDd&D`YZLRug2?264j9wV8_Ht*v?uFQk zX8|XLoO7xSxCn(=={Y*#hMa!+gvlp?uC{q^yO&~-U2Q-s-whxs0xt7d++x5+@J9k; zJqIM}tB3u<#=uwr3DNFMOiZK~npr&@7#AXqN|4+Dhn*Lr#s8E=9ItF{xKVcusAV!_Q7oX8T>aCPNJR7#;j7cYR| ze&DZ(KvVTcIc4ZKsR5wM@dCF3&|GL@!FY&{PQYtx0H%aT9tca&CIHmlG?TxQ{yDI> z%&Lz5IC5oWWepO8o1~Q@h>z(+CJe;`U%B&uXy){! z2&d?_`WD+Pz7e`UQoQnj5En?r&z}GWl*?*{cpJe05QWxQX!5#x9v6-1!`d{0E)YMe>m||#h8*yw9qNRr2xUj9UC)*L3DMgdpGRXpQ z`RbJm$1eW_*ykMZ@n8M@#xr%!h+d@QjI-aX=a0ds$vQz_7hrDk!q*%Vh>8!x>EVPU zE6AM|LxtsDzrG7-Ua9rFt*bKx!@wP41F9k(K0uW0G@(*&?4%5}23(y- zbbydoEdrR6Y9P7D5K!(vkrnBk2C>?gp4JE$Fy|k&goHz@d?mcECnK zY+}1-pVAKZ;8$}HvquQObEhG*RxfQR>m}ArbWYCF)S$E6Xqn=Oh4CK~<6V>tKgUtW z_ZsmnU(a&MHg_=xL;R!gyBSA-zY}r_xRDspmN4o|?3yV5gcu(*G&B%!=>~w11sYZ} z&Z{IVeM!=Cefd5UL<3q-5FZ@h<0Nu-vAX952Z9bJiTRyS3Lcl$@?R@)eUX$bW`Efy z=IHvhHAzHIk9bK{)NKIQ$j#R~N(t{2->6PdB)-P0?9|>awWIs@Qxl70n^aC2x%fba z91&@iFyD~p7RvP4iZX6zT?ESKd37~94}NfYGl#gM@#V=7>%k|nGh2xkR3&1Mo}pH= zUMN8C#SB;!0R$ACl+?R6kfBy;^awD>+RT+DtJH%@1qneI0~rz`76Gl-ajA|bFnFvA za3^W|y0=c91UM!Nen%2N+-q;ZJ@J!KQn`1&-Nkyfy78uGyqII;!iI`p^5kMXBB==@ zBU00dwmOOA>MAoX=NB;#vGUf<;}4LwgLTp5+%_|xvrS&oZFROMT03dYM4eJj$IyWO zyIGv<2Kpv=3TMfvW$X0%Vq2`()6mL2Zcg2m&=Q-qLl)+qo=l#RX9KG;Vq)nMQc{+k zU(m3@ghYsI@qJO+W_kevfOsnEm6nK^;JB2?l;izMp8hyLADBpJLI*={?OgGcb2bl9 z6Y>nQ+I31lqQRP)vmfs>;R!oAJqR^KrIVCe%5rA?65{ZF@{Z2jqn02kI=50D6nb(m zChRyo^}4Xi-VIqSj;Q^(S{L27SAmrj zw(BUEQp_gAH+v^P-i63^t0?<{hDOZKrEJ+(7OXmsv+gl~EeD#dWr+C`1<)(t*`)@W zi=Y1FA(o1AyliZbb&U%aL2{D4;QKF^5&E?olg|2f zs9BMMZ3(SkFpxiuHIZ>WAe>{BvG-|-6@C2R%f255~oK)yGCpt2c)B@#h$0-a63GexXX0eX6RvBHoL4h~Ko;CTVfGn?Dl-lRt|2}FOB z*f_4Y7b>jX_nU`)Ub^u;YaELYpVMv1O@#0T5kGVc3Cd30&yd{m$Luh={4TIUNjKE| z^%<>=XfMy_o*-2LOm^H{?{r<1byi)yX|AVJC|&#Y!Ot**)1I^YVrmmj_TR$~$C0iW z!ni@Qva$l;;j%0HQ_0;Oo#UJ&VyJ}bV2a8~U!RgI$7eP!ye(Yb^}FzN*X=$mGC8J& zQWOWc#i9W3xN17UO++Pg3j-|hgv?ATKnl*#j1W^ZHKhYwb%b^eG!zt+m0{{u@!RHR zBnj!%pdWU>Q&S>k$dWrXPS^GWV8^UkbTALOGl5sW8ILzlvf0YevDPEH0J zK3HD`T{-M_Hw9s0mJ`+Wo}#_?rnqkA(vA+fjXOH_4;F3eZwS$FbCqnuj`{*y6 zm!iegep3WnA5o+Y39|x;p;&Xjg6DXvlpO>6UeX?#1kyHHo-ZSN^0S!+gb%MS=X#ef|O2+Ra*1`j|3y$!Cd z|8#>0>?7?(x~0X_Xc>_6)ba+GkkUC1Ccl&+clZ@fzK(usphAN*Pw0 z1Wbz9-Oj8*{tLF@G(e5khldn9Lc3ZFxac4;1ejGBup8syF3h)%cHr(M7w3Q+yQOjv+v*WBy zt}$U2b|7SJ8U+GtO5_*5?c}%U=)tiu1pgnoKjjj+ZE+0|Y|FVW3>!e?E`UNPpr5*mEiaX4+9vZO9A*eV*@Pcf_6dV9EWt1DkGe0M}E zB|GxbmANeZ8*?4wblt%K!3mkwBAM{dta&+HS_+EFBtB^>3Q$_vt@P*~Z;WI@Kn4SR zHn$^~Y)OXT-AFq49frb)#i~U_c>9iIiBDHRKZQWco9&R1s|7Nlg?{Kjwqd52WTkTe zcEaV$JBXXDV?capOG3;y{HvDsE>%14xlvkhjf;2s6U>J1X7F#M^1juPLqhZgJ4m}8 z%f|NaiAxoG-Kuhu`ab(aq(O2&Ltukzwk+^RGX-)t&Wd5FL%()q18B#_x`nU=kN!B-{G*L{BdXkrQtguUO$y!30Q02WxP~Zt8Z-y z|ARCi>!fV;qy3|vZuXCa508XoJm?jDYt`z@afiOD-ZXCKyFqeXDefM=^~IK2`0G?@ z83~a|B1TJ-<3(9exb{8ddz&tj!~_zP;YKq*0NpQvHLl5=kKbD^3~O|xWC*7l!!MuyI7fhcGW zq`iAFvE2Dw@#Dw0y1L}!cm8s3&UIGR-8@?`TK)XH8EK=lJ-t7*G}8@Hp)dnFewAouB1mZd{QEunF{Z1}}QL(fWl{Dhv>3r}d_G8`5rJ>V9$E zO)o$$L6lO8=ia>%mnnY#xc2Rw2 zgR($OtJrsAO)N5Q<(2-o_4NtG_id>7USp6vZAHItQ&*YgIryG#*nOle$CKr7!NQ4H z`EB3=6c zgjF-muer&RE8MVn&@*l|2TL~y{u);2J;Lc>8yFcExrZc%v-yC zkKmLJrahELdRy`EcVd~sVB6qt0n9<;K4Kuv@a$gJ1KsJ$a`#rG1j>^D(Yp}SvQ4cE zR)k1bB1eR&;);T%-It7$8OSUW%}o$<=Q7`4!}N`1!cgCr#CxPn0=IA9%7xC4AH^PG z*-j8}=bZ|Zbg@#MTJ&`XQ}13~@JF>xAa(W!Q{Q@R-*^8+m6cs}QK72FGvHtenQ83W z?7NF+A6ukwt+afTafR#T232?|* z9vg~WmBQ@W+RN<8ec0JJEInaPmUMP}W!1#)^NJA}eA2Sw?^_cJLAm!Gcn#};0yPf; zd3thka)Mc_IqPCcTp{Z{s6ReF;B-!@Ss%Er-~L zbTjbXqoboepzhcMxxkz~U!nW&`*kE9ePv(#PhmwHI@}~e*nQ@Bw}w$k+qL{>dB{6b zoM$6B`S(ilu7*ik3pSWus$;x`L(cd+EQ?3+MS3lkyuw1KZQ-~c@3$#=M|vrxbpMPJ zFff!JZuZypFdY;f>#(Ep$;y!8bO#aR5l#S4DvB6|&jGd{Fw_DL)*0fF-)nyOag-#73Dc^d`x2 zpkgq@d|65!+P>PA-F}AYFwZ~O1Lvf9>ZW-$!rwa<(YrOP*rF%EI)J) zA>GO+;923_Wi)r0KhBEMbu#GY4@rPXs%dS57$BG`$WTeJ(UE z7vC7Hy3JVUlCQr~rB6j4(&H6L(J-dkZ**#y3=NM{xGxAIjWW`Nn&O@tP*39P zdG-}SXm}_drD#{=48>dm^Uu{kUESL@@^z6J>y;Z6L@_43OGP_wYPK=2qaM5DgxYSp zF$hT9)#{)OpaFXLNQI+B z+Yumq#Vo&iRUE0yAp%!>tpG=aB0##2@LvTQH2~N-l}TfR6Y)xjsH5b8 z4h3jAfY0iJQbkEw8KGAO+xTC6NgkYV#}=r4=a!e3!$J81GHM{_)&Vr%wzjq~@JWER zg6xNTSWCi{2vikc+A<$}U;xA8hzxFmLqS2|tb@Bj1bY5>4xn?y!XAlW!@k7#e{4Z1|F5Ec9DDg13GM-JwAjWyg*c{6vEZUnWD$K3hOhVp|(C=d!i4>+0>L ze)bTwKVFN9A_K^kSjY_@FjTt?TFki?VYU9j!R^boHba@94;Waf<>ji0vIvhHApMVc?9774A!&cW0dJ?q9;(1E%MxhGFqiL!@6{ z`yf7u4?L5O{6ppEpz~GS631O3(6q>q5PWU+(WR^#F|qCddE(OD{e8440LKh4fj1tA zq1<6?Mo3>Np56hjQ;0uLfLRaX@BhXRp#L8S`F}cwPW=q3vNA;CZ$N^$2MX_iE*1>R z32_jl0K(=X>GMG@ES?x=5qt(&fm72Yw-wSr!M8f4VQyYqry4Y_JVz9liE zZ>|IoH!(=lZ8V%aVgIdV0c5WAr`}?L80wHdm`dKY4Xz}skipcp%ecd|^ zH)-0&s`XLlm2<-6*>n9Bjd}7<+DwbVb=+qo=s?bQs1MUxZ>}6l;tNF#l~{XPrPlIj z^6q})Egc>zlJVJA%B_Ej+D+7K(o)qAE~`8V*In4Jxb_yG(z$Y+jrqTuu!s)-CrsHT zM~GC2sN@b??146EreQCfW7;5>`&rqkC9|JeZ4*6XB zcT>0GMxE=eZo8QqWyTK+ZNk3QDJjD|Iy=tU4=>ma>&l*DHk@3Yr_sA=ug2Ml^0|;5 z9!!+ixt%037YbI^SB6OYRcKW0+O7&-LPehvSB)nBUXw@aHx!70AjT3#75Ox8)d)3g z>ecTVX{$aalz=#nPgL}U5oMzd8XeMgzxtB+5wxm8+`5ijyzBw*!uNLCz<&Ss48G;I zDE@{mRK;<}U^SGPBH==;6k&Po+QQ`P=Qf|V5h2x?6#W_{ zn7GE?Ziuy^#7NOPGG7b&tySwa8rz=P@L65J6qi!P!^LNw^3%EfvZR)VlMqY4+8ITZ zmGEq?;DI>q8=a}cI+cDXWIwsp{qVDMe+v4t-A)3kpWMlxB1isZ)Ybi~>Nc$&^#1x*qS=$&U%gt=b{w#QMHa@NdR(AokfyZu2LEpGOduci zsCkOna%fnnS#}*fipRD(xU*bO%iAWRETrAh9-0g{o#UE$?F@a0bEYJaT3L2XE?6h} zSrQS$G$q6qsvgg?Ot?MsV^$L^JYof*g$Il`4*dom#((a3T%bzxE|%(rkhJSJp2oOU z?yXGL_oYscie7h6i*kWUFitc%e))R8{Z0u_!rc{32bA#d-97qCop{dcD$E*OS2Olw z4R31y&I|}TdpWznJmX7ydqnV-7^JG~mHFG7M0_PDipn7Z!sbhfyr-e;K}RZ#sm@V_W$!NEF6RkgvGmhL$Im?HXls5I$sBW3rgf%XA>;5tJ+N` z!eAadT%1Wj>hG<4uiU||f}YaOymwVc-^(`$jjpud&9|sYSW2-nUu}GNsO5T-PH1&q zDv~+zHz+4phCfEXVKG3C#b{-r7%BtL9)s(j#29y*P3$5#_gZ%9?CHPn`;z@nS7z&J z^goE{`f9gVo5I#2{@+(CLU%dr5ko9Sbr-mzApSw|A1_(_ANc|FKYiXN!tJ{#wZE37 zRcjh{u6&^g9|m=SO;~x~0ku_YWZ|BDmxDl^8(rW}bgRX4@yuCz?O*9Q-`sC$li~t% zhRVv~TMPrMztM}F4~i##ihhcFQm#_%hL)hHMa~x!_coe&T;>;j}8G~9%s2Qkc=Z4t|+mFs%SEklJG8A%7| zOv$CVrRLTRmtQ+SxG@H4uKJ|9tv@BqaliI<1Lrk=tJPCt=+6H#rqrOzc2LXt;^Y~F zO0-a9d!c~rF1vQ$pt!VZGAyev`jh)!)tq3a0NZlF)b_Ko-6FL>JcatqfVXd7RHx?9 zxv%I!TFx~~URvp;f?{|lI#ET|YUCr*KRw^R9KtIJldZS}pq3b@jYHD!BbMnK8M$8sECrN(cfr{**TCxXDtm#U^5Dn|8+(RnsN? z`c>1Ayn}P3<$+tmNT$p<_wba4ItkPn_V(c9#euAkKAOn#D#wV7bxWh^K1`uFOy@$1HWrk1(^n~o~A(k>z6DJ1)v|+zi)AkqP(<|nd%OQ zvchFJkE2TM71;t~7&A`Y4d|AK6*ajd+q?Ttl#eW};v2TSFu&XW+}x1VstYote%D|> zR2{wfhnv-XoDKKXousO64M$6D%)UXQ)|S`mw7l3Jxc^k-RmNn1D2k3||3vss?S5cP zab9L(Rv?$+jeXbi>xba%@2mBm1S&(XcKtR?@pd!9K>PjFkwY%^Bni_+7jaw+p z#dcz(UqyVjJRf{FS|K@F=EKG7=z7}|Gli~$O4mY_`c~QKk~&*l@t8kDc+b0YH)DA% zSeK<^5^GQ1H$-JEzgnDB!eKNTr>`HaqLxm0Q8z+s{#;7hcjIDa({;!`nh{F4uTA>PAN7vz2Vqbg%Z6#(J02PSPyiVZq}%ncjk=yN zpVJ(ckV#t3IXtHr%}#Zf_)y~3^)R*}C?dj^E2n>{OC`A>Q$Ed+*kSpAnt>7WX*tSL zifPT;TvHahT~U$xfI}sWrm=HfMCEgoH4??1TPRT*|Lf>A?$FriA|r)khFV}u5>bJ& zmhC$2l@PT&yZa&aX*?9gY-sx7Nuc(fXi-gl>LU*o2?s+ypTM-t%u4QZFzcgp1f^_U z(9oF)_%)p8X_1WH$2NTVxxCKe&Px5t-Gz^xx%&L_)@t|0JH267AVheb@Gl8p27VVyD8bKrb6>OZ6n?#BboFrCX`UKWEzXK>W@Y;{^?A_gQpKPByDKTr>~`!*RARF{J(0bHlsHQdNj4|% z#*bIS7Q}vyoq9GvBhSwFo|#BYtzpPKFI8IV*FsjV*QLnM*uWyMHMzf=_vmKAae-NU zwa&3Kr8o9)OfmM81}=;7wj2~((UrHUzS&LF>l~DGQ(>~D%?o^82x^V)=`<7n*&$ZU zc=Sy0_*t?n|NiyGL#@=&J9{V6!14~81zN=k&WHE)q0AUTk-`}k1=s}YVG3pTgpQXTl>2*@YSp7M_t zEGOZ}hwshEZLZqIvKz~-1;M_bdVX~?dGD)>U+MDrDN64|{NEZGmX7*&8~!TxnGI1y zL5M0U2>3dJ=H9&*|Ge}W(5Vo=0>5GTv3<=qvlD#8gV>qHvNN}QevnU=<0HsEV8>SC z`};9aqx{F#?fIV_DfJbgGydJ>|9Q=(*yp={Un~uUKX~`Qi@5*#QCdh%xGnmqxkoQl zR#NHrkV`G>hT7n(mf2{j-6Cq1sqVvc`X0(FYj@+v1PUzdZ*PR$7CU>XxhsQGMgL|Q zEi`qWuo&+N=uK*7z=Q+A+=TeIjBX4VJ&|a#LS4K6(0ZHNhr1jKn``N&vrHNWMFkZB zPg9ErA2xXwoET|Dy<5&}uWJ(`4*A&AeKGOV+CHxNbgi4KxVq#C+n@KF_6zoZbo(D} zlKg$G^qm$GlN2FO^cQLhGRj&{2tIGNnX<bJ68Z-O zGk8{M8`g`#aL{rCaM=@a0$<&!4G~0?f1NTtY9a&}&y&BA2jc%Pe(-;W-WSKwC*dqC z7|4aE6Aq#N0Rb&WL#tv449Z>hC8PUp~-=Hg@Gbs~6>>+5Ut@AyW} z;8dc$jB8qV!X5{@E^@$>R8LxXg?9H#6OLF}c?W*z$npAMjuHIJ+OlW^Z zI`Njdw3Q^dmd|Gxm-~H)2gap6@nyY$N)o{{H)kFe0}=^gq5_CWKr7S_xu@y792fF1 z<@FezY(dH&a-y9LnZpb9%QZ$0WMSyHdy+Hsto{++cu4RvHc8P7p9-_hM)fK4CgRZw zvoT+SDLy_l0+SOijV}u_L9ekw@{MimX+FY_OEad?oss;EuA)ODe?)9ycaVEW!1v(?w;JR7d{J2EdxK&Zr-z1dl4piN$` zrAI&8x}+sQ!58YfEOw6aI8{ro>hC~Rq2;Lr4@;c;J&uu1%*S}oVjEwAT%Rz!lm|&F zHju3uA}1jm&vk9qB!vTO&1acywc zm;MtMwgoo5E}wU{(zwUe9KT-QI()vNZ+PWEIP}`Xn56SL;mGKD{0yGVaeJ)V+#Tj^ z{ZN9v5cStlzTCq5s@eyt~YE+;C%8w`H>bo4wO1$$c2!-$5$uLCQbHMS9#=vAFtsl0^nq z?L3=I#3w;dN-Qz|4&0FgMpX~{ED0ewGu#nkjyq(QVTUV|NF-n0t-mLPl&=@h!RvU=3IXQ+AoQsmq5Biz!^^3VxhX5Kp{csn-XGNC+N~_X0_!1J$Ld^*4f{oa zT3COJ9rN!F_a!$W6nvxK?2$|F3@MxAIyU$3E7G+Zg(VuG$L;rprdX1YwGQb+RWE$F z=pVq~+6JQ1)<(F|*{X44cbJ{&y2vlqjYZqlR9DbndEY&)j~NrPCnyyf!%%|IH5v|k zDlVd$Q2mDoG3a?@C@$CT#SMj>(!{UkeOwrJV#l83zbBuKI-*rsg)CybSKpOjST0M; z|6*u*!mm-j=$HLZcC{H}_XqfUCH3x2iN-?@wnf8|oAAN#=v;rlfXzDjlGF0!3VUGg zVg?r(749}Tudmn1NW2c>oH2l+jnDeZ*@o}cYk|eIV2$RNin`p~jZnWDd$(ZoC3RGt z(FD~>MQ~XQEw{ET}$K3gcKfj?J&yDf*92BdaV$dIICi&~iXIIWMkTeA4;t*Hx z^|h1?9FN_JS#Ro?#tyQ(s^1^fH|$csd~;<{>*^M#f)$cMsa)aqnbVu{nJP7|6^3TT zioNIbO_06tv3FV_N?o9rD-NT0FYKU3?QkM-OW<6?UMY}M>!bANQ1XvAhwNaOtOdDw2uV>`Lv%5&|@ zndB#5vG$wE)9VuXokQ5`S9$D=mOA{P2Olxcivt%2$duR%8@ygZKYwVPIO|y+hXDtx zfUb16bM>pzMaG+7H}`Ci>>8T`<}rzJNCeJW$$V}mOJ4Y_x@u&8uxHLH<2 zKvGRv;b)E)9r1sq_fET^BDL@azH?Ok;CZz12@HGW-Z|Qz^r{xMVRKIQDyp%(cK?`l zd}3W$@ye07YPbIkt@Xg>Exr`i+i!Xk?N>lf8rOx#*1)6E*$At@sL)qw8}cnLdbDCjCzWYi~JUCf&jLhcxyC6TTdFVvITke={jZ}(Y=5Hri^ z)jg-Dl8leyKfNLDNEdT)?fVFiTP?tvk) z;aSsDHXt1n_#CKpb6FCssV%hys+CW=8=!H%$OZ8DWb6U7$o>Y4~{K2QUvkd~e8U5kHj6OpBzy&{S<^-B%33HWUR(3gbyS}c$qnkQ;k+G{Zurnku7VlZnUrd( z%`RRpm)Q66`;-j!@8uVil|Omg2Gqtj6M2&4%mU-bjY(w~KipKjlu&uMdfijV8CsZ* zD}ndBEOaFu`k0#^(W^{mSp6ZWMsLW-Y&8MSySZf`zDGLMwX$+c-OrTL=Lu=_Yu~P3 zGW@tAZ@05L{w`*zP3b3Jw6T!$Lz^{*mlcT;n@=0R_RW=g*ddOhnaUwvZcYC=+)Oc$wnFWsPN`XE%QQDc_Zd zX)rnF%agh}^5Fo}+3d@P`WM%i%GoyG3lm5fi#*mCYKJ0B=sCQ%E}~>G_+#%l?KLD) z*cz{;Ln#yoB}f5k3JTH?-m}R~>j|r)OWLIK!_PyslG=JZJqh1b?p?}xGczz%sJot^ zXcm(N^q?!$Wq$d1=rzo{&0)dR>e!y$D)_rJeoFI|6iy#w`+WQntz6G4-r;tmnp>_P zIoo}W1)Z3fUA#W@3BhZ}tLfaL-pX0m9)Uj$Ymn|xvoueDzVHD~YvRDo{oBJ9W?%>X zmHYdM-5O+bv*MVDC3G}qiefY)0SHxD_vu*N!n_;fM8J!cmo&DQjJkl4k=u%Oq|givXQ^(K_^o^$pH_YwcAESyj)_gUchHeq&eHOcxOwh_o&0-OVh)GM z6)0roT%pvr!1(d4vc$?=%tA<8?n$*`;!4|bBO6gp_xm@1Ir$;4DfzzUb>v#ADSP=L zeX()#x|C*7;0@`EpNK-QqyYZQH}I?2Flyq(u;x-GGRDBTTR`**eVyISL&n}56KA^z zpO?-ZpV-ZN7iqBe5N!LMU1&Eo3%cHwg^V!=4`zsQ`?lF{8w>sGt=yvz?pu#`x|Wq` zE;b~J_XydAhZ9Kk-1jxcCq8nT>-F9eynVdv*xST2+mc2}=eF*twD6Vu;ul?r<0%^p zBkK!MH`JFhtuKzgIjaUz(D1=pXsy9+Ie!&f!GHKZhvKO@>EV!-rC&OOD~Vh!0c0J+ z`|^jhobjwf$gXWv@kN_iqIwU*N!|In%uc{MmGK>eaFr;bAA*kJVnT%8xgAR(M}(0A zdngnd8ScI*WNxATg36C22XdY%YF!|?>C$1X&U9^9mS#yOQAa)-~hCwN1J)9JI=Aa-3IZ#v^$@f~wDsv#LyyjR$Mu5N}@kv#0Y z(^sL+hwHpk_g<;Evad^fy%mV(QWRhQUJ{yTV8X>LIW$iS5p-4AWO3`kCdDCFcIDrU z6i=ntt4FI^21q|U;o?k->JDf!e60;^Nq2qW_S@}3{??yfBRIi%I+=#PWb*R*XXLC) zq4jooy~duC&aJvYNzX4~c+X0*t8r_+_mxXOlDmN9O@PA^GMw=A_Y*QD2a;3XonYjJ zkbwa=6iIT{OWlX1^P|kW^JA<~=Z&72v2FJeSC!?lPhJ3M9^INvx$IdvGYm} zwn`+Ib0Jh!8eX8%a(b5G%g|HyX|e`1(x$10tcl!iwF z<9(6q_3Q2TkM-SdFEl#%%r;9tGbrzN1NdXm3^|@F($xvA{Ls~UyJRB|@&uT`@VLr5 zC0r#}K@lX)x~zcK>gw3(KMHs^Kfs#|pLA2IaXp+7=;a=CcbI^hLT{+n!sdsD>+~00 zH-%l?xn4!-exc(gU7AZ4+}pM~l>E-6z1}&!yT72r!J542#&T=(iy z?;4h^>V#_qmA$6lL6plvC|V($M+fe^GBDwtN#`~W+XW0^_w&2#q*CoS5*7ZnRcKGp z%Gw8)Q@3iFt>;Uz1sONlcKfezg_RL#)BNx_e1USv1ic!vq}_WJe^o~{aaH>d#f*eg81rzc`xW;8+g_PX%U?(c=U5bk^H8*DH&LavqFvRjr3% zP-lkeD$j2;X}ql8%8&9fM<0=<)7a7$vu+-i#^N;7|5NUGeI&u_V(M?(`{rC$HJ%jx zrI>XLPEp#o&DQXKomxM700S@w9b6P^K!8w5 zdK!^OCmjFzu|BY*zP)0HUvte5sh*SS;eKFkvP|!iyNLB;IzUTDKy?N$35n;Mz8ljz zA@_g8-#b8g6_{YW5XthB-DdS1_FmFR9Z`4?JC8Y)4~-!qA;n6Gi736fze({_>z}gK z_GvM5ZIj;SIGRy##d+SB?shU$nO0Z~y=R delta 14573 zcmcJ02UJtrwl*HDcz~mVg?bbs0s<<%1VjX+w*b;ndO}ek^sp6?!(cJmyB_@PaWkt zc~Ydh%a7r$#;ZhtG67gx?xNQAY9fD4xiVIN{FUbG^GC!nu)CgZFJUH^&lh}e=%ph2 z<0|?g1)5Lz2r;g2KCSRB^st60{}O>^SlSL!`0-q3A+UKN5MZ&NhfeKfc%2+$cvSgY z)sZjfQz%Rm8oz*72Kmek3=9`<4;%-FUw?OI1c&3`BjCVzk_i5Pa^$ERIJ7c^NP&Yb zgEA*L+<21nPfP>;#d-hOw0XVi+yfZ4^D)R5Lrs$ZJKGyF!=Z;4?vhC{ha>Pmy`jIu znD%AoK-jW(*QI@|36IyzEuh0le*HTX=b2JRkUcjOIkY62Sm~piWd-u~d0r1=Txj7i zXU#52o9(Vn^&j{2)$D2}hE+zZ;|LQN*PTwu!jGV|pVT>eiW8msuYI{@XzeW{;?vvo zhB$_GcMx*?)fo>v@XTX}9q7~J~sc}`67 zSh`%uJ6m-l;9JD_xNWc2;Kb~4ueQ_HOe3@N$GyA|A!4c=cj@D2Tm!C1f4^%~=oY5-~g7`T)xk+bC>j1{5b+e zL*B)_e*Hx&*Jp5nQjlirzIAvKY)8_6w8yo}&u;GF0n1tAy_c6vVp$|LlL_Vb>Z+|w zhQ?NnbI`i-k@@w4Wl8yS_V}JMmE>M|7?(?qruqxr0Dfe3H|I42|5`POMft{ATt<{M zCuOkne8=a<_6;!WvvIp{qxH93$?zDCZ{OF|V%0Y?T;uaAyjQ-nr_uXU5bE{{WB#h1 zNBb5_0e)mXVcamUz6j;eU>P5r*KhH-Scv;brmXy48^~*GPuh5UoI!=viCHgy*z$E# zw=_NZ6boek@-!Zr4LuiU*S_(RWhe=Pr3y60-Lh~o8@g1&*nrPhB@F6t2}`(d_I;nZ z-~2we^;P9L$_lY!ILRUUYK-o-uh!EPPgzc&qg?P5Wyna_38}Tku?+NO8MMB=bJOVr zNW12_;0ZUawwmk^CnGn3K_o?Py#CFBF*@?sLZj7sHNkobejn_zCf<Pt zx#wFQ$bPb{r_U%J6c28&V>K%s*u4sFwN)lDebBo3&cvLqY(809lYFJJwp~8Ru*_)g zD>dRQVUNGFfU(!mY^xfA+=za)k1Xg1N^DceyQ|IZQrQrb;qHt@6nJg5uX;#h7B~EA0CTV3K@QG=r88; z-?pBh{r{hEBY(&0{?|?m_?NuazfA6Lr~&_rzV#pB68N8U<^Kq|zo7>F%aOyMkZV3Q zxo=W#c*_(%*OhGUKV?VP@F?cL9F$t2w9vv*4#rZGu4*)eZv#sQ_>WPqc-X<)+I-IG-b)Us%{lC1 zEU$JFxIkcYp_qH;=!7^_6nx;K`qFdd5!Y$~g>*WOQOR^Clf)j!4mepUDjU76}$3=bL7l3*&s{>H3-Omwe@nyXXnvXA1ZBf|#$#EC=TW@QL}WAwE@kWf*LK_WR>*)WtDAxU|&o;Ef(*%U@4{ zBN&lpu~TtKnv0uTwAuJzVR-d!k(&^Gg>2-}GbH7k(R?TkwgSFNRnHJ2jS4Avb^+I< zcm*Ob{%CZs+&E2B`OuiUb14T_1NW?poRDU#ES)&D1S;}=M1bbbvy?Ju+QOx``;_~o zIl?+aIpYn-tNiaJoJHm-Y9x4%qs(7Dz1J|wcZ6a#J+S&d*lhx-D%;5m_xim)8@$+W z&Pqhj9wU#Xlt-lpd;=-f@Mx+##{bwlN?GPf;@{@EWYQP<;)?KTarRQcrofhND9OxR zqGOmIczb``cxOW!F%qz-vNxd{gtbQ|;(u|ioc7;ila%4Y{C8s*nG1t(uj3OkD% zWFJ=F_{B{y3C-pJKw1h{Kck{7l!{h!4csOH^K{Bp#O85Gf%d2YD8})WlSGa|`EY5M zVVkMq*(hDqZbPOKDQNFulgV5{Lo44XV}!I!3R|70*ix=lYI5qbe%NuOWrD=D-Q}Uv z+a*c4%5}a?0>al=7ax@*+4$MfdNhOebYf*z5`HQa5KdBXwzy35ilyH+3!EBKvhL3x zQlA{0qE9+)%}KT!c1Zj|dCx!RABKCZ?Wb#yay+SyUWGndrjwGDkhErA+D6htWT{7% z4`yM4M(>pHY8Zy3Nu8+&S$D@b+TOU>Xu@|;Y&}=nd`v7hkY>?kjnfg-;ohj_89=Jf z>VF1SgVa2lXi0%cBgmrPdADU7MK8I9yZlB^lH~EG z(xC+RVH4Ff2+l&D4!#PKYQ>L_D9clP_YIM%dYHY2DFT~tNzL`@t zdt$q%+bY2Er&oPq!LmCD-U0q9u@d-NRx>$7@@Rn${|x=O?)-0NUVpKlhyM5PWNeih zB$M8B={1f6k%6{VUx{18cA%+jHSWz`I`aDnBSztkDW}m)S)fWoFs($c-ak5$a5;AQ z2xM~QD<~RU!;{3yKEt`-YW-)I)<-6CfjI9auWUl>NfJo965uG{^U|NR@xu?=hr4y% z1HW^GgzRJ_6`ipB1AG-v#-ehdPG_pYl^n%GcDTIvhGaA4eRUW5n3vAA&_b;Dw8E_~ zyMiXEN67M5*%Nfin#kzXN3;E|c}Z%eF)ukC;X#c9SN$zC2U<8w?(fecj82!y9qdx+ z2j2@hfI3eU)TTMe%&9-i_~FC6)s};O&P)8@gu4S-cISos$KHQ0QEb%mwRFNN?XSnq zt^0W&(037je)mnwEe$j@A`FdYCVLKJuf*E}&AnFj-Wuw$JcRsMMT{h3?ZEbCunwn`( z4^_4Yb(Es@|0U!Ie%|Bh3RTHwf~0Zt{jaljOtwERKXaqV9Z!^qKRInd=s zApc{9cDlH);c4tAjgv;&MCsACC_zmDRI(Ja?z`FSxBf8Rs5t zL9N9b=M$54NjIOS!^i0_Yia5tBQ^U9P;ww07lfYc9g@ z($0R;>*$!b`JKKZNx*?iFUjH9epKmQ-0pTsO(0B`^{NJxx2OhrpK13{{!f-bMU%=O ziF(VA49Y=i4xqSE#Qebb;zR^QL(p?hGdvdjx>LgrkvH07YHfSpEjQaDeA{v(Xz3GV zDSjZzCxl`_4@!>#AcJse6z*ez@Cp}|%D6idqX_ke z1w63uM(w!T9^39!iHGQ22p1g(ebepIk~w?FDvw*sx|esNcC}d@GuY~?3qDEy^cJ

    !oYS_f6e z9n$zZq@+E~>NX_0>H}_8%{F;MXP+1No`<`;i*83{$}X$7c$8exURRSiG$q;y@yp*z z+(XPyl*&GJjg4=}mWy>nQ|QJ&quz7p*&_?Ew`wlJ;}Qx*W~mkpR4;VeAMl{6TLpow$HEl^r^a{ zyW_Vl646eAVikOCwKLpxA1ov#=+e8OQ?hRBUFfv)04jRTysrO83(%Z-H5{M{GV|gP zz#r*9Z&$sqwY&D&dWTZA)`-kkMfY}he?wpN$yZ)39_v*5hex<%+qqha6Y9!syLmR< z-1GV$^KbL^$-0hA^tlze=phw7m2k5~RUOGM`m(OjFMJa*Oe`x>Rq4@0&Hc;I(w?UN zdN%O3JB48+ZAOVyd@{=`+h0KT;N>Bz)FR5gJAr_@Egu6ReuM4kx@XiP<*R|KzRI7f zI>FQjQ1Y5Q*$|;1!!<6xc%ttm8mB$2m~%R`WvzF?iOqI%RrYgk8aI4A?^(A@m!2%# zEZiR-SR3fGWyJIYd%RL^p+TqB9jlq-x24HfG?KLw>qGKi2^{E7kMppK|JZC<|HOlx zC3uId)5Y&?%~!d;Y7JvdYY#V>XHmBtJqoso)|GfMjDLJ)~ z;$aHlg3?NXR|~`5XZKR;hU*S_*@vRvL`IHzKbUK6ANXUEpLn0XNi=$*r0(8S{EgN) z~7I(b=gr^%y3>eOYnnysNh_Vmby2i&P)j+xDoZR$*uY zLm{UBOsHX4Ucu!)ue{~$7t=PZ&{S^QVi$7J&q38Zm!-uyweyU0{<~AB8*XNpD_7qE0r~WDJ3{UO+ zZM#fv&vW-m#c|WKI=MQA&-ada|0Bj;nU2}FW<$o{lS{LcWdf&doTwAOtVe{GPJH^5 zGqX=F^Jc#Y8+9P7zq{Mn+dZn7{fzBkLs=8&WQK2b4!= zJ+o$Iqeq*^r&78n(U?>xr<+?W$4hePnGsdxq(xw%e4{e^V(3e-Odcb~SBirB>R`1d zHOl+$nZy({tW(yj_Umq&b&SyYeN%{yZg<+1F-v`%jpa6fssT0VTcwh_ePHo{DqX9~ zE8YLeu3sa$#W}>Ds;kj4_tUlM+MC+ex+HX+&lZl!BSWrDqb}Kz{-Wa3MFE0ma=PD- zJTR_rpg3>0;#n zcdyA9#wQc_@4^oOz^cg)UscHn!e^mq{O=)0mK%Jmd5E#a=YJRSzuV-0**IA{G~$WL z!2V?+<&fgBpG=VJDXSNTAZ1teQFuW3{4W}==Dpv zNv6v?i@kq7aCpp|%K0YqUnd~B;s0WmEay&zFNUlm>-`$8^$1YXKzXtz$CGUZjExDN zGuq5wj3@wejG7f$m2X*(mbQiMK%+&RFN!&?6Da=2)yv~%^jtnVN#t496$AN%X3G~IIW$s&}h|yb1!#_w*ZYr zl6FAb5;T~rWMHzNWJYG&4L~e#nZ|0N3&`2{h%Dg0%ZW1~&!3x>UhGhkeKdKpg)mx+ zZ{VKJQPYlm*8>>~<}T9_yzAurT*v&wX#+*Y3gL`%1u=nia30GRFCxkVAF`i<88&5b z709q`6GJd+)>Z09Bvk*bWwrhK?#8|JS(18)@J!v%Fp;D!fJwm1_%;lvBme75WH&I> zdgNUo|6k;aGD6gqCDmGsI(X%%)L1mZIbB_9dgr7Q=X8yrPU;zKoU(uXM^_i9_Q9Bu zXIdB9bi9i@?>7?Q9{I2>0}Gp%QKmkB{(Mi&6+P0BTM@fz2$YzxLMJ!LkXNQssUcx$ zP|+dZ;(%}s_>RCsCXXbidpV0;*uA3~k|dOmvU^86R+g65fd1dKV(IpliqcY5)W=aD zs6Vu1Ha5~e8i@w{i4CzJM-A)gc?OB$e(%9vZ!f+Iz8+x<_G^hX(v6RgH@@UVMudm6 zJfiv_5sL@Y1{N0aW>;O)5_nTZg@g{rjK{B=gHW(ouV~eC>`Rhr_j%%&}#@4xV& zep62%C==SK7&rGRcJJc1RsaipF5R2}4b(MyeOKTIoT6EV(;n*SAE#=Y{Snl2f4{AB z8Jl`*rty;pzx(Rk_c{RmzgZ<3)#nMRY)G{1s-DPE%Bg>v7ZX!jJ))~xuskAVIcOl_5b7=zr#vL}&L2@ze$yEpSoG zVBDhaX_m*9AOBfRS_xMK3r<=LH1kP+1vN`MTO)KZ*NWP z9)+~a+`_^u`z>~VaXiXC)RrUKpRDnC9uqeq+5^LRHc&9PWJWqj(lvYWjd#LKweG?s z`x)->n(4pmaYON{LHdCb0`GvrToj!-tZAAt9aqf4Wr@7cN5v_3f)1G|o@|-J*aeA7 z&l*DVXt9U&TP=o89V^BOZU_eq5;ch$(#Yw;g>N2Aj2Y0(rKP9KZ0C^iUT_Ph?rmvg z&?z`Rb7Khu*)ZhUi0-W~g{!^|G$b})&Zb^0Tm{3#iy4Y(JZnCe=QL@K*GbW{iVIqT zJ#N-}`?9X!aQS&7d>?)jyZZf;Fw@?3avB=`j{9D^>Sj1iEm*ls{oJ|f0iWffNph-s zI7*7Ke+y~9R^|VAL4y}5nP;)rMPmOGEAkEHYY~aU$q)Yn?uqb(G2xjh@7{@zX^)o+ zEcRIR&gMTpOknZaF~8qTof+df(JFBuUmG zt6<{8YQeqY;?7m20Gh-wEU?4R!9*xhkO&-uEqTnLThvLuRN`SlMNHa1JS>tp)UguR z`9vVSm9de&yc7so8jNg^zGsWZFB9b&bwiVhBDW!*e~CCuwI#`x6y`Oz=`HfWQ92(Y z!R`#7MjUghVEEwRpxfQy&3qcB-#*-dZh;0U=g@h>e5~MpPoAt_@1H0VLEoJH(Q5Hv zYgTRR^=@N%v?g=1?42QHX&!Y zrn@}I%3g&+dCWz$UfAR5kV0qT%lXnC>Zs|=K|PT%fq-DTdf=wYv zav#xscE{ZWTuqIO_n8`Wa$Q^7(B4XLi3F!ZN0~zo)SXk*p7&*r?fH`@SM`h6H|!P{ z*A=%PRK_p?a?IASmS*?RZfiUW=ajwPBgZF`(R+KFFm;;@n7V zOER7@hn=Dx{bKBkb#zHB=tRFgVl7ipP}qGK3wtz%6_ytw?dDueGJ*+It>$ca?%bt( z>L0g)zK#0O9AE*f+edBl5a8oeQ&sh8@)oAj2-xoPSWx25#`LD|b)T9;FpSKP)}k=_v+5y53MdZFOq6-^1pJ9@glY0o>jK8Ew=t}~`L6~4V*|uh1924q6_$QiWVVVG; zWzsr=IvZi4lacK&px>MrD> zN>EkV54T2Rog@;y?mSb@rvZL`@bMZ`+ z|H4GTBhJ|38*uoc-jA6`q=vfXk>FWM=AEPCUk(vVP*+{Olc!F20A!p>PdVU!H8o$O z$91@_A5HWqf0&=2zq3>c05R z;T16jPz5|&!s@jE_D3-`E*tChf{Ep)y1yPyPJ3WucOS8t}Ozj&38Nj!#5us~++5 z^equ25)mzIM=IjCH(g1IMD0rPcrRiqJcQ6`)zZZz+Jdjgb?5l_%t(PC&!!LYeei4h z8MYxU_3sXJtt#@<06};O&-nj=uRD^{DMwr;LCRsUA@@nnwBaLu3m~p9oDu zS9PDKkV@j|_gp`hm#gnsx4(sJVap_nWyG;qGb!vSf~bT99Xy*nb#-+KKm5#*kS1U= zC!Do&u&IZfkN-aH@6Rj~xkCuc!NS5N3(wjo0@0_O4+(Iv=Av0-EEXw4+k*;h{JAh9 zGOL%zM@p<)@ws#KSpz+UAJLNErd17^DOV7h>geinnm2vaK86$c`eu2(+n`L{MYP7M z2)PigbLv2>h0p$Hmd(<(2*sguBRfGvtBeTp4N4&^^FR-_(@{bAq>-Q(4d;A-H@3bm zA43|8N<-QLpg@_XRvpj5!8mJJOcMLj19KAfvJRS`AFp$!>;_9L zIr1cE$ut*w!?&_&cp4Q?zHyr&Z6EQ6I(i1XwqOALm~=AomqJ7UM{K?8cWe|{Js`e+ z;WZ~}L+{WL#`5mjQ|wtfJbE1?MFVm7Ss(06v)$V`h3VH8sz6ZK-2Wq3dkb(>`P;UOaPxHJOa#XmRs5HT=-2oB1mN2U(~Ue?f(J% zD4Z&Fi0yZrW75JNgOqnn?LbbC7!)tN_5P~@@4|ql^e+2v#^ArR0sl9k&$W3?%cMJ? zp0=ClRRLFd#wR-`$8IEV${br=iDq5G`-sXQ+HH56v6!5gAlq!fL=z82My9A-fW?C& z$vd#Z+(4!#)RL350fXJ@OiN6(Km>ZgM7U)!M94PMM0e`NDoW3CIc68s9&;rAd|$-9 zsa&cz)unX5Yp!h^Z~q^iocX7KxS8!F{*T7KGpfm~UE4PHF4ht7RYXw{5hDl&ETf3X z0HRbO3JOSoh)4|tyCOqSRH}#+qez!tqoTwS>5$L_m7#_zB-DiOdh~tITHiWnt#kb4 zI3dP7d*A!MueQ^aGdhzgu3CYt*bjW$x7qx-Dk8& zT1JaZCKGZ1PxD}rYI|GH18@tg6a(CPot!1lM^63X^2qJE|7Q2Bn(wKygZjsdKU=l1 zz-rXXp;ah+y5`%^|Zsa|JIxFcu~X7J|tk7#u5G4cQ<7{0{qS z;s|Omx3{FOB`ul5Q16{s$sZ+{D*B>pcSXIu*(MW;a->3Dx%TK_Dt8$*Je3*h?U^uE z^n#+mS7{h&WH`R-c$nlBWEFA4tn&LvAvdYK>{#IP+r@DcmRnD1kUX+8_tX2Y(gMPS zW;H}kDpEiJcjZ&wdb>|bh84tp7}R_YZtcwoWsT^9sEU3s{1iwK!Ga~g<`875zhPR(YKLO1L$|UoCCvA`ibc4{GpF_?@*7I5@a`wkcTckOQ$Dk%qLaFRV?yBlbo1 z-=Ap|_LrI;)?~#&N3D~`zb{qN1#O3=R4_ZbRkCB#j2EYwV7h8RpvgD28&pO%W`Ohp zM-l$jT<;4juB}wnbXVD|(klT0WV$pZER|xckB)meq?xGa zm!ShHiusi)nP%J}!yUf1w0Gnq!!fpwO*5h|ZnCrUNGmhXP9W(vwblh=Q8rJqnbXP5 ztH#q?q6u#kVUYyzh^$%t$RUkAst0}4>U%>Bohp*=9NiMaD{=GQ1SV?iutr9{3AWAF zq?h^xfvfSS)zPN4E^6QuR~psW2Fbm2RH9f^JyuvIH+Ng7F;1J&)5O6QVLcc?qw-MiS z>F}#f)8)M?Hpxj8zKH!m1xI-M(zm^lR-wLfMeF&)?={)^Qck@4FEz~aH7?&KQ^_F5 z+s6~0<(BFT%bbHxxMxsa+?vC|V`TD`wCzrwf0ID%+RcAG!|g}}Mb5Wuw^_2={>Y@W zT{8Yl)D~9?wE|;4mq=-GjUrZWY=7{NN)o;>+dkcBWsSuei@$MNEN&a0Q{)b&rb)-! zauV^tuRnjdhiY&6p8k!;IjuRv(=}{Mw`;UR_3G?Sm2$44pUaaiTQiG=R>V6Bd#$=9YD5o-7V(U7-8Y*IC$aMKlJzbirP-4BAkKcU_p*>q@sxtx2 zdxlN9lvWiXh431?tW||rI^+<^X;l#ca|oiYE61c`ksyMP%9+RXMNSF-FF_*5jb=iF~s= z-ch^QgK^SoVH~6N!|^fO$0NR2IgppR-6uANwLUiDN>PsawZMfS1gUr)4du7{vQ2d! z9FIIv``YAhLi*4kdf_-m0g5I0gcv*Ql90CpM6BJW1iO4=P-C83GCG-!T5uur2q%My zN!Q#?0w#chWOZtS_ZJ{_Cp%eh0Jwf0ChjkQDh97rzSd-sXZM>3nTM1%saC@uh)Jd* ztPsf+C-wF9*}+4F^8?a2$TpSFBJ6sKJ}ySGV}4T4(~F2NTVzDVyiJT1R-OIy=E6uSZ0lLgZ{kNa5L}w zvz8{~ODCoZH$QhVZ(DGtCLz_As1bXtc7m+t`k2?y7ft`L^0)Pk3v6zE4G3nEq7+Pr z1ebbk4)cBD+tV*rnd^7BHKiEu-EMNk$5FX0v#cC6u4JNwYVOXi*5_7|D-WhJ5A(OL zXp?iS`eEMEnL1~=Wa7#MD{6oHTK?!Uqg=)P5QF3}`ud&HPRP^t%CFvmO)R+8tF$7K zf73g>sI`BW{E~!}9Us)Uq_Xa0S*L6(eMc2-@18`3Jd3P58W%+PZ^w79kNjZVAWK-C-h?ihAp7)(lUP3la7=??Ai|;xRR)~TEvZXn~5!dbA@gu1vap$H@ zhsVao+9OE^%qc&lhF>Oaz7m|Br55B`BIU%WNKmV)6dxegB&`GroQJv~u;FX-#XSbkA>9K{riA8F2QnTWI6!w4=lvS9Hoh zCPd3JdcFkP%$RhC zu3k=2u~KoGIZQo~d`JiMq1Pc4JjAAWV|nYjWcdqD!se_Vve^8+pc-HCic2UDr?3dq z`eJ@-mDmvxduxg3`qK794@#NT#c@(OWERCjsiCI@x|jD*TrBQ(vW!tCw(0DEW~hC< zB#a$hMzi~PcJuymo@(f>+F0_z-2>=@a33C;UC}*4P{`MLkD2 z`@JK=2U?Wng!{5jpYmZC){kgr#-=czn+rw0uf&r*R~_gThbEA?pyQv-s73iHO2#E#9ZG z3o(y{y>@lUJQSLBPQ0ZnPi1wX6BO(_a8xCpVnB0~P)6G|RAL)RbAP08aKh`GTf($y zeZ=V1A{J&buQp4=3C>6^fqkYMSr7$D*1h0xn6i_G&Yn%VyLazKm?CU`dS3}s76$iN zLMg_I^TMD+2;?kyO8do&HFxp%Lz>;g>XGw3jN0+(DoxTnIC`%jC>Bpt^I<16AA5AV zb;UiQCAXz9!c!Ya1qJ ztd`{LGS%~K^YwL$A8Oi+4$_`kATgg&S@ssS#!iE-zjBU9wc5GS@c=We44RvCM6e(-Xce=S`tbe3y61mB6PV z?pdK4+XHQnFfDuE5CZ*MsJXw60MwEtdb4te>|3Wn%leHr^x7|byv2L2) z^=Zv4?xM)Q=(oG_hGrVc?X!&{8!j3_h2F%1Xd~SE$G6h9USWSrGVWN=3WNo6CFygF z8*#K?D>JiWWCdS1=gV8lkBT;?^vw!b>+}N4Yh!bkoj|jR^xny6$S^N&_B4(2XflX= z1(1j}0})T2^w=Kk0Lbau^VlyRGCq!dt_5uGn2ObA(7~s96>e`?;o#s27Qs57kXD^onp#dHRc3yYOgtnTRKQ_7 z4|`;B4V)^ZGZehcwS!MSyd4%apUWP2P+b&I^#0K~X8622-e2@NOGX?2c1%0t6QG+e zs0%P7D#bEU_?G9z)c(Q#L!1r8*?*>H68&h7mIVLFAK~bw+@2^=W5r!v^O(!NZ0;I# z@@*Fxd#Wi{GFsl%m%mN?-gGOT-q}!F))Ib@U+q{MZ3f7kz=|OxEk5D5s%MGRe%tGL zwLOj9(i(vO-frt#aui~qUX|r~7LU~Rg0iEJYWnPu8=mtaH{5z&zn`U`C1vDv=%aOn zJ}*4aIqG1?^4jrF@B8~d-zr=hLMuyuL#gJh!r{M9$+rmn<>;dsme~WE*(SWdxTI&Ks$3Fz za$TB+{2@GIRI`Sbrj>$0TOp^Xej=BnsxIU-*Yj5Jvp-yJ3mf@lbCEOD#k8`QEHQ3e z2wAm@y=BBh+v?!bk5Y!FT;uesM`KX10zrEvR#oZ3A@Dz&RTS zc&8nrg8*%tzhZr zRSO?{O;qo|XSJ5`fQSy%LZWHLr&OsD^vf{OZcpY>!#=k3MTx+yD9(98rO}jU4gkn# zN+P5X@Re^zA~cK|-rSU#Zw_E2K7!irDY@PWqu9yicNW@i|Bk=yCz8|jCr*EU)2$Ly zLBAX`Z1~rFw)l%nhvZDL3Ly_Ceu>gY3z9SVX%)r}^A5Mxcq>Z8MTYG^WA?Pb?M)Ug zo*`cIb)8qu6~m$3fwNtH|BnF8uHq@gti-RRCI5GrC@xAA+V#<<^v2IiE~ZUm3`jlM zUp5%l@gD;DzvIUL_c#A93EWSP*?T)~paJdi`2PJ3TA(($2y2Q5F3|i>AYjL)HR!mA z1j^d#>KH_S6Gme&Okfa|^K7Rv-l*HD#(S*Qx{>Qo0Nm?qc&8jmd+7P{qgK7Pk%U zp2Pzs{;O`wK=ukyN6 zVC*lo_EJTW-LR`D1A~WuFIi-fd|HeNlcSojTV1U*25sU9)g04p2BeDp$O>2PISmJq0aVGJ)AJ8)wRl;trY^i z#RJY4kp%FBlQw3xmO~OyN{Ax`U0Zt4+|qotj%+L_3;f#YR(X;wp6OC zrLr1%Hm9>qGy-(jwrBrqvsOgM&Ld!UK06srmqU^J_hgx`lOmXUB(3M-}tMc>-z`Y zRK(LBK|c*i|FXu^77@MY+WTuw=8(QVLU_P|4X1_-DHH`QBE=eLzKoVdva(%bJ0hLo z3f(|R#0XW|6JlH&@kuO3LP3=Xh#{^`~++6oOTW1!~kV7pE!7RdjWJS zM2a60&|-;@+*;_;k}r~17~IyHe~V)zCB4$+>A+dy%ek9(JEUuY^sp`GK}EkWS%r!A zYRtpk_-;lf>@2;y4lD@|(Mk+OsF~Xqk4rYD@Sfe~IpS+)y%}kI9E+x?`g`c6=stD< zmpk9mFy{`ZA@L3l3cYs#HO2+;kW$m7fLX2WeZ$CqAHul^S|HUp_ z&9MRFxNB3z?{jagYCzZY64c|dKmyoqD+$&PBtnD?UL0~8BZgv4DUbK5O+?NRZndDo z07PVmtVsQgV75~8(|O3DI2O1{!J;Pw;r7u8M4#T27EZ%mX6+p~GWodPvCDZazt0$Z zkQj?64-QKxYt0w!t`FxJ)r`3$ByQ<8Z$~xKpK{MX?cDI0=KTzYp&&>biKvfwqhv!c zA%t)e9Mj9h#L`)#V8~Fo%a(-z&)a$ioZp05s0O(LG09Lf%0nyeB2?1kWs>@1v)+1*d6-QGZ8Gg0J90 zbK3P&9XZ;vyG*|gxN|(7%UH}iU^s1wTSD(~XTbrj+a~2{)%&gUgw{pe4C4e-AMFIb zLLOlOkP{paS>&K*juH%0NSxrYuQmPT)=qS!yB_c4x|~TjZ3N`!X?x{5VVQ|u>rQJM z;|H5FSyeNow5J!*_kcv5iul3^BbB zH!ik5kqr#ee@dLsQKfMGZw)xE@e#c)af(=8UF}P`+(t5*AU6I zqKdQ$Jaz78+2fKI1e%|D|61rmFR;*xG8IAv8`=dbtP*m@&02u_{a&8SN|Kw~lNF2{ zgO@QeMfp-l+=p`*IrE)suI^MesUj&M8x8eK|goL~2? zlqFC2d+>h0M~6s%)pRp&Np8&TYJmC85EWO4`fQ8K@QfL zyC`{c7V{!dkeGRSSDssc*;(OSzkUkyj#`pOQ9u`pe(AdKHA?4AA{X(q->Xt^AP|2c z%Atzm{r$o>k6k**os|U4EZjah`#?h1$xg4jfB=O{`ow1J!dCr{6A4*!ntHIe%4k*}6Xz@U!1pZ(&mk6@LkQ6b4h# zWAIp8m~J;;YmO>rn1+}t?-!3>2yUikUv}oePzIF1=(HT*C0BmF=0wl%-Y=fzg*2R! z`?i$>qX{X`{_-f@Jwv>Gk2e|~6t24-`Mn)IDamTzjiunS`AnM<;XE1{t1qneaudJa z-8b*_TvT=vc!G=O_9A=lVx_*dto||zGbbsYWUIORe+6J#8|uToZl#SMJVG_xgC3=A zLDdyF%e?e1;tJZV7cdx$gjsBtS;J!YDbWbs9GR9Up_T1+5gew0Ifw4y;z?HxE9 z%wR8h7IdAHFH6oJJ$f6%BW)ZoN})MIg-)`0M!c%$HL-e2DuIDrsbK^JRQ)3YvP^<; zi=Z~J&)Q9GI1jGMKEHiErobfg!$eFJv!MpK*>jo2`h51zuoMbl(D4wo0@mXn%`DA* zKJ3PJfD5rqvGmox3^5FFMYG-#Fv?2>&{l2mcKK%q{jT)=Po>iNIil109l;8h6zw{7 z@#nUG>lJR$Axv8ijz=O|6ptPl6$WGoRIdMMZCwuYl+pDzqK$hyrzjwv(qlifV+glW!!^GY8aMrWEw zzDWNvS2a54b>h|feo!g3gx?LbO?8VpiYeM)X6kGl0ph!FYcS;*!qRAUV!E7=hs{x@ zHQO`95aL1?apP?Ul_$(8AhK1gP4WmpCEhS`zGGvieEWnhSx~cR$0C@dg(Vd6?$Nv! z5wsMy3w;=4B^3PV*#SiD2B=O!+bIPF?L2Xx8(V1zKU=Ceg}lIxg?KB|m1i>SPN%R~ zvfU%b(AQZ>g5H?Rt*KFIpGR>-YsnmW*TG5bMbxVKKu*Wg1^8dHG$sd%zJijoNg_=@ zo8mC}&y`D~)JV+}x>HkPDMbhTevUHZvgeyjGUQW0j~dc!0ub^BNdVQZoQ-Qu!228v z>~bc$*c|5$J7nN^f~!1*|HNu1ZiOOlAj7d#y8EPU%^28XkAi0D6D!6LG4_)y9=90X z-~}%pfhs_dqY1$Qlf#0_2|P{M*gNToOepZ7J^1)J?Of69p{L~?eyZ*fG7!eT%*d!s zb>t5^!q}r!J@n(pxP4$`aIj5#B)Y59%HQtf5#Zy$5eg#Z5Msn(lcL4bW`3|MSf>8N z$DO*0ueD$%>2kiz2PkW>&CS?BiX&T|x#EUL1`Y!}z(SI~LE_CwXPlMOhMx+80ulgUHUfol3#P=1H UqRv$&6EDy@^5-8(ht6LAe{>+G}6-fOMB*4}G<4jJOP^_i!=lQkOeIX))p4(6{rnl3h;KIZP$XvVI{U){0)VQ%kX>1dAX>WFl1iuT}F zH!XWlM{Bf_{YgeNv}b4vuOzj6Gk2GPzE3wh&X4fXrR_tQ@6gyYGu1Ybq$)P)RjbQe zo|05lV7Y5Jcu4vGRA4rMYh|-Bg!0KbIV5Mj@<=Z-EE9>>VwrLEjDBq4(mx;|039_pG_*It zC-r+NLHqVS%Q$Ef1O%6hH#N@z*#F!^{gaP%=a*FeX+#gl@BF!}mUx5r=kg8uUC%$4 zXsnNN?)|wo3qhm&OUAzcOOyXJy=M{_e=fh={SVe+GH^SY!jR3=FUiJ55Glu1*wt2l6cJS>Em#=!pj(As(@e+18Zjr|`L$Ygmn_}=Gv_1E04?B@lwlaom^ zQ~6oJeC`4xEvH@6o;$8hG>=_C@QG}gU$(NXftZ*Hw&JY4!_FgqmgGJTwVl=qvXP8G z19{eXhKpaa|JFhj(k@>d)ns7NE*3CP*?Pi(1d&tuE25tp<-MAO-pT{+`=8C*vM5J@ zr!S%iUTjR>TvutIrzf3layXcalRx~!@1o=)zfrtF+LZmebvI?LW!0DMV%Eiet%yPN ze7oC0S>w)C$XJkMs!Gb~LKWO-Nr)W-?l|S*rI+ZnlQ#zI2!yfmC&{|?@bnz6GL7Emz+%Wo=?+RgIHyDl5y^m%oZXwvFhhXe_niW zQs*C8CQRq!i;=W9Fp7S#JF^ZOR8GX>=Y^(~cp0_Aueo6js`i6yCZNk29Z1lt*_*`* z(4}(Zt-EJvk&O*AH@7r3uuCZ``W#@bki4YRQY?rK<87L;%P-cHW3)ou*Gzj7TRL>o z9^5%1B!Mh0Hd!_4)HrwEAMaNk)Y?kIgbKFnvc+nZ6ttUUSsgD`d(E_;dd~^z?yPp+ z#Fazmd=3H(d{{XqDtO5^1%+Mn#Ohs!>7G;U&kr~s?x~@dVYr>;L2%9%z&|9 zSY@fNVt|#i^nyC&vEy{dY><+VUW2;aDIh4V)6FTF%HB^?=)0X|ALhYeU5#v0%2Qa@ zwq@ACAE|4szf#VqF~wL>F`L+b3tbR5%og-JG)SDL%S$LY#rE8podHZ;&7Q)xO|;i2 zB7NI~-jW3e=%ojSVX@2W?uPDA&+ZVfmN-;(s%_6r5;8e>Y-od%fpYkbygQYqn=g<7 zf|6rL&|E`j4P(RDNtKS*Wjd=lk=rU*BK`$V`TL822Kz;?gOQBWG=~}J5zx?zDCc0N zv$#yF7Niid06jgdOWny*N_ZjYQdzfgNAx6`gIUz#GyBciWm!^Cuv&N4KGDr?xc0(0 zuMGB(^DHpfQay(x_`H)CUZ>4J)NmsvTD|5dTJ5N^n<~D}ynMc){ZiJJxU`R7Nq4nF zrFUMzF?99Tt95&g8%~X^Qx7{~Oxv3;2ynT`qFS6Sz|i%AEK?%j*4xspd&e#5R;)S2 zWs3EnojAU0pL{I$D%@7H$%>ThY+*dcGLw9pj%c8TboziCjVB*(dYV;Kkd^5|~=u2hA-X30rtkB34!kLhar z)!jk`p=-ohoca<*w!b`nBV1k+%M-D%DE0MMk8_Js-&M%Wnb+Xjyctz?} z6^FFftZzskEZYWdy&g%RTQ%`|5R9-Dovl|8Rn*)cOdiaRA11Sf9N#S~BU*r&xpRn z*6R@)J-rN%8Ow5bH!>BmjCL)n3d?KBN&5-Xggn`hTAN1q`FaYy5V zsWlpMu{kDn%fo9i7UptqT;MmYh)dEO@k$Y$FvcBCN>H=huH^Q@zX_Co6zle6{&u*s~J_pVZJjMJ3x7{!JC~B#|!6_z{$cPpdPXM$p2gWJO^jd|@<`a`EyB4 z!V0iW^B{{;H#P8p_-aBXyMZbvQ|bn1oPGrPu~MW><-GGOjx5UnbeUS9v}_0`pLIwW z)tQ*BkhM1SJ@LEQNC5*Jg&pswB_#3blWH;o7Iumioq&xGC+O{4RYV$AE2!@<*ePx) zT=@=L7qOHIN?98+msz&zj1BI_0XSy@`s2}K?*xlBg2 z7;swdSM!tsdB>I4$GX&pRN{Yatd`35{B3#|;E<<;CVrB`^Xm5+ou_-m6dDPZZxS7n zeZ19t*%gr2#W8XsJE$P_T%l{qp$kSOe-fc!iV&3+l7@^6Pt2*^INx`HM0w^%x0zg8 zCNv!UIZzb5iaHEz#$}R7-GZ?Ub(Qe!OeJTckFd&neLn*My?~`kde0x(? zgsdIoG&r$8zuEVZ*IIuLh64_@K)<}blR<-XS2;*!tZUbR@O8ZZ0>JZR1n%!<>Uua| z@m8208nd8$vy|7JdIEQV_wtl(U$!+I$3z2!39fw4yFUYh58DhfrWuCgxISG~2RG%* z(9&RyUba^9@@e^0wM&!J@@olaP*3|LE{;zN!Cw-xXVBPZ85BPiy=?_V5we19BlUKCL%FV zTVvBsH?T_$_Ob}@Q_qqCEZx5iD$mm!DWgi_xc1{d-n^bz^@3~#)CUDb>zJ4nf8X+e z-!4K$JhhlhCY|oBG)um;O=ETjO4B#FjA!#}LDF%NVE){at{cTE>vOugNzWiZh04jS z)q33^u=bOFs@W)(1D!qI`M0&CM{w{bzuHg9iPICCKg|F)C3 z7)3=TXK78xcK1qTyiTWjWrJ{Ina$=V2>UgYztI5|WO9v4!9y2%Z0`6c!XBE}Z4#Hk zkBJYomd{72J*9BREa=N!AD&nmA<@1_-P*>ezA^i3- z1=}EL2PjB8ld!{YeQ)S=s-J4o*qV4K>&UHR6YYf41qQwohII?RG>~-TO1db-`4sDKe=~Q89>p!)9DF4vBU zIyGn9L6euFLHWX$cmJNm-{6z~HxBFnkq6*(ZvK_HLA68kANGr)OQ^_CkF>C&Af5iAD zLh2fA+4x07kNHuR#{L%?JV7kjCgoCN@CA=BZp!!xni0P->UwJ$a*Clf=jdY`VLBb7VA-AWP3-IhZ&jnZh-#H<(rx|Ti;y*E+y?;7rhQfFvM`KT0GrRRL>{W) z$Sca`w6RdSH>Q4XsMMQ}j|EMxX(e7JPEF7i7leXzDn^@3WSP~pKP3v9w+Gp$M5ig5)ZF z_BN|&376f;gkxR<=h)lKD0(H{rV8~8?i5g?$XHh#GiZ^gDKNUonN8a=XE(xF$zh0) ztGc7bpfFmpL2_3Th9$zzR&i6l!sL`Bmk?xMF=#C^)>*H!c|*nqlrZ$BoQ0cyVnDFC zlvdun`8bxokWE;q6LsF>i{xfq>9^5NRUesbDx0N#znDQW5&+n`L-3XvohtD`q0`z zDb2YqG6CF;=#)aFTAd}1VEMzoo^1}C^Bp&oi=F3eKR6$f5FeZf`2m+b4FKkoYa1+- zd?=lO;whL9HMU_D=IJz4s{F8CG-fUzOss1FH1s|3*gZ0)ED~8kZ4n?Gu9A-a-faGw&PF&fR_e0Odw=do{M;#Wn)wi^2ofS5K z*bWREYw{$g-b%g7r$njBfV-OaZucZ03_Z-)KUYeqs!?Y%I>R+8YB_AUU04auC&68^fD!I$*t){^-OMmpr!V4bm`zk zo56*AQ=?+i=I@XJDZa1Ne4(Ye5!dthwCW}AR7fki!$w{5cl{-PZ&9FEGS)PmZU=uo zp~puW*+@B;V+z8ssP|*D0NpglPBPwB`WJ@1GUytKO3yjgSBe{P%YEOLb*~_-LB&%~>eySe zb2s?6K<~RK6;*E8$Y=3ORZ;PDt;O$dqi4;wd)2kROo0sM#DDeMRI*N$<9IiAA7D!M zGEacR_QT7K334|MwQJ=*=clK4=2FW?3*{B}ntiQITN$j7gZc^2{Z`%sMF%^L8~_do(W}7o^@E+;Qyw-k zrAhrK+6f#IgNmbv`^dFWp^*9mnKtl+M*wn`u@0VDJr&=&yv-C7g4J2 zyRa}_h@%`mFj~YSYH`{^XKlB?R2^1a%pz@!WfeW*GCK5tmq5zFaM|O_6;~27m86{#khliDtN%j2L3#tWbhkJ? z-Ef0#RHspVyh^dR_l_l<)7~^7nNO!|nh8Kz$NFs*&s%}iBY6;K(IZDmBb7`^32b-d zD?6tezjlM>2%SM~h_PFOx(3sd8CozjbS&COo2`oaoR-ScD>U>+U#-u6{tWWlzqiSe zQ99Kx2lW1WAh%*`?Q&XDF+w}Pcg)lNEOys`jETiv!Z@LoOi7yz8BK|n-##=A)!>z# zmZfGoxhof}7QMT4)VdP%D%L5%-92BNJLQAvr_zJi#bT6H0h^Pr3zc4eJ?Sc);?vX} zB_}_*ylvegRT|W8V<_2B&QWRMVivb_KFzWS9OXK*JvmXD@8==-l-QkOG|k`t#olAG zzPiv>!rD(o45?MI)G8-F#}tJ8X|I?#e0WVgcs*EpWkE2@``gdRW~||kk33$}dE$px z^y8Tr&_2ybW(06V#M0)Gk*<~VbaVSb-HKZdp8Jj@OhF9e1J^MaAT`|WEdj40vD6uB zgTvp;x%gebF==n_O8gK5-XR`Kx_*AO+hgM!tT=pVq_}l6FlD&F)d+k@b1(Pa*W{aG(m;igFU%+7khJa`tQn&I=Y zlLPo(Ouud9@VZuDttGt-4Eg^4lOBJP;GlRPAZko->#oAP?ITkcy1A=kb*I$&oA}uV zn%$Z`4xf^X@>^Ag^epZ&j#tQ!r(G~)?r_yGjmYm!47ERIiYqCrY-vi7Q)y{2Ri1qY z%?x0MAHVc|A}XTsWv3f1fqZzs>oj_PNsKVyc3|meT8}%QKfKyxP|aAl%2-iWRjr=! z{xEGWI}tBlX_G>Bm`%MIQoN8py`}|D0qIDxloX*i14H_GQI&iRyiKJQEbSEU z^$n~`R_EH?lR3UWWVW3&m2JVFXOIaL>$tR^l(d{amM9nzmRW5I%4rZ+;uMJ;WNMo1 zuPi0iNcD5;(O4Q2?Ax|IYdSn;U$gdmFwLPk+MHpw7Ha=Ed%F_d62mA(?xpmp0&*OV z|2XTPGT)onm|W~}Zri~khA^AW+Ych2nQ<~Wr;YVVN#8IQDvbX4pwfXV)ER*J$7VuB zG6F}~c@Y}iekGl zer;v7KCqHG{@T0@i3?hnWa^h<+C@LQ;SoI?x!>dQqUF3tOxJ_EwZ6rzt~HbapO=~k zRv?W?VcYR02pXdB+Jo+$GAqj}gCU*3SM zEI}~d$19VMQ5hSY-~T|sugdBj1V1q2km4WrALxl=jG4M?K}a|~U_T?wahU4#-Lzt6 zIE|T=IU&Eu#mz8H3HIRFA6?sh#PjFu!h2(6DRMh8l3iWt z;XE^6=^&o-v+l~UuMkN96p#Ah>7knnw@UQe1btq~`3R`%>i{Y%4T8IT_*4azOw`~u zmO-)=9tv5q$q$GPnu>D*BmF|wori?B^;^H5weGLNE4>{6T|>>MkwGmptfF)LE^p`% zlLl0(BJAa-pil{B!O{L+cUy0FnQpV;Sx8h!I~|)-pauJdvA_r=BobnZ|xclJIVF$ z!~auB{{QLW_x}teAmLy7y$mn{-dT?=5d^_bQLp|5X86g83aMLcQ&*ew#~33%l^Q4?5}Ad2 zf7wk0p~Mz&>J;R)Nk)rvE|N<=TR9u8A^+a_-8R&4f8G=@zkub{iv?u_my6314#{q%B>q7q2`3z`|d*mqV)bH4~xUWb%_v;+veV% zf`+G#b*JF6Ef$s)s3>r<3{h-%yEN|3cGglSCG9-63fEQ0R>3#k->}!Ts9NpRyIhmr z*kgoFCEWT~bCCET-BNj6Z06)odW9Uarq^yX)g*ut#)yA}0rzSVVqCCk*i-NSe&Tg! z?XpDnFEHhq&{*~<^mgEf!Qjj(j)E~TmgHvdc88&Z=isDOh&BY=w5J}SGI{Fzyh#Sa zrhr%#qO;B%7xTI49YX0Kcksr-6!tkY>4DqPV%)<8e6KJ}047}(Pt|RrEG;GZ0=Yap>m7yln&uaT3e|Fu!xQs; z@-Vim8vS!&_sNml9bcHl59HY177&ARwi3k9iLn}8rJSnzqW z_7QYV8wR(Mt(=)<;{!Iyh_jcD*ZQ>>WPf?@quLYHT6Y=8!=VdHm5bqv9nJgpnr3S= zJjwri7rU-7YB7G_Zh`<1KZDC3Nk`vaP1q2;@V-8ia~maHtFnBp z2+-!IqJ2X97nJmh_@$riVTn`K?F_xg-7&T+x0B}z5n8$$xvkaOo+1Xh*0G~H3d>D2 ziftskeQb&apRCocy}qA!dC3d;=~z{qV%tD7<$UxXT;F<&wF5e`mZ-~?BGp}P3Ul1K zg4Ip=Q%Vlf?7t*tS(N!0a+K*6k;B`cMVvm?(>AZPe$RY#T1J$ZNfz5hz$lVh z;5c8G0k=9aX(`N!14er9$JHLIsJ=XmInF|#;pgr1;7U;Y>%%2pUv7{6TK1cO!&Cv3 z+Tc|n+VVahDG`)^Nx)hr(VMj}j^mf192p6+))P@300+u%8-e*PmOHOcgyh<^&ZpQU zS-2V4z~Aev_%#72aAUzXJg#0=`CV*0%2T)4he%Efh zb;V;y47Us-p^Ey8>w1)N`x_X?IppvFi*>-+*oD}g7U>Ql8in<~fq1vj+n(UO z6b_YH#_+ai5^&$?+1VMM&o40IulCHXzu}-ov~{c+$}=_HMZZA3`YRwWLPLa3lkF%;Ulz+U`qoP_m zks&*0s4K2?Y=nZP1DOIvBHrk z3zgZtNEEaY9d*1$A2TiUJ8lbblJpMT%W%n!)K43fTBg`Q&aU9tO|R;sdVu( zXvVfRwC(oLC_zk2Kif2`wBHsEjo|RIZz`DDDzINWvh+X0??HK2m4C%8*%0ZgDM^K$ zbbwYVyD#eJP)8+UQ>CSuEAEuvQjhE=0u zSq0qmd(H_1I&!QYYO} z+sS&n&}qLMxo8(S;GDYw@g(V~)IBxtUz1Bc{WDR1Tsl^cT>`{#^IXYF{8C#{3kUJ&` z`2#gIJAFtUMs+WLj7#m`x=Su^SB1`C_IsgbxALJ;E$8f#(Q79&*O5}}^}lVI9WzSG z_Eb>gU!c@4B~Lt_3gwT*)BKxNHc9?CX;6&T^S`c)lUYCJpU2++Yjr`axUfD?Y|GRC ztB#hhGr;62n@!vM@3)yq=8v=Rb6!!D%KY7pm}#BFN_DOFLp%zI{B z%g^zAq)~e1#92!IRjcDA7<+&@ju@#>jF85Y%gxK$Zey_&7t{NVY<_rMmbBl78Ys5>uJ7s@S0{P_)Hn6O18>HLr6T$g5Zz$ViYg#taC5{_ z{8|Oa>x<0Mt}6WA9qNA7XZp9VZ9c`2Vgluq&Ap%MS^w;J#K|w&_M`6TYWfu!^RrcX zwc!TUsA5~s^3(5gEs^QT+W>H@QD-C$KR0Afo-h`_9^tuN- zYYSxp60}^M>xofW?go`!+Mm&AbicA1Qr_~GT|NSt%q0LYbbvC*wV7qpRZ+X5!e;g5 zm8N>`2G-@G`E_T5%lpwM1Ca)o@UF~ppUR-5Of#AD0 zKb+L-#uze2inoZWKGsFJ;;UQ;L!Vj6?JEjqD*u{}P-jVu<9x5dtO3Qv#6^b4HfhjlCM;2?jB`3N zwdc7-yPI#=_;I#jP}@c`(Sxb#IGf!2&G%U-=*t@~ouTTsrd2hvx}Wh=&yT8K!TtFePx05zXj^OIfU{Yi3cRK+SgH+dckk zl=1|3t|Uf`KzVm%s175PygQG3#wcq4DQd{AQuCiTGL-&Us%DYB6ypC$SF9Nj)K`)> zGs8^yDqwlEovAmP*LH+a_`MNJ_PREQ0Z?fT<~IvJzJxzRnoOS{Iv@;c^;s_`|=N{*;mz zJ|FK!!9Jz&)g$WVeaMR+T~}MLo2!kig0{xfCHvNOyxv9m``oL*wa&DgvytrsJZ2Oe zoQ3LC;{5FCgTCRAnemR~Qxr9!-p6o>Ob?pOd|#$EKlrlq=DdNoO%G=9BK2Ktk;L+B z$;~t*J9+=mTGMCtLsQ}WRbGvZUaE1sO2v_EZ`z%u77B->+!P3xPCT!^rcV2OvtEUu z{^OvRivn|?Dg>ENMK8IwGbJmUH0=>pPQ9ueW-SitCR|-n|dG#bo%Zo>ttE!e1!UUqLb)Ob1TqYow z_Mq)TItf+G6P;8B+iO%=GTHsYfugCA3~6Mop{zbWN+7!AV1GsrOxQ=&A7xB-VsW6? zrc?>rC>2iAZOggR+=)_&#|Ug4@G4+0cGH1wdtjU0Tn zOtu7TF0om~{yVH0c3t!24IFWdMuC{dHZ2l?7zW+qg)3nIa~-W^(p6^pZUN&-AJdNt zUGuq169x#gt1gLjXt_{k0>X+?FdJ4CK^jFaXl}8&SbtxFSg-+a1-V}=fp|RG|!I??PQ|&j^e#YV$_}E;=2|Re10Q@f!Er#nrYsifs)R(8FDB)c*6Gkyxt8JuZ=GVECp*daE7B3ilx8~DkL}&t_ zOhYy(FkSPhKZg4)Aa&DCt5c8}YFey(D-5Wek8hIRdpSyamw3y<80SmLPv`mp#iS~5 z<>7jgerL%bAREur0p*3m_7iUt+Ha-9H{HhDd%B*5H8DNTDUL%9wXhge#cG_4_#U_9 z@}`}n%3gETSI(1sZt5KWWW~w)>OBW~!|;i2S%bK#_Z#!aPDv_ymq|~rAA9QxZMc#V zPbLUeDM+%N?Eds}*H@mrAH~<*bVLXquzl<=bE+A+*t6dLo|zH_VR2;kpy&7RclUI- zwhem?fMjb$uQSPF=Wp4McYW!tydPV`Ftpgp2B__uM0%LPgu8!=v-#e2MfTn)Q}6!r ztojp2Kgm29aN2m_^OI2q{V?#(FhsHod?op<4I_=co1z z25hwBqiBThz~EQsHLl8WIs=wL;~mZ_D%mdZDDx{$#hL>71e73hr(5_hQYJeeTdg%T zNI5@;F0q&byNog#zC>|6nE-$c&QnJ_J|H*WGuHO8aDKc{&CHZ+I_mu-?_*ZAu9aBv zy3+0hS8s*T;+k!TI1+oKPo6F&pJb0fq_0SxX8TJ@zEPr(Dn6lKuya=b`T9QBGrui} z8_;aGBDL(rsPWKN7$omUt)2Fa=B<9R^ZSn|M~zn3uC9k^6p=5_D~5ahGqzWRx@Lg@ zDGY$tD!gkFmBVyoII*@I-^*4wB6(;e6>yW3dpjRtt;&kamaYL($BmV z&D%7$O|q?q$PeXp&8)bqVstL?mt?c6H(M-XwUlb{F}h3&d+blw?7SdSvi%R5x=X6k zmp(i?G&c)Q8$Cf%6u#2{wXj61`*N8uZb)g#`|zqzBw~?Uje3k*-N%X_+dYsGHY<=n zBq7&r?~EG|bcNV;jPEa2Zpcl_h!^vviyXG~zj?QT!WN*Sr(yfxf+1~o#p}@$M6F@6 zN@Q)`z22iI@=?gjE#^o}epIoK6{PMFsoOh`c@_~2RDJzJ7yzovFIn|d4&0{f7#`!R zk$F;;eNf56G1!-;CDhg|kIt(?D?WmP8^02NbcRhkuE}oLtCD}KlFY(tH#9n#`Qs&9 zcR7RLu_{*G2qj%Opo=7tVl&(D8LwcpA%K8sCDE=!I3E(6m?@c9c2Tt}fT&4rVd-H|uyFLWZz zNpW2##d3^Q1pN6SuNpI=9iA-NG%j<{ldOJF7pa5bP3Xea4)KCVH!BB!snCTd$8#GC zBQ6WENC5kN>D7MX!}0mujE5`!+Ta3qG1b6YXYP`R?DIB_^erD!UvK$I54_sgx)O-_ z+4HQ%vi!w{K*_tY7f(bn@P@gy2t~fzYfmOpUXj8_rN>I6;q>17cm;~yZt+-wo%ciS zXg3~WRxc&rV=4WHl2@F1I{ys1Aq=|%YkBPE?N_awyx_ujA5cdRFYlzTRz-C4et(}$ ziAHqVw}PJpEC_6ym?OWw#6_B!+d{t8^aVd+o)R!ahhwa>GqcDBLleqG8xkX~)W2HC zUAR!cztBVZSzeDKtjLcWB|C_Q%{^g_AKvXnReF3wj7ssc=p|2&`$Ppo37&%Qh#^3p+AqasR!P3h$086XyD+JK@y)0(=mbeOPR zjmGInoVR4vn%Lp9QZ5Sj-tzH`j4-U-E(BySdt`l=Hq~ztq*^P&uvz6@n%_}!;A_c} zIHX+!qA42%n~H&-3R*22BbUA;Ly!sUVlTV zZ^REQ9W;{pb#k$L6m#dFB&}wb!JmZ2%~oYn&kOe9yKbZ>YdrYAE0hlZPTEGPYy}D& zZH+@Y{*_z#!nBb+ECm0h%X@z@%$y%dtPKHyWOLVUm^lyr{c$qW+TTxM|2tnK|Cdt_ z|9fKKmrVXYf}z(@AJw8j)>?aiUn?7JbjmpJETq6!D)6M={XJ4KP7UYZH5(iboD=s3preRO`*=FXt zU7n($Nqqgw>uCpv2+7kd)u~Toud$7PaL)%JSN$VbfVlw!3#dwX+{53zNUT?u)QaH~ z%z05H%R*Oertq6j+68Xf;K=qr=rz$Wb_8dN!0mVn{$ufq15 ziGntn*qdWX(aXXyXzjtK-Sv29b1VN+6~6Zk?U}{;w!_lL9q967p1k(;2qABu)=B5f zmeVr6=$kDg%C3O0+xf?*?UZc(rhe(1Oin0dk37}yOp)1Bzmpxg2Ip)~$Oo?l&guN| z)zv)9E?=z{Hns zOS|^VqLoZ8X>OX}o52tU)aTQ`|1Ln0&G17c+b`uQEwlOWrjEfj@(y13Oo@UJBQv>_ zVf%=(0@mmj&jvC3*v4_#RsSF^Gzdl+eOVwSeY)G``SqB`Yqpv9EJK^D%}2)W{q1)J zGH%}r0Q+9N#>P*xE&H z>Z#Q0WqbFeoRnoCZ^P>vou{Bw7Eag}Q&iY6BKnHFOd4e{+a|{Sf+CpaL*+I>%n!2F zo4Jz@x#F9<#BFSRsP^YSFFO)YtyIB|TdjP&x3U6k_|F5kxU<_XIsN0q>c$W_%tShC zc*T^&xCiT)uU@^Hfm6sdUvjSaA6T|OU;Wf&c3sRV3KS_a_9K#wb%gP}q=|p%aya!U z0G}gxd&u`^dDR!f`H$cXB>sgbI?>3e#E;Va=5zkowJU7d)@a7u9Aa-(a?oA4D>0)< z=6h6A2}bY-lk&k<(QH z%MJ=24wIO2Xr$Y9mvdCITiPvMpNLxbGk=<(h)2NzBFQGNI|-Z?_A zf6Dx6XG+)^BZDQh+DUsqksS?Pu%~^Gj>pI1>TSmydd_aj2VeN;lKG;iQ0&kE#d_kK zz(6Hp)gG*Vd42|Ef4sF=a=f*fLo_^GG)s@sFLZ*vh@KVI>H`5+8*heAUXQy}*Rhz4 zubzD-h45H4-fsA}yMZGwW_Gb%Z)jul*0*{ezCQWU539VtaxDl7s<`+G+TQ$esdK$? z#qSD^T>a`eWM~)CH5t}g{e!I-KQ~<~Siiu_x$+Yj()(o(0ZO@hycedpkCgw)6P;c*E;Ci)RDhCB17S1*Y!4yamL zPxrd|zBsJA$-;%KZVUls@7s?&PAdX*uKK@Fy`nOH6OvCYk95`#4_4)RR1qTf*fy{- zv)e-x*juO66^*pN621jzht*+Mepy;{s8&g|7sE_V8ttKnBSSb`R^OQ-i-=5t%}NHh z?HYl5{Vc99+j1AK{Z-S*_1Jf?I|;~)`K1p#_-B^!cBD70KOcw{qU}H(2(Bx%W=hG6 zalpRMsBZWoP7m6@ljs4jCzlzHe3^LN`j^6Qref-Zv&5pp1|$&-U@qRw^U#_W!mkIh z&e?2mq~t~RF1mBtdwJ%dtQ`FCSM3KbSOmtp`VO&v)Ou|u>dTIg%cYk`OP*X74L=e( zE$%3}UY2`E^CT;6`zI{>^LuO$Zfzx;AMzJyjR#l6&d7D~YS5kws;xW6zck9-4jl#`Zo(eQ9 z-Wwi$fHqfuGyYSqa41YMldRj)qt|sd;)l+yAOSz8$}`P_`seP&#~deL>>`fEg|Ei- zaHm2v*E43=Qwl=NS>DVw7KBJMG`iF(!0>Z|v(t6Nmk8rx^HVJAN%S zd}aIJx}fj(W>4GSg6_1P8fbb-yufwDa%j_jOT{uI{}XqR%po>+Bi{b~xB2r=Z|ANS z&<3$y)*Sb$ENyd=3#8$+Z#4oqUQ>jqG4P!){J9@0#(Y4}flEwEKuRy;BzbbFR*tmc0ySVQU_H z1A6GwFMU-!2j`H-btOQgf!3-PGsaNW*T8d%ayZy>J$iFzObS_o@r8bXsqJAlLA&VT z4BzSA6rr>@H}$;7$HyH{+1sh_9XNI$$+ovj}0;fBhx0gV%8zzeLsr& zbu7D26-dZ^=4(C)l@Z{Ng1)_l^yK=GAI?ROtwY>khDsObvp+AS+o_f>4)^Y`YDB*n zzO@0|Q%ln;SZy{BWNMH@@RNnV(Vyo%LgXFMtJCy8ipKcKc}m|}R z<-(#BAC;m4KNY_cO+tUWlGgUe6cLjyn<#+ed~_j)OTY>*8~#7odkd$yy6#=Dakt<>8VDLJxVr_H;O-JUxVsbF z-66QUySux)yEC2ld%wBA`v*+TovPVY)T!z|=k%7fmptoPn+={PEyXog>f-hnQqPA5 zICiJ-S__>YI4u*r2pnch)fnt|96d#LE@)CCoU+7yR?fv1u+~CK@Kqku%@YR!7rT=kSMpa7-(3&9VoOb53xwcim z3D_m8_p~~cHKDHO|}m?Z|uLN$Rp`8pWdMB$*ceP!!mAQt>@tJJX5#x zqN_7-Z`y0Z9UY>>(w9|~i;!c(87!9-q`I8ot{S_WWnMOLb&$`>9!gyMRI?Er6I3GmKHcsFkV2pkcr~EjN-uu+MgIimeZ6{M!`vTOgh%k$q?}!Y z{iInj$i^_cpw)lVJ$%teWwpWexIg0YD7K}_ykU;Tz3|yX32ffWfu@~x5@n#@$;R|h z!z>ic{xjpA6J1X{y$7C->ZPUo!}(`!H)ddLSb2Bic{74eb1`h}P2~1cO3T%nHGL;` z``f2-O-B=T`fCCfUiK;P^kzOofeHf0mg~%~orJgDR*4dx{wJE#FWPrOewWKinRlV@ zg2xF}D%~5?;9mJ!botW&+1tCtLiN}9<_Xw&i}~}~sFk9hZutdh(=YMw3I3LI?evF* zSt>8>dOCT$x6lqRG!iK+@Y+#=VAv{{{R;;da6&iJh-+P}Mr%y!kTO*s5g9Tq{Cs>H?KX5ZE{%M=1SJ$-=gO zSz`6g-Z1(c0&?-_PXP&8XF9_K*xxZsu zE>Y4ahc72nSqumQlsIIDj9KGVWF;SA?d~F^N}JqF8Ob=`c>x%PB%CaP@pk>-Q&4qA z*H4qLo@qwwz)m{D97-#%gPcP_-G%nZaBHX)hLbgXZo9U4gnmC$H*Crgt{L~}O*ER* zVf}lKDJtP1-j0(31;bnfZJ260l_7~7 zOhAq>onG8bFdIkSoI2xb3X+`|x2U5hh;empyv)#>8d2j2-51$*KMKdQ$hKO(U|{pf zBy-YS!Q%tl+*Qz&nCUsV#Keyef{}oi5a%x5nvO`59AWIr4A;Uj{dDU;+@eR@SM$|I zFkFPDAhXz1HW>AhS}tR1#v4Iyn6vA?W->m(4865oHein{;Py$pK$;!ouU4HIjassh z`>B3LaWMGvlK{7ld}nK4X7x&wyne&7)nWGPmSO9u?EUn%Nr58*q(Xu_2+~4gz_X4n znt74y2R0U%51l!~!(rU25Fk_^vpl)3Ua0hd!fK}%{v%}1?*)}(>;tMfTnFc8vzm!& z7ZB+;O!9$XwMeX&me+1mSN5t7=l)xfPDsC|4@GuH1}^QDSy|UIBH@PIndyO%%7zB+ z3k^qD6yu-F%`cr>p_uP=cXn7*TcmI2MY*+q_!w?TxS16{A-n~@5VJ2G6a|l^60E-uymq`=?VDe32b4cXlM0x#jJb35(zWE zuXsYK_?a8>Xp+*>E{hyPke}0R@8$~++0W2(e9IVdy-$r1J8d2iodLPuFnu?RERJ20 zy%}K{S}vntzK&h=xL0a3!sp9DSLPtl^W*MHVAComh^M=580<ybFzqaMP*YsIH(qCJqI{e_{KIn!a{haw%hP zr9H6(Ox1kc`#byqu*pUz^RL~E;90`9NF46$!!2Zd@H2Yz(k#Ks52B{j4 z2i%^fxH!WD7#pVo3;!BqPfh_>#vhlE260!eIXg!-wfOnf71AZO0`^x9zREf8nXZM> z`R^|Z^*GPaS;k^R0=~%3bpMQ60=dvrQa%33h5l4THoz+V~8>J%D6zv_T6wg&j zCRF_~@7V0fze8_(BdmW}xrsEU`XhI$RYFnlm~`eI<*^&hJ>TL}xkR>t#(cOqtW=2Z z-nkc1e9c#aKt69mBsuFo?JMxb$3~2_^{?9eVsNH>kqz%=)olkG-Hl7y&TZPx*6rZV zCoZ;G1fBH@k(<9NT1yuY%&zK!>Dmt<(wHNAZcnG8yLn*3-b` zo=Vy3vvDidHHRJa8O3_^aDe6VSZ>}%c6$AMO6v*v8Bi#Td22uWea~bbM(ND4yD)=D zfvzVeCJQ?Q8n1Z2#B+#%W!VwCW$PC_cs@(h!P z>%m}t6>^EsRu%V@qK?PGF~WVy^oT^se%$^pN3N!<(!MI=8-Os9nVrpW#;m$NPrx&W zGjqH1LE!P?Odz(|Fq+@M(xT(M(^f3+&1tH zE6sK8p3^6wZi!4^23thFTSnJ2J)gR+) zp(Aq6?F0@*t6Ev+gl04rRi<`$b4h&lpFe1l7R%2^Vuox=D7tIE5ei~g9-F56wM-y9wPX^Exi~RX=w%wcL{AN90kmy=PZ51M6?h)n8 zBY{^&fGs)wE8Jjd@A#rZar_Tw=-+mU9R8u=Mw-_sre< zk1`;=iOEie`48IFG(U6tq5j^tH|H^hQuen%4)1mtypKmLo4&Ejb$6(7OxmieNM{6< zP2-EPM!{O|@%lQADyLx!=e8OKk=yqZ>#fWm#s*z=*9eL0-V-{ubocFTXgNs_bqH9S z>T@0RZCk&jy0q;r!#v&t&F?Ng(8Zu1;y$PfE0!XySC#y9*y_KyWuPO^959i0ZlwjC z-iy9A@6);WY;YT@F?FRQd6UD!QwrQy>R}W=k>*7v2)<0YV+i1Oo(rkq*o=Rt6UoUp zW9qgM{HSUL$D5r0onYF6kd;ZD&AxF=Bd<5xq?j+_I6i6ES)!gxwL>Cd!*(m64Q3IH zv`xUYD`ne-1Xttnn-D^aNOL9edJNTJ-aSQ?1G+CCvohdh^Hcnp*^ww-t=bMrJ@^?K zjbn>FSzz9clo#?5A2w3^h$WuH5Bi0Lg9N6+iby90bT{{J23F?wg4y&_{pN$7@l031JBxD zq)*NDazZGV!IjzO^iXeSMSAQpb~A;!QPMm`m$yfzQgib-)SdPMdvn$l*= zlThh7BQ=O^CZ^qg3MVyoe^G1JZ*$fFKmg7XCi+_{fX6?_grs;@u@d?oQYneCCLA(e znw+7Auh~2DIPquTE3{b;K~3SAYvlXmf|jTfg<4NJ;uqjz=tDX3j3hOVch+h{;sZ}y zRy!rWNRf{gwF9NJVqn^~iiTi7_3Mn;C>>kEiugHq6gleLcxHa;_vo|Yn|h=3 ziseio<;DyZr7wl5(L3~L#Q?|B)(P1bQ>X?htNA?<%j+S%mxv_CNwhK8!c;x|ub(wL zZ@1`-P`$_jHDWGvBcv3ZQJ#h=RlpQ3`8EiEYgARP(!)N(V+UZwgMw!|*~mR_X4>{M zX;Zn|vUygbRDVh2_gD{JLgClW_UE)JVM2QiE$s|@`-Rb}VD9LmTS;DJi(}~h`>f|9 zzvfXUB~;H?X|7-u#uZkwL_M}U8N6jQ(Jec%NoSMt^KO1Rl^XW9J-1*}L&~Ltxq_tw zcq#;svI;^xYnlOCWjor#JOyn>f>u6D!5I}v`QkKGiKPS}cff_TJA|zJLyI#w%Fa6D zUW6pD{>&M7$C!up(Ga7iqr-S7(o{76*;ib^FVL+QxA$0CE?aav$81cVa*AiQZ@Al8 z#TB1t&SZu@xNpdALHaJ4Ql%ifoU5M9o0SS#NDny^iA;{EN)V12oQRjnEQSQWW@+Qn znzSV+kpNlMPKWRH5wj{fDF0;+$q6LkC!$&Fv~Aeu-Mly`7wzTWyy3%>AO`^67{Vw` z#L}xrJ|pW;8$>6+xs2Jju1sG1|z%752M_fsR5|v1kksM-GvbB_SD=<7~4 zkk0%iw~#gGE*rQ54UdMDX?pLXwR&pT=TGl}i}31XaQDHw9SAdw4!H{RC0tf{RCEFt zaD6Utk76Z)<^6uABeX&71@R5w4wz>F!td$y67Y54O|-kCOIRmCZo<}oa29=CQ3!Mc zLVI4_I=%}OI3S$Ne=*x!JJ%Lu`l-PnK#13@nW*$SX)-M z8|j>dzdlWq!QwmK5gCZF%XELQ-tmE?Aw{Ijx67acn?xj)GR58P4f+Rs>DLjRDQJXd zBLvS9uQqcR|4L9JiQ2keSBy!m6F2-5L(7@}8-+AoC>?iHqjGziA(#N@aC7E$S>a_* z66I%LR7M($tmshPD$LaadQkpu;qHRb8BQb^(OgBOio(!O;CI;w{xl+}n@@=$UOmDc z*!DS}yTpZm*qwpXxBj|!;nZ~P@wiMe%Dh+#9%wl4Yf{lHbMcz!AIOajZub};Gqard zvqgiU>Gp+A@;OkBj;`fO9V0D1f|ZhG$lxw7|C)pgDOQPmzY|fO$EI#uL26!rxIei7!}>pcq9Pr+Mj$2YKIM;oL{8!3LMb_RF1jp2jNg-lGM6Fc+E&J#oSbK zoHSs1LQJ&y5VSBq!Ii2!Y)2>K^~D8mYXnYb7xEKvC%BsOqOxm8P;JxvSfC(O-=@(@ zBe=}6MXvi|+Si?SQs1fsf?icOj~nXtsPcRoe|3@bc$!eUk?=86K`rHT?zd>a$Y~%8 zw+F}go+>9)6;vrBXQa-bFuTQ}$_+Q-EbDc3MC+falhZ2Mbb zqL0dj_KgmZuhM@M;*7oP%&WE-|iXMEh_ghZ5a6L4dB0 zGIEA~a0DZ~WsKZSCHA=Gi?%Ln-_!3>OOT(UL5-5!h!R7|l)TwUN=7@tj$KoMc9xlt ze?zoL2Qz`rZA8nLU6Sy~CiUV*yw=Ek-f`>Z!Z;!_1qtxT+zfu+E1~bcZYk)0l8yI3 z2Eg!j=>hV0M2#~FW9e|hk*@#C1@Pw8yti=2XSv?ZeOSvvij)*^GW#?&u@hPJ=MO`A z-0dwhROZLBUn7S(ZN?MCx62`lE9{S5bi_>*XJbn&E6+>w$JU}G4@ULZqS_X@ps$d# zRC5te3Y(4772-H3uGDDMOSI)7=SezHsoC{TsOyK#d2lQ}4s@p5(*j-=Yc5dzfL~R3 zbS5|sbQR?M>)RFK+l7st|yg? zK`R4Qxp`3Lo4i%!nw*B5 z=RI2|GaC!pw?|mf%*l?HOZ9s?#q4RMaBZo){f;n>Aa5b0p5`Sy9H4RFgIr;dWNSZl zZvMe?AIkGql)QWOOmpgb?p<$LToqwcS_b*da`u;-uw11Lq9q(P7Tr_WrtV(dM-ZOj zNI8|3PNhp;Cw=G3HX!+Nf&ZH<<;trS5)<=DyyH<^MB$@cGanBfW<}{`<9B{DhgaT^ z)!a$_{0B+*`@H3h1W;8il9XqFEd4~`zC!M1CFkr1wFePdVQ;3!pfeBL&cnj+MZn>M zg3LL`lE?FgDA)y1%o!CT_I-ZG88=sscQHvXROajxU1CH}q=&7|=+72s%g~jf&7wOO5RaELiJN}3#I-bE8OG?W;4Hg* zBzb?^`fTLd3fNxrRU-Y;I;I4%MTlqdSXB`l6bIEcVAhU=zSor+cw&M}l$q!6O4dTx z*CRL2V27S1=0az;f-5$kR*I$W_|xZEtRp4XAQL7MI21SUMx>wuTI!)2%HVyT4?~G* zbCzW_Fu{2#G&3-MgyFMXo>_Pg{0Q-Fb#3HPT09Lc+W?_D6Gsy5(9P`$jpfXtx#a$> zz7mb6#m~nwK*75&8s!*EmhS~F{ zo9yFVDcE-oC@)BnH3@5sXwekCevbKc&3lL?aeuSYn+40tJ3ICN1i~AQD3no5cN2cc zIFiB+P-SUM%2I7JfrER?24$+%&g!Q?tu{&wZc%*8ho@vy*Gf#>V*^@unw8RbBSt%@ z-5gjL`!j};Dtf+k*QY^4BUE|Uz6y`^z~6Ip79je`dX)dS(YnbNmCeTn6(aS%+Z^I` zLa;&6kQS^+!jgW72cA%QK5btP?4$9R_71(B2dv!tH~Jmyj#8;3aoG|tuboIfkP;xl z7O5*s=`dREcreM?U4s~$d@T$6LCx(mSE63^?U{|Uj=_)Yh!ABIKkUBMpx6`jt!?3V ziE#3nFGF>0`OuU|xPhha(00hQs$vb}8@tSGCf2edBW{J&asPDFF@q}kJh$&I#%|Wz zGuT*DoO(#Kd+8!6)JyIeLzziA1L0Z2Ik4Y%s(H{tP}6Jo>YUbhvxS?B^!&Op_xkC73W$>>F1rm zsgUx%NQnhwMN0HGQSrL@=xVLZ?8D}bFNqMN7%%8 z{2N>vat)_?78$LOd{^t?D2GkwY_@iq1g3Ggsh7`5R#~mIuU*<3@xv zoz3>Jk)Ee?Z;L%@8;e5)w|WGp{GL z*$z7_a;JB&NS^DUxcRHCq#E1D2ES23`bI?DM`B(VN(8Zi{Kkl)2Q)Kq#{I&!sD3jG zn(|`J03GS8ov9$}0fNjI^7dZ>Up(&>aq8U&d#t}!bT39*k)WZW{gU%sGhKbE$xUi0 z#~V9$m#Tc8@>p}$wF4q!rv+U6mb=7fhl4m2Z*c@`RSioyFu$C?0oc%$e;aY#xB=ts zGmq;iFg-BcE4bIT5Nr1E2=2( zt?p^#A9s#>eM!6;`*;HTN{1Wv)@A!RA;K0uNE##jrJyg8-w#O%tRM*;v~DEf4I2a~ z2fzLBfZ)OXgR`tRdn{jaWuYn=esX6dhXJB1xj z_?{iddZmjT2pc*L_%nB8S|Bo@sKUC)(nzytBOUu2pf_MnD>O9J$Fhuc0fb=B^Gzl1_ilOYItuf>k}J}r zaDS^ox7D*M_!$C*4+reL*ZSx_D}(5CG0`6=`ym&@rY{ZM3E%|H_rDD(C`0IRCs3%7 zh1**QqH{5g>6>_Y^tIjv#iA2FI};cBMhXWQ%KLzS?Pw39Dq}J8{3P0YHNEZ_7bPgE$0jy8kxt|M_M# zI1qj7zuyQ8lm2fVjt2by5B|R}In1iGo{Gz7m(Vjc&7cgiTRxEXNR8mXvVfLvI{Tf? zTSf~+;>dsorIJ6h2ioH`W2f`_|D4r8>^6S@w4?q+M2cQF|K?8KY*GG6AD<{DivTel8wLFqnQE(Xy;a~G%YcQ;anEybP3aTdO?iB5KGJN}7m+R|jb zZL%fExf!11n`&qHauMX&Bz%ytRd8c8J^#FNYgt%jHGDB%&e*DUlisZ_ zu?{O0p9PeR{PtHNtafylN?ajOvs;;)zQRtEEyffkY*ts7X-hi9`P_kW&8i4weoH%M znQAg|K8p_`Q8|hH{m$~lmAAx$Fha`vpcBF!XS3ljqT`{lTfZ{;yu2uzvOt^eH(lM( z=QwJZ-kiWgnhBvo@w4NQtK=L8Va08axT|WC04RA7KAW-f$sx4Wv*#D6r*0q;)v?E1 z25NNB?8xB3sO9qlGZ)E)SlR~15jVOAuy&y9cq3VbP{O@6~14nTC zjpa?!Y4AY_N%PKefrPm#j`T_v$W6ARP%JM15-XmCa*E=PA372&B{f31nARd(=CQlO z?Bgclf?nJ7ITjx{604$%K5k>56-u#1@f}g{or4~`M=_127?S(=w_|;3U%p9zMm$A= zhsJ4O;c#G}w*uYZFrzZNTs^1YTbw=dU}Zi)B69^_}o?q_1^z!qN8v%(R)54&GF zEin>2$oeKAtKfqw$Xj^CsNDi%sRZVaxHQ}E89XANJI3lX+j#)_c{bg6FRhB?8B%)i z5z;r8{66LRBi`fsDB?#I9?P-Ot{r)66P4pQj%Q-n*1aN}r$#PP?=xp7`J+C^&stfq zUY-Vw;Rn-qs;4mN|A?AUIG8;rsNQvf`1H1qwgl`u8N}(m1jpl1C!#dJd>;dZ%->Aq zjTs2-mq|nr34FNErbc8pVUI(~W^5+lhc6aqnex--I(6LRlaG>BXKfBQBfi6Wq@Fve z&Q-vii@#TDc+XO)`r08}yiG?+Whipr6Fn5w(&Xn*9TXl5dXu5CN zXW8;}L7RODDX?;9kf4r1di@+A?+u?is#rCBecluD^>-jFp9WE)0>Dl>NfHD^4BrT%He?+QX`7s^YJ2CZd2kGt5X8dtXwv z(ij7J#o|{9`Lu26$X+nTz5dQuQfp@pIrLDSbD?G*1*nOrS;%NlKMN?ADV0)?e?M>D zC?6Bv3cffA-IX1_ynqQEdcCv3O*xMJS})So~iTz>4A$uhdgoPcTmKAQ85#w_M_iMY%n3Sc6IdyG9Z``)v~yzqKI@M07!&f zj^nVz81TdxF~07E4j4@!&yviIg_IVX5*EkYq~THCEb*r+^+*7?5`Q}N=Sw=evTu-e zzFc?!Q>LLguqBY<;s&vHiso^Dt8f^Tjvt5T_UYh`*(lAg?K8;KelEA`f|0ey)o4U+ zAC_or*1T?qmNS~U!vka?`A7ga;rbGU2sDd{Ty4!n(hyZjuD4i6!dc-oQ)8`KG4`;9 zF!19we!r3cEZ0nZT!=ml*4=G*^i%-<2SW>8Q1eIBM8IT4luL-n0_1dkCFW)M}VYzmQM ziXp~Qq_ipXwQkkAz*A^kVD?px=D(Osmq?O+-{Yt)fh(^NQq9~`KNW40jVGfsvFrEU zqdl~$={lNCP*_~ZhkS+X;*+L={?j&Jqs~Ix|J+TDrOy@f&OnlS_Ip<7<%o%<6q+Dk# zrYT)GrtYudb;FE9B$Kc8$fO(p?jeyRh7NF6jvs1ji5Qo$&m@`$j7aWSiORiYAC?m1 zlh}#i^2;Ps7b@C5(n->mq>Uj8nxXJo$x*d&Ir7gES~E)$%65&&<)&E^0nH?tSu*!S z!*H3`yS}fPYKTmSb&|M4fmua|Pllv03%PWq6LF416=ZfZJ*BlnmxjQw$loz?1Y~Y=DihqR;VBnE2mm< zM6PIxy^{TnG@Y1|$}ZC?H>_*^0#a;BzY?O82LN=42?nW_@xO+1Fc`$6b^UE!`zwTft-$thr@e;9e@MtTb!r3pmV)35Tt%+_a_2vLwT>NyvhN948|0^B2Ni8m@$Sa@KAYm~^3vS-7M zQ-2(q-C!#_;;CgB&Xx5j%9Q%f1cK7$$CLec#be9Xaehpg=yEjD7N-JlyU&Y-qGfHE z{(wR$2t+a~Zlqw|Aw6x9!B*(jd_1lHC<)=e4!_W-PlbvW_^Agnin|Np`TJ1?C_mWd z%+`U5ZTU)v^%R4YL(Nk4gOWCSfK1dM)>I6z4(fK03-(p*cDpk48$kGgpMd%wJ z3RL|!RyLMwYJ9gfhMthieR5`pfH6Odh|iG4kX_4)@E01ikP)f5imCQ;)njW(sGKc|qUkICfY>4uQES7D z36NV3b6`q7>|hJ*`5`gQ;#el1hPprr4Ig`%qT};IHAyGDSvGo*O$rge!BcH!z`7OW zj0^dha&meisQRX5ag{qg11Oxxo0YA?yYt1f;-$!8QyT?tMtLzI;XeM6W&hXo=k)_P zk*Z|3NFL}xG_o7rkyoyD)dvIjlad?T9pB8&2>>#iJ9Zf1ny=7M>9o8bKc?Klr#J#L z5W!hSDUQ4zeYT&4`h*z96HmBqXs0dl)1IieSgacEtppiO?O2&_Sy%4bf+@d5`c&C0 zONEdh=U}D^0AzCi!^IXJ1gwYe(nLOUAH(6~4R)-m}24!t}%TTNpD0J3|d-B=^B{)zOiHU;C>zOSHdkvGZ zhGL&sorPIC{4SN%J+1{lJp5N5^v0Z4r#TG%EZtplP0^!pWO~pdBB_Aet0+U=FSu++;KWgNa!(|230MD*$RALwdfX4YA-lEvV}86%>s}d!1(sL zW_<);jM;fiO;Mrl^TKWOm~!Xj{XkgkKm>H;ZA{r$K;{foBqu`K;_qiU-d4xE_GLLt zSX^+8zg(fYfb5XZn29;v%0b`k>#|mkHx-;RW++N$Xv>%YAMQbWG_xSf30~wsVkBmP zAoD1A6l%=5g@8e%+aPq#X*Mk!3(fgA(OfDvsl{DX2!qd*c3F#w$csu@hQu-r2Wa^P zjuYXdxPu#CzF1YQM4Uw(wjHGm8QCUqjzZzy{EMUCK%dDFOG8a`I%^pV^6XP9&~m}u z9wzUa)>tQBzX4&K69xSJ$)+)0y7-xDxgPacdcLXx9qIA`$ZW*w>o;f0A zaQEclC(v zZr(^e+z&sf`LpfL|B-54B1mNT+R7~3ISI0R|3C&gGeUo%!f^X9hqD;B%lR~_@@psi zbB%W=A7R@U75xwRv7$K+m&*{8-|LyX%)TDheUU@0ARVY=g?2>gJ&6AU@^rNhfAvvA z3H+;bg!B47(J?df;s<>^>_o$7K}Z)lq?ljI{KOpzGJIQg%h z4i1hPK(zlak^#Dc8UGJh1O#3{r2lKnL6`5|VE@~#(EsZ#!NHI?{QnuN}JZ8AB?`NB^lZq990vRLIPG)g;$@xtYtBC!G1&{>pE-+ zw{p@u<>BRix%2q(XPWg-83ILG=z!0^GddjtW-n3GvAvX!qN@dSImPGmaalUBrXq21 zOX!T=p>-wgzPE^IR<{qJdQZO3Z)HgVy)W~J)_tXwS9jIZ=nSg=YGYyh zW6(-XpRz~1e}Vb1Uiu}q%nY=SO!lSvvD;7})kRj`P^EW(=-lpXboxciE-EDX@p*V+ zd*UW@U}{I)N&zEIbAFuYd5CB=NVM~ooyGAUPbck1@F3{W$XU6=egr+;5Cc>;Fme!H z|2~wI(k`0b|7)wA5BogY3i@BEOutlxNDt&E|23ZB%b+&oPL5zu5H6qqWRO263?n-n zK+u@3WcqDun;JlPrCf># zZd6Z0v`YVAiNcsrhfLSQ?fN~`spqx!_#HQiT?TR@zi#V zgMvmr_Rx(+)40?MOrY)F|A6bilNf=+U-)C?x|XNaKss^C?67~DNLTA$J0Gx!H02m>@VZ5*wIQec35AWbcO zX5gP;R-NMnA=1ycO!ZAu8(&{bQ<^)p+obN6 zo4;itd_Dik>CGiUK~k;B!jWqX9K{^N`%NazS# zbZR9$F#$|@Q-L1&)xjC;3YY<#GmM?yjYZ>_T&~I{(1=wVND~y^|2_a_?6Xrl>jdoV zb_l8x<#_+Ka=vIYiAoyy)2lKc-E&vpaZ4{tTu0%6sJ2Zit(2*8k5@%q@j-}i_;A@m~03(N0`0)8-HBuz-rj0;^ z21?{Vy4GIZ01lh858wY|Py4j`w=$GV%a!vCU|3>cK)c0)F@tKXcX)wo3XH!vq!cMG z-isB+DCoJ$q2cx-0%@S~mmu=;T-P{9z@k;nay^Yjq$exzA>J4~$XjHg4}9#|Qhx-E zhC42VW#NzCRFlmHAC@HY-L|cCatc_MO)GihTGbYg^3Qte#6|{pW$8&BK*4y8UW+9F z;bXN-%UuvTBg7c)pxeU%D{DQdG0!uY07j{WVt11lp>CXu6~Dh*NNusai8uIm&_!$|gqa=hA<(P8tyGRCQzipSPiLWPBnSRH$XnG|wG5l2@_zfn zV>PYg-CA+on;B~ASgo&5KK#vlA7cL{pS6xs(rtzx&R5&AEN#dQ7%$KL(k9zG{#rt`YyI_c=44LCz`sP{7N3 z<7b~f*9-9& z@P>iS4G&c3HlR^Hh_ZHG8y8S@H75{UD+;_#jkpy4gNu@g6x|1;2V?O&0zSNLal?-~SrL1;-q z9yk`77?SyuU@NB4QS2{C7fN1qB0kXi;6oS7`g@qd1b1WN8qE+`t`(q7R@T?Fe|`!BRAhS)ose~ge$dT7oFmhvN+4C+6eZ%&wB&0i0_3G z=Q{-us>R8awLk3A@>5v{$@Ic(3-jRmfO1S0_Td*u(&Fp}UB$shOc5y)FqZ@wN z4xwV^#v16U3I0x0=ZpSnU9VPI)c@GUDKlR(P18Zc^w=OCA2QWXQSWb4d??$Gg^WIt z4Oy*VgF{@{Q^RvEH7rWuFcjG5C%nDK4hnKC+v5YXF08d*!Ud(@c4;hh=wM(EF!bFD z6*CO7uh-8wij)`lJ1iKr+uG1)76|x7W79G$@xtz>4Jf5J+gL(8n)t9q-jy+mkCPJP zWrTYb5*$JN=L_frvy&{)2fZb>yetkGNYS=ugK`fG{`j@@!0u0McGXp+?A|dG~iXzVWI)wdU_x z_NOA$SD6Bxq#O``za?F|A!er@fcJYYDKzWJsZVdNtxjU{B>J?@(KOB zRSFxzzmtB#JrbS#lLz%a49t00-+SC9UDFu&2;u4Qgye(Q@q6iT_(I2{;`OmF&CT)Q zf&t2s(Giy4e~M0E&fY)nR{VKTSTMB_s`mZb81SzrGxbduniI*#k=tRzo!jWy6T98( z!H)c5NsgKMHwg)K930C9Fk_SBzjud#G6@nj`i&<-Hj(yB!IV%iTVDTYhZ#P3n*ZJ; z4nm_yNMeSI{E6q3fCbaE{|-SIKhgcKWf1;`llLf$s!tnzdKa#m2m1VIT2rvjuy?I z=)$k#cVd?Va7;M>81!PwcYW;dI&9mqRseQy+4tGt!BY5nAy5pTgAUE~Z)7h+@}lF3 zb$0;>`deP#lOFIsrR@GXTN8ZSuW_go-1;o--g+k++*&qFdGU_MTmFW?Sh7GgQ-!ZK zm#CX{Z^hwE=hgxTM3SHRi#I5AA=-Z?e0ebV$P-U8bavq*m!9sB_-7n~9@5TRDl0ba zCt#yX*Oba1);pKR*+Cl+QU4TgmGoLpc3&2iI9h8Lk$(%*lOwt>o8fTtoy+h&g+OKvZhMa6cY0z%&qA~e(@@F_sF z*%VG!EV^tI0Q3(sb49bh=1^dzLFcjTjV&9v3%X4&#uQ#v(bBV8@(_zw)^3lW&ER_! z9HPJqj)|8PRGCpw_?SXc(}!;L2@7WM-LEsfI2g+^ilbgkIM`|#PAr>O)ZM2nJv2YG zwLfrLTNGn-PxT)+oz2qW_pFQL!qg(2fEklcX+`1BESpQo_B76=QRW+CEM;#HAAO=*jYdBEu4km(LbI!z9YNP*6U;( zX|ld7W~Nr@J4_Yuy1Ov5Ii@2gH$6y;m-!?8fa~d~mCtrfazn5Fgqm3{`XrY|_eNd@ z&Y_Q|>M)MeY4newd1>49I|(Cvc3ydsXAR4nh#`iu2D01rOP1FGzTSS&@Dn345@yq* z<7oCTb3&OmdBS_G@%TK%?58WZtoSfP{Fl^_|BJb|42o;(_I{H9A%psg6tgo8%khw<4{m-|JlB8sv;QEK% zMzltoK4sZCJhkKY4S8x^HKu?x68YaQ&t`<;3VeJEOaH*z5SG#>xK-v-)2OeuE|PWj zjHG3w*_HWIC+0jaU3o$Rq|{(vuMHt=e}%J->6q+7_{59=CpSSj^98D!29c?3;%)i##U_6NLxXo4nE0fzx~&}6V1Atj3y5k%nq;>_4isjMb(!sN_@o80r02{<&5$)4WIIITGf~MSA+8l?$fhm6S zvbSFdrEGT>vtwXVXq!cjz1%@BBEuti=_&!g&uycX;e9;$Eu+~3n#vVHWy}1Y8{w#` z*QptBsDzPVxBLsXSj#7~flqzKM2F}ygan=tSnPJ3aTnt-{ZU{fHzmQr))(xDu(54; zK>6aA-~uz?LnK|>i*vpVEXCUR)cSh&x~xUKHf28wQU9Rf`_NvsaxPg`78-JH{8y27 z1b8$9H{gNYCtD((7}2#k?#o&r{1#jvpeI*^s2SVL2Y~;Le#z(7QC{hLPL%RhK0b)z zP`?oMofhr&-dfJg*`LAk{d#x= zX)x;Ne-D{<-k{m4F5h^Q64|o0B+@SsgY)1&NaoER?s_xc>44>s-L47VX3Z>*Emz8* z^5Nu_Hqpa_WuNG0+Rvya|4~S4!Uf)BI(02g?VawA#;CVMi!t7-Ha2Fk*x%UqnB{d| zc1Yz#KjNsXddPE4F3E?@0JG=@c)6maf%N*O!d@Cr zhTph2E8~x!{rF0o?P&UtLXE>2a7vRSLlijqw!%#bVW5h8ob+aVCrrAEqf;@`eA$0b z0HqRt*wN)mv8FD8VOp!@8TMvAGV9T_&9F9X6pp6$Vj-+u(J~CWdr-+xy&6dv8&vGDq7$ws9DU2`gwPdoOpV@cIT6e70TWJR_f4PDx%o zjY;S>q5zzLGMX4qs^YCuiI$t1d(eUK!+xk6-UpW$r&_dYNDCA&M=fJ@;)~tkAV6 zrqn;dFUQO^^4?7{bSd8@uF*s1j)rt){{rAVZxtqUrtV$yGSmNxLgoB%zWzF9wv8EXS}{ z{^=bErE~wPrP0h1UTl4N+(V29$LVO5uKl=!`ehuCn`9nMY3vDH;P@3|>ZU6)&PNXT zWj?fS->cS+wWD|Am^lk3`ATz}FHIy_YsjBfq?U*G;zJWx^wo+qNe%H1Yt-6eL;)e zf6w3fwstgGNP||m+M&C4)Qpa>0?0UWD*yc&p>#SjX1K{be{WQ_8Y?2Jg{EkJ?CK6B zV6lz>iG!oV_zZ6@=^1&h;6qlE`TG{2+?azc-#F>nmb{MgC~M?b>|Gn4(m`MWL7ADJ z>}&y>CP!=smaD4Al@SF9@P)UVFM;_^8-SeT6U$6@netFN zXTTM&fm)OB3ia$q)9RiDr}8h0WyUgK7V{WA4T;K0P7!9O-CU%v!*VPOztPlI=FD2Od?qH!iMLL#6=%SZQ`;b^^=?Q?Bp0gT9g)BoDr8 zqDwE`_$kBwyMox5O>-JPCU^}8S7vQ{GbcE1KT&wvX2w6a;Mz87)5dtuL&()V9T8@w z`Zu@Ww8t;@vDQwA;FMK3ozX=?(^fRo5k65Xk8l7sN<~Y38F=_f> zzIcd4LSLYkvKn^XZ5S~&%2`@)RJVrLCYm#EHVERYWee7w#tApR+?^aN7;sSe=ywHA z|L_Fe-c2Gm_yo>Hv9b+;{yn58RAX_C?G+M!L#p3p8d=;K*`{%%%nvD?%M%c;r$OWS zz3`TG=|-2$cwe}MM9D7EslwaTq?|+Y~g@h|V z-mL+=S9l-m5~gTLc@Z&rsu9K5eRxdTUbv(zEfu9!LwOZMkJNoh1?Mg2!d*y9Jj@mv zECGGd!!fQ84+BP>hGO89U?o!Dc^l;=RxQwdDYey1T^-=30l}>7S++#ouFCk=U7Fik zS|?%j%3u6H+BV5V4#(xCcn=a5Yddx43A6Owa`Z+DcwkXQSmXEH7OTm>tRzn#=Y*15 zbggT6@Jv2wS(25r8L}Eq5#8_|iFnc5xKuNe|5yw-tI$8g)BfnHbbw4LRMbCu z*DaIu03$sgxx4b6p;5A%jWeFu_8Br^kO+cxA=H>F(-B5)ABL%LJl8WvyBSuxuMXwx z6snNgTzrhaH&&rsJ2|tjJ<~V{;+pVpHz-Xw>o~`_Ls}NG+G=}x+8yPMcHwDQu}5rJ zN$)33(b)stQ7E=p;N0=uyjj1C2)Bdji`x2emqY@3XBd_@9T5-i* zo!B20meua95zWzqvEXZ2MT?dr8l}S8Ne-9c&be38vd9NUj~Pb&1X?Y$S6L$_cIR)0 zJY(f?@L=S=SEHqoF6tN_OKBkhny(-txW!?TTIcHIfY~gM%$#N>Xs=E5k---u4vvoI zvE;ERyJUu;wKO0ppj{BLDgV+~5cW3GDm;rp!u+*KYhW)?s1pb7JCDg9LR0q|GSLV< zGmOx)HlHst68qhqI>NT<*3`^gA=JdKzTAp2KdVqAt?uOABbse|nVpqC@EHld-wEeh zRCjp2m9pe8S4G>B%pp)u?0Zz@P0=0slpuPW z!ogl+$vZZ<0uiyus#e=zRM{&E<1rtBk7KkSCP8zNkL>RujN`WY2bN0-WBFG`DTb`@ z#05%_r=FT(v6n8xfKu0B0iD+jvJ_Nv>0AMgC8w0_=XaX5`W)Cn_iiXSVP4#Y4?O#w>^C2ebcaF}0%#Ql7T~tOVC@bKh_Z8|^ob^@NCkqNhA%HQw?g!f-ew#(Kcak_X+k64n2_tUm**L=wFrHo-t$OfA zWFMSkIoWY0Th0Ba^4kO?gk`J+0c)+5p-E8$)o<~ENlxlL7hz<19g%XnigJ4)q=(I) zSL|NwhAN12A{wf5BCP_;WakU}ro2`Bsx_GSU42e=osS>QAq)|EO3LHA682+5lYuh9e=evA`6TT zr_pKQn|oXds#c2veK4Cc$P+02%Q-7TlQ!)`%o69Ti5;uPDZY=0v(RGq)p#4!SX16q z5uGXmQ~)xgv;_;%zr<(x2E(d7*Lp8pBCj@4Q<#YoMsgg`nsRS2fSxC{H&@>JuL$>B z7BpLboSgYlS2ZOfZNA5G4LrdQS!^9X%{j58V#rs8VAsnkE$U0*yHo*=K|e)3r05xA zAwiTc$=xnKmA@Q^tw)5Xu%Ex5?LEa&`Y87y*3sAY*TR{R;ismKD`K7h(!r6eO^jC& zZ!bt5dMB&;Qey#ue_q$7FtZxZUeZxk z&Zde4cvY%1e@Y;EjX?4hH=bydF}rd}=sB%f$JVB*YSql`-rka+b&vUc_lquk-QhV{ zry?K~-w|1pv9~$lV|@FYwJpgF|WN>YsSuQ`408#pncUhXCmr$0x>r8)lqdv9VyHG;j9)cv)n51K{sYMUcM5Jq>3u zak|PGmnYt0#3dD25e54V!LQ)9CiIHMXUL~*Zz`lh{|VQbe}B}fsJ2#j_kqn9RY^IJLGbOF zEk~YX)egdH;|#HGv%wZq!8Nq~k)jyDvKd!G&K z()W&dfhO!$qiMJ zqxxXz)1bf*&y!~poELFix4mAKel>mrmO*Q!PiDx+b>9%e#AjmbHBLlqXjW;rgvPhS zwe+rH8r^SsjxB4ChUdGvmrh`W+2B9r53H|=`Y)eZ&X9>+8)TpQv8rsC(?Nfm_SlkW zv&EnG=M>6B_rzlNm~L!tL<0*wSQW-FHKr)#xnX>T6!Fo!5kJ+y20EwfiRs1~95`zi z&8VETm$4qpTiQbW?c z$R3UZhBKSJ!K#= z8Dd4W{XKj&gQl^$U*I5624G;`*~iesy$i{pD0N}<0q7%6*Td~0xZ}%z^bZU0LW$~S z!h@ggfoLQy$}+3|{RBUKo8DD{Xc7Bb-d$(dNs@bLrxE<^Nkf9|!Ne2Ppe~%mK;8xV=;BuT%IX|%hjvp{n zinl^ET+1pFl%e8sQ(E}TEnWw;_Ydr|d%#On!f7SbKH>9xNoP!j!_S|4hA6c}u&JdI zz@eg~J~XpIX;F6FY2+!q?*uxIRUJrmJnw$_f@|%li54bBVQl5C8o+Q4>X(MUN8eL_ zNn-S6IT=qyJ3I_IQHQ#wBzov%{i0vIXu_!?WySK$T*Es$pwm(bbRl0 z#psdT%sL+&tk2blzEp2(9a3AL3aIZ9@ERH2heXRDSo{d!NM;fZU*42pUhAyoB?cJz zx1KWg9l=?p@5Z`zrxyU$himJbPE1h}9j)G|EyvPF#7uoQjHL=l@S6F)Rj7&f)B?g? z23GhJh1yWmP>nx&nwGvc%sIp&Zlt9LLvuCB5ov$Cp+GjDt=OGMLqvWgaRLszS- zN&`WDl}VB8mbc3qmn*PQ3n8Rj4?2p*+;LStF%>!B&pMzjv^l?nvp7!O?{fnMCG%2S zY~rNAeLJpMxT6U+eSp0!{~9gaYsFJakP;<))uoi%u1ABPLniz4lV=2iXhy=KXof{t z^Nlr@3SG_<&?50g-Z^7o`g3$}ipGdY{`xH9o@XfH-YYhH`(5Ye$66#EVG0)KtzJun znV<6n-zLVy!~$6ysZzP!J}}9|FS$Q&NPM2(jZT{?Z|n4e#(;Bdc6WuX>(W|{6Z3b7uQKe{nOB{iR6xEYi z&%OQ;>hANVq&lk{A~)dS<`8aNf8E+)fC5kwR!2)r}T3kPj!AB$V9pD zwXct1vdt;MhQ(#X)UfSHt6f1KeY6}FLN$3DlYNi;I)0}klU(O(EQA4Cbdv&3Vt$s6(QjcbfI?B4J_tq zFDT&!eEva`14oW=?UYg)cSI&N%h+e9+DiZ^mZ>xP6lb1z%kyHOqyH=!i*}}~qCdZ< z@9fPR2S*EXU}v(Z!lJh>Sgj77gD~0EGtWF7qLR9vmTeOVgn#m}fUOA)i*U%|WSg9u z863dRo?#>A35!aTsbxn^sZ^JdYnE40lMQD7xj+secj8K4!bd`tp4w-7yYX%(#VOuG;E+#+9*Bw*I=V2d`cgdIMa*d$rfIvBgK$ z#rFz>(p`&4a%)V`6Spk(TG2)`c)^FzrwW_>Y2~X|NI+YKT+TRqbpiSBJ|*Q9PuT3R z{7RvW--G(9rU9|Z?`n&Ps;x+ZF>_3rl2X52BU%kny@y3}&&(i-_*vy*6qS5}7F zehOq&t0A=YQf~UN7KMakxjPrIALJv{N~-y zPmN*x^ZOlC*RM?GNAtZtGM##(5jTaxW?n7YOkMcAymjpC52BOO`Q?SE^U}+b?zW4} z0*Zu-sDbW6lV&M}HS7c1u~MDVVZ7R_@(Ry;w4%6uWK~XUp3_Q^6rjcxV9f(x`VhUs zpWHUBKkn~yOKTdjUyybjG9_w!DxvEVM=9vnJm$@kC7i-7oYkJSLl-=D8?;gCBGgl5 znd7a2ZL8ieEhiKe`0gbB*q?A$KTvZx{#DVk?(`D%smp6ofJ$~RmrZRNvMg%*5a_gT zs{EMQxKwX8G>)2M!@&1u7SmAdNRvK{}tG2_pe$xcUTsMBGVgn-3O~z^! z0$#gyrOwG`phQeKV&Jd`Z9a7ScqRnmvlTU1-==?mS@cN_%yaD=-oBS z$F!B#$O4?fK114(muWoM)Qod3&zK)=zNVRTE0BDDW7#5vvQ)VLHKD^Z^-`6LSpiAV z!G0>4lSe2ZR%lAJ_tR_`ib%o|8YIVhRf(XHLv8JIqkIU3x&Bk5E53|v@8-c6s!c>A zGIB)mmLm}$I;N+Qs$_Mn=25#Xd4|KJ>RrrRRJQRv)2C!uh z;al0s+s&MF3&~lLjHAM5(_q1hng-#b1nPHP*f5~|t182lyLWd+iEW3FkN*4|G51D5 zQt!_056#v1{QS7F<_FK$F#BVM6DJlyl)Wsd*lKo^@MOkn7EnV{tuzjAU5q7Op(%(ECkI{PaRhgLef(`2 z(e&xtSe9XlZB!pPyuFP(%h|TeccS+*a7x&EGfF zb~hFS>%tDdM+B`}OCPDr zXsDR(9{UK*Fdufx>JBH5(bb{Nx(xVr2ql=#=ph9^ta7G;^wV{)vcBmre*KTx;?$44TsoCS}i(>(4kGOyv;tv@eHC{qY!TZbI*gds; zAb9kqixdmhUzJG(J}6oy;{lA`w{%)h=>?pWmAa#xO;ru*qDYuK#`jdD8IoS&b$7D8 zcBKjHubxDj{4Q0Xnc+7DG?#=;0m2F1AwQj{5!hjj_;YweI!Ki78Zk;>0Q4w2vfo*B zqB;fEkSPKiItFO2w(!`&Ch|i@1R;_9${iizlyc~B&m;ywj8(U<^}SgY z&m_Crm;s~pOM#7z@JN^<`!;RaDdmIpRD;qbhz{XKG&Gv6r3%_(Y+t`AT8S$bcat^c ztfUZlKJ;V{<%XYF`+t(`8uIesUc~liokwl)<9{|bib8k%M2jGew9Iyda(-jAU+=I) zJ~hMEECkj3s{2TldF}94C@z#I(S}E6$U|nXKR$}a$TF`HhC|g5{lk5xK!MTnODe!6YKt07I^qKd==U9}2X z>u*a$A1gvACKI5+2H>AygJt%3AoKGOwI;wjako~XVQqA4_&MeBrS!A$P>_3HF7r-& z3Xc1*%m*Uio3Zo_%c~a8xhDn_ARi32mw)FWNGM->3Y-4ED<;v67^v!=*dPD=@g>Wa z9A%Rc%pj+23q%n~F&VO&vblk?UHF99(yaXW9al&O0lk~=vCbKX&`DGoKCL8SeN4SS z%NhR!I3LVmHQ~5xm8Mr7qb%|G&J zf`SnNy~K}BvZ9>Qs@sF%#T6-f;+bi_sxl-C?z-}Ct1go#E(2SpDxd`9BRoY9W)sWk z61Vcf>|}4Lo8WM(vq<%Poi}a|sgu$~aE__FjnC&m&CbZPwA^R>2pb$tfL-HhBEtj0 z#(-MH>mss?t=QV0 zKQvWMKE=^mk-x(WtZ0r#je8Lp-KyR9A%NI{j{h_U3r&E_x_BHthDLr}G+ zDXx|69BckHE{3r(I`3$V-0qxiFO`TRi|hTX1}B zYuOArc2pMQ_Fw@^tXD61$z@OJfVMkE$MlhKkh+L0Pm!~L7py#&v}4@r60LKfw45<* zVTNl#`e$hudQC)!aa>7pT_yTXMtvtM=~YpuUoMBlCo42F^?KbUGK&uhJJU&qb6@K^ zSDd$Q3s0OEnwxD>zV4CPcS)cZuX%7mdM?Am=@ttivoTgdhxIeKLWJYP?QZYXEM#js zBad$7ptpTgWPcq!1dR!X1-BsMHFOyREWyq(Y-Vkz&qu+|BV~6o8SiFCokksMr)lP6 z&_XVYIW-yA+&r#`R#TM@774JRx=jF5B@^4lunObL*V=_!O#R3eV*65Y|zt zVJESehGW=W3&E2Sb*_NFmf1tJugmxHk}kHJ=`NYDS^y)7jjGng3#CSi0TZnxKW4%y zD4W6Ui)$6G9A$)(kmSB!$_cCY$sh^IahC{VdIF(?&hDPk+4lLlo5+$g`3Kl^ZJbZ+ zTz6K{!%L-~lm1?2TeGr{^zx1~Bnn=|e?NUrvU-8`B;jW-u--7E2Iz9W)oUc8Zd>l-nA0C*<3u;&L6F=pyH2*W_5e=cBdoyv z(}cqC_Dk}(g%15T=P)Tb3iRx!%Uh$?b2(s6F{k?e^NWZFZcoR32kz1|w_~ciBbpYk zz?2Y7;^SUxb{f!%erHoBb?bJDq@5Y^9_>eji%!n*CUKQP7mc?%TL$A@8czEss241p zUlf9R>@p%nlQWxieUc~3R2X|_4MMSA4vcT!CgP zUI_e8h&JDB_DnjE&*jz`DM7wEiU$&(T{7|M-$BCuQdr43cqm~1s(!ZpU!2CNh&0!^ z2a(3(Bhjp#{z5N-M^%EtKK1;^eiXpt8A2+-WH1e?7*7LFB%lw=chGbHz167`8ImLVp9a>uOrW~1WpP;l96z4i;}nnGLfW)l zj@al__%#_h^Xf+E{xp0Gz;Oh?3a0#YfJ{u%kJbfXdAUSckwK{ zLG^@UV~8@DDo2e}QQ91YG|4@u=E`&4xXkkW70+F_Z~VAi zYdb1XkF|5j$hq>nV+X79W`mvgykz~->r9m!w{t#zjQAH>^iL*THf8yPU%bjtd-&+b zNb`El`wY$A`pW)hAbpA0a|3;$xg>hy-OW^bPHoYgKJ@h5bu{vb5aZblW#&6D_e#1Wy+A8B%r*$tlB zcRebCUv@PWgYQ=ixP(+JiB#O7fZSlYnJkz^Ec5T1^w->xb;*>{3=P(x?msvP(pk+d zDr?j^1P&v5W**1Hu3^1?t%QvM7?|+v#J&0YjX(1lctEqa!`DRsA5~tp2CuqkgM{w) zLo~{yNOW?NxbUe6TArVuQbS!E&A@opc>Bh$eht8}+BfO;eQ6L15}*3IqSzRx@wS=p z&w0B2jkNcRGV~*Ed1=@E8g3_R80`d`GG|4=I(wU0YVU-^fm5&wQ?ZY_`S5SE%s+Mg z_m|GQh-W=uQ^z9)@B(AamU;c5pIOs7i1%#Eb%Uwp&Z~EL&+ ziN8kVpHBGu<@cNkp{i)Njcs|OMR4*n_p>ifiFs}+msh;6$wpU?Ydfm}hQ+g+vNT%K z9hTkyDgZ?6QR2-_zv~fX{C?VOcj8`(LD&6~Tsp~l60pfN{}I0Ve-`-Xrv)a{O#J`z z&37OYC@S{fh5D}p{GJ~S|D(Fls&fRvX#K17f1haipT6c3vg1E>{O7)v0tEa2-g|EX1Rcqfql)zo7y-1nuo9s8bDsWqeF6R*i4J~KGI_JwZJ{9#aaVWS71DHZak=}#Dfr))a>;>f!>3=W{8%eE02tzAr+qrVT-Plb8Y^`)DE_+WBkI35 zxK|Ie?8}bv*bG60CR@wTER->d_A`9)zs}sioBWrZ+^5=^dH|MF-!zYZZgzQ51o09J zt?U|v!7<1oLOSxl%elB*Yb^iW`zxRD_W!%@Gbp*u-JXkdE~kKANnjMCn1v4P0)t2Q zF}92kI&>G@ZyB3{%Yl{%gi^Q6jbte`c~bl4Tp!GU6j>X?sbHN3yLzMzCX*L=p}P@4 zcHmz&+6C~1!nFTif|P+mfn03PbO!W+ zD9p~K;KF~*r`~bq@=2+sapdl!j@OC8&`V9ePtF9)8O&hMDE(fxV}W3Js%BH#Y4_s+ z2YfLn?}$ldd!J)gFw!c4s>d z6FQjWjF~`5u+13$=xVn*e!qJ00n6u62Yh%lzlDoQD(C(e`zf;*LS1^*moNF5z^XKT zS@xuh`B;n1{mXJCk*+A(D%>D*S=%4l)8iG|f>xZQv$O@UU%mtQ_`URXTLI0p@fL@3 zm04LJZ$EZ6#UTolmkgy;4xm7VAWI*tH&k(U;M#l2GXn)w4(so)e9~_zPbd*)h_}n` zfZKA1WAzsa&>bswq!L+9NCJ>8k3NXQHcyxwKOOKsJFZH3n%uhXm3hU+!_gL|Dh|kb z^C7K0!NHM-uT)a2Z22_AX3i+@6q+3bpAcplR6KoWbAKTi?}` z82Xq@obgJ%NxZMBBdIYQnqR)ej9y}irMh>!5XU@kVqtg~CjUEYl{-ggeqO>E^4{Vj zP2Y0#x05ql(RTMy+xe-S+pp{W6Z&0mm)&I`%FJP9p%>L{<-6`)>{zmItHJKv1R!%Z zE9FO-MmL-FfDJy@$TH+*Fw)#v*zj4}O^a^(9dl|5bi&jyodh)*t*~LC*|eqfVh%qr zy!X1Z*>~SYdyDy$?8kVM`%{)XqdBhT=Fnyp?)QCp=5*`P26V`{{yfcm%WZ2#f!&vX z1N!W34ZS+dk|C1LUgyFl9Ll&|+`>7yBcdTK#oWS#CmtJDH}IM>slQmn?JIwk0;&Q7@Xt1EYa0x@ zmN)qv@LH<#WKPtl%-iE_-s=(EG1jGpGHSk3&*6$k(?bW1|au8$1@KPznYqfc!|c z{$PBQZcm^3+3~3^*iOV=qVn$6$7+Lr_dKdSJbK(On~hE#?c8^6b0taZRdEet_M3@{ z<_Vj?Y%oU%LCGV2;-*yMF$0sSfn{~E^jpxE*56!#iM0blcO)l_Cf&s%kK^gc=I?Et zIofgce&q1&Lq>b7EMW!b-?ug0QQiC@qj5e#Sgzc(EY*2L0N;GRA6OvQJWNeunb<-H z;qgtt1H0D>YT6`j2$%eauf4Vs^j54m9HK(Z>3Q+qMQ_J2kgZG}3szjejM{o50iz>AQaQT-i% z&K1Hwee0Swy%S?PX~f9VBSHo%X7RZCo>8R457G@*Z1e;sT$(DN##3+4+Rgjx4*XDc zEY}5%ePh6_Ak4X&}_yqzlw`3n(KV$=-;No>lWE zblLNY8zt9R^ww}b&Y1vO!IzUT9KC0#1UDX)X*m+G1!w6bN^hx52dTUe@R~4F9uCI= z`C$$v54dlFFI~F39kKESppN+m-)CwKv>mUyE7|7vkq(Q{}1?@J4L*X zw7}PVJ&fY)VlvC=&4Ya!T^nH0apd^AmS=o1g86@Q*FXQk(s5b{mt4J3O4U*Ggr?V} zI~$oDRdB8BYgQF1D@*@j0o1PY(S8{?rHdVA4B{r~Tm8%dgln;}@W6C?1j4jIaE?iRZ957<@a`K`XO^X19!1%6R zt`Rhgvbb=L;BlHP{?Pc^g5{Hhus^@yfC%;#=nK8%Ql?%Q!40SPUC-S>#}UJ2#~p0P z<1&>fveJ6{E=~yv-LI0A za2gQ{KH5Itp=7h+B2F<@YteD~>mwcROm5KfLSGd!|qf8k*Gi8v2-yjF$N1;({iMg8uC_^&Wv1m-MTb|WDEo-$M0%JxAqrMU75%@6cSr6@1Mz&RF&jc@|0d_+Bs@qv8>Gugr-2FqGgJE zlICWK0HV~ChsP|NKnQQum|bG+J{m{f^^-R=R2qR6#@`W|(&ub@-3DoOsrCIg9W{&8 zo}PJkB*RBiMdY&<_U&MBob;rK}+cNAEIsZ;;FWtE$J+~As6b3lu z<9j@5_U`gVwuTCMDX@?8e$$HWIH{y~Nwu%d_Xm8HT5&&X zTXA1Cq#(=KN!l{0K;1c0BY$I@aHucGI5B|F1c1(-T7zKG^UuGYZn3YS-$Yh#a%8I=mAnZDok1DclW& z?YaU&d%k8HpviP7U`MCxHw>6=gZU&MYiy9WKYkr9Ut8$SHxe3jZ1=1zo&DILL69od zh#x8u%G(xVj{y3O@+WLw$wJ{Aahk5nkq`VEI;BsBa^PmmPzmAkxs##Mv$6;!C&|;z z29yt-6!6rq!EG*v(cA55d?C)oo_4@Hngi2)jHIH0u&wqeLlh5}0w>DzcPsT;uP?Gm!SD6K`G0H&xrCD zKT>Ki@QZHG+8mx#374EtYTjZmWGzH#aTSA?0Y{L2HGP8^^}~pzh{lY1x)X>Ax9sh13S9M>{jHaf2UsD?Jb3ho&7mSy@F`DrsWLVQH}y z)ju6J6>IjUJLg60!msdzPg7QMrsj%6aLt1$AuK5zu=D7d!quF3eV)xi9~IaP%+eG7 z@Z)8GQT}GtYKo_}x`vaH^Vq2SyI z+vaDWc0yOp9r?v*xoqq5`mX7E!&KC3$ILT*hl{uM9q9Qzd-@!Hw7MHm!IR4PilHU4 zz9y?NQU69~fm_BXl-_Ekcds%7QJ~Kq{ER4Pw_d3=L$NkIuCq2m>ek>eOy6KTeB#Di z4L0)jwjrr&39wsNVm$XcTfpJeC7>oMM0TIR1R3fn@y9ti&CJd!B&`c)?b%*Kc@`Ck zcCpF6@{$rniEbz*ouVKfRZZL{3Y?N92y8Lk$&&&{L-#}QF9)dtZQK*9`eM3x5*q4L-5aH zK8K~EodiTfMEcri;(q1utn0*P4HeG7ReX(BB5a1|E=FW^g}k+rw$E(-wX&i~qeLU* z1V2Po<+1#c9Q8~9>gxH+?5NE7KkzTgzs7B6p-Aw1_?l$%0cciCmo;19SzmWAyN9!v z@0_OY49hz*C_SB)P=bHO9jlR3H!5WZrPqgYzkGj@eVhBIofIl3fREbKeZt$ zZZU(9(jCosO#}M=&UD!8jW!RP@%dh(kjkGZT??1u8>6T-bHa09G)zRLu&A~@5>guS z8b{Nxkm_xXIbA-Afmx#IbMln4xfZvH6?PCZBiV6cttnNBy4=-`uEvsT+hnV&10E|O zlm$wg?2V>$Yl*X8x<66hRjWP*75lH zo!|(waE1o(be`(EgSR_4uf|M=J7p}vDteT_GgbEH3Vpno2!a@cTfIg8)(iST{-jJ* zk1d?7^5%^Du62jWkVVZ;TOdANF4mVDWU80+En(meDDV#0eLpLu*_w(XCu3${o1oz` zi_u&Xpx7~~b_DQSOvjN~YlXeF;=!_41g9k7GBmdaPJ(2)7Blgj$J}=bYG9b&atUWN zSR%l>v{C=fd4sL~C+9t;VPnpe?Kb;9PsYPHIw*O?&%V`751W+~V2H%w&2m&5w2dnv z=|i0HJ2!mU zAfqs-rh2A!x8(XB`t;q@Ilga08Kyg6Gw5!P4IZKe&;;7HcQ`}vL>T(y| z^RgPiGs=hcA4HDwXNDbKuj_5(Q>S@O5ECZ|mc}pU#E|DbPU%HQ7_tisgP=g%W*O+1 z@Z@(nkO;IyQfH}vDtR#q8`^Qj+-;Hq#HMT}JfW{^mA@rTf3iSchja=~(YG+8OX%Fg zw5MFDq(3R(GS1Xb5KUv{Mp@e0^Gm7y7V_4kn$%a<{tQkxry=FigN(OpI6a`1F7>?|uL_{IkjMyPf+F4irp_CXJj!sk5Vz{6bzq9ge^IUW3*Up!qc$ zV;gNF{(ixS1SpYP;z*H)_YtoH_T7Ku-S8(b&M(_^TP~vM?sn3&# z-3?cA?LbNLvbWy3ZqZ&>AFDqwiq@W`H5vM>p$L4`5C6Z#c`vlr-sVrWk?`Yqm2fqs z)_I-esK_)Tkre`e|0m4b8PmP=(t7W`X1Ec4$$TmWYqC~|HQ}tep|`LZveHZG4}4@{ zfQqF=M&`h*6&pZgbdY}(jbOF3*~*2OwF>^I<5CF z%Gj72&&bOZ~4oDr; z?Flw2Gk0n;VJ|o4Ok4s24%P5<-wL5mEmUG2veKIy9UMJJ9L5 z)QEw?RyX<4(&hag_K4Y_b&W6_)zv|+h;~Qk$JZ4W;R1cV48K=d{vg~RS+?3Z3!}C; z7|Bu}@LJ(1#2W4BW)nU?6oPR!_lRj5AK5euW0XK@b(UXs;~Nx<6aacCqiZFmv>z zmkzQLa6C8d&^SF;PPYP&9`k99kidKvhH&D~>{Su;(W`v2Lw)~mmG=z8VUqK?L-*$- z6t$KD+@=}z0G3_^$CCyYg0Zg(zNc|X@emUd4ozg)9_}z7_1E1zbsEcT3J))*={du4 zD=94%ay?3qmqQoeTQi0^ou;?!vi7*vmSapTRPME~83C;T(XO{a$7Yl_8xxfZ6$+ae zYG-G^9Cz!h0oC1ob?;v#=r5r*Fiv{{pH_6(*C* zoIYK z(p{}e9wB7SUfjhe=a@WRoJJFzJXY`wd=(QG${!?xz-@8bT?_nxS z>o9SyQNxk`6Q{M3M}_OUK~`Hrdgu9HF!i21rA_1e`UpPA@t2NdFfBAa;l&(;cBP_N zYtJuB?rg=7?TvM!%uA4>E9qGh!TJc-+0K#wL;$de!O))g^WHu+^oJy=yiPq(IjC}~f?wo~PW z`l`6b{Y$Vd%GBk8dQxOT^F*;or0ylC>y>C;z>iM+MV?B zZ0ap1jlKMdliRYU6mgwDh%^J4c=kdv4#L%3PjW)|Qh=QUzL0w$6!=lc2z|sxyp58i zDX;&sWZ`BJEZ=e3_({TeRh_)c&6k>_TNlSXSobEHy1b9%8_rqLGDovef!+eXmeVeeM+#ut)i8ZA20Ug=ycaB5LhpSJzl??O4>!9L`H8TMm=TRo_rb z3E49Ua4*z>FhxgF@m7<&ZWuVTAoq~#=ppmwK;F%xNy%;j>Ww*#NMAL zC%R->GLXE!)ANOz&=A*B)p6ZZ#=l5uSw$*^=^SooibSK9p<6C{66@qiCeo($$(}K& z@S)2vT)VILL7%+1PQS;^nixX7f>8V)S?No^e^}}71pB`5d)1I09^xxzQVHf4=Wr-z zst&#<47#tWFNuRl8`k?qde85r9TNlM;AHuq7|Eanv=hr^02TXaKeB?IjOwdFwc{ey4lV++5O8=qH;lXh<7rptpCCSf86mlY6JrBl?}`#LgF9 zVbL~kwhOW(FBPsN7kFZs?tYqE_NZikH4@zU|CDx~QB6JD0uL4xP>S@>6zNI_kuFGY zQl&@;NRiM31SB+-CQUjh2uSGC2>}URq=epk6G9b`8all2UwZF-Z>_i9hj%{B?6vmH ze3&_B&fdShcZ;`5pf`X^YY#0I|06Z%P{@RPHGAgUK`d?fSo{w6 z5~*jxA3*a3ZXPF@EBxH!)85EPjlW>@SL$hfGW`Bh5e_4a!$1@p`f?&(_JLI3YLbio zvhSu#d|z|cr1fjmpO#vRD7Jsot-P=qZ%0%(5JjVl0+O%LH7v&8`B_>Pv(KQJ;3#>S z03&AuzE(L;{k++C07YcwDA~R1*G?+wrQfzLB`JOAF%l9^C8+2aI4nGsIsL-Zk^;#a zI`Ptae1&Ub<%%fQ!sAU-D@0&At5Z+B5KlqC~vY7toYzk+)rm42tZqc ztepe2RhsWPxcTL5URybC?P#f*2URf?sBiYaSyl|ga$tQ16211_hsUN>M=@ZE-xj7 zn~IXlNX@-@qe`8IA`)%JDJ3ee_tDZWfnkdw#^1@43lQ&P#;>OR*$Ty+Zxfqegwj`)J;D_8_phqZebAABpRd}04q zoAj)2nFv`NF8hozW0gz5j=Xt4NzOw3l-d3s%%-~xH^m`rv*6z(8U?_HvuW(ml= z0VUEtDLXr^FQIQ_Lr7bW%p*!E*7{xdPZOx9>8)S9t3{^XmOK!4U6ZAgF+_||r{bzY z_}@dkd&u}$tw$V9DffMtyG5(ISr-vT6>@`YWUHzVc34YZ#2P5IQgJ&dn{c>E5qJzK zEvp)4$;kufJtEZ0?5wYfRO~;jP#N^)uZX)(glG@l3#*W-OvDC$Ui##=)u)h>U9zS{ zfRxgZ#ed@IwslQEv8;t35XModQ(f!b-$ffInYBp#)>q9)bM#!1V+cWVXNT`3Md>kz zvvE8MrIG`2L4x&<&4pGGr;e8T6)&UhT0^)YS;1)7Gidpwl~>4|Ja=*)QOov(1^lGs zF?+y=*ZUJ56r6Fznm2KijIhEec)Q8tRv?Onk63*W;)4O{qeLOu^G0M078bNe&T$nx zX8~y2J4u!l3?H<&14XwDe>_6V5Aw*))U-#vpC}+cP9@ao{b$>jTy9&Vc}8EE#E28- zpY^wphIK56zBZdX4ePId@W1{jXXw$~#<}`jcJ2QGT6-1%LYJn>Vvdf#bjB;_j|&Dp zHA^6WB#G94mEX_d7FQ}$d*1|eeZEJIhL6=}Alm~6=4XA^tjH-j)*i-W!!c!)ym(l_ z7P|ceZ#nkWBejG&vGarwQ;0Ynj=3Uul^~=DU$>dZHOq_n&+%b zTDX^=acz+m0?%687?!#Ezl@JkT@g)}yaD&$?!n!rD!?dr#|noHf>c@I_e*q5P1irh z?}cL&oKBa3G;9t_tFuo>$B{q7)1}pE8 z=gvPK>2wC1BTVIEr*X+EGm_Ltq?wgf=?HU>ntb<@PrY1G^CdTjrTJRco@jM8CsBUs zGPH7u7SqQP{_3wNzfJ1wA7il8B5JqO`z5~fF%^q%o}Yh=RvHKKsbZ@i-QFbA@fyGG zrh&znLxJ!6aPK~Coxt;v2k6yghw#|03beqeQ4ZpJODAw~QA5v~eVE4Ak2((f!PVJy zYn3vbC+<;Y4fVT-e`3mU?&ZCz@@&BMJI9A935r?*VJ#d@2t^VT2(9-74DF&ekZ6Fu zCOdL1JPb)qd;9@j@k2-$1`o86R`8ZqDVl9IvRmHrd>dzzq2%#4N7Hur0PmO4ZfoO% zWKZ01=T|!I=I~V&9gpo1cTB3#tq!@y^aJnsrMYyE7o!gc73HcSnJ+kacdqRV^8y1C zx62WZEUz*I`|q4z&GGKHJ!bxv9Z9SwyPz=};8(-)?(UDo(uw6}I{!tgVn*36SCe%6 zj3`yhc3v^TJv?VE<#+9~bkq2f=TYGisK*aZ$ahQ}Fx(rWQJ2MUvK7QBxGUpVx+f6D zdv@>q=}$H0@8BI!TJ4-4bBB7Alkz*Df-J#sik`!LUR-rzOz} z*Z3fD|7$=`0wD@H0?nINI_ZTWG#MCSi}%8^l5`@hjfQBcbtV)u9=Qt*#+#Psh**X5 z$PxTc+?pl!5J`yTs)UmL8?{#Dg4t6~Zp+BG&>U2zOq(b{&yyLy;~kB~{F&_4RTv6$ zQ^Pz0-ecEC2jzHE?V$AgD{+pq<%=Ii%(Wd2?1)m=`i(xkzW>M82Q%^XBYHYK8tn+ zPq`lh;D>hS1+kQdW-VN&-o{RA07D)faV}06K9Z;U+7h6AP zl&L^uZBat>ujV8j8i~((@~Opz2R%MKzILg}SalQTj(nMjT)f$FkvGT5l(@S7me9Ly zOh%SgjSqAEXCY!=`uLys8gx~$tGvZmg}A!%I9?}nrgs!Ih3SN?9Is+>%h_&#Ey$jR z*S5shnrT{C@Nq9x#u|R?B?agC;Y}ax;xfed^)0g}a#-#`sGOlp3%ah`)>eTX*m&(K zQJM)sY0e#KTSQlq+{(x@9rne*PNi;=sX}ml1b!AN+R=L9bTu%2+Nu2HZxt<7cJ2hU z_#%GN9yYOsy0}xd^ojG&X6l_r44>M+MuM^q%rnfDJ({RI2HU&lo~zgg_Te*>CF5^2 zIWg>S5JgUKeT*DVlNOC;t*kWv>8I+I1S zXp>84Vl=9cd)`XKYxe`v>hh+=LA(H-B&O$!wHEP;in77coV|vymDZ>o&0Z!$<9FoH z0&}#WtvzQe`;6WKHwsxwF5Pl=miwl@)rWnREiw!w=21?ku+eGz;`_Sz$X&d7W_mEf zjaNSx%2y>3e1OrA6-wFJpkm1ZX z-hrDeH>Oh@f=1cCX!~?yG{X^Jq*10m4Zs$gX4sLLOZ?h)G4s|rhNm7L1W9y1jog?8 z%dOt<-0i$*-)Pe6?Z--!K9nttD^W2&n7Bt(DDKEJnUDOnXZtAaWq}5tqlk)yk;5%h z4vo_<;l6Czz}7j@N#SGr;Pof$WhQ%@1EPA%i71p(pA+BZf#+ll*`m??SOu|JvB?wa z-W-&g>*(V)*GIc-?8i)GKx2|NZTOY|)D86;1-revCK)gDHkX!A<#x}RHvKu++ml7l zn!Xi!8j^Q2jF=}VR$1pBiX7x*TOUnPp!1XhS-NFCq6X@*vwMWl!y&5O>GG_ta#iEI zFhfh^Ot!&DMFj*bnbmGy|K?M`{hKUoX4v;Wvi@nyOEYy$=F6vPzp9H(?AQE4 zh8}w|d80J~>Wkb;FSfm9{4m-~Cmklg&I(TIekj{lg0&mp?V`>{MfN<$DsSP|xXz5& z?Sn+np=XOcQO_Ys5_TZBaHo`Zj16)eXy(Cy&F10Dev;E}XeFg5@+=?9%_E>V5Y>FVGj(zm)lQEr8AYH#rd zf2w>2DI?>y)Ie-LOD@@)d+lqZy{{dUl1IDrii=G~t)UyE>!Nw1%a^1et@00 zodCp{{j$rS*#iK+Y~(%8dX|=&TNig{Z~t9za0n1Ha{QhaC2EVR6w9TBPcZOkMt`pI zy<3&DsiQuw1~&MmSIzG+x1Lg?mR}y12w6o7DHgsTUN1XaWX+$)nz26w74H#{>_Z*C zojQYseE+Ma`DzqPx>k?t~-ayPxs1)s$o|1=f-R`^>c`Kq^anP zFJ?Z`gj0bEUcqw|>5m2)k8>g_EqyipBtF8PmlVC%X_`6;JA?((D270=0{p8}6lb-A zh~bnX;;`|&QsgfbrZbCbRzBV%e&}T-yd90+$S!352I&HE)v&pdm z&41xZ?QCyDjb4=#Uj>1D3y^#V4)e@npA$Bsu_8t6N^MO&piIQbTIbtPlWL#fG!m1n z@iW|mbCQBnGqY@Lo{p>M9t8n_Za&-E?|O2yLEd#rU(vN3h8pH%iMqHn_nKb`zmsdYq8akgHXT*fet*Wl|Osewj$)Ib&61BhyTB2AKdaT@V!EIseU)(83E z>H>kHT#nw`p6%qSjTWSwc7s~7-IEHT;sC(6p08jnFCGWAT^SblU4MPO(`>i4!U6Jz z9LITC1HKaVgb+XH5##mEgux0n7%AryXUL4@k}b?Ny8cCtsXeJi-(-sH&={H*1OT|u z8Akd~Y4)~(NAyyjJ@EVx1wUIxBjJ0$Elx9EY1u>JL1CI8YGF(sybkubIEVyL@dAf? zC~5sW(|HOJM8gNTeC9T_D=xmtdl;;Iu1dl6h+rDtwqIS^`9y<&Q9Vu9VuXeY=QSEnk zm;OU5ZJ@J!iRQs_uYWwq$v;2+6=&rB_E298==b}%Q;93?e-;L~ugzbq8-EisGF zm@NO*|1x~-)~=&VWL&om67}8quh>@4_UD!VW3c~aorknQ;Rd6b!{=`<^;H$M6pH1| G-~AWLF>>qx literal 40450 zcmeFZcT|&G*Do3yC`Go7UQ`fJ>Ahp23IftQD82Vyq8kyB00K&p5|Jj-1O%i8L_!Hg zdMC0&4-g@=010;mec$n&|IT~Pch4DjjGICBeq2vmYp&VnZzfttOO=+2nF<1d(5kB` z=|Ui<=^>C4#IqD&q%`eF6a4R-r<#cm1akg6`FrB+?ei>PkkVKEp)%#q)AW>Q=tttz zgpP-ljeYO>`8s-dLkdf~)xZ#qFBnp?^Re-E^7M7`aEDwvca0N_Q<2B-dw2$UJ2^P| zLW=3SWx(k9<56$B$K*?|`Z~GULBx0I&Ve)M$Y=CC?0o|sd)q-QJdeniQy)Lv$;Za^ zF}TzlQq%k;9t@u)4;wx9c6V}jfHbo#M1e8N-}n1@+t@+2k0P-Dy6nD(o12}xFJz}X z83D#9$d~Cm`MTOcKCTb&KpPmO@12a~qp}uDGnYaV(s}D2&I*q*PUfz7>p7PZv z7INorJ`(u2o-5t?#FQuHyUSGi>9jo zyLx=}4t^TF7-SzC7Z*p~EeNFfg$9+y@e#z6bp7-1BUjG<kdr=wm~6_elP*#xfmR8%B7*(fe9PIda^t9H!d+@2m4 zA0sVtWo1QOyeW3gQU7?s)@b4`x-2g4Ja`6nxd3jctsQ^z*;5J%imho}xKW?{?i4KL z@s95rFY9>}W@E0(@_IsQX=^WI3M%gu<@w8Xj7%T;KZYM-IIt5gWd<%TMf0`$`@zGb zqYNKylYA83ULnuu)uWJ*`Z#v^Pdr(H_XJW<=1ulJ%q1q3DlOJJilmMBD*K*yO#JO% z{2~L1+oSjgm1C6-@eAE)q83q&OIzF9%S-(^kpg5%guHLQp74^iQby{!sIN9WHC3FL zc=1d`3;FKT^zIECDzPxw5(8qd?JHI}=MkHHu-IbE@r{s6qIFW5Z_cf61P%=jissm* zC71pM=p*C5ni{@cWEER)sj3>qmwBEmj znT4g&{nGiUDu+IHHd%j7PEO85u7bhBg@uLUY0-(v$tssoflRp|-2r3kxo4E@9mb=K ztHRs&&z?RBD4#fr9iFIi8Sd}T4wNfRNVp))dLHcYLt`yYj5T<}ewR_xhn{pv2Mfip zNgZBWh4qyc5!B*#@bJWhb1BAGrYdCD-DetX`HhR`2*mKP{pErM7r3ZHoI8T(FaN9g zly|K;RaEOfp%3aFWVK$8YbtgU-3T<-Rv_dChlIS<~iZ&>yP+P$?6 zLS$$aG~qLGbDEfQ6cNE2Z45n|vYA?LW1pW1Fpz03AO#QIjAlLG{v2zduiw4*{PbXA zxhG*h1vT$|Gfi_rv;1W{1`y3#CKI!Rb98pr<)cq(oqY{fTVaQKqshHJm!$ovu~FV8 z4Bl6u!<%c<9@jbVoi<5BM^{u!+#j6T*pNKS-{Te)5&lB$hE}( z`0@H(dir+R(S8}3@4+S`y--Xv6g}PoX4RUgWd6a9j+Z;@)3@P$lCvAPZr`5Y4xaa~ zzY#0`uF3tY+?4OQdW4Sam?Uuez`OisE`=)yL+E}oO$ zU&=8-TvmWvox#2Qt0@fw1yf?9J@2(471k zOG``Z3}_|B3?Au&#FO`k%V~RM7_-h}w$tp>CtvU|UE=1&Xyb|#5*{suH$vKj^wYttz))(}()NK#}`?{Ct@bUx}z zv{FTKWp%Y-xv}P~XW*19mOWk-{LOkAgOM0|{w~G_uj^$9QeF732#(ZenSpWwV6Spi z<5$MYZJ5dmN=voC;)eypH>gpY2;wASxHE|dC=G`o1dQ)FoVeco!uL} zESeC8wdfGN*0d1>ZVH?g^8T@s69d=bSEUb~N zTy9*9zF9EAXI9O}DYemjicXC=<}1@b8(&RobR(#c*n|C11X-+!n<#Unv!Xz@At8-m6{p$I6 zgg2o-ke!va`(Vu9PL|XVgy*t@%BNU`*K)ax0~K&X-HOmiTVN@w869siBRD zvqj)q)u@<=$cMHV28Zds6vUyOdJ;7=nSGlHSJO0|ZEcm%#PxtHKZaj~n6)weIACuw-Jv&1OP8DS+8X73+<%&(1ilmU?qt>@T&bp989X zW~S6u@4;EMm)3_aCFz2e^GXJi}z?f%*CQ#m{1T zi~jZPv@80ChFPrxFk1Us$Nmo)eT%ZqH^`H?EX(=PnuhwPcP*6+%gh%_dZ3)Dz=|6W zH&MXSPSkk7bIZ$Vxi|N*WiEh2nZo98I0XidZSLi#yXzVmrM!6YBER6L=v*IZwT~djf}fwCI&=Cf5e_7b3K;&3T0Zvp+l(~! z#n_F&FF-5bNK$v3t`pDcXQ!dyKe(A&zh0-2I5af$=20)OW(PO~bl^bFe|7B38@Gz4 zjaZM4SE2}c-UKI34 ze~#)ro*)J#g@%#v@V?Yr-uYk61ems{o&oOi3nlzMdE}|HS*h#qKjv4~z?6k#HS* zy(>{tQnDG`c6}%E+Zpjx^$1cl(wJ1IZkouuX-oD=o2YG1-aavmY~QRK9}lVKmVd(1YQn1L%t5; zIr|?u-~Yb&-(L7!Je>H*fy&}6g!jE-_)fce$-f-!xz>0pi_;LPvTkNJHa33WYsW8a zCPe>lI^6$jZuzv`T0a7GhTxoYUQC2*a~A8<%mYq7yeNG`f+ut zR_|aJXA}~0@MYD5I7qAuUB3~G-Ai*C=KymM(1Mji%w*69jqZqirJCeEgSlAS>=>U% zwUypY;rLDt5QmvVESF_V46H2QQ?9o5CJ&Cv6@OKb4hn)UX2U7V65%^Vivr zMMbwcG2a&Pg=J+P57I6JCy|+*U4nxpfT6~9{KH^@w%NLS)V*tM7ze#hqY~3R;=!&9 z1{rHw{v{}CfQf_}qOwYVgZ~agr z+Xi5-{YSg)%+qzo0X4hJOU*BD_&n~!;LO&aqOtxrLLkwy#!KF?kMd|{6SJ(+@k=RLO*3) zeRF#^UVKwSL!$@ZmdtO~J&)XwaG&}ZK}mOuJziTTX11V==93~JEsJ0nIifgSX0)%R z-EaZ0%xmSlBJ}>anUcCX84z7;Z*8T<9yp490{aZ&DAeZGT@KEKm+V1v7r-ePi~dWc z>vi+VX5C@ZnOeg`LuxXU2Ar(t&8nBN*uj)$`xNkr{zL)J0I(AQH(J0 zdKSqto@_B$$-X3OaVBzb1yif^$Y*%lltbvJ%6M>Wq?StW7mG^!!DC%Ckm;IXQsc4qf zXX|IV*yI2Su$u&uQ5%3f-HurZ_yPzX5fNdZIR!#D69EjNlj5|V@{HQ2 zZ^HCuq!n6xkNZRaF`_HjbI-@A-qzQ`ejy#joI|XDxd0|N*}CNgEejtLW#SwN5;p?5 zr{JSl5Pww?zSh>7blMKkaDSb4_w)CE*B90L7BIn5!H^Us#4) zeHuAEJZ(*bxmC+@Ynlf0So7#HTRmyidZg`OzlbfWn|GQVA88Au7nQ}%cTP` z;4M8H^ni>lBS)T9ggqdEOPjSR#?1J_Nx5+CS^;=S^u?o{G=h|P$m98kDK~=_v=^EN zPN{mZDdxPDv`Bu0q}*jU0y3|$^KEyXZx{%E-&YnAJlWETbo9NjkB^D5FSO{oOZ7L! z?L)H>Ut-vXo^$xRQZL17ogbDD{%nIysEI|TRbD*Fak|dW6sY~W`uZ#J?N!dhw=^t- zcLIJkp8(8kx`O~*tznS?d-aM66)*(W{yq8<#vQYJ;1*l!>1(YNU>Ij79ER)FHITBO zTpzLB4WR)cHFYbDcE(W^WM`g~r{>*$evLWyUCZ;$%}v;1rMgugW&=2%smtGQ8U z%3fbxeKU%!GT9df5-a1o^!moU0!z*#AAFCbS+Z5w_VBo2U!7bUtIO%ot$tNN>Ta30 z^X(i^R}y-OO4vX}@@#8Yy1-z3og%wK%+z_(c8YJiVkocr#8y=#Fkze_bnt-|1W9+q z4XjaIPOcd6tix20z)dFVKru0~kLBf$WCPZR0AYN8{k#iS{Vuk(rR6T(hq=$d$l`7J z>QLbZu6erK_07E&99JNII?ms7K`96EECO4s6ddG!z*1PFX*2w ztu-yOpssM|vGY$?_XBAPKoPsJ-m^1#0qH_CG&CJ+{tkQrQmn}WS_Bc1Yr4SWeHg5G zNqvpt@mFA6cMvXu_07GzjATzBj)}#lMSvVy!7dKwH8oiR5d+C5U@DFH=tT#|*F@IM z-N!3#P!%IB4PPi(onouxB2rXoV(7irdE?d!*DSVVky zcjeoxr=zvC^~6rV;nylO6y#$>(uOwYQ9X7B1_mputNMT(gUj7TG0F-OZWFmXJN~qE zbPj7SZnjr*{S99C&RolcouQ`h?y%@_B|9DUrErg(DDAZr#kVbJGPiu${Z-h&%&8*8 zEzZK3enTVqV_8`rYs_`=mpZz-PwYdx-$bu8`wG?3jIm+vC6XPOEy>%x_V$bxTr?`2 z_?E`@?U4=9Pxbr%r{4A!}{2J)NGON%4{A4BQ?K3737W zbC(&VrM@PSBqI?mwqwyfJpB{Iej~qrc_JlVR8)w7{FW*cDycK~fkw%+^gz5x}U5_Q~Q;;@#=bU^`ry#QxM3{Z;w7V-&0nO1es7fO$r;iNNXWSff$t>rU=Oe z5T~Ikj-uFuc{u|=`>&a{JrM@#Q%gf9J1?*85Yf-rnXH9)(nduV_JPX!`g$JCo<1a_ zHaT>XMkPK3Nmr0m^^tftz_dI#&YXPPqt5j~1VY^=HZhciQy}HG4Fm=9(;BB{I_$^l z1ImCSz&}|(?T)$w8!&#&1Jrx86v$0$o*dZodtX?16XWx)7>Ll;a++cq?W!4S(cag_ zcysR{X~MzdXuOoF4=Hj=VAO&jEsw`V5a-{O%x;8q8O)}-oj>G_9cHrm*|A}%9o$$O z+_KlH4|Lo;)uS@yOB7dV3NcSsr|U;Ir+^;L2I7latngXXTAQjJJj}}PWxt-umXe*H zuRwrkvsnE%C z+KIP&?C zL3@1~@C}xOF6=`GOQ%yNw-5sYT?X>9WUmEhR4qUWv;v6M>lU*@_)xK{ky~EO+_K#F z?%$6fYg<&S?aG}dn83*wL!~Ey>mHFTM{2rJLM+ANIkYi~{EY*wth&rBeb?l59>a1H zT#yv^|G~K@f>49cj>%){^nK^icVrnU(s(F<}Qj5@F=v2gJZjAJ(WY&`^MUDoC;T{%n5s z_nT{%sqDJ_6#Fl~I=z+l+ve=$>LDIf>m10$U#Y0ROdT5k1s)(xXqoqyf zi$@SR442Gy!>21&qe>>XMr1kWs>o+5*6$}~h3}kM3u>AS4b7}HFGZxfYPft(cDCp{Ne}m4BJs0d`ll%?iBsoPIKyTQ zj8bFw9H0cjWR)X2vzkI;p}ceioDnpN>mIWu2wqyZb!qltQK4_!svkbfU?Rt;}sO%hEcluvYUO@Wu|GsL6`H zEx#<{JYq@4p_UnUU_XLs*u#z<6D73i^;y2-9e>qZ9z|$;e+m^99{2Y zbGK-+CQ0A6Y9dojz2dYO*D~JDXr-o|vb$aT^eK$L(^B|0EtnB9V| z@ekil^p`8k%2YdscbbRQ)cTpm+fXu5lb`$)-#ggX^nR%&wM3W_c9*3+{ZR`euW;DN zOLOuYKTz7#Z7*PZyqNMQ{d&DMObq$zABJS%M!>d}ytm-`H(~8kdIk#$v>f<2m}PQq zvr%_Hqnm_JBnhW~3mg<@J`rKwry)|$GADa*&l<12mHvIBSWiu$VTB5{mHa|mJ9FeP zaZ1!UH{D7^(uU?-PLbM*F>U0X<5Dg}$G5a`!Fd}wQ^ki8|Lemnnc2h9s?zOjLUmd& z2BEXAq-d^rHvK(7eWLr%qzo(+J5%P;ho27KA7|iu21C<^ez>)pf|q$AMz5qsca<@| zGFI73Kp6R39+t$y92#G|=ryLW4V}%qPhKy6rk%`}EX)#Vddf|BOZ4-}BW^GA+sV_( zcmi2afS7gP6hz|=9KS(Y0AU(`4P3)}tvpR4n3k_f(9&@84_Y>XF~HV>dzu$)|M1^H zTpa(zkI(Ah!RiBV+69Fu?uhNAg!6G4e_kZGgKeDL3^gg_#9mFff8XJ^q`>K8mXT8IzjC}l z$e7A+LjKPkNYwxMoil_O(vfN~E1|gE{T?3Zj{*l0m-?r#PpaJy?nO7@ZVo$-{(Um# z7f5dYmzOg7v_lCxQ5Wym&3@`D{PZL%!w5EiT1k<0Ko%j(sZKRzkpB?c^!at0SVH;n zEbk;3UktXwWwG|7i@!dIKT-}t;t&2Q7&=62FZG||xlzdbH}#*K9`8vP(sJsIyz~c- zA-86p3(zuN$J)-{ z68OHE{m`R*8~8AV^F?;Yd9-25f^Ciz%R*?wZp?zrQ6P??>Q@x*69EDLkxpXSLWGtp zl^rhlp3sngvCMsJb9g`R;Z%GHQyO0;s_u|ulzAV)^3zvntQt2&8biF566Z+&m}g3D zxBFNO(fn)KpV9G$>OKOQb|mzp#Kzk7h9}jeU+v`=Xjy#(g^#S%{(ar2R~KnB*ij05 z6CY4RV1>&d^E)|gK$Cp zwkwrY%aLf4zp0OD4N_d_uk+sO16U4PY_;H<%bz;(zePzL@7&Y%2KTHTM9720t+}He z<*)+;sc0QdG;<4{4R}C0c$2hS#}*8pUqyl+h#!uB1T4dEn{Y#T`nc8sQGRT7sE@py zXhv#RC-$LfmSf_^>qf(B4eROEDzqM&IR23tozq~%xB`^s!2G(6`#KCA3C`oSe3s;l zBl&YD0Su(QP-Ge2hpzY4_L2g$mwT}bY2(z9fB63C^#p#GYX;?ZxBpG6TNpe3%VyPo zEB%&?rymk;yJRy~Ug0`7OSumGmtFqL4R796=@gGsC5ru9 zT+(30ksy&4wmx8@oK|x6Uku*w45p_Luw4A1$MALTv9z3#{)J{2`2P5qCsH5LL5cXm zI>Zs~2hR%2;r$tGJZZ6QF!(U~^`8}9I8aQsG+DY1i}`KBA)jOan-1JYmX?+rv#Gs= z-)+}KiSNT180r|mzSLRNas8OYOFyLCEw;k=>WtsUp}{Jg?YGH*G)w%U(*N#3_5Ywd zq!j;<4Dz2Lh5kqHtvBR1!sZy9B6^GUd{JFp-H)~oA+S%p&p{CxWRO6TwG*>poCV?~ zP^IeHpYqix`zst_wY|NaYzIo@78Vu@n2jz23yVxY4kR{n$vD*nRD?mf+opDKd1!sQ zzK^iM1~S2{Qm@M`og01Yrzfi2%zBByTNkw97`I%k4UYZXw>K3W9BhAROvpG0RUl_Y z2!RdW^D?{YY1{qS?N3!z!|wgU5fwzkc^U181)+Vhh4U=9jAZPTb5zt0C{@cfV>nq;TEe9iEt5<#+jK4DAbB65&h1;>7)OfCT92>Cp?ll6ns55H1i7 zjm6#j~BdtiUay>yujJYRxjUiTrpZ5JSJt%LEdLYFu zf~S*uCANOo;caT&J4S>wQ<^v~mw~*o()DWq^77S!=HI4eN95fsDg{ntcNK;adX>Uu+` zCMMpMYY8#FnOrk8Gn@R{UQ}G1fgG@rS(|Azvn&hvMjcuBKrtHtb6OfY5|LV=0NCIy zSp#nM&b|_>0tyy45NN@&(R93VUS8gyS)jQPx6CdR!!F3;B)jF7<1-(B@Ua3L%tv3( z8{Q!-ekqeBqUAk^>TfhpfHH&$58NjQlu#$vxNY*E0#wjE^Q~cW9o<*PVHL#Qxa!kl zuwd(q(QmV#FGfGldpr*CSD?)3Ddj4FU0MQopSNgSUodM<)5QiE#np)_4S@Y%k8hWQ zcjs>5EkO8~7dP+Il$5K+^#O#l8nQRudOb|LjlIH<4?-p#OUqI)3Wzbktt_#Aiv?PE z;v8mOrLJ&mSFGvhasmnzNkM(}duT(*?z$J^%i=#=k%bzFW+706PW3Cz&*!$O2Z@Qo z6a{#nKT{m5^oLKMZlNkbEm=dxj6rG7_!kO4mw2E~cKcMnVq4U_vR z{p3L1JTVs#xAMb7hcn-{yks(E!VkX^z5;w=kx`ih*4)l6Z~kxYzs~Yrj0Te1V_r~P z%!k8(6?B0dEDs4V$mXUuN(SizQX@gQ08dYya$~+lWyW4Q@It_-_S2xi2CD2#v0p$A zLX|z}yLmxTk&EtP>Xr|B1Jhoab?`t#LtIKKbvOKAf8Q6yUt=8pxiDt2Cb~B|v0Ejl zJZ^F=>oZETZp#Pr^QZNQPf_da=Zwnsr2Wj)rIQy$3!0h~uzprRum+dKB9;pQVsU<7 zFiq3`G#${B?zQvupy)FfHtjHU4wHK7)G3onA^^MPp4xPYmQRl1(Md#lQSMw9@s( z_>j^!A_%lc{>xGDX0S^;!sGRJpw#GHKRr0p-qh4Iqk92t<7KMIuc_OZDZ=l)pySp&0#se09`r ztd~egli3CKO8NQ)Q1LKcxy~@w#(y!|w(+mbr3^lB4gUzZjcpG-U_eCMdeO8|4j=kEVw5W8y zTGnlO+`2X+#s|Y0FZYCmKKp&X?tXMyf`a?q6$^~Ht{$w?FE6$G>pkTASfJ%ZC1zBd zn~iiwRCuWb8%wND7gUHh4YE819LI#{OzJexCm^EtM1LV)F73KG4f@0mmY3A7O(@10czRTo-JF_>|OfCsn=_# zlLhz3GT{}O@ci3&+Xf%2prD`;>YptwE$S8xvaE5iQh62mUh!LUuO1Ox@)`jV#Ia-0!dAkX&D1>QM+O}9R4g^$ z`?&|Q*&0_F37w0t{mihi0fd@?ySWW#Tr!PnV7~V9~gYIIX5uveETIHufdKpDEbUB%Z&fOu^w8OfjObEeC%g+HPC6B^MFJ6B9#0wbddEp{LjZ0)*tdQ3d*jw6V zc#xah+SitT;KHe_gszmw-aO*wBudIN(rkv9-?1z+YO(hGR_|XJ8)n07Ci|q^xYvs{ zx3aLSaM9Gpbh`5}96(A@Fb8C+W)hLVy<50fcAVK?MP3cjpSGXQcs|Of_lZcBqnOOB zv_oBQ01!W5i;_jOx7fapeW|Vn;1J^`e81z6_nO;K6sU7_n78j84nFklu{XB@9w!RY zHW*#{*G)2;UBCcLd@5%Q3mGxYya(K5@Tef#2}c^focIZ*)85m>x+S%Lb z9$KK=2OVm|8!0R*IjxG$l-ooR(quDxy`YkKX~_pRi1fn2(D6czWyEq~g+JxD+Q+_+ z*>F<>z$^6<0JZa^b*coJk57UpLRJX;#Na`#T@H*~RxqZe*F)OA7oh5pZexIYc4DlO z0OaPip6)8)w4&*?tc#rhtOyvqrx048yFhKRAHr|fq`ka&reN?Uuy4{Sb0Iwo8-ez= z&04L+{ouniE=mrzo0F}DKB{qjdw5rq8uMa6bC{>@7>EY(Jb_(Z&FB}%{*#UPdWQ)E z>HYpbmIC=Zg8q5Z7S{N4_rSr|oa4_Br22m?L-ik}v;O~!A^&rEzu$!7{ftDaMBclm zJ^&yg!vK@CzP^4kg$lAM3gTx+SJ&>k(BGh`Hfez#LQ!6xGJt+Cp(ZCMsdbpi>Eu>$ zUlsI-1e*sH91y78z7q}kd8qfR`ERZg)2auckR-|hAW@D7J8LqYKc9l~?VH_j7{`m4 zDq(=xncF>}_CH)-cXvZKWxoFl0+GVyS}B5(wQ_81tZAKZAu}`c=1lxFwm)Wj{|YG2 z@z&o1^?XM#rxhH|NL5ueI|h_TpT>0OKTQAPyR6G5V4{EJLKQ9?_5gzL0bi34**S^Jv=0j04BNn zt~;TZ^mGZ>A3(@1bAi~*JwbX9&H?v0*$x!?0j5+K`U4n5-|b}7XgHm9SbH(Wb$BX_n^uPqoQu3=nIfY;OjXoj&(-uSPppgzxfzQ}|nmkT~#%)l#zTbWBVNFY#!>>U%)t zZ_c}xFLp|H{cEc$mz5d-Ie`Llk0M6(V|Mo4*4EYu0E((zPvBJ5H!->C#MdE2#^vnM zgd-Gf(gy}~Q8MEv$xT@dpFp%hMxCTmgMTml{H&;eI>OfP<-5a^+@z#sW-3 zFhH180ep*JK!6Jfdv>RM;<=V{;uQwSQOfQTCSFnEND)dpge}I3-2q!k-M>6o(BtwR ztaPry{@s#&O8<0A9KZoB1Lkpdb;-=dft0k`zo;U)<)Sqr z;r!W*d?po2f{j~=T+2UOB5v{XR~_=i6)K25AJ!h z7Oc;V4R%gl^>f@89|wX#4(xVLKtv09>+Y?h5mo?ZD#-z&G~3(&00gZ1@+CEF0z{kh zfW<7X!EWA)CAv+0?RUL{LnF{426@5}Es@_D8-xv3z9^Gv3Ch!;pY3hA8(5k2Qcg?n z%T@rd2B1HYQ}?@RK+3h3a(PszaPTfOES-0<#-pa#qxgm1z3b+Qct@p_PcLfl#NcrEC2mN z?@|@y^S|=7$C+bDulAoLIb`xrA@2X<2UP6FFOSnd)raK%DJ(_AU7t)xv3Gu%cdowP zC4np|Xrcri3f{?rtmhq8`xfyJziLUb_SPXbx;)n=g{KA5 zx`~%TtCd7IXF|vG0}z}if?OWxshpUY=w8!}pjLT$oj&H_R|M!C1PHZ{1qG_|^77tN ztN_Jf?+HL`w=PquCjtl|@Zq@BvvoQy%8`?yk~%tOW<{U@4CKe~#^8=i$-iHI@0O!= zOUGqTnM`MQcSF#m1YGpvz9wwlrRC-2e&B0zsRNIH3O(t8;CJGyzj`qmK)gVNr}Y&v zT_1pLes*dBGhAe(k+{FV&!r9|K9LLHOF#=J2$<6krmI|1a?3TJD_ws~!8ULv;x6dR z0wFLsx413yyU0XwhL#V+(@Ke79Q&{PjPut_T~`OnR4gU3^|9!s$DaV6g})`LP~;?y zN^M?cnS-_Uoy0F71qxCwj)cv5likO*62+iR&9v*dlGt1;QvaG#n>#5n7i5imOaSU= zURvGWC;~uU9tKZ6bEQ2h6cXV8D4-je`~{CdNP|_Ujf3$32)E26|92fDBUK7ulR@Lv z$19<*$mpSwkq3#=q;Ix054n@{kzthfB)_&YLL!N z^gZ13@-YFHosiN08n?32l^R|SKuOrAamcN=AhHE<|KLS^&@ciTKSUkUJ9e01-UUrr zz${I+i&cYc-SKSRGhXq9MFPElGeIpiLh6A-yO1#mI!E3=yTQ!-3c=!_gar@}gCptfx{|1RJU;ub8 zi#UY8Mpj%{6{@=m0>a`-RZV}_(>5yS)J=9BY?ZfmcW;A^M|(dh&!2Z@+B>W0>T$>0 z30dqq4h`-x{4O(Rz+VL$0<{l5I#d5$`pABAd*J- z=jh-M>+T$%`*|q5=tG#lK1TJM10ZUDDuj^y<`G8f)bRU9+IA!JJ~-^q4QfPaoW}7g z?u7q=SU{@()cXE!AM^`yz&?mp-x z7%Wb1^_F8D-7h#02S``;sSxu-au-VOPNXp1x_l|daixi^LUr3Rh$5J>L(+uzTugMK)DknaO%aju)J=QRf2R9u0nm;&rF5wx%X`iv&;9sU4G9@SpFRH>a`5iHAq~)a=2HJIvy~TtBoa^$psze>mjsf6Jx8*jgIUV6 zc{3ECNr7=7eEnTDOUym)-HwKZ<*)OEWmZ>91j%I;+j$18dPRLQN3?dJnCT z2XKKZge4zkPH zI=ncqp96@9LKx1}nJAJQZj@WTE0(6&we0&~;5jR&&AWBmnWlh0X2SQMhI z3I?Tf+PfG4<&3Lc$$sg_ni?aZ85e?qE-|gNe>igxhTUT#&ZS%Z2sy>M-+mtst1ksu zz#;gdCb`uQAOXwjCRyu1bI5j*NBA`do$G$}s71>Ub95Hc@m`=i;kfglyxgk2)vIKG z^Q1h!q;mWMnK@$Ze71CL@^Z_+tklH8h2fGFw_t8o%d&3C7|@*%jBjD#Yxf6y_8Uy% z*=-15h!t}134>XHg?AiIVOSbB)=k{XS&!ca-=0kp;FoCtxL()~uuw$v6^JF@+$5i9 z2jBu}bdu}529#q|aoQtUdEhJ4Wy~5+%FwO^u~A)dr_nuX-sb^Su%fZ1uw89hVOzd$ zn>{b!TDkq8ZPVy-yW~ng8PqT+3hfHSt-Ip}!N1IAc)*IL!yiTy(n_IqR-jeFt~ALs ze+x7J2{WFHs2N`=*`ex?C$OBDgxz6+YhAr%GmFQ_|^-hl5@j2ZU z#gg#s$6Ulj`Dyjp*Dp?~zqFn2rKG%Pw~%BYb}l36eV{W1xASLi3TpYhy0q`Hx;gqj z%eiS?<2#r+slvtZ)MCF8(*tF*5c}Q?pTnb;7Ir6>we4!FkqMWQ5^)*^dipv4VdpD( zy6V_HUiz3OHmYVPn;t(4bYDoLr8VV)D$}=MsHfqa%a>%79V-V13Rg6I%Y1ZrXEuc) zTIru}EZ^>x8-EX!OZM8lU4|c1)#2Q45KDi!br5DeG8fVv^TSare`2Q0ojyjnySKLs z5g#94CF5`_1(lsi@pN~r*7ZZqgP|H%iI^wlfdXts4qnUg32@Mt9ZEo1B_COaZYUEh ziiQW8^gzz=2wo{HxZZ{>EXevs?%5}nybvVG6SoF0=monFN=kl#M(f8;PU@sa z1R@@T!4%3|Q6Q{doAEnp+?%oy-9z#${F;cZxwlvrPg*#&w{)M*dZvz!$123wg_p7% zv1!w=2t7Qn)wCl-{*r#lBUq%$NJ)L{|3HtRh{Q=1Cs%5YgOR_=NSlax55@f-rzUpM z%k_J6s(b_@U7Wk43+2lfANJUvO6;2X=Dx%o&C$(7dqABn-4BeQJC+%tYmZCx?uPnr zRz+hDo6+Rq&IjR))@HGI7bGpU@jpwPV+JLw+b zP*_OQulxL~@d{f{M?N0SRYp~`s`8svo)5>pmHd^a7)A${`nljf_t6FFvgtq#jX@X5 znQz*09!+WUQHu4?6bTUlC#6baoX6`VXA=F~-pP>4J!q@E? z|CBoK9}p1M>LQWuX<-!dpa^LdDv;lOvN=$0gxT?vfBl+z(h}EMm-n@$F}1bnqusN= zwk9r(IJ(qK8k?CVK{?pioM_R`RaB^oFAbmFSVqgN=xFc_+XrF%9+Hxh!pyNhmVJ9~ z9D3KnW<8~bU#3V^S6Ank7A@wPmRwIz%P7>#8C-sk#<}=~$g#Wl_4v zxxla}l7qOUn$FWJ zp3HhhlA=TWFAw6jB5Ov?suE*I-#TdK851j${nB_VM`~*g-APy zuT2~0u;#$oDgWN{O9in>Fsm86{6 z4#Cr&5q4_Z?SDl=51E<{JUo8-#P_`4p4`+^J#n}-Y-K|@g;-2i5FS38S{erhTrZcY zWIuCi)=$}^xBF&_wOVjR>CG~Y^UUeD_s6zU07IvxF>xiSqtA;pr$;%5iL2_T z=IC_qyT_S3RhcgN*LT=gPAK$vpJP@&rHPK_$-ndR3xO>nygd#r#-(Wgt|#tVWkZh~ zKHc3fFz_r8pEat;lPlXYGMT-3am8PUE>J51Zu`}=+o)GgZAT=tcH2Tp_(V`yk!;_7QZwpXu=D62&^<8{PaR-Qfd{p@Zqw05ng*sl(N6bO-Sj z)ERgg?H>P>KUX+;y}Jl;=n)E-<;$-jm5(79ey&AyArTqAI~RU;gCdTsQ$q`I--vF9 z!#szNX8!u?vexTy%B|TIj=i;)r^MkUf{lEwpGW$(_8A-5k~&udwKnW-5jLV zt+Bn%jdZnM#3lSl*d7)tmB`81y?n`e9I=lYjEnr}XFgXlK7Ng4h*v0fr(Dy{wJ6C6 z_qZY4YADOm_LAp9!DzTyvUA{*U}Ste`b|!beg@TDrJ4t|=E(j1x=@Q6Y#nb3>e*zx z3Mb$YLX9Ke89#bo8MZZppCyL3KijkSRhlvwj;L7`BaxV1GmTM;JkAorRW(-LlsZi!*l)~8sn{&UwhC%YZ`buN2h z{p(HJW3hE(6BCJOI}xUm$2Y&}q}g3#etDe+Rq+}%KexLg!wTNR!oreuc=r0Y3y93j z%nFr$TIO?z`vI1#dfBV;aC> z5!l^>ieiI*)JZEVpLS}obwD61v_2uGCnqB?Ql6}o)9#~sWyCl(L|sK?B__JhQS4hw z%d;t@7i-C&QlSsTys!)4)Dpj)cY=b;Mmibr_Gl$>i> zP!iz>5$u-qy?^}iN$^7@t)RVK=uyDoB9v4hSDTfmcUSC=;t_(>IylCl9nyFIN9g`l zva_RgMQ71ndy}j)$=^-~x(&k7HpkvKMUv}36DL;mNbhU0UTIjGjJL$M94;Q1zkK%3 z?4mf{44z*n{LLce0o9cnBs)|U#Y0=~T94|PIm|MT_)c`=xrh5@1V*WH ztPWMQC?Q&d9@EgWZcKcb%g2Z5FU{HuvPah56O}Ej?*Bi{y>(F4(f2Nlg+T~{poAzW zAdPe?Qi?Q4hje$>K}A|nq`Rb~yE#fqi*z1o;Rr}K+;#B#yYIb!yfb(1%x~WJ4CAPr z`h51@Yd`CGp0#$yf)C%!)hjxzZws$HNb58fejrO5&MPduGszv_-DpQ)b@0}dDMzmS zrMYO0JUvXpSG*J*t@Q_GkCyeF5f~hhJo80Psc9hvCvE*UHwALg+{{iULlNe(66;<1 z8Iy76&yFy$?nO$qZ)Jzrvs*PM9Hes30K}kZyPCjo{`dUL+`*6C#tQi=3OUNJ#<{-? ze%aYV{ZYFTO_+PQ;)+;X2N^giNj)8~ghMuT=T3tE(*VB^2n1 z1?|B9Gnmx8_UF%c1CbCKTa8|#K(SYC(WAz86m1+D*j0S`tz8^W$^rb#_d5o#kp^vr z1$p`TX6fp$`~4cocDuV}J}W*1_zWFBwBMHt}W}G+V63h*&ePBiGm6;d`wp<8=Ikcn})#M234vP@^T;QP?ID#>@^S6 zAbk<{T7#T$aY8GPFuQ+v zq0oC57`y~VYxvXi8uOlz87cZso%1a7%2NIQ_|$aa9KrhTW7lMp)v9Ho(^;3f{$+Yv zE6jjr-4n{u^ZI>)t$T=^Vm;;VzmUMaB?r)YA^-4iH)(x3cbcEUjix={wUcr3lIbyl zqev6}MhmIxy^NPelisXJh?!jsQ2sGg7vuHIrL2|rmsJAx{3Zrjdj33tJ~%Bdr`@&O zO%OFd(XgfwSbX%{7!^I5_CSzgeN6DCL)ahDBKAtj?dRTI(Oi+{*pz!`GGrHNnhX@Agakj&A`q-U3fbEonxk*wa_=^*q72pOl&b2Eok9j=Ljmo9dovelR zxZ=ChJjlmUc*5-6Pgk<#$$i!UfbwloRqzdL41X zbo#JVXGxXYWH8vb*Zo>=-PRWqy`N_@t5=BI#|BVDqPwtna#`nt8mXx(^Ktg_(ym3`5G^@8Zpcb~ z;HMvqD#*(-6`l3Twz0w5lE}Zipp)CIbov}GLL(o$&F;MFJgL&%^fS!=VP;v55Canv$<-HDTEl3kQD?&K7m13$qVc~TN{~EO7@iAo z|08XII9c%F3Zvadedecfl&&uD$Z@(_HJ3wxNWX?@`e>GZE(vj9cC@UDyq4&kBI`kL zBq5q`xme{Jr;TD2lYVj7rmM>;k1oYwj|;XnOT+L1smrooG!|Uft7;iMT*D3eo5q= z2S4g)A@`uUXcK__9Z2DA3_UTdfc>T8yZUx*9u2={w0BXt%s=RM9w1Irs}C=bMkf%5 zCPOlSmE^Yc@^*tdi}^mJL1vVA<~rF(9xs>$0PT1nO>gl>+FdwZ(>*0bcpha&`O7_C zKO8HgMB20a?|MVNvNu=iULPc|BJOCNlgTOpH`q z(CDSVLay9%fkb>5_%(|gE$-)yU6;`mEotw}Y4qc;_Zl1Dn%w^i$Yim-4rOAuCu2lV z_=b2l8V3g_iLPB_^BWzZoMms*pFeqYgVavDyO$_)>i@xN|({TpU5zso@N z$qWbkr6=>d*kQo&l$UeC&KCQ@oZMLOj)#QzmV5p8kY%Vb`%(Giibz{eR~IfmK7Lv6 z&hD21*gzlVr; zP9WqTBXqf)eHI+#M6Emn{hvT**8YX9_+Z+Cf`T+<2Dcd#XVZ&#>#Wh8&uGI-6lf5S zyWhUa1PCl?7~mR*#unp}@qfmjxWn{m)Rc4XX&iOofNLxbM}b!LTle|`uC1=}dl2dC zl37TC-=H4{$kK64ruTg(y3Br!Hc__8jzX*6{iVf^wY4=l&$rA&i)^!5H#T<%t(vt? zvYo2>Ouuib$f;e+r2J%;P6Dj*-pNnx2X9k194`ks}H;NKv- zvOE)_u*Xd7CIGVTCm|z~73I6s)YR?*&!Ke`yK>?1Jo%00@HN;*QD#_(LV_(Cl3^kw z=*Jq8O)&9EDsEfzCt?zu_f%MNS+5V?4M307a#Rp1c{^~iwG~?``P!#Ny&{{JjDbVdpdKK^0|X^?hl?uwAQQL zSB!{s_3?RVx&?zeH1l9aC@0CEQo#4=IoRTp40=6Z1Xzs&2p$@mU?X+l?9|M603#MK z1!KEuv$h@{nv9*&v>Y$hbs{`u;laXj9(HKwYjv}fYhR%uuQ*ng626Z6(u3X|ee!aH zbG+K}3b?o3{(ieWAAc9q*bi67Yy0I&ZAz#whBw;le|)TDHP8e@60n%;ee!e)d%ZL3 zD0yu1)O&4aYWH}(dhJ7_x~}_es?*uaz1z%qVrLJR^cQPtDN29TFe5@uohHynxvp~M z?C;dnHA2M(Zvy^3^bOk16aIU&w1!^#&ohETC~^M1kr*+#0Lg!zOV91hMDXvq3YP!% z*3@YuBgIet^W@_Hwl|)1u!qNJ*uU$63nG&I|LnW`w_W7_{>Cy9o%0_7)}FqN=ro$M z=R>VQ`a_psU;U>R2`wSnW%a#BExB!Vjd^DrkZi||OOE^v>&mnDPA+8#FccRSmB}&2 zcc-Z_NsJY0(CW>PSaJ)^o30v++2b;h78e?qE*)0iM#%G>{~JPwMI0>7%q)UT_R~!W z#EkZ;#2>Y)7niu+&2|_*0`h4?mo{7k$bxc>ZA;DEK{m3G^W+gxM(wuT+}uB`E4|2H z0aLqs>{UAY4qdacHaPgQssMcz%22Sdijc^){RumYl~RaNeWv%DR5SX`fRh+7=VHds zQN9Lyokl}fS66~X)>rk&P9x^RBS^F&q#jsWT7GvNFfR|Bzw+dT2NJcLe_f%oSTP6d zHQjri!mMM}S}yJd)C(0=HtOVxLnNbhMyA8pG`(bAA|6&zb#)GxBdccZqy%mF)yYiAeF47lOeu6KSXwM>bI#LO z@HE}R#V%sP@%i?3b06Z}&S=@Z>-O?XU{Uf*&++D?e4pygtexHM07@K3@C=-T8%lVt zT1yr`QCCN2hjXi`tGnCGo0W;_YY9_tKN{{I0=Z^(k?zLT{OQppM_?pWR8-i&m5|KJ z%xs2S+jdve(ShFP3&xDse%GDsIraoulr2jMMmD_yCHHc2n}$P zWf6J1A&{v&S z&d$z)`~BwSf_mBe)MURWtyLG&O$}w2j{rP9gZ98p>e{+@&H1>`#4wb^0Ss1VdB6&g z#7v!^mI&7Wq6uOvD6Zqci<;H(`0n%4R^BJ3_3Fhr@1Gffb+SvDxAPRtG=KCQnCd%^TI5YjI z9-W$M-Px%)5-{bhLD!TJj+>VkRa7jHC&kPba=&gSG7BHYf&o(yEB$M`Mm`neD~%;gR(-8SW|z_^S_TLn_eZ4bx&b2-0+q`mM@NmNgA#& zz3*9Prz1a5hcrzjG-?AqSf!#S&~AUS&j(d}NU^`Tb?G{EaQ~%wKl7oa6LA+b1E$0QHEYPM z&+c=OQfOOS+Z)umuhY}1Sr;zw0wFlvj>-A2kZ@QRpwob?nm1j@sh)awyBC2hJZ^yh z7*}SvSvGD3Kl!4J9SvuTw`ZoIGZagkqA$DVd&|XRlBdMYjqeA|xg4LJjE#{kZ@d3; z$xyudb!p%Y$kJbJNk~Z8ZsGp00H0L8s7T#`gHY2~`yh=v zS4a+6(y&f>={J90$U)?-98bLE_j`iCiO!r)h2bW|M-)Gg3?B;%i@u3To01N6gDhds zccwVE-eKqLyc6ZraPBLZ*gm17*`!Qmp0Zg z^c3n~sIuq5ANtL`{-v#09V9(jd9@aPdLO-`?#$J4HJ&H*#Mf-Kp*FZ_bIZ-eg%qZm z+*Avi(}#pvOGifniMpPcE)0e^^>+lklw+(Cw;-gu4rQ^C+9+pT5>v<>^z5hpX{wl9 zheJJOZg8X$Wssrx23=#Hh|2}!usjoq5ZbW$p`?OtO@9_WVs*@C--WR zhqWAq*L0akVEz|ZR?(gR}P%+Kw<{IGU;6G>%HJZ&WJ^D!@E4uJ=3hw{{=An_$R{&I zEF&u1wbY+%0q`|lVR{6>ZeOeMH|dONQ8c!jT#?3ZU>gLsus0%%cRofoE39`>2#5WA zR-$pYu~LC{$`B^NJJ*Ilx4!RQF_cgQ)l^#OT$|ql9U%P|vNUA%sm%RFN=G9O^Hg%7 zUZC!_S*M*js`PTrd{EIZTJy>CG;{VE8g8u=s|`B9$dC(O%VsgnpFj`m7i z%bm2gC@jQrKfg*B-fjwaVkX2~Z8^bKDMRsFPY=F|sw&;;3r@lA;pZ$&Os+a|^kilT z(dHJS9oQ#9SuKzA%=O{l5)Nj(O8A7~AI}&J`!ySLb<= z3|%E^gZM@w*JkJGKM{}F$>XiYQ*k6@l|m8oml9;d!6dKI)~DV98+(dkj_VMUJn7?! zsi~;KP2z!^OEdYn5NG}LqSAkxf@M9AsFjtHTAJ$)hzJm%09msnJtT={ij*3Qe>$@o zkAW_xpZ)=Ffg6q|&FD4raxxw0o_}ekHTPrHQ~2?^)4Rpg{-s~g#&qmA zcFkrH#o229em(1H9iAt2|8GW}tf2G(&^zCs_#%7h*8;I`sVp+3v&H^CCa_UIPPn$t zy%`LLHAFcxT+tJqTk84tpI;GWJ^i0J8KdOKxLn=dRml7QAn8i9?cf{zO4J(hrbv0LI`E90L zMhR0k!)3GjR-DfzsB|gjybB4z1MpYfZOfZ*EA)zi#=lJd5QzVPn?w2BR&n4LC`ZDs z4!dCybRbCTt6`2YtJlm>e3(~Qn4HsNZDV8M9o=b!i+!PYaWMk`#H6)Hr~`Gl)p*Gr zKnDY8Cnjd*;;A3ZAR(;A9KO+fE=W-I9i4|NXO8dIH!`{uDK+1?^TH(y)~B!UC4j1( zp&gVi*CTot=h;t<^os)kvOSlByJ8UfGE^2BHzyPj!aA>>=E-yjeLRc(`R}StBC1ED1rQLPNt240gX!BC8ukz$NIBF z<>hB1q%!8hMcB>7zQf)iRJX8W+z`92I!lwipR;h;c1&Q*x>9HwZq1gvP_HSDf-@%d z?Ym{HW;~{tL%gvs2w~-Qe_iMeZ;@`Lb&u^@xO%vY)gjdYJ~sF3))24zONiI=hS4Qc zkh;T-jKxPL{flSzaZ`1kYI>FOod~A%e!EFJI3i*fYRm0Ww#$E>X%cz?le#6%)L-^3r3H3 zbOcSb7D`Jm^Yz+M0J2!A`J$uLRd)kPD%Y1)kBD2s^?3VG;wt zUS5>22?b}xW)@jwXqKQ!@ZHMoF4dt}{kl|#xsGq6%OaYLX`qS_DYH)6Kw{|+;oU@N>RcgBwocO%4M1YWS>W#&Z#xth&u!G_ zC;rf0@+H;bbpzjttd8sSrIk&SWUn3g*Bw5$nLxTZ6FI^4cZ+Lqz{JKJ<^k@}fd-=F z!~KI{Bw}N4_Jc(-#_LSiD}0!@wwrvil_jJXk5m;}ZziI{{L9PRCUbYajp{Mx1$P*` zsq>)fQVhY`ctxu7b6N1#KA~Rxbj}jtcmPtILVOSN5;;s?=~(0S`aR9hKwYw~b#3iM z#_MVfZpH4Ktj@yM{V`*_;7=B%E|=swbCr2T#4X+L6u!#go$JPA0~;H;Jo=|^<37;Q zowNlX?3V4nYHjcGD3-Yu=FCM=S~tKe(JqJF^ienQ*-3AGKyS$iOHP-_uV z5f;?2A{{=FEkL=^YR=+}2U1X_a~Uo>VzH2ZI&PkSW&fwNhg!WL-_^nk2&eVB-aS`@s9aPj!7Ke229U$C_Tn8FP#hoIAA5^bt4jbm?&ZQudlNM zP@Y3Aa%Fw_=aQ;_TdsjufIeWE`)SENT~jcGQ&myn2N@si29ErAZFb-i1icC}OyFd~Ca z6A;Dv`ofNMx-E(mzY93&&TJY!T8b|KNZoRicSRhM)}-Ex4pkbk5qV1K(i4}}X+ZKD z5jo3SvO7XCG-=BDi#L=6uyov7LmJ!c?T8Nw(&5)JpJez*gLQvl!T1;ZjaJ+?CRQ#P z>c`?*#~b~5oq(u>_ivanMt2rjX^sy`TgZ<gOwd@M0! zWxONumkWw^Su$cXt9^}U<}_W)2AoN}p-@BW^W*sZ$zrY<8o4aE`bJD+aK*prUQ~4S zIWc5~82bwSC3gK5%lL_(IdXjeBBoBFVG!8mCI<9|fE|G$Pnu2==}I-r#0aY( zkr~o;xC-tx_cC>w?G5gycqSOedD?0ZS30y+SOFN72-uea96W|XZ0l0C;yzh5;HB_$ z?y4#XcCTN(&EN{&K-fvFG&w#TbzI|RW>rWkK=g>89vv7C|-hl!2_(>MA_S)rp*&Y-9 z@xr$Km_^ZH0el|;BwCGZ-63F*q z2HQxHt|_1MAys-n+;vhJtt;XuU$!}V7&$!Zr?e}VJ-Fk2jnv0H`%=jBfJJmu5~jc} zuC5LQuZ54#1t11jV&Z7ErUiTJzb=K-^u>PXC-`HXcVY46lnJ0T2v>6<4Myro3NIB3 zqtkq7P4PXIqn%i|#jA%2dvck28L!88XVP7tojAQ?@=lJPh-&1abtTE2NNXyG_&b@qUk1!lNv#K8D3(y!SiWThzgdAVjbTGo` zk}JAF9WnEKKwTnDntCU7>epqwHF?t6HEkJWSSlC~=`Aa3WuEfOd5@RKPY$J7IX}Ee+`Tybh-MPieC6TDw{Q1 zeMN>p_6sHVOy%-KEhO0)Ia(}oPN|Bl@`yyy;Naj585|Kg(q^_Nr4x`qa}N&;0DXRl zOMaZHBb|mHPXtj?XrAf;E;86Z`T2e}tm^*d7S4U!`Hq`%v82J`BNam1O6AVA%;+H3 zwarLIRq(#ae0IYS?%l2QL6yba0F?og`)K&vnx7(na1B zI;4iJLrGI;LXJA@Yfn$8<&&VjZNTJ8pUfH)9UFiLc$T54lz1J!B1snD6jkiSmzUE9 z9ERSw4oi<$lv@~M=mK2EHM2l;DVb~p8w?*z!$o7=gr-4vrF<39!Xkw2fgAQQh2g3u!w{rIA4 z$4u~WS*>%IE99&iz~XU`@@a&Uy(D+`rAA2H=5}V+d2Ov{0A)nEEdTbUzvlavuCTE~ z7AVO_p(5L~Qo>&tB7^cuXY`4=s9^p=zoc@<_ieLkYaBg`oA&t;iaDPt+m>^Co7uCc z==WP_=o@C7lz?F8<{aFL!{GzE6!Z+!@t8v4n@+mTk0Yhrbf}yNe=e2PJp@af{k0$R;wc9~~XNTDP06%rMq4%QWOMWRaIlKP=VfDxINN z5=QD+I7=sm$yLN8r6Aoe9ZiVw2PhaTEfE}!`nUn=_VC?om0YE0BY9!Jvyt9`k$x_O z0{^MHwZhs;X1y+(IG^{yacf;>knC&v;crbAic0asfVH6V_{BwUc z;7pL@=h1&hB5*U{cL|*CAwv=JV$p}@Op~PN-gNTsuN!?G@S8fI^8LD}Bf9ASQ8s6l z|4Z=v|DT-sf6v(bPh#o6QGl%q26HhWyszGgvX=q7<|s38CMYxb>KET)#K(w6a({9) z^3P*^8DuCKwal|+{q((3Hj7B$JrED})f6=$-@|!(HZ*_jbRTZgE+-s-cOp@94{Bw1 zitVO)H0W5MVnmc7vZlyAD=DjI_7+AEN!wek{d48VK9~nUZ^V+dDSMG|1JuQjkh^d< zP21}8QolFjI@4@ccA>sjMQv**Tq>iep#j0-B$4kkYDofoHG~cm{OGhCm0VkGo}KFZ zLBY6Zq+n(fA&#Rp{`Kp6>O)47KF=J0`-X&GxVym@4p4SwIWsPhPY3u`<^T%@g3_r< z^2xkC9}^Q(ic0P|UdofnwOy~un*&xrfWZC?2i-Pj{ZMEmDH&ygNCZVGAcA-95q{M!F4`J%V*^HY) z^w+h9FJWQ0X3a3fx1%X#mS~`@FI18mWepLPG7WBNMEM#%3jFr!ZokzK2hx*t{~Xq~ zJ0YRUs?Q;$khq)bU)`6{9q$)B#Qy4A_ zxcTn}q7gnLv`iDq3=cls`(=#C-PRSVkY08ME@LRS$n#}Zbbu8^IcUII#!u;-bfaVb zk$Zg-9fDdL(I$l97!&a%nd)Rrj%U%8yB%+QYc z_&$iu6gw~`fYkTvXL*wZF{MIUS`p)*9|}Rtw%sOz z#A}eP+Mh1(W&#PPQ%F~Nb3ESdAz6BwCs~N!Q306ea#(>zhH_91np)uXWzQ3uKv)*% zz9oLtzf_jMlia&l&MU1!(|kYkG(aNn_g6x_pd$i1?39%?AdMTQAva{cj;Ztz6f@AY z1mzCI`ZE5EC{?I}=;#Nk%1KbnOL15e_V=-}ESFK%ilAtIUssA~%+0@+qqvjf~ zXj25=)zjUAUs$*m1kodbylH_D$lf8n7J8UJXr6@q<{^MmxvtH9K^VS@ZrI_DPT_v` znSNfOOO%BVclB#6EG+CiWd(tU;xZgfvSGuu0vm3UpaX?u=P=}ZD_8TYSHPuqq-nKx zseN&?#LhA^wa?Ubqm?xTY7mjmD{*w59IS(_C8kAzY|zNjCh4lNk1!BagGCmcWJ!YX zMT(dhi<+9{>UE+i_0!(uM9l*xGQ@0)`AX8CM?dgQAQf{ihFW5!tf+o|zLKq}r8Tev z?(eb<>3^PcJUBg99ZDi!M)}a^etY%0rKRQj^p|-S{`vt=bxqB9bNA;Fp5<1W3!R{U zW4$sm5=S75ie9g~QkdzQBe1|^ckWZW;peIwFmwC1&N5mntnS|4%iKv&7$naS38VMa z|DD_mPW~*f13@01tm75ZU1)H7dJ5@ng_TF+bI__K$_@lDnJxH0KfydH~MyMVosuYW6PBvC>Vhf*_6U&SmM2L2Av^xzTI}MUeR3yW?3SI$k%d zW$j`U6C*>APg7sRiN;pEN1Uy*#Wr3q?%&|$=f8Gr^&=t*PW=Ml`orBs_90<%tR2`H zHoA!vND?`RDF7wq_9C1{6U?VolfIgzYYq%Tk~A6!mWvONPXmtweU>nH2?3<@uv3<> zicI*%%ayOh$vNxt=)?PfLj?o`Hr5bGDqej*jCcb5%W#OL>dewK^1=J&+moL(tRilHnx1ijfihI+W?Rd%Ff+1Wi}x%kv7NN>!%c02 zWjT?pMb%Uaqyt>IJ)+$4kxId069b_vgHW^ae$ke{(S3Ui4 zfUh7EUug0&NBM_&IRsX?n8J+YvoA-L^;G`8{+&8>jS`;d^-mC)^tKgZ<-R~ktZ7># z-1LfH`Xg&ys&@F;7x=D$J=?tLL02F@Xl5p z&m)FQNv>UjC94)SUyJ>e0=CHlw0X#WiW$LIGq-?;)M<{4d=Id&C=#EGi74YnM@4~4 z1Nu)F6%`RMYTezt6(^D4Da6=jhf#c?}O`^-_s`0XD=yL`AwZR5*$ z!DAAIHv>!hpEP*U8aOh+U?uEhS?!o2jeLCovrW5$dLs)F=YBa>m5=?fF4q{Nu6DVA3KYYH<#TPmoZ(>f-ElclIRof1R zi%qdS1w9tiD|dIkzn99GQCBYQUoxdUZ*JljC#+Phwd2^+yz=)-8p|EBG97;~N?m-)&U>CCru`sEKNJV zqyPQr%wwqdnNxgl#d&@JS0utILov)E2s z-h?yyN%GDnf0o zItKj0!}^@8@7mvPZFn8=p@Er;MgdLuFU{~|;F z-=jsBVr7PmV@8tT=o=rPN>Pi&W%>~24`f_WW|lf`SUQUH;YAEIis}Rpj+TZX6dVrN z!LQ&6spAP51vi7mV|ny-0quNUQE+y-rcePG;Ypdj0NRd!X+!|(%XwcW1}Rmt{>)H=Lp*Y^snV_q`cgmnn& zGghVU?0Mc0rP|3>7+ByJelBepNj_9gh~KrY42C9@IlF_v41fj3i<$TuKoZD}l>E1y zqt8S|FetDHFgOM$NQxe+Bys?9V(J9XMGFu(zN?I(Rf|PtF^jdOel0y$!9WS_$10pb zv=hu#IUh?84{{)vvtk_4c>bbTRVxC-EKSqX5bbOJm=g3|5;)tMyNo1f71uo_;X26S zI*cIlF?C+^?1+btM{i?Ye4MD5>=~$6q`!yw@mJo-)jNXDME_Ra6^`gmH-14lS@TuQ zGMgKFf{KhB6k6sepT`0gwzr>Ry;hlF{&q`Px3N*pAoLls>6)%JJ~&R=11lXycxyAi zwfs@dX%9J4cw2JwYUC~2JU@e|$nR9^Hs0PSB1sPK*ZrXk95VW+h$h$W63+gGEbuu1 zes$7jUJYMXj41M%p-@3JO6*8qlgt=uPuX}`i8F@WudnG%aSe8-AnEx$%Lz8zf!Wrs z_~(mPIc$7-c&K$|b`_R)J_}-R8BExmQp?fF7%BEIRZ=0#;^&PPeAT0j6V9y_lRfA* zPnb>O5I^$i`LN)8jG%((^kSIPZkuSw!!AT2*6oX|szR?GwN|NMSBdHeXl_Ev??w09 zlXMZ&6k*IsT&A+RKK3$oV%nd$ZsT9o05PWqY3>9D{Dx!hZKL^kc|oAKa)dB5yIO#j zhNF!FrwD z2~*hKQPX9R9s@eXx|>Cry##Ok!!IR{=XJgc&TxUYXyrHr37GI>HWKM!+`GtOwAs?G zQtlvRC-_(z2@cg1u&o~*!@ShUS9v8${S1j}1AiedhQY@x1nNNM114X`eId#&Lbg(WQ+gEzSzf*m*v_( z2Xkmj0M2QZXwCenBbm}su^i=3`x7h97#v>~gUWRy;F`j+1!UQ4N9M=^(!0h;pqT!Q z=N=?IAIQUa%!Tj;|xx<_Y=qAYv+^3K#@oCdaO@@AIgT)KBi+Evf3Vg3#JUyjY z$P1t{1=qmJ3J)|$PLwn?Ycrym?^|KgCCXfdpLzV9d>rxJ)UncjNlL!JRe+w-W;dst zWj4DUt*eIwr{hooJ2e&f?dD8;zTI`aub$rbQBNQ=eGsi*45(#(7huXU;xSuZ%BFV0 ztO1z1YYQN?I>%ejlH>F&BG?VLa@-24_1b42{?-x|6XU!pK(hK2!82>Zm6Mvq{intB zDiZre>1eYl=g*45LG!VX@^(#`tEFeQIq0irKHZY&UFer6P0N1gL-`u0L3QoKr`pht z05x6_0`Lp#D@ZCNr&1X=+`jneB4FDzd=#6r$TwcWyh#Hd{t7ET{)|3TFyS#H2ezbN z-~p~~0{p+yb+31kYY};-wRtRup=;iRcyfHO8gGT@fb|L*6tu~x2{tuerM5mgXQMqe zHujV@Jj}ueD{EWnv-rS;@+SFan>g1CU&}3q=T21_Zh~PSJzVHf@vpmrfGhx4NIRdR zjf9hjL&;0;_$SgGfu=48%|R?8uKZhovgB&!e1W!I*lF(8e+~R-Iy}fQOkCZTz^TkN z1I4&3LdPEB^tpkO8t7!o41G zMB7kVkGp3!7%R&7?>BOO&}*|Ra|*;db?62j@J|^e(;H2pzO_Hr*Vn84NS*Fv^WE33 zHzR`d+smeEz>9*CazC^NlDI8LtY-DxuhP8$m9z8!bJLxAgJ@q`2>DTLFDy8)pZ)w{ zuOyGS4>?k+JAp$_30d2^>-&}#@s-1(Fy`=VH}=PmscxzEvEh(&-|^4ZG*67@ym|hI zKO9IdYp#R|Ryy^54Jm z`28fO&20N@GiroKq4_DBFl8FyY~)uXK*fiW$oCUwSj%-7DDVtQ#2-{@xC}b@Jfu%B z6Y$U;76*6ehIyP{%@rD^?*1zRCU+<)+c%Tzq3mhB=mpGRnmnvMINT91PDoT-=CTJ$7 ze-tbIn_~U>w6sB-UmJ`PMO0(kF|kuax*A# zWX@d{_WW;0E|`iA419Bhs*f1JdXQe|6!O@S^@-PN7o>|Uk^z=`jtRJgP2YU1v0+}! z;YFC<&88%@OJbm+pfDBXY-+@q`tq`{o*V)u>#1~@`}ONrh0b#=&W%jBO$m7fSWQOn zZjuwStq`@r@LLJ9+ggyD>fdoyn@oVCNn*_NKSHAc=s|)27}ZAybw{z= zZfv){W7iw0Z#@5E&PnDbfrTL(A+a4Ih#|K5)>Sxd`}^>saJG)D{?LoVMu7WUQfPa9Zy?#9&PiwK@S*C#1)$(Q36uHZWRrc}P9$a-Qc=k_ww+n(WmUJI@C zvz-K%14uQ{I|5{)YpY;!hp6S;_Vh=!>6joNdR=d0yrF;TtJCDO^uf11TmW1|;MS1B zp%)For$(jfy;^GH6~*P{4^BhJe=FG}G&O>=5;8e*V>A3}Vuu%ly)6RBEOpYag|l68uIiykyOG6sQdqusP;`GhVQOqNwKKHNo^p9|q~oxLf#4z_(gekel(X zu*WZuXc(OBndh<-(GXie=K+=^Y-d(7A-K!HVl2n<$Fvyl*It!h5(p z87~qN`c|)%&^%d$P4gA(>d+sl_FIqPqokIkipt9J{RDm9Q%-J3-me+h*vO5;5hw-_ zW<%Ct-`T&$^esV?65b7D1o$E4FH=tRPHH#I)KInun_tf;DTdT1*LH|&DVtZOC$@EU zrQbZy+ui$oa{+V{&>9lP@A$_RfLHzydulG)M#N?gFr+=%1zQb?Wn#Z|*FWvv$Qtg4 z33nM88Ix+50*>T6TPv)r?(sNLLJN&KYIB8IX4pNf4vP#L*KTo=@^C_V)7L#|ez^bx ziTrTHyn2qZt)t^R_xezsLVt~X?qX}n_E{j~b$99Z5;^GLpqYW?j9Ffc^C8_1Hp0$v zPvJtY1#z92bv#DRO|_6u#*giKVxjv%X-_-nVsMpR;?6E8l@PwrmIUKT0B0*ylE6V5 zIxAgX(W)MLy{{Tb`?>vZHXdzuw6a-O`G$YGbTy-EepOk=+ZNi10_K=j9`AO)Z&gGTu2_P z=$?*(XG_9s$N0%+LNE)%hVFlHN7^yK=$<|PkDQDDFFd%33QII}VSZZq9Qq891e22Z zpSc=+&CA{O4g6`VFLNvFJKGvV_owkDDbcK$p=`%bmt$b?$f}ha=j+_{%N& z>rv4rXUd4+u5AnZ7<3&H`lI`XgHCnmx-nZe*IsC3%Iy+M-Zm&9v&Xil)g{m zz1IZyg=iz}AQLJ!{Q82AI<%!t+43owVYrdfi}6iUEc&U8k_qs*CQoxga1IOwj_f z?Ex_(+|DzG8}6&wx?<%eEa(-JWwku;9)Z06YwO|2XS&ieANjKr=AE2XfM4K>yA*m& zzJGxiAMlH3KQtSD2X;=_zEpBymDmD)Oe|Q^*74 zH-v$N*)dbjvX#O85}3^xf0xIwlLD-vv#eNeocmEMF5Gwm^%l`!UTBPfm$VAqB}AmgFW*5W&=2PF&eK8bLU206UYFD^-2O< zZ+~VZs0HBx(3o^=`BISR)8oPYOqk?^d_DHs4Rm*m<)CCOmdh|}4>GvxAoLc@XSlBhC|({o&T%US zzK)Ei92Y$8u-OVal`1oswb|zmerod`IT5=Y=FSweuJS=0csyI%6fYEddv0G(F_EKp z2}(;eOu~~vTj_m}M#L5h+#T@faAw`to}A}K(7B|X|K>bzzDh0>h(US-?xq5?drxwCyeamd-ks>@Go~HY3Pepm@x=hi%vk3DXHenl#f`Tcvs7sJ+b!$9|-I^HCh{{+2KUDv&ggkV=q&?Ne zwRkz3G1W{P{v5Jmxo5{R|8dpbLfDl6lP<}h=w~$!bGJe7VBRWK{x#I~Jk%iulN17> zb3!?v6BVbbu$OTvn3NPNCj@qDq0J;H*P-?W?zXH3DjYERloccqxVn~%9lfj}3KC53 z1_%G6PPAau3HMo2Kxe${+Tep2`?~_a0@51P4mm+!U@XUnI`Tn}4mjva)&wQAT>s&MM<~evmUD@SwvT0E}C=RJRv;Si68eLlpqD zy8vA|w1&64FN1l5x4Wy$6xG|+bdYNE0eC>vfXNjhv9jepk)&k|M|M zf%<(3mNzV%9RAl(C3<89<&G11@fI($ojMBNAJ3Rv%gs&GW1hKx65BX)Gm53p?EybF zIFIlF`zIIOp`tnzjs&ye-#NPcYx;J>Xh3}-ngz`4-)J?lrO5t8%(|d#n1z=XR*n(RwD#6weKwYh6-z3zJuG%UmXq znNkHUr6Ia>rxLX`>-gX#J?IKyWjCJ8>U}jP62mxJLIvx@PWRR9j<}p<*}*`K787rh zNv_befVl3=trKd89~VXL3N?L7>q~sX-wr;b;N^B2M>Rbqc~zqPSI*~Xy#$s! zf7k*()Hj-b)wx!&#{bq5rt!1xk78SWC@o{~kB1Ig85^E~4T!lrwLv2GTdliZL221r z&uaJ7**UAa=z05wuRFbz620XYDIfrvjs1X2>F8%_s-VAu9{^l%=BN{XQ9v06xQw!C zz5FbpLk!*-nT(qeffHAnKElM9^^T^TRMMW!<0J_yDA3W;dZst=axO6%T|?}rM^Tb| zvm()n)uvK&g?_`hG)z(KOA?L?arffpfW_kCV#hwQ@@bY*20j>FYmmsSyH_F>qntqV zw8>F8nLEy77@s>SNxI+$#k-&RwDu0>2Kfe0s(OqS1``c0D}cGuYF0pEROXL*`-A!wB;F?b3Ym@e&Mh_7i7sxA+`BP`P<`nS^Z`V7geH5o@_;K)@kH_rs|)x zj>c`u7QFV|=zgfyMsZ~9g?oHI8MvJ{dV+8J-Q(K(lx|JYnkdbDPtiph3g4vg%Asj+ zb{IW(KoCNr84n+|%ji@TK=k?Mq+daS{g=k3CZDa?lJr@(#g<_?(&^Ni=<4^I3!Mby zk>Ygy_o*LdCFk&W^Ip_uivB`)Q5^l+{P4>nPL@MJjzrzc__*d$efx9lmXhwVWVqqt zVOuq8ht*+{6;?27)Av1DGXBCXo6;@0^E)8KYOwkSAvh$0(&!O#ksd`*$gCJ%K%2Zs zJy}QdeTC_s%NZ3br5&k0@b z{N>(@aqR5BS**p<4vXkAzs2)*CJ};X$)uv$;fs-7GR8@Z&xd)dC&;7ytMcM*8C%C0 zYjM||Zvm8!vWYXc)@YiXq=emFF`01P{94_8DpnEI2y{&u1cBpW^Kxar?76|0y_?xk z!xp_Puv2F_o;hk6W&WG?!J5&@JN-+Jzh`IDmA8~)`N8`q zU8(Q8O!g&eqOPH#XCl+u`wKcv;Eu663B-VT!}uEhwqC3CI9h>gVii_x!-<6tY(zbK zi+5iU0uhzu@B2Gf)`>r{>q-brZC9><`#Sm?^Yh~FiJe@mcy9w{h^eUe59PLxzxS4c z!uU8kumhz8_Z9igI~g9{hj+2Cel0ps_`BCn6(*8n1>MHQcI2gCa1n;4=wFeSbKvM5 zTTc8*$*l9g0i87VU4j??b-0T;QCte7__(89w)c-esa(o3V!QQu!J0l^7#eV6oeF>c zcN`QP%WU+_7ybwHc-;ZP>_3mlRD*wKS72c=h_?M}9FK*iyz{vFCl2!aw7D|odC$dV L#R{Ijdiy^B3#+1^ diff --git a/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md b/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md index 74775e203d..1343254a55 100644 --- a/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md @@ -14,81 +14,34 @@ ms.sitesec: library [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -Alerts in Windows Defender ATP indicate possible security breaches on endpoints in your organization. The **Dashboard** provides a quick view of active alerts, their severity levels, and information on the machines with the most active alerts. +Alerts in Windows Defender ATP indicate possible security breaches on endpoints in your organization. -You can investigate alerts by clicking an alert in [any of the alert queues](alerts-queue-windows-advanced-threat-protection.md). +There are three alert severity levels, described in the following table. + +Alert severity | Description +:---|:--- +High (Red) | Threats often associated with APT. These alerts pose a high risk due to the severity of the damage they might inflict on endpoints. +Medium (Orange) | Threats considered to be abnormal or suspicious in nature such as anomalous registry modifications and loading of executable files. +Low (Yellow) | Threats associated with prevalent malware and hack-tools that pose a lower risk to endpoints. Reviewing the various alerts and their severity can help you take the appropriate action to protect your organization's endpoints. -## Investigate a machine -Investigate the details of an alert raised on a specific machine to identify other behaviors or events that might be related to the alert or the potential scope of breach. +Alerts are organized in three queues, by their workflow status: -You can click on affected machines whenever you see them in the portal to open a detailed report about that machine. Affected machines are identified in the following areas: +- **New** +- **In progress** +- **Resolved** -- The [Machines view](machines-view-windows-advanced-threat-protection.md) -- The [Alerts queue](alerts-queue-windows-advanced-threat-protection.md) -- The [Dashboard](dashboard-windows-advanced-threat-protection.md) -- Any individual alert -- Any individual file details view -- Any IP address or domain details view +You can investigate alerts by clicking an alert in [any of the alert queues](alerts-queue-windows-advanced-threat-protection.md). -When you investigate a specific machine, you'll see: +Details about the alert is displayed such as: +- Alert information such as when it was last observed +- Alert description +- Recommended actions +- The scope of the breach +- The alert timeline -- **Machine details**, **Machine IP Addresses**, and **Machine Reporting** -- **Alerts related to this machine** -- **Machine timeline** - -The machine details, IP, and reporting sections display some attributes of the machine such as its name, domain, OS, IP address, and how long it's been reporting telemetry to the Windows Defender ATP service. - -The **Alerts related to this machine** section provides a list of alerts that are associated with the machine. This list is a simplified version of the [Alerts queue](alerts-queue-windows-advanced-threat-protection.md), and shows the date that the alert was detected, a short description of the alert, the alert's severity, the alert's threat category, and the alert's status in the queue. - -The **Machine timeline** section provides a chronological view of the events and associated alerts that have been observed on the machine. - -You'll see an aggregated view of alerts, a short description of the alert, details on the action taken, and which user ran the action. This helps you see significant activities or behaviors that occurred on a machine within your network in relation to a specific time frame. Several icons are used to identify various detections and their current state. For more information, see [Windows Defender ATP icons](portal-overview-windows-defender-advanced-threat-protection.md#windows-defender-atp-icons). - -This feature also enables you to selectively drill down into a behavior or event that occurred within a given time period. You can view the temporal sequence of events that occurred on a machine over a specified time period. - -![The timeline shows an interactive history of the alerts seen on a machine](images/timeline.png) - -Use the search bar to look for specific alerts or files associated with the machine. - -You can also filter by: - -- Signed or unsigned files -- Detections mode: displays Windows ATP Alerts and detections -- Behaviors mode: displays "detections" and selected events of interest -- Verbose mode: displays "behaviors" (including "detections"), and all reported events -- Logged on users, System, Network, or Local service - -Use the time-based slider to filter events from a specific date. By default, the machine timeline is set to display the events of the current day. - -Using the slider updates the listed alerts to the date that you select. Displayed events are filtered from that date and older. - -The slider is helpful when you're investigating a particular alert on a machine. You can navigate from the **Alerts view** and click on the machine associated with the alert to jump to the specific date when the alert was observed, enabling you to investigate the events that took place around the alert. - -From the **Machine view**, you can also navigate to the file, IP, or URL view and the timeline associated with an alert is retained, helping you view the investigation from different angles and retain the context of the event time line. - -From the list of events that are displayed in the timeline, you can examine the behaviors or events in to help identify indicators of interests such as files and IP addresses to help determine the scope of a breach. You can then use the information to respond to events and keep your system secure. - -Windows Defender ATP monitors and captures questionable behavior on Windows 10 machines and displays the process tree flow in the **Machine timeline**. This gives you better context of the behavior which can contribute to understanding the correlation between events, files, and IP addresses in relation to the machine. - -![The process tree shows you a hierarchical history of processes and events on the machine](images/machine-investigation.png) - -**Investigate a machine:** - -1. Select the machine that you want to investigate. You can select or search a machine from any of the following views: - - **Dashboard** - click the machine name from the **Top machines with active alerts** section - - **Alerts queue** - click the machine name beside the machine icon - - **Machines view** - click the heading of the machine name - - **Search box** - select **Machine** from the drop-down menu and enter the machine name -2. Information about the specific machine is displayed. - - -**Use the machine timeline** - -1. Use the sort and filter feature to narrow down the search results. -2. Use the timeline search box to filter specific indicators that appear in the machine timeline. -3. Click the expand icon ![The expand icon looks like a plus symbol](images/expand.png) in the timeline row or click anywhere on the row to see additional information about the alert, behavior, or event. +[A detailed view of an alert when clicked](alert-details.png) ## Investigate a file Investigate the details of a file associated with a specific alert, behavior, or event to help determine if the file exhibits malicious activities, identify the attack motivation, and understand the potential scope of the breach. diff --git a/windows/keep-secure/machines-view-windows-advanced-threat-protection.md b/windows/keep-secure/machines-view-windows-advanced-threat-protection.md index 8064546362..ae40fd30f4 100644 --- a/windows/keep-secure/machines-view-windows-advanced-threat-protection.md +++ b/windows/keep-secure/machines-view-windows-advanced-threat-protection.md @@ -67,6 +67,77 @@ You can also download a full list of all the machines in your organization, in C **Note**: Exporting the list depends on the number of machines in your organization. It can take a significant amount of time to download, depending on how large your organization is. Exporting the list in CSV format displays the data in an unfiltered manner. The CSV file will include all machines in the organization, regardless of any filtering applied in the view itself. +## Investigate a machine +Investigate the details of an alert raised on a specific machine to identify other behaviors or events that might be related to the alert or the potential scope of breach. + +You can click on affected machines whenever you see them in the portal to open a detailed report about that machine. Affected machines are identified in the following areas: + +- The [Machines view](machines-view-windows-advanced-threat-protection.md) +- The [Alerts queue](alerts-queue-windows-advanced-threat-protection.md) +- The [Dashboard](dashboard-windows-advanced-threat-protection.md) +- Any individual alert +- Any individual file details view +- Any IP address or domain details view + +When you investigate a specific machine, you'll see: + +- **Machine details**, **Machine IP Addresses**, and **Machine Reporting** +- **Alerts related to this machine** +- **Machine timeline** + +The machine details, IP, and reporting sections display some attributes of the machine such as its name, domain, OS, IP address, and how long it's been reporting telemetry to the Windows Defender ATP service. + +The **Alerts related to this machine** section provides a list of alerts that are associated with the machine. This list is a simplified version of the [Alerts queue](alerts-queue-windows-advanced-threat-protection.md), and shows the date that the alert was detected, a short description of the alert, the alert's severity, the alert's threat category, and the alert's status in the queue. + +The **Machine timeline** section provides a chronological view of the events and associated alerts that have been observed on the machine. + +You'll see an aggregated view of alerts, a short description of the alert, details on the action taken, and which user ran the action. This helps you see significant activities or behaviors that occurred on a machine within your network in relation to a specific time frame. Several icons are used to identify various detections and their current state. For more information, see [Windows Defender ATP icons](portal-overview-windows-defender-advanced-threat-protection.md#windows-defender-atp-icons). + +This feature also enables you to selectively drill down into a behavior or event that occurred within a given time period. You can view the temporal sequence of events that occurred on a machine over a specified time period. + +![The timeline shows an interactive history of the alerts seen on a machine](images/timeline.png) + +Use the search bar to look for specific alerts or files associated with the machine. + +You can also filter by: + +- Signed or unsigned files +- Detections mode: displays Windows ATP Alerts and detections +- Behaviors mode: displays "detections" and selected events of interest +- Verbose mode: displays "behaviors" (including "detections"), and all reported events +- Logged on users, System, Network, or Local service + +Use the time-based slider to filter events from a specific date. By default, the machine timeline is set to display the events of the current day. + +Using the slider updates the listed alerts to the date that you select. Displayed events are filtered from that date and older. + +The slider is helpful when you're investigating a particular alert on a machine. You can navigate from the **Alerts view** and click on the machine associated with the alert to jump to the specific date when the alert was observed, enabling you to investigate the events that took place around the alert. + +From the **Machine view**, you can also navigate to the file, IP, or URL view and the timeline associated with an alert is retained, helping you view the investigation from different angles and retain the context of the event time line. + +From the list of events that are displayed in the timeline, you can examine the behaviors or events in to help identify indicators of interests such as files and IP addresses to help determine the scope of a breach. You can then use the information to respond to events and keep your system secure. + +Windows Defender ATP monitors and captures questionable behavior on Windows 10 machines and displays the process tree flow in the **Machine timeline**. This gives you better context of the behavior which can contribute to understanding the correlation between events, files, and IP addresses in relation to the machine. + +![The process tree shows you a hierarchical history of processes and events on the machine](images/machine-investigation.png) + +**Investigate a machine:** + +1. Select the machine that you want to investigate. You can select or search a machine from any of the following views: + - **Dashboard** - click the machine name from the **Top machines with active alerts** section + - **Alerts queue** - click the machine name beside the machine icon + - **Machines view** - click the heading of the machine name + - **Search box** - select **Machine** from the drop-down menu and enter the machine name +2. Information about the specific machine is displayed. + + +**Use the machine timeline** + +1. Use the sort and filter feature to narrow down the search results. +2. Use the timeline search box to filter specific indicators that appear in the machine timeline. +3. Click the expand icon ![The expand icon looks like a plus symbol](images/expand.png) in the timeline row or click anywhere on the row to see additional information about the alert, behavior, or event. + + ### Related topics - [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-advanced-threat-protection.md) - [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-advanced-threat-protection.md) diff --git a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md index 880d7158c5..491bdd81b3 100644 --- a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md @@ -26,34 +26,13 @@ A typical security breach investigation requires a member of a security operatio Security operation teams can use Windows Defender ATP Portal to carry out this end-to-end process without having to leave the portal. Teams can monitor the overall status of enterprise endpoints from the **Dashboard**, gain insight on the various alerts, their category, when they were observed, and how long they’ve been in the network at a glance. -## Windows Defender ATP alerts -Alerts in the portal help to notify you of detected threat behaviors or activities on your endpoints. -The **Dashboard** and **Alerts queue** provide important information about your endpoints that can help you address alerts. - -The **Dashboard** groups or categorizes active alerts into **New** or **In progress** queues, and supports filtering by severity levels. It also has clickable tiles that give visual cues on the overall health status of your organization. Each tile opens a detailed view of the corresponding overview. - -Alerts are organized in three queues, by their workflow status: - -- **New** -- **In progress** -- **Resolved** - -There are three alert severity levels, described in the following table. - -Alert severity | Description -:---|:--- -High (Red) | Threats often associated with APT. These alerts pose a high risk due to the severity of the damage they might inflict on endpoints. -Medium (Orange) | Threats considered to be abnormal or suspicious in nature such as anomalous registry modifications and loading of executable files. -Low (Yellow) | Threats associated with prevalent malware and hack-tools that pose a lower risk to endpoints. - - ### In this section Topic | Description :---|:--- [View the Dashboard](dashboard-windows-advanced-threat-protection.md) | The Windows Defender ATP **Dashboard** provides a snapshot of your network. You can view aggregates of alerts, the overall status of the service of the endpoints on your network, investigate machines, files, and URLs, and see snapshots of threats seen on machines. [View and organize the Alerts queue](alerts-queue-windows-advanced-threat-protection.md) | You can sort and filter alerts across your network, and drill down on individual alert queues such as new, in progress, or resolved queues. -[Investigate alerts](investigate-alerts-windows-advanced-threat-protection.md)| Investigate alerts in Windows Defender ATP which might indicate possible security breaches on endpoints in your organization. +[Investigate alerts](investigate-alerts-windows-advanced-threat-protection.md) Investigate alerts in Windows Defender ATP which might indicate possible security breaches on endpoints in your organization. [Investigate machines](machines-view-windows-advanced-threat-protection.md) | The **Machines view** shows a list of the machines in your network, the corresponding number of active alerts for each machine categorized by alert severity levels, as well as the number of threats. [Submit files to the Deep analysis feature](deep-analysis-windows-advanced-threat-protection.md) | You can submit files for deep analysis to see detailed information about the file’s activities, observed behaviors, and associated artifacts (such as dropped files, registry modifications, and communications with IPs). [Manage alerts](manage-alerts-windows-advanced-threat-protection.md) | The **Manage Alert** menu on every alert lets you change an alert's status, resolve it, suppress it, or contribute comments about the alert. From f69ae684a4030eeecb4ce4a046d58ba6028299c6 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 22 Apr 2016 19:37:11 +1000 Subject: [PATCH 073/439] remove investigate topics to individual topics --- ...erts-windows-advanced-threat-protection.md | 85 ------------------- 1 file changed, 85 deletions(-) diff --git a/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md b/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md index 1343254a55..da8ce1d8b7 100644 --- a/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md @@ -43,91 +43,6 @@ Details about the alert is displayed such as: [A detailed view of an alert when clicked](alert-details.png) -## Investigate a file -Investigate the details of a file associated with a specific alert, behavior, or event to help determine if the file exhibits malicious activities, identify the attack motivation, and understand the potential scope of the breach. - -You can get information from the following sections in the file view: - -- File details -- Deep analysis -- File in organization -- Observed in organization - -The file details section shows attributes of the file such as its MD5 hash or number and its prevalence worldwide. - -The **Deep analysis** section provides the option of submitting a file for deep analysis to gain detailed visibility on observed suspicious behaviors, and associated artifacts. For more information on submitting files for deep analysis, see the **Deep analysis** topic. - -The **File in organization** section provides details on the prevalence of the file and the name observed in the organization. - -The **Observed in organization** section provides a chronological view on the events and associated alerts that were observed on the file. - -You'll see a list of machines associated with the file and a description of the action taken by the file. - -**Investigate a file** - -1. Select the file you want to investigate. You can select a file from any of the following views or use the Search box: - - Alerts - click the file links from the **Description** or **Details** in the Alert timeline - - Machines view - click the file links in the **Description** or **Details** columns in the **Observed on machine** section - - Search box - select **File** from the drop-down menu and enter the file name -2. View the file details. -3. Use the search filters to define the search criteria. You can also use the timeline search box to further filter displayed search results. - -## Investigate an IP address - -Examine possible communication between your machines and external internet protocol (IP) addresses. - -Identifying all machines in the organization that communicated with a suspected or known malicious IP address, such as Command and Control (C2) servers, helps determine the potential scope of breach, associated files, and infected machines. - -You can information from the following sections in the IP address view: - -- IP address details -- IP in organization -- Communication with IP from organization - -The IP address details section shows attributes of the IP address such as its ASN and its reverse IPs. - -The **IP in organization** section provides details on the prevalence of the IP address in the organization. - -The **Communication with IP in organization** section provides a chronological view on the events and associated alerts that were observed on the IP address. - -**Investigate an external IP:** - -1. Select **IP** from the **Search bar** drop-down menu. -2. Enter the IP address in the **Search** field. -3. Click the search icon or press **Enter**. - -Details about the IP address are displayed, including: registration details (if available), reverse IPs (for example, domains), prevalence of machines in the organization that communicated with this IP Address (during selectable time period), and the machines in the organization that were observed communicating with this IP address. - -> **Note**  Search results will only be returned for IP addresses observed in communication with machines in the organization. - -Use the search filters to define the search criteria. You can also use the timeline search box to filter the displayed results of all machines in the organization observed communicating with the IP address, the file associated with the communication and the last date observed. - -Clicking any of the machine names will take you to that machine's view, where you can continue investigate reported alerts, behaviors, and events. - -## Investigate a domain - -Investigate a domain to see if machines and servers in your enterprise network have been communicating with a known malicious domain. - -You can see information from the following sections in the URL view: - -- URL details -- URL in organization -- Prevalence in organization -- Communication with URL from organization - -The URL address details section shows attributes of the URL such as its contacts and nameservers. - -The **URL in organization** section provides details on the prevalence of the URL in the organization. - -The **Communication with URL in organization** section provides a chronological view on the events and associated alerts that were observed on the URL. - -**Investigate a domain:** - -1. Select **URL** from the **Search bar** drop-down menu. -2. Enter the URL in the **Search** field. -3. Click the search icon or press **Enter**. Details about the URL are displayed. Note: search results will only be returned for URLs observed in communications from machines in the organization. -4. Use the search filters to define the search criteria. You can also use the timeline search box to filter the displayed results of all machines in the organization observed communicating with the URL, the file associated with the communication and the last date observed. -5. Clicking any of the machine names will take you to that machine's view, where you can continue investigate reported alerts, behaviors, and events. ### Related topics - [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-advanced-threat-protection.md) From ef2dc1efb6a8b5bf78d2b64da21385ec5c056fbc Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 22 Apr 2016 19:44:39 +1000 Subject: [PATCH 074/439] include new windef-atp investigation topics --- windows/keep-secure/TOC.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 3e56e7babc..3117358a7f 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -416,6 +416,9 @@ ##### [View and organize the Alerts queue](alerts-queue-windows-advanced-threat-protection.md) ##### [Investigate alerts](investigate-alerts-windows-advanced-threat-protection.md) ##### [Investigate machines](machines-view-windows-advanced-threat-protection.md) +##### [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md) +##### [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) +##### [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) ##### [Submit files to the Deep analysis feature](deep-analysis-windows-advanced-threat-protection.md) ##### [Manage alerts](manage-alerts-windows-advanced-threat-protection.md) #### [Windows Defender ATP settings](settings-windows-defender-advanced-threat-protection.md) From 1c95bd969665aeafd8b690a0dcdf061c75b7207f Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 22 Apr 2016 19:48:36 +1000 Subject: [PATCH 075/439] change position of topic --- windows/keep-secure/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 3117358a7f..54b6b84025 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -417,9 +417,9 @@ ##### [Investigate alerts](investigate-alerts-windows-advanced-threat-protection.md) ##### [Investigate machines](machines-view-windows-advanced-threat-protection.md) ##### [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md) +###### [Submit files to the Deep analysis feature](deep-analysis-windows-advanced-threat-protection.md) ##### [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) ##### [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) -##### [Submit files to the Deep analysis feature](deep-analysis-windows-advanced-threat-protection.md) ##### [Manage alerts](manage-alerts-windows-advanced-threat-protection.md) #### [Windows Defender ATP settings](settings-windows-defender-advanced-threat-protection.md) #### [Troubleshoot Windows Defender ATP](troubleshoot-windows-defender-advanced-threat-protection.md) From 3967b2746f0451e50b2cf087cda6b3016afb3440 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 26 Apr 2016 16:51:58 +1000 Subject: [PATCH 076/439] fix image link, fix tables --- ...vestigate-alerts-windows-advanced-threat-protection.md | 2 +- .../use-windows-defender-advanced-threat-protection.md | 2 +- .../windows-defender-advanced-threat-protection.md | 8 ++++---- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md b/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md index da8ce1d8b7..758691589a 100644 --- a/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md @@ -41,7 +41,7 @@ Details about the alert is displayed such as: - The scope of the breach - The alert timeline -[A detailed view of an alert when clicked](alert-details.png) +[A detailed view of an alert when clicked](images/alert-details.png) ### Related topics diff --git a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md index 491bdd81b3..dbda5f0611 100644 --- a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md @@ -32,7 +32,7 @@ Topic | Description :---|:--- [View the Dashboard](dashboard-windows-advanced-threat-protection.md) | The Windows Defender ATP **Dashboard** provides a snapshot of your network. You can view aggregates of alerts, the overall status of the service of the endpoints on your network, investigate machines, files, and URLs, and see snapshots of threats seen on machines. [View and organize the Alerts queue](alerts-queue-windows-advanced-threat-protection.md) | You can sort and filter alerts across your network, and drill down on individual alert queues such as new, in progress, or resolved queues. -[Investigate alerts](investigate-alerts-windows-advanced-threat-protection.md) Investigate alerts in Windows Defender ATP which might indicate possible security breaches on endpoints in your organization. +[Investigate alerts](investigate-alerts-windows-advanced-threat-protection.md)| Investigate alerts in Windows Defender ATP which might indicate possible security breaches on endpoints in your organization. [Investigate machines](machines-view-windows-advanced-threat-protection.md) | The **Machines view** shows a list of the machines in your network, the corresponding number of active alerts for each machine categorized by alert severity levels, as well as the number of threats. [Submit files to the Deep analysis feature](deep-analysis-windows-advanced-threat-protection.md) | You can submit files for deep analysis to see detailed information about the file’s activities, observed behaviors, and associated artifacts (such as dropped files, registry modifications, and communications with IPs). [Manage alerts](manage-alerts-windows-advanced-threat-protection.md) | The **Manage Alert** menu on every alert lets you change an alert's status, resolve it, suppress it, or contribute comments about the alert. diff --git a/windows/keep-secure/windows-defender-advanced-threat-protection.md b/windows/keep-secure/windows-defender-advanced-threat-protection.md index df2d8af280..84b0c12d9b 100644 --- a/windows/keep-secure/windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/windows-defender-advanced-threat-protection.md @@ -78,8 +78,8 @@ Topic | Description :---|:--- [Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md) | This overview topic for IT professionals provides information on the minimum requirements to use Windows Defender Advanced Threat Protection such as network and data storage configuration, and endpoint hardware ans software requirements, and deployment channels. [Onboard endpoints and set up access](onboard-configure-windows-advanced-threat-protection.md) | You'll need to onboard and configure the Windows Defender ATP service and the endpoints in your network before you can use the service. Learn about how you can assign users to the Windows Defender ATP service in Azure Active Directory (AAD) and using a configuration package to configure endpoints. -[Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) Learn about how Windows Defender ATP collects and handles information and where data is stored.| -[Portal overview](portal-overview-windows-defender-advanced-threat-protection.md) | Understand the main features of the service and how it leverages Microsoft technology to protect enterprise endpoints from sophisticated cyber attacks.| -[Use the Windows Defender Advanced Threat Protection portal](use-windows-defender-advanced-threat-protection.md) | Learn about the capabilities of Windows Defender ATP to help you investigate alerts that might be indicators of possible breaches in your enterprise.| -[Windows Defender Advanced Threat Protection settings](settings-windows-defender-advanced-threat-protection.md) | Learn about setting the time zone and configuring the suppression rules to configure the service to your requirements. | +[Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md)| Learn about how Windows Defender ATP collects and handles information and where data is stored.| +[Portal overview](portal-overview-windows-defender-advanced-threat-protection.md) | Understand the main features of the service and how it leverages Microsoft technology to protect enterprise endpoints from sophisticated cyber attacks. +[Use the Windows Defender Advanced Threat Protection portal](use-windows-defender-advanced-threat-protection.md) | Learn about the capabilities of Windows Defender ATP to help you investigate alerts that might be indicators of possible breaches in your enterprise. +[Windows Defender Advanced Threat Protection settings](settings-windows-defender-advanced-threat-protection.md) | Learn about setting the time zone and configuring the suppression rules to configure the service to your requirements. [Troubleshoot Windows Defender Advanced Threat Protection](troubleshoot-windows-defender-advanced-threat-protection.md) | This topic contains information to help IT Pros find workarounds for the known issues and troubleshoot issues in Windows Defender ATP. From 7615767fe3f75fb20954f8011e85332b958c15d4 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Wed, 27 Apr 2016 10:32:07 +1000 Subject: [PATCH 077/439] Update investigate-alerts-windows-advanced-threat-protection.md --- .../investigate-alerts-windows-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md b/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md index 758691589a..0a116aa6bc 100644 --- a/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-alerts-windows-advanced-threat-protection.md @@ -41,7 +41,7 @@ Details about the alert is displayed such as: - The scope of the breach - The alert timeline -[A detailed view of an alert when clicked](images/alert-details.png) +![A detailed view of an alert when clicked](images/alert-details.png) ### Related topics From a7733fad6f4cea1fcd03ce3775ed439fe15efa73 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 27 Apr 2016 10:30:28 +1000 Subject: [PATCH 078/439] remove extra table cell --- .../keep-secure/windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/windows-defender-advanced-threat-protection.md b/windows/keep-secure/windows-defender-advanced-threat-protection.md index 84b0c12d9b..759899e1be 100644 --- a/windows/keep-secure/windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/windows-defender-advanced-threat-protection.md @@ -78,7 +78,7 @@ Topic | Description :---|:--- [Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md) | This overview topic for IT professionals provides information on the minimum requirements to use Windows Defender Advanced Threat Protection such as network and data storage configuration, and endpoint hardware ans software requirements, and deployment channels. [Onboard endpoints and set up access](onboard-configure-windows-advanced-threat-protection.md) | You'll need to onboard and configure the Windows Defender ATP service and the endpoints in your network before you can use the service. Learn about how you can assign users to the Windows Defender ATP service in Azure Active Directory (AAD) and using a configuration package to configure endpoints. -[Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md)| Learn about how Windows Defender ATP collects and handles information and where data is stored.| +[Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md)| Learn about how Windows Defender ATP collects and handles information and where data is stored. [Portal overview](portal-overview-windows-defender-advanced-threat-protection.md) | Understand the main features of the service and how it leverages Microsoft technology to protect enterprise endpoints from sophisticated cyber attacks. [Use the Windows Defender Advanced Threat Protection portal](use-windows-defender-advanced-threat-protection.md) | Learn about the capabilities of Windows Defender ATP to help you investigate alerts that might be indicators of possible breaches in your enterprise. [Windows Defender Advanced Threat Protection settings](settings-windows-defender-advanced-threat-protection.md) | Learn about setting the time zone and configuring the suppression rules to configure the service to your requirements. From 89b8b05114baf936cc2c29acddcfcd7f350203a9 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 27 Apr 2016 10:38:06 +1000 Subject: [PATCH 079/439] change machine names to fake names --- windows/keep-secure/images/alert-details.png | Bin 73309 -> 74033 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/keep-secure/images/alert-details.png b/windows/keep-secure/images/alert-details.png index 4db0f4692d9dc757280714e74b7fd718e3c6966f..49c12023c3f7b3f06de4cec90b6b724e1aff3719 100644 GIT binary patch literal 74033 zcmb@u2UJtrw>KJlqX?)VRY3ufF1@Ots5DU&qzXvyCG?^PX(FHp0Vx3iX(~c2ANlLHE$gGb&w5lQP7RY z&->4&8~PsCkRCS9Ziu{s_FJ%t#sfB~TDn`f*}8bxIy)hlj-BU$?Z>IxRh(UX+-$9F zJP@Dg+vQ*@-Jh*)mS)sl&w1E7S|TLL^vB?xW7K!lLunG zJ-!aM9j5N4YwO`)iO602$%jCkL)=!qrt6)uFdF2-gEiyZDC|GZW9>Mwsv+TeSlmb| zuGr>U*)`q%^EDeZDoAMX6hLFB+ux7CMIN#V$n z6dngr$5Aps`}55;;g9={^&`DKR>S(rG_HH|NQu#Vk7)#mlsi< z+<$&DIKSPL|7Ta781qcjKfC6t6?gA4g`gIHn+j#53)8+ZqQM)i!RyX#W~%+x z`p+?){H6Vj#bR6DJ^X0q=-7coUr&D;7Z+ECM}>MTMBmIb)1M)2E{&0EnPU`IzL!Rv z`uCdDIMzy}S)=d;VOLnAGK_@Vf_i#-Hd^&+-9|aoa#Fn~kG;QlX_yEfB%|CMeB0EN zRv1nl4`CXQ8J0cw=dxEaGH-4Vez7htEkz2@rpErQ!MmJJA8^#r&=4ypz&9VlY*OFQ z@QmQqrMySE)SO+uu(+7o8aUFq@1Id&=8zn6uEd@3U(MwDHaW@d>FKE@pv5Pgs4>|Z zcNr_k`tLv$DAe@`Ux>Z^yDEBomoR>_Sbw!(WxmC*o&y1x_Qvh&|(eL^J|njK!%08#<#;cPWzDg^enn&du4Xax-+fF3-PK z<808Y+j=08tXV@@X{#WV4KKB52Qo4X8;Ld!Mh{ro+TJc8N^*=$?#^ikv34ntUXC+as-+8$_rGS)3YTU9Vs zIh%^HR^EQ}>C-2~Q?uO=PqVjVGGEXN--?k`vL+2ZJx@ZLZ0doviW{6nJpPMf%wNW- z$3m_j4Y}^v^Xkt`DsUHyv9h){oSK?iAt{nadVDt~!i4ZbA|h=4_N4~-Icb4IpLb_w ztnjIRi?$tIU2OdvTwKnITfZ~&2L~Tv*7F~JT+0#($deQoHy^YL46KEJ{M`DPQ2XSV zI<1;wd|qB&*>Wlh<*2w+e;~i3LlaZGSUJn7{?=;pEmy#*PMf&M+^;8YZlBkdF!XH_ zws21PNdEzPg&*tQ&(qV-593hmL=3(12rCzt^rz~|N?VyDGdmiZnvZ^tM#x~>+S=R( zd$g5DlTuO~M%}v<<4JbqyDKZ7Eo$##L{BhLXI*#H#P=xA?)qZ;_P1<|_wU~?i<<4|=;#;O`6+TXJ}M?gUTUG8 zR-i94M#*llu(G?hvhos}yj>>t(%200IrSuNBUbbZOHZ@TkKUG(DUR%c>vA02<&W|# zY`)C;iIBTJ_r77wt}+e(`Za^PoLs)Lvhp}ww}ha(U5Ov<)Lc%QQ`F0sES&lSu5w36 zBvSNjlfR}c?(8zhzmY+@jAu`48%-XIEG`!F-|9*8GfrS-mKGF=yK^)Q1FyGOF7CAVz#fF{r!CUy*80Dq2!c5Kb>F?DE`kkh*Mo(WU1$OWO9xtV=V8mv2wiQxmXS8GLzNg*Y-8_V}eg@zM3f)jq&s~0u+h{MY4dI&mNqKSM&gB$FrPBM zDjFhQV&YjrK|z@&^?|{`hP2(eG;?QX`cebU+8mntvS;OAz63XO1+k}XH1g4yab4s{ zfmqU(ATkxEOgZoA<%Qdx4Y}S>oQ{u6mFlRjT;(TTE5X~gQPBH;>Oq>p?o~L&>wdhLC0nCXB=FzjC`~E#LW@vDavbzF;WCHSC)77?B2rpH6f+s;}>X|0GkIjOWNuo~}T&txKCw`LA!x zrV4SQHE!~zp7i;Dp3LvKxq+zl6U@TrVq1PG@6GPLw2`o@?#wSAvwNF9tp1jdFiH%R z?#E&|>aa)-JRZM+QKqP<`MDd>o>BUab4v}fBaT$M4~&m{QFgNuOvL?b zch-lEvE+8`Hd4V*Y( zDk@m#GO^!Zi3_5>$EPJ?-CiJNDNNbJLC`Mga9Y=_k6RJsf*KNvxFEv`nH|!WnBef> z;5Fd{jGFS6PP5Mb(K|=vV-(j}{FTzo5{EAzw(d$@V=o(B9;2>V%5t+}*y|1}F)67~ znDN@QWYe8K({I$3h4F+Kp{=;~#_W*<>kYICx%cGZg|IX)#+#6p66z?pvgSz-y2Toj zmUb-NO>Tw_e9z%2+E#B4H5inj z4lY*Aoje|LH&2&_woQ%G=b#9B_3y0iKnOGnV|KoVoOt{8ZT-kd%7i}BxLJi>@%gY*b;svG?$^|f z=Xd4h<$p-fMyP%*+U?q1=$c%?wS`U*FT8vr9wEP2ap208EAbn7v;A}I({8c~r1mS{ zpNPk=s$XCX-Pvn$rW}SDE#!J9>)vl7(Mwb9pMlvO?X@d4FnQSiL_D|8&T;%38iFQu zNBmq>^tW#}78VxjXGs%KvK&3Q|7~ij)M|9|lq)tsVY!is`oxwOzI1(^C8ZBKOv2@F zY&0u7&Ea4d8wu7>ONiVMAE|+z79V-|Llu!P)q8)?s#?&6F#aR^_xV$%xSB0u6b~a- z_I;)Pt{W$^SW9XY&i$JHnWfHuCh|8PkBPgiH|;mD?9Cn<8ykA$NK&>L5_uYq>@^-B z4JDC6fst@nZLLzxa+LF%E7g9oCJ*3oX5G7HYRU!K!l{}dMcFFctMd0!WT(qC5;iQ` zY?7{>u$|eZE?qbjwYq8(sT0I7D@RyGYp36>XRcj3^q-RE2NoM9Pps*2EAWCf_Ctjp z?lc1ugQ(h5tZ4i4fv0e44Gj$z-X|V%N8tH*FBCTm&PgjNIr(g4&iF9oL_{2`SuZUt zoqqJsfERl^mHbK8kgn(E=a;k=lq|R(OUmhlD(M&HhljaY+lFVKj&D>O-6rO zT_X@vJrw?gp73y!{C;`#q6>2>J8;6-Qub7lYU z_51(+#Qgt*`}tkvacFO%XS}g|Z@r|Pu)bUHOW9z!4J^d~M;lKVR?OT}A>iIVE{K^w?pAW7)^GI0BS@&)S zYF%LbZuJE#d|mC;oh(r~xq0sZ`=rCh*y6G>&-Y8P`p3pN-6~TEWc1&mfJ?qN52$Bn zXAc#S61)6o8mC+>eq(~rdtb%M_N*!ElU_>;C-jz*Y73-X@9(d@X|X4;s)w>7FawY>SjVRtBu!GGi0!LhxM8XIulXY*IU5%tE<07ev`q^ExQ|UfiP~Ak2{tN>~ zLqqdjeC1{qzKWvE7~vtg;FOb|ZHriXAuKN?CG|vZV6*;+lFQeq^~)O_BRw0{%!R)i z_Dq_lMe5GB1iAMYQJBXAFYjXMYmOm`ws2g(mfMu;@uu578!_~?hw9S&nyd^hHmDP( zA#qoUvQ}=|Nd4%xpU7m({4>TyGmB09THO)EeVG|=3OnL4o~>)LVXxNOV9&*rzGjcG z5hBgGyVEJ}ufP4-N3q&v{NS$#8`G=9E&~>O(tK~m2s^*kl)qwY*Ci>x)kX<;;?UAY zHK)(X!a5QiB}lK}@vrfKA1g!xeE`if)9p0J@|~a{3b|sWv2%AeV0KQp=r>^b$3)ryPH8#kD*Ug(T@#35AOQX$od-EADeTLm{Kjdm~{U zlon4~*8xO-fB&@Si4!MaUc@(zCtk6hmV-4gcA=oKkS#tkpwV0mK$rd`XH2u@2!VA$ z%WS?X+902IN?-7dCHq0mo}!|nb1|mqf*amzzN2pWr;Z7miQ=chJZ2<5T!eqt7&i7n^OJI%SPVUIK%l~WgTjYv-j!C{j{`!mBIi=g4 zYwCiY-t-x^NtEgyQ4?DUO-z0LQw!p96fa}MVLx;nd^1=3X$}qUd;V7V~313g963bcaHDQ8!9*Li7_`>bJ9%i-_0VF zS&5i#TGy;;?&xoK$S*a{d||1==l}V4dDqU4cIZ1Usd((nSN-Jb6MZ>k+>h10vK7Ix z=^(}anXfAi4Q+b6XO#z>ISSJJPwW!wD2Bu73r_e!E>q`|JB5`_+iPkw%Z0)_sTM3mW$(iQg+UyMUqK_=`zVihy2N0YiL@l;Cj8j0 zl;F6>8RF)M#Zmvq`w=d<5awmR9p}>L?la6P-nLj@tG=;~Ab(HhkIuef=M|8ZTdYs@ zJ^yZun!CM56Ja7_jCEa}yfIe8fXaZ!=9~e6%R&Ex^uq%O4#X3LO>18Q2Y?8}H<&y3JJKVDNk8x~o#X0cvp1esg)^wLy53^j7 z+OzDV^d5h&OG8y}N1L>fGZV9%+NEf<=`^`*8k}0g)h3OKi}FKMY?c;M(}3A#_Lrkd zlyeXvSmK@KB5}!`lOglvF5}WtmMmV1E9aC3d^zFwJA%tb8xgJTw5{F2#j~*#JU}U> zZ?nvB-6dJny?ho#zJ{stbY0A@tdxZjkqhLC{Psk~4#YU$F z7FiiJ%70i=!F^;QxUAijU3YhPH`TY^rh2QqkqkN=R!qUc!GQkZULmcDu|t5Y zveZ3|dTF?260&*ZtMc3qoyCUZ)87nrQ?t%Zz5acH8D-QuX9tyYvQED#Xp=%l6BZ1W zug{1CKJVIjpR+UTuiS?|;QBboU%D*Sw&XxPGtoaL-P&*?ak$fBI-;xXCb^?9fc7cI zY;6)nPOIKVd#7&+Rd(RWV_|w}bz9$W(8QS5&I!VN8uQ%aa!`z+FH3F4k2xujGEH~6 z19SIIBYp{S-T7thB=4-RH`;X@E*_$MnWE~lx6zsRa~=i{8SNTugY8Ps z3wzx)>o`u|VfDpr_%1(W4w|+`zrQmQ)C7q{VmZfT0o|zaqes^+FkX{G-4ta}tu(qR zm3#wm9QW&2((iyhiEq8%BO%*Z22aKJS1++$*rX=hLoN!^TSLRO&1wC{2k68@kHgtq z^!I(Vz2sEY+iDAer_zY7;ql2i4_0+`b^cSw2gb&vbU&HP1VN-SJ1X}2Bwd)8v@~|P zI_l%cj|Icw={;JQAv6`1oToGgawqvI^AXVguV z{@HGu)mw$pqeoL%{eUKpH~ZdgqZ_XVe+hH3u!z1?y2lmmW2_zUG^3L%!%10A?gbjH z2wct8bC3BWQNBZcVY&5Ym7bd`mYe9U5BH^#QP`G&Oi@R*zP3`nt4r%3iaz7lZ$ROxq4rvad0VYIT$wm6X}$z_ZFbp;$KF z7Qf|W?X<0FBs`{K{q}pmq*!S&KX`PC0h&K@adLD#D*(vX-n;6P*1fE;qaS-CKKK5m z7~ArFzYipxsGAs<`{vTB>KykjhR&2_(#@V~&c#;|evBLBhZ^KtZSQ8^QZAijYAY)* z7gC&u0_8Kh;usSpP+3CrimsifK-`Oql+jV+UOP#QYwl@fv|B{_3oWL@Yh*GTuYepZ z`qf){0;iip9iRrwe|W_|XmLaq2>jMAKR>?$G-0+YP5RAcSiPZy;gCm#Sj!PInG9v` zwC}U4^)6ow3bD9b`!#!}{Z>3~(d3<;d&Gb07ip7*{%U86>;YH+bAqg=Jlqy|ZA$!N z&?bd#>1~s73=Kqb+m^zq<37IV$(uZ5%Zuxc4k$(@qZjsVZ7By$@(T(K7Db}PC!1Pq z->S>W?hJrUHjGL_?B_)UA$b3_nviNpOG_xZq*7TYOwkqKpK~SBA&A1KlL{e=9F+)rF{}_m~THG zxp~#m((=Z-{-?r1!&X^iY_%`RU$OfS16UBNE+j0>ozQ0H?A-N3Me52GO!~6ow1M<3 zzef$xH1{vZbx3YC*+cV2k1A=*uG6S$LTs4Tlm8|V|dr> z`w_p3-4-$Wa+5+8bsU_Xz1C*Op59-y-3u9Ckvc#&9aD~c&8H-yTv$8DvGEx1BkQqS zS-0^beU?qepKllGTy0DjAgz7U3(KR&7qh*^L)vKAN}FmIF(J5mFN)N1mj}Q~KOjRH ztb}QxCCnT<+^1Y;$6_wx`&-*UJh2himZ0;oZ@N)8BLVAZPVa8^$u`LXQ`&6<+%1dm z+vJXHv#)%v7G|6V_IkgQ2?RpReyx0&_Na%YVa{G&dh4I_;->5C5f7n^jeGGnMD|SN zBd0~4*GC~s@bfMFl+X;7mXSGXj1{uYYtnQ)mA8Gm*=aZ8OsOb6q%C(QfS`|EU3HxF z1mbAWW*!!X1_sv!&!`mZORTmIM*Y6aHZ0o)pj29M(yIL zsHhfPgldK(5BKX^-`6@Y=bmBk--O$5UHI!x7I#8UkFELuHRYeu5oLLkY2H4^NORbj zPjCLg`1TmtVUOtXH?L-oU~`%VZ*fHhf6r|NN+QsE?d>m(oXBnaJsc12-?y1sWQbXe zbAWud>^6z?@AN%aee`3q)BIk#Lx{)ZT1H3rCDpB!Ch_nBRu06{`eR~q)J{pDY zTEy;hrkG|SMe_-lfhE6YPwDX)Lhqw%eWA}b$pL+5^+W(|WMy5%{O}OV`~Z_YT(l3l zZ)zdij&ei)$dM!Bspdy(z3GFjtZqu_HhP)Mpa*WE#3WgxTGN9ojkKD+QP}$I4Bk$? z+YKyD((-g=QVp@@{90FBe4czUPD&}7ipGDu0RK1D{D057Es@ zD<=u$OQOaMSP-gQGosdk;CGREsVmUuiL!Tv*a9o;X8PUVHr1fJ!yEd7p4Y|j1%N8N z6#_M<&ULzr^dLDVTv)0K=iB>)Ksph~6DB5Tu&@bHBZe^&YB?H#Hv@Zu^KDZxs+v9sF~ep7FOKrsFiMgvb1 zdtEpo7F~-{_|41BZKw8f36wOzYfGE{WvC}JYfmvp+F##N4TNxdlIC!6Ny&4-SHBg6 z6WUe){(&Q7A0qr_CP)eThK9k}wosMd{3BjrhK5+h6KU>bF+Rn3=KrR7fVuUDj4f-c zn$Tq>z;%Mo7LSXJj68ZcSVl&s$Un!H6?7VkAfst`^ArmU%PT%1pp_CefKxh`*44H) z!l;f#wzs#lXnE#81PbZuFcTA97>oce_~@EELR@J+kTK#Q9HKpZlEtnxX~fgaY~Px% zF=w!G_5;7yqmz8KOxi#DR-6Jc?>`7~XaV~=(R&o^@hcmecyb`^o3>b0(?HZe6K?)rqE-&1mivvPa_B=c3} zfGm60ZSxC7^yjMu+0Y<5LK>^utC^8c;P;fr9p^UnoahK?#VwK?j4ewhs?K z0vA;FDXrxR@B_G_8h~hk(S4+Abp_0PeGTYbnd1^zewG&%JvA>L=-z&uasAA;qXg?p z8H##Q&?|oRyVT(dWD5?g{5ZW5F{3^TOOJ1-WFX9wqU1Rc^D~ z`Ve5J4Eh;}w_lLw7$csW-Lm2%`hvoL9;J2Q>C|N!V69+XD5YsHsymJd3k$dI90|T= zRO8+4X4>!YCJe5jIMcZmOUl{TK_v;fwMn<%&~`W39-;r(M8aM+W}N$ zUq36WCPry@bY8Zz;F&AzWT172IGGvHE2^0~kD95qjM(CMsW;*;0QdAY@Irc`}(?6XjmBVWVE=7(a%n@rGrzM-TY8(Or`?0@0R!H^PghIGMs2D&vT0>Cnmm@zC?v|;)1a)`mK2I zpHMwi>&VPp!x#hS!@<`8npSG-FekOa<6_+VII*!4=yN3(FZZGE!^8m4t67=X@;~0# zM3G|MhSUONL4Z0p?SNe5Iad*aY)Xgqx9pF6#<-u@6Q`2(CqDW!~ z`uY4T*#=5U8OVQk%W0SN7a@fo9$(dpqV8q-MZ@&T^I|2Kq#r+}Q)-vYK> zwjI8Gx5t#?h@Cpm`V-Y&#s&=H7J#wlRR^i$@3W-PRbA)5o?=RPxaBUHQw!gcn#r=d zI_KX$FuOy$^?@#?(nS-TrDF>2GcU8E%RVObR;f#z>8n!9_fqAsOuaPT?q4@S+I)g8 zsjG{5_G}-9JX2L*?CWz36R~lFO-DQ2yApLkWMT3k`})&F`4c1a9bks>R|@I~`W71Q zL^El|=OS~jHE&r_RP^zj=o#d#pde*{fH<#tUn_XNWraQ`fOG(r{6~v@`9g&j4(0jF zu8=%G|KZaG?Tmz_n?W(s!0t^D>-)Su6-tVw7-|L;VulK5)7>%>R7ON)amvf{pX>e+dI$+ZpG&U+M9Rv z+__;EC!CjXf{H-gXJfry`$>5*1{4ZZepq!X)x1C{d3j-%miiQeUg$%3?YB8X7p4Ks zD{vLfIdvJY%~R7K(%g5qZ-nWnD-d_zu_R62t8=MQ4PwWluXgSq`ZTnCu;qvMuOe*2 zh{XwZrBb=hPa81wkb28_xOJ-v*gDP7CJAW#&dyGm_WNEW@Ddi4xpJDpu}~<0m;@2l zJb4dj5=)!+Jw<*9x8E1Rpw)Y#si}!Zn%mQ|xRtQo^GSO6*unjf{Nt90^=6= z=lYzKQo(-GwuCG-u`TcNOete#TKBxu-a6tG$j2F}7phI;vG`;w=`4LcaC+`8?W~BL%fb`fVhPv_o0$WEmJ4NoWW^=3|V|=QV42 zBA&|YE-T<_-g|rHc*tK<7yL%gMQbmpA$KW0*rs( zOU$%nt{^$&5P5^ywXHj}=G?xqiM)6-g-D7ac^c zo<0u>0)s3V)_B=@{^K>fM1I~Q;@a;8zV6p5AM@ZIJ0PtsGoMv+TGb$T?U~%dJ>%v} z)Htmca1_!Y&05{CEMll`*SZ{?ZR<#!Xm7V|N$a?nVRB#ajH78c;bP8E4;{NwzO!_# zaza}Rx$KY#Ca*E-s#2OXMYa7l`Jt18152nrg6~SnBMlb5=q@7JFw`CVpupd=2Cj5~ z3ZqGPpDB9VpyB7wzbA~ZlDg`0o8K+!1>8Fmp$Zxu)f~2YVN7A+B9un=^5Cv3jzO$* z<&a{EP@QH!I z?T+z?q|y8?$mf{qduj8#3&RcWUnC^}b#okM=d1_kp4sUa1%`w&v-6z%S#o^#%L8#gG|2 ztM@9uT|N_e4ZFq@;`4^^T!Ysl*$WJ^$3wop#z*>GdlJGdW&Q6`-OZ8@)Amm1q zz4#u*Ad~o72J<9_>`Phwl}xd$2bx6&ZGaSE8f`8u z0aRinJX_USYV$5{S#Ew;TVO0l$82*a5GZkYLG8OVLpoXaMpdwfuJ0Jpc+T1|kV<`bI_y4;7+g%L~fc+~ohM&R*Y|R{iRnPz#D5h$wI^ zSBv#)7P-ErtYeh;fL1H@hbWbY|;Y6kgo1vzvd-B}O6w`DyZvVUb$fi)_0>Xi_wh`XDg zLHou?s5Lms+B|1A68%DZcOo{zQ;#EM!u7LXG*A7I=va}stLTIb%G15mbTPJtC6ue& z@2`bk(z&lpanI!5d`roJxn1LMiS}xu3vbhgti{i&kM$vqo7$ZA5Jjb>I5~&h9>T)Urk2&!5_{*jqsR*@AAIva zV55e6nn5B2s{fIbS3$?@O+~G8ypBs`tnpU3Jyo|^@pBJ6Gr3&xGBVpXv_#KTy|~T7 zPVPlbwz#RD2`Rb9RX(nGCg25feSMw1j%n_Fd>*$(4#iq2t&SvLXJHusaanIFuPF$L z?33Dk>ORObX{%?F9Pb07Wt{4!0|{TKA10^(IqDps*$9)gQ^q{p5DBnSZ9Z_sBKy( z@X4{S&(rW|C3()_&p4N2FnMDom-ia^#d0VMo`n|7sT-XsrX%xi%RBAuG~k^#lh0Xc zx>V?c4jrXB+D{%G=qH0d6djdx_1sg)rP|wf2S@#q^2ldrwh!xc9kZ*P^{8{?yn&PY z(7L!)zO6-TYQ$z&%RDXwWe9j)p&de3AYE5raOT+B#>l*SaeigzgPv03U3d92uFg)( z^n8R?#%llkP`qSEU(GMwht1|d75wCj*}ZZ~Udo#f61W zM$R@iw*t#+Y8?F7=L7pB?#B3edX`Db%U_N$qzIKUY`;xP5?@f!G|ib}w9VoS8yKfh zYR)T=WZ?wPj!sUjWe>XAW@fUdDo^%KNu=G+v7GTv>EvB!re`0UL%rmW;(3GLV>IHF@sA4N)1((=0>cfm|e*31LR)GuGY z#0Px9&cmfstUIxuxM!QbOcUXjPS{MQHE*?>H)*i%Di%9%ufo%ODp?bjmt8T%@+jqM ziz_*q3HVm^z%TMnIpPnq;;(S~myQ%)W^Qj@c(d1zE9%*r_hH;NHZds^%2|kRc2Wjo zskkv3OemilZRI6*wQw-;_^CqNC$%Htq?R!&ZwOwyfD9Pu}N?r3vyeBRD8fTXA)(f{`qcWMk zWY38R|AIhIIV%!6x(ZdHl(M*&GWlLSAy^9+m1w}siDUIVVejtV%hRVyHa`N>oaSO zveL~DJ`peOCB_({rOAx+NVf9NjYbJ4wC3!z+;jYHm46<}7s{Bq?H(}ck!H)B8lIzH zFy@yO^Ju5DW^`ktf`B%zmPyQO4tlfw({o{HjBlvNuH}`&=n1Fr?DI~Ct3tY$$Tvs9jfX4fSb<0MyX!dFF z#zIl+R=M?F{caC9j!viF{mvKz%|zbxw!Xfsz!3#Krx0{lgOHyTR~^K=EVHLTikqk)hL0X$F^bWO^8oaC$B z+J#a8LaG=Yc!q$EgM9;O7!$rpr-$&^$lJ7vm%(flYTs{vHh29=xclP*5*nuNP#@YU zW#xUMZyME4=;HFY+WAVk{jXdyKOx*}h%G8qfzN3z`~GIatqU~EXKaUr(S3x*HQ-6X z(kRFylrlNplvlHFft2(M$GQ#z%|P_};P`mC@i=}7xwbR$MEsJem#n~RXI0KzEdCa6 zY;)E4nRc_>&2-}pK*0sd3JN1SV`u(qcqf<)DmSgIvz{|>Kt7!UamS&Em1_;kD3?y_ z@{0~*%Aro*@u7h^l(gLH zJW_$em`MH+_~bwEbfw7lbSnXm4Bac1RqWQ+#YC`4zeCDA1|ra^L+gcq#+lS}~L~R+JG+t1p$0u0X*&DaEd?6P!-Y}~*qYb$Z^<42j zJEcXK7Em5mEUN1YqcrX@9uEP_FRk_$U?FqP2C1Z<1c#|TkHM)=p0j=y7Aos0!$Mbb zDz~&y38ZwBPj=edR6}TW)no*^N9EjFjqI8yL?0*;fQ5MSbdT`oXZ7zS0d>QuGP>Y+}3f6u(^uC&dLuvG-Y6yiQc`Z^a0(Q@IPb z9=XmdYpaTS%IlSX}?xg7SzMP2ME|k3W_iDR9na-UW*4hLU zdwI{bG8QCIFW^zrsccu@Jy77OfSPU`AuLYG-*ztq79vOI_8%6rYw6?O^&nGRm1 zlp@9D&KtYj+rl?_VKGv!lKh~pD>J?UC0Cs4so4V&R_IXs@87u>uSBFC`a^IpWHE+B zd2gjFJrh$NgwQuIIx2bUE(D6y$p!K@)i(O*Y9s-851?yl&4v_Fl3Y+ws}<{)Xb6al zi9G{Kp*hh9+uu*abRT?{%{e9+dPhX*_LlBw7OHYT1KzUjy}qa7%}JKVN^$VbK~kaS zl_};}g@~y;ys>3%2;iZ+q&PuZUqWr>y=Ccmmz@S(GSiotfp!NIS=0Sb)u0_g$bby{ zoo~zuBXZ!`Q{2ptxzOI4pu!p_zR*v3b2Dpmu&il^bCKKq} zp_SEAdCsG1%FPuZ;%^N7n$kJMw&Hbw3mD=Bos)NSLuz`bN)G~E2HbRj2_{scF*M^W_ z=L+>#ig_YFr|&!z7gRrSfWDOOr0q}(I{F+h&zZ)6r28rD5Hl9iy#$<9$3$mKV_#|T zx`Js;#iy*KhBn>Ui~Mic`G_tT4oW#gIii|Pm_EAzQ~VR z50yGT)YF6F#epc<(Y#$O@+4)Qut?IUmqdKqcT?Hyl@WY7BoG%UU&VPc8j+W1T%LfEk=7jxr(t z{bba4`Q=4Lwgpuz9UGySVcDs-pVhBNUX-7@}_mRM4h8#;RDK22OR=dE`h4 zhPv%{)tINT7+c-Otj9~fi|lm6!Xl@Rr^YmV)ZpcbAysT%0|hbN)&TqUO5`{59}=3` zx54rMiKjDDmJ{fk^|yqd+?+AhsX@hi_K9_pnz7iVM+%%?6mzMGL;vvt6fn!+*6eRL z&hcZ1ZyRMc+ZE-4h8i${YjEx&yp19si=5lCLp6g%Ar9?11paN2g6hSJGbzQum^eSTq~1&Fiu_V!poI>o*}ZA?`R5P8(K zXP|OopgCNq^YRnqd{?mPY2!h!GdDA9aOn|ZRg_Kw4<*$*-Zkj3US;C|c1j4Yn}bAh zCPJQ z2t>EdDJCW+1YMeW1fLt|ybzON1i%Ukt7GMu9u!Gm2A_A$UQs~Z4~qx~hBN%PH<$&A z_1~o3;IJ=900pfRCC`UlyT|+y30-Z?AYXbIH&d-Yz=MK~Y@f_R;#t5L+b74NocITv ze|PEK{tN0twpTFAHvLTkq4Is=4VIge&XU65F@TGLx~twyCEFl>|I_qhyV@=WS7|m5 zj&H54FC317|IHU24XPG+yxK~b$=852v0z*lh`R&S83NI~dcT~x4fWITlOcHGYisEc z@e)vPKtE?1Uh`9u@VsKm@D3_TxpBG4Tns#|Edhzjk(PE)WeQULxX{@N9U#y#@(#4& zbxMTe4FfRn8FDItxCDVA1-=pB@8*uVOJAY)55)SbfVQZOtO+K*Ew4i1;vqOzcrRxt zaF!P>th`N{?V!Jl0C8M@lI?g1fFS|wY4q|3yVCg$M3ayZ)Z>;W5A$Z#QuHL9_lNP& zJ^i?u35sZeg}Xk2X7i`NF|g3;hS%=)++UE6yJH418GM`K^e^0>FvrVyk|cdW(z==X z4B{x1Nz|LEIm$l6>^^pouCNsDq}i?gHh91w`hmE){5jH|4_9t1OUr@}g?<`xI%n)H zX_8olapp|Gem#%zpN) zt6~A%k$T`gWoIX+)+u)Q8iV(BtjcQ&kvQ(4 z+4g2<;S)2nvpA(2yG!Q&{zfx6Pi)9QOqD-eqEja49$fBu!5q)99?1_)Z7E}(K0WN( z)jM)o5wcx!-}>w~9fjF$$XW`k_mQSO2uV{@9#J1=O*NUcboT7ig~T)49v_H(Eyb!v0D3Km zxA|1NPPz>Ac)PeD5CATrQPr(3>gE9|r#C^hk+`}t)SGF)9IkE$z973Wu_DY(y$+xp zm16K3SNHY1__JPp#Jw_QA#OjcqTbX(CwKWEJB8+^CL_$Hgtl8bJ#PDjmd8HJ>_Hj} zozf*$|DHJf3DdvtF_@zp9{>0m{QFHatP&l;Gsfd6=!=NA1it#&)vH=seDQfh#%-Rq z`|3$cUha?HMJw$~@l$yAk?F69lDn10%-6xI*aoH1a3|(h|DsFvO|*D(PXW8VT4TB~ zTZ{T88jX&!D-|e*uUMd(72afN@w|w3qX8Nv)LtY}19a~;%ACheQr5jom8K8M3xXQd zH$54({Jkl+Md{$0{>_})G9;cTK{KwP2|D1M%?>0$zUKWdAFk*Q)Ao7%-C>0j z9Oc^-uD(?V)(tk<`MW_mYiKAPp^p5493>SGOP=d!d^O=BGqRJOMJE@a4Mr`HxBg{o zR_33^0&1liHbfZ`^t60Hgo4ZoeQ(1BQ@xKF3+=#RG8~F0Z$q{nKDN?Z0&NWNq*7yA zpa--VbxIrhsH+Ov@RSm(6{UPnHR)EdoQkTfkBL4?2NbMlWS3+$d>15!o23S&FE7|8&_iz^xVMCO6h>BD#S>M( z4633{${pWoYiSwyF5l>?xo?1|UtAQ11}cszfwyg7bytw~RowtMSj$y3h~$m=mn)|8y)h}YX0RBl|;T&hA+7$ zw33dUBKz(nbL9BTM>9E=fRzopEj)I}^0PBDG%6tlIOiD<1xIgPPk+U3;&Td6UOyQW zeNbKEtNfr&fZQm|#l}YJJptqV6oNdE4=@|v+_?xP7^JB0hp)m-alaO>E#*+{Sl zl@AfgepSwo!21g~`kZJ5G#@-c0`1(-pNw>LbWbX@lyzp`1ZFfF)Xbb?wMM-!PinFP z7tP;g<_}%nN8pQOhE3epq{pqTtfp0HyPry=4Qox#t5P%)2MT*Ikxh8X^`XF`I8o3AXPU{ou=37onkCBs>u2V ztf85e58uq^$1r7jY(n6hN5Y&;YrGl2Y2<3`PLa2*k37OZ$u3hWpHiT+Jpb2k%QN&9 zUnl+-ac>?E^&Yp4Pp3^Mg_LA1L`6sE>wR6<`}+LJycGns z2!A6=(xt=-Sc*C|`Q5)K4jZU#$-M~#sl@Kz_ciC68mK&pj&2^DSs=&In2aBXhHX^) zIKBTYi-m=m0B_nC8&eG>SR4I<&t;p#{H^(>9doAh@Z{6?tl)lT#5|45)cT}IVqJX1 z_wNABmvEeXr?C{!y;MGpk~5jev)OSYpGi!eHKstj`<5GVU~(?Pyh(Hp6oN zwAUFr=YRP1!Yj~*f2`X_8@)5R@5^Kei~p#e!^!GSEW4T|hM1EoJRAjN^4N5>LVzeY@7Ikej} znBj*6PDv@*nD!1@lSEG>O7NQmnUdbDu#8k)8 z>Kd29^8}qxO3A-USKRCkuBYUb1wZeMRy%r`MsDvss@m)=VyW8kLKsV+7B{!KrCnTa zrzh~IuvXwKn-vx{#>!l@c91u%XK9!suC;y^L>OQ4UwHK zLDx)OeR-ijW>;{g4AD#5M<%S>O$B5STKphl7gW_>VQlCW)u z$JOm*5hBzJtxQwe(+ZLE(}jT^5+VL>KTd>3EZwyK<}U&el{D&@wBkR~Coh)K=Y#b3 z#e!=L{J+CwQyMA7tBcR~z(=cvSwV8-s6T8ay3Rs;9q%8^sdwxDC>iDFp+8BA7h=< zlQ1gr0|ZUl%?5&TY0F+**8O=*gPMEN$VXc0r}V(;iiFGXdQ&AfqTh$B0^Si=t!o5> zR2LJyJ5oJ)D{6m(`P{hu+HFRe%jJCOKt_pKHIfgv^_P+SlUH_0)$JHy z$uJDkb6nC=Tcx2MTbGeE&BCBT!&yNEQOAHbD<^35_+^XUg*Q~^ONSbTktqU(XiXE- z&TCtCQr?b@xzjOF_FePvFb*-5jtA`O<8!>0p>X>ps2T9a#x0<1L*JZQ7#I`MDO*8$ zg26uJRWlWi}&42X3)Ev~wFFcMXxw4v% zR$klsWEi`j_bKgVAZp{x{AZSRPjByO&_3ux)AJUQN4lQM9_<6p*b;DyV;M zgMQV?Ek|JDDgGFHL%lVf$Enc63EQ2XzidX$xF6#_4$aSDX8tySqM$L}&o1eVz~;(r zwEET*!Ox>E<|N=XDs4qmj)q+ngLQhc^OFjHoqkuUSJ{Q0yi;FRUB{#Cgac-(Cu@1q zta;6|!r$Dw+A@fu7$W<70mEh+!2k|X2HJH#;)IgT<_2367;po z-W7KHBRXN^&Rd(TE5EI5U6P$josV|@kT~c(*dJVbbv^`Tl$qRa*nUGxXk?dHPQ1Ot zl}2xolhKmuTO~ABPQ2tf(wWLE)reHIrYav#U`|XZPTuBwtkCOmPi8Wu7X-n77JaFcRO`$+9%il?KBfX4> zqW9%YIb%`Mte|tUw=I~x!Mzo~={jV7O5mD|skQ!PJ%g6#jpj6w#KPA1*Qg)qv*|}4 zoN`Atb0M<-#-2z$41RBgQU9|QXqI>)m!E0)3V@(tPebMBd#{r(s`n+jWJf=R$VNjU z{D{k#v&{0+)27>kVX>iO#mc~XsH&>QmI_4b4S0NT%9>Oo_y24*^yyd$@D2%yp2R$X z9c|yFb zxH7Rj-|Ga+`en*0?BE*fk0~%2?@-NCwjyf)D38tp2b6)nvr5$YeC8|1)_1U3W>vI& zhviKTRv@WOe$XEMPP^gzGo(?1kaRL^+nmlh-P2V+oKDMp8Qntea(~g~{#NmcAsz;8 zrn~zb`T4UWc;d)wsM@lQ!ur$q`7=S(8(3`&2GitctoItb^qi1-#RxZK`s_lrW6XGH zQXub(%CQ?>)_Bf^tqY!3jY5Uys%mesnN5SHfziucy3j>mZ0*TepQ6jgU9jG~l z1oJG3>x{ORYU z->0)2%*;n710+LYzm%P3jZ!Am@v=_u=V*b$vL@z?)O8woTVS=l`ys{Ul~-Nv&bqkp zxMjk~*<7lQR(dGY1926j!LcJE3LssLeE#Z!W`oT9?NMI83`WB^hEVU|rO16PH)4~+ zu78Q-8N|PT3_0-QpY|%&VgG+JQD=6m|C5P&`|%oPj$jONybaKl3oL})%fDKAz*WT<9v>$w3SP*g)JWW;ZvHIy>$yLYe zD422S$Xm3Xt-ZaIhFA;A%gf8#-#=_W7fke_1sDWnlKDT0@DLITaR)_zT~+nWt*@^S zfeGYUnV2{q!gI5k`^~zLRE*DYn+O(<9=xiQ{0E)&ZdyZ5AhM~c zBF9a5mgb={tTH_>QfRTg(Bd3{xv2GXeEe8CMbZtJA0StCsLH^oBHn!X5b@)C{`~3YHdRkgqR!(}NOr!U%7O((6+p~6$N@KtO8F|6^L{?w19L%GE z#o6)LokT~$@BWoG)ny?fRM z!y*2%Xeei=2t6L{GAs{QDX~@sX3TSE+J@))B|4Lki98?3;(Mz60{jDdX z?~gNTy>K%G&c{AGT|Vqn(O240o3r{}d;99#zWD?2zu{*=@*ul7My zj+-=RJdYKpH_QfqBH>RO7J(j2kP@L2zPqf8oceKyz=GpVBz5>|G8KX9tSDxwy65BL79dXG_rP+~men3+wbH$5ttr@R6*`7e<`!d#qDGQ3E;Yf zZaeJrE?CWF!d0d$VHsQHP1W z2};gi=-?5*OOXw~LF=F%HS1+QJW$@{Gu_95GobxLPFIQ%l!(}M3||P2f{wh2A5hNtq@0V zvfW{)sjb~eBRUMv0YNq*zN28?@Oiq(1kIaqf`u`_ zqz31f8L(eR@Ga5lHUJ1<(fx3(iV%FTqOvlc)jJz}BPDV4?dhcjn?t+dlc{=^M~pAR zr4pY0!=69B?F3bsFYHCtXJBcXymvES@>tZDRrYw~h>4?dS(MWqY`=ce*kl)4^#0pZ z_N$%D#6Z+zhjR^QRM<-HzOLGeideeI+6uO|1xUQemEcwpb6QMaoln0} zPFMP&9a3^qkoynj!r7DG{g4T6jK02t&IrMMyBCclJbCph>Z6LR1!A{O2185fFwg_B zPj7n1tEE#e9NNtrb^wwn$8Pe_yK!f$e&63cI=kr8ULA9^QExBvqX!OJHHwcyT2eBB;o3CGA zECt=V^{0REfskcQEv@%340BNNV4-=Q69GKqq|W{DO&5qC+`{S(0OwNKZ;#~#9HS@} zGdu#Y_IgRh!cO^JV8ZYCA<_i{_6A)N zbSsziaKo5}QRX87Apj41Jhm`qUjTf6a4=H1yOj1jxXVGA>J2ag{TcTj*i}dfHW&Cp zj7T@8J`=Tz_3T*M0LXA06zs9qRTXrSt}!M%x_P6SWKKr(_J_ZPEX@_gIkXgaNB6#R z3r7v0D+v7`N2U{YR-}w$Ub3a#YfhM);oT${)A*b+QcMV}7K7c}l4LjA`@s*{(9@H= z^yB1CK)2(S`D`dgLF^q0bSGDq9z0N}`EtY~v)zz&DxW{Uf$`xp=N@4~Llu~MS&~y5 zrOF$X$BI7r*`4);F}@mlu~D71Pi76PEoC)$m^#E;I4gLTC(-;4Q3>{eDVt_ zZt~H*JW9sTU4;~~rqx=2G$Rkgb9S);imtqwT~4T4m0R2BVuu#BVCbnt6Fii}VnBA0 zWJG+3yfe~zXtnQru+Eb|B0{xqcVt0guOhcMWY|%kOx27V=-1HDehz07$*@KFIG;5p zmwg~KDxVYXFXd^Uzi6;2;KGpv33PV!*fui3tAE8|5chS2ls&hxLQ3MXzNlMhUTK3j zgLH9TXuQ(Zt#05&#^A}D_`ao!w2$?`}vsMK(YMxyr+0$%D_KZjN^t!Kq(BpMAE&sq_4-{Wv<-cDE?R4tB$e#sHB0nMM9!4NaB=fU^F*mIVcQZ_ZHhr;v@Onp>T+mlHP5e_w~LT z{iUSnq*c+wIb9d0PR*4z0!Foigi0nnKl!~vt_4gt5kCx!<+?n}q4;q&Ea!^vMr(RY zAioeN+Ck6#C^<8>$-*7;lO)oplS_>-J|Z3d;eF?}$$DKsN*UoNP_!2a@#uOI0Fz^RB3t1$ zcKqb7d&<-VAEX@f+!b14H!3r+UGYi%&LRxz%ZZLHcw{m2`;0 zY_6)7qD-GJv~bX{gKtxEYlf2pY|T7){nO>psa)VFfEEYC_?@NkbAan#*VKf$SSiHe znPkMB>m~CNqcGT98rHVP zOwCG=%xjCUk(9{L<~QJ!#D-&jNWczUb&5rqH|Q#WP~R!)3WgOQmjz&0;jy;rHch>~ z3LozRk!Fdc5|{%kEB2lWi9B02&fCc+MOKB1ZQ1}&s_ak1?%VkYgj|-tdQqJ{1YqP{ z0$2enm?Ul-Hu726V!x2(AyEVBKe=)js|aS{#X<{k@a-=@43a(mP8O2kCj!HO@^-C4 zF@m+S%=##L9yYxy+EM-9hw$-?n6O?X&jyEv#=v+>7>A96pOz=;@r5}1^=Qkz95=3e zS6N#1K4^8IKUx}U26&_fMxCw9p0{4-6v*k2ZzO^?do^v+csD$JMTC1T7skjK>6&ug z=?W>wP5Xp)%{Y`9O%u~e&!aR8xpjC!yZsQH9ffzbQ@E)WHx@+o-VfJr>)Q3Z@$mao z=_uR$ucKD_$t94A^?i0xmXVM9F=u#N$b_nx+GS_ z=l4KdJH*3Q!2~*!bE&cEcC@Ifb39VCiUk~sPMo6pL4C(qFM#skyp%u3or+#h#kMQC90TdB&9^qG+yr+%Lg4jR zpvaY=pGY+U+6jgPKwfa*0Y96cFU$Stj9RltinOxHMnp2+aC%|E+J7vV0iz|34z`LW za%6)DIJ{Jr{Ngf0t5>H94ESMF#jmcXiVZ|wI}EhZ3{ zKBeb}E_X&5YUAIJjvj_}3(_013MMrgDhQE_i;GR)v)oehGG``B8v-+S4$c$TR=wCI z==o?WevF*d;GvH02KEyGXe@GX%k`3dkbQDh(Xfy{cZ`n(sCdI%KB}Q5@0-I9)xrWD z-lkuEc4h@K7s`#WyV(-GPi|~ z=1^puMa*$a`PR(dZ~usd0!zy^Wg+lKKyyU%U?t&a7qh@o5Ehr%n+JGNsRJ5@m7YK` z!R3a`f1r&LZl1Bm738mCY+}-r#!e`3pTSlQ(h{?l-)DDuEqOgyu+kifBcxY)EUuH% zP)Fdey*U3=)!b^1!_~>uF$Y`j?SIauS`l#Qo7L9+3zA-krs{NM+ z&*0=0PX~xmGsh{?GCeWa$W!5|l^#=-2&J%#5J&+LZZGR^ZpzSVP%(lo%Br`! z=cBbf`07on4Q*Iepf$|*L(kDrzfHSz=K>$m;UycHY<$bx`>rB4>;x8x& zQ?29#UX#hzZZ=0~Xvz5i5m*`jppNR!9B96j-v#53FYEy9d=l)vM4O^&Yq8kqD>?q3 zx>Q`P1c0xDHE$>Ys^e){F{`$`tl~y=Wq*_G@iFXeUth_je+y*yGG{9Y8u)Ql<^q+s zaigL3*8Hwl+{~SIywK`>0>ut2y&`AM=x^)Lx1%*cfjIR1)im}ci>CM_L2(Wswt3zI z^E{~-FE9mUo5#9oX=&+`Dj^}mme?_7Qn&~_P|?ppY=n4;B6mBJ?HqhmU^~{dq41`- z8=HtfGax8!H_csl$1P<_s4%C717wiS!&s14SOU z2>T-}6PtAQ8%XMf?2XiO!q*$hPjp&!qeW}RuOV>*KYkb!a^)jaO>>_cOZzy03IoKW z{9c?-qj$G|$R*f7lv@p5RidEG4+FY0Ej@kXDd*Ft8MBtrL`5KS8yBXgc9rxPhX`EQ zk#Xiw_fdgJ4*NEAra*G+QfCD`?Ih}z4f{Ea`3g^KI;7zXg3H0QuD@SYAo8JHXnxl_ z4;82z{zBV*yZA#rs`oS0xnaP6Gz9|2k5$Sk6b@}FHcj+BlJ~>gsY9z><+A%{Fz9-y z*c?8W+5WU$(Wp}yM#L=$NSP6NLW}4X80ZX7f%bQ(afo(acEZ)QwT%r85BsF^q8_u> ztKQfY1+;qEHJN5&i0Sk$w1QMwE!$ceRknvv$(@==$2EG{slo-WLAY z<3XCPKbw-HH}%T&PPvhM5Q&%T&MR92YBFOZpP6H7C(&Z$A;#S9a+ECKh1s#ewNT=4J5mdaDzH?YON z%D3vU+$?lY?Rs1otrE^xjdDv7*jHvJlhgv;zaBWcnn!#CmV+t)L)ogwn!Q(b!zm+!E5pIDc-mU5p45{=&B9LP(6~ zk_oB3YW_#Nu#Y5?V(hkz?5l>d4nV}#ok<0KxYxEQW>7* zmfe@>jv&f^eLERkkcq$Olu?4|+018M+p0A%LUt4sRxckT4``UFZ-pMqtUf0RGEG{# zoPW{e710F19N-G)-C@r!UBoHgN}By6{o?E!s&{mGEr^OhB4l zH44Oo+9e^uj7KQCHY!vX5jqtGnE3M@0uvMj1Rl8qunk2)#}C|t-y*Y(%mAFpCoM{b zO8it~xiRQpZYZA?4D-T88Ea6^Ks`}T-;DS~iVCb=DM$|jp#c{A9KFh8Ceul72DK7v zeu4H>q_%b_Q|>PTPf!&D0~fk`{@BaAX@j!KZKj9w%*4c9bJ`sOs^+hHq}#CNEJQ5=8M`i4FiCWjt(_ed%FW9!(U;_t zyn}-|fYb3UXO#q9V;zA(JzmgR`Ny}*g)#^1RV6f`!XBT6YLe4yemJxW-?hBK3|H0T zAx+n<+Sz%{D+TJ#UHX~r&Bu6MF4I4fT_jqwNJa8I&;bX8RWTllWDQDPkXBM79|B+o zUT{Kevti$_dZ0vWS zff94=iEu{ZhpLpEb&_sf^C;>NXec&8KTFi!-+O(q(Kg|d!Q?d9Mb;sDMNH|kbXQc< zBR~rpmh_sJwHR#2)X_FsZ?RYD@x6N1nh}EuEyEypSm+bGP@Sa%Z0WZ9SvRG4H7SEM zD{tK6Pyv=MY9oZ6+f$%W8a_|-HX6}Jxh201U8StH6br$KUDmG&nlE0O_*w@@QC>S_ z>GjgwWTx%R%JS{``N77R7C8E@#YJ2z=t{`q3<^aa|6Cov+KJK*T@mS_=f*&vNVJ(>ksB|m( z1F}g~pL_BE%e<9ACfmrTM-$0~)(TF^hbWLCF3B?2eAG#fDQ_r1@7A8x;#`BN;mAJy zqqh@P3cel2lLEPme_Dn++#F~$?L1f2-@w#6Pux36F=9y^tsTG|6kR-dB5JNecIxS+ znK`n1>f`d8Y|dvN3WV<&Q7Veop7ecAitn7gzGhs|3y;8ewkNMaopbZ^KYqv+7toj= zjD~^Vfz7A;C)i&fIEKTpO#aIQiQ_OfrTUqCIn+FngTFM)2)6?Q9)TuELzP)Wg^}ER zL#SRY84c zL8iUE{q-9E$KN+MdYjW@!<#08wJ)ZW?pxae3^{xq;I9K;mqQ%nZT5bi>zgp(t6^gC zRYsTV%r8d|{sH{oEsOm^zg2FZwD+=}Z_v`c@{?nyxvC(r9qteK1)x#~*bPyq2n^Y~ zrnc5$@#o6hw{Lrc4)QscgF+tGNGEZYr~@5V%mWe6?|AaFaf4_Q%8dTeBK-tUWmB)T z3br+%IVL*V{wNC_C;iCRPW564tm8l@KX^J$W)#FlTh=ld^VRdE{;|&(XqN4Ro=BF% zRFaf^u_%P~&p+17?{dN{ZT|wELq0yeaN$lM#piK3Zn47kfNPo-aHg&YMQP~c{kI%! zZJU1m{_wOE>oxFh2E1VXgSBIqmk+!>)O9hPe)Zu36P<_8do{;5D}<-IpwpoaArtCm zgMqhbaJsv=cpEzy2oxJ!eHcYi`9jBlhIHAg9YH1_i??W?gX$EYJn4P~POS|HhuRPm z6K&?o0RLZrk^mg-Gl4@@b&9U^y^eu73mKu<@Y0)N_RTpeFCHhgqWcTg9~iOY{p7)1 z0mcuHgqd@ONK=5Vd151IQPZ-G$>=OiRP9*h(kt+_8g6<>U`Al!jDYaYfDWxYxq}(_ zM@BTBGP|td0RA%1PUaQ!6>77XgC)*Vm#Vz)@bF^Dx0l?26A2CX-y*^szx@2U6F)MU zJLUgojh~H!2wLv>6WnJ)v<0~(YV+i!GdALp9THi#pT6aW0>NL)fJ7d>a(V-td6C6Q z-~d^$H5aJ^ZH7i^4}J^{>4sgAiJIcnIy@(;OQ#xTTubC+l}6(o1%2w}l3EHMT+GKc zeZ9p+RhH!U$$t3G-oXLd)(@I~&hC!ovata30O))$Zx6R1-4?gsLjdz3n|Y7rFU&bY z^em_&O3O>#zP%S=qQ?rnafo--ROP9J`PKPof4`??P4ORzj>415x}`?d_AzN|X0WsG zDIFdvlJgt!y+)bs;c0ZY156m#P*OLSw}gl`zMUOsSoX#bo>UU40dcm}$lETwyb@m>fxp6zx1|o+|WS4I)crBGo#H7cHb5w!NOUaoAY zf$$qV9NO{rnj`GL&mCTnpp%BZQgXN5LvV1~W}S(6pE>4~22YOLI})qB?e`!?C_4x! z8=s1*i$c&$Q0`#^_3-R+dX2-HA`rR|GTUm?6)Hq0VQsq=O^#2KYcC4BuBj3hz|qVH z;oZPl!J!3Rt-57Le$oPbeeZ))1hT^}B3r$_9!2(4`n|DV*s^+1>{3-3qYU-4WZj!` z#LaSzZ9L+(nitZ2MtqF~yrBp7x4cV%Ophg!K;&j|PhP$Y((7F0119+-7{(9pICk2y z(8BWFHz2R1c#MeL zQq^MnyJJEXW)8m_1g9x%M8?$m)fL97x>E7snf#vyokmqV^{T^{A5Z0Duc%5q^DEF5 z3=LY$y7m&*QBbL&B`_zFmGOez_MZg2!rWz%G>!f6~zG7$UtG}EN#bCm-__W(V zsO`-;Nl_8ahuus~W^n!-Qp~FPS*bQ(>;A+@q)D?wubN~%QO9ULvRua7wt?LSN}hjj zkwqRe+`r)4nSO@~Tl)(6SM+=r6QnjEIbblsWjG|1wJTk(`th}+&CmV&Klb|5?8-Zf zU(%{d$KyT7-PtT{R$vYxy>vY5W?R11^$Eu6^lEW|K8MtP4T1V{+Cg)F+QJ|=OV>K8 z9lTKLzwE`RIm)QMEwfr3x@w;@{jQ3yxd91S=W!MrA~Bkj(8BC#z%%@_@y}*4WcOgMvDJLEm;wb}X1JL1 z9HcRQ75*a0tY;$gxS7$HgEV84vaSi{5+r*e-U9GjE~x~txPG*kwbiCF&3by6HHCxI zLgpqM=UMdf`oOuRd0(fBhGGs{D;;dK?0+<;Rg+$d(h8d6onHYcc9W@sH)Br&-jkr` zvzB4AkVReN)PAjUjYsg%l*Md|kaIb^%gd636xAqkV@e^x&|`OQXlWOA4>POGs7T?0 zK#^(HXRXkcG|W+xBbG}+0;>wmufD0DtGqyom@7L{6FR9@L&Vq!pcDM%UHBAoUn&%N z6^WmSVfNm$UcJ{FJ-~9%R4raI*~L03AJU55W)$qTUVT7y4M&iXdi8^IAwsHo9BpTi z*^WSfQ4idAzae0}xR>=>EW%RtbX7rLrJkz^I)V0GRs%N^Mq|r_^5eLcVFUv7j@VM& zmEx+~IDug3g@J-q0t;ekEL*hkE-Y@JgFg=YOla_c4g^B&Qa@M^fBm|YX!Hy+VsuFy zPXax>-Ls4k*PP;CaHm$E1reH3F?6vrcjfjS_{R%iLjB7_Wdj1-&M;{Z_~;MNY4glL zq*8h8yG?K3_DRG0aCFXmki5gWPcwF?I>j$1ci!ppm((BX?lP(}d0BsKBR;ypLxq0C z>lLt8EuWzGW%=XvlBSRWtP!%!+ba4p@M0+Q&KMUfbsRs_zUu-Va$8~w^1Fx0zWPH3 zK~O+@W3h*)wNqP%iYz5}KniUO`u$+hlk-r6R@?KyRghimL~EiSSp2XlJ<(Fk!E3lu z|M=mhPq2|zjDs(8-wBD{CioBww$=gMoj#B-u%8Rynq=cek&!IFt_8DQUaMmjv3{DV zt=E-~=yVRk89zBbHDR^2J$R6MZV)~>;(T3#gmcf0!~=~ zI3S0tdDhqkrS_0=IJHXscEM1+&8S!;-#l*^Y%r{C;+f zIZw$6%MnY_gWyh$-5D{0oqEp#8c#`xCM<0}%O7=Dr2gYIuSc2Y}g%blkC;sAOZPkfff zGdU&@;w0IU4%JFRqZzfd3CmA8*TGpj3L4Lr_Do{r49?SV{He{qb`_@`hwcKv#Rb|9jF_j$HJ(EI`R#T)?nYZS89`2TCaU91r3&ZHTw(_bIA})&wqi}zO}n`8 zKaD`YX)-n5bV7f5CdURuNIAvVc!3chYsCFabOj#Yk7#4w1vW5EYySww3)56{pHsc6>o2ygce}V zo_c@*5O!)xY1i*IMA`<8u6ztj!cDmcY$1bgR*8KEOIN;=cY>GUWj>S`dWXUf#m+Tl z51s@WIsOID{;8lJbk! z8U%be?*!t34F24(4>lX+<=b!Gq69sGC>0a%n}ZK^gxnPQ7t3D~Wmzqdvuv`9_=L-d zHZgZ%r0joDo$ZhE!_KQqJTUq#_J$39#1VtVxfX9UAQmP{s128)wW1|6V&6BG0R8P}~-l)qMC@dcN0VTq2e zuGI2BE`G=czE*VQ6jd2y-}!1FmR6Z;q)20IIw-zSa~3!Nt%k*JYxH(bK|sj?Jthc^ zheI*?k_ccOp-Juyct63GNu3dOnn2*ytUFDO z2VP7WfiUp{LAhRHcq33SOcsI_mR(0i);rI}JX5Z_V}fiGXFqkF4`s|AAL;*}w!Jd% z)U^_S(Rh@fuYEjf%_-Ne@3cw1<;l-5$2TMttjY5@sJgXZBvMBB)oZ~72;UlkfNwY- zw39JAJOzYM-eau-dxl@(|rR0!?}8WI48sJGHJ}W$|lcq_RS|B?*c;s zR4Hu~%5VVG^I$jilnvQc2r^I9$va#1U*BdTJNeoVij#uOw7n6vIQE`jN#v+Cg`P za(23^(KzHLu-cD(s!ga$#PLNf zusc~ITNTh74RwDdlB%UwM(^!^GdeojJe#pme3cH37vA6@ps4}bRB+8IG3e7ZL4Eg9 zC?ZaQrmMCJR{&toXEj{X`?ZBy@8gK?KC#z_cSFReKPx;?qfhG`CXZ`J%p>G`>Vh_` zW`A_Ke^`?4|Cq;&RBYYP<%|h1SL^!gBga}xzzAh{I3*iyos;!DF1E{BK1p)X-)?W0 zJNn?J5IcOQ%jEe>U)+Y=*O!yAX~_SWe4W)5s$mlA#rM0gnXH(ZJcTbn*zr`)L{h<_;gLM9ZPK`&#hQwhVM zDtnjSM&hJb3V9iu;r+hug$C;!DqQ|C?9nmB!}a#hz>5iD88OXltm43!iKg_Jt2aJ5 zCt`IjW_6uFz?9Jrt=r;0c#8lzyJju{)ltQ>#PbqNZ)iSfQEnXcc7Fs^ZO@K-rwF0` z{#$5hAjhGvsh35vok@p&2?(G03oYs>C>?hEF&g?3JXGRE3xR7-vgCBifx4+mkm%Ir zKGVlw5oqQoKV0qbwlq$C zU@JX#{sgBT0|^JBO8H&vENNOKFEFGI7lO3}*yLt35ECh_*WK}UG(CtaW2i^p2i6b@ zN6>FG)HEpZjxCOY13(G*By$Z5tm@)bvQ>eLRDmuf*pB6)Nqy>h;@N|KNL)f7@9?%d z-hR)$_>r&h1f^Cu1Dd{i>!h)!Cs?Z-1>Y%hL+bpsKd>Em90;u}g zV8JjxEA2wf@L*_(Qk$x1BaA%#z7)=`|L$&H?N@0BJ$i7yVlBfD#mC0C3%i!UeONLLYQjIg~nfNRfEDo|$(vcWGEgp=St1OBI`x<9}wS78k0K*gcvk&`<; z=+SAQI&Y0_%P};trRu3e``qNxPiXBq>WvS##CHw~h2Gk;>22@J2c@-pz%Hwjy5UW4 z`xH2IpvETz5%IKs&w%V57T{Pr6Z66O9t1%r+`JR$>5LsdTbjSR7`mzeN*=Uz2!^Rw zZ;1hKkj=~zMAB@IJ6Sp@D;maE`sq74@&-A!nlKjMvw^84A{1Ow%atoF1{LB9Y!`rHkF^D?<%u>S{)5eIC z8e2d$dBuJPRkFqxAWbp z{Y*_W&CL@{Lt_IYJ|tZ-Vy}v1Y*f%6?^20NbOrG0s(!AbW2_QJV|&omat9fJA2-!^ zrAnE&4`cC9OcC7yhf2UH)xcsM1u5%C7Nfr(MpX5j?rkfLS&`l{`wqgz(s(S8bib z#=q-pSGrr}xb7Kel9_<({sU1kUG}2cieBgItO>`s*$&8Vabx>H z%?l1Q1g5*J!CR!1&Z@sAPKjialf^Wo5*(@XH9Oc{$)>sYAtCBDp1_3O5co@wRxNww zlEiL%k^7~Cdl=FzWa>;gCxU{H3HCaUNFVuJQw$@NN16H}5fU}2F>b|k3=}0vmP^0c z8G`KMxpk?_h``iGqO3x`-2f_Q+v5Q`bjX9Rb>1^5+uTZh3f7eOgWgg{kD2caZM-7N zK4#+UqC35`Bm!$>w17*68`Hni2fFp$I@OM9*iw~Yb+;mchv7Be#Yz@Sq%oDo*QAmx z|C8Orc|9J4&ftz4S6-YyMWoe1R7-EVl(pq51!5>+8-zk>D8LQ7vcS&wxIISM3G)Jg zCv;XDY7LA+iGaNy49zN_?tnXR$~3?_5L$d86d{6z5ngxyM1MEUr5dKd3JxWI*uI-7 zTkL4%pUu*8+=|bD#}8VX%8lUWspYym4(* zjD2VOu!)NaXX~vYP?Pjc)L9xL+*@Lis?ZUCBYAF~r$Eed|NIg!@tKrpWLE8-$?z0t zlv}(&+)N!+X1{$1&NY4M-}+}jwUb_O{N<%5-$BOYR=yNV<0)U6UWLz zb-7kuMFG7-`;|W;>yz2ycf0}3;_7~_MLzKSj)Sn zjr<4D%wY%qZs7k9SRBR*^dgtH=}W9>H|3w(NGw+r9GY6nGZ*g#Px)oDNDV#0sW4IN zArSE7zniDqANy2rL*)QKi~&;0>U<3k0^CHm?Dld5-tK&QxFUN$7o68M?C%~3A_WPW zpX2Z&SlM~Nxm@@5$KgL&0`=u4brd}Ey{_w$4HU}j4V>V?Ev^HR47@MkZiRjcF#Xe? zG+u)Z8Tt+5@K*qAK#LRLS_I%YU{B0Jh};S#mn03?P@se&vS?7FpUN3rv-(PjLplJR zrBB)p?G8S`IRw`SaQZn8aUui$NB2I!+x6a%0$F4mxLoo^!I9m5qjU;R$108w_3_y? znnou@0S`@!gd>sW7TB_KE$?8lG&M7G!K3J=K{3J9^_O2Odzy7&BY%m71`)}$_h>s{ zmCg{-J2%9@KuC1?5IZ9U?aYIdf(StIKxiYbo)j5?K$jCsf4|5&zk!lMj!e$Bl)xd$ zn0Qqn0Kfk;zKw7L7uPrR<{?N+ zsJ1sV9l8!(<0vQ(j|oLxO_An|%vk@HVnBrOH*j^wl0QQQ2}lbbvO(kFSY%a~`w1Y8 z^}89RX+TknFaKxl4&h3`w!rq8c0L-0its-IM7u&BV|?(}uU~6q%dc1K1-ZlHIni0j zT~pg23bSPV@xPvXOKU&*|J$8coTvT2=PA7Q|GlrdHZwV2@BcFvWM+pk^?_T;pD1&M} zB!!tM7&fKOm<30H!@+Bdz^>O77nHYcS%10Z7fNX8gKY#YwX#1tX#C_(D5MjftpAd4 zd6e{f4CNh%Tq|q}82cWiQE$&7_v)G!a@;scoa_FfaXM?JxhX)S8g{r*oqKL6u@nd= zi_*V#u+^UU2(mw{@KRjAakfu2F^h4sJfv~RD=4@uhX?kQqJps2YJ+Gvr~=wIoN>@E z(BKsNnj_?M7DVk8f4jEn0X7-w}ozr+xdUBXM8m-+vy!Ae*bR3~bNTbAfE}l1Tcy zj8Eu$mDfwQLH#xAXHLDTECgJ}0ouNXISJ<{TiFU@%tD}+iDIBXyekW(jW5{WE_zH^5tScD22=2wHWw~j*rC!> z$;VFGsjH_qS|7oW);gsq6t&~ss`_|U=7miCE;akw!~jNcdE0Gko5e@sAvacL;bA-6 zUur)V+q1_7pQm_x#sho%c1flN0)DO(2?q|*L8@ja)h_A5$OVO$cs$Nl-HF~A?iUnP z#l7WB=0)089XkSq-iXBKJ26%aa(r{`dj$MMcV*g_C@6l^)zvjxysF#6swbFO>7Gd2_a*1Dsd!rU1KY?6?Q&ZW z+e=d|Eu82YjGYW0w@}sXLPcC8;pbIuZY6-4+NUN=OiXC`?Tn-K4jec@MTov-{rQ|0 zcB8zVr&l_AWQ#<^U7ku|c!F1>-`<=MiPWN&Bl-)>y{~<2ysExd$aqbQ?kBO@`_7#^ zjo-dKcH`f<(RGf4vyAS4pLj*LRgmOtWan}=caDokS|x2+C)XNR2XkLC;5XogFKW3jP{!s-u!cK ziP@QtNZ?05qNWv7Wh&>K;Q!r&l`h1t&2ClQ@S);*;lt_M48m*uwvdHJHRxOKfTP^$ z90NxTgU9bLZ}$?ZtF$neFf-W9F`ZENVYHSK}1%I?iK!miHr+Vk3BXLKxHLTTi#bVcH_W938{KEqtm zL)&Fm=8t2)wRb{7LUXGx&MkXuWX)lIaA3IdBezM1^Z*U&P!0c2Sf4@3zG;@=VQ^4a zqF-X{l+BA$=y!fB;J7QW^Mi^{8#VgDGbFE(XLjdTo*x``{?0lT|Ie4%9~kdEW{u=g z!Y=etuENWIzjEUL%2$+HL%I25-ggYz@7%a;){lBI^T0au)_=4BOSZmuUG!LXqmMm{ zI)8fJ?i~4V>B;|{=lP#j;644f&6fWkkFHgxnVFf!<`|Kf2?eLs%k*KK;uNP$rgmfO zEd2fbX>aI1%r{q1R1ArU$$5L6WxD1$#p24!Y}_=O_&@yGsNG6l#ciQPNBo;&nRp0)$fDzkg4i zj@G%c6c`-sy9x?{{){3yKv*_GqGaHSBS+%kJOT6GyjRGGdCI(n@#$pc;82DG!6YRm zm6Vl}o5Hw=pxCFqZIg667k`kNS_RyKkf5MTfGQkPJ`8R5p952vX*<<%*#N3;u&{_j z1zEPMSCya**o%F9eaE0zRc;%NkFTW}wZ`P-=PSYy1W+c9cDA*?UW_>?-D@5hCSxIJ z$G6OGDzKxo^Rfg8z(}K&LPBV{jpe)tjzd#zD*I^wm5^+eO>qUWZ~^i+p&oWsFN$cG~UwL7Jskr zj|?>D>3aLJxGe=e{eAn*?({)dWZ;XwNvBEcO$D7;VU$}Qw zn-+a39eqhsT|HdKb>YF@J$tTPym&WJ%rDPQ0zMTDyJJjgrHJO5gaVxF*(pu< zq~~3=xhU20@%lY*?_3hi8=IO!K7RaJ8-k|r00k@~3UG{k-oBLwN3hU!-RA7!*J6F) zk5Z^}&_tZnfww;Wvk)7$MV|M-_GGC?+_FwcZbDa=@xbJgP>_-FfBN*PJ{Fsa)&PKO z9hZ07W{9Wv1YjNqYpEsbwqg*AY?0k~*K#ncqeDSxdvj?K>ay>Q z9wrAyuPnWwfZLoj=h-4TakR0J?V<61QcqMzIcYYb+t(8_F|DlCPiIiPR^0N>xTF!wKO^rd5n^ zoW`PKAsn9K#baacv+j1l!SUMACFt;DKebM3yF20aO^dngoe4h0++02`RI+arMwR`C!U#Pr6$5VVO{ikv|^jr4gEh^bwN7kN0I%sM#YFL zaR`nC!Nf&h>wssl@K@#LB)bW%&*U$zt*OpT>vIfR>%1*JS;mrETslB7nIky&r+pRp z(KOVp)8610$TZ~c5NNvF+|{u3^F9HrTmRk=C9U=sv$yTV+Ob|+(f6WS8aB0O3+F`R zcWceAJW}&mT6pY8nH@dODFGQ1cixurTpEOt({PN-{qe?0>hp3;@C|4p{U&LsA$~mn zo7)m)6TDKUaPj`uQ%Y>`s$^VLjrxc>XsYC%xGT{16{>)zRcJY{_8P&_zIwt8!=^ax z@2Ba6SZca;cIB*URI=zoSJB-9PsFO{pL;!mMzoqIOiLndV^(THrH#RmZyp3AHy^A=y@{Q((K~_nE z(Pt9&i>NohV(aPoTbAy#;kjEkRJ7WAUr3rqk0irfvMY+q`#~%u7Y18*UvoO^tmD|# z-_*ABnqk6F%}K-8F$%Bk{)6AX>a!rhBl{1P2`zETIEI<4yBYISW1eCk+`lH`I=r5v zv9616WnzW1uj?fQJCxmR+6uzP)a#V@_V?V@IXLuQ#mM<@;idj6@=PwV*4{ z^Yd$f$=ieCoVZBnfJzQ;?vffG`sW7v=M3ZaU&`mmZJMm#KkFGnY7p6qfAM1XKW+HI zuEh>fY4+x(YtKJ7JQq)&d!xO*ef+2cl)9G+L%pbZ0hgXEb&wR?X$f4k++*8+8$^O* zV`U$sDg3yn6AbEm;lINaA;H0u>8UXncUrp!+taDlx$=3*W0615vl)A~QLB9mVOL%5 z(X>nliG9RPBmaN)j>oUyCVREY>?ABJS3(7agifA4Yx0kkS7U`0QVTxL3S7l{?V8+8 z!{*$7OnKHB7$8yb-kgcq#V2TKGr*o}{Idb5_=9zRzr1W$x%5NeAPo(E^m`D8HriP| zWuO~&p0Jl!Zf|Y)ynELLXJ%Rab1%DNF#6GGH+ET_X;+jLN`6xJ`rj=jdVf5)$Z>^5&>UsZDZn z)ASL@Ea-{d-ZUc57>RTim~>wK_j&xM7K|0e0~nOS=Yx=&Ndn$rp#D}VJB00#)QrMe z;4+v_w#EOmIfZy@Zh-X_m?XR2~Zg(25D z&i8ylVvAja{A#Q4#-mT4K1J|gLzy3a{C5MkyZ+LlAiQ3z*VfjSXm;1JRcOr^1~2pq zPTIiGkd2vH4ARV z+jI4mx3^~5IbRqq6KhRIMn?KuR-#o^RkLbG;rg~hgc@|N(9+93Y@a+|?Vm;&t#tqX zO9%zH?WdI_6x7r{-i~^3|Ng_kr+RuED!Q8Anwk_JJ$jdsnYjWkJQn=iP|okaA;v+T zJh=PZeVjZz%HY@SaYRpic4witn}VT4J~X(}g&wV{Fd?ZYML zKHiH)I1L1UQeoZZNBY5HcoHuaBud+b#>Iq%8BtGncX!kBSwy)nMGjrtTjj-F^yPCy zgSYk=`X=)cLi-rJrEo82Sf2HMbg5}+SJpQ+G|LJsj5<@KrK>_ATs_II(!c!f2s~IE z`^AF9d&sYT`}S>PYik(DzBV^E31j>KmqG~D-JU3Z5`qHjk$P4^L9GiHF3j2panA$B zrtI$S9)x2Qd?rWi$;Jj@?YrjBK!a^Z_s>pV11#}h-M>|^uuD4>HK z;uB{XooVLKb!e|90tV`WKfM4m#KQbfBm)h9M5Tkdnk?$GP=v5k8RAiB@8s#znMq0a zzkdCCgVxW!N>EU66pov^eWY()l7Tsv1qhA97ip%xLU>&^u23(ZDVn)DbO^f zXvj<#43)*AquEqPav2;y=)5xBoxzV@lE0X-xc9e~7IT~B^0c&v5ch`p`S~$@hY+=> zsA#%9(c8@2ygT1Wb}0-_Fj!n#3W<%y0l;ZL$`N;*d;|Ee zzNc5dT?*hPX+Zn{aokT=^m3!A<12kL-5f~poDfagDY^xRh8C4U2@;xUL8rXh1-Nt5 z<7>t(5j=T?h20RRD9g*o1BuC>IP>7a19;@dmX;9c0&GM)#%<@JV1+T*jYUwIw#IDo zI~EjT@r__CaTSY_nWVS={ynhcXTaN8N!cK+_E|=5(nH=tU}~ySrYSO`SDy!WzWQ2U zKV4i+&Q6N>qeC}rsbXhW0Q2HgBtgjx@K4g_QY#F4YHseer3HvJ)e-u>kNVut-&F?> z9t;i&N`!M>qJ>;kD5=l2!D}C#pU1`D^M;u#yS24tCX8?4UK4}RpFXum-L{1@Hxnye)=X zyv#x0?JC6@jw^8UzcHeBJOx&?Gxtdy;c6~EgK93&f~`bXQ&&eP#?{TOkK+-Pd!Fsh z7hhjrhtNL^@)6Lw1++v=tM5Hb46%1-;sHfcSvd|)ia4X2651)jnEaeB;TMv1`sgaHmR1aK+IWzh5 zlO94Gz-K!Nt^+J|lje`tXEi9Ure1PyfI;;17d4)L!KqbpUV=247*GIcm_zC7c4M*6`H((`SCtYnYC-tZMJc*5t7o7DX6>yStze`jTh^ zcyNAyzstHO#BPqV5Q;5h2i?}R;dPlb2D9#j=q4&Guz3Otl0BVRP*C8Pfvzh%1s>Zw z5Prcwt|wggsJS0_uMZ?(PR4y|-iOFI?U2}dLJz(#YDfgy))@Yy}YQT+RzuSW^b>A0VK z-ov3=rFHh~S&d?g=o>d~T-81XEqHSJv{_sa(OAYSN;b|-+V+v0LrCP;oor^amv3-Q z<2|H}-9+etp= zibjtV@1^NF6hM*;+$t53igYkY*JY$6Z#ju%ldJRnqBM)QA9zTIVm(~wCD?i{ISwVf zSo-QCWc@3`9s7B4p`b&Il&{fCHH)m;y_+pus z>Y?`;6XP^NQjt}7dLwuhq*jluL@*zwFx9~w^xRvy+#w|?AyFD{n<5jPk(QR`kg*@U zw0(XC^FR0sdN2PZwj|f#4wUnV>ypLG#%1WT`@B`LD=w^(jiI|Km8a#NzTK)0Yly5f z)0^l~)luj07}|2S&P#RwbX}rVP*A11Y9zs(EFW?3a_Kh}F0$$0?jD}!rPo|NwQ_oX z5eH-~Iahe9b#&CTvvvm+RSN1zUhO)*-Pl#B+J~>UP@JW$uI6>s*!te29U zT-^5{7R@py%&9zsrc-0%M&WJk)kYEG2Tn*fMkBIYrW)5Zbl|9SV{ptv-upcyKI7>EXa&wX|@?o_Bk0^DkF8 zS11_SHm*EM^6=U+e5G5t^=5FoII|&uT#%-%xQ73&Ieh|9wgUa{$12wbUD&Q%k%ObO zV8T4U01ihd*fPy7-YZuonRDclC-_oK2FdqMTGeIRXxPrR7|%H?Yb-o@eX51Qrt@aD z&NjEUOEsTlAVXQ*J(2CV#BSA$6$QHp8GW6=AUB%IGdu}ibEkn;x@TN`(SNmw)OmA+ zxVJar=z_;wYsYa9{&>|G#_m4>5zW4&uk}nJp{kLo`MRo4<3rum(^|L!!aBQI=Vr4P zHi*uUM%YqI2EVOqBtV1{tdLZgfi-W_v6i7$T7x!-!dr@TD@H1c82H#mUSS@%zfb?t ze=u5WCKaOkz$CyKim{a#exGQa2%*t&SrOfow~4L=!@}vSbva}HVs!Lvy1DqimP zxf1$!7lxnfZh3cZNNul*chKU=TWMRg_EWV210jFwzKV$#k9A9V=nAh!P=s)lCHU6r z$iVn#oYPbGoi1^j?Z(-o-PwbT_m~Qj6>dkNPfN6bYE>0SENgqO7F{mg@%1|?IUOvFS<*r|F?4 znd<2IMEsD9p!9$G&Yc3-^)e&IZeqkn~4ckgN&B#p|E9sE{^tfd0P2JQRK#-6{XV|gcx)P$Q-Odr?R$%|*h@1N@ z*^$>9#>A)#jo+*7R;q`JG>(p?W=p*&w3moG)=Jy5t?fbXJm*9+oejTiVLTVCsx9x( z9ul#7v!ZZ9?M~u0qj8S*$eN>HellBD?uX*Yqz*Ritg@`3%IKtTsxl_M6**bWpuye`2GngFzl`zsM#x&1i`hz7rdgp5VgF2*BJ;^n2~LZ^ zAE(%DTwXJM|6bM5J)$hxl-*Xb;mtcaUmL4cSyi1+a_b#waM$R{N#7_Z)%8B*5Ku}A z5n;?C?3H-+RaxVvh#Y5z`dZa&4}KN4-lWGsah^oa-K14 zi#^6w;{viNn`M`hcdb7AcuQAbD58Fh^uLX`U;wwLXOoQSF z#eXZ{|3vU2vVU$TcsmQMwEYU+y|;wtoV5Eeuj*yPU>^Q54o9QP^2dL9C^Nc_ak|Zz ziWRnovZfZSMvW6ooTQgssvb@Fk`GD&pp|5!_b znRG?SdK^+{^cuw?ga#h{jIoTy&rnY`eo%;UO7W&H7$H^JI|V^7=2q2URwbvK9}^%1%{C z9vYHS7-b)lT3uBYPbbE@9N&x%`JkDOrI$i=6F! zu*-TRhnUWPkHB`jclQTHZ!IhGRsL~r`Q)o=7EVh8@q`&jHKv^X{8^HW?T!RU?ILva zSypp^j2$d8z9X6YyNi9^MRB?Uhlui?2JN=I?a{`P48!^7SjIY)?Ltz30Ub;_#of+4 z`)3eZ4BS8lN1R6K_=5maGX~GZ$Iq|wmu+jbKq~OdZ0FApr~Ck* zFdx7IjJ;It8%ibBIlV!!n5w@u-T5?!AIQ z;Yokmra{1e)t-AZI6u7SP2EjrSrHFTE&!`>^h&C#z~nY`7{D!MUPBXaDH)!Lf+M-d zG0vB?wJ{I#)p+U#xZy0oXlCu-p}%Vi5svFL{G1YqWl<~2EG6KZg-Mf_D%Zy&Nz0wG z$_ffQNSo+sF}SF0d8+fkoaaeGscq`kYH{^<2zo!iJU{|ab{Vi>c~(}|P);iF_vBwX z)JRIl3TwmtodLD52dWu*Y3BlrE@>vebs3t*f)jS|z=8I8k8Kx3ATqiwe@Jcuh*%rc z4!KWh1pjzCsXDz7Xxjp;O<6@H<@4vefJ+cTuO=rc=@S?fWItT9YXGp?vawLj>8Rrn z5&$j;h^ShMF}Q8XD+PADFcExiBs;go?<~$EethV*P2azN2MRITr`=fT$&+}9hT)kL z0t1hQgob7m6o8sb9*|eWX#X)fjsF`kLTCT&R);9z+O)k^l|Z;k6xkoc(kv zou|;zwf6S2!{w;+^nfAnG40MUz zkPWRWDS5D#e&92p9U+jCl9a@RkSKL^_37@+u!@R`Q8-U~3tv~4SZ7N5I})%0sCY(R zo`T!PYIiWJ;)zqI90rz9&jckr2f05}@^$1v9*!p0#(XuOw;j~22HM>iMgcag;P9YInwQK zo>LR}8#3GRwo+V?Ue14CbAw?_2=eU(|Iu?5F+ZgcJ5LX7Zx!DzS&A}N3j$0Bp$gD< zMQ7(SKqBk_d;jRgqA|x;z3vC0oaxs3aIF`tdn0fBC(EtJOKb5u{=j_xe1wIirU89F zR08zJ*zj;1UdKgRR(L&W9~G_sRA5^RQn~=$(pl?8X<%uI)7|`in)asQyX2<45-P6%l1&l4?vGs)L3q=Yaxt(+VR$}_mEVO$@j&Wu#4$Ln%cuq3W zxHe!w^3)B3OI0ehXY{AyCc#diRLJ`vK%B zgd~X01ztO%@8%c-7;A8TIDdmZ3$3iIyj=p?p1&lPUFI{en&q{$qI`UOVCJSEKy9B_ zZ3omHh>AMrwz<$CT?OZOXTjSpZYq>w%Xye_;0riE2KiUp&-o)K5TXfNE1ZZ>Ra{ot zo%cG7j(6bg`|UFWjvcMheAv7$pH?zmiE)+aXwR}at4h@g8#<}4_`$gQsrg&2!7d-Sj6)cvG#hW;YVIBRQb7~dcq4#zAVk@Wuk5eUKT0j@cD?wr{t;+pm3 zlNiF>yeXFlp3!k^?Z&c_%^icF3E`XZ9?`LvM80+XNa_%y*nrys+n=zv&lV_ondlL0 zYAF_c+NC$;OtTWKiV|N#_%AKNo9OSC-i>M7i^jHpdfCM7}R?ad} zcU!}&i4_^@xExRa()l*{yPx^7gV=5vw`vEr za;7DvH4W?>eHx6HetwprkrUTF*$3bwf?K?#u?B4WSS7#uS*|_CvXbi2Q_GIj);al7 zLSU)G|ADC57haz5qkc-DZ95wcHB!O<2#k%5HEfA6n6ha*fEFWAh99D%qvtA?emL}9 zp%Q_es-rQ4{p87$-TINh+#(Pb_yKygv%ss!f}sR|mr4str$So_%E}=O9-Gzx;H#H0 z+3ohGrdI&36~N1606Vaw-#&m7+_(SWL4~JJf7|!@ow*L$7mVm>unlFU=6yv|puly8 zX*~ufmrvO|PNt^kPXaF&_D%^ydjQJI0=9S3kXa@w4S8mOY5?A>3T#`l)QeZz0(tJ+ z_b4Kq=KoeoCRAtk2OZ zO=yYaL(V~4mU=!ngfH+ussF&PW4bmsU}I<31&r+hBDAgY0z|*lK%jb$H-{&Jf}99S zn{N1G4p>*sva1C_*gBHi+JLwk%+AR@XG|#1OR%xBB1BUeJUI1y!>LeB3wT81O9(uN z+0vCN%Q#?<*GA)lVgLG2z>|4ps#AQMJhYvStKQP^0Ew2}eC677jLY07JM|I?U_}u6 zxjNg&0(*^`7ZBRvF~yA2+6;Cxcw z&!6AGo4NP;ut`xYFlHfPVaNOXKPDHD)&1IHZ(B|QG^6X=gho`CO$2tts; zC9*1}ToDxP-;DU*u)5*KKhr6JNvyw*09?WepdY|x1HK56Jh1N%uD-id59-)vGhFHxOH?lB1OlF3+)k%?tnA!~v-W%R$DEUZAJL0OnI1 zJt#Q~-oV0%ab1*fgXu&1?aNgFxGUY99*8yr?^{(LP|eY52Psu5ylHk;R*5H1o@kU< zJqg-?O&6>Ida?`f5n?LrH~(4#Q~n6L%*?RfGC5Lp8&3uV)fszTp%N0gL>tLt(QyqxGr3{ z^RIgVNe$Uxsgd7{HWCD)$9W;ypHE_9qRz8ld;g^|Nw9hThfV;8O*%&0YFi$-sej!c zkmof4s{(W)X<*)+1&CFtFqpNNL!f~(J`TwOAXij|ult|7oxoM~_bw8tl~|8}O7yaX z^Y6DTv{4fyBZ-ikW^uAVGb5w#Hk zKa3ngAT;6Nq)6aIEv8EsTS~2dy*PO2P)KyNHcOHKKR$0eZs*o-Q11YbkGx%gN~hx)K63*l!gecxg1|M)3;}ju2jOd#?z)k-mNX z`hbCf0ibRLAedmub-^ZDQr4e5fr7sbR1D-EKG#veaazzh6G z3EZ;13LSJKEu*~%B9Y+8$V_l^_$K>+Dg>6*d9HLq-^hqX0^o%*n=v1V>oYPkAa2T@ zo;F4N6TD0ns3&OvPX%Uj$^JDpJsSi)OJUjB<_(p1pevI_Fhp5_&=rUUnp?eaxRMez zFl}W}dK}ua1E~q~Mg}}Cc%WmWqfC(94*LLV8xe`yn*U0kAqs;Rpa|Yjbejb?t^LC9 z2TQ6zXLUmb@zpXnxRK~FFo-PZ-~92tKYqwqRxG>*mx&2=2TqiI2AW{q>a7)=W!iRL zULJqvsIQL?;s+oH=gw(PEx9{)o#PSy@>pXXglf9^K*Byyddcww)!CYk%e_ z?oSYyE4hcOT#bPFcTs}hX7mk&sw-WJvIABgP^SS51Waz1AakJ9Vdj_*zMO-d3DN8@ zyNEBJK@JoZEq7Wizbmvl>m^8$wExkDzdEwq!EZzxjhDKnmA?^ki;7CXr7z~0Ep0&v{vi8EL8YxMjtMH z0_Pt_8)A0}Fb^tVAES@7>ivQX+RlIi*A4>#upfgEq2iMcXwGhbnFop$q!ZA%63~JW zD}0nhieSW*72%*vGb77>maSq}AEXf4IQR+*~J(J=(cRWY6Cf;^q|RrKo|e=z;ST;nRkpUkXfF*0EM)%ft|?K!D?%05X8Fe z7)R>;I>E38fA|nzQgVyD5a59Z=kw>!Y8#+kX?ulCr=*ip>9OO-Ikd%!!LP~&Vh?H3 zQD_9aU!m=U4Dg%m+}vFqNP!X;@?Rmc_qyU;6d2=VQ0$n(VnXP|=ej!kjoD&ETmjfA z3a}C6Fik%FH;iI~t!86&_GUl@Y~oElJv}>(4(|g^D@I!j;%BtsLdcBmNRohv^gS%@ zovmI}=p76N-{`~yi-?E_QeE-#s(AdZV{8uiaH#^uN{vs9uq!U|dvkLaBm~+oj!GZ~ z91QAoZ&0fhbo^@erx|HuN>2-)KZEXwt_Gvt-*y{h7s^UXN&?F8X80)}a|6?iT!5c? z0jz*!Kso%Jo8~cp2KkX7&cY%GNfi=SVT=RqDB>$6TP+`T0;tVaGb@&fZ7JnTEF~(N zeDyx7!R_)!%c5u_|Eo`b%ms-up4{q~*l|_~5$ z3sY=bc_KQ+i?w5q;-@Np7m0a}1EE0~E2#mUAyE^AJB$kOu8}pH-aqs{1=Q6*2DA?s zLR50n_H!D@vnN4Nil5Caa?7qKyO6T^9S1-M76&*V$EVDf=~5r|X{Mv$Wi}M?m-KbXrP_ z3V(2tP#}MpA=!5^jd`Wo0%Nszg`g{NP)VBimIcKjWY@j2e2BHW%9)+@qxBL#wC|aT7s>KZUvak68 zML*6aw9-tN^jk5SN8h}Edp%6)ibNhzgCgeI$Fj1ec85IcdA9OQntssB8A}X&yhKSk zrmPyQZI_%vK5RLATjjBZ?sl1UA$DeKOIhv$BOm3`I!y`x6(QVR_-nE}SfSfBNiI7v zJvrO8br&Z0+-n&O_YpuGK>BO%zoSo|9%)-_C4v0cY)iPSNnSI6F4BYwt4KF^^Tv$= zqgIB>Kc5eQ@2vXlSqWGw?9`&1`2ROrCnGa+ou`AQU-gmUTT#BMF8MsS-1f;)#B+Qt7eQ9B?LTaFXbxOs64 zcdyjh=3Zb=GmTlvufFvgWYy-|Au3Av@E?O&`Cm00(k7=P79vbw!M1PQyge!V_H>Jg zj=*BourMP>32yu^F*XIeUlH;mqX9D(O+~Is8(65ysSKQdhzlr>`*^%wjH2kt*c3l@l!{%p2{5L>Lu`f4vQgr1u4^*L<^^56UKpHY#3b{>>%g0r`D3R|y(17c?8bGrF9Q z(l-<5zWDA`Sl^2;krq_7T^kz>1NKhZYc!&JE4wE2>OX9h;TY$MWfmnk{K}TK{j2N& z6@{##tK?4xpV!EQ-)TqdcDvPAPj=vq-WfP^HH7%)4wgJI3?j>y#l7y~6k4HKBb+Ax z)+Cerd`TXg;gCWW2WIXwVO1+n>wzCz=1Rt5uI$bFFU#1{%QStIX-%wa#`p=N&-+&M zG;lI&T3sFVy4WdyoO!3zX(kiLPDevOz?IDBI;LWLiz3#WOmYIAUw`^#KegTM`f!Xidnn$D6h z#(j@%a4n@$hlXzF%<|~6Z}~qF>B{J%v^>!=Ww zf5rBVX@(qIbxS-@C4W3taZdi83k?sE8rYju0zsp&un;{gR2QV>nf8gTaH~TBVBzE1 z-9n4sE}@?{D*M6x4hauul>nD`&Ilzs@yz~*#*5?MkPllmof=mPOC3;ew;Jl4e~H^&GIi=`RMh#_BLR5 z%eZY4juhsxe%jvNeoAC(L}VGsmk=FrGomQ9obyS+>UCA+Qv#)U?(~%q2|{1L0aj*v((O}`{Is=O>3{|J{z%IOpo<*f zB1k%h!e<)czj5{NrndKw^Cf`eCL=8^9dW~;@g&DkclYJkfYhttu}K*-&|uCeLGl<0 zK)(#+PauID5H+TzrX47~3?z8zSy_)za^6{};x~~3 zBHI#s2-Pt70cafIloB1_yey+GEwzf^0hK~d*nr12xeUTlh+Bezje)9jM2$i4xu%d7 z54>n_6$N)eD%)WOaOrF0U(+z=04Qey&{`lUOjLQ(zP?3suVQR7=4HaX>9oCc##DXc{ zYU2g|{?t$e;VwgfILb4Cp^bwSy=g#EP=+D6!91p2SC(|)$ZOBwF&dA*UJ%O1gK+ra zLBRy`?hIu>+JPut^)!QdRf7`tOMWpiF9!$mPhiE*t=XZ&|QiE+XD=F5~6Lu6WN)W>o=YL{`oadq5({kkvu6*YVg<; zx77f6RL5nOhdixX-Lbj8WWEG9J`8GU%y0@4L!ce43}jjN2FqcX`T6hGyTzm2&#$#)ps13PARzVOUVcKM&Ikc72($X%28=&)eAAuAmSQelMGoR_~@^k`MOjVPH)7Tu0GF zpn2zEx|j+nsg8TG<|5ez>VbAl9u-Wi)fv*3DzSk~m&;#gfB`95AHYV8E<}eh`Ms%< zu2N>b(0O@ktXZB-`+XNK@BT@G=J~(AEZzfn*r7t_{__7Wd$;CiPG{379rn*Wl|n6AK+PmrF%~!vMGnU$0<-k_gp~BihFm(iT%H&99^?3 zTeQcyS&!HR6s;JWDiqu{U#gY4SyG1QHd(Ddb#u7Phn7e0(Yv#wV1k1c=dR<=vi@03 zy-KF4?xEXTyUOdx+RLL<9$9tB$r7%1()+C3mA09|tEp~eX*Pvl-JqM}hVH6fp0^&j_W9&-*Hi4;b9iy~DO zV)tqKiQt)O@-ep5{zPc&*Xf$jMsn0DM={HTGM@M`uIEv=tjS4n>PvadFsNdFvB{!l8iNvuUfhN zrs|>fxa6uC=BE^Td1_(Y*>7vvpzzbtVuL-ddi3=U>@*wP@T!@n79<>v`<}#_m%?qv zZCW2y+bunT$si3Q0M}{cujzkTq^+8~WyCw?c#>zeG!}z-2_g;5Fzp*40aR2}a7*_O z&QLso331lKmeDHxPwQ;u4-b-egfR@PPwd0PPD5wDwd_y6J;or-ZqB>$g6={&SL-9k z@RsQfHecnb7fiDjBpH`T3LZj_;T&2#3Zufau~Cz}Yw31(0(lu{3PSLNRJ70xEzRUj zZQem|POpl2+yCJw^4ea_rZRl@R(>OV=>l*RZKu%^z}EmSlG9f-AVO=(i=PXC7agd5 zFGO*!9j2H@*$7tiiUZC>fmEW_7iZTOBgKnNZSX&r(pXpJ{%UnAG?}l5_L*0^$ce?^SPd#z!LjpK?>?Tat!r4;&bzhdqZDcLrRTWmlt~hiBr?oS#SC89Fu0j5E3sDuMmcT;%cMGFs`rv(mf?)9$Z?{6)VnH#R8_Fr0yV3v3u$q27v zOttX4a@RBU4Ok!ca-Gze8jfLT54k$cZtvF7*`LI=VRg{YaD4~UMFJ>;c^#Y%1 z6@^#s-X5&k&A;nY@EUvffy(7-ZL1t#M6LMK*-i_yrpZ3W3a&^RhX_8NEH^?b^8;@; z85i9mp|C8IiRJgEkg0uiA6!ift z?WG@z>gwr`xi{4*D^mITGVFU^tXiunPAI1ogP}&1aB7~ruja?H0{Z#8Iu`N;@#Sv- zoTQDDg^56YF9@J#X2%=t6!2$Q4vDAX&$<7U+qs9_82Dp#1MF z?0g!vUsJ=sX|lA!x!aR{xh8m_2*0yjhM7;e{-UW_|2$xo_+J+wy5Rq?O1zE{^7Hb5 ztGIS1v&sx~gFtcq;^|e9mPREzl;q`~xXcFY?X13%Pg?TEx+PZe=mSN?n{8tUUvCkq~kyzv4^8Amyz;4PFS z*y}h*y8yA$Z&3_QA+Cp=a0Ok2;R}K+EEJw~0kZ>MOtxk!L=ZaGnSYvcOhoJ^-veow z3fbRCRR+)^a6d%bQXij#peXu?n`jQ#E8lnzq#zL7aL7*@^cVsMRX4ZFb$4L8lm75b zpaOLh+C^sJJG>veY7RFZYlhMup#%sd)*@z~Ndi44kbpfo+L@qMvaS481f%kplSQH_ zjBDP0yR)OCIZtg(G02**-8Kp`>Q9#jI^9$~%KRNoZSDTRXZ3r;7vL{8hm$dR*jWmzD8D z>7NG>mq!S@mBE-zPfuUuB*nwSGw#rD z;rLLOgi^PGKo}PUdI&@fr85G|VrqOnBQ~XXi-1E+fwZ+1{+;<>b6Y_{;j;`QpfV?M zOL=!U0Pb%|SqNMPF<&O&6s>IdWGKm6R&qq1ZV*{9P)VoM}NV1dn;Bn0+Qie)OVXx^dRJo_-bR3ia@cs0RI zV;w+yn)R8QoAZdLAXXc5s{zUsLiL{d-1+XVu8$l!TzG?5t0a=MrhV1X&qF}EzG*sh zVF`4XdD60yk~bpV=|F7q?Dp5vr$Er;SIRtm_`Yc@Z&njRP^R!ZBuK77k;=s0F`*DudWFs6xc3f=heAC%aXk(G5gy(=dz?R~?@lxp#!6=@)K zz_?LIUEPGZ#*wZ|(Q($T#Zn*6UYXIf9CIkAbkzh7=1@5YYQl2~1QA5gGIc>>XR>r8 zFDt~d9@`s3CxOiTgmdv&7AU~OLs1l|pQUJC;Wbmcu$!5Q zX&GBJ%sfxQ0Svov?7WZnRP{MTTY*2k&uwQz_RQ4V<3RkVzckUR3Q2XIN?L2|1$1sb zm#B_~MMRjo2x{iS`+iw4i%UxbGW1StpNynr9@YNSZ>_K8ERT!oqB}d3uRv)gLdxkA zCl3D|wt^H&1uPc(ZQ;o>90miMzrWRUx40Gdg89B;Sy+()f2*#4(@Hv0Wii0t5`I%0 z#F~n*K9O-!Q0Tyo55c;Gsc<8V=x1$v9t_N=wGG8DNRY}8xy->K4W51Z?_GN@e*gCE z8l$h#K#$*GCAtm9;uI)v%93iSW&%%)!AUn>We^&J*V^?A$IAi26ClkAahA4o{iV*NsZ>BZ5ig3xbD|1Pjm^#H3Kn-^IAtXy-ooD0f(I)N z#ld=Db3j!dI5Y~3Yl;fZdT-b}I!5BMhYkRz9hd~_WSXC=`x@a}$Zim|-$knYF_P;r z&^21Fcb*M|91f7XnUF~<6nPeyGlyTUMm~b-4zs?HIV}fsk*pBKkocU9eW{3GoN$4*7^#gv90A{w>r@AcT|8zNP_RRqx( zXpz(K*u%s^DSP{snv=AceFs`bENvhkzKp!uR|rrXQTqf2!z2Ov3>9E!vwOCtQez>v zHy=2q7^2#ZTk?j6DF}{vPjJMPD9d%aAA0!cQE=--&8a3 z`9OPnd{$Q0d-F}G=%V80=Jw6Ok9k?lyt@6XWM1*LLt8&Is$5Igg)U0KV<|(0iEKgi z!~oGDrU(j!L=N%v%o+5|e*7T0n#-z`h z?B#9!0&&_Zm6-MTcarNF3Elz|!1}>xYd0ho~W_UgY7();voLL-0LcT9w z?k^qsp_Wo!t_f0u1AVH4&QA>b&!^?&@K)dQJ0y&?EdVQ>o}B#E;ri-MGr>AIRYA6*;#4ElhZYkE-g z0O{YEdaEw^kv|tY0`s3)S*ZdG&nH4TRPKBkWAo0st};q5PDocuxt1VJe#PL zl&@iH49E9D?q(z+ftRgO@yz;*Qw}KR5_618p`F6wVj4B@_r3IBsiToR#ii4aOAQ4~ z`KM_)6-xX*cI?Z9<*!Whswr3oge_{`d`g`XH-;KyC${)GjvT;IP?Pwla#>YszcBM}P&f zmm%j13I4pS+oMK0O<%i97NB-!I(uiSbjsz1HT>1Zvxln0*pGKODj;ii9s3HNE#)

    n#EUxgW@WWH|MVObluy@lI`Zw{RuEA zb)DeN8zE!OeiYVT3fBA+^CX=D)}2%uBkK51f(@O#&yyu|N@*YE`zTg#a;>duUp-CM4 zg@1ln+}7Fnx9N;A zZ*fc!F`YG9!?Q7U)2%dkGt0x1qVx{p2~c_Pq~g2^aUz8CHi^21)?sV%Ca;xLk1W`Y z>g?W)#lP2(EE;*PD&n0yr(%n8{r33~jlFGaTDEE2;2NtJt67UJt~+-+rsaDfWzL|( zN@_Kta$^xYA@n+u{|?>&gSo!s!?VWlK)*5~#t8@nft|q7bha5r+0<=c-C9naKU5HN zRn<8E?)KNB6e^}wWmT(&FEx>^sKdsWDX?)?_2FdqN?L!yOb9qM9NPse?qsE4wK}l- z*X%feH98wj2?3fcof_lbP%Kh#y{a1-aqKh)bvT5x@+3IS8dLN`>s{bQXqS`A*yLJb zD$C}b@}sTfBSM4G(5BOHT&bYcP`3=)uP&O#nFJHmC;ZM(l#P+m(3EG|GJ%wdPHaEm z0x+qI$bxBuQ*lxuu@E=yoy{a!6^<&DfOM{zpDh$_TM6FQe^UrQXr{pHzeeHwLgvh+ zssNExjgpgW7!aAoi`8O|4z^vg#;JEU;URCVb5HJJzOAdvpjpd8^Maf zXeTX#e<*nE_rlpa*F$q`>udOOqRa+;3{jf+*qHlUb!37KaE2@}qbxh3htY6iR(d7I zow*x+iYDVL%Or*vKiioVlybJEF_Fi#TDEs)4DGGb-gA1%nS~ou68^-bF0cfx9Xc*K za1oV4Afw<9)pfqZx8GmAX_$Vqj))?~EC*F^3XQIWPv_sP~|qYf9FKq$CGKW+;zqvQBOn z8Iy;ICnc=w-e-NC^gN~Tk_OXT;UL)Kb=#>-2op13t>d@lUcB#Dq@r(*k9YZS;>H^X zachHNYW7fhNe;hfG8ne2bvo?njsvOX;s*ld-g8M3j9U>>gcQ*^_0>~p$lH7NWlxJf zW+n|yiKf*WJAb0)DPd=1Zr6&lgIDCvZ6_xc^0+$g>zr_$&Wmb&`!q(Urs^WCcpKw) z_PgQvqQTg)0GzR3ml<6@w{aA;Dckg|BQkMnU4}v?3kh6_TOH;Cw@5VCup;=prs9n1 z8c+Ys(^$L{^=NM7qOM+u>Ya^zPSNJs+M8YDG8JjKXqxx*)tuFgq}HOW^vEX58_OyR zF4yIbzLV+Tvbb}@w&q*#mS(f$05uDVEB4uT4Mym0QQg%G-Y5vs z%W$d13eV`w-#xgmNTp95-wONI8t+FJ{CuLouJySW(RuNhSjf)fTdlM1r#FignT9w@ z5!y8c5H^XBb5kpJ3ZfB6V7V?B58IwuiM&Qv)Wx>wC;6EYd zw78FVM0S4ShRTM6)T47P8T9NuE{<&HE!Be<=Cx25tvi#cWspj>V9trS{g2dsLU_R^ zQBVDNjYrFnGreN=ipi9to1xIQZOSB?Rv zjpNViiXgDvg>oES)`&zAv_I^06o^*o;*3TfuwY}Rw_49c`phm;wws5OzX~)gwX-59kO|+uY87*KJMJQW z_pG2&2GhXJX`rbMo|O3qt@LJ2Cf;}ZIfLuC-(I6f;$)3&df_~d(|&{HU!9wxGrCRw z=Fq6f*owatbXxAh4r8b2Ft&_>EJ96{HhX>Rn{KODcd|c75%G8L%oH^aS@Z57VP-&t zM}IucX}htJiVVJ2dReetQ~W`{=n2cy`B+Ag^>@7q=$Y@d%?6KWZgQNlU(X^pWm^;E zDl-W!uzn^m%GPp19sBSBnE~Ih%Oq0%V;uXkXQ~LPR=wNz)}M+B0rIdyf~amO_k%_K7H z)3Px3tKI5D)1~u5&wNG2dnV1^5WKf z+$erjM2DsbFB33*l{MDBxEGaI+&-s!^7q#PpXr}30Ph?yHOmYXVi>qb45L@gO&K2z z7RHaY>80|en>qikWBEhI&9DrFx)F6dopvb8?yBx>K{p~2w_gp78~v8}kbY+mz>Uj2+R z=9_@UNvm%AX|%rI=5CI&3V(!s{rgTnGihsS&qcO(J$*hO<6aW{Xcx0yPY`x=G{oD5 zpZ5CIWcYkMef1ODntntUoh*sWr*^FboaRK++mg54KltAFY~2ODBKy(muvqJ#*0Q}Y zJkjj-DyrE0CLHTk(`!Dji51T??dT!^N9gO?{YF3fIJ0H;#^o$=YZ{r*OGUiqPKJ*7 z*I*tI=kG07*)_s~+2D1aCf>Xw6$OLXs42^1wlcU70s6yI!Rr@S%}<*=j8LPQv4)@}*Z( zc1sxD%UGh9HGci&H+s}<9LzMPA4Ffsycnnb%JxYW}t3)t{=u!v0`(T!9lJ>mOB0G8lZt;5ELq;&C1tlp=q8 z(Cl!E`sTUPx|`*%AE>8s%K}w9pEo_ZZ0ASJhcXtjXJxC}YYtsDwA5}*_Upu+U@NaU zxsGglbsq}8-BqueI>sv{8CcdvSNoolm0fqUR{caf?kDLHF7Exj(0Rbi@9J+cetl!8 z`8|v4$+q%p+WclgxY|7)ui2K%$#waLr|JVQ{LPAfLeaYU)}i?zYUa3-j{*C)mcSF| z=G1w!T{mU{@9)|9Px!N|1l@&s9S0}Pg-1zjuMNihWd7mWkp88>9+7g;j}`D%Fi3mA z=GKLxD;p(-W46o%)pSm6wCmkmU{V8{N%}5C zuG<91mTR4VkGDRlgef$yS&h&2XH*F%=x`ekcUMwj(IJ2HC~+HZ;G4Mq|EN04uqvZ= z-O?S4?pSoQ=19QD+$M+Nz0|_l1w?r4Tvp%x+*{_zEzIy1MCbAP7tKmB zskv-l)gZ<5a_cmA_>I`K=uIN`(n%A(7`IZ)%-0|(CIgOd0RcmA354di3(pmtxQAVh z@txi?4DH|BqfQ&I=iq0>X#cUNCw38K(vk5}Bsa8;|MIVC=9_d&M@9=GKYue4<5K?02Nt-YB$yZY6S&ewaBP>&uHT(sMb+MD{T zZ)fP&;vS_cL6RZAhHEanCNrN8Vor>&p%2tcTq`zy{PY-3`hI_@{RbHg%KERypqk08 zBjBv)#_DuSO@`HeIqR&Ne(5=O+^en{t#NzpYA0PPMJ|bD4jlcCdy>;G!n9M`yAauW zNpHWPt)7T^wQhUYBmQ8w*jy#d8R6hJMIy$W0uEe`zT%(>4`f2whiiJABy_v z_vlw#Sw9*4%nH#!ar${%(7%=mWxK@!pLMNo22R*_(!;2O#4eqS36{|28hV=cMbp-P z4)O)V({Dak4~5#NrWw`pF68EDDVdTEeu`=5o)5Byi==!w*N%h?6El${xeFq`w1SE7dS z8ODD^erR!g*GVbO3H(lo+Q{!m@$u47I}f`tr0pO|L&+7;LX+pxiP?P%sU-Yt6X`>R zI$R%bd-O1WENnM2!YQDh9!XR+AqwtnzSnO2^)5oq=e*!czL6&2(NZjp0=z^BR>?F&Di7@$#KTNFLzsj&qGBIedc)qnI6;C zujPXU&Ek6VUTO{`h4Q%q$f#C90n9cK1#5xryPDldnaT{dVp3QdQtFiXhw8)4;S8Z; z`r9|C@8o~(*f&v%`ivuIiqC#s%)JtjPWg_m z!1<5-EFNdoUB=(Q=O?|y5~fE>U3960S)8YNF0raO=Hljfv~@kyQ{hOy=Jn6Iejer( zDsg{pm~Sf^!QU~YVi7gy{(Ja!vVnJpTk?5Z$ED|1&yQDb6KV>_XPP6%{ zoql%Rxy`$d@=ji7a;|&a&Hl+d?zqGJC#}kFd|^4+kLh<+)P?fS>HTomSLWsH7c46t zqHIG{U+ZR+9XFG0Ke}j+B?K4`383#f6Q?CiF8 z8gFMWU;4?Uqigusr);!(Bym9DTjaRme=`zOE~KU3LF6%)GyN#oH1fRpeUQocblvm? zv&(hz#!q*$}Z~Z1UuaTcC|)x&(ia^Ol)QzA}sBNPG+sY2d?-GUN!McHX~tr9QwLD9z|y< zHPY123KlffswT3_@c8|xW&Ajad2QZ3n>q3^@`IHV&UcgcUn2w0-;6ejzPlUip5(cO z*o9V#`7Q57bicvfKb|RPJwX=9gEQ&ZZ(a%gXeeuD-2#9}2ox((UVTulokx_lQy8>QjE&sJHmC zHRK5VtmCl{oVKUaC#|@`SEiD>wZzsi-5BY?4`!>w11^s zTzgIHuL2du(=vp1&D{kKYs1pc08{5F34|mu1Ck+6d-YIM00~eI_I?sNf!#EhMR|KW zarZ^1c8S3~6&~X(of?bz@!PjD@)S!AkNvnI?!W@8%wf8q{YZ26D~|WYK=PyzZ?R~| z?&3I*FlJMV`@0XuV1q*(!h=SkV7b=!heS-nF;w{&+m9(OF+1laj*g}S$qamHnQ>KK zicIAmWSPYmnct(f*vP;dJOfQ^Jg0E3!ECC^rVNLXG4aPyeC83;j;k)ldov+dM)k>T zH{H+jF8zdqs>7VGT@x$=T7@sBzn;slsrt|3i@84Q%73((-5GAX98I(yrOzgidBy8e z#doeha;Do=7-vFE@=~qmxycBYpz1)GU_s^`9D$*Nx=g%@tX9=jQZ=LV^dJ6bq}i~Y zfp3bH9=xH-etgYSMZWWTA<6sPpb%ODs-Im z3lgge;uM|3>Fi9+j~}C>r|}`sxh&&1FDv5Ms-UUvJC^GqA|f-qyp+bDFj|ZyJc}Fky4A(Q4mCIMK~8Z-yP)H*a$S(U&;jBH zFN}|c5%AgU-!qk4@Gl03F6@5&Cq=gKTS0!8?mxdh_LWa8dpzw$;0OjSOawt;c}Euf zl$R~d#N|~EIwna$@kkN0Wz!Tw_xIl)@4+f2a!Xr{g)}Z|eW)7-9=`JF$9SKOh4a1X zw`i5aY)sMmGmSZjQ-<(gOiaS*m@(&$Clt7#$jHYKC9l|xd9YZnCzu3oBnTV!C4Ue# ztg}_{&i_#!gjsM0=OFoq!JsnL{eb&b*UvC5;l(ii<7dUJa@iHNIkp3w8Ncp?p6!|4 z3K-uOY8z0NXgv6=qeM8P=l1A(DWnV+a(|%}%sp4#t;$sw+B+~Ak6*XUYK_{Eu$_qD zIUB()BYAgXH|bgl?e#4e@%WlZfrD?OB~B@1z2e}s`=_L7g>U6OC|xLLGA_Y+ip%nBM!r~urrOs%lu@)!l6NBgbK#R zpstAXK4`PqtMOlrcYd*)x9{0G_^~yJ7Z}!#qyE2flF9w5d`~7CYlWJZ$CTH?L-pPmj zSh!l7SDmCc@rK7&WN?g9W*_Ip)6krf|57|7z<8BvPL^ekJ&%>Sc0u!(m3KMlX1AZu zijXVajB`&c^EbDiBDo?RLqFp(TDoqeeGU#LD~Bo#H!I(re;OLJamQx^Y2om2>40oo?Pv*yhv2kIo82Lg zHdNHSOQMOtFTs%)G`ny7(uYBJg5bvkGxc7uzB#vnww{E|B#AaL8e72}q6w#T;k=wm z;d^cK-eHnR6t%&Zs?^;E4$~&xBDEg^?c(AIvq!!l9>Z)ESonpVf1RHhm70k;ugjog z?sYNOFuq0dHN_KQE1z&7dWZf@zcshdSBv)pROMwhy~bT7pR{LuqX`waTXht_mdOQf z+}eQh$NN;66?z4QN49F>BsO<1?}-%C|Nbffw25T!Px%yCP1SoNMR{CM^fIk6(_7#l z^+;E_U1!Kz_)t8|wo_q~!Fmj8h_~*-_4$e}!BibJ8XK79Ai2Z))64m`Vr{3bordsF$uX7c-Re_aud2|f-3;dZ*5FGAg}+sbZaVUD~W zK9axbgOFR2dkZ-8Hg+LMrcyW)x9*=US@tkcl(OST!z%nT8e#Ytf;^)Z}}-uG}DJ;P>LBhhnZ% zdei@YV5se#c&OC9rBo!w%2?RSIFpu~rsZWg%Zatbm1BFugv+c;sMe^T@TY9E@DpP$ zAy%qjO@wX)cbekEn}lPPG`4qHFG$hCO|{_~?*g7Z2&E2%f3Z;z4(eznO=7%2PZu9j z^Xb`@B4hB26wmC1qWT{!59mmE4*9yA=Fe*`zoT!Roh(hWc4~p-5e>T}@o&otd4*-? z*p{ieaed^oY2G5*yM5$+|2wo?W$R}U z%8kJ#>AHD}{rY3@#Zi+&LFZF;77)siwO@jWcg|vlep(X>qDzBV+DNV+qQ9?;;E3YVCk!s~)>-;#2 zr-dBvU5R$o;^Jc15~+e6KO4>0z7Y<}`o>1XV~Y`zmCP48UkLwh8F|&N3XZ*&r|UFJ zkyB0{z^WcHZ+~uXj>~s7JD8dP7wD)*fFyu9dNk_!DUu);8ymZ31h#frQU*94IurP4 zVzv4C`MEXQRfh0ZcypSF%V&8g{oxmpE{bJ&P~qHY-Qm|YU0tGU-d1q2-fx9#bfPS< z1k!onNNUZ2$e%m~eMum3gI-q0E<D zBqeSTEZG|8YJCyp&b-k0Jex~{D-VsLrT|i&{Z})wf_K@Qkcj&Id1-Q&?8p#uWksr( zxjqxL?v*5r_tTr<;pE)FWAZwP90n_7y|j+UNA7>E7>K1&9Tiz>;UxXqv5G5AT{O3h z3R}rEFHb>pEEMX#A)RQpI#MOQp~2Kf_tH46hB#$Rn?1Z{vLYkRUHdgs{~_I*6iAT; zEot)5bLQM>cj|PU7Mq*IofCK%5BXq2cxFDR7MtqZKc=fz>gINJp$uARNGvhX+waKg z`S`d9tE&%q^CnQfw?UHUlOos@=4sN&r7Ys)l5!BjPrbw*j`jP-GcI8F|<3#%c{Xr%-`l=wj}^=HeM66Ne} zFU$U)oL#&VqmjhR#_ElEWsJ^Z59}<5zG{0V`3<{{)%q9Rf9<9Ik)c<1y`hy!meh>f zla$vK2igJ9S+M}IXwVv}=<(P=@#?$F>PUWd4D zZG1h_mq>p&u*_>h6d%FSk2vrkP7%?0z*ZQ8p3!MK_?Ee+?SIg*?_M2fDIyfG+aU=f@Qws{o~Nx}G#64+Nz~+7henEP_8; z4vpF{8wKkn6s^9M(kfH40LVneCV4>N7|x z$Vqw|Rws|4Yf3tt1c)oJL`??ijz>_YvI1Us;N3i4Z94#^y2c1}hbgVBA1N;xF$DM7 zzAPq$3zp00Yd--sqUm`7#AdV>#KC!ysS9*V^`aQh=*eCSYaBvpU;444prPNSxbJEY z2Hc!&34QZNj9i7v7a2V1*~65andMumgj0-V`=Ku65HBc}gmvE5Ad8cA|i#xkQY-%}Lxio3A#nkp zVo5C(5_I}W!MR?0$^m<_Dfi2g0PUyXt%&gKzg^^KVH_r!$KKXn85x&(k??kvypC0y zXa)W5U%*>4;<1Qb)}iva4xW zJRemRscMMzR1saErPDv?Pf2wj^X*I}CMJ$EGki!jNHh};-hTD{_Mz*2J_;`R!&3e) zPO}cuU&bc#67M)C1tjsYFArC3r`L$$;2U@nmRF|ebax2#nvuTqAl5C)?r?*a65>6Y z4KA$k_c?&c!rb#_XX2Mi9sdad<`KVXmM4oR+(Hx`NoC@1=<1({SpsA1Yux&2hxWBK#r$Xw;pYd-bxy0 z%C0ywJDayKeuymJg!W}KC3}ZOKLS7R&^!b?Vr0!y%9SqsBvw2IyS&v`5K&DoPxB0& zkhg^Z1qf7r1s#Y*;dI2^BO#&4r)A*Td-7gz4%AQw)BXg(#(K;!>}52Lcq)ClQtwhwy;MLtMxi2w)1^@hmP8Zv=GZsKXnEF^KF-yR~9|8 zVdqW!8Ku|`e{Puz!@`oDibo_K==)|dktg6ZEBxxpIZLrEz!*W(Kr{=&F=|d&yEj55 zo6Lh@o|EIBXl!>_&8g5GO-{U$!qd7ogCLi0?mnD&f zBtAWqhm?I}Eg1@7%`+xwny3{mLZU&J=d=BC$1h*@D-euo`S1LZ!a7{;^_zJC$G}NW zaXH-gxj6XYJeGz^)ctHFtsG!Hmezj-&9?mt8(D(nNI#IzzY{J+lk`yZ#OTyLjye*QQzKh^Pr{olcUAn#vd#ta(S+-ah>kB{?Ryde#2kB%*!R*hEGkVlljqMR9A-)ECp2yJaN^Ea`n%;&up8=YQ22C0&-#_X$;7OFw(i?G zpM`X9zEIPF{9C``Q+6XFIIop)|JY;jmSq+EWXJ4fJAx-DPT_cWb8bP}=nRL|z63gE z7KmayBbI7>e@QUGY6pUjoaR^VO|)Nv^i*VS@Aq!52U^N zw3a)yoj#ywdqAKSBdu{_U%$OQV`eo*l>T!R(vHWY?@rZ+64c)e=mHED6awUUla31S z0NZPtP`^eE<89i}LSofHWL%EcIUpotXg%W4Iqi1+pLRQ4Oh+^!5z&1Uh){QQ^F+(Z zt_j|e@=Q>@c||P*JFQ~qu<^h2`fe2$V@l#WWn-5#k1M~`GyFW4f>dwJZ=4f+en(wM zQRera9QGT7V*)BW9a(g_`sq`VgvG48#JiMeM%VtX2^Cbk{g=`klDV4g)5!rqof$^w zTFGFrE4`v(iYvSGO>0DDe()!8@<#7CKImZ&c$disU+k*12Iz*yxQE|m>9{s-ICYX` zM5MBBD*XFNeC-h~NQUcxlq{@J6cvz^ehbeD!>W1LJ)*Jvo!$0Q3r+ zV(O7=#f#`5TWo`o#f#Y;@SXslW4p$-N7u|DB=P}aYbb#s2Su2eZ;e1;TMmB;eSo(% z^Ub}=g{u1BtDlMR^*H^bPR`Fh`SW1a09y|t_7WQU?j*fkEi&C|Xn{?m@Wlv)TXW`RbEQFj z>db2R9-1X)i~7opp`}*@v!w-hOG-g-fuS?SzHGjr%YgWaJQbd{A^>7QklNwxE6Evo zN!2NhJvbN?M(}5uxNvDi>lc`*j2etr7iayqHf}2u-(XRm4ZDT>`SHhT`D;^6(62&2 z5>8|P)2Y?WHw;b(@;N+SuA+}Wc>$4G9rwlxLS35K(K7pn>xKWXuOGf>?c-;A{87FA z_^WrB90xvj$?e;aO3}EjNW3(?dVj4uEb3}~*$s?7cFoy(S8m(5mK(pi7a-+;+SZF> zvN@oQU{=qOM-1!r*x3h9OrN9qWba9zz27u{(b1~&*9tmD{#xPAS!dpqrzGOa&@KW~ z(h0mXiq=4VpI}Ec^smaE%y3kiMMPYO8BBF5P4VA>)T4+CF&c``U-f)JY?Svwp5~mU z?)USznl#)sww*J%-N0?q8>`#|WM%5jh(p+6tTwyN28M=ovFyAH zmOBYa2C&qsK56Fk&WMF_J02?P3QNRm%~N;>9j{vGBF_ZWH+|0nT6lxZL-k5K@cQ)m zsrpK!jc~E@*`WHg26D#i#h19ae?mgPz}h7p-6NEah&})z_U_5Mb3|^}7fHE2I2|vD zjkR;C$%S^;M}@Ud9j{0^1m~khKe)MH@gQ;s*aZyr8>O8ZWjNf*?ZWzx&9QA8uhE&V zpSvcEmA2K_Cm|s#js2@u&y9%oPRGdD*~amcbUlbl)J!EhqH-BZSM$hcAY$6F5k+Yx zJ}&+Zy^w09`y@>swgqsMWz(|K6PTyd8*k%bZ8?cZS!3y5dS2E{>zhT%(m_hx62h7Y z7)x}FvS?P07P#j&7(JiW&{{10a!7`S`qU1p#*Bk!U#&kuUd8kxYU?^iF zIz$k+Q;eyF66UVlC9N27-+|RrmZ72WR%t@hE)0`D4qvv9p#l$$VNL4c{59zMsL&}h z$(zn_EMW=(ZeL$LI8&#qrM1q^B(!}Ha@~mY+ocgk-iLm%7={kS*_`qHh_+#BwaghN z^hH}Y=tSw2RUM0>sVNVcX?Nd}&2p2m5#(U6n<}f}NY=a>mwNmyMZlwLJVozV&I2HK zq!#pOCp4+JY4U05azztmo5SE|9FLd{`uAY7@f?PZA_@&+uDFR-sYiH=p1JnCp!tN3 z!Gg_hlgfox>I|`Mj9i2}RfRdWK6=2hAZgJVPIh9u6&02qjKHO9k5Mg!l_SHTGqIhn zV$G&^_`Ss%m0elcaYq0xBO}_|aBs=GbzNi`M#|kxJT$hA51$>T2C*lA%QEO=C`-T~ zKa9xe6pkx&hReo%jV4)SCFMa|7Zd)e82dGbFG;7EjGQnuI(8Z{Th5UyqoJ-AIhW%_ zhr>`ai1vXnB3xc5B$2GWhqoZTlr^ zGI-m+H$xOYG!`0hnzPLpjWK{)kf6(m_h9>9?7Quiao!v2u8~e~PWWawao72~%l8x? zJ7%B(-hJ?A{)cZNzYEt)$$kS2sn5@~ukDP6#X@fVhjZ4B-p7|FD&v}G1OI-78k=^# zq4wEB#q;p3>z*D+D`}f}2bl6>WD`s_Er-yeP2cRIy@zSHkijf?>c%M!mX-8|6c;!j z=N)I=M=m+%Ez6lU0_ABFzg>u;XxgAc%ny7QO*-G5KTbvyGnw6wOHQn@61hySCqcIw zh|s@R6wQuaJeZm4OrHxyS9`Vm*zv^!EwpA%yLS_>cjEPV?eh!`46uzHA><>?s{mjk z;krS}?HD?LKDfjN-3y8s*GdkBv!R7>8y#a|XU7vu-b7B}G ztp2lMkp3fAU!w)+4selU)#_1GEUs!q@g&i@8*U5uvA5H`A{D%1{`kDmLwzgovw>-} z^1T;UPf6NJYit%>*+gKiT$}@Y$WrtJy;6$%oHdn4f)mN|7XXT}B>Ki<+_l$_F=^PF9Jt3_aKN_GIb{<;K#D+cEtyPUQiJ=F0&I z-BS8fV*U>H)XsUW#u@DNd^)nwfB+E^S9y&b*w*7+@#E8pm4P0zE!l5om-gMAc{4&Y zefoL$Itp86zfIS%VU#*jdXgsvy`!+tG2z-4R3S1ppV$xcriGZ|P^m=LNsB?a7#(k% zA_cNx)B~t8ZyAza;cn5%(LJXXK8_jXEdEC(w}{5U;o z6VzqZ#lM)s3WFk8-*qkw8k(6+_0av4CTvVoCy=(S7&zz{_uYo*8Pppy?LxeK2_;+C z$HR_>?Bp$B1kjUk8Id^m_Za>O5+~1md6%{c?MkSApP}Wx#I%G`w**BYRMsP_X&nzj z$g{{6o!L^cyjmby<8CXz3s{ppsdcOo5AZB^8DueESWxFO!dntLg-;jAG|OCCz{yzu zBt#?-Fuf;v5$NPnS%eufNt3E8Jw(sS6c)U)5)4s4YcnhsRDm+gRv)_#Fwe;OKM!BFk)=k7DQfxCVnDw#_1`NI2=C#KtRJY`7 zUP{^~(OY50D$S#g=u@~j+@iPFDozu5rD@jb9pH9UWUZ7Ekp`y4PIXQxG!pH0UyhxO z8hP{Fchw{(xL~yXHe1If?U3`%=A`pwqm6jus`m*NKguH7)Vp$fybH<5+^p&G46! z(r_0o<%I+8g2uOvCH?3%4^$Z2>hM%DW_#|b-EWujut#c#5@s!YNQXT>iwR1Vv(eUv zfKkk$&AL1KHepEy=|KDrhP`Lw7FBi$!sr*r&m$w|yKRS9wF?Pwyb~#Vp9W=pF19%Y z=Js_RBQ+0GlChZUx8w^*aIK{1Bak>u$V1ZEM+N*z@hbfHhv z7e}-A-vfU%0E&tiqD5wB99=hU!@-sGyvnJrwl-jlqH^_Y^a4ufWF-yXm_Y6@i%=K< zA%Xes8_esc(WUKVwnw=v6&tt>D>1KD=c#QgU&QL|N+c3>scPY#Gb+D+#@&DkIBZoLQK zEXCO@=nErasc|}07A%MhA=siVWMYo)aV$CUSQ5vnnQ?ODHt)QxunN5A%gZ#>9dgylsaVdlPcQoO?!B3d0s9L-?Rf|K6Xj zu&&Xq>$)UnR=DwQ0Z%rZOIKTh~T9op<`2Jr)0+Dx2D>ZkD6YvP5i8iQKDDF z2}GphB8fIb=>pNu5Ec1R=u|+4(_WURR%BIfp;1vO7?~2q^S#mAqz>GKA@8*Q~vxS&s z&Fz?=s`58F{PW}9OjZ;UL)q4d<9Q2y#lt+04_BS_?WNOb<{@K?rhdM%hJ~P&t z&_Mn9Na9mtev8Or7LV`4wgUs47#aExu^5U+GOTM`vEi&^yH|=*ywJ5v2uqHm1vNsg zrF0rEsSeVY-*6u;L=g4#1*JD2H5Hbe&S&n!c4=wqK{Z)^6L|ia?hJg<(3iHbGMKcA z-km=ZMfq|2G~{XrtsEkOrbOFsBa;glksvu~pxl#Wchil9)|?otKL%;IX&%##wL5|4H!KEPuYl(4&Gy^E zj>`otqsFod)ouj_kW0?0^%3Ql5QrcjMVRJiCJq}>@p@#5v3?6PJskz|z%Px~qJaM_ z(sdYa!m9gu0E?NY8a2`b2_@%9U(X`UVjmK+M`)T_8xhY~6Gqc=cJLuKh=8gvsZ0ks z*+iAL9LC;~)Owku%NLd3424iDX8juLXDb`MjeD_%rNfSD*@wj>>n|f!@fnXawRRHMkWZokQZFy$w?Id{8K|*1?nh2F@@@-#qiYw_cd9kVE*=iEi z|Dw}wFO3*|$SU_k&iLa1^53gm=`{*T_v6Dq5GOeBeGlkee%}I6&G;Q=O90oNgqT>f zKv+j&3%=lK0!5Ag5$weJapizX7;qOhz+VPH&r-~XW%E!f$L_#CYaJf+B-dam{X|s< z@A0beu4`a-0GnQ9?Kx=#N1lQen9UgEYzC}WaUMFsKL&`TSmKC!e`b0GY5>b?1 z$KgY>{cXf0DIZd>(S7!Y8copuP#$fGcPP2|#$C;t&QHmobO42XDguUx+4%)(7%z)} zj)7g(H_l>(-a}rte-$Ggb7)VfK-vC^;hwL2%iVe-iBUofALCioT|_MLm&gVvId6G_ zf=vum*S!nJ&pW;;HPuhH>a9aR%83qj8e%EV8w2tvcv5xO($mA0@vA-*(zkVWB2lON z-|r_lDxmOo`Yd9dp@ZWrLo9x-I7bW!9kgC?Q6xg@9L&|;9AYcveRj8|FZggOpm-I< zzD{14a#M`UNxAJAQ#mQ9{B%1*;z(tM3JjdXt5LSQy6Ee1b4=y3S$|tJ1Tp#PlCw+F zekqqG6bI#UqarYx@0f5;3?Fp7_4tE1^Nj%coIKC3%hu5pC%UnnW;MF57@N3zSo z8Hn#T6M>~2v6p2GsVoP!v-UUErZhRZBP;z*lu{$s0lYOB3!=pir6pY(>9BuX2$po_ z{20qat7S7Jq+%|z?a&t7O=QqwPmFJ}xL*D}3eOds&xw<+Vv$X}AOw7ES}amU+RsAwlSO6i0g)#lEMUPh%I}8026Ur`wV`06ufgL`06}N zM7tdu^zXV2=)UeU4I*Ji!;mwyO9 z3py*3Hjc|zuLzIc<*H!i&#BX;S!0k}1dwI^H2}LXz0c>ryOq4%@lizWZw`z0M9^ERv|i zc7i2?X2~^m3sYX{;~cA z5#^N@Q}q3BDiArz&ZzXDdII5TMj6kg(;%({?P-GJYHwjf6d89oFS ztjF8p$AJC_mUKF3U3OU5qJ{o;+)T>INlBm*Z>fzLAh_Oqd5!*_9KqThM zx&HghTq5M8tt#^*Ub_rcx85_hAz7R>A2RzUS+8q%5;IK zBS5H^W{+gCXZQa7XvCzE$Llbg8gh?f_Q^l@)oeEBx~Si&soAGLUyMR~9n$Vl=*|!4 zE1xlCP>A_{`unA34d1!<``x}!ed|S9u!0R68(YX#TXFE;qw06(aROyBY*VTpV~zBL zWBQZRDfhq)D&&q_L`R^hiF7px%qs?g8rV_`mQ~ZP`V{HZ#0YHM+@oROhg0hl9-G{+ zilL;UE@*bb9;0U%#V-A%FtF|)(+0>XNP7Gp%y=qCg z%*M!}5T%lQA-7f^6RTTU00;$eE$rW5aSc4{@xJ@Ie2KHHw`Pz`ezZ3tJSN_E(eSy4 z!{XcHEY2NC7;96}P^sFV3hpbf#hgX_VWcFa+mHbzQ4#%nB*-lqGfpbLay5QR0Ly?T z>Ed6uZpwK>CJzH>(ec2T+21)?@hpCFRk8aC+u<kUy`#kBlLIb@bJVpCN0B~hkqrX!jpG}n3#<;h^t@ymLldE>Dp3ny&6Ter7 zqALn}<|s=AAX?#R=A$5N+0d<0XZL9x$GBr@3v_MTaES}c2C7PR9m>=K=Zq{zj7}XT z^03GI=ezvs(EL)3&!`Ti=KykN#n}T>4U8h==X&u8&9u)s z>rfl)p>ILs1Nt`3V3o8?xxzix8NCnAog8KX=UYY|@(!jmP4}fLcCig)Tje89LIDH) zrD!++)JTJ)9bl`g$|kW??PNM0i{v(tee`pok#b%9Q@4ymCA{*{zW5&zuDXPz_gVAy zw1P(RA9^LM^>!b87aN}9P}j>r!{aPm!%CU?i=Rf^Mqa_7;SFBHR!*QI(qW#M z9~Z)My$PQUY~S{42bZVgL|OFj@VGSP`udZ_v9$6gvoyCMjM(y9bHPftjgCKaN>q9I z&sc%Dt-j7_mLIVmvz6|_Jt86e8HfWSyn+yH*w}(c3$_J{NE*KJZZxO7ZgM&<0r}p^~Lor9yp(R!UMvaaL%Y~$AzjEq!XS2gmh*m2W}RYO?@k+ zaGn(fQuX9>xHe#&#ta*+vLc9Z11!;my^f@R4y+s;`miSfKvVY>dG@R#H+zTIfo8Kr zT$+HwPJbk-j4Nr_DzI=3;VpWc-d%m@9cG}t#tk_`d`BNkPC1-Cf=ukXRBwVdWU&oL zv1P?wySxE)`LWdC46VSs0|C=!%7S>7LF^_@^IY_%n0=yS3wWA2aCcNPi}*UR&{mzgT6jG-Z%Hfy=edWoQnTnDDNZA z_6to<>HEyMLqKUxh}%T+Pa@@sAWZhwyT{}~=UGspQ}F=m0xSkvH~N6ejJp_T@(l!P z+STpU_=>j`P8rNvOj;2cW~eJwlCr8eQScQNHl`I}7Pw5h^hgRNw10xtccsHnb#?K# z!S|Pu1S+m~DooveO?O>r=CvzRl|D-wO3T!T@+U#_^=UrY|Ba;y=>Qf6UTb_Od@v@tO503-{giDB z$~>V=mVbRh7S5u8gUUu(EOzd%zblb+AXrHM)s&n@vG|HNz(E`xtZ;$N_Yr(0G#=31#z7cg6d{3OwdqVh*gL|Jmgs3BB`HmUQ%)NC7J@hj z34%rU*k_vLzgfpdZ2*1zwKiW#j1T8)QkF-(kn$OQa(l z?V{QRf_=Kd5-1KjMnbO<(^*U_<@eR8C=#MeS{k)X3{9?7 z>S{r_*UfEGN1wodUGM#RZ@7za^r}=1xK*P_r$A~$ePy_P=`ig6%s`YQ$vV_*%7-dd}i9h0`9m8^QixzEU6{5!gcZFdu?_2*$Tr+EVBb#xI5@OsphiSmN)(>1=BF^#|m;%@=et9@@p{DEX03K#)@DS5 zxr$5UocmiDsU$Y@I?rgDKCwtDvUX?T;n`m{|zCp(tw)(p}t_Kzsx<<<|*Nv#1(Mes_+X4)Zq1lFK ze!!(@XfRCIelMCfMPwevRnb|oCXEnw_&Vg0KAL!TOcpK>ejJV=FmCJVoxtnAq8zZQ zzyaxL!&O;G>*KOg`vjDlV6eg<_PEC#iav|%2Ms@hsLl-=$`8DATv$Z0=n6{8epDeP zbp*M1XZ-pJ?(Vx)qO*(3qXl`28~Ex0i%Ue+e(^InSf&cUam3!_n>qp6Oa#(Ht6&k^ zoSLh%ub`!PBty>C{Johb|9A01n%EOzlY{5(xD>n4nPHR1J&`pmG!>SQ>W*wkdd!s?SnMP%i zffVg+SZCur$;4`D4OSAIf z@vIavd}-gA$?}=0i^g83*TuE6gAxMSr*!loS&n10xCsQ6e`9z$GR!*2WN(Y_-D?Jr zXTY0g+(U)t3u2U*->LJrPr0ySbFclRW&SLvMiEHUh1rlokl~uAgjs4%ZsNiA zH6rwX0=Gz>u6sgozNnUoQ2d)-`9WBvZU`*!UrJ$CFwAP}-`&|}lptJhDSJY7<< z^U|d&8#ZiW;;B<-UVr_KWHJppQW^Hnojb>l9m{&1Jb6+r7H+B^gR!6_-#|wi3;_>F zuUX==XV0p9oyZU?_5%wIgab%0UF{0BnuLW;B0!K&ojOH>S%_jG2oY^y0K1Er-?(vu zm=kbxVZeX^1K4t;?6>nD8zr{z(+>j;a(&>Il8iAbJ15A%6*e=$A;o7FOF$SA!YFfD zV!+tNix*ih`hof=#RaUzZ1mEDUij%pBUXXWnG3;yr*ct(L1I-_R(9sh8G-;Oy9-n4 zgiSe!@7uO*Q(NxZwQE>HeDD;*q_8lZDaNf25{;TE3Cq0m_dUGWJjTw zQO?K8%1Y$Z&(agXwQJX61FosH=A5OCeA>877+C`L3DS_Mo=35x@C%n|6A*%+#9{+h zv2Z^5aD$;p zjy$_HNO4?`{!CWX)Yj8ZrZTpZpmr0IYcS_u(8Ap(E~FA;h|AoQ|BaHCt=6* za8px*?aF_arr$8)Xl!l@GO@9-IgylqR-VcvBhdiCU<&dPrNV+Vbfq&n+`%t8m75go zgpGb2L6nr%)PhOMY!zPR3!Usn+DO9y`su_$#D>E1jd0X-GM%<^jT)y^+^{whiKWun zU@#1uX_=RppLjx-O%i&vR)<&1EUy>Oyo8ISi_W<)~V7#VVs7`np7;fLG#B0NJ(1;_nF$^}fxUflk!ckOYbE3YXNsZD# zFAL2S%w`rYu=)%USR%kECNWVNAYIT+h7brpZPh@9+KLRpueMg+LK$H?2^W$XQt?z< zQ880k9Y)#t)TmI_(vJbu9I6E(N`3ncDA}B0 z=)`7J;FofrwsM?8gF{TBAH4`sn~Hv1qlZI;z@r${9>y2+(uoA-!oz-OUt$bH5vEeZ z&qU0Fhfu(V&7He++qHX-GLL}3z%1sfWuif$pIPbyO zh8DmJ5Qaudi*pO-kZX`0PsYupX*j~G5AEpo|G9Z|qi||PqSZ88%!C!R?XZ^&bI-FJ zP5uKn_W}8v5H1kh)nu`(m}N5L*M9BSPg%!IBVy_iT?^^4P%IjVMZ#K)wqFwyA`>-q zqD0cGJC^C#hHHOyJpJ0Q|8v(|F}~Ep*`e9-$2tFMwK_Mcu`O(9>YV)w{;#E0*AVJx z+~5j>owVbg`_;4j+OPfkKYtx}!d5C0PsI(((M?Bl|KIk@?EAWO>?}Pao`)c@=z0_@C z*S<`@l5~$`^hWtX%s+}HrB-T*LYL&!YE~sjYBkp-`3@1_65J8<2!gD`bNvK(stH}G z0KiR~90R;Wcp4B3FCi$NSR5dNY$5T0tg!Of#(N)h4Q|3dM%&d$Y+XlXvqid?9Mk(nrK_*0-QPk0000< KMNUMnLSTZ`9&y_M literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/machines-active-threats-tile.png b/windows/keep-secure/images/machines-active-threats-tile.png new file mode 100644 index 0000000000000000000000000000000000000000..ec1702e6dd450b62abc8cd3ae8a3033af2a9b6e8 GIT binary patch literal 18095 zcmbTd1y~$Uvo9RnB?JhP;1C=Z*TvmKaA$FMcMt9m+zAP`xNC3-8r(y0cjue@-}9bx z?z#8*Y6*La*(Fg%(qc})wIlp>^+57h&X2AZd$*WhA;xghQ zpFH%BvQa+aX|$X$WG|gu>)5X}s#o32wjNZt&$WKuc5`ZVexUL7c3m{b0)5Wz-a?K1 zI!R@i#raug00v=zDrTJkPXa`Q5RNQ6BMvte1BXmMxYdP@+9R?a(6fQOljXHm*{+n$ z_kce0WgXY2^GfA#(Ocse$^Li$qi=j_q8d9-`Bp`Co606Uzida6Wf+TmZ(Ce*VuCE? zxBG^^V@4K0p{-b>RFP;?sNkGS8B@7NEnLc8$naQd?6Suob7cIyC7TAG%T+@L(~xOJ z0W;ieHOT0`1_yewWBhbp%=my{!Szq5enP`OOskZZ5<3wyTj=+u7Ye%_zI-1T52 zw`R{Jc%i2NuezS!Mqg0z?TzXR(GMhzAKv~+`z0SPyi1buLZqIyssFjM+ &P-IY zLH@hTBA`MKdy9bgm8!7EHm9*tC;fl}Oba5P9K=voP6_toH#QkXjO0#eeXxu*cYV8x z|DP1OvQG0M`ixXFG8j6zm}HftMf(+5`BWk1m1*kryoqshJJ0o!&^s z!UVUdBoS+-Hw1o3hKcTD`$F9wD_Uhpm+QXEPpNJAp;-v9IExd?H&uyfFMQD-2f zmsDL5rtc48RxWQbyE(rxF6{^Omm&>btkf^pwQLPzqOZAU(&>$JD(b{19EViY_!)0H z<2y{QlULv8gX&<@`^Rz+Rgb|@-_=xiw^xMU?#v30D2!^+3#-a>_07uAf0D+OHMpQj;kZTcs8a>D?%q<3)V7VYq zJm4uNby*BqY*+}aYl3(`BfevxG0&Tj=03$s+EBMmv{Rp;iu~P>GV#fHwxAXs<)-YF z0yT_z*{hhxxm>A$Cn{sxsJlt)o;VAfzI@|~4~DQ~aKEtq?moDciem4k_(qg6A*p&% z2Ek{oS~)bui6j}KPAuX6C@*uu!IHH1{|2*}2`6E7&!}6z5igIRa zh7JV5w@L8>n{~mhB-0$_#$r=pHhp2$P%y;%1I}{SWUp zUp>m<)54aNh(_gVz}^pp&s1Zh+3PbC{tf)f%(Q8CoS{lFg|)FfdSW(%pYTP?c}~~~ zXb1ZX29ZWp42HWFz;g5~b10^Yad3UF+dBnGV?XT5v@I)R<88;E97y2gpw*rH`h4nH}R? zh?8`)_UOU7nJq`B`Rv#o%0pO$_xxNG-ALD8uDig~B=hEry?VK(N^#L~x{TNQ#uvRL zOIJ44raLmxS3O*yDnH3}gk5uzyg)FV5T#<6pP2-lFW0+j>&xe34a>su{m$4TcjREg z)-dO#W4D;fri5>1T3vRIm+S`B);x!`OWX_sSM05kW$X<_jq{wk6E}n_l`QbX#XwPWt18Cp9INk{LS!nF4J z9@cu(y$HDVZQATr4z?#JP!3IdV@arZ5h!|f6#eFqM-?I;M{u0K`QoCG4TeM3hpi>G zUC!2ZLo(}TN*vMd*5ezOoJ=DsA8JEU?W$bPx%qPPl_fy05bI;^-Ou%hf45R|@0P_$ z4!-C$H(SNsX3Kb8zb+Xwh3E-ZnKmMhTiZ1@g&!S{)C8<-b}ySZuFt5z;Lc6lw&=Rx zK$tjOenCSFrp*z{CM9^bOh04%1~Y)P{GOwV)u2_~mlytCFvb+WlS*=ELp@Xu^F6aR zp}8u}3Vyq+yRn*l`UxeJ#+ktqewfSX8eG&Owt zCtTWyk)zZ6UBl~=%2`SgzlC;&Yc@~eg&9d_w|Y*hO8VrF4=}U2Daz?74j8kr#09_h zZZO!CfBvZN+YVc_MjDbcA71n}TEL%d;(Mmi`uvH`NCVHL@D46q!#50_e)VdBa=vhk zg0Q%~<{9y@K`b-ix~Z>aF4O$wSX|(!tF@ z?^;o9l*xkY2Bc&-|~ zVyi7s5S#zPkNLCT(e)pS47~S^q!s;tr*<-CJtM~ZD91daSD%QkJSAOir3JW9lZMOB zrRfIfhjTJYGq7&^ye8!Wv49ipUeheGp^<|He2fMb@Jyb3=fv3=K8iJltz8W{c1*bi zo_HlDRW;FV@Q;@BQ@$iRFBLCwBy!~5^)ESdiH3_rnU7&CWk?aldT1Je_gMEd($tl3 z4yI;hUouN<_*POM0F#C-k)2psl=nTYzl$iZG0%S23Pn9PHj5}tcb14yF=u+}y_%2h zPx%~4LZTvF!zvk>yA9dnoFhD@Y9$@aQUh$JEhOkWpYS8C3vyq*3X|LkX)2F(esmNk zfc=PW>HS@p(**NIL~#Ehg+tbujgsE`no=oQC0xo5@bi(>vI~Lnzb|9B5FpPV%Dnz+ zgbVyEfahnVt+sY)?40SvydZYNDD9XOe6%cHsp(!Ya(9>isYgKaNMttW(A(Twq`_*v z9^G5H5#}Cl3D+9di;3oUNMy(3K3`G)=0b3ewbJ;BNM{u3kcfGgKbrXfjhSB_hjoTE z447=uXw|u+Z{Eu735v~rHx<$OcYByJ5=}meq02GWIDYLPkY4{#li!L4>NK-Q}%`}JgsJrzg3-zs4#WHv+X^Fg|sf84;zcM?o!Ab zN{`+{8Mxgv{U=P7IEnolh2HYXW5Xl&&deGSvl)7sK5e;Q8-#eYB;%Ndi(n%+W2XoZFM4KEwt zL!B}@Me3(0H&OCd(?})5`mwb}=2+|WdC0q0@=@gHt3l8CwpxPweCLHNbSDx!{B`3k zSnOIZzBHtOYP~`hekJ3>G*?~mSf~yc5C15g+n=0G3tJ$`4-fmKhjrV2`aIt7i1DLv|VNyP^?!cDA58K7h=Axw7Wx-jR|cf9$%P zhjfN;*?{JdAsX=l%noZtk0Y-_=XPvk{ZdnO7L06F3X?m~(a2wIwcZAokuH!b+h3D-Kx!C>Q?Q7tk$efSJDn00*3 zD;Y7L&w;~!E>SEacNuqI=^EOK>5S?U)^V@4%f$0aG@wtG)?hU&p&_o1!mqCuGuSz@ znmae%8zGunGe2P>+lJ(fJI8f?0j@KpHIhh97!ehVuYB|N$`z{7=+p7THN4r=J?x;B zi3G>M){s1?)cr8)kG+FCl*3Vv5Dft-$CW@{V?aNQlH`a9yF!h4s8xWO(5u+0^^o;E z$nY$oT7dMYvFxa?8QppQJW~Uwbk!o4i!1lej(TePSV41APFQo0Tl!C%z?3W-e{qA^ ziu+%^<-Lo}avy&)qm4M{^HuZ2xS;N_vU?KBL$^k?EAGB9N;-aSDOJpBCvH|r$`9tC+9f{dftb_Lx$sxUU+ES}nALKD~X zYF?P$VZb(NS}%^v{=%tx-$%MJTob`7HUHKQ8-7E155k#0rDSfqEH9t&_S{xXqw3gr zxl)a@Cid!2czAS@(4Ysq9sNxOkGIvX#U;d}LCja; zUdkjU!exTB2g;ksiT+GL!~2u}?xk5?@ImFQv$eeV;^6UUq_ z$(+#fQ3^Ic%1}GglhJba_H-hSOy0K~Y&jds_wEewEz<%&7WHvJ_V%v+IrEpr8C#C$ zt(+=GV+}8g3usU9lEjL^fw%m7PXl*6QmcCUDDO|V^Mwb~8poza-pB8CveZ}l&1e(j zx?ie#`eh81lHD$mw7yTD$JCn-<}gK`8NJaN!}lG!vGbK*q-ZQH);5F_si?}1?*i1CNKhI+9t;s#X+~E$%xNNfJ!MIlr&Vrc zbI)VKmprSPX-VvyVGmf#fEPtyblqKfEzVn~k5-kSov0+&n@r}TJa7Y52re6h;V$B& zLo3IU3`d%g7l}J4ZitV@cOx;c^^|j0hj}+0`YgQ}mKCf+Rzqn|+N9-vMlNl&?+{Oj z)YiToNEX32F@Q}~ofk(gZ74!27T>kGJaD}BU0h7;A}T-j-zS5>VPt`Q&ZGyecZdF8 zbknL&=S%Zfc&$5igbLHB$&feU?OhnXy-cp_G~R3$xSFCsUmNX{(29hi1wElv9m#vS za}7aWP;K~~AGmCpf_5S!ayOo2Eq5U`P;vOPcdJ#&VPG0!IhRNd5_V}ysN%aga?De| zVvbADf@T4lp}?$a!y8Fsm*JR!Ev3xCew=cLGDAiYm^2t*liB!K2IXMTr6-V6?lOG^ zK~Zn|WW_j!nugksgX=)pr5S|BoI)g5+fy6_g-6guWKA^;l`HO_`mZVaFMvB$`N-?n zN_IQ$zE*zXr)sPe4`Tes85-=XaSN>tWd2_w@ zKf3Kgg0cSNw8s%7^;?kcySO_9zYnTJ_v!W%M>StWdgMq)3~n1d%wMnx;xN3BUOg(7 z08ClSTQX%2{^1~`@$M4y)or#sz{w7g#t}0_l%reCxj&J|vgcD%o)?Cd;LmMl$v6z{ zQqYUT$Re%ZKm?BGy4PArlWo5jfk7-~Hg*M|7Tfl`t^$t=$my+-hF>WKt|u12~0~wjx6-0xt0F9zSiIGNGh%qHhiO9shukF{-uFR z9XrJI1G8A=urC^!?$iwR>H{&nq%Duw>>>URSl!DE?Qm=hp^^NJcE!m+OkIcR;xp4M zn>tc;hl@6~&l`rA8_)~nAfP+As{Y?AU6$khWz*F7!RF^kVOLq#fY(ponj?=?+!u!} z)mlsDQz-a$&f8KoKlVPonjDToy6N}j<{=SXT1c~`{xAl!OF7GnkKB!v^Xz9miSx{3 z%4_pCSGz5`dE@o_Lm0|ow{)b^dz=^C?_Xz5lkWkJOWudK`^ULaUc~3|bFJK^++5if ztUCL4^pUjP+|Vh&Gf7V%uz>s_5V+N5_^UomXCTPot>f@Gk9d4ze`Dg@m|WR|SqzrJ znU<5*cPjVayM`zN7{*kj5OX`4$z*um-kmF#q`>&!JGi$r>e}nBj0Ee}6@UsI6;_eXnC^MgDM2bmdhxnNk&9g# zP}pzlnVOc5hP}!!gCkawciPaVZF1b5Z ziVy`K0D*UAiyT|zLC>m7}*{kkc@r(Jnr1{=Es2U!n1Aer0GNG+E+l1O}2El zgAeI0W7+y8FMa-B&^N|k_7D>DeFnB)o!^z^R?Ax;BCv z{gX1a&tC65Li5jDSEqGv=O5j3Kei;Ps1?6@i=wtT89qthXv+*2tb6Ey-vV`m z==zP^v%Jr!E&~73iVnX~%VrlARp!p^R|x)-*g)o_fRQ~ICYGFkym)4<*X1t&m%x}L zr~@{r0eH&MS?I|}FBUICRlO6LoEo;|B3utRd&S?Ci8-xsM|NI$5FwMLk)r#ePh!K6 z#A&f;7NGislG}y^<~?@&mT%=D)-259DC1MzCHe2QM-k^y zN2gY`bQjM$2Tecwv_zLmk0}oFJHDS)UtWDU4_k7;haE%aEa=>9&(uQ4u)tR+dh3=l zJsXDTX~7^PCNH|`p5odvj2c1M4vrJRTvIN*N@GJ<96&B}teykosHd$oc?7TC2GQ|8 zE!7?0CExdtQp~^5$G)8*mY=}jtNn7T)`;oVzGGLR0jB8yVsjUxMvEN6B&BQZ2rFw^ z5V6i^>JPQhR^zIm@9*TAtngcv8g67{@a0SqOuT)cQo;)?FYm1jn%O&Ah=)~0M<~G* z$MhL_@l$RBp?3u3=Cb-1$!!hS%ZXXn`pq3q2^N-bH1w0$9uO7=B8&DoPeI7S!D7~R zYFs1ja7^o0t2S3qsqxZJN%cpSL5Pnl_c*8VYnoX2cWPLMZ`{Ar=WiP85dSFGa{Y54 zS*VNCTxv*f6Hv%BB8)%F2In{i=NNLl8$nDTYY_aKF>{g)ZXZIX#b|;h_=93F-o(&n zl!LGM-Oq}R@>e|$-xO@#Mn`2BhP*OoTZcGUN&P;NGqkV7lvAhKuSYsP>4+M^b} zzu#p4__zPl8EKEx8|(P!__Y7)!tb$>#qA%6}ktBQ$yCCK?{1Y) zt$auQCs;bXw;)$CulMDg1RibA$5lxgR*#|MlyJdNW@^y!A@%vUo&!rA)x_&*i?C*a zmt#2mYg86r^w_&R$Pv@cd{)Zu4RY?^rPJIf`?1XB&whl5nyza$f$6c!w-+sT&;zzR zj#k>#nU(NgiPg=1n?d3eVg=+am#3$mi03GK$~-SrZ1YnqKG*D;)nH3?G56e#5FaD` z0y7b9m`9y=Y_V+`bspX#X@UFchmfg(@)*+a(Gac38mhQRce@eB5Omg@x_bgTF~3XP zy_va7MUUwDtd8w2Ug&q5bF1qOPvL9msq)8Z-;XMgfjE8{u&Zqr33yz7m=rUCQ0GRt zpO~0Zr@J*hu3j;A6>WiDr_Gm`9*4lL#O5uAgv10(7zKYRkuE7j1YsRga2Hm0L%gOR zZ-Ms)V%M)SQI|ftq~+YJsU8|DesKLyg0KG1J6&8v8zW$$|kCfpJ%Q1)W*8hj$S-;M1Eq5ph`c(^do z`yrt^gqSqxdJwbEvNYuGCjc=+S>JhVmNfkFo21SFKr58z^8SHj>d)|BYK(Uvi9vxx z!PsJFEC^6=v}@e8FVo6m6X>!|wvH%IXlZI@ zy?6+9qi*%>J++-ZwM%D`>IZIWNL=M!z;0%CyV=a88aqoAAKJ!))W60BB8SL%v#v~b zqGlqO`j@FB8IGHo8x)+ixK!@W4lr8QiVpFr&BaWcRuJlRhVA;+rdMN^>kMTOizW~3 zLuL}P?$c|i-kWQ@V=hDN40V>^sYqe|rA!(uVWx5ub}{t+!_VM3Q=59<7&>caUS5}D zhw+)2|t?H(>jsfw`M-ME-w5|>>$K?O~;-1KsXCzW2EkEp0e3kV;}IS>%})l3mYrXTz_fca;WLi-z4~p@${LXClI_Hp#h$K{M#k7RY+!+uZPTuJ|ZTnM^D7O3}y0G`~AN?>f;2}nu zL?$$y^|b1A3f*+oPW6^Xk6*;;U{hFJlwS`EM}g#8CZ5tH;A^iJQe;s zjeNngVaoGL*BWUsCL}-qU$?;ZGG_!jP5^&CflJ4RuV>~2{fZ`fN=<;1KTJ|oNr8fn~S#~wPYPN#jRiz*lt)r zE-)9+JJI>UQnMswvElCasICDbHt-wxjgjwvu-#3cOpv)VmtK|&lch z@E#TyggUPa2MowtvzoU#H>89X=&3JeIU3!cU*_ z1Ifc8iE8M4wWBp=79^o>>CXtdoG5vU6h7e~9ZD3x&DdCd6%cN80m2SgV!p*WT<&4` zO{s`02cG3NHnE6W5cNHrf@|@vb(ScOyXtNOENb$A5|sH5<_;gCSlZ88hS36x(Yv5B zqqFN!G#r^c-Y3Xrpa2)CYT!Te0^B8n`*bXar4%1|#>XwZd1zT|vBC>e7JSFGdlGq2 z&O?3r(#mc6ZJtF4nZWftOY0AHWMqhWqS{rs9I5xGw%Y3A2i=(>bt1L4cAfLaI#27} zJ~%S#RRM?QBv+H}N7Id%6<^}6CzrhnfJmM`#Ukre<6$Z+bG?I`~V~; ztp6dCl&b9l8c7IJS;Bf=f8c)JQmo_fA;M%`OuG5E3ji9D!VQPw~fK4`Acg z&8U6eo_+NX3^k*ffydji_FnNPNfqWvy=2J(Zb7mfZFadjFrkSTe85_Y;z|P=b zvO?1MN)Ri3k8Bn^Q>E;*7W}xbuS3(i#)QW#av}@RzJs$@7G^yf3-XHdb4jZmPM6dc z>o6FxG+q_oxyieB_D;gWZ|24FNhZt^SWmo6#>PxSC#M^qex2Me-J_G+xw8~-xZPDhrw z0DKMLFVru%Sn#boy*tH^9j}wY*DO^WX)(p$5LAguFcDSn-hIS)bV~^X_uI-@imeR9 zzPnTQI2^hUZ^s5FvntHTt2Eog9BNZ5=n4L@#Ew|@`RH$h2p=-I!cq3=d9OVjesv(# z1m(n!u91zM8+;u%j!LPI?tOu>uMxXFxku5dSDYW`xb$&R`3AJ->ACm%;roFiC-INi z>8M(3GSkQ3Tg^sf-iuMJDd(AzU}izdLniQD`h$D=l$l`askH<8M#{}r7!3dq_}$|Q zN`&-=O;shk(ftY@4_vZMX8+eZ_rWyT3~Z!-ojsV`m)spY4p%y#=!sO)59X)120rDh zPyF(hwZ~DunD2ruDr=hc?&gKSa!SZ6nj2q0E?S)P|2dN#n5Je;q_g(LxHo6dfvEYo z_$6R4h`I_bfq&=eLdoy)mVs%tqo7BFRJEfwxiu5!0UIQf&;<$+3VWmUuqH&Q`XvG4 z@eux@?6SEA5F%f@xoBf0M+9z(tx2Cl-B50=fG$ijmvLR49e*;QQ#j>=XFbWCmpZTJ zivgI#_J@V1t)UH^da_K7h=5jeZ9uh&Sv=L8E&~4$WmtC#Y-YzRz750@4sZumu~HtPk*OlV?h8lWduHQUR)si zAc<&hxRcd)aEiX?4(zGY=|=}9rQA>A@nq!deEpuuh0T*7ctTis9|1(Rdftpj-M+HD z?*@I&LM9e(ct{VTs<Wnn;K`S+ewu^*gtm9hPbIi;{j0NXOCZgeo1I(7;NAbG$*VT z$o$Xs>EoyFOe6X5!jT@>Sl5GnF2e4G`efiP|^Hm|lhJ!)|p| zHlz)1J|Yok2H^camLOt7E&;g#t}SwP(psQEOOC_6PeUjxT_1))V8tTdXO!YCow2#= zrtG@6kQsgPs-8soVeT!){a@WG(U)yKX&Y9tv ze=Rd0rpQvgm!7XMkKtsL&#%1sO>`3yNzqM$SdSbME5o#mQHs~o7(%u_ zIjT&IJ=n}h_o=n`Lil?Ftia!zUsAU-S-Zv+I>*bEb+eOn;sh#zeANdjeI{> zbcAs=OV13<`|V*JjsxCQ_bPg(-?0NzorbS_YrQ)otVOxIrZ2j7*{WeseYdChei*|# zNmW&6Pb_{I<^+e4#-9`EzP>g|xLc(km^}Sja>lHaIR#)zOg_foZIoM1EX+1k7NZ0= zmmh*OJiFC-se~4!VpJ0Y_r+L}pF19{7(9gkri0kx!Ddd5r^hcfY(W-jfu|s^$wwQa zW@UZj<4nRN%0qgjG;c@GSdPmNV6*lj>w>oq3yH`DzKA^o^AgTbESGXn(lQd9_3JUA zEQVlV(lZcc46d8n< z0PrC^%|QC!12&#BQ1$Hg{%i?705`3THOJ)xVcQDeY)`=c7vuz7;=mvtCLjVn8DSWv z=or99p?6!if4-0mfS{0ZBr6;Ps zb+PiDd;Lqb^L?G`64uII50)?`&?#p_im+89r*7-w51QWMrn{MZI_pmR*~!l@cb=o$ zi9hulvNWAd7oxYS)Rhd+?;VNi zglRjb3})d8b=ry}FEeOuFoR!>@2A^AEOS=dy#qsTc=D_rvL+>I`H`v3qd&7WLp90M z&|*>Xy>tSNuao`<(l?oQ{Yq(0J)5e7-HX)cvWC;x&kh@ro}{(f@kK!OZfg^H+HVWS zPx%Z*HTjXEEy8whaF7j>Jg3QpxQUXMx=lv!Hf?ou5;A_Sq}gKY0L9%4^-OzdT8}75 z>pVoxtKaa!Wd}}+jHW8hiL?R7NjKQ7+xw0D*zgISGio_Gig@3j9}2yvPgI0zX4d2v z&VBdv=&*|A4E(m2bDENWU|6n^nhi_U*viXLB_uu*@}FN9KRSfIKXCOIOmQjFH<*rh zXUyJOu;>&$IjfCU$g16Zh=w#DA6g)01$)y#9MCBSs@!)ShiOzIA??l2{r%D{S6L%{ zhDm6%ntXj z@Y)gRjEUMMLWH$ru*}SeEmm*R=9YDb2*~8pM5U#p=)%CGMQ8Zoh0(nBYBK%FGJQ)a z5OFh?ok`QfOgujS-<8YJbqB1Nv&B_d`3eJ^X_3dm*y54~>E5R!q_QXJDQq-cb0suc zRW=Dd0qx+SLePk>-q2l8T}5J|O3D;>&Vm^JVY8aY>30ezrXo25pKYt>KP8xWIC+>a zgXvmnjt*{vmnp5^kAL;--`AeE*yBqndT@iP3UbZg*s>uK@c*pz@cy~nIhra(5(&rm zt~t4v(`hN1L>qGtW8ycz3K$w=q1dW&NffzZkCv+0+vRb z_wHGrFsk{Pzo&vUYzx|`EW(KiA#ZUSvjtConRuepTkH6HFhOkQk37sj(SNJZ8S?n) zW@j>|E34~@6ol?9ztZ=CIaysWC{L}QF|}mz_ma(9JgjWn`sU=~Mu8*gsb>nk(s{>& z*)MwGIE{bS+OZbhXrDwsw6a;gw|Nb-Y)ccp~ zKX>d+VP=^4Tcd{YY%wRh7)|GYj=&CEILK8oNGxd*!Shc*e|QIS+v-osjL4tb+&4w9 zjx8=ykk_nb`4Zi3Az;1JxNW~|pyxEtMWo6#7i{Ia5=bT;@T%{g??@D7aEVpT@%+dN5Ox{*=-OP@m7Cv4{0p=3^EWT?bU1Du9J_#gv{;9Tm zdCvMZQ^|4)CAW{OrIE)}g*x;~e6*8^0mPe71LQ_r=#g|4R;cb6;Idm}&NUGET$8q{ z&|UUvh71UIXA}}U*(S;|sr*gzRJmoIhlNY+5+73n7611EvT%cjAl5=?qzwfG%WL?$ zT(7-U+a9~`-sgL?L|oMO+Vu#)et$sz2ZU{dn(i#nQ-vh3pp3U2#|S=sW8K8EVUkv6 z6MlblIWEgyI3S}kaNk7S~GT`lr5F<1k52|R#ja5>U72rxE+8({uZ5WrOFQ{Z@s z_Ltk;z;TM@FE8PNqjV>FbhMT~x7m#j=y3(O{PcIY+`6g!^NOZw^JBd4C`(W37^d?} z>t9DB8B}C|XvRVFWG7D!VOUMCbzP<_k7<<1@9sQqR?%s}}lb>4rMw2Zkv*YPse45ith2uqDnaWq>N0W;T2@lT~ zBJC8c=3I2AE*QzZTm!YkSeB9PY1hw){?F0qG_(*az|TUF1^gMWMfSp-fatL=Et~em zVKv!N6svJD$U45zsj>)119eyS|3^9Nnw~zr+G$cu=Zm?dh07j>A;sElxVlw0@Dz*% zlwlZ9ivjeGnMFInz&%sGVi=R^E^o-7gA~Kg9uLvQr~?O=jWD5D82`VCQtpr6z#LB3 z79$i3!bt|1GzGJj%mOF#;QulxFS?8~8AL@(C{0+Ke&X9|JDE5$)9%ky23kMqk6-^6 z4-nqy`f43kn~<57Qvfi8eMK~XJJ+Fx0ZsPg^GSbKx2AM0`bB$g&_5Fgp;UG-x@oe- zvzhHfpVe*d;%`^x;}bxY`hQ7J`ES~-LFgmY#asENM3GVuP;sZO0k{@h!H!=V`f5#Z@aGi@uEQ%}XrPH}>>!to>MyFR$bzy@mm{PlVn?5=PfRPXYgJy&= zOFwzS{YN$M(r9+|&S z6$vhViLRghP$A81oj7Ctg^CKB-TgULwZbe3N<+=X_~Wzq85=&QUe zQ0a$?gpvO@TIg;*0#Nqz(C7-E+b5`T$5Ug(%grrIs@M6a><;>CP9rhIcaDc-nI2~Q zpFeW(e{D(vrJ5plyL0_;Xf2m@W`=MAS!6z4s!tKAjO_22r6A%{J=X@+yHlMJ;AL6k z7NGpeq~-@Jq4TVNo#Tybydc|RCQx%e9M?bUZsk8u#Q!Jhf-f2L;UB$&8U}r5i7Lj9 zxf`2L^XIhcB@7+s#`QZNCN=PMEHW@*Ocy3}p11y$?o6mk5!WAqE0cIV`>5c8`zHX2 z4RJSf+^<18acF2V6IHm~g%GF+`jDx4wlMkii+DfTICrih7UA0lq1H@v7(Kg{{{tV; zR24b(!Dpog&vyQmF0)In_Dbp1mzm)jb5B`Ani6iyJ8ATp64274`OyTWv5w0;4WIbz z%c*GqdDj8zt}?!(s@u|m>Vu=7cF!~lYV0%ma;}}_47?A=g4Mjvb;?Th7e9S1HCM#@(!X#%zWEw_{(Yx?c~z~ZcxH4xmkG7`vEFIMDWwRu-{Vb^5~urq+?Yet zmW2>e(ytNy{w$MtW}BW2)92%X#5O_NmJD&O`t=s#q7txK2{`q>Z;G~H>Z`^~8 z2;#20cw{$@YoBY^x=Ibh*03Y2cqq z)5%=c5G1tdXcU+oJMs-P9@?fm%W!5oNhOH0e#etH!nx`bH&baB~Aq zDN#rKFp-GSuBt>4k@WA=9hUlk+MVcGxOEn73WrSymiJ^)L%&osqM}y8$t}+-#%;GZzQ3-3!%x+>v>yhx^ z^wkg{8(qXa?l$v(jMMn$!5X(_s-|6iyb$sB-~0NRVn3~<@8t139SA}1x=@rJg6$E1 zr8eI*^c^dSJk6Mj`|T%%BBk6;1*%Bhg5(?)b6OU9zF~rw+u&v(Tq#GsW^K7swDogT zx`~$ThF6_`a3*7 zu35e)HZJjh&D#yHp@`4V=tu|2f*yh==TsZakM;$Bc?HwX?y#UMwfv%Q$cZ3%E9IBW zEe*`#OnkOE9I8Z2WbpUJQx7xrJMy*h=MXk7lmBHp!2YodPR(^+N9>Vmibw4k1wZGf z2{~`OYo#V(2KGVpK{grmS(5Yz*xHR{W4l;M2s-C`NX2~qbX;!?XWZx@}; ze_Bl5e_71Y+*4rVq#UTiu))Jwu3Vq;yPxTp-}xHdT^)@+`1}x2eP$mYfF{{_I(>Hn z=Cqoj1wiPf^v(_I(y2B(_@8x5kOut!g;Wv3+9f>Q#m+X^;ZOd5@V=RZn)e5YPqNM* zp|Q}Ji=2|dVN6HG!+d1xaH9v@64U7K5wc>0Xf#buHJV);reQ!@f@yB6kq(nnx&P1& z!TtJ2Rqv{g=~sBOIcLaVZYX~YPB(-%xB z_XAcwi&6da5mVPsGv9#|hD-cpP^(@(DS+ymR=}pfswLGA#{f`uXi|P8#mh@T;QwiK zVKj=;Gw|9d{&_<3WoO$Z<3m^!+v>ucn#;D-{Tl-tLHE$MH1Ro+%t1k z4k)r1ot^kbE=6Ib+ClKtqh#7mrqtW{Sjm*K7_HY6Vqsi+E&AMwhcGkfb?A<;>c@qj zj4lb$kM2rFEQA88H<9@8x+8-g!^F>GaDJ4k!-{^a13|feW)Zl{jD)?7C6`WU$ftw3 zHqg=Ve6`VpBt+1Z|E)wDDe>!ud*k8(3NtL)5CPEw?gC*CGQ=NnC1g&lvW0x`Vhmcq ztG2vl=~r@g{ZN%c$w{?I3{Mk4BH0NgcX3Go00>X6-OgQ7RJ_53oG4(}l6>#|=l2Pj zz_6Bb&C*-_0;55c%^$M`u|S5f8hJ3WO_UR{570kscocXsk^TUn{*yj83~A*f7z4|Q zpm?$xC}7p#8BOKKdXnP{~U1GNnbQoma*xY-5>6`b`oDK4C-EP0^6-Zl!u5#<(^#UK+-QM`zZ^FE*Zt;3yz95HSziGwNU&S>ddLWzY=ZSKA0bRMDf$dIp@Q z(Q>pdxf2G%HCBKB7CMH3+f5H)3!Y|-K;-}v=@|HYy@&B^EtVG>Bc0n8xLJDp30#jH zgv6$9kl=r0I5`&+)<1dxRB+C{srPWAPZqyF_FrTR6q6ZMJFYz{o%)QyrNxi=U)xqr$NpN3ENk zIA=z)bAC7ezS0(ysqHLh^kzegPZQ39{oNY{3{DpNCWVgS73GW4Kg};Wzl`x?KE9y? zI}e}JE=qB5nx)oYd}*z5(`y_db-?BCKi4g@&f^PJJwIL>Z+|WFjq&~2LeuPwx{vi` zn9j#LYQkFA%8HacTS_~ot;HP~ zb3Oc`V|LsXB8h7y23rjF-Ae1@X1$AvWo7>0ijcz{s?s+5B)yjP-&2?$Y$@($Hm5La zv=6|B*7!?AdGURuX^8v5K@qZbV4}jVW6dV21Iz`jR#)p;9COX9y+c-W`#cS>(rxBW zf4_|u-iyre4X>%m3*uTtryc*NK!XGr<*Fl__I$HZ#f5exCk{lsHX6$~ge*4~Sx;tO z>?G|Zw|K1jS53J-Fhv!dzkj%HKDwv$rM7{JpYzY_^q|SVG^k$~t)y3cYKy8UT_Gse z6dx39Q(%PEXS=%>ETZ3~pBGQR{`#KKLne{2`>INBr$&8$svvqn5`x`lLrq^#Dkp7o(eduJRdw3ym3#pQ5YnpC4?)NoprO3wci46FEA_Gxk39qAy}g~#*bQp{(FYBS1|N2MF3 z-PgG!b)sNGa6pQ{g+)Dz9pxJ5Jp_)hzcW7*+xmS~Gb?;{CveL2B=EeCK}hPE%g=$s zCZOT7lfa((1;wMv&z{B2?yx@|jcV(|{&UP)I&;V#e3XjGuy^cW-^N zGwbEc;(wjd#oxDzygd14>UA^O{p%)dv{UbY4s|9j&(1`d+F_u6aCIlpgybFRfxO?BlXhfW-VAn3>y z6$NbwqHKmBibph*;Q!7tIV`w9;iRpMg7P{~O@R;lt>muBK@dI!wq-^IJ|DDK(RYHN zW6tCsiXlsOcL=)Fb45W;*WGw-P{Zz2Pt1ZtHN`?@fEz=NZ{7ayUxuFG+{Kn8zMhYM zcHuD-eS>d3)&5Hn#f$X1aQ}23vHfO=3W2hwD)gciQ+qrL(IprXg1Ga+t1lPRFN0Ut;^yo9x|BpN`&_*c?T$NsDfde$Lj58+4q; z3vBcGPGdaZTLr)*G%+}&toX)#h*ajA3 z@;z-9XW|wU_VTux%T6eUumWFM$IjDOoMmP8T51*@+Wa0%kiMWb`nGNO?yXb01p;t5 zygfeide3_=Gls;wrWiL96=5}_kHgFuZ|`bjNtEtKfjfa-NA+8)(T0ZO;vXG$wtm_U z&I&%KZb=#^ku>|QdJ=ArHC!(ca2A-In=9K)c2l`r-renG_C;CQuE=ZDaZPdg5(g@T zvs|)WWZ8#CtET2NKl;fg5^y#UodL4`k9>{r*0_vhrTzOk(|5 z^I(PBM7NrR#C@xg^EQ>2hvOwyWKV1kmZ%pwX@t(>npqzB_?Wmo5qv%^yN=!Tb}t{Q zj*f}>;NLdPEJk!l4cS|9rV*Z=iA}k3Drw!88(+;lLr3RbusB&J zBh{@R_}lfv%o`TrT|wR-nyN{v!^}0i+Y43Czm5s4noow*{K&E{+nGsFyQR5N{hk%k z?%t!US3S5;Bl7X**PD|#(e;Fy-M*edo^$t7H!;^+t+I+?lYH1JqkF(YGGU;$LlboC!u61Jc z`3iw>_Vw6TUs@cv&Vp4w{SrfrSCG=b<#1}M@1jyIkvv;X)A7|(L+xtK;_kg*P5>k6 z;4JLNb>ib1y@;j0A39o+UQNTyop(i6_K8=mp|_0HJFDM^9O~%kaLI@qU`Dxu@%40F zO+L|Xa)4R=LQYflB3>Z0-WgWybs)(?=RMzhWrFOXaw_eJ8TjBrJWKA4HZ@`cPY>U~ zungZ0mXJ5aZ%rz9Jb%7?!32z4mXbVZTfrU?%7442oy6zya{IwV?7MmC*lFX0cH?Zd zbd@nZy_)C#YEk|J)01h=FN|x|(zj-x*EHvD&Z+7>wMFde#`%~%iFx=`zGUyc@A*Rg zY#%Z@!%`CsPAlFf*b98T72{#%Sp6nTASdaBj!qUk&(*8Dp;{m3vT`)?Ef3DY(>V_d zuTWo}Hrl5t^X+Vv+#CKG7nr0`P|Jcv&{K0lvxMTfE6%l%Xd-!RkYlw#E$`TYqg~AR zr(KR@oVel&+ii2WY+OvU0MF9PbPVHbR4*_v7ytQ)Mx64i@e(Row~u8FIOoPng+>Uc5=Y;HLRVB#lxaaA4A4^2axHb=ONoXUftku5EtLCzwux ztH}L|#~*{Et1~?ZYUL*NjIdL1UmSQxxb%tje?FAk-RD2Sv?F~g8Q0BcX=U}iC!g^n-#~m)&lOS5;BhfAJw3fu zHyIK zyUlX7pKtsI{Ka(=i}?4e87KkQ*96q&!|w;niW$;`)}J(e={)+0Ps)<|teyj*mPg^& z`u;IYpR|bCp}H1BsNH`1PS8m$i%|%UIw&v^P#U^iCrw< zl3JaCS5#EY3;4u(&~A3&K9Y=++qYKEPccY1H*Kj>$sXz9TbAA#b;cDWgdfa>ml(9a zdl%~w&^iOx-wl0x9k!imQ0iwpV#FpJ%@UCN@sUcO#$~uOY-zlOp^KBmaQ(GT3E87$ zY&-nHFpO?Ey*I`&J&4Lf=5MyBJr?)t2RStO6mxbJ-x`z5!Q} zL20{`@@Q_s!|brBP4n~%-_vz?r6O;@*4;Qz5%cg6wxx9UGXRLI-@5GwIhGA9>YbnD zo!85Y&I;(5g9CN)fsSKdAb^o~9)A3pgrYhbTRbHAakoF%$$=pF=32#%4NaHn2tGA8 z`@`$2NkvXCABdRBR#jjHS5CdHI`>B|w*}7d^z=+;n!0=x=QPzi2S3>-lNmP)k6Cyq zKA8Mz)0`vIV0L!4_ks!g>i|8z0h0#TGZl*8^ldT>7FUzX0p>evM(scQy`lSjJ+6RC z$$yU|gCqe*0kbBTlJEMEsZ;WGMxIkA!xqp8;o@!1?w%(NPoioT;>9K}7Y5&Sg+;|o z9-q$@_O^RB;exBx@Sd#d6YAx=TE%y)&>+GqJ7;sqx@KRTqr4ujouOZy07i2GH!i-R z1F>B#t*d8CpxNEf{2})k%tJelMMm)op z9LtFxKWeuZzWPEpU>mlviXa#?%aphg3m)2jC?2kI$*3jAV4yMK{SYUCXCdhD4P5jf zFw?Vk`$1HDM@NfI>+)w8SY6K(r4;o(N>2Gbyfw1!x$;kT`6u*2moEKDDiHl+48`eY zS-kt|bfh)KrNQvw#Y8luB8UHVg@#BeOCLz(dzujj$#KIWKTRaGKkGI6-o1P6ot^w? zJgbt|T81OqDpZuB1{5m>w~MRewb!FLXI}DcIJsJ;X3SE}JrvS2!-t;BWns}RL6^3v z8sM;Aj?;!^0&yR+lvGvAgS^V8g@v^&t>ta!I6rAgYT5D)rgt72S~0nhtz*t-q`jcx zGoWtO=kicnx?;1vs8Q*1ICit4%fJIQ4eEtKn^vRS1)&Dks`8UxCT+UA(CMBGE}v{Q z^@?WWzF-jMOg85T)By=z%gkkSI}xiN-sE}r#B~F~-T97T*L>ui1TPV@Z8mwgMndsL zgjVk9^1QfMuY1=IH62v{hq;r`5Dn_T`Gb6e_H}$H z6Eicj&*j^8cJJD$r&EN)(%ug5d_N~LZQcWS5REA&sB>)3zoN@AvjlTq-e7a#oP7k-$YhEE$1NwR|4gkPIWjLo!LyR zXWaKh%}`%oh?CZ+I+PKoZ2c@G?}4Xl)e6&gCxiF;gxI9j_j?EPE$W9}DiO3vrh2L9 z)2iNhd!Gg_O*8zWw`CUE7Jq#7X!`3)bO3K4R(d4O`1|YHlU~cJcN6(j;V_5YG9zOx zWayb1bf)&Z#(Ip_Mp>K@^80#1!_ti6I0j!+V;3lwryTPADcvVo6+Cw&m6ASkHl!v} z{rtft4g0`P+(~(cWf(Z+9gYk%>D}2EUbZ0xXqvv4+XtJ+GE>pebFK{Z;f#EA#0vu? z2H2d68y<+EU`#}F{}mv*+DPx+&EZ(Ls|+BI>CMa7=7cjot<^4EPVY$*mnL| zdMYAHksqFZoNJ)Uv#02O`yr;|<>*S!dDSk;Q;aaNKnx;s^jk-)WolE7Cf7;@V$jY> zEygamnrBl{xUh2Ni0HZ}hwu3eG7xX4e6r$q3Iynze{foK=-j2b^w}r{e|Q-hi9|+Y z-WL}XBzJYVzuVfXR2PW2jufSO;5=cFOIek%aq_3#p7E@HdQnmZjx)l}yjv_Q6Bjvl zIs=`FCZgD)w{2CXY|bk1!#O5#i0M%x&QdFp)-ez(#WZoyTFLKO4w`0jTgX7n9}et( zP9t9Bf#5{a6M@*|V8=kB{UMy9bsv!<`E?+bpwPcJ*L9@1BERtCmRfNbQw=((Pto6Z zY%gRuJi-uhwo3Qw1%yQ(FB3->XEzEP(jaPSRB%@iCW(U?rgQk1{|<+KcT<((z=FR! zG1+ZUBry@K1`1=rpF~W+k#Ed6vkTGb%b2jOLoveV8C!VaM{7s=OQZFm0j^)Ipk|eE-Oh4`C-jH_u~l!tDCfisIZ&`|A0~xuID92O5dxcD94#_ zBxaTZ_E!FNMCUBVj36@4%<`qLPe_D%rWtKyPD2L}lS(q$rsol&l)JC*%54E`l#xcH0}~o2oK8rAUTH#&?|JEM$gr8H)Ky%inGy z))U$c3!zX=G;;Q$0wtJxSy|cCl=b?pDB+u1`pd}}q2QW%8(uk$2u#?@9wzioVZUNh$ZJ=Uu@Wn_ zMUCbbL6CM7swjfXyul0<<>l1$egpy*7UU75T#>} zger4)2leYZaTwx=NB0!NJM|B9xABYdjcfcxVMusEWsw+Vskz5sX*hA5LRFrigGN3^ z-eN9sqEJo9)8+}+(DShEKUevFvaBN7>sx{m0;f_j=s{_UMT~67R=Qt3>I8E`i}%Wt=wssMF3@`c?SgYu#hg zZ>#2R7dxK8Vc%~gpLEOESI^eJD*i^}W*j%cHP2r4kpXg?Wj_7bnUwO>0;Yz+fbeTA zr`=LNa~Yl?CV#$jB~6gi`Vez|5xt7Mwl6h>q+YM&uue0+u@ zo`~*l*6iMWvG0x_2Eoe%PvDmk<}d)H00sc&_Mc#DFWhyv1Q zcg=3s@+zvtX|gjW?fh3J9DPCSrL z1wOpx=B8&E6Bch-n3c_Ve`c(thb*?zCT#ffH9W0-mNL6Smy=S;eI>Q*u!Cobl;YfQ z4o7^c_jWlC_2u(M!fiq8Ti-6$e7Jt-N`Z=v3V*0UF4ZxHawmy`s@&Lnj> zn0zY_xu)yt>TxbHC|&b4AV4L1SD#l*09JhmJ^&MN>vc7FVZbKeU3Hw;Mvo{| z%T{g;%+uzsLVy4GFqiVau{>{p9`k^Kq}J`6_kmrC;Q4wCzP$X-O^Rh4HZ+&W3olXX zeJxZ3EDKs3>BkR;>!*KS+4|{ZM0MN;WU2UG3%W1ow2@aM3w6VA*dIMU+j=^51s$LQ zPkSiQ%meQp7Dq<_~XM)aNZeWK(cnC zD_NZ!RCLdwPeH;_>`5%*{#OIB8(S;yu6d9~aORm=fX^QTeRvZj?X-Ffh1%gjEU0;i z+;BgT!c)*RfmE777z8(5R%q|SzZc&iP7Tdz7#9!20Ip5oQ+Nnd2>^M`RYC=`zBOmZ7=coJ?L@TT{zEx5Xi^W5wp2ccx@>ncZiF z*@mQZ({31a)CXD>s?Z}f0}ptKC;|Pm=Ua2TY3(p}oKM!KpN!6KJfBx=gG|)%w+a0g zJ_P<$w8EBt)fYo^l@?^zwD`QDzXa{-7j|u!S_`S5rT)c1&%5WooR9AFS37ruEXCg| z<*?6w{wVTOrZ;v~*nF=f2=)w18e(dxJXfL7ELwp{ECIP2Ms zUx0=EtQeBG?BOQ@<~~InB|WS5dvEUGyj!*@+>i^)BBEaO++2CLyTh8ntC~4&aK-Z9?0TJ>L)SzUcJn(2(S-BsKvj+Xq9LOXu)wym#vaYo9WN0dE@ijQ#pXs zlRw>R)4GD!B>RUGX!fK(G<#M)8e(|#7tj9P<-ZEte`U1LLwmZd;cKoA7?(UBK}Hz( zP4GIxAPuN7nLw%r6rO$wM=Uim=U%*Xx&S@ev^qr6SfKdjI|1RM!a~ljg`ujujh;%b zVM+AbJfPUB!i?--E~$$LVgn431>S?6Zf>9!APZix=g8CvZunX? z6lQ`fIyzI1xOuj9`>>TO01W%=wd%uRPt(Onr9csS4AM`)VaAV4W!3Td$&4_9QUnci zAF;kW0AIl<+pXyTm}TK$O*6gyDA4pdQHXgR30r)qaO$%pP{xqMe;Fv}f`c*{=u(ZT zWBR8P(LqK9^uPnp&t;$^av4EQMdNiN3P!m%CW0;FoHw3)nc-{=8f~dfW*Q6B1*U9t zfOZI<@);t^0XR8`jMOcRP|yJ8s4DiCJO!PJKrQ5cpv9E%^gxRpC!#cwz8FT>e{5Ok zqLJkIptg$(yc$T>-;V*y14_s`)W=)ZOi$0cmlMWZ!w_GA-~!xx{4MS<)-X)Xr?O{f zoUkKo|23`M{se&cI7W-8=-+xmT7ST2M{$x@30|{w1OyZZGme*^?6mXYtW~Q^wH7Bj z^JG}KSuYVC$uAU6X2f0P7yfi~J#g-Lq0nDDMs0MJOY+W_t`v4$f? z@Qq~ZcT&ACVDcLgn2~N8eqr;+Cgy-@8!9>aPR4!CKKkml@0)yd!+n-f>9n$D%>&FV zsH*>s>6^-J19FebOQ~xBQ~w1oKZ&T;$M<+|;OW!Y41$4KMnQNV7bjw9KnZocjL7i< z1V6cW`}gGd3qt>17y!JHp&Ar8B(d#7x6`jCadxwNDtlK*hgb7oV04na3}E3cOr4^? zpvRsYRE*7=x2+c+o4Jx!UcVIA|{7ln2W*UJ(X{2J!VhjlC#qKdH12)<;fU49&dKD33M2G z`})HAb1*{w%q*iEP;G4(GRT-@a2? zFrbn9K_HHUZ#9RgZGNigb^ThndL^3Cur)uOh$34qI*bYT?Aeh8i-02BMdM-29?vP6 z;knNMR?EsnD*#~+ou&Q@0{#w-|5B#>kJUvWjta`G#5lOSgROR>WBh8?q$y??)chBy zL6CxcKG>Z9K#znVS<(G42%^7sKi~bw;z)?h&JVELpQ!5hu;CH2fN^wAC_)6?e72ni z?Axz$9Z%hH#y&BnfS|ym|9JLD9XJl~_aXmZzSgNR1@09x8k(KW(XWXo`|}OReU?&Y zlsk=|KVScOe!M%#DpbbF(y}oKf*RF~9$`=2?r`^=rY*lPVSbtIGWwAIN3|1I&GL_5 z{LH#@5Dp1;(!iUN>CVoim3U=3&QQa|`CAzyrIfDT7hEa-E>K*D+Mx#<_pcEBc%Kw6 z-SQWX?7qSx<(18&()F*5Y+jHG)@=(TA}jAE{gh>Y&7Wf9cCp-N7O0yz(!A*Q$+@b1 zvT2~lc@OLhiwLWv?>?9~DWY8kHiTbzMl{`OY@)6kMSrhz4tbhxX8C){lNB+R_YoXrImWTi}>krBM4$=V|0HgeHXiALY(hA1b+B$GMC`V!2mcVp7iC$7y_ zKWb@*9?H~J&-dj(pTc==b;%c$3~#_qV}-AD zCs*t~Q4ShASQhBYqWhG&*DWqa^OpIp=dWtOhiZy*GP~x6VUWIe_42cE$iqQk&ctY2 z{fmtLkHXH4zH>hKbH`KhJBzaYt{wWr zt#T*IE2W{b;&s~=Ue{!!UL#fZ$P$-wH3yN<<>@vOf#Q z1~kErtSt%<*6d0AW2}-`wr?(ZTh{sqZdF)_cn6t=NnFGsWA1OcvX?BgCFQuZn~sE^ znX7kI)JKyPAeA#uv^_&2?2H){nbGy zYy#iW(NfjrlaqrMqDOkm?z@*bVRxRn>Yg~k%0UfFTAz_tv7U)*MY<`j^Bdl0c6}i& zWyWr{OyRlw2)q3@5^2qzTalcH+2w~8o0qQB;jadlwwR8v-kvbc$!fH>Ni|TnsN?Z@WYFS3n+@G^0 zo^>*;!l@_RwbMvJD?Ao2aY=&9uarJ(I0#JM!*UU zbp{9sI(@**87ac=^F(9_+0;#ngR$2>U+wuxnGDk}%> zT_BW{(9+VjJ3_wGV(ICXBX&L;&too9lRM>ABdgQlF&EF;Y8*MdyQ*P%|Hx+~`kt*V zKR^GDL{RE81A;9p8{5lB3h48qHums-oFfhVj(HuqwgDyUICh!eurwcZn@g_CgA#PD zN~0!gi5)Wi=#hn@_EQw!4-RfUG9RKNC zwX&py_Wxt_{dK61zAaQjq9=|N4&G#GVZo`VlD-}6hkP}SUxz+4)uOFKU1vp>l$5A( za2J4nZ+7(3z1$nBQ9%>n9EZo#T~NPAtey>V zjoMmVUbp;C>L6DSyU$G#ZXe#k*AptvF%9&Fm5&#f1iOc%GMs+3SpbZEb>+`xzn(UA z*xqnqIN&%~<>_W;r%{NFiJ1GCrdqy)=0blLQP8VpTnTg$w=Qj9D)NO+-0=v+mTB0KLRgknw5_5mr}7wNIY=> zwz>91*-7ce#DqnmAr}~Uz38#mK2-2ViyOc8@S&C<@B%SGqNmk3sY7OW(`~-q=+Ac{ zI?<#h1KSRFDPU}bAlTIjmjd;zgnu2z)wTPYB}&O6nME9Nixqh@_r=qF6qN7K0~Kx> z7ipmYB6(Uz;EwGtI0>g}I^1=^2uZUBh+D^zp!X)NF5-x4lt2gE?a7N#pqDS~6YZyh z8phHNvG`xQg-~t?qz(M#-#7<4IL67TYus;4-@rh`U_YcVLB4Bq(Qx>6S*uaX~{lDPTwkT{29W3p~O{c`5L zlH*Tw5z|MJpGHPT;w0U`K`}LB8vD&Pn?hkIQJ6e%sR*2D33%M%k>Uif>a9%mx_TFT z`}cQ>`Aw>~`sIWb>zjZa)2D?rFAH36md)pWVw$8b2%y>cB#PJkG&({)UlZ8U_jf!8 z0`SuRS{Mjia`vwWcA`hNBGBAqbld+|LEr-HS<~O&fA{X)XG&vWOJZeZ1pwQ`*x2?$ ztbu{SfddCD#Ua_%%7vG$wLRC`MrP9Qe6Iu6b8>L_U}%;T@P7eeDkz}ig8*pHi= zvtghQo@{(}(h>*xW&)e;t4luRhdm*eA1Z3GI_{&jj!14y_Z5+wZD7 z;|=QjR?mT|okVZ(2vVo}ZKl_>a4_SuN6q{D`aU#v#9p+B1bUaX(7j8kJ?|#qc^&=wSoNK3OR+cAJpE6r=y-ib%YVYO@W8PRmK3Hu^ z+3Q)E%=@_i-0TdR$9tFteh_a;>|!WXXf-?nzsOdtGMIQ$GF&y@$frB5YfS2OWj-n& z()9oBwK00+cLi+k;Go#^K+-Z^CEtB!Y>hdjJu@`L)A4GzmJ|yt9CzkI??Ltp2JQyU z#*U`B!JF@@nyd$W;=@&-)3IPAnuB|&1YN1@6wsa$emz%84#h0fq!68={>ZAK6Bp3! z;9p0FwZRFdxmxYB(?P_}&Q1_gEG_xqs9y=&(|EjnNas(T@!kctl1=>SO|FM0StFRw zYWKJHSI1}DADCnt27701-!mzoGBEgCdn@F)U|A94uAv`!28ZD%c(^oj^74Ys@LN%g=1a423=esO%-?OrIhy! z=g{VMCe4_kThzYxWK0B@CLOTzq~zoPp442+4HY^JUp5^_wCocZGupV+(R`3)#uSlf zRAG5c?r?`?*S(AJj&-O@Rn+mot(1UK(F`nAY>9SUThmxlIIAmaZFJ9*Rm_wTOjy4TJx186ePBOh;4z=#Hj zqWH}8R%Q@UWf%JK)#%WUXKE*K=~1ygZ;>J7xu%3Dq9p1FQp#R3NcNhrK4LI zC@aj*H(f^g_7m)4L1K#}ou+M;|URnk>{ z^!E3Qv{68>C&3$N;1l%7PY0=CQ0 zbmzW(D^I4j6TkWA84_Iyx~(5>M^|bNVPVW`>+2mQ;N0F%~iec1?iE;lvdoKPXWI%cl`h^ zH<#}@O~Ks!{GD4C7K%5@JlFGrEv<`hf~-2ex-AJa*DV9fR z^3)@BjrLFr_0coM{&1mI^aX_f~ZsI?6DoE z1qas&YTV|#D@;)MKZr2f6yIZ^&OktY8$d*(Da(xkN9|%KGtx0oP>lW=(&GO2pd2pcN zrm=DNvnFkR^pB=*om!R5RL86s?~m@s&Cb!a9)=fW`F^H&r9=*VkjNaP4Q~ee@Yexo zJ>Cx*H;=7~}V0|4a?kEesE>cyc_~=fR4=J7^}`AD*gV(E9pp zJIDWWT7HY9vU5{lwP? zX(q&CJCs8P2xlQk=$CvFDo9BrkFvFx9uL{eRO(-OO%F_fplh+jIjArtv(=%1${i|m zvNAKP8^=NfyWtDx_d&dS;snSJMKXz-<{ytUdqh0`S|{J0_0*}No4G)~?Yf4lg)Ndd zuwU$hbpMgA7!JcB-=&d1nSv2i2&aF?4F`}5kAGv}Z)yQD1Ybe)|Dg?V4OH#}3!ppx z<;%^K52awsX=@7*!(>!cRBXq$?(Xiox`%u6WT7Hmc+sWH@ke>q39tO#fdNB9Ls7ls z=Q*s$x^oSlJb7Yi0m+K}p418be0LykQ$7fKBvrzg`DYgvVr?iO%s)^qT8HuU?BD-* ztjuA|zmEet&HFpGE72pljzk;M%Y(=Jb0fiVm(8J!Ve?mx;tzHU-xN;zd#=ov34o37 z_aopWO>E0$up8c6CNxi5t3VEdy|M!6YkYCB#WA@O(CV@Qr>~oN-4=#Ee?S6lf6gq{VO_oFh<9Sev1#S|4bUX=`;H zi>&l_Jv{U;vfce!qcd}V zco2#J@pXJY2z%;m)QiysRdS9()RE73XQ5gmKto96*ayuzRB|-4v$^ismthRT-F2Y0 zjky#mx2*70|Io}(m8a!QSOg62eV_D7k)-&rfdw0XsgA>QlZTo;<6gri4yxT# z`6TZ^nFPHUga&3y(#?PW*6hrIS^m9<%j_&Y0K=D+Sv%G(<>cnZ@KHj^zs!h|(L*$; zh!`IM_t76iR??v}$MI6Z%XO$y_I%Asreo7nT^Zn@su)F5rDfqy($P106p6gQ91}Fl zO#*nOl&Q=*2My5K-3aGx048ddFX+RZ(#B>g=W7DcxXlmfqtSvMh}yY+LPsm)+e#*+ z5$Q_(qvUrUM=DwMnhN<(Ga?OvHqX5=vpmsO!^)+@^#J@SNz4QUef|xo>HUwWAkzo` zqzY($LyBDJ{}=v%nEzYTL8r$Qv0hPCRaH{beOr{@xbl*Wj1SNc6B84bg=NLXprkR~ zBdpE5ti!iiX;L-m?6Bt;3H9`nRK_$z}EEqgPH6YzHNzq(lKL zzW!rYzvi80T;n}>TU5=Md!Zf++uYo=G=O}2|6r9rytTGga*(FUX{_-`p&}$pE(<{w zAG}9^x(a`(^?!mR%?n-|*BW`E-hz|m5}vlDov!JfQu%KU*a6cv0 z-{XsyV4ty7Siq!Obj%1SrtEG-`97l7?bc+DsymG8(O{{6LTY>p|SkV{+TR)8s@ygyjU4+}tjYVf&Efx0-? zEjdSg1GVJHTT7T7tWT9T=QB9yw|>b}!b*UPFRh)zSM(PaqGMxY5yvB z_Z#akQ%`Dy-Kz2ANMeVTPae}A4zf>qv`lVWc=Y!;G0lfAttoS0A=wMRf_pq5^ND;} z?tCd3Dde)91w}iQot^!0sJGW%2V3Cugd808e#G0ZraXW42*@`&EDT-V>v3Qc*d&@3 zj2WAyUNjwqrxl>q9X9MzAX#eg0&;P2H3SD132F{RnVGfqm44f1O$m!1&*9{ij~gH& z=WDh9rHSw?!!Vz|GiIN-aVj#o zE+DbhCzCH+xL{5ZEA>Z%XZr7D2e=z%HteQy)ypY$|F2N~Tesmb$m?gpH9?9xjJ0)( zSE0PjY3r0nn|V(@P8`O|)BM4#8Er}!(*V{OJ z=3Y6(f^1Zd^TPslpZNKXQT2nLgh%FqkLfl=^daA)f7BU!*rJ5&@BE?J_X3Lox>WpE z&_U3vn|l}jz!?Oo^X)Bx`xkUT{Xr&}|9yk;f4=)$Y29cOyHCV5^4JHd-yXn`|9q=p yhXH(UDztj1cB46z4YWTXf7yR*qHrlI@3K!ja>NgmD};h;&=o~>g*=q0-~Rz#v-e8? literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/machines-reporting-tile.png b/windows/keep-secure/images/machines-reporting-tile.png new file mode 100644 index 0000000000000000000000000000000000000000..96989bd0cf33002a8c8517172433e16dd414aaa3 GIT binary patch literal 14672 zcmch;byS?evM)MF&|twGg1fr~cXxLgB)Dsk5S-u+!QI^x0t9!r1ZQv=T;7nq&pCU) zb>F+^y>;*XV`j~&ufOh^>iYGss=7NuMM)Y3i2w-z0HDaqNT>k-(BhEae-NM{-xBE5 zkZ%B@lZ>t_0D$`Q^#hg6fJz7v!n?^TO2Yq!MTUk$ul2fg{40{waT9fSvvG6*lvR() zKtyldAR-A%S92GjlN-?SBLEYToB|?8dX-@m1v{<5Gm?ksf(rQYf~~e zpo1lV>jn)G@&xhqiMpeeo2RLZCBV?><+VBT-_C)q=JuwLrY?Y%-o`kH7~xf{ZR+w7 z_|Y2BOSl^jk-`7teRmggO91#KDw^kuA3nX`wYi)Em2;EN%Uk9|&m3u$Q8r|=nFOs2t< zS{#AAaEUdMJQRJ}K5Yo{E|7cF0`eLsq1FF_*XAwKD+L8a7zz~DH5#NL-6rvtKc_!% zZUe>Mbm4#XBTRiJxevWat~|S*zw5x1u6deS>Ay8R`~p#APT7)L9%a4m(uHn}59r_8 zY|P^SOQDT033`{CatWcyj#c;1T<$IjyMeD;8D^ACED~8Lx*AV%`dh#U>tEBP)Qt=3 zcRABZn1_MhumHeCQhYYNQvHM9v0)%J^4j@bdByUKwj=36RcvBrzH4UB>g6xjyCM9i zC5>dev`OLyEg`)66CpkYMuqhjuca8Jv{?+XDiTR*il8C~6HA+7p9N!`!ankyuY_H~ zWq2H`iCS$)Q%x(*6b37HbLAh(ZpXni?0OA0tP3pH@P1RA4IdGa5^tEEKXX)oFoSZA zk6^kRGCR}|$Ti?)Rm~*6b~hw{t5vnSIiV2V-oeK}%y%K%VGm-bTVwqB4&D$|vF2$Z z|94c$yY)6Xh#~cArw8{^o*Hi#{beb};x3Nf7rmP*G8D+gg3<@$|7t-G-TB=e85n19 z4&qz5A8V_*2oC3Y;X38|PCeZMV!1P2pvZmf;9%840tl|uF{COTO;^)D?OF@-2JFYl zPgnqY*$FPk=F|O?RW~QMZai|@Q>b8m)V}(p+I2Z) zfJbIJNWMVbW)F_02{{)g$E#~r_q^l=H0`N0Nc?c>z0gD!B-(gp%6e`p2LSr^O5^822}QN&F{0U*6A zWUvpc`A_DI|=oJ z8_C6S*1_750s!#AD97vY@^%D(qt@pXQO`MP&O%EE4DTZx~+=Y0}Dq<`P z6q$k{94d)f*#vxi3grfB_qAFf;78-(+1HSmJ224@ZN4$lt@iztb=UGfx8|F$F2O*( z>6IVilQNgS;pXg;+ad18FD_?3%!wx1N=94K5hUxeSaWHnt1}I3H?Q2_20w+<)<|-};H~tSh7*p_>X!mdiXW)&x&O}p772Pw^j{NL^ z#Y4j1FB9x7x5NT9G`RDsZ|Yf{PQ#+RqtM{81RfvUD#GCxj1e_yk-OSGrrIBtqndLN zcs;!;Qd2fQD=tuAlcj#nS#4#iPptoGXnZ|cR&p~O{POm98T?mP(DdR~e9^YX%g4(?+tZab5J$NbH{6zNkfICH#^4zjpUg^8pdBeCDCACT@J z_L!$n&BP2A?6b&(s*I>-<&Gcldr!^c8=XWh>VIQH0?OmR=eXC`coaaq(?Lx|yK$B7y0N#(_xifi9X)Saah>to=gemh z>SS^pK5cO`>@#Eg8Ch5A8|N8l?u~$38u2O)$IlkDGPK?SeImtAtCE-mw?(l=wrk#PgI|f?<%T>cJfi_H((KL&y$YbA7L_(!#5fV zcEa%$3VEmK!Nw>0{V|i-J2&=1-+t*^^%dwf76aPo>lxAh)979laOpaFC@X%Y(2 zGE@L0CFKkfJUWz6wR#;77yHZKQwvK^F;a|X{uIbE+-{9~^d0;VTSsF3>!!bAK?HO= zce)dK)XozJ>xl2$)8^cpRDREXyU$CT8>kEKE-fvLrINC_ zIWW;qj=a5hs0?j;Lj@p<_12g)Rm%mFP0msf?YBJxozR)iroiy7b{#Nl5UPhUD|ub#1vJ5{kq` zEY2K_i(+LqUs0GOb{=~FXRJWhOPDR5Juk&d!{a}~Pxus}dgYH_zN8@yemcG*8yZGu zSia(*1O)viz_T4ui;A>N@mVczN!ga(@b%$QC^SK|uLR3Zz5&p(c)4wEjxYiM$IVZ| z=Z(p*h6q?4K5;GBwVxDX1u@d*?8HdBuF|aIj3{y6nN0a#Sd{QwR+6UU1RnjoWZoKV zTjCj>w2f4d5<9r;6LF?8^)3j!_onpoJW z!wP_2nbV#p<_V?*fULQqs;vBA(3>Ja9xd}Ps%UqDV?0vw+4q#j*BuvfaEwe3&*D`m zfc0lHR^^IoYv=PVUr!E3kqqHQsTQ)U;cP5R>a9cH(JT-YpkLS1?*#?*l3;#Zl;J%a z*TVc1R{f?K;vgE)uSO0}pBX)I&jMQ@k{fF<7Y2Vc5sgtubGncaf|1atS9Q4`NZP&F@nAj z03a#h91v6YwJmH15W^9A=>S`^a`7bMF;h)pjOT{GH)lB;&l>n5(o(IE?3jJ`tvrOI zyzMExv$Iu&y0)Hm7iMxYr6b5g2_mrmwNWFnD9=o?E;+JzKI)#Q3mD9@1z1m9Xb{E74a;rXOuRFtEj_4v5^ zIi|zKK>M+wm7yxiB_TL3+m72|33`K*F@4FOwY#r~Vui=K?+r!E(_WIHswvLI^l~d` zLRPuPLJI)^XdDyZ2Ris-X|iV-eYW}1O#Hx*BSF3E=2};}N9-5Ej7j4KA(VaRVQU!L zZcha+o(oxv-Kzji7~Y0W($Hk^RkPKB6F)y<^V(YsGy)a>;5y3p+p69#OCB+IVa~Bt zu4v=u;ij&F_6$*~l#*+4Fis9X#n8pZLRcG4Z2G!$^u;c~C}46yrnn<}g?Q}ED@F$x z&j6u^go}FicZ-1do1^o&y{z@V!SROFu=_VZp#V{KTPA@wLx)(BvWyd!euU6~TMq~L zMNy-(G0f-KoC16BK8lQeCnp>@`u10ZNd56?bnM9dq=GqsZ1S|>j3$>PUAp<9Yt&xm z?)oEz!DU~fI-DQ>&ubAFlx2^jnlA{Q_nmLIcOtYOZ(yl4pF_q@h0f(m7J3{Ov9mRi z0AvAJL_~V?LBWS5huqudM!mU#hKO<60Km329P#oVDP{PNLiH8;mr@yJlnITiquI|F zM`m5F6}Ga=b5G$gGxC;sGO~iL&i-F^-k*vt_wL^0wEm)V-^=aDrLu$pd(UJ1=Phe^2 zJt?p)sq*YTnvXFk%S8^A`_-g`nEPt2X46D)6CYjKQ8K|W$p0En7Ibyvu1|;c$)j6L(kU1zGgYPQyvayL@>cOJ%f&4TD2;b@#={JQ?@p>ha~#dlwZS{WEF6 z_1&`f3$wQj3jz5oG*DM3QM;N53EBklXcZpis7M-s=W)o@$$Gn7w}q6FVpxM_XczmA zru7*9?K{JEcMnfkClo`0#gcv)KpGgt^Lu?pJ@B(llQZ|O_)fLqV57PI$sy~O$FRIX zzQhYAnk#*f!*usTQ0)BG=Woej1_t$iYy)$d*8K^0`0+*O-7Ad4ZohX`C`;7C#Z7Ie zxe@bjic_Gj@5jZ44l<-TxEQV8dZzi&6q)txydWP&ZA42U%qjXYoNa98Y)R|QdIluC zOULot^^4y65|`n2^nRrBG<@cPd*JbFu_|SEd$JYR=urH96~eb0wDj~_GK1Z#I=(GV zI6!Dq$O3fuKn0dC$Gs2@LuWg%i6X(>=1w*c(A8-~UBpuxA z-K$SSley8c;fVp{4Bq%=_b@Z)-{}bmx;TmL89#HYe2Rt+MTchH7qT!q-K~}&26Zbz zQcwgSl3+L_J^kO3iqZ&BG`AfFK}KN-v1xTf~Ds~ED@)kpLryHRGW7S z9!1ONlJNU+V0>7y+zbx*aVGH0qwWyy9kWmO3$;4q8vUJZIS)j!!a`75^jkF4I#NOB z*2%z=b+53__ka2iuPLaNa_9Tl&o4TArXNsUeQKXODn2O*LdQ@q(XfqDo$Qc^mQLLcU(@8+_hBwJTiiU2O6d9I#&#azGG> zAHVEZyT8@badmf;K!bZ#SC78%B;(EvmHr8J0yJ}`NnM)(4q&Jz%W8omRn}a{?ztMA z@a#D7X^il>JGtW9++Q|K>LU8Y=Sgsk(UdUa6W0kGzx^+Nt(_uscTZ>i`-zi6UR-kRLfDxT| zY1tSW0>xr7Zd+8pEMLUe)P*}v$7FO{DS9bCnM+dG9JRBzkI#|hj1Lp|X$>DoFgc8_ zTrVX9z4dG7s|*hcn79qvEsMjncCId%#?uBMu27afY|b9R%hU4(79gfSI2vrsJU*6+ zq)-`3gcH=rC=kV2`#8ZVRtmLy8&=!qx8nvhvhsLj;Fs3+QqXdkpL#HG@ZV{y?Bt{X zofpkTWwgjutw;B@ylEd826{_+OG%vd&lz(&CTqn0z)i!~P3wB9zkj1V^0U1f7^(tO z%eM;3`f25w*}_f`F;;f+Ay{*x-)A-r0q0>%PM$u<<~h;X3oGnj0HKj%C?Rt>#_J@m z;;(1GEFb5E)#_r@FkcG3TzAzS9BsY`6Z?t}-d>H=9n&kY;`lhiHsev^S?W{dDX@gKH-t2{MCA#}0q!iQpLn(w(Jkd5UF=AlLz^ z6Uj7`K`4ky;^AQf9kCE77x}?X~ zRpuET-Ve3cwiW!gh^=~J{tV%uM6o;cl}<2_k)JvRS_pHeQ9*6GGg*`g3ZjDbT&$)$ z+U>NU>P#{fC+j?0Lqz~xO+2@uZdFKmLsaNWQW?owbWCH!XugZ8&i@V6u?HjHBG{WW zi6EssXh8X)MdACy>vV8S$364OPih&cRK?mw17_r)?FBZ&4XWjT$MHI7q{=md0|A(C zTR|HYV3K(4AwE*xp!yaXsMRqZjK^X;_lJ|PpG?9%Z~5L}%<`#a?zEMwYl~a5q3CU? zpOxD{n{i+(r0&%cay%Ll9CawYPU>%`nRzLE$x&sfoD_XGaYf|vT!wh!Rdm$F4)IYA z_!b^(+!-@v=G#zqx$K+UH1GZ9-bn*K#bHax{JWimiCpe?Wmx0hC>>2n%w-1dQhonJ zS3>3eUUl@c*w^an(e=-qXWE!-G%pw%+%IAU>7n^%I5W{4$y;jMoIlljT~Cc2XuIgo zUvOrfjj*dJ!l9>@K!PE$mp=9OG z&Rwua3x|s9VO~#RMpERV#q=ZmrxGkdn4TUpgpp@gk!)cGr(-!%hq^!0OdL#&^G}{W zcR1Dx<`BrtDo9dq;d@p0tk?WqVx%X6MSLHcj~J(W)qa_Z`p>+s*FI%LVJxg1^{f@= z86}oxid-?TOA|JURFyNV^q$`;1RF)yZ;nf8_PQTBb?vTjCb$HcvV1k; zDB@GFj&i3vyemS{i!uu2W!mg-7MaKNNv+P(-U1o1`#xfbonrpCi@9eH7F9F18~znN z_|!G=G8YZZRZs1&eTyl=a_Amfm>jEIYHe7)S%QoZif+sA<$>`pg=E!iLrUa&QiJF^ z{JBA;j_reQeLR>@jfT|B`!sKRwgNfkJkl1vX__{~A^j_?gf63nK%TF{^CUBi!+rH`6dD&uwD{`4hcrUYE8&?$IYbJg9KMN;{4 zV*5Mu;E>I>9PArr0u^O=CtfS_SP3C}NA>KXqmJihyFn+&E&=UWggnz1l$dw&Z}|Rv z3JwtGzd8DI5U{t6VO%x*7c%a%_zdozTPW%&2*A>oV{1~G%^V$$g zBC!{c7~iMg^Dhzg#Ag(oNlr~L*XSzX_y4}L*lH%?aCL&w+8IoHY+Ou47XB8UQMP3nhOxt-QIF#uu_#86Lixzv8m3Y-l@Mj%j-?PEG>v#$J|e+EwM~U z=)&|>`ONAoy!6Pyf{3cj$25c)VU}ZTv?opszD^jHjV{D?XU-y{7wO!kl*+mvj$$v| zO?WRG#(S^ZTYr$G%0=qk?<6}^SY~>|QhguHUcL+WJ~63K8rD#+>kE7NJe-S@Uf?i# zP0YiXfSa|ZyDu=u=EXXMt{}~U%+a0fIIQ0u#`MguK0_b=iE6HJKQNbZ_hcGHdDLra zVhs0b$KktPi$_sh^PP^8Mv^o3+R$>SlA&mx&ntCMm^sXx7u#i{5P$cOAz*y8<@!2S~CH)@`zUiaz` z(tL*GbmNL&Y<|LP{N0|J-EM`>1_@X|f7lYvLz-ZI|1VoLf*rqpZuh{rM>8eQ6pArN zdOQCayc^S}g7~weDskf1H%m8h@Ko4<_{hre7LO_cmjhM0vQle3Ce4pfyavqDd4_j= zxbI+v$Kc3AGh#prI5#%u*6S6hZ}w6`1dskL*mPGmj#E{y!hm3uzI=jt+4IR^A=W`2 z8tTI%y~?Dc`(93Q&dH?*>Cghf<4Rz0iI74Pid~KK9s|t_cAoW8GYI=GPJ3au5(Ux$ zoLaW$qTnYja0G{1uO%iUcj^c<*`2$B9mtSjkq9TXCW}&5@^bzSd8mr`6iEl|Y)e!u zt}NAE1W-w6HTy8*#NJNNnmv?g1!8-l8m*zU}?YTk2%#Sv0_ZG++ajkryh|l#hDj(bjS$!`g^3(PpQMHP6 zS689SI|`s=HZskZVYC{)2#k{Mi~P4`ZG|#woxT^h(%2oTi&_xDJfsb7TC_cD4QL|j{O za&4GF!_V&PrH&hkF1G(Pb+r*qtz(Z`bKizNM~4C-7h9|=j`Yg^2`P&5L3mZHlx?a< zsrY|FdWt&guT7b+ICOzZ2DYO1Hc2}4zYx)|t_Y{wtkINj1Zd)JZ8epQQ5BQ8Of_FI z%Rf0`@&86_2V*wVI?BTv?ow>18pKKspWlkDv(f(v;RB#Q&NBQip%Ke_o{oN+y2eM0$1VUzby4@yzPGA z?ypPc2UuPGf5hHjjiAGvtx5E~0-8?rDwYNBdN) z9I#Xt+`#%!4+GN+Elz)uB$4OXdFb)pl%IG2Wxqeub7)q1D7?n5Zb0z+ z;Zi-qUy#&_PP~)*gy(cJTXXKX$UFZj7o|Abtoc*t+^1*{%d3vA`SsUuFo~S2CAN4y zc}gPir}XGr5n)c+d46st%l*hoaMQ*ysRiI}ww$n(WJ>U@9#! zRAej1jg)Lj0-gCBsn_Qfex;pa`T1INn0LT){I7AzBKiA!NNv&e zq|`CsQKc`XvBOGV$YkGSqmIf(mRFkw=n0A@xD5|SqE*GxW0g!H(y^yvT53P}aYseMzBae-@ zpn6D_Py1jBSzgqrE0&JE%h=rbRj{5q+kGG!xrqTj5IxlI&VO5-FI^~VX+h;*(TJhK zP9iy%(aTb{zQeI7*5IZG$?hJOU?-UUW4r*X&CH$5Gr4{^wM)w}6iNo+x7#lKgax#_ zl9mNOLLfA@f8`xkNGZUqK=hz?ryl=RreuPuzb(BcS8Jh`Rv<=6*YViY%s2^qdy=k# zR-j6&Wky%0>DnqO3K3ABSYUTNyl=0*d0Sg9jD|B9&ULbn~CnAL8|SsoD>BsUuyASBPYK%A|^oM2l*>7Ll_(<7)P3dNyQJ&xFk5Jy^plqieAj-&I z__08xxYWl9juh2bx2~V=%sjM?J>$b7%>)HLe&&51xDEAf?NoHx8AB#{N()vZe@gCGqG1x~0f89JagkaRk*Zd-_#801sRQ9X2cE;EC6eeyp z3`0Nl$$Nd_rOaVL^tzZnYWR!LMfhpcAvv03m|&-it@iK4qgH5BeO!4MP0@5~p2zD| z?|5X9``%5U-T3-j-uqwyi+JRIqrfa$pE#l&H;x%n88sYJ;`j!Z&ewe`cq*`7J_cY@Ggk) zdg*>iTx1Os$iTGL`f;pnCV<6TV?VYK z)2!pFX|J=L-}8CXHPv5P7|2taTLr@UWg!WT{)V|l*DY(}WVX8saV(B2d1cn^6cgBIB8sgbs9tsRnZGKZ3nMmOKmQ-*^-o)ACIgyDCQA8&(p z9x7k(zk$Y*k=~)^COi|B+Tb?3PyS&`g%LzCB1(5=HVtYBDW71!mpVq7Mm=s@^xj>c zXm<)3zJfn0V^*t*$Fbo^XSFaPz-W@**C z%m=2bTpK0@+&EY9+1-8=-K6soL=i~ zb4qfT_eB}s1e2#@+H{PgZg9tZm?z%-TH?d5to6=sQr8%=<~4V-C8 zpNiFhjkwKWT}@o(Zr2~}&h5V!L$JEkKNtGG35${l73^0 z!EjxO&`D2RUWW3E+^5O9Yd!A6)R!l>R?nPDCU-o2 z0-j<{ZM3b!;TjABe`4jC-gp#Pph!0^k-Q5>y6pSgBXVbwYQ(B>F6GO~8p|pF zs1{fkH(tANwGG4T;3Too{>?_c{3!+|wbx?0IwOv*=vRq6`SXKQ2Mdqom=ac#Qm!}@ z6}_{I)grsQ>PxGR{R-YzYHa+QkOqf)x4N22<$122mE|1Fdo_P%Eh$_J!%z&A<7$gp8Imh(imz zdn`i474S2tS`4J9sh48>gNxPv7kt;}a8})~01Lz#$C7lk1M58dH|cmjzhh4d%N&{x z3|!*1DdC?lcSsH<;7entpgu5{7J|yuPUM(Jd8LL;-*dQ}s6fvAk9te$=e* z3_f~S9g!U02TjWq9h1D`$*s{9Wr6;KH8KgeWKR|r4nn_x_@W}Jp)q3nG7rD$`lBnC zPeq?lrS%M86ErYP9nBS*Zn=t8{UAIqeiqO1I~b+4w_Vu$n3#(cz`1{?v7@uE%3L6kqaztGx=<4ak>N>0cx*F^t-;-VJ18`vd4MYxNw~E z-XA7!d=i(O?=x5~?Od)_jiHzI_i+)4dCifxs-tDG=vb5{M#ktX@Ts;Er(+yp$-)Sa!{L#%d94z5Gb5VY&U0m4hH6akiuBkEH zZ`^xS6VRPKF4BKoseCFeD___o?60ldv*sQO@Oz#}Q?UMLAf}4v;&cE-=wJtL!vUk)EQ%3eLRDBs5g@^a0 zV9B)<3FzS-lz?T%5`|SRc`vTP*f4X#K3)FHQ=JT&=@t;>2ehO4svRgs&^fX3YE+`#Z3=ETvwV&_fTUtdT@ z2Gl2o_Nu4Ktrh#CskTiIQBLvvxD)DF!H0s>J@W*fTk3_1758lyZs+X&Kzu+8`0>~A zkw-{&bkc(a@K0A?i=uRlN3(|Ry8>G3J}A5xRWlq(919_S&*SNAU)eAuCi9j6(zqwL zLhPN?0)5MZH288m?SWVPSf?UK6Z%o5iN4PFRbw^AYyP}0;M$Lj}H-0XtZ)2>%och z0r^zOom(#3lI=@^?7JExp&Qz4)|1840%5~!%{amedKziBl@~P`B;a)2%@+(}rnf*t zZxe`FKnF{gaU9s6nf=32PaNOpHQcofLp;_#x$AqWD(DD_VAcixPa~#qq9Wp#Vg>tD!9W5I`g zG>pEbBP;OLMM>09a_nzMPuucM*}Urrdw3J|R(lihB+9DD5|Y+8F7IOBO2YW&OWx%0 z6Be!4<4MfDl@;doz3joBW#f7N+!c>n{kCHSzTO0JK&`uB_)T$V4dT8|s|&9E@()6j5f}jL5vw01_$ejr zb#Op+OvU)FVn;;WSR){a6SV3`HizPp7xqs*2(UD-E{1wokRl}$o(?@_gh6>sBklg* z{LX6VTbSD@?}xjzH>ZEhDvCT;;?2n_rv!K!=M1vV@#vf3Bqw@Y%1H!h8C@48XBJ@+ zU+tue>Msf@mp-p+{+r%5fTk?Nq|`$^q*e&db^Khzxus@XsMTn(92#3S_nI3Oh?Wm8 zX(!^?zNqPo0?1&5PsbdP8%OPrt4h(T^xaNB5xm-r0E-H{XwX{DYj;g>IrB^hK;-bi z{M6oB&iEy1=O=ZPd|S$RNS4AKEI@yu+L|XdmRRGOuc5R)KXj21apFgpyfp=+uqr=T z?C8iNJ=e8BPZ-v9ULB)mt<4#v7dzDGcDref8!{~q1<;vq7qaoAwK{j>=NZS2%Q8a?#2yRPFKd006RbdT#YU zmSYCa(3^XKv#d0Lc=-kjwFHJ}o0u9?97}tl#TA028&$t_)cHoK;l}?!K_LVMk#H&_ zw2!y}BHLi2t2)`|yb0~tk2FqSZw>phh3%y>cVa0OkiC-1 z1q;uSPSca9$829scPBG_fhwPs>Jr^Us^9rwE(5p02yX84pAm6gH~xH0?nq~oiX#;2 zSHn%_rzjLt!RFK{K5+9L^!xeFwEl9NLsN&upg6{c zKyk8VHv%#Q`I3f0JW0CKg4;pd0$y0)F1JBOnrz99o@D_ZeDmN z;Aq;Iv-2Uoi`$Ii>_`Oa$l3vFBN6ldjF6`tQo#ovVQn&h+Vh(Oo^)Y>`wvr-ltkQclq4iz-2 z)YIx{{JTNp(;DmPQtmbA!=V{kLuvlr&CRLElftMg!Ed1l4jz8ABKzzZGonR$-w@ST z>fkKB`KakKb%`=EzY*u4azQDH*24UJ=NwxoD)|qKVK0da_yzD~F6719EOnKPOO-V- z>Z!7M7EiR3m80)F&%B{nAYJU4eJ}^12yERxPTW{v_=qW$`8|TxRssl>t^2IrQH_ao znShqG^C|{052M%I&RR&j^XlU4lK)keMlLYqG5`iwvP_$1%4J{Z=>uOmeXEbXLXmyu z&#=@)WMBLWzhRhHKfAKpSHhOexd7zquIbH)Rx2fsAvH%Lv9}f8kpZ{Z?k33 zOEaRkkO%Hpy!c#y1S{9`kGiu_zn;L@QxTL6mrde)x%%-P*UQy#@mqb-7E&t&UCEhE#hrM+s54(*!=Ud+@H(;<@e*R1AX8eC~fxzeIXYI0kV=x K64hcR!T%Q^CXpHd literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/machines-view.png b/windows/keep-secure/images/machines-view.png new file mode 100644 index 0000000000000000000000000000000000000000..5b5fefb5ad508a644c7959d7ca1008316cf57a64 GIT binary patch literal 70885 zcmcG0WmJ@H)b5xlX@Lj=1|cm{0uqXXNJ%${NW;+5p(q%HBHc*mNH?e`C@^%VbTbk& zG@SkD`+nbd);a52XPtEpKi(IandiBmeebxgYwvqrKU9z=Bc>rnp-^Np_wOpBP)Aiz zsKfFnj>BK}t_e$^P?u0LcWvrS!4h}?em#P_Kx7aDqIZEtDzN;lx{c+qR z?U~EvIIIwpqcw5(pkvNA%r-g&R}=oI+C4k!LzwvE%PD&gXNk-jR(roSA6C9Em;O;9 z1iRth)XK1kpRc;<&oJ{_2i@EBvPl?|(7Gnv5Z7CtFtfI@-i8Y@(9j{Q`-Gzp!IH9~ zZrXi(y4cs=ft8?jNUpL$ht3@OT)xnYaUbgH2!waQkD2TVcnIW2S0eK8pI?4GkI|_> zE&xBvvqR;Dexw&Z`uL!nmWTRxKcu`p&mHZ}q7d6QR_E`uzq=(R#BGS!1g^y^>@=UU zvs|et=|}n=gRu!5#LsujR=eRt7+?DPTTVAe!5c!!>2GD|RX&|tooYgtKD&PG&u5F= zN=LmarGhSIDkV!rU4EVIwy~T$Qti&p$EV8RwV6a%9?r(pY&T9#oJ#xi0Uvei&EI2h z-o8~ySBRsTazQ@+`0-;$T=fQXGU1;rxA5?{189mKDrYR7w@WcwyFO8 zm1Mg?d|zosOfHc0&r-C*aGp5#?fzD;p2^#9s=+Rn^#K=F*Vl6#biSVZ^Om+Oxyb9c zH-?=J3KN{0BYE(`Hr4)Hx{7l+glP;$=PlE!UH)u ztB?s(V`Kig6{XTopRVgwyQ#f=`I2+^kLk*ihMao!=DV{aWOo8C3Mu#I>2)p-SH>M@ z(!l66o1NJj+{5rzh2G-9>r5ORa=jRX-b|Hri=p}x+#Q{rmZHZEau!(N z1%Vj(^IW=Z_=R3h?~E7>1_Q6EX=={e?s4gswRK>RfO&k5pFDBG)-@qduX6s|>$6U1 z=kaeR5%WwpOi+LNw4|W0P)$`eWp#Bm9IanHH8a!H z*{SmE*|YGe*RNkgxTt=>(?kn9Wr^*rtH>va>BWgS_tbdqgvQ0?4h`v2Qd08&6pA}Z zLelyEs&r^rShv;8QHaD0up?sMAMdYD7hIJNy2ipHZD?r7*>?lw=e4&jW@i{zQEcNmpI9aw6a1yFPI7N&!&!4AuP$_P(MqPHFW-o+ z=fWXbJG*>Fp(VRh=gxs)?X8C^icjkF6PTEpvn2h=g&k+#J&={vsSvV$1N#>5z3(d1 zv9~d*h+#o}CgbGcX*axYYiO8+_{^e=RjWy%5b4X}gXHDd3DX6ERHfF+CV z>=DcEzTSOIs$V^BwASF>y?YPt-+u@JIX*sq?)>@mjErkcjEor>8TWTKa5nEt_|t4^ zwxk@Uo9!$OyuH1@*Vk8gF8B3miXQB)4HTJw5U?Idx%ZZ;{1z=q8>E_ujdF-$#%{|r zdLvpR2928{UX|o3$|@>qT3U0Cy5Xlk?T%4+zfsnVS!Nz`%>nj2B8elMp{9q5;ND;oaN1@LW#wU97TXf%6T5=<8X|#(Z8$`8a}EneEu~ z)V$^b<0g(7A@IC7Yu@Q80;Dk~5%-#!n#RV)0$uJH>~s-rTE4aX(hafZI6WKFg~bT@ zIN@%qI#>eJPkY`+R+i1aHEwu|LbAEJx#FH79%3rm2B&Gk+O0syN*~E+1+IyU*T!pL z9%ySvPeor8vi~;5+!3}h0|8kKpOaAr3wF|~nBs>oiDF$f6> zJ&=)6f(?dzJUKRY8Dh)2zu?~O+qZ>Xem}}hhzdDJLu0XAYJ#PaxxqjynZLHSHZ?Yu z^y0;fX%}t5fEO>0t_l13`^#p{^H_4c4GIz{t%m1T$LL#^6X@ybu_MzEqu?q~5t^z- zxj8w*Ad^9c!!m3gK71HL%y@*NSUOmIzf1r;)OpwKiph)yK! z$B+AaQ{3J>-sh~iq}@^u-+g}pZExa}(x1c6# zxo<3osq%kEtX5D^z`-C!kQ5H!PK}R`-^OFSbD>@fU+nGe)o>>)z7Gx#e)Hx{^N7Ha zXgn$nZ_$Yq=PHr3lsKodX@rby2>3)oA^(Vk#!H+)aE`rLKMy5MQHUNt?@(x zjxiIK=~R-<1@!{I1u z=%$rG4CF43gcZNZ$tO%KEbN?|*edCd8nz3@h5e2zr>xtREZ>C8a}g!g|Q@ot#Q}yg}^n}lNt8zdv33{M;Lg`ImU>2ZvPk@)JgDI zeXTQNOO;l%5YHMC8WF)F6V7D^Syl};O7-ExOEPTNuGwBwwd@LXnT|4@cZ%0Rm*1=N zBjdGvNlGgq2Z{VmKtPdIsmGSRj2gexm8(~=71VZib_$mEDQRhq4Gq$kJvmB{WmBnS zpfG_Yn(2>oSFeYpE)iN&tEzPAgdIQajvJlpL$Cys3?yd_C<9Zss@*s8digi8HeSh) zZJ|h2x7^9i%*>nz>{!Qt|G@)ge{wpG+n=FWV`pr-PQQkrJE**TM^aJ^mJPXphJ<8h zW(KOr04bG#&4^V=Qc+Qt2Tm2I^dT}bgG;Z%Y=^K^T=HdbaB%8yA=E|UlPB%UnCsoq zBUP^CJ6$t-7wG7$M_yeN_Zk}NDeKp)@hIoguQC%-Ff+>l*P=Xi>eo6y1HVP+R<^ps z$fH9j?O@1-uul@n(!m10q2IpU^}l@iWR1*~ek)Rge1`DH%^{}Z zMc@0IUAz4Y`Zner1>6ns^l{z(O#M~@O)J&{F%YhFetl&fy}(-k z3}G6maxH`>?Jl;|So3F1o+q-JH6%Fy-ek<};d5b&p8Pg_%uzhqq--OQHt)=Kco z%~7m<>RLN(;&Ew^h*S#mq1dwb!FI{U>pddh+S*zuH1m2#p1_`mTL*Fv5DwKtX@Nbw z1hwb)+oqmeono6&G5-lEDXFZSoM!XZmw+oEIYd`mz{3KXnru75bnV)Y-H_eibrdm8 z2x@L@d{791ZvVD(jXsGvL|0I;YM{p3kXr{%lo=&XW*8xG;A z0HX>8@2fa=SG%lygl(i%o%z1`E>FzM3F>voJo!X`K2M$t;HB6a7PvR0iCA*W?ADz^ zfqM6isR)CoW%~8g3Qgu-p4ZRloyl#lEY7=JzZ@xO6K{O8 z@g>Q5K95b?rW-q-u0rN9ye117TC1-JYDTydpvK0Q76I`Ma5k{Tqkd+{GMDcXpE&WU zC^;kJM}fTFl9_@^nw*lWt84abcYCgmAdoH{FH&q{qw>b`FuzsbbpWtx!(Q}MlamXWZi!p4trf5v zznhwp0`T%74-e1w_5udKyVh#iou%fsH5I`R2~R%$RzE5E_680!*O@M|XrQE&^u?Em zots;cm6dh+6b9UvjE3+2TPjXv7Z;?2W&k8(WoDKVbz8sg?$5}?lvz;Fu_|f-kda2* zs|xO$4fJJg?;cPfdE>X6oDs;5v5^n?@Bx99*SlDNn?UGUhCHu=d;#Rf z&TTJ1BH2wbYP(9@(x}S$Jh%R$ZA(bV85uQ6uPj*wg{O1nhfrt^fQZOdWfO>SwFfo8 z{rYFE^A8G2opJievPjNzIcl0jf?1|p6KsT}pu`B>?TtVEmAcyG?Af#6(}}RpO;5qE zrmvrsbagGCis<3D?9ue1&djERN5QINQh=x`_@|b>0Nw%2YpzpKoIe6M=mYVspNh>p zn6|cu2qV=!0AdU-hxsD;own}R7his(dQ!^s=h<0VWtfiO`5V%>fAk z2x@wIg4e(pbwdzc=TNzWnyzlnR8vH@PAM9x2*ppAv?2b?A&N|HjyLBUHSoa&Wz^~% z0n*uc`Il{sxPuhp3h$X)X<+CrcbI8*xFGqNj72d%w6wG|CF@Z#z@G|S%?{M<^zre> z4ky|$-g}mit-Cx%AYh|~9MX=H(L9+8R8pw~F4#=t0a33eCFPfr6))|*JHZeZ8u}!U z_c?Lq{K!_E^N5nZemwHNB|s9Cr%xwA?uZsIXpIxmC@(LM=C=&*v@Ch_}eF0NHwNH5p_9>a5*cvOyR`DG6EWQvfk&94$S49=)jB zEPS{E5OSVw`9}zz*{?52DxNMyS5;TzCm0U;QibE4igQQ!Rn)~bH_m6(_i^JTd)XHR z5Sis1C8aUzL*r2r#=lH?nkb^({i>i~snXzB&cZ|M`8B4}3P?C+fH0#$tU{137&i+D zQ)+7J_H1%+^W6c62k{y{V3@!r{v-r!OnO<_O<=cWw_@v0s3CD|8t*E#HjV9s7z#~D zun}X~iN46slNV8lF3o+7HBkYmDzyK!zrc9DElD!h$e9eB$HYa|01(YXa5Sxh6d`KN zOHXX%yai3|36xpw$K+(E?RE1ALVvAyZRh1|GUL&h@h0wC$AP-9n{oon9}vFKbCnmi zQ-_|m&St5$Nb2rgV0u5sHtQ!?Rnj64^i*yd9_7MYOFP)%Yf@Re`JW_;@!l;?5ptL| zTc2&8?=MWBlFkGx%_EwLRVD0C_2&57aAQJ}pVGi1$Y|3A6*Xn*6!%)UcJTju)QroBs2;|h`Eb90#p!)fr|^{?3+Cn=Oxb^@IF0mw9f%CHX~ zCRX`=k`b$*pMYYQ_3`7!bEi)mQZ;3b434d}iVN1BqM*Kx=nB^ME?=RTBNZg3E*i+y zI@B7OZ2>bLFV6QD{gbGNEjuCMns+b)vu0&sX-Fc-dJf(&YrDj$U!_^Qg|*=jJSQa| zMEj+}Y2nX3_Q9EQ8k?FH@cXRn>s$ALRq;kp|Rm6luKMydx2 zjNf{#en_|@-MmM|^*K9wA=Z6^@w~ z+-{0E%XiMx-2Ql4S8b*-e;^y7Gh8?$4~k)6UAee0Um}Y6!d5XAfG;}F8hZ`Amp?wus_D{DSGNGVV^XS=teO4gzIVD@6sWmA%reIU4>}om9>3_scblHOA;y=@T{^S0 zlncP8si1auiW`)y8zf6KbLn<;SFT(EWb#|v@+%|g8P2#7Hg0ZbZIa}gtPQrzR)-tZ zqP_uK!A^EPso80k!;wfF!({?5@Jc~Z0I;6vj5(d`zGCCOGw62U_E`0!O^bn!t|uo7 z^)AaolY01I3G^{-3!gqB)~iwhW-B8>QV)OSkVjR2{dxy-kx&;;6Bg@KfoUK7M*Vn1 zb15Tmg}t`$&WaR8^!5XJc{PY(^*r6Vr|vXwd5(VH*B5|vG1C&)3CIKCWB~D6Rwq=< z%`+io4n+$T^IWKNIZi>Jlaj)it5?}GCRSqF8Xw-!ZFxnY7|=5?bVaCrh+2tAn7@D9 zI#4SDFP#ENbg+**P?wQ;-9It0fT?|IR+&^#pzOIraMA>|+PSpuYO<*YeoU_3$Y?L% z02+ODS+fD(x+OHl85L^~>Q?8k0{$P}YH^;Y3(y7S69kU! z7U!DeN?grgs)OhL)(m;m36=fa#6*chhYnRt1c}7@ov7E;PqsCae{CdLwca5MAh-)6 zny%(VdTOdr9M%+;iqviGI!1POS;%p=kv#P${Jai!MnxPAIj>!7^Eq_n+_`g;4|%_7 zUG6}9$!VWK;_>5;z~|$<$_4Y%_vDqVTUkX#hj%{-ihYull(ggwi3U^*FnZW^CN5lH zb9>ujcXOqBGXoSe{B}!?zQXBZ_2oV zEg04I29)DgwE0x=6zc=}BnAcs{{1HrH>j!7uX1TmeO_QxA7Dp4-gX9&1VG_vGIao% z$n_v3JUk7W5b2^8hyVr{|97&oiAfq^X>djv6I3yv)N3WSwY4=+YLkHEW+5qf9QY}M zh;}QzmzA}1=FFM#hxau?I*sLx=Q>gmdG0`8j4 zk0XO_Zf;qSZ`e3FoihD@c4up-X=`VJ5;L5-&Dt_he?7rl#P*lZojZ3XCni*k4)r~M ze%Qf9&eNO6_8!EAfK^|j>)JE|r~nsq!pFP8n+qSALkcxcNZ6fZL8L9npXs2!L^(-; z)ctTmPVnc?p9sF*-P@zvU!lKgD*lvrOOrUC?VZtvl|ZGxVyudQX{-TFbus9;u% z&jI)YVCDzN+|EOG{@^AT2S9neQw?HJG!P-^dZ2?EE($wlARc7YK<+RIc*+6_43c;0 z-4}TrbfEJ9mxyEtks1zxL>qazJwqwk5el{}kC5{P$?ve~sQ?kdAG9j`#kM9tM8mzM z0%=m=sUy%K0cf++r%ywjDD3*cqi?z+!G8Jj?GMcIH*B5+Ai^BP#*?Roj?xwuS<1@F zpeI6vaX^bDn)hrKw11FCMhpgcegTRGGg1QLFqyy5NW$d0E&g}rD`auHV_!qAwVj{ zUVFjz^YY#6)P@gK6t=?Oy-S3~m3dE&*7WZv@Q?4`ziXv&3WSD-TL4Uh>e3Cq)oe%w zka61I$+|Ul+aJi{ARm&OLVx%{>PPfG($INf|I7URYEZx0hMh+tUte-K`1tWk`VL52 z3;R2`-o`L!1D{I)P?iBD18%d8IoRfwtwgFN(%LM@UD;hEIVvqB1=6$Z`}glb3RH&5 zHsZFxxinfkn)E0}1bHvQC|4(c!mIYw+QxGHR^nvE>=mu2SRn)Nw*Xomy$(02wZITy)-?~XeCe2%$iL*asHH`I132uQw`B%qWZznhbxGi1nXR+}rc5vLPld zvF3B4${GmmT8E1uyKd6D5fDHMut5RoVu3BxK*k`Vclk_ertdmM31Mg6mUw%h!YMoT z1X@}7Pp1`{J%RM1+Q5CCefj79odu}Tcbj7>oUDU7#aX?jk)wGTB)rW{7v!x5p7=1W zgn~RHHE*)4S}DJI%tYWc;yW5Q`yk~V?rt$oygLC0@(W5d~9m#3A7K&n_h*Z43KU}lDxhA>qIQ>@+-Hr z3qhTXI`m3aP35~uA-|0I(V;#MPfvWGQE<1A!xGXboob{k9W{cU$UOAo;tmv=nws#7 zg{?>rHGB#>vKxt}#BHQszkY2_(ng^^zxU*BZf=%yphhbxy%*b_y$Yu779u@i%M2NL zu*AAEgh{r!L0Qcv_Rx{z*O-~pzWWo3oCqq!N63_*zCjm8lR|9sQSKl=UrvtA35Q>w z5BXpE4wDRgN0PHd>-12ljHtrP91=zVN(9p%@)u36H=ryCWBv>XCdP`%syRWDE2g@| zB6leImC~_Ms7lZ~XvAWtG$@cRc?MD)?d|O+7Z$Q{UK^F19e&<>3kIOaI_GxQ@$%nj zdja6M`A%)OH`$+=iJM@t&UjIG?e$$4MbOV3gn0#dMo0|MTY^gA=o&4FT-U5s-+hU{ zi8L2G1v}ntiK$kfd5Wi>o>=7&ISAh#V=5&eZDH=gM;nf+9Km7syHDB zsfqf)4+#kd$@H}_S^)gBV+U7@>+pKP`sc=pYCFGtDI6z%oEF{u7X-Juhi4xX?j%X{+*b>a~ag+z~dn=L|-?2zFe`u<+RX)O*PW3a!~>-CE~p7$bOgS z-{}p330Se)RG7wkBRd9R6iDTATc1^05CbUQ4KoygUk0vOUy}PfiDKOWt$atM7>VQL zv0hStmgpl8@Xv#NKK9S5QCz>@jixMc4xd0}V8fova}Gm09EB3hfX-`u>XP?wUj~=9 ze|B}-?^Ci%#R=M2$nit{c}r{cB8yt`B3Ymu;~9XH*@%(VGq># zf1VOm=JUU<@4va#e~#e%?=K~hyoz5=`?{h34&z)Jj{Y-s!*>$y8d%?38AEuIG8^AOeFCPL zP^cn7cwtED9Wn=$D0)Ti&@Zaze}*uYD8VeHPcR47jV+;PQ;_$XIfH@9nAr9yR_FTf znai4%I{q<8qSom&l&$RC+!_sCOp46Luzcd5%jsQ)%LyE&L_WLJj^!Lip{!$0XDt4_ z|2{=sPcju~*WbP3`v59ak>lC62cBzKK{U?2Q(jOegvgNC=eVWpGh&9UTxn40Tt#8+ zAAU*m@i76q@Y_O}T_oK?T%}DPjBmy#m3V{8&-+G$zUA)XB+!j zsWE@tO5QL2ud|~<041J|BCZ{0`!{Nav*=T(RV;g{GX8b-rqq=+sk13DG1W<(Yw%A_kRE84YQ)y7f&yUcnvjedtDB=uPPx~?_M z!9WMddL7pq?$oWgf$eHU@m(qf{Z@!BDiuI&$mI<=EcC;NWRQDASH7J^)5YwNc0nhz z#?E~-23;Yeudh$P{x?MVveV<;9w38Z4y~drFy7Eq0V63EWsLi!at%IXJ*54ktAXxrhb`kFb9&P)BZw3z@>_3MM^bd26TK0!{d z4jRXZ%S51w#f697V6L|28#iurj(XPT8zhRD_(C`i%ay6jExLfah|Mrb!m*P5lFqwqagGU~s|4dwFtl(v64>j|Z9=*?@zpn*8!P$i4~& zHUKVQ%#E*6$f8pdqXbRBa84a5O=1+@7AEn+(T9H_38~HGB2YD8K;hg4!J-7sY>EU> zPcoq|RqV)XQDj(m+!M--{L@_!mDv!rHV9Femj+8kIJ}pNd%G|OwNgUT4z7#&4ZtwA z)ftW-mXKXrU$>fLMv;TRCQ|bFJ?g6Wdi9FO>RS}dA5;|Q@vjjGdHJT#FGCHlUoi4s zTJ-k?27HW&D5fqaK%b`D|C}1G+ORgSL||%q+M**x#!0Mpo17=JRmesa2AEXs?F)>x zKzHfE7+_#s!W^Zw`rYo&R2f#Eh^I7q#qGJLZd*Pf{a)a0qsDO9q&Clu77DW?0D=v! z1aSl`#;H>x2V-a%1YI8_2OUmB^_K@b&hG3nAz=!A{+Bp@T2+Mj=ZV6oi$J`@E;K_E2vO=P*%*w>dx zW~nPdny8RD=T2o%8;pa7OgpAkM4D`J4}^C~?hyFE0_f2ErJ$=M33+_aka=7ND_94r ztQ}-qcBRg5?9f-Q zTP$vTL!R8>2}};ouXuyyEVfpsrYDfm4Q6IxD-F*Rns9rC1Tjt-1ZW_B?NFVNkdPWk zz$JsT3sq?>_SbSDyx&(SS-l1LZ?iQtx8z(7Cl0@T{komPdsC8AyC|bxA{96Zv@eNa zxCIhxO!-TRVKjQ~I8@KBQX2!Hs^3yQfry93#OUBINGu)+V@dGnSPbk4_dVyHt)8n4 zTGaFB&mDoLWCOYhNda=$^c0+d|G@pr^JC$^|McaaDy#ic8^p!{Hm@V(!8E6D6XqVc zech=DUelJc?uAr0#hC33ufRq8TxY}TCej6h`35A-feJOG>`|HomM@0!4oItUVx9vz z$uMem!Qa}~*OwE672O!RDkE$+{-Vy(471IjyM)JsMyP4RV6S!{Xn9a`#D{E} zMjg#jyp(iwxrjEfuz?%JK-U-<#Z|nua+jp!T*d{!14Wmiu!I|wFFZcVR=bbK@Ed-8 zLCbufXLD;Ss+ug|dTQFcOU%smvG-)MXiAhc+PlFg>#c2%l%M^~mj**EHbbc3E zbhAMgV841bS!qzrvWKIZFklJzyZbG7&8%Y#OjBv+Y2j&vrMSb=CKYUnQGx|P7(gy& z;>+j^C?wgiF*17%K8O_pbqaxM;MjjuH9WF zJDqZCW5^+VJRTA++$ap}eIcid@5vvI!o3UcvCo~^24y}ATuGMVh;teRIcz)x0IeczlEuPRFqw^fhA(_kl1iSElJ@o-OD1b zP*GN1A92S;d4u;IWi`XkMnS^53wa%uPz3$GLT8wUdkv`pojGN9wGy%wKaBA<-7vcO zTGi=;NptMu>u$_d&{jeQdAE)Ui;30rB+*LUd?ao)3;tu5JzO8aNyd7I7Mkmb@bB>U z)vJdfs{$2+F>JT~6PIFNo>f*;OmrS`ZLp_Ht?(xW-IGmBOdoRGbP3Fomy(v>ApTLI zd_oYeU4Q8-NauiacnxY{NLAafm-@hD5o3zKQWQ7_kprYK+1Mp~&s{)Juva$> zE7a|zLn?VFu|_*f`hk08tB)lVydshptb)w?Kp4?hoI*wZfRWO8zMdm)`vVnehGn^{ z?*^V5`gBc#1Oanqjv`MN&7fHRC;a64?^r>b*)g*^DblWxEfuE*it4G(3`{>*=e%nsPTni`I26ZYc_)_6%+m=!s|cJZ+8+X7-gC|OXiw7 zXZZKyleQh5qYHYN_{+Zh!Ivn`%-f|- z6)L|}(4TBEKU5^CK`g-EXa{vT128^cV}6@$70du9X4)n^8}I^ue5NKua6v~X|3qhi9bjqY|?|FumIF>ZcG;2qsEU@s>?VmAKu-(#Zc@apR0sp2H zc>E}EuutFM^56nH&6Ee3S_0wEF8I_>sYjj>c$|30@92E(K1(O5GCY1adsknDQLsIM zzP*U3Zb+#3&4ZR7$uT&Hme*E4;nUmi#k-Kz+x2QLMO_=+g|AGAWx31U8 zYF?RlJgX}CbMQ~eFLIWU($V}H)uHz^VpMy1Hap^5jA7$T$rz5YdwABE4`&@t&@;mGD^Czh)A$Y^GfP*jkgkn7YpoStVVBOezhs%p z8JGKlX(6<5Q2@%NZaId*Op*ajZnbz`&oCc)Gan~1874_}+X9jNvTF<9zuo=RVm9WGOu zieTe=^3b5kbkM{c{EK*v?Ij?TAX`Qrs<^k{!p2tuJ3rQDDcE(u2sH+Jg!2ID$esk}&i=8sj=e_&q+=UXVxu(?MYILqIt6Fu1oD zsx%w-Dw+tBuGwjL)&+ixI_tRiBu$|9y-f+m&E+pS)@CXF8XCN>oFPI)$hGs_-&dp* zc74Bmuyq5Ls`TTXglucjr_)D}Os0=*be>r!hbVpsf9I6jN``3}CXpGVLa7J%cpg9S zgjD{Rk)m^1xxw>wUIG1YS2w(~K7KG@{ftSk6FZ&!yg8m1{(I4HQB~Z;3GB~t>?xCZ z<2NO)V%k4O=Zn=bZ2Zt#^--thpjtTniol()->iyeR+^v6J&ZeA)l}`JbetFMX4a{s z?E1H4dv%D1$$#Ul_cvtOXS4|U)iqyN`?~cnAMz6AY!!uwEpQMESMBCahYW0dLaFc7 zvo~+5WG(m0I_(3Z2PT@Q7jL~JJy|3tVl7U4>fc?*POG?WS3#Ol8j?IcPA`GqzT3b5=)uFHa_<7?H$gI;?7YXly{byc;O^4-pDhUyXR3G!t zh~U5%gq&V5@K|}Nvvd4!t*l$>_h4iN4Txl#6w~&U8 z{-Y*hEg!a?ll&+7AT9}+j;&TT>D}dLjl(*LB3`qc3G{lZuo;LcFU}uE;qSHn5uXB6 zdEC1ML}6W_JSd z-bgA&wVkSWKI@kD=SKh6y5hhwBZ~>Yzs5qL{x@Rhf3vv%dQ-v5LY496lZ^v=`41Em zA~4Q^_kydlZwKBVE-Spf^B0NmorfIIEj!Mn_VQA@5$*;j3vpc>NWt1nvK#&sF5QU8>1DH? zTU0;0j#@5TA}X~|lzJo8z}(ILaOE#%8K_xEHZh|^jLR1+pv7yfty+c@NQf|ej8Hr1 zrbK|J?uS&6#~EtHe|i$vW93%(Mby}RPt+IL*~xp;0#Y%H{@1%5mjS-K?@}C-Of?#p11q8}Rw|Z(i^E+*YY$YWp!h*a zX1AMuLF135{_^}ZJ%Yjjm1NFNYD|m43Z1GpLzz4>!~nc(6NedOT|W|(<0Qi$ub5R$ zE~oVK0stHX+>Gw#2uZlZAix38wr#b!>!aXJH2hXRTe}Fz7%5557(HCt4U*~~>A9@E zoHDJ?`}HUwx02<)PBXHsrr%%o2i$*`ZMgtyl7CB#;i-xQkfjaqr|`TK7@v;7TC1vL zii_kbb)9orVO`75t~MVEyXo*;_~4g%6Td;^s`Qk#`vX8ZJqy%I@10pa8qZEoAQlCi z6*`mtA~$_Td>fJ6eF%xzZaD<9nD&@N1p`PBYK}C*tWlu5VRvQ$psiuH3Fi+8PH{7O zYYlNod4PghG3p{R)5zUxS?N<#-38TIc4w_bR1LRA{Y(~~kfUK15Qxsw@x}h$hbL)y z-d#fE`9KRego=nvjONhN)GjoUPfoZB^P3>@S*=feoVx|0taiD*@!OIwx$&$Ba{7L7 zkUao~LEtxloU+@2893W8*n6g*=8+F|xZl=CiZ(OK4VwJxE^?^H@w_>=s_X z1|@amr-&}jq1Ta1Ci;e*YIV?;cl3Oe6Qg>_67jE)$KR$A^C+8Id3RZ|2t6#Et247Z zQULSdBvc%2K-;2|U2}V0L@1hPY-|+o)(o)tm$mD{5L;@@Fa1b+aEF@hg?lm`8s61r z7xp_s>t9kRJ#A?qm$b6NVA{%lUsl*CNAd#?TSj}@l_0=kJ$iOjk<@jsruT+iBav_d z?`!6c1yhQ2#mvgl?4x z)=t|5r--vYe~y->D>4p#65H-~WHd;@#XAVIJlFfhV`we&N?h({IvhS?aJF_HdzG#4 zGWIeY{oK9I;&^mH79cPZX``n)|h%e3%uYIo{Hv=m|Et12!AW|e9g32C5J(LMBp1k44fYDJ#!ZEvSf9@Uf^TKisi;G(*vfD^=#;0DuonU1>Sb{C!0B4{O z-~9x0=-JRTi>dR0^8x&DieL@%=~LT~7s&76HG#-cVrc57&%o$HOgYA`8UEp~5Bft+ z`}p^_#nyuY5q?B^-flj5;-V6Ebs}>sbl&_C6!M~(M9XDry$SS*8#9~p;-l4x6bh<6 zJ7s1UtkX;y8&eWu3O7|vkCL~fnJH)%C_w(ogp`kUy9}wLSBUe|>94ww;{hXbILWS- zh^9ie?{y;uZUm*@FjM8RoV*poSD;Io2*M>`ceaii&v;k~srM%Fc5M-rY6ley?F=3q zi3B>@--FP-G-L9(s{3FNZ34yyO9lRjGLuJ+SIuW*kohM#8s`(vZ2*T@H^=;oL0h5& zsT;-}x@jBd6zl;1hH~u7pJ`uAbo=uR)7$RbPHjh=hqC1T_ovryE{N4|1dq~1 zG~j}=XH@QmJ2Av&WT+4J{5uQ4*Xz2wTt;sri(S9x_)D9Xf^2oH;G*s+7A>Ngk&(v2rFnCp$k#QeM<33pden>Vl~?aKk4( z9z651UFpt2du!P(88gbBT6)$xx{SE`ia&SZqGqQt*r-RuULEjLVP&R|< zHWS=A87KPI6UL0@FiVUaK}v(^P-p`iAV&h>e1_|-owYKHoqS?Z+lJhbl&>TQ*_W$p zY_vw}7EBy|1XqJMShOsdHebF251%81NoaqF%i0s9+m5NLnA&jae6e3@F=INaP*LF0 z>q<6<_Z;rT_}1reI#Js{u^DcN;NQtpAaCLg(r=HeuHio58giM@!H%S5gnU# zlX7SqHS2RBeQh}0i?iPmyQ!4PV=2p2ZgAGPGpTm&nFyNSH@M%~se@odIqkMH!d-}) zPeGo6h=mPO7kaua3EAMJ&Vx31j_5%u{moIDy3j#%xr~Z|Xl^crdrZ>}Sh}S&`#F)a z>D^kuipFPAyH(~W%9IJngKcD-FB@ULYrm&)h z7;WhIO~kaYp|yDL>Tg34Ml zCi5>6_W2^lSdL89z{ItdAHK|uW9LpOtsuIn>)r+E{XNBvGYi@G&Y|^;g*-PZd3hJUXtN~7``8}BH}yRZ=K@={i$U} z{chn}SNPovRL_Hf=xG*HPjV+%P~Lu%LIs-6-zKXB?O8CyWl6tCUfj{+$1RZaI}p3r z3$7-u@p`xk{A@eY;N;&xng^*5mqJ-pkU8;kT^C5R@{1&&xkjAyP1*M|k-ZY#6E?e# z!Nn|y!)6PL9}LW0Pkbjdl5@>o880^+%_(m`upGNwE7Pk}aT@h72GWmC#YrULG(e8U!_l&Z&(Dsa zVd7|09v^>|z&m%77H#ChI1wOlF(W$43D%LF-ixJ~-}B_G#l#p7BbfqOld>-1eE_f9 z+8PEsc8}ns%gBm$VUZmU>sdsGcUD)GYrXb{1`c3aItCf9FD1YTZw6v5Yt*0V1nmyU z*-*~q!%H52ZA$N|TbLF&8`)*@?bYd!6qt6aEcP~f!HT9#{PRT(zobmp@6SO(`}92vwK1{oWr3~`OrghbrmAluu%A??|kz#HT5i^Exrf2@cQ(O!2%S*Tsz{)66TvX z%Ti}|Dr z_rP?nP6cq=U&rkoWCh{>6;3|Hv$d_r~+*?)&~9kGt@1mwWF@DyCnSm82FVN%pX@yGdAe<~}v_ zITLy;X5bUk6ELu|G*qr~mRZj1i+WP7`^MYs?eXyg{>JkWGy4qg&h%8@!lKH2#I-krH)-6xcwW(dxKE{eLy7tHSu(rj>l!!2-j{v<`C_JChIHZ#_QkJi zF6-FHfH#+tqk?Xt`(7#V<#L2vBYX9c<755iPO?fv*2t{M`Pzh;v6I7UPAxj!`Lk{d zRp|woUt72J+6OzgH6G6mvE)A`Pa&AD{amocO^&yX&SF_Gb*;n2*j;bKeVozv{iZil zSp0Bu^`OV9@G3j{%fuMDeDt>g+nh7?SqwbIwIY6aN6Uhzna0Z!0h#v zTeqr&oMV<%cGfK4nO0@qr}B16%c8t`#UgT)9LIddkDXxP=blc!tFxT4`$h*PH@ZZa z>HWQV8pW*g>Q%J-Ck>WK-6FZPSdQ}7m-i{yM|Ljl5W|Bomb|^tp~mrH*$?%JT8eE{ zVf!n0Ejtt0F><`S=8zsg{BBb>qNkyjPJUv({dA0?zQ#8e=W%7arwO@Km{bu?aowHM z3Dc^Ntt3oOH+1bUZ;lOE!%Z?ZHLldg)Qbo#`6nbWz`*Gt6g-Wjo*rGi`?3(~GmHx- zbY-ym4JU%VqvC>CmMh(S&)Eov|Tvy*S%f~JkcK3OfXxpK0jE;m?`&l^J zI~hJtr{oikQdUxW22ItQ)p~HwYU}&UR|CcSBXNoBIo~OIz0MhU!QNcz%RZZBGyKw> zBaCZ(uMvD z;1A>3ylPa&r&+kVS*OzmJXR}i5`n`$up1E&H;qoH%q>>5ew$mH3_V4y&@Hg`?Jr@2 z<7v-gGOtVMDx2m&HRHK0czrGHG@B8 zj7N-)2q){9YP@HBUsFe&?WM|SfNk;s>zo@D3AxyxVBo8e$2IQEtg5Y^+z^!@Wo2cL7J72=c@DpSeW_ohLOp^nor)CquE9>h@l5N2nphq2op6d`Z2ap7CM8Q^h>41i+AG4XE@z`_^v*4iF3hEEPRz`#oMN+yT&9`Q z82b98xKfkZzy<5^NEoMN!VN`-f34UO!4vy43 zFLfZth?sYzNa4exqu*TMHPO@~z=YV9n|&>1+04j6*%&*%bU60i94mAd2xq=#iR+q4 zbBrJbTXZ^JeVhfTBNxM)L{FL}T7JXSw1^6Ekd zC4Z^c9l}eUH{S~Q&Z~E06Mma3q<$ouI~*`ji}*nMi8FK0X;4EVLSEcDG(2qPvmTbK z0-6E~7g^0aMk_yT+IW5EJhyvG`<}vsk)92@Gzfs0rg5pKbwvFdwgr=E*GNhQ?B(O{ zzYm~LH}v)*lg=ng+(Ea5!fZcG@*g3hpf7T%8i&J?-&YA%K+PhB9GGGD-{O6;Cc2Ejfb?K`#7yl2=-U2MjcHbKv3oK9?Nu`mJM$(`J1PPH&Q5tEa z6_M^1kS^)&QU*jorAs;$0f%nR|54Xo@A~%s&e_+QYhCLFnVILAd+z+ze=RvYoMHYP z*Y|6uY?Q)V1{_JH#KfMT+YjnaGw6wNr z)Nw=|NsG-J-BdCO+%VL+LmSl*%fZ6LbeW!4Ner|*N*hlt2<5@1)HS!(@H1)=I@Xuz zf_Rl9I{G+hF@H#-@EN&u?%Zuq(x5rRws1U$_-SlD7rjkHi`!K+Xx(#smp+vqu2(2O z1hb&iSfoOD=$DzE%gDIqAf8{=AV0a}3)6sJ-d>oI$TB#bika$%iw&{C0+n2a#|05; zRn^sgb71Y#_M(daxx9=6lW+IuuJ|q4{_MjNd-f<8#2=?u8uHhY3O}n%`Iv1-Utymh z9Nnv~rTJofc+5?`?L#=1*mu+}%jG(z9cEi>a^&8AtSh4F-tqZOA4PfzCA9EWlLOjm zsq6h*$8xjlsRH|yk~-l`oJlCnp8V27DeI6+s>76rckVAV$SJnAwCF+Dfj>Sm^KF`- zkL z!R#!t4~jbhk0W9583e$gB%lh80jE&{fH73vjSUNHF1eP96*^CYv8_Dvv2fz(o%Mws zKoe~3{HK~Y@75T6D3;;WD$DWlKOP*SLMA_h?3y%%XwrdRoTnXDe%Cg8-1#K()~@Y( z&P8x#FLP6ijD&8^Ds1MgmghTw+KP}?yL0pzkG!d7r%(4KjK|P?b)ReGx68*a5$4#N zi@q@IQ&{rK1=^$uzJ9v5(1vNgt}?OLPV*X8X|;sP6Va+=PY>&b^tXpik*N}PamZiv zV3+FuWum)Xd=569cR!J z|B!mDTXpTT_L^dQ&jHJ)qb0GJU#`7eS}TIw!+u0cTiLlQ1x#(bCc)Y{#>O6%MQnQV$-4j;W>3egMyDek(iuqx1^MZ@@tIzznQ? z{(LCCt~b0x@P&g{l4!X-B*|4<3Ry=%nM0#!*f0SLCmPO>){t3%m%F<_XL0Hl26DBM zz^|02UWx_N527(LnDG7cSm6gd!Cf#udR0*JnUi|%mvv&_xc`0+u6OE2)M%b|?e7GU zuFWo4O-SoG-NZBUe%xW+eiUYS2eaa?4%5A@WfmDD@G^p}DaF?adZ)n{;-qZ_@if~f zGxM;RJ@c^|A_$n`BarSn`m`S%vnxFcOZtP2L$HU_a&r@SnxxB!i;LHDf{YP)lsg8o zuUET|sdTJ%5;#LRjz8d^{O=}U1=0hoT)^qqRp@baZ}ki5O?&k9~I`{SX2|X}t8)OI20@4~R2EJ}mVW($lRBXcV>N)^g zK&V-?dzw5^-UpPy3Uo@HQm!CGW|==@A`eMVcxfg-!>FpwMJN2L8Q(gcgm!>$&#Znu zZsX@L0eJslS5s77NEU<5eU?Koht12=bKu*-9P#G6G+uC zvk?jguyEkKiL`@#lR@gxYX%i0AgB)3j##ipjh&mFCCGgvmIJQb@n(?waYBq%*kfsk z^Kcd=k&=#>ksf$odQHZ72h_dGNqZn*+in!_y zK;&m?hXTu96Ubi3#&CakEId3#w>Q%!qCw6)Yapj5ugSTg*MtHCFmDZFghw8!dpr_c z8Hxm72Ohn=^XFZ~`^N2zmr;L5jPDAgT;}D!Z+A0A(MVKW+(LW2@=QME$>0CVTm1FK z?fjlXJGbUA=D+VCEf7q?_N48zE#ZwH(n~Epfdc=y_@(O8lI0E;#l;=Q*bY+5??P9E2mU{w^8f$-V&$&= z{Wvx!BcN@T`xvo5g@tJjkLZ^%pUJTIolr5i-QD^?B(S0VFrcOQ@R>xwrc~efqMcwM zDd(L7(u-Kdtn~B}#d2A_{iAPHb0xr`=VWn%l+dDYPzQeQa!TKt>&WLMz32;pXf>?t z?DFR1BqWbkkKio=HqDnqRCCKmRpFTuS}EDK@< z$~3)3nQ9%#nbnQdjlSJhm7Dq$yPJulqXlOBuGgNZ1gB1q}+V>*cCz@wyO zn+BUVQ=h55na`6Kw9s201Nxb)lmlve)6Iq3>xH(wRXUDYiWa0SR{H4TrTc`6>wA{P zHR=(fMuV1y%>`V>S-V&D{i$`H_mCF~e;+eH#4DEq(?qQB^O79{Hu~xep~kiJO1ow& zQ6+KwD_8vB7$QM~js}ZAD@46cyOnF?FDlE(OS`R%R$eMDE;iWpCt^t+TteHJh|7U$ zTVk|_av040edN@7GIg)Ky_xq)k!Up4eIDJmgCTLqKE;;-TIhc6NhDoP+=#-Unw}im|KzAWQ(nu0-{w&H z+`8fL*%{)e51SsiVb8b;>VF8RzdQ?k4)ruYk>P~5U;=YvkVj(f?K`h7xrzu~-&)#i zd+4<4t@EI|dity5L+KH127`McOJ270_R=Cs%p(_;#)hA`eqQky_a>{Wt)$SrV1+`3 zOFBHHyCZt@LGbL)+#4zrco=EbWljxOz8=2%TE~`_l(7d7G<+V$8J%7GK{qfafWgCS z+x5GJSpPg>Ql**ea0ZWX#*fMzKK2G;|GgdFYCz&!v>fx@b5s#ga9@ ztUe|x*6Ub>l|hH~>Nb7_{oN1W?A|Nz?yCRH73nz}8cC=*vnrQc=HX4*#96z60e=Uz+;6^d^>IL^If+4qHF9oZ&pX8 zDI&1}qz@OCmI5FROx6FRXfVuIrdTdEEXDigI5H&O$##losa8#7G*kx1ZdZOTVA3Xh z`6I(Lvj1E2@smd=RKeg_v%ldWW+c`!TL%J@Q2ZCwH3O-%wG``Bf*jx1U#>5`2;CcY zR+!HAs=&ckyANYxmzsp8bYdf{hkpn&E72J3%ho@DXXhL~^xba^aM;!_Xua^EPDtO> zgJ|BgZgOcD&&smV*KlIc@91W61(#Pa+<)`f z7NQqwe6`=sa*_r8!eA8hMx#02_$G8yETmxHHZfra3o_B_?#_;YU4uCevhMKG_J5$9 zoEcW^yoo=%^!gREI}Dk#sMrx*@0b3X28S5Y#9!}?IkLZLahg1Mgu3NgbxFl?TaufU zWi>yErzF?u*t=WDNw=4Bc$b&hI!{Q&5BXZil3#x6A}S2tZapf|WMaxMz2ai*d0t0b zaI%|<5|1qTP8Z+=gU5Y(b3DoiqHifNt;g%{_Xsi-`Ck8Ux%a~FZmpmF-fpem*3Y0< z)(*#vxXTO!_Kvpbz^2bI%VG1{JKkWN;SzOgrcOC=T|zkg($iSU&{tU5H)xBv*>&pA zXr|k@ZLD8jiq@{R*j5{|$=JfJARcd;)Uouv(ofmeQ1~I?OG9NX4&F_vnx*Sw&&&C) z<#BgPSr0`-M!tfKPQLHn$`GY8l=LuH70zZUiu;B)NMWucvdu8&Awy?JLK+U7xCdMq zMYy=|VYi=}ep_&B4WE^H3rJ&HUf%L?MQ-us+sa8k*%qc-TuEn&l`)?-p1nG~lP0_1 zqi9`zzIuXqI*MQU*;MMGkdwGL+cNC#kc~J58$Y(MPSXv|y14whF)8nT(Q&)f^w3Hy zrh^J*6^+Q(f!p6-ofzL{Uz=;Jt&Lk7Tch)=Zmy4P_mgt56K}rR(b5EsKGaxxaVUpE zRC~E4`z*5`-a*Wr+>Y(fzuMCC>75R>a112vt-hwe`~0&}->O@m1YRyCb^6--G zc;+LL{cWPWe9ejCq6N46j$x$dF}7Z-wF|{1Wd-Bn1bA_3YHidjpQOe!Th|u zysoZg8k2#?pQJjbFN>L-$6dm4@|cOKa-9>@iK7b6YJEK&u|17<6i?qZEP@xN93CD% zIW_eHVlXPYEponT70>lI7*K_=-o>e?8zEWRjtS_wO#LNz$i3?1vEb92;pr(2jW(n6 zB|j&&EW@)}RX84MCXzg!{%XmDqcTO!c%5^rm-HlUd(g+7PoJ zD?^Em>C8id#1$Kh)BaK}-(){a`;k2j*ATxXXht#xE*ernJLA%gn740(;oLN;E#Cy|e4pr{27Wlf$ySaC~$$7PJlK>;fLGr0>jC4~;PH*`)aL0EV>g#Xbs7 z@xBJwI8B1x!hajm5l6of_|SE!&X-#{%x5Ns)My*e$3W8HYe61#yk7lX#M&V zQ;q5`^NzJ&d+NCQpTH|`0A(%uv4zhN1r#xi>TDLd~ov0a4lYaX0i& z!tom&x*HiuxU;{1H(&LG-VLTt(sqKBuyum%__cwcfB@SnjzoEE2($^PZHI*mHe1t< zyUHecXqKc|PG;uzlq_uZQPtdjjmSj-c)i;FS=gk82@jW>#ia5`IZykjG#IWj-|7*@ zn^(9V9u3AQ|He{yb7=(y5+fCONBDk%-lE=Sm-jnT(Tu{rBn7rNufFvZn=RfftmYm4 z7+Fao*Y-$V3e$?;8|t*n6s0S=&v10Oy?sMat_$zFcpn4A2VeXmvP}WIv!4YEi!pV} zJ}gBm59oEsdvTU;srqX&XrK%x3+n+Gvrf+U!xo>$Ix@=b zK6fXsUXZf;5L%9|QgXp=be8kB_qoo=*OWirhQfYs|9(2}ysO6?Unb5f1H%h9pc9-N z93*VE9%5cm#)!RbhOH3F6WQO`@@6U#Gb{eu3Jy5C*qzf(b>?7i<~rRn`v|#-6QWeN{cu20m|)v7qGeQNx!nHsDYIW{x*nLl+e1%l8vmTm zo@or1kM0a!>6H$JLx@vqqYo2y`^Ws2%^IP_z4cy8IDuUKIEVv#j(~|1z0y7hJ%XHm z*Y%t!o)s0wGnt)R8oQz`Damjq#~&a0E0Zuc)q4tK&bkjL;S2m+mjS8n7+Mm^qok zsjP90jAbj1Qs|3fQ#NfrK>*Hw0#r}P;_$beuA(O64JR~MBk-A-Ou}Z;wHK^L+Qjn^K3+W5%$%jf2o$)fRO(l{D=mDxrGCj+L> zx=bb|4J0k{Xdl`6tMnF^U|LoTG^lo^!O=^?!PX~WgeY+46mHAoFeh>mQYGqQ_C>ioqH`odU=hB%gz~%3A4H@{#n-d zmx&$z`;opl8-s_qvCHkU~zKwSE=b79z%5k-l+nm>y7jN*2 z4oCNAi|%i@o_?#fK$TE>< z=K_`Jl+rgnD$Qx3J7LdA;u5+A;wsbL&GPyEVx#@B%r$BFY^nAeDOrEb6%mCPhG16h-=iwe(V#ta8+8AVM`N<4!|5OpC6g|(J#60Rmj~P$P7S$m3 zVHtc!lqR4gI?5*LqsF~HIPcD>l3n9&Bk=h}~19=UIId z{i)ur_>3T}RcCOzu+pf5D@ z`DU(AW>yUO*h*yL=dc~`U_lSnn=fp;x$!t1K3=h)JwMU_mts1bl@0G=LG7mjii=IYogPZ+#pGqK0l(VJ_!ygetv559euSG3=JeI8{5JAsY5rzcB}x#>%6l&e67{*W!VNuknaj0 zM`dG`xR5lz$QT0UU$DbbORT9K4#%k=)U9DSuAdf+G{;|~w?#Ib~`+@L%sW+AAXlO3qBwmTItD#mCDx)7o2)5a&mX->AW%t}V z9tlD>XJH6BG*(ZDwQA828wgj0zOC`oaV>Q?Rm<4^hoy>E{!64Q3$AU=W!zH|BYKn@ zT4!A0w7Ptzmu+tgxsUybS*HL-(LbNM{7moac=?VAi?9Q++JP|76PZKuipX=0QDSMq zWe(z9skeVI?D|@xUE;GJ8%LBLuf?v_=lF$u8sDQWC^#QKvA>D z(NeLoijdy=$r9&M7EBYcqV*DB70n?I6LdJ70g zr4_isg&wJ#q%O4dceAb7fJqX0WV1bkrC2^|=py#Oq~zHBi*W}o0Y(;VVR!OZ;rchO z&UOALvQj;WmK;)>6D>Q zG90^*(Rpvx>Isdv?;8ojdAaueisW;&zY)~bimP^d54LRmZ)x9GwK1Nl|v{ zblIPdtfFCYQsdA2(xhS&Aza1A^;|<$u?0fe1yij7LfBFzg zjR4#_oMLZgW>##wATJlkb!Gu_(C0r!0-#iEGxv#jdEGsu_xlZlma`Z*n75R`u>sAM zDF3vS(yMv$YYhOh4x{&EWJ<1FLK&B9plvjZ;ZQpAQ+I?9Vg_zo$F7MQhN}=SUfavU|V7z2telt%;m95oyT2fQ_nO0OmCQ^#+T>SK25>#0w|9TH z1N(bvwJ`Yj&!nZS66eO3AG#k|emr)&`qFi*#U(yO2OaB9g`6nimG>>1O-;qdWdgF0B-2#;nLHH2d6S)o;Rw&oyE{r zkbou*JS-fb&^KK{Z#w<0Kl&L0+sc7eUFA9vRENkv5_p%nf(tn3`?-*(lWT3bj%7D4t7!`|0D(2X^YkM*B#Vfk|%_)B&yqi z^uV;guqk$LbiBATd#k!Dwt~9g7W|TGVMfnpqjWB~?if&DSDWN-292m*rr@}xfEGyG z*HS6lhSzm_z*GH?@+nzN$a7Tg`Aanv>>df$h9KAy%^V7_y)F(reI~X9O{DEs%;U z-nmv$T2fMEGba<^79Ne{4WT?C*2jPOCuQ2mhz8pIV~9_^KqrJhA_=*~%dwTzL`3w{ zXFLHn%+sn?+9-v{*aT5GjTUkuqJGv4rGKOT+AXrQRI?CJk(s)gg=D#(X0M*k% z?YD1dqSytH8Z-P<|8Lkok{;Yonql!nS(gG*5d8zfpb|)A)G)PuB}8mGM^HedY6)3w zi^faozqA5_QubKbas0#Fez+W<&}F3(9XYEBeQ(m&tL%ZHoU5IA zLXQ92;W`ST0sx`S{~S^B2lv)EQXX`|FyjI>V z7S8^#5Eg1V1-F6B1gaFZ?9pyE$rSCwkBSd7bgK3jPN@CCl)DFuSC;^lW*do=v6#(} zQ4;(O`oUXGTNBcS^VM z4-rY|hC2|}=m+->DP74>-3b?c?U9a7Fr4s_5?UMA%1a-&>u==k@r?k=9<}|+ zdKSZOqI8@xkjs=t{Sp`i>D99)cW6-ol8LJ7PmnvxKp zoKv5qJ6D}@6&5m>e$c!48crT`au~0WER)kMeMi>`Rleabg#fAxEY$6}dH;J}H78Ni zAKa2{Y|$6e>QSiHPcBQ0K|imLd+3*uj1SsLIW){s&>?VA;xi6_y^$y8&eRt-{#31} z#tmw(N8oBPh z6ocm&Xn!X~HTiHmBlqwXMfBvfLn}JBlJyj)rlXwLC3H>Da2xc?*!AJ>(ZfXem%8NZ27ohS*F^JR5!Aup%bixzFT!p|-38>li3(AioVgM#)W^3a{ z=#eiW*eFk@o@{)49Ig{E)b>Sm|01AAXD?mCMqLE)FZ{d%*)}a(u)dOzgh16EVN`N* zG74T`z|#pz^{2GlLM3h9Cp)L?9bDCRZ@FaD)_ys1md zV|*E<2Or7_%6Vbn<^z@?|Lz8qC2(?ap}l_nJaQF`DAbsN-e|p8C770;-eOSZC47!1 ziTt!@m$)}@ZIG=rU7xwrWBIlT*coEXh|E!J@6smf!D<3+aLb8r@h%eApO(ZhL1Dxu zSUHxricNYMT)i5^%tRZEx zB<|d9_@+T_vq_l-!x0oF*Mx;BpcrQAK^uH^FkVXpzvpaRk@h2OhX}a>X{C0tUf}vi z*g{O1f&B-@pJe@nTKwgTYABne4~nt-g4?(LN%4#y78A8W$eg&)+U#qd^HL3N=H}-0 zX*RQInw~CgIyx`u(eAMSg7R-%DR(Xrny_c?eLC~~sO6lopYLO+Z4&|!+6D;S9V4`N zMjb{FTj3TuW%XTXS?xuDdCi}fa}2C~xff(b=k^SebUh{-a*c9`{7#&ws zj=hpJL?2E_$SoJ%*;MNNh_^09HP|<1vL)_ay07N2%*SBG)SCODhDP6ixyIczc4=@~ z%&*KT} zKMfA5o%N*Siy*XuUj-?B>c8YvRH%k+@>?M+E;J#* zT=7X-zbVj0ONm($!2ZN>Wy9L^bF}iy)TZCcQ`mola$-}SYOIIMMc!0?KoUDTDyrOX zC~pdcKB-9n%|i{-Q;=BJhHP>-+tfk&G0E{|SAXe?f){gkmG`r9nZN=y$B#Dd1W$p7 z%pu(@Icl-zT=3EA`B*?4Lh6uyfWETdVX1Fdl+%*=bHoDkaRz3&zLkO@LnHQ>%)U^! zgNdK#<<34cq{+B)kxG~p$?q^IQF$KM4k2m9VBnUpxeDq!;0G&6ai)BsZ{JGm_Qhiy zkkNSa9;)Sp#l@M}8}viG8c~wRQT22^%sLbhS8nRHXR|?ygts?=WTGX3=W~mG{-q`! znhXf@^?z;&TR!C71G>4`x-{@1sr@w6`LcgUX{I|8B$=ih5hRCXO-t(7kQ3|KCeTjCLF)ijk0r zyC*Jw8mi|q$*4eifg;#{uY-B4AlFW_eQ4*N?V}mR@DR7*Qc;?RU+-nUY{dixC&v_T0>BHuxVm~ z8m1X6uiJ`}slDF`Ghn4+293}uy^(D=NO5BO!FddXFLy}@HS$#>rQ*bhK5EqU%tW2& zm55GLDCC>~-fASlC8a^2lkt?iygc!G;z!2hvES6yQ}B6CcXzG{4I>+s7e=Bd^6L~p z+|<|C_ayE?Og38>!xPKg2p0bNguZWoSSuohhq4L^R^01dv9<_HqA7HihQEsE#6dGS&hB^X?WWtvH#}7SvR$% z7z$-gO%_SMs@ht^kD=GHb8-}gIT;~vQ;r4=@k{k5V`1&M+)_zB|+B9B*c9E zI(|gqr%|reT&NXsV41JI?$9{_)e`PlTCxLLBR&BqHN1#{*RNjrZq4pryj2_|jH|hi zl)p$2^PqylH9Keycl~WrC~Fp=#Ng=Y2qj4*%M3YinH@}~zrpDWR97EUMAPqCowV|dIuUt0*V_1fU6FD`<8t?Bq->i zu&TzJ$bp0nU*qRm1LLRUNWvh*aXJ=G?SA*{PAJEPln2l-f1mzHo9w6YiI0RNU^{an z|F~!PppJ%9>=CczKUpA(k#RsV(tdIaIlN8tRFt9^Q4tK0o?ZBriImozU0C2Z9)&88 zCy=>eM@HdBlOvQZ>@Rt;PMr+E^F`>?=rG(jQrWvU%&HduiqR z+Y$s0q8t4BSVq>^oGW9PmnN=9=?zWXdt`y6(rb82$@$1IF3{RaN}=rB1r>F-lVQ4* z^7)r>5WK7$8$q(hvhZnK$r3j}=1{S}Mg)|+12xBeai;lo*k=6E0>Cw90p#`dT~Y4& zb{)B-cwfm55A|PU?mtAGuNc_Yca7C4c+#*^V+u(CrADEEAeb^RIb$c)h$fePvlAx! z`z_%A*z)d$Gj|X?F*vefNGsK3oK39vL;&!G^BgBoR2P2w;d$NtwRS;4AJB09uH(#^ z<%gPYQZ@gD2oeu2KK|5rd_*PblY;@yfmN*rkAyv1Q=20>hF_H<(JP%lm2=83WoNF` zim$@#&&yI7_zzdc25_4hLJ~pk`qGVHWTn_lCg=_K973j~9G?Ec~i&2&R# z?Hp$BJ=z9HO!g;r7|}cX*pu+gLQd`9GzQX;{#cC4(TtrfK-uWX%QaVMW3xrK33KDJ z99=fV9Ko*`8-w$3lf}aNPrUZ1_-(EtRKpI^PN?2GHsD_T>{nr$F!hV);AbuIwFOXI zzS2;j2n*r=F5(GV0VM+X{GB>J3bizW@xSf2tnJm|I)D6x3z!X4-Y}&kz|3jpnWRp<=WlBuS|!KLE3Rn({-+l+yxv_R(0Q;afKXRsn}8lC`()Lo9)ns2 z;AU}|k+%-qR|@yqcmE{?##0P1{rWL7BpRIp-w`x&aWf?cGnyCqMRo(sv8KYCYQ$bt$bXwcxr^ zlH@CMPQx9Yx*>N#MUk~vtV%=6Q5zP6x<}92uAToX8vCZJNF-SlmFI)|oC70ppk zsA*RKIfC#{bV_b+pAPp|SN-M&_K-$0HiRZa+pL$+?yfwB%HA!x3?N^v`Z73i;g{yc;mA?|%Pu_O{S zk1#k-j+_$=>L1}Nx2#?ftVgfS`<6C{cFpKCILAxBmZlY(4T;xDtRd%48qk~XCCif^ z!?~q?ezP?k2S}PT2=iF1s+Eu2wZHxJQw21LIM7=t)^OSZ*C>0HGUiQ0I-{DkV)-my z94Bhqg51N70-2fcZn6O}kh{U6t;^$dQlmOCPO1f6l>h3l_Q=22NN|3ZjOP3ZpO?%PH@zkHyQrCd;i#zX6ghqg!hI_0&>Z${Kc;#rZ7nGk zTweXz(CsijT~20P*Dd||z1cb5zvFkd4vSuyJz7<*b61}w#egO3B#IWxXVSpL`@msZ51e_)CubJPNgPTY)$vT8(RTP_-?C%^mXS3kRB~oAQttX1vQ^J2Wv3 z!YN$l4{kW`ZWYBzpIe*@`g(NYE2VuMq2wEaSx_DX7*)K@qumyx_Aud``uTDwM_%OZ za99bo$vED+Kt@Z?YV^%x$Z^m&ML#ZqKIzMdb+2vUpj|xeL!Y$kHaF(2aM;E@8`pZb zCyN_Sf}lmI3nagJ8ODN*;MV-#9-GZsu)xjJ-MD~{M;;Oi!V@$P5bleU%#xe{$={JaZM89}QX^b8l41YZvx zqy6y2uMJNYh;l!!WT1aDr;9s!dfk5__ptGO_bj|8N^VX&*nBXQkDPn@dwrms$3 zEvv;De)jym99=zL&=sq?5SW`aSSL1Oj_=HElI6CCe-Bg8Taxl<@((FUTmIF=1(Uxts@AErz8516Q_O)=;Nvn2D=B`4l^z+Fe@|#8X z-md-W5aNAGWShpb{}NXfZKjD`g~ddz$c~m>i?y=G@)m~`v^h31d+FET?)12GiP&VE zw0eSVl!>90{?FuTx&)S^6LROGK>ERX%pZYSZU_l=+&USYBp71r9fOLc@(?z7b{1Jf zCCAvJw}dA_?a=)Fxy|3E8wr`Zi7d;n%H`u( z37+4x1Rmbl_8Yo58vT-2|9W{XZayXI?;pDlUjaJv_wnD1C;y=5jFr#JEM0EQ8Jb^% zL)Np!+IPeOjH`EWJ{63q)*2 z#nGg;_I$S^g^HCsVBIiKmyz)|h?CFCtrW>u4FK&bW(4GQBiV)Z@N+yydbuM;6L_@C zSFV`Yt3x9G5YS|w=iPZEDCRo{1HkyAxEDun{VL`0i2lq9Bnxh8tl4wa2tLt&J_6f1hm8#IY;M5601@RF8PkdBy$Isx{Hnp~zN zDPESt0dc<1kq^0A!owF<<7Z!mJZ*atl0^^D^98}CT zM$Y%m<=I`ZjchoJ92^|5P6vQ<1Z*Q?ZpQBfX8&yWEinxT0p-kuzmGunA3l622BiBUwP;;jT8RoELQtxp(y4Jf9*`lqx5DbK z#nJ4Y8F;j77wnla`l5I4{$+c7*k_?MZ4n&21Gf83%TvEV1xbk{AQvFVE>Eq&0DXRO z)45oSEDZdz#@!VFZi8ZQvvqJtU=}_+KorH0bL6}~R%Q~>KXgJ5pgSih(c7|wphr+# zyv|{MhhR)0VVA$JC*dYZ8P9iN_QXcO_ThU9go0TE7dse`14Acx2=AtKs~uuCH|?{3 zD_VhY1g+!?;1Tuusd~L_;WX^z(k6j9>fDq_Mfh@jpdx*%n!k%C2Hm|L9}Y!>G!I$+?fTRU+H;Rvz}+Su}a`<*ed_z4u-L2LSWA- zo43zV-t<0{7zbKXx$Ymf6{P>XX@2`n=BKEpSC7Os#HP~bQUi{mIJ>2v{_rn|8AQE{ z^1!Ns`SvqlR)G5p1~3d!?>7eM6;WEJcTv?SgX~{ux4r{ z340Ql9I&vM+rN!Org(welcTynyx|2168!C0yG%{N^8eGg!mj2~TQA;HBG`kyVp(wZ zg31*5R8s31u}9dGz(yfkFy2~vR~T`_986#vfJ@9^LhO(0Xy{0Z1AG+Vf&n!<8RNoc zGqv3#v@r7?wWV*EfYQCtGRrM17egS6iVHv=tN;`|g6D0;I5+18EQ@`BuD-M6VfyvU zME*G6C{h@6#+yW^2?#rc9E7rLEGw+-F-amW#K1T*v9h*6u{u<&%u66xUVD0?65tO2 z+d1vd#b5xMyUNIj4IxlS4nb8_VNTAAtSm+-EcXmT2qCIP59rNQwj88y^7E5Gkq|Th zp9sxFant5B3V59f=WPq96#|zbbnAL6Lhi}@A`GnJa2IJ+RixA&2b_==!8mW0Q&7;l zx4DFO`LZXJbE$)38psVOYH9{R#G3Ce7s7G|Nh+@*g)>^jj&~J+rbKQHJm-KAR>N=s zFBFoem3k>BkzO|XD%=io+dzB5OM_x`-PP%&LDS+56+vczm5>Bv9$^X~QP9^(Dv-3B zbzKj54zD8VFGLx$H#P*t(|DUq3(DX3V3}V#cy-C|@{u>cMB~$&VB_ z?o;}(0j2&v{a!>Kd+9(Dp{!=rDfx|L(_q`%%FJwR8SpMe37teS~U#$bQYQUel^Q4!(_KpUGc#IxTK>XK@Cav#7dgeCzE zyu+YbN5j#c8Eh+kpUXg&6;TFC*W-{kQz0oB_68|HLjBs>Y6X9PG0@+fsi#rMU%;1- z7{*b*_Ld4EEr=X;4DVqgRn*o7()+YuNC-k*q9${)-U3ZWV&1w973GgSwpPU66;p7C45m!Ych^!qc~*3>Mr1YNT?A*7wIp3gIXkTLab+hrM~^X^yQ0- z>(;mn(kos2ht7>*x!Y0O`}T+uA4;NJhH%+inwpx@GlDj=XW!-KLX|?4P$pKgWu6;yI{^%d9&8Sp{~jqMGiPm!Su z(rMlB4!1YRWhn3i&@Z8M$|Z1ariMVN-?GX|Lty83hQGKo{AdNwKcWKo099sK$6=Eb z0)d*ywPmAOn~_UQA7Vm00$;y=9XfA+_1>m@x--huTkXR&dX76eQARvu#UKJWkuUN< zRh6L?3|Rh9m0Gloz>>nbzTwLoR#R5ufSs|^4e|RaYNMXM#>vGfHoUM-s4a~7o|Tje z2=JzprY1R+`_7c;sCp!skJ#I)m%GOfxUV}gYP*$=w+SfERA!NkUaFWO8IVQQwV&Em z#obM66L(n$n_Ug8+*?|B7_zDx z7wElOu75~kIV*OfL03ZS!xfLxUauZglJSF1oH5eXcM*&y688CS6Xtn5k8f7>IW1UO zSp8sTYr|l9g`?Q=$no3_UTiWU%(M>4#kd*Fx3qKDD#iLhEU+UI_ZUKGX_~uxdJuve zZEf<<*Y##$Bn8ZkCs6$-6FnVeKS8x~KpF5+{)yM{MaZv|m2<$`3r|&j(Uh zKQMEgxwMq2x8Lkg%uC1VKzIF;<75QK!K3hv!I+8D?va*b+yvOO%)DdqcK$U~;cdz@ zlL_ydlY$*-)*W?m)I44g9vsoUjm@~d&9M3jZ$gTyR;2!&HE#MX+m!i)Ua#%Xx@eb$ zLjT8PsJh)a@@$)_*4*vXqfR1L*Fv2AM+_5v1d*@(3koJ#>|H}-%Wv(?AOZzLLt1Ec zBezH+ANlotFzwKnoUAOV zu#N9aPn}slR&Gd-jEsc7c_YYlsLo0ZE8S@k#2+^DBkERr(gW3+odMj%4n1^AW@aYC z;sE1rG}W$Z+Osxs@l$5Wg=bDNb8_NAO~D6s^LBy{Bj)a&sNB7bcS6AZK){?&Q`%+v zQK1fHS!|kCYiF^OTMqGRV&i#~@k-Te)Xj}ttA$t6090d#UaMr_UWw+e=-J7N1`^{5C*+N^ZQ@(xlc_cFOgBb zSsAOKv#32sxNz%&5qsab?M%N5k?zt{Gd-OIU-H873(#X{Up}{*eb7PpY?xFvo6zJ$Gfxv73X6il6h8Rb#k z*3tf|;aH9R;SZL+o6aDPgAE6(Y0oPH9}Q|xM~P4HHbnN85IcwnoErPNDm5G&_#Bo; z=v8mV$}!L}GTzPVZMLjrIgbHi4y{TU(f$e&aYFY?H1dJAac5!fd{U~`O`HGqtQ~E5 zVj`QW+==lPw`_$%j9cNbxhkRSW>8L}^$u||j(69Sby>ak3tvx;w^262ZerT$-o18D zqCWc6qv|-b9zCRDQr8m#1+IvKsbpi;7v(n)EIoB0pa}Vv*4(OL)jX_GOOCBQX!*mB4gT{ht&-i>eV#G!Jxvrj#^}3s z?DnXtYj1CW)JnIWrW+#{qtx~;>7)rJt*E%-l&-riWx#3(frOsNVV8YNaPXabWAx_j z{%vbM)11>8y*uUOwc68NU%ol%td4z34I)2-a+>oBh;<#zJ~3KT;$8s>M_Nu(J-nP* z;ruoP#lPzL@Sb|-Unu0D9HLKco=+rDOppFX;BEc;EA{qemADCGU z;6|(9&IozAXl@q{f|u~Bm>Be?4F9qW2|zgD7syJ+UwEXVvf-lXHxfbbTCK&d#!3wT zLoXpaTy}OzP=aZ($4INDXJmLk>}UbN1)uVTY5c_}6b&co<6MbINYav%Z*5eAH};x~ zvbbFq=|{6>J*Y^03u=Gw@Qd_$+@;k&oyppO_x-A`@5^fIqYu(Pm-z#9O*w+ zEixU9Z};4pb7eGZ%+AG`lZ~0Ipkol7bYfM;$5uWh6=k9vK;9dXimr%; z?}gKHV_Rk4#KHLngP=^_%X7raS1lC^)!d2~N87geVDp&SRr}89{f?pmi^5?XivjPa zL**#+lZ@?;UmnGmK5OL&v3O#`)9R|}t4d}C>)z{iOU`kaXH`ZczeF5-aZ6;Oj#<@u zC6h0rYnYn0$NEi3WpiW0Hwp)iq0Nw6GwD!Eq|lj@pHC$5n46m${VDwITPhxYeil`| z1VQ`rpr9cbm1ozgy6O+S?%Hy0eZBU9dcO9AgR5@sv#FD?q#!^}_cjzv74IH_1S24J z4Y87)LWF~F847~J4^cgW=vf#lG2dRuhL@Wgk#Rq{2>CeTLe0~m1~KOswl+4B8yZB@ zMblF&OxNdyM9ZrgXvo;N0!gQ~NBqg}&J65+nl^DS4C0IZbr>jt=PM}@^yM2`6eawO zj;r|ev)whL1W*|0t|p3kh$5+^#-yad?U9-(MRi0lRI78ME-T?Z()B7Qn^xT>IfpFv zSrJF}^hfS1Rig&`ke$<==-D0_|ICL@xvI;@cM&(5P)NzVEsUI7+FR4g-XkoO@1fT$ z=18+LeOVsCM0pN4A+3f-j)+aV?mOKp`09#-jEcs79MN3kba?!=O&uWsyMMKT$h!Lm zuhx?BZ?goBqbm>BUkFl>^xuAh^QZppU(na<`WG@8m$F9snAb4(4K3xJXTx_LSFrFO z{Z}%N_rIfaQg8e_I)@MoIUN6ay#IG}jv^^S%GTub9&TSQbol)d#PwyXtu(~tP3sxS(=-@IqhgQy zP2E@o4N1jJC%dz=F>$p+*q+$I;tbKZTcZBUsG|Q>x1!U!*abWcN55hB2*Pda+-erf9mWBhA`ydg) z7*&pP@5XmFv3k1bYdoKB!>EtVdZF8e0;8R9!wr} zl~5gXQs5RQ`x`k!>dsd zGM7+>P?Qu=rUo*P70MJE%_2jlN*ObyQc)tM5>n>*?0ePk_re2(9+gk0ZBLZT;Ndzniu8pt4Wm9Zg~|m?q`gH?zVzY z$&lRdc(7plLFM_nx@>WOjQIJ(1*n@bS{`ze0)$#Jd;a}q_*MmM0@=4@8ipm{i6EQw zy@(J?+8;@KIdnThrTSw;x$Vo^=3S9hs_C2e4Ig_WZsaX!6zg0{5Z7N;H zG&X6it%h(^`tkFp|6qt?+a`-lEDEI;uU@SOD-L|1*CrbA@2k {Le3(%LsR(SBk} zaFwN?Y_s?w2HK>3Xc!6ikB`%HcqYqS9+6y#_IhyRCw*ygss$r|nS59Hw_@{QKbw04 z0~Wv`{Fe3ESXozI)0g4)pg+VXyE4%Qq`T5b;+D+*cMoB}>RZfkEoi)Q@NukWzmNRD z`xh^ch1p?W@<9et{#^4G?OJb>mRf;#rKP1FWsQ0qfV~1D!$7LaG~8XEKKH12VZj}5 z2D{gqAm#R8jd*X}gj>a3c~b{C=m31zK^9c0gj_v@}tRl`|@KO+G)JYd!QKGCC_}3)8J#rzmDD#Z^a# zNY|(h*pPf2mf)vGspm3Wv%3BPuC6oY)>OaR@?3=NnVqD?SA4q@yDFFn(c-(fqHGF+ zHS_JBT|CTl$4qf&SsK!tDHP0C8u2HrJbY?Gv4+A@*nX61YhN>c5_blQ`E_>?wWod*1pevK}q@vyYKmUs^|5) z)dII}ukz@n6tGg}mu~-bsEI&|H}g84O(;HCH@AvKP~Jnzp1k_q`}Zu#n5!Nb>39HF z1Pa1y(HB(`PR*U}vDqK#oz8TdNHFgzDX)PwE8}(x)$f{5r28cru48$crsxyb(zY3D zuCxPptH$#V+|`Z#C^vausXKhhqkeEwaOch&^%g8b$LFNV<&XN;Tinu3IJscdV3Bsw z(lYSOi2?WIHDL{Pbw48F)Kye&eCxlhC0}TN4%^ALrp6}!5LxHq*|80hCQq(^_v%(Z zjXZ-v;vjWZ#D%AB;dHy5MV8(tts;H>*{?vU*_|88;5)2-@T^8~S#C!0dYs1)JpP_^VeYZ|a;wV%Df%qDUoAn1_*7N*w{c0TB<$sDDg__w{QR(E6@`an) zE@t=FRu6WEF-tKnpKxVREST`KzcR6~riK1$_`&KE>HhldAJt19^a;kP*LPO9nk%@4 zw6nR)t7UfE<~VX{R&5Ey>xr75J;A(nh|xTPamT#`enD~=$6~EF@eecod<#WamFtvK zJg%I4QxcZGTDiADW*>tkz5A{z+Wl;W2yJ0{Kac!;z1}Z`vV0-)RcX-NKE2UTRBV)! znj)-iC9FcREdUN9JDfHp>I%u8y4Sdh^t4Iin+esl**rv`pvUXwC>Wx>qiiZ8Y+Ji8dC`{oewu~l+5mdu81 z4=zGXj`0sJDmu_jBHcRW|5aYmpJj7!)ku}Z(wQh1kJ+P?nKV!7fvT)UGEsiuYf*am z<~sjD>On5m4~HAY#iV3bm}@?KbJ+dMwB583Z`j^btEQLdX@GhJB?jhE1j>R-L5Fth|$q)wOO0@l?ON&MI=)_4m{NQ#8_CQVBI)bo*^~LjJNfZV-7f>zzMIG3JtKA0sl^MD! zk6-~U4iE}A4#maC2a;1@44$&{d4YpqUbQpJXK>UB6HA4?N;`RkIVCo25I&;n7`Qr{ zRm+9QP?UOrXwRUO(Ka?tx|*AqNQ;3&cF{w^DnZ3tH4O_Fyrig(_PD%RXvul%A3WB= zKBi9=Y>gakQ_o+hHjmAl9X?|q*Q24;Zq@OxIFm}2K>Gg)XDUdgRcv0lnxwf>a@zWa zp#JjM{(4>Ci7PfH4l!jz{iV%qCT495BaCM()Dm)A!i=-rIpw~84?v(T-OtCPV^ZH` zCrP}$0tXrzny$aV98F_O3k$U8ie#%lV+R4Gxu|PGfDv`NjjP{XowT4_K#v6*gV_H4 zYdJKZN)kF4kdLt=#=f+SJ-@AI<7mSnyDY<4KU;9j&E~^%_ZMl+-i>-GSC>BVGEr*_ zbx{^;E478eRm0tlp;1!Th*o&vMKLpYdAp2N2zWo4hAMLM)TAL3=PkK6kvs!_b5ZI>iryrpBVF(7m(SZ#%X`Vv@~DNyz|#pf z6`2+N{Y(}KdMmek9XZust9QN8j=afY<@OJLK2mABWaxZ(e|7XqX+!d;5hWSpQrYiF z_uX>Me}`X!Fk?Bix$?mQ)?|_T0G?O4Hbb9(^Q)(88CV>QylIYnskI|%w>_?lMHe=% zta7h;KMGa%+vU5LX;j|slC{v`w|t77&*R-AVH9mIO;@@wk*Z}LU7LI_4*RqXH@%ZA zT`p!jx7S^_X4aZ)mk>}$eTp`>S3*P6Ohf|xPpEvQH zzDDcCxBk%k_g~D+o9O856)cUL=WR;cRtx)_Gw;947h3es?K{EM@+(jXRR)Rh_yuH7 zJ9|ln_;ocGS#)~6Gx^qSNvnjBlDY5gtIK((FTPD_FtAH+7%oH9Ds8xL$LVNP9MYb> zZSG<89+k8+{qH6uzsy?;<@fiO5=R4Mc^Lj|-hIPp>Wp@ie#>={f~?@u>2iObw*^Z* z2h9`}W8#MIxD-|SMQC(4&QVCY3A>&&x@Ek(*qvK(O;0w{ufjQqdPXeTj`)x%yllpq zj_O}t{RnE62W+Tba>{hDXi$~P$^YWptiI&_C!8*_Qx?-ij0O> z)DVpHv*1!VGOcAG%K9m7n+`;PKvqQVBp&^#eAMFDnNQ>`VRSeA1RreamAmb@&eXvu zKUh=4P4C9-z~G{eN_L@iZz4sDh-d50_h?oJXow7}E8E>@Ve@E`qh#-dAoV=}3ZgPQ zPFqpA-^;zkP<<`cm zG5gsng_rIv<3R`RMiZ4UZLSROv6;Mda@p6+EBWtS9(7ngqvdy(GuK`ntF7I=&pCyj zM9<-`CcMHh-+eP!G=q(95S!BzL5h8?kNMu8x`M*C#5%FD*naawNxfckNzJPC8+>;b z6^a17EcC}MANN3EFG)E;cyX{dKTykB@2s@LUl;XuFYHpN7Y8(OD&D^5Dwk2^`gptu)aji#``0qF2MU=#}$HyM= z{eF<+;AqXq-+$qM|4v=|7LAhMKVe@2wn*@B9y#>?SNX)}_dlW+|61i|yn5{0Z2vT6 zU#;ne^_3d*)SnGjaV4WtKy|-Xd@aiQmnfLAOI@_Er@9@3xYYWj{czB44`LfS;w#SB z(W0kUb0u8jCmv#Rkh?qEoio|pj`E^8^HkdtW3(H*Rvvw~e1dI%1D)~S(krtExt2o4 zXS)4``m*QPhTtY2 zow%YUrDf=F^)C4Tm&1F0WxBZ-`>L{4r1S4j*-L8)6AYBuem>sb2X@T(MA}0FMb{>YIX5Eo_HwCTLur^sm0z}WuL9@;ozU{s?%UtbmOrXa?xfUZ z9=;uL(FJc4^~@0kg*8Y;)cBczB)oMVF}ANl`bKg|?njzOb~6DWAh>JSEx7aor;oDS z`|xW+1Ao4VpdhFp@|aCvB8?=PEDZzzrLMvTD9p%iNErbWATc?bs;#9(imY6ls5{7J ze)#Z;)YH}&$3=)Z!7Gx@pSaq6Mf3KBx?^LdUO5pFU_9H&P=1Z%Yo|VFP*O#19^l5?P7i?05 zbfsoqWBoof_!T>JK3<@26V|u(H*#V6oCfp#jM(q}lr4Iut_k{wwY_=*cOpEpxo7S5Z9OU`#^6iIRMxK(i*1d8wVe25PYMk=*N#~eT%yqfmj@$*wH4e z?18G5@c1XYfR|ylKT>kHhZ!8MPnh3rX9~cV4TNLI98Da$$7z}!OIT1i??M^ZKv2-> z8|y~-PyblY-r>s2UWH8;X3g94Q4~O%vs7mMCi z@LBy8L{av`9I~{pgOjgKu+q5GQj$}cwt5WvjQ`whmoL5Q{W3rMHRl}V);>X^u0|o6 z*_t;~ebDws+~;qBxMWfJj@Q3~Mn z_j;Y{_sryKN#?<;OE-q7^89@+>}-)2w*A3xrsl|8`@&-MM{Y`Np5n-s!N!o(H5X1V z2#Qvr`5jZ#u%`F(K09)J_$Uw@(WG?MMhXrkUS3wTCV>IiTlK~`-K{esYUTh*K2+=g z3N%trVf{RCLnLIODE()NJydNd3&e}Vw!o*>gAP0Y4ZM!gs%|e@Ql?8kdqcHu(vs^B zF4{*@No%ab`!tBja$g=xVa661LIai8D$c^B=FvdVGHPg1+ji+vOPD$CjzFUk#m=ve z0uzpeSFa8`IXN{^nyvODNX<<0mKqouzRA9PG(a>;*7;WxgAQ3C+cb=EbFEX9)@oHJ zrIr_Q4sls0o;41lXp$G!xoj!uIj6=rl_}3f}3_l*^{mn zy^+Vx|8^n9h171nkFlG+%)c>0jyc3+u>9F@lot#~CLcH5VF^KHOdL0yvYNxuh$cIh z2klsjXh(6IbCCR}v$Uc^&kEfv=gY`_0p4@(jxqTD04#S6 zm*AR*dp%4y(@$zc{_rD_Ya;o*})t({gzAxy$6?oMW-GG|Q_C zQD1PpxxC`!C(ZRa#e$c2Znu9?;AuQLgRM({#&}DESJ$znRo!8t-@I5<_S8x~Pux?n z;tnm+2bBaP;)`-L&+V06-`Sc`ar?~Tr{2A?{4>4luUFx67`FU%^K)BZ_i~3LzVXo? zU39sbjkmhr7e(^&3`8Qd)yXJpYSO>T_Z7J`um1M5fW=74cdLN8T@ndz-h4@3tL9b4 zi|zj{?z0DGU4MEz5OVBrXfJL|uIObO4L(4S)ux9hrF8Z6UpB4WzC9C@Iu{4ND6Y0>M1277aU7R?6HzFc|%huAexR_q9^@7wR^dU{#m~qvv z>{i_U&&oagKPvaY51J3xgP~za@A78&p}(nsWF25W|C_$8fQ0Nc>N_>drNU-&lGnbG zGg(tm;D?y?HLoJ)a>;a9ISO41_fl4Xo1$Hx-3*_ zMoL~iWX_*$^fGb4PLjjZz>74Zp7X6=9$bMA+H806K>4LtFH6m|`PO2tN+~OATI3>< z9PAfgMZ$PIcy@V(G!HyFq?>HKYw1nnAOyiaWo2ca0vvIV_Ibdo0q68!y*XrQ{Nu+J zUJDBgW^scbX$%k4V!G6d)n{#X(*Q!iBvScDdK|VZ+u1D;LK2%v+I?n5n zmUJVP>3lla!$|iR&*3R?@I=F!FPfXSTLgdHr5bV+y9|<(fF>u8=9t>p+P{i-Y#=}? zW7paA%Tgg@E(av%i>j50rk3e4GNsX;3pUz93R@(oNd$cBEo&`!f}o}>e7uEi(`82P zu0b%cYBz3T6?C2bISXhrBNRmNY+ z#$op(BI0Mh>SX)SH|&pt1IzTFYLPVtuaJ7GqeC$N*k_{2oTQ)ac80V8=1rfs29)En1K%K}r%-ZX{?q!{hBDsi;Nr#O1qLVg%Ishl@I0toGwdI&QRH}v zq0yOZ+4A<5MHvOTTHQObYdT~q__1lBZ{SzrEB)e3gUtPFIU{39vC2qC(Cq4#zbsaj z>Z)h9VB`8Ovp?DGe5`)Z^F(osKR_AL1R1`h+}FKMu*yIakeP+W zzww8`X-o;ejxZ8-HguY|_j1;m6n*^1oZJgDBk+uonG&GrW58vhG>Iza_v9|cCtFJt z0!E#h?awUkx>npZ>XseizA$!xW&|WH~tI_IpTLeS%XwQff zS_@=n{k#IPG^6io{`# zzp#l!fyL)QaXy`0zLCZ(TeTf{L(OAv!j#6;;xuFQ)bC+C%g(g2>;E6x`?7%ZZ7kK7Wl9nr|5i_HH|Y#VvW9s+ zpQk|r*O$)vDp2@0X42*vH&0_T{`aJv|4N?t$4ht~0VmmF|dv;H)=)BGw=6`M@(P8`Z^KX3`{{u7Pf1oXlE-FzS0?Og+ z10#cl>g5G`>~J2c^D-a?gK7BIg+dOklKVrMp&@}=SBin*Yef$dFjg?pyZ$Gk;pwBt zTnM*orHx%PS500>+F-E(h29CS;X^;W=+GadN=ue9a(0%$WJK4`^NERxu)9!J>IIw2 zv?f+zW*{MX6wWA!blvcs@#cupadVTx(7~&!^BgvBbcJB^UK-J6!&VNu9r?j`E4n6) z!-ubvThEkZoY-I3#WU7$_MEoh*49?p?hUL|-Y+~${^kN)dukq0zWJp{n#<22RMI(>c=v0>R-icNenmvXvZphuq zHt^)3H3y^aS{FsClmJpWtM zkP|{l42W$AGhl82wrI+679kO~{*q3=9!N@nXa?%SNVav_>9EI-gE*y}NF?ALpxr7+ z;Q`jx*0G5wVIdX+4m@9q=@ooc`ywkb_KvLs82(=XJul!N`2wAmKST)ITOU>4^`|>q$sEqS&^#Ut`$PJrCAF3e}icLh!L$iRHm38U> z@yS9+v(Ww`KHhw|H4CsrSRTOyw+{6? z3o}qZyuC80J25dqB7rS-jdsiaGsQl%i=LWVz*KhG0pb&!ZGmhp4WSK4~6 zA`#A+E+%iY2KxK8Z!5}*6p}};bQP_^G{1&q&W@=F;Zr>1dp*SL-PmZnl1_*adD;nz zBK|nsE6Pz{Ur!KOmQ(KAkkKC|3EHgt12lBnNiHJ=Dpc~>&q^1HdxxXh^IG>VdQ2qe%bs@t!S=bg7n2~3ZC{N$;5XnN7+m-=q?^z-pq3$Z6XffBxGA9CWwwn$4$JA;XfFulAEUq!$4xFH3d zoS>i};!f>Tr~Kin_1fkqTKR=AHG?_StAl0l-t7g$nbx*oF@4jsW6utQ>xyLiEnZJ* zdOCS1qoWLpD6Nwxx0^NPdq@!y#)byn+|eQ$m#Oa;YQBB*MxE?G#74Z2iK`yb4kwL_ zf}l*Q2Ceqc(W9%tC0#@EDC2HyZx2Qi1GBOK**K@A+34lXcwNMB6})>2`q$lfTP*AE zz{i#REJU`b#kL>_Z;+5-1+wm9q|i+;PGdUA8C=l;jTo0nwQ!#Jn_RYalwScnm13Ln z^Y6I=*b?UeAbcF z2=cz@6Y_<|S!+1uaMJl6P2o|JwTW%H_lJ|hCrlu%Kel_sCnIze6NJY9&Ol+J{g9Km z-NunQN~HSGG(V@|u<^o$#}bEY|IY*zo>{Z`ft?LpGwi4(33|U7h$*;vI!!|bOVaAi z&>t}UABg-`Tdf^GtUvjg{?a?FOOOx`OZRdVh*74W=R^;a4JAi;nEwv!xImFRY!hj{*| zmT1wH?R@G0YKZ~}3KjkPT#dbMFKr3M8k(`&;JbP5+z#2irJ3%K6zFCNwGFfdgjq1` zV^c0vbEQDRr29tyIvh07yd{y|dM;k&!U!G9;(#8s%Y_hb`XLg{EDB`A$5V;q&+rg_h#mRm63~9a-H{XOO$Ku{JSEn& z>7GrYsN_E6G?$*)a|WboGAQ|81^ShQ!i03l!C@bsWe>($Q}UsCyD6;)9vq}au^n3E zQ1q8u!PWjP(mQ+ZTufdbCvoLfdrs{Wttt&p8$v$m!PwW-3qn?l6(aZ#x)lCX%OK+OX4yG0VoelF;nt0Irr|?o- zUQe&}IISZVzx-Z8}PqK6Lbk0YE zxMYwhwFqjQb5()g0FZca^%a5gpLeNFL5U)`G)7O1GiCA!nicA*y#NtPvc_1rm-82XVUq0mi zH=CcRGO)WVr9?Y`kABibRW;D$y6Wuxhfrk{uxzcJVxJYz(z%RjEo(_9 zELBLK5(Uw7E{a}W=zU629$NWfhSJSaPVCR|Pp(pTmxq*ZvCZY4yKiY@vzAnUdM6?% z4>!+4QF9-jm~C=N4fzl&rGefJ#V)Uq5DmyvX7ieY_DV=9U!4v;F?WjacLW88rDEr7 zwG&3;dM+L#ghFX2=XB7n@hy&Ng1slZ!ceGrd2k`RC8u82fM~M3w75d=(S#yq(D=pt zp#iw|+Zxf!%+Wr3}5$MKmwqu^qHj?ewkM^4*cc{nYLj0$Cay&9(K2|>7m^ica7p5p*@}HQZ zO-_OO&DFe<$+P<_LZyvmp8R1G62hcx(RPRE)po-zXOF#&O&Sv|D_>nbPIWM&z}$UU zdqh1A&*!!H@%oJplalDb7gQefw_YS92)*gnVSFmrj_KQ|L1SZL2*ZPyuU{WAGBRo! zQfe_;$x=5_|LxneM;q*O+71`c>%GkiKuC}p$@PZCL?_bsTlE&DxXI+iQRr!$-~DUw zg4BaL-7AtDbfpbj!HE@gXIDcXQqW0IK%{}%C8Jx(K)>$J8uS{8tj5H8TR+pKSvP`M z#N%~0^FKsli)LB|)FYR(PWCStZGSR_r8{G2az zLFRf-^uGIub_Wj*Cgi?k{#W)rk zm>k0jkfD5q?NA6D7tIifP1%I4FI~D0??xewA0D>|`Q*nhUw-Wi+lwft7A47m9L`KA z{44^XrzYttw3%>+%zoRwV(y7h1reViRu(>;D)>vXZf>1e73330DR!Ny!I-V|=kegA zVem02w{Z-8j!@kLV7Vo-hhn7gM;iBkJ5(%okG= z@v}b+uKqB1^23~3jL7a!^VCd_c=FB4npz3=4<6iKX9sMP;To>x;`8rsrCx9Ze1ACF zk2^xtLD<;jH6fo{NkXHBTQ!~`K`6a`zENU*Iigo)fstz$G?4R@-O`ss%0{HotSzUs44EVtg^_$JARpSOF;Be${;agP`Pm3%pEZ~CeMyTC<~d9l zal8Q}NKKhZW~h8d>yB&gNRJ?PJPb{aZhB<4_u(iEug%7LDi;StVA)9+VxKy-8MQ#m z2se@Dxaf$9RPI?x2~3Oi zyidF?i(L;5xTU1F5YnOb^kDcxr2>YJ_C|57yYhJnzN&i6=gzC=oB zTI~x;rMoPM$-wcqT{AM?=-5h>+otetCeOpMd+pA)%c@7@vJcsu}KmF7m`Hd+|+sVDe`Jg=FYHMqIAmf&P zQ39JB_CT|iI`|MMXd86Q9^Vq(9M!SmUvWtEw4lNrsSq1;;KRaa4P1j&q?4PEnhj3CElvyk{FgXw_d#k2g&kwdq*+etWU9 zprt1ka_EtjedJo)BFr!DF*(xWi;$}u{Y5Rf?13#!jmo0LAMV$p+!OZrX5U=(jw$cQ zNS{AdQ(aRW=44AfMz~70ZT`PNIziPD+pwYh?59L6{q_I|DgEMSCwxzcH4wb7*gb=G z&QDXAybku82#=5S1~X}%B21m`fF{P@%3Z-spoH1p+e?E>#;-1){W3J+(wX{-yx+lU>H;#zz5=ZGWjq74-I{%rU?i;y`2FuHuM__aC(mHr8l*=2 z1AhK3wi3-(fV{*{#hXlf-dgU}V(G6B;8%o0i2m*PNZGFu?N%tIgPoy9oN*pP&CC3;QRr%JOeI+Zes{ zSmzs8b6D@`n%^AAvoR=uJvuAUgXGewbk=OMyy4#<>%aGD{8Q)l52*Iv#8GXI6P4H@ z^9ymsn{@s={)rx&Ho#EyufEoir=&cwG6-(h=V&81PGN7baV>!TEH;mm`XdJbv%(5Q zT#2Ek64GK~wB%+f#?H$be8kJs*Y>$qa#vUxF?QuP zN^2Z4cP{NTFXwqBh`bac;-_CUZ}N-03hEjm^OdMCJJdfl0sZd+)22IsI?;2q{5t0h z&ZqBkw=~fy&rVueGw#_E04%1I5^Ys*?T$Am{FSG(Z}5BiJR2UiiIR35yFU%@3HTG- z39TCH?Vw?os<+Cb7LqibZ4(=Lqko->yS1_lPkGN$6W~L}{$YFE?aU0n? z0gD1`dEICYav8|R_QTLNt>oW#WBZCfqAz(Vh>i%+mnR|mq5$wJh>QRjTI%K=f>G;~ zC7`9NZ*NDN8^<9)9>w@$94T)GQ?!pp)I%R~cz))M>rs4r`3Yvo zTV}N)sGMqkO>8(V?HpjTG#2qPIhnq{6^TtNR^^DIFQP9bGT}Fr~is zJAzJ9bcD2VJrURKlQiOw!ia%`&euc=^d$78$nz-gUp~38KN4+j);(O%5}A>FVw~Okm0emiUckc@}X^2CTSM;Okzv) zTwM=9>cyPgKY0~w1Ii+y^L0Gvoo>GO;X-p*OPZzL*KYaZAT&V#MJ)ze7kO?y2?pJ- z8}pU=i2RahX8a~jk>vvO{}88;H^w?fuOg^y3?h$@^~;XP>D2C|?VrRdBw+!QawWcj zOUWQ7EaQs<%IHj0~$F7E?GAcGR^2zCOdA-eA$NyhhZXMr#_Lt6mXNOE@HAxN4Nc=4p zMW1`;{7WhHWbO-}x}hA-&&|ub3d{^z7k4=96QXsP7m!G7yA3~JJOLr=qj+A540X(3 z_-1wKq_3mZP;=Tv+v%m;A1#4#P9Vid>g5kS#nm&CJ5G20%L4{GLm3&FfP9>tCm68^ zr$1UEY?}i&ZG#M($t~fIza$D~X-U7~bC1HFm$0M|rJHqM9a!85dz-gTL#GRz+*?fE z!GM%)G^qivD538Huy)BS19$zL0m*p3J2?QG1;TWloCa;;;hfE=dDicE$lzCb{wTZ$ z$>IRL$-Cf&m)T5Mj-W|S_bQs8O~q-#^)zrZOixc=cT8ORrWH&~ZxE(Hw^(>~dIG4)D zK+YV+9+yYJ^CMNPZ=Z^Vo1dar1S{<-Y`mJN48F1d{L+DID>(&2u&08Zx{7 z*=UI{EeLnKJDm8IUXAetd-gMQ5A@B_q;H*Qe=B?ZJHMGLuLJ{#@PyJ^pf`wRNakus z)3wE0QcM4xOeZ>pn5zwD#Qz{$3$qQn^RJq<>(c+PjJjRHjj4i6hVd=QRMxhFQrMO5 ziWhxwH1x}vVncyBN+-L(D*Z{s6VchhiShxgQUjttV%z21~aIDU9^QKK7p2)au#B*0wX;^jSbK=4Q4fq49qf*vz1V!kI zO?yH7q(k4&V9=EFgytViSbK21-4JtvXU71q*vIPR|bfMMozm9`tK)CgAXa zY$9YpWkmN6?`OA3{%s-O zP(B=;FwZVCY+!iUDX_8QN62@pwNKw{?X*sKRc~=cbw=^nu>eo($)hMg1j!T6AstV- zqo85z_7hlIz`dPMnkoBz5gPi2ho=S?xgQAwD8>-DL`ia(0EJp9p3C+K*3 zq^w>%U&-r@3}dUL?K)22&oj#f%eOM*(w<4eZwb$hem2*2ncgS^mpB$y(x@X@&A#$R z-n4Y#m!+`Q1Mp}5?+@t60}CZ{pW1yc_(MzfOvE_};NzZSLD zP;qnX-ohc}X@e47L5|jAH#U<`w*(o;_7-ia?^q;-yo@)k&hlI+?>E+8>$7p+=go~w z^it*XweyX3F~z|V?FBx^_m9}CI}$?)u+_q60&lbWqwPy#P$Ks0vuDq4(?K~@uV}zP2k|^7ZRcfTduWh*ODZ|w;`{=eWc&8DJLhVaktx0 zTH{7W#v5=r+y-~J5!($I)1|Ga=bO=fl?La=&;hgCV51`eKo@rn2?#2TZDIg}=XwH< zGE@DC#EV2i#~9}|6IXM0mnM_R3r~3OsjR`6?YT(-I%Q<7M6!m)QH`R7#ZGKHTIgaC zU@l%96^VEwfEw^VS(B@)s*d3luu3JIRe|<1jA(kz9S5RX&~ruj#L1KX%{z-LFpS38 zIm2vCKx!#}=oSwo5cIM$A1)Y$A3AyBgkSSo)RKaNf}6A#uc1VbNk~xDUahAx26ef% z)C#*`^UwEp1=u$H1iN2eZ7lBLv1f&_`YIiaE4h<#Ru!cB#+$SZL3yzCGq2~~zUB7c zT!7an)h-5qr7xEv@x=Q7z~~O5jbPvRl{=(2Cp&u-H|Sfc9+f4C^qwzWW^O zlg0V@r_^*eJnYuFX-sxT9J}!Nwg7K@m+9oR#Ozq~QSZmIHm-~x>hH|otMI29jtoc_ zX|?^J`Q3(mB8c{-wx@&C#zQj9JNzk~k$N&umOH;+d~-FKMk@a;?|jWECF4#HmH>(C zw+ku{`qduX(!Nwjr~cBRzG5FK$vtA*SbafmrQgPm4k4Fpr_8L;9(mQRR#V(j^Ilvx zcS^3Sj_NP1GT$F%Ah{~6>$rBL6cv@+aH+AmNRNVAad_Cbl@?w+{e69QLOq+An0OgE zuw0asm9?WHbZ>o(7+0wXgJUPjZr;a)Y$s{g`C*0jMJFr>*^B`t;PYU3E^KBb^hV2qJA74qbBp;iI@r1tP$*c5n z@&RWlE8bX+1UU-T(*MIv=9^rmWS z4$}>s$w})U?J7nR;gr*UQH%^o6quxc>Oi?ck05+(W~O3`3nit*4#nWrMCqOyDU0cf?m#YPb2c^_r4zOb?{J{E!KP15G|4A zmFp8Ne8RMorS}s-0EOslx@bzEaV)wGIOes zd!g2abH3+w8Q)Y+OhL!A3TNZE&aTifd}So;7}!vr>LzF(KmIJUf2(?9vdQ$-Dw~Y? z1sSdU9zjGG0yjsy&Dd-43dkU!yvub;y2Cow_h{I}=3$wAW_AaJ&Ulv zsInFv@z(Cjn|HOG6A5dpq5Cc?^1bG6#$#+=iK!}w zmY{qeWKI*9JGH zSC2*lZ{HVh`)=<0`O%zw&GGrpjZ;yBdI}SxNhHp%`!7sK>;H>y5 z#Q0dB^__;Ll!cJ`rWF034ufAVN}kK{FXwW!F}Rc7<`U?TI=heUNh=#;oYE7cKD#B3 z0dDT`_T_m!>CFeMn-aB|>S0Z4H_@m4$C3b8~>t&_6mpurC zmPwaH$9>zaQ^MGu%79yB){5XuW=LiaDodoRBD!*AydsBkY&&EXq-vcKP_UDumuI8f zdYpmpH@!PY!?Z)JUs;nOeAxgbkcWG&DAREs6f+H!r5Zc1pTUlxv0YQ-a$RlNm^3+` zQcnDG&7V^f`SfV+t&A%_@yk4AUm>OB=+0jjcC1m>Z=38tIUP?)+pZOFB|*^~Ne%Sm z($*|~G&1o1W1@j9ld4yTf5AbYQ9R(T_$2rC{Vq-Ar0T#2K1Q^8Gh@jap($1`1Xs?t z6to|inb>w$%(y(^6@&h={^}PC1N#;a%aoapR@3%qDt zKu?6gDi7eRw=pP>LJMRlxHHBd(CCzIq8YQhV5 zAc6;lmB~_`VfCFXzPZ~U<(##3VvD&Cyaa<_*+Z-`v>r-8H2dLPbcj8{T{=Hs{eF6@ z(lYB0uW2k^vp2j(?Q(8YRtnO!lKy>egzq<@RLme-|7>>YLr4P6uZ055)p~|!$<-b+c%rF zYkl|FI_wR_w-CQA z!i3pm=_C2xsk=0sPVVhL4eKv2zqtg*vv0i}e)WQ%dv*p^sw9V*j9jW(xw$|(eN9c_ zy2Yf8iDK>h2cNpUvBL{_q7l`fLdcH2xQ0*9W*YVuu{BP2T{<|W6Btm&cnmj-T;u(>^xhQXL5V7Rf$XZG?R zANE-|`q+iceXsi7#^SJm%xsl_hq4wzN@ed0D0c6j(|hIj8S9a^M%>)NC;-S<%wF{2 zWvZoPcXqV)9F?DtuyUF?k;181b(}V&qN&40=~2Rw3E^p$?X^yXlA7ny0s$63ileUO z8IfF%5<i>Y432(Q*epdd&+>H1HexHelhnn=C z5c7(EIE;}9=e4$PyBDI@FZD_OKA2j+DAu*RHrdgu5TI<^x3a;b_kW*!Sf+OIw_C&? z;Qqh7(%;=y;{GtTzrLsrE?=cqkMOSiAdl>-Yg_q~H~U_ce(C%$XH@aJVr03%ebIlg zqW{ZF`X4@wf3S!DFWzq-*W|FTjO6!PiFVVOI$UK-F&fFe3Dpy^{o}S}(!sdE4Ex>& zc34Z;#LTIU7!5AlDuAg58vF3o0<30eDJk=FV7Wnn^7O@vwZMqY*)|0|KtmNvx^!z` zDNohr4QopeJgbqka>Le!ZI0|5SQ>lLJaYowvvkyd z4SeH!QptFax!PO?JzW>l_x*KETK5?IQPDQP@pc)lOh7Jj3wuaY{ns@{pSC?&PPwXP zHe;}N&z@^2{o5x!x3II@VY(gu#k!>#LKj7B0x8^XgGY_EV6y5oJI61L~L zQPA6NPm>j3f)_IYZw^`aO(0eQ0Gl);;wI z&1(2x=6EcjN%-Z7jDexa$&~uje_(Ks#a;yD%doI8 z@Mu>7I|dA|b^0`Pl!N<;ufaH3Zz0Dh-~9jqfPy}I+u^K6?FC*EIKOA3p4s;fIatL$ zZ2HY1jxfr!Te0&VH5#s5%le58rs2E9uF7^iFC0#r4mmX+vd}}lG`=9=viI^MNmkVU zWxZx+n#8E8m-T}(YI#$Jel(i1t_sQ{hC&jt&`1jAt5_#++294&8XF-RHk-TG-2)>X z4O<7j`6xBmi@t?q30WBl&YZF&KNjBF5t2N)xFx_Bv>>bR?-at6C@%oG0?f842R;MG zwe!jY@ALDG;kX9hEfAD?pWD89zWPbjL{Lh`P2U83#!yhXs@dW5+DY!fXp6?P{)K0* zeYZM>CPeu-wqq3X#qE8WWqEk+Cae9VLugh511fR*K`h-AGv5yi=7#=p%+uI;XFPB3?HVxp{5`{>y9z6^~pQrFq6T9?T5-h3M?)jctzF+&{L}NpzqXi znY_CTUt3!-(L)VWKdA_T=e<=)y}e%^dZW*QeU@|xf&$Rgwe|G{jYX`P?j%LnZpH-z zH~tjK40!)eOh_(!e#~G~9%A3H);`gFQ2P%CQZfP#rEIyrw)S=GmJH8QcfEvHp1ona zBEl5pf^B8|kLTM)JgG>67$}fDF0O~FN|b9hcP60tBq3t3Zs}9u5R*)|<<#}pM&6t@hWMyekd#~0>ee+7nz3Opr|xGKY|3|LHUj8y)ATc-cWx|_Pvm9G& zi47s>I@2x>NzV$p!Q|fJxxrceg^n95Bs0>!L~*UgUFMxEv;ZR(l8;@u5$9#MP9b{2 z+-*#4LvHM06{|h>m-3mWZ>>h9OKYqi^udQcQYrrdVq}YkXV6f^KKuDeUy6mr>h#A8 z&E}8qVtpV01`eoC6KC~&r**4U&e$PGL!zJ(feqCOPuAF=)l7CaFakw#l2;&@4Y<=!brhUL&d?RuT7JApJV5FV^Tl} z_xpbRDgpEhP_37;01X^!ZoB^l`h5IglBP zP^r#*Hd$I3Ua=ZTI9fO>KfJa72ov6IARiG7S4^wGY>LeU4GOk{2c@LK!o$524Ke~& zSAckHk9~-EPLPozL`=%ib(PP3hB=lA37>~r>aZQ8kPjP=tiIMLudoff_=1K-Ccj-A z%cjc!4U%BXKw53Msw^CfI~Q!10Lc-4>{8Gl!DhkV97|OJUK&Kp0jQp~YqDRN0TI`p zJ!2{VvHnE1Gm(pk`JC{YUM26NS^CX?-wH|FcA5rx?!B#9&0YTn!c1!O=rBoM)_x$F zzm&3WL05_T$4Tqir@7`7!|^2Uw1rz1@EIN#C)b7o3>m6oNB@3Qqn(h#$Q?e&^An*G*-1 znAQbm5Yg@fdJ9+I7$N;NgqFbI-;cHmkARWb1I;$AYq4Lyw3IOD@cbhO9~cI zF}hNgEd(2_udi>Ey#oqR9{_!C^ix)X;%w8g=^zK)uhuL=*%lBfH#>`#c2}iDhrGLc z?xts_6OW-|3k3=&PAeq!a==0(h_HV{Pa=IlAeM`2v`}&4_k6zVBol0(utic zbrxxTjnR^P(AemwUSzVtD?QdyP9Y!xMRR z#)_hC?I*9w$ilQ)Tb&x#_kNVS_wUC(eR@W|`#YFb+1c65{`@;CFhX4Mxh}j!k`h#r zpAm$()2DYKa}*^$UcNgsOtPjq*@`2xvscK5@s1iv@# zw;8ze#~0d@^1?;4-yuUZNl5N`|HR;B<>T%~YF3>Apto*&mDSX4E7>_ZI%X!$gr+yb z{@h+oCHUseo1|-vi)|?0sOUHjAuNzCygQB4p0Zu$ z2ff;ed{xEipv|oV)mV>^Gd-V$M*CZ3i!|uD(9VWnRg{Lk5Z>@n2W| z26U%35rFRUlmDl;D-VZ4?b}n@v?y82Rw$K9WXoDokxE)9iJ~IAh#?xK5<)mCDN|II z7%6Mk>^dP?k9|$D%bM-GAE)oT&h@_Ux!(7W@B8LzVa$v%o_U_%@4oNfeQQ@!-(jp} z@EuO1W5-ql!`v^)?`RI?+TxY`ygw|YP_GI&58OEO_7y3V&LJA?6lxv5bRAW;8{yj& zL$o8x+UNYN9bk(F9{YxIh+}@|Rl;gR^XaU8L1*FO7EMPRlb=&O-+b#npNnh5XEnA_ zi|Nk0mf+|Tl5pOFQl&LatX{|eUd2ONddG-fo2|If=m}m*;dGnS)P?6unPO#ie3F%h zYLsM!S4$XOjL%PwnbM$S&CWbb7WbXduR^f*XUE7zg=zqCDA+Q01RcU#m84VG_e{dY zivXuO+lb|i_!`5cI+q##O$N3cU}_*=4nvemZ03v{R_bVflYljEMx$7@4a-=g&jy4y zsDs)AFIey*6Wb$-_?k{Byojj#_;q5b8Z+bXzFgc&zku-!iLaU;F$av?2>xz-#g+B2 zeMsW)p*tewN1KT&<&vxv+s<>+!PB*DnRvfHc%5CeF} zg%_f5Ud6`Nmbf%q0GtFS4h{1>!eh41L_|lc9z6K*jmK}}<5c93Z2F$12EV`h5Q-h( zQ@AI4Z`w%fG(`#=is#kh3s<{`D^W_@>~LU;ivG~mxD*|O6f>+M_PRZAR3L%pWhP|u zI$<~DI-y70L5EseGMZc*w+J)Kdc8a->i8l%ve91%Kr6fGD~fSzBRzbvqmu>1NuMtL z;8WH=>7@5=*iN8&e!NhJuIngr$Mlz}zxO#D71^pA{m|qsW(dGZ9INo$0$D@EBgw-o z1S43`?010wLv4cDG=#GF&m|;QsoV=>rnzQ_$Jj|@wcEJ+i`+%N-;LZIwrcO8)!*r@ zw(=A|*m%%4H)`ztz%RIyS9+|iI3X;x{%U;wrb^d|YSW8@wKwC{EXSC$!1F=CdE2!S+sw>$0Cmk-H<*OJi(z=H{t*Nf`wVX21jz!6*1&&blIT;>gv&eh z-GWILP8w2#pfqTG9h;$Y>J+yRzam0;1kEwpj2;EDbyZ|q0aPrjsgdpZzQ|*^;tk4i zg@G(4oFY$4Q=(AHV1DLNCx}oAx3mww$g6yv7rj^O^!>(I%(1b%xVTW;yk&A_dH#w` z78-2}O5O9iQU!4fC|g{AoH=*7!wnO2Ak$g+6*e)HoyQ06CV68h<9v-(fQ2-VshL>= z|IReDOBkv}l=%v1m;_Jz5oGc($K~iD)dDrMVD9C2w1T;4YRnv(>TA0$?;diT=Sr~0 z$y=%2SG{^|Up9*>L~(SzRe6Go zLAB3?dm*)P4aqMz4T<{s22ZtF%jSCCLHZryL)alE9Q@XTAwDftX%gAD)kc;VqTS=s zY3M}qAjrzK55OF(mfgw52WAFP1R({v_ha2hz0bvl5bmUsrVF2J<)zOWXRQpVzPDGBzasV1 z+3~Qfus+RV9!*S{aSy^-CTAY01Ou`z9C}s1V!~aH@CJjDbieza`2=M2>7+%E4tN%I z0tcRPE=$kIQQpq{7cnl&l=rV>1*@8#fk^6}?vQ)T>F(O+go{r)I?vat_;k7L&*b@r zWq$z~yXHW~;1sTXcQi*PsF&x!!rgQB%Ib04TL=tSHr^cOHyirO7sOtwi1&6_k`ePH*;eK;nLz*Z^0#2+-{EuN6RXM;d$VVQnk(@dv-CELJi!0WK2Pyh90}4tQ6l!+6otZmNL_W$33}I6d6_??Bqbq; zYh{epVVQy*an&!ct@W&`suK4kuiHj>0`vB1!Le)KZ1ZQn1Tem1K5P<+JV^s!jrtAuzU(kiJ1ZoODzR{8JiNI2jogHRNPD zG1P%-LBBI+M0es5@l~*~5@+h`59ppMD(JA#zq?U%qRDEa^LN$I>h1<5k&R1%toC#^ zP$yfcu#1rN10IH5^+Tr=KsKD(4x2*>0a~^q+i|$NwxZ$$*rz3s zckr}D)Pq+BTv^b6YE~PmSC~X-2Dy*yVEhaahh)LvD_07ArCKLjAoV*c0#E=GP=N`qR%=PN-5fY1#;WDYpgDEs9r|x=s zUhxuxDj1N6Qo%a7XhD~N(}E|rhK-F4m4vE9F5TW-ng?DPgyKrFC73gWw)_g-2fj2k zc%!rR?L z3$U%3Gj+rZ{0}fD<(vSoN|%S_p@~Xk0<;}<%64qq8uR78&#bv->M2LUr--G~R%iz5 ze<0W$;JIedT-Y1MJ9OyhKfLC|V&`y4n>@b~(A)vNOaOKGpup@(@&pQ3-QzYDX~et?o~!BVHCL8Eo|^6rlY;)l^|RKuwQ7toB}iCgy#7)Lyw?fL)W= z#He88S+@`C7=c!ba-c_1NBg3oxyJV}r{(ByU{KKJ5^$+x6qjgPG1CYR)Y8bmWV+8G zlZk@a7|-g7$3hqk<#u;ga?Wds!ZC+wFk7>NglS-jtYQ>2o3QISHGCW+hX8|Etu9^q z`p7&GsCy1z^XFx<0d%Ob=FBHEVLmy<5Zxz?DuIC8f_|-sVL}SjvB3wz`+f8;#r_q> zXo(Wd{}3$U;^6pTF75T>i%gZ=(~=mAE*>LI^%Xi_#$V1raYdFFbOSct;TODR2s%r3 z#wzr@_2pxrXjx@tM*^Rfi)n&xp7%wF#NMYi1bk8r(E2;nm+9xB=hHhk=OBNGef*TD0%>%gs_eoITL{3L)-MU!idpgI3 z-T+8a5a@iYl%K?gBb6d#8r+-O=l5CU?Nt^U6c49uOiWBQ?~GUCdlR*4Z(WiRB(Z=MVcQj1vmKZoQ;fEJ5AhypfgjB> zJZt>n+^+XchxZEVKWviw4GlxT?KSP}cxbR61T)dm0&oP7NSsUr_gool-AAf*;F9F$ z!SNJ_c{A4jQ`;<*X)|ecGLf*p;J3WKf1cRp1vW!P8F>IDaD`8RCvG?%Ws zTf6@8Cv3As{7RqOtOI-;0^)}(Lm6)yG1h0m-0ndr-B9rtKT`$Pq1O+Y>AOR1>^a9C z?V$qRfRd%j83h^9alP3K?UK>7t@DBNM0>7eqO^za_p}gjwXM6SiniCrdD@6|JjR}L zZESM&f`5e*cG+G%2#Ak$y>b@Q*x`NnaCCOkfI4|x-gD=ZLF{#Tvs3-7HMS+Ef8!i!7L`A{gx!f*v32r>le1Uq)@pkxItC@L*= z*Ns_3`8#~^`mClU zn1GFsPJ7P2WJ%3o5=u8PK&=Eip}azhO#9NQh(F&cR{w?6nR80GP!V^2ymPd958Y z=v9J`zx_oW{UzN^3bkW?*1yq{=66$`6uG%qHZ`^XPGebN|24Hk zouZ@Br_*Sz41IIFOG^kh(WxDml76;-Vq42@%0knZ!uf7i`XkgCH{-Cl@9Eon#gydjPK&GiD*`F}c4%PFZC=1~k6ggJ~HZpDY6Fi+p6$gZn zM|il_&Npv%&~2|L6?Q*W%QJcTbBhqdfu|-obr8d7F70dD;EP{m(%KzDYkU!4RG|Tl zF-O7?y;6wOJu>$KT_j4TX6^p(MG{)@o?la>r@^F|;&jZ<{|8Zk4S zT=#R*CAPvwQLJ+Q8V>-$&ydOmeg*(Ne04m7XUgoRe_oC4gwtec6H|wokBW*4ygIKV zRqyLU#(Pw|YUKjpR)zn@ zlUc_b<~p0u6xFf$nrEC8VvdFt`4S0e2F#Vk;SNJ4sh5GxZXfiWa~~U>6u(lm>{4@a zf)=&^dlJPpu`yV!G9uU1{p~CHYdzMdkJC3fnPLYGv7P3pXM}<6sS~2Pi|+2;vR-@P zVUtxy3QgZ)yJYw6^9G{>tRUYfZwvj5@%|j3ZwjN&Y)L>${+TCX#q^Yc;m4?7qQ~Ds z5O{KpA4OBEk=8i*Fd;2@bV$L$m<4F(@f z4T>aO`gksbDR9z~tz^|KN*zFTURFp4=F-)==oWFR?KjF2@DYU+Ve6;NHRX@|(YLk5`lCJD z?C=qJf}+zKFBb@Xzs$ev0R!qxoI66ZN5k*-HW#Gx>z;VbCB7nct&^5hD33+e9<2q5 z!>TewAmBTdKk-eU(pn_@Qsh0+V`_Lm5N1<%5%Pcrff;tc7+*%kG;~M za<{bp7P4IOv2$^rn&SA^lcXvmC1vSod{~Cjs#&3nSClv%v6BD}ufc>faYln)GEX`H zrypr6as0sL*!9D?tdghlaj0EbM?^L(1XGCs;6$yMN{Fc45KI0Hjew1f4LUm#iLF`> zMFGVXplN7a94n}N!ok8N3HwqU9zFA?-}kfV)WbqU4QqA*)MRx*D-QB*g2R1y0e|!4 z*d8bPi|`fmh$~VYMv6$|F=ma^EN3HUel1FRn}Oy%TJ05Z_?MH@RhZGye~5U;E&l5l zxt*`kU4JEHsrvkqoAF;pH$}?EB;{t~9(kiXvx1VxlBDl;o55oO_`c#s0Zd&!QybMV zddQFhMi9O>5D`4Gddoh4T((%FS8dis!S37r0+E&T`WBjW^g>0F?4bZN659l zU9p{zZh7!@zkx_TCwmR@W{Vyufe>BalN#Qzd^yW`lw9BmRx2}=1hVKvyLqa-L_tj@ zfM=EezXUvu1bA1!7W)Mi;I`vwzo*=6ojF~es~z&HG?VqU)`Q}coWX(mLYa-_PZmmC zcQjuX>c;x>?0VhHX;@#67`1s+`akI}4H&&C`8}oAB>j+>_J1I|Tr>8+CA$oJ85MO< zcnv9S&zQBV&!c$$6a*cH+!=@0#p@e}ldB$!&+$E$1^CS$g))WM8NrMWg^8s&dJo;S zBi9c@gH=$wZb&-ao5MA9qlc)Y3!5ffFgN>ZM&$`6JPiq9j9)sN@l*tgIQIO&atsC? zI;3iEpZKjBz>qyZR9oPklI+o|wpOz}xSOy0OJF!j>)tx+AX$6nkBp*6o%ZH`stlPU zo)WcFW18czj(g=V%(i%*R7>vVSh;dBQAr-2?;si^@dxmQT(*^w&YU~> zd=Q*-^4KRkBEELlsSiqRXrdCGk+OlE!Sf+sjqKdxPXWZ47^aqA_;_k<%!QAS*4)NN zJl+?U5<`RO6~TN;9AYL70pib%kfdWdCd2RlHENaO@6*hx|A}0*va>CkV5BBPMgUw* s{Qawi=Mp5FyJ%x)KeYs15hU=31N`xDZCTl3kY+e zpF$uYb+Pd8hLFJ5u=bLgP9Pvi1OF}15xY_o5D<$#DN!Mn-+C8aPi`ve%~ut^+n@Kt zA3NO+!=6u3H?J!cfiT|`ML|i-(ZpDw*7i+|TRO7ChB>q6H-;%BN-p`IvXGEgAQA(E z$WXYb)uxI-9{4-DhyKv@4r>U*Ji6InI!&`L>sbHgQlG0X&)%&8=Oi8a6bw4^$m2am zCO?G<7S^lbz((-sUqrG?@0r_+8IJhatQ|PIPxcI82;U$D1sM#fA8TQ=kpI5?DFRZ^Y3jkxJGhWzy#a;)-&zYcC00p zH(5R)ffne$+NHzcIMLvdK}*i@rK77)Eg_f1`@3;_zpSF|i19G1Q-icatvX4Bt7LA~ zg*V=5U*7lKWPe4Gz25r3gQz)Tkxz++hUS||c3=74OuopD{qNzZ?-MEXxSaOe<*F4w zeyuuxygoEGHU=%!i1e#**scpwLs+)hZVXn^^P>1(Pq!A9mrHk*RaT;xs2MEQSuZo# zsOsweG%d8Z;y|IxJvuyeJzuFaok*$DY6@7a(eE+)n?c>778l@fii13Ow15^aT8oV| z^1X0uiYPS+B}}})ggO;n3gjoIAVO^U=!GOPGI4~|#!{8`4IB=2Zgw_3GP7_hqyE&j z&Fmk@egsuVq50yUZMtI0t;^uLG~hNFd0p+LKKJ&*u+sqDUt+jfhvD0>$#(6*JU0hS)He7 z@73d5Ke-|!Wu`U;)7H+W6i;OF#iX03^lPd%f?6=>t*4RquNzt1h>j zfbVR4mO8EaMkW>W_9+5#A=o3P)>6;QA+9YJquyl1LWB8qYj2I%A86SuvkUZ+W`!q; zKNr{%9L~ZYOj-KK70@-^ujRJaK{VJ*27a791k_acT#oyhcHL!7iEw&eH$#1a(6n#M z1yjg+$TMRo5sJ14;cM}9bVv!i>xgQ|D=~>I^;#{q*%=wDRoWb#{l)T&c)Y)_d;P&l z#iRW68ZBl!-S1{f;ZU}>*DKU(s&zX~O{t5g7#Li|y|} zYq}mY>Su7>8ZdAJp%DA;EtW63w*Aver_wj7lFT}JpO%GB;+jR z%9g{-ECIGbtnYil+C}&F6aA}G_{c?NX=U~8vyqQJ6%Kr;SJu98_aF7Iv-;_?#}{d^ z#kw$o@f*hcQX~UD{>a?Fej~UAkeFbf8L@MndW>i{$Fl_^BYm?>c!+;L-^&La9wxwt zX3I4k98RJb87@a*>0gGA=#f8fayJb#8Dlr>fAxkaBiZE*p8TXL2QNj&)5sslm)4iM z$$q04g=d>)+8*&q30&afEg!&#Hmsf-15$N4&$Sk|MO{cP^k z)#{JBX_x+QiKve(`eG0&(F7;EL}=Cik}o+Goxa@Bi? zDWFaMqm0Joh!G(k>8|Pd^tfDayZ(pVkiucNiD%fLT;cXkm103s)=nHF=w$sdEzlGu zVaj_gW9CrX}*Z`ACqaJlk(jpnaP_L#4kio6n`U66Yg8W6mBTd4?4=ZamF z(-4?~2&I{J)d*fe_j>XRyI`u_dWsG}>+D zu(7kNUZ_1t2lnNe%)~;aMVSp^(rb|+nt(zX-sVAfxLt*8Hkczr0uSW4jRwO^Iu@eH z7tKRj)0*HHGB9ybV4idf_=*XU$X@*j!&%je8XMXAla%Gm%*?JfyTa`Pa^n6@O9?sEeA$g;yl+H9X$?if7Y^wo0u|QRYziZM>5HPYDpD8p z%Ao4DK#j1h@@|wTL{wqW1jCWtB5JL=<7ZRgrSa}Pp%8|lq?c_cpD2XGg$zWUp<^)9 z9USZGJr!|WnEOr}x7VdKGHHvPriN22@CnOnz{dN#kQZ)7{|VTF-~{SapQriZ|C==gP|wEi6;weo22^-TfVOw<=_^!eS}sWJ^j(yj<;Cu zUKlfVPGIzwDVMNl{PRf;EnjEwUAel0#4nPIUE6s|)^mC3-1|E3M2&XWxs=T7Ts?wG z)`NTQBG%tk)YsiMgQj~IsL{QJ#&bIcQT_|`J>puv$hufF=#QMdrvTFDwH{qh5AAr; z^9|=2)%`N;>v-eSsYKNsY5m2btH_iTKa>zkGgycawO!U1n+a{XmqLlSjJbpemYmT4nHD?`DstW!ErU`F9PWfscz-`MBJ$qbA;(rZ+LdAdiBF{ z^EEVZUt9oA%7{5-gs1Q+8pdT+c-fkxtTdbFnJZArhp=^0S>AJeQ0+Y#hy)`~1 zWtgkMdbyg_d`gsvojtk0EE1D`;m#v;(f_LF%jfg`r9GF=^T)+ni=DpXo6qwO^qf5Z zOAxw`n3&jF^Dn}L-nUtz;mx#v?`<(jiOjP_0%ZJIrCji01+)7|VJ~r_6Znb^;D|`E zqR>7@oEcOsg9A_%;I9=uFKYsMZGJZf!2F#>#;BAJVUn>*%ZLr0Q8Od(u7lHxot(Vu z424@tB|H(#{P8OWk4u;X0A9uXwGqDn*!9~0D3uVOQiI?bU^rWF-+2Sb6c|~SDTW^b zqald6T1{4v`uaTQ8y!y~oVi-~L|T&|LNPh@S-kv4g@( zd4?{6wCEx!%;TlxrVwa)g>-XnIweD*g4AM@5JmoS4jc6zWY#khLLjmxWORHsdsoIO z4Vd*<`d*5JBB+t36V4)dy;Y}b_^&=RstM&4#ndppb+6ucq?vw|Ji-lGHk1boe=0pi zNrIZ~wl=#w-R8p4D3xe0lmq>I-pqRaK=H;^&?X=woq_rXkO`m3D2mBoDlf$CAIsOd zBAK1qgl8{)rKHaLIT;g&df?J$qN>Tq*==^d$U8r~l5zWylwot&;^Aoa*Ao5>C`i(Q zg&8FR$!BXDB7wNzPk5uy^2AKW7?eOB{BX|O>Aw{8-itr>gZkTrfG>`%Oeyk{bPc4N z!YD~FP*i*lrrS+2aP_WX2+cPge9WnTgUE$O7_t(3cR|uFSI-BP%BT{S-jkd)(a>eP zrRRhGpKiOep^+KRPkDKBoL{Sr)RVRw?I-3u>HX;snhmM++DkS10(btV_!u4!r(y+9 z=l=>cvw{Ou!H^Ov=@Zu5U1+JfrJ#}UB+Kn^>?hNB-EVWo8AOW|i|mHGUJ)ty<=-LIY%p*5^6IZi>c z+XSMY0@ir!w-y&)kgFEh3Bq0Sg#Nq0#Tpx|InILfHsoLwv%@Hq!38RshiXn#tlULu z&_m|JtYWe^tHJDH51v}Z6jnt;g(^}Fwl&EFB(=U@pO*8*b#Zm2%&=C!cD)*aO9zWa zVPa}Z3?ABKI#(z~hfZhZ5uw^q%bS-N!A$vcB*JJ;4Hc|$?CH zixI(ih{`2$rWeLi!cpX=0FQ%4CP-2&EWtGVIBmHfHwd^1iBSRh9*il-qPcRf;0q3A zAGKwI^(sqwRtO&cg-dsiw7@|Sj&#hZHnyikirl-LRgk1eB?UVO?PRneD0r(@2MtpJ zetuq-(-4+!ZV~$FT%gUqJoy78MoTu8|LfgJs(vH%#qZ6)MNr^w3g`ZQUfv1QxO;E1 zZ!A&-Dq63>46zN3Qm%1uuPSKTa&N!1)Y|q&K=QO0n@m5DzBtM>XXVB$gNku#b^R@B-=*L zV4!V-yj<=oPGVVw8A4fEX}?`Vi^LOkx6Zq45Jp4se&!vG`}qhwSO?IV$(1AquO2uu zcMZTofX!(65Vz7Jh6ZBPoh{ZG^r~aPdXg^J1RLr3o)15yH5}WR7Oot*kYL_G2K?SS zYa?(K5A22u-LoRwuR(g1@xHX5)Wm>?G(vS#biWqo+`bpDlpx9xdI+Ni$veg3JGgW6y8F}4{<#jh(vEPr#=wOL zuM(l-J-^=X!M4lu7L?QvW%wAM+u35h^+s8q@4@ct(XO!P<*(g}uSL>tUUH!pw?6%d zEKrH2W$hgouN3`y$J~h>S`XK=gS@x#yRVX!Gq^AE8n4?a89j+`9u3~l$O;YLe)Ht3 zD;}&0`=6`7$u)2Ynjh}>=}Tw^;srI^D5aa~dLJ~Hw302P1BL66{nD^EupYlA#+}F+ zQkT!V)Cm=GE^r~SQKCRNXVM6^;#lyLQ&L{Rsf;Xw!KMsWtUo+X9~AQXF9wg2G062= z7_}5tcWR>C86*bc^G0?|L2uQS+{!BGG*Ba62e1a}n81UhB=ZJ$9-(TqWKuYGA38dH z&iL>Uk=*Y5mle6K_QdpE=3~4vP4~;Y$`VC(dYX7Y4 z+&oY48oD{;+BPFw5!whwKs|M4BrEc_p2c>{ZB=AexFJjA5*&1Oq?#7%o~^ZYn&%pr zdEwO-)zxTqdLgMV>{S^#z_X-U34Ny1l2cw)wpn>uPIO=Hal3Lp-Iqm5$mjAX|7I4b zxz?+O`nu?r*sk|h_);GSI1871Fr{417>~<|#pTI|grn57J~f}$`+Z*lq^ zYL@<$nyCCdCsWg8xt6bdbjeygoyFmMQ=e?@@rWOn>02yjwdy}WNo4hZUIYn`&%J(| z7ydQ`k*EFXI2v3@yQIlx@$vUm_#wSkE|(`YWy|(`nbXhAMw?AK_6Bvey+e9z?zR^! zY&3S~f6E`b)NNeB!NIBNk#hUFeBPflXo`LRCJLcrG-`M_bKJ_e&xabYB9QQ=R6%9+ ze_!5)cPc;fmp3zb{;d9*coh23NBopJBn4T6euyP}5hM&{BDAc#F);8JY+(7^sNCpq z^L^TITi*p=Lqz^Y?Fh0U@Ocvp4vjRKE0DWZUQXk!AF%FzcesPi>HYTjahPfMc(sM> zyHKk5e6nWO6D>;eYmZSTxDCKg0v$HuxKQ?-TzI2^W7c8}-(L>OZJ0ZI=5Tps8#JLdpRjj`vQ<%QCcLOy35 zKsEUyp$vMRt-w5+0937ZXKJGcv%d*GxKM7oiFKUAEV&}!>lB&DTHr9-7za2p(VipI zSCKTk0(bTjgvXfBY4XthZEKz1SQDAL2LA~Ju2E9;Ru$K* zHQ219E-i;f73G0KV4_og5Bts!F>$rwWl%HO1GB^#XX*=}zUG`6a43Y{FhCv|9Ub-S zrL_^s^?uYeSg7_Z-Sf|r&jw+8eamr{afLsIN2hSdeoEg|Av*yR zf|(%D*D7R2$2Ci}v-{PM>w1zoq8jg2=vdCHN5rEKk`=))8I1{2%Bt`^tvl^1T%VNW znn~o5!1Vh24Lk}pKKli{HVx1G)vsX^_!O;vX+j4LW|E3dXcsiXJ5HV9^c~AMIXPLk zU2P1nq*gAj)Tje90t5mLg&u>sGG)q)V83EXA z2A31XrD%wbVDz!q?HHw$OX>M~8><-SZm-nOpJI7HbyMjySz)Xaai)_Dm!VD1dRyGA zHClpi0GikwcYjq|m;%X0yUW?-Mn}FSb12>FIOuPHPmjbBegT~M^ES0-GLr+jgZFNd z73K^Qw4PrUq|RcNMCsim=g8ovto+dfE{J_CPyeVO@^_XXt=5n8hUvKcwHXc2%mflv zn-!+C)}ODSuKog^k2V(LyH}9#m_$zZ$BJ_T?>orfj5VAp2;*nvU3X!X0(1!iC_48o zA%BXCL%}^r_#@$S$DKkKouN~!jQKVu^H(I!aQdm8F1-tbJx_nVPeZueJ*lJqD6@g1 zx^(6yHql{@zxmCJ0+9hTDC>Z#A{{Y3nm{&`Y?=h_IQA`+W&u(N60~iO0@PhyGl^Xc z!H`B6T$U7}mA$JJe#P4H1Gv5ayGVDy>0`C>G_wAVKhowWN3+k&1ms(*m^_n=Le8|C zHrPGSSpBLO%nqQbMX>I$lC@9Fpuw>K#X8cnx5hgzaqjEF`qV7-Zp{234BB++r>|oB zY~HsOzC9go+47;K@Dr(MMDx7rdKzW-7nWuSgI^++#W=L5?4=yNujpzgSG~GKO+jXY zGu=15$Zjh61i0N!1BYrA(4|b_YjOY?9y`+Ox(`}q`a5Eb9QbMpc=opiqULa$MPdrs zG(TZBFQDxKU@&+dAR*D;o>`dlNUYYItkp+i@Tn_mcO~=77qy2$ZD*!k9iIhr2B0Z9 zO%#4__kuoW!CLqckXPw-c>pbI{|{m|_q@U$05Ji{mM+%kepZ4lP=rb|EMM7NO0L)< zPjzNA&*|m%zzX5{^{hrJ8X0JL1*8N`3hXV;DZ6+LGq7YSQG@bMiQn|I5KewTmii6s zSJZUF#b;;#oej|*6u4N~=gb z1ghGCUh~=#nHmnDw#YZ{chjVTm`f$r+)PdpArze!J-p?VO+a%mir=5pmo~)Y4uG^5 z@Zwa7rg>JHvQR6^VjE+3NQuhTN<1I{)e=G!8WH6nnz50MYi&b3MfwmHCx$ulf4HgU z&%-Y)#up`t2Di$}s|+RN^fP$3BrNR_yqgO=HyCHfeTdG@h_vCwUg0nG{co+`_Hj7W zK3c&Kk`#-L(Wwba&|EObEudjA4^b{s>W`ZG{`|Ku;0=GXIK^EiL`w7_4J!Tl`P5_m zLAFRaEQ{e6K*JA^$7YWiqXgm1CiSw6`?vuQWYVwMT|oL0zbGEK7u^b;JCpo(K~g-T z2Po}7?(a|LrMO6DRZTe2jvpA#j}=+mE_GxFG@~}qWgiy`%fS${2v&>|#i%*$I&Yx* zJe-0?KXK;h%4K#nO%tGi`e!?<4KtwAc?0S3d=tXhpQX} zIrfp!czk;FTSAOs5JV%yR0fH-3>MwVtkFwIhz`(GX<*Xl5+YLr)EMH9AQrKg4PT^W zqa_Vi2WF*IdEcLBX)9}ST3#n0vhx#zaAjSvDX7~t2C*UK>Nh|kRe${39sh>kQf|sq zM1iFcr&NxL1FBkxPT@imKCi9&(Cxw%!d+C>;kmEl_;RZiaGcrxwB1|Mrbcpdqt0+HmtWaw5xQ96zM$4C? zq?9KKjHRQ*n7ey3U49*?(j6szk$z1$GV27vI}?!?AzJ zK=;8#%hqrVpk{6Y;}H-8P&GPS={0R$$`l#b7vx!qCW%Fm_EPTpa`-&WCe!kvg#h=5 z+&joH8XPT_h54u+gI3J|760$O1M6{X7(3FY*WFLLA_+{8^p;Hz8OF_!=`pqLS<2;Y zCTT$C^Jhgre-OkRQ+8aFW5U&@xKoscc4+h4wUja z2+;FX@JMCuwG7(=5OJyA%%x+=);q=$bFDpeh#)Z**;Q=eLXuJ1&R`Zdguni$JAQ6F zX^9hU!$bD-+cnlt?jeg_{?>ieafBu@EEza!(w9_Oqk2l>?!Pps?7yOBxAQM|2oA_G z;M{&{3((8G@Y4z@&}Vd0LzejR84~HB?0F%2xxJsDJKK7YHj`JcnQ8{N`d$Ry@%(lV z@6o?$wYvvuN}lAK&;Y3QV+rFDAuVi2MH-9aCj z+pF&ksf1&jI_4$IFqdba(b!AXgSIl2X7CTe7JKT^YP8?T1>A3u91AjZLiHyL9X1VSDj7 zT7ha8ZgAaSg9?xSDJi*qqANclLcyJEHyjFF>{8OjU5Ha-=MGX@B-j-7v57ynWRTEk zP3t?HM>fNjYVI_epxX*s)ay6KYfFRYI&eQd>ceP{8gYDeK0RMfC7}`DP0%!4v_!cK zHcJ4xW;GCT=Iw&Gp228%dVU?;tWALR!695c276Dj$Wv`cL4E9KkZE1Gs0Rn4GM;sH zOj>unmfDj)KN;yOTroB~{Y;FAIztLb-{M ze5ces-w-@GO@gJp8O&>+tt#iv+#q!~!?uPRF~UP=m%LQ>sStxm7j2ha)Y*=mIK6Vl z{R$fUwUzc8tq?r;4s2rw2#Xj>BfN2_@Om)8 z-h2Gqj-)DWuhwpsF6RP|+$rZZ84Y(V40!bqtG?&$_4{@)<}FxBq1lO_juiW4zi+08 zS{vr{zd3Nx1_(stg#?&DTbvHx=C$4&JGzZtZA(sp3?WA2(Dx zAGoRO*!FOsd%NY*{yvy{>)1f;c{`b&uI5Dv7c1ZVU^sqK?R;4ltScB)M!n;n=p0)1 z>i&~g(8nW)$3>*&-8CEPA2y(@sOKzC>erMiCfHYbr4z?R4L_&&|6!Gl`2@%_tuZ;N%$L+v5Cm(r-Z7nIf zeHaN+X1iKW?DEIAh;rk)xY#D1(@5^}fl=-P#nin&JPL{j_B`Nq5#<)!MnK8zG=il%7_C+JO&K>W|0SA``)TDWp zz9IiLH%iuqPB%vNUiI%cPAP2aMCeg!YN9lMmY7F&VxNU~!oE&tkp63NLwxOA_1tY8 zZd50kIq%S%c4}r0PgB5m0rLX!@o$6~V&|N%!E9V*k_qDu-rH+(YQ@*+pB-=AfwvUo zOZA+^J9EZ2^4cb^HX7kN!7#{ekKPfwuLgCvv-&nKf*S9S@rv;Snj81@lL6b%BLah- zfR^T(tp3C!1}uPK1C)BW!u9I+zbnp)qX}0*K7DE~$fNTL0!B}Wg}Y?O{Xwa-k1ERP zY%YB-wxh{>-F?fmUmcXwS=>%d*Zoa^``T7AC9;pDH#XLzU|)Q!art8Wf)#t1HNXrRtPXf4 z+>Y;T{UeU&Sn|vL$q8OJdRI} zk5St!b-Gk6H2zu>uv=~(h%ey!tKGztkhs;Y-11XffX}y#>Z|c%^-8N%Da@31?ryrp zD&6PY!Zvg1BoeDDD`%-py@o)ULLk%WPo8eay&m6N&LrPry;!Cy?Q)~V#^KCtKxY6g zB|O8@jH&*ULs8bKzyw_oxK^_)Bd?R;#R#reQL}aGlEdiCPR-|KG#VGA`%7@emQRgk zVhW+p^+@%1zIkp}ZqNL%lTkfzs{?7k&<+F7%V?6F;Bkp5>yc@hl>5#npWC$nxZDM1 z^q!BGxryp&tIgo^=y%hZv}#8=+!MmybWb+XCzF7NBn^OIIR4%|gkW$9`TE9Bd(KeP zN72ofJ@*p%+#YAPCpH3Z-!ihV`=No6TTP~0_~~pqPEX$D&oxDQokyX{9L6=!2d{s= z@a0Dn1phtSny)ZlK`Q;jAZ@8F^jHG@ zc%`>R;>4seT+f$#r||}v$bXPSjx`5DIf584_c|Fx81E6>up)s#bUXOf)#OX1*Aubn z^t*ZVMMvlM>f+~V5*X}uaDh;`V)^regK6c|I>feCfJb@f)8B1*L!^a|{`m0TJ}M!? zb%6u!8N&a)q6XjCHH=-5@3C?^K;3`vu9Bt~t@PR#F6pKCVlKfjiJM5onl{z+;6@2X zd&kF3zF6}82pWXx)xcKq6=PZ($BA=@HwhaZzx8(vZXKnUi`KzyA+3WNJsv}wz39!T z=cKl6pu?9S;fXPc@uuma}I)YKkHu~IwFc!soB#H773**_!gJL*KyUOc$l!I^c7!bm(5jFwsC9VTXppE< zKl0#V=E4-oId?dzJ|O9L*)N^HWqZFqxLzULh?1K=?T%oQ4Zz42ZZ?oC0^G=Vlle2Be}p zQwT(;`nd^d0<=8*bB2Fjl$I4~K!s=FJ3_hke1%DGJd`FJ5dx7th$hV+og$A!4h11g z6nYB0#Zm0n%Z@8aASYEW5ELX#%!QyOm*BJChVc_l*3-mWXp7ljuy=t<{}l6MG_j&` zHTVETwZVR;pI9WMloD{CsV9L{WL$Ac$$%x0K>TI(ub%vVe=O0m+8zHji_58X11OzT z2Hm(^9yiEg{xEsfd6_mPjRHRK?tkzzIqVMAriW@7??VZF!p0`uVqGs*7XhuZ{k{*HkSN3xTQIEykP*X( zktGt=`z5M!FzCyz}F6Elg-K ziz^Ym;%}}1q0#Y7{xv9m9^D=|9}XU4_cMt{@0HIJPZgUZw(5XM5V1%WU|wT@aYC~{R*p+GurRV(zN1V+&VuUH!qUKZSGv(x>?%R1$Jvy11V*t;+x2*gB))*b;R zkqia8CEiLp7)8Ix#Nz~lYJr|*G!nKd0t82ap_sD~^8*H(IYOoi!tWVf785O0rTmzO zJwmwv)CJTUf=pdL^WCQ>84bE6%DZN{!uEK=^AtM>4h}t4Gcg^+kh9RS95e$|7H(;# zz&2BhXeP?L2u@HrPTLQ}V;clEF@ZLFPToo-zCRxZB2IXgT?;Il7n0m2Vu8W-m&mUL zcpK;i*8jidvk!tqNA$vUYi)p^xH}{DEdc$18_l75XWRIh#7}ObT}*?L#labU&S5MI zVlVg`m<#k`fWx;Z4q|=@^`?24^|!LWj(&7<(=KTX{*TKd(TU0a2$WhEdq3J_5<=rN zjL9Kc_#?r0A2ZBmx0xmFd4KGm ztUdVO#B3Ld&*pIhbOYEOV1J`>plfz{uor7LTA4%fv&4lN*Dk#L)lYC(j@&`JPP>Wc~ zO%mX!Azna_Cad*+b4B$y7qTwXjpeX70(z7rTr~d9*$GM&$q;Cv0YLZ*7Xm;Q^K}qO z`SVbVNqasn?8b_2>|u-^Z8IAPAt4w(aN>G}QVFWkKjJV+$6TdW3yE?b zlI2RbK$yo2$Z33SdS3PAt6HpddA8uRnNDEVms-!{39WxKEW~j)0MZ%LymtuY*iK<5 zZg7SPk0`wt~9(xT(jU36+qmyG}Kx582rT>TBPUwpju2(nZIRK5NtB*t+X4P9{LDwb(G>- z&LcY&gx67v`KW$>K7H_>0~1d8EcSbX)Mo_<3spS!1BI`8@B1veKeO>Lk)TkM#NRzNUje2g zx|8@QE3Y(%v%Qnoy#~Rvor!wC?pZX>)7S_DePzr5k}-2LQeNNB_kE?pF{APR0F>bX z0O*p55v%e7((z0Z*jNtf(_fA)Hoc^_Hpqme!%)H{7=?m|RBellYJn!>RJTp{BOt`? z{d)he)-aHuVKSXHRAsBl8t6iNgg_)HOD>yxr}k!Vgj4|V2sq)f7(}b~OJvi9;Y`Yg zBC(7~KZx~wnRB^aXik6t{Pvlr$vW5vds>7f^#cGq@`R?FeZJnd5}SXmVNL@Gll0)3th`OwsA(-@8HBZulJGy&&u-fhL;bVBFfzkkm1@-{%FiI-zB7L}A3 zQ}}^X!I(c^@33IDBvQ(!P=o6A#Yh@i9RCMW>Y}0$`0fSWC!R&9KyuZHNvF>LH7F)$ zWRx>vpfazsNR*WU(z)3u0#smBtym=HN$9dgGtS-2?h+0YpmzhgYaAm0~W z0)RWUx8tf?MmlN&bYFO2mXQhxo5_#F1Kk-p5gDm> z-6Nuq@+S)V0^xBw!EDqTIynMPy{L5`_79u1=fXURSOSk{k;FlFi}>dRf?kFI+mqVL zJZ%e9`_cYE$?lddF(sF` z(p8ry61ywq=`?~y>_HWGFIK4I)`jB1LeF>8~dg7>tY#(Gx( zeFljH0vCDgKl%Cb#tea1Nz}hm2enNqLcJj!OY~Nrr{oZ~OfQ$9*~U%)IS%=sF$v`_ zNc2xT7Q2#K@91En?BNxY~LL|hD^z~(!#&A)onLqod5G$1kiIOOGYI5{>x9x%oh42iMe z5i1WgPN|1ta=)W{NFr~y(B0p{Tj<*D&L>gdS%+irE1+R5^7QULh|lH3O8fbuC_lLW zkw$5E6NzUHMlQek;KHASy zng<(?4fgUwNOg1;Dzx3Vy0M_mJy<)EAI|mo4Xzg}j~80JoL!Cj z!;J0YtR1>%TUB%w+An!}%N~ziD{cz4^2_x?_ALMB&F7D3a91{#E4JD|`GB)~XYu8N zd6Oqj5bvA%&Rp-w7=6+`j5-*I5bMNl$y>?k2RJJ=ycI``1mOI+(|b395P?DtVE%r~ zXTh*Sa2Ku}_(&3D--KE#E2Fe6_EBL*{G+y{zNgNkAwp6sX`R-%2KB4%fXK?oGktqZ z3Z^wuY@t1VeA5-`ncl0aWVmge@B)pU&^?XBbnhe=k|094*CpC-`U-Ht3hkc$bn}7x zxXln=zk(6xE?+H+p=3<#ivIcZJ4+hDb$Yd1hvAM0;Q#Sa%@ltO580o-o-qX`ggI-3}g+j-tesBlaMWQ`#9+ju! zrAeq4PU@l69efAQtMxLf7!t)6jV$|jp7QH-T1_XhM&{V>f(Axwr^N$`aw&!luz$i zz}vj59Vak2&c(zAM29rhX+q+b;c+MnvTG&sE= zCu_G-yW{&F`^5|xy#U5cjKSx51ad_o*nA%MJ)dVijuRF_{OE9+^F3S0pfuy-hhBO= zY$lqR*BE-9Q^DMV)LwY|sK80Fqq)Eg)m4+{J&Oj_)o|`}oHJ&_AQ)4%X{lq z;DnP{s#RQWedCT>2|?kwk%3W@pdGKlMEZET`_IA(E!Yt>wXDtJ6Qz#@?T;Z^qBraU z`1aRF&zBn=rtuee?l?BCjSn_WR1iR!`p6<@`vU|WASy#+FG(KFyZzqUeg!vtOVC2S+fx*&?i} zuvla^EQibuJ&xZ` zGiJpM({wGr=Qzp}jn2S%@L}+~nZn#@t2N$$*e^40!&5#AfLcSN5<=Oe4a7TcJqR{U zTs*0Uc2yH;`$?`~#b~YFYT<&zIlJ;u9i(XJceq}Bz3P8i14#UAx#sJ6FIEZ&`i$;g z1LooV>7q5jN<{@^Ks!jqAqT(*;X}YwIo@qY0;a3!o^O*nCifacRGGFNg9GZ$Fm^x* z2{wH)3S_pUd-OAEA9PF?#xxDab8EVu<$uugn{U5XPT#Fo(O$Mcj)z^SFA=uB_g(Iy zW{w->pD~-?MCUC|x%E6vulPJ#&74GtZaq&4xPKfN5H(w+I_*=qwZ8Y)*VLHW2`KAe zM7~CDy%zsoPZ?N@DK~F9MAkm~tLIzxH8K>q+^+ZLR2_Oiaon{Vu7m6;v)-pMdSEzk zC@%~8;}pjY7hJX&Hk>m|yl=-LRQGb}D*N*DlPi^H8(D()QZQ~qh&~4NPrAw-Ut}+U zLxCasXULy!SlrT*8ayzafTBevh3+NQ_XP_kXeY5kBw!6cMiiV*>0hpX_WO~wUWRpe zXaRpHhe7sMN0pOzXH6qF&dWv%dHPy5>T;9d^DC_{-_vdCa`jub%%|4p`4s$=!a?ri zGgJ-ZYiyU8YJUA==Es-A3hsmM<9aF0-B8MxLU!98Lg;F#|0~4s96u?>*Z$!{O4(_3aZD$RrTf>V=@GoX++z?GCxm-)6uJoWL0jzpxz-Q@~mL`z~Y7A>b{aNPHTr2lX*y^JhQW{j-Ri zFPVbs*kkc=J%DpUbw9<-0k@V8abtTM_l`$qLWYJ!o%4sWn|^D;*x+ksa>x3>3bLm0 z$S`;>qb_v+pkOa<*kJ!+@~lPWx+-3@4x^(MSkn)vnIRoHJl1*ECMOwblZG8bgJbNx z4J6GB+>@+xc0O(e6QKCqV8f`1>g0b}4>f(gEh^_IZ`e-O9^c~{p9 zb#;Bb>Ro25es^dXLUgC;&p$gizx>TLE>keeq>T@toktd(bv=Q={tI|@(X8aDIF9`t zI-E)*F6q|?`svBq5x?kA0%CJ_wZr5}Td@z1q{oxXleLOc{bE+uis2FAzXvDF^Z!aR zSt~p(&9Iu^Oh4LrpzfWK&c*t6b2QbVO?A#P9e&xT?sjKSK)dyFhg%W)bM8Z979*AyWf~CA-hh^1Hm^C5f;fJo|m**-%<9;nm+d^Zg=kP|K=l4>Uf9 zc=Sf#|F6EjGAhcbZFhhH2N*hJ$e}}!#!;k(8oH5^jsXOv6#<71K~hT5p;JW!0j0Y{ zkPc}P5ReuS%zG|*dWdx7?^%H1bQJkwueblK=_Lg<9 z{^7xKWH7(z%f4&3yf(Z&fSCQ{=VpHs`_F5<#S1TkrzVzzrhegq<+d~ANH%|YH5+=9 zlaZ5&K4AMQ=eP2(b$9lImAW21J}3|QZpXegE06BcRi8ak zrI+$|e1-pP_8Mh)lV9IfNPg|Jx|E#i;zKTa^<{nFippYa>Q8T7YhhII)@eg3ow^jK@sCTBg^h9rSkZh|8e05X$c@exWUvuGq($ zjEb!f^h%?>sXxJ-=UufBv{+x>?XAlpYu@8`Z1yj-y*~Qcs`x$N%1n8MdQ^npG2BzE z7X4e+{nT%vp~kgW_Q~ny^Vu^=e)2)j>5m@_KBV833|#%mP*m)X@w^4&#e&|E>>9U` z0;d;YAFi4!GD~}m-CqzBK?)02hzvF(Y!Bp@97YdM#b9q=j)B!K3BhyZL%$R?{zEracJYnqC;^C%jKgJ?~wgv zymmk?>cuAKMV7s0~+ga+@lW~0o zJn@ST{8Ddpulj6jc6`J`gi9ftwPVToG80r$TzBB0T9DltJ=_r-FdehS9pBgfR zsq)zg!!%?rz71pfAk+O*z!N=&j_qv_+x(jn)IT!qpgS)fw6>+N^N4-j zuqF9ESWY6MMy4jAHDtGJtb6W;XI<#~x zQ@X<=+U*+stwj?iUMwEc)u&_5#&+$6YV4K`(DrP|I#OR6(9%)UspK1=3i`(M-(UWL zY(F@xAr>H7x8&r`0RdV;s-mEbeyY4TS!uVN+{!jcbZO@WJo%+WKlbrzhzQ~H=g*I< zd%E(YEgf*jrZGC&LVRw%W5Z-8B*2}N&Q z@Qhu~VlgrbupIu|vj}^DssJJ-!?`MEFT*Az%aW~T%Eo}a{0m_7{~oLpMceWcgG7e8 z&jF&f`#-__XEZj2n^zcN&)~o2f{hjS-7J=Vc8QLnYcdy ze!&7}X(x9ew%+`OqXE{m*8r)L6`;Ky;uqk`Im|c4|kBY04mCo za3X7Sn`w(AM?_F#6-5N4+>MdcI9o_1E66r+Jlq%q3l_IEo@%_Uvv9 zy#-B?rG1PgL@Be)fDs2c7VXuCUfM$9Yqnyr(9C1Vk23O11~nWomau=+9vYa3v{kT_ zpks%%$%cf*``UOS^XZE$-g41a_DxnMN65a6eZmN(D_tVZW+Q(Q;z(7l2q6V0 zs^Cbha`zW_#ZEeXOfWEEfISZOo-5eEz;l0@_5tNrU;Nq@H+2lr$3HD)yOYQ+2k>ly zU9E12)R%Cx_x7sJ&Z~_#x}p+ZtJ$+*D91TMjzh(FKun8r?eB(tUBK>fCUKHwwIxR& z$p|9&oLlB%g$+N<&~PAzcYqw~959kT0Qo#rx;5g=BD2jB zz(#Z_WAXsZ2RK`TfoI3NfJ)$`jvWSGw857*=~j0Z+Yf&*9D}$b-e171p{b>1B#1^3 zM7-I1Z}w;V`wfq2m9_jUp$~WNpaF58ZAI_a(8>z-OP$v;9_Vd4@~Q#Rv^8RuLjv60 zB$*T}&9va5kB>G@9UXxL{5#;4_)v3gB)>t&f({mG=SH@YCDN(Ij~2ImlMp0J3)vT#+1b z7dv8e)kT7~Y9;{q%X)u3@!y(bJ4pX}>i~dYq9L(6Z!A=WX+7Yi_Bk;T?-uq08w;LZ z6)i$_0RMf~Dkl&fw7`I2k6VffBwztq2dO=_3nKaH7|4}a#qFW|P&Nh(IHO;jHD=hm zV%<(wQuP3R8wdv1UTnZVuCA?VyW&>W-a@;k9NxwEf!Z`C_2M93j#g^ET5|( z4?)C|rIOx(a{E<&^YDo0WYZ(cnaqVy=e>yzTo(>&J8GCD!q~wUoeCaKFWAfZSUp>x zdlMF@TChkLLxx51Y1NZqDPB0rE569Hs>jNBQ5CCc`#go<)1EOp8@EWc_eLeygm>J+ z8z*PqCU~(Xr38;rFmzPO98yu!r2kxdrG)T?`E&eIK}nc?Ac*SzXUKNFsDHfTC;ZTQy<&#I@{+ z>e7UQq52|AW;yldPg_L3j9*cMqA-NBG*@dO^KL^rkzTEqMN#)N301L7+RKDfNuMyK zlmu95%jOS!m{(!FeX3G0vw8kig@NM7o*)EmI!~3{M>g;P3mcK+$sO~Mgse#_PR5Y( zwHZG(T)vC9%!;>!ixlDGs9Uy$RO4vZlO^#qMuO`!_}#VB!(WH;loseRXXPR9jg$td zrx0*aoGeCj6zDUw8s8;}Q}FIZOO|?SBoLQqjm3@tJ`VUZ}Y`tAbsmeP0-GO6#?;`l5K{<`MMs;WR4AVE1=$Ez!{yX zalhfeX=Z++@NZcG?DBud-3moTMfOg%uCd)JYHD2@W91;rtn?2l4p6FIGoSq2_qoD= z9718YgKjiz5O8=j{>P+1)P(}4yaOxZm)zyo0ost!0u4Io>7U=CgWViYWb;FGs^YY4yQtA3gu>%`60kLxU z<~?Y^79mi9@={`t(?I5~;N^rHJ9PE;8xI)?uFyT`e?VC6(h)-gWt4zY)IKC0JUiK^ zF?tNr=p4K{s8{_#6}q$@zXa`1z}EEhwdfWNHE$4URh?zp2>4woHIdLni2H)V#fcua zS}=P|^!T7hi1ms`z8p1F$=SIm6XsA2%!`(djC3t72ehSSKR~5%nN-yB0Y#wcY)|V} z8x!)tbzm?@mQ+|Xw2shSTHpM^&Vo|g)pPpL-j=S_Dw0k>Llfp!DSl~z0cSBnVt_K< z8g4K63DG^;*@DB%0S`0>U|*{;c{z+%O5 z-&IRqL$9oc56$*&#|W=7acR_FoV>p1<%tmM860#DQ^5@tTtK5)H9DxRVPbv;aT@4$ zlFM8wP;2(6Y1%WBy=eF%8I=^3wO`#fzke-Unc+dEyLtk1AreQbB6Qvtlq-i`mM*#(I0;~XVP6UZRY{=?fYV#H06AL%|`VJC(m zQ4|FtHp}wtI$G(J6O-lFMH2F^?DdYraI^=Igg9yxuV@(PYGtY)0Mx3K(G*jir))<1jZV6{- zyH+%7m#2U>bz`>P=lxZ4XdhtDuhEG`inYJrZg*^f1NOXCkx?2bXESIB6B=PEVd0CR z7JN)Rhnm`0W<}@_$rnphidFi(2=Q7(iQ7#hS=GsbBrP6sxUEF)lGq6eKFMN@xU@_1 zx=Knq6T+0!J}mj2Wtr)`tIP}DYVq{7Qgb?(;G4(QS9$>>A}Ng)xLQMBfbz%FhjW|; zH2=+M5~4`rxt8@Y!LE zaYK7xBt$i{QvVskT$_>=h2xn9u}E6i->5PKY2;;9V$jo$cdZ3NoN9y6E*ikF1uC+`1oG$E(rpMB-O$0;Q5F2y54i z@m`W9Ohtx9n)PX6`m&uoCT9l3K_?n1j#*1#K!CS(N_S-srPo&Q?cFEgT$ItRR2}H3 zkQbbe$wK-YI@YUvuq|20L`euOR-N6gAAu|+z)ChsZb6G;zWy}2u0OVFil^5ej#4zV z=Sq2spBfcVEJv0Zix#S6I!n=;IY8cJ(huFZ^>WsQrppXRnVQYjJDxl&9^vRnBOH0L zg7(x{6rk5f-#zu=tX)Eqa`LY9jgXX~BT)28W?Kg4IJ8&F-!LK9RFV#hfiuZS-%QGc3R)C|T3iT2tfnX(Ess)S`jp zRYKGv0{uaFWIamXvt2ch<%UAh+a{tZD_;p7INpmwrK)p@i?Jt#j<>Y>V^Us>xZ-D2 z?^iY*J$CjXU8N#U6HMuDre07c7j7l>Z=U71j$qoQD#ilpwmt2Jinv*dDi(^NWiy6k z+8SyE=>vCs6|RCLLFL9$2&c3GR7c32hx@vFsBncNv@+IvQS7DEUjcF+szjT_4r`3A z#3U$!KnVD2{0$JxCI9;d+%(#(K%mRbIEjXO)Xgr=m1&>gPtwO4U5>+>}M zAxTo?`u-$B!`pr1YWma?ZoKO8+7M^3j3uWmP}2vqse8yQcRaxHBn+o={(xAV@`m4O zy7>24YpEN9nIBD*?Q|hA|9B7K^gNPWXNwDCqOWiIpD#hy9-R*P{JjUs8Eh1?{;d!Q z6Qydi<$bj*+I?$?-Qk%0(%6rKS(3$|Er^GXc*X$3xyM`sf-vac$xj$|0f-V~RUN=p z8ON|z@ADIVZ@Rh^02#idk39KxUxHLSewgOr*31n_NlEI9C5d_f4kE1?k}Gakpm#p| z{fg2(aF7r7i;CT^nXnGWmFl&>XeD(4dg;@?XDB*8Z7jo+r}Xw_>87RbzGNP2Rv-%$ zuN0o7Vhcv}aqq{H!Khgr^g4t&wJSGu}cGp zI*!I9Vtw~xFiw5zE+}mTnv4qF2yzqK>uRD<2?)Vy4BXF-8nBCh6b?s?m>6?rCAwZc zT15yy0;Mr?gAkv?@#IXLaHv3_*gx$TgAmplv;a*-$~5s*jR2Y$s{>gNZw!nZL6X&N zwEHkF(&phJ@o`$)x?*2xhG!f*m{@>lIadh`W*28a6_k5?ZGo}oln|Mn%c=ht)Di#n zZ;@3ob|%E}rWR5_9|k210qRgrXob>W&L)t?>VNIhY?135Q3Xc0Bsh-yML%Ug`x|j2 zk0=cCd4V&y`J>)zc~FFv1(_$_*}T)sA_}^UQ`97_k=R=Q8_~hhN?}6-(J!2s5o3}+ zS)l^~6Ttc$H4oCg(CPBEt|L*wgh4`@dV2g?$z_ASo0Bw@e_6i^F#wFGuhQ6W#~`n^ zpwxdn$ss9~fyz3r!_4al3R}b%(YOi)b~wI9U+wRT5*MPjO{-L%&4(Q9LP^2 ze-q0}hczn~cf0jLI%Vz2$&ZY~H>#@+D~pwbLnh{AL&nGP*9jv}SSV{znL2D_PHYwR zz!MNBc0R--1wMx5wEyq9gbA-iapJZ4<_q97P&N8|78lHv4rlVEbqowfmemys+kVUA zLWT8h%+!*=Mp^^rgYVb`7SXpVeMpXW9=2`ld?KY?U*Kq`VG0@6e%z6Vez_*4tHi`% z=NQke(Hq0ZJ6)}o`;s7hs_^v`Td}*)4@SCS60G-o+O9_z=YM*?^!2q7uN9CFoyt=q z(E~i_zq^D^G?MN#BrY3Dh7u)hfvbhy4~-acMJ632swISvEJ`LF{Q2jWmKaM6=55;7 znOGldvYW)49cXQ`+r1&GN^{KvW+Nt!n066u#Yx0p-7Ja7FF0(OdQ_-xA9EN(k}+e_ zUry~~vNGbD9l`PqFf#TT(wK|sNRDdcn~R8R!qsug=_oa#VbMokJ%t{-tmJvUnw|~Q zR?5v#ebu*BzV6uOc~La0iF%pPP`Fq^vUwUW`io=`kx?>KyWBXb=2^{+dhuRq<|0i3 z)J|wM0W){gv|3+$`F$3m8ku@Gf^+*aF7ebEh=*sW1+hS(FvFd#CGsW3%%v{y7I(vv zX^i_&zdSK#ch}}Ztqn`l{i9GuITrb9)ZNs=*72^fUgXB(YIkuS5IUKDO8?b#$hqpc zni+0YvF#}8Tu6{xXeyXQ=n%VbHIV>G$D}-3C!I7FPfSo-`*f;A#MW;0jtF5kmNV_} zLy|kh2jRr|z-mv}{Y2E2iKi|Ry6wW2MCwRG)8dHu<)CsxBybJUGg;zi8{|PR-h}!S z6LDvW`sa~{8gPI?|0K5n`BN7onU{Eifn(i@a%=>}5_cP#Yer3kAi&mIN3m_oCH6J0 zf%}1$dFi)Tn%9lqQi~qMEQB1PW$xY9#0*o{+AY72{0~fkIa_^8!ICJlxqk^4{8z*9 z|3G%*ZiPWx_NR)XcRy8w84q;Ak;G#x!%LE?e)kj{CT5x?za>V~Ib#pI}W{zJCCAtC<3ul&)5PowK ze4Md=7wQu+jOBAFqIc`P*OQVHd5IlxUsAHjz?-U8WMJQ~+cY)koYg=;3;*h-Pf^vS z-v$IjfkDT~(GeI_{aeF`p%nH2(cb=6NG?$qw*jhs zgk+T!gNpHu>WEvp!^jn2UTea&qu<^;sH+*fxorU5F~a+@5|t7X3^>hkMY3xeh`PR( z4_=!9_JKlSHQB}&^1+|fD95JS7cOD06c2#S8;4rXed~z+~>rcsdVy$*^kB?>>9(`~GA3TCvL}a(t4@4%msxydpqe6Q{ zl%IA{`>(lRHfL(}a(e~XB%R}#2XK#o2~Pl)nPSdZjeVeXodU_LqJmE~TxkM^GT{DH zW3i8z0OTIePgSQuY>vk@rc(+p=8lrb#;i5!1~>p^xd z0UL$WTUs6F_$TE$^3H7|6C3zekVr58aK|=C(Kj2BX0_@X6&I^oV1?dvJi9bYEJE)4*58r8&Z;K%1>RsX_{s z&i*a%o*@~n=<;R42&BgMDyoJ6root#pk>HO2Q$l~^qM7F-^H~dJ%4la9*I> zw`I;S3WNmo$LKeZRaB--H6mst+(zc!_H2qdn~RLuluC+DFYvijVBjZ8$+SXiTxHXW zD&zh&qjy}SEsm|jO<{*hqV$9+EHCH+<3iK~i5apLKcY`At-=BC4T#5vSHU^*?q9&N1E4`PfMXP7z;YSc#mZQXy8zW{QA>N;`4AB5dE__lIkmYSZWF@~6`CC*rj z?`X)>P**Vb?laGu3>*%gFl{)pClaTTj;d82wEZaai%8Kr$d%Dnlfwf-sQ>D{~oZLcQmrcdb$rJcReaVsRbbsD>T&I-u++b z3b>S0Sr-XyG>tW@A?loYmNag;ScXt;v_TBo+k|==MkMLW`%VS|U06$3<8scnBeYP3 zs+M74RX7;REsBiqX)F~FNq4n+PKsDPhHr+TXH#t--a{XC?4bfjj*8f%<{`b)n z6J&}OOJrA_tve|=3S^~jJ*HYRgsveFK@o>=43Zonca=`v={%%4li`K}w1^%`NHA7n zC9b@y-ubP9x$_1glKCQ{@zGlO$5`E{(ea)X_JjOT#>zlSI>M(fVS^(quIrXLWrt-H>ga=DvBqSv#D$I#~0q9B;{JS-97QI|iz^UfE&xOmcR_jVJso-dPlW+Y zWtr0MjOMTbV2%S1ACkIE5d_hqm7|^a4VoS-qJ=y_Ts7#B8Ge8vIiEu8GRgL9bd{rs zbweie*f~Iw57$T3nKzS%6b<%oD^>$G^$ehu;ps-CY&z}WNtV=4+OH~!fqZ~4HQVh? z+9w$R`Sm&NobSyK6XpwiLfUp3qi_ta^w{B*Q1t^GFeuRd!GZuhI%SMf;ww;0*Tav8 zOf$QQf;WpF)uDM%+*itj93;hk+;1n{FZ^C&IBWP z%b?_sH6pTtC7w}4UO*+jN_)`}*cG1QQTA~dC{wiqNc;srH6ZTQOu-k0rRt9fjE?82 zcQUS=6^~fB48pA7kJk{ile_G;7bR&f?M7<`=FItpkQj%2yVg_r_x{{_9D;L^Ej62D zlbyXsGrO i-FwTsYQjesM2~M8l=W~qG=N_?f@rAfs=P(phW!s~z%B*= literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/menu-icon.png b/windows/keep-secure/images/menu-icon.png new file mode 100644 index 0000000000000000000000000000000000000000..4a63d810692eae34f96230babdc8fbfed0a89d64 GIT binary patch literal 774 zcmeAS@N?(olHy`uVBq!ia0vp^0zfRx!3HE}ruUu)Qk(@Ik;M!Qd`Cc-ajG_-G*FPe z#M9T6{Q(O%lRo3TKA$qMkZVMVV`)i7ei6gUb!R+)LOdlvA(zzRmTfv$lQ>i(9!sy>5X>AB883_Go(7$cE^=HpR@DJQl2!H z{&R_f^%}cYzFYO{_j|3yt4__IVKZ0qy3zB(38SN6AO&~*fSe1KX{#GX@fMA(jkRu3zA)#JKPu+X+D#j!o+#NfrF8CPNRh4vbVc8 zOL?>%I`Eb~f9300%ggyDw6X_Jbb8{wmH)ukFO}Qbj6(BgnJTgB$gEIGE#1hbyLi_& z_UDPrTXIiNUA5@`mmjaL=fC;Us^}2n5qYw(=J_Tm?cbN;&oERKanuxie6|Si))5zA*4=9KZdleL+`CuVQK67qbPx#1ZP1_K>z@;j|==^1poj532;bRa{vG#)c^n?)d2*Yw4DF|5yVMEK~zXfZC8nV zQ&)D^Ka(~EYy)O9-n2_tk|lX#3or~bZHFdIny>^2CS;vX$Tsb?Ups^(U%pHhl4;Y< z*GVQT3D_7fvaQXsE!mPK%htXx@9F9Ecb*JcI+yFm)4lhdd+xdC{Lb$v+-@(CP$Q}n zRcl#6vy%#fV$$ucNoC5%DPLY1P*FToRsD^^8Vm8S(>w=gCe_S8vIkXRqFnJJSTeP~GPX?2_T zQZBEc$yuUGL1WVu5@>m$UXy%%9St=U z9=EebBK}csl`;uRuTv~WWr0GDa*w9axjA7mWOVJ&M&WYZsl56cWmA;RQhtpxF-ose zHof}rAZgkbtzG1q5W9C!SyFgsCunLC7MmHgjQ01J#QHafET118sMW=QT}hP!Rd{5lIxVu;?%S>O_hY8-4fWRruD_LcI$GFSrIsDr}P@- zlN66qI!37^WntG;rsDy+eRJNX%Nuvi{Nkh{IG}{hrJ6wHNP76}+Cd|gt9;bZq@>+0 z>Y7&c-Bc45A*_SmvBk*)y_8P5o`2FapeM1!2b!EAp~yFf^9BahxLZmEDVyMFDNjKk zRSP6l$>D<;_>!?MIH18nsGOz59K}!Oz@eq8AW==KcwtjsigoY?*QK*_m!6QX1!%e|_&xh<*Q6Sk;*eckgm&7yrTo^F#e*3+@BYg@6Z@`i1s zY^Lt!@dHOF8lZIC^N>N*x7NFxmQ5Ch2)A?8XX&8vyRf6gheBjaBqkD9pQ=B5UU=?e z<@t-zcRuE;5pe|EpFd*Rg(GJTyGXyis%^>WcNbM#<3_+sj08d9aZW4`Drs^G-;@OW z#mIe^CO%6UjU2aPC42g4_TfipVuV~XRISzlC1Q5o-c8S3nLB!T;>b|+H?L43kI)kY zHnn2f?FjbkSR#i=m6HBj{U*vLsRUgsrD~3ZER{OJ&f))$K3b^CQ^QQx*-Eqy{k%N6yVPCG3;J2!1 z+C`88iQHsIl$&D4J-X7TqVX9-D%O_8dJT~yMj}?#s;SLy>xiqHf)`!{@`&(Im<3=e zRTr#knqFYjLPo<;?llJFz^OywV+ZKn|DgBZr1!4VyVvQ1*XjM&={@<$FW0zZ@Wyre z_#JxZdZJf{xZV&4IN*!hP*dTWnW##LtRhtes^M8Cv49)+%e_*;UCHmlhT&udVX*sJ zDsUe_{)TnyFfgV8XL7URkXv4S7aF1I>w+fg>QimEN}MAB?4Xj&J0l@v>0H$}Y;k7X5P zS%^V-bH>kgN=Fb3{2q-^GR6xknW>}3vSw#W*HzfJhg8iK^^UNitE_JF4fa#9j>B%4 z6`iD_@3&6_f_wueZ(ldU*@vLE8|MZLGyR>E0(h;YG%Z!l9(wE~xyJ)`1ATLo-uaih zstKV<{-}a2RfbmyY@lj#^x;GF>8A|K+_Oldl*>^narcm!Tn-9Ni@KJIb~6AbbLj%5 z!t~Mgq;Ut*X->C;-u^&ALMHLr@PfHLG_-Hk(jC{g#tmJw`Zj1cZ&%It0UGp6Hg!V3 zCt_$1nf3_E&47kA?OvMp(DW@@@+EqAiXEHE`VRW=j|xgIEf|#)S))RN5=bb>5?M+{ zDYr(cn4DPSjODomk4FPZORJ=8N*dMl#&5%xj?%@)Y4Rp1n}XVIN`eJsLd!NCAWW2M zxKd+`v!rb5ETtc0N$iZA)pklfEUZZpmnO6?8l1 ze{uwlsi0IKXho9djLE13$ggGS>;GIgXoLTBIrhwH9G2pM0a2<}*uMF+@0Wu$O$$(( zG@C@j*0OH5^PvNjN!MyM95xuVbyJzWq>j|&8)xOOy&N!Gsg$SG%BpoQjoc;22<3C4 zC{jhFwYfFzp2*{mjoNyAXaA9$GgK|L^^lyUM2dx0%qq$W1T;f}Vcg?}^nt@hLcMC3i*rde>-gm{`sy<( z zi%%$@fnI`G6p^n>Nsxj&2W_+-mMtPtEEqJiIEay>TMjC@!FK*2Pz<(%xKi4A>QK_q zwrW;?J8)RS9_e)uxr9}@g!~X$;`9t5$xzUu;ZN|sA?LohLZbGI3h=Z%~j> zh;pSmZW+uDP%oA#7MSnt#DzBK2-LfOW(B2}mN56mzte};WQYf#UuP)imwOQ3KzR(l ze~qsFrtruwyhAp4H6t?QFf#M2EUpCCopBGJUVP><_>On@3D@Nd4c5~jKKJP;=npzb z>CDrYC|_W5xuKJcm2y)+dCpq;0F;+Ck}pTD6Syfn zE-zdY3~B?Ac^^Ii+?6AgV})HvcCk8q6$3nmJXr@+GSS0IIovttu!-dj&^e{nafeV8 z*dC@&KbSgb2wB=nJ-YO!&0=L2 zZOG-;cxwzH;lM+xMeh6p?*wwgO@K29S(r+G=cxiS+?v4R8bX9JbNA6t0t0*Vx-CWR z_DuVxx?yKk(<~WV>$+{=@%65jylQ93unXKjqivqI8pYqePRT46A`(gqw^NeM07r!{ zZA2jcW6#BwSeJ;t{p$E*Kb^mPVfOqP*Tu(OPoDBVc@ll@!lQE+9-BM=_}uw3zH?`n z;2CF6F23>{C(3M@l`h2S?W>DD+bYKPimEN%-A?BoqtVa(c5T|Yr>NbLHgrTlEpEI+ z*Z(=KZxz+eqH24jM>l`@c}hZpq?qw~@A>3Cv&lrDf*Y)$AX^@P^oScM`{;4{)o}gl z)AZtHx_U`^nLEF8zaqW#boJ_U^y^`|^s@z9+nxP(T3)77j@B0Etevn{Mb%P5$)nvF zw5V2|zDO&JV3*$JZX#WCwfnE?`YkDS^Qy_Z6RxWs{Mhwu9dXg z>bk8t-OiA)hyLw#DwGsco-rzfbH96GqIVBaA!P0f^l9dLRYAKkI?%IZ*DUpG{Z`$A zMT3z*pU%hRLxnYgKGott$HD;C>%cQs4)rYbDSehMpGE1n>6eGhi+zS=b63W+v#f2R z?k4KkLY>=~uusi$g1_;`pAMOv&ppHNHG6YqzcSwO*Q9Kr?(GRxo4bFIZr!DPRpFkw zO^LvgRU0*t5L}YA$ z3%jq(@xaZdKXcl5r;J<4utQL`CRDp=`1E{lcT(NVRfeuLZ0anYc{qA}D6QRI>D*LQ zxBIP@^xJO(aM}Mnt~-F|(0=W_xeMhwl>qfJKak@D0Rzb35EauTtk%D{f#NG}>|VBL ze0Gfo=Co^qy&WEVk8k)DilXSPi2!#IA&jpe2A^gq>YYDfiJ4nV`esSjR8=-hYDDhl zy7ECmy@?FlL4nGh%@tE;(9r3E?~aX9A=`)vg$w$DwhSnlxxju%f3oS=fD90Ms-~#` zX1YSf75el>P_K?zEffq;3eLJp(RsS~cYagH>JwKeoTgNY(|!>^BM7i4Byk;uaw|fi zv8CQNFyWYbXH360v#%{_+!@igMti$fOkMMKL;T`7@_Hzf0my>QY*bm^*(s1#)(=5C zImxI4SZ#25+-4#2`RSj3J!o8srPl*K3n@L749=meNW7+Gn@0%U8 z-|f|oKV<)}V}~iW3V1?m0D=H$j0YF`)De@4M#gA8P3tj=tx*Du5~s?cHUXj)>k?d~ z!C26k2DzM5lw1k*t3x38QME6(D|~~R{XtP!Coy*x-kGcDqj-ws10;$ z+}IDB!r__1-7OF3_Y zp*jMa1IFh|(Dn2EmM@PCQ8XwQpmKvSEPQk$^U0?GJPFYX zxnenW>yy%--V^`udwTaxy8f>d7VQYCQy^$1&zoTlZ(jk03s_Y_vyL2dYz4O5M#h&> zf>YN<_WE8^IGv+lYs>wr<=$=@cd&loUp1+MdKJNu4t@Rj@$mzCzpZ;gy>(r`JEv9$ z`VY~10glgXEVEX*d@`bIN?N*?^&N}*)U*5h{`bTYu31VY8DpRTSc3pBU$80>_~dZ% zF3cq4dzV#Y#TqZ@-)o9l_XH||P``%hF7O4sf!(4e!Z>v>i86u-x5Jb z#A2if;&+uYs}yn5@Xx)buEpV(DFG%cRI6|-DwbI}PU4LnAuAr8x9R-7Mw;=-{0a6$ zV9SBn(66E551V4fIYM#&vRxT6DQOJ&497z`B3E4U$5p9b2A1K-)%D^xACDoanAO0% zfMt)rw{zao0mqo=vrIqr5+y)wY85a!Ab`A?RI8xqCUmh#>&sxYi}3R4#{ELMd+N&_ z5B~YXhWv4dauM&42C0d@{F0(^j)OvyipUe7VreQTnZTj?$fxA;H}jV}%5}`<)7of0}vnk2xp%NQvLz{+vvN_RzVgQl?q z_-Pm$)K3rXo9j1wZDyy{l7H=0%EAxWavR2jK3p5$bH^Vx#q8t^7NLaUl)@!il-5=O zzg&oOEiOMZNVu2++;9y?Y0SzU%q9&h)% l+~jfW2%kh}quy^s{|BBBDhH}d;JE+*002ovPDHLkV1gNY9GL(B literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/overview.png b/windows/keep-secure/images/overview.png new file mode 100644 index 0000000000000000000000000000000000000000..f8fc37f154ba4bf69149025e1363f0b06e01a516 GIT binary patch literal 17148 zcmaL9by!qg+cyjdNC|?pBHbe(B?5|+bm!2>&?VgA-TS$;f>%iYNI2dSX z=Gjr(2}?1F}d{|NO#M@!G7L_?E^ zmy;6L^fcQ0tW?b0le|%v(e;79Wr4CbRm*2Y&&TxZN$Kzx@j9wFe1hOj3~tP-$9DOa zR%O!B@4<~<*@6vq=kdi_-tZHR7fRDp;YN^PfSE(&M>$_5%a=a4KMBOvpd-jy{Bh@1 zv@Gra6Z!SU?*)&8Kg3M&@$tm0%2`5Q$1CfIgDUYyuTG9fe~2|Om(_?TZLcY_#){nq zPRx;FZ?7#aeRC$uO`*EFx}xARkkx`4dN&ErPDZ;~c9=g4yqi1ixUlz?5v{(e>?;%I%ZJsUY&!1iB9u%EDKxr2 zi)5OEJS+v3u?;4ybIisp-Y+I{-}dr5J)sJkD6Ih@ic_Q$1ZwT}XYg4mpq(revr=cv z-xbEX78jc@2YdP$dk=2kUuB5-WJl@9CISzp-$Y(2_#{8H$IXL#lg&(mzy%R@V;>+7 zv>+KUNOBCae!bU*`P2@lNS~O!aasjwyT=MC9*-Yq!?6C(6Ls)TipmI@_sHbl1&L)HAFQ$7mUixh@%{i$HDbB)cr<#p4 z#Ycm~?%S2_gr+;cDgDr$Olg+PCc=B2GL0C>GW74_A9X?tF;QqX+2S&V=L=MWd zw6x63zb(^o`coHMUW-+x({3|4J~$W?E{)7nd^{;1N>*of%28h2(c)rJS{?EEL|Dbr zyJXS6!JDky!aF`muh4sBZkwcq$=)tj!cyQ-xO;n@Zza_q&|%&KVSt_#E}QY{XANxH)YCg`u|e zds7j!N9oKrXZ0z~H6JF*WKTQ9^PJCAC$_b!`)Ueeve1!DABzRXiHNFj!( zY5bVXa2`+J7SgWjh=^H;Vl2dpT?*R_4WruuhRJf5eh7!Y8sq$4w!MCA`mIz^Y2qjy zS)}yglFg%QgqIB9VUK}d*}dizuS~~OS|*2hwl>+++q!dGYv8jCYEHd3ulwsvDl~P~ zME+i~P2lIG$Ncrc!d@G|V)l|38eOLJUNV%$v6MNX%t@1NqQ9Ql8`ry9(dFg!ZkglV z^)yuug^-9Xo30Mjn(M+zdy}R`Gf~mG)BHAf*F=zb3#hYL5+Ulu_ zF^S)IAt6642+5kuy49&TDOUH_nOg5C)!u{+PNcj}$`R<-$`tV!T>KWe>*v@{v$0D|!EIFg zg@xLUt^DmH?~nxCG}DT4t4Bh%6%|hI*+_%YM7_uN213zn9UWr{`nydOPIyxYXfn1b zf5>Xh6yBUfz*ZUsw^encscTt$lq%|D>eTa;Otw@HGXL1nxElvGiJt7<_vUlm_oLt% zc{U|AZ?Gx75#Mz1#Vs){5`TC5J0XviOlVA7kL8XGzs;htpsSr^v}SmRLV369_{WtW zf_NYy{wQMM7~&Qp{uI)b!XE~z;PYMy{`5#*n)OlpAO^ma=1bm&_zo7RF2Tl_9qH~M z)qS!#Z`RW@LxT3sLy|J5CvCKora=?pc~@E0a%$Xk+l&LR9!T^=u9 z+UQ2->T(K@Q+VRJnA-62trjFZX3{dRcf{m)%%)9V4m>C#g3gw9lUdtPq}p<8ynOr)THSN72B`aSs)*NHePeu)fw;wV5gKMWow z2wE$#zFXDw>Q4Bvb_lN`Z(80{HJ%evxVYpy00RVAlatTfq*VPBzS}Nhk%_*_ZZti; z9CH$TcXY%xW)Kw3I>5}vY{$%I-disr^b+((fw+AZrl=2Q`q1pYva)**x4pTBs~!VL z2Uxbfr1c$ZKJs&ZL)FOwmJDrQuGFjxm8bjC`9do;&kE-7ibWai%zvaIt4!FueO2DR z)nElK!QJq3YJGHZXk5ryafz$>^39snJWvlB6YLZjd5j4C}s9DwYM>s9N zjA&o?fAn^*dhtoK`0Jy3*gB}aO6Zr4U`BOvP7>;4R`0xZ$}MC9F1>rpX=g6-Tz|x# zM8vA+Wx(3^UAC|aJ61k@ua&|16P~MN1$l3}IXjeeiUozhobAoLaI%<0uvEwC&eRZ7 z+YF{yrhPq$o#6RxU{Bi3(~3)Y#<5p*dntmRAFW6br$r5D5gp&qYXBSn$lS#(% zXnA$mj??*BeL^)-XzGWyFQ`nOrKi`Fq3!tFehV!5bR?coSI&FmFtJ>!RF^0132XRI zZJ4K^AH)TS`X}`_X!^g@ciL{2y7kzRu`@qIDnt)gA0%k^%F?d}oQKcB@(&JZ6JDN1 z-kV^T118S>C5&^`sCsj&?L`(ujDrGCiu)xw02?8UX!7AtPeZc8Axg~mAjgI{#;Yy_}vvvg)p%O5o z%sTr?=U}Tuyl&e+fVIHnZ@jMm5DjQ|0%1*71&}hs`_u~8ugTA*=c$F2J>V|v*4kBQ zFCuzQbNb-;-$_bbu>-D;dg{_gS;z+L{{XP&(piR)=9zvpHF9fFMB|6)~l!P843Ro!Xl}c;2dO+b#-`8vU`sOSe#H_+&TBFeQ|o- zPp8pBVL%MCdT-H|-n$EtZCcIPJdtVZ%2hf~=O}>}R}AA!g0iY|e?HahC{0MM z!J|_sqSJ;yFf-arh3Xw=-tBATV@-)*P(?T0G-9DVVS=)Ax#fktKmzreQbo6F*tC3v z!vLE~x1JL6b^7#$th%R2&@WRq2z3S)3p!!jcgu*svTg1Z;8Hv8(C9e!$N ztuqUmryPeaUds>-2=XlNt=OJkbcmhmJjjNVJvvy5dT>UUfJ(V`jRG{(c2mG>-@G#F zU6wbu=~_`Lf|DewO6d#>I9i`6SiiX z5{K1e?!94rg}3q=+Ioz(FCS2rzr{$X&KJlrPbwMuB3LihT#+^IttpWhESwL7bfL`4<|=0z_3pxy=Y*0 z4!yYWu^FgnYY!Ir?EGqRJl^_}l(kfgPvMbsZk~CWnqJufk+O%Iff|lw+l#Ud%++i zwLGJq^koKF(;mG*9OE(N6lVuM4?)?7Ak_EiDJb@~u({G$jh8-%j6TZG!hr)IS^@z&p&R=4{2uthyPWYyV;3XS+=<1s4XjDKS z+UO8Pb-t*m!o#S}PbVO=M<{}rL>2C#2oaAE?SJgC&pXlPb~Jgf<$!k$DSG|W{_dS8 zJ?dv4t20pgv^)v{u^2=Hp#J96azR5Nb8urqEU@9e8DRe)%hR(XGe!n6IlGJ6u8$jJ;%t!>Dt9q&9ALtg8@j6^I(s|D7-~W5zhB=RcnI3*wrQJfNLUS6Baiyw z2Y@}&=nTHiPK4Yi{XiLiw?t?KU==%^k`n=m4)&J|x3o&c?N&dhcGwAC7YtXt@r2f4 zt=W0;N@M1k>PXVWLhnn$xBPzMibiJHzXA$x(S8&dEwv|%dGky`<=~0G^U-<3?S9XJ z)8=`lpA>G{s>;ps60QGL`}sK$d%RY0$32z7TXm%?BfpIm0K3);s{KaQ*pt(dt8UN? zMPTs((a81dwW-(3Y?C9gwkKb~cdxurEr6I(^YPe4$n!`s5u)tTuoL)k$Q4qaMWOJc z3IA>hyfse!&Qkd%Q$^dIHfNrCY{Rzs7H*r7$j(6d z;5SGjg(&}Vcy?;`X0Ss!=v=9(C;QH1ImD-65hyinoRe~Wz8D9rBg*S)5?z&fU-k`i zxlglL(s;j+CJoktPc;Pi$881dO2wXt&|N~mrOHe$P0L}3U7WN(A6f>i2((Z4{D=Ra zzFnK92Mu-djykmWyz7c zYWUFzq9u{VKQZ3E+a*Qi#b~Dv5o{Lh7(^EGf#+vut~84M9y z%+-v+<^0bd5jl#OKszuoUc61;;6M&UOY&LB3yOEMibe)|6^NzA9ThwZtB7`iJ@7Ve zwv@9T%T2K)o9&Y}JD@?rr~90YDyx%u$6MIHq#9uq<)A;oyPwqC3o_T5Ugzy5pJp9Q z6R6omY@`OWc?fDU7B!{ zV|M6APCpg7Hsh_b?hQ>_zTNtK;=^BFx#tIM4r6ZH^X)_%!q{bo|6Xk6lr)|1kL+HU zOBH#X)-3#k{L6w8v68IeO!$vJEC>Tb@+uMVkOcj>GdMEUXJ#8Sf-4XhaoQOw-jLC^*l(L^mD|o7l{+w$MKq z%UQ4tuYY5>Z>-J6lZ2BQgHKM{c=)m5`J--3Fgxo}_CV^F@n6@4TF17J;cp5}*X%cX z!Ql%9;ey-PO%j2omEU09AW+?B9dtz10(>B(n7uN^lKy&9zvC$sE+3~D#+LNZH6Wl( zhi-Nce6oXn&K{Itl-0#e^-++RD3JZvCDaA$%VhAV!zSW8yjtLKjJ(|j<0f^1T;gbM zQdnGH_0PFEvl7bzj&Y+=QS`P&4Kzpk?>;)IN;HP-@73~{WuldYZS=IR)bamlib59% z6RI%i$D!vY z9iK7?w!yJd->x{zxQD2c9#Aj(2{+l{73$91#(2i|MWa=f@m;z|BZ(Xf(sYbNA%?4` zu2dZl;n4%4g5O(Q23Pw-9aLJA`X!Y)8p$q=O7p0=Vsprg<>bQ7D=+y&*)^z$B;MYS zS2})ITS#&Y5-$U3WjouyE4inXJIGcpZ|9h8gYqavL&NzCQ>^1{Lq?1;%>hr0ytkU2 z^ly|g6N@>VUcr+F_SrUgHDI_fi}Je(RqWF%Z}J%gNabyIyRS)N#gh?19g1^MZKg0* z^INnzcPZhtl5&Y-y~}+g$qEhZ#*YgCr2HsRN!T8)Q_}C|#;BNp7#rQ5qDpVOp zJ$xXbl*C)Scy43$Y4~b6%bZtx;VM{#HkBd5w91qgO&9OP!I=~;@xZv{=sBXQ#1b7* zU0Vu~AYIAM(39J~3P_HttA1rYef~|`$2U9RN+B_i@{XZTepJzrMfM?P`!UWC3Gj{k zfA|L54jp%YZsDH4{@vMoNf=~;J~;)4s340J?->!{2GN--y^6HBkYDh=2FmV{Iw0w{ z(*aM2-d^vD`RQOFh&*?m<6y7?DCFdJH8Ox#Er@P&D9jTYj8Sfb{uh`Cw!@bM+}+)| zTt{~_u>ZN$2}gRwnU)YRw|*iB)tYDci=6CYEKPBbLG|8}b~ZBt z;5HuS40nMfi&3SVKIVV$T5%b@u@?4E__R0G-$}I(z=UE~ea^V|MDgP`7?6CRWE9hn z;O~Zxujh<;qj%cIwsyd!{hztYZT=lX3*S_jO>@~=14ETPp>(=&b&W&n9$dhDf3ccr z^Ptkc0Wur_F^T>8S!)5it>-9Imnho5;c>T|i~@)ZO39-H-W7SMlW5~qv{h(cak}E zkh@yNEIxa?yQ+g+c3-OFQGk`s)=5CqveMF2ZUENOQs$v`2ol1_W6w3n!V+T`>R_2j z5>xL5V5H>_0ThlSUtRTr;-Zv}Pm)yt;3i;(UtsG0{~PM7U@pXM*Y~0MZf>5nr_+8Z z1dk4)MLg_X{tC#)>J*f{coXT*CiG&WEpQk|0L3wMcnN&Sj>&RNjRF+_mb8CV*-d0D zq*<3xBKsM&AoFV0n$J~0QW2^boneXPyC<{$sXUowdbS^q0_OTViIN9^$-zI702ngH zi#(L0lU?w8jLZJdCXFKH&#!#WfI3?{>HS`J&#r<^%UwsI^N@tnw%Bo5MvC#3RbPnM z1e;j*zSQhR5ZnmA7QJxa-EJikE$UI|{IEFZPKy~yV)khlA0@H=waH`efHP8B9C*48THmMCY#nY`&iRC)k}=hj$9@dp-qk*ey?tI0V^t zDZIEdxL{fBX6l~1Xz*&M{K;C7A!fzu#_Td5ku!7h21cD_t~9&_5z(OR<{uF4XKZV> z9?W^F_X;Wx{1S4KV`s|y4ATt2 zbH9WLi-*B2YTmU9)#=fWQ9P%o>0DI}2&ewSdp)VLzj`Uieq)%yELBs@FrPxzvq(15lVG_tKt zIt|g{yp0T{y9j9 zxJnKS>NfO+q^`OXMLc9sq|y5dN^mP3Fq5|^oDDcA(6=cUyxpe~lMbE<$6-rbe;p~3 z@}ARPR;*0P`8oI(|G&~+!cg^?d&D4$1ok}^HZ9p5B}nroO68STj`ASXLl{E97@AEq zdwY}y-nF?+?xda$_4FniwE2JjApIP_(USg4Ne}2;?70ZBz-{g}B#U|T?ISzeL~DA= zN54UI1s=W`FwCapZX%f4LO=XsYL7+v)Yv*DXHJV#4%Mu{Ra2bosAnFNpgqwwVYb#i zslbmUi z>(SUbLfW<%TfhGmezMLfjX@LA$VJP4_$>QLGfNtqdAX{duGc|f=sVY{Z>W3zhgjUt|fw+7aF!^J3*r!Uzb1eqIcJcZz z)cUNFv|o&5))OTN!T_b8?SjwV$t}q1>qb->`TsHR#l3&Og7#V2n2ydjE`@k6%I$e6 zb~EC@8+Q&W&h1a$j)x$OyX9ENmcJVtSFRF2a7FRovLL=Ol+Gv*y=#(>E>g+na^g}K z63_xu$qQRtEjN4bR5U#G*?q2W9q@KW*4Ple1;oX7DK*&Lz~8KPz#>oe9kbHE*=3jc z%3BV18!-VFYNRYoV~J(ezFH6(H>&3);vhN%r4!XVZwvxqesscl^Ob0%Q7k5>O$S-l zewpZ+{h+y%;j3dLW1r~l#R_O^lU3}`C;9bJ6cgVet*%=nHm+=2YnY+lfB-1z-p>U% zt4<$D*fDPVwOWG7T?OkcOK1gI!U7=hC*IlJaL-ltFf8y2;I8w7T^@2nc3CQq6}QSb zK_b!zp|)dPkrdpYBhF~} zYB~$6B#s=XTvOsLvme&eUbrk}d#SxpjJ-q8Hce4grIn?iKy0Je?{y88SEtAQ+;i(9 z9=Ztkz4VHKysF9%hL?SyID`9oGE^H9Vf0qE^eBboReiJ1MbNg_<3$&rAA%kXUlnJq z4W#iU$OkmQjDMAd4EK@phFQvqk9YTe$c(rT$EyT3k7YvH5w2L#K~CaKcM`P;3odC2 zC}o@^gXx+$W%5kOys?V@ojsab8UHb7ZSKN%IRBdiKoA%Ty`Stl&mcndo0;EA^-aC5 zn>dD+*T7iEqfM5)eQwONn0Yt+&g}XBl1$keQy%tBeZbEb3e-4Byq9=UvVF38ha~Y8 z?s@;rn%51I4K3b(_k=q?h>Wb7V@M*ii@@|z;HMy8@hlQvJ1r1&L_uemB~@hE=wyPd zT7f&wjTMJq%`Llw)!ul#<&*kb<3Pjj31d2+z2)w2ze1s?*X=YvKW}?veLK0gc3*T= zKiLx9-ISBAo_Fa_J@(ahgu8`@gDubf$uao*8pa1`9Ygzp*&;IjA8K<@L}KIY!X|>v z1s^o}>LV<3e>&rmo}Gf8bO>HPRr5YL1f>|=E$6N*mONeuV_JHqW!!R+>88Y3-{bqmP~4i)$XAI(!-b zM!mybLin&zGSM%&d_iXyd`&@B?~loR?;Uyj3_;u64vQ5w!o!ms(Vs1xA}!j#?CJx3 z`{0HAoW+}Y4GepiJ;}^3!k}Iai6)M5_9-%@A8w8Jb{A@gr81iP%pEZ4kKksWYpbzFmp3z;o=lf;315M>{%fRNa#|2%NmNgm=&Z+Hl z?9V3l`&8e}rL#>XFII2nJma;=)7Kd;u5?a&Z0)0{Ey1Grx!HvZ#Is>$@F_+l&9un! z^mU1)7Z8~&>|Wih1YD=&*OcP>K(TT?@+Al)erOKz|I#i#YY=Odt2;dcrNw3O0<1({ zS$($|$g5t*bHl2{MAojBR92Gp?IsM=b+_F$#HKL3uL?GjL8xql*ICY6R;SwGNOMebNXA)vhK_asgGhwqnpd?yT;rK*A0*^Qm&a(^-}R~;l%0dz8ZeTQe8{=# zPm9ZM?d+zzo*_JZ$hVXour9r!E;3@B(=RW-9Wo4@f}&&Q+?9*>_4t1>h-+3h+ZTkb z7GY4mVoeueJMfz{*7(t_|B0FIE96k|vxA}dy7q^Ox6yUEPJ!AYA?)Ia3^t{4&f?B9 z#|^vFU-&U86;qq1)iY`boM#|ZkB*+V0fQ9kL*8AbuLKbaVT&x2f|kR^ql=BYzvJEkqZ?C=J z#VIKgoKt$@qEF_BX4Lcv?(V|@`G^QRgqJGW1pO0)*W-EG##X!=MICZ1O3t|WO z>BXJ>EU~wc%emC3LGQ--MlP>gShWqbH5(cqSE?EVgjE}U2d&(_#h9!``UF}KyTPb) z`3R3f+?l5C-fXD1vEM)fjdUO+Gz-fG^6ib$BvGF#!@Oxyv7L4cf%icSSRG(QG;&oF z`>0m)ZGEu~^FTCso7y1>T3PcLEY`@o1{RI=q|^C=IE>Yk_V>Df%&Wb|_toP;n&Lz~ zjW{7ysB6B&>Il8IQce&dXDG=4k%w?NoIulO=m?~Gmr2*cZ&QBHt;j!~o`$7ND_Q+- z^vL~I9DlEKL`oFXjD0@Al2d_H0lT4tr6JsAifjBz@26!+FhH=hT51fflw^|P@FL$G;=CB;OTXTg zFe)qwwZ-kC2>?lMiJYr z@dl48>e?hvSy&a7BSSG1qBj?x#WCO48?})r!C82$o3rK#XfmmZwY4TKL#b% z94{#0cUAYJEE*WJL-*bjioNNFG1NizCWXL6x~C*XBO4xG@uUVc^ri70Y5us+eLOdb zvCtQ)iSV>+s8*l^wJGOXDKz1%(#2#hZTP!z1tFRo$V2L1x-hLx;^~V$9u-8jV=z__ z8pz9KCVW|V(GGt<&EvZJSn}i|I!F1eBDin#`&JXGA`cCgD#G~|7*CK8K~OfkU98$+ zo0u8X7oW+AVMtTVW6qw{g=LoJO%5$t(Cu=fGtICZQF}iWG*Aj%M%Ys55F=Y^@c1C8L2fj!L(G|HTyu zOmeQr=}f_%5M6nn)e0l@?VC=(i-RQBvO=|7(P56f!rx4;27(t-Ho?e7rVl*nl&gqL z;Q^{W+1%1UB#`p)Bbz~WQGCM-l6ZA0O*SMW+UTq|^E1B81kQ;UNADj%__^vwgGvkX z5oJzIXf)!-C6$^z8>OmE79fR}q>BoDOp?K}9UNZUktm!{Vp|?9AL4UA=~wZvx%-ht z9sXa<0#qiC^VJwe^WL*p|12?nwcZKp+kDfv&I5vGjTDk>`Z*0TPzi}bz9}H9lbUR? zy>p{f;E~MCTupkz9BD~M@5m44MVMEzq!q}TZ|lbQx!m8*ijZw88xDW&u5^~qf5>YS zPJm9Tprlu#EUbyOm#l0E@Ku~@6a>((d(+*g$CI6_<=aRM!$d{=u7}@X z6h^&zX%Cw^I@;*no>sI@!$<R0#?cUY5V|qMbnV@zlcsV*4-*h~hu5UBovadE)7hx7^|z;+;Jd+Eoxg8O-4pj*rNNJ)*!&Et=8%)mps z&xm0sCP8s)9ijMrKDjH*eL~i_Ei!+3v13C028#<_1NIQ)GhH?6dZJvp>Au_iGvhij zy#i4oE*KV-=m7KM7)4|L%eaZgCt#(-dGn*xJjRv$3#=Mlk_KcBrca2=jKF zt6NxFhJUr!=lDlPWx&{{ijQDP5WDO`gxz=8r~guSeLA{h{GP?adS_3O97e$S&mzGy zXK|==kzSi%5vs)Idnsy?$4>O$f5>P6aV6x{zke5DZyCsZ3gRjyE zVe@$QrQapL&y2h@0>V=})=+{2SQAdr1Z!04XJn(83;<_b!va9VP&w13JK*%#YY4^1>kxp3*7i6t>ajKNuFmY z$#HFYcmIE+hthp~TtNhb1)FfLYRyN%_;YTW9IUPNr`ASZ?7#s1fJ3XGA*f9BiXciRxC?guP)zwp0& z&00^}`rZ>bb|VW!lyW!?RdV$wJk31kdXY~S)?Zhz*yjKD1Z)s`9M8iop8zLChV`W< z>*Bo(!#GOj;so;}C2os}IN#KuQy9-TiNl$kMBBnC8_ zVl(hAEv|u`E#$6FoTn8NeY3)vyy zdPz_`g}}V=i3w2f_wZ=A@^;d)_m0bN$CN~^&)cPm$PJ0t`w?^Tt4apbk*90^J-)-@#epLp&MMI{w!F1Z_$J33cYPO@W==lUGPD1bu9o|`!Ftgi z8^TL1nb_UYez8Iy(%{5|3K?$K7B>0M6pt_rs;Pj7I+*=O1n^a16J5QpUra%PuM-4Um?yLEL9eL zH(ll|y1b=enqEr}@U&DG35RNjI#sSe@dv4HNpklQ780uZW&+k7<)|6)hnbLF4QGGy z-7C*cVBZ@EMfJ|toDK8*{!AWRx3V~a%wC_Palum5jrr_B$vG5hH|3VwIN-0tl9;@F zMXI@*=#{O%pLGSpF!-` z0fHp1d+3`9wA?RGcTVF%CFBP`ixds5c>D6vL5{9C=WCE*p`f76)iyEHK>Rcu?Vwhq zXZ=gBkCGq0P+FBG{3Uun6m*EV5o`9lJ0@$XW(!10Ht3VW9_FyYfgKCkF21Kf*dQZ1 zP8&fyT$B>&jnC{LNQRG^47#{szxdcj-C5wlbV9v=pMK!`A{N#NfFgwe`UY;CrMocQ z3pPml-#CQYr~ux3uwEJa?HKU#hC4y^;E#^j52hJpNYiYp%-ckU(Mez;xo>KYz1M~l z0!;pli4ev|+DX4QQ(6dln_eXmR(EE|bQ0ms}*VV4Sv=YV25<<6%F&IOD`E-t2DS)mj8<(4x`D)qhfC2^)1pp=h za|VM|h_0LHL||8=wCE1%NaxdSEvoyLA31d@HJ|UJQ)!#aX;zmqKBDh0E;mI6Il@jc z7n$%4MBnGO18?fQ>pk}Kl)R=3oyA*a&&?EdE0(*dmB3vyqa_Pv*?N_neZ9&GZE@LH z?uxYY`?Ho}?nYEG%`zFPG`*a6W@+m&z!E`(uFC&y)ET zcB0Atp4S9Y5?O?ZXz~D9{?G4^D9v<8iZV77M^8jWCd+n3Al%V;}%>U=^{bu)i6h zz%}0WN5!G?dkH%vpHRT96|#8T`!gkx1cs)+Lz-SDX~ni?>oF|NHmE*r2ynEMM=m-Euy=Ub-(0+(>;&DcN38sh_CCK$ z%U6`kt`|bQ zPTAA8;EcM&i2qm?fPY7EAAp~*lb3iE)_aA(XYC2apH&vX7PFK($JHe$2G|6d*SV;4*qzm0!w zh@jcjqSOZqqI6(E>i^UpDCuT4H$F6}M)yJNHk@=tA!%2}(qkbYLZ?sb(*tu8!@CtS ze2g`oNZzTiiPyc&c0JL3llYVmVM};3%%{PYG5!Mv;m0S?)Is&;3(j2M-Fxq|Uw>#S z3hX)pNF(^t2|@s&XvW0QA2)tk7}5cguS1_~qyv;9t%7HXIDd!W%D7Ad6&)n)M#lQh zNkV7te~5K`elF(9f)7r0rqaDPrsefRe@z2L9TNmN(r>t@fGV12F;YHBLhIfEg~@Oj zBF1fIke?o3HG9Wm@ch{IHm0IpxY@kIhcbf5wXULqIVl!FLDIcO`{Bt=abP46B6C>x zPh{s!Yjof-tUb~1Qw6w!0MAm3%C3-gQF&uD=1mi5ClBSZLj|9w9^m5u;oa(tUJ0l$ zFaA0`Xqn+Y{KAl&w2WLfIuIzU^U>+?lcuX3>$v9HPfaWyg@A$(q@nQg><&cd4#8%D z?=B+F#j**UT8^tB7j#8n6u#t(`hsfD_xZt zBId0y^PIn=)E|a_{U(Z}sI4Q;d=2yz_A%xgGhi^)ani1H)hYTZdrKcU8WuCUUQzhJ z_wY!0)KsT?!xWOxv1n8e7!5klHdakocYBY6J5N$mV5B1~rU4g~$R4`fqgb>-D0j&I zT>_|zfewO6-!2PKj8Vfp<7#A&QR@JI7em@t1$UVz*93{pSbGVca2qof1V&Qm^~{9; zlB;1_O#S@f>rd}_7T?_ruawZS?GGohcSptnzlYq{=_XbTwyiWmKp5d`vz#hhb+e1N z7ln&fpW;H3!a!*Y^6KFad~)5I{>k++5U551?@pgXt!ERE|50Y#e;6Hb=SZusFLS}N zox59;ylkj4cQ-Ht|!g$bneqKPUGz`kD83fOj@i5k}9ZuD(8D;n?gMiv0RpjaCF6 z){5NRkliuEW#3XMz(&QYO*y%0hOaShq8K!I;D}1pJ;Re+CS78qAKr#hT}5bP+Rqd} z#J<{xrFOZ_MNqOsj>cFo%74d6Q(X&C`8F%l@2c;4b3@`!LCcdZU>->OSdF88H3Lgy z|CdMftR{DuAAN+iPuGY}Hf9q0&rjQul?%pzT0F&4D0iFBzSzgIMZmF zn>Cd)#m&b#{a_qgJ1GvMPs?^g<2BSz`6T@co=u14K?9G+t8e0FywOi#>u!S1vPQ7jW-s*{nU!S%}2_n*$iz)K*9gi|mmBirHe-}dO+Aq!#^b*|*h}iE2 zK4X;Bo9}7TaWk9MQqqSeSur#Y*5y4en)}0WG0h0sYL}&t%)p3qVw9c#QXgcH>~lEq z>W^2)WJ*sEy#nr-D5Zp9F=@VJHq?qlQ)W}Qx^vMwoVTMV$(aYfhYR6H|dP zR+-Xso=_`@*WBMK%#cScN7PN-DwTvxJ)D5Ke$UhR_=7r3AEtMPyZj!>rjoIp^V&T+ zGD_HnA1xYd9G{9~T#H^siJl6a61HL`!wc$7JQ}IVhgtHoIsS~+Ae-)2C|1Na{R&~Z zar%RD{eSQorf>C|Fs)?Iw-M5Tr9AHWK;Hiss71zu8L4gg>2(B>1sZb&n z930Qx6K2}2JY^=21cA(L7!?eJUx!EkNyyfT66EuWt)q9bA+C8@^Y#d=d2aKP3BpNM z$cRRDaPYl0db`IlaihZ@DjHT|#YPKDW#rDEng^ARFnS3n-*g*(ZJ%-YRIIm`W4~)X zb?@-;3MYCEaTfiwH~xQ;=3M?a|~0%X5>Ze%~V<}mJ*^#X2)wLb2FtCwFZ)A$h>%y64gY? zOIehxHR|!1gT%d*czHz?$LrGfik+dO1XP0Yra1f(G_xhtgQyhvpX~fxNL{m34!g3Z zrG7!?5pl{DAo{j0fh>D?GN&&tjadi3~JtP9*yF_1+R{b`UR$w!cxu)6!Qkb z6M^^Y)^FUa>**tpmpBp-HF~r@VPy?hqVW#W4Yi*-5UMg79H-cpEn2FTl8Z`n(-S#i zIYz#z{=+j;P5JNAX2bHe!um>zt>r9~gKSE-WV4s@95N5mLab@1A>8^eJ5VWw8t~|^ zOunkeA-qv`fqz}azFtf46zu2wr;)p>(Y<~KRK*cX(Z*5{XW)HpKz*P85s z#s4W4P+12B&V%C2?ZI<#=6oNg9A%ihm3jYx_6xwz|Dt(d3~EUrQAq#o8%D|htzG|e z@Hf@`EtP=O@CxWdX9k>VSVupKVs{p4bh_vTy7I%*Jt9Thj2Zc;;#GKo5Y<}3R^Gl4 zJ`6(rUxMc8j*r6=wmbU4#@6p&nE;X@qVb!$3+H~KcRttthm+Q3iRiVT2|#pqN1N{& z^b|ppZ}Eg)LF~F#9(BS(vgCs4hKmZ5l&&JL2iq&d}EsT)5Y#C6LyE=Px?c zYs4N>Uv?BzA1J@xF82*iTx?);;-KLsb>Hk5D#-_4b*6h{{hP$>j3e&<~Qpm*?OYr~z))QTX}davhDFt2Kr82xNQr>5`i9=H89qok&kM;cnZpuqFL zFIC6fFb&U>4=%DNe+|_T5&$MZH4Fc*n;g|=*QZr?v=Qx?4t6iy*MR?6fhH%dELACC H67>H7=n0Df literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/portal.png b/windows/keep-secure/images/portal.png new file mode 100644 index 0000000000000000000000000000000000000000..965f8cff0d3787fb1af4987da351429d6e7150d0 GIT binary patch literal 563593 zcmV*7Kytr{P)Px#1ZP1_K>z@;j|==^1poj532;bRa{vG#)c^n?)d2*Yw4DF||D{PpK~#8N?0p4b zmDlwNqDCtbI;xYbshwd=O7v`7e0r!8Kjh2rj#5Gd}N1Ojn) zmz!L-PtX5(&-w1nO|Sp~LVF($C+9mZ?|II9&L`KzLTLX`8PmCg+bYwMoVX}|pCuNl)= zVuBISrU;3`H36-*zK)g$zBXvb6GFPe*Ay7|>iW9k2k$F=;J(7|->028McmNV2#LbA z0Zo+wlgZ@s`3$eNMo1K{B|sF!8gV&rK2gxMD#q#=t7EKzJ6zpf^AyE;$!748&%y1y*Q|<3LAnIaGaMFlv_p~2p^Sc8kJ)jkr@`9WqPoG7=$x~ z^WmX~9x_~)jxf_rrbts*IKO}$e(?FH;dv%$@=BZVX2 z2|LhZ!VwV>Auc=Pf0*zj|AWsz!@Z4YA}#C|m%Z( zdaK9dL3xuVO@dujRrSatk03IFDl02dGndN+$8Uf8Tljoc0Z~9p#W4Kzr$3!GZJNzy zTfcrie7^CGZ#bP!_{YS=^y$+FT>C2&9S#1jZ5Q81a3 zlap_{=@vMM6*%hZ>YjY^$(}uXMny%%#l_uz`|Y?qb?VeV|M}0q|NZY`bdDW6hTIVJ z;fEh$jNpdnd+)useED)DfhbI!I`#ab04BI~O)Cyuom_E$^h+p z_~D0*i%UnC={A#LzzN?pnGSJX;S&2Uxbs`HK(NT}Pnf#*4>AM8xC8b@nr@VXFo~%} z4u{QgQLsB5PKV8HCmWYeIKHB$dFx!_5>hHp1#}d0;PAS9>l~U)R#-D`Tq4vjz_|I_Q#deo=_%_IU6>wt?x<$JD*Asas#T zFNhVaP7fC*~;&|M-XP}kUnn>ebb2XHN%~Eek*lwf8*kk(M%K+u}|P9o7g*u zXJ-z)@Iu0~FSofl^4!ZupM5EDP(M_{;`CZvSOQ&G{M>d69H+~N&ok%U3P!^Wu$_)QNI9a z9t0@>LOH;ynfmm=>_Po92Y)Tiz$f#2J<0o{4bYqwG*(_-nUa#0dMYh7H61D>#%uTA zUob-377#eUD2Rctz31NI`|dBjuZN{`XYLuoc|p3i;k;zD)D`rgC#4_Hm2}LEHTIp&0d#7wj81_kgMAfXzoM zOkJPEgpRm-$X|y}hctvkN}~F9=-$`Vqs5S)#dI4oCqA`9)DxzzgVF{+ec+kF2`iT; zu2=#4;PT}OE8$py%XV%=J(E_iIypGPseu3pSGq#b~^!5pZ)>YriP5K>nx7mn7k!fC^47+N)g9safB zoCb`-V^ZYI!OuVx(1|{Cd85UK9fVI~dk-G>=uFa7RYAY1R-dz72#KyricixNzSC9> zPaz7}gy-cJ7iVT==Q<@RGqYG{UZ$8e*{*AfqWNT%PGqn&E1K+-++LZJ^Ob-m$u9IN zYHoK)5>r%Nk`y{QL_>5YBSssE!ljs~CQ(2!@oQK6uw&8OYnQKNIz8y!;ITB;RyI`T zWfzo4zN;<^n$PRD+bo*TwQJX|V@anBZ!QYx>%YA4{P5u;HJv%!mWh)mefY@?=BukK zNL85+!~XG<&nxTePi5rAZ$033dzLL*am8f8qcM-l> z&3*bsMm-sc4F#m6#dx2?_(fsw%P$&5U2A}H0|-{QX2H@{t`N;>B`XZNrQ5G=>H0HM zx8CDE-*hn3^>Xx_Qx*CRUHtHe$j@e)FA(Pgmuo|o z>2O;30!^;-p?ORwA;LlTVhI;JQG;25!=I7(3%m7IY+LBEeft)1P(*DlTIKIIjd?e5 z2jRk4A)*^UMd(4#qCwq*-bbd}U~%am-GTfvXt2+1E zMTGMLokIPhqgzNTQ8abjyD{&-|Ka=ZzyIEQ?@gRMAy~p%4~PO1N|Ll}*)s0IYbw5i z03$>}XV4pY=#_)UY8P>4nM z{^3z#YaoWX72MDYQBa}rLdzvasP{DfT5i03;?1VdI^MkMrN3#4>hw7f(3@!VhykYW&?!@gr~zSJ`k1=)4X1;q0d$;9C(6B>4f)wjD?|a+)>*F4 zVN&cS#TL$Nrb#!MVoYIk!*5tEgkHAIde2I{BANC1Gbx;M#iHQY}kLu*7yL5ShYGe07 zI}*$PIPkv^h{Ktd6WNY$_55@6ge4Q^u8-YQGJD0opFH}Hb$g4y^Kjq)8}#q}r>dIh z;T-04QP7#HLl2;Cr8;Y}WPe??MkrR3Y>9L>c47J+=CT#7T(PM0Z9*CrN8HS$I)CS% z2|Uba`HyNPNpjbjY?j9uE5HaMVfm*Id#8|as8*9|{}@ce(=-Q-BN6MF!U&``g1!_j zHa6Dq!tPyHWmQ62?BV$pJ$VIUIC=7<5$Ey)RIu0-CK`YR!ZRs?FOI~q-iAl0XZRB* z7bXfFd-i|&wJCfEF@F7MY3Rb2gS!Wr?&@Xg+K28i-8}?4BeaT}?rojscqUdTs;Z@1 zBzF6Xl}i}gi4kIUlcVuY1ksq%y>kK$jI7Kxb(SWW9GKS9S&wW;In;JjJ{FU+@h)96 zrh)Q%8>-GkNkvkH45#?3DXyuJp2;R@LT3{7=0nA=6bKLa zK(av&zKImVp9f*ippVE$VVc+eZA8Nwgjv%(8@g5$>F9eO_){9<7=RE3S(aNaR=h?= zqN@Xq<>bi{l~0sbcf@Mtn;oiCs>kgF2jl8OMd7r8ymWIGQJ{+Bzjs2$Nt0&pK=ar? zU_MQHZt}6fnocn#n>;C8p4f@$Zs8dWilFSpjF%h3RNa^y@cnRIv733Ho0t^P;$#p@ zqseDMZ={?)*pRvX@6c>UhTwbQ83059LI6=nNin{b#i3(8fntv8(<^_sE*MSjHPtl6dtxtH5r?9IGk9r0wWQVB1rk+n3=ZwZy zf@_X}@jiz+yV{7lDwZ3eCDOYd@%0Rsbr7GbEWr_y1F2&19c#EjqDpAf#S)j zYre)G)9oEDq!-ExH0qtZKMI}T`aA!0(>?vZabN$mQunT7g&ptyPpJm##T0L@W_9B8%(CX4Nvfkpco6;1XSZ3EC8-8$t4-y~Dn zl&Ik0Gk`H{ybc5GY3SomLfQXoZZY&YtdkfsKI*jBa@9SEn2IIbh~@{n4@#r+&;uQ;&Cj=kZ!S+f??g)Ws%eemzk{YA95zWOE2Q^{jpfGF@s zSMGkQbJss^PN;-75Z>hp)7`zpyYz~@n@m{OUgYzg$0F`}oSsnX(x+p$Cmww4^=6}f zMss#nAcD1Y#^S9@3j@6f2Q3Zw6YQl+p2;`(CU-9S>=ByhL7-TqDBPq&6dHfdeKZ;+ z3KX-Gk1S;Zqj~Flkn(7`jz?$)@T%+3$6WmehWteV(CP={QoDA4VwsD89SoKGdZfZGsf7X`r6 za3_dCvSPlVuf32G+IDow(4KVc9YWB5rd6X`ME{) z<)y{>1r1hLS*@j{sMu_Cso3C7nn-_}S;v5|1~1 zIZ=qhXS1g+TsR*N`Yw*5e);9*aUV`Xl_yS|7!woo#{d2c9&*^NJ9g~giLM0DIrB_@ zlEd;kIZT5ZO>Nb^mLD_4$0ecFqJWfGAj0qNOS{Kb7>aiHz!sioG^Vb7Bf9oYd1}ax zm!C5VYXa(cRO81=s^XzbIxLjv8&Hr3dW?a_om7UJZOUYm?~^dDU7iV=5411a&?7~( z*H=8#J{gb6iQ%tlu*#}eQ=yDP+ENvJgwl93W2b-r3^Js7?2Eam2^loFML>uG;9m&* za(dOFv3aHr|NZv}aiLDWL3T^Ljy`AI4^^pFRJYZvps@~7f2QXU#Ytitny!PeK}{;C z+x^mWK^+@_%v_zp?O42N{3%9L7voBXe9K;GQlw*Qr|OTt>u2wl00*j#-+<<**dujj z#bt0=#&@$7r`8w_@^D$Bgg+etD3VwRh(#eo?y1d_HX$Gi?GC(c+=c~*f3~1m@btIl z0v3qy9#1wS_BJ$K2c+kbC>SNRgk81KQ8BaK#F!K9py`QW0iUZfD~|4@?N=0n5!@}!yXXQ$A+kqXe_tVBy7f!TH=j)uc!f)uEs`~o zKwz=(HAasdSLR%{u(Q^LIy!hI7=G+>&H$l&Lkj7*+17z+4;ZbUV9RICx88O_=e zJ5{CO4!N;2gaZ;FHHIk`lO{WPk%9?=fVD{jPsp<7!D@2)cHr6&g|p)t5CskljLXq@ zrw>DA3xhzoCYhwkChtU(Z(?Nftlxm)Tgdo1;I4c_wRI-_1A7xJJyw%s4P(|wcjF`@ z#+kvnq2*j^g2UmU{o=KX3wU&eb?AB77KrnU0tSFq29@k|uWNY0=fA9uAIjuv&eN@z z12LSiVJwUt@YT#^EKz4}zJ`dPiv+z`!e80D7Gbs8FF+Ko`(7)~i!RP|>2qFDI5W5e zw3-gifs2=b0I)z{Z$eq2Le1*b2AN+0w040&)7t)9OhM)%MWH=`L;<6Y{e^#vL9~1A z;6ikTDw^7B5|LBD-+w>ec^!ZTNvB3CYQ)d>-!=ukHn-ow0(>Tu$Z7FE=yQvT4f>CVM16 zW%h<@rns>ioVzUEBk7wquBkUS8a2C8P!*PxWzMu{Y59`VCcVAj(3%W)UVW2DLKGk< zCD|u6m4w+NIqXiG!|6q}T`rdqsU4%8u>vPmKJ}Td64m;!mDlNk6nX%Nf2N$*#lP3T zlE9b;h8_HH+TBH=E1>@L5EPH;kAB6gdQoVHx&n>2s_K&LrWd(1&60ea`?q&+Q3wdj zwTE`6D*!HgZNiD;PIKwXjXR(i_>Lu6AQg0b&s$MaSX^b6Wm!BYs6dHO6o3`!RyJ7vR;)+65m6MZ`8_ad7nK{+vWhoiyjkYs9 z&eV3$YHLe1r+w;_1*sXiV*Ep_&^9K(3LdZImOZK>$ug7$+BLWi9W-h{2&}tTeF1J+ zfmVtF#i0L4E>6tE*0U{|b9&*(_53w5(C%~vC|#g_i`~PRSJD}npXDTq=AfeiXb)%W zaS{fKI&+CM)AZcv>{v=E;iLuJsI(p_< z^FfoKx5lw@U?Zo}GtHjHN~X)T#f4|+vQ`7i$;NHFF_d(3O4Gbvw-3eh+*&6J^yJOI z{_!j%;L#@@LoR05N()=}>9&`Q@JoYaEBlb+;}6~)_woC^2E6e2lYjQLttg<0SB4c1 zCnhHyI5_9CsZa*1&2(tPvJ&Zm6wrezVLs6~W9h(rl5|Uh75XE#8)R$r&WQ|vdaVwB zAO{#ZAC?%}-eDICAyU1_M=FCJGfH=M@EnsWL0C^(f4ndTeh>R@zI? z45Ur5W`lBUM7ktsy0c8Us2-}f?~s>J!*kUs2cy^E4P&*BL?7@OkEeN5`2|Qr>k4iK6q!VUx`Oi4S^q)LL-bpj zcY9+6>gD?S+Pb=$va%e9SEg>tOfo8Q8iKn%aOf29JjcKU2f;1U268wD_zfomE#kLI z6m<2?*PfT5A#i}Nyk5!K?6KTSfX<%#$NzXAiYw-_lzSC=hNCrTU#wtsG(T9x_Q9+0 zXRk67R;^g+tgnJkWlgcqZK*FWUAbyq>Zvp+mBq!`tJcO!F3Z%Jv*S0fi;a!l6u)im z-1#e3u3NTr)sk6r6O&IaTfTDXoEeAqC%T+gtTMILX2t8$bqLPBsJ_0wh@-Hu(C%o_OVQcf~i+I=`x!GfQC3d~0fv*N{?3I_xR zLIV|nj+xL@{!9@R2HJd*+KB}EEEYO!hhrO zzw<$nJv=KOU2l4fy>$!3Wd}_n)QhOj@M$I5o34N{B(2cvqqj_{RE&_@O&x4>a=#(}F&cp8y-Yg--gH3@a0ep55pZ7t1j;(EC>YCMOI*BY1{cTO z)EjhYg?*DQ@z-T90PT$xsAp&)Aa>K}83kG(5?3r)?5Hn+#!y{WG-dWI&1shv_otuE zUbk}Tr%P5i>uT4oT3l6Ay>#KcLr0IVUAJQKl4VG;a3Oy+tZkvo!$*yge6GU$g5${v zrA4{x*2asF^NIpi7RBpXw0QZ!ZJRf3j)x|6B4N+kb+M;X(iSZ=hN1PKl5|y(eVNA( zV$NVYl2=p;SzEgkyB92JZ{QNeb9nuE zhU7R`y0d|13r{F&LK&iScuxGbK6l$1%sS%_f+JK{B>9ZYL}-7kz`@%?q{p>F|7-9B z8U_(+49S(oSqp6+YU4Tk;Aqp3d_QDDfg`F=vQ+Lgx zwwAsaR8dh;c6m_FVO(4mRJ8Wt_bbB+^0f@Gf+R`C#kB@S(JtUUh%2TmKntRM7gjx@ zTfX>-L;3*watAC@fsDoRoNHv;ftSpcwLoP!ur%0gHd-LaUubg_M?~ZbBh}DI6clQ_ z*F`?!%!&tHPR;jhXlFYJRY^%nIhB?VMHeM%DwA}%vZ|)2pcuVO2ZGo+(|7#nN>yd- zH|gL{g;ZY&QQ)Q0WB61zI>j_@UWg!w0#tMaxf{!|??wG2x*LiZRCOfe2bBEVeSD-9 z`YwQs`lA6z&a=VpnFIvW6cQpH_q|L|sAklYR4a~lw1XhEQSp8J@%YzYdj)-#ot^D+ zH(G1U*T%&yUbC?{E7j>`rL|^yfmLzNoH=uS?DoczbXQqH!l8X0|C7*{6&RuH?A#-V zPwd#Ux3Z+Lw6vTEfWr_4jlDhg{R0OMpf*W|_N3>eCMO*9X>8w?ow)^-`wtwA-@MUh zX`k~_rdf;a*pfBGL>|0~%R>N>;Ou67W+UVPRl=^BJ!1wpxI0pd`!05IsMfmR9* z5wltR%ZzrWD+HF_)_|(-w@=3z{m&Np95_dk;2^jSwedm_h<|#*b7yry1+_AA`_UEn zS66iP%h=de>o!6r0Meegf+KD|2^$R)4k0&i!-sE&NDo2|q+W_>vbZtbl#seaSNXGJ z^ke)`+=z}TKK>#tX?En|U))4)NJtUHJ5Q9WMqlFOMbl$)L2qjz0z`o(I%9bS*#)&0 zDvm?cP}sr|aHHDD1P)<~oCSj8<1!E$@PQ2DWzRq~P|c%!|?XcQ1U_rnnF#dUYyOy%<#f z_@fW0KiH6m2r^P@%7}G&Xf1R-G02dUrSbbHbCrhQ1BI5Ok$#Gcm&gGJEfD+)HD$Ua zhDMYtz-!TLjD7v(6dPyMXKhr)8pPg zbT#HL_DQuK>O{H?qbjRTS|Dd{ug!qZh_wY6+EMXk$aBPoDhz+jM*803@HP2JHFVZ4 zxOXQPf>-8kJ`O=>aDyB)F9ZYjIDVok7QqvR<-$kPp@DxP=BC`ia7yNKcNoBpSQ;+`F zbsuCDaCRU2Tc+1^h{8i-N~&tTtrvylC5yQvwc>|}FRLhI6q4GAdPq(u z9TIS=6@7$Rg$V(OieeI=gAl;qs@Fb^PeH$@RZAGB{pqC`Ih#xyIK**7CUjOV!H-SZ zl#1CHo8`f(@b0=Cz%=6nwJxV2%Z>Fh4#K^{I0+ zS*0b|tut^#y^nclL21ScqQXq`+PqpqQsSvor!q4$VP|J&CncRoN<5Z&DkUo`3!Yh7 zIfaGAiN}-D(=#(O($dq@5vQ=Q@W6os2+hgK$;->j&&{i>s_7IpC^D)qQsw98!yj>~ zD{CGek^I1zf`Q``Fw!u^C6x$54nRgmR&sJOMB#y$qNJ3fCQ+c{&LH7E4aXNP6ppLR z3IS0-ryCu5CLjo7jHwUz8;cVVds=)ZVy9Ng7{$X`6&N{402m(AQ?NoA76_G1+ISNE zur`%mtcY2WhU6p)y3Sca9~D;%AHfP(I3Nnc=InucU#1z|Cs?7@Mf8I_>17?pEGqNx zZV8}C6qxMt(Q$$h6nF}U3n~aCnb zdi15xKoEgyC0L=lLGIYo5CxP4y8@Lyi$Jti6o4xr3XlV@SF(AizGCj9Wwc~!^f;4G zSCeb$fz{!0RfzDvg(qN7-<$;o0V}}&XigQBK?ew&lxX_OE3tx?L}7AV3UU(*L_ic^ zkBTct5m+ElT=d2YWCBr;H2uxlyAX4CS}i($!R92St#Ohlcr-&4gs!l+kZ(uOyE?Pk zjUUIw_{r#atP(PmABC&%w7`$~Y^_)IK!Z_zSj}Wb_FxC$L?D-b3_CzB?&ew%Sz_M9 zGr)_`jYt&61EK(+dO!TnCUgxI$$dyV2qYZsixp51 z-BD2ahq6`XqT1^*8}r~fd=tH49lfy{K5xZVVHp0m;5gbnH7*_Q)G8mw=};z}1Pf6> z4+lg6wVxc9hF!(FGzS)lF{?6=aOB2P*cg5k8Xa2`5QXUVMG%Fdvv$J0C%q0D=%O!A zD3T0OKs6u-Zn`rVe0zNz zz0SqF?z#rMxxTixrpnH@Bq9%>xf>cK!$^0G8en({=B%VI9-z>ZP<;3w=n6s<(5PTtA;1cy zZmuhAND-`n%&~(&R-`a8P)-H>0bKzl z?kF%m=z)P~w0XtCq)DE+>$e|CK9yMLEvWFNmDG3aKKQzC-gY$U_=)33GcwXhL(C~E zZ)6E+MGICPT(J7^+$CFbb90M}i=j5Aq@<)}r>7TL3(I}gRpw4T26pJ)7fA{V3ZNSn z6%|!gR1+(VF6cY%Fmwe7N_j;sluBrt$Rsl}J0*<-1)^{;AuD)+0Daza_wNk1e`^{* zJJS_t5J^jzxuXi>6umkf!#q5WIDG5|+9;0RR15#1u@zht5;4!FZcf2UnO;f19(gpQ zlxaRE1_{K#DFKX7?x0_3pB$TvY&WDdVit~Gk%IX+I<_2=HzuwEQxBqmA%_pi+}c8n z>(IIT!Q=`+|2YGjH(*j|)8fqg=Xg+!F|IeQLW3qk`eav*% zA3H_;IX~0nYUm)2861o~6qEgf=&Xou{_(o*Lpt5@D|jLZ$;qL~501)tC^`q56s!)N z?iql}i|I?Y#(ol$^*~JFfDev*7O$TW_A^ibs=*mMe`42}Ime;xUtFPl;olHL-Nr_ z`&9nBSaiTbH+E_J>4B2LbXiuQ+kps(e=*GHJDLG}<;EBxA;gGMQ=>?|BOc~`h^+9J z)=<A`$rGxvKMK|K~vHc$%q zV4!OBDG4z?^ap|q4@IJbRQ%(SgFr**qXiK0(KXG&gb+w1(v%PPGG@ZL(H>a=FjwZI z9Vd<*M!5?=n+bYcwQ3Eze((N0BoGG^(7t0Q($LuC4D2uD(u#T-3^(Qp4HQi}YC3)Y zfGKXp>$BF7?zwf{8ce^{%T^(5(TWwAeu>AEz!OP_pbfCK8)MPOv*#^`9rxu9#DDL@ z8M5YCvLX)Cw5YfOed_SInc|>x4bA7p5P6N?)j;H+a|HpVz{WNtl#d;MS7Et2Yir@e z^~X5lXesH=!&%yrjVH^TY~lL!ooUVw;|mVt@sTy4NnSQHHY;v#{%6aQAlt$D0vK$l zEZdG-^K03WQe#6a;PZLBKDKg8yjG&!nQP;Ar{%0w6pkf+g3Dh+Vsy=MLKx!Ab6s*v>e-Y@CVn;(Vaf5 z2p+f7r%6lZEl@S@&M!A1;gV%b5&Hb#moRb0jvXgU?wx!0V5fgFEfb-+dBvEc$5V(o zGP1FQRch-RF@z3}20=DC*301wNgPCWyaBQ!P7ARWFTAofDfy zgW(S~Ql0IReCSmsG^(XPjEHR5L3sun5$ZRX9Kn~T8(8gy6|#yO_q_N_pk_^mD6qLZ z*e77l<`b}m2@0hdEEZDUnFJb0L=q7My%Iljx8V&pWD!QBA|HQbm(5NN;Y$JBf=-~x zq}-@ML9H|`>U=p3BrbW0@m}H8))k8CnA3h1<2=phA`CJ)J)hG(1DC=PWV?j_nSz@6 z`whi+8g`SzAKKoGs2<1F))gQMA+!&)h7}$+bsKP*Oj>?O6xs{UFA5=Cb&$@|LVIXy zgyi5F0G&N>Z5N>Pv1S|Bwn0b^t_f(3|M&;9S((Sfii&8f($)yc!L@;kS6+47ZR9F1 z3#|)ZTWA%p{YRriBKqa?kQ{t{QUA@`O76e6=)QZ*-Fnc0SX(0`2iFD^Me=&RpMLtO zBpDAzv@Jq%aLoYg!nA4AjElC$dE@{~lAWrWd+W@XzJ6Zfj z79Y3h->;Bk;|5u$=X=`_=aU1bnnq=rMrV^5RbU#GYcfTeLb$R>8PX@rWP&l7!nuQN zaedKEQw(aoY!xoF>%P+qiF=7M;Kn&X}ue<{Li!Z)-?z!h4 zdE^l>u4QFqu;KIKi!YXzmiF!2H~Fc77{uFezkS1o4dIXkk^^Hn*REZ=Z{I#Rva+&f z&z}ABpZ^^0yYIfcM~@!g{qA?4e)?$$1cm^fqC{N&>Q}#l19DJXTWh!5SFc`;%k$}p znr@1rCpBhmPgfWV8<{JFF(AJH+znjbTwH$#<5hNgd z0OPv3kLcKxA^mv>t|IwzAnYcH_yGtX5d^?3XdpOf&YU@50$}07h2&$5_gSE;nkl+4 zY*dU+D%bQ?FfaKp8d_kr}#KomFK`-ioS=_edcr_*uqusIwqZabXzua^<62JDy8e?d5(9AGWz#^s<* zO?cOS!f|PGKyX@ZSmf+>=hw>ExN$fwHhY875toLmA_x8M{moy5+u?F@={`T4c8|;9 z^l$@*+b$-Ajn3Qa>sVdwSxtkvrO#K!G&WrNL=w0Pa)1mYqMj0NOk|@X=Yz*#XFGN< zo1NJm%WbehdZ(}4G$u|QlRn#lowKG$&5BjNO> zk#=&(KN6mOxvkAhNzcA??Ad>a_F!@go`bQtTuwVy{nO!Mo8qy5dFih&Yno!u$%Pll zM6);pa)8{hDa91=csv0K`|8O-eSQ6m88gt**3Y8zqM00cR5|VTZ>QXGd+ImtD7pP6 zhy;I1TT`=%Hb65uKo>KQ>xswyq$pC+ ztt1D4cnT_D0~F2g1BihU?$$#j5ORP9vDnSb?P6{(b4$+rBBOReaN8|xQyiNyoy=#S z*JoxUtymWjYDXpx7bvBL112^uKH&b!7|}o*+I_j?!0lYIVujD=E57yC@JQ?}J7B2ntCb?CbKA)Klc)N6RgcaDydlEtS%edva#g*4;0^b zf9bvVoskdDh;#20zVfg;Ee@yIxVSVllLIkF{UA4(z|^&msas!Dw|?PW2M9+C6W;a0 zOmHgf6tM8qHo?-+*x1-1EF6EuCgK_as(LkRduEz!HL$XzolH(kOKTwqr$N(AQT@WA z2AHA-nz|2!gWQ3WfFSpUnlRYi24E@D8GQtajLu9Z`i=yOHGD$mG8^J#uJxZ+4j9Jl z^$D9kn!oq=PruVK>gk{MecjZ3@b`Z6Pg9Qp>-QCRAo=KR>eeSLYEW2r5Z!++)SK!j_; zBtZSQ&{Jlul7qjFS@{0+CBGOF{kM0Q-1*2eKYwc6e?D9l)}`S|tY&-M|D-(e10K{z)h3v&Yaz{htpKrCu|@TITf{4~|L~{FA*`2hBEjAOt79 z7SSp>2r_(i@Lw8Z-@4&%Vfb1u=b zoaU1yujG?u`h9x=Lk@JQq@Zxzq|bfy9VGf$R{C(0Lcd*)g#05;^lSFAuB~6Sj;TJz ze;4YqgMWnqdp}k2l@tqqAqT4BjgF2PHTGRi zm)`y0^MvHoywX}#)=G*>8_Eip>cjwiwlr2{zKyY)_HN(qmSmCqGJ{rsugd6~v6|+h z@4(R~!yv34dS6naW?hgRVC|29hTnaNnEf=Bp%xGg42C132RXvJ_qiZq5PSgrfaHMs zSxh>rI{ghs%j>HK<69{~fE;){o~9adhqyXRtqm>siomF?QCy%@;t78c`u+m=pvQp2 z84cmz?G@4O@kgHguc`ZxhaMks{X>7j#t(YpPkImiS+CKiu7e;h!6SV>6D$YUBtTb! z53q_|qafjEy&UxTzZb9X`n!k!@cOrY_{{Hz{BQQ!r0vOdk3Rd(^<94R&*7hU?DqJs zEL-O;y?)x~&E_M0E)%RD7-gLsB+igxB8&j2C4SL9FZ>Au@kLtWlBP&-)~!RZo+!{% z3f}++R2%ZY@cb_YN=6##T^!I;pl=B`|G48R;l8kS0UCY;XrIP!a9B4i0W^yAY#EK^ zVD3+s5p>x!(&sZ=4upPiexN<{89R-Cq(31c!D_WyEEeoCTCYRWty7dmgMr)>4AcAX zz4JcDd+)sm&$U|*ikPiOKn~{4ohy8hKNY0Xy|>w4%$+f1I`y@tuUoVB%8CKY8WlrD zbI=!q^?KpPh0it7a9@xd@Ph$9#!wE#qlH`!_;7Nu2>3(^aXG&+_~6`fV0@~~t7{Xz zjdv>zH+&X;-KXFBHnUq0$dk41Rwo7mdlFf5H$Em?ua~VR`?QXYQ@`n5{|tTJOp&M% z#JccptDz^V>ej7WKmYu5?x*eCv2WbCaUXv?e!;x?Gp9^PC_F1GD|zUZLqha$kIg22 zI+y>Fm06+B3{sEE-j5s(?ndAR=m${)JKp_=$S#9TU4}&V92nlUFAe$Kz2WHC1A5{B zQ`cT}THK{KkKA&|&tlFm2dXN28-Ao%BVbf(xMDNSH+7sJcEbwOO^Z!8RBu>9-w|yE z6m0Ao?^3NMhy(r!iDj{-A{J7t53(S{Wk1OPR#L4U9k6&Kfc`mrS~eGY}kjZj%Ilx z@9uS7mq+jWzy5bU*mqxMUGwoivpEAFprSOrsfMUGeJR;)!ti7KB%4WcyvbM!t84h= zo8OsZidY&D} z_w;94WJHI-KGU!odZI3^S+mApb48Y1x=b81Z_&cfCeDz3^xN{~Km~p7RV2IuNF6h} zsb|p1T7%(cn&kW#HdW<<ta1Vfmm4A&OXvDlK#!vXnYI0%+Wi}oZ)!yGC*M7n zilE8N+EFDMKt5$$cjN6B4jPp#gbHa>>Fd`mK}!nFCZp^Y5OSa>+847I&6{WZxbxP{ zhj)ItYuM{=&Y3fB_C%};q}i-nx30LjP(-*gNFO~`^SOL7D1kVD$@H65qWOwzlF{iG zBnM*dHXp^NQ)Ea$lP8(eVxGyINk1Ur<^8SA`n0E7AFevX1KJJb8RH$y-}=d!@??`| zvWcnGl9u2Z$+i(#1@uOfrZ>$7O;fxi2#6sx$7&svU@exmU@!3Efa3T7^WihAA0SBLa zdP6v~b&ws=O<_74zB(_**)$Z0Xr0i(JH_Okev9GN92jra8i4`!ItIWkJY|)+6t-Y* z?c4E1!UxKO$NXbjI2s~2L$n;cDL3C{R1#9+FI~Vd2l|NeJyyI!Leh#F#meJ5lPd1~(U9Bj z?|C8H3y

    DeXB@_K$kkDx8>7^YdxU5>gAR)Mc-I*EyDhYstD5)VQnxefz=ol4VV6- zBTt$du2TTPV+O@ZUKT*)u4jW!aTn-q&t~v!oy-+@pm#n5}Ys&%=s7m!7 z0$ocGqp4cs{oQpkzej90xM$Azn2n{S;r@IRsH2$-CHHm&T|t0%j09yA=uD7Urqy(1 zkRA8H2P}Ta-VkFkUr;uLf*C;wO#sbhyEO@_MnLWpFtTZMcXO$c4Q7MF2iOe9qM}$b za9&Ba%|U}E%Ms!v1Ws=W^}soxe@AOcwoB*N;A(_s1$JfL^^Le6tlm_$HDUTE8rgr| zoI3jl1Gyw13`<(>c>VnR=ye*o|EzY5fdX7Siy^XY%Pr^a?Jbwr4Onv5r6B5qOV69D zi58$^0_YYI4*oSD29P-7R0NzKO6CD&>sTOO%B-!8pV0MAdH=?4q`N_jF_uxgugwo_ zs>YTSpvOIG)Lmd+tT%u!6#?N)55y6^iv?fl1XjvFtFsE=`GJ-7bwy?6)1cvqw6tNi zVZIN}&YUGpXRoi%_er}@L9kef`t&>YE5v^33CJhb%DPDmXKU?)7^&alGU-T5N}`f_ z9<)*m1nA=rr1B?;lX^viiX-f_K=;r1IH#v5qWdxc27R@#u`xm1{pO(kUoA8FtNVfv zikYqLIta08TYL!#34CXhhSI5g34=*o6%OmNZHouY%82;JB`Ku&5(s&sl$4e2L0K4n z_?GaOL0PHQ6e}hP-$z5kb#($cflCSy8ynB2Et9$JmqzgZT`UbQ&H%ps9PXV) zDHR)lnkaqyhstD1@9=zt)d2K4gPiL;1PRFwG+L zN5{rG!Lq71y0R>Hhs!zgkju);zW_0;@puTrcY89@4jpQ16GrUYyW4AoatmSQpa_cZ z&qBZ6qCD_DJf{nJ$nl(QG^v`XH~*DPqHz5PFW<7L;a5Z49p5-;IMP(T;Cq;lFLv%@ zX*vnR&^d1J2T5m+QJRUZqeiDJA|iW^z>=kq9z7f{(UlVw^%FkhP*PI*JwD!*%I^V0 zSfsHI8uYj(!>NNHUIL-p8eYo<5?EpBM0RtvA#XZI;#&^y8$3bN`8HId4_1Qpn+)&n zR>VDbgZ>tzW{wc%kfJRs6h068^OulvFzRbJa)-~-y0)eeh&?|+_CmF&#n*k zw_0}J{3b8uu^cM8SekwZ^S@jc@kS4r3+Bf)IKQ*W36*FiE{jYvX-CydOa|4bR1@;4 z2fE(T#m`r=)yr6)Zw$K{*79-k^{oTS0#ul1SA4rXqF6HT1 z!(~Dn=B=fs3(_0-W$hDfL}=0y2PX>t^vP_UYxi~(wv(ARI>?Pz2zQDNPo|Q{XS}=E zQ<{g*NLY_jbVhcV?#Y@A-`U7s7^+pI@TC&010FjRh|p$o@2E2OcC8g0GQ( zNwc=SgD`p~sF?XK zx}wt7qIV1=ug9ef>P+=^WTDm1Q0?|YEppn!wXWW;X3IeO_410HHP(!5K!VOfMvvk0 zf;}mQ=?8AD{F}~9w}HSXt~IA?x>^)~UyS0NCjYf~4(ls9^K&g7=#|qgCbK+immZdJ zRBpEfJmbmf>ETM$y`YB+36-(ey2riOgpT%@a?^)>jFU$)kA=COTEGAF5T}CyKT~#z z#neQWRWp^3EsD)#%`B22ErG3vPTTI|}~MFUZA8K?*eQeeY#qX^9OD1F{B1 z9i5?}6o`5Yj31O;fVz^!^J2l{Wlqi{Pn|d5r{1-n*YR1G7pF&@lEZavp=ArjAn3M4khNQX&Wdie9$bkuZljy?M zLOS!K;=2Qj=;z&=SY5rr49y~6e<^1)A zqqFb*BLO9#n}w>S!LBxQnW{&E#%2ADb9H^8Ht)3|ZhNN;p35HIBK8Z+hkvJL1&b)A zl(m%+N|NpIB6_vb2LbI7J5c{*0N4@3hC-nLMLw(Z*T-L3Sz$IAzy~1s66ko$fT{&R zH}LyzsZ*@>BTV<^Mv!NcAZNY9{)}TUyR7UmD$VOUX(LRO+p#jNuUD~0vMkN1am>0M z5B)HzUZ)~?*qn@PVV1@(T@ z{ux_e>oSW!mV@3i!b)dkHAi+?OS!MNUi$u`GF#zKTwS~cDg6@YiPE~>n+i5GNN4zm z1x+DCzKLywbRN1}gAay0OJwZAnc?vy`%FjY#{vuU0XixiyuMz4w`Xt(+nK43i@pfe zCgz}uvsLdOEFJ>z_{~)m?-O>vb5CFSY5`U$TLWqPweS18=C-z`y^)jyDG&hMla1oo zi~#5f|1X`T6O|w=Jz@m-G?3-R*>OvQSO9$eGqkI?PcNikCr)=J9*lxF-p#VHzQa`` z`2IdZ@lH%P984}UOEGCTvwxbq>IhA&1iN#VR3l3)Xu~q=-v~OYEq+7s=HucfHaF=Ta=dC zU8-^5y;j-GR%}?M{`*H&V9%)>`Lu*#xkIP-f#e*E!DCF4+oAiAKZ-k#hCC<)UOgUYWh}zV`I=lt>Vk3|L&ss&AiYM5Lt9051S? z)CEUgki&sA;d@e22#}gv+!};*#pg(XDjU*_GT^QGfByXWQI2#eEdy|*Jqp`BKaBK( zoDQ#&3e0S3mQUerq<4R`FN%FVkk0qva#B+L94Yz~Ca28H{obuiY4_8nBs>Fc%V<2W zZPp;?Obd|vBi0t>6tBUp`e`cJtw=n)ki(~V$<^G zQ2T>JD^W0Ge(NPg*{0?Sx zP{@|e#m*fGYG3?iQlVclWyhNW*Z@!g)U3AB2T2FO!wx`zrc$Ca2!e8fx+PeGkMh6o z+T2|?FI!Bd`m~x^44d(yvcm$&IHfQ;V)8_sxgjK<4RSu_bp?nI|WF{aDRVhw_33GLROyHtAH`%(=_h zgf_keA~ryyR8;>D>fSP{%BXw$MNm*AM7j}>5TrXrk&p)IW|Pw0AR^@^q`Q=q?gjy2 z)7{-6&8G8R+voX@^WltljC000AI{;62<(0DJJworUh{X&1qzZNn+4fH`VB~H0EZ9i z@(DR19Y)I_6cGQZbPR|4sW^uCUMvTJ-y=MS#L9S;Eo`_cdO5zQ+BdEK_=M9n@%;y^ z^d!PnQh|oFzFfzjw5mSg19`&V(%m_kTw9xF@a{-`>fIU+sAWOtZ}BQGt3%4oE;iF6t$s|2&rf(4ci3 z=rihmhHu<5&Q}DJgvEc@lT8{bYy(gll-$76Lf;Tm!4JP2i1zKg_Qb|v$HZtin7~!w zFxr!8JS%X$Sd5S-k9sW#(g8dI0%dh|SST@PlF{*4BHVs}5ygyE4e#p?dlFe2GLC%2r%}}D3=fM3 z0I!tT^{2X+XLjVMR-fMmVIgR==9_g^>}JwYD~q|?MW2WU(TYp|U9|;$^rI|1fPs3! z`w@wSlZ%UoT#s2!<2=DGdgF6Q}B|d4C zy`R-=wxO>ub=H|B!3AY^#DKD?-=-_NNub50lg%hA1FSs((21gT2e|)hqVQ><i zteWl)4Qvg?MMuFRRAI`s%bI)}J894lEvWVEfp|4n2>1NrmeeGMmt~A~LJuhDH8u># z!ykO;%yDp2N0U+DGq=L5u=5}(VG#~>eEXn+xry02V(IBDLzfHus($sWg!{$OFPCPm zrte{ovNtVk#PItcj*YKjJjD6?kKs7U9ZE_VQygY*%QW>lHNz5ret! zgR(S~n?cFuzRczGLqcqM*kiO{U4vW7g8q*CSN)sx_ZOZ*(U+WQUbII{baW$Nv;sX9 zk)?ODtOuG@X@NyAPwfKOeNbcxBVFr3O3 zofL`K+{>8S8Zpp>#r(rvq75IhP^7FaYiPx!?>!kBq0Ah!P!?bg3xefFE|MA_4XDj{ z?uE*6Z-spB$M6}6woamK5tFLw)3*rfL@W_s&hR<>CEc!u(KM5rKgY5P$!(aBc@FlK%~c(`meu=oyHXM* zy*LGDPD>GiNGy#3QANuA32(N>)(kMgU}B-0Ue{3pQ|~5OH?KmaWAS@i6h9>PRWDv5 z67f}bo@yuMwaW4zlRdj36mk2z#?~?9FBU{-%o>#oM5f-(QWgF7ZLq?Y$Kni@_8x@_`+#sTjk`VKi0%bD2!wR5h_Bd{mO)Kg`Dl*koiyZreejx#Hr;IMFT%qQ@>07au$o8W;|KUGm={c|0#OM)6@#@OTX0&^kd}?U{>c9tlkTHK~z~| zyEw4i9t5PbR!rV60vd8aWkF=z-@bhlD+`t@Pdp+bNKPFabW*%f7S@o9cJw_kjxypb z#T0k1;qNTs=I`rrTa4m&_ANtZDCZrSMu#pJzlNZn3q?E_kyhVEb`WOqk2j z)EWkQg>_$vOXND&(XzpUEG3Gwu9Yy^pI{=4tgOR^r=xsc8OanS(f3N0o7o#wK`3fH z6?<-09)KmsKn3efmsCTDug8wbg627nu;J7AXltV~J_R8-vZEPxlf`s6h42S&Z{hQK z*F}EYw=%!r;UCj1CwG{F!D7F9>H$QbAT4*K_QbcAs|0ta`abf_*B?m(4d0wE(}jPP zOm+PL3$`$HaHl(0_rCg4%pkL>&^s{2INpDgq{4fbLy)WFKjwNZho7u4@>P~g-|W?h!hd40+t@v499tF|~ z<9J8;ik4dxf_{r1tcTk|Z3Ixi{?B&1@YdN4yGZs=H_qqC2}172^!IA-Oe|bLrEF*X zG>#KB?9PuNXZ)=l)!QyZnnlR%TA3X~&zrHgNoI!;xf0Yk3qIG@VCDxp{YVG46f&pj z%Bx>1130Sbp3KPa970Z+V&mc@Y;0ISP?uSK)@fl03U|bzsJ*nw=o{vm~`Js1~zA5cWOiyi(RbsA=Ftu^i#?OJ9g5*}Rek(*%v%CV@c+{S#67_a~aEn5t z*^3`UTXP;eMf!)f9@{Hre911(aKqg03uga>{(-&m9QUpNVF66^JhV`Dw;tnSc23V3 zI&6+{eL(will9^=H^~dKn$;>;{^CN%3@%-boK*WkQPo*tyv+VU};TRaz_wND8;s6A#vvL##%L(|9b$Lakh0NpL&!1>1kv1K_?Gs znr30zDw-vr+ z+UTZgnVXYSH4zBN6q(>g@7+4h8 z<=0Z7!;fqlDoP__5Rq4N_G#KaQH|^tF<;xQ_IT{h&dQGy0;KuveJbkWo#I;s=^@O8XATaogp^JJ zTYOUr6Xv4fG`BaVX2IT)4g6L|Y)uRUgA>)9bC%`5d_E7WijYY*Xn3;8yP9EZd+f>{ z23?+p`&>m}9@^A&x7mwu%&Q5U*T7f99^|OGxt;r~tx)han|;PU$6S(iEq7EWmF&a& zw&HzL&)(O^fjt4eXKemnSjfy{GbiQa)9g_NiVn}W-tub}(U^VvlP`(~`5W``(<`sg z!{o1xjB_d*rW59rXr3NhoUi9p)8zMpF?w$4aF{U8r-|Y>f2V&kJ7J^0q+mK4g&Of$ z5!{HN1%y9#k$feZlr9(da$sxD>C^GN5Z8>@j)oE#eT zWvP@^&+C-&K>rLcEWKV0|om|)*3z$JHUS9A* zJZQWFg=W4lC80+=xx4fBMRgz;?!>j6DJSQNALBd{lG1ycUb0}FoI`4~k5Cv{o;FLx zoQI3&r|p_}*`tmglaX2Mw5}i8sYfP18n=0c5gmagF+~Y27ya~-wG z`?7<|8$W%Rd3rapF#VNAIlV+FYcO$T*?}AOtUm!(<%#n5<#t@G5fhI@4XeY}0X=kd z9WI{pkpO6t5ibn~xp6}g*Y4k(!PP$_ls{N0%x;5HQ)Ew{Lt#(O&MM3&kpg>{CL2%_ zTvP<^6k|#k#Y~!mw9Ha`XGZ!@BJ;`kMBa4R@p?v}=Dm_>C*OixOFylNfGb69Q;m{r zR^b;ZZnce&P*aqZ-5Ovw%)Z^_BY^zX5DmzWKXd;Dz%$^NR8my@-k3f9jyiECw9b#LoDr0A=_>yH}^#Og_J z#q!eAZJtD1@M<=4c9E}gl%|jwj7vYAJ*ymDlU+XBC2E-_rXks0?H3l?&+A#TlM$VT z94ftIz5dB!(_1q{QOUtF*#EU0Z$;A6!bKpzpX1`FC)yYT{%i|d<>Qj6gZ-A&6@{|zsT&y#iydE?>2D36zE5-! z(c7VZ-7h8`4ppkN`PRsjBEm}%FUE!ifi}qwI67GUHr8<`sfjq`5SZ*fDrRWH@yDSN z>Lc1PuvJLu#uuU6Y+xL8R#|ghvY+YhcUnHzU`OI4dudQpks%P>l0v1C{_oTj# z35lLBru0<4<$b+pC^Svctg~)nWbul)n(wtYdm#%G1YKCRt8A2c$vQ|e7^r*5aHcYrs zWunME+If>!n+mq-zQHLjrfb0;e=wek1f~A6_u2U95u9jenH`}>`$3W|9Oih2!4+a$ zr3J(=Vb3!~H8qzb6hxW4T$h2KbmJv+M2)o>?kba{-f5e$-4rOgBJ>HMBKcdgCk-Hp z>P$+zOOrf>Wz%L1c4y_+CG#d3J-m9mW||8(uS$JM={)+Jjc*QjrFBL&$5^2FDz+pR zROCy1Z!HnZ(cqwh3qM%4CR2gN+b`hYUjWz~&>jI$MbT*@wary*DycVT*6m$K8n{lJ zeqsxDtk{=w7!9#P5sze}i6J)+jp!&81T4-no5*U$Kbe5N5`kx!$s7P(IuP_3-n{*N zn+5kxasajf*Qp2=Y>Bjr+lnBN{(|_g!%UZJn!A#J=-AGViISQcsA~&?a)8mAls6|> zN*#)H^h4gVbOS3Sq96r)@BS`Tl64-;1Wy5k1gfR%Mt>e-K+GdXz`-!^!NIXnfZP;n*MtN15j5&Rh)*uk zQ4az9V+v%#nAlju8vTt|5{LrrG+t#11XO*k=IdjBN`mJ>@poS$CqQ_*S!AMU0mc#< zih*E#a%2;ub`kFBVo&s$$xKkiMbwx9v%tu}fGFmpPa*#v%U5v+fDrIb0|<_;feaCj zCVe?`M!21UN;Et&@)octrKR5ic>(~SsNE6cX8?K$CF74m*otRuTZI3eg3csfC0Yoe zS>#jr{Mwf@>g%t5IBKE!i-G@(IXZHpprAbT7Xxq(sM1pCKnF0`gRm)AeimW=S*3%( zJ}PQyCGAEP*C!>B=y{*20t`$VFze<2oYOXp=Ge%Vlf~JfZ3w7K*#m+BQSt{;CBTPX zJbMg)8wH?z>gwtO#d~;iQj!6$ZQBVT3dEv5LhkPF-FMu9T%%n44r^?z&Bp}IjqH3W zHa=Buuh09i^j#~QruJL_H8Y4t>Gd0MA5psDV8(Hl5fkhNF)$hy*%C0EcWyfY`&bvq zCofyEecq_45rCToWNqNkE}OOjvI6I)F$UoD1UqtN&cac)ZH!zE4$Av9TQp4vx(b z83^!S+YJ$v8Ni8`?GoNlyBjucqO)vPBpFxcrz=A+=1r!{>bfR_RFpNMwqOz)r-F1J?_@768O^1PAe_<#e!vk1; zWE0r@F5#P;79+HPpKk}Gk-3$XtcwMQlw1m5WLg>pAT1Jh5xoJ5nf?wphp%sLMgw3Z z^Igys82@1Wt{|=;xW3&ia;P}aj-UJ?*-#BKg|Imb|5Ax zAj`TDZ4ZpQREC7Cnm}P$8vVCn7->k+YNm0iQqApiD!8U zif;e;OF(yuu!AABU%$g5a&!0&v`t7u{4FRFfyW#&{!6v{Uw;BA<)OF=z}5hY0NG`C zN({^a<-L)#$s*nY;9D^B(>EZxHM{^eOc78};{fLl{wy5ScP4-Xv)MSFM*1V58W4|3y^}>$yGy76 zo7+HoUgDo}@Q{hL$L%5;ANB&GdO+~Nc)ceU3?XoFqIIKarKP2xfPvn4ceV4c7$-`2 zb=K1EdiQtJjUy->-e0hKC}w)Uym)k2*;e2p$4Nl{yk@C1y^Nj0=yrn2{gJ$u{6k{h zeR`Oomlu-d-v%NPx>WRtP7c7u8Uw;c8c?H&;4GQc3Jn$--T$*vNk@TBA7FU80kY>` z+bHHnkIXY84|$5Uua3<3SM9c|g0NLk)S2Y3JtxwkHFrIE|JdNgqGfk= z^_w|bqVQ21&Mr97*d(RN^zcWY`~8n2WV!y1LVZEn^@%Bo3MQHOl3emKRNP)@WnRq%{?~e+ zkPUjK$kM!Ow~p_=gFz<;%%Crsz#7+=z|O4SoC3_hMrG!e`x4xs&JXxbP+i>w4`(*; z0Ve58md+gITpiWv)D9fg0!L`Sjqv@GKB8pas$&OEHyr{3wXAXnTeQ?bOirU^S6jLD zFnrk5s*4eZc%sI}3nzxYnRahkOGo8o3wk_Wsj|$fKIijVc@^ z;2qDGx_b?98ulWiB)R_FW4xjJPV2?Sji*D`%9316ew7izL>n2BF(2R^$aBb7us z6y3zgJq#T_Om8et|9kW^kDPqNR$nA=^3mXJX&}Z@K=x}VBx3dJ2mlZ31C~-J4iKR@ zSV4#ymE-0>2U{qZfuzCX+t%m~*8o2R>jxa&BF$k$C@QAwe2{H49u( z=KXODUxl!5p?7RUktI?T$EXZK92Ozmhbp(TlqBEsh+Dx#OTw zw*J#UD9dg{L{z4?aI@L6q2RN&giYBJKdfmcsVEtjjMhVbv$p~Xm8yVu$+hzxDv|m& z=S5U<3F?=emK!@`1U<1Y@Dm*$n9@PBBnef(NGJ5CJBCCqdJcgdN)?uu|NL(x1Cu~Ba{e?Pcq$FQ<_r9q_t^Ypo+da%z zi^NDrDcRXQi;vKjyrZg0&%Lh*xi&LCs$t!u|3q@LM9K>qodjbj2U_@?wWy{4PYMF{ zFn+wfx3^w3sR!Ags{;**bZ?OA_Q^%O5`ZCn1%8>ApI`Tjx4-#%^giBq7CD=r5p4V* zQ30Z#z8bc6qYfgzPM>o;`AXO09)-J@K1U4thi&%MfqsKNzizVxpS7=6r@5}Zcn-zw z_-!rhTJVt>%W#yIECf9Ce-H#DSG%Wa!|;qb-Opq;pFk|rjYXU<<DFdwU8}ykdMG$2n zTo8!BA{Suju%t3l2L0xv!wBOAhS( z#utan0C1*gS@cycDFgX|L^xSUuX8cK6j+m22T@I>X{`Ln%eJKe3 zvvd~On5R-1`N*-z%x*OvUr8L#`}!t(_K)`^-#d%&T}_`om!^$?wS&rl2Ee6FOiTa} z`(+Ur%YfA*6g&+hfQL|5CyeaMy=MVMd_?FAVs+pZnFb3o|Dbi17I#M$$lSC@hT{qV z17<&|>w45lYP$r#1eANr26w^{5nYP#4|3@9Cjm#{DV+z+wc)#>?!k+fe<3&hE%#4d zWA)~FQ0v%&+FL=rkqDIC0N#!uF#xZMXj}-g0N`J6Y1jr08^O8`5N-s`!AJIwS_LrG zh1aGQHi$Qk?Z7B6=-h-WX>0e+R9U(MY8Ye|-7HTqo|>MstKCj2bkC&Ac{PX+z;Zp+5 z5f$(gb-yISNZx}hBNN9g{kK0d-Okj0@+73O>1y-lmgH&Rcp$wm2V{2gi17YGrun#y za_2pp6aY7XrwsrVpi#qu7hDbytDuzu!ae0Cw5j!FL#U4p&BZ3Cj{8gha};%~@n|Od zf?h-<{lWyJ?k~u1K^I2|xC6kPNmoN8NwIi4&3d^H3KVzU2XMgx)Zk3QR)deAV-si< z0JyZ=oScpF+;A>I7kCfU7h3VR0B`16v-#xy_~1aOZ}GOd&{2}$RY#JOAXzWHq{)B2{=ION6gXD7?0CHWqx*UZ$DewV2&u&ng7sD(+=lh|cx2up9{AliF?~ ziE226>IT(c=DvhkG{tp*zMQJLtkb-{qaxO14Y5tybq#QO!2}yF(EX(Ngl;93@@S z5C|bui`qD=zP6-oAS9YDHd|g~X4>B~Azep?Qt}-c!yTj@apG0?-cho&KMm z3mg^~imjjhd&c2tUv9l`oUCK=dOHtfk8rJbRxkHZ+$xmanPSEAE|V7fBW9_OFmp8 z6BF!2OV*lR>RPLz=W{bzwdadz%b`)SX?PhnpsUL~Yn+|W^j4^2u-q9|7FNU2OJrbS z`IyEEGQ)t~%R>fZI6Y1$ZMZl~L0-6DBErco_G= zNUzGa&EKU{Q$m)YN9{<^qazFfr3F3b6oHy}?Nr0N^LmjDGi~?vJxGGu({WYM8LwT0 zPTlm-=a!v09GQYFb22Ho%OK-m;AJML@F5a+P>le521sn`2EcwdDoRRXVqyvljQL_CpLi6~?WPk4T-qqR@W8xosLODYK}EMfbn>xuGM__P$bJ<9G7 zU8eD$6?|nSsi%>A@EaE|dD8J%pPbk&=m(t0*0%>;4svt$Fmh(i@~;shSHZv+2z0Kx zfkXmx;mV*YOI~HK&cD0!Xf?wl7Aa<5TmKlcch$^nb+oN=269fAW&b`f)^tqx@k@3i zhVO;>VV}2+#3nyuLgHX;9yHXDAnhV5?3DgzC8l`UTF&8oB9`*&A&Sruk}oCmaWJ_% zKD1+bUGKJ9*&ZR6V!YbUSahL6r=qEejK*mTIy!6F7o(@HLJFyd}bb6Ndq$W8A=~ zR|f!FM0P?+cmJ>MA-vGu4nrHNZxs8a3sCEVZ(6ilZisQ`*dc?sFmSYCZTS>{_ck}8Vz?_Z~ zIjAxemz7^wXbd_R0=E;8>FnNbmTJ7N-HU@(e*WWj(7tMA6Yjeo>EBR)aVa@J<~!EP zBzRq%hl+T$qZ0HN?f6s~1eh2RS-#NWZ6IOP zQ9^L4wkrPIb2-N-(-CSIbyxtTp zHRo*mJhAR%sC@%d|O#$a|W0V~Y( zDkGSBg_gNAMn<=?Qdner%ajvmitKH2dHMdXNth#VZ*Tf{$fr18@6LFnsFL&KU{)ON z_N;ORami&MjB}v(B?da^Jp;UE<)F7S(5qQ5`Jks`zdQ&E0(z+FAMs;#)?=0*kGdO4 zyu#F;owj59I%#58Md|`~(e~qVaV8_V@p= z0K2O{m2lb0W~he9jU^}Z>D^>(LvcvIcEx zmYja{AnTRnyBTnF-d~{T0y=lZfL>wlt6{vLRh%Kv_5M37Qn(_jG5A5VzaR>aU{KjW zw43)Y=FpRka zbmyN0`tP?tfKyKj$a<^2`ga@@5kdO5f7L&yo550^~pJCOvo(p+sVU zY63>R++V-G0W`=s9&|~eKIR8UUjs3g<7TR>!^NQ?i0VPKZ2)+{f696`;*GpO2jjp( zptyoq)f~isK+dz8tqyB!6ngdQm6VK(jEg&XD+hltj$f1j!WXz3fem)5$&V z*x)b0nIR^dLip*K6E3tvN@h?>u>e3G`_vP z4Q9OWiHRYTJHUaP3MVU=EHu1MBVa2G?UI3&d*rAr+t%R zDc{jXAp>7QNd=C_^xW=m;3h@pMn3+NmVcic1GQ;a=eXr^gZDnP<*Gn*72EfE(0%_F zqQ4ay&)=kvGAO**)#zU806|gssOp^wP4@=E^xBarMai{@<3L64x7<%|%@^)^9xEr# zn_lVl@I5bX-GYA~R!W(x`52?+*gM+yVv{-riEQ;Y{f_hg(=A1daEJT*&BjKYy}+=- zH7o*_MwB#fRhmY`HEN@W1zBv~Z#hON{lfAaB8Lhh^pD8&kjK{AeaxyakO`bv8c? zBGyf6|2Kq1hOBkz^SgbtOde58)>L(&8S}sMQ*C~^B0Nbep9`mX^< z%PnVDGmW1!Y~MR>Lt9?>?DoJny?(RhJwMznr#QU+z_(iA=Qn!2U#p4kig!hu`30UK z^aG<+PLT8;Vc)+%X5?brwy?O)*D-@e27UdSjRHDw&5>|&xLLB z_N|+WIkxT11#f7xFP8d5rZ+L~yJC$NqO-PD?!mOG+sjP?j?IepUd$j1V^%0-$?|T~ zrafNmw;Dw~MLm1|^|jRN)}Q^k+NuQbwZz$8=;d47T%EPX$-l0Ih*OopojF6lul9a* ze;Yo3bAf%&3VX}Lyf8d>E$G`n`KtJ)F`lSWAwp5~J~1u~3;_6z1W8(+fZ!W7e8tYj zrvp?`PVOBs@xD-ceUFut<@0atXYU98bH63cXPIusEf3cZgxlQc`x1`2R0YqotHKL4 z23L+1W+g<}HwiZObh|qTvq!*nvSnAm+UQ*S#W>e$cGZancL(~5_}Z^4E@RO@7fgHD zb)RJ(&tM9j-x&2ABshfQ%<#`SOkf6@2_4_6@ILV2fJ?|>M(8kjsR_5P!UuSFy0#rz zZU|ENce)6bJ8)Tr-%VFUq^qtH-dlaog98sb&>DB)N+Dn5k7GOC?{7d@)G)hE#^Zb7{k$S-5-bw;4CJvu7JU&<_#q>Wr ze@P?#zcH=-e}2yYeZRPHi}v1o)1AVXgZ4SOF7X3mOwQ*T28N}qq)%|UzjvLMFL)%+ zE7fr)Bvs5z|0VSttaV-uq~><>a3$m4DSqxc`?|Uk3jfg?CTbJ?>Q&(O`+!l|$KCtf z%q((L3D0!1*lS5>{!|}C9Mt$Cg{?>de+h-E+RMc|AJN6ZbD7DS#l`dU+e&yA(E`PcV=UZvF*@i;?7W3`p$zW*@tK0$ zDZDBm>%ib|=*oAt<5fql8I{k|WR6MPbN^dlF1^rkTi557SMuqF`{X?Ntbgx2@7U-v zQN}7)`(hfOcPs+=$M|KIA4KV>IaJXrAuO?~;dWHJE;ISR^!elnIiHfc%;%81{^=O~ zo8balg9dlKmVMlre^l%I`UKniCCC$lg=cpS~<#VzA z%?GzhIeYb&P(IG8Zaz%%k8Q9Z&piHRj!K4igeJL(ldAJd>z9|*qcQb8t;Lve!OTi* z@9+{^OBL0U->It-F11E$Nf7sUVlTg^S8b+MR!I4cYsFd;{i~e<_0ZrzCjcT$W+81F z-!8z?YqH;~qM-V84Krow&zo8WYL4iy{v`pYs+AboD@Pa!iTmwD@#!37(*0y-7@uMC zW@}ZyRTMZ)ASIY_n1u(0KRPhqBQ<;c+NCF=B3hHwfqn7&k(>4^w@m&}I-P!u5*reQ zmzfJTflBtqc$5-ptzC-Leg603f~y*tiS9>dkKabb@Q35dYBKWi?s~f}^*x^$j{`)p z?>7>7RWf!K9cjiFZHcOGZ1 z%mhD-NiOz#5JgrsruBQz3ad)U&M0_gMvH7?_4iey?(Qp6bhAp~Q!@5hJBq;a87-RL zWfvpY`Z9tCY4Ubs%9i%4l{HHX28o#w;E4P}L3>l!{`M-mTxXmPc}31d3N32^|)Qhn+`1^|*ZuIE|>%rsKg!J2AV6e|GgA^+!$e8;0P^{ZV` z2imcc^U@iA$JLrBUWM&%p75zE-+V)twDZV1>JHvW&oZSbc53SPN{Zk!PjhLy@#z54 zg2dtdw&)~(l=Q?Sf=FBHf}cDei#Mu6TiSUwc@*b3YzjkWLn=72VJsOGs9qFoY2(A| z(l22TKw}>{XTgFz{o1swk55fjKLrU#x*}USd}yy<-zk_3jxdQ7v59SlP4yI+j&V~m@V zhSrOCvL(mVqr+HsF7)|vF6oFxO&?Ox<2N|!gz*?S^Bt=4KhbNZM%!{n5{NLU5qz+k zWJazZVO@rl`Z0iGrjsx7=n><@520Tv@9-v3&$UBGZD3PHiT3k~ve5aE+lLZiE`OcU z6VUn+=rfn6^}aYCXNFd5>ZiuLKFpn$S5NfMdXRhR{tCFqhB;@3o6)F`Eul{zBKuv> zKS@Njk?RLY5A`wC@KfNB1z$#Qi2t+WC6S`Uf0j;Ey#G$opOOFjn}m@QpR|Dmjq`sS zuC8SoclQR@>-fL;x565|$^N$wDm8n?oB!P#D1zNez}IsW^#82NMsNK7lPzH|{CAtp z2agcRJN5sqH!+w&+3O^Kgol@K-=pjFRg^7m&pgHJ_6s=|vQsSs>tj~RitgIM9$oS` zG=g-@q_aMGVFse;=%51{y^$&+6o|CoZ1Qsng4UxN$Z=e^L*^*;V5apU-kK zBSrYCRZAX_XSn^2rr3o3)Q*XlSEHDIz7bdDQ7 zT!gsJc7^w#b}hWs)duenRJyLPL;P>w&j&ezLn6Ldtfi(VjF$mwP;xASkRW7}?&)ruc%41VInOwS$*rv__wCYR#;$G3SKoFc>OeBlr%vp%r`aLb{}xhEoD{b_G~K6sSkar zGG|@tJFWe<4{5IJzpttRuY!-3?|c0mNnIX^4E%uZa#FFzlYaoNt<}uVOHUbcK^b`6 z=)7t6dJxC{zuQ#C)|5>HjsK3xm14tXnIFaxB{)qm68d|3C#ULX32o;m@?wY3 zHCNK0KIEManb6&n?M^JM`BsjokcP(#kHybendIL8yXhRa6p0fP$JSO_74bcRA9x-Z z+h#IrrOYq?@EX-?1a&9RrmsxzCls41Vn)J!{*s)PyQ*ZDIjOuTT7P79Y#N2<=6uIbeNG4AiJ~4MB|dQM(pdax_5&=^PX~|=dpAc<0pd5% z9p(x**DBw}ke<>?M&qUP7ZoZv=j+b$CZ=$WG*j?m98*F82Y@Kp>o8+Ov zE|kt`8BIfQR$+aPS#6^bG<3Hz-NH^fJHkjIqk?T8_Vd|rZkLJiAdP_x)ME~EX}8xb zJ8@=zoAyz3_LYQ&dbG4sB?QW+jzrs^V|Gomo6k0=WZd$j+Pbi&k8Q z@X_SH7!UR%(Gauy&PR4P^5LyRE5{?ZmG%Qa@8)5L0q4nF$rNxM`D)$TmJRl=cRa2a zu0B%#W(fDGltPmoY05hO_d@5e`>-lg1MlpbSpDWpeLlN0CWo3Ev%9Sto5ha@?5v5x zr74=3Chx0tAS<~!6l!E}d(%DVvy;9bxpb+aITR~8w-2o%mId}VtCHq|mwI8{hK|Bl z(=NSBM`~Uv##nwyTr_WPGbm?A@~cKU$P^Uhip%cjy-(tZ{PY>Nnmg+90 zr>f~8?HbMfCY9>~K7?rF3ox1XjYUJ{<=Zm~czNyNPl#qb2$4li{jDrzNdw4vA=`mZf(yCxDuKl`LjK{Nuy5dJrTwc*> zMbQegJ-*rW1fkx{3P)T=okZWu?x_iRjD3#?_x@(IS?n6ZnuZ9y40G$s-4k)82+z5? z2U}SCqgKAMzW%*4*KQVW1lQ5jqzxn@6FFV$B0AnjR<8|H+{)u5Z13UAZWFOYo9mad zhZv}n4T0HqD`9UB%5az!f(94=Kpv;p;KRID!<&MBwz|~cvN@UTR%f14SBLST%AgOo zu+l1!xPqw}}#i0nf z>Jvy2!x)=eVfSWB_$$L!{@dS23s%CpwHcPh|L~K;lbBA>F2LuT731z;nw)|h-TOUW z^V1};qyoy|uD*%2a;%D&pG^_!31*ei;hLYGuW^=dRC8sd3%76F@pL+#Bw$Oeo|61* z+Q?FpuMVoQve#`dpJ9d&oxvp_l^N$Qo2D_|%v6feG71|Eo=KsO@DE1ch9eB}`_X*# zD*DMsXFQ91CdSvE=Ov<12KqZCu~e|y+iaOq5q+eT!;W7i!>n%U8%(34oPQ@fwg4Oc z^JwZhJq0W+%`FZ4)|#H;9pdVdhQZHf4o$QUm#>~BSvou!qy0QNbqrrtLXUqmc%a^S z6mLx8U63egIH>CJWD%+9kJoDB`|D=$VZq%X*$UeLAHBq9wW2q8<}l?T=Btt`Lw^}SW9PYfYHQAtQ6$WHaCR@M13 z-ipLUZ6|txZ;PQ1%fseD9yhYJ6NF3;pB#pXcg|RG^2xRyFViND=53l1lq6RDAr6tC zt9B*wiNaU%oFBu*ilP~mTlR9ChGjI`gnXHkU5m*?U9ocSbs|7FyV<6+omO)p0Rb;mSm^ge>REu6ZM_m zo_Ap$7)PbmDTkNd(J~Too>2!fTmd1bi{++r?#V$R$a@-0m&Bm8pUc+b;D_fIYl@G? zU2(0FPvt>;g=yj*xOlPkTHy1UN>Sf^dsE|;F}7{`B{BF3n{cC$X&>>kAy^|Md{N>MdwZ98nbP=Dy{Tg z+2DWMPnYu&UsD>xhZs6cLpnU$C;K7wJDbal@N?+IuB3arCP?gS`GOcK5jlq z_^TIttS{Nl5g%jir;q**GDis`uPxifSz+`LB^xrMp22kmR>#b94nmgD1)o!Wf7Evi zj&Qd-Gj3)PEirEHkHvQ)PtF@;z(xGtZMIq;adA)_adBRK+J~ZXLenE5RQn1vBOLUh zxUDg<5U_Re>@MW%U8@lKYF5i;8Y+cmU}%$DI9enrEynl`+F7}{j-7hIlDd&u(7 zWKA3s8d(PnM?Nk4IKIdIc;!`WUc0@~OZ0C#XM!R9X_5vO98L4_eW#(;H4+0kQC!Js zd)?7q`ac-Dv!qM9x9ON9a!gI_%Gb23+ zNj`Tuh^RZ<%@d(9c}W{I|%agXT4`oJRPX}eJW^uZYzpadS79&lM~!$uy>8Z z%A!pG7$8l9zV$qB-=z-1bF>*)G1=7pkFx#p;K7BWq}sk4T1AuUCgw3WaZ-pY(bWA4 z)bADtQ+ARiP~Tc&5pCad>d&wWhLJp}rh>F;>PAn~h~^U11ctDe3y7@z80=D%RgP zqMa)8@<_^dN4DtKT6YI-&hwCzn-c9yY~R~QOicHoBk#`})TyzHhetQvwr6ViwW@>1 z9)4B|>?@Ddlp#2xKeL5vuJVf{<+M7D>I-ljGq!v(-|U>>79!Ph^Bc9j6*awY{gj4Y zbpGIg?8xCs!fjJ*;cNNLx0WdV3#?S@Xg3Q7cRZPwXQCqA!{?%#0^egABF7aj%>@@i z&qq{ESv>+5wPSCGV)TWo?#2)KGa|{?Yl^G(gH*UxNJ@6 z`n}DjM;~ejv6iuN25`QV`0mXm9RC?J6iLWIPaY?cSYQkG!BFH4Bh%#A@Zy8)>UWjX zHm$C11UAOUkTs%@}`0efn;BrPvrdxRwG5q zfv_QavSWR|z$t$5$h2z{%woX&{##4_y`Ts=NgHL^*yN3`#Wf776QXmv3db1mjsj$4 zc{LxoguMM<%1yWSFsr#*aIGHn(U`6Ouh#DUoe4dT1GrmL zxs2tWQFD^H-!k_l)Iq3*EGuE|a@(|Ujv0k0%ym<_Hz_4n=y3^~yK-60amZ~h$9deP z(T212H=MuV`@`q^e4p?8_4z!{N2!0{FpWNRBNiVAoFn8A72pBcv`WB!3k)s!NMH1l zK9)v8d@%tk4dsj*Wx&Ri&SAgV-lv!w0wQ;9x1-a0FGm$)8WYeaHmR?k@*1%(p|k=Z zcpni|8YLRzq*=E>+k>vYO+E;J>(Ma6^yn!FH#(^c0U^A%#v4`qk#g<&t7}6+(Rk;v z{Mz7X{6z+bCQzvpn|J?}x66P^m088UIDR)`_6tFH)?VIa#5mh=s@$4&$Wb!e9l`xY z63)t$9L6rHyXt!NCy9+IJj?Bb+(x@3BCJ(g@af6di+xxXn4_rR^1Wni0%uu#k=R~S z3uon0Tg9z&l!>Q{366b>RssS7M*t3XHg1N;@Zy_o zq0GF+Nm=O+7J}g-lm-f1ze_ekt^3^H@}^NCiR*7PC9D2nIE^>`2;Th!Db~4{WdC%b z*K6JOCj))t#yAHKj9lq-UW6M06Phv~Gka#M1EB{UC%E0i4w=g9!ZVJCX4ZRQq}sNF zqR{C?hw6;558q`#2G6t0y8M}_DmryCUMEBXmk}y8WawA^voLcn5nZ3d4LdlG5J?{l z+pCZUE&fSB)!*j4{t6ujKU?!f9dG(2l=@e>X(}nK&rr}NXe^-U0W5?wRgjHe6 z?YRn9W31MjEe&|hC<7JtkyFpm1Jpdv8PzHC_8!&b1yKX591ev|Djf8nN}V;mMe=<{41@&wVT(PR&>6A`$f0Lu}z6dNsbuB;ilvyhE}!L=wnN_;ZDX&VvSm0{niv(ZjY_cWS}$3;gzPY1eZb{< z+t(OI7w_NPhMOoe~7H(09MsCWJyqr@K3-L7G6&>tlm3pw%{`0)FS zIP(wI=Jcfs#Ts3&zH)XJZ+niBHpfHjCJdyoH!nmj{77H-vYuZ(JlE^zp!P@f?1W`= ztOO9v_X2LDQmQ(5-cS6ZCL=ALFFf(>Lp?oldx%5Sk5;Ltv2^{oH6i>C(|yshkg)1a zcb%ex(;P~5D3bCE@YhTK;?(24m@#dnX2M4|zF9GR7vJBpDnT=Yn3%ye0R7$^>>m$}D^PXKdH={v{ z5RoB|2M`Y|6uDbCF6!XB=2*A@H4s4!Qkp&*e2stD))l1^GT>K8?$}yED!@0}hU;fM zl~Y*AM!8euB_lmdJvhC9f}sFzpr$5T?3~f+4+9U_OGfaN_+P}fB^AO?AO?l!-wsw( zr~XNXiZq-(DZHF2m{WJhwL8V2DZ%wbjbC1c^A)!_7J5jdn9jk8LyVr?>fkN@-5TB; z`J`Q(_2T&&IHd%wxWiOLQa!_UVNSg7w*}F00{(lX$XM;!3j=dK?4MLhY$z^hsHe#Zo%E%-CY~^;O_3Ob9mqH zo0_VbxieMw*8PKG*XrGUcAws7?`Qwkv;5^`#8HunkU=02s>Ejz1rX@PEC>W|@d^=$ z(6kq?1OHxIeO9*xfzUdi|KOtN(1?K`5>!H36loa&842Oz;5&2se?p>a&`)+yV@n%Q zUh%+ZAoK>-53fgL?7S*qGYuFuh3ruue^SKMbXj->Y#692-3ECdhU+$&xf1X8kp$=U2Q-$t(Bob_|e`K08SxZmVa$~L3EbfsN{cksgt0fhp}TF@rMnyO3@WNB;2CWmP}fhhaO zKhJc>{%Zm2Z-u|pFA=(E{$^Xa^eGXqzB+shjE7kPSLO^o5k z%sGt3=-7;FiMi>K+rK(gh4XkMK3d;S4a}3BHD9@1-R0F^G>^Nv^KNl(@jjf7=iJR> z`{=(CdPV*lL#U_fG;xjr^xS+!?mz*peEm;z2JU~{n%XjU!BhJC)4?18(F%%NkFBNY z->`COgBapI$OF$S<(&_y-O*^k@`Be^*4NHi{pVW6aYbPBVTH8(u9k$OS4--S(a0AZ zj(-{oIjzncmTst@$IyE+kCJ6^xs28zXHPj$ftm&Rz0|az@I1QTf3#cKXa5=K?|siC zp4qRc<&_he-);omB_wAQBF(sYs@ma!RCx+lLsX5ULOLEZci42!fG<_^@Yow*==zbt5$X){J^7$#{W6Ac#En zRAiO>^E#~gN4t(0aGPLaVF|s_?nJhbKo*|T_xhF1!9%W|quC?(9M0$Tv1?S$7Gx%< z$o1MqYKx-%Xe71Xio;nFu{u8Uth!!st}oDK2o9Ou(#_iddZK)iZOV65iW>epcZEC z_=X165EWOW!5Q7m)kR4F= zn$5+6N(d#AJ3{j#S*sjU*IJxju1_{f*UPB`2k z>0E;ftJ;~xcSneP$xK^<9kuf@#??C+M&K9{xPK;eO;i&1?8z8nON;yKPpAG6;F?5o zF$rg8U3hlzr1Z8yMvC-1ToctdP<;?)r}oyPDCU)`{+84LoY~rv4z(dCvt~sUDN`?F zKh^W+)eX*%4c|G9TVM1Vqq5=^(3R*okJwtlf*08 zGC#%_lB8;v(XW;F(+Buvk*%3Dd#_RnVu{fY#|78Nr^l-T4+Lpz?IMGTvW znYfH5YTmYquv7YP(Z&>>2E9y(Vtf8lQ{Qwk4ltTF35-@)?Z)~OPNZCo@FmZGF1YI9 z>l_Y{Vlzn(CGe4`Ab#zVO7X7RN=7j79O(Bj-2YosH{+*E&(3P+8140G2wu52oT? zFLrORF_;u)!33uYE20*`hgA&k+r3aegIL6Z{-mbRqn(#3K6$VXV-h9mM*F+cjvy*bVYF+HV>RZ$y<} zl*WW*G-<-=!stW1w~#6xhP{v$8lPn}#^%BpF3m)-5KuPab#Rqtu5HgRjZ{7N%QUj^ z;NRcq)AKUy*x+3o_7V+h@Uyz%rl0oT)opzRZ~s5*9Ej(?E8hR5RXqC7Cy;+bVosO- z=bQJSrDpu!Thl)};zRjw{k8i){o4!NOGoM?v2#-7;A3__>!6*$>;OS;G<0eZef#e; z^t6LBVFdrX8+=0=`9H7ozow-HES2z%I!9}c%VY?(0#8>R>97$cT|aeWvwCHoWN2D&obl^kDux+U`qdBQpL=s#L<3eCKjpLzft_Gg8j z&EMUk`&EVpS+&qFQDo$P2|IFUm>YA^eR5Gq`aRF!SgM4ZpD*O_bKV+7hrjCmSpF&Z za6rgT4~~2oKX*3dm5m7llWl7G{CZ<#TE13YaQ?z;Rg)&?XAVYt7g?(sSr1UP;=T%CU^Xfrtq}_s%G7orJkmIdE3)&r-E2mDD zJGJ|D44yZ=tP7s|zH0KcXvQmY$d>HM_>m*Y(bA{hqo)gjHV9ci*&UAi?9wO0nm@x& zCr4{nPuFLV4|lsEm(9QKo)S3MlJAm5uIpss<61)30$Z*yf5*KM@V+BGKVF~Pbv!k< zVuHHYg9o{%X@681Qju8Zscsf#U zZ0FB*F%JhPt}J-@a@Trm9^SPN->2uEX&)^Xo69~B%0*aWxg%dSE!+Iar?h_e71sJo z*$N~7Y!^~Hixi>*}s0?FAB{xhN1+KX!RC5O@E>308f`rQ0L(TZ4| zy}M&KvS!p;8PHo#ns(o#YL>DM_p8$UhM99Oczh1mCEvN^Ry^Ex1?Ac}WIi+e44=ky>cdByJ!OL=6t zH+x!Iv%K#tS>g0}L^|%R5TISZSw5GjY+kDmUSN1@m5Oii2A=CSnp3PydT^m}L1~P5 zdUbHkC$V%gYiYE~TkCgACw8bn2u$iJxm8!i@Qe($w|K(#c-?QAlv#3$8Z`599StR1z@9mp2XC>s>Sj;}uF@H2H5A zE)0s~mo#&tO;-exAL;Jb#mPX&pIl3=E`MEL!1k_7o>uCy@YL={Nt<`Xn@Lh02cJB1 znzvdy0~fC>PjX5;=$f~>hT$Jum|#WNt?%w%DH&xYTeSE?#f(>lK#AxI|qm@ z9_0(4U?5TeXZuUkN+tzA;5(Vi*w5u%E#E>){WZwi2gVN<`5)mQXG}d1ub%LO+vB>P zZg3V!?%y<5&?nr!YZQN=U%WXS#vSInG--4?dEaCy!JC_2ZZocn7 z9`;!FcDyl2=}z#tJG*`fYCMK(+;V9aTlWuXy4^ru(*)^VaOqsl>4MT-ua{Gn&)c5f z2n4`RHi!9;m>$=+L~krzF?HZEPabDvDI}gw_Y}vfPNW5{`5P_84Rwdd!oKtSGr8>w zd$$}*8Tu~;-aNJd4O6!O+X6&8p-<+3!AM1h#rt_cv9NNr)9!C@WeaGr2D8!=8pUf9O zeHf0UNd$4>)3Q1Rf;PS3sYLMfygy=M8q|?Ae!4q{%|H;jb*bhDSi2&(W;8~ z6(OL4)m^WP&IfLD|AbCG??F+&?aCQt3^R58QVo!~qDZbwAdPb~8tTI&PJVv78qv1t zJ7m5{KnI~%EEG0=nz%g;X2Rg&h!$I4hS~NZqA@x6I*~UY-g&&S^thWlxvXgcTRI<@ zo@Cdwye@G&NI1UaY{DyX8=pHdSbDPCLvg&NlXqD`I*C?6@pw{dLw|xt2z`R#Cf}}Z zd9^s=wA{C(tiCVd6+E_lqE4KA62I?zV(%Jud&uB=+FJ@}sXm)L@UthjQqM3Tm!T2PPhFE=mZ3CHtQK zqPycc?vG#hz@xA5S-KJ&<$1i$ak$2c=(kGH@o}X~cGd*T7VFg6H`zJ@8$b&Oyw0%? zl)L8_(u_!GBjuKB3$TXp>ij522(@rjI^Je_=X#7)~7BVrnR4+Plq^7F8i7yo26L;gqT~o=^H^&4HkV)z6IAJUsFK`3=>ik?S z2R78@a*9N%@7Io6N7H09)nP8?*0g4^I|Qor1h@RI*rk?#%X60=-rtWM=}@h`XgQaC z!hO6y3SO4=Abi>md_rq^@NErj)@d_%I=fndES)pn4>gsvE!`%NwU_W;{%G7d;{RFF zdUhO>a`(gaj*gM%tpyemml+ca3dT$ZUU-4nvL4YKu7Q6THB-XrXaN1BQMX{f@6lx` zvw3Ue{&~?iZcp+S@ze|buP9phDL%&MdQdNz28EUSh zZFpa;u!D3Smu-*3OPoMVNXK^QpimD)4ATYy@2RG>;gg}Km!K5b8hXI_hv7E)HB*r5 z`{v8GuP015w@4AEaG;bMEdJwOf#;3qL*pTOv!}r0{C9`x+Wxc7qr~NP2m3RfzJrI| zp4}$~o*^evzD`!zMw}}X44I<`%Rf4D_i(&Nf0;xbqcv?0nuv5=k73qF51M_L42E!? zE-g1%U*ja(8&153n{ck0ZcFg?>Zo|a!mjRSzDG$+Oa=wDOp2Sv2lH~e_>RbJ*1l9@ z=w?>N&HtgttRqy2$Xp8DFxEm6JAZN|Y(q9C6WNJ`uPmG0S4(6XH5NS>(b)F;r53V= z^3(t1ovKV}`&YAoY9jccn5~)mGqcYnB$e`7)>4yYs`#OEUZ4sI_#$(%grmO{+DB>4 zu>mAn+REV+buP(0%N7eSR#b;*qNip(yAYSkQL$?cT4eH?zW!t z^6jXX>f>#y8>)wdnDjF_^l>hzX;Gu|1^JS_Aa%ah=l$(_Tzc*0OE&xG2>pp~@vP3W zi>_sb?ik+#>+SWpWtUXTYsWT+1cIkcrnMZM3w75nQ}h!~JV1J|rogt6-HBxHhg#Z( z9hrP=d?CtxpTPaAuE^>_K)rZISQt zR3Z?J?1tvrV2+`j$3TVwKc zJ(9w7-!3ASx>;@DT}}}2ygLTu-?iv+!Wxs`J)jY4JaI(7E6Olh&_c18r=c#0TxCzHR zKuL$9w&HLaMqHBjX^&oKecagtcVmg^!lw%2qzSQ8wb%LUCZejS4UG3BdoVTYhZIkgMpDc# z;sk0QAHvOaVqX_|*!+xntmxR68W~+$5pW`ZybyQ-YdPFsuX*NSjmJbB&UM=l=&j9W6UyTTLNQJN2sPJS&_C*Ug{zV2Y2kKE1(b$=18dsloK zF^gpNr26E#6T^GBH)MTe%a6dz(y91#xSn6W$ijOZjZ%ntNw2p3UB{>L92d)0CJ$}!PlkwG&HrrX!NEt7z4iFAEXax2zOz5QDu26+(ZRU9&7l|XX>Rb7 zd-IG&dObGihwyn7NamgJ{W}eMUHpLWpV(n_G2B_agH-Xx9g$;H<~y{<^thX9kqukh z%<0_$r|UM(R=(PaCDKQ23eqRbH8Ua=`g*m7>*0SA{Cz#nT3oqx&dgJ~V8_ANbRL&1 z%fwH}kNXC#z!Rd20OEaIyjl}@=yY^oUZO;vOsBor?kh(OETj~ z5S;5g)R>MSZJ%Tt-LKTYL}wls&qcMpWVQY?c&pH&^MBSIiP8&5thXSY{th9$-BNNZ0wtxv&IjeDxc zS9>*bj0(NtWDhTOPI{yyhqVJU9$NdG@mBByE%_JE=D!~UDrMD`)0SNPuKHaw4LKvh z?>`A$2G_?f0@dU{E?&5j)|>%`zrAP{=>u*|7V`@|!Dx0`ZxrV~tU`M4$antUB?jrh2)MH)Z;&v%MpkG4QT z&fCe8@To_Xdz45>pX$agrn$oMkiRkZKg6}5lri1SrG@7oNhv+c1Ozl+4vCqW;4!Ueyt3{r6J;k3hrmki-A_Bjvw*VneCvOr)FNW*6r$~i*E-J9aHMxqF zL&B_nI+&{AKz;drv<+>?TD>5Lt(R`sZsxupi?BZpZwv3Bt)Mqd3*8bAAm-R786=7C zbzI%m@-m52vPe@$p()6{Lv(X4Qf^xN0=`FpM~l&DvGw4B|^ zc10XE-!Tu2Y~gCY$XWhwb5*U<2{!_})Mz3Ky_&%Vi0G2<5pbX<4)z+PhW!3REQGUv z?pE7`ymW$Q^gYBrV*!z>Vje6Cf@!Bt?R^X7sfTh>hzq9mq3pnAgL8QQb)z>0W5ZBAIH7NYPTb7eNVW*cC#-=9qN+m*1G7}cy`eGqJQ?2m@4)Pjo)S@Ah{&9cf|V=HY&4B;34jhkui1Lx`u>%-$G{NYp!l` z3}dRU{+g4o52edv51(zYXdgd)O-XGRgTvsUibH`T;j;{-bfLa8A2+p-t3@EY`30+% zh_-TWBqL49ev+haf5?b9-aqG>50y4)zFxr6|Zl;@1W-O6aMdiMVLm5F1c z2aaUUnh=n6s5~5Bd$7`#bZ~A=ne?#7A_XV?w#NKUEiTmEIN)DslOWTv_VA#kdD^m8 zo#X?P5F^)}52=XAV3U2k!n^IQ%u*stPpowQpxqplXhx{L@eKmu?mL%OiBWb_Ojng~ z5I3RDI*1GMXbAHwoC4lI;OKv0r8GkzWWmf$98*TV0^G71>Ky9TC;ZZx zuZ$b+s?&=4Ikqi^5Sl9TDDLt$!iES23iE{6v$$KS{`o&l1@p)2T$(;+WUL!0k#nVA zw1Hdah5%_a)IG6DB?&uf{JCldhF#r_HI$#42 zwqAA;7?!btr#Eq=vJ-zVb1`=c8yfB*3Pyvbc04!8G<|quxYNGF0uXma#xzn8zLT9*iH<%ST&kBw zHVr~mH_5nZsh(FxAj}7IaFL^qF`W#^Ob6)?uH51&)FTg z~D>F2_i9af%ajWW#fkonnA@@%!X;l8I{?+zQlMUVdRb=@wFa#5>JnooCV z)HrJ9Z{Y0yp1xT=!FO*FPYv>gWHT;~Mh``u%}rNAUMYI-z@17^q5-#Ms*;;&U1k$- zSe#uQt?@_OpSwThB99T;X*bSo=Rf#6x<5^@sf%-nw&DOcJhrkQm)n8MpZ(%(to~2u z?&uFl=F=2Ntd-W&2pEx3d-^}VtX!}gV|>z|Krbm$Z?LOOOEqOn4dI<&7VJ2dN=)Al z(c%dsx>hgik=)v?_e+nLK!8&T%pSSHO+08F)u%_jZjQdMuIY37^bk3PCeB&P=IXZ# z5Xbo0;h0!X4Y|@6=`<1=O;EU*>RVGWe=3dTZRSFa!{7&$$|{4H<^wXWhClIt5kz|8+c#g#!WQP^QTx;4 z4Rfdm9kO0^8ZoU%&zJdcwB_1z^~_?l^Ywui=W~f0eFvso`*qApxKy4pTh0`-4NoD} zlS1Fk+DRNnXs_A6zV4ci)OqVqI)^*{&Y7Osv#Ekpq03<0i@^=An^^y?KzuFbRzG*V zMDDv*v+}_lRmR+u-Py84sjzT8AF~UC9R^+WXl}8bEYVOZ7&9xAQ9Xfps9L0kFg=U^ z?E3WR%UaP$CW@JfNk3z)(N|j@I~|Xj*i4wuvNKV+75f$*urif9_>?n7sJ8gm2iUdALy;r%%Xh( z@58@dfLj_VV6zsIJ)|tXEQ|ShIMS`a{)hjhWfAsGV+o0#U0cCQ8WUzr`#;_3mz(XC_oWBsKiB$n{IW zyRtLc?I6|a@Z?!GP`BB_4*g!RnW1Z_SjF$EwxcD4RE6rG#-~r< zlYr%RJ}SG68``+8(j)wzyi^B|zzyTV&!m4;;h#B_{|RyV|5uo{qLCbcLW+fyGX(nK zUm(?Qm}~!h=AnBrU;Ju5;SFPb)KztYzQH%3s0AMZoE=}1hbPbK%`VV+z=-vp~ zo+S9}F)t=09_8ovgE6xpouvg@66pnLsSuKMh2LO^9KhZQu<-X2P^mg2t{xauSP%A?%8p)Z!rgv9ouT_O^Kfo~Rvd){ZhPuOxl3(^4Gqk3Wv1S#k zdaD|Vj-#yYQOl2gO{d;sHW*HfQ~muEzsKu3m%0rpab7wyhOonRLwLT5bf{s(%&(}r zGkn9$jUB5O`mYix->E5te9yxCeeG&?&WF;i7gDBsbp60Y_`re_deu)u}1@b$9s={DH2VlB~HN$ zE>x23O@cEo@{0@FoxRQ*x`U-xSw7v48rvvNT8JTN{pG1*Zb|;0unT8AC`T5!L|*pz-hjpmswU&g%b3&Y6FDa0 zR-zT14#qv3@E?z=HfYjHFtdF$su~FixZFC^?FqrKsll*l6MtMTGY=O{^rjZSTX}50 zhVXEsbW}tfZ(p;;(DSI+9G*K0%!h^~C6V}l{J0g`zCN;JO%tB%0~4oS+3A%(*X#*f z=i|dOq`Ck^;~i|pM8o*7F&DyAO~YCAw7;JFhv^OAd0C4%rl&TIo6mvW)$t4gYE+H! z=1Jet-i9POapUw^!iuLeN(ir5+t3&Iesv4iGJL@KYfVYZcrHpw4)U zA!o1lEc%SIOz4%ZO{OzHgc~h1)H`{NpQk@4&y0Jo+a$Z`JN3$_`@D}@^6BFsE*9z0 z(f3=mNz;#yt2{P4tL}55b4*!bcJYyMI~h=tES~<*oUbjBJ9cMWF?|x>cu_;IrlQDv za$p;_qLNl!{1^w)W&@AzJ8IMOi>^B4;&s6@sKj@>T$bXit~Q!ubxQn?hI177Ofz@) zH^>bUeZ>7LEHbCI{Bix_2oS6-2qU=vuGh7se)HQ<5+Kb@yGLev<#{Zz6M$~EQ_?fd z-!~1ukpmw(K1m)we@Kf2vhQdf_up!hxSI(gFz(d7x(wfQsO zMg%{APxn$1-)Ld52+1tnfo7FfvM7v>xAh14J8M8AvcuF0Ux0{iyRkOM{*XG@>vdk3 zGC=VP&WpL#^hZsyMicIDB!|jGh>_&W0O=?V;?fn9C;S(~uDWK-ld1%wX+(v7A1(_@ zM+EXP1VLrI=;cn8c$0|vHqO%poEZitFFQzv%XmwMk^pc`9~|&Xo@j>!(Ux8XF0$Ca zo=)`q^oH)XRg+;PPpJ>FuK$)?HFUDi^h?_(7q2{gz3RfXQiLx?aE%`(&rwU=6Qf61 z(qY3c7z=WfEjM3?Zky4UUhW6v%BB~by&vHh-^&WrU%_68+*p!_)4#AVNJ<}azxWJW{ zIvYay0l8Y**ia;01)4O z`&J*T$DGL4_j4zAMW*_&>iW#iTtO6NRn{pnKe8GhBt+&r9Z9do5%vKe-Rm0rozKg9 zFBJ=)Y+d|U4E5^`q5~s+K zZ`nwe@6&Up9lNwb>ivuFFJserYhupn>xIdhm)hBEuvmd#Pq2VJ9A(gZgK^JSi*KpxojGc0F9HF)*GUR|P=3!*KF{~9Ni?oTmTomaX%vP_B>#ynRfX)k=6U){O zEN*pgYg7tX#;|gYi?07EBBYl1vrf`~!{Mz;AwnO+Y|9v{|1RhW7bb@W_=dbus4+O1 z2a^+KE7Gj~px8Sm&-yqn(s4s}rD4W}JGDQ}EhLXLZuTZ~W2%;Zv73vw95DR+^n1Q( zUPD|n5AI~4jt>)-S*1-CRHVZ-dW#rs{Y@=+%Ag@PLEBgxo>|e??JErPTkDXT0IC~t zuXgS3DEal6#1f8M{q0V{7;AF3~uc2pDtiXWe8Q8tHNiy0CPYXTN&T4-##Y zh`P(xDj}@IBZ|9d^Olsl<0P*j{o6W*!D+d%hV}JLHMImzpBj;=?$;=ok@GQdoT`tqHbTVj*J-AVWOiRp4>+qTsjYFiA)ArK z;r#1<%k#dZFr(gh$6JO$?I}^2{0B1i})1kl;)Mr*v_5~)? zi#mO~H$l2v2CfrKc^T3?UP6ay1F5Bc(_y8U4)~N_H?D@o%p*G$hk-))h0JRY(**&O zWA>^#ZFZ67gJ>cI6+ODSU4LaW62qoIZHwBrg9sphoPpO7ze{(%0UFBqaMkZW(67N8 z^FO50g5`f~W##M~MO)sExfZj)O;)}Z+yDD|dHem6I3OJ$Plq{31*eeKhJ2eQGl`=4er!QygAX)zv|JE(#N`qV zEwtH3v?{#TYBb$1x=D6i-kx*Y;!ltYuUU1CduR!M8Ddv3SFK3QF%*|6fnHH%!|VF!_2K-C(NTf#zmJf&ICuO#ft zwl~>^HGDff9WP zM;kp}dz5VNf;n7xWI0*4N z282SV^;7tPBwTNF?-@J3cCfj_OylsprwW&t2|qaF+iJfpO;vAlR)=-r{=7o{wgc|V z5Hwp}ro&jGvOZm@b?zd-cNW&T-mANaw^gN7yQrisPIt~Ua~u>LX&7Ng-J6kv+`lbQ zWqD(2d~=Z(2{2g0^7UK#=F7d1h)gpd*6xy#uD6*MbG93k&a70WPc!CCtG z6n1lJC~+%wAKnE7S&P%({Yr0se2z<1hh7vxIM$IV&fR z?vAcRfQ1n+nFQ=j{ry?};eb&(j{o&QZ}Q;nta?aE$qWHH63~|Frb(@P}T%uP)a z?odi%?~zNyRMIiU6vEgyNVlAeq5A>1vJtkpYZPG>`NQM(Jr_zLqXV(I$#lOdDXY`W zhDc(9(i#uA`UZxdA*+YLEu=X9=KD&oHJdMMbzxzM@sRSs-Mtn~WK=KproP$MxD&(N zpwgjPe65?|S^m9-Li7>60d`2oIIX5uKF5x;!q>A3i42>M9QS~!J9KYgqgShc%oc#P zb*Ab{Th?YZlC#>gIc4-G*PrLK8dajSIAub!cxN6Z3&Q7ABMU|xh|OHG!C41PbW-I_ zP75(N7=(2j`TejhKz;58QgXEH@@QJS^(GedVfWivdq@X0g>!4I;^S-uxE|!!GU9cs zRt-m9I(dg6H_Mm3IjJy4VQl9SaN?8_kLM%#0ZL7!N~TzLB^2EQypk-fj!ru9%6r6W zL>mtH8U=t300CyNgI^57Phf)4qye3#I+f^bB_o?0gE!2&h40kI%2TUGBtqa{0jXKQ zliEOG+t`|adbv#^RcVc(nhlu9-uJO%$&Z+L{(aXRp_mqLK>rap*?@3iAuk`qbI;{n5)RPfB$48?e6;%}s)DxEKEyeidzj)bSMXqU@`N&B;=EznCuZnH3O zsxgRUYAdJZQ+3<4r2l9%-X@lcl@gw{efGJ5k%k!(iaKO$FLPDP8Xgo= z>F|7Y=#CYWUsp*xY$D`?%Pe^}vpx z4R4k7HmL(aviL|aza@V!eau_kA&VL%<~WWL&v0mZ$SomKvs%ohB)RxZ(=wI)9B^a4 zp1y$@YM=!7z8S*F6J`yK0_#=PQmMZ{qKI8hoQpuLU*~oCN0iQ}{xD{9v0D51U}rjX zB^NWriNN{=L*VNi9zvBEHXl$lb2-{Wx+}f&bNjBH{G7hlj@VAsnS_#%%#ueegDR>* z6^V*9GhN2>wu^FMK4ki>WicxYv<>;@5O3xu7dF*d`0nP;dQiXe4^%dnzk4-(ut22# zqK@K*F@t>ewY8saIx0B|rh17qeH~D(u(&_8mHa_j!6udA3Ohueac-H1>WEYa9Z4l6 z03>6!V@_b}^mZI!q<##l9zCR(_yf6e6gJRHv$QVWSEQ3m>(bPS*3h9+KCk3hJ>d^tT6ke^bnI^| zPcq6Vwl4ZoypT*`gncfy)8QIWfQuj+Bx9z@5-+L4MX9Nj4~d zf(;W}Loz;=R^Y>Bp;Yim%o@@MCkivwn06%Gjd~96iS5mKe&|(K&awAfY^OiKC(kGE zQ&rBr#0nnsyL>n5&tlTCPaAfoPq{|kGE~f^12CMx`Wf$NTcvy$Y?EIVZB|Xhv{DL| zJMV6XtgpXuvHIIg3}R-$5@M;yey(kzmA{&mR(=um!34@tMi+D2?&*Vvn5U@Aa>RNz ztBnJe&qB$-6p*eg3!-XPGbJ51g_kmDz(1@~$*}oXbdP#B_`SytYi`RV6Sk?7wMnaC>ZX(t|>MT9i}B~A!+&Pt4=Nv zX$0RBnUhQ1Sm#wUJXCREg*sm#|7ySBi)lHprzwJQ=%*H#t*{zGBh4+BVhsJxD@JST z`2Tfc7%z|>uA@;~rH1|>(1Fcud%>I9dp<5a+{7XSeDPJ)3hHC|3v$i?z@G`fx$xNa zp&U0E!OgCg_50Q&;CS)`Hey{zueEXy@feZ(LL^6DG#4+{f)R8$`30f{MpfBQJU8u=O2@izMZ;b#*Lw0zc(#7Z_+WpyM;icj z_cF?0ba#%Pj_tc*T^hQg$G4mEW%8&VF%u?p+NP~TbWx;tX1t%fJ}@pK>-UIj0`aQd zBKz*yYc*nz+?vADzwfAl(K1k>_r#T|KYe%7k*1cK9-|I15^~~w9;2x32vutYyfO@w zh|^2V=c4z1J)bk`0$)E1E^(c;&wp_2s(9Bk0+N;IqurRvs2hskZ}FkjuTdJlhvOWU zq^Or+p)H;uB8b`VPu$FZczU z@W-)nL`t{R(CGI(0T)btA0ns$Y8f51oduQIMoSF04wIl3SO|y4Ce5WU@kY)inNe~F zyT=T<TX9&}+K`L(5 zhm3YEbM(OV?Dx_x7KE#LUO*W`2Jz1uP=EAuO@wA`Ttc218Islh`!~Al4twLquY(HL z_-}=YlZ?=dTihLnZ_?3Ni69#`G2}I(`BQ4|NQtcLEL>i6$iS|@;Q=mV7ZZ^K2lM9z6(`*SG-P(lz z5Mmp-c{yd1AS{SHxfz?T6J{VRk)^xnu)vVlfIQon-+AQTT&vgNUg_VIINAT}7nc?6Gi znVD4CWiG3Cq$lzEIg3-*ze5lfQLQSD4SL?Ytr<)q0QOty{J_ozdJDiye~J#|da)c{ z11Jlde&FYoALQu``N+!bEINgq215cPX0@I@SG+aYTLLJ}+IuvO_g6v^ltTo1qELvHIvRgJVuAr%&RWyibdt)h={lq5rMag91GA154pJXGXaHku{bB9>GYSwJ(74~6 z4F1Oby%~WC3Z{PB#Z01EQe%wSXh!|^>ja(qX=v7PvRyPxB_oGb#$0BydUH~hthmTI zOY_IM>h|`N5fK8<5brWS90^T~IikmO6i!jjG^mV2uTdhI<|n~kNeQlSxVYtzO(pC>mx;W?`v~s_uqVAptnZ ztevXk3`|xTeVWl**asQWF-vM_xh!|A(7ak?e`YG=eC3Ye%hW*Gz{eszpI#Es zi&wbfmPGX5nNC^<{tf&tNU*}+sJI3sxHlJ@PpibrXz5n6aaU_Olq&8< z(62aQjbG%0ES!|Og_h;cL@YeltL-z%*;#J{62#_nh~0ZC--PN9L34%R1Ytf)OUxW} z>*E@zxjq3B!@=ipf_ojw`4Tt4_fA7Jt9QXxeg)=`ii*q>nZme01F=DpE;y-hPhZM# zNbAc)(th;JARbi+LNn8aYm}!{!8d|{uhN51csEDTMkl+8TVA3fuE2I!|VP(;@9Yd9We_a28%rqe99m_RK+i!RH$5#Wc!M`y*8v{etR32GDKyL7JsEc#nv}&)dys5fBW4CpbS?g7*u4Ld|?LTI8Ws;L+KS?K{XdiSFjll2k~e zh|7Cwy@u+-Pdi_0Pbv%>#zd2)c;c0ZHiDr%w)3w)>I9e`_6KX(1TC)I<~$o49ay|F zI&4-M{5eI8ei2dyPbkxu|JMtEcUy#rm~rpT;F*y?Fbo`>b0hsM#63p6ng7{BC!(_b z_weu?V6>b4nGqSv$x#y#!Fm#CW#2zJkd&4A(^m5ji-nIHYkbQ7)^8-={GE_MMDvd( z>9Ts+{?6r0{>Hc6p>1-j)C7aFs>;K+xyDlEUC?F0n#9cguaS&)ehM>ZVJ%AdCS)R~ zly==tHg12oG!^bBxj$~?oe=a~SvD>-{^{_)Q*^*+{bl$jonh3lE)X_uof^%r9ySa+ z-LO+2kU9o7_{a|zzcz4Tpvj(Bpo;lxh9U|&M~z404;Sh)_oaF}CuOP3jD66zF_zrn z2KDxb-|nzLDsk@p(GAT^qT2O_{^#|--uBFaZxA{D#vF1H`g&CTo%WA2+;oj|udaq~ zcsKtu^uEntj*%Wz6G#~09xP&*^aeFb(5?*PB6!uELS=>| z4JGHa6)XsVoS}Fc#s=PATtsBp?Oa`&9AJ zkW$HQp_=U`v9x|$De3cX#H!PGm|6~U4(GGMB5crR6!bCqEos^l~n529^OC(hdE>P z=^b&W$kG8BzTKd+T88abzv#YwWzOu+#U;4vo&>TXg-q5uBNFcP2x<(Q1O)QuVdPnZ4pf`)dt!<@44%Z7y-sah8tbXxPR6g#NR7{ZiqxRE5xCr~bAJPnCk*rtS*EEK zDn9HNxSPC^upSP3J=IU<{}g6}ECWP`y^sD6;@&bU%Jyyh9=c1qK_sL>>8?RVT3T{w z7`hulngNuM4new08bKHYq`ML6?uPe->-sQg`+BrkZHJm))adamU}t1guGCe=7l| zUf(Yjj(KLq$30d^`29?hzFf27$YHozgo0#0-gft)yx($i@}(w1J}^?$Q(c@cbWWUn zZO)GHKx-zIuilp=O%9#=UN9L&zSWBkbc&A<{uGi8J820u;{QPf62%(TjEC>V$LoQU zaanu+g+G;k;qGjrHW8Zf{x$>xIaw32c7I!*ciW5_1|RWMrBhGgJSZ%Gr@_CH); z{s1Vd9i;|M1*gWHZzrT1T}eNt_tgTmU*Hj64)2Jr2H|U2g`VM$(;3fH8?gM%Bt>Ms zc_p8Sv&B8vAGJaZacIVyi8PINV~q#|Q=wD?8WVyfplXc`bw4YtXB;s=Cif{Y9crp@-2HjY~nNr_1V>z`0-CU zR9P)7Iu>lSgQvBXFC%cbpVByUlKkdPCxWXzX-S+|VTv<_d^pS2@HXFUMp?>3^j z-D*GEf6weq_}}{b_y5Cb0RPho0gtaeBq&2D_#G9sWEXFl#}k62QdH# zGdLwxYj+Wt;Eg&W@s);vtCM7FeEq}9szSZ0kwk>nzP5Fh^?17)@kSrkDF&yqd--*336?zsPWyE zw3CxzHaJ!!$-9FaTYyowK2+qNnTSD600RB*vljoK%LRZ&{~kBt{^H?$pKPGe?JHJV z58tuyoV4TsTvss)(h!Zm!_n~SXO<)mM$WiT$ay7r4d1|oPt%6i*q+L zo^U)FR$^A7l>aLFK#bxVstUB96!yt>QT^kJV<3z>G9pLnhnq9a2vt`R+`iOhlS5Hp zXwh_8_`sYO{n;x~cS!z{Fj$Avp5hi5!cQbze?6-V{LSFmAAxlr`$tl}ts<^J^ z$r)=jNun&;s@u2qRdfhv)s9XBWcF0yoBm~(`%=69$x@=wRvu&^C{M5A}x`pSGJnG%v=X2ea~8MSr#;GdJPN=Q=g zy?hd#h}zz1ITVoIb}07|M-6ufw$rz2nbWG}$CNJ8Wm#Kc7HBHrcKvs3h*ip zk3;_t5h@D;(XiL!3b2l9!-7BCup7(5Z~RE-v!j)&(I%6qadCX>L(SnK`|@#(|AlB8 z;3EJXw0mbBjwBEg`x`h#CZ$)1xWnf5d-`EzbDFLkrSte((CGQ{EDko924Ap(u%)p; z`PlR2$yedI1w?f&b$p*iFogRF?&mSu2jHTk#eC^A#a#_+v5-^!yW=^?Tk$f-?Mm(4 zSap_?-ZVt-EYhN(01km`GeMqx8y05?7r(pTNpFD__kZrr)VebKXog|Mh^}e*SxPBQ z_Zf^DTeUBnE6^yGkn_hh-BV^lLTsluCUHBsO@YH@!KS~V6;j8y#@=gDgYdL6Y z7cJmlYL4Y7sn1@#bY&!@qZH~asCkCXU4F%QYBzJjwkyhByiZx*qiZ7W(YE}j;()D9 zhia~Ou}R$A&eyhvan6ZzCHP$>0bK7bXV2ynuod+I=X#R;mfoV&?S4{mu1MI^irV@(R@x+g&0Ato9y4z)8;6p{ zG6Y%@W2 zl|nzXfa=PzEz+A#x*2~6i5W9Tye*=xIROQ{^rppk`LSN}=ezhvUB7N*Ol$8%-&7Xe zQ=QBrxmiQ2bz>dh#qV+x4gpsg2$3`RUpN9rOvPxovo&0~el@(};R?B!b5}ugWw39b zXZ&Evj#mnSvK^G)GOaRqNCItWD^IuueM*d}Ef>BpVrW+p;Y$)7AxejI{Hu4n?+=(% z9NH_JXPD%vvW)&>>~mic71b5;&Nw#1XVRo`{QmMB3-Yo-k@nDN>6vK^BCvgT>`f1H z{NpkR^Lp-ZO`{N=Ehr=eo(XgstJ4?o(fm5(P8+sEeq~G~37yk-1^#vc9u1@uNIK(t zN(YHk8F^}TjpB?iKON_Adr!zo3dJg-ma%;7g3D`;wR(BiS>1B>%L!2g$3of<1BO?L zlP=Pz2%TNgc#b+}^xA@Epy#)${Iy#W>DD>rl`)W?#~b-KuTCg#cz_{3AH643c+AMm zNP!$NmXx$l2@iShj@(8Kv~8s`v~*Fl;qslI#!$AQ!`lF9qmdqft2>y z3_lLd(-mz$zGu^8LG*9yo`^OL(c=&HurVp4!0$$&Yo&NN=eBm*N0WEk49x)}A~ z{<>QzVF3AJq9Z`iBuBH1>0S4?Jmo$bPuon%7gyO#FS?D6bf{K*Z3}isXubKXNGpPa ztVGceDZwgN`H@{ex|M`q%njb_p7dQX4<6s>X5U|B-go-nT({j~`~G9H&uq6?WI9H% z&%R9mPQ?75LCH(OD~gYUE}zs5D=q2BQTNG=JXbd}C&bgFpFMhV zS-&#wT3llzlc8$QOf9_1gO#x^xub->W8OlqpOU=XEd&p;cs(6%@#FB#d~cN;?GwC2 z>ZKY&?lho$R}w9*N+7Je=iDV0R-0_(!Vv8PJIqLt-A1|2%cH6KR?rYmtCXr+?eBew zR_QC>)!f$K7`2Q^c97mfdjZslNBYB)_(dNfRUu`}g63Ey6ZBL_4l86#bV!`c!Jg3K zgTG-xTTd5~3Rjmo%090k6j6R=I#f59zm8W?)G$Rv!KOm-c zgv|aWAMpb>_GXYA^Z`C%$VfBumiK>e59Uz~|U zA&9|Tf-EmKfUxakfbyPuUHhBGdwr&oa$~l;aqNQDy6lVel5Mqj2x;!C=pqHS8`ISOmokfW+k*`5HynuC^uH$ zamrU7$Lo2?W0=U?YunVm7yoCDGFDif%Z)kr7BNUz!5hg&FL1HPAyqH%?U*t$I{kTI zAW&cUSo9NMg6fr5j3A6BCSny$BP)67 zy~a@G0z7O*D2F%92KfjGlj&PuSSS+hq69hbpo(vadQv}7ZfvRzeTt)U6r4Bz_JjW$ z>xTmJU!e{;p4rurtCqj@%tFEtL9dotKyFkFu-l2>Qm>z4(ZL`WGALjd&RrbeXkRLZ z4Ee54q=d7AU|S^4Nx;f4@ZAL{v|IUv%_G>7BsV}tCfi_cY$Se=CFO-TVLLLVVLP|& zLlhe(`Rq~g6PFpJ-5BOd_^UgV8+&Rf%c>pGNhfIP*M{3>_s}weU^^d$t0Jhvu?Cxr zzo=@qHu@u@(GEzmvwIODrq@o48r38BzKnKr6EV0;n8cSOi{c|TG<=n#aGR%}WA2rC zxtY3nd`$(xOUsmqLt+7@wIT##DpQGG*_MW)-6+OH1<(-B$AH*3T6MufNxnk1OISwC z*gGIgjlgYT8%kR57l9TSJ;pj6(XPQT1QF015#|g=-@ixYN*MICe=|h~k8M73K2qhs z=S(ixvd0&_sUmx_e|~r+o7}Te01LVm@m_x61~|q}3y57W{s{oQ$9iUQ_lVMHA#cZ} z&28$jt1#%>u+9HH!u0Z4(jU`1GC(l+-{aPQ{q!O45{r;ibb%Qef(H&@G1<-y3w#kA z3s`1<_kcq|=oo{KnRg7ncvNt1kPCNp3rkoJF5)-*zRqX!7x8}o^spqOly&i8ESFEV=>0#3wE)p>w z8r}BKV@k{#RA;ny-*NdG);HYB?OV1X$pjwQ4{{xg5zcyG5nfzSU16qoqHlJ~-=q$T zpgzPHtpgY~CR05TPC6^rp6u^Vuw!$7`!CySEgE-e&mXl&X>QWyDZN+@8;@bn&P^=P zg0I?yo~p9*d4=)IDl@n_rCEbC+z+hKds1ZU$C01BoOF7%%h%VlCVYgtJ)V57m+`cw zx_w3GI^#DbME#WQ&`3zhI7T`t@lI}H%o(+NFc6a92A!%Ib%z(md`zz_2pR?7b_;#| z+V{nOyi-f`(lQ!~IJkAvL@z(np!3bMMC?vUd#1m*SI=PNY`DY1yKxdpJw|2}*Pzfl zJ+BOEw9H89g0?h8otk}D3tjOrbI`k1_D;K=Ui(?SB&bvh$ThQ>3@mmTEil7`y4}I- z8GA}+eitJlT=vcYLW9YMPsW}HjXL*h=Wj1t)GzIH>Xw_*FUQCB_XIRAac*=iSw_doDBa7R@TNmin8^Lmq#> zzFD)yjAMBnI)87!l35R*fyIbp<%GFrEsK)q$^4ws#Jz+7;5V};mQSDidw3-{^|@jB z(qt~q?AFfs^<`#e9M{8|C-bE<%QA4L=OGELdC(MB?<@Bcn_e3jq}p)xa5CSkgc8~; zF4j}EdI(>?;qd>RNn#;iJq0W!L=xUDWkvU}*ovTnR;QCre_Pb7?c zA=}3(sBajiRk4!(bLU$En>xc)6_Lc11Q>!ci-ROjdG?T$TiFg)n|T*(~# zP^I!Q)j389W-##DX=A0N#c{5)Xd!+%HggnAm}ckNlnnHkCx_wB23GEaBlqBOai;){rJ+x(+5!w=o!8gtzK63k~}4J z1v~ZtcXOP_C_$(;h_LFs%#I~`RF`+CE(w;s46P)Jl@b0i6q^Dhlc*AeGTs8jCUt0N z9!nz6TOvy_G1q<)nbsHF{6NyPLQ|cl?-KHq4{>S+IoC=V>T)R1Cdc-5#1hICi*KuI z3}j4YHEy?Qey4B`LgtPs)~Lgw^2qE27;E*iENFP!MCxZ_Z? z*5hlG1r$C0C`_o36wWImYy9yT`>$DoCDOAOU0(Yap_6hc#VA!@Ls_8j>FmMqcjFa@ zD{nGy8`*LRkV6O%T`_%gK%o#a?E3!8wFCv< zQ=aM_xyQuz=DGHEz`J?^M3?SwTa$`j>04PZg#HZafpZ~6s9_X+IysVECqWR19pq;v z&Uf4ndOg^M*5{#cZmzBGef0Ax6#2w-wYv#fGz&AN3)Q3YUJUkX&~|7k*JBnuoDKb* zcU_j4fdLE6K11sUXG)LrAF$2tR!%Uh(Ale)4I_zJ$oRU$%E?t8!$Y(W>LBjQ znG5_71j=?No#2Qyk`5jtG8~=lIPhP6v4@ zW##4+luM1i!#)QE2%%xqV);w3`#~Yb7_VH-XzT5sy+{LPL6`Ow=?=SfEwkuPaeC}t z>j+CXzZ{=#42yCjC&aLe!<95Y!m{|>`VBHty&C4v_l3pE)nN2x!Eu?Lf{;>lW&GV# z4QYi7#MTug{gEDfhvKMv$O7woM*u;CgE6VI{7jB2rg~To6ek6h9gI>&|L!Ym(|cTt znrjHshO{{Ob76F#S8AM2T0PnhlJyl6mG4MmJ2fvA`U?j0?ag$<7m&qI6l|S8MjH-% zWkj9Jofe!pL)0`*8j)~$CWuRtiI{Uhs2IdA?q%2^;hC{MiK#!+`7pG5DM(Mn&~ejA zzM}VPNr&sp-ah>`)@xC1PNVzadZu95$KxXZ7t(j{ITyM88G!1#hi>mk|B&x}#OLIP z9^**;wJ4T}d&fw$|18#eOPn&r)(#_m{g96|3KYrzTCs)s&?sEL_T`%LU768C@Oenu z%1+Of)?)sZhZ~Tv|IPdV%he5tJ}o=_`0mvfH3m*+z_QQZuC~SCp+HyH>!I>b>Fw2N zcr6B=k{k9b{@IWv{v?cLGKrae+T6M65y!oPzFmm=-q=R)?%+AyVM)_3nh)jYfFLRT zCPGoe6n~>bp`X^{{Dk&MeBV&cNw!Yg*mm)&1dg-!HrvKq+ZDrYf?tQA@#s}B@2p`F z=3iJc>)iJ#x?ijki@Nhcr@UQ$*WLrX55>!0%FiAoROLMeNcS;)H#$Ia{n2{2rx)%P`J!lpV(oKT) zw7zLT@kAVC-6oxGL%3~%2E*F-h}!o~RcC%W3!jzm%+q|<6p7|dOsc7J{vBm))oHV` z6P(VUBi*GW!T~<15iO_qdgt-dG%4QzSH;{5-sfjl->(lVCn<+_25w%InL z_E9rNT0RoN5Fv+>BkfXWg~dRgt!uj%pCw*e{PirSYWh)ffOa)boir3Um5x7!%Fb2d zVl{j1TEVEBaFRybP%sVyl}J*4-ITA zzf>%?CZr88p-&~d^j@M|Zn=@_~?YFHd=P5Uft;ZzzkKO6d*!o1h zvDOb=f7|KqZ8pQ-SZLVdXtkxiJyLgGdxtyiZEG7sK9YUfkTThIh>$tZv>LKzTnww( z7@8`DT*(p*cr)DlJV1$SlR zhN}o_PWCAJTQT4xX(O5D2ac&b~L9ve`n-P?{K~fS5G2j{i_Q} zp?Mx7g|&&$J}277MY2$6{1vRk!^?;a^(Uv~*&PfUtDi!_|C95~C#!*^S6Iv~Yu7`V zIzS4&BqwC)IanB~kO2EGQtv3(46xHj@F@_=ZBH!)-EP79P;}2)rxxkGW1{y}G}Z{Y86@HJF*!dO@m4bplgpZyTx7)+h&<}smk@U~IeTH+{VYoF^5 zGeZfMY1~jRka~v_V*Kp9Xd<7rCYq}cK&!V`TXpMKx{~uPbivpziFWTN7gK=SIoDl? zJMiW@R4Ld~b+Pnmd|A3n$vFUGVLeB&?LXg(EitNb3z)@Hw3s@*?&eq#HL3O!;p_Cm zC3k%5_5o5?VD~aN<+bl#j)>b0dlX%sQkJE{cSkWLJ!eD|G%Cv8ZFOR)-CXpqpskbQ zdY=8+vehPtuhl?u$y5~Na<8posuQv9RMq&FyDeUUZ7Zk z$V=v54s`NUTIZX-8swqGg~?xh2pZ|BDTlJ-=1?rY-Ql_e)o#*)gQbgLwWaU)6Q)h6 zZM*}6EKAJz>m7`>R{pYyw_XXjh|RkC)=ww>5OR(-94&9f)qhw#UnhvB!UyJPpe8ta zhqK!QBH~a_jI60G6hXJu*kQ!4dlE2N1}t}#EmtNI^EHATzfS#FTtYF z(gpS-3d2c0-A7yeDcwp7^tP>!&S(KC)XAo!Uk4*yTz-)ho7s?-`)fO{o<*z&_Vkb^ zeLg8T@=pHC^qkPh{%@`>Wq@ohqxS)b7W){FtGhcGhQd{N$KuA0z5LQ$k8PmVoiARh zbcL*inrJ(HzqiV=kG)r*Pl!I?XOPD3Gp&sTkBTBF;kKmkA-kY~jzJ<0b>RH-0yo_f zH^rA^K7`VK%HNG~fHn*oOfV81^L=JrICzEaV1-OLV8{{Q1ceT?#`6c-)Y!VfU_g3W z!tjaDp~i>BFY5b~&GsJTKi2Rs$QiEf9Wj-Y^hmaoo&7XgF9an4oC6#``csc~y=G2> zJ9x!@3GTnL7ZDsQf%2GO?K|hBO>^Qj#2LhP=^|{asdELHK@~rJEG@cNub}{8@_>u* zvUA(WHvbaps?ums2WJ`wV(*iVy^nYrmccS~mENvtieFkH418{beb0ivW$~3rNz7 zGx1w9gUB*)I>#Tu5FAom00T+;$^65Cc-E|u49Omd&r2hOq|R!HwU*X*7#oboRs}QIg5THni#hsK&7VWylKN-ye?w#6PNksI^829@Z1!$_70w zh5!4jOGf7II+q>Sp^>l0dIoaF>QcSrR?tL`Tag3 z^o>&T2|QRpnT6EHy%embnapEv$V}*=$gb%a}r(?$VC#kN9M%ifahnyTLkd-PO& zfe=@CnPc-v@mCplQ9Z8&DBrrFP#f5%LI}=z(r`~boK}A-)OSpA=CG9D>^vqQEoc&| zZq(PNC*?j5{-fhSm47sR=dP^PcKy#?dl8N%KqvrJpqWaKWD8gVO*uwQX;gY+1aeC^ z9-6IPM+~VKwZkB`%xY-K9Ov1xzq8cgx&?w%k&+i*j4OEwg!xs>ru5reKQZD2cv3+Y zUv)9Vk;bIE{Yn+|s7MYVp8bYYOJ40>`zD3IqRv_mJw>$QGR!InjWJ|-Ed?Qg$+%x; zr6v4>USg(3&@Gf7?p>(d-ke8ErB2wGuGjY5d>$w=wYU4e7Dt5T%SC$Yi&Bp12pGt$XAZ#ZpX!S zB@xr(Z@Zya#r55g(ohH4QvXfoeEkqlEARW2>DAtHwna>OeWkh=@+uVM+rGnf#eW=R z4J8ZDzh&d`Xl1xCse?AhfBl6|%BMwzW4} zc!YZXNYKrvt)J-exRaFExDV!!1NSS+10M0VUIg8CcjW69m)zDc0H3!j5;dIs1j5~) zZ>Rk;CQRF{7IGxL|JEjpGn>{B3{+3_a|=t$$Mn)yak{@#1K)PYo3xKsHtZU z{{6o(dX?Ff_ULF5Qj(0)$@c6B^?lzT%j71oZDuQ&7hJM(%R zq!43ro8?*WE3!@Ksz*v| z>{b|fr7RNG(dsr-nJV7-H2N=23|{~55gazIpL_zrO!hnA7(f};NX8%{I^OQ^*s4Yu zVUcy}&nj7yTwP}Z!*go}YsF)(WW5cxZ31U{6~g{7IptVtTt>D!2AWOx47m@=`rmN7u6_X_^${haqR&yC{q+R>O|wUoD6MC5B~G0WFw z$W@z9k%TL<3^R*(oAi5Gt2V^^$yVMi8YR@x?%5Zs7D&0=qC#qZ<#hdx`erjBrMIkS z-jvSG>QtH?WNBbtleCeooNb-T+BAFb8w9HbJ>3rrVnx!}3`ro(aqA?sb`513k^jz{ z(S_5FMbz&?=*-utKwz=>l8N+Mbd50GlNuZybtZ{dwut~5$JrA>ZNmk(dfS~%bN#a< zwTk57M{!4Lv+aw(w#6%($KVqV#w+yCTxb2Za_!sZ23vLt)kW-3x9A)GLo4Bbz$f86V~R7i^; zw>@`=2Zs*H&lfX(THn25lDi&JCwaJ)$D66ES2%CVKteaVKf7+i^8A?zptv{L*rD|* zs+vEiT$zeDG()7carVB;g4Df2o3KP08hL}~sNHU`9drwg3B=gMoSYa7acErcC+05{ z69uEy*A+JHUR2U2VIs84O6gu@8{TDo|C-sunn^*0=8U_8s~xY*HNj5;&_E7CUKKvA z)S^;?q$?1^%Cw+_UM_l7VY5yOl2p+v30kVpnxUNM4eNx_DbeB-1l$hWYBqwop}=b9 zn6TWoL9gBU8uOz(D0@F6!w;$T_~Xszbx*(2A^+RK`(=r{+r_u(v>&0gpkamc>i(?ThZU)hB8?&tb?W@e!lCjSEc(Cl|Ln|UYtkAot(Kw6 zCC}AEVVn2+l9qseK!m!!W#^!n9DQWwRjXRoB4P%Rkh*aDog5EN*Pq1scMsozss8y<1qdo8 zlJ(~IluqDX*6Uw8{Pb;MH>h{VZTIJiCJ!H4?|~!a-|!6{Pv(c-EN^Pi`1KR&mNu*tSp}O@!CBBZY=445P&<=p%M9mEyn$gqY|J7nlnyvZm4S{dOrYx zsTL);ZMG|N3qvPjb@uM=rxzouRO8m@z+9pi*aYz2s9G2Rg6Sx3PEYfURN)|*LRhV> zLyqOg6lP?%xM5;I(e*A45z=xLWRfJK*YD55tMkm}O1eS0Yi)<3;I~TN>G78Hvt%Z?70hQjUP-k8?a3WyjqKMBM7DfBwVox+PNgJ z982v+vs*Gp_sZ%A)X))07j*K2pX+4xjlXW!gf~#HdyeT~j#M$mQsD*gl3VQ{L6AWY zaq^@~AGc1c$_3iKy8%YOEc~bNkAyw%wJnS6?8*T)Draipe3&wP#$bsqWP&kusxd&n z?8O=Jg@^6KIli4)<;GmN8mUhSr(zaVqoU%3LK_Kv=dw~WI5aw4IM=6YGtDAkZSpM`SgpLkd@^{&BLbV= zRHk<^!X^_sEa|JGEfjc*IOv4`G|=KUWd9}C`h83KE{%^Rl~=+t8Ll)adu6E@c(4Ii zqC5~j1Z3tfNcrDB2igYyrS3!D`W+=vZ7%hlCd&4kvJIP^bBU*Pffg-BjrTX28*69c zkWU^Y2H(7G6&w0i;Z5Wnl>^$llSBSfN>E=v;Wd)VOAIlJQ#*P1RZur3HP-q#++FP! zc;X~LWh?JxzL`fVM+ZGS^l6{(L~a%BL49z)#P0w04mq*TM$X7IS;0dIqEDl&o(s1) z?c=Nd3qz9Malo`C12a31v1^%vfuX0B1UMymyEXhZlG4i(dHwPUMi+KLm_`kNmbd(L z3`TxMB$8z85GeoDgPHH1c!nL5fNR70deLJ}2ty9A7 z-sadw`6@jIb=W*cpni{)D0u;VIB?Ro=_qK#kN<;uL#lZvAn`F&HyAu`O1<6N8l}h_ zQPQV273*{S`(2ynlWDtQ5mPVZca&3{8E2--$qC4TCP_zPnrz!}bdRgYtMO!A@z}mk zA=ZOrX9iVhlP(j2b~JikA@dxJW?Hke>Z7_)RCsd;*vCNn+pH#kp)kb;UwTMZ$?l?j37P|8UlOKIG17GwWFam6u3)h3Z?^Qne zf;SpabDA;CLQGoUI@0LsT>(0&^}jkPvqf&-Wpp3S7JD*vS}buddl!W;2v8|OLva8B z4H_x(;z;LXH}@*EJ0&0D(F094!KRsgfnUd*hLoI#RW@qB98yz4Mu)|a-L zY5=RCm&*mHuCWNEloyTRb_tZOc$=lDGp$&VijXcUmeYJF)TM)>?vJ4_t18*Is(I_L z#LQc7v!~KyVQxpC1_82Ki$^F&S!h_KYMKC)`cw2h3-Yc*n7;p@W~o(Klq=i7mzZ%> zFIb9&93BYpdj*R#ABSesa(@nqQ44JshuX7eokKIkX z2pKm8q$WA`a38^zg2$i|gN12;)j4Oc@Hgv#0?dAC*}#a+A>rY0MChiblrNRN@fN^j zT}B(>k3wf-XQgwtnw~isN>JBU&Ox^E{|%F| zz}y0O?N}N;eHxIoX65`@=d2C?aTeKa4{Qakj2?w5kL^1Y<;-~voThFM_QedHIg_6> zIqoV*Tnm66gtWhuqwn{vI=d#~ZJ3+3xld1N?*6ElN%cj=Hn;}zR$E@EpiVk|O?X{2 zDV-8KP6-E`p;rFUXR@!0o&3C>hw)at z${2+P@opnG2~PkrQ;*yHTaKz!rn;xayZjE-yn4C2d^0VaPmiArBSu^npd_RJay=MGqcSw*d>N?(Y$zd^Tj zxV5Ww{L0d?J;xV*QF%B#SwXpoRbM9&l6W9 zE%y6b`0m%SXq)Cn+ui#80qy;rz5BZ$AjMu%_-)RzwGz`)b%y>~JcpA0*l2dV@agGnZlOO}jbZ1R z9?Q05^z#>C_C8v3wAY-rzR|aLT5MA2m->%NZ7TVxu&4~ApJl|jtl%M6 z1B;L(w z^{x`1byb zX)N~gZ3FgqFT1s_?YI6HP6525*#POeQ<<3g2~h25Y+?Gp`$7M(B$pBtqxwYEV27Uw zkqH>Sb&}S47amjvfCnVn);^3yg{MWRl{3g>Nle7I=1}_Mb6`BjtY*c--?;byU+HBz z?@S+-2_Ya1^+nZ9h}f5r^uTCxTo61Z0F@$!0PfsS)}rANDF`#}q`q`~PXD*5lUC-5 zbdP)YT!(}nes`H5U;s~&+N1!?)WLyA?1`LzO2f~wRX9tIxa&Ee0v@ADUd5%5+8!W| zd{nI|w4xZhlq{S^EaNtk<@^(P%nMHT*f-xl~C8#0cG2_>)*Nfn?-5-?y2<%{7=w>;+>ZMN@nn@jZ(+}Mu5zRiuO zHDz&dK|*l-4wUMjQGP9M?OfjAEAp7jxTFndr*a8QKa`-$Qt0gS8Yg;a?rS?DY6^(Z z2+M&*9!v}D0Db(S00cXBJ+tQ2Q>-5kE(a>I5Fj4e_0RCVnD6@d60khtrd72R8Ip(& z7P@SlakwD6<%8U&ClRRic7=vkxwcE9k9A6U?t6E zh#>Xlu2zk+vOnO$foYvXjKmeR3e0-kqy=&AIWxobYkz0$zt2b_U9UTIw)^>@3icR& zgcYXznfu-ztQrx`^zad{3w8Kg^w{Zmj~AO~kbQJ8-E;TzKM|7mMq9m6Ol*M%(=UH#ASicZDG~{Ag1q zz1IJn{d)z${$x84D~G3{6$6#i9_-Bx}HqrWej~lfdm~6t|$M0lw7C9Tq@VRL> z;vDk$Ix`8Ouada$p4`Qd3KJ z<5%zp(Emox8Maz_6;)(tJ^`#@qV?QS@GmPg5kigF+=pB+C49PEIZX0mL*UdG8z)u6 z_*db~ru^tYfY83)H&rqK*Czx1DPuG-5shi(2Zso$)KC@XPoO-_Vbku%WS+3lww&~? zB(edX$A?&oKT;jq8d7@UiYoA!npm6a?A5U3a^HW^hT5r^z5|**o}ttXMd0rpRU*2r zB*?W`TDYqs8h65TZY}AqP8sC523^@AnC=5!H&2EHDo2&|(mbQiI`X6RgAmW@ztrTt z`?=EmcIil&p%01cMh>t!8CPzVIC551@-GR~pA<&WZ5bw--J&1!V!2%w@wX$tiPNX( zPxKG?>0QWcb*JL+RXH0~mH2(IYTS0pgE?~C&%fn776!BeDi*&x3zCGIij}eUpeKR-lswHF0+AF9edv%SM z9x5)}TBxrwyN6K^cl#c4ER$I@#P2tsc}sDXew#-F5jxv?xBshP7wH)sDeJ9iY%2Hw zMoz-!ob_gsU#1meke)OL-_&t zsBRx=v|SW{@A2l%&6Nhj+OkLnlNs)?>FXOxZIawZ2EIQTbHSDAJO z;CQTow6Z~7jGWJyvf293586=Fw5pq-(XZXcAp#@U^NDcq}p1W$~O z^oEuIjsDS**7GZJ_h0|mB5x<}Z)opU7VmcliXK4QIl!rYoenOZ<>9npWg~4jH?HVe z`dLT|hTwIz!DnCi$vnZE=p*u0DvJEKA84iL{a)sms%bileyI!mo<4`p5Wjexzf7#6 zUC09!c+lU)e*uU>F8cudG6)@M@XJ_C%z?jG{ZBKY9v{C+nL?kYg_oJv{fldg%AnmXmz zL6WVG_HONr%O~kF6me)Vo(s>wwd7pl(08TH0sAo>)icF66_Nu`vpDG6Q*T`}6&W<3 zZZ)Ee-ffL^if-%6dVW|^)T-KJi?S6&TBl3ei9ztFoX^JU41DW9%ApY^p@M%f)~`pdsckYL{&Ug zxN9|rme;)Z-7mIvCqyxI`o34W2{Jjb08G5VOV*h`E{fn{LoCxM{KjJ4U4(DS4Y0e+MGCZ(Dm@f7z{E&H z;Y#6E|F>;*P+6{x#@chYu@)CkBl+Lq2%GK0vzvH{w%S?C8J_YPPr&6kdj>tbFPuG- zyq_r&>vi*9QKu^35qQ@ItqzrrbFxjT<60fxeLbyQo(>Vyw-Ld)9{(a<+usW=S5AO& zT=T>8S1h2pyR`Q^)#*UbbD}q;Ii2&G=u!Cja6aVEH3bMSqro z*RQxFhD1_ro%}%@U}@K`uKgUcOkiGrOVd1CeRbijDN4YNO=c3BW%K#R z-8>SIiibN3bqhovJd#pjEc!;@m<98BM{UVau|*`kl#GDF!T97w5(oHZ3(5EG!1Kgf zDdR`iV@bDsrgY1gqU%EuO?rP5?Iy*KDWT-hPgJtjzWjwQ>P^yKOuD!pU37;D#xNCA z_igUUKu&W6rfydP&t zTR9$an^!Z%uhN{;=kH3%bKe`V6_x|T2!b^4$logxEjg4RRz4`@7@#rIl5^~Q1f756 zomqWdf{yUDkK&x1hOBwGGb5!RN(2`=9+V(-SNEVFMH(s}kkw8xh@cq%4|{JNRMi{( zjiM;1v>z_x^eRxN~RT zxo4b#*>3jU&wAFg*7|%t>)EFYue@R$&v_>hSMjI*RLSJKKgAB_B(~CB=+`O_e}m?Q ziq=;pLv@akRWSKR@9W>3zKV<$IsGzvGaD7O;9g!_C3X z*Evp{Wq;zQ;Fb$tN?q*uyLg1oZuG4{r>I4B!As%Y!zZk4mTw*k@$CmpU#riP{YL^A z^o^pKCHxLicp&8H^t(n-8OCThsr|)BKb#ypgl)LmzXAH;RE)M*XM1S;{+66%g4b(y z1=(DSoL7e37B!j~0$-zI6JArA71^Z)sOJ-P0K(RJOf6B>^6%>qqA*`K^)2p`;*v4P ze9MPk6=-!$jZ-tVZ_OkCb#?Ad@C(@w;!N(`&3Kb{t#%G?UsU>oqgzM_-BB<~&)ab{ zz_N&W`7D6C+G2v=tcUa{Z&5JOzCt}i3uB_yPiwMA1#$S61@w8XSkf7ko&r04v3PC$ zYVFZ?LdBJXiA_}uU1x>h{9Q*O;f<5=m~D0jCHHENEIV%ol;&jAI(T~57w-616*mEE zQ;fCPKmT=RCQ>H6@>!`#o-P2}ddEZx*bc3-3EeO~n?}rs#HxhWo+R~HzcwLNKCnM- zlyP7y;2!lgsrhn)KmYXYEwSLf%6!C-?U&v0hAdjJLAF@v zoHkJ?vd!luTOjNt8&hFfQc*ZI^6(bB83(OirQnvSlUR@CJS zkKtaYvaD6p%uxibtQHTZ&~BY!E4=aS`-VUKX8b`W>KyU25Je>Kr#3irhZ^Fa2f@WU8m4=gedkl)yD& zDrERoQ)a30c#9$EpCTs1HIv?Q1ERPIYbpKFD*&b0?O{MKat1>VthGnP51 ze8}*5k>q5*el#9KG3lFp@T!4vF#(KDLoD)U`i~2ptPUtF2JsqQKlfigkU_~IXTzhJ z>mh$3uv6m9uDTx6H{_44*)9RuMiGI^JzBuz#t$^We|vxM@Oylzz|TjYW{I!ak|2$t zC-PmDy>_5EzwQ6fCB*^mK)cO?CZfKC7qJ-Gy@zS1ZW2i^qq7R@gn}$(K;Qqkj%u& zyu|OxSX{5#IDnXHc|2LipUY_Mh@xpM&z{>9la3w(#*#KX}G1`Jdgf`Y4j`Hz|FnI<@% zl_;goK<)qg>Om9@_LkiVj79$^!BlR<=iUQv2*aRxu=@M;_xCn(A;X}f zonib*ohY8`(&EEPO_Lq#pR>8`AN(p0Lr%LvKRoHxyRV-L)BrIw+pOH_MoAOC9vHlE z{y{tzY{gT!L(xq~DX93vo1N<)MyX=CJMI<&(p09lR zw^q12G%deRiE(j@;Jr-%(Uh8RYe@lsD6<&W)8Vfy>ahDp#!~_(gH@!dqKxCFNg9DN z<>Pl-<`cm>MdW)As!rYX$Z*X!K)f2+tFW}v`ndyJq#7A7CPEJs*Z5djs~$b8I&O)o zUodXo)t>fGQR;k@ zHu%0qjgg%19h}dngEwRO{a;(mzYF=al~J*My?__}q4LFLLn@9)IPu+D1{v0r563}R zyW5#{_0T-^+`k)7@DwNAje4n8YN!E-vdR+1eO<2Ux0nw^9{VL#{&1*Stu&ijo12!t z!pLe^9p|`ll$zqOM15(QNNd&;rQ6)mHnE^J=WJf`qPO(Skt1=p@A5|Pz~91R$mPZ5 zjR*h9LK@HXdNMj`(>fpQSm4PdH8pqex5~h-2cJ$y0@$Sj1G~bqDJ=28C-Q;95Fzpx zDU^r*Cm-mnD0De66{X(BMGiJW0kgL>-;n4zHTbao`Q`Wy`FU}Vpj-_3%hR{Q;5Eko zA08;AF|}Tp-1?k5c*o!C-!>WpB};9vyCF->x(XuVNe-=Lvb$)f`{m`NsjY<^&*hip z#4%n3wLE`KYQ~6U%RphceY^V0UeET91tom2MN|1fV>^k8= zTRS6NT)D9Yct$#x!-IB9dLm1AEA;w{HnC}M8R>R^6J{&x-)o31ZagM%ncn;wsBD>vw{PqGyMY6GJ`TUi)dg z$(T{IdPx1^0%I(#myq0T@laYv=kD8S>+{}H>;_$dMw_(Lic_L}Il zqvi#t`HkN*rmLIpr>)Bv1)Vww`F$0I` zsG3Uq=9mj9%W8R*bPLobkGg+Jd{pii4$Nq$5SL z?oV0!YaT;5IXUagKhwx-v$fWO?R8xIH+{-PQx!sh!>Tu@p&J(*v^Qs(>d%l@ZnWAK zqp4cuzxivQUsHTvKCZ}M8*Sl$i7QpJH+tRuL$1qKcSZg*?_bjsw93LaP37UaIWBg) zQe4`APqbT=KmIHB(7SvtWcw?Y#<=3`Nk-h*U_i#*NB+|pKet@MqI85IegO(Fa+agH z>utKhM}gB3zZ*@D*)jf};Z-`b&kbk8{~mp%wle8Cv(o7Z&M()`sDqz`y352k`BhvB z_g&i`c@7rH($O>1*IS^A_36?us?LICxocbGcVF4QBu@|w?^5? zaaCw<>QWZv29m7jlCCH|(BT|0>?XJ2z zZhaD<J!`VdK!8 z(k%z`%>sRHs#{dW=%7Nw-b~a{g*m-YlioA=lsYKUKm)=|+ii>Y^Rs`x-CNAi`+jbb z`@rH<`iG`9@xMGlvRt@~w}Z4SwOzsgj+a#31vLK-;YW-AzZpWCZ5iK?^G|)>;6;Y# zcO6+ZW!YgDSDX)b^LF1NkE|FwR@^hI2uHeC;EOLH=Yfyp{a24d-!{JMbd6Prob?{yh=w!7ycI!rH|z88ghYX*aa&Y!lbUts#ujFVRQ}hU>@=+R z75O&lJH(j%RhtAPr4k~_$e$Yz%Fqp-F4{$p&+qELcVx0x#y{}WV;E>;hhyrSs0E>~ zZ%_)qdnXUOs0>dKEX}ip<63s&u9*tNBacrxE&yVSYvfGi?%zfr!K1SX`{osorILjY>!>4 z-%fF-0e7h1CNwoLOtUF0_3NVoE!3UQ-&$^2_A6X2VQ)%p!p_79@gfy7elk)o`|CMJ z#zu{sI?esR(lN*Vt}!1IBxIRYE=Z(KsFN-hM^?r*g=lK^L=clx}2b>So$n)7KT>_SfzL^JF# z(~z!eMfaUYomG}A=ib||nBcXB33|lIg0*q!V|0;nOD+%@gbUJ^Ll zWLwAUw#kWFV>ZnTTgwwyVKF2neJ}}p`%11;_lM0)?`(*DH5nC!uDwlQcebC=Tjyb1 z=6#CvtG)X(d&EAXtOE|>#5Uq2#hQI`6}G(nFX%?wnddd${z{A6N5|ajty+qye)RiVb)dd=ar$2~#a)su6;K8PMx^jfUse~oZrz`#Vs!z0N+E=bLZ z>n-k!5N8^XZFeC<^;#bn#NVG`dTi%qaDDZPf>1s~1yF&>p3$_Q<1X!1i>eKxEn6Ik1& ztrA1j+PM-3FzuVmhb!v>P+gs@5>nsGwpZ4m{O?`>Ps+jZ1cuZExJj>ObszY`4jfkc z>E4@RJqi2EwyCyQ!B;FayY;A96R941* z{rdGy;qcT{&(P2iR{nbs9H-3Qfj>=7Oe6)Tbocb6XJ`BK*sm#k{CFC93c>EYJVR#t z5^>}WeACjN`}_NE?CcoMH+u4)O&DZmW&If+@4PzQP7w6u)h^qb@Z=a z*Eah2^SWGK&#$fMGMR<5SPIa-p}ge$^wG$xr|i<9FJ6j8|NBx|mm{&Y-(*dOrVd8!qkpT)$)jC1g6DJiwK`e76a z8KNFG(k8l3)!h7%a9R0NVR$icz``!cM`ByfEW+WTis zu(6^rY=BHH85o5Zx$1vS*VxkmQ~rpJJ!(e9SvY*L$FoS&pJqwygh+5DAX;S)A_&gz zZ%s8i{CjsDkc@~CS{nZp7gn4D?eF)2Y=NXgJ#vUo(CY6H+spqm@z zuV7nCL*2slJexA54^1PWHaHS46-+%lYF>MNl_j?uD5!XR_Bn3QG2EZ<2O2 z2`z7jQ3Sk*K9&&A3y>PW4~jtVttS-*!GH!C3`RIOIZK@PwGm!I=X37NUQI%2ofrXd z2)_$%(|m-Hnrf_H?{dZjPiQ|&pcsnEYiC9^v1?og=9A+N^XW(VOf;u7?(DAK66pJU zr5CHO(Tl9iX|z`i+zo!LO8?#Dn;cAPz}|AF;a`$kKXo2lN;X-RGYI77%Yag26aKhT zZK}Y^V~Fvdo9Z2QmNz~g;|kBZx@hIVF%uP*!x2|g+A!>`WNM@g)2&38N=SU~?a3`< zd9-9Z&5Bt(i5ZHs<#xPoxnq-4-1=;dc^<tSs)8_~Z4#rj@T;u||5%(2{nh)T}nD z98*%Bw@}8eTW4&&@M`V@SFIU#fuyWeT+3af?L)8k(sX6Ux#;|~-gVqveVRVb*k`O| zeS^Bi5zDaw?=c$raGx7Zw5>WCJis~%nVDf7hA;I&ZZCDe6!hN%-xK@#cvy{{5ld$p zw+ObC#kXMiiOV-d?k_|!e-WcBFL`?~Tw$72pQ=+r>xn8o#hylT&#?D=bMol08Y$UQ zjdt|N;wvW@y7h-;Kq49VfilSBb&Kxz{v_^YyPAucb-}nHuE^f3oSf*?)Z57Mg0nIj zIdo#|0M@UO;PslgRWe+oPK)6am#)n%2GW0BT;;iicoM}IMo^TE4a+(xR*s7tk4++E z)12Jdt!tDnuQbuGD-&hp>{)X-{4UdQ=Pfx%f<-5+OuQPC;v!Cz*|GFX?8i-@7E5nV z6nKc~wn`O0E}A58_YBTI)=MNTfsRn_E=mZ8s0}M`27#S}a*MYzL`Bx-CVM9q10zml z88hvko7koGOt05n)jnlbIfB3^vfo906jV`Jc{ISc4{8_-LI&0EJ9YzQOSHsX9&r`c zIT!rI#>tT;E0s3WSVv1->Y`{7MO`Ld**@Ky_r^HIyYjl0zOvz9PG3yjP#DWODOZ<% z3676T7U7fcAh$4!U|V5PRoGZPx3Z5i_PJ_#m4n9Mbr^o1(5UTql7m&7>p(t3c6RM6 zE;!;s(l@q|xWxkJ&cKK%iv*jZX;dP6x;1pFref$Z`W4SC<;&Scs*G1Yqej0SDzX1; zI~|d!QQYRyw{A8NWVPrv+E0!ltm)-OD%QPN%>lp_5DDZI5NtP_40h zshlGx>%-xwPTAjb zLC8Vq?f|p!{yG&Dr-vEWuHk`PtSWN9+e-7kfLd{4U@gmKYbaV!<_nQVmEG8%gFuL$7(kJu7!?EYw z_XWoC)kKYrjZ1q$N+Tfxac3nLWTS~{TN>wC@ckKne%(wGfc}~Rq-SKF+x2c0{hK!i zJwNEXnZTtCHIZxfjoW&Pb60n_-r-XFe}`v~hw;dH?0i#GDLxfyChRC7!RJem0xtvi z_N>nKW_ugX=R(rZtHE=6P$NeWq{`4yx8K;i)E;tpee*weRRY(MwwP~BIXQ87{rYv3 z7RaPs)!CpnUr*t63|?C^wraXLGmHaJnr)BXG~^M=qD_1XpL40*>ic9llmA9_4o3Ch z3pg4DgUQ?4+LlU#u_oYxqrS1RgzD<*swMhj{~crj2d(U~&5mxb_scvk?J7c%cBFo2 z8JRSbD&XEVFpynd&M}z^0OPt9G@*eD2055kq}e^;ll_GasT7Z!FH4^Mvq;G23wM>R5O=ud{kp<9DY z3NPn>XR9L5PLO=jx(E*dJh;?<_ZvdqkInsTNAGW@)XK`ri#h^On>>~k)>xtaJ3l}8 zTRBIy-sOMBe1JTen$LMJv%X$)_!3kYGbqTb291qbdzge{+1y{gNHd5P}t&6)nUN;~X|7Z3ZGcaZu zo6ZQz&Q&`_b@jym&VG$NJKii2q_OY7aR1C>Hw^qGp&6T;_uc2uuOB{q_&>J;7>rF= zj2bT-!qb{A7VI@)fQpBQXJvKu<-Y+ZMSZL6dO(1Q_B$_cIAaX>W|Sm2 z?>?{10?Os(rJ=Dg?SJRRBG1Er^uW}@;)69HJ0zok+sLrgIq!p+1@raagxM+Ezo

    w9W!_^~+Vb5+8$Uw*@8@IrK};J~g& zz{a%SXX~7m6&1gZZ_7H-KmOxwN8WT;;hkYR<&aFnAY|`A>FjYyd9kE5EWYZp_%<;7 zd&p99NK_rkiUisH4}G#GKds}{o{_91d((v-S__%yEQN~@UgJkM`iR1Jp!g<#94NhB zdH^yNOtaxPQ)}y-y1FF3{d)GvtQUO>I_SoWmWX+wyQegsKU^;F5KkN#wVI!SFOBSQ zcN9jmkQ@8qy19>Cx@!^I%1=3ZiOtLBZ-$k~Az?A2u5Z#C`^n3LH>OB1wmm--XO1Zh zYMG)(o8)9nl!?3f%Jgm9~PHE9s?85w3WcyEOQL(l8ViJ6_qXu)1}2THzj2Dw=Czvt!H2y@1M(8cIfdOQ34iYSY9 zgjI$EvJ9KUI+*l`Zki@s4i^)wY#I%-lzl!4N_xHcEzZlyGeOcE=%jtm0tU|N;YG02 z$Vo~&;|G5xHlh|y)~O6IYT(t0nFbuokK2wRcV64Q~iktnl4P2%QK`l#Nv90GC3Qb!ytprn4_Zt_r}z;L_1yiTE22KCG0k-c3R>b^m z#cvsV65P_jH-;gBp%}=u{8m;L>v*jnZk*JG|5$9|Xikn-o_y6hb-!6pGm#4m{`1-a zeQtMu=rG~^(M+6`rTsJswy(>oOQ2XPv7RQxV$;C(Hw-lgPC!)4g>HcPa%4BHW{c9 z_fi(#9Ek3E%;(*@j|htP_Soa@uHGOYh}>N5bv8OIpg~QRwLcmucvv0baGWuF^CLF% z@KVj{?=G636IFZ5%%e5U;78#QcTW6oM@j5t$X0)$mSzjFE&<54*K4&_a@@Ce$307b%Qe` zoAHxGZsqQEB5kxr2dASHb2D6$8YAg_%PY4v2?Vu{G?{^2swS#qt9R<2BP|(NeJPy0 z&W9mg8$s>*^@yWhpst24EiD8fEGM= zvyVN>(eVl`58`iT26k)xhs%vbHuCw}_VBSD1Z2c9mMr!&=uW2eb|rpE+a5|2y|}r3 zOj&v_R`3v08diN$q016DzTM8kQTqm5AmUr4%%h~nQ-&r4&VHG$)Wb@grc72$O!nrz zUG#*T5brMU`U8_65gxFaYJw+zP^TT@^I2z|Qfa9~cmR&Fnp)8OzPuAXC8c2j)B%s6R&DcKZe4;>5kI6ouw7s3mjd7hmSvlnhgXdaiP2(>yc}8%a8U>D zHzHcmZhz*+b?(UEG&Yb9Ux78Awj6t>pzC)HZG1B>UoNT6+4ovoj|ytC=pz zs%T>Wv`S>rRmPFdh#z32cQ3B3&?Q-w;~P!Yx6a$6XHVXH!I*_ki5un-Oii^8@1vgF zoH*^xbmyy;9k}p!Gp#0K;o#s0y?f**^1w$Ja1f6I;P0p-kA-aZMBgzG8thJ0pdiul zGUZ+T?X4FZ8(Wm?6JVWjF<}i_t~zqJ#Eb5Eeo z3lC~j1U(be($ZM3Z4yC=GBkusPEPLNi%Uhy;fq{=+nfAV0A6Rd?SrWB?I)qwkL>Nr$ zWHMhuoO$M!ita9ryi7*#NL0KZ#2O({U~XPsXCK^5W;io1FQl@P>+0$XR8R5QQtIlY zBqSst^)H@ZgHmxE5}P7N2P&Y&gGIP%Y&*I0jIF2eG-j#ywD@N}#+gcDMR%^MIZyOx z+M)hpP$-^-<%B-ByGgD=Oxb(47ipaxRqlHv=x9;48+zQ}jf{+ZkBVv?`K=tSE&+vP z*VH5o=g70OuzcxVrKX|rK_EPij*bLRu@c+c+X;w>*rCviAY+1{^JLu{jXSxyf+pcg z_GWpVTM4hyvV^7!9i5-hplEXm5xgmMOM*3C;=|aPUs75+p@u2mX=Q@6 zmw5Pt^_{q^E;N)?T->+lqqQ}2XE^zC3p%At&!JBXRY5@k2NxF`3(H$KH{NJEdE?1a zBbSCbU&yh#$XOuGHEVSJ=0|>;`PmiRY`O`#*-h_zyn!0B~MgZl70O6ksIOP3|uyx zoKIXwhw}ID-!choeo;|RXROXUt&?@L&Di+)JsJzzN*OG;_?+NW6d_LoMZ$;0#ab{u ze#-@?leymTS(j{(!PYavUfE((ZtAI+B$wTL#U#BN2R4FF&co#gJGxG4E)W)Ay>zH? zboRQ}xk=IwWVdlO|JLLC-9lV6Dv_X_(Bt#a>DJSPk~Jx$=A|4qHyX)-y9>*#xQok| zCQm+*W~=q{{VrO!%7}dm?8wBJ9wLmLi)1veq_1$j8}c#h%`B>Lb~&kFdRychT!g z66E%%`mVxReDKiEKV~0o4LI=|ndKLeEt%sOmYJwvperj~q#P00UHNZfPG2HKgvjR2 z)^+B>o^FOJ@N%c@;Wr?P+e3z3t$gPe;3N*|^|d8o%L$wLNAFy2Z>(OIsJ4u|hdl=!&s)zB?=vdKoHqGJz@ zjQ9?&X8?5b_wQd;K9$pN4>4F|kE3`hv68UdRptYat#EK~45lnJH!bS5>7;WqS$R73 zr3iPdv6SLr@?!qc!B3evB}5pQ9gfDnYOkpn|0UZniC8o!>1>}rm7pi%qG#@>nn#;- zW$JkX`B3n>t)dCGzrSg`n@L{n z7W9`Dmu9Qd)L~MMMIa^X8B^o=v2tH>OmCm*cY`!&**Df;Y4(K0(dk-{1=E}jBU!Bg zTlpg7jy(oEb(bx%PJ8)GKleUxCz-goaCD0G zam4=sTZ10B9{mpNdIvxooB!zOC@U1&mB?xS)G2hiGs6DjKo86xAUBLeP;bKYp%8}= z%9R+EdHvw?nXY2Jw>rbDq*v^P2OTDQRhY&`nF>Fwm*<{R`ce248P>WKy%ZV46vD7i z!96`Lpi`pnb5yF$jep5X^m`Mnsidbpb%2oQf1cjAK*LyH zSBzYzWm(ARG&XURdYz#eE(KYh!w(t_tot}ndJN6q#roi13hQOSLw|6f(6$9TD81j zei+SEp9*u_YcjjV37FQJ5j<`ka_>O5JZQwhzFb7SDtoUK@2J-P+l)!+UU8XQHtl@^ zJQ8z)awC!ABvFgYZrG8F1!`r)<01chj(qc(_G57*z4(ZRo3m-a6-3n6*DKEMH#egI z1}VL$D55=th~22?!js_U*(86Tdi@nm%gGjG#%sFmvKX{yb?1QMr}aqZ*7DY2N*gU8 zgOX3ll2}2FGopL+Jakg%3xK8uRnrN81^Bf)%prTWJ1qesSeeP7@o4VHj7n=zlU)8P zNn{7)(}>ae!FBIbp*NjjLx2Ca2I14WocxiHu!PCV$|B>!%#5bs_2l5v@uu1es4Rj2 zF~eQal8SqcYHO8b=eJ-c4xJ*P;p-JQiD)l>%G~&1&XkLVrP+PIp)1ic ziLa}N6z#mmyttGjSJ^edW=HzIsEB%+))g5_Sc>6t9iO}HN)F4Qaj^k3SZKP}WX4Hf zOB8Wh>$GKneY??!neXp)n>N|DS$gc}ik6_wCs&76G`$3;)4)MTyF47zBc&;>?U9xk z#^o{MnMmZ@?C#Rf#aj_d63ukg;#W(N9piNPj6kdl<^1{;s9{yJs;pH8cr{Q9NMp0b2Z}o#4k{{K`4dT((ZR0Da=%G? zkMGMl-!M~&jg_Upu#@j1IvZI=vjj=QPmioQ8_LCY`9G$JXBJUv%=9yV$czjZ>)T%H z<~xeV$0*)hK$)MJ9PFbPtl#xP45!{pPQ{RaT0VJi$>Xj-4tsj$!+OWXq5Hia+MLqW zhT(ed9sN&NRCmQj-+5jNwuapxj?05|Pwh8aS@4bn zPCH3B-zHX~OhMODcs>iCb7!Ci5M%vCY42%-hT9}7^u5@S);m?gVP|6$@qC^xRr@p} zTO!A}rmiyxj9n8__f~HN@liuiD?~^9mY@)9h%IW-vL<_lpRnB5ICqvwR$}#Oxy!vtR?14x+2_5B$+CZTUq9@oemt=|@rcFIQ_*f% zt534wNH*;HY&WB%B(lPMe92Dh4prj**XB!}66=~(!k(TU!NUsB$`tv>NHuQ$A=ft_ z39@)T^Qo|35-Ze%I(LWkJ4R|VIy(k#;TSph-WfplgCk@2(uSO^8Wbj4cPsHCI!L&v zM)iCGyAM-|opQqTn^1d;4|pw4&Lp6G7K-0@X@~V#i7O83EZ$|%#tw&Lgj|I`(!&h? zyX%693b)ctB=pzA3z?R*C385JFr}=NJSV+?II$`3w9(M|#D+QKh*_Hai0}W&G3@8; z8&M9pytRoE1CKp>7!4=qX>HL!qv!Q6pa6sABNjraSG8ROfIc<%6hN%sDns=Mt#|jR zvp7wKI6@w?mK0c6SP))^M-iQH5TJm3dVLWFlFp0gg|X42ywnEq zEe#=d(OPZ4KyegC#*JiL4I%`bwCs(l%FBy^dWW($2rJsWLek$*zyXmNnwkcV>v)qF zjrY<-@Z0qlQ0(sR?o5^i*g*Th4|-;1d7CWobZn$ZuJ#MN$-n`i=~*qOI0%`wJ!GfL z%gb#}HWbm&(Gxh$34yTsxDd&$i${N}l)Mj$RKUgn{(r`4+LH3RtyA)a2#D>cr>8)R zEjJqm;jqnk_{TZ8{&E=jgKr!h9L3i2f*yjDKsab$KGd|G1@t^nz0J(bo(p{3ee(N% z_W}r{_+b!*_ZUn7YW0OHcs6l02?=y`Y{<`?oPcLupy(1Fb5`3XhMEm$YgNpm{sg%Yn8#+Vj|5;u0Iki2 z2l}&kK$SCDX0o}tnby<^5qoq%ZfJ3o2|d z0KTYucY8DAeRmVbk82DjsHH`?wyw_1%F0+*7X>yb;pD`nrly98ja_OsObg_Z;z^6l z?Chw71Su)0$AE^0rVPADO#^Fv22lET%E96pm;jn%BKvGQN*RFKA#G*FR5kC#hZ2B8 zxkfgBfmTyf)3$6Yl7{>B?H3TsXRNr5jEn%9jE;=_I%`FT`)J|(`uDG2R5UcGMdKlQ z#8QIFATLW1f?DUGb&=)f<_7c-4FCBfOoiKQT$X~<;#5Ztpa>N%6(8Rl3POH13<&8lcM z0XG0L&OoYwGzV!Ga0757)MQGr{k^?xKpaTE_%^=%Qa~VuUOD?a3|2Ju6nLWT-e(>) zVU3Q4uV3#Wp)DA!c2V5XkzKY-!Z*0BK~pi0`x!$3HaRu!BNopq2av6tyN_^k&dtru zGYSgAfGf($VFP`dfRJ!*NFAw!IRJLUm*CNZ36K&1XaN7gX1^x$k5(cCs{$!^fO!U- z20bGqxoyMV-rg}zKA_w{(+2WH(9&UL(E@z^D2N_h=xIp%M1?sKV371c`NE)DykM|i zC+FYMA%3<$FaQ4ilQ*C8o7a!EY-hnmfn08CWhE$N-~EGL*-Ezpc@-(-u z&6!fss>QnZ0DA9c+BDb&g&PnwOZ3}=Bd`X+dYYP22P;0Pa~Wt&F(BHL&7mQCQ^(hU zk?!1jt8p>WCL2BZfTw0j$0=!QChtTQPX5i3PGB>7f)u*S%A!GR(6-eIfD0QLy#z6- zyt2{`abYW$3~lL4U`GZjuB2VGPfXydFn{rKqds%c%K~s$Up%W1xF&5~vOEI>yG##` z#?ZUO4zy0r2qkAnN2LA)c&9Ss{`AsPww4&A_*bE{9T=(sy2nABDRtOX3JwmA(i-@M zq?~}6k!yIIv&cz9gUtPW@8#1V7Uw<9Y}w&?K(I)b0?Sqd=TG9crX>xt8`pByI?_!D z(gnpwG7uBdDO|n){bzfs5_qrY_1WT~3qbin#`MUAmky*{PLG~={3m`cH>cyaP{@q^ zpa4FTAu5AfsV@*_wY_f~zqKqlT571P_ki5d2aJwXQKu^{X`TkX_@#s_t205(FSEI~ zw^lK(ol#vK4-h68yKf@5H3g`@*ZR5V4P9I=YO8d>Y~k=9poof!B6duKK$jBNy^qMz z(`Ef+G!R!-#uc&&U>_x5fK#~ z4S!Qq-})65UAzP+&3KnD2+Ch>%E1KtfnZs)-*_F*?`l`tD;11H%87|RK)$^WI@cpc z13eq-AZuj-y+cLEGp4e#^3NM&mMRSSR{7$iy*;}|rN!c2-99ZH9o^*Wi%~$?34?3` z7Tnc`YtV4D)Ofv@k)I#Rs8LyLzb=>lXXDjJB(XdGURWb)4Y-uWMDbU^sorGcOrmfl zg@LLC+2BMv}jm2Ad3e6*Vhb8OvYf@LZCKZkTXKUZmgiC6{bg= zQF=$#9*p^CWa6#KJPVD0S#L^|c=rj3q03H&JwLk~hZWrM@Wb9Aiw2JGD+W9JT7kB{ zBk%^XjsUV^S9!|In1m0RrVvrkvkfpF_lH*m`m?o;AhW$O)Dd%Z3bN^0c5O z7a5oZlc{nu5ajzK% z?oRL!ZSbMm)_b9Qt=a?08uU9@#RH}p=$N8vY9t`F%Q*2EBa2a zO&d1VI6ORD16tP1EG$+QT6`dUPN9ILQ&3ffe(sd~pTVmqxQ(d*V zq}55eR$EjUmXb0=6@Jgl>xH;tNeIjtQ`ucVFzP*JbVIR~3emLy;Q$A7lcO|g(%G4U zxq9YQvd3C1!5L&@*?}copc8(hrr21E`dYph5|Xe|eo!@_BY%jY6SrP+$|(z1UCyQHyYMH*-2c;{x)fx~e@vUh2+BHG1+ zEq{7aewt;bjty4Cd~SPI-hvFTkGgwTAE*HSO#3|o8#{$GJ?+i6 z>7)*oeMVg;hPLT~@w)|TAaW#eqzj-yJl6y2YnfY9K2msH++Z0FHYKTDb{BqjAO|Z2 z)LaxE2Q7wiY=y`?1cZ}H>-mAB)n0tN&;)i9C2j2i&=E0N>-YxLrXU0aAP^K%i(Y49JPre z{~i(mZxPKqUhJc~V|^f9W-)=;`~^~k%5reM^8o)K4YZC%!EZag5#XQgn+oSMHhS)3 zv>*2PTYNnsMLX*uIyYMH{WSvP3f2~lvcR}Mq(E)I0ZR2?!3Sr_t_I|>YGnn5X28gF z_x1wl!uh4%mz*PDSD|5&&V?({$i!QYspFw8X zWea!TB{MHOeO5Uv;txbMu4P`|C2OODPjEV3<`aim(q2YuPEezzG{EbpNOSC|-g{ED zX2!RtvcoNMDbvfLNfPVExI5%aE-_G;_5Ln0ZH95rEu^~dJ!fWSo?H#p0Broud=pH9!ga;Jk3e6I5FAM6cZ~u)GN2Or z_3M|U>QIw^u*)*Dw_g$E>jio5eU&cT!$>DmI15YQ!EMtGkI;@rb41f=Qy0baB5aAJ zcUV3g>owaGLKaa=6*`C84Zld}{J)M19yxL^E2_=Bkr-<>(Xz#p-23u@v|?zp?@ zh_a3D876EFyryb|B$cfD$W%egAUc+@nc{%?oi62pcqH zQ&doRD=d5uAOWO#BZO|_tE-`$3 z(uN+UP5aWM`MNICF4eYTdNb7}V4%mf>1=-Wv>;@!%-gAoZ}EE^x9Y)18%3C1z4o&FPR3c1xbjo|ZAjRa7ZBhK&{Mw zVnP*E4vm4Z?XIy=gt7fYa)Eo$>nN@S7QK#`s7`~yTdoYWi;WzhS_xh(pi+3ADDqPb zk_&mu%j4w8r67B`2L|LI*ysR)0f>r^k8j_(eGlMIDkdh-PhnwU9=6J4y(>GA8DG$1AIK|$@=e!lL$b-R74msC<$PRm*pPpX9%Yd=<&xQbJ;2BKXNu$zpe;VC%US%=h9=4C@2JA;u$D8>^Kupd4NKS_68yHMBxSx~PupSu$ zA7RsP3k<1z=pzi+8US_Hy}(a^G#}i*hY4@C;8F%HD=fq>-n_xsNRjpcu;ao*5V=8} zM1i2(I^kZpYPRRPnAe?#-?)nfdYzz#D9c2hq<=TT&0N>C8K@({wuRH8)zJd3{ICF* zU7V)=@Ol?bRwfH_^vmvHoFP1fZyaU-k;U}%^hT`S)hn8~7Z!1904CZP zG#nu7a*(e8;}O!i9JDm@4HWI%62jM9ED6o?v$nhFq`MEk>FxN~$ZP`K4U!w+a>VL> zgz%JJv`BlmnxIGEv&h8D&>A-$JQd}>39j1NNsImXecJ21gtF>oPNd}ozG>~@}O0{e48}beuL52U%j(UMnggGuZR1@ z=k$raoxxiw3td)GC?;Wu*^tNbOKLlArJ+WxLb?Z-tzWQg0Cq*<=4g4r$vZ2VGTMVK zZ?!&}IE!2Uim!v8grTp+W+{+8`2c}%0k+M@Y7DDvQbtW}QkIg^>Nc49d_U8)1&8Fb z`FerQO{mJ9Je~K|^?cR~IyZr3Svt~-K><0!!MfIyP)04p#xPeZeUM)N9!09g_pio3 ziSS6O(Z(nIeiiFis25MAj2})A=M%CMPQTp|ZKyBf77{!e5_LXV>(m&X8%167I!jwX z<4KVNIC!Gg(Y#zbh%~y}cbCmuo>u0C5vCEM`cEj+Yh#Da7klJ-2j|Rptk%{-o_=GP zq@=aKp(8EKRTU+9S?69M*|k<)B@KQt0re*r_mgu^QPDc(9Bs4l-D(>~D$z{y_t*Ld zHQXaG{3cv8eJb4fppz83%c)$qWwjw()`68{R&#Ts9en6@_Z~UBy1GkXY|EzlC(zW_e#1{@)nCS#9V(l zY1_r{uf2z-q5F47GI?c+qhej(81C`$B}SVvD;@4jgC%H9Q^H3_Cv46OH7MiPXL)i< z#Bu#H_UL(u_gxU5N|m+h%d!aPZMcQB#@n2;jSv18cW)I{*V1*15=bBf0s(?sa0u=W zAwYm&2@oW>yTigEK!D)x?n!WWcXxMpcR#iE{=V~a+JD<=?LOU`mz_;mbFNvls>T?7 z^xmt*m(_K{hS?(uPN})QM3J#AA5!T$8MGoz>YC#{IF5t&H$nNx4sESiizB``1)l?5 z=WNqi0EH)R`S>hUl^4hO)mQ6jNe91Fw6!F&nFVQ^9KQ=y*|o%ko_(nWw)do?#MDMh zUSICMK5ntf+PHRS-p^F!XrErasqMWL#LA1LAS=E0Ytrn`>*;gciSI6o!;#2SEFc99 zZNRGeR2Nkj)1i|Nifi+^%JAgmg(u%bk!i5QgRDBep@DGw^=wESR|I2isY*9}y`S2< zFx~8&RY_PSqoI{zW=mzf&=Aj`mk^G9BT5%Xtf650j{*K3zqd)r7PZ<^6i-Waw+}5g zinXb7yOswgVa_7<%Uz_|IB~NKd2c44a~h(1(d8Ykh$#I)L-9u2LF7}9_@L+)8~yDy zoBcEnhG7OjjAEOMg;b?>Qo{#?>s2f40U8;ZpC1WMRUM5X=uZz7WI@U7Nq55P{RL-b zO#I?X-BK?2VYu;Iz<$Ca$m>#?r9St1q-;q?eigRY~E< zv;`9z8nWNCdxnpipHBrLmO-dP+26lD(p2b1+`~e08n9;s{CriV{>1z#Z7YOSH{FNp z(IXIuIVvk#kHk(f*C+eSm zP+O)$0nRl)qNnO0m4Pv{!}-bNJLpRWST*a%Wp)! z&v44G_Gj99BB?--ZBd`{p4F62;tB_Kro6K9G$U4tKL;5>t62q_L(j`svPt-X+EzD5 z$;dkSl=%xnlT$zAzQ%N(OCju(6x1s%NH~8d7zzq*nbclwk}mriw?#S;_1T#zrhf%1 z<)WhWu^c;Buz%YOVJMbjmATDxY{Au;rMaGFM@kk^9&@RV&8?-_QEv4B`RvXyb5yo$ zDoraYa*L8OJkmtp{ZHguKTibSv%{<5hO+1ds)jgN%356=<#Hy^NU=GiQ2XPhoZ0Jd z!LgD2Sf6rctyC`@X#QOx#%1x}TMDri)Hsy1Zw+8g9W90Z{C(;9z}FY~l67#St*G5!^i$Y!BUFz3h9@IEk-=F zrK_jp`;lYXdpS~4boN)XoCED)Bl0%|Bl4N*-GpNxM}p=g+v$Gd;^My`+}O;>aAU8f zGIZG!8FcZ!kIU9@ACG0F-Bg&SAr#pE#PZ(nNYZB0mk&0tlnMDxs zL}Rhq#5y}3UM)I6YW|_7^I$+hP97E>-V&?n-ZTEkVW^lAzlJY;z%HBzHmR|XV14+aq4%~nS8g7{tEx+ z>z6nm(h@@}5xDkQU&i$ZIeb)= z8@VTB&jvkjHrKnt zAV`@AP+5?T4GXJ5e|5*!`K^zzHe}yYS2a*bBEUavqSO0DNjWg=E1HoV#y3zZYiWzb zz!^E%AiliRLWDo|GjE@5RoFMymrrhiTSNcl5NFIkKhR`uPQGk+%)6GfFE}b};fY`v z80uC)Nr~(et;)+qsrLamBR ze;{v5Po}O;$uk7hijq^kA79(%gP36nN_iaLwY1lDxj5SWj=ZAf;r8|MiCpa|5xX>~ zi;Ken-J=;G7zLnW&~^<#qSt%r1aC(|-R%kxCfLivQW6{ydi`0*`v1zxmetYv#&cr@ zIWs<$tAu=-v?P!7HW+o7v6}JzK{^Jji53m6Vq7WjZWi9m|1uncLTeU0V`1m|_6anVlX$xZ~xTev?Mdh~+oYUh&n0NxU$JN9uAGho~5F&$r7~T`|=R58MvnzpP8ItW7l6v|kgq`%=*qF8>L+W<|!` zwtMK|g$3P|`+Exs(B1-VB`R84N!<$2S|i;CeJEiuhPN-}t@+y5C9I<`opJCimji=W zMqsg7#hkb%7iDs_4Gz0Sa!{mo^y-D0VTJh=I}K+2L(7=oF9^lVeXO?pid;7#Ro^8O z!vAA{sB5WTmZF2eK;aXqz6wJMo__9y9xs9_^7lEf^Xh$aJcG+BU#{W(T<({TAL6pu zcx{jTS4I#~MjuG#OE^BgwhmjVWHpx~9hjiE%chbGJ6KPYA9HjPqV#!0S>(6V)fEG! z8Ld)b`-;{4NXmX0x*x@{W}xm&ac=M$CH9z@@^pQXCo4ZgN^)|SaEHNr6#HV2qELgt zNGji&Y7bX}wF3A#)Vt{eRI6#j*68)Lysqbi09Em=T?>db;F{qL{1&+^3XDK?4WsmBa@Y2bIhE6ysHEKmEQ@(?&R>% zLP`dsX=Z64$_3s3>cvUd98Iqc>jc^+ag&+uY%y2JBt)L8y`yD}|1CE8^6rkFY(qRk zmvgslWuzJ6+2t&Jx3!MNF&c{UjBS20T(H1pG9t5+6d$+s)RoiU%uMfzJf+CwWWt8* z2{)3E>-5Z=WH=K1p%^YFLv?=UOu4uelU3zh|1tZ5YgmTXM~2ECS_Yk_GRPrT+2#YBtmIFn-hJ|fE{z;JKy6S6cYlJoSe98V<&!z9Si5$`*rA^ zh3!{Y6C9kYEfo}RzVM8a3pt?;rBkmqPGOsLz}iq?DJLhV)O3o$7a7-U?x2xu3+Vo8 z=G5q^XpJo&YmC=LV*=r-M1@QIb9VfWHS==b6$u{_d?EQ99U75@=-=D z#j4GEUyfLr%h>!!&-d_sHC0vns8U@&g8V^22@Cn+`OLR1Dh}YI_<6P1&&wcI#i5>nXQU&Vb3X+D9o5o=zlhDZ^W!laMNtTUZG2t+? zgd_OXcFUC5mePttLK6LubmN)chj4u?FMnaY^U`{$orLfE^16a*SS1RhOlV|o4u$S( zgg<*6R@HPtL&4fcf4xO=aT6!{@-~GA{0Nl7!C43tC6KJ0Ud>1ZTvplYM^NOH7 z{jnVBJs1Y`S?31(IlKX=kB2Ut}JDI49VzGbjO+5%7ONE18nH#KX;0 zyPf-b0bx|aR+ZF_)ziP9q=XOCQVSGzc8M)aaRNLkDPf*-$>Lt-T8v%hCCb240w`2I zLY@59QRIgkB`bjP@uZ6wK%{N=H)kbtcbY{7JthX?KQ+^3{G#c)e5lyN-*Q$z(!F~1 z3fgBD3n9>+W^!Yt0JvW+a-j&x)JC%>oPwev6uNS+o6VdTFer;39hHNEI6w}>91jm+ zYyboHAwA6v8+7xaP8Oi72OVDFj~_plOGfYlN@ge^td@B^x&M zsI!eg)e0Klt*xy_vE*NwtXD;Vx<(v;*Bo=N3w6k$@RO8~%bPu5&jAF5NkG!Fzi)Qf z^yIF_pj6%$LEY2c{f>slpRw`U3$zwR>j*$fC?pF$@wcEL`|sZXz(4`Ocf6oSBWxuM z6M(*;m@@b#ph5_SaD&TxCwN`H8v*24Ak^lzUWEdu0HvaoO_2hB$|WP++t*H*%%+(@ z&DrUVDu8of1F{cz;J@Xb0k|rl%LQaKps6>NG&Z|;A*ZAy23{cOQ3G@mwBG?&0x-v?rXm3W=HCm`g9~ecDF)z97RbIb z=m)6)|BX=oOB{=;M8FjRW*@++Bnvd=0SL~+%X@O;3J}lLwKdRbBw=M`oo(v;VSob< zfb#W$DuL!mZoIm-jv^(C)sdM;Ax=rZ0fWq}te-=IPf4KTD)R4eNec1y0w$AKDAC4F zZffU>6#!tMrKQtGw34`lL^{}U0T>T>Sc-Yk?d>9<-j)G!TogZVzzTYNxC0m`r?0li z-4t#yKwbfDqa*%H^RKUKFmRf(sG4r}j>9j^e=zHIS}iv}Lm?LE2Uta>I&>bSWu+17 zV+Hzv7JlRXsU$#*#Q?Pcu!V9{-4m{_9f5HMz;VGy!g|60pw!OJZg^tCXTX3Ayzu^h zDIjtK0OS{H5$d-AmqqN$%5+#z(O20G65g(iZpEyTDPK?finr~1k;tBQpjPh#XcI1n zSsYdgAQSk*fPr2HD)FteAwff+>xY3hEt8UxXayFx&PK+^Ma<0)YOH4&Vu3s9h`+h!yNu#6ksjc-aRaXa&?{(WLVksWgv)KC2Nr{SKA4dJ^#>H( zbfbSH^~)ffEGbX@Id@@ZW)8yV3<3IXR_)g3fX3tmsD0ofU!YUm0cPEvl%91q9$wDg49TmF-c(RRoxW2cua)#xnp_5&_C2l$JJN5D1ZgE+#MM z@*`N#nCVXyOx14lEwNtvB=B%9fA8)A{eI-Uyoq2mIV=|m4xn@r_}4EE>cp+BnV0T2 zIRSpP0^J$GrZvJKaT^Xu=CNS)nwXem{NoysmX_ugTQYY5y)>AdW%_+sko{@2gNUru z;<*E<6u$TZ)vDDC=YQwck6iHEy+cEWi}g;>mZHO=li!DTZ@_O8cZ1$60MldzAJ}H0 zRUNY9t62wTkSVQ&3d(%^2n(oLX$=khvlJ47$HA7a-e7HljxP4U-x!D$w88ckM8ux} z0OU}hX)}r?`)W|49LKB+ujzh60aRZ9d0D{wAkBec0|@v_oi9wl%qKXoA@7xwm&XOu z2#V+tposmm0G|Ox{2;D?E0^uopgsWp0SSa^c0)W06VM6c<9llD_x>G$A6aSi*nl9a z4@g5$l_PLO_*6&W4>*lEBeS!gMMXu+q0R`nz`|g|6f_^=0WAs8g5`%U)d$Tu&brA$ ztpLg9H4R|U)d&HeqY9W>_3g5n2Zx4ehL-zG82o<0=uhQhs585pL|Ll-(zFw7T z;azLmhx0W6aiKO_+5qb;p5KK7pTlfe3c5#6fhQ>J1sf&s5~(zsX$7PqOz^M)Kxh{S zNM_(+18k;IRxX?w?=aXhlw-i+r^p{+_;A~_zODzj1lqlQeE{dB0xfee>`|btH#RZR z0f;2fxOH@GntpcNb-&E$9>VL?tLfE&E-ZX)|G`_N3aZBeZ8X;u&;0o>iLBdYQ4&@>}=CI`-aht%rC6d*rj9= z0_k#vB$dK^L*AJy(qhO^wwns8m$_!ou(pS5gqIk7xFcCiYpiLo4BH=wFXCcMATiqGvO;381me|+;z)849hZux+b$H_WB`Kczy6S0G+cD7z2w{vVn z_sbGyP9tq|S1NnylttUZ&RTn%2zqGMF(N{bKqD@(p6$f^GsOPu+%v7^*R4SkG_GY_@U$de z3>fjo99ADpl{hcdg;wQ~T|GYG3DTSuSN!oC<-@j>)agMj|1xI2Hlgz8en-6EzBE`KFkYU)#HnlE*udNkoB?zCpFNXPYC)jFf%rX<_(fBktEp8poah^CT2Y#X94vui|h6AoO=o(?PF5Y zjLvbWpyuE(7ww8<(^uwrCLbQhr_{#?!CQP@j|&fe>G>C#;`{z6od$Qm`8LUD##(;8 zrLq>O8^RPxUiy&A02949^apd|e#fP_t%ewp)Td6;f6dFxd?XheVq3m=!7!uSxgwEc zH2%fx>!1BYJ4kpY&@BVq>Mwu)8v275PYzUxpa+;etI{&SGNV4TSWjvxlXx#J(b#C$1;8#aKvK;&_M@_XWVkXW$I;Ypj_ ziOiNM)kPw)d3)tJo#*iB$fKv}Y2Zq{&V<&67Z7tw0Fe{WjB#1?UV;vIdzYpz`Yt{Q z9UaBmZB{&toCv^;MtohJo+?jO)B>>Wae*!Z+D`t5naOTvhd`6q^mC%gH9U|~a*wAu z64gC$=;^`Zxu%4-;$3miv+)M}eew5&!wNX_rPz1rF52P)AU27z? zw0j{_T0ezxtgJ&J)Z)!sRFLVnSPeBkAp zZ3Qx25O>o7fmydJ1Zo~fhlK=EP{1DsHb;(+H(Ma@x_)qXzv#fO4V@lkEKjyPFI5MjEfKK zLoo|CsLw}vO{Iaj0px63mG%(G=)!_DSZTbF{WOsFgCyM9*|}JmPMJyUL2dbXy8RKJq_jU#PitiR-pbOccBziyCl9pju^myTxmLU*{elN7xa4k4XR0y zc|tRI(9eG@OK8kSyj;Nfq)E`RMA9|ck?>9OrYbab)ADIsmHd;%O0Vgw7hdIe{q0=| zj2_-n)KbE-IH7GKu|v%mrW1SeB6=`m17YZBKyvsFWG7(01G+=stDmiL1I{;BhW`Hk zK{(8-Ih%%@_X4A@I?omiQ`c2x`P+m;he(&y+n&yLpR{Eg1YsvMQgb3--L z^#!3@RI8BS!87qvpPqmrQohzt2O$&ptHc7ULmsEnjf*9Oo82RjOAcS|QLG#-J%TeE zLIR%g-a0B+@(%7BgY@89XYUL&l*ZpCUC~6czBQ3!0CJ(3Qfnx5{#cd7N4_Ft<}Ua`_`#6RA7z$QhsbYC~)3l^`{g%{XHngcKd{IRSx|!Q`w*J4pykI+naD@TbpZ1(j`Jv+9+WsK+nVDI%)ejCYW$TgrhWf+k5ad5`IUeF02eJ9x zT<4+e-jf8d@bz~GuX(ys`Gr);jS%Fd52W?!Q|+T@|8&{o;BxUqu__;wRLX5p62P#Q zVD4v-UTq#x+!w}($6+h^!{0t~2*ZqMfsU*WJi2a?)Wa!ODW&3mOqgT?+R$uv_d5)H ze96zBduvjGEh>UfB&lT*PfB8xNI zX7GuUm&-lhySMV4=ZB-XH>r#wW|e`s@svr5tR2F-PI~2mD3)?|ucg_7BV4~^)H8l77gal` z>m#JzdxG8FCNMHS@(8BLU#V$FM%N-!3A`V$;V``KDYzT-V`^?I&cx`X!kp z+=O}|JlEp|1eO{qf&P*H#j;TRL@Cd?PX^S@b$4!T_CDJ(wx?d@65y=t+p@O#+ zF#QY%34m_Gvu{HOG?=R@+}dCg$u0wgVHq~8>zq*|gnE+LB8=rX<GNlq(3P3Ubq$6wXK86X z)g0qm_t`_)WNB7ji#t8Gm8wbiHtTnPhtZa$1l()piNMvwva_6-e zT02iD)@ili78JN@565!XH&oxxa9Vt!#frcqEk%Uc7es)K zHw)~aNMq$fD@D{n-Url%^-qs?oP0r9Wj%ejMLgX0rHKU>+KslBeC!Ab*G3++iKtFA z_?TUA9oGH*6=%~gQH56r*0Z_dqKsAtlBL-Ykm+K7uBVJ0+#g9FyhX8J;T`SoVy8rR zRllF$9hi<7*k4lbt2LmNA04Py)Q}989eWNHS546vNj5=qpie$d(x1k#QZkQiA5Fb!Wo0EZ0*E)dgswtnCAz|Avt`(^k_<;h?R7G$#Ax^(Pai$3Kb ztf82BqSP{5%WSZ{S=FplZS%*_sdoZ1G6_w=ng6UQp=*4T%6W?$X^@#N&>a6xk75o-$8)e45gXpU4Dp_Xu7rbc<(;bO{qq9@UuUW5 z0hv*Lctbo`a;h0)lid|9RdD7SLWlA0C?HzbsDgB#77Y6MumkWP00W$Ey$r@il*=nBEZZQvH0axd9Esx8%dSo=mj{sz-6>2oJ=f3 zJp$T+u?MTd-4cu@6l6S@t15GUaE5}2l3=LOYA9crn;+0?y|aR62g8UoA!;RL>;T!2{(XxJcCBc06#Ipr@`pq@tN0^AP1`{On!J_yo! zsHrJXjR7Fev0M@Z+=p9CNEJRG^cz420sN{qC`c3(6``tO5Vrq;j%3084sC$yc6noC zBOFvIAaw?kYAry=ZEtT61HTCXRFLa%j%$dy;DhSnXM5JmZ**XA9N@q+u*u2EU3YRe z0uk^sK-~xg-IG9!!9ekokdh*&rw<0;7=ZDtd6Hwzb=x|F_x}hyqeK#B#falKr9|o4 zAcihG8^A1L*`7Azu(7r685p2=`wBEOJ_-xN0UVV;z!e9ONqh8K%{bN|b^gJ@9UC^* z=iO-ULphku`rp!F(cZlmq`E8{ssRf&^MMu&O*afc8NCxabVz{g7a;SWLWy2~P*TDM zpf%WI001uv{s&<62?=Xj5|kVaMBoOr4B?%fIn+<^;QO$A0V+-Pt^)|TVN<2sdN=H% zqwR}3h+DwI3i&uBL1K*P*GC`dFX8})qI3UH+2xxptWt*~0nmcT6yyJB^4+<-54xhB z0kPmZ?8yn@JiuB;7{GY}BJj`XTc9FTQuJrQ;0gK%4Y=b#|NH;NA80i!A}A^n`s)!w zpMcampoa;WY*rLZPXJ1D;PL$P)BjfwX0<>o40gs}M%hN;MYJGz%^X0-?Fg$w@xNRE zU{7E8_PxmAC#AdNKk5ITY4d+Es8(x2E(d*4(fnig!5_w4 zG(CJvW2Zjd^Fg0sl-Tae#fauv!_fnx#|gGaEAjo|)9S_0;JjQQCs)IghK9%5o3l-! zo6Cm!FKVumR87@8Q%;*VcqvOax|?b%B&M1SYr*xL*AqxUUU#Mo(b#FJ8cXI0g$|TR zM|zdU##GADNz)SzHUf;{^?vG;f2zu3)Kc<#^&bw)d@+|JNN;>ct54Z-1?KL`KT%gm zi`NuIdfkCY0KfDZOWdg@QI`Hd7u$kf9_QQgD+@+Hl}Kual=l2^+M9Dc3Gk%)QPCF< zd}ll^Lq}=*@l#F>mQQ_*O;R&wMb=@_^$Lm*_wLRc*0Wny{rYlrl*Y^Zn{-+i&8>J_ zVIF7Vv(wp%de_S&#v=ZzhN=)rze=_0BbzP$yJFL%ErYp#zL9%cG`t5LZmb1_JQ6*B z%K#y4{=@L1q~#z3d_X*#DLHLXMEO*sTBl@v?_e@7lnYgaRo|J1oipNH^wm}q_}4#O zckR2biGE@URdP7g+X`hQ%>CMr)HK_Zcc!%-XbFV4MUE@4G8GjY&uOj>=6eQ{i&!i- zB%`7mUNK%wFde-sD&SH*121FKsn@V!L}?Ab-f^3vkP{&R;Sp~`2BMW*EL?6X2xRl3#DvI?@$0vF}(_`afsC)r?Udi=S-WuWLGtSVJO<60Y2D5i^NW+XjM%8$Af~T-qwnh&(8mPG2g%kxeJ3B&Cx{Q}O7C$HNGaUG z|63Xn%P=p%5~`ZOwSjlA_-9ES>^CBXp+%?kkM=`)?uL`k+;0&ix!20Tk+~hZO;@q5 zRmYoi4TEV5Q^F6O6v7-}`p@9c&D?!F>3CMkl?c13ZVw;+yRTn&y&KzUM~P95<9^X@ zy75!pKWoC{`u)->d;E0+5ulRuvrV;q#PU$}5KO37V}ZabGbXX>rdr#eCkf zTB?t(A5TS~#Fo{;iVea)8v6G|nA;2J35xa%grL?0?7f_Iae4@j4oYI*Vc{>gtv<@Y zM`oNpTU$(o85*ens@Tb@gp}IBczj<^JHRtKwb_cj(yAh6A;HXezx(Z#hRb6Hp5;TC zP}b}}^Kou-{CmtNCOx<~aQXBJx{~SCB%Vq~1UlDRxU_}D`3+aDPApHO351R1~VBza}Hzbv78xQY& zBYfyo`Su_cgQpahZIMOCc0Kld^{zC5e~~QLZbY+|Xf=B?Fr(d`sFLFYbH~cd6I%5H zYocj|Zbn6uOk>coE-RF3ToDuHHAr}3<3GnR&PesrR$bOzXhzd%mPQ3G$;B+R+Pby4 zh(E~1u*s}N?>V!gh3{pj5nAu`tGNoijAc}BkJvD-+R;&L9V=4HOg=?oNGZcAGqY;E z`_=u;l|D#)%O}ls2OTfh?ZMj>+}7-~Mt`Zk8}IwrGQA#~Q4Oct%eQn&F#?etMSRjn zteS(PqLRufknF)2Q@7*lW&SKamW_b_TgaQi4>4b^7F<{ha;_o@(7xYGvqAfYt$_r-zP}H)CjRG?&7Qv$W(C(jZX zOP_h=rbn|eF0alR+0i$6sd#Q-nb5fJh4S0x@7}JsMtzVz#g|6Av6`5@Nls?B85XQ7 zH^S=rZA=Z7X}dnlUlp4PW>8EFt0~?Wl^21rCHYxN*?}DLk9Ixp z9$tZ)f349$3sn4YmDG zaw#!V-)=v~G}v64$n~67xfCfiv`NR5*4to-#!il5zw67}i{mzD-jIwEub-1gE+wZPSw`@zhxh3=Ik$4IwM zij)ShuBW{<`IGynFybN*t7LVbnI?8pUi>!V{rf+;wS~WoDWVk`)Vpr81GyX~l2jzz zFy2b<(N<>t$~YgGItfB1y^s!5dwwx7{;kk(B*S)Sd&=dK@rLrOlvvzi+5R2rR8E?k z*tb&Go>y^=K@kx)9Jxd5JxVE!S+eO41oj)J6m;|+KCS233bAeZd)tZvPn${--!RDq z5!DVKiphP>vnQfh^NPgk5_-=+VvS8ttYS`>h-3w62vbvp7TqQ&? z>KlJU3)FlTBdo4Vaqg}pX0OlV6PTWrRmE8WR(nh?zl4o5A`&AmubR^e6^y~xxW=D< zH+GoZm?=KEIrFeG*4*4ZSsp!lXEYx1g$VB8y`hbMl{69dIc-@xToR5%h)ja(bAwH6 zB~B4$Qc79Q+QfNKa^7p<9Op&UkR)5q-DJpYIN@NR8Uy@c1TLlTm%la<@KfaoY;1vn zzeN&Daq>UCP;a{Gx~dcWA<8@xtfLW%YZ!sLbhLGM3&BT(+ktoR@$Cd)XP`-W+VgObujJq<8wtvvK0>&GB0! zvH5Lesdr@x>q8oFiVfPN1)003By~nFj`CkW&N{3zif+|Abf*r)olVQfnW|wi86L=Z z1XuRt@2T$fQ4Tl-)*lxP7IOHudcI zQWBWTVK8}YVFnj;4GzLD8bk_anipc=s)osx+mR$fP~?s=mh6$HYasNS`UOFIRj-WH z>mn-zyYfd;Fb?r;6LBx3jkKz;HIwVX2PZ)KaE;D8Rk)FiDI0#gD6_X^8^>xWvmFHa zedYPf)#$6QHcplE8+7=A*@STvO05ae}{pVkp z{v15;EFK1*b3sF~NKV$i&mWSx3LGd&2ZU$^p8u92|Bcn2|I?MyJ^=RNKVkjf11Lp) z!2Wy4^2;y(yHNYTzep>Q5vTbe1?SYQ(qst2!1!q-In(#kaMJr{!CnVN;_ETC`z^py)@~midW*;(y7GF3; zuD-*6Y^Po28!VgL-gbuZ5`&svabaZudRocot7gx_O9Qp2FB|zC_3Z)#A>aG^ZfE~m z*~Pb9ZTE4M)RdyJOn%+7TeX|i9(uJ$_|Fl`&sqtMQUyGbs8!^o6gALrf9$mzv&I#w zi*=IMip%;w61~g(RiCdD69scVY^k48wr|gstV)f-v(=7>{iQWxmF_fv1qPc+2D_|d zhYij>HK&aYwi;5x!{z;N$!nnfy1eez#p01%lSWLREJ~py`kZheRJvE#X>oE>_nZKUVfgw zq%{_&%gp&Yok!uR*Tpmx6e zzOTOV_YgTlOy!|OOM_fgPWzF?eOfYH55y$|&*hVBsyy+3rb4UbcV(Bp(z04T?C9X= zeE4qVu7EGr;H8vK)LH54g{|12{eDZ6ZX(Itq5d$=ai}x3`?<{Cp6EcoCLf|77OqXS zpd2r$n{BW74U<9vINsu&mD0Y%UBtFb-?dr`?gG6t0ED55;`(aO?+QUD_^)~6^JY8% z;Gl*7Kg_zH4pV61OiajdMOU--q5c5@tp;OTB2akAP5S-tp<^BA=-Qi;I|YTeW4T>c z2ea&j(#13~W@dC-gAb3oMDgH0-HtOz^1_v-E`l`&IKG}&v+UJ_yz;ov31727^WR05 z{ro=(?*Fl9%#XmAXAym!YBzd48hF2YRTjr?6Cg!@g^)Sy#v4X=M=mp zP(@H?-M;e=PB@(@elpn9GO@4Tc51HQBGJ71%ICR9*}htNxFNFjqSJJsEC)E9&Mv=|hrmaK|$F)Lde6_3^l2jv) zIXRb{niKiJ#E#cQv!5Bu+6aT|cznjOIKPItBj4E(+%@niCF8zzb>d>uBNP+FFU055 z2=#;OZ~iUA0XI(eFpVu;m^w*bzMq!BnNmv@h;F4-X=)(Ito4&sC|QkEkI9hSqkJ-@7i#G8d4XVEm^!DRsKc zmX?|BZ1$gCM(*zGPJ~_XNKsoYfY-$PT}xHlWBaOa@)<*q%=VP5@}P4bSA9DY4K+5dQ?ZTw)5H}=upkg)q5-o(^R!XmcR zMMs><@-xN*-B8@)QhsgtPxh3bN`l$NZdFWVGbqWh9Kh`5EgC&6^td^Es%BC*Nkn$00r&u5s*{kMv9wt=o_u>E(4 zcc$mN&H0T|=Ejg6>4T^BhDMO_gg~ z!*fhhkQ%3@6nq{rS|S3ml`r6V?2)VcS(ga$NEo{uJQ(B87^PUd6bZ#r?qD093&0fU z#5gT|Y|#9;O?dh-fxVKCaVQ9BK3CwyZ20&_nwc>(Fn+0i(mWZ};W(-)MFqPgap%@@ zt2OIwfJ)d4XnII)cMOF)RFpT7K6t}kHN;K}*x{B5Od~5G zsWqPUSKdZ7BlwSxBGYn7k=|`Tj~@%WqD2$VM3#-8cxXOxS=Oe zze1XdmwIer)~`vnxYzD4tIDFG+e@6|(gwHYB*U?n2f|?~%{X9iv>txnLY5qTNvOE; z1l>`NP=bpMijEqcc6REe#6AYGFY3h@UJq8Vj6ZMC06S>mHf67ps?74Ez>o@SAAido zMO3|`soBm*q=4c3uW5wFK7z}@Y3}6dPDmTMYw!KQXpw&D80@`g{9@sfg+ZTT!h&=99;r@H34+o9wMJ1(qeU zdgZ2_=fY!RlyrcWuNW(weEv2pLygo zRt)W-hESz=2jkIZ9t^eLzdHF8J@DhSC@%#pHGNZaxW!#LNwVHf7zr#Ov z2ZumgTC{2+zQ(rWjNiZ?Ryh!VEYrB^77m{s)o~m5ywt#w)3jNz>zvFp=xVG3gRUOm z!O{S(*u{g>^zyqc_4BxaNL7Sie{qT-GsRdTw+=MS*f5)@8s(iPAtacch67!TnQ}ka zQf%Wq>z>%(CqKiSbnBDMC}0}FLwa0L?MKBTa{h(#9$(vwyFaZlBa!;}=xwP0Bh%IW zb4PS>`qv4jp9nfLM4Vj)zjwuN6{0RmQ;=X?b+#ieGLpQ_vF?7K%slkkP5C-__{v#u z$@q!|$hr7_1Zq6ql?JP8N^FK=`x<)E!T5^E7zUTvjG1O8Xw02&bv6+mvOBAb1vkig zv`wGyBCeedT;7%G!n5bLa!8@oc-v3n(AwGr0YQuIcv0pcp6*63UZ(AN%cp_QXVXb( zsSTCJu89{Ix{(tOAx&p#0-rR8f2-7t{zlx@T6Nbim8p7|z8-11@8`0fVG0^E@06uY zVb$Pu%M+up;jJ?{AFm4%bUP_OnPYx7ZM9^)rdd@Nl%T2pdTv62=agAeEoxwRXz#bn z$+r-yfoxk@R{kk|G9yv@;rH8N_xAEac@C=cLU}<0wd_w*l8xU6NR&_lyOYz5HCaU~ zWReEo|DKn^7~Y^JtNP2`KB6+cm&BDUV-lD!V@M=L|Lw8zy_nLMt%v?1_RyjXEHUii z^3ctU?|B6g1B%4@HQ$12b;b-#wi3Iz_xANfkBR1cHaDLrh8R)@Jw4QhG@rKa=>FW3 zbl6&6{1&m$B=eIk-d)Z8qsbi0%?v|^{9T`HN<9C zvKl@8inhlZE=tqAN4vW@?$uo=Z)+Z74Hr`TV%g78ueXEcoHpGT0_1MtMeZAt*H?3b zkRP|4OB*aq<_v8P9XW0M!(|Ec>K`O92kARj63(e)`nRyp4w_V4^ZZCyUZ|~V z#l{|C4^kF`j01?UQ%VzwoXJid53Yh?u1%D*^&PuOmI zSU+w$B%unNPaDGSx)8A0M{b5}-pG~t z78<^JQWV>SMJe*oltHVJPugt1Xkx+7?fd!(&>X+zH>bQ%e~8>pGiI$gqb)IP*^y8$ z4tyk{{tGSUN(;MseFJ}qj3Xr7j;pU{!6A>#xCX>*($?EPzM>z2L@<3XttU!ERxsR*lJ^PwVif%@9HfCwzmqF)3C{u@P70dnpkED#@l6}aL zO;pKkyGfF2Kiy^h&5qPzzz(_LGre%7D1krx4x%Cgc;0!P>mlcOk$lJSq-vRNzNy5n zp+o$NZ^TD(-^y#;!nkVFpl&Vpsnt5|Y;clnJR1#$KpyUh@CMa%C(F4Ut++Qt9oimH z<&QgDZu*y>Y0NGmG~Ya85D2ojXVWTGUn5ROIsf6ua3B&=eHH(mP;tOMBG`4RBaD5% zAmka3O@HvN61(FMkx`8LeC`Z-SkXf>74k7D7wiuhelD*1vZ^Upsh zxv=g?dVS_g;E)&H_+1*BuV=);C_c7AA%&8*bnfoqZ{(75k<~#(gW9p9){`n< zX@9R^SN~>;i(y-X_r3EFj2oZ$V}SiSTo>NeFdDIfJ>eDiVKCfk$jFE*yf_K-o%XA; zl_|!fm1*YgM;#GEo4#|7YH`!5SJtj`o8?LP9?KbTX9E^QZmQT=s$iT`%HAS(u2u@a zXYJ0z(Gqqgo!gi2Jcxo>nv~GxoW~CTQ{X6yrk`iaESa91j!g*Rrq1)~{rvlTL!T?P zS|^XmUg-}y#iKp|Zj741C2&N#I3iY@xmX>P?&f=fl7D5BrEf(yS8jCy@`KwC{s z+`^XE%-yQQALgIEmJm z|JUZ(et4Vz*<*!S{L2$}-+z3RU}8A$agD+M!c%gR&n~RaFRo0PQ0^WSxh;va`2L#o z_dnZD{0y;vAJd!o6cHn?|sVb-`%b}Vp8;o$G-L_ld+uV(SPpSI(P5j6y)4;^wQG> zZ+7b!Jlrg7tNYsM{rNv)_F1bM?;~U!h&N&z@~-RW@ze+<&y%{Xmt{f)jIffn%e~ zKmD4%7uc|A><(|d5wYrd+sDocV&D<7;7d2om{@G%+mI&k$#{|B|0C6Za`$bu;JFzQ z$2H-^;>_n37dXAemtF|tUCVc!S8kD7k@`l%*Pl1f5Iv|3>C`ku$%>!UJAdTE)XFV8 zZqA+7veEEjjE6nTgpS%|rLr?ezXJP-mdaPQAGqYi&wfX_P+~Nhl7|Gc6L@sK5I_((9X?X}#Niu4!5EjnQMn#Q6*&$5?JPEbndv_PKqPf6Nn@ zQ^lRGShW1|w>t0`q2Pi`z Date: Thu, 12 May 2016 12:13:06 +1000 Subject: [PATCH 251/439] move event id table around and insert new event error codes page and ref in TOC --- windows/keep-secure/TOC.md | 1 + ...ows-defender-advanced-threat-protection.md | 241 +++++++++++++++++ ...ows-defender-advanced-threat-protection.md | 250 +----------------- ...ows-defender-advanced-threat-protection.md | 12 +- 4 files changed, 257 insertions(+), 247 deletions(-) create mode 100644 windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index fe18116b84..d7bd10d059 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -423,6 +423,7 @@ ##### [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md) #### [Windows Defender ATP settings](settings-windows-defender-advanced-threat-protection.md) #### [Troubleshoot Windows Defender ATP](troubleshoot-windows-defender-advanced-threat-protection.md) +#### [Review events and errors on endpoints with Event Viewer](event-error-codes-windows-defender-advanced-threat-protection.md) ### [Windows Defender in Windows 10](windows-defender-in-windows-10.md) #### [Update and manage Windows Defender in Windows 10](get-started-with-windows-defender-for-windows-10.md) #### [Configure Windows Defender in Windows 10](configure-windows-defender-in-windows-10.md) diff --git a/windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md b/windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md new file mode 100644 index 0000000000..c4409f0fd0 --- /dev/null +++ b/windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md @@ -0,0 +1,241 @@ +--- +title: Review events and errors on endpoints with Event Viewer +description: Get descriptions and further troubleshooting steps (if required) for all events reported by the Windows Defender ATP service. +keywords: troubleshoot, event viewer, lof summary, failure code, failed, Windows Advanced Threat Protection service, cannot start, broken, can't start +search.product: eADQiWindows 10XVcnh +ms.prod: W10 +ms.mktglfcycl: deploy +ms.sitesec: library +author: iaanw +--- + + +# Review events and errors on endpoints with Event Viewer + +You can review event IDs in the [Event Viewer](https://msdn.microsoft.com/en-US/library/aa745633(v=bts.10).aspx) on individual endpoints. + +For example, if endpoints are not appearing in the **Machines view** list, you might need to look for event IDs on the endpoints. You can then use this table to determine further troubleshooting steps. + +> **Note**  It can take several days for endpoints to begin reporting to the Windows Defender ATP service. + +**Open Event Viewer and find the Windows Defender ATP service event log:** + +1. Click **Start**, type **Event Viewer**, and press **Enter**. + +2. In the log list, under **Log Summary**, scroll until you see **Microsoft-Windows-SENSE/Operational**. Double-click the item to + open the log. + + a. You can also access the log by expanding **Applications and Services Logs** > **Microsoft** > **Windows** > **SENSE** and click on **Operational**. + + > **Note**  SENSE is the internal name used to refer to the behavioral sensor that powers Windows Defender ATP. + +3. Events recorded by the service will appear in the log. See the following table for a list of events recorded by the service. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Event IDMessageDescriptionAction
    1Windows Advanced Threat Protection service started (Version ```variable```).Occurs during system start up, shut down, and during onbboarding.Normal operating notification; no action required.
    2Windows Advanced Threat Protection service shutdown.Occurs when the endpoint is shut down or offboarded.Normal operating notification; no action required.
    3Windows Advanced Threat Protection service failed to start. Failure code: ```variable```Service did not start.Review other messages to determine possible cause and troubleshooting steps.
    4Windows Advanced Threat Protection service contacted the server at ```variable```.variable = URL of the Windows Defender ATP processing servers.
    +This URL will match that seen in the Firewall or network activity.
    Normal operating notification; no action required.
    5Windows Advanced Threat Protection service failed to connect to the server at ```variable```.variable = URL of the Windows Defender ATP processing servers.
    +The service could not contact the external processing servers at that URL.
    Check the connection to the URL. See [Configure proxy and Internet connectivity](#configure-proxy-and-Internet-connectivity).
    6Windows Advanced Threat Protection service is not onboarded and no onboarding parameters were found.The endpoint did not onboard correctly and will not be reporting to the portal.Onboarding must be run before starting the service.
    +Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md).
    7Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: ```variable```The endpoint did not onboard correctly and will not be reporting to the portal.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
    8Windows Advanced Threat Protection service failed to clean its configuration. Failure code: ```variable```The endpoint did not onboard correctly and will not be reporting to the portal.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
    9Windows Advanced Threat Protection service failed to change its start type. Failure code: ```variable```The endpoint did not onboard correctly and will not be reporting to the portal.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
    10Windows Advanced Threat Protection service failed to persist the onboarding information. Failure code: ```variable```The endpoint did not onboard correctly and will not be reporting to the portal.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
    11Windows Advanced Threat Protection service completed.The endpoint onboarded correctly.Normal operating notification; no action required.
    +It may take several hours for the endpoint to appear in the portal.
    12Windows Advanced Threat Protection failed to apply the default configuration.Service was unable to apply configuration from the processing servers.This is a server error and should resolve after a short period.
    13Service machine ID calculated: ```variable```Normal operating process.Normal operating notification; no action required.
    14Service cannot calculate machine ID. Failure code: ```variable```Internal error.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
    15Windows Advanced Threat Protection cannot start command channel with URL: ```variable```variable = URL of the Windows Defender ATP processing servers.
    +The service could not contact the external processing servers at that URL.
    Check the connection to the URL. See [Configure proxy and Internet connectivity](#configure-proxy-and-Internet-connectivity).
    17Windows Advanced Threat Protection service failed to change the Connected User Experiences and Telemetry service location. Failure code: ```variable```An error occurred with the Windows telemetry service.[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled)
    +Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
    18OOBE (Windows Welcome) is completed.Service will only start after any Windows updates have finished installing.Normal operating notification; no action required.
    19OOBE (Windows Welcome) has not yet completed.Service will only start after any Windows updates have finished installing.Normal operating notification; no action required.
    +If this error persists after a system restart, ensure all Windows updates have full installed.
    20Cannot wait for OOBE (Windows Welcome) to complete. Failure code: ```variable```Internal error.If this error persists after a system restart, ensure all Windows updates have full installed.
    25Windows Advanced Threat Protection service failed to reset health status in the registry, causing the onboarding process to fail. Failure code: ```variable```The endpoint did not onboard correctly and will not be reporting to the portal.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
    26Windows Advanced Threat Protection service failed to set the onboarding status in the registry. Failure code: ```variable```The endpoint did not onboard correctly.
    +It will report to the portal, however the service may not appear as registered in SCCM or the registry.
    Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
    27Windows Advanced Threat Protection service failed to enable SENSE aware mode in Windows Defender. Onboarding process failed. Failure code: ```variable```Normally, Windows Defender will enter a special passive state if another real-time antimalware product is running properly on the endpoint, and the endpoint is reporting to Windows Defender ATP.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
    +Ensure real-time antimalware protection is running properly.
    28Windows Advanced Threat Protection Connected User Experiences and Telemetry service registration failed. Failure code: ```variable```An error occurred with the Windows telemetry service.[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
    +Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
    30Windows Advanced Threat Protection service failed to disable SENSE aware mode in Windows Defender. Failure code: ```variable```Normally, Windows Defender will enter a special passive state if another real-time antimalware product is running properly on the endpoint, and the endpoint is reporting to Windows Defender ATP.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
    +Ensure real-time antimalware protection is running properly.
    31Windows Advanced Threat Protection Connected User Experiences and Telemetry service unregistration failed. Failure code: ```variable```An error occurred with the Windows telemetry service.[Check for errors with the Windows telemetry service](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
    33Windows Advanced Threat Protection service failed to persist SENSE GUID. Failure code: ```variable```A unique identifier is used to represent each endpoint that is reporting to the portal.
    +If the identifier does not persist, the same machine might appear twice in the portal.
    Check registry permissions on the endpoint to ensure the service can update the registry.
    34Windows Advanced Threat Protection service failed to add itself as a dependency on the Connected User Experiences and Telemetry service, causing onboarding process to fail. Failure code: ```variable```An error occurred with the Windows telemetry service.[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
    +Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
    + + + +## Related topics +- [Troubleshoot Windows Defender ATP](troubleshoot-onboarding-windows-defender-advanced-threate-protection.md) +- [Windows Defender ATP service onboarding](service-onboarding-windows-defender-advanced-threat-protection.md) +- [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +- [Additional Windows Defender ATP configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md) +- [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index 92624f61fb..f73c17f06e 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -58,7 +58,7 @@ If the **OnboardingState** value is not set to **1**, you can use Event Viewer t 1. Click **Start**, type **Event Viewer**, and press **Enter**. -2. In the **Event Viewer (Local)** pane, expand the **Applications and Services Logs** section, and then browse to the **Microsoft\Windows\SENSE** directory. +2. In the **Event Viewer (Local)** pane, expand **Applications and Services Logs** > **Microsoft** > **Windows** > **SENSE**. > **Note**  SENSE is the internal name used to refer to the behavioral sensor that powers Windows Defender ATP. @@ -183,7 +183,7 @@ First, you should check that the service is set to start automatically when Wind 2. Enter the following command, and press **Enter**: - ```doscon + ```text sc qc diagtrack ``` @@ -205,13 +205,13 @@ If the **START_TYPE** is not set to **AUTO_START**, then you'll need to set the 2. Enter the following command, and press **Enter**: - ```doscon + ```text sc config diagtrack start=auto ``` 3. A success message is displayed. Verify the change by entering the following command, and press **Enter**: - ```doscon + ```text sc qc diagtrack ``` @@ -258,7 +258,7 @@ If the startup type is not set to **Automatic**, you'll need to change it so the 2. Enter the following command, and press **Enter**: - ```doscon + ```text sc query diagtrack ``` @@ -279,13 +279,13 @@ If the service **STATE** is not set to **RUNNING**, then you'll need to start it 2. Enter the following command, and press **Enter**: - ```doscon + ```text sc start diagtrack ``` 3. A success message is displayed. Verify the change by entering the following command, and press **Enter**: - ```doscon + ```text sc query diagtrack ``` @@ -329,242 +329,6 @@ To ensure that sensor has service connectivity, follow the steps described in th If the verification fails and your environment is using a proxy to connect to the Internet, then follow the steps described in [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) topic. - - -## Review events and errors on endpoints with Event Viewer - -You can review event IDs in the [Event Viewer](https://msdn.microsoft.com/en-US/library/aa745633(v=bts.10).aspx) on individual endpoints, or check the status of machines from the [Windows Defender ATP portal](https://securitycenter.windows.com/). - -For example, if endpoints are not appearing in the **Machines view** list, you might need to look for event IDs on the endpoints. - -> **Note**   It can take several days for endpoints to begin reporting to the Windows Defender ATP service. - -1. Click **Start** and type **Event Viewer**. - -2. In the log list, under **Log Summary**, scroll until you see **Microsoft-Windows-SENSE/Operational**. Double-click the item to - open the log. - - > **Note**   SENSE is the internal name used to refer to the behavioral sensor that powers Windows Defender ATP. - -3. Events recorded by the service will appear in the log. See the following table for a list of events recorded by the service. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Event IDMessageDescriptionAction
    1Windows Advanced Threat Protection service started (Version ```variable```).Occurs during system start up, shut down, and during onbboarding.Normal operating notification; no action required.
    2Windows Advanced Threat Protection service shutdown.Occurs when the endpoint is shut down or offboarded.Normal operating notification; no action required.
    3Windows Advanced Threat Protection service failed to start. Failure code: ```variable```Service did not start.Review other messages to determine possible cause and troubleshooting steps.
    4Windows Advanced Threat Protection service contacted the server at ```variable```.variable = URL of the Windows Defender ATP processing servers.
    -This URL will match that seen in the Firewall or network activity.
    Normal operating notification; no action required.
    5Windows Advanced Threat Protection service failed to connect to the server at ```variable```.variable = URL of the Windows Defender ATP processing servers.
    -The service could not contact the external processing servers at that URL.
    Check the connection to the URL. See [Configure proxy and Internet connectivity](#configure-proxy-and-Internet-connectivity).
    6Windows Advanced Threat Protection service is not onboarded and no onboarding parameters were found.The endpoint did not onboard correctly and will not be reporting to the portal.Onboarding must be run before starting the service.
    -Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md).
    7Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: ```variable```The endpoint did not onboard correctly and will not be reporting to the portal.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
    8Windows Advanced Threat Protection service failed to clean its configuration. Failure code: ```variable```The endpoint did not onboard correctly and will not be reporting to the portal.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
    9Windows Advanced Threat Protection service failed to change its start type. Failure code: ```variable```The endpoint did not onboard correctly and will not be reporting to the portal.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
    10Windows Advanced Threat Protection service failed to persist the onboarding information. Failure code: ```variable```The endpoint did not onboard correctly and will not be reporting to the portal.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
    11Windows Advanced Threat Protection service completed.The endpoint onboarded correctly.Normal operating notification; no action required.
    -It may take several hours for the endpoint to appear in the portal.
    12Windows Advanced Threat Protection failed to apply the default configuration.Service was unable to apply configuration from the processing servers.This is a server error and should resolve after a short period.
    13Service machine ID calculated: ```variable```Normal operating process.Normal operating notification; no action required.
    14Service cannot calculate machine ID. Failure code: ```variable```Internal error.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
    15Windows Advanced Threat Protection cannot start command channel with URL: ```variable```variable = URL of the Windows Defender ATP processing servers.
    -The service could not contact the external processing servers at that URL.
    Check the connection to the URL. See [Configure proxy and Internet connectivity](#configure-proxy-and-Internet-connectivity).
    17Windows Advanced Threat Protection service failed to change the Connected User Experiences and Telemetry service location. Failure code: ```variable```An error occurred with the Windows telemetry service.[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled)
    -Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
    18OOBE (Windows Welcome) is completed.Service will only start after any Windows updates have finished installing.Normal operating notification; no action required.
    19OOBE (Windows Welcome) has not yet completed.Service will only start after any Windows updates have finished installing.Normal operating notification; no action required.
    -If this error persists after a system restart, ensure all Windows updates have full installed.
    20Cannot wait for OOBE (Windows Welcome) to complete. Failure code: ```variable```Internal error.If this error persists after a system restart, ensure all Windows updates have full installed.
    25Windows Advanced Threat Protection service failed to reset health status in the registry, causing the onboarding process to fail. Failure code: ```variable```The endpoint did not onboard correctly and will not be reporting to the portal.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
    26Windows Advanced Threat Protection service failed to set the onboarding status in the registry. Failure code: ```variable```The endpoint did not onboard correctly.
    -It will report to the portal, however the service may not appear as registered in SCCM or the registry.
    Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
    27Windows Advanced Threat Protection service failed to enable SENSE aware mode in Windows Defender. Onboarding process failed. Failure code: ```variable```Normally, Windows Defender will enter a special passive state if another real-time antimalware product is running properly on the endpoint, and the endpoint is reporting to Windows Defender ATP.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
    -Ensure real-time antimalware protection is running properly.
    28Windows Advanced Threat Protection Connected User Experiences and Telemetry service registration failed. Failure code: ```variable```An error occurred with the Windows telemetry service.[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
    -Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
    29Windows Advanced Threat Protection service failed to read the offboarding parameters. Failure code: ```variable```Naama: Should I remove this error? Or just leave it as internal?TBD
    30Windows Advanced Threat Protection service failed to disable SENSE aware mode in Windows Defender. Failure code: ```variable```Normally, Windows Defender will enter a special passive state if another real-time antimalware product is running properly on the endpoint, and the endpoint is reporting to Windows Defender ATP.Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
    -Ensure real-time antimalware protection is running properly.
    31Windows Advanced Threat Protection Connected User Experiences and Telemetry service unregistration failed. Failure code: ```variable```An error occurred with the Windows telemetry service.[Check for errors with the Windows telemetry service](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
    32Windows Advanced Threat Protection service failed to request to stop itself after offboarding process. Failure code: ```variable```Naama: Should I remove this error? Or just leave it as internal?TBD
    33Windows Advanced Threat Protection service failed to persist SENSE GUID. Failure code: ```variable```A unique identifier is used to represent each endpoint that is reporting to the portal.
    -If the identifier does not persist, the same machine might appear twice in the portal.
    Check registry permissions on the endpoint to ensure the service can update the registry.
    34Windows Advanced Threat Protection service failed to add itself as a dependency on the Connected User Experiences and Telemetry service, causing onboarding process to fail. Failure code: ```variable```An error occurred with the Windows telemetry service.[Ensure the telemetry service is enabled](#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
    -Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
    35Windows Advanced Threat Protection service failed to remove itself as a dependency on the Connected User Experiences and Telemetry service. Failure code: ```variable```Naama: Should I remove this error? Or just leave it as internal?TBD
    - - [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -- [Configure Windows Defender ATP endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) +- [Configure endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) - [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) - [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md index fe674ee8ac..19b81eb45b 100644 --- a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md @@ -18,29 +18,12 @@ author: iaanw [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -You can use a System Center Configuration Manager (SCCM) package, a Group Policy (GP) configuration package, or an automated script to configure endpoints. - -## Configure with System Center Configuration Manager - -1. Open the SCCM configuration package .zip file (*WindowsATPOnboardingPackage_ConfigurationManager.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): - - a. Click **Client onboarding** on the **Navigation pane**. - - b. Select **System Center Configuration Manager**, click **Download package**, and save the .zip file. - -2. Copy the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. - -3. Import the configuration package by following the steps in the [How to Create Packages and Programs in Configuration Manager](https://technet.microsoft.com/en-us/library/gg682112.aspx#BKMK_Import) topic. - -4. Deploy the package by following the steps in the [How to Deploy Packages and Programs in Configuration Manager](https://technet.microsoft.com/en-us/library/gg682178.aspx) topic. - - a. Choose a predefined device collection to deploy the package to. - +You can use a Group Policy (GP) configuration package, a System Center Configuration Manager (SCCM) package, or an automated script to configure endpoints. ## Configure with Group Policy Using the GP configuration package ensures your endpoints will be correctly configured to report to the Windows Defender ATP service. -> **Note**  To use GP updates to deploy the package, you must be on Windows Server 2008 R2 or later. The endpoints must be running Windows 10 build 14332. +> **Note**  To use GP updates to deploy the package, you must be on Windows Server 2008 R2 or later. The endpoints must be running Windows 10 Build 14332 or later. 1. Open the GP configuration package .zip file (*WindowsATPOnboardingPackage_GroupPolicy.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): @@ -66,6 +49,24 @@ Using the GP configuration package ensures your endpoints will be correctly conf For additional settings, see the [Additional configuration settings section](additional-configuration-windows-defender-advanced-threat-protection.md). + +## Configure with System Center Configuration Manager + +1. Open the SCCM configuration package .zip file (*WindowsATPOnboardingPackage_ConfigurationManager.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): + + a. Click **Client onboarding** on the **Navigation pane**. + + b. Select **System Center Configuration Manager**, click **Download package**, and save the .zip file. + +2. Copy the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. + +3. Import the configuration package by following the steps in the [How to Create Packages and Programs in Configuration Manager](https://technet.microsoft.com/en-us/library/gg682112.aspx#BKMK_Import) topic. + +4. Deploy the package by following the steps in the [How to Deploy Packages and Programs in Configuration Manager](https://technet.microsoft.com/en-us/library/gg682178.aspx) topic. + + a. Choose a predefined device collection to deploy the package to. + + ## Configure endpoints individually with an automated script
    You can also manually onboard individual endpoints to Windows Defender ATP. You might want to do this first when testing the service before you commit to onboarding all endpoints in your network. @@ -95,7 +96,8 @@ You can also manually onboard individual endpoints to Windows Defender ATP. You See the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) topic for details on how you can manually validate that the endpoint is compliant and correctly reports telemetry. ## Related topics -- [Windows Defender ATP service onboarding](service-onboarding-windows-defender-advanced-threat-protection.md) + +- [Configure endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) - [Additional Windows Defender ATP configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md) - [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) - [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md index 6d982083d4..71a479e614 100644 --- a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md @@ -1,5 +1,5 @@ --- -title: Configure Windows Defender ATP endpoint proxy and Internet connection +title: Configure Windows Defender ATP endpoint proxy and Internet connection settings description: Configure the Windows Defender ATP proxy and internet settings to enable communication with the cloud service. keywords: configure, proxy, internet, internet connectivity, settings, proxy settings search.product: eADQiWindows 10XVcnh @@ -10,7 +10,7 @@ author: mjcaparas --- -# Configure Windows Defender ATP endpoint proxy and Internet connectivity settings +# Configure endpoint proxy and Internet connectivity settings **Applies to:** @@ -179,6 +179,7 @@ If the any of the verification steps indicate a fail, then verify that you have ## Related topics - [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +- [Configure endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) - [Additional Windows Defender ATP configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md) - [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) - [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md index 980770723a..3108e3739c 100644 --- a/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md @@ -60,6 +60,6 @@ If there are failed deployments (endpoints with **Error**, **Requirements Not Me ## Related topics - [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -- [Configure Windows Defender ATP endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) +- [Configure endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) - [Additional Windows Defender ATP configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md) - [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index 4fd8e33080..ace80e960e 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -81,7 +81,7 @@ Event ID | Message | Resolution steps ### Ensure the Windows Defender ATP service is enabled -If the endpoints aren't reporting correctly, you might need to check that the Windows Defender ATP service is set to automatically start and is running on the endpoint. +If the endpoints aren't reporting correctly, you might need to check that the Windows Defender ATP service is set to automatically start and is running on the endpoint. You can use the SC command line program for checking and managing the startup type and running state of the service. @@ -314,7 +314,7 @@ If the service is not running, you'll need to start it. 2. Scroll through the list of services until you find **Connected User Experiences and Telemetry**. -3. Right-click on the entry and click **Start**, as shown in the following image. +3. Right-click on the entry and click **Start**, as shown in the following image. ![Select Start to start the service](images/windef-utc-console-start.png) @@ -362,7 +362,8 @@ Log in to the application in the Azure Management Portal again: --> ## Related topics -- [Windows Defender ATP service onboarding](service-onboarding-windows-defender-advanced-threat-protection.md) + - [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +- [Configure endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) - [Additional Windows Defender ATP configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md) - [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) From eb93d961706f27cfe6a136607d29f7a63a0732b9 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 12 May 2016 14:41:21 +1000 Subject: [PATCH 258/439] comment out service onboarding, add config proxy and internet settings, update product name, --- ...rror-codes-windows-defender-advanced-threat-protection.md | 5 +++-- ...quirements-windows-defender-advanced-threat-protection.md | 2 +- ...l-overview-windows-defender-advanced-threat-protection.md | 2 +- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md b/windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md index 638e1c61c8..13edaed0e6 100644 --- a/windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md @@ -241,8 +241,9 @@ See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defen ## Related topics -- [Troubleshoot Windows Defender ATP](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) -- [Windows Defender ATP service onboarding](service-onboarding-windows-defender-advanced-threat-protection.md) + - [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +- [Configure endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) - [Additional Windows Defender ATP configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md) - [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) +- [Troubleshoot Windows Defender ATP](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md index 1e0c645688..fa17f2947f 100644 --- a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -34,7 +34,7 @@ When you run the onboarding wizard for the first time, you must choose where you - Review the [Windows Defender ATP data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) for more information on where and how Microsoft stores your data. ### Endpoint hardware and software requirements -Endpoints on your network must be running the pre-release version of Windows build 14332 or greater. The hardware requirements for Windows Defender ATP on endpoints is the same as those for Windows build 14332. +Endpoints on your network must be running Windows 10 Insider Preview Build 14332 or later. The hardware requirements for Windows Defender ATP on endpoints is the same as those for Windows 10 Insider Preview Build 14332 or later. > **Note**  Endpoints that are running Windows Server and mobile versions of Windows are not supported. diff --git a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md index d626dca677..01d5a3cd63 100644 --- a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md @@ -47,7 +47,7 @@ Area | Description **Dashboard** | Provides clickable tiles that open detailed information on various alerts that have been detected in your organization. **Alerts queue** | Enables you to view separate queues of new, in progress, and resolved alerts. **Machines view**| Displays the list of machines that are onboarded to Windows Defender ATP, some information about them, and the corresponding number of alerts. -**Preferences setup**| Shows the settings you selected during [service onboarding](service-onboarding-windows-defender-advanced-threat-protection.md), and lets you update your industry preferences and retention policy period. +**Preferences setup**| Shows the settings you selected and lets you update your industry preferences and retention policy period. **Client onboarding**| Allows you to download the onboarding configuration package. (3) Main portal| Main area where you will see the different views such as the Dashboard, Alerts queue, and Machines view. (4) Search | Search for machines, files, external IP Addresses, or domains across endpoints. The drop-down combo box allows you to select the entity type. From 7acdfc7bf008fe3b62530c15eb64dabd2dd2d9a0 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 12 May 2016 14:55:14 +1000 Subject: [PATCH 259/439] remove space after nbsp; --- ...view-windows-defender-advanced-threat-protection.md | 2 +- ...ding-windows-defender-advanced-threat-protection.md | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md index 01d5a3cd63..0c95e4abf7 100644 --- a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md @@ -36,7 +36,7 @@ When you open the portal, you’ll see the main areas of the application: ![Windows Defender Advanced Threat Protection portal](images/portal-image.png) -> **Note**   Malware related detections will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/en-us/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product. +> **Note**  Malware related detections will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/en-us/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product. You can navigate through the portal using the menu options available in all sections. Refer to the following table for a description of each section. diff --git a/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md index 12a216c4f4..eba16ede92 100644 --- a/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md @@ -27,7 +27,7 @@ You have to assign users to the Windows Defender ATP Service application in Azur have users assigned to the Windows ATP Service application, you will be directed to open the [Microsoft Azure Dashboard](https://portal.azure.com) to manage user access. - > **Note**   In AAD, a directory is essentially a tenant. See the [Azure AD documentation](https://msdn.microsoft.com/en-us/library/azure/jj573650.aspx) for more information on how tenants work with AAD. + > **Note**  In AAD, a directory is essentially a tenant. See the [Azure AD documentation](https://msdn.microsoft.com/en-us/library/azure/jj573650.aspx) for more information on how tenants work with AAD. 2. Ensure you have logged in to Microsoft Azure with an account that has permissions to assign users to an application in AAD. You might @@ -74,7 +74,7 @@ You have to assign users to the Windows Defender ATP Service application in Azur ![Example selected organization in Azure Active Directory](images/contoso-application.png) - > **Note**   The application might have a slightly different name than the one shown here. It might be called **Windows Defender ATP Service**. + > **Note**  The application might have a slightly different name than the one shown here. It might be called **Windows Defender ATP Service**. 8. Click **Users** from the top menu bar. A list of users that are in the directory is displayed. @@ -82,7 +82,7 @@ You have to assign users to the Windows Defender ATP Service application in Azur ![Example user assignment to the windows atp service](images/assign-users.png) - > **Note**   If you do not normally work with AAD, you might not see any users in the directory, or we might have created a test tenant specifically for a single user’s account. See the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) section for instructions on adding users to a directory. + > **Note**  If you do not normally work with AAD, you might not see any users in the directory, or we might have created a test tenant specifically for a single user’s account. See the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) section for instructions on adding users to a directory. 9. Select the user you want manage. @@ -100,11 +100,11 @@ You have to assign users to the Windows Defender ATP Service application in Azur 14. To remove the access for all users, click **Manage access**. If you click **Complete** ![Complete icon](images/check-icon.png), you will not see the Windows ATP Service in the list of applications in your directory. - > **Note**   If you want to give access to users again, see the Manage access for all users in Azure Active Directory topic in [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md). + > **Note**  If you want to give access to users again, see the Manage access for all users in Azure Active Directory topic in [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md). 15. You can continue assigning roles for other users in your organization now, or you can return to the Windows Defender ATP portal to complete the service onboarding wizard. - > **Note**   You need to assign roles for every user in your organization that requires access to the Windows Defender ATP portal. You can assign roles at any time by going to the Azure Management Portal, clicking **Active Directory**, and then finding your directory in the list and following the steps above. + > **Note**  You need to assign roles for every user in your organization that requires access to the Windows Defender ATP portal. You can assign roles at any time by going to the Azure Management Portal, clicking **Active Directory**, and then finding your directory in the list and following the steps above. When you have finished assigning roles, return to the [Windows Defender ATP portal](https://securitycenter.windows.com) and refresh the page. From 8d6f5f779b88a6590f37ae21f2fd8d11df39f0f5 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 12 May 2016 15:10:35 +1000 Subject: [PATCH 260/439] remove reference to azure --- ...ot-onboarding-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index ace80e960e..152818fbdd 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- title: Troubleshoot Windows Defender ATP onboarding issues description: Troubleshoot issues that might arise during the onboarding of endpoints or to the Windows Defender ATP service. -keywords: troubleshoot onboarding, onboarding issues, event viewer, azure management portal, data collection and preview builds +keywords: troubleshoot onboarding, onboarding issues, event viewer, data collection and preview builds search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy From fde789968e385d3d1323d67c836324837964a959 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 12 May 2016 16:16:26 +1000 Subject: [PATCH 261/439] add Applies to, change apt to sentence case --- ...tigate-alerts-windows-defender-advanced-threat-protection.md | 2 +- .../keep-secure/windows-defender-advanced-threat-protection.md | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md index 0fa1932083..02e10c15b7 100644 --- a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md @@ -23,7 +23,7 @@ There are three alert severity levels, described in the following table. Alert severity | Description :---|:--- -High (Red) | Threats often associated with Advanced Persistent Threats (APT). These alerts indicate a high risk due to the severity of damage they can inflict on endpoints. +High (Red) | Threats often associated with advanced persistent threats (APT). These alerts indicate a high risk due to the severity of damage they can inflict on endpoints. Medium (Orange) | Threats rarely observed in the organization, such as anomalous registry change, execution of suspicious files, and observed behaviors typical of attack stages. Low (Yellow) | Threats associated with prevalent malware and hack-tools that do not appear to indicate an advanced threat targeting the organization. diff --git a/windows/keep-secure/windows-defender-advanced-threat-protection.md b/windows/keep-secure/windows-defender-advanced-threat-protection.md index fac98431c9..8a38ee3156 100644 --- a/windows/keep-secure/windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/windows-defender-advanced-threat-protection.md @@ -14,6 +14,7 @@ author: mjcaparas **Applies to:** - Windows 10 Insider Preview Build 14332 or later +- Windows Defender Advanced Threat Protection (Windows Defender ATP) [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] From c3008347117123b72c7e297aba6f7efaaf10e012 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 12 May 2016 17:59:21 +1000 Subject: [PATCH 262/439] update product name --- ...ure-endpoints-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md index 19b81eb45b..2a04c01d4c 100644 --- a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md @@ -23,7 +23,7 @@ You can use a Group Policy (GP) configuration package, a System Center Configura ## Configure with Group Policy Using the GP configuration package ensures your endpoints will be correctly configured to report to the Windows Defender ATP service. -> **Note**  To use GP updates to deploy the package, you must be on Windows Server 2008 R2 or later. The endpoints must be running Windows 10 Build 14332 or later. +> **Note**  To use GP updates to deploy the package, you must be on Windows Server 2008 R2 or later. The endpoints must be running Windows 10 Insider Preview Build 14332 or later. 1. Open the GP configuration package .zip file (*WindowsATPOnboardingPackage_GroupPolicy.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): From cc22b6da1993ee1cce3ebea191127500b0642a25 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 12 May 2016 18:29:39 +1000 Subject: [PATCH 263/439] clean ups --- ...ts-queue-windows-defender-advanced-threat-protection.md | 7 +++---- ...internet-windows-defender-advanced-threat-protection.md | 3 +-- ...te-files-windows-defender-advanced-threat-protection.md | 2 +- ...overview-windows-defender-advanced-threat-protection.md | 2 +- ...settings-windows-defender-advanced-threat-protection.md | 2 +- ...bleshoot-windows-defender-advanced-threat-protection.md | 1 + .../windows-defender-advanced-threat-protection.md | 1 + 7 files changed, 9 insertions(+), 9 deletions(-) diff --git a/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md b/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md index 3b3d8aa7ce..f9dea0c4a4 100644 --- a/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md @@ -46,9 +46,9 @@ There are three mechanisms to pivot the queue against: 2. Filter alerts by their **Severity** by opening the drop-down menu in the **Filter by** field and selecting one or more of the check boxes: - - High (Red) - Threats often associated with advanced persistent threat (APT). These alerts pose a high risk due to the severity of the damage they might inflict on endpoints. - - Medium (Orange) - Threats considered to be abnormal or suspicious in nature such as anomalous registry modifications and loading of executable files. - - Low (Yellow) - Threats associated with prevalent malware and hack-tools that pose a lower risk to endpoints. + - High (Red) - Threats often associated with advanced persistent threats (APT). These alerts indicate a high risk due to the severity of damage they can inflict on endpoints. + - Medium (Orange) - Threats rarely observed in the organization, such as anomalous registry change, execution of suspicious files, and observed behaviors typical of attack stages. + - Low (Yellow) - Threats associated with prevalent malware and hack-tools that do not appear to indicate an advanced threat targeting the organization. 3. Limit the queue to see alerts from various set periods by clicking the drop-down menu in the date range field (by default, this is selected as **6 months**): @@ -62,7 +62,6 @@ There are three mechanisms to pivot the queue against: ### Related topics - [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) -- [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) - [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) - [Investigate machines in the Windows Defender ATP Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) - [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md index 71a479e614..987a8d74de 100644 --- a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md @@ -109,7 +109,7 @@ After configuring the endpoints, you'll need to verify that the correct proxy se netsh winhttp show proxy ``` -For more information on how to use Netsh see, [https://technet.microsoft.com/en-us/library/cc731131(v=ws.10).aspx](https://technet.microsoft.com/en-us/library/cc731131(v=ws.10).aspx) +For more information on how to use Netsh see, [Netsh Commands for Windows Hypertext Transfer Protocol (WINHTTP)](https://technet.microsoft.com/en-us/library/cc731131(v=ws.10).aspx) ## Enable access to Windows Defender ATP service URLs in the proxy server @@ -179,7 +179,6 @@ If the any of the verification steps indicate a fail, then verify that you have ## Related topics - [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -- [Configure endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) - [Additional Windows Defender ATP configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md) - [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) - [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md index 2a7ebff2f7..fa6d41a65c 100644 --- a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md @@ -120,7 +120,7 @@ HKLM\SOFTWARE\Policies\Microsoft\Sense\AllowSampleCollection Value = 0 - block sample collection Value = 1 - allow sample collection ``` -5. Change the organizational unit through the GPO. See [Configure with Group Policy](additional-configuration-windows-defender-advanced-threat-protection.md#configure-with-group-policy). +5. Change the organizational unit through the Group Policy. See [Configure with Group Policy](additional-configuration-windows-defender-advanced-threat-protection.md#configure-with-group-policy). 6. If these steps do not resolve the issue, contact [winatp@microsoft.com](mailto:winatp@microsoft.com). > **Note**  If the value *AllowSampleCollection* is not available, the client will allow sample collection by default. diff --git a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md index 0c95e4abf7..b5dae385ac 100644 --- a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md @@ -14,7 +14,7 @@ author: DulceMV **Applies to:** - Windows 10 Insider Preview Build 14332 or later -Windows Defender Advanced Threat Protection (Windows Defender ATP) +- Windows Defender Advanced Threat Protection (Windows Defender ATP) [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] diff --git a/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md b/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md index 1e34eed266..6c0752a2bc 100644 --- a/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md @@ -32,7 +32,7 @@ Your current time zone setting is shown in the Windows Defender ATP menu. You ca ### UTC time zone Windows Defender ATP uses UTC time by default. -Setting the Windows Defender ATP time zone to UTC will display all system timestamps (alerts, events, etc.) in UTC for all users. Choosing this setting means that all users will see the same timestamps in Windows Defender ATP, regardless of their regional settings. This can help security analysts working in different locations across the globe to use the same time stamps while investigating events. +Setting the Windows Defender ATP time zone to UTC will display all system timestamps (alerts, events, and others) in UTC for all users. Choosing this setting means that all users will see the same timestamps in Windows Defender ATP, regardless of their regional settings. This can help security analysts working in different locations across the globe to use the same time stamps while investigating events. ### Local time zone You can choose to have Windows Defender ATP use local time zone settings. All alerts and events will be displayed using your local time zone. diff --git a/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md index 324896ea60..4c2347e870 100644 --- a/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md @@ -51,3 +51,4 @@ See the topic [Review events and errors on endpoints with Event Viewer](event-er ### Related topic - [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) +- [Review events and errors on endpoints with Event Viewer](event-error-codes-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/windows-defender-advanced-threat-protection.md b/windows/keep-secure/windows-defender-advanced-threat-protection.md index 8a38ee3156..b7e191b23b 100644 --- a/windows/keep-secure/windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/windows-defender-advanced-threat-protection.md @@ -83,3 +83,4 @@ Topic | Description [Use the Windows Defender Advanced Threat Protection portal](use-windows-defender-advanced-threat-protection.md) | Learn about the capabilities of Windows Defender ATP to help you investigate alerts that might be indicators of possible breaches in your enterprise. [Windows Defender Advanced Threat Protection settings](settings-windows-defender-advanced-threat-protection.md) | Learn about setting the time zone and configuring the suppression rules to configure the service to your requirements. [Troubleshoot Windows Defender Advanced Threat Protection](troubleshoot-windows-defender-advanced-threat-protection.md) | This topic contains information to help IT Pros find workarounds for the known issues and troubleshoot issues in Windows Defender ATP. +[Review events and errors on endpoints with Event Viewer](event-error-codes-windows-defender-advanced-threat-protection.md)| Review events and errors associated with event IDs to determine if further troubleshooting steps are required. From 04bf9dff0aed29adeedfa2b5b58b93d8c4e8643d Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 12 May 2016 06:58:36 -0700 Subject: [PATCH 264/439] fixed link --- education/windows/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/education/windows/index.md b/education/windows/index.md index 8bfca9f8a3..7d202e116d 100644 --- a/education/windows/index.md +++ b/education/windows/index.md @@ -17,4 +17,4 @@ Learn about using Windows 10 in schools. | tbd | tbd | ## Related topics -- [Windows 10 and Windows 10 Mobile](../index.md) \ No newline at end of file +- [Windows 10 and Windows 10 Mobile](https://technet.microsoft.com/itpro/windows/index) \ No newline at end of file From 43083f00e760c6023521f196daebc81c364b4d6a Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 12 May 2016 07:37:13 -0700 Subject: [PATCH 265/439] copied 2 edu topics from win10 --- education/windows/TOC.md | 4 +- .../windows/chromebook-migration-guide.md | 962 +++++++++++++ .../windows/deploy-windows-10-in-a-school.md | 1264 +++++++++++++++++ education/windows/index.md | 3 +- 4 files changed, 2231 insertions(+), 2 deletions(-) create mode 100644 education/windows/chromebook-migration-guide.md create mode 100644 education/windows/deploy-windows-10-in-a-school.md diff --git a/education/windows/TOC.md b/education/windows/TOC.md index 364dd264fa..f02d261fd6 100644 --- a/education/windows/TOC.md +++ b/education/windows/TOC.md @@ -1 +1,3 @@ -# [Windows 10 for education](index.md) \ No newline at end of file +# [Windows 10 for education](index.md) +## [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) +## [Chromebook migration guide](chromebook-migration-guide.md) \ No newline at end of file diff --git a/education/windows/chromebook-migration-guide.md b/education/windows/chromebook-migration-guide.md new file mode 100644 index 0000000000..e56979fdef --- /dev/null +++ b/education/windows/chromebook-migration-guide.md @@ -0,0 +1,962 @@ +--- +title: Chromebook migration guide (Windows 10) +description: In this guide you will learn how to migrate a Google Chromebook-based learning environment to a Windows 10-based learning environment. +ms.assetid: 7A1FA48A-C44A-4F59-B895-86D4D77F8BEA +keywords: ["migrate", "automate", "device"] +ms.prod: W10 +ms.mktglfcycl: plan +ms.sitesec: library +author: craigash +--- + +# Chromebook migration guide + + +**Applies to** + +- Windows 10 + +In this guide you will learn how to migrate a Google Chromebook-based learning environment to a Windows 10-based learning environment. You will learn how to perform the necessary planning steps, including Windows device deployment, migration of user and device settings, app migration or replacement, and cloud storage migration. You will then learn the best method to perform the migration by using automated deployment and migration tools. + +## Plan Chromebook migration + + +Before you begin to migrate Chromebook devices, plan your migration. As with most projects, there can be an urge to immediately start doing before planning. When you plan your Chromebook migration before you perform the migration, you can save countless hours of frustration and mistakes during the migration process. + +In the planning portion of this guide, you will identify all the decisions that you need to make and how to make each decision. At the end of the planning section, you will have a list of information you need to collect and what you need to do with the information. You will be ready to perform your Chromebook migration. + +## Plan for app migration or replacement + + +App migration or replacement is an essential part of your Chromebook migration. In this section you will plan how you will migrate or replace Chromebook (Chrome OS) apps that are currently in use with the same or equivalent Windows apps. At the end of this section, you will have a list of the active Chrome OS apps and the Windows app counterparts. + +**Identify the apps currently in use on Chromebook devices** + +Before you can do any analysis or make decisions about which apps to migrate or replace, you need to identify which apps are currently in use on the Chromebook devices. You will create a list of apps that are currently in use (also called an app portfolio). + +**Note**   +The majority of Chromebook apps are web apps. For these apps you need to first perform Microsoft Edge compatibility testing and then publish the web app URL to the Windows users. For more information, see the [Perform app compatibility testing for web apps](#perform-testing-webapps) section. + +  + +You can divide the apps into the following categories: + +- **Apps installed and managed by the institution.** These apps are typically managed in the Apps section in the Google Admin Console. You can record the list of these apps in your app portfolio. + +- **Apps installed by faculty or students.** Faculty or students might have installed these apps as a part of a classroom curriculum. Obtain the list of these apps from faculty or students. Ensure you only record apps that are legitimately used as a part of classroom curriculum (and not for personal entertainment or use). + +Record the following information about each app in your app portfolio: + +- App name + +- App type (such as offline app, online app, web app, and so on) + +- App publisher or developer + +- App version currently in use + +- App priority (how necessary is the app to the day-to-day process of the institution or a classroom? Rank as high, medium, or low) + +Throughout the entire app migration or replacement process, focus on the higher priority apps. Focus on lower priority apps only after you have determined what you will do with the higher priority apps. + +### + +**Select Google Apps replacements** + +Table 1 lists the Windows device app replacements for the common Google Apps on Chromebook devices. If your users rely on any of these Google Apps, use the corresponding app on the Windows device. Use the information in Table 1 to select the Google App replacement on a Windows device. + +Table 1. Google App replacements + +| If you use this Google app on a Chromebook | Use this app on a Windows device | +|--------------------------------------------|--------------------------------------| +| Google Docs | Word 2016 or Word Online | +| Google Sheets | Excel 2016 or Excel Online | +| Google Slides | PowerPoint 2016 or PowerPoint Online | +| Google Apps Gmail | Outlook 2016 or Outlook Web App | +| Google Hangouts | Microsoft Skype for Business | +| Chrome | Microsoft Edge | +| Google Drive | Microsoft OneDrive for Business | + +  + +It may be that you will decide to replace Google Apps after you deploy Windows devices. For more information on making this decision, see the [Select cloud services migration strategy](#select-cs-migrationstrat) section of this guide. + +**Find the same or similar apps in the Windows Store** + +In many instances, software vendors will create a version of their app for multiple platforms. You can search the Windows Store to find the same or similar apps to any apps not identified in the [Select Google Apps replacements](#select-googleapps) section. + +In other instances, the offline app does not have a version written for the Windows Store or is not a web app. In these cases, look for an app that provides similar functions. For example, you might have a graphing calculator offline Android app published on the Chrome OS, but the software publisher does not have a version for Windows devices. Search the Windows Store for a graphing calculator app that provides similar features and functionality. Use that Windows Store app as a replacement for the graphing calculator offline Android app published on the Chrome OS. + +Record the Windows app that replaces the Chromebook app in your app portfolio. + +### + +**Perform app compatibility testing for web apps** + +The majority of Chromebook apps are web apps. Because you cannot run native offline Chromebook apps on a Windows device, there is no reason to perform app compatibility testing for offline Chromebook apps. However, you may have a number of web apps that will run on both platforms. + +Ensure that you test these web apps in Microsoft Edge. Record the level of compatibility for each web app in Microsoft Edge in your app portfolio. + +## Plan for migration of user and device settings + + +Some institutions have configured the Chromebook devices to make the devices easier to use by using the Google Chrome Admin Console. You have also probably configured the Chromebook devices to help ensure the user data access and ensure that the devices themselves are secure by using the Google Chrome Admin Console. + +However, in addition to your centralized configuration in the Google Admin Console, Chromebook users have probably customized their device. In some instances, users may have changed the web content that is displayed when the Chrome browser starts. Or they may have bookmarked websites for future reference. Or users may have installed apps for use in the classroom. + +In this section, you will identify the user and device configuration settings for your Chromebook users and devices. Then you will prioritize these settings to focus on the configuration settings that are essential to your educational institution. + +At the end of this section, you should have a list of Chromebook user and device settings that you want to migrate to Windows, as well as a level of priority for each setting. You may discover at the end of this section that you have few or no higher priority settings to be migrated. If this is the case, you can skip the [Perform migration of user and device settings](#migrate-user-device-settings) section of this guide. + +**Identify Google Admin Console settings to migrate** + +You use the Google Admin Console (as shown in Figure 1) to manage user and device settings. These settings are applied to all the Chromebook devices in your institution that are enrolled in the Google Admin Console. Review the user and device settings in the Google Admin Console and determine which settings are appropriate for your Windows devices. + +![figure 1](images/chromebook-fig1-googleadmin.png) + +Figure 1. Google Admin Console + +Table 2 lists the settings in the Device Management node in the Google Admin Console. Review the settings and determine which settings you will migrate to Windows. + +Table 2. Settings in the Device Management node in the Google Admin Console + + ++++ + + + + + + + + + + + + + + + + + + + + +
    SectionSettings
    Network

    These settings configure the network connections for Chromebook devices and include the following settings categories:

    +
      +
    • Wi-Fi. Configures the Wi-Fi connections that are available. The Windows devices will need these configuration settings to connect to the same Wi-Fi networks.

    • +
    • Ethernet. Configures authentication for secured, wired Ethernet connections (802.1x). The Windows devices will need these configuration settings to connect to the network.

    • +
    • VPN. Specifies the VPN network connections used by devices when not directly connected to your intranet. The Windows devices will need the same VPN network connections for users to remotely connect to your intranet.

    • +
    • Certificates. Contains the certificates used for network authentication. The Windows devices will need these certificates to connect to the network.

    • +
    Mobile

    These settings configure and manage companion devices (such as smartphones or tablets) that are used in conjunction with the Chromebook devices and include the following settings categories:

    +
      +
    • Device management settings. Configures settings for mobile (companion) devices, such as device synchronization, password settings, auditing, enable remote wipe, and other settings. Record these settings so that you can ensure the same settings are applied when the devices are being managed by Microsoft Intune or another mobile device management (MDM) provider.

    • +
    • Device activation. Contains a list of mobile (companion) devices that need to be approved for management by using the Google Admin Console. Approve or block any devices in this list so that the list of managed devices accurately reflects active managed devices.

    • +
    • Managed devices. Performs management tasks on mobile (companion) devices that are managed by the Google Admin Console. Record the list of companion devices on this page so that you can ensure the same devices are managed by Intune or another MDM provider.

    • +
    • Set Up Apple Push Certificate. Configures the certificate that is essentially the digital signature that lets the Google Admin Console manage iOS devices. You will need this certificate if you plan to manage iOS devices by using Intune or another MDM provider.

    • +
    • Set Up Android for Work. Authorizes the Google Admin Console to be the MDM provider for Android devices by providing an Enterprise Mobility Management (EMM) token. You will need this token if you plan to manage Android devices by using another MDM provider.

    • +
    Chrome management

    These settings configure and manage companion devices (such as smartphones or tablets) that are used in conjunction with the Chromebook devices and include the following settings categories:

    +
      +
    • User settings. Configures user-based settings for the Chrome browser and Chromebook devices. Most of these Chromebook user-based settings can be mapped to a corresponding setting in Windows. Record the settings and then map them to settings in Group Policy or Intune.

    • +
    • Public session settings. Configures Public Sessions for Chrome devices that are used as kiosks, loaner devices, shared computers, or for any other work or school-related purpose for which users don't need to sign in with their credentials. You can configure Windows devices similarly by using Assigned Access. Record the settings and apps that are available in Public Sessions so that you can provide similar configuration in Assigned Access.

    • +
    • Device settings. Configures device-based settings for the Chrome browser and Chromebook devices. You can map most of these Chromebook device-based settings to a corresponding setting in Windows. Record the settings and then map them to settings in Group Policy or Intune.

    • +
    • Devices. Manages Chrome device management licenses. The number of licenses recorded here should correspond to the number of licenses you will need for your new management system, such as Intune. Record the number of licenses and use those to determine how many licenses you will need to manage your Windows devices.

    • +
    • App Management. Provides configuration settings for Chrome apps. Record the settings for any apps that you have identified that will run on Windows devices.

    • +
    + +  + +Table 3 lists the settings in the Security node in the Google Admin Console. Review the settings and determine which settings you will migrate to Windows. + +Table 3. Settings in the Security node in the Google Admin Console + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    SectionSettings

    Basic settings

    These settings configure password management and whether or not two-factor authentication (2FA) is configured. You can set the minimum password length, the maximum password length, if non-admin users can recover their own passwords, and enable 2FA.

    +

    Record these settings and use them to help configure your on-premises Active Directory or Azure Active Directory (Azure AD) to mirror the current behavior of your Chromebook environment.

    Password monitoring

    This section is used to monitor the strength of user passwords. You don’t need to migrate any settings in this section.

    API reference

    This section is used to enable access to various Google Apps Administrative APIs. You don’t need to migrate any settings in this section.

    Set up single sign-on (SSO)

    This section is used to configure SSO for Google web-based apps (such as Google Apps Gmail or Google Apps Calendar). While you don’t need to migrate any settings in this section, you probably will want to configure Azure Active Directory synchronization to replace Google-based SSO.

    Advanced settings

    This section is used to configure administrative access to user data and to configure the Google Secure Data Connector (which allows Google Apps to access data on your local network). You don’t need to migrate any settings in this section.

    + +  + +**Identify locally-configured settings to migrate** + +In addition to the settings configured in the Google Admin Console, users may have locally configured their devices based on their own personal preferences (as shown in Figure 2). Table 4 lists the Chromebook user and device settings that you can locally configure. Review the settings and determine which settings you will migrate to Windows. Some of the settings listed in Table 4 can only be seen when you click the **Show advanced settings** link (as shown in Figure 2). + +![figure 2](images/fig2-locallyconfig.png) + +Figure 2. Locally-configured settings on Chromebook + +Table 4. Locally-configured settings + +| Section | Settings | +|------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Internet connections | These settings configure the Internet connection for the devices, such as Wi-Fi and VPN connections. Record the network connection currently in use and configure the Windows device to use the same network connection settings. | +| Appearances | These settings affect the appearance of the desktop. Record the wallpaper image file that is used. Migrate the image file to the Windows device and configure as the user’s wallpaper to maintain similar user experience. | +| Search | These settings configure which search engine is used to search for content. Record this setting so that you can use as the search engine on the Windows device. | +| Advanced sync settings | These settings configure which user settings are synchronized with the Google cloud, such as Apps, Extensions, History, Passwords, Settings, and so on. Record these settings and configure the Windows device with the same settings if you decide to continue to use Google Apps and other cloud services after you migrate to Windows devices. | +| Date and time | These settings configure the time zone and if 24-hour clock time should be used. Record these settings and configure the Windows device to use these settings. | +| Privacy | These settings configure Google Chrome web browser privacy settings (such as prediction service, phishing and malware protection, spelling errors, resource pre-fetch, and so on). Record these settings and configure Microsoft Edge, Internet Explorer, or the web browser of your choice with these settings. | +| Bluetooth | This setting configures whether or not Bluetooth is enabled on the device. Record this setting and configure the Windows device similarly. | +| Passwords and forms | These settings configure Google Chrome web browser to enable autofill of web forms and to save web passwords. Record these settings and configure Microsoft Edge, Internet Explorer, or the web browser of your choice with these settings. | +| Smart lock | These settings configure the Chromebook when the user’s Android phone is nearby and unlocked, which eliminates the need to type a password. You don’t need to migrate settings in this section. | +| Web content | These settings configure how the Chrome web browser displays content (such as font size and page zoom). Record these settings and configure Microsoft Edge, Internet Explorer, or the web browser of your choice with these settings. | +| Languages | These settings configure the language in use for the Chromebook. Record these settings and configure the Windows device to support the same language. | +| Downloads | These settings configure the default folder for file download, if the user should be prompted where to save files, and if the Google Drive account should be disconnected. Record these settings and configure the Windows device with similar settings. | +| HTTPS/SSL | These settings configure client-side certificates that are used to authenticate the device. Depending on the services or apps that use these certificates, you may need to export and then migrate these certificates to the Windows device. Contact the service or app provider to determine if you can use the existing certificate or if a new certificate needs to be issued. Record these settings and migrate the certificate to the Windows device or enroll for a new certificate as required by the service or app. | +| Google Cloud Print | These settings configure the printers that are available to the user. Record the list of printers available to the user and configure the Windows device to have the same printers available. Ensure that the user-friendly printer names in Windows are the same as for the Chromebook device. For example, if the Chromebook device has a printer named “Laser Printer in Registrar’s Office”, use that same name in Windows. | +| On startup | These settings configure which web pages are opened when the Chrome web browser starts. Record these settings and configure Microsoft Edge, Internet Explorer, or the web browser of your choice with these settings. | +| Accessibility | These settings configure the Chromebook ease of use (such as display of large mouse cursor, use of high contrast mode, enablement of the screen magnifier, and so on). Record these settings and configure the Windows device with similar settings. | +| Powerwash | This action removes all user accounts and resets the Chromebook device back to factory settings. You don’t have to migrate any settings in this section. | +| Reset settings | This action retains all user accounts, but restores all settings back to their default values. You don’t have to migrate any settings in this section. | + +  + +Determine how many users have similar settings and then consider managing those settings centrally. For example, a large number of users may have many of the same Chrome web browser settings. You can centrally manage these settings in Windows after migration. + +Also, as a part of this planning process, consider settings that may not be currently managed centrally, but should be managed centrally. Record the settings that are currently being locally managed, but you want to manage centrally after the migration. + +**Prioritize settings to migrate** + +After you have collected all the Chromebook user, app, and device settings that you want to migrate, you need to prioritize each setting. Evaluate each setting and assign a priority to the setting based on the levels of high, medium, and low. + +Assign the setting-migration priority based on how critical the setting is to the faculty performing their day-to-day tasks and how the setting affects the curriculum in the classrooms. Focus on the migration of higher priority settings and put less effort into the migration of lower priority settings. There may be some settings that are not necessary at all and can be dropped from your list of settings entirely. Record the setting priority in the list of settings you plan to migrate. + +## Plan for email migration + + +Many of your users may be using Google Apps Gmail to manage their email, calendars, and contacts. You need to create the list of users you will migrate and the best time to perform the migration. + +Office 365 supports automated migration from Google Apps Gmail to Office 365. For more information, see [Migrate Google Apps mailboxes to Office 365](http://go.microsoft.com/fwlink/p/?LinkId=690252). + +**Identify the list of user mailboxes to migrate** + +In regards to creating the list of users you will migrate, it might seem that the answer “all the users” might be the best one. However, depending on the time you select for migration, only a subset of the users may need to be migrated. For example, you may not persist student email accounts between semesters or between academic years. In this case you would only need to migrate faculty and staff. + +Also, when you perform a migration it is a great time to verify that all user mailboxes are active. In many environments there are a significant number of mailboxes that were provisioned for users that are no longer a part of the institution (such as interns or student assistants). You can eliminate these users from your list of user mailboxes to migrate. + +Create your list of user mailboxes to migrate in Excel 2016 based on the format described in step 7 in [Create a list of Gmail mailboxes to migrate](http://go.microsoft.com/fwlink/p/?LinkId=690253). If you follow this format, you can use the Microsoft Excel spreadsheet to perform the actual migration later in the process. + +**Identify companion devices that access Google Apps Gmail** + +In addition to Chromebook devices, users may have companion devices (smartphones, tablets, desktops, laptops, and so on) that also access the Google Apps Gmail mailbox. You will need to identify those companion devices and identify the proper configuration for those devices to access Office 365 mailboxes. + +After you have identified each companion device, verify the settings for the device that are used to access Office 365. You only need to test one type of each companion device. For example, if users use Android phones to access Google Apps Gmail mailboxes, configure the device to access Office 365 and then record those settings. You can publish those settings on a website or to your helpdesk staff so that users will know how to access their Office 365 mailbox. + +In most instances, users will only need to provide in their Office 365 email account and password. However, you should verify this on each type of companion device. For more information about how to configure a companion device to work with Office 365, see [Compare how different mobile devices work with Office 365](http://go.microsoft.com/fwlink/p/?LinkId=690254). + +**Identify the optimal timing for the migration** + +Typically, the best time to perform the migration is between academic years or during semester breaks. Select the time of least activity for your institution. And during that time, the optimal time to perform the migration might be during an evening or over a weekend. + +Ensure that you communicate the time the migration will occur to your users well in advance. Also, ensure that users know how to access their Office 365 email after the migration is complete. Finally, ensure that your users know how to perform the common tasks they performed in Google Apps Gmail in Office 365 and/or Outlook 2016. + +## Plan for cloud storage migration + + +Chromebook devices have limited local storage. So, most of your users will store data in cloud storage, such as Google Drive. You will need to plan how to migrate your cloud storage as a part of the Chromebook migration process. + +In this section, you will create a list of the existing cloud services, select the Microsoft cloud services that best meet your needs, and then optimize your cloud storage services migration plan. + +**Identify cloud storage services currently in use** + +Typically, most Chromebook users use Google Drive for cloud storage services because your educational institution purchased other Google cloud services and Google Drive is a part of those services. However, some users may use cloud storage services from other vendors. For each member of your faculty and staff and for each student, create a list of cloud storage services that includes the following: + +- Name of the cloud storage service + +- Cloud storage service vendor + +- Associated licensing costs or fees + +- Approximate storage currently in use per user + +Use this information as the requirements for your cloud storage services after you migrate to Windows devices. If at the end of this discovery you determine there is no essential data being stored in cloud storage services that requires migration, then you can skip to the [Plan for cloud services migration](#plan-cloud-services) section. + +**Optimize cloud storage services migration plan** + +Now that you know the current cloud storage services configuration, you need to optimize your cloud storage services migration plan for Microsoft OneDrive for Business. Optimization helps ensure that your use only the cloud storage services resources that are necessary for your requirements. + +Consider the following to help optimize your cloud storage services migration plan: + +- **Eliminate inactive user storage.** Before you perform the cloud storage services migration, identify cloud storage that is currently allocated to inactive users. Remove this storage from your list of cloud storage to migrate. + +- **Eliminate or archive inactive files.** Review cloud storage to identify files that are inactive (have not been accessed for some period of time). Eliminate or archive these files so that they do not consume cloud storage. + +- **Consolidate cloud storage services.** If multiple cloud storage services are in use, reduce the number of cloud storage services and standardize on one cloud storage service. This will help reduce management complexity, support time, and typically will reduce cloud storage costs. + +Record your optimization changes in your cloud storage services migration plan. + +## Plan for cloud services migration + + +Many of your users may use cloud services on their Chromebook device, such as Google Apps, Google Drive, or Google Apps Gmail. You have planned for these individual cloud services in the [Plan for app migration or replacement](#plan-app-migrate-replace), [Plan for Google Apps Gmail to Office 365 migration](#plan-email-migrate), and [Plan for cloud storage migration](#plan-cloud-storage-migration) sections. + +In this section, you will create a combined list of these cloud services and then select the appropriate strategy to migrate these cloud services. + +### + +**Identify cloud services currently in use** + +You have already identified the individual cloud services that are currently in use in your educational institution in the [Plan for app migration or replacement](#plan-app-migrate-replace), [Plan for Google Apps Gmail to Office 365 migration](#plan-email-migrate), and [Plan for cloud storage migration](#plan-cloud-storage-migration) sections. Create a unified list of these cloud services and record the following about each service: + +- Cloud service name + +- Cloud service provider + +- Number of users that use the cloud service + +**Select cloud services to migrate** + +One of the first questions you should ask after you identify the cloud services currently in use is, “Why do we need to migrate from these cloud services?” The answer to this question largely comes down to finances and features. + +Here is a list of reasons that describe why you might want to migrate from an existing cloud service to Microsoft cloud services: + +- **Better integration with Office 365.** If your long-term strategy is to migrate to Office 365 apps (such as Word 2016 or Excel 2016) then a migration to Microsoft cloud services will provide better integration with these apps. The use of existing cloud services may not be as intuitive for users. For example, Office 365 apps will integrate better with OneDrive for Business compared to Google Drive. + +- **Online apps offer better document compatibility.** Microsoft Office online apps (such as Word Online and Excel Online) provide the highest level of compatibility with Microsoft Office documents. The Office online apps allow you to open and edit documents directly from SharePoint or OneDrive for Business. Users can access the Office online app from any device with Internet connectivity. + +- **Reduce licensing costs.** If you pay for Office 365 licenses, then Office 365 apps and cloud storage are included in those licenses. Although you could keep existing cloud services, you probably would pay more to keep those services. + +- **Improve storage capacity and cross-platform features.** Microsoft cloud services provide competitive storage capacity and provide more Windows-centric features than other cloud services providers. While the Microsoft cloud services user experience is highly optimized for Windows devices, Microsoft cloud services are also highly optimized for companion devices (such as iOS or Android devices). + +Review the list of existing cloud services that you created in the [Identify cloud services currently in use](#identify-cloud-services-inuse) section and identify the cloud services that you want to migrate to Microsoft cloud services. If you determine at the end of this task that there are no cloud services to be migrated, then skip to the [Plan for Windows device deployment](#plan-windevice-deploy) section. Also, skip the [Perform cloud services migration](#perform-cloud-services-migration) section later in this guide. + +**Prioritize cloud services** + +After you have created your aggregated list of cloud services currently in use by Chromebook users, prioritize each cloud service. Evaluate each cloud service and assign a priority based on the levels of high, medium, and low. + +Assign the priority based on how critical the cloud service is to the faculty and staff performing their day-to-day tasks and how the cloud service affects the curriculum in the classrooms. Also, make cloud services that are causing pain for the users a higher priority. For example, if users experience outages with a specific cloud service, then make migration of that cloud service a higher priority. + +Focus on the migration of higher priority cloud services first and put less effort into the migration of lower priority cloud services. There may be some cloud services that are unnecessary and you can remove them from your list of cloud services to migrate entirely. Record the cloud service migration priority in the list of cloud services you plan to migrate. + +### + +**Select cloud services migration strategy** + +When you deploy the Windows devices, should you migrate the faculty, staff, and students to the new cloud services? Perhaps. But, in most instances you will want to select a migration strategy that introduces a number of small changes over a period of time. + +Consider the following when you create your cloud services migration strategy: + +- **Introduce small changes.** The move from Chrome OS to Windows will be simple for most users as most will have exposure to Windows from home, friends, or family. However, users may not be as familiar with the apps or cloud services. Consider the move to Windows first, and then make other changes as time progresses. + +- **Start off by using existing apps and cloud services.** Immediately after the migration to Windows devices, you may want to consider running the existing apps and cloud services (such Google Apps, Google Apps Gmail, and Google Drive). This gives users a familiar method to perform their day-to-day tasks. + +- **Resolve pain points.** If some existing apps or cloud services cause problems, you may want to migrate them sooner rather than later. In most instances, users will be happy to go through the learning curve of a new app or cloud service if it is more reliable or intuitive for them to use. + +- **Migrate classrooms or users with common curriculum.** Migrate to Windows devices for an entire classroom or for multiple classrooms that share common curriculum. You must ensure that the necessary apps and cloud services are available for the curriculum prior to the migration of one or more classrooms. + +- **Migrate when the fewest number of active users are affected.** Migrate your cloud services at the end of an academic year or end of a semester. This will ensure you have minimal impact on faculty, staff, and students. Also, a migration during this time will minimize the learning curve for users as they are probably dealing with new curriculum for the next semester. Also, you may not need to migrate student apps and data because many educational institutions do not preserve data between semesters or academic years. + +- **Overlap existing and new cloud services.** For faculty and staff, consider overlapping the existing and new cloud services (having both services available) for one business cycle (end of semester or academic year) after migration. This allows you to easily recover any data that might not have migrated successfully from the existing cloud services. At a minimum, overlap the user of existing and new cloud services until the user can verify the migration. Of course, the tradeoff for using this strategy is the cost of the existing cloud services. However, depending on when license renewal occurs, the cost may be minimal. + +## Plan for Windows device deployment + + +You need to plan for Windows device deployment to help ensure that the devices are successfully installed and configured to replace the Chromebook devices. Even if the vendor that provides the devices pre-loads Windows 10 on them, you still will need to perform other tasks. + +In this section you will select a Windows device deployment strategy; plan for Active Directory Domain Services (AD DS) and Azure AD services; plan for device, user, and app management; and plan for any necessary network infrastructure remediation. + +### + +**Select a Windows device deployment strategy** + +What decisions need to be made about Windows device deployment? You just put the device on a desk, hook up power, connect to Wi-Fi, and then let the users operate the device, right? That is essentially correct, but depending on the extent of your deployment and other factors, you need to consider different deployment strategies. + +For each classroom that has Chromebook devices, select a combination of the following device deployment strategies: + +- **Deploy one classroom at a time.** In most cases you will want to perform your deployment in batches of devices and a classroom is an excellent way to batch devices. You can treat each classroom as a unit and check each classroom off your list after you have deployed the devices. + +- **Deploy based on curriculum.** Deploy the Windows devices after you have confirmed that the curriculum is ready for the Windows devices. If you deploy Windows devices without the curriculum installed and tested, you could significantly reduce the ability for students and teachers to perform effectively in the classroom. Also, deployment based on curriculum has the advantage of letting you move from classroom to classroom quickly if multiple classrooms use the same curriculum. + +- **Deploy side-by-side.** In some instances you may need to have both the Chromebook and Windows devices in one or more classrooms. You can use this strategy if some of the curriculum only works on Chromebook and other parts of the curriculum works on Windows devices. This is a good method to help prevent delays in Windows device deployment, while ensuring that students and teachers can make optimal use of technology in their curriculum. + +- **Deploy after apps and cloud services migration.** If you deploy a Windows device without the necessary apps and cloud services to support the curriculum, this provides only a portion of your complete solution. Ensure that the apps and cloud services are tested, provisioned, and ready for use prior to the deployment of Windows devices. + +- **Deploy after the migration of user and device settings.** Ensure that you have identified the user and device settings that you plan to migrate and that those settings are ready to be applied to the new Windows devices. For example, you would want to create Group Policy Objects (GPOs) to apply the user and device settings to Windows devices. + + If you ensure that Windows devices closely mirror the Chromebook device configuration, you will ease user learning curve and create a sense of familiarity. Also, when you have the settings ready to be applied to the devices, it helps ensure you will deploy your new Windows devices in a secure configuration. + +Record the combination of Windows device deployment strategies that you selected. + +### + +**Plan for AD DS and Azure AD services** + +The next decision you will need to make concerns AD DS and Azure AD services. You can run AD DS on-premises, in the cloud by using Azure AD, or a combination of both (hybrid). The decision about which of these options is best is closely tied to how you will manage your users, apps, and devices and if you will use Office 365 and other Azure-based cloud services. + +In the hybrid configuration, your on-premises AD DS user and group objects are synchronized with Azure AD (including passwords). The synchronization happens both directions so that changes are made in both your on-premises AD DS and Azure AD. + +Table 5 is a decision matrix that helps you decide if you can use only on-premises AD DS, only Azure AD, or a combination of both (hybrid). If the requirements you select from the table require on-premises AD DS and Azure AD, then you should select hybrid. For example, if you plan to use Office 365 and use Group Policy for management, then you would select hybrid. However, if you plan to use Office 365 and use Intune for management, then you would select only Azure AD. + +Table 5. Select on-premises AD DS, Azure AD, or hybrid + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    If you plan to...On-premises AD DSAzure ADHybrid
    Use Office 365XX
    Use Intune for managementXX
    Use System Center 2012 R2 Configuration Manager for managementXX
    Use Group Policy for managementXX
    Have devices that are domain-joinedXX
    Allow faculty and students to Bring Your Own Device (BYOD) which are not domain-joinedXX
    + +  + +### + +**Plan device, user, and app management** + +You may ask the question, “Why plan for device, user, and app management before you deploy the device?” The answer is that you will only deploy the device once, but you will manage the device throughout the remainder of the device's lifecycle. + +Also, planning management before deployment is essential to being ready to support the devices as you deploy them. You want to have your management processes and technology in place when the first teachers, facility, or students start using their new Windows device. + +Table 6 is a decision matrix that lists the device, user, and app management products and technologies and the features supported by each product or technology. The primary device, user, and app management products and technologies include Group Policy, System Center Configuration Manager, Intune, and the Microsoft Deployment Toolkit (MDT). Use this decision matrix to help you select the right combination of products and technologies for your plan. + +Table 6. Device, user, and app management products and technologies + + +++++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Desired featureWindows provisioning packagesGroup PolicyConfiguration ManagerIntuneMDTWindows Software Update Services
    Deploy operating system imagesXXX
    Deploy apps during operating system deploymentXXX
    Deploy apps after operating system deploymentXXX
    Deploy software updates during operating system deploymentXX
    Deploy software updates after operating system deploymentXXXXX
    Support devices that are domain-joinedXXXXX
    Support devices that are not domain-joinedXXX
    Use on-premises resourcesXXXX
    Use cloud-based servicesX
    + +  + +You can use Configuration Manager and Intune in conjunction with each other to provide features from both products and technologies. In some instances you may need only one of these products or technologies. In other instances, you may need two or more to meet the device, user, and app management needs for your institution. + +Record the device, user, and app management products and technologies that you selected. + +### + +**Plan network infrastructure remediation** + +In addition to AD DS, Azure AD, and management components, there are other network infrastructure services that Windows devices need. In most instances, Windows devices have the same network infrastructure requirements as the existing Chromebook devices. + +Examine each of the following network infrastructure technologies and services and determine if any remediation is necessary: + +- **Domain Name System (DNS)** provides translation between a device name and its associated IP address. For Chromebook devices, public facing, Internet DNS services are the most important. For Windows devices that only access the Internet, they have the same requirements. + + However, if you intend to communicate between Windows devices (peer-to-peer or client/server) then you will need local DNS services. Windows devices will register their name and IP address with the local DNS services so that Windows devices can locate each other. + +- **Dynamic Host Configuration Protocol (DHCP)** provides automatic IP configuration for devices. Your existing Chromebook devices probably use DHCP for configuration. If you plan to immediately replace the Chromebook devices with Windows devices, then you only need to release all the DHCP reservations for the Chromebook devices prior to the deployment of Windows devices. + + If you plan to run Chromebook and Windows devices side-by-side, then you need to ensure that your DHCP service has adequate IP addresses available for both sets of devices. + +- **Wi-Fi.** Chromebook devices are designed to connect to Wi-Fi networks. Windows devices are the same. Your existing Wi-Fi network for the Chromebook devices should be adequate for the same number of Windows devices. + + If you plan to significantly increase the number of Windows devices or you plan to run Chromebook and Windows devices side-by-side, then you need to ensure that Wi-Fi network can support the number of devices. + +- **Internet bandwidth.** Chromebook devices consume more Internet bandwidth (up to 700 times more) than Windows devices. This means that if your existing Internet bandwidth is adequate for the Chromebook devices, then the bandwidth will be more than adequate for Windows devices. + + However, if you plan to significantly increase the number of Windows devices or you plan to run Chromebook and Windows devices side-by-side, then you need to ensure that your Internet connection can support the number of devices. + + For more information that compares Internet bandwidth consumption for Chromebook and Windows devices, see the following resources: + + - [Chromebook vs. Windows Notebook Network Traffic Analysis](http://go.microsoft.com/fwlink/p/?LinkId=690255) + + - [Hidden Cost of Chromebook Deployments](http://go.microsoft.com/fwlink/p/?LinkId=690256) + + - [Microsoft Windows 8.1 Notebook vs. Chromebooks for Education](http://go.microsoft.com/fwlink/p/?LinkId=690257) + +- **Power.** Although not specifically a network infrastructure, you need to ensure your classrooms have adequate power. Chromebook and Windows devices should consume similar amounts of power. This means that your existing power outlets should support the same number of Windows devices. + + If you plan to significantly increase the number of Windows devices or you plan to run Chromebook and Windows devices side-by-side, you need to ensure that the power outlets, power strips, and other power management components can support the number of devices. + +At the end of this process, you may determine that no network infrastructure remediation is necessary. If so, you can skip the [Perform network infrastructure remediation](#network-infra-remediation) section of this guide. + +## Perform Chromebook migration + + +Thus far, planning has been the primary focus. Believe it or not most of the work is now done. The rest of the Chromebook migration is just the implementation of the plan you have created. + +In this section you will perform the necessary steps for the Chromebook device migration. You will perform the migration based on the planning decision that you made in the [Plan Chromebook migration](#plan-migration) section earlier in this guide. + +You must perform some of the steps in this section in a specific sequence. Each section has guidance about when to perform a step. You can perform other steps before, during, or after the migration. Again, each section will tell you if the sequence is important. + +## Perform network infrastructure remediation + + +The first migration task is to perform any network infrastructure remediation. In the [Plan network infrastructure remediation](#plan-network-infra-remediation) section, you determined the network infrastructure remediation (if any) that you needed to perform. + +It is important that you perform any network infrastructure remediation first because the remaining migration steps are dependent on the network infrastructure. Table 7 lists the Microsoft network infrastructure products and technologies and deployment resources for each. + +Table 7. Network infrastructure products and technologies and deployment resources + + ++++ + + + + + + + + + + + + + + + + +
    Product or technologyResources
    DHCP
      +
    • [Core Network Guide](http://go.microsoft.com/fwlink/p/?LinkId=733920)

    • +
    • [DHCP Deployment Guide](http://go.microsoft.com/fwlink/p/?LinkId=734021)

    • +
    DNS
      +
    • [Core Network Guide](http://go.microsoft.com/fwlink/p/?LinkId=733920)

    • +
    • [Deploying Domain Name System (DNS)](http://go.microsoft.com/fwlink/p/?LinkId=734022)

    • +
    + +  + +If you use network infrastructure products and technologies from other vendors, refer to the vendor documentation on how to perform the necessary remediation. If you determined that no remediation is necessary, you can skip this section. + +## Perform AD DS and Azure AD services deployment or remediation + + +It is important that you perform AD DS and Azure AD services deployment or remediation right after you finish network infrastructure remediation. Many of the remaining migration steps are dependent on you having your identity system (AD DS or Azure AD) in place and up to necessary expectations. + +In the [Plan for Active Directory services](#plan-adservices) section, you determined the AD DS and/or Azure AD deployment or remediation (if any) that needed to be performed. Table 8 list AD DS, Azure AD, and the deployment resources for both. Use the resources in this table to deploy or remediate on-premises AD DS, Azure AD, or both. + +Table 8. AD DS, Azure AD and deployment resources + + ++++ + + + + + + + + + + + + + + + + +
    Product or technologyResources
    AD DS
      +
    • [Core Network Guide](http://go.microsoft.com/fwlink/p/?LinkId=733920)

    • +
    • [Active Directory Domain Services Overview](http://go.microsoft.com/fwlink/p/?LinkId=733909)

    • +
    Azure AD
      +
    • [Azure Active Directory documentation](http://go.microsoft.com/fwlink/p/?LinkId=690258)

    • +
    • [Manage and support Azure Active Directory Premium](http://go.microsoft.com/fwlink/p/?LinkId=690259)

    • +
    • [Guidelines for Deploying Windows Server Active Directory on Azure Virtual Machines](http://go.microsoft.com/fwlink/p/?LinkId=690260)

    • +
    + +  + +If you decided not to migrate to AD DS or Azure AD as a part of the migration, or if you determined that no remediation is necessary, you can skip this section. If you use identity products and technologies from another vendor, refer to the vendor documentation on how to perform the necessary steps. + +## Prepare device, user, and app management systems + + +In the [Plan device, user, and app management](#plan-userdevapp-manage) section of this guide, you selected the products and technologies that you will use to manage devices, users, and apps on Windows devices. You need to prepare your management systems prior to Windows 10 device deployment. You will use these management systems to manage the user and device settings that you selected to migrate in the [Plan for migration of user and device settings](#plan-migrate-user-device-settings) section. You need to prepare these systems prior to the migration of user and device settings. + +Table 9 lists the Microsoft management systems and the deployment resources for each. Use the resources in this table to prepare (deploy or remediate) these management systems. + +Table 9. Management systems and deployment resources + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Management systemResources
    Windows provisioning packages
      +
    • [Build and apply a provisioning package](http://go.microsoft.com/fwlink/p/?LinkId=733918)

    • +
    • [Windows Imaging and Configuration Designer](http://go.microsoft.com/fwlink/p/?LinkId=733911)

    • +
    • [Step-By-Step: Building Windows 10 Provisioning Packages](http://go.microsoft.com/fwlink/p/?LinkId=690261)

    • +
    Group Policy
      +
    • [Core Network Companion Guide: Group Policy Deployment](http://go.microsoft.com/fwlink/p/?LinkId=733915)

    • +
    • [Deploying Group Policy](http://go.microsoft.com/fwlink/p/?LinkId=734024)

    • +
    Configuration Manager
      +
    • [Site Administration for System Center 2012 Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=733914)

    • +
    • [Deploying Clients for System Center 2012 Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=733919)

    • +
    Intune
      +
    • [Set up and manage devices with Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkId=690262)

    • +
    • [Smoother Management Of Office 365 Deployments with Windows Intune](http://go.microsoft.com/fwlink/p/?LinkId=690263)

    • +
    • [System Center 2012 R2 Configuration Manager & Windows Intune](http://go.microsoft.com/fwlink/p/?LinkId=690264)

    • +
    MDT
      +
    • [MDT documentation in the Microsoft Deployment Toolkit (MDT) 2013](http://go.microsoft.com/fwlink/p/?LinkId=690324)

    • +
    • [Step-By-Step: Installing Windows 8.1 From A USB Key](http://go.microsoft.com/fwlink/p/?LinkId=690265)

    • +
    + +  + +If you determined that no new management system or no remediation of existing systems is necessary, you can skip this section. If you use a management system from another vendor, refer to the vendor documentation on how to perform the necessary steps. + +## Perform app migration or replacement + + +In the [Plan for app migration or replacement](#plan-app-migrate-replace) section, you identified the apps currently in use on Chromebook devices and selected the Windows apps that will replace the Chromebook apps. You also performed app compatibility testing for web apps to ensure that web apps on the Chromebook devices would run on Microsoft Edge and Internet Explorer. + +In this step, you need to configure your management system to deploy the apps to the appropriate Windows users and devices. Table 10 lists the Microsoft management systems and the app deployment resources for each. Use the resources in this table to configure these management systems to deploy the apps that you selected in the [Plan for app migration or replacement](#plan-app-migrate-replace) section of this guide. + +Table 10. Management systems and app deployment resources + + ++++ + + + + + + + + + + + + + + + + + + + + +
    Management systemResources
    Group Policy
      +
    • [Editing an AppLocker Policy](http://go.microsoft.com/fwlink/p/?LinkId=734025)

    • +
    • [Group Policy Software Deployment Background](http://go.microsoft.com/fwlink/p/?LinkId=734026)

    • +
    • [Assigning and Publishing Software](http://go.microsoft.com/fwlink/p/?LinkId=734027)

    • +
    Configuration Manager
      +
    • [How to Deploy Applications in Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=733917)

    • +
    • [Application Management in Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=733907)

    • +
    Intune
      +
    • [Deploy apps to mobile devices in Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkId=733913)

    • +
    • [Manage apps with Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkId=733910)

    • +
    + +  + +If you determined that no deployment of apps is necessary, you can skip this section. If you use a management system from another vendor, refer to the vendor documentation on how to perform the necessary steps. + +## Perform migration of user and device settings + + +In the [Plan for migration of user and device settings](#plan-migrate-user-device-settings) section, you determined the user and device settings that you want to migrate. You selected settings that are configured in the Google Admin Console and locally on the Chromebook device. + +Perform the user and device setting migration by using the following steps: + +1. From the list of institution-wide settings that you created in the [Plan for migration of user and device settings](#plan-migrate-user-device-settings) section, configure as many as possible in your management system (such as Group Policy, Configuration Manager, or Intune). + +2. From the list of device-specific settings that you created in the [Plan for migration of user and device settings](#plan-migrate-user-device-settings) section, configure device-specific setting for higher priority settings. + +3. From the list of user-specific settings that you created in the [Plan for migration of user and device settings](#plan-migrate-user-device-settings) section, configure user-specific setting for higher priority settings. + +4. Verify that all higher-priority user and device settings have been configured in your management system. + +If you do no want to migrate any user or device settings from the Chromebook devices to the Windows devices, you can skip this section. + +## Perform email migration + + +In the [Plan for email migration](#plan-email-migrate) section, you identified the user mailboxes to migrate, identified the companion devices that access Google Apps Gmail, and identified the optimal timing for migration. You can perform this migration before or after you deploy the Windows devices. + +Office 365 supports automated migration from Google Apps Gmail to Office 365. For more information on how to automate the migration from Google Apps Gmail to Office 365, see [Migrate Google Apps mailboxes to Office 365](http://go.microsoft.com/fwlink/p/?LinkId=690252). + +Alternatively, if you want to migrate to Office 365 from: + +- **On-premises Microsoft Exchange Server.** Use the following resources to migrate to Office 365 from an on-premises Microsoft Exchange Server: + + - [Cutover Exchange Migration and Single Sign-On](http://go.microsoft.com/fwlink/p/?LinkId=690266) + + - [Step-By-Step: Migration of Exchange 2003 Server to Office 365](http://go.microsoft.com/fwlink/p/?LinkId=690267) + + - [Step-By-Step: Migrating from Exchange 2007 to Office 365](http://go.microsoft.com/fwlink/p/?LinkId=690268) + +- **Another on-premises or cloud-based email service.** Follow the guidance from that vendor. + +## Perform cloud storage migration + + +In the [Plan for cloud storage migration](#plan-cloud-storage-migration) section, you identified the cloud storage services currently in use, selected the Microsoft cloud storage services that you will use, and optimized your cloud storage services migration plan. You can perform the cloud storage migration before or after you deploy the Windows devices. + +Manually migrate the cloud storage migration by using the following steps: + +1. Install both Google Drive app and OneDrive for Business or OneDrive app on a device. + +2. Sign in as the user in the Google Drive app. + +3. Sign in as the user in the OneDrive for Business or OneDrive app. + +4. Copy the data from the Google Drive storage to the OneDrive for Business or OneDrive storage. + +5. Optionally uninstall the Google Drive app. + +There are also a number of software vendors who provide software that helps automate the migration from Google Drive to OneDrive for Business, Office 365 SharePoint, or OneDrive. For more information about these automated migration tools, contact the vendors. + +## Perform cloud services migration + + +In the [Plan for cloud services migration](#plan-cloud-services)section, you identified the cloud services currently in use, selected the cloud services that you want to migrate, prioritized the cloud services to migrate, and then selected the cloud services migration strategy. You can perform the cloud services migration before or after you deploy the Windows devices. + +Migrate the cloud services that you currently use to the Microsoft cloud services that you selected. For example, you could migrate from a collaboration website to Office 365 SharePoint. Perform the cloud services migration based on the existing cloud services and the Microsoft cloud services that you selected. + +There are also a number of software vendors who provide software that helps automate the migration from other cloud services to Microsoft cloud services. For more information about these automated migration tools, contact the vendors. + +## Perform Windows device deployment + + +In the [Select a Windows device deployment strategy](#select-windows-device-deploy) section, you selected how you wanted to deploy Windows 10 devices. The other migration task that you designed in the [Plan for Windows device deployment](#plan-windevice-deploy) section have already been performed. Now it's time to deploy the actual devices. + +For example, if you selected to deploy Windows devices by each classroom, start with the first classroom and then proceed through all of the classrooms until you’ve deployed all Windows devices. + +In some instances, you may receive the devices with Windows 10 already deployed, and want to use provisioning packages. In other cases, you may have a custom Windows 10 image that you want to deploy to the devices by using Configuration Manager and/or MDT. For information on how to deploy Windows 10 images to the devices, see the following resources: + +- [Windows Imaging and Configuration Designer](http://go.microsoft.com/fwlink/p/?LinkId=733911) + +- [Build and apply a provisioning package](http://go.microsoft.com/fwlink/p/?LinkId=733918) + +- [MDT documentation in the Microsoft Deployment Toolkit (MDT) 2013](http://go.microsoft.com/fwlink/p/?LinkId=690324) + +- [Step-By-Step: Installing Windows 8.1 From A USB Key](http://go.microsoft.com/fwlink/p/?LinkId=690265) + +- [Operating System Deployment in Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=733916) + +In addition to the Windows 10 image deployment, you may need to perform the following tasks as a part of device deployment: + +- Enroll the device with your management system. + +- Ensure that Windows Defender is enabled and configured to receive updates. + +- Ensure that Windows Update is enabled and configured to receive updates. + +- Deploy any apps that you want the user to immediately be able to access when they start the device (such as Word 2016 or Excel 2016). + +After you complete these steps, your management system should take over the day-to-day maintenance tasks for the Windows 10 devices. Verify that the user and device settings migrated correctly as you deploy each batch of Windows 10 devices. Continue this process until you deploy all Windows 10 devices. + +## Related topics + + +[Try it out: Windows 10 deployment (for education)](http://go.microsoft.com/fwlink/p/?LinkId=623254) + +[Try it out: Windows 10 in the classroom](http://go.microsoft.com/fwlink/p/?LinkId=623255) + +  + +  + + + + + diff --git a/education/windows/deploy-windows-10-in-a-school.md b/education/windows/deploy-windows-10-in-a-school.md new file mode 100644 index 0000000000..2c9039447a --- /dev/null +++ b/education/windows/deploy-windows-10-in-a-school.md @@ -0,0 +1,1264 @@ +--- +title: Deploy Windows 10 in a school (Windows 10) +description: Learn how to integrate your school environment with Microsoft Office 365, Active Directory Domain Services (AD DS), and Microsoft Azure Active Directory (Azure AD). Deploy Windows 10 and apps to new devices or upgrade existing devices to Windows 10. Manage faculty, students, and devices by using Microsoft Intune and Group Policy. +keywords: configure, tools, device, school +ms.prod: w10 +ms.mktglfcycl: plan +ms.pgtyp: edu +ms.sitesec: library +author: craigash +--- + +# Deploy Windows 10 in a school + + +**Applies to** + +- Windows 10 + +This guide shows you how to deploy the Windows 10 operating system in a school environment. You learn how to deploy Windows 10 in classrooms; integrate the school environment with Microsoft Office 365, Active Directory Domain Services (AD DS), and Microsoft Azure Active Directory (Azure AD); and deploy Windows 10 and your apps to new devices or upgrade existing devices to Windows 10. This guide also describes how to use Microsoft Intune and Group Policy to manage devices. Finally, the guide discusses common, ongoing maintenance tasks that you will perform after initial deployment as well as the automated tools and built-in features of the operating system. + +## Prepare for school deployment + +Proper preparation is essential for a successful school deployment. To avoid common mistakes, your first step is to plan a typical school configuration. Just as with building a house, you need a blueprint for what your school should look like when it’s finished. The second step in preparation is to learn how you will configure your school. Just as a builder needs to have the right tools to build a house, you need the right set of tools to deploy your school. + +### Plan a typical school configuration + +As part of preparing for your school deployment, you need to plan your configuration—the focus of this guide. Figure 1 illustrates a typical finished school configuration that you can use as a model (the blueprint in our builder analogy) for the finished state. + +![fig 1](images/deploy-win-10-school-figure1.png) + +*Figure 1. Typical school configuration for this guide* + +Figure 2 shows the classroom configuration this guide uses. + +![fig 2](images/deploy-win-10-school-figure2.png) + +*Figure 2. Typical classroom configuration in a school* + +This school configuration has the following characteristics: +- It contains one or more admin devices. +- It contains two or more classrooms. +- Each classroom contains one teacher device. +- The classrooms connect to each other through multiple subnets. +- All devices in each classroom connect to a single subnet. +- All devices have high-speed, persistent connections to each other and to the Internet. +- All teachers and students have access to Windows Store or Windows Store for Business. +- All devices receive software updates from Intune (or another device management system). +- You install a 64-bit version of Windows 10 on the admin device. +- You install the Windows Assessment and Deployment Kit (Windows ADK) on the admin device. +- You install the Windows Assessment and Deployment Kit (Windows ADK) on the admin device. +- You install the 64-bit version of the Microsoft Deployment Toolkit (MDT) 2013 Update 2 on the admin device. + + **Note**  In this guide, all references to MDT refer to the 64-bit version of MDT 2013 Update 2. +- The devices use Azure AD in Office 365 Education for identity management. +- If you have on-premises AD DS, you can [integrate Azure AD with on-premises AD DS](http://azure.microsoft.com/en-us/documentation/articles/active-directory-aadconnect/). +- Use [Intune](http://technet.microsoft.com/library/jj676587.aspx), [compliance settings in Office 365](https://support.office.com/en-us/article/Manage-mobile-devices-in-Office-365-dd892318-bc44-4eb1-af00-9db5430be3cd?ui=en-US&rs=en-US&ad=US), or [Group Policy](http://technet.microsoft.com/en-us/library/cc725828%28v=ws.10%29.aspx?f=255&MSPPError=-2147217396) in AD DS to manage devices. +- Each device supports a one-student-per-device or multiple-students-per-device scenario. +- The devices can be a mixture of different make, model, and processor architecture (32 bit or 64 bit) or be identical. +- To initiate Windows 10 deployment, use a USB flash drive, DVD-ROM or CD-ROM, or Pre-Boot Execution Environment Boot (PXE Boot). +- The devices can be a mixture of different Windows 10 editions, such as Windows 10 Home, Windows 10 Pro, and Windows 10 Education. + +Office 365 Education allows: + +- Students and faculty to use Microsoft Office Online to create and edit Microsoft Word, OneNote, PowerPoint, and Excel documents in a browser. +- Teachers to use the [OneNote Class Notebook app](https://www.onenote.com/classnotebook) to share content and collaborate with students. +- Faculty to use the [OneNote Staff Notebooks app](https://www.onenote.com/staffnotebookedu) to collaborate with other teachers, administration, and faculty. +- Teachers to employ Sway to create interactive educational digital storytelling. +- Students and faculty to use email and calendars, with mailboxes up to 50 GB per user. +- Faculty to use advanced email features like email archiving and legal hold capabilities. +- Faculty to help prevent unauthorized users from accessing documents and email by using Azure Rights Management. +- Faculty to use advanced compliance tools on the unified eDiscovery pages in the Office 365 Compliance Center. +- Faculty to host online classes, parent–teacher conferences, and other collaboration in Skype for Business or Skype. +- Students and faculty to access up to 1 TB of personal cloud storage that users inside and outside the educational institution can share through OneDrive for Business. +- Teachers to provide collaboration in the classroom through Microsoft SharePoint Online team sites. +- Students and faculty to use Office 365 Video to manage videos. +- Students and faculty to use Yammer to collaborate through private social networking. +- Students and faculty to access classroom resources from anywhere on any device (including Windows 10 Mobile, iOS, and Android devices). + +For more information about Office 365 Education features and a FAQ, go to [Office 365 Education](https://products.office.com/en-us/academic). + +## How to configure a school + +Now that you have the plan (blueprint) for your classroom, you’re ready to learn about the tools you will use to deploy it. There are many tools you could use to accomplish the task, but this guide focuses on using those tools that require the least infrastructure and technical knowledge. + +The primary tool you will use to deploy Windows 10 in your school is MDT, which uses Windows ADK components to make deployment easier. You could just use the Windows ADK to perform your deployment, but MDT simplifies the process by providing an intuitive, wizard-driven user interface (UI). + +You can use MDT as a stand-alone tool or integrate it with Microsoft System Center Configuration Manager. As a stand-alone tool, MDT performs Lite Touch Installation (LTI) deployments—deployments that require minimal infrastructure and allow you to control the level of automation. When integrated with System Center Configuration Manager, MDT performs Zero Touch Installation (ZTI) deployments, which require more infrastructure (such as System Center Configuration Manager) but result in fully automated deployments. + +MDT includes the Deployment Workbench—a console from which you can manage the deployment of Windows 10 and your apps. You configure the deployment process in the Deployment Workbench, including the management of operating systems, device drivers, apps and migration of user settings on existing devices. + +LTI performs deployment from a *deployment share*—a network-shared folder on the device where you installed MDT. You can perform over-the-network deployments from the deployment share or perform deployments from a local copy of the deployment share on a USB drive or DVD. You will learn more about MDT in the [Prepare the admin device](#prepare-the-admin-device) section. + +The focus of MDT is deployment, so you also need tools that help you manage your Windows 10 devices and apps. You can manage Windows 10 devices and apps with Intune, the Compliance Management feature in Office 365, or Group Policy in AD DS. You can use any combination of these tools based on your school requirements. + +The configuration process requires the following devices: + +- **Admin device.** This is the device you use for your day-to-day job functions. It’s also the one you use to create and manage the Windows 10 and app deployment process. You install the Windows ADK and MDT on this device. +- **Faculty devices.** These are the devices that the teachers and other faculty use for their day-to-day job functions. You use the admin device to deploy (or upgrade) Windows 10 and apps to these devices. +- **Student devices.** The students will use these devices. You will use the admin device deploy (or upgrade) Windows 10 and apps to them. + +The high-level process for deploying and configuring devices within individual classrooms and the school as a whole is as follows and illustrated in Figure 3: + +1. Prepare the admin device for use, which includes installing the Windows ADK and MDT. +2. On the admin device, create and configure the Office 365 Education subscription that you will use for each classroom in the school. +3. On the admin device, configure integration between on-premises AD DS and Azure AD (if you have an on premises AD DS configuration). +4. On the admin device, create and configure a Windows Store for Business portal. +5. On the admin device, prepare for management of the Windows 10 devices after deployment. +6. On the student and faculty devices, deploy Windows 10 to new or existing devices, or upgrade eligible devices to Windows 10. +7. On the admin device, manage the Windows 10 devices and apps, the Office 365 subscription, and the AD DS and Azure AD integration. + +![fig 3](images/deploy-win-10-school-figure3.png) + +*Figure 3. How school configuration works* + +Each of the steps illustrated in Figure 3 directly correspond to the remaining high-level sections in this guide. + +### Summary + +In this section, you looked at the final configuration of your individual classrooms and the school as a whole upon completion of this guide. You also learned the high-level steps you need to perform to deploy the faculty and student devices in your school. + +## Prepare the admin device + +Now, you’re ready to prepare the admin device for use in the school. This process includes installing the Windows ADK, installing the MDT, and creating the MDT deployment share. + +### Install the Windows ADK + +The first step in preparing the admin device is to install the Windows ADK. The Windows ADK contains the deployment tools that MDT uses, including the Windows Preinstallation Environment (Windows PE), the Windows User State Migration Tool (USMT), and Deployment Image Servicing and Management. + +When you install the Windows ADK on the admin device, select the following features: + +- Deployment tools +- Windows Preinstallation Environment (Windows PE) +- User State Migration Tool (USMT) + +For more information about installing the Windows ADK, see [Step 2-2: Install the Windows ADK](http://technet.microsoft.com/en-us/library/dn781086.aspx?f=255&MSPPError=-2147217396#InstallWindowsADK). + +### Install MDT + +Next, install MDT. MDT uses the Windows ADK to help you manage and perform Windows 10 and app deployment and is a free tool available directly from Microsoft. + +You can use MDT to deploy 32-bit or 64-bit versions of Windows 10. Install the 64-bit version of MDT to support deployment of 32-bit and 64-bit operating systems. + +**Note**  If you install the 32-bit version of MDT, you can install only 32-bit versions of Windows 10. Ensure that you download and install the 64-bit version of MDT so that you can install 64-bit and 32 bit versions of the operating system. + +For more information about installing MDT on the admin device, see [Installing a New Instance of MDT](https://technet.microsoft.com/en-us/library/dn759415.aspx#InstallingaNewInstanceofMDT). + +Now, you’re ready to create the MDT deployment share and populate it with the operating system, apps, and device drivers you want to deploy to your devices. + +### Create a deployment share + +MDT includes the Deployment Workbench, a graphical user interface that you can use to manage MDT deployment shares. A deployment share is a shared folder that contains all the MDT deployment content. The LTI Deployment Wizard accesses the deployment content over the network or from a local copy of the deployment share (known as MDT deployment media). + +For more information about how to create a deployment share, see [Step 3-1: Create an MDT Deployment Share](http://technet.microsoft.com/en-us/library/dn781086.aspx?f=255&MSPPError=-2147217396#CreateMDTDeployShare). + +### Summary + +In this section, you installed the Windows ADK and MDT on the admin device. You also created the MDT deployment share that you will configure and use later in the LTI deployment process. + +## Create and configure Office 365 + +Office 365 is one of the core components of your classroom environment. You create and manage student identities in Office 365, and students and teachers use the suite as their email, contacts, and calendar system. Teachers and students use Office 365 collaboration features such as SharePoint, OneNote, and OneDrive for Business. + +As a first step in deploying your classroom, create an Office 365 Education subscription, and then configure Office 365 for the classroom. For more information about Office 365 Education deployment, see [School deployment of Office 365 Education](http://www.microsoft.com/en-us/education/products/office-365-deployment-resources/default.aspx). + +### Select the appropriate Office 365 Education license plan + +Complete the following steps to select the appropriate Office 365 Education license plan for your school: + +
      +
    1. Determine the number of faculty members and students who will use the classroom.
      Office 365 Education licensing plans are available specifically for faculty and students. You must assign faculty and students the correct licensing plan. +
    2. +
    3. Determine the faculty members and students who need to install Office applications on devices (if any). Faculty and students can use Office applications online (standard plans) or run them locally (Office 365 ProPlus plans). Table 1 lists the advantages and disadvantages of standard and Office 365 ProPlus plans.
    4. +
      +*Table 1. Comparison of standard and Microsoft Office 365 ProPlus plans* +
      + +++++ + + + + + + + + + + + + +
      PlanAdvantagesDisadvantages
      Standard
      • Less expensive than Office 365 ProPlus
      • Can be run from any device
      • No installation necessary
      • Must have an Internet connection to use it
      • Does not support all the features found in Office 365 ProPlus
      Office ProPlus
      • Only requires an Internet connection every 30 days (for activation)
      • Supports full set of Office features
      • Requires installation
      • Can be installed on only five devices per user (there is no limit to the number of devices on which you can run Office apps online)
      +
      +The best user experience is to run Office 365 ProPlus or use native Office apps on mobile devices. If neither of these options is available, use Office applications online. In addition, all Office 365 plans provide a better user experience by storing documents in OneDrive for Business, which is included in all Office 365 plans. OneDrive for Business keeps content in sync among devices and helps ensure that users always have access to their documents on any device. +
      +
    5. Determine whether students or faculty need Azure Rights Management.
      You can use Azure Rights Management to protect classroom information against unauthorized access. Azure Rights Management protects your information inside or outside the classroom through encryption, identity, and authorization policies, securing your files and email. You can retain control of the information, even when it’s shared with people outside the classroom or your educational institution. Azure Rights Management is free to use with all Office 365 Education license plans. For more information, see [Azure Rights Management](https://technet.microsoft.com/library/jj585024.aspx).
    6. +
    7. Record the Office 365 Education license plans needed for the classroom in Table 2.

      + +*Table 2. Office 365 Education license plans needed for the classroom* +
      + ++++ + + + + + + + + + + + + +
      QuantityPlan
      Office 365 Education for students
      Office 365 Education for faculty
      Azure Rights Management for students
      Azure Rights Management for faculty
      +
      +You will use the Office 365 Education license plan information you record in Table 2 in the [Create user accounts in Office 365](#create-user-accounts-in-office-365) section of this guide.
    + +### Create a new Office 365 Education subscription + +To create a new Office 365 Education subscription for use in the classroom, use your educational institution’s email account. There are no costs to you or to students for signing up for Office 365 Education subscriptions. + +**Note**  If you already have an Office 365 Education subscription, you can use that subscription and continue to the next section, [Add domains and subdomains](#add-domains-and-subdomains). + +#### To create a new Office 365 subscription + +1. In Microsoft Edge or Internet Explorer, type `https://portal.office.com/start?sku=faculty` in the address bar. + + **Note**  If you have already used your current sign-in account to create a new Office 365 subscription, you will be prompted to sign in. If you want to create a new Office 365 subscription, start an In-Private Window in one of the following: + - Microsoft Edge by opening the Microsoft Edge app, either pressing Ctrl+Shift+P or clicking or tapping **More actions**, and then clicking or tapping **New InPrivate window**. + - Internet Explorer 11 by opening Internet Explorer 11, either pressing Ctrl+Shift+P or clicking or tapping **Settings**, clicking or tapping **Safety**, and then clicking or tapping **InPrivate Browsing**. + +2. On the **Get started** page, type your school email address in the **Enter your school email address** box, and then click **Sign up**. You will receive an email in your school email account. +3. Click the hyperlink in the email in your school email account. +4. On the **One last thing** page, complete your user information, and then click **Start**. The wizard creates your new Office 365 Education subscription, and you are automatically signed in as the administrative user you specified when you created the subscription. + +### Add domains and subdomains + +Now that you have created your new Office 365 Education subscription, add the domains and subdomains that your institution uses. For example, if your institution has contoso.edu as the primary domain name but you have subdomains for students or faculty (such as students.contoso.edu and faculty.contoso.edu), then you need to add the subdomains. + +#### To add additional domains and subdomains + +1. In the Office 365 admin center, in the list view, click **DOMAINS**. +2. In the details pane, above the list of domains, on the menu bar, click **Add domain**. +3. In the Add a New Domain in Office 365 Wizard, on the **Verify domain wizard** page, click **Let’s get started**. +4. On the **Verify domain** wizard page, in the **Enter a domain you already own** box, type your domain name, and then click **Next**. +5. Sign in to your domain name management provider (for example, Network Solutions or GoDaddy), and then complete the steps for your provider. +6. Repeat these steps for each domain and subdomain you want faculty and students to use for your institution. + +### Configure automatic tenant join + +To make it easier for faculty and students to join your Office 365 Education subscription (or *tenant*), allow them to automatically sign up to your tenant (*automatic tenant join*). In automatic tenant join, when a faculty member or student signs up for Office 365, Office 365 automatically adds (joins) the user to your Office 365 tenant. + +**Note**  By default, automatic tenant join is enabled in Office 365 Education, with the exception of certain areas in Europe, the Middle East, and Africa. These countries require opt-in steps to add new users to existing Office 365 tenants. Check your country requirements to determine the automatic tenant join default configuration. Also, if you use Azure AD Connect, then automatic tenant join is disabled. + +Office 365 uses the domain portion of the user’s email address to know which Office 365 tenant to join. For example, if a faculty member or student provides an email address of user@contoso.edu, then Office 365 automatically performs one of the following tasks: + +- If an Office 365 tenant with that domain name (contoso.edu) exists, Office 365 automatically adds the user to that tenant. +- If an Office 365 tenant with that domain name (contoso.edu) does not exists, Office 365 automatically creates a new Office 365 tenant with that domain name and adds the user to it. + +You will always want faculty and students to join the Office 365 tenant that you created. Ensure that you perform the steps in the [Create a new Office 365 Education subscription](#create-a-new-office-365-education-subscription) and [Add domains and subdomains](#add-domains-and-subdomains) sections before allowing other faculty and students to join Office 365. + +**Note**  You cannot merge multiple tenants, so any faculty or students who create their own tenant will need to abandon their existing tenant and join yours. + +All new Office 365 Education subscriptions have automatic tenant join enabled by default, but you can enable or disable automatic tenant join by using the Windows PowerShell commands in Table 3. For more information about how to run these commands, see [How can I prevent students from joining my existing Office 365 tenant](https://support.office.com/en-us/article/Office-365-Education-Self-Sign-up-Technical-FAQ-7fb1b2f9-94c2-4cbb-b01e-a6eca34261d6?ui=en-US&rs=en-US&ad=US#BKMK_PreventJoins). + +*Table 3. Windows PowerShell commands to enable or disable Automatic Tenant Join* + + +| Action | Windows PowerShell command | +|------- |----------------------------| +| Enable |`Set-MsolCompanySettings -AllowEmailVerifiedUsers $true`| +| Disable |`Set-MsolCompanySettings -AllowEmailVerifiedUsers $false`| +

    +**Note**  If your institution has AD DS, then disable automatic tenant join. Instead, use Azure AD integration with AD DS to add users to your Office 365 tenant. + +### Disable automatic licensing + +To reduce your administrative effort, automatically assign Office 365 Education or Office 365 Education Plus licenses to faculty and students when they sign up (automatic licensing). Automatic licensing also enables Office 365 Education or Office 365 Education Plus features that do not require administrative approval. + +**Note**  By default, automatic licensing is enabled in Office 365 Education. If you want to use automatic licensing, then skip this section and go to the next section. + +Although all new Office 365 Education subscriptions have automatic licensing enabled by default, you can enable or disable it for your Office 365 tenant by using the Windows PowerShell commands in Table 4. For more information about how to run these commands, see [How can I prevent students from joining my existing Office 365 tenant](https://support.office.com/en-us/article/Office-365-Education-Self-Sign-up-Technical-FAQ-7fb1b2f9-94c2-4cbb-b01e-a6eca34261d6?ui=en-US&rs=en-US&ad=US#BKMK_PreventJoins). + +*Table 4. Windows PowerShell commands to enable or disable automatic licensing* + +| Action | Windows PowerShell command| +| -------| --------------------------| +| Enable |`Set-MsolCompanySettings -AllowAdHocSubscriptions $true`| +|Disable | `Set-MsolCompanySettings -AllowAdHocSubscriptions $false`| +

    +### Enable Azure AD Premium + +When you create your Office 365 subscription, you create an Office 365 tenant that includes an Azure AD directory. Azure AD is the centralized repository for all your student and faculty accounts in Office 365, Intune, and other Azure AD–integrated apps. Azure AD is available in Free, Basic, and Premium editions. Azure AD Free, which is included in Office 365 Education, has fewer features than Azure AD Basic, which in turn has fewer features than Azure AD Premium. + +Educational institutions can obtain Azure AD Basic edition licenses at no cost. After you obtain your licenses, activate your Azure AD access by completing the steps in [Step 3: Activate your Azure Active Directory access](https://azure.microsoft.com/en-us/documentation/articles/active-directory-get-started-premium/#step-3-activate-your-azure-active-directory-access). + +The Azure AD Premium features that are not in Azure AD Basic include: + +- Allow designated users to manage group membership +- Dynamic group membership based on user metadata +- Multifactor authentication (MFA) +- Identify cloud apps that your users run +- Automatic enrollment in a mobile device management (MDM) system (such as Intune) +- Self-service recovery of BitLocker +- Add local administrator accounts to Windows 10 devices +- Azure AD Connect health monitoring +- Extended reporting capabilities + +You can assign Azure AD Premium licenses to the users who need these features. For example, you may want the users who have access to confidential student information to use MFA. In this example, you could assign Azure AD Premium to only those users. + +You can sign up for Azure AD Premium, and then assign licenses to users. In this section, you sign up for Azure AD Premium. You will assign Azure AD Premium licenses to users later in the deployment process. + +For more information about: + +- Azure AD editions and the features in each, see [Azure Active Directory editions](https://azure.microsoft.com/en-us/documentation/articles/active-directory-editions/). +- How to enable Azure AD premium, see [Associate an Azure AD directory with a new Azure subscription](https://msdn.microsoft.com/en-us/library/azure/jj573650.aspx#create_tenant3). + +### Summary +You provision and initially configure Office 365 Education as part of the initial configuration. With the subscription in place, automatic tenant join configured, automatic licensing established, and Azure AD Premium enabled (if required), you’re ready to select the method you will use to create user accounts in Office 365. + +## Select an Office 365 user account–creation method + + +Now that you have an Office 365 subscription, you need to determine how you will create your Office 365 user accounts. Use the following methods to create Office 365 user accounts: + +- **Method 1:** Automatically synchronize your on-premises AD DS domain with Azure AD. Select this method if you have an on-premises AD DS domain. +- **Method 2:** Bulk-import the user accounts from a .csv file (based on information from other sources) into Azure AD. Select this method if you don’t have an on-premises AD DS domain. + +### Method 1: Automatic synchronization between AD DS and Azure AD + +In this method, you have an on-premises AD DS domain. As shown in Figure 4, the Azure AD Connector tool automatically synchronizes AD DS with Azure AD. When you add or change any user accounts in AD DS, the Azure AD Connector tool automatically updates Azure AD. + +**Note**  Azure AD Connect also supports synchronization from any Lightweight Directory Access Protocol version 3 (LDAPv3)–compliant directory by using the information provided in [Generic LDAP Connector for FIM 2010 R2 Technical Reference](https://technet.microsoft.com/en-us/library/dn510997.aspx?f=255&MSPPError=-2147217396). + +![fig 4](images/deploy-win-10-school-figure4.png) + +*Figure 4. Automatic synchronization between AD DS and Azure AD* + +For more information about how to perform this step, see the [Integrate on-premises AD DS with Azure AD](#integrate-on-premises-ad-ds-with-azure-ad) section in this guide. + +### Method 2: Bulk import into Azure AD from a .csv file + +In this method, you have no on-premises AD DS domain. As shown in Figure 5, you manually prepare a .csv file with the student information from your source, and then manually import the information directly into Azure AD. The .csv file must be in the format that Office 365 specifies. + +![fig 5](images/deploy-win-10-school-figure5.png) + +*Figure 5. Bulk import into Azure AD from other sources* + +To implement this method, perform the following steps: + +1. Export the student information from the source. Ultimately, you want to format the student information in the format the bulk-import feature requires. +2. Bulk-import the student information into Azure AD. For more information about how to perform this step, see the [Bulk-import user accounts into Office 365](#bulk-import-user-accounts-into-office-365) section. + +### Summary + +In this section, you selected the method for creating user accounts in your Office 365 subscription. Ultimately, these user accounts are in Azure AD (which is the identity management system for Office 365). Now, you’re ready to create your Office 365 accounts. + +## Integrate on-premises AD DS with Azure AD + +You can integrate your on-premises AD DS domain with Azure AD to provide identity management for your Office 365 tenant. With this integration, you can synchronize the users, security groups, and distribution lists in your AD DS domain with Azure AD with the Azure AD Connect tool. Users will be able to sign in to Office 365 automatically by using their email account and the same password they use to sign in to AD DS. + +**Note**  If your institution does not have an on-premises AD DS domain, you can skip this section. + +### Select synchronization model + +Before you deploy AD DS and Azure AD synchronization, you need to determine where you want to deploy the server that runs Azure AD Connect. + +You can deploy the Azure AD Connect tool by using one of the following methods: + +- **On premises.** As shown in Figure 6, Azure AD Connect runs on premises, which has the advantage of not requiring a virtual private network (VPN) connection to Azure. It does, however, require a virtual machine (VM) or physical server. + + ![fig 6](images/deploy-win-10-school-figure6.png) + + *Figure 6. Azure AD Connect on premises* + +- **In Azure**. As shown in Figure 7, Azure AD Connect runs on a VM in Azure AD, which has the advantages of being faster to provision (than a physical, on-premises server), offers better site availability, and helps reduce the number of on-premises servers. The disadvantage is that you need to deploy a VPN gateway on premises. + + ![fig 7](images/deploy-win-10-school-figure7.png) + + *Figure 7. Azure AD Connect in Azure* + +This guide describes how to run Azure AD Connect on premises. For information about running Azure AD Connect in Azure, see [Deploy Office 365 Directory Synchronization (DirSync) in Microsoft Azure](https://technet.microsoft.com/en-us/library/dn635310.aspx). + +### Deploy Azure AD Connect on premises + +In this synchronization model (illustrated in Figure 6), you run Azure AD Connect on premises on a physical device or VM. Azure AD Connect synchronizes AD DS user and group accounts with Azure AD. Azure AD Connect includes a wizard that helps you configure Azure AD Connect for your AD DS domain and Office 365 subscription. First, you install Azure AD Connect; then, you run the wizard to configure it for your institution. + +#### To deploy AD DS and Azure AD synchronization + +1. Configure your environment to meet the prerequisites for installing Azure AD Connect by performing the steps in [Prerequisites for Azure AD Connect](https://azure.microsoft.com/en-us/documentation/articles/active-directory-aadconnect-prerequisites/). +2. On the VM or physical device that will run Azure AD Connect, sign in with a domain administrator account. +3. Install Azure AD Connect by performing the steps in [Install Azure AD Connect](https://azure.microsoft.com/en-us/documentation/articles/active-directory-aadconnect/#install-azure-ad-connect). +4. Configure Azure AD Connect features based on your institution’s requirements by performing the steps in [Configure features](https://azure.microsoft.com/en-us/documentation/articles/active-directory-aadconnect/#configure-sync-features). + +Now that you have used on premises Azure AD Connect to deploy AD DS and Azure AD synchronization, you’re ready to verify that Azure AD Connect is synchronizing AD DS user and group accounts with Azure AD. + +### Verify synchronization + +Azure AD Connect should start synchronization immediately. Depending on the number of users in your AD DS domain, the synchronization process can take some time. To monitor the process, view the number of AD DS users and groups the tool has synchronized with Azure AD in the Office 365 admin console. + +#### To verify AD DS and Azure AD synchronization + +1. Open https://portal.office.com in your web browser. +2. Using the administrative account that you created in the [Create a new Office 365 Education subscription](#create-a-new-office-365-education-subscription) section, sign in to Office 365. +3. In the list view, expand **USERS**, and then click **Active Users**. +4. In the details pane, view the list of users. The list of users should mirror the users in AD DS. +5. In the list view, click **GROUPS**. +6. In the details pane, view the list of security groups. The list of users should mirror the security groups in AD DS. +7. In the details pane, double-click one of the security groups. +8. The list of security group members should mirror the group membership for the corresponding security group in AD DS. +9. Close the browser. + +Now that you have verified Azure AD Connect synchronization, you’re ready to assign user licenses for Azure AD Premium. + +### Summary + +In this section, you selected your synchronization model, deployed Azure AD Connect, and verified that Azure AD is synchronizing properly. + +## Bulk-import user and group accounts into AD DS + +You can bulk-import user and group accounts into your on-premises AD DS domain. Bulk-importing accounts helps reduce the time and effort needed to create users compared to creating the accounts manually in the Office 365 Admin portal. First, you select the appropriate method for bulk-importing user accounts into AD DS. Next, you create the .csv file that contains the user accounts. Finally, you use the selected method to import the .csv file into AD DS. + +**Note**  If your institution doesn’t have an on-premises AD DS domain, you can skip this section. + +### Select the bulk import method + +Several methods are available to bulk-import user accounts into AD DS domains. Table 5 lists the methods that the Windows Server operating system supports natively. In addition, you can use partner solutions to bulk-import user and group accounts into AD DS. + +*Table 5. AD DS bulk-import account methods* + +|Method | Description and reason to select this method | +|-------| ---------------------------------------------| +|Ldifde.exe |This command-line tool allows you to import and export objects (such as user accounts) from AD DS. Select this method if you aren’t comfortable with Microsoft Visual Basic Scripting Edition (VBScript), Windows PowerShell, or other scripting languages. For more information about using Ldifde.exe, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/en-us/library/bb727091.aspx), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/en-us/kb/555636), [Import or Export Directory Objects Using Ldifde](https://technet.microsoft.com/library/cc816781.aspx), and [LDIFDE](https://technet.microsoft.com/library/cc755456.aspx).| +|VBScript | This scripting language uses the Active Directory Services Interfaces (ADSI) Component Object Model interface to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with VBScript. For more information about using VBScript and ADSI, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/en-us/library/bb727091.aspx) and [ADSI Scriptomatic](https://technet.microsoft.com/en-us/scriptcenter/dd939958.aspx).| +|Windows PowerShell| This scripting language natively supports cmdlets to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with Window PowerShell scripting. For more information about using Windows PowerShell, see [Import Bulk Users to Active Directory](https://blogs.technet.microsoft.com/bettertogether/2011/01/09/import-bulk-users-to-active-directory/) and [PowerShell: Bulk create AD Users from CSV file](http://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx).| +

    +### Create a source file that contains the user and group accounts + +After you have selected your user and group account bulk import method, you’re ready to create the source file that contains the user and group account. You’ll use the source file as the input to the import process. The source file format depends on the method you selected. Table 6 lists the source file format for the bulk import methods. + +*Table 6. Source file format for each bulk import method* + +| Method | Source file format | +|--------| -------------------| +|Ldifde.exe|Ldifde.exe requires a specific format for the source file. Use Ldifde.exe to export existing user and group accounts so that you can see the format. For examples of the format that Ldifde.exe requires, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/en-us/library/bb727091.aspx), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/en-us/kb/555636), [Import or Export Directory Objects Using Ldifde](https://technet.microsoft.com/library/cc816781.aspx), and [LDIFDE](https://technet.microsoft.com/library/cc755456.aspx).| +|VBScript | VBScript can use any .csv file format to create a source file for the bulk-import process. To create the .csv file, use software such as Excel. For examples of how to format your source file in comma-separated values (CSV) format, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/en-us/library/bb727091.aspx).| +| Windows PowerShell| Windows PowerShell can use any .csv file format you want to create as a source file for the bulk-import process. To create the .csv file, use software such as Excel. For examples of how to format your source file in CSV format, see [Import Bulk Users to Active Directory](https://blogs.technet.microsoft.com/bettertogether/2011/01/09/import-bulk-users-to-active-directory/) and [PowerShell: Bulk create AD Users from CSV file](http://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx).| +

    +### Import the user accounts into AD DS + +With the bulk-import source file finished, you’re ready to import the user and group accounts into AD DS. The steps for importing the file are slightly different for each method. + +**Note**  Bulk-import your group accounts first, and then import your user accounts. Importing in this order allows you to specify group membership when you import your user accounts. + +For more information about how to import user accounts into AD DS by using: + +- Ldifde.exe, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/en-us/library/bb727091.aspx), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/en-us/kb/555636), [Import or Export Directory Objects Using Ldifde](https://technet.microsoft.com/library/cc816781.aspx), and [LDIFDE](https://technet.microsoft.com/library/cc755456.aspx). +- VBScript, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/en-us/library/bb727091.aspx). +- Windows PowerShell, see [Import Bulk Users to Active Directory](https://blogs.technet.microsoft.com/bettertogether/2011/01/09/import-bulk-users-to-active-directory/) and [PowerShell: Bulk create AD Users from CSV file](http://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx). + +### Summary + +In this section, you selected the bulk-import method, created the source file that contains the user and group accounts, and imported the user and group accounts in to AD DS. If you have Azure AD Connect, it automatically synchronizes the new AD DS user and group accounts to Azure AD. Now, you’re ready to assign user licenses for Azure AD Premium in the [Assign user licenses for Azure AD Premium](#assign-user-licenses-for-azure-ad-premium) section later in this guide. + +## Bulk-import user accounts into Office 365 + +You can bulk-import user and group accounts directly into Office 365, reducing the time and effort required to create users. First, you bulk-import the user accounts into Office 365. Then, you create the security groups for your institution. Finally, you create the email distribution groups your institution requires. + +### Create user accounts in Office 365 + +Now that you have created your new Office 365 Education subscription, you need to create user accounts. You can add user accounts for the teachers, other faculty, and students who will use the classroom. + +You can use the Office 365 admin center to add individual Office 365 accounts manually—a reasonable process when you’re adding only a few users. If you have many users, however, you can automate the process by creating a list of those users, and then use that list to create user accounts (that is, bulk-add users). + +The bulk-add process assigns the same Office 365 Education license plan to all users on the list. Therefore, you must create a separate list for each license plan you recorded in Table 2. Depending on the number of faculty members who need to use the classroom, you may want to add the faculty Office 365 accounts manually; however, use the bulk-add process to add student accounts. + +For more information about how to bulk-add users to Office 365, see [Add several users at the same time to Office 365](https://support.office.com/en-us/article/Add-several-users-at-the-same-time-to-Office-365-Admin-Help-1f5767ed-e717-4f24-969c-6ea9d412ca88?ui=en-US&rs=en-US&ad=US). + +**Note**  If you encountered errors during bulk add, resolve them before you continue the bulk-add process. You can view the log file to see which users caused the errors, and then modify the .csv file to correct the problems. Click **Back** to retry the verification process. + +The email accounts are assigned temporary passwords upon creation. You must communicate these temporary passwords to your users before they can sign in to Office 365. + +### Create Office 365 security groups + +Assign SharePoint Online resource permissions to Office 365 security groups, not individual user accounts. For example, create one security group for faculty members and another for students. Then, you can assign unique SharePoint Online resource permissions to faculty members and a different set of permissions to students. Add or remove users from the security groups to grant or revoke access to SharePoint Online resources. + +**Note**  If your institution has AD DS, don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Azure AD integration to synchronize the security groups with your Office 365 tenant. + +For information about creating security groups, see [Create and manage Office 365 groups in Admin Center Preview](https://support.office.com/en-us/article/Create-and-manage-Office-365-groups-in-Admin-Center-Preview-93df5bd4-74c4-45e8-9625-56db92865a6e?ui=en-US&rs=en-US&ad=US). + +You can add and remove users from security groups at any time. + +**Note**  Office 365 evaluates group membership when users sign in. If you change group membership for a user, that user may need to sign out, and then sign in again for the change to take effect. + +### Create email distribution groups + +Microsoft Exchange Online uses an email distribution group as a single email recipient for multiple users. For example, you could create an email distribution group that contains all students. Then, you could send a message to the email distribution group instead of individually addressing the message to each student. + +You can create email distribution groups based on job role (such as teachers, administration, or students) or specific interests (such as robotics, drama club, or soccer team). You can create any number of distribution groups, and users can be members of more than one group. + +**Note**  Office 365 can take some time to complete the Exchange Online creation process. You will have to wait until Office 365 completes the Exchange Online creation process before you can perform the following steps. + +For information about how to create security groups, see [Create and manage Office 365 groups in Admin Center Preview](https://support.office.com/en-us/article/Create-and-manage-Office-365-groups-in-Admin-Center-Preview-93df5bd4-74c4-45e8-9625-56db92865a6e?ui=en-US&rs=en-US&ad=US). + +### Summary + +Now, you have bulk-imported the user accounts into Office 365. First, you selected the bulk-import method. Next, you created the Office 365 security groups in Office 365. Finally, you created the Office 365 email distribution groups. Now, you’re ready to assign user licenses for Azure AD Premium. + +## Assign user licenses for Azure AD Premium + +Azure AD is available in Free, Basic, and Premium editions. Azure AD Free, which is included in Office 365 Education, has fewer features than Azure AD Basic, which in turn has fewer features than Azure AD Premium. Educational institutions can obtain Azure AD Basic licenses at no cost and Azure AD Premium licenses at a reduced cost. + +You can assign Azure AD Premium licenses to the users who need the features this edition offers. For example, you may want the users who have access to confidential student information to use MFA. In this example, you could assign Azure AD Premium only to those users. + +For more information about: + +- Azure AD editions, see [Azure Active Directory editions](https://azure.microsoft.com/en-us/documentation/articles/active-directory-editions/). +- How to assign user licenses for Azure AD Premium, see [How to assign EMS/Azure AD Premium licenses to user accounts](https://channel9.msdn.com/Series/Azure-Active-Directory-Videos-Demos/How-to-assign-Azure-AD-Premium-Licenses-to-user-accounts). + +## Create and configure a Windows Store for Business portal + +Windows Store for Business allows you to create your own private portal to manage Windows Store apps in your institution. With Windows Store for Business, you can do the following: + +- Find and acquire Windows Store apps. +- Manage apps, app licenses, and updates. +- Distribute apps to your users. + +For more information about Windows Store for Business, see [Windows Store for Business overview](https://technet.microsoft.com/itpro/windows/whats-new/windows-store-for-business-overview). + +The following section shows you how to create a Windows Store for Business portal and configure it for your school. + +### Create and configure your Windows Store for Business portal + +To create and configure your Windows Store for Business portal, simply use the administrative account for your Office 365 subscription to sign in to Windows Store for Business. Windows Store for Business automatically creates a portal for your institution and uses your account as its administrator. + +#### To create and configure a Windows Store for Business portal + +1. In Microsoft Edge or Internet Explorer, type `http://microsoft.com/business-store` in the address bar. +2. On the **Windows Store for Business** page, click **Sign in with an organizational account**.

    **Note**  If your institution has AD DS, then don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Azure AD integration to synchronize the security groups with your Office 365 tenant. +3. On the Windows Store for Business sign-in page, use the administrative account for the Office 365 subscription you created in the [Create a new Office 365 Education subscription](#create-a-new-office-365-education-subscription) section to sign in. +4. On the **Windows Store for Business Services Agreement** page, review the agreement, select the **I accept this agreement and certify that I have the authority to bind my organization to its terms** check box, and then click **Accept** +5. In the **Welcome to the Windows Store for Business** dialog box, click **OK**. + +After you create the Windows Store for Business portal, configure it by using the commands in the settings menu listed in Table 7. Depending on your institution, you may (or may not) need to change these settings to further customize your portal. + +*Table 7. Menu selections to configure Windows Store for Business settings* + +| Menu selection | What you can do in this menu | +|---------------| -------------------| +|Account information|Displays information about your Windows Store for Business account (no settings can be changed). You make changes to this information in Office 365 or the Azure Portal. For more information, see [Update Windows Store for Business account settings](https://technet.microsoft.com/itpro/windows/manage/update-windows-store-for-business-account-settings).| +|Device Guard signing|Allows you to upload and sign Device Guard catalog and policy files. For more information about Device Guard, see [Device Guard deployment guide](https://technet.microsoft.com/itpro/windows/keep-secure/device-guard-deployment-guide).| +|LOB publishers| Allows you to add line-of-business (LOB) publishers that can then publish apps to your private store. LOB publishers are usually internal developers or software vendors that are working with your institution. For more information, see [Working with line-of-business apps](https://technet.microsoft.com/itpro/windows/manage/working-with-line-of-business-apps).| +|Management tools| Allows you to add tools that you can use to distribute (deploy) apps in your private store. For more information, see [Distribute apps with a management tool](https://technet.microsoft.com/itpro/windows/manage/distribute-apps-with-management-tool).| +|Offline licensing|Allows you to show (or not show) offline licensed apps to people shopping in your private store. For more information, see [Licensing model: online and offline licenses](https://technet.microsoft.com/itpro/windows/manage/apps-in-windows-store-for-business#licensing-model).| +|Permissions|Allows you to grant other users in your organization the ability to buy, manage, and administer your Windows Store for Business portal. You can also remove permissions you have previously granted. For more information, see [Roles and permissions in Windows Store for Business](https://technet.microsoft.com/itpro/windows/manage/roles-and-permissions-windows-store-for-business).| +|Private store|Allows you to change the organization name used in your Windows Store for Business portal. When you create your portal, the private store uses the organization name that you used to create your Office 365 subscription. For more information, see [Distribute apps using your private store](https://technet.microsoft.com/itpro/windows/manage/distribute-apps-from-your-private-store).| +

    +### Find, acquire, and distribute apps in the portal + +Now that you have created your Windows Store for Business portal, you’re ready to find, acquire, and distribute apps that you will add to your portal. You do this by using the Inventory page in Windows Store for Business. + +**Note**  Your educational institution can now use a credit card or purchase order to pay for apps in Windows Store for Business. + +You can deploy apps to individual users or make apps available to users through your private store. Deploying apps to individual users restricts the app to those specified users. Making apps available through your private store allows all your users. + +For more information about how to find, acquire, and distribute apps in the portal, see [App inventory management for Windows Store for Business](https://technet.microsoft.com/itpro/windows/manage/app-inventory-managemement-windows-store-for-business). + +### Summary + +At the end of this section, you should have a properly configured Windows Store for Business portal. You have also found and acquired your apps from Windows Store. Finally, you should have deployed all your Windows Store apps to your users. Now, you’re ready to deploy Windows Store apps to your users. + +## Plan for deployment + +You will use the LTI deployment process in MDT to deploy Windows 10 to devices or to upgrade devices to Windows 10. Prior to preparing for deployment, you must make some deployment planning decisions, including selecting the operating systems you will use, the approach you will use to create your Windows 10 images, and the method you will use to initiate the LTI deployment process. + +### Select the operating systems + +Later in the process, you will import the versions of Windows 10 you want to deploy. You can deploy the operating system to new devices, refresh existing devices, or upgrade existing devices. In the case of: + +- New devices or refreshing existing devices, you will complete replace the existing operating system on a device with Windows 10. +- Upgrading existing devices, you will upgrade the existing operating system (the Windows 8.1 or Windows 7 operating system) to Windows 10. + +Depending on your school’s requirements, you may need any combination of the following Windows 10 editions: + +- **Windows 10 Home**. Use this operating system to upgrade existing eligible institution-owned and personal devices that are running Windows 8.1 Home or Windows 7 Home to Windows 10 Home. +- **Windows 10 Pro**. Use this operating system to: + - Upgrade existing eligible institution-owned and personal devices running Windows 8.1 Pro or Windows 7 Professional to Windows 10 Pro. + - Deploy new instances of Windows 10 Pro to devices so that new devices have a known configuration. +- **Windows 10 Education**. Use this operating system to: + - Upgrade institution-owned devices to Windows 10 Education. + - Deploy new instances of Windows 10 Education so that new devices have a known configuration. + +**Note**  Although you can use Windows 10 Home on institution-owned devices, Microsoft recommends that you use Windows 10 Pro or Windows 10 Education, instead. Windows 10 Pro and Windows 10 Education provide support for MDM, policy-based management, and Windows Store for Business. These features are not available in Windows 10 Home. + +One other consideration is the mix of processor architectures you will support. If you can, support only 64-bit versions of Windows 10. If you have devices that can run only 32 bit versions of Windows 10, you will need to import both 64-bit and 32-bit versions of the Windows 10 editions listed above. + +**Note**  On devices that have minimal system resources (such as devices with only 2 GB of memory or 32 GB of storage), use 32-bit versions of Windows 10 because 64-bit versions of Windows 10 place more stress on device system resources. + +Finally, as a best practice, minimize the number of operating systems that you deploy and manage. If possible, standardize institution-owned devices on one Windows 10 edition (such as a 64-bit version of Windows 10 Education or Windows 10 Pro). Of course, you cannot standardize personal devices on a specific operating system version or processor architecture. + +### Select an image approach + +A key operating system image decision is whether to use a “thin” or “thick” image. *Thin images* contain only the operating system, and MDT installs the necessary device drivers and apps after the operating system has been installed. *Thick images* contain the operating system, “core” apps (such as Office), and device drivers. With thick images, MDT installs any device drivers and apps not included in the thick image after the operating system has been installed. + +The advantage to a thin image is that the final deployment configuration is dynamic, and you can easily change the configuration without having to capture another image. The disadvantage of a thin image is that it takes longer to complete the deployment. + +The advantage of a thick image is that the deployment takes less time than it would for a thin image. The disadvantage of a thick image is that you need to capture a new image each time you want to make a change to the operating system, apps, or other software in the image. + +### Select a method to initiate deployment + +The MDT deployment process is highly automated, requiring minimal information to deploy or upgrade Windows 10, but you must manually initiate the MDT deployment process. To do so, use the method listed in Table 8 that best meets the needs of your institution. + +*Table 8. Methods to initiate MDT deployment* + + ++++ + + + + + + + + + + + + + + + + + + + + + + + +
    MethodDescription and reason to select this method
    Windows Deployment ServicesThis method:

    +
      +
    • Uses diskless booting to initiate MDT deployment.
    • +
    • Works only with devices that support PXE boot.
    • +
    • Deploys Windows 10 over the network, which consumes more network bandwidth than deployment from local media.
    • +
    • Deploys images more slowly than when using local media.
    • +
    • Requires that you deploy a Windows Deployment Services server.
    • +
    + +Select this method when you want to deploy Windows over-the-network and perform diskless booting. The advantage of this method is that the diskless media are generic and typically don’t require updates after you create them (the Deployment Wizard accesses the centrally located deployment share over the network). The disadvantage of this method is that over-the-network deployments are slower than deployments from local media, and you must deploy a Windows Deployment Services server.
    Bootable mediaThis method:

    +
      +
    • Initiates MDT deployment by booting from local media, including from USB drives, DVD-ROM, or CD-ROM.
    • +
    • Deploys Windows 10 over the network, which consumes more network bandwidth than deployment from local media.
    • +
    • Deploys images more slowly than when using local media.
    • +
    • Requires no additional infrastructure.
    • +
    + +Select this method when you want to deploy Windows over-the-network and are willing to boot the target device from local media. The advantage of this method is that the media are generic and typically don’t require updates after you create them (the Deployment Wizard accesses the centrally located deployment share over the network). The disadvantage of this method is that over-the-network deployments are slower than deployment from local media.
    MDT deployment mediaThis method:

    +
      +
    • Initiates MDT deployment by booting from a local USB hard disk.
    • +
    • Deploys Windows 10 from local media, which consumes less network bandwidth than over-the-network methods.
    • +
    • Deploys images more quickly than network-based methods do.
    • +
    • Requires a USB hard disk because of the deployment share’s storage requirements (up to 100 GB).
    • +
    + +Select this method when you want to perform local deployments and are willing to boot the target device from a local USB hard disk. The advantage of this method is that local deployments are faster than over-the-network deployments. The disadvantage of this method is that each time you change the deployment share, you must regenerate the MDT deployment media and update the USB hard disk.
    + +### Summary + +At the end of this section, you should know the Windows 10 editions and processor architecture that you want to deploy (and will import later in the process). You also determined whether you want to use thin or thick images. Finally, you selected the method for initiating your LTI deployment. Now, you can prepare for Windows 10 deployment. + +## Prepare for deployment + +To deploy Windows 10 to devices, using the LTI deployment method in MDT. In this section, you prepare your MDT environment and Windows Deployment Services for Windows 10 deployment. + +### Configure the MDT deployment share + +The first step in preparation for Windows 10 deployment is to configure—that is, *populate*—the MDT deployment share. Table 9 lists the MDT deployment share configuration tasks that you must perform. Perform the tasks in the order represented in Table 9. + +*Table 9. Tasks to configure the MDT deployment share* + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    TaskDescription
    1. Import operating systemsImport the operating systems that you selected in the [Select operating systems](#select-the-operating-systems) section into the deployment share. For more information about how to import operating systems, see [Import an Operating System into the Deployment Workbench](https://technet.microsoft.com/en-us/library/dn759415.aspx#ImportanOperatingSystemintotheDeploymentWorkbench).
    2. Import device drivesDevice drivers allow Windows 10 to know a device’s hardware resources and connected hardware accessories. Without the proper device drivers, certain features may be unavailable. For example, without the proper audio driver, a device cannot play sounds; without the proper camera driver, the device cannot take photos or use video chat.

    + +Import device drivers for each device in your institution. For more information about how to import device drivers, see [Import Device Drivers into the Deployment Workbench](https://technet.microsoft.com/en-us/library/dn759415.aspx#ImportDeviceDriversintotheDeploymentWorkbench). + +
    3. Create MDT applications for Windows Store appsCreate an MDT application for each Windows Store app you want to deploy. You can deploy Windows Store apps by using *sideloading*, which allows you to use the **Add-AppxPackage** Windows PowerShell cmdlet to deploy the .appx files associated with the app (called *provisioned apps*). Use this method to deploy up to 24 apps to Windows 10.

    + +Prior to sideloading the .appx files, obtain the Windows Store .appx files that you will use to deploy (sideload) the apps in your provisioning package. For apps in Windows Store, you will need to obtain the .appx files from the app software vendor directly. If you are unable to obtain the .appx files from the app software vendor, then you or the students will need to install the apps on the student devices directly from Windows Store or Windows Store for Business.

    + +If you have Intune, you can deploy Windows Store apps after you deploy Windows 10, as described in the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section. This method provides granular deployment of Windows Store apps, and you can use it for ongoing management of Windows Store apps. This is the preferred method of deploying and managing Windows Store apps.

    + +In addition, you must prepare your environment for sideloading (deploying) Windows Store apps. For more information about how to:

    +
      +
    • Prepare your environment for sideloading, see [Sideload LOB apps in Windows 10](https://technet.microsoft.com/en-us/itpro/windows/deploy/sideload-apps-in-windows-10).
    • +
    • Create an MDT application, see [Create a New Application in the Deployment Workbench](https://technet.microsoft.com/en-us/library/dn759415.aspx#CreateaNewApplicationintheDeploymentWorkbench).
    • +
    + + +
    4. Create MDT applications for Windows desktop apps +You need to create an MDT application for each Windows desktop app you want to deploy. You can obtain the Windows desktop apps from any source, but ensure that you have sufficient licenses for them.

    + +To help reduce the effort needed to deploy Microsoft Office 2016 desktop apps, use the Office Deployment Tool, as described in [Deploy Click-to-Run for Office 365 products by using the Office Deployment Tool](https://technet.microsoft.com/en-us/library/jj219423.aspx?f=255&MSPPError=-2147217396).

    + +If you have Intune, you can deploy Windows desktop apps after you deploy Windows 10, as described in the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section. This method provides granular deployment of Windows desktop apps, and you can use it for ongoing management of the apps. This is the preferred method for deploying and managing Windows desktop apps.

    + +**Note**  You can also deploy Windows desktop apps after you deploy Windows 10, as described in the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section.

    + +For more information about how to create an MDT application for Window desktop apps, see [Create a New Application in the Deployment Workbench](https://technet.microsoft.com/en-us/library/dn759415.aspx#CreateaNewApplicationintheDeploymentWorkbench). + +
    5. Create task sequences. +You must create a separate task sequences for each Windows 10 edition, processor architecture, operating system upgrade process, and new operating system deployment process. Minimally, create a task sequence for each Windows 10 operating system you imported in Step 1—for example, (1) if you want to deploy Windows 10 Education to new devices or refresh existing devices with a new deployment of Windows 10 Education; (2) if you want to upgrade existing devices running Windows 8.1 or Windows 7 to Windows 10 Education; or (3) if you want to run deployments and upgrades for both 32 bit and 64 bit versions of Windows 10. To do so, you must create task sequences that will: +

    +
    • Deploy Windows 10 Education 64-bit to devices.
    • +
    • Deploy Windows 10 Education 32-bit to devices.
    • +
    • Upgrade existing devices to Windows 10 Education 64-bit.
    • +
    • Upgrade existing devices to Windows 10 Education 32-bit.
    • +
    + +Again, you will create the task sequences based on the operating systems that you imported in Step 1. For more information about how to create a task sequence, see [Create a New Task Sequence in the Deployment Workbench](https://technet.microsoft.com/en-us/library/dn759415.aspx#CreateaNewTaskSequenceintheDeploymentWorkbench). + +
    6. Update the deployment share. +Updating a deployment share generates the MDT boot images you use to initiate the Windows 10 deployment process. You can configure the process to create 32 bit and 64 bit versions of the .iso and .wim files you can use to create bootable media or in Windows Deployment Services.

    + +For more information about how to update a deployment share, see [Update a Deployment Share in the Deployment Workbench](https://technet.microsoft.com/en-us/library/dn759415.aspx#UpdateaDeploymentShareintheDeploymentWorkbench).
    + +### Configure Window Deployment Services for MDT + +You can use Windows Deployment Services in conjunction with MDT to automatically initiate boot images on target computers. These boot images can be Windows PE images (which you generated in Step 6 in Table 9) or custom images that can deploy operating systems directly to the target computers. + +#### To configure Windows Deployment Services for MDT + +1. Set up and configure Windows Deployment Services.

    Windows Deployment Services is a server role available in all Windows Server editions. You can enable the Windows Deployment Services server role on a new server or on any server running Windows Server in your institution. For more information about how to perform this step, see the following resources: + + - [Windows Deployment Services overview](https://technet.microsoft.com/library/hh831764.aspx) + - The Windows Deployment Services Help file, included in Windows Deployment Services + - [Windows Deployment Services Getting Started Guide for Windows Server 2012](https://technet.microsoft.com/en-us/library/jj648426.aspx) + +2. Add LTI boot images (Windows PE images) to Windows Deployment Services.

    The LTI boot images (.wim files) that you will add to Windows Deployment Services are in the MDT deployment share. Locate the .wim files in the Boot subfolder in the deployment share. For more information about how to perform this step, see [Add LTI Boot Images to Windows Deployment Services](https://technet.microsoft.com/en-us/library/dn759415.aspx#AddLTIBootImagestoWindowsDeploymentServices). + +### Summary + +Now, Windows Deployment Services is ready to initiate the LTI deployment process in MDT. You have set up and configured Windows Deployment Services and added the LTI boot images, which you generated in the previous section, to Windows Deployment Services. Now, you’re ready to prepare to manage the devices in your institution. + +## Prepare for device management + +Before you deploy Windows 10 in your institution, you must prepare for device management. You will deploy Windows 10 in a configuration that complies with your requirements, but you want to help ensure that your deployments remain compliant. + +### Select the management method + +If you have only one device to configure, manually configuring that one device is tedious but possible. When you have multiple classrooms of devices to configure, however, manually configuring each device becomes overwhelming. In addition, manually keeping an identical configuration on each device is virtually impossible as the number of devices in the school increases. + +For a school, there are many ways to manage devices. Table 10 lists the methods that this guide describes and recommends. Use the information in Table 10 to determine which combination of management methods is right for your institution. + +*Table 10. School management methods* + + ++++ + + + + + + + + + + + + + + + + + + + +
    MethodDescription
    Group Policy +Group Policy is an integral part of AD DS and allows you to specify configuration settings for Windows 10 and previous versions of Windows. Select this method when you: +
      +
    • Want to manage institution-owned devices that are domain joined (personally owned devices are typically not domain joined).
    • +
    • Want more granular control of device and user settings.
    • +
    • Have an existing AD DS infrastructure.
    • +
    • Typically manage on-premises devices.
    • +
    • Can manage a required setting only by using Group Policy.
    • +
    + +The advantages of this method include: +
      +
    • No cost beyond the AD DS infrastructure.
    • +
    • A larger number of settings (compared to Intune).
    • +
    +The disadvantages of this method are: +
      +
    • Can only manage domain-joined (institution-owned devices).
    • +
    • Requires an AD DS infrastructure (if the institution does not have AD DS already).
    • +
    • Typically manages on-premises devices (unless devices connect by using a VPN or DirectAccess).
    • +
    +
    IntuneIntune is a cloud-based management system that allows you to specify configuration settings for Windows 10, previous versions of Windows, and other operating systems (such as iOS or Android). Intune is a subscription-based cloud service that integrates with Office 365 and Azure AD. +Select this method when you: +
      +
    • Want to manage institution-owned and personal devices (does not require that the device be domain joined).
    • +
    • Don’t require the level of granular control over device and user settings (compared to Group Policy).
    • +
    • Don’t have an existing AD DS infrastructure.
    • +
    • Need to manage devices regardless of where they are (on or off premises).
    • +
    • Can manage a required setting only by using Intune.
    • +
    + +The advantages of this method are: +
      +
    • You can manage institution-owned and personal devices.
    • +
    • It doesn’t require that devices be domain joined.
    • +
    • It doesn’t require any on-premises infrastructure.
    • +
    • It can manage devices regardless of their location (on or off premises).
    • + +
    +The disadvantages of this method are: +
      +
    • Carries an additional cost for subscription.
    • +
    • Doesn’t have a granular level control over device and user settings (compared to Group Policy).
    • +
    + +

    + +### Select Microsoft-recommended settings + +Microsoft has several recommended settings for educational institutions. Table 11 lists them, provides a brief description of why you need to configure them, and recommends methods for configuring the settings. Review the settings in Table 11 and evaluate their relevancy to your institution. Use the information to help you determine whether you need to configure the setting and which method you will use to do so. At the end, you will have a list of settings that you want to apply to the Windows 10 devices and know which management method you will use to configure the settings. + +*Table 11. Recommended settings for educational institutions* + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    RecommendationDescription
    Use of Microsoft accountsYou want faculty and students to use only Azure AD accounts for institution-owned devices. For these devices, do not use Microsoft accounts or associate a Microsoft account with the Azure AD accounts.

    +**Note**  Personal devices typically use Microsoft accounts. Faculty and students can associate their Microsoft account with their Azure AD account on these devices.

    +**Group Policy.** Configure the [Accounts: Block Microsoft accounts](https://technet.microsoft.com/en-us/library/jj966262.aspx?f=255&MSPPError=-2147217396) Group Policy setting to use the Users can’t add Microsoft accounts setting option.

    +**Intune.** Enable or disable the camera by using the **Allow Microsoft account**, **Allow adding non-Microsoft accounts manually**, and **Allow settings synchronization for Microsoft accounts** policy settings under the **Accounts and Synchronization** section of a **Windows 10 General Configuration** policy. +
    Restrict local administrator accounts on the devicesEnsure that only authorized users are local administrators on institution-owned devices. Typically, you don’t want students to be administrators on instruction-owned devices. Explicitly specify the users who will be local administrators on a group of devices.

    +**Group Policy**. Create a **Local Group** Group Policy preference to limit the local administrators group membership. Select the **Delete all member users** and **Delete all member groups** check boxes to remove any existing members. For more information about how to configure Local Group preferences, see [Configure a Local Group Item](https://technet.microsoft.com/en-us/library/cc732525.aspx).

    +**Intune**. Not available. +
    Restrict the local administrator accounts on the devicesEnsure that only authorized users are local administrators on institution-owned devices. Typically, you don’t want students to be administrators on instruction-owned devices. Explicitly specify the users who will be local administrators on a group of devices.

    +**Group Policy**. Create a **Local Group** Group Policy preference to limit the local administrators group membership. Select the **Delete all member users** and **Delete all member groups** check boxes to remove any existing members. For more information about how to configure Local Group preferences, see [Configure a Local Group Item](https://technet.microsoft.com/en-us/library/cc732525.aspx).

    +**Intune**. Not available. +
    Manage the built-in administrator account created during device deploymentWhen you use MDT to deploy Windows 10, the MDT deployment process automatically creates a local Administrator account with the password you specified. As a security best practice, rename the built-in Administrator account and optionally disable it.

    +**Group Policy**. Rename the built-in Administrator account by using the **Accounts: Rename administrator account** Group Policy setting. For more information about how to rename the built-in Administrator account, see [To rename the Administrator account using the Group Policy Management Console](https://technet.microsoft.com/en-us/library/cc747484.aspx). You will specify the new name for the Administrator account. You can disable the built-in Administrator account by using the **Accounts: Administrator account status** Group Policy setting. For more information about how to disable the built-in Administrator account, see [Accounts: Administrator account status](https://technet.microsoft.com/en-us/library/jj852165.aspx).

    +**Intune**. Not available. +
    Control Windows Store accessYou can control access to Windows Store and whether existing Windows Store apps receive updates. You can only disable the Windows Store app in Windows 10 Education and Windows 10 Enterprise.

    +**Group Policy**. You can disable the Windows Store app by using the **Turn off the Store Application** Group Policy setting. You can prevent Windows Store apps from receiving updates by using the **Turn off Automatic Download and Install of updates** Group Policy setting. For more information about configuring these settings, see [Can I use Group Policy to control the Windows Store in my enterprise environment?](https://technet.microsoft.com/en-us/library/hh832040.aspx#BKMK_UseGP).

    +**Intune**. You can enable or disable the camera by using the **Allow application store** policy setting in the **Apps** section of a **Windows 10 General Configuration** policy. +
    Use of Remote Desktop connections to devicesRemote Desktop connections could allow unauthorized access to the device. Depending on your institution’s policies, you may want to disable Remote Desktop connections on your devices.

    +**Group Policy**. You can enable or disable Remote Desktop connections to devices by using the **Allow Users to connect remotely using Remote Desktop setting** in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections.

    +**Intune**. Not available. +
    Use of cameraA device’s camera can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the camera on your devices.

    +**Group Policy**. Not available.

    +**Intune**. You can enable or disable the camera by using the **Allow camera** policy setting in the **Hardware** section of a **Windows 10 General Configuration** policy. +
    Use of audio recordingAudio recording (by using the Sound Recorder app) can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the Sound Recorder app on your devices.

    +**Group Policy**. You can disable the Sound Recorder app by using the **Do not allow Sound Recorder to run** Group Policy setting. You can disable other audio recording apps by using AppLocker policies. Create AppLocker policies by using the information in [Editing an AppLocker Policy](https://technet.microsoft.com/en-us/library/ee791894(v=ws.10).aspx) and [Create Your AppLocker Policies](https://technet.microsoft.com/en-us/library/ee791899.aspx).

    +**Intune**. You can enable or disable the camera by using the **Allow voice recording** policy setting in the **Features** section of a **Windows 10 General Configuration** policy. +
    Use of screen captureScreen captures can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the ability to perform screen captures on your devices.

    +**Group Policy**. Not available.

    +**Intune**. You can enable or disable the camera by using the **Allow screen capture** policy setting in the **System** section of a **Windows 10 General Configuration** policy. +
    Use of location servicesProviding a device’s location can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the location service on your devices.

    +**Group Policy**. You can enable or disable location services by using the **Turn off location** Group Policy setting in User Configuration\Windows Components\Location and Sensors.

    +**Intune**. You can enable or disable the camera by using the **Allow geolocation** policy setting in the **Hardware** section of a **Windows 10 General Configuration** policy. +
    Changing wallpaperDisplaying a custom wallpaper can be a source of disclosure or privacy issues in an education environment (if the wallpaper displays information about the user or the device). Depending on your institution’s policies, you may want to prevent users from changing the wallpaper on your devices.

    +**Group Policy**. You can configure the wallpaper by using the **Desktop WallPaper** setting in User Configuration\Administrative Templates\Desktop\Desktop.

    +**Intune**. Not available. +

    + +### Configure settings by using Group Policy + +Now, you’re ready to configure settings by using Group Policy. The steps in this section assume that you have an AD DS infrastructure. You will configure the Group Policy settings you select in the [Select Microsoft-recommended settings](#select-microsoft-recommended-settings) section. + +For more information about Group Policy, see [Group Policy Planning and Deployment Guide](https://technet.microsoft.com/en-us/library/cc754948.aspx). + +#### To configure Group Policy settings + +1. Create a Group Policy object (GPO) that will contain the Group Policy settings by completing the steps in [Create a new Group Policy object](https://technet.microsoft.com/en-us/library/cc738830.aspx). +2. Configure the settings in the GPO by completing the steps in [Edit a Group Policy object](https://technet.microsoft.com/en-us/library/cc739902.aspx). +3. Link the GPO to the appropriate AD DS site, domain, or organizational unit by completing the steps in [Link a Group Policy object to a site, domain, or organizational unit](https://technet.microsoft.com/en-us/library/cc738954(v=ws.10).aspx). + +### Configure settings by using Intune + +Now, you’re ready to configure settings by using Intune. The steps in this section assume that you have an Office 365 subscription. You will configure the Intune settings that you selected in the [Select Microsoft-recommended settings](#select-microsoft-recommended-settings) section. + +For more information about Intune, see [Documentation for Microsoft Intune](https://docs.microsoft.com/en-us/intune/). + +#### To configure Intune settings + +1. Add Intune to your Office 365 subscription by completing the steps in [Get started with a paid subscription to Microsoft Intune](https://docs.microsoft.com/en-us/intune/get-started/start-with-a-paid-subscription-to-microsoft-intune). +2. Enroll devices with Intune by completing the steps in [Get ready to enroll devices in Microsoft Intune](https://technet.microsoft.com/en-us/library/dn646962.aspx). +3. Configure the settings in Intune Windows 10 policies by completing the steps in [Manage settings and features on your devices with Microsoft Intune policies](https://technet.microsoft.com/en-us/library/dn646984.aspx). +4. Manage Windows 10 devices by completing the steps in [Manage Windows PCs with Microsoft Intune](https://technet.microsoft.com/en-us/library/dn646959.aspx). + +### Deploy apps by using Intune + +You can use Intune to deploy Windows Store and Windows desktop apps. Intune provides improved control over which users receive specific apps. In addition, Intune allows you deploy apps to companion devices (such as Windows 10 Mobile, iOS, or Android devices) Finally, Intune helps you manage app security and features, such as mobile application management policies that let you manage apps on devices that are not enrolled in Intune or are managed by another solution. + +For more information about how to configure Intune to manage your apps, see [Deploy and configure apps with Microsoft Intune](https://docs.microsoft.com/en-us/intune/). + +### Summary + +In this section, you prepared your institution for device management. You determined whether you want to use Group Policy or Intune to manage your devices. You identified the configuration settings that you want to use to manage your users and devices. Finally, you configured the Group Policy and Intune settings in Group Policy and Intune, respectively. + +## Deploy Windows 10 to devices + +You’re ready to deploy Windows 10 to faculty and student devices. You must complete the steps in this section for each student device in the classrooms as well as for any new student devices you add in the future. You can also perform these actions for any device that’s eligible for a Windows 10 upgrade. This section discusses deploying Windows 10 to new devices, refreshing Windows 10 on existing devices, and upgrading existing devices that are running eligible versions of Windows 8.1 or Windows to Windows 10. + +### Prepare for deployment + +Prior to deployment of Windows 10, ensure that you complete the tasks listed in Table 12. Most of these tasks are already complete, but use this step to make sure. + +*Table 12. Deployment preparation checklist* + +|Task | | +| ---| --- | +| |The target devices have sufficient system resources to run Windows 10. | +| | Identify the necessary devices drivers, and import them to the MDT deployment share.| +| | Create an MDT application for each Windows Store and Windows desktop app.| +| | Notify the students and faculty about the deployment.| +

    +### Perform the deployment + +Use the Deployment Wizard to deploy Windows 10. The LTI deployment process is almost fully automated: You provide only minimal information to the Deployment Wizard at the beginning of the process. After the wizard collects the necessary information, the remainder of the process is fully automated. + +**Note**  To fully automate the LTI deployment process, complete the steps in the “Fully Automated LTI Deployment Scenario” section in the [Microsoft Deployment Toolkit Samples Guide](https://technet.microsoft.com/en-us/library/dn781089.aspx). + +In most instances, deployments occur without incident. Only in rare occasions do deployments experience problems. + +#### To deploy Windows 10 + +1. **Initiate the LTI deployment process**. Initiate the LTI deployment process booting over the network (PXE boot) or from local media. You selected the method for initiating the LTI deployment process in the [Select a method to initiate deployment](#select-a-method-to-initiate-deployment) section earlier in this guide. +2. **Complete the Deployment Wizard**. For more information about how to complete the Deployment Wizard, see the “Running the Deployment Wizard” topic in [Using the Microsoft Deployment Toolkit](https://technet.microsoft.com/en-us/library/dn759415.aspx#Running%20the%20Deployment%20Wizard). + +### Set up printers + +After you have deployed Windows 10, the devices are almost ready for use. First, you must set up the printers that each classroom will use. Typically, you connect the printers to the same network as the devices in the same classroom. If you don’t have printers in your classrooms, skip this section and proceed to the [Verify deployment](#verify-deployment) section. + +**Note**  If you’re performing an upgrade instead of a new deployment, the printers remain configured as they were in the previous version of Windows. As a result, you can skip this section and proceed to the [Verify deployment](#verify-deployment) section. + +#### To set up printers + +1. Review the printer manufacturer’s instructions for installing the printer drivers. +2. On the admin device, download the printer drivers. +3. Copy the printer drivers to a USB drive. +4. On a device, use the same account you used to set up Windows 10 in the [Perform the deployment](#perform-the-deployment) section to sign in to the device. +5. Insert the USB drive in the device. +6. Follow the printer manufacturer’s instructions to install the printer drivers from the USB drive. +7. Verify that the printer drivers were installed correctly by printing a test page. +8. Complete steps 1–8 for each printer. + +### Verify deployment + +As a final quality control step, verify the device configuration to ensure that all apps run. Microsoft recommends that you perform all the tasks that the user would perform. Specifically, verify the following: + +- The device can connect to the Internet and view the appropriate web content in Microsoft Edge. +- Windows Update is active and current with software updates. +- Windows Defender is active and current with malware signatures. +- The SmartScreen Filter is active. +- All Windows Store apps are properly installed and updated. +- All Windows desktop apps are properly installed and updated. +- Printers are properly configured. + +When you have verified that the first device is properly configured, you can move to the next device and perform the same steps. + +### Summary + +You prepared the devices for deployment by verifying that they have adequate system resources and that the resources in the devices have corresponding Windows 10 device drivers. You performed device deployment over the network or by using local MDT media. Next, you configured the appropriate printers on the devices. Finally, you verified that the devices are properly configured and ready for use. + +## Maintain Windows devices and Office 365 + +After the initial deployment, you will need to perform certain tasks to maintain the Windows 10 devices and your Office 365 Education subscription. You should perform these tasks on the following schedule: + +- **Monthly.** These tasks help ensure that the devices are current with software updates and properly protected against viruses and malware. +- **New semester or academic year.** Perform these tasks prior to the start of a new curriculum—for example, at the start of a new academic year or semester. These tasks help ensure that the classroom environments are ready for the next group of students. +- **As required (ad hoc).** Perform these tasks as necessary in a classroom. For example, a new version of an app may be available, or a student may inadvertently corrupt a device so that you must restore it to the default configuration. + +Table 13 lists the school and individual classroom maintenance tasks, the resources for performing the tasks, and the schedule (or frequency) on which you should perform the tasks. + +*Table 13. School and individual classroom maintenance tasks, with resources and the schedule for performing them* + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Task and resourcesMonthlyNew semester or academic yearAs required
    Verify that Windows Update is active and current with operating system and software updates.

    +For more information about completing this task when you have: +
      +
    • Intune, see [Keep Windows PCs up to date with software updates in Microsoft Intune](https://docs.microsoft.com/en-us/intune/deploy-use/keep-windows-pcs-up-to-date-with-software-updates-in-microsoft-intune).
    • +
    • Group Policy, see [Windows Update for Business](https://technet.microsoft.com/itpro/windows/plan/windows-update-for-business).
    • +
    • Windows Server Update Services (WSUS), see [Windows Server Update Services](https://msdn.microsoft.com/en-us/library/bb332157.aspx?f=255&MSPPError=-2147217396).
    • +
    • Neither Intune, Group Policy, or WSUS, see [Update Windows 10](http://windows.microsoft.com/en-id/windows-10/update-windows-10)
    • +
    +
    XXX
    Verify that Windows Defender is active and current with malware signatures.

    +For more information about completing this task, see [Turn Windows Defender on or off](http://windows.microsoft.com/en-us/windows-10/how-to-protect-your-windows-10-pc#v1h=tab01) and [Updating Windows Defender](http://windows.microsoft.com/en-us/windows-10/how-to-protect-your-windows-10-pc#v1h=tab03).
    XXX
    Verify that Windows Defender has run a scan in the past week and that no viruses or malware were found.

    +For more information about completing this task, see [How do I find and remove a virus?](http://windows.microsoft.com/en-US/windows-8/how-find-remove-virus) +
    XXX
    Verify that you are using the appropriate Windows 10 servicing options for updates and upgrades (such as selecting whether you want to use Current Branch or Current Branch for Business).

    +For more information about Windows 10 servicing options for updates and upgrades, see [Windows 10 servicing options for updates and upgrades](https://technet.microsoft.com/itpro/windows/manage/introduction-to-windows-10-servicing).
    XX
    Refresh the operating system and apps on devices.

    +For more information about completing this task, see the [Deploy Windows 10 to devices](#deploy-windows-10-to-devices) section. + +
    XX
    Install any new Windows desktop apps or update any Windows desktop apps that are used in the curriculum.

    +For more information, see the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section. + +
    XX
    Install new or update existing Windows Store apps that are used in the curriculum.

    +Windows Store apps are automatically updated from Windows Store. The menu bar in the Windows Store app shows whether any Windows Store app updates are available for download.

    +You can also deploy Windows Store apps directly to devices by using Intune. For more information, see the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section. + +
    XX
    Remove unnecessary user accounts (and corresponding licenses) from Office 365.

    +For more information about how to: +
      +
    • Remove unnecessary user accounts, see [Delete or restore users](https://support.office.com/en-us/article/Delete-or-restore-users-d5155593-3bac-4d8d-9d8b-f4513a81479e?ui=en-US&rs=en-US&ad=US).
    • +
    • Unassign licenses, see [Assign or unassign licenses for Office 365 for business](https://support.office.com/en-us/article/Assign-or-unassign-licenses-for-Office-365-for-business-997596b5-4173-4627-b915-36abac6786dc?ui=en-US&rs=en-US&ad=US).
    • +
    + +
    XX
    Add new accounts (and corresponding licenses) to Office 365.

    +For more information about how to: +
      +
    • Add user accounts, see [Add users to Office 365 for business](https://support.office.com/en-us/article/Add-users-to-Office-365-for-business-435ccec3-09dd-4587-9ebd-2f3cad6bc2bc) and [Add users individually or in bulk to Office 365](https://www.youtube.com/watch?v=zDs3VltTJps).
    • +
    • Assign licenses, see [Assign or unassign licenses for Office 365 for business](https://support.office.com/en-us/article/Assign-or-unassign-licenses-for-Office-365-for-business-997596b5-4173-4627-b915-36abac6786dc?ui=en-US&rs=en-US&ad=US).
    • +
    +
    XX
    Create or modify security groups and manage group membership in Office 365.

    +For more information about how to: +
      +
    • Create or modify security groups, see [View, create, and delete Groups in the Office 365 admin center](https://support.office.com/en-us/article/View-create-and-delete-groups-in-the-Office-365-admin-center-a6360120-2fc4-46af-b105-6a04dc5461c7).
    • +
    • Manage group membership, see [Manage Group membership in the Office 365 admin center](https://support.office.com/en-us/article/Manage-Group-membership-in-the-Office-365-admin-center-e186d224-a324-4afa-8300-0e4fc0c3000a).
    • +
    + +
    XX
    Create or modify Exchange Online or Microsoft Exchange Server distribution lists in Office 365.

    +For more information about how to create or modify Exchange Online or Exchange Server distribution lists in Office 365, see [Manage Distribution Groups](https://technet.microsoft.com/library/bb124513.aspx) and [Groups in Exchange Online and SharePoint Online](https://support.office.com/en-us/article/Create-edit-or-delete-a-security-group-55C96B32-E086-4C9E-948B-A018B44510CB#__groups_in_exchange). + +
    XX
    Install new student devices

    +Follow the same steps described in the [Deploy Windows 10 to devices](#deploy-windows-10-to-devices) section. + +
    X
    +

    +### Summary + +Now, you have identified the tasks you need to perform monthly, at the end of an academic year or semester, and as required. Your school configuration should match the typical school configuration that you saw in the [Plan a typical school configuration](#plan-a-typical-school-configuration) section. By performing these maintenance tasks you help ensure that your school stays secure and is configured as you specified. + +##Related resources +

      +
    • [Try it out: Windows 10 deployment (for educational institutions)](http://go.microsoft.com/fwlink/p/?LinkId=623254)
    • +
    • [Try it out: Windows 10 in the classroom](http://go.microsoft.com/fwlink/p/?LinkId=623255)
    • +
    • [Chromebook migration guide](http://go.microsoft.com/fwlink/p/?LinkId=623249)
    • +
    + diff --git a/education/windows/index.md b/education/windows/index.md index 7d202e116d..0ef9f4d787 100644 --- a/education/windows/index.md +++ b/education/windows/index.md @@ -14,7 +14,8 @@ Learn about using Windows 10 in schools. |Topic |Description | |------|------------| -| tbd | tbd | +| [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) | Learn how to deploy Windows 10 in classrooms; integrate the school environment with Microsoft Office 365, Active Directory Domain Services (AD DS), and Microsoft Azure Active Directory (Azure AD); and deploy Windows 10 and your apps to new devices or upgrade existing devices to Windows 10. | +| [Chromebook migration guide](chromebook-migration-guide.md) | Learn how to migrate a Google Chromebook-based learning environment to a Windows 10-based learning environment. | ## Related topics - [Windows 10 and Windows 10 Mobile](https://technet.microsoft.com/itpro/windows/index) \ No newline at end of file From 876cc3f8b2363b7340fff2cddd29f02d7f6fd6a7 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 12 May 2016 08:01:24 -0700 Subject: [PATCH 266/439] video test --- education/windows/TOC.md | 1 + education/windows/video-test.md | 17 +++++++++++++++++ 2 files changed, 18 insertions(+) create mode 100644 education/windows/video-test.md diff --git a/education/windows/TOC.md b/education/windows/TOC.md index f02d261fd6..ed1484d8f8 100644 --- a/education/windows/TOC.md +++ b/education/windows/TOC.md @@ -1,3 +1,4 @@ # [Windows 10 for education](index.md) +## [video test](video-test.md) ## [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) ## [Chromebook migration guide](chromebook-migration-guide.md) \ No newline at end of file diff --git a/education/windows/video-test.md b/education/windows/video-test.md new file mode 100644 index 0000000000..f9801a49d8 --- /dev/null +++ b/education/windows/video-test.md @@ -0,0 +1,17 @@ +--- +title: video test +description: In this topic I will embed a channel 9 video. +keywords: ["migrate", "automate", "device"] +ms.prod: W10 +ms.mktglfcycl: plan +ms.sitesec: library +author: jdeckerMS +--- + +# Video test + +Does this work? + + + +Did that work? From 3364685604942f82fe43808e5815945bb0d77b17 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 12 May 2016 08:03:38 -0700 Subject: [PATCH 267/439] copied image --- .../images/chromebook-fig1-googleadmin.png | Bin 0 -> 94575 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 education/windows/images/chromebook-fig1-googleadmin.png diff --git a/education/windows/images/chromebook-fig1-googleadmin.png b/education/windows/images/chromebook-fig1-googleadmin.png new file mode 100644 index 0000000000000000000000000000000000000000..b3d42e5ff24d6e09ebefe8b8122e852bd1676a76 GIT binary patch literal 94575 zcmX_nbyOQ))NODpE`{Ju@gl_vv`BDwcXuo9UIGa@tQaaX5E%dfph}2~C;|X52mk=IH6k>9U z|L=f;O|Q!U0FdP@goWkh&F!4+oXqX)$s~k@$?P5NOf9TU006g@3?(yVrDHt)$BjE7 zsW87kQg({Ch-8XF5q>zaH1y<17?NS+*~_>J-I$`Hu!KWdVK7lqev!BejGulZFCpxa z=R^hOhW#G-x9yp0wb1r>F#cY@C~#PIn^8N7(1rLZQJh_Y)9+KU5DDg1;9%dt_8#*O ze`G3q00v^MF}c$lB^2Pv=lgdCiY|l>0F>J-3L>COCasH=DD(sUL?}fY$}b42%Q==? z3egV-@WUfYr~vQ-1m%~JOrr$If(7W08X4{af-?{F#%X5)J(+zRgHkI2@I4P0OBVAt3p`t7XYj$ zK!1pm(hU%l0>A;?sC~a?sK7X+heRr+=6f?0kEp*EB9jAxni?|+-Gszv2AppO&<3eL zn0wq)2-y5N(6?^K0D!DmT*%$tzPU}HRZL8Li)ujAV>;=C|DZ55+?-TplA#YtVnx1G0`+)Nbwni;ZY@O!M;c{@&h_WS@|h z!HAmoyIGH3m)e{4v(NX}$NR009V&k|9e**{r>&l`JL!C)$vC7S!?lBGvDZeFk5}SZ ziarU$W_5a;T?H(MD3R32Tef_PaG|&_{nRrb#ygvg|6l|*IRRCc0#Kf@Ohr0IFb`6+ z80yYlJC6XsO{-n^933KzpLyW+r0d6};G0+$HNekQBF+H-&=sL#RvxJp97F^FM6&$p zt9}yRb>lO3!4q}Et#zZk>VFFoqU!4r!Vp3>_9JrC|56qpL>Dq%MNF^HGWUa+qf5a& zB;Fp4xksf5jo%*q#Q-t0o370t3HIj@BDMkfN*I*kZ*|Hj#Lp?gPvqU=uvigPWW!-N z3KUYYoZ?>YJ*y0`Gx>&0k0u#VqgFG*C_DMeX193F5&_PfpSo$ zjGe!xM&o6rO*z&9`6It&A5N8;qpw5@2oJJ$9pNLe_gS+t5A+IEb2B2v8;w>|lzl24 z09L7%!L)|o8%DM8$!*g2aUc6Qs~XOA%ir zRY%i;`P_$Z$o4f7`25Sa1W2;Dc%vhYp zAr7RBA6_xGszKoS!$`(36ug(Q*Sp8QN4Q6RqlKJd_`@OZNoj{pal}%RU>{?jV;|lm zneC@aZmQyXQMNKBXSAkJd3J+hr9x;CHit_p&v+o7gj9ZcPQonE{ImI^Mdgum3+8$P ziEPr8+RW&&*iq6E%$@5e)DYaj!7wvAf;4;td@}-9{K{nM0)p8HfhWc-U-YfXZ^W$;{3XTNJi_df>}s`&w|`6p5q6Uup3h+4(|P zz#-lI)kNE>Brz#by;QtZp;YX&{aeL(VMal_XsgCQf3%;2lC;{iVrJ13a2bb6%S!8o z$c1<^{Ji%S%q3R&gxRekuAR1p7s;6&x_+6`c7+@6?T0T!-Yjp*Z#FN5_hO&a;cGup z!LNRr!2jOQ>0tMrm}PMFT0vN+_lI!4L4rZjc2I2d^!MC(5Ez6WX)&O^OSNk=U^9?Q z15ZOvBPDYpbCIej(_HYSfKQrFdT@MfJZF3%g)@!+>mu7>+F{ya+GeA^rkf^XLs3JM ziA2qwW`V{CU{HFO!RlvtD4$EnT{hgX$%BXuJELeRVa zF7cSfOnnk#a*2Jn0ekdIpGAgJ+N_w_XR~Ifz}v8haH)V%<|F~;G{S-Pq4qsV=X(d8 zZI7AzjI`Rcp7WyB%8PFo78jvwf5$lfe#z8ecbe)Q65dkSpB6;_`rEaz`l ze@Mw<#1gAkzF5_m?^^O`aQRu_LBR3vuE6eht_`*g4ZSh0uEwFpQMq2bOugVuVPDD* z;}4IIX+WVLHIx}lxc^UoE$Dww9$w^~QG&dyCJ!~s=RYH}nt$T{j1DLd*zYbUHy=8S zDJOqCOrD6Hus{oz_c>aaLNGWmi0JkCL>n9$tQH~|Wgn&voc@}`={mh8?6fKJB9bVw zk!JQ)j;E4Il9OJbgxT`@3Req9i{JpWsm9p6dWO1$wG?%5MPcfo~t#mrcYyoo=g!(_StT>ZqLFT#tYzQJ~-jzV_tA?`7wV440l z9kwK_O-~|wBTg^l5qB2b#_3Mg&z{e?-yB3+9MdL^D!rb@n~9hDi_C_NpSS&MU|ejB zgHQ>%OnigciP?eauhBA-;F|Y-+lWRMk_3cdtJ;_{I1MJ`2BCr@Wlg$8dW0G?6E)M$ z@$eCz#L`TL@$<3Tk<}Qk^vk~==U6>h+i?x~AyR5g#Oep_WtKcO-yPgnk#}+77(!Ix z%f2`LZlJfBmn%J2ORDf`r}2=n^4IMi3FxkevN}akLEaDcK3!Wp*O60a(b%jvcnQfM z6u=GtU4gUuISJQyiEhnppD@&Jq%&phPhD|oU$gO~>5S>|!3I;N7FuFS(m@iME$Z@0 z9qOiP-TD24=qgLnINfS%V1saTZs+%=Hj~2PiE%zbOQtwlUiyeub$0` z^U3%3_*uEZ*7VlYie_!A<_nMZdQa2GW5P_XiS@g7_iMb5h51Y#{`K}-54*?y$NNpZ zbstCCw~5i#WmnpZ@;13Py}KXhKbM8qL+1sx-q)5c*L*FzT(fSc*Tf#-g99huWACHU zh2f%8qDMneLrycf1$cON1RdXwUkimNjVEa`KfmX^k5+ufWAS;KKV6)dPM*$Ax=D)f zwDHP+JLx(ls9YWB86fExc4Pmld#C#EyxVonmH0Au6J2i4i_Dkq!~D7WUTLcEUpzs4 z{0A&d^6je;JJTuzZ;}~_E6M->9@GGUUmyVR`~mqr1^`@G0e};I0Dw0c0QhVdr`Hbx zK$)gWi2PJ`TRCe-aMLO!Ugd({DpYglrP zSgSvdTB}`w;)_B8R$AYN=Vb;g(!++QumO~K3}713Po(lyZ%dMcNdfCifZ@NWsEga} z-SWds&yHUco*i6LM?QD_6wtrFw^t|yPft%bk4y@DycR^h57(1K_B{2$Hr%~5@LZfj zEq^=p=e05R<=CS@mh6b(3?`u*6=qCUMF`Z*6KC!u=f;H8E3D z6VM|x0HFNxg@>R2?dcjD4Gk?f*9a?IxpFar3M-w8lD#$tR9aDNfR2WT`+3yZktRY# zQ&Uq%r(9lo^D)HZ-%CJX;AC@CvNTP}L7L-FOUspcE7dshd`e16XWq977$>J19wKHp zo*i==tKJ2}YW-5h;w+AmcNVnzpRT#2|v-~4!7lSRiPQzok$zk!4l+~{k877(%sxOkD1uBQk)APmaIinWz}41zuj651 zVXaLBifl@2_k1)g3lb6%f}YM*naYif{DhXYy17|7Z+V?*?8x&X*5BXn{r1-0-v0dj zJUl#HUthmuc$m7f5=x$%s$1=QQ8jIDd}Df(2G>O1Y}nG)_MMFNDz(*9QIVoxr$W0q zXWCp?NXWzUA4wE{j~|KFZaGq$%0lj!6t9Jaba!|6Y;r4e^F9OaS8b!!RN`%QyOWmziSR9HDnHQUUvTjA_@SyEs20x&-L)W3 zi81Ds5MN0^!#YY_X@&eHLMp)_Q?tA-GWpUrcE6B)!$)^(mwt3Ic|;=P(~a@#wZ%Z% zWCapI`=w$%nV>Ym@KH00lLNEGza*RJZ?8o<`HI*COsXJuNfmD+BQI?)5fNC<33CgJ zYH%rdP%g90AkDhgD=CZwliwqmP3W{Xk6m^cx8_T;Iu-EnR_$(k+Nv;l_(&rza?G?= zp04e$v5FHK!b4K5I=wgB?NS37TSCx`2+?X_6H@id!ci4y}Mo^M#z^d!c|k=xT`WSN7pQ zyb+)N9HZ>5v$OO+>1$Ir3#23N{_qp$UBe|x|qUb%*=`{+JdrX zuBKTH1_36&Wt87=K9(ex2^Ed zBE+CRO>0nvkha3R((0MyJeTNI=w07kS|-*hZovHj#;p@5oQq<-iL8rbE0+~y&%Hy_ z4EQjnjfj_J(3)xb$cH}se4CLOC3s`vvSnzDqr}@n!S-T;D^)&?g5YEMtqPBYGDRqR z`dHa=eCHBo<~maPCQMS}m3;D$$MB!X-nL#pskRJ1vc+lz_IKX>`%2R9Ksjm>@^7oQ-}tCG%j@eC#!Zcs5tD$;+7-$rVUZ-iNirO{_m7T_ zj`v+Qv2{8e;k4A$)Jk0*fkL$p%H8H z=_H8_RhkW}Mvx=Fr_h&-X$EC@3d$TY5s(OoP!0sDc5m?;I@0A>b{XP+_5AsUN0Hka z{VyYWAT+54M2XRWDlZS;d_lNVXFE&!^lk^4qT~p!!$-S^;C{qpF18zkmOspO4KI zBO=at@VQqJG5*tQf$-nN(nLVDL1B?+WVwG^@%SC{-z6Qtf=J4`yLVa^o|^_sBa9;d zX}wN#sc3vz+a=X0wo6Zj`o;mxS5Q#U@lh-%uVH8UZ>YQIrt@QLGTVBLcNUK*@+ndx z8*v)fUJDR}-1BR8X4c8kX?<-S0RdsVN{Gpw(!M)XJZ!ddb#hO|>%&Xa;7c3klN4mNI zBh=LS%!fKJ2=EugfA~Y~4Y&xP7;v7mV_-{iYHIT8$`hY|S360=>cSRy z-A||l_<`k!@l5(>g4`T)Yb(Ed8|^luGW-*~wtL`m-voZ-h(#n|79g|s&MykeD=Dp7 zN34BeVj3MA!$E}ASzj*-4-fxIZ6Ezr?Ax=>pYnt_1xH+#X3JMiw%p(^;}&~`i&04l zNiauCy}d97bjv)=@;+peP0g+OX2#l`KEy}#4D^&iX7X@u?vYW~MK{{NB2{K7smy!v zYEkhBN2>gyCi?3kG;*=3_IWZ*6pJg zgCYTksK}jh5+|BLA5$>wRO;wCw7+Np?$R4&g*S$ z@rD>^yKcKPy;OTaOElQ!uz z(RtwGM1I1?BMtZCw4W4uYPX39xaEx(?F&mlfK38-Q62j>V>x1;rqr)(W_NA&+FCom zmgt%Y?_sUMdsJ<>#ErPNn-p30S@l5c8+Mw^N_{9}uBfbtKj1CmSb*^i0*PJE*8JTC zn<|+OerQ8Cmt4ZWbPz&0Ad<=5#l=Y{9eTLJaME%e;*-=HerLcqzC%Y>|R^^io9k7_ed)h zhnd{@Cr`us6CUgy@!w&6#$O8(HdAlB&r_EavI3Y+Zk+dYdHWe9{+|nY1XZ8kjEfK9 zs!rk_3RSrFl9+7RF1d=u$g(o>JNislLt_lWxCCTfP+D7BmIBYVVq!#da^f0%m)RV- zy;l}p6-Lg^cSjAYW&a95iW<1-uB$7nuP<+DN&V^P`r{I%Sd@0Vhs)!|x{l6zMB8OJ zQb%BKF)^R(j$4OWg~JcheZ z8`3{Erk0O%$!Z?JvYuu&X65o9YeR+?FekA$s#gb^G_w>mhoGlTcZ^SBXSd})U9UFu z5AimsCRf-T4FhZ>*n^gQu>`_|w(+AI-_NE)$c;5(izBfW%k?D-o_T!gGyr<&l+IugFiHCtqK7o47s;&ddO8ZmPWSBjp7?DR+x5jm z|26s-7Kw;SP@W!%G4FCTl`SXmHn+aMJ2agu0tzBg25Dc={qOLQ3vg0WVs$pC8s8lk z{xvlZj6h*?+Oa)3%#bpKXwyVle2_5~M8_Jr6 z#`7>^_VlEOfn&W#*xT#}ev24>S*0YU>%+=_0W^!l9yZAR))8RWeFj!Niwd^Nm zx!TuWS^XrR!lOyQaXk|2`=d)+gO`(&jg8F;9HKI|PGzK6dg?iNvADk^U%@ll+oDVJ z#kSdsLh?6D({W;$JaNic>b+JWm(;2*sqOb)v%sG&KK8}T6=IP+A1yOK2ny3GofdAm ze7WBneR-S7CN<}t`Qszz@U!wJ&ug=y5be6zaM$^d%w=LZU-ei#Sh9B`>Yya^x0Zjp z$I3fq(SMobX+xS;+%a7U0FIl$wx(%C$@-#v`27H4HxR=9BU(fkPlXTib*6&>zGisB zxW77T9c0{F!3KDNr@W}{p4;xF`wQeLr|i(D<*&vKB`q}QGor3TX~*|Ja%PUqMB3vO zO&m_$NE)T2CsiysM8Fp_7+$5IID)_p<7&#LcQzjKuU}aNJ3F!s(9#51>Fk4gp^E6R zV#yYV?+LktgoM4{UMqB4fdm8uK;X&20SPW~pfwEu{}U?8=)^DqkR&rRr5Sa?w;H@s zJcX8^d73e-eN|~653j^Y-=*D}n-|T{%aQ z3PyE8`cQ~Y)Aly8s^{y}wK_<+#SP`}KPm7?)KKr@vd3R81N>Vh`}y=9UeE6GR9Dya z!hWHjnwxuXE%?@zFK{lg_3~#KCb`fr^EpJ!mLy;}^$hAIVs&*&XU~sDD`oIm+`A?7 z&!*_g%2iG-=YA|Ktcgq)S!u~WMuMA_yu1Q3QCVACX45gO__!nI7eHWad^{mBF?ded z-``)|iCCXC){2^eZ#6M@#CX$_(o)2YSS$A^86R2o_FIn|9XYuJb}=Rf6^ex@TyU^s zGqgl(ohHARgbntU<(RVpLLTlw4Nr&XoO-8EJBeKOw7Ej2LUC39d)MiLA&23rSnmAr z9`dOI2>YS0%*w_a=Eq4(Yiy#rFatA)dP|}@O`dAtYdpo*bd0S|Ug~&*h+3o|3R*L> z6vI>w%hO@tvU0bONqA3$2&zg!DoLA>C27eI>O>*tV)s@JlsSJ>LdQ>4;41b6```5H z))s|DYzdCByfKdS8GmELM>K=^nHW-ve-};nnocppxmi|n7Qla!RF*uSeQadmb4HZCbC zNk4~>bxTXjZ^fK(3@SHuB@!=^An0q zH%BbEDx;~%tve6nna0j-)31d!d92{Tv|1#9=ke(Y)>RJO_XA*#LvR%z3nVBWk9vJ~ zm}q5T1aEpo6~&e-S%2N6blF*7Y62q3sA+dJf;NHd9Eu24;! z&X=Zj;+|MFdfzL#Kp<_8D*q$h-2*bgTR@alqFjq-a`(GvI+Sfh!MK zF1u+CytNgl6>(dy5uu=FcnwOFx+>RumoRoDP@v2KJ&*?lU~p1ciU2u<(lo#ge4En0 z*7$SOv$fLW7z7v}J$NRMbzbHlN7kCPFS!49Vttlms2D4?Yy+SBBs?Ead?7LZbz7miQt*l+QCNxb=T_IZ8BX&?YDR@E0 z8pF*ErDEz%0m&1K)vak}GD|5xmWRAd<25O%VB2gIpC-*1)OPSb-mT|1(<`15^bi`C zQ_C}U5}M?t@tBxH6JylU)#Xz)R0AXJ^jr1%i&7LpueA3sgDjm#8R#*bbd;4N>zlW>^p$&LyObEYsoZ#S zek!5T)?{Uosb`gx&^I~esF0A5fN}-84|j8H&d(8Dy7H|oElHoY&1@_>1e0~ zt1ZpV1sw((5qll+^727};90)+eYd#+mAAD)Xa8&FX&(MEY|q`74ofBQZ6J`b&D+b* zg-U%R)k#N(IA>B(QORg`=Xb<0B4&6*bTl~P{^4PGd_2(1$Wl{N%F4>lu5$7Il#UUB z1)v940WB*l>)&V$0v&L2an0o}hJQvvS8j6&YUm#ri0#0%nER%X8xlo%scNYiD=s}3 zhEWX)3Ik$lc3RE}(4|e|KPzcg$n#UlyEx%gQ?IEuXq&M%q7IjOmXGo^gR!BS1H<=o zr8k@{LaS1kM(uX6A-Q$O^wa-fq#=2GRic6;GQ2$W6N+*l5OW0syyC>QqW5tAD!SIi zQktyq`f}RMbSYDO9{nQDQpuQ=bnrQ0Z~BM_PIPPbkfkz+(F38G((7v|izE|c_JWBO zP*ZhB$d))o3wgr!i@gWUC5MkdtW!^ve zY-Z(a)cs8N9ni2Zab06GT&3B=W*$DS2 zxqKo9#=LA(t(Shiexjwk1-h(bnZGNIBc6W=&;Nb-d#}{7I!U$oF-~Q$@`iVdY*E?q zwt>?5F&pjkur%BG<}GHHWJvy+xsTnke)ih~pL}wN>Tlm!%-k9-){7EPVU_on*CXuM z(9AHNSL2;n5+v97lGu$R#p8V5z&>l7)K5aaV|fN1_b>%#LZccw8sCRGBx6_5B9@K2 zu4kyfrDgm{kAx$AG9==4rlaG=53|nC&(Cn}?$?Fm zgl@yR$uekmwv;qYBJ9Cp1b(KX5hg`ss8NP)8y=Q;$}|+!B*V}zAl>QuT_9VjMxUU} zpHOSf6QtD5X=1o0$xUvE7;7X-6Ti&QzlCVFw{*R$S&qgK?S@fulV;aJz7RGAtO0S= zAowr#;j2w-+@YuBzgFYjjpVq76%luhGcNxw#dI__Aa5&bLS#6xNAahmN$iW&MJ;_( z|BZ0{?8WWX?E?sRa5IKIfDKP@tVvpv>IVwEPA5y_wf)@L-T8+AzcmW=`OiZXnp81e}*;q)kYZlY^G_o0tDs7-7= zISG-yb}UZK-@pt3MB?8~ZoCuYa78>mw4D!p)pC+^VMWt%LzBls@l+_qyGF+&Z5!BBpKZe<^Y}yuToozgcV`_&&&}qIVtKi=EW%ze)nPZoF>r* zmv%Z{@yC_AwAUI!pg=4?!Sv^fii(7Jl~{%8F7?FW{V)$<)E(xIwc5kR&NpI=I2dRc zzuq?A49P3k*FY&DImf9ikS8(X|v*oT*dvzWRk2b?=rfy;GVk6TKClfJ$ zS~3RA#&WYF*3r?Anb5R8;|dts$IG|Bqqu@C)?npA4huUs%s_*7J9?Bn(aLAvXk(ub z^F(3Y%}wI**VSGEy4ciORsFk&44>f$UbY5^TPg-hPtEZ;}NghV`n7o?n=LvZQ zjbY>Jn8v)qO1bK@K5cOcB~?}U{`u9bc`5d*k%|`Mu=SGd zqEkiJ#J+`wzbq!uGx*#*3ZUh5BR+iDxr=<(*Xq)az;nIrvoY($sUhjG8SxM)v>wYvGIgE#jCnnS zvuUzHSGz*wF9YH`@IlRYY?{|D>A9havW2w-t_a|^f?&I*-Yh@CAHk-r4Z%t7Ad)fS zfY}&$+o%TKM2J#bPeypxB9jf8P|!KiGLev_f85ejIl5*`=jc_?a51VRE%a4C$WPBq zx#BKOEtD1k<0`jy{%w+*%GV5}}ue4n| zymII#>$7D8^ra&euW8H6N5L=uN);4&2F<5XBS&=kBzH6Tixvo#XLJ(=%!|BtgJJ6S zBq#oHxK31*(`RI==l(01)|*g;-(z*vwo<3Gy6Sy(Ekrlw+IF!0iXVJfwo9shPHIP#cH-Vew&xPh2I zb1kU5{NfPKS1eEk3v>#yL}(N)90m2e({omXA|OzxRl5~5Cr*d;Gv33)^RgNp5b_0E zwA#>PB~!;5tm;IcSKc62G|jkFJl7Q+&)Q$z-+N7sQVS9WSq33(3WE#G{sbYhgjS#Z zd<7#e8{wse`9YRqp;INWrk3Vqd+&{tBBlp--ysTK83OkwtcvyXBDnSDi(F7>G*LGm zl3R&Y3Fb+?&1ypipDQ&DO^)NGnqK?s2m@wpEH_IWQv1WpX;f5{hK2@x0&)e}rR}=p z#_S3ey+d?mbaZFsWrlC?;vZlAtvW>wZSA(LZMV)x1jjpj3pUWfg0oCu@N)fF7En)s&q?F@fz=#xsEvDvJ3b`iL!`4WjkO#t`srz2Yte#%wZYO@^e@P*l@SGD{TbhgP zwK_DRqOq)-m>XgqNaw}1uV8g>d3(8!9Fyig-gXBB!Ko>b>gn|z1qFwalk-|)oCG^x zc3mDRDAg)|+6gn&p%H?OV`eFc3z*O%7XA;m{fWR z8!ecEgM5pE3_;i;U_=&4@K&Plz%-_nYLu*OKQ%Q1I`QjPAo>X*aI4h!`6gkPR`zaH zAKF?<{RQE`B@2Y8JT%IJA(eMEL9`zwk*9Q3DcnA%8pBYauu<()C|&VmI}K(t-O0h9 zV>)m^&RTQxE%=qjF<7-w%$1N+s5%Hp9vuZXm~>)3tTL%yW|vF=MF4;>$WII{ z8}RW+y7N!PvxKlhvBM15Q|H8mh zSycA>H)Qg%A#6~Rcy^@KYENxhAU_6(hakHz5ZYsznwlB{aPmz|jzR|e2Xh&*BG5^` zFU`zIepyrd_W;EQCr@>hy*R&s9NZ%uiq=0!tFNPB7s%b!_;1`F=KUS&-^1m#Rt${5z3hgn)$L4>?5oIgosqPSv5jJ)_iAjS&` z6&2hx{;)T$0O0Zg`sWg^HC^A$XTlLSn-wTuJH5?-d(Ln2HK?}W0g;oefLK-_ZTdGN z(L)-w8)(N+0;At`CrFdZ1!}ybf@ViO!6*g>22Xj+dL3TZJNaQ@h(vDhug@_tQ(G|@ zTfq>?;#!9ypsB2ksFy&Fg+)4Gw-@yj^4Zau`lY3DU0i+Ku>V9wtH539l(kc@dBc#%;o(i-i8x`DRszWRPA zV!{c2Dp%)z3kApm9X?K+;S%8(T)hu2idOa>X?F?)_&6f>SqSj>rw%4y=W5b);ohDq z#e>UB-}6*LeO?3MEYQY}zN>o|CnuIty2hmrp|gYY^IeFor{2okTBLDWuuG2&2f7}| z$gRs{t8)75bQh})q$BMkk&zJre>)aGZ^*o%7~E?lzK>Z{3I}59o?7;~KL+R5wB#oi z#U=#agia1VFb{pc=y3;Q6Dop3Hhc_<%d9IXEsgirFTj_r%1q%b0}s~XoQ9pZ0aKeY zlY}N6*RZ$sdREIYJK};D{*$2_zB22JU#>dFd`@{5NdKz-ndX4uk4*Xqyg#TN!OH

    z1BW&@bbb9!~|5-Y;O=@Q6~+wVO9D z)DmWK^)Oasr=QUdJ10z6Mn|e&om36MjdClf6=+f4C0gdBUpVWWe$8~+_ng2bQ~|?p zc-R(0ns5%w#?six%vR+FM#6TZz#>e5UL%hRV>pYoJSPQ=PtU0;cnccjro)cZK_g=L zgj6nnqA#===VBcz#ao;NW1-gN}?0uS>G(=DAXP1J15bjHH$9!N zdGLi?vEnEWaQ-bi8=f3n?YK~GQ5!w+rK zD^9e(DJj*3z;5h7&4WIn7i1)F_%Bd}DlGdv0+|kb*O9q4<4mfYz{XBszcKEC3g^ba zy7h!)X{=)L%;3junXKuc)c3c$*;^M;Mm!@zOacY*Tymz(zCPHVa``~mEQM)>FuO4p zI_-~Egcw%bT_j*hpKl_ml&O*CSX zX`8oQ%Yuwr z=MIl}HF0oFIq#ojy*LpDEgnv`zIXZMn>L51`QiXQLIk}KG=gOo&2NRAGeGgqTlGFnb76-B^xqL8I`E!%6!n2rzk-7N;tH=HAC$x!LC!}HamrF`TwByLZ?%&r7exK{j}SH;1Kxl2vz#!OP;(#EXG@PxV|zigRfUQbR=jEr_U zfa8V}kp{p4k8@&36NqTj5exjU)d~ZyN9QSi(RU;wlI7$1yWV26n!;{&<{}5taL-RK z1zj(QSj+tWRez*aW~8UfrGMYv*)cqKCPlD3l6dV!6N@79A5CblfcWf?rQ?#9mg?&6 zdU}N1+?LfA5YR}{Kd_&nivo5^-%P93y?eFPbXs3ak5J*IWn{kIE`T|)!bQ|O2#ASc zhEBI)GLq)|u#iBoSjB$^2@ma?HOni865nu~mc)(2r3;R5p*e}v8W(XP_K<5Ex*xN% zP0Ws`E05tZ0gJP3I-(yrQonrY)aX0T-i^t46B#N8wc#4O*LpR+0H;Z?i5MzXlp1qJ zs^U_`dzXyhG2yx_930$Heb$?$g$2}uySX^shM~PZE5vi$Grh2pnGqk@heMs8KiW(S z9|)BtSA-VYOT2qcK}lI?ed!3|36zK^D?2+mvE)FV0%VonKELj3qsUt^;t|SFDSu=9 zPDFMpZc7y_4menxpNFFoZ0d&5$4TFxMr4wbk>S+Dcv{NchShYn^YzU~ zO{nh3#^m8A<7aGuxve{59v&SQ2T!>cWoH{GMbAxnLE91f(09S2AtRR*6*)V(h8F*5 zflK}k5nmAA?GKM$gHi6{u=ck6gXN2rlP#E-nQd)sM4R*LapgBz#j7HI{HiFm>x!}D zSqwlydr9a5M}~(7+q7<bXsgjvKdLPF zwD;p&+E_=qI62pA9z8EXbE7%DOZ-k-Y-$QqbOuuryQ1&2+~_n4e$Z3>+U?7Td|Tnp zQ08(fxkl06#@5-y5e=GTVjTHGH}Zw?KUNLhHil~$S3G2Z_AsClT!0J3vKe>z$>-~2 zvDEh)uNGnG(vc`y^dUmDe6Yw&vjC5<`KV&afG~>KNNb<@mYd-zg{%1X5Sa0sVrX_X z3Nt#Mdh zee=AhjcM>)QN%a_(dVoD8@u_VpBa*uKS>kx8cP)XXO)@@Z~Zq} zE@Br*>j6SP-#$l4lZaK$j~{VHixKy5Y!|3d;;EMgXH4Dl#MW&8EpcNg0_lTg2Mufe zk@h@BKlgO}F{=IXWAH{|>{o<%3uaO^mYO@;;oPlz6m&37$A(-8sR!G^m6C(l7y~SR z)xi9a{>)m@d%RvRUtBC{G`r78;fG%KVdrqg$I`_k7Z1;KYhy$E!^4A^&wDB9`>L<4 z`y0CXqG}J&A3nK^hZDMXIglZzj8evcn1f2jCtxP~sW+OMWGxR2oTF>A@%%CRtsSzH z=P38)=I>DZN9DldbV7$tow*qi@%DU+(4iSR>Y?(2C#`X{dRcv!Co{067Qqp zrru7;?{)5CmJ7dRSm3mzh2j;==cIwAG^mo-@G)Wg2K6iy^+MTdc9A^vY;R4|hz8Pt z7h|>*et!P2Fo+q`*1|%Rz?Yt-65~Ion2u!rOh@(?2vh|^Ep|crqwO(^NdES=wk$3` z9&U#n*w-3NuSUC%_gS+EXJ=>a`cu~6BFyZ0)m$bPo1ga83-FksWHtMnG8Pug!%Br1 zEx*xzOEVARWiKFlC5q>T8D~WJ4TzRIv_L}zRQkhrAEI2)OB?azehSbKh9 zb~a!Y4`L8U*gGPxe*&Y(mq2+`W8J1hnktN=_iNg}WMmll427~8n(ymm=W3>=1%*kA zp`@(D*LCWo<~Cld*(f4A7jVtJk8Az432LsoIx(C_j1kf#tQq!3YS{Ldsk8VZmHmq#r8lqmb7*F><19jpdjRLM zS56Xk0e&(Ujt;c12B0;0#%f@+Rm8s`lDRs6twa~er^oeMP8emzLhv*wrXrB1Lb{mb zag>Dd9H(&MYKLJ!RUWMGe|#4g6cn`9_8pL#<6vQ7CG6a8=mB5OCv@iaorDz>lZ^#X zDlfPBQe50G721#STg0cM!^OpA2nQN5DuuuVWJ;6TP*zrkLCEnV3fGB}G=rQsBkIrR z;^N|>Pe`cu=!jmd*_0uqkC6qn#l<{y+}!L8476Mba>&k@eXhGcep7I6(8fz%Rkyph z3=9mtDPQ+UAP$hf$$&Ekc}aPrQ(D{|OnVr&nYA_TSloLnoGz$(mwK1`d%{kIK<9%F zs{P;lR|EfAAJG8TRhPK_;kERY**Q6e?~@22O3>i&3*P+jMBDLuFk3C#?aeJ4do4Wv zCxDbehm=Kh_X_mqkugSk`T$A<`LL!nh1OCuQGC0ey)MVBTeLn(=aXukXm85OPpTHJ z7);7I8M}!iK?i?aekU8vf$eej^ zobQIcP`~+4_P_kuds6j8*}zzEc*5>F<;?>*K{6yIL=^_J%8cwsR(vGt@t>V&RG^C+ ze3kwEH0l0pF(CEvKQZEez#k^0>ik#!gdp{!9EFoj?z6n~p7`8R_b~S>e7`9K?o%t| zB9K2Fr-W=)U0;F&JBiD^BgEs2re_cloBmg^$PhU3J+b%eh3drKd?H$xf|Z;zKepWS zs-rnCO`U7^XBK;t^*Q%;M#rR6$fYh-sG5!Cc1l=T{6gcvH@tZ8R)9zSydGETALipuL^xw(< z|87>iEMWogeNj+OMin7K2LFW%$$4uFYL7+i!MTf-!uVk)KO#&6{_cmHo12RaYU~$< z-27NjISm$-$O|Y)RRa9__BJ{)0wK5=7)mjYCiGdcv9K{NCX8zUf40w0Q4pnK#YL#3 zAj9?<*0ADAY+vh-lNxIr`rQWoCkOoxkbqEa|F3(4g!R7=59wM`VM!rYTIph2LUy_! zRa!wB#^j=Dpb>Z>)xFnH>pSQs+xy?cIGqZuT)J_MI%I!|`i1aG*3(l^e4#9ffFnNA z35VwSK7$%$aLyOB(z#T@_GeQuG1?hpmtVhp>h1oj7TQ_Zw7VV8_y;1SG~o0V{qzvd zs;9(NftW}ilUgASKZJ0b3u9HF>=6ME-BFSY1r2E;LcYJ@k#iohPYV3IU)1xx?vL`k z3}18nT3tPqo|F+U90_?jg3hFe*w!KWrKFVx*$sEe9~%PnpB~Bue*SB(W|XJ&W%K&W z)8J^mVB5?U<>CvezGpQBV`l(jDh9a_x?S=wj>Pvct6st8g^wf2b)S`~6vqonwUaCC zSM;P4F;GZ#^t5@Z0|a+>cXt{H?(Xgo+}+(F1cJLer}Dht{dLDV{AosakLq2ks`g%Mt~uxa_1ZXK z+Lw)za%f^~ET3GaI#%qi&i2H6!28m~GtoInOe`9*AM^QUaG&B{mM|8s0m**_w%aOh z61Jh2t7g(v$t?`LVd-HpxT6bv1HtNvkTbMjMw7Ykpnh2y}oRIr7dm*q>fCyf>} zUBjQ)bZ$FE>Li~UgOJgOt6v_RX#y6b8Byg21d(7Kw%L`1!ekW?O0ZcFITI6}DK#6L z6tMIvmei{gBdI)@az;l*siPks^){{+ev+ZaUeQrimB_%JTU~tr6%`eI@>9Z+zexq+ z*3(o-er+K-3X1M~y6>&>pXQEGht{H`w`p#nKK2L`7jPhqt=` z;sp_Tg5)`N?(ESGcNjP?VH8($^<-w;xhLxDEqgr6g39)2EonZNU2m?LtmfRp^2`r?pHH2110Pc z3_Qs6b-mMMpYsKVhlHcTZc$L&49k&@f>3u;=7&H16iOi!=~?bYcLlGn-cN$mNu%@T z(U>&tqG z>T8ye&SU=~)Z0s5nb7LlU6sy*U~TV}&8z1{6<4is|8(mN&(mibbR36`&{NLka{5T{ zXGX?vk}`ewb>(eq^Yh<7CSTuP_zC!L+})w;l5(S?qN6V^E_P>_y1E7maEE$(l1px6t(8({?E$FDri;JA;aBj_0fM()}h1AcEWXpquhE`cs72-)& zO+eU!M}h?Aq@ls1Moa+8ur&=g@&0`f`YrM~?NZOTZhBQ^BnG}vSALW5 z3-4RIL6H#1kR>>s2?If#JVTo)IbFF_8IU^`C?+K)ej7Gq)|h2u`{kpludfg7T-wy+ z;^~>*Z`^yDO$+pZ2d)&+5j@P9K`iHt!1C#)E*{xu^>qLEC#=xsN7gC=nl>JzHowO$ z{S7vk=lW_|&vu##WNz54XhP*1!p`B()U9us-)V&&cH%Nxor8iTesdTZ8vnr+-UL{V z%%o5$z31H`9GslDx7Q*o^||Dsyo`*3oQ!CyVs+`6nRfm2xaxXUGz?4(#P}pR1cdsK zPd%*xoVgY=3md$ui0xKpR`^@C_%hT+Il}j_Q-r=fP4)HlE{>k7gO-w+2dj)n524eG z_ZfPriYzxn{a7Q{UGOjGiTIB(7Td2s*P6Aa8@E}fP}ntLP~eT=Zg?{!9D`M5c4N6| zJLCJIlgGzVXDj<^r!x|yd3){AXdG?)IkJxME11X!OpW#+@#Y*$D={qr%8f#p)RrzP z6>=wv>lwp*T7o`uPI8#o)H2EEy<1Npik~WF_(VxHZmdT{wZ>*9S@UT!yuJFjeZw_$ z-P@7a)cjdBYJXy8d<3k_h`tfdnGf%^`#~^OxnEW;up+)nyu{0Xo^OHxHJq|Wo|4T; zIY()IVRIII`v=Q8i%q7hk-zmnK0CQLOc&3Xp6WrEFJywp1Fb2>WUQU&-?|D8IX6x< zA3Cf&_OiMF@e7Lkdf`iH&9@mq>GtC}YGMKqXwnC-dH7_b)2l5IqWoTU9!NbC@U9GH z5eeBpIzsKhhlz*kQ9;Kxm>TwIz2A%a9imuZX!(#LMa#PQELOl##!l@p{r2GH{f zFl5?_pPL)Uc=RPcH8U|jUGuwEMMoZ~?-;=;35g6m8ynka3JMqn0`0~2+}u3O;w`6b zu%paaB;iJPH`(4~)*U*+yO5wDz3#imo1?E^zY42;m6p3}@qXDUQTl};&)nADuGi@K z@?4EWLQL#+vce(cBScE7b6=uMjGxqN&-UT>y=OPfEu@}coK$Wm8n*sjRkH?@L=%YL>H=oPewrfie?_AU;K>aU7g zBP)-&`j(F29KN_N`Va($PLt~-hXiKPtk#7x$K7bA1q=iBEDw*TiRNEBJAWS@o^(3x zU@FaB2q^lm>m}*I0ydsR+9I~oKWTAnjRM(_yt}L5cHuvMJ3kiPhxfdw=Fdt zroQ)d%>I1?y+_zTh7#3X5-5V%HuhT}WV=9-c1^{Wnuwb%Pt%a}@D+P$t{(Hg0~<_G zv74>qzy{M{POx16*z5&Iy{(Vy526rp$%BiWZg)FMk+p(w?!w+G;&YZoQZbqWdCjmq z^(7T>BOih&dIAx#y@d_Lz)*n*nCjRhOJcCVKjZ^I+9nbh%0ey{I_1s+ezyQ>7Z-MF z#+F8`ci5W%>WxwqA%9gJk4QQtKBbr!;ag@6dS$n$-}J(`z7g!ICGFo4g`i8{{S5y> zs4gWhKlMxu9JF2%8f`HiH8&!6A@PHbjZGFI*RHMKskE&HBs|LRO~G3GHAp%s(H+LN zw7jHDBa!9sh}6{5GWSmcmBwS2>isM%|$#&k3QOaZDN$EhX_0< zBFCGRhKM947;W>fT=GA@!+{z@cxBia=A7KCGxlE1AFN-j)<25`A~1w8uR%GI@=6F7 zi9%&$^b^gmE}|RYVB$L6t~DPXrWR=9REHWw*qTv0fd31>*nb(_e__YS;W1#R#lfVO zadpCnIt}ckNtC>Sr_k#OR1HD}Q%0vyu9I6#hJy0G&xuqMPdaZB^z?x+4eC?N=MVf& z>py^sTd!4g!^2-9r%ibs23S5aW7xV0*Z8-> zXo}W4*ee9=*qxu#F&4fL3G5rB`Pd119`S8kT$&@o#Dq$o?#ll7?ubn3yQJwSjJKYi zo~?GcbcXEn=GIo2U+8Bf+PcC^&}%x{-d}Wez894?tx!ywI}-D3m1)Z1=_C6k3z*`=0@)%QY9?xNP-9pJKF z!8(<*Tbm|H*AVu^xgblvO@1=@FBc8lX+;xYZKVH>ODzMzWC4rO0P=yd0R$Mg{9CZ1 zjRXx%_EG2KO4&Y7mNS1qXkF|~ZM%+_(`%30@$Ku=87Yvy4=;?4e*SsG$HleSJA2iO zF2wJ+k1K7n?KSuCQ+rW_Ht{ zVx9~lzi3DAn?p|gc~(C7&dSr@XVoxKSMk0pOT|TwDTS{ok41!=M*dU*BTVcQ3?1ng z1<=SgP4JSP-G%a4vnFF&db*e|?^xmj{10?jPY`{Oh+i@*<;ib=@d~nn4Q{u!wH4N# zxY!=VJdK!p@AmLOLXufvRKUN{hc7W0J~C3c`$2}rfRkYJ7I*RUr)<9#$Aef&dH}3x zcYLVr)}1-H?&1Lv5YW=+>$SMM510?3k?nndfT{9B+p9=9Fp1^x`2P-H$PZuX@`liTm|+%<2pf!TO63WMcyKBZ<_I z!o)_RgoIpsq-=H`r5*FzYBH9%#q+i)E^0 z1&AFVJF|cH^dlQ$g`>=dveXLg;o*?)G4Os=JDfR)+<(awaQT2=G61yX1*5XK{U~Js z9s{@cAMOR8k&(}(78Wu0RDxtsCm`p6Md@)FQUQ0Ikq`!y@M*&nD{(P!kD;cWQ~x7g zhmRT&P{(B#c7cd_++mq$nVF{^j(?o)@6*12pBxbU7(A+4$<44B*O1LVX}0$z_Onb0ZK z!NDPVjm#LnEF!y|N=4stBI46y{rSXryV#;k6lZ5*2ryg}CG)g8JmF}%uT)gNYt;SO z+0Dgjnp;^xda__o((^(dj$P~|K!U@oHHG;Y_zy|8_2q^7VL)jp7 zIStd)+s4LL=3!&2D=+t4fPd#tazsA<1+X~)n9%+{boBHZUbd=FBj@wc}1Bx((%GA8qzjKNVQsd<1HsibO>8^5lS9R zYcOpQzg&V+k7QJiE%flWrLTxnjtFLEYBjY_j;B*L+x?Y}68(8cA{re*e*dmA! zo|4Vn%PNbz5T_z;*^t#PNUCm`m-q7-&YvPDkrDl1I<;k8OTA(F<(_m!bJP!Y!=}V5 zKU{(@6<);_92U5;Q&VpX-9;UIay^4YM0!6lQI0ZnQpy%Ifz5AeCjN=U!@&`G zshev&`00%1Q241O44b-_T_2(nsptDG(E0CNv~-bEjZq#8)mlA4rYbyNnRjk=3aNHq z5R8FhzuLETZWYO>5XU_ZB=QKJ7;%cN`j{5)uae!8lo>Fe{RiG7*C!`+E2_J>;g=&8 z+WeM8-5<^V{V`wiec&fgVi;)XwY4>XLX@760fTokRz5aY&(2&}T;kblyEs5LlpHlO zHN`B`J~%kod;PJAccx$zcQ!fko19#9cvv^iJRpl=_Mif!*%|_r&*zbt+V71?#K~Ez zr;w14I0zVcDFE|~eV5-=0HeRRw->-lXJ^^=4|I(xnw#N-C%Ivs6YMeB zjSZHNpG_p6ABj(hKlScsqbT`j+E<|t;l@c|@81%j&?U4~c92kTCzH&<3@#I(&uv(1 z+$0(7_ZimsLS>|-EiNtjdR}@8lKS+hp}>*Yq=WLt3mo=`bakVH7+mwHC@DXhRyH;= zQnJI|sPPSszLUS0x3C5{u7Gqb8CgY}BQrKNn0PAh3l5?BP}?*An74lo`|jx}OZOgyIs*?6kB|^4pTSp> z7kaUp9K!Ev@~(e&5X%P#2L=FZ6$%`*FIExkCV|7uk)S-MWwzS26-ADrw3)d%nH#U- zlB@?Pqhz>1KCHu%EQfW{C7kEuQ zG)z|X^Nkgep!cK2ZQ3NFm!^Wy{q2>Ajp{9FR*F>Q-_wUK=hwaXf6M(8sC`cpYGc>X z2W_D9F8}KVh2#N+z+b$vwIfg779jRe74_Q_G6C(Pk-q$U+H=e#a~K)5%`* zrYCQ$M{5*cIk8^drcc7dU{S*{6ri6nY`+L}4()#(Ed%H+Fytn^?LTaUgzl46XkZIp$S!0*n{B$=Br_%lvix0;NAun%2`NALt8v>{8Y zv|kW-TWLLAj&c6@#`1n&|EA+8vUQzM{_3KDz%jl&0k5>P>#Ma>=tiAWQYeeM&Oq^A zQ}oTtK}y2zh7do;tTKQW>am*q%P@iXf+#4h%)w2y{1vnNp~Yb=>Tv@I**ZWipp6^s zK+6K=iUhJfGLbTAgwGTrAOBSY`jG!s1LP3QT)a*1y^Q9ptt~wSGUYOkPcUhqpG;w2 zzan@H$h{+)T(SLF14l2^Q@s}jZHiJ|RVV>M9cZAj#kW#WVZ zT6D23m7w~e`!pl8G}Ox?=9Z!s`De~e%%>=46VZ_ZdoFo zI5f1F1$kW_6v+ub>>x9>RiER}nb&(N!_#4~25CAti00JRV&Mlb2Z#=BhnC4qj_K;5 z-3(E|V0fd2z-Sue`+Z5QUuofe7R$xt6U3_}ijItIXmEi*Aiqt%eCb}{0855^A-nXn zfDnxa*{?sc0&YXN)ddMieql0D6J(wupOoIXbEyqqPpx-_^rySPMejbA+& zSWvw0^*U&Xc5c7DIOP&tzbcx%TTgq*#a?V>>7n68V2i(3@>sxdCVmKVGv0p}O3j&j*x1_5rOsh0!WjiI{Cib>bT zj{W(IT-Cj*mlhY*`^d(2gJWRYc2ytulv;dCPrZpRxcV;r6mj$?ESD8oqt!i?uZ7n7 zU|$c_0Zc<}W3W49is#_k4$3nt0IRnEc1jcmYv?y$-^iJsr!d}%6She*kREEv55LY% zje-~0>ZtW0oGC1H=Gee=FS}K|F(3>FQ=}YOg@;JO^qc?h;!VBWAolC}MIn-}^wbGmU*EJtO_k*J;;* z%fj$P2+g0=^&~9#7imc@NkZYXCgzQSRsB5taPOad7RYAA$p7#d5kABMia)eA~qmt!c2;6Du6rVts{s(N1Z%V?uCdZ>7+x+ z>OxiLOjGAfRU`P#AgeSI2PM6}y0bYlvQ0kMwoK%4dV65ni}UsH!&$=x389bKj=#&1 z8;$DU+Ybg1G-APLKp09!V%6QLf9MYIfEGS5B8P`Ub|AL*o?lE%XuO@Bob*;_X9F0p z^zLqM^d3-t)Ukx1y1;X$MV9wVy2}0?1(RFC2k0g3nOj-)A3I4~5bh3Luu)J1jNt>2 zNue3b00K{7Q(HZipx~=DUw%Qs_}G~I-^WLHLuLswmg$zYl-OARoAUZ=N3oWXzn4Ha zx8>1YjcP|Oq{cTA14(?yDXML+T6Sr~@b-t|4l-=rLP0xbI>s*g--`>xfAg>U=0GUQ zEHDp?L8gN_!RKD3m6ZT4ys&0JtNsKlQL9u$GzF#oS~7(X5E;Jg;V-dRTNF9h!W6+gGA+QC1aOOo%Uefu6%ucr5(jB>bCz1$@5B?k!D? z%mQ|%l$=`~92EMP-O#|m&Q8z4a03)Z04ozP&pJ9eK}JIAv0PJ+n|rw0W7%`TL{Lp) z+Wy>bdw?}{TWVoWl#zaWwwaZdgolZVPlOd49}mlPpV8_97MF1I@YwDmZgtiNGjnsR zeM)~e-xNINnG%|so2z#@Qx&e{QUg1kd6k?{Cu>RMN#?@Ne+t`^)re* zV$thj;ztEK5%2!q-g_;37ncx$^{4rbbsg^m_xbtZ;ga0inXPLxU7E(G zrtL4>oLL6gE_1nxX-4*5WaH(@;BIby{XbWWp)AmsDN-g2`zA(~se*re)D7F4PTq}= zjZWH_nu?tdE`iRrlGT48GIpA zz5*VdkM@%!HEQ`;9UCyW_qmLj{v(0r_nAut5A2a`uQC9%qGsEP@$DQpX4-Hg7Us?UM^LT-F zF9&NU018%58bHX7`w#N4^_p* z!X6y#?CF^?e$zzm6QFLrp}KH=5%-epY+c9)JC9#f>u;Cs+jmnP(F9I%Cs!MtSWau*sE2~g~NCxA8(c+EBO^ppf45YSzT`hCH- zU;m9SEj=oa@8W`|2V{IPnLs1`XbJQK@6D3E6AS7C?+aL?fC@-^a~d|-MkYslm9>n% z<7)Z=d{s#0=R|^cv=My}iz$j|0A~*bmi&J&2teNW55E1s1Tv?=2r_oGJRSJ&vxRz= z@Xvn}>yhgYA6Tf;pN+{D79M|vhtX>3zDjE1CoNDz3LRG9jm$Gjs@?2uMRwpHUmU))4b zOJx3+Q}08Sbm-I$32?Z_If6Tl{|f&b8=*;ZV`bR?jRiksH8u_A&@Z+82*zu!kRh;C;MzyQdn(d@2dEHMv#Yg@oV8t5*9qb3oIb+ z31`IgkQ?Syf6Nu)V&Wn1&s!8sD8;!@m9VDJq&0n zn934TeB_G?t5{OY(?7D#Bj=EjgE1&g%VSPu(99ulSU}QHWLiRVU(Fx3{0fLg5^1KB z#}H(>47iB=zf#SOnL>u9^5#HA#@CWm(SC%Der}@b0r;HOnz;(*k=u$4h245{^3C0m zF(bM$=HvDi_!?mglnVrb>b>~`%sDJFrA0+fali4`^QD-`%%x0&hDU^!!hn0DImxm+X)OTZvo_h>%-Tuu#*tz%O(sN-bPNs7M7MsHt3GIq7QQMojkK}x9b2JUC=cN-p6 zvBHuF${4Z2SmL<%Z}|qF`<#jRYEW4%ycYIsxlOY2lsZjL8t$}@rXerU1*D;d2^DG} zSqn%c%;ixfoh6}MIRUneY2}hUg6vZyA2eHO_4gT`@_PDd{15ID%IdxTYIZMlYLZYk zxZV3d*dW^H<{m3`e>=%Nl6v;%dvxz&g&yYG-AddteCp=AK6U=WxoFRJAYhnj5yjk4 zu27VtO^7qjP%LSCsh|#^$c=HbbIl+k(P1T1`6OOT+x?54r*o%tZ2{K_6#>l#*JO_D zuV9?l@xvPS(6P%B?l)VXB1toCyc2&AybsF3x zNs!ESoG|dUm}t}*s|j6p{$>=L4p#Sv%(A3<1~YfoUIxojj{@wDeRQy6#Rt$hXqS}k zZG~WEV`9;q-N7O0J2MX5$rF0Uj&}v<(dNp%5w|;ZYXXaMe2Yxflo578QdWA^s-R>z$KVorE!?7MTu;GVaYa!m0K!;!%IzB# z&OJ}NAj6H@aBLeG%l`;?#g20sBl zN%Y0SJ8Z?UbY7{cdhpC=~1@e zSHlH8vkbT>&S(3bYi_WkX-TI>C>mVbA~T4__zG`eh`5PQmXHr<1FUaS!VvpV~Gx>l(g zc~-_Ru1fM>OBBga0~+{0aPOv%lp9wp?9VTz1T1jYD)t_u%G#=Sc#2VFy>*jM!z;SlsF11Y*oic0=G<|l@ znhrY)A%?XujeYWM+Y!n??TpWO`#Tr(zKH4BQrj4gStMU9@T*J*IiS@vQ-x(=h!KE4 z*s8{fVTdUk4bMao3${Kx9Hy_*K%zMN1*ubq!T1dl>fZ2Nb29yDYpHs!oB*r;9$6=1)pSu8Zykd}=2 zupT^InVmiDdA@p`_C#MR%mnz&sN*9E-@n6BU}43cp;PQ6YqJ*(04$Wd z^XsKHpk&Z!)vOeThRgR}w=n3{ubbBY95?KIyw>bCYP=bNhsjBZKmR~MVf)c?sd{>N zn3j%?mz&bDcOY^Id++p=5eF$HBd=xrTB@1Pef!w}_?6fMYkUQclc)$P!k2K|>pX=| zII0YWwH#}sX9LH_s2#eynm1PqPGG47d#X)V|7q4(I5;04SZk{R@e(x^6(29J^=b$4>f^%$A}q9=+$2EE+wug6 z$cztKsmVXdB{)&ejD(I#OU(^)fPPu1bf^T{>GU+qFG8u&5zE_^wpMR}V;{q>y#?I1 z=f7WHo+|#(%1KG_0*V^I&7iEz;tw_!4Yi@9^4{UD^ZC>lLJbYW4$(}({PWdT7p890 z1a&avc%>P6cC5VI<4J_HsY!zBO`A8bHzZmuBMf$Uv@<=6fR=8Ul^hiF^XD2p1nV;_ zzLUXs0oG_k70v$r@`0ssC6&7o3-`Y)M*f$TVZWcZu6egginWXGq2lkp?e!%_e*9pi zd=RR`$<>zZ!&%wcsFRb<;#yD}u~Lw*KGOmP2fvxwWir5TqsAjn>*Wm6VcF9JUqPwl6mD*8Fsgnsw>XlLlCB9{#u$g%zamc> zJ=>q}ZiXNR6@GDmhH_^B4Ar;sfJ`&F7id*-f8ktZH^h8ps#nS`45P@JHPzRb<&XvF z3tv3TN=gt@P}sO#P`-4Dq|>wNyoZHPRgp~&rgqH~if)L#xTvXNVdq^N=i175`#A#m zhf^07ijmhS(}~ZR6D3R150K?3{K%UQ7bB0yOl9mRDg<>0q=l*?91Ph34uZ@P{lPhY zZo7`Bso76dnb;sxZet=`5>9?PZjrTAxLIkz0Q{Y=A-$%){WC|hleiOb-)h7iY`zl- zeS;mXadUU)b&z8j!Y{M!T;b!j1>f8N+#wR_^LTv?9JPl;%#GAsO>BV_*qwChQyP!O4zclmhvrup#Ym^ZYUKXq1PMB`*8 z#Li%$nP8w}X9l-Dd(PfBq%7awqGf2mhyT0t*AFv5RMh41Fx#%ayp3qm#q0+UKeBI- zuA`-)n6HD_DqV|ubR;4&60!o8h4jdXtz>dHg@&niDCc5h6xxS~dB7ZYcL}pQG^L1$ zGh}vC$k&9}#BY&=%H!$rJRYVsL(9cujQtdu@t8UKeb2)D!k>5NB!9$y^Bf)>g&0Uv z#{ur3xrU-j6bRo{b!;ZA)!`Ps0VlLd_+$=VP89`(<(V1xq&lVFt3MOsDEi=-=z2th zB#;>y_`O|qW%%J-jAbTVJ&7HzE(;5psU^PaZ2HFaHv+w-U%SBeLJ<+tw#3!d)x{th zH8thXK@^v9vDE{!8Z}5OM53my3|q)?)oV*xR^!J!`wJ@HN420X`r5H=vc^M)gM*U- z7lR<>S*#JvzoPjZV|UTTftNgDUSeGsln4qFhYG_p_`8_9m@yFE;6m!c`jddTaeAIV zyqtBo2*j&>oC0y7f0ufd$iwr*aug;A9^vSsaXvJf|NW%G2hlw=K*1w0J%8~#@x?qT zZpOh)`dx-gjGd=k%AAkP$tKviaLG)@iSX!PWNb`LNuA4!K}4hpxWxe$erJGxjf34+ zyB|N?thFm~+ev`l8R&b6M<83v&KW@a%=-D$*SI@$Xh=HgSwSo4;U`9xFi|ryvwmbL z27+wi0$Cvk^booG@lR9uAHiJ&x&?721la*W53=NyuI~2gA)aEP3=uvO)Vml{E6QZJ za#;vxyI+k*cn2_38(U2DWeUHzS{`F8k&o_c7>&7ufR$pt-UA;@NeP=*CdN_5C8t2B zF?9$jPW93lzW7>kqy63=6LB~^c)Dilw64a>ySdkk!W_0ZQ~p5yq4YTM!59?|_dHyK zN-#zA098L)S;@muBmpDG;0f-~_c-Tti?#}-Ql=niGW5SiNut#39K8AKU7O_QkKljr zT#D*B${}@!1_tViF_V*#k%2HFl9CAEe@hmYKX70E|9y~m6sB;f|NGUfr`PLj21no zvG*BMe|`~**R0M4H1Vuh-Z}vI0h_E#=)ZxqP~>tEFcL3gn|4M||EzQFsk{@{I?9PX zbs{@`&qT6u;$fOJ*`2ZR)c9!!+cD(dc=KAJ@_e_So}*VDNoy|nY8T&TYlbEFsr&B9*EXXjp}}U0b&6} z;*i&UkMmU2OzPT#K@jiuGoPMWEGtd$O99kYVKW z2R1gULaVj$S3WF$VlE#b zRL?-;iLtpr8~=F1VT=L~vrhBh1q%t6p(Z6F7#W?6mXj1dy^W8L@5;^w)_~=Gg&%3N zrk-A2!2TM@$Poaj^K)E)QIJFXsMF$!MyE$@$ruM-%Av+!w|rq zRU?rjk|%Uh2q0HeaE9#6Z`~+LkRL(#qja;4R}nJ!&yz9?R4ESygt1t_b;#c=Wvg?@ zvc8Xyq<4GkMaRO%zHtxm5&li}=F1W@w6XDe#ndr0JPfA-__puWt24T|K1C7#O7gfn zU9NH116VwrEA@zPkN1!M(%wmozzzbU)qVZ*^ABr0%%=9{hkapjmYjre`{vmH`!V$l z60-ew6rWtXiFajbzbmGoTmkn1*{Q9KP8PV#K!ujNh$(N8>Jj6D}O6dI_ONVc&l+(kDgq3t5Z6;B5{jj zrPcZf46aoycgX+H$G-F_tnTYue@$YF-^Q6TFV!0X*uX#pErbG}^z8KDyPQr`{mk6P z59LL7X?3;L6#$TbX}C^KF#IklCx?Fd?n>fbKtRQL7O-yy;77j77=ZlpXUOW~^l|;8 z&ZM&Tz|?Y!^TF8U8Ua1Cx=)QSEf@b-T2@w*B_|&r4StgD0AtH>6&l{l8I}8d=i;GP zquVAotkrCfrOXBl zi)CnOVTJ9aO$y7Ih}P?hopXeF#$9?lCU(o86ss?OPJ0?|=0y&B?XCfH(59ti%pcs0 z!FzeVh-xw#=VN0hlZ4SfKfN4Gx+cD5$gXUjN&BqSdD^JoZ7vtSY{DF%XH2{aJuY%;`Cmx z%rrVgZU~cXxN?>FI7_;&~{5 z>iVT-%YRa&OHk9$*<|M8DiX_v*kMEL=#``jl556_Hlyv?eISo!grt+zMSqI%Kn-@kih@pKg` z5#tK)p5~5jk_V~vYY@f=NRxCCqo9QRG^T+mnPPZ?lf!Lfr?#cVorusm$SQ#@K|PY- z#L>--XTf-H=XcFO<18C>jI7LWus#iUUQ0_0Ak;`sUxI;ECG;Q#>6R4DbL(E=G84l) z$R?^XK0dJA!R?vy8l}iECb5;-Qk0gK*?lP-?@m)FnH(BA@38GA8ac7RI*7bFb+V$E zuOg}>abeu?ZBk24O`SN-udkoG)NrM=zAR2nOS9SL2?yMKP0`XsDQhK7RErAq+4((} zNy=@CO(3{!&}&BjMf*<@OEj|IQ%KfiOQ6j`>%JZ{axtTXK$uISxT(KUBEO*x{U;#Tav=BG1q4 z%_iW?FS#`Pa$`|zCYox#{WN{|r{bHBVCSz1fx2RsYkAK|pRbD#ZH-qCC#$_uZwJzy zZ#RB4jT!rI+gmM&AxM6r{X;cG*kOQOuy1s2t-UbLug=un~00@rn zA_4>ZfL=n|JU6`9dAHf(!eUcHQ=MA*GqjRcZBf(W^e`D-O5A^jk8)j-}9)p8ROG_`q z!!;$ftpWUd!fVR&6c;z)orJVSnoMPvQ^*_4oTGGGq3umJEh>t||N zP1W7qzkWrG!g!5IU*ms=w;%@GVA=|nYFbKhX-ViE+hB4j1q%&A=g_R*sXi7W)WDWC zmgeTrJ#=)R<6`4F$FZ8zu!x8t5u_NPAy6#fscmFrq-r~5ztRnrnjWifFP0ifvDOE) z0}Ck4F^2{SbhuS%1T_1+m;xr3@_!8pS0ptx1q1{{lu7H#PvJ|@VDNJ=%y)Os*}yd+ z3K3`h!~p1KI5<0pyDFNRkg~%+f5Mq%E-o%QIyzkCZ5GX_sVRRyVu#WDFJh32tVwxR ze3uSB`$Onkga_t3t*Mi`7oXPD=x-A6|?*q6ZC5P178zjN;UJ%w@Q{u_$lllG!&A?snV z^VjP>+uhq!&6SXiZGUI->y1a0&)f8}&r{Dfsi4zC|A(`;yAtH<8ZW=Mr*^ixc555= zOkS_eQLJOS9h;#o39hJQ6dp!AYEo-wYi(^^`QII0PZxi-zL+?07n`s$I;eee{RD;i z4muDz*_Xi*!2@*{T^Ars?s{D00@#C$42mYCTK;?nxR5JLD>zBeTS9wEa(ZvMv$vNe==GQ$f$V}vX{`k4zZws?+?`JK`%2LKbT6ew*b=a-y{VT?K?3RcIaAv8+8TwBs}$BcjrZYo>mz4y_n88go0Q^ zyd@+VqN$p_l>-L`2F_dxG}koeH)V2vW@N-AWH?=Um|B|N2X}AI^vub9wI0ZEz9O*@ zn4D+K`7^G3+FBAI{!*yU_9>cHu(3FJdusrtLjay~fcYiQ#C&sir0RJ@eGc)u`0bCM znATFgTmaM?Yl7(|_Ii#+bXpHLr1A)*eWWPt^6@j*Dd8*i30HWE`UUa!)!U7wKtQHX ziwKoNgm;kdWF3xCC7%qLrn~1!N)QiKLS~FvQ+}l$Z2%ExgqOJ5Vv>!{6|wzEFxPX& z*+y@L^*8%%3*@H>g4KyoF&AaVJ4;BZ>1G03y+_#T2#I0J3pFKWlUAR8*gP>?s`rk4 z(AZr3IjVRB-1^k2F!{Yo&aaWh5r`Wu?Sa)I{t^GKjZ#aFkmgxh^A;6=%Tcu>OHq;o zuUIj$8}hQOE~8S5C)yM--}q<}%bwiqw*ptP7uRMgZwS_Nt-Wt|k@7@Q-H)=LuxU%g z$)?5AuZF#v@=3zl)2C_Oo6d-_a+C&0Iu}B7w|4z5uFPPnmJ`-SiYyt+JO9{F2(qJ^ z{tCOa5Ash%m#oAM89GIm`@T^MZ&GJ+aMQshnLj;dePvE>g~!%d31(XyiP7q4RX-{3 zX3lHYCm%O6VIN50A--Z7FgtJ}0Le%2Zf^$q{L1D??#kyHJ9HEyk6jhdy^~XE^QpZI zh+CvlkVG??k45+Z3#QHK6bzQh+0=28y@?z((Cu~Ft0BFX?7Ln?Vl%3wvwix?UXbbK z?h&P3)o$LbPM6@y7vVV(mA+zPzLK7@aJy>$11)&B$z;wx$b45>X4Cm>mn$l9T;}MF zdglf1rLB$9hJPl@U-XqmfhT+N z>F+j-TT-AZW$w{u~p9XP`JKvqKOz@||OCZ5@j` z_S4`eQzCR3O4vG6Q_Hq5-%mRT>obk#5i^%!m&X&*(gl%M?oOnO3irU1#KcZQh-sl` zo-!NrIrwNZi?2|X6vMZ1gEX{3%PbNb*FB2ih=5!Ilrro zJO0W8Wg(Xi-_viy{=GeOF5Y=V4um{u*G2aT6}B+>8W9kTuF;zx3<9*>`Bcsk=ck+k z0@1^ZjjuEqOJF}W_AczgWN~H&6dEvpBGiY^w6yqJq{7(oP&yby&>Spk!d=+8YxPYo zzVbjv5!~K&-YuvQE5z#03bKusWmb8h7LdAIpSs}~#m`uCDLHwG`|H8f0Qe9Vniy{t zC%QCBehx1LON^;ak9~6-Lu56kX))Pl_qUrbDXwgaN_>9Mz4+-#Z8>4OxZFLv9>Xdc86My1yLQm_E=T<5XEdfrx>rRT`0fC=yD@_ zW6AE8$DSmh$h8nQe4vVsi~qY|#$0pTLj#_Y%ZKRS?6DF)nWOSNzdER1neMIcV9aEL z^;$itY5sk-shR;rqz^vsXDp)v_m`_f3H|Wqru=DfQGh^askxpffHRWfUpO7hnFD5% zz)J$)l7WnWReG2tAb_;V6r;Og2kP{L%R{d@UQrQ|+G7#Qe^471&}#T!+5TVE{$JUS zMg9*x8a|=H6!HI5i9Zy6-FqeUF@%@G%F4>IOj6Q1sc*1&$D*fA8UHeO+L4 z8vrU!?r5fadZ4qSB`J~sQ#qZcvCZf8P4(TFh@8U0;4fH(puT8Y=v4aTuYL6Oq20RG z=g3M^Bc|-E()4VJ4)?!%(W_R%fnuLpoDz#cvj%>5Z;$EWLF@Vg5fP8ucXMcHpIWjWAd-m7qaV#ZBqx^4ZrODtLeVA_k+&r0t zFh$;C!^rEC&+Gdyl$$@ADuJC2Zdjj5{wxaKJ*$^L_QRm-K0Y4Vd=z9fZaiD^qm}ok z)%Rj+U{Djy+1g5W+v>-QCgD(U0JeZC)aPt`LMQn-Z20g1SD4XuF%TR{_`v^~SfPPQ z(pFHAK*EF-n?{3K_yOy?ipo1t2q11;A0r`}%!CV@Xl_PDsU{{O*89Lv(coG1P6NP} zUb0tGFyK=p$M*XIk4vFnU|@K7BwuqjtMyYiAZ_%)uxc+PO$n&>p_!MWE0DAQdlrw|i!k$UAP zCJFC#Ou;v5F0p(s=Ar&^)J*I=yH^z-JgDlk@+<&o>LY;rl4Ii)_ai~dYY#0<5`d>` zpa0(<`kx z(v;*tmV*@*DpsbUmoh8)s(=k_8o z{|{Yn85KtxEsYW&5P}7F2=4A4U~mskaCdk2Fu1z}cXtcH-QC^YHE=ucIp6($+;tbM z{(;PNKi$*4cUA2wE^hLI@^U^B78V+sFjg*QMMZy>N}Ec+{VsI$3sJV+&_-u_J3e#z z7i$JOzR{i@QYI!d;Eug0$fT^J=ubQ=Qxg#(<2SLk)=^zN*xwH$Av{`=kT9FFsD3&; zaWVaohzJ*8L^mqaKT_GH7Mj*=wLL8cmW%^;eFJ^M`*RRdn+j_r0evd&xizz7q0m3nZ zE*k=?YQ15QT98msSF~SIJ_9aCe(Xm$I4$n(5X9AqDJj^Pm@o(*L__bt0JTFxh86dC zqWfAX2t+cyQtk(TQ^>4B`5K;vUYN9ulf;_HNM|%kWs+6$9cRq9a`qH6WzSE|QJS_c zro@i9kBOR=7A>rARF1B5-59A4PASwKS0UvbJ~mVW1ZXn1xwE1TJ%<^@h*sBXjXXu;?ZC~1s z52^drWth2r7AXUrLt{TymMf2aLkVv0@7J0e@GR4R{HQu>4&AdRAdpUGMYQn9yL$Pp zhD(N22)obm3?_@SZ||uN>>n7oy4c+%E0j2qPmjjgA0x-qBQ2;I?8e!)d)76k_l6vHO+55r%U#9e3^EpfAoIUA44` z(#V0X%fSl4*rXcT+r7DmZznNs@hMaf9c+z;8jpev*;88+Lmi<~=ZMRvyeLHzZ#gzV ztVVTzx@Pz+dbCHN=`*FLg`FLf^Mj)??RzPc=!aA-{r-h^8Riz}6OO{agx()x>Eg{d z2d)7@fj%*$(k3O@G~8}X>USD@GAWGDm~4BtpNiIyW#UJJmnv^c4Rs6e96SUjRALtG%qc1JK0+2dM}4 zx|>r23IQrRK$vj*AY^e-U440+wtSvN*bJp`c5!y{^0*TnA0IC+2K}SSn%Djs{rY@= z?;vl*$-_g;RBZv4$SVfOK;D>ab|1mazYPA+U^-#*$h%}U{`|0R_)J9H#wo*X)B(&5 zqlWj0`DovopPmr?d!pMfN^rJ2pQt(=F)+~g+1LkhodScYlaT!;!k~wg7DW$)^kJ#T@RTUE^!5)xph`vYqEViuOn%3(QyB`Ob4hgke<+ZGg^h5t+Q7Vq~2NQ$=mCiw{&@eoQw_MVp?zo+H z7m@Ih4DP``U`~xLovBAQMW0FrXP+*q(%2+LTO)~13n$Uxj5_|m$Ms;UF=0!iMDn%{ z$<*j6os~?3W@b_n2Or-k9pHM~VWaPMn34*B{`T=HxGGnWQ706IRM~4ve&%;kUgoXy^)YMeKL=Z5Y zfCIzr?HQ|o6ok;^tHu`qwP+#f_Ef=qlQSj1Q0Gd?y(zp1J1t*zw9 ziu-NyH~?lIaO=JN$e+T(!g>w=`Ik4;UtoqhFi_--fB+Du(9_e)jurZ8Tzc+f?UIrp z(!2mTEubOE%+yX)nX~))OYlRQ!t_|y*zoYMeMtiF5V5!;+rDx$>7{?7mhy+yKRi!7mNV%==pU!1c3swzd$?aUfK2fW+X`cU%@-m*bOpo#PXH?=d zSZ`sqeafEu65a~4&e}OXSAlAId6{YbY*~dVnTh@G={LdOL;%cEnCf9~k^1tTX%tsQ zR@M@0KT<^a?zP?CUSFU>?h|s=Qm|F8Lww!>oh;o)y6eSS#e@&h)t^PHQO6D<;;}gi z5N|MjxmmT3oyAh0`^D-O%wn(H4MTcxW>cXEw*;L$dOI;~oAjIzBF)rV%CIVX`Eu96 zyEPQi4R@~N9JqfSntyAEq%_)5@W(Cbn4b#e@Ra+xQm5l7b!X2Vhp!Zv?!ekn2Eadd zJ+;4LN`g?{4fZ$t%5z>#?Df{|G>VjgxF`ga+;$S5ye0kAfY5LN zJ>5OG{H|yLIA!kutGTr`r?UWn%FWEEy3Du-w($@mhz*%0m;z$)vGXQISw(IX1KYNx zIoul%_a{aXcU9@BNn+<{%}7#bx%%$=5~Drx9av68GgpV=?(H||7}WUk(x!s<9W!^H zw>0Q%h=|bTD3zlM=RS8#b8U&XM{SklmrgwnD>@c0eY$PBe|Q++5045HemAK%HZn5S zhik zO2D|76EJ6+u61w=m~242IsEcNTRXDCj?|@Rp4~#f_ zV*pnBuWCPudd*Q1r2_MH82FOjgrp5eSddpGA66+J9ttpEfiJ;Q zGBVwN2p%K0ghLFAOG`aWTwumb)!`4AaR(=>gMFUNK;cnQ{*e)T-%#;~QiL{K{SbEI z0d7WbJy#y0oHF8DzzW{q9sPSqYoK)o<<7B3%ulCZwGwWZwetF)nd;X4nO?bU71U4F zRo7~Nf@)Lw$$7MPi`EsRnEo*ja_TL(lqY0A&xImZBE?4FlU#5ApYAT9`r)2YeaKR3 z3Q8gJNbWDgl{mlVnDenGXW+U;?8i16#Z6RP+g0- zY7oY`V%{Q9{k2;!CRbv*8s@{t`u2jPs!4tK8qF-m{U!Um`3CfKfed^5gXt~IsD~%(Jdmxm1&;LwvtTLs{A6EJMH%sV*Y*_*P1NL3W zIKkJ@vUI#_B>gXRuSs&`VjP(+gQxXh?4V@nb7LJ#m~iNN*6z@K8mA$ z{>qFZHevV)Z$~dc#Qz+(Arl3B&Yu41?|>i1>>@K1BWZtfH4lcR#axKv5waGzE1D`hAqXQ8|H2LU;O8A08q}SYbTbuK7Lvuo)apomJ0yD7V%$jpl5Kg=IhTi3{^vK@FjuKS!L zooKG}PN0D$l2zv;T!oH!e!zn%UbTL1c%0i%#fHx2?!-G%_O!{1->t^+tmYb^MMhON zI>$&HAMo7nJGzQ&P@u-@C?& zd7L;bqOF%w))$88&&p(=!JVGRAA-BK??!-aK`+C-;eZP*Dk(IFF2e7t)8=Hf&vt^( zd6)SWvkQqg&oc%KXc-Gx+qQ3holoBAgqjZ|zAFRUjswP9$JIo0m8KSc~aVL!~M72%ap*2OPY@f#})YWQlg zE-X;po{Yb=82}VnkML=4j|b6hgRm6z%l(ZV9tVF8_$TCq1w;cw~^eeDSc);zc6i zVs1N*B5_Od>meC|YkC@!xCbJ*vB+;Pj4?1RpA1ZZ5`m&G~}n>{t1!l_2hh#a1upm{|Au%FV# z1I`Re7H^by?Yd@og*wpxTS}tG@G7rzypXn$M5oCt{=Z-B#qZ0dbu$QouS=C6}$ zz7f8essOOIv(puTN z^9mX-kI9wJ#U*EV*4$`ofRcg%70l3j+j%v*HrbR#3VcEa&7NL4+TM;OeRcJ{T9 zY;L?f8YD2@QN{1fd3#p`2Ic?j(4Lb*g=q?MnH+1WPR1?t=Vjz!fl3!B)pJp*Z`sQ6 zQ6o#&dA|48w{38H-$+pZ14+n8I$~*Nmw7AVXEa;K|GQaGQ^y|Sq8{Ceeg8ha_nlUIPN6#-k1o5699ufmeQceDrBBN8*)+kO`F_Y%gq1D`$(p)0h|k19N;7ZOajXP=Y#;b=|6tq z|2YfC?s>0m~2qXn_G{-O+JDFAk$RP4Lp1{&)nCM&An63`#sITyDkX zKr}DtxJ0r5PK2eeH%N;n6C1!CrOAYAjAY0H=GJ+uZc$RBYre2wU@O5jFKs;Do!#K#Mh9|Q&GRq%ifl|l|>wDBuvcE$iCZN%_12z zRT|BAJ!tFuV)otP+8G`+&^tRjtNsQUqd}xpW58Tp2v!q`j9%g!{O-tua!Sd{nzv{G zY>ogY4yWRhiat%ubZu>I{!TmIitfcl?4d_42{tY^Hb47Ty7|xKQ(b@V%i0attHGsW9_zHuo^*ZpPvwSHyBTgQe>clMMip7)t}HK?hl2uNr;0}d%EO*dhePlz z#oX6AgmUed^7HMQ7>+4JGLls(z{4Z7^W_>hy=d}WJUlv05HOPq3%YMidT#t77uh`C zfa{kG6)I`aCo(1`0B%D2AZBr50U*?ugtxc%!Qw%HTQflI2ZscAD*{f5fESWG-b7hh z8Q}O1j4K)v_PEy7vZzskAst|_IAnu<`+$HckL_s23puiB%A2_PzA=^pR!LU7#)IYxpcJ%~L&`q@?c z_HW23h7<`<#id6^BGT|KXooXDbaZr#^5xzdexCRPfIWwYX1c!bz-r16qv7(jDWHl; zDJjhWP-9^=_{)|A5ROFL|1hyJuUPd+kB^Y$TliKyb7cDk+lX5-pOvn?jqK_AhxkZB z9ZVT%tTIJ<%m}S}=GUnSgWu2AVP{G>KM6xO?j6P@f3`kWjuVb=P9CP%$xvlw)j*=| zC94TO%)?r4yj?yu33?r^$?IypS3Gw=BhJf_#Iq~c>Jt4$(;EckmM2Q*dg>&#oLR|P z@?mW>ZCQ7rVR_v`*_P7M+WKrwt}(!?hXdT{@c=p8_OT z78r(W)!vQ}B0t^GSkU6F{9+$F`>XXK+?BxiM(oBSts)IXfq-$wtko4mvwJWcAczK5 zr3RmWI6{*_h!~!R<6C<%83?BX6z?yzcbr%gNNOc$zm6q2ymg%JZqds15pI zhl(zFHr2J+VM2TZrx;!YB^#4_i_DqPE)^qDvb5Ax41|X0yJT?hjubnMvC?)eDJFs} z^xMzUd;6YASm0J3+c0c9&dz@}bzSc{a+7st$4Z^*R|kX`2k|a0b<|uE$*en*iYC z0k|&;xc>Pm(4XLfkg@63yq+ql-BS1Wjc}bozlGL9bPI>z{=!|o+6r!GWkXg4qbTg@ zX!Va%x1~QmLyI@H{&#UT59A^n(yB&iqF!hs%uB&FOQQBI96PqVi&!#mF@*~27+ z84*5uJb<-Zwgt%r7OY_Yk%ncp-eCR-7*rMv!k)hBIw~!LaH^;jRAkmCN3x2SHBy5~ zKdg#M=%Mgn=Fn5SkL?>z#^UjLkZoW=6*XqT2ACp4DuyaD=1#hq&ysA~&xs7j8+%us zEC?OIfQHq#wOrnb&}LOzuO!c9oQh|3^IOG8Ua!^=uCg;X;6(8}Ati{7`NK!&BloTjd>kHIMs z|GW$8@6n3^gG3ndLUdS`gf^IhWw2Rlv)LWi$x$mXQ3*ax=#qK%cqFBCU~)}G6fCV!ZeHsL+&v#cOS3t61N<)Upm zLs(eRV*}83&6M=?x`d3hjOVw8B->gPMbUn+H5JE_;xZ6Ow=%aDOK8)zaSb;V6Qb+tc&&@SekM zy=vLqp;hEm9X1iT0nq;ct&k<10+BfR5n^M1qeR>_NYGaZ(TXyVlZ$FPX(!3c1sIoK z#htzoA`>vMKUM#e?b{@RMEm*xJI%*#0Z*T<&V;=H^bVUk~zTwGjqe0<#8OLJ@9 zPF8dj92D&Ai1%`qmb8a~In@%_cmxE2EZA{L>FG`He?CMg^gOZ?5oND9>u}|Fcawld zgqjlr0s_iUt$r}HV<^ez|P1g08AgHSC0g@PqXke!5oTg)v zsRo?QVMU_#N|jaA9*_}?jE()V`pC)YD=GlA69^)~Tsi&;PsdWC9A;llAs{E8_vRL8 zfeREQy`LqVCjS2`6SF6Y-g@*_PdCk}LdKq)5k=x+&Q(u`B=zbx&E-LvsGju}*(^+|P~g$+KHx&jY4kI3tbWOA z9-KkaPf(G3cK_^KFC5;Fm6*wDKv~oy9^KzJ;F%@Z>HGdB{q{zC#zL&200>cY_3!WQ z2zY(k>*`L*WYYm6?>8{yaUJ$KLqg7`GCh3-P%(H~TmNJI`xSE}5@J)qvMv`(I~N!4 zQv*btY;5>^PM-*9-)@Tpa}XO^KIRzzh$a$@62PK8^AdbMBy~kb?m9HH&|K!uNDLnV zDo{?sQPB@YP38@@LnpP zF>PdQS?B2Nd`BAuN;G(c(0E4w-+59!2Dh756x}g za=Y<}RGW-M{Px~iW>)N$>k+DlScbF9Z>OW_s7zi@V6L$8Gjsr8S9-BjcK}>(OHICl z4rIR!PiU*!11JfH^uLjpFSj_Fs;IC})BoeH8XFr|^=(9y9D%_wiG;_qi&2LmO5Z2+ zOna1%{0t0lr%QF?2N{Cz+m5}8axzl)mzT;^=s*+=?R{#Le5mb(nIJ%ERi0I@waI7k z>>WBaR&)@&0}$!&yZIko#Kc%$-U9F2;X4CovU<}NSO{W05Yh{i#q?Ed2==n&X_>5_ zL}^1n%Q$D-5&c~8jjG9yWtQ-p;EMbZ(A~Xrf8XYECMPNB-<6(}6*VqJDW5Hzh0HfcDVIe@Mb(?kPQ&xO z{(#1;-8ppwmpN%);N~UpY+wL~n)TIk;Uq)8iHh{dE1AEkdX(#%EBn|$aUcZs5WRr;?Q?3>xEvX7chlwU z(F|bNXBUOV_zW056LGqZj5AWv0jyC3ht;B8{}ddK01GSYl{4t4WVtBp31jCg3pH~I zFcVbR2&4UlSqHiSEq|i*LDFgBQ(UW7dd(j<<7yIBoKEk}+{7@=j$GKuu4DtBj)Rn= zBUU5}M+)J>Ko$YQQNFOX{;4e21km!S??AD(^$S`^*Fj_;BcMr|nc#~&0(Kr&_d^Q2 z;p>C%W6$pH?0m(K8a`THSRzqQ*N4b#>+;GHY6faT0=zzl*)||LM(+a1P{BI<83_$i znNu0;@hAR@7#TT!F#fO4v{@-K2qxNcjWg3x;j5x!viz;6?HD)%t-}oUhC5d4W{l6r zI+xy8@8Yw5{WO~rJGO~86HE)mLKpY~2AbG1;bM&UsCX(Ss!vELdf5Ghc6g|$!^-NL zjvwr6px1Rfy8L`=zKqFe)|rhWC5*5e1w%fXd{^og`4Bx?t3^T9@-q+G##y=3-byo* z1MuX2Bam=#2y5v!sD0nUWXE8__F{bAj%Te<-Epdh9+&{^c*k*ZE;f%<(`dJvAw!Ix z&FYr$y=ZoJ&_bHE@DT)Z_8Ir~j>(XK&H_OxgK^rO>A`XsUn8J}pjkJ3Kf(hy@+hff zZf5aI)O4HsXD%yzRG+_in9y>DZy}v8w7i zO2cc0)O_}bNSK5n7XLI6 zSWN&1Ahg~A$kc3jVsv=d4yMl0;frfwO-ZUb#l*;n$d0m%)xT~KphH$~T$jj${IK0} z?RTw81O)?W8C$W!BZ$v9%x9`2BwVPyoZp~K0T*=_IgZf| zD>T>csk)Fp6DVe?z+ays5Yw0(Zmy>;C`edPV~r;Tzbtia@`7yp0U^ykFqG27#aq9B z`9ylSs;;Wps6`o^!k&`b2i*%A`RYMtl+ODZ5&7ow?;ml<8mrB>AjxpF-eibM*%)~7 zD3Dn*Bn9f;0W36ht`dd=4k=8Zs9o7IqwO^!1;xad|2wOszA^~+c6#WxkJRAPk=Bfs23V= zs~q0pg%yE;iISiLgTZ~A2&yz@@Fs}W>T;$NQj|srb|_2;*G=yl z&?e~tuC%{g7XdDbU+oG5I!Y0a9CZyIfI2k9{MTS-JPQag{$c3wkXTSVCE7G+BfCwS zQ65?}{cV$m-^gkWP`fGsebL7UH<$L^_9M4B*EcsnBOJVe ztKt;#>FV;*? zRzm^D-xs$D$`rN}Zk2?g(uS)Iu=~3$=#TVk9Gy3WP-)o=AzR~IR{G@@FU!0>LEnt3y^|_6 zAz^oCC!7P9jW5T%u(6WxLQuz~v+W#Ko5swy3-1#pq*gkFf*S}rW|wGFS6O*9LP7jQ z0Cz{|2N&Ju@4mx%;t1`4cwRPiAM(eYw$?UF88;d~X>2I7Ed(H$Ja7a3lboDnA6}(0 zy?m81K3+F=-W=Q-som=@RNTnr<&{6OZg%!qlj^BSSumKUrUwvJm))B#o8xOb zMvILpw?Jhcg0GSVe@F-5Ou$(sS)%vg=Ir!zvsZnXLI#B}{J)<*SeOd!6Xu7K2bCLz z9t0N>Ml_1|0)-ui=tke85P+G*smPMlN9u)9s6i8)pB@Wyy56pBv|6WUZ}eHOH2w(7 zNgfJQ10eLEUQNk*DF9g${vQnOAB6TF1LwLF;d=*K4>@$Ffss=x)B5ThxqNJb31WVzJI^hGf12S zRZ5T|{bZ9SzDzvu=4TyVpVkoFzk`%;A^_8Ev)7`hBIXXC zgA**2T6^W<^&lsm8kWOMFu0#?ql0N{vKZ6Su2=t zFI7-P`66=fqzwBKuKlwn1GY{*h_TgXScy|-oe<@7AR-u3EtaNH{vDqx8~C>pjF>G4 zg|g(zV_3(hf2(~$G1Wo*f0tdtNd#5JNfP7uq}dimRQG`Q`vi^&+rq@g9J7%Fv2!Yc zWW=EIvZd1QHf6-k$da}naQbQ;BxkwHXK}EG+bEA=(Jy~AAv8h4y8LDHr0oNh^(T6NTZYY9z zE~Au|R7|d1Ihu#qD+}FXxE?1*!q62fF|w3`2qw< z0gLH$W`#a9>U?vE2~AeQ4l_DiM?qllY+5g-JWP?mv)Mg6Vy{2NpGulK8-j7w`#Dlf zP*A`)OooHqQehk$0*elXnr%_5EPLS?3!%Rc<%sS+LxG)xLi|EPsYpBrUz_wmG(Lr4 z(-lzQ1Guwy+2QRC#6ZJ{KlaG&{>MoTI4pe}39{_;?Aa7_R)-3q(kbcv+imW@iy1m4 zC}s7i4H~giep!lfykwer>mHI$^20#mKJe}u$P7{xP&_YY3J*#tycL0(%$+0Uu@$}FMt>fz-$ItDt1-fCJM zT00Mxo6C5OpV@=;Jzo2Eq_Jk~ab`*+2cp?XV%ZPpkJ(c9RkRurZ>DpXsiPa72_3kr ztpfSZ-cAEz|K6k>MF?4q=?|8J80ZuQ#iW(1y*@6jJj^59Bw;R$9F>-b`l$SR;>k2? zq{dfZ!N>ai%G5E6Ki&JZCL%DpkjSlJGeWFNyN2vq%2?NxTg+#Qol!DB6F-&wVVf#jAtAIjbC4F3L@7bOvI zx@i$5=MJVA8)pnK*~2p0_o*=Fb{DSc^^joW`GdC;CHX{xqf3W}8TEj8RYii5Fw|^K z5QQCh-*URcxS!>=o=<_wAMfa7+0fblYmCUkon_>_-!fc9-Dto3+&Aq5@hh~89`{KDI-Gs7>MlxNg)vZC2xr~(=b2eip z?L|_Kk!A(eS66J2iPzenUMyT)!CnaNku-Sbdh$;u2)SOOO>_lfgM=zTB&2&2zvu5e zxQC?omH=WjFwM`2{l8sh*X*7BuCG7lHBi9cS?Y>RP1tzWGQ@a!i&9fFGqbW3OO)fK z$n!oId}pGlCq#{OwsV7eWv=m(Dp!b-!Z?ksv6Sq^!LLnX)zsZ~!4aWIKYVoL9@wCE z>AFUObCq4pqC|bD8meCTe%1*o8MH1^fgh}kw7_WjrQ-Ae6_&|NAjg5OJtaCS6z8t6 z(3`F$Wz0GB9Fclc9OGsRLU*3sp20tOY)whM>xnNSOSTw2!AVAs?yax9i!f`N(UPh} z^V4|>56N8mJfuob9L_Bn?w4{TRBr{A>l3p1cQT|`HLrJ(8gFqA=m8JLlUMUm;9{bM!x0e2<&Q=fDX22qf0=DmaHU42_I_=o8jI_1s^Zom}pyagl3KN zIOKkXE;|N683)LXT8-cN&@EGBDK!`X&Ep75yqSkf6f?;$$7NB~HD8GrqUlf{ivlv1 zuF#Ugu~fbMnG@utC1NhZn0)0jpkJxjc6ubu!;n2o97}GX=Ob9M+hrt0r)Y2mtla3qpkyx*->f`{dyGE=oxn z1x!Vhq!n^v|9xdJuh)Ex_*3xTju<$wwAF6Wpt_3|>4c74hDtcVhd)HfjMLFg9o?$h z^HBakozz4A7-9v_SVvJ>vpMxg+fw+U5^m!Kls~qk$YGiL@a(*g3RZ;&%W;U?&^fND zZ{2GY41`EU=e(`0`mgcbGYFU-P}y>F-X>2!>JFn3DN_jk8u#ecWH6A^NAdcmMm-ZO zz)X#TU|?Z7Z-7Qz>!G&s&E&~hqPN&pM$=V3x?wew0p|idDq^R3F@9s5MAne}PGNVD z#)PMLXwMo#7~SB_W%5w0DMqFVK)t7eyV`$S)$UHPj@K_Me3htQQ-3{lP5p)qfseL(47SrmXM!meGhin5} z=o&)&a@emLt4y;sDtky#>7l?Z&&W9oB-l8 zVUmpH#i=PN)s;oy4G|Lc#}d#Tv+YR3 zF`puhrPdi|^8~Xm-6ZVagwR5~d~@KQ#`x{L4Y#)e49M+zS8~PsC5R-}ncy`@W_@xw zOHn7?;$9t={D7^gURF*{V<(ady|DQ?2Ezfz-c}D)RvQ}!?kDtk5s@bWIjxK_!9~WA3?=15~FN7 z46yfF*ZZEQac2RS$CGHJpOqU>j?SEh8oo}-9g8TI=j8Gk${>e!HwO40bn3_;qu_W6 ziuj4q)sWfpJq(P0^7f<3wG@9PNuM%Q*Z%jmNMZ`+QSj)^Sqi>3Gi z$t;{;#c}fls#tW=6xL615FfsL1xtM4{sIkXoenY_$B(ulvAB!E-D0179vYz)5l}^$ z{S5vV!C2e_VNOn^Z>}ntrCnVBV7#-xFD)$%_&)U7si>$qySgSPCf+?f0QsC2%gY{~ zo^a~4jEoBw4FFcclWC)`zZHz7tHov|ObNKARcm6YHKnEDHd<>Y&NzY4;GoOY&;Xb) zGBT2$oyJ*2=frva?d`+5@5ac;Okdwe%EG3m31G0K@oaH@b@g<6pM#lM-^OM< zgs9?gF<`9sm5GU*yzlhUe!G*<^R#AbEB1`n1yBf7+(r|`46b;RwQ5X(AiDyeolWYk zSKj`@S^!`n0Z&3|qKek{08S1%zSGyI8(_Qu*j1{ua4g32^*SKo{^R-1=HZ|!fVCqd zM_1R^%ScP}>KkL=VYwc~b=F+z(^{SY&@wzF>L+MjSu}pKFS2A`LMc2#*-_%t_2SB2 zPt67fYTmW$uDj9>?eO$qPO)CYjJN!GbEj%l2qLM|4t*?g0n;b|X5K;pk}HAfBK&SO zZa$g8&y9cQ99`BuPUw;4|J1dhE!fsvZ1iqP?p#Ayq7qvAcouIkpd7kZ13!Byl;Br;jIAXfj~eV;0Tg1I}0QkKEAxz zva{s!yLx?h2+Pd;n})nl{{Co)hKA-W4gUjh9I;ud4Gyw!B1Fe8@7NeX+A*}^0*}$t zaoDbpk|hEdS-&6)OLu+i_IB>rkH*ENr7dAG+v{84;P5xlOu1-jrPr2Qy_W@X2vNH9E47<2$$_joy0pWsX%InXru)+qAb2052By*qb=KE?-3~I>+FTC~ zurheOTMvA00x;TNuW9>#BHxhkdo7ajPyjPRu%GJ;2jqVI`00qaLydq@B)4x1q7?jC%lzXMSJ zBWP~ibnxL}adC0y7sNduD#|O|_)pi`kclqg^qd0%Yinz_5q|mIpDvAnbPN6X-n-$E zd+Ct^c}*-de_jkNJ`PUhU9`V2EX`vD03_ zS8SE}?WA7Ak3Z*1;w3^{N~*DjZ)I%`6<#GM_-^V&fOF)XKf{nHurCZMaP$h^~;u7{f8^J=4{3C&ggXiHGO?4NibapDc2nTWL(NZ6*4BD2?RJKOuxs6s)8Nu<$gOLRnQiY|9Q+QkEOIYRki;7`Z z-Vc^tzF!DKXRgqJ1hq2RdrpH_rh^9 z;R-sK`@D7FaHHL14>sA13!NRM(IZ5?6;2Y^YUztk=8lY4Ym%v zAF&t@oRmsp6VYvMrOh9tX7kmM_h%84*`uRm$BL8@7DGxbRw#>))Hk@zu}agX>G|~1 zKE3R}zVfMltA{aHxwiqot6zhUF zsyZu6r$2-;CDapl=hKed9>kOozJr%AByBqGoimpT4F)n_yx$;mzj+S7a|VzZ09f>a z5%kLPcX$2Y{6j)uYIW<*I=td)8g}@)e~*(%_Jgxm>>@F76Jt3!9naFz=ger4ax@CI z1%VNdSEaRFfB-gftd#K9_6A({7orSxe>V+@@U5;rjRfm03=i3=mbFl+&udK3_g*${ za2@bN8{FPHL{polJk#PvhMWwlwsT2Vm$V}{&&x!2n{FQ!FouRCSF7Z0%^UAjU)nKv z1Jaq}CbZy#BPev#k>@HtuI8S!Pl9Y&iq{4EMhBbG54X3yLLup+OMSu8Bjq?+oqW^v z?f9tO#{HI<7zDxcG_3J(>;+PH@cSd1bbx2nCpfsir!d#-M6Qukt-yDTWN|Aie0jz@ zgp1=6A=UdE+zw;cmz&q7s=$U5Cpyz6e`%+U2^Mg%+4xT63ABp?qi~&eNQ(&bL^n6 zbHF{uf%@X=Y$P*})7{Mj5Uks!UJ5&OK4~|9K}Rna+sWSm&<%4uy)yVJTz z!ep;|x!vgJ<`(TEZ$H%If4oZ^h2d^-mz9k~M2u`Nw)e4IW@8F(^LA07QeaYsQ_8qn zs{3P!`P)y`K(ElmBse&@e2R8>R@ovKwRdrST}WLjTnvggG(23K2!)KDpC1hmOI`x$ zIb2Vo8QIo++;4*WZ(z{9el7bD(WfI-0ox0l$;KF#N<}qOEM#g!Lx{`J$DrOffB(nc z-sw10IY_n0Bs2ZDYx!9P3kzJWz`T7AWF&-NA?o0$-vdpIpFa|$=_-6O-8!~2Z-z!h zyrT&eNumv~%eE5{2I34RUm|pKq;XPH+1VSQ{xV&^?V|rZ33})<$HNPd0fM3xe=7(o zvuYuSC1hrbydkdhw{w8d_#x5`;r~#ofQ6>CB4K*eAcjx;dF??QK4a5?d^d-Mb6ydA zD@|_=qWN=~4an=BdbFGIPw==@D3lM2a>@&Z+Un1zfbNZ9BewxnsmaCTO^ExctlRb8 zd9AIx~(f85E z%dmwnVs|SXP6{iID4unto~S1crJe=~ylOKXglgrS?UGiI; zg*k>^-`c_;SI+|}wgCqjCW;Wi{EI>+Cc09%GZ)npBrb01w|JQuI9#k`Mh?jQcf5Ef#>dSye=x6H ziH0~+v(Q`%nSMhKqQE80R&kcCzm;>RG;=ulY5&J`9%&_ntw0Uwv7m7$E1K>!`0Ez+ zNEuO=J!Z=KK7PTyj8$E;GEv$}plhe5h|IKuu;j*Nua}*iTBpl6zmC!>-#%th4YIjg zF}otb#Tyuq=x~(J*4WpiB&C1^qJCrWU4DK&f+<>~MTYUg-`AAJ0OMqH zhFs8jBSl*34D9u+v&=7#=K&LqL!2q|A}j-VPd)y+8|e-hxgaEqlk9WCsfJsbd9!-a z$ezAZ6z2`}e6X(JXHUSZ#vXen#2Jpf!x3J3iCu)dL8PEG_NOM=6)_Y#mXE2asqZ@k zYYs6wwtaez4!h-Lh*KmBMC>rlc}z_#jf+qAB_Xlp2Xs%aS-XD~5y7>1EVripm=9|K_J(D=W^ zED=Kbn~?yux4&5~<19#9gjJ2v32EF*$nezwC=MXIG8aHUCl**fG*o(LJn0^1Njkp6 z1Vor%B{At?p$>9$M|=LZb;86Fh@2_=DWy!hnEw>MUuuTqso)fEM&hq`XF(#2#%Ssc zW9)*-9?2tqRMf2rdlKkhA)-8*Xu7o+{2V*<6#A+o+qo`_sWHjPB;ZO?jiO>qusX}j zV~I6?`z-_dUuSSU2jcH}wylZsH-|*|@lyCn%j$f-$eIhUAp2O^e@L__zH8 zLIYEv{a);88vQIgzL0F6U7 zNky(_DfK65*Kcg-EgkKZV-d%;dby66fkc5J`rjevwgK~jS?3gOw+`y>3uA6YBVF3# zFRmG)_c)pSdb{q*)tP4ulsT1q#=`#r>^EYG?46y06z{8-3bzhVv=w0{somIkh#f0xU75{1J8UI>!4 zcm}eKBX{$d#{i6D-rfF>g}ji_$axLiqr})A2DaE5EyDkKhmT7~S5dH$<6bmTu#G(D z8y>4>e`_i%Wt%Elsqz}A^5Rz(g0-*XM*cgs!1eY2b7cYj?Z0aY?tizyzHESi=e(}& z_wU`^B{M~U4R)0+6EK37c7uH=cxPo%xweP`D^SELmnCW zimIx6!$(yVLAtw3TDn1zkWT4Fy1PNTL8QC8yFt3UySuyLO#OZ1e{s$k=kBbl?Z7?O z+H0*j=R2SG39u4P?W0GFPK}RqvazvoGyaZN>%o3;eO)K|RWFE8rnj(Q zo&?Wn1WQX-mqbzQ-{ZmiGd@1fGGLh+y;bPpOIQ4e_TOCce}C5hKTK9Ut_g<9goulL z0p#}rC~&awfdK)F^jNsq=n`2oKsgZ%_%b(Q=;*NmD0?hpi;rFb0liPiQDAlitWn~> z?;`lZ-&ruhaH@YDs9?h@v~Fk6o&#fj-#zEke1ua{n5RxG%ZkHS3P06+#-4T^?-Lyn z^Me!oH(l13r;&xlC)nHD0hmM9nvs;*cBVvKS6BC><>B~vsWCsT(Pn43(qM#+mKN|u z&L?_z^XASr9uN*wQ^sWSDjIXyI63t%wrL-3P8{s)mTE0DwPhkkI9Ajf9pK;)%hzUYC3-jWq=gDpN(0;^IDVb6m5v)eeBAxD3dMNdY=dtTi>G#Hy-| zV4H5VRFq`)cZv`&F9^IoTrjY(Ai%+KxGuT??7z|Rc~NMKs=$Z{q_??E89J7ZKEbv2 zODYnoE^4lieUZ5!sf4q!AyQ5@)%|`iMnS^Vl%}?>IN3}^#aZwBl*>u0rkpAc7MdAo zlD~pU$WvZ&hjv>Q1wR&nDG+?Q&F!m$!_9k> z>CVn>;Qt8pM&`41RtE~1z&@dLuGro+X;Nut_%6kY6UX)L{KHpd1+Wf-bFL0+fs{<7 z=if<1-(30m_4Kl3rLM0>$Hugs7frWPaac_q_qG)G_xD@3*#QSeglYfi$Y#2WjF~&+ zQOUszjh0?rS*59>$x_cr#{Av?uHONDVqyZ*&eY5dIA2+1$n-8J*{-Gt!1atnjQ^4cpv!(|hWGxnW@67+Z(@AKw7%_^^{p4#FG}bR?od&MEF6i|y zTFEaEHx(Y7@h?0Bizd5cE6UqX2Z5xmQSI4x^@T1;si`xD%w}dsDo3}Ej|S%4$&$hn zve5-tzpE;&W!T&{b?0vqw$%w!jjf7=*AIDq}7$5`mddrQb4*RX} zigOWir>@mm%(|-it#tVZh_6?45yq(H6DDQ^W0ji;Bb_rHzEP-xL(aHG`A5N|=SwE;595@8gn_@vyM8 z8xCprE6@SFgIUGQA&`bmnbZu85wwY&q>%{ zT~t)m+?`T?j#fq6OZRG#-3?y# z^(J4-2(WffG+kIPUC@LY^i_Z*h1lkmJUF~z3~ z&(jmrrps6^ujTW;yIK;Nd%es*C+5(rCz|Fk_w=d|&j&Ss6nSj$t0f;RC1RDP2d00v zE~5uLp7{k6+;3CsQlBI+N|;a?R^ZaVC>y0Tn`rOkRINGiv&g*DgOO_%P4w%A6zwa` zJ0bTL-GT_neG)r)RjtCqol&Y6-UWN*_Vm=|JGs=G+6yhu`gjio4Y&36$iyDl9?yVc z=;^+#jYuDtW|ACfyP~6W&exVc6IZ9Pg#ERb#ol zRln7&GfRL9{ZXc+p#j`Fv60@ou5kY4WH9^k@bKhQ=7X{(b%%K%Pf+&vXeC$_fq{@s zs(av42wJGb$oubM4QMlZF&5_i4^C?1Il&^&%?ZEj6XY0M1(YIICDSVlVOlCOx}EUj z?GOm+w)0by654e#%#GGKww}5Q->Q4w3$C#hPCX{K1Ra!_sk#V%`9dU+QCiwso*yW5 zxi~i$nEV@{U-h}Qr9>;6q6d}H46Txlw@MCekut}8I8-jy4QtW+>o9UmsV;bYQa?3$ev8U7SCDf55GFwM z`ZTMXJow)Eof%usu^!kf^D43$O7Ji$d6*7ZQwOrF zZ1r5^^&ZN5f43^1i0pXWhh3=LFkf@AIFQx%8}6cp6s9lg7@!O7{qN$C;L&Qeg^{PBbk4#xus6R;v> zVdZt5?}m)|l^9!FS2wvl)`s?7V_9u=i+TXK_{2Uw0U)^7YxC3vl*y6J`N+bw61M`lOvZ~(B=ATdiMIIjE3Bi@xC@n!#Q^SafU87)Q zi>3lyiLc=Ukf4B$+S7aZ)5!dItmKfeP&fpH%-mJ1q#!@P?x-l#NnFKW(Mg^l5qeo1 zR}8Q;i+t(bHB5nu8CRt+CsfmE;Y>nWK>@y4M#Cp5weHptKFQy+xV^oDgKty`6E4baA0t=?VhZah=`Syh@q09yu2+x z{~KjGosD%UjST^#`Gv1v`FE387L6XG;^O4x)o_up`j&xWL`O$=mTLuFnho9Xk18vm zB8mOn!MG7MRKf&8=2{GW1z8mpRYhS127ATt>guYhiP6atE@2_?cZo4E_Mm+OVzWTi zF*(VMjf#VajxNO1-Ho=x7;aR(wY3G{r9qwMgf*U|&tKbo8XEbC7S&+b*ly;eDhtzB z>mrM#Qf%$*w>LGLwZDFa7{TTPJo8U7U5o9+9AsN^x(~>Tqra-mpc#GMY@yg(%Avb_ zRhS&j6Brm6 z+4M5{u8&*0rTbkMdbH0=eieR(D>?y<};jNiX36+aS4qCcjx`YI0aDQ^|e20c%Z*Ho0WX{qdPWmo8Y z8pXPN^S-Z*$(&gp#OzkB$?P0zL67on!q~iD;%~W_?&I@#xJ+$wvTinc^bE$LXopE* zhPz#2c-bIwT5y%UzR%`6ujs1PsGQ%6d~BPWeK{{Fb}^nBflu<7VW4V|f9h!FRc($8 zf47t1zuBsXQNBbmM^$0jtm^euZI5+jQZpXX^#(5yoMn=vRH=jmrI29G)=;9K-o7UW zOAkSl<{Byw(XV| z$J+~SwXKjCJ$d{r77vruZly((m4WY&X{=4xK~gPyE66ZBOW7{X&ejtbFDeW+X<1`| z&DVjOf8Pw)Y8^KWo$)NvC>of+6#o<-S!s-;3R1S6I({=97fLaxyJ>7MCOS+~GDI_5 zwyh+tW!LqZhR-VQqgBv5M%$KFA`wJJjq6eDID$SZ_N2)w`Hy12o$QdDfdT0V67A=0 zJH%vhF$e_z*nfPy3`7HQhy#n&Krsz0XHNrj^wD-cd{>f(eVwpT-0}1(bu~(d|Ie!q zlb^A;5MokN{!)mpf8sZ5M8rim1Tt)k2YV!oQMt(L!%G9To_!G{r_X3pebHCv z*Rp$eqnI-@b6xQ#RrFednIuH}?V6e&0~R7!s(7;9RIL|=C$Ay)k_r5#Q-@4t<}D%O z5>-jba!-}CM{W?HV40>8FAaxYJO5u(t4ZE@#WQ3IwV6>RCMgp=-Ozy zFokGz?$jR?eVMB)r>57G7AC?LHYnDuW3Ug1jjJeC1r7T57reGhhx~e0ot9HvOmQsCnBxy)MHk_EHT2jCxwS^E zC-V0<=ri4DU$UO}9D^hr?<uT)^SdNh3)##)#3NxJKaH?U@0JY9m!mY%lJR#?w#;gybRG6X4TA2{kb$XdOsq2JWn%#_@h9&v5NG>|iT z5BO^rWn`TD9dQ_&a-Wj&n&t9ZG&I58^v@iADNCS4Dk`ryXI=65MPY7zxf%ou52wCy zbGUo>GgEV;zU4Kw%5HqVrY-@>jqA6b?ZMZPm+--t3LBHxZ2XCu*OY5wB3NdhwFnp0 z?@9pu2S}2b892NcriO+>>G4`&+!qT!5&5;f7ZEl7;3w70!oY~k(wh(v@J;WP(g%m5 zWeGZT+@h+LT8|eFP0b=5(2B_Gsj9MVu_v5+kAUx!aDl6x4TwHQrludMsMZ_bb^rMQ zV-wt8y8f=^y>!#-pl2)`yu^p7-VfBsYH;ju1ZZ{eagkuT3G4ew@utAGc_B$r<7m$rta99vS`eqC)X_v_r9}%XUvt<2!OY^RxorwNlyChWg}D^Q{_sBrfr8kqcJ$ zXZvBv4xBUxDpsl{btJ6=7}wb(jq0WsGxX)qP1mC z_~np>8{RJqAtx%!AHNdwhWbf zUl^3c95F>0uBD0&b`1YJ6i5M@_wOhI=*_=l6TTv259>Gc@Ziw!FMU&UkOIWkk?{Vh z>65x7_z#<6dO~bphXt2-BI2=}i~<9S6cn<4rPpX2WmnZaX?#z_6Ps4rakHgb>CNw? z%*fBOvNUzwr-Q>@`Ze+WL?LlgArf;+mYX|WZwPNMzC>6^D4x<8C*2EN1VZ%S0ff&E zg3EXAX8J9%jmt(VdVEorE>eYc#=RxSZVTMh?3HHQ$Fre?^cM~FGje9noj0L|5_8dWzFgB6gRod{dzWY`QQp02 ziv`KbEjsos_hcJYY~gy#8BJD~DD_tos7`b2OVmOvd~DQ3yF{o|y3!19v^|U1#NYVG zUbL^%4-6*#ma|<^ib&6kKem?ap|9;CIHfrum{JWXvG6OuVdBk7OioB7I61;9EW|FP zoGHL2ua447O18JuB6=!nML}7_1V+|IORy$|XqTO^fLqxlGdF}OXJ@ET@?;zi~-Hr)Q z?iLjn=Dr%9w>tpF-cdI*M^{qQdIk9El^lc{gmbf{$|G8Nd{RbCzsuwtU?~_)%%_V}*a^|{Bia%*!l&i&%~(RWce_VIkw32DAcJOQ~3yOvMXw_f&P3v=+_x_q~DuFdImq`jYv@9^ux=d zA_wUkSe)!Qc&e<*du|?yxJebr!e1hMB4xDEXb=eG^QZ|54$j3#B@JYdUQQJCsLHAn zmNduLO&cz3N%*0Uz9nFH|A`0hL5F^_#fL+NnC2sU+&){R+{Dz>l>Cx@Qb?#*;-|_& ztmu~e{ahpe-A(**;v}8tK@~-l~qtHcIOH zk@lZ>E3Vj9PPlZ9J}vL6>X2c73ov{}u0GkA8wY7QpIEvNlQ3*o?oVP(M1c@H{qP zX2CPI;h3?|XG}<}Rg^7a@o{`8s2Bjdiw+7t(YxvwhY8nbhY4-9Llv6rarZIG3PMw# z?Gmru#Iyy8HO;9r;L9T-#uP|Mdf#r{Ex)Wni2jsA#^JBr?m(baea@~S?kHt?_wHR= zthZD$=hpf@$nbVuTNlK&lr%`*jl55Zss_ zi<||?EsU+FLXUkGjZMgfl$r@~$5q^E_d_=>PdpR`J7owAo%wV13+yEAK>(0nI!n`Q zGD^@Rn4cWw7~^49?JpJ)BGsDP3KxDbCT zE-U*aF8uoS>q(6+RG-wa4@EUK_DB&(;K5FQ^NUw+axBj%_+SsPv_1t8>(<;1VtbH) zz~b%>pQsY9d5v9Ei2`%jxUEIB)ST*H7Ve3zBIRa;0@L<9#j za|lcC^e}veU;0O0-Zs#-12Jcnh18^^Sq(Xm*4`Y22<_pvg ziDT2w@XRdUy1{w-sjj$B<7>=`s|{J}B}D}-Awl@9Sus5hWUiLPiAIKlGXy3UM`av2 z&Ie~Tx{c0nT<4F5RN*nN3`ivy4G+IY>M|L}`d*%l>^uw2SgI)MGN#^Cm9)8A>!ALA z3*l`|OSkJP#~f}R=5+PVS;uJPaM08&bzAuLLaW_&{fusLaAU%59zF5rtNWAv)W`4~ z7W#tFT9ZRs{{xd&W5bBQT^LI?rLn0o!P592r?F|ox6+R04ss)t_%juX2)QuS$o28X zc@-7LC(AsIH;0roR1LVu=VyL!ry&jZkRil4Y-a5N*1=YSRWeOtA0nl7YLS{tg>zN! z3TYNC;q+53Ltt+|_z{>20*Y=EGg>VMp3aizz19z}2CVs!j|b7syM>w8*LO)=?*%`= z!DW6-ckhs@{mv;96KzF>Bu1^P0NKPC7u{O;QFE-S&Ad|?4?Fn~d$i^%%kPj(znX~1*VV1FxEJp)4kblZ>FH=kXz7M%2dPpRhfx{s4t4sxV^0h^yZ60Z=+Z};+zY|T!Gsv1n3L}0_tfpuBIL;Cte_l= zNbD1B$uPLi{;Ygl(B$~>X{#gtcj-5Q&9&m&*Km5s&l)r16!sLYT1hp>w#(B@U5R+X zOBspxeiZt4Ob*e}1Ia|h#MabrB-R>}!>e2fXBW48f&;j-iVVqqLQ5^Kw;yJFInnz1 z`-Jp=wO@pP1R7}7{yU(kk^id*>-~!YI)zap|5p`)qOAH)0DeS$_1|t3=%oEWyLfN@ z-lczk`#T-{`{aWL@@D^iq6YK?a1V((A0OM}>|H^BjP69w-OwIuCDHQq1FQM{-5y&;uIeI9hR+toS{eRU-Qrp zVF<|BHBPxsvhlBwaSko3XlY47v88?j2tw28dho$asb-`7(&Azg zAaWNNZ{z?mw#70?Q4aSwj~pMD7cxRZt&Z+clbPbm zvNB9e%&hp4dK+6EW8>@N#uF7~#iaLVpCp^s}RKU2v&YL^BV!_(|!Sb$02j*CUe z$k13U){PBGSm+oTnm#U_;9JP%D;*#2IX#~B07Fc0fAQTe%X4zb6~>=mZckp+m3em# z9u6x<7?7ccxbCgb4313;f_vB~Ko zB2zdT5+qQC^PLHRD+Y3s8uO)o>>9U|ryDgjb>Im=;C3maBnb%G3SVY-frZ~m>T`2& zaBxL&V`I+%eXG~dX|lu0)%7(#F7D%1sfStB&~8&|Dxl`KJ}unPYc!FDm;8O(kJ%d< zU4T^Ol75u@J4k+*I$7D;${rjHVSv(BxnbuJDs~1(~*hPGbz~J!Os)}|6P)Lu>y!Yw2-^@>ayv#jda}CMg_GU48 zzFKJke4Y;@&f9YafB-Z9*&&Vc1NA*SWM6V$sz09;e2Db;f!W9L`d9YBovt}Ny zkEVYeB`*4sT1H%*unZ_Cum-21fW`TCcLNS543FtMHfe6w<92PUnW-ta&^?y0~5!V>^u}%{`KUd|;&Ltqk?YN5gUL?m7(K{rvh&d$aX%iXJ2g z@bS!cJsdBg{O!-PA;)2!j#pLJUT6S;Nvj{-4?X?mIJD}j#r)S=@7q0XLJTn>s5#9{ zRORJEWL{B^S^3h&CmQ_tu^d#tS;N4_7p}V#<_Kvq;$0)Jto+yE-wqE5)jn;x?e%^d zbOrB=+CVgmk`?dcE=jQh%+B8jtLd>33f>AVvjxAUJV2sYx({a%7^5L!y6B44G`FxY z;2f|E!!=;<%!8v8`&6 zfX62pf=PXJh==&3oRY|Aw{NRu`Nco?a0aw7VrugJaCYQ#{JFe@6Tmbm*1o;R`TrC03N{G9|ssfZV_i^Yhz=>CFaJ; zAJ|ZT3Pbw)?QCQG4^qHq1&;7ZV?#Q4aq(k;7vIuu(xCraa1=;=J`?_jJt+OHNy>;L z{J%rfVSTtb^(TvItzz)7c$|o)eyopPS}OC$=|5b2#CR+SNq+G-E8}ZDzzO+v^+?X< z9T4#MyBQYS-n7=Ci-!Ud;*wk2TR^oXASkS;I0Ghq+4iz>5f+}z%rYAlXHF>ru|jet zYOdC_&zVLb8^~CpFruZ!T_Gk~QG8@@6hXCEwU&;8qE;k3C^YzFfA8pUUsPsq_-T0{hhqw(n!_@K#@lCh4=ITjXf zLkQ}{-TsM*%9ix>;$j{$meA&1r}1&?mp^~3Y%T_3=`S8@t7^s}j`mt>N_dHg%BzY( z+7#s#tZ2MDI%XoN>Z{Gq^ihxi0Y-t;n!rcc86@WX5cCrk>Y*TS{S0l~L!pJXA2a>z z*;Y9`ytKpvwoR3lHek8C%gx-tqPI8!wqseFS-p9AnLXlc7IXYtJM#?<7w+yL0G;YP zlN9_*NJx-Rnvb9FnUnS zC5RHKDdS!PVkdlj_zA^1QI|)U0peKxry0Hff4tetFA%>Ty{)se0&rX zE*75RDh|ifG(fHLhW^m9I65mYqikex@~6em&z~dX=g&VNTb-W16lCO>EZ;ZGadgw) z%(5_Yu+Rp51DJtQL_jY@{@e1L$*HL?DP=fcpd5$Tm|3r{5VCS|+8{wlPN9kM8iP{E zr)4dZHYzz88D%*+98ksqpq-b&voE{0G__a@+E-BU`SojKyWoawUx{6U;KANqLof@e zso|RJ9~=nxbZg1X>Jl;&rKdl6dw*gok^qYrrqBNV0m!kYrY_{D;gzR;E=d5&xHx8Py!;G;e#Y`N0R2MU2029E!5SY z0LgIZ%^L_TK8Q>LD0FqK>xI?5Ei+w{#NP?y3o{PeA(4rVssLz6%*xINaGW)ACn7O1 zm@EE{${*hYknaR&#)>OZRH#&Gfowtag*shElk!cH5HWj;mL`j^TF})v(^yyw*PoXXXjheKE6M#1qJ({=?=0W{UyYsQlW?s_xFj( zEAsNb6)RM(JwEd1zZMXel#qa~1jFTDHj1rCnMl+W(L-0#MPi_4oIH!mzS4i^+Y_v zg@J+4`8?CbnjZGb1rhD0*~yuHyq&q8 zPpvzu!$!8M8CWi(N)n*$a$%_iIY%u1V)<>nuw z>`wcrSiO=9v!oOhJ)Pa0T#ZQ=SJe(>sYyx9wPl^MXgD|~rlzj#`<<#5tzB6&CXgb} z@cP5QOER?g5#drMBc2v-@E)+ z0j(h-DoKu{lbGYC2iIECR8Iu0n5(6)gJuTHqb8%@O0BBSq<(N=5)%h2rP75aY3YWe z=OFHFAjvh-;nWKA9sy4_$E}#T(cQG)FGQLnV?^JbR=wW%Q4A8o<)H^>I+rx}BU4k! z@y`BP*&lh2ainNPd8&){s2EY*Eyq%=5l!}z3M1=ldd&JGjwm?Z)qrqNK5kPo*lR|HPEy&EYadq`d z@_e{kTlMVBBDMYu7hBMN2Zz3raCF#ukk;#x2Ftp6OWIszL_+8`5HWsHoS-QhHkE|*T+l25v?trm;p!$R_^l)T;cdU-OxY2I+F}Uq@-cexk*{@ z#kiIb?RYZS1OX)_?i-A$$-$_PGQ&7MU3%*a3BlhQ$cITN8L%L8yCx??vZP^)va&XJ z%QMx;W#z2nZx1&L-r+D>MYhR$yx?;8PWeBIj3Fb%dy|93yTVy;M6$oX9J<5Qvhbpx z+x`%9QD^2@om85RlGX*J#yO=%RKz>bK0?Z!hT(DbdenKmxc7FVc{};dkS2OGt!;36 zJ0yAVOIO%fhv9OF3c^fFQ$Rd0k-v@UdoS@qMwU(AdLC36T; zlO-aqymPL)iNyklZ;SGWNc{}@hmj6)x$Mj+??`H zQ61*?j24%X6wu|I2kDaKu~|{5kO+KoZ@$$B0AeCdC9-j_w#PsWtsohhJmH!p`(2Y5 zVG*#Uoy2jEi52eduE7cjtB_+fkvrYIn$h%^Dfi2Y0?c8MlFY(ZyQ-$nut=dAT2nzX z?qq{tDQ1bZ)`GZobubgT^_%rO3kz&!ULEGm+c_2yn!9OLi{!BtzBbTHT}Sug7x5xP z0x$|dxeM9ypl~4ld?->~8L7Ec@9I3B?{ej2maAuj zK302Ddd(GMMg|D|kcB)k{h$drT#)ZImn#j}urjnMIw{5}uIi^tRD~%NVeMG8Ae+>{ z_!aHWib##sl#$WK3}23rdbFdS~_vW)YJ^KdrP&CiB|CEDC^vX|B4jFqSO zI-fd-$CsDe8Xu2pSBAfhoSvR8)>?Q7E3)YgD~ZhS20uSzdO|`%Y6nQu#l7tSf`8Hv zuOWU5WqMjS-z>X~R@cq4!+vsvU?>Crc5r_F>IMtfX1J8|NsJ^*Jk0`{I<|XzdqaK0 zZdX$?)^J7NG;hp|gRXwbICo?~+O(qz)EoeKzg@Ypv4M#Ats@A_NNTn8H0etLW;S0}4!9s*R&h7L&bln)ivr!Py8NS?xTm)2psutwRYlwWw)U%|SgZ~J&yeSN`X>|gW6WtG1Vor0aVuyD_5LOF~fSxv^T zvQMllRZceIrm&%NxF#91K>`3B^Fa$Nve$XLAk9)}*T5mTBpv<+GLt>!mO_RXRjI4Z z$L{U;SHy9^H>1(DGz|EKP5i4YV0Eo6u-h+NZwu7WG$f+C;mC&k6t-QA$4mmLQ(xI& z4!q>6t7|JC=YDN(2ig-)y|;&2I;6>gzb=^+Y33~Pb@&vmW7SV6jpg2c)}uj490Diz zp4n?XU*1j~8oHgN8$UXuI5>Eqt~n2dpQ$c6y^UYWf?mK!?u+GAfTyPwzM-_7>HyK| zj~@ad{<@uX*()2HsE48E47P2r2t}f!?C(9Rwvtp@os3pgD7b={v^39WER4EML;O%!CN>7a zjiAx)Zq(I=?LI!Zdzp*LxnRIP8$FT7CxaIKiDH-)qf1&VD>5^UZGM7DxQ$MUFK3ET z(wV8qbca+6^#?sJhB}k`lM#a&)N|h(w1Zh={p-jFe-od2F<3!jfK&dhH(S;?v7H5Y zkqs~~Xte95Izio6k)S*V;68=Ik5y@hx6YL&6)r$Qf|jQuyxQOG z#Mk1YE_85~eq|(bZPy``$jI2QbdeuFl9T%-g$_am2L<`O{%AAwA^3xlcQ}46J62#X zzfWe;{79Ao@QgP-F)Zy$P}dCSOLlk}3~}e>z#@dM&$MAg)~2PSrthGa+9Wn2I`iH@ zG&l|*^0VNj0W02;w|RWY7u+90LffyVH`>}jG=&@SVV7XVmwoRK+uOZNeWrncht-Y~ zF!^Kfo&^tY-inrF?}zZ*9PD>2`!CwB&7F7g_#&v0{W`tIDHP^GYIstTnzPZ#VJGB> zXbe+j1%SbN@uU?sd&U^z+B4So;-zwW=;`Rl$;eZ94&)8K;ik#v2Ows{ZFn9rV1##& z8lm{FEH9Vv2?A~SOzNNf{DIi7ag*(Q3?O8fLM2K{ILM00EPL)(r|f^5i{2*#K~X9~ zwT2(b`WnWDN=mA#IGaBWIhKmx8^8Vd@grMX5)!8FcRZYE7NNe@ECjws#(o<1Cwxa_ z=76fNlQ+^zNLg8RRZ)&#SYcsdN$G_Y6v&%i1Ea9e6e&20PoK7>5KV#lOH>Hy8>W^2 zpo~)d#R%rCk>NMMFJ-R8U0+{U3Y@?dZCfT{F3SUR*!a1%_+)TuLfY=zdloJ(|6DFo z(x^<5xbQ0hDOpESQsyWq{s8zMWL(@NgISD3M5aG$0)j$FyuDJUT}|rQU&%E-&AfHr z-mnQPk_6;%0qSuG8(~a{#_5r)zCj<)J(ENMAwPfL4OPV&J+j9@L|-2t0k_dyl_3SE zySpT*^8Y~lB6J0xLYN$641$qFoB=o?)LBRy427m|n0$mEKS54+sFy{3+VE7Hoi!@! z*LslI_tXj$`4-UgIm2;1jrS8Qw=g2qyzU|qYlJ*WF(f|V(@0H-; z4KigjL=r*0C)Ky=QtZM6TTE00R7t1#Pix*kC7)v>BEGP)jB9IMX+y#?>vdIiydoqh zV>=WXyz%MyGQXK|gzRa9|-gO(ZD(5?fr&RBR`x+5eA3+{EEx zk+xIR>)f22-??0XB=~?8DxwUnPEALb&gN=)$_=YX4KEy~A|er}_mPMJ$&Z?3ep0N}!^-&G?{=4q9u#(i`ts)XwjvXKd zdH=wA?;My@sCOnzWy!)}R;Vu~L&W#QfB&v7!8@zUhaR+7BA}_gqVpj@Ks7kPRb5#_ zqsSc3F36NlF8t^$uOVtWMrMxS*EBCDL*YKY#ZmGhPVyPBSm9Z*N%oerGt+e=VQLXE zTRtl;pgSs4$h~CBnqsjvRCQi^XET_EotTt8x46iEGin=XT&0ky*WBRXm6A+6^>w4t z%q?j7cFPj-#BSU#smoU-w)&<>Z}P?8ZZK?^z)TD}+#J4I_u#Nn2H(`Pa@bO7q zJCvG|u6XCodb&0$@m$@`0jTN>^rrj-jicInW?em45W0@85{yovcaI-Q5+_()-~49q z+*22T`1H#8$16+H=RORxWNn?*%c_!m5ntzQgZoXyPw8JLcYX4IShEFzzEdwQGg8Du z!EjmI?lygPbz)MfL^1BA=p-(Ors@hqiuAk#os90D=1%N5di+YHBAdK4-zN4FW47u? zLrh+r;xMXR^W*qSaYOIv&vA4HcFq)43AYM87+0&l{%G~xRgT>z#4yez=gx1KIHlgP z$=4d&82g#>%Wq>GB#|WWS8(!Iaus`HA1w4#7WfYf<-@g&!3dyfDcL*R5Skzb!X+mq zr6FGATP3c9vCb|Xp)_pN??T3+|(Rz4momq(P+s*iuz%FeLq9ojUt_C z&kOdh!n@ZjIU-s_nG7hJ#wo^W)%wpuA`1(t`#!}t;;$0?X{x6dwrX9 zadyTd3{S+!yk15DjmYpe_ACFlmv8q1hs)aO>6i;xq&C}F-nqFH4|*qq9TZF~sXu+b z-#701y=cIQhGwoi@%5wh^X61VhnoW{JcX(31}ur?N3;h zcu##P;VEf8(r6VEq2m~!5A?$_uBTa{Q3{?Y_er^4ug=PDS5q$JWM`vco=;XnOA&`L zeJw&v9w~NgR4`@zyfT$r{-rB)$9_PeEJB@_{|W+m^6g7;~RdPA9H5+q7~kUh4* z48bUwH&9YyLFtDEhU^rh=&^7^`+SrP%TK0~7WLrbykZZ=hBPkb#>_ISx@HfmmOB6L z*^F5`0SyOn?U6sTgI*eAG!X_LX}G;W?wRQQ`?mm$p~EbQUV{gYBixvXr~(Q4*0c)W zzrTlsj7a(=5ZlRbOhMjv&>;}@?D^W3Iw=6IZy6O6S6qukKes3e7u(;*FXDB;TmIOu zfhn*ZM* zo|3)zo{Kb*%=1lFJbB8WU*$##S+STtyPj<*D}TNbieDmlWayA_v{9Dqb7gaLGmQY&=>=nq>PM1rvyZUP1uElC zVOrW}A~w@+S}3Sgbi85m2C~W+OR5lHp$HEXDgtLyp_CNJ*A8+G_4IluI&1B0PkA8D zh({V_t)N^G();6;=d$K^#6s$IADM_5y*^ozd+F&hRZ|ClHWlhpL@|r1KZ}cjz9)B} ztB$_a+JF(e{q^?+%%Gt`zU6O*aTVG$X@NWNt$;@3A7zvn8miTKlm2=H>0MWeg;DRx zV*2LqmaErg&;$uHrtN%Z-_wl);Tq)TLUw)Brj(Le(mwE*1rQL6iim#!bt69EYP*=I z0XBPx8?p)_{5QA_Nm}_7#dm zU*4CXPf}9!budI60ma3%nnrO&cckxD5>+w#5)G}C>2i~AL@YLPJYq-Zg;+j2@EYO#;rt1S z@3wOHH6Mn(<1Fljd*Do%6rsnwGA0_*M3F%Q4M9{AvCy~I6(DjQWw|o~c^DW~meSMa z8g1-azLA9tlPC6Ju*zT;>Tf%zcD{yDiuzwC1}xB1i27NjzlAJ`F9y?D1lUxSmFw#p z+aR=GQf={&rG^Vd^iHGevFultaZjT^4+Izkfje@1-U%lGG{uAbxd zS5!(axBE$8F(@iJ@X_A>zG`T#!{6$tgCma6&o0PFZF+iIzJV<6l_KvYkSf&p$jeEk zutr${1-JWFB>yEvpo2c?FJwoY%&T`hZVY{^>#de+Zy;9Zs<^GZGA-?<2;Ok}LHPlL zQvQHpPA&k)-F?Aj)}GuvTK&8#f;z27dWaz;G@zT4^Y-Ugb7J5JM}M~DW9{PXgmepi zMm!i0jms+{`6*DDDMv1MFZ4O^z~=}l8BUIw%Ulu_=?oEMKFsdG1O)}0q+kGa`G3gz zkE??^V1@YT#eYcWgPD19S(#^jQ8s}YRH=Y02fL&#=>n}i+(i~=xyk@G-)%fA-cjqBjE%+R8$ye;d-rr!B{jJ! zj6<_h`3W~Mz4xV-$fqpKVk{^w9qI4eq9B7of&_K7J>I-7u@|j&TLzm>gR*{2uq5IURT(os z7hJ@5>(l^HJ^UZy%D*<(|7ND5U6@Z1sKriOGsUeh<=gS8yr<`vQYxwUGBeW-1}sDE zL7Q`k|C$vFms6j1tqZpD394IegDnEMUz838S`(;-(G*BW`~rHf%2{BTD)09zZ}|0( zOQeNvf)D0{z-b%s6gFKew)zNaT23#(*KQ0C#9C1mNI}bFQ>DJ5X>yd|+4KAI#rp{j z&ZOtG0h{--;dcrWgS(X&yRgqf9`%vpzxWxKkuaW+VCmzTxI60JbOsAJ~&LB zcw{(l8_?{&7%5F$-g>xJ6frw)8w}Au@?Tv_DX%;(>V5-Xm415eNxjrUe6AnAFi4y@ zoD=>o_56)q>c!{kQO+pmWsj2e?%lwB^971W>MhX$-`qQsl;`}4QYpVSKE-Y+KKf_t z3ee}`#vvvK^tWbo2z0e8-Bke}B(#MTWc5SR}aAwVifgul3q z^pRAW(bAsqPMlxMO`!R9xR>ZM#A5jQ3uSus*vRG{6f&D=$~-*_@3Xn*nwTfiP~(Qe zPUhpdND+*Y3mK!3+$R@pyEJmz7k}q@+SuN~PcEUshpV5x+(gh4Thezi;9_3VZ=`^! zh|$;QyfKq*ydzQ<7hZ0Xo>*1(!bvSYPqr)_z#HB8`Y-j4Q<0)|g;WkknjZ(kYoEy%{ zb1@O)kUEvW?;?q7?7S~rutTt65gyH8qO$zld_P1%4paGlBpDCxCiUPL_rqy???_S! zjoH&`SI){y-d**|@TB5M9!@S*u<|Zht7*7Q@W+c=;2AoBzl&?9R-$)q0^K zQK_f8gIT&;6pw1k^3$^ToQCw^6w`$rEe<(3hE?sAitR1nobS%YHFQ6dX6yIWQJ$=Z z`0o;3+aC0PF?Nu7dB%HX=EpIEjceYvX zFUE0wt65_mSvr!x$#psd*zq;?u@!xt+KKWA9j;}pc7v?8o)XuNmiD%*dm!ER$@5mS zKX}fKeYspG{yIy1oYBOq!Ln|-Dd8I`F5a|mw8bG+OZV7a;K{C4jip5Oo$@Q}vY%JQ z69jk`SY7MzrIG&aPgzxYg8T8ea({9z9|vNBOuUyIt`20BPA82zssaWNpN_oM@Ih0q z?pyLdT(X0`wxv51JDyi8)0^j)es10i{kG|@t^8(V0D&hR^)V8mi*=^mXWP_s!O~n?hUklvY1_>{k$sU&|_$~W_#h*RzBE8P%~}n$z5iuP-=9YJF?%xfc6c` zaI6>)4yqMyq6PJ-i6y;k+Hu0wddbw%6nNj6LTcu{v$yQF2IT1D;d=4)>}T&*kM*{5 zzWcjF!A#Wq!+60ejNsF~vkY0$IMn!_D1(I4l+UdGxD0>*&Dc0mS(8>iQF)XWyH!D@ zeuXa6 zLeq5R!_4zs6JyWO0aKRY{AOM$W>~4V9tK-WYX!03BihuSwU81cUkl~l0&Nz)@;3MpicF1 z%Xl0$um-FHblKGE+jIm58XMl8dWGb=vJ#cD+)jq)JNTVXA#`kUt#9TBgglTebsQpG z(r>vYWY1Rx;I^l)Gv@gh*0WmelRE^vs8oTQ6R>l95Y`#C*0$h8o2kIYO)U@V4(FL5 zv=U5X?oJ%@-|GDI>UUraZTnRRcBaAAkoq>(nMBD{#YF7mK~pD2 zZ$m-?qtHf80?+}WAoMCA*QL@>oXJCVQY4(491==NA8+e0nlj1{i!kKlk)F9A@`)SV zqh1mF=f|@B=sI1}GAEf-5Zh`<-7{@hc)L}B04w~b@hI@Cb<&;fpOj>*&u!4KN?bov zKBR-#3P-6Fgo%_$viBwTd8!|qNqM5W+`kX}e6oavYJd_Qwnk?$S%DL+x@q^38;jvD zP<_`OfaE^^0EQ5l-V9JUSJM}#px}zd64y+5=xHA65VZ4v-%cGUe0@zQ>4*oR*P#Gc zUtjON*uz7@q&0ifdZNdsU^9sVg>U4rCUiA z^@1^`e8sP<{Hvt30G(p;9&?sk#^p^<#GCsLXH2M&V6XSR8N7bhsj65G zziDrnq~zQ?I^IkPpy>lZ=)QjkN90I%x8Ja?zg((ZFNw_0``4I0YWof06WiO)jIm8w z1Cc~&5s|VG;lI5l2nN)s_2VswHsL?N4&W9D2vua=^Sa`Q1;hF^u`z$Y$~Yh>Stm3M zYaDvR;MG9rSP*}4);ZQa25fzCXyEmi<)WXMz@Q_054`?DuK!%k-=Bg9eg$~_{Sgp{ zDh0N*ySoP=>OeAK4%b0Zij3G3XmQ(?8z_0rm`C2zL7Fh9$|OoTz2KAf!Up%mj*WY7 zRt^o(Br|>4PN}>ebzPdPzXOVITOYVmWaf$xds&I!zaP|<`S72&oth7nr&y}q%|{dZ z!`zYcP6q{6)Lo+g5eWz2Hr1DxvH;&80FDEUoG7WNe0hwFjmhH7y}Y18B%PfBE91vp z(co;ayT$suyOWHJ*H`aM+3d6=_ru=>ufE>kVu1Mh(fK1{R3=jOm`YC8L_xvM!NI}8 z!U9MSvXum!uA*l3F9pB4x^kmtrKWzBlIq3+hzu)dz9?iwQ~>hXvuy-G2(P_V69D^3 zN=j1A>L@7KeF)ulZ(Dm-p-q$kKulOz>*abYPkntuLuf7li|Fq74yf<}R;LQ2s5A`= z3uj?&Zih?s?v1sI?C*VlKgUZak}~ffjM{ep>Jf}e=njNDK0m<$q3Op3UnUPeB}!!r z2qq>b%3ymO&qa?JO9Mq?kSq5mB;_yd-t9mfC1AEeEtlzskpU1gK$dn?ru9a#m&d)+ z{Y`J*0N??=2RM!+!$Qs1E)#Nd0Wy7i$D33(lZ%DylXV@CvLgx|BA~+rpmh{fRJZFf zu7QDp>EFNQG6lWvPIy+Te%1n*PX4?iU?pC)O)V>F#CoolKLw8p$7@ulF0=;3N9F_M z86Pi|@$=oO$#@nzeBneE-~PS}D;cXui6S7}%i{64+bWQ@PhnfTYOj z-cb|@@VhdqSp@8^zDRs&Lz`Urt+*~PB*+q_@e>Gu|5>PSR#{$-GDAyF4kbkrD1wed zJU=^I*Vq`cZRZX|$YnD%-U)q>rr;J}pA&6910D z|BQ#f4~73{7?P-p{eAr%roauX%B$?|-m0EE$(UZ6l_)aM3q{<)hN@D(W37;P@S)iuKQco+BctD0o8OZBL2ak8a@iDSIS7n@HM^;^^?I;>-VP z31*ypwnO@{CRsjf<_H_PmNVNTw2IFw;QWh2JyE@MrZ~~OPNXD`E+K}e335u8w8p_f zJ9gaN$XSBw8WD0q!)j&#eGZYhdg%na)T#~|^K-el0ed;2Juu4&mzkzAaGb*vdv1!2 z&`~b~&6H*8cC4wkT^#3#+K?mk``~6nl-K{W%{$89BTh#=DbQmIm;w_*CSWWl3S zdnBxv8IG_KgFP{Z4%&7YyJ-E(aw!X^~~4m_sM65!#PS}#OYRg>JjUxQ?AOihJ{ zYXEqI?EYvUP1v2IBc3`JwZoa3wFUqN7f+ojzBzCcSp0047sN`$0*MO0330PWF9c>0kMVu)Ddqy&trG!9MexRZ3w+3yp@5()RN`45@wyAFnVL@7T2xa z!cH8#7aeO<&nBLOg1ydURn9a>@aF2P$95maso6HU!Su99s^;gigFRomgrC@Id-DxR z4R;9*ckY56p&BpC2DDM^Gtgdkcb44eVJtIBwZG$i(p!(`V;q6O)ppDA*(ul9IE7 zWlSE#`aL+){n;z5PEP^z0k1YMv%|wi%&WmHK?m5-QQKx+cf3daSv-`h!pNv-fS-be zgCk%6m;$Xh^h91_DgXX=mEQiw&{S zI#dLT#Sgvj;sPv80)!OQfIjh^M0PTt^Tx7zd#T>!*&M?`2*`wnHm{~5?r`->rOt^) zjP^e|vuxk)ZQ!Iso=-eJ_)xU}5ne;Rm*^fjM)b@o;d}N`T>nEHT4_lubf+)9Q8GRn z+m-9v{`$3_B926RB#eShQD3|?aPw=D&4tnW#zA~;6;56})D|1$hxT&Kkgw(EC;8Pc zf?%>}Z^?mOnNd!nT9en&*jJ1%{e)4q#OQR*3M9UCnBu^Eb@AkMJXfjnb~7zU9)FB- z7&bgS0!%O4TU)VpuS?m+CMHmjkWWv~jr?o72P1=DkYN2C%K@(lAZ=8anO~52NOR1% zMq}A=({IR7Bxvcc)44B%{3lHaH@#dx+REa_9b#sFR&`}%(UF^(C+H)ZuUB1&}+t)TVZ7(bU{N%$fU^sm- zILM^|sog?n+QYxvg46QZt3BpJ+s^#c@1gqcsE@46Z7^k$1#>@eKS%Hyq}%?f+uKM^ zgXC%mYMaNtRh3>C?x*|KbzUpcI*om+E`3n*?X{@c0oNd6Dpmp3AgpgsMlRg=XAKb) zd6S{>+@EjMhyfEh%>^%9OdZ$D$?K1+bmt=8&sQxzuBR_T?d`kKHl7ZTx6}1wC9}N@SPSkX&JZ`zhG2PN2x~zo`XyZ57_YJF@_1ue zZOqly)oGd_G3~W_7eYDD<$Pg!tlzp0+-6{Us3(%f%f^gPI#7MrO4L6?8wu;DQmeX| zqNa9poe}+}a}ajrBBFM)j-mbPv^n>u0u3?!EpGZjMr*$G^u;C`&1yE9(0Qa+0b@JG z?WmW3+9hju|22buYX$|lRz!)^45i#D@6WOA^YHCip&{4N-w;B+-F18hz9UFU+8pBN zRlih#rds>R)Q;Uwh87FS?@pdGKF(i|NCJJk` z$G2MJ`rJ6uuah17n*)djnesHwqAeSR+Aqgt)_ulYpU;hmrGv6`vL4#%4?{N_-%?~= z(7yLIPX)Yn-Z^ganl1W^vb>Emff~54o_D8&-qWc&sm^dP(_@CY`W;Rn>X2ZDRy`dO zId#AiptgvVQ>r=w^DL}O<`mf`ip9}d!~U8DgZqs9bz1f9!HQ`=edQNgtm{Ps`vtV! zmGkCb#P;q9qW!(uW0Y$}v_6xpR{`PA7C83^IOn^&F#k->76{J!zsu$X$(U;+O3h)h zcH10gp|18=jF>d&l+_uc#H(qVVHR{KJ$rpN&T6!TcxN9w1J_U>Uf!IWuc?dph_BAy zR0c1e24mL?#NWsV=8N_M2FvN5+L{dFi!b!d4q>&n^SAO)^14yN(gxU3q7jjZ`eCc` z(!0VGrGF`fm3Br7GL`hHm{D2}eJUNRv|zA0Yi>{Aa7nInPG)zBbSNybR7=GA9%)=E zldJ0dz*FOWH2f!&?KsLuYOkY-^>sG!mE4n;%?FVoHW@iJ&YLQ_MNRup_O+;7b7P0y zrT1yBScknG5%u2%hGWY;q4dayI*v-KJ>iuDjeTC7D^dA8)k+?8%TgU@>Gb{UU%u$x z0#k^kGnVo*Li~vh)`jj+z^Cs8KE3&G zL59Nujzc4kkJcq)WyK@(l>;WuMxqL$9^XgQ-1ac&)CK4n7*qGlZCO(eBkT7BHirLH zkzW@%FTfV8>rFh+EJUY6X_1qNCe37*V4NrIzXX?@+u`6F9&iz{?re%`Zwjm3eE4TQ zwTuB9PFE^k{V0N?5AuJfHGuy%0v&KjJdm!#w@RcwicY(C*!EpZwYJM=V}P3PHQT`I zKI>TfeEq&dw)SNL!wOCNVTM(4nONOF;XZ- zYwDYcc!9N)V<1}Myf3nm8+5{_mTH!kUo1t%=n_Uf|I0aX!Q+f*yUUUMHImsBbG87W$mkjq>ZW$;Sr0{p|B@nc;YrLdrPf@ zi+obi`!7+eI6QZf2N#7Kq+E2vQ6B9VJLALod9NmIWe24Jpeb`d%J-CeYCpB}$*!() zkuP%T5{d;|wh)Q!rJW39zbRQeIe2SH+bQkiRObODSqRwlVP_{tafz(b9Ttt@X!cN- zk}F~`vW+8x_xY9%x!*d2%-cA}3m^48m+W1o7C+O+rw@X?tMK1-g_<{v#ee=?7B{!O z8zEg!u;X5czye*VNuxBe{mH^PvdS*m>y_F}A>!?WL_xO1j$(CumUDRNrV*AVL z?DLy1oL|tZfa6YAPVOxPR0sUWSMkBYrypHkUf_WLJ{VeA=t#=^)3^r)zfFvg%lTe< zCi2%Y|0#m8qE2Mc`!=asG)}s>uP?NvFLX(H^`PQ*6261p04DmbYt=}L#snsEl=4bW zI_V9wh7Zy9g~sD^KH+vg0Vz4u9K)8pb#BPJtK(HW+b(2S+%H?+b?4 zua|ddn_ko=PsYX54W{-qIjYu#QdjhE6oof*bkm$Ljm)3>}&X7>f)b0-pYTy&j7I%28rj;GT(FuR5EA!d&ZxK1i6*u_a8l3X!M-0cSej<2vh$(<`( zADNLQuz?0-D^5<4+1Wa-u3{Dz8m?l!ls(@*oAY^CCPhwb{`S8L6)3E zYp>rNb`@Ly+2)s-l_An?T|e5i-%`bOlYOSY$`QDoQ34Deblx0`rbAneC54k>Qb5|; zuOC&RtNk)nW@iDH057i>N$t7cONhEV7q;Xw?3yBk+w+PZ4X((?*Haymjn z*y*=zzbe~by}`s{f#t=;2S5(<&^652gNcE`wyQ2P1+y}Nu-oK6#h(XjP%MtSKLn3v zEKQQsZ4$($o|>IX?0N|7;!E&{Bh0f*abMaqZUF7m0> z=Tc?lev0(5)CLf=pBeOgT6%i^{4O2DZ@0~En1IpuVPYZT&Nl}Nu5hE{<9GLHx@f2= zu~M6yq3{?Yx$u7P@YOR>NqOaGF7OD6vxQq(34%Uha*OB6=P*J;3g($^NOHT3jtz;E zx$v_LjYiCmK;^UQo5?Wal9T7_HXGNZ_UUiB`cI)i*XmY-E+)hbqqx>w$@%!;P%~yZ z>f)7@TAWYyS--n(#7-%=)+!e7Rzf45-g0T%oF5dIR{A`jHYn@?p2wf8dNV}}iVBLd zJ8ZKCwy}~ELMT5pZbrz-eq?O3JII1t*1AvJ-X~*XDI#_<#vIQfsW7l4>Y94=}O)4)$T!9 z*f5Y6I+o5wO-T(03v;^G#>dU=y58;;61TXt)Vw@EeRO3cmc@)4anr9!ELCunA6*Za z1~!^xOG{4@P*72l>f`2Fk}~%{Uhhw22n1KdG(B$gpaBK9_l74Mx&H9W%?A6j2c&== z?T>60v-{;JFSs8N%NtopmC=H}*T!KaX(T|YBY@B(m1-+CiiH2s&~2JAX? zzb}MN5)yk}kj4*L0`T;14gM$sKC$(qt-hZxqBys**x`fga(%mR*UR%gHFZ%dP|pKA z0)V_DKHH6V@Yu5(PCpdAw#T?yRcgGRouL&)$Bg%Pa^3+lY6j ztFgMe9L~%Zvb=S6T#FZQFRrC){e!&g%M?YrhDMgpt6Oh()$%DI>g9IzV>xVo8fO|d z-uL&z!9x`tjX^yZL2|fujQp` zSTnJ#$?M(Y+0`>%){?}&t>XqWdH@8@$m^UP7K{bi^66JWdtB(Ic#xQqLT_Uhx}|6} zY9hg}M;vCmnD!+6UiKt&KCv%?m`i`O0F21lMGlh3C;ubNeWeEZKM5;x4|Y}ajD39>5Ca_GI|x+qJ33{~^g6 zFoQ)S;tz?%e}SA`y@kkJ(MVUASyuRFGLhM%s19;qp%Q=QL=lFaRd?5x9AK{+~ zRHXq;fh{+IX`_j;@q2GP4`Dm7eYtAsRKk0G79O6%L^W-Q(9dOkjg6pltY5#(Witiq zPFQdsOpm|hFi8seaR;yEM4b|zdfcCKq{?vXK1UG(5oE4hX&UMmSm$Wo-L)9;5~iM2 zaORLUl_8%mW=fRSPAC-=lA{R(^{-<%FDT|ui}k53EV^By0Y6{qWX6vIR<}WS&C4-)U;g56WW8-rXc1?%?M%*Hck(!p6D-UgRv%J->z6o#nlQ z1E39zu7L_S?v8K>;}@NN5jHYH|3rPV;IEME5Rx13?)*Qq@K8RUG}SPdOG`=$mo_;L z=}2|Ks)b^ungoBt@^Qv~>;3N5z;;i4_a}Q{>1~?jHX*!Ws_$(&?!}^ttT>!G7`kS) z#fDfNF?j3_OhyAj$J|MQ5OMSG$A_XX?UaV$CBi0h)=+={rSF*5-wwIed< zFemQ;^?Ph2jv=wn!qDo@mbJY-S2IaQQAP%JMj49inh(R`qs}!ibIA?gVel-YrT?+6 z9r0nCuJ^k{v z?R0iQO`?h%L#-hzjVCUDE+@jqu7B(FULe|#$e96?c0tmq4uCsK7Rx2l44Gq$p_?Tv z<&Xk%v$k2HZ+|8HtxEho&MFJB_1Fp?3)7{7oQ_GXWajE2J3dh{Vflk7S8#rD2@Z(H z%I3Hg{0wz6H-{I&*+RJFQMtQOC+rC=qq8A@omwMkbBKJ-JQOi=d-wvP@&BB%-CzDE z$E`n(U#7-nD0vd9cn(g$YGA8sARu}H#VuHmHq@=?EbZ(5H%P}@Tdbc?|CIUZo)9}f zlmqc9{aMTj{XgJ>sSaQ#GWpOfG(j5%n*{EXmL6#R5Vl)C%+XQT!1od1;r_XT{Wd3| zK-jspu zqQU|yDk{KBpo^3MZlJ%vE6C;MF6`(s@duokr6xgA);D7|=>Th1 zK=9>P;7ISiUCm4`en}S1ZZGKK(Fn@KM})zdJTBO9-~|GC zh*qqH{>Y7j_37#3F+3FiUYjJ{M>xdE$%qK#;$sD{DI)mW=TC@?!T!HH0iAzWbF;e) zt$d0tr6@nrr_)u|bZ7)Dg$!zJBe)N)m_)D|Tf`4WxvrsQ6DoHw+my;52_ArxW?u z^$VSl>j|@F5gLc~6WazeS^U^m0%OZApW=7+PMVhO38yWdYuaXL(4~Y?mS`n1keer&q(!Wc1wo`+H zgMn}q!M9MJqfw9+1CON9GAEt!6Fra%w`*i1PFaxC0qoPb-;IyTYkrP~FBi45LqEXO zWO&~N&xq>^cY*6le06oTdD2`+i)0+XL14cR z{DVoA?}DstP#-=L3ikokLLA@V^dyP4rQ`S0(^K&24+l>Ak})c_C^(hAS_l*fE9hQK zhX}wx0?@vv7yvT;ZAXwwj|xT&W-V(YeXh#Zy9YWufjtsa`eJ%^3D3MtA|Y?cYti!r zG^H;KQJo|>6G3je%F39gbe>UvUS1RqNrssvx~_i|kg|8yN(KltGVbMB|ISFjB=`^k z3xrP-U}7T2wow))g!hS+h@)v{gHym((M#XFEPc=XiL?Pz$i-j0Kt|ANlokuj2ECb8)cKgYqYD+|+M+RKM~v4B9*iOgd4f@dnm|xj9@)t-& zPH*6s9D9`#W0UKLI0t_WylG+wFqPt>tg&tNVFcwBYkU2*$Y;=yak;6ai=OmcuI)iZXN~gU#dc1d|g4Obzy#92Z#wc7GJ2f>xbi zzW1$rAD31IvZU`3Rf~Xs{}9$^p8`G*SkeVyCMG5Ju;TR7fvAFyK!+^!;t#T)lJs^- z>_w5;FjGEuRigL{h-8U+q2z1fb~U=7qI8Wy_G5sDE{wCa(%*;oF_-$y!b@=jt_@Ut zU|(T|PFeUsB@H#WM7}U|Rhm!cAdyZ9h+lvi08<3f`)G7^FV0{T82*R@g_H#-4=ZK3 z4=y<(RYkRBn6Ykl{CTU}TaAQ}QTZPfY5+ihn+PlNrPy)dNWTdJ`vW+ut2{OX$tl9J_`U!kk~zT( z_k8Ra2ylBl#Pel0xhl6h+}yWGzl*s1R9zv<*)DHgb!fUgECW6IIT=|Nh4EtY1Rg1( zNF>1@7Xkr+F}()y0d=G&!QUceXnSO9mDt$>`F5oR&Z10y#G()(+l>6)`rtJEUyZ;8 zOJ7^$X33@}4!v&$QZeu%yn**;!LHxbOiE7=MrJ*j)T;{F#31CI>t^GZHNjP?%8BCe zaE@pJK{UaEybor9CN}p?R+dJJf~f2k5pcf%%vR3zg(P&4N7p_RhBoU?MuuK3 zdBzK4>rKAHkbXePO&|mI?|wh@ILKH(1R~S=e`*HzilvGcMC*O%ug@npkgVJmShe!S z%>I!k!UNzlU0JJ{nMJt}9?TR5)G~IlnNYAlM~FtSQf%_mbT|EabcGSE0~9_QV>1)> z#e!#l^g+2=0X8Rt-wh3adeky9lwX3jxY*gr7}N|L*vc4n>0t3~<=H_BoxO=}v-*|{ z?+V~Bv=aD>sn_gwgo0T32#{ioU@(xO&P07RSrUtE#B!ryAq}RXc0Z?dJ^V z7ig?p3hK{+RrqciH1iDuSa5}4trl09BH+Q`(&iNfb-yDrk(chw!&rNkaY?i0 zSm~Z>(~kP?BYuTLUE>b$H=NWiOLRCpyhlmGb zL(8rS?a!i*uE%*Yru*X~8?0GldAU)(Rsy~hTH3n=w2bS`PDnMTN=lCKu`T!d*e_{) zBA09|bAGY#51uw={>r{edCCHwGg>LQQpp0cRh$;~upIXC zS>fj=!(ww`veiiVM6&nHMTI%pqC+{eIa<0R7|D^NwDAz=ZiL-7#0 z$k}Tn-9nfslNzs$g6c8Ji#ekT<&v6V+46^tOq`R|@}aIKw#-N9=g94TTANYwn498x zf@#1KR=Dh74q}`A$*8hOV3QBJnPOlJ!P9SZuC%AIJum#J7r%_DbjVP9JIdp~2E#w7 z*Lym9C}+IEZ_a-L@CP@S=GR>^{bP-tjt7WGD$P|8{>8l-y?}~eNWZp=(+i;>0emPz z*39A}3vos%V10IT%tm3=)GGvY_xVIZzbtN;irpb8#qpW zw~q#@?mnKzUw~YrR(@FL`WK?9BCD>a`tN`L^IZP-F8qIDHr=!}dDcmsrQ#X0WT}`w zwDDDa?Kv!3LmU(eZc@@GTC+cbd#gI^V>^N6GnA@QrF7 z(LsY!F|w{vI!&2Ri-W|*s5snX?-$(O2Mg#>j%fiI6v^S%F)Y6h7x=V4GK%An!e*`^GIkR% zxzH~UmwX`-#;rM-Ok*Xx93iQ9$+UAYde*x1Ncg)};;Tvre{I0ACdjXlwmM>YV6Hxj z&Vcr@ktU0w-JQ4YGl6>Vp@G?ragh&EIyswvkTDlT`54lmf{8ujJ5 zN#8K-MI6o4@~`DM-mjamJn9vrj;C4Z?JQNYt@>2r|NUkOj#)07e_W(=i7&~NLE8j+f# zGg2yi-%JlW_yUd#y7!i3X()54Z}i}7&`N`D_(O%z`kQR{(JWHmHLp)KyuWC52O%~x zj~2SCuhqH`yP-#76u8)`?4_x)A^;c7*0}p6;Szs9`Fr{AX1&>6#IC8{%U`eGSMWArk0cTvX!5^$(j@OD z4}Us~Tdn9{`1fH~c90Gx6Z=eml2E`I@_w(VR)b1$yl5s|nD4!esj}{%b?i>9RHs=# zv^)5tC9!nsL5gzn-8jnCO-ZD_ZOJ%IWFLmzry{39Gi9?B7tZKkwzk58eANL+g|mVM zU#&2G2PkF{a})gbJylDge-g&DyTDXaHnopHj}OXe~(EO5PuWN$1AzOK7JPTX8%oo&8U1>ZkguN7KfTA&tzuj#k~1d^9-UiSij$o?&EUm|PYG@qt0~>Y3W5v!B`3Pxt$ta)Y?w4ZTR4+U zq%H0}RU60`T-Vc0?5))^HDcT3B-w?1EMh7vFLY0@Aq#i7?BPF)&&}2s?|`L5Bwobj z{Uc0u&0BVmnik-I<#SW{rX+vOrg!QSdHD9FTSYa2<*9y-tZ>`~i-ot#b-O28$Ll1U~pJUuo!H6+%_FHs8)BEmuUU)^KA-YUDtNy8W& zzx)W+m7P4du~Z!$MHh2T%*U;dBluVnuDv~G;<3IE(XPH3KE{TGO0|r9EjtM6e2p|_GjVrMzKiZw6{`k9C8_Y5hdV*d}=46x}XVza(P#nhH#I$gRfRk5Mhgx>;r}k(;VuZlbJy zUnD}FR2twQm1IlR(R@kwT|vWzIGV|}DFmyWN;f;b%k0G}alH^|l*=npCdwyFI^H|i zzDsUg#Oqb`U=fwn8ieVpnGbjUc!!|l$5jaoriDi zT=yeYw9|CRz~~ES`2}f1M&oc;4i|5G)zyN*ZgA9{$%2-(Q{Y0*iY8H`pxZvi_h+J^ zmmM|A0a+B_I5=8c$9^O9s)uJKYIm2THs>z#JGzgxc3JCIeiZ+;E>`l$qZI~i;uHk& zgTtasv4*g|j4Cx5Y+VFR!4X}MW(a;j&jnpKrf-_#w-O_~!8`14p(KpWdT<@V>njwT~e>$jhNK&z7%?ptHlaUu|GhZj*`Z z-^qx>y^NpRi8;0^`-ov3R(iOfIZ3V8Vl?_vj290zU?AlAKpi0Qsle8YUw9h~*&qyl zr!U?x)pDlp=_cuFLwD@!T(9PhaA-T?WmQI)PZm7eY}(LdnVkqTa8*X~mD_f|^jks|~h_jj#h#l>+I8E3F)nJLy3JKNpBk&^Xu?l4C7hvE?0uHY3v z9by_jN4r|nE`zCArtLpXljpfBZ5=dxQGslw(*o}$P?Llb>OH((*MwBEjf>|edu>$8 z%5#^oY3M;mSKctW=rjyB_P_vJtIAV@4ZN=d3wB5ZWiCsI8AsG|E{BQei(B69e*DZ@ zdQ5b9Ai%q(rMgIX*M#+0rFFTH7cXiv@y$rw`gQ`#dWTd3#L+Sw$$tYsVuVT*?Q^nF z1)QS5KtpHnxuD{=dsF)Yr`sLn<(X1Wb-GocjtDF_L-!17!*C;lsxt80SQxFkhw2Uz zNWmmpLru(CycF8s>s8l=cCLfdEon%#S2~DOAsIWW?-$bql)Us?XJqyrI($$(CEzSjU1K``Z2& zvdi>Uc^boEf@6^<*_#rmMHZg=kOY#fYz8jem+^i2Y!eze0+1X4DUhqE#lW2*n+sB0 zpFO`Lw>Wzep|Ln*v@}Hunc&9BJi@_q;paYbwY>?A!R-JyDxo73<;P77{M3q=K%V$y zYJQxOnXZwiuSF>-b2OhON<=3V!BHKl#x6S0x>a9Z!Tn^qM*WPhFTTV>P&RddixDwb zU%#-IHv)x4SvKAqtDfDw@a+(8j`G}{dlrsU0{^!sk<99&w^pOs*u&{RTB;{=Rf=@k zt@{@lLAU52kIE#MXl>gD?yO0bV46MP(!I&8wS$Uj2ppf>)9?~SkB{f-)pQsgTyPMI1bO0-IRtvBvkN7^x-)Kt$^0>{)(!PfcxGNyrw30DnfM=Egc2H`H-E0;D|QClHBzpUe-u1sbAEOhvw`}Gtz$)SXw{F1B)sq zA;_`!(D=s=cMmh#Nv3aR25?N{8D0JBRA)Lk9ow;D*(gIED{))bl1o`%_!ACdBLt$2 z&%7usn35*4hWQrAQbBx_z%CH13W{}@Qtw^BUwL|tNh%W6$VRnztGu`q`r;^vv3Q$Y zeAdAk#ZQ~@fZ(uEqy!~ogz_4|c4KgM5$#6)MvMDAe^~NHUe>5&e}+?iEtK7I;qcg( zP4{xH2D4I$+A4SKlPq|Y3xoAtqml~z>#D1w?G;G)6zx{q@zWq<3>1fz&}>(Q?9LZq z9FU-*$i7B<+UbPI(p@U0^E>3=pCW1Z_WnuN{IOS(BDVGx%`3P6KpHfKg)l}h%lPZ) zlsF}mQpynn)~U$KM6LTN?j>aLLGrTep4OjIy>GaZd2<-IY#sN!hS7Q;NG$tHoQsX* z-Q@)-7p0&5;7IUF!Y7aOpp3TTYL{&MK?lYP(jKP2?cNiHT~;vaZ|6VJfA97TJ^f{sIIpM@(cEy9e)x$BbMFr)4^yy8L z=)ysK@@07Ad6xA4u={K_c+~*8#X->fB`*y$b(GWG`~>LLULjsdNlClr;ooBtc%J=v z^#2moel^E8(Q(x;r0s>_7s<8$veB5WV`_TP)@mF!$)9pErL*>V9*xu}2#gB6qI@uE?8jDdAN@(AoLT>N|ZWPh*VvC@Q z&4uJ)H-PAw$N=4@A2iijvt~#rxnkFJ-&EYbpZ}EIvGV4*Jfj58a@M@0e=hlY#m4YP zl(|9FbFJug;vE$Pm6lXu*w`kg z%Y8DZi~IbHU{9EE5ZE(GU2%GCbwIyr1`nkq#2Nw?GoxcZ(+6z0{?zRi{qyA2=w<-T z?Ic*2|3*G+qK8H;qD0_{w88#hiq6w?y@$ucC$;Ultq?v|p$T>*5`?aYQk5510tIBt zA#&llvlw3xPeC!&vT$klgjLv*kBkyhO=TJ{W(Li*uy@@bi2%*L<`9S`zGl?snapq% z_1O647+Z1h%qF=^=q%T1kwWRlh5cz@u6z=op*u_(sI@h&tZgb#aMM{G!OM-vG5#tu z75j7a8P-6NKB;pweE0|(>QMLomcoW!2=O@YHnfEZlCt~P_hD-;N~!zHgWx;@`Cai-s}QiVaq2;g7ePE0sG{9g4zR{2y8rQg5g+@=eV``?Vmu zP(Jy_1i{GqT_~kzX2y?=AKk!8Iox^u=+3LeLen`I^Qa-)s1&DuQ}sNup^TaKp%Z8; zU|}^ctNu1Txjd#U|M#N)2T=HT2Of|<7^beFfkwz%3t(#3IEb&48H~gwv#+|~h)wHwEqeqojGbSgpa!C|xt*SF5Y{nJA|n9~Nyv8c zZ^{HL3=AMUeFj96fct1=$LkZI3>Exy;jd&OdoE=A4j~+TlaY|HbG+{Xs6c0GYXLw` zO~-3&eVtgXxU8)Awn{b<%KQF#-NeW!IxZ_PtvFcVO;1JUsm-DcL(d zBJ6nc@X!l5-Np|Ed@t z9PDjVR8%A<%Lh_%S^*+!I83TZGb=ecIUylJ;FORs8}Nq?+=`7^+q}aF=X>_`|5upV z5QXKIJ7pT{Vrrx}qRYHRCy7RYUdv0^s-KBkq*~gi)@UdqLsiqI3({2oeSFJ}T!Fyb zhS~~;uPccd2r1N+jh);#+e-SZb{2@ifrk+jMmu*eR$OV!hs$|V8IA9BEXdU0siIDi^g ztBppg3~8wm*orF&?Rp}QL-hVBxO2I)@e?(QKS zO1e|JJJj!}zq@X%yY5=|n}5!lIx}a#d++x>?|%04^e*I97Xxyv=ms@oQCHVMN#57j z7tj~s6qj68zmu!4Z&c(Y8FCD%1>tj-3}(()H}u}%c2Nqtqbk1O#X}B)!C(@75+pG| zBQw%>aZW;aC-*~)#FwdYA<~kF!0K1f17hl2P+94_*7@NK(;*?#xE4Smj%Dy+Si}N6 zL?Iy|Fnjw>hmFk}3IPY{qkiUQZ4VE=5N}(67zp5K+Rz}8?;R#eiV4M``a|P?c4p(* z@4~w=Rcmp&8WinS z`_a+t?;di~n^tPhll6= zZ%ypuS%wcg;4wZB|T3O6t5gD07evX0=jKz(gGc=-}6V z!tIh_8##0#OVHJhN2N$Zu+kibFys!HvL&gav<*2)Mk(`qahkkQe@6i5yJLYyjNsmc zgoNfhUfz<2Ou-kpxOW3&_5izSU~P_mw^olXps950bAg7vbTKJSlS|X)nd z2kqgE3_=JBT+dBQNcm*IRcvs97CJaR|o5vs*i6YhvDX#l1KYc!;u4f2$4EX2BX*44WHv_qqrJdb1@~;bq%g|c(Jmu z0`1{$C-YiLN@t5URbqUIgm}6Uc&12Oc3?1GkgtBRNIAk8uEPJLZyP24}zk?qIS)?mE!ETCt}Y6M-(uMV3(I!(dNDYdDlW_(YI(x z+_QN9OC)ra*Kf8iFhfaRpA$aN+efVvU~m`HIS}8eH^<8~8~JmDklfez1CqyGf%ZL@ zQ*8kzXJJMpGl;$+Wi+BP9-!cu7@P>0)Nb@o_y9O>44fdFO(N1LQeqG`$1-siS+OzZ z(&y~}1cwy2FqG^GW>3F75Y=;1ZLIV@sW6YOJeO`i%|k7tXI=e`-@cbCO#;vzB5U-= z8UjMBQ<8-CChf_QYATj_pX{UT%=CPzdTr5#yzNO6aQmG#H>rm=B@4W6V{?J?cveTs zFOOXpLy*!+E?D$y)6qHX#?{d>-IBx7e-(+h9w|-Zst;-737~?4gDN$Z-@kzUV{S1>w?VmMn%*gXU!9;v#?Ho?)@7)T4!0 z!Rd}nZ(^!h8rfD`h)0p{s_g$PnS>j43RlWiSJ$)6ElMGJ20<6bly)0n+|i}@*1^(W z2HKxY)NNq)*|IjcL~g?uOXe3#^w#-7d?pI^xQWj4Aar?Hx2{x><)`Gniv8FEg#>sYrR`*;3Lu* zP}71L>!KGCyN$k1@81!6oe!NEpWKL+CKyZ~TxM~Y>s9_)4d3O;#e*DC_E9`@iT1_j zzL!>7q}1|I$1$J$5_C!t6>E9nei|8UG#ELsO+rix(WY;Xo;~W1dY#r!p+XvZ=qi(@ z`0v62L_ZqqCM+!oW1-cfNZdZAENjd*HH>X18vTkI%Mi_wWi=5cWWu2(@YLZIbOyaA zl*P+}<43K8y!$-mk3)ELKH|%H+te524CN_rxIU8n*k^NX>TPTFV{g;K*BJg#jz>Qe zvB)%IB5tCg@kauF-;3Z&Wak2DW6 zc$oe)gnAS78|gL^KRr@i16F+@xoA39K#Fp?b4hJ<-az~G$ar|1Q}A2Aj+V`~hqG?h zPW&GE&_CWwHqes!I;18};@Czq6zl$Mr`Q=xfbV23)9wZGGR1_0eh#)ij6 zMo7shI&PRqHc5+#{)}TEZlCJN(wh7!Gffi%)(tV;lZkilR)Ct zRtb8R6uDur-{3mfOZ06DP`BxfX9_?gj+`R_KRgU} zOF2MqP<;#2I4)FzJg7<`uc~Qp=j)s4!P=7H9%U;P%#*2^;w@Sq>p9rigIHioD-lrF zUD_Lo#~_#D;9!PolscH16MJ~#B_tEpQjHje(b@X=A;`xQyGWqD%%0a#$}Fz*)x2Me zclCimak+}fC1SzC)??e6FmSP!t`dCRkru)UoyS;JM3(xZjjY}@^w znN@&nmE86%*}~m=PCy2alN03BAFQd0`I|@cVl%Cosoj2k0O!`8zCmox^?Z{dQ!%Cq z1)IXi$cTrhp{Iw&T~Uy{Qe9d3OIFsiaX&=az(a_h4?;$kA;x{5kNsJ;tBXsns*bj{ zQHlR=^n2`$ftl6SxRjL7Im{mS9u5`6VNku56+k59Om1{^e0*#ypa_5dl^o;Cm-Bi* zhKG3ps0+--K`87=xTU40#?gU=oujJzZN@VI<_(b9fQKC5rD2};SmgamVhmruawbUS zQB9K`*twh1v$EFZR2R3je9g8c|1PP_Agqd;q4s77As{4wYyS}-=^w%S|T?M=7&YQYAFc0J_peBh9L-~s6$2H9e zVal}yryD+n$;!TbG0lsPQXxz2kj$4R>a3t(U|^tQBe3ek{VwHdGfg@5c@!-V1Cp8u z|J$q|ovQdh-T=)^sQ^DJAKx_=mZcBpZ-9E|bbtT7q9RCQfc2C1=s3sc$Z+eAHqx<3 z->6tvSnNzN=-s_?-8+U~RA(OSA5Mr=FOauK85Z~T(LouY^I^EiDO5y+#9u8;*Io2( zBrzoXQqt2gLThU;!s$OCZFGSA(G*kx#`pGD*!IGu_+O(!wk{Ir6(t!4`UkM1B27)r z^YAA*dJu@~n%mpGbqQ9|nzFyS%sEgBVtGA0#1aX^R=Nq!zU18Jq$nt~g>=9~+1}InM6FhtWtWJz6kOo&05kEWjvp!tB?^QK#4gew!-Tm<+chYk= zN67?$1Am=J2S|Zw9W&G7K-S$20%aP-ZPQ*ei_aND-w; zFvItRdgMhN+x6aRVzfe(7<37iQWS#t0Ai6`aj+Ok5o=l5it~cGM1_%vG7YV?v#l;0 z`)4uYK37k3DL{bDS$y?Qc3rudm;XF4kk;9&*fMfYYeB2|b%@_5TQP@Z*6`wb*RY5R$EHw#4vynIJzK?$pQAIl7eI}n%$6J}p4V4b>ocJ5 z-QGBa0ldW2`tI2q><2S3#uxr{T(3Uald?SDp9PqiY;2ZY0!p1vIoS1G+lbN#2;wJj zXa`7y&jt5tbEL0sybyvAnn_8$fL0)Hw9wEH?KBeHcwj8#6U85yW;EwAyXw$o3m)w``?(|%hax5vZ{8Y&>Pt(KjB?lqPhYL?5rCj z=82kZ{QvHuB+i`Pnwy>MKh2CM_>)AZGcfd z#$kMSw+3i7g<(Hq%EBZ_dS;JH#;*+JKuh zZ@4aAB4USZc#T9rq-g*h7|bV9{;nK{iHJ68sIk##LPFvnEaxL3^g5A$zR(8C$(z|?&?v6)$_<|HEvL@CO>84TB)4W#G@;Pzr7TYVV zXn9T{G3W+KNjKfPrm+^C1>LNdfH(frKB~suXHc{z18#G#&PN)+>=0+b-lIGS*e8c_(M>@JzH}O zc%}-hjz|S2A;~)(8ygPh;bubzeBDTtC2_=XgO{Hl*^Qp$Adrx!slK-qFPe`NHF$@b zE#D{u6&1ZIAfE;DMm5z>pvI{0Qc5ic!aVm;M zprf;i2_2h+5dqNH*jtY@FwI#NGHD40bKS9iOI&Z2*=afOe?g?M$nYh#{)&4VTNlOf zHYnU*1W}<#%NF~sks-#T4K7{EdG8*jh*9w~kKiJBb81W8p~(nsWG?(LS!VfW3eCw| zbjO)MaA%S=P+)qGIAG#@ZU}z8z?O&%pvwMWA^!#A|K6YdpA9+ShLeKY2Zb#seel;l zeT-!3WFox1I#zHGrE+ilVP_bIjDBc&Vs7E$|3Ee3_!H8gvndzTLVaw%8YZD<$>6~nz7`G}W2lA=sXKEzC^j7mX>CpZ6c?rmI zGc}@#{{iiNI{iXO)8uW-utuToC`X|K9sihY&MhmdLM!KSHXa%;=)FH~{+{{DF3IHX z_fp$s5hIRZ^w#gGU)9Hv$CjsSvvzJ40ml5TqUi!kyL49(zo$bm-3Bf`J6de~&yc|eS2uyS<1yEWPJ_!A$l}=ig*QSt9?ES3H=0eludi%} zCpb0N04Xm?`crdyDjPe^*W7J7aYM6tlbt^d{r{pRCSr?*$9=c=!M8jU$z_BM`3 z{zCty$#46^pN|;ospA#X!od~ODuLkOlt4M*aBw-{qJ+=jLZbs~yEWg%r<<*TCMuq%u`5`% zh7f_E-rozXk8a6OjIdf?gr;pG7*MI&x2W829PAC+eJ^|53&rx?qm1=gf8lQMgL1z9 z?rdeD63ge+DfyJ0Fh12sL7l1F92+agxFYPo=9?ubT2k{V<$TAuT`XK{nXRZEn==~m zcy8>{Qq!7|GL(_>Im2=-S~8R>8a>|Z(6#E-RW&>JJH?~IpqzqxGybMOl;S6U?e_YKN=YsQN&^#4$X!w%Uuxdlqoqu;d|1@%5F~G! zk6-I7PDV?~RnyQ>F7VF~|1sDh7!=Z6{pH(UZsl>A1X)MnZF}K+{qIs{Wqqe(H+Jj- zr2_cOY6bLh${;ZtwdYD1jdSLiKNb-FnKCyVeX9?BtM|gB4`M>+WI_iqNfCsKSJoE`RBDvs(e@k_W3Kh_$DIJ1-#Njtlh4UA4ei4 zpAvt?81tS`u;d8*V{&?T45g{n_B||~EsOQVK_0;S~o<7%C{VDcaL}n@` z=8wIB%MQbKUD_J=c~J=(&xe`fO6l-Q%as7{{Nurg)#28PRIsS2=l#dNX1Pc;+V`4? z**^E)AbFP-do{D#fs3hM(l|RINx3~w{hz9Wy5z91V(~rWB;!i^Hri^%f5tElURvAy zvwj;3%eR>ljP3Oa*3p=mAH&At(UK+KdsSuA;LHqAPT63?{7Jr|Rf}=OtEmMy@>6%m zb9Y5nKkNG3Wbw^Hk4JRNXrqBZ0%FH9Qw@Aw0`DOdYpV218~L87;@$|Hrn@#87Wjqd zmu!!3ZU1`al+*k=mHSY;3H{txlV5(;F_P|Ax;0 zNBml@w9c+}I({z%2nyPSvhMHiGkty2-~HYIYN&IS4KZmj{VF$W>w|^q>E);Pz6}5% zQKt>)s6_z#7skerMQfK9T|ltSZ>9D6d~5K7mlsefVYszwS^`$4*&=@I*&+tI8303I zhIgSi^IUdHMn+cFjk};=>fe~WB79B@pal70Q4UL4m~y#lbxNN1{dP1#~XmvMX%M_W0cq+MWL|t;2>qb z8Bp9jy!HwWl`g19#|#N7DG3V;Tk~4_@Il03T@4<_=+b8nPIuSl=T+79 zvobR9adDMYRr}-7{tdU(;Ps(rhkns_3K3sj-+L&P2wAwznU- zwk2|CkPH7ll-AYKii;8S`j07Ts}dDuWrty-PA$t4eSMu8Y6j)Wm)k)9>#HQL7A3`Y zH-0_#B6-E?}ecWol0 zqP|+lvjXzYW#gkQCLk!3@q27L2N(nbNlQy#dt~3-++<{AY?=&W1_$4sti&&kq~j0E zn!30Ur=_LuT+b=<3E@y>33@13PAn}w?oDn14f%;#LS^kXamD4umLEUXEtmtE$vZ-^ zV+l#-RKgiaS?oBfYHAJj^{Og5UU>zQiWZ0a9z#wTf9>1F!nf)KsAPKd4G6fM01A>a zd)|*LZV=I809v4{wQx4{S+}UH?9kV($(z>xoBPAnK61XJxvP4MhlE5QQ2*SHU+ok| z1Aqwpe5BJNoJz{dkP}@kH#av6i{1709LNqJulW!X@{AT<1a`|7b=HIx+#!fp~>H2-aBl~|&y1;x4p%q@C zEjqU}sQrR*k)Zqip4Dmb@WAo(bUnGUvE*DmJ(>OVDM3S(T*OhllJ7OY^-DJ3?6&sy zIH;IFii!<rtj+nwi9+D`5&WF;= zn@pW1{-B_lsHi9uoWhZvPF-!iL~Ugxq(lu>-`_v;fx^-7if2dJ)9~wmV_~5YM~)I6 z7WMvv{OH&iI}1xv!X#)vnust{$V)MQ#*>~)T?0tn1o-&q=$P5w7sEhN{GH!})lwpB zW@gjRrzb#pyvm@9eb8|h->l*5j(y)MlHq!L;9eFFJkHw809dw!$ zx87Nl@bU=hdEV%1Yp3bztLbG{TZ|{NYBYXaDnwVdYFI2UXS?@F z-Tv&&O@awIlLDB4qM~AefE~qSY|tjaC7GX|X0y-7&zsS2_0|fjfTfF2aAQ^MsLK0_ z1zcb>w*$5qVcF-B$ffx?L9_I&e7Q^REBZ2FN?aUsmvg-D!_kNAV{D9w@aRs*%R=%t zWgBkmD1J7<@}{b67UM`@J>5Ugkzx92JI=O(X&EvtUHDXS@bmGU Date: Thu, 12 May 2016 08:12:33 -0700 Subject: [PATCH 268/439] tweaks --- education/windows/index.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/education/windows/index.md b/education/windows/index.md index 0ef9f4d787..f83388aa42 100644 --- a/education/windows/index.md +++ b/education/windows/index.md @@ -8,7 +8,9 @@ author: jdeckerMS --- # Windows 10 for Education -Learn about using Windows 10 in schools. +[Windows 10 Education](https://www.microsoft.com/en-us/education/products/windows/default.aspx) empowers staff, administrators, teachers and students to do great things. + +[Find out how to get Windows 10 Education for your school.](https://www.microsoft.com/en-us/education/buy-license/overview-of-how-to-buy/default.aspx?tabshow=schools) ## In this section From 1242eb8e175968275481c327145217d0cc603067 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 12 May 2016 08:22:36 -0700 Subject: [PATCH 269/439] add topic, delete video test --- education/windows/TOC.md | 2 +- education/windows/index.md | 1 + .../windows/use-set-up-school-pcs-app.md | 19 +++++++++++++++++++ education/windows/video-test.md | 17 ----------------- 4 files changed, 21 insertions(+), 18 deletions(-) create mode 100644 education/windows/use-set-up-school-pcs-app.md delete mode 100644 education/windows/video-test.md diff --git a/education/windows/TOC.md b/education/windows/TOC.md index ed1484d8f8..2b8b527b24 100644 --- a/education/windows/TOC.md +++ b/education/windows/TOC.md @@ -1,4 +1,4 @@ # [Windows 10 for education](index.md) -## [video test](video-test.md) +## [Use Set up School PCs app](use-set-up-school-pcs-app.md) ## [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) ## [Chromebook migration guide](chromebook-migration-guide.md) \ No newline at end of file diff --git a/education/windows/index.md b/education/windows/index.md index f83388aa42..4e759a8208 100644 --- a/education/windows/index.md +++ b/education/windows/index.md @@ -16,6 +16,7 @@ author: jdeckerMS |Topic |Description | |------|------------| +|[Use Set up School PCs app](use-set-up-school-pcs-app.md) | Learn how to use the Set up School PCs app to quickly configure new Windows 10 PCs for students. | | [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) | Learn how to deploy Windows 10 in classrooms; integrate the school environment with Microsoft Office 365, Active Directory Domain Services (AD DS), and Microsoft Azure Active Directory (Azure AD); and deploy Windows 10 and your apps to new devices or upgrade existing devices to Windows 10. | | [Chromebook migration guide](chromebook-migration-guide.md) | Learn how to migrate a Google Chromebook-based learning environment to a Windows 10-based learning environment. | diff --git a/education/windows/use-set-up-school-pcs-app.md b/education/windows/use-set-up-school-pcs-app.md new file mode 100644 index 0000000000..3db61d70bb --- /dev/null +++ b/education/windows/use-set-up-school-pcs-app.md @@ -0,0 +1,19 @@ +--- +title: Use Set up School PCs app +description: Learn how the Set up School PCs app works and how to use it. +keywords: ["shared cart", "shared PC", "school"] +ms.prod: W10 +ms.mktglfcycl: plan +ms.sitesec: library +author: jdeckerMS +--- + +# Use Set up School PCs app +**Applies to:** + +- Windows 10 + + +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows 10 Anniversary SDK Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.] + +placeholder diff --git a/education/windows/video-test.md b/education/windows/video-test.md deleted file mode 100644 index f9801a49d8..0000000000 --- a/education/windows/video-test.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -title: video test -description: In this topic I will embed a channel 9 video. -keywords: ["migrate", "automate", "device"] -ms.prod: W10 -ms.mktglfcycl: plan -ms.sitesec: library -author: jdeckerMS ---- - -# Video test - -Does this work? - - - -Did that work? From 839509922298e5a5db1994ae7ffb98ff4bddb41d Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 12 May 2016 08:27:27 -0700 Subject: [PATCH 270/439] copied art --- .../images/deploy-win-10-school-figure1.png | Bin 0 -> 46486 bytes .../images/deploy-win-10-school-figure2.png | Bin 0 -> 61301 bytes .../images/deploy-win-10-school-figure3.png | Bin 0 -> 131013 bytes .../images/deploy-win-10-school-figure4.png | Bin 0 -> 18525 bytes .../images/deploy-win-10-school-figure5.png | Bin 0 -> 9897 bytes .../images/deploy-win-10-school-figure6.png | Bin 0 -> 18525 bytes .../images/deploy-win-10-school-figure7.png | Bin 0 -> 80870 bytes .../windows/images/fig2-locallyconfig.png | Bin 0 -> 86495 bytes 8 files changed, 0 insertions(+), 0 deletions(-) create mode 100644 education/windows/images/deploy-win-10-school-figure1.png create mode 100644 education/windows/images/deploy-win-10-school-figure2.png create mode 100644 education/windows/images/deploy-win-10-school-figure3.png create mode 100644 education/windows/images/deploy-win-10-school-figure4.png create mode 100644 education/windows/images/deploy-win-10-school-figure5.png create mode 100644 education/windows/images/deploy-win-10-school-figure6.png create mode 100644 education/windows/images/deploy-win-10-school-figure7.png create mode 100644 education/windows/images/fig2-locallyconfig.png diff --git a/education/windows/images/deploy-win-10-school-figure1.png b/education/windows/images/deploy-win-10-school-figure1.png new file mode 100644 index 0000000000000000000000000000000000000000..66113dcce1147b8a802aff95612240772dc17f27 GIT binary patch literal 46486 zcma&NWmKD8*DZ_{FA%iF6WraM;O6JSY65hZ+f5^kmus29ZO>D|? zGJ4+TCy$0&#AmB#3C0iaXwFK_n(%LQuMKK_H4PR;z413Lw(q3QOqy=0jH?epXmUK3 zFNn}*3PqT>i!jk~qhqnrabekX=xQ&5SRt=_gJCcjEo;x?N%!f&!9l_4!N-FF?|?(n zv$cThfS`xNj*5zkWhpFN3L4BVUuAXQ@gQp|D21`%q~Cr0Qz-4+pXjVV%E|%zTq|pj z%@L3;)5Wo1!>3D4sLYwYVSOn2n?XV9-!$Uhv{p~>QXWb3l=$h<(K;A&MPvW+SH&)c zZZG7W>b}2mMh;fZxA-)^yD0I)U}-e;+tWn~U24!bZ{n-Nof2I;^AFXpy5;`+#gcXtppbht?eZAj41Yoj z=r+OUH~u<>lEiX9(nY@7(nW_Orw9dJq_d10));mB-&N^Xw|8{N*KyTQ;D4=Mh%ZUm z{OVO7{gU8hi0z>Qza&y+a}YvVS)GIj6;?>Zr1A5t#d%Y%j*IyBWJN0e?`aI2 zA9IY0mai4izkN5Yz|DJDUf40Uq)Q_>UNS@@sP@sUk+iuBB&tCS>y1d+-B;pBL zYjal|gj;rLvNimfBJdlU@5eOExriuk3?80C8b__!+h+T~qNou2nnf1NRGsx1w)jQn z>)#xGL#qnCLqaC#VyspO;eh+b=(_>mLh0krJa~zno;69GUBXWOetsR%F9(JckpwrC z;RW6eokTns!hSb3(RUE;-*ze6?)e@MH;$moq53}}D=P~Xvx(h)w;F>eeQyj&P^jEawjYY{1c1sFQ=t_E_c7@eh)7M&@b=)q# zyZ(L+Z>?dcx1Gp~De=2K{d9XKJ#N5vE6G%;eW}>4H_Ol8! zQn)O7bmS}-_Gck)k$GQ`kzpezbta@|X2u#B(f*c~WekaDB7Q%w##H`$sNTHGc(4Q? zSRle5-hO8-KjMB5Nd-FWPtzs-9?HGko2CKbP!_h}FV(!Fvm$j_`Wt)Uh7GB;TCOwu zJ(Mu;ty9T_u~L)fP&X(GecZMNWy$$F?Ht0ze_P$4<1$gK+lenK!7J5#g$&VjQ#U>1 zr=AZ)EK;drwAnbG6iS~s4^Pj4CxjW#+tErxV&wb{c^fe=9W;mPfaMjI^=jTe(C?jZ z5rfAoUo(2bVIW#mjOP#>oVZwKMdWcA*8B4<)E#EZ>Ln?jt%$EfM<4-|;Wy;D#2*KS zRui}v$VwugxqxY{%KaDD;jrpUcWV8A1`vzA!v(fCLNcHd^*5sTpmf=!y?=ZVk|%ar zYXw^&Tn4>EPa*pH`r2~a3PgD1G>;8`Vz4RB=;zWZ>&)j2wJEUE&osBj;v`p&PTWQ{ zn|vkrbh}XvXF3dl$($tsMRivX(G|kz>;5>j$?tbG&ItupANcirjw{~LBsydOV^1DD zh4he*Z>8<4u3Y^HHyXBXyZ?qM$&tiIKYq;>_D&_Uo3*sr^peE?AOed=qdqUs0VEJ< zEVj=P&4*{;$ZPJ6LNiu8Z*1`>BDoS#{--u-r$!{XM=$d@BV}c0PzLK$C!@?pldr!3@6cu zc@#qI8a9eE?2X6qsl}PQzR@x7$B?NruYN`ix=un~H1CmgM!e%-$JOp}pVY5u$%R?wUeIG`N>-au*6RaZ*wUZQ{Va6T>H05~W=}wO;N?)kO5pA3`eR0h&v<5xNAL@Y zc`+8ThxHDxThD3z`zA`<^+&lu4}TzR8+kT4ib`$%H5)`3-nM&NXhDxZ>lVr(H1z9% zpLjfBLhIr{oz~u8u-GgqdndQW0X)uS(XA%pyB|OjIGi^zFIE3o)?E-A>tV6~LeO9M zRh>`Ky3DwViOEBG8U5`^M{(y@shxtJ9VMX5`fHC5CXHh+Je+w&SZ)@|D`qE#V57I8}>#i)@JK3BH= z#z>Nr4JU;q=uy5lIAzCny5NLvGqZg7crlusH8k(Ump!pfQ!N%H=fuGWGn0+$*SmnH z0tohRCbgmw)^$~XV`F1Ec7iMCYy+oUYQeuHQ5NF>NC?J6ytTC*kHiqz)sD6p2Qj_R za9$YQF(1s>k#lscjcz-+Ri-p{0yT@5zaED|7&)W@;jPgT(!%Wcmy?u_WbFaJiguKT zxMsX>PpRs@-=3~A&4ow@K%yISH47y$uHaV3VZN#d6FqE;3k&_Em3=-<)qjK{#lN>`dFYj+k-={98pk+IS{FHr>(q zRb|laNH4*yB2v@>KXN^-!0CFgw25-W@MzizC#cG^rSbYRmM3vC^E`YHbG8O_sd7|mie_)~WSj`@o0IGkWvrkZQC`1* z%wWZ0;<1s)<6W|ly=YDlr2-#Fx8Z-Hx1iK&iNy9*#UP6^=D-YodvRUJ-}Eg-zX?L$ zHbP`Eb$b=8z%S?qb({tjxA2L{#70#TgF`pc9ZRX%M(Pu|k}Kj=b2w9lQr=dHdzMuy z$m=wjcad|?ZVNo)l}MX=QB|auW;_}+o6so2ny~{yo0~$qJyiHw8+^XWh?qK8YXlaG zMTV|q?-R20otyZxBZF)tRDt!_(B7CE?G`5!7e&j&KsQ|ERryE{N{^OeWLV`;@(mxlKa^BjARiH7~$<*Zl`2l zD{Ier`C9;fyhO#==ngO`3zJ=;VW9om-CY3bD}H&MckBQ+Yjr7R#zT85rDmx~Y8QQx za36(F6T4KWuA-r#tp3T66LuzWqpGQ?u38GGQ%v-~zdHDaGq5*P8!Q3h5#bD|S*%EU zzdbTGHpaRxG|y2&eNCsYuOdGA*yMX8cLvLSJ? zDHWvl1mTcQk9;Hew~@XiQ5KT9GR=weC`qEyX$~0ivze}om*{THoK5)1|316a9;_$< za>#sxk&ueiVZl>hnsAh+iP*faW zUtdZ}PxXesZ)EiKNxDo}7z8rhCa?k)1Rj)S(m#H&+8Iks#FGO!g;t_Sap6bzFJF1) zRDfwGd{z#J-|-0vwbaxc1CdQR-~lrHhp%%wt2Ouct>=ZkgE*f_kZLaZ5qhNLVfZGE zJ9o*QHIuyeg2XxO;q}IWU@7;VQ8l9?){|f0{8QImL~5S*V8d=url8iFkqsdg#)#)l zg@YRV=OTyMLOImw=Ta?QbKA_wrHC^MiH<5fMs&npBB^@fcPy$83HMJ;r%v_CWTBWP z0n(*TkY|%zAux_*rM@yEo0cnMAv;e5+y|svTwi~jx`O9TCJ=NX&Rxl)RV#Reu3&nE zU7RS&iTTGcKr5$EszS*m*Q4l~sh3F;e%$E0pjjX)4=QD2>?t)jHC0Rbk}vkh(5!Lp z@#}V26mFkIA^O~>Pd|Fu4C{5aFKtKpyFvhbN66!hLgi`tG-sj|B3f76*=ah+UY|=j z+fIJuqzR_&37lDWuVd^WH%;L{zkucTm1@X+gM~S7cE@Btll1>9ouXZ;s4JI*Sl=CA z7b;*!ltl$DY`*BR@NIdBjGqly3zi($P8=GHA!4!8h%V(cm*D8}Hy&hVHRa5DEbVS; zystO-=Dw50zaXMM2^_w=~~am;VO*ZqtJUYqg%dFeC*MDZL5P^t`z<_EE?$g~ zTGWqz)tHEH|EtA9Ag78^q#bmAz6H$B{wISK5s?u)2Zu75b_0{upkAbVe&@PQwWqsF zCX##+KSAX{64KZU!`grN2yaI5dY7M&ijeaL9N<4qM@ua7J3BkDBm?I47H11x-854P zCGUl>zMIWqygKH0-V3O^wq9O_hGZJE_Z9L$#63a8TsS={TDJN4B#Xteva-r$=Hk;x zK`b6SeqaO5%7MsZ8`TF7VR6%$w$n?4i_w{av-9)wD=V)8;NCq~9(jHio&L(3bjZT0 zLQ+B9K*-1&O~a=YmYy~zWcGcy;V`{c%BptQo9gfH@9;X)0f}}7JbW1oSj8wwei!kviJFETF%j6!`;@pR7x za0oRuOW|#Gb@eOv59!B&tD!tjANiwG#kW7loq?w(Cd6HTp?yX<%Moru6D>)3UcOuRA33;4aKZQCTHIGzcJLS_h2Ap$ zCZR$7d08R*Sd|w;(iur&^5UmxiozS_E>T(e!)(Mr&|E^h0E*dWImp7{%t!uJLInWuXS~G&CLe% z*+$Sj2Y0tGVAHr_7%bVCrI#sfxm;77xKo$f|IX8uDL61U!xitO7@ri^%K7@WHgOQ> zXN4abf3F1_Njg{&Pi5!9r)5)b2PLiw&f#!h;=Xu-(&X%@1LF;^vtZ(wTN(;wrV}5t$dGV#w4J2d#GgQ z^0FEc09aHglJXVUqQ_~yd@|Rt*1XH~+ct|X5PwJnP@Hc}Rb-rgYO~J#yPNs|LQQUS8V;1R?nar5k z*huUtVJCp&-`zFn>gtB6S5NX`<>XwLQ(OSD0+VI|rGzgr**^#YP;aSt+_wK>5oPY~ zp00F|ecd};tiG}yAJg>12=N^m9~)y%yO}(r&M9*81N4tWDLy{kH?M}KlNAYgS!QU- z{eV~-_K}}OOsv*I%2!IVY>kN}24NM<5~`dm5C{iop-TqA3|Hy<-sAx`?atxGA(`mPlNKGZAt=0UMTn3_`V_wM(pl_aO- z*HWKJ`|X0sgn72l86j`kiq{xX#J59VkY9vh;Kv$iohRdXj}YNeUxbH6nU;9TggyM> z?$I=QhQQ2>zxg9|TWY%%6=nKUV7uy%R#LhcE5eYvw=^2j_om37E<7@?o1gx12iy`I z2CWm%s*EWki=V6yY%RaE>o@{UOOND3W)F*| zY;eQ-5h%SH)Lh$~(+ctTVYXBifa{$e2eZG2A>+iWQET^EQUFe`Gw+Br0~D@?5nhHt za1gf_a zl=*V_hvyNqTSwhg3V8XL^qKZ<((T#iZ(uh(6oJQhm4y z-NhM&1@j%I%Fff;Y{?sY6k|KLLF&K#d&%!}G{xttMzuq~P(;5rWTLrV(2Fgn3aWpj zlWlYz2|+%oN`O+E5=mQO{*2l{oykE>s7iM7uuCC#Q8OQ~OFu$?EzL8#q0?!ksL_-�(H zwcj8@pZz^@e_`I8+^$1b>(-Mzy`K;l7zLlo7lV{rCp>)cb$9<7I6}e?-PjRCgL&!u zge}C9urZf}Y}k^Cf?iytF=^_An>$xiUz}~qH<4U)2rMef`S2Vf`_z_j>QIxt6!7Io z+~+-45c*vMqwMs*(;39o64D-G>*Ke5q42vo?z6bABPAo#eG}D}+pWe}sCnP& z+GYxL;O2M*vQ(j2+=L&FLUG}Fv}A)vk(ra3xz@r3VKbpxlCJlT`Qkpj zzDH^4;f@I&ZA%?zgzve@F96nFQ^W52c{4aZo~26YszAg&()>a3?2aPm;~k)6kzYLj z_H7^%-w<~qYnq3DTgYjR+2|{JTG3N5^1SWD3#K4@X@l1^$(rbi)O?J#7jNDi#*Bh* zW4;k}ME;DuGSX|aP|Mj5Xp@!h7=unhPce7^=tb^5A|D?G5HX@i@Nm2IU=3J-7Xs~e zxO0nTUOvQrxH+pB8B|VVE;;}6TM;zxdOib=Wj6dv4jc|fE5r=0kD?-m{E%k0G)Tgi zZC{l5XGszSdvR_$OZ8`aJOtZ$qnm{1eYo&8iPM5BhQ3Cp51msPGr*D4AYxu8CDD=9 z%XKl?c#rMxr#HHY`xd$6;UzCG1}?@=k!x=kW_E;%nm%b3NX%m!e}v`=I+sVIA5Akw z2yf3N#f`vz3*!6O+U@~WI@hbur~RpKM^hO9npsj}(GzHyANGkXR%dRGQ9Y-uQsteeVMsbZ3OPoTQI5hecUL|Ft;`!{<1%yAP{RXe+I1E54AJC#Hu1skEXQBV3t zZJ_d<#sfvZDoDg>@o=%RnwebEDtsivxhkGYjI_L%xyhpE4u`a{)$4k?P%1TKpTI9Y zN7V9{+)kP2(T$@+G_G8$-))^$kq8*CZ6xCoV0Nzv+G4}$Sd(Or@0T=R`~+MxQ+M7fFd*WG%Yie6oeC= zO>@C~haFAgKy&dENbWR1T-e z;S95mHln%^IW5FX45SXfxxrYCSp>Hrz6D9BX0jJ6WjqXcD$aKL?*hyTD1ybE>0?H} zpmtMtIc<^zmu!rNynOkW4I5tEnG{Z4(GmxIv@@K~@|WrYpGI;G5Vm|_-9b+gaiko^ zU$#@#EogX{n8ZxJR+sc<1Ettl3BUVK6-ne0zFt0U*S6s`1eaOPV?rw^R*0BA2(Zps5Co$v$#%nc9nXA*m%^Zju;wJ0O8!Q703_)U%_`n z9jwsEXDwK}4NSDqofPpeFatJOVvnQ+{+lbC>b>btVzP%|=XdXlyr$F&c~FBEp>=C{ zH2mJ&@}YE$!0GgOS0#e+{O)wUBW=gIhJk_UY_%n+JBa?dkLL7{dTx4292wU}hnJ=k zQ$VHb%EeBAu8vlEPUh0Wf}Z=`7v60k2T=+5UbWWLjAwBb3cFezE!FaG<5Npg@_k^> zDYE>af#-H*k=2NY@57yK3cb^76Y;mYO?aV9eUZEc#zzPE46On$b|iea)?}R*Qi~GD zyiFtFt5>G~6B|$d{(7Bwu8Y#oO=4!xvMtwnBSzS%UBjn@bL%dSs zw~3bdgZO36M`ch%%aAio-&`K#KFcdyRt?Wbj?_*X+9A_+Kd+O$1x zzmD77?H=zrOqy{$ft?eF@{!H3?uv%{H3ELOTyLTIq30`_x+G9U4|+nxhoF8g8b&j2 z^yVS4gc5jN|M|UN@$TdY8J9&>3yCO?$TkB5!<8Fla&9i06$wd>eWDvs76-XsZVh0- z1FrT#@(ccV7tew||1{VP0S7+bNA!q!ot8zD+k3WFsRUhe5?i^AEJ`(2`1oq+xdo0` zXJx;16Zln7g{M7{O_&D7107k+42?A_so{wbVgL6a{ts*Z-*dT9oh8B8y1iU?Tk^C< zd?k3;DFdeo8~mFrq|`G{PnQ&u$DUj=H)09*y>^?m$Ra+{KRI0NFm$dgPc+w24l#Wd zt0Yoqk1LY%(-|7Fpt6`5xyE;H&d1Om6GhZPuWr|{Gr*~^F0suY+lBM4^QrO!xKLqg z$L;!*g8}PG<}wU2BEzPrs|c!c;wi= zrRe%$-#@9~rg?|k9X=iWz3@Fe|3@`YAMNU)T$YTV;*KvB{&cDN&@8ifIFpB>tVr_!9jgj|u)1_=7 zzuaO}ecDGb#yBJ*m5oqleALwwjHk)b@g}5MAmD?}Vrc_AsIzhYldd|*wZhC-W3p?) ziMfcCGb7$_oC$Lgr64(%M-7E2cnWNNjYD-c)6xr_ZF93wZx3Sh`#@`}N2kM4_$+_lXK&^m3Ih1-9-L&9*UHoByp{@Lkv-z72rQcEq?G=;B0!=5; zVQc8FyLV&^-(XpNRTcJ>-zrWFLG^o`4#iJZCU#@@YhAn*ymrVIGex8Pvp!)k+GVEv z>a!ak{i0zzn=A~*HI6D$r#9O>Y~Ec)q-`YxxV=NkD7&K@v@sT z=r)!-&i0PT^{(=TPoJq4t%n9p8J))UY-mAU3USO5{)JE&$F$=AFIoPduiJ-m|e=E zDhC^?G>`aC!6hGFG<&=d43)@nDssPH-~2A87X3Gp@sqouGU4ghum@kJzh9pTGI^e! zT4<+hb+7T{&)Y>|v9Qq1o!-Vpo8Bsm^Xn;$YF~5CDtui z#0_5!tc7i|@|5hf1Bga#ZnGXJQm?6jzIUQl>BI;vjkIbm@WztJF6JwM+C>%A=7eWQ$qa>Awvs z)9F9?2pQH9G&+~b#?*cJ{`}cknUh`NA`{AS*aiW}5QN^;F>PafC005F%ZNX9iHPMT z2;WP?J1+C6%EV6;)lil`Vb%yb*%0Du;IOePbug4jKUAB9yQXWk3?5zXE3lL89LU?3 zy(itN=SNQGORr(J)6q$cZ_f}Wn|T%u5rpesKjD{)%IoE$;a*G6lz*bCA1xpVw)iNVP+~&Z{Kf9tb;cH(jgoP}v0iv8!C`>+3jV z9OPLUHjivW&A`B)0nN<>Z_Sy#?3@Xk%l#h72M6%d-c&vyhC>`xG&QFIAfl_I>-sIR zb>z9&uIMzmP-2y3+v#8wEpne|5(Zq9lp>4>L1f(J`EUd1S-uE3=vDdaYe|cns>~+&L`(o_wfq^4X z(I;}HXyQ(~{B8@xf)F3f%&e_{1I1Cf=Ol%a0XYJGAAFw>Kmk@mU3K-d^)LX(K(TW|069MELJ20R-*#eyZtD_p zyAR<$R`%Jcc_iwnFNo3!mD^hJU#$Q9gT?F8-Rf%Gb^`i z>JTFALoXi0l6g?3@YpUd*=~;80IX7NSWk?B09YyDVlD<%KmOJyP^R+4_)gSEZAy++mhpI1c5HJ8CDfkFlXvXEt(PoF+PcK_M&Dtksg zv8E5b_izAa)m!uoHTfDEE*DA#@p~;#6-p)b&`1U3NZ8`_1Ii^(4SW_ca8d-GqI)MT zP>OL7rJxrki>#^fvy^Q+PI3b{F%eNmY<}6Lc8#>q#zYuV zg=eTIHKWnq4WWtX@CLQGw-!AF`AA%?Vd^BplbWFBlDki|g>1=3x?ySn?Pv|y%gC1X zQyg8LIp$F>nERTrNhTjKp~0R`T)<#3jm3XWR`6aN34fyZ;OsI^-sm?h@_j0Y{r18C z7`ze5WM0G+r*c}+UeqofI9b%4!K65bvM&>ZDeh_70iOF1i9ominLcS3PWyBhv+KFV0_1Y_d`R>F9YX@^8xjw2Jn>gXO7rUw?mE zdbP9l-ycNt&=^Z!UOlBbO*U9~-q>5dY6sK(d89a^=V-@pmN@QMNqm>i@=gCPCE`Er zMh7G58S6ipeq81X!L%7`>04mcZz8cplb<`>M3*V|crY!`x~->Dz+P(WYM4Uprz;kg zzn7Diqr?8s)PinBlSqNZ=oiJ0{=OuFM>8;pMj_}x@Kum-uyabDJu`-t&FWiWuCB3h zyYIDqN;Ha#(n=u^>efCO?P&l(CPp|r<>cg~#(mW?|NZNH#TQF$08A5Tn4-fy`ez%E z8|{H2Jx|dHM9Me`wULg*>5cY)(Bp-&_5O`c;=+mXX}!^tR|u;#kH7K8OW!Ps_+)umXoc$ybivL{l;i!{Ppq&fH)O z`BKxX4}7^IZrjn(Z7-z)#SufPQv$=PM1bLx#p;Y?7Kp2IYUR}c*80$_^j&7qGx235 zB{V?mDLe1oYYZC6zy(t|AZR^J<_bYTyrAVax0x%;t=gO!A{r>{uxp`9~z=Rl@&jzk@ z5Up34j;VZGQ@M3Pj=o^RX2OWu7FQ+L*Yf?AE_zAJt53f}fYG6MO;J5twMXnXHNMF= z`Q`uHE2=y&^k}UZ^d|r7R9J}TDM5`p6Oa(Gj@H0=^FDfAj**_!g#W&`ig)0@@n`ou z++{zH9<*vX7hyh6ZO_Mn=8B1eJU?49C9sNZ=v^|7C8*ZTNoAy79>EPrp2BFE$}T~5 z!z}r6;mG&cPd~1HZDvXkVOhLxxUNmMK7Fobxi5KA@de?f=_PvgUhlHPsb~G3o;LqM zz<>+uY3Pvk@AaN!!ngB}Nk!9biGiWqV_Y@v&n*}KQI&vI<1%aKw;SMrKeJsc^vpei zk7cl}CYhEQka3xb`drZO>OB2+abl;r5zBXv+LN{%56b1#HB0?}3fY>tsV+k;D>U^6Ac2digEd zdsBr^KL!6ggf;~v!2PUOz`#BGkEdQvZTD!oo(X>7zgK4l_@Ck7Sdh2k*Q=|mn>|5X zguG*=&Ws8yMESyie^PT1l`s&?Y%gcntq(R^DnIf4J0RQu5<*P4nuZ3RyqX8zk(?TO z#ewtYV8te*sKv)ZE-PMu{;zb};CxGn@Ar`zT!STC;NY=LfgoE*{}>rd2X@@qov!#m5 zHLt=h>GXBa1bYR>Kl0hS_{vs;p;2`#?10grA5ero*U1o3Vl2$=Q!=gm_+hLjMoAO? zsjZE>xwv=>sO!9t;g>0dl`o0pyxwZCJ=>_9FSmrgd*(QuFNDvOr3i>N-seRnCBJ@s zi-T429PU&bM&VKQ+YlSuB+#7M=vi9+8A>QAkOHDU#GOVXY4gEFa(03+4(+pF-%Fck z?*xd0PP1q~n3TH5!91Pvf5uV9>OyJfx%&DC~E5S7XmB{?&Y>C z5-Dd`s1j^sYAR78-@4~>pwoxT!$mgs3Av9fMk8I`e`NXJJ5dX~Rnyc=V&;1d=)(IJ z{O_EGzQ9-bp3)rF+dWG{aF;HPtmAl5uM{es4~y$HaJ#>^*eO}qpL>PBQX zKrV@ulG7bx^Y8Eo&f-qT>p!mL{P}9i;)f*iT6u2AReKA z%xZwiWhp-gM5h>=jSOJFz^nZfr4b|kG0{Lz4Iz|8cA$hj7~l5vGep6T?(t=u`%&#` zi@fYxU@sjeal{+_mY@U9a#C7^(u)SCM_-Wp*WOU=C1B&CLf(38EG?n);Es%pOpUHI z`dl`>UoO(e6*LWbiw?WH*um)>?!3DkPNay^mSWiKe*|(&;r1K4sFlSPtQHH;?GeC$ z12}8`F*>i2-^<`LlHtu90+Fr3m;y)_Yd)9%?AngHQ=nD|xS>=}S8xBMF_jbubtl-r z57VxGG($m?tL)>#1}-f0LHox6DDC@gECcXMearX;Kx5ZW7}g0>0wYnMTaiX71s#@- zSAddrN5F$%yo7<-b8E|1*xn>?%w3$Q07(>n4k(^=rfn$JK=iV#8D)@GR2=>~G_=;) z$zwfig{GM&tZiYDw639|G1M%_;2f^aqzS}@NS9>G^!xdF0sxRS3>OZNNQbnl=t-uU z0hf-7p;6?yITKwL@82H*1S6ekk+xsL??(FdVbTYI*T%hO(oyMyaw|GIIwmI7+keZx ze!c7)hyrRG`kj>9v6U-xbF#`3+}QK$<1iAoninJl3ZhIdZ)o+tHC8--E_@&zm9yu= z-}}Ai3GvW$2oBY+HU#24C3$HX^@}*2tNIr>R8|6Lmyw4Yb7fh7e9HCkMpB=SFy zOqEin>}|bG?AiM` z{p0@O1gk$RImlYL+cH0jqDPAU^j5BSpN04F1DQsCZEYS3!{1*ndp)dJ_hnyp(7d@Yh{e*D0Hc6Kh4EFXYdUB)EG<)tQKNA*pEoMo9(>EVW zSW15K^<4BBswXl!^jvGFU2ZP%Tbksksqe#g_7oNS0esybK3}Lv+EeEYcuWJHZPQxN z`-fmdZ@WNPLc0_wuo?L15fd}5(o?O6?dZ>VY^i^Dmf`DsF%00l4O23zs^b8`1T^>g z-;CBXw5+m3boqcY^YP*KtRw^;=Few4Spp%l<1qiS4bVl2Q%B4Bt1weW(X-=Y|E2HD zguL#1Q=g(^wCguJd3agj4O5Ph=1bLm%$t;H8&)79Wz$Y??ZG!U$LrPN()MNUn3|WX z&I5|^Kv2wg{?Ykra4o)&I|RZgI*cVh_=Z{{5CB&^vAHk)b+D$b^aKSN8fGblQ!TYk zVsiLG?*N_umo2Y8t(1_EA-x`R?bXO?j0CYVpkq+*BL4pQ4eb2ej+-+PB*Iq(QLhOrdC0QFT=US33wXhvY(8Q@kJWnnQFPDe9YYhOuu_B$oMMq;=R2+^}aMB zkxEQXHeyaCsWbokz~J@AqJ44N(C^6^*KGy=F4lja4hR$=yp!y4scW2rl33v_`Jh?m zug1@m2&GSp+U6?)Z0|p_Q{%qmQ}+759~Cwnx$oR$_p=9`P59g#f85P~4s2l%k1nTq zJ8+&Tgq*G(^3MTQ1WL05pv}_BD#S8=m+evdPLB)wf7&n1zFjR8_kmbBF{yhhNp4)99AaB8iZ$q6{>4O(Q~fV(R# zHZAe_#beljy@b`cL$E6-sH)z9$M#|y6$7tG7785zGE^lmaw(vBk-@ZQ0bueroV1H) zOlY`FC=v^E$tRnD{5jfes--MIXBe?@aFn}pDg>^zni>I=`ZhZmh;uQ&epwMVC{aKc zc_Fv)^h7}oQ!g0-So5#WXq){v%5#eQ5B^b}HbdA}gc+|)>1m%W~n{OemE>XT!c zs}z2RqO+irW6x-!UT80MWL=pY>AfnwGl~H;K>&28CwJE+bKrs7Isxj!ZMF&kz4X z@ePHDuMDP8wx>V6Xm?X)x!7`RUY+Js`vuZRtUXSmOKW#c>FfIkxXQ}jD}+C!%WS65 z?&E-Q(}LwPrWg)%DEfnaI5tbn27=v7_9!XORizI zLc~!IZRdC{;>fyJ%65`ljaj(*a;oP{{K4W0gT<66XZ{JQX9ei*l(Qn@HII6Zf3y9kxR;xD6S)=1fae-=qQ zM=Nq~$`)vBX(@dNn75+YRLUU&Dxgr!{P`or4E&*W%{K3YykAb&27YUv&=Au(+JX@G zBhyD1?f^Zbfq<5Y2@XRpTp`HZ{1m30szSn`+fDunvk$0H;CHmq_`hU@_0!cp+NVR%x~3MLPa?~9#@*mtqxu@HZ=CDJ|EesX zbjhhOIGDE6DSTpgi$q3vCfeKq#yHvw;Pz7tyDl+9Tq8E{WBZbn1KiEl<(IW4sG55c(gj>Cg;ai zoH@!1%1?{&8zi0{A8#_-wwI*YP`?P|^K;nSoEvtQ48c5@cZTbmV@9a?x+##pX@awe zy7XwGC?{9BglmsUF4D3;Vn!s! zWvf3T-6NDcPvu4ApO`&7U3qyCkLa1XImj0WSs$E)Z%novCGA+wG-HmEkuh}Qq8L|Q z{81>JF9+Yoy9D8$x;-V9!2e`#UAoBZn;wk8G`ptO3)^|raDV#|E-x=bFF$}qn~(yK z&_Stq8D;RT51w2th#maKKT#g1J|V=5hLYlnd~G9_XVs+9o9}h* zi8tM{*i=EY1(sH^`)&qbTO96JdPFW%Dquq626QU%i0FXZb=WR1d;1Qa6{+-z}?)8GgXvfwH!w=5X)0Ye<#X1&Uh3PDugzHhN z8=AM$n1=LQqqr|Wv-N?FL^TPv+jf4M;Y(kSCL!N?;8Wf%DB6CH&1ww)|5$tLxT?0V zYy65Rp-4-IG@>-pozfjr0*ZumgMdhJXA`$|EbeAZHknTQomnitoB4(%zE{9LTvzv9$A4JIqWP;P?mqs* zA{Q*Ds?=N&A3XG;gCvO*ch#Arzp@+a2q`!OEF$OB9B;Gs& z_$&O%#*}!E4h<853ek`KPK2=BCryHIiQSFNj|a}POlhHui-aM2_ledh6*GfrWb$N| zp3R~cxt!=Q;=fua>azsE-nSwtnT4UyRdq07h`og2vGE`=lkv?SZ~88U&yU&@2t>ro zSL^#H8JCqt(Pmn&?tUJ6N0fNwy?uGAG0*C5fjJp_1oQhtR&{rD)Drx8_HfatG*h~70cs-I<GJsbD@U=JA;$ls~+terZX66w`z%fNb74yO+Iin_&yv{l=82Zk|D!< z!Je>0)jaUp9d;lhLVpxmqbzZaLLaf-vev4xROpy7!Ypv3ke!S1~Wng`T8# zYL|tekKWd=-~L+7e>ZY=Yw08&6Jg8d_B%{VrluJSZCxEN z3BgF0>v9s)bHiwym#)WYH-U9qR9Hm;1Ikoe)ee^)-j1cVy4RE9q$Ygwiy`fU3sjK@ zDPBczN<%Dcv6n@z>&CqiVbpY~)y(tby+{qeEk#a% ziV6rx@f zkX*5HSEi9^;DmY*s(eg$Kznv8I4lEwHzY!)fu;G8KV9VqxSx|%bE_aOSV3@k^~5i; z={}up^abQQ?9NFCaChI_F`n>meh#Gu0CzdaLrFBl?*FHUN@^MygkSmqj4|uCV-GZ6 z*thK(9=5m2M!Lr*R902F!+&n>7rdEubw44u048jPpzR1iZnBHJ*+L)3&(lPGbaU;@p?6kqj%L$sF+@j48!UD;`JF$=Rf%PP`SWk* z%a{{E$4XRKoYAfaF%ZI{AfXSctx8KvNvyR1`{Jgh zw^%7MfG#00h?Ve-KMW8%eJ)G9ysSzi+GKUC^3P`{Rc7k_C`k0c(6EDP%MywR!LqV= zAEDVGLC#%T0&SbabS)!1e`T)VvSMUpBww;uP0bMJFRNo28ufQYMNzjyF`%w*)%k6J z_MSD{tpBg1riU%#E=ZXP8YLH(pSYxRa!-uy?_Dp!cj57M$}xV% z#{ebb*Sn5Vl40wM4v&o7zOQkV;h)La^S-cJvRM|}yzNBe#UjBzWJUu?nYEvNKwEqaydVoIUYr|Jfmyl52!k<)3)pVk+&%+@sCv9tE?6|@2&oNX5K$AAgRk1 z_(&;J-iR+*G4t+K97}%)_R$^J7CHh$ZzOC@)z}=ZV-Ygnpyb7@-AYW4;e=TQD)i;0 zrEkf?9*_Ml@>SkKF%q;zj=x(1VIpuCePV(9Re|aV|5$eXz%d?oqX1D`Y0D~ZJ0;N3 zr==mlHOroG`_kxccJqCyLBV`6*L2#Up`lm9DNfG3{WtIKgXafKtwj6DD*I`nRTprs z0VoV8nP~NUU|yj$HyiglYYc^nRXc8u;?lhnDEX50>`v?JvtufeN8SD3V2Xsc`KYDv zVojLTdvd*56(E^g7v<+rdwOTnD(3nXMw-HqD%OjYUJ9GR@86}}TCZ<~hym7Kphrf; zNtB)ZIw<#`U4}{PP_a(W)C7(iSjXX#y6s@20ZUWnsz5RPBw~xz4ay z`uSgLA(W4`Ge-IwyWrU;QCTE%dGu zRn%;mxx`4itkrxZQt1ZZL~}uC*TPAkl9E!wa)W6+B2B-hg{MvY^=8%*R14@a!WR55 zTKooOcLD-2-u*fvkufna@LC&W911T5J^kQ6b|N&(piCSt}@3 z00!_GvT(g+=x$nBTMraGpeZjem$AbDsP-}t5g=FXdV>Hf1y*x>*kx~^$RI94FHdL6 z5p9?L@Dc)G|3TdY)@N*Z{@>gXmZAg4=0Dt!OhAtRcNe;^*JpmtoAItGl)Z!Z!j_n> z!MjH04)5PQhj?1I?R7@JJF8oaf&FgwgMoxXCv|N_2dhDD)GW8wQlCHgOZL_52R#SD zI?0GyHz_xT_Yvk4*xp~8Ms%j@B+h6OJ{W6?mzXqYP-z_fOBWHMrEh9q^CREqY#YTa056OjUL-=kBmgZzk=u&pmF(?+>ucf$Que`^qOqO| z7PtGR{tC{aNz|^nG;W{v^}O0AWOGl?W;uZ#aicISYP4z!i)=zv&y8=NMOBEzZ78j7 z@t^jVXTOluR8kNModk5u@`JIuaGaQ%YJuB!)&!%oHvTaDGCS+9Cj>)MdY^E`+}MG% zWv`D6pkur3n29H0{whaP+$L>NoK>$;`>J-RYwk$R(ziS!_I*ZKuQj7>b-CNwy6Kb? zmxr|J?6oKNM{05n%QE7(@?3U$zi5!CN^29*{r#09~IrdWDC&nSW2G^LT zSLMHmiW3q4#-EYEszd0AC8vkpqOmV<@$e<%@K;^Wqhwf1zM186av-Qs+s70e^oMFA zfz^a)i@eYnSNLZPw$~tXmX3x0d4-(|5g|Y{uWg8^>m%p?rYA{++okb$VUn(tmvhJN zu8dbap}R@-P!E=Xy95J0fP;L@pqq~b+%-(!6~)){RG@?u8LPbrI) zE&Q{8*G_W`+~b01?eCHSFl+)tfmHK1%>u|cK(s+kyY%XTAF=fEGIZF0=L4zAb3qOX zpe9K;%X8G#2Xkhqe@0#Xf4C9#9~MvAb2n;{KhOAcvp>&35qEY!BH&N|azjFXAy`#Y z6l5;_-72-IRgps1jz3JF-Klynm$ncbI{XTmEX3r*gbbZ!cy-CjxAeQ_S5qN$Yj2gh zzG0-MVU`uvabqCUrKzj9vQnqr9DU?Zc?6mbtef-S`h9bmQ_iZAsUFv_Ygl|0$S2a95J}Y!bk&8ZP-=r-U8l@CfAx(;v#GmX-hX@e@-#>rl zi=gAmLHXOU$ScwSHpWgq)&jfOnri{4+XSzVgS@;Evd8IwtjB#b6Emg>_()JDCgdXf zhG-w~+6%!UDl3uYJOBx)|0&`#gJeF;4 zX*EqH$GAZWvZ?JW*GM8J-0>KNNaXwfDx@Vx?|?cjXmf$r)ZVh0n0`a&6Xz&dLIgXP6G#-RAJPx+iy!uk+VK^-wh4U>a?uixb&Dw$;C)f#^5<{u{6uyD3SE+la7|+yuZEA`!6l|%rpna23R?_O|6|j-fHq0`@xpf zRZ+ZQR3Yfwzcc@7ap#;oa=w45dF;1n6PEnZ@0njxS~8Ne=C7J4!t%aPw{`+NWq+c`X7!JKren_jBVi1@H2<-dS@Z=0` z(E^{0;~DuirE}6cwOS?uEPman;CIAODXqgel;;!3`PC{k+9ovGD)ia>&V~rBJ`(MB z1%wIJWkm-px5`}ofRj~QTibL`7g%9ugLz6QW)`q4h?B1)q2jeOUB_?TR#t)J$R-At z(Odf}t~0~KZlFXOl4rAVKKn*?n|t&J2rPTtx2LMD34`N`4OwSPH3U2Ca}a4-QRPyr zLOa{rjldHczm`a3p_V2jE4w0uN>K8pNy?B`FX%sf;^sPzxt{VASY^7TEx^#xjQxVy zXk#r1jx;O1Z`TU!C+f-Mv3^`4a~o{%0kz}?Rt7@2t~OoF_cj6d0m&UauI~orS=IXO zkL+h_WjPrBp^<&-UAb$>VxD~f(XZiwcX3v7G7%Sd;fD&X17p`p4P8uQq^ztg5X{^p zF9A_3#^p6|C%K#%WTT=wS_bL~EP~f%Wtr#;yp)EZa=bHB7pfp3M_e7fuViRQv0)^A z>e}cs$_~{)5K-duq%%6MK$J>?l?-W*M!O6$!j=xI{DZL?F( zFuGejE-T6r`uywP#w#K;{H*Qm-5(%*pP9uw#N2ndMnN( zBl$$Pl5gsL2H69PeJ(1A5cA#~reIG2+ddZiM^DR6f`?(R0;nTAXb-bw^!(l%=Y&U( zhQK9K_L~Zj+o5@=&-5DMw8|AdRJxzWXZvQKTk#>U(hX`MbUk{4{p$*?eS-mNr!2Efc z>u)sDHB^n%wDFk+hbC=qo>HRb)Vs3kG1wMbv7}&EcmiB1fq)2TqONzwY5#ra*+wFM zZX2khlIMK9wZTykS%mPtX#Z>9_o6>;P!U(><24MoMp&0?4pySS_Plt=sfzd4RniJh zi#Z7+pS~nP7fttje3yDW+bEEC4evP(<^}{_%>$1m-NV-A_&=tv*D1s(eed1l%gWDo zp&SR!s#>~;pvxHN1YSx%8)YoGGdw7BUOsc%SlSj9>Z+ORjHam0g`I_uy$VbsUdO%W zn#RDPj`E!>f2=fey4MqR9l^qeUg&a1Y~II(Nv$)hIe)mbRc*nXnWox7jYTN55Zos$ zza<5**=^pt(_zXhiQYxFvdHasn8Y=t$mI^m%UA;_wJC3o6_5%8eDW=c3#1y?>LgX3 zbH4ylCCa`>l@SOJveKWjiyzX0#YGI6uzPoZma9ke6w4SwmZk_mf##k)BK#f|!$`ZiI1<5{Kn@1vh5K%MGgyAAvWVv1Jl zD|B6QWq15xzXYa}y0*``kPSImuZx?pe7Xp(eh3{Kb z7qXvDpB)w4e6B&-GG)Yuf&Ec@lrVq8y{VvUl8)(QUYWB7_lcCFoI%S%)R00eop+ky zt*7*)sW3VGOMq1$J{MJvwqeAu8F*d;`yb;Ao*r!27(e13Bfa&JZ!qE0e?-W(ij8G# zn57xg3FH(t3z1;`eE6S#yx0-uUT)@SZqDtq1Wp z-SFW+wycc>=q~a^9z2n{fB(LPMUE9cZWqBxj+>l<+;n5~bT-piUt^*Ch7?1&P}e{~ zf55M)DWiY56kYe8e*XdELd@@sfq?s_e+_jHK36h8Kemn4+42YdKY;^|idP9bHz%7+ z+ozPZePcVBX&%c+bf^39M@b91W3w<lZFK_w%W|jxfE*j2+Ngskc^qE6~P5-l|BbZwN7)J)FB=vQ- z>FCg{p!_46u7!fo>Y0x3YmB9pWjo*}F zvDup;pQakgtm5J=pzs3!2qIrjTTp&o&G^+=jH6VCHa#4K=6==13f5kWuIRw8FI*|e z$uoZdIwyxD;x1h8#wV@h7N?OjOFldLN^rbZ|A2mXy!48;^S(X!E*J*hDY^UyS|$ zqZCU-$}oqhDERELL^q-ZzeY{@w9LC?RD-(N*Ehn&3;r zk`Flxaig|oO>Krhmzr+|g%dihyy)b8={UDQ#%%Cq?Bbl*LW9QN=|!M;SLLS}{iP!C z8)dfQ9g3O*2!5_oU7qK~qal4$Il!M4V||B}F_2kI%jl@CoqCGy@} z->2&$$^b#d9P>XK-RH~XrYtunFM00R;re6$aj%#9WjQ=OA@#=cS`%Qv!912j+E}4y z+~Z|=ciTvYQovDyyJ!C`!#7x5yQ+=^2`N?ky3vDBORHB9aKBVZUG0PVt!TsEKm`>= z7@ZXKzj&4#v;GtYEVm5G^^fxplkjsI=6Zd8erI+f;@dZwO4LH+PWsP1(A`w&F!1WT z_hljVE$ABE!a@V>4_$#v;#b-Aqn~8AbS~3v{rhbwNky0QkO9m5I-xiIa1-sA%Y|O5 zqR6gKa<@Jrj!?A9J_QgS!3r-=njQbkN=WIhP5A7Mqw{CYGjE8xqL8iMjZ5a+x0F*PVvEUS4b;z)epW#sW1k7bz5AwctN zNsdrEf)bS6rMv=q8;omjVt~X43S2PJc+h0l1~cu9fw4v|Iz`Ct0l+DGrN&A$oV1L0 zRfb}m6p$%x1z1@dl-C?6H3hansk=bBK#+E0EuK|tZVZ;~DX7eSI&{?#J_B7^9Awg{ zgANF)_Cexml*(aJo-59fmXh+v>t_d?c*b2;Bz}Pe7xv2f1z!qQ`%_@=q7F*H`gwY| z_8r!LUkZ3UDl4b^<-OKRa`2-)AMWsDd#-m#G_hENJaQ^|875s$!LAv}aR{crjpAAj*nYUZ&CEHw9@S%_h~uVEBSU3Q~9&UjQ6g*Uon`BWRcQ3CRg#wAj zG5sPlhH#a){EP#4=K{a&lKMn8FZjY;3a1D?^E=RZJN9YHLLflH&Sqtlzjb=mx_ zfc0Qpo)So%fBYPvcg@DUKOm^P<2VZGcDoHK=YW!LUVfg+kBw4LSL6^Dy?aIZDpsR?<#ogAsIcatUwVnAA8wK8qrY z({PwkU*1K1=0@*C&TA`D54hnmRmsxH6V-8w@Jq#@GNZp|zqPJU_h1q!6(djAzfLW+E3^Lw6EEnUK1oaepSymWo#3*QYYh3y10{e%gKGNO1#06|abnvi<@pv{+ zHM19Ro6SBISpD$e^M4fQ5BU4S){7~aEGWu2)=w8g*xaDP0T=qlB_^JLeIp_N#ywbpHrthaB+rBr`*E2=$% zj>!I&^!V$W_t8@I+1XO@vNV52hoB;#`juF9{3jV1w&}MyW~%p29K^+uNjvAnWx(t} zSx~kn-DPBitqM2_be0kTDt`ii3WWYQ|DB+2w{NTcr`Zg*mkQ`w&VPUbfXuhv{%^|o zJad4GL*_+@m25ClG*fAt81`juXjj+IZzO1{UIgFeaz{iGSC7^nw)E8On@ETvQ2piY zZj6KKFe?Inq0p0?T*+Yl96zKT%b6*Id;@?<L=?-ctDSV~*EMDuX_re7nsk|LM%Wo#9Y`L^AQ*FFNAR-*3uL7yw$Zh@^`~a^uFhF7%CGG21rffmv{xa(JWDTJl@y(m91t?GAWfs&BC~}c-FnCb^2+KDo zuyN>8!!1ELTEy_P1Avjj9tGvC01{zGMhyNu(Q8DPvb!b4f=5hFPR=_k8{7>E!)Lb* zUC)PZgy><8InSsDCMK|tG<_E!2?P7RAGYh-d17>9qNy+U4-TLJeURs4joxnG^>>g^Fk(+LJhE-2W? z9c~XBwm;%*x{t-ckf$BqeDWGC-bSHt@swut>b@y!h2G8!e{yW>AtZsKZk_kn2XwOY zr4Nt=&vT8GdbE*v+dVi9OH{9`78+SzEpn%CMbQ1y@K|n`++G<(R3NtGqu2@YGY#=y z$F6ut2Rx%v%Z^*R{XteH{wx>cKGU#?(~0Tl=gV|nkLLulG7J8?9jZ%#t)SNJq@>sV zvNlWE?Z$k`onJMdh)?V<*C|C;bhCQLY)A=A5q22JlP?7O0Bt;RL2_81v zQ+O|xbmx~PhE4RT^gdTEAH9I}bS(i|e>8 ze2E|Jr~WiEYTITKydI($pyv=^#0qc8xhL_g_P~^8vN2us>_9e0fd};zBSPlw`ka-+ z$>4FE-{(zY=cE2y*nJqkUshErsaGJMBwBT%e(NNuTNWI~Ffqa9BVb>Ev`051;bzWg!i!nwZu@gQxqo^B`!{RJW04lwU8&c@`5 zYiFyh)>#7nbU)z}fo)VlD>4H6b==u0j?2n7dpkSgUhP$?3S$4KZ-w7I8T_PH7<|R_ z?XkCvDjl5g&d%T%7a|9MR9nFsMk61My}r6y05y?8rdh`VlzQPrYSPdq zqTj*9fhtPdQ$BjRlzwm0;ERT=HYo=&;4eaZj>9A zoCx`MsR}hN<9psY&J89dMpDbq13n9%Ed5*^3T3`G{t0(g^70(dSjP1ht(4%Il5>0D!7SG5v~6Rpg*z_ENgaZEcp@!Po2l{Eds5)T6}DG8%1U0s2->J^eX^ zh=i5WA%BnlB#SR;pFe;8UT6C8W?xSaU1;%dxn$`ADwj6@-=#bI`5qU(^6_MC+o|xF z`*2JX*cp8OvSIqPK5;uSJ;NB(7r&kB3H%E!7 z{GP9J@T0s6b5O&D+}8CRx1=7-(zvbrLkC-5*4^_H_0iTUM33B_+PcGso2)e6;Pau0 z+;ZN`jd|Cvb6R-0g~c?m!v-~2U9;Vghm2g<^EHXoLa0M_wk|A>^`j?8(5rusYK69a zH>}aa?QXMf9Ew)XJxsPYWvO$QTI#-A$ZBYvQ<#68ttoFWV?4_@OzcyGt?gEScDc~^ zvZh0cO&*_}bOTnQ@^C?T{EExKKyU zA=UY11PQy5LL-DwMvpqg0D{CXg996c6Pb&hOtSMw^6(4oG3`Q1&|d9(lMp41$lUh+ zdxq%NPyK*V>WsWOTTb0OG%^x*7xD-?Hi`QBr1;%xw&(-R;rMJcotUoQSlYw!e%fBm z)9rdHXpHNW))|lL`BxgeEX0fLN}eW)IjED9oy@Jh*c~#5$(!2wH4O~1-x@tEdS+uU z1^UTxZo3KI*p5GQJ|aW zXA7K;2#p*gFr%VN{Ie_&6$@kZkf%+V`T91ngk6E7qJXGrg#`0_S@u7RE}z(xpavLu z3%D^V!#tenrM8ni;Nh&s#@ZX^-?uO}!F9Q>=IbRMwc>X}*>se~MD3MeupfQP(|dR7 zdZ2wlVOhd@&EB623i^?K`La6A)b`U4%x5vs<6a+EI|%0akfg2{xO{C-6n^ru4_1Ar zUv&rV9gF!>C5Fq@csi*yw+&6+*D2*b!%sL6RT-XL)FjbJPE|K$*RJ!f!_#)d)6?4x zwkbuQ5j3eQoWMG|02kvPy$2ua_6LfESsA|_$HIG-g<{qngoK1Z))_8yc#D$w;y^%G zaDA&qo0TI2$+}yzlQ2Z|esH^Sx9N}uTc$_LwD8Vi+Y=k%krmIKLd^o}d{xD}+66J; z?}GDVq6&pW!tZl_8Rm$?W)|b$lFlD+o4>OYYlFMij#vB+&1(n7e-Yt*4?hT-ytsRN zd+FFF9EF+tBsN^?a~X+!B1EoeDi^36W)AJAoD_OXY~v{AYv$(4))x9-d7rKNZ9gR5 zXou((PrZAOtDX*DyI7s@_nnGT<437d{_PF&GEzOUh3H~J+i%Py(sfeo!dY1e^QZgi zw}R@O80oTR`1s-4TH>r5`L|s3bIE6NsJX5)MaOTIP0zif8OkJ&I2?Xu zu@}l|r4~>9s#N=6f@RpHYs$0mbbZRBSD|%V#O#)AI6C211?e^4mGBm%$j87GJ8O4g zA~q?>iIQ@?voyS)?3y!`I`Vy!_w4vtjvlA%<@1FqcIuhPygD8lP4~RB%l*x>tKoy! z`Wm?>6~%Mx_`^c$RCUe4-xIOB(>0|ju_4o5t=X~IgkL=oD%&nEndMXcmI{On3*V>4 zYBMtn&VDCi`7UED^VqqyL8S+0K@c~<2Kjunli|*>ImgUT^!n)Gw81=cHD5K`20K3$ zuE|d&-$ol{Zk%sl8m1Uq~y-_IO1#HG;bOiYtpBwk1dD0rq40qk%@{Pb03uM(4FqZ`iG|i^p~l4BRip^! zFyc%1TRjJayoWL+z1nSRm#-g%U!w2%SjP38G|xTjh503Lxz6SCCtJ*YtqIC;W}o6) zckpj`u-mmY)Qw5^tx!%?QyKfvcvcdRU_Fz8rNo@l9T{Tv>(k)5UU=EcLW0IISLA#WeEMobzBs@=_3q5Jo!vB{VXFF}`uCL>d!dpmP7> zg(tbRJJPaW(DZ>^ZI@BT!Zsab=K9|wjx7k?kt+)HJE8_GUA8F&E72!QT52pd%vmR2G(`hWcn@Zh zJQRm93+m{9xnj#uWDpP6mCTh%%IU?(nY`tmxRQ}}jdzlBRo(5n4#lORVw=l~qGY9a ze{##uzAe45z~XpaOiS}-Zu7dQA@;4Oydnz1tHt!VCc+$jB#Qm$gvGE%^7UYt7{9N2 zKaHNak%kikb%mYKbBgP(LuLP_aA+LwZJ9$r!v#y z+eh`Pw%ab$X_^UVSKo=vPSQQwOdm?CWj^Vg`b}6ELib%>Z@$9^W7tY5o|j6ZM_Z4l z=cH;dT6@KIv2lL^ohGzJ^vN^*yTiv^f_I1GKR@EEu)u{_o)Fg)p`GIL23fS?=EtMT z!up=xw}d2Qa*+7``g>ii$r=mXxp(ywcZaZl3jE?B4@4 z%;bkvK!J_)UhwFpTMP$ZbXBtAc?GcL_!?pw<0-^3Vo`I7Y37MvA66gX>%G+BdW1tK z7UQzp%=aODQhO!6Tsb1IqaEu)2dhEiHcorg>@T9L5e#^iW9a0Sj@EV(Ma~=_|1K}c zg9^9tv#e*&BW+nthuZ5q(O5G1PI}kdy8oMG1cF0SrWG>}gv@hrs|0IGM7k*3;6QKc zctzP~I4~5?I)rN(%8ksbslZLg<;~QAm~1uJ3=Nh5!b{MGJw+8297`pZtdbJd!;b0} zt^vwCiOUGV?9$WV|9J`a&GCq9SnTZ)?5$YVob9w{5vK4<{O9oZ(t>G0%b4z?E|x?k z>yB+B+&ULFXeQlXbq7|N@7^H++=J6VjH;gf_-0UXlfwWYrq9n%8X-NzTXBCQ-4Q^P z@Ir8C?77r^e`O>m3wn0H0&{0DZZg%>+=r4G045Q|ox=41idPDoRy*Emw+aS2Z65K9 zRW?7=d;jH*9FWk`B1CxL&1H8)DplEwx`4YxoyW$;1{g-3!Lh_$0fAM39M&1@efIr% zT(q|c$Y3GVnBNJ1MyqpSnu1kQ0G?m# zxwin-J$jegQKNu!mBswjgAA^Y(NGY8}ce@-k!o5`=|_a+G*^v}0J#Ew$#T*(R`7QgB`@yXg(ORGyQ$q|@G;4pXUsgX*GdINW)?n4hm z5QRGuKlkS-$0^`49zZ29DRX`dyaASvfpDT#(d@@te0Pie<>Uq?DmhH*@velU*MVW1 zhy4|Iq;j>H2estP=Sq;J2zt!a<51iKt9O($Wi~DEM|6KMD}(e6*fneCKRNWPcfmCZ zY9`qNu@61A(Kivr&D*J1{Bqlr2m+9s%mpc!fjsyX7pfSg$VMS;X_;Rh4xjHSkr-AT zKtzf@!O!xz_gQ&v26Szmo*lIYUwi#d8PK93wnPpOH@EQeSCYslh}2{OYl1f`t2Bmd zo0~+BvE){_e*w8Io1-)OK?oc=s`slE9!mp#?9(03_(wsAkfRZJyK$Zi7A#E<%)H|T$i(OG$z)SF#y z_}K9NJ*&95ssA~YiQXi>rT9J?FA3Q;_9lX?3+vqXs|KlKRpmy&?(QxKYG72uVGt!? zJSJ^8iSjj*?3QSP$w!lzaK&Q=6mj?AtPn3R0IGDh9T|uus}I2cpSOL!=L=$lh%8ux zouppOjtd`iI*sOip_I73Ds9ZQ9MT3Ben1}<1+r%Sq7Zm&+v{LU)7zIpBjRe+(i;3h zx3tRF%VT@0Cj2#%nXwqmA8`C?&3SU2GE6BHs#6i<;WC*OX^?a-raTKOa$1~QW4nDj z0{fb;_Zg@K2jmvh@us~%Feo%|UFDZCZkg~CO6HX5AFWrewVU*O%>ikX%9Ypf-1>?N zIH34^xB9!~w=q+LA7GG!;zqy$xbTW_maK%eo}L~U*g@6pqzRzN#m&Wz*uj$?%N+BZrB33ThukM>r zbCFlMKK|*wRziLCOzodH0O4HBcTpq0RF+dX)&eFJoCx8&HBkwYML6CM!}OYbq(al-p=97y zRFQFi)D--2TjPACotyxF1^+q}amH<(NYw?HXkNew1S_l=xaZn;=5@mJ*FQsdc3QHV zYHD03tDwa2(E7$pF>n$BURz741)Jm6*EbwZ+FF4dSIbJn1H7x+)E1q)FokyJv*q8< z=AO;aTIR=>jwQB7pi3`jT`2oF`*$UJ%DTv$9+P1sD*g zIf2x1W=8yoiIJHe!=6+&EQhJM7(a_aYUQJuzD?U60MHg+2J?W8O~G$hI97q|9>{^* zkKVZC)8QeU;Mn#axRj*6=8>!Dy-owqd#cm%bQ!OXJP{t5Do`^$%#{7n7K-as8Kf-p z7klB*5$jw;VO}1n$eS1)1k(eeBN}e{zqo?&sxfr!Bpkh$&v%pHz6XKTefhWML;8vo!34AM6AkI%mgGyb>v6$;(q%}aFh^$^nn$3I5=kOA1i^jvwZn0 z*cARA9eR(V`J4oo2ImB8G0VTrcHWJ9d4inKz(^QC52)uun-WBOj1mhPwvba%$TkyS z9a#ljtscnjFvQ!py#v#JpB=I3B4G&FSy@^6{1(Ia)4Q8FuF8(lWte85p%LKs5naz; zS=HmEB_at8Q^4n~R(NZ2WbTnnI_1;z5#agN^JG@d7_h@~&UF`#}G zo8{^4d>qjhGAfThvaBEfG#Wv=I?%g{6)2q(JTYmwdn9aRdZQ8#Xo`_7~$n zYTY&*sn!l&o#F6OmR+lJ>2y+7b>!L;Q%a@hty8&WqbDm0q?ez^;9iEaeGI1Cqc*mE zu&FGq4!~(AAf&AIYr85i3WkB;+8OHw$Ev`gHv=4La4h5vW|Y@nDxR#V5KxpkhKGoX z40u3w+0;Drz5@9zU^1l71P-&fU^gu@hazU(*RL>lJi%8K#3$3$UW6tz(@d>e+m~uw zP=4dQvCqW3?Fbeg@>x^S3x%1- zHjC?1cx`2oX74I0cjP?)f3{dGf8$?T!|=*DaEWP%x-(FF^NY^972AiwPT2_p z{%yNC|21)KLRJsEwwdL$QHi{C?@qUZH&F{6M}qeCpNkZ2uMM5@;Z#pRL{<+#JuWU;s43!gFNi= z|8YDipYHm_Os$eRUs1bqfH6+?FHe5y(>_|rz+0l7xulp}V)MnVr=W>vh@r^AUAI!9j(;ns;pee5Upv&rpc! zgG!@irx?hKozfTx-ed*9IWC0OavgBq@!BaZU3n57=;8)o^N^vFxc7AId4PVId9VV{ zOux+XFr;Nf9_)k4OPK+4hKFMFZ?^`dt*u$FnuGfeU9YD!VFD_1gS-is7jF~c3*ezQ zWHdKawExLzMEfN^3ZG!r9jpdGDU4SGwMqi^cPMeWWqXQw6On@fz)8OhtPrT|NdwK_ zqZ@Fl0f4q#tg>MxX~n5KfI3u-;D5aoEE2LV`*>yy=ho* z38Yt|P~8h7ZfPuk~#d>Cl-C>!qd-*M%$-3HzO z@>$p zT;Bn9dIBemIv0#&9-pePAFamZa{)TMb_z(znMyV4O!0?NqF<*$%3`me68uY2z=-G}^O z(#$hRbKy9C+-^fLpZLn}|;_@E=6RqehL&_n`rj+my^#l*OL&q!CytT1#n|-AYIo zaC(vQ$kLLIwKh`M@eIY`Ks=}0iUi*clo~Z0;7sUGIc7z5Jw16X{H&rPWgZPyA~@Rc z%H!J3AmQKV$iBki5A$DTCrH4Q#JI^UP(g-}SA+2Qi=DD;Dgjro6t3X-IMd4^SuBA{ zaI@6n zWj|emZApyfX&_=t6LM2zc;>X)p9KuHhso@N1L!J4L2k$tYfI6GkB_z{`Bf|rO}*d5 z$ES+9$ibC|V`ZQG&WA=BHxXN*y0=@d+===)HSkDotAYaHB3|(tUS8fukij~R4=u~% zxg&3>jz&aat5^=z9)N#lor>DR-BMFrG9lgu|KG3k*~K+c6W3lT%-Q3Hyh*v+2ZhrG z_~c+5v-38N8-!nHbCj^ZXQ(4yib3|x)RAPyZ;(}tDfc#T}rqa?i~ zP28^@2({p1FnYk;u>9LCabeHp?I)T+6TgT8TbjuY)Y z6#n>KKPun|%DC!&INNO#Wo??07|L@SQ366%WhFK7MU(alc<1BeV~DR2$)ds>{GaRU z441rJkSe21_ZlPwOdL*EeE|ORRShSM2J0GdcDJ^(>zJs8vg5Yy5P2-WkqTJ78gR|)XBHgivl#*#YJNzplyugSAoTLsp6NJZVa!2KDZtu5 zoO8RLyaq`xElSgCz=if^6o7{I+g9=h;{c`24ROg@&p=Z85(w54hif0MVSm(b4PM)- zt%WMT&&f`XpNZ_pbqU0V*R}Q#kFkoP=12$iPZKF zT=P?^6#(yC-+bDLPWPB`wRsx8ffvM?mLX+cYcjYZeDmIrA3@s=DYP*gB={Q-`uIO} z8I1WIOdqKEZ41He^+uk3SF4v7sg@A^^|H8>_eaVu_#o#@{PwvY$TaIsT7H6K_W?zJ zjuk3u{1sk!#Ni(;5Zuc@!8fdocJ_|?qH82Eg-!)?y5M)&URM8?G_@2uH}$9#caiQ` z%_#C(4rK?At}n5OI055`qJH&}XOe1qN0R+S)@YqX!&2nq#T?d#DbG}zpKDh3zhgts zW*tQTAFX|NRL+0gHyI7Imxf518rqYhE>Y1%8Y+rXT1q8NnzW@MG}P6PByDL)MM^Za zmx_k8hm^|my7=Aq{XFM9=RWs&&f}k)6W{B5eaGkXe!t$Y!5Mb-q=8O3zaSy-py_C$ z1JmCxz*r;KBg&{Xr5xjVq1FGqz%0^rbtlQ$72hg+b1oa#Cwu+=NyAV=9830~@+Y#o zGM*q!R4KUaT2Y(%&L{CWowcQQipe0E*IqSj=WtRMe#(c_pu-_U-&4KYu8kf<+mz_2 zNX@CtQ#zl+&Z7A5tu1EzQv~%Y4!SVPUO#wk)ck<3OK0M*z&`ihl6lP7Q&UqPkBqdp zx63JZcXz{SSI%Z(3{v%GRet%#j@iZUkTU~b=|^7nk4fX)9dgg1dGcPtihE<_*jec5 zz&ku=sMiY7ibX5TuuMru5v6@b`VMtNI%wPoPcDp!F?seJ9{odbzGzIRXb_UG0sx5q zUW`NDsx@eb2Wf)$c<(ZnCwR`=T>tTLY`0xcxi!_9ZP1`qwvJ%~M+1RyzOFWpruk^Q~JyyX=b&265~uhC6Z8HKv47E7bKc^7t=TwKfz`Y=qB?j!gyNrkhgs`{DcFH%m9ZXrKM@DaC&(6utl z4+n3^X7+yiBn6Kt?_W!y1tGhYc~%szkKNJyNkMyYqR5Hk3d1k~i5A{9v{5tF5RZc8 z+xKIk_oW{=P$$Owy}{{Kp8E&Zc_tUkIUstz0Y%K`H>xT;5wa1*xJ0{btKJ4<_`##- zWoYppWYfegq#P64K0y=rOq1f4ud*91%^}t_rP8_o<7IcO@&%m(;g-s>$@Lad{Zsh(bd zlOhm)R5Z~2?as%0aJW;~6rN-(o;1XtHDeKPJT^Y{%5zK>j4kJ%jvyx&$s3yL z-rQG({VmJn)ymA^8$iUE)gaY6;K=b~I^+N#Nb@zsS;IY+?}iEY7ZL6CQr@LECg(~) z)Kx3U9DJ_V&}r1LYasJhzB_!W3ch_}$QiX%a@%#ti9#!xtYvOWiE*fiv+L^?5PEv$ z_;Fx;pMgjQFQ$sm>QCsk5u;OW$0d8=?N4f^tMhY?k2_!3 zve8zd*a2D{Vyk8nPrFl*`4$J|#wqoMp?BG%{?TtT-*iK9^9vd39~&BWp-KbBen0=x z^K-8}z!y7nG{U6#>M(S?;^)fW>Sp!i_!3x;_(w6m+HBd1FTF^pck3MR@PRQYR=zg z4N1KzzvZjI;$&!kC!+BjY5Z#r3pjq1H?Jfd zQ-9X4pI5eLwYqSiEXAu9<;L>8UY=7!nKWv`yZUO=?JGGnBKr-cX#}RQF23=P;85W( z;2hgAVy3gTG-tlnH=OFWS*VLbi$OyT!Mqz+d@%lVxhJYf6+45jxca>>+@*GINlufi z6RR3%I1uRAQuCr2V^aZ3t2d{It`Avra&HdXLMxN?`|8!J?a$BuCX`S2EzVoPua5Sx zfdQNAwuL0R6I8p#3|$u=R8^sI|8khg)ZFm0MXY`E$PC-Bn_e-O!g(UKTBN2tHRb2x zv+BYvOT((#9^OMBl75&Ulo)4A9r`+*zDS7X?wS79?l|yIb%?12!ec>Thfr+p(hW$0~c~5oM{@^^f(d;gPRvt7Htz2#Y~De-1xop`NkK!P?-?H zI1w(4-a4lGPz1{391z%))4D$7Goq|ZYAQ}4-V+ldsQApOUx_j0I^>hkaF^fBcGKZ$ zKJA;tnT_%djtTO+U-y0TFVZ(Ih3(&5NC?!*BCf5;^xsvIsf*aF_E+=f<>oSUh;dl? z^R>rdwo(-tYkZBnh5tZYQ7eT6VRhv^p~RfMV^IXQZWf42YwZ@bF*+c`uAz_I7k zB~e?x${F1T^pqbZCIu&p6OMW>CPvTjrm#O*0BT87=vRm1(Rh~Aqg=swTm=7FAPSHy z`5l^AJ`8jg*vRt=f<}V+wb50<1dYx_&&nxf=FUWaN5$Zx1uv(|dSf%=y?Z*5_VL4O z51DaIo^_LWY0Knw^nSWVvDj{&Y%pGyk!-(x%B>%kP_uvB6%&zxU6a+P)oyQ`SLpJk zomt?QWWMLkGX>FU= zePLZQJ>&-$6VWFWd`QPb!z1rF0B!-N+mxK-II<$f<=#{JUSO7G-b%8oVa3Adh?Wrz zohHKEmlUaPv#_!CERMJ*^f^{UCd=nKjBd2Ewam4$*mrGGSXA`6vg7Wz z+25XpcXOO4m^amjdwg9}?6ltf_folWX)YCfo4yg_&?9R#WfDadjwM*!xbWlKGibKL zU5XvP`H1l9<}?bNOk|`!|ELNUNb0=OupZh-ipehi?n^{&CHnawP0A02lRfp}-I(m} zHT>WA^tb!iDcYD)cDez=qg}~0~c$O=$74Hnziov#Iv`8 z#j%WoWhk(e2{#4L&dj)SNQK#i#M)XUwx>(9oCNVW8ioWl{pV-5M2fX2Ix0XESLOQn zN=f12`0%>(FESMN6Yl>$wJnU}!Tn`|kFmZBV~G+B#JVw#K;?CklOt$5_sYkJUrfkR zLjyUoZ3r+#l}w0w4vNY?i`~hGQ`TQ@(;?KQ%R+202v!4E=c=?beLk5}B{QbftjYLS+AhWdeniz+5 z!$$OJw17qx+mptGZx8P>rV?lTe8THE4)u$X>~0y1`lQrt*r5?8g!5!Ic>*iX^z!mu z410MtoY$B>S?;lzQA-oI_h_U;f8LfJ6xM94nY;!-ro_{DDl~NxWxYL`fzso+t8U735qn zt?20L>gwy8bhdD6=Y(sItej6(fNsB$$WGTKhxjnX8~q_fIDhTo*m7vHCOuJUQnHTv zI&%GhQ4E37b2O6M|2l514D>;8%N#n+b582m`ct}04x|y%KS@3{1{2d-=mrTTCO{*| z+qRMeS4?nG>`99ot3RC(YPJ>|>nLh1gHSAxBIK2j^S+^HJUS-8p2%m^&sum}LR!ih zHY}%~=pc@=b9KwMOCJ;NE7--)T@*g(ORULw_C9?%kJx!Kl%P}hewG~;Ib+T2)#>4R zM5(o%fl@IiNkO!n*9M0)nxBfJzhNd>r_~BBaK#f@3Bsph;^Kywi^+MG?Hk=rd9VI# zFfFB_p<&%`cyp6Ha!9zexz5z9sh$91;Wo0gDjX|j-bV{WVz1S5-rfYLMY1?r&CJx$ zbIoJechf^z`@VNr}er5KN%T!IWt)Waz5vG`}-p{u} zSsD2t{*xgITn);k?IIcI%Ek=B_RkG|Ick!^6WftJ=G8P%$#+GQ`$(w9d#nk$C9g0= zhKdgvFUY_OCBs+)jgISz*Cyh}YMCWzrp{ksZqV@{p@W=|v;iN=gM^0eoarO}MM`@$iIrF`t&CHzalVYMZ*;VS+Hs0pgIm6^a?^tp*-l z0&MqBLpOO8@L1qB&!tI!&v&&W+2^>Mii_6ft++no!(ff&q(HWr;4muMXXgPY7Klmd z49=LVg5~u*JNs70Tj`1xceqgzepFQYr|v!7N=QkeBhk=!vA=K=4?DXnlZdWz=?e4p zm6)(9>a&u<;?s|~34=79z3H*b%R0mn8Ky1_8_B~*CW@=z3<_Zzn^)=)1yXX%8UyeH zYP_Y+>l!klAe}IBV631`PdTNmTjidwauB2|KET%Z;|Jgy`;{!a(9plogzf@H*KN*P zTA{Tx;n2EZH=^KfZ*9Guc^$ZTbQ6wr!Edw6=u9cX6)rG{`lnS-KjQR#Q8e~phe@em zs5d^AdItst{F#B==Qh_)ok&Ai3z4(Fk`hI2I|M~|XA5KC!Z)9Zj)lEuD3hXxx zwH&i*EW3xt=^?oZ_A3Hm@86FMSer=5#pskj#dmLw5aS8cw4MCIfE37_zrX(kOtLUC z%kS@}FXZ!1!9m|{204KbvzzTCfY<-8hi?*M96gShopdl4 zzp&xzA3pL#6F*`AaLr;^&!3WVnh!tf{_|@z3Ejm=Xc*U+Obh>Qe^am zPa08t6+&~6_Vdbe2)ZTHD! z4kl!ds2IQXqYyCK&A9ywJ4_77bj#pJR8AREe=cp(x2dUy_YJhea{ELq)&0!5NZ5ED zKPK=|P)2i|=4LvVb{|tQ1*XP=!b1MVZ%lP_93n}bXBS{5X$QN8Uq7Zl7du%GC#q`bdKzy<4V-eSQ5KKEzEfXyo zb0<1cbS3<_qM{-c*HpBRaz|Gw$TL2N@09hY8l~ z6=$u$CB^OsECHc0WH&LEGEJ%GO3+{1r0P8ki_A7Y7|k|$+VJ+wepk*!Fdqj&yTP|Z zHT&b(i4jVDKQfE;WqPAi$}K^+QNwyO9cK(DK*>DlvHBC|iRvR&d!+k?E%HBqJx&YT zDMch;L4!*U>ebPyb{)mjqb_!F z$DeP}Yj?wJW-WPs$K?D;<)hZWXSFQ8sTz;-4axP8w?;I4xSEl0^NmFyFay|f^o~;q zT9gw~Fru#29`9jmqo2k;S&I%z%(TR1w&kC>xj8b=@5FsU)#5IPx$0T_mxme;eG1y$ zQvQgVr|YN+R&-Z91+L#atk9Y%JiY&q^q$z8G|~#OU*VJr8~$vQ;ye_4oU2{#H_40J zy}xD|H=9;-Pg_(o!vOS5_lE0^l|ctKo6^$K zNG_FTeF2s+8375L$=kqtIZnZOBM;q5M2lvoIW_2_BMNOoTFqLq(yx40+<2f@l6U0Wd$R+_;HS7 zSDvMNMh-~akb~3K)*@x?mNmWKsOS2sf^0!bQ4zYSS1dHk%gbE~3YfqF6nu9u2f+BpWRHeFeVC%hg0;E%Aa;%OFAK_=X3@y5o_Y2zjQiK(cZ22%1rl7y z3Hzx2Tt4#mONd5pu|z@u=6m?u=)C+t)p?~yIgInb7Asp^^Nebr#k{e|c_LEt!{*D_ z_^Ojscn7z!%fM*Tj+o{zGY%`OnasYvAT5A1i+D!^^Vu%n9|+5sv(j6f{lX-mbBZ%| zH?BzPJ?vWxWI*-s8ZJRdLG&L`RT#kYuh_LCjQXqor9e^|-RJR-bq40&%r@1Ewmy0WIE zr1Y!87Y<1L?1-R~k^>pivURLk&Y_?Ao4OxXsaH5Bzume5zJYT9P!D;p@UiTo9UZ*=2A@v|z_c@__vMx2Ha6=SXU18)9wpIz7>3^ul!ym0 zY(1m(0WGV{(xy97XgFF63d)6qB9pJH9KH0Kc#AHY2yAkDt)Ph&@;l4Ce-#2iXSD~{ z9W^THFFzNibo@zm5%Va)k#px&5DEK6!0zRmffy~c*RCTik6Th~+$ATc&F*P-{o?CRO zr#Cf%&P+)sXTP$rzG>^D;sQ~Z=(~P9%$;vH(F$_@^ZNbOgAeQk#SS{on1M#`b4cl4 zn4*iIJW2QH0l+$Kj^U}N&l4(dT#UT|AOc)OCk08H1?%q33DTzSn!m&;L%v)=j%cSY z$h2sYK$sC-{EhtvbLVn|mN*ss`r{7*1An9Y>2|=`SJy?1baKVcmsz~W!vehG_gL;&SKT;R+)VilQp-Rr z#`u&3tW5M-6THod&FF>64t=2W)A1a-kg^QvMPli-l;0*h^@7gh#Ml;@?hwJvGzdFe zWF1vZ#5St?Q z$Z0j{CzBTlD%bvfyV%YpN~sNW9P89jO%hk{6nrO+*L-XrnD;P`E<}@T2HOnY4>1!H zc4U}*7!VWm31nU-zlSd+i&!%ct_*YMd>}>Xd?#6}@(KWu*74)Q`&DDr92~N0CAS!> zf#yM^^(@x~Mpa6FrOAaO{r`R>>h8Y)SnK}<03)&f@JgweQoe?AQC(cE)Y*qwY@<7F z=khi-5KHneGzK2y%y15QCSF|Wwc#%itXsWm+Z?&X3l+4$A7?ED@!K}cd>bY%ZJFkay+cV%^T;-SVWhwEEf z5+iwUTcDs5Hc34s4Q3-|%X?maA8*ex6=5tVGp01}J!mbfZ(moHwv3@wO&5(Y!47jB;qM$yJ$dc>pRp$9t0%0!owkuG^7xD5Q&e)tkHyTfuPZ!EsIHbS_ar>1OEO41d8om!f=E3-8N#|H4 z#VaYpAk0RUd8Evbz3FJ;?-0?iQ+GFe zgn9fC7#$2h`{1D#A@Q}Nn#GoFVaOD1&nBZLDeSRisa7ia0UyBX^yEZxkmnmCAFN^v zA9%puxO@6kjxusdgEpzEMl9rWU5!|H$TgRp1Q5gw92$I7@2OLHj?KLDmY>PPwQEx* zc#V-1(oA1J_%3Z73JQ&Gn!7EJfBiV)v!7OgdmL6*7yR|IbY!jh;N& zcq@`8_xL;B>$aD_LAHfW4U`v-ZS|PZP4&F~jZGTBDHi;i@%g&8XFwm&DisAne~s$9=Hu!f+im6F>4>--YwM#(HIs^-9@w9MR$MQ^H8`6Dn#H z&REtsR~j+T{P01ftEBC#Rq>)A!L;l;!`jDFJJ0Cpef@;gc#{6eD5W{`wa$xr`f(>o z85tS1f`-f?M0TO~g3F_AZG^rery~c(GkOHM%2mTJ00`7xsQTl4KyKUr+>`BZ49V)Z zR}~^}Y|o}-WY8?WDORlcC#bXV(Ef8GWW6|9z~w{rgzWthER0QXmVmYzp;QR=baI*{ zi?|%9THD$x1FbA9zK)C(78Kkzfz;HRyh|Ud=m=pc2>G{7Pr3$I*uc~b!GUU9^zp7wZ-w_4A$U)$0?6qG99f-acJu- zrcR>MUciBlS)}C`tVoBuO#5vO;cNM3Jm+PR-Qc+Q$rvz<=_D{K!|HLd8CmmB7i4Jv zFs3-;`ZS2MaoP2BuIRHYi6OnOU`j0`y>WJuLT|B*>yA-* zOYn3+hES6|(J#}H&HagmvWm#o(5pg|PcynVk-q@jIhBXf#Bqj_thBmaz110*wd7Hs zv7EHLInA5hzMUx+w*e2%|KVTr-#;i}^Nojo-!SNHJG%NJ6w;NTD@;NTD~&=BC@;4xdA zn7|A0POoGo;L1kGx4;7=3voqpIJn9v%o`(Q@EG0xg|-tM98TxMKlom|LQ^=neT?y(kE5q|~NIPr8 zyERENhwd6_``X9swOYj#zD8_C4KpQYzJyQF0$rG0P2Yo?$&Ad8^&Nx`A2?RRz7TG0 zZboM@`*Eyb=ypA>4Pko=(VU?z3senP*HG_M$rz{7Sv%ifq&+y_H-M<9T2R*dUUaD= zI^nRtI2GL83?L*CF!ZaF-q=LfH)!n}ZS##~RQ!|$$2~>+tvm1WN%+th{$~yYPRaYb zyxjbOXeI?Ex$8{ny}1TD@YJov%Wy2gg6p-Rq$hOa<16@&P_W1axH&m#c*b~L*~bz2 ze?u)HB3Fdyfr&e)yae3etYV16hs$mr6OA9Rlox87a6AkDis^vP$;haYYjg68@G!;a z7p-ft zzV`vBW_>(u_I5GhL|g;lYywbldkVb5*|on)1>N1I@Vc-<=c8QbE)IE5_80d=ybiX~ zEwXK=>$2*#f)wzo2^+l5%dl>*&!y9%8teMj2NTRT7u(LxT)n}gUv+j5k3@a%mL_g3 zrG+joj|kFPu`1g7V1oWV zp&llYug==t?RA^_-QDHt%?B}leo|7?^tL{Rc~m0nKig82rlYM!_E|YOl55|T%s!D3 zS4pR9mcQxGh1+xp-_#FEO(iFBl-Z{!)vJ*UN*&{0uigD+)<@Dp6;Y`jlq#5a^%TL* z!&53s*L1o>n>W`fT2CdF7ImSOCy~$NE0)LiiOETN$&vJ?ba^3BExkxwyeba=FYx9V z_CEHMk77S9QD=o!nScLW{5mY{xZOkYv6G|Ix^?`gPmijRc@5u(BjZ}1B=TSqa>f*)XCl0d@Plkrs-yS%n>>Gpo+dXZLmy(s?A zCMF9A_Pegf-#M}s8q*HE@8-XrqUz})^%lOVz(WnkS&kE*D=R8f(_*mif1L6nPN9mdM7vvYVlu+ObEj~SfFEO5d}N296D0-y#+qy;iMf;g4V@L!mWB==<(KW)6AphkOKguQ~S)yiQk_{5h`i|aJOOtP> zBb8sY#k(dp%niL2lYqPd5=tgQ)+`|<; zWJ{Z!6le$;bFiq0rQT|E#Xr79&eHXHBjGF-)c#HZ?s~q!bU`}ler|^rxVlbhrE35dipKvII)^^`t zZEOW>pjr4&kZ()lt^0>C>N|e$93u}2w;IT+edAMR?>8!xil*T-^On$~0V^nrG>{uJ zG+Fi~(fbO9$x}65c5fpK2k_&ixKm69UDiLi^hC^D>jX6)Qw=s66t7@E5#>BtMGg7; zY>`R@hXncz+I-?^@ZG(J<0%i#rA$0e2#c5aWNmDUK{wzx>OdlK+_*m9f9M(!Bu`BH zk}zv(9v(!;5s)~VPi;@}BI%L|z6wfZ;otymY2BS(U|995RqVs3-(J|0IOew(U2OR; z)5-KjKUvXFLa+^%&36t9x(psC#sP73tw)dWWpndrzMK92;TuUNN*PM~J@Z>Y zH<^Ns%QO;WL4l3OD8?7bVB>sUT}>v<6zarRv$+3hY$^Fs14$_Z-IbYSFp{>10)laU zZ!Tz#+{rM1&CXT}kNScqC#@!`g{7sXd8d+6=kz$D22%)bGkb>}6g?_!)Otk=fWdr=n{rUqI|cpPQLq zDU?qQ85215KS3xcwlU|Cx$(hOcCsjVxM+5F-Xs`sYQw5(YO!f)*j$*Oaf7Yb3RQD@ zBPzAnJ%h{lR=RhztAcQ;aQ4xDMx%z$NNrr4?_Yf+tFrhmL+go3XiEIllh2zKmY&w+ zy1ewkjj5T%-OPT-ZFiQz>E>EfTU+qmm2-V*pC3-R*leMyd;&++Ho3w5rh~;8*4jlV z{=(af-`_K6?brGsb{^F%LjYS~U-@UYwl4gRC@U))u@HoAIXIoz{k>o|^ERTD52^}r zJCQV+j&8%BK9jjqk#5P;zI=rO+8n+E}Te-qA0&-Q2fNc&Cf*$d&IoGOlXUEv_;J^?aTe8<<9> z+v}W9_fpOq?m*OrA$oerVr_loBI5UthE#K82cr?^PtijUv5M`IC4*A8RGo%WL=EO{ z@iU^iEe{O&q_#)18k~NI)eI!e^9=l0wZysUEtnOL3uX3<_9C+azXgeCxA)Pd{O9VL zn$U_xqyoXoDw=(Lu?Z8%#J$$3lwoPMb>)f-k_W$}`=i5Yh@NMbV8^w^dJlMKwMAfN z)Jz;@mT-;=gu6HPU3@EDGD|aAcv|;=obJEZJSpa6$>uz16;)Ll$<}DH;Lo4{CKdUE zl|F)EYHeu*YU9WXD2)I3G;`j=H3wx)gA2gug*M7k3XLx=^eHqre#~^bG`Vhq6*Y#YMGOEXfE^&y6hdGQZ0Tk_H?TDQ{6R2g4!kB5n_yi zHp!#!u@~^yLOlLw;t`oJJUV}KDhdh;Ua2ccHLfwzZUC|PHMNXXIPBtF-c17B9fj(B zDJg8HrOPrtOBJlCsbO+X6>_oOtS~C$8dT@v)7>5DWIj1pAok87SxQJ#HKp1}m`f#Z z(0)NI>eGz1Woc`>(Ckqau^FP89-HMYnFY&&gwuDUyf(yzKMii4qsLLJUkY zhU<3i`z*)vz4;>8H6Sri&!I#b78YVzMy2GqM`lU56?hNkX9!!j^~nGZ``vuI`b>6z_q)1U_7VD#4%CiB0_cx!XbL=d-Lae zi$q%hB@=S!#Kj~D`hN4LlZ_1NYNci0k@Q|JcdM6>T$~Ml?$i9ewJysi5L{2uEe4}3 z*ady_PA7t|989YCs-oYP?^?y;I3yJE@|NH{{Y%Dd=|_#z&=6W{d)=qIolMJSR5U?n z%lNah#E{)HhlX{wWNNg*lRsrFKAgDouV}4ehG$a(C!v3_BlKFmduB=7H40x=Nk-zz z^BSy%F}mA}C^JRgHJK=-c<~Lxczh{KD)TJZiIDluYHt)(>=RxMB7z7qQJb5Zd*)V8Kx1R^DM z&V6b0I^S!)JU-qSz7}QT8XF)HF^{-I#xNi70D!^PcCX_D=Dn^=j7Fr{&deH(q-kX4 zBiAz?mn&zIafj^_t6O=Np&8T&$sp&sdIu9Qa=gYP&=L*Yws}@oR?owg4-tt1ab?$ji$EvmcjI*snRNR*O3Q zXO($BcJoZIM&z)0cz6^QpF4L+X>M+AS=ruQ04kNJkHYu97cUj3{)EY1w=Pu^=aPr{_OU-b;wcpba?`qyI?u@pUrAi3b$6@E zLclsM;Ld4nQ?)@{Wy|Y&^X3Q{waw(Wk^s3S7dgk|qcexgBeRH_-QC?OCgp5t-m0(9 z1osjSEvXEe8o7HkH8hk``OrTYikEi?Y7AIe0rjCB4VfQ7<5j(D=}cD+jQaP-prG-u zUyVA0bD&!0!^t1E^&1@X)-RnBN3tY??Thl2(mZDl*Nb|OuWD;f$JYn{goOoCU`0d) z-#aX|!)px`-e2kh6+Er)1CCIaP5K@QXBFzeaxEN&I7S zPES=Eok9XeYC9MG3n{ANSais+=bk%&V*154U9LwN^E~fvF7Y!GndvqPXX})MoR{bsut{^<)YoId zbRLYxiSyHDwq{smZ1>g;at7$ieYeqt*EkYOIiZ%jpxabS<|=NXCTeH{@z@Td=CsBc_jTQ=9Pi(df1tdL51bv3V^GdT(2)p2PVJh*1ctNi2N1zM`(vfr9FSXYTu%l(}j{X=U$HvCCR9j~Y z9ZcZa9N-(4nO7R?@YV8I9vtA zKV8I&vCcWaxcCn!1%0VP&V}-Vh3RHHT74W+Xz`chQ!d++EHfYHzDA+N_{z}|%%c9) zAw#gPLn>#g>!xkGSldiBZG%*NddjYM)2_(Sz7vwS8iUJ8Hrw*>l*3DNdirSrh-aR08StIaO6^c1S3g zI5aFgs#Mt66CxsxtvNX+$pt5P_zKr(y47k6InuUsgK_VEeiE^n29(yu#s<(QQ&x7D zgQfb53!n;;Xg)>shkw^zfQNfYXK>1ixvq8_$~8WIA6VC?!RnKHFkHiW*>029DDE;S7Df)hfwyOh}Agum_N7>&Qv8(YB*Hc zVLxdV`czsXjwPM02)9Y>`T+fu4q(PWqH5d>sU}$JyFHAI4`+}!fhj(LH2;Pk|1qjk z_mxrb>3#kEUkVGOV<=Zj6{ydMu}7iJ|Lq=tn|%r+A;P>X5if{H<{%!~@Uy79ooIjE zTv5F_)L_K(ia@dazue32hT_@F4zA*ix5T4&QRcv36}-_5RgMY~9uvE-#I-}>ZH>OO zql%&w`NTBW#qxb%;FGo$73=LHR7_FvLJ-b*F5pHijR|3)eQT5 zRO_hdro<&h?XexVG=ZgPGl6dC4QJbp>rJNG<-2@3Me$s^NZxAoLqvx-^IqRmcrv-L zBR}k?;d@N0w|*g&xZ_O!Ws193;O<^3KzaJCTJau@xL4x#uHhMC{1CZS6OBLJCKxk9 zat-ET_Ki!(DJnJ}wWv+m8sOj+~&D|q!zG!W7Hz5#_+~BVgAa$@SiN%oX zYiLSEm@;gw$tBNbq2G{NqVEtyl;vxhiScMXC)LDcQhsS$gYfjIYRX(X%$_S6E!ton z!#3;+%krs22e!#|dxLs9C3>JH%L2BaRI29T;~;B31SS*J+SiMG)X!wqXMf&U;FV7-HZ{1@N&*TZGGzJ+Eg2;di4 zu+1!3y~On>{^K);-y>;&K9C$D?@HqCcE*qXk~K41UnnX9syn{W+0M_{^cWf^feKc; zPecVnlN?R7P6{Qj=P-9rt8q0Y?5LhpRRJjXEdaG#uYr~h$G&yStD$@Tt|)YqQZ{En zf^#|)>ycDkO6M&t>rPI6J+a07&C&61^_A8K6<#+??WKn~_vO-thvY31~+&hi+|s zs=FN~4!n;al#~>QT$ou>XrT6O(o?V6h!Ym^s;CO-=j$Rm;PVPVEM07c#X>01LqiYI z(E;fF=v-< z_};Dc#Z9Vfb!M)ufmUw%J-Mc(xw*2Ehl7KI6MA>B-03K9M707TF4D}pd89fMtau5} z7JW?Gi^v;CkaFXavylnsVurhUe|EUmkDq$V1stOK$Ok7US5hl90x7<>wiZA=ht*zO zC8Z$Yb_C%5Fn@l3c=&>Zn26u%XsyA+15`1YyKmtK>rl9G~)`9@=QHgH{HW;92k9U;wX`=-oqH@&V8Ha#w7 zmBX`P7rFbpl0q6{R|W%;vUsE8-Dcw6#_uN>S~$Y7r!(~#3818}kc@Q;g3~=5hb^g~ zhojbGh=4>@M{)a~EfckzjmpmkD|hrkcea}Z0=?jU5zyskY-@Brz-C_mmi$uT&YgUB zXt^CPbqU88mqVB>6<={)UTZ}KMW?$C>3%u&@`HP9_|X?eYcAKANb3k`@1jLFH_>lc zXJfY*#8Xe=X+Q(>ek5}?Mz%?r@f#j|*Hr_ISP~S<-G3FzhcmOR!%dA^Vo&<5rX#v1tnZ&{UjH9uRTsHX-iz<*egcwnM+lTI~xp|{C~PpwWjha zE;>qJ?@#7kZ!;tKNWri4VDo6zc-9OVjX;&sg=z#ueZl3v|GmbbBM9X8k*V9rK?PWe z%``xx#vNUu0gNNl10Ugl-QBX$G4AB#<#n%K0+AGJA_g4u=bJZshv)KOvGC@uOhEIM zQu52&;AE5e?b0I(FRF2O3vfMsZf>^j^0D8Y1}QebIb z1Aa9S688P-FZaTE^2ZO&-Cs;}tk7MP^K=ogr0eT14s&FAv%y#V4JKUo7ho-JC`5QN zXYf2f?u``?JI_Yao|{Q^7r=IADgl{|i;pi|tPqz`kNAW5eJQBGHAC3rsKH6;F?Veg zpk{zeYs)xeMT7^8^oN91!qhW_fvKoVG8U5#_e1&{L#cY*_J2;j2L&dxI_$z^&C{x9Jh32x*reghq#4Xn&x(;7|lP$0}*{N7(^ z1MIUhDk=jCP_sdk>pLLAGNVc!0VNmoPEUYPfW6o$+2tXvIpL;#ezkOBLhO05Io2(o z@F^IJgxj7vsQIbQbZXg`1^{S&HMtcir7OHt{9y3q++=PSae?jX3W&~Jlhej+74oU` z*ksQpr>C=1&v$o;d4jR2(g7d`X8SzU=k{u9cJ>MsEig;M49rH-`0eyn#{k2Mb6jZS zTBwJtFV(N1e9O1nK~y5t6D39>MJq74dGwg+F($%`Uici2Xq-VyYwM!Y;t3xgw3D;< zm&iidy^i+&F@=wjAw56+hx<8PPPewVXI1nfN?!%xbZ<>21R#INA$=hwxLHymkxE&a zB~}#$T0yB+!y|?eNqZIxDIL=70Eq+i;}55Rri5c7C&Pe3`Ivyfuz+&#+o3TL+R_BC z>yAlN%f=8%rP1h?*KNDhDzM9eZ~}gl^eFkJuBE_9)O2laP*2Y%#gzQ-iSK<%Znb{q z_%wT;ZqHpF6B9@YT26F_6UkG6tG!XGn`dSQB!+L&w_qO5beX`oW1v1ONR7{x=m*|A zlxS7106Z8)CHhd`YySKIqZ3t?5}U%te~?XOZ-7HC;Fr7_QV~JHZwn|QP~Sa|*3jo- z8XFs@kdb2Jf4s?_gzhLR%0^Lgu(5Ss zGB4DtvZu()m+Q5#Iwh{I7i%(G{HlF--x*h>Bbf5+U89OFn^R&=OUo@_-_KolE(|vG zrv_MlR&PyyQR593R8rTZs`~ltbKDJ;ymFYtGXkQ7gaqG<1Mv-RSw+R+m>gMt+c|-s zjk0VOV8&9mm16S%dcL!>!=ut#EtRM8D^(MI-7yGk&zLg()7`);{esWF<%B8 z!`yrWm;t^*32JVK*}b~m&F?$El$C)x)HL^I9ng0m1gT0U^^=3e+7{MHZ3? zj6LU}$;l~Xz(JRim9u6gm5@<5*qd(x6>%^m5(wkxg%t5k3X$Y75DJo{Bw#dug5a0v z*C_=#X9f2+gn(^kYI>JQ4KE*)u+;$P=Y-&8+o7JqWtU5oE z@f!PslOH;FUgQnhjTLbw)wAUxc&K>U~x@dG@-kzL` zp3}70P!VyxiKDRy%FR7_5xg(zzEs&FlbffQD4+^Xar^YodE<2iUspMjX%|vbdKYeh zgq$3PumK7Gx3^qehc763O@E#30$g-b2Fs)})bqQa0k(haWQxHjwO7E@8os9bE2IEK zsBOFI!1821OFY5|4c>mDEfSJHKgvZNR=PTaacd$Y;jTmm#`Z7|`*ZtamkoYQO>G(6 z2FBQc3;<9Cq8;$t`)8^>o@^L^QlIeh{_fkVj3Bo*$-Wu@qr`Hxw!dmE4~@|fakv~t zskPup_2;HP;Jp71Y_?^EPLuYR$pTj6;Oo|VgzRg%Yjm^kq%ekqAFWWVgKFKm1DDYm zgexmZ7@k*Hh_>$TJ&&M=ky^3NrjbcreQJ2x!=aA8jzuhhhn!8WO2ym@qzl!^UXRfh zuXB5h-=GKxiclnVD+;ZQ;=Ldfd}QPu31T1XTqECQ8|TK8n3U5qf&VwxAIl_pCMBpP zCD=B2X>ba4&{aJvdCc4Csshkr|RHh$p(&MmAlsl9x(qz5Z3fgQt8u#Ab zV%y@X!_lF>lQuB3tyW(<;l#_I~Ej1p%nB zWGyx|*!xsYuES14gIcpepumhJZw$h7t{eUu&dbv**AGBW7tgy&UKgzrp{klmVzWLOCKidr)(l92;OH>S*_ThL5J*3tLu zW;dBkl*ZBtYa%mduCEYyKl-lf`qDc3f&jVd z(NiK>8cbX-+MLh1xWU(UJzWoo$Yu{fvcUb+0_&ljTDbknSF;}mp&-Xix zO^i)A2JC|3GO$@vEQ{m(t_Gi6=J55hp4$n;5tv0)YP@TsC+Dul?cG-|bzN^}Ju<9n zM^V2X%`h=5?aue^&hu$tcqfjzsUY>1p{_=Yy@LHI^DbgWrN;AJI&ZX*5V0#ZpfE^f zo@HI;8at~X*yaS(hDnk4oMj2&tz@CI+T$#lgiLTiPtV>H5C=PkE1sXo_UFz9^FeML zE{cxMF9zi1IbUcQbwH#0533QH9;fGjDpd3{qUw;E+m-Zi4;RW)%`nR(4ZEs9Y|wzo zNtATXRwKOB`c@_JmreF>7Yi*J#&>pL7DrF}zmEivCs1&RsU>s&LkH-LpG!>zvQ^)U z!g>{5U48u)vp>@uLauwWr$_7ZNu7A7gu`#%pDoK}%=7}@y9g-Z?eXvONQjk{sLxHb zp!(a-#HWOY9wrs5P=ocdH#Q|lq0WbhPj-FYtp7$D+1K2GjG0kAefm`37R^g9&@6BP zN=^2Vdw`$c0S2d#IbTu@8DK8&Ob`Ax| z1z0NpR*2dkWJa7&e5;NsFhbwnaNKL*;1rzd+;*XadIJDRM>57k&yZJKEH85vnfX&z zAV>5Miu^0%Y$z-Lo*5yh4oG?B=H?S>!6GpuGm-`AP|`Ail+@Vw(JKkmUk&d3Vj%UosE z;U2zV?TR1tpT`xE^rwrOXXQkq(btnvA8!;T_%U>uWzl%}Q@sAC?7|l}UV>-fIPJVk zI-t!nO&HM%oOd9QpN(N3>8dx4?MQa3iq(bIlLZ9=&90&%sud922a^yu9Uqzow_F14 zWhesZaT2=G9vJTcV7$oCriDB_XudhsKwXTSf&j^O!G+_iTW8`x3e~`=!bckTB48X| zYW)oMHcm6AS{Xq(WXZ08KmA%c0yS;C+Tuoz%OVaYeQaAU3#c_Z*EJds(ER|N1=qk` z{69EuMO4+W{&E#~A>4iGN>7 zzYn@}vGQ+6_)l*D-&eni9wRQ3DlW7uiTC*Iee7;zA2r=bi1REe_}s(y-+e)iR=UPJ z!N2AfOP``dxQ_lM%m4T90BT~oum`PDLj>8YH*ajAPJDR!S2VHBbjR4lDmpr>vDqoi zU!z{eGWOH&_mv=`@bU5W? z&40mGOt7lL8>ZCG|oK^LUMLWStR09L;%l6(&RB zB>gn&oBE%2A&G~`1sob8F$fM}1ax>747Jzm@d!rnk+HM4629vvYARwQ!kWxn{Z67j@O&1!5*D?gn}%ho6OF(s9`n4l3Sq3p`k zp_GCzfh6~vCty=mPIh}wM<}k0&5HuMW@xLnvXa7eqFiJ1{M{Zi{tSn;MWl3w#)Oow zYe@nF=46E$#sNL;70gN+eQ1A#Fnnc4V*r(AFEJih0?pz5kvQ66?9yQHV08y^oz3U6 zsz-+AD~65*B1L30UBqqcot&Q8<8>4XWbE6>XtG2#y*j(DHYL(qH*)5|7|aR8UC5A3 zz01jYMU2T|mk+CIEh^dXXz?`p;xO@PS>0I64K}%2H@Uu8yG+FI*RL&m69nRAAW1?e z_lmLu<1=?^D_6>2$jZL{Dq!<|^Y?|bv;E>x76HPrcs8~b#tY{i^`@IIJA>wRVTpag zej5BwyB`%N;Qr2`4!n>$dntjo#S-_gv5>d~&!Vpf;H@wjF+BuAJUl#jCD71Kn5hEs zM6eV6k8>&X+gzZ#x+UP2f{49a8$8lWb3bl$kVgSa(6hxmv5wt>yy$&@2Xpki0vae#3{C-Q1HEnFak~4-rmBST3MkC0Z^eZ3`FmFG zT=|;1^MxZdh0}ClJ)F=$@0s|-Yc-!Ki=(3A)P=`vb&kT7nqKtwmYLosRC;TO8j%Ff z*Lm`vsUeutq+GOQM<&HrSDvYuaroFrl>iS11mpCF&{)Q90Y^6N*)E_by#3F?unrdq z*BfBM1$!47Is5d|-Q}6SfT*5|c}&+~vpt1>WK+$L3YWB~`r`Z#p(Mh3jwrX)IDHGo z$-<|&IC{6AQ8SfJ7Kc3_51yOOJ-1gl+g}uA7Q6(Z0bZ8IEbkLkJs}T2c^ezHfmA++ zZ23m5F3M|c5MW45O1s^fU?SmPTWIkDlGxy9j%yHvPzbZ_P=ba~)t?-+69pti&Y86> zbq^+tM&{=;g7<>U1tb87j@?+kGnr5y~lg> z?X4Mz?~EdZbVMXQ0V)$4E1Pn<(3JgZ58z8Y$}yMZZ)ckYX?Pq!oa7>v+hN6|=?=r3 z|5^B^+E@AF1W^i2p~*iav=mg)xW)SYQT~B(Go_Viy2i%N#?(i@0==CrVl~C$+yqx} zk3wE=FPt{*>33y)>XTV)Sr+J1m%OXWWnjF1A8{dJ(5ir82Z&D8LaX!7uPkZ>jJPEJ zBtS(J{tPTLt%tU)EF~=_FNMLY+Y?D4^p+R_sGqdl0)ix4ps|A;0t+|;gG9f7=ga^t zt}jiHZcXe@r}bzN$~y_UlcTJX*Ib_lD#DKIn6^{2b~ReO(JJUppN3*kuG1lHvdLwK zQ1;8_9s>^_$en3IFw$gRo3ovhlM}%1C2=w_?HQ;!SMV`Ui~%DB+%<7h47L=ND&T-n z1&Gl?bzPmPjg<#LI`PGtZm-qj;^Im;nZ?xi=vcG7rC3xMsCv9_E>we@Z+^TU{#f1? zdJsb=3)BsuN&XleJviA?d&57K>HT8ql%?>EL7%s1rkkw33dPuh|B(?EDbxPsa}t_2 zncmFxb8lCLV|U&ZBUgv(>O6aQ#oBREtfUeD922tD8p2?^U#V?OA;jRi{3^3PFu!bE zAH`{obdn-k;HdD4(Qize0gVLC%WFW?E&;mbM*6BE7evA7ObBDU# zNjwlt!c3)#@y~ntqu*JCS1}0VJHtLlH8t)M2-r2pAbcsvu zpd%v`tDG)m>F1MBF8X$9=%h39)9}~m%x$I9Dy{aaToy&}mo?!;mv}^KkK?#q;p1Ga zD=*mM5qu}#nNC(}$nS&N2x_0Xiej`B)!%nB!9e}b_cp&Dfw0z}pBtQ?B#dw-tD&>02cu4j=_xxm)rnxkHK9EBzfpUn-{;=Nb10R6Ogr6s-Qq4 zR3hiI1Qq9jmi&5-_SqZEcVpW(3zwKgpk_==&xWz~&o_;Yja6EoZi@$?0;5Y8s0{Jw zVczTpt<9FVS3pP0GQ%P*0D>Q&{B*KW>9Mh^huQ_-K1BhAc&X5Cq4{SKt=m4z_VG=3 z_(?=W|JK&ZQ+){hdS?iTjIiss-t>*-@Y?o)V#K777@d)EpI4>ExP=zx4bp_A_Peu= zPW#Lf>ond^%!mA}2IwioV{lK}K?_oZzH83PGI}8wR(DQ@Bn>SpD$*#?W1$PWxw&+j z$X5iil>5O!mVzTA^O3{$WEI~zozM7_=wdeYGKprCI#Z5}K$$R`Zca{&V(4d`1vA|!5%_LqLYW7|w$p7zIr zUk_N;6W%8UiWz&mufM(@>^&vpr%s^MM|WF-#|{YxVtRQ*6Qtf7#OfSYkax`d_NkPmfmWkgx)7yQcf1&^cZgx)iupN4B>!JWDV|e~a&N$2b?<_kBFMJw}pw%|@5L0h@LoY%WtvLzjXY?g1e)rOojD%UuE3 z6<_0@O&$}CGM!UEvy!$IsE^=7zmJSSf9p4$it(yoTZ%MinLI0xk^`Tt2sax{Fkxg^ zZS}**fr6G+R#+1E5`wVaiI_;7Q*JxkOaj{<%aJAiIXgQG^}UO5PLf15uLV|Q&z3SJ zFFg;76)<}!DL#Ws;;3R+v(W7F2PmK_g>|K+K%_mId0cru{+0KzgAePXn~dMH#FhH! zy-)sxdFrSLY13IeTR^&xm)a1sHsZ zcGWg;q}}eJjF`YC4Vvu`{ZyPL=(K^QL`aI7k*ELz`}^2Z!8rko8&UM|<^v{(MS5MG zuy}J$qE7HfS!0SqW|M`SErD$YQcLP@%0iH`<)NcBlp;Rfmq+W3;Y7-5P}oIZ42XJz zwZpF6NYF{7v~U2SGkmQApQ_XcpH18ektWWMg8J1UqTqCi2|0}CYFAm9kn7f4jxDX3 zMjX@0ew2XwxfIcNyLG@!RZ#%6Ngxv&sQ+x%($p)E6K&&&r8eDYZ!MpUrw5S3wX zbAx>kiKMSoL{zCxUP?{Ke3USM>yHQ`x5%uaSDBv*mA#Eu07_fCb9RrzO%x!&xCE&g zWpzzS>Vbg)pn9XqngF{}pgk^2vRkQJ*HHRYg`W@d=rFYAg50Fi@NGs)LY?cpkR@t0 zO1ei8s|83OhVQ9DLG&z~g>2htV@Eq>7{!XPJSg>v1G3`;p!U2RQY0lM195<#y04L)hLVLI|9+j=x*07HGmF3`6-LVzfI@?dglr)s@&sS0 z_iXpq*rjSFyH1*>$cLj zyrkm|eeu%1a_Ej8KL>ez>HBNcg01DwU?OXq(|9D51ymt)@3P__Wv?@YLE3)g=Ej?V za}wkEW2HcOSaitiY=;B%mPD|#1jqFILQ9=X6;t0j2=4*py)ZLM9ZL?z>EQf3Rm1`i zWj=IJf;ngMvLA4CkOe&bxcZ7J*HVWOiNY8@o{N*S2l7qxlXP)9oet$kM533Bf?(eG zPuJP)gSN4Cw4T!&`E4vfPJ*+0>tF_Ybp-@78Cb>C6*ifQ#BnUsS3Rwc^L=|4nuK9R zMP8QX<+X0~dZt8zC4vr7P(#_xFY0XPzZToQ2)f_m)%H6y((2(3F~ZJoFdO^~WNE`z z#C^n(=J0~;#WmzA%M)KM;VY+i`txAL11p9SM4X334JsYi*G`-h&Bv}z3vq=>C#imc zI76czBVRNwBJfGGnpv)XJ|Xa0=?VpSKF6fA-C(G2$gR+#Xpn0)8WCRyj}sGrZ)_p9yCqK_VjjC2$p2O}~|P!qtMX z=sHECHB80V?n$|Qz!8KNq4^Brd=neB&?$PkDFW_TK0Nyu2%v=w$cAJ-V73q`W-6Ko zG`LRpD9bw#Z6KH@F6u?#|JOI>X7tHkU!Nmu{5b)pW$oLaH8wwHUH;&49CQIY1GM_| zT&V81Rl8sQAi?o_V|*L{a8O*0I^{LL3MMC$Qfi`zMdZtd zxmuXlQ8dki{&;BUv_A0IGPrjUzRBt4!ogDeoqk%xIRc1$gFUN9*KYaV4+Ir-f4Hn zU%TMEHV=*lory+8R5AikaR=Nhtlqt&cy60oSCCylIyZ;)1JNgYuw2@|53pX4oOK?Y zSk;{OSX_Y8GnkF7baRSQhw0G1fr331g0LQ}Smgxi#rCc8k`g|_lgn@630yqY$vc$5 z77kiet@deoS$c@5kfTC{RRK^2AR^p2TsqZ#Yfhg$F>bzs1cbyJv$<$65Ed2|$|=zK z)he9;gdp;v$w-Rl<}x_Z7X9OSt36Ra?#=lJLf>AxAD?klcdo`Z&09%tBs~H9_&})1 z;quh8;sWG6&Puc&yg~;_DC{cGft`ls3xHn>e`pQ{m+l8cXaM+QV`c5IjIttzf@I58blqU z$a&un^7!V!+ZDJ?oa$wwpKElHFGFLs!N3HpsxO3Q<%p*7!GUGOv=~W^Ve^**Q|7W@ z|4oA<@@}kr$N-9T{)W<_@HB&cl+uICR6xdRtTW7nREe*ELi7Qg03fS-1f|mDy(_kvEtG`db`vssyfMmVf z{oSf;RJ68m4%+EUif2Q)%D-_^!$DEp*w`36J)N4GD#W5!aJcUMNS2x!(Vrtpw5i>BK8dXjz&Ry_C%iuTUHR57R*GO)~|hwuX* zc9YoUiibRRO66*gnW^be`V-XCpCEd1HJK{tbUe)=&``K$D7$JX=)M`vF4BlDd)a>J z1F+A}Dhr;S_UWAYS<6Vx{UMg^Mo3$$} z1GKw=iZ_X>6JV?H)e1j;z&>5Yo$1E!JGTn*)A@;c@r5LWdA1aDzO-g zRMr#^lQrNq5E#k~+9(Uq8FF|5Rk^&_ik(YBxBm?C1R>uL5m=GtO<@(8(7p&b-c|gb z0Ju1}^?`W2r`71&$F(&z=Zq;a(p?H~MuW$e!EVg=F}qi%e_mgoeLL>5r_qy3HCK@P zVK-9&;xt(M#9=%&;s99LhGzNvF4O;D6aSpOqMtb23}p7hkB_4=1R#A3w+7ZQ!yQg()Uc0#HlWz*NN}t`;S3dc>$%+t29O?h3|asE$J+; zon+9aqocEA_&F{vgsEZKG%Ive#Z0$0u~}>nGDJ8gFiLk}Im04@P%kQ=m<_GKnCS!+ zsYp3p3dIy`x3fOJ=ATno&kD@TyS%(49$L!zW+eezN^j4J$&+P^fo;X%jR*fFG5?#a z`R`h12%NDoJ1+t6Tf%a#sIwrdloK4-sNNXHI-P))aicCTBjeekXj8X&IQU;YibQ`@ z^w1LLoN}fxp!B=iuoFtf`z2GFRMIeoy^>c^sp||Lr#ku2)unUD;#PE~Yo;IZsw8Mf zI`YlDzT^&NS5byFtsLQ&oKn-{P>tf5fim+LuOF<8*8a1s+I|U&QVeFNlkvuq45|r= z-L^Gu{0X+D!`70^U!OjFiGzCkmyI_m#n*cE)2T>7ow+XzGvx=Ocb;);KgCk3)um|3 zCR>BZlpx1d$otyAEhJdUMsO|O&A?`>eCcLUp?&iFQOgT9dW|3G@Qq0t7Pm@f&tO{J zc{#58lh=&fWfZ%9qK&ThUm~XUX!Yx+D@8@NjlwY8-*L{jR(D7TY}zOxNRi^vz`}Nx z>Azr*s;4Ja z7vfRx%?iso*m$G?x(zm)0!<;iix%gwQCm$hpz@8!kkURP_1qDQ6jfq1AQ3Anwu z)N6l6)YtxCy0m>9ZMz#BJDdzT1_nZ5xlJ{lf1uXWwksSyS=-a6AqZV@rKztP7wwpB zXzgbc=(5KH<^{)rYk28(HljM* z4EcNTzn|ECeEnm_c#3?x2C+#ixR8O7kfc(kFZd4fbQ?KlujBQu3dW=z0(k;G0efVc zv71K9YmZkS?&kkQ>R7p`4Qh^04fH8izct2}2;qSr2tJbCdhc3{2YEj$`qtt+=>jqvQ89kHpn3=0oVL$^rmACDvPD zJT=lE&lpf@akNnD|Eq}Kp$Zjx{+$2q3^iR~v^@j)dJf1Db8#ulpwTR2{ACaPFN5%p z6_?Y-W8V%(g2CFN&K_#XOm&MrfQn86gk_ZVfIzGP**4>MMl@F*Ac7x(8Vd5>1YW;K zC`g#3KKx}AAawxVVm_3p+U$@sZ2sK&!d}|U>;n@kKxwV8YvOPQu+eArS!jGYYK7ne zex~qiP3VUo6uoqAUV&HS4u@z)mnVyR7I5d#xF{dw_09*`I3p(MA&g4GkHnZ9o#+m> zppl%1(V`PdKd*+9kSmxF9ndX`h{g>LDa1vo`-e{hL0ey5m__V4MY|MxR+;sGsC(K3g`L}uK;jM%cqt_`*0+HcBjZTB7n zq9T=G9a65ghGA!#OE6Lx&&p;&0T&@*FiQ6sbZNX@utrQ)hOgepoosQw>>3V*G5|i6}~;w`vop0 zMZ*rg2q(zvBJn=kIK`5x=HCd`KA`g(^NX6J#cMuks|n zl3-hs|3E^?DR{VnRc=+f7)z!hokF3EHOERR)V#wT-BQ+sq3<`CXQDOixKy<{3wcp3 z@4cnyt+kaVrjx-ZPm%n(We9+W(QO(xPW%TT=%3fkko3e;69hwm;ce`$PK#jmoZnWm zG~7An3Rt8hv_Hf_It+2eB8U1!t?S}1ukYH&**62{d~&#&0)JnCOrWBh6P8r34)ml? zX+b+FN=HXbFNwp1u^58fY=Q`A*3_$``{29aeC*86R|eCBtcC zPLgV;2Mc>5cigCN2%&A9-xSJO_A)-l+Kz z*&}O{PdT%fUe2(+oGrznfA&d%#YhM1@4S3X=Hmd|f3orao|kWxKkD>7h6(^Of!-Tw z(;+3E6lQoB66wYwXO!EU&?3Ha@#~$aN zG>UYI@~m$l$owuw!J3zYA1h^tn!*)Oz?C;?q^Ek}_wLGHN1ogLK)H=DGJo{ip9OHg z3=H7^>|YmFcgcNls6&@q8V4&YqNtG-iAG{Fv6Mv4@I6_yNVu}v(kgS>(s>l{wxaJ< zPJy>sFs!X%50_p3)GtCYh?d#Za{ZE8kae4s|Jsk+Vo{}7u3W)R*VEJM@mBfaT)5Ht z7~XqqACekB(WelP)M!h$;eVa#pC3u)(O}!dw|;`F5YUS~oZ}ZpU0L%ybWiq_s#n>Y z#W!92Z1W>39K)rQ#2<1$Mciu-taUGmuR%1V_jI9_@i%m~9Y12D7YB0YO6B;&AGbs+8;lB2oQmI(N?cUWR}2muk(i;%>@s94i<%0J%cTa zL_!mZ4Z$DQED>OtgY^A%bKfM7NMNj3ilG0*B>7W*cq;^lHE?i2aKh3U)A}T_0gF zv0Ns=sYI+bO9=)SBWeSJ(bWBJ+5tsU0u%|(%?9!tb&7S^a(*n_JH|C)Xll<-`R^|)tHv2^3ycKtq!~KKvjZK z4c@(n^-;INZ`&_VbUfB@f@n5)GS(-d>6f_E>+)P|JFAACdlg@kWN{^?vF~VHH*a&Q zFk-O4)R0h6xNG&Us6NjzkJ;%orEO^fPwaL^m3+fu`zxnBl~R&(9TGV|R$oo6-Iok_ zM!yw)zdwJMOV?#MI@M0^|Lu-Mim#}tsOS*UG0ri?BumSR>==<;6qohjI+y0ml;9nm zwvAYkl!F9Y+||)jRaEub(j!OnG^bMcA5C+6 zTVMNF&zhV|}$B9^cNlz+J=|Eo9ZfB3LXQ^L;P{#&E(l|Nzc zRuvmR|M!+)bR+^}@b9f5Xn?aI5ow z!#$H5HaQFr7w|LNYd5teR5)`H2k^vQPSKV)B}T_40C$$w{6D&=dqX`%2)$Pt(h+k)z`1;1B@I$0Z z&(re|m!Dbw;t9L!?(Q%DyAK`IOHRkB7I9=4ODfEKGHy-=Ke6i27r7NTvr7xq_Bpm) z|d z)xqq(T9&kd%a=K_%3hz?ELdXuh0#=d*#~FYV(Z`K{Q*gY`8pi>Ys{3&0e7QjF3GLu zAP%Sj2h4jd_OlL<^vOtZO- zpFl5lDLct!edN`>013JZ_-59eowA)8Uhlz5-@&!*SQIiqW;4u>Bsr%uq?iGJWsv$x8@nm*xw-_%T}1D1jJ|&_0)Wx*VmDYa(mi=m zU-2@`or(l8DeI#)w8~p2F8)K>gsgKUy9&K&4Aye`Z_TbQHi`Ky^~^0TL4oOtdd9@; zET8VV^2y{FZ^Cz7N!GU?BIxauJK8rHE_PujkhT8uW$a@u3pkZLEA3X_TYDM+J4!;e&v1q8(l|Q!}E1SW}3z*_| zI=D@8a&>QZf5!pTrz4|xj)%V28|Wb9Suas<%Zw5r(c&Iza4@KDW0R8rWFYpWhnSZ; zGcyx#i}?8XZmo=>q9PD&dcqS1`C3|OOAHR?w1_yBTemJ@pWG|R)MICzXS zmPwiG4|WdW#QXT^la%+5xfgA6Vq73< zGOL!~9<=;HopWuGyeae@ao%U5$nl(omkbGX>X~OmvL%X2lBWzT%nA)GjWI4H7@+Z4 zsYdU~)1aPRy(bquxii%q=qW1;dTJ81S^{m<9*hU{hG7Vtk0h~XYE_aGc-Jl!eXP%8 zRX4U?|9!!=1GXPX9o248*d#2-R3un4q3SVP>zWUkgSvcydM4i0pg`1DQCjL@IZ>E8 zf`PPvser{Dc-2%t++R7zCW6v-^P~M0co2^}rdQ$Cg2f_G9Gg)00vMm&izHQBA}^(A zgh&eM(J(u5+iQ0LOirONLloaLFaX+`-7bxE2azeLm6_f6UEB2T-Mh+4H>jDUp?*pe zcVBp^3J#`bP=JKo`y~*>KF=ewQ%)hPo}6z3;-jIy-nyf;#ys$M;fY(s9-w}ChnqEy zQ;3!R=U_;Rd^lc`!}sO31?C*wsi(THj1om38{wlKzVYmFsdw9vdmHevtH}bTx}9K@ z2y?gb1#{J;1x9uL+Z;q%@MLhsxAlj&G`}@2Ccb|!k&al+KDcyXJ{)^zK}p7sl@Qae zGj>&?(P zt>bD-LJ(W?;#)WLMCq+#3dM)TD0(PNQLJ40+e>m1)|&Naa#34gX!lRhKbp{8w?c* z4d8uJMX&knCJCZhd1&U>(9c);Nt2`)MGOyIgf+<6%bjUtwgu3u+0-n)2?R}AV8L+x zy^qlZ&T#*B6uU^;B8Jx1CDHtO^j{IEqeR!VCHn7q92GLJP0ml`_mwe-2Bn>ebV_W| zVZr~%Z2t(l@YUaaRXAzjsBe7qZZ>GG$&Q3+W|HNL9qMC33yLDgvT#aqZIbk2i^Jl( zq%vgE%LbhZFKq1<>jSl(S^a$&k=R4xyALb4oJFZDs_7)0GF_%Ob3bHGknVgT+SVjd zM&!!o(LXLCmT>x9ZozX-m@g-$AhSdb8#x{=JfiqXhz_Ty9iLX4^MQU83sZ)A?C_4k zwl>ZS1gH0BqH6US$GsVQ9R)4Mn$pmJ&N8bt10{QHDbMQ0!^jtW1%x=ovaz+TCOHGj zDW4Q&IHN_kgC>gVs?75_lS#u;EXRV*^zcXXX6zZ(rT!kNvnok4j-FdAQjz~`QwQ&# zLCgF5pmGojT>p$!)a?mTf8t;#OL6)R(Sla%Z9F83w;^52&-XRYT~;E;--Il* zT4giN@3a&#Hyt_tjm!7OHL!Dt|*}+6J8EL2ubamN8zmQVkBNJ2p{{9d2zkrV!$d&F#3w%JhTvBgf@4n2KI#1M0u@-%gxbLl5h$SVdY6-^u8 z5f*2&f|pt`KAyIq^UqKOowTI_n8v*c2>}D9kK65Zc9Fy)koN+}4@%5=pF@t!Y@MA0 zFBTM)9&l_?eqHLi0o!UoY=fDyWG#l#>6>PNnG9{>~PPW!{>naj*4&os}H<&K^ z)}iky$kVNmAfnqhC(y2&H2P4^c#gffgLE$cbNCaTC12kaYh?lV#LgXxWDIwA7nO^! z!m8iD*LNymGn}-jnabV6CT6gEbTM7)ubmArW4<)JQ~@%qnU?;Li=Y|aop0|@O?H~8 zXJ3rCC)O$U9=ySU*^5Cy<`%p>KIb#dYZ@4ggA|FH*MxI%0OOVObaNmRI){gB7a@RK z>V9%^NY~;W^*LBa@2_?}dD2#Ge}9@9rj+Qbft3o8szH!K5XbaDn9M$1fE`m@#HRWEFR;fFuwHa6@4 z8-&dz=G&h8&~0v zZxu+#Kp+P~F!8~mYv&Ue&Ijj~Pnv^0-alIO#I>>{TXXOVTdd46gU7oOXJS|m)T{zC5rHB!|)LEVnmKrVLW}bt9sWA>>Y%2d|*?J%+b`cxP)MJb^E55 z2cc}De+&}XE-6ZKl^39Ck*5WqLev6s3xBhjraF(~e&vC9ms~x$i;6>A;zMO!i33oc z9Q;0TBl@bS^}-x(Jssaty$EDqvBBGmgZ1P%I=8*0kHDD}Hk#Aonn(zwx0_jakf@(N z<-IEe=nw<~y_ZGNN(Rrdi6Qgr{egRn$nO<6umIidy+4OGo&Y{<0N8y4m)tJG)|OD* zK9I|P>Q88g)soF@bKp(K(*quZvYuL&AJ@9I(gZvwuR9Zo<7i7j2?i-cUmIefJ;J;( zQZ$@jkqQLpy>H%N>_GH&FFgv@Fw{Ub_KBR@r%DxYykX* z%mpYvxOLf3?IN)SB>9Y+`~XQ4+QIj@97hK{=WLz*GuS1`_VNCa^TWG$0pjB59&5aF zhh}x2n!-d(`#s_=0q=k#DX7z1NVtSeXYEoV(aWlp=+U%WVDzoi~96WU9BNm9&lNkyF; zL2FyweAsH(7|>M0Ycvz9cf}}RgB2QL9P7dq6Qz&8)XqW3GwqF1xd@sCQ@gN=?=!N)zd`-mUIGGzcS0G!rHR3lEx|c|gM8;Y4MTx$jc`4LLfBP(J#i0ywV_a`WHd-U$7?u}c>EXj|sjJrh}fu+Xs0hF8VbR1L9Jv|HuE zg3A|y=W_mlN#8Lt@;N)+ot!kv&>cNbdEB zaRxO_He)3vta|d1$Bx5!if%Ro-lIf@TJrMf8}1ivn4>nogVDj!1An|M+(-i~JUV(F z3vlILTBGC)R4{shlh2XFovYsy6wK$|OW|+_n6ysI=K>aT5E@jn$UgveEm69?gP$c(XL9(18RFzZVR-inIhiPd zhms1bpk`sWq~wms5R-6sbJKnfGkVSd5TMHJj|of1oldhndQS7Z6La-Fsrj>R_@9Cx z2h2+8L>vq&Jsu(uBATeZ9gI2!Nmm@HabkbA8X4kjgmx(;b2pcnRN+u6{kj)LcBTGx z-Q6926)6x%RY4TxuI#jQEmY^u#H%&fISVpCgT7f6-EbZo7k=ZCNEAD5&AnB z8oD;yxj4!9Qx*$rZfm}OhCBgQw^>qNM3$)RZL_)&M2eBh{@RtU{^jN#GzV1H^3-y9 z0ve-sz-cG35QHY7s4P9tIty6(__+{C6uoXOQKsjbRQ5p8Qz}mU$%SU9ZKF;8DMc41P%3LBXCQWJ^1IrSoyjX;fpwDBgNc+-y`M zexrPVpXC&2ASx>>fe}YWXsesx*uuE#&sdEvK7ZYjpMMZun-+Q3b(pFWW&IUUPT-H| zA6kk5*D26`Fr~kE0g$u~)7migZ1U_X+)=WdQ#CGc1an$F)cSf?R+i%{3|**P?RKMe zi!(hd=B~4m+FMi$P=s~IGbNUOah?bwJIF+36ke%GyMMhQo)OEPs$Y1n1CpL0(#?*) z5dCS|(ufyD2(qJ7X6`MmQEW>2b3x&j5<9@2IMtpOBbtG%&aG(fKg=gB-S?0o*3nSK^>|NaU^XOiS|#wx8kW_Nkp7toLd3-6nhuKh*}p*f9sip*h+4ov%A>iWZRwCmef?WajeH_feFxcFwomZur?i_RYk*GzFgq$4;xNs#@qRKHHC%rr!)~Dk8QXIG@FK z_HPe|7dY%iDkML_(lrf9ei6gXBfZ858bm%5obTsQ7a#fr?R8@D``2)Pi1B6IY<8S_ zPsyV%Gozioe(gbtVcp32svpN@sE}(MU~C<{Se)QDMEg+&Sd;Pl3 z#2n%Xd567=bKf{x$fZP1Q#(&bolsz4c83_%1^%+S@KIiU#$S#>FLc%bgKpV8JnA@zbz7#f3+ZQ&erDQKX=wFdL3K0p-CFcD1E1fo z3x*M_*D!^LrO2Soowe_Eyz-?E`~_sBfV2m$`b)tTa9EaW+hGa36&v6}p0-8j<8o|^ z;hIV2kFt&a)#u=Nx6k0MKv2VP92a2kUmke$(1#IRFmUjSI?wnVtdXj@Fd3W!&K^a~ zz#t|;Q#_vv(kr&&DypsZ2340!H*mw~0wRguF2d+W6G-N> z5eJL`2k~a?B^!&`2nFP4vfBa?lccWN5^@;T?KF^dmEFc69VN0VVj#t?W>e6Xh|5JN z(EoqpiwES}pzc7rL=A)AGrg1%OoFb9UB87^cdR$F7UJm+`ywp;9Ht@f7L1Oq-emvf zCakFPB_n>V>A)m+aX!ISWp#L}aoTI!2l+gR%JyN^Qs?>|DCg?-qM_mZNFt^#&0*04 z&mn%}KLq`=nrCvD;Syfo8A)M(m8uV^5)WHXxUXKFF*6GQ^c74e?>XDuC>d20H@|=X z{$`BmqvAne>p_!iQs*NaV%9c#3l6)ewDc1!)j_8f*95C$wBqU(asZy6l^P0)i9Z5% znYgjp>xK(B?b!5Z)PX`7Zg{7urWs?T>0gOawc4XQa(-t($1Zm@w!n%GIw?`}8ifVm zl+14A7sM7;WlMUhIng_qK^QM~lj$(nHjioHCA{x-4Gq(>9)mkw)%Za}@OjSpxi9?* z=mRXo%d@LDzdVvK2OJ(mM?SD@qr0UBWgrEKdr<;!fBppda&tTO$#VENP;-MQ3OqU> ztgFA7AQr`I`kny&fw3{&PfL?*SdJuS3$Q>g;{0x_EQXbY`fubavIuY<_%dHl92FaS#0R|o{!^;Br!Jwe z+JX7(o=GPT?_#42$gMMS;B^j5TG%8LBZ6n<+8A z*k=-ocA0Lrqu^8e{b`b(?u-ojjA@v&dtY)E+_Xj7d(F!)eCVz95_oejL7>ZWeaw|$ zk(+}p)9J0S3$_(CH}TCiC`$>wrY;h9e*o#0Q!idxmmhPo{p%35U0!T00JS32qYw?I zkbVfjtRbF^BB4Mu%;@=<9hu%&E~n_`v9#D`)+Da+j`Gm??DjJ)aVZ@ zTv+``HK_`4wyb79&otH5wdyMDbcw<31J6d^x6+)nZ573NZ7&n!ac@obJSMqIOUzvq z>OEifu~%jd7LJ04$-DPL?dYZ5tewoVKE_f*Gz31y#J>C7ZWyGylVIz=4l7VtLa25T z!uy%nSn^ByqTzWe&rkt!p$rQ`M++0U@nN)45W%h&5U4?B0hZd#^e!)~B_|-8jwXlr zn4uf`2(=(@e`WA{BabdHR*-f|`0DVNND?Bo$^v!QK$Zs{WM3zP=PjXO&JfzQ#rHJ9 z5EnRCTKz)pst^tjhdD-6{3e(My28@|7vU)!`YGTzGWhq7ggz!gf=s3lraHdG))fy8 z!hvTWV=-wcu?R1DKtd*2GlpsU!y|VPrE%D}gC9ZYXVCO~^`$mvjqUkDMDPY`9e}*S z0X2Ai2cI;7gu~f7WsL$5Z(ax)CEgQ5_HOf0QsUPjK_L={GBOf5al(0lnaU*M=M9eN zLR>}2t_sU(O$Nrsv96R(Cnx)>_ivZiX&Xxbkq(n6 zWEUV|66_)~Fr?imIQp%@i(f*bp|0+37h$k<96Wr$Qr61xIX@+&a-MAp7n~OHdbM>` zXfPwXqR^p_>gd@or7NT*4A~MAFlYFGoHj^AVZ?TTzJFUH?(*hZkb6LSBCIs|V_@2U zi8`eyGv!GR=^bRc3Es3Ow{Np9HgSHdKqr4HNQGQ~hn6w?U>gzw2Ck=;AFgXre~(T+ zES)}o{mP{qihULZz~jIRVX&!pt!rW=e+o1n1QMW_eEND=1H&GBrM=uOIU-!#5sF}j zU|I(*WSjBnXm7vOJ_h+7k30NVGmU{xw%LpK*M)_1rD?X|k%ph=J>wv}l#-Mt=GTFf zJf8I_^ecJQ)RIB7%XR%yGr}vb@CGRwiCrCBj+sNv1+UO`C=0@KY>0f-YcshvIUVj1 z?md>nut&PP3948&#XRqOoUc5e4a~q13_0Ule6T~JX++BZ#f~7Yuo?eLV$RgcBxKm? zQn(=1HBuVdjYXXq=&W}yDvh~?HIj(#!HD|~X_1VY-NwlMzL?n9qwQ~jD_dWoX6ZV| z$bV-R0@BoOGHRy8S7l|IWjJJjgGQ1-71LJUbvLWg7bJ$Q{iOTUiTe##K#H9vMk<%6 zp-r1S-sX$ZMW!wTI#BIwK>Wc$12Q4ulRh8P-UpF^nqg2gNZ;Q|t%dJ>veu|>@=ruhn$GiE$mT3VW$!xs0*;nt6cN2+BV z?d>(4cIH^*@A35{cAoXOvB4wDZ}y=UTsc6&F--m*B0RrNyjo%buZbJn$w?_Gz=lf3 zLdqFr=N3`z9WSAC3;EdCT1%SbTRrFMuAG=N^o51q_fDybzc78~;PvZ#{dz{TOD@>m z!NgW(SRrR}Opz~2L_a1Usjj7^ENYmM-RyH{H@XTdkckagyQj@WJ)oGZsLzq1nsJx* zKf`&;Xo=wu+1o%MPWP7kDs)v|I%ITofNml8etFIl5{fED?$Bg3*+&-(m?@fiSgG9~ zU!*^y?pb!U72ODRef4je9~*dT)3&*<@UWm3qQr+jw*n92m#WG46rmBJ3C#IrF?f25 zaEEA5U9%aG5mQ*qkrsQ$z+iEZyw=1@Uya0uQ&UraaDXxW(5i(Q*h+y)QBp}U3X_+Z zBYgj=wChd<(n-*wxIkY@0RYfTf`M z-A+G-HlGKSD=T3lx3~yD#W9tcFG~C(J;5bik;4>o${hEYe2nB!wzC|Us)~37R^z6S zK1o2uRf?H@&M(kh&Tz8{e9Is`kU##Zf1r!h!u`5LZ?~qR@X)Q@=%ONmON2TZTvb?Y zLt@rl9JaTw^X5H&{=AoX@IilzD~sI)74c|cK>?O-9CZ7*r+#=m*W~e1Y546iHQm;*C1O~ig3b5AJN0|5%)%RVKIPn zQ|WSseqNrwfVrU=*@vTW{B4B9M(B$c_MPFd#`R45kz>^W~>#hyq#gavOye3(uT*NfC&ntawguM9AP49 z(ui|rcYXaYuXPKxvmwHn_k&>SjcD03Mf!OO8(Cu6@wTra>rlsbo@!#SDxooOJ$1En zy?q$_6b(O!vJGF+AaWn=8l;B==?(gITA!7bL4l@?LSQ(EiO1^!TB-CJw@azudiW~w zRT=+s<9sU0iTu!5Su9yW%P9HeT0T!O4!BwsKo-Jxs+s3^s}cIa0w z{TN#w@Cz;-szwU(%fLzc937je#HjI7p^ToAhru&NJ*5N341RTWfl>+YAIz6as!KJB z)pd0tgTlaZN!fRAUy<{Y31!B?PhuuWYGPz6&b!c7b?rX5nI|n~?jkssVTm@8GqCRR zLct%hLt~e#l>C{;qEpO}jYX z$NnQXYYJ!9-TTfw$cn&s!oypvN)nPG?gZE)$M%!&RtHj3Qd;~3{c`E72wJ(mzj{ZcEAKBI zaAvE0QN1}HE9w*`ZdOzp-W^=Vw}Eb*Fc(Y|y{Nc)os-@S>jR7JC!qhKs|==;V)lCc zsf^?BRl!^t8IHQ$vrhaB-s7|%19L%;##`zh%x=`74HD9!CAf-p7~JE;7dqe^eEYhH z$Rr3|zkj`T7%j$X41A?O<{z|j6xc$*M_bnqHx1b;utx!CO!tnfu zO@?u+k)kl`TU}ykW);Sz8-0cq(Nryk!e9C#Ecqe2gVo8-X%dD<#ll)m!-lqXem6f?BB_d4jJd*2ntr%Ju$`IsMl97+3S$^Fdg<) z)DyM`mnsk6TrO=|b_dG)UeuN~U2irWE9|7%N$Jq5>7(- zt7!_;GO5uhqjt=CQj!a=zo$=3&rw=nPVw(yEOsi|Q8%az5f;%OH<_`&Dp-Nj`vqlB zU`*>3nx^p47n6GTc_Vi+9Ea|E_nu)D=hRb{8?cukCJeu_I~Xwqam5xjrd8|O z$nf8OUuiscz1pw4M8Wk&ie6n^B_2yRk#>sAc9 zZ&4bV_HJc#J-_EQ<-|Moc?Dwkb@S~QtRu(2)Z0d?E21Xgt=aEPo6I;SjHF<=@@0T- zE_hqzl<{k$szR%~(tpWF|DOR#|AMhy6@A~Knk&l?sTwZSdrnm~W{>srAG9 zIa&3f!lE7PAsSz8Bh%+)%v*eVckX;7Q@#E;D@(IEv^KBt-atVU(`Q2ol~K8O%sXO@ zOv#h7lJMt0;PU_QLHb|%<~=2et%Z*@coq83SI~Wr+)o>=-qCE$lu4CNVYY)g;O5Td z`e#o`!M=l!c&;L!agb938s6P2JRLo?4)#vkQ~-q1%~ z_u}MAh+7b5I{j2Fgj!!lX-dn5DDL6E@$OO>r%F}n0ap*lOSR%?nZFV6k8*2XBnxr6 zi9#|5hRio;@)8)iThrdg?`uv5Uz8|yRFj>r7(GXs;{Lj&A8Uj&4mss;1abf61vj)hX|bW1L^D%!1@wB%$CJ6ge|BJ$P0pWU z;tA}Y7k$k9S?&}@^7i=Kv!Rbyd!6}sN(ys)> z-=if^T-hGlId*xS&Uu?hArK4>t*mQy(X}RXa}Ko*oTqNm)my|VHcIsmADLFm*Li*R zbVuI~N(|D*21a6Lku0%YN%h3#cC5shatf2@eDxEPt`X(l|{tFaTPd0CutYr4(e3;N!#0D)bQ_X(4&3 zm>6Y$GWZTO@husZq^{^vr3bGiy8Nf#Ij>?M;dQ{)Kc5CV^EU2oJBtOaBmKi*9sRME z|L4|BdRmIduP;|=MbXGfSZHx@bX-0YiQ80k+|ZMce*KOzh*^5xgY&DSi#f%pFkS+N z;F0U30CJ<~P!Q)k|8Vq_Ip7@$$DiEP#+Y&e0Gw?V3EpQj$~%t+9Rz66;tBza9KDWT^5RCQP_&8`~?-YiTV1hy4(cHM7Md2~3g z|BZ?>qk>a~X|-Ky99>91aA9in*NdRc-tS>;S4CDZDcc`PgN0HA>}5~M`>Ms3;Yt3wY`at7~mXk@HC$-8>4ie#>h1DDl+ zpX;i5XbbtgYwW_F$5Espod%?-PcM+vy!C}b!{`R?+oSYDZjeEsy!AT9UID!Q>J6mf z^&cAW96%1xb@fe6%y-VBHZT+0k1h*y=+?wzMk`UG8E8sEH02R8J-d;#$ zj5|*wm8icyt$-!a;0q}U$gmwVq`ilR4?AG}Y>mu4=b4 z*qdUw0YM+DgX{EzGFI@$M1VJ@*P|YZ)+FVU+ec;JJo#A@k`+YwCWF8Fx;%f9`ihb< zdNP;`_l;xC6u()$$HCh0$jAsl#5NCXAn6&PU}OY|`Lt*P=-R}o4*8*MfOwvZJ-n^- z;6dHwmuqfRQ~={Q!X?X{6yy-rzhuAGLlXP zpL9a&$)W9MZw&>3ZaUZpqUIG5172`YUr^Rf0Y0K^!!VLLaxSDFnKj0S0N{`cEIbo< zNW`%#LM8Ic)`V)Ot+A?P>PZr}UMJndU>3UsJVveOrarvT7S8NN|cm3#hfRbE!`iZ;{fH1bvAEM-AO{VEIgIU1TW$u>=pg0q412UdiKke=z}F z42UpkU5+!ni;(Vx&?W~;yDvlorKe+{KFT5=A;S=s0^IpA!$_nBhFbRvOx!>L)69nY5X zrnnmojHfa+8YsJ6iL=SZB9~`^j}9mBScPP9^&8!JiY8 ze3W~rb!AHlQqb4?{jOb-{s)C_zpUgHh!;}EkRVmRHR*~T_1szaL;F8O{oq=&4W+ry8~-r~ zzB=O>^$(lyhyBNxrR%HZOUBSx>DoB8r%dp9+;W&j4B9sg-mwN<_UnBc!yr8TCB|d> zL}%q6<~`B|VDs0$@#UjL)%-k}ccwQjWLLey8mi?R$U7dJ+9q)-U*2d>n7W?g#jxp2 zL)pfH#@cMiGtyZo-KhN6!G_wkb}-b8;}mC?P3DqZ-`4(7z+m_MRC&eDUMEcbJLx~f z_Yb@kjAMl>)C`|hB}P329c2s&?Y^_>Yp=5PuCOwvbfhC>97ath-|D1%#F100u#*XR zgK0OsQ=M?Y*!tIrU!*bM@+`edV*Iag`v1FVb4-79sj%4YS2<;wlk-RkMMzU?r}yKl ziXUXQk<7YE5C}UcAPyq=Bd=gam4lBVOp+;L(7~$?#lQhUK`tT*1!~uSKM$PYld@x7VsLeS`jlhBOLc$V){k96EtkPb0g{Op4t9Tt@g`U!44x&ku>nWVI#QaO|+7 znTr@KFjjg0Ixu*(AU}_isbYgDulu?sc~WXBd$OOPWd}}0bU+~oM60)uKX~i)*O>v( z_yfPZPPKz$4oQuEq=vUJb^02J*CB3&tD%$=+Y9P-U}MAZZX(pS*Pi`{-6}9owr(<9 z?)VQM{p*qZ+Y$b=!+(ZS%!cL9DgHCWa3E(4S8)aZ8W%l)Uzfei!j=P*2UK=se^p3K6GhaFT3q)N!`{=E&jDq#fw#Yz0zQ2fi0 zEj(tpuGiD}q$qNdbhk&EfqThJbrh)&w9Y1?bbAZxbr6VxuhTkWn18B2axRgV|_WhC_2V4{nzjb#~C05_9tLJ=zV2Z7mAkRRO8lARF-~0cWMpo9lUN<`O9u| z;`ppT4U1VXRR~rX$!HwKF-?+^+ou|TE!|+0++nqyoYy!Ea$S~ku!U!hEEj=6Uaic9 z$6EhXo1~hJMR9#;?M%&3wIW*5vL`$;Ld@pYB zb4*OY^Dc@DaVlg@pAO$TJ3Sj%UPEw?U|PDzdOY?>pWxj{NLjgEJZ^f2v_;UevEt&1 zw1O}`+2s^zXq&U3DC5CgT>~NHx|>n`q$xwDzN(_LtY(R#n7)ScGjjji@+)2xAp{%d zn92`knt~Y0VnR%(x*nsMaI*~|xKHbn5o`OKeXg^w%_K6ox2mG^nB|zm5VoG$Hdc6+ z&v0t(IoI9muO?!kRy&JfS}TuuT}@v|}MxHE8uD|ABYkBU!lFdLZfJzJ`lEDF0esOEfNHej+>HJtPYo zHbH*yel<72hK#@cN#%3&<<>Nrn$&3(Z$=~i=UScjsIv^}#&tiAo4%}^73Xl52sx&+ zua2&)j(hNPnJe*0d$4|5cZZYYPM=jNh0pgjkB=4l_Fg)0h*6?GpZ9-I8t9M_cBx{k z*&V$%QpIZc(bVf1FLz`{dfSx#ar?vO1i~3Sm(puOJ+@x@gO5@UPxUAhqlxNoQP{eU zQ{M1dT{9UW{HXl`?h_fl1o(CqZErJ|be z4u^Q+6HQ;CiSX4sn#P;jKZhH;#0wTChOAIon0YkT zpE>9nUVkz}PYYw;K@OvfyclwExvR49N79h&U?}pc%NTA&e3|`vkxA9 ze)*(tapoQJD!Q^yOA#~OoWO}$+>1TkJIb+SYeqge?o?9G>Afg?K?a9+@fkZSGICdoVasHVk>;@7(u?%C z_)Hdymi)v-bZ8;#*6rOJRU7Yz5jlDM1Qs@f?GO1UH8IMh)x4feJ>|oVpmdoft9|uo zYT8Q4z~t5ys~R8LuP+-H#+9#h`M zb(emwJQ8DgT2DT1Mfxa3?|$`Xqt(2O1v{M?9#gN-9OH+xBIE40GSrY`5pwJLHw!i7 z$ZE^~%gAC&K`)a3-g7au&kS2oS2&bNg_*AHdrQm6{w$JwR!VUz~z z?w~1D=qAaWjJ&=J{0EYLGJg&Lm-YXje;(k%Y?w+(3EnP3jI)rZ!mfr6Bw(}Vwf5*Z zC<}X?Tp)&+UVvE?8kDrt)iM-amA;=rBKJXlupRqAQY9OC_9N!GtMlkSj4!p2W4iu! zX#WSQ6tdShjP!xQKifgRmri;98l|u-&;mj3gr=|Ch8 z5A?yJprAn7>+cY;a69K z{y#&?M)ToAt~QNNpI|JR=>7Cg!aA=*2_M|Rpv*gAcv}cC8!;x%-+)4>JZm_>zVE&B z^ZKY^iE&Kw70aw7Z^n^3ZeO3>0#-bxJTfbiccX~5Y*%PkK;D#3U5Th*ie zhW8@ivIFTHd;>PH4u+fsF8LKkX}8M)HS(`~`w?-2^*Z#jjvZgvdBm&j+0^O@-mK50 zZ}5w(8AN;9DSRiN;H{wIt(U~vyhf8#Oz$%JJmlkTRx-G?;nK+wOA(VWi&<#nhLKbTZtZf4hgxV_hQA{N!$D!~WdurlXm|n}6LAxKciYRwbR4&~g5lNw>1H zszczeHoKk!=)H~bq!LvyE?OZ4a7{=EJoiOKM1Y{VQ-+fU_YE9I!OH^BQuPfE211qx zGR#Z$C^`|3!gngZN_9RwK@4dtaAs?iWAxh**j1Ln857SzY_1m(tvHBHQ(|v*hEg#s> zJ9UFM`8@CGc``XQ7!4#mK?<{8ytpxG$;HnfczW<~h|fC-=kMEqgk&WPtSHo8scALu z=B|_BmxJ(7BqN$ys0vZd{SSm z%Bl=~t-K#A@XqC@NI1Tu$Q1alSQj)YG>TV=?#yg`6Aj0rgfQno>H|C!PayLI4<5)}sIHp%tqtWe z&mNzEJ`j?h?Zuj^8X79<^uVT~LHi%bRl?n}+O5&uDDWZ@F3CahQ(JhcvG^nJbTzXk zpK7~9yIM@h89Vau-*o@E^{VgLTj*2(sc3LNfY#4Q2Va1CKo$85&JV~<5IVBd9CX5S zIJLWY?ZH4?Y@*hs>o^T9S4>F6m{cS^Pd${CBiHGqM|Tb7iTY0!&J7(|O$|ai3u zPqRPx@M4Htm5Nk!Z68(47T+xMXp~r0d#cf zwXR6Iqm`)#dG|8pfI|lK1j1Rp=i;^p0?I=5%p0Qo&Y(^-1dkM>a-YKpLOQVQ zCZ-p2fm;mJk@lM#VCI{ErXw_+V(`}7%BweYq}dOtv(N`%j+1t|5E7R)^4^R<*>Y|} zPXmyvB@2rLJE>4DzU>>@p4XwBsWaKfPZ`}AHl7L|Z_9i$7uLsd8kcqJ^Q#*+N$K@Y zuNLY!X`{7aVi-B1@n&rGk5~_UTGe5FvxRk0R_-^A?z!9`o8cKaxIpe4*~vI?9;q>g zo1?6(Od7y{@aRQ+|N0KnfY7`{QBhI9`2V5qEr6>2*LP7A5k+C4NOuaNba#URh)6d` zNq4tOhX_*AN_TgtluD5cjFic_97P*G&ELUSQML7W<;X+EN(A!Ccv=^PLTSm z6&6UV4&87ca-l2lb}1Pc2quuNPr6$Xlv}uexGA(W%>#nN@oxzrc(CI%!FlCO@d12L+Ngxm0RrtnXC@8Hs@5FACA{9Ua6@p8u@hV zKv_wRdhxEqsdXXC){B?l#k&0>=+j~Z5O>+2k_5C?upT)97ns@!PuNq$n3!P2os*r- z>waYI;&L3%X$Fq%(D+-{YtY(+>%E&=MS;aE!9(@c3fuGDDb+aELw!31U)4AAeoFKL z)a>kV1;W%oG7q%M^*^cNVEF)7W_V5YRL3@;z+quw@JWPS_p*S?1K=`z!aD_lnzCuP zVS`EB*%LV7Civ3`ee(_V=RlN%{+DkoQ_j0|tw&H_*_2Ok zM0J9u-2#nt_cJpW=jOmwq^zjO8V+M1RLLjuIl$2gl(I=UNPB17fEEo>)90QjaoS%_)9#En&mW{irVsIRU3tjPG2W}S1&GgIN3AYz6)Mxy~^wu66Pj_%G3{+>X9)$PrqAStR!QP{oe84Q>d6Wus0haZE17vMuaAz2Z}*xqYKHuEn$jXQmO1NW8k zCSi?2iK{s_p`!IfsnA9ZlL&Hn;9Y&u1QBV{gimX2h|leF9S|5Vm7UUG*~@PW_^#~m zhPFs8t5Z%=%LVZ95An8rs@PS1W9R4GzQW*FQbSDJA=rYeg|+EV!UK;r1!qSyGGYJ6 zyg)2o1Rufgui%K5?s^oe=qod{n|~umHLlYCT|nYoid1fZ!4gu z%lcv1zbin33?SI}3pdaqY7c1240@QV8HA=<~19Sr_j zoWYsTR9t8Bc|??O!9^r}Ace6UP54L>I_a^Vf#`*Nls$-T1dP8bJ@!woU9xMxzST zLlXqQ_Rq!kzxZoZAy$nS7vPnbc4@a=^s5TzgM*OK6Rl?l9>Yq|B_8-=-b>qj^XNe1 zHT_LgI7kRa%TPb4{1TwjKW?mSyyrj$PHR7NQkXC6m$aWP@IL&;m|UHQF*fg|wfnLx z{Hd$e!^>`3$Kt}vhT@jFNSn`tUm~!XFZ=7Hv$nh*n%O?y43*@NGdaMGLNk`;Pi4yW zZ2)^WzE`IhLu@IUL5L{DfBxO~&dqipOGCMO=F*mo(LI}2FAky`*6k9f?ao$r1E(sQ z5F&3C>4;7*`zNP$QDR>ULLf(#>b9e&!IBFBgtP>`un7djwkcr`NWW?B zvbrsZK>moD2qI@`dLiW42C$4Aho&y-A%7$>3t8oj7JuYUxO1Jqk#$c1z!|*|6F5D{ zQjd^_67^TzMecV={>UHQ35CBweUBWujU))x&RTnRS&%723w;qeO@Uf=t z+50)U2r|Bx4F=MtYQIAqluEi*8M$IU#;X-6{r>o9tipNeOhgf@7GAsjHuE zzDZr&hEN!;AP}KAh6VuDu)i@7W`0-X(uLcEy^_0`h_nT$%AoiFl?r+^L_?nyp zdo&ZA@UpV#*%=v`D6hyyB_|`g7vNU4Eu6f`*o}IB53-n^Lx_?}jXTw~ooEVAz% ziSH8=8(-a&5(_EZ5{!rKP2|qUw#GKF04vzz2(7 zIggEQ{Cnob4_pQzbOgq>&y#CU-F11z+%04A$o0u!2TL8N0Kwxy^B;#+XX zdbU0PTIWspqR-89z$x$^YN}Q_T4-q{cAVb+g;JTGmv=k#gTN~pVBJ9*)-P^PSYAA- z;QZ6v9yAZ+me?M6JXHS$(DZ@UC72|=vnmLFA)lJ#!wG0zw(Cw$E$*!`>IC5=AW)fA zj`_`hY+mO9Umu_t0q^HiIP?lPKV{c(t_tj~)5c9!NPlyri$SUK;Scioyy4%4$UXrf z0J^+bYjCz%9Nk|P{Z!<6a^?d24$?50XHVkcYyvcC9>ea9-=fb@)34=~a+}D${L{_K9E`TTMj(5x2gUf&$p&^5I{F zwfvFs*B#3l_Dt>;bW0uif9@cx#7jG4V<3}3@UPjR-vVHYACIkwA_!&g?(FpJva_?p z1B~~tW=;Qb(cNlN04|fIjps#@pj%R-Go{M4+XAs51f!lm1W6h->wVC-hgK)sMBcB> zyI`X^4d*64lln`LDmk1Kj3Z((IRFf39U6HCmU@96Q(T~C2M9!xoT}vPUh3i%D_tuk z+=rRaSq;8?Xsd2`x4V}z35vj92?rh1*G^eO!))Q>E5T_hp}|2hcWa*d`$7O)-<*lz z`3|A@9jRm|Pnly_5wKtac+my?4h|fDeVwoI1_h&5khJmtoDoLKjr9Ss=YAXckSF82 zB4)Z<^ba1y^O)Y1QVw}5TBklXFs`Yo`3XQ8Xf>2v9sah?aw!;}4M8`^ zhYjYu@p1E3=TI_kB!Ir8JEYse_>Z9Re{C5JK|z#RD1azyg_9=(?mD+Fk}6UiKK}V2 zZy$6!=roNA(Q_ExTfPAhSazn$t*?^qcn`5>P%G09zk}RPe&*j7z|vS(;ojNlA!~}* zS7rQrBkPU;i1u`VUPH|0$a{fTH@@GQPv*6|UK)|~;AyfO@_Yr!kIr~OH)u$KY%?oqTqFM3TaefrE(!?(&6Ki zC&QUO&Q_-S%7rZcsL2jPew%Uua6G*|i^Vn?13ObwP=28s2bg%vKyEn{(9Lu%;_Ec@ zvnkDfu*!z>)a+_9GBUY89_BAz$>swiBWOPX*Jho1*K+AYE+W4)ChfWa-f99v)trVUGkz zL6JlMdq7zkh%-Q&*H4m#CAfsUnoB=^1o)CbjT;)0wz)@8ED6s-z+X!b_D_>@4^J#1 zxu9!Vrm-l8T!3J>PNSE>7QgKty}R$(*_m5&?IBvqVv>Nv1G69ZIOJe;n-Hqrsf&PS zp(JhPWsU9ZT4#lT?&FAnZeUm@1tC}w5c;JT@?FAl4+P^LVSt}nUh-GP_=1jLz1c8R zNJgw34Y+ZmUHP@f+KAM~3%?#Nv?l=KdgZo*4{nn|=w=0uve{Qqf47)#g0=f{T%5^A zkQ{^4f(j)NGzJHId;O@_;j<;-Ec^y@*x>>V^wgN_=9JRXT__>|4-XUCB0GJXaXNJyv! z9Q>KyPp36+doq5<+ckk|M{uGi#K*G~a_&Y@@vz1w=s$Y`pyj1bgh*1=5f!>A&_H8u7(#Wz6; z3qbfl1x3rvM8N$3`UT8*+Bzk$C|Ds~Ivp%DaUOxlkcH(1)}_$40E?|=oxLesAp{2$ z+t&1;0l{GTmZ3=f>CYbz9xz5PYA5q4X{b1XW))n)l>%-Dpn{P+OT~sPeMwPCVLe;w zJxViV>5)rjoduwWK>gQL4+Rm_UeQCYoZm<%edyIU*OA4=hwsk7Q(`>~rIKpTL3_M(Va5hwdu9n1<ax9-pD`tq4NKXJ zlnGLjblDU^l#TiM>&yL_Sv2n|pT;n&Bnt$-HwPr|%a<>)(lgeeNE0S{uPuz46e+J3 zY#^PW+kAF+o%)TZ%=MD8C*h6^BiA6||7>`TAk`+ObZq1##`{BrXk zH3w@1b|bmv5GW#(-0E_clf%NozO{xP>X+WC@CRFB_76^*FTFa#;zsxr)}-lg{e68A zgx_e0Fqf@o|L8VLGe8vsDRcAAh6$&c$9gkmY%UH=h;u}mGa zMmIO1V2T-QGzrOCAxMOd7Vyp?$HXF_ztRcUFIK4D#Zj()AjJBzIK(I?rERf51? zq1fD1573kpk(yUH{#v&P`lfBItx~sl2}V;#f2!oE7Fkn{=iS7i6B*xcr6xkhRSuE% zc%0xkaN^iRMfBvUgh(k8JRpk>|4WsA zWtt6(GRDt4t?8UtS7(|e`2)OV?gY0plt6oDX*#E_zztno_1m@IL~f;v&FVJGy$?W( z>-APG>Id1mX&U|KZ9GA{H-3tqHjzrOr}y$b6V@88J4$JOdt}bc9B#kua(BSL`py;P zwIkgh2J(STm(I{93=th9ucgpY@~WTiwl22e64td_^>-!^T6ZSo?G5r(g2O`5>eU~n zeQ?t#Ge41xqQDR(OT{8kq3Br}#C~%7cEnm=NeL9{oOrwpy?+>N96_ZEDu2I%qq|lck-l_hQWo4iA`h)V?SK$>D1wixz`{B~Pci619f9SvK1r2|Dy-pn_ z_fXxeidmiPJdOE^3${q{2=gd<{xzR>?;uIH0)^0!V5 z=(SKkBcE;E+kUhLSxuVN+1bnCrEWgW@~jC=1YIhR{`8~W37zfV6`6(SKS&rZ1P5dg zwHjAa@L}L=RpBwVPKauDSbA>H^u^{b4mux}C`Z_k&}efFM}TMV&JuocwepRU)Mp{{ zK!1>n|Lkl+EiIQI9XD?B!6~SiG#w6kFa-nth0 z0DuTz1H$CO)c84;KpGb6dHTc5It}J#X5ySe_VyIs&HG?TPq0D;ecrr0u6rg*O1MVH zKPrh=hb$)Rsv8=}#3&F=IHGmks4L*LWjwG2)uY(@^@&QvzQ29fuP!`4a;b(pE8_Lm z15c=V5RXpKmV1Qg^ZJCu-|6C%g~!%C(5d(g`Jj*o=ZAra*FJcHnYKo*Y1 z3&2Sr_elwqI870XmF42*o@!F#x6z07NTB|l^;cammpPBeN!hj_Ih+Xw6rDYW1M2{i zfaDnuIJZ@-kFl1wR7Jjj&+7U0S`{6E77NO(x6L0OcfVHAeo7Q}zwHzoT?gw%7SC^3 ztOB}eb=JL9A*&h{migoL#6msr@sVz#t)hNqm6ebw+@vOXunS$?9~ZmzQ~&~yQiK8~ z3XaFK)nQOgG!`3J43ChUJp$H=uMH`#+u2dEersD8@F{Lx|HN&jt*i`o^RrVj1G zF-U}5BN}A)f{PgKnaVyNeMJlPyZbzB$57VwWV}v*L<>N-Ezdu15gl}<8WZ5@qmJ5(sWdFw~+hM7NmjJLp`g-ynG8DI*r+Za@#&@H@2&1p1KFPAQOJk zwX^HGn$0Nh{3D8?hd*obFKzxLOhK(;TUt5}>=LL* zCG&e}yZeu>oYOH!Aq>Bd6giA>0Y_s*z^mi#{Hk9ZJL@l90W!E)Ifx9PLcbgHNaLNJ z1Nfsxyp*|5_oC#U{F^nb{;n=LdVHD-TaR}mmM118K{LW8|%NoUIO@8}8uQbJvNGZ1lh*WmBu?oGxnu^$uW^f!qg zi}Pw$&_h-Y_$p{Biyie8r#>VgU~#|`K54SQ_V#CYZl^^%-b%~$>v zJ^fqvWrOYh$^^d?#3Pz~R_S5#60>_b0D#9!YGy@jC+(heCIHgKl|8hz z)!HAkUAMj6K_KLIQiF&2H&z{Dy>vGHjK`U5`WfWVdSND?Ac6Tx_#cq$|D$2}|C1k{ z09oyhVb&($akg&$`W7fu(K!Wg~a>St5*TkVdNj8 z1&kt}DmrW4lM0v8gS*;m1RU=v8QV4GYo!7%EBEByjGMjL0{9x> zG)quX?dX)81w8ylq8aQ(FaY&?q}Cc1{gK7>;i&Y~jn?2Hwk6Ge<6k3{US2l%M$f_0>7Q`@rI&IWF*KpgsIH$v{)jx zy?szY4=9X;cjsVTBjkl`;rnk;GH~3S6a+)*_8Cwcf_lRgh*J6g9v@%R!O_e8`0*pm z!X`-Qd;`7|^ctkYg#^m!{Xi3Iub0AtTb0lAjHeFsDBD^n3{vOx)M-e*e991O=n2S7 zD%BNqxBUEXGtko`8}d{nT#N{mnTLlp@`nJLGDVz%mm^rPqf&{kdJ1Nsw7zViKAF5n?CM}I#7Yd+6>_@$k2D`%o%{vNB zN;M$h=*||~14tS8q|O0+X9HGB>%l$|ZLm$n8;A@_jCvST#L9DuJdzRaL z1Vx8EU>~RnC*W2v?HEGFo&k_KMZ94w_wf_HkO>-s1R=-f*C6?XGyFIcOAci9C#*pro&KXHA0s)wP5Hr@6smKVoT+R^bK zyFYU}pndQ?>bt($!wrbsQ$2?8aP?Xl0G-YIQe14)5lIWZh)qF%`s>_}Ulasmt0xJH zzQlR-Bc#p8~7BVs-BO^h^9=aAueEh@7BxlT%X2gLj8D5kEv=YE#=I0j3 z3JWYPEF?3d8Ly%$63TR3HrAi6SBU5!zSR-ON)X)MIg3DM z%WxZt?CTT0I7+ve=+Uqr5jG#^Fbx%G9k-FxihD66J0S~LzYVBr@Ss%dgQ4$0g^9E5uu)qsdp=chF=B65A~_*&#_Eg&zzmq;`IGF8^(xz zQ(R0yVReN>Ha9*FNN1K-Cj1;xs}JRp_&BMBy#RNVW@Pk>=ar~z1YDaCDjfcDiLGJ8 zPC%A)6DQsVuOP@`nAK|R0Y8UF@;YCMuAlyp{UJ9u_r83bzB_l8*Cm7nmHEsKss!#4 z3^d`lYk@vov%dB%7sG>yW@=leVzNbuxie6zx7g7_(aJN8a?Bc zfq*wUBrS?}o%|I>2epBHWlr`6=rPw!$Fe!BK$vuur0(S)MAqn7L<7Z&nNXoi20ge( zVIf5MT`Ef1c2XfE*``XBf3A3{=L$iebEJM7fXWaQT|x-Yb*NCphxBv<*(JWWa3m5Z z8=)Wi_`lY!GI?(l#_YB~3f0EV#>>ffC&;@1h(!r-F7h~UfodT!F)`{Hn3>o1r&_8jd!@G2fL=Iok($ZeJK)q=-Ro6Q)>ATr*+KsPc zzcgUF6U6|+|9v9k6%EZPy-yCue>Prvf-PLl{aVoJg!x;Zlyho=I>;&pV_j9{o-%wM;CBhAfY!(f8%`^z;DSu0Qy&>;XmK4^Yd#f{LC4xxqTJ2OToGPm zar4)KbzA%7i4mmCfUTuVhhIPX0ohA32nENL8$cs5pVQF3nTN+`iU4UTjfSlz|Fczt+=kfd!s{zM%5_)DUjmwh{8xK`t z8*gUYnY!-LH;p}+okIKlS7j$2dU)6Q%#XI>fNpxZeE%(?Rzf4?RR*s?dr#^R_sgqw z`2)4ZX=(bPwK-Aaq=LUp+hef}_FJzDv@IBSSC^B$$oMVC0Y>vWo{vEhexPVnZ$16> zt7Ne2;d1(1Z>5efXX=O(M4A=*g5mHPz@+Y&@V1bN1+4cT8g&ho%+oc(<739)pcSi$ z67FlFhj{1+G7^DT0SmWR56?Ng+<)h)G?y3x3!(UyVf`tB%%m)y-D$(=7JgD;PRa0f z(GL;(RxI`_eUcMt7t6h+#>18q9KEmWwdhv`PiGOb1pqk@o+)T+lMTo(J;KDq48~(t zPR=sss6JSk&^R^+F?_hkyDs>LftIIJ`aHD0qH?(KPHtZ#h0&ZeJEOL-;2 zQ^(^Aclf@B!fTm?HL>6M<>=&E6&4;_qBmf9fivw-pbacpDpf{;P%xz9u1uYsUKhuU zxx)g}xUG9qTyEhlVP5`e zMqTYpcWUTmUuc1Waa{nqvjbDMQ<&H<0NLo|jLY^@%}T!ARp|eZNB%qZ)p~^*oTdG_~x>%dmO=TW2=LQprJf z<;Q?ww!f64R@V9Mj(yC?}|8?nS$ z#o7vO)SyJ+%R19kFCyQ|QI$jF6W&FrLmMRQ5k!JR1OMd;l zQ~9l{$w#Hjv&CR$sW2kLvu7*XMi*AEdy{(WOf)qMwHZv+@ME-1(~XIU9efSl4nl~z z<cNTAFlj~(xET8i5dslHQ;(C{trAfIrwQOqC%?h*!%dN;QmxOqZmK+dzTgMq* zUW0LO{SYN^q0rV8aP*nJ?AsdX=}F;l9K*x}-IJOTd)e1r{7^N5z!W$;jgafk%*+7c z8K|!I%}!JEi;JtSL!@(18F4#YH^ZD6ny6^C#|&`Q57m!X=EO5`AD++2RY};>{E+6b ztX`?+S|IGuSa4HyFbq!GuJLN3$0~TZ7K}_x6ZLM;kdRYhcDUj9?lz%-bJ4b`aX8tK z%5+(J1`a0um5Uj}C@Dcq5u$L8VpIEm3d4O6hgb)Ql2cI|L@2~3L6_VV3Mmo_pnKeX4N&C3>{Or3LME3neSn3H`*xL1Fdu z0!52-scaG><0iVwbNRf}Fe9aPEbj~8fI8c`rENKla# zJ5WP=qF8&~%xsT)QVbLG$K!Gbhu0erg5c+Z2bVzhczRUIw05&tdSjR-`#dyh;6@Kf zx-1+DI+O&-@~JrlYwM6UcBwGeoJg4EO%~NWl^-A;I&E7aT$Qh%k5a!!-5Ns558@!Q zH-l_ehYE)^oZt$?xi2^H^790AN@N_SW?-9Ps9Y|kY5~2Vcf7mLG-zHUzU{auSI<4*0C)b2 zx}U@>DFA`FGQMUOEIS=OKaKhLaYd=3`vK3kUw8gkWvSyyd?Jxug^FbywX?+YN6P{pKYX1?4X*73TSk3pTE7mfq< zqN20YO#~_5=TpklJm2&Lh0u^1hH-FDlA`LwsIekrGmn+>T9x2PTTVq)eqehLJ}5cF zuzF`5JD2=Z_bk4{4)qnmhp(le5 zDYRZEV@>o_o#9V7kM=d49AJ4!cdS7I9piP1tYCvJgyLMhkik16p8BYvK!QYrgYZp_ zc0Qfe>9uQ%yGN2rX&(mpjhmW$;-3$`c`!hdR~bQ6GAZVoY&R<;}E>x^|;z18vl{|;e-<u@9S zUse^PGe;J0X!fU^`g85jvaotxt2D#1Z8%>eb6WmTkmx-~Efw@011=HYWXa93^xDev zLNnd*TOz-MgM)hESP2q>7%zWXo2OPPCGK~9<1CJSfAO|mhFYcPIiRkWHxE^CIrz+$ z2CDMD4L#a#7Wa4D7|$LvnZHY#8ul7ma>U{>tIBky}EJVTe6tz~x%!xjD1 zUO4~o5~>POBT-L3;^KMoTP591kW=nYog`L9NVw6B@(vA{eGc+Ll@2BP!kr)|akvD` zwehWQh#Xm!Rp^p}OxmF#XGPy(9|Um0f+uL{(+(OKYu+)^=~0^k9sQL7yb?lGEw44X#x(**H~^qu&8g9!qkSQ5g<$U zv^V5_miXYqB!`Jjlz*@>;RYvTC{g@fjzg0z;C~Ig%&(oJQOUOKXAC17luea-F}qku z#GE19Kc8Oor3uR&Oi)Q8qO7g!aOMS6bMf7G8IkiucIpL?lP9d_UCx^!ZSoT6f|ZNf}c zq^P0cmq`{t{E6BIB>@&xh~RVHN*Q8w(5i7)`w$@(;@BHVb9v#jAsT(j(HTN2tgXdi zy7Q_N2ZPV`a4FTr4APtU)*lCJ3g_`ET}k{-=dGCY)gK=oRq}_*=V&(!7^bPJ+3n|q zb)HD|0%KsmZgr6Ge`ipmKy6ka_glTAm&9b zbp2j1{BpU_om@DO)}H2_#eV@=?TSNocD6#NRq4VdS>~bFDy9&TxR75n`ZTo*3X1nu zga8VPh_ehC3JQe)4FUxPn=BF?1?2{!0~H13jsM&g6qK*xJ18h9)0F?=i_ zb9cHjP2oZjOkiNH*|(*2{655#LD|20K*&<|#NrJb_sIDl)1P*8*@-goZKtN0aVwL_ zLr=JFHI4~SHAsv}?T8Gq7|Ax;uyG~C(^9eLvgVA+Yq_1sHx#q-luWQbSk1NzZ~rLK z8CWW55L~*`?rJ9fs@X+#-erAv&-z}!ov{xM6}quaxp6>lOQE_Gss6p7`~V9_Wvisn zZdc=53n%Tq#eV7YRZ{6fCAcc}8-tE|!(r-HLbA^_LewZqhLlFVbQV)vx6PVt-sndK zJgTnXO|Yw&aU(cToU(MPyz%N*BzlRouMJxTU$d?SW}W5s{z%JyjDaRsQtL{kq%w_3 z*REz-@MMnW&-W{PmD@2Dzn>OUNx3M_Vb8k6%Z%#3sT{2myV*6M$W&u;?=Z-6E4%I9 zu*rAnN_|UKdD;^R{lTM(sH%z^ht2$E+f&1pg!j|EJ1WN}I(aKy9)vN`3A}xy1@)X zt0`-;4gQp^CnK-r>%;JT9*V-6v+15fQOAUZ_-5|P8~FeKcq#tBT)F@K%U`@m8tzK< z5UsB#LlMI0Ky5-Nh@)mQJu0~7jbMvx1N7NRTAt!hY%hLpPHHBj6Gj*I=-HDi-)CA@}q9(SOM6#SKJV=kK@SGhP&fxun6B z+hJK`*YGv%7T}@tggTAe#mf7?LU@#Ks?@$Goqe!HR*EqaT%2}c7_#0~PB#^OrM6YEdmT_qld;?ch?F4X*RzLab`< zcSCcj-m0tHjP;??G4;fn>a%MCs~;*5C?Y(<7OX?R&*+#J9Rt_aRm}=*yCVxeMsiFy zc9d88^-7rsyLH_A-CKDz*FCC!LW`pyWEQ2R7;Iw2XXx+nGf$-lnTD3y<%Qj1LqVxR zONIj)C45Y_ka^>M;AkxAdS-z<{wH!OXXEFG6$dV^BO27ST1teB>u9^Cnp(Yr?%({< z9ZDm*-zVHEP87_Sh-Ybe&93Z5Y+q*hSUI}3%*FgYtwnEt)#%;z4O2N`)Lg85nJucgCu2uX(bi~lKRNj?m3YZ!yiv?GNH#&GGd6VHkRvNlP7777 zBc!c(U@6}n^cnrnq~gpF?dU{hN=&6A3W|_67cIi9W;bCfglbY(S2=R=2)`*bTqw&S?zx;h^i zLf@g5Ug?HniUz>95LX*@CgpR2Jn8_oRg?EUay9@+txgU%Co<)sLcr&+fvmCslA}{) zJq>uBV=j4mLyAYOqs#n3WU2rtI~<_xA4E2*8r%zHKBasw_)V{D!J|z)RH<#RwX%7OGxnNv>J6ZHr_LJ~g+FaeCy+#ru)kVcBYy*`g>$e?IhU z#^;Xaeu)`8;roB>1Z*MWot}tCy)EW$OCxzY=EY<*;an?~KVx=xciTdUp}N}uc=VUk zbZlnYKLG5760&C)WXeItC-_2P8**B&%R{gAPE+;_7jbj_FrC@>8m;Q4;$~-~Ow`(U zCJY9O_8kgxzeacRzUwg&l6&y1gtKALVUdT;vd2mPfheYxEBqe=p#TVO=gnCIa!3R` zL7mvcvR&Wne18~#t4i|;K2Vf3eESxjr-J+1G?1<(bCn&|hw@c6C!u(9^u_ESEC0qP za$9#fsC^#vo0UN?&11z3NIwrM8C52~>@(hPxW^BDBVPn2U`_JcEy6fo^m}#rR)qca z2x1ZQ9R^AY3UIo>s9v9&cj2P-iV!Fnhnh2FI7mlzAhZJVvj9iW!8;1@Yom9x-{>=h z8Ygh9K#RPXo5CMXqr0+XB7gQaN+ykde-aSTu}Ng{tjiRMMDL(Zs0Xav#Bd$}JQ!9j zb@dZ426Fp$-wgl=AXf1_q zUEHAp2h=aD7l(P|Zl7qv^Y)RI!CEIPaNtAo6_}Wyj`((HWK8Hc>^knVt#43i%%A#9 z%H@6pJT_>;8X6ffiD@U;{h6A--O|~;Pn;?W3CVBYO&5w+01UK@Re~~fZC2J&Ybf!- zsC>o|c$uCWw1tNg@Rq;|s7JCXE3GP_^Ak#F)WVm2^FPU>tKdgQn~>HrN6 z=s$i&o34F3$8L)j&g}Xm=mr(r z^yp}4)I_eP?Spl2%vJ~Z9pFf4kc$$wTL21hTNp97$=093hU1JW6&(g+`YTKFv%$%U zd_Z*@J9#GN^?+(`eOSKxa<>IP=!UX>j~(sZ=$9^ny$wS+(VNLJnXkcJj?41w$h1GR zJBdA0_jd_YZy)5DOd*R|#6p^~2r@Q_L3Lq^;+@bZ4~j>O_bCfZr=0Zh4C-|lE_Yf- zRU-qqBC>1`DXW|vZSbDGOsJpqxZSJearoq=Qi9|TN=XZ}vk2HZ?%f$^#Ne}?`fyph zkVJN1n_{oA#%nGJ2Ui>Oi|djdvxie&Dr-T+H-L0qdoJXZarF{n#_dfAp z*MhjoAp9Q~qob(?(yOU~I(k$mMQI{?fp)p&Syd?*(KHRqQ#xKbVuDdL$f9q2dh)BR z&qEs9Vx9Y&Q(nt`Uw{Nt2uAESy9;k`;mdsz$Zq*29TpY!F-gedqv z#yn8R>|%hLOOe>Frc;57Yqi$)t<`+s2mkK}?Tk(;pO&7lQ`-(NnNVMN(~2rt;J~a> z{vcVWo9y|fEtLS5V=h$v28V}r0B*?1;d59SK(5@FXk2{!LhaH8xJ{4}Lx2$$He9Il zHesMA?icyW&;;|?y<61#j>Vp>T5Bdfs4IBSB#Na>8!A)UNon11Rt)G*@61Dqb(r;R z=O;594Gow2BLEqeHvq*O4u{3LvtwwqK)GzRH^Gr16TzZ%nY-G#fdn^=4*8unp^JPL zN&(0V8s-F~T)8aAv)ox=Pi^DS(R0wt(`zirQ@@Y(Qos4_2{FVfijHx>{mSFD!(&n} z1Hu4ONoK6^5{}J4ocmo#f~RBAj6>WnHe)Y|&+(bH1-vday9+g|)1<;l`Hjk|O#6SN zQLPJsOcW3>Ko96OI37ZaPcn~-t*2*$*o(opx8Q^+MUYne%w3toj+72lqz3?4*3Pcf z_bX(R;7VzFURws)Ayl&AU3fibzQfGjW3U{r``y#C1%xo@CxT5&9>fM0luG23g$pS3 zyblWcZMQ(5cN^NQ*Q#uQN%FutPqkPd*40b8}Cb4Tob%#V?3gvLGaKfJR=?Z)HpRyZy6O3@Fn_&LFmWXONORv<+Pes zq%vi%ErLFVoKtB<6+fyN9r;=RYJlW;Og(z#4&T8O>ny3j8@VM%oJ^19c(;X9k62~M zWX86~tn#?KLxM679#A}jzffgtifEG{o*nr%vN8GFD>N5tGpOA*ZGUp{FNKOyWh2sENBp);XP9#1hBhfpBl^<3AY)wHR76>hp}R`7H%htlFn<|*_7<} zKDoutSB z#QxK_o7o!8jstbx-CjG5N`34(B)a!l1V)g!1635l@Y7cwJ4aEdzt%cn?zke+eZ_W~ z+E_LwsT()cl7@xk5pH)w<+8%!2Ax-ujI^9C!+v~Pojok6I#8lqO`fwZuvs&-3>vUB zx8;g5@pxrr&}>!zJL{ZgD5^tyHmg@Hw6xA_>e{>ppoXT@E)?`M2zL?#R}MP4bBnVt z+5Or<&obe?IXj3#^tBxyb@|$y63(c&4)es2qSF*Vx;d2Ttb1oWSBo=loATs)_290i z`_D?iA^QN@doDwEq}qBfE@tuQemmrU`X90lj6#!BLOld?pGiG-8|4f>!nIw`C0)C8 z2sQ{cSl~jisY|YjMCLo02LxFSc+Nb&Ssedsaf4~wa{u@6Wt1O8+5a424(iFWi#Afa zfBh*DqqnjA@E5PqAg;arYkU6lA&}<^1x)n+zHdids#*Vx7jWK^IThV$x(^`$FU?7u z|AvmsmdvcpaxedB=e5tl$cOM8y-G3rZ<{ni9PnDUuzx(CcL>Byya12=|Mn$+Hjy>@ zd@yKkwp?hu1X5ODeZ~HHmq>VvMbBL}}F~boEY> zeERxTtkw}OuD^dt29~RcEe)cHT-f5~fB#->hXQ@y4h2wXq~Y1#3-kdb9zg+eCH+WoI4?0i2b;ATK<*g{|&Gb04NZ^P)cGyJna z67dL(Gr`VQ-%A<07nqlkk#}n)4zfWWZ@4hoBkv9l-7}=ajn-9^ad^iC2D{s&d;>|9 zIPDeW8fz1^!$Kw3qT+x?xZa0?4NHgZS@E}|T;b2qE`A^sR{{E`r?EnFkl-8$q3FW7 zKzPuMKzst91LMt)yg^U2YV3;_sF$92m$}Tt_{L zfWAvNa^$M<{>5*<6d|Z^Ur9^LVl%=NQvGe6hoNnS16KoJL6`V0?5LF*{bqNB9r6{r zXlqS|vhwnP%$n&DUA zeDv5Y3o#GT)8}DT>os%y(%XrPsgA{_(?HsA03Map$YF_3l}pWoD}GdzP_St$eQE#8;2JDsBfd z7GKyG0Ck4Nn^1 zr1pM0wsv>5R^d9q<1xuO{kffaAAF?yWMj_rew;e>x$AO?@6YuNkNI(?$@~AEr~Fap z*yijq^Ve%G-w?Vjvhw`ptVeA&uOEN=ys7_qu))uVKd;VzQ6UumH1DF~Nlld;)mg(Sj#(B@m}uiTGMr!Ck(IeP@A;F^MsJRd{5D~A1{wZyQZAn zIN4(L<{jI;x4ddOd$T6XuO{xCad0W?wY58Tx10^UAaGMIdagpmPnrH?{c6i7jdhb+ zz8*K5vF7W$xpSWj>b_fXd)fxhkGV%vWH+U|=3Fei_04PlDw(B6fR~}R5T4RZ{Q18A bzkTw|IX1v^nQj6{*%>@t{an^LB{Ts5f2`;V literal 0 HcmV?d00001 diff --git a/education/windows/images/deploy-win-10-school-figure3.png b/education/windows/images/deploy-win-10-school-figure3.png new file mode 100644 index 0000000000000000000000000000000000000000..1b39b5cc14258539da1a9d4b199d7ec60db6053b GIT binary patch literal 131013 zcmWh!WmFwK5MA8ep}2c-w}*RiDNga?P+W>T#jUtgv`{E+#ogUXad(Grznrt@{m9w8 zNj90ebMGYbgNiH~GBGj$0BG`ZQtAKzy#+ogh|mB4m64hl0(Kxd$?3TQ0DABL57dBT z*(U%%R<)6o{P4lr(aq7-+R=$ZUQ&|6$;Hvq=CcI=crIsaSZQh;;EUX?Uqcil0+SUT z)$tH1)FIJWuOAH)9EyTJXpYF#N2Ef_`nL7&>gk3a}Oe zDkrp~qygRc0IsFt9|2&I6?iYNV<`vJHUVAZm?%F1L{#9tT0|%#0P6#o3{q2j0wEay zuFR#5@C9=<<{lHcQW-ymn`s23zkWnybw<$9VIyN0mnUGx@n1mR!LrVk)BkHDo&T+QX=&%*zeR;VkdLOrI)1NKJ;q%+ zFP|U$g`e+kHaq^(eC0I!DhqqR*)w{rRQzrt5h=uMbvIu2xe4X%nRJHgkGxs4E)(vy z8n$zsRA$T-XE9YIB$2U?cKYqp-wl>07|{(Lpw?Ct$|r%f%+MU>R*@c4*RAXC9ROUm zI(E-8Ai@M%2X9Syyq$@?$mY=kftK=#&H!K}MZ=~!TrW0&2mn%fUzutpNUpmHS-Rlg zb;GT8qdc4NhCpck^gu8n$e#k=xtK6k20<9Y#%f8KOxS0|Nx8e!tizI=(Aj#lexr*x zVLX~5=5#Z(eMN$m7(~P|rCg4HGK<52 z(2^s)6mfwT2se;vNe~(YID?+U+GIJBzy4GcnMM62*<8j)93oSIGWp4kBQqX9FKg1J zfmkGlH-B&Phc(7>yr|^B`>uUL1g<}y-?R1iLhATgkdn+t>ZmGFfAkaAYFEOvM&6iD z)Oo;Sf0gb+;)V5qP?(ZQ$muHSsw~QtQM{w!##%<=LxKrW>!GJgDpPErYr%T>Lukgy z5w0u8LOqWikHe1X6CwGBj|MwZl9Rsq8?<~~k>)h^w9K@FI`sidc^0=EF?G_=@+Z5W z2m;A06wHI6|FZw}{^R;b@{jWJBXYKxxO36H#$N{YVOs^F9n2l>9e9g$P6@5TO!c+0 zd`&E#czsA!exrJgT6h@_w|l0*STMf4VsTYL$_%kJf%TnD&AwX;)>;agO4_8(^vHqi ze%e0FwFfF%7+&x|gcSo(79j$m6_E#FO}bJE(M&YafaZHXj-&Lw42%p%EnTKYCSSaS zVdNBr6uJ}=CU(v8ijs=;3KXp?tr5-maw84DY8fpqjqP%z+0-9e71KHN}ej^6 z>?lmiKCp73CTZ9!E?I1vVw$!UlF&RQTsS8aD}xbZ({Hd%vu)pR-(N@vPe)0osC=k= znyIebT*6o)q$H#?Fg7|?FgBmTlO@8jz`2*Tm$i_!(PX0Usn60_*7(~({^vja61~&L zHiuAs0li{fEq%j!nX2q6+WFS1)>5p}W|btBA35_@y|ovOLyhH4M72AM@GI4g_Kkj~ zR%QfNO?}n9r%CNeel32nFCqwN;Y;X0NcBnmT^n3*1+@j&GsnN5iuv_jryj6d=}ury zEOKo(;*2o-RqA^9~vI26DAht6roEz#gWG2F|{h`x*_!_l`6HKWyPT?P{XRg z!z5b4W-GkR*TUT**3V|CH#(=AttCeF)Oo2MwLP z^2d9wLrd|?*|1pzQ^l1cRQQw6B`}%F@MCB%aXe__kiB|Hd#tF~r+B9#79|as$W$)n zn3TN}j}zK>ylDEkidlA=L+H!DwJD(~tz`-3;AeiJu;&yJZ0870O!(#usi0I&YP34E z+O_;LQfU$T^R>?*x`~}E1!2gp{#zxS9xHMqq-0-HpJ9Os;ir{_j%DXqlUl5of2&WzRMhVmbOnm=gdpW>GpcJ|-llS)_Tb`KZZzI=%MGbm87%>XgK%?Uws^ZslX! z-HYf@$BGt|mhznCoW+y;Q~jM-b!5fCed?3FVU>!#^T`0rG|USEHG1Ph^Xweyw1}p9 z{5$7}YP2P+ycnpW)h{=d{tQeOWK?vOU_$j}6rzr^@dZXwK&e<8IZWw(W7 zUS`T(&r9J-bI4}-AZRAZ>T)6`J0;uCpY37Q zWTl|dXU}|m!xqEwtOe6;Yg+m(dQYfLXx!lPx7+20TStD6n%noqskfB9J69gyVkjjvs|dtKna&Clfsh^)0=c{|?q-Q8^9ulc*szl@Kx zE_u+OR<)_N8DEQ^NGwUNh0lq7d|h2UTMe-7^2ocIT9v(n4-KApO}L52kc5lRh#v_< z3p>i;7ZnirE9UZY@LVc6@o9oChv2o~b)=dApWXj{?r33rDt#(H?J_N?)84oE<*@6B zsAi?Vr=P52$dil1=vw>fq}yZFgY>L$14H$nFGT>uoApE8jmBi@QxZ{9(i<#H`qi^J z7wZa$Hz~~J)Rh6in-%~9g8|^-4g5U-0QdI*aA*Pmg6RN2;FxIKCj&rTpUX>0XnHOm z8+hqz4B(6L`9NSQ=p^3A z{Uai%QLE0@84Bl5Y#$yTtmX&UWc}OPkZ)cA2ESpkp{Nzb#|Q45EiXq_n>&SEEypul zgDFEy#FIm2nRTj?Z615`uJ7@pi#n^SCE+u?QlKa5+109CJq3r^xm<|}dPqwI+DwQ= z;}zniUP*6ZB1No=_**w73R_zC2t@ibbj=?(#4c*&wb% ze7hk~#ftyfdr@T@veihoD_wtFExvhta4=WGNxhxZ`ZWA%Y3y$xE}O#ldYyjO#sE+z zCtjN11W$jsi2_(qTX|&`yaaqgWHJO|>syuAmcKLnHONfnK4tUO5brmG>~d!WTaDVz`?+CLz*tI*B6} zfCYE}7OfM@y?>uRecCio$`D>!T;vxJ@H(2W!bRRe5Fmnvyt>}bsV)oysb4FD(c!kU2xuR8 zm@>yKSC*E3l{Y8Z*`dA z#qJ_n(9bkp#)Jn%95MkWp^Upy1M9P8QdC47X0X*YADhqtp#6qiU3ZX9Ig{INo<%hG zY>AFg1jtc>hgRA95^Sy1m4<@kT`nutxhqID`zPIi0%`*J# z*Ny$7qmdmKEJ#wbfvW0+$2AK$^E4JcY;0nE1B2Dc$y(pOC=Z(|3H^=nQZ{I)S3axT zD(>a4NjOREqMzu}-fQ#+JB5b7WmJq3ezbWD9q!noj zHAd~k9*3Hyrd!Z_P2|rnbGdt(`c@{~#A9=Pq3`+Du&tb;+G3fPn%LuC=)PQ)2L3BX zqzw62&d3Pjn}cuQ{E7Fws*NOh2rkquyjrl-{t}F#@I5AaX7Z{q zquvsn_qO18^iyP-ZNoNa*a?5s8s+iB)n0#pzsMc}%^YR2VNcV$D1vP=1%rNT_YT8m zgLR4&UV9OT)E`%W-tVKbix6y(mKTR(RwPh|U}kV8j!qNBcbA9%0_`8Cw1JaWM4*J# zHnz4q%2Nsu>?NjjYkfGnEdbw0@<;T*|YV!5t zh(uydO>Qo^19fX^nnR+)b!ouc3x)v}a;WDu1tTM)sAx`~nfn|qE+31bg|p9iu8NXU zWw}XQt_d0tLOricB|CY}1O@CKlEi(=60(20%96w?NLdaAKDeL&yRf_hg3M?#w=U0p zv$Nc9dPe*4M#3F=B_$<3+jNBA!p30(U2BXRX4#(5fi4qh;QL)>%)$xt(8Jx@v!4c1(1AZEe^4 zV-Z361E;&tw~2`f$9mzL4A;a{Oyb}=w}a`lzP@01G^)mOLr$khUiNSd^3#<)C_fc= zPomA@fb*UL({|4rhl!frbtkeStRKFUW$Pc~F@bp_3~wv`&!f;xye7u*$EN^0Oxv}P zku3=(7}&-UP`F1&!0aJi3B$2I2t;GobO+QN3S|UGHf?R}|m)FC`8re{gmSQw!`&fdFgH2q) z|69{cSXekBeE0ZY5w_&F#H_3zV8b>yGYeu~`Di8XA%o7RsHCK%rG=;F+j>Ej0(y~F zd_273sw#U^Q`3PxK5p)YZcRrthEIgOulI-Neh{!3yyxQD zc4;0O8iIp^lg0H8#%xJTaDH8F{@COgPa>4syY>8z$i~sJ({@Jznj&pPLqnsmu+Yxd zZs4Qd(#pz4XFz9L+q3d@xsePWK4}Q%!5I6G20kNe?##aZDbU;YnKh5)z9r=6C)8b3 z*Vbwug~r9@=Tl~@@V$Sp``gJ>OS%u!?}eA~fR2t1Bo(?%ocP~~=86rke&;`>RN9o| z;N+qb2{-`Ir!OB3E(O8jX7&i{VR7>V9mAh3m>KYn4xIUPP;;~z(*5a<_ z)EhZs!9|v?`|W*mcmYA3&8!UyNaT-;tfH24l?^5n<5Jh1!RRdnN; zN<_SjOcmN23$NFj_Ks%@tweVwr>0`Jtn`F3!QgavcZZN+5|&|aAIx34l3G|;oX84R z8+Wdoa{v1=-k!|qxZd_fw5qZa7ZG;&2KuW>*t5GHnQ@x=A}lj`m3RVn}_wJrt{VN@n7Ui3=y@Gl1i@Vi-q07 zHt2|L4i4(->c9j2<;xedI({y$E8Qd0jO=Vy>`1mqsiexPQrBimO3J7euGQ#v_akix z1Y%^AQ(R1&Hln5S5wxt$b#J^qCg#myUD$q^TQoi`C1p;?*%3dQw!GSsGXr$CZ#nO` zE@n!D-Q8DyYk7Nn)6&wi;E(k5^bAi=udW&>{;;=v{zfT@Y}97*o)Cv#<(<$MmfV4n z&wh$ZbVB)lw*Jk3gU^&K5xU?3tQR>|hv=?+E!NA2tDJ6zkM zOE_#B*(v;G$*PYE<{n<9>XCztAXDfHF^Q3?w} zNRz6x1^sy)$7k8OFFc%Ee6vrd?yFm&8a*=w03|(qL_oH4dT9Ld#x#@g@X8@9Al$s9 zQtXvt4+&_&_^>#Pms!|!-X--`8MRR3!hV_?WxA9Q-B2t4;Y;G7oL?;TZ9;v2&Q}(9qD>I5^G( zNIKr$Z4rHc(K_kni^{-;f&sIk26k2HoUl|?rwx4qH(oned_g0*Qp_?u0DdIm9z}EW z?T0lVPKPKUaANNcn*AO6-c2^co)&~Gz7%YfZHvpx=yZFRo~~ZPIkBIq+*5 zR}lrVXW%A*BErNBT|pR6Ogt@rDy>II5P~cF`Bjf7Sn0R2-SS0(mKl$x+j1g3Y7Omx|JY3oDUC7v?Ph z%Z3M+v;VaO8z}K@Mald1{s4_n5)~Nb_`KtRMwrNx+P^F1%3=NcZ({?P#7;_8al`Uh~j-k%DPFOrs)=HDy{8hP)W z0v={mz(3|;kGK`s{QPCvAWZ=1vaEl>UxpT+jJnaW#s&7%!UIhSArZY>pEo*Q>_U?_ zBJ*$^9UXzZTkUtA>?p%O_T>rhDeriJZ*Ja}^PsX9MD8|;EeY2P}ihs$Ac6gG7>}KWGwA&KxBk~0N`q)A=>F|vKRG=IvY6rxd)E7U? z@@d>wySTWJ@$x_cNWCDk_c&dZFIEr#GoH!kxE_Vaj8C(s_BmOhI4}X-GRLIzn1F;t z@!wDOk1e>e6=75T`n{Ntt*xzls8~&=cF&8ygF@~8FD*$L@iRC56n)zu;AK4#`V$2(2|-i)lQW4*n> zzb30X(X=7?@Bl{*JkSDVtAGsECFA?X8GsLL5+^_p0-peF(^X2|5GA@93$OQ(h(5Cm z&$fim#YO5iR#tm0H%F@9`KM@ccXxK+stn3Y>{rx{jiE!mueTZ1)YNA3rem* zJ53!wK$wl>xwxYP*49f`moTf3xQeo{r%<`l9vXO7x;PiK3v34hN!oQ#p-|nszrz6< zdvHJ(3y#ZOIY-MRWQU-S2n7X&lr(#anDKC#mfgplC{{*;`SO~4Z+z=Ve0V8+9FGS- zkCs5W26ggZ@=ewA1Dk_Y8MU6``GNgCp#VkYB}`Grpvd>z_r2w%qCPxZiIq?$hg|`_ zhie&%iJG};_A4zXSLqV~#arX~#rskoIYutAorr~vMOM?dQ& zFS!4~pkfov=Mj)p%>~cbmf%Kw=)6gBwHdN%(#BCV@rApW01(%23|LLZ#>Le%GCJKm zu(Yt?vAlD&DZApu?$ODm#CpWFABNDmo?n|PqZ<5(bb5NMEobzcDT#h~D70{(@4*@n zBH4yt2ki7v&5YY}W}AQ84p# zO@bZFvyv*tXiHFAQf+#tCNJqGHkLk&=5?!PbauHjB0?VUfno(rm2nbXcSpTu50Z?Q zx5Qcz+-sufGi*ddio2+oCQm8bo*Jg(0++&Gh{Xg)qHlT03$E-f7{)Ku$b6(7SyW_Y zWm)iX_FbtGA~tti9_q{o5Ql#M{#{D&&bw%E5`^z*XKv5Z4tDnTFWPwe^-6R?p64cG zCo90@>gxCJ$we&nPb2Jbq@*q(@3CzZpzK?4;$Ly_DEiBX$9qkAS zVV&(S!{EsOKv){{%*TMmCFjh`xPi;xpzc31ii(cjAHV!)%889jOiWBp9)ATR(JC7f zes{b?Lab>E3-Am1Bo;)(to#4jzJT!FQ9$5e;n6*cF!?794Gm#yKHG(9N5%FiACt`2 z=rBrJ7qz#qbxVXY3V57;PfH^hcU<~O+fJaNo$$qlKll2upt{3oM@-P`^560=JLh%B zhf7l%DY_)A^NH8jSJ)avI^hs?OmTbrlTZ|bpY`=8pY8QN-}WM4_)m|$bE%+Vj!|BinePv_Wf8XcYcp@T62rN%!>=V_t45A}kJ zY7&)_l9Q8DU481Sqr)35U97IGr2I5!lAfKNEyXfFH+OS+Y1Z7zMTqKbET!w`=jY?& z!<14{Q$tROc^;FH0RH(`@&L_b4qjef4&IWPgD;JZP_M6eDJdm%bPF}cXWIU`pN zE<`RfE9`}6yOswt?3`cCzv%uFr^72 ze}pn*hS#a6s0gc``8MRVt9B@2h8tLbXX7e|*qtltDpNcP@+OEz^G~X>5PyIF;l+vd z_4VP{3TnqXpWCv}VD>_PzwrE`HSBvoB@5emTh*jFEJuU=9V@yIT>RipB?pJo`=S^Z zMTOh54ff+h7k77y`Xz8;W4;|3K{{X#9#vzctRnv)BJ>1jWyMFQL3GwuU!OFxlbV_; zbG*3q_y6^tnVKSZI?z^D27{Z7On;l#)#}CE=idWf2~c4|(-#ob0gYfFo_ zr>AdLx*SzPy3(#LLI#~`4hwc9Cd9$P0c3SO+}t$VLXiM4O^%F2GI~1bwj?1UQqJbI zFy0u;&&eT!L{yhrS=tV}c+~v(ktOVPnX6OHFsz%NwJ^6ZbKpi#U)s#xwmJTZsrT)p zQYLuVthtw=;d{sDZ;R86hKZrxpRw2I%6|f@VtQ6y{EH2y7`zpF5~^I@(?QAU2d8$@ z^XxxX&GXK0Z{4zEkTcmE3#|-#42@)+^bJ%@b!))609b)JyfQ+_9QyKed>%i=bO+w+ zHTe!@sYC;tf5M0W-{w5*PZ&VnUv1J=)xPkZuY5KDh4l~Yh70yp*{Mz=9^Lbt^`HB* zPXJK%Xa$^q?`BgpphozuXV{*VPygFh|3ll`F8jx3XVJp@#OKxx7;&<_U&&3Wri8b{ zsK#a!DQ`q8qh1(mvuR)ywzks^3+NaaHC0ulW0T#~)4%K% zAd-^KIo&3IP~R@O-9IQQqF~XQ)GvWF5%EkyVoC}e@GEugSAq_amY71moW=LpFPT@+fy>o@s)+al*VNKj%*5sn zCp{m8V)iQ#g-Z1(h+jR7F2R*(FlDPHzvr12@q`f1;sA2Fdn6IIH9W7L+|?Y`pa{OX9F zvuXpKC?-NWB7*Ec>)?by5qIhh2dfE z)o?z6*IBcMg>l zL2Y+T`Zt3zHx=^cX_z}{I5J_84FsCEy7E^$foDsD65y9vpYWzY2-G9jm5Qm~#WDFL zK091o(tl!%U2K(l8rs?a8{K6tLebSJEf&$1>mEPc#2jJTzj_iPRjglVAc=bL{3rO7B z*f8QR?A?n|V_$&0dzoB9w~cX7;7T2ekAJgK7zK9ZJ5o}ped55i1R;cgW48k;>aW|S z(!D&`Z7_k^*=u{b0q9G2OSzs$<0(x~esY*0H8r45s7RQaF>jF!L#=CQ(9~)4KAD%e zQjI)|JN*JZBB70HshZQNI3CperPN`_=ZM4aY-DhHH1}3`{6cf&2QV8-G;A?TV#%s~ zdoy445oD8zh=|n7ui-?nq}6V3Z$WYkOv>`qNX*v5NvRBvMl9bcpk^HlZ){BDE;UBu z4siuuUtgh~w74Do1;g|1ZohW*2ZlIuv32qN{eQD+EAn#f^~|7*H>wALfq?bXR6OLVaoLA_Mc4GRryuQ?DUl*m+L~4ei&q@JMUea<|{Z8kD>6 z@jg50*FnYRnPgL6jpje09Z%@MfUZXO_2~Kg+vgY;|4%Q?;5w}b?&r+vy`B#3FL zN_ML4Kd+5Czo+VKA=U4~}PUlaUyYoK(brMtK+p( z(hE94H>jh75=W2ZKA(kYlL|r9prHV1<+_Ykf-Xd07-}65XE@l{+bGzkG<=F_Z_f|t z)be8gq%*s_ET#R^bB4&>6_naQP@c7^@cdK0CooiqF76#sTfI*FyC(NJe^O|(u%ZXl z0Its3vU+7zMI3&5`79Ee&RZV!Uw9`76E>T{Zc^$lm&-hM#E4i^>=bz(HAbT&RpynA zadqAqV!ysvk`nrqi7HX2jetzo?w=j$58B4~H>M))U`Zu^lc-Y6oN8`Z<|P1|1l47E zO8M*Ckgt?@(+b>;G+b^LgX#&WP%QnlPz?Ub4Kiym2{l0Vx|a<{uKRL8`ihC(FN za9v-G*KAEqDU*ioeMRLHeMJMdg5U(2n@?kDQf=-3tu+&;{p=l~?qPS!dArKQ{tEX4(eqW^zn3Brf#GAZb)1E_BZ~Z6oIUn8b z<0NVlGlEH>OeS>J*gs{Qu}we)K7{o@jf$mdmx%Ca0`1^9*zY+J&KpS5^(>ot`D|tn zjfeK-0V(?loLZ`FWmx>A|YU;xD-f#`o>}AkLH@JyZrnR8|om4Oo z@IGF=J3Y0VuO1s6U2XDk1cg*yhvf#_xr)CC7=O*oo9~gsOCu050zj^b3M1bC<%yn- z7LS0SHHO6M)2Ba6DZ7-sY`oN5!K@f)NcJ!+jBIT4qoK4(Lm;8m+L^pOYd={nB_m_o z@0p(Qdl$03hoTjosA#nokL_I>Az}JNxeHe&THy zzzxt0XEktyo2MX$o_us9jTGYaZ&Q5n9t%WJ|2g+ow%}*Bpf4&{k~a#=iqj18u!nF( z<>d$W7i>>=Q81Z0Y*<5AZ|_8ki;th0lQVt{%g>6v*6M2YSm{NT zz`(#jEoF)bo4t%gM*9pyj}RG<(}7+L{QeBRtLUmdHjCYZYk;VRdRvY z`f@5;G>~RU9*4f-ZBYs;@P5E=qe6($#|<9$#_Em{pnK{_@}U7@K4yNRL#^d>89{l& z1%h&tO$ErgkN|b0?#N9WY_-~6*<7iOGB^MM0pVx}EBgdq;H-HDeqpqwYhr?(hewO6 zMSA8s0*kt>tu1|E_mS6lignp5rI50l$@P%57_nI8LZgI6IXj|b3 z!hnk$+N0y~EE`X1epo$WTq|xU^H(dX#>sOCG&bVg=~jg_j`0ZLXIpK0!n z&)V3FW){iA%uP-J7_!b!1?*q0{;#aV9yjBfA zvndGsyp6OiX=sgCJ9+xeOQ@=_m^lTUei7}3XYYgyg9XlWj)ak{boiYNwz`}{VFvKf z-|6V%wDaPXYdB*vyELyX!9ve4Z^{+S>8*^OwYp93a__)w6R`PGS z0qQTu?yS2x9pgG2IV9Mis*g=At*v}IS?c9V^72GAC*1DV)@4;ytW68$_CW<@>FI>L zv2;r56bW)*-3tl#TC?lG%uGGpF><&L7U&-JcOnKIrgtVuYl?N-=vzdIGD~1GMa^aE zuRndVU`$Z}tTzL9N3(ylV%O>VZug_@1}GzNcVv9b?xm(m58x*KrpfeDm+>$!lJkyX z)=fMM0vR3|)=y#PVR^rhN`d$#Nif**#|j9KjOk2k=|B@i@Y!Y!kwBLlWFoW)DqylQ zGKbalr-KPzEDmrr#+@R<1|GCvWQXYJH2RLOHrKJNti#S%>eYiaM({la1ymY1NqjAC zHhnxO@dF*yN=7E2Bl(hKz!pGcu=Lvo=cztL!D4i)H(Su%#mQ+>P4&<1$uU>E{Lm0n zA`1)4@j^|mO6ASnoy891^=PXX+`XXYweLx&R<4P^)^6vx;Y8NruqGHpVS98)%yowL zEj@j(t@ta7ZlhUf{@3mxxGG)tc#4SUXWuFp(cGF}<)O`xnFcu;!PIXbSn-+hkP~Ta zGU*U|v>0FkNl8f=DojLBFvh~dqO2;pld5v|KIFPJ_&JRBU3Zt>|8P@rC1z!)V18(3Dx5JUmKogP&W)S5lG*x4OLMMa&i zwbr{v8MS|5Wn-%@Dv~PK1V>ZDmB945JCT$EZI&uxs4#5(0@kPa{I6Hr$|Zg-ub+>d z+7Zaqk6{)jbG$#_YDt@|ySF-J;{oX@$7P{Lv>y4lL z5#d1SbfKrB>4C$ed~aTSrU79jpM;PQ%p>RK=IXMBM@De4vH7dpyycz`1`L~rqo-QM zazxIWn?b6fCskHjnh_WIi-v>*)If?3c68f(44KH|Ka|;L>(dyiG}*y-I@h=@ngMe1 z@>5LgtgJg%58EU|ejps+=(uPo8_1Ny4~g9t^6+SM`l!1Is(WfypqLjks?@k@@$C5- z{r2S&MR^7-#HHCcJ3jtY0r~O@oW(~`)9E5hG|Qa|tm-ahqb${<{plas6OC&ecl$9Gt3JUMOmX<=q$Vq#)p z`82XtqBQmYVX?8X`P>{H9u8^=hN=*=0!=0h=3F61vc`8tAeke(4Oka7Dn-%oAIP{02W^aK&V{KcTZ~ubv+dKS{LhMk8^Z6uY zqwh-?TGHAoh`-%t>-~G-8_)lSq8Lwn_uA@#BTY#b_Vv6u)MD)%U#d3@g}iJj*aeFJ z8Lg}YX;cIZvJbd@e}2!BMd`U};L>6uqN1UKlmacbe3Qf4qMdUhO+2{#b_!7jY*yUw zw|FdbEX@9&L5f1LI7KZ;8JwRpFf-RT)tf*40ZS7|`904;>KE)DQwyRDdDD) zPlT25Jv((+skbt;XB8@9P8u>ZGoQ#2DAZ)iFtujl;NZw-P$<{De0Wx)mW?A4YAmQc zUb|a2$0(_-J@4ucZf*h7JZru!{R4gdIbb?=K~ZfML@4RxfBgnc*sAB zVXUdbnys&T?ISKK<`P9BzCpS{5fSm2b=6-Dx9~~5BNm)H?Zd|nx%7HMg=#c&ji3RY z3OjBkgF;h<2XZ4|bFr0rO)k7Z<{vNgSl^cG3zO}Yv0=~2cLA9zi@vzh31^;~n{C+^ zEqNP5MTMjY>%}Fnn@O@r#qVNgGiQ;)%vT(jP?#M4W(cGDq3JT~8%8=UvRdv0ShB3> zWQ%v^QmZ^?ic)_rVIn*WKD>T3eSxMqAfc8~L#Haxb;U9cz27bmkGMbOs{;x>>&>t( z&fRiaf{!OyN5z7n417B7o`&PGrYziT{alwEdbd^rGI|K0h3~oE)4#4vC%r~^`rRq9 zh-v$q{Oow3;33n|p0B9=dC8&7lw9;(a}YO5P(e>e&4@N>ZeDYNB9SRd=1&wdBNdnx zQknhwUYVq=R?$KX$6CcyQ?A9~a^m`NeA87_u2lCu7(E65;>BH@t+zjcs!WI5fx5Ib zT>Joupc{jHA_?#3O$R2DgM)*;@$6Q=r`vX)JBFyol z&Y@^d*$F*30NfY`y-W`;ndUpgDFp0B|E?ZjRo(d?dc+ghyxmjht$B%eZhdcyt>d)}iF5|_UP#!u2{aNk>C!!s zRGvYeGE!$kA~0qurKRbZB3%I0uBQyYNVgn6M^FTkL=cqPkleU4!Q$dZyoA)3uhMEz zdw%!bv!l1S<82y-T84(oPN7}#ri<7V5z{$x%AnyYlsSA7xEJ5*M4$oHr63Qy9U}MR z9$WwM5n14Te+cI}C^<<3r!f{b&?Bb>mP8-2F#b$u zJLrNORN)c>IkDu@^Q!kqd#)4vqfU|hgsDL?cWmPzIO(S1ZSSdN?f)s)&{c=k;CG-x z@eN2x^Yh>L$7XR8v$}?*IOtMEGQt7!bQS5SDYa^XeDI|HZ<)co{8hae^;r5H{T9E+ z90NMdDMMIvJdaU*>Fv+LFf0B>J8qqCNrLr1%GhyT@8=_}pn@WQZ42b7vCVPV`!fnQ~vl#mO5fKs5+CVYC zw|ELiQq`vqcpYcA}A`5W}@t*1<$d~t7k-ZAH zq|8=sk)f5UJEZ=hGSx`&TLpRpg_gN-E>kJ>i!SDZerq*vxRfE)tXf#fMHC@9RG+E@ zE*43yC!Qk_+hq|m;*IU6M)32W5c~d~$XIqRa0rB8DnJGwXe(lbzi+kzJI3o)=8+$! z$uy)xKHP@S4TH*qREY94-pK}v8_!dLP6s08QKzf#dSR|MyaH6E(B*#K*k)&8{qReG zGy}PZvb821wq^#Yr#b3}&~J`xkO;|A7|7uBo&{oGa0@kL;@q;_&07#6uC5{;p;C%s z7T+e!gMkM}r72k&oE^E$5br6N9cSG3dFf~47oTHY5-QH8ZRu&xwvjaUiA)~F%lO45 zWh7+e)1JE!iYU*~Y#~_*2{lOd@oFbauo8`L za48#>RPfUll*Z@EuP`m5fQ%5PHT;eHyoeNNi=Ygr} zqm)`{B%SQ;vgx$$F_aL)_0xGjtVnd6ITDh^GSTYxghV_C&RZPkoEG6^z^1ml7C;9) zKkj~;nj1}A5M`NxdGvE1B%Fjgb`$^t$Gg;)Ut;ENPz|kO_+Gj87hN+Rk;q3K=2!J% z@Xrt$pWShWT4xEw5Y-S#q}BiI%oC9h`R)}JZdlV7GG3ttO>|ImBY%y5FPe-5z^{|{ z2100P5(fWFN^VkDs#wfzFk#<56}LTlUMO$@aw$)B&r8*bpZ~u#O`|IVngdbofTm*?_Xl0Q&q^(BDha z9!|i=%Gmu%oe24G3rxHG%QQ_!1R?Xv@!{RfpQ*&GGMa z3w|gOM-&VSF%kE=SZq{OW+SPrV}9F3UfzEuXNEqgsdbyx5u+2ii1=p-a8Xe~L(M+@ zL?ku3I+#U;q{ThEZx0P%@6o67lTo9sKPmbLOHp7(oaV0t!g2BOh_Zkv)1~?H@)9hm zqfkJA>#))?j~ocaL}30AMi>!$7wqoyChYEs8_!;(E(c7uZ{`O;f#M*?@NmUfl)GMZ z{kPAwTWMq$YqnNGBPxp2F;rZAB#>4-3i3H4#}^ zTO;KQ8yuF|4w!DcF#d)~$(bPx222s3+h@;y7J6v$-yG`J%oh7NSI(g&ONn`wqJima z^V+n=2w!Z?4_vN{iCcktCui?w1nWD(A<&C4p3$Zh9YP zHbOfjDxv*^p-*;pcA#<$TC&PVcIk|Sj;^9o-Q=P$ozq`(O}J1`$mgKHXfN^sR)Y1I zVRyFU(2nf{2W%sS5b0o`t^1Mym)H>2W5eX|8seV3rI(JQVhWuL z|M^fJ$JAQchly3AzD^2xkKWTY@D?yw*AwnM^K*-sjPl|9fG)0JvCfq~exUcQbjq47i_e@?w{Uia0aSs(0&V4WG7XIx zP+r`=xfOy2rDQPW%tBPn6}7jqnA6cA0BV)bHtjZ!Rqb)#p^*rlAL_m%8yp-40xK(z zLE>FlM5NC)S)ksEFCQyIN%YIHZjCC>@bUWLo8=DoLYh`*I$6sNDxkUdn&dGqVdQTn zeZWJ}RHRV&(@V_8SEZXA8vySE)#|c*r(LLCjfp5T9>FCg^?Q4L(azFsysP`SvDa?D zw;){TdfK{&GkuNl9zvnDM0Fs)Ho+2nY$oO}-kL zvVX@DTu#B3p@I^QKe8q8fpn|-=AcnaDa3iep(>!UPElo zbP?#2Wj3==Q=8-a@?tex@(!iS$I!wT2L5ES{EQC+1%gQ_-C^@qFp~)#AxWAtyca{o z*GBB&XSFUlxp z`xnjOr`TKZm9ER4ZsrLN4~Mb6*w#|t_rLW>LC}qfMwa}1?!HH4AOqodY5)7FJ?tc+nZvAsrEU=BMI(1rdJvtkf-0xc-XFLHKe{ z(A(Kb%EfgHjDZmJcjvH>o1tpWUBb@IbME)DgPFug=sqQFcmr7)eURU5`YaIsLa*;{ zIVjzsh5wyoToWgGwaGk#r_@{URY!5+a(6U+rj(H1y&|Bk4R`!H021&vs=0Apkw%E+f41gwxu+TW+y_@IO*4BH-;;ybYw@p4!^`k?{ZLWj1A$d+O zo=-=rCMx?^p;9-Q3pGaHPF3ytj}LvcTXvet1R8hk3X1C9B40;n5=^2Wre1_HP)Ra7^Qptd- z+NX;{hEEXs@$NV?IkBJnRQ2R^O4;a^*pKFXhlJ)x1?7Mt+(hLgWvqsd*2h8pi^Apm z>Bc*g`}_Ox@$qs@Ow84mcW3ty5++)g*v668n_V^dSzCTGOV8O=&VIL0M=zTsLm`K@0z#xy74 z>awq-HB$A|6v?$Ar?zT`Im8YRl4Tg9O$A3)u#2y*!?6C|P+ttjd;)}4%}js8a9$I` zLTqn@9KP;X2J{MiFBA~VR~g-u9Dn?9!&naEnjJo=VyX@2pNG}AUWIJQg}rxxP9Z6* zPx1lD5wNMI))B9Ewzh4y&ks>}${zcXK!R8-HT?&(*hY4>_ zVS-8Nh(4TKmh|_cpdFO0^4BWbPq;@)<(|;HgIA`6J{4qs9%GFzh0&q6_`cn=$-h!2^YN55HEgtP6+P~4O5slT zmHA9UE?KGwOT4aksL20Z)~~kV6H&VVG@*=me0(bWSoV6QqT<5`};!(bY) zdsu?q_peo)c*w6|eb&}AQ7Lh-n45hzwyCM<`SCVg;Lz!KVY;Cq37^duxI7>b>zDcl z6;`Z3YKHaOL%2HVFVrSVugL@6wRN0*ZxfptcLZ^+E)R4bV>c%${Py1bE{)};;_&uW zYrQdSY;=W6tzT#SxngnIP(Hd^!-ludGOL^{-gU%|4#`E@`?j0T>t?TjvO!o#?ciBz zW@x`3SuDQlFT8@`6FsY> zq(#+h?9CcepE)hBbXn<}0-%)I+FBqp3+W%RnuTuLPsga&-W)Wrvho6`5OFZ|D#q=} zGN0?w-gNOS0iPh`>}`QyQ%qQD|yvvr9`$ZxSFKsa$s1+1Z?SD@!bVL#EZe z|LlT-oDFXqFdOd36~%$G`3&~WEMxj&wKLWU*|>QPP6CRb8!YS_-8RR(_42wp)vJ`g zBRhO(hvq4qznD@>!;}M6 z2$9#+)Kph5%+H@;@mevyGGI-X!T4*&@)!32wo1AfYOwV9eZBR22%R_zDz5q!ji1NU z@JG7O%Qf}&5(g;j@?O2<`Bk)+(!K;vi)Qz8dPWnlzghy>k^DU}ts$+&CO&R%qtIi7 zZQF(xXDhsabF5Gv*V&Q28=&-&5RsgCEFGUwT{A%iUj)CEYG+zPLjzRDu8t~Oopt5` zBBUhjK!rCHx-o#@XTl99w*LcnGIngzKN#T%UAvQ^C!?d#sin(85{8O5Cq&7J6GpaE z5P5Ul_f$|2`DA&luOsek$`tDo?54}h%jdzCNDHO`g1Uag85hh27!dL356|1-R&C!| z=u(j8*Pv?ojgGh{CU(zZy2S6LscC69FfF$6#{s&?Ej2Ygom!30$JB-^)r6q%a<_?Q zVX>d-_kypt0tTny;b9dO72u;pfn7kv|*mg7<%~%Fh)X3du-BwQy z^D&Y@YQ1+rm;*#8=?_$}aPV@q)xfpA*b&u_o!#Rh5deIAH#UpR$W{_CX=BtnP}x!} z1Y~q(qiM;jD^4n4aHS)FU;2)WKj9AN^5qM{CoJd<4#`+y0P#AFWD3cl2X{!AK0O?k zx3#rROiV$CRDC5;79a3AG6|8CJ2$?=8<3iN{DC$m-t%0Nx)+9@P|V1XFL(&|2*;e{8HMV59tC+=P61B_ zJjoEmR^-K+h7wFGtSuV^V&7u)PeZgef#}1e9zL0Uc|GadL)=g&?S(JiuaW68*5ZdxXYCW)q;gLNt?_w0#Uiuw z->eAS;UKF@3PcKw{zsSF+=8;ncU}j3lNZ?C*yI*lsu)@%u#S%wXG23nfWHg<2jo%$ z0s=xtk33vl^7G7IU^cY$a@zdh11{7S=K zBuva$N)b@TfxQthw*kUqTT?^HY>3%UKfomwb}BF(N+RtGva~5A`!T^$2?TMOz7JoO zhqr*2B`i)ApyQ?Sv^K=qQ!_K3r}H@_B||jhPV*a!B;|#L+@4!Mw*JRNYa#+&T*Y6k zJ+SSe`gv3QbI1rzy-9-l*3Qm@Udxw)@g$8Zt-3UEe<*)plHcRzi%ZKCr$hICuRwi# z@8RK6@{Un!WJ6X>%;P?7zFI8v)7!a=S-pjn6bt<1XrYqvkH5Z{Y;VKgo)*Zr&4f2u z%`%Q_@N3)r*zVz)pr(>df3P}Kg{VVA^rzR_@9!QYR}e&~skz-xGXx+NMZcE1yNxz_ zLSyPT8?9!4b%#K$MT>X!%VnH3Xb%vspSy#)Bb7)G1#yG;S2lP@efw7QcWxD0m*20= z;n`C|W1h0zc|BW9FPZ}6sZG-=5Snyd#m7_FZv zcsjM6-CZvak5J#oDY@GlbHD70d26Y+Zx!y_aT&p(&hNbuB{r;}pk5zWUq!ba&d-^2 zTkcvpn205Sstl~CJyns5I554VqoU!O`q;m|s>_ zmQyMK#H_&88z8*4dn%;16x&UTh4l6<(gYiulcVDauyq5@)WgFA4lZ~FutL1NnhOiw zjA~&6TlU=aI8x%``HdrSadBY4*xB9{^0*+Upa>SvDFQ+*Iyx&0%Y&=^oW%k(-;aiy zn~{+bDTm03gTsS^Qc`lGBmcr8BWp7`WkBK5l>AelkPro&3JI##+V3IY(W`CYlLQ|f zIEig_bwPjN?0i-J`j{CNg&HY2JvKHrHFY%G4qkpbI_am4PF^jo?crYUv9PYDmp3;y z42Aq&ljhX3ghBm#C(?icX3qw(3$S(}1LxgHDkp$w5Q9a42;tuhE|Z>aqc;y7Un-cC z-CN$ABqk{xu4%_ZZ0`v;^5{vNcUJl1t&Bz z!bna1BRt%QHQD=v-Rep!0x9?dm7{mSO&sv)Q=W;5HfjhUYJ)|dQd(O03DPrC5?m8U z6Jruol~e>=E{sh~^5*!u4J*rZT0M79bTE>&L0e{T1|i|$(U6p+rQnDk+-Aj#u(-Lw z!NCEl0q6k#C7k948FK?-*~%PgJ}WE=ioEG!)%8=B=6uTY>qB7LFUZaP`IY=~y*pAy z`s(U>pIuYi+gn|IZqeMkWE1#sqsTy{GaNdVg+IjO5(4rzC_jGu$WBks$%)fl z@d<=r5ONLylw&}@#qU*+pMPn3I8r=keqkZ%bvvC zFWP2A(@EEl9HdrjE;x8u*9PqZwyOIXTui@0^NyoZ27))oQEKJ7q06J}%*^)x;%LCE z)V~>8l`KjIZq`uWKU(zwxU&V$lb)mVXgD^u>I?xd&UfPC;xkiI(y5#>%6viJzx#&! z69%{j$uRYf1y<45Rn%YYN;HB?&qzRI@gv9kyOS(>UiT+kkSnF_GpcJrBK4^KXQ{jhERS_=Mu8Avg+zd zd)L5?K>1^0U)XVF;|(O2>5RAz+=!I74Js1pB$5(6z$cc#r1wI>0Mb)ZQ&Q@3yrj|d zK8nP6pmA{20<8tRn`?g*QFa+hvUDG_^+fL1VIL6hkW;86gP!M<1MUPvOj=DMNlpEA zFm$HyO)GW`TP*XUphU*iha!Aj_b|l!uA-`PpCKTX_qB!a8NmmP+_bh4b0PYXs%T5&?fh70F1iPn8W3+0!{w;|>g)3>{Wv@< zY$1*&vRZEny1{zEcc76%6) zjL(i-MMNPI^7V!%MM{@NLq$!vdbaR|lRqTL`}0SVJ?l(EIwCGk*-&xu^ zq}cXr8s9B1i^4_bF(^KsSLO<}%DM^;CrdntgotQpZb^J<%DzDMdq_$emz(8c{%OkkxOecUxM=_8_&=!yu-l~z z`T5$17ip-($2WpfCMJeP%x(n zEDl71j-sDFeF9v7mXuV19I*@v3UB(z@5y^_Uk8WEm>9*kzMlYxENg44YikSiL(er9 zAaSIMl@&A_1g&0HHz&utyZzgaIoUaCZaUfe@$vC5xJ=@rqH6;>4Zqa=P`g1uS&)c< zjSWMvNHVkUle*U8L<~ly%N{V_KR-RMws>^!UJ^>1@GnM!Dp#b;KaE1VwZ9&KZYU{r zi;)a3fv}8%f`Wid&qUWfo3ZwhXay@$927}VSY!+6uJS^g2-nApv*vTmN=8PY;k^h8 zJM+2)EkiJLClHtw$feF4J@#*_s;cz%^#m=oXlQCm=E;M(0F;}W+8R)#H#asj1$|P0 zfLKO$#Nt>pe&_fbs7^pZ2aiVlJvjK>gMZ$3Sv&#{uq~j#3Fj!DKUJosy$4`!;*Q$$ zlmmDC_VzCz#9wMqP*UpFXO%!E2DesOc6OIBGua10z{deux$?ohQ)+7Jp7|mKCp2MV%=&frUclU{l5>Z;D5K`bGZgY#bNr*K<89uqyEZL4tHlqoX74LkXCWz)hh=i;iz>f>b>#-Nt%Uo@u1vLY4iOLIPd_ zMK8X86$#4QB~~-34>JaEa7^LsJD5UIAV>ckA&}>J2zrZtp3dG{+){S08QCUXV;my< zU-G7wZV#Ek>Sqqs!Z~^^PK{GZPoE_6)(Y>RSLUkIP!Rj659u*VaWOFmEZV%sd#{}8 z)YkKEehI-DIm_H^$e_94w;dg&FGGibIcLH@H6vN&*sQ<&YfPW6HBs@w&fKc;;W1(e zCS*;Qu^gx4Qqx-hyjl&P2T~!p=AmHgsmVeJ$$&9uL{m6oG;925{ZO>^!iH+y7JukT zQ`TK2s;iro5^@Hgi6#aifychMK)Q?b;edR?0gQ$KtXQm!1Rw;G^A|B@L34{C9^C9~bu)9jphvqe$;) z>1f0eD*p}s`8S{T2ef>3{@s0}8?kI46NqDaJN`&>ybsYRf!P%N)1ekNgh3)~js>k3 z1kj%Jq$GDBVq;CVwzTBc(Uyb>cw=m4cDmZ0DUt=EKFrQHdTkgIRy9Hc(H-5~z^MKs zEQ~C60NC9_LqpljMy4hwKXQ{I0kSAa-r1QQl3P%Ki-SXek6&9fV`@eb26%Xo8WAkg zd58#v0fHYteiJ3LS#FB|Erw}5SMi@FmLBJA<_9J)NT8v?L!6wP#Kd~btaHf8$-#uj zA3SHd|L4b#ACjm)zvP1KNFW*r#E%S6<1ngJhx|6;q$ML0`PB#S4@@=R;L%(ij5xWu zxhW~%K!TuaRz!@}I-ne{9?lC(^QfEo!3=x7(fbwxLC?5e;Iv=sV6}Z_o}gsQtM(E= z4)`rS>RDYYy>Iq(M+^l9dEx^-d#FEFU;FsP>HNg`(qpKBzt4SH9iy>K%kFS_(YIZJ z77YYWmQVYb`LZV^C4s92?^onb;w8AZmIW^+6z0WmHB$nHI?#bYhW=S1L&o-vAr*CX zIL-ZkqmhB6numv{WvyH$r?wubs=>soK#F$ut9EI)HW1 z#@d>IH4qG2MMX5}vU+m~VwvgOL8F`JAR7h{dKoJ1=Hq0b7zN@O2B0src(A3*_A^UU zV`*w>Y5geXTHy#4SIW~b93-`jLI zvz5-Uz)tBT?Papg9{%*MMjE{o-?h=-(2A`J!~%a;WbT z^s$H}=+jgF&yNRcj>=)E0>i#7Bx8LuowAgFS@nr=zHw{|iH!t689emVXsf8+e1GGn zCTPMFTbF}?SKTP!FRGgHOLFq{u6BSlmV(h+ixu`B9;)Lat5k2h-RaD^GM?jLF&H{& zreRnoOa1GlqT(NFy~+7;LAe!8vd&Wt7Imc;rMX+=(7guR%ahL%QL6jzII>vbk`Is} zf8|Y}AkfT{uD(#CT=esvTP=#nC{`@HvLBpm_*3LG8Z0iVESl@5*wPzfhDLO;m9xg( zs^8QoVs@c6k6q*qE{4ZOn4&J?DJk1W;3)k|GRkrM>{jGfo^$jbApji$A(btFs+_X< z$8XZ#HYcjC#EkbNB7)y>>x=f16QpZ(wOt}QBOoB)ew7mK(7NFkzNiA5yXgxI^fpS$ zKf-#FUPXvI&fcd5YIl=LoB45<2Sw|l(YGx$gNfZ&NZ58}h)i4jFaAbu*OtUM1sX1g zZgP-R-(u%xDtm=?mF10VXOEEVj6Yx+!3p;mNy|*2*NAyF0OBDqx}a}F5xxERHD-J( z21!f!uiGq-B5k+LEk(d4jUK|#^m?L|YUTaHq>C~vWJyntOBz@&8Rl>yva&}>P-8{f zY!L2?&x;AIkJm4CpW{dTN~?wz1XyTO|EwLUSP?+{S$ndh_Z~r<>7%W;Qjlh zTC2p({%&9}Q#mVUHTm~m=)+8{RehNb-)3Kz5%G{&M?lEF0L&6Z7}rUI0z((YujJFj z_~$kbGpdqh%yBPaqdc8?K7+(mX9Ot!!DdzQLs%1-=9-d2M2Nwxt+V+RHbi(N=TSQE zN{SC-3VCzE*gEl#s;&U#j)tY>0Z<47U0JKyXxnW<^eJ|iaW1ro$tXYdR>4{&+6>l^ zUm_UI$8#h+JUszPJ~%$EkTZ^l{2hEw^*oyWBI}H%u1L`m8t#lhkGJz?zAZ=3PW6@) zZg9t^u{x>gQl=kx5+>wC5hCC7uyS1Ig@i~XG6LSaKrVAY4wocWgAo6G)h%>DQtfm( ziMyhdp5zP8l)7eVT}S+C1B%d=pwpQy^=U_1>K6YR>;z@wwYrYSwo|UBeEzL3??cb; z&&i{5jA`}OJo4Ky=pxjWB@k0-!kgu$RD`VlK~G8SE}Qzv2r6-1*%>mdNr!ocAbF0} z(Dxz;mB+$eyQmo|gkOHK-_3%^iYv&^FMll2o2sq0!)lEPQ5GZ64^Ge^o!&cJQ)31Y z4D)+75$X;dN_13HbdkN6fWzjvjqmIr;V(LoYl1B9*0B4xlex>NaL`yQN6sd?h%>9d z{FqQ#&3p5^nU`h@e9K7r@t%x`jf2ox>)g;h>S{;J*n`j)xPQBd)=>cA zM7-Hr^!=Y}^&okdW=6^&bk7x!{Y-@A{rc@w?;~&>q{R_Pm446pIw(;EjYU!jWS$p| zvsL-+&)(e%-MB2K-&xw7G@f!HC`5p^{&ux@LZxJ0s zY}o|uUP}5jR~P}M_;fi1D-IFA{K1FDA9CP*YbaB{X@Njtcih4YOXn-{^e^K^|O^#&G6R9R3^yi$uGo6BwiJmZ#c`KmGY@|fINGQ~o#*!DKNXGqLJ*cwR`Nv#d zI=2@!lb2zp&5E}X{epPX4&xqb|0=1P)~}Cd++4kyqlZv3=9~}1=;pNbFy`bsv4muW z`agtEKtU1OZa>g_zSJ4Eio@-gR}qUX_uzD=1a`LIe~kQ5DOZK!$0Q&?EhA7n91;n^PaE%`EJHMrpM@v2|n!*qGXADBGCGI@U-H$x53&@PaHv(87E2x zRv`MyIm{zXlA>6_q($w*1U@ZhP^wlX1JOg%r(Ik`1=s*$YfwFj-+k+pXND5^8UrBq z_iC1-u6%sWPk8S|3IUZHPpk4!p_Gh2nX@Nkk7*>+=}lgvc?>+G#;gDomXwwrqQY~l zsI8^=8e=lATB^wb`qIJ>p|G&2gA4SHisC>HIHe7K_cIc9_BfIsZ*dtxx|&E}7i(^8 zF;M^{nVsj&&an~p#6Tx1sch-LPsZy-9}!@qq9lb8AP6xkX4_=h_V|tItqmOk3)UPu zzX5>P2vp4X7u!tQ4QBuj0pKh4J{PCmQlshg8+G|MW_u^!Fp?nG(-n~SS*G0xyn?!K zEr0TUQiUBy6W9jYWLjqhREs@I`Ht5+jsmLJFepIK7^aH)eHW>gQ1^Upjuq5 z;!*w<39{$pG-X+LCwm@B4^cyY(qj%WssVRi z96Lbsu)=$3;}2XuK|zAJ^GcVDDH$_Tr2X3#!wAcZp)h!L8|}9eSGG^#tbG<$dhiDn zzA|}AYYU9j$FyoQ*Bq-=dX5uHxoUY;#=li6x4@;jf3r;bm6eC5QM1+(uu?R7Z7tVA zmy0K{ZO4N9*Q1jY6Rt;dzY-Hcz^?~<vXwOaLyMOYz-k*y3 zqdw0@6wwk~s{ByC+6ldV-|yk&#fGfZ=(r88*MB##Q2XXwLcx6(i`mHg81i=_fG7iI z86X^a5-0Y4umaR7z}ywEdYOj+`LsgakfaDdn)58$2!2|mR1hJ)31XX(mifuQn&t13 zk*(U0rt7><8RcVVBcaNDJ`>qBkS3^2aCLR5xwP{2K8(mJE$&ItzRY1DaQU7L)$>c% zR+hX1`;lRenftd+bpo$ynoymBi7A=n&Jl^j;pK^QeIf4GZH1 z_wZm9=sz%!f={Ujn5FIQE99v`1Q{wKVyDh_JBHjqYrRmY7|40FK_M22Xli*Q9m;o7 zxGJydl7I8VN388l|4Y*e?dxuODO>)i`dw73kHjp>KhMcsMBKW!#l```=B8Kwif<5=9=EtL1gTVS7{m8v@y|KK>5~ z*3l;V8iWwoP-$qsxrXWoewSnmWMqkdTIZI{lCLoz?^;}J{u)c!@*693*lV}`wG6u7 z0X+1;aF}cHa4=nbA82@}N5SvBS*Y-FmM9t|>d=suGLtbzZutbG8WFHi&CeRvsq ziUXRzyF2$%)o^r0+IT?1o}8ShW@v74PNuPTI(?G7nTOAJ8Xg=`lZXtawHh1FKqHWD zpZ?)_BzQhW)_yrs>UNFtH~c2u*><06vzZGk!3xV)#?Q}gejGQo?3q((b0!-4P=_f}V}T&ke2dtDsYa(=kgkkPFHbJCt+Dhi z%*68LX3-Ah2yodhQ73T`I#|c6ehXX*(s^?mF2sD;9RJQWrkyyzu(ClRM_e+`ajC&U zbtcVZ9ysi2ZEQ+u(qdyVefKeRx#aoJv2w;6tmj!%^2Nx0jhjo$%I@%0ijtjQT*Q1K zNA5-l?n1<*1WQiK=F~x}N9kwU0^MQBl9oRzv-1wSn8Oy)KO+(R@f!_~jWdN>7lDH(hupaw&+fi=%kR9*iQlz@hQzTy2Z~)gyGW?{L5^*Fs^PIPx3%H2A3o@HN#iAe^lo+ zT3(`-uWg8d!U)g4+mayOC--aY!Bm+}p?`Dp<5Hv3eLKpVZ?Xl00|TT8*)^UK+Kh>k zdEi-leNkSYjT(A2k-iI1_O+K#c&!llq$tO9#JYIoq)(e-50$CA| zqzxJ{j`^DR3nXCUt_>`h(;{vt%V$6 zGVkvX0gy}^Kj+4wIR{91oK-DWE&cp>bIS0ZknnM{MB{j|_HeP@?j=NN#F(KyM#ppF ze7)jqlp%Wcq#!q+s%&1+XMIY5T?Vk-nI`jeYGqFpiC@TW9}O0x&~YLDN|zx+{2xl= z5HCK{0$m(9H9#R=+}3kC1?rZcPFEMmQ^yS$w|ZWC=9GZ%9T3d`B?fl~@awx-A$iul zHcPm;IWygonog|RF$*2+1hzrW+I@%ZC{pmV7l-LKL!m!EmZz{&^j=u4n+eUjhxHoX zpZ60Z1~!1$en8S)zy*&N)4C)#J=F7{5`2F7xB+zk-t;zrWz0Ja^9v*iiV64qPUlcI$HKMro*=PS4O!Ss2vMLS zv!WOlvI_qIBRtoTU;%*&8vd?ihVkLZn!|Ov4ga%mQ%tho8P_D!YTCb%rCU4*C*HSm zoz{o`_;bvocwXJT2`(lt@s$SGYt1_i@x-+S(}yybLBePhc>gxko`27YT2u5e5C-F( z??$r+Z#ZH7T^R`V5YWnJxBVdKco)O>ZxgAGxZ9uk>fzdLXOkKy#^e6e_w;UneGPD~ zig_dzsR}vc-$JQaO3_P`7CeJ1=Ggeu6N>rDo9$J!^25mP@j{>Pv^n%U88WZ09(L7J z^18*`Embu{-@N>VSVIYPBN*7&9ENxHR#Rr1`7!{&ilvfyKnpv~JM1rC<>@b%a&>e} zVKbBM4Z}|5v>^aYc(tiami%94c4he{0d(OL;Jy!@GV4<0%Ck>liu)@f>NGl`#C|)4I1+M`a^f$z3-z>`^qu#aw9zC zgoDm!m2RuqQ>7Z}U#&G?i&BoNtK{2`oFzww6pnCY9jM=4q==UDWIY*VgmG@>OHHYz zcRAw0FCQLVFMA|uC)5E0X*iERRugi+7!IR5%)i!H&0gw~p(DsZ<EEm?XmdGU{c~LA zRPg-`hn6qhQr#9x3OaGS_w*n9$$X7!-`j`l!}gb()KZc0DzWe~o#vO1?#U*N$;MCb z`vuFDW|b7DRh~>$wz)TIxv9IE0Z|Vkl*vS>{SJ^mp#us^CYAGf&4T9Mh}a5Ai|wYf zg-U!8ByLD0GOB?4U=7&{+QBnt+}Z%@=YW0%v*WL|Q(;XYm(@sMz`9|=V91wM`Vs2- zvEZH!3g(6gQ5jv~J@U)3ZHV3Lk$N(oEB9z>5OvC!;wty(Wekdp*V%-#Xzj8BsS!GU z{;nQl44s_>=7=7tjJ6%2VH4_pMiA8SfYqCjS(j8z&e)&45dWWRNzv%yBe;k4y-L+pRZ;JGx>%)wSK+*(0_<1AjXO75lU-eyUA;GW;;nVV#P4hC^^#T} zIQr-3PjvpMs;1+gE4xTEOEJ7GWlBp-O~^xIflTie<*H!{LRM<2`midm$bvKq?9$_n#z% z>3%SIjDG!R%`#KEV*Iag+F-Z-l)tLWnDyxOxGYk8-b@<3d!m&u>Uha>4BiSX;q%pQ z<%&hfC@9NKCQ_Z(P^Q%$AQ}UkPPL~?0aj)mZ1A+w=EK*`+@sf`2pjboK>_POp)C^= z(@Xc+xQUHf-y6xB+PkLJx>X*g;qTkYK9n=){=%m6X6n)UTyz4iS+!zzmlJnA);syieU!#tibHCua;IC<60+M-Yp^SaZ2*1j9gJDm=- zP{Pdi#MPx-B;jeb|Bvib=%iTb|S`mtO)}Bk)2`JnMywnzJGoL}KOQ|;S9L6LE(+6rOhi%pe zkAhuRtt7s6{#GoSn3$|q{xcMToM4cqqkR-FNo8i1r??NqeX#=nCzXtO(r+ z)C{3aAD2`d&*K8!y}VxUHltNDvga3YZ**{Zl9F(56-xJaF=vF7izKuOsBCH`Dk@_~ zgXngKbXHf6+bgqny_I&lut13Uz$xF9HvSIWgX@cptaub&#caW+Ka^r_|86oot>peSdkn)k zc#lx5Do2{~642@A=au;tAT)u#csQKK^-GMiy*>36J4dQ?dx^#+Kd0-)>kCLuZOf5}et3A`w4Rd(Mg3%Y(3-Ovc{0yw_hVL;dvDSY)Hv*u~{8$8Ot%t}MfRJn9Pf!}_9>9X(;Y+7aY8g~}X z5|#fs0x)F)haZxF%zdym{a~1A_Wk9K50|}u@k}Y7%U%b33wMz3-8#IWX9LKdYj!&s zO63|gXE!u56oUKqj78e-0Px?Rnc0*3Bk4lK@7`6~9IE)pXK)CLv#-pGKi&(6si*HfAqOrUw}4BcUQRa9znIR;Ll zQr&W)4>$=Rz9>W);!lE5sybMnkT78Uv;~1MYtaK*UtPW;KMq<#BpLxOn9l)hrd44g z_zwBaXJg~7!^=aE3Z2NP;kbKaQzYFth%Pe;KC4&shmYbB9hQL{dBzqqEnuUP^jaLM zAKf9SMmauYK*@+g#Crug;yJ8dxTtX)nAex!jRQg+%r4fo@U#!cTyw83`->+()@sj_Z&fbE|tR{xDTjH=$a+&c4P$HG8R;B6p~wxa#^Xb+d!E$I1C^*%qRF_Mo|WP1XMapc#rm#YyV4I&S%Dbr$`te;*fOt@d>t?A zdwaCSEaKR1ZmYlBZWve3x*S~`F`4Y@g{Bg)J2xNHsOuR%I3#GJ*=07#aJ~`_DwoJR z+*PcPX6JZa?fD+gFhp&#vatc~q1t{Odg+qc{peDao<{?J*HiArH`gcgjHS|u7|Yp< zhqJT2&ua9f=H%nVB`dKF@vI8sAJa{;QweQOM~HBSfa`5wUk!7vfpqjC24plT559Ov z#;eh+C{w1?eEGUmSIKYmhcC;HdT|5xxy**%lA3hH6x9+gx3o!B0h~&jBh^JqC=877 zRPEle=3sg2qN0pkt#$3?QV~iyqs;W{rs>w1?YF9-G26|IBK$$$rUd5Zk#Lh33tT1@ zH1lffp4inoOFYtnY3#bzt25+qg!p%9xx|JEM@L7XH<1R(TDP#tW=p4x3;S2eg)1ESJygi#@m~lz7&85S|R2C z-P+os*R1*SpyufoDQ?7!Crb9KwbjSBuNswzcdAtDHuf1Yvnrn?2w;uCsJW^GhB8`} zKYzC!mq?|kG6HFEfY3>`M4j~47cjJgZD3aGqIAiA{Uiqhya9khVsm&5`@R3xIaV!! zc36L^uW{q9j#o!G6E_+Ia62MCSCXJR?~eONg`}SiRqcF(0W?f(A4k7Hz%I@I(dF^9 z|ILKFybmz0uaBdO%&7$+4!*yYCzZdO8N}njRp;r4!H&GhKUB~+`#yWdkbfj2yTIiB z7;8GlwC;D5>U_LXotxV;#BbDz`f|0eB&d}qp40i}3E}`g-`6WGpwg{2#mFJ`i9Zdb zg8X#(Em!Z;%lYfzD2|i&ux`ZN*HYy%YV*ETXPSyi8j%Z17>#%%;YJ0jU)Kpr*z1qm z;4~M6v33a^&A%(sw1nmrF;klw>*DqG@v~C0D+lb_yBeG0DglX6F;V(@^VgNzSP}$Z zt}Y-Lw(dadn3+*M$Jugh0AliWNhSV*&hzgXh zdW?6D5&G{D1oDQUy`O6{c}n|RtcRxS_i(YPmROKkm-1vhH@0RwopM10P5%bMofP+U zdDl*TyT|o9=Py7uhcieK@$0vA4HR3|1KbE-$;GngJo{5m=nHM>&{l zmeWInRHCG4G&>e9|BMoORzrb-g8Y8@#UdC!Q_?0=;{f+bA72i#r#lG)X}Yo&f##k) zU~KgJS|V6&`)o)ObnDX2q;p|8JIT2K#-2U=4NpgfHap`&p1daBK() zq3L!U5Aqu;Bvl-P&e?8unL}q@5Jhn);3{3|k50hh$qsQgU)3eY0LnwyMc8PcHuTWS z`uhIBi(dwKJ0Zlr2#AOlt7YlJBx~GdI*WDO7eBy01v{mM(+Bl37Djlc%MaH;??%Mu z{8vtx4kJ{v-qPh_il*cgkQ7N>=&%ZH-uGM&M4qj_$4xFY0|Tq5ct4q_`5hZul=`E9 zytV7lzan3s`4#NXnwIv|l$kwk+0CQ_GM*O>REm2H&ky0ldN%}Hy-w$wXZ!lzq@LTX zxg+hg|2@1k2Z(v?;VeMc8+Q`*F4VrXpo%HLJlx7jNp*Af0KVu6Io=QpC;RxZRA@1p%?uTv_bSz{t@C>? zI7UkValUM?c!v=&@|$mf-uX}J0rm$gp~3s_n!fo4pnCBBKRE+3pq}1b4t%>DPoQjH z8Nw$_P}uu?z_zOL9nRnHh9bP7M!OFBa_9t z_^tOJjQ!XPg8WreV_sOo#D#rJSU6_lCbq6kDIo_QQi6xX(tpf9vXo}sviU5VS002jvh!aK!<_uicxZxl>IBu>>V`p3ky%GM4lN< zAPItfLgJAzcMD^qGdF&zP5U!Ni%C;W5}EWRts$L3SXk(%iLVMIc`G;UgHM(GGjU8f zABP7_1-*QHeMA0n_QSgyJn9Q3`Ri?b$kRabvs|AuQ4#F=LtH|WC!L(B@^NP-ReDYXseDl)psG zCoZ)A`i#Qm;2@ZYz&=6&kxs=hu5kfYJr~(I8Y2H zv7jM%Cy(Mc*&8comI|V-{j{7q#n|hdQ3@IfX+wAf=4wZEx~>$>O{wOJMj>QG91rFX z6PzPuoV_hImbcIRnBQJz3(e#4s~Pe>o21%`RTgk;;Wgg9_mqZtBqO?3YWSm}alc3Q z;aYcuf6}fk;oEcY=%O5WN{FGp8|(}vD;3BRSs_Ie@o`d6z(GJ55Tj0$@h~aa{|_XP z{?Bu3rVR-mY4&(vW6SXa#e0L`1r`ECbou=owe)7`Gb zh-BGs_C-aiqkgr$3*1-4*1~%$Dl_{ekn~OetLg z6B9ZTVxTwwPy)>7x(8yf|3%Vy2U6MpZ~P{q5D6hOGg;Z$WM_qB%id&VkH_93n+Qcn zvNy>JA!LtZgk%%P_IvmJ`J+FcJaW#t@6Y`n*Y&zAh!Onuk9y5|rP`3brS^%Flj%u1 z7^B}mPQ}K;!n%4Dl9GwAc30K)Z$#KvH>fK{D!6SN?LG=8R3n!V7ZR#tbh83eoR^+M zrgka(e?-!l|IKSiT)n3LfrmtqnUR^(u;!y`sUD;)Bq}JGNA81w5YD{GJc~Yv3%h<5 zGl;HhG;o)nB$VwDLKmX_Ne^(yd;2r>U@~EPLQ$&SXx@_;mCOc9UUd_*V4`9xwIa)h zD=Q?9%owt7#9ddw)@Iffb1cmG>$SJ24p24$(yAS&!bp7W@(vua;P3q?+N#5T;ljrx zE`A~H=^39bb_El2PX7oxoNK$gW?gX{^it(I>^_HErLgV<%;lWE(1QoN!^?gBFo^&8 z;fdnkpV12o>AJeNy5gU)&h58!S#yVkhu?Q_@PXD&Iwiy`JJBiCap~u4*GE9fO>On_mSvCOGXneu(*&g7$=QWN&(y!76N6@S}&dvP$sGS4P=X0ag)o% zQ(CAjz})zXBud;5D`>HHwK6TO@8(VD=lsgvB41{G(4P!j#T_?v2npkfZ3~u6O!#eo zewI`JX?t);EduE45x5T%Kj2HVf~}7|*|ztc;`S(R2sEhS7;m2qW^1eBA7kaR+QJNF-p_tN{y`FEa)U;c^=9;RwS%3CnqHH6*qtdx`*m(gOf{><>C?_$a$e|JA~OMZao z>sXR8)(g^heBerXolxtjlFipM+P}F^Q1F=@F7m%H zL)F*xgrfzBA?isUJ;rf4E=w!@At51Pwt>GvU7Q2H1ST^2HGnsBG2ab;vbP6oq6cOt zZn-<>Hum7l^gipjhJzD+j&sA)+gn)VwkunygUCzh5d>LTzh&I!Wl=mXrvk8&8--1mYYmV~iA_LBMTn=#N}}|B7;0w|vwU^dUoKv` zUmeJY-OlA`r2}5w-=w`G~ilhRC!STIXE}~`&Bx3o@3veSGKz&OUy@`Eg1}P zbFi>f)Y6iSrR{#uRA!~f_z*+N=gB9*c+4u;bN+M&o^WB8sfH#)T{b9|Q$QVhK$Ew6g z43TyT3XDX!GN$E$dG-zt#x1^U%WF1PPC1E*Fvx-W&Embs6$EIS=xx;a9enRMoGgOl z)_gEfj_!nSfM2@D+*DVamE-HDU?2o>D z^dU6jzT~&=Jl1Ci(~n;1*mLeQ4zge)C%$wyJ&yJYEGfFUTh~J&udxXXzeCpVSfda+ z1z0#k4*h?U5I!Pv_oft)(t93${?Xa~{?1OO2lo_9hU}+X{2=&QJ1!9L-`jJIRzKDc zy!})iKlPaNP~uxw>K2atE8i!Td1Dk9O)0|iK0xyq@@mqaEK-KOuXoucxGj(#))4lywCDkE^|Q>3T+9B$YQ z<%Ra0&PCtEdQxfGPswi!7d@VeK6?tJ-NDL!mCL9@)JHDy-F%s4g$_Gz?wKXvm+#`H zSag~`z}z`JeCg)GwzT^1Yje}V&aO}YpTAU$V-r+7z^@?q7*XW&zpqRP3ZAqV$b=7D zLt_}uE}$zivaq~nyhnVUB0~;$S*>pVPFx{ z*$5L83#!?Ji-)J;QTPoelHd0p;s$Z2E91B8XjZ)SgXK%I|Bu$Pck>K7Qk<##Tjj9% z1+=d*;g1Tc)Z~OV`d@$kC_N!jOg!WL{Jb1Q(3>;O`nl>!_n!@nw6{Zq*&qtl*9{NR z&kACX*pl}&!?NCFot>QpW%AuS>R1tqTM~+u11sD5pFh3pxKc!+a$O@Tk}6id+1wrBrrAg8NIFyZaKRhPbTm1$iGAH9m6PD(^(0VHdGdRHEo~YWC{y5wG*&G4J}uI#2CYcaXusC) z2abG{k3BYcO*=?)xp3-@ z2{Bx1TpXSL0L{(N&@MF->GjS*iF2*tWH8+eVE(5vS+UJIS*w=Q;&1ks0*ckmO;mM(?p?CMtOxnzWg>u>cwp9*Ng{k&Xdx!I+X7k?q1VKE7MBVAr&MRu}yN`5vm zF=~X5vL8YUN+SzJ11@~KT4^}`i6Q3(0SI(PyZRIt(f*UJQG_k~1pFW6Jb$wW zznrtpD!M6~kX8uQYy7?#e$OGJH}CKLUMo<-UxHlE9bZr7GTvHS9<6)Apszpekp$QDO+auv zp;|z~SnW7k%t+=)AM$c*Dmgpl(7nC^rdj2_xCgToEO*cqoP8A zPO&lBh%UhJV~SP7`yN-Qb+nW}qmAq{LyTEKaAm;u9^&c`YLaFn(aKLCWiR9E{{ zj-AXHCP^bJ{V?6&nzMLy^&up40-g?zEni<>qntqfohMo8>Gk%hmISD?skJ;koVF4dkcl>9>*w*-aK&!Gl4vd*PKn2T8>hIsyD!fIbe_+}@R%F=NFNjJ~=bZ&! zhN9L_@M#*()pjKotSxoNGlaC9A5N<&sVm*C))RyGBxp#tTxSN>Sa8^1^dTxx;NUUW zF)6x0&%|#x_V?i6Tr!~W1CGqug^!EIum{TDE*8i6@5F=Vp@~9|ZQ@=ta$4Get*@a* zVm>X;)IA9o!8C5z;C3(4ha6FsTUua{_dP%RcoST#m9U($eOgijz6?g++LG~4oh*#_ z6rvLud)@K0YJJ~+OFR!$*1O9qqd7ACRWgXvBPs>RqlT<3sPt zYdL^VNVqDr)g1bCa`OBHZ48N{*Pe!1OhU{k^aJC)UnK@J$IAjPp;1iy@EzV0xmXG_ z3tpf@t{%v;297bTp1Ge37Z496{hIKEb zN=C`HZEP~c;f_{S9cYz!dh?7V*r?UNJ#3pr*%SShBfF!c10FcnLceMjs_kdyl5(+k zQv-a_KAp!n;QYYH491C0Gj&7eJk81~Vty;iilTDaa`MJNuY-$uj0D`yZdzJN%FOT_ zKgH>&oQoZ@J_9S<69ze*5oMdAqDJ%{ZbhNfd9C7-WpA?^C}<>=N+)Dw6a!#P zk0VDtc(7wX{z+g@l^uEu(gih1-uDhbB@OjE=iGlM5WT9F^H8%~IuyVhAQm37?I*+Q zT-@3^_u^**Zl8yU@k7^GOc)RvF@2+IvSKf!`Lh|VY{ zn342zP=N`Af49`i*ZRXU<3|6Jg8(-Pvn z?lEUeW`pph4|SPqC|9@_K-UbEI5Qg`94u*84zY9a?fg4v`Br}Y+DZTM-O|;_C>uT> z@_+Ru9SNqiuK-=#64c%@ccEb?j_k1JBgXod{-taTYDu~X@a}=^=V=#?*jB^O%O6TpDVS*z6~6;pQJ!>sdPb7#{FD$(zP!J? zqZkP?3k4|kph3_n(vlPN(<@aXt?c}Y+S#10t!1X^K;=O*wtMXwsGQ%9@7w%<+SjN| z@b>{_Y?z5|<>dG6sISghI_xX^c0^chCI8-w%2<%MB`83n2A2hsX?b*sosv?NQQ0%L zy}%m^PU^k~ED?4vsT$U-gg$f#ny>f%n*9`Kp>_dA^S3kH`) zO+-`y(<6TrSAaiEhww3A*9|0GmJ4?~XljLT3?zNU9*pttkz@Bjfw0DKu6 z(;6F#{>Qc&i*6I(i6Rqi5=sWJj!ceVZG?1Y;@se1Kl2Yj9x1@*10zp0$5 zx>?i~OBji+H#awdR}x|%&VBvh4=_{;{gd+C=jG)W69aL&f3r8R+_YOB4Xq!@!NtV~ zpK&Xs%7bDD8es3>|15MnoR90*E^eMPD<(1?p8x{{%C(c@lM`T!9v{~?HtsV6K~4oy zk`d{SP$dX}IcR348~2E+`!oC5 z2(z!nUarD$-}Ln8Xmw0$YYu$1ww6k_Ns#hXR1A*{Yb3sgC8(0M)7wD}P4fPNM_gft zpPp{8v`{oOOQmi{xqaIrDD)w`4D${zXgV#(vzd|}5iS+Df4>hH%6Ai>fyh-?NHA{; zvHv$n{Td2_Yj~$X1^IMpO8bMl6mu#bYj3an^|7NHXT@02oqIg|Pfg6sw&&^I!fpKx zC3+Qad$x8PhAEt!oKVre_*{!V+;#SFWl+?B`;IZubTaO>1v&H^*24Plc{2M!i4FfG zBhf38r>w!hAmDf0VSe|A>uU}f93?3@c!P1Ag{0KF8v6vZIU=!T-Dm!~? zVSzqH0s0`>Cz$`eeT$XZzXBBmIGXqS%?q{uRn~I3|JrG?+vA6VWYM7oHqo7l+1Z@Q zO4L-;R~hdSMH;DvdK`UAh={<2S;lozHX)IRUQmH}da9E!5l1tb?iNA|nM5+DQ%duL5pQoC>-lI<)PY#ZLJTN3Io1AvAZ_f>0rJ!z^YIdVTAiQ9DRKChc z)L!|j6|G63=LxxmxWN9CLa+Z2BqM}Dg1u#a%p7ZKt|iao^{J+s;z&<)X!P z^(jRs#@6Q^8-DFox^~)lUi5$=B!oe2q$_-hi^06-me7D_xy=ub5TZ99K30${i~Y50 zBA|D(TYg)*W-Zs6yDI3&+rcsG}NK_e966b`l{&E3de^bL{;SvdA$1BaVT{Qux1R<{vupeB_de#A?oI(Q-+rP zY2xdJ>8uAkX@(v*rI$AwC{TZ0BTNIf1KWIy<~^hMUrk{B{|0K`*y<6Aj4RqRBIwU~ zjV}(~34eD6W(5D^l8Y~w=Y9-Br(rKrQVdy;FHr+;*i>|`AgE`>3D|Fk$x)uR|C!q- zu)X$k{E5C5=2yEwhMZ}&4&dFA?CP@V&biI@(y!^r!AeN1TJ!7lU`}J<(uqicG_7}p zPYXvtoOUUvkzI6`q1XQHE}hjc#&a*V<}NyeP6N7zehIC|}pa-FQz!H7oL0@oO{7u5n8NcbA!&U`sDr#8eU$j*JBPVbE;^ys2pWEkguk zTP&%pZ@%uD_M7jfJnX0YX!hg1s3V#yUmMnSQ-5)q-}^yxm~I&;GV=1B-9j%~K9&#Y zJHIy1If;?LEhd*MfdosfLBIQ0Ob50UgX2_EFd4P)MhM(O?^t=*A58ZasaVHd2^`@P zonb;gapcjMpFJJr_9-$q3wnZPTc*?dsc-`s3|QaCcXPS)LXe18|J`eyTIJxb+LlDf zDStBG{_>3&3vDaG>sjt{nEZ@@eV97&vH2N2dw10ImgkAxzD(eiB?H9e{haHODZ0l0 zzSaaA2~TZT8S@JMnjjVucjKdvF5Y92(In`~^%eV2V+R=r@nTzYA|lc6`-PCV?ufM_ z!#$*pG%|}LJ+K1d5w17yQ^sX2Ld)|5BU)ct?sGs_1`KO+jKw6ktB=l-i9_t z;H`_5F~wey`ZdJ0v7BX1z+yH+3|6a$aC8Cd&c5*OBxBh?QCg9 zSav-wXy%vaxUk9<@4=aw+5GM)Kf~e^>YShGbob=T?`BmIqj!{%5ChIDNOTWtqJnO8 zI!WYz7Jr#}>7*SQ`T|I8hVOK^P+&a&nfcD;8bbcP3YT1ook=KzJ_Hj}*;@=xItqzY zHXmD~SRC!a0HLog=j#jt?*!!my%@_3hO5#=I#@_V`R{%{49Q4FVtR`oYY#Q78GH^j z#-9IRz>42+us0z8$IcgdpJnJd-r zG6(Yh#=n~$8;FH`CMO_EA=U`dVKeQ=z7>pMxzv;EMF02R{BBe^Io4f@Me^Vw@?!_zquFWvr4}Uk>BHCO7ffe*Dx!zSYA+yc0mgnXBip%eOdhr%Xt*jA zXF^_YAP%DvQ$@@Fj@6(JhcUdj_-q;I1_amtnZ!;sg4?*wzrBK`)nfVJ?M{$HfD8zk zhbGms^7!DY3!lofVy&L>@n?l2Fw7k2?HozF6atHmkl#s_4trcw6j&F%{hB%ZDu7%D zt)C1ofF#dPn_k23ea#<$W>I;N{`TZWtstiJWIbgfqCuxI_3h~JIe7u7ivV#2Q+XSR ztrDPKq5f#tsQq3;EZ{=)-o3T$LK3OpdoC0==w&7*@9*ar!uLXdfP<{>gI$73?bs6r zOj&s!fQgS86huWC(?aE(>*^q%VnGr1U#p%G9T9jXB}+zu;+CSWE&n~W4LV>*V}y~o zuDUwUH%gcy7(HxApZxmbE)gyvlqW13N;i$L`xgbzq}vjv=`8VdT^0`!(3IaG>qQi^lV=Jvaw~Z{us48-R4ZS zy0sNo8t!$+cj`-kBMoz$fA+O`fe)_g&zHX#OjGV>inv}iAQhj|kj|7`^z7{p9_))I zii(K%7VwTPu7+d$Z4|F;c^B`^+GK$ME*_X&mS`53%e|zP zlV{^s@Y9#Y+eSr&q=~%vF|h)|?H|U$u!sTyhru1YUaNR;yBx3P+>7$QI6IbjGaB%v z!X73&unmAA&4(xXpJ%zZEw*OrL8`jE43mRK_2JB`rFvp7)->souKLiJT6m%4LfKlLQKd@wKLPwzIB_PL*S*KpD~K-TJSw$-875&Y~YdQf4q0U@~b>r9VOWJ>r{KW{dzpketAt%`I3zWpe+xLD1+9o1gbDM~f*$SdmjFPevT^kAcR z)@9H;q?T!vK)=>OrBTq9^4$ctI06M-r?gk@gF*mtZmyKq1>gh)? zC8+zp4cxnYF|Tl6;K2$;o77}s+FB~tEBEd#&stPEm+@u33?cH|8I#W31PQFBN46jK zw~BebJyw(OZ&=$LKj*Y)IyU%hYuy25tf zlNZOSv{O8sno6UwgquyBcbz81J@*~$@6If@J>QC7{+%-&Zj? z>aA?=q1dnf>0Xh;M7a(mkb`N+Wd&DYegto;KwO0V`1T#QW(onPo0m`3l$ladckzNfJ<7{!lH;E0KQexW#YTlipE5J=Cw6w$ zG?q8?sC(h~)GNuS^msqBs+|Jdo6Z|*B!}NgV@Ya|BnJ13+l(~Ww2KOEv#KaIna7YqH=^FE3K(OuJjhF`f8n}^Z2U%yc;Y+tYjM3z|G z#!x;EvU3CHQ-u|&XgR@tndj;oCcx3V3sWFOkurU$Wf8Hl&FFhg?Fplm7*bEF!mTC- zMn+pJ3{_dvE*1|0=*0J|nQOQY)wwT8yW#^%>*_qWW{yFQlFzDCG76T622V~G;W}F% z2{X7CE~16r48YbM*v^^#av5Z$#+P0YAH9;3 z4C=M)=j$2fiWKK}`TQw&XSgHw$>)1-FKjBAyPey^syr_dn-T4bf>KsN{(J5BvvM4FKJU&hu$wrxBa%56rO)!ckQeTkB7MWT&GK(V zXtKTT1-mX3e>}I|_$bCg=unUBw9l*%s%IxU%@j~IrDp7W{IHvKRL5($>=7FyFe-C- z2W1XV;Q#)UYCW$xO@3wsHIE-;A<|Y%_K^185DRKW(H^zchD?bC{E7IOO~BhIL#lko zYc|?>0)R8MZH0tcRa-Q^CzumN!aM%0o0sbmL?J`3==>Iad-0I#BgvQ7a)ZQ56zV~4#esYeE= zjx&U43kF!o%)TW|EXAeoC|}G*(RciH(ahbuMQb4Q&1j~s`!;Sa!+LmKV~?DZLV(@y zK5j0*T_GCrwCVQ`Q6C#0>9{_08emQz66PLzs6O1f`oJ(F%)3reHCeYr-wdF&Fy<~| z(yX+2-=OyFoxncl35st$nX#qi@p7Ytr0+-&+a-!H3g&rc|w*IqKcEQHuhmyCq z3N6`tn4XH^J4|%4A$wCAcXGekjEp{Hz}|QF8TP@>b|i3(@>gF~CGC5n}^d)Og$b>-KmH5M@|;hG&x=^9^)UyZmF`o)>o z!|^w7MG{d?dk{%m8${FKS`cJaQ`1+~jL_ZbwG&!k2_cep?!TSW)Ja0sO#q3D?O}t? zC12*VDhMOPFC&&U#m`;8iii(!eahY$ntZZf+(LXm36V^=i&Rdi5Fi@WBnX=W&s9Y7 z)vRg2S~z;p=8|&6a^nMfP*vR_Mg41$jDpOS694g-ZTu!~^Fdzr<*SHNa(oZAY3OIR z@wO?d zhrAFe5wqwKB@zGo`07=J?xpJ$B#H=Q!mFfOTA#` zXZ-r?996$vh#JYTWfo{rBYNU^{UyYQs}6u!6=sJW@MnwmxAa+toxfiIgYR&u^F z6kec;?N|Sc%!jXp#Q&oBm7pcaMkl?%B+Dev5>EXqFc@2zL+Mf(C5LnQG)4!;w z?{3K0CqMAd!_peouq4w^wXEdQFlKWMr{J6%Bgl@jk+au}w_H|&8Io(9e&nmWnHL>1 zb^kTw8D5@Yt+H2Y&Rs7q=-qfB#H^ZSU9D$Zv&>2o<$*HX+}@7Y@6?|#TvD|v zJdG|74@qk!W1Z#Cn_!AL_6iZp9o6D8^Ic&|=c^_(MC`2b zcT^^{RvbPE`PlAwl_p<7l(4qUhkKVw`^nZb=-p-GvM8qG?QtuSH|RKSJEHy4*b zubgV^4Ig;>?Eb~3adgB*0yPqlcOAmpKcte-Lk0Ux?T@!AZT>MuMDP$e%#ne5?xukrPzLhzd z{rF4SpUICR?&2D>PCRN8m0pit-jpW2h{Xxv-};D!`)M2#v36H~#kM$o??TGm_Xc?| z|4{iBAM#~zO};xc^yEDhfMsmSJlL>S>x~Da?#SM9w`WsVa8R=FA<|6 zUo)#3FK%g|wcURaqlN!-L6k-d5^_FHC(Y;{h(C1jE-cks6F2?d^aLxAxgt3c`_BLl10BHvnLd5u=Bh50s;ylHLH?xCC zui;J7k7OqKCeRRX;m3bzGjfu>rzgLG^UUdbe+8?@6Z5BGEcaBjN-56v!jtoH243|! z6Hi*bEHaq)?DmnAbem&7({g8?O~gNjiPDY zpoHvMqTGOuS4kVUZ6jIpRP9FWeG)hxpH%)oT_bzd>*4{62@`G*qauhOAdM5`#sRKH zf-Ft(c4Y943IAFekWgrgeaD5R?cciV5RnQx?ZJIgQc^h5K{}T6&~@dJ@#ew9*=PNz z#Z8JpyMG7plbs%xoTSv$E0PfX1RL<|EZsYxQ9JlE%1e&F-LyY2?bNE0NO&uTm%NXd z^Ud#B3#?DSt+1(*{9Gnm{2+wnp%f8|YL8(u%W zXzp}MpHNt+UmYOK#>Ot#9H+p;$@vKw4KQV^ncjr<^}nrhoy_fZ(xVr%O!#CZF(toN zS1Z}=YNz{pd#z8#gl&a4_xWef4_?kme94?2aNib4ZG2s@lV#eM)7XT3+BAHy)f`-F z)M?^>oR2cLS0GJJSCIDomH#j&r?0?Kyu-$BXD#e1i8S(Ua1fYjl zxpwWL+i!KKxM_b2pgbERCw15$P`snNF!xnYFS%y4e1EjaT!-jBL3R2 zx0=7{tAF1-X~=(ChiCC_c$2(k4)^$`=Xj13ZUwq!r&m}I!rXs4pdSBH%$JWr5F;`l z-|f@JR8D#+|Go!UQb{Q(AaEB1VWgDPYx#&gXGapMM{PfOU`5Obzg4eDE7m(l)2Mk} zRn9yl&|*U5;H7U%#-#OTM<{wNMB(R9Lc#<0D>^GQCX`jr`)oTh#iLSDyLOGUs!x)J ztbKn>`+EJ}prOV_$*#W|vW74Y5Ek3o*c7!r{}So*IXuWqp|`J3F|lfTyZj1S3C)R( zW-OoM5*F{{xr$pi=zc!$!nW(_^iwUf@MsKF$jbJmZ&vvc)Y*4O7Kd!p*JDTibStet z#PyrEkA{UrD@RM;bhrsfE52Lq2hUkv8gZf892SlNvULXiCdd@>SWW&AbUVLnY=%#L zPz*go-7J6)ot}qmsWw9hBXQ50R_4H$v=yiQhXt;8teg}XoNi$#6&;^l&C#5mTPL1= zh55=SO#WzY#o$$9KB_bgA|R@UX5)>_u3)2|3a5*lT&JF!l_ut1e*LboCCQqS{++t$ zPWCES6LGTFfyRNFi;D}mQ(S>iNk~YTVsZceeb|4)pSmeei?qO{zrWJo=(2p>k^bL9 z41pW%U!-4=mdD0{koBO%%YL5K%L$uBxrDR=-1Ly3uu{Fg`=7E0!MUC7%*bM(?(S(u z5}|;g8#Ws{&o1yNW`tge`yS?{F=GUpMOvyzt7fT~$YA6e@gePZQ1a+cJkx5T zU|!R=8;^xOA53jFG}e+p9EWq3(tGb8(@6^EllAu!7GgsJAPaYMu37)RMlzu17#R^n z){t=H1ywkaE!YWCQ^&#V0c*RVYP)AMs_?lwN2aBb7mloLZx2?~cFWuEOH93G{8Bpb zt>aw?C^ySCfB)xs(e8orL61(Xv&~lxc)AXNM#qxNKnjDzc&2<4Gg7*hqjtLZX_qtvaD6%{ z1bBEpKc@cBB40PMQ5AN0L$wp6A z9}dP{4y({#kwoa8?9jH%Sow#h)4l5Gf5bsL`Q5Q)uELOZ^WBF4BVO5@L%Yu@=$*qB z{YN0D2EPIG>mry=5PD}CH#N2@CBx0gLKY3E5y*Vr65tJGRBSfN$;z4mmq=Obh4w^LDfd`lYFPYCY-ubF4|BM0yt`e6y=1&J z-fC;T%<3|iOw0Q%@3XRgxK5(W9w+_?=Wrc#mg6bQDFLGVrP}&>dc|67 zAlQ$e?g@}p7eD#SiqK`BpT)Byk~fyDy735|reAai-}bP1x;HP8E3&JY@T09pdmyv* zd3&vmhgj9G)B(J$G>Vv0bG4b*x({HFbL0AT%s>!XCNg>rN@*^B4WfBt)GYsp_iIXh zt;uUCBDZ*M9NoX?G0cYJfit6#^i0KRKe#K;kjrNcqUqbM-_`mo?$>bo zp1--*Iqs%=r{~+lfejJ0my*O~IB(|MyyW9UQAvZ7XgOr(HRV;mbcd-{I^kQx4BMVn zGHlWwXIHZ=j#+9Pp%bYCg?M!5Fv#ZN+MAg%XxnT(S4h`maHHBPCad~6V%WQj&giAr z{?LJ(ofr7vKGX$eCTPlK5*gdM;i>IccgLK(Q0s1)|0J7KuFUXdwIk!Wr*4&7WnVzI zOjY^A_((_3=K`7imX*#_&vbP`9%y*kIZ~*aY+H>M$EJU``*&lwo>x1Zl8hwfAD9ge z+yn1s2rZ6}R|Acm!mr`V)_IOHEE>}9Z!|yWmEN5Ho4T!X>^ZRKP?>W_&>@CvVbW?P z!L^&yNYS%IO=$8c)DTB$4(s`Fz}9Zp4RqGKA)E?v$MN0g3z3)Z*Qx5oYJ2K$U*H@6 z?aAOc&^pVC7YOOKMy!Pv=LP;$Ga{ewv58q&O6< z|LmFJ?;RA5yzSF|)Tz71bZJdCMSxR0^^6L77415hCVU!6R*Jg4GdhoAJg+Vk@J;O= zO%T=f`vOC_3vkhaFC!r#fq;^am5ZxZuQc8xD%F4!WKpYLa}a#(?F|lwgIt!dk4B&Q zne)FM`g_pnBR&VSX*#N`QqQbEkWtsm_^ceH+t z9xl3)f9l8QKSMKp>|{)S^dLe^0l~GW+@BMqJ?D0axao4^)jsE^Y*wW^2%;(P*DT>* zMxyK&=3j%R?kwkt(5bcCPVZ=r?weDNo=vOzSY=ZvTrquJ+2E3kjRi$y)i>q z*R6|%yycC!y6Ax8sYA4mElW&_7m6M4a&4o9IVaBW$6kNP_W{2@H)%|x1WQr7^{W=! z+bT8X#Ih>7W47fTo!yn9YBxhBP0Q2ze{*ulfIBw`7Z=}tGOu&fRV|E=b`F|#I4RFz zOU9?-R6Dx5N2cv6a=FJ(i zq_WJekr+OYqZYqIF^vSH&Dv2{u=w#sSy|na$8*>{bN6wO8Wj<}L*3hD>$itlMKL7v z{wy6~J?{y1uuCaTN08HJ9`;R39e2W8Xi@_6Ozpeb-fm^*kUEy#WaNJNJPWJs;eX|t zf{XH47!f!xCO%MBZ(Ll#8ORcwu5(^O0s<207)^JnbM7SQWTmE}(Wrp#t}X$mv5mOY zVQW6F)-xXDx0~?m9=F2sU-DQ|L?H9bANu*tZM4N~{laObOS`|}*#UpC9aF_q-$r+l zip=Y?`W${+2NAV3$(}{UC-TyZbvSw`1O6NR6&tf!F?6^KV>^_;;f*ZSueCHcXHD(} zPp`i4CW!4|u?vhcFcp9rS&$qb^v{jm@8i#QDF6H-B*{AQ^8SWgLqsLKt|0h1m6*s> zj9)PJkg*60htbJWc9IxRpr8k%U#rWp#-O$Y=N1N%&_>Y6msp!IUqrBdqrr9CQT!{z zpQX_8QAVH33}emwB3HW~G4&Fp1_l>f#h?9GL&aQt2Irdp%vu<@t=EhBWjmE`M_V|Z z{>`bRlUqYAP#59P2oKn<-@{Nuo5Y?W&)bv4In>`KVt)|%7^|V7X=y>e@@*);J?sWZ zfUAEfHihf&qG3yPgUWimrc{}^5p5A_@`j~eEb;@+PPRFZMZFY@jvTJ&<*g)(&ZXNi z=cqgPts^b91POFBDmsWQ__+Xjpj$eIbN#JW zmuq{=uy;Q_HAEft_R#k<@hP4Cbr^|69AnQaKDa3+#qZs?K;`k96*gDQpjgadv7lYT zFD~9x%{H ze^Wo`y1>V>(5YAJy0S3|hLy<9#Z#JeP!zmMn_v^DX;@z{zlkjV;BDF7?yX1R1;kK` z97c1sSWi{0fw(v{?wX=YVU7RfVzfIJ1|yU9w~IAyNT>p#V~TDIb2&cJ9GWZ-I*IoRpBLtPLb6GujE0esW4TW8bP2DnGOF?ZUu;4g)nniHpbak66?EYV5>esffp4v=< zch_%@s}BP>3AXvsB@csFw(sAUIGKy^TCeS=ypT1uSSWL9s`uW%?2=(IQm$QnbGoZF zW=2F3@&jxL;B_annEfDTm2YytVsJCg{s${_$LrR5B@GP?>kM(1U*B4}I#y~|o{kM{ z8qT6G5-Q}+vmk?|O6vT?-ye;t8((smuwp~Q8loCJg3 zYi5-!)m7?vs9oV+`v^Gx9`g(_pTi}Nvv0=gT5ioQn;rsmJ_H*)yJ$|Q@hd@$og|19 zG2LQm&Dx#RDyMH}yU%))6g3C8Pfyf44_r|f58X`*y>Dw=9*Okp^yBfD{2VuC+fw(; zZ?~pAU3$BE+Oo4S;4yBDo$by!(c=95&aF7V^V>FpT&Mp1c20vrXFfB=`j?`OR_DFJ zx5Y13e#BhW?OTaAuHkRiU9x_nex9(&Kok6y8~@Qr)yP^?QQ@QEhb*nMKmFbvayrYG zj4BbyxW}(7)TQ{YZ7q>$=S}9}H0V7`=0e!h`4Qyf`!(TJ1_vwlJ~&Bgp4xxBfBpuv zOQ8J_DAmU~I=#fX+Sw-bYi~V4J5q+nX-*UXq-$%F(2*M(8;7^IIcISj|7SuDv^rR< zo*o~A5eFWEjrH|n19`??=zR@WkPg-FZjTdAq;&9=n>P_68qPlkuzXCu`X|fX!1}C; zd{}zg>gp}m5Ggeq>M*q7)AK;WqOicWzE`aUG6U%8Y!KYSQ}(T8pL0?lPno579^~y& zce%r6CNlr)wo~g*A|%iqp`!`J!W3db25(Z`UgHW_N(C>3;p0>DoyVoFgeyV*k5QsX zl9O*o7`;=+7tch-hjERH>bS!?NxE7KbX$vp!c;e+^6YEEQQ3!QDY{j8L;UZ#5Ry$j zdbIkdnQXlVyW!f~e-ZAwQS%$WsC~k(NCrQ5LQ{leJik1G3#%p7>FA&-s)wUe;c z&u*UykqE9g$A{nR@vKyhN#-(C?Y?(KiXn*P!SRQbma@&@uN`=+g9VeD*@D=qGs3?9 zA9L2ehT^@S^`PRn%n=D_XIq;pS~snEp! zsPerFls+1f3^plKJ$jw4dsM$1Y`Qe)|0X47;0VReV~OfJPw{QElJ8B4#NhhAXhg8l zd^CSSDn|34R6MN&IA3^^@!HejAxBUDU)~3>wgd1Fg#E>3GmO6k^D%Q`UwurL@}OG8 zK*|-s=(Iy;+P(&=OpGhoxa*lTB92nAB}NUgnPJG8 zriV%Cl=eA?@}sv;#U1o7c|S0Yg*+vg?%<0=0w*R!%>8#F>~H!k#f+8e83q_wP&y%q zjdC3c0$EE*H$fi$MCI~$R<2YJFW^Xa4DC~uQqRdsB703WYCR)}2t3(T-Lw4V6X#qe z3#9(Y+Z$T9o-Zk<1lj2}&lz*#LZvB_%~0>`jL1$b9mOt>+kpSn24y^2bhU_t(Mv;eY0ty-ER&7wuQcEVenk z-~Ady`BYq~Sa4+y${uz(R!-eS28BztMT)hHsJibZD}|XPDJ?&`5W4xW^5ABWwK?G) zN7zoS2-A3^4doNGEY6o_K4FBDb2Xu$JL0*6PU0wINF+KRll~&J);j@WOF_rKZLuQi zoZF`qwQjyLt8?uE_E(WCYK$*CDGM@g0TQ8UvWRG3dp=PT*eaipEU&HIbGz6s|BX!# z9BQWgAt-n^U!Ht8h*w?mu{*2G(3<1iY6sd;&0V`HBj9RU#_kfU--TvOe9W!K25;TV2m!ZP^M%9XsGCC?cHaS`E&44vuN>b7{ zbDrEQ-?)|GsS44MuUd_ME5NV#Vbm6UJ770|FP#9{phMOn1b2Y~5fvSEVHd>n^0)mN zmUv|lJRYFK2Z|nCE5(Hk^|RBzggya&m{Ad=DJPeLT_Ob7?ZAkrtgMWVj^4++F2lz$ zk^3j$YWQ->O}A3*`>B2K!tDj_4DLh1r+2fsn3!RNIXqejs6{8t%YRo*X_OvHp?7`B zOj$?t!$*q*Eq7wlA}j-_W?aPABBuJy4m$`x3XD|5vkZ}ltskI8#m-u$E*w>*x!H%%#5+I3LZceLw=QIy#d&R-%X@<#&FO8ZAgB>blGU_J;LrxIpn3JM>4 z-om?v_J)eNqS&F+stu3-gg~37d!0530fD4~^2?cePzm1%=;BmBVDIGQ1Qv(hCPv93 zr9WUdr@!=&epzWB5;Rgq)02&gD4%3XQe(Y+Yiw^sK;Q!UYo%=QyZmUEc{uUfQZ30F z4wLUxE42%yC7<_~NAh0H>rA4H_tbt!Pg{ITMAZFZQPk-(rpQc#a|V}Z{iwO8Ssy;w zAM@W8=?C(hCCG$I``FspW7m0zBB9F?O(hZi7A&T~p+aAB9`rTAC@3hHBKM$!18d>M z#{#tRr0v7-a6O{)h2sM(^(|Q4@1D4=mrbC>MKp7pu(*^zr70t$2^mZR zYLG{@bJ?M>uTL48R1hP|q1OFnIW1=z{wQ)hnlUry2NPI3>l=}X4^0Jf9VY#QopA{H zqZ$3}&PYw2$mpr_WOHBszsw9R)QA<4i|K6gXUF}mesy(ZJnkjdDk#@%^eth|~$LDs#Z+%sXf*5<1Bt}V;5K|fJPJ@F1 z6j>vQ=A_5SNN0QKm2u<@4{5H+givdTeGT=3ntm)~5e43TKc`KnOR_Gxl_r89 zyB}0Kyg`#0*|Zej@Vn!=WlHzpLJjYhDNlhi!DC|L$HdI)xs8q5MWgYt@oT+54&0i+ zr^b{6OfbM61vt~Lt}1ozD4Cl=SBa^q(h9NVxD!*oML?Z2k7LM}C9czsBwSjc;ODP zwRqn(r{RImCYB1s4;I;LJ*phgdhMv;V*0u}P-z704~y12l0LtCa_5Ry>D?_8qm%Q6 zdl7`}jw_>we(gnq?;7m7e_h6&`dN{b3T zcAilk>^*jx88u!R*xR92dH?BshUfXIwe4JZBZvLfKNaiJQm@yWYL*$cD8HS(eOPJ| z{`+B!2qz0xU~T4E>%_BNaL+2&EJ4F%;rHH}27??xy~(I=%E80s6i}lUjk18c^V6pn z^6}tPyg6NkR#xe(B9BD91+qI({%*O4=rDd&s~$*yW-OL?ptwY;M1!uUbU0c|%=fy>(MQCKJEJHK54_%l(!Qa3#A+NW!c!?T&eWT_2iF~m9TLZ zqRqiA9wCU}XhTVX#=A{$$V&tB-E8M;)}zGQ5r^286CJ z+NH(t47MGaj?lAXkU*j&58>MZc8*Ggu*EpPXEKQxFMTSIw_&iJGEdF1+N zV9?E9V8d^ufj&r2Zku1L3ez>5A!lCmRMb$EztxeG|TvB zqOCh`*zb3f#oBd>D3QT0vucb7uI#sGVJ$k@eNDRRP!GjZ26Rj-2Lwmf9YnH3)D%4o zfd!H7i5<$ff#EuT;fip1cX49favGRL2ZUvh?O8_E(u=uhYQ#4-u&Ii|ECz~$(S&1$ zhc9!;-6eLLjdAwMPLIn&aYg7Ww>1n4l>YoFz@-C_%yx;cfc4eIjmc1aESW#}tu+*> zf=iM=D9%B$p|b7<%yM7uI}MaBZ)o~|xW!udLqgk6=uTBG34!ood4 zl(futO#idM^J({*Z~tz7Of9K_8-|X=`R8xMqykf3M!%)LG4gSH*n28j$3WocnU+_Y zy8GTrA2o>-TR%HLWuVs{g15;z-$wS9D0g3EP?8}#P{ znn~*pDksl(IklpMk{gQi^VPrF4E@w|ZmK*;Bdxiv-CA(GHeOMEu>9m$zCv&t=lN*b zYoSMoDL$kK2Dgxwv#pQxlA_z2hNv_x&TET>P7a!y)G>NDLBtC}Exe~+uvd(#_i z_vBhHRpOM~)t^SrL}L+TQ0 zx_1(|zl$Rwp1qlw7I51|^vqeE%(uHfb<`5AT6d1z-QP>=yrX^b)grX@7NSJ&Z0#~~ z^BRv}vi>}G`|SMd#*xtc_W?Jvi%Tu_Tatfk%Fa(|bL5nWzjb7?vaTzwEGUh!);ZXX z>3c_I*h_hQmVW0sN}AF0SkPLNn~iOQ*eAP%q}zkY=BuTR6_=}AeV+=^jQ0CA z>9)4(e?O`*c%50s#>A6q9vIG{(TH}Am9?C3zMCEpJWem!TUS`%zJmx>5v6p$OjcD? zowVNwl#0l+PT%b}D&Jb=_fp>q*tfU0%dM4JYtd?WV>328)*_%)m(#V^q0Lh=!; z1J)O;_ps=1|9HYyInd@^OoX2Fhh?CpO`T-W^7Z+*V**{rX#%Zqz1_WoxF!9@RZ*!V z_DRBTne&PKDed!pEHYozSkCmzuY%Iv3nTt0)2Sd3R4RtU`3M9-(vM!m+C7%ttKC?~ zU8mmLNT`Sa+Erm6l`S)b{$|{CRW$Zs8UH~%^D%OZKI+S-zk7C25QVDAK{_XfFIQ*d zq%0wbQS_G2UkRjg^Op&kDUp(rnD@W)J;g+PDDnNJBf~zaN>l1$S_u)QZg2z!%1NWD zmfL*WU0*Wr&-u5qG6qgI(BxGSil#ukv%0YSnis41y8XC9*cXq{K-iT|oeyDhX*!i} zk?=|!@y!$&(M7&@ctD0?c)ZkSinw>n;7y^d8J}4upYYcWK1S4lL#=Zi+A4-8FE3X} zk||@XiH{Yd(i*UsjS+u(f5^u7?NC!|&f!^hwjjPayT5wWyH5THMM0*E;UXj877A(Y znT?NSq!{>yoy{4O@gaY!XJeCY9XU!!n*xneaD|=&haQ#Kmqr{Za?AtXvUz{ zd@Z&BiVh{9!$lGcK}zs#1XwROIIds8_O`>{@}^sE;H`VT_FvPl%f=W1VmVS-9_hba z>40y7frggCV@vVdmo}$YN$G21^PL&{sMkIADSY&A<&y8}k(}@SQ}}Fs4O&g;aYTR# zQD5Q^pVP%nh#p9S_}mVH+vgK`amrL+@)a1-h5VgG4#tuDOOj^z<-{sw1`=d32sliS zx8`0&5(#5=gt11x#i!xr&2>MvD%DO}sD)hflzvs@Z91R_lZ5-U&#PB&q#YbMfC;7Z ztcKIvulG(3mkUusPCP_4$`9Mw9@9vJeRiu(IzhI1p2D>JmrwkDmQ&TtkO@zQ;*Z%2 zj{P5vG;$Q_6M6$)$zgT?c$hKnU?5iuNOcStoz5}8RAEqYap93IK6U`UH2|0kuIXgK zu#W)zw)UhQQ{-t96Bk!}R({Q#mpj=0F~p&2ZM>&rU`Ph5%rHVMHD%?CD(ABD6oD?s z@_Rz`V0^3~?&fx~GY`ydtvw7ZB!ikMXoDNF;R9d?9pUYdBsli3tF5P&&yJSOt9Y52 z9}+%9`=NA`2%wz`i^(Lnk7d@MR6xdKTWcP2<>qz4F8$=Z?C@Tq+cVYa9e}V z4tPb4>SYEy7GAXTzr~iw^tGsC`ha+$@Cyukz*H(OIobS+`c@*wEqiO&=QT^37u1l1 z0a`+iCt;$KV+D~XhYWy);Do~OvfREW!K6M%sIDe z-*+)PBm`qTPyP0M+AQup=WqGdzRGGEBHi(sIMJ5m{Wjede@ea;#J8~hgw)xl1UV1x zGaN^7mPULs?Ufg8scc#gO%@MsqWL;LaM`YSbYfv0SA&kQCn)FetdLcz4(FMudDGKk4Gu_o>^n?nHhiM z9Q#}CF)t(q?}=JjR1xhB1mgJ3iXCg&lSfZ*M)mtt|CIPqU^|L_=8jeOP8}zwdFt_J z?{Qma8lHEsH+5yicG9}g@>c|6!m{U;H^1e1&%bfRl<+gLL z#rbqd9q!pF znw$5w-dhQo?|Y?a9HV}7)~dO#zRs35UwgjNuK4Ck?ow};{0EI!mBqTRAmcsRL+=jUzpF%qf#9=_8Bp>hU2fJ_3k13gP69oyFk;2VNLudMDKCk#>yxu(}YIL zM3r)TGAF5}XT#^6&+gTm{}|3k^bFH#u5%MYB`vGx>NCTJEx%%1H~h)jQBJmOqksX# z3tT{;s?d%-X6i*KH=ni@Rq7F@topNi5=DICRXAvw4lJHOnHUKHlKMa>3nD zU2~&&auuidSdZvA{|h3Dy?oKHtIsUI=eP8Z;1RVdqFpFFKIOchs}tvwnA z43<0)2+i9F{a#ID(-~=}rVxb0t#5@an`HK0xyqsI3mL%^ZzIEu(nlumErGF%-^Dt?e6;^0B8?={Tud-`cO|w;G#*bQ-Ec{TVh_Pr{{;v{D-5CHQB4dqYLh34)`roI**po9rx$fPL@Y=Ru2Darhf^~ zn+0_}?v1VXONt=~8!ue`^^C@8dPOMGnivT&q0yjAy2r9jUS=m}_~uQV~YLs}*nm*s8Jw-xK%B?YclF^4!x6brz)%f^PSdiJr@%a)vHSMJUc?tkQv zz~TDKge5?V+{`4IIfAobNj9rEBsAJlVF|HCAo5|;_gR13!;a5HcTLVOAaH)L+FoJV z;Izp>0EF2ZQa{WrvwHCVL=pyH=4$IXlBtKFmrmpZ^Ez6;RvX|SEcd4*#Kjqzn83>F zOC}z@$Rk^z9O&;4+zNZ5ydl$E*|bpRz*Z1J;(>!fnO4mfhS0?))grAb^UnRo_W3`q z5a|LiedGcI1H(-;MT4`oCF27)(r(E?UM9r94CTp@0&hb@qo;yN*Ipcx!hY0VBs|IPBn_$N3`?!!>L7quh2lFw z{ylLY4GnAyCfe?zQDI4pt~^cJxM6h82jKlraRj$SSGhsE?i21UE96);<+mnAI*l&7 z@t0G-y^k~oNCdKZFa+T`a#4NB(200#Y7)i4jo(hRZbxg-sX1*$ zCY^p)Y5q|hY90#97dL|NQa?;6Y6ff7^qLlGz!9^0!tyxr1ngWbI0$yDBj79W5eQ$h zD79G%M9+--)Ka+T_~?Pu1ca1xz!ASt18v{$76P-{qa!{3Zv|rL$N?P6HJ2Yv}u5K zI(KgIyO!ihrdSp*yB*elKh!$>%|ec=DgAJdingE`88CnFUw3r>AkWxs+i<+m${8sD zFHn`ApFi*+sa4g4wh%Rv2}<{kv?b#HV_HMX3wIlNT)+Qmh;VaP!2Ji01Q@HW`Zu~2 zm=s`{1Q+@L^pODyiqP7TpmER<+sICI2l|N)pPIdxJ3xv?!j#*WAxB(Q-xGUOTTM#O zf7`(V2XmwF-|L+bp1X^0{1!0DkhsxMu9<%D1@%J?`)}$8(p{Md{8Gfse1L|JC-wE&rb%0nC8^ zpN~vGOufCwE^n}akFHMg5i#Abmy{-Mv5e`H;M+#HWk7;L*q%ZZOmUyqef_sNif~fE z!Xt3CjxFsB45*>-e9+ij>9VhJ2l0W!wpaCiZ29L;0Yw-2&644lulw%Uu=P&v?_0cx z!Iqh>(4v&VVrswRJ5%<1RZlLYfqwv-5c%{D@{30`*8D$iA#Pc`Lel4K<);&%SoBQE z_o1+wJC9p>B>&RCEL(LH$(=4L!dEi)XTyZ^G=7uDCn^I?e6B~!^B4e)swtSsaj!k6-Q)7)#{^z{WE18-Fc4HS5^jPCA!3(JX2 zQK}DjI^7Kot{#^7zV#%mZS9Z7ny22vIi)*tZ}Z(7C%a!;&x3kmo|Z;7;mcRgjNj+C z)6FQH9%`<2*X{#9<-wyWbIZ$a@x)hOYr7xbH8}BK%^asmB$!{!*2grgL_wF%r^FM; zq9sQA@y6Iy&e~?rXK+uj8PZLXDY~?V^O^|}9Vg;$ulVcx-@#b$8eV?=>kx}|E0B** zju#-TN_8eVDYI)2Y81>4ISkiqV%KR&6276?zXubJUx?E^pmz!@o|3Y@lS&`u`i8!+ ztM9kU4fd+xQj*hs(0~5l&lNdr&X{bsj-#yhiFks6%RrQ@#^_ze5ex^TqC2}tioYFD z#r!|PuZ}QxF%h*%$dErv2=ugke(+iX3Vq`HpP7BBlNU~^;3INjt#SaS!5dp#4`Z^qc?xwGh%Isz< zngKxx0{k>J3508Zb-1KkgZ3!m{*NSntvoid27R;s>R-J%k=wE=ecKzWXGUhxCx85B zMPEg{D=pPvOh}%ndVSFA?wUe`Az!AK%DH%}k)Wtq?6H|I%2+VTq_!27-S9xC(v(|1 z6~?EO5V0d6#eOMww~55$V!A+4H0Oi|W`A&3shuv1DJai}Y%iyOrgNsqhth-uoLB7z z9MNjXb6HKRYin;zT0D?RWXpt}1F+i#+u5RWU7)Q7Hm%=({?z?q7$CkF{RH054V~|e zuL$BG{DYkNrfwy7HDl+&jKSqbWHK_Zg@vI}aKpb6Wd8ML?IGUZB*Su+hx*60LhV^q z<$4cxigqo?*-xb9$K6UA>P7_ znO48TRcyy?B8GOU&o&R>{r|y-71LE26A5zLv>%xBq{+@(L&mEiUB}^f^qVcUpu4?& zp{T6cZs|L4d;#c0d-MT{0yZ+TZ*i57LU6%)JbJST^K8{aKMo*J=jv@O>o5)U;?&{r<2CSNWN_W6nf9cLP zwPp@e6ym?%_=#jDa=p`3`FcnKIw-4&ihwLSgv(N#8bAM*keW~KDzJ7*Z@yhmm5A1)rAjHAHVdCh0&zQYQ}EFaMQHrD z%HV$E^Q8nm?WCt#P`Rm4!oe;Gydlt{2m>(Pa(yf4>FEK}sB8!dN>S9%Rrsi9byuRS z29I^oI^74{huY`MCpJN31=hci8(yW52+fFhS~bZfsz4M7G^p5TJSLUU z^)`ocK`vqL;k8rl`eQ1(2kje^b}&n^p~Oau!gj8(jC7e-iT! zI=q`{1HLb#Ozw)?F{s6H-4dnVzcH9Csh7o!d$j<@x7c=dH8sxfVyU1_0+|Mo`Dgh% z8>k@AFCgpT_IWcOp@k+IJ?C{i1KAZ@H6 z4^bz=!>iefk(;bGQN(qD=qDf+6y+ug)HX6N9E(E%|a~W3<%NVqz~( z&dWk0CpANNAZsu)Fl|hH?rzBlvgiJp`us62!CI)b zYJLHIvgGC^q8jBZfC-N1=tA<)$c6mwIRQ5AocnF9%EVUFQwjI zse$kKoaV7W5@J>vnRsS$`{MGB4t^V?M=lm9LHreHT;1L7=453Vf{}hH|33eKnh}Z1 zdP$A;0pDN?$sJckBx-W@p_v&0CZ@hPKj_SueWc^(Z;XGXi;9Z&FfIdTztyo04R{!;}y}2fV#0Y!U z5yGNsGJ1HJWTpXLHE2II)8O3abS=1b;zE2HG+r_j$D#;(7RryIH{B4Pm*dd70GtZ& zMTYOMS`i2T>E7&N(}Z(ANRScRU#?P!mi)X6z{^$9AIMo~I$eW* z-(-S8*P;F|KEZ=P5L$G-d_7iBwX?G%l|YwVy6vmK%kK>esU+pe3NbX7e?`nTwu*VQsY1g!#}Jw3(e@ zcu>Y~|6t1-H5afyvXqyX*BR5D#5hCh?(78KSm;;qG)WV(u9?#6>iRt_#Y0P*S6*(@ z_iw0FTL}D(L9IHfrdJa2qH5<`2Q5utP(Xps&J2FwbH_6WdHqj}@gC8T*Hold=Ct%3 zW)S!Irx(8yVsjly!uPw}Kvb>KtzjlTF}A~28_WT7hSUiIdis9Y zjc-N}a@q|guxl~F4N_8mUS5#onu6TK28XSU(4WA}15Sks*y}gDd|arVEbm)=W&*)e z+9Ao$9#Ag6=pPt>>nw|CgBjPa&sK|XAR{daUfNDU3zFsx{Fgf{@&W{H4PDQMmuz{6 z3e-x&2?QqN*mq#AKzkjC^^lJe9gTII>~(HSl#rfYx_jV2o$TjwH64H!yz-7q3)T*4 zY3X+zD3dkT+lt!sl%hqWKbH1RIyzV&3hTs;tzpKCntCY!PxnLb(y_q!+o#lejrpoY zKnp`dMb#eqgiOsTpp&Cm_pc#M$UB`%0wQE$W0kMzF@Dr#R%7Ec~4mCBW?v1%!T-<1;4xbu2SF$wRhd31${4Oa;W5GJp zF9^LVJi^iFThv1B*I&vFGgdWIFiS`&teo}0y?O~%?DF12?dP?hK9LCt=`rE1K$0{L z&Zvt4JOxD-y{+kj7^%qgQ8!qJC_df@m0dUm+&)xr%l4aSU;5NBnLuQh^l*l$v=PY#iL1tNDY)lsDoE_JM$6AAug~`7AfSA8DMy(hpe^6J zh$emkqQhuC#G~JuYih2r=)C3RRRUY|oZMXKAtc1c*B6a~6evgWzF57dq?MgrMP`K} zL(DG!%`yV>#C;@~RQQ3>XrT&v&_eU;<&~8(Fr>u4)-2b5&v?h1;-e{;56U^nSD$H8 zrmryLhK-stGcrC)>4)2TRaqxp1fJXQ2cRWSDG{w$z`@4$!2mx=dKvPC~xj??G+o)bRDmYE%`@wd^@XJ3&hQ3#yn;WNB9pd9-7nfEj{g1Y$ zUPn`jDZmnsLLQ=CtXKdT5|m*zWo487{b05|)w|v|QHdbKex;@g49Ei;-?oZk$hIMf zfYUlu5mq%8j=W8}1N$B@i$LBY5q-mF0#WwO#-5PylHnmL3Z@j*)zuY*(P#Rgg?SBo z%S^jyiK@Ffhh0G1z`#KJOj>q6;8e-Ez>buN2D%dqJ&TjA$Tu14TL}MD*}Mr$7SIx^ zGZ`5ff%Y#p7EA$@sOr40z2-M5Q2eDCROsS#)6<{UO?P*{E>H$0CrE5F1l)1S7ae$B zBw{6{UL2r?4$|m2zx8if|5dPH*n4rj&t|S5599nMM-G@JxKaVF`ZW{9T+p#(OObX8 zYB#T{U}B6HR}aiI(}dQH%yU}WpcU67>G+Qy-(y1l6o(AN044O&hr+4?j_Yu3OE@^t z`+$E~P*L02U=%VkG1&1E!LNZ_caz>u>95R;i`LG@Ap>g^ZWv4|GOd7s0HW^uvY72` zSRwwoX34pb8VeX=Pfvkfi=dc7fS4G~XLj&57wgT=$;->m9)HL6c|zNajc3CN6sOKS zeYj!$=8il>{36&As97{0#ZzTXTwUv0^46*s+k#4?{Miu5+Gq^2soF5_qtUjXv?)Wof<~Xop~XysoknZy+k%oi6QRk1IUT@ zUm^z*IXAc3;3Xt4ATZ5?vgneeA>B#0%zC6St~pDjY%BpA4?xH|Iw&iFncrMqJ~(d^ zOZWh{asnDs#OPt8YvofQl#MYk{TOV74{=*yYi8Jxa_1OueeI+|CCbWrc##m94W{RchK9OcUSI|) z7R^6UNkm(_tY5xWXbcvI>ne`=*=DVX%<~z=SnZ zckbK)f{4+pClb*H^Yf5cMJ*)s?3t4Im!1ks6$4BWky(Oy?gW-QeAjgEaO+*_b`Doyd@N|tK_>Mlr!GWbsBPl5-Cx=SHj;On$ zn2pyD^R~ZwJhXr4{PY>qSMK&aw(5TS^!`9N7P3GcVCsaVqTd z=6D5$xJQobU9?n-c-U`^jj@ngDLbA*E}E|fU1(v2#39KOnGqCna0oMpvd$QW81C`L zg#GtFtv(;xSHDhd-nzPC!G(OX@*SI)p+rS>NU<=eQb+NHxxBz*un2y`!Hm+8GW!Q zp=2~*Mh%swDbg#`1%@wILz*owv#JFE-*C184R)z+Q>aV&f@@}`@{B9AW4c4=LbK^W z>i_4DzK~E$aJ}OlKVN@|-#5I~zi`%Ue;ujbw+wvK8E1LFto(022-rD5l+OF4Yu@Hx z?~mc(kuu#T2LESwoAL$!Xf{PaC`LjLif_JNS$bZL^Gta;NFBa?dr_zTlPx^xRZK=g zLQIT3nNW*kk?OGy!S>eHY_3cS^qikR=~}f>PL_VIR+ejGY;0rIzzVCVtB{#{5&LV}IGxU|%1mnu#LNX$rF9QYRGs}zz5xX;!kL#+>?|}y9C*{vgG50o_x7!JZ;u2{VaUqe1?5rMI9q=T zh@-P=Qjj{E)lQ1n7*!vaqvZU`uN?d|L_NO*r$h=t|Z%A!g{L#h@IM!*6O z5TP$NVfP75evD+mhM#`$srXOQ9Ur_G;x;x#R%UJ*WG#)fZaZ(p{woU2=>sIE@e7%E1g0NbpKdSXqKoT<3@ix)nB z-Y8)kv8Ozaj%LxWl~-5J9$A&9d3@{B?!g1tP(0I`|8^}bt*;Z}JQ~W8!V5HjZAe&H zSXNh8Q*&~(n5n40YoA|C0WKA04uoIaMY;zCD}AiwBN-)*2p2(S=FOAc1?rp}>dsCh zH-UkDphZu0=RpQ%saniSiUQ3|U0S+)qy6Ov-Oo3i(qx^PX=%YRL_naaxLDeT1C}0B zQ&XsV%QE!fDZs-aFBidl38zFu!@qE54wI6El((7r50X^r1TqfN;p^)-)`c|Q*WjZ4 z^g%mYc&q+RW58`w)7;!#g>#657!wnd1b2C1osa+v3lpC%PW-=6La2ht+1UljGiz&s z1`F$AG}8R)5)L*tm7~GV`TdTWnVHUa9PlvVNXHOP1e4+{Y37w^urP=nFr1I`^Yga^ z+-&%*E7c_>rNHob$qt->uqCi+?yo^SQ5CNaJoWW)b&Loaetzv7#Ya>UO20(q9#Bgt zQs7E;80IKG!N&eos>2t#fFB4=Ygj%Z?WM7mnU;jde);=HN+=5yhK7izYK}2bP*71R zzzPZF%pk7`l9S}=z!4;w%dG8iv)5KzOe~<&@@W4UFQoHVnk2mR+J%)2F>D+XlG%LW zI}v#%E-tkYGI$lBf$+&P3(d`eWb&JB>)&ii3Z@b(Bje+)6r{@OVGI4|TVrW_;NJp^ zHXPy$c6U(F(7;HE7DXhuoZo{J5@$kQ=H~*x0M=VuZ3&6{G9$XWx-bL>Xq7u5J^Xlk zDsT57JTlU1tTZj7%o^Hum`GyL7;1^H>*$uP{O;Er25636^* z$yvtzsi)ry>8Yp|XI~%vn{9f1yv2Dk(sHrayWpt{n_#`;`tpxwatg{S$oo}ey7opC zOd|j0%3{7r6tXAg-SZ_Q`I}UhvzT(zI?5x2Y%P!}lIwe0hre0?sa$}SKC}z9HQ0m| zeqCLj-#A}Ykv7(z9A10<1Q=n@h*hX-i2*gh5YVYoqNKPuFjc1)mVXsRvS}y}9#!|0 z&aq3a&XkJ67}9+qm;6p~JWm{$--mujo|;D3%YuO9lfnUB`+v zotWCXdkab25U)&cZl68-=W7%ohvL0b<3r3&D6I0B1oEU>MdzY(EfjBJQoe_{0r#Ie-2+sG!`vV z*H%jnvDJ9N2z&X!+jU6jdT*WR z$|Y1mR~JOL;%bq_%@JJ?A$4UxWeV*mH4+!K3dR}Va`lU$8@DjqxX@74D$PrL=Oc27 zVVH?HLJ(OR)1y3kX=}8JC5(A3_?ZU)*De*Hc6^1L@5%3Vn-ryGT+Q%I4pv73bO#!? zo6q}7xw`bzbrfc`>sC_+rm9cK!+Cicg^|E{VOlfTHE0PzAjsY|z zMlH%;aV^!4){#jV1YWf~>2ga9v4sGD6zgVs2A1EZ9Q*?-OG`PJj(!s!cgL;F8d1nU z4*`wX1dytHgZ4=_j@}An;Go(3@yW;_l^MBvdO9J?8Nj2b>)bG?4tZ0ZPc8oq!qXX@ zjr^-;HOmwy39C%2er;h@?Bg~4=A9#2E%9k$h=;cC3ZEQT01=hxoSvt$5_ZreQuu%FA6+36+V7E9*^{)l7L{L-FinViF?1N%mt69iy*=~N4vSvV4(|27gw2W zQIDo%7~k|PTbI-JLkbF161PQc@{%be;GFEyXqDD!iJo6&4sxp?3{opld_vdU>Zj-2 z$`O8R>73UTbn;EbzmL?8h;6ciqKCn+Sg+;kSAmjLJk#lMf=-qBXaL%n(It=~@L06R zVZr?T7&{#tdxYk|zMqA~(n$lV8D-^Pm1TwT8~Yktr8nZ{xs0uID8TZ>@Ob=lji3!DKb>r3DbV~_^B z4nF>wA+)`@N$l3*zu@~RmEX3ld#pyd>it1-&JF6qT2^V{XS4D%gF8hUAajp@mqc6V zB!aekZySy_bu=cD^yEK8Cr@U%+CzmrNhj^$(fI1~eTk6Jnx&!y(YRL#TN^1???`(Zwa!c~@leUD+5>F|_n3fWG>@7lC<(oHe zEWWhFB#y&&r-qJO{Q~kTm6^2@qgDuB~2him45FxWqzNsimrZ zfx#s7S*lV~30Ngm;Y_ap%0#Cg%HXg{J|Yw{FplJ+(F3F$mR(p?>;Ik8NpJT^aFMTJesQD2YIN8Fy=>kyz%hY$>QE2iev@>^t)f8$+*TWZkwyR; zEgD^O;2jwrmVWgn0`JuhkM@S^nnQhRDp7%Qa!ibpvbuUDHG7gYd^Jn6xq5sPe5X3o z@AbncRSVcef_B*eMuP;f^yDerzcIiIr+t0WZp)&l=SSs80Po0Vh^ zbRR`B@vgYCZkn=RDL6bSASH;Q- zj8cwz(C+!o+ezN^UU`06)c_*&>%?O)wl@L9#;`Nx0Px4pzi3wngdI9;(Am_qBtg%m z-Ihosn5w6*m?>z4zMwAT9e{p-M-W6TgY$|NLmXU^VnJ;0+nfJEZ3G0cUwMgTMr89U ziyQe_g<7m!9{-Nfk`egSFL(XIjmHatMU z21j~(0js{pgUot@a#=g9Hz1sfsT_vEa z4NX~DZRS-342%GLH5YFTFZBY7HwU2+!VuXnNkc5nkh4erLOs;1(>;!F^d$dx1wU34H7I)8Zq zF%Xxz9u2*}|0>z;S>> zruXgB5M_oevp7j3t`vB{FW*FvwtJRb zd_?FU#XI&JA%VGfsckO@Zab(QI1fa!w71COB=7dZl_x1DXJpKMm5A93MQzg6gASdd z;@_-KFu1U>ai20-6c=4pcJ?vITo|+(Z=*-D;CJh08H!4_%b?s#tKi0 z$_^gQ4SX9B^!jMD2%NoOT?VAnyoyGzk;h}44X=ovoBJ3h>4;U$@gz3PH0!QfMRnK4l`l?DKuS#GL=!h2wD6!J0{95dKc`oUbFu`xAw6>81M zCjta0Z6GNq{{4qfMx~JwMzWZg7*uP})!{0NTXD@?S5}d^csEMrAvMAwrT}efY!zKy zmY5z)5m*G~=DeXXnVFdx_(L+UefLF@`!tLv&9vB=(o6r16!YFBY z2u!T1$4K)IyhTiu$}upubY&!$e6B9x=nR10CVJ4Qp>0{(^NvK#B{!|N8mcaHn#I4L zmT*y0Ql3v%6&EwLUSpH|StFh-JWfXlW5VqM@Bx1u0M2;>1As)9c+wXfG~X4drliCu zwFvux5D<^pv=XM*)TWa=+?cGD6?g`L-2r$rd;6tqy(hyQh{2|g_0Iwr6hlv_W$?oX z04)d0%b`H%*hl#WmKE{w%gZZDNJC(cgST=QmYAYZ^BMrs?cvY5xt+l#+1SXRz7l}E z8sE0V&l=1`{he6`WO+ay2nvA4aA06SARxBsE5zupCBU4)AX7GPedu!#Bjrm#A-BC@ zz=PF6Tv{4*so=STRfG9op3*a!`=eCjV8$9vcH7U_!_&i8RJ2`0q^-RTnoG|k7hH79 z#w?_yD$8`j!owXr(VJnMPi%@H(*ht4A!_SeqYj?fe_r{KODN{&f_F^$;2_)>)EvHV z2_w1`OSo8BqY(c_i^gL1zw#d)+`VgZZD%o(*QKO0{!k-fJXpO9`FZyTn^ux1>nlzx z_@RTHI9KQxXg4H_(fw4|vphF7HO&iU^B(K+aER4eaLi|B!m8TpxCWU>p`C_F%94uM z|79!x`|<_~RKVWdn$nkeoU3?&b&|Q>OL1QWW#-lkK)yg&54tE=NQy?2p&^oz06kwX zAms>e_&3YBsH?xw*Y^Q@FBpY8N0I5{AjKn@XgEtq^z@t`ZL`wR(T%KHIyGps9RD(% zthPXALB0T7R|OB6?uEb@00y#EO#<|-mY0o;X|~C zkf#evaKTHFXy{tXKqp*Q@<-22r_eYiB#W-9!5th|!iJ&QqFI95RSid%6iy3h{{Xil zr_}}!N%-MpmdP8fVCtoOsT3O&^crC0j0`>SQ4$dm@wdVg8}X6XbUWLPq21r#3kB2T zAH9&;BMGwT{jkVTyCww{6(#sE9J{Cv9QtsjKxPZW3M>qvjSu^#uz?YlgsFO>HvqCN z-ZS-%U{g0}22oA5wI_CxKjwnamsVDQ;L$L{lF-XZAOnn#j8io?|3=&B!z?T!4)(#w zqv20ujY)#<+!KsCoyVnVFOOM8N#*5-Ydndc8CMdg#UmWh9`0`srmqWach7SRg#RAy z@Qg&p#@=l8bQ@?u{lP4codd)u)PTG^lb0`F(gqr&$_5%i;RCA^ytKheOrq5_S`tCK zw*Uq~zX_H#-W#bdHx);0E**LB&IeiS8#ol&ty^0p0J9Pj_5wGZ?Vev|Ma5GxvKO$b znshbn$w zLam!tf&(3fiN^0$hl&T_LL{OPTT@dLoV&`WG6EQ7jrAN@c91~5_UO_4$_gG97JL9U zy5BE3@7}#vZ8-sle$@AMd!eCVc^UFjWCU{Y3R2Ehp-K#kAasp{pfxkNeAuvKo2y#I{g@_@5R7rf9lJC%edmV{W(AD;6Ni zS#02{cd}lm$99=InV^O9>r$S5cV}GH$=13V0>_@FnX@rNXw@;{g#VtOZ2*Ln{5w2L zZeGiH=A7$Ig7fE>b&9w4xk}LszObugCJ~e-LaAKJ*ssO9Tp~@JAjuDK6s^SM-ECzg z#ie*FFpIEPBv(zdGX-F}(^N_m7~&y;cmxoP1hws7K>Jc%_j+ z<1t%hm3k|Oh4Aa1_UtCNUySk_wx|TbIj=frv-X;o$qIU&j^@1FDt7HD*&ToB5E0(? z&v;lQbP+yQkEd?En8(?)xP_=tZM|DiViGlXeJGgk!Psm!cTT(Ru>bCBNrdU@zZD^V zul3ZPPqIxKd>Dvx44n*%X;Xvge1S3ZovUV5ZpDY}G4-|^#D;HO?&IFuPt+*ZOW-jfMM(1q%I=z= zBgPpKh&~a`x9)W~RNDgHh29y$SgxmvKEm5SAI5MNjtp*k2g&;SJ2cAKydM0fr|L27 zK&71OVKn0`$>mvm;pVUq_sEkmQFOpD#pTaV7iZy_kkbPT+r6wEm8FlP>kF**)pp!A z1Wyp@ODKqkP14jarU$I=HHr&S) zNFLnVUyR!0KmEgk0bGXvO*XJB(T0yVYrXH62G;Mt_xQF4typ-T+Gzm+mPcT0Y;La1 zHt+OUz)rIaLX;8sY~~d^5-F<|k5!MFwAX4c_0LOfgGd|MK5HFe6*68{CUELn3F$Do z`^1zyNoN*xDW8+_a@R>dik#zNc-&AT=gFb6Gqxc(wzHtax8wAA>LSefDw5*9Lm9c| zbtanir8rZ)mXl(gUeUn4dzWK(mv*8N-G8J1{*4~d6T)M^Tx`N1nQd(p!azhvS9{x5 zBOzo*i>9i32(=6wx4+sbP`SxBe2uh&TNv>BFsrF}S5Ynny?S;vzQ6REfYoT}Bd6c&R6?WCE@1;Ii6o4w?QHnjy81AoAJ=1~FZLcY*^7%Ad0z{W_*S`45x)-xG2@Hg z3H{(OzWDw2sO+_u`mP^tpp$tvGd;ms+Y6t@*3W8rdXh|>&vh6sl=v(@TFCX5UiT0Z zHegifor|e>drZD(F$!2ymWVnw35;d(%lUL(k0#9-Tm7>-*=4n{wD+EaL>7Wuf5ispLtTqmN4ze zdp@1dR+o?Mjp@N2EUk^>HI}0;vJ=r-u9$JemGPlZ$OaK8)$k?^$r>WloSjyrv=nO?9gNVVr^*uQ#v zSjx)Bv=@LeH>%w+Bi+2ETaHbPn)qb-0LtB@2)%uL(?Z&0)?ZDwL4Oa~2&3+3q1y`y z(=_CPo%879aq2x6Y0upbm!{A5GG_Kj!7W&GoA&Oe;@-Q{*`jaWB!+)5xWf!g!KuFX z3>-~CJ2L&~&h{Obl)cg`b~eMuL9<`QEabp$itg=gLP!DdpyvwsW^ zSH|*7!i^Zx8C}t`xzjZ50SQc~SG&kpSGZA(y|_!4YgvG%(K+4s4 zL&;5vz!=Xhd)CKV3w=%CnRYrGsG8n9chxzUsE#q$WKZe4JZS;n$V{tAGP029k8xM- zM?d2JSVX6%M=q(3MmClsh$(_L5v19RX&)c<5U=A7)u0#ole9Z)@6~BW5oCyP@iV?@ zb5lPQlYahjA-WAyWYtSt?NPyNQixDw=ZrVq7(e*N{SOXOkkZ9Cv&Y)mR(JEq1$QQO z&5at`({Tw3W_`hr`*5U`lJkn+FhnGidkz@I5qHylj)(%8X(8B1R1ld+#QxeR2Z?Z} zIxYIySfhDPv2YA~EiALQI4?}dD)IV0CQt-ErSK|*6{m5Qwk`YhM7hJ0U08%|TOo>F zy$J;#%D0i0BtG9wRZ$+^kQp;bzIuGuM*9?#aYa~pC6k`uJM8&rSX9ww>ceI}zC6uv zFxb?BzK217=X{WNj!1Ug^UVIU?xCBCgPmHTwPoST<~8QP@+i~eWMs@1iSQpaa9in1 zb}sT$YxiU%1wD1YX^DPlYv6j-0#G1U$Vi2JP36O9u7RWRt0&g4=%p81*RVw5*^kxI z;|_FrR<^bE!$~5oRH2>Qh?%#G1nkLm2&%98@%%Hw4KR{Ov+>cK$aX0ZFJWGZ>?DuH zqLBsO1VxA)PU-MfTA%*5Yq8N`Etx<*R@H6Ozknc%AaWb?;{h(s$VkiXwv&E|lyhjK zwGiTa+?M+_%8yUD*WcpikQsVNgz4Jkz8y7adVKCi<}Iz8-WXzeRto%nRJR@fRuoZ; z{XoqrR~7YdfjE0Z>;2teXjvnj)Zl?rh*J`;d~yvsnVHFtY5$whL4Ct1-5O&O?PR~S zuwTk8jJtxeQK?sO{W{MNX90+IM~5^>={}<~EsYt7ju@QF=Z*Dg?w5v-8NC0Gx$*TEkhKm;Ktp`-z*g+i;_Il?0}IDSDA8T zMwrq>Q%@#_qez(=56+NDEm(ya#y=0ktYR)G3=Xni?f*%RZ0d;87^~B&0@F7~Di>p? zQhSIGgAW}k*S~81?OU2SI@)LmWF-}s5Do%5hc*?q)hc9}Z%vUULM35ySbq#zz0?wc z{gjhcXc#6*tZ0bDg@BBO+0A8zmZsDn_zfLep+Ut;2N8=2oHP`MCCYV4=qa!ns8O8W(s+EP8sFK4e1Q51+_!A7m&zu?t0F@m-yFC!~>875zvS|A(xH>{@s z;uD@a=tE!unw-8buq6ine+TDJEzubzgn1a{bwuqB{(k-6T|H5#Ku!blctENFQj;wR zHQ(O{v&v)8GTHU{e2*x@L}v9|?Q*OKD9_Q9Bj=#`1jN}uY#H@giWse5;3bf<1Mya1 zsw7>gAwDqtrwX~Hfy@a2h2I^|MdrZX0#peQnghJl6P+CMom&x|tv`S=kP%E-7Zdco zXS;Pb%QN_hfR3v~zfF%CsC?7Y(|r!-J_swgrd^)`CI73_t1DAYwd^rqL4Zp}UMEKj zHUhqc&eCxzDk^Sn?w0|6l#+qpb(n$N3XGJooMF-heY__*GBp&^Y=ABUgvx?u@4wNF z{n=p?9eLoFBpVQ9FQy0%bs%k=`D~c?7~(r*$_uWU$P44E0hl-Dsuh9$8~}QR1TS)* zFRf%8P?!KpJ-h6`>3Uw?k{wiy>?fFIW2S8n3=I5>e2Mtlz_RRljwlxj+xwh$w>CR|A%vD z9BS|bITlN5^@t(&wy;$m^uIv&2K)%|X~#mq#)dH`XI)lSmJiQxiuIGcAWGO;Q;lUQ z+xzMTU8Z{);hH{UED`#DLFNt4hXjz=xW!l`{lhnTus2(WeNuF&v7eY50rKzc%s!eD z^c5;D-?;!GFw$7e9<0H8%v3{IW~iQmN*_eTW?Xw>v5JwQc@;cB-9)+&;8~s&_=qLR z=vy^Ew+0?lT`8_5y73bCjZ{*^;4a~4O0?|HN8%~l ze76#S4p})_?Yh>>2*N-DAKrK(;B>+R&pvc(ICUSGA@J}(o{!rx1zjkBlD~#9YF6f` zEhW{n5}UXHb{GZ(Fv=aH{0IZT138VOWA&^RF)!{hDoEY{iU6R=23PpK&-mJ&1ThPI z0WlLayQks_BN^5e&+hiil(EGo9Kk}wPB3)n7Ki`Ud;#E6dm?~q6kJn~0`p4;C|C?8 zo827ZO@IlO5EIkxKIcQcNkBkAljE)kMj(g}0xCa?0?PVD=RD0V5A1U^%}V(b~--3xARErJOFA3#9~n@^f;A!Afy#MniJLF8)c}o&6C#a z(TI310Qupn-xq%K6zDweK>FZ!O1d1&0Ky8F;I1*C2f?He*NG}Mc!v(#^$sAZ!2k&N zr5)nh9o%qb@qfIAB(0LtNm$@VP5}S}p!fxiK{k~2<754NIU?{V@I`V&1_!T_mIwm_*|o4p zFZ4utvS72=cVU%cE#Osz6m!0@)A^ID9!1*urk!1hq{d#?l2TNK!^L5dZIArr7`fkvSLGC4u3dR392{nX9G;fxyPj zv9(Kg>7-XHzKbg+T;X{N%np`L5W8<1jkr#-?`iP8lM!rNF2rjY@bB91fc6LJp{ef5%9gQ7E}{!4KN7zp_Z*0#I1oD}BL z3TYrQTd^sIyHubql#4Bin~tFDYsbGA8EPdSeBaK|GPdRmNT)XXP_n1pl8KR~_g$Wz z`j(vhEmxmbG-g{Xf``TA#cGU?*M>>xEpn0Iz0LG19!7Rb_8iCA?_1V1P-!d(q|nFx z!ymhwulSm_KwtYMTL`@*7REPxlE{Bq@Jlr^BCvP9LbY7+hk+*xd;_1kJ=ND&S~i-V zk6XOAnb+)15bEKnY`YaO0KL>p`%Rpr+t%@isM*em1V}yHQIlJ0!pa_+mAj~|)hQXU zj{vflx`6;9^sD*q-eYlrmJ?mxI^blON#-&HZM8$b3@K%e@vk2S%wCzup)6xcbKi<~Bcyh}ZqV!Z|Jx0kRSzn&NQV zzng6)Pb^5R{Mi(K!3Qyu29kbBdckh1isMiE6Xpp29tz!-n4K@!DNWathVm+&i^ZHv z(74<6MC(Fttt^OqK37xt=2B`}$opx*C^%it@0NKM&gzMhKQD<6>m!>DEqsbtc6vXf z)4_$$;@Mo3#AuTQTN1{>nW6|w*X4#gXgM)m&rq%>E(GPz^rO+V0itr)u zRGHm4v%N}E3`5ghu`Z9){IAHi56(U62Q)0ecdua?2daqPw>ZNr**Z7B3smABLmA_dPV)(p7^6b4fdgh(k zAr!)&?2=yNt@&=9-|6wGR6-3E1#xiPBDc7;ziEHQMIdQ%>FF*a#E5^U#rDXIH!Dsm zb8ggTYa8L&eGDCv(OdiTT+oLLs#Dc~lQKJgAC_v@lFS3=dtEvPwQ7sDH2yZWa1qd= znJa*{w(WI|;m1U`HXto_6__uNihbYO&0Z@ z{n#$>u4(a7bOk8B7?B8RRBsU=)lzUSD$#s28jMNAkBfp@A>H3bje6>qLUOvwdHtcRO^vyYklV~XDXRms3l9v+_cxC?)CD+0IS!i4-pw9H}@@2 zjes)z-?|(kTE_u-ErS1b%dKN#f&qAAK@JRveKE%0nqor4b?87)u8$^{qJ)Kr?+Y=g zmR8|P621uI_wvg+x@+~6y=?Ig!srb5AN5gOo%S|xD7qvLvsa>S6zJm=;C1_Rqbm3t zP20zKcSr81HocoE{Ge3}Z!9k^As`S-I=Xe);)vH}S6z92rZ261lsJC#>Ug=%X+IuF zWs~yw`S_MR9jt)V8-xU?73G>InP`HbMKII*{@r%(Zyz`j94s~g2cZ*CKC!gkWQk$uev%b2DJ!5%yVjEP!ezj3{PxZL8yMfdmPerou>|h#D5R-MG9x0~JoDi((;&l>S zc>PThdU+zlU2AYy_$Y?bjc^T?)N(wpqq8122Hs(ExYoZusUI>%pl$A)KW7#R0S0|) zUkg?Dq`Qf!#RLLjQ13i7Sn_6R^D#XqB)f`o@|2g7>IcAIkSkyTg$jOd_XYA~9xkqh zQ-TT&E9k%1GT8mW7lDQnI3+JP`eJ}XcOJ;j?vLA!*Vh9Oa73K2hwXevtA2allo%vx zuT#4N`fsa%z-P^wR5cC$D(*bGu^d53dw!96fZ^Bh}OV%b*YC16wU z*hd4wR&ZviyF1G5lR$1eq%>tP% zA*+N3ote$*^MC3X6udLC^)M|Z^=dsRRTZdJiv^cS;yt4X#(%#QV_t!1vX?If{-%Rj zI>0Lb%Z>#-4}V{_YYMP8l3hH9xN#cicpGdL)-_X3-+LfUg^psS>pkfq)NVQM)C=SO z?KTrzcD77;(7(TE$^^(A-fR5XjZ2|6!KM!m6%G^8B6x{?uOQ_!xA@z&i&a3opqz;c<+b7x)-@4C+5EfHEN zKIch!jG7FL`8W zl7qt;4AVgp9uSuJ148p_EUYYGjK!4(j{*c(UVj_*8Qs6QK|v%N1d^v0?Uh!*Tn*AW zoSdA%2~Sm3)!7+WOcAVH03Sf);!@Xpe}xShc^v?9x81UBRhy3br&7%eP_B_heuCfl ztO$M+5Nw+OB#Wvl4q2dyrU)XLD8>sjv+cf^WsBw3$JaOb)uMYG+iazINeqM8Di#&V z`G1yRw$1)6Deh>P(nFi76un1BS6ySLwP+DmVspb(A8Y&7kA2#L4nIsS#4xmZA4{DN z%_pU#y)#Sx@;k5WzMgM%3Yp{Dx=ogQJ-g<$mbu0DIa2&t`tlc!O%_J6tK{Tyt zEo(n}XP|<+M>iYj(SSe#DtMsKg!R>6bbGwy1ilfViONx;>w3pG0@qGd)ghpEcA~}^ zsfVnuOt(`=->PrP=d)mY$}XlHo(e}5Ght8F{VrCA%-I&p;}%mmgVM!gMif#`LjvBu z(W;Q>LjT~_S-T0#u&cp}mhjorT{H8Z$n2#iJ zr3b6UAsk5@$|zRS-znMB&yqSz1+y$=X1Gr)FoD|)Rp%%xR1EUVXU;Rt?Z5qRFD=`A zL*<|8t*`e$yu{JXuh-u&-^J-l+xc+PoXV<0^$o?9G5P>JBr1XX=UV&XUMD({I^;?M-dTVRcmg7pexXj4b)FpVnmk^Pt=dbvg z5=I3ww`*b{_npQfgAG1I#|H~O)>h+Ya0f{xbku>;^VhqGWeIirugDr1=Ebir4jMVq zG3>2J{3Egd`q-^@c#^rV-_))~^dA194&3k*>^q7mrpSk&GbQibxHQ)-CW>n{|S{^ldL_RIhzy-HryxXg*Bw!%hIP)}9 zJcfo2Ei9A774_d0@ewl1+6WS+8%X<3@aMGy-lAH6IPqP{2k z>=pGhAM0^frxkDR1el7f)rO-&#KKlB<<+tAaHcRs&U}38WQ)`&rc(+_OXY5#QX~0; zhZd6^&KEVpI^3;ldecl`&8gm*uXu(S(lHqN; z&kkga;B9BUR(7Bt^tW|j;7cfHN1{#C0&1nd^g#<119fqMI}X=FQT8cbKQKhT(QOX~ zKgPm@MZY4;+1UG9*Tngzg|3E=g`b<7spz*z;Yf*lfk(TvcIYcII>8nqc#Mnj%Iu)d z&B?CLF72VaY+sD%3Io@!DVEl{bx$`Fr?t5s5$-ZtPMY$6X5mYkA|DQ}+019Bm11J- z9dqtRB*{{#t-0)|F16e(?CsSGe!M<%*Fp6E9vk}?n2=!L?xF}e0SaKU#Yh{&HQSGg zp%!$%8IZ$99^oi1ib zZ{3@_iJ=7RO=Ho#c+1YLlP*~Qc6$rfUtTRIfww8=tV}c2y*9}^_WQcB*2Mvbi%+g~ zlbH7XiwlCrJu6f)N)K7>I)NDP@DDmZBjHpXNifKf+pm?XDuUfF@=zR3hhdC-7(YDl z%pD!_Q|atRJyHhL#S=6%>A5?)oeIhqkJO_)f0TEeR%<4|auwXVI}T5j*uI?p$~;j2 z1pPP|`KpDV2Rae6f%?${{$f_k(SePQH_u58?wcxou2Qbj0EE=`_q17&ja&YOYKcc{ z&5Z&sSzrze)M^^~l<7EexlHA~Lq+)Drc;rKVZW>EVS1C-OmIb#9=E+F2&FiBkbS!J zAwa&CM~m@jt~!2*j*N6DGmBkdBSBSx_l&lGgd&YtC;ml&v~%xGZqfyoZ?}3EsJBbc zOCgd~5Q;~>IlGgG2Pg6VC;W+Kvukv@*U`0iafmp+8}Y~ER$EX>agjd_-HIKh5J=`Z zS|0ceZj3geHWP`l3!UexOUqt!(Q`$59Jjy&J*vm;X2<>YaoIjXgIs=-=dHbs4RhKt zBEK6Ko`Aa}7H?h0dat&i1qu89Xkbuw4dm?3faU6_(aTpqisWp0@jdSjvHbf|!T!2O z!J@ce+{I1?Bs7qJNDQGYOS_yss#dAddI?#XaQbpGsX9gX|$o{i+c<8Xvi zh)!!g1u*yQr8u=Rs;h)~~QYI_P5 z>d~mutCV&^4QBphaVWf5`YsI_rFEWV6IGVL?8+X-lihLX=pbzg2idy!5sgxEQ{Sg1{K>yFTDu zJoS{=q2o*J=3W?mzAjfNPeM^6|3Q~S-hTx*Y{+^JraXB1#|q@OxJ6>0vF+be+2Y1i zgsV_zK@g$ut6-U;CB?82Q-B!J9`@f%W)(gZGo-uLZRV93N1|pV1VgLvyR_&hfc z_vczxrCb#mWk|~G=Pmq1CF;BFi$mPhK8vQkFcbR3!%kV(u)Z&=v|5ykw3O@+j3o<> zpPHetp}5k<_OIX|e3k~91tb zSV@S@lUC)n*kUkb)t?wu|A@g_)>e{64~WLLCu$Pohm>q^hb2;kYtS3eLi|1?GpQZ* zxcs2UR{F~JhN)PH79#RZqcnOVWz1?5-Viy#Fi7g|+NK_L;=>iIP0J2J8*QJ@a z1Sw~0-C+P0^7idp5SXEnKOcxun0=y&F7iw5*n_svd?JrRJRJK487HUN?{A#;_V#-V zb));2fcPC676zCSx{ZzV1@h%Ypa$gvRF5`5c6%8BBlP`KPFc&9`|(l>ys&FL z-tFrbnZ?C`R(>cE`4%%oR4Uj0WF_JLazEJP^}m8KQya6Ww7Qd2Ay)M8Amdj+L|Wi? zAY257F%?x+Ek-rS3fGZlsl%5fQ+#nsEOYiGa1yf{%}6+*75#U#m-owM_qxpR-OX=K z8h+Z`TifFF88#z%wvg$46YSa4T(!GmmP+dzu6x|f?&Pv#hEUhCb@|(7w?rLJTs$>d zx5DKYmM`Mh{s;P=No9}i>inMY*CcYTcKX3#73cm(4NTIq4a2`_Q;9a@nRd$=J-}@0 z=TH3Xv714T-1>%wTFdFBfdS+Zw7@iYt`WvNmOAB=6^c3%-ov4pR(?+E1CmV$M8WQI z`?yv2xYDt^>7L_f$f4Gr;K}+#%N8;@4&>x6G|S&#iov%Nz_1n-hxbDVxG}plQB9~` z#^pyP$0(tEF8MRUQo?#B^et7LU!6Ay5p?8+`{_B7xRDT9>;DKV@-mEcnK@r%?9TDiBAhMFQBJsItz4i;9<0zO{>oc(%d~dzPL7Y#YQEk5;G=; ztjMT-_`pN1Oz7ZHNSoL*HaQ{7fK{K9>d;%td%$rrKlza$v^rAD(!4=4$JtTo9i+MR zoxX(mTb%ju7_z8f9S1wa*w z)Jn>Y5JYx54AM0(($VN(k*}6Yg4@`}_&omPSwQ}9R~qbQEk-z(y86Z9-x9jqf7qTv zBUy0o&-9PBHVPoue{81Y0<jEr|KTAF2U0lq?<9ujTs7%oX?R(reJ$5XxlMF;6$a|yq^HfM7$qARwe z7;9ibxUWlffAK}}dwOzHn3}TS!sKMPVvi{Ft)Rz|84W{Ts92w==G-M$_d>M*@ zKPVy$HEHbP65wKRW@&Z_Te8H#sn{HBtZ;3U?-RVmdP`v8Ia0Qov+Q8;g3ll0-=WCe zQNz`;JC6@P z9v6itwO$&LqoIFi2iYFM{uSFMzq|Bzq_=mz=^2xE*6+3Y5H%V)Y2c_);E4OE4|fIx z3e#@|Q*Jr-ToQEO6@1`mxIf3g9Ez>#mj0-+tvL{hJD#PQ>FX6tmZ13 z=s4)G7LPFX^r7a}Qj*~F&sxKFLW-sl1A)Cwt1`X{$Cals!So#lux`V)Yqk&0&C%0} zZ>+2s-#QIk38;}w_gFuEsH=vDfxZmIf%qc&cf(FUe?1}n`KsFv!b+n)T{vFE%lWjm zOp|3`dv0?mz;kxqV=|u_%$;&)e_8Rn)0@7BgO?CWWr|zM`Tc~^H*p&k_9BI&b?iw{ zXDe!Vx?OYl72ilB=k8X9E5T*&rssK_r$ZeiH@)TNc{Xy^5IZavWoX6Cca#nJ9`sE2 z!Ubb4W1eY;nQJ*NVr|}TEX}Du{YloUb#7G3b90#C`|&9pK5Vq=73jGK?tRUrp}({0 zA7VBW7Rim(m@6525@_5S<8UIo+X*V_ed4O;et*fjluvds*y#+KmQ|6jKldN4eUKOs z7VjD|7Ohf{FDydD`JVjMK#o15abTM8OeE00c4SM zX0RP~?_V$FB@#QH`hC78Y+t47C!I;;?s#yqEV^v|8;Zvn#Uf?mdr*W%4~r*n zXQOvh;YqV}ZL~3&Z$!Q+WmZINzE5&A9k|?eAv)BlD{K5_seJ?2F1$1x}0IQVl;%ZC=qD zex)y7eUh0nNvI^vI!ctI9q-g$%4}7l$_&)rV~eLj5o?*8Tha^(J0n%0S=HbT9G#dR z)vPQ|*at{G1*-OKjN?2!iZ_N!1)TpDXUHk5zBuF>o*T5p24^h7{g;~s zrieTehdp^iw0Q;rD%79Hj%V5@*q|8JDUHDomivRbp`pAvQm6>i)Yil@EiCdc! zKqvqAcaFT2uX9IUo((#@yQzT>cA!OKw_)F(Kc8e}CwBql&IC6M z9`ckNAYrwr2+X5JMMc@!MhXhw0SKe&q{H3Cqs1dQ!7nQZ>kV9IG81lSjq3a}yL6B7>h_JAToi$Z%Xp@=oh&vkm$yvi}*{}q?~=-~JMqxhz9XRFY^`AWykEGH}b zA$bU$L!FMS)4J{uTkKi?$JW##|3U3H((g^;-w@svFi$`6zq4{`D-}+J%YlHpo6-`&ZfBodl?Z8>9CE)k~?LBaVKT!fcos_h6 z0AaTJQ91&p1&*~j_v3tB<6oD0x2aPz!Sw1oS1lXV=knFS?e0jwmgVJlC5eX!le-da zZXSE3QV5%E>EkJxO0!2LvuwSNciR}rg>6e5~{Jx z9k0(qqOAYj0F^qRi2|7kip&XNqM#u42OemVKLOPlH^8r4OWNY2_Opre{dL1 zP@lI-J;ST$&2n|pkJH5>^HFp+FAB6|F&6ZRMm871og^oXHR`R?@{*> zS_wyRc@&=LN4Via>H7QkFC`UKP;fA~KJeZGIv!Aj(8l%m)-gn--Vz~>V#mZf&kke@ z2pkFT%m$iKi=hAh!miik9I@^8)gWBlNKz8mbKTlEcPQ!aFVeTdQ%-Ihq=YwjHug*x znodVzkpd3SO6_d(iCr~$0bPkW^R-&>QBi+Wx%U-=wtdP|8IlkqIHMso=m3`#jzx(Q zv*|B{eQ~L8pGws%ZIov3WoD|Ma7ak~>AWxhh$UcWAv`Lv%TE9O3%s7ddt0HQqoNY~ z^XHAmwdu#_JfsFKYGodtdPQH|Zy5hJ(>+#TZ3WKNcPL_trd6}Xto(-88h(?Qhn7%u z^NpMwi0|7cQ|r(%T7`=?n+QbFoXg|u*}S@sH-#612_stRN9UC{nZ3CR*e9^7@DSgX z1i__;v)*Z+A9c{huS9}GBUR;m-Fyo!6vbJS3((%caqLwmpJ9Sa(k%43~$Z8g!n{qgbDK;`7*Bv{0NK^|D~YF9V;MwGDu9a@92wyJ94 z3p)_Rf&RXulap$JN-gu`f0F=yJ-!i#w=UVQ{P_BRs)p97DbEd0v?foFjOf9(#~(lK zI(|otTM8 z_&iCN{<|Otop9NPNl6&PHO;5lLwRLAhItf)Xn|A&Xt1`GRe@EVh6W^5RsvBAbFY>vu>8gtQXf<1)FbZ0YXhm0yb>-$UmOa+@cQ#i}L(j!~_Bpy_YJkc;#m zLF8{46byp^06NbPvT6Kj?sT9Pm+aDmUB$P5NtRw6s}nP=MuS_AG+cujXW1bft%6|l zBggYQ)=!-ZpKrYOcJ%2t(6vi2z@Hx?o{jm!4fdo08 z{>$C))inZqlO&|w)8LS%&5R%@zGQCZ4B3b&v?)om`&Hm}@(};kEix-+cdzG|TmMn= zd>(DmWZWVC*p~>&`lpYbRpAZ_>DMmINAv-qIr@TLMr+L3`Puyx#g8Y~xM(E^Q{ixg zf~ilkDOHOl(&M&Y?M?DsaJ_Dl&UYi0k0Uu5%pD?@ktq#F>*wNDmmYHp3i(`#e~;6z$^2Kr%d4UoJI1_82bX~ zXc4ljh7p)q`S>0{ zYX>kDTwQ0}$L8j4kHhf3=&N(kU5S{p4!njS9?X0=IW|QV&uUV@NY@=gf@QF)F{4F- zpv=xbe+kc|vXH>L9FopzXR|1HfB73ecU&PY#@znI9(eJKV&l0iAP~n7TWjQd!%;L! z+?sOCM3bgw31lDjh5-S-5f2zf4bwzKpz#s{qn+geCxHN~?r}oLnS(jBiT!cCOtV)$^nI z*GQ{{(_=U_~n^D0tgDcJa(F8mV#N zOyPX=R$1Rd?#^@EvZ?Yf`uu9N2CBb=@v)}mlJ%=;x#HWKE*8V$B`tB+KguasjzON+ zR7GYN)@wQU)~kP1gB>FLbsjVtl@a}cZyJMu0MJ6XBV#^M0*9`}MBdO4-fuk3o+m9w zjv>gnN9;S8mA;>9S7D93O}~CVZ+HD1+WKHQrJ}Ar|C9)xhS*rgsC+h9=m$a>#)U6` zVWk*<^le5rp@ddmYM!3|$6}P70F2t%S+|vTKVWHf6(I{eq($#Z@_7<+OrzfDM!VeG zGd$cnce5eJmEpWqe_GO+O z=V@O0_EG%h(CHD9$M_Q09beeMZR4fOM+%CY^tRiLm1Aw@y~P%GbRq?aYfN9myfloJ zX8%`B=uxARLKmF{f5wdaAA0OikktwJt^hPpG+C%X>wb0chM4&2#nt-k0D^#yz?3lu z^YhBIX{NQ6kpl?m_<~I9PYUR$;Pu3of#HW&bnrNjayZ!_(WZ9g^W3TAc-Y<;lpH0o ztzE-C?xQ=xpHPM&`ADeT9mzPkMa0xxBVTN@e{9f6$Sb4D^p-b01qWHizHue}ezwc%|w z=3hEot;4%DI+SidSs{pq>~Q8~_nR=l{la2v-r{MqFnFn&>?qiTLH!}^i|44|DD-ec z@p>2p)n4i$8gEax@H#>N2M zyLMR(JY&?B4f_ch-BO$qjkY7dzq!K*3!{o;y&RrRgHfux^TPAI?YL0)q%SOSxn&Cx zjZR2VS5Od|s8*qu1?)yCsZLX?z%&KkP_RqBca3uTmf9sPXnk0g#$&0!T+?z$o4Iwe ztzTf;Jnhh1B;8}y{2I|pb*r^T@EgtXn`4-GG!hcs*JU<{kh`pzqU~W@n36IkZFjA$ z$!hDi>0q&07>I^F^YQG}VH)<@qexDrk_pS#wjz|SN&b27yGs#x1xmv|GwO|^TtauP zab`DLM7%W@im*RROSSCATD05rR!dnSk8yGOIUfk-%L1f3$D@1(ncpk5Yx3OTo=#<}SpL6031f8AE`HBmu)-=F{8Hfp-iNN|4|(oWMP zbXartY1$Ab z*hc1c)oW6Cv9`_M4E#_rT30u1U7~9jgN0-el)JfP!LOPu38dsZtG(X!)t8Tfs=N4z)RKV(De^5wOThh16G5BlT$YV zgg^UD5Qd?4Kr0Xu137VX^TOwMGt>(Ji^EajXN{7kR^;U1aDH-vh=^ETS67yc&gkv7 znIP@C1x=o|^zZE+(Z9c(OrKbC{%Zw&@A>%ioT7eXxlMrA!c3gYH9&XO{S(A1R}vb&Si!|u+*O9?@I4x=d3g^}f! zZMfVvpNHF3d?$|}l)-}gX}S3W0qbWMWDeA*$MS1r?}b~X}I(=0sn@A4MX+uELUBx5ez zy?_P8(eVOMpEcq^RS&q>&f+V@__phPktLXbk+rvH5g|SS78r2P-8?)5Q;D|mDjx#$ zpPvGSfF9rGNjZOF(X97XvE~}#>DfI4%@WVm9}UmbX_f@5x%9rG6#RP2*SNA1|IvkJ z(w=7MM|yuK$^h5RWKk3`H~9}K%d#VQ$V?kFT`!+d&;a)8R%}E~8~~@@zkd%_FtBU? zM`52ylKGMZwiZAtx)Rj{JkVTF<7>n-fsKHf8H6K+9$o^(;g26bKml7zd=@oq{cr~# zrY*BL>+=VFpwZL%ASZKBxizKM=I=uQQIgMP$i#iF?6YFNZE;U8&C2H06(qxPoQIuV zpG}L5lc_c7dY9)938X#KOSDQLGx!1*v?y+N*k!Zz4jboe4iEJAw4TG9%(>~PZwZsB zZFZ9#x$g!WoNS1wBea{hhU5?k?|0N9n%E8ddJxTOx}a1&MGS2^6&az@Tn*ZP57%?q zJZ}4rmVZRW_jk^@*ez&TH7L%jVt4CClw8|OOb*?RsJPxn$u?C!Glp9UeRNy%V~?N? zNBHwi{xc2?k;g3r!gc-S&D5rSVFwaKEr2dVLS^058M3m|&B~8Zi-xKO>#I#cM>nOZ ziMBGe*q$h}N+DkNm);z55}qR~_F-hNr42Alzcdx+(j9-SZg^%SqQuIaRu9 z2tYtF#qZ~ncD?f_T{!o}9H?*pS<;o{ZA3*{9y`ZxI2!wg;{F54RiAu-II&)n>yb;J zQb~BLrR59Rd95#qWWaWY+o-ktK@8K7Be|fr+)ld>G0N>Le;_e=HegWjdtChnLkBtf zWYAIonIRwmft|oQDh67*%M8+3C@V{zGnEQ-baesn?1eC3Jr4{H8sq0FW{ZPP8HfY% z*g#)&+^YRCoceH8u-tUU3kP9!D(Yj_|Sms-Emkn5(6+q&V{KmB*zGk<3tWxI5 z6tQM>(%d8JD!$hY6Z#S9capuny0ZICyxf}WN?}ATnhcQomTJ#nyS@F1B%8P(@rL|v zlg1XV+X-$cM-1E_8te4YHlKNp?K>#1_K4hGv(--0QpA$|qu{8Oy8m`UV65S6is___*zMiY}@ok;c zkZY0)ZF_fjtXXVKF0zlDJ)&AKdC@$l#2gzUX#y`4Tyc(|lYD2=yE0^;cT}2|cb-Uv zI%oUV)-;r%&fgkMsp!XAe@Xip1cD3KouExStOld)NUEYi+eyHXF>brQHKGKUGmbLy zMLZ-dg5UMVR@TYsA1M5DMt*RxS~mFf*6N%g#ALrsKpz~AsToNgG+6x`x3349u9qb;XX%CBFc#*ha^G2*drQeuU+oLKbX2M99 z^E9%YHfA6(n2(n>bnPEYf5yU<&uUb;exzZ9D8Ji~8@TvDWGUEenV!_u)bjH4)m2q7 zMTkFZAwnSYBS^04UE|i=i*9M9*zA?jJZa(jFw| z>ND$mA1!dtvopQzb#rwc)Gu!z7}z)9jEjk>a-S>&L-7V3G!W}mU@{O7LatmKTzc1E z^A9;=r^?lVl-Ym|(wII-1~|%suwKyHvbxVHfqFVQT?QfJ0SY@fuw`dc$W8#rSwvVE zh~mSKZ2gE1>Vh2r2o&q?hVkp*x;$h#m6d0}UkO$W+^}4~HlKlCzdTeodBRS- zWQO*PHc7MWN)~8>Uw*b|s7JUap600}6dOBYZmq?IB_T-%9ns%CJ>%?52?NRO=2%2T zk5QTY;Tl>onD=(U90Sb+b*R^$i{HXz>^S%w()NFA!q)Hq@>i+gz-F?L6cOZF0TTV& z-Zv3FCnqN~Q!@aF2YS3_GU-o<*1(e#xo!oMi)-S!HF~XGhcdDA+yBjF`by?+qPGI( zt5M5o_?2sAK~SfrB|Lfq#fdAy#t6bW&QVns>)3yfz?t zy&kll9v(dBmD8F)?ZyuMu;(;s8c7~5TA*ZUOujmN_2$PX;~Fg%-Nuc>!^7iamV^O7 z#OJi0y8skb{t|D8Up61Ie$!B<2sre}6H_?5fc%{si9hMa#zu;O7Y`lx?C@}@ zSQzdQ1-T0Sq^`aU%(pL)`R8}pf9=w2E}>;Tzx?13#@W3#`*F076V*zzx_f#+1u;*k z0>n5maCGuKZtr%lnEDS@Y!f7M_(ldc&;9{b@$f{x>6JwRT>N6wbqiWmuOCKd5~t0xCZ#l7-CP2t0M)c*8cgx`f>^EW*!IJ;5}qIp*rmloX4hYNE3Nh#}X#Y^Pr z<*PXQ5b32`rerlrvErvJ_084PVDycm`AW;BnJKbHu%Z{R)9LNG!Gw|qI^^av*xq+ddyC|;WbJBbDz zEI4Tkr>3v(wM(DvNZch-TsaxmOWKm5z49rr5G&c!V`ZL^mfwHygTMZ8Xq_MJxZ z`P0iX>EbF7)32)~3fRj46bxzSpfUugQeoka#qn2Sm=3b<^9!cUrXqFQ-bP4D0pT`J zor$wxdbGuP%WE$HGW$Q$-ZHAnHhlZsfKnDEAT1)&DBUPZOLvzvNJ%$>N{e(0NOw0V zA=2HcfOJUro|EVQ&RX-%tTi8I_Ij3I(EWoJ zu)0zDIVgeDGBT8ul3EtNxpItW-{{UHGYtB^o!R>8Nh@?jrs8CtNRv^kvg$EDr7Z)lHfDo+N!0Vi+k8RD@5Hw98!>Q6x9hHmcb zhQIu-s!tvx)DKTPO~b!!SZVajC%LRGtXbXi$voMODX#k2okdyr`pVe6!{1qNo$c6u z`Z9j}iz3^Quv2ZB)kuzYymOOX%b$OxmmhAsRA#CREmh0qjTNdla%QblP?oKczHj>| zm%1O^Z@OauT88p`oXT@8{;7D{V@vFcIG^ehKck zQW6D`viA1$3mlqHCq1@ye>;rwd2b2L68Y=h`nk2L!OpN4-&q-m=;4-Gy+4+EXjh$S=z9@R6BEr{+#Pcng?2*C*h$+Gk@f+s^+5fTBuH{cI6a3(jVVUrv3+Cd*;vfIgshD8bl7-SR#r^4#wOa^Gd<6b z0Qw12hW|ziNCl&+kB|JQczAg$%?8uK`~Y5o{{}>0NP<+?O9*buiKhKtN59tn_dR2F zcq|#e)5-2{{Ooe-tlLdIZ#F6L5plucjVo&263bQTHF6nk0PQ=68ZQ(JnG}aH71AA&Wk(_-Kg1W>(>a5$!vnDt*f?^4>QEO*O;`hb5fv zeWprv>(8>%Hw_VpmVGvNeqE#Q{rGc6R%j$Ac`#idLEMTn34Y2-a8NLis^XH9VY?y6#Z}OH=C^VR-8rRfIcQ?=^YMxKf8;hF zxUL$(&Ps?tP|5@Y49dvXb5in;0n}(GYGh}Eu8bd)UEc6eA1Z94>EDKC(vVc z_%U^nxcXU_#RgedUZ7TN9nxjwE*ySnf4o3H9oBq*o$TxnBfIR~JKuzytY-=&JC2y! zy+Q_WfA_5n%6>hrBr#BOe}k+k>CkJ($r6aqXwze_eHH^ich%&8Cz6d&!^~)*lg0j zb#z638rW^l+oY#LeH3|^f?V+nH*_j^@G3B+R9cu%XQuXvF*CA4Es3pM6#g zD^taainzJZDxU90*PBkbWTI+Z@!oNFql7!wv9_U*a_6JWR>@o4YV@5%bkE2dLl>XneO|(-T@Vxv*Ak?q}t2bG&j#6AAV@ zciE$;LVlcY*l5Vp8X?)@Cmm~={fSF;_I~%b+8K+EPDR999B^Db z&S+Vh+x{SIa*wj2qM-jtDr^@C*@6J$O*LW&Elel_U7PESMS#lc1mqJ~u=B0NSplT8*4*AfDb+h0vTzHn&_ zZ7rK)>Fb)BXZ53kv-Ho74&Wusm~l+CboAyDUTKt1s^S1vlr5f#jSW)OVqnV-H>Zel zkLlQ2bhE$>+jt>YOAg7*g{qcMiLIWbK~%?$v@!9Y_#%KthVyOmkYeruia6Ui?PX@N z<=w|M{lZN-9|gaEo@D>S%F3_&GU_w(ylEdRTlObSL!E6ROXD ztTf7c-9dg|8A7!C8xp-W>qphtCYErT5Y_ZoSCbT#()ZB?wpt)U{ z-n_BbR8-T`RqmLC_+%F36{pF-&uYCkRUIle+fmNtUUxdX63rn4PcEm`fi&2g$T~`y zEICMEyX)%icH~Qj_(W#rQ8Nx`om6qsl9Q8L_qJ9#7Et>?ShfKnwu=i4{oqlxF{2Bm z*v11xWu9*wuZ#bsw&n9ON< zUp47dYUvd>zjvgW)sbLbs?$7kX1H&|*;>`(S{}JG&n>Q+k#^V?utj?B{GIoFvEF_) zQM>1AZPCBcOtiWKGc(>X3%&L-*&uf&3hDeAzSlZzRpLtcpjXe0d!Fos@ zM-f9<`iKSf`}4PjVdiNg`V4d!y9mTrpU8Yx%Q%=z~I*#HIEs8R>H(51AUWKp|Cn4Hkc z_WDaD?TB$SXC4sy`g(!%W>ChHKB(*Q#Oc}M+ z-#T|!+fXlkMH?GTPn85ojkxhu7b8E<1p6A4<+YHa>oA z?&0anN&1eH_HG+?wDv3f6w@UstUFZdxA_`>NSR@OqWVNYQaQxM7^y!xx+)XZqs!cU zTJnWkWqcQ}QiLV_rh`hfFFv>uvmBKrtyoLPqBaV+Z)s-P)s?^Y!Rgc1v8I+PYz#r6 zRu3KJV=M%xJO|=;A#Fwkz9k16$#eZ)F`du|e935wO24=eRUF1BJQAN0^kfa3PUT~% zmyS}RqU}Yg-a^3ahnRumW9Q>t`Co6U=tJ&HWkQ@-@GG`jZ3v6}c1?7T?Y73)YW}-e zQBe^I#&JQ1tcG-vLe*go>!-xvY$k-Wcb-wU>>V_;f3zp3P74#^8&#}qafi3E3d})2 zm!6W(qH|J!Az1z3CPF<%(CuIqXh7DDig49f^_o16KNb@(<4JxqTu)`5ClKX{F)k!a z+m5@HGQcsLqwokuO(`p(Vn%Q@n69=7kM&1l#u!^GSwfWPvDArOPuc+t=6qX3QGdx%f6e51;FYwAz z`B!R&LL>XlAN80O*Wl5vvd!LqcU6Pixl)D=EB6F!+>cDPTz(wMX_2N_I~h&8nE*Di zcs#N9FNpG{3+_WwY>Xuwst81}{PeZj!qVxc+ur+8J*^^p6ul>)r>pyxgQT&saaLQ$ z^#$}q;3ungAr|`!fW~VS9`(@mH+HSF;XW!G=KC$haW4!9y5PhSn8B!ml_7@pG!-`U zbG^M_Ot-$K^p`>B0u*6wZLg+B=)-Lfhb$`Lb6!8GHef{U27Y0?waOJNQ3c5Hg?xit zWkLc%!uy1(u=zy6rBjWGjec+kJy2OnDav}`ePL7mDWyK?UpY*~OcHB1A&*saqw7cn zX>n^Jp+db#GovA~0~|q*bu7UMd`)FZov!ADB?Q)osRlh#+8A$XQO;QlfW8>))>m(1m+l zx45{dh=rM%nUS>^6fFSbXJ#(U%d6w%94kZ~zfc?`M;ee4S-4v)uCC^Qen=`)v(O19 zf7R9F5bzNy2J!*rJS|GrDOv1~D znd|&9`=f6;CJXgp_0!=uLjW;?Cx*hMU|;ZZfvaddVYwuAL>;d?{gO8&F>P?^SDtAL zPR2J4FTTgWZp zkv7f2y)oB2sg-Z%kyD_p)$eBY<8oQ;x^=2%HHd8cw+QKmfRg_rm3eRISeoja&UDoy z@z56CpE+F93U9x3zJXq?`@eRgjEoF;idxn`gRv*P%4b_3dSzN$43gE%I6!p>0eghO zP)a~9^j6>DU-I(Tv>VqY&8xO8%HK0dzcjLP8Hr@A*2GYr_x$-ax6={dap7erX(N2+ z4&q5RuQR6&oi^u0-QwZj9k=3M-6Ovx-!bA0A3~+dCbG%dq`2t=V)MF9_6_$zMq2KF zHM|mQGuq*IN3|GKk1BQM<@z1Bt418QGjBP(XKsFNOKk1^8Yw!xzNt6AcDC*-+nnir zE>h@8m4Ghwx;42{qA%u!=lncn?7YX-59^(GcN!Ghb>kj9ecIXSRqQx0*lglxtDuN5 z{afQaWSy@)sm7d%vd~r^CKz+x=zMySBu1Sp#dveU0^2L@5C7=7)M-cP_R&?vE9zP` z?nl&^4ZGaa43>2X3D?@F^>z58Y;O-J@YB1pFbI_9MSQ;|!-E*DP?evDXJUFXchn+4 zyGSvAt3nf$&k%MR*+~r9&84{wna=yebl~C-@|E=TwIF{kU z({JaDvGAutzFoscaT1w864|y;VnluZ{P5O41Gf0Od$~s$RP5~j!Mu}IyGB2l z_8!me$SiY`1?YH#Ap4O9 zUkREz-eWLoFjPG*u$sk$QPp&%B@r>POZd#J-4XwgNh(XIMWe}U_LaQQa$y_fax~Vw z^Ql+=x0no)+OAv8@%2J`k>!HQhM#MAqoQL-d=R)_VqbCb32$pHYehN*J`f{2`h8l? zPJ+4{P2c?5=5o&&Js>08eOOmVTg5xv?%CrVq~Xt!)AQH%hC^H%mwnFl^KX+br$YjR zS^Pbm-kF=?5^TAyEK3U4^`056e4|Cw&fnQ8?G!NS>~FOfznxIJ{4PS%aJ07JsJH0x zqUM~cyR!GVyX|R|XKI*t@i3_qrPuuOhGeh6{c0|SnTvj|VCi@GTnD>0jP-8m6f!4e z2baUN&1J`-(&jOh&h_L{!gWWDkJj~eRxlq~!M~a@O+D^739w=fyOLW+s`FHJ}tN{vKp%`|xzH@7_HJPfPU1G4?@CmS!lCkW?@7JG{eMDarLz(Ho_1J0mGq_O)QY`+H>EWyy8V zU5(966rmFxG5Y3b#|NNX7I?3gqcoA6ZOibpu*}i$R{P}1DfyABeMy$qta1NR-&d1X zFm7?N^0BTrTjlkSH5;`8l2a#_gS|e(57AvSZvA=}Q)tvj^>HU;tX|;R@6h{0UX0Ff0`BQtDJ^j;kzCDe-TxgNX{33!eN(qa zujp%1a$~@^84sV1=D4$7R{`?~i2_w*s+<;G5cVA`ur2<;r?`xb?07FAvh12-5LdeR zv+?9lF#3Cg<*sPpd#cXH%}jDR-00s2MK+wM+#P@6)N0FOmKL_qMMzlDH#anRT-G^) zMxrWpzQF^kHt<}ywFljoGcUtBXfTc9e|j5sSa_Xyd*6;7l%7`?I$v3SBxkiHxL<6` zO+tgO)==fr7qo1S;Z0t>IqXy4Utlw)(=3CYAArhFLj3cErA_0zLY(j9-_^f7&}#bx z{9cJSiu}BmT{5U<7zlYy)rjnIK66CWEbVPUeSzI}EeCgw>S7n8t+29cLLJSg>-XR5 zJpVNy8H&*Vr)O%tV|rOA?($?ff8IkF89-|JQ`?Q-qweyfcLQflDE}SA?wGG|F;BSG z6#HJJP?Lq0l);r3jTQZ;Q;W8*o-dt$I{&$AgHcMidZ-udcELHV!eO^?{5Vms(b)NO znKbFo1Fg@OFIq;q$q}z6W!t)jt8`y{*Z5&kF-k{fDuy$C*j}l`{ALMp8s&;<3gM?5t#O~UYRP7pDUmW{=ujsTjdZjGDs*YA^ z_+MojFKL`oZN*r7s;b_^9wC>IP>$(segF6h))5O5EO)j z4#|h}iM#eeg#2T-Y}V;9Y^~VOkK@LVIjX9iv9_Kbyt_Qb7w53mM?6<7J{K2mFS;{f zmOWO-Gr>)E{&8{qqfzxiIT|7rrCb*ahf>f>pm-xO?YW~%wT8-RAY1k4Qub-OubT^- z51FH!`gCH8pTsjVnI>&A?7d-?mltLkE zGwIa#acB>8ceB59>eIrQNbf}>yV2F8>%wkx-)Eu{mZov+^u-jN$4u&3^Uh^5^+%6N zqq_b2JDcRme(uec(gL=xm7M7j5)~;zcTkh81OdM%;2!0xt7cwL+md0d0m#dUQ&jLxk?dyE zmE&46jyENQg2PlKYyZ}~P#fXfbyMekG&aL*H(Z&O$q2TU1sL70AE*C4+A^Bn#V z=%22ONQPv)r9gc9S~A3I+DKprsp)xgZf#Xt2h;Y&vzz{I3Fu>CF$or>jhy7OpLEOE znJiz)eDS_%zN*)-v?qn#bfUzdioPA$bey(UIq&iQ{HEZ*U@&7i*a`QSB03I1BV1Ba z5*SGftfb4UX&VT%j*!Y^>XuD?mI2UCrtT@XjQP!07Q*1_x07Y=$8Vu5+W2C>ug1yA zDILRNJ(zw|RH0SRy%6H_xY{GOj6qRB%JsHQFyQKbn8tI=w3Q_5yAQS8YP`j8F-v6z zf7+9E+re2lJtq@lXLTziipN49aQgSSCq1Y1p)?-j-J_L3!hLu*v)8`mxk! zH`6Or#i&+@cjE;Uq4!?rlTJxVf1L7mKmME7;LbE8U&=~yQt}hoBw`Yhv*Jqyx}Y+_ zc{@8NCp#xD;@cn)sw(i8pnu>)@(u`fd_kOm`Uom{IA%3g1_8sLEBA-Ok%;w56gUk1OC6jjAEh@Pz zMsi?`O&DwpPuKI~t$N(DgVk=ZbCUN7xARK4a0;*IRE!b)cA;2hg;Il% z{tI{H#N;#tLwTJ1z<|rZ-SNbMtlEB*fs&GPM(IC4;8JNB2W`p6>)a%h-?=I1jaAQz~mMI>@?_0KwB=H!MCpy6<|HLC^Dy(I?l z`9!8S`?;%yjedsQCFlRcfdAiH7>L3C{h#<7TFSkUj$2Tm4P1`g$S2G8r{uZmSy?}O zdkX>Q;CqKuDpL_r64$$Y|9wukvh#5l%Bw8 zUG;8Fk%`0qs`%V@X-UuP>J&OPCglKNzp~WA>@EXCRDXZ*$}QG|t!biREcmC^nNUH* z9IX<4uV#r@Q~^6vgvsrzrW|#|#NXamn6nJ5tUJ>-&7q;8ThrA$K)$8eE#BMT&nVUf z;c|UUyoQpFju${ff0m=igyh=~VsRE~K+_8hxO&qnt?s&jMJi` zJedk|Vwvqgl4KWKo@<^sD1Tq56>b*-ac9a3Z`j6geSg>%KbQ3c0R=@$M1GUSYJXNUP6RnLyr#cI14Nh<4PuP(@zD5F*=aN9j<&7(Z6KvZOHn7WEptzXSgq zT4LNlVPF2iY6B?euBd7TMn-5KYK&PJyQVC=J_L&aEv*~!$`hi=Abt+cfsv8;DZ6l4 z!E52@Zc~({#dL9MWHA~`dM^`39er}vr3H)Ux6nE5qH$5Kyt-baI6H{iNG;DVx4smv z&|*JnbU+|((A^UEsXxz4sf*Ifs&KwV)+qR7qesqC2>E8#978?# z=Zn4N{?Rd!eYhuozWAH>zqN`{Y_S64YacIXVu|AovF+#CSbvh50JTnRhga#o$L4bR z6FKdkf%l?ooA!H)b`CNi8Qz6%g`(g2#V4M4H(&zcnz2c9 zu*mwnGxEvh)wvDa8t|Z>srd)3YQ3h5?p&p8av_hU{r+ZX%neVJUQd$^4O_lR;v<3Z zeQp(lz(H&Vf_;7>%>I1Yx3Fk00l6Q()`TW(GjO7`V|-a8b82l(>D((vcJFu%LtFx~ zBy@`7_nWImwfXmF$H?oPS*(cH(H7WWm`fD83I|8NJPdewevdNL1b;5*Ozi7}qJo+s zC9*yH`D60J$D!i=BxPor+~PhadOZR&Z@a_KSsW8*y14M;UT?UV|Ldld5c4>`ilabb z^BLIc2)azTDzmg-F_)Ruoxv?HF#gUze|%vbH2-_BSU1^rK?H-@Q-tR8Airw(TV`7A zwh?Y&ilVu)qh6EmoVyf)OWkW2f0|dxB;RGmdTSp~SK7xOPhE5>Rp<|?4FuYF^Dph< zJUy$j8MN-*Gw?z@WbL4o*8R8Nx%b<~AN`b{udVKecmVp00(M$PQ(_t^&t-B>{N%fd zX@0Kiw=9)0(eF-dxA>JXKIS3*%IJ)2jiJ4F_fLUz_xoU`kkZ|SN>j&E+X92RaB z^;i6wH*>-{(Lz2%$P*ysu~ixgnH#qvg(X5LmTfmyIwfyX`+V2wH+f!!#FC>+ldxea zL^%;x%t+6=ax-B-e6I~;o+neddZ8sBc!R2?m%DM$LcTmBdtSa*t@GbYlBwXb*ijn} zX{su{J@4vB`3k-BzB^RTBe{QgQRKFGaA9Vt)$DZ%X$fGS1v6)FJo|WWZ?FDG`F^+6%fxKWsufNmMXertup(Gyhgb@`C?Ug zZLL3`e@$AdP!W1`4Cy}X1hK@%VMipnpHOi^mPOG^Gcq)#lo0y4EKK7LGoiR2DrP!| zHC|lK=CqLJ2U!rCI``^4*~C+KkTF-tyibE&DOULHHJ{XC0Ral8iKnq^d{~Bg5N3n= z+QMeReLd~5^F+%u&-tr@a_aJsXtSiGO%=syPcj=i=4ZjsDXhf|$$T6w#*X1Hu_>6u zi8shxy%0U^=Hf+oasETDzNXU*QKEc5%J+SC@@>SY+`O+}?DqzwP%v$3wjA*1G?f(P z%`?rhG1DH~^8@hHdT{NXNksA%zSbQTKEVinUIyZYUQU(eWlqA}uE8G)jP-WKorw%x zj20neGD@iZjAXN9oc2X|6B3rn46xTN9JD`Ht&LP=2J#HNZS+P#((_LvgOaM&1hqVY zApy&6b1xa2jWzC46HD!P^;Fru91Qt6sdSFi8yzpys|F1nMpA2GS)TpAbK<`Je$%Om z3|J^&WT@+X8Cq6W7H~@#DsJvr&1DGf8nHO6o-aDz>s}^e)g=ggb$xKoI2M`%2u+cB}@pH6ikXIjvMi+OQ zQY%^p7h_boGBusU-C65I6hemP_UFjO%}aawTKl(ms_svQ>itpr9eh!k1~+E}M&E^3+5_ z8cpYB{^lIz!p6xDucV{yhH+o{MVONba)voK2|seS{r9eB(bTDENULjhba8BJy4LkV zhlc^|USo@t!#YY8L+#=k(;bKody`-d3)im|FO?495wp^tNJ&WOv^`UMJ&NJAe{*$l zbKa}|Ezr$C&{(a>jD~)jM8M@~>r(>J#^X6Za8(9@yK;1+xY>6_;5w}!cRKy=X5d*f zmp->gssT^T;`{ig1}*+r_!LLQCcSPe-+j@bn@8)-~(;o70NUc8F+p~Z(Cp476=wOTS(0>5AxOOc5VpZd3 znU$5*CJcoc85mxr*S~R_e(*}c`N5qwJ8gA!byz>paW18yymKUeiX2sa>^=UT?0?w7 zb@gBkhv@W-oSa`(R%Ogzi9>(F!2sIykQ*dE$_k@82Jp|nb8;H9s5C59r@?!C9fbQt ziz(&^YId7>T~ML@NPiM34JeRijdEIgdPye2@h&dc6r#Xap67?|YnibW!wk!qv+*IN z4btox!Uq=UqG^rr%|BMHV z!fBD-w_5>l2U8s;(`$Oj6Y=a}NIQc5q-?IT;x)hnkCO5pqRPj9T+79GB|wXWnm!?I zZJJ_gn1dO!Ww|?6M_U^(9T14C&ZG+=>#zVIpZ*_;u-oe^S2HZX-Cu=&Ib;?~gRbc+ z95#aeslt@__>W?{>4O*;7=l7W8#~^6w3JpTK8_W;OUCcvvh%e$+p+WXbhv$fJA}*P zO*MDT#FX-%KYvw31v7~Ybz>hk=vj!-HbKj@|<$))wqMeK{>IgS989q`08GgaiYOk)e?<+XU<+z z;dF!4DQK!*HHHG|Bo%Ha>>r|excDK^yO>e2;W*=&(HydTW^!5un?Nn@(fZ!eMSE%p zR_vTpN93MLxYs_ii>P)o_Z30!@=A`ljV7n5S*#nVH&$gE<};8VtgtY@)%8Z-aSWjSjGc45?dl60wISy3Urlk}ep#;q?y1zT_ z6EaR$^vI9vuD2Z*zvc0A7pHX0m_K`V%Wq=6VT7iyKJE8Gyp^WO%F;Yd%TB7%@7MPq zNAsa&;4LTDYElikoM8mqtdsO9{ME(2M*swxXQERBv}t!{2@o+YOEpWDj|r*#v@(9_ zQxfs|WIm-G+gz4rD~H@@CdKBz)-U5W9R?@w)7sv#oc;CET=fz;#9HDrq_Klc= z#q41wa8sCl{K^$EXOC!c5FHdx@5Yn~Bv}7YsOcK$!yc8H)bRNwd&Tqa%DFU!7h%=L zH@HlO(|el(kF|rtuFfLqQ!8hW-!76qe$CLGSdqxNT>Y4JCQfthV2LX|Ou zJC$2HCupc|*qQmVMttEg?}DN*sLLc#(X<#bUWNUG@QPLe}3E3)RN@+=#{gc^(My|m0Gb;v2KjY z%Le0-5Oo=sYF%>apC3j^FD;!o?;#LGLKY(n$&G(!iXU-o$&OggS3*x?w%#%HAm%+t z1h}VkW*^ng-n!mI@V0e0hUx`%E5B2b5-XX1SPMK75g3uu0LZ~ z4iiGwW_vDA`~$s-w{^6wh2qGp8md;>qSw#w=dDNIVP6w$-s)pW!$3wHMi?ya(y|4u z)w--uN~(Ay7wf{q;l{NTg$+Q<{^>dAA@gYn%n8E)cb|Vte>Hy39eN1*VX&StcmA1i zTd21bCY>lt(XW`RH^B*f#f|p4aOYNx@L6%rd}Sk&kaeSpJ8FH(lO6JxReGT0; zLt(2^jNgc_CHr?)Em&As-v_l)9_Eaf*hQ8s6ur#8R6$ehQ*V|&$D+KwkB%@l%P8@2 ztId6YNE)2r$djHo2z_hC$64t|ZCcIj%FDn;-Jo$U^H@16aCFV5bZnJR&b{2o$P{5V zF@%aHOhTlhcZcfM26Lfdu!d~S=|4Qz_W16brsHGP zJ!0eE?fB;(YPCaQ6DeQsrK&7c!HLC7*3$neS$v9GZW{am8f|3fUcI4@=~qvH;qr(dX6;g z?|HH#7lj49>4XO_O{Sku>g|j5dblU)?H(I>VnuXf53yX8*@@>i#w+Ub9~`DgAADtP zN*sH%JC?0O#u{mwgfyByL)GKOWi;|m^88k?KhrIIr^v=eu;S}rUe7pRMTHt;J5kl; zAI|;6T$#t|b)H224mA&NAmkMl%e*e#$|srd0&k@M#u!^14UF|5cNAL2LWkPGjjQ!7}=8t1x@!P>+}R<(Chb5>KG>Hu=U zhX@43Er5G4;Wh0G9B}j6+LpYgEq5fV-SYeOD@o$-_B{;ljnkigl^sFqD)Q4#zHB;k zHn+qfHTK`n?2oq&(%o-F`S>6pBxgE=9z@`P9ry{n;70=|uc|g?g>PgpBJX_%93u)G zT}La-mBJRi&eooQK1?+qZV=cnuiYv&4<4gRaIz>m9Cea+%gt5YDa}{CjWmm^;8gkW z;e(rt%K%5OT@pwF*-dU2x%dra*xlYfw6|qt!T|K!Qu{CMRJNkAIy7q9f>FH|j#8-ZKlG=!WkiPpSGQ0AJSD0B7`Cf#Bh*;&DJD zK*0$8hcliSD5|fkBDy7eS70O8J8n1up$(#PfWpB@5Cn${j2ky>$+E{cWN0IGi=lZ; z)}g^fSPFveU{UG_=uI(1Geocdl`x4hmZ1e6ojObt8XFp(CR6!e2MAs1DdtuHlFE9j zA{TN1BqgCHlyY;cv!=ZdfFhFh1QA$A4&?X-=JGsQ9hV<(v*7V6>YN!hWB z?Vm#U0tbQNPkjx}yH%lS9ZU!zcxEUFv5eA!g4fx@DypggFwr85=zL>QsmTxx;slVD zL;Q`Ysq^u&7f#-F2Msj9NjlmHDq&We(L5FKcNaIES)?|3F5C0Q+=IUTfKrA$ori}< z3E6-*d`_DO_c_gnXdw9!s`uii3pQ?UHR^~0z2>Hz9J8fg5f)^HAK+{A$8q~Y7X+%Y z&B5{&kkM^!ZWd`bHNXnK9*mF)GeleTrwF2F*uhbX$DQpz>g8%@E~tZ``ycnrNZH~L z9Env{a|QXiwT^fqnToFKOPz4+<#qTAHX?(-G)>?CBBtt6p&2Qpoj<;zW8o8(>R6>2NzI|+B6=H5kdI#+FD>h_fb@ewfysUpy;2OTUKn`~?th_o$G7N!z|Q+_ zb@#`67()0_Vfu%V3O9ib3Q=Oe+$HFJb?TE5Odmw;_Y}UI%v5g*G6Mg4gdp2yIQ;TR z-)|zr9IXNi$QvS%WyrtNFq|z%8Qi|tzLF~J^1K#Aay<#p7NP7%Y73L4T_2P%A07bk z@KgIA7M;2VUZ(=xV(;(5Fnwf;@6mr+pjo>IJ{^#6<(-!JrB*5~LcoA60||oJZfVX#jZWS_%c7Su>R7Gfpv@sS>Y7sPW;H_cV(N z*5pI~E3s=1B#30d4Rmm+XU>)Q^5x4XvI*am8I-<6ju&V|#>5;U`)yeXgPpDBbyYNY z-Fk?%>#_d}2|TdvF>xs0-Gy#&eSLk$&$a^HMm|uY7pFulByUD{9{AODpuoAK$!jbQCs~Xh%+vEp6 z*C=%V6h&A z{}X%ozcLX2TlD`E!UI3@-O~d7#V-i&=g_OO2 zg_{I_RKSl;z(K^FG=!77S-k4+55?YAI?#Ld zR{MgEDH!=W?8R!W_#)ANAN_y-wEftyoUbD3aFlkb8i{GBKL^omYFtGf;n||9^XwI8 zI1-b5qYnD1OTT(*{1>ys2mq_X&wJ$4-YQCo;QpR_5rBBvTE9gmyuKasV3{5d6BAj5 zW`>Q1?dH|WcM~z->@c_OLjGyn^DF+>P^Sb<(hxFgv6Rz0x{15)-|8`ye*QNWP>-hiu=jC-?p?o3^nn8-*@Ieh~f&3Uj z&mJ^oF@o<7szwU_I5WqqwQAOcbw&N9vFz072p=4}XZBd4gty#x91?saUU9zra>5^^ zks^;kkD2I>H@7C^8;LZEp!TOo1tPRl+el3gaRMr~4}ykJ%OOwQetw#v*8lAmW8_>7 z3VX@7=xPrIXVa`cE^+u?koQI1iVoK|d$5nH62rV5_b(RwX`A*cFK0E~jDQp@=oB0t z<850LQi=Us>7J(Etfnza!}OqmfwL*D&c|t05bGmx*v0=MRrXH*b$#^uW&Y<}+|2pz zAs)MW5TrvcS%sNj6pNO+(&7ldP8LP*l-U%>9U~s=bfjKhzdbXmuV?ProTbBa5#a&P zz~?|LzGRWzakBkB^b%9hAPM2gy|NuV>bv>F5Zf1B_6z=^$INK@%EAUL3Zy8nidD8_ z?RZxq5>LqmZ~KuJ_jkb=r4IogaNIP7_!O@u2iX>TSA>q6vJ=MJ&2^tVsXgIc;}3?} zuK0t3mOmNG!S`a(9FE;_OR!nFRFS+bq}|vL4@TOFv_9-Gh4el1{Z!{3-Tnn_(X);# zXTRSW9{=wyzs<#_d;d%A_q>rF^K8fIUD9|bt~A!egU!`OUK_cFyTt2947X5qXuLy@ zjw`4jB*^Gpg%&f!v<3`x` zC=cHy4EDWv=ymsrKq~;DR|{LpBJWdzRm&&kN1kWK?&)0-Bm9Po|;n$shA8 z;w$mbeVTuszq9=6q1#LkD-?lnK@EHyQy^uTO2rw2E`rPk<|jC7p)!D?qjPSK;?}pL zd?pmHPr2Je&)1H$L*{FVaJS9<5k6^OBl0UE@(F@b(===R_5=`^em>Pd!t=Y*4b<7U z9FUx)5AXgzZ;t<$hur^uGf~WxbM{-QKGrf>*yt|#bfyQllE&# z(UEdt>qigu|K4DfBf!%XQ3~JLS45b|4rpK@40150FgWC;=pVaD1;;8O2xXs^=}$+8 zABMX462r9pE5UqI-adOE>cS1f61)%Snf|CQ4FMTOH($V;r03R^h6q0V8liv^rii}7 zhzkRxKW}2}CdMviunE688a-qX@xeie&?UGP+@C$CZ1Xq!kvhV3;GY{XPkY3Kbk|lm5RgSDC4$Ci<=wim zOiS`NzF6frn;4jdQHj<9Jj2bw&42ziD!A1ihNfcox2>U9lp#+!`%RHPvMiNHGf{~; zh7V?^yk?&tcbw@8axGs)80L zNBIen8d+Cb`wToH27InyTArAjYs$*X8eJ&3k#rDm1Q!e>PfM&)!xV} zKy_=O`FFk{5%y|;z-X!wS<-L7lkV<5hsy<_Ds}yZ|5c45l_5CP(Nd(G79(K&)SR(0 zG5HHb8aO)H^wPof4U|oQE2%sY1CbU8(mdANKmE4{9*)&^&5?&3)ga&m%l!B9Btuyp^M=Ya zE-tR)fcbxZqkhsCI1vBbZkSuhDEJWQ;Q7i75fbk#Be7(Lp+#Ids_C#FTA{h6#QO5T zicX$+k*BY{eHn%&!Jj_mwD9nkwH9Z$Lrt}Z1hBD0)(#?a?X$(s>Gl$G7?Q4_L*LyY{{c#$9$ix3% zsa}*i2gyIS0yb6ZnEm`+pE}cTh*_2GVg&{+W7{_`=UTOk=wTqFYPB;5%|_Ozk{S0U zQ)Iv@w8#^bZWZtn(?BD}w2(F?DoWxxQ?=$~NY86MMpOOV^Vpul^1yTiWG~SZU|$91- zE}Bs-C@ADH@NY9jG>BSAi+>v01l=2VMOqj1 zGZi}ryjdwu%=r5aOD`OE^}#Xtns)#AI2=5o3TAXF+1pl_50{ON0af#>tIJ}l!o0r9 zT2N3B`UQoB3E`?d(CL8tubv7MPInwM-+=H22Oq~A++|IZzrP=ezZNqBQ(>aG7#}ac zG!35Cd*3ZBffnb7{xmc+uii(C-skudN zyoVWJRH-hT!WaEH4zze^sHo|hl@KqcL`UGbs+>-j2dpPJdxEGFIx{d7ELJN{QKrp6 z?vz6s!sfB?)h9@!q9Xv>Orcg~o?bD9>ZY6v5}b>$i`CTCjs2Ne1Yy^=Z#3_J*jh#s zcbCCAU6qcYlIIBi_H2DLU(WO7nMsuU9L^Kk$MjKMpML$yl1Y@ZVR~@r{dcCPrw3+M zfblndlKtt^C)hd%9oOma_3y*re1%mTMtlc*dqEbHY*bWVRjaJH5}~y;JTwg58Q|Bv zdgY&;ZK{JsM;N>etCWaE8|DTOcL}AEot<57w0i_R=Gy@NylEA$JjEo?08BYpUXJ+* zMR|Ea;o)*pucNx({O(N<6%!j%q9X5SvJ4L@OE$Rp%VjEDf+ znI6D3W)c)Y)cFbbkws%alSz~*Ziij2xj7MwF2S?c=T2KKA}`x34>pnTDWIs3`xG84 zMI)2I6&mu%*8W|AL$5TTxZqX>?PH;46?`Lkg+2h*@&u|id^Tt!swybJ1uC2R6(A=D z$-MF9ru+N*tt6ZllMSxccP8@bScM%Rn|C+hDE zFL0n^O~P%is3o^uR$dMf^4F2H3F!%3=6IuJnb6x-$;R%m;sR4YtTP@yUQV0284!%B z@&%WW5s?x(L+bhTt<*`}R*HW%#>l&``I4ePKeDMMv8 zc+llmi%AYVSZ{4_uVuaj_XTXE0RS;&WgDt>#Vkw3;S6!ztbom{ur@Ugwq@l4mG?iW zfVq;g3LV91Y6@#srrE!Lb@aj&iUzn*TwEyBk9R#eku0GhA^krSLuj=g88EXjB)>_` zd+-U?sh5XO^^;a#!51R~17-$>Wak9~Cnu-toqZi8`2{ajAWYpdHZHa7_%~2wG}rcB zc5(f9cF5$vJ_x-K$wi`HYV`GViZD|HB@TBGy~57ko~V8QeE$RK_3z+AfM!1CgFKc- z4b){l%zdjK)kCu|?p$fQx1gzFm70UYB8UsXK?n=J)VaF6K9V&CL;207z^=cFj4b%{ z$@%Hi@Q8@@&Gme<*~pln@89uOoi7=4!0i>7@4^BV0JGIVL?CCH)oc#dpy4kgdi%AC zWmBF%J>1^`tw?oEji`MONjQ!B%(q2lMClq4IeHbCEnbS zkdP4MXzXv20H2Ibk$#!b%KGv;A8l=8GVya@ z8%Iya0{aqF0nZNhpG?NFQv?>URM@WvK!9c zo~BAXyu2h}5oW^@a_y63mk{{Us@mDPsz#_@qoFyyvbB}mfA2Cahls>u7-neq=+S@v z0?Cgu-|~brkZO*!@?3fU-m2?OTl)_uH+Khm=6_R*hP)?&iC;k15EK;DTZTqxT%(7q z=s4Ah+~F_ncwy0YvAi6T@%^rUvB#bCcQ`e#kG4u(ju$Xdthym8x;0pA2EA90B|IDm zIcoNg9oM}N67#?hEqlXTnj^^MbwaOBc+SHz>v3HV)-BW(?hJ7k#k}tI`5|E*o{tqm zcQiG-Aq@bCSXD9m(G39llW!PVird8BG_y?uRS!|mBrO(|SIpqOI^!i-1kOF)Bc zlR(7~^-F zJ)wzyxxBJc{5W;#b>70csXsk)8?frIJ|IjAWPf=FoHR%g&^VC-^8&oQ!1rseC<5Z2T21D`tQ&_&$1Kw*1;k} zFyOfQ=@Yop!TkUdEBICw<(gn(1ULAT@?*aMt=35}D$a>%1M3h-0iTq+ySodeM3^uV z!WnOh4oqa)7#v@>s7F=a<@vRbz-L6~TKcqoGV;xRhKv|vE61^X8~g_mtB(cd6dWfx zZoRa(32E@>p{VFeiNj*!Qy+p^51h1ry;liD-Ks|pyhvyyPi&65ZD~1kSdG@aOufKkCc^^1X5Jt^S##sxz|I-qPU(Om1KS({bFKhXYtlI*(-@& ztPc5nX1rMtmLMVf7I+d$Nqzk<9$l=iariR6xl zxQ@V|ovq^j<8q3M(Q)W=!e*#rth@3qC<48(Le9DR=uy>`t#?t z8`q$WKfYHBoZx9GW28LlY+d$KuX9bE}ur-Qj*(D_o(+tA7eY!gSf59ue5xypDCK`GqyE4 zoxYZ~GnR}Re+J6G=QA~O@A7wJUJfv zxGSIXYilzz1I#etITv(AXh@nl*n?os$%NPqeo@g$X0l7%?`)W>yPtC^-p8Xm%!RJD z39Xvu=C;s*i3=Y-0d@6i_z#L=ed;T}{)k1bGgUJy$9-gU@$e8mZ#bilen3O5_apQv zl7TYV8k@sINuwauwf9UWdVtW~4?~ao!Nq|BcxmwL8E|v0(dUDIo7&oeG)^l|^H=nj z40`z^umw**DI|5T@Wi36#4GFKT^}>VD=TOsDRgxsn@vA5Y0x*99*|% zir&Qq1vH2lC^TeE?>rIRetTH~ttNk9`nK_HSA=&wN;x-|`PkKgCtO(*23hGQ+~Le* z2_eZ$P;HrTerKR@7mD^bmjKnU!GMuQK|uj)bf^jRj%i$RM0Lm9RJgkw)YBss_?#%# zRuXXQ`LtIwj*c=It;P%epCfgtIX1F58*GT*y}y+1OQULd*U^{f#x;1#S)Tnmk%i4k z2|2OJ%3S?{f2hI)6NggH`e=i-0f!2%IAu(dT2l;4nO=e5Ozur5ksfKn*hmyqqr-%- zQ>fuNV=1)Wi$$GHt9nTki~9l7f)LArfTCfNt|;|frU-!KKKB=Xr0#uLSzaF18v)2| zOc)tMhAOV#)AI7F8X&fIb$N*Vj0JxyOp>myf*&ze9>4y);nKd;YLhirS}sdimM3~J z2AL!K49v|P92{)y!S`34>wFd}EQ=AoWa~Sk*xwVpc%M#;G&?rD_PGs~q-n>mNELM+ zfrvw4lHMQx$iH{#6~@J)OkR6RjSdWimQk&y{*VMQP84J%DMDVW&}4@Qxf0*1&u58A zDxB+9LJ40cI*}Ty;pZ0@9ju@Hv$lPun4QI^lJ!~%WxDc(Pnm>!hBe&cR|bi5^MRoa zqavDFp;0x8XpL3eqnKFvVo#9jq9g6@>kBp)3v!BfcKTgxkHkqEI>Lq4dsSOVSeOPM zp~#uVBSFihpsAhUB$hV3eo_t3%*>LSn(E{24e!Ad4tw%^m_A=l?zQtwFKP}LUXvw8 z>*%`unO|)TU447vH9G}3fM69nz^=$#NSQWhU`|A>w65;b6^(4NS0~QNY6lF6 zFg}WE(kH%26tVc302&jl3B+48b2(qzuML>1aVC^3U46%0psl33x*Brz;bB5{_eYen zQUf^RXwqxi5#L%~TK6}nbXEN0mxSDI|0o)ZYMm#ukbw>5DTPvo8B&>zr^&{O>*1xXy#qfq>)x~a&F+ewdO@-h^{SNSTwb$%zPmTQj`B>Fa@o_vq<52hF zUaS5L53CQ)%Ejhp>GvMhce9ti#m$70%TLl$TZ_@FG5rn)>rA2;y+Wpvs)NG~oO6kvpikG}K{^9w&a4w6dqM|~gqJs)L!glG))3Y7Rqtd!E!PgXE$;*coO2@yorw& z21|VKYo(S>)T399V@}07QB#qgBsnEfjXa^{@Q?qC@sp*=ekYYk{nNp6@)E8T90os> zz7yk6VR1p6g(ZA>;hcH7Ik`M9ueS+d+gLrxT&a?v{nCn&Jd#(ci%P2NDN-R0-Q?*j z)6j)mlL{bGw~@cNU4#P|GAB2R$dhY;!9WcFu2Lq}x#3(UNfw#L5+Ov62LFG6+k8-0 zx7UZH|J~mZr-!sZvl!LEyFZApEzDf#Tr_x)olySp1k2aPGl<{_LKvS?&5m`J3jA!< zgDc^&xJye)AFC+nUxbqvrdFo4J{@7f_;^6%@m&&kZEZTO7}#*R%#nBQD9i20pFuE& zK(^hHBEqY?@$f{*Y1ZgJEA-UjHa9z@b7D}KxQSxM9>MTk*%%CYNDK#oS`E*WfoM)5 zk8{&cYCbLZ=gTbt9*UC+nrMYgJL*7odfoEtRFkp~boFe*vzS5(bL04Mrh;(ao}Csu z)8u@`tfl>pFn2i(Ic~*R!1J>-dvzg>xN?V+Bg|AQZeqn#C?(;}xen483k^~W_G>UD z3{v7IfsdjbVo`K41&kpm<%X{5wH>i^?$d$eU*3)_ZFt)g6mN^E;i1vxYHLZMjnbVg zrPnr$v~s5qIOl!8qlDIYtFH7n!#^4sHn?!H7UCCQWuAsXY~bCO1?OSC!7`hNXFI&# z`HZE1uN@;~!{k-W=|sk)_eyaVn2fQdwH@n_Oo~9_j)uUGwc4DykV46*%gQ}~y_#eC zspSXIy1K+-ea_g=mrfZox*`MFf7N!nFlIU5kiSV?G~m;t%&nFtCa62T0qQ~M+8#SP ztZZoTUru|VnZV*$D~LSvVYxOPb~yNOHFw+hP>uR={)7O>b{Acu`_=Fj4Z^tBpuCGc)4qWZT@oISY)UT6mUC9J|IfE@hZdVtvO? z23KOOvE?b1X)GWueV}x)y-~1zZq3WLo`l;l$$}#plw8(9iqRIBkcy6{X#zZ9`n05F zQ^74P>Czy3$LhygB#fEONZf~eEtG*Y$^sKb6pvycO)}9>de1~o({!rF=HWv^_yu0~fj;FD zYL0hTDJ`O5gcVVP{sIL#llXbk(iiRUS2+nB^QXu zv^j6j5kQOh`peY-s2W9b1E;@?EpuydKfxlIcsP6&AS)P+Vi9!!jn>s#J29jo)c5xs znUUsiU})A87t0roe|U>(Ct5V?)pmr;^O%vNN6e9N(>q|}FcpndhRhLvvTH5yt20tf zljqGOj|VMEnYDeKllaVDEt2SI;Jq6GZR-+e)UkuPTT&p1d zLQ7Y?L-EV9HS>8TDPS2Bd+*rh-z~ML2)xBYqP_TpuZ=QPPMb?TUBFMu;Qj?qLkK{w znODP2h8#s7z*s<8w|_bcnlst8C)hdz6m|PH<_0`mUEh{>CzO3WJoHPT64~}jvPkAP zTHM;xzHpa=BCE2J0ZGOyntxcCnWqVL^l>R2VS$0mZ@|d^ z0D`lYCybQn3}y5CQe5opRH!Az>JKfW+Nsf6dU_tXOCE0zjtUilIB|An8r6K!B6{d` zl&7w6`!yF?1Sc`0U|zy+h-B-~Qkg^DPft|x!~V;?fNKe3=N?5uMLjXGs^)d{J61Hl z!EdgJCCB{0k?EV)!n;51YixV_V|o#4&-Q;z?<7a>tZ(rz^|*BHY;-YL{J~Y+))=aT zdQW~}gT4?#%@yS5ab8Ah!)GhapRNf>I$h4_+A8?)zJ?j_6yUH^Gx_`rYU`GBS2DlK z{3MZG8`duL{!&EQ)uVc;=FInQlmwcOYLfRPrA~j>Ui0n zUEUVdTe1{h{lcVvs@6m^kCa$YZC6xoe)+%8Sh8O5FK}zA>dUrh zqqA24`V8*#Ft#OSdf(0$*BoDqMm#zB!kOloht^dj?i>to#j9rsTivJRCkzgPwjx~# zMQ%&4tIJ|?YJUVv*7MOg zZQZ6wR4aI@9t83r5FsZ0g^yVvk<+JYC@ppQK_~ma=QJTy+vxmAw=Y`u&=b_dpAu!n zqS*AUHo-kyrK&}OnbQA%i`_i=8Ns1yZ&MzC|9rMq^T`(K|DM9&--61~+>ak)P_yYi ziz_?N#%@y$R$QVcZ#X(w>cWbs3~VGkiqDw^1$nZOUsYb7?Xq%S97=lmD+y$NpN9QZ zHFbP_4~WsSi|Ib|$D8MAK6F1|Q&WK}&#fq)ghu@7Bnk^iGGP>*p7Xry{D1u2wll70&Gi2mWt$o<<0}{p+2EuO*-x zD?9iE%Ec8=Dc0x@`%!xeVou1Vxj9MGmNZ~#;1YCxeWO032SV2YX3MPg z_0@=>XJO{f9Sg_bZDO^<8F@F!;_*Oq$R)w6-;ak+Yk9K%(#+KaYs!bmBaDu2%}P)= z@wLTWX}#I27~I|0{d{G9uwt@fit)tPWW`CaS`>^xDF?D!huj`gwi#dkY|9o!T;JTR zaC1e`ou+Q0K!$?5s9KxWd-GI^fY)cgtS=UBCLUo}M9$irrX_jKP7#N4Ms9i50p$ah z(S}7^)=DpS@6A+?j`a0)_r14ajv@lu^4Pt)Q1Tw~``thKuTM_ZEY;6(7syBaJ%eUR zWB)epWa!`kF5a-B&0Mr{n)C!oiCu4>OSs0(o1QplddvfzL|j3M661D@ezjJ;jr3zW zZMz8#Z#soI+9pP9CtQTBt;*0>XiAqu&kV_6S$TOg-RaMw*P>1szs^A^C)upeCfG-j zkm~Ac?i#32%LbhZ@V=s~IYXK>pPvuJiP=UFeR7eSyZa_&4qHA#u}aW%1E^{Gbo617 zG1l_#-BW7#PaR*Sheg6|u)v5xiU=r9kE`@$fI}q-#1##c4WYt;G3RvY)yeLOHwXlB z@M}xG{^#2Wo;V%)_jxrnnVB4{(Q8r-PUGJcxYKAU$wQMBmAT>pe*q^Zds|0tg{j!Rc~3N?7kxA2b>V~ciPXB2AJpzrP$fn*w{S@Z#E?h4(5L2nKiZq z*-Vp4HaxNiIy!cFA7>U8Hg=u?Je+A9W5Re!PJV!f#4r~B)W)6n43he}yylMB?ZKoz zmN4{9z^g^^XldvD?Pl;Vc+ohXrD@mp#QMoF_}mueUeg5_t!MSAi!|$5P312=Zr_IHGQ^|yfx_0Vg&Op0!Wa{&CR?5NSvT5Agl%tq5RiXIDVWf z-|3)e@0x~|&#_6RbqxXl_r9A$R+nRc_%R8flz|@I25mbe-)ndz1~e0+195jw2G)A7{3Msi%wJG9;lp4J05sV15d{6i8~Q0;8{V?f7*|+ zy8f_Y-a1Ab=2c3rAZZ&lk7DK3_5&$DvEqF-NhK1gkeXq3;>H;&Py4x@(ZlJdp zM%JGW6o3L7Qo%C}0Vg@;mzIjaVmmKyZTDHJWmmeOSxciiPOt9i-Me?;(4sH0#3qY^ zTtQPop~-rM3So?SV5K)O1(Ja3no<`R20ncO%k>$Og=LXPP+D%dxdASOcn;LuEI!A= z(z5zRaa({=-1@(~qMK;+XTCi$?URVFI5vNvX=}_|;~ck0!0}iX+SrZe5jI%3F#SNJ zu~fU(d0Ey*e4bfhU<0%dunYgK?Lf736Kr6GF0}SV5$A`?=i7b1t>)R8?0|(UrYAQZfmh2y=^ztSK3?{)@khuUu)etv!K& zz-RxvOqsqJ0}nV&T$?s1VX!v4?f~yL_p=h5M16k#ZC#t{?CAW-eB)-ZeN9e9MQ!aP z+8}7BPoih|kbCvmqYXxpK~M_B3H$WtGvRZ{LLQa`^MnIY4LLouK?qy6|LFXAuQdXm z4)oxt4-_1K4nfoJ`&BL~AtsJb#f4_74Ie(-dw=zjSQO5*7*a#W$NdBS{j5LTxdYh& zdt=UxS`L+}^S+~BgHNsOfWl_@7~Xlkroy8 z@U*|Kty^AE;l3AjsRX5#CSU?%Og{bm2%+#oVj?^!dIgXcIJ87C0p{xIwgJ`wAh~+1 ztBY2H<|3c=*Me7Df0xP)1nSH987^LgFLgjTC_^cC zVnulADSc#D)Fs9I@xxf|H-fav8!gFlpD*{{Mw+9uu-#UNrpW4n!1>}!a7 z&{(7OUXrHiV?n`)Cg!Sg55UEiov&l#-$>V%bgH!tKhP{TX@VKXQAS^!z|8Jym{PWq zm4$)=aJ~UV*t+-}^{q1*wO5iagD%wy=3zk8F=K3rA(0)95p$mSezezcblm<{c^Clo zp0>KQh-Et{zCu*{O6*hFU#jretxu&o9=Zqhn!KTOEciHBZT}F;9*79xFrezfG@N-D z2cYZg>np%0<NlAp=Z+p);+iI_u#MP?w^UUEB%VLzK~H(L3TgCxw^iw=`dPb zm6Kx$%Y1wY?{!}Tpy6Sq{lijAHE6^$F&Phgbx|!Hef3H~_aq~E(`V>DJ64C+*B=g9 zWdOzJiUgV<4s|sg3!@=H{*@M&IHxndwa4bWuBo6o>Pd|311-bBJH`-A`U_`5yPzX% zXKmU)wK2WPb;KH74ah}B#Z5*ERirG)JED~|neU;Q3xJ~5b1S#O2C{GOA11IdIq3(` zLT=y)AGV>0-~andxTxMgk((F0|M1~M1q%zGyQiW|WQrIzNGZmh!Y;yL*VQfe!gCQS zAX^2ckyc^|r!uhpBb^Hby09R23crSooLQ6DJJcKzIHJYmBnU8MG915s4L zyz8X8*vx`qbR{peV)|{5hlaL&nDjaRdTzi+!N2T?#gg^@lLo zOh3uq!DeWAXBzfM=)s$f@~Y1-u-*_}aASF93ZMMjAy_ z$X29zg>Vx}$Ibw?r7FAjBX!Wn7M`J{Ws{VP)+HMvtg1dmj*RqRLJWb9I@N24w_mu6Y|^JK__{s z<2Dx_eXNSr)gvTJ^1E7Pd=!Y8+1abSym^jxD5W0aic(xzY3|R8g}`s$A|fKP zWjAwjpFH;UHPfbR5`eLB*THQ?_g|tJfhIB%(sAE|1D^JwzP>~ylvp~Ot`3U2l9Zo; zK`(nh`mnwp95OR6J;&#$5y=`$_;AkTPgDcyM6&DS=*sx=Dl0wU6vN}GF2ti3#G-O+ zPzvQ}(aN$45VRu?RGQsrXxRL=O{7>eBrNV7J5LaDEXH5lb6nW^^XqO&$nI|L8_B)B zz3XjRJol0;2o)k~w$|3xwzl#LO3{{W*46cp(Sc)dg2fR0VRC9xJj#r)8DqI~?>aYY zG?24!Aev1D!?XC>deAh8UyydgYhWxRC2K@5^o6HXz2yRo-O7bR1%U89k`rYX#?j{l zs0jn?q1H?|=iS|1ce}CCp5OWR&UdW=nVIux&fE6kLm0vSvQ}zLGlSSSIJn¥Gmf z4xVbNn8`_HAQ=Mdnh(AX*b9W1pl{v;A91&>^}!?ykSq{FOc+DDfA{td4KcBXe6R;_ zBNQD@6mv5A6^}sR1>p3tq+*8&1W3fe?ME4~w=@$BBJAM0rC-fJ&NeVYQ`94lEvdt0Eya1+ACouz+q4*vSp+ly*@3esy(GCBdh{*AceS!W1%^oFMxi0`AO;TKst zFi`)ozh4H}e+(=NoTT8lLUgMFP10n&jsCd+AIcuyX6v!Aa@g@OiqTY44 zpuC49tTAFvL$jYm?I#d~W!Bf1=CuiR01|yvdvG(#1f}3rXV`Fzf0N!e7Ka}RUE@g` zo>GPx{PfgX)Gtmvrz5TK_^SAXQTj7qUSYkTij55vj>>UBv*4VY1Y(?@cr4xT`tkbs zLcf?;e{F9gyK&Rmj^LaIcm_1SKv;ky56ZsGo_4;r-DmZ;*#E3}0?3L8reKesiqcf*LHX&e9Z?rvy%xt#5px85QQY?DF7R#ko*=k<$bkE(0U0{Q7L(Elx zI2iQ;Dd#IMZ>Fscq}#&6!Twqo)ch2IlV9LRtnHCS5y=9ky`n70ZbQ-l;H(@+I#Gje zXsmDk`mf(3cx_1XwYAN#TsWXRc|qS!?wST!9SE|;lP>A%py#6mpE@%YGLy+!4^`MO z0$!3YzqCR{JDhYy89Kj@>Ge!&1J0BLg>C_0$>Lkz*xurei^d z8W8W-iuGa5LQLQxqJV$wcBLJox(%~=1^8Gf$-UCKoqiKHfHwLYCEsZ5=(rTpCF^Ko zGwzknPN5w4E3LJJ@9_XcOPKcE(WX+RcpDsWu~GIUI$pjpLUIneO1rJf$2ML+lAr0PS`N0L6kOz7;-#Va#riKk)oq+9Fh351;t+neH|% zX%q=HApG$0vOq9F;@7}W`$zvKJ!LVqc8$*#%)KP8d>NZ|L2}0`y^S*Kp!gs5y=11Z)4*O3Z73Jx_qYxJoq zW+i-*{j0d%;o_||T1n1b8j~WXo9cysbDdgnkn_41SE_d_% ziw?VUQsjOU8rsGy?S|=>cS=f1wZF_v0eYsuOx72p`08Y_zG@N*bBvh@#l~E)cd4HjS^1N!5srP9i{oz}FUtlaDj^&`Y+#pd_la2fE3XT<;>Ap1M5EQGFvJBs&%$a6Xc=m?s=Y zW!#ze&8Zcg4e1^pHqg@>80x#i6(7gP8<#N1YbY4_m3)JfUj5{YZ)Goh@Xzy@e(Rp% zgZkrn-nf3!u%sYxpT7k5{bVI3={JlBB|2*IoM%U3b7rBgrsKM=N)>9M5T=+NhZ?H5 z6pgbdus%b?07`6Pkx`0+ZoH)>0B>Kln6{d0sdB~c#oXyeQy=rouzS&JXo7s5_p-V3 zvZwI+!I|D0FOptqvY%3OI2rJKY^jnDlC%FK;I(yh&;W{XQ2EVN7xGZ9Y8w{m(FW0T z9b_{38^O!ppOf{jpH#Zice>MRnyUCaE~fDQO#*6kaxZHKjkTW@TWkuS@xFQn(Q}bj z4mASHf`P~+NNtwF6-At7ViG@Y{qnj3`q7k>Q-ukVQQ33V`8*+obfn`O-r`XznQ(JM zISt8dH%y;b4bOV5ikesv3$KImL{FHpOxXw$<_DQXcHNVkeeS19+x@Q7Af7Kg-g%0| zmDq>mD98QvlA)(OM{4q#tIHYic))`%-;F{7kQP$~NhdEf#8NW*Xqay^lC}j^~mH1d0Vl8059Y=W!47M;YH@pna zZ4{B(UF5~&d@|#yrmyvmx09R^PJC22XS6mY>B(C5*C7E!PenyV_XqvZQ3F^)ytK}B zNs7!|P-MKWj-n$Sj-Nk+I<>k5d<1}v&^N_jy9_Ffr!*6BCnHyzi7`ANen$hBt{})7 zjmzr3BlPK7c;Os2=My$3H}^Q$8svm!UI_QytFXY3-ge?^6KGGrMXBb(_v#zD82p`u zGW0-(t*PXAnjGz!;9A2Xl1vM%l0v3fl?gVakoVZ8kh7cTX}!{f`MVEY07!y({H|T$ zi;F_L+1=)x9O0(mIfFAjt$F7~Ob%!%c)|k%2T9I&G{p8eBg3;iqq3QRuf=9DhTLWX z3Pcli^_UI+Mcl}uebqIsqM~BPL|#x1`n0wZR9kf+OSQx696n{pt|3Z2{*6|PV^{nO zPMV@c#(#fYj$aQ|%sw``X^zX{;fjZ^&KmtH?wu_*XU^yPyR1oa;3@a}_z2{*LgiI6?5#=t#99rN5YuT zcL*Sx*h_)obw&c?3lhH8U+8~oQ1+m&FH7yx-TIiyMGj&bIJBDdO`vhoxo`!>6HYik z9=Oz-iR7lIhItHTyJa?a^Ut$~yR++E4mXvGeW{oY>#%Y8f(V0}_5~1(5=xu`8ST;n z{$8LrG__{-VhPE?Bu#pz=kQSD>I@xu=vO_Zz(8++2<aW$WAP%Us!O(`frnLWYWJ$EoC!@pmy{UGpi|Spg>;v&1xA#1_1sIV%zAPaDf%|c&%voCRh>}xwZCTw;-`0>gFVaTh%3J!I z$NF}8e^xsKBW>-qq1_D#{npu(lv5~H~cs&;fhQmlBQc>k{C$OmISkZ=4*3G`|8Y7 zWcnlZTDTTqE`S8#33;;; zM|zt!sFvhfHFO0101+Q(49|gziPPW-n)=08=P2Ul-&V>%Jz6Q&v-}jGF5y#(#<_ep zWrP+PkgkKU738=Dd(?MU?c2UN|0b?%KdaXei&!u2nxhGA!VC@FokEzWvG4mqsld;8 z?Rh{_=pD^F@h6nybQI1hfXEMDVjT`_&bXMLhT{Y#X&g>NEo)cfy-4vWd~feMn8g74 z@+xcQ?O$r-DY3;t2zh9Q9Z>b+h-==Oj;p)RfCC!BVD6TDW>Ld~a9=*n;Y4Q6TpX%3 zoO3a_QIPV! zct&+k$%-k2;aK^RnBs+Yq;wH~muc_nJh36n8qjsHvP)cLM119LI6Pc3vVNk!X1ei; zA!0)l@qEicYJ4>CY!TwMgQU-k%FvUyZ^;D7cbQ0E6)WDUCR5S-t3Dy4FMRl^G>Q!> zNc{G4{^=tbugU4HOE_))qdeRsnaZfm0j||3K|c5#YF3@(_xR#m;HmQ*45ZGeu&Gyf9b+h)piJ_TvHzH$nxMU- zR_lK(`(P4AAgr-J)}-3js1;&SVI_1?Q|B4L&)QdJNh2)u;}DWjO3W47PP)3zhRC6m zwNR~}^S`e7aB9&9_hd%hFV&!T``r5V7HV}ar8yvmxC7}xFd5koQfoYAo4}8INZj~c z7c5x_Y_k%(;oHy142%!F?MI!{K-prW{XvdGIoyWX5|VL&COv zR$aL-Hx3_f+3&4Tu6)!=;lkaZyZ@g`L*4mvr!&P zZ9c0lwhlw|)lRJx;pyHj&B=$xA(c}`qKCVmyhUs$w)cNvY21YQzwD*Y-S5as=#x$L z=)kTQ3v(qc-)|046b$7&TP}KO^u%E*wXikg@z^33nb6#4A_s>Zy%)OHn$22}@ku)& z9pnh7&nABQFYf=^-d%`fe_B%NQc@b-dUK72n8Vk0F_Kvq{Ukxs)c+JmQvJ?vH`?BMGn)`<916BuH_3qu0)6YD+NARq6QX=ht5Qvtu2xA0-QE|I;=oOpq z;`k?oz9}Kkb-Y7e_mOw>bYG~$v#qp+x`tE=guufGM=QzG2im6)h~m`_qob*DtV*SQ zJtqYMu{$OE*!SoHLxaKY)a5NZsjV=786CevY5Tc+GEphU-+g=i@g2fNWBa(rM1R+f zzU1o{Z`x7S>kpq}h%|0h71J@$Si)M+k>z|9Xn_GVe#(mnC`t#e8Nxb}cX4m>iigbJ8s6dhNp=Ct*_326`?LG+`&FlX6|FW3 zJ&Z=Y1#=jX9z7)uN0aN)wm08LAMUpHSvdVZojzLOV0k}kyC~y`OTc@oyyb#kU;6eB z*(F*3T$mzvxE4y35muYl2qmcufN`k+Hzi|MzZPKfj+{0p+9dgFU7bys5r3mucNB>7 z$!SlgB3pc;AH{GX#WI6vtyk)zU1>;As=nAX(M8}!0PtTw|V zcM}=JI9a81rSrnwjKi%uk4~@2)g3FTeUrHW<#!yN9MT-mIX*@49}Jaa_>VR-3b3$s zrMn*OX#COJ%AjMEn&hZj8EZHi>FD4!@}1-t&8V?|<~fXCL9-&RpGF|Q76+IZGb$hu z#zcQVVcUN7qnlf@Z2Qwj{0HM77$Q|R=KyB8RYCFSpv%4O?+eTiy?_EkxIH^|o z5m_w0^-x&_1zcC~s6A?5Rb*`E$NK-f`mHm%Z+2Qu@!zc{qs5!$Tf7|KrL(8`47_{3 z*NJD}BZTPkVqafXxu4F$_56!Z$Emzsq5EPR+hHdjjn+*Zh&*JWr=$iR&RbI%`y>Gf2zFgxRLiCvVIT10zd-;J9Ia+Ju z8KWZ#+N41-RMUL*`&p({HUz8pe}A*xKYhaZ3ZXKwaPFs}cfTh;;_G}7p=_dH!@hzJ zDO)V|==G$);rW`v+<>bxUbhe5W<9o4$d`co_Le;T;@Ip*fcneUJ1{u8#rZ~tGdbFA3;Kb2e*XTr$R zhzBluX`B72{!+=>Cv67lZD%c)kcLK(1wFOCh1*_ltinkf_}TfZ6)ddDj=8VCKU$Q^ z_xR+$xlZO$-+x|s#QlA_@8LAze${;WjRE=_O_aD8*=mo)EF5pc1mRubi0*q`>6U?N zn*kQR^rv%d{i3!;s}jX4Ya8XhBpX_1I-2k19{Kux6+Rpwzz;pCX0i4-n-X8>S>kOq z*>8Vga!yZr_*KZuQ%=W(Fc_abKWuaTMiNn)da(_6^jhDg^xV8 zGrAo`e{Uz$s~2{?FZHV!|7hQDH1?;)d%ei7=J06rX-j$KexBCTOW|#?Z~u8@-!-?g zgxB=n8+DTmR+IimjU97`OF5x@zED=4nj*d4-$U1jPYS5IHhMc-W+x@k8F?qDXjBo z{WuTFZu@*-aYGT=*Y3EZDvR~}RGDGo?!uiWmIf?(smuNfRcF2TQ)f-%u0NWkyM-83 zhfk1=l~Ji_m+j?@2G;{r;HHoG<`-MG!7{5PizL~nc+QXwOH%RL8C-)=UtCXj&!iIZ z_3*#c+IEX2#yzQm%?C33(tOk5x;J%Fla9QG_I<{@wzLoeGLDBk(e`7I_;(ytJMbZp zDu3|&)n*0WU;79~d#w?lO8r;dd4p&jd_B8Me3lw)X4B@D4z1pkas;vXi97rZj(*m2 zlEdx*H;Z@NB{*C;9H((%-GA06t<4?1{4{W>_d_mm_v_^OB}2mmz-{q8ozD)3Qh7E* z%E5;y(i}f_e*#l9w!|jr)mXYP^GacEtlD-qO|l>S_j*$w93939zFOqJJ65<`PAC#T zEUDBTT-kNJPyU?JlPAV^waai+WVS(g(E2K@cLzP9rw9GwGANbAhHS{`$XLY;Hg#{=8J7HN?}?YL{_KA?f*p?@2_h-<4oaNnuN1jwZw-0d^*Jg= z9xjl-_MDCiTVo}Jr6&>Yv86?hQ+HkHkX}plTQ|4c+pD}!`kZ+6$?8_ok;dpW$)Kd+ z;T+Y`vxy<@MX3{zeLUJ7y!-gYq1V=!UkOjNxfDIZO13_i?puY`{f5m9M_HeRFzs67 z_UlWc-^Upk_j4M_yQ+MzqjQfAvrlh1D)!$mJDi&;EiZa$Hf-Nc~jel?OJrLw~94riu@QQ`_#wr=jx(za~bZQJS60e(ieMqWX% zj(VIS<@)oqS?5kADUsJf{K$uUY-9HMbiK_`$*Xk7;LodPKV7mvbL zrxbn<9sLXS9ta(XT-)EiL?%~YHbTPfslM$)|7~$~uZyTCTgD<+wfa7zgKg!2ffHsF zTCaE-eQ_`8W*ibQTrXOr$kb-d?CnwTyb>zc%+cw0YS9IZ4nL`E>o@ zQL}u2uWd-lBd340RZr0l2ma)gqi*Bi%g&`W6 z*Y}!KUMv~9{JXqIHucnhJC&v7p-54!E>+qVn}N}H_1e`H=waO0XX*0mJ@F2_NNcwz z^8CICup!>Ai}Y4(*+gY;_9Ygy+}O`A5&5LlhWjlz*&^zFhYIm)5A1zBEE;t1EMc1) z^?tb{a|mh@_tgcKp0&lUeWeHSE1tFP&1MUFE(&Lt$n`%vHHuHG>N|Hw&LLhd+1c%X z*@|du&XC5_-0HG&EXo`99VeNdKb&*hs&AJbHU55w#JzAIuds)#P}nV@DyezQ;mD#@axE&0?4WF>E_mR`&4r(nG!OUR_7U zJs(N`N(ux;=0$tQ`GHNvCv+n;9nKWSdp>6$IgL*1xijYcuJGHr)cj^cqI3BcVKvmk z%4nlCrG{OH9=|)Yy1rE;J{$W4!Bb$1!*1rYjcf=8eI^>Nmf!VzIyQ_#Xcziz7T~&A zeOt~RZdXwZNI6aEoBYDW1f$?l zH#@Z?+x~j@>h}-3S3eXDg9WE0xZm!pE6bYl*#Lp!Ojf0#QdZxQx?Bw88O z9U7B&)&E)S1DRG$u^wyfa(y|Op3K20-E?A_^WswftL6C6PNpSiX~4osCFk58`?~qP zd;iIKOPgWmuHo_%hSMB~!9NLSPf0vi^t*&Rp-%GBBv`_C~yl=PiF;l~i>4EYJt!4v27i;Glf zqJEs$ut8U#NVo+Nh+lN4U!lAuLFEm;Vv;_VGG%*Vc+y)|tVaay!cpf|i=!t6KE(RF zEpVf~SrZbO+YW?H*u}@jc&LB5M5wgv=SwdQrq$v9qF-eweVaQtHB5qS;*CI6| z6xpk}nQ9o@L@A^hS+nm9zwg}N?>B#XojJ~V&NI(*p6C1id_IS3I=l`d!Mci{PSHk1 z;PpFouz+AGnq1~vceyk#$jb5DwJIa8uf%2JYtcDvYWRki9;QNJkkI`(Cri^^C>!y2Tzb-4kwr69m-Td=r)oROSPVA#e~sUr zZX7-PaswX|3T4+ZX(Jn}n>#dRr*O|Kp0^A9dT1@hixkH56d4v_^cD4SJdxwvnW@I@ z{?rrF$PMq)`m8?LnAh`!b>mwhq;=+#X+yoRHQ~^WQQC-c-&N6rz7vAFJeXEc3h z=Za%5Z?{!saf==rU}rI{;6g5yAb$+=IKqKc?>o6up0*7ZUq8ZQ@&_vvdDW=&;C{Vj zhsdryHLM}x1cjsUzR>T*wL5%@_M9b90$;M*iACbLtWrCFvdTn+0tK}CZi$$PB5rRo zJX79e-D%1n$OjAOsT0eXreJrY+g06D5ktLs#*K3d#5RqAg_I2ph83kGWn<8%HSD?5 zN+BDTSW+M7VoxQ}1wkf58L!D=KY^C}*P@rcBs)Iti>Fuk%`3Y4w8vs@mx^67v*(aN z3d=G>UKQA9eMcDOUc%JnybE_MW+$Ir4`qI&#S0zNn>@JasuQ%y$l6?|@B3ipQ4M?NTq3#G$R!#E76Uij zxlejr*KS{p+=G>^( z)n5FHtDSOapGilTv54(?g2-D<0n0m4*y;85mnOG3Z{zD-8bby?MDDkCYFO)kKzP`8 z^qFwWl<<_XHVR2gGgEhnpw0~xsW%T-D2O31W-d(YP6?hOtqy-jq(T^nY(F-ZKaDO- zaE+K2Iyl!-8_U00*(ght^{e}AwK2L%dU#vHwQMs0O|1|hU!%GVMs2D6%CQwOEnU<# z!0$z{W};Djw-gL|53W2|{JlaEmd?Yyhkqb$O31GHIOFnZu#zsLSmpf9f!yZGz|R_2huE*>nV!&+o=YE+45k2FOOGh(G ze4t#DsYGZj&lXDPs9^TS2q43aYbA!A-;a!R8~@RD^;nASSt@}q9irp0$2GFIj)}SI zCycJhys|N} zvO@w_NoQ7D_gF=}%iSEU8f*{!YbYo@aH6&DA$ON`kudLMbP~Jq;XDZrcR0f9s`G6 z7Gv+hus{Eo*S!{S{f;+O9|XFhtZaWWl&-w&SuECL949Egw{qvl0Fn9V;|$#XBN2N3_)w%9UW)D_2c{Z)=D)K zkU_@bYle%D1OdH5)w0wUL4l|ta-9D3ty@O1N^dIM*D+qpZlGLh`~bn8IB(evCL%Z) z@(V7OctS_DpH3(2jJtw=7=!|F#l8tB@TgsnaB30-+ao;0fkV`tNgX#Cgd3d=pgro= z5jQu%gT8}}e1M4ryXP#61=IkM15hYI%^sXYCvxbZwbKO8QONT&S{p6N&zH|1xkEK| zIc{s)t#gNAs<9Wvsjmu5Vj2TMf`Psnr=PO|CFq}&K(>TXUk3CT;ftRylys`(#2^Tm zE5yXaL`K$^l_{P0i8W%{kU_jsjmrT%iT3H!+-elJ2|HTU0*f{p$-QP_Vc|3nTZ|9S z=RJ3-4Pvb=V$;rvnTtSLU#HJYKt#&R+pGPUl|oS^RrerP=fMNn?TOqbFZ^U-Y8VI8 zEE*uSL!~zC%^S7lrLckP-V;4UpI8agFMWM|bUG7DyFgU+`lgr0fJ%E}Vxk(=0sJ>U zLFffde@8iM@7=oPX;9Vh{ZzX1!S zTo83OQ)$85+1c6GSJgzstWn}mLe80w3u8~5v8v7ouOOPa!OW>7V!_p`AyVVW76_!k zycq6LD(RqQmizsA+97rhGwCa&+%?HV1Fipv7d~Ub&VvI(Gc~GNt(pM&fUeB#1n;fz zS-O+4m%a#+TKFpI)ic$4PcDHXA2cQV&ydSlbdrdN6v&!_VeKd^NqxO&?UZIR5VM81 zCv-A^nFH~FBG2}hiYC7bg8G}Q@5XG-4*DPRowXy(^Tx*>-le*Gx3YFyy+c9 zWZ>t@RUrz6-Wkch>MZ#B4RM@3>*mDPg0yI%fT5iWS<<*tN7YFS2>INVmUE7Vn?;wm z!yEwDQ2Buf9D_}H54(XnwsCU~1-yRxberidiwZfVT0u&Hb*6wQ)E+k1>zkV^N$RJ& z&Tq6GpJ{U~u$6k)R5RJ&9omRaFGCbAU*b_*SdAJznB)#}O7c6StLXQ`b|r;{ZoB%` zw6)=Yed<`BO;@d*nYLC&F&JO1q% z6($y(0N`ZO($b`1_U~~&*g<=FnV{q-vtU$k=GLxTMN8khIO``GU)dhOBR3YbW9nXa zcrWYrjGZH4{X@^+;6&)pSB~7h8-LXnhE!9WdMUm80&&Np-_Vp{s6HB{zY4sPp;UhK`Oi;z!hhZnimPjd#7lmD{sTav zjllqKxXR3Ot^(`5C_#|au1`0++S(?T-KY2T0DUVYelM|lJ6B>NY*9|sWu<8GJ+|t4 z+-$J?s}EDXz=7OSyr^ePj|&kx7)KqSyar7EE? zJV!>ZcTg!(ya${y&l|sPi2T%{oWX`_F7r0JOoIfTx0ovF9NYo=t%Ac%gV@ zG~BbG{eqJd8pYjFf90FJar6cobBbqeQ1xAj?x} zr?u_ko04=nN|DNbw2-%_X9C$hQ>pVSFl_5lP2HytfoC#~N5R`G79Io1j0GT7Y_mo|w=LsxYKCLG}H<=oi2th+G zE^IB#SY4V9U)LU$68Sw}{s=%ToH8`j6l0gaX&=5Y$erC>-|GYv4 zTil0_ANRq#(!PC==((B1m%%PkMhT)R*0#{%uVBsqog*M2@2z>)RhgCH`3nC{^o0gD zly9%FuJ{ONo{I9a5>^=HkB7mA{oeJU*;L*4jq7g=^-lua8ypKCYUizb?=JQ*3zzQ0 b+~PxCXg@KsTX%=0EP|XcKYfH`>K6AO>o^}n literal 0 HcmV?d00001 diff --git a/education/windows/images/deploy-win-10-school-figure4.png b/education/windows/images/deploy-win-10-school-figure4.png new file mode 100644 index 0000000000000000000000000000000000000000..09552a448a0b36bcca641eb5dedf09114b02f691 GIT binary patch literal 18525 zcmb5V1z256uqL_*8VC?H!QCMcTtgtZY#f5SyIXJ)+}+(RxI+@$T{rHwA-I!SJWzgVC!y{L0-<$1|HAay78`*;;%AZ~LdtGB z(2T<&_p#EEHth1jM4D1rtv!k{^a?C!^ssKQa6yLfNhHV*jiV?tBzSsEL7! zL5L~_d5uXe?y@tEd_0kl{!54;tXt8)pxBTs4hzL{7|ct?4nu&rne%d-@}|wQ-L~R! zwsfe{tK|NCGpF66LZ$3oS*Ays#aw}7UURZ>t973>Y+Y08G_wvEeT4(ucL z93K6oV{{F9_*oNCl=Yo~Wk?nGT)ja^4ih)DYlkFF{g1J9A)kiTd=59? z)HDS#>WL%HNqH}auKFp^vjlx~5U?+G8n9?0bz5Cz5jNHeQXLj_I`?HtTZ(>WBJG`zmAN^f+c=#JvOwpF_tJV(f7AlG14W&3EZ7-_VEOT zQENAZKXNYAWN>?@V=1z{Yl?s}2SVs8&vAKt{&9g7z{2g$kcrJ(dkSh*#IHn#Wic zO1+73;YP^fiIWFqW;C8!C<4D4qmrrTsth*gRX3iytG$ zc(W5`XAl8i*|RhMWjXu&{?)FhI+>bcV#U?X&}@DW+mIM1h1<`In$ztDu1szZPRQnst%{E15o zzg49!;@s_FyVd@*_X4fRggqA3-c3kkN-@fEmFQk$s@-jl?HQ_E=bv48{PNS9W=|op`ByTrTO{j@|Wt`+RhOYv*~N12DGv$=a4b4Sj0Z&v^Q6juEIN$ z5{zF=WAey`3O$Dv?v2B=>HB;#+*5J)qXci}%o9gig)=Mj#gI-)O>ir`O`(2>$Ga1? zan1`8fWmlO3?(r;3J+3KwokDim&z3yYwGG|*<@;=q!)JHAGcVx6b2U*P)SnNx}NM6 z#+(i{*xf_lF&U@WQ=B#N3J^_u?#Fs00LNoBbMT_d!kQj5>OH=GVAmf@Fh_I-q`Z+VvQjS`~B_8 z2WX65KDtCW2aT}1HvI0ZdmSRRRty4z`4?5AIv15!B2*NM^^SU;L9{O1G_GhWOLa-b8t?(W7*K2)9Mdv=y+(~DNbh>!Gx?D!W}0XkgXWr0{tD+bzDVL zDHZKJ&;O7_I19b(*SY#e-+}HWAs*iFdaJ(}V$jpxuOj3uam1NnYw3^tzSo+ua*^`P z`_0FdY=}k3enT7s%~X#{nh1Q$$diK=+U_gPpcA;aixhkT&4gxQxs5?LT@eqrOj1P4 zg|-+U8)q<`G^w)L^v?J3QPKvrwOOeNuG|IpE4gzZ7B5>W9NN6D`W}8D95!a%=M!)7 z?loY}S8sB9tAD8d{(a5ndbh(K9qWDNm_$08Y@_Jtp;#=w=(?=7v<0QSYGcL+uSHMN zuAjF{Ts$smo=?#U#>OK=sT&<$_l3!E{;kl(ddq1B#sMkcdjy-XB3~Oe-PirIDygf` zr}%tqDksR{PuMW`wZG(8`fN1o#^eV-{t(el@b}D&7cn0gsfT>HNm%ly?c({j(y9%G z*I`&0tJVF{a0(kM3wkcWPyW^s9Q*ngc5yBmy1J{7L-!O)JTlU`jC^-YSFnxY&Vn^- zw%uVc`{kT5wLkTi^&G#m)R)aeU03rYJM7mGGwry&k3P8e6qC6IHp{&!8kUw%#6HL4 z$_A|?Uh=_PXFNZ#$E}-LgEEZR`}Y0rX}lMHinzs5^q9mJQ@CRnMl8>Q#;xn&mQ|(4 zt;26)f_<2bT5m$RXv9uf z$(~W@Oi&D;V{^We3sO-9-qROCmJS=x(%H-(8%k*c;6g(8kbG!5xd+?MOlOmvP9tcT zAI@-?vqY!P9O_(-6BT(OjUlIO6wHLF@+*O6RKFqNNB0r_yfMtYquMwQ1eYmy#g-Cn zR79HZ&@NHPz`Yq!1-=M*{5 zq_r7W<|HtC2&DZG$7YjnE>pdAW4qRj@6w^p zVOdhl62C9}LmiNgsB%h=W+a9cj>k?~GGwWP@ zoosSRu}!V$r^=6PhP$);L(-l-*4L=FL|&A=xOrS z%9bTsle1;V8eiZ(RF!vqjrXy#0{2VJ+yhZEy$Ku(O+Ms8mwA1S54{A|A0k!^;oT|h z?nkA7g;-N_#INM8Y{Mm^Oj>7Z6;{L{5ujkpwL$7+nB?DYEEo1%vi@oni{_fN4vJf~ zmE9<MR_NK{({ITBTM@t9zQi`UNi=bwhQN zh2cL|fk~)wCRWNhtyzu1fytZE1nz`@K*4^dSN^Nb=8)t=KvE9Z+Tq)Hc6fU`cxvSm z7|$q1W&QWJK^6L>Q`TQX%x8$c>rkpWcwa3SD~sG}IXr57f|J3L;3)2Q8}#efwh< zc3j$+>G7+e0HLJ}Ylc6Dr#pTeSNE(`E|3tcKIbeR+Vf@C)dCTnWtZEt?S6DVat&j} zlGkk|mXZ;0Qb!H*A1G$$=A!0LXmTN#C3=lKXHd>Yafc0=5@n>NPaeb)VXZDI-yyhf zTor<f)iB0h9Z1d7q zM0QHc@wJ&kOMBtk+kRTlJkFyvvF!3#8DQ&uhlZETwK83wFZSXb+R&pJDM_!V7*w#v z8_ug(!`SRZaEaSV=y1Gog=c%9q1ff{n=R^GdLH?;oIP%qF{OB8`zaSm5zaC~W6X-j zCK29f4kQF&b3@+8@|QM5$8F=fb-lT5|2S5}RIYE_}ihR^vx zIdWM{lvf*M;{XPH(|1e>{uYOahpg#7jS~Y4gr1S9K@qRsu7F+68XgSN;C6oc{mmALsc+q$g$=ChYyb32`}N#c_joOxqaZril zg;FhVw^V0IPzFcEG3OKZ$9N|OWxp$zG_Uwo!r<{lFl%d`-vxQW0v!Kmp+$)G4h0=i zt!wUb%rWPnSR>Al3%&u&m!n+6*MiphhiAHj8%W|lJQye~6@)hehMY}{Z@Nw`j|W!2 zyfXOXknwrk8sUUHZB}iNzU+nd5$6Zr_yCN1b2^Ciq#Sjh3js8b9^z{EA8Ya7CCOy2 z*H{myzP5;Yz$yRc-`z@h`RYNX7=e7;`VtF}Q5I4sE-f{2EhTRDYin+JT8=}g64$nnn>RNNvhGhXsiFajbURa3b_bK)+1Td3wa4i+yleyQCT%5VvgVMhc-kH*I^rD6#YuM%IiI(lKd zeO{&sgOTXrBJfGzNTs%y{k6R(6IJO!B{A2=WYkZ*Upyy}!ln2YL3tYG05aH}Ef_E3 zjuKE}Oj_GKXk_dir&BdWWc)&2(g@ahr&%wgP*N+-j)#{m^!8`e-WkEp#)!$`TUWZW zS5UJZqVMT=90Y1>`u7JUY?OcOs6eGbwhhWtz&mJ&L$=yC8*VVu`|{x&On;8pecyD7k{^hgEp% zc6-;$4nJX=ytjWqYMo`rX(U(Lm;DtAJJmSoRS0H`ENMaupEAerFT&|=m~Z_;19lsb z9)Bc#8=)SHLG`GtTjf|~rZJFBGvPeQ^gL--L-;u2xA0;MgXz7*wAHM1;K*Bn-#y7e zbT3aalTwR%ZxpI3>$UY1Nd9(T09#uRpIqUj*U$i}EzmHWtS zad;M2uR-LSmt_K3mVJydcMb`bV-iWTl$`qjKPj%V>Kx^=p#jC;=2YvIglPB6ep(=X z-DGJxSWD6Ons#K}Uxl{coqK2K9jzTmzx_|0S|2}bLk|gb?|(^W-2_kFjUHc`supm+ z_}k-x`(X)9U45^V7>e)0;)~&4D=RBP9tSr7iuoMHfA)K4r!Zdh2DKqOJTgi4W(;8DSy7 z8*Y}C4s~2xexv(&b>VUOSg!pPYU|!vVa}gc{meE4;=dzpNgJ^eomKO^2LE9k)@phh zE;TKs96*ApXNO$2qIGyrjewus54vLXf2k*MKsK2A>Qp;xso{}#>nbXk21+rpFIGGb zUgAj&dwb7nH_^MBekm7oRIm7W)U|uX00aDE_>x^EA%BF z!3Z-O?b?7MaK=UtE7<{bB&qYHvX!=Q0(=n@L~<31>k8et%9~!ag0me7 z3kyN{OwMnMO<=_Bmpfw85f+C`Lf>?!;d+ww2c6D%9XGU%QkvMW)V#>r#^!0OPp}X! zMc!1A<1BfIY=Q1(df5uDuaPm$S-)u)Au%zLk|D)Hl(T~wGBjO!=GQIaHiUzdm2ZDH zVe6CDXW+7IA57xlNQ9Z*P|Zqa8=)&GWVZsD zrc}(dw30f+VGmntHyTXH^`_f7GUX#2U@Pb`7K*`61o#X#ZG~<_m<%1%BH|%B9iH;O zqlXt06k%bxKdcIr0vBkFPVsygmHogoZA{d8O^>|fC|NL-CrobTW<|XThJFiDMM$;A zLJj3FV`3n184VLLG_98U`uf{jl5}qohgEr1-V^i_{D*N$K>KSLCjFkxfhsSs%mIU1 zL|L0M_WRYXw7_v5U%Va3;!ERF^w5BkXWE3d1LEaJrse5X7ixEgtU-@!n$CLodJU6w zeOA_iS0od*3MSuNWYV)uk|iPj&&HVn!E?A=n9Ij;;XbqE*4UluCVs$p82m^IC>MZ zANA!NLWDL^Xc86W!KuVaq2|}ff?wxM4e1BL)+T_fO;959!WaCBI8P>StBx9)&E|LU zojz_4n|!0;^LX*hsLQ!5X;lBLiCd8Hu$#Jb3kuWU9Yhr4sh)*9j7?ud{7C)+O>BQ6 zrnaN$MeR(SN3!g@aoPG9m5>~s?f4r`7CO&?_Y+nw;|A&GV`{P`18HAW{+S>**qUAK zpU&2`m*a`1@0@=lywNhsla;T`u%otB8nsFnJaRQ>mLpj0*3=3EBpSqZ>gK=#`DkVM zin`IVy0v(km}=nNvNrSjCz>&cEuHSbJt9EquiJUvGE+vENJ%yKE08koY5z zJt9kyk63|xd0y1Q$iHSG0KvzYHSAUizh>vcU?G6RA$wsGkWDUP#Hwj}{Sn>6i*&_pfi8ag67hjqp$N?AxTwHQD9*7E*bMQjv=SFtn8d zU>VrUOeR}cM<_WuM(UUec;%$$-j{$)i$>NL8cHG$JF2C-Mf0sq5M)ly^+@^3sM*YO zgl}CkU;3z9?U+>#V!kg}IC{8N9L9AjeLI|x8fYC@iUBz$Kqzo2PskjiQ^=f}?ff!c z_L{*Ip>=;8Go_RAz%A}|?Lyt++6z>pUF)!=Ldlnn3E>TM6N6jTbtK9fa-s#!d@D{= zY!XEr{TllU;C@QZzQR7{2{XqUg4mgHYfu|LkJ4B`{s^td&xk`K2C3vRdGI>9-6#Up zpiQ^83CA{CFg@QG+%STWXt3`BX)zK8i)MJoT~w5y=aVcmR&3l@im0jT7u+}Pp`2m# z-s95KT~@0fT2%9KZFzR~D?9%@v019MHHU_d-WnNzntEngES8Prq42}e zh}|+=8S6Ue8%`Hy=Bn7G1a_+_G0vLrNKr7Cq=~pSi{&PW`CQ_^tsrNx@WX0$`N>HB zdck0e2b$xVc~0LwXpLOof^TkY{qelFw$$`<)Z4*Ehap;P1kpvDHfXGox~j+MOnM1T zPUXjM1#>#{KTJYn_IIY?YoFPPY0XyS8h9$$AlKtWq8I)zZ2rF*NSTTXVi5=YztE5A zE|5sbWX}u;GzC)xBM+y<3;p#KCH4i#h;)lR;|hTX8oUDnDf&)W~IZDGxS6RHwqN2?y=NnxHse0BfnJP;>AvEb=P+faz2a@==AC5pmd zKfX+6mZemgPw6V46& zaV324h(DwSO=p#ZrPXY!npu+JT`vVu?C{NAkrfp@IAl}?PksB+C0+#KGVhSFo%EZ! zajg}q8WL@XNwXMda}B!KBE~qZ(3_y78kO~$@G<5u|P*j~W9HsZkJ%vr*!9Uq# zd4{bs3iUp|M=ftHx&-)tRC0ET&S$VJ;9&|je9fddb$}E! zVA552?KBvCr=$?Umhg5Om{$pH+D{DXj${{@`mlei`N9Y$@w1~pr0IK)CjU8$>nnM6 zn*e#}ji~f6ZSY=7`A(9EM5ZEFnVv5C>=U_sAu~@R9%(bI9h!& z7u~oR9*y1>_)B%(ylZdBwm0=HI}CTkghH@j7CCcljn9I4-dJg1$CvzSzxQrQ@w`Wb z2QK`W8CM%&%(=Gsu<5;K=w?v`d`zJNi}8m2cIkvfVIDusD?nh!ewe&^TnuOYM@#zR zJaH%?@lG9YL%c2Vf>E2``ZLQoVw1)=+!g<=Boe_@Z|>IJ$q{xe3boR=7!u>L+8>af z<;L_?fAuNQTK1RPB^2HG4uTo*lx^#ivr~4PlQm=}V&gZJ{`Qgf4d|b`mCli^yd)2p zL=N~xuzy~Okqvp%g*?UFi@qq@&#J}yJBk6gMrMT73ly#RjXI1`1+A_09dA6>zsyLJ zJNc-J+mPya&HH6WxE-4qG`|t~7GJ*yidEFYug8P=|IVb=?G#F9v@+}8nLJy&V=H6! z+Mv*=VuG%ESbqxb`b#&B;-ur|SC#E!@@{qUUoZRTi)T{SE+1|-37CCuYcn$x>j1d0 zKNMsajZB zT5>XpD^KNx9xc>fonNHXIh^H(&uW>inxpBF4-uCEDBzU&w{RYu3TOPZpwV$7Zk)VlNI5Ut%hxyL(DN@@x!6P=T9+-Nk25y9;hzK%)EsJOXF^U5e%oYjumTMI&!^ z%kspdq!PD*=&`n(ox9@dhk0!+P_eEq-xj|E7+(Cy%iX%mjOBcq5r zsnUHqGp+JI5vn0cS5;W6qq8eAy8D^9aXSQ=8xYPcF_+swK(E#igWED>{9~KT?~%H5;^_?sB>zis$2S;BZlly7O66 zv#e>VhTlQMxyb!`&h7iQQT7L!gSxK}+ahi1C~3Z%ggBa{#Kb+@E4Ic^KBiecv}+Rv zyh>ugG?tc4p%L**P@Gjf?h7?X%51Ug;B*6-6el>+Fl!#!Uvlj|x_s6-A3CXm^qZB}@$a_t-mlmWL=O zGJ{9Q`_+K+26s`(>)N?x^W$6zc;<`NxVj52c-2vJ!5UlEGgiqjgfp*dxFfVgIP!K) zmi#v-3#9jPl3Vy9)+*eO5VTp2-vn2i4t?c~*!kwtOZOY4YZy(&nissJ0Xq(kql)@H zt7)qst7bh%TmLC#W!>27v!(CUMZgSBvqYipHM9Bv_CZ~>?UDO#hU;Ec*@<~# zW0f*8lzkwy>xj8)=EKA9Pf1-H3~|!eOPdY`f@zbWB8YQEony4m^X@q{i2lae=fn&Z~qFvGAAqfioTsHzH9lsRv>Cr|K} z6OAwBwjRrHRUFADF|9vyi)`0p<&_O`?eITAPzMges-Z8%Nxnp%8-JeQFPe$8$S7(~ z-H%cbta%2bt# z?3~Cddok&v`AVss2Nc~WJGByj-@koGLH9vVVdwI2Zkbf=9N5B(FvX*k`}m4T7;Ksg zjd(orAJJymi^%C64L_}X-N9^$@3|$m)7XzcVP8Bdj_kOm53}&{QN=BaDK>FJ6j_g~ zqEk|+%g8551$+a#RdZ!Bj}sMK`%P!cyeaPTl(AjWPy-y#Z@qvwp%gfEB!GU}_H=is z{1alp8p_qpE8OQ@^RVf5E_)u>d9TkTO2oETwra{NBB2F21KLCcxk} zUqp7E_(G7JuyK~^Ai9Q;*Ouh26`qfF;4>RwSa;a}&P&<O4_!PSD`h;4nr*VM0!NQrTGA1efd0UAU;=y+)ceOA zJiEdJXE8Rc!F*70=nw2?hW)3$VHdn5=uR(jItn$JJiX$O|+$pp1 z*^K}hPneKUs0x)P?=wB+9`m-xp2@dG2}pp-!E?(V7vu_l*(G-W_Ki-qh$Ma|&Zn`c z@mrjN+gxQj?pE3=f*HvepEnCJz~z~%h85_A`#ECn_jyvJ zumJUWCca31gH%Vfp7*QfS2R}k8o#HoOvMaSfvpq-P;eWH%;8lN`SC1_|4Z-tf2r5K z+^Fm?_ci1ZLckQ69tR~P{)N8*d!coQ6EBoH1p=MF00V)-a}){sFAp0TF6)aC|KJ`! z&0i}AuCW85s2x54fN-PwhrUh+LT}n-^Q$rxVY#Tn`id!zkY_Z*%x-=`V7!2wuHD|s zl_nlt2s(a~%sES7^^4}@kT?vRr+M;#4+@|gPh&nj>&C)V2S2W;k1}ZN@TnS>x$?XH zpwz+5+t=y6?<;EC<$Rhu-fhqN|MV+iT#wu+GIud8+M1C9JEl%M@VQ%jMdq1rYIS%j|aEAsSAhMx}Vc!$q9&5cXaA874E5Cq# zqsp4u#!zp=)Jny&5uIpSLJQ;k;IBqkV9vG;RVnIHs@`9QC7!77teq-Qug@r;&tlWX z=W(f&gAS>7{PKLQVp?Dt3xVpcz)Or4-%lo))$uH7TRWi-)eeTte?{JgxKlqEhYYKz zr}mn+S+OVY)j4{#tM36GZzUbuy9(w5hgz~siilnVcLFbU4`|hgyNvGCP;g{1>0U-W~jqav3;ziV4;IWfQ?9_O1Mb^ zhfT;*uuc8A82J@x$@a|o4<6;XhW5QSd+^bh#7gsYlR1f9Uu_NiaQjqk6X7a+aI2V1 zwI&LKz5Ht7s>+iTUHVQ~`VM=^Hon)YVd_*Yq^_}H@$iJdg)#3f#ri;0%r_U*S8g%O6{3{3 zBA!t(vRe!AwZ#bF`w7RY30&Rex~X*HmR%m(%G}(DkS7Q96y2ahyHyJ7QxiMS)kosX z{1p9jOXu%j2ZCLM#BQmT9-VByJ6l=QX&oflSF>8<+9bN?>LDOuba7eb%^l^<=6Rsw>1L6aX%(6 zvb~Z+T7PKsK-a5d;&5sV#yk{xzpWH>bsmevCJt7X-7N@w?Mv~f4r-3i*?Q-tGhR`# zhEnD$ZmPB1BRj=3oJ}LeQ|X8jZH(&axHwe;SH3G3?x9akj)(s0&%z$p%N?gy$+{<& zHL=qqrLrpArRB;U+%*K(_aIs?4z4fks5_@96z#j`-8TNtw}wY4YF1`W9YB9jmv|$? z%snzEf?yfD)1-n!x6rJt^Iz=|5*R>c|M&9;m@WCXDV;x45o)V`q-HjuuJ}OSxxBcr z0`wPubOZ40`|G7>J;Y^+vo)UyC}!Ke1|T&Mdr)1m%T2$2(UIt+DxvxT@Cu|9hdV<# z$EqD8p2!One@y3#ax_17#kNZRqRUa_~1AuUDk|!+l$hpKCe%Undblg=dt@zF-y?y-wXS zz4StGJj<@90S3wpSWD4yDa=x07v;}s=%Qtir04E=12i}(s$eG5ZQ3A<8 z6DJG8$^d1PSlk&!;(9P$Yy)+83@aMYlm(XOsd8t#NV*pWD4CEll@9a>Nneqhm)$C$ zCcTFNWjhT2apeecE)gse?a9+>agsDK26r#{b8|h*9{4I)I+DAxk~u8JPbeW%T(j4@ zBC7!E!_S~_r?zB|HK*anCYt!lM1OpRsKwgCtQ!h_+k{900!f)Zb(WbIEGc7_St-aO zh}qK;mQ%i1_^D8gDW*ba3`_Y2k?EeIX_u)nEbYlM-PTbe*9E*v2t3W4Y%T&zdzX+|gM^CD~iI z_eF#QDAz{g&TJvRm%hqX4=e`y(ZfA^)V7{PNeH$8zM7B$M zoMk+26|L&KQtf7k?Q@W?`R(nPB)Z0mT(Mu}K0>=2#f-%h=Oi7<*!vg_N;HO9Gp@+@$jDVx7g=_6g`x9d(n0E%RbUv zl9q7)f1BfD!IH<2#Y@6g?-P#0NEUHO-pbG(QDcQ#fP6IqiV?&pGi>(Pq6ue|eP42j z+;ZX#%7k+@;IgG+X|~RVWtJ|4@U|h0e9q%kOs4+JbWmc}*?T^!h@sv^G?_;r`xi15hE`UYSikyLLgV~0^Fzc_&vL^2zmQX5--4eseDIO6g*QB~bzU>Yd<)EdDjKt!~n{ zSfPIu$xrGONTY1NYe)3CZmxMSdPSdVIc*ozt(tW!@3tc-D7phazSb8}l; zo9$``5ueRaE&y`rG}#G>jsBQ95j+x2E%x?0?AvRDK3`4{Z2ygd$Akl@zAt*N#!yaw zovZCw*yp%|i~XrdEmk@O=ySfga_Z}UYgp#6u`zR3183s2Qrf^ZnuD*+PWzJ-QT#^{ zzjz(CSTcS~wj%-a=u7@l*^&%EZq8mzZfsNn83I!FCIB8u*lysyH=YAzER^ItuP1Dn zT#d49w(kIjKom&JSdgw~>}T-#;)v-kjv!Y9L*A5-=ZjmPb>nvF%#2D3aWR>trKJh; z>-|}tP!|TLVTLINLXrBb@72{gpYRK4T9zq@7QeN--R|W@Nu|ImR3HIa0cTgtJo`Y3 zK%%6-hW@*05f3(+1f2QTGa4^43ihKvVbJa;)v9wlY<*9IE1;V5FHYpE!#Z_gxD6Ra zGA_+l9bXTgOSmw$Nh)<_E95qN3SNY|w$? ziBbOkM!N#eAa5}f2u|5d$gWaxay4W_A}of6h9(!L9Il@pb3`I+i$&lZ6Ror#|>eok4T%S@d2jDJ1zBizc`dZM=(fGA-< zD+i$w#bSiQD=@j*!DEKQtC0#_^7uSG0R6U&Cy?{n#=Q@F{s=Vt{Cei2aSmH;{!~r7 zrzZeI>i|FMJd(Wj8{DWZkYjWCR9ak-`XxY54T0a8K!b!ZeMVmGyf{v}N=iTtW&(6$ zrLg>qabGB)hQlkM#`oXd@j4G~Y`kOkbaNm&j0!OinR1AFu~8n zdK|Bg7OG>0=}tT^cKd@)I>lqcH^!e=l#j>yo0HB50=i@vk^0yFic%tWe$F-9pI44|V`RRz$(` zn*-NbooA5Mq^sQ^v>rgb7x^UBTXU4^fDGr2ZDyZY6a}o14ZMu=cCI$sh+e;9&T5ko z3&O7F6dT>neUl0TS2>{h|b%lH+9*~ zhfzMRW#y;C$~>j*rw7iqT*xZwt9Kjpq9XhJL$kAq9dq_4E9$y)h=m9W)&{ap@Mi(K z+Ft+&I3mKa>4iF|>BY-jdAl=mRb}ih@3WImkHZL8qjc`#K5Yq#3|?m`q}K%pTP05n=rS?PVV9>h9hAf%iYZ>Bti*_G>-L^8x% zUcx~GCY(ErzB*83Aq%#^I@}Pwg_&CFv~)aP>CAF04A@x8^8Wn^57ZoEsSJS}R#a6D z#WMmxFHI!LYNKtIni7zpvhH_(Qbe@TMyxFikmu5A{~-D*Y$Ky==IF%ASy7G;o5X&M0U74Fwn?(6y*14w_2ROXq;ueE*2B&zvSkLMrcP?3KOQ_;-d?; zpxS89zX6U_6hW*X#RHE&!BIX`CVDF8Mekhc(jjh6GbrhzAh@%w7Q65x@o)8h3PN)) zaGY3N#Fr!I3%1zauyN6ood|#i%4~V5*d(e16?5u%9=A{0=v#H}HSJy5HwIVG|hjI zBuvH2!sjl&U2ga3gwWDK6R2PInc*1eC_wiD&>aG>C)>zXPZ)IFk4*&~1B&Fb3T5|z zn>$V(;zGyOC*Dc^xgRcaCJQ`|?JosnFJAhH)YGpm4~gf3mzI{|4PJk|hXQtGr6u)I zER9;czP(+YB#;m-C_VcTd==eWIw4M_A#A0b)+1bf&God7?i0N+9X3-g;JUK!UCzPf zD@y;p##TDm0>|%4!sHz3q)Ia0{a~7oKEb0Rkn_@vg<|Betzkd`IP>vCizu4K61;)o z0y8Y8lZr2rFtou}Dt3!;EDpInW>)?oxG-l&5_r6r(#pSG3qaqS9x2-&u%-bLvaUlv z*WKEGttKs1L0)v07k9h2p)D;aDB#H)+CVmHTWSZ*RccHBS*O%iS{+8%8P%%%*rGdq z;XcpR@pO67SLyTTezkS5+99Y|l1tHqzeQZRjL|6+*Yj#tgX!HdU`gGG-u}sfHJrS~yj>muH+83a#p_yo6mVPzEBTJ?E|*QyZ1qlTru(7ax_ens(A$t;Z-JxN-V3zVh-1XnCAk-8cX$I zoaW{pn9o9#P)^H8*O5;nZ&N9Am(NoCc*g5NK9Q5~BxIxbcX({$-bRsG7z4#hHwa%G z)pd2bNWwy$Jj%@=c@g^WTrmMp>e=PD2SPHsImp+)ZT|a600cNlsjz=}`M(P#vb7bg z#}6+&+QCI!(XU{Q4_>hW*IyF0DT4al8<4z_@V@nlJ9=HRS)V} zbi*}lrE>ltOZ2OGb}Bg(n6L+h6&R>hdv=VA%@;XD#No4%o`oQ(9M(;NGnZRExYeCr zYFv(ooC3mr35>8J*kZy=Wd58!&QgkF0E4cekX~2>w&1y|)?-|lh#)lPTrN1APe=J9 z>yd-s#RYkYum6dGQUiGYG>~;uy}Bx2!U&9)$HDnRI|D^`!>%mrQ-h(GdB~?w7}2xX zdUmg#V<%ZMY`NT=uI@JpSdkxciVM#kO{|8)5c0Pq`$X#J+jxL3fk?^>Ax1tYAdK!J zcfv`5DX~scd~jpO*!wvKOD)D-ZXL#}r5SQXCQX??PI&j;I8=c{ZJZ$7K&y@lGK}QI zY96OL_1YoK^wob7K0e{h#Q+w``*YvX-4}15P8>Y_#HitsHR6a@fpj&n?=T3L%Pi%2 zNOE9*Ja@BHT<9N8_U`8MgA3W)EC~o$LHBey`$&?{~j0IkG5wsqrjxhbRW%C zjz~$wr-sl;2HJrK<{_f_g}Lxome9BKj@Y`Bxv5Nb$!%sgA=cyBWuhW zfZMJS>2DzY|9koT&yl!qO75as=iLm+3lM$R1aLl<1_-lW25V*oI1^oNb**&=fpCmi ze()`Plun_3h7dqAa0;jZn)5fV2mKBA0l4dVP@sQ?1bj+nEY)su*}N@#4JY(kSrjAK z0(g-BBtlv$1U#T(016B|aEQR=;sX_?U;jT9l&MOAJ2?6-mEEtv`N@SY=uYrR{-nh* z7WAjAf_@uoTKmkQP{?Z1cA+6a;Svynsl8A=sK8}7eRXGQ1! z1oIiqulOihEM{-duR!qd*=O2%3uHghdWfdRO1kAizQ1|Bm z9;VOJPzd?Pl9b%FLQZH}-Qw@Jw&&+KrK`tKnl~fk;)bOehqiGKM{}XWqo$!K(&I~_ zTW@Ea^nPz86lRu{^g;pea6cbNc>9izzx+1ObB(ZIL`+hD-e^+U$}S<*Bv-4beNus` zRBIz$9XcIle8h-Jo#90xH^?kK!BZ7qn9{y*M_aKN?+t8|p~3ul8nk^P*e?lUWSK0L z3E*=?3PkJot}Gnr1eBn@#v9Sg~Pw49aTDa+P$XL` zTca#;1wi7iygJ@JWsy85vC1aAsf)c>)b((0&5xNbNp(`im}A7WI5%4R3>JR>K&Y} zFFi*b!|#4*XuIo3Li6X>^N705`t%7T=bI6w(&{=H*aIZ*F;);u22I4+svykioyQ5U{te@V>6&%^{sGgd>@Qs?S>P42YC1cP7+QGs4n2EXUJ0G}nXSG?lL zm9o51Ar6s%3su^1a%RmTeShO2jXyw8D84LC9{ z)~NnG78eG*Cp8n+w@phr;#oi{-wF}^KdvvJ!sg}CEm!+L>*blUX!TZRe>@{!uY8m;EbA@1X8_xR)eMvuK5^Mvl#hY{O!KD#q;-W z>2sacX=a-HbzGm@r2F2?4nC9qW))xRrFD_vAK0F2+5Y!DJ!xOhvr1Fj>e4dDNF{-* z&lGMgthW9&E&G|p@;xbcL@SeauWSkK7`I)YS_gl4~&&kt{&SyCveP>RzYr5&Cq_-zsF6DU4Js~3eN`0MVV1?aZ zU?_0=G*A4h|MOr=(BdeAqfeG{7zvw8So5FB@O#7a=8kRE=IPezo4JJ^m}VTibUGu= z;no%JCn2fgQ`DIPbM1Zs=VWSszlaKc%DPtN?CT|GXPiBJTex-2jAzdS_ucw!u_(-E zW=YTd+Pg$k?RvkDpSH>Ty3-r8O%JbHw&h;b zp=Kl3`lzs*W-}(lSeM0wTBh3Ft@`l#${p6F;3RUoJ8n&kp3S7BGQ(pVzhzvHF!{Qi zBUtg?`E3)Q%-tP&Ye}vB?1L)CpZ7V3n(gk?+Q%N``F8f3MS^*uDreh7T$jxVvJbek z&cJ5=HtomZ(}Pk%Z_fUT5&Fy|Q3` z!$Mx`w52n@y?)X(2~@s6o|??lthHjt1m>serBOU*wSWU3O$uu-Hd?Y=^}{IdiAk_{ hYmAb|$9n(sr>;G> zqW4~+o?G&~&w1DSzO~Me^JCUMd+%%StGB%)bhMsOkTQ{iKp+ZL6-6)zgzpagpSX$- z0^!|*>3IVKJa_Pu$DmRy^D;2FVk5694+2%hke!+n0%H;v6+>VL<>$*EUb}OlB?xp^ zR#j16-`jLOz0Z04+erIi*)pmo?O@O}k_G=$64he@ZvMTyPa8>IvK_otq+pW>4$YR; z|Jt_E>Vwy??(mRWhga^U#d9{D;7^kJb@vEGDOVh`hhD{d#O10n)oJRZ12dBsXI#Wj zD`5OyUL9wFf=P??bsRR$C%581o6pYN|9EgPJ}yC-X7GHx(Ztwn;CH0*XS9ErQiSrZ z`I8IQ1t__f^KWO9h&4W9{zA^U#=NqMks0NjJYMNFOez&CT-?-iyt>hQnSIlVPxa`o z-gM=$ZdK!Ytb>cK{VbbIWU8%onNxB*i=T!C?#cdD{b4x~yByp{w%@0$x&@7zISYO# z?X3QXXPf?S+uoOL>QqAfq{O_U+g4V1zS>bWd#}@B3y!v{V)Sx-{Zgyb(V5f(uA>U7 zw3B0XyYAFEtS8HHHhSG7#(v>4tuG7|Nc_}~%4^8T$e2~fwF%CIegp;{yhSQ(t{)#W zy=rW1EZRhkV1NJiiJs%yoP>*<1x{r)_P+S3=(fIoJnu>Ksh=-ZQ}jTd(WvHm=rMe- zfy~!CQn?Cs4sI6MZTo(3a07Y&f#Zu8YBEs*eo~A?o2X?l4g6Ci`Q(^rI=3j(v2XA6 zCSq|q6=r7b>Ff|QYS45IXOx6&_vG|}c3O-!W<)+@I&S}P?!2rn-L=ZAW(i#uSRA7E zf;xPvv4{SC`5GR70ggV$M`9I_BMZFP@$|xn_E5$b{l+yfRO{ij4P7WBN!cTKAC%`&F%;(iO&4@X32GXq8WPc5)E(Ya?jd~!r{x3jD{4IUa$RtfUt1;mS=K|y`etPC;iUBe1C)2W|vb^#2w>noPl-TgC-(=>J43SMbE_6er1pE zyD->6o$?!yJv&)6j+31;a2yPhR5HV@i(FX1<*Cz4#3#TSx(Z}pT2l0h2Zm5lQgS3k z#BEQTnE3naia1{5@KX6!f!xl_R@9iKn#6%SCJl}a44@ts^h18=01s@MPgv_4-Ulk2 zQS=RxfK2TR@>agzE(kL|x}hZk$E~phrAMwih`=$lQajkieqq+j6mRy-fU$TdEt(hkG(zcOB?8(#uU~KDYg9>*^v^s%0u9Em~J=TVJUl zV4n0{hU6ioi zpe?B$m4;FMjlk%0c3IzZ5}L(u zQxf#*Peyn`baeE>0(O04L(M3LSul*a_DuW*1GItvVt5ChXeYz8YSXYVRm>U1k?k^| zg*KU;weWss{K+$b;kO7~WlV7jNbYU_l28eYeb28G>RIfL5RQsG{voO@tIiR7?hlV zEWfg9DKNUoJM>KkGzX*GodP{dkU;PF7J>wtyN*yP9c!b8Q3gBwDHR;A4Y<~KorhB% zqk=<5P~l2-%DG;yr)kh@DlU7o5~T)T(oC~0IzxM?ByvtX9sD}X9OX_! zjCRm;nH+ryM{yOKq!*d}0=AKU9K|ghtdCI>1j;=spDSEZu4#&YGC8^ti(0ukCQlgs zp&|RqD9%e?AmaE*>%NhiZnWLwlZBcw)@u2NAp*3+{O|S&FAnPvIEu$6lR4FnQzKRg z?Lg-`x>MHtJ1;_=0*%ZpDJ{J#8-0H0H3=V$5lprnju2Wixm&>JBSdO z?(V{Kn8e+)*GB_tcoP;0OUz8C{PY5vK|hu~cEp@4a;Q&-zNpq9zu*_zEn@pPMfuim zH|N3O(~S!gtSUwgLZ)a3ivdapQOs?>_96+**b)wZJ1A*9T`)XK!O3oNY_!)uW-D<_ zBn&X#T{pY1>r1_HOOlr+cThrRpExc~jSJVm&_e z!acv(Uu;FcvHQ^%bXI9;*X0P^jdZ3=BPmp8rbmAH_ANIk+$Q!&Tfc5y?SR>A=FiZz zW)+LYdXLe~<&MMiFkk%!=h3Uj^ZRHvMDW*{8FNF;)aqjDQB42VN!!5m?VqslaN1Y1 z5#Y(~4+*`!n)Wf^(2@tFqXsevl#v!DA@JE_CJoHJ8l;_iprvsWseA+Y?xP`-;KoLo zMGlL?*dGze`|zmvUHK2B!GMl!hkb>78zKoXse4=u&M!WZYDDOc;Zk%pYd8<@w#gDA zieD4coxlv5h-k? zCyh?(RpJ1((5l2D)6uihFm4+Pg_n3A*uG96+$!hozg&v^2LciLOo3S_TwMCUa}A4A0jReC~E z?DTMNDZ;WY{+qX4BB!WGeQ4H-o!dOA?<;ew=&b^fjym;R%8jR`T6c**A+80J#Iix9 z?AmWbLHXU+HY5c*B8eX8htmxwfdt8CN|}%B%iWK=LU@Uvav@j136V8>cJ^$;rd1QG zMFl<`XoLA_w5Z#B#9ZVd0YS^VK9f7cNh+THoNs>d6n7^=_AitRiz5S--ta-s--hpi z{&K$EqSa7S)2>=d4q~9;Y*_8=>@?Bg8J7fIBXQ&G%e@wp3NB8Y9j8ldam3D%^{d44 zHaCi~urgRGWl6I^AL-H?GPU04kw$Bk790>w9!+7v1lxE zc)DXawd`PODPVJK0kuqf?l%AA;`CIHI~uRfmm=Cf{pe84Ea=k#nh(3?a=JEKX$b=8 z7T;m1Y;JCDYWlXRWeS7+92toVWdLH26zRj6s*B%6>)Am;i%tdjgdG@*>5j#a=ze5b z6HmnU_szrJ)n4xV0yQcXH*emA-+eVZ``l1&_Kl8PLNII<6z$Klbnm*cv2i>rLQg{BMaSTi;;Ha0dffk9P*Vjb>5DMzwj!EB=1B2A2pEL^{Z4KidT zCpoa^K8@hStHZJd9erlqd3e0NT~WvSd1h-%r%SEv&DMFs#dcX)Q{p%W8d|SeD9a$rF=5}(%F=Muw=Vj!M)nE~X@rAV zLSVDNK2axTMFY?-NK&n=>Dc}?gk;Em*`|Q=@z}vY=D9vK_uwaCm?zt?^mko$A+%aK zY@OA&Ok7-inlI6VRAiGJnoh#}n@Lay`Q_Iy{0MUi@4Q-PSiQ$}Hr^r4xgR_;Z(-Wn+Nu>_Lrb!w0i0ae8)oD(N*^)~6}7ecs!~4qXtYs9YI!?bKS~C9 z-2K{?C1)nlna%<&J^kVsV`=s4Eli%BCV`hEN>L$5RVp!O@oc3NJ#0T&E@#9u`6Gy~ zx<6F)^FyOrYI@g{&Pe^lMLJ=(C~eP2kRCaI);5d-)T+u2ROj2vF>n7Xq|&jjYi(zg zM`1?E8g%CgjxblUi23RVA$AeHIZ`5g08BsT(Wu4|rx%zftLh;4QD@Xd5} z+BjsK=M}(-2j25`fS$1Ylq)q2yF>NY8UJxIf}0&U2bZ}JioZCm%VB1I>mtYf!FIQM zL2@j0_#l6f5n&e7OCuREFMcT%8Boi^Uq3d@Qj~3k3wuBG^swX?09nVn+TjATV7-|*$3lrM_Lz?cqm7hS+aBKQ zTB+(d4`bg0nSBO_Ck9JPHoZQTSADV#6c{1%f;7QKU_~T+!KiC>PeqY>ASS;1`TP($ z!rGS~wUQ-gU74%VkFq2>*1zR;Yx7|p7+qntwfN>@wsAB zuIHM*KvClB4dM%4`D}*};QmTbh6fUqy+q;7%3wtJ%t#Ii(kJLUX%R0Vlw){|9GS6i zdjIpQ%^voO5uuz5roOsKIb;?nV`$AxOy(`&F6hx{a(y9zy6HE^I!*6$h#z-MFgD@k zVC-H$utOb;GAx3Ekp@y5X=QHZygzT38tiA@FyDIpmXaHL!~?bUlq><47P+mNYvkhK zQf~+Z2WpM-gu(9MdNf*b`|K=03)nVxI~+o1&RRRXA-xuBB5LHD7?c8$qRPp6gZDuf zhPpw?XvEpMoKdzhbx`Qe%i49l*iK(<3Hw43Y43V6KLYCExMPQtt?Tu1A_3`;Ly>Ul zZGRjk+{%_NxI!o%vYuf4=O38$CuIq)Axpp34#f6)$ll0msQA+;ULrB83kZgyWF|9* zRudezZ8L5@KZa|1HE``ysTcuZNPRsXMV>P408d&Zu}%hv+S za~jPF&_tSrs*?i_|h*T-#Fn^|CJd;5Ee`(yCN{nn&ZKj>*uZj#&ml0K*jM6@l+O z-R`(>3+U6B5cA#L0(1IOQpCxdB}xIg54K|2GcC^F_jn`*N-;^ z7*jtBl|veQ{IRk(Dl{ipo60jVU-{ZN%38148ifjf^s~m*Ti%^jWw8jxQg2IeiPVT< z@P5!r^D}E$AYFNm0Ux^KW*8w$w&g^;74>U{KdeCTh2tZ_H;E^P@1u;aqzo!4BWWW> zc+e{kzT0yO-bom|%0Zp{I$mpcJ`NAuISqXuh5gHMSelKp8 zLkhP&dUT<0k^JZAp$u(N{-%p`=j5%+E0@bIu#({qnCE{TJD4hy_LK>O3HlYUPYQ==(0kEVY-k-gaO21+swl^C1Z!8taozcl%H?{so4 z-*a+uQuQV8>FcXvqNk_l=nnP$+TG2U^RyFZ>CpG>zs_wjx-}JIWMX1 z&;aX&4?C`ph>J+57=kV(XwUKv(r%98;^Hc4xx96ONP2CI&vZ?^c<=r%@+MnPDORwb zXfR~=8Cp#R;!}Q5NOgZ%UWY50e#Wx;z%eZaV6}xF1(Xyt68Q?A_d4)}LFg3Xp_Q|f z!)52?p{}+ZVX*4rv%6@X3Xi8qg-(PhOAmfNs%}DkW})|H^_H94e3v%ANqxumf2fn= z#H5&&qPP2GPaKH{nO>~+qYzT)Tp3j=?f+oRDmLoX%gl-jTF!gVfww{_B6d3>J1s43 zZGGLd!9)}%<+Y*Gy7jM6cuEXN!LgK1(r8JkcebblCooNq(ggm$>%}NwJqaHz>7etL zCcdM0X6EA^T^b;<=rd*fOVvE49;lgUx#VwBp|G@sCHqTD9rxUWg3R1R23eDy-u_o; z2L1MF4#TDL$d(YM^jJknG3QCa=kfREnj=zJbLs_5{gf)ff+Fjey5%XPqhgWHQl1(g zPxPQ(h!B-hF)Z@mJEft%`7#Gg3BCbBg&I|qm&--*M=*HoEUS0~1Vptp`W@zeW0+P& z0A_q@(_DKDG_XnI_o@{&V=FO2p#rV3pJ$~fJs3K!a_tY}g zz5*}o`8?njL8q-=w*ul1&u2HJz<1QnPFkMb$g0LZFCPBne{v2zakkXhv?%mpt?i$d zNR{4l7ahs>g~Jz8i*95s1WcM-v|Tw`O2fbek(5L_=$lF^BHs6&Fft0m+p$NJMO z3nyJtQZgr@hWNg+yj+x<@W;XVuHOhtHu=iyHhJ>u(&7283kPl9>&uBInJhm-pHZ^d zd7kYYmzys?dY@$wOOtfv)mrJo%LfU^>XNt2&_L5~eBaV+q4Z(G5BnTW_qS163JP)7 z*Ot*tGA4>2sO&{k_G%^)NhO^hGt_}=^eXei&))eRML;1oNj6IQ{51re&3lOk`@sHAgb6IBW4jttnaY$DfUHiXt$WYA1& zeZ1Z#5TN|`lIJ*a`sLIs{>%vTG0<#XLoRiHH%EfBlGOi_jKl zmSyk^2>9I|7*cy?al&;16ZUh88ckwZ|5Q`4Pcz2VKz zyyr7fQYTHUXj1E_A_rVk_+-Uq)ri-Oc($#lc=$#9i-`Kk)G$a$FB-#iD^;0cy&{O{ zjy3J}HvcC_-X(@%asZQtF%nI<@d1(X?uj0F?Wda7fV~Nj=z8}s#jiiu-OInA(u^0T zsHm{(C$4U+(E^D0MvMxz{7drxNR0oTO`*u12}szdzc{NS5b zEKePi)Kqm}U~?v94rBw&>Npp#l-vq@mB!}$dHY?4Z+iI20t)~vQs4^>Llk^Vd-#9` z7=Dm8a34bN$|1Ceir*5%Xx5CWh&Ukp?>d&r?)dE7=CL21t3_M|UQ#56jfB{&dPzh8 z67?fUOejQOGf^oRIW9r2a~S^yKV=%k-MzciZ;NqBuRx5c6Mb>W=gdaxaYu<_2SwWL z0gei35$;1R36I+??vVB!Wt&>#$Yu=QI4@s;z7=>zr~GD6L!Be2$%r$+V>E>?H$NAk zPCpbt#6MuDE@ud-E&?!vz6Splj*zKMui&8f<>jQnr401nZ%^91x?KApLL|jom(z+h zGct-Ff8iArG{qnKXTk8Bo5;@(8yg#?dWqLXMMb@ffIfMIcB=Kv2snZNx$Dq%g*vXX z&X}e|f=fvUcR$^z8Z|d}HFpY#`utU$KE3}->~cw0Pft!^m&mMko*TROwL#AzTf-_P zd9|>VID;Y$)g@a;6KfJ_AK>*Xn4zI+lnUpuI|0A7RPwQoacppM;o9-X_1D)Q>0js) zs=CT};U#F9CJ>bZ&~gkXxMz~u^9==x*s)TjG=wJqir>59Urd>%s&8)@6bu$24T0FB z+VQIs+a(ca1(4h$xZm7&`OKyf--@;0hzFPNE-o%=p0BJFnylu`dAjpQY^|HeZ~ngS zLy(l~l2#L8{s~>~hO%jN!R#%DcpdVQ26m|qU2EkjkSFtudqO{6jl_vWB&%l9P*?OP zqPp(s6dKG)BVJeG>s%4%1%;_fh>&YWmh^}sZH4yg6!qMN(>)~$5rz&`#l`VQp<0{{ z&)onzvaSN+*@?AP`S@P9M-*c#1QUH9BeCKOUmv*CT97REF3^j4!~E1>=+DJ5aa!WK#mE(5_##G zx&L>H1WWqItApcbW|Tiq_TPV%8x#F55KLZS#VNk(x7p}rtZ=;(KWhVE{~iq^m%e4~ z_rhF%wA;{9eqoyb^Ox!_kRAQ=h>ve9@pQbVOF)U?^Y%PURb}4?vd`&VAIWw;R5cjL zr5-L;JzJ`+y1U5vAKYD!{hrZw6DmLro+_(+NfWuR_S7zv+uGkF^sO>VjNl)Bbtnxf zZ+IF+8JH-ctkUW120S2ZvHL$>d^|6QRjXYRb!kqqME__AWcNR&3h^$ESGonvrhYH| z=9;{~*4*<4UQJlbWX`@il=-_~C=}^l{SPvwbJxT4^FC8)$tg?TUdD5enUl=(({{7< z=Iu@ArX)Hm{C{M5x|o?6q{fwXn0ZRo&i#bEy-${(H5MS{kDYAA4%A$13P1w~PbO<_ z3EUS0h+-fEq@Rx+;cCykIG%rGa?~{IPe8!;m}qTW`|L!@Sqj&GxxE6=4_j(jSQsxf zPzbm&(9TMkcmYl7k!PVly)5N{ho?%@;`?teDS6h_VkmFue=uSLErpGYj>dZ+BxGbJ z#>YKi?mx?$nv_@LMDkY3>|Oqa&~oX-Buy( z?nVJuKFqgnsW#p_3kpVY@y*`9fhCor2&oFK6vV3O|A1+0X?4inGW!Hy zUuoIJiVv5Wc?}6adX%};1u$q2B#6XU>m`bq9t8HuErIc=srQxH%q%SNA4gYnwc{#5 zfT%^TU`e~$nwT8f!3$zoJ{-U*JE2v1MTL2pzpJY}=|h(xo*w}gH(g?2p@HrC=n(`I zru?ivAUT{N4CcQzji){qa%sjSGY_?}!&rER(ROyNtASkMR0u9d|ASVH!qF zqsLI<-BKAKww2zw-u=D3LB>QWL1tFg?lzh$SR>B6YbDG}3RV@jfqer#z z`(AK3aIeWs92E}qBppI5&tY3(Pgs{P)|5`HTwaA#MFYwKweUI`i^R;&E$;0B1%B@~ z7A@B#g-~z!$|iQUv!AXVbUxb`=(-PdvYck8!%#Cd!`ss(v-m*t*$UTn1R9Zh+qZ-) z(H;<>Y-itJX=`r&opQPlkQYtnCN4R}A$8h~V72-wnC1xsoC%a67>W93CJ}gcyib}Q zlXTfT@4X#1{k=P|8!ZscGF|dHZl(lFp7iMQ{xx0 zSi_5>uuVy=WUjrY!}XYqpwJrydd7w(k}gA6>12Q?shsFUo@30C~IZw-DwW&3Y>_Svq_j) z12C7D_9hfWdRLs|2&~Lay%eyLk*LwKS04ot%l>!-Hc>it?hrw~>5{Db@2X_?2lbe_ zpCPY!PC416cjbm57QRK@Tv+Pu>r;OLNbUM`2^*ISMCZlcjYe_aBiX{r%DsS#~R9O{lyn;fxMFb zeB_(U`ltan=(mg3u`AXH$Q7|PmjPqyY{Lr$Sq0oKcJHeAq#Tzy7(_H9UGA|AZnZmO z6n6j;T?a`Top;B`NV0Iw?H&=T?PU>V|8yw;NgCZ8;OnOxFG`U}WR+;yjLsJ`4WN_f zwNeVHQhsKW?h;%Dxi0R2Swb_VST}GD4Bl9sSml)>_QHaDDs zuj0|;Ulj)Uf~0_DM+)v@iz^>i-%i$$lBz7v8v5u;#-La7!;>27G))L@jJr|YwMJ3- z>j#zQh!AM!Pql$@9hxz>L0kc`QCY zBPd&DP)Dab#n)F!{?*H_tk6rZ1d?w;uaJF|XvIndL^U}={j=ffpY;5#N6Mi%tdf{# z{8tA%w=$zAqyc;_CauHTk#GyJG7uX@T2=njoG4NGv7>j_l_>@-vZ_`*CCPu1PXiGY zbV38qopmhs2V+L03PaEC0d#|E>i7m*U|6V=8gEWY2h)8dTK^ z)S*WX0zyE!9Za3JpA#eNyHZqe1SJYi{sq_?I{^svj79b|h-W=Ahu+q_11N++s!Cdl JrH`M5{vVjn{nY>f literal 0 HcmV?d00001 diff --git a/education/windows/images/deploy-win-10-school-figure6.png b/education/windows/images/deploy-win-10-school-figure6.png new file mode 100644 index 0000000000000000000000000000000000000000..09552a448a0b36bcca641eb5dedf09114b02f691 GIT binary patch literal 18525 zcmb5V1z256uqL_*8VC?H!QCMcTtgtZY#f5SyIXJ)+}+(RxI+@$T{rHwA-I!SJWzgVC!y{L0-<$1|HAay78`*;;%AZ~LdtGB z(2T<&_p#EEHth1jM4D1rtv!k{^a?C!^ssKQa6yLfNhHV*jiV?tBzSsEL7! zL5L~_d5uXe?y@tEd_0kl{!54;tXt8)pxBTs4hzL{7|ct?4nu&rne%d-@}|wQ-L~R! zwsfe{tK|NCGpF66LZ$3oS*Ays#aw}7UURZ>t973>Y+Y08G_wvEeT4(ucL z93K6oV{{F9_*oNCl=Yo~Wk?nGT)ja^4ih)DYlkFF{g1J9A)kiTd=59? z)HDS#>WL%HNqH}auKFp^vjlx~5U?+G8n9?0bz5Cz5jNHeQXLj_I`?HtTZ(>WBJG`zmAN^f+c=#JvOwpF_tJV(f7AlG14W&3EZ7-_VEOT zQENAZKXNYAWN>?@V=1z{Yl?s}2SVs8&vAKt{&9g7z{2g$kcrJ(dkSh*#IHn#Wic zO1+73;YP^fiIWFqW;C8!C<4D4qmrrTsth*gRX3iytG$ zc(W5`XAl8i*|RhMWjXu&{?)FhI+>bcV#U?X&}@DW+mIM1h1<`In$ztDu1szZPRQnst%{E15o zzg49!;@s_FyVd@*_X4fRggqA3-c3kkN-@fEmFQk$s@-jl?HQ_E=bv48{PNS9W=|op`ByTrTO{j@|Wt`+RhOYv*~N12DGv$=a4b4Sj0Z&v^Q6juEIN$ z5{zF=WAey`3O$Dv?v2B=>HB;#+*5J)qXci}%o9gig)=Mj#gI-)O>ir`O`(2>$Ga1? zan1`8fWmlO3?(r;3J+3KwokDim&z3yYwGG|*<@;=q!)JHAGcVx6b2U*P)SnNx}NM6 z#+(i{*xf_lF&U@WQ=B#N3J^_u?#Fs00LNoBbMT_d!kQj5>OH=GVAmf@Fh_I-q`Z+VvQjS`~B_8 z2WX65KDtCW2aT}1HvI0ZdmSRRRty4z`4?5AIv15!B2*NM^^SU;L9{O1G_GhWOLa-b8t?(W7*K2)9Mdv=y+(~DNbh>!Gx?D!W}0XkgXWr0{tD+bzDVL zDHZKJ&;O7_I19b(*SY#e-+}HWAs*iFdaJ(}V$jpxuOj3uam1NnYw3^tzSo+ua*^`P z`_0FdY=}k3enT7s%~X#{nh1Q$$diK=+U_gPpcA;aixhkT&4gxQxs5?LT@eqrOj1P4 zg|-+U8)q<`G^w)L^v?J3QPKvrwOOeNuG|IpE4gzZ7B5>W9NN6D`W}8D95!a%=M!)7 z?loY}S8sB9tAD8d{(a5ndbh(K9qWDNm_$08Y@_Jtp;#=w=(?=7v<0QSYGcL+uSHMN zuAjF{Ts$smo=?#U#>OK=sT&<$_l3!E{;kl(ddq1B#sMkcdjy-XB3~Oe-PirIDygf` zr}%tqDksR{PuMW`wZG(8`fN1o#^eV-{t(el@b}D&7cn0gsfT>HNm%ly?c({j(y9%G z*I`&0tJVF{a0(kM3wkcWPyW^s9Q*ngc5yBmy1J{7L-!O)JTlU`jC^-YSFnxY&Vn^- zw%uVc`{kT5wLkTi^&G#m)R)aeU03rYJM7mGGwry&k3P8e6qC6IHp{&!8kUw%#6HL4 z$_A|?Uh=_PXFNZ#$E}-LgEEZR`}Y0rX}lMHinzs5^q9mJQ@CRnMl8>Q#;xn&mQ|(4 zt;26)f_<2bT5m$RXv9uf z$(~W@Oi&D;V{^We3sO-9-qROCmJS=x(%H-(8%k*c;6g(8kbG!5xd+?MOlOmvP9tcT zAI@-?vqY!P9O_(-6BT(OjUlIO6wHLF@+*O6RKFqNNB0r_yfMtYquMwQ1eYmy#g-Cn zR79HZ&@NHPz`Yq!1-=M*{5 zq_r7W<|HtC2&DZG$7YjnE>pdAW4qRj@6w^p zVOdhl62C9}LmiNgsB%h=W+a9cj>k?~GGwWP@ zoosSRu}!V$r^=6PhP$);L(-l-*4L=FL|&A=xOrS z%9bTsle1;V8eiZ(RF!vqjrXy#0{2VJ+yhZEy$Ku(O+Ms8mwA1S54{A|A0k!^;oT|h z?nkA7g;-N_#INM8Y{Mm^Oj>7Z6;{L{5ujkpwL$7+nB?DYEEo1%vi@oni{_fN4vJf~ zmE9<MR_NK{({ITBTM@t9zQi`UNi=bwhQN zh2cL|fk~)wCRWNhtyzu1fytZE1nz`@K*4^dSN^Nb=8)t=KvE9Z+Tq)Hc6fU`cxvSm z7|$q1W&QWJK^6L>Q`TQX%x8$c>rkpWcwa3SD~sG}IXr57f|J3L;3)2Q8}#efwh< zc3j$+>G7+e0HLJ}Ylc6Dr#pTeSNE(`E|3tcKIbeR+Vf@C)dCTnWtZEt?S6DVat&j} zlGkk|mXZ;0Qb!H*A1G$$=A!0LXmTN#C3=lKXHd>Yafc0=5@n>NPaeb)VXZDI-yyhf zTor<f)iB0h9Z1d7q zM0QHc@wJ&kOMBtk+kRTlJkFyvvF!3#8DQ&uhlZETwK83wFZSXb+R&pJDM_!V7*w#v z8_ug(!`SRZaEaSV=y1Gog=c%9q1ff{n=R^GdLH?;oIP%qF{OB8`zaSm5zaC~W6X-j zCK29f4kQF&b3@+8@|QM5$8F=fb-lT5|2S5}RIYE_}ihR^vx zIdWM{lvf*M;{XPH(|1e>{uYOahpg#7jS~Y4gr1S9K@qRsu7F+68XgSN;C6oc{mmALsc+q$g$=ChYyb32`}N#c_joOxqaZril zg;FhVw^V0IPzFcEG3OKZ$9N|OWxp$zG_Uwo!r<{lFl%d`-vxQW0v!Kmp+$)G4h0=i zt!wUb%rWPnSR>Al3%&u&m!n+6*MiphhiAHj8%W|lJQye~6@)hehMY}{Z@Nw`j|W!2 zyfXOXknwrk8sUUHZB}iNzU+nd5$6Zr_yCN1b2^Ciq#Sjh3js8b9^z{EA8Ya7CCOy2 z*H{myzP5;Yz$yRc-`z@h`RYNX7=e7;`VtF}Q5I4sE-f{2EhTRDYin+JT8=}g64$nnn>RNNvhGhXsiFajbURa3b_bK)+1Td3wa4i+yleyQCT%5VvgVMhc-kH*I^rD6#YuM%IiI(lKd zeO{&sgOTXrBJfGzNTs%y{k6R(6IJO!B{A2=WYkZ*Upyy}!ln2YL3tYG05aH}Ef_E3 zjuKE}Oj_GKXk_dir&BdWWc)&2(g@ahr&%wgP*N+-j)#{m^!8`e-WkEp#)!$`TUWZW zS5UJZqVMT=90Y1>`u7JUY?OcOs6eGbwhhWtz&mJ&L$=yC8*VVu`|{x&On;8pecyD7k{^hgEp% zc6-;$4nJX=ytjWqYMo`rX(U(Lm;DtAJJmSoRS0H`ENMaupEAerFT&|=m~Z_;19lsb z9)Bc#8=)SHLG`GtTjf|~rZJFBGvPeQ^gL--L-;u2xA0;MgXz7*wAHM1;K*Bn-#y7e zbT3aalTwR%ZxpI3>$UY1Nd9(T09#uRpIqUj*U$i}EzmHWtS zad;M2uR-LSmt_K3mVJydcMb`bV-iWTl$`qjKPj%V>Kx^=p#jC;=2YvIglPB6ep(=X z-DGJxSWD6Ons#K}Uxl{coqK2K9jzTmzx_|0S|2}bLk|gb?|(^W-2_kFjUHc`supm+ z_}k-x`(X)9U45^V7>e)0;)~&4D=RBP9tSr7iuoMHfA)K4r!Zdh2DKqOJTgi4W(;8DSy7 z8*Y}C4s~2xexv(&b>VUOSg!pPYU|!vVa}gc{meE4;=dzpNgJ^eomKO^2LE9k)@phh zE;TKs96*ApXNO$2qIGyrjewus54vLXf2k*MKsK2A>Qp;xso{}#>nbXk21+rpFIGGb zUgAj&dwb7nH_^MBekm7oRIm7W)U|uX00aDE_>x^EA%BF z!3Z-O?b?7MaK=UtE7<{bB&qYHvX!=Q0(=n@L~<31>k8et%9~!ag0me7 z3kyN{OwMnMO<=_Bmpfw85f+C`Lf>?!;d+ww2c6D%9XGU%QkvMW)V#>r#^!0OPp}X! zMc!1A<1BfIY=Q1(df5uDuaPm$S-)u)Au%zLk|D)Hl(T~wGBjO!=GQIaHiUzdm2ZDH zVe6CDXW+7IA57xlNQ9Z*P|Zqa8=)&GWVZsD zrc}(dw30f+VGmntHyTXH^`_f7GUX#2U@Pb`7K*`61o#X#ZG~<_m<%1%BH|%B9iH;O zqlXt06k%bxKdcIr0vBkFPVsygmHogoZA{d8O^>|fC|NL-CrobTW<|XThJFiDMM$;A zLJj3FV`3n184VLLG_98U`uf{jl5}qohgEr1-V^i_{D*N$K>KSLCjFkxfhsSs%mIU1 zL|L0M_WRYXw7_v5U%Va3;!ERF^w5BkXWE3d1LEaJrse5X7ixEgtU-@!n$CLodJU6w zeOA_iS0od*3MSuNWYV)uk|iPj&&HVn!E?A=n9Ij;;XbqE*4UluCVs$p82m^IC>MZ zANA!NLWDL^Xc86W!KuVaq2|}ff?wxM4e1BL)+T_fO;959!WaCBI8P>StBx9)&E|LU zojz_4n|!0;^LX*hsLQ!5X;lBLiCd8Hu$#Jb3kuWU9Yhr4sh)*9j7?ud{7C)+O>BQ6 zrnaN$MeR(SN3!g@aoPG9m5>~s?f4r`7CO&?_Y+nw;|A&GV`{P`18HAW{+S>**qUAK zpU&2`m*a`1@0@=lywNhsla;T`u%otB8nsFnJaRQ>mLpj0*3=3EBpSqZ>gK=#`DkVM zin`IVy0v(km}=nNvNrSjCz>&cEuHSbJt9EquiJUvGE+vENJ%yKE08koY5z zJt9kyk63|xd0y1Q$iHSG0KvzYHSAUizh>vcU?G6RA$wsGkWDUP#Hwj}{Sn>6i*&_pfi8ag67hjqp$N?AxTwHQD9*7E*bMQjv=SFtn8d zU>VrUOeR}cM<_WuM(UUec;%$$-j{$)i$>NL8cHG$JF2C-Mf0sq5M)ly^+@^3sM*YO zgl}CkU;3z9?U+>#V!kg}IC{8N9L9AjeLI|x8fYC@iUBz$Kqzo2PskjiQ^=f}?ff!c z_L{*Ip>=;8Go_RAz%A}|?Lyt++6z>pUF)!=Ldlnn3E>TM6N6jTbtK9fa-s#!d@D{= zY!XEr{TllU;C@QZzQR7{2{XqUg4mgHYfu|LkJ4B`{s^td&xk`K2C3vRdGI>9-6#Up zpiQ^83CA{CFg@QG+%STWXt3`BX)zK8i)MJoT~w5y=aVcmR&3l@im0jT7u+}Pp`2m# z-s95KT~@0fT2%9KZFzR~D?9%@v019MHHU_d-WnNzntEngES8Prq42}e zh}|+=8S6Ue8%`Hy=Bn7G1a_+_G0vLrNKr7Cq=~pSi{&PW`CQ_^tsrNx@WX0$`N>HB zdck0e2b$xVc~0LwXpLOof^TkY{qelFw$$`<)Z4*Ehap;P1kpvDHfXGox~j+MOnM1T zPUXjM1#>#{KTJYn_IIY?YoFPPY0XyS8h9$$AlKtWq8I)zZ2rF*NSTTXVi5=YztE5A zE|5sbWX}u;GzC)xBM+y<3;p#KCH4i#h;)lR;|hTX8oUDnDf&)W~IZDGxS6RHwqN2?y=NnxHse0BfnJP;>AvEb=P+faz2a@==AC5pmd zKfX+6mZemgPw6V46& zaV324h(DwSO=p#ZrPXY!npu+JT`vVu?C{NAkrfp@IAl}?PksB+C0+#KGVhSFo%EZ! zajg}q8WL@XNwXMda}B!KBE~qZ(3_y78kO~$@G<5u|P*j~W9HsZkJ%vr*!9Uq# zd4{bs3iUp|M=ftHx&-)tRC0ET&S$VJ;9&|je9fddb$}E! zVA552?KBvCr=$?Umhg5Om{$pH+D{DXj${{@`mlei`N9Y$@w1~pr0IK)CjU8$>nnM6 zn*e#}ji~f6ZSY=7`A(9EM5ZEFnVv5C>=U_sAu~@R9%(bI9h!& z7u~oR9*y1>_)B%(ylZdBwm0=HI}CTkghH@j7CCcljn9I4-dJg1$CvzSzxQrQ@w`Wb z2QK`W8CM%&%(=Gsu<5;K=w?v`d`zJNi}8m2cIkvfVIDusD?nh!ewe&^TnuOYM@#zR zJaH%?@lG9YL%c2Vf>E2``ZLQoVw1)=+!g<=Boe_@Z|>IJ$q{xe3boR=7!u>L+8>af z<;L_?fAuNQTK1RPB^2HG4uTo*lx^#ivr~4PlQm=}V&gZJ{`Qgf4d|b`mCli^yd)2p zL=N~xuzy~Okqvp%g*?UFi@qq@&#J}yJBk6gMrMT73ly#RjXI1`1+A_09dA6>zsyLJ zJNc-J+mPya&HH6WxE-4qG`|t~7GJ*yidEFYug8P=|IVb=?G#F9v@+}8nLJy&V=H6! z+Mv*=VuG%ESbqxb`b#&B;-ur|SC#E!@@{qUUoZRTi)T{SE+1|-37CCuYcn$x>j1d0 zKNMsajZB zT5>XpD^KNx9xc>fonNHXIh^H(&uW>inxpBF4-uCEDBzU&w{RYu3TOPZpwV$7Zk)VlNI5Ut%hxyL(DN@@x!6P=T9+-Nk25y9;hzK%)EsJOXF^U5e%oYjumTMI&!^ z%kspdq!PD*=&`n(ox9@dhk0!+P_eEq-xj|E7+(Cy%iX%mjOBcq5r zsnUHqGp+JI5vn0cS5;W6qq8eAy8D^9aXSQ=8xYPcF_+swK(E#igWED>{9~KT?~%H5;^_?sB>zis$2S;BZlly7O66 zv#e>VhTlQMxyb!`&h7iQQT7L!gSxK}+ahi1C~3Z%ggBa{#Kb+@E4Ic^KBiecv}+Rv zyh>ugG?tc4p%L**P@Gjf?h7?X%51Ug;B*6-6el>+Fl!#!Uvlj|x_s6-A3CXm^qZB}@$a_t-mlmWL=O zGJ{9Q`_+K+26s`(>)N?x^W$6zc;<`NxVj52c-2vJ!5UlEGgiqjgfp*dxFfVgIP!K) zmi#v-3#9jPl3Vy9)+*eO5VTp2-vn2i4t?c~*!kwtOZOY4YZy(&nissJ0Xq(kql)@H zt7)qst7bh%TmLC#W!>27v!(CUMZgSBvqYipHM9Bv_CZ~>?UDO#hU;Ec*@<~# zW0f*8lzkwy>xj8)=EKA9Pf1-H3~|!eOPdY`f@zbWB8YQEony4m^X@q{i2lae=fn&Z~qFvGAAqfioTsHzH9lsRv>Cr|K} z6OAwBwjRrHRUFADF|9vyi)`0p<&_O`?eITAPzMges-Z8%Nxnp%8-JeQFPe$8$S7(~ z-H%cbta%2bt# z?3~Cddok&v`AVss2Nc~WJGByj-@koGLH9vVVdwI2Zkbf=9N5B(FvX*k`}m4T7;Ksg zjd(orAJJymi^%C64L_}X-N9^$@3|$m)7XzcVP8Bdj_kOm53}&{QN=BaDK>FJ6j_g~ zqEk|+%g8551$+a#RdZ!Bj}sMK`%P!cyeaPTl(AjWPy-y#Z@qvwp%gfEB!GU}_H=is z{1alp8p_qpE8OQ@^RVf5E_)u>d9TkTO2oETwra{NBB2F21KLCcxk} zUqp7E_(G7JuyK~^Ai9Q;*Ouh26`qfF;4>RwSa;a}&P&<O4_!PSD`h;4nr*VM0!NQrTGA1efd0UAU;=y+)ceOA zJiEdJXE8Rc!F*70=nw2?hW)3$VHdn5=uR(jItn$JJiX$O|+$pp1 z*^K}hPneKUs0x)P?=wB+9`m-xp2@dG2}pp-!E?(V7vu_l*(G-W_Ki-qh$Ma|&Zn`c z@mrjN+gxQj?pE3=f*HvepEnCJz~z~%h85_A`#ECn_jyvJ zumJUWCca31gH%Vfp7*QfS2R}k8o#HoOvMaSfvpq-P;eWH%;8lN`SC1_|4Z-tf2r5K z+^Fm?_ci1ZLckQ69tR~P{)N8*d!coQ6EBoH1p=MF00V)-a}){sFAp0TF6)aC|KJ`! z&0i}AuCW85s2x54fN-PwhrUh+LT}n-^Q$rxVY#Tn`id!zkY_Z*%x-=`V7!2wuHD|s zl_nlt2s(a~%sES7^^4}@kT?vRr+M;#4+@|gPh&nj>&C)V2S2W;k1}ZN@TnS>x$?XH zpwz+5+t=y6?<;EC<$Rhu-fhqN|MV+iT#wu+GIud8+M1C9JEl%M@VQ%jMdq1rYIS%j|aEAsSAhMx}Vc!$q9&5cXaA874E5Cq# zqsp4u#!zp=)Jny&5uIpSLJQ;k;IBqkV9vG;RVnIHs@`9QC7!77teq-Qug@r;&tlWX z=W(f&gAS>7{PKLQVp?Dt3xVpcz)Or4-%lo))$uH7TRWi-)eeTte?{JgxKlqEhYYKz zr}mn+S+OVY)j4{#tM36GZzUbuy9(w5hgz~siilnVcLFbU4`|hgyNvGCP;g{1>0U-W~jqav3;ziV4;IWfQ?9_O1Mb^ zhfT;*uuc8A82J@x$@a|o4<6;XhW5QSd+^bh#7gsYlR1f9Uu_NiaQjqk6X7a+aI2V1 zwI&LKz5Ht7s>+iTUHVQ~`VM=^Hon)YVd_*Yq^_}H@$iJdg)#3f#ri;0%r_U*S8g%O6{3{3 zBA!t(vRe!AwZ#bF`w7RY30&Rex~X*HmR%m(%G}(DkS7Q96y2ahyHyJ7QxiMS)kosX z{1p9jOXu%j2ZCLM#BQmT9-VByJ6l=QX&oflSF>8<+9bN?>LDOuba7eb%^l^<=6Rsw>1L6aX%(6 zvb~Z+T7PKsK-a5d;&5sV#yk{xzpWH>bsmevCJt7X-7N@w?Mv~f4r-3i*?Q-tGhR`# zhEnD$ZmPB1BRj=3oJ}LeQ|X8jZH(&axHwe;SH3G3?x9akj)(s0&%z$p%N?gy$+{<& zHL=qqrLrpArRB;U+%*K(_aIs?4z4fks5_@96z#j`-8TNtw}wY4YF1`W9YB9jmv|$? z%snzEf?yfD)1-n!x6rJt^Iz=|5*R>c|M&9;m@WCXDV;x45o)V`q-HjuuJ}OSxxBcr z0`wPubOZ40`|G7>J;Y^+vo)UyC}!Ke1|T&Mdr)1m%T2$2(UIt+DxvxT@Cu|9hdV<# z$EqD8p2!One@y3#ax_17#kNZRqRUa_~1AuUDk|!+l$hpKCe%Undblg=dt@zF-y?y-wXS zz4StGJj<@90S3wpSWD4yDa=x07v;}s=%Qtir04E=12i}(s$eG5ZQ3A<8 z6DJG8$^d1PSlk&!;(9P$Yy)+83@aMYlm(XOsd8t#NV*pWD4CEll@9a>Nneqhm)$C$ zCcTFNWjhT2apeecE)gse?a9+>agsDK26r#{b8|h*9{4I)I+DAxk~u8JPbeW%T(j4@ zBC7!E!_S~_r?zB|HK*anCYt!lM1OpRsKwgCtQ!h_+k{900!f)Zb(WbIEGc7_St-aO zh}qK;mQ%i1_^D8gDW*ba3`_Y2k?EeIX_u)nEbYlM-PTbe*9E*v2t3W4Y%T&zdzX+|gM^CD~iI z_eF#QDAz{g&TJvRm%hqX4=e`y(ZfA^)V7{PNeH$8zM7B$M zoMk+26|L&KQtf7k?Q@W?`R(nPB)Z0mT(Mu}K0>=2#f-%h=Oi7<*!vg_N;HO9Gp@+@$jDVx7g=_6g`x9d(n0E%RbUv zl9q7)f1BfD!IH<2#Y@6g?-P#0NEUHO-pbG(QDcQ#fP6IqiV?&pGi>(Pq6ue|eP42j z+;ZX#%7k+@;IgG+X|~RVWtJ|4@U|h0e9q%kOs4+JbWmc}*?T^!h@sv^G?_;r`xi15hE`UYSikyLLgV~0^Fzc_&vL^2zmQX5--4eseDIO6g*QB~bzU>Yd<)EdDjKt!~n{ zSfPIu$xrGONTY1NYe)3CZmxMSdPSdVIc*ozt(tW!@3tc-D7phazSb8}l; zo9$``5ueRaE&y`rG}#G>jsBQ95j+x2E%x?0?AvRDK3`4{Z2ygd$Akl@zAt*N#!yaw zovZCw*yp%|i~XrdEmk@O=ySfga_Z}UYgp#6u`zR3183s2Qrf^ZnuD*+PWzJ-QT#^{ zzjz(CSTcS~wj%-a=u7@l*^&%EZq8mzZfsNn83I!FCIB8u*lysyH=YAzER^ItuP1Dn zT#d49w(kIjKom&JSdgw~>}T-#;)v-kjv!Y9L*A5-=ZjmPb>nvF%#2D3aWR>trKJh; z>-|}tP!|TLVTLINLXrBb@72{gpYRK4T9zq@7QeN--R|W@Nu|ImR3HIa0cTgtJo`Y3 zK%%6-hW@*05f3(+1f2QTGa4^43ihKvVbJa;)v9wlY<*9IE1;V5FHYpE!#Z_gxD6Ra zGA_+l9bXTgOSmw$Nh)<_E95qN3SNY|w$? ziBbOkM!N#eAa5}f2u|5d$gWaxay4W_A}of6h9(!L9Il@pb3`I+i$&lZ6Ror#|>eok4T%S@d2jDJ1zBizc`dZM=(fGA-< zD+i$w#bSiQD=@j*!DEKQtC0#_^7uSG0R6U&Cy?{n#=Q@F{s=Vt{Cei2aSmH;{!~r7 zrzZeI>i|FMJd(Wj8{DWZkYjWCR9ak-`XxY54T0a8K!b!ZeMVmGyf{v}N=iTtW&(6$ zrLg>qabGB)hQlkM#`oXd@j4G~Y`kOkbaNm&j0!OinR1AFu~8n zdK|Bg7OG>0=}tT^cKd@)I>lqcH^!e=l#j>yo0HB50=i@vk^0yFic%tWe$F-9pI44|V`RRz$(` zn*-NbooA5Mq^sQ^v>rgb7x^UBTXU4^fDGr2ZDyZY6a}o14ZMu=cCI$sh+e;9&T5ko z3&O7F6dT>neUl0TS2>{h|b%lH+9*~ zhfzMRW#y;C$~>j*rw7iqT*xZwt9Kjpq9XhJL$kAq9dq_4E9$y)h=m9W)&{ap@Mi(K z+Ft+&I3mKa>4iF|>BY-jdAl=mRb}ih@3WImkHZL8qjc`#K5Yq#3|?m`q}K%pTP05n=rS?PVV9>h9hAf%iYZ>Bti*_G>-L^8x% zUcx~GCY(ErzB*83Aq%#^I@}Pwg_&CFv~)aP>CAF04A@x8^8Wn^57ZoEsSJS}R#a6D z#WMmxFHI!LYNKtIni7zpvhH_(Qbe@TMyxFikmu5A{~-D*Y$Ky==IF%ASy7G;o5X&M0U74Fwn?(6y*14w_2ROXq;ueE*2B&zvSkLMrcP?3KOQ_;-d?; zpxS89zX6U_6hW*X#RHE&!BIX`CVDF8Mekhc(jjh6GbrhzAh@%w7Q65x@o)8h3PN)) zaGY3N#Fr!I3%1zauyN6ood|#i%4~V5*d(e16?5u%9=A{0=v#H}HSJy5HwIVG|hjI zBuvH2!sjl&U2ga3gwWDK6R2PInc*1eC_wiD&>aG>C)>zXPZ)IFk4*&~1B&Fb3T5|z zn>$V(;zGyOC*Dc^xgRcaCJQ`|?JosnFJAhH)YGpm4~gf3mzI{|4PJk|hXQtGr6u)I zER9;czP(+YB#;m-C_VcTd==eWIw4M_A#A0b)+1bf&God7?i0N+9X3-g;JUK!UCzPf zD@y;p##TDm0>|%4!sHz3q)Ia0{a~7oKEb0Rkn_@vg<|Betzkd`IP>vCizu4K61;)o z0y8Y8lZr2rFtou}Dt3!;EDpInW>)?oxG-l&5_r6r(#pSG3qaqS9x2-&u%-bLvaUlv z*WKEGttKs1L0)v07k9h2p)D;aDB#H)+CVmHTWSZ*RccHBS*O%iS{+8%8P%%%*rGdq z;XcpR@pO67SLyTTezkS5+99Y|l1tHqzeQZRjL|6+*Yj#tgX!HdU`gGG-u}sfHJrS~yj>muH+83a#p_yo6mVPzEBTJ?E|*QyZ1qlTru(7ax_ens(A$t;Z-JxN-V3zVh-1XnCAk-8cX$I zoaW{pn9o9#P)^H8*O5;nZ&N9Am(NoCc*g5NK9Q5~BxIxbcX({$-bRsG7z4#hHwa%G z)pd2bNWwy$Jj%@=c@g^WTrmMp>e=PD2SPHsImp+)ZT|a600cNlsjz=}`M(P#vb7bg z#}6+&+QCI!(XU{Q4_>hW*IyF0DT4al8<4z_@V@nlJ9=HRS)V} zbi*}lrE>ltOZ2OGb}Bg(n6L+h6&R>hdv=VA%@;XD#No4%o`oQ(9M(;NGnZRExYeCr zYFv(ooC3mr35>8J*kZy=Wd58!&QgkF0E4cekX~2>w&1y|)?-|lh#)lPTrN1APe=J9 z>yd-s#RYkYum6dGQUiGYG>~;uy}Bx2!U&9)$HDnRI|D^`!>%mrQ-h(GdB~?w7}2xX zdUmg#V<%ZMY`NT=uI@JpSdkxciVM#kO{|8)5c0Pq`$X#J+jxL3fk?^>Ax1tYAdK!J zcfv`5DX~scd~jpO*!wvKOD)D-ZXL#}r5SQXCQX??PI&j;I8=c{ZJZ$7K&y@lGK}QI zY96OL_1YoK^wob7K0e{h#Q+w``*YvX-4}15P8>Y_#HitsHR6a@fpj&n?=T3L%Pi%2 zNOE9*Ja@BHT<9N8_U`8MgA3W)EC~o$LHBey`$&?{~j0IkG5wsqrjxhbRW%C zjz~$wr-sl;2HJrK<{_f_g}Lxome9BKj@Y`Bxv5Nb$!%sgA=cyBWuhW zfZMJS>2DzY|9koT&yl!qO75as=iLm+3lM$R1aLl<1_-lW25V*oI1^oNb**&=fpCmi ze()`Plun_3h7dqAa0;jZn)5fV2mKBA0l4dVP@sQ?1bj+nEY)su*}N@#4JY(kSrjAK z0(g-BBtlv$1U#T(016B|aEQR=;sX_?U;jT9l&MOAJ2?6-mEEtv`N@SY=uYrR{-nh* z7WAjAf_@uoTKmkQP{?Z1cA+6a;Svynsl8A=sK8}7eRXGQ1! z1oIiqulOihEM{-duR!qd*=O2%3uHghdWfdRO1kAizQ1|Bm z9;VOJPzd?Pl9b%FLQZH}-Qw@Jw&&+KrK`tKnl~fk;)bOehqiGKM{}XWqo$!K(&I~_ zTW@Ea^nPz86lRu{^g;pea6cbNc>9izzx+1ObB(ZIL`+hD-e^+U$}S<*Bv-4beNus` zRBIz$9XcIle8h-Jo#90xH^?kK!BZ7qn9{y*M_aKN?+t8|p~3ul8nk^P*e?lUWSK0L z3E*=?3PkJot}Gnr1eBn@#v9Sg~Pw49aTDa+P$XL` zTca#;1wi7iygJ@JWsy85vC1aAsf)c>)b((0&5xNbNp(`im}A7WI5%4R3>JR>K&Y} zFFi*b!|#4*XuIo3Li6X>^N705`t%7T=bI6w(&{=H*aIZ*F;);u22I4+svykioyQ5U{te@V>6&%^{sGgd>@Qs?S>P42YC1cP7+QGs4n2EXUJ0G}nXSG?lL zm9o51Ar6s%3su^1a%RmTeShO2jXyw8D84LC9{ z)~NnG78eG*Cp8n+w@phr;#oi{-wF}^KdvvJ!sg}CEm!+L>*blUX!TZRe>@{!uY8m;EbA@1X8_xR)eMvuK5^Mvl#hY{O!KD#q;-W z>2sacX=a-HbzGm@r2F2?4nC9qW))xRrFD_vAK0F2+5Y!DJ!xOhvr1Fj>e4dDNF{-* z&lGMgthW9&E&G|p@;xbcL@SeauWSkK7`I)YS_gl4~&&kt{&SyCveP>RzYr5&Cq_-zsF6DU4Js~3eN`0MVV1?aZ zU?_0=G*A4h|MOr=(BdeAqfeG{7zvw8So5FB@O#7a=8kRE=IPezo4JJ^m}VTibUGu= z;no%JCn2fgQ`DIPbM1Zs=VWSszlaKc%DPtN?CT|GXPiBJTex-2jAzdS_ucw!u_(-E zW=YTd+Pg$k?RvkDpSH>Ty3-r8O%JbHw&h;b zp=Kl3`lzs*W-}(lSeM0wTBh3Ft@`l#${p6F;3RUoJ8n&kp3S7BGQ(pVzhzvHF!{Qi zBUtg?`E3)Q%-tP&Ye}vB?1L)CpZ7V3n(gk?+Q%N``F8f3MS^*uDreh7T$jxVvJbek z&cJ5=HtomZ(}Pk%Z_fUT5&Fy|Q3` z!$Mx`w52n@y?)X(2~@s6o|??lthHjt1m>serBOU*wSWU3O$uu-Hd?Y=^}{IdiAk_{ hYmAb|$9n(sr>;G>3k{2(q{Yg0r~0yA#~q-Q5-mA-KDQ;2PW)cPF^JdvLyepQ^v=->Q|V zJ9}rkx~IGEIp;>JC`qHE5TZaqL7~gaNT@+U!DvH4LH8iRKt3Zj>Z&0F&~9qdVo=qS z#K({WI4e;_Q7EXoIMi1Yc*rrbvy6@#6x64_|GlAyoJ!51pgw-dN{DKB8=mDLis0zv zek^ykcdo9se?+YEG_*IcM-X`2{JW75J+}^5GnhJO`JQkBNuW6qSyuuQT~Hb+?+&j5GrC{_4uOrbVqX z;*$;BAx0Hi@5Apculyp|7+34@mg4|+ z^tf^36@tw4bP;27b2z;NZ#uX@?9TB*wk%9d#4x$;Q{z6vLHgq&w&|Yo&-PyLfwEqi zHL#>sv0(Aa$Pf;pZkI(m1m)~r4iY(V&=~!2N*EVkaAeC7xoVw=%aHb8By`j%-w2>( z^~lJGBXWw%c5ghBmt{3mh!0$Wk{N47weN3o86#WUl}kqF*w=QK)Se9cT7$o%2fUw>Y@7dKYS9)D8xhhh*3W5j`*+YEKTy?8q7jo@M(_r@OwVzWF zM`U^MpEItdV=DI>yR{EP7VebN`?+s(DVj~BdnV%YqIU}joF`S3H1U*m@i7>ltdA$2 zc7N%Q2Ri&T+yv!Pj9!gRv-MN?NJOJkxp#HVjDx3YYxBt&Ip#Mv$@IJ^DyIotYyFqt zx{nB89336Cjgfl@Ohc+CCl?nr89OjF@6kFtJL`Hr2eZ%T6xY>ZDesF-R1jk*-jE{) zj7|vjK@;YxaT>yRGnsdstjUQo>mO^=;gRGQRqQ9a)*ZpQ!354B_^`iO@b|UaP*bvf z`bHPWK%pQSpGkOEGboX^?1xuLL~?in%NC*spY(tgUmapTl9O`!;P zkbZy1)uzE|Z8GkSiHbBPp7t{P*%#Hr#$2pBz@{<0_B26ayS#&i*A5mOZ0tmc_UEbHmt=}Xi;qiiT))_p9nu!-*4)U0GIWcO=gKBLWj`qivMsMr$*?%}? zl`|;T@?B<-JUt!eVM+CV?VF2NGcbr{Vw?XPX~eJhhu~nLLd%^n$;?cAueX}DYf)`u z$f1@gJEb@rE<+(TF}Z*8N>O{%!1p0Ewa#81(eck z?CdYkDv^xPEqumX;*3yqq~)PkFUG9sKUD=)wT+)9uhP0D&H>$!OJL)IZqHz~jH6@f zN7&8lw6ocXC!M|0o^IY0Hwib(JrbAw=(@t+XaM~;FVoZ0S2(Lzk2@jK02F?x!|30@ z&wQv(9s2L=`iu<+kuXQ9_Z$Ta9o*YY+1r;)SBX@EbBJZ<$-5LGbL}OUk~KbfBo+&KIum z5tX06wcY3KpYVfCs;;MS>S_){GE@D`m0bE=A76f3-`<6lmC-_V+%qD3ea8h(^-+Xl zNUOE}sMj-gYr>RTtHuylwFAdh^y}^pkm+}P7=phc3v3Ke-|`LlWC7z}f(JFf?X(6x z#)Pa(?l)8nreMiz3Xp;&iw+t+NQpu`dBoT~|D(DRLze0@UW>U+*;U9A>J)Y_Js5BE z%tHA0;LiD;3{qjY&u=4G!p#ng3RT*T#4FdMuXx&P2Ia1tALH1W@#2$dvt7`Mi2q)F z$f!)Ep_=rqXw|7x?THKT8ZX`lwyg-Ykyj8r+KX=&~TI&oK;&1c- zgm3dmgoAo{4qIt0`TO=wef*KC!`P@iBVszWta2%0L0w7-%xRIEOG2d_1;eRD=o1?b zk63bP1s)Z*=!bQs-gGM(RXSBVyoNfwnj>N=Ibu-rEofGc5sd8^V}sLDa$C#O?2iUP zR;6Bp$34q`3Vy1%4!j+56vGzy*EmzVL(Q~rU{-V!O`;k(C88gRla}O|h=>HAj0T_Q zF~^l7y!YMhk1qdVhr4;<&RnQ%&+as{I{HNq)eQr)vP4+-(7rTdz{Wpw*IM=RFRP@m zHCKIG7JKO!c`&Q=Ii3b&R+1Ei!(aY&iT}6{-Ez!7Vl>Z3QF8MPIPiJY!c0zSvRv9EwH${VI{itJs8u1f3iHR0|XMDHTbJ6^85P0XazB zaB`oRs)I6$h}^upAM2=`Coug~?4=xl!Exej`sIdR$Ac(5(&A(C?6iMYD>H>pTuI9o zkL0rArAhmpJ)2yW`SnMatgxTw`#W4kd<;@JDAHu2ZINrydnL=H_B`SmV7Kq~8A`D4 z`{?(b#2pLXK18kGo%;r;`Bq3DJw+IkDl*!%EG(FXUDbvS_k)?~U)}U_rh=80iz1t8 zr`f5JMv97xoFkUbQOfAe^qSInZvcdwGoKQSm5}|!6KWmiW@N1{t8~~ zhPj%So7Kv7?&Ydw1a5g0N19DH0I7>y%}cLx0bS|nIU}b~cW9h{IOaL$x7Q>FB#0bt-$b9>)lbPh?@KffRv9R}?Z#zgU1qu17`Wf*Gnh zBwKt`YqOKjv&nNCd_s$d%*&flK?b~+M0x2ye%JT5ALWezFYv`7_Z|t45!Op^a&$7j z-M7pl=!WpJ0Tb8#byg={ob4Ij^YFx;>$*1n;#6n`04zljTfEe$&axUdL4c2ja`jN5w(mC520ZF1!JYpVFWxT}x~o;0gSRa+ zAGwX0MICQzKIaHo3=~C_X=WjEZoC@{FLV<$nbkrR9d02w%du--FS>xxvzL617ONGj zQvoZUNr`qrX8sEI2!9=9GE+g<7M(Ko{;tv^5-Vfq_a^YBp7FRxgj6PtAjVtq%e&QI z+bbN>ErPz=I(Ymp`)lL3SIKaYq@)BnRQH*AL}6m{;uK1j&~v07P|f}C9ho$+e(tI7 z_-4R_lx(BbdqeqD-<8I7Z(epiX)vBm6_<14u2^^j4eZWWUh($wU}0s|>=uwV^wtSK z#f?X7N0;?bC#f#WoL!JyOqCwmA@Hh{yPZ{E+U{-*b^JKkMQe{=r=k(zE#=Gi-YBW5 zsi=sq?+r=gj{}Q_j4FJj#KanEYHF(ANbvD_YJ-HS0-tNTDP$D6)dC4gGOS;t+rOvn z6}YK(N z!hDQfW)S$pW<{$rx|-mXGO5zTf{hBb?PKlb5qyZ|kTpF8_)0~!#R}ULt~BJY(@&7< zRe-LqlQYLGU{D*KMn)`#fi-a|S-#+zwAd1pSz(Yol(KA^l?$k#JJ_t@WQLJI3JN zOO=v3f2$UEyc6-#B=%`#7y|QA4HBmfai1jiaQ}~%#LrD`s|K5={w-R84fc3qjzo%= z((z1sO(MQgZQ&2G_B?G&o9V5?MfcQoY8zb#sDgbHepR3B5d6&_S^BkZ$2PZe`#-_+ zBXu#Jpj8o8ZKb(I)EIUqrify+6@;v_^$e5+DYd5@SYq+@%P?k?=Q>Y1Hyv&eZTwPH zR4fD^acdqN9Pm=gfbaWTR*#>U{%jDtLosw6EgWqZ$Q}syx$$$a;(l?lu24?Nmfv3H zztH9jPD!MIl7^Lz`0Cma&c0`5az_opq)rNq%TYF_dsp2(R*1BNG!Sb5(R+3L~s z3LY<>AuVjP7Wn#$WKqCmGrU<}F15gGqDp^j|okD07kP<$n;Fqc3FPo4DE0q zJ)nj5M*8*|Gc@^!Vt`|_<7Dl5ZpoQ63QFV|X0ZZ88-l2{q6=Wcbm+_N$mZ)muh5{k zk)F&C;~Ju&$cB(Sig%ZOS2J7N?~v;E5ooz`h&5){%{Fk#`bcndH@=1+aea|v!uXH@ zucdW2b$)tq9=ZPZqIkZE);S(#lL&CM?04t4Vi9VR);r?23~p8 zK0=iBw} z5P);=WW{Q?g@qE9ti?KHxR$7u3+i+Uq(Q#`28*d+k|a3Ubc{6FMS2{ATZyFbK1EA} zN;8n^G*=1(5D*b}Dc}mcIMwH7utLt(`t|E}!Tm^^ zOTqPF0ku&CJdxtWDJ2!v-oZhH7rwqge8EPC5BBC?Ujz?|hhLzSM%-6j!}{dJ%;#Y> z9g7o(T|Ek#>cyiu%*wP6V}Ot@4K%kp5C;$I;MEj(c6OGWnvm;t08SxiF57TkMHdib zp@9rz1Hz14kX?SF#vze}I9ng>-6<8Jqj`Ek({%G7%14$cywW9~#iTNSj`3wWUz@pX z#_C@j9b%;(dYjdOvx!VJ`f5>_5^+Z{Uipb?={0oW7lVuupos~Cpt<5ssOzWnB73hV z0O+?7h_~b4%f&MB*Cd|@>vKcljFUc7b~UAV3I`lXs1r_srF*?;0I<=bFaT%LuoJaA z#$pt7M5&>BvNI5KMc!D~$Q$s?A;H>*aFG}5?e)iNs=oHwXsOx-&V3daY}e(?^sYQt zmRl~M(58ZL?g_I|ICuOx@iQh13kNSeg!4c^Y8sG zCg>?HyC>-8m8&l+oKe1h1p!^NM6{xT*7IYhx^j~L1ToyLr|(vv|5j*G)M9dQa?*Tk zC2x;$VKNq7$iMtmU24Wbj2gP2H%6DjdGz7eKPz)rrhETq+2jW42HL>(9}K!qkiolz#!ub*RiuZ?R|S; zO-e`&e0Fadsn=Qr*?zNKBWoK=88hj7GLuP>H3@q&LrOzpNL3D)WzzjJx*ls-sx4Eb z3maFfwOAwi`&VCZ%G9DVdMLFaz2h8*Lvd_IB`<)Uj^31v)tRWvUa1F!qBWx$7|!&) z`>KlSABIgt0hxdor^k^wI^qWN%M3aZY?Pz(Z!VTU-nXq?b;2 z$Xu@4_MOiA8u&9L6dGT`r58zw)vESV2TvK&$aIoh* zJUz135EY_$pLrdMfdM|{Q|2)-kL`iG!Yc~-4J5nY1LI0IO4iwi82z_gIK7EPb@7pI z_BY=vAL~BPl2I_f-v4v``$1=VX~cCiQ`2OfULs%~WNu(!fWClGr2gm?+SJsy>Mms zv6T)yS&>zdXS?Tb9=R_h|4e4;hJ8PW;>3@rFk}*P_*~1R$wqpCb`xYZH9&XY>HVLb z;Rp_MU%3+mdsW?-H{4Ny;kLARxkQz=k9$&OX)Aphc!3v^mGT#bl{}4QEWcd1#uP>3 z$n=pW$A*Vh_+7;G6)GXfPhs22N?BQ1;^)uAfKP+RHk)L|Q{+(rO=E>B1Y1r>xQ5)p ztCwYAC*DQMSE^->!>vwCtMQ~2x8x2!Z#R>eYME(i+#24EWTJ(G@%&}H{LQ3v4x)Z3 z3xEHLGX<99sC;7r0tX!*+S=M~Zd@5V_D1s45V*=!z41{V#|H-B1I@?;T0GAQHN1I% z`tYWHW_1L+EjsN!6jFhKf$kbOYhz3Q{$XQdH=CJiZi1GoD5>e?eyK%9Ms5Q-qQ1K7 zTVs5iA_Qdj3jth z40;0a;Q>4}b&b&xV;?FOtN2!Q(!^U7CgZ042Q}@v%>krsM*sR`B~a_FS)D<&h4zZR z57^%w5)>3*xxIdf*uiZ&a;Vz@7JoWe%AU7kEz9C^cwTL$At4hC??=`hYJ$Xg>A=vy zfP}Q0o&%GU*7KTHyENY@j=RQ>T?Szk&5QmU|L9cuQSDDiokqNy+ z@EUt+gTtzGL@q8awMzb`u0}7N5PYnUj3n}?HU39Ua=^1xh8JMjEKpKEy-(t2KzZqY z>RbFzB)f`34pn)~{tiC ze|13;%SB63vy-XkG`+^v<#Hkn3%Pti>0_8+xW0^ z2q$3mhzM_C7Cr+bWsLBp^>y@au-H*nfGQRiLRg(2qA!auS;uG3SEDaO)zRMjfj0w-`Cq1pP7FkYh+}e;c*_ zqkm#(C`|4Rj3p{T%#K5uvm_lp6D>iGr?RuR&|QapB^rz!7&Hc6ao-kR_(CZ5t(;*x z6?SE>rgE+i^v^VRq1P=qPT}VAPK|37vh#ir55L3--b&=EA6@y7OD~( z{F+20gHBm_8_1e`%{dP9&)wZyUf+khRW|P>d&Y8^Rs(q$Xm1`zWo6W!|Hq3;ZW z>}GvWQ98`I_QKpL#!tjT?~!UyeWW_5>>YH`wZhgy^=ZlTV?WtUa1t`}^EJYlRM?}s zQdp5+EztqQaQ=N60vXn7+*35MS;_3wBQo1nb*37xcW;Ihgx49kC&aijrEB2WYL~D8EgN#)B5fA0* zd4%%%j%j;#y<#$THAcWkyb9~7$P=9%U^?@4weXwFk}f+Kbh@Fr28up55OU;|XW5_X zV9Da85)|;~nabM_h(Guz%rP7TVdYq2GlRY_9 zgdlI7S#XZBW2lhUGVF&Lzw|$Z=q1~uL4LufPY=R#NVwI0l=>|fvCi9V&8_+}wHHgl zK#gzTJiNS|Y;1fUuL?>_tyO3KkQNigq3?^KfL!-cE-N47y=`yA=g~(ZT(|9+fk*Cb zp`l<9Du9E7LnN)Jh{)D`J9Za5mNt_B#uI}yHwfvup?wH0Cd$fjm1pzQ3aAuJOz0R@ zZi}6$1%FH}EfEMvNsU+{AkUI@PQy=w^z`)7U%wU>7bAuM$gxscemy7m;5K&(eP1&( zGl3ffkt$e>Dyzj`sDc6|9;kY3F%v?6sZXasqoZ?{!UZL3Q~^vPvRfn!&LPA+EcdZJ zd=_u5(-RZu7!*i$G`_Fy?Pg)0gF<@3V_}Ne5DO9sNYEJ{)~p$CcP|JsyFO`- z$lC@I+L;Gyz9y#PMOQ^&;o^cK7il0j#%$QpBYuU`x!-?gU(8?rDdruz@XsC*4z~fG zMJT5bI2+%rX;GoSMKK!?DT$qW^e-33&L^IHznr@5nhH{6y{!Z4-}Sw(wnPOukQ=yxu1lQ*Z7C&V7Y#9fKa|^mK9$sFi z0v)TWIw5`Shr)%uF_t7|>O*Jo_`fwqc>+FcLPDf@Dy|7@T>(U-!(*if%}6I=_7P-1 zWn~KIwyQ~8u}{#O41`|{Bv#NjE*p`c)<6KDp^AoDa!OKTQ{6$!)pP9W(ov~X0{dn- zjgPp+Ph(AIfMxe6mw*M5VP$3cUd!~~DKAq~7}Ode9j|f^E~dJP{Tvvtf~ZoY*HGjb zBr`~XJqA_-QOR13eP%u$egAOs;gI%rYyqhfWDdut%1TQ`aNH>PGFv#z6V>~8RU%Ht zPEXHk2Dh$3Gjp>ck$6&zowiqGuvxC2>#l>yBvi-M|GvVR#7-YD3;5A2e3^?>)#hnI z9r)V64e+O?21c|xdwZu3fey5$HPLMKgggp=#r*J=+&4Y`yF02bP8@l{E`>=oJpeD7 zS-%sCWe#TUJT0_P8MnxSij*JbDdR!NDXDkCe~Ztq0PJy~HE*_D_6I$V+)I9A=M$C@ zW#aqOd;2L-(io+xXn>DAWi8h8ce^!-wa+oi?5fA=F^ojsyedqt7rDET`gcaSH4vmj zEwNHeNl7Vq4Q<6_$O$Fk^N;GJz7fEGgL<_|r!*_XLg6*!z8(P@c}~Ze1<2epi}Iu~ z=O=aJtxE^R&>U4;0=LBY>~T%~RxsT z(ACkIH~=qe-#vmFpn(2I?V|cEjAz$$A1TWWNiEdSIcdtLmLx-XUIm$Lnb{rLe}4Qa zNu@sErQLGw@YW|FX>!`$8_IWk1*UrSf)+fEtVK{M1Zucxe-p)#%P8Gi`!Dy5AqeSU zUVtGiU4xsYwhMxPghj{_@jqgK5ZaYA*(W5|v7r|q#hQksfc~)qQoNlY%4%{h99Ly# zW@R{&gTr;^=zr1(rxkQDcCdbk`b(QDiSU4d<%PZpnxz-rHD^0gSONtfd>D}A!-6>P zXYFg|m(bzRvKfpi8ct=!ciY4TSurD!YmY%x>-W`sec0|$X*d(Q1Mq4Z1v4=eX+74MP2GAwcpg78~1 zM5j>&gJ=k|+!5qjmCQ6WG+wck?$mbO!k5Kt>hFEyJY%=}^Q*XPAaQZ=HTpgLm;trF zDns9n4r9qFuVfxt4{+mEf`52Q6*p7CEr0nllL}2QcHDXZZ=qyK6sjTA1&ZfauK>)4 zq6LMXV(eI&n1nEIh=dDD#-LL`|J7gbTn`9C#r~3HWFCq#xYr%_pH)K`>b5$x~iiV;9af5%ZhcY92vr{d>o+f-;x8qZ!1y zqqB#27_C$qW_=14z|B(onb_84)6<;gpP_LMqE{Mx71n()`*JPY1vrb_NlZs$yAhCn`vyp483WZfYz8pV{A$>J!57jR`aD)l&it+4q?OE$@*?#@q=EmJok2&hA(t zXB~^lA|o>}F!*1e*?R+EC~ExPZFBw&$+xaiJM*1}jlp{aJo@!mxNrCT&I|ZXj*i48 zB^jUpN#ewH|H*FotBN(fN9e%EqpOw%>60(bXZ64QKj+V%w~3g0$tZG$Kx&DJ=;-Kw z!@`zdvST2j?~kRTJRokLIs+;_#4HB9YpJT8_~CB6jd!x+J5-2|7Ik2cl6YtsajT*X z#-nw|#FrEo-_4Ra$nCqBNJ}HWJ~w2v`;l*pq0NKNTsBqn%|jwBgR45Vhwq*?30&GS zsgPzUL#+XZNX87~2>+c%92&X-)^i;Pd7FQ(bfP&JTPD|!Vx0gL6sQ~YYod>XA~8t7 zXFcz4nrT3iwQjPr>E5s}VDO_ayS5ErG-Zr4;Wr=CaN3yHT**of1)svuCh4?}dz2E( zl@h%zi;9ruB*_HDzO(dGy_7*IKS`yaL6l&^ki9Xm zIDg8PPnm{^I!SqiC)AF58Psy+d*~t1Pu=3Ci_B1Jwt~&jVz#1|dlWlamhm%~h-9v4 zE^XtiEjn_^UA66Mn#yhlM9xXdZ{_%tIhUjfHG|WdOR=s^FO$FLb*1r-H`;_~b7sLU z?eSU}i6uktKPewI=83Y7)4S7zu=f-dDMMxqwcmKZGYa+HfO{fEEcEPG$eegECt`Rf zwMWRBQ!Ks}z7N|wNzFjeXEwMmzE{69Tu-jp;S2}@mKy@~htnEQ!2?~)`ZFCWe>Co% zrriYU2bZ>hudDMJXAf&F-?v&@TOC{I74S!z(3ISs+$c5&zzV!q$jPt)!L1WC@} z8?9L*2Z|~E4~n#A&sYEe6cgSz5F)kdIeowfgc;4 zFaOT_{^wU?^_hSdUESKJ$?4oKq#Ut~^hV}$73dXNdmkMx0C?SRN6LlJrue()vO~(% ztTK^NFnb((avYhKnudPVI;17ov~0Y(zwXUkXXST0_>r4S>LsVGjbAxvN|lw{X7bgu z7`x0uRhr9b^L?3H&8VZfwKnfzWN|`J8R+i@{s?;C4HAA`2r_9mAmpX&FrsD5Lft>F zN5I@$4MQwLs=_vzmnbZnrOOL?e3PF2X{BVmJWuvL0+nF{`3QMnptJK%g3*c1RVm z3sfK+X;+d~?k*9)$@z89iRxk}a@W_O>trkU=F*;*T|15kzpET*dg(#u-RLutGPa!{ zn>qoqr~_Wa~vp`O=pA|n8nn;Kg^`wbn&9SpHsy7Zge=6Eenu8tPTUHJ<2H8$<@v4UPZcq=rrXV(Aq zH3?rV3YJ)4W5dk&r6$Jdf79Q|F>&rhfB| zp|-FH2?ct4vBco#87hc_CpIR_E5WPM>;O*~4W2-!d;;0Z( zi5V}D7Au5j%%_D*Q|o*MbRlnvNh2b*s99K8Ty3@4TQxre!(R~k5r?3<(|`tStXvT| ztg5Py@VhNnH*YP{9CsdCI`x3m`VP21h?T}JmixhWIE0^X_C~P114C_{)>@z!*!-8v zd*~*EGcq%U0$(3Z)MjNlIhDQ~h*^RV)jpQ$h>?+7RopHaXR+~3Y4mUkEBsy=-0qX! zb7_=G*lUxeh642r7jseJ;o^Xu{YJ%qZf2B{>dXG2Fb|Qzf3~lCmfl- zg#OruMXvZ*Cqu3LRFG3pzuy5HRRcldY70r2ODL!zsPF+IwDuO$jZ%xsrC}IEs>jz| z9fg0}hWY(QU6}<8x~+u)z6Jq|f{r!SmIY6tTyNW0%+l>1{~KBZCZpC|%Spf7ek=<7 zcKQ)i7T75uW5bwfSHVDwq9-b z?YmNdCO@+bduwxs579hz%eTTjckG%@o{BxWKIJRDRv=gUgsk4Vd(=rfff~~Q^@!~{ zFb(@4R1-tM;!kCdNNB*bx1XP{w=p#hLq%CZ2(uqiWdv&E_i2|iR=ykTt7&^ij~}h_<(t^cTe~+;`mN-Qr^L;TvP?7{KeBQj=*ZsE3?LG{bTvh$J^S%tQyNeC`lj*|Y z=sV;|z33eF9{dqFb7v~hgW3{*SQuPI2k=z;9YMIqtHcruuYfH<#ymk_C_?nSqeB3A z??4nCL>zHZJ=w9K$RunV458V>3Rgu@{tU-^k(x0n0klv~xnAr-ZQbToYQ(02faDS& zP{9wk1CEvU=!x)Oir$E*bOc5G{Cd3$JV6_O=(iutHk~hN6csbJWrdDv?>^Z|yYZL( zR?Y*d5zhza;&n_?uqtJloHHk%0v4qFrX!Y(-8E>EMW6FsNG_9`8Fs{|!;~Z=<1Oo! z)agvHljBEl*g#T6`6k|u-lQ)$1}PKI9u&zk>gwtgzFQy6myw@J-@-GXgjH;>(wYj`S|0b-pjPKhBQ&{sO5q9G-1 zZO`C(tJ|Tro|G;IN4ygk7I3Fhrf49*edrgbUVx-`|Y}!@L)*nK7CYhw$o%0_x)v zE;)X(SvzD2zj90%_;vil3)LtMxcMg^XNx-1i>l4}`2E#@hmVh*nmVGU4oY(#L^U`s za*)qH*`lq@0p!wD(7?$p^ziV|(a{l;{z)!_{+wS>RMfkuQh+wSDeO(8)cv{`t<3%Q z6c6L~^V4Gxul6w_9kW479QMs`IWK&6gHrFa^u`oixIyYoo-o{dU$WbEAC!Q>7q*%{>GxuJm@7LJY^TGv;iUro0Ohc-6992MOk z|2_I2J=71{blhMSO0NsJH4xKE_~x-P7BOH0}U9#8o!bY8xfTUcC< z4vy}4?~C?d^<|jxC31a-zo2tFl|^%y>$4)$Cocu0&hMdTnBI#MHR$bosglg{NRpg= zc1A!6-RW`p`nBatx~K`Xk(1I!Au8+E@%PA7T;~)&hP;g!0MRrSRmehM{0%%rJHXe+ zF7s~A8bGSq#e?Rab=?HVa`IC;#wS=qxag((gFH2c|Fs#+gd;B;aT>)$HyFG>QF zi6kqN5VvXHUz9@k%X9v}-kF=C+R62ec4sv0Hks(*OlK1*sli*>VRN>)j~=`){mt*> z1{C3PmLvk0uZZ3M0oPI<6y%ztzg<0w@ymg<;i#&blb~@5j^BTj$c(#z*_ycSE8VDp zjhm||-CFW9I~LoWWr%E%&z2mkcGTQvsy|My%Pg6}AX_+vEHrf>&+3v0CTiK|=G>8yUIFt(m=`xE3n?gUT zz7WX43&*RuxuwDu9_NcIbFpFKwc+<7+Nh^%-MI9C$yY65J~zBrr6+4K5@7bn6)yTj zq{$xM<3ZKft=&AK!Hp9J6DXmx>$ANE`ChICCa0u)GY}@`_e2xE7@*95xf50}s#eFI z_WPcPkYxj;(vDMbGg-z=+*DrTV{t?RRLk#1K)_-S$H$gw`ES8~4&xoqSkMcRYpPup zozb|5i?_v?Tv;yc6{u#*6|S%0tt!+AoA3u>1km<227%QysqfT_5GhXj_5ClvYYIU$ z@r%9)QDCc6JuX|WaDPA*k7b)%hSNpH;DkOsL~aU?Y6iqvI*uk0JP>=xw7$E|$<4c5 z163hw+MPGT?Y3b4Xkhr+o6wUI3M+Dn&jJ6|9v`*-?I=Wvl*q~^5Y4xhH4JtzkT=Vj zsI4^^%CC&;BpCmE#4X4=Go~sGaayBVINYFO#N(Kxk9P8)#Q*ZJPsQ%&%q-{#T~ zaU<51t7icVxG83gDQMqs%iCCMq4>^zI@>~_-vW%y;@ktb&^QRtg-=+nRZ;-xgAPCh zMn=`H(e9QBk!EZA%DMHlmPzoPWuX+hC}a28W_iZhu8i%&Tn;k|yOxsrN4u#F{~2Kw zX{?f}SMZsx&FaOVmbX~E6_#PfczZ+_+mSthWnawm2^*sU^^d?%FzNOl%HyP2$>{45 zv;q)R&w!WS*P^3GzbCtlk8rUq>*KZ?K|5Lb|Gf17IqbimmYJx?i)>+GVGv4eaB$Go z)fKXof{@}fGc!x>T5zX?V&Qfq5Ih6|cU9^PQW&$~KRrE(iHT)L!yzw{gd_c>RiIWE z7w;Rh!@?HLNKe;qb1!RdZfFLYM%0%&vYGE`qHN~o&b(!jU%FqNAe`F-XTJa=6l`d)&Lv?Zb6}=58}xd2k4zpg3lPgn3+bC%);t!rO09=49BmCsi)o0VhQ) za=IL;!>}<*MeE&Ce#9Y?Hp+!`s#+9KL~6UR89Dxg9^F2-C9&w2$@Xv+$dGFd_4kK6 z1p$1$P*44!;}J<41y`E&j8%4+wcYn#=gFh`eq*q^lA`Clx(W=Njyq#i(K|teUaqC+ zOyjBkQ+|x#XhIK*c@0dxjBiiAXXVs({^m>07z3NxshIttg2bx|^64HYChF>Q%f5S< zl`s&iiD_@XX=?6Z0gntODr?|r>5kTPt=-#@Mv!}xS@@Ay^vY!pc93$U+Nh?8&j@Zg z&CvfTOSGa@1i{Pe>|OUJ8Pzw7n8c!inTzWD$1jOTkVtOa$3KXf$Vh17XVe5uy@(BL z5WFro?(gpUDd8$UL5!r~<6GI-AdMRjURD)0sTq%dynTE(n(cpQvHksnSz9unhY-+w zG-8L8iVAU9NK=!i?a7}6qracv;o+UwQW<))#G{sVip!RrRCwlM3#;6Y;6kiBg|87^E0KH%2t{^ ze4u}h0M{v#p{6DtCg#@O9-OJRVzqv2Vrr_CwUc5<3=5-xf|{I~oUWXh8q5#&Lt+|~ zZitS3X%wFkFJ>fLsNso!WQlxWUpsVT@l-R?5yL${PpCtwl>M0zPESsRg?UbrmJ$>Y zYZ`G##sLw4f$DZ;;|u>(W-E4eqUx8x&4thTdb3M&qa#6V965sZqR zORA|Q>V==5pNoOT(&bDldU`|{a{veyI2QJxu}ZVQQ~cjlw9L7DJ|(-Xd;@uhIdB6n zVlQl{2Q_{9RYtIJPBa`+m5LPN%aFv{g9dnu?BJ9GV715VWTa{GN`Fn|wQzV#dcQoJ z_xDRMIWQrS33_q>fk0L|EIcN)@IOclw}~bKv&k-V!qwkpPyO)!(Z5;vYnYGzfyT!y zrsXUP$mihOSv*fWx&!Zaaw_NH4GOiavWQ5<&mdx9B_v?@Ze1P-kBv?IXu-`%G!)W( zVf?~YQi;7F?r7@IPZDq*K(nLSKLJ;1oql^2Xzo65=MG~K&IutZ2z(fBkk1@d6@I9! zrzAnbL+>oswklmniKMsOZGDFN%Q$6gLRH_kK+S1E(R75CaED7DHh)sZwXAQNMtmyG3G&(ijfi7XlXhOD|Q;@=G*OsjoD?w zYUNpV0*zZw!t*#oVDx;n<&ZoDc^G8-LQR&AyX#Oa6z!~`UD228i$#w!&h~oBj@=k( zLPNv*z#oo+y7oRZq!Og~_&C0|n!XBKIcs<_U8lzCVhGC#`V;zF(D-i4CE23PKVs_I zy`KZ6P_YR*Ev*hu$$}jLTY8+|1yDO3O#-=!iv709>SpQCCNN;gH%}`i`9rZP;X}_S zo4-^ZjeX)Q7NTj#^ky`wm1Ga*Fp31^6ixLRkf!Wnysyc`wbUyi{juD1m+z0@q$j*Y|1;@y2a(1PBG$k;Zy;~1aJ z2x-&M(5QV-Rw0)Tr>3S}L+L-8-WI2%6xfIM-43(6Fx)V_c$lh~76|8Bw03fV#WfM_ zu<}M|`YZ+JTpdy_?Cj{s29t`ny4JpfZX2c3!z0HMna=ioLtL zyZ$?yGGBUWdTC^&vpc(0s zPg}^I5L8}&Zo|z6j&f;TnVLN9V4CEPPsk0m{ugrxA1=j+?<7%I)l*}mD|Uy>`|ivavJG&95p+Wkk6tSM0M{E5 zRLQtUc}K8BW-}X6h%Ton-rkbuJ<3t5nVFG5%Z8yJYjvvQ%jDfk#$>9>829_=JD72A z!b57WQj@F5Pn!Isi+5Aqt|4(1&*os!lAesS?Jq%#>607m4EHZTg1QQ)z zo#D^S`Yq(}3V(?#YsKW{#~>R9ksGlw_wlyR$GCpsAj}`@kLycg4KnFvbvWMbMYO+c zWlU$296SWC2PLW=o}b|1

    LDV7d!Zb=BgsQDB;&>xC;j@f0t3fpnLQ$->2z9y?m! zQe*e~MjbuDt~Wy)o zim2TpWx>*G1moRd7_C>rd%pw2FJ0@zKsxIVkAr9BZ)E2^Aq6{}0$a`DxW`y)=NTr; z=#DB$5P!~Bc_^cfftigBL%y8A#WThzljc#f3w|Dc(cvm~a;3## z8OLN9l+SG;unO4LRa;|SWS0|fP$9)~UH0R8TB`PT6Kh%T?;qeH3}eB^LkM&4Q;(<> zij@oFnw@e*x8TNiNZR6i^9# znGCvBN1v^^s+sbX^?lgm@xPiWx#W1&Bh#taI6CSmV{Sa{J6vbf)Z6*z`)?+;bU`?% za^?|4g)^I1$$e%L0 zvoc#N9Kxh>E-a|n!Y}D{&_UA4XLstD!Spd>c(5G_eL9wrTg~VJ>llEtptQ$U zH`Ng&wfCp)t2ip=x7wHcJ)(JD30eq+qN%y4VuS&0Wo6|b#vOsV-Hs47eM9kqtmlHY z@uP)~l7W(e=7qY%*YumTuhWR%7q@vBKfqnYIJFoPQ`PnLHAK$pqN>Ux$)u>L9cxCT z@vX+F`{$);0_GS0zv)Kd?8lJTWssK8#x@>Bd&6_GC<4+-mdtCZ}(2qWMkWIY^yOF+qUgA$tI1_*luiFjcu#3Z9S*|=eKV+XLDxeGxNoTIoUyb zhZ;`@${qG3Qek`hi>WCEzS`;SP-Jp3*%g+xE2CuEHU3Sog zxYGC9X*JoWU)=N@c=+(xCNx^xF4juE4$fDl7Y7wSk;P+#9H~UB_Rh@IDDeqo_D&0H zz6E$N{mJv73&VkdKmUQ&)JPVo4`TSF5zjwk8i0 zHSrhpDLpxPqGnEh`eH<3RDG+_UjsvVQB5t2soX4zom8q;GNaL+-yg*!UR}sD&qD`p zy33DWq1Fj!V6S8!h;J??tiq&53HaPLM%xrj)WZ8m-KbR=43p6Gs;4e19?5zeHhuR@ri_?38@_eD$W6QB@}YkZ zYi|I_aj1TQ3c0bz3RNxZztPcQmK9esB}cTct^J(=NRN;1xbvzh8XM^6848>QlFW_q z0aFD8rCw6&MSA)65Lc$H*)Dt#XVaUjvqv++ zE!ircWr$)(?za;Kme*Y%TL?Ap;SERh8K4_7-RY}6*DX=B{<4DkC`Fss;HQ7WTOmYR zML`{Y_L!jqY8o~m%Xr>=`_%z=`REiB5!>Io_2N~xenMo#V*xrVcE*SjdKuVOwc!ow zC%)iGZ+LRDJD!@uRttN$5eye?yGh>X^fS3RuFJvPR~e4Tb$hy_d|70CPT@2jQPz+& znLDw4cs`u#i5aiuSWW&meL3wE%H+(&n*FCsT!IN248j_h_MdB$I{_;&{-TYKr%8l8 zq2%dgKokZ?n2m?Vnr>??zo6DB6;YKns7uL?AYMVl=`|9Qp-}z?$I}m6+y%-(-X(xe_QAakCD$^KX zT>xE}$Ied+`HX&7n@GzS{4dhB{#4ar9|Sx|eG>1DMDNV&wa!s7-3^VRk84634X`B< za}yV74l7-p>A|~VX&#(W=|1g?7lFIusO0?LCe3RTN&cw(jmUR02S-vJCXnf0EHSv0 z2rU2g|Jd>GVioZ&dpwLdU%GPkl1chL@-@&TRaZ*r(6d#1v2&%yxNV{W-#i%10f|Gs zS;Re`rKhZ%Ur-!6{t3GJcTk}N=GCiFKq{a2y{wiJs%UNhVjaEV1g4+kV8mrN%Rzb;e~%tG<~zl;l$KET2ha{QkTiK-{B^h}gU4?F^3aztdyzjfJREr^0 z?*H5ZAlRuVnx$dR4;1BG=A!AeH^Qy|a1V9KTjYA~h1O1n;T=eVLFTD=0!VyAK z2|c;WjtY7{zP0yj)BEuD?zCTj|9Y70^s0k%x^E695BBz!S65@AqcpWN0OGBsrB&~j zZOwRf@L1Z5#TPiD&k-Pv+7X4+xv~oN_0=_!A5`PL&lPAhCnKYE zc3QqgT?xzF;yfqg^$4Ccq$!{y7lBO@;rqkGtxx|=X)7uMvYd)8A|9T?5tv#U*GR01(qzGA^?Y! z`{KYrbRNqrNJ^$MnPdw#T$3o}Tx2zvdr6TxOTc0#|(NzI5q(=-)3-p!||+C6!^uOlfo>D)YJ*vGyJkl&*>b z{(U`I#S>TS|Gqhi#41DorO*g%C!uP4k6-J?ndD)_E2d+5KGMW{KE<(sQgnj8V_p8( zz)QbkORp$k0gti?XiVZ4XsC`JD8Mp39y<8Xjw5xgQG6xezbrl+$;v-#@LNP{GoB>+ zet7i!u3t2rVRw1H$>~q)A^L~d!-~xtdAlZGLch}|H8rjVSw>#o-qx0$j&7GBObF58 z<=%D)?+~pw1wq9B-zLRe#4ftPM(;R%>K4zA)6-ay}9_+yC<*%EVqt<%=hNC75&*o45=_JCHM zZEl{~(FxDKPj<0mr&9hB6o?*@_LaJ%^VnAT!|#Mssa3>ew=q8KSNPM{Kt8y-prTVU z^$SEuY8s!!!yFeK%_8$W#;>Sv^%d=wSCq zSyb0ojn@%EN_vEmI^YG#sr_bupP8B2;Q)qE0DhjZxn|4G`*N#?o0S!m!@YgUgo+(n zTyk}8{+5X!K!jy!rhqoiEp`UCpmA|fpGvK(rFR#@$K@eDgiWsUQO=4|CHmnSf? z^vLUAeG2aQTZ(EW?&6j7AA>vN%pWqAg%km5PUf3_lY%=XwnYk*R+Y` z`GvvGq{Kg7AN{i*p1!F$>GDo|K}o#sDB!qk==;M)go( zN7i59Y`ddMnC$44#(tgld)zDdlX%B|%XlxgPN$(k+~!VZa*v)Kk6y&yMood}RyE@S zRfePjqL85|94*Li%?APsG4OM=WW6oRKe7R+Ay?hWCT$~2LdC)ld1|)aPzIU~>{|37 zr=yQgm`wo8MQx?%V}aY_b6HjZMFVta3rGT+3=5Ber=Dv{lNE6*6Meh)-wU2dfFUR~ zsq#;>LcT)aGNRHf5fRgcaAFy1sHdo;CTNr_#Rrr$!EpiW4+dtU91Ue8coBqcdVWQ{ zdZhULQ^vDP@WZR-i9`|KHv*Y7Bbe13nU(c+;pxF&LiT&y&B4`eqPZez0zw5Q)6k`? z#31h8lu+J#ljnqgTE{Vg_Ti6iFesVe1JVD8#d6tcIkeKVa~l{c95eHwZ(mKMCzPU| z_&&z=(c|w2+v_G>>cF*0PB?#M&iHebl@H$R8{P;VjVI^DzZ*3z*8_xh*`XWcp!x(jBzJa?0 zvTyYF>sA=Q*8$ZvZ7Zc;yV||}f!=o8)?j)>b@qaP>HS>Gvokv77kMLPMMcMzKcdPa z#)z!!?7k8q#9MGAy~{X65*UwV`Xps9gq|B24jBWHj6^nv+4n29978Vqb*HySe$n(i>VI=uHjrkU)7A&;KyH%3tj zU%1()vf#8hwOm$OZqiPgkcC!{sk7uGknl6jx38+=o9!w^A=09gGiJa<{Gwljg|6>h z_)ThyH6b{J#Pb}(=zjLRixk(=&bp<`<*%nADk`huf*AC26q;k;`!*7dCmQPD_8j9E z8l5(uZCmE@#GC}qeXJwbGB>zoPSNO1%dsghH}ZK$dRpuNQS&!+%3q>2d(UF|+2dGK zQ&aD?%PP$}5f=L-sk_9U&}&^G`q3Y;*F?k&}0TH45K3>WwIb1p*?D2x2`Og9m2xnBIw2o6|x{xV(118yenk~gbWU! zI${n;OcStRqqF#(%N|2|)0!B8AtMfD!E%L6YS(Zdu4KKVf)~Sv`na>}+N;m!)Z7IU z*{|YG~JZ1-F3PKdT{{CHk7xuN0etM|xYEwg-{TA8gUW4r0F&G)= z*x7vWSe>`mSc?%J`tpXP8H+#}k`x?@ER6%S5|*BQZK^MS4M%h>a_A@LUPGpz36|0u zy2QsiD;ZG+AY-4kya%0f`};@GZ)Wyj(nkTWC9`>6-HEa1pheRRZy348bDlz2+5E5p zn$dRly~&LLst#BFgawz$b?K~W_X};mk3wS~xt>hrznF?bSTX%`cdh3y0vH`VUj3bq z0|)coQ zwwnqFS1Gnl`1$f&No(IQBq-l;zRmq0=5*a1<3pIgh>Pus?HIWa6QDBvd?l2xfuX)e zh!~sotT%+8dnve6xHX6U;Jld4lUJ%NBOs{vBJ znDy5b*x3{dLf)2+P!QJ17}U|#kt9c*>ocT&4ctvjO9MK0fN7XhPD=~-Jtj)WepPiA z)SHAL`cK@0rP+uJ-}<{7d$-^_1sBdU0M;?Un05i@Rf{2B3r1wVxS~g!l9;r_#Pq%y z-uF*pfNpAU8|9HMP`oY_1idAsm5fgP<5(8S)F_?0KHgrmo6fBv6D6`95B4kc{crm; zn8=dv)R z;RsVR?`V3#)=5S7%_XNCAr9Ta$~;~J4megU@!2Mu^McmAIvx@dn*|OaspiuBB6|T@ zp;}U5USz94@0_fxED0;tMl?GRN@p&hm$TX%*;6S~fwq{1QXLTW5LRWUVfnQRFaivy zb=;U0r`y~~u!L*s>vutulZ);a79c?2ArWn0eDs<7eV>Pi$1(Wz;zcvZD^tMK<=F_2 zP*=NL1|>SNrI~`0Eb^B~8)MQs+oi~=;BaZtdL5sfp1s6?w>_>Nqi8Jb-TI5$nQQL7 z07siPA+aYD5l;L@E^G|zPK>|sphosYub760LbnMEG&B|<@Pp7SBK6_8m92$;i*2`R zhm|)93Il2nH5p~)__DGU0LwL`=HNprpPgAd-8%}SM)uP`*fmK1oJ&HYpb;#KDpczK zJZ5uE0J)R2949ZZOuDb~N3<3=$8LrPKad?O3Vs zBapgV_}Gn?mnF4(-%;;+mt4c#99%K*#ga&l12*k>;z10ZRHO%KiG;(kR> zZthsp!JJo^;ISh4tnNf`p#tU^&;vX@z3p^EU^vZ}h}j|)^nC`vTkNE?Y~G(|^z#<0 zN94B@VwR>$S(7T?!lhTiKU2l7se*EDscv$8HoI+gHy1BKNlVts1pd-z0&1@|n;mc! zKBS;^hf#SSSYi7_1QOwA0{RanKEBLa6TG@MLUa3T{SgF8;bzwE6Q8roToD);n9px- ze@_*Cd$t06C&u76{hpQ#ND~s{xJz@o7r*%dh&v!T&e%TQ`qf()(n}@LirmphIPG&L zVmzHPWFinn%-q4O7Ny4Vog?h+kj)U=Cxk$QiWHycx)Xh&Z?AKi*=2xo6UG3oG(+-H;y=|P~MXhtHVlIqQfmhZchKJgDx;a?U(n=9X zOi1Vz7NMd{vMeaU2pK4#R{h%2Frmz1L_!w<1-HXvY*ztsLP2$U<5K_7nT;?3+h%pK zG7D_>JT|=aC=Ig=55Ne_KJswzjwB8DW}g?{{gu+u z;LwszmeJs7~ zULJKEX)y#zBAl@!Eltcy81xLE5bERO;~|~vgW#kHYr67KE@K>oAwg2bwdtT&BOG^e zCTA8$BL8EoAbrGKpbcdpR4yvotbuaU8VO!frA#TvJF}>XMx3ev?Y-EtgF3aRXw!UF zbapyCpO~sMvHrTo=?T{J#mqa)iA=mlGQgx{H* zGeKv%Yww-RyJV+94e{n{66560tiI>984A(neW2;+py49D33^FMMSCllUf8b;cFDy( zyAa{^t;0D!?{2kL9{eeRwR(~r0d&^C`lvXrg|;n=|K4 zvk0BIQr;PAj_6z+@~DhxS?CGc{5Wza%785^K+5h+h|sB0yqH?x{WkAMBBeqEVdQ;pb@4d ztvR#NHwvleu~+{^94nAX3*I(*UGgh}njrCSET==ppN4Hk2NZvyES%C!mR-jWyanGC z``xmZDfa<@B@GD2ZBQh=>_9&59z_w(L~4{J6bzFjtEacIifZUO`8WlcSv}8&no5#W z1k6VI^BUXO7FYT&79Y=TBO#|AWfK^4i=n>1+U zA@R{iA}Wb(SY`rX-ejlrtKks0?E*bW)8`0JFrKlpS5$x@0grjYUe;j|m zGxYlqQE}ttCz*Dk!bM*y8Gn}`#{3gf`Ga;AZc~cDo1`_Nj+5>S1mLz=Jzq`Wq~@Xh zkLqXu*p6WWyhysV#cEcqynYMgWJLHjF2I;mS*B&i6Lqn2+*5ps0Ah<%s*(!)B=BdO za7Rkhy)lFI4+P8U%cneI8jyjyo3xC>x^ew?=V_)vE}5E4ABJi;nGgI);fCp3Y}=~$ zR>0=0S`5EW~_|cbwbv!43 z&UI~Q$0%dax^|ZDk$n;Ko>09cmnc)zTHHf%*8ZkIH7i$lx0{2{aCHA{KnmtlkISNw zr1c6=pOSW8IY5RLI%lJA?(9lwnv#i1E-6Lk=eZgZ^Kn?;rof<}iZ5w%2!p{W_eoL6 z+ka)BSQ(klI(i)CS3EGst!L9QF)gh-T+!_fwaSIoV-WOc`^wBuq0&%sQe%UQQWlx>3lr{QUcWxm!62e{2?@|0CfE+~#Uc*=HGZnc`WaAqV$<0hlm_!^lb(8{kb=j0t7 z1b*Cciw)IGw#Xr`(hor)qH0Gu$6YOI(Ov{n;E@RTVjB5uOrbXFh=;~9^={OnkdjAM zH`)CEUGVRFkoV~SzM>ZcLqbB9eIn_-`!7)%=rGndHmU(mk_rk_v$M|5&fag&?D50q zENFpuUr2fz5TnGMU0f0p5>(XH<>ln;tgNg66n}EE%lD7?m-1{xY^ zlvGp)LvdsP=Zl}8-($vQWp!03kA;N=0Rh1SwZ{wC{woyB%!(Qs&3SncF_RNOryPk$ zAR|3J0^o&W{NthKe06lZ%FRu6_PZ%+ZN){0>xzns^7QmFF<3fZ-1JpV|O9JG49y3nP z2NMKhVqyT|!~sMU%Hq;e77mW2U%!;p)C4@QcQ2WM4vDnG{uoXyDItl*X8<)GWlEI= zd~Av<3JVG%qoZezTzq=M6?Jsz7#U;!$BU(ehx&ZYPfJ^Nb>+xssmkT|>fz@n0B|8! zf#>0XHS+fM7I{(@7XEuYU*>U4gNldez1{nTPx!JCc>B^hz#VFVij2(pY^4FPiQweq z+<{X|URlv%XJ^NZ2p)v_KaOk+z~7USk{SxWd|b_MYtz=$^u##MhJ*`1-llN`M&;@G zgkgKH!$poNB`qC(sMabD3=kLKS;D}=Mn^_&U9oouK_d}s`)ThPLI5R4B@{qMPEAeq zFd4rDNQn*i79O0y+x+G8d&QlxP^=N0T6an9^L-3d?Ex&|M@C>{ zklQJMpWrHz%lx~F5S10rNAe&bbCl0q6pt2TANBr~sag4lT2e5h8H>d*$sCBv%$)4c zA^kiXo~F3--J|E#RXXAl4Qp;SJAU5Mk6F>k)!3DT-QqGbH3?1l=adP#XJ2_U|AUm4uiV`k_*g$G z#yoKO3D3WcdrC@y@_0&X#D7X;u$L^-r(}L#Li8-ItX!Cy>i*w9mJtyNDlexaOr5|d zEl}T!e#$Vd3an zLux2ogY%BQJ|D-p$bt0|C8BR6`u6hNVn|$#b(S;&;~#>S5JzILjgW~ zECg24T=XB*b)Aq_F1J}6*GLc|n=n%&mz+4|j;Q_jOU=RPLG&^sH*J@2PlVP+2|k<9 z2;SMh_0)`_5tUyj<0^J73oRlL`$t2KD!ws#1%!y$d|kL6n-uMJJ^}7G z0(QV(l)$F{NO}{4r3(oG0miim-^AxkabF+jzmIC+TU9uLA7V<6u^XMuJ((LBjg1^Y z^#yFte`myBY&<+cU{A!1L0DI(b6>mh#8FUDq3Nr%>;BsTg@uK6iIR&DzzK6BKn7An z|Hqq7N&>QxhpQniQYtD5K)v+8?Sk$?V_fZAUWe!#wJ|^M3cv^r9BagLDkKq<0yX|8 z|A^Da*KMpuH1?~eEi{yAK7>}+swo?TJ+`WEOG-n|ThWZPw0(K@1PVET3P1&P#nrP4 z9N)E9-A@fYjVI#SA=p6>UGS_=q+`miEA)CwN)V=9wCa`Z>r!7d=`byj(3_n;)1uPB z3WGh`1bx!b5RJB_x!K3}ND|I$uojB{F=)$wJuZjC}A-9UdBz1o+HtZEb*!-WAP1 z$Dzvdl9Ha7AOleod3E>Ew{+7)@7O`GQ`U_?5L9UPi4YbGOZOoUN5 z;ROb>PzWQZ*M`?NMBU-cvKFHklFMcCn3~!aR#fmSg8?PRAbL#y;NZ@cJL)y|xEP7v zNBjxagE&&Xyl=(gI+G}076@}90VL$%mV8F6qpM6$M@mOZbN%s(U=Jx~g5P@Pf=qSR$)upAdGk|*uFE8)rdD(%gvCEIs-wBX=@?|1TZO37T&M-+) zmi^NJy-`|5=3=ue217zbSU5a9Tt`QTypX&_?C|g~v;_S$bSiFI@tq9xJu;>z&v9g= zQ}?t~`W_^ydo=jX&S$+uUIcL2`2in0OpL3$0U^udYGf36vcfuyhNi+}?Xz`<@q$g0 z^(cNjSHRuo$@weE)I7o<4P<*}L!zUn7|lM$=lhJF_iul@_6CPCvG!82?baU0&Tt7fXStPeU zc4{&s!MpO3ywk$9Ww0H2#7MWWF|g?l;X2y6tewq_AAP3<$O@^r2YGD%CGBR+)0hk?;~@u zZd{d|texFN@t;>J+Wv~ExR@AeeF=f!S8t}Fz;urH4 zOD>|45a0CrHA<))IfG5$NXtSK<@;R|2j+n+pY#Uz3Er8F6Ng!KAp7UB9n8SSf2i$Z zt@?u=n;>VWt}rpVwd$a$ zLMe%>LM}86p$sz65Qq3xI7J%_Tq@D8_6d!z*WBaRHFRa1r*g|Inc(QFBKgfT#^N8P zuZ28W9b^0(Qx?uy!3`2fxTRdSjs%tax>R-D5{F-rI=^(;R`( z3c>`8SZ=vSr=(3SS}9m=L12xN#d1{ZDZVq$$GtXBku%26{4-N+RrVeZ1^21JSUgTh zGpWAQBv9vq+IWm?;l%QNx_TUW`CAo;v!bBu&x$ZGaE1^;sMMl0Zn(%KQQ~D473+2G zNR%?sLd$n+PtHqzOr=CGA?+z6=jYt17;$lt1_y%{dVfHj7ON0QSxd56q}&)YTkuKCGqW4$9~-o#J<*6~$p@VYVoUWTTn zsU0`G`x@v|F86r3EfN|61{-LSh9Vz(5X;zoF*5TUMqNdMYAJdSAB}=>OPSX8*kFfX z=#ybU$@|{ti%)XOpR4XFiC`o zVy1e8W}t~BOA8X$lamP1#8buBd*a3#i%0U(7iG zN{Vlxu?C1)3y5$jCNPJ;FYf3C2{sF`6=@xKw7)UxvNc=5r2ehv*~W)TyKUXyJKP0X z?P@~0DZLdGB_A+ZQp*QUhrqvBTiew$3WFi*u3AmecbmpbihVt_)GRY+XmYY^PFC_H zm{KW)J->JkJ*dbR12RR^NZd5saOv;;kA9;ID}4nd#!+` z+vllyh54Dj1B&}!sX5HrKfiud(>_LEe5k8Uo=DP*Bv3W<`DyCLScgRLVBXd`YGqCh zEQADCOOHy|@EB@o;YRegdfrgd^(H`#z=Pl=C1sl}98r4lzXZ~YgZn0u`Io+{MdW>i z8-FDc4h$ByuIKD>Sf=&TJWn-bF^-Yv*4k$StS!cx)q4*zZ?F?{{j0WwZ`(emMh{BKNlD8E*&MMQ}7y3P;wafA3_Lyoh( zJiS`mHb_K#c_s!|Mixdni+7hZQ)F*_x5)gP7Wv^JE!!|78?EjW1g|0Z_}i!@_4n!y zS4$RsAkw5V)d>_;(J7vwg1a;<*-=S#E>wy_#5;>aooZ=`B(x{8H@l)I`VNmUUki9H z@mxIb5KW;6qDPHq>P}rBEhM$-e7lK-n(T@L{7LZ|tjtq?$C^8Mb zReI`2v=A8E*$GI~4AP5f#BTr&M<~Oy>1*}wa^p;MNwEM9UeTjZh*MBzeq}W&9==W>Ca|fjo?HxH$ zLFbX3Y2I%$k}xUa9=O0E7`!f!KID&n(Iu*>@y*v8`gJ*`dTtb zNayZD4?COVl!OFy_lw^R^NA#lK7=o;1BpNGH7w&v+ihdQrpOurXG|?;(lcMXo~X2p zU-zZ(lWpy+t&lFWGCYGdU-cQtn{p^r3AevD`SZRU&*U$xioK2DIAvzrz}S8>s9OL5*kwHh?Vz?xuH|a8C%GKZuk-drDtb$9P84A z#7#n;^Te}zPxYFuk8?0jo#h9L#Mq%s42bkN`@6f}?uY1wi_!FAJYY!6eR1PsHzBAI zCWZN@7xT{9PvtHf=!9&$a?SKSDuT<52RC4c6GQoE(owwRmwd za<5^Of&pb+Pe}u42FGW9{^LDA;ZrsbR2?5RT?6jL#9Ef;==x1s@=t3iEWe*;H?+{p z28M(yA;n50^FGG`;+hcRser{!ommW}X5M1iWyfXc)XD%ZP^$kWl?4Oz6l4TAxE)Lq zlV2GtTaJ4>T3T8(r8LOx$n;OHm}z95FDJVC;& z`Y_4l6zC9REA;vbxF1%842D>F4ZrQ&#xvikXXTnsRISTEPFz~E@W;PFkLuvQknLHL zg6R-pQ;Ef7)nos2S~1|FzC$>a`BIGFR1^e=kHW*kpP!yXeg==T-8dhRQ;-ArdwP2@ z6%4k?51VMQxikv4N$akTN8E9YJJwUBRov%ci07lVm7OIVZZF~IGZe3mXa0t zn7_qlX0Ff9#sgY40Qpx?_+j6!a(#0XL&&eCs2HI8sw#42wwFy``!2bJx0+pX{cbcq z$*@-{J}>mW$}^Tn*6cQN+Rs_wr@D9iz5YITpUEw);0Dh>byb2`O**0rNHNRkz(yQh z0_#fx77Z=!)lg}-5s82O(CZTOgQ!WOlPHCu3`e4NB9YF-j^bPbj``a-r9OG{wfCe_ zy`{^26Z+qHd+Og|m)|1+(SZjo>1(`c(p3--pWG!B8-l`AG8$j&-^Lc+sT8x1i z@M`ky-gzYxVzpVWc96W5;XVe*T%4(?Ni^shN6XFtV*2p+w@P|9~LyYsv zN5M9jhZkPpVfkU#!L5@vEqJOMvyMx#aNP_ z=Xm)kbK$My5k^eH#i+5m4)zqqTB9jatkGrzeZIRil)JmjzN(Y`H&LiyLR4igdQii64RUX|34;6GDj#-|ezM@^J~;XzjB3 zQ{GeCCQWa6&;?@M|2@XGy(Aa3&A`y;Z>M|EBK1X-hMWTtcwV4-9_(G4pX9Sz7n z&TJ2f^+*3H4#V%LdZVuk>M`3_v@(#>CjE*CEGqL|)_#DA7i~^aR#H;O=_S$QQ6-Xd zneb)h3Dw)Uz{I;D&?AG13FQ|gL*J^Yo-?82SKJ2hUXrZ-=;&%5HH)7pERRD6pQ598 zk|rd?HhXMC&;gD}!G(bJ;D7J4|GXVJ^a1OKO=?VXVG=_UP3~n*W@g8lJ=E=9Y+v-> z{!jPU?HBvB!T{R`u*6_VEiWj53{>HD{9BNQ+f+hByR*tj2%L=QaHu4{Pyp(HM4vLB zS)3_FO20bTQHLRs3rb5$;$UVbVWe_jm_wh48;06EMIZ)dx`r6#`jfl1ukYJ&__1v- z%D)TFyw{A^h-v7^6VlUVa0x@ImzV37o^fz+>?$kg=MPiVWq{@)Z@-f0(&i>34UKd@ zy%AKRD*|P&2sD!Ldkoe1r)xlD?KUx|qMngq5MNpd8}|SIo{Nczn2PG5GE6~S>-n-L z2%thAGy>O;5U48!y6Sa$#Py2_`E~vdf!a+vJFAP%V~0M`0$=%F1rP+}!@uhXtX*^v z&ENwXoKdmnRpZ+VvJlzMfJYNYq&pMC#jy!y%0P-$TGzbv-5em43t`d8zs451y zcE0W7**Ov}b?E~JR?^kg^Qa7S&lrXa4oNPl^#JQbu>vLQ&zH4B7E=}jweM)1H%(sS+oT{g#wYbA4;K(y-ESTgR!?mm=rf?LeQFc7S3$OLG6! zaF$!w9XBaFDSSWf`m#Vu10++X1(yVy3|f@C)WfHYDA6i`l?e_H<|&>PH`hW32+7cB zxm(+P9UYI=M0Nk|sUk)rBIa~=b{5K#wEBsq$c!X@P5e}nQ88#ew8n?yL#jwgqDg7F zX%j=`_+KhHUEp|CgMMFp^N&bGH(EU!!fF2bn7|;3bZELSsT8;JauDOey72@S+V!Hh z{m24~6rB4A`_(E1q6H2v#~tXaivV4yxKEK*ljZMF;(jQ5?GJ1a4{hU?j6 zOG;E7GU3w|7glTyAE5`lm^2UEn^H9Nkj7uH9lM9MeQo?;Q3XpIeY#Uf`M(h1`PHih z0zON^ggLj~WiM(gpFT(_@M-Xw^nD=|DiP1%gYgMt^p*c7f8!FA`e%fL|0BcJZuM2me+FpiJS^``-NyT8HW(*OOZY_w&F-QYxn0|&`BGW0K(mkH+Yh-7Q9E=d9)}W5 z!X4GHXMan6$4x{F)OfQOox3u{GBd|meg0@)N4e`z+4cCgT~h2c3*mw;2ej-*KiPgN zjWGBbj&wEN!3_*98|W-&WMt?tz(!n0NW%gbl2p~!T_J2>%Q?Cf{C=V;`bD)~uU>Tm z5t0&eFLt`UNOiA?0d49oy}Z{zX2QKFeDq@b{X0F!U9rSk(CBn3KXORpcWxM*WH;J` zh>KIJiv=kQe;$w>VIr&zJ)@ zN9pA^gmJ&qIMdQrIaW>l-K)~WBWZQ)a}f~U`UScyAsk`p*KCq~*}i0wUW|)z$r5$0 zdMDe*!}s6=zzi%czaU8wSF07BjNDgk23l3hLe+}9a~De;On@@{MHtL#SdC3eL3+J+ z4ajcc!T!lu5S{;?vla!*8#}Z9RGd`w_VV+RQ{qW>B(A=#n=+Fusj9-_QjYXI)D!kZ z){@DHFdc@8e~uqJ9?ycWF?XcU0K6QMdvQ@nf>|uGIN<|!4-g7L%6*N^ctVvwlLuyF zkJFN5Ffs)qpXPN2=)xxy3x~s7eDtdS1`qIrMZOnyhBV2KN#B@{(vcZ4g#W|w3NJ%QWh?Qkeb;O_Be(@D zS1k{1@l*Y|8-mTJ!&fdCOwO-qTx8Rq^OFfV6ptdXo2(L;wb=F8FOqp7`Ti}7{nuVa z*!&35%)aM=)O9kptUrm30ghT1hxLLhQd$jC?i-f>*46$Fy)W^Ux0TSaMg!2a6;el;oBb~~fM7>Iaet11iHV4Wba3vN zMsTD)6NY6CeUl$g1C<4--0l4)K=MFqf`Ae?mW_S@Lm_9Thtd{_Unv$F#@eDaAPIHZG{ zn}M({PdYdyHZxO==Hm`JnL+w_uV6lTy@>47HY{ zP1>92SP7^6B3tmLI@j;E!?k=}*8V888e>Z?ShS0FA|IeS$h_I{jAe_T^Z7}BMdF8oJ@sZAMQC(Xh{RmU@ zVMy=xVnU;C_Hm862Wbh`7tM8~?0n-^vFs%srMTxs-9vosaVhgm*k?d5=`>US{H`eo zm|BtBHZ{ef$uUtT&?FR$7Q`eH^#Ppx@p+gxhT}PPN*!4|;n>@X3wy!GJFJPP%zRzL zB4OzjGK4d@QZ7{?PBocVnle>sQp0?zpLueet==ITF+is|4f+5V^&d0h$Zm!sJtGBPs2gB#~)R@~*g zw6xdbB?)?JB^S5Q+~gt_Yykk1BL66^sGzs$*K@?p5&4b~b$isd;sN+NI4VvLX&=IC z0?6mmVa$er0I^Kgd^cdFHGXac>6rW+6zhuNxkX9YYqOtnIoJkVU#rUF3oUfq_0a|? z3g7kEg81fU^;&!w@LRo6i`hXRec0j|bA#=^9K4H7AA^6dRyM-qi+#dOrb1dj;Wc(E z&~`O!xV`V#T+Ep8{oFXLk03XMb86v3SC3D=z9Wg5`#G<1b<^TObJY6dl^P_(;`&+_H(>4UPMhsDT=Fx= zfb{h2?4Q5sr>v2I+1c5bm4@wY!{(pFrMZ>wrW3G}4EXPzWSTsDaAwjW==n?H3#spGSj|aV+DGSpCw`uSWuJ;KFkB62 z7dlqttK2bHhwA$Lv6roRLr9L`L5hlb0TG1=ZI6-#-K=BHSLlVI^fha(G7C(yxK38U zyl?h?M;10ysA&#@I`%!*0wx?9$hti8;WafkdwY5XLUKZ(Q~&`O6jH9C1icc!Ia%PU zfb4yM&FIw)R>2cnG7i$Cw-D1aCaMd1zvU}e-=SE01|V(92wPK6z!@nxhLDz?-uwFU zM@lgb)`)pI6sKPB368aLFd`_2g)R^&U|Olj{gX61`lfY%nxkx}#VbuL7(_P$&3Uk- zmUPEO=7Ziqt@Zu{Vt0hVQfx;Thm74aNV1rfohmRe3<#WR!99L- zQmyA_{hg%POMJW9Z(eKnN~9%Mv^`v%)Z0BLU+a0SZa>}lKd}emXi?X49oZUHw76;Z zkrVFOF)}gP?``|~xXlLZ%4~66avas=2T~AA?$%+evnjozk6Dj54U{bi#7cGfXpcFd zu~P;74`IGH+~+-L81((xEKe73@XT;+_{Ch{I549f5EC?ro|7L8P4lO>w=gH?H9}S# zoG5wm8PN3KoGf)&1yyze|1-^w$3-5^;MRo{+Rntn>k;#@*v~002&wWp6T1vlL3)r+ ztf>}pk_EqQ<-~9m>yvBt{pXC{pznzF@x~ebs2KZ5xP^LsO_oFrjr#NZJ2HsGL01+$ z5YUKm%#QR_h3)9_gTlX@TbKFn?(R7c5wlNkV5UH}Iz!NR{&F~#=diZQQ3n1#ZaFR+ zT&+QwM28uzpyRsu{zhLMF)5jGA|xoY%k*x)gu|P~}u5z?d>ia613+I3NHpD7V@v=W+M*GruKFcAXH&ixfnX3taUN*yHA^Q4YwMUtDT7R z(Ai4U>$kA)P7O!!kLY4Tr(C+at-3H*Of&eo-@Vf9h8qIMk5G#mCh9blDdg*RAH~yb zK1r`7!4y31t9hO>QrHF5TX948=EV*kWjQ!!$e}C#j+)}i^5Z_)+Z_eTuJ?Tv}1X{f1{kHEXZXJ0n18fYE%TF^e%c^N8G9VIYluI=4$4Zh|L8?Lmntg4 zE9=8~#Bp_XRd$l$11ugM54n{e!kb~a{z_%g@3JNfXlr=xMpsU_uNpV3dY!?2${>^BGOPm#g z{E<4pft}L@B|0i0Csf$p(#pa@G|Ow_DdX@bpKms*uNM2_^2FHKE9=@0gy{Fqid^-i z+~nPM+`ua{FE0-WgUP6aX=d(aaUI zLJxv$In;uY2D!05_R)Hn+Ap#6zUBMqC|@WqnTvI#!VE`HX=HZQAr8SN=!dFf=U8Jz zLP2qBbAs7~yV3IWClp$yf4e&@~HLm)EXYUtH!>TqQ9Zs2=Hl%SIp5*4CC$W@~6jI&*CP$p)zbYwn$# zT=;TK1Uv##?JpPjiN7WG!XD!NENBE%_p5dw)!~`&t*D0)A;9goH8icNit4$KvZx(nR9W!V{xLs8*n~mci=Ol>;y_7w zH4{+)@&cn*{wkj*0ag@FV{PNt*gqHW5VB6wSK_;yyKiyu5t4+d65&nXHx{g(`Ojb- zsXp$G=bctEEAR2qh&DoiuRI{^2CUOS&ui->CMGnp3CAellBv5jyv7#EEfs&h##L$L z%IaNGee|(L2_#%7M2L)S2buXeG;|i2VEsCE+QOG_gZ2`-4-4=3+#S z^CL|PNjUm0kC&I1CQDLZVPxEv=Wbu4 zeq#rf$@9C}Z=a4;_`eo2rG>;5)Mrq4I$pa}{kQ65T|1uQP4e)` z0AE*SVjk;lJIX&VZTiL_fRSiEiuU^TCT_d1-<{m^^}-7I#s)t!+s~gr$5m87dE`H@ zmJgq*1F*2kitmMsbX4LPX~EW2FC;9n%8j8=U0EFFt1*p_*Ys^-dL2+UEQ{HWbm3$+PyfoA2YP0 zHrOQIof%RfT7KcgaM9PTXlMXJdmcbaPmQ>|K5u9f4DMO?lu-FY#l&>-x5ix4o7Bvs z3(2OlCehV4&jRiknDw;X5txzk13Zct6ch_OIzXjl7NnegIgN&ApDfd&7Q+WE#*`1n z#`bW*X_SBzg8KHcRYP<0qS7cN_j_17qL4HZ2`#*CSX81mSbV4rna#Hh6Vu~4s)cRk zeqvS=b`qd!oaF;N`p7`1IAqi#6Yddsp73aC9b+-)MK9PQ7ym4+t*zxZH#74)Ud%<} ztg5N=O@`B@_(y5LG}6*a4QP9&73<;|1{-XWRJ}hv^IN2Cc})hYz-&&U5h_i?4HbUv z!{vQ_0sZJcb8wqaXOIt$EO7ixs56giz?lZ{4yeCRqAru_f}L)gC!cqp676jpB*4a$g z2?HWXiZe-&g|Hu)One42qg-S(Lf<5UW8p{+W_GucM&BC5fyVxukXIC)nJn`a!}?DP ze>Fh%R3r0~8Z1K~7cLp15quIv1bf$`#}U@rD~KA*j{l)cG(_IR$XBPq(Mr9cZ{W!@ zu4VjUioOPF=0KEqetI5gF`#k(FI<8I-Ha<5^49#xrR;Ea$NBn>(d+)JDQ%3KTJt3A z#}4VRGl+Z#2||l&wnI}#8QUKW34M< z^+*gO1tzW458DrJcZAfLG4>c^3hkE`=)9ETjTk10)lBTV{S;ekXa5Krh_NITu(08^ z>|Qs7LNTERt(~}K{D`%UDt zp0dG4Mjq=wnHwPPy6^o)IbY`fXunQmSn@_Tga1>5XA%Umy7v_`cZ2bD%Ju+SaYa9y zgiTiID3s*k3|ghAKK&Ka+OIl#H3_h@5?gxI^T@M^i9pS|Kmgn^?=+CMrf`;o)a0CSs%N!_0IZ=6=1anx70 z|9H66fyRD})rLW0{ViB6wR4k25SyH_J9v-xQaMC@QNsJFr3o@l%+@0c;)q|czbp!v z0c?DCQ}1ocAH$5mz&j;#v43+pJwpY(n%YNSVcRz4$8jpauW+X=coZK{?6AkG?m3sW zFpz&J|L~15k+YO#llb7;QX8MMHwVl66IC0moKePX1=nFih%-QWEAH>d89Z5WEJ&~b z0!eiZL(jO#z2Tka9k=s5(xy@te+O(%O-LSw&? zBrzomsro=GeGiEy6aALlXy`pl0ab*HwpS9d^t@K6khc8t=jCyw>DFe6U9Fu;Z*CWU|hxn5Uxgy|@@! z8ZznGOw>w!QBx`GCo~i3XQ;ikwzm!4`)`Mwp`>4^0$%PMXJgx!&HMDtzW~lb7aZ!B z$Ow@q6BJBr^l?z|(V+F8_vq=8D}U!uGtt9^*sx}4L#G>Z$hx{x{#-{cY8WS&!t#}6 zFy-osp;r>ks80+N88NIxqXIwjD2gC|(C?DtpbCEU7J@ zzk6IOIurca8KP%K2wvNtFW{5pq$AdI@(77piMP3Tog&>DGuZOh_Tf7E=s%;nQ%dJK zH3fyUmGa`yZsoID)$~bzz%Ss%d~5SDSz+)UPe5*;?b4%Y@uALBV9xj0qM;#9tA2Q` z**G-Yq7)mY)RSpFIk-W0i=5WHVfMD>Vh480IUNDQn4g<@FSp#>W(8iS_R#2p%|j+P=dAP24+Ykl>VorW$IwTn_0EYCObjcx6~0*RM@ z5VAc$+yV)hRcqBm%!9Rs(zk$@GTU4}^leD;MtsAOlb%x4z;Zy=MBZy*;JEN$+ugdd z;E5L3|CcIE558VQpFS=VX@B^7*t&x?_mNPodjsrEiuowisCBC5wmZtv{l$*#pse;c zbUgiebc+U>kF}*Hjstq$J83%4)oOdUj(VdXplOpaoqu!c!gES@4W|JB!fk(iXecbd zoSyXk!hdw> zqKlib7&>iywUB6T&(&d-TxY^Tn78^7`=u+B1-j{WtAQ-uZQYz4Q#JFGFV0}KT0+Yo zWVN((6#sQX9Fmt>?rE9vb{M_jOQG9ICU;bFmx7}OyT0B&^H~b%_|;L;y`)b>5vM(c zLahy!lkFc`-$3I!QZFq^MFZe+Wuonz$_xM8f)8dLY%Cs?gATG*nQa3#zdA zzIqYIlc9rB0v`wH$pLvM#HNtmbT?xLRmD?63%2n4loIWeue$1Ke3bezDb#mmcMr)FCv=v~!9vR6Ff z5s%?D|2RQf^YZ-Eay)psLrYdPs#DdTM_A9}JRg>toU#wVFBZ_Y!HAzjjKDNCT}m*E)UV z<#I`JDfU(^BBLQUH#12HCxJ(2`R|YWrSjt9Y%#culzwX?OLxs2j>&@(rk+CAG9$6@ z)3R{o58{+8WJW%pMAgKg9?}E*3>Of}r@nWV8Vnb0}=)!m1)VF9!?vTJ&TNsBn8s@ib5JtDPOC!9{{3HKT`mBx=QL$~-0 zWI|(&32V7OVArkv%pA!IFqhEttR7yTEr-6nPZRPQJ-2-7rnhf>Tl+3-%2Vyci|0_` zI^}-cwhuj+>Unvs{ztt&O(fOhQ^m_?IUps77 zRUk7NwDALo_jD&Po;f_U8K$V*og2@aTc%SjB^Ql_P<&SgmN;2G)(aP~T07L!J+eKw{(5MwzC2kUbYKq7DE%@NQb7NHk6KAL z(2qNKJec*^{(eCSosVGXQ-a^4&Be#muKD@&(;)rf{Iy#= zeqwu_kB42KkkI0{v{?!*ES!jx)OMZ-My= zHW`Fgkde`z_gzm92)e8v7667OC{9);sI9H!&dGf<4rG1bzTwbRbi#xQU@`W&-?-P+ zce}M2C61og*h%y=a7|6~l$E-apjwTOUb(pPtL1RB#G!c%X=^YQrf<2+?C7pingXN3GBeWzYgNNM@K~1cmpii zplH0f5{*?@%hIy{-q2J&Y)%3P9fueX&(YB_0Nd~)JDb!d48rR2QA4UP7*h`|n#nGM z*L83l_sHPajAjveKJm&u57rUW(SsCgs?YAtim>gd`eqHoe7E^a4b)}bh5L(Mhwvfl z31c9_O@_{c|BX7TDpiqBD~-4WdnNop%}moDK2rp;PH@*M>O;DD%T@!5MNjE1@j&yT`u?so;**{^;A#dqgqo||5a*x?Zg z{VYg|B(3*GajB9>*{Il92_KVY;hn9nB68GhgsdG0T&-F$O$% zI<*9Up@yE(&3LSAD7@U74E3eahgu$Egh_nueyQK;a||}B-AY>$^?o@mqa!lH4t?u$ z^@qz0zUOj{s_KtU8#@1|%Z;7(hYO*u8V&FM1Rl+b9+e4!pmzV-yMFyMzAovfCp8kg zc?R>WDAM=md{@H3y?iL_B6XlH*lqT6E-h%%v4v`IF%Te6uxt9TyM)*MAa_R}nHNNRsZR5-4JZBh=<$ZO z(Q~lKbIRnv-2uPBrF&8uYQgVJh)?k8@+Rys2)jVPCN@$gV){zE6%QGw^WH8+OA?1h zlm=Jj#|JoX@52CORC}KXQ_~HOVZ-E@KESIK4s*b(vOd_}hCL`MEYz>AZSj9;i;q`P zHe5}eEUGH4E=TdzQ#|l~+EEG_Q)Jv^SOV?Sj*svW8Zy6{4Zd#8Ci5IGYCRAMZZ@2z z5&I#9biTae7fB2qxX6XxGHCZVCob2eW&0%m*LNELLXpx#Zrpmyd~w8&iil1&rGLEC zidYo8r0(EsXqs_OeX5kUXz!k77UB6oOtbUlrOiuxlXyuZ@qKF^1ECSFq5SZ4TBmr>DChD3lM z%-k9ffD7_z0VUCTCb#MzK2R#TO=xbo0H@g3b5YEaHfc7t-)-a%iZV$B*aa)5X2Kv^ zrSLifC+>%H@rxbOwU{ea#t)g314#KF*1PQ84sUmj)t^xPp3>g4mMbxq_|<3}!eCk| z@n2Nf^3_MC6N`m1qt}yT!C`lhv^_I=eO9DiT7J0FFz+l0nBeV?D02o$JifkMyZbwya|Ij@QrZxkk72|5_fFqf5)4o5)DVrAE5!p_ zXMJgDsSB)ThPa$uWFqn>*c*i&C#9_ilrLzzCnxPrTZ2``ePi;fA|1oSrNtKGi6`yv z6CPAxu9bK8_*4b-->Z@*D13K&C__b$spFq>CqDSH-16Wnax1k_L-AA!D`UhLw-{08 zjn$9~GeSeL_qO(2O7M9(jP$RedMY8Sy6J;Rk3yK2g=f}r$4(ysNz}yk_bY4|Z9;5} zb;giDB3=(byaI`2pAs%=Mfs~^J)C6)bSJ~o2HNz5`^0?Nf?q!nzjG8@wd_j|#51Vk z5F1Fjc6Kg^Twh;rb@huMI73XX0<-Q_iE&6FSC&&7+bs)jk7RX zU8yKxv1H=gcw6aBe_uD)EcVGiS2IGBuYf3)>D5?{aupi2&>|@^n>`AZ=o*ETHWlCD zMO;cszZ%*WXU_m}?@%W%c8+1y>M)DhE2_@nw<9UGcMsj8H8-Cjl_8D=DUql)h11R=Sx6*-4B)XeO59R->=H4 zG-1*RaxQ7-D5`~pTICAaQZ4n94o8E-Bg93jw^E~!p}xYq^VpQ=7oa?Js8QpYMs=#r&1BDfE^>eU zO1+t)N6KW-WP~dh8I7MkF|DfL?CDGvTUKxCN2q6{BqB|6ry!XwmkPBO6+A{6p_J(l z)gRV`6WCG@@#R^3^Hm+)q`!I zG3^dPrcIRCNjeU16T@Sl@&gsN3!>bbSx6dzQie&e;2SPRhL9C~{F4&WID|vYZ=J+u zX8C_G|B!lX(iu<*v6Ym*E&0q!$)L`lu{qEXK&XmRzk{jnWA*R@>W4!usSsM4V+Kp+ zpk%8yQ8#=a)Y@>4ye4udQ>ebMAEP=IjM0&mt&PH~uRpX3Jgd$=2}=r*iGJ-4hE_pG zSH^FMi1^~wn8!glz*8eKoNcxXEC!E`kpCJYvuSl{IaqtudJYdeziKR6gGJuod{Gw% zEMbP|eGw_n)PI^(hUlZ{o(+(v==6OtiSu_|s`-O?J|K^gN%Vxwsd(OPZkoQeiA7txf8*j&zD7u#irNnagsDyK9Dv?}1O6Q| z|6p4?&g3LehMOrLueYl1+^_+pihq_5>G5qS*Wvp8r_2$oQyjqxx2&jB0V0nXaFIOA zGm#;9P)ksVe?2&}{XBjhvwy%kyG1gLcdNVZ>5cU8!2ouZ=%T@h)GO)?6)?65(<&N7 zCzksiy)$BQVJMP6YOdGila8-dV~T~#A$OpK3k>tA#ddN9W6dLsdVh+w~enOjX zYBpVc*E^6m`zNAASAIY(hS{EjUpf&x&mHxcjZL*#QVk-N*@-F0j->rXa`gOilmVxU zrI2~^w|Sx28<@phXD&7WdDwj97nI2|9QnMNj-{ONIXj$OCZ1FVi;_kL3tIfONIa?5 z0MAbPBpNJL-_6Qo7x!jQwvg6rN}VV9)IU{66^mP7Hxf;;)&%t z|G8s)NoU&UCkgCJB?ooX(U>_Ose%;I&2fBe}&x{4WSFB z&tsFnk%fIU$XF$uk!W)f#w#a%P^<85k-;Ca_WJ&(FUyC#UXP51XFZXrZ8rWRnFE0W z!>xU@S}#dPdzUx)%J<9Ylpf6xF7an^q-OVZ+K02)Z$B10n)?>jnilclSrGf>?PuMy ze9rY?f^@ESRi!bnv7UeZ@}fx2yFS9Pfj&_WKv}^Fp+P)-*f^y1+^Z|YH;Ik}^#ST7z<}eG#}O5p z(4+cE))wMNoEMf8oU@=pr38f*_zqpNy5Fud>Az>?|NYVMWb%O10WHOFT+z9lQw>eF z4CaV-oxICGk$2lomXU%unujoC9>W^%TF?+`A14}R#Qk#+0}9j+U2X4ex^Bpxp(;|$ zp7bN3Q`>3YYl3P>3AT}vo)|v5;7-2C7YcX=^fcW@&@nb4?VaCMATZu7bBGJ=D)(_v zkDs}nmDcw!zi1V#t6Tn<=;zZ2R;2QwK5c-kNVZ|uu6nCBs&34Rw@`|1nf$8%o*9A| zi!^@QbY^zuly>)Ur+V8?#+5THB6I85!4@nA{|@@)y{5VkjK_E|E7r2S{_3J??Iz9{ z=J~e}g)iZ&JJ^gJoFnrz&-aFwAzhw3l>S892BR7!A)2;i>5M!r(OKH5huQ5R0_V~sFr8^=I|rWS5u|caQjbdhNg}OrFGxmJ;QMRUVxs%X&LNO zq7otN_QUl)Ge*#3IxX_Vy&F~1%5j#itPq~$!xYLf|C+ed9+KRt!<%{SxebKF<+=`r z30XWs18?xoXTl6%3zbksAdEI&`b2dorEgpOXsY;v_qzg-t{pO2F>reku%#Zc>72$%<#HsgR#^R6zp`leU5pP#GEOfSY( z_&?tS;z1o|ZSy9S-*9p;V(eU6}#sB4tN;e2=Z-aGe7)Zx% zt6ko0%j+D)(4btFHAaQ18rYL^Yk|9TCf@yn{%n!?f`sOe0DOK25HrWSLbImj1fff2 zz>~S#Pep0Q&gC}JmfT(96?7<-I`Vv;@0Enqv(Cc(Y1g)78(sd;Svt0$xSwtm5C_&- zkm<*YzRg-@EBVku_g)>}vrnnm8Fra3*kAFKxOwf#3>t;hhkSi}run2;84h7q$@-NmOW$V5(7qQ_>M^Tw!KPXm?603mJR2%5cE5QU_P>Ig6fHGUfA{H zK14r#{_Mjuzm`R@N}TuI)*HcX8VIv$HG{Y?}BU~otf+In0xduaUMC{f2{-|rBe&la4}D79Q5b)G4tXw8`|ObxSk z8MN;4C!Y3qUccEwcNXN{UXSSxtyBc8fNPK1Du2D5 zF9Ux*UL`xEu2lYKEHka^5y@JW|DPrC|9ABN*Yz|KTNL_Dl~wVFeSk|kJ#{cJFc@VA z>?ok?5GP09KHnfi3)etq6@^~!5zZTzm6cswS^^HsQ&UsGA{8hT0da3DL>bh~3Y!w6 z^-WE&Gcc6a)g=KwiL(eP+5rmq%})x#e50eICv#QCVBh!}AK&D2=cKQ%4=g+agnCRZ~*~&_@feFA)&|51@lYyBtrJTLGhT z>}{*xlNV^Hx%mzti3kb23DAV^hoFaVB_t)mEa#P%KLc}2zcINW$-H+|Q~;?43kSEe zy^Vr|B(I&b=;^cxnYe~&bM zU7w$won2DWY(%muf_Mea-D8F!p?P1v41(H)4#B$%G)Q;nzn=I8J0A!N-=$)Sec%78 z5>8}!_YP*}rgOV=bUH{`p1j*i2fHdX( z{r&Mm!|43{uZoITk}txf!NQW^!iKhOz<1!`<^%vIhXx1fXlXlQ<&qhJSP;M`KhuJt zX={5=H}?ySwqCPa0B&wkD5P5#yxg+YoQ<2PXdoDGz=;BBNbVKzGikG135rEh;^K$P ztqT(q81vze%Fu5*pzz4nkKTNj0+#Xric>>E486zB`8-au)6)LA$O!ckAk@O>>FQ!( zVFCEOCIimDwt=2%Ia@V0f`fz0;&GM~75%hOZwtf;pdr+X>6O*h2uMg^6t<*%Cu!fm z53!w{oIE%@+=L@TgO~(|b77yhFD~jLB1Qr(Udhj&fL7nz-Cf(zaADq_B&;?!GxJeR z?E;LE4QCqYjh3r_f6g*aIv;qwf%39R~t>bCVHLos!iCjW*vWBYa`PrFgRaXcFTE)M)VGmI*1C~yn zU{Z2&a*iQvhLLXz7pQii0DGkFo*pK>UzgYX|EXH3GF4^78VAvrDbsxUN|uEp`8Tcv<)=BQ33@ zpup775LjQ2qUwPHB7DT@wzb+ zk*cI|7#nOk_hf&yznQ!ra+)=o#&MV%^3no4y#4M7Ot8QKw(Gy{e*bS~Uzu514UUW` z%F6DK=SdCuD5dkvNw`n0JyLdleHIY7AeJhA*L`SdI$xsfuk{=9mmwi}pm8~tLEl>G z)sf6?W5?(eT-$JqRAOHn(d^?FEFZtYArtwh8rqGcuR7Pm*Sub5m}bb|u+5#KGVwba zOZ!}=b9-(pi>OF-ytKLhT+#ed2#fd38cHoPg^f&MUQim1G2+yaPfyD3eQ@5xdglM! zLwT1HU!Jk9R2~Pm3mzUGXXlHV8N7uM;g)y*85Mw;1uI*4WTeV{;WE7#vP*!GW*Cz!{X~m_=O?ibls4{9>?7zlhrPsVbs#v{(=jM*- z-I(mLjmFcNp^_lUJ}(=6y&i?^B#k-NY5dh(@vUuHV~c<+ zjhol9h}UudRhr@s+*!89R@C03uKbx`wou zP#&6#jsyCk{-9H$+a-55KGC%O8#8@FNk{1Fc1=x zgXH#jsbz2!DIR9;@OPUfQp*UMjiGfLW0YY_kC79Sm?@!UOGv}Jo1(fV>c+$?9vSgp zninqT6oj%hr%~y-%53LGc|hQcqzsI)ggUC%9a3CFqL`($7m+0;v3gXD2erScWb~!t z7cDww@>eCE{Z7X7H$Lx18H6&J5vFDnNN_x%qYy~gx8yf%$xumQusM~(AR=ltA0<{& zQhH{8bH*7Eg?8oz>=OYK66~SbbVZ{!#qZyQbs3>vG1nNs4Vd{boA-fBPdob^8!a@x ziOZy3Er~?09~PM(HS4=8@9okN);DuDjO1Sn}@l%Jt}Mb?BIxKSKkKBD5< zTvNWbRzq+{-s(stG))X2eMqSOoBo4kp`ihAt1T>OgdhPPX<*m$XnidQ zwuA}bjWaRvv%GvetQ;C82o|OLxY(2mTFrK=-!NFPCLRkYKw2 zQhTM%7XY!rPVuPRt@`;Q0P%Rf4zZj}QcCJB2hyzr%PQJU@W#VPQ!@qZr@G0k$*35QGoUi|M>&z{tgch#}3vIK^6w&t*FSza>~my6B6Fc zqJeWqw+=jbjnF*anuCPPph=j8VaR3B`o^`W%W*~=2NE~Ox& zV~SA>9OG+l1{==i?Cjrjb8qSHH~M0M-(ZE^+hZ9B~hiz#@`hBsjuK*wzQ~;cxp94%VEG(>` zprDqP7C06^{FJPmdrELF180o( z$8*G#6>vJ}>g)uT5h@#R15$>NC@xV?U(Sk1ZVmynabr?h$~h2&qATqMfr*wBOi;y2*9cp+FLZ zFh5fE`#2Y8EhjqZ*VyN$?RsvWMKIan`(U|jcvu-s{%qS16DCDNtX!6qE}C4Jp9d@* zLeaMN`N(dd)}u7Pg^5|dp50ep;uLc5 z#R!w?qg@b?-KLhdl-5PNT3a7LV$&B1YbMRYC{Y3yWTa&+2xq{~LGbqN?;UX75XR7r zBp?eAZrt`&_#ltP+T?yh972Anz|pNEW^ggL6zTbqk6h6Q@6)B_>3~8*&XY#sl0t^| zv0)Ab`psFc<}ieakVsnXQR?6d`3h%;p&K5DnaGwyILl>F8(yLf?vH8dl^0O*}8d@>Ebfcl_Xm&bActM(qM$^iyn$Eb_rYzlxSFvNd4;6-qQa zFDolMKfh#d&GISE(5F!d)4Tx|lC*)Ip6|?h=_y-hZ7q8TT8N=j9Q169$+t%LM(!O

    t0GQbtmxgo zMn;KFut-7wWKd&PvohT5A?NaqEOFqrw70O=`P&Y(Wbuz5sTmp3qi@J5D3aMl!4k#d z$g=nbCeSqEO9Ys>41Ey1jn=KR`>sIZsclXBUsh7& zqdU6X4x_u1q+tDv5<+b&%=mEL=<0+OUHsWY4v*oN`_NNhMr&S1&_-P|&k@^~PHC~u zKP55OhCXg~WbrW8;Hq4}GVy#_xFli!awzEcO1MN8#ev-oqGas{b+Y{4&H96giim=q z!bT;mw7P=2z6f#FJBqL+e03ESm09J!9XeY2H5vU}^a(hfELc9hQv~@vN@sI}M0s|h zXs1et=J*d{JFGOescmlcMNIn0k$!;t7Ki56b(PTC_Y_qaA5valIDby8%UL6Mg6(wT z=OQb6zR{guS>krw<|i{PV4Tu~@tyS~ovWd~37-(pRfzV^(ad%f8dIlW-J6VzD~Ozg z`km01h*RgP%LwU`qa5UKlHR--wNCKiQA4u+kIej==XY#w8gGax`?`Cns09?m5gi&_ z-I|kEx`%vf-%(8MA4=Rvsk=}`&g-S2A3OHEn0e@`I;{t-ddFg1c&;cLI)>6!liWWn z`k-NErF`|d35{%SUU(`}pkQZAWc`rpDD?YIR+?cL*bbaEr)mGaR}~tZ{V3=$$}(!E z^!526piijx-v55T0IQcnjY{PK^{k#v6AOFO0`r!ejsB%7E2G3;S0F$rjPonO+R;8q zR$5XLmdybgn%3uNpP`gurOV1H0orCAAcyGOssLmg7UK>UKhg zF=HYXb93A0*-i2Wy5i$D(nrBIOW$#N_J)ihQ#R@c0=hxD$VfR^xi67ce4!BxjCIYs zIYmj${-36u9|{`^mM#T%T-eGSqlPkUd~vocHh>W+E01mG@Jx|WCNAUclFVS(p{(4{ zAVMb9N{dIwNUu zR-bz+kICTEA-L98IX7jfXll)}iu*>~Xz(mbWxgv+v%~WvG`Z9|{b6tKO(HiEYy15H z9<0q}Fl?f5L)NHtu*GTuJOPR*8eJFRSe#)K-yDYiO!MW~S>%>%$Hyi;)uLm71(}g& zABxrk;YJ^ zHm!L>uuX|iFb(N8hq_&?k(J*AdMlc_#iF$u(izHODLD}9Gq%c_A!b4G58hjrp8WX4;k|@jw`$;3Tz;ulA+Y{ik~kpufD2(y?ZaJg=axT zEZ{bE8_Xhj6TXekAMqP<))xkN9zgQHZyk0G>h%gxi3w;%8zd?DIZ3%;4yW3Zd34uaGlrsV-m)zbw49zh0-|T}02S(Y7IJbn5t{h#R zDz8o>==KW}d-2y>kMzxqhQ72o^;})o6spi{WxR7-zQ9|< z3Y$DtB3@OZh?Ym#zJpBXx6t zzk8?%35|yXrWGtTpH6!-Ooqvf!$#ugiydD(GuI6k2d~WK^QyY0%nwS23NHM5zadK} zrtEDTl92jt{~SNB()-ZfQ0!J^Cgx7HB1IxB0U8@`MEJ*v>z1QV$#CDFuDLa&%ah|> z^bB>bK7qZ)KY#4zw0FUr#8F>uv<#6`{dmv!yJvuxyCB*=*w^&z_0A!`{Z6e>;)U=& zgUmTwLv{1IcYA(V)RrtwG|CybKMPH3DXzCX|4agr<5}QAok`9!gN@TtqQ%L@Ht`y& z+=FKcD-Wk?(tUQmb#2jOPFBfXQgaBA55-}B>yAgqmX&BvE&2@AZF81ebH;QOp3y>$ z^aEnKppw;q+GR}X@Xvq|N7%%HPcGZ2^5`0Z9iI3BuN`HYsr7|bQv?HZ}9GkW*Ztud>u8WbP}=b{S0mhvcL34P$fvw zM3HbLVRiWrJlnHjN?>@R&PE=`5OHm7ZTT_j!}>Lmf7`r|xvH*gM$e2TFf#rbo0q6( zVMY?)VLF*M@yVAl{j3pFV-apEotJmU;NuMc^cnla&{nCEjrvI~y3-tHM$&k4hHeF{ znHySRrEGv^ve)Rs3QB7D$wLQIEJDpu@n^Dm^ZLo*V&nHa?NX2vT*k!}N_zNgVpeqUAQ9k$EA`_8@WdVL~WJjg`TrRW3%3rkA^%*?OQ%MIEYp-wT{#3|B46%K8!e^!*0L9N<9j70@BaWf2h7??}x ztkA%;8};QV#9Y?ZyQ4-iUB)HPlGnE5q%3p)ot=X4%+7Fex+4jJutatgYJG$IHCo{u zo6aW&jH>p!svKg2r2F2POnB~a`Ts-JJ4WZ#yz#J2u`4>Uk%5{^|Q%4#NGP5_OkOZ+Rv@US8~Ifcr4XqipeT$&u;$ex8>J) z48GOac?s^+#S&!JMV>^oNN$_yc~$x-`>|$c6M^wkJw*8J1SmoYIs{F3o%LDoATjFmnitc?g3$naVJQ z$}r)BH+B1>Tp4Geo{BxAbOcn$KkeTgDA8%&kTY!?}q7B~A| zS=Vi9P{O8&vU76mO_yvJh%X_P_vLoM?G+Cn2tn*E3GO-dzQ1g4dAQT6ntFE~UvF@N zq5*R^m;bqdy*%w_GSa!nqS>%#)ea2Z+cpmZs=sPuo zsUqV-8;>Uj)c^;s)qI0u1LqaHvheRMU^6`N4|F%LdYKH54>ds_6MTB4jak*v8!wIy zkfFD5Lu()Q)Gv3*VDxmzwUlxbDBv00`|mSHuY!8?E@OujifT{0j#ZdhfXO!yx^_9X z`EQe0jZ^I`XZevqo(6}8!Xyt4ixC_gvXeekA3(w2MsHbHp(Ew6IXT$3pW^Z*NJvOZ zIJ&Fm&D_r9w9?!j!bVE0EN#oB8jto34^ZM}{O`o~r^R1jb8H`9g7P@n>uYQ4P1jns zw=6+ab>*NiS^SfdL1}3FYA2VLIE9tfb#~#5!Z0M)y6X016?T6LLR%RaJ{!ZcO^k)k z-f~82448IAMj;IqBl>e=FO@%;1<@OkkJb5@|ElQM50>ZX1fs2)2TP}h1NBptFzeOc zF7mKA8|qwoL`UuSz6p*(pZwMy*O%6eNk0=6@8}JS+8WaEvC-x1g!XaCJZ$&sxjl*b zsrUKmnpt(@Jx``J5<_QIDN|QfTnDDQmUzqkx*vp>AMNeLjaZfcvzdE}_Mb@ASb6E= z_>ngobADoNg7ZgF&|gg`he5;5x-6}nuiUgsV>NdByITRPeA9ZAm#XT*>YN;LO>*y4 zSYztf1zXCwIX0nSZU^5C#`-Q86CJ0G%%p!TNaAcCu%j1`tmY-@VHebA$;bFPUH)B) z8rJ2V|6zs5n6;SPzc+}I?B|$z)TG;?_|c^7zVAD?8_2v&4hx>tFR}_he$A(#p@8ux z^0(L4H}!7{$4&)2_#5+6np28Xio=S-va`2=#a$PJ64h|9>Qvit8n-;Sk*9PA^HptJ zyFG43a!b}_Kd2?6#_b9rJhFX&jE8n|t!sLcu}Sf!}vc^<)Ij{Vl*)P@s$^< zcr^Dr%mR|L-~rJV-lNDzHn-9W<4f>UZJK7Gg8Gj%Hu z7dKY3UYz{tW$;Yklo*CgK73HP{u_E_n9So(ST(Os(Jd0rLNCrHyR~Q?9hyNd_~|B& zbblNG8!8OBmC#q2!~sJwXaOo(N?4MA9-fg>qcc{{$^N_gF=G8HlrZxDaC;h~&vLaP~5ywUN}S0KU$De9=iKkrIPIbO&8{p)dStXb0?1aKVw z0`}kwDU8D)+E8;yPr|m|1`+A3)AnkGe0)?0O!DY4WYdqwz{;z2lFSr&f zW{Pj#(%bfnbu{gXXQ!k!DFf~#r&IN%_A44Z4Z9QxdNcDX?Ia6$A)%rc5C!5^U zJpsLE%uq&eWoZfYsev9V5Opb=!SlOA9J(G#41<7RZGC-xWd#o9_4W1g0oox`OK~z( zSy>Sf=H&fCl1xcVbh}+tsMJkrxh$JHwb!B(j~2)9Cd03YxN~J`a;8glv!;5{RD4_0 z!Dj-`Q=aEwH!>C#&)-Yf3fTSyufpGYt`C}GN z%rN}Jb7Qx>lEEx!f|mgy4k;bVZSRtOfg#6q(KroBztTV5i03PymPNtSy@g6kxXNX; zN0>H-hk|aFdwZ_p)zTSgsm^3*r%_rFnO7HZ5paFqE_q)p_t)iLP0h{UR!%d}NzAo~{RlGiq{xkcKYnlnfuR0$TD z9blv=uFfw{ug=a+&vS4M89P8qT|n|=JhaB8Y|Jid#-%zAtj&-1A4wS^miYv_>p2icp>8#?ca8JXfmOtodOe6iBf%igD3@B$z&~)-tpDoo%A!cgY1k>%|}o zSc#T)BZ_cwRu&0qG(ffKVjT>MkiT?xdxj0_F`c$hZvNK;2MH$(?xR_mLD$`o&pqQr zb9-dZfp&uS%|lj?Zc{F@ijk=XKYYwRgE@%O-JJf=n9RAV3v~V3nuCy=e$K#3w-EU) zbxc-Pil?}Y!QpT+jjSH`Y@=bKzdtyW7oe)(wH`-5x3+{MyGMSzgL{Q?!Jiij*3*iu zlnt7>L!7rl_9uxD3*kX37Ad{RA`Z}Sp^37Og!K@rPG%l-uIHF1rT-5z$wd)MutU@@ zh|h+M5Z3ZB+9{}mW#=wPV--x!!0BV7soTvuOrTNuzDcX^!X}J_ApzWUEUdLr#_8kE zI!nkI&tbn39B7@ZD5zlyZd_Bnfe~1BLD!Ah!wdKJfPk0}@V0QB2fktkAC% zlT8Bkjm8rh%bdM4A0ORSFff3b%LnyYYgc{<#xlBHG#PGtg&Yh=hZGjKlT$$#=e7TA+*hO-|C1EfR70!_4Zs{pwO03i^QR1mK3td>B$d5@l6aa7G_m_od8)n9`BE(PTK!> zsSz6#6mc2+)V)qyt@V4^O>3iy29?>JHd~Nk zYojD#i?wvgOyJDeRNu5Im9H3*s!FTx#kRCHacpQ6NvA|h?D5+?{Z)j0o?hmrnjha5 zgYYkgF}!z9R5Uaqeou4{>c4TqLY0Zs~5Z!7cmXkPrYi;z4E#0R%Vzr-(Fm(6CDJ zPn_N z=G=cv11%=S`15SC28c4#pzGrPG(~;Kkyy#|Onh1hvIYjzK&;bG+pcMkzwwFb++Je( zfg#cOva+&}sksKxT1P-WU5Zs8m=M=GEI5O$U!y%)plA=R&_1xSR##VtpfEvUU|<03 zGp-aiTm}aAI}_}!+1bBf|YYSrK7P zv%82HPbzaCv|C?N0&UBDY&x`rZ$@DYeS!_?h4{;lNCVY^E9f7NWzW78uG}kf#-|Sz zFBtQwrlNKm2XDvD@9mwY>RP%Q8n^R>{@MO1&A9HU5|8uL&>iey8(2Y2fUSeShSfr; zR?efEISLcT;)E0LNU1`1gVOEF;at5?Mt-+KRBP;U@x>K7XG z=nvs#WR_u6W?xE2QZopa{#&b?*R_QcTTBFz7bL;9Wb5&sWreHG;0<-mur$plI1DPs z4}Gn)Ia$nz+dEX?cQk7vkgEh*mC06#cMlFa5X7MKc&mJGK{hu(qY8*%?5K~)U859N zU?e0eWC(I*=TX8$g%2vm)E0-(uxg)V9IIY3H>2`f6Zf{Dz{kVt@o^4br^?xE_p!bM ztc6Dab~E}yCes}`Nxa6D-<0`i3V#{mjz)c+(XHDFC9RbnStc4h@jget!R4CKB@v6l zh$gHvoUB9o@qS=eZ?{(U_9FQ1va-~oL3VO`w|loGij%c@*2CZ82GGK8oHnolB#u~@ z8=sN0B;K98dhg;sZ_&-O3;k*Vc7ai7La`MBrc8{C{@|mY@%c$}Eb>)o80_MOj7*!7 zYz}5#>O!(5e#*nGXom5fLljU7lB0W`ppu^yW&)7YIc5M0mu6OP2A8Fi70VlKEV_Be2v5uTl4!= zg7@91g2G5;b!tHap&Lk1ohYY4r{~HNa-N}HaA-=^=->)!=e0RZ=D8 z`+h7&xfgqs9{d>~zD$#UksM>Jt7W@zXs*fst7f}47)Qsu@iw5=jCjRB@P^iX-hxRM zcu&Lze#WS6ZfogZ8v4@^kZ1!Cq?XpoBiH>|Gy>QsM;4)@{dlsmzipb8wC9p7! zO<-RaN-&k~Ob`p@DL@!MoYN}1TUTY|+4S*EKl7%)d7a?3T$-zP{kb6eqA3X5XZxdXYa+*-j@Reu zJeH?8m+%R3SlLu>V-1?)RSIqw>)~O)Way8Qa`U*(7IQo(o6+?WkV{yFUl|Mcnw-YQ z#$sT&GH>#vQMb2W?$7J$>Vtm_Vord_KBtU(z?J86I9`^G;=qj@9Md=8<&6vZ?sE_A z+%hII)81uZWJP*ms@5_O1NF;zIb2u-&qp&dLCOhJ00&~VNpE_YuCA@&bf0^OfBQK) zMa;?P{=IgE{CkaA*obvxOX2HPrht-z_o9H&tr|yzz;aK&#KPol;HYojPE;1bPVc!n zQytO!{S*oNAf~;C`Z9!y)($~HKuZT(BYy;y@ucTD;mdQy$Gum4r=hpIyP{fE!PEOM z(2E$1be>!HrI_o*&(^hu4XNYc{qd@TcwCal%-q0U9H*P&VJV6AnVFsKQ+U5^L&Hh7 z(y|gGmSiP3R&H*Z$NRx%fM*1}y$7=xwj-VKMSI($nY&&VVi=*aiqe|C*kd;dxjGGY znycK}cdaH;vOq4+=4K$=Js=RB7D!H#kdlJM^}lv>1e~P+rxP#N3&=B_A1$uut4%&F zB_(w2hb{os59|u^#xUYLC)2}q{D?riK!qw`8R+NdhxYR{VFM4kgnj?-WBo)2&uN@a zhdm z^zJ?X?@NTbrzTqkK87PJ{`qqQYbq%v5lYAhEjc|s4bWqM|7<=#C?IBHVx)8(@6IlD zz7LR42mcw+@yNw=g7m*tV45CbZ)ix$!ZJNNO3%m`HRNrOx%k5x+!Ti-X$crkvx$s3 zMkyT~0=Cm)S~>_ajh^VF!$WCV*>hW4m}o+j-#_{Av9Ylmx3~PXN&y&gry1$-_y0y% zgNh8FfZ*=xN&-N*5Z=(b4&nvpexg3HPpxNg}7!dfc1C_+gBioTj4dEux8OCYD)i(!J$KncTV% zpoW+_qU)l$sK^pNnyF60#t}KHYof`;QzGz#9P@XVZ(lwz=c`or*Ku|7FL?_G5a8{l zZ|<%X6cl+}Zx4m1xm{)SSsaGA<@p!1|bCdabKA+!6xY) z{wS0xgQdrsww$%#!}k3W{P__3*sX<=0{NW(n6OldUDz-f!5(WCumIk39m@!`Np9ZU z+^lQ{pGW_yx5L+hu~F@`^pN0S;>?u>TY#!R9!6GLV>bR@CyD_IFulTHVF?KdAJrOk zIR>HiVD!EI%>4dQW5zTb*^UQA ziv&GAyfB<;!OuFn*OzGz4(^&c2+BMbD~-t!}m03z~_WyX?TsG0`Fr9@5D=jJe5= z(BFw#xt}^&RCnFwUW~O{a(_3yi+8wgc-Uq5QmsLO(}mt8xvZI_KSnQ;Xtq+H>Jm#E zd0A`3+TK~7w{xNsjD&&y^DiDF*2zMnH)jV|wUyebu6XtvCix6$^noURKEj%n-UqT~ z_TulYdH?Y{Wj}$_W8KGFrWdxQ3yJx`Kq??-uV0jH+YcnvXXCMv2iFJ4_4 zWoMV==Mg4g$?qME=hW5B4NWQBZVK6JP*D|}pPT3`bo|)I2Gr?%`ndA%V|m+l+TrbO zOE|NLX6zvn_5hz z(@jFgSHy;N{0oSO3U~=vm`?dA7OGCCAILqCv9!F1O(~5ncF*X|2O?*D zj^>j2y9}Kyg7SQ9TWb@;2WX2%tFPw+5+bWwjb~&a#AgS=Z+9J<_iE zzNii*gswZU|0?~{jTpH(&c~w~oBK)lwEkC?#*&h)SVF2x!KlN)ph}UiP!KDSFrL{) z3tTAXVR({%5t_+UCY>%+y6WuWkmTgNggQ;tA9nFzwv;xCzAFZNaCs$hxpx()x!RWulJOT>h@QR})qT zyHsVn=4+P87NwlEPkm#;NZ+jh2^k<~;P{UKQx4NC!elnaa^77J9UvF0BMtssb_q}p zK>9Y?-jeR!=1=tee7Oppn$ifbX{M6u4ZCH*ROj?}nO)4jO(h4DS-#UC5tChdY2hWR z3MQ_{OlP=`Rop351{IA??G0f~b3wYEpY&F4vP&OQg8rGWFLG&Ws_abNLQ_D6eJI;t zj9peqvL;un>aZs(Si#cir1ESmyCNqfMbZh)30r1=61&XJf1Y319-dlN8mGiiiHxj- zqTDUdVJWii>{wRi;Fx+$i5@Z}JyG>3&+hGsMNu$zUd|Y~(0b58grCgVY0(++G#6u5 z3cC0Bf3MdG{dSvi*meMNoGBykaP&Pq=_$n|3F#rkNu#&S9JEOtv`H@{G`rTd*@+pf zjUqXQu2`T>6)rlW+<#CEdDK(fXF0mvmnBWeC4i&4gm>h?M|26(UKSn2`zLteGi-c& zdy_CHpur7d`A;Nk+VV=pl1lYgrH35lQXsP>lwZ_Z)?TILPelhRW>Bb5*S-T~{~!i3 zPPm}TFa7_HY>>%-;^cMjZaHsd$zguXalC%o(R45E3vP(=Il%%rN1->AIsAdmNu~vn zcd8htVn*kprTuuy06COG==1Z%puqNIvsxWLE52ZZZ>{gkXeuo%j$vM-o6u4etQ;w< zG=-F5BDGw&Oyvs}bY~s+7uHDip5 z%LzE3#(Mr2VNaN(ltD6=FE_wrp1b*I8vi2FdgZv76DaU&rS+qR@$ph|Y5>!u_=wD; z^`iFL%LY{ zW!I%czP@|-+~-M;keDnDYyQW>lovxb<6bZlFW3_kMm1!}KT&m)waz5g+65=FG+(*Q z8KtRmP|jiW0W9d!20FzOe`?_qZZKf;2VxfzV-?<`A zuTIGj#CwZ-bBpsjAzbjB6K{sXMgO-@Vo=&KflaSftX2VtAPQ?PV$z59{rn`G@pxP4 zk?bse*d%3Q;4G{(tZI@`(hEx zKryAEpT-1(86s*lLv0P49toK!)av}dd97v}SQMGV@%!umjhB(UOnZocBU)>sk5jXs zbBVHkEaL_8$Q#w#;w3qxZ2zh(0mkMaZrMz<6QX5`C5yknXL}EaBsDy;0#bKy^Ru<{ zc@#uB={oVX`b1p1K2H=-eoF}`Na!*q5; zpVq^9zm4CauR<)juI9z`uW45niH~84D`TM?nt11A4_hDJBy<+Ix?YrO;qI0>7d50|2>Xxeqm~oTgJy@!VnV>lJfgJ z&kj$c(uRI}c?kaUN6EY$x@G&FslqvY6JFs-N^<6idS-e=f z%|wtZyY`|3R1IHdc`!ZD%-h^7MtQYhz@_9f_vF#k)b#XJ=Mz9M#^3f!1tTwh?kq>1 zq_Uvd3RYj&*498{rS|uf7*9&r4N2+0)^aqE&R^DLRgFN1J&gHVnJ!0~01r27bhlTV zObrJJyeWUbRGv&0mIpUjvR#7vKmSnqP zvW+&vdp5sQ$L*-IZKDVE?N=WvqoxOC!dXK?R0sSx_bo)X9f^zmNzaPa)MMcSJb8VA@D)+?5$V)xg}s3 zk?#5TF?$4%GuD(4&l|_xMkeUOp5_!J-k(B}(Fb6E8)_E^J#GJI1`{cT56k*)USMHv zU!jEZM$9P8NO^oGcr!~ErB z=4e`)C=BDH`KYQ^-G6ZG+by<8;4U+@%!q#Ron5>S(yvx{ZGln=dc&=4d!80IBkG{Zc&-p4lAUxb{wkJEk{IwGesGxjfdB~F+M7FDNycSAJcGs zGr713y)dgEn4Fvp*eB=Zi5@Ig*=RKYMT(4zI+Vx)5e*Fu(Bf%v*agp%%S1&-6Y+XF zKa}eLf$INBns?IB(FjGxrTqnu1601*K=QDJn;MqPr?g2JNY*Lr)_3IoQKlv@|F0y6 zjEn*z`9=h#f{Kns*!=kGet{g;?g4A^XnsB=SNi4!pm(#du#j?e1nCh43d%}M@;QRP zDvD`(sv>_DuU-Tw-p^N@;-sV#sHar}{o`(9$Ch(}S^e9WHs-pyjCtOkZalL11VqyZ(=d;om zz47aU!0bLRkn6Ch(8^LWd}s*Aiw#wx_s=X`wjhYfX-C4 z5VBLzmXB}p5<2zWR70lSn%y>$-qpS!nZ7-?XfJ8H7(o>+^AN4%qt&vtCbLS{|E_I} z5F{`4&%C6hL^PrZG8--uHE-`LBDh~QSZ&=D2fS?YJr1mFI{sk#N`QhswxUIU{#;jS zogT$#HkeBG@SQ0C)k49L&d(=Hu>R6#mRal`AC0)@F7aNgw%*y__i~%{u)db>$Q>|p zD&x#^{owYH;@Q}@5M>lOm7t7O#E^NmT5_@ruZ;jRf%hNSf}_tx!N(IwFAby$x7V;f zXL~{PLGDWN?_cq4^LoREM5be_IY{w8CIQL0|Ydea+2$dFH%= zye{(EEx?I`B)6deiV~>rBw2tyYj6-+h7mxP?NC3b$AMo%a%!qxhwoeW(+%zLFeWBu zJfJ(FWxpGW+ku3%*VVbYylnK=kW*8OS|Bj}oFauNq#XD?w_9S4JK!e}&Zxp-kCsKg z?)Q@mdK#4SNhNl371*9ClQ2eQIq%^DN@yIyjn(@hj1btLqSr&eZ$N0#cNj7E<6X(Z zU;yYfK$U^Bq_ANqi@0@80zdJ8h7&cz7FXV)& zCEy_wTy-l1RULqdhdN*Xk%Vgf14!FIRzp`$Cn7+SDO9#JHKj~*ac{izQD`I%=+xkb zwn`QoB(0t2oMn%0T`h1J9oi}np3WDdRgz~=f=bnF;T0Pw%sEqe;?}SzDzZ4zcyf7r zjWsI>)})1%(rl&zhgpqdjg3nW$7t<;;YLzQ zfQ6*WhNujvLU_ZaCS?S6w9@drYeUI3de8KIMf)Wo(TIgHw-$-Oy{N&CZ~W(+{BHC1 zA&XKkSpWH0G(7PDP|c?L5Ir}a+#+R}`L-HeIX%+FPMLKft%hIjK#y7hYy@I9v`Y}X*4x9axJdl;o$&V z)mHM3!;cY`?pXDKxD>tCn?01An}>y2K_eKho~EHhbb;CM6UuE0e--NvwVS^$0aI6L zBgckBC7$yLi1qQ5X>0FOuHloGV5wS16{K&;gMuKR+gd#w-Dhetn}z82y8|?Xy7X3y zUSVRg)yJ5ZVy2Szo1LMg`mer&iuRPxxU^CuS|Rh51zph5c-ZEJCE}u@b@lZ?;dE^^ zUtU?+y4WTEpo2q)h0sPo(iYIs(E$|AG046@mi@YXIWGL@BS*2%(s7S6ym3fxWn|%F zC3lpk!6Vt;pTne*b6Jn*5mS47DGVL-ryi%E0wa-MVOHUM|NDtVh>nH^m~TWzMD%77 zJv=-B@@l+O1T*uHAvdj_bHmfumBEmx=vb~PE2n*V38xJ!JsT@8pYi=7p zbUWx8O1gM^=H*-0=GdmJLn27&Cb#9}b&-xM+ocSn6nzxE@#qu1bxuPf9=63=?Ol)a zT>q-w_7#u#n-(J4UzWf7qI)f64@=5S4U;s7^bkn6PXB!p`@o#viIm2RX7hN!>iIY9 zYwHu!{gol$KP!^+0TV<`auHK_L$iPDFTAor3kFDAC~yH0_B|}xnTPodR177c(aYl? zGSHe?>Lhz;&;q44e;zdh0_!-GiRx`Z$WkU8lTpm2(L%iY9QUT_dQJB(vR+82_d7tJ zQHEl0DWuKK`xQX_8lEoRP#5GdB6QBkh;_FujQ10Z1cT%}pSKqkY`gw)29Iy9hq86s$-HF#*%(}AYsCULP-lsK!tAPgG zCb0uUI};ZZZQknXB@V*}sX%E&8J3XjLJ4$YqNOcv%gJe|Kw5rY z;{$wkQc_a^j~^1ziGYQ^9ha-y%Qf)9qLFQ z+u!lmRUk_FK2Rx4yoiG9s*7jG<*y=9PPMAV2T`|D*60b1@kXl67Bnl8Ms_?J7W5{5 z)ZIDDpv~hURDBWPR8^gvD!YgKGAdz)&lw zc&u#BX9-j=eA+!_$2QXDdMFrL14uD>Oje`r=9sMu? zi@j?3q`^)9`SaK#ERkLK?;m(wgg@A8Fmj_NSo(JkUt~P#w9aSD``g>Vz(Bx&tkXLb zhFj$R3;96`Xw|kt1z)jk^Uk4*W(|uq`?7(sQ6s=XDzyH-=#JcF8Zyx*{IDTB*tn2u3 zAHyv|z;J#PbN}Hfmi+}3&Q^b5&$+Mnit)?F#>Zui4sWk)=G43D5Pwc|=U$~4VI%(f z)4G?sUMf;Yoa#+c;Nt1;)spKCU;2}b`G^kH)!1Ff*TbxvDtRM&^PP0gU+r(#aY&Wu zsIoY9=_*zAe~3CpMz%)My-r!&nM_B6Whi^*+}NX25{bWeG&l29(jkT@sjAk;plrL~ zD}%7cGXXoYkoo@_8XlHd&HTZ>Ws&v(Hm@w*3+M)9y+{SmnXPxSIrw{A*>JRHwY%1`+G1|i{1OfruN(u`Sm_JURZ?MU zazZ-wppACG>kIH!W-V+4dz{eH+MfqhYq~qg5atcbtqS>@G zd>?*(=#X&F$FDYBz;wODGq$zWRndUK(Cf|-M}~&!0?T?1@CF*HQS^p^#Ffl``l$Gb z@0NtzU9^- z+|*J4bu9lVlrL{+WaxUn_!R-nIIw~s9B+%>Z=x$%-{V|c)zs9%;R;CI2CPm1^R><% z#Z11c>RNbM_|l59$msBynYli@xbb0wa!ht%+?II}*BghIL)=nUDLJ9A4{o@Un{y$g za2R~dbY+aQT|*-alf0@OUJa#aFVQCw%9eKbiw?m@(YaCjT<5gaB$qx3tzQp?z?CD) zzkIH45)-kEg8B53v!jtSLJ?=xm#7Ts{dkwtdZ`kGTi#V|!g##;2ll1{`Pf%4=J3BkT1$%Ni;26e|--vA5jrQit7v5pX zpF+wxa0e4R3}2G?46L;k6~SEQ+X|@>TwGr3z7P6=tk7lt_H1=;WDr_w)FedJqRg(3 zV?6uLheaTdf4yYj;_U9}xnlmW_KK`{7T_dBMC-x+-5iZ!Pd3Eu?CB_xz^fhfz|TCR)u(N_bcS}FS?F#= z##p_$H~xpn`?||b&~~HF=ViRjE1q5_?)l#(TV5kAQEiy5H8gkm9%w*JVQ8I>jqkQO z{`dV;?{ACN$Rdbj~t(}yn)S7LuQL`wVxe%Szz}h*PQrr2?V5pOj4v(*Kq0~3 z-feY5cf?lWGq_m&I{n`F`A8RUV^%C;KI7eCz0-WB4C0_;>2`=JGi|&O ze}{#2Lg$ayhYmZa!YevcTlv{MQ$*26<4L6C8|eMH62v?ol9qyFT=CFH)UG-u;00>h zu>$N8aYzj7jEyf(szFa!=UY9iHD*ou`E)T=%nRNAsVT#GGtzW)SQqTifS02VP=NT#PDzs@>ahEBihIKfqP`x%fqjx zvcTqsa6OjDJ-0BeuB4+9-IgPPo!RM+^Y<#Fzd2=j`5XrF9z9m-(6)Rpue8|egmlyH zzIv&)YW;p)fhCTU7B^^eWoAVXl5)sE24(rUl5qYPzt0+f4mpo6QZ4K1;7_G~4l{@x zLed1l*AEy2)9c7f&W^46>veZ+2Dm$1h^{?8YU=Oyj<9%<-^!nttnW8F{{wIY0W~fb z##yUdb`wX(>-#b-dxvl0_Vdg-+K+EvB%lwzX%qUfOWpKqC9N;dzuu%n4 zRxo=Z=BRNs_FV#dwrcC^yRTFfl~+6Lh~`1+%Fd$xBGCXEwC(>0-%cZ>{fK^5n6FmZzam8N2<*{Mg-Z~7CHB@rW z^=y{`>+&pG{T~Y)az6#%b^|a;@9vt~A|fu!{KgC#6qd(pGh&Mq{*)#Jc9iRso0lr| z(rw$YbiclO+t{1|js$ZH6-S7pkRd%=lylLBV&*Zn_yFs|+o$~~G~)6spvxdedJ;a}bn2mq@6z)$00AZhzv4Uq8ROf5at4=e|AffcZd<7RV?6 zNAG2FsKYqXIF_FKw1|2l2?b{;3S}fEffXO63PYZJj(y>Cj75zFe^Cb6BkF7G|MMXE zMfSUm`94z0CQv2ARLe#_`tq$HhbSqe+{0>N8G$>qn;)hD88%7WSnWwAS{Z8Ji_qZw zVDVfL#61KHcepO>|MRrVTnFu4=k~!Oz9+57GjL0XiP`9dVo~SJ_f3uXwdd)QQvlmP z&3Vu{Y0FnHq1L4+*DUb#+Pp`H!&5V7{sdz`O~@>PLCChi&n{fGcy|j2Lz&S&Z7-Cq z4_#M6$-$2W{Zx>fz}ACO8) z+eL)8hk~k_K<@9qK1u(0L^=mzq@e?QwAT+8?Xa09pi@I=!u0(n!FM(OE!4bwNE=*$ zubmnU*iB#vf4kb4!2FK@QLfFM7a$`oK2~y-78lX3iRlbkN;ctgKYCR^87~>*fbNSw zw+9%2JUk)L)82A>qUZGSl=*ar2<}USfb$g6O_a)#@{VJ z$^N4df)5y1^T*SU2@FlXa~VtQkTg3?L=5M0i!a*?E6^0=j|W>paMIWY>T69lTRfnS zt-N?(X4eJu?A=biq_w1BSYenHn`~a(t)Gb8lDwa)094&7VNK1(>gtIxIdw|PMTBY2 z*gEVj@F0`;#k-4w8`0ZL!*snLfD)hT=H0W3tc@g&T>`{^K%aiShC2V6|J=H;^-`4m(TBbOWS`>8C~zWu9NNSO$LFK&V1$ z>apk~R4JBjjk2Z!gX;g0J{-_7oHeGzrpoKrJXavrOa8Dy4=dGzWrfPn+t1vsuy4Mn zY$Cwi5xY9LNv~rRfeg)#fFQcJmjw7OVdgdFHrAGcD=TVhM?hgez+=4@fVS700_Jk;sI8d0Z!xzy3F9ZVy$0$Z{{yWtt+OY2CGWoj&gO{rrqU}M60Weho$`+5#P|QNv#$(_Blz}B2<`+69^4_gLxAA! z?(Xig!2$#i?hq_E1oz4tUr;kn&_H#G!8gQlD%&8^5QHb>9xMz8;QjO9tT zg>%Xw-oy9hkIZ5)A(&HSc`7C3I@G0$g{hyV^J?+!w}P=`Wn__w@++dpWT~Z5?tv08 zp!j|6Ce=>zFK(rj(x2X6u5CWY5)qGCbXI7!^B}U0AoB1M?Gu16us#6FebM#xwFxRN zE^O+&p$Q2PL{m*It#Ud>@w)c}V7-4Z9>NdAyYR3~8ye5!09@#s#1c@sN4K-)<>kG* zfAID3Ws$<1y`Q0mgM<5|0wgh5K&q5JqyL4;wxp5u+~S7?fCAe21Dic zL#TcX@e`Ld=Me4QrByYuc_hf^|x_|TRpBah>Za)>4d{mKLN>>GbUT>TEco!{UA)5fudXu&j{ z9XvbO>NewF3H5hSO#FCW>U(R_OgkbiOCh_YI}99HBDqXdB1ysy*xSJUgkseLMYdU4B#d#BGre^AkQ z9yzM?iE<};?n@5-tL5bInfoyp?N-%wrxAKY4ocbKarWOz1zy@m9{SX=hm0-CP3wn# z4YQkNU%f$XwM$jLTIz8b=>KNaU=XEj+{ahOsFdYk$BVEuSdkL9RU+q4l!mgDmoE4o`_m)YyH=r9Kw zBWXcHB)2S7wk1Waq&ZZ~&4w#gO6JzUUQthH69M00#8cp6Tx6H2fP&(5ql1X#m9E6) zYjfX(l8oZQ++3dkdON15rm_-l$KLaF0x*ZT>#=BZwF0%aRo}Y!ZnecapPaCVum6yV z-oqh7crI5OIKU2-7g11qOe8clEvcsV$(dfhxlfsGA_A%{1M1fuZnmiuWf|vt7&R zq)Ll=T~u7vf1i?+5pX`W|9YV$zzo$mZ>^p}Jh>Ir0Nt%hh0oR3)bq1o$O)u2FT#v> z_Yx8+*Nv5Z)MOSc4}RiW?*>6WQtDfMBj`=vNk6ANmq?U|GCJ1ZY z(YWMzV4=ow)JnO|_u`K9;W1W}YAwI*M~}J0A4A=}JryEgg9>yoFV=qnc^jQ*@^!)F ze4wjYzIJ+TlbP8H1&SC0JY@Df!ntbd1m52Jelwo_jApK@?O#Cbmomp&uEPhXnyF)P zOT32x&qud6fAw^9viK>lU!17g$>!Nx)&@SUlZZSU6E20(`i}z#n6#jpfA#HBI>yzN zC4ED3&6E`6iwkd7;eX+ds1LChp;zNj9XROY`jC|Zs7@d5bNl?9AfjbNyTpm|cGjce zSM7auv!tB4Cf(xhWHo)U)9anzX;`WV0>Nk-n>KjUQ}0yZ_57qt2G0L>$Otp!KJR$< zyn&W^9!7RXcT-am3@7gGO)TMu4-n<(EBk1z(SyEwIb?!s%r;%rW_yuGOjYqoS=q1n z+sON$RwqGA`9!m`IVOHvw~v#SF&9=QS5&RGqxLf$%N!kTd~3tzLIjlf*aQ|R2yqdI z4<)f9BJI`q+>bg^5<@C7I&6=3Trm$XBcK2AqGH^+7n4%)@L?qS8&2Lmp=aB3msZ#Q zEVeLqrMx}E;TA)3aRGY9S65d#xEFWlX3om(BK$x_GXl*tG_{o_64?CaOv#qt3aFQ> zwatT~`qR707vZ^khELf=o>{w|wxcF}jzt2h%Q8jmYN$rK)kkjL21)*nX~3U%^;?^G z^c7PJPP`Eoe6S>d*irXrxQ;^%Hct{nZV_L{dcNr8K-1q1zGE0}e<<8~Fkwbnyz*pe zIXu;|F@(?blwB6iS48sEb1S@@KFI~0_oo^;rm`W@4+MXR_I=&)YunK;_={)@)-}b9U;UdY4TUgTH$n1$vB`~8}Sj4lu=G{c%4X+-hTF4PW^?sW= zz=z>2#RqLrpean` zSvAeW4oBDHOmBNCA6F)xI5hf<%QWNzd6K8|@pho$|LtONd68 zKn?E;6*nvaT{{07z0vkEyr~9|3xEp+PM1m@33Y}*lH-Tt?(@$tsdYMLy?yO}3TRTH z^XM)JzuU7NAh?|B8ju*uqh@zkv-s(tN)gB9-w-Rx+%@iQ+KoY?ZG)mF`@QpC46^5g z*XMn*mxtlh@3A~6Tdj7@Gz+?iQfYON5}_aax$)k&RJLX($Mzb@oSgHZ<=>ZQ>1sjA zcZ+~&-+K`Qah_MJ>?ktxt7vE7Fyp9gn1|J4L8d=IGQY5)Y!>r7-K_GSJ~D2GA(PZ6 z!}>s50Itv1xCbq(8^g5WiV&?IE^Wj44w3S54eRlI%o~WSV;* zlXRjf_3>_SJRGX9DP#!qK1!Wm=fV6+X4!n1LVTJ9+dPyt%RT(0t)A)qSrn10)vwH} zQv-%+h&^Epso#U!8lu4Iq4W@`tAE7$-rw>__J?~A6|t?=X@KUAI3vVilN1e8U(Cf! z5!9)$Sn$>BXVS)uNDU-Y?fg!LE6t+oh$ut=vR<+BW;x({_%r+Y+4MG(ND*{*Z4J_; z)|#W%4MOhvFod`d2OJkIm?Z&-$3(4JWE|N}i>MwZk&A-i%b%C$c;*eTU5a^O5k_QG z6u@3Y0<2U8_;ZZPCqk8P`%H6(pq(29AKm(xi<#%H2FY+ydoF9_cB|^krEZ>e4tzyC zYK{iLn=c20*{a*N;YD5@w-dDATTRy0PrukCojWGHu2xmhGy6$D9C-ykUWV1AP?04Y z{6tvGb+y3-!?%5TX*Q6M)74df7~OonNsVe^pyk!Kz2(^F2oHR+E~(FItO%WB&3#$5 ztlJGrCmSUlxvHD_Q8SWLh?<08Yd?=sP8u|7BWqGqURz)B<4%d}>7?t$C(8B<=^E6 z9cHT>=2v*m9DqMs@!nt9X!ta}KNjXmj3xjB*pnGeK|-dFS7{3qCwn$e!(qlX1WE%r zzZOcjDMzI>%&^C5jY3vh~{Z)ZL?MTmxwG7QRg4NlOlYdsgSYMfLD{4wX{C_{paI z`#O}dOc(^_IL_5cxy#Qq_RtC^>d-f2z$lW54Cc;IY2HL(N!H&XZ3kS63o16v+ zJzXQoq*D09_9dZ+Kn3kd4Wc#b0w!UiadU17*DV5@BE9Yr1> zP4aIPpeg=1!4N>JUOJ*LBUZVY*imKdQ5pgL++GhY0?+I)cW!u&UF%GKX^jdxs6|O{ zFZ()UbP{m29?(c1ASO9P2r_kIXmi+aL73VYm;HV*{q)r3xjZ-@6xpLXaPf?Gg@)=B zgk(Au@k~A_vgAY2{F5ZpKH`)5v?ibJo=MSD*Z|ttv(7QHRq5@<<0!3>|K&Q*rau4+ zL5Q|DU8!lFOfPfcYZlj>oMRPYY;k|k4n0Su%o^$Pd`SBh_+f+6 z%48sYN2|4(ZjKHSpd*yOM>)U%Pa5J5A#Q4GbI#luyWB9NAo0aj1YTTauTX!MtA?BPI()F?CvjkjNVsY`?w{HO>Bmeq;7h!}@cn8kn5qL6!9_hk}+d-it7f3OM~*NlgO&TX|e{d&O)S_|ZNKCM1_vPSZ#CxGKHP zzb&fRR$D)sPwk8D_EC!@r0U7}2)N7`<2$+ir} z%*SED@||d}#W^q3t45xt`bJb!H!1#1Mm_kmLBHeas>9YsVG1ZbwoiS*la8gY<#YkU zTPuv0od~7pn!HPrmafv$(psrI4H5Kkwi(swxph?oO{0{{V;xONhBKzF;@nrnq&YQ% zr0lmx`noEbnwyIo8_S#Ps`Kp9xa~%4(*_3d>9N#u0lJ#AlvjU~`iX6r%Z~_iTu7&B zkqpov4&t0E(pnlahMw@OHkv+AOFtRa%u!3<##mAqn4r*&5h6bMXO{>~^I|`qNM8yqATzeUR0YrU( z-!9PTAW#G9YW_vHv`_AG4)9Mta{^7HJDaO(=^g1+20a`1osxG4| zI=d!&vCB03A|%YPW%}PwN5&YG2e8`ZV^D>EM{9;?9%>)5OQpQkgK1l7@`8%3v{_BE zioE*2ZU{+drsl>qVRgemH@o7j=*EVIBA)xByc^H(Q((r0heVa6N}7K~^qck%42VVi z?GA}Y>I>Rrsj3nZYG2Lzz~s9*`w9OY8j=JYoCT^6SNT?S#=g*&AvZBz2Q@7PH}LNI zH~f5iKT9?{$}8fwMUc58jzS>{p0rCODr>gspV*ZN+)Y=*ixUbG?~?US=GT2ovVRT^ z-y2F`lmNj{@(s4~aT!1GuI-oOZ4x>&z80$qVJmHN1_ zo4H=tA8{}cQe9=jcu;pc=X%0l%zm6^2DEByGCB?8dl>!z^cQf>@XvgKZA-}I$n)K6 zZ=0C3hFs}lsT8`zZ@$aT?OZ=QoHc2Ed3*B6$nRpXPX`~L!Z1I5YG*^JtMc`Zj*AIO z)X~!m0gK8DT1C9!w=%&Z!v~D=Qj(J9=0b(2Ll&$Kv7@*0@+iYGLMRRE>+Br*A3@5x ziP`m?_Zv(x6wQ2mXia@Oxgsn$qWel#Qw8etM)wbR3QN1Ry z^~noYjp`7Hg`lGBc!fO~X1lu50iB|pe5k!D1AioE`->%Zn=QMyiH?p1No5!Y>(J|o z+q7BLi;~@n)Kn_d9srGL?f!{v=Fr&QB(=ZLTRf4&8BUq|e8ak0v3+p7u`MSh@*;ok zs$=74WtCoX$~rPAl>44H)IGH~TzK|kFe_Sy6m|OXG4A2T8>2j9b$}rw7et$1c^@{{ zu>Dfp3Oo7^bT7*KGcZl>#LGH7TJ|$rY7*2>ep_6FjOlGS8zNv+wl+i_YzEM2$px2_XQ@1xQKjiycgna@$O+;&MH;ngE|8NMGkG1 z^&WLCEo{W46TttE0?x;$y#c`n9Nw6s3CKB($$DQQ0{+l2q~PclKB|4@bPRQCz~thN zNAHg&fHDma_rVZc;+lj}I^q9oz{%yt z20diHCi6Yl_}PEDUYK47y-v_1NKhtFpuV1ix}Jyme@A~>@b3M)U%5%zIXjl$SZt*3 z2P$!~77dh;==bnA=V*fRTx%JqVXxCT;H|^y#3{(jPfHi9H=&8#%glmZ$P?r(Dhj&* z8&&q6>o6d2>*>d5>dmdKtS!tguJC;8n)^fS$S^uN3h2A^<`7&?Xs+x!dr7HH(ls{m z+5_Gb;&M>BmoM4;3$xS9LV~h@-8sY9DC1bQwT+V_LDo;U7IiTxJ*!2!uu&RpUw*yMJ6vzinF0&fhtn;<&k zN<<#e2&NQlDzB`ZpPdiG^k-Q*oISSR@O@iQFl*2yLFF&0IuGTNPtt6%8-qO7;t z@%gEDF9zqc?BT&YPvK43QTVPY1XOtZLIAnNt>#ifi`(FMbPu;NCa5k@-04ueaP>P$ z97GtYI&!>k`yp|bdc z)i4QbTWb~oG9I7wJHm;dI3NF2aTfJw(dP{j1>%8o-eCX<5T8uafu$eF$`XO0W!B`h z`E3`NK>JKg&P2U#Ut0jM{=~$D_bg^wTH4>!Q&IwgZly&)6EGsLqA;|}{jFT6di+y- zv$woFYBIxGT&|>p5010rBEHe_awl2UTQGz2{EeffqvkGdOl7V=!fe~E(|V;lTN^Ub z_t*5xReY;19Lc)+{=Nj6lB;V5sJCjxlFg#V9CX(Q-B_g%M&Du~eJm^T$5duX@Wc;a*t*aWF_mTiH?)-mcZ@UJ@S20I7wT(G!b_n+ z=h?S)4-t_e6I1`E3&^NUO+t1j0U(|7)#b^vP{_w3|%uyK%UO-;zrgIL-PDHRZ*CXK+ zZ`7@XzG~lMtD^9GD;@CJ?-`pp%4irK7TjI64|GegeV(UyW*0`M#9i-CsyJJ16arTiwR@UU+iI`k$c zO=4nyq`*vJ{)9wCB*!NJpzM^RZerdCt{;{{{4Ek1T38*45n10#ehr;WC{+_n(@3c- zyj7!74c{@)s}t!U1<=@u3RWQSc0Kr0 zvKsAJ#FhAlJ*Ip23IhL&%-gHP2N@PKvj23%$bPz6bE@~i*Z6Kn;I&qcqdl8bCnv!0 zCS;OJ|DxTU`-Hna!$2aRV>yP+$}{jB^cb@PKZL^{HJWyaBK&gh_oFdA40eeA;QL7I ziK-&KyrkOq4!li74DBy-Xur#!a6KbQ`MnA%Dwz6L_oD{_tMO=3`^hCffbL2rA=R{; zDmGE1Rwk5!R5b7d-_XR{-~XA9__7Unx7xb_)@VP2gU=wBOfqsZ-CVqBkMPw}Kr&1% zuc%lo?BhDoBL?gWRWRVWuu-n|+6WYyZW=I*qMqE*VKSqKhllgTB{t;(YPPr%6;;_{ zIpYF@ue;CJdFB}7LZut6~;QnRR zOxCuw+jXVh@m+5>`*5jcE{RK^df(s9YSz+^kgN!em%bZ+jBF*ZjLl2+SNm7`*Y_JI zFe2PEr`Z(cQ?XRh!wR(h|Ljz~KfMjQjT^R96x5k-Wpu~Y;EiM56;hXHC$gSWUo_BJ((%f{*)J4H`&!{-hFr3!YnpUDHTg1gdB?q!e3NzaNyFI zKLb!tgaAI~**}0hk(#xN9ER@GC+B;pXtfBCRdR3nqECQ<6Y#fh-%6Bn|B=M3tnl&i zy#V>&=;(N(O(i9J^*jjBbDa9M7+;;xwc_RxLH;4nN`dnSk;AHee_5YmLk`fh7I8-h zlAsUv3)+5F$vulA{!KnSd8YX3!b2a90=-wwZ>`A0|4bN&JW-k5^E!R_u3Xf$efqA= z-n6DRc0lhp3*C!Ls?QpSR?B4PqxY=kIFSvB4~CM=>FeniUMM`Bx-yfcpT$(d^QPl^ zJ&EgsYe^5>W_uu^S3CcPDws?pH^M#nxhq#GRNcc(M#v|2WwrC=5?`Pu8FO*2MP(Sw zo|Xvq1-o#*-8EcRSYIN~kiN&iy*|ex%&|2K zigwN}rJjGdy%+G}+aze8RRqV}M|+D0H4 zuF>4mf_C|^XwM0x544NE)iRoLBlAP_^93A}HMz?xaAx5A#R zSgBCA)o>^Bc=ml>DIInAqPmoHReM$EU^RaZG8K}79Y?`|6yAE?oMozCmVoepi7)8sJqt(sT^`nEG9l$0n+Op`LN0Of#8?*1MZtIW*-XuqI zp=`Bb^(D!^IJ{T}ot)rGApZ-_O003#89tR7rP;DA(mWmLre})psyTu8p3tZLx>ULR zjSYzavA{36IDgLm3}h0-i%!RA@wyd$^sbd@b_$ZmT7Fq>pRQ_lxU?NnJeCy zy8=KX*eH>u6^cKtd>;HV8ghWB7FV?j44FYJevfdF5TyY#8j@&Dt*wXc7IBmpRX05q zUIuq2@=Ol~pr^qr|Fj(SgFgki5iKgj10H+cZY~7EFh{5Vx4C92W(wF(PJA6|7@I!? zt2+zf@ZlhViCJj<1c|By&yJ|l;KJX$GO$KUAd{gE#sN5@%>pzje15b;X%FWU3Qc;; z1zYYv4v0hK04zb!N@5ZbDEr!x@~IkX!Xq&HrvUwT%6FB- zvv_L1?*8EZQO}D-KSrTqx4J6H#s8&IE;FxeASNcrtX^>Y?UZ>?JueJ-e2Vf~YS*^5 z{^PIgM5N(SHr$AJY%cExUW3_iFi}$69`RSir;?J&_gHZXH-BL`G(fJZV9OEzqI_N8 z?o`IC|K4hCFe-zx7tnI_`y=zQ!;$Bag{Msr{6l|i6d*aaWf)Jan^>e)wCAvAtYxJ) z3FISp=b>M3&LO9xQ@e0oq3WI|o-sHtx50ik9r4Ix+O?8cd;A`}9?CT+_)peiltdgu zgmBVCYh;20Y3pzpx_`EwzbSk(9@9M0oG)a+OLaN1A^SJCws*F1b|JSX>nM)(&7RPe zBDZ60IXRR<1_q|N#YKF4>`V)ray)a7tH0BL+vpQXwH7*1OG4L{qiw*>z)~)c{iJ!5 zMo>|dyn<|#pZsY8=jHe5jIwqTjVpGc0~L=LQ36@3U|yBeN1o3sc(N#A9lsaDjfG6) z$eF!SD?~)xeg3?>?R^6UlyX=H8{xhxiN8ai(Nxm7oqkL)%Y`u(6{^qqUW#n}6RERY zLs$b{>r;3cx=y|BpNFlWo_HPe2tjCUSVz-T1>4>dotgXTJZfSuEDEPJ=htt0Esbss zySm*pc~+qjT-~O%Il=*DRmGmhuYvw&W%$&!AqX1k>VRf1cMnp?KRH2}B!%SkhBT52 zes7>9hHFDApf6w?1azALjXYBgQy}QMK~n+M;|e77@Y&7H+>2cqclWE1r6v5Lr4P}x zN;!a`r$eYD`9IOaB2|73-!e#&ck-PWkDL}lws^SaN9~UvPVR3mr?McEX@I*atf>uv z!@)fI3@FVFrzEn^vzO>8hLEsWxz~r~0cS?D^oN)SK!QA^cp<#Tm9< z;d&0YlGni&=UTh-OR$Wxm_|hDmEq17&EA;VAIq6v>d4tG!L5WPcdZ%0RW{li(JQGk zv;*2NSM#}zt9|NmN}JvU3{j0jH+7DmcPb=yoV8I2uPp+X<9i|M@)}vz!uh%-gdD_m zt*mliQG9Q_85Zbt8+C&7S?+nU0r|;VP5{=*3O8ZASx_euXhW#a@y8Fhidt1__UzYS z9h_e!_oh&w^zk6aG^1y@AjWxz>!$9)+0bu%lZI&WS?RM4aBt_S1p}EfnSCw`2*q*T4dc)&V*i!gGcdB~h>B0s2 zgfHBV&HsHYMWRKGoAavy$G)a%*_~j5$6va~G2ilkw3XlrE8o~;6Lxnhcey>FTze$Y zxUvHfsY|CK)xk%{!;ZGuD@|M|wtWovn=E1YSO{6aF9UR)iISGuV{7mh#GgII-cxy# zn6-(h!?al`F_rqvbU)yqm`Y4F_F;E+!D z@X~aGBO|Ek!kS3sQ|))Bf-T6m02&I4i>Mq0JQ3?>0C)JA2@MEja-j;)u7a!i zuE?jTzsbBW%!A!Mp9;iZX+4U3T+=We?-rfneD^K~7HvS@iYiZxI-||O+nUG8QY+rW zB-e3XWF6a=bX;5$VyBlFU9Tpo!9f$n&ziUF?@g-?o-V?ju6`1RHz()#fl_usFNSYI zI9>H_SvPHs#vxr56AlySNv}~6Lm+>8n?(On|5bb=S>C(BVl$jMFU&vflCr&HxG(2* zfzqD7Cz#p8AEH$gp8)WDVwX!7$^r|8*dsLenBRpd->UvL=dyG1#u@>Z8jx*RvWCvi zc}DCGW9{E2HV>GPy zqmp8R&Da60u03A17{w23d-QPe5=`3MNz>_}9m-zu(CN~H?@0>OvFI3R=;*NuK&fAq z-km>6lz@non3$9>J1ZlrkbT)+nwv`^SpUxE?(?2Gc#I8jmh9tAkRLq$DoRMy?Fuhh z)6l(FmtHT^GcigLOIGkF17+kdfGoA93oJ`w8w1U*bAfCPyZQRIUXGj%08 zO6POED8NRa zxsXgEqHzSC(Q!mN)GF9F$yrl|LOGGEcZ@{FRck{jCw*^oA z5H-|Vg8XI&f)wxr<+;OqjMab((7Trvjby}?0YEk^44`8*UonGdH_%c9OZ9IQqLt84 zY?h?}yTX6I^2iP$Cd30{!FT#Gb_K$|dip zTJ0iDLgilnrD9{66BgFA{Pv`-YTa)N=W3fOD!%u?m^mudTBFb}SnlI=7xH>j_CW9GcZza~>}#kTLx#P4RgEkbRgd z@shlcy8~#Jgh9E?n}`Kl?MA;2!FFtvS#FC-_&p*4aMLx!oQY>$Pcr!$2GU#@Il+wW zr5P4MC0}I={_M=Ro~m zDr`c3_iW48Nf-rg%x7X*<;*k<{QC6vTjY^?&g; zNa(v=x<_8e_HaB4L&eVcEqqTe&AyXO9h~iRkyOFO9`{7$`2CnPgsoae$ykU^M5D^` z%vaF<=%4SPV?2FX3DCbze(HcZxXr`thV-__3i!OP_aZsOwf8tQjf)1Y`KGujlK z5(wKV)C}8L=6+r}pu^#{yI@{m%FQgo4~TPD9H-VtF$Q@5T=mK%oE*9LN7XvI_S2WS zyO#zblQEG8_us+q4Hv{RYqAbirBOmByM)tHnxZVjCYR!ItMY4VhP1Q7w4gr3`G4@8 zqf-dbHd~ju{yb$i4h4FXcGhEEG%EhNL}Xmft?S*S=`f}I;#+sk?%>q8SBZDO$fK=- zzwN^*dQI-X*b@dA zU*j2i2vUYtTRqTvxRblmLD&ffhAg)`YYASPr5oc)YhR8pK%N>Okc8lH=F>!DGI?R&l+M zZnRhb9naeBNNFlwhv7q1d}Gg*LuR^>nc#N&hn*YqBHcw*^v7Z&PCE=arGNkT_RU?t zqBDhgCKP>X)+xf;!)UDySdmXcph_aM){S(X6XEIuZx3YPPCoVbwkGyo3U&RX#EmWs ze)dbd6y7%%_)|5I63m>WrJz)h&N;bzNy6^MXbI2a z-(#Es_D89hZ!eibHHpIRH1^Gw>n_J)@6jsV?E(K=52F{-_R`YVb(R+uBn|o|5^~C4 ztQOI|B`9%zOXGgT5pHX~V2Efb@&ZdtYDJA}L73H91&!GBdu;GmLg9MwS5n~cI-H-Q zDtpHQ80&{8-Sn)l@pQMv&i7dyzgbr7o3`2MF3s%2Ui6kMB41#6>gNydM`Z#(4nYxW zE*eVEqp3v4lRw_aZT@1wd8ukVVbXJfb^JDer)RMuyJbljMA|tPqw76A$_!U64McFm zpO*J)OqKIDmUfCQ?^!x7)fvmnVfN-tqjL1%jLA8Ue(!_p7*W8uz0~a$VcaG`XJL&N zL1*`iRw+49ZU6pI{En$Z=K8*{9h577mq{)&A*+%MH*4<u!ok-KMac`!WBN29+pg-&6G5+9soabFAY_hx}@0rB6Bc@e3-B zeT6s5xgepYyH8%Nh0r&lCOpOLi-%(&rXnCBuBlEgd9 z{?IVwa72X(L7-gH1n0$W#Gx3uU;4QRX=|F)V?&#mtW>sOGyou+|tI>4| z(QtOEw>0GWSSkAdw6XnvUeur{DQ)UXOYomnB~7GgP6OKLZ*U+IBfRsybQWXdwQbLP>6pAqfylh#{fb6;Z(vMMVS~$e@S=j*ftg6;Uhf59&ghTmgWD0l;*T zI709Y^p6lP1rIRMx#05C~cW=H_Aw*bJ-5DT&Z2n+x)QHX^p z00esgV8|mQcmRZ%02D^@S3L16t`O%c004NIvOKvYIYoh62rY33S640`D9%Y2D-rV&neh&#Q1i z007~1e$oCcFS8neI|hJl{-P!B1ZZ9hpmq0)X0i`JwE&>$+E?>%_LC6RbVIkUx0b+_+BaR3cnT7Zv!AJxW zizFb)h!jyGOOZ85F;a?DAXP{m@;!0_IfqH8(HlgRxt7s3}k3K`kFu>>-2Q$QMFfPW!La{h336o>X zu_CMttHv6zR;&ZNiS=X8v3CR#fknUxHUxJ0uoBa_M6WNWeqIg~6QE69c9o#eyhGvpiOA@W-aonk<7r1(?fC{oI5N*U!4 zfg=2N-7=cNnjjOr{yriy6mMFgG#l znCF=fnQv8CDz++o6_Lscl}eQ+l^ZHARH>?_s@|##Rr6KLRFA1%Q+=*RRWnoLsR`7U zt5vFIcfW3@?wFpwUVxrVZ>QdQz32KIeJ}k~{cZZE^+ya? z2D1z#2HOnI7(B%_ac?{wFUQ;QQA1tBKtrWrm0_3Rgps+?Jfqb{jYbcQX~taRB;#$y zZN{S}1|}gUOHJxc?wV3fxuz+mJ4`!F$IZ;mqRrNsHJd##*D~ju=bP7?-?v~|cv>vB zsJ6IeNwVZxrdjT`yl#bBIa#GxRa#xMMy;K#CDyyGyQdMSxlWT#tDe?p!?5wT$+oGt z8L;Kp2HUQ-ZMJ=3XJQv;x5ci*?vuTfeY$;({XGW_huIFR9a(?@3)XSs8O^N5RyOM=TTmp(3=8^+zpz2r)C z^>JO{deZfso3oq3?Wo(Y?l$ge?uXo;%ru`Vo>?<<(8I_>;8Eq#KMS9gFl*neeosSB zfoHYnBQIkwkyowPu(zdms`p{<7e4kra-ZWq<2*OsGTvEV%s0Td$hXT+!*8Bnh2KMe zBmZRodjHV?r+_5^X9J0WL4jKW`}lf%A-|44I@@LTvf1rHjG(ze6+w@Jt%Bvjts!X0 z?2xS?_ve_-kiKB_KiJlZ$9G`c^=E@oNG)mWWaNo-3TIW8)$Hg0Ub-~8?KhvJ>$ z3*&nim@mj(aCxE5!t{lw7O5^0EIO7zOo&c6l<+|iDySBWCGrz@C5{St!X3hAA}`T4 z(TLbXTq+(;@<=L8dXnssyft|w#WSTW<++3>sgS%(4NTpeI-VAqb|7ssJvzNHgOZVu zaYCvgO_R1~>SyL=cFU|~g|hy|Zi}}s9+d~lYqOB71z9Z$wnC=pR9Yz4DhIM>Wmjgu z&56o6maCpC&F##y%G;1PobR9i?GnNg;gYtchD%p19a!eQtZF&3JaKv33gZ<8D~47E ztUS1iwkmDaPpj=$m#%)jCVEY4fnLGNg2A-`YwHVD3gv};>)hAvT~AmqS>Lr``i7kw zJ{5_It`yrBmlc25DBO7E8;5VoznR>Ww5hAaxn$2~(q`%A-YuS64wkBy=9dm`4cXeX z4c}I@?e+FW+b@^RDBHV(wnMq2zdX3SWv9u`%{xC-q*U}&`cyXV(%rRT*Z6MH?i+i& z_B8C(+grT%{XWUQ+f@NoP1R=AW&26{v-dx)iK^-Nmiuj8txj!m?Z*Ss1N{dh4z}01 z)YTo*JycSU)+_5r4#yw9{+;i4Ee$peRgIj+;v;ZGdF1K$3E%e~4LaI(jC-u%2h$&R z9cLXcYC@Xwnns&bn)_Q~Te?roKGD|d-g^8;+aC{{G(1^(O7m37Y1-+6)01cN&y1aw zoqc{T`P^XJqPBbIW6s}d4{z_f5Om?vMgNQEJG?v2T=KYd^0M3I6IZxbny)%vZR&LD zJpPl@Psh8QyPB@KTx+@RdcC!KX7}kEo;S|j^u2lU7XQ}Oo;f|;z4Ll+_r>@1-xl3| zawq-H%e&ckC+@AhPrP6BKT#_XdT7&;F71j}Joy zkC~6lh7E@6o;W@^IpRNZ{ptLtL(gQ-CY~4mqW;US7Zxvm_|@yz&e53Bp_lTPlfP|z zrTyx_>lv@x#=^!PzR7qqF<$gm`|ZJZ+;<)Cqu&ot2z=0000WV@Og>004R=004l4008;_004mL004C`008P>0026e000+nl3&F} z00Bn|Nkl)y%vZNh6VxNQxpUx+dFD8fhdA zDN?jeQfxNK_SIe9q2Rqqcn>7JcL{GYfwV~Pz0X7@EcF=KAm#ZpLpU1f0#@b*m`||!fra7i)V82SUi`__=Dki zDx1xupLYF(W6#%kJJ}zP&j+?6!#!{P>u)<3DGM{hb)8d{{flb1rKje6Q+;dKDrI(K zZFjm%#Ml|?>uByk_YhJHSNzV_TzyNm+j=SO>O3aXO6SykIA zu((j=r-xP;=SpgEN@p$|G|TBvvOn3|aL35wLr~q|M&qH;R1l-d1a@s!Yhm}~p@PKY@u#yt ziRbqB0M#nmxRmh;Hd%cPaXr2}Wc>vfMVU>O7)eP>Z=a*D)a zkI&z~v~TzL-B$G`Lw@D-d7~@PH@h}II_5BIK?yp&zPzl$;j+$c(3A#)Nh=`m6 z;?$_i>zB(FkFP%`f4(dh^Ub>!u;p+#N4r+bEkAe1B9Tb1|0II#jbBBx*_=NrhQDvH zKL9WN{m;vP`!8Z|_Ip2m7wYF3=uhUxed=9O+~cM+8c#j>{)|q}W#Zm&I!E4T$ATu$ zp=^t$H2Y%qU~+V7(Q8x)l~%JaKD$ZTp@~*7i}q+r?~F1CTLP0em-H=f5w;m>vF2cT z9g~eYlOdDN8;|+Tpk#p|ATx#9=A?UM{U?2YeWO1zx#A8YQ^*y{`;@2QdEvzM)Z?`q zRa;c{$Z&UkRgKH(_WOh2b?IC0pC23<<;%r=tyO_g7}eH8XKWJpmv`p|&R=dEUR*_w zpgn=0$Lo8#`g3S96$D&9kHbdu$*}o2d`Ee@`tw};zMXi?^aqh|J}v_<9rJTp;=XMm z|IkguVOKVAiA>IK)_|j&eFBw80I%wCG+9miXegf9AaYoArqLTE?O~s;{@nRzJDqw~ z_49m;x8#ZEA6p@CsR(tos>=~d6)vWgT`SgDZi7t&yQMXwJh5zGbsr;fs=V=4t|JVt zo~hi$^0wN6dCh?mTx5S$viDXS`|Wm)GL&f;;s~Ab$Jw9f>-%>2w(r~E6PzK4M7nHB z&hADgliJ7c5h!e+Dq9puz>*$p%r1)PSjqlgES+YMi8eLI;qqx^?3nKmB+%M|yh9&& zp9sQ4GJ!)RzPLMI`;KH-y~3yz|bLsr_xaMguNHW#~?UZG6UhoKcWsq;yx>z#TrTTpm%W`T!XpW|K_jRUd@;>`><6_r2_#RF2 z;tcU?@1bA%@a@lOU2D&tep1OB`srLat2X^?VBwoTDE&tJxj!{{)%xD#0`u~@$ye((Ue@RPvrk2CbHKE+STvf+WWtd+G7lyiIeN2@%_QQn zLO7F77XGGE>3A#}4o6z5Djs)#k|)NS%~khbfB0XfroYG#{pAqtYr8bevp3!nPvvK+ zhwl&gWN^F_iN)?;{QkiGBzx@riQb^N)8!uOM+vxuOQmfJS7@vgC7|Oa8lf*5Yi#bT z?wuW)C$-FAT^996JY7`dcgQD3dnWs8J%Ip7_PF~K zJz_Qjfk2oS!HI1lAhz zP{>jC;W<#&_U(-*?|Tu1FWsu%2D&zQ((ir=X5`Zkqs*$d=HwD^ZiaHdwu;6IlnXrEc+=4So{OzXz>ptAIKL-q;g((o)*i1 zwKC6Lf1ansKYM%l7jn-Rp3?pV0)Yow|8r}9%zDN7D_tnn7l zU!Wq<7zl8r#=?pka5+0(2n4RIPygbdTlG^||C2}_otq>wqax$=1!KuuV|{P77rlrF3xP@+dh~q4 z{JwH%2A4}m!Q~d+h1wAaDjV9sHf(scJMv7)Ze9SJPL*pIS|A1Zid+^x%Q&H1WHMoq%tQbx5_S#D$Yy0ivOKK&u?(deRK3b(@Z+qow zT>tZM+1yUY&N}94*Uv|;?TLQW`XBIIdG7>|wLc!OmyTN^a%AHZ6F#@4rM_IKx7UoU z&Q6S)91gIy2dw{D7-~jOF4nbmy8@AQJj-pntt2EC^e>6g5>XFZ?h`O|75-pLlGfMXN@zh*4%w^Ci*mbkNFfSvjmGZ$KzePzVP#4#TTWiZrb26_xw8t<_ zuPNAK!Q<=C?Tddv^JlMJ z_^_^Lsihm;-QP!CotznLyHMIq9ls+`J1B|+@U4zaVTld)RLtYINI){l;URbjN8@UD ziL8SI0hLIkk!b`P+jc0U5sAAr2}PjYBT~2`u8c+AUfUAuoEE#m8wx}H!2W=rfn+vU zUtgOJS)L#L@T6Ke-k#$AD9x|E`s>e~9euTE`jy`me+9&B%?%fobu?GjuP`mkb6p=6 zw_R(;433XzS!?CREqtXem$hCwS0ofjC$TadX0Etnw5}aZ7I76~F;?URQyK6=KDwjf zgZGQ8`j&rrs1CMnn(OAH~6cW2#=d*#A-^{*^81m!5h3Y|#F3o$}Y;dE;|6b1%vD{~38K zRjJf!^*!>-9mm%bWL?KP?Z{s6KA!O8`!hiPX8q<%SLa`C>ix<)|N2MyCssLF&jcp# zgro6XItjjF*<{;MWWG!$zY;o|$!3v5$PA)PBofKLd&qzVLLf^z8Gq9JF~0ihzx=7v z_@Dpc>wnlrd)m;4W;+3kFP$umRn7do+F@xpXZ4`Cl~(| zR@xNS-JD#ygRHEH#|tZSki|cFB##&N&uoBFL3$KmA{U+&z!p zG5upeR}T}vrKlL-Uh3uJaLP?1VvnP2R9rE@TO=QJjR*wngKOhbnKisFax*EqQM#>u zQgTQ2uvl#1U`(ko@i^2_A_uISNAoJ<^Vm!_*C3>EWQQV=-0t`6F(o`M=VPfS{(L!V z`=pWmgmJ5SqVYSc=j2VTwyD5Nz+#Fc^?u z+XUjXji)eWa+y@rMc`}n!7OHrkjtj25_2{a-rd>Er2L?E#Q@f@{I%5X)Kn^?qzHpGLe2Lh@G0;=cvQBTZV zdgcx0Omlq~=CA*)wt9%$fhs%ulOM43et4!JdmtV}J-|!Jo)hH8r%iw$?WfjL*$nu52JK4uQ8LHH|G**UnoU zhF@PrHI|*xc*6C=+Y<{jAC@-sH(UU-(JH$Zr`HMB`mi$clGYW2?16at)KjoH;mL3B zCcsrK^6KZFX>OOq^W{F^$*9L}M@~JBw05nkol9Q6THd_1w>z~bzS1%$7jqOwr`_SS z+wEX|97tJS*SXG zm24^^GPsAQRu*Qb-3NkHHoZ*d-A{cUmy<@ql6E)Ysec;T1Mz6o^Pu-*w~H9Kpcaci zB3U4C?*wYKMz243=r$-6isw^3HoF5zP4{X|W7qBqx@>5Eba2q*ww}IHzq8O(i=Jz# zIHwa6YkC%THr9GqS+kw>2X04wLo1fN+cLfb^6~`&E{_KSb7)j`UHkUd<_E96ex;#* zVW?w%7k~Ba1)EX$!P{?>Rwu@GXq&5B>r5r81h`L^*R=FwS7+u3B9K?1R4SAz5GcKJ zxqp#BBW-q1uQpee?d|jwwa+ZERG7)ZZ5nfH8_yO=8fx0~5^USx)bi92L23fIfEAe|*9$8y==xnI1wPF%R$I6u?g$Q19Ly4s8BM=7k<;*yq? zg@H3IGs_EObz>VK7X~wVx_)%3tFfKP{LSTd31xYPqAqWp86E7^&}XmI^i7QobWCkj z6<4sGF|pOuUx!*>9;;{@ue76Kmceky7YaYz!=pcVhlkTZCT2)Y-q_)(m1DDOt@Y(& zeeK|z5UQgeGu9`dY?4@1gPf^Vb1?HuX01@ImuxOA^!Bt68BF{-rUli!GTz6;t^zA@ z$X5!d3#tdO2Y!8l*B*$6RL@;LEx-A@-#Og{zrHCEkJP)s#V-vEk+l8@Vhz1=XicG$ zmy|V;Ntni|z2>qynh+RUiUicywx(9KFRr5_cH@auQuW~G*g#XuBo?L&pd;HpXcfv*V?9MJIfa-%;NH1hKw_?LNbYV&>Qsnu1Tn#yQ&A`DN)azKW0ax z!2HzFWvKzx3alZ3m5X9*$8mzbvEkzC`q{2}V44au)X6gj6R8ZamjG5M`AwWmIyKRY z&Lq5r#OYKLGu#J`0?+o#BKz^{O5np@K-ohkhvbcECy~Y+9m*hoqv`w~y*~-na}#_% zpV#Mmh!Qmd$|HYOJiMvtTUGY1DADUG5CB{BhPrP>*}sPDg00gZ|8%M6Bm@%Vs|m2! zhODfl>=T(hu*eh`M{#L+1iBcQ(#ocj`SG3xByd^~Lv@+_5?L^<0BmFN1fW$R29%Mf zhA)+WmIq!SbD5*Xw7}$``@|0|&~Yr0END6wN9>q@0MFpX(#62eNufqEW-61jle> z;H?1!R1d^G)RS-^9(4cd2X6)90lR4V#UFlHI!o-m{0p&A3C|Q{55#?|CmNHOoyAIP z73Z*)q^;Z6)Nv1Lq?Br}x4Lt%G!Q-FlbXI!hu#6}gMq!eKqP6kx%?hCxJL-ZqhLXA zGKzRy0gkJ|Z3WkxMU1|rlP-tj^7$I8)9ZC1HezfJS|dCFU9CtM%XRZFcN4$W ziht>?*FSr%_Ui`w8vNyXEb58hd4U;LcK)|#{{$=i%D?;1zyB96|A*3*?_65=&Id!U z43>PJqxq~ibmX^3BoYJjF2D*92%|2ZW$1l#eNEsoq^@xk%fL%qiG}_qhkU2Ewqd-d z@pAJhrnf2JJGgYIv9hugH86IjcwkfMLap+1N#MjGa`uBVk6AsuMHbo9Yj|w_xrSa` zHH_+NE2(VXG(;}d5A?LO@9Zp}Z<|HcRkyDRo^$o2?(*X{N544A{$?-v#iH3)&JDc$ zFIT@-)BHDI_{P7lT7LP%>AzKKA$uN=dXjfmk1vEZxlrTlZE9nO+dmqN;BD^4fsuM5 zYe;76bOaUf+&vEUB;k$q)2yCY^v*A=3iC1g2c|;NgfW~9go1%k0QeFJ$6~%<2skM$ zt7!5C!+yl)TqGO?H^4Du>PQ#~%x_UGZs3_9>I3sRf&q}^c!CG;Sm1KIL7=s1&@9=H zM5DoQ)E@xFfQ->#1etjPN?6<=dy*NDGY|$b0T2L@h227$qv;~S=X|=z3-P<$8W_!% zf|#wg;{b5Ah-}SPWY=N^yLth|oR75FZ22_6xwH-J7LE!i+g$kphy-C%z7PQ53;rm3 zzD%>FP^`VDrxS#cG&WnIQd7Q=Le(JBgrv0Pn{m_zi_QL=t0x+bz~7K(Lp|Vg4zL&x z<&n$BQBVHblTjfKEW$6~$$#W<{=Y#0acNQTY7u=Qmv|u;&xe6T@-g`Y?MvT80{Jun z&HpSC{ima&k?V+p8aaBb zU8tUq_1u$!b`74vw+0YTg?eZ#9*Mz4gvPlcbk0q?k5{M+E}O&SaCi(hk4)##*gUYy z1mTm7yss8=Zw?%9xi=rZbH;rJs1ezvF?n1r(uQNj$yKGE_u8tuJ!^V$!8`rm$j`nzvkSQC0HCV0OaC7T23HJ%zA zQh9UlUM$NiD#OTF+##8BDhQ zK%Rb7x(S+947I~!l-k4T(TRD?>wNLD zIb~HJ_uY1mQ|oM4*O|0-OE`J8p9dz32pRg~5wLJPS3M>Ya}MiPw0Gc5HpS(#nH;`^ z$2J+IDv7{ysALJ{DhV%=NXoTlZy?AM%7e}W7EhoSapIXr#~X;J_csmV-gvBzE>G@& zC9(x^I$dB!8L(0V!fCL)J?;f-)sK%R5?}^M@_4r(DwC%WNTt%Z9D;J60#-+VG;al#EQwvUMVCi7t~HLS6V*7+ zRm~6fDSheE(pr)kepLMgo^Qa1JSLN6Hd_!DBa6+m;On*57XYrXlc_W?4gr?3M?wL> zrBvqViXILHkyTQ_nnXGo3iy#xkb$ld;j<^y4a8HS8(;t(xb00Q)9?g6b-FQ{Odg+4 zCX<7(8b9UBBzu-ve8SQO0pB*iKhlY^gwy4nlU;S^s8V@(ZP)%>I~phX&Ba#C+I(Zj z2vF%VcDuN;ov}ARNftNsE-vq^*OZiQ?kvA{u4x+Gb+x(^c`dZL+S@y}GFk@J@Bq3I ziN(O5vP_EHr%7}!9*<>|3YY@j%GRD`chaO30An`0*lnqRqjpDVN{h&d%(12u@!4EL z$V8STZftFdn8ZxX=TD?mVs<8%GRwtlI|S*0JDc=U@jFPG&Fy_0R-q6O5#5|WU9_^Y^})G{s>bH`&lcIVtkd0# zMU}0|fN641R8-mWZp+O2{8UL}Yfo*d#A+GAiZO#N2H9rA6!BVRLs5BMYeQG}E@ykH z-gI)}O9!XzQqLDz2{mH0mZ~k#i56QrdPE zsvEOKH@U2*+7>EWM$$3Q4*#&Ev9G*)V`pp2m(G!whUIQQR$yXm%~}*2OAK9UeRoS^ zbH-WpZvewzs7IdNHt`&NDV>6Cpu&Wqre0|%<>ew>V7LBiQ4$GSQGErM? z_e|I>uc)jCiOZ`R`#M`E#-~XPLN|ty%ecq-J2x=1mDMdv)APkO&FdTu{7r*+nsjrY zb9O%dOdp5`(~Ze&{z%_zfj}^Nvy->`5r@+WPx{BwjWMsAqT(v_CTE4fX`kNkIt@0f zew`xJTHUwk1~}FeF*e^S?jD|6oS9i1on2j+oeYLTqr+Y63lmp<_Znt;4A@44x_LCZ z(diF>gS*QYi`o~q%FmvfXQFMGZI^_gxIdU3g<1UPDElF2+8(QbDFLul}%e=Oao)M|s#cxW_%?XiGe zjqacj0AjIPfo_fu9n10VaS10QK>_fj!}~O-8;IvdH?e3Wm4>##KCW)E%}vc$LE!t)OA1)fLUcs*VVVw(G7hy`&i1GXQhkivuN z$ISk`>E?dkr+uX4t{c>UXbA*^AEyvti2pg%&7sNU_WBO=vO}wDiNJLQJR&-FYr0u) zvCXWLhtNYb?4rsQnjRZEkkNLh+kW->TLJ-7Y;eylu1t&#gS;NE50vBa`8~d%Tu62r zWhx$(usy#@;tdXu@2yU8sauE@9fkPHix)9GCaJzxJX&*A00w7dGVv)y3W(zuY+7*;LWBymR^Dg*D8$J^#+GP>9pxSznr-Zm(Whn?F}nzcJlE zyRx?4TLD%J&yRPu_KmL&)?Mnt)K%6_?d_d8e|2`a9m(Z#KZm+es?;Z6k=>^ljKHmf z?RXdA-_1wwvmC4Ks1Q^Bf^o}Ha1}WUoT%%hSZvnoDXq_;ZgLN3TjL(qHa>niAHNOo z9vTAb2I>al>Cz2(Ves~q(eS15Q=yx=_RGOUYXWdMoN^OB~Z*$WO{jg(dPr}&lTgElDjbdidbt8zY>BYtA#{N0#<{V#4 zn(b{R2=^~m4U*>3d))o2`?1)|6C5vN=OE*HcsJuxsl2mnV8^ zJX*@zXS)VFigv~N#^(ObjahI?+q(yswl_Nm=a&1$tQnQvLdJ8+mQy>=?fC z%9*#TN0#PB8fJG^CcEqg;gw70BnR4xrs3XE{tDmzS}}f8;&``>+0@UP6}ZoLup5WC z&zo)nR<%8pnO-F>?#XNl0gWjOrE@HeZ7=Eo#@qf)>cpPB=lQm~02%hdFONrrs!WGZd5OY2BAA%|4Jl9>HlR9P;A zSY27CNynzkFDbFnH=t^HF6Jnj4jin+WQ4+6W|1@ zrJcrCs)daHP2w&^V6`5I^p??85|>F5>TEXTtEU6%<_-WC5-?=|d^rT$BQc){Ul;J{ z8sPT$yqND2f4|9WP&e>)2gKuE4VcRU{NyPV3J^Yj4TT{Qi7eIX=B~}344JiF z6>Vd(i%#5&`K;ifd!Hprr(>~H?%Ut~QBm!{28k7oCk%3NI_8h0vs{gvCqKAcRJF22 z$YrB+Dh+ujL}KmHB%7PSqH5Nqmj;~%u0Xztqwis{7cNvHH;V3v-X4OwxdY^KMQLfN zP$&T5lB%}R?VYI}6rQ?U`u1CA>ZTKR`Q}7h$K1|zU&|Jo`{CJ(w5`g@)~8FQG7vuZ!3FW54+N5#oHw4l z+B}{}r9%#hnz1vEKl1ffR#SKEh7fo$Se7_IU|SpL#Y*FOrv_j*kwvy4y9(@r60#Wt z>1?jxCM%gfdb62KXA+5I1~}VEB#KcBASRVaLfzbeR;ROAZDO$)xfke~W^N2u^i22E zSB7)B#=#{a4_Q7~S>04uRomCySC}SM)wWn!)!bE8>s3-_aBKVdC5HV3RnDi%rGr;1 zy5esBxzf(GR}bRn2AXr(xKhTYE{@Jm_2_kC4x1Tt9yU+o_+0h|nO5Ak3hJuvSaoG` z5ihbFptze|HOQ|U7Mdf7vOR~+GlQa>GvJA*uXeCLMY;)v!akoboqiZU9>eoHkG6>z zig9>TofpmEx~gwQ*}I|yTlBhWctc$X!0QdfQ>Gi|ft11&#o~n@{Y1cH+auHM`5zWu z{ztEHwTQ(NdvpAZVf5ZDw<6DBZ+Vz6i*>Z z)5(O(=}9F*G4OUh5)MX^7P~9tcjwaa1->ch^Q4d$ao~#t@`f<%bH}6L)lv>UE?5w{ z&7Qc^16~|ug5FRth`hDySV7)-gDhZLi`W#bnLyqsCbKzfAmQ}IHgT#?TsJ;n0L+Q0 z8vn-M|Mqh~EB)#R=vOY!z1pz$(wW!(?EAm`%o6=?k97mib$4TX#G}D-jlHM}8IROb zU$-$ml*+&79BM36>A;(}jFPrs2*xVwx-e@aml_7z8mg&U)78q(@!p0JijvBfiU|u1 z<2ya|r8=Xux3v{B*mkI(s{OHRwZr;I?pk>ZlY`q)yM{K!E!8O0$YgU>{hR<T2``D7tB#AQFiaE|mz=UEkO%-kUTB(^M+k5eWsH>{e7;B!1JRFaPmR-sySy%FwrY%Fhzye|fAMu;M_WQXc)DByXB@5x=e8s_c;j+=fE2>TMHk*W zb+xLlrLJ|*DA~i2m*4x~GSd?0+7sZ;O=Nd4WyYl);`H_^dTcJ2cCT{KVufOrTwZUue_Uw*z)Z$d0T-3y|#UcmnT-r|)ANDj}sh?fD^8Q(H zSM_Ps4Y*HR7k~N9mKPg0zg@lZ(xsVK%T`|b?uD=PQC|FI=gTYnFCFVIT7-=nP^z0NG{h-Pts9{{n96!V&P16ZuXZj>giNY$O^#CIj*j8qBJR#*eKAq*E#I zfjJyaAPmeRk*Vvf0r$t(^M3kxGfMwv-~NlO*l(Xfzw%zkOYeN}g^Gz67ua9Fy7=m= zKlo#Ky?K(n(VG93Df;>8;xCpqd_`;gtm5!L_m6&IlKi!1+{>3SFKe_=H&5#F(lxtMUR3P#o7!7D1{=z{W@bl*&?D7XYnlc(MrxX;G2^3S&Ooqxks?(~ zx5)eBBO|te57?q`dAz`bB`C*kw}0w%qf%>(W(%+x5A4b#g1AaSw!nVBkx0Od_%{K&J>4B3JFr3zav|w$Ho!R$K$2N(h4PV#tTrJXCs2Zk z)YhY-kfWCTE^^eAk1QkxwVLuR0b!fX_Nmj2TCEWXgaQP@6C$`dEVxqw!JX3Ihy;b- zDWmXCF&|xN=DD`P3-8mQZXiCUZsK753zSDKA6qxU7jnVh`$Qxyh79=lx_N<$`%gyp z@8?1<K}+j*|gNOW|351iJAV z{$E_`f2!zsDQEe=wRe4UX5+6|JAb@7^W{GDSNaCO-Zk)rHR9*GdcTr3{ZFkue}&|Y zywEZFmF}_6w{?Eg>-}Gb=l=@b{f(}gLhu1{v?6{J@W%2#2nRqt{P& z@Q5xq0+D>m@CzpXAMhmq{wO`<&7;vxi|0`Byl2nqmsgIqL4I!7=Az` zUr*xt(W5F7`NFT)n>ene(0W9!SD8FfOJVo88>t(S$>XYzDoWg(D{)jsA#b6In;MhI zH{g0}3uPXaj68Q9wFI1jlQklVuQ%y>;Wt%X2*1GR3&~^(g|ZI?3Y7a4K$#bKd;tg* zCILc$0_A=LQ04_Lmk*f(1r~^i5 zp+JFh{{rv=cwr5{n?OK3@V7R|90&-=90-WV#hk?5nWN(qi!1A}{DZsZjycBga4ILn zT}DR?c_PR>n*jb`v^woQnUlB+bF!&_`^7KER|xsFe6jc6y)Zd7cx3=P)?QSKUf-VY z{Kb`?s8jySLBe>=g^LY?mrnhLV~%$gzuPh}@!F5Sr}5{`{O+xpnUNoz>&xZ+(qywo zMz^wgLE2W>&HJp$oG|nCk+!+AHwTV(3w7Lb=(y7CjlFz+h=6GmF*Qqv`u$PQf9W$6+>F@3qd|YgI?@G7P_GTryEqMb`M@>$Aev2_Z0>Hm~wG?jz&xY7+%){od%sPPSQNo5t%b-e}Fd zJZbfJP4a<9$+Lq(AzeR&k#=opF3%t~4KJY)E2yYJb|9MCBkN11<@d>)Y$h2FczA4< z-7FW#RBR64VbY4YRI^DGO=SgAHArdIi=){bjfs|CQboY6;`BrK3Jz zzm~y~@cFWk<3K9rfFa8fDC`E6M5an*pBQr{NMJnc% zD-;r) zHLMV^7gupI_C8DF&Lusws|2Jh54#mT%hGw&QgJR5rt_)4F6q1c{`*>Ya&K$xz@HRw zKrRB*9K;i5&I4U@fB{^@ESkk;wb_M2;q~YQuve#)GY41KdKS3TJ7KJV?Y4958SYsS258{blbKuIVC6oZl*wf$j-<|4^kjVnP@7HHHcoLZ?rovP9fCU)cXxLS?ykj3 zaVzd_h2Tzc2^QSlU4NeE{oa}Hn?EzVv)Rc#Nj7(O&$-TZt^=Er{pE%C&OqBjw4XoL z?T5+Jp}kxUV9v1^qj~r;dC?n}1034AQ{N+^;7LSFzFEs6Sw0i&4y&FqcIp_>&xKl+ z{dA(EM~X(O^W=)N-Bf0bn)tHO=oaT};b?tpJZSE3VRIAIRf2ct*0c{>s!J_Ty~#9( znhzm%CbW4vk622C99K-m4`#GdODp8?f1u0>m07|MQ*7+QvAEmZEd3d~*bnxgZswo* zK|)(5;&Ak%;2}>2YHa{&(|hV3w4KXoSK${?iGab*uTDIHg&b+Gb}52kQy0=86SWY+z=jKx`^YCl3;m$Sx^pz3DZK@qh9-FZ+l9jij8NT4sux@dx$AD#H)b2dwGt*c=YlH zSBbG23b~?ncy=_F=hN73x!k%1!7-2yZBN}6dDWa8I{;K>f)CRw%0vo9)8Uu#)J|y7 zo7~+Sww+_UZ+6_JwUzXGeM!e!epGj~pY2r}oRm0RXg5}#*wI>`#tM2ghf&zh<7ueQ zaGWCkZRA-37B+DKb=pJ&d9V3RAuvQspY?Adv;QP?@alSEGqR{01mz>MBErCIDltoz zDw7h$2qAOxQ4ZihcoF1J$p}#W{GkZG&mP<~lW?qln^mjyvw(Aht!2eiN*-9XxC1UFmq95+TAgkn)d)s#ie||3nlM zR46e23D&+?&VfDH1U+uvJ1>6Aj)G*l`{d!uC`EK|dNH2%*{^s8x(>gmd49){C$QYR z#43Wua}2;t!n0yeu^Mppw^SuYt)JKDWNyF<99mEEx2}t{j9Bxail@H4advKvP5h^; zsv2tZTp;wRb8x?7wunAO0FfJrlo_#tfuZkDn*g4DZCl&rq}_p*1zyS>0{zeKK#7VW zMW2i3zor@%lI;t}4Am8gO{-HHFNxN>bR?Z5-$9Uq&<6{E#2;|YVR3s2wBR^9m{ z7&^^Bao_)Z!YNBv^YV{a(cqJtRzCf{=hFG3+lLCb;u$N%%$k6s*g+Fl?rycvI?kw+ z3_JN^@F^5sO<-1&h+9Ull40zWtpM$$wfOzkMF4vjd+Ex7aE}{4!5wFaHN~pFW^9zH zJLNZFBzvYm=AObZT|(O>^Cs@C0SlQ`TgGS-pG?vFa5{D!xk8DQ9DC+CJ`|+&+gSmY0f=A5Zs%Rs*EpO3aIw%AFbMB0v&2>o*NwGiniBk#V zeS+$pQ)nWr^$@9?+Kw;%7)GP$O_i(ob>o8{XBA-ZYOc*M2kpW3%=r(Wdukfqhnf%N zoc`zXiE}V82y^QlH<+ncyEhMAO8N3fmusF)klKhZKVg9H(M2!c)kGEnP}Gph`J;|+-a=x%MD4<7 zk~fU+(S7a08-&v&YE0yBxaa&&Y|dlv>}i+Q<%n&XKK5$|54q`AGcxxMP;vb@nKL^Y zD#vwo8aVHpOFqYbDY*d@+u}V?&oo91vZq#>Q0Q#Ph|M(%P*1r1ex4S`j*;z$(8B4jNsLH-? zQgKI{HPQ-CdxJC7F6+nf&Uu=Yk$>)i)ch%HIrZ{k<1q&Yw{X(Mpa*OD;^C;#RXE_V zEqV%UTFEXP5Yp!6>bsT>*@3AaKSsyrMy5^zbQQ2h_uJM728`K{OgM^S2X`8Fq^&3o z**Jknqh)knVm{L9bO@P_XY`vk2K*u+;|iCB-`q8cPY$4`X0wc&32NxE5>T9LMyGTQ z@|=|qC)6d+VvGiBmyoKWVh88Grz|(X4a4k?P?9nH=^qL26 z{2fEt+dXmOyA!*=y-x(W|AL@wFQ*6ee*1H}arrPbPWscy-e#3Fy43{iehjnMl!plo zB@=L29O|3me5$$rQqTq<+#BD+eD3JNdbVYLKdNBjo^;F1mw_1%Xemi!m7Ut%{F}ob z>wnkCcHlv=YxgRH<`Sal^fx$UD*`o zbLqqF!p%ws2~MW&mM=EKDrc|POvaCds-jE^H&>l)2~^gb#<|L~#5H~c_b#2f zL7=!9L)J>7Ml~n2LxdN&>YQ2Er3LvjTUlZGRj;W)qnn|XcS;@mbZaYjYh#=VnS@MK z*N1USRrUmcvP#^K;(?!R_rA1}QaUCi*LSx`;M-m0SZHjZM+RTps2NGId@ATt@@AiEo7{p7+rW$90x!@?iXeKsAEa;Q;BMKXf-o(?gJEN(ZWNmXB1#FOH5qts|<8BEBL#6ikmg1syd{3%JjF-E^#vyN}- zS9Dp?x5xMqj%jF~ofDcmNiO#(nTjz&7Y#|eeP=K()`psm+yKoY-cocluk&|r&-wTv zBDxmEw3?`<#z5UAwm<#>A~zm44J}!VO$R3oFr?e9(=bhGD56wt%X)LYvX4P_>_;8r z{w;}-M0hT7pJEkOMOe}X)_a&~jxk<-han@fwCRBGZE5A-X@}1ToSAse`#Pr6fE`U{fFMbv04;P;j!EspMlK6> zG=Gn=pjBl5mf=Sz5}tSfhT|9u2~jnZHmdaP{NIrgH||5BuLK`LeIL}KD2`ErRuub+ zZBmOvdU6f-i^NlMr3xr0Q0FF~b_rsr-)E3Xf#DOrBtHoxL!jn`_D$IKAP-Rh%MB;qDQMf45C{5fK> zVE(lS3lrxZw7FV*`8{p;)nl+fRUY4k2|f+SA8L318Zi{!h%BeLpaH$2kFi62MRyGg zO-nk8j_XfTqo1m)XZ~8DXtkZ&7?WP*k$z?l+ajM-)sfAT{>!*~*B^MJ8cyN`X+b_d zxLq&`l5Kd;1;2==+0O0hG>j3*!sAj}T*n(29tCQQGB^-Z&}9@&Qb)@u=(_+zT>_YqN5uJiwXlPCs zOgpSTkOD{+0WiE^{$nKC7epTjcZ4&xn-5j@hm{;tiK{AUeqYwj@k1o^2n~vsz3FK5 zVjdUC`wxPOP!CQPG-V*6rT6Ch>!%8%EVarN7*ork7J3LjUmhd_uR>XS;}s+#Q-vrb zQQxSzbdyYBwiFL@)gpGCRd@u9(lcWcuOAK%VF0tjh{?cWRL(Ad4>UI=6Q4t5F|{s@QX~0 zu6pmJm%OLe>A0+FM~LOF-5P6dn-5xtoK>{!;AvCP)bm?gc1>+u?Y!-dRQJG1l{-rS zW+a9s=0Cb%fDS}JcZDyh?tHKI9?6iQGOxJ9m1K4yv0B8)nX%g8J-k4-_0lK+A8RDV z4(5z!-bze$RiIBCX?@bDkyGh1*RlDU0{k0+oKtQURR;jG32O2**53HdqyM)2K1d%N za8w2g`$F%XxM-76s*hg_|8Ao4u06bBx2q3bFyUh^zozU5K^S(#)bMvupn$i;wA9)? z6gS0QQ#6=~(i7W?0M&DQ$z6RYtMard@{W-+Fu&w6cj8DI3l#|{532j-EW?l7$s^4X z;%s&HP;_zd#W1kFXS1OaTWhD1tyqw+zsQi+JwAmnwKT0IL0*R04$s!6ZI$d=b>`gK zK=R4b0wuViPTow`h>(LJKXFCwRd$?qNwhlAP4n--TzArxe1f!u@wE5eo!{kL<4a{4 z8j-gx&Kv0Jrji2;KVO37;HV9q$+27VE7+NRja*(m2DzA^XJ;6;ItK?T~=r|Uk04ujeB+*Am>Q2Hi z06PXDRT!tt^L}iHp>67`PO1Sjf--v`tEme5ghO$4r>lGzX?`LbwSn}PO|xm}Y!)c0 z7d-IfeI{Lcla0rgjTmM%))>7A%kvIn~vX=$H09b;X7GteI zl@dF^7#ksZcg>wygpyy=(sKj6M6onF%Ud>bhwmEibezYwgp6{&1JNn#JTw##|FdBqT7;p>6@d{nY+d7a%s00gdAE8LX z&+64Q9)qg=)OEdf?az~BVOlXIAAyO{~myXzyhUJ;~!TzXCFTzKuyq za}=G#=uzSh|-6eN7Dw~dBvpwhG##0 z8?vtr**Y*~--e>&X9J+e_+6Gj?9m344^&ZqXxEe-e~ku{i1{#>ca8dn_z4vA63B_e zpo0=3AKHk1P}fV5U*QD7JS1EEbi&RyYy_!L1}pkuMo{K8Y{&y!NZi~f@JT~uK>?kyd*^Bp|x;)27(JWqdz zH~&F44-DmL3*HWx{H{)U&!kRw2x#<{n&1?u-horJ&-_75Z@o4a69#qR{08@r{x+r0 zznz26^A8(!mG#(b9+=LcO_~NUwDJ9}?Irtl-Wqd3cUMgQVm*Jblcl;OJ~~wASk!u~#}7aq)0hF+qxe6ZJyQH*J^tHeGXq0Juxk3O+__KC zQ?^!rHt!?-{MdKE7o}>`;NAfkT^@PuT-zI2@eRF|i?gV8WcS^3>0&)NNf7Sbo64EB zMVGbuAh>e%w=NAX73}2V#h-oriH;LT+NXgoT#PU6uL9f!+$qO%UVe%9&A`r zu}hIZnBXm;?9q1QcHSnrb5Y#ODgH5rv!^*)L%(#*uhi}i!XM(`x}o2u{O}R_MImNa zFkSogc|zf(-=Vw{_lGhE7u#U2@h>hH>&)7ssIc@XudGZS`9=Hee0`919HDhe#4Sxz zGom^mY3C!w#nSfrrEIWNad{3!@XAhOdt?rh`g1a;B}4`26c(*YOgJlAj`E zQbUc)Ffp;o4c`f71@tj1>5CjHYeFp>_3V*!m^+ty0vK-p);KAsu1iGr*2kmK)z{U= z-%M=JkzD~x`)^rF7^r}CfZ*LHXx37h64KVMArR{lIm->BG^{%Njv;7E;xXBCArT;$KYt6S<(&CBT$qiszh?@Som`_JndDMonCRmAu!}aU*8A(d- zYq?=Ya7ow_be?7OXnC2~O)jI2YtVu30kxLnhH|g0LYBlx>53^knjI=TSK!%Pxu`4E z5`wv3L;?3Z9#L6B4tAQGZ$jW&jL^!Vvxxp$z>n@0U;K;S$O4k0_3>jRa38%fvz{iw zonBcfN$!RN&ANNMZ89CjO2@)VZ9YnjBwbf5vsjw(#tx~}+j$&8cxM;^?c{1Ua4G$C zPPrwW4V{nCVuk}n8hXA>mTUgn=`)PYUYMKOA;Y2JyRs*cd%!HzTYUR?f#>U)aqs|r z)rgSb{D3E;MSSI5%EYij%BDM^dE}&!($hF zIbzcpVl{_g&07d7#>R24Ot)TT}2KAsj zhcT!XEn?(5A<)#>g%yFRx?PD!KR7c8+j43Vjg`q1s;0e1y?D&p!z-G}zlI#Pb+)Sh zaX`{C=rdy#ImjF=*!ZsIm&2Cbx$t;`NRK3v8=Ks%OT8UeFlx@GDJW)yEL@;Z`IA_8 zu_U8A(d!bgtwFg%))f=OQ%fWbjIZ+ji&AGagEEikkdk8Y0HM=j0M9h10o>>&#Dr*M zs?Dy76y#8n{&TuNcGqbGrdMQvOZB#1iTCki7-2ib$;vGD!(5@BTz`aNw9O|chDMW~ zZo3m|eH}rjwL-#MkGTYflZCQ8dkKk@1!4&}ViL%6Yn`ibEG6l&V`VC->rBP0b@Tnt z2?1c2wqn%pYv~pI!`6;z{_B2*zZ%J<2HE*OFEpJ`$A!t&bFw~9gYzA?+9zBi8u|=+ z{)J|DJAY%&GGDT-+O5RU6YgoqPAcYxgq6E(5Cofxa7r3AYL@hfGpv zonS5L>n7*W3)rUHLbTJA!3(C>nQDQjlbpAQYDFf_)Am^j&(f^(OT;sOzl^8(tF~%& zd!LL-&G6Ac5B=14FZfe>m#3`W8lwNx#M^xC)sNA0ch=s{QrW$br5s~IgUppjubG8t z1CJZQSO2$>H+A;AEFjxjsg{4C%SKYO|E+-|Fej1lHKh6p$73we!!I?_r)Dp+EBo@9 z=gmR?ZJlXwPJemT|KO?mg(d7crm7#m^Krue+G6bygX!h=s*tWa8*wzvr_uVh5TnXh zy!G6I}0 zOHtp40br!EpQoZxzXa|$y4o?V^Q5kb>5dLOC&%2N1$JZnARMj05k|E)QM0|4)N36E zxBr$Smp4zNnh8|KyVEIRfwY9Uo5Am~e;XJ?Xr3i2R=Vy5o*?BoIm3tZNy3qyI;IaO zd82P{#Ctp2e@Q^Psf2=!F(lP-cJl*7wf&OLdR*!JR$0`@Q88GQrQJ^>(iAhs5UUDk z_b}Z}scEETe*_T`JE!gUJ@a@VV@=)dONakb$kEdczvaoc+vS@SF*wf*PSjh#^^Yuk z8*DwOe%o)KNRscozdQ52h+cb{LD_dmGSU~|ddZ?1b&pEc=V!af@_$&5R@rvYP4{_t zt`?A4_x01b1!SDffjAiB{I|mgts%v$j`h0UjRb9cC4>w6VvQ#%x1raK52QVz)Gl_O zH>L_V=&+sQx<7dnvr5!yL$SxVmyvDns5YPhct&NQ}a*J9f>Dp!1^Lq#y@$|pNR>;JZ5@p?exPtX4hY}%Xv4=|By``b0Om$Uh) zRlMNTp3<#7qzHDS_}5e4gWzAIgGU{jFgu4QZF}Bry$K|s@-SkCFYKr!i3~K2G4h|6 zeWlNiFQqd_8{fn4XWMmx0|K~>(Q7_?yp_sP=WnKobd$%*7keW^id1Pg?w@9v2W@X3 zUj{cZ5Re0fxHoyR{2h=aKdnB=`{Y*%brF9cfj?!Ep&)2jwCys;8#xh}+BFn_>Y(74 zC5GA97iE8C976$+$aBNxsO|QdV4R0_8M3#$YjfVajwa2`NmS0LXsPKqpZ1Q=ndcJ- zhJU$3M{ABb(*?P7R91;q;)C5$8x-v6Z#bJdxRCEdcJ;4IHy;(b>n62UAP{*?aTK(H z!|V&-JQ0(D9d10c@5@TLtQzxiH6v5Cq$_QUH$UtP&XJBo4%1orH|;M|gX+x+24&wE zs&cDx5yPI+lfRoK-Bgn5k@?q5a!x3rbYIUxc}zx0Bx%JVeO;_DyWZDQRq5Ga-qczL){A&SGgrg+!yP zCv5jo@u?IP#tGL`d$31xDo%{VsbHgedHvF{(D7Vw?HB3yB$N~K%zZoil5#F?J<)tR z3AE-aEHDc*3vaj*@`sj0<;`dNc=iOnO)GoX?LLGhvfkH+;kxyqD!u zKMNCI8OgWJ>ymy?Zjj_zRW&>o4^n+@X|7XREBEZwoFJO4YkFheVHs`q0O#CHYan4g zPYezyvoVrPbz*yIvjDu~{73htB>fTLmu^p4RcYY}23OIe(uxV_XbZ2|qN2Xm*EB7* zcQPVFS0J>S-##0KbuaCm>$6-roP@kCvWJDNsRMNiMb61Y5d!wOgWG+UX_xw3#zn#> zRO^{dNN&Y-Hpl14h7`We_LPYe-CYj_eX%~DDFv4e{~L3X(xzj zIbP9^*l(j~$Xn{VLj@*s`O0!%I7(V3mx?kQZ?}N7bH3?b4Rn1MI{UW3bFMaen!}{< zA}%wb5z_ZYclhkjxFNs>xcDOUaeUn0_UuJ@@>P(-&Hu)BOXdpb?^^TbZw>!e)qW;} z@bacK^BR-hRQ;g(W@B?^fP(A)hxwwVYJ(|5{7q+mJtdua4QkP1P;h?fjtgn;t-XD3 z#P*fE)9H3+u9e9iQ?Opvv2hd+YWf=1`8{1sBQ-e$5C(XwNFPdJLK|to!rc~ zT$~qY&9}aG1W#sNnNHXEI$oXWHE)84pw5A$*D2Ep170})n%1WjNI_?&!OKY2yYSlg zx8Ek`4n%vMJnZL%w}I7U$ZtYSFYd^TyCc^k{hn~Ap+3?J#wIk+4D2Pos=aBc2=-$4z1_392MIicIuS= z-C6)2I^rTLfDa)<(#(0-1wAG-q+1E^eQL4I7w=sk!SAQ<#_kTckN4=X)ajTcfGeE5 zLc)<2S+9uMUKP<;s2ZS4mJ*$rX(BxS@$PGYlt6cT=-AF#Fs)G9JOpX{voq@f38sR{ z)xPbv?TpsYumx_9Em=e{OCSXj!F=dA50A827QqHrh`UOFpPtYO>Zx7vDYcQKIFn*& zm+_(i?pMWA15Nr{lv&@yf1Z$uE!d))qT_yz2PppL6WCR>Iu{cPgn6fTBL8>x9sK@h z;y(;f#BBKYi^2eKd{}Wb@AEsap%VF>n9+mp)Xz&H>^K_zfSG?Chn0y6iubL>1SSid|cD0?6M1xlCUs0=d4PZdp#8XbTZx%%Qi@zWf9a zDk4#OrGBanDLz-RUfoy6)j_XQZWj}-6n?A@uDW@yX4BzaCmC7FgUSm>ML|3Q)G&+Y z3-s_U%Ct|*gpW5#oPl^wro;LNHUz1Fs|~9J-N(bb*BIKL&-=xKt2o4<>X*@!=+~S1 z_aZL>m+f~DAlYzdhi7AF`35ifZ~mSelu8r))wir!GG4Nd!DB$JH+w7!Xz__+l121X zvuC)KH7z3*C{wqGQ_8-E8S&I3E4qFg9PTwSl{)9STPgv`g~W8lg|0ig}onUD@8v9SQoL_$Up7 z9A3=l*Wac(vk=0^eb4d!L>^V&HwqHJzVaqg>}H*H1`}KV1Z=fro`CiwX7tC1&oU)q z9L!H$lsr2m&u~J1nfQQ0)6m4%Y|S|ANr&K)*|O+CY<=|-G;R&mIcq(`zKddQPJ7H- z(d=VUOt+5VL%Zd6E^VW(wZY=Eh|!=$d@t^?-e-Yzh!@0T3lcz#>leA2_I1-X~jr_K@Z=F`NB=ow6yJem!S%}&r;dPQ1sNlE4;0cC8hb5QanG_{h=+!>$dV`pVeEe9Ks-H1usUFOeM$ed09QQcdq^SE9m+-iw z_#(Z&zKxx=Q;AzNwdLR=)#VlNYo6lvT!2!YRI-%Tf(K`96CLaY$i{ofm(AU&s_HTE=xOj`cuUSi@Nf|G`2NEF|^-+~xFgoay?vDXA_X89T@`07V<*G#Ir z)D%>38w`i`vK-~dC~V08p(qORzVTC#7=D) zvdP@*+>V3wX{Pc0I1#hd(dtx~Q2})FVM68jEI$xp7R%5Io$0H@KA8je#WL0=HiB7y zD0~8v;ilDWa5-dqZ#8!s5eJ>`k#FL7iT+NGf~WU7#CaX_uK0&e`@Z{A2rzctk;Dyd zxd|rb%^XkyDY6ObCg=s~Z2sBJFoHp>h!yzl;w0!6aBas!D1S0Z2WhZ}RcVvPx49c$ zJXl@5CB(2JU3k!b7O|!A()`iK&5)PN{`xuTZ@_35{~W)waNy=H|V9EoqrF%IFMY9t7NvH&Rlu5G6uid;T5bw?^9a+yC z6mE6uU8>_vQwhQ6v0xABYCy9nb)vVAUkU`a&yu zP!Q{0VN%3G!0rVr*zgxIa`k2L2pnTq-L9glJ(qx_Gijm+adw#MpYEc>5Y@C!qtX4N ziT=}dPGe_UfA;;I6^5^TL8rHP}wh z(@sN$E~BZvgH2fRu}u0%BwPg5uG5BWV)wgn(7?|bpWW3_0aA`y*Ta|kf?D-ph>pPb z@>1I(TY389Dw(W=yuX|!fC!5)fJ9>2urW(oL=E6LF+9l6pFIJ3f@;W=i<#{kQ7kpv zdOxy9#rNXaQ+$&lrSp5ZCaY>e)TUBdyk)r{tNl`0Mm%)!t9qDjw4#Z)<)+Z!_w*uk zYF6>B14Cw1m<~l$+iv#pxHiPl0FS8D|3wV`FF_bOEtq~*?x+gZXCiP99fozUgCb>Q z>%#Oi5$vWTkAe@<7)#O8Z0@oLQ1AFP`l`O>CrEx}~ZV5=jO& z(0gq13f(r^Axa9OW3jJzhZz?GK=!9tzjz3M%HW|%Q(0Lu5NvCnonhgcs>HHYI4M7R z#6$23hbY|~nS5;)1&JBqVpKK6RRr~o@T1w31GPzSbRo;3)2E&;Pn*k=cuBIq4*VV< zk2|^YHJk1x1*C)cFHHq^oBgzeX0EW!wS59`w%#W$CVE-`S8r>3-%9r^HFXGhPP6mf zB-bMZbK6!M*j2XPZY<3$Q6#T${?Sy6Nk49>`%aBsy|F}dOK{bmnswsa$eZH&)>@L^ zQ6VM-SzXjwGmbRi)gz3c-mna~7fbz=Bz5x62DPtWvPDD;GuaK1eddZ@^1HnW5Os=O`qiVfys@+;7Ypqj zfR~$M^7Syn0qH_`;itb!$qWS8*-G*(t}f3zd)nKfj3AC)%%T1SL$(UVT`A-)cGADM z%?as}2;G4>8ViBBbKi*kYMIhTeh;M3r9Y1Qdsx}Nm-9LgR-VOMJLIsz-y3jZwP4)Z zPcp(%A?B;;=8Myh_`dg%{PUaqyJz2#Q&z;|2zKwCjNQlGC43^ z|4CAn?oiSJcg4@LqZuWe`@>KsZ~kkFAbeuf%?L+V?Mlnts_&6Tb@gpZ>GR^9|Ft%x z<*Mb^8I9lrSi$eUye9N+HI&XFOSD@B2|5kfM^e*sY*?G!t>=BScb0^!w{4TOb0TW- zRMP0sS-eW)KO}(iM%B4@F|a+PXdV)n*TBDNHkGaYo*xq^ zTXTLW(P3D$)qhdJj#d0n0BhW~>^jJPaK7>31qvOcfDa@=rdL1s-g5ooTY{`g=OxLx z6v(5qnrn8g#@_Jbn3i~Cq)L~Yj^kYtw}JlDMksmlG|VQ+bt9s=F1OGD>#aVgZFO}) zRiGvA(16eN_ORuue_V6}Of*|s6&jj7K&Lh~Y|BXMq+emVuVbRe=YMOhRLh0USS{+x zIB7MKpHihZcjGYUaR)S(fnG2HMbeqm7OQSD2l5ItufBt_J^w; zZ8;EL*Nh`Z^hkH|HLJ9vJn06H|H4OH#%XVtmPk$8E!0w`kmSeAj$BFx&5f_grkEskFhON2QgT&YURebY z0lh;31z3?MmrfZU4PPVy>c(*M9K5zvm_Kk=0Nza{=vGzudbr3`<=LUe=B7`XoXkW( zTM~w=LYBW3$g8`eH={DR=C&G}XMc{bI83!C*5-1Y_u@GeuDk3o`xveodKha4Ty$}< zc1CR>``WE6VvkArFS6rCB>6Cn%?$y%XuVswjn&QV<=dB~uN$=-$F%aBOWEXA)!zoA;c@6+<}Q8o z-l#}?aB z+f;U_UD20Z9PSuqv3p_aMF&y2kIB>L(K04$aJ9C3od)__xs7{&ZBdV5)!BAQ3a{f^U6`t`Rz3a8;CnK* za%IZs1l!6R>hJ+m_QoAIKa36IdU+G@wX%eI#I~9I@HEGFKiP$Y>q~vkx|R(0AKM$! zY|}}8Uq>n7|8A^&!n>yASY)1ocPjXBeThcnf%^WItb{QGy=}OT9wI-u928EorC_C* zhfP_xYxQZ_^qD3-bZ#Ls0&U)4cU#e1o)~RdFzUtUv`-peVY+|MpD{)3d94fg<9~n} z4}fXm%YG9J%n1p&>^DYIW$T;iA!(im8geu9uE0}!!1{q^cH97gCZsh-DEC*8uBoXf zL-YtZc%F9Xlo7Rso2-T18Mq3sgrQB*drah$4aW{c=A14Ickfe8toIy@nV!reSpMJm z4sj}Aey|293-%O`Bd$n^`MEHz#jfEDI;Mv<`{F@Z5}F_w07)$5h(D@<7^K9pAKD&M zEC0ZhmJ))cx8;nznMx~k>Q>>IBYm8yTVbf}#s=qv zpsA$7rs;UPR?x|S%Ma4+ZoJCG zFndnCc0K~+|5>r++f@2w(R`!`XwN+x9>R`Zygzo~Jxajz4k+Q`zG3Hmp)2HgQ z!z+m_cSD-*HONNC=Ha0)`cm`3R-rHnLSJz|1bn!Jh^%{QdXO;vsikZCQi~ZdxD^N! z>Phm^qg``DE|dh{U#8$(jLqIY^1LWH03s49g7oj7=>J&wSC+ZIBF&5iFl*xzzZd6r zP*MO-QAh^-Sg{oPOx()9;l+sfit<74THZBJWC6Te>ZZtAwk~8pd0p9i$~>u`6(eWB zNjjO68Qm?oNb`}!3{v4G{)4$j>H$qhL{C-azZ-~8FrYD>spa7fp@@0~mjInh{ey3B z`~QZO(K6#(*jg3ZCGdnv%!B6+`WIdo3+sL9D7+Qy`YF7Gx{1!R49dwC(~gb^jt^8x zzk+C(O9FS~Rkwt6z8rK>0autuww;#v(2sf}*G>$lq!4+ML}(kdesCskLlAN7< zX@in)XXvB_@FF!$IOjHb$+A7f{ZlmyzUg=}!b*_pb9iUZ+n*{Cx6UnJ>Xls;6=Rhv zS@8Qv)n;Jqn`TN=V>%s#dx3M+FDAvcP?uC$k-|~>L|F%^x59q5*p5b%5puyz%N}3e zj~cUPkdkIh@`$wZ*1sX`}Rg`eZW0%eM_INLG-Tu+zG)hgGSk zdM9M#qskg8r(HiEqkgx9lB6+Dc5y2oCG}TbF;PDEnG=X<$XAKldanS%)i?7LCN$m? zcIIiYHLd6qH=>Ij+;-HIq05;sPZ`y3{7)Jf6EK_h*xuL_rs&s%VZ75jg7AMK(PpZw zam_C6S{epUNWwS0ny8cEroJ8Ly-VsXdZ@VeTOkUl@U!}Ek``UE=)q4@`-w@0UrA6A zx@l+66YY@*I@VQ^)XO7ju;V)20J`qiqs)8e-Zl!dK3%%1m;@=U7&>-=3JqVV6OouD z^QRC*a|iv&x-bYyIwr_~0cwQd5EFOqGs|k`b@z%BmOyYL1OvV|+p{lrcI5}bqv}#` zxDk5I2p)24dk3*NyeOy~xC)B1YL-#JJo0r19A5BX*o`Ba#ZHhz;o-Ce#!sAqNww`y z|G4{Qc{InaEelU_mM`uEj(Xak&f#|bP8-}qG-e}a$>I=6>ONsd%MBl8qzPr%VjGgr z@piG4a$reL;u^2U-hsK?UP%4BnSaJOVSj>{IS?6{@Uz>DIsUWk@xrv*SCUjxa`k;R zhmKcBU{Tbm8Bc8Ag05CtD&*EX;7c{r8z z)IyheH66adu~4Vh<$&UIjQ$^|VR^N~-=dk?Ks@c@_y9TS>vMt{VOH28ZcDiQeBUkH z(s_IeyRpjnd*~c94-Zvpv)4;m@!tNs=C3fxiZ!*ZA>FK*hmog#0kpu0- zFs4z-YdSJSQ}dxo5cc{`u80f0+r@UIfQ`dD6wDuGdoFtzRR%uA#Kmg!#g;XFN3!#_ z&Kjb|^3kVB%fCf{IYQY2=_XC&o{(o_PjmTc%(g-pOFOYejgiar5u(x|y)(=KI)IK`jJUl3S zT}^I+9VqLvwK*hXswRIoWb&Rvrh-2QtB=b`0Q{{U&SwAvJyF#=q>xKiup0pXj2uwruEnA#Ky;jlwA|ArzMn znf*I4bi7ZZaw*C4$%-l&FiS+&{vu|Rh&saIIb&t zmBU71x!!Vy6%{eYYUsNE!7NFe028`+j84%tfP)t^z4*eb!hcnMC7Q}_NL#r*3Nn43 z-d}z`zSUQG=PT!#xcv6PtDod=aj7iIue?5GUnpX zbs-Mi-m=_ns7?;o<;eW$PgUeBUC{Ao6;>oha6|Kl3W$IPjr zt%`1+k9=c&69M8*l77|5|xu}NLKk~gJOg8`9fGtZpILJ zax4XbiR5XmaXTPFW^PjCHJ}LTy<0Sl)ud`#BBhSzV8V;;MS?N^En1AzW(MO{m=z(; zK};~&^_P%fO+DPAqj~wmam}L8XJ*NWKG;*}_TV2Ba1}Klr-R|-%>eDd6toS7V_0>uv4d!!v}yDpcEl^qzn5y_>> z4;xvWm^E6$ThI@}P{Sy(L5!LE5r7E=;%U@LYJ8)QqRW}uc_XBry-t!AUDir_?Vq7` zq1ar0t9hb0a9VUgQ~c2M15%i8n)8f|t_Jj*i?@cc|3A9^I;yQF{QpH;iWYZ=;_ei8 zE$;5_?wV3c@!)R7i@Uo^aCdii2oesT@AsU0*YBQn|CnUWWM;3Got-_;e&qEYsYsY= zEvms`m?7R9`+2w3HESc~NxUV@!?2|u1pPCC5D}4ZHsB?qPmBdPDI9}%J}gKvh92H8 z(%@B}phOF;K1nzm3ne!W(L1SAds8T1p3`zRB-=P#a zV%tVF`03f0ZPV)f;I*pn{Mw!i4rS9SnAf+1MEh-bO_V2-e<(+wzlE8`OR1H?Q7`{65k{XSIn zvIu~*?R2hJOgzGBg&Vyelt~r-6j_2?RwcDxmo2I-KM8kv3Smw;VsHcI>Zvk$Ctbuy z2|qUH7X1m5s8s`EYJ)~WN+kU8b)va2~3F|FD3m7l|Z zUkYLUGjg)H$ibfL$lr#lV$4aEV9?~82zL-*OBm}R_@$1CJx&4|q5P}V0Nh_9^J2#4*jgy0NjQ7C)f8>j5~eH>1yd3A6fFArOymN5n);bt7w=U``LTA|+&(+hBkl2mMv^o8(oxPwjTh$Dgb zU^rkQ8D1jQ_3%$Wa_CvzP-gR_@`6w$hmHsN%@JRth3W2G=s>u~8FMNo=dQ+`Cqi&+ZNzhkT6<^Wc*+# ztnn2?ebHm`yW#vYD(hYr;<;Nf3ui2DC=MHkAJjw3^E3zU=_g(o{)B{7$2C#24)!LE$C*aiPQA=XOcho3)i%ZS(~A*=2U4&LMf8VFi`4LW3=MBdxSKFSu&<$s z={4)|w@&OwZU3g{Pa3aht%UpK-8mKQ4QVf79jqB!X;aP?qMQtDQ+19UbyH7Ld=hK` z&E`@*J|f<^+4Z%BrTWU*$J;qoRAUvO$D|1=;Q3nOjz3|YU25d=yh-5&M*Uw)Nkq8o z*$JX56=Rfw#z9>v>Q+{0K9zr^B^P2Be7^>pCOGp~GvEodWWMW)>kYYu@xR!a`eCFp zl~sy>qhH^|0bH0?wc3RW`Pf>M2@fS-v721H_xo<|1=j`Hc9|v5-Bt{uksVx8@bZ!O zUgLKrbk0Z`T441*locY?BqaY;w7R&s8~-cD*Pr)IP8R-mG_?Jox=iHZFt>B7TJrP& zLvKBqbmK^YO5@RL9`&+O6xCPs>CPVMA)aGVtd1^H<>;C?5biy*aVkg+9x z?%+wEP&p#6(lM(h<}*vX-3Wd}Z6Vu0%PE!@^zAf&2N2+UfpV>OKHG8RDQ&=P5`mbbFDB}mOiPX`HWtJqJ?mRL)KC&7;lgb>9Z2xb)q-$ z68=c|-a{2B?;sTqyF1Pm5~k|{tz5(1E$wwWnLM0Skc5o1%~71###UcoQ~3KAym|RH zhtqA75yqN)G7c;>?ZSMvjPi+Cp{I!9{hK_!7AAlwXAufYJ`CKrQpGO6LMKR~ipDCf zMHzi~QF5Z{GkH#~#F~2kzYkf`@S%O|E&9}20vK_ldoW5VmUS>Z7k+=B@oYkOVRt^K z_Tj>tUQ6&`1W;l`4<2nDlL}0geUB*}Ym?hUPo@r@nECcm*$S1*>fGyN{DJzD?De`G zI7IaS9is^N);-MeL4wI*tV3&-9zi7|T~CE`xuXmDZ%sO{@$9U&&hp$jR5qM=t_UrB zrq{3hZfeg9;wcu-7VX{4C0zT!a%zfaTRjW%(>c|Q=9(=Gamf6lpe^^oHs zK=}O$0QJ{@tED?;?$;E;*`HprSiF+Ttz^z9$}4hY_?OB{*pK>T)=#Fr*WTcy8EZz* zy*?}+Z6ui6RWxU=)Q?-2mB|DqaK8@j^&9^YN^{bf7u<*c0G$=?3Bkj!qx-(>w}2wI zw{<^plB#;pNvXq$F1`cdk<$QsbJD$o)dm1iTa4{JB7urJhBnYmVe;u2&=tDlT(!U+R|296t(svs@l4J1Cm#K#>ijLLD zj)n}zo2m<#Ggnyao25-5f8W}Db{?7!nV(0FSlai*cKzI_&p_9+?abT+*9t7-QD@X7xRvKaRwkL(5 zC}K1;a8|;Ujffi!b&!Z=hh`4=bnVvCWI0V7VCGo`Xssd^$I?wa8*C)WSQX@FcYc_& z!SGx)pK1K7>wVHEmi+4*^Y@SZQW_EIAYRk(yQ6=7Egg-f(+D!In3g_Sjo-Oh1tzxQ z_Cp&7_K^osmWVNr6pkPpsFe!@1$RXY%wMhyj;e#prlI1T7OpbV`8hRjMXZL7kSu+C z2KHT)^4k`McajQ|z9hvKa{ZD`8G@tM8qotqa+M{MFUTX^W%*umI@q*-je* z?R(G+K;6c2_lxD{3E1uCAn#8H+KifvC@=ra;o97sjYXI(#K_X*i+%#aVwLRa7I&Ql zWm|a1!=bT8voMJq=)CA}ff{T2=oqxWd+P1*|3eX3ZT@em`u`DG75L`Hn4G`=i9GHo z8Qd!r!=F4leYNC=6YIfqVcSZT@pT%DyIr4ZSEagHC@VrZ)}+w9e}V%J=+(h|I5IY^ ztx7{p?KELJ`_&-aFX@>{swxk~M12xlx z$!R;mMc6UrsQOe(%krSmk=iGwOmuCyL;@;Hu`_b@{`c%i>LHDj0fmV!S2eU2rQ5%) zgLTfmy%)r1WmhY^Rf4eV-?lm9)(xjJ62E3JZc-cU+T1&w{T$7dOi*AAp63mu=FFC; zShqfYo^J=VN;$ls@ze}f%j(?f z#NR-x`573_f=|`n!{lW1?##)Fo_nUiIFh3tOjPg_Rf2be3iVuAYUHdnl4C%;V>zvz z%=6wYd0#_Oj|Vwwy;sSSL|*TO z_UZ=nMLI(jv4--3vtPcdQC@T4-&_X)OwU*u(1~&@QAptBIft9|+>?6F3>=Fn8fq_5 zjdpuy=XKVlzcjPf2iIa~tY(zU>iSoDMEXQgx<2z9Tbu55+mxynE;32GUih)#Z8jT# zpEH8qB8*atkQ!Ex;D;Zg1XqKPXH#CITYXb>Gykf>cFfk%{CNTv6uLg>hZ^yQ{zXMj zfEE>1%(k^8G6l{?Z}QUfbJr_u$@g<6ryTq<(qkLirN2d0#_Jre7J(`? zks6YnE`cX~B@7;KS^pl^?_1_Ou+2E#DqO0|ih@8US3k@`(X9&+c0^On8kSSLO$k2m zLhMdiL9VB>!&yTMY|E82(w;C#e3-&bW$v5btsa1|0(DJ`{(}BS6#RZ_x0jjw$wz(} zeIF?SK5IV;b9>DHhlulkQgK3fYrKid{h7mb^TES+Fga>rfWiz4C3(c*qRSTt4SJ6^ z23f8QMPV=teVRN$r*-gH3(N5SjW;>|c;B%*@r!Vs-LO@eE}>s{`7e3)5D99GEjgL? zb`R#HkrN+1eJAQ9zV!Qvz^-pGCfLq?A8p-RSY&6B0u68$3jP_ z!%RQ}lQU1U)A?U5yXso2TAjZxB zso{=5w|)skgD3yueVsLmNtVWwos}SSU?u_vH-2mTM5iptoH4cskI1CRx_iX;+ZL5b zK9<+(KZo(%)2m4L^Aw?xSdt&{El={ohdN8qcB5{KuDoSk>w(Orfld0cV*$G}C4!S< zjEW||d!ivv6~Y%^8_T2Di<%mIqMHs=w7ypBu(DlUYsQp%B_nU=JAADeeMQc}9dl$Df=0ka1sqzsWr|t*kqv+zXoGe?i zGMmLvSDUru!RjjNphR%2chuQS(5*NioSw1jJc|%tH^*r?Z<>($5iyINP$UZTr%_OZ z=mzb0V`nZc$(EkSL}c(U2Ek0bb^EQoJ`3k0AbeGHn4IrYrE$5pGHZ{ge^{Oi%BzNT zPbvJfnV(|XNAlB8AA-nn*mAccRHUIXHc-tBD~2`x#=+%yxxIpu%5lOn)YDGl6z*VKEHcrm)3|7C!}SsL z5MD_wee^|@)C2>(jMM1%hCQg}i7A+po*dkHFc~h_kod>+ZVmp| zA)g^HU#1Es+(wD2A%^+$rJMv;u@uR&FK7MV zmfXiCO+8t|m5fZ)^Ao#y+Q0851)ky*hZO>aLUp`tmvx59(PND+3R`qSICd5ghcw~0 zMy!2&?#CG_{BgMPIZ>lnBvqyFVaHX&*_vBfX(lFPP?kCS>g=}gEU~R(YuU7atrRrC z?MNZa?^%HL>mofF!vRz}$ zF0c*T5F8|cHSIXpIVq+=OnYjaF&i++-*f#o(Mr?ekmJXh5Wij_X$exTV|Cm8 zcfPKSzm$96d@7$5DuVqrEx<+1_MCH&fEQ8ZtCiH3kshS6KlR7gS%J5@66$mHYE!91 zRY`ZF6AS`H+v%|5dxR@|fsqPIWtp#*h~Yid^rz6>+mZhp2^LnI%3GpNj?-2174vDV zWix8z>6&s%oALQaJIj#S^a~3$P9)&$1jwJESU_?O_s?74>(GT;cP3-F#6HJJCy#b5 zK3qN#cq#mw)eHknC|8eAHYoSlK!rRAR;cD%A9n^h`r|UE>Nk|m0xTgYVr0#$0m?L4 zLhLhT*eF!iCwAi?8=kDl(6wuIuCy>x7OF7p&W>-J+87~Cu-$B$CMKU$y*_GWRYq(7 za2%UM&5e>@_U{h)f2xqM9bL>I-N9$=zlR_*KCe+)W^42RLB zKV5*k5OzY7u-M${kiwrm>fYSM_ts31W=&)w65nC{BxiuqaGv)sLjt8*=_G`I`~)H0 ze-lp5D-90fdcHKN{99yiKoNE%^?5IfjZm<~(ZriYXA zkP3Ze$ZVDDVo;MPVO9_)V?X*w_$Y7m>jKKmDs*;YPy*snr7_wh8k!AMM=FZp9q((9 z1AT_rzG@g{e!Lsrk76;L+=U6VTX>$lp%0cck831qU9F8U8h#&G(bCj43!zQn??nYn z2W+_1z+#JM&Fa?h=Ny8lmPZ)4-|K?Bq2_f&SE#X0MeNi%6vmX~nn691OUpgG3m;mQ zAxx=OC^x0u1#$e0^wFYyS}PLvd~N{HW!=raC5AY)1qWEZe9~&$HVQgDRXkr=hA`V2 z3V2`@&6`H6WFiZLLPfwPZ8mToFOD;UvcF{S11nchj2R?Y6fdz-92fi8dz=b~^r+uU zre??EngNtE!9XZ+kC(Slfua7Mlb3v}@ilpw(A68r=;|#`p7jTF^uSqt4|L3oW2X|l z41cV?RNeqf=M5DZ1+$Sy9)7oTSG!!kfq5dr-uCM-92(vqIa~4ElokmjxP|TcxbcEM;0O$T{r{1B^uOAj!yTvizf3^^t`RT$?WzvGcX$|^_VD` zA(I^4nypFY6i%zop4ze)zMelr`#^{;1;w>rtb;*nrH>3(kc%%|87sB{=TOjBs zD$=#Rt4(0Ie79pPFrdc~3Rm@PSJyzN+*I`wg zp2^tVE9GveE<~3ibx}(O0Y}tG*`MOzwDtoDaiOwtm=7!pGEeO2?=1SEXz6r$cFP7{ zkxx9TprX9+*Ee0pqlT4O76Gyx5TV4yXgLnUlE;d@{iq}DyS!;#y68zhO^!DwddyE7 z#~`#DDo&CI{Wpb!f}@lIkbgrakKa1?esN_m z;ku2WqI0#Ld2T?M|1H_p{4A)co;*e@#6;gZGfNqT3*2T8|2J>}Juo!G8#9X&QOq$C zhMjsT6a2NVI}xGTsn+%hf~Oj{`k4=aoQt( zB)&p*J#V9Sd$yb``fB}a+`FL`&xqzLjbNFK-ruC;``~Muz+8skGoyxcFJOUYv=2DS6SB+AuDFt`)d~?3f9O@%LJmZ5q>#uHGJ1o zuv%eppa9ct-+uv(gcq>adkfmqDI~TWRTlcD@sK=2XD^(2g;X<{W6QsNiwf&2RHjw)atm-n zO|V^7|90s_;YVt@xaPP?yc@LL^y8-S7^QpV4nc_|25Gr`7F=Hid}xi)g&$J}lgErX z0#^Y>)c5*e^Kfl;pGi7eMZk`aF;KMxYSlPw@9wXA}; zM@_$%mdW+iwgA7f;(6IT%7{Fg@AcvnNM2eD;t`q!5NMcV3o)5ZO@^BDuqNo>#M?FcKOTDtQQ&13COyJ~pB-uFf zvo_8uI0(3vEv@vj)w9z@Z*Lj%te{7FTuh%XT34`3!||-0-md%XFEl+o|QeG#=PxK>hKb*u@4CYYBV%pP()dfexN9;%iF80sT?ZsC^W-9+7W;-beS+ zqtrei@i5lr+ERv!rane1T}pUM@{xjgLjY|;*r1Y`0FEOP3;ifb;9an546>IGR-!5+ z29R=;<4e|(GRZcjA<5rebF4&iJnG6%zhtq0evYHWLxPU7jhD6Boz~{ls)T_OBE^&b zJO}Tyh0w2!KuLm7G`icGG)fUmL@F)blbnG}(-6N{GDvbXJFQHvrA;Wd53}aHoV17nm=Ksz(E{`H(%^d%nDBy z1%?w2(oX#2AZVZ)moa8s^*iOAq#Iw2!3BsYNy)WGjgB(g7*>Kvj_8-|1nGz&HLWl& z)zEoYWkaB%J>&s+0Al$DvCMp|klEn&wT@YE5-@Cf;Q9615qOd>4!2p7^Rl6QZ62?lXEFXqj+gzUee#<~6=c;}`L&S9E0OFxfw2_AnQBf3p;KTGhx;ZlI6NrS?*} zuLyfktON4WLyP|^kmf33(LhG=;0mtE7vl;UGnN=wwbnJF1? zX#PmsB#Y5C4WYiXmXnK#72ulKn!3Y@Q1)vGG_KDVr8M_WkRJNr>p&e2?!!7WAJ4wQ zk(bQbw?r7wC_T_6wZjmUnc2fFF2-1Qmd@TDKo_M2AUOWDieS{%75Zm$w(Ec?y$H|$ zb+@Ziby6oMRvYPSaA&JmN6i-_zkGd#sNB_iSZw?|)fKG!MsoCu6y%$ZN^DU%wMChm z!nWBIg3x%&le99XuR`KXYm||cJT zAF(SO-iX)DGNZ!>2GG5jH~DyOKY;e;545J}kL9=AHodlc&_%fwxhJ)Tt>QS5a9omg zh=k(A4zhG^j&=dIS}tHyY}QY!%ce7k)$a4K3aW1THW^_qgS)E&3T_M-XIV$*oaq|k zb)d!Pg}91}Zz=y)by;nd9?NG6AIj-}eHV{^{+t_o`AwD4jr`qdMSETC#w71YE`t0& z(a?mQ(+uElzJTQ{PnT6jPJ&EB;8>@d-U*-~Qej2isoMS}Spr+}fiGRIIDM(;-x5KW zjC%XR_$t+DLE}@}w36Zooz$+|h4Sjj1|rM1&bNlHH>b^)dn3TLldxd@<9P~Pb~7uu zpK1rwgCVBLL13ZgW=U>7h7l>Ck@P+3{kl#VQ1pOaxZAa<=lV5BvS^xqX$g(BsOiTk zl$RC1Z9&`l(=bPC(;{ypla@8Xsd8E~P1a4ZsedV+WCw9CeACBwi| z8;G?UeD0_gM5isV&#c&>Rds&Ue!lcQ#W{l~cvdpueyQZ-VY)W#4>3W)wtXLT0Lpwz z#i_kLGxc}^96t!EShdimIZ(}ttJJ$7K=R*(?)R(B`KdUW)R(5mlTfaz&cLLWFjUy2 zFkY$q=t0*O+siTYyfD#T9vxnwB-HmQkiLLYveG=FwUiC(A{S*jAr4%5E>H$$D4Qqr zAeUzETpKuw!yOv*2g}HyX|09fgDsF(O2VQdL#(D=CY03$M9(Be zTTRL?A?{0G0yrxF%2ZQZ)QFRZ5Q&1@P}N@1>3FG};CZW`vq%NNDMkTjF_6V7;oB;W znAiKJchEw*bS+O}&*N);FE8wsnf(Knwx){>;;?rW1M3U%mF?j4cNd_^TJB#Y!K zq|5$oxv}gYV|M7)<;C2>{z22*f>EtL5w39XpN))NpB26?uR#Afj-moakOwJSc^;^d z!5V#b6kOYO=JYu7@IXjKc|(wv4Vs$=){XNJSmV~v%kcrKnJ z$dYFqO$K_XUSrh6>|R+RQW1u6;*akk3Ixra-F<-e7)6`bEnyH$TnGM^a+UT!9OW+V ze+nk}GaG7r!CbtqOTRe)?x_;YeBdVz9f?&gag)Z()m}MtJy1mt(m$0me8O z#7d`zU+B(K)ZaBxbF$vLnjHeiVf3nrfzpkyS%MJZXrn+s!*l%Xqy{k-9F-#txI zrMvSe>-I@|@#8=E6pj4Ug?#eY_1R4UQlh)E!g~ziqb|*=s49!`UIwlNe!{DQ&l+P( zi&{U7bn*cX*$>105N=YR*RFdf|HqOQCrB%JRg0RmtLEnIA!{f$@v;L5dBB4(?C!Cg z*>(L;4cxAfLxH{tXW}(pX*_P2tSN{oQ82O?>7wO)RW^s98@x3rjBG|-_!Bm~t{cty z-)fz29_RU^*1Y4{zSorHZ=N1M&vagZ>>|4GaRs2{Q1)`?GcgPx#pLTow2bcsUWV1a zgi#lSs-Ui^Iit+Hz&fwvY2o*ikHjT6qc5n-ttcd?X8ujSuhW%9EDmK|e8c{CKzQprizA1b(;E8B_r+$!{i z_o15$GtJEp2}bnRJ;XA&&8Pd@93RLGE(F}G)pZxF1bA7@dC@rZszN6{)qlNk%6`wZ zyyUQ5&5?};v{1f`3R2NzDcX5_Qx|l$jXnS(%y)|)`frc7t^Dr0TuoW^TYb6g&(Q7f z1jyFY5nVgvP+_BrlM`lE5+`TwlE>W^Mlu=U8N5Gioi$10cJVg8Hq=yHwyQrjOujz~ zLk7EE=iLNj7Rm*$pZ6Y}6on1NUpKm=C%>WyRnc9#~oBdr0_qNxAWPiTqsE* zX~c488Ol>VJZH|-N-Ag+A;j4P#Sg0)?fZo_Og2FDxFBf_EP>qp=N0uT58J>vy&LKa@kuT#yDQv zr{1c#m_PJc=ohll*pB+85h9=Vpu4l2r+le-TcX|)$r-Lt+`EYocZ&5qywk|iP@C&CJ?&x(bzLC;&5`8aYL zt<<$}f(1maB5ilBDeTPINi27A+Ubt$`vX}<*|Qesr!Lj&VZIc8^hM;^lhv@JvrpaD z^+dI1F%YZV_DgAcoH_1RfJSMbA~~1Bh>gy8L6k=cHW@9y%OxN<$sbins+v+(6UvM_ z<#N$X3hJdTB^(~!*m-)QwKVZ_F*?XSzsv#b-#qMWG0X@5?OO!R2b?c5|L$Jxk8%N8 zh<*sBH#7Wsx+W?*^raxTU9kuO+7W^bw31;}B3I|U#{|Twj3gBe1l{mgJw4p~8cgh6 z!p)YuJ>xCSv2DhvJMYmrj>nPdF>9i`a=JQp-B=8DEJ*ILeqaWMV)xlCRUz-w)MU0i@YYGg4Z{gf~E(9EN1{#*k zzrWo^H#j)|Z4E8k8~fVDLlaow0G@tMldieDG`871Clg+2g>)e9D(Ppzyg8Cor2}?a zdWLeq<5tqzF?n>GFfhk(lYko1mwlLJtxG!IH2dW716CdTttFy~?d@&CaiXcu&Fs-0 zTnWsHGyxNKOJ#o~5ICc6LQI8>hP4i4CN0=$+=Pre7ve^eQ6~##lkkfpOWZH!#CZ!a z;H%gLkFHfJ+o^IUbIt@y8Glwj82g^~*&k@`mY#KKr>zsndwRoDgDQy-sjXPBf$TJx znkl1FP~xMjb;n{g^LO;B(`s%dL7y4_>*EwX@Tbw0JQ5?q^=d?@wI(DFU`o30;w z0cAOm^^1;6PkTX6v+Zz>-!z8!zON12Lo8?{!b;w+Dd#alFE@w0gEYw&o3^@sL`Rcy zyYFw8fSco*iY~B0c16&}{Q!5@l50!Mgal@%p>t z?TMLISd3A>;KOsbnNpMRb3&a_hwnDx`s^n7e*WXHw5A`pBYnOZ@CFv< z|D#k$hH5v$o4x!xIv?a@L>5?VvVZ+NFjNH;4s_hAS!CUOv$*H3GI+0*x;=~zV?kT& zyngI@iX`auy1H{(*Z0q}+z&5{+ytCi<^0c9kW3VOD^2inSU*T}8rpT;_rZ$1P3gKj zX<*^@3e;eHW5_?{;5#K{7|X#a5q=-2dP^y`g;?r=qq93M^By`w^8znv6gGeUx2q%* zRh*xG1p(Y(T2sJ)$3>&}zUh4y&={bkI&kIWISu5sZ~+OKxv`RZIh4X70e?K(^l@bB z#RuBSK8=4~@Tz3-hf5|J?$dVdeu3N+l3sX)Dg#A|`>HccvsY1^4@+MXxgRtI z+G`{WHFE?`LPSXN;=crm7?1pK6B?z0y8})Kmczq>h__Xb>!m*8yZFV^nW=E#y%Zv6 za8M89?DE;rz~|tg<*$Y88K3~@@h_8dTlbI7i9{7#*`N9b1{Dni0{wW?WIytTm<%|x zp-Fe!#U~&8VNjyhZMs)m66Dl!l?NR&2;erMl5jUPc)XU-0Ect|dd14!;TI&M@%gz< z5yT$^Bo}uqJ4*Y4gc@@`0|=-<^!kTIZMZpkvV2h;{#HvZ0o;34ktI!r|Q}bH@UTgD4EwSi4mTS!fJY(X^a>{ z*tcj5OI@N1ZEI{>U0m0pFq$TUw1rM_iupDy5j`^}7KwF}Sf{$EZiS#m1Rm zv);cC+fVD`UtM;6GyG$-QF(UykG-ArpB))&y9O)gpNtFlWGcgo(C7x-wY868*uI}b zdmc4oqV6hd3XtzBG!Bh+&#H`JU%V_1oCm7;iJO(aSc3L%oH=1NMd@(Q6|yRbqn7$7 z1-+6R+J2Kt)$I4)&Kqz$)w_7%UOfetil}a`X}G=Rh1GoLS?ijZr7;a^TzIIQn4q(V zi|gkxn%6g)E#I+6-iBR#D4FaC>^qC8+R1<#`D7cuvNE?8B61AfCjPXIOn*OsIL{x+ zbB2cF-=)j8#eBQ>6{a0R0*ues4DBt>arR}JNn!qO;Cm0_&cDM-YLl^aa%`(35R3Zo zjnA%1<-_#ea8~25Ekq=Z`J+?NBh=f!H0STP*(y`7$npGU_%hRrWNL2XhBdt`EVMSi zhpH25d4;*EnzO!x_{RYjJoj{klMn#0Jmn#o)b1(!RU@^t!H5%dYJ(_oc0|VLBHi@+ zT=i4~GyjX8m^dZIhsp@&r(zr^nv@h4g*16sA)X5RaA&VUTwG~%c&sN0cc%dV#Gh#^ z`SOm4L$OS&b_vh|IH8wDCTR;aQm|-R)K-UXx%pt~}&26Lx z-`Tj^>T87RMNt2kg8J@z5VHjVyH4e}$`@0f*tE7~DdA zx>>#71hJ^3OVoeaICpcBkQn{!4DgbQ+54$`U;^J%Y5BR{#4sdd5uFJ=a`gP`}H%;uYOWCL=Lt)R5Onv2;;}K4sJ&@}s zozkPVfb+eouqC9*twI6G(?rUEkJ&PLJyY?i#l(Rivk|f^I5QU(TN8A4Y+y1a<9_@+ zN1M_)9dcn%gdpvwlEQ4jnV#7FsdDgZeEZK+$?ZcyDYie&ovk1W7RA)D(&S`KphSIh z->q+eB}{%xLqI%zDv1brsHFgxhnpLRG`;QyCV_;X!gz&if=y6ww!ucW-V!{t;y7mb zz}2%Ktt?7&o3md4N(v!Q@v5KQ=eyGDR(d0e9D6SxdeR?lYczyChShJ4IX4@lLB>7j z*U=~sI-pfhAU(@pg-xq)$CKXo_I%MJ7~Z7k|7D&oy*=3xmloil0i0OnpBw z!$(t!lqrR3Doi&V`r2t4Tj=#h%dja#)g@lHrj`W4F8Y6Bswvs?DCkl}=pAJJ_GkE~ zW~cP{>-|#uAu(&nZB-yh8NRA3G;i-`8=~{hx#Ho=QDDlatbNxVUqnPWqjQG)nY+H>osaXCs^s}S9sdQ&_Ucq-wd)f9sdV8f$M1!- zMfJs+3j#-XN_vMBAo=aRYV{Tnf)8FHg4Cs^vAiGLV2+&&o7lgPYz=Guj(Cqaf7i7; zTr;>`?GMrap%SoywRjQ(%l@upsXh<*VN34X~fLEVCB|){-jk3Fk(FnUWdbHGF$=$L7w$&h+#-Ef9DS z_U1_6L(%Q*o6S`^{>Qb(q7p;+!JTh z!C$)gA2*uu6!X6zg83C+x3j`W*N?%KSnKEmg6Qj=6PN86jz$s1GR@fI=W4HXTuS}B z&b;;$tIexxb-sSPS$>zozi$sh1)OnT6v&^CZfm$8289>n#4p5cUVd1IUhbFdWK#i8 zz&90-OEcXK8QD#7NB_A=#z-cda3LxTIUPov;2v{!oheZ`V)rT0M^T=??8g7zmBJ}i zaWG|3K88NVN!$0ra`#03cLrI5s{{s4Br+8o-_hS-6h2zs|6Lp4N-2%>|2rr;5`^+U z(^|b4c*V#PiT-EFkr39%X8)RCx^#oCO$CP8Fq@X$9VQ9USwIe%I{eOw=Cv>&%qXsDq7tm==OYa-Eq9g+X8 zoc~Wp2zrFq|1w?;inv^k6_E^WI8?4i*_khkFKgoyICh#)q%yQ`dsEaEWwT-r3ki_?%y5~1l;{}Z#eXxC#g-`hsO#aMa>(6C)D;)IQ?XvyhI=7@_GRanzx`(= zY}4>Qd&nEuv&~sOj0!d8D=CO!H#jy^Z2O4SOZ&Ivem*sC(h75hv19$b;rqN=*IPkY4i1(+vK8>PH>GiW9^3DEdcV$xSDZKX9<9e!Nk++FmsR{6uPl+DS|*j z5)IdO zJWpfXGvJ{QK*BRM#K9Y?$ttAC2A=VX9M+qwrg~yTyI~_ImN)EZe4G0@=cmpWLCM@W zd+6h+#hNA1LdQTH+H0ftEsGv^N0mOnU7L2(wV)QPOu0S_>TI<|C{RLd);YEzz-k)* zx8j_)f`1OR?ujsNfuDDwOr6D&^mV{m;1IDeAyo3Olp|mUlS#OR_5jhijV9Jrx~?VP zls3^bghM(>Onvx^6P*&{7)&C3JvvY5(flTlBE%I!%JndoW+ zTWkO+br(!;_aIS)?~Gh9-*ueW>YD2eQE0e|Y*Jta!h z&l&3(Li8Z5#+~y$lw55dXp^6@J&{p2e`dYiNQYLA`jRvCMZU9fNG}dKIiUlMUbewf zJCF-ErB3%EJDI%LuLI<9@RrRj6><; z8dcx+{B3C#;Bvl&Tqe;>q;Q~*fvE{FKj$@tKAgrYek^*rOt_t=2${rk#-)neS|ySz z*{ZB6^L;rIzLN>^()A@oss7s~f6Llay?^52y0+SV>{z(+i78yb&to>*FB)0pH45V5 zs9u@7-!sGH28d&~2bfu^x8*n# z#m$-Eth*P5b}4cQFOF&_!-C-k-SC2@(#&VaHN@jX6y|lxm5<~rSQrA=h6~a$2|qw$ zb-rJRJik!()esY}yW;@PQR?Z^!SeLDzOHw=Z2VzId% zF#TL7LfHVfYf`1*)VMkp5&R{YgUAiP&_0(>x2E1558Y)6D!T8mX0;t6vBq*xJ+Ij{ zS$XIxY1yPVR&***V=wT{wC+64e%Qen5lb;8xo1lo%B4wWVh41liJZdZE*&2jnMtPJ z+AE44$^5;!-7$1z8x*i6Mf7r|$16$URCloxvf1tmK1(8G>A0JzGOEb7#OogM`r&Ci zk>hhS55jd?^WK)%0MTOW8_N_o9}HMQE=E9g`f|sttjmGtPJk=l?@nDAA! zJdwbm;w^L&qdblRtu?CwawaUq-&ae5YnB*ZY4mzJtCUmH>V3a68Td9S+|KS8k=)Ct zIXhqX{=Bo#u;?W8GE-JXfva#i>wy&H|C<))2k6FVeg+LOJ(~{frf~P{GY(>kqO+kr z1I~M}K3mRnx3-+FXtQUEA%A@yIdIJL)+D}N71s)-inkx*9hEK+j3z4d_-RcE#_ z%e3=&t$Hk37>6wyx2WN^ZSdBbS%)yLA%)sMcuNMR7X7j9>X$sW zV$m_|vaCSVoPpSkjyUJ3Q`7-7QT&8Tuc6ztu*5!3DGrmEI11$@1K&99v|&;je@kX1 zdsg~p0Uz3|m}XAKxEbQ;ma_*DO553pBO;rR2 za7hABm05%LHz!W9x@%7jm^1;x+L6UMLtc5=li#JTpJ?wJu*LEPcI1mm68iZB9y z-CB3Z6@Ki>SVR`Huy$f4Wrab%LX;_8+;6Ixa-u_mgOs5K z%ow?EX2O+Ov7(1CN8B%}U;EF^Id}b;iBVvJr+K`KHF!qe{0xjO+1qu{* zD8=2qxO?&9?hxGFrNQ0Z2^!qp-QC@x^yS=h=FPir?w`rzmq|X|d+oK?qDr(daD1mh zAgWsTF-e*fREkZiAUEI{KTCtCzki=>gkLoJwmM8VJlqs;0m2@e$>w_ zW1mUI;);L~-uhFhHP0vW{h-*cNH%mk65Md$?e(^2jqBYsy~}XUZ&7WnpV}KHr~IEZ zQG`k2c4Kv88q34FCWbocw35H`zw|7PekONv!_|f!F4@yDdUI?zw4QtLGVwc zbmKsd9qAu}icWMSAZu2uxo)e#@wlNs1c}@r@zYRfUvb@~vZGM7?-cQ08}8@UT1C2z z{Vx65w@>7nZd1a*%zowC_Q$(Z@tS+WK389^er=`Sy}SKld(dWqB

    jeF9H(8H-Jmh zgFi_BY;~dg1DO8_6N?fOpACpAEE=>zXTL;K_f9X_;6zjN5mjqdwkSACLy?2aK;Cac z`_X;K5K(42{G;~wyJdJ|&YL%vy{s|I9Xk%TMot&!1u}b2!~Q$_OVF6jex<av^5W)lyG%^ z<7uW5(nP6aWz^ep;E*XuQaA=8W2PsxDVau*$eSVOB@a}{E3p2Yi!_5!a9sAzd5ki!z*YZI?$ui^fu*oQwsvJJVr~-~%RL#mlW3m&XSFowM zsVFGqXts@z4;cdiP0voHGF6D)2k}P_@ArsXfBhQE#^o=F{oWADwL>|ZsRj#SQyH$D z8v9f9xW6szFO(>ixSs^QuDNZs_li`tG1O{ z=8v)_!xkh~e7W{ZWu|N#E_cxi3v4@VP&KTg=T;Z^LaqQntz7tSMQuHti$QoXKdqSD zD0H~}pB*dCxaQjM@T_UdklYy##OqpJ!iF2ORd;0tiPI^r)_NoD9RY@BPi>yV;8r;= zG*h`0UinGn2TWMo<&mlTg=Z2;{Sl7oWu;h35X6s|yro%YX)0#j>0pZ;!5>ns9v&w2 zA<@?u*>_}j10A@oX3B2~MIyZM=-Os>e+=nq`P;2^Ow&y^KCil%*`^+wlGh?yHU4vl zRt`RtSe!5|$dp?a zWfB*iGI)i_<}_4XM6P|JSAEf?sh;x?C8Rh z-xHi#!w{B*Yy_NQh`FERY|?E}->e^sCHRuLlUbC`o{Yb0+wee`A_~w*pYcV1^rtulT8>RB1ed|k@LPL=D6Cy!t-18!-%;?Q0pQ@`( zp$8apq^~nPPLo!+LK3IF+}|0_sICbi|FgHrxJ&8&uWTs?l5j&lOPWY9MXm+erzr5? zZnt8U()pb7yL3X}B!$uSNJhXQ_r=8np4`2#*MPFLcF7(}A?phfD*uQH#Ch@?abdzj zs^g%x&r+(g{m?1fJ@4pdfc%(d@yFRq8|yXY1b|TPcU`;rZ7?nlVTDSwIM+TpEcA1M zR7?@emK<4pSf62&E?xYUo3~H|5!Z>EKwj?}-|Oum<78yFM0zNz_xkt}rN3kWsQ*?8 z#}_b(F;?hpimm@ylA;m%uU(dG zUw3A3rPCLy4l66-O%JhghGdCiJNbAy!QGBxsIeG&946k*j<%VV@&zg$-;8X3c?0b5 zBagETj`9seMDbR?GVbjXJ#4@`c>GE%=g!RNz|tYC>YNEm&Cu7&xq3?#A>GHBZW^RA z(>NM2X0TFnIyg+$7|syFcrXkVA|d`htYpQ;QBH`=jrr04_({Y+0_g{tP^c=}?+h>J zy0(0Xk>T9bDPHR`_T`9y-QZqKio^*Kg?!~$CU|b17tA3-&}%o6Fx&-|+90lFSK6vG z-0cxgA!iP<1Oi04p)$jt$6Z)9XEpiR60-joKm#C!Bj%^_MOmc~3i2bK(& z)K>on^?eR&k&_))YlW_9pJm093&ucA7-)!t%bDR- zt=pMv4)Ht->l{C7myop!&Vj&EtHbIY^>1PXd1gN|7z?pOwX)r>=WhuU)9krz_b+t3 zkt~gUj7*X*qtp+A>7F%0(&J}!YP1_!98u~S7R^icD(|C%N6i>e?541(rjNdAVaN+Z zFbo0L1oGtX$l{5Ehfb~h^05fWq8~C=PgzsxSxS+S@4T8e`Y2>{Ialpfb4AD!tGDCj z`2UPYpVQ~h^(tGp|9Pp`2+uM$uDU*vS%fDDb>{_~z1=g+KvlLq%vgo>OO^^{i~M;r zGh1}N_L>n;ARt^dpi_9zxB0rDIzU2W8lXMv)&y~ zOl#)YOw8Tb*vP#;6+~tgAOUr8+R48tgcVHCbKCi3^M{7s>D52i{?vosQk$l`fgM9K zV#dK5c{*a*xMs+yQnH65vZ)?S-55+e9C?9`@8kU${3Aa%J&jrB_0=k|k+3(tVckbn zW0U39z^Mo-cr)kRuq{3a!o}$^m-w5vK6HB0V;erV_blHBOYWOdIQHNYql6ZVG*|mB z-*dO7sqw`zqOQs3cBb$G4#NkRzd83qedw5hl96g*LhYJA6%APFePL{CY2>|oVjN!% zDPRPqOWD5k^2BK#rodYo;B-610I;YybwqJ}^z*u1bKhezNn2vA=?a0lfrK)#*?WH1 za|JA4V<$Uj9o+fiC6UFoJbibiTjzsp=Y|k*)RX@SKbWK^LZwK3RcU%Yr~Lz4Nu&OQ zOpz%5Qv-m7rbPJvy!a2j`VY$b-{{r9P}YA>3s@wm43#`Ce(V*65f#OZG>)dej)|c) z<>!d}o)W-~`aj>l!TeQXHL;U#6{N3+Y{{ele$2>-$!AfM)Fgd;i)mzqkY^7%QkO|3 zlX1^WvexX~KcYt+I2iCBf_o$E2ft+k!^3~J_IYW3#iKu%vmRHFrMI@!ad4CV=XXm_ z;3v$!?=kAzEpw;p%rq_Dmisj!5Zc1AOI^Wr?Nvwh!BZ6la7?HSPkWQV1ZOIE&r^NYKh|9al){=IFB)zwev zssDF;Y-J`oGfuf^nyhxP$Ck7IJe|cYGFo|_OE9`tOLW09UgvBQ(-RV((0~=*-#Y)U z+c8#`H^68 z&vYCHi6roHYHF*wfKSA=Cuug_cytf0fBgoBSv9*?LPZyst^v765*p^ixy#zuhZPzLWt84Rs-)t-1Y*crn%UTzX38m0TlK&|Y#B-X|=Y5$HAAKoO!_4T!Rnb)Y=GKbIC>c+5yR;t#^ z$G&-H%NoIlfoS7#pd=1&M*#8K7`1uipDXF$Ga07gSncK#j%!4Rew{gexmfx|iaBHT zTL(3CB)(;Yl;Dt+wA4>-pO){-E@En!Y}dMp)cLlx!2T}N^Mv260nznY%K!>+)MSyh z8Sx5Ah2a9zUUQ#GAyKtq_&7P+_xJ#pKaTF82bCdF9>*fE7(5{JIeFgv9ysXqaS0hD z#E{JPE$G!bYbBEgh|14VPn`h;a^q*vps{Ykb=QfPv>iSe-BB9rXTuES4JDH>+qbjfW5<%U?u9vG;tD|hyyyn8Wwf~8nrg&Oa(yuhaNPAdGmEuFL z&GNa}Z+z`=gg@Ntn#Pjdl2QaJ`WuJ)Xippp?~@LPyVHRwuj{7n1*$$z6qF!Yu0i&| zY^xzqtT_$a6%E8xTD6V$EV}QD*7bhODp6W!}aw6Cx%`>7RBoFbT~JCdhNS z)Rot4W`T;EoHDq*E}tLsm+72L_V7#{ZC!TOg0br)TR4K6r=;1aM&`{&iqA?)t+I1j ze$vHH*s8}dW`J9Sk`;?;a2OgdJ_h|6%92wdv%qm}xQl?cct0=}eZ)$ZYhPwBLM$}) z+;v%>y-i$Nxu8@aD_kRN3(?&OW8+TmwJ#0goKmU zR_y(pkkqIen_}=0kfx0g6l2_1MRv)=X9DD(2(}TWAFmflx3#-5eQjn=c#sCHp0t*{ z+{k&X^o!=bHtpBN%kLeXkrjcR(oChOV60LmF5<)WunhfepaK!b70?}i>l%BqTP6WV zfcS{PVYW5p(UOhE$}!zZEB?UymR!(D2c>_8V3_%(&Pwm&ufro29t%_Rn4X+UvJh;L zMZrplPodx!rf)R7s?1IoC;K78FxMLd4?QRieHz$LA{=x%#P%k%H_+Q_(E>3ka|aXi*;54ndyBRl|S--i=n^V_Q9wyI;8&U}(b+g%M$`1N;`>4ElOsi2CT{%J(1n3F* zKjQ}-h4X1?C%N=$bJb_oXIeRNJX)tXElE0SQev*CRh4(SX;eRxjAdi3B@~p7mmXe< zw&miFa=@*&=D(^Cru~Xb>RJkZj~09aI?wbWF)q$xvB)BLL{zV*_vqR6Ue>jEvQ_b> z1yd43PA4gO25Yj0#auI27wqpw-eq|H68E`0A)H+X))ilLP%xU9V!1Vfi^2=|T^3J6 z4&3IT_NG{xFM(&W>i4qp^a||v6A>;Ulsbz)#>RL|?#0y(L6YUa!+zj-wmNQR-;^d{ zFQg#;IdIdk`HP`3QB`fJRUo70SSplvyQ0P~Cr57W*++X(VYQ*^X+CPiKIA~<-9Xre zJ4B4Xe7hKLRDO!dPR|8WmPi%O>>YDJS&80viPz$vUUlqn8POh2w;pQmXcq^THBl)h z<4GJrFw#c3bgxP`0I0U*ub;yCxyVjauq9B0gmooKN6eemL81bk8Jpu_8PR7pS{+1h zygNBZI^g|mL~pb${z{`Td}=LTUBk}8;bQuyEAv~Vw!jGq+eTkpf!2YgH><0D?rvPs zNm{Ll#z8@@(GH{F{j8a-Y#sTpRbznJB(zH57ZlfqT}Y^Et?^3nBmWnmq0zAETi8Pp zbKS|^w(<(|{9g__}%aVLMa~Z+Z$MU2SiJeK^si!euoi z-_VyCvAWF8ZZn(y-6pz(Jw{wM(+doWgcy*wC$B5{y4b7as4#t&(=BIPnfp*?WvNg# zAJJ!-n5FAoZ{dH)6J?=YwrUFC;7zkdt-5ta#IDOVN~@cXwO&?&i$$_kl~}wY@@&9a z=BTS;I_f72?(I7gZK#lW>yImWSZVBF7qGE88!l#y?;|r-IiykP7F^O>#R*FtU96t7 zrd=nkp52b^sg5CyQwZD35Ez`K5bd^SQ}ZcNrX$!#9aV6@k=PGT1VgxTsS^h=H^Fb) zq)VE#oo^q?g^R-{67VWl!Y_(Wppc)l@ZiX7!q;9mWc~he4UIgT& z!;%3W#mMi#eX45T7#TE*x99UdbRvq&bK^^eNskC60mq9Sps-52W11oP_gRQY6x(qs zUn_FCj)pBLj37lXjPKT{}`G#7}A@_u_|gTGe-#UUW) zH}dP4X*p-Ydk#5tV9(D=bq%Ix)Ju0Hp{^akx6ROAC7zvogc;&PoXW z!~t12ms70&|Dv*&Aq92%c$%zfsVsa(#f_(@uk6g3$^I4zd+l{lf^I0U2l z1th3kICkvE440&HO@`szgQ!aYp&4BNZfMfsDfD4n(`ZWm#<_UB+R(x3!&fL#wd~yV zrR6qs_~^Xsk%JO$%m;*ag_etG*N_ns!6-F8>)4}CC`~lDw7+)5x_(U1H0TsW_xq=^ zEP((}iTh=s@=ba;|x#|;ja6x$d zGNBn;rXe#&*U8OgSoVhF#j)YWO9MSvD{^VxMTkd}*n! z6uOv`44v@Y=Qxn_G6u;PAtrgcsAS+bA{l7HNv%RF6cn4&5c_4PpQ8`9Nti!_S8YxUQ!9*it4K#Xq578KM43vAWbJctt9wm(EbHTwtH}c9LMSrTfMm zrFFemVMX)z?OZq)$CW9`RuJJ?n;UpGXO=h`U21qj1e^*j976-`z&;>6ZxUuE?CYb8 z+!k&_E33(c3zpXHeJ8n;d&vYm3N8ri4%;)@aXIppL)d|?h(6m;rOU>kD+ zZ@aUXmP6aT0Zp%$I|GHuAvOox^_a}MLbEW9Es8#H6bBRXB7Fd z*j)Wi9rj*eoLNY%5$mj*Dyv~wPl2nRdu5qf7GuH~s%xw)JvstUx}sQgx%D0XK`{9v zL!k2yBfV^W1`R((t*v=v2y&`EtW;j9j$eZP$A60+L5$iE-EO{-B-y0HZK<7YZJG~M z2NF9vImyh*uIhBI1-NH}c{O55!n~)!(-TSECiOq3*6l&9R&L%#M(!?wpthi6>z{@e z`AWpzt)~Npqw|&gsz8JxDH<$P*xqhM8eC+!(a~<+Jk*!&7<EH>Ar5ZP{!A_H`JmP@+Kn4F z2Wu}&M=y^=`uY^Mg6HdC!g%2cy|gTy{PIfi{fC*mp^v|8&xJ~p&f+<_9rFb-Zd3bG zR?<4ye=?nYnf+!=t4(E^c+A%kS6>UNta0;#5=8%kUcGt>hXip&xw~wo=gyhmaclwm zbgrH{Y0$xTbTuV0w8ewKvJ_j_LDwj0OBX13{RoMPw^#zWaS1$}^0-9lc~@-e{B}-G zGNz93B2bkn%&g*FvGO*|6t1xe0mo#wf4;UssKxUPc zwGUPQgQk|eYQHIZ^ZIszB*i~i$WZUe0vT_nyU0{6njR0(N%J zZR^yAx8hF#F$Z4~phpJdmM3jOqI~gBx+J(LCnx2WwhX{&-fcA8BH^}R7saCPz~=7k ze(UOCCRNJ?|3lW^W~%YxpWzltBip8FV{F9Wf5+oHcj_5w$vDbDETV~wEY+1jv9r}p ztuc#5<1z|-FE7snzu4nD-e0PtX!xrMWao^)WEMz;&+T7C=|8aH87zhR7KHvE#$+c& zvn7~gjn^PuFKon8;$NTApiJrsuwqXRcA^)BEM#%Vy6dpnZF`Rq{Q$SmOLI^t6i!FJbbU1b45n1md(`Cry=8oiUnq7xa=1oMjA58Q()s_Mq}A8ap~eUgGHK=4`@s6y z%8j?T*NrTESIVEroSWOp^EX$BP=hLpou&e?Y>PA8bfA07L|Ym_M>uzGYd0aQfErb8 z!MC3(J`45d<_y-=Qv3Yd;zVkWt%YfwotN&mte;w2zz>QTKtAsTXvbU~a@DKA2|AvK z7<5tZ)EZ9LC{yj#mgpRGC{;f+pGASst+D?B^xVz0xT%M5LV3}5eR80Jj|kxB!6hH? zy))(~LR_r{%j$i<%0=x`eOUjI} zRr7>5Jakv%ruMKMmg$I)W_2J|S4~V2JrlQGxuy@+Ft)uqrPi#%%W|uGy-t-qEHD{~_fKmHLiT=N9$HnCze-eH3ls&N6%Q*oBt{Uq-wU z%kAl^vhGBUA)VP5_O$?V^dU&gU%*rl7C0>(xCS&;K*3Sk9E&5Fx`wVro*ktYBc^m_33E!y@79tgec#wY$NCNidYsRy_t6hXZXiChi!2(pF{!$;4a^1~`Zmi^nw{SqOOE z7^>0R8u^;$)H|dU)O-zX<7q1f0RZ24kxTo_j_fRsv)4C@FXGXHP+>5q7v?*gS*JJe zWKlvaZ>3=kb)TSCbZD_}B|f#?a-ker!HyHcrEG-Q$uhZ`70HPDgX}UVc4sy z*IIgCXRp&;Y6yD!e5J*GiOKz9xVc}{^5p4Ts9bj&W>XU0MO|JFdnC|Rc=@sps@Zhe z$rDC1fAbT7`?=)(0kRo~-D4w^pvS{!E(!Xm&lm6|QDbWnep6xJK-WSs5Iw9$(XKFj z`e$7|n@gj5oxM9yCdx~}5)hq!xYNe8KcbEq&!IKh5g|pp{Rck&Uo6M}>UN2w+{BWP zP_cvg6*-FS+eFO}qA36S<+5jI+w9--eNPSnrajL3!*NviQ;3K6D*iiAnn{T*g=f3w zrV%lPP`-HaJMHQvn)I_P{^eu?0@WcA8XDh;f9k`+H;*m%7D4R|9w9%S+~31{KE7Lf zmY?7QrGe7#NoH3zjDZMxXm;^G>@o+MYPR`d-5zP5l!AMIX}$_U;7vR81}&y=Ewa?8 z0YkKwNWV=tWL2(kv7G`BIJF7UELM_d0}p<1xBW~w`k0Avt!8(HAli==m2Yxz|306c z0CV!&jqG#jTuYNKTdHiqY|b21vTQNNuqS^zFmizGnyaLv_wp@H1qb2pNN8u}q#GZ6 z-v_rC>YZV+mKaG2!)v!a-9fk5{pmJJiO({8B-;k$VIV{JF#hL-Yw_LiBhN-^yBj)7L@kmMn7kYWlD=<=9tnk7So!x zlMjb)l5-1fwIi(F=3`kf0cVgv@Dfx@Je(gN`j~RYnbB1W3DGBs3fmL5W72oAq{y-r z)NbezY0sorginOhN+tqL1%XJ$0Q~71HO+^sH*qS{Bxj*lRVVHPg0CnhB z34A?=nbRw`oY!5F<78i~9lg-#f#?rP79@ z55`W*L+^A&txj{e@+K_B$=G4F6?(&oNF?5`demur>}_5|qjesJ977SRWZTQy>6s>} zhRiq?zg(qu?zmO8(|M&OxH3o8cFHpTB+8Uv@G^ZzIro@j93liE|E1`q-Ha3~{yq=NyghSIP`aE2# zs~ggq7+2p)K&WF^_6iz{PaHNeOFjo8<5x5tg}Lso$+co7p2s5mSz&f%mBdyCT*$=Bx7*C;dCSqIe+G7S!sXvHC28Sl zzletuHsUZoPO2=w4!v0RZIK{Ox70A+^kd{I!ct(rWl<2*4eduf(GSN%{Ho04>nRCJ z>BKOV22b2BHyjWMmF+~k0?>mC<~4Ev(3%~JNL;|4Gfjl=m=Wr zyq<&hN34us5rY!)Pb9sh540B^HdcSHgv=hdI@V}bw2zL(wg<&mR?$_g@S9`OlI=*S z7HIfgG$z=#UB5c9KGicA{8@2GL)d$Bq763YrAUhKsua!REG78Y(5DA zk*<-{WS2Gsv_Zu!VInxfP;6e<`+Wi_RAGz$aLSv0lInl}`iOXHuKPZo)Q;jrBLoL` zcP$4Vzn2Vjh)(ddV2cgFxgE8h<{zim6$~Ad9OkR_s(PbQL38s8%Fk_)TuiVDs{Mrc zXM@q(Z7XTw$xX$=F9)b}rk{#BK6h4rq)wQQv-(w&Uz889&uN0;{l^uMPTN~4xd?TQf8EkXdG z^#hG7>Eni`!r)X9eG2kw0Y6H#TLMq={~Jd&x%JA$W)Q$u1nEw9k>_|^F*pj z?JAr!JZLc*=pq_Ps{lLaY8&cb+r-Yvx-!4O*Ipy>^T_SF5s9B`r|;4Rw-r>Rc<V&Fjf@1XMX%OqT6q`=IjuMrys5PnNKK|e=h4z?@mfw)$y zgj9TfhB4e?#Mf*}RKOj&TYIzs1vIOlO{;5_g|S@afsqz|wQk!ozfAqh$jsqm%RcnL z$<3OOof&zAn~-)z=gZB#`q*CI5|d8=6~-hoSzJ0xr@kO^6=m9V(T0SxfjX!t-sWS{ zg2kdTZyZ>(uRCM_D(f3I+co;V+$dkL$dHb1%DDuf;Z8nGw!?FRU9w2F%J0$__Hhy@9v5j5az0Z0}%A7pB=k9+^FX!b;U%k9V0IPqou&l`k8@c)CIfb;FK4Wy? z_@52jp;Qrk%+TXCazdP*_W!DzbRw&B^74W@cnol|;KfIn`>L~BD8o*}R+in&z|ndR ze?2Ct&uMD#k+ZdCkX75IAQcK0dR>r-rEQQUDIW$RBVRhYdlZ8@cZDTqiVDw<@xlYY zygbh@wp|V;X=Nu1k%anFI^@*byquXC-RQysbP&?g%U}7U_sz=8C$fnB7*zC$AIyKx z$*6yk`T00HYG29N%~4dmV~1{L5Oo2btj8Uoz*1hPOH zSer%VGtF%an({H(2R8!x`zY{Z$|stFh|9BrOhKE; z`0WsZP`+;}NTw1VJiPHwK<`FE+&s$3&pbRrqn2vc_B;(3$sdiq63je6M@zGmLqdF&&ati4M_&Vwzt$xOzz!jvfx@%BrRSi7k^SNj$3{fes$ zs;@e@IlB4t$MRL!U_G=fHmF|$!%diidcIwz%40DGtE;@NiYYDhpk++NCu@ZCQElha zhT~;tC{N2(?e%0$%`T1;yo<(V43_%k5Cb!d#)3cIQGE$uv~4`lG97m-wXhE<1t! z8}CXiKu|}=_`$S#vIeC`+c=4q-p@l^0z8gXCck6LO5by@`Lv;&18cOr?s=wWkwk93 zt$-3_wlf&)&u=`&Ew{(e>pDP1NWA?TKi7yR!BWkP;<<`g)sm>_6dgiW z@=gbHl1;0p)3pn==6i1)Yo8J>yb{BR%>7O~<`J?3JjuNg%+CAVb!>}&gE+#h%Ph>l zYUh4Ew>7xYCipm!C2!a4U0e-mCb7H^yxqIgY2MtcXd&EUO7?H}OV?Rz^7tda=uKUF z#%CKE3}Tv_moOfx%t83OUfaA$Yqqh{vMyg7{3A`Iac-fJ1n03IwQ2F#qr3wC0r3YJ z4R>6qx}!jxg0KloDxR~JQyZicm)AK4aCVynGaIwv`+K(%t+w-2b7PJv^mH7s4z_gS zdh!x*Q$lluU%Ra5)*19<*?Pa@*)THg2=#J%jjB{F-CDd}fcMiCit8FhCSh&bc(dqw zrB5EbC8|OhY#aVM`053>;c40Rl-yC-&Su5gT}dn$ICkN{1-pz9O51^CYJA|YF#=$ZJT${4%` z{@KJYJs5}4=v-$QPp1&O%^`4u^f11lkMj;Kwe=uO>W-VrZ~%DxPq(*od$-*bL)y>3 zTWnBxZc1@<+y_5`pgL0j0O5cu5Mx)QfAgMyxR?-{wr36eKaA{;*8BhS#=lge z{}?3y7nLY3Hhd3j=k#c_^Xb{{M4Q)&k?#>r(A_8Il;)j*%J>U=_4}xdQv?|w{=eiG zdFjxO?Nf#K^GW?~Mq=}G1J&nVoeo^q`YBF5UZ>-c{^V@07E2+Vs5)$Bh=9SvOXH}* zpVMlq!KG=EM-AV{%+B|XSO&nv@N-+(?Ihoyp6`r*9&rA?rSrtcY~HL0dcXVrd0E@9 z7knp<1uF^?`RgMJL;lWh0-o(D4@s7D_6U;eY(?f-|2`#}rFqucaO%Ae`aV&{n;?~bTl9Sn zJgnj%Z?k03xTiS_>0U7-emzE#8=n_^IneigMKIf^dO>3B$DD%A;#rbz`{^QsFFRIV~NdSA6l$QT?*nnGznAuC* z>1!sCj2c3=EOJaA12|2cz5Q))FsH!qW$tTb?V4^cma#}gOUsu;&g+i!Y!v*YBC?!?v zhvI|OkYOF0_VxtOhr@Y)%$w;Ao}W6kzUj|x!Pj-1vGJPJ7l8&dv|-N zb=WV3?n`R2bMbLL%aEss@=|gvJU=dQ;){*SL6uI~F?H1AZc&w6aT;QP)xzO`X9zVXT#?RkbDVRchUt`OqBfc5 zb~6^h3a40HDR5U6_?KqC(1vmQYF9O$8Kb6hT!E|>vkeij#%NpK=1)Lk5K0Ar1+5w? z%D$EqxML+XQ#$Xl2tPnrfn#f3AAB4X;u(mj&+CF6-ahzPI{H)8tQ6{CYuI4in%A>B zk@v#(u&gH21b8TnQ2eTCPUUxJ17O$=7i`%mQ69g=E7kDwvGFlUEIg}FzlykWr}jh> z5lZNYvjB<5zVP9p#`~Rq)y7B*>=GTTOv@y>L&v6c&AH&Nj|=FHb#-Oy^yv6`H2Ir< zY5q5i1BUM%#9z`?N~URp_AR2ZvL9Y z?EJgI&ZZ(pLH+^Lbb;G(WCa7B7erY@0IX-J-jAOU_%oM?lGxTT4hm_#h`)wfTk~Io znMp$Vs%{!ylKZu20r1L#>bZ;geI@4WeHC+-AYUF+Mek@@7Ti7GVttF5xEw8qiN7&z zn`qOPM#Fl28Ol$l)S-*(3}w+0fSBTsI2T6q12`Y1EODNcjP}|4v#@BX&M6{%1QH;W-pG# zQ8^w6O@-}Y?C9eJI`B|gyn4IZ+nbA#B-d)4W;){IDh$;Itgrbsg0I_mOTf8-*3@?+D1IK!IQ;$xKF zsZQjV81IPnG%I>&yB46jWNT6A%b+Aa*nAEc;{Rhrn%q*|W=n3nbwMmA

  • 1o zEO-=`T}zlO>xMLQ)fEPl$`ePFUx9Tj8v+_4v#`&coN+Oxfc`M2KdN1w`ImO2F27n$7Ad2L8rs9t!mTOM|U z%IX_k)XqL#<5*dF{Dzv+M3i-T zFlX`a8#TGyeFQ(JMC;CSw2S?0zFKj=yW=pic^lbpr8L2EbBQESldPiqpd~`NQ}To; z>{A#jF&!MMQc6paZY)nUnCQawHRRl)&k;@b+M3RxFqD=0hD@SR#tY3=S$Y9jsh9e@ zJ!r3UYG6klj~@wEiMT&W%J}5;o1lg1u&AQlKVc7V;vMZvT6*i16+#r)$Jui-M3TzH zr6I@RRCQ)$z`t*A-hrpQ+~IX#YEY zzGD7#K8(Lxpw2AH4n%iHsvU}bP%NR8U(UC0YouGeln}-fw8*f?YO_C*=ZveDO>j(E zRY@PMTYYJgO2DfkYO{1~L+fJVvT2GF<+9kcwaAGruE(d{=~fecd~T9zRG8m2L(=-0 zwULR_pQ?gr2v?VoCY&62KZ>8OBoh*`hm|-7r$g>xZ3M9M_SQGSAWKhAPC3}kYwBz> ziy+S&d|b$(#>NSo1bdWbPh?Xg??|%g=pSB@bvhGhcm#fk{F=7DL3m<&nzj_HUiMrAT-8yD{JDfDJ`Yx0rLHfdMnL%Zy-lU} z=%Cvqah1#eTsXG+^32+f)x;8|v$Dv+-qxz2?YdN>+#RTn+Eu*vey=bYGfg0H-~CVZFZ=9@fVO5G!U{VuNU`(#xXjn}O!c$zk|4WF!Th z`*_3au@+8OZzEua#9} zm4mCZR@L)wMg%99o0ff@sj$HHv{rp!3zh6qqPFso^W*SBs)N{d7ZARczun2bkdKBc@AA(voj)4!CwU7ebfVSvE5?UJ>^FMfzC;#cjDJ9$&n47&z1EeLo%9bGdl%FFkdnzmT>aNw9y~V)>9q^b!7-d!W!(U?bXI_e#37 zJRihxgpVP;+q{7b{5gmCI`O;-+ptOFvO;LId|HeJ+vVJjp}J13TMY5Z*A95b3(PPt zSfjc@5I);S@8rj9Su3EH9h+Hhc=JctvkY>rcSM&s@ zx|c2^-SEADES&)xS$G5}M_AI}c|!QZ5{w(|psOlJqW`Im@k`3{0Ub}d!vnwDy1JsGqL!$hY`hD&n@Qx)LTW^s zWZNwgj?OQRgm~b3X}RD(Jaf;*K6hvLCbhh&<8X8Vt()&}+4^NG?4hz4Cr2dkf!Vvq zYd)b~o-V&kGnly8IvDGM$bKan`+5~rqX|wbwO$8U5`%f-;*$^`SjocAkTq5Q>Gz?Y&p*COI7z>nPA#)r0D ze>kDD4XXK(yhJy$FQua(2xZ-5K|{Y-o%0GG5*kiXG(ik!(_I(ohVpyAR_|;GUIQO7 z#bULb6_bP$;c(bcf$f+h%*@_kFX*~-`3p$7MP`L>OJ>P=&VH&ADn)WFE$#vq;R2>UgBImK;0Ta29F6pYb zfDvlCB4iF%)Zq*tZf~e*uRk;6L^ota(;=pKd7)p4Eg)ukt)-9xjm#OZw5L>W*h%8qnLra+M#cTm_*kgo2gRJ=uD)Vkcvi#cHZ zUaRkIM$?8>4`rp$iM7*rD1I4l--KOlPvRI8`eh6?9?O7YBbShu^KSRn1^3}`0!=A1ZrNBQ>5z- z;5yUruDZ6iITNSx)Dch znZ>KU9r)m?x)#xCO&a97h8+>=&Rkx3v1gqRaLTm6ccBkSod0zHAW(9PCw^7s5%Apt zA;I?Qwb|O@PEReff*aUYHlaf7KGOz8HeV!deBRL%#0@kK9MJ2_Gx9#q*BF!XhQ-^axZ0_3*E`l(=$#m)D?&;(42LW=dGg7`MI{`D{sR6 z>E0R^uQ{{l;UKrjMGISge-Dwk zMmoRed>u3mPYFTd|d?u8v8ZO?h+^o3NT1&HRb8o~KWR0le27sgcOdx(10JK=l z7p=*K2Ks9_Rv7cUslJ<$nG-6t!z;L6rD~P7pv!Y=SvmBVs`axK92pMkT3s+X(&*@S zD^F!^!c~X*##kP1Mvaure-X$mWa8y{SK$2v**QGi~o4# z`-AIR&&`L{LSL^%{07v<#k=w9T7cPS$+5Yak(-$`#Y&UQv4DfcGq$SQR#!{?p5pV1 zi|InchX(;|ifuc)^HS@5R&O)YfKegZ#6V2gQG7@X+F@VgK^Iy;Ch~)p7kccLPRk# z0pcTs{o8e(KBpDNiw5603!SVsGO%a_wFW`}aK!GyCuZcip znGd~m@U+^RJDkV1u zfBg91FLV8Dy51aT0=9D&MX0M8Z4^Pt;J5U3#bEJniZBuoZ=mofFX z;(q=rD*lHz-@gBSq4n2*D9y%ilXUiBeBwg=ZxfJlv!o)oCnBiDt{=A#a%WWC1ngd% z$JFsciqcO0*pSVzD+o@3K?fcbb^wIk{L-MlW{)XlLQib}}!SM0Jn$y<# z=IZv^m#skLjzP11O@sf3uXhTLb>YHpcf4ZTwr$(C(Xs8Utk||~TPwD0+jerY_xGQR zQ}x%W>f3%Vx~r=v#vD(52T~dKj=NLE77^;9Fpit)W)>nZ!{2vUF9j-p3)6%P({-M| zN+JD^X0NW-V#8f+&VFzkdft7kip;p9$H|7Z7xPD%e~vJJ~aXi%URx*r@R{vJqD zt~(aOE~$6(UVOG~3_b)dMh+qhA`p=zUefL`55XBfR=QZp9s~GiqzMG?{{Lg_`W>Gz zeM}rz`V0sB#gwP;>w(7q_21)0_@Vb)28s{aMEs58rJto&LvYUPJ21l-?ruIs zaDk!a=>aycfyMd!iP!Sm0y3w+54UXP2FZLq`%~U>%@C(VA4`vxD9f&a-oqs+GsYCw z@G;yLh{$LzR`-0buz)*8Jfwr@%gmkBJIE$ZpKVJtTV0#5jAc;_9exWC^x%)qn!C7$ z^qc>DCwd|CKDTp4*FM)?larI4fr9GEnO+rRp-Jj4Rp4C%4nfGd$~Fw8_~soC2c`=T zdn$`j&9K!{f?4gW(WEj_tW7TT4TH??6U8gl0NRf;a=@q*I>4gQ*qv6b`XT(cY~T4Z z!x4(PrRk?!gV1rLcqVjUs2Gfck@t-jvzqN}Ldlzz=P)@LxD_I3z-TAK@9yaA%rqSD z+X)XE<+=3@PG5rM`<8VD;e-ZbSy~AOJiy=t48Y-L;v8MSBg_Cph;CE`*>b@oZqEx5 z_vKZPrrp9M!J}4TTWV&d>Qj9>%O>?P(9oExooz9xhCmvV&?3Ls*xlN!J`c05ifMkC zoU2YbLAe!L*1aw=O1%5)A?nNLXlq44T=)85LF4-Vxcn&bY4db9W79YRnYgM;M7Y(l zTPm+DZ!7MxOHyc@IfZNZ2vA|iHeE|YpdC{`yJ>MTU&B7tF!*qo45<0t<@Crp*@c&o#m&OHxwXMI-INJhXh^qYbaW{8N`V%Up?@ma2vb!jI&rvWCiGHTT3n^JX#4~} zr00ICgYBEw($MDMK8#+w$C%n2=kf7RyOUW?pO)WlkUHW%wa>`YkYWA0UB+O(;-6PU znsVqC!hB?X&UY>1Xp=i~gP)o?_ea6-quQ-VNlx~?9shxWP6}f9zh1UKKey#&WP*tm zGy3yXD6VV{6CDYm<#QR1!-pAD8mr37{T#s7qX;U;qGRSG3O+-#xAKnOWF;|PlIUT# zFIHzpF_vxFR9g^T)7CFtWYM*5A(j>-HNv~foKm<30`4Ze#GCC4@VdI1)RtLjo_{76 z4pRC~>yu|k!FaO&EKI*n`ijUR*Mo)4Lr4#MTnmsprqW$mh{{*eN4e;Gbanf=ni?Cq z29?{Zu0dfA(KMsBU`xJ)l@^ohd+aJfWHYU9&UPRH2Lv^xz9qvpi#103JPMtk3|-CP z>|UI^=t5VTA0p=(X)LX)^$auz99q+0!Ev*dK%~#OXN&)7FRkN*tb@Gw*a8vR$YCTXNJ(=0h>>0ol8_wXq9 z`iEaSDaq=_TTEnY1@-q?N2&1z&aX)~K0c|psB>s#UJznoxZJM> zPct-z@tS92fGBaPv$H*L>a=O@M4F8e`|AOyWgN zf=yv$Y-^XJLLUvO08a1~$E?_CgHfBJ{rvFhTnU>JR4=aD4kqS?(bzBx9k3PcnNW=m zrE^0%vfS!t*gbnElmdDWq}X8+(%GW!(wwd)9{&uSjBM>(sm{?q&Tg2@q4)$c6L!qb zV!Kap+?mwDS>=iBqBf-K4!@NJmfFs#`T3Vzy7XaX_bH z%UZQ?Up?z{jCp3c2KJWDW5b%M6WybI4#C;XMXkchU8#v%xKrsFR+Rv57nesWd>j`wsIFdlI29{cudtarGXD-z__@! z!c8^CCMHMK;zMu2uyJka-;d2(;|eYt65+DRm0x1bD|B7&lbEK_zHS*qOBp>H32R4b zdI*BP6shKQamHBJB#~2c+37$l@ZX3KYB4A|2`0EPLA-v{0^4)JXHUFn;+NcCOuMQ ze)F1{Ouh9K9AHJ}Ec+2AF>;P23NWHfTPuc~WkEka zOO$BSg0cc2p z$6XyKc?cxtNrWoem?wnMzf26pny_Yqm(Y?L3zJn*$!8g|fzmQic~-HYR9USiCDq+t zzE;SB8hTr4o=-v2!qA1Mf&;72QO@UCE}FBHnU;dP7vwooXx1Vyj=xFMa8F+rnR|HG z*_6LxzY-}tkY?rM5B*1MV6u3fis7X5=^`5+6UOxAhGbuom#9;)G8nOU#y|EGvu5Vz z6#W{&8gQs_O04_ZoAYFWuxIDEh4s3v z!5kLCUO>bq_ZI*z&HKArtt;>Lu)3-UCCc{Wj@RV+YW$AIYQHu?O?B}^p7ZJQrzI9e z#$iua4Y>`*Kx575#8AVoKYLL%WjSXCcG!DnP47tQ@=Bs38E@*fNG>pEKgn9RaX4){ zh79REd_D7*KfaY6^q(mxpkBj->GZP-rzQFB=RWLmpy_aN685h5#a4KJ+VFO88Wq~>)EyCY{K|4fA&(qS#Y@jJPwvtEDtb6> z&KG2CHzYYxC!De5Vk2NKk3%Wid^`*6awx;qbakwK>L|ZvcdvVKXtnPVGxh!!+G(Zd zWg}uHbA$`!hWa}yOMM}7tk)e1t?ZMP#7z`a4Z9yk6$7T}A1jDo2gbyl1{|zqGD9Xz zm^4c^;sB-~A;OhM$+2GVIY})oQs&lq;?(plQ#WuumFu{EZ$*pfN?eT_tG58v&z)dH z>661TpLy-zUfEBo>HcN#=hf(0*w2A#)3npVUpyqy5qS^HBwMh_33)Ixq}i;=fyKXW zSb&NbIwl(D4}p>=I;LD_P=SgEI)+?l69tR^if+sxQzV0^#**GvHV6^`<H}b zjE^gZD{`_&f%>USh&kc0i;NJv;l4L1QKVn{bgOU3#@%dbc+B%|$h`0|zIeR?FiG9H z2>)LT&HqH%BkNLAv*O2TtS3~5)P6ntH$%+V1Ledis>8DkNz^H~yc!HO(+_wuNS{rGqS>oTj_*|$+i@dYPaJeD-D@WNX%k0J z>cOKlV*$nrD!TK4u}+>rhQl-gE}C__%i335n1OUo6jf-SmRO_iRYf3`J% zRQ)<2OidM^05GS@Gz;KK94QfI#EJr(JY=wBEuT|ejM@cor%hy}C=&)vZU>(X_89z9 zr3#rsO17OyKG2G!jvr4}V6Z}ljb|{WBEARwl?Vaz<13kt&QJ~P`kcA3u)j2%!6U|j zfWn}{?U;tV~Xd3N=MpI`*dp4x;y1P8Dlwl^-&$vYtT+)31-OTd`M-bvHz7(;T9~{Lr9AX3Y(>8<^-&Equ8anc~J{W@` z-@f#(keMu*M_tlR(}--9^+sUI7*y3r7_C*LTv!+Wi3*Rd23I&gubXusk89mD*ERHnQGgz%+@n;ehWf~Zu}96esBApaeh zcDc|3e@c)O*=8sXkiuvY>PtJgtyMXk)WHy4 zsaACIR!K~1{}AM=%(M<8c`=bESuR;5rcl#Rc?3?}sM}`UTcF#xO63R3wDV0?c8|iz$Nq_-+-zlFQjnrTKRT4!&5jQo@A;L{WE4?E4!u2 zeIc|IFor{wL2GpB1Z&6A7S73<(yN$wKVX+QTgLLVm93&~3y=FY`MwUpZMDwiXNQ8)1fdi<{QZJgUIb>4Q=*s~NR=@gbsV>hL zmr15>ISiHO$pPUg|6YYPTS+;>GuFV$BZlV`G)b)pK{}3DY(d{*RikbJJEYqaDroaz94Zo? zY_Wb*CDdX8QU~$2M){#_^G8y#p!E;Mf}` z^BziW9}Ji*b*uRXRQn3IX}PEN=W0BVTKu_RAgCDF8`I(aW!4J?fPkZ4AufOaVGbqh z(=%=x?KPUijVyGesA<1n)7n#P;U~ z%3V4)521#EUIMT2MT~RjR@ymcM<-7OWKGu5=A#fbUfw^=u#5#Q zXMBa^vb+)vF$K21NJZkemC)rAC#=yKkU0z!Tl0vN{09lAVuq1jNI7GMDN!;Ij}0}+ zt9A1nHgp?|%#8moy&jfqO{e$h0#_OF6j|~O{HB~CQyxNTZ`AfB2~#Fca2P}x(?!X(RKF9MDT0U+xG!3q(*8hmUcCWF{`1 zhirNKrT*wJ1t`!V<6q1df?sR*m09cU_azHTrmu6Dd=$QRA3SW_ok}K*|0fda#{S|2UHQ#`2bs)4o5J1qtGA*TmJse?{5kGUT3QS zzxR)bs88xV93J}rG3Q-QB6#gz)98vvL=#Rwv$OwegvAQYJ~=iu4^iYSO4h ztlsT%XG|X5zdG5o5&S!L8<38kHF4y~D%w6bXG^nIt5OT;k7Gw4B5qJ>ZENcqRs>}( zQlg_VaESaG@CvIu$?1!kklskb^YCcUqGNpXeWus)!4f0)RKfByQv8w9rud7URM11C`R@e<~usY zfh(SGhwI4V=L$gA&pt)E&WD&wAn1uaybf;x3T^l#9D!KIX|{Tn**NK zV5f>t(>dHgi@K&|=A!o!dqPaa$(6;26%`ny;5=~T(R=bywseQtcKU5%@s(Qhz3=l_ z!mjGqRQ-XY_%R53s2>&4Q%mrEZgG1Y_t0ap=~Ec=A#wjiOsgH^9EX3p`hJFRIqp7` zV*fx7d*xSTb7yY_u0PwD9SqxIfb zxl_|s7gc|UDXUlWJXw7_nb!=R>XHkC8DpE-O29Hw@(bCyYq?L;wz}J+srl7Y8eg+F zgZ#%3(W2j_q{}bhN(yCBV^r93esQSvfJ2==z6xpuyV#^|X_d|E=A?5`rPHHH=3x^> zT6is|+qR~mt?pNCn_A6VMd4()er7&>c)pmjCg#56&WOB`cGaV#>XX;zCw|4(_94Cc zk7@h&TvYpg%2by^VA2cG@1IzaAvsztTkmk*$ISVmo-e4?QoV z){5JEUtQ>0uEfyiu@;z?v3@*2DoqF!XF6XaBbrvFHGZF-{UgN$9?nL^W{vM}=j`d# zI$fIUEv6lhyebPsM9wWbrR8>bn=61T)vkw&XI}?A>A7JZPaXZ`)e4uaghqkl#M|=Q z)ar&5Th}P%KFDbvJfEue$F;|Fu8DMJy)Opn%@AXAZ^4>z^LoxItvM9eFk@QW!7}C* zXmzXda%^l!YHe#JU0o+t-TR<5*Mk*rH|_JZaam?(A2wVPd3e2UHJ372eUb!KSvk06QC=Z@KJfT-ro>CgEKC+yzuLbcWX&l12D`u z_tjBu+oe`D?Rri{PQ54-V2u-3Pe%>QXYFRI0WySzyeE}4-Ae18Re4TA7c!tx%EF}$ z>gDT@ByOELx&WVINR)J&NYt+KIzeDv+d{fsI^DANnQ-1251RN%-;ea~+8q_f8|ZbJ zDXqmtt7E&TI+yNxArs}TG>jaLys;N|1@;=fe)lR< zJvJZB>%&L$(U3a*;u9T1->cHf#QCKquTv9H!+`XWljocF@HbF&urGYo3OL19ERn-TCvEmsZ-3A*3H(=A>xx$)qtD7cjLk}T!mImddBTh>&l&`ds zcrk*g01TsXqgLP?bHz_ha7&n#?(+!K_^2Zp z?M}a*Dl`yOHj3_b#F7Iy<6ei4k^qXG+e^5an95$e5|sF)qd@4wl<6xHMW?p|^`nn& za@(eWQeWX$TAI(@PqqP^eg!U?rXXJMFP~J0 zfCiT7SymeL?Ah1N90E+>;Ao(XSo5G?~L7c0z^J7Z~?(R@KFW1H{h;{Df zzNJ^{qSsLVn5uKqz=+kFqL${zTu)Cdh^MjTW_|9Bg>d}ybAjmgxnV-&77%7G&S1-H z?I_e3WmgAgPv`id>YA(kG#<+>Jh+%^>oT9KN45awLPI;^_PUXPS=C}L4<&Qv@-RYB zQOtju#NCAZDTMu$QeK?Bd767F;6wBc+Y%^IUAjGjaii0N*QdJGmU;hRw>fkHv2$-} zIXx|MJ^Tm<+7V~F8aFpr8GC9#UKuv#ql#w8idt7mi*WtV+V53Uy#{llEp^>seD zg^cG|VtL0V+1%Cso&G$FLa9Rr?IGxHl*$+v132x_vn>_&7y}LaA~J68(trx|HX(2Q zWvc#vESnWY)^D;GtYhU6!+3eKj zQo2ozm}*(Yt;LPK#L&wu_2)|Z^5ZTG=2=Hbo1XsJT$6*am{?;lhjFmNTMt3v9C!IN z; zN4uwj`N2Z=(F+G7@4{wJ1zk+029<&vi%Y|r%FmrbvYG+U$?7TNpy{QHyLdgc)VQRdU3)0wF&`{F4xB)cj3qnXp5&;5G;JhFWq%~;CP*ZD| zPGX6T&H;ybHV#|I?wtGCPF-kDtA}vD5fLSHBYh^)N*xNdIlS}Q2gs+eO;lDqD2K2L$DKJEsh$ zZW*)8PBrBf5J!+%Q12kWXb}jntDcU7iR#jnf(8PVHTFn0sGvtfq1Egd?`Dth$D-}7 z9-r|%a>18=$z^t7IM2?nIq;O>W)D8Ei>xYq63sz(TcPm1OEpdFll*7XWzloBW z^_CUx&OT_>T~xtGn0)svDf{n(F4{VDw&mr^?@Q`wo`%yn02}Yw=dvuxkzU$UYj0#$ z=G6-sJwR@AI9hD@520}&;>yX-a8XPoRIcLSxjBYtsLXTxUDA0OwIKh&5a4^GRFv_W;w%;@e zrX?t)0=IdTm66Abxq z&l@3iu0la28TR!n(GE0u0AUq(Z3Fb+b%)|xU|YUm)F`W+4;|nCFL=;P7k0AF$f39> ziNjk^(P_nQCoES-U3KEvl|^yv?F8Tc-fy57F?9Q& z%D1!fYC#Ktu{R16O4yHY=R{?#s=hd)JCr8fx-=$m(4aSH*i;o(8>gU)rg0vQ5%M5i z@KQibNCwf|0c}Erhc9B1o{GY_@$uHO0r+>f%s#va+Z2oVy7 zqQJ&p~%0!IdkxqNjv_D}LsMzSm zECYommMx`q-SvvL8d_4W)e+g~svB&aMbg7B`0^%L7wsP;I#2}#Vd=Zq=mB97d@h{v z8)M`pL+VZbhipSmNcJXb+y(I$=lGaG5gy-v@Po+luWUnMVt)1K$K-UN%+uf}+XuXX z6B*m5nHqgY;pLsKVSLX6VU| zP14v|r>Y`JpX|m*xg$Om>wdu6rtQGdQC$G(+65&g4`Z4liLIg}SR}Z1;p(r9pj4O8 zw+Fn9aMuIW+zO%u3iz%EAJ`|;rn5sB2ZOLZV;gl00PA8| zRCz!dI-;M+MhqrBrXruj#PT(kVw3nCcg3Q)z3`N=Xh~x;|Ixe|q!-JHa#1`AnH zCc6V*!OeGVgofNWo@qq1s4&0%Dz9$(4Rx3`>2;OzKnI46tRbEM6~6~-Ff&nFS{j7T zRtPkjWI=B80!|hR`wp0B-lKoXuYn<=@h2nxXyN%&-1%4oS3Rsr7;-TFLCQny@gH|t zx&+dsvG}r2OjQs})jO24x%IoEmZZCdJKr7EKcudmj>SXg)|-$*ZboS|O?_!l`eg4k z3E{rpWz368LdTe~PhwL$1u6(Or!s3w6WD2izy2_3Y6anBk|>y39Da`Opo-{0QI4Zl z#BPUXK6t2MN^2G=ybC`5l0Gb^69oY{Vh0c7%uKd5a4n%_aL0e&T|u|8dO4nN$b(pp@Z>~Et!Phi#HzbdbnGg?T{4tiNf@0XUh~^+w4UF(1wOwOx8{WMeTe0y?i9#=*g4WzWRKNI?eBs-MXY=#+zW1F5C`af7S+*Q~ zWyzev1v`gqebxL=4Dhv2GR%0D+QAni%M+*D#7k!7M&K#0e9UJXW7RUyQ~-cTXlW<| zpo=%gkgjbK*jMabjskFHD!4M$d`OyxaP@b6>Ar5fN`>wI;Cq6&kmUCv3*Q5K2IhMV zvU%)jWZza6V1T=q?)&cc+oVz2ZWy){1F@%@sCSvTx#VcK*{7^&{UikcO!Ka2M$_~d zM=|l;bb7i4Y&fQOx=7SJ9xGhKk|6#BcDyjPWcO}MCk~sY-xEkI0z}4II)eTBldf%1 z+7j=dj@WT03~{6Bo&4qjDa#ode)nM+<2icXhj-b9WHB;Vaj9g}98y12#0{oi5kHC8Ia%YFlSkentXz!~R3U zJoP1j8C9OQ7(v}!r5FXwIxOYNwNMqzK8Pm1{8@NV;vTDnw#6H_;|91x1~>pSym7>) zeorT08eiX=+nGLZl{no2Mf4tAPY(E1qmnJZ z=}4oA&`|@OLOJUS_XAt~OzwP5b%IBrk}Hy)^EZJcR|qsldyYPmh0^N<3Quc7*S&V-w>H;X>z||?C_}Yum~9v)=}r>o(Ms*hdXew3d^&p_D^L` zL?VWIEi+9|w=8{atreQIujTuUQUY=^)F$74l^QTB5K1rAbylMGn4vYHXeTobJ~Vz3AgMeClI@Ro&kdyQY<+b*cDV+YT^N5wIj~p{Q=! zWA}F5e92L}s)%i{yFAs0XVmKMz;;K9m%eaWiI&H@H@Vi?VelE!CXDI^*!XO5-83%u z$9ut}hcCT-m(@uDzGB$eIN^D&r7TpQf|l-TSu(szsc|wt>3F2%r0DF>U^FHiNIB|K ze}i9gl}{cuDPSOFU{xcq`XN!cYBY9=Ap*smG}CUts~SM2wVmM%^pc?#efNH|#Ryv_uN))G{pB%0!^0LeXY8nU)$T(8oilQ! z?xF_hew9lUD9b-C+OzWDk@FG53RBWTzz6_5KF&*pmVu$dsyOPH4c7Xo(VFZcF^4Ah zrKT2+**?x$$9oi1P90B(fBgvu!X&1;IasA|B#y|I3>7ayjc1C_pO4_QIXtG%6gEQz zASn#{AWC|uroEW^=>%ANOCHv6k0}|082vzG3~4=rrimqc_M*ChU740Tj;_9jwkkAb z(l%FyigA*wt6-ewIBlvU{h~VmSREf67J~iRU-^Fe!1(!j(MwH@@s4X|Lyet1Q=U2+ zj=46C#vG}2MNVz`aV~B`w7_RL?I2Hl>HAzf?FEqMtiO(T`K`Qkt{cnSd=7r`+jffF z{i?a)%kjJL-mQxm9QF>60a}Elahn1Mb8?tEbnijk|LT=Q*IDZ>ydw?>-Q>f!B?Met zB-@>0`-IUt0qMa>x3BNzZfiLTpljLHApDByHE&0ZBxB~7pY3h%R&^|HV$2IgnTnMh z6%7$>fz@Q~oOqVk8$yhLrbz5tGgA^m3SVhH(TPaFOc5!skrWqA5L_=#VG}JzVRn~g zyj_h#ju`+D#;u6u^%9k~Vx(6z(&{ygDD0+kz1F8V6;ZLWwJQ+- zQbfdyqPWOaV$gSPN04ss282m_mLMwqViTon=tE&4p~z7J!t8Y)Ie(F8Jdxcm4D*?2 zS;;z_l||$sVgT#Hz;KAk-f~`H%hFL1AEPO@^)ruS%8rHI#syvEfk}%K(KYK@D6^&f z$%l^myPb_+BR42MI0#k%=`%##JiBxPYBc?_SE%GKLiPhi;?xFJfCp99zSf|2ER8gt(EXpcMa&E%?ISudUt;C>VL&#DaR;QUZz{57s z<9RRhBOyb{(%CBOWMdz#pbi(=%}LZxBbw~^19hzP;t&`Gp;1CjSSz=iTi|KzWfNa_f$Nmg~o=<)Qmh!2waIpQYrlmLR zRy|*o(r7j`NQ69BkPzCG)fbJ1mcZ}**`A~)n0J?`4!E4S%QOJx3f7=y_t`RLFR-el zItqQfN4`rRgQ~-OV56hxZ4wa&Gg2xCD_{$(%`NmC@N}6Yp{_B5k*A%)2$7buY?mF! zd(Es5NkfQ&6hW3+2QMy`g*`;26>g?>RYhc6rN_xoTe8g7ZDnH9ks$*ms-;xPRwF0P zrOSa1{Uy4qMD4L}-^T%Zw|}moos4reBMP-$q|;jC?}sq$3{Q32p12=S&55;rf+_nP zS$QX<;t7`MPFTSUBF)o#;(x!o1(4h_;Kkksw(|>jGpK9vi+gUmC#ppTAPa)8_WFCtT$%9b<~TjLvuh%eGSPx~7r3_$8mY5_Vm< z7SEm2kK3H5nMbqnN%20hmpLK@wV0#yB+5SadVwS5 z56ANM_vxVjN?<6=^L9_q=Kf+-kB{AO*a=AE)~EBVph^+iPZ*w4$Xri90WQ~v zg(?1zD@k8$7YBmk)=86<~b=ac6*Sz z&}Ck{dcLmfz2sZ4>j~3Oh0>k#oFTpY__cX*&RyieS7DXUTydAD9!BE4UH{uI|1<{7 zUZ$cU@HAMJD}s-9Z%G{k;pig7>!byGo8bi{Q+dxIu02kU0J*_#t!OJ4Lv7VAY3&eg z@oBc(nIpnS-=e1^#mx$-s^{7@)#8m6((Q=^>m*9{A~U+vLk|6b763f1Ne+cRJJDboJsG+?$L>T=!k6SHen zA8@yfF-5`R7f-2=0?SXRZi_!-O>1oP^mRX9P0#-oBTbL{xjl?H03tjjQFpeV-hIib z%k9{qBhiVgk!}?OMfcx%rd#Skrw(dj08#i zXqn{8d&rLzew2D;tQ56hkJ-PU55*eWfbEuZk9U8nST0#e8f)N}MF@SS=2L@lqyD7FcUZp$d#0g=!L6 z17a|7R!e&sS%HXHn6b~&xemCfXV8NhBSy_BMh77X?5n8O4;E0&Uu3X6pd0dnw`f$% zQR};}x(OR5^Y9XHf5LrpE4qRvb7wic+kCD24B4M=wXH1ASH07KtT({1oQMBRS|&a< zE-fyzyGc76!-e#7k?gYiw|K9Xy0*gLyY4Yjwlx^PO)l6^6Hqm;6|;pvzRfD4{qY_^kJJ@XQQZ0TPi`eR$?8O z^pm|8PF7wWFr1l3$?hnjc&@jKZmp|9SgsSZui{L7LkK8dph>z}>DthiXcse5RD`YU z=L9QbaZ`m!-~^~lo0|kexA@oeujH13Xw-z!Giy$O7y(tp4emlMpeeZB$Epxusc7Oh z1BI2kDVX9hOSN;lJi^L)*DW#eaT?+#yDlv*vECMmMVJ=q&ukpXRLqqR=w`011)~K_ zn13cO1^&R+9|G~r4NTLHe-prKQKKf!S|T;SF)Me_?MkPI2$ds1vm!}If~PLY1`Cva zqPXUd>Qz|CN(wvwgiaT$sUPo$smzA{9=AL@*;Bkx>?VYasjM{EkfS`p#vvF+EZ`{>PPe9Zy_Ne3T8G+OU+~|Cp9U= zrz#2^-L2*J42IA)&aV}vL8DAl7_uEQ7K#toeoRL67SRxcB&FwM>Z+V%vOTvl{YR7$ zNZoXf%m4-aMf5<8S<|}OSwTru2wbFy-R17iNH{jl^kU81+OuqeYf&>JYQhR@mYRaH zE^Q%w;?KjmWy5orNRISWqyhyC#-#BQy%u(3SMk)4kccx58f#Ch{)Gppl99Qg`D!5&2fr+WHXxLF3lvSMe_{cv4 zNS17TFmbWVV|KDJH?X7ml$FfLT#Te-2=W%p^75`q^ZD_2*r%vGtkYSNOi2ck7}K#S z1ba{VJjptWRGA2h%?Lh-l-An0?~R0rk(KL}h!QAZHvdEk_r8OPB{8LE2sR?ZGW4-) z!M}L)b@LUBg8F?UjKmZg!$#s_C{j%Bz<R*#IrA2Z0M~Fmqcy;$;b$43gkF8RU@4^ z36ocd2LV-?(o{-6HNJQ76i;SCXyi0Koy0JqJ?BL-xXg@)j3I18K)R;Jq(ybKFle#b zJqeLvi2zAbn7gi!W=~<@I%h7UkHfQ)fuzBTUYe0)wb3WgOW?TdU-hi58k*C&mWSIu_19JVn$p*1cAb$6{Cavvg+#y(P8AucHNjF z0~3zRD@=|H4aO2#jPigpXVWPqm82MSGNrkdfr|{pQE63_R1_|g(aL4h8o0tC9WaYw zgjpDmz>(-&c6L%!Vj;b~sUkcwwyK?9njV&1K-XJG^YKyWqWX&B3?v#)Z*Au^Hu5{! zDY(eQ{6@Xi3TkV!C>RAXp)r|^7J78BPeefttFe-pU(Rl-iVeDmFJUk$h>^%ddRsf2 z!Qk^a1*s9qMNRrKT~m2ZdJeUXU5O0}Al9_^OM3ZzGMTuiqqAplSjOXZ52>97``j#_ zS+A$3*Jw1t-#-L$yCr9Zh7X9v;-TRYgUPJb8@>?0erS4~!Khz)3l6}BXnN;c-Ka{f z(SbA0^LnEZ1f4U2$)MM(G|rDew522l-Evy}Qa&c5Mypn7bb6x+1Os@h(J0kgjbW*M zG3qrcjY_LuPP<&9!Dv*2tv@wdJ?LFBYPi*83ksOng>bXI3T<2SikB)T3IE&}eX8kq%TB6a+?3fTBTG`sF(749@&Pjg9I~ zHlwDF-PK-?3J6H8d?3xIIf%a^6#?Sv1RLS-Qmr6##6dXIM6-Ub|Er*jjJtjyTH&7E|l= z&R4B=$$Gk*TCZCmfRY1&{2(1`EAlL-udfdbMFqck(30K=&TXE*@cN~L8y|i3_!b|1 zDeaeX`(lY-4N4_g2M!2?UZYWeHOVb9{5BQ)>h+Fl)SzJ;b&3OMofSjF3eY%eb=sTe zcGH6!6##Ya>K5p9x@F1f>h4y8_Fk*KX_Bwj{OdBm*;Qyjbw`yW!y^inQw24*PI7C5 z-{MMdec`vx;imQZy4wc=_!GkC^Wl205Xg^5a=`qD&Q3n~CoT~52%PkM;Xv?(gPyMh z!B-BxbW-p&XL@cK|E3uV{(pv_N9eg}(cd!jTcj1-vRuK}m-y9e1zlZTHk)m6XRBEUsthP*IDrOmhAZ!wY{~`zU9|I@RcfkJa5D4Tpb*w=k5C{bF zWyt}%+CVEnAP@)ydN~jX1OoXnNzU|l8$JLYyUs%(5D4UZ?-mFI@{^F9ukmu`<%^S#FHWrbR>86A+s6E% zGF;JY|IIMDe(|~(eitDS$d6xgzP4j+eqeF(shc;E)2kL|m%^1*i!-aP817RKJ~C^& zcX9H2X@6HO*zeK|K5R2R`2A$~g`CYJYgEdg&pYn^=Eze^S2y|3gL&IM^Y(jIMsj|! zcwGX&ix3Fpr|jk2Ome1H&5zw(n7$K7I>_ffnU%7OSg}{ceHxd1NF;qquYPFOelHND z>(+a;Lu<67Ye3^ZXSrv}d_PEg#eClt>%G9wm^QASvE8?<0gH~i%!&uqinTNL`<+T= zzssU}aHQ{%Xu=^nfAduk4Yc^SyQYlyFF5X+)UH+yuCtqd1`=K|-#e~-Kr^(~qyvC$m zDtB_#ly?@Yk&m-K9i3^{-y z9_i_LfsnCZrFj&%NAuRZx|thz{O7p!PhSW=(n8yci$B;Rc+NVw4wHPKmbsmr?%LhA zp(cNONxh3!`e;-0i?Xi&ioxuyVD79a+>%td-)2~oow7ZvdVg{5&IHmvt9eZq<2hc( zrY7nOpbjG8lVpNx9Qg=^=$2FE3L@vEZI7WYNzUvlP1i31!@Vn++qlgy$i+{HS&t)d z?wvi))D^sh&UbHTy?{$RG@$>bq~VF^bPuC>J-zsa!uq{6rCTDC4_b5&XQyt(7apeO zxTY2D9y6^i17cQkpsVTG;3$te_7-l_MtT3^3zK(2$$>y1kS}(uO@AjZXI6Dz3Sl3u z{iRvQ{VmiDLCKyh)=LTL2d&n1BKD)pSSr zb$4xOseB%jazxty#9+@83h`4lx!cl9cbgOsrzN_gOFW#CGrh_vUSCtcLm_)SH`z6_ zWKUnyGf|00I{The^!?ZH@KYn)$Iw`hKIP-`#wSn-o+|Alj3vpbE!~<{uxnxZ-V*YQ zaRu(>1ulgAy$01I#hE+fi}y>qo}w|gjLIJ)5q4+S?Qs~^*i~z1OslP<>!!`Ct;%&X z*88C3Kp>ExvgCYcFK2Q5F6-z+3i-o2)w=7ByRTdCau^<%cieT&a<5(Q>~5Mf->V*6 zuTieMHhwQqsX5y{4#Pv&$M0SMG4&75joA|bLRVWL+iE5br$uSS5BkL`iwG-wCrcA4+Eugmzbkp7MFgv^2W(=#9 z0}q?^Yvw_J*VL+M{p!(yhqa^Yu7L+Ij#cBT2USDsO)6(v&_}miff@b%%7OLZDx6iC zT6NWQzj|Q3O0oXRQorA%ZnZ(R7L+@#c>vUB+F9c2Y191^#-D+5L0{j5f?w)^_zy`Y~>DSz0YSqog8S@XRX?V1_OeO4Xlc3W-LJTz^+|0WNppyWUx zke`a=T>0+92VnR-fRPTyfi-=CM^(y)=O^!m!v`P`2;^Uroc_g$pF2kt!?4m}V)f$n zKKNaPKp;Qij0t5nqKyHWR%w4+%tpI^Q zAduT5Inc|2Kp+sv?U5YVu?B%aAP^`y5C{YU`B6y@96kVnKp>FYB{}d}4g>;$KyC~F Y2jOrk>9t=NRsaA107*qoM6N<$g8jZ3eE Date: Thu, 12 May 2016 08:31:40 -0700 Subject: [PATCH 271/439] tweak beta disclaimer --- education/windows/use-set-up-school-pcs-app.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/education/windows/use-set-up-school-pcs-app.md b/education/windows/use-set-up-school-pcs-app.md index 3db61d70bb..f440a05dff 100644 --- a/education/windows/use-set-up-school-pcs-app.md +++ b/education/windows/use-set-up-school-pcs-app.md @@ -11,9 +11,9 @@ author: jdeckerMS # Use Set up School PCs app **Applies to:** -- Windows 10 +- Windows 10 Insider Preview -[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows 10 Anniversary SDK Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.] +> [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows 10 Anniversary SDK Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.] placeholder From 2160697d7517c8c379fbfccacb8488badb9aea3a Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 12 May 2016 08:32:40 -0700 Subject: [PATCH 272/439] updated beta language --- education/windows/use-set-up-school-pcs-app.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/education/windows/use-set-up-school-pcs-app.md b/education/windows/use-set-up-school-pcs-app.md index f440a05dff..cca8ead346 100644 --- a/education/windows/use-set-up-school-pcs-app.md +++ b/education/windows/use-set-up-school-pcs-app.md @@ -14,6 +14,6 @@ author: jdeckerMS - Windows 10 Insider Preview -> [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows 10 Anniversary SDK Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.] +> [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] placeholder From 71aebac2d82a133debdbf50afe8592bd25ccd5f5 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 12 May 2016 12:26:33 -0700 Subject: [PATCH 273/439] add video, new topic --- education/windows/TOC.md | 1 + education/windows/index.md | 1 + .../set-up-students-pcs-to-join-domain.md | 19 +++++++++++++++++++ 3 files changed, 21 insertions(+) create mode 100644 education/windows/set-up-students-pcs-to-join-domain.md diff --git a/education/windows/TOC.md b/education/windows/TOC.md index 2b8b527b24..99abf98502 100644 --- a/education/windows/TOC.md +++ b/education/windows/TOC.md @@ -1,4 +1,5 @@ # [Windows 10 for education](index.md) ## [Use Set up School PCs app](use-set-up-school-pcs-app.md) +## [Set up students' PCs to join domain](set-up-students-pcs-to-join-domain.md) ## [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) ## [Chromebook migration guide](chromebook-migration-guide.md) \ No newline at end of file diff --git a/education/windows/index.md b/education/windows/index.md index 4e759a8208..8fe3a1d3bf 100644 --- a/education/windows/index.md +++ b/education/windows/index.md @@ -17,6 +17,7 @@ author: jdeckerMS |Topic |Description | |------|------------| |[Use Set up School PCs app](use-set-up-school-pcs-app.md) | Learn how to use the Set up School PCs app to quickly configure new Windows 10 PCs for students. | +| [Set up students' PCs to join domain](set-up-students-pcs-to-join-domain.md) | Learn how to create provisioning packages to easily configure student's PCs to join your Active Directory domain. | | [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) | Learn how to deploy Windows 10 in classrooms; integrate the school environment with Microsoft Office 365, Active Directory Domain Services (AD DS), and Microsoft Azure Active Directory (Azure AD); and deploy Windows 10 and your apps to new devices or upgrade existing devices to Windows 10. | | [Chromebook migration guide](chromebook-migration-guide.md) | Learn how to migrate a Google Chromebook-based learning environment to a Windows 10-based learning environment. | diff --git a/education/windows/set-up-students-pcs-to-join-domain.md b/education/windows/set-up-students-pcs-to-join-domain.md new file mode 100644 index 0000000000..c16073de0f --- /dev/null +++ b/education/windows/set-up-students-pcs-to-join-domain.md @@ -0,0 +1,19 @@ +--- +title: Set up student PCs to join domain +description: Learn how to use Configuration Designer to easily provision student devices to join Active Directory. +keywords: ["shared cart", "shared PC", "school"] +ms.prod: W10 +ms.mktglfcycl: plan +ms.sitesec: library +author: jdeckerMS +--- + +# Set up student PCs to join domain +**Applies to:** + +- Windows 10 + + +> [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] + + From 1e6c2fb473835a5fd85212bb3b44d47f2d43ee3a Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 12 May 2016 18:10:41 +1000 Subject: [PATCH 274/439] replace with no color image --- .../windefatp-utc-console-autostart.png | Bin 22317 -> 68628 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/keep-secure/images/windefatp-utc-console-autostart.png b/windows/keep-secure/images/windefatp-utc-console-autostart.png index fc9c01ff7960ab7e44c310bebb9c80080e34bad3..99a69e555d3bfd3fb452375d07b4dbb7aa93c02e 100644 GIT binary patch literal 68628 zcma&N18`(f7w?;yOl;e>ZQHhOyECzqiEVp=i7~Nl+h)gkneW~2@z%Sqs!w(GI;+>& zwa?jmul-y96QL+C0SAo@4FUoJCnYJW3@X6bZ`bKuNjy8GQqljnMBQ8Oq{J8 zU9BAKK~SKGNWSdQ|Lh_Tj$Y1I7M89cRS4tUUsm}4Se?y`{<#vmTG^R_umKUEzRp1X zJEP)Y?&@LWYzCs|`1#Kr=0Cx$Tuf|@zFeI_n*TP&eVHNunKg`@?XB!BK>p$!el`26 zwg36Qo3n`-$irvQ*?-+c9PI4O>|H?~$5Xn$Y~cUgRIOZX%|Oa7XDL8H2tlMog;YJW z&a*vy(FYcP=591MqYA@x$|ULsK|%&XQ!0y!qJC5Qp_){%6ga9@m-jOlF4;y1EWSV) zl_v1JbSkl!H_Wf#j?VK-Uw_g7)gsbGulZcB<}5Ck$#gEBhKBahkE1b|0b2-EQsf9x z;#S8W!Z0T42E+#^7Lym9UWm&lYF@!yY*TPFV&b z9QQGDD)|**|4Lq-Ug^`6?_acA1QBxdub}a$G|YAX&K7CLM~D%B1ssT!rTup~Ds@xi zub;?Lb;Kx9Uyg4uGpsQ@SGYYCxd82brd;0_DvwRB?{agKGLK+nDUB%QMI|N9#1sBR zrJo1Oo!(R~sWsyJYxMV+{01O;`zw-vk4Q?61YU@dzyS{66tNa7>}(I5AC6U?W0Z=f z(b0)kqLJ;P)gX_(k#valo?KJQ?@xqXKW0y~Ke z9H||%1ERFJq!;@URhZoI9~PB~VZRv?RW=Qoq)>`-WJQ)_%J|F+!4Oz%UTEPVrZ($7 z@LomL)K1o0S%B+2p#xE=sLS1+H^`T*9bJ>4SnEy~C;rG3{qcb%_6p6J+f z;S5W2M2*{Nc*q*_ovpy{Q<0f6`4qpzv1BB)N>vm#>v_cYAvu&fV$+G1hUR0xqv!;U z7vfzGj$B!Ms!<9J$rQ5CvSD3i-1==4w0!S$I_y(7R#9{en=ylg$l zN((+R@V6s5B*=4=W;eQz$21W}w-C$hY3(XWIP|v9+6{^voLoSYq-wRk2(5PG(|waz z6na#}f=#%BfR3wv{rxnRlc6@85&zN;RPM%{v)XR_;!V48okwJ|3+fM(_GPr^%JCAa zj@Mfg)ovRky3?$!botaU&gR0u?)hSpGGl^cEXFg#k}@O(SQw@DANBW)U3p=jT|g#1 z>$Y!T3dSeKbR+_c!Gj&|7rLkqS$*3M0jI8rscGR0Nx*>$v<$tm`U5;hR{@mJ$CA~* z8dx*Mcw3+RDq9xKD0{ z<{}vQ#1k|X?^0^yz7B4R)q^%}6CHNFlT_DsCbg;LfRfn0FR|p`lp6g4j8t>gI#1B>!jZH>acLu|immty(PV}pqvvkG|1aqYQAPr~% z|1}SSo7JJM#Q8kD2NUYUUSlDpI!)T=&DSc!I!(pos_IvD|IvA^v1vN{(2Y;X7@F3| zX`SERC*PU*)KhHd z9xA}ooA(htVlRf;o-3uWT=~#&4~Z{2PsS9a{w)1XencSv{E3%Y)$7v(t>M;N#4;#z zZ8IYETV0}B^-yAP=)Nbl0fLurH1QOI=fo#oxHi?MO+|BU<(IqH;CnMHvDVzb)*z55t8qr=)IE=aZB$`cA3cVse;BumQ6e{5)u$r-sX1cp65T`aI(DkpQ* zc8D~3>*Tap5JG79jYnNElo~hCuXF5k(}oOV`fi!9*4kQZp2cOy8f@hN);B7dU{dV! z?H3sD_*cYRvFYi%y)h>$Ejnr0eN9nn{aT}TKwo#q)zlVD$-7ins=Uc4?)HD#c<#OC zLK>)K#PL6ew5bL8c327kKRj^JXut9MK79kJg(^NZ_s}jNp01nGL@q#JBjvwcn4rUd`u8>Y%TbIM+QUYKc}f7K?%5^jerU z4+VB{H=fXxOz28Va?I2K6~T39j_xwoeF2Ogv=(ZmEB3i82lG?Y!-tZnNa5i6r7LN1r( z=3#1DRcD6)o^sdbJ9$+0Jsk`t;|mpQLr6G~kq04%TKCEd=37WIjJYGQ465pRLgzQ; zLNq$}a8diE;e46WI?JP!d$ElwE#BS;6R?2>b`3-J;1m6djBBRnWy;(M7#=^aRfpCW z&g8Od2kT}2X!WY=Gw0b62{zCiw!?v7*jGoHwK`FBUkLZA?t17M$~m(XSBiXI-xWDIENm{=m|I{-2Aw~BwyHG z(rbr2Xpbp+eq?zKic?y5>QA4=^ckXT%8JexokW(%FI--5mc$t1rou1LNn@X@7+EeIx zy8w199;`96F}}y5flg&I7f(nDEnV{zleON1vUhd(yo7<&*ISp{y`A37&r?0NL?CCZD2#23GBJfrUo4v*|qAa1uPkZqsL2&(C?lHMyF z7a2U`WA!e#1qFwuL3!O?liw^3Z-q_V_uAlsMI_SSje1&Ws6**16r!_yI^N>TA_Ip% zD2{rc1G!RtXuS{JXWGqVZYH`U^I!e7u7k_gN}4%+y*&iiHy@Ol4ky%vf3Qa+)i3nB z7?@7+fHz0Rs#QjK>3|BG)-bqk1>zyqeO8tis7F=y5B8-CFS*qLUpYi4$UFO$uBePRhKr=P%K@noSOQsy!jN?~CrQFn0>0FGuxGk5yw{s;bEOJh@6!L(eq)IoA6g! zz0D$DvgWGw%pY-$x<#7)O*0160^lFw1w`XZfAGi`jdh}q6*Ip#N&gwE?LFbS0^|J! zxZ7u9YIj;XN}4ebeWoH4GN+|aIsuidH*pN%CziSX!P>)!h)*n%Q*~;JkE_fe;U{)< zY#JC3@%~9Mg~&F$*GQ9<`i?b>D49wQWP@{R<4rwaWW1kF6h_K9XVg^v=||5~kMVU2 zFa*(vX*a_g?40}d;3@>t9{FNa9m%1JlQbC7__Lm>SFNo}(@7HLtN-uQg?8(424Uo) zBHP=J5@#x_F>n00powk=YyE*3UcP9ne?(dByknl|2!p5NqB405=nw6&B@*P0AxwN}r?oxGg=ZYC8VoI6Md@9pUZJ6gqY zH9uy#hJZK8Ed6GnLpdMslkd$r3n?B`nsn~|AGQJP$x9vpCZlV$-FLR32EA61d%F#7 z+LawX7g<&j*sg+-wCirRQjUw4H!h_HFNgTkG1{WfVQY(!!EBG}W9`C9O+Vr!jhLu& z6n_T&)rWS2V3=mXh~Jho#!A)VayQQyWBo@4v?vSK^W!d42fAFfKC~5uxHX&%IPUnx zDhm~0k5|ub1TkxFC4p=fQHl1|YxRa}4wlv;yS%B>t!|I~byVrrZbaL0-?(#xA45cx z9A z$PvoU$l>qQy9=#at0Efq39)u={hc#TXqmNAp-qda6l6&%dSP>Uke*G^Qm5s2s>_x} zk?Z?Y#K#?tcBxFpn>EzPS*6=6O4yDT7B8_7`7`|yoa))W8Wv!QJBRxq*=E6RS79*$ zv}p?gPi-O}+8>G0R^oa$0m$%-$NNDn^X`4a{@AkoK|W2Qo48A6yzHoEFS=2or2@~@ z93e}-+}_UEc^034VwsWLRL#9RLSJdUQIUr50u>hLa@-Q(-m_ymw2_x(7VmXpmpl(X29E(o;)1PyK1(=y(MHOgJpD>$CE<@I6?q{>BBl zkwT-~Du9C>2_r=38R+SJUCB`xRI~FHWaR;{{G7#Xi)BfzJ^#Z!+j@#Z ztLKsgcq}d=Z#p~`mkJq57{(?`vYyT!*b`TtDc+WgIf!pQTk5p1YoOPl%P`P>Zp_v; znEf^7zcwa6XU{yz)Wy;PXtc!a{$`Jc3Wi#2siVK~!pY{)ooUg8$F)&{?|%-kCO^zT zMaItm9s1{2`6O=iG}A2025jf4tnI?-ban=oK^==5LRjq4l>n{jxxUnA?`{nweUrl5 zhUW@;vFFt;`o!*l3?`R1D}!9Fd~=P)cSgTeR`FPTI6>g$QdaZ0OZ$+qRFOyXV|1>g zfCigS?u%5@TzlXSCRzn~gV9biZq$aD7mVPq+Qkpin9QsGDjZB<#2B$}Jeb_VWo0Xg z1qHwSpveSBMkYXoR9NStsdJ-+pJ3}jj{=P`l!bmdOH7*gfX zTZqib!eZVLgNiE{3wJ;Az8UL%%vE?39lS`@>qJ0-ieznhJN}F->6UsoB9Ywqz!$)4 z$x&CUN|Qx$zgh*k|898H9L1TY8@Vcl7S5m%dih>*bN_3st|HLToV$$;{{7ekazQW- z%TR!&p98i`v8?lrG+pk^7SnPtor^|~Ls1Qd-3FIFlcAO&n(}~JomN%7L(kA=J{^ee zVZIf|a>DIM`k+x=r1s2mbHA`wi&)8(W_HB~65P^y$8o#@RZyl$r8YY9qM(6dNJ>v= zH)g$f31lhz9RcJu9iih@uRp87fgAwYm7+F?y?no0Rcq+ahu|Oyj_+LDlBGo#!Q@^M zh!|iER;<&mH(OU!1Q#de0W@5iP(lvx(Le-&KbX%BIqYya6yC+4P`0f9AT|;jvXQtM z-Rr!y)lj@0mZ?$xptVB}%-4Hs;|T(XLkR$p@z)kx;JGZW@L{+)!rTf)C#j%mX%LZv zMBKG)y3ZS+^;(@5nbJ7yqkzb<$|Q$4NaQUlHTxd1lFWi+FzV8#%T~h*AC*crw&<+o zu6wE7l{OD;R;JeW9X_gAaGah;W*u!*>@lJngCVcrd%Ppa!fvl{wBYz(vt}~~7h@*9 zb=PDg%yEO?zv}h|(OQ&p?|{QIg-{`V_g!5}UUXdiM+btPgR)957z9>W2vRsB}cD0>>|ANallMM+$$^D;cLM7y{s{pJTiFKxNC0)NIqKI z6b7VH<(-|Yj~A6lC~T?RMkJZMHv|iNn>1o`^%iXSfa5wU~vicp4o~tdSiy6{E4zIa&)a z$LPMZ76Br~AY=&D?0Gii-rtk{&)#@dI$wyD44_yy-P1ky_e_y4v0F_`vi%%CUE}(% zttbJ_{$>Z%Va~RYAqj+1_XIRWOOFf3)5@*uEiE3c`b!n}E>{SVu&t?P7=yp&F25Zf ze8IQ&`l?@_4;vI(+-`|SJ$JFVj9Ed4wnPlqlKa!qdWAyPDEJ4+h^58bfcGw3z2Wic zIZ~9kg)7M-$B(N=A*XmZuh&TY)z-A<6nm(Y=m;i5u>~IX2CSVKuMiuPY7V~f66(b= zwZ`**4|$!BHcVR*>qO<1+obuBv%P};*f*HJz4UxydI6EDyu%+}gWTAprU?rb&=qKDP`{P z%E`BOeSixuWjG@1q@tnVpl>vf{~3o8fC6Syb@bqOcP24=GNB*Rq{Y{WuQEPWsSv&Y zdRr{H(VB80u9DNyM1&S2+Sb{4oVDAoI)I(^wnJv$H8*|?K_Da===rC>w%qxsNUFap zZSXGFo@b*3TZ2CLDsW1=dNg^t#e+Z*u2`_WZrbnZ$H(3FhAsyu4?P_=P4`PmW^Rt$ z^Hcr0$EV~AEDuUUvd%-1Ol8yg)ApaOxOQDsja*I54pVU1v_`^acbi@^6aIV#f;pR0 zdUd*t(N4Zq<%?K^bk^-%^%tzrp471vriTy=XubD^1_=*WIg^vw;`_GC)jMh05+)5Y ze)OeX`1&p%e{@v}JRgJ-Ju#TIM_eIDp%w58teH>gtVd68*z+(t7l^Pq5>mFd$fXjw zqAIu_)UhqhtafW@oHC1^%ctRmMsw^*Q4Pi}sq`(iQZ%Ef(gi-bm!j~tJCfp%D#mj5 zt$zrLb=4Ej{uE1uS=+AN;$#enP2t$*OIu+~=&(}kT?6Ko)sBD7hT{9RqpakTAyV0LbY&75JDJN&l*Xp(YEi2ZZn{>5N54G#Ql)yj-kIfxT~pT3B?CH`3ChVaVJHGs9D<+b|#=^Ac00(z=ZrT9Ed8d0bSOh?V4Q&|*P5 zwcuI)m-C+Esw$n_gE`$y+?%*^XGzh=6PfO8rhRJ0vd^+Y_e^4IyTjsixA1$DYa45T zoQ^*U_MFvm9naOryE4h$)?UB#Mla6_6w?0vV)j*=Z95A0V$KE57yPM z-S-0?wsNJu3U#vcSEdbz-AvkQ%k1alMr60-?n@l7vo|zXqi%M}ZYP}3aBV{oH6ivc zPFI$-FZyRNTV(^L*+xxOYy@R5(we+R)@+r%CQOXZvi3W3hWb!dhGjfncS(_Tqk|Wf zQ}O6bfmTXweUkk4^i*yhTSq!it-Y#c=lHX)TgiLI?aSsaRsDqcJ470=hyD`q0{`f+ z5nE}@Q_{tqPA!i{E4D`M@7tchkS|mp0va}FIbQ?HHcGCzlkg(8d@Ih)Rv}%kjPJg0 zt+MBErkp27o;K^{HwpdncoO+F2$ag_XhX)hUH|iJY<)c&znPxmtzgd<5%UZ`XMpC~ zrLKAU%ICm6`Z&3$QUzLC{ZZ9&nMChDh=T7WcIEo35p?CyR1?^S%4nx-b}|q3`1Igk zymzLM=izjL?l!H>?QFJC!bA31BLX#Gn)qq4GuGMA+D+*u_Mz-CI7(UhcIftUS?76h zKBhUh^<+w2>{bG4bK=j1{eBJCma|%Q)S2p}_V@^!?$V1=&gK)?gmg_B%n;=D@-$AJ z?gJ#ky~9AOn^%Iscap4;9juA{_TG;g(eD7?&A++Tq5B9z79;H{$6j&-wy6mDGEn4b zoGfD4up!coSuo;mOh&V$>vblgQ=cit`v}{)55o`L;p$6UvR2k_E7p=9gs^(0>Pt$z zOdpTP4vpv@Y~uXv3D%baw@96LeM;p}!1eY0DRmL$AI{XW{~`H-SCf*P{VCza^ASV1>j37MW zE6|7mP9hr8eb6w6@yH1KKfm}a4B@OvqFelb6@vds`~#0Ii&9DqU~+vo_AP(Hms1k0 zg&Zx{*5pU2>tJL-)`!BshLDMT6(5vP1A7Pq1h+f*rJgkg8DVwlG3ZmzzHY%+DdK|) z!#}|v+ybxexJ_PH7gtIOOrZGHgOrXgMw0Y44m(7O^e1kF%!l&ZB_Fz)+SIepkiVNO zIZD1_xFze0MWyrPKIvb7@6sEGatkR#OmO>VoYXNghBQ)ts1G%RU#P;{j-1z?y#7(( zWt7nTxd_`|iBHJ&Kj&X2JbFu?wrZpabEqQ5OyN%~Be0?ko2(_PH>CYLjc)-OIl?5! zGl-E`nG@qH((0&Si6i&T#~scJ4sUv{U5Foa542GGsA>DP!(W{pGhM^r3AlwBf3r7O z6k&3jX!*!_O?MP=k>;VZxY&=1xfb8d>-duoFU9l3!Fd;8?qZxJ-#tFj)$C)47cnT zOhZLA?l%TmIjS%pH&<~72(1yo3QG1bgkafTNicygr=${wDpWOr|%n~ zC4fI@%V|0NPJfBT6TVoiHXTLurwrXTpU(IGyg~Na5_BhvN{~dnSiYIX{M@sq0-NZ? zBiEauF(;5Zb!+^XY42EDL=4Ga@jG3Br;;dYH%DZ?wi7qqfQu1H{M(4Gs<9S94Gfy9 zHhD#!#P#d@5905Y8xdo6!axVpk9~`DW(SmSx~!K#khs{2i5FnE*@1!pGHi|60eZHz z-lcIb32=_fisdeM)ZZ769l)8ZfKEp-hY?mC2v+%k(PXPG)L-U0K#7mFfIkLCuRGTE z9S+g4AJOaZ!damk5>{_2XLMA6&Lq!<+k4WiVI|OP%lPB^BVT*a`%w1z zCr7TDA_1PTv@Wb1WnNj?Xo$iYrS~t_KkORo>_6ASntSoS*;vv!Osx-38B`TKl(F|q zz|Gt0P00?KE%cZwD-G)bdbn-c1lckbnWq1oyC{63Q?}a1lNsctsj8|?WPD?dkuR;>pqxH_qqZE5(oVt-V0*vr)8V{hO ziHZn)@1YDW$jcZ%qC0BbP-67)-zfwxCB!cW3I%2CL_`FBD67hnvuJ_h;9WRyPf$Gr z9hD-;O0PnZ8d(s{bAi;Z!~lmy_k82}Wyh8*PCIf$ zYIK*cW^|=khJ>yIreYdtK?__t#Mj*t>RjCKR+iQ*X9}?c1b=F>igLO$sc1k)F36QT ztCeXLgX4oL7S0>9WCHOIlCW^CPE4Qrj?;d(H;9Lt4-jIHlWyP;QlnPYaPrz?u(OF% zmfCAN4Gio!K?at-9ao@*jYUFbhc7A2GnxRG8Q)H_uFb}P{bn(YB1XnLjCGo*8|VEO z?z@bc(17gA_rqmkc(G=E-MuGxO-M<6j4BkbD+A~e~<0ql~ zmApm6v7dd9$7nr$86#^#?w$ui)D|FLJF{R18DHnFL)=swpc1VSZ;D+`bq~_u3IaOZ z<2)9Mb#kFa)i7c;qkm0BapZQ(dSm7SNdtbxj-;c}sEfUklyH%K%F6PL8fw>rYi+dGQKqIaLa;S{w3)iu4SaYKO@r;EYK}b@P2a7PKqqH89AEIg zK97<$Xo<;F3K$FB9BYB7ExsHyI(jwFiqG+1Ex=6(``z3lCK?Z{$@sF9Yb83Fdya}m z1%9v3Eu#;@Wgi-tk10mjx%zoBwGz1r2~4T%PVrO|a<5QO4oT~4mr$eB`e1#kf#K?_!f|mZ?x88b6?l3%a0aeOC_ElCu5Yuo5tSXm^Jl|kAd%lTp+#HaQq!^ z`Q@}h_MKGc!wtv`@U&x}dW|lY(LlMsFit#xwkP-miF>T+t8K{LonR|%DcV9=UtE^g zyu-g@|*UwK+PXnqs54sb)nijYb^<%BTZ zY0lr?jMKZklg-)Ti)K~4#!|rG%YG1|`++^sxd)+a@fyY}@PNj@;SFtbfxpgX{=K=l zA0-NHX@fhW$g{Pqe|G+n#^5}zp1qJSm15PAV%bq=*C|alST)VKyLM4wH=*JoKIAp=>bkaPorJkH4VctNcnCxRQktfmXtPilG%fBb| zp8P2hg-nAMSLup;6Pi+-nvW7CQxr`CZ@@V`vJth6)|NyR*Vzjbd(gq}!Xn`Rj$$X# z*pJ2?$K{g<*6u-)JLwyzV7{UhLWoW)*RFH5m!JQz%)aN<^i=6GM1wGwvCzTcLnCwK zCsblWwS_0Qz38Fg=ysv!`?1cu*!_uKKGI#!lGHwFa6Rb(be4IYt$MP?!}0L8>J?wK zQXh4#kaIktuzfs8_?-Fb=OfC)cc1CR+QW}>ljoC@*7J8GmRFzjl@4*k*gr*PC>(Xm z1H47l(=k7!Q<;8)159o*c_d-b^Cg~Xu(+%k|M;hm?8$WR_K~3-d)>P2UPkh8>~eY&o5^Qf%RAE4{geK6k)pQ} zUo(BNSu-`Qk0U(;A4lAi4}B@`kk|5kq^Q$2ecnoIRg^=O zHBJ9A+Dq>2<4yMTTZ+|b*9qVg2Vi2!+iUk!SA1$Lfhspg_T&e~(7f)Pr8!N?z3lfA zS7tSqn|?-B6!b4mi!lFemHD{Y>TLb2neGg4`o79Y|5~#%Ei%{Vewj`1UdFV`zG5i6 zoft1*@zViWM%mx!YEp)?)enzgY9+GG7s;JOobi}w0QsQk53QMX^FhYrfn?<1+)@13 zOs{@(Y9sM`X;ke<&A?^1S#@;F9WT}XDWP#nc&V}9^jPfDazU1m!h#IOx*iY zaJ)M5?XJCf&zAzSQyR;%WuKMptR7FkKl=YkBRiBE&uzf3ZD_HFU^N?hF68c^)ct~6N zO-HF1uG1B|cGjxFg)p1@`K3OL_k(LK#bT{b|EvKHma0#h0 zcr=mr{tdZtQt2F=+tbd8#mSO0awI<4v8<8im^f$9w|+1IjzVK*o!{EknqZoRB~_WV zrARBEACnzT`Go@uB{RkNvG}Wf4q6+XiZj| z{*tm&uw#0}3Oog4E^4)}l@vVr<=$`rqFt-O9wymDt+fjHu>P^NIUoH4@`vmB3;Sm7 z153Ivm&)cz*m;sJpPGC21E#n!Nk-CVESk>N9v`-Hw>%2HTx8v*L0z7&9nIC$rmUdS zG+Yq3oKD`=%E+37ztj@^pE55myL-v~4x5ZM3HBej8&g7JePtQ4yE(9{4}i4%=Lb)J zl5Y!1X!~seO5_2aaX7C%(2Zw)a$S4P*B|Ew_2RRwZv_?5`#CxDZm@cwt_AthjaM6c zy!(_|Fi^M4d_(&o!*^new(wQxLGT-)F3x+h`sut`ZcDtwpa}Y6$=6`I(UPS8AQ;a- zi@+?hE3pLFLUukNzoW><;ZzPp6RTFCvt(cS#iIwkiw0v!_IS{#E%zbvlu9|fC?&)c+aS3G&DK=p1wC%p87%XTwnc$@l8LjzqyipaNfIFC` z$iz9h)cvIJeDelNMxCSNeI$3~d?HU<8ler>FUZ6HBU(&=wZvioyDI$#he={`6hHot^=Y8E&Ud{yq!`hL zD?UiuRMrwJLz-@T7(=^*yz`e0Tu#$cr&)3Iw=HP-c}wZ{w)86f&NMQCuhFN?^ZeH8 zb*^folvGuj_b91g4(=h`1B%|x%m~<|du#94sKmhJ}-oRP(mUc1HeA@94;~=?Rv_WR&OA;eSFyA zZAzK}^`hY9d}QxlvUs##k-LIBUi5OXG*f(zugrm(??IbtV5~%(Gg!o#di$JV+g?<= zQ%cvpeZn5hU;XIlyWutLeFo}5|yo~m~ z@2=(0FmQ@~*a6KNRxLjitbtE_Bcloh?qvSsc2)3reK?4g@t<@m8z{XREP`=i_2lMcS$ zc&U2q;h%WG>H88Q*!FS+xN{$ug;oxd+8Sw2OtO4?Q0)0L@n&y0OGSZOll50cZ3cU_~CXN9q@Uu8F{Zqks3a3=v9kb@ z*wa~%*AI=B_fvk}=CJ`X4Lt=HiyvNB`nMWlT#SD*u3gdh z#Kw7)A_zBHh_3w*0%odAXPBw`3USH=K8u1hMjEE?o3irHB#;BqeJBbYLje_GP$8_a z3(*_)LTtvteO%plAYQKgod%X*Q)+^7Kf*1c)l+fU_Q_c06oP5-cGum>+%Aqa`B;xsVEki z-a{BTEggEU^C#+t##?sxu9xK?f7A&oc^?6zz)Jf>=dUK}qgK9VvmvVnBM+_Vw@sJS zL>FKB_9371<9x=91RH;Qf3K{xKZJm83F6S(Av>Q|<(rM6^#=Ft2?>31h3|~4w<9yttN|Mr z!b%g%@P1=S78EzDALzXIxs$qqgCXmBRO1p{+&JHdYayVmO9Cg5Bu?r_NHxj>c~HgX zSXuebQas|lF-|d@S3=I8rf1lk0M5|3xetF!Rt|dgj{$IUQTdhZyu}F-3Zv9Ib05n~ z%aWu=W8KdE$OHubMjGys^8H7BM+g>rZZzgumz?YNI2Dv1Y}}CrztYp89Cx@sBPhLp zGmf8t0mkMjC{le`n`I^t+m;s;e#TX=~@ z8Z*`lg4d3rEq-xQe;Q~0xoe+X>n9DeFZB2YMJ=^Iv_87&x$wlq#Rqe%q(*N4fkZ+( ziswQ`SkTn5FQo^~y9QZGf4}JN-rlDz+ZU7FcaYN7Ugh#zeK$zfbne2Z`iE!lB-ExZ zppuO}WB;SfPGI?eVcY+o+U@@dnf*V=@BcD{a_^Q2Qopc1bElCjYSq^m({Mv# zM}Y&ohUn|RuVQHXH&lG+Cnvr8^NSkw?0-k#XxF8&z!5-;Wi!ON)Lb%qE;k$Qhl~K)!%QMI+rqTtk?AE<2>Q5r z@>*fyWi%0!k%c5Bp}uShgqZmV9}82UwlMl+YqBIp1Sv~OS;^gr$5^eGaaF4*OJcFc zr`yQurq%4ojc0sN&so?J`x+sC0qm`x2{?7(@4g?qxa>s+lSx+}ap1-%1n)o_Kw5i3 z$>)je08D)O)%KhRVB6FfCvi37y4FcJ}9=4079LaHo{Jw$14+&`%f~Iqxx*`d!IM#3eBv33f=9aY%$ie-oHo# zEsRkA?zrFxS<1B(yfu538_rCLv)6jkQBEp1Vt62^5bJT@8BD%O?@q+f9_tsp4;Sy% z`Wyn)?$P0V-?EF?B+;bX9GWo?y1>JG+OCQD?qo%_} z!M@6%wAiGmD!*HIuUjrCl?3<=e*Omk)wy9N5@&w$RkcKN=a6p@nkNu#XuWC4)?6qU zosW3xwM?t?u_a>#E6dYfCrv3AOx`yg7rf2OTzMIHR`>TwSbG8Xl(aEQfSSI%m7bZq zd4;?1FcO7>`FXw*vF01rFFUpAaoX7<+u9>DQW{W4>?M^dJ2Q{`#E;qrf=7tM21^MM ziPNSS*b9C3XI5#-l7F#!b3uex&Vv}E8_#P_T4!rn;^#0$=ZFFQRCG4bs%LxlD}YK6 zKiozO3W}2#YOn+7U9MLO)g3$1U$H#^!u4?(x9yuFe=hAyfZ#Dl(|PmkeF=oueuR$Y zDEQ{{6pk$<&u@)tiDc>O*0aGMU4Bl;Q{zu5eicFsv3)I{J+H^QMi4N$-iOiW{6H3f zut0`)efz^TIlr$Lna$$6Bx6fTvW{zoTWi!OuRDR<<69gBMfdnocR8W4YMU`?T=Z#g zK7+tv;uPSohc!l+^<$9^8cVqWy`fwTj@SOomp1BB{SZU@5UI=mS;bvB%!Z&PVU*0= z_8)s8Tg!J^D5F+yuvt^q&uvI%hQd46KjYEQVNE9ME~g~^!qOg$k3CGT^qn~?aeNal zE*waTZUvL->u=kAvK>?w!6;-UXUC=^6pcAR1D*ca;w`69oc}?O0V`QDm!Kxcx&Q)$ zt|!*1gQwCtNPPU2Z}}OFI^$(CLB8+ng}gULKjjng_jdRn>XOs^z6J_`)Cd{+fZSa` z9HX#Tq{Wb{apaQN9?sz1Fv>fk3wr&4M&it8rXUIX-3$ayy1*G@3SW0Vg~7z~kv-|n zSgEJg0yJO~z!IZ1guNl`EUiL)F3@{(4F$-0WjDZ=GF={`InmsK94nnVJo@Y$i{E#J zhj1Rr`4b178h;M)|Dlpo}EeNeNWg8yGY z`(h1tsMnpZ(UKBoVE4B|st-|Fu3Y38pCY{11xp0mqGILQ?CTq!1YeF1+bd+1Ae?R z;Ko>$t@3x}+`uwS8pJ6Ck4$GepOwicN!3Wax7k_gjE$yP!KB@j!P=mtq(L-X0-BoHXm&0VD#TeZ(EQy*URJ0@y0vZ zpv4N)4`7b4kFBssPeKMKT`JUHL0wgs@5Nv4KVQl@8UTCVe;M2DAWikhcaU6ej|GzR z59~(>I8}H{h|9Lbz^f(fQwv4x6NpEUp(DZUMg>kBkmg4R1v6h*zVGO}pRZ356;o$_ z;lRoN3l1CyIFJC?eDX62ktPzm4_+r6ZqQ?_G@H3%#xScUyOJig4~q6PQZ*D&vn9)* z@m_%@rt~YzdsKce37S7wA|}iyDtt*p>1CJoUZ3wn9;*1}BTKup^I5tUdM0tbvoU)Dgx*uq1p=kom-E~)Fs6T}Bho3dI@ftM!T1tiw0g&p`}9_M>= zRA zLXJnm{Cc_4)~DWwyf26f0^MjfEF1?_t)>duBbg10iSCD&d~N6?=yMIFK0n%O3UR=- z`-A4tBs$c@CdRiVU!>r1z%8*e%n1>XTR&sP!dp&ftNw({ru6<>U%vnF#i;9l@j$|? z11XiqKQOeWE-#08GGBbf4aZ__t)Rk!oC@ImenzR9SF%SxJN`o8u=%X3Q4 zJY0_P2#w4001h$vQk)FwC#E!Qo#vUr)NgjEqOMJzv**aOEy6-)3UT@Rf~ zCrkBQ6F#vPmk1J4($Q1=o3Lqj@7dL3Kbc(16*bc(o<0tmy=z zNKO(GzAi+Ov#Oa+bBQZ5qz#SUj#pWZpZ&TZu8^HkX)h7(LE)nHncpbS+Yj^3GgCf> z$IEeLF?+G78(`FX=(IDcwcx%AAU7tRI|=0mJK!FhX>#EI#EmL_xYn`M*$kY3ZY$>k z4P_guKR_erZwS|$NnrjZO8i`?1TR}n&I_7S*p`S?x1Ej`8Mt&dVBf6L=6V8?SQB<* zmeWgsl(+0i(Z5%hS?}>Y%zHpVJkGg`BI%eB5!!nk3D(YcRBoGX$ru=ll{ptFWf|PZ z6l^?T#Bq?2Z|Fji1z6?nK7Z03iJW7u9~*hDUUgh%{hprw6o@UX#H54UvcZl@^i^;V zgCowz47KLE^Z2IcoLY|Z7&6Vc*D_486D4{q8VGm`U}V}5%rkVO__bYU^0gD7ZnLLv z28}`@z0jnl=oD%U+G4zDhaGjp9i8K=Fk2fZ#E#B0={;;LfR2&m90PaH#1a#Q^1K^! z+i5(wi=znm(TvB3D@-!K^eE*K?hpFy5_OCfi>fq}s+P6}*eq}cDuWIc#uwwLb8=PSkU$g(k}+VKdH`dCdW zdH5C4vEjh0HN}zPi=GE(#fn@x+UoQamz}K1ec#yw=zDAv2!R+vd|O zB%mYhhzFK*jy3|>k?EO=KSME*X8kh;NJQF9*IL>9uDn7A*4{;>FVBp{NLYz?7IWSfk-vcUiwS6+$Q$^@pNPsJ~*u zk?wOX#y`=hdNn8($4z(hs-A2%%a~$t*h<}`p{at%nHv~I&`<87_Jwy9l+Tma!v`RL zmFNpE@z@*9Por~&|F+vyq4m1}qiud5x@$kcjdAGvor!HCK;fkn2oT_xPz9Hz7slb= zj?m~Pns$OV=vF1b8PdF&ZJ_nKMAKD>If}gX|1Df+@U(r9T$E}*b*z)=C~siVB*=={ zZ}7L7+o+a6U`N+ro7Q$s%N zUm!|s^d-zEkZk=9?@>*=eDCn0`Zq8Cu_vvH14nLVdvQ znGhY<>Uem6fYF&(q9yA8JxZiL$z#*1%W(aYZYdW#!>BiWV_SGYA+1Ge-v}{4pU$Ae ze3OT6U>UwYQa*-CFjPcw2Fot1 zecgWH`9}03`?lA0E;I}t3IIYaNBsyGagNaO;M-+`xgl1Rnzm*O8hE~=@8IK%y{rg74uk62# zpTV*=EJ2bN1uriLXw&%O)Ff01AuPGiiR>@-5056=t(-UR#&KtU zsZ{E3Kg5K%wz$!IxGn~GAmq|Y8jZyoIJP$@)@u~3Y)A0&yHM-Jb`3R5F&Mg8`Ne?C z8xI!sm{w_x-X`NXq2du29!Q3=A&qF=k?Cl!_ePhRJIS>B(Ppxwrgkj{!JuT57g;9! zR}0|aohE^gC!!&Peuh!Ct+C2z{ep;XAR6KU#$8asFwJ&eplJ5nm4~m!TU>|Hn=4d?^!|g3b zyOVLrn4HS<(tYMh70+OXM$X1*{b!>A{%CG9hl?Y7G{PxaYI;q{|z{ z+wzb@3Co%mbHhA4FDkSi7Ke#xj7bA^47S9J^Je-pZ|)V9=-MTC2|rhqQ!0V+N>(dc zQ><4KR^n>C#RzkX|2xZbtF`tPR}dD$W8t~EJee0IcVf>?mUpoSGO^ei#_ikd*>Bxf z-2aWVcMh)XX&bdC6HLqrCbn&7Vsm2Kwryi#+vdc!ZQI$g&z|4&yzl#bRp)$Fr_TLf zYOh-9eXriNy05v-DctOyG;FNaK`p2vFIm6*c{VcMQIxshnemQvBL|&|qK)sG z(R~G+9!wu6#cqeK_&O7*zj8-XL{k|`;o5j#Qlm78?tFIjAQt$v#gB?WFAsNyiWpmZ z_&YOh1q$ul?ncs0+k7adCcRSWMjhSGDXg!oXu7&bHUPME?Jd5*t^j%P!5bTSRgU$U zNuBzv2{$w<`!hb4{CNXZESh|EeG6M2yhM23&&yLyI0pLSJcy*LYe!mG#z*Jj)gxGA zwJ0R2F(_+~l(Aw*o|VogJzMd|yhVm!#vT}-*E7@PZooNW$W3=-v8$u&$@5OK0OuxS z@*3CK3bEO<9 zE&h;vxjBsbRsLb^Orf|cd$+PHe&=}P_w$~Z6qmG&H+(UZ4~gvg*zaa-V|5!mi>8a+ z-;yx{dc~@9DSAZTX49^9kiuuEI(@m>m+X3WFy&!}AG zUJhoj99@m@R>yBjW>JDDzvzt-KU^Ao(V zw>p9o$C|fi8;zejnhjQKGWuRVxStlsxYyUF5Z0XS71lyI*OY563ur2`^)Af6-3*Vp zAnBY7u`cnmUlVD_s1jL@4>?(aYdEYi@oM@MLqB(a^F%LlSl_%TxZoJ5?epMBGBAEZ z(YybS8sBzLuU3^MmBp9UKQF}?e&=|+hAmlIRuqhLyjeZIwI=U~AF|%7&n=o4)dl^$ zB&+7KuW6tpg7j^%z%JO`5py+~vo7HxVw0#a9^w3GI84*i-**%6|{U;9hU<}L= zV6-li-H;C4FFG>)ncJnAtM91IrOqNVOEDc{Rfm7AZcURTRI!WCixb|+G(>1z0aX9a z%on9S)q|l{g^4vQq-o^eL))B{?V0*&4V(pb~~uv z1Y?6eVvL3?f(4t*%j@)v{)g80g<%k|z%skjZGPv>vY5hmMC;?d&A-Y zO!yqxvweCTc)4RI{`ZeNGbCke_MdvzoUe7wfSYe?NS&W~4cW>s;UM--VZ;q>;b*O6 z`owXyvO2+Af1-k5SmiazqE-8#lrJ~OMY9X?%Iqx#kvSg@25G}E{BizNn4zu2W6vO< zQlkDOuizFEgG7qoGh6SBm5w;NtzKcX-_lCJa9N>H=1%Y3jd@VCz6$(XaEoP?UcE)&IovXj3Lgdq+rPp#~MWOt$AzA-8tdBg;8cL5^o#CY|ooB1g zTbiBXc-XM-M02Ux53m}ZS-qGJp;|Rv(I5-{I)wCqv)n6+cV1F)1ovKxnefM6tZVe; z=v==|5y4>Xpo-B^uht2S3_Y>1Y5;! zCMeem&c$1fT)F0cm~fE#ydrhZN{pQV2?3jpgurmX63y)C%d2bY5+AvkMt{4>U@ey$ zB3eFFJ$cf4YluJ~@~JKp=Cn9IR&@RDL8j%@@qmMcPGN)(6^zbW;2h12wU|voM=7* z%D}C;ln;Yylii9lvt0PyS`U63qDvP|hV#6Yp;M_at>_O;HFt4L0H-Y~>Q0;@q)``^ z8ibmNh)7i)Xo=!i$eB^WC+?^p^beeuFlWX1pQFWBHbr7Z`tO2>v4Y6)-vvaz2t4sf zAM-iGK8kWQwOHP>krRmbkat9o<<`b@Jg9f z&alGrNb_oKS#2iGGf&>fhhboe_lY3ng~`Y+PYcqQAN*PXEcma| zt@osk?3qC})rV>PR;C&!zz&hF*&ilM`rTIkck)DO26p7ra`PRL%u71s+bMCh=M9ec z0*LbDYepq_vfb-mGrhej@2l1iY%ck4Cg=RK4w%2#oS53UWmcW7g*Wc@3_}FKywD;^ zsaPwam8=QWz}?utdItt(5kK?o&MEz1#$?S}vlJllDA4u&`IE9^Ha?CRsxSev7FG3ES^b*4%@C!gYh*GV2&&pIQT z2wqjmy%`eOph};6@I~~dB0WK}O`Wdo@&+{GBP-+L{1jH4bQFhc@_`pf9AZ>^a)E4J zaXt?%yU@8c%9lUpo9g!J&U?s8r5PhClnHyuF<$LL$~P7)cP*UDCKskTYLR zpIB%{YcK3qVin9a_@UEhAM`P}srC5+!d@o8=Y>N!Qj!GsM1BtP!&}_-vydC#O4dKG zZiaE;wFSuwPR5ooA#Eu~I5JmssIbW)63G=P<--N$am$kvy=Lxb^N!SJxGRErd7VGs z!OcnqxW1STOL=5ID#s9}Bnmq3fB=&$4@@%GhHwLhEs@|E4xxuA%SFTL*I~M}9_N%sFNl%_rZZcdEqi;`{r-^JG(ESPk zg!}cn^lB3C9ljO4-2P6|%rS3XU|vrZS|=9jJ)==anB~wsg8Wcn3YAV5C#$0Sw(1QZ z;VDuVEdWb*q1X3J=^;*Y>{figcJA5-LGUWH|lJ1Vaa94(Gz#?74B&3n^Xgq9g}!6 zYVGS8dJ7vxnD?AQ=!GX!f@q^i;X)4T8k4D`MZsJ(eUXVvYm8^$6q_-MiYNl{bgmWX z%f@ni)5V$!yc;BDBq<7Me$oCn0#o|5yW_IbYHJ*glSkp7kxy%(GFr(68hHA)0h-!) zGntniWVI5eqtj4cV)zmFFq=p3;AbPPreBkFk6ELOKR6)ARzt*OBnT-^+&71%xy@a^RlRRj-ijC=@m9?Z1*uA7uq(r2Y?ilh=&*B}&1Ys$!jzBArF`15= z2s9n`-ig`BwMO{-uHcL7QNF@f@Xz_`qXC{?36^cJ-{d6?Ngea^qxGvF=n_6A+0-G07a~^@pk>@ z^E8?{wR83PYd8HQo``jVIEO=30g6 zMW$szuS`-hqb8LyN?QVkvT;>W)kT=*aEkQ)h^{1x$>ci9{!$)OXZ=w>?ri|`@Ptuu z;AO7r?rqB7HvD(`Oqh|eB-OOu3ZKY<#IarV^b@gW?c(^}eRp?vvddVl_sV(K)(z@+ zut>uphCa3XJlKu<*I`N=h)hL5OD&bJZi9koM{*Ed)ox%X`lIY|xH7YDM6KR@;I;c( z;SiV|D*B%7w>WUryg}a)a%8~!XmWj$UGH*~M)seqq@8AHd&FusUux6oGvUBGAC+I( zD;0vVMuz`o(z!!Xdu$%1AGIQb_ha4cLbQ=GSETR z2ZWb5_zl4v4^w7gzmdeap{;FzEr?h$EYjn!96OP4KDG1j*A!l3y*0^Zgzt7K!;{D8TD#>wGE%$RmZm#78b zHf>P}gaJ6gn>8M?xub~HbD~A#d!-*P%lrEeNgtp1A(>ht-_ab=a(N<1LU;Mz1F`B4 z;2Vbs003OOcc@k>8*=P^=u`?jAMHFDb_-{y(tf{k-b`!u>kTw4+FU3+tZik&N@2T& z(&pNXP^&j)s2T$29x2MPW%c)Py*g;zUywY^h064~BGdWq4O6_tWV4ts`n=)9`r68Y&Falcrm!980*2#}T)N_ka#E zwd8+ep7Q_lqGt+PJ7RG{L`cPnwfvl%>tq2$TI!xu>M>JhOre`ct_>=bF%lVfcTO`i zvzaaa%DkwO6i&5gc(g9u!gs zzt>{j)~xgNS?|s@5^Q>jP{)sm0bl!=AL1+qsCV18-}m4|o|;RBENgX32o3KIyh{ng z2`Lj#{YjJRjMFEMT`wmKQ^x3A$U1Lr_hDagdADC@WM^LMQCsQ z^xo){>TDBDfgpRbo>Z7Mn>seB$~9{=>H@LB%;sTA=fJb>%dbQ%zZj;F%H~b=zW1>J zEgS|}r{yC^Y}#GuO(tB3TsYC$+(u-Hn>+DX6J^^$eVj1S1i*wQ)gaV>c zT7>i=<@uUuO-f|*`-PALQs*1fhN0Oh$cOnMA&;e$sf~He4d1N4Ifs0MVu6T2l|1n{ zmppZgDEkC zn$JkK>t|lmkd7;BG4i}sq`S$K@_hm)NvRg=fu)d!E^0)N6=s-5j`~j=ci@ulx=8nY zs%jO^#`}-QmEPO#9JRe>4iN5Jh0%wf=*)_i-#Oe`~85+lDm zQfq8;MTwx^d2F$5?Eou?KSPL`37*L7$|*MqI*k)FT3Yh{8XqY1h0j;#t3ZZov#;pl zrSYD2m~j9Z;5ahmhay{|k%RVjA>G4vuh3CC?qQth(DZ@=C+DW4bLLDQaM8F*4?T!7 z0JR*%*4pT%;>dO9R&hO-lvvg?e&yHRlikOZ<@yJV^`o=Gg9I}cV^Asr{NcO{U#*^l z>hsEZiZ@fH(~#=zs6%^;EzOV;fjV4QW)GZyf#*FfMK6QpMHk)`NboVnSz%F8h=LQ8wN|m|36c;pRl$A3DXkOA*btF9Pbgo{ zz$*6$SQX05HIQa(>yT`L0vYp2ZpqERacps?0nadmJ@T6|_rTo_97p3Rxb~K+Sct}v zz35Q{P#sh#g#`Qh#gsXXZ(`s6h7@g!H)*m8TgRH=*hVUoH<5q_wsGzHkN)^UtvsB& z7G(1+9b!xs6eV2QIE&#-f)6iS_Mf5)>X$8R=eGus%Gh3BQAu3aD|ybiQ4_pNZl|3;<{VuV*$IJRQB!6K{0|)uHdu zI(NG6StWHAQdt$#EXjPJ?_Jv0avpR^WkNFyPOdXr5tDsB>MSm{rI}rA37pNxxOqOC z^FGxgEtyms+BjXXVhrrbHW!x<2?P62oZ%(H0<{mWP&(nNp#Oz zL$Wza^lx{C<91aH*gX;dfrE&hr~H%0^9};dLo0SHnteFJQqw1(6P3->`a;~$@gLxF z>Q7?OEt@>{ujGHg<;q`hnG4USeCHst#d2S&8@bq|J7Rof zj+OrhUH%SRZ$`HExm6Q+7(VcUTbm=OLg+Xn%d1{X&XVNYTXxa8X>19QMYj=+UbGGY zBHw%?n@kMojF1%%`tU5ayCHokQZrj1xXj)hU@gTRWPKlV>NHw3a>Z$Tx*jo6Z6HRy zcQLxh5SK6&92<;%{@;L02AdTb?7C!uQYsgja3bE-C*ZA`^Kjvwa zytZGwQzmFkjoAA)BahvGTP#V8Z5k)fa8_Y;teuLpU=2^jTqeKUNDNw<3*;|jREYdI zZO#|`3oqTk;cQeVxV}062jz~yfS^iO?0kRFP_EX7^OY&yOS7nY{@aJ_qJ)1IGW;Uz z1d&EYLGtV88mzr~&R(f?M-R9U3*~8`JCTNWjOKB%=2?Q(;Zv&Cr*sMI6Ia;vXs|5*UZKBD<#G6#xD7lmq5l8 zQ0quz(f$SG8R~Cd~E-QP*Yu$P(2V{8q45G7=YjhTxn~LH$`f5H$Nz~J~h|b_Ba#!_{u5reV16{ zTT)dLt(l*M#DgrX-|u7guluraEHBOl{F#bq0bC#hPv00DvSoRf12oWp5VKNP5k~B1 zf^`QJj*Q99T6v4H9M&rF=b;JoR5I11(h?Z%?E3sCL`?K7jp#T*E4jk!GFZ zZAVrKPMCn($x5+m3%G|;Ndvo&?&f9g`1HUzh zc{4d8{v4^3VQ|NZ;%1Ld7p+w2)cEU|^_83mntIv|w0$uY0CKfD9u!6e`k(l6O+REs zpr5W&TW8xI^<-@L`olC)D^GFu*WCEx7fSdZr6g&gEFjT1AI(SOm%R4_5IAQI9Y=oY zo#}Y_-3L{gO?QVqE*W_yF2?V#Pn_F-pKCI3(1*u92;{Bc5f_M89L`N!txaO8Y@Mm~ z0_l1K{14^4cYsIz!(k+W&q^2amvUB5+uPdwHds4|tE-)FdW*7@knUqQR25pD6Viu4 z)xSaVmLAI$C&J%Ti8h7nXQBQ}IaSpxTeg$`%LQ0Z<-+R1`^Mu zUqIqnp_C6LvL;9I-@p?r^5B5?f!ZyAc@E!rGBC1X$<1X!%zuR=gO*dwUB=+F$l5r$ zJQNMoTHo|dug+O{&N`=H!~DMDZUgeYQtQOzCD?{F`owWZf@UK?wVR$!yxSWOgz0wjC{)SL{qpKD{g!Hb75^-QuD5h(~SQR0=7yhqdDoj>p&{&(8eviYPO{lB} z+byq8YdoL2yHPYZ*%aL;Jc6S~SM_5H{zFN{H9Hp;P=-E3d5NM>I2t|tDoj-#v_ZeK zwGG57l4-Us1|>mXHhsukHn*C&i{6d|q9*lw6`k2gfG|}G)k54KB7fxnOi>}rCzh?S zWu>tr4~qZ40@AOj3)Ar&jS%|X zqE~Tix$bl}(zxG_L^j46C-28y7&tz^v(ewui?^f;p94iP(A>^j2qIgou`{Czo1{N| zGY9M(8x%M27ype)-!6&cT&YM+`I?hUV%cW!@Y9(v^{#i zkSQ-(E(hi|AU9&BGa2KXf;V zR55~E9m5^s;&)f`#vP4XWKH#!Ro%wkhS*7 z5C`%PF-5uBwdv#3BVQU2dW|zUE}&ES4Z_yU&-o5*;O<=fIxPC+X~61qww(8xOPW$vR^o!1AtSfjCtvn(9m{bu=3{2%E|n{jtliNSD%g&eo(GQytLQE(>=u z-30P(Z7II?a6xAts)Yy!tS;r?(p3OwEcSh=S~vkGRCO4))n>;Dg` zJ{qI7U!(lF0d?E|ppvLwl&O2WA;Gp^p;){$8sS=tJzJyHZ*k%4XMvNgJuMVIzfwS6 z!*yEG!A#2Z z-cwF5$@R3=)kQ?*{ACVL47%;~&7sEY)%lD2-7!eub(@!1$;^+&l6`z_o1Fbz@QzTq z4;vbY4$P6WoR;A*Su}=a{TgAf6awG2638~P&`94&>|Za2*^ygT#mkqZC5*b|27M(^ zJNHjSt1t@6rID(jT$anDcx<#()ut-fs}yywNRepzv+LmHg!_x{GJiA}jM~ zfVLX+l^ZeNRbQ6DaB&TQP{NvgWFP8JdeyMnwCS>vJhjOGM6&+^*NPHIL^-pmwX5S8 z^Z0Jq?6<6dE;d$q-IIxaD6N@r2ulXm$U?gp^ED+i`s3~+D8w>j&GKc{%8#8rtQF(Z zrnuH+DbqeKnpeA(2)mYmVSi|OgKo=3f?@l{Jv>|VUy1>>WxHF2g$s|5*zSQADnvLe zVz^ub(O)P7a4SWkd_%Q~cI*po4=Ri@=$-c#O{$8GXog0-c=2#!zVRbYn>SMHbYf>u z4N0?YD0V)}BZ754?ZP;6;w)*oXg%XZP>*522CI*dr6ebZ05xgzM&%91(nZ3yTU$@Y zZT*m5#S&rZ0sYo@3^GOj{X@7g9!0UO+I-3(dLo0CsYrvzZUR*}b;me6-7oSHtqPH9 zaG{C2^Y#Kb)FM3UKC!-PCG2QFIM$t}{>a!;wCnv0TEuX!Bn~}>({KD#KBMVhY|hA+ zfg4P5jbw;B_^O^C<(f}ZAr-Z0oAfX>7hQ7TPF4Hj;7L|yH6w2(-9OJH-{^rExyT-g z^m>)oSj?j6;6+(7lV&;3lDPrj*yB%A%X`y=5eVGrtlCQI#(Qx(nOpooy=SleqLME; zaHKBPbD<^+SiR96Ph)9VBuf-~ z^X3Cqk1eb75w28rxM*BLh7S6erpM5nXF*Gq>lT*RW-Ye2r{6W$nvG#UvFP8f^~wJz zD>c026@_)V{-NNcyjw}eVOL|{{%-4+V30)044*hCLIMRvvwMPFClfMI%JX*xR#4!@ z`vEvj3iv3y*>I>r8MYmv*`(5BETP+L8nMdf+pN4kBJE`J@p*u;{`DiQ_JfxJuA_7R zR3g3?AR>mWZZ%@`hWDE$xdLauQ z@RJ>~9pJkprl{IqY~_|Io6EDhG`?b^Q|vG0iaPX@SD8_DiH`ze0IcBQr^`Q!P?4OD z`?Y#KukBsBJZk9D>_PVX_`KEV)pV+EdhM-%+fsGFF8L@)*Kk<1GNAcQ1PrO8$CrRH z1EO(OCkRr4<^IWh2drXIuM|bLW4LBpxPaP4ReH?FhISKEGV#e?+;}~uCi9Ucd`CIV z3g(!ap+Dtb3>TpXuxyIBQXduc`5p)BMR!RT@oUWzqwy<$430t<}iJ^XC9CC26irButN2Cf8=-p_Em$4FodO-|>tmGp2Sf=Tdm~xRC`uw8J3# z*zSX!ZzjvJhRe--KD!OWObR*MJ|MHH?sNTHRjwa3xN_0U+`i;_p*b|ZKldS;-wgiZ z91a)88Yy=G_xa3ciyie|hbNA*=WiH?(}jUV~UkQ2SLDR zos8a9lTODcK4fz~sdcn><@Z^fUS%_hTh8RI~8cSrws4@MD{oT+cUM($j zy6o#{RrgqxJ`$oL;&tndhhV5Nih57Xoc1p)qpwwjfI6lT=tDi1GkLT75`U$HFy)!b z_^3bM-M`K=1!@Van9uo76bL@N#+6+Nt{CrK!}WWAHRAmqM_sQeN-+8uArqIHDh|xb zDyycK0}*j!QY@eE5T2ETJ@^7yE9~t>{i?>PAZ0AtA*NEP8Io!6X!KTIB{}e|drVkw<~z{5! zpkW=`y~(8)xSkzvSi>z0^Ror{D)sv6n#GZrO15n2Ap+8VA&m&-pD2%rMC)6ug$`Mt z%DpHsKn*=ixm^yZs3xh07QIh!Gq^#1Xq6gjR8vCLE1mq!yTV2BqQQl~QH83~t|00N zW60ckM-)jt5lTX^*H+?W5~#Jm6VW-~;;4K;!}d&A(LT0=;>=dWQU-UiVb?{g=E5s0 zor|wm1tOu=m|{#Nctt6*!-%&4dFJ`yc7g2VX%$$?b-SxM zF2y-*P8%sl-u6C$DaF-`sjlhbXn2H)J?5N9a4q@UmUn7fnn}F#9Xa!#q$;nBy8@wE7}V>Az0nCsVHl)1pX(dMeutIKGc?P*lJT zswMAS)>_}&o?&O=W%AnfcQl1_C_Qse4ljskLst@=ks&YgM&pO1=h(R*mDp=H?k7i9 zMWr_{tTi_Dxx2+$%>>P;!9wqv+t>HyC?`3bmq;hkGkXUTIH2%Lb2tPPe&tJb(A-^Y zeoAj%kc%Vt=wAD?@tXf#*KO8uY}>H*@6o-x$4tchYW?Q1^%=2I`^HE7U2(2P5SQ=$ z?!t{&s@-23Dh$IKQ#4s{E1~Pv#G5pG@Fo+(&56vJcAVd2YpUt(36qpOQcPD(%f8!m z1o8ggy63aqj;3~)ls3jz46k&;k4*xkUuT_nZ*NS|?{x?&bFTUqAEBOzlCgj zzr=zQH@6#ol(Xk(y<}6+vjpP}-0EDdG~5NvEdfPf&P;CA;1F2{ z=5ba_(tYXGHGJlu3N07Tp^#}C-tXeyE#Zb|#@vJu3EV`(zg8-PrcsHAo% zNT!SqG9!iLxG8f^f@3L7p#l2;^5x`G68-5Npk7kvlxDmp5ciWr-Gw08YlRJvB$FdIrF$GMX8OCoo1*B@472h&wAlgzv zuYc;p**D{-lua=$_*E?=W2G}PdQmKPz5=B*EsGEI|1N$`k^X7%c@IbBau^<287Y?K z>2dg63291C4ZLnW>KI$YyCm*9XH!bUuBj?Ae|=Vu{fd+>D@fqKGXfJK8INw9C*TAC z6aDoVpOheY_!19Sy}AfjdUn6d(3r1b180}G`s|Ca`JRGsIHk7;QVBPd(;JOuw%!}=S)fPxTdHM)>J(Yb%7_WTN#@m=7;eId2bTsa!h3WpPN`U$n#V)l{Nm9= zl+Lc0QeNMV3OM&_GllmE+u9uGoJ8GOIiiTlfP3)c-s5TCyn%KH5+oROGmDkSNne8c)Cj@5@)pn>8*F!&LCs^#i1<&HYV}l?N7sVX@hg zfW_SU@T`AHpw-f7%nWAq46+&D&gU^XVlM@6mnLH*{1%$+Pge8L+^)l5dZ}N~LBYC* zGqak6U7N?sy1u4vRjRXt|MYf&`D3(~XEk(v=AkT6wPOEdz|F{uv@{aRt9ln2mmc-E z5lA$#n5*J2baawQZhbh8mDYW=+Qh`nL~c>jOHU7vPtR!{ z3B1hGMH=MaHw0q1@V0xn(zYk6ME15CPF{K++D#kPy`Ofzb$+~9fbstXgY zkw1Vw8OatBizy2PwL1$zZ@jg##^(w$=O`GD%sITzL0|~WG|jq5;*9?Qc9J)_dHP2< z=jaRm)xOUyAuHCWv!P(wGss$H z3T_sg2uFH0kkw>}i$z85K78ePPd;-+XOv-*5;+sa88877`*{Qc1eIMS(_Ol!*tHdOifcj6B`uLwU(X@M6LQ6`pggDJDt zMq;v*wNrDS-Qe};$l8H}g9ml7#}nr&m;YeU7kXA7%{Ed1G18Zplap&9hRW9L9s7X& zms-|KBJniV@j;yc{a=4i;B}1gVvhFPhuwG{k@8r+JY<1>k-8`26uTZJqbF zunsC5!yKLul0Roifj*k1VT1YwURKe8ryOaLB=$kHF#k^VRH1#bLU4Sb0zWWvmE}p% zfK3ArQWs8D{r)%1QUBE_xe}${VZ#4U7bQj{n@S{IduXz6Xn&1|{kQ#d>VS*Ye*{Aa zL&%vqT$o65#9dld{h7@SOvIC<-OZ({=c_8`>($-aYD7T+5aqht?=`4A?-;V!a3lmg zwQINYLbbO&Uw7GDZw<8FD69B9KL)&+ZHXzMV0E;qVOLf!BvJvt{M*PMR}{&AJ5F9v zEEE(4Z`YhEL#``;31`ijPCT)L{AZZdPcu%8?mgS>yWp~}wwq$W&0Em;CvjA_@L9i& z(5iQ6fTj~wJz)u4yo7M*n%xg}iD z7sjRv;K^L^-#p5}=SmpY#dU7RO;nDdJTAz=|3-lLLnHyJC46{nl6WjzGM7xupP%@D zOeZQ*ul)w%Jr}MTE^e_B230GJfiJWwUuI1E3c$O{F z)~;zi8G%%e1W!~50^FgX3EeY8@xR@?etm+TicQZHZ{kZPtQOKrL^pBml2)b$%0*O! zujl)R2RZO&3>sD`LM-M^Cq8k`$!ml=4z5sydCkX@IQoiz9|}%O2}*I@_O1txtJ%qr8+uiNEp)94dw@4pObP0%$p6Uj@`8xvUPS=3azm}*$V8U(MNRq}2SQ8cvWYC!B{m+ztStgbii!!S~=gv?DRhZMsSYoC$wwQptP4lU*pyclHH0&LMgp5FxTM&43}R1D`1 z%W#RYc?M40H(C_h!tk0s%(RRjLtc?qb%yT3I;Poqz>pYJ&9CJGfxd084L%(mLiJL_ zg1K-Kk#h8cx}ghhv@C>XKUdO!IugPBhz#nMs?zu?2)BK`$tlg2WbiAJe)EZKqzFY> zC0{LImGhT8dob917!#l1>hjy5vdfUBB5AZ(o<%tZCjPg_)DZddPc zVq40IPIFt-4#TUyFIFGjBs`3^u{|uZPQ;p>k)JY}B7evSOl+XU;=zmO{7blEHAjfo zgd5cFc`KavirQwyWbuA>6$Nl~c|lAnzn|RCgq%O?q4*V@6ewQm8hl7>`aFsTf^~Vg zx7O=iihgS@pY#?01qBVz5x{W{Iyuh6aghLJWMV|7ZOFFKc28Dv>u|H4v2aXOVKmw` zpO*s@{xt&*GR<$V+o-O8B%D{m8LHo_2`VkD)R+bcL$Pq7D)xPvBS48OSuC zEet9^EQ2L#RS<)-I(h}*d-Ey&{+&yJ%p;=4zcu*nSMska7$_AKL}DcV86;+cMRWSF zV^bj|)P$-$7-TefhNA(4d5!2iy&>~PJ@9GfhL;gn9OsI%U}J??L1_%v`@;3OZ5UQM zGm~hrCO^NPPoh&>zk=v8kvJko08+MvDH0oe@waMWp$hi#o>^o7IFdM=yqbc5n-QW~ z1aef_%@29bva-A~s8Rt$qA<$rD~aj`%;G|*TL_soWX$o1VOtBpD2nkZpU*A0-Dr-JvHi(P({SSOOeaZDw=^EAW%-!XRD?vriIR z|9y^gG8-glJ&}DU{U`KG>g&lPIpym4Xq~-@9q!Y6F$g#Ell%&G>a(kfL$hI1jLraP z%DIFa#Y_)sjV6%>`-6H%z#KP&6Q~;7M|EM-@_)GiiCNKF+#YtUN9);w63rGZHm(V2 z0RM!n{7VznK7CTH@xWfd6V@m4|c2q(U;N`z19vZ{E zw+66tDf&e3^Lf9iG2Y;8rnUqII6VkrVqjooU^}t7R#OG`$vgH$PAFR(w9ulIRCJ>& zPJ<&QtVGWl3{?c*D2;|XW1-at`cgPwGFY9E6YwQ=Li+a!#*g_USLC!ah7zvckb2mq z#AsJn1$!y}ehoV&#TM5-&y&J0FmPzAmCOnDd=lVnGDJuU%?8-xA#DV1oDFF3Y_yC9 z`z|B~E?EgmR3wZ<4pjJ}8*)9)wa!%lEH!!w; z>l32^I|XRKukbik*uNn|A)?Pf4-EFg`JJ!gUxMU}I1&j^OIB)XNz+S(dMP1ED;CRS zo$_|R$V>O?Hya>_Uff~D&PcIlIHP>!lvtJ}rqpZF;1A1#GPYC>1tT)eD>QykZLAVM z_uxn=K>{@nVPh>XUnPqQ?eY)zjf@W5NC+IV=5*`IfTzxrVcyTrV+;)U9XRMYYsd{G zI`-$tot&TVPIek$T$f*F#YR-#if`*JRHbv%yGRH8dMSb?N0--SiZuSbaEVGUIW@w6}r!TP2&k z{-n?6W_%evH5vVtxaHCdxAPp+8mBq->lb*&&p&G|pAVlkfNp2r4Eofi&8^T$WnRyH z_z(B1wF)yGGE5z8?B(-_QrmA z&fYT+Q!J4!5>;a`$$r^dfxfch)dH}ouGNk4FA7}db-{kr-V8ZEw{(wc&ko!2nTk)v z!^x-ZiZ9!;d}-CG628?qzJJ5)nga7801ZGXm_(K|y?BjGZTAi5-&2iE5R{p;w65$5 zs@6&CpWQ7}kUriZ6_cAZx_O{nK!TxBXBKQ8J|BkpLeNx6RrJ;^qo{}H27(_yRrRi2 zvK3uHsz*r$`V;`2gB*2!@V^-QrYJ|Ew%uvlwrxz??rGb$ZQI?`nzn7*p0;h<_Q`zf z|IWo(|Ha8ovXWFKsnp)JAH44qg|M~%IqesH+I_+-==b5pE0MMky4xZXZZUX3yAx0U zuFmmFc63x$`g-sF8WE?VcdcrAeDJ$LA2;Z8o5^Cr>w_}GBFiP;*QLhc_Ajgr?YO1Sn5?z%xa6-yj0p7ne_Z zKQ5o9W`xIqmUqtsimhvi`hAb+#mYUJ9X+>nSI-nNg&C6)Js>1)3i)o5Ia0NPzUNP? z*reRq?FViNH9m##W7iW5tMh`)M5=xI=TF8`lCw%0>(6pR$rw+^p`6gU36S4?XmMRr zuLeLBCBMW6r4@S&Sl4R(14U^l?Ka~`L3w1f`gVEPs@DUy7}7TToVgy(B+DwIUDlO7 zml^c^8ekK++$e-;K>?;M&>6IaVhpDI<>OQY-_d?v-WMYhrfMtX^Hju1`hsBtmu(1 zicJO<%W2&**gN?^&mU%l0j1%a@qN{Y_b6wu!BV5#Vz0mae*D}aF?KRY0d*#mpe!em zBwq+8(32m!a5jummRJ2P?%Tu{Bf@$jHIsO|=b9QWM*KIP(NRRKrOiH-mH3OWd@*GG zuy<|;_v%YcPox8-q;RhNwB&+%O;9u_!{Z?yhLJmSMO5NyJ*{XviKOLR@TlD6LbfuB z9_8WnCPY~po?W*D>nA2TwYmexWVpEqh#;}1wLuBulafM}-F_cU8k1I~_{pt$CLoB5 z8<}gil`STrv?I}evS1&nD4W*-B7E(QO&9klaruxFyG~PhM8ulN#=``)VLhhf?5(L| z+&M&oG}8M8aVW$CRmAEcBzEDm>?|P(O7-h*#Zy)Ud!u(pP0@_*Ptz=XI9&VOWTHJ& z2ZUTbPK9z4+NdFPp(^Ytwa}iHUBQ!ci>G<(H6huMmijRbndcVdTHAd15rGh=a`=*SszF{TtrS&hQf+5oXz52`yV*ISwsZ)4c(om~3xI+1_6ye|)~s=eInAMxCB> z$8cT`R@X6^%o&3qVs@I3`OVJrWF~w+MZX+}R5k#Fr0~}rq#WNX$20u(04ICgVSx*f z^JwV$;UJYrDXse7xko2!TjHtAMx77pZk1QUVBQeV;;1)egtX{5iTjZzS~ybEh@qZ zpzz-80b#aNWg7Wk9crfN_=zM?G1vAU$j@*Z+zEsT^UD*=P$-@#7}nH zA?XfKag(WIl;=cG$<2pT2wOXURM}jsHxzl<5Le&G7&e_C=4t32@X};H<ryJFU6w zz7a!YQy6Qz!@I;)bW~CDgEQq?kX$zY4$6HGlsZRL(c~M$N{^IR>p!Z(*_>OdmZHx= zxDkHrN_i*dOq|34=>ON$o+a*y`W8OJfvF)>=&II-He5$^S$+5NiS!Vu(N|-xwtyp^ zI}P~lo>%dFFc^1sGqCZVH4UFhlKopXTY}lhvzS~Le*USKXc?%wQCi)pIUnBE(_#G7 zmaehwuP5qt>CM)w-3&&$H~*&YU=Gzvqot0D8?p^o%RxC&3nWnpsWRBm@X+PEs|J*` zoaHDcCyM)Cq~)4Z`uY9uYFf0vXWU7BYD0cKNHH4RpJd&tdl(=SCtFHt*y604xITJDA2g(>c7;Nq1q$aSum^LlS0s-^K!;B%#ko; z%1umINs1ckzrf@#v$Uu3a^vPuS%{Hs+6(K?jz1!EXf>5io%ZKDU3P;&pBZ)z*_RnF zgPNT`q!@6;7uwiU8vn#9`2JMFaNcdEnWLK05xz3SIqxE0xWaJA^8=6b~m+aTojeAdUwNu9b*iT0K zd}2>B;j{g-fqFZdnC%2|-myPwh?N4JP?qU)HEa}jVKtVhu!1bp3NXA_BT>ZS_RT}2~CYfRixaN`G#Fg|#SY#RtF&hn`WsyMM5f`U$?d7wG3M`8A~w7Vm1>?OJVjcyHAY;W%G zFH@%ZYB|GKCH9+zV6uZWQc%GktOxSsAT{{o5K&HlHPVHr_T=2ZvhV*oo)JRjj#K7i zHE^==<(YE@Qs&VRQG*EfC*avxqSSXZim`%m%I70$+~do2wjo>WY<4#r^px{p0(anX^NmG+q2c2_)-%{?%V_FKvqm*AJeS<^8FF!rw_LMGJn1Dx!G(~} z+*DK7p1o$`6Rqy&kpNC6_!(`T^QpzL{T6lcrybIJR3s&}=165-%iYX2MP1_yCKs_H z4Y(^BQGEhf2C=ye*L+oF^iB5Vg~c2w#?F}aaNpv&MoI^|mg;`%eS{{R$_O_0&KYNT ztSmR$xUYU3C2?+nC`eKYs(o&0cz*sTZRQvLyGe-b064R~JNw{go3y(H`gvp|>yk24Q0SF9*Kpeh{P zj;8;NU9eBPU+a+0`63}hmq&xc!&6a^FOOA0lVK&f{t7I~@yjeRJyKM5{(Y@xM@-u> z3hg~|Z^UPS*VX2#P9j7WM#**3BAAayw$Q`bWux-3_7$J5+nc zu>a{eU6_{kG+ez^+Slax`P^>o5}%YUC?*Cybp$6lel`W?hb_9UQ(77mx3m+knQdb|MMJ3f+t5=a44UfJY?khRCf>ngPg2+Sz(N=E9(Y=L@!r_z{e|D- z?N-B@xxF9uER{=&_UUT*{>4VvfuTL8Z*|q!OmFNUkWKsMd7YEuQ=N+#Sh6c@u2tIf znqu2Y!dj%^NCs=8hbaxKtd1CNeYWZGbz`m?PuSCV7DfNfa2M3>(xV6|f5(&rk z9BpL+XkeDH35*lPCYBxzbE=tB2IE0<7)MV;@PavqpWmG$7n;n`+=X>L#P&4sv4E}L z1(zr1z8rELzKm=ygVehe)+R+n{<8S+(uDRCcvuGPZg)oeNMQoX*+%K#kvts>*y|kG zTZO|8V#S%*P`x#f<1Mu|-`-cAt|8fT{>^chN7s7u{&}9;C(rcl z2gCuCMzbTxG+2V4nST<%Mv&^tIbBnKUeM7;zWZRUu6}y#yc>IJd-3Z$x?J!#M$s|l0I-7GMeC)q8r%6)K=Ab%SSH-YlXb+4H=O!t4@hIP0 ziF+GqKP>=8Z$T+RQ!ay8j=c)-*eA_)-<7iLPa55cpZtAa-sq)kFpHlBKbetu$kRI~ zS+`v?1c%_DYp4y4>)i2-gx_9G@~7N0+uAxR;e_Q)aScbu0Ik zb{tSRi{u9&D#-MnH4Bmoh=7fr4N?nA2ayGqN2TKaS@CEWBE=O&nOvztgc^#qQK89c zqRgv}CSSGJ6oh}d1?v}4fx`oeqKPOZ@s@{rr>1-sp8-RGmy>=cMS2wZ0G1zkp&q*x zcSfviP3Ua35tlOy2N$9Y#Hx@XQrC^W4!^_xx|8u{Hf4Lq-E4a*lNwFo<=kODViOsW*`_Bx?m|%<*`nG*p>xvw`FvfZ1lVr7j6d- z^&zt8P6HuQffBbK)8*+HEXzt+P|mDi9O%n=lrbV%xhyRVAF99zs1YyUwv3%=aiEAl zsLu-(rcAAPbSK`W)YQ%(*DUHF;k@zW<)H1C8y0qMy=|5L+np*?(xGZCE0i*_`?$xs z<-BjnU-9t=O8F%m(sctL;-|qI=VkUE>6 z7NvIo3sc-(PFEKeiz)2#v-8IXCxA!;2h=B!|KZxAnb=WF+zR98XNfu&fsn)}DFd*E zA74z!$$*P)X_ln*r!X z#pwT`=Keq5q`H-}8(csgAdlMg)Xn>EUk;>#y%y|7EIHY95;230q4#HMIGFt07#Zu4 z@mc^<&yoZZ@kzAR&R7kV*ED#skYzDH600a_`GU|WKw5=$uFFEWnsJ10j@vN8Bh zA2SXTK&z^v1Xd$PP@X_S5{nEF<;O$T+x8va?lh{nw4aKA944V2I5BDpIe2i&MnP39 zM#vz~EF$LF2bbCo6^j0jtIs2W@KJsfDwSB-#NU920j5UM!vsTNYk72=AEJ;1erK!d zC%q6#c5b$%D^jv!$cGNB&a>nqBuuYb5u$l9JX54roZdal@HBuDLn1{C;Wck>+0{+Pb9mBe&A~RKgv~8c>Z}jG!yI6Yd zQFv&llm_pm4BB|t#Er6_>_1b-t&E0Q%u*mdlZJ(__Ubx9N+u z337e+fjdpmUa~%0t(@g9cD1*%YNP!pBNvq?5>}&bLtN`#1;~T0-BbNOKY7wKKm|-k z`aQh)-(?&xL_y)D0jl7v$KX7VuK@}CgilDBQ}>aVo*y;K;f4--j%~m5la-Ue!YR234IL=<;onO+lH}?XMbZ*vdZOm#MJQBtM4{ep z-akZKfEosZ#t#RBBbhz{q<#sKX#7W4$E-`t@T3;7IC**}FEu0_wJp7KBa zM>Ou7VBd9DL$}k9ai2QNx$TI6$8+62R2#3zWDe05Zz&*fw5prsC3uGo7IV7 z{KzlPVuXGn6yttcoWS%n=@oT}JC0jSGxg~Mm>P_8$);c&^b-iUU5wQZXEqwfeP_tZ zyy?s5>va`(D}6q+Mubp{HxSIkO43UBJ*LHdgXnM%;`q ze@vnu^| znaKC(^IfCZr!M~YR&X}JM{wy^HF9Q=Q)j%(9GJ{aIe{zaYJ_4U#b+jbl>G4+Q1@`( zGoJCCHi7Ui0?PYqppSj7#y2TuyL*88PSQd-xTIhF?`leg7}@PU&h+in0~u!f!SlB55Y7&@dZMK^-xsIiSZQo%|Z@Ka(9P}i5vfdtabK=X>sBkql zW_zD(A3SqbO*NM(n$F2Ss*1uVZS(_T=t&-ro*uVI{UcjXlV;ozuG*IPsx-{x`-JW7 znL1#}Zrg6fc#3stzTHglsj0DYB13#2GrX_NBw0tFqTWgh2&5tx6rVO14^#a-nI{C% zvh?%xdBM-{TaoS~$e70joJkP_iNVX4q*QGb7F8DJYFsF|c zmYdAk-MotQ6QTR?;`pQ6aMydCivb>Igr-fNvcG&3w2#VCxcpInFh|URRV@iBbmo>k zJ)SWe#&5RS5;sugcFhQF%9wvp#6%VJ@^zKy? zkaq!<36C*L1$EXD2AW9yEnU2FoF1ymk7d_ooKTKCw>NJKChu>``<8pP)}O?F%(%A! z?~FBtM9Ko(kaG`|Z5}vt=s6mg8!5;xK(6<~ZgWgyPyGS!!D=<)2GUP;q zTpR75^OXLCWW}r}rp+bCR#{)zt3y>l3%RpbYbW zldRXjwKKWjWwoYzW2w~x-!kVq=A8)$2PSW@CPf1Y$`M?4xqzn-rtb_4(VH|JWzTWY zzlMLZUY8!2K!LT)cNN3 zuFVH%_VT|O(a;_2&)J$$(c*iIIjw|!C#tZOHnS1;Tz~zdd=#Hae>%eT0LeJ2H0)Z) zz{dhU>m!CnwgDYOYDX}0XNW+(hkrtg3SVRE#{XuslhqS0%SFBggM1-tJa}~k3*p&#hA+lAC%RsfHPrS(j ztkk9p%BfW|Vu&zwWd|mXy!oG zW=l+Ah6ls89RB$JJhZu=62wElT5G);g6GFA5kM;wu&l=jn~#_`6+*$D8%v)4kEFgv z#HGEBeb~!UJuyZ89_!a&ULzph0;hCOh|}X4uhr0ibt3>zrBid%eawlg_Fpf66V5V+ zu@!2|J*}Laj%eFVxa@!MA-c_4lej!<;gKL4uEGAVE8LY(_~p%k+R!2C_F4$uw~hZz zkw^QRDDa!~*YdGrX)CN*2mONGLh2h<)yZrNQzXr=+w>sw_m+l&+VK3W^;IQ#i3m!f zG6P@}(IhC1Mhj&T^AR&zU5&wP6`ED-QUPm4f)-j7m7mVetfGQtT&hNNf-0^C4Q&o& z5s=AYRGivlM1ms91E6ESN=sppRSHCO0Mlq;>dn=(MrUXE-QA-1`yEQ><6X%`tY$nc z5d>gmlTY22$?`z__0gLMxX<4fRSe*|fJT{sU(>z$QDYi6OfV~0yZ7sEulW~i=Q~*=Cuy7K&2$TdgPXh{hKRH&H+>44;PNaJ5fRf#_N}*z6RB=D_je{2hw7H`uwnE5 z((=vr?d!w)z0(F~ISzUvo*lsE&1tan%Y5*+*YN!P5oG>ipnCSW+jyoi+sU-YCTX|` zWC)IftPKu1kojoabC=Myf-iA9RL4I=7A-Kay|~jgTG?O`0`_U|v)1U01RtWnxNkk5 zwlIA^D!n@1y%*ulb%7;ahClJdZ@<`UT8QC088~_m<(Yl>gkzhxS#9R-rObx1nT6%O zPNL1NeZ0;NW4~h961BK1&CzTSzczPI9Duj4d$1cYO+t+%)Xb;NY)qNAVc{SNSJ25q606z#_8N9B38S~m_Y_Qp-yc2_Hk&kriYSa zd-1U6sDa43cmm79$RP>16ny&}Bw9|z%23kjwC-*_odmuPqEi(=>`hNk>~YNsCX67x zPi)2DTwS{FvH6Cbw8u{F3m^(8S>n&N(;GatBLZ%czliuU^YY5EAzd$Qk#tn#mGPoz zl0COr!`-~f(xEcuk@d7k>*8Ecs*N$S7cA`z`5@UYY=NrEsq(E#74SyWM9L`+!@&~7 zjD~u5E_N;?Xak`#K1s`oH5@2P2v!rgG;n&98jaXOj1XRPIAG{@tz=^GZ?D%}<9sR$ zsPCA_nasskg$T0;ef!A(rV^GvEZ>rr{*=(EGQ_5fn6ChU$bsA-DZ(?E(Ssdv2rDi? zf%}K53KBVC`t9;39Kd{%@OwyvgO;RKPLHDJA4a`kqsck2J{WI$?P;RR6w-7>p;W(=baADcB8w}Hc3Q|HS^j5GIE^A8mv3zdG0lDRU=b%3uXCRa}k zg^mO72&E&oIjTnYCGyh|HOGYRT4uD5!0&eprYDS_*MVK;dcW@l4oA|s*0+X`#o3Rm zFQ+)A4w`-kn~}m+GoE|mebbu0Frh@Cmb)GPYZLooD5TRtL+?R5#oiAGf;v^(QL?zN zc($W$QyAwUmYn&nf)FPDN7@5{E9lBSc+`feHMryvhEiL@;b8XEm%d>=ig$0?d>nVb zJsj!GHn5dZjQK62H8U;9oS9KBwDE2ezXXxQsBeEQi@w@*az+Mb_1 z8@wYLkSNQiw-AR)+djtNoR~aouG*2@E!IC6Mv7X+HG?YC{y}-)ujs_z^W_T z72fxfl(UN{?Y7F5*|sx4hQWIz-OdrqRm-g~H!jk0)tte0R=H}uU<`;l_GU6@pb$j? zRhkXMRZ>7rDA*V+aWMe#mSUwmA$KWaxTq|7hKPCqI=^g*Tcb6JXEC%$CkFMIw+22p z|AzaEd-p|g1HA-7j*jZ8^TYesp&@)2>sbpye~86v<#t2*rY1{$w3=X$ULYYNRM>2R zAfV32h%C}D3n~CB;?TOl5ha7xwUVx8XD@L2#W1cv+YsS=>-A4ylKZoaJ1@(2>i7pI z%-{74DO+cR?B+@L4 z>0*t;D52M>Etqqev-4p)`EoaQ z+FtsTP4`i$%^dViXE}9*0_=L@sKNFmsV)pVLvl~u6K)f)` zWQy};{LRhB`q;1V=)4!TV|Kj~7;Oz6A$QSVUHPuhcZT$P-+|+j)){NgeAMQ8BmZK$ z)wZRF$qQY+zYX)cslad7^TVLi7H-{VhWYk#AOdn?;`ioB_JByl`gDK~!p1kgwPI0! z8ZKe=J>qHy#K;eX!5cQ27yh*PVcExInI_Z)j_vyG%9m50mLP!cCg&3_YrRwOynH*_ z;UQtlqRA>0gwIYYp;vRfpXN16BbV2dB;uRQ`lwhNVKdXrK-iKG2H1$v^t|iQn~x-m z`TY0*JpKNL0tKs|Cp)b+QvY(OG%)dMnSZ!yuc6cVTYp%k^~7_M4J!{+~i=}qlFLxOs>gIB+pwR(h&Fg;=#7n3k$8^zUJ>vbQzv?t~ z-;TVd$u>#zy%KIXeo7~xRoJmqjGyhAv;3CwG~OW$vKn?Kr46DoNJuHRknn$PW%tG! z5@ib(;0!s$dDUP0^+?89yidr(BHm~v=IY~gw)Ctio8mIm)+<$(~a+;^ckE&pdSA3NWq76zY$ z{Wq|#uNNK*UrnxoCzqtSgu{2nEmU3m=~Z4KyR~?S>*vY(SihJZ^Ddxd=kh33XBIXv zxEO2Q8T*6zKbcSp>gti^PVor|igZre7?^-rroScjun+xXH-0+J(btGo&~(5{Nh7Bx z;n5Letqp}VYyT{sTt^fG)Nmb-V#Bx{-qZV1q)EClnmC;)qv#(#a=O^Rcd**Ko2!{q z0rX#!te6!-LaiEejnOn-{NX&A3<|pY*T6ynRUS~A35<(0YFy0qtbApXQ=0$NPGl^0 z0JhbWwnc4ROdPS1Zo=CQ59xiYz$c?NT0lPUvX-wDXPM=2vMrjU1w;qJtj<7J7+lu} z%MD4QPZhuI56BOGlQc(Y@^{+cgD0ku3oVF zEhzR`42wGhIaKkxhljxBxw*CQo{jAo?Kgvjgk|`ca7fZi!^s~Ff4gy7zD;?NU4(Is z{R#o=CI7;3Y2^qivGT}3MVHF*()3Vdhh6*j{ku66Tv|FJIYgsosb7>eu*4P2NN!%9 zruf9Imr8tkN+Jrg*rt46a@oG#=ots;=__YHNr|Hlj?n^1bH)E($(clfOUH*L$m>M> zuh_K5rB1Qjcf4Umcs2e&OFi;k5}>=duJJg|3acC1`OuYf*>Y&Ck8~l~8umB5QV%Sk zR}9nF zdg_|5e|7EsX_TZhwVJJPkUUmXZxk;PzCSYNM5uM1`yccAM@V+;CXd^H4eJ%H&k0Ks z=s2=rP>e&Q1r>2N>V>YbUG->|voF{lr05Mn(i4=9fsm=$n^Zz}ijg}0i z=RjL@>x*Z*^3dU~+iM+9OswraQjdSpXHoQ(l2l~Jto~K^C3Ab))6HjL9S>g>Bl(bz zNF{ti`bC74gOs_DuqN02-?RrIrUMj8Lzb#lladkLtDy7T; zMr0>PCAvVEy$LP7qBQ)vMGJAdRBjG=^? zNp%YFf_~)42*I}ut~!GEfD%iK;iU&$T&%foxg9~!Hw6#dHzQ1s)ZIK5ZYn(Ql?<$6}Hnf?(cAP_uhNh=jyS4g9Hu zM4A_a2bdeJnaT*x!OAnDEJw=h?aC)l^B-ZA>K{bwAp{fzmYJEubKEriX41ODcW7A=dbqqD{+m z%jZlkod!j`s9#JF%f0zR?S5@NcRmdEq}JB38)ak1vP1J-ax@d?k}M38`A*hCTNW z3)g%4Z}1QVmmghxwK#}ne%$Tm2Co#r?Mze?I~atKwMCF?>3-c8W&Qv542&2pWKm0A zXAZm~t-sV);y-qqD76UQm2ZEBBA;(_iJ>jdx{l;8e`6MvjT?wInj8xUDPpNf)5A|H z5(NST`Qm4#2Ro%K!t@l)s7VV>5kl&(5lM#18cy0r=acIPsjCA-W5TiY6~eU>ZC68} zAa|+dm48_a&Bh|(St;q;zg+f9%%zS)Jt{3Fc!lk`N9&9k9Q>OBacITISF^^$lfg`W znUbqf5+V*t8@W+7uF06Ss~8NZZW0!l5W?pdC@LRM= zojoIeIJRlUF=fR~<+u!ywU5kU9ogR2tCboC*K#7Rynfa_LjIX>fTeiA(3 zQHyF{DEI~hncjzLmu5cLK1S;*;ULid1E1x^rB<`oB(}>T_)r~Yz%sHaT$&h?I@pCV zLtw6#08A!2%Pyh^ZB*eVjfl#YTg889-AKm?h{&~i9N3hwT!0W-A-V+@B&Y!lupp8- z$>q*#`_VU0I|q+JD#*fM+!P>Y;7)-NnPo5Pg}H#*3I7*0uMxKRA}GppASXSLu(x=U z(E;S)1ePQ{P(RR_z#1~3i?0!(H%X;-1Gb<;kR9R#IO%xc4YF}EIF<_+R$veq9;>)2 z%$HYRncLoKhbHiOsc%DZYC_|mP%Lgh`lkU>ChURrMsueY_R!Q`GfxIvqIe}$eDR2m z9_NA^mD|h<)%3z&HY=|Lu6Qzx0M}j*hJyiydQ< z-v>zi8o~L3Gz`ubU@;9l)IdCdDx5l?hjJ#AaIz$Q)+ak&;4m_dZIHtvMh1jComw)G z1Ri~uzGg>tC2$SF6|7*FqM2Vn2)P*s0uZg;789=ZSVz`@wcvrUd;r^nb;y(JO>*A{ zh&+8?Nrgc*rWT9QKk~c*1n?iwo#b-n1%dfaguJ^A4YPVW`%lrEQ}oA5SkGqT$}y4? zv7x=XL#lkE5M+u+!wu44pWLRA*8?BB1YXIeK9G4c^qoxAG2v2Osr7&3xp-Il;Q+h` ztC;&mW>D?mSdY2!Fdt!gGYFzU>bjtwsAok1lTbD~^88rXZG9CZ!y=h%5{vp?WTZv? zwPG{WAe!rW^~htSj3XGDkwV^x{JykM`pkk7p<|3EsyAyyRDI3M!01S{NGsYv*{GOn zn4PMvg%mssIBRK!bkzU2A%cP-$3MB|Ge3FRSggFLR%Gfl)WW28^jTIgLOpHW&!FY= z2`z6%bt#(!zv=D85x+XnR6TZ&cI_L0InQ?obnFe(AP3zd5yazo{``C~AYeU%lGA}I zhlJm$;H}-pZ}6!AcjQ?5*=&dsF57B>xltJKjo6t2a~^a1?|^~>4k%cuXQkCyhxT8h zr{3iVnO!uYn_I^hk#H9o4H?40j^@B$l`2er+_{6pLZ%Es9{j`TY~Tm#$geLWFAqjw zeC0lsBgn&6_d9fDrrc@rsLDX-)^V5dMS~cmq5d9iwbo9P&PF}f((G)Er8I+@Rx7d) z0Kde*EKnGfB3>PkeU|&3g#6OnL%L|VV}EWWNw-5yc>tkcJxjBIVnj-vX0JhvPw~h& z!M%F;szjqr(;#wc`Hgjg25xEiLUP&2`Nt^r{AGm#<$<@R^HyTPnDvgp^vQgu$>v zu2C+YK@GMjlUYYgsaoecDd2H21-y$Q_fAkLV^bRU^D5>7BJQ| z22o!0;I_0UsKiG|uXUsG^2c>UJm=-u7?Ad}f(j49{(uT&7wA17l*UZ;gylsdDyP7U z8>u5jD^U`yhud=~IIT(?glv)#S5-g*6GeKa0q*;Xwx{KVRZ78Ps%M89HC%1yctu-x zD5D>a8y8N^7TR; zvh$G;Ju}eu7 zS44AhPH&V7cRI0QK(F&k8t=D-wP+N1GrI+67UuJiu=RF7lps|Vl7c_-Dn zlTEqWeWrdoC9O#%oftSG&z6)a2p9#tbVx;7#EWCdk-7O=xQE8sXa(w0?N_dvBm9Zh z4dA<9QB;2fnAq-TGdtSsww6IJFART|b-PL!J$hMVv9g1vC&(6?{=BuuR+dwi z&t1@>DyxX96v5AN238WZy#WX8jEGBzeh+iMprE+m> z4t4roJJHf-{l&Y-sNMM#Z+nY&07d5dbJln2%(`hY=pv0nDkBC+T9C4YrY!rl(j0t2 ze-z_7&oq?ZB|v!6jTB{odD6b6GYVtA7G8SJRlYVC%~ot-I0(la7E8$TsXknE!0cH& z`4${up@Hc@fM1h?8WydsBITj;Q!F&)D>Sw`W0L#9Mp~F6elAQ9jjU3qCloCi>_Dw@ ze|-+R@(ToWLxHO}qOB#z1{D(Y9d+|aoy~fscPyDEk=`?~dYCGslHqLVZ#+o`yaYBr zpd}^@@*U+=&#|3)eV~?J!2EfC9_;?#Q{)QUwyaYWTTx~d5uOljE(6kR3DEWVPCjA_ z_fC4lSR`DJ^ufrUjj4zJ9%8eSy*vCd6Y&`RGv|!M?c`Vi!WD-2U#8CupU1v|7vp_P zB-}l}NwINo9NM&vO--*H`rE4u&ON!6eg;+x^&iDuFXvfcKWEOsSO>XFk0h{a)4LoG zZL)uwMi-|GPi{drGJcTgyk`3xa53yT8>u9tI6b#*m4dKBPYwU=xxD3KuCiZVB^ zWt;4Vv#fA3^X)Vqf-Laj?q(oT)Us~eGSp?QuDEVHGNb(&^%){sMf0<-SrX!eh!-j0 zL+?2p9UDIZ`6PXD(ds`=C0EEJ%v0q_L$^Bpt34DYZaZFd-_f;P*IF(*zpMAX(gDZh zBt9HTN{+ZYJ;kmoiOPsVQC(faz<|h1&x_&OF4Ay~eAYfyUgY|Nr0?JG>Mh{8nQ%1B z;_NOt1ljCT4R0Mj#rf0 zS(4MTh)|(W@0ClThCd-PoGDHg&UIKNM2Leoh&hS`YWWFqrQ(Eymb?p14i$eV20Nin(Za|w9Z7ZvLQ#Om*Nuu^+5bYDz59wO@K$^-jYypA&Wfh#em#V zK|?KiC18t?_&uzTiUQWc@4vk-03c=fY(-k;FP)=8%^r&(ZZO~6R)FVK4g_DrSrFIdc{vOOYBeGTxx z8b*P{6~vl+XAKpVpel0g!dCn47*QKHoyLkNC_F57dcN0i8l15f%kT#1ZS%#MAi>bo zr()Qq^)&{;P-VJ8xqTkfSZb#;as=q}3q-4X@|-@5F|Fd#m^e9*Zy{N|zAQeTWW#v8 zEP|-}ZUZlMKZA+ux-t2AzL@)NQF9z3YbQ%Z6v^$?bL;6lzTR)#taW^NZ3!N5{A6v4 zoz_$TTRtOD?Y-wIR-cfPtN6$Ogu;6?K8zJ4WocVyWwKMda&uj`eZ0H_lxt79W}rfE(VNSe5TBK{}e-+%s(Mjn1cmi z(!B4izAWdg;FRFA!xwr`pvl(e(9{}{(TyfB z87Vb}CMIMiIrIk^=8!h>_*iwA3fJ<(c$EoxHu_S@(biR5WJBox^#bf?t;*dEW-x)n zRuMm3`gypRkgcQB?TjZ^P^K8yg^3cbAe@+v7#4`*lvY<3);n^$>|&Zeo3{FqcuBA? z-CU8RI4K(tg@nwv`e^Wpf4pHA!zaw(%Hm?}bAC16x<`HYy@nBt*jR1C^1LBvf8PV= zubZ;?^t%t|c=IyQQBsi5Wi?LNc)yP2a2C}59`Nh&e_)z#J4*ujjR%iw2_AB+JrLif z!sEE-J}lRs;8y4z+qq*d%W>!}=EdePLKT907uM#jlQSCNi?k(g9NV!s8!{Z%epUK#5FF)tJmN^1yDqVLk$mGD*!8;1mwJ5Y^F5b2s8 zFyh(Rebh(9@4W;Ne_haZdVNRHR`F(f@%x4&Jvn|kt%rGk%>fT@*^_!~Q^+{s)$l)Z zE?Pi1jd~O~xT$D7qVc@X09&#k?3ZI1xmC+uoO1F5|Di*Q6?PfyZxm1kDgFA9KKIa# zJ|5W4k@_dFl9CcVH8gT>tale|Jx~l!T1(i`G~Xk4Xo{FzJraa-F^(LFEm(%p1xwV0 z2t*9`xA$KQK3wKhHdfMJU{W&wOnd<_TAVXjMij%SLV?;Ai*TtGuUpsFcU-B;^r}#l zkr@Tt%xxTkuC}*6s$i6zEfXajXy3R<{J6yMk@PR|f&It*NAthxC%cqTEGZ<#->@3@ zJKz)Q;lsm>P#qq^InzxUa9)xtP{e&=feJ8_=R;_Axy|`W^&)7GOo_0ZVw4sQx%0;( zXb6g03St`h>2DIz{?baQJAWAO9YC}kcO272uyG*8ssOl>4N{CzBK{ZpJ@t1bXZ?sx#ES2PVYm|Z7S|G`UIvKoqiQkN5tR*ld!b8ke zPjNWIw!X&#@pRGdnd&?N7E*sBLkCU;l%A67vIJ_sk!AkkUTkL43rPuw0d0$jze603cab4gqcNz^nFQl6_mJ`8CbbBUAtNR8QeyR&Q zLrtkLjw9Fd){Po{rt)+NLeH2dxYHOx9C;6nNw=pq)ZF)02_@4Xy$@?vdI5Nh+l>Z2 zC3JWsI9nqx(hOmQ^DuVhK{Guxlx0-ZQN#6OVna_Xt>&~=aDri^Ft|K}O>j1wRq4*j z+x8}$2+GTkD}P~*kCT0@)Ae4A`|lC)@fL%>~ohJK9j6hHV@2imFI01OU@S=riWXbg|bJ)6u-jJ}ZhJMwv%;I$tM;d{6s zj+-(R>IQxt>r53@3%6aAde`F~-;acqFcq*xVrflDeXmOYyq#LUbiW@g5n@80)zH)1Jbf9*ufkM8R3s;sK+ zs?0o@2a}ZCkQ-|5c2d1TF1-_2o;?!^Z zSSI_756#Esa6}};5DjoS(K>MYj_st=^9L5&pFH97@7YgQK!!u7+>A&2?U(-e^RIm= zz9};B>n^pVjA;-$aYFldEQ)HuewXI#9y?R*5ooeV_v`Cwa|v0p2?iq$+dV(03zLU- zJGfOA%Zb{zx3c`B!qM1xv2Lq8T7-x)cKKSGl869$lNqz+=5enop7Thi-L={k$47N`g^TMbr>hf8dO+mw?xtz5TKBbrS^05Ud#gnwRN0z+cRD=B5bd{@79Xq8^r zDG9m#=j8ZvN)pF9AF(Djzg!*t6PJu_7HN_q4V@yr5d5k$IlZLT3x|P zrA%{^g3)?Zc4hU8SG{W{L3;;O|JL)dbJ%j^)%YiOqYk=rcX6^zYHOYm7Mx+}DJruh zB;r@v4eWSRs0yR$g2$5=T(wNL9MtSLx7ji{;XdxaCd&$Z&Dj+HsbpW1<#v%hwlf>P z#_|aW!|>GO(0Jl7oDkoYA6>#G?D%-jdCWN!|MY-q+R=bvv*+>VYDt*LWbDxJ-Dnm*bF{p@qrgIW{h#is`>Vfv zsce$DJ+=8nACd zeycsmVZ1{!FC(SZdZB{$DGXnab#_MxG%JtYs?cX@UO=QBcW6RP={D%kdF==Yv^jO^=@lo&1Vw_W8>f7l^BbzPJmFh z7dPZE)gNEj$4u_*Qxl?m`Bwq1DeO@$CSNht*$<4Vnz$%j2Q(^{h`2sgW>tP&6h(@_ z-eWa%rq*cSB=sK5K*43A^z%9q<5r0;rnk4B(rWQr^5#^k%mW|*X}@KTvgQcj)w*@% zHG=Pl<=5r`1KTB#AvEP1sz17}?Q;#+*>=oXB;SHLB7^E6dk~KfFt}P=db(V1c63@5 zczby3@pjp@kzvXV&ddrJbAn4DVDUF9F0E*Pt~zL#+H>m?3RSGK@%C1Gq~9O|Yvmi9 zubz(B_CJy6IDypIe5sgDpS>%gZ%Bn|UyAK$)#Tv*i5p4ink7J#$hG?lwWu18{j|As zm!1WBUy>aRo1S=d6OdQZ%(iR`I5+XifEtNZRk`xR1@nM6^6i6xMCXjiOq-aAw2aX;7EyL8N0vLGg zfr$m|GiNq#3^5vh*6=bcD1x22UM$z+Jl(GCY1uw+23i34`_5aFR zuVL2AO{4UUyqBC*kU|f753hHev1McMnhUaa21wHS0~8Te);1qGdI)Mo5{%coWrD(R z5RgM72uq7u)|BM9e47JI0;5;&@Ib^^Z064n;zMr6D<@tAT1pD%)C(ZmQi~{k>-R7} zZ*B3*(iHn4$@jLpCa@7md~awI96{c4Rs1-(d7(%@*xNZA7o*2-#yV8oIsN~S< zhSl1^?&{_Z8y`Xy8%`DLJdQ~$aNHQNkx1W8W8+(FQ2=}c3Wd7PiuEk$L_XTEuf*l| zg*Iz&GsG?w@n=cr_w53`^+t+O)<)J*y2dC)zs^ng3jveaim}cVRiVEAn)>;h3(FZI zP3C1l&)xCm{^(15#88fKH=SW70@N#6Z!KKg7wBRp%wnedA;vJU#RV3%Iq|DM*vz05 zWCXTweEpR|iXZut7!|G!V_O{xTryn%X4aEo*xOfb4Lu4KFd2DIog_wSOL!>WDY z8E(*lj;L9~g;d)@ZDMk=lD2j`Xp(kWpvYpjT2BZ8ffxBmT}7pTwb5#Z-G(W-!Yucc zS0ohKN3xk0tB?7MJvaW2?TZ(&B-)I*b0~lyPJ$fV zRB*mneT|(YO)oG5Ut(fntOU8MS2nl}x%I9{!nZ`D+2-p>&gDjN%ZLmy%UJ*X!=WPjEBT8xuUFuzv3Hh`->0x}GQ-ZcSU@f|B`b0a3OKWea&4{6 zH)Z$K%kXFm?9`%Q6A(L(J*KK^Y=7Y;?Cc*c)E8Fi-p zEqiLX{RdP@F_sf*P)%IkEDXIY#8`LIOb!Gj>L03Wf)<~pEL!mkvO2yAFA)yTHbrGS*6^R*Qx#MnI_g>4NUL$@Lh%eZ&Z@c#F z;O6Jej`zehWHC(kCy+n0Yz~QIZ<8am(ZX)?H&~U3h$t(et_!xno=_e@izv&Zew|`h zsB0>-ARB?nj_1WCWkEw54gq9WM3)h3QHInii_6B<$~yg+(87-}NndUXW+@$_AuuO&(k1bREpNJxSsWO4%fD4s ze$^pm;=JRi#LBf7Wk%Q_ExV?^)cBVUOt&+_JV=USy3Na~Qx@5w=D$oBt@JLXJ?aV; zBcp7|IVpjOM3Xyj`6Cn2-eC7`K^6uZ?Vk{Y9##yBe4!&hbbDO7M)$^AFK@b@rQyVz z>vH+QXWv8Uss-aeih4GDPJHzSe#`fV1@#?y#!~-t7g%=D(&&m@FZy0tMp|UT9%Eld zv!We%F`g$c6~=(arM!wQe!oBKx26A52t~8rlC~2ehN$wD=lw{CImg+?FAZk3w9?Su zIyg*{HDV~5O;P-LP`0uWN9C`O`sko+28~rz{>uwe-p`?UYe{!AC*(oTKAPA10C025E45z=a(1& zpfyG+1PYyVWj*S4zCntO=50z2EiJDS1BBG_uOQ+d6;>JZv4~^&IDPFcZRizV@`>Vk zwUjv~`FLJ(a;HBsSf*iX-Fc(I$hMy4+E*~mT+T?ES{ogeATkwvKn>=QcRUQuxxRtT zKW=QrCUc_gYP%MG@q1-=^I^{Uv4JxzJM=gpadv6IZ;Zhvv7hYNltQyyBuv~a1nD>n zSF+)H{--Xz2rZ+A83}#vdx5DJw#bCZ9u!k_hGp2inj)@kf#RbAvnL$Ryn>SERFe`{ zCq$aLt9~n&W|u$W1<^l;TNqqTi@ENH8?@eQX46POh86tMqJacjL}Ep& ze<}6ywZa^S@${DyF5BG2QNyiN#d+&W3fu}4t&%EPLILSd!Xx$cSn?k@J}|qN0;s*9 zm6k?-nUF=y5n}aXLk_OKUlqh(q`;TqrWfUwvSJ(F z8d#BIFk}QyJ_$g^w4t?H3qE$$ge-mjC{Xj{E&X6;9iM2|S^YNkPlU%-32S8m9UGiG zxOV_lGC?q|f9XDmI84dsLTa?(opdj~sO&xZ8vD1^UaPo*$5&{VwuwkSzLiS!`bXgO~LRX z`Tgt2?BvE2!X^$hF4q_#GK3-_jahj+Z3N#OWvv|l%m$>pHRpfV5W22dKSOoW5Z z#W)z!7ZXHO8qAvcoReaWaXg0jyMnlyiC~K!DKxv1cB04NObW?BwzIE$({|>Jf@A&Q z@4G7g%|{(9jilC?sGKd+NmEEkwOzkStK?~d^yi;d>fv}(78)gzQ3tdCO6Dh{fY%S49c#Czl?aAu&QUz_0J*z$hZ2JwhC@rNJeGC;jZ9dYc z7U}fchL40|A(5}pb-MufcoFKC_)?phU!w6Mo(>XZshcE)I`ll&p;uEJcfzR;8TTP<5;YBdFmf4bldZRY0xso%f!JG`J0B*T9~ zU(&TFB;)!B3}xgA@Otaxd8ng%9*EK#%8=y;f z(f20Bi+@7+jL65-+8BM$=uDr|lpNRu5<%XuI%vHH`dpS(Mt_R|6$mDFr>*3i^?Pzs zS}8016>14a63uWs;kHNZI7i^bu#uYOkM1l*aJ}V#GM_AeuFuooA-BDCdIc2~%!-2{*bLvIe`bP|hm+L@y$@s9}qA$Rp4s;BTFSPe zpR+V`s)A|?x1e09T)QJoBZ#R|0q9B z?)jRXNMFM}5pYCMcq|64Q|hsjas#6Drlc6>x-(*2k03}a7lj+Fa{E}g zE3w8}f168YK}TRr$+@er_B?#-!Hdq%IM8*YePxvO!gEEUG7c~si9L{$sv+O#u!@Ah=c4rGQG2Kk%xpqvXxHVo?M23S^^$p(nf!Deag#7BOZ)^s zT?r`MANh7I_;49YE?Joka{>oynsLc;=V#QtyBCNx!O>abE3B_MB$5MfYeAnEZ!GBf8hjH1DBA@{C+RrZit(I%>8ai{eP=n{y!?Hg&=%sehfKLHtBu#D z_ctQ%?z{mk=mgu{9w5{1^t!5GZNMR6dY=eW6$IDsz+b{Fk&NLw71diSp$Avfw{$an zPMxjkhmU)2M1lQ;i>2ttK6dYqDw_fWQmDrWUJB`^$Zg|Q4_G=TUF$1DzHkS;x_&1( z+1~dcqRo-_pKT1*oow~7kxZ}2n*xu5@*P=YBdYQ@IcSk&Rp~wRGO%I=aWDE9%8py# z3btH+@uznut7gh!j&OzzAz7C`Ulue>{7;vbR_`_v>Q!qjItgx|fg#M_pgFwmOBX{* zL_~p*xG>a(jF?yL%IIM*{s4>~&@3SoqS2*l$|fd^$sO7yw}$Qf`K4MK!Wu1(IJ$?L z62TU{;0^gVNVkF^6G(^sPG0C`TD|o|T&NcU{<@}_`YJ=mS364N)?`xb2Ba3cYq&?- zo@I2S)Ldm2Q7y3qjK*ZYZEPr%%5U7X0S_mI9vv+^Nb`RZm6A*H1Wn^fhTxz@&dsr? zzQ^P)*%ek)M4kM`bWzOGwXLM_0TE|2PlINLB0}LpR;@z0!`%~qul4>RCwF%4c=txX zhH4rM6>pRXBE^;?^38z_T`QV|5UO$~;*U)S;c*0S@<65ML5@*nzxB0;?K6dFSZov88+GhEQs zW&cWW$phv?L<-tg>q+3pxwmTog{@bunB%E{;HU#7=6uCFeGKX23Z25ON9rR7r{?$J zs8D!3tn{%^zEYWpxyX1prOhXS7tiKpyF-w>{OhuumZf|j7M``OGCRMnkZw#!R4^eR zp4o}V@MS8N1LXp_$|;L>PVgsJXN>5e-&L!2oh?VqrYoh{J#R)NV@FUV<#SD--t}9h zoBg9SU6?wwOoj(p^9N(XBhgcs4Nj=TLLuxnfWhbjGDmUl#?7hhk0BY+njh8Uc$$2z z^^Ds|p|;;HM-+o!0Pw;))h*Jv#^nXy0h&w40ZME0Gi(aW_ZN9x5OlfB3js&MsofL7 z(47s7e!^CKO3QBcYg%(2vdyx_+jE&wt(xE9X|<0SwPt^_*0)s7Ta>rwHlyPo8iVb? zi-V0%MyjZk88h9ndq4ijnaK%n`%ePCF^==4HTQvQ6~_A>)Uy9S7Qi#zjL;`1zS1O- zhHj-nqPU1Sg)Am(Ae!o+_C5>fv3JWGlH-N)BRT|$$fw)vme9ywQ|huk-yVqBmA)6Hg~vNtA*oUm&j7GE@-6+=GQ*|@yv zu2^ZGld8|Be%~_D_1bmn-R7Xz#OoPe{yiEi_;x(L%?)8l=YBoI<^GyA1y6PCblW(z zqk9MCwl>#9pgH>%6r%sdtSY3hHeQu(b&5;9%YW9N%E{VaY9F?`#=M(n&H0vo5~nTQ zqj_^d+e`?3GG}DQLzLe0oJBC6Gmf=Eh${M^JgOF;h)%q7`dwaDBf+A`Q{6=#oMumnrgR{ch{=uE_tH4kj%+O zu8mQT{6&ft3oSfr%Q;mo{3wA-`8D=a(!sjKV%w)5(nhx0KB0=!W@v0vk|rPT&5mlb zE*Gmp?*KBVrE5#aRbZmU=FirHmU*pAGC#oHRbZo2H<(59+8tk2_1c|(lgVX7a^ok_ zfF6_sCjJN}8w!aupvL`T-CJQcvi|b}yB-jA`@uCv6Ul9_YFjKdayTvdZ0^bO4IH7` zk#9G*`NcJLKz@Dj6z?t5`L!$6<^I~ZN^?9u80k*n(ONFm6>TWTp4KdrJ?NzoR8m$> zrF2Id*@Uv&%XfH{q6Z*pX-ka96-pR9J{LJmsCUFm;z+Wl(~@uW z#8&$}6|Bm@I1H@r%p}_9D}v$$Xr&cTG*`d z?h#HFePuT6*AD>@O%2l=Iu0>}Cb-{fHO<4M+W-DLAkSDNOf(jL2q0CClRU3f(8w5t z2+bOBVSB0j7!ZGAWsm=6Ye(aUvrkg9=sldb^JVCgdPr(9@imQ`gs8Z|s>73^e9*b= zIy$HSDZJQe-@|D5m@Vo$v~i&#WH(`Vm#mgf0J5IX$zsHfbuy zH!wQ8RJ&dzr+TH^UXDL6_Bu3Y**AR^qw1q8qt*H)9G~r8Mec}rQ;7dcnpN;Kbs-#H z+vQWVAjLX=F}8N;jj43fheoHt-?LBT(!dCZ=h;l#tB1MM=Y>U(L3VvbFtV$##F#HP zZy}Kvu!SN&UhueNRVs<$I1vc$*Sx4%Pp&?c(-@*c^p_N+c7g7BWq`3#ylZ2*Rn5Au zV<^C|zksdfq?f$oi`|C(Akl{Z;;O-0ljzWZ^a`%aj^+!66+!6byxX->Q;5zJ9@*%Nz?QQxPL&LJr;Sv7haJY5E2}FJxOE{%rY$PVyqk z;oD_h`M{=^Lcz!kT3dk@$Uw_12RTSoy^TGrOi|nFfmmn zHDMyEOh=NzuJD+h`D-5c;q6QfSTtF6i9uZ5G$*3^Lm!c8fT9^-e}|5BWK=M7@>Hp_C*gWhu65Sy)jFdSi`TlQ-*=+sf=T zRIf3oCf;!^#Cf#wF|frY4Oz)D&zDXE;zZk@p48Y2isBBEYjL@5x_BO&W~^~Fc>1sf zommr5>}zN#lFX%OEhOi7m$6(g?8S^Jj&F0!H0sTfKrs`Cb3AVLc3u|9*)j&cFjZHM zx=&qREuTrqHw1h7s$Gyg#7_7LAua0LPRh!2x>@fsJWjZRb`Ue1&JPHmvo}R8_xC2~aUWMvSWb6l z^m-@z91lSw&UX2Ux|ruw+?#qahnwsCCsR3!$w4~}?Sx>ntHeJ`t?KqPQ)^FZ*`5Z_ zqh16_7MuS-1mBXwDIn_-omu1^E1Qs-qAQ0b;PFP{(+_M^;qkuZum3JAz#unnO?jQoiH`L)?RavC|1jTLFhvHakS~CoAk~Ht zo|uk4cyVOYtA@_XJ673mz~^S_^Q2AE?-ORDE5(hpuvHkW1OyAG|0jTkrt~!RvXC+f z{h^uYTNBW8uqa`te~{%=c&YE$s_DR_+EDtilmN{=YtE*jgWB^|+25$No1ggml)7UeEq| z@9CpYUwqSj)F2CeJwb<*$7MEh!-nV(yAnSb7b@A_v0Ef56S}=iWl*U((}@J(BPK&y zd4R6#T^*p8?af=Pj%8Bq7w$6}9yK;*SiX1Bpd-16o1FuUs%gsb4I2M@oxrSh_Hy(+ zDw{KC|5N*0CsxKNn7owENQaO)$V>P zyXJBzT>)njw}TYB6B~zjLS0>1G+x&;J>!C2UPupim{JOir>KwNxvlpyxOGYPEjw{P zr^4@1NR?{TXW5)C))v*p*UA5=W7m#hzrY5h{fn*o|KV77&;P@&YB|6lmQy5aS809p zZrXXKC4I+S;nX?=xse8kCsp{GvCz$j<0r-&KgCBGi&<1u6?L)*_gX6Z3dpVTB|0Rq zvuY*nZt_2jbInVD=MM4BU8RcJ5d6X)WjsLKG^D%h%=p*7Zm_@7HMx+|<1&t(%&xq^ z&?a7RhIsX#_AHsMHc)o1H{#VTp*lFrnC;=>B?fZJ zeonW9O)Uxj!>T;FDPckDK@JrZAcBF0!X0m z7&pZ61T4Ezvoq94_x1$W zg$liB$no|2{3ch17$fURII%;YssAx6bbQWA9E|zA_mCXo_m8?^kjhsq+_5=WLMx>= zwxTJtM$(uORwVwNI_&sw%TSkCI%U1GxxM*t02~DC2!J$mg2In{Sdw5g=gvJliYNsW zY?eS^Z8oW`P+_b{mB!DP6 z<$jJChLXBF%xA@&)AWGa4JZ;JOm%JQ4t^KM@8-V!&I209g2v{?RvGKdkOF|u=Ih4J zinjfe!&=kg*fjc7-c`3}a)$?33MQ80lgl>=BDSotVnl;}4>boBTg(_RPUSkGYKwp- zhipn99et`j(_&nBt1Y#c9y$~h*sRKPgDps&(l>=Y9Ba_$%Afk>FI^0zw~6=1 z)%n`X5h-r{EL;O^7i@9-ukF^Q1{!faKpIQh8Q|o;GK1uY-o*2YsQ24d<=UGHbRQF; ze@7+cgf?w*B1k1!-0rZ+k7>2_aX5bFMO^*)51tQln#^`7Br~7XT>ihg3=1=)jR_vw ze@)M8zp_RSkIJXaBHGgAi8`XY-n^jS&9tX#ZJc>r2U!r62;8;NcmrK6E)A&U%@WJ& zUx4;yecU%@unkpx0gkh<$c8o5&T1Xh`j%cUa@RXYLu4O zmr;meWH9wsh^*@nCls+soO0|?PlD6%q{;}dK07$oUo44HNIZo!x9jl_0?-2TyX#WS z>gxS;E_F%NYo|{K-+43eWm%Ie5YQ2%r|rt4?AR$H(#>W~o-dZ!FG(iG;@E;<8ea+C z8cnz`1_v^>{r%?0kx-&6_szp)g*9_r)u8}c?4Y&$mchnwV!av{$u5RuwSbNiGQJn2x6bR~g(EYVYkzw2zQ=Zo4w z4Buq&5(1E*`gr51ex}z&@I1EnVJ-b;%wfR_J)xv%Y>leCQFACRh^^ao*e!5;R+hYP zWj10#OsD*`R?$wEU1?Y>R)jd{&CatVKAJ5YO*n) zRmFvo=*y5 zUG2nzbjem{YD$A8e(zwHa0?(OBHzljO`bcxTNKNzOSrgj)T&4QB>rpDj8jXCd?vxs zb69*4%z-62uy30Y9dsZ`GL|rVPy=Zvg|)#M3d(DFD|mdke75^DSRf~j&6MVN_3;Ch20MJ}^Cjw(LUYVfLgWg9w9-gHj=vWqaq@;y_PpJ6> zHmjz5@uhJtrVPtPe@W=y|InM=h)%cMD%q`hzl9F<0ZfmLH#WhEX#ZXi)xKdIn;Xwz zraA;fNB=gFpIe_0{j?V-hClfcjmcMQ36U0S-xF=kraN3AQ8(Pl4x{fc;70z9 za%%CSvscM}>0Q<2B9r3_=^W*1=XPU3dbLO80=Mp|bk@d-zSKYbZ6_V?d2T%L+P6Ny zeX?}z?qN3*O}%fijNkWj^{b%Q8Tnnrqx(s;3wZ?Rzr*a_=&8?)$SlyZ5?@dn)A;re zSnib?>f?8)x)ALLh<*HS3paZG9&r>$XV1)Pp_iyBUEj!s9)IoUekcCN{-nEVy}@>~ zgL)T{@1{;4RIjup6}0-Mvph^f@0dL~FBvXihm1Z^E=Y{N?u?RRU9wE?*9hTg%|@ub zx+_u)*BzP7@b}8VSsVI7UOOn*q6YN8)4SvqR2>kLvy#RHy+OHI@VF@$Z#Lk?FPUI( zWd{>1GtR8n=RhmU|JtEX<0W8d3OL%ak~f_+Wfk7JZ_rj_#vEP>cG}>JFrK8GE<|na zIyf{1b{d59#vshS97<#MX`O?zLkWhR38}W((2lcL9uT`sKtQAOwmENAK~M)GmArc; z;L69EGkw`+?76TWZ}O+;BKxb`2ss`En6w8+{WKygwUC8nNb+M-;>#ctQvU~T69D@T zB8PUnPiK~K6cl=Xf;gzxQ|nt#=6k4-)nFmuKu|ysMTv5 zRdJ$Q3N;x0RzoyxLjq0`UgYwCJ+`(Hu= zXa}}%=zQ#wmUqTlaWOE0ZuKfZ)Y+kR6@_%!SE21-%kw<*(i(3y&!#0(0O{XS56{1? zn^$lvzxJRQF|{8_{|CBzMgPA<;r&1QN&YW^d{Y0JcCVCs>*(pnRyk@i!LxIOOcJe* zo@~s^jGhEP^2^_{GFtFYLDc~5>o55}W<*Cv$KlDz4Z7#>@~|&|f0O>w)WmIVZ547= z1Y-$*DC_FVkzRkEuX`kFFZgU-U-~?DsA;J+YFaW#&hL+I{p_zvKd$5^dNd3>CjG(AfCB&qe%Eaj4M$jxJ zOMq5BV_8B{stuYaqOSL4n}?Z#C%$c9$Is?**(PudSj}yCFKPJwXKA@Lh!e0I<*FQn zs%i>)2t#%n+v_Naea0lAEQ<5BlQ#S=45z5tCy0Rs^~=P1%0;IkIrIa8r2jW(MK}eR z8vAVdmzNjcm+0tdc6RnHZscF6Ul4g_GHsq`mw{2t7iuW6mRzoVaHO77X>oEatq5t!DXrf9=jbsD`Ui#baEDWjD-6Ko@M zE33XHn`8zp&Mh9Mj=R}kr#7~>MU|CEe?=p)W)>I4=&{QCO?v{Mf6}xTD$(>ZlV?oS zc|SX@uC9UyuQ&-l;GdEoZx&_B*v#~Fcea4nwC3FO^p_~_nEhz3jW1how^Kwjp24Vn z)tZ-=laq2c&-|q-CwCO%s{_V-$G%4=+vl~*O%uJr-_qF3kiXd2*noRsdTk9c(UW~Y z{B0fRmLOL=qdB*}F6-pPCPhOUC$WE!?fASgY66yJ-)!>{R^U+KBzkCOgkUMWXcjYibf{m2AA^Hp;HEDF-Rvl~N0VuV!>(=Bg$DSi z_)GwzG@`i*U*tLr%s@>x;3Q{ds^wpn+gz+n7>l$otZlDqZ89DnTyLJ={vP5>b@GxIJ(fp-55DE#Bp}-t6p%5A)s>GD=%qTpVppQcBvccIKVf8Hfyh!wp6?tiWCD zkC!XH_UU46pYvjEzwGBxcvj#X%uH7BOt}PEUGrD7#u!DF-eJS=fn_?^S;Q8>4&eqk zN#VI(Zs;6y>^ruO?s-4AcZ{hg2VcH^X=rXnhk|fAoUEiDBdpA2CJ8D@HqfzMo1Xr= znBHi$ROfoG3GO8mCC`y~isdF*-YnDO*}{H9mTdPOc(6BnXrsf6PDFn{H+N&-tKKFf zi_fjj_x(kR06dZDwOj0`osbJRIydPG&8@A;aihT;*Yf}U^AZg&)>^@D$Dh>}0z@6V$>QWSrWU$;Is~whh%)(ze`Bd1VrDUy-Iz?FujDpgx#WSKM z>hBm!xzB391d_YgI3fQjS_2-v`uJ6!%2b!SrEMG@>3o_qaV3vfBoedoSx1KIW_zmwAeZOZJt791vfov6(VN7Br0(OM99%_ZaU=-5ytB5 z@y({6(ZdZsLva5SVqB7&Ss-`VJ%2sEmSj7zGo*~amR1c^%$t!afjDJd!V(8=U}pDE z7HXepIFsB)!B)}o1aW(;tfNkCzyUi%$kEQ^ol_Y^Ok(<0w6 z(Dmmi?wDpvi}TtY>eSjx%!psmF|dF;l!pFW!1`3}LAB6;Z1Y+#1D9VSuD@9-nl-MQB5eWJjg~+v>;T^sV>ft=rAWX9s|Q=f|P7?iP30 zl)6<6Dw#MR_iN5R=<^EW{Jz;?^QGA1C70>8YFv8lvr>FH-ogHQ#I(*Bfusouxb(^P z*>H^-T`n|aR+SN{e3w=-2Tb0LUw?pmsfYCT^NjY^Zte)> ztON)-k(3L$uw7QDrP3^273XjdrVwsU%rTwqls&GRgGf$R+Z&(3Am>s@84V9AKi^x! zom_DT6)K^Sgy1GXz0sJjr5U?JA8fUOZwCpp^3!|Q6Rz41%vFKjj8Ik#??6Q?+lmn5 zH417dC~(+uD%qu0ODz;fI8+rfjVX|OBP-V&!?d%%2ebL(L113m4rS4@kY|<$W3WNObN} zg@~!}tOl31l4EHN{)N~nOgP2ma7me}NC*4A&;6XmwW*LL`o!zh>#CURAAUEszPE3F zHOEO4#82^@J!w9WmwvZqZ-#!uR7+YiJWa>2-q-gzbw?*t*8>@cGuO*p?psS#seW@m zo{n~?gB4dtgwZ0o-JV6;M;iN2sS*$ZW@Gx#fVxKRfbWIO&A>>T%WdYxEzkUaG%VU}&y-#<|P^Mw)eYB%jA@OvRNB@uUJ{ zL0#7=?Fke7Z@=+QiC&Rbv)ymik{9vin`6iB{_U`pl+xUoeh@S8F$tfqN9y@;zadV5zDs=n_7pIEJL5hC5`I@6PVC$`X(XCyKt?_wR z*YJ(Jwiqq-j{KI~x8&$b#L=gqBp2~Q7C&h^l__0a?<=pjEi)VA5eI(tepoem)6s@8 zb=U2E?FIh8G^(P6sPnv62|BGlPeUihUC0!9le&~WlndRcla0}sPG6Lm_fzDGLqEBG zjFE$Q?FTQqupv`c0gkfoC9K~nHw~vY-rMiC5*j|omGu_@2b>yEtQW*ho=(J{!2FUL7D-!dBHB9BDx z_~^&0_qWm@!o@qOHd#MpH z*Xe)Re#Iq09xi%w%Y#w?!P}Ae)b$440rR1b6CBKnqsg+~Ny#E(e+m5c z8!w}m9@~pPpOE$~R5iZ9V6DK^_50;}d^2l(%g3lkP`3QvUQ~rUH2SV<5$(9Mg8@H} z#OP4S`QMqaUx>-!sOoE;z2)#%NArcADS!ayS&xd~;;wg(j|)G+?y=CK*osmTo)KZU zj)CpnA#UUDC&Er5g*J{pR8LWak!N~=u7tJhoZCw#qW!1v%8GX(z1@t*^IjcXv$Fb7 zF64fRAfU&CSIpJ4ycRd1Vk(RK?WWz>YzP^H7SH@M)<}rxcqT`}t!aB;5}g@Zx`?%3 zQ&QjSL+$Cbf$sYhL&E{{q%R=dao&(p{y0Ql3Q>7Y6)&ToXfk}_BI1N3t)Ir zDf4PZ5Lh=qtm^IqUiqxur{S6NI|{jJ`w1-hJ<+ve>x~Ruyr8DcyJJMl(qoZf&0tTF zm1y2)@W&WQCnTC`juo&v|JM_?rr(I9@t zWL_)0V=Mo&w*TJSz&JDG`ik1})0^A#?4`~a?58Vw0@nKQP<3mVy%D8Xmet}Q(T?gdzohJRpQlHPWHL4DB1$J)hM(FQgY4@ ztb~Mm%&Gua17lfnD|BajS&wNKRkK--=6NHUN*w!qmyih1DEauL-=melYcug&LSH>8 zxnGU_+;U*3%;XUDHyd$D@--#l9!j*vTH&0xk*5JPWZ$BUi>e#PU5t@*sP6;{ z!*`kdRpFG%1!$bQO+WwPlPc;Y?HOudRd+n#&X^}cf5W;1+W0OQsTX~X5P<$_P0C@n zX;V!fed3+%)m0yt??Tt|9+MvSl-^%3GXI*<^0Pqz<-bg7`*IVloyo+i4J1Lr7CASp%W@WSZXB--bIOFjt_@$3qtICLs;)^W?@yGa z-|p<7N`Qy2gc})Qf%60TWDmwM6Du%sB$z3HysDYI{#NIapQ6d6J31PE?sckBtG)=* z->cJJ-wJ2CGbksxl-ziHCE8T$0Ho~Ng^{BfxiVF3M%0EEX(zG(vK%J0~)PA)W*`GY}FzRQQS z>i14>4SJOHdJD90kU3Wkddz10wl5xG^G^$OSRKKlj;@e?HJ*%OJnHK>|I0q9Z}yXj zJ#tpQ{&?nb@BLv4!Pk$tzuVXUf6<~PlM1_9FUqlKgWK(E_}w?TZ98kP`MMzN{4!1Z z&9U=t*R9&zd9vg9g(A-@E*h%yKfKM&`DGoKc6`O!^@*E|SoZlRT-lK4VR>Z+u%Vvp zCcwmXE$8Ep#BTNe2|B?OzI*>?YmS*9mHfe`KWU=||H@Z~H|f}%KU{j3@w6w;Z}Te> zUO-(<3r!mBSGoz`crg1?z+MYUY4(y{wTFCr{!f0rOU9z0!AH$F=&W?O&H2Ua*5w^A z5<1+-tJ=0n%cqBv>%`BtIq4F`{L>}0d5*}qo_S}#vn8?P{b}R5>`AxHrd|C%R}9#3 znrjGFZu(TtTT5ws7_W*!+JT1#YfZQ5=D%*_`Bo9z`S1Z-_d*x{9!W=zMxQl*{GM38 z-EZCb@V%cNe=A1+aO$%N9ri8EjmD?W0!J4O^)k0l@n(?bQLE=!EZZ|(`sp-KzjXSR z=9BWwJlj5Uf3Yche6shk+wN3QpH!7qqWNR-pZeCX^=mjK_uXUw0#8>zmvv4FO#rn- Bj6DDV literal 22317 zcmb5WbyyrvyDd6caCc{rkl^m_1cD|=aCdhnxO>%*^xDRQFU@SFiV7>s>XW3UZRj2m}Zq5C~aXN=yj^f=C2jQ*dv97JO5bGvEW> zR!ZFg1VZV4eL;MqMIi(lVI8GEio>qKAi{#*u6?U4Z?&6QvmG*{Qq!WZ z_8U}q;2ZeYZ$P)dr6DIfDJwnnhuDDErNFYP2ShB?N$=)z{0lE)mUpe$n2?d)Ts(csesghpf8%{JTd`WPdg9bh&F63< z2Ni%OA|d;kv`y^Qe{^S4jj;pK#T|uu++_adDN-;_&nUP+Az=#zbE)I+h%yZ zr-spZ7*2oaHh1rNHaQn?)kgjs$yrdd%SelM@irfJOUvpGB~@Ul)7mYBWBJZZ6W4=y zhT!F*x@@h!TB6fwjzUt$H#hh~TFVm5a6)bP7UZ9?@8QVi?y>GmA zcB(%B57A1R z{GTh;z&e!zdAUEeGAH2um;I#E_-JplMxzLL6B&3SSSD{P3I;EpBjd?u0u0j3uK7`- z-k#V@4SBD1a|2$%$Yo9++_F(V1YI4Xu<{Q{XU8vZb}Tm-K_Jz~3RyT;YDpC*zuivlby8A#N-=TWySt#AsHZ$>tNK zKqKuZdF5V3OOLrll|NjP9jS#bf7T69cC0}Lg0o&uJsm;P}gfumaA`qy18@g`orzLdZ!CoN(;2az@^s0R@iW64iKgFFX0o~og+PP zov9<-*jXMU`J_4AiK-S{9`_n^Z=p;ic@(ccxy+gF6iPZiBCK52*Qb+n{Avqlp?=4C zRG~N8)%-jA!~(+T=keM)<=2l%+%Keghg?@z@qyO7>`OZvKRv$2leW$fAbXj0RBwz; zYn*UdvW7$$rFruOFF#atrS|J7ukm#;k=%#messgn(n5;&UR?Tq<+I|z%;)!ZAJ&Nh zos`r1&sASWXT8VE!qdCM5%~?4d64$B9eRU7>Y>!?#nir>AJs+m)2!PBFzy9v{_`^) zhGQ;Y;>7aQ>m8zOFg3lVrx&iXr)T+-)Sr4U*wgC`NiE#|9tyKs62ZWaFWW!YSYY+v zG@rb#-I|V8p8%_)J^~lL#R~QFvbmFa2`R5GyxnBb!%fUqb$t9#Md#uXQ`ZPv{n07! zg5-(R4%6nX_Epq|X1Pdj52+_^Gu=2{QMtQA#Yf44)<&+HtCeufsJ&HAnFj1>jk_~;AAz!l#h`snb?D}*+I(zsG^W04glaEKJNDdG{cK(l zolbO=bH<+b9AmUGDgVbZFEnm5yAdTwJWU%Z#C-qB8RZMg%U!m17AdE}jd4B7nk< zMb46|uX=@{gVkiDls6q#FL%lT@6r>0afe8~ob0hC5~!$O!0deS&2HB zg+6?+6r0=vYy5lFBsLqa`<4xPm0<_d;JYMZy@uZ3MPc@pWh zHPWao>Lq&evnBWzw#T@cnB~Tk1I%?Hm(^hE%ofz<*)OOf`ji5FaWoCQ9{8Y38k)#A zVR2iQdE^9<2tNow>c2Dx9Xw6F`}+I2f5e8FcB??3mY>R?OL|Q<=$G7BUuz_OO;sqG>fbI%m1{uO6u6cHKy=d_F~iPsWUE z9|Uh6!At8djmuTM^Yr9;K0e1}a)$Z{TKq0(oZQ6AAE}vcHofK|<6YNQB&$x`B)N`P zU~Ms|&pL=7AevEjqCgKP9Z=Lz`z;Rwzn3qFNW40yPB$^5*PA@HZC8)U?m!t9f4)~} zT)P#SJMBs;dhL?@UdEkmy_;^_PQ!V@d0srJKLbr`)?BW zkdnwI>rL;VLcqSD#iKz`#t;7>lF{=f5Pu&%!WJCX!XJjl+CLbs<~*Fqb>SY8=0l)- zy(?~kY|?Fi4$l`RdYgwmwBWTPurx7YHxW+~qVsM)FDmirDG`n(XFbJ(%W+7wh@@`+ zbjg9sHGV_xp-J+rThWI2T7>(C@>o1 z=73J+gW&L?Mp@h4?(;rs;IfPUDn0$~3b140vy(kOAzR>) z;pVMw>s|@c+}UFS3Z>V}0iLL30CRGc)S-`{dj;v(ttc$F`J`LG<5K^ivd*-idEXYR zr_5yy0(xrx$7K40um1xoYwibbR=S#v%wO6`3FCI~AOS7ndqEhSi zX?25AGuYBQy+#}l8W^r=xLmqDqk9GeL`MZfADp4Od?E&r(mzGhC}i;I%i-`k&LQen z&=NQ9^m8jW`0_xhyxSwItT-Ze-Vo5aLtU$s$!zUkf~qZVa&VFta2pxtmmCqEUlfhj z_`=oVM0@SAkNNS$d3br}F;Sz`t*+?GrT?tvVH$O9oXM^EYY8fUSgQ3xm_Nvx`;sqX zlfuyO_uue!mSOYQf71s5x9n2&T@{0)Yi&r`G}6fXF2c~#mmd7+oW{B^+32RPa|dp( z_{(^Dg?#$%fnf`8xvAL5|I>C{aK1EVsPugZjJ|~aoq~r7E zQ>UPJb*mAz%)71T=&K+f9+xNL);KEc{A-t1$rPINP8vxwe=<3}pW}YpcvZJEWil=h zA{FRSLnLmS{+n;oNnO2n;1Xg&4MMV+&;x%4S&E-KHu8L^89`IW`KDgtV8#}!#xiNq z^oHhh&CqxWHk}tq{5S8@GwTI_!9rqu zhsf3T#Z$on8!j_%7Ip%Vq_U%wDq&X-tyPgTVVd<$-K9neJyHVZGqP`*c<;WEl0$k_ z^B0H&ZpoWcRmHDhqi$A_+#XQ)1;P>73`Fh{;0 zh}~3eVBnSLHuIOVFT0?CFvSAHo6&7=D`rW84axDBH+qZlHwoyIIm@C3bh~`@TzKTV zk*bTbeyAvZEo4RQk#x>8XeQ+dalC2!!4e$M=2ws=)R$LMtbym>Kb&oBs_@-RfJ&-A zfQ79uCn@e&QhC~lZV+Bd|BbpE`cOGu`zl{Rh%C;#f^Z>@4U{Cc3(jDzvq#DgAvC-p zX0r1zW@RHGR1y7G_}D707Au7M=fxUH#IWEn&4Wi%&?YqH0fhf&K`JRYe3_tawQdn& z_B>w9X0t36MxlTZk=8ePN2k)j%Jd--`E3Xmm8iF9T#wa5kQ9z!Ximl2PIx#p8`JuI|P&ffGPLZd- zmw6*^JU1lU1T(lD-Y6?8Q>cWN;+vCno+GV(1_#_$S6BNTEj9#i-@U>_90MWY4aF~! zpL^a?erO_ZbX^&x;+%vKjJkx}%BINzWU+|;dx7ge9?JirDmHjZ6z(we<)G#VG1L`C zoOI^XL1t}o zbqxp8F=~|zY8*f2#$=?WzLj>3Y`@X4m|-sOb2uV+_S(`D!cHYyWp>xv`-o4e=-OG_mo@E*#i;lYi%#qYdZ4lJYAgV@{&3QGW#Pj7pD1vU<{I8F5o~S&4 zKwLXG%@hl9ctSAhjz>$D8xx}w)cq*nYxs&n*7m3gOW?skkMo+vb1Y?TJ)w`aLeHqj z{FHH^DZ$HVuI;;4EZT-O!Qqj(NMFHg4`Bg$sJ{$VVUs;04=|{h^VL zrsf)rFR)tg#G_p$8F$`sxGxIA`BWbDM`4r_3-VMNxKUkK`zsyo*gi~%ULTJmt9cW| z{?4qk$cS|F$Gfy7;9@PT$xsuJrwYQ8>5HwjhVY?lhvBx&5jL;g;0FnHUl@27(~C0G zd@TlrZ9PzVUP`!C^=73RJuW?-KF6xt*9%5Jd0e4Va!9oJ=LM-45U|EQwFd;Wgw$5T zsgEmgBKT@|`Ykmf;604F^_g3%~Ro0p> z$}{;ul~-f@s}Mqe(FzRz&KW`IGovouLW#CG3_@b*eOL*`@xcW^GN<90Q%3LG&I=|k_gdJ;p0%d2vnf)cV zeB&4mS&C((Cf+M5A#J>WaFXlNbo+CfVYSdW_7|p&GdFr59CBH{-?Zt2gPvA)9O4}M zn3H$qQ>tACJ*U|{!S$vuTE}c2LlII-J^AA0IBF_v4P_Ih~esmY2Z zGLJWVyTdl~>H$7l;zIk?;X^rI^)3fyBXB!3r?+GG*A~$v_Ttz>$R$r^@T1KBm#Btl z0Vc;QW-U8}g6B_Xzf)L~zkeqvlK`?Cb=?8R?dAA!r(Hv+>L2yeGbGojB}PU@FpCW~ zsKXZ<(OQDSGCzyl;6w;M8bw70p{)l!bxGm3qXXrLm@31K$k*yb1kC>sum4st{yUKW zhHmpwcHP*_%&hD)SwIALO-&62eRPx&B%V_)@H>eux^JI*@E0H&6QChKdp|J1D`6r$xRMhK7-PBz;h_E4cXezy6@mWsO z;uVE~*!3*Um55%r3 z(;4p)tKPA}FiaBY@b&T}$e zghxJ)Ixj6c55$EjRnInE*9ulV5qG(=pV*{Eb^`%Z-ZQ0Yi# z`91Yd#t-=Gsjtw?r>*>5YLR-jp~d@ZOz}g(*YB**oQS_^V~k+Fw1Suq)q<@h=sA7I zKM^s=rGjxkLWBip2hEp`i|G&e>LrY0rYeCK((KbXA{ELD zgsd}@vRWXnPpWH{L+=O9YQj_H=4kfsbcUPur=xP`QT~-ozNsCeVUZcR-l=+7uQo!& z9t!9Fjq7*Zzh0bWQqi5u2*@wJW{1u1bOtk~~?VlOQiKXr4%DsY>M^COHE4-lRdnClQ?N|0_p}4N_E)(wWycC+Ol~}py7)lh9QWZQ;O4s{%mGBE=hfH_W zy5Gxkei`!>FlZF8({0DA;r!UI0Y`le4I2?IO@8 z?|>_eV#Lvd%b+gJVIud6pVOUUNOCmV)U7e7%3chv%&Ew%8THM7eoa&^m|;1{1|r6S z;g3?`*iAx)&*vt1ifo zlLJ9F%MCJ5;W|9Gf)`*N+qqrad1f%`WzE_Ebkl3t{YFpT$xf@5$ecM-qC&LFx;2g= z$#4Wj%>8$H1x(BDL@>@3x}u!+g8t&SsQxeJm#P@1129fy9!Ol;mrSb2FsZcpYK7w< z$0DjHK|QTJI}K84i=ZGJBQ99Ocd6TNt$=3i_w}MIaFfKD3)y1p4^p%b_0o2C zXyTr=u82?5V2G)C7BiEujO~5Xh9lSr^m)J8A^1apUS(;!<0bCZ(NIk4h_B;VqKVj| z4pcJ{MD`LNm67n7*6#a*a?FCrQ(uO{aLD`Ot$l8`r?Euqhr;7H>AY-ZkiG?zxSIkn zYsa*G6mi+PzZgWhyvVugFv{QN<*eYYnZ{*DKBhC5`5HMQoVzEY^q~BEY+ z7KEy{vYfCzpZk7ym~tV+fuj5ciT=;nAj(>WNemSU*0$_H7W9960a6p_nw+)0sPaSr za>-)+RzCyK9)kS;Ga6%tZCUH`N%y#qrD|v!HhmOtq~<$rjJD&-VFWW_r50+slkwy< z12B2*k3&_vRsS2$>Fx?rGadEh{mIeq7n55(YCecR>wuRx`(>Zkbbe(Pr+0kCqTi5S zWT59(WmKXv`wDGf>C1tz>`e7=kK(mNqw#$JMIyXzB@E^hj(I`DiyBPr1!2WDJcu>Yw&RY&?^Pf{`yhVxH*vZ*|= zN8L9mr_(keBBLtV%ts|(?Q#}>Z8_((UmbxA4^y-1^~)Td3%WW-Stm*5)R;W~`f21T zd*n~0>>97n=TeKoe3&=xJI9F={SduyTn5Ms0miDJM9g|MeFURncfFZ+6xcZy4RQjA z=x@gBFNjp`XA}>;i#e;8I~@;OL-KrxTNu$`=@aoUJF7Otx3%jLJ-M4iZ8i2Jbr^+@ zT1g2}&nK=7UjueBA{2s@3TqLeQC_L|+bF4*QNX;PuJt*|qsN8{T0 zl2!Ri?3=9{y9QC!@>opo93{P(yMr$_>aT^F1&b<6-YmUUzKsBD5{NYM(eeEKu=cG8XjW3p+E?o)(#)|nq0X4 z67$HGuIpQ&)w)#cU@^b5x>swdJP4fS(yqOVN8j-a>vG3$)FD{qy4am zhQUq`|M6x!RJc#!UhQ)H24*vc2YOz>wCZ7BM(Fv3qk_k*=->g^fTG>;BQRm5 z#=pdv;{%cK=ga?m$V9{nB3^VjYp?7<#9iE54%b5Ysiu#m1?6Z@FSa{SGj`dOO03W~ z27~G`N58AK$|AbI*8I*`!95^Qnqs;b7i^W!=+z2ccjIkIG`n8f3jd|YRa1pCqZF5t zlMM68k5ZjC=+=H;LCxm=I`jrcdhzQmeacCLHl9ulB_Pbf@1VqOKugjc5JjoMrFcFj zI-WVa6)qwCTYAc))~04*klBWMtq8?94K*H( zm(~=JctBGvoMNvU*K7K=+1ORF?cZrCaHo~sz~`B3UCsx{crv)r5iR?fvtr^agewZf1AONs#LWj*q+^|b3`35ye?m`vLlc<^`NNY4(A;J42W-P61T-K!RdFpPCNCkc z$rDP%Hg#e}B>*_KU#BTKLiuAsZc2H|9eaML<7_|_AO`>nP-2R>Q9X3AWfq54x23ez z(7VFNi~WD)Z)HBnfP8mO97M&mQ>^ULTE@eU^YxBw+20Yu7i&-gzxZ|ps6Uo|A0Mv5 zbHWm%U3P=|(rfyFj5V0lYkMZgfUqbRp0WI#`dZklpg(|J7ti15$ zb}Vj{B`ORsks>5NC?br5x-ZvSGVFhIM^Sz_ItVq$kE#v4{ZzCg;@wnkJ05913|IrIJs6ZU9{o#5pT3o!%LfwrxKaaQK zeczoDuxJfuA!7hFdzL)XyZvU4LSmTL+huTHnKASHw_`g`@D?e*dB=KYxj5SejmSYY z!OVd()WK&P5q)FRC~-zA@aO8Nx=wSUg+=uOrlc~i6+>7MdP-@;c9@sjevt}D-8v_} z*6*!-@|hQH<=1t~{+^>R?Xp1blO6v(I7Y(c4vRiK%#b(9`)XgiGe2cS^s3B3?Kz}- zy13XaFSS0>+&AA}`vZC8mqqIjtdT7QpOTn$Tb<4iKI({w;C(kJRsr>V8J?pA6r$vC zJ{~m03ttl`COdP2$Pd#WCdWi@F4VL1D_V-`#`=eE+pQRA6$--9d3hba89IE^BhC+e zi#2?P)2t@c$`P4ERm#|UiOse}$C4wOcoo#5liqb6o$v`isI`-gl9I0PJI_{sw0!nSnFh=Piz1o0s_`;_;uemcq+G5~k?a8cE zF{xEvcEV2cp*cE3nB!}ddH&bE_u~x=*2|a2X!!>|nNL=9o;Mrtb1sF2{F?iHRgChC zrS5J+(Ty(hF+v%a5%U{lS~02f(S&O&xWZc{{m zDXnI^Eu}%KS^9d3p;%G|BcS20kc6h}=2Jo!hwOd1DUxO!&e>fm==h8~ox7-4qz`e?B;jFL2t0(F+lpwS z*9~XO(bT4^#5O6~9*wopdO8`}Mg53~Ql>!$m$*SLCmEpTUFNw&Q5hD<-pyjB6Riq3 z2QppfnQby55lHM$PRR7D&8E@a_VoH8y>ZmP>IQ8IJ*1!hj$H%S*=m9HW<#)j>YEOo zu7F9Ibt!`ZGp9e+Uw#GyF<@T6Ylu@D9R8*Q-#Xr3@|%A43O_7N-;(+=@%G_Vk50o> z+EI(_;(LeUaxX{ChsE2YKFr1wIaCj^s*i#X=dJ{w9{|c4R@bCO5Z-k6tAPWqIvmg6 zs%aS#A41fDPW`e0|Jx0UcG~ye^>e-21u%Pwaz%L-K3n^G=i#9-YC~tuyvEybe8Y6i zGmebAw69n8LF177LjN zudYT=Xa76b?c?;`CWjqQL29`)CKdmJ{x`nY)T%W;#rWKt5npD}M;wP04DqUS+`N;J zRpScqs!Q>{-!v=3?wp`_E%D5YZxXe84DL%Zb}^ZAo2YwVIn8p@`Oxn$Oqyx1wi<70 z_RYTl9!f*n=;bu`IisIW4lmnf;S>298fK!$)$z*m2cE8@xvHwX?G*BC9?e1)c* zZ!TOK(z34CI&vF|m2a5K4@45n3_3@23e%luYvdO(suASUxX^bQ4@X&DPS_erhkp7J zx}%HCkN_0n{l5h;xj?jP1~vb(P-&gKL8gfFFBX88H};u22HZCCkfh(0%dh?F6ZlFy z19)ZL`r`VyT4t?E^q`6Aks~-E&xdX9#)xAjV)a);mTCLKk$tWgF>-FS{AEuR`4&UQ z_&ci)nX`A7Zvk7Z^T*xBA^P9%V{nt`gR}JAn1k<{#C(y6^VLnH7y)a~(UQ`;=#6)W z31PV>&t!3EcG%BEqZuMMA%CV+?bbvyJ8%&kZpY8K4;`ZD7*+#P8DC#7(EB4Tq%4!D zkE`-)qYJCU=!#FQ*UZ~Hi1Mugf)0bu-(H~G)&_aaq0pzU7081;D)F- zH`)tQwZrkvdZuP~)hxsM_=AsMr%47=4ap09IgM6#l?f`;%?pICPlJTm0OR*QB9CF& zS#0cvpN5Mq0fG->NT<}!&qix5T)1LVpE%kb5D_v}PY>gL{@63f3!dR+c%3sU+_v}) zpDa}e5k#F2KTILn?-`j&abfUcK02Wn#HU0S^KnDG|CCNNF+^iL7QmwVrV@jkB6xu- zO4id2epKLj^{oHwqieU^LhgEDJNln7WtymUCIO%3yA$koJI-<+O;$;KkK^95W>DI> zrw!@DXQD_xMU^-sRwD78za3HE3RC;afX z^e480!`RT7{Rp*3w7=Cke|c}opW039SJTk*%4apKe_wexV240OnGrPT|cyR{Y z75a7`dd6KCT_jK|*w5P6N6!w2y67(9J^#!I_N|!kQY0P(s}q5{+3oSE3n7ult3m>K z%%xo3ZchpUYw{gXlUEF&+{`8q zz+;1hD}nO^Dv&xI{#A@(m}C^cnGIJoT-+c2nG^wSh-$$m(z%Dj>GE1y?+xp<8C<*R zCqdyq=O2yNGhX0lHU>UzGq%s{I;)2rdCYx=gVFL8LlgLbQ2uqkA9p>E+jW;HWDb+A6g>-LEa{?*g= zc0Pw~q=JG1iP8y>nggp$YX(t`;sx47cnmi3mEW9l5E)#XK2n!jKr%NsFJeU%RC-ExEb@7XZ5FD6cSM4omW31W3ggn4fEx?~Ks+Mo$pK^AhwAir6 zb){wV*R(GeJpmnYG&I^${D{L^LdC0#~Jk@ zu8M|^K%iIM-JsV6pTl9Y{yNBZqqDMpU2a&|EC@JIN^B%kFghHUaeYVdh5PwR=f$ar zHf*d)mH@zsJ^VZ}FocCD%PM{PMZZUVsB^G=DO!Zd;*O!Tc=6M6!dz=>tqG#J>K)B_ zYp3|g@a&_lbtYP)6&s{u%|wfaa?+))x^U`vlOsW=%2I)@>_^^uD>6eNxlDn`_J`*7 zuAXq*Gsc&5Mp63kD5K7?5^UMg(d$2^1_Ug1hmq7<)rPLl%*L(GOu<0++b{MM z!O(AVwv;vI2SjWSszr|W^N3BdwOlV)-1hlANGTdJQr)5Etc+jp9rJyRFK4*$U7qt!f><`3NpQ z))$~G_16=XKr!jxucSVdtU`t(9_r3ow?*%FUw;pj zL9jHWZmsqX7s}_|7Y0#s@2pM^Wjd}Wv^0dFv=;eNA3nPTcPg>=)AM8mm}7zKs9UIN zw~>>71X>Xi=cHbxdRXj}scScPxFj&Al{J37R`%YgQ+yB3mhDA}BgFf&7LM7J2T;}Z z(@(^)o{K^NH5f_`-H2V&%h?9gjdtK=fcxJFaov))JqrG4To0qQJ*t}pKFT|`hf~jH z8rtd@xfNYvHbVjOC+ZS!x4URS7J5C?O zj!4kqN%L>?@rLN{eM>E-1t&k@T_-3Ow{LDV`ZVs&yhmWrS+0Z1= z5?sq8q^-}0XZzON$Bq)v=}ke`-6YW|1W4x&rSjm(I74t5=J9&mbSp8v`e-~%vVK@K z3RF4Bl?Zi8Y>_7lmx9*_x5Xm~th;MXcDL6Uu)c9Sq!|zg!~~w8_#4cQsw}HHcrdiD zt!?d=-Ct8Zunq4mJm3W(Yi#Hbj8X!s^>o6hd`!LPl8Pu`!_sVn6gESAdx!kVri0I) zax6>b0Lc)jF54N#rk7`#d*GD8Y}&Uy)B?&D(`zVTVVx{e%MjPHCg+VeeJR+6ffLz@ zR~<*u`*!}kmp(4PbkNA8#A^$63}GCK1qR{bMB(O70bHRZXPJMC zgY&(An5#7~tmTui%0UF%n^ccb8Q?@1z?CQfWld9Ag8~aImdN)WaJhAzk_78m1%&jb zr$ej3L?Zn``ldE3jP&%#GHiBd7S99v5KdjG$(?D{AZaun>1qt}#dw`WFa@(O&{x7Q zT%p_n2$!8)-Qw@y!N1^Oo8YJbCD;k+uOR%tHYmggTr9_Nt%RU{`Bc5y^R|hL3QUN= zlPE2!k~MGBO-O)&2r*Ox+@hE@2_4MHkj^;2e|xXWu7JIf&|LZ{j)zG^#1uHK36{Zw zaa0yngB{{j8eD0$lNY;TrA?hSfE1hQ$Z!W-fnSu-dTdNgs+w85K*hSP9Ra(=dmJoO zQSrI;gz%1*l=Al<^IB6whIx{l2Xa_6{7_zbO@W1qd!z?7W_2uZ4_(=62_}=xD{Se& zU`BF!xPM9-zEa`Jub!Wtt&t+}e_0s0qbxotd@d>Ks4B`&So@+MU`Yn7CSos`kKA8J z2JZj@<3P#08drL%LK^ompc7V}uK_%m5Lg7Ey$I67xI8jD2UL`0O)&s# z2h1rsP+!A8@Ze-m0Vd6~p;JJI*b=8Jk(+lb0*bL%c4|&UoZVkAM0ybgusO`w0Hcfk z!>Z=65I0P1CMyo28c<@Rgb)W+=VUX4jX~jl(-ixnW?5)!`Mg;BDlZFwMeZjC%4AVynuj67l4?!kCr$8OpiZ$`#j zaq}ET6v(W)Pet_Z5x(2wI5-QfxcI~fpx?!1l6L;WoqgS2V#dnXM{XPw7%;E&=E`sP zc^I3Vb>kc+AtudAk04yll50Yo*9T_)3(hwf-C}^%VY`8mY41;xWlm$4KYL;*jSpr| z#gt)0YNIi12 z>a~V11Roh)PfngGyiabPbsm3_K0 zQtOK_3@Gbw9t0(Uz{Gn@`C$QLje2o>&siI-lp;SVCLxhI|9uQ`dW{;8%9kAiE}nUs z?L@3khkWkuvqrS%gR^l4rNDvJ%-sW2qXGQ3Ak>%3i^j!Rhjl9;K7h6Ulnf!iToC|v$Q9xwQ z?^~Ed=P?ebf2HyK)xQwxe=y)Gr^Haw3Zb5*ik*B$CP>7wU4S84#2BJOpWv zgFgh7w~a;jTO}Kp1<;X=-otdb6G(IFbZD60Osn*jCBxdB??J1zFxk zFn4M5f+=tnYf*(6l1Os>u-*QPljDin^H-{O*_9yJaM*2eaV5y5WrO%OU*|smy2wZ^ z;@EEEABx)HSv-P?Ga)l$+AZ>%EL{E5=PW=T;0#$;GUgxjGq~M!&>)~&Dt8o0fxDUzq{4$NZJKSIz`S!) zo%LEt6CzO$iV*7<3hrQ{K6ye5cn{ca_^!q9UsBI~gnn+uMP+n4xgKah2!mGcXByVa zK&LYeYA-h*Q171z9vM+-r9LD%5+sy5o}-I!V0C#3$63loEBy2Vfw0$J{}*72FJLQW z#Pk~)3wp#a#5lu^tnayE5AoI_DY?pE!(2dWlS0Z<;6O_7Frf^v1aayAUvJ0%kHX^r zN6^28x< z`lNc=&!8r^O_p)r7Es}daC=SxTWJx=t~qNNYn!@!&9Liw4MU8}V5AWNQ~3H5#&21% zod1|`wQngMR%-Mcqc;>-gKQ-9x2J}&%Ec0B86S?z&(AEMA1#6)x1XM zyBq{BdG8A^UA;%1T}!>)wv)Uk_-u68bjq5xT8&Tc%L%zyX5e^)XC>-`BX41ButL6U ztc_W2JBB0Gu#8|w!D$=p0eR2vyEOi*X%d>~Y`Cn<2}8qY64 zm9Uu)&lFszTcdv#j}(&kOv~MNvH9$IZTEjQpRV}J|M|w}yFpFn^@80}Jrp|v{~cwA zozIFxcg~8dcKQDNjiVK!wd``33?pz~%!qA5$i1)qs6RdWMG+Ggr#D+7f|CC9P9e`l zAdY!iU5r@s9>Y~7)}Xq5fn9hSFw;bHS-T8a^bsLO)a6M^aDzSXMa^!@G6=p|zmQwE ziY;wd!8__Ka?~05U4OMrvL8tdU z$Tncyx%C8U?&6O6Y$|(^+q~**1ZobtPQwR0*RloElGSFtLSI6&Pcg5zw>oOHFw_ByCmoW;L3D7%hb`70MQ}dsi zHLMJnJUqY3EHHT}9iPg9OZ@@-pDaRGjRR!;qS+vCMzJAgTaq-+ z#L$~xhuXl%FIfK`;2D^<@~rWvjD`I_2$pWYtzfl&EwS=_``^Jp_ih=uJG^L(2#o7W zp%u0$p-p5_61VN8AurWcn>xp{kkgskGopmh;>0&4*n&Lm_4RfCeMe0ERjGri7LiOoqXtUkzp}`PgZN^I+{dkR`Rd3$ud4+imMUK~h zfqY4{*0f=a%u`CKF3L^!hqAIC`T~yXj;JZFnpsy138^I$Ibegc2u@=nI82c~cj|X?|sl>jtKP}xtLA*bek}O!z!hn;=OE$ojxQb%5z{npg0LVoT@3ZzUt| z!o7U#>84ZuSc1{U;~G)dz1T)J*)||JHRajNPdm6gsUa&dNfqk9DtTGY2F62>|B&E3 zWkIxMmb4l3fu}PEQc3fIqd1B}a=Br9rH#(fAN#EKje?1XXDf}p(^Htx$)vG*&llxT zcRRmtwV2|d4}q=9>==*ZP4xGb&mOgj9vdwjVI$WbpPEi^;;PMB$Qp~uA~k!6)~Zcg zM3C?t1*78Sd!K6No$T+zHpYylqE!rK?scMuKQ6mTXGe7dT;(ZBBn5RMW+q(4I9+TX zma!3;fFu_oj6}@tKH`~fHEFUbK)v!iZ!1!$U$oHv+OO8ww>f(<&Qy+VYLxfhhoP|D zQl;I8enG*Ug!s77@3gC|dG@UXAKm2wqDQdmLu#z|bgtFwM?Zl!`!aTqO3rsmKAu)D zV1|)n9XW}$EXi|fk_Ajk8z#Mev#!(*oK9qt6Rkrw{88DtMhY|O5@w8MR`K+#KmFQr z{))V9J~U-mgL?;)imTUBX}dLO>e>?F1}#vqxXRUCOOIJ z^!ao2^eEN`FpcUA*lgv}lf@HWq7$&b{3R%v8sWl9FXg5#nr9*226?geih}?Jr7``h zl88DbeD~o+nOu8GB^ZP>rizf_Il6(pC=_oQoeOnm-KqJaU5R;_L$x7-XNKLtzwV8L zt!hL-1b-pFH27XaQ3dLLXZ9g$4ajL3ynP;-guHsVT9e`acyfcNn?*zvK6ay#Mn^TZMac)9TTiFlp#!@UkJ|7PT@l6b$^#Hf1*|;6rISVJB+Ou;vlXZFj$UYIGd+?ZrqzJt)Wk_qhMy>g5P~&5`Gc z;_fDk!f<&IvmF$AKLK0TTurV*;bG_pc7^FcYxu++v%WLXBYZ1fbk9d7w;vR8bR$Jc zqtSFt1#d^wv_Pt7raBB?=W=zx*n5g9gsh)Te-;5)v`A>|fV)QH^4S4Q&|AbnxgvR+Za+wlZ zI{8PFXeLw}ltZKZelG8+rX7U7m%JatKlTqSOaW$_ zj~|DHgtG5$y*~X}Cx2v4#4YkUyjCtjb8X$_=3}AjvwU)uOjOeEQ>AzJiM^%|2cneo zl;p>8KrffLTVxp&VtcXaF@z50A9HUW>7liNzwmn!7R&B2->ND<7_aV6Dd?+uB`~IP zhA*~Awi6T2*m1os4><;SBme9(1B4`SP@jkZGIJ=0T}=C#vSKYdzND_990oZ~yG20& zq4toEg4}sPLs-!Unxpv_Gw%Ls(x}`fMBI~&4>FUUH}I2u=lEu3p+|t%%FNU)Wd9u6 zVyBMrW<$TwG#V*e6Lj=N57@YnGV-1Ly$tfoY!j}(CQ&R^$^v%Ve%m;W69exHcW@Yt9r+>7`&TRz+o_Iw;fSl4}?TYqz|0=?X5P$>TO^zgy@hEVH|}R zeg7*MHb7dlVi(}9O2dpOj4mxU0tzRokv@p0ngmQ8*s?Hz!FSX)ucX}6&M}H&(S$Rl z`kqu^^pdMUQ1=Y~gYjtp*Y1lQUgy>A$XV!&uc&2+NZ_k>8O%w#-`y|B zlLqKmzI)%SM)wixtg)2Yj?ASW^Q5d6+?nMqQ)iklRiiDPXRa!`W~0Xwfpx+@I71i( z=8|M>Ex-T$LWdh_B`^9Tk2iW!W=;imi0j!)n(}Uh$>y(Iwjf(0f%A~UwHGY1DxaHL zjsJmJiBh{m-;}v88*})(s4VR@Mdm58YgbMIG%LM`P&th(8JY@ zeMitusfdKVxW7XhOVlS>JKt?DbT&50@LlLRo}Z(H3#V*4T?ygv@*~iC6;~mcL`ycK z{z%q(&&Wsz_foWY_{<68S=0o-gDor4t@5a%eJN&6%`9P{dEZ>;y|Tqmje!Tdlh?BL z>Y5`jDVQduqi{{0I<8hgAXu!qIX3%Vqw%Z(HNp_iJcqNb9@~0s+)9B7b@e1pXvGAmLEsO620ifL=`(2%gl7NW827f@WC>09pCfn$05U7Anq82 ze-8ahD)yG(cL(jM%`O=tyvo&mawqjD+a+zs3i>zV{enii$Z5cv?)K;0Pj+RV7DrOFT9P$=c|_Y5TN^1`&b6u6jOuo5V5Cqw0JaUDmP>@)FV1q5L+eFFPpD;?oK=p)zH5Bi7>AUXHIu z$5t4D%WsRzF1z@0dMCVhd+D%ded$GH0}-0K`>lu%*V7%UM|2hy5aBX5 z7LUI^D)QN(^lzA@2Nq~q>~0pR7OP4Tm2VQt(U80~!{wN`^0V>EwS#ZUp(7=e3o%D>tiS@% z#RkuqDA;h97dO;BYhEs$IZSPyKep2@ZDl%!J`ofv$qu`H6>PXSp^GL72$0N)sqfNz z-{vs_ zvlbO@gy!~{p4MtbqTxHU$wj#mUlY=`x%jN&kcjg1Z@n>*t?}T}ln>%19Bk-0k0*4>=-+1XJeoJE>+o zG6#i|1DGIrL0xr+>s~6eQ&Usnb^R}nHalj)*^q*=<&y1(X%lK4mZPhp8S`T*3{EhX zz8T2zC}}IL3iP(+dYs%|nscH0aYV4W5l#q9Ah2P`r-5YJr>pkjxP|tH8Tw~X$M$5= zw?pS=$=n=UR3IIhyKN(%w91|o$2wAJF6HsO!K`wB+ip&a15!)FR-DMpR;zN(!#7p| wDxaJXcmG|Y9aDT0a=hVy;XVW6RryKtu7?Y;iZ?$5row`BwT*6+YdVJg54It(G5`Po From 68b71f909399ffc7cc4b32db01a4eb8e9e488171 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 13 May 2016 13:50:59 +1000 Subject: [PATCH 275/439] fix meta data, add key words --- ...dows-defender-advanced-threat-protection.md | 2 +- ...dows-defender-advanced-threat-protection.md | 4 ++-- ...dows-defender-advanced-threat-protection.md | 2 +- ...dows-defender-advanced-threat-protection.md | 2 +- ...dows-defender-advanced-threat-protection.md | 2 +- ...dows-defender-advanced-threat-protection.md | 2 +- ...dows-defender-advanced-threat-protection.md | 2 +- ...dows-defender-advanced-threat-protection.md | 4 ++-- ...dows-defender-advanced-threat-protection.md | 2 +- ...dows-defender-advanced-threat-protection.md | 2 +- ...dows-defender-advanced-threat-protection.md | 18 +++++++++--------- ...dows-defender-advanced-threat-protection.md | 2 +- ...dows-defender-advanced-threat-protection.md | 2 +- ...dows-defender-advanced-threat-protection.md | 2 +- 14 files changed, 24 insertions(+), 24 deletions(-) diff --git a/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md b/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md index f9dea0c4a4..ee4ce0a4a9 100644 --- a/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md @@ -18,7 +18,7 @@ author: mjcaparas [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -As a security operations team member, you can manage Windows Defender ATP alerts as part of your routine activities. Alerts will appear in the respective queues according to their current status. +As a security operations team member, you can manage Windows Defender ATP alerts as part of your routine activities. Alerts will appear in queues according to their current status. To see a list of alerts, click any of the queues under the **Alerts queue** option in the navigation pane. diff --git a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md index 2a04c01d4c..8ac1ba2c6b 100644 --- a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- title: Configure Windows Defender ATP endpoints -description: Use Group Policy to deploy the configuration package or do manual registry changes on endpoints so that they are onboarded to the service. -keywords: configure endpoints, client onboarding, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints +description: Use Group Policy or SCCM to deploy the configuration package or do manual registry changes on endpoints so that they are onboarded to the service. +keywords: configure endpoints, client onboarding, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints, sccm, system center configuration manager search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy diff --git a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md index 987a8d74de..9a7265a85d 100644 --- a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- title: Configure Windows Defender ATP endpoint proxy and Internet connection settings description: Configure the Windows Defender ATP proxy and internet settings to enable communication with the cloud service. -keywords: configure, proxy, internet, internet connectivity, settings, proxy settings +keywords: configure, proxy, internet, internet connectivity, settings, proxy settings, web proxy auto detect, wpad, netsh, winhttp, proxy server search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy diff --git a/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md index 8f29acb06f..f5864ee6f3 100644 --- a/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- title: Investigate Windows Defender Advanced Threat Protection domains description: Use the investigation options to see if machines and servers have been communicating with malicious domains. -keywords: investigate domain, domain, malicious domain, windows defender atp, alert +keywords: investigate domain, domain, malicious domain, windows defender atp, alert, URL search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy diff --git a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md index fa6d41a65c..3b0b76a04d 100644 --- a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- title: Investigate Windows Defender Advanced Threat Protection files description: Use the investigation options to get details on files associated with alerts, behaviours, or events. -keywords: investigate, investigation, file, malicious activity, attack motivation +keywords: investigate, investigation, file, malicious activity, attack motivation, deep analysis, deep analysis report search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy diff --git a/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md index 1386976cde..5e516f6425 100644 --- a/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- title: Investigate Windows Defender Advanced Threat Protection IP address description: Use the investigation options to examine possible communication between machines and external IP addresses. -keywords: investigate, investigation, IP address, alert, windows defender atp +keywords: investigate, investigation, IP address, alert, windows defender atp, external IP search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy diff --git a/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md index 3108e3739c..67ff38e86d 100644 --- a/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md @@ -1,5 +1,5 @@ --- -title: Monitor the Windows Defender ATP onboarding +title: Monitor Windows Defender ATP onboarding description: Monitor the onboarding of the Windows Defender ATP service to ensure your endpoints are correctly configured and are sending telemetry reports. keywords: monitor onboarding, monitor Windows Defender ATP onboarding, monitor Windows Defender Advanced Threat Protection onboarding search.product: eADQiWindows 10XVcnh diff --git a/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md b/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md index a6aa4e4472..baf6178433 100644 --- a/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- title: Onboard endpoints and set up the Windows Defender ATP user access -description: Set up user access in Azure Active Directory and use Group Policy or do manual registry changes to onboard endpoints to the service. -keywords: onboarding, windows defender advanced threat protection onboarding, windows atp onboarding +description: Set up user access in Azure Active Directory and use Group Policy, SCCM, or do manual registry changes to onboard endpoints to the service. +keywords: onboarding, windows defender advanced threat protection onboarding, windows atp onboarding, sccm, group policy search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy diff --git a/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md index eba16ede92..1be3c1bfe6 100644 --- a/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- title: Windows Defender ATP service onboarding description: Assign users to the Windows Defender ATP service application in Azure Active Directory to grant access to the portal. -keywords: service onboarding, Windows Defender Advanced Threat Protection service onboarding +keywords: service onboarding, Windows Defender Advanced Threat Protection service onboarding, manage users, search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy diff --git a/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md b/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md index 6c0752a2bc..f976f74857 100644 --- a/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- title: Windows Defender Advanced Threat Protection settings description: Use the menu to configure the time zone, suppression rules, and view license information. -keywords: Windows Defender ATP settings, Windows Defender, cybersecurity threat intelligence, advanced threat protection +keywords: Windows Defender ATP settings, Windows Defender, cybersecurity threat intelligence, advanced threat protection, time zone, utc, local time, license, suppression rules search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index 152818fbdd..09251bb1f6 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- title: Troubleshoot Windows Defender ATP onboarding issues description: Troubleshoot issues that might arise during the onboarding of endpoints or to the Windows Defender ATP service. -keywords: troubleshoot onboarding, onboarding issues, event viewer, data collection and preview builds +keywords: troubleshoot onboarding, onboarding issues, event viewer, data collection and preview builds, telemetry and diagnostics search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy @@ -173,7 +173,7 @@ First, you should check that the service is set to start automatically when Wind ### Ensure the service is set to start -**Use the command line to check the Windows 10 telemetry and diganostics service startup type**: +**Use the command line to check the Windows 10 telemetry and diagnostics service startup type**: 1. Open an elevated command-line prompt on the endpoint: @@ -195,7 +195,7 @@ If the **START_TYPE** is not set to **AUTO_START**, then you'll need to set the -**Use the command line to set the Windows 10 telemetry and diganostics service to automatically start:** +**Use the command line to set the Windows 10 telemetry and diagnostics service to automatically start:** 1. Open an elevated command-line prompt on the endpoint: @@ -215,7 +215,7 @@ If the **START_TYPE** is not set to **AUTO_START**, then you'll need to set the sc qc diagtrack ``` -**Use the Windows Services console to check the Windows 10 telemetry and diganostics service startup type**: +**Use the Windows Services console to check the Windows 10 telemetry and diagnostics service startup type**: 1. Open the services console: @@ -230,7 +230,7 @@ If the **START_TYPE** is not set to **AUTO_START**, then you'll need to set the If the startup type is not set to **Automatic**, you'll need to change it so the service starts when the endpoint does. -**Use the Windows Services console to set the Windows 10 telemetry and diganostics service to automatically start:** +**Use the Windows Services console to set the Windows 10 telemetry and diagnostics service to automatically start:** 1. Open the services console: @@ -248,7 +248,7 @@ If the startup type is not set to **Automatic**, you'll need to change it so the ### Ensure the service is running -**Use the command line to check the Windows 10 telemetry and diganostics service is running**: +**Use the command line to check the Windows 10 telemetry and diagnostics service is running**: 1. Open an elevated command-line prompt on the endpoint: @@ -269,7 +269,7 @@ If the service is running, the result should look like the following screenshot: If the service **STATE** is not set to **RUNNING**, then you'll need to start it. -**Use the command line to start the Windows 10 telemetry and diganostics service:** +**Use the command line to start the Windows 10 telemetry and diagnostics service:** 1. Open an elevated command-line prompt on the endpoint: @@ -289,7 +289,7 @@ If the service **STATE** is not set to **RUNNING**, then you'll need to start it sc query diagtrack ``` -**Use the Windows Services console to check the Windows 10 telemetry and diganostics service is running**: +**Use the Windows Services console to check the Windows 10 telemetry and diagnostics service is running**: 1. Open the services console: @@ -304,7 +304,7 @@ If the service **STATE** is not set to **RUNNING**, then you'll need to start it If the service is not running, you'll need to start it. -**Use the Windows Services console to start the Windows 10 telemetry and diganostics service:** +**Use the Windows Services console to start the Windows 10 telemetry and diagnostics service:** 1. Open the services console: diff --git a/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md index 4c2347e870..4378da7bde 100644 --- a/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- title: Troubleshoot Windows Defender Advanced Threat Protection description: Find solutions and work arounds to known issues such as server errors when trying to access the service. -keywords: troubleshoot Windows Defender Advanced Threat Protection, troubleshoot Windows ATP, server error, access denied, invalid credentials +keywords: troubleshoot Windows Defender Advanced Threat Protection, troubleshoot Windows ATP, server error, access denied, invalid credentials, no data, dashboard portal, whitelist, event viewer search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy diff --git a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md index 460a963431..dd0fc24f67 100644 --- a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- title: Use the Windows Defender Advanced Threat Protection portal description: Learn about the features on Windows Defender ATP portal, including how alerts work, and suggestions on how to investigate possible breaches and attacks. -keywords: dashboard, alerts queue, manage alerts, investigation, investigate alerts, investigate machines, submit files, deep analysis, high, medium, low, severity, +keywords: dashboard, alerts queue, manage alerts, investigation, investigate alerts, investigate machines, submit files, deep analysis, high, medium, low, severity, ioc, ioa search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy diff --git a/windows/keep-secure/windows-defender-advanced-threat-protection.md b/windows/keep-secure/windows-defender-advanced-threat-protection.md index b7e191b23b..5637c81086 100644 --- a/windows/keep-secure/windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/windows-defender-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- title: Windows Defender Advanced Threat Protection - Windows Defender description: Windows Defender Advanced Threat Protection is an enterprise security service that helps detect and respond to possible cybersecurity threats related to advanced persistent threats. -keywords: introduction to Windows Defender Advanced Threat Protection, introduction to Windows Defender ATP, cybersecurity, advanced persistent threat, enterprise security +keywords: introduction to Windows Defender Advanced Threat Protection, introduction to Windows Defender ATP, cybersecurity, advanced persistent threat, enterprise security, endpoint behavioral sensor, cloud security, analytics, threat intelligence search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy From 2fdb566a28a4d205952b5e68bcfef9012ceff433 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 13 May 2016 13:52:28 +1000 Subject: [PATCH 276/439] fix typo --- ...t-error-codes-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md b/windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md index 13edaed0e6..f6244f66e0 100644 --- a/windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- title: Review events and errors on endpoints with Event Viewer description: Get descriptions and further troubleshooting steps (if required) for all events reported by the Windows Defender ATP service. -keywords: troubleshoot, event viewer, lof summary, failure code, failed, Windows Advanced Threat Protection service, cannot start, broken, can't start +keywords: troubleshoot, event viewer, log summary, failure code, failed, Windows Advanced Threat Protection service, cannot start, broken, can't start search.product: eADQiWindows 10XVcnh ms.prod: W10 ms.mktglfcycl: deploy From dc4fdde96ce65deffb54fef57300a0e21718196d Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 13 May 2016 10:20:21 -0700 Subject: [PATCH 277/439] new art, new content --- education/windows/TOC.md | 2 +- education/windows/images/app1.jpg | Bin 0 -> 34004 bytes education/windows/images/oobe.jpg | Bin 0 -> 27689 bytes education/windows/images/prov.jpg | Bin 0 -> 17796 bytes education/windows/images/setupmsg.jpg | Bin 0 -> 23035 bytes education/windows/images/signin.jpg | Bin 0 -> 5667 bytes education/windows/images/signinprov.jpg | Bin 0 -> 22869 bytes .../windows/set-up-school-pcs-technical.md | 112 ++++++++++++++++++ .../windows/use-set-up-school-pcs-app.md | 69 ++++++++++- 9 files changed, 180 insertions(+), 3 deletions(-) create mode 100644 education/windows/images/app1.jpg create mode 100644 education/windows/images/oobe.jpg create mode 100644 education/windows/images/prov.jpg create mode 100644 education/windows/images/setupmsg.jpg create mode 100644 education/windows/images/signin.jpg create mode 100644 education/windows/images/signinprov.jpg create mode 100644 education/windows/set-up-school-pcs-technical.md diff --git a/education/windows/TOC.md b/education/windows/TOC.md index 99abf98502..fa05afcd2e 100644 --- a/education/windows/TOC.md +++ b/education/windows/TOC.md @@ -1,5 +1,5 @@ # [Windows 10 for education](index.md) -## [Use Set up School PCs app](use-set-up-school-pcs-app.md) +## [Use the Set up School PCs app](use-set-up-school-pcs-app.md) ## [Set up students' PCs to join domain](set-up-students-pcs-to-join-domain.md) ## [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) ## [Chromebook migration guide](chromebook-migration-guide.md) \ No newline at end of file diff --git a/education/windows/images/app1.jpg b/education/windows/images/app1.jpg new file mode 100644 index 0000000000000000000000000000000000000000..cb7f4991836d2d930995a9d56fcb27e41ff71c01 GIT binary patch literal 34004 zcmeFZcUY6(mM|It>4HkHQMy#=ASEI{KtM#g)QCtIB0WGLic+Ks2uKi6dNCl$P?=F!Ze`~}UfF^+K(xpGozc=#B{?DKM`T3t;k)HI_RMda& z_`lbP-vQUCFC~#Nkze8ikX^e(e(e&m0{|q!dYOdLAEf@?E|HN_T&5&}L`z4yq53Kb zd~$L!60nykC`fmQkgfwLu3f%_}?`Zy|rLA*cSI@-M%-rI!rIo`oM<-_&S2rJDKmPz|V9@I~ z;SrHhZ=;iv->0OeeMm>-l#K>_FhbUGOwta?RsmcU2$B%Wq`medX5sIASoC3=4#s@*sK+q=QU#;0VrZ~G!~xN8F=s(Igm{4EzJCX=$!emX#y#Fj_g!UZCNp1AmcVE#tD;$|o03=~`k%K1Lszx$ zCh=c?;}Cc~JEKPWhd4E5L8`OkeCv%WmOnqfz;U z%bQl6{c&9>4%{{6tEq&a^xyivDIUBFSIK@}v7{qVLwWzkRTz6!*fO7#BrL|V1AX(6 zt!`a}Kcle4<oiE9^LYZVPr8@-f51W*e_5&?H@g^7Sm{6qjP zXo=z%5wJm*M+7Viz?ZD*bLIXEcQqFE103OPG@prpUu?QW!1wz^KwAP|3X^od`GYo0U!Rc;K;u>aQyj9;-kMUK-)37 zQZ>(h!Ab-?e(Ul|=vCsz2nR5y1J^B8nIQHy~1695a zx-3rebzY$Ctd5WDpnOM?&b7Dtx?=b58vne@RdJf22T1t049l$e%2ytE@OOcOv>lCw zeqwm|7y65L56#eX^~p4#6KhTvNO^MIl^pn@NTN~YUYIWXjptIYsuce1l$oTpYTMdY zgQ|bXYkBi$JNIyNRi1>Tx89SkTNix!JXVBj!wWA$F8lAsHm`B{#MntBS#N+=n-(dU z06HW){Ky|&vT4V|SZMk7s3yr!RQQ=e{~CSG7>5!EvK$*y+bwmrxwwF1swDz=%99|d z)mugIiQ@@ELQsM{{z}Bs$1>ksr0|}NPLg{bN5hJkfkO){7!06zq zOi3a!p$xTjvcQd6FMkb3KU~21C;SUc+y8(m(Ippe(F@<;1-*cG=q@LmGZYg6uYk7j z_T3g`_#l{)B$G2y*j*s{0um2CoM=U1g&_nLFyD~QdHH*i=v56}Bm$z6JAp?$CPV<4 zdIJ#C_?=HSJbNh zBOI_8E#OuQX{5WDi`N7`LuU9dKSLb#`8EOQf$1XzVHJr0id`b0+vR_S!u^#+lI5Sava#3xi&M-DFF7;BlXveiV&AG75dj)wAT---N>3C;bFaJa8p zkp?n5$Udh^m<3|4LvsnQOW=z-6X1V8qdNbA&J#bXjQ*9Tp#P!h|4{UQc=UfS2LFdg z|3~WnP5S>=rLNZhi9Sg-0$~(JLED6NB0#5E`;J+h|H4kojWPbchH#Rv@?+m@d%SH^ zo31DH{@KrMf;J0DK7sJJ!kLY1sZyDZv;hB|-3mi@mL)KjG4Y6`jEDBkEb<>uB;ZV~ z3h{3w;YYz^eoOB3is;-8lt7SW_XQq~=_3O4?6sK9*Af4nVE-BW@dN`*tAq%cy!W?> zx8M=&BAHG%cTEUwir{m#t-4Jctn~$ZkW>$EsuzI>0OLrO#_$ItEtX$_pS74DUHa3l zdCAd2r5M@HRD@8B`w8;iVW5^PtH{b<+JORzli~M=Skg12XiIeE6Ko^DFTAZm(c=6B z*YfSv3v=BNe)Dl9*4Di@>w@)*tZvauYS4*B(C5E0wxD|b_-VeeT)wE@K~2mcT1DpE zSNLrqz5egl?&&8M6S=tTT&|VOc0 z%%|5W7(FLYPNn4$pldhLB{0DunEuk7=(CEk>WqHJr(^OuXIdTT+l^Yav@^K(2X(Xs zcUKVy^Bxc1v&q$Gpj?_IeD}s1c0#zJ&ez@|CG|oF#8O=Q<<82TKAJSyW;Kch{5tcV z(P(KJDywGq@D!-1NKz{EWTA)H?3oZHGrm4=!m903?0| zlzrhrc47eVO!6bCMLl7gM*|5I3$e@V?0{2FP;_g@x zRBybKAHAclWGg7%UT@@nG8WS}mpM7<^>IC`8dV6@X;r7if-#02cM8K-#>;WaD;XhN znl-6wF1zN6Y-jOsiLvP$UnAPSI=TE}rG3ni<;vbA6KlO@Q&lnd6Q)w? z)aX~(hj^9ZEz7&u zB`;t~&RFyGUCB4yu)H#Nsgpo-Xc|VUqoF%|U&0~Hd_vCsJsQ_JWySOGhH#kl>oDPK zP3%ts)9C zPPC{n z{s>rrN`|*}bKESFSGM-@iuQo)!SQyQp-iDt@csD-{e4}+1F;tbz7)rM9zIIFU@YBx ztK%ly79Ea{w9@^-!n<+8Z(!FjF`e@?X!x6|W-0w&)o+m#Mya}MqtAT(=U*WVVyK0m zetNJQ_qf7Ir~>XJMYS0!hmov@colA*pGMsrwu3Ni)Sgn#&selv?`ScRX<%~<&-aZ9 zI*X5PT6g77Fr+&!WKBt~Nvo{QOg&$4te5Sv`U$VhmA@r4;&#%|JUqPbAztl&f6?q9dmN}_9)Izw(=NI-jhA=7(Z-Nsn= zr4UAw_^$KuwE_L$3;%DaYU-G&4g;?b^ID?u45mfB;R4k!7#(w=hl^CPFiT*>kq6zQ zit!_NuKQIZFK$#vKbCs%`LAz37F4u2R6ZOuIUstK-#6#Res*-(_B~E^Z&{ddD6zbv z7-8l*+O%)HSx{BTB3T*`(yTgon;VfdFjp>hGyJ}JmR2m&uj_XS)tkK3STo2<_N&zE zmNPm;0F7k%%8V4ljIFF<6UVdNQnc{d&=cc3c{SLdw6k=lDV}3q#%J)9nAev96tZjoA4AZmN_zmur z@#Vw{thmq3^%X>K^#u%X`}|ZFfJ#Cl7Ou(fGtAm(`6;|AnspsEV81Ek^30`AMD?ZK zdbU-k{4r%MS_Z<3Gscdrh`G0%9i;kMvVf5&PTnQVLJ++*1*7sfZI_}=`vUt6*rCRbz8kTY~-0!Y8BN|QGU4KNw^ zgsC_br|*FuSAXcmX!<+KoH<_)7m|{ClJL9LzG)ae(Xk6Mz(=gcL&&g-kDyKVmoxNV zNCo`dEtplDws!1IPy(1fp=edU7g(C=3i8v=X!IJIakU$SOT-7kl=VhZ^tMw)gYu=K zxofRTXXYQ`4X+OSPWd6t$9u071otG(OLWs(PKvIcKZ|!ClLt+9cZ^S;gdy&LO138i`DYaO^)bO zL#)w-8#JanO8`^&de^s^s#|e-YjU%pWWj9$!unZY)9u|~H1Xz7uEplFs@AL|hB+zq zR+SW)_@7$qO*9&aG4l0(os5-5+A-*7Nkh`Lv?UaNm(-+gLD||3BdjJmn*)#V4CBhH zVU&&aS%FE@<87C_HVYB=_@kxY(WzWY0`%PA$!5o0PiPC}Y8XZ0{LuS$?yOpfLH#ko zq@6v#2VF^;>>tRcgoK`pNc?hYFl2IPvJUM|JvATFA%!w%CgS$j#?=Q8a_RJgoolK= zNBx|8u4Gv4?$on)CcgBJWa{}|wKHko{;O`_ox9&=e|~M}aH8dyt25*1arn+5 zzq7!BlXXBJejl%NQ78N5mq5NXZCj;aCne#dHkwvWCimqauT4orsd3LAVHjeBBjvYu?^y2a36AUu)CMAjEqB*MI`wtKSSUZ41PB>b`;ar{Ax|l zy=(3I1ey)poK}n@khzA+jvVnwwFl*=HVeHfn%Qh|o3_ifmgry-_g48Z>yg5JYkJ}4 z_Z#c9%7_g8l<7^dzHO)cINoDxpvjq0FV;~KdT3>AWC2Mr=-hr*hVYy-ZaL=$y}|J- z#zG_)BM$W{-BoUtr&rT;RO_+|&Khz2xFY6j%3ZN&ZoYGV;nYli@&fIjwvx^6p4xy! z*lCc2uk)jDj`Vwmm*0HrAOdbt{q{3?-P(O)L|qiBX@EX$8w{Tg&-~UNSiTWpVQ~=g z)YH*GZ;RzA&G!zk9L%eO@qPB(sFUk+GY60(rE!Z}PeNQ@+ECIXB`h4h21U9L7I|5&Gu&Q0og2VmK|Bh?0>1xC%2S0)>d%-cFF zty*=~WCz1eY7lExeO{~Wa-9=>y0*+u?of&r*DI!Sf+|x{pa_sBIP#8DEqbs$lye+; z+^E78qf^~n?UF^ZTva|Z8NQMM+*6ePRxfD%+9t)vu}9e?ZuaRsQlfl4pr+M+Ha=lUM>WyUBJh@3Y%NwWpQ&Op~r$H!vtLmssQGFYA9PDZ>zeIei%H zZkGLZeO#)?NB+Q~er4&!QI^!?rhKqiUm{3h4tZFSfnog4S=hF~Zs%h4Q;hQSvuhcB zDNfO*iLCd3$7>1NDaH+ry?Win&QTYQr@=5*cw*N{xI&Fj1`xlKB8YDt z(wNJ&qme22PM77kXtTbuv6)xFCq8J2@)#W3a{3YK$|gYpGZtHenwsX>{xP%j;en^; z%`ipn`V>60!_1$)AZn)hA-a+3oa|HtZH2f&CWZK6|EPjD2yF2F8 z$00GXL;wSh%d>AutS?=B)%LD9mvBYg?h8*%@dsz#dHamtpX7S*l3^u$kTAZOZcflk zIpB4-EXlF*Csh@7jR(Fc#u@APSH9hnG}e6k z>1i!|#H1{Z{sMaMvFo8i-fF#LPHeqrl0|^O`QGujM)isT>+ukmVhRoUEU!4S2X;{3AWM)_P-=ltiBP`XE>p}?(Bp;&7o zz;Tmpd^)66=Bb86+XKw5jdxwxgO8Z*a^BJvvcIABJvIpb$P$2e|oS{GAcIt7N zr{fUq!)*#}5uv!xuaIrJCvkafPM5p-s|T=l5UCSYOr4pyAjUI7b`ZGHkWNT}-1at1 z^bq9nz>NplZ5x!Y{&Yy}%CMWaXjV3`I=ABPv$ovMt?8E=l+B428&iKSk`oR1&w53f z*D?>uyJZ9Y&AT<1UpQkw247IykOHEoB`f(3kpyNnw$%iEB_aS`PEdw#J|O+gwD!#!WlTlTzl>{1?I@Y8dYSD^_jFP`7XSJE?D|Tzhd=upBkDhMqV}5iu z>8E}=*ysNK_q!!1S3c+KZIJE!#HMG=Go%Nj^F?T>-GJ%x=9D0vx|!3o zyY>7*aBc9m&yYGBbg-=gE7irzf}xn6PsqcDtqq(HoOBJVoFSi82i9~7cnI8V?^e0e z+ZXZ3fAO8_@l4-`D)9v|&)Bc4LC;KF$`DX!n{g6keh!v|GgcCFC^TnY5@_zr8$W5@ zozb4F+TIAB&1P3;-$L>1go?R=(P{l(T96Rr0`{qx2;PVsJ42RzNmXndUQOb8X!@b!C##L5QSN;G_3K=s zvWLY;YdEJ{Y72D}dNn}B*Y@5yk6tibA~ZP4`0+}}Fjq%>fRq@F6SNy6qU9n^}oG#h^dJMw?Sq$Q{-E`h@*?C8)Q zUF9V++g5KlQ!Br?nZJE@>NNMvIv9!^*HzGtaJ5bUSXn7Wd)0Fpb`$Al$AgJTEOIH( zKu#`b_!I^{sl?|Cn8&zqr_Qqh{5CBYpEgL5_?yMA{0*X`Au@8kvT{@);i*lZJ;X=8 z_y^y8D^myhPqA&(lP)#sQ}$ zA#;0kGaj`*!=UF0z?n^O72jqSbGWaE$`Za$BKA?QQ2c_CdqiWCpAsOvF(B?CXl$nI z&LvZr84@OpO<8W-XWdG(lN;Levra{g!sHzaT2+k)cI=+jHoH#rh0lE`!*aaihOLsp z;^qoc^8B3w*;B>!Wtm2k0tLm77(F3rG#%~19Fs^;hrq099ll)*CF zZpBOufnSkL-|lH2KUJvlrY-?q4ZR6fpE(I7B?nNoVYUM*g`-AnGOR`=R%#TnRS2>$ zmPA~>0cO{D@8Pqj+KahAT}mu%nfJN!eRqd9E!8h1PYzlN;M=UXIuE_;ohE2M)1e-eY^XoH*MQR7hlIy_dgl3m2NK@HvKfME6})E zbE-P!;HawKF{by>peC!o*{&Z{pF4X4pI>Fmv;t|zn}L>YOjN-sTxDDWI8(6qj}6Q@ z!iTFG6~C3gPqVWzs)~E_>XQ9ONyax#7K;gtuIi#_t?|-jl|gE3U%PI@YNCI~Tj+{uRp(rctQmTYc$`eQ^XAnhv)uCO*V>vd z-W4g*Q`uQgnwTHnoZmU#4PH?U$8n$|@1twOP_>@&5{#XR&`iI6?P(QwjV`we+f{-1 zr>2euCAM$RdhFljc(`|gXpYOHzCpL{<7{dzf}+OCV0<+%Lf+5Ho_*7n!p-78^dwOw zu2HDSCbl$rMuRGEA@c?1_V!C#PDc)^8y zp{3eT(ROrWO)7rN2Hp}>mbIhRDy4nY;_5@(ChdIP6m$Y_Zqo=^{%&WrxeQ2NKQhyi zEaWPxNuKkao|wJ}oI#d3o2Zu?4}W~R&gLhkQXY($nVx9b+ElUY{sg63p3hzaPnQ~E zes?ynB5Vtz;k9#;&C9zO*{yM!*w*F!t5e-_ z3RyQMq^j@pf4C&zHRvPI`{fe<3x-Rr{K~ESHoGjSiiE0@W)Dcpo)_M;@as8h3Z*zO zj!R#F-NKgUZt`9oQw6SE0X-U1F5=%j$P0>ygGD)5mxi3_%yCHfa4p{1JxfV3 zu)vhPMsMq&f46V&3Ss=4zvx!(4B2j6b*=e@TY)2%x11o!{$wI&Uv;}#I))zOABq-M zz4-_!)py3auDjc85k@~2iL%&pc$aEbo#iwNAsTFzlWX;Po0rOYp=?WvZ(v5kk$&YI zTWML6Xna?U!rS12b`NLrfmg82Lfu)z)tdE~Yq#dF{(j-J)p#255{;oop407i!oF`4N138}MMNi6ZR9L32^VRt)G?N=I*k&G zpA(pY$2b=fdMfE4tk|~A2>Wkn^=5&ejMqvZ_s}LECp{hwN+WNUOe487mvMh#&6YCR zIvdiWnn1-+2}zIVdsY3C650~l!>))$?XAPMrzwI-HtLpo4Plq;0vq?^=J`=rn5xuC zoce^0%W|||*g{Q0~%|73hRKciF%y<3KnehsHCV=uK8<_;-)!EwkdmdjJxKw!alBw+pof^2$A z1XxPzd6%-VD9g?QM3^ys}y1PP_3``!6%cX?h&o&tu?(z%i zKX|U|NFlm&c1mBf{~jP)yV%UOG+(|{H_*HcWOKRGAx`j~cKPaNKB1eP+$Xfm8drnX zq@*~Y=4OzL-b$g|Eb?hQ9VP-&P~`pbGNM%_4Mwi`w0_6UeK1CaF%EQHyyfOL!sd=v z+(70M5pZSmg-e5}qOo|IHg!yWlG7vR9)WNAH)$2h(77t!PqAJFP+61eI+7+!v%^S5 z`f&vsTdQO$>cu>I`*J|TL{&10velekTlTw>e6NxIR)uNvd#>ocS{x+!ECrvh{M1hL zi)qHjUYet)Iie=D()^p+H^?-<2FAGy#pZVBn|taxFa{>6Dj}KU5Wj8O+xfh-=wZf? z5JIQgB1JRy3>hKtYIjF3D^ohawb!XIg^(0c);cl zly!br8n-0H4O7KRl>k|x+J~Lf2+=9SO}7JUUeoJ zvzJWP2v;x#h3Jb8>8)wC?kRcd&slSV2jdR}&`sB4Z}YFk>)5RDE3@C=>@^DS&UY5C zMSRIuR#7Ty4yg24cv!pXIm6W+rIy8cHUFWg*T=QY7Oo5_iXgrb(84i$^hXk%loN3!RPM|pYr zx}id`sC4^*mbT)4X_9Wwc1w)A*!B~WZ}asa>|b4x|L{u3d5Vj*DklXUQAe;88{bkZ zA^;Z~^yiB|QAnfVdNitylmVQ$=?vT-BLz^U{vJU6Z;wJ+O?0X1{4)w^#v?l3GKJwS zB?9c}vhlpfroLq`sec4ekN*)swa{22MS$;K{%`E8^807()rS9cAT2Reynotr)+ zgK)l-AtizfYjgxoQWIan6HtE=$?|WL$mr8gE0Xi_pFLL&;LPmQtbgK+k5j)HI*wSe zhJrMc+}W)?29NNW>3%x1w6HURK3$S1(Ok-= zz*_ue+CAu6pvfJp;~&!a;UdYvzZF&y{(ZL-<_KY8+0~24B87?t1}9#?b(EDBSmJew z0Dm@ca1t(IUD#+uvI>sHRX0=;0cGea`1w^9vO2%sj|oQLp@Py+Q|>j$E617nI})e4 zSuBZ$qqpUk7uZmX8Q{yIa+x8a8|NXmxfvjIDmLv@zQT!dLp6L#fES!+rd#jwS?F?Eh@{pCJp zQcV8Y7MH~F_k4(-r_77h$mq#q;ocCD2i(mo{L&0p&G?6lq8@xvL^sVzID z$uY}mpp)P0pEvu%5ovyvc11XgD6FQ!kCF@V-k9){;LdYh*MsJZoP1_lS-axHoBtXy z|MRNtG9Wq-lQR!ZFs~jtno&XOJZgHc32}F)Gmvl3ijMkJ$+U4vUM5Lz|LJEcghtXaZHMf*{!8etHJLLcGba*xR&iG`CC({=8M^!>{Ax^6!IY$Sh6mTF`fV=)uFR*eWrBZMbVyB&dBD9l|BvH>o z3?b1+{>i#2C)V!fT!ka+YOj*X`+V>{WXS_El4bJY#%Hh+ps7aLmXKGNXh(x z&5Xc);SU7{jS>5M>j=Cn_A+T*Yhhi{=j@VAuEE97L(@leU8|FuTk}Kw5PQPKyO7Hv z252JSB!uJ|#mGgr+g(9-g(a>4?MH5gzdaT&p;2E=249ZHa8Vf?EPYyEN0)c)qd^`$ zp$TVQe6$7jR&ua3lvE}nf$(7Py9%7r-NLnjhwX8?j!JGtO5_@Au^X%GrbNx&e6YD1 z1?IybLG?0RdrRSHxp012Er%^{Z}~$Os=MWER<(UvzycAM*T>ER_z#{(bNlAJsvvQ{mIyUQ>NukpO^Qe zqB&)FFa!l@>0WQrSuDKj_|C6L(2nj*>Sr3(4&^r(rP0r#P*`BIfr#r&IYy49{Qekm zYj@Ay#pzYIneP*h$3a)G+*4vXF-mgVz(u@x0sCf7O6f7X{-0&^SWaLuLdbv7W1{ zKhDFlD2tW3l70dAj$Ea26by=CAV+a=`;q7NHMJ2+61%^&n2m}|-!eZDA%97#BHIOL zconkh)6bJr;!iQ^6B|tnp;?V^O{m6_hib2wO8-ib;^~c(46rK^;HQ>mUOnV)*rv`n zqDsEhs0P#;**QWA8z%JDR8>W3(Tk{v#$R?TT8;~QPj9gjZ_wC0xUJ{ALS3X`DUmdE zBbOs5nwI`)v{)u)Ax;1t`L2&!f;)O=m*0b$je8wKN)gZLgo1Z7FD^r6Pky4?C6S&D z;I})=w+gn$dtzctM)~6@Dx8(IHy94@B`7=xFPgi&a11G$*iqE%V|Z(G`>sB(%}hY84B+-Z#Oe5((TfBil-kG zYg=P?wU@3M-R#pw5WZZw(nE zGL@IqXDRn_2AG65@=}rW5~EcTZUY7&^P#}sO!5Qmx4?t zUs6q$Ws{phwqGWuQ}bV>*3=Bq_o$Y&8d23hrCOOTAVvNhM+$HCXp8PP3XWw8e=mP! zCxp*!5qb`fc8ouMcRJT?Y zq2|z~Xmoj0zV8iwh1-Xl7Cxqx)xP%pN@o;%+6e&v_6RjOxI}L*nR=QfF-~S!<|Zn; z)-z3^2K#VumuFy2wU+mUA7HW6WZ9V_eauUW;%oU|*g^WfomF1wv=ISxU(bYiIU?*? z#7$F<$4pRK_`QS8Z-@ROoy->P*;SW$Tu6qNv=;NF>}5j+SAx{9y{cy8-U;IoNUn>g zhi8tZeI|9Qx%uMj4fg{SfmVwIdw$xYLH>Sx3%7>a!t1A$w)%RKBQ`F%O^L~=!Cngj z-<%s(%eM%vMmBeoyEgg6x)w{t=p!h+sgKIt1qQv89pSDT7tIbs<%c_i2`jubeRVOE zXzY(^_a%hg5qPT+nO##7*;73sMACrS}MBW$-5h8zQL8L zE>wBXWqLLv?E12kH2UEhj_GmS{+vn(M%_@xl28`{c2% ztiY^yY`g9@iM_}P5!0IeHCQU?E%YH)=5A0)80TH@`!*1~)~_lt5dFr zd-VML^iAg5IkA_`9+ACNp{?ZBFqQnp{6c!tG~+T{ZQXKBSf+f}z4?w#&Jo@cztoCj zOM9_*#r~_;X?CYV^Cn1f$lqGZR)^uek=ZdF*0)i2&(kS-dU}pjl_&NlUce~TN%-X_ zGF??#%wU=L(`d9kY1>2#pV5t*fWK*ikB&H#bW_Jf2xtqAOSq_Ej9S`&S9%cvh+T9Vsa7uoL{J8+kqSFB2~q@-jama~(~g)}$!?tib8g%} zbg>v*&JdXGa75;L5CL0x-+?<{&37~|%9xgWKX4|tKh4}|Ap)HH0|UTvp<>Gk;Z?GT z>p#6GMV52QhKEe`a|x%;6V5~BeZPFP6ljLm1e28cQxuY2;fE?6_6CA=Rb2u&8yTH4m-|&$EO!s_XHHVSzMc*{{DImVezCW zcea8YQ&PXyLaJ8`Q^oNnEZ6QL^X6^u300syK2EQcGQRI^d>W~~tgD#-#g|6Pc6|}L zULXW^R3w1k?!H(vRGpChoTeF+q=!#Ah70l7A1GAKJ`lM%He4Qavk6WbaL!_uN>Gt8tL7BbxDn!4( z4wDA|WeIyYM3`drtCMc>dw)K0kd4XG%3d*y<9YZSesxQn@w77FRzDzg9(IE?yB`SM zaIzL)Z8%OIBP6EAs_U5kIql(?)6-!9aLq;b2l=LHC@;KKkK`)>Ujb=6abkapkuX-9 z!+NK;=o|ctWjVNSIMgo={$;0DimqjL$nJUxD&C)zJvql}TtIMYb%x=gN+U2!uf<8^ z7r(~Gi&^8_58i*KThqKF@al1Hct|6c!;_EPuox204&c*rhg3CkaF2(PsY=HI20+_` zi7!ixQ|pkDo3Y9GACW=WL&6p6^^;|M0ceLR7rxOWc2aoq3o8NaCIY4cx>{IWU^7Tf zgCzYM%3^+351;T8ruhgI@yEO9Jx6f{`-ja(&Dpu6ZOH5rb=eLEo``@%i`MEuYXq-J ze93%ckU}W+(1QpwgkWOm&db|4*JC^%JZt}MPPE8X-jq`i?waf(Wl9-Lf2>6i8ttLZ z1*T8(=zAZasdokYJSekr5vHcL#1SVnq-b`8Q6V(e0-mP zJeqqrWA@6ix-M*sd-ss<-TnHbAIr#z-;6lUQV4Gv`t?eDwkIc-7?^EZ?lz^mjaC&l zhK1w%0HxPB%A)kFmgh|>+clFbiUBlAjUKrb_{~?HIxG=|Z^OQQG)*}jv*~Zac&6vi zRw-J=XG3IOKJcE+xjp!hrk|u5Y1T-j(TF42mSiNSi4!M)9lTJ-DPqq^1e3#m&cl8f zA0PjUoe%aZwRx;xtn0yPY5igOT4}LZ79|6-`JW97@6aC5k;)`|i7t>NiA%R$z}TY7 zBMaY}d_y!;iRvS3V>w$g2j6#LYPcBR7Dv1YcwKqA*W8jm zQsG=85fCSWS$j)@DU$>fIsYG+fY^)+ve15Y4m4`INxFD5RCG*r)$nW2QgEi49Y=jMKfQ< z4?0z4$jtB0%G7#NFOHUZfl0u&)|b5ko` zLjI@GCsjV+hf8PKy(s_1ES|2#7a*%*rQQ@X4uNvt=|l7Bo|zwn2bgy0?@sc$qH@1E zM+KIIc3rgz56|`8kDl)oGOTJKp0ZCr(YdO;yhfh=aE%?t?YY&`svw_|Gsoo)vCw?#B zuCXodgo5y2JaPJdbh?m559z(9Pu0yD>V95ZpVfBe|MfEH6}aprYz#XXRi9fN9ZxGY z7uI+TUq#8DZ+~at3a76r@G=TMwvL76@(|AK2vPn6u4A|c!UC|Gt&QL`GS_Q2@}Q{2{KnN93^%Xy#0%*gESBLG=b27xneIUCO+^>zVk?gqpKp_DPyNT4N|<|2pKO(NhaWjzs)$MlG5nQF)Sf_DR6MfIxb zO73PT9omo3T(VJN!y)A%k#iXRoo6a9(JSeaYL-FBHBx%iqY2bT22P4p?wYC4Bz$5t z{A5C%7Roxlc0OScVQ_s$kqvO>8ubdWGLawj6>FPA;#2;@NcetQ`DWA;0rZhA(3z!& zXVXVz%H2;8^%>V~avS{kOKGsKyt0QyqSd*W9I4=E1GLo3d5ULB2w%W56-=;UY6&!% zkP9^zbE|~61RzeWwt7@DwC7TFeAi}d2FIBx#j9#V;pkD)2?4gb@L!ut3m3mP3?uHy zz<+Ko?e}aySEuwU%C{YPAC#|EK=6FH;1$o$!(rkUU6eo6(35{)WN|UHnvEWuC-K;4 z;WjW>fIl9W!d?dBYNiGWp7D~O-@B#r(n_)U8C5e;u3#5H3PgxrfD;ly1P=TJWMB^w3 zYpVR+*;fg-aEACoKf_Bn&}b8AF#}G%dGF->)L3im>DV|%&uX_ODlbtE!dxhbZA&U+ zzcduuy};}@7!RU9g_iW&PpDFr8Z2G({ivocv#@BcGAEr(GacPx)s*q!7T}!*J4*@% za$=93=!5{LusQP}Zm5(U>*>|4JCWhb9+DRphYoRUyG&i0KPt}L?$u~~-?WX~IYjrh zqb{j(f6YKlCD9)%E-A+zT@6uZK6!+aay+o&k5Vqi+tCQ5fsM zeroTuy9$(^74ea_irPZli2zkUIF8ML2WwOLhRnrnsYE@V>-jlBJl7Nk7H8U~)Yi=azZ?T8f}1Rk@^kXR zfgea%Hve)T{~LurXTC%#BC2h}V1-w7V&xvgM>p@x?S6#8>3tf?H!l0g&k{y0vZsMn z-5p}DYft9|N7)wxE*_+`TO9K;82ox2JQaGM2#`B;(Pp3i72j)&n5?uNI>*N}Y%H650DY{JPZHhFoFaltiUx+YmLHJ^Ou;oHxa+CSqJ zzS37v+A%)TV7bVqH|iL?)zH009S=*J!opP(kP4QnMd@GrtFGVW5UMzWaB6;WleW&!LelAeR2`4wq$dj$jvpK0 z^iC~WOSxZ=?7UHnEQx!X@a6M z7P+!;!Bw4&mqL*I(pQQUc5aVOp6TE;_|GRemg_m;Z`BnNTaL2C#wPIwM_mmIubyQ3 zV^0pK2yevB3;DsA1d{o>Jqr?mb7M&-Fszj04oESJ1OsxCE9;XT9nRzO>6cvSXLu_a zOy(<$6Z;D3f&abMd?f-t6)`112%v1a07*562EkjIn;iT;5q`D^*HpWVp_arEI<`kpc5&YddqmL3&1S&gVg|c` zScQZ|!|v?Zc~MN~X$;}ED`#X(wRPOny}^g$&$aSo2i9~|Kg)kix-9u~()qdP_wN7( z3&PC@_-xV^$0wK%X|a!!W~ul5qMg9{@Xx3ce@4yyw;#$g)p7Y3BB9;tboh7zH5B|^ zou#^=VMJA!PRl*Gvx&xT|z%L+g~++AgW4!DmK0ZUFK(D@7_;b=-jOt}I+l5lGqbvcv^2EwpK z?6Vn;i&u#lb4)XT5P^~@_AVCpCXaf7wTXcC0d)ljf(|ttZQ@DAU_AzJQaY!2+GWa`a>~;*3rA4VoOW?+54v7T|fxwPz7KiYc$*uDov9$&#@%6a= zXVA(nFKo^@d-7jHM<|KYw92Sl5PNHnsyV9b|0wP|pqkpcby1YwEFd671q7uDh;*VN zARh`z}V=P}_ z?n)Fgv+b!>LZJ2*8>&%JEz@ox*JPBS_E$*{_VGW0VWJNNis#-ukE(YfVH@G%K7@QD zaP@=H+yl5o9cTpzu_C~!zPOFB)~z=N!u)GTXZn?ym(m&j8HP9qPt2QvyB=$PK&M~n zOID1b>9rV-e(|0UuOFxRN{_!eyN=`;`o7Tf;VB;xaOi$fpO@vo0RAo+@HxR~j8`X7 zHP7*u;G*WhjA~a$hRT0PQt1KVve!B>IJ76|wj+AoAUCLOhRtAB3UdwRa>i6`VWrFM zdBs`3z~mQJ@8a-v!NA@m*n$?KEAjO-J~LGae_TL_D+R1`nNWik>4#3LcKO+&YW^@n zLJj`Rkb!2d#(p4;%qh2rI^q-OE~c~1+D0cY8ah3<=HU7~&)rt>Jm8@ah9|tK=Zn?l z+R+_XQi$IqeV$Fssz3Sz!_r%mQ%zPK)&UDIu-&a;5&Yj1@;5Zo8M2e z-um=|DKb$4A26u;7y&ByANT#PrT14YYJa(v`(G9GovJh!OveD^&z3k-{2Jj5P}}GO zlAfYC^5Yh?EvDjqRk-I_B~Odp8Xrlbfw51ARc%Z%^~u85kA9N*k<3B%7OzP+uprF2 zxgIHfY*n}rJY(xLzTC-D@Fd)who|uL<;3@|Svi>QoIkNx?oDvi1vGN}NiSuWNVGYC zfoi9Cdi3Q_vbPL?E&uuuiAyHKCy?lkfpF#kF$)Y}BEU2sw5U8V&PIgU^X<(?F=t0R zxyn`Di=kNLU;aEgCq-cI!opi>T`<&mC7;fnJHtf*VtGa@$&YiOo(@ov1$TI=YL!85Zr zNrKFpjP&!s3Jm(X?Y=&eW&$y2ANJFY&fZa1-tkgha0!>cBO1Af$LKpvd*!?HO>C^y zs*1R8COo!3|HO5$LKv*68yT%fKt}|6GNy>CGJBMr0c!RfT6$e1pF?`mxIelDkRzj`F zXmtP=)qLP$3!Yya{UQiGi0Z@gdYY9c;o=G!`G7Ls0K3i@&@c#fXMg~c3K>cY1Ac2&dM zH9I@}74+p@p7G+@c{2C*!G=J~z(B54d)|Tgk~SG>qGH9I6^R;;Z2&Bp2#atADi8pj z0)AiJW+eEuyxdlLb5gQqxG-EqsK~}B!^Hm(!)AC*8xoNi-ngvBjEi}YkT0bJt@Eoq zaN6iym-WbaM3X9MU9R>#emQ_=D}hAqh-M52amxqJIg!s%6rxPPoNJmejU3SsVYqT# zDX-7j4iS?#oM8iBz^DO|VlN?u1=t7P2*({uD3yf~&TXQ=MDl<;fM<0z0|0FD0HL42 zWB2c~OE?IdH3Y)#`RPeaw#7(3i1BR`w9Xn({b+Kft5DC=QR_|Cf%CP>fIDz-!p}ORL7n8MGe8d>4e{mx{1?rx(=Eb*YPqB8b!EL@$8>vB{0q>=o~lB z0~uHLlZ>CT5WtzNfM(lqW7Xi?jEB`4z&b!>!VPFD*@Bx9hzr1!|5tr+IPV!CqI5)o z16C;-4W*xCaoVKPXUN?%AOdyRQPq3k=9?hw`6s}>DFd?QBgP@9r+iqzOjACY+dHO+ zQR|`HFD5+lkcY)<3xzjWpJ-C1?6Sf?i&o?jK+d99C-rZgx*lDY_SGO^IsHp|vkQZx zmtRQnr()Vd0DM17x{Q3M1f|f?>sF$B)p&}16(Jhbi@1PW-={~bo8UtSy@~1T$1oa{s@c^?^e%J^hU*mrb1HS6$Q|`KwO1u$xP6; zNwHWN!g22sxKR;tAt7#kh6#*P%L8w%6224jM9VKC_@>~4_=wfuggnfXZd1bT-~MNBu*URG}oJGH(4U;^CC9gJHbroQ?%9wSgNycq9g zI<9ChM~Dx~J*|A+U|n@lo?&b; zm?DSIS;VJfH8rF2u?G7E*uCMQE`~%{QoqYs?8z+LnG%K9-B);z$Sq(Y0ae#$d>_#V zoooMbLFuNapPm~0F_eHjhj;u+Sd{+G9?MSJqkbUlE7hHjCM^QHXMh@>$>3cO(1Pu! zV0O^D>Ii5z(s-}NR3+r&>w?#6{A4uS+!sj$T+Ac1#^boc=FA}uIk3GFev{z8f%gWa z%eY?y;TmAQp$@o&ML@vC>h$}mIVKa6s{7OvRt03umv8uTDtpXer;xP3DsA}*F!4vZ z3Cckw;HDqgI3nHjMPQV@;U+xh##YMn{3KJ70un{AmXtuYhy_$@OX?={!A&TY@iji^ zGK|o^BppZRRy%B?ubVnQ;a6M?7;mvDyY2utWLjXuYOas`5*5XK4;{N#q@(~i{1p;6PAK(EfUmUwO*(hYR zpILW&abc0qt>N1gx2lFeC%A4<39Ay6g(eO!AAm^rL1^X$P%o$fyv@Hb4Z%AG$ZS#M zx>#8iYr6XSUJ9iOO@ATZZWY3I?Nz*ATA~$iLPEmi(dd*#6{J1&q9%^sHOsEH5|U@( z6N?g>G&WV0P$pBfj`m83#^^2K7ZJ>GB&ukKEg7X)5vAs6Hzw&(HHFCCv502#q7?42 zggnVw=(^a6v0EtZ7fAvi6Ze+mz5!d%AGu(^ziG{{ux^O}i>BqpKiC|FX;)dd9>I@) zfc_+VH=X|~vYDPBaP%KlRBHZBVC138?-4%r>?KGCG@A@6p9FITQ7L_1H8@ePJzJew zQq3?HzcEDr#nin+`XbQ#z9*!o1(z{n@Ky`JZD8B$9Rth(=TB%jWA|CSW`O)7%|u_? z7ufr9&{%~#&2&su#23U=fMyL4Wd^zFG4;x*!!N8ee~2%Vz?G^YjI= zwWY`iv0O&y!KXB42%-hMfr@i@-Nv6}OxJ8#sTMxefXfH;M=`C>N0W^u7lMj5DIZ+R z$p1QT(9B(a%)~swmY+E!a!DiKRaRh`B^n zQ=6W&vMrB)HNi0Fkha2}wuk`c+3O_I6n5FzIRiV|=p7}J?E!N_(?6JgBm|Y0%z6%5 zfV%NsiV0r8w_tE&bX*^H+Z~AhFLBO#2K%v>jVd?2Mku)cYKbaGOOhM-XA>sA1uZ`%{4SEW=Qad?hTpA8FWa8ihs>+ zQ?POdPl?ElM)dg^h{#cDGT$}yL((OFT(usnC!@c`;8n-{suc~?g^t^C8CT*eu^<3wnrzLnz&oDuIjm=YYH&8!AnGOBY z-CS+&mt@Z|0a2qzI?XW#x3)FdJX2QHTn9gki(l)g2%E2}x~td^7GpDfs(bKZZ#8M# zT2j5Ite-l@%0Ab*o4)yFSMpE=YF9k5AB@{74jSM-53koQ{$f-t##vDyV^@xMO?}(G zF0Q6v6v3ZhYT-wEg$jtU`5^hof}aaFg3uW}8-e2Qi;)lnV z0>Nm+2g34kvM1vl&I>-`@`HRoC2s#c?!vQC2+gzrc3d^rVcBHqeMpOe^jgGYHGcdm z8hO=!)Eh4y)aN(4-n*sK)p8`dS&y8uFp@}&(yHWjiD-}*HlcJRyFDAc!}0iSQ7?4| zcdTqH$^MAs1-g&zib=l7l=K1bzr^|4pk3&v zg@PK-7<3(HP8w@zn;h5ywJWwOjgQc^LTw z)XXFc?Dx*zAJMb1p(~;(eb-FhNKxNQVl6|lfwmvX^K|qQe1!cxnLqaV#u3D9n?OhW zTmbU>^@Qr*O6IA`WdG|MQXXBC(xUtbZe}?~xHDZ*+ypXa&h~XjY|zNG+B2O0><`Nj z^$y-7hkW)|@!e`)$=uYI1&1I)6Sq6$$pmM?xNBg{90k%P5Zl{m&?TAgBG|&7U00=r>&%m>rB(vVcIR@cI?7oGNm+)G-)rihA1mfM# zElL_vl*J-jxMPefW?t_qNZrQ5%4juYX{F^8t7F9JHe@&6MM;$=a+U`CBs)(dcqDo{ zI5#wdPJ!93l^0>L2u?pl*oSwQREYh^^&N6TrfVvfZUe)kHty!}==kfW25lL~3=kBU zYL6AW^m>i!(17p9e2lwT(jG73_xFw|d4ICy_mIEI@_%FGohLi@3Q)A#jN`gWObu}7 z4wo0qyC_#-A>v~e(B;2emT_p9WP87nKJ-yJr)+iOhTM^33umVVx) znPq%HsFTKSYnMKe@n)I98uW%p@NWv$+fcU$DqdZ}CL_eF zs1|ppQYnZ+qqDuESj6=g#aB4`+mwADY=I+HhuN}v0uq5fZhT7OFr3&Z0lfZbNor(u zU!yZ1NNVk}V6M6)MWW?H_c*hC#sYG$E{xE5;htSso+*DdH?Jk4pn1(0(cMdf48&!Q7+XCk-dH%J#9gWB z{)0jDiR0|d#5od8HYloSqh1Qzu(69#v=K9N9B5xKGrcwoD@}W<18f;&1njx|LsfKo z8lrfNu}XWX6aNrd_mZo>?Z&$}8*S5XD;62n@|0msY6fi}d&z<6RWQ7F z14J?B!Xb8;D)VIfL+$yrSc8N42K{%3W{06};C9$~ZGgfbToritFQ&vP(2d3w3oB9^ zVCCug_lD_vA=q$lN0Si|G)1?PThtfL4L`He-dMZ&dFE_@luHo~tXDEpUYPM= z1IBk&WxBog%LeQ{yX(Pbq9yfkoDtIJbA9{43Rgj!P~vAgp#=qy;-{sSIKq z*IfJftH6jcyJSIaI?9*!CTw%(WuV~TSL{`LGt&O`wIe7^p}KwZ&$DliLqi2kyyqU zv0HsxxolLsxKd!fG}Op|^VL(z>_GZiBuLOub~x>!X$_Hc#D0Gr0540B^<#NTfj+gpp_tvDtk| zWn1rU`&Rnh4>gR&4+t!BsD)^@!2mfl@xh~4*0HoeU!>>7HWh2N^4V-Z;%?fc(}4NJJud0@CKQ%JmH^@AO7YH$Fa zemZh1H#{?GrU}8-A0Wo@@gy4cNvl?SwT7Arq~~x5MuS>GX9J#WG45AIdiJQB4~c~& zZ#*Swkyb^gl=rnx2XYw!6Q@w8P3^8i5`3@}-`ndG*WR5=OG%f*P>!$YI(>le9q1(X z=Kdsm4#!=mKWJ4~@1+Y+z(0#ZO}w#lkyJD2L=0(RyI8+lhQ|V-3RW&JH^y(5o>)}~ zGan%g-lIy7uE(<9GP5vPoY6fDj*y0m^}4#SeHdDVD3?F2Q}(b(*8*H$Kh@s97weHEU;SqkLE=CJ=x7p>_8avJ9Pe+HcbGxPk$w%HyXsDY{;p zF7+E-FTS*(S5T|!iE7zFqh58x_A|O2Vn+k$kCa_!W5dXvrkg-x?>8Rczy6~ZC^Qr`_9Vt-U+(Gwe*ZlMQX{3OHzzNzDDf?`S&C(?6 zAdia8nJ@5gOKckyEf}L~S}_nH=W65X2bA-%X!i5V;U0r{l&YyWsVcR z!YUaKkjm*N?djx6v;dS}>Q%{D0+4wHeqF6*n15a6_P18QgAn9%I4w@|K?MLzqbO@fZU$b};1hCk*|eOJ*MC%Oyr>*? z_JX24Q=;A5S|)MWqHlGP{?$}(EQ7{rAOdxJAuX0u4zctBTigYi6;d1{D=sxnXS)0%ggx zCNZl{W413MN}^b4zTjJJTt1{V0NZTiopL9u7Km|iHcBuGrm|+_51>!f!sB+BkhW|g z{n-zVr_Ua0$(ELW2)=eoL}t}WY%AV1!_#IzaWi{#v2y+Uk<24?f$<#i@7osS6^ZNk zH7I`gC|%^^W6f!EUyi-coz?iR-ba3;2m&QBUtVzbBK*RHgE@0`5;wa8=0%yQc~su+ zgtwd34l}eHPR@x|K9RC?Q7m-#B77pOvCrk&o9xPUV2@eIUQG9;xs~RO!OZP^HiEv>_erLtX)iE)C=LrP@UzA6 zXOFKT&xk^?#P6{IP63dlum{Oh)17=07fJ*BP_V@vt&WB8?Y?4)8yBE!hFSBeoR!|j zYc5?DUs1l!rgPM)%(cVP3f#gN1md8!a(e0QVHa^>*1h*Zvg5Vc!HjyJXX@%*hp_(hWy_Bv#u@(z8Y+3tRm8a_q)7y6J>M`P-GnMZp_8yc#UcV)5g%XHN!m zt|MDhC%3!Bh&N^q#ewC#FIF|aZicJY zJ!sqvSL94@!raQ3v){NHiI$mT8M!ll>kX9`Sq_WpxUT&b-I$CQ)2e-=*te&_98kXJyhZL+L+jXOi^ zCHFIYNTw{<;+3n;)#RhWhmYYLxC=%&TQtQ$fKv9fU2T>FCq`s$dr?`Y@wzW3qs4=c zyP3+*v^tAe^EZPn?i-TEk7@jGD)A-_SmB>aK_OgV7#<2 zMNsg}C}sA;%J_<4v+#Mx`->*tDVN2HqS+E@J?I{Dyh?eSwM)_9j)r4Y8Cxxa2Yj4& zlr1n6k^KWWWfyLUC+F~d!bAD$;joYNE!s~wPEf6r74PU1>jgn0FT-m{t@gdmDOu@T<3z4PUvwyP>*d=ERy-=;t;-U#t@Q{ij6DwOepxx5! zZE?Pwo6{#)X^SfZ?az6OQ&d~q(}^!}K=rv(cfX(t7aNBqLgnN&wkfsm<8atB>X|V? zBhQijIy2cR3#_+9tWmu5c9HsGoqQvFB%c!R#=(M=NB^E8s{I$E^iWT+g zze`K5gXoZUQyVCUP}YkZH~BL4r2P z5&msw)ux&i6<98IZK$fT6MsNLUL_PqQW^{P$unjC5z0Tg6h=@8ME5vMXbh}xNYdZk zBGmZErq^TD<|=I4T{$Az%#0q%^ujy=syB(J6(E&g2n*0wD5~mPhJfw;eNt4m zV~VQj?vQVK!!58gn0yowbibl}NS>RoY30aoWd!b=RH8v=F*f2gkg2h-8C}2MBlgx= z`u*!-w)cmB?5R4yp6cT7Se*WD)21fK!aVL4|C#k%f1}p&k>r&s-6fC=xW2)46q)U4 zZ%#EL*~VNGU}``>UHqHOhS^Xz`?B;q( znj{aKl}zHE13fQHWCNcEE7w7)#GOEtCp;XwT2alV(OMrv_by&MHmgvSv+dz=CQb_f%nn3L;;5Jj#+CAIsg`kd)D^W`uBgxoj-a0>$-TXl-Rse-^gm`nxo?=bnwXbVQF;CaI{r) zxszZO%lf7rENRVP8K2|BlACR6*XvxRee>!n)kemo>gJWVHXQzER6b^#u4zw6774$o z)W>+rJmkL4cS$1s$$i4wba~u_u5#t;HVu=n#xCKKw5&IAT~k75+CAo;u0B&Xj752J zI7GemVsU@{NKnyYyy{Lh@v}?4r6)>yvq;1vuY94xPB`P;6o06u%vXIKyw$bph44mx z4ti*Gn_R9^_JMK3O?+KSLZ@368WpV}oB+qUo!mUtj9+M`ofB{E~$$7h=UG00p~ zL2&ZIe(`_^NoJW#9Dyy8(#WxgR9>KZ`pRfN$+5DsM)|RxsLOe5=KRT^?>D+a1OZlb zv$Kz6xqvVjWl=Aso*(2t&KoTu*c0<$LBat-<=6>(@3^ZFu9PH$(NKzH3CfAn&GF$3winKv{fwdD zO84fHF{_qM%%vTT6Wl}Y0jEA~OFUFO8{=%s`N(HXZhR!rfN%rgb`JeJW9+wbbn=|^@fnn2maP{4EmR*5yeOSEYfz zyZht$idr)kAPhEilp=b@GGALSJ2+QZXrf_y{7^yG#LM3n!-%!|Izt=8VK0^Jw7b0q zdAH(i@8J2Nm=9T5Q|_DVPSe6Zrv2tJ=f~iPM<>Qz*UYci;^emYjYnXjo|}xz$&d02 z8{S)3WznLRk~|lMq{V4YSXxv>1TWabKp~){z%|ujpx%6~ zr_g@>Cs`p^EM@q)mIrC)Xc>&MYAg=);KiQ+k`hC0TE=Yen{*oaJ6j2@`%&sgS#-pufk9# z3fg>OZN6lFMXRu#NuiQpcG*ltTGvM0=KeD?LA1@rr>r$EN7RG`LTFR}Ga^xzybr-{yT$q|820+R|ezsBWJPahjRl%vBmO6w+r;u@yQkW9~n_ zfvHT|e;{XJ_=lRG(ucXnzJ`a+ zG~&7O1zBY|6rROF)C4NPW^L|r;g~jBIb&fs)=2?%ala*kE=%Z9jWL$sEMbp!zwwNw zX=d?K>JY&Uf69C%O=ycR_EV94Y|=q|b7rGwVC71t*^?F5hHp&k-KB+B)@{1BZ)+*P zAjuNr1GKSgsE=DJa8DH8B=Ft+O5wcI$R{MjfO}tUGUK(+M=~sU1W-H{Hr9pRErOJ_ zN>6tPOO+D9Js*ae=57qlRCZ;Em~?a*WV-k(B#w6QdYPZbE;WG}gZdDcD(Z(=G*20i z+dIE=kgD{iz)WZl1`SiCaf=!0U#$t4s7|ncp1rk59yc2oilpD`aRETd;w80yQ1B+MBsUFkAeMwL!sX=Bj>p1wK{6sHS%0X(~@e)cSMC zosrA)MF`KPla23LCF)LmLn$iY+?#{W;;IVlNoNp&>djx;?fJ4c-I=?b;|JKDDe>Ne zvM&1a9IBCbwW*y-yBoROJiGKrtrHrrRw(D_?N6wbb{)%R$G*3`d&A9s%Hm#PQGMEG zH-Il~$iMh=Vfk-lRRTt!vveLef!3ukXSU-1;5 zse0eZu2~ksN)k=BgR>U{OV9gZU%}m# zCIlyerUs%l%Cp5hlI`npRGG_HkydD9>nIepUvs%Eg3LGb;=q)4w=$>oq1xohMI5{d zU`N*TZAqYnWa&r3^6W-}ME$``Gp4I0Q-L`ho&sa+i&svDBRYSG16vC7&5>3YB+4Hbso3lZ@+b*5iFy8WoSKj!E*^YbLjPByX-mIa6emGpkhK94)Gq|I|kD? zv0{)PzT01_i=vb}_*&hCH6=7($I|>}at$fHc@EtT$2xO33 z9O)j%AsPQe98yrTkt8*u$mLkFn#=&pTdsY7{Tt+#0sW~ALraL;+XwH4ID(DdpGp4M zsOHvT#;#K+>#iGY57RZi`Mq>>ZZozB0}TbS`D9qdX^}=~iTM(Y6^Cgq>0R#pA9n!8 z#9{5u<2hU}8b@%Hin!2fe#L^x^q$lF5Jc;}nf$%e+ufha%Ivf*eE#~CmAMBUtq%e? zQBfPJy4@vCysKTRo`wB~4j$eB*|XlLu$On#{OTxwvJ=8O&S$-+a(PShx^x`xV9%V^f{JO4Ud%JRS2Ofn7fWP8vx zg5#JFK`K`vMaTnx@}Yy;t!4MG`^A34iE^eJjkDR|PRir$vFK=5^B%xt`~C?y&JqIx z1e6kf9WZRG0gzd}fC$dZ4ia;Q~Rr+ z{rleB9iBE<6~QrzSJ??a$u1FrkjIHZg2D!1`n! z=kg8w!<}Svz$FnY(CRPsw+Dm%^)YmgcKw6y{I2_wyAqwh0Z_Z--)ct(iP%>j1-6D) z0sk1{s+CzaCS$9avxRh0YMxt0bS|iT%9~G(RRjV6WgUNwBK&u*Iemds$%K_i$YLPU zFnFg&c9V41IE)B311}$51LiJ3$bEG@j)r>y+dmu_UqHwHI;L#E7YO_OaZK5N@l9^B zk>1wO_7xZl0NKqHm`8V*QQgv#D}2O4r<^N*k^0BI+3m!`o7|B{ir^7b@JxdG zkD>MEwfCUZz@-r`j;-h3e)^G~buh}9>w&WEcWXvq@S9Qjpi)~y5vv$$icY0Vkus;U zl@vNIch3zxL-ZF`|G;l0junLREI55qOo;x$Z^=yhWAs|{JTMI(@}zO3^&Pd66g@s zKQ4QL+&c{?pcidLM+LyL`0q)Pi(u4qpxHYEb0k8t#b4e~9Pm;Y|9B_DFF@>|xix?) z>!!I_QTFF60WM||OsiVJ=f`kqjGWl1<$^X4;&f~^%0uyoryc_U-ct!oVOuKnR`nA8_ zr#S64i=0A{m=C!sfj|@w$K9V~xqr^dA>YgY=!t*!%>V83$tmzR6#y7@282-uw3Xdv n!BZ>1@D5UirGvk90aQ8*{@*&CdE0mYLeV+-|KXbP=h*)M22Yu1 literal 0 HcmV?d00001 diff --git a/education/windows/images/oobe.jpg b/education/windows/images/oobe.jpg new file mode 100644 index 0000000000000000000000000000000000000000..53a5dab6bfe01da8909934ed8a1ea5bcf7b075b3 GIT binary patch literal 27689 zcmdqJXIN9))&?3y1O-Hp-eRGsG^Hv6*@}RGi1a2zIspNZUZW^gilBgk7-`apbg7Xp z2qIl-=)EMA5JP*GFu ze-0lyL`6+=n1*KmqCG-)gqHRwEe*|4hNDO6=z$N-kz7*Odb9q>Te zaX@`4s)K;C)Q1iMPX_?^L5G;AnNMB3diaF41Egu9O zIm*V)!O0~cD0KGRc`0cb*-Mw@l&&kQsNPUh*VWTEFf=kYv9h+YwX=sgxVd|HdU^Z! zK7JA$5*ijB5%>H>d_v;OS4nB<8JX|0vU75aOG?YiD?U_KH8eIgx3qq0Ywzjp>mL~W zHZ(jrH9a#sH@~pBgx%QO+Q#kRclY+~Isl^jVb&j({mm{Wz^;RU4-V1n+jZce7jRKA z9il#U@i6mMZ5j*L6Q?B}(Xw2NO)aWFaz;`I!)p1U`zRZ~)T97*-?ZpP@(ZeH#!*56VvAoQb%RtR&A zCIzG<8xFxZxl%yQ-B@w5Iy4-$a?y_h%49aU#DQGSS2$|kuDCShuDT(1hDl#9v1TU# z>Sje|GYm&9*kXmq422MU6=c!|pG*#MVTMl(Pg6io^WA!$$?mdNyw4=&t*L;G@`zpQ zwp~OK)Cu_4&M7S-_Z>La9p3O6D@&pu=cj<`%UUTQcBAU|a#M*?0p^Jt$PaL%g8yZs z7E*PhD<|mLkv-iitL^lqEmV9!{dUCXRY+|z7*kCA)kX@4PPhrZCF%W~0y;bhCYo7& z^=A3eCG>}$t^ZNa-R6Tac|BzPos)ab&^frD%uoB7D4-tzq?6eIAOV2DKLBb?`_X`I zSsMO|wDOGt3QnAI+2gEHqktYe#*oEg@Wz3H6i{k%6C5w|fdZOZ=8I57YU~=0f{nkU z_lH)He}~?d_O>syy>60Zi`@KQn%=G2zX(512;NRYb&zrQ{^1eTU!m}bQ3f0CyA(X& zKmkb-hKc|*#eYHbAAk=i{6zO}cKq8Y_}z|)z0RN5djB=H{($!P*!u}B<9`pWcz!?G zZl?r@=3kuk)0=-pv+voxTJc%veR7H6E@Hg%AHG`n!=0+XyR&HFM;tc%X~ZuB8lBbymDlZi)= z8`)8N+5%Pstxd??bAdt>(EH|f@(VSi>4IBey!ICK85YudYyQk^vvH8%RQOc z!0S>UNS#ChY4yn;ao+JVU>a!t)xgG6L=?aal;F7wsNhrHN7_(v`8!9h3^%&!2JRt2|rf_`)|-zxh#yrtM`F~sp$Glp80SzV@m!LV$t4R+S3R1^+f=(bAH6Uf-?L1< z&T(YZh2T`tQF(RlK_f#9GYKK@WQRdb&o@#)Cmb{+VRal>nZ&$tT0{3JhO!yS8!TQ< zMddVZ5t|p>vFcIYYSO}2t{9_}{GhYWg9`FCHzDQeXNL-HJpA%ZxXH3xia{8|`YzhB zz%S6!!^v6rW#!PuDoD8eMfu@v@^cU8dtWv3R0h6|JmTL}H*Nnd=i&UEt)7a-tQWM{ zAQL_fJ!XveYBD)iJBeb2v73;x!p(%<7ZtxRfyM1PHpSAv4|r8DyLntVVOJh?p(e#eIy)6( zsiE{aE0|7-iR^Qi>w^xigO20Ny_tpXdeKJ0d!R)QVh;^)o3 zqNikot)G4@8daOtyklZU0omeR+COO6Lv}RjHdwedYO@8%V&-iszQbFZRe^NkjXq zV<@1Q0{0ofEBFnKVfJkk z-Ld+gy?d_*DA!!YUC!`(ng^4nHRtxb8~Q04cDjODYN_QbeO>n)(`ODdbT{DS%E z%4FSv)aPm+1}4O_hUJfd0ckhP)a9>PzSE29i}z5yz0`E!9l_grg$|QGwrZLQ0*Y};~p9qPC+o(pbYz9qPZZJ-#|w0 zQ>mJ0sZd?q)QEex#ES~!Ltac;bgHMFy_D5#Hg2j%6J45JzO9XX1RwKYur9Ck@yTcv zEybDW=d)|RYvXN6=d9`zRLh8IgIMWpTI_Om1bZuQD*CW>Ki)a+Hx++ZzolQlm5Pd0 zZ-eNN^kR9;bJo#R(;=OLe-+1^O@(gM5o_a`oD|kOgqS8^EzB9>=o6na|J2bqF<43 zbcrjlsL;%jZgRW7^aHzwN*Ok|Bk5*R%uwk&W4bP!ZRE)4T{dIR8~P9dZ`r5*hS}ch zrsS{vg-Lr@tLQ_vQC2rjM|rlg*gxcV&BbItJiBsP`W4Q*jRG>LTyF(plkLh-=6Uk= zda+|~$1AJ%=G|qgV`UXY|Cr1=X>#)$UJPRsBD9Y2{eZNeW0YUhaAJr@3jB8T87r3e z4t&>Gql^x{xc;d{=Go!VtOp^7i|Ry(R2WnP;}G0n@Lexa9~|K!s-&#psNgA8hQiFq zGA%Pmo%k3PBX>1R^?WsQFE1=mS;Pp>Jdzf42v!=&6kRGJ%-No;yK;UyamtC~ONpnK zugM-7<)nE1^Myw9TT(hz#e+_w6wo08)s*VWRSY>m-(B>CHkL6MStu>4q6yLI@9<(P z`Brb0ddDTDLVWFGU8VQ<#kP-@dIxK$f%NJ1wu^966@zPSPU_4Wkuvt+DD)^e93TO# zEX-9B&ZSr0FlrHfo1}eSY``+?NaMv_!pb74nF6Y_zi=+b@%+R#M|OI`)I@$>MfyU; zIt2vEeHFsyOm22TXSv{o2CT?O`X`g=#F-tqLSv-uw;;!c;0|56rm%3=qr-E;skPcK zRnNe@JPl8(W2yL8nSEL=%cGb{X(+oq3TSA#SvX@%x_>4?XoV}~+mnE3QB7^Zq@Hsu z@z2{s{487LrJlIgE5hI1a<9ELzQG#$r7YeqvhApPYTt|v2dl-K4qC-0*7`BW9V_b2 zW2tckIb(OAOG%lHW8-GG2y>N5Dk5tgJ|Z1zLgPrf$1S~izWtTc3$bs6S)Zf`>tucw z+o{yk{_S#F?c>&?XVV`3HfnBv;noD^=SizqYbnPxR6pwUal9i!*(t z!kpL;=GrMZjL_|IkD)Tw*?mK=PTzGrk;ihk9x2?YV^wNlA@*U_YFFc_Abb0B#(xIpKp1+(m;`fXaIO|_wbJSSLU4-h~NuGy|3d%wP)yIrIxm92V zr-LC9giRfD<55_}1JhB{E+^L`BmBD8yW2Ro&VM`}5SA7AsD1du@OgXpyy_@1zlD`` z{-QD)wY4}J`;&H)tTR*&2`fhq;X0L~VdsS2tBX26jQmQ?qRS6zX3_qQ`oFxm!T+H; z+fMjioW<4&;fuE|pmzh?QRV1H_(38KX8p0hPu8+*m#Y9eSYAm=CTP+MQxoHsef^Y( z+q_to+(mPU*U`;~2k^us`}?ZgsP*S}F26GkZRyp+9&5Xjcjd}zDmQxoXVFIaW{^0tnnysoOOF2K;Frshf8c}TLoRc$Gs>6sQ< zPoo{ARNZ;+o=B0E^!LBL(||=H=QEh@ z-I$8XFv7Qxk=S(HeJnrP!bwb2?8_AI0DHptk*l(ys{@;=DN?)rf`|7eT46aYE=Sr3 zcc~*PnTU^{X<@%>2H#gq{S_bIgSmK^ds(KVvB1uvmm`zbWhCv8c8uw`!U((|VZOJH zkCdax=Piz_$16>B(y4{2V!R%$^HD%LrV7U{iDkwkkzhBcgK9<2xNIsJmUEzEYAEql z8q5_VyvzMTbG9DQ8nuA8`M!N@4MX0kNN}F7n%4^Ks;VdNQhfhS-Zb zlLto&5zmgb8f+7?h-cGdC(of1^2-eH)f5nP?)<9(!OYh=sw#-ak*w710%Qw%Xk7>I zAm!M}Hcr>6rJSf)R{gYIo1e^D9l*6Q>^GF5CX3!3evwe2ee!aJ5iUow+BEMu?h^@7 z!;3xk`8K92XbYe3?uVB)z1;dlbh=LV!m{UyQ^!UkkT`#@&n2E?8 zU<%H}T2z+h2@4y$-6NpumNkT7b2m$Blxv686p@K=VYmsxXVLr$o(2oPg~jFAIbs@> zd$(2IQsH(D}OUw$ntU+viHQzW?`T!IP@JV^n{ zS#LLj#;r=MwOsIQ6gpVPaXEwURLCNdYxnghCkm*jM?=yw(7^M{G5>b_%M0M~Wl|%V z#Ts4)D48@L$}p*y91l~7+bKwcKD8~LqF2&Lh%}&p?EFd=z#Qa$t~&^t8qG|+M@VS4 zcW>jKL3{xW$K_@O^J32I+d!))bhDPJ@t*8u@7&mV7R{1lC-jl#R?1%Q0}xpph-{

    %*qNy}-?wY4>3!LGeGepK0C??tYvjnj#W?d+v<$)P~B2_`D8?yI$i>!W~P z@hG-r+3j5H({)=z@3f`=xTR1AnY+5;;0br*RhGQJ?LwI8nenY4ZP7;#Ru5(9u?H&8})dhZw>- z(ALi(;43NWR@a(UcE%S~Y~abBXm~@RsI>d_v|gb2OnY_e-_)K!jfwh&j{6rirp;e# zOg@G{V9%iba^Oi5qBKwxnD}2A+}6l@Y9@RQGdoL~iOsvBN^j`pyu#{Z$-)O}YYyZt zLXLv*LamJ>@CYbI9ex0BOIX$ZhJW6$vuC|g-xQlMXy}@tbCo+}B{E3j@~2LJ@i6F` z`zjHguDIS<9pITs0VQs$R+tJajq-r%ZYWv=Hr1J;$Jl7DW z#6C@x%^HJA#9b@HL$DCdK`D}sQo6mXLo6(b$K<-qB8-$S@FJ0F74(Wr+L5D4?I9Dl zg?O>VhZE#RuVR@j52xv;ohJke*@$5T&qWPn~+EWJqh`Cl`TcSSczdMv16k{ROHs9 zMy8av)4t9NrO2>h=i0n+*d9Erv{UJJZ+e7jwT9-cb8Di^`sfoHToHKlAw#&MYaEza}Un78w@q445Ums3_lscp4%UVf9$h7uKBH0J1+JJQZ^XcCI?bD;r z$#^LTp8ti~`*Rex0C@(nQ=fi&)-3#|0yua}%qlnHyA5zge4n2Hz#%;NKIsmL?*RLP zbqrjg=U3GJfTHA26!Gwu^xwgQOscfOD*-fN|3VwLe}MQGZL+c-6gDA-WucqH(_{i< zTJ@&`P@zNzg*XbR>oR2hIhp0&?A{19~lMlym{;G@ZO`DX);>Mf3p z6JtW*6B9!w@L|V~H`jW=`0G{A5xapOkU?^l$Xei5hCK@Aa$rpdg;n$70CL?(68>z! zG_>|Uk{FS_7no0^dkUFxG!~id2R71_=t$J1WySyF@QCSbrJ?l;Ni#u zr-Ht?CVuVq?1x2G!657BooV7Dy~*$}Vf4uGGafFOX5k0h%o zppa~QF63__^!)!Wf)0`N>_h}qw-J7t@GQWO^``(}r5BQg2TEvV-KiKd>mHDX_|nN- zh^e;}P*M(7=}#RH1&0v6a2;R^2fzcNT%y_NYKP1u+hZz>2#qejJ<6qXvTE56wqX@;&}?FTmM&}vwlSG z?Vpj`->^wqx)osmJ6;5(??DPg$akmYA$I?Y7+{XpK43q+WDc)Y?IbPzqw|$SI!PvEvbK##oLt79`^2%62GItj<{%MmUe^vR@ zwvcJVzIjx_*$q?6nvRaVxLaR;YZEM1m9l(z!O{NOg*!zCstW3H$#cooz#1^S<6otW z{r~&dY2z0rC;$F0Sp#Yv*p4n@e@Fqrz(a(_q~{llu+XP*>-BQCO$SdAHR&tlg1#*D zP#cZhjG%pZDYEV2r9<>Y=UeAxf;mY2_pottgM6?@c@gi@RnoKg*F6@?mkXjhkenKf z+U;f1QvLZ9P+{w+xipY^{qQu?0bd?x6EA)kl+p;e)-!VZ`OV```;xV)`pfdX#VnIx zjipoQTVbWAE;PPCpSgD#2{nhZko*m|h8SDdBOkIur2i8mf7nD}MI{4-dhPI2HWpwtsFq>R?TkkC>vU>au3D zdHe9L8QRo*Z@q78Hu-MK?6ytE>Y!HDm{zKk__w5n^=Z{+Et;jevsK;BimX>0*jqFl zeKHWL6=E)HA#J!Dr z7P+t0UdxUSWP&(N%^wDXt-v)Wg@5g8EK%JbtjY}6hZUn~$yktSsJ3Ey9< z;J!P;bC&b<=x^R%dN)vyh_GCuG}bv8X)im-WnPxiA$AXW@?*ld_A}lGv|U2k>&C(d zorH@5;9NSNH-&6?G)vL(j=~jiQIUMaZ_yTs&9Wj2+rw*Z#-b!=vfWq$7^BG;S~U=y z>FvJrQ)(wal(Hs?&$aA<`x4`+$^yYH8wAr{%0AK(S zlad&g(ZfC^Slrv{^!5r=a}vL@(vj4Xj=SP%Au@GiGU`B*(&@ZMgxa@3{TuJ2H0)dy z+|W|AiOyr`&KDzHbv4d)oXQ$N!-KsBF~utdX=28OhfOCF#|iM8gv4t=0GoT;HJXcH zg`tj$l335=)J3l3+G4!Zx*dO;j1ptMoXIjw01r36-{s?eih5P2_ek=B5t{ z#`uT}93>{Nma~v<)EAt4_3*RAG;i6iBi=?g-*yOw8@4}7XA)d-`qs7aD427{NynRK zr&YZN6BFSf4)RW5uu`smuGueoJ&&Qo2+a{E6pnozlO$`S*b$JUA>7e_`Ro)@$WfNH z`%2!u!r|(QtEv*8Ur%?2?&z-}$MOO`Zz>`OAQOq6zIKhGrcFXkZ)8dwxgD!Rg9r^@ z8>;B8rj9tI@tV~Q1h$yl=D4|cAQ?{Uz*U~< z`JVezAu>^a;8dB~32%EVd-vJMDzT3~mb}l@He#_dZ~ad=PL_BH;TTegRj=7D@#z^# zG}G&}U-~i^Jee6Z`6-lYIoeu;#8rA_$Gy8EudfWts>E)3SY8^11e|Gyz*8PD!Tp6(K+r@Ikk1aYP@m5txnWG2K^-eLlHWe!3=%88SK;`kNbKzqgfxHe)jS3q5H}f z=ux#ihZE*^+C=;N`wHZH)thG$R0L9nVgz2ssmaGVoJp7)9oQR4+120iD_|xJ!G}5R zga~!0DbEp24`NK2yfP57k1M{q5S1+`pd+|cluD)YQ=`PIH@0r1Ki4aHe`766_P}J- z5$_6y_KUf-ASOc=~A}9)#JbmM za@8yk)16f~0-CG4673p~`F7*hlToOws&gbkjJp1I(^MAyb(TbN{lM&yX)>)DhV6?% zw9}Q=a$YujOyH?nZ@}wIxlSJ%sc76kFq-~`uOm-qM)N9I&i#mJ#(^b)Cc9@yatW%sAv@b6kd z^Z3}5A103nWbD~}UN%7;C7!@O!>?;%Z8QA!oqQNjp;AvjA)W8tG?`6Xu8LTa>^eO5 zm8EwrxZygoO2%57e*{zjWyQNSB|%n?OrcMh;-O9Er>p#U{Td5+gIee1*>NUk7A0D2 z<1Te(Jb>*zxusvi(A-q0cf|Su1vDV?nGDxjKSMJ644>~%oCeN~hH?<8V8H&h9e%`j zUYJz3%dy-F)L4wfWho-tU{OBtSZV78h z+L_D4TG8SHeKlV20;3@ZIgjWHuWaMw6kJ}8(W~@|s!|Vq<`Eawmfjb!bjMtjdlcoo zkKD89@rO(~YCP>?UL20^eC?ZAfD2FkMtZKQw)OeynZu?x9`-Z&G>~3fSo>HxK=x4$ z>{_?r!3sVe}ch!0mmw8cor%%=b-0|`4*SETI^S#m*n{va7PuP*3<+s;Juvqq}o=THf zep%t-1gU*4#{1cDUqc@#@zV4JI}wlX0;;~lKr!kLZ;T=zup`U+!+;Wt3XZMX!$;e< zmN}7XUjo6s8?X|yLSI4lS6x#CYWz?he=4Bh5a)8GfOPjChD^2q+q|gx))oZ*HiQD= zMk0$=RW2>6;&4_#{W-hyp8OFAxu(GB88F_p^`i*9H3ryP!n}1M%c>GDp(ofN)8E_5 z{%G5(ev!C99`At96YFr`Z=5bfe9UOfv!C63Zh_+=Kbsy0NC9z9;IuLcg&zxm$2eSE z{j*yjf;P~*Sa2oy;}!geeA?t?_LUs2B5@SfWxc+fZwHY!GCH!|Ch$%e{1~H!pYwNwG+uat{6J9zrP)D zJ{JeL&SM*QY4It4*Q2%D(SO;zy*nnn5;N3D zrn@@LIE0*lhWJxu;e{HiGGl^Q-wbf)ja;5%3w}!;+*$ume-gbS0^LFE@Wa-9DL?5_?SN%2Tzc=7#@s7b7dY{iO_U7?7Ehz$y;|7IT99|Fei z^Xc!M1Alg2#z4u3&46)2Lq5icorBN3#slIG0;EAp-GNS)Upp@W${%sWDC!eo3tnG8 zE)T@c(dqg?1a`-(cQX@$xgQe)L!RCpAEEavf-l=ky{=V;DHoNxJQ*`E~+&H*{|-8QwLxBmTqgKc8gx z0{GUZYvzgo4dXU}BGOj_R5YGON}HT(0}SJUbz&pQxf3aaK34=At{SZ-DX6K{uOl_n_8%use_1;Fu&#_#lb*;sVkIZFh=N?aEm7Gp6ehZDiZ$Ha!c{0SThkJ!{!U){ ztIVcmDRbRTn+kW<=}VoyJN4oth$(hpFJ%(RurSVx>b2_i7oOrIYS>VBMsyUoNv99r zh^Qj7MlQ?I1C{-u_Q7*DsYb3E1%;|5Ox}3CS&YP@< znGa`g=JLnF=42w~ZPKLd=C7o>6#dq0Dq^fgf8cb@Fl59*o%OP40opLVJlVzZO|aIA z=j+tY0Ff$DkHKEcTJ(x2)v#NhlA0_xRbPe+B0Sjo1y#J0E#>kq z^kcz97Sk!3n3Wn$t0|={v@w48M#kV=k+BqEdC*8R=L2&KL9=y8U8zbho;FC(+RnhU zA0G?Mcv9G`s2Z;+29rUJuhXGARpoWPkTR#l+cjU;oVIrJ&s0a~F{$Dn^LCC#j^An& z?TDFu9BH*Gxq7DUSXA|5&vISW)({s#{<*Q+m*F8(^K!VT+_wB48YhO&RLn~=Vx%!w z^_#ksq$$VgT#)7$LPy1MzlWiM+xhP4v7(D7RG(Z4cJ@CFkShNE`uO^3@nZ|Pad3>9 z7PG32E5ll*5B+V^t3Dq_G|uO7>fOjWbNZ0Pg$SMO>&_~JL6C`e2q=a$H|}F zFXA~h z^BO%!8XW`Xq!lNuQq!O^lwA)Tde508MOa~3 zBzK}K7^6`(n!-1VF$mm|P^HSsni5%@3hWG^4se3WP_<=MVsQ45u=vYD-a7@(_&nTB zf0+|agD)>4)IG0@9`Dr{lZsyC;~&X2b?o`3^}(Zh3ujx**x58m-^cCbm;8m?DyPd+v3{n?#M-a*{K8!VP*1ZYds)K2diHM&>NV zbPPLZWlNoeJKjvVIN~$NZqWVeX-Zp_pKvxVUbKph+t)4`gIHOgj^SMxGzkfvEKo8o zDRS)lknkyEnX|;mWPYvaOY?^(Gu9Vk)z{|v5?z2$6v3zRW!mN5B6IY~UvRFwd`4s}e$$JwAeSEtDb8k;GI65bPWck6+ zXS;dRa0@kU%cGs-jQqC}%w9g)%z?K&qHaznXtuETw6Bd+kL{TZdkN}oMB8Vc8!@dG zUd>D_SkoPVTdqgE0hh?Kzd6!x5o|JZdGn-gm}#S%eB=_(3+VYTi`~g|=ReL#Oc-9x z049SgWFbcsCcO1nq9ZRl!ZzM~9M+_&9B%SaRbiz3jNVHJnF6l#D|M@>UKTgy#8>C1 zJ5RT?KuYi?OH&*`J?SFmUOQ-hraYp3t>LVA#xeS^go+BLgULLhIvvfdA$3Rqle75X zDF(|cQ5qT;!Bi(IRelrqJr2jSGhyGjz4XRu?M*ey&V{rdQ81O<&Ns4F;&Ub2TQ+;?~yxc8_p-oFzKa}4JV7rA{f zRonBVnT_G4+EiL&FW*|W>K)XmYH>SPO_so7ui>82Ecp<*B~Xy`)*q6!BzG$_%~&bh z(am1H0&Z^`WS^{Q5T_+3M91cF>F~<7>K8?`q486sXNvrI+d*j62h5vv9GJdoP_{QH zLWc>QWX)7^B;tGoZG*N<=0HvzS`Oa z3*FzwZ@taHUbNiW;DJ3nMu;I&l(t~ z?Zn^#w)ak|YJ{6P(zT>cQcAtRM~UH4bF)&_1FjF2Pk*{_7}|gsZfu6o)`0UCssfOq z(sTiqQ@GXnzO6}DS0~Zgr{B!vML4fsF<={ zoYidJR1>R)m7~K2GYOnTwXe?GW&QH9GKr3pF$j~YxT$l~J>6G*hMGjy=EkLc1fvCf zPF)x1_AZ1^BkQZX9wL~mF|)Xw%%x3%_)N@)BDHC=L>cU;N}RI1YbSks+*$9;C^PPp z5nC=`c)c?DjK3PDHLTQ0m2gZ!wke@|xJIV?PSZepIq-s)h`@>6=Ox!!wT6f9A3S+G z6~qUbMsu3`t6&EzrbMq=m?=R~2%V~pihGhbXVKiRk`pW+bZF%WB@I%MGS9#MR;SPH z#Ou5@Xa>|V^`otvBm|fL2h)lGv=e-SQ%YOek0$!p_n+R_F95V?#Mys$QCUqH5?`QB zP(a@-cPJor{(Rqmv87kk2$U#_Pd8+N%}_S;eA>pTl`Sr09` zYc%f-%EY1_ye{5J6Dhv#l{+H$xJts?svfMqduIzdjQoadl||8^CZfsgSeazrn&Hq; zf9{+mgSPwm-SW>y&2OYOJX4?bsi)zbG3<2pbPfCb{%c-{!EhVekn45yFR>Y=8h0{(>Z?6{rZ= z;lyx&6A7XvI=2!->NsKukw9g*ArM%<3!i7<*rb4#v&c2JDM0o3@HshcHsE(LVEAMM zlpC@jiviH4kp-jxzPa5!U9FF5=pt8 z0Pq3;Y4R`-DB%DMWZ++2CgHzh5QD!T)6%uaKm&|7pPBasIv0Rdb-?m||%_(%(nG{x||gfa zJ95EsFBmh-G+ddR=W2|s__d#nq|1X;E_OL=yq=EU-pL~J9EVH`)X-2smIx?e|8Q2Q zE;M(>sQqO=wY)MkLIYYuOjoS$X|T$*0FEN~Lc8gJmsRt<>;L_^+P`se|KZ(D+0!T^ z$Xx{fTj^YWAhhs(28YLP@1C7fi@`<~Ui zeMDC3!qEGJzV|K?UeBGMA>H*~Y zq*p&B$K&BK1vH4C1`#(2gS#}u>mu+C)iwBB-~_yJ0&d$2bS(R`boj`O8EhGI@!U6Y-$4FciM203>iD_-wl9)(v3U0Stx%#EoCv9^eYpf+3`Ac^ZPg{{u`y5e8Ui00&ne zYxWQoaCAAr!TpGM+2ME3ZAZeUtv0G&KU7t4Yxa+gl;&*3e5Fy`#&HH7<&c-Z-#6l* z03G*twu*iu$t0qA{duB=eOkoIrE3vqfsOfpUJNmRf8oz+3i`LDX?y6OuK<30t=~Oa zaKo6C>Rzj{0$@sjC9V|v1gZe!`j@dtpFq1d)Y{tg<*A$#k4CV_LWqsa2x4-l5&8&t zDHR$mrQoM;n6%mW=48^qFy{{5T&1!ug4^v(%vNyU8rwBmS{?rRhr*#!&6f7Mx{W%x z=)J=7abUeS5-`4$at06ZliH7^hirzcAlK9y~XI=lzGXjK$6yt;0Q8A$Q*VkI~v zb*_#E-fJpNxR*HaboRno&l}f-gWX!m{gAT3#`Q3^I=XVaUwT{WV&D;M!Frge`yx@= z%7xB!wBU7TP%xhT;+>e157uX~)>G2To0#2l8Mi38m$q*zyn2bfKQB_|M1k~BDIvvseDr#eWU&a^!ipv-?9jKigaXcp;^JMjO1;OE4+o3p9ABmHtHp!n~s&Rojgxt&Q%Y|*Eg-F-uHMqnR%4>7RZh4 zEx&l+eCNE5FoRb ztcVs!)yg&`INAA01Uxg7ACRo(7rfCkb2zv!@jUuu>_DNnB(4}Qn&EAy^S%!6l{T*C zGN~z~(KEcDZ$tKYg5TcW1rx%Qq<&@_XCAxGeLa4NL-bYmbJmOVmnz}dZ(4d-c+ z(q9+JF(yjttY)fOQuyt9SRyt3Kn}k#lWfO2vwr}dy>LM;9o}%+?O3JVyCpWF5}@Ebes+%TZtN11n)~~v;`36~y^d^Y#+`8cNgnwm&AftACnyl(7xUjF zo_>+ne8qgs!%*>VZSR`YH_?pB@(&f!8xXm%*{F2WupNo@Ybu;x!eW!L@fLkth$cRc zet97`db#pfIWXNj*DH><`Zx(xYn%ueygk9D`#6M$$FL6$thyYbj{}+TeiNeLroh9G zjS&DbT8d)U^qBPHo`2IXFql!pw$U-tjb0tLXl?&(=0 zPitY|A*-dcro|iT;$TUry0w?rGqne6ALBq~5xKc<4OQ4LH0vW*GL>7-Raf+j76A3n z;2@6*4TE}UX_Pq(mbN~3KP}=SP=81KT7Um{-$(KPfd+dyT=D_OW7G4*5NOgGFd13ZtpTZi*Kt9|^|{8uW?18Po(8wmv={Cr8Ki zw8zG(%V~rjdV`*ugPHAOL{hohc?Lbl$GBGreCrG|j*^*f>LA@kWO?! zkwFC+1*sVe0zr%jC^dHm5s;P<6r@N*WT+uBG({vMRRj#ui?krUBrymVa&!HiIO^z( zZ@u3e-yf_6S>fD$zVq#U_WtfZhoU%lwE1;@KHL87Y-T2Y(}AM6wF%ofpzTY!-TYSc z@ks0SD}7uR=N(>bBALy4JWFjt_te}gyP67*GxSe4y+EyEjz(G;7nhP6@}sAMUMrBr zJ5OxmoQ={v7{ArZf~bqi>QNEUu@7o)gJyJVDKx?Xj|Vq((V2*>PDcNjPSJ9nwh71* z8}$^jf!}Sp^CM`y;2Z3^unZ32TEn;j9Jo+G!RBE*rTgG7ub(_2nMJ$m`ouOcuf==m zM%LLJL#`(TDUv$F8qLW9RihgA)7nEZj z5X|&Q)$$PP@EWSfr6*8wA& zAn?fr40~rQjU|Lbm{WNW;tWCkIF{fi6ruk2DEj^$u~xy7&hz0L$Vc%Ex?iUlUBm~q zeMXalzLXJR@fNyXdFLN+OR;99t3)3SYhLRGb>vk&E&_t6S#iY+syJ=&;9YHtxYd-~l&qVH1+QBqXEitSeMV2q_?oxRj`r61TT`^_=c{&M|9N zpV+#+b<)b*-Y$hye`A~S18ciO<96SzSR8U%9CR!IZzL-L2?%eIo+OMde6E*X>D!i7OVDS|I;P(diX`Y! zHfTy%=-xfl8EqJf)Gj`-?dFO!esvKkH#KR6E(N|whJ!&qN&dL7y5OA#9*9i89?j(A z1(s5s?-Wp@!io2R1x`Ri+_28nB|x+~J8z)N%As`^t2m}FZQCM`dU;0P3nk3I(#zX< zqIQ`Prcy0#klED@QarQZg!b@4oV2rPinEHBSWD4D#E*yC#aSAaMR|A6*SZg-oLV;@ zWt;(8MU>wOjDSu$pffE;41wN59|4AdngvTHz($3Hg(c%;c)2QQ?lDGW6N-6@y>Nfx zNF5EE7)%dwLrxLy)=+Kx@IQ_-@BR?$K`HOR<%k|tnckaJ&fHweH587&=h)vblRcFW z(M_<-)T0KnwNnQ^I-gD(1mrH!`Fy||+Nfw2)Gtj&j$l~V$2&f;2m<_;4=BRTk16nG zow?^}oF+5wWHZ3^I(DALXC)B+LJ7kBjus%OC~(gCzlRW7d>9^5ejL4{$xRrEr3VdPL$xQ9@llLqa&1o4LQ6?|=0W)S`M3ay(yTWW7T>(cZb z2Cf9$*Ff?^*!*W0ZHj+-?=ycsGtS!qKd2TP>ldcx7nf4gXA@5$9{w5dX8U zRYZRm>%XXo-YCt^%`Sp3^G^vqRnS{KQ0+rWZAVm~bY9A~zSr>=avKeFr{tualB^ga zl46a{K+P|;9hlOQ+KjCt?s$+_Bz3B|ur+sU@D>v}MWvrp<&qY)B(St%wk5k9R6n&{ zN_S$kecTUGORiC(DmI7TYAv`tK}=_c1oF!-%4)_MnJq0E;n`K-Z}aw_nivm^0_%>q z{Pc#JW;6j?1pjQ!<#&<+8V(-xy!L_MV4KG z_BD{3>xw1&SJ!x~3)X*8)Zn;i@xEqdatMx9>hA@v+O3J8v3$TURiGMJUGas%Bslmj z4tYX)RRbg}#W-XE^2J{ARPD&Zu5{JeG*(jB?5rc6NzjNQyE|*T_Ct188z>aFDtnqX#_cY8@5THbu8S!Oe3qk3tZmEF5Qy zH_EGENlYpbSe&P^G7|Z0<4}2irJ6RL*KK!l--YCb>hiXy=UlHHyXCFSs6S<3x$8ur zTck$mQtnoe@jPHBlc~-`*|t+gQ3+BMZPc4hMum6L;33T4u;iN?O0YtSHPfd6bn>M4&;|H=aJ6krZr)%{AA zO+$vsz}P0ORExYj7>gM55J^ei>*$-8%vLShsMnqh_K~MrrJ9-WB0X(+3S&b-R8!l_ zv%xFQ+zd!GM5}{%_5OL+;s{6jsVm%Z*U4Y8-~(We9{@8$w>DU1XJZ}(vSq`%Vz@84 z6&_rbbVP}^W^}idopVXg3ySZVJin7(8czyal$q_$S3G^TwB%abJ)0U1?Timb`p5h7 zHrIrf3TBM@ricC3dcSqDfG0ma%dD`Z%66VSplDsNYQ;L7QM2iup3Gx& zAeTsdpZPKnEg{Hv4)|0=S~mzx-2^-u~YY{_ie|=#odx3zsqI!c$53l z^ep6P8GA2@vDvgD-*vWVR;RU8T*PksD@&%DQQIWaRll?{FCOciW=-5TDn}i8CxA-C zMTH>rzwEh-xU+#f#1B^EV7(I1n|l-b=%`g-J!St~Pd7a=P(ZVqOH~}RR?|hjV{FRW zQav9(PF^BpT6_P{Nr_$E*I!agM1j zEWhh9b^oo`#vi;NdN_4A4we^`Q#$ixgTM^rJJp+@$gDk5VKv7h5$2Ll~& zDf1`OZeiJL$02$LuO4Er&xGD%C%T^(&QuqU@PH|$R+I@`SHe&%6%tBY8SNIUl2zxj zh7j{C@q}*osxtfgJ3`|x8}!UdML?N}D6D}D3r88~U^st;EfVY?^W_uWS;GaFbIOKI z*|OoifJi(^9ysdZ-2l$)Z!)NG2eS7${yBL_8?f?&8-s0-A7tM9@xUM%`0+W>pjiM3gU!!17Jp?E4)u6s*v?Tf`Q=pIQQqE%2|3;-LXdWp8R1(Pm zUE*`83u@f8H3%C_PCek0nWzVLz}x!^S{{2J|FEA0Y%*fl^-h2@A5agQ7B7q22g6HR79n_xm?rFT&nL<-Yd(FCx_8Qthm_Ua50?QW*!t3Kiy3feZ<2?UfIo zjbm+ebOaeB=UFw>oU7Cy@l#t!D1yuJt{&HZd&l-f+peu$=ao%2)$kM->9!lf zd)wq)RO-oYkumg@zmgjJt!^YgF<{yZR}AiGr{zW8D!9Ct8kBvow@n52@YufB?)!3M z_$>(Qjvd$_@PGeNOus$;L{r*)@iF^6_y{2eO~jf_t7w#M*iVLefXQXzPq32_rd`-D zy}qgQsvP1P#%OLQQFI^3MGrrECqQ#G1q}?b0?^=WKi9|AjEj*#Xko%1zN&WMavv*` z0#2{jyshDJZKMX&F&r-NIDZvP2TUD8%puoPP$J7o^q?zf;<$E%K>G01losMf!}PIs zQOfJd(~(Jw!(S}JJKkhiJSH*1qFjSxevj*aVE}SG^%;=ML0?{HcZLCcBmDDwW)rGE zm$xIr-ZDG(s(g>@Dz5n5xx^rbA-vAo7Oz>N5}fA#`l&v$S7Lp)$Qv!6^+wj)B64L8 zy)>~KE)9{)EVy%euA<~gZc4g?gUiCTh*}TVE3RsW`UM$=ayLqTeLnujx<3L}h;4kn zt8itLnYBDE8}A_Wdzy^~&KMdW$t2ceB=sa%-TUBsWg3l$buQjuFDq$bdqjyt+Sv*>tA=@--`t0skwo&(fX$ssUFm2|$G(eIQ0o-iKztZwXqqgJbuI;_%79o`@+yxiI_v8VANQ%UTvE^l*=Wg5jLs!A60!HtNaN1Lt z%F$mv(E8*~UnOpBMMeObYvAV4unR$a4vJn3JTgCcp{J9+u_3^bf{4RXY-0!4NKK2T z8CxX~_~Ag0`yD{4jfo&@hdKRg8PkBmY~-29B)}}aZB;GbBo25xrCB# zLJiZPqX}{n4)S#@%$W%AVkkA(RM`LQ5=T^Oo;=&^6xcgf&}rYi!+~WKmHn_rFt>dV zVPD_Q+;(&K7D2n)Fx91)FzXMh+yJONsZV?=zabJ_RD&6?mpq<1uwC1#vZS;Pj%j*f z>)DxhZrpins+o4;9P3NlLQlt|vDksezI;ud2qXy7Nsv-9GQMV&Y>_bPZ_3;c zD3%VsgdLpY&to&zMtg>dYoZ}KQnMgMxu@C>A%a+Nbt`L>(3yya(tZJX${L{U9EU0` zpMpg6dcY`_v0)H9f)Ixx4e7!331h9Xh4vZh*R1~gplq=R5Ql;D6^5^A(dXX@U>=bh zj1BILj_4~b0DZDRmfznL3<;_Ca2 zu{ae$4vO`_CIE6p1?YYY!TFPTp+hX>f%yJ! zot>WUt3AVW{nuWSG&8n;qKlUHl}Uevub;dGM3axcuHMht_uogG-1pJO5Cp#;!$I(4 zbK{Zb>C`J6>e!k8Vi^?s|FH}gTV(vKX27QV&)E1sMHz|DqD0b2Q`px+C6G@485rMn F{s&}CQcVB= literal 0 HcmV?d00001 diff --git a/education/windows/images/prov.jpg b/education/windows/images/prov.jpg new file mode 100644 index 0000000000000000000000000000000000000000..1593ccb36b6c841627424547a2722af005483fa3 GIT binary patch literal 17796 zcmeHu2UL^awr3C&5RpI9K|rJ`0-_YDQ4wik1SwJ@AT>m!ccKE)MLh zy^3@Q(h_=2C?P;dCf;}Nn>Y7A<<4C*v)-(AzvLuY>pN#>|Mos-pR>zH9jDF${?Nax zcNaiMM+bOJdjY7E04=}?I=bKQzh3kw>3?6R7#QeJGM-{&{N0$CS(uraPBSqwo@PCL zn&k}bVq`wc#(L)L@87?P{2u;$6zzS6iIM4dkN>@k`VGL&1Q?@3)6-o9oM5M;XQ!jK z0)znox|1|+e>42oi|zzH!^u-LmQJ(KIw1a_u}@Ebg2wDg1_oO1P}+R}1N+HyBJ#IR zaTwV#Ui9R=_9E#slj!Y=?_9@rz4HN?p3Fps1vLLq%2Vj`m$0 zT|NDWCZ=ZQk1Q-5o;W%=ySTb}`}q3#2LuL%M?}7gijIj*PI;S}mj3R2Mow;CenDYT z@t4Y~Y6KEhQ(M>E(%RPE(b?5KI5a#mIyOFmnZx4d7Z#V6S5^tzJG*dkviC7E_oLC;W!?7i9k!u$TW7vVRBmUvXgoXXxo@%A;oo009S4IN^3VUW<^& z1ox{XR2#b%H!3KpJp`2`G7qJ+7qfLSb#3W&?aIg`^8d8vSL zzauI@U##37U3Rs`Qm9!7JK0_aW&8PIKXF(z`MfoZ-~(%3Clnr^)s&_JzPEKy0X)`i zoT0{1+j6yxW1hl0+u-1T43X4fKHEIli>(|BT$*np`p}sEd;SOhgwdPRXis0bvuR$~ zrWMxT6}rAc1^h|&e}{2V>aViXtdFJwvXhS{hNytQ2ch%dqV(-G(ixG0T|9ad>d#IE z0LAyK3jd^)#J^YE+Pj>@FApf%`xpMDrGIHD?q6%^FBaqfzqQofe;^|yPX&D4*r&YJ zvu>l=CIR4lbwCHD1vPVMB<{^=2YkV%eQ-+o7+XlnUgUDVI{;VLE1g)u_~!RfJ{R3j zLn4s_3RTv<>s+FD9vG;}1El!Go?k`;nXlVV!rZeXB!@cqB`F^-d}%fHS<%l~{%{oC zJZK8Jow7Q3G@*qxUq=ztX8WVs%dk{Hl%_hq{OyoTP2gHoF9(|KtH=YQ2SLnzTQakZ^hciXW zj8PeMobEFd4diHIoec2X+@5Ks0yur*4Ax3|($6WqAueD?4U~Q=eS>aF(x1OWa8~JB zr3~hCFN7ZEjK!Io2So?kiEYsrp4sDS@x~ok{PlZ z$27K3-E1{DA5Bi*9Pg2*f>>!6_jjgQYR?KZa_E65xfmU z9#4?Tk1)44UrLpi-|L~*$Jr&}>}#yg!%mZ>@Jn$pS95#@3D|)?Q#hn9kCiSnzc-?o zt$Hk5rT{q_Z*qXr>j(tOm$Y~KUvj_7+784dEu{P85ho-@$LcYdFrK@#L&ng<1Wffu z<1xR%ATYO>ad!~|WwK+v zh)8A3kD>c^($ZB>?H%?L$We!hN0hE?Hg$Fn0@#uuvlZu?eTD>TnHC~|UcsssUJmY< zB1f_qU$P{3UDUpy*XmXGiix0W3SMB;b9$RoK2$Y%geh8q`=O8-WoL3zMp7!1>t?`F zIx;@%Sz}{5#oNask9p57eS({jrttgCAbeu85D;&ghR9jTx-hILc#aCt9Z}>Qw(Z{T zgXZsC%(RcLHrDcI$8@FocqX47%MI(Xqyk>3cU5UAwt>*SEOLr)hmnPTcmuI6(2jt;zwk@%1s(y}7^k`)8nTOXc&k*b1^NN-n$ZD|Eh^_ubW?$@_dlDVSK^B;!e%FFOow`ht0kS6aC z3S$&m`lHMYo+*Udv&w2*9tO_a?a?`{dXVBoQZ z6`<2(o52t^*)oZ{*@7Q`t_eYRk+|e#8TP2Y?GpWl%|7p;zK2nYcZSf=F=c5aYPIR8 zB)6d8-f?ciC5f^b=bm1;@6$vN9jA~z?O@4`7<^9)`lLEUIg)1C=mM6S`3o}rCDVi9 z5Kpj9`S?PbbWxg`OUhZ38v%LA*La`bzve|b6QYbqlP^;N=g2n+4M8K6@J}-n%ShF` zss4hQ?G;7VdE3v&*v`M?z4!`q*GtsNDOue5sgrFd?(yog$IvX=?r!aO!`TgEwo{X&$n|`ibDM|IYXU8avIg&RV=XS8U-HT$$m4iD z`<%?j!p@WA=Fpgw*{JVZOk}l08~ip2g}skDxmR991z-kUeq=bM4K^5SpEvZ%c24Xy z-5x=42!YOehnOD;u8hH08XU1K9udOlL+E&(%ZQA&^~dT#VC;`rI%Sq#j8A++qQb1P zj^l%}qN&ex&D0k(qGMo&=58Wb|eSPyQ*LKEsX8n}_i-q9nn+c-HEYb&_S|W7gQmPH32{>p5 z=qa&sZ^U&mUNptbGj+oUGlSe3(t)RFLUNj(lVtD)-)9gytp)>gV8)PJLkb>@%RKy> z^?56pH)DIy$71;J3`$l|QK@Z1@6&46bSnxDp55lU7B&E^e20g9(+z<^@JCo+i>O0+ z+ox4kU>rko+0UAnu4Uy=$zX`r3}NG0a=R%~SUlYR9t&kS@5`6#btx#Qz=TH70od0I zSShV4+raN>9t1W)xvdpuBK^h>He;pWy4x>fr9PebC)?TVKRIA^u!QVwOLYe-z;1Hu zSSqS z^z~O61=}Hmh%HR)8i>@7pX?CgK?Mt1&5b60p7_h?7sGXvOKvNTYH(83RzG5M?e z$P`!plf%*7Re_y3!Jp~u38G>aj`8(3%q*^Ho}&!E2~j+Lr*1wQs8GC#sLxfmY6P!}NkO&6WD;^;OD9dFGtU zR*sqF=ElsOF{jirhvBlYD;VuWwxr=EN zMIeLoFa6t+0wHBz-#@+jIO|4dR3Av*;@ma+Go?>Z zSU83_*&fD4Dl6>!++Wy%gUa3fxhwEUHe|WlKu|*0jOmGAi|&l`3(gv&rrVpQ{*MEE zIjMjum+8Zm%BDC|8BNzPgIh4SF+_F!)TDXtYqSIvpj`Y50_2kM1y0nrG%;Bjq&5zO z=oPPdStmE$OPaEJ)LfLi_4J|J{Jg{2nk_3ZUD#EUce5~S(*@G?HYDa~IZP!Al(Jzd z6t23uz)?bkUzzP9s`qqqp7Tji+JI$0^L>*k&4ihyFv#&DCjlX1WNMY~ky;Dg z7o-9@JmR^txvPOuen_OhS>kLzlU0D%LV@GO#Yg3`PS+$vth4t6LT0Bk_CMXID4cV&h`e$7VhAA6pYTbsG zVk6%>yf*y40Bz}Y!5;89Sqaag+P2QRpwEUF%!1Cl*7a>gs%r;2m$dlj>YZD)RQl|e z(s6#E6kVUDa?5!eXA9JU?~QJM8#Kw3@%3-qYuti0827r>bt5yREism(sHq*z z=*r`-4RZLz7AoMZyQW}(gV|kDC^l28mBSjcFSUggt4APENs^DQiu69~;vVn9MC$r^ z89qa^H{8M(lf{FDBd{d6Y_b1W%Qm>1pHsj7gVkQ%)=2o-pAQ6)vm6b@?cF>4moF_; z7kBB)%#4LvjV;bBAYY|=TaH}BiIoi*RvUnl!C8k{9XJn6K5h4rbkPJD%0BX4a}}u? zRZM%sUhJ9%@|6AH#%Q$AxY16=n@tb#ZMRRq!Vz14Dz24;idx_)Rl&1;pgCgVY?;?6 zOU-Pf-Y)UAE`miz1UH@Bv0WM$^;+-2#!PKka8BZSgGSlYvdw+Ju?5Gcqh@RyA%>eX zcaY0WGq6gFabv&>zQF9#C+)IPblSxooI zt6)grt)#qjoKoFi?gxV6R6CwO^@&phGYUs5qb@qgjO@qAmL(}co7=dm)$rcQPh4LI z(D5*!n6+KcaEfaBOdYPFKTzuZ?)qM5{_&vzOOr)I`rb_aX{nt0vw)mfseiW77m_BZ z0P);*AW^W13K)!$epmiyD_@Jx{uY%(eqHKu)CM8|d!=&fwk9YYh9jDqB<@KI0~G~G zHv7te8?)a{RIp!NyuO&sH^WGjbG)-+ncnuT{)&XlVS{S>Dogup0km8&=e>|<^ z5l*2eSrIIGeQmBAsowpJZ$4_};kV5#pZGOpxyt6?H=xamxmm%i+`*!ARNyG{lI4ui z8SLAXg}Az=tn9Ia@!}_@IV1C>7;|(O6)=|H|8W^!5u$b^8*&~GdaY10P(DqH?F~rj z>|4w&?8~40CdY7laPL`sKhen|WLJc@?!_Obe){;ZR$%LFPQ#;5*63B=-p z6`a$xSwk08fU!pO)LB+Nn$*(hc)O6BNw}Q(NlQ%@Hdzyl>EEQF;WGMEfO!RX*fhYK>th$W6uuC;nBb$3Nw$lbB2IfQ6UAZx{F;~s|l6QLEGB_;g ziW!dU9>S_uf;}Fmpl7|PfG49w;YU!*u^n>a$(*M4MB*tD%<;?W#IWLq*XWRW7dW)o z?ls4@j$8Mqb06M!cb$(m@0ST<3E(g#^?xFH4emTj?jmzQ%cteX+*>o6$|PQ8y!eWI z`%M%vMFZ|=`sUth3!^s~@u07$uS;8lYo>7KIEY<6twAL)V?V>dwv?bRy`C5?TxI@k z8DW(GemLSgb^V@I0uWRa)l!Fi@5vpZ*_J2WKm~~Gyw9tx_fNh+7x3=#IkAb}8A?wW zV6cHtCfRLFQ;Hz>YN?^RVQ{w(W>5vSJ(Sv&e+Dhjni`+Hv+w`ipHD09Hemy-vUWLe ziZAcLwh3H5GeT6%(z28(cPz|aLGMBP(_P>>A;Eazxx^N93>Cl(^*PqD9IMWRSyUQ6 z#cml_bMr^097j&gCSMTxMpNDf=K35R zNTU0MMT~6sj;@9E!_HEGBy+25V}i_5gs+P)hh2f?^eXX%IHczJ(0+AN!Tjrh#iKju zixKjV@7@PF=Z1BoPx-2i(1aBc)f(O+#{!<1LB}YJ=a2GqH>FlDL{FxnYNM@Mg`CgE zYuPLA%$AgVFe;Q}mh^4P9^2cw_}aiW&jcqmagcq<2&@$nNV#k>~TYLM3zF+Z*OvIwTu|+k}k-%71Yg(*c z+YT%Js0>^2vw&dx0VZ}$FF245BbLk(V#xk#T8aJB-IJ(;S1O_kxQvI%aa9d8#oH3(yFq z0jJ%3=KGhLtb*$6T~~&|{(9mOzo*`!i` z&sItCd>F7<`$o>Nc~~a}dj?=vuR_rwK)Dqvu2Bv_rLWC_UNC zihZu`G9g-JzuKT@BkEokgy4K{v!EI4l{jC6BureJud7h4p2h ze)3bMo0MXPrmdW`8PMow1fpq3ys>JiFpc3zTH(#6!SbR3f#$~?c;23V7;{2F9UHrR z=(7c%x9nU)gt_dkO@ew4++q*Eqo4FgJzVp%g#JJgM=I-3Lt9q*1kH4QSHD5Gj9wnq zxL+E1P=BrlGr!kb7gcyfW%%E{)t*C7q|YfHM|OY5LM8*tcBh1-yF3&#m3*5rC@rA+ z)QzN#aI0vsv{lg^^>8MZ&lX%`#1R36bK%}06<}aQ1w0;RNPpnU|MSYgfuCQwh;HhOx*yx6 z?{~H)cA95c$%aR=5H@VE83ki71vY}j*;sZD9xh4?if$;SRq$;T1SDIfU2fNWa#Umg zg_b#WH+HRQLzej#S{)q7UwI8zaJZ!HZQEavw!LE;)jw=L95l1uhL8Jxs1vQIp=Cl4 zU&x9q=npK^f?yjJ9SL4iUnjhuHjjd;bUwVl6*;IU@SK;|iR(QrfIg8sN86@M1EiZr zHN{4p@J?m0VhgwZ#PUattq|v;X-w(BkFU}894#Jaz6c5nd7N1_8PQSBl`#$t@-v4; z9e8*-Cyl+{PQ2eZRqsy)Xq1M`Xomtlj#NVUqvn2m!1C?M@%0h=S^BWRsurxE;>9%I zp~6~Km(;SJJc6~@1LaNYuA>&@#eotVg53Ih{Fj+Fe|$jj1A=f2ck?E(TSF!UoNs00 zCe3=BcX375cBWgG9QVrp18+rqjVFK81Z5&O*y4BwZ$SChYDpfTWt3-OHf(Q~;Ux`< zN9V~BV9hb_9{k24M5uX38 zss1TivqDjVb-54{kE1-$yE*!c(%H;prXab_)pjbN!GsFnAU9Wsh|U>M0YW5{{!gEx zlcUAuwk?Ggx1T&}9qPN-!T;2r%d7X)qvzMVPE?f`e9w|W;~C?t6JQ3Zk4F@wmlXw6 zEESU+viP`l$4gF>(o5aA5I&8_R+gTh`5dWf>)VgA@^BcEJdV(m$V2v=r3GDt-Q**o zK-;g4cV6GA_kEAK^iJ%?*M{DNNMWaEx;WJ=Hd>fEgfwF^rleKtEmooGcNHXq`O}YoD#bEU3WQDC0t!_%?Kk>le(GQ@qgpnB8ST*$asq zvsxD}?TE@229*P2oB+pdZP{nTCMat7$eKjM4>zl~!*x6^{M@j#x?#C0(2k0kU=h2! z$dK*=4CwSe>QWBmu*j{8i=x#gFc4RIq|Ce??haAtdIKhBm7^QzW<%9l_eZZLvaRt{ zJ+idb@n)zmj7xicCtxn_8cFnzUMB0-qM}4T%AFh2XK_fz6HvvOdA1qD6ipY&4*_*FSWI>|?R*E^Q5v zXXVei-&jo^(EHugJC6&TGTH6NS@4`S``kFtM;7U~V~D_UgUvSha=5T^0IudMxlo7{dya;_)t0g5Q$hy3)a-X?>`i5u^$>_J2SEe zr2=R%OujWE#djin5RrG>M3LwVl4f(uN9l z%DjW0h%N#ZxTR}KR=?~pL86CpYO5Mvu}OBC#e8RIht6G|3BJ^&_QChzqdno!w)!w- za3p+(OV4pIyCyGnYzi9YkLtt>0iPtsq+yhD8Lo~$S{brpNpO=Oh`;>Mc99AIaUV7oPADqJ-9yDfO#9tcn5X;Ng;)W5n@lt6*Y1nxbrE64VthzBn9O?6+vk$%{(`Eb+HeQB`e?zh8pLXx} zKC%vIB9y5QvJXi|@*6t#urSiO5jngxX!Z*+e44?S51Ny`&~o)cV7>n-k&2}6<+|;8 zp#ulz<^%_v1cCr>W&5($q8EBw?@Thtxxi{dA-g_S+-y6^EBehR?d5DGz%TFavHU1v z>|0ZhSj=SY0@g;^?0!^BsNDF?=gu$sZB+*r%EOj-R}8e>?L1GvTBRdPZMO%pb*IGw zZhjI9-~RkS?k3|;Wo-t95(qD0e&e@vd;H3@06Y4lKMjeKK}igUx!>$7I-H`{`&i z(aO%}ov8Z@UJqU;UKL)4wMR!fpKzG8*i_CBu5R7lDf%+Y5lnQ;8bL;1>EeG&Am`4w zvNOGA&8NS}oCeV*+JSYLo@BI81oWZ(?E@Zm6S$-}q0Juvo7IZN*eisS>%oUOkeik5%EkdLh1q{mm`DvdhCJvx`K_cY_71 zCJ8q-rLR3uE-vcZ`E&q-oj!!;KP00EuXbGK}p@TJ~;Pyn;1$nWR-hdZ%LY#U|tcC z{Q#DuRUE!F4{&Iv$OjvO+cgyj*ORw3q;C1obzT^rf4_GG<&$k?^+v5 z;lZA)agD8VHQgI@UdYF8!Ly)}PQ;OJj9#pAg-mlsUpfWAuyT>)>!r$ZArJFhF$-_` zOKd@(Tf|d`IaV-{`xEQV98z`lNN!u3X6Vh*K`$j%%y9qLw@XqcP_N0{Rd{~9>oelD zQc+b`O%Fv{Y_68Dz_kTK@T_OfWrqv1UTM&ogLAB5ex?{z&>XB0g(CM}gV4NNUnbwW zET(viJq+}ELf7b3%Qc(2Jm+ab;5;sqX_Pt0a*|^-XMH$fIzw}S-WX|f4SGd#8r?kk zf4B((|Cbd=T>TLg1`VEhUkBLqWmpWwPQTpY@vRHtZ*F}*l^naQqQl3VE4zqky?zGY z>LWRmaxj!%mlpWMKg~SwnV6H80gkt8>u1>Q+?>=T>wbF+kHSnq;F7PvSN_{Kr}pdj zx7M_5d$(%($*6XW(0vz*vV(X`_};Qw^{ zlYj8v$rpr3;zgFxq9p=QQ)ToJL9FwFIZ*O3goVztjO=D`-2~z4^BK#}jtb z=#uqf{Q{!lajRW%u;oC0u(v`JF|hDs_Ox)OkQXc<%$MlgDmNL2(}-$i4Pw%iCTqp= z`bxjUB`B`FDatVe(4n6L+NFgl0w^5#m(K7V|`#Pej&8nLk@}{Kn0v;$)?D{ zk67e4*vO~BPxjNw zc6G?gv^?^mG>jdF|5W?C?3mKr8>~eIoJgkvE(rfmNrfp=0snnk=zoG%;z0?F{ci)Q zfLH6k6Fu4jsH~xL; zCcWs)X|y748VPSS5~2YBA;nPu;4$0o1f(0%(K14;&NUld)H`0vjmcdv(NEp##vIX# zWy<3Jk!qQLt}+I0a2$u8-_fK+G{$#mOs_Pb-qEL3;MG$=*Jr7K<3v?qS}|+s4%@zE z_8crJ(Bo)Ij-a!nV?|J==!0ox_v_L$2Rk>bDf0NOf^gI!dcCm>vsMRt1y^?{Tjd`q zNLJ+iY@V7kXqU{OEFOWZNzKGb2`u0Y;YeZjg;<;W3j;$f z{*gBKN^ddt%(Fl0APSLsVT(y*J=#IvX@?3(7#p`I@LsXy=1jYM6_GiduDwQkOahTr z_`^=h;n};|(EtlWwUQf6@F5ggpp5O)78PJG{NhlqwaCX+9gMZ=;geNZV`xk?AHu#| zdAddERpiYd|NfcX=^^(3%Hwd5H}%^9%pp5cQ)Cb~{Foq7%$iC`fdngOVr4YI&EGfR zHk;+Q;uVL(e5+j-?o`z5c-B-&Z1K~q+j&wq@INv-Knpym5z>L%x)d>5B(}4PHVxX> z`Vu&E#)z5I8PmXY<$k=sIcU)LLn^KCL}ARpU}u4X8km3wl7f$z$r6PAXoX2T+)HE- z<-^&k^LR|5-dU@=klWcID-CL$se(7hUD^}$poptFPpV%b zU~VbFoxL3bFX0Cb#Wxz5W1!P4Bd70_w(Ci#`K3yORkFvuahIro3>|_bEuHnDpQ3#8 zI4bN~;z1tl91Q=S=1k#yDJd3EF6%@*zH1Lg}yij}(h9}T>CTp!aN z^oF&d`JQ)>F9Tz4PyrQxnGOFYp@6FZlbk_{%^ z^#GElAd!)(ijCD(C*=Z_K3L|JdBp9m1cM)*x6w~63g%td)Lhfc+l5Y30c>kK$f)!I z+g#c-(;{S3VkBGPWC=KpgfPAp$VUY%Cx_6o+s$r&Su}%G0Av=pL@O>7r#Sb)9B4k# z5-o;==b`AN8~tN629Dv+X^+{^T#s+*2T?>#ASDDut1^Yn2l{fY0{{GhjA2M@ z2Q<#f%&>R=V&Olf6igFDDYr+n_ojfmBDN`i(jX|G(hB2CF+oVq$+f;==+x8XZ@?`I z@BS#TXgV>|5k+A@_kIby3w$4jg^^gO0MSmghwy=>a6F8t1`$5Ak_prf>e!gihdq^x ze;m(_gFgNv7*^0@3j$|4QURN9(JjJV!rt#;jU#`F`^QR^xBNps#XsXCJa`tW!L*^L z?Q=eF2E!w~L-3>mU{+)oT1uWa&Epb}4rg!=1|D|T^YqKk|4(}8TwXuFy=i#-nKmBC zBfP(dZcp4`NjxCY$e_z8imaSo<=_8B;y;-znwQc&^{%ug>q&~Gbmis5=G^`VE0X`Y zb5>5Q^rwZtMYH~IfB$pQGO6fRl#DX_~ z=k$w3OsWvE%6Uon{+usmh-YHLe+@yYO6+K5gI-aiVp@hj&0gAMr9g}xf4oiRV$8Lg}dqk)J zIUevnZF`Iq#+O`4BsbVlAQaAEm#7h^XT#>+|LsuVoSB6)MUzHoE1z~pqgrdV>V}(i zEp4;~&3*xSU>ScUgkHjK?SS#QlXo;ruD{ADUFDW`E$ws9kJXWn=NJQE>+h04j|C{2 za=^b(+PzwHxh7&tHtKzByK#%cm%SU8r5kCajO>0>&HgKYU#=k?q#z|Dtp55f9fy=-e?Pa+894nNvSQGUcY3yFe-+RE}gs!;#ZM3HvJ}zzR>B z^l9P$5m`^wvZAjePd^#!f4|Fc+h|MPs?3j%N~*6#5TMULf5$PB2XMki zXJ=q5cT#)JL4+!bflfSZT`iOf$UkQ;Z)?jz`ePTIwDz|km!8BuXF<>QOD^T%@Al!7 zs#JjSV3;zA(TE_E6^R9(5k5)s!nF{U3RZ^<8V8JjC|dcnwg*rFLFw$>W;dHXX|$2v&p9`n65cTE=Y~Q0^~vCwX7T8`26Kvi@gO;=i6u zsy#^s@S|OhAL7j3=eb7R#`{N9v$9&P2kE@>iTsKezPkqXg6AfBbQ}a6em#G*Fk#MAy71uSX+}0}u1(`Y{%0n* zO0zB0`<=Zn-DP^FSsOD*$}Me9vsbi_2Xz0tO+Py{EGPNx`Ky{y3a^6cLvecwsXfYV z2KF7t+&K7tS|Z8PZ)RtWw&#V)cm}KZX?S>mYIh~q^9#pq6Zxv;1C-XMT6RAsh`i`Yi#&+)U6$gtSzXBsptRmKIIgj6Ka=XFKt~Y4o;OxuK0x}k@j`|Eh zKh=#2wV)zaHkPKy*EdGerXq-b(dr17&RUyzihTs>MbjnAuZx4T$NGb?=6+hqR<;Ul zb;GZ7q?r{njkG!Y4$dq-iJTH|Lz z5!fl6V~W9?BXDp#HxuO?GGhqzQER?Vda63b`qwvS-bd=0gLD;ZNylX&9QgfjFcx*7 z!)*VB=?<(K6@U!fNBU>P-tpOxX;w!L>XrdA%Nt57I(pf9`I}5>D>$2G88y8r5PdYK zjCp<@ZrQBhwW%$asLIIOw?Y1UV~2b7zUIm;KR$lu_q=Zt9OQZ&WFh+{b^$%-ItlA9 z>p0%6hBXf%X#lMfk5(X~M6dP0u<2~?ccbWew>l~SUO)x>EExfBWtRmC9^)HEC2CLK z?vj6VX_Zc;ysb&bl6Hs_GN)O%vEli5UrZdtO)*4GW%cF}_>DS!B6``^q$mD3lkjol zMjNdp6OV+#mb%v{hnB!OcMKKKpE`EDi`ay@*}<}DeuQYVg_HCFP;?i9^>2Ya2Xm1_ zvFwgTB&%j(dKNHBH*3hS1{vP{vL7_cuTr{TFKS>g%I~H2l&LC8tVjy-0iV9UgBQ3< zkVr3{o^EV43TW!TUo)WS!D(?J^s*k58?wSb^~*ihRU*8{Liw7#y{WN2Ns_|d2PYrc zz-A0|$TD%DgKe6*ZAxpp%jYg4?0m-Oz&+hIcJh!WX2yr>Uz~=D8;O>ogRPTkW8`M_)$Kfl^OrgQ7>t)e#94lig{ cYamQ#828uUzc#1&t!_>uZNUGF2BS{=7jr>dg#Z8m literal 0 HcmV?d00001 diff --git a/education/windows/images/setupmsg.jpg b/education/windows/images/setupmsg.jpg new file mode 100644 index 0000000000000000000000000000000000000000..12935483c52eca8648eba05e1e5d507b8c244018 GIT binary patch literal 23035 zcmeFZcT|(lwl^L`Kv6_`2c=7u-ieJaAiWa>krImZP-COFFCd^GAiaZ>fYi{D8afhc zsL~Tkh!DaX&$;itcb#*7YrVgA|2j`HYdx9FvuE!q`}xeCz31}hqa6xVN2Q{BAv=l&0oKac-;iuk>GjpEv$ z694zE%XR?GH9+x|KvEKJz!e%2QW}!WZU7gNS2ChRe}wvvi{uLFRWfoSOO!W=1z@*{ z?30pSAu>yL^(wJ+2=RZwRT?tdyAlt{=?q>_aC_2AzD>-z#`CDUgTZhN%`0W+_3k<) zBNHjSbf9y#-`4$?w;PhAN>R46O&WZGe2jM zsFl^V^^MJ6Tick!qvI3oDem{#AGt^Xq<@>pT*1P&bW`uC%P9m;=OF-v7rs0B`Q}zz<(5pX_i-^yFL- zS6E2OELX4jZWnDe18s?T)J4(!HW1|xnIl9butApzN0)$jL+C$JthDFaq_@YfG{I}p z@S|-Yj#2?wCjmObf^c+-P@K&ovF@DJ-X$Ec! z-#yHi0QtOg;EhXwYThN_%~!%`4-_#AU4FWC3HS#N3@!mTntPXyl_7JN0E*LWyjNo^ z^ov2lQ8e&>GeEs}(+q!+Mz}hXM_}@gga3kH8VJ+}K-{_jUhIGkI*M8Kz;i7^F#{VC z1W$F~h#&#cc?m!iUjmi||IPfrTmIj}=HC=imXn_Y&}r z;O70#nZZSN*d-vFsE^v8L7nX2o4atd0Kw4&Ge^)t{1=`pE5Yqu0{AxjKv;=w(3zR2 zS6_iL^?3ylUDZ#nbg@x{%idtgllgTCsBzq#DJ4u_0yup@SGMGyIUl+_(%ScMe1tK# zdJ?YX@LWOOpnX-u_~olsE=x3GH-SH`#PV0$ecY*R2~}N1k&C|{tJju)a;ZdYoiG!U zR^WMF_9u$9o2=_Sj`U75XHBsMqHG2+e)_M@Z4n4{A5={=toY)^fJA(Wf|5TcGjS_G-WuyL#i)1aTb`QglQovDX4S}fM~ys?{K zs|2E11XAqdI4#&w2K2QO#{h5h7oHzIrA@hGt0+pL=#B5?9Ih&6kLuj`Mv0W~g$=dY z&K$|PA?f!Kg^C;bvP_hRy`%H)Zx~a8>xUlribx!;E;cD7&372N#z?;^%+PCUsI!U^ z70U~M>Xw3XP)9tKU@n%JIL78m8cy@1C}?Ooi8&2xIXbA|3A!y()><ba#)|Kdk^(H=UxLiaHrH16wtL1J2{OsS>NUKk@Zi00$k63rc|i$ow;~# z&!P2;#!V^frwg>wVtq4jhl#8;?P^qKMI%6W8}nqKkH%0f7~AZk?FQXk zB{t^FN#)-Aa`)Bv>fa_ekXD2kp^vb(7hix*2aF&H6AB*JCf2uFU)%J3tO|C{#y2M8 zESejTDXYeubqCYCuJes2_UJHMi7UgPQ_Q7QPqx`bG{3oFj04ABSSkA5$kT9^e|K&- z%``Ycjk_LAB^nsVdPMqKzpAJsbvsa*>7ea@#>o{A_Mer_T!QLoDtyZa1%L#^aa5YJ z-%48$jq5a=GJ2F)l7sFZ)xWsLC=J*ar~T)A;&ejxtY=9(A%{-%7@S5*eW zB$NbdzjI;MlYQL>9;-Oht>rV9DX#S$W4DEE3QZEDvq#h;Em$oWv^s0{ⅆwiDj&W z8H($rSkok(Bul*1^t27K3EqUr>F3iL#X|Z!#+uzl&oO?BtnNh3QmR6S)y3(qB!n$} zbBw^-p!;lbK`83TY+Bz8+&*4y#myF>+cv%{V)KGAm48iQC`rND0&vHbYUI&}5<9u91=h@f>wnAgG(G&Lc@z#}s2U_gMPZAnbYc;_RY~2~fhTCu+3-Qs))?1hcn72UiN7 zk1FDfLS&%UPp#b!w*yaVU8V0EK>R9xqt?75kQI4R3v^xz2g2ZC(op*TBHXz)uF)Z9>r7_y3Y$85uW$Be*%0rMZo4Rrya6-G zyUj*bHgwR61JSksjZtOB#HaGOJ?=cKs4sC(3YoQJF~Q26i#9l81zH1V)ve^$yxL2H zlh-|+%WRM{aO302!z1fX$&tLc6g`Nyy4E7rtTh`9&e>{Xz60&hsF1n@s8JMMz**0^ zP;!wdv<9Bu3OhQ@KYn~+$HDVpsF4QG^HbMKM zFbCJ;xO@qSnc?J5Hq-Ufr?$yp7!&ninJP%+v%vqRv2KZCyK3rI>Q}|^3shaymq3NL zxhRLbAR@DW28I`)bb~q-Q;W}Zk7BIKGE5WYI``=A#|?y&BxX=hD4UIJ+Ada582UIe z_kOfHC|KXS>jT@(YF3SCO%b9m6M9|2qHSWG0;>z)dv%Og^pj8cnT0Q z2yOWH8ZEZeztn{9*zZ5u#8efuu@T0z0ha)WkVogeT$Das(a45w@o&1$IoXUC;T&>Z zhq^3}y$To2f}(f~A5oZa;8avCvQ~5kKl5j4qz8QZaR?OUsqVK6(c+z%e)-*m-NbUz zsmT}_tyN~Led>4Y460~z9NILGca>3;aS=+P&)?77V*(4GE&S%P!zHhzww?n*dqEUL z8;z}&2MWQAx2$c!FgCB4=SJ&3n9J{HX#HZSn9OdazCoJQH$R=wbAWu@%>|>t({djf zVxCnuV)!#K>InVjDHJUFM%?p|x1agHA5J~iF71%Z(lkgvf?f$7hf@;xLx&gHa6y=C zEesNYCV&%g>M{q{D#~XJkn{3MR#uUfym6EfY$fY+e#LH;IOQeeMRmi@mYI(WcDN;h>A+CUfHVlRRCCdASF7I`a>1Vxa?RD}o2VbYhZaaKh; zS!`p+Rx#i>UKf9`$|WF^eER%JY_?FdW^;X|iT7LUpPXFXQ+k;}y}7Z;!Kr#?x^hZw z9)aVQA#)te^QY8Wr61h{6@U8(>xm2(_E}`s^&n19f zIsrZSz#`8;#J`q_^+RGRVwhgj@;n5>}R}ST^yGo ze2B7$e06J9?I2?nF=x5ZMj1MC=JCOPs&0unm@cUKvxnFoO4duC??)ETEsmJtUS`dh zt@k!HgGa2Gq8Lxl3Wa|7KA+y}IDA!AdA!W0=Yo0=^M37*+)0EZU!Hqb>qWVWhy)~VeDj8!%fHO$?);JVt-kg`H0=+vL8b!Fc#c&%Y2LD1I(5l`e#mdQ8qLx{TxSA*Yd z3TY(aAL3fiMT1>2u+2Ew!OdVt^i1SQBkLu=bhHI{ku8>>vPwJ7T$FAg?fGLZ`Mk!= z6R8rg6b7yH=n`kbUr9hE^m35)%qUVv`08Yubt=NcLx;smazgS;zQbN-Ch~P`0X6+cd(*1=~!X(&t zg*xIap&fDcr;}f(WK5r;PZ|jQmoD^mLjF+vau4 z1JKK0@DZh8?wkL~q?jGQbZ8swdkL`TEVu*|c+H5~==XX27FSig1XL#&UINA&!KuSu z&!Gz?(6CU=ojz#GVgC5Em7NMtUM^sgP zREY8KMq2SFaW3>bk7uW}4MJEdIbqsTCij$NCZE`pQaqP0GPHNQ#|*r1nfuWnM*rp# z@WpWSPHrYyOPZ00rv~r%kJr_`VV@Jev1fOt4-8oO57sTepX6NK(cZCZw5epyeT&$P zPTKDcQC;rxyg7X&c(qUDl^o03OLk5T>Bf}3*Xt=&c8U_}-kKH~7?P7x{vo1RN|%5* zj$)2a1{&H=M;YzLG+e03-;&Yaf+8%RVhGZJx@Wgm)uAJTe@eKH-hzq{If^~fSbtzH zm`~MbV2HFBF4nYf2nR<{T9+H7J|Hc4#hmb?MRNC?W8-4uPTS*sF>>uyF32s<$y+WChQfZv&I4B5t@OV{ z*PHCV_3;jsnnzAn1HAM(-fXIbNdeO;R9|8#7-4o}deMtoW9jm1iS}%nDL1ZKuL^Kb zG-6K*SJ#J?Vp78BsXtdg*dhF>QfgRHkoWs%;%Zxq8AV)8O6|axUzw4ZreKa1kU_+f!^orh4ID-9lK#wY0fIGwAssl6{^WIT@ znKh3=RNRwpV2ug9`*%8v_Y78&q{209%8TYXHCA;I^fs2uD-*Spg2VLv|7v>v^E48g znhN&21SB1;R-H4Sh+hb&Hrh{`@l#wN({N^M@k9RS!}=KD&@7rF9)^g>;(vGEbv9k` zb?K?$!oKuQzo-KwHqzpT`a>b@k~?Tk&J-+S@5H{yWr>NP3R&%&z?Jo;>%VXD@IbXv zbV295Eq@{hy`Y}>e*zo=BvPfYbR58Udn zFpVm!sM-jeHFZ>vXN3gLoTh_y3LN-?e5WcXLWw$oLYgZqO9c&^elL2G9Tpsf+LP)r zl|4Ti$^1!~osztdBR@(L ze?tz(c%ISlJSZ)VzEb)I&|bM}bn!iu-$hk&^kgo?3!yQoEC*FBd)1_#3@);|s0`)L z(tHtTpRxu@iH)B7xTnBwrYbHZB)TAK1Z4h zcc@u6?=Z3qo7P`cD+d(fwMX$L_CYyYfkhFb`=YLQCys@cbeNNtHEZ`_@e(&aGn$%; zd`M|mCW!}iaxn)#MxUFY#3v0ye``c5|z$Zqy2SQpLp7H@Sf<^-ox zX3N{oqIrekC9t-PAHdWn?b~{qtb4p~mY4bq$!pQ=hj(y*8!ob-%lWpvXt`eab#Rv0 zM{5YQyOCkt z>5L|11ya~QkT5raV@#iHld8%aSw0IL08!1YR%WAh>)^McoerfC2VX(FIkHSd_UuC{ z#j`lF)P*XS>XOL%gZmelEnBmI^9RnVv={OGID1q^0*$TyDwXAu1x7hN*0ame#VwCp z82rS{YhYZ#Kc$}W(2h+*<{{ioJhHDHijJ>ubeZ1Cmy4LjZ`Jpi+9*WwkAecAPKTOo zejdF`X@zPU*idJK0fXY*0zS6>!juCRl>;!$5hE;XHdBLik@!gGr)R2Fh8z)w9sB>< z4@5)|k-*Z`?d&?}hZb>O%WvZ+hz~ry6JOi7)hB_q{7rmTEHu9p6Os!hg%Otk7mo;4 zGMvUTFuY!oJff7E7MIb<3X1ZzF+DH|;HI7L9zyqc#N|*^C3zLyd1(To3|(BJZ=pkh zL%8&2cJ0Gwo_J7c_=+Vs%bab+f-b1{L|Hy|w%PC5{Itd(TMqi*bg-%@L|#2C0E^hA z5?XpveKDZ1Hrw88m#|K%^ssj|DJbh??#-Y#LuA}j6P;ca`m73Xm+6cJ=gK}Ysr&7U zx0s!R#t#^BC)7?=f)Q2l7YG1^bUAJB;km4(OFAR03ewkS$3+uoM`b>T+_H7+>6RVs zbEhxw2p!pYw8q~5_7tp0J^L8N72%^#y%em8F^f2EUW!cIZrVkL^+i^SR36K-Zfvs| zxY?y1a7^<@c-Pf@Rr(BId(3qk2R!%1>*46~olI3(XGBEJIuDebCKjBqX=#?)BXfoE zi_Z4WJaKb;d8SAmIWCD(PWp>)!9mOLYgFVjh7)4aIB|E_4Jl|I(iTym?>lthEK*%N zcL0>-79yqX$^s8oByJ>iYuA*3>oSb|ofTlS@57g2GL^%C(Xfm@K?*>@A{qP?PwK6j*|NQqRIS1HFTc@sRf9An*}a=k455Q zv-oFVR&gM`DPGJI(?l1)rql%IAbWqT@skE`HxaknNiq+vzV)|PKJ=av$&=pP@C`_6 zYLGIETXi#Raue`tF4*wakR1$gWA$?%!Rn3IRTUX$n1ZC{@La^z&aGNB(>q@T(+(08 z;RBC)?ZVn^##$A%FM2|K%l!IA_}HEL=-Jg)Ux@^Xe4lwea^d%vfOoEz5L*z^%D8$4 zuL52flt8um>6oUk=R{pq^c_4v(ua$c$|esv-c(@d+k!VxcUJ(_lJ(uJblMuu-S%@_ zXU_OC=bKz-g5tU?`*|HIx>D`yxxdo=Mdk^-)+P>Kx`GdIT=BTMsNqm@y93Q0Nr* zeOiSyk~fqJ3Y?zH;mO8ae zH(m(WutNO~etS>Z1VywSR`1k@zSdd~6El4%;>KRat;zDz%*^+B`b{T7 zbxn)sHCgpti{z>txYqR$eJ9=!O*1RjV{C8G{ani)+1`ftOtED9!=jQ#2 z&+C=JlX(NM^Xoefj%Bk-=gqz<%^h5|0v*hF(&Z&uNUiBO9+;1RnsolGL9r@EOw=P- zuCR~Cs&7q=qb@2)Xy8V5VxlGqfFgbU#AEgV6}&`J7vj<7=D9Mc^s@dE@S(Yfk##Vn zp>sT>(f+%0U8(^gX6+lzQ2DIg4OeBeFGSl&cDE?0&i5MDth8dw;nLxX_Vlb6$B>JR z09ob!3gw@l=4ccZ5P@6v}(^9)|EC}P*62kaeP!y zFw=Q5HX1q$C&MeC5&B~?;uN^o4^bg58*9#-{52RUaG-yr=mbgV8Bd2-=F7-pr1?$% z%5CwVr|mPg^b>8|k3Gt&x-K5K-`>7{v!RluMTZZ8h5qc$@ecs|7(TkzAJ;0}87dw+ zmL-fsITRtmGnQUkXHRSAk><|n4s98Z>__!mg@zwKOQm=NK#`*!Sf)D{He z&j{UVt7vNyR^6NB_3mPM5*^l&!^{^&{SCvD<%lki=OWpX=DD}Ke+U^m4s9r}`^<^XJx~3&u zmS&+;!B^XO#~v>+B`MX{)nrK410i8W!S?{q6CP&sW6btaFm%0HSHGk8b1JO*!68K* z`HPGE8E%{<#j~9hX&#=CVu5s-&bZ38+ht#tO%}|so4C)F!77u=GQO4OT1DGPZk+p> z$8ONWkdUI>J)HpeC!yY@Z)ErF)X5boJF_e@I<|~7Ud|{jVp{5V9G#Ba5_0NlMM^;o zKpCfs^6~f!G1!j1H}*HqW|`}aDsTeNL)0wP+t``ZCe`dx7uE`F-HL z?mc%l-s}QD0yEL)j-{#x8UeiSD=OZdmL-IXLN)6e5ojY%q;3W}ES!99s@L2_8#?g- zcv7Da>Dceb;@2@&D>IR*vbaXr0UZeH>{0}x-g7777aKAo4t;lWkX_ty0ZXu5VFJK-jdtB3PC zT0H9b!m1l|d#Uqq>&A+BUBzCy1q`vjnQ3C5OnMq0YJ4Nn)@s=UsnMMZq6uZ+4or)d zabpCAV-vTKqS%xdR~syCN|_v<#D1D~w|Pq|Cp2`OC;CJ@W(oc5`dxI@+d4$VY5Ir2 zi1)#d<)T)n1xBSW80GhE8Q*9ygjM1mee@UGH~(RE6+jl?dtU*jIQoI_o{m|lvsZ-! zTs_^>bjyv&Xfj+$xJ1wUqp@j}urNHrLr3fP{INbYp);EjZ?<~y!QW*dSZ?(t=80l! zQG~LtSlLbe0;{MzC-;qT*+u^_A0Z>J*FR+<&}`UXw0@5pSI43(x-~mm`G)<93Qtdy zU(O4+m3svldx{}{WeMoS3jdbmeQV2)icTDziCrQra?w?taNV*Nt1b9h^jJtd6wQ&C={ciz)su!JPDkMrruLoO$b+|oj6vZwy;u>(^QOt#q54-jNHB* zDK@fUsE3;r2l}&Eb2?uF>>O{!WqJgelxLU*6D(U_R1yxBWTaxNkU@2ImjKG8h4Ylj zx+4`OJsb#q2{67$lUA|xhzKl5=%(g!VLa1+@9L(kuROzABYd@Sl67Ii=|lhdr#E+` zbNUt@foFWUX7y2sxA@1)`g9to3x2C%rj@KjlrH!|J?2BxK)2Y-xLl@}?Zs&{_qjFg z9is>i^MI;M8R%T{3S+~I+%Dxd1`E7`gGZ4w(j z+Wn1k=lv?2sWSy_o2B&~`mzJ4vN)ucxR?4{2aml*lbCzho zjFMoF_nn8%*rvKPMw<5Nw4`B0t8drbncHPO4@s-_r~+oXvWe*G2GptfdSwd`1*L;L zaZ;5ZlMedWIL+I{TA5aC%jT-!%c;AvH*X-R`iig@P!t1o1x4CQHh<4rwQQ(P-|1!~ z2qhl3D$eP9>}hgC@|wu$t+ilty!M`MeFEv(J<$5JZgHkz2VP`hial1vPn<4g{MbrY zMO;RHDbQwKM4~wB*{s4}az@)=?EqCr2B*pT>C?qj?bC_HHsoH@WUocNjli%VDCoS* z#%G$a*Dw*1V2evcueLAU5LJe*iic-$PD$DW}Z;oq%EULg#dTu3Hr0A_sM4N?f~zql6icJY-)<2IK1kSC6Zq0a20bI?He0_xNhu>+Sqv z>=I# z0``G-i4!O$Yud(ireFPB$Ff8 z-e^3|u#k~=^(Q}@#ONeHMO0 zy4~n&$y8y60c_sG-#=&<>nso=5^@#(ZKmrWic<<5*YIx714bQ@HZ)@dInbYJn@4_> zou;$4`8oV*0B+azDy*LLQ|E1eSxCvbXz1W2;QA%Nl>yz>ScvoQwxt{Ii$#RPY^1?e z!3}8L7b;UNQLlfnDwyPuOkTP6A|AG)dhY_(#tW%68L!H)s2+E(3wa57w{UDDG^4## z9EKFjKjbkGY4&Q)_8%Bhlo*E6hyJ_-5IqPgAfdluU{Q`1iBb*^y%@FeJ)dTX#~?Yl zF#6gQ@23<%^A%0ztwd{s0jUU15ZLim@@8tr!MN^LWwdOIp&}gS1rt6Ot`KW9ZFZZo zvXS$j$|^Z0qKCE{xZ&lc2sz|rV6DzdRSXavzNFHMiqp%!$X4n5ao_Wf&tv#RthdFY zFxs(`iy~NR8V@0mVW`&M0UXF?|bXtqsf9ly?Ix;96K7Y;bp$eJT5;fcz z&J-*+0n1=xs}MTUnW^e63nGFJwfX`_zU6tc&Mrko-mgl4ZIX^Y?O%kUVLmz2{8R9P zk+aq3`pTsG)ajW8Ve4LtR4Zm7pPY#mPkk#3CAr13V8mA+>e=_pA!)>IqHEi>f*A5- z)F3oc(GA-`wO_Cj6M2AFah*UgM5}=r%6bB7`>z;|-+N^Tu=ei4>)@D{ZIrOK2|c#g zC+2z$oUyXt3P={BTa177gh_a#E1*!4nxC96=^jJ2r*$gD9nX4TeO0%W3YpIqOhw!v zelch#Lkq^iIC8l2G-z7X8|$1Omj&3>p<#K(yhdULqK0|^nIQJI=s}mnt)|q7oF(T5 z|5Qdr-@**l@99DAuy^|#^1=OikKacud~qx$&sA^-Yllu`4ve>cSxDF2s_}=VWWY|< z1|PhtsHhFu9%9W!cjsFn{L%o z|8@EHz)+a>7t-d6pv^ewa(3G_T+nhemDkzXnFmfIm?MZOX3ubIpkt-m$|QUO!qxm( zEYF3~|8S{Z^S8!BT*(SGRj^(Irl7KbH}qb^Bos#6hPB&2H$B|Y{XREH*DEn15xuRf zb#4{>2;=`g*zxN&CwJ1S7Vd3D0u2})lEruKixzs)c;n-`*}5Uqx~+WW{Gj+ynVr26 zwONuV?-W4~=?4w8E#d^l4;GKUuF_98^Yhzk+F63~EW(|Dvt=mi-C?E}>5mv-I2@&l z3#?~iec|S{fj#P0jFvV;cz74dG<99&v)-E%<|vjLWDoS;rN%Is;>tXTuiYK98=mFh zCFT~jkN^=U91l&E!1d#K5^a>2;d%wjc9HxCEzV5Dy8cG_PL z38nX{7$uY=zmwkFyaVulYuv^ZI;kp;6EAd@C7N`Z^yB0OQ=LPzR;mo98C9Irdi&Pr!YF91oK6tK6LVTK6C1P(Av#0!XV_0?s1oA^YhM8L|xfUUZnl@ty_}RE_&~=i=6pvz(rmI7%{hWxN?rHw*k5V$#R%+atP+jm$f=Un@m*1wy=xG!ZG`@~ zn`?z?C%;8Yezf2e5C0QWk*^XwN#IGit2j=u5RN(OUF1&a@`Bpq^t)M23gaYo3Xp20 z`p)#8zf;F;xIbHxr|1N{dUUOw2ll#8aA<2fI(DhmZ%Jva@=0UeX?b!@P{qjBt68_F z${Ep3E`up9*)rqJekUFKl3&mI6ePAyt6ta7 z+zxmUauV=0>D7-_#PwP2I=*Wotbg$M%WG`P+ zN;Wi&MG0S^zWAfjq0$2-z9+XT{_gBnPJz>DlkZ4EsZC$8^-mY1NqvdajKPT^h|b?06?cTfrk&#IEVdXBPVusj!!n4*)mGt~6#x z!rAfq7|<#QA_4!fBm~}*mi8BDIAl$O^LGwSs$>uPzy zf?BN%>QjGBOkV{5=&`TaQd7KLyAcDc*J|DgEvbx{2GKxYAwCdDF;rg``9|>$E5kZH zT#P3kzVbbsjIZHjPmwL3uTGPSOYXgL>-XR*-|ep03+4Qd1dtZet%=vZ2nNH5XM z<0@y{`X~beQ@VHtfdhGWKhy6j7{miM>MP;ypeQpxWVu_Jv*#jMzqoazfHBIEGav4e zSkP>~|H00DTHSvj4?y}HAYY~Mvay_pVbA^Sd>^Tz=r)+ARkjth>jwop)VLq-6=rR> zm4Py`?nD>f1yz|~X|#SfA_jhI_xK>9J}@++5HI`f}q_xP-mpa^MSUdCbUgur`m?R_ukcCSHA(gx zSG9h*o+W)z*Tx(Cpn0lNMmLltf4WXbpK9US@s5-67Pf(WV{yUcwvdpv7TE*&&b7DE z0~WWO#Voa*A6jmW=wZ`SkRd+5-Ky)nhZ?<&JzM6+4huZ|7J!vSFV0^>OjrA$Xd?ud zlj*d7ddf6x)!+qHL0;~>bzK#`o&4;N2fO9~t2demhN5#2VJPb+&ifqri&GxmfVD}P z>WdK%mVnw9;8JZur^SV+6?72125ydK6Flcre_X#;-7+r}AdV zbN|X^Xo;H|fA+=|m8d5XFAQE~+OuCxh+m|xCB7yi#p?=3k1w=!?QV!FX}~6ObQ&2_ zwdy-qgGZS61xnTqg=dP=R#74%FL-nG?r9HiPr4q@R+I-M4c(WD=bMc2DxQmv(RGJy zO>chTq(-UTRiOX6W;Su6`dlzK8t{+lA3ca0pxXbG1?p|Q58R)Gcfxu7?BRD|118Y2baX?3XBu^*dehVz) z+4ymDYJyR17(;$bO$w`Uq_LFHzEfs8B z4=F*qoPmObD>MCU9n*;}EZi9Xa35-#r)Sw84rCDITkp*T zM)x^gcw@)Dgp-oDlA<>8bSHQv3{STz8wR$KRtA0sAvM6L#3y_O>3Bk~4qm0RXo;?V zUiSMt%{?)F6Tmw#4uP%1d3#p{8)NF<=i`W89v14Z#Ll1uXlxFBv zrkC}Tnn$0gk7zZNI4Oxc9;PfxpJ!vvH zZQZf3*(*|ieV^E{s(5=!Nb$Di!JFeSG*w*OK{V%)1+s~BL5bUP$b?N!(3m1xW%ovI z+=zCZE;Uvzp%Z>1R0@R4>xZ|Xi^A%vXdob?@hbd+oKg7xt{OISo@Arf$ZI)FaJ&7D zT436nV0*NEFSOvZlVH?WTG&Kym$ z`?A#Hx6~IIGaE&EVwjIcrvYwgxr)W6ewots>5DVfoR4GcU)EaJ_6|V5lg8&P)Rr{7 zhfbD$B6>{QnCmBxMRmGV6|CZ1mbz-@a4r{BMRo8@mYlHOo~x>TB&*^qLJwRTJ9{@ki|pn!90jY z*O~4ty0xlX)bu4LK4nFhOKW6`=c4%5nNC^B3JM^Q{U(Yk6Fz&L<-Hd?X&)T`SyKYG1o%RWnnufXYjujU=E0Au2N*6q-CXY?yXGF3Ia+r!az9wP z?Oq*vy|8Ly`?Q|?t^_3aCquq@KUDBrVhT%&`4w>TMG--w4-;fI-Zr>$35W{4Up?+> zd)ISSF4DSBs#!Ygse!Jf8jArFN&hQD$TD>?+<7T}=@#KCVN{VRwmc6LT7VJP!#Nh3 z|5UqH=SHbiQrF?ZF*w3^)TMSa$vtA=&UetKn=_`uT%V1?uBqAPf1J}+w2?n73i7H5 z*_`;X*|jWrmQN{mB*RpyF?h(<;H$>P#!&D}%n+^4tkbO?Xj! zk!Sp^Cg7@_1&!I@a!qR7OG&{OA320aRjETe%d@$HDNu0sokhBM8!Mafa$m$vD=?Yw zf+|}-;My-bmmhQorAo?H;meJchjRofflP8ybq6$HOYIIj zq(gIW$ARjgLiTW45ch9q5zjrc_Y&=u9#xJqCYmD|(Wi};@y){g2Zar%Ee(O7yln+F zprhch)_F_+pzgv_R_dv~5=MOYeFcQ*_w2ri zvetb!vn&n~;^Jg9Z-;f|b|0?ncrZK$^XH(P@IZkGvmUpV67gAS`MPOQ)~AOx*Xip9 z*F;_cB?|67%7SfGht5N(@nB4^c(kg}DBi*mL-%Z=N_yDLVBEF5aycG!N6o(6vcvm+ zywcAxL%9!RAKZ?39K0Ux?L%GS#Ib#oaFp#lpZM&Z0zh852!1LO;z~T%vlZAG?sg{a{& z?jQ7T6`XAqd3X3`{}kx8RBu52%$ri?Dt01pj}~I2123{FHnwCHUG=N?-T8ki7c7Kb zGj8;vbH^8>LZyPKr&TFj(w{1RM7rnLuW-nUf;1=Vwub5hGt0kR=MgEr1PGI>o0&K` zJl9~rQX~*T9q10^1-eF3?R3`x6)Q@cZ{x@XvL_qzq5b=9fti zH&WC-^}&Uk+B|TxnD<1T&X_wbCL;=6Wr~#<9S0V+!xg}JJMN*`IKt$l<3F6 zt(our-Q7;=?aaqlp9=!3Ga;dS6|C_UHu>jbX=ZcApZn7t8r@jE;#fj4Dqm7klHB}5 zeCy9Rl^!fZEh)5xcM%D67N9sgR*;}3uen=ZUpg77S)*d?L=xniE?Qd&Inn*846Gm_{(En@6F zr{UH7GVZ1A_ZQzCXVR0R$ulf-{_6b3KV@RV0bst8P2`m5$!YL_?EiJ58)jK~LwQdw z#A)H=D_L%`|8(4vCBX7uWjH$la^E<8y%Mc(EX~*hpf_|s8*AQqa6^s%pn|Qf4p8?m zG75$P^h8;GfgJF)7TgY@S4HO%puJvc+4RpY$JU>?PF+AKP?92M=|Be9eF?aq8!cSE z_ODzm|G&%=huC)_i{e@ygY%u5+_2T9+tllG78dOj^Vap(k&$0(*{{5&cmQs@1cVFW zew1ATc+*zQ2y|&syqezwSElA(|L}6Yv27x$rU9q#lF3fSe$x{&0u9u=r@lZN zxHP#8MMbwsLdW=V$;AEog{4aXjRs!AtXKbxcZn8?&S<^_tOyf>?!tR<#9KA}6#)W0 z69{iYf$hOH>Ely?k=eLsHc*W3>_uAkY2GCu`3oG$!sP=0eecI5po<~+Ul}z= z$8AEu-wGhmk8_htK>sZb0(04_zy+;G6cDGoa0$TBL;tC&rqy#hybZ-4IzYUjSR*n1 zoft3tk8*I$5>IbABE}>4_Y+3{PF?T+i24D})guOeY)s&Wq8<{R+IyZsi5c1dEyLjA zbM_@bhO6ntMNT4?*riEd68<#pQ)vHxYi(h>5zHG_Q%#9NF(nePyR5kfawh!(RHz+}e#@Rc`kCq~SFCjCF}>>%QNk zESso~sqPmFlO^A`ge{I_n*zB+<3G~9Rih{fvf||5J!nxl7a$`2_%O#(r%M1;a7dYR z;0GN~aDZcu^)T6xt7K(-@#A~!?`{d5;w3bCpAwss50~=42bAr}xkKn^s0vOCZH2Y3 zMpwnPSfMi55#&|W0@;cO4smZpVGsIQ+8LIMu+zBy?BBv5S~xoY&k)>M zzYiH&Wzd-$H~wgqWVX?k1fIw_fy^@+eJI-%YKqrVt8a8G)jy%e*(LlLU!ifTw7JkdTr9v}NqBAIaYXJ1#KmqNfjRHbAOuB$aJn{sAB151OM$;r zz9;sFGO;cKad!PT${Khv=tMUD3lPOb$hriq<@_rKqg9Cy{kIm>z{|q_)~f%F&;#P` zjwILbvj1!&;vqww2N%R(ivF&D#k0#l@%*=mLp^7;Dt^IG6=hEJoJt~=iOD0dfmZo} zYZbwNME#E}Cg9c#L5~X^a|zIg9vTVsF4f9)L&LK;GR!an#ElMC2vqBBB46vIk5!Bn zWbnQT*}|iD=5Hhecqvz?DLBe@fq-BqOj-}IQTP(}7#Bq`j#0|brWI$xrinpj9~-h? zQ9=A&kFL*sxw*>Hj?l)P!dGn+RORSwOvCSKq<{GxGB@RB z$3*%|9LFaBL>nMJ0I{qd7yRkpfvi<{)3eQs5BucA0Q-Fw_Bp+B{EE&&=Uo@?+!r79x8D7ge|ncUi)BRr{t?yM2dS@`t%dzBYa6NEYu zNM}@KU1SN0AWBU{&OEXIl&GUNoO~=!+{Pkl_rfJuj06nH_gXQwY&Osi4|W`=ol~%> z1>^D7we5~`EmEc>Fl3~_^Z7Sz8)iM;58)yV7Jgsev1fI*#VB{_wOy%T4W3Cl7rhsp z;T*VKw+&Gc_2Y==-)5qjDrFLK~c!yb>OT1dX)IXS6Ed-F=v zP%4xm>cT(dQli0Dn%1z1fj&TYJ0SndZ8e`z;@Mg69C81vnQQ-tI`85(ZB}k2tcS)Z zNi{A{g_bbwBWc-YLN)G_R4(%jOBikVDw~O1R&IqF8WD?GGLcI|E|Y|6${2SeavKeX zhMDiz^V!|!^*sCPwSU0=@creyKA-RRe9!rO&Uv5D`J7`iCiv8vi$zBcoJy+G$|`p>*+w!;VM4oQ$dq9jh>C;w|?tg*Z&KFVv%Pk4`BFeFY~nJBtC zc(`Mw*hn`*_lJU05wf>pnX+ztm+`H@AqjyYt?KkB$6dl{?Ga393 za+C3^{qc-La4zJ(4ClpQ0*7^}EfJQ(=@kKlHPn1^Ncb+NjtgNjkw0}Vm257R4QI2= zMBF)G#lDmk#utnaZD6|!N8)49VtkX0GB>R8K#$;2=cfBX!dclzQIgvg3bI*-cogO> z|9c!{*B!ZWRrQ2ve*Y(faI!~~H1%lj-HOW%*7470_tZ^ek*DLi9u@(>bX z6AtIE%Um=v7&B=>%SUpa4O>@=uZ}?)o@Ay|n#tIr43?59A(%<=w>>VMhy~MF;4@h-8-*1$n*kv!U>5@aOl~QU z+zyJrcZ%0#5}`HE)O4BuWnT#&T-xQ-$CJ_pHvFsj6*dM7CPZFV*nFKI)b%{ZN}#1;wp|xV%_GI3t-RbhwS^_}{Z3 z%1fO%4VU@B@pX+UndMUpQ>xSVch_g`xKZAkZh1H;O;&fKBJDQ6BI-D>8&ABWY+qa1 zt4b|6bKxpqdry7p&+OyQe>j$o%dzlvJsZW|NPeWPC;Mf`huCk1f|1Q9Du^>QEi(nY za$mq2wOt9vK7G)L^BtUER=Cim(?n2}zOJD7vfeakVG_}e1|;ik@85ZAnb+y}ls<~E zf8r(_Bp99^@Tef0W|dHav#-$c1i%JqnhR|gVXu2@h?#WpBR;vk1kSCPdgXtxIXM4v zh*dUzg|27BPMgTwbEB*^N%6f(0GtP!^=1Evea1?;r&GV+_}w^7UR-=+LG2_jGP{}U zjjm@tt-6XjZ=U^qw~Jh;!&h?mFs&a!;Yx%#gsP?`#-PM5V=U#UW2r8dDfOi-r9&r_ z8>(6typEFl=6=FYYFxzMaote+!C1%u0fd7%WZ@#a&0AgUp`6mY7F1l^MY_cAvUPTA zn+v?-V&S9J{`JJ^leix|)HTbnTYHO2ym-wcqxD&hE@uce7y|S%fLh)n3cPYO^KIr+ zEY;D!ml1P*j#0VzqLOV>boWipCae{wjxd$>dRI*JVe`3Y3kj&vet}^H5G6`tAR~va zDE7z#qZsSQTD7AHFzYfttj)lkxiM}p^^AM#;H6Q1a5Ql(=#Ib--SiCNvf!s@EuD@` z+g)M*^tTT1tQ}YM#JobJ8_i_IO2Zkp(IIrPuhSt)h}*F$PfN}7_%yeSZP}>f<7RXH zH3?YXyTsEC4e129=!|1$f-%Z@z^=b+&h=`B!9NU2%oeRRn;Dp`nM-_~eVJ~YbO)2H zGj%7JbFQWsZR(mL*qK*NkfRKN16HKqxGwVrG#Tv!7fV1xN#7N)9Gl3%CEcJ) z@GIu)GWl$Q1?Xhi58}72L<4@36PycPm;Zt#Rt4DAR^prrZ+HXd5Lan`&BVIQXI!X3 z7x~cC0S2;>wYmj)3nIoN)hyxHh+i+dAF8Z@H(>*Mq?=x20Zs?E9({w?6k|9vvC@5L zL47f1PaFEr|A1xgS(kZbWFq}?UFObmTp+gcml8QwxY%MGv987=J8SU+pT=AUc8s5w8#VBUz|%?x<^ z18(q59f2vT8g6zm4=pgXwmf+)lhLVth+G#-9(j={rv@&;=;|0|{mAG?$p`$&G1CyZ#7n6KrFL}=T(<(_QwkP}$c<1716;Qp) zed(F#{cfpR9AU~e+PAEyU2{R7^myR$U7jfXo5XOmnY-x(MxTQ6y5&C0L*pPHq>Uv) z!4FwNv@PgI8umFMd^lHdmGir*^h^W*dLI#i@nQoGtq-aUhUKtAJ`uQKa(QVgY6@+5%3HXaK=eR_+7U|IYtwnEE-1`!dW4jx$-4 z|9!zNs{925|Now>EqoK2vXD4Iqc&7Jqy eiHG<9mrD#E|09>^14g<%|LySU@AyFLy#D}G{^?`@ literal 0 HcmV?d00001 diff --git a/education/windows/images/signin.jpg b/education/windows/images/signin.jpg new file mode 100644 index 0000000000000000000000000000000000000000..ad31bb31c438ada2f1b57418eef16667fd781ad7 GIT binary patch literal 5667 zcmcJT2T)VZx4X{2mOPW985o$#e8@#5bCr&Dy zI;{wXoYm6S(KRwQF*P%{xOn-By@R9ERha87x7+R>o?d}L_wEOWgg$umIQj`HCN?f5 z^?6!4`b9?Oo4ovj!lL4m(%QPW^%(5ChQ`*m_KzK%pSnH|3=R#C5WamMotd4RUmz|n zEw514e{F11w`kit2V5)w>%U|DmF%Cm1esiim^okr9dNN63T7&+ARGH}bq*mzThI-E zVOfoboFW&JU)Ox#lGC&!i{1?A=RP72o;g7|K>L&Ie+Cxye@6hImnAY7yxGc#5fQ(#)lR^W)}oU&%S5wAZ_4;Wx;`Me)th8JTE0@7K*!4!^9(Q}LBm^8`PY zZ@y0_Y<$_yYJ7SubIRN zCVPGdi&6z24l^9`1*-{opi}Y*InqPZomoHzhrFGHe4;&zTb%j$sl#tW-P@B`#=~_f z#*N`$Zbzds{LZQ`nm&*z)?s^)R1o%3zuif%r_nky!K9)*n~+*FyEqPw?@lQ#)iG>B z*!$TBB<-Eh#qP61)b@B%_dFQD<01zJ@T#zY0Xz&qCb;)EK{k<&1$*&7&ARt*R{esu zWXh1!yrwophLB`c8%o~arxKFgd_<{^e;gte&Sv#^x;UI)(GS+b=}k zhRW>e*EYf>*Cad~b?qzKqnqEkC-Xl?c&OBU;b{U=8l)CQ=dMXJfT+)V0?bT7Z5wIP zv!rt~QwhxmeLk~(Jd?EEuO4xJO=U4Dv(ihj}MykkDGllV? zWmjq5v&IB0?$mJ5@-ePd)0$`)Tr@lMiDd~fO309Zfr~o5u8;m8!`}=g_kBpGOOYp| z^Og*b)g^U3`n|d?k;i=S-TKh=#h0lm4^phXw+9MzE?5gYcpL3-i^^%2e3;O;`E5V? zZG~m~j#{FD;>v^YOfd3j{RTxfxzIw<0+OC8oz{{aZ?#ZoiWO?}TQo2JBJf$DM$tQr zT2=dW38qgt7U0}0NANy5w^Lkc)`sNsVF0)K#z1X5Hjjd~l?`OVZ()a~Z2NtV`~BDl z!E58r#r!1oM_S%$iY~Ia1SH6xsb-1o$sL7uR?~9ZtCvSolrf{$3&EGuLgA7%^d-QZ z0NK9zwR_k7FsSEv|(t{+`RqDnye| ze<98Rz3r^@(>&Xc?ZFa!YPLoIgOC&mGAh~$XVm|T%&8`qh05galC-hv(&-z4_932p4-{G6Ml-=}Z9zYbz)kRqt);icK0 zdu=xDPHcMZJ61MHYjj>Gt|>-Z4qAF55i|uWP^$_*Y`>r)oTtzWHn>bGGf2?i{30md zqj-^0*AZv_?P9`foGa<83_o4aLw60O2Q68JZ8SQ=*1Zt!PrKL~C%U~=nmu^~zZjeM z5kFg+-zQ4vr8=uoH)#|QwYsJ8XwfKcg8JdOaO~E0jxW7wYj3P^F>_gx`j9f_tyHY_ zRL_{u-$5=XZg;=YF}(-Ul8g|ud9S@8Q#kwRW(`ldO^t8fD*pO z`P&FaMgo;Ih^?)TiU-?G}j!u<(d8JnXt^K zr&pvB+5>W>n)&m>HEGeIuaZfo)Y^-{#v z1o(S(p&<4Wbc^;Qtr$Sw(c;XOS^W0Vdp0|J%!+FYvFmX~(Rua7<`cXbz>#a^lVpYV zeb<@szWv-ldV>04m2x~-LvXyx_2(JyuPS)&lLC>uh7PIHuFa$P_+Z2;_$+2D4iJDwh%hVC$NOa=N_CcOgGHf``)im3vw} zZb=V8ZgVDUY-dKtpTOOZos%`Mqm!3uv(&4u=C}EK@ zaA}Oim2RXiq5VpQ?QrRuLKF0rM}LuNW`PAv$vDYx{{>EcRYojaf3^qIk$FGEZO#wy z4h->bzw7iwH)1y?FGsTbUci@X=P@ghH(Dp2)g70w^!|f3K_)^`lZuGiCr5o>6~ga^ zu7BEH-e8N;k6C3_|LJU4MQ%GXdh#SKNwunQ<(djDy9$S$4O7yQNQ$l;nG~1ncXQ;C zwQ^^(HBop`+H;c1EsEB6C&8JgaVsQm<5%R!uGy}^)xK2>t}M!b*n_B^C-$>IIIwq9{!?LrSU(_wp@azy*p(N!F~x0b;%T1mka%;NznrVwKprTpVk{nx{6 zako*Nv=o6!uNnuIJkZly%p^DSt87K{nr$UreiRVXeB@-12z!@{MB{eRmZsDECN|a5l;Bd&0MuHJ zN$Uy0e(&#*diE(dRNk)q+&aHOZuW2DRe5`E7+pCe?#R)?q+-v;4wQFTW3`e!LckGoa~P#?8zA@kt<6emG3Z_Dw|z7D?8rjjB_O9 z4)gj>X=>=Q9gj;W=Q9!cwW4~u2mGT7gLYgS`?-3(zYW88xCQMdR7h0oX*=5kVx9C09eUna60`h);W&+{%;CS39g_;zi~1{^O8gU6ns z6f_yigCG$Af#R=xGd|p=YGuWEKwCu$uI>PKlwZCJkm<7|PPwGueDgPg% zdO6x(!=d}ASqmTEJ7Sk~e*_~MD69;?z2#ed9YVgNLa8{GZ|hE(bOFxxa+?e{xW&~n z>xv&h`@G@_iT63Rbe1p>U!kfHj~sOiyyNn?NJ;#bJ%?78FJPndD(%OPK{nj73a(G` z#rPaAudE>5BjAm*mIoNXLSfM}J4jdp{zro=H2&>a*zq!Nm`v)dC~jEAz=I7VG^s4# z7*(?%hq;-*H|Z{Qrc`53lbnD-6>BWR+9qki#$W4KOWcM*X-H~E-PLJM+5J%lP~e6L z6vVO#gyfRGK)+kwf#-_gx52GU=h}~HU{j3Oi4AoL$hvY>Ipw3~*N8?sF69YS zF#m@STU+;&vFgfGux&9Df?u;vvC44t&^KsOKnnd9X%G7>+!$+v60CBOrEvUbX`a-L;PUIa+;*eyhTEdi|EAs|b zaJIasXnExZRvuX{zt=~5rv8K7jn*{l+b~zKzA3pZj|JU*2qgZ7oRCIJjR;CWHk{R4 zq2GV)^vYhmyzGOHB)C6pf9beMi-7aJyfNG|6okgPJjTv|7y$Ubj=wG~sed!4C32fmH|CjEf(jtofFnOtguv+7mcd?gL zKDNdTCm;IM=7pWK?E~iL`S`3ouMesEIDs7<1vNTuu%B>icQ3sgx!kq=Akfyw;Jp?WdKc^RxuG@p zE=v)!02`J>RKk-;Dn=yXBD6Bz6RBZOUp*UORs(T}%XR1b6gd#_9a32q>U!s^QD`u) zkaUkopoW~3>j}dT+H=cRT7lJf2fwr$JB>^5_m(A;hR*Zy@;zexdL_s{OndD{V0Xib o;c>#RZM3kJ|H-dS3(uOa-{r8j2BxnB*;<*X2xR#=AQ|8P4ZleWGynhq literal 0 HcmV?d00001 diff --git a/education/windows/images/signinprov.jpg b/education/windows/images/signinprov.jpg new file mode 100644 index 0000000000000000000000000000000000000000..dccd7e98e2f123b8a1e4c17b2944cb9624e22799 GIT binary patch literal 22869 zcmeFZ2Ut_jx;Gl6sep*|uJqnJNCc&cfb z1VRg;B{%M~_da{?bME(@^Z$SMxzBy>S!BXwtywek&U(wt`~GHOW-u#&yHAzXlmR$6 zIDi+}KL7>>U{UgMv;zP%GypsR0N^I}+C2a+Hiv`#`^$lu2RsJcz`^G zyTpI*!2AG^-NfO*8N|h50o)+N!6n1NbOM;MeZ|L8^qZ)^9ym8}@$d<-UAj$#El_h8 z+kITz8`#d`*jZ$Y6!6y3hP4KPT zRMa%IbnG0QT--cj;u4Zl(lU>qC@HI`sy)@!(>E|QGB&Zcv9+^zaCCC_@bvQb@%0ON z9~u@O5gC=3^f5Ul^;24UPHtX)L19sG$@gkVO)a#pzM;LNv#YzOx37O}d}4BHdS-SG zwz{^yvAOkYd*|@z_~aCMhC09aO&1OT_ut6+J7xbu7a5kW8`x)nNBEmAoEzTQgiD5p z|3H}Fo`N=^l^Z#W$h(^qiV4|OZMRrObr6&<-;Ca-ViSY0AO0roFO>b)2n+s0l>MEs zf2V5>K#YrneR#NJ03hIed2Oqwl4(1ONzNApS{tD^H8n*g>4ec(P4BP8(M;_>FDhYc zF9HAv01R$X>lgqmCy2!j1E41A$wFycfDikD4j~u-E$JZ~pb z(%Iw91v3N~hKZmxUY#&>n?78)wLj zB{>EIfJ_8xkzxSyYiIW_kgVt+^#gk>9VBFj?N*6qLmM(VD6 z<(nh0a-MiOJM$md`acMcSrB%-MA73qe?~z6-%}0$)AD~)5f@+oDQ&3!UlL2se=xaBo}dL0^mnv08u zYhCdkDa2s_zQsEjfKW~psmYF1d(>VFyN_~5M+*SuALvM=;#ui%ytq{Va>=GN(EX+q znt{zhNNP131xBcJT9QMyDRnUml4{s^BxW4wZ}D`xxoHn>yXiYbS-i$fxa>pP znJQ!Ol|N|G8B$f#7_~!1oc*z^N|g0R9@DL>n=DW{5(H~!>s=50Nj?zdGEhRzw4a3MSg%8&eMm9bSmZRC47xnb4az@E6UL@=Hu*GbqjO88x>7;|5p+1hi14 zcFcuBBjg7KErvIqkm9$dZl>i6Jc<*_61KmO)7Rx;L4Tbjr(YUifN%}n&#ej#aP&!; zGD)t;cJ{UV#r`BMQU9az!QEG%&cda&<3HJRuQ@1K=$KjtWu$lDT7ZcykTb`0ykAji zh!H)M)~YY0+(gRyi#p9!W08yG*EiXbk&6nlTK$?T8^%j)i0))#2sm zk(SKO(7H&wFol?_O8QdLvr>nt_la))J2AG(ZXoe0#i)G`tyySy`f`MvLcx~@9_Im^ zZpeprAmt+>dUKIAKD>Jxyd}5P3~+GxyfUTO?42aZ+ zVf({k-u|C#6?Ke)ySLtml75K$8Z|6c!au7PxS6F}mMR(z%^nyv6ssg%c21#7p8Qgl zH2({kb96f41|rg+xS@;`8M^1Tq@e4g(r%I(clDScId4vU<8%rhLBms0#5X+H$-`2_ zXB?pqNK|s#QL;DyUB%>TYUHJCf+!b_uEd)Wg0U`;Mbi$XJa+;_y>TXI{IqBzjDqS& zs)^jRn&3!6EKEe%>+Yk~Qj{PPd}tVVB}!0kYi~^wyC&zQW9eitrBN)ySW&wxTKuUr zpzsAylF_Fu2&(QiX5t*U4?5*(WILGap;z)s2kvdJeR1zj4-W@j373LF+jk$k7a8{k zbAF4`k4;pA-euMJo_lYBOZpYSO=Xq34GxCAPq#|Z%QWMQDQMIg*L)x;dHLt6u#&eWexx+Zmv4w(%zFs=&ds^AX{ zfGmK2?A0lW!BV$|{DpT-)P9FHwB@blThaCrqB^x3ALdO73FV^J8w@6P6>~O28jgfY zl|7dECO>H_QD$SmC;)#T;mib$G9S4C@3!taOoC5poz^a)Q;no^tY}TnRqE?lx=M7) zkQvzPVp@RkdM*oPxE?p?eL19Mcpgd+b*p_^yEoqE5Ico#rSw@|*=qMMCv9)xoPvYD zx#WsEUMO`fScMgOC-c(@joe?8u1H)~x1{8qjdYCW;4xi z+5ieofok4vLTDcLu6+K+mq(s{WdE+1t4Nxk-Z==mH01p-!j1yQ$(C8n2~`JqTrw+K z82MzZ3PuERJ4iC!%1}DwkM9@)s?{PkKDwJN-7FV8>DK2OJXYiRk@1P)ds)Cc$h*yD zT$V$sj0&GD^=gDf;hHmVtaRCxQjUVF+g5plxnf&nsEMkDYy_+W{=gLH9bVK5pFqKw zz*=2RinDPxXmkKCOqx|b`(rQ=S983^w4CEqfN$TWY+v^Q2Q)1^L18ychZJa1_rlDI zi`UuZ!gMPr-T4h?oX%%^-bKm4S}?EQiOfN~CCOe8b$|kTaD2Gf74$H<`LJs828oKQ zuP(pio4Y*cqX~Vt-xurX8zozetb*IMC<4q8mL0LW?Lo{_O}g1Cu*N_d5}tnbuJOvX zL|u2h9HA$gW5TIhKWsk;^$yFu*hp(ZZnA$$n#fcG>JE8ZlI9?2e;Vy(@}WXum&H(( zqB(~-KI#M~GGh2GUW><&m6b?qPrSo~E}4@Z#k+~1etE-|tf}nqa!pT8s&ZQ2xw&QN zN+8K9|7~Yd3RFiM)Q==SUd~*yqw=N_RTfjeD5D~;tPj)v(vqn+sa$jf1Is!B)C zMJ>4Jh#iD1x1>Z#_m+y{Em~5aBhxdO3e8Z!nm^brXlI(5+^mnmnZ_|+pua?@%yta^787-@v5GX&UQ*pZ8#|NY%z#at;EN@bD0SPuy4L|{P_FCm2Q#4 z1-jgSl~?_y#nF*$X>F8JOClS|gE%E!=8RxmWxWroi`Y2{qIv7R7#P<_)GYjxv&*lm zFe<2{aQPdwt_C}~(m3LOkZejomA)da|C;oG0zqTHIZvXvrq-&SVH&x&pNq$bJc8(O z$=#(@m12$ei(1L(TlY=NPxKb#?e!Kb^X2P2>daJosK)W}`?mPrL}KhdWC{(PKQ_U0 z=PHELxo8;g7G|a_pFS*wRko2*`7p1jbjMm+{1kU3HSK}<%W|zvzS^kH+)_$WGB4@+7vL)Nejni@8mkdL%kC^!w+vHycJ%1#%o$%RB+jMcj+M8kOSi@D! zo|{cm`{zZlkP?WP53c*AU}GJgqu!bjQ>AylvR&{oVDi*^&mS3%Xy||~caF$ve4F;5 zIwb5kAlo7TMb}4C^eYi;XCct@Ks#Mh|DN)2#0LE)A$;}_Dp6;a*f^g5^XIJ!P3L+9AMnmdxHWp|P^%Lpp#Gk>WLri#9wa973BNXCpKf31 zZN<-L-_*YC|FANv5vp;hF}NB5Wn6hRPAlxW+Ov41nNDdO|$q{jUq} z&ORG3q+ay_zqM>asVsEJqpW^X zbthjur@6&t>t}jq=xSvsRgh={6m^R;e823(Tt#c5CT(kytvZ;f$Ye>)KrR1>eQ`5{ z79T3n{d|T}Wo`P$GEKk>)T-QLmyR5KEg-xxf1O}` zlxJuw{OQgcp`H%=i3$M^6v(c=A$|B~5*{h9*z=@`lBCcbzdH``+I1Qt&f<0T>aqo- z;@{HVi+t-Q;_#}XVfdg0nA9EEy5+7=;VeG6UFf}WMy4xLDBdS_?iv(r?$2NIkQzA> zr3!RDh!P%R84*F1Y8$f~F0fm@K7ZlARpEbHsfM`Tm`W6zk2dCn)>*za>}QMl_@YvL zRr28@p21e-$_%@-{4aAVzBbk=_Uvi##hk^vQ(utv6oLl@7=Xb`nh%Jqh21kX&bZGf z<@u?{+Myh1iqysIWQI0H$d2hM7@_qD5ww1tbmf0<|A@MCjtGzWwPZpG@mj%az}mM; z*IBB#4@RHE-oX~PozqxwzSQYgQK|0hhOAG zaRL57!u|GNUHVm+kzUpS5tV(6pAOE_Gb@j8%Zw^{GFZjXkv`?hX?x8n=A9D-5I(kx z@z+*%U=}5yg-6{SqIgbi74uWsAtyN`Efmi#ifco`3-I|l0SSdJ(Kkl$ZD2TaRx^e6 zi_I5GgqfRBTz9S0H6W1Zvfpwkw3R|%{{f2raTNXxbp-Uj_<w6)v4J>D%7ZIl~>=_3sIca?+LN3}I=zUE4(R~b5_Xc_{AEHCmR0fC z6$7}rW*p6%ZA&^Ymm%HNRbG|^KW49udQtJMngZW2KH2Tqne?;bRSnCf<>~j6pz;&> zM5CA-M~ly?{@{*_%DSBvR&?id3(obI@+*(@sZ_9Q;m$=tZ23Zm7rkcO=90S4N^MP& zgJa=`KDVRzR8ZqLSwl|N_T?(c*e2WTU*1%LuyaB2UOvH>Ho3M?e+(eOy4~_SFyhMnP^D{$a_kgHytwGY zGUYsEu}|NVK6#H@hdbbVLK+7bJZvWPk-;lCeQ5>C`SPZPPtLLhbXrae)=X_tjficH zEcZZ8C|^?5HIC;%)vvmr@bXE*ekhvV{rYaKsRIV>X(bEbL`Ax-4$*1w`9%2+%~_f| z{xny!e{Cajj_{2ND1LlIEA*&$yX)05dWH!&2{Lx6iI$Bn_V@%*&o~<|AG*HI(={ET z@TR7h>#Kd3UuW>!!uv3*-wX`Iiu9~qk$aT8V{4uF1UzBDUy|wd;(<)N2|d#hvM|<)_xP>e!X1Vk~W=Z0-@z#7uLRp=VpkYIgZeWaG(5 zAx>w8(^_E0JmKZJjQM!TqKfNl>cL=cy8(#XHyyQKxA5hxE^V$94kyEEoCC{^qg}~N z%;t6yOdY3?eMK2*@O=RncCxP|?tCe=d&kV5&tKT%MUBjE!t=QmrwyUbn7+uT z(xSdb&x6XW?5Y*Z8Oc@Z&aAL>>S(bdv0^cEuWLTskvCIt>jv4#C&vema&Q>S_H2}2 zNH83^=|Nm)4mvZrqSZj0Mu?zN&dAfpc_=>`anVhmC?$s!HU5yCO`5sqwCgiCYJlPX z_zqz0R%az4%2jpjWSQ)-t7}eREGXkresR+QP6gv%Nl^^V4`pqviy!##k(-yBhNIX7 zJj%Y63DOF4k;#>HO6BA;;7$G2UQnyGwE&ToC=I4^3_`OTyQ(8R7%!$55ZS z3)kA(mJIk&tB&;de9F8^Td=txC=iTW5Q4-z?9MGj**_n5mE$dSSQ0v1Tcq@kqFs*rPU@Q2+_}bXjquSE^4r^BsI+Fa{(cYII-f-3L zUc2f@pV|2B4S@1<@sqOjkfB9}dq@1pH8#efzjGPkMPK>4a$-BCu%EZp zx49M`Iub__^0j`!vE!$(d+YwF3~N{be>DAPKGBK}B-YQL6p0GO0IZcuF@XGPL*~Vn znt^v1fL9@!@|?Ar5q+#XiMCQ$aj_tw@X)G!x?}n|0*x(iBZ%T?{gD;H{2kg6=x&6v zf3mz0Dfv{UEQ(VWZpp=V*rmPFaX3&tYXH739n?bklxt1pE?Zq+evk$&y3gs&n}}Q z1>a);2jdvPq5cVh!w~cQdDb-^_P!q*XsiF}%KyPpNfHCQZh}w9buj?k)bsF*))eqh zap2Vr;JOdtAAC6A|0SR3Fr(O2_V$6BSZ+gL7ht~Dn&A*z znATj|257jJpGe zQRw1a-tlPvS<8LkM`5z3d5Qb&*g5mF8&OKk zPJXR}+`#CpjJS^w7Ft_qy6+ zXCU#ML}c;3Q0F_cH_wwopNqJgfDzYObN1-)Qt%a}Dfp1`C^b^$y&UVR#$&bC!#oD#S6(`4D!eHE+_%I5&* zzeUA3>8XJOF@Utw=_{Z;5-YOVJIh$NyutF767#<{DtN_aK>$2{Xo>->q+o?OG8cW1 z85jKX6gwFWHXT886waKulpwqB-`JZ|#){6Lm`uEO@`OAf%1F^jNgB1hlji19RsAFUyng9bByx2lB zS6@EE>YBfFqtq465|0WRfs0}Qk0)Evx64~mQRmeE($RR7Y5>W<6}aUJM5RB>RKP+N zuV3FLam8V*nAk|DnkiB@Ezw_>bj(EA*cZ zPQ3jG@JI<5g$F*r`#%l*&k#lAGb7Bi=A5B%<*kf7zuBrX0SJ45kh~@}z^X@fEIww{ zku;*|whU@#IS#x|rr#K6XJivw%=rI6MtyR+4Q_{#F$;kkP zQq}KH>5~(wsfj$H_nvOK*An8gCG}7ym@skwR0;D;ftW^AS_^f!F&yTy3@}u&6?xU( zlr^(qI?b}w(9E-^-k-?I_5JcFw8PhR(Sb9{GsJ0CHp6=Uo;%u zAb3p4C_e~qia_4uzE<*3w@%6Ge3Nxo?53RVrTOj!X!_F>bcwqmOkZWLOQXYv;6D7~ zgWD9OhIuw(7Xxr=K%nyrJMfd!7Z&Hum!jjp_f_R30wGVrIA)?~l7dA<7pB6yT;Ewp zHKMjwLGCK!lerlt4NcYcaThZ#25C`s17~=irzP_DP*#WTKTPzd=;U-~j2EhWAH-e! zEauCmi5+xH1~6FPC!XFID>T&95Ca;=KJ|98bw$}M8tsVAb2NYL{kfpxLW|#b&o}Fh z!ev>6(F$MT`peh1ifXiGwagLA;Wm>sU$m4)_g>UQ9r<$lerk`4dYY`-#}~`y@Z%2c zHI8^Scx5@3F19J5cUn>Uk-^cytJMbz26MDVlx8J~U*D?s5v0qJ9%k1(@UWd=t23;7 zV>3~1V<7syY1ZIPo-9w|O;#Q$nqs66*4Lb7F;03dN@#MOE>23K6mW)SK`iF^IjKGD z46R@zdlZ*YhBAtrIbgF=Svs!=+)$A`3~#4e0-*9M9BSXF^H*fJuXi3XRL7RMeJlO8j*Ck&zE)sO|c}+OewlYubuXhfxSiRH$Pwd1|9IN6PiZj#zecRw*e)}If0BR^GFXXIggkmvyxoBGN9?KJ4 z%d0!JzoBoZ$5)Tjyrlp^5Zs=_|7~B?ErFfVsqSwHcOL;w{$T+k z6wS8jGC6 z(r0MO6aM8rYy14Ur9SbVm_l?{GE0Kh_{+sr<`Zt0G{|y>2rI>-{OXSjGo0%dmdN)g z_UtPb#GO=$^cI$ei7fs4nuf-vSk^GMyQV{oO-1!b`yZZZkNeW+rWV~umec2!H$p4$ zF&dQ)9Lq&?6Cw^DJ@OAq-q#5llBce%icu@~DTEJZ+!>H{zuhnP$y53M!Gf+$EDg=@ z3cXaXlq3dFJ(>CCFsnnJEXgF%_K*@b?~RAkZq)aH3VJi|?GWF6b?AMo3HxT9&T%l} z2ckx&b;sADix9f;$Px*DdO_5lRaKK3gKMVZy~@whzokLmMOEySU}0h=T~FqV_-ei0 z&;O|u5QQ5%EY!FXjno=5*iKikq%s#g@5O?zxk2&r$q6Eq(%PD#fJP0(t~K*Fbrz^&b_kSkH=m$P#EmUr_g@(M@{aZ z79edEEWoSh{K%DmQ>{MLO17Ri26SN^<58#%c9UUgo*ay32zpA8obeLuVS{K{p>B19zQtO%}R1KaJCTmhUtA zE&-rnl?%>wWL{j$e>HHZVv@1S2#u24^_(nQVg=PMQW4ok;<-IZz^SoToz#C$49Kb9 zd+sZC&a$}2G^Vbe0<3YRb7YrHwNv|`e6ZEBr5$s_J&}L_XXW`t*Lse|bZYEo=ly`; zo&f6{CSUDeJ|%1M?QtKuzIw7Re6Se4jYfl$6M7CviF2JYn;)$(b-a70&VO<=I3{*1 zmZ-{Z?|943ZM1KMPvo`VkrNNs#*^dk>ZSFS1&*BQ#(A$2kEFe%*)p{rssUqFlqjD- z|7@`19|IqM%m0}G2yHO0@CsL-{6`&`^AOjwFw(JxIMtm~Nl)f53%1c^9n*4LBPfVz zb7}Z;5aM~scD&w3et6XMNmgN_s@n-<2_uaXBc*bbp+tui&+MA4@yr;TDO#uhf(!v} z7osy*3orXsoGz+iXIB)|KN|SsLts;4aHj*Wc#`E9;OH6H(Ye87wjyffU@+lpmBwDr z26fU3!}Svc> z?G{*Mq~PZ1=6ZWSk>;y`@0V~}B?C4jV9NN*4HtpNK(*DD?~v=ND{`3sBGp;P@eZ9v zTow#utuAu|Wis-LuDmODohWGfeoCG3MqO-_YMyev4vi9%djQ#`=9TbIFv#406>ko7 zni=j}F#9k@qJgqn(G!qj2@;vz*E`y@Y5o!Wkt$gYhc>0bI{js(ywjaNb6*JD6>EMt z+y{8u{Y%6r=heU z)-czB)6naHk%YnCuNxDf-K4Sn#5vV+SXyp^Ro%kNgb$&qjvb(fcSs2tNdg0N(NkGB z(ex@Zza-A+@~6`R*$knXB-M|Cw>nd(VRFSx`sZS(3M;(pDNt!BXtFD4)Dp5B8pQ3R z`@>H@+|$iD8ztJ6-qk6?xc`o}8anPG&g}xC0R{9HyX=yi-V^OzctoPFF5Wqu6a96< z)URdA4?e9_`G&_<%0c%Ha=T@qB{Qh-Z5u3BajR|ICrnm)`7yL5UOn+#`GtBhYogwJ zs0N%tM~JaqGT;7uyQ$)Ip;_6N@{FMP(kFnQ+R$L&PJXfD1$LdrSHthO1SX!Vd7rYK z?^HY11Wgsek}=cAZ9)TYGz)A(KFWbJcIW;sJaY*s1M=NFBJ;4z&a%Y z(x^jEZ(TibTg9vX0#TQpfy^ERqc?fetP@pN?S9cF(i)Mf&W}|r1c)7ylpzoMa&|0i zH$Sx84}C)1ts(uP7i!IX)cKXawLrSEB!KnOD&PTPBz*5gvTCw|4?f<}qCfBRhQQQ+ zo|Jfp?p1n{N!n9&7E7}ZDP=nWT!~dZg7qfdOB0m6F$yAHUnw4|0EB4)-`O{Ucz9JB zCpAKT*dA#k^E6mpdZlsV2Qsg2s8tK z&j8u{Cw+FH zISS~6os#6(yhun%bh{IX;E9 zIib)W02}^i0L4E6KqTBi_U5Foz4@Nd_`3UHGjIMmL)F64L<^lyyvpdFYo*6SlkNfC zVD(bj=nR7}-nv{sW49^JTjIiv5j?WbQSJVpj)pb``+d(#f0?_kxppiXDpXC#DTwz( zHyLxpKMdXI^pl-w;{(2oqj`{Kp{(l>OQYa^gKI`o*shH!;Zix^+0P&n)SFFY7eu;A zqnx8&F#JJkyNsTQgT$CdE;aNOZRLe()LYb@)C zvydMck6kkY`>NRU-#Ek8I8zM>l7(#y7DgroU47*zI%8?fN`P)#HpmWZ!xma zf9Cd#c`Yq%ul+75Nwa0t<)o2_zBJnS1$2_dac|wTeWANTI}O-`%PXMbW~mMXx$Pyuo-IEFe4ITLz(FLyt6RsAwvwiU?PE>~hMcx*oW&Gn&=BMhji%K^}r( zp$DO^0-#fra(Gd9>JV&(f1`dfZ!&hMc}#v;0{@8a8Bem_vGMKC>FqREdWEjmwuP0Z zC)?IJ#$J@VjpdcFu|>a3W?R_&wPOFyD!ptm{~kzw`SmXCJV{-Gl}OU{i14K39Z3n9 zN&cM$7xS56Q8aku=>@0yb!9H%tZj&HZe0IZP9X<%=eUDPB9)1$Hl3cRb`tKAlj>ir zrq@Q+_CZ)By1>+}`BFLP=ko0U5F*54^okzV4Af|7o)Qq?UjtEs)?@mDripwhN`PMY zwewbY;3Z}KtlczvZZpZc31eO^(=E|MOPvFP9scq@Q-)8G&Xu;s$I=OkNBzQmavoT} zZ|iXC(4&q`vxH17*W;y@SOl<#G^~Lj7H0ak_S^3BmiN%@Kv-xd5owiU!I_RJC z4+6@p%s;Ax)Y}!<8p|q&_{C)!D^&V@SLrL2p=$r0DMh=hl9{1*9v#LIu-xDB0Re`q ztSlO8jGrvi8nw93=hUfo#}7Yz1q*JZg3{p#qjKE>6df&=7_< z3!?F&6)guS&c2|RYY$R4w?~$k`#<)6P3CKI@B0PJ4-^-KOCzSWQQE5xSX-9gw>omy zvG$D z#AQIgky?gLQvS(@os@$IQC7j$Nm|Ei4$EGf{fOI>UxNikY44b=a*HqWUsYjRgr7YdFrcZaItu5i&?}`9;Zf5x7rGq9uEO3W8 z*a-K=AAJ{+;t6b9Z7IUSI*fhrRC1k6#vjA5f@i!uH&o%IMO$6D$US@6dQuo@!k{i|}18AxL+$9csd6ipL_1Tk_zn@m6DCQBuqRk|Rm z^Dc!u@sk?u7~ifA^VTkMDDTGHIUIzbI2fA%^0TJv_e;g!~^+9>KLhrhgeKW?VW z(9i(rt9j=Rsa82w--ldTW1l6NPxu;Vv^a_U@LC7*;$tTJ&&}pI@pSXYa1kPPQD#0J z&w73q!G8QY&d~A$GW5?Zq5!pmZKTelDx*cy#d(t+>i7J)No{UgIcBpob9yf>!dwfY zwtPVy{Q}sHNdz^bbXBQ5dCUF}AzD?R-}LK5CzYf+pH5#~j(kcE!9j}!>y0d#tw{~} zA#)Fjel%3VsaN@*@J+RlPI(ZOvrMfx{2H;9Yml5}t-s`Yfuo+a#8_TO{EfY?(geG` z75)(6t$v6&SJb*BK`VPO0N=Ytqg8S zjlCHKqL}hV2ONf4oQj>M7bniyM845j9eebE^Nqfbxp?y0r7tZxzmHRjIJb6pc`=yF zsHrHt_B|cR-6H5iYH(e23Rl-1gU|n9dQgQPZZahi)=}Jcy`|op4Qerq_jP5ce4A#> zPXFjl&Gr%z*03<6bbFYXry$KTK;k8h()rznyxJhfVBG>Uvw4d)Fy4dkAy=}*iSFo_ zSk!Gjy{SQAGWC?`Mzw?LJ$;5&5^i~?KDN2zQ+e%)6VoADK9ij#Q>$VV{_E@nuj`z} zXrBI-qNh@LZb#`q!Qo5~qTAe12@pox09mn|o2S64KBO^2)$^QZAhvHjLcaIoa+uA_sGb!al%g`UwQf8>v|!fA90RaY!0XVB*3EQIYeMAc$Clgjls4KAL0_?RV(c4)y zldqMgGj*Wh2_IKK+kUy03S-o?bS_BWK0bx+_;gnyqC4kEnop+F`LE0TYzl}9l5a$? zk?{?NXEm|fz9dj377cbY`agn1Y_(C*` zUq74gt4+E{;rr56+H3vmjb~5NhNZ)VdG&HDlg9l$Ek!m`R+b>Ujun^ip!oHG0p^ez zUpaQk2x|2SdPQhG)tj9g1QJ!x^n_ybx+h=Wl;Ui5-fqQhax7gknV&zcl*4sN%USW)l8tV6q~o4q9at z`jglDrm;e!VXRTZoyfY$052X9CkjYo^@;k(#g$se21-roX} z@+($RvyX~O4K8{M7{DTZnjt5{H^!ZBX`1r3=M67TD_yQXx7_!UY;Q%RjFcLMj~bec z)u@bd%!;L6m`TQOn!MdB6@8Gnq)X1A`ry@Pn^?hEAOss7%L<>XP0by$FY`&#`95AI zE=VT$zFaH|-o^kO(_&GKM#luym#wfXHnrLktM-=X$CksJKRVVzrkz2pSHRs@29_!_ zmnzzvGYBab=h8Yj%phgePA^W3K2wa-o*FI{~g<#2dvqOvW8^s)@V6;ej8&_(0B3x)Vd7aA0wE`4~MWPj=`PvRVox zn%Nd!+AS?GeR##h6g67;Ahyz`PKrw|Ro=7gNoQ#@C@Be24e~KX<{}8bz~XNR)Dt-) zP%g|Q^8>leMDxDi`mDVvrlFRvycUK0J^VdGpN3~CF0k#iFqVjCo*maArZt6Kq|*J??hbK4kkfipyC8q;dtT>Cja zdO_Xo8oES_=-P~CTw65hf(wa8sf%R46dT^lop;$2%JE2?^qiEIi)5eO3&0NaGRNM~TW z;DzP%5^%3cK61)(vb8ed=w~twx1nz1yAjKLrZ=F)X0JQtnS^VWIzAo9B$R7K&l>*S zZS60Q91FN#U2#QoG>Q>3rU$m^^N%bha&_KW73bOVH+<-M*xJT>`4S5=F~wiM=OAi) zGryq$vEwT-&7|3l-Ei~B`qo<(Usf-g^T{I(M=haBw)wot_5rj1A{wd^*n*Gb8D!y)N(#HqW>tg-)e=Ln zgNM1^qD4=!kKe6Ib{6$if2a+US*A}Sg%6ZcU!x?ds#s1l{8AAmaMqCyI*Wk#95iW^ zIZPv&I6cN6=%qVAE=&D6!<|Z4N7y?xSWDvh;R)x(aaIwItuLoXPO7x{J2+BnpCOde z=<^aX-8$~HB(s-k_`5R*m1>B6=Tl>_c5kd|FTyRo_XxMXvfRUUt`HWKx+X|z;Uw(1 z#PWUOe#j*OZx+7k+~a&BHYh1a#Ax@O)g8oxIvO@*l}}$c>v)&rm#D{r*sn+r36kIZ z99i*?=C1MCJCTBeUctiry}0iQiD(GldOd9ZMO}o#mao5pHjG7Q1Ih1j+LB>8JpgJq zcA?`|n=%(@IB-E8pU43_WyGi7pEeFj>V%fn5Zxj+y!-T#kC~^zRxnS-)2iz&?QUQ3 zla{1QLmz*m34Vj4qmjoGY-27nKJS_sZG+~5$^}Z@fOAX>Uyq?iVy|!DknO|X5b4oD z;g&0loSIW3@5LA;6%!9n2b$$+uY|3nA$94SqbHmAV@ff~35$25o+@pE=)-uZtRib6 z=GTD%QRt!eW_?>%EfnXl^xCeHCo}z(LN=;;jX6pjNIX{_AAU-r>HkH37Sz?yMpV0! z!@ep6Y>;BWd1uz_ce1`gF;~6kQ}Z&HlVTqm!!!Q9A@Wc77FZEL6BAK$f$KX)`+<=w zma{#uma0SDA2K!F@lH$h(aK|D<^C%ETly2?r9<*dM(o2_PmRrh+_;bqKth!C<6Tlx z(!JE2B_GkY^rXkDBsyA@9P!TL!?BbQi6Dk!7=)i6anm?m_x1d(*}5lccCU)gr-uUP zp(0R*klr5LEUU54sUpg>29C*W03kyjde_C?5tpSerJcrhECPpR7lI=r z_C_-0BwA&RYWX{9i1;#zlT32#RvhbiZpyW;!4b#>B~&+nQkh>;71f2GoRogP-W*+Ws)#Ty$UU&*nL%6{MxZy!yKppMCWp85u%d=&K8M?UgqA zu~>h40WZfttKPfWLK+}+s1+VSmu~s?v^2W+;EFnbslg&!ImGB&rfFp1QLdrgan!2H zOa0ELjfTR|zD!<3&2&gjG2eb}npI3HQ~&x70~I^j>&?Q_D=ZeU zA~%LBmmuaRjuPW9F@UzR&(}YMZuuQ*`>&=y71JhHV$|?tuy@bC!cGR?=e8y7m<0BG zo=PDFyUX?mPt98Uyf0d@Q?fDS#MitkHVZMf5JWk9!*1@grEK=4O!j0@Asx%tM8wot zVO}4MX{=~7>MfM)Dq}n&3~-prir6+D@q-lL zKKbWlq@4DE81#;lcXM2{0gAck7Y6XEE=haLdK|>@MSh;QzvQrsRheyuRWQuv6(BDr zpzTfGkzYlId}N8a(W1)6qR}AonB(y)kC$a4QY*ny<@}PX%FTI@A%e;x-e=#r-Cu8f zsMpymlqQ~6R$Y&Y>arK;%5WEDNYqq&c;u8lf{fXb65s!t6UF=ZZqC26{NGsr|J46K z6WSwXiQ+9ie_CRI84J zWVwVB`Q&)E3(|T3vr;tCwLfGpX{2+kyFnAQ*shl<2*Nz9zNLRI;i(WkPCZF-$m3x<#$wrfSZq z=;1_%eI~}z%br+cUH;fEJz2PpSMc5=yd*5Zti~m#v1Qb~H9lkL72+nt);G4mTlsym zF7kes1E?=utv`Au%gSB&YSh63Fn;~m{+qP}0zX$sy3+LOZvSBHBn$0!7(?Tek|{By zyENOsE|A(t8h$(P>v%uO>U@SkHYe~0!&@BsdfZU;+1!|t0g+O`?eP0|?>yR_IX=xH z>MPGPh*Pt+{iWZ_T3I-Ow#%x{a`RUO3$A)zWVL4mGAm37cqpkTfB4HS;bbL9G41nY`|hepF;{D-5mp0M3;jRD zW54;!=Q>CJfgiYCyX4>A3bV$R<%cAlKl?ESCTV?z4SmgNW=@mXH54@wcoSdlTgB~Y zKEh?P8F?2+K=@EAz7qGa0=w1U$%uJm8aX%_ejnlsV={=`y z2YW0G@k!`!Q}9OXsPS1IL9ghJ- z<<38DAT6EP8>Hj)xe_=80FOwL(C8lQ<_`leC~W?KWQf6g3hv4l-K_Tw)FHK}K~_w) zmnM=cRSMC`fruRtE$>XVcs4hxk+Bgh5VGz#xuO(2UC)nQFX7^{3UP=`wJ_CbYQ*8tN4BDDQ>XHbxmcG7dzp)4A~WHP5Vm+@({|!#IJ^&`iqF}nfu@#mL=1N+UtCT9hTB5 z=h-6~GqFf>d^zlfn-f$524HCb#%`&qB&hVoV$L(ceHQ_$7(ity5DQf^3^9!SfQ5%Q zVjYqeSl3`)?#u`_aB3fc1>dzwP~H99LLv>%Lz@Q>lU|a&MDGG=x~;H+LRwl;xe?m6=scg+RTsb8%l??lgf`_o!QW2 zooE{({UDn2BU46}UqgtQSYht_xWDdkf8G7}{^R|4|M7Xe-;c-p{r6%u0<8^*6rd!EmoW& zK>=df8%1FMi_-Rk>MqN(c^<+1YxaKnf4WiT3}nM_z53k~4+^1@S;wo{e&SghZW+H4 z=XuSd`#|kT5@zd=Lb~&4jZ-SYJT_@t{n*mmZE}qk2W|JUz(I zWM7y?KFotZCCiI!{UjnwIdb&du`Ak*8aDb~hYOXfQAN$?L(1Dmop zHx1TfU!T=qckvNSU884r-_Fi?zqPd4`soMrPn{vkukr`IjucBc3={1%RByBImeNsg z7r}!X#-O{gf75?$hyLxiL6``P(7KS5bI6s?1H?mhj*SK&O30fI0vTBxjiE5=i~WR^ zGr(d8n3!{_3ANy>9-R5@nSQ3+bz;&}J-iAj1k*!-S`J_O0S}b3w4dO^K`!Ow#B z<+Z^Vs9Z*+Y)AZsw4VvC;g|y1vG-Q_N!vG+M*!9PGOAg|HWJE^<@Vq--MfTt-=;1r zG5)3*%={)n|Bpm#w%_J^^#Mc(%j&gq>u61%YKe7Bju%R2G(c|Cy9e-IaN8i{kf;kp z7}BZdw1e(>Oh2ph#&C-1=5{{554;9H=_Q!VsCXxG6d47k&U{TAHEcHBKSRi>Hr%tL z1-a*<4t|e_17Dv1`+Y+43C{6-g{15C$*Q*4>}Ea$8h^ZlP^_9N?l62>ws?s|PQ$0Jz(L>Kz0ZwnUi*b)NvAaqxb3ePm zRJDJj=n}!gS0Qx`1x#V$4SyJH9z9AQZz%VEAu#JE%uu=>1|oZ7{Cdp0$jjfGE&i(P zsZvFgqQmhxD@l8A_VYB3laq(N=o$Q09tB#*hg?|`MfJIkZnLM#?1 zxBmL^x;I(cCaxH)ow~L1`MTC^O*mJ^mtkA392oU-o@jVdp^Z0_A#NR^T@95rm^s)b zcnsDmbm&>w&JR|!%I+$5*}018{*-Wwj8-Qjkf`EotE*!QrGdSV`9H_N|7+{vJ9PKT8k{V7BoXtOMbD$S56A*IXUyGLf(3D1f$K&p%ZOQta8OO0BK8ty2mP*E>)Arqr PVGKCvwli9htG#~#-VA*# literal 0 HcmV?d00001 diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md new file mode 100644 index 0000000000..0daa935fc1 --- /dev/null +++ b/education/windows/set-up-school-pcs-technical.md @@ -0,0 +1,112 @@ +--- +title: Set up School PCs app technical reference +description: Describes the changes that the app makes to a PC. +keywords: ["shared cart", "shared PC", "school"] +ms.prod: W10 +ms.mktglfcycl: plan +ms.sitesec: library +author: jdeckerMS +--- + +# Technical reference for the Set up School PCs app +**Applies to:** + +- Windows 10 Insider Preview + + +> [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] + +The Set up School PCs app helps you set up new computers running Windows 10, version 1607. + +If your school uses Azure Active Directory (Azure AD) or Office 365, the **Set up School PCs** app will create a setup file that connects the computer to your subscription. You can also use the app to set up school PCs that anyone can use, with or without Internet connectivity. + +The following table tells you what you get using the **Set up School PCs** app in your school. + +| Feature | No Internet | Azure AD | Office 365 | Azure AD Premium | +| --- | :---: | :---: | :---: | :---: | +| **Fast sign-in**
    Each student can sign in and start using the computer in less than a minute, even on their first sign-in. | X | X | X | X | +| **Custom Start experience**\*
    The apps students need are pinned to Start, and unncessary apps are removed. | X | X | X | X | +| **Temporary access, no sign-in required**
    This option sets up computers for common use. Anyone can use the computer without an account. | X | X | X | X | +| **School policies**\*
    Settings specific to education create a useful learning environment and the best computer performance. | X | X | X | X | +| **Azure AD Join**
    The computers are joined to your Azure AD or Office 365 subscription for centralized management. | | X | X | X | +| **Single sign-on to Office 365**
    By signing on with student IDs, students have fast access to Office 365 web apps. | | | X | X | +| **[Settings roaming](https://azure.microsoft.com/en-us/documentation/articles/active-directory-windows-enterprise-state-roaming-overview/) via Azure AD**
    Student user and application settings data can be synchronized across devices for a personalized experience. | | | | X | +| | | | | | +\* Feature applies to Windows 10 Pro for Education, Windows 10 Enterprise, and Windows 10 Enterprise for EDU + +> **Note**: If your school only uses traditional domains through Active Directory, [use Windows Imaging and Configuration Designer](set-up-students-pcs-to-join-domain.md) to configure your PCs. You can only use the Set up School PCs app to set up PCs that are not connected to your traditional domain. + +## Prerequisites for IT + +* If your school uses Azure AD, [configure your directory to allow devices to join](https://azure.microsoft.com/en-us/documentation/articles/active-directory-azureadjoin-setup/). If the teacher is going to set up a lot of devices, give her appropriate privileges or make a special account. +* Office 365, which includes online versions of Office apps plus 1 TB online storage and [Microsoft Classroom](https://classroom.microsoft.com/), is free for teachers and students. [Sign up your school for Office 365 Education.](https://products.office.com/en-us/academic/office-365-education-plan) +* If your school has an Office 365 Education subscription, it includes a free Azure AD subscription. [Register your free Azure AD subscription.](https://msdn.microsoft.com/en-us/library/windows/hardware/mt703369%28v=vs.85%29.aspx) +* After you set up your Office 365 Education tenant, use [Microsoft School Data Sync Preview](https://sis.microsoft.com/) to sync user profiles and class rosters from your Student Information System. + + +## Information about Windows Update + +It is the intent of the shared PC mode to always be up to date. If using the **Set up School PCs** app, Shared PC mode configures the power states and Windows Update to : +* Wake nightly +* Check and install updates +* Forcibly reboot if necessary to finish applying updates + +However, the PC is also configured to not interrupt the user during normal daytime hours with updates or reboots. + +## Guidance for accounts on shared PCs + +* On a Windows PC joined to Azure Active Directory + * By default, the account that joined the PC to AAD will have an admin account on that PC, and well as Global Administrators of the domain. + * With Azure AD Premium, which accounts have admin accounts on a PC can be specified via the Additional administrators on Azure AD Joined devices setting on the Azure portal. +* If shared PC mode with the account manager turned on is set up on a PC that is already in use, existing local accounts will not be deleted. However, all other local accounts created after Shared PC mode is turned on will automatically be deleted at sign off, including admin accounts. + * Ensure the PC is joined to a domain that enables accounts to be signed on as admin, or + * Create admin accounts before enabling Shared PC mode, or + * Create exempt accounts before signing off. +* The account management service supports accounts that are exempt from deletion. + * An account can be marked exempt from deletion by adding the account SID to the **HKEY_LOCAL_MACHINE\SOFTARE\Microsoft\Windows\CurrentVersion\SharedPC\Exemptions\** registry key. + * To add the account SID to the registry key using PowerShell: + * $adminName = "LocalAdmin" + * $adminPass = 'Pa$$word123' + * iex "net user /add $adminName $adminPass" + * $user = New-Object System.Security.Principal.NTAccount($adminName) + * $sid = $user.Translate([System.Security.Principal.SecurityIdentifier]) + * $sid = $sid.Value; + * New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\SharedPC\Exemptions\$sid" -Force +* It is recommended to not have any local admin accounts on the PC to improve the reliability and security of the PC. + + + +## Provisioning package details + +The **Set up School PCs** app produces a specialized provisioning package that makes use of the SharedPC configuration service provider (CSP). + + +* Uninstalled apps + * 3D Builder (Microsoft.3DBuilder_8wekyb3d8bbwe) + * ? (Microsoft.Appconnector_8wekyb3d8bbwe) + * Money (Microsoft.BingFinance_8wekyb3d8bbwe) + * News (Microsoft.BingNews_8wekyb3d8bbwe) + * Sports (Microsoft.BingSports_8wekyb3d8bbwe) + * Weather (Microsoft.BingWeather_8wekyb3d8bbwe) + * Phone dialer (Microsoft.CommsPhone_8wekyb3d8bbwe) + * ? (Microsoft.ConnectivityStore_8wekyb3d8bbwe) + * Get Started (Microsoft.Getstarted_8wekyb3d8bbwe) + * Microsoft Office Hub (Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe) + * Solitaire (Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe) + * Skype (Microsoft.SkypeApp_kzf8qxf38zg5c) + * ? (Microsoft.WindowsPhone_8wekyb3d8bbwe) + * Xbox (Microsoft.XboxApp_8wekyb3d8bbwe) + * Xbox (Microsoft.XboxIdentityProvider_8wekyb3d8bbwe) + * Groove (Microsoft.ZuneMusic_8wekyb3d8bbwe) + * Movies and TV (Microsoft.ZuneVideo_8wekyb3d8bbwe) + * Outlook Mail and Calendar (microsoft.windowscommunicationsapps_8wekyb3d8bbwe) +* Local Group Policies + +> **Important**: It is not recommended to set additional policies on PCs configured with the **Set up School PCs** app. The shared PC mode has been optimized to be fast and reliable over time with minimal to no manual maintenance required + + +

    Policy name

    Value

    When set

    Admin Templates>Control Panel>Personalization

    Prevent enabling lock screen slide show

    Enabled

    Always

    Do not display the lock screen

    Enabled

    Only on Windows 10 Pro for EDU, Enterprise, Enterprise for EDU

    Always

    Prevent changing lock screen and logon image

    Enabled

    Always

    Admin Templates>System>Power Management>Button Settings

    Select the Power button action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the Power button action (on battery)

    Sleep

    SetPowerPolicies=True

    Select the Sleep button action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the lid switch action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the lid switch action (on battery)

    Sleep

    SetPowerPolicies=True

    Admin Templates>System>Power Management>Sleep Settings

    Require a password when a computer wakes (plugged in)

    Enabled

    SignInOnResume = True

    Require a password when a computer wakes (on battery)

    Enabled

    SignInOnResume = True

    Specify the system sleep timeout (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Specify the system sleep timeout (on battery)

    SleepTimeout

    SetPowerPolicies=True

    Turn off hybrid sleep (plugged in)

    Enabled

    SetPowerPolicies=True

    Turn off hybrid sleep (on battery)

    Enabled

    SetPowerPolicies=True

    Specify the unattended sleep timeout (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Specify the unattended sleep timeout (on battery)

    SleepTimeout

    SetPowerPolicies=True

    Allow standby states (S1-S3) when sleeping (plugged in)

    Enabled

    SetPowerPolicies=True

    Allow standby states (S1-S3) when sleeping (on battery)

    Enabled

    SetPowerPolicies=True

    Specify the system hibernate timeout (plugged in)

    Enabled, 0

    SetPowerPolicies=True

    Specify the system hibernate timeout (on battery)

    Enabled, 0

    SetPowerPolicies=True

    Admin Templates > System > Power Management > Video and Display Settings

    Turn off the display (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Turn off the display (on battery

    SleepTimeout

    SetPowerPolicies=True

    Admin Templates > System > Logon

    Show first sign-in animation

    Disabled

    Always

    Hide entry points for Fast User Switching

    Enabled

    Always

    Turn on convenience PIN sign-in

    Disabled

    Always

    Turn off picture password sign-in

    Enabled

    Always

    Turn off app notification on the lock screen

    Enabled

    Always

    Allow users to select when a password is required when resuming from connected standby

    Disabled

    SignInOnResume = True

    Block user from showing account details on sign-in

    Enabled

    Always

    Admin Templates > System > User Profiles

    Turn off the advertising ID

    Enabled

    SetEduPolicies = True

    Admin Templates > Windows Components

    Do not show Windows Tips

    Enabled

    SetEduPolicies = True

    Turn off Microsoft consumer experiences

    Enabled

    SetEduPolicies = True

    Microsoft Passport for Work

    Disabled

    Always

    Prevent the usage of OneDrive for file storage

    Enabled

    Always

    Admin Templates > Windows Components > Biometrics

    Allow the use of biometrics

    Disabled

    Always

    Allow users to log on using biometrics

    Disabled

    Always

    Allow domain users to log on using biometrics

    Disabled

    Always

    Admin Templates > Windows Components > Data Collection and Preview Builds

    Toggle user control over Insider builds

    Disabled

    Always

    Disable pre-release features or settings

    Disabled

    Always

    Do not show feedback notifications

    Enabled

    Always

    Admin Templates > Windows Components > File Explorer

    Show lock in the user tile menu

    Disabled

    Always

    Admin Templates > Windows Components > Maintenance Scheduler

    Automatic Maintenance Activation Boundary

    MaintenanceStartTime

    Always

    Automatic Maintenance Random Delay

    Enabled, 2 hours

    Always

    Automatic Maintenance WakeUp Policy

    Enabled

    Always

    Admin Templates > Windows Components > Microsoft Edge

    Open a new tab with an empty tab

    Disabled

    SetEduPolicies = True

    Configure corporate home pages

    Enabled, about:blank

    SetEduPolicies = True

    Admin Templates > Windows Components > Search

    Allow Cortana

    Disabled

    SetEduPolicies = True

    Windows Settings > Security Settings > Local Policies > Security Options

    Interactive logon: Do not display last user name

    - Enabled

    - Disabled when account model is only guest

    Always

    Interactive logon: Sign-in last interactive user automatically after a system-initiated restart

    Disabled

    Always

    Shutdown: Allow system to be shut down without having to log on

    Disabled

    Always

    User Account Control: Behavior of the elevation prompt for standard users

    Auto deny

    Always

    + + + + diff --git a/education/windows/use-set-up-school-pcs-app.md b/education/windows/use-set-up-school-pcs-app.md index cca8ead346..28442ed89e 100644 --- a/education/windows/use-set-up-school-pcs-app.md +++ b/education/windows/use-set-up-school-pcs-app.md @@ -8,7 +8,7 @@ ms.sitesec: library author: jdeckerMS --- -# Use Set up School PCs app +# Use the Set up School PCs app **Applies to:** - Windows 10 Insider Preview @@ -16,4 +16,69 @@ author: jdeckerMS > [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] -placeholder +Teachers and IT administrators can use the **Set up School PCs** app to quickly set up computers for students. A computer set up using the app is tailored to provide students with the tools they need for learning while removing apps and features that they don't need. + +![Run app, turn on PC, insert USB key](images/app1.jpg) + +## What does this app do? + +The Set up School PCs app helps you set up new computers running Windows 10, version 1607. Some benefits of using this app to set up your students' PCs: +* A computer set up this way is tailored to provide students with the tools they need for learning while removing apps and features that they don't need. + * Places tiles for OneNote, Office 365 web apps, and Microsoft Classroom on the Start menu + * Installs OneDrive for cloud-based documents and places it on the Start menu and task bar + * Sets Microsoft Edge as the default browser + * Uninstalls apps not specific to education, such as Solitaire and Sports + * Turns off Offers and tips + * Prevents students from adding personal Microsoft accounts to the computer +* Significantly improves how fast a student's first sign-in happens. +* The app connects the PCs to your school’s cloud so IT can manage them. +* Windows 10 automatically manages accounts no matter how many students use the PC. +* Keeps computers up-to-date without interfering with class time using Windows Update and maintenance hours (by default, 12 AM). +* Customizes the sign-in screen to support students with IDs and temporary users. +* Automatically manages account profiles on shared computers to maintain performance +* Locks down the computer to prevent mischievous activity: + * Prevents students from installing apps + * Prevents students from removing the computer from the school's device management system + * Prevents students from removing the Set up School PCs settings + + +## Tips for success + +* **Run the app at work**: For the best results, run the **Set up School PCs** app on your work device connected to your school's network. That way the app can gather accurate information about your wireless networks and cloud subscriptions. +* **Apply to new computers**: The setup file that the **Set up School PCs** app creates should be used on new computers that haven't been set up for accounts yet. If you apply the setup file to a computer that has already been set up, existing accounts and data might be lost. +> **Warning**: Only use the setup file on computers that you want to configure and lock down for students. After you apply the setup file to a computer, the computer must be reset to remove the settings. +* **Turn on student PCs and stay on first screen**: The computer must be on this screen when you insert the USB key. + +![The first screen to set up a new PC](images/oobe.jpg) + +If you have gone past this screen, you may have to reset your PC to start over. To reset your PC after you have completed the first run experience, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**. +* **Use more than one USB key**: If you are setting up multiple PCs, you can set them up at the same time. Just run the **Set up School PCs** app again and save the same settings to another key. That way you can run set up on more than one PC at once. Create three keys and you can run it on three PCs at once, etc. +* **Start fresh**: If the PC has already been set up and you want to return to the first-run-experience to apply a new package, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**. +* **Keep it clean**: We strongly recommend that IT avoid changes to policies unless absolutely necessary, as any changes can impair performance and sign-in time. + +## Set up School PCs app step-by-step + +The setup file on your USB drive is named SetupSchoolPCs.ppkg, which is a provisioning package. A provisioning package is a method for applying settings to Windows 10. When Windows 10 refers to "package", it means your setup file, and when it refers to "provisioning", it means applying the setup file to the computer. + +1. Start with a computer on the first-run setup screen. + + ![The first screen to set up a new PC](images/oobe.jpg) + +2. Insert the USB drive. Windows Setup will recognize the drive and ask you if you want to set up the device. Select Set up. + + ![Set up device?](images/setupmsg.jpg) + +3. The next screen asks you to select a provisioning source. Select **Removable Media** and tap **Next**. + + ![Provision this device](images/prov.jpg) + +4. Read and accept the Microsoft Software License Terms. Your last step is to sign in. Use your Azure AD or Office 365 account and password. + + ![Sign in](images/signinprov.jpg) + +That's it! The computer is now ready for students. + +## Learn more + +See [The Set up School PCs app technical reference](set-up-school-pcs-technical.md) for prerequisites and provisioning details. + From d79f30b6b24a17cf44e8e49a5ec194029ea0b90d Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 13 May 2016 10:23:42 -0700 Subject: [PATCH 278/439] added new topic to toc/index --- education/windows/TOC.md | 1 + education/windows/index.md | 1 + 2 files changed, 2 insertions(+) diff --git a/education/windows/TOC.md b/education/windows/TOC.md index fa05afcd2e..f7d2916ea9 100644 --- a/education/windows/TOC.md +++ b/education/windows/TOC.md @@ -1,5 +1,6 @@ # [Windows 10 for education](index.md) ## [Use the Set up School PCs app](use-set-up-school-pcs-app.md) +## [Set up School PCs app technical reference](set-up-school-pcs-technical.md) ## [Set up students' PCs to join domain](set-up-students-pcs-to-join-domain.md) ## [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) ## [Chromebook migration guide](chromebook-migration-guide.md) \ No newline at end of file diff --git a/education/windows/index.md b/education/windows/index.md index 8fe3a1d3bf..a087ed8190 100644 --- a/education/windows/index.md +++ b/education/windows/index.md @@ -17,6 +17,7 @@ author: jdeckerMS |Topic |Description | |------|------------| |[Use Set up School PCs app](use-set-up-school-pcs-app.md) | Learn how to use the Set up School PCs app to quickly configure new Windows 10 PCs for students. | +| [Set up School PCs app technical reference](set-up-school-pcs-technical.md) | This topic provides prerequisites and provisioning details for using the **Set up School PCs** app. | | [Set up students' PCs to join domain](set-up-students-pcs-to-join-domain.md) | Learn how to create provisioning packages to easily configure student's PCs to join your Active Directory domain. | | [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) | Learn how to deploy Windows 10 in classrooms; integrate the school environment with Microsoft Office 365, Active Directory Domain Services (AD DS), and Microsoft Azure Active Directory (Azure AD); and deploy Windows 10 and your apps to new devices or upgrade existing devices to Windows 10. | | [Chromebook migration guide](chromebook-migration-guide.md) | Learn how to migrate a Google Chromebook-based learning environment to a Windows 10-based learning environment. | From de6e7c4f0c9a8f78ab40edbdb4069329e6e445af Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 13 May 2016 10:43:27 -0700 Subject: [PATCH 279/439] tweak --- education/windows/set-up-school-pcs-technical.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index 0daa935fc1..87f8828344 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -38,7 +38,7 @@ The following table tells you what you get using the **Set up School PCs** app i ## Prerequisites for IT -* If your school uses Azure AD, [configure your directory to allow devices to join](https://azure.microsoft.com/en-us/documentation/articles/active-directory-azureadjoin-setup/). If the teacher is going to set up a lot of devices, give her appropriate privileges or make a special account. +* If your school uses Azure AD, [configure your directory to allow devices to join](https://azure.microsoft.com/en-us/documentation/articles/active-directory-azureadjoin-setup/). If the teacher is going to set up a lot of devices, give her appropriate privileges for joining devices or make a special account. * Office 365, which includes online versions of Office apps plus 1 TB online storage and [Microsoft Classroom](https://classroom.microsoft.com/), is free for teachers and students. [Sign up your school for Office 365 Education.](https://products.office.com/en-us/academic/office-365-education-plan) * If your school has an Office 365 Education subscription, it includes a free Azure AD subscription. [Register your free Azure AD subscription.](https://msdn.microsoft.com/en-us/library/windows/hardware/mt703369%28v=vs.85%29.aspx) * After you set up your Office 365 Education tenant, use [Microsoft School Data Sync Preview](https://sis.microsoft.com/) to sync user profiles and class rosters from your Student Information System. From cfaa3f09c79802cd7db16b89eddb6d703b5193b6 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 13 May 2016 10:51:08 -0700 Subject: [PATCH 280/439] troubleshooting: removed table --- education/windows/set-up-school-pcs-technical.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index 87f8828344..bcf70ec786 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -105,7 +105,7 @@ The **Set up School PCs** app produces a specialized provisioning package that m > **Important**: It is not recommended to set additional policies on PCs configured with the **Set up School PCs** app. The shared PC mode has been optimized to be fast and reliable over time with minimal to no manual maintenance required -

    Policy name

    Value

    When set

    Admin Templates>Control Panel>Personalization

    Prevent enabling lock screen slide show

    Enabled

    Always

    Do not display the lock screen

    Enabled

    Only on Windows 10 Pro for EDU, Enterprise, Enterprise for EDU

    Always

    Prevent changing lock screen and logon image

    Enabled

    Always

    Admin Templates>System>Power Management>Button Settings

    Select the Power button action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the Power button action (on battery)

    Sleep

    SetPowerPolicies=True

    Select the Sleep button action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the lid switch action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the lid switch action (on battery)

    Sleep

    SetPowerPolicies=True

    Admin Templates>System>Power Management>Sleep Settings

    Require a password when a computer wakes (plugged in)

    Enabled

    SignInOnResume = True

    Require a password when a computer wakes (on battery)

    Enabled

    SignInOnResume = True

    Specify the system sleep timeout (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Specify the system sleep timeout (on battery)

    SleepTimeout

    SetPowerPolicies=True

    Turn off hybrid sleep (plugged in)

    Enabled

    SetPowerPolicies=True

    Turn off hybrid sleep (on battery)

    Enabled

    SetPowerPolicies=True

    Specify the unattended sleep timeout (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Specify the unattended sleep timeout (on battery)

    SleepTimeout

    SetPowerPolicies=True

    Allow standby states (S1-S3) when sleeping (plugged in)

    Enabled

    SetPowerPolicies=True

    Allow standby states (S1-S3) when sleeping (on battery)

    Enabled

    SetPowerPolicies=True

    Specify the system hibernate timeout (plugged in)

    Enabled, 0

    SetPowerPolicies=True

    Specify the system hibernate timeout (on battery)

    Enabled, 0

    SetPowerPolicies=True

    Admin Templates > System > Power Management > Video and Display Settings

    Turn off the display (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Turn off the display (on battery

    SleepTimeout

    SetPowerPolicies=True

    Admin Templates > System > Logon

    Show first sign-in animation

    Disabled

    Always

    Hide entry points for Fast User Switching

    Enabled

    Always

    Turn on convenience PIN sign-in

    Disabled

    Always

    Turn off picture password sign-in

    Enabled

    Always

    Turn off app notification on the lock screen

    Enabled

    Always

    Allow users to select when a password is required when resuming from connected standby

    Disabled

    SignInOnResume = True

    Block user from showing account details on sign-in

    Enabled

    Always

    Admin Templates > System > User Profiles

    Turn off the advertising ID

    Enabled

    SetEduPolicies = True

    Admin Templates > Windows Components

    Do not show Windows Tips

    Enabled

    SetEduPolicies = True

    Turn off Microsoft consumer experiences

    Enabled

    SetEduPolicies = True

    Microsoft Passport for Work

    Disabled

    Always

    Prevent the usage of OneDrive for file storage

    Enabled

    Always

    Admin Templates > Windows Components > Biometrics

    Allow the use of biometrics

    Disabled

    Always

    Allow users to log on using biometrics

    Disabled

    Always

    Allow domain users to log on using biometrics

    Disabled

    Always

    Admin Templates > Windows Components > Data Collection and Preview Builds

    Toggle user control over Insider builds

    Disabled

    Always

    Disable pre-release features or settings

    Disabled

    Always

    Do not show feedback notifications

    Enabled

    Always

    Admin Templates > Windows Components > File Explorer

    Show lock in the user tile menu

    Disabled

    Always

    Admin Templates > Windows Components > Maintenance Scheduler

    Automatic Maintenance Activation Boundary

    MaintenanceStartTime

    Always

    Automatic Maintenance Random Delay

    Enabled, 2 hours

    Always

    Automatic Maintenance WakeUp Policy

    Enabled

    Always

    Admin Templates > Windows Components > Microsoft Edge

    Open a new tab with an empty tab

    Disabled

    SetEduPolicies = True

    Configure corporate home pages

    Enabled, about:blank

    SetEduPolicies = True

    Admin Templates > Windows Components > Search

    Allow Cortana

    Disabled

    SetEduPolicies = True

    Windows Settings > Security Settings > Local Policies > Security Options

    Interactive logon: Do not display last user name

    - Enabled

    - Disabled when account model is only guest

    Always

    Interactive logon: Sign-in last interactive user automatically after a system-initiated restart

    Disabled

    Always

    Shutdown: Allow system to be shut down without having to log on

    Disabled

    Always

    User Account Control: Behavior of the elevation prompt for standard users

    Auto deny

    Always

    + From 5f2e84640e025ab7b70b260eef25af58728e5ac0 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 13 May 2016 11:06:47 -0700 Subject: [PATCH 281/439] add table back with changes --- .../windows/set-up-school-pcs-technical.md | 127 +++++++++++++++++- 1 file changed, 126 insertions(+), 1 deletion(-) diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index bcf70ec786..ada85a2a86 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -105,7 +105,132 @@ The **Set up School PCs** app produces a specialized provisioning package that m > **Important**: It is not recommended to set additional policies on PCs configured with the **Set up School PCs** app. The shared PC mode has been optimized to be fast and reliable over time with minimal to no manual maintenance required - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Policy name

    Value

    When set

    Admin Templates>Control Panel>Personalization

    Prevent enabling lock screen slide show

    Enabled

    Always

    Do not display the lock screen

    Enabled

    Only on Windows 10 Pro for EDU, Enterprise, Enterprise for EDU

    Always

    Prevent changing lock screen and logon image

    Enabled

    Always

    Admin Templates>System>Power Management>Button Settings

    Select the Power button action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the Power button action (on battery)

    Sleep

    SetPowerPolicies=True

    Select the Sleep button action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the lid switch action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the lid switch action (on battery)

    Sleep

    SetPowerPolicies=True

    Admin Templates>System>Power Management>Sleep Settings

    Require a password when a computer wakes (plugged in)

    Enabled

    SignInOnResume = True

    Require a password when a computer wakes (on battery)

    Enabled

    SignInOnResume = True

    Specify the system sleep timeout (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Specify the system sleep timeout (on battery)

    SleepTimeout

    SetPowerPolicies=True

    Turn off hybrid sleep (plugged in)

    Enabled

    SetPowerPolicies=True

    Turn off hybrid sleep (on battery)

    Enabled

    SetPowerPolicies=True

    Specify the unattended sleep timeout (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Specify the unattended sleep timeout (on battery)

    SleepTimeout

    SetPowerPolicies=True

    Allow standby states (S1-S3) when sleeping (plugged in)

    Enabled

    SetPowerPolicies=True

    Allow standby states (S1-S3) when sleeping (on battery)

    Enabled

    SetPowerPolicies=True

    Specify the system hibernate timeout (plugged in)

    Enabled, 0

    SetPowerPolicies=True

    Specify the system hibernate timeout (on battery)

    Enabled, 0

    SetPowerPolicies=True

    Admin Templates > System > Power Management > Video and Display Settings

    Turn off the display (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Turn off the display (on battery

    SleepTimeout

    SetPowerPolicies=True

    Admin Templates > System > Logon

    Show first sign-in animation

    Disabled

    Always

    Hide entry points for Fast User Switching

    Enabled

    Always

    Turn on convenience PIN sign-in

    Disabled

    Always

    Turn off picture password sign-in

    Enabled

    Always

    Turn off app notification on the lock screen

    Enabled

    Always

    Allow users to select when a password is required when resuming from connected standby

    Disabled

    SignInOnResume = True

    Block user from showing account details on sign-in

    Enabled

    Always

    Admin Templates > System > User Profiles

    Turn off the advertising ID

    Enabled

    SetEduPolicies = True

    Admin Templates > Windows Components

    Do not show Windows Tips

    Enabled

    SetEduPolicies = True

    Turn off Microsoft consumer experiences

    Enabled

    SetEduPolicies = True

    Microsoft Passport for Work

    Disabled

    Always

    Prevent the usage of OneDrive for file storage

    Enabled

    Always

    Admin Templates > Windows Components > Biometrics

    Allow the use of biometrics

    Disabled

    Always

    Allow users to log on using biometrics

    Disabled

    Always

    Allow domain users to log on using biometrics

    Disabled

    Always

    Admin Templates > Windows Components > Data Collection and Preview Builds

    Toggle user control over Insider builds

    Disabled

    Always

    Disable pre-release features or settings

    Disabled

    Always

    Do not show feedback notifications

    Enabled

    Always

    Admin Templates > Windows Components > File Explorer

    Show lock in the user tile menu

    Disabled

    Always

    Admin Templates > Windows Components > Maintenance Scheduler

    Automatic Maintenance Activation Boundary

    MaintenanceStartTime

    Always

    Automatic Maintenance Random Delay

    Enabled, 2 hours

    Always

    Automatic Maintenance WakeUp Policy

    Enabled

    Always

    Admin Templates > Windows Components > Microsoft Edge

    Open a new tab with an empty tab

    Disabled

    SetEduPolicies = True

    Configure corporate home pages

    Enabled, about:blank

    SetEduPolicies = True

    Admin Templates > Windows Components > Search

    Allow Cortana

    Disabled

    SetEduPolicies = True

    Windows Settings > Security Settings > Local Policies > Security Options

    Interactive logon: Do not display last user name

    - Enabled

    - Disabled when account model is only guest

    Always

    Interactive logon: Sign-in last interactive user automatically after a system-initiated restart

    Disabled

    Always

    Shutdown: Allow system to be shut down without having to log on

    Disabled

    Always

    User Account Control: Behavior of the elevation prompt for standard users

    Auto deny

    Always

    From 814d15e57c6a407c865dd939f762ae9baab7e339 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 13 May 2016 11:24:09 -0700 Subject: [PATCH 282/439] replaced > --- .../windows/set-up-school-pcs-technical.md | 28 +++++++++---------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index ada85a2a86..91f46eb988 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -109,7 +109,7 @@ The **Set up School PCs** app produces a specialized provisioning package that m

    Policy name

    Value

    When set

    -

    Admin Templates>Control Panel>Personalization

    +

    Admin Templates > Control Panel > Personalization

    Prevent enabling lock screen slide show

    Enabled

    Always

    @@ -117,7 +117,7 @@ The **Set up School PCs** app produces a specialized provisioning package that m

    Prevent changing lock screen and logon image

    Enabled

    Always

    -

    Admin Templates>System>Power Management>Button Settings

    +

    Admin Templates > System > Power Management > Button Settings

    Select the Power button action (plugged in)

    Sleep

    SetPowerPolicies=True

    @@ -129,7 +129,7 @@ The **Set up School PCs** app produces a specialized provisioning package that m

    Select the lid switch action (on battery)

    Sleep

    SetPowerPolicies=True

    -

    Admin Templates>System>Power Management>Sleep Settings

    +

    Admin Templates > System > Power Management > Sleep Settings

    Require a password when a computer wakes (plugged in)

    Enabled

    SignInOnResume = True

    @@ -151,10 +151,10 @@ The **Set up School PCs** app produces a specialized provisioning package that m

    Specify the system hibernate timeout (plugged in)

    Enabled, 0

    SetPowerPolicies=True

    -

    Specify the system hibernate timeout (on battery)

    Enabled, 0

    SetPowerPolicies=True

    Admin Templates > System > Power Management > Video and Display Settings

    +

    Specify the system hibernate timeout (on battery)

    Enabled, 0

    SetPowerPolicies=True

    Admin Templates > System > Power Management > Video and Display Settings

    Turn off the display (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Turn off the display (on battery

    SleepTimeout

    SetPowerPolicies=True

    -

    Admin Templates > System > Logon

    +

    Admin Templates > System > Logon

    Show first sign-in animation

    Disabled

    Always

    @@ -168,11 +168,11 @@ The **Set up School PCs** app produces a specialized provisioning package that m

    Block user from showing account details on sign-in

    Enabled

    Always

    -

    Admin Templates > System > User Profiles

    +

    Admin Templates > System > User Profiles

    Turn off the advertising ID

    Enabled

    SetEduPolicies = True

    -

    Admin Templates > Windows Components

    +

    Admin Templates > Windows Components

    Do not show Windows Tips

    Enabled

    SetEduPolicies = True

    @@ -182,7 +182,7 @@ The **Set up School PCs** app produces a specialized provisioning package that m

    Prevent the usage of OneDrive for file storage

    Enabled

    Always

    -

    Admin Templates > Windows Components > Biometrics

    +

    Admin Templates > Windows Components > Biometrics

    Allow the use of biometrics

    Disabled

    Always

    @@ -190,7 +190,7 @@ The **Set up School PCs** app produces a specialized provisioning package that m

    Allow domain users to log on using biometrics

    Disabled

    Always

    -

    Admin Templates > Windows Components > Data Collection and Preview Builds

    +

    Admin Templates > Windows Components > Data Collection and Preview Builds

    Toggle user control over Insider builds

    Disabled

    Always

    @@ -198,11 +198,11 @@ The **Set up School PCs** app produces a specialized provisioning package that m

    Do not show feedback notifications

    Enabled

    Always

    -

    Admin Templates > Windows Components > File Explorer

    +

    Admin Templates > Windows Components > File Explorer

    Show lock in the user tile menu

    Disabled

    Always

    -

    Admin Templates > Windows Components > Maintenance Scheduler

    +

    Admin Templates > Windows Components > Maintenance Scheduler

    Automatic Maintenance Activation Boundary

    MaintenanceStartTime

    Always

    @@ -210,17 +210,17 @@ The **Set up School PCs** app produces a specialized provisioning package that m

    Automatic Maintenance WakeUp Policy

    Enabled

    Always

    -

    Admin Templates > Windows Components > Microsoft Edge

    +

    Admin Templates > Windows Components > Microsoft Edge

    Open a new tab with an empty tab

    Disabled

    SetEduPolicies = True

    Configure corporate home pages

    Enabled, about:blank

    SetEduPolicies = True

    -

    Admin Templates > Windows Components > Search

    +

    Admin Templates > Windows Components > Search

    Allow Cortana

    Disabled

    SetEduPolicies = True

    -

    Windows Settings > Security Settings > Local Policies > Security Options

    +

    Windows Settings > Security Settings > Local Policies > Security Options

    Interactive logon: Do not display last user name

    - Enabled

    - Disabled when account model is only guest

    Always

    From c11e3cd5d6dcf12b492f45ea2b2e9087d4b27ff2 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 13 May 2016 11:40:12 -0700 Subject: [PATCH 283/439] tweak table --- .../windows/set-up-school-pcs-technical.md | 257 +++++++++++++----- 1 file changed, 192 insertions(+), 65 deletions(-) diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index 91f46eb988..3de8d5b795 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -105,131 +105,258 @@ The **Set up School PCs** app produces a specialized provisioning package that m > **Important**: It is not recommended to set additional policies on PCs configured with the **Set up School PCs** app. The shared PC mode has been optimized to be fast and reliable over time with minimal to no manual maintenance required - - - +

    Policy name

    Value

    When set

    + + + + + - + - + - + - + - + - + - + - + - + - + - + - - - + - + - + - + - + - - - + + + - + - + - - + + - + - + + + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - - + +

    Policy name

    Value

    When set

    Admin Templates > Control Panel > + +Personalization

    Admin Templates > Control Panel > Personalization

    Prevent enabling lock screen slide show

    Enabled

    Always

    Prevent enabling lock screen slide show

    Enabled

    Always

    Do not display the lock screen

    Enabled

    Only on Windows 10 Pro for EDU, Enterprise, + +Enterprise for EDU

    Always

    Do not display the lock screen

    Enabled

    Only on Windows 10 Pro for EDU, Enterprise, Enterprise for EDU

    Always

    Prevent changing lock screen and logon image

    Enabled

    Always

    Prevent changing lock screen and logon image

    Enabled

    Always

    Admin Templates > System > Power Management > + +Button Settings

    Admin Templates > System > Power Management > Button Settings

    Select the Power button action (plugged in)

    Sleep

    + +SetPowerPolicies=True

    Select the Power button action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the Power button action (on battery)

    Sleep

    SetPowerPolicies=True

    Select the Power button action (on battery)

    Sleep

    SetPowerPolicies=True

    Select the Sleep button action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the Sleep button action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the lid switch action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the lid switch action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the lid switch action (on battery)

    Sleep

    SetPowerPolicies=True

    Select the lid switch action (on battery)

    Sleep

    SetPowerPolicies=True

    Admin Templates > System > Power Management > + +Sleep Settings

    Admin Templates > System > Power Management > Sleep Settings

    Require a password when a computer wakes (plugged in)

    Enabled

    SignInOnResume = True

    Require a password when a computer wakes (plugged in)

    Enabled

    SignInOnResume = True

    Require a password when a computer wakes (on battery)

    Enabled

    SignInOnResume = True

    Require a password when a computer wakes (on battery)

    Enabled

    SignInOnResume = True

    Specify the system sleep timeout (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Specify the system sleep timeout (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Specify the system sleep timeout (on battery)

    SleepTimeout

    SetPowerPolicies=True

    Specify the system sleep timeout (on battery)

    SleepTimeout

    SetPowerPolicies=True

    Turn off hybrid sleep (plugged in)

    Enabled

    SetPowerPolicies=True

    Turn off hybrid sleep (plugged in)

    Enabled

    + +SetPowerPolicies=True

    Turn off hybrid sleep (on battery)

    Enabled

    SetPowerPolicies=True

    Turn off hybrid sleep (on battery)

    Enabled

    + +SetPowerPolicies=True

    Specify the unattended sleep timeout (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Specify the unattended sleep timeout (on battery)

    SleepTimeout

    SetPowerPolicies=True

    Allow standby states (S1-S3) when sleeping (plugged in)

    Enabled

    SetPowerPolicies=True

    Specify the unattended sleep timeout (plugged in)

    SleepTimeout

    + +

    SetPowerPolicies=True

    Specify the unattended sleep timeout (on battery)

    SleepTimeout

    + +

    SetPowerPolicies=True

    Allow standby states (S1-S3) when sleeping (plugged in)

    Enabled

    SetPowerPolicies=True

    Allow standby states (S1-S3) when sleeping (on battery)

    Enabled

    SetPowerPolicies=True

    Allow standby states (S1-S3) when sleeping (on battery)

    Enabled

    SetPowerPolicies=True

    Specify the system hibernate timeout (plugged in)

    Enabled, 0

    SetPowerPolicies=True

    Specify the system hibernate timeout (plugged in)

    Enabled, 0

    SetPowerPolicies=True

    Specify the system hibernate timeout (on battery)

    Enabled, 0

    SetPowerPolicies=True

    Admin Templates > System > Power Management > Video and Display Settings

    Turn off the display (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Turn off the display (on battery

    SleepTimeout

    SetPowerPolicies=True

    Specify the system hibernate timeout (on battery)

    Enabled, 0

    SetPowerPolicies=True

    Admin Templates > + +System > Power Management > Video and Display Settings

    Turn off the display (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Turn off the display (on battery

    SleepTimeout

    SetPowerPolicies=True

    Admin Templates > System > Logon

    Show first sign-in animation

    Disabled

    Always

    Show first sign-in animation

    Disabled

    Always + +

    Hide entry points for Fast User Switching

    Enabled

    Always

    Turn on convenience PIN sign-in

    Disabled

    Always

    Hide entry points for Fast User Switching

    Enabled

    + +

    Always

    Turn on convenience PIN sign-in

    Disabled

    Always

    Turn off picture password sign-in

    Enabled

    Always

    Turn off picture password sign-in

    Enabled

    Always + +

    Turn off app notification on the lock screen

    Enabled

    Always

    Turn off app notification on the lock screen

    Enabled

    + +

    Always

    Allow users to select when a password is required when resuming from connected standby

    Disabled

    SignInOnResume = True

    Allow users to select when a password is required when resuming from connected standby

    Disabled

    SignInOnResume = True

    Block user from showing account details on sign-in

    Enabled

    Always

    Block user from showing account details on sign-in

    Enabled

    Always

    Admin Templates > System > User Profiles

    Admin Templates > System > User Profiles

    + +

    Turn off the advertising ID

    Enabled

    SetEduPolicies = True

    Turn off the advertising ID

    Enabled

    + +SetEduPolicies = True

    Admin Templates > Windows Components

    Do not show Windows Tips

    Enabled

    SetEduPolicies = True

    Do not show Windows Tips

    Enabled

    SetEduPolicies + += True

    Turn off Microsoft consumer experiences

    Enabled

    SetEduPolicies = True

    Turn off Microsoft consumer experiences

    Enabled

    + +SetEduPolicies = True

    Microsoft Passport for Work

    Disabled

    Always

    Microsoft Passport for Work

    Disabled

    Always

    + +

    Prevent the usage of OneDrive for file storage

    Enabled

    Always

    Prevent the usage of OneDrive for file storage

    Enabled

    Always

    Admin Templates > Windows Components > Biometrics

    Admin Templates > Windows Components > + +Biometrics

    Allow the use of biometrics

    Disabled

    Always

    Allow the use of biometrics

    Disabled

    Always

    + +

    Allow users to log on using biometrics

    Disabled

    Always

    Allow users to log on using biometrics

    Disabled

    + +Always

    Allow domain users to log on using biometrics

    Disabled

    Always

    Allow domain users to log on using biometrics

    Disabled

    Always

    Admin Templates > Windows Components > Data Collection and Preview Builds

    Admin Templates > Windows Components > Data Collection + +and Preview Builds

    Toggle user control over Insider builds

    Disabled

    Always

    Toggle user control over Insider builds

    Disabled

    + +Always

    Disable pre-release features or settings

    Disabled

    Always

    Disable pre-release features or settings

    Disabled

    + +

    Always

    Do not show feedback notifications

    Enabled

    Always

    Do not show feedback notifications

    Enabled

    + +Always

    Admin Templates > Windows Components > File Explorer

    Admin Templates > Windows Components > File + +Explorer

    Show lock in the user tile menu

    Disabled

    Always

    Show lock in the user tile menu

    Disabled

    Always + +

    Admin Templates > Windows Components > Maintenance Scheduler

    Admin Templates > Windows Components > Maintenance + +Scheduler

    Automatic Maintenance Activation Boundary

    MaintenanceStartTime

    Always

    Automatic Maintenance Activation Boundary

    MaintenanceStartTime

    + +

    Always

    Automatic Maintenance Random Delay

    Enabled, 2 hours

    Always

    Automatic Maintenance Random Delay

    Enabled, 2 hours

    + +

    Always

    Automatic Maintenance WakeUp Policy

    Enabled

    Always

    Automatic Maintenance WakeUp Policy

    Enabled

    + +Always

    Admin Templates > Windows Components > Microsoft Edge

    Admin Templates > Windows Components > Microsoft + +Edge

    Open a new tab with an empty tab

    Disabled

    SetEduPolicies = True

    Open a new tab with an empty tab

    Disabled

    + +SetEduPolicies = True

    Configure corporate home pages

    Enabled, about:blank

    SetEduPolicies = True

    Configure corporate home pages

    Enabled, about:blank

    + +

    SetEduPolicies = True

    Admin Templates > Windows Components > Search

    Admin Templates > Windows Components > Search + +

    Allow Cortana

    Disabled

    SetEduPolicies = True

    Allow Cortana

    Disabled

    SetEduPolicies = True + +

    Windows Settings > Security Settings > Local Policies > Security Options

    Windows Settings > Security Settings > Local + +Policies > Security Options

    Interactive logon: Do not display last user name

    - Enabled

    - Disabled when account model is only guest

    Always

    Interactive logon: Do not display last user name

    - Enabled

    - Disabled + +when account model is only guest

    Always

    Interactive logon: Sign-in last interactive user automatically after a system-initiated restart

    Disabled

    Always

    Interactive logon: Sign-in last interactive user automatically after a system-initiated restart

    Disabled

    Always

    Shutdown: Allow system to be shut down without having to log on

    Disabled

    Always

    Shutdown: Allow system to be shut down without having to log on

    Disabled

    + +

    Always

    User Account Control: Behavior of the elevation prompt for standard users

    Auto deny

    Always

    User Account Control: Behavior of the elevation prompt for standard users

    Auto + +deny

    Always

    From d4437d493a2d14dd4fc5444f8bed33ea9d819f0b Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 13 May 2016 12:04:17 -0700 Subject: [PATCH 284/439] more tweaks --- .../windows/set-up-school-pcs-technical.md | 256 +++++------------- 1 file changed, 69 insertions(+), 187 deletions(-) diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index 3de8d5b795..838d77ff92 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -106,256 +106,138 @@ The **Set up School PCs** app produces a specialized provisioning package that m - - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - - - + - + - + - - + + + + + + + + + + + - + - - - + - + - + - + - + - + - + + + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - +

    Policy name

    Value

    When set

    Admin Templates > Control Panel > - -Personalization

    Admin Templates > Control Panel > Personalization

    Prevent enabling lock screen slide show

    Enabled

    Always

    Prevent enabling lock screen slide show

    Enabled

    Always

    Do not display the lock screen

    Enabled

    Only on Windows 10 Pro for EDU, Enterprise, - -Enterprise for EDU

    Always

    Do not display the lock screen

    Enabled

    Only on Windows 10 Pro for EDU, Enterprise, Enterprise for EDU

    Always

    Prevent changing lock screen and logon image

    Enabled

    Always

    Prevent changing lock screen and logon image

    Enabled

    Always

    Admin Templates > System > Power Management > - -Button Settings

    Admin Templates > System > Power Management > Button Settings

    Select the Power button action (plugged in)

    Sleep

    - -SetPowerPolicies=True

    Select the Power button action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the Power button action (on battery)

    Sleep

    SetPowerPolicies=True

    Select the Power button action (on battery)

    Sleep

    SetPowerPolicies=True

    Select the Sleep button action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the Sleep button action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the lid switch action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the lid switch action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the lid switch action (on battery)

    Sleep

    SetPowerPolicies=True

    Select the lid switch action (on battery)

    Sleep

    SetPowerPolicies=True

    Admin Templates > System > Power Management > - -Sleep Settings

    Admin Templates > System > Power Management > Sleep Settings

    Require a password when a computer wakes (plugged in)

    Enabled

    SignInOnResume = True

    Require a password when a computer wakes (plugged in)

    Enabled

    SignInOnResume = True

    Require a password when a computer wakes (on battery)

    Enabled

    SignInOnResume = True

    Require a password when a computer wakes (on battery)

    Enabled

    SignInOnResume = True

    Specify the system sleep timeout (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Specify the system sleep timeout (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Specify the system sleep timeout (on battery)

    SleepTimeout

    SetPowerPolicies=True

    Specify the system sleep timeout (on battery)

    SleepTimeout

    SetPowerPolicies=True

    Turn off hybrid sleep (plugged in)

    Enabled

    - -SetPowerPolicies=True

    Turn off hybrid sleep (plugged in)

    Enabled

    SetPowerPolicies=True

    Turn off hybrid sleep (on battery)

    Enabled

    - -SetPowerPolicies=True

    Turn off hybrid sleep (on battery)

    Enabled

    SetPowerPolicies=True

    Specify the unattended sleep timeout (plugged in)

    SleepTimeout

    - -

    SetPowerPolicies=True

    Specify the unattended sleep timeout (on battery)

    SleepTimeout

    - -

    SetPowerPolicies=True

    Allow standby states (S1-S3) when sleeping (plugged in)

    Enabled

    SetPowerPolicies=True

    Specify the unattended sleep timeout (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Allow standby states (S1-S3) when sleeping (on battery)

    Enabled

    SetPowerPolicies=True

    Specify the unattended sleep timeout (on battery)

    SleepTimeout

    SetPowerPolicies=True

    Specify the system hibernate timeout (plugged in)

    Enabled, 0

    SetPowerPolicies=True

    Allow standby states (S1-S3) when sleeping (plugged in)

    Enabled

    SetPowerPolicies=True

    Specify the system hibernate timeout (on battery)

    Enabled, 0

    SetPowerPolicies=True

    Admin Templates > - -System > Power Management > Video and Display Settings

    Turn off the display (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Turn off the display (on battery

    SleepTimeout

    SetPowerPolicies=True

    Allow standby states (S1-S3) when sleeping (on battery)

    Enabled

    SetPowerPolicies=True

    Specify the system hibernate timeout (plugged in)

    Enabled, 0

    SetPowerPolicies=True

    Specify the system hibernate timeout (on battery)

    Enabled, 0

    SetPowerPolicies=True

    Admin Templates > System > Power Management > Video and Display Settings

    Turn off the display (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Turn off the display (on battery

    SleepTimeout

    SetPowerPolicies=True

    Admin Templates > System > Logon

    Show first sign-in animation

    Disabled

    Always - -

    Show first sign-in animation

    Disabled

    Always

    Hide entry points for Fast User Switching

    Enabled

    - -

    Always

    Turn on convenience PIN sign-in

    Disabled

    Always

    Hide entry points for Fast User Switching

    Enabled

    Always

    Turn off picture password sign-in

    Enabled

    Always - -

    Turn on convenience PIN sign-in

    Disabled

    Always

    Turn off app notification on the lock screen

    Enabled

    - -

    Always

    Turn off picture password sign-in

    Enabled

    Always

    Allow users to select when a password is required when resuming from connected standby

    Disabled

    SignInOnResume = True

    Turn off app notification on the lock screen

    Enabled

    Always

    Block user from showing account details on sign-in

    Enabled

    Always

    Allow users to select when a password is required when resuming from connected standby

    Disabled

    SignInOnResume = True

    Admin Templates > System > User Profiles

    - -

    Block user from showing account details on sign-in

    Enabled

    Always

    Turn off the advertising ID

    Enabled

    - -SetEduPolicies = True

    Admin Templates > System > User Profiles

    Turn off the advertising ID

    Enabled

    SetEduPolicies = True

    Admin Templates > Windows Components

    Do not show Windows Tips

    Enabled

    SetEduPolicies - -= True

    Do not show Windows Tips

    Enabled

    SetEduPolicies = True

    Turn off Microsoft consumer experiences

    Enabled

    - -SetEduPolicies = True

    Turn off Microsoft consumer experiences

    Enabled

    SetEduPolicies = True

    Microsoft Passport for Work

    Disabled

    Always

    - -

    Microsoft Passport for Work

    Disabled

    Always

    Prevent the usage of OneDrive for file storage

    Enabled

    Always

    Prevent the usage of OneDrive for file storage

    Enabled

    Always

    Admin Templates > Windows Components > - -Biometrics

    Admin Templates > Windows Components > Biometrics

    Allow the use of biometrics

    Disabled

    Always

    - -

    Allow the use of biometrics

    Disabled

    Always

    Allow users to log on using biometrics

    Disabled

    - -Always

    Allow users to log on using biometrics

    Disabled

    Always

    Allow domain users to log on using biometrics

    Disabled

    Always

    Allow domain users to log on using biometrics

    Disabled

    Always

    Admin Templates > Windows Components > Data Collection - -and Preview Builds

    Admin Templates > Windows Components > Data Collection and Preview Builds

    Toggle user control over Insider builds

    Disabled

    - -Always

    Toggle user control over Insider builds

    Disabled

    Always

    Disable pre-release features or settings

    Disabled

    - -

    Always

    Disable pre-release features or settings

    Disabled

    Always

    Do not show feedback notifications

    Enabled

    - -Always

    Do not show feedback notifications

    Enabled

    Always

    Admin Templates > Windows Components > File - -Explorer

    Admin Templates > Windows Components > File Explorer

    Show lock in the user tile menu

    Disabled

    Always - -

    Show lock in the user tile menu

    Disabled

    Always

    Admin Templates > Windows Components > Maintenance - -Scheduler

    Admin Templates > Windows Components > Maintenance Scheduler

    Automatic Maintenance Activation Boundary

    MaintenanceStartTime

    - -

    Always

    Automatic Maintenance Activation Boundary

    MaintenanceStartTime

    Always

    Automatic Maintenance Random Delay

    Enabled, 2 hours

    - -

    Always

    Automatic Maintenance Random Delay

    Enabled, 2 hours

    Always

    Automatic Maintenance WakeUp Policy

    Enabled

    - -Always

    Automatic Maintenance WakeUp Policy

    Enabled

    Always

    Admin Templates > Windows Components > Microsoft - -Edge

    Admin Templates > Windows Components > Microsoft Edge

    Open a new tab with an empty tab

    Disabled

    - -SetEduPolicies = True

    Open a new tab with an empty tab

    Disabled

    SetEduPolicies = True

    Configure corporate home pages

    Enabled, about:blank

    - -

    SetEduPolicies = True

    Configure corporate home pages

    Enabled, about:blank

    SetEduPolicies = True

    Admin Templates > Windows Components > Search - -

    Admin Templates > Windows Components > Search

    Allow Cortana

    Disabled

    SetEduPolicies = True - -

    Allow Cortana

    Disabled

    SetEduPolicies = True

    Windows Settings > Security Settings > Local - -Policies > Security Options

    Windows Settings > Security Settings > Local Policies > Security Options

    Interactive logon: Do not display last user name

    - Enabled

    - Disabled - -when account model is only guest

    Always

    Interactive logon: Do not display last user name

    - Enabled

    - Disabled when account model is only guest

    Always

    Interactive logon: Sign-in last interactive user automatically after a system-initiated restart

    Disabled

    Always

    Interactive logon: Sign-in last interactive user automatically after a system-initiated restart

    Disabled

    Always

    Shutdown: Allow system to be shut down without having to log on

    Disabled

    - -

    Always

    Shutdown: Allow system to be shut down without having to log on

    Disabled

    Always

    User Account Control: Behavior of the elevation prompt for standard users

    Auto - -deny

    Always

    User Account Control: Behavior of the elevation prompt for standard users

    Auto deny

    Always

    From a1d64e6bf185a1649c890c0227dae3a9593fb9b3 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 13 May 2016 12:07:03 -0700 Subject: [PATCH 285/439] removed and valign --- .../windows/set-up-school-pcs-technical.md | 132 +++++++++--------- 1 file changed, 66 insertions(+), 66 deletions(-) diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index 838d77ff92..1715815b53 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -106,138 +106,138 @@ The **Set up School PCs** app produces a specialized provisioning package that m - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - +

    Policy name

    Value

    When set

    Policy name

    Value

    When set

    Admin Templates > Control Panel > Personalization

    **Admin Templates** > **Control Panel** > **Personalization**

    Prevent enabling lock screen slide show

    Enabled

    Always

    Prevent enabling lock screen slide show

    Enabled

    Always

    Do not display the lock screen

    Enabled

    Only on Windows 10 Pro for EDU, Enterprise, Enterprise for EDU

    Always

    Do not display the lock screen

    Enabled

    Only on Windows 10 Pro for EDU, Enterprise, Enterprise for EDU

    Always

    Prevent changing lock screen and logon image

    Enabled

    Always

    Prevent changing lock screen and logon image

    Enabled

    Always

    Admin Templates > System > Power Management > Button Settings

    **Admin Templates** > **System** > **Power Management** > **Button Settings**

    Select the Power button action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the Power button action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the Power button action (on battery)

    Sleep

    SetPowerPolicies=True

    Select the Power button action (on battery)

    Sleep

    SetPowerPolicies=True

    Select the Sleep button action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the Sleep button action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the lid switch action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the lid switch action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the lid switch action (on battery)

    Sleep

    SetPowerPolicies=True

    Select the lid switch action (on battery)

    Sleep

    SetPowerPolicies=True

    Admin Templates > System > Power Management > Sleep Settings

    **Admin Templates** > **System** > **Power Management** > **Sleep Settings**

    Require a password when a computer wakes (plugged in)

    Enabled

    SignInOnResume = True

    Require a password when a computer wakes (plugged in)

    Enabled

    SignInOnResume = True

    Require a password when a computer wakes (on battery)

    Enabled

    SignInOnResume = True

    Require a password when a computer wakes (on battery)

    Enabled

    SignInOnResume = True

    Specify the system sleep timeout (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Specify the system sleep timeout (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Specify the system sleep timeout (on battery)

    SleepTimeout

    SetPowerPolicies=True

    Specify the system sleep timeout (on battery)

    SleepTimeout

    SetPowerPolicies=True

    Turn off hybrid sleep (plugged in)

    Enabled

    SetPowerPolicies=True

    Turn off hybrid sleep (plugged in)

    Enabled

    SetPowerPolicies=True

    Turn off hybrid sleep (on battery)

    Enabled

    SetPowerPolicies=True

    Turn off hybrid sleep (on battery)

    Enabled

    SetPowerPolicies=True

    Specify the unattended sleep timeout (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Specify the unattended sleep timeout (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Specify the unattended sleep timeout (on battery)

    SleepTimeout

    SetPowerPolicies=True

    Specify the unattended sleep timeout (on battery)

    SleepTimeout

    SetPowerPolicies=True

    Allow standby states (S1-S3) when sleeping (plugged in)

    Enabled

    SetPowerPolicies=True

    Allow standby states (S1-S3) when sleeping (plugged in)

    Enabled

    SetPowerPolicies=True

    Allow standby states (S1-S3) when sleeping (on battery)

    Enabled

    SetPowerPolicies=True

    Allow standby states (S1-S3) when sleeping (on battery)

    Enabled

    SetPowerPolicies=True

    Specify the system hibernate timeout (plugged in)

    Enabled, 0

    SetPowerPolicies=True

    Specify the system hibernate timeout (plugged in)

    Enabled, 0

    SetPowerPolicies=True

    Specify the system hibernate timeout (on battery)

    Enabled, 0

    SetPowerPolicies=True

    Specify the system hibernate timeout (on battery)

    Enabled, 0

    SetPowerPolicies=True

    Admin Templates > System > Power Management > Video and Display Settings

    **Admin Templates** > **System** > **Power Management** > **Video and Display Settings**

    Turn off the display (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Turn off the display (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Turn off the display (on battery

    SleepTimeout

    SetPowerPolicies=True

    Turn off the display (on battery

    SleepTimeout

    SetPowerPolicies=True

    Admin Templates > System > Logon

    **Admin Templates** > **System** > **Logon**

    Show first sign-in animation

    Disabled

    Always

    Show first sign-in animation

    Disabled

    Always

    Hide entry points for Fast User Switching

    Enabled

    Always

    Hide entry points for Fast User Switching

    Enabled

    Always

    Turn on convenience PIN sign-in

    Disabled

    Always

    Turn on convenience PIN sign-in

    Disabled

    Always

    Turn off picture password sign-in

    Enabled

    Always

    Turn off picture password sign-in

    Enabled

    Always

    Turn off app notification on the lock screen

    Enabled

    Always

    Turn off app notification on the lock screen

    Enabled

    Always

    Allow users to select when a password is required when resuming from connected standby

    Disabled

    SignInOnResume = True

    Allow users to select when a password is required when resuming from connected standby

    Disabled

    SignInOnResume = True

    Block user from showing account details on sign-in

    Enabled

    Always

    Block user from showing account details on sign-in

    Enabled

    Always

    Admin Templates > System > User Profiles

    **Admin Templates** > **System** > **User Profiles**

    Turn off the advertising ID

    Enabled

    SetEduPolicies = True

    Turn off the advertising ID

    Enabled

    SetEduPolicies = True

    Admin Templates > Windows Components

    **Admin Templates** > **Windows Components **

    Do not show Windows Tips

    Enabled

    SetEduPolicies = True

    Do not show Windows Tips

    Enabled

    SetEduPolicies = True

    Turn off Microsoft consumer experiences

    Enabled

    SetEduPolicies = True

    Turn off Microsoft consumer experiences

    Enabled

    SetEduPolicies = True

    Microsoft Passport for Work

    Disabled

    Always

    Microsoft Passport for Work

    Disabled

    Always

    Prevent the usage of OneDrive for file storage

    Enabled

    Always

    Prevent the usage of OneDrive for file storage

    Enabled

    Always

    Admin Templates > Windows Components > Biometrics

    **Admin Templates** > **Windows Components** > **Biometrics**

    Allow the use of biometrics

    Disabled

    Always

    Allow the use of biometrics

    Disabled

    Always

    Allow users to log on using biometrics

    Disabled

    Always

    Allow users to log on using biometrics

    Disabled

    Always

    Allow domain users to log on using biometrics

    Disabled

    Always

    Allow domain users to log on using biometrics

    Disabled

    Always

    Admin Templates > Windows Components > Data Collection and Preview Builds

    **Admin Templates** > **Windows Components** > **Data Collection and Preview Builds**

    Toggle user control over Insider builds

    Disabled

    Always

    Toggle user control over Insider builds

    Disabled

    Always

    Disable pre-release features or settings

    Disabled

    Always

    Disable pre-release features or settings

    Disabled

    Always

    Do not show feedback notifications

    Enabled

    Always

    Do not show feedback notifications

    Enabled

    Always

    Admin Templates > Windows Components > File Explorer

    **Admin Templates** > **Windows Components** > **File Explorer**

    Show lock in the user tile menu

    Disabled

    Always

    Show lock in the user tile menu

    Disabled

    Always

    Admin Templates > Windows Components > Maintenance Scheduler

    **Admin Templates** > **Windows Components** > **Maintenance Scheduler**

    Automatic Maintenance Activation Boundary

    MaintenanceStartTime

    Always

    Automatic Maintenance Activation Boundary

    MaintenanceStartTime

    Always

    Automatic Maintenance Random Delay

    Enabled, 2 hours

    Always

    Automatic Maintenance Random Delay

    Enabled, 2 hours

    Always

    Automatic Maintenance WakeUp Policy

    Enabled

    Always

    Automatic Maintenance WakeUp Policy

    Enabled

    Always

    Admin Templates > Windows Components > Microsoft Edge

    **Admin Templates** > **Windows Components** > **Microsoft Edge**

    Open a new tab with an empty tab

    Disabled

    SetEduPolicies = True

    Open a new tab with an empty tab

    Disabled

    SetEduPolicies = True

    Configure corporate home pages

    Enabled, about:blank

    SetEduPolicies = True

    Configure corporate home pages

    Enabled, about:blank

    SetEduPolicies = True

    Admin Templates > Windows Components > Search

    **Admin Templates** > **Windows Components** > **Search**

    Allow Cortana

    Disabled

    SetEduPolicies = True

    Allow Cortana

    Disabled

    SetEduPolicies = True

    Windows Settings > Security Settings > Local Policies > Security Options

    **Windows Settings** > **Security Settings** > **Local Policies** > **Security Options**

    Interactive logon: Do not display last user name

    - Enabled

    - Disabled when account model is only guest

    Always

    Interactive logon: Do not display last user name

    - Enabled

    - Disabled when account model is only guest

    Always

    Interactive logon: Sign-in last interactive user automatically after a system-initiated restart

    Disabled

    Always

    Interactive logon: Sign-in last interactive user automatically after a system-initiated restart

    Disabled

    Always

    Shutdown: Allow system to be shut down without having to log on

    Disabled

    Always

    Shutdown: Allow system to be shut down without having to log on

    Disabled

    Always

    User Account Control: Behavior of the elevation prompt for standard users

    Auto deny

    Always

    User Account Control: Behavior of the elevation prompt for standard users

    Auto deny

    Always

    From 5412b3ec7772e7c5cfab0828ad630965518d6771 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 13 May 2016 12:17:52 -0700 Subject: [PATCH 286/439] starting elimination --- .../windows/set-up-school-pcs-technical.md | 125 +----------------- 1 file changed, 1 insertion(+), 124 deletions(-) diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index 1715815b53..f96ec39c49 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -113,130 +113,7 @@ The **Set up School PCs** app produces a specialized provisioning package that m

    Prevent enabling lock screen slide show

    Enabled

    Always

    -

    Do not display the lock screen

    Enabled

    Only on Windows 10 Pro for EDU, Enterprise, Enterprise for EDU

    Always

    - -

    Prevent changing lock screen and logon image

    Enabled

    Always

    - -

    **Admin Templates** > **System** > **Power Management** > **Button Settings**

    - -

    Select the Power button action (plugged in)

    Sleep

    SetPowerPolicies=True

    - -

    Select the Power button action (on battery)

    Sleep

    SetPowerPolicies=True

    - -

    Select the Sleep button action (plugged in)

    Sleep

    SetPowerPolicies=True

    - -

    Select the lid switch action (plugged in)

    Sleep

    SetPowerPolicies=True

    - -

    Select the lid switch action (on battery)

    Sleep

    SetPowerPolicies=True

    - -

    **Admin Templates** > **System** > **Power Management** > **Sleep Settings**

    - -

    Require a password when a computer wakes (plugged in)

    Enabled

    SignInOnResume = True

    - -

    Require a password when a computer wakes (on battery)

    Enabled

    SignInOnResume = True

    - -

    Specify the system sleep timeout (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    - -

    Specify the system sleep timeout (on battery)

    SleepTimeout

    SetPowerPolicies=True

    - -

    Turn off hybrid sleep (plugged in)

    Enabled

    SetPowerPolicies=True

    - -

    Turn off hybrid sleep (on battery)

    Enabled

    SetPowerPolicies=True

    - -

    Specify the unattended sleep timeout (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    - -

    Specify the unattended sleep timeout (on battery)

    SleepTimeout

    SetPowerPolicies=True

    - -

    Allow standby states (S1-S3) when sleeping (plugged in)

    Enabled

    SetPowerPolicies=True

    - -

    Allow standby states (S1-S3) when sleeping (on battery)

    Enabled

    SetPowerPolicies=True

    - -

    Specify the system hibernate timeout (plugged in)

    Enabled, 0

    SetPowerPolicies=True

    - -

    Specify the system hibernate timeout (on battery)

    Enabled, 0

    SetPowerPolicies=True

    - -

    **Admin Templates** > **System** > **Power Management** > **Video and Display Settings**

    - -

    Turn off the display (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    - -

    Turn off the display (on battery

    SleepTimeout

    SetPowerPolicies=True

    - -

    **Admin Templates** > **System** > **Logon**

    - -

    Show first sign-in animation

    Disabled

    Always

    - -

    Hide entry points for Fast User Switching

    Enabled

    Always

    - -

    Turn on convenience PIN sign-in

    Disabled

    Always

    - -

    Turn off picture password sign-in

    Enabled

    Always

    - -

    Turn off app notification on the lock screen

    Enabled

    Always

    - -

    Allow users to select when a password is required when resuming from connected standby

    Disabled

    SignInOnResume = True

    - -

    Block user from showing account details on sign-in

    Enabled

    Always

    - -

    **Admin Templates** > **System** > **User Profiles**

    - -

    Turn off the advertising ID

    Enabled

    SetEduPolicies = True

    - -

    **Admin Templates** > **Windows Components **

    - -

    Do not show Windows Tips

    Enabled

    SetEduPolicies = True

    - -

    Turn off Microsoft consumer experiences

    Enabled

    SetEduPolicies = True

    - -

    Microsoft Passport for Work

    Disabled

    Always

    - -

    Prevent the usage of OneDrive for file storage

    Enabled

    Always

    - -

    **Admin Templates** > **Windows Components** > **Biometrics**

    - -

    Allow the use of biometrics

    Disabled

    Always

    - -

    Allow users to log on using biometrics

    Disabled

    Always

    - -

    Allow domain users to log on using biometrics

    Disabled

    Always

    - -

    **Admin Templates** > **Windows Components** > **Data Collection and Preview Builds**

    - -

    Toggle user control over Insider builds

    Disabled

    Always

    - -

    Disable pre-release features or settings

    Disabled

    Always

    - -

    Do not show feedback notifications

    Enabled

    Always

    - -

    **Admin Templates** > **Windows Components** > **File Explorer**

    - -

    Show lock in the user tile menu

    Disabled

    Always

    - -

    **Admin Templates** > **Windows Components** > **Maintenance Scheduler**

    - -

    Automatic Maintenance Activation Boundary

    MaintenanceStartTime

    Always

    - -

    Automatic Maintenance Random Delay

    Enabled, 2 hours

    Always

    - -

    Automatic Maintenance WakeUp Policy

    Enabled

    Always

    - -

    **Admin Templates** > **Windows Components** > **Microsoft Edge**

    - -

    Open a new tab with an empty tab

    Disabled

    SetEduPolicies = True

    - -

    Configure corporate home pages

    Enabled, about:blank

    SetEduPolicies = True

    - -

    **Admin Templates** > **Windows Components** > **Search**

    - -

    Allow Cortana

    Disabled

    SetEduPolicies = True

    - -

    **Windows Settings** > **Security Settings** > **Local Policies** > **Security Options**

    - -

    Interactive logon: Do not display last user name

    - Enabled

    - Disabled when account model is only guest

    Always

    - -

    Interactive logon: Sign-in last interactive user automatically after a system-initiated restart

    Disabled

    Always

    - -

    Shutdown: Allow system to be shut down without having to log on

    Disabled

    Always

    - +

    User Account Control: Behavior of the elevation prompt for standard users

    Auto deny

    Always

    From 796139ed053ffad77c88220d61a27ca80aea9677 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 13 May 2016 12:37:12 -0700 Subject: [PATCH 287/439] removed colspan --- education/windows/set-up-school-pcs-technical.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index f96ec39c49..01b2fe7aef 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -109,8 +109,7 @@ The **Set up School PCs** app produces a specialized provisioning package that m

    Policy name

    Value

    When set

    -

    **Admin Templates** > **Control Panel** > **Personalization**

    - +

    Prevent enabling lock screen slide show

    Enabled

    Always

    From eea43dc775f410da711cc442924abc1c4c127858 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 13 May 2016 12:48:44 -0700 Subject: [PATCH 288/439] removed table --- education/windows/set-up-school-pcs-technical.md | 11 ----------- 1 file changed, 11 deletions(-) diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index 01b2fe7aef..1f25de8042 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -105,17 +105,6 @@ The **Set up School PCs** app produces a specialized provisioning package that m > **Important**: It is not recommended to set additional policies on PCs configured with the **Set up School PCs** app. The shared PC mode has been optimized to be fast and reliable over time with minimal to no manual maintenance required - - - - - - - - - - -

    Policy name

    Value

    When set

    Prevent enabling lock screen slide show

    Enabled

    Always

    User Account Control: Behavior of the elevation prompt for standard users

    Auto deny

    Always

    From cdcd2d6c1a7fccfa1513a85948e10a607ac9cfe0 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 13 May 2016 13:22:13 -0700 Subject: [PATCH 289/439] testing table with
    --- .../set-up-students-pcs-to-join-domain.md | 130 ++++++++++++++++++ 1 file changed, 130 insertions(+) diff --git a/education/windows/set-up-students-pcs-to-join-domain.md b/education/windows/set-up-students-pcs-to-join-domain.md index c16073de0f..a07a8cae33 100644 --- a/education/windows/set-up-students-pcs-to-join-domain.md +++ b/education/windows/set-up-students-pcs-to-join-domain.md @@ -17,3 +17,133 @@ author: jdeckerMS > [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Policy name

    Value

    When set

    Admin Templates > Control Panel > Personalization

    Prevent enabling lock screen slide show

    Enabled

    Always

    Do not display the lock screen

    Enabled

    Only on Windows 10 Pro for EDU, Enterprise, Enterprise for EDU

    Always

    Prevent changing lock screen and logon image

    Enabled

    Always

    Admin Templates > System > Power Management > Button Settings

    Select the Power button action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the Power button action (on battery)

    Sleep

    SetPowerPolicies=True

    Select the Sleep button action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the lid switch action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the lid switch action (on battery)

    Sleep

    SetPowerPolicies=True

    Admin Templates > System > Power Management > Sleep Settings

    Require a password when a computer wakes (plugged in)

    Enabled

    SignInOnResume = True

    Require a password when a computer wakes (on battery)

    Enabled

    SignInOnResume = True

    Specify the system sleep timeout (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Specify the system sleep timeout (on battery)

    SleepTimeout

    SetPowerPolicies=True

    Turn off hybrid sleep (plugged in)

    Enabled

    SetPowerPolicies=True

    Turn off hybrid sleep (on battery)

    Enabled

    SetPowerPolicies=True

    Specify the unattended sleep timeout (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Specify the unattended sleep timeout (on battery)

    SleepTimeout

    SetPowerPolicies=True

    Allow standby states (S1-S3) when sleeping (plugged in)

    Enabled

    SetPowerPolicies=True

    Allow standby states (S1-S3) when sleeping (on battery)

    Enabled

    SetPowerPolicies=True

    Specify the system hibernate timeout (plugged in)

    Enabled, 0

    SetPowerPolicies=True

    Specify the system hibernate timeout (on battery)

    Enabled, 0

    SetPowerPolicies=True

    Admin Templates > System > Power Management > Video and Display Settings

    Turn off the display (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Turn off the display (on battery

    SleepTimeout

    SetPowerPolicies=True

    Admin Templates > System > Logon

    Show first sign-in animation

    Disabled

    Always

    Hide entry points for Fast User Switching

    Enabled

    Always

    Turn on convenience PIN sign-in

    Disabled

    Always

    Turn off picture password sign-in

    Enabled

    Always

    Turn off app notification on the lock screen

    Enabled

    Always

    Allow users to select when a password is required when resuming from connected standby

    Disabled

    SignInOnResume = True

    Block user from showing account details on sign-in

    Enabled

    Always

    Admin Templates > System > User Profiles

    Turn off the advertising ID

    Enabled

    SetEduPolicies = True

    Admin Templates > Windows Components

    Do not show Windows Tips

    Enabled

    SetEduPolicies = True

    Turn off Microsoft consumer experiences

    Enabled

    SetEduPolicies = True

    Microsoft Passport for Work

    Disabled

    Always

    Prevent the usage of OneDrive for file storage

    Enabled

    Always

    Admin Templates > Windows Components > Biometrics

    Allow the use of biometrics

    Disabled

    Always

    Allow users to log on using biometrics

    Disabled

    Always

    Allow domain users to log on using biometrics

    Disabled

    Always

    Admin Templates > Windows Components > Data Collection and Preview Builds

    Toggle user control over Insider builds

    Disabled

    Always

    Disable pre-release features or settings

    Disabled

    Always

    Do not show feedback notifications

    Enabled

    Always

    Admin Templates > Windows Components > File Explorer

    Show lock in the user tile menu

    Disabled

    Always

    Admin Templates > Windows Components > Maintenance Scheduler

    Automatic Maintenance Activation Boundary

    MaintenanceStartTime

    Always

    Automatic Maintenance Random Delay

    Enabled, 2 hours

    Always

    Automatic Maintenance WakeUp Policy

    Enabled

    Always

    Admin Templates > Windows Components > Microsoft Edge

    Open a new tab with an empty tab

    Disabled

    SetEduPolicies = True

    Configure corporate home pages

    Enabled, about:blank

    SetEduPolicies = True

    Admin Templates > Windows Components > Search

    Allow Cortana

    Disabled

    SetEduPolicies = True

    Windows Settings > Security Settings > Local Policies > Security Options

    Interactive logon: Do not display last user name

    - Enabled

    - Disabled when account model is only guest

    Always

    Interactive logon: Sign-in last interactive user automatically after a system-initiated restart

    Disabled

    Always

    Shutdown: Allow system to be shut down without having to log on

    Disabled

    Always

    User Account Control: Behavior of the elevation prompt for standard users

    Auto deny

    Always


    + +text + From e158bd9a7d2d13c6ed787dc7f20bc56a4e7558e9 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 13 May 2016 13:36:29 -0700 Subject: [PATCH 290/439]
    worked, moving to right topic --- .../windows/set-up-school-pcs-technical.md | 131 +++++++++++++++++- .../set-up-students-pcs-to-join-domain.md | 127 +---------------- 2 files changed, 131 insertions(+), 127 deletions(-) diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index 1f25de8042..5bf30b870c 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -104,7 +104,136 @@ The **Set up School PCs** app produces a specialized provisioning package that m > **Important**: It is not recommended to set additional policies on PCs configured with the **Set up School PCs** app. The shared PC mode has been optimized to be fast and reliable over time with minimal to no manual maintenance required - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Policy name

    Value

    When set

    Admin Templates > Control Panel > Personalization

    Prevent enabling lock screen slide show

    Enabled

    Always

    Do not display the lock screen

    Enabled

    Only on Windows 10 Pro for EDU, Enterprise, Enterprise for EDU

    Always

    Prevent changing lock screen and logon image

    Enabled

    Always

    Admin Templates > System > Power Management > Button Settings

    Select the Power button action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the Power button action (on battery)

    Sleep

    SetPowerPolicies=True

    Select the Sleep button action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the lid switch action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the lid switch action (on battery)

    Sleep

    SetPowerPolicies=True

    Admin Templates > System > Power Management > Sleep Settings

    Require a password when a computer wakes (plugged in)

    Enabled

    SignInOnResume = True

    Require a password when a computer wakes (on battery)

    Enabled

    SignInOnResume = True

    Specify the system sleep timeout (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Specify the system sleep timeout (on battery)

    SleepTimeout

    SetPowerPolicies=True

    Turn off hybrid sleep (plugged in)

    Enabled

    SetPowerPolicies=True

    Turn off hybrid sleep (on battery)

    Enabled

    SetPowerPolicies=True

    Specify the unattended sleep timeout (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Specify the unattended sleep timeout (on battery)

    SleepTimeout

    SetPowerPolicies=True

    Allow standby states (S1-S3) when sleeping (plugged in)

    Enabled

    SetPowerPolicies=True

    Allow standby states (S1-S3) when sleeping (on battery)

    Enabled

    SetPowerPolicies=True

    Specify the system hibernate timeout (plugged in)

    Enabled, 0

    SetPowerPolicies=True

    Specify the system hibernate timeout (on battery)

    Enabled, 0

    SetPowerPolicies=True

    Admin Templates > System > Power Management > Video and Display Settings

    Turn off the display (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Turn off the display (on battery

    SleepTimeout

    SetPowerPolicies=True

    Admin Templates > System > Logon

    Show first sign-in animation

    Disabled

    Always

    Hide entry points for Fast User Switching

    Enabled

    Always

    Turn on convenience PIN sign-in

    Disabled

    Always

    Turn off picture password sign-in

    Enabled

    Always

    Turn off app notification on the lock screen

    Enabled

    Always

    Allow users to select when a password is required when resuming from connected standby

    Disabled

    SignInOnResume = True

    Block user from showing account details on sign-in

    Enabled

    Always

    Admin Templates > System > User Profiles

    Turn off the advertising ID

    Enabled

    SetEduPolicies = True

    Admin Templates > Windows Components

    Do not show Windows Tips

    Enabled

    SetEduPolicies = True

    Turn off Microsoft consumer experiences

    Enabled

    SetEduPolicies = True

    Microsoft Passport for Work

    Disabled

    Always

    Prevent the usage of OneDrive for file storage

    Enabled

    Always

    Admin Templates > Windows Components > Biometrics

    Allow the use of biometrics

    Disabled

    Always

    Allow users to log on using biometrics

    Disabled

    Always

    Allow domain users to log on using biometrics

    Disabled

    Always

    Admin Templates > Windows Components > Data Collection and Preview Builds

    Toggle user control over Insider builds

    Disabled

    Always

    Disable pre-release features or settings

    Disabled

    Always

    Do not show feedback notifications

    Enabled

    Always

    Admin Templates > Windows Components > File Explorer

    Show lock in the user tile menu

    Disabled

    Always

    Admin Templates > Windows Components > Maintenance Scheduler

    Automatic Maintenance Activation Boundary

    MaintenanceStartTime

    Always

    Automatic Maintenance Random Delay

    Enabled, 2 hours

    Always

    Automatic Maintenance WakeUp Policy

    Enabled

    Always

    Admin Templates > Windows Components > Microsoft Edge

    Open a new tab with an empty tab

    Disabled

    SetEduPolicies = True

    Configure corporate home pages

    Enabled, about:blank

    SetEduPolicies = True

    Admin Templates > Windows Components > Search

    Allow Cortana

    Disabled

    SetEduPolicies = True

    Windows Settings > Security Settings > Local Policies > Security Options

    Interactive logon: Do not display last user name

    - Enabled

    - Disabled when account model is only guest

    Always

    Interactive logon: Sign-in last interactive user automatically after a system-initiated restart

    Disabled

    Always

    Shutdown: Allow system to be shut down without having to log on

    Disabled

    Always

    User Account Control: Behavior of the elevation prompt for standard users

    Auto deny

    Always


    + +## Related topics + +[Use Set up School PCs app](use-set-up-school-pcs-app.md) diff --git a/education/windows/set-up-students-pcs-to-join-domain.md b/education/windows/set-up-students-pcs-to-join-domain.md index a07a8cae33..3de5764c97 100644 --- a/education/windows/set-up-students-pcs-to-join-domain.md +++ b/education/windows/set-up-students-pcs-to-join-domain.md @@ -18,132 +18,7 @@ author: jdeckerMS - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Policy name

    Value

    When set

    Admin Templates > Control Panel > Personalization

    Prevent enabling lock screen slide show

    Enabled

    Always

    Do not display the lock screen

    Enabled

    Only on Windows 10 Pro for EDU, Enterprise, Enterprise for EDU

    Always

    Prevent changing lock screen and logon image

    Enabled

    Always

    Admin Templates > System > Power Management > Button Settings

    Select the Power button action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the Power button action (on battery)

    Sleep

    SetPowerPolicies=True

    Select the Sleep button action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the lid switch action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the lid switch action (on battery)

    Sleep

    SetPowerPolicies=True

    Admin Templates > System > Power Management > Sleep Settings

    Require a password when a computer wakes (plugged in)

    Enabled

    SignInOnResume = True

    Require a password when a computer wakes (on battery)

    Enabled

    SignInOnResume = True

    Specify the system sleep timeout (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Specify the system sleep timeout (on battery)

    SleepTimeout

    SetPowerPolicies=True

    Turn off hybrid sleep (plugged in)

    Enabled

    SetPowerPolicies=True

    Turn off hybrid sleep (on battery)

    Enabled

    SetPowerPolicies=True

    Specify the unattended sleep timeout (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Specify the unattended sleep timeout (on battery)

    SleepTimeout

    SetPowerPolicies=True

    Allow standby states (S1-S3) when sleeping (plugged in)

    Enabled

    SetPowerPolicies=True

    Allow standby states (S1-S3) when sleeping (on battery)

    Enabled

    SetPowerPolicies=True

    Specify the system hibernate timeout (plugged in)

    Enabled, 0

    SetPowerPolicies=True

    Specify the system hibernate timeout (on battery)

    Enabled, 0

    SetPowerPolicies=True

    Admin Templates > System > Power Management > Video and Display Settings

    Turn off the display (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Turn off the display (on battery

    SleepTimeout

    SetPowerPolicies=True

    Admin Templates > System > Logon

    Show first sign-in animation

    Disabled

    Always

    Hide entry points for Fast User Switching

    Enabled

    Always

    Turn on convenience PIN sign-in

    Disabled

    Always

    Turn off picture password sign-in

    Enabled

    Always

    Turn off app notification on the lock screen

    Enabled

    Always

    Allow users to select when a password is required when resuming from connected standby

    Disabled

    SignInOnResume = True

    Block user from showing account details on sign-in

    Enabled

    Always

    Admin Templates > System > User Profiles

    Turn off the advertising ID

    Enabled

    SetEduPolicies = True

    Admin Templates > Windows Components

    Do not show Windows Tips

    Enabled

    SetEduPolicies = True

    Turn off Microsoft consumer experiences

    Enabled

    SetEduPolicies = True

    Microsoft Passport for Work

    Disabled

    Always

    Prevent the usage of OneDrive for file storage

    Enabled

    Always

    Admin Templates > Windows Components > Biometrics

    Allow the use of biometrics

    Disabled

    Always

    Allow users to log on using biometrics

    Disabled

    Always

    Allow domain users to log on using biometrics

    Disabled

    Always

    Admin Templates > Windows Components > Data Collection and Preview Builds

    Toggle user control over Insider builds

    Disabled

    Always

    Disable pre-release features or settings

    Disabled

    Always

    Do not show feedback notifications

    Enabled

    Always

    Admin Templates > Windows Components > File Explorer

    Show lock in the user tile menu

    Disabled

    Always

    Admin Templates > Windows Components > Maintenance Scheduler

    Automatic Maintenance Activation Boundary

    MaintenanceStartTime

    Always

    Automatic Maintenance Random Delay

    Enabled, 2 hours

    Always

    Automatic Maintenance WakeUp Policy

    Enabled

    Always

    Admin Templates > Windows Components > Microsoft Edge

    Open a new tab with an empty tab

    Disabled

    SetEduPolicies = True

    Configure corporate home pages

    Enabled, about:blank

    SetEduPolicies = True

    Admin Templates > Windows Components > Search

    Allow Cortana

    Disabled

    SetEduPolicies = True

    Windows Settings > Security Settings > Local Policies > Security Options

    Interactive logon: Do not display last user name

    - Enabled

    - Disabled when account model is only guest

    Always

    Interactive logon: Sign-in last interactive user automatically after a system-initiated restart

    Disabled

    Always

    Shutdown: Allow system to be shut down without having to log on

    Disabled

    Always

    User Account Control: Behavior of the elevation prompt for standard users

    Auto deny

    Always


    + text From 1b0aceaa11d1438deb6509453470b4a9ea5d09f7 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Sun, 15 May 2016 19:44:10 +1000 Subject: [PATCH 291/439] Updated components image --- windows/keep-secure/images/components.png | Bin 96200 -> 64490 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/keep-secure/images/components.png b/windows/keep-secure/images/components.png index 0522f3facd1261e6c47a45a108af3f37aca81ca0..840f1cb0dfeb74383a9f126c46f39f1646adad37 100644 GIT binary patch literal 64490 zcmeFZ^;=Z$8#RiFQhrb*q;x7{||B!*cdM`(9qDZ-%E-rqM<#&K|{NTd~_F_af^MJ z1paw!E2-{)hW6AE_4m#Ul-w1ZM0b2ID~3Mz;K^g^yLOM;{@k7tQ*#t@ax}HEN6RVf zkp!o(9Kk73V+TWfGh0V98*8*@k6%%M^BAb}A~v>e_GTugj%fK$dU(KDoZGYZ#`>sB zUpksu8KZHWJb4U$@)-3KB^#)ti@v=vnzro?>T=B67dLY-wA2Te+M`uAm4$-Sk5H#o z_3f?AtWD6Gh*$i;IrM+O?__UijCOSMb@TsRCSqe{Wo+$;cH9%y2+lo3UG~w;(b5<# zduNau4ece`dr_f}t_fSyURsFNdckWKgQokq_vj$m?_}}t=uDNdEHWH;F^;(wPe#?Z z;fY)(_pWN9szy{iEDH+goh#VN955Va%J{{s`ej`3_7cj!FyfYDU|>l8czJ>+@<W~TPG4<$8G$46$bW5se`l3SlmVtQ;bTAOw& zoByOEO>XzcI0(QvEOCP`_*O*v+2D;Yd9)}m9orEkoKV%hXIfF z%G|k0Z`bFHU*>Qh`o?Nq zTS+*_3hcaGZu0#`rL z8y&|;ocVEVpMBQuQm(?>TgVf3gAmw13_7(PiP|C~7)Nd=8b)uX-L1b{FQLjlEf}VY zztqfM0?l+=Dzq@W*_-SFcbbD;D&ooi1-$FXMsM0dTz_D|=49%ZIx4ps?Y!z}2wWSN z^LpA?XoV~MIXhJ{e5IzidsZh#ce-ZNvh`OTEt=@MSgw2noCj_?;!K!-QsXd2W<4G1 zQYzPfNJE4rUakTk*%0K{y;?up=+sFw{I*!Z7<;_5#JZAY6BfD7gN1u1siPCE`5tNu zH5G;HPRH4&aPA(tY2jSB>U^D5J4s*ueKuS`|72G3Le>-pN5{1iRPtuYqS}xBgy|o~ z&-0lmwl#OFWF^%KIjm8i|BDsU4p>C3?5h4?bKH>!vndh6j;$) zIUX*n8_kr!$+^A!wSOw)*t@6F1KOB={#yDKu)o9iQ#s_fOq+47z@>1y|LS{La5@LSl|loteWJwHnuC! zMPq|~`+ffdX3Tvzht45w6Z%0NoY$#~s>BC6$plNy#t&6Bb&W384=6048;8DNP2NAV zjp$b;KP|U)O5be_i2BOS0p1EsWEF|?cA=Q)$Em+ou)NT1uo_0^#qfQG?9u zEq}YdguYe#7?y;?sb`{&5V+8}*U@m-h;zMA!7!NAZ5~a#z0p7Xvno#qz_5BKVWG_x zf5jL>tzrppr#!`sXMXY@ERJXi%;l|O>gD;anr-O)B}oKcspjNZn3;sg2BgAM%7`e8-^Bt_0X3mlA#Iw6+6^b@2 zCFA)%x@%dUCi)2Ufh^8%+_4b__5ZDV%nx^5cqCt6N5WbW?YMzpTW|CS9OP-XSA|Yg zv)k(F-bKTDg^K#0<|(98pyF>#XonO&>uBNdLYmkbYa(G_4t_kTtZE2`JxzX0*j|27 zEKr;8wtr{`hHf{D07CUtA?Ql=nCfH;J z`PRH3X}mkAiV6aKM~f`w$dGCmH3r}CXcmxfdFq9-xNNyC!Afz8JBFdjLmP_g1Bc4X zF5If)D_i=z6W0;Y!X_=}WLF;CVY8q2PN|w6RbCx#^Uo@Whrz@GlL=k6ZZL_OzD+ep zM6~m9w3ZfSIDqi?H(&K~Tn>yD)`1<8rt{uy68VZswk)1QW)miITQb$3XVN^j zun)R%MnA~vjV;V*N zIeU6`3Fcv3g^}IWkJ*mQUJChKgsMI|KhuUhOB7kMD<6LP?R)2Th5E_a%+-uvg?e~d zpd%2QOJbHfz59#_f)Dlda-7_6602q8@MY$dcYb{+g@6)0$bAYX_#pOKc@Vh7KosIQ!U$%Ng`+o}7)onf|g&KZ$@X$i(v6=vc zArt_Co%QiJJL?!x+hut zp`d{i*=(-IOZuvd!>qHkO7F%4+gAvMx=qUmO0(96Wx{at?Pv0<_Le7n+o#5Jz2_Am8<_;gRU|hgg4pfl6NbiucZ*Ja zBfS>Z;~SU&JXqO~oE_GtAK5xP4$;UnQGsqek8YOJAgepr3kI3NM)Qr;WVo4VI)Zp4 zE0U6*V5?`%0&+mSnRF`C1aMDCeyrP^+pE$NJclq4tS6)i(3sqgenKj>L_{aO13^zpFxjep?Wzp?^lD-)dx>1<8SETXLP&N^}joomiA_%?%y0_ z{9SOj(oybC+NG0Ux*AF!Mh{)x4#C{u7`)e%_Q{xiA}Jn)2}5)KVYD?Kte*Remm4F& z1K01nzj~0Uj1H1rUW;Yg5+t{qoxhy$w22a~KiI<-WOktW~5r_T{;eYNFx+32%-!EF4J51<#L=+Yi%n$m7)xyAXFmmlPGfuK97c zo3U8b{^p^A;uKhNcvkW7kLxnS)u(*KH?1ecn}t^h#4*!Tia9Q?|Fl8U|JYnH>alVP z0l5QwfxQJn`(|4Omy$+_YXCAM=3yv=TZ1Mn-U=qqm5HTpL6$3YA*}Z|+v)sUM21m1 z2qJI$It8b!IiFu?@Q4{vAz4epf#^5-B!DZitx>V&I=tRQGzm=}>wyMV ze)^rCH!El2Y`g*kYES%WoK;TJzna`%?8E1Xyh`6RF?1)O56K#eFv0WBMAx*-`ymPm ztJ{nEVo=K&HS;sVba-(*O(uYidU>B$%48c~qwWJS80~c~b-UV#$~FNV-G@#838S8> ziRI(yV8i<6Ai#5hvWx)ujd+}RdQfwgzvL{Ro0c)Q6N&E)%q~A?EP1m68M&$l%XAk? zCreP=5V&3h&@Er>%|vai6y$tOYkAB{(DG{4Dnlx3b1gQ)Uvg5vgK_jSxtXiY`r_4@ zXXGaHv@y|RyBx?mD}jK331v~uYoiz|*`l=q=@6(GH9Z5DV}Kk}xyw->qQ>TrR`Y^U zHxB#c_Ikt50wvi3WlD+CZ%?@u%(X%h+d7;SpN&WUe8cJ<-I>eeFMN@h5Job+DC^Kw z!z|q)$;VakmA3u4Y|V2&j9~G&xpkFlw%i-;SQw|5wiF7iWu6@~i=OMad6D_`nvW7E zog7}LkZe3p1QP5uB$#=L%&6x`eL^Lm@#~%cb~k}!R#fQ{Mh9u zP}!AUz&SR_CsjT`k%! zKcv463=I5<=dIz&=U5KZnWTt*G&;yyYH?&*@RGG%jqbTqu<|y^_l+K7UQJVrsoeT_ z=iZ-A8?r@0h!fEa;@*9@Q(Kn-gZ<9uUb|vQyu?V#2E2ROmy?G(sur>pYX!Qf2W>gS<(!HNLV;jc%v_ihJxpEp^Sg4!$B8l3M-Vs7jz zlcEz86X>nplq1qr9Bw*VC%`+z;~cv#)}2kG$EZt{(elrDRtBfZ#xsPnYsh^s6JX^} zvYf42P03KiRkvEJD@;2co0zWuom$RmV|G(ABFohncNJf=NA;HFED@8kGw!nQ0eXAS z`QDrNC2E=_4a`csZsTlRyF1;vTFA5B*5nn&Yj&GSpXlxG+>g0DH_m0GPcCP|A}B3P z#H)J|x@Qu!$f|~eC&l#x9iHYT!&=5@^#8+b4YYM0M!hoV z!|9dDOoDrLKl&Ff&vOqA#H72vYnVAdPi}wjNi_#b(OAP0ybZu66c9uktR4EMMQ?xt zdGof={>VN(3!(2W_zNm-K&*u5TD^p1NP(KXV7goqq*RSOK&$Y2H0GK6=utuhLcxC2 z1ANkne^&dW(-BMtfUR{an|7yGxK}y*AIB~UiCS%=Xo`sE>^L2oL(J0;e$+gUfvZWACZbyg!Hzhvt%LndxSf;C3@Ll!$b4F#@;pE2OCW4D2{ zU;kT@!Jt^}-r&GA@9zWU)I#s6!T5td0pJ%yu$tzP6Ns^u5~RX66C{u zShAo_>CDOPoeYW~cLRWHbL~m@taMiE%~A6%53)idPtZN5@1h_yQ~;Er+}p_k0`Q`-U)RK?MIn>+8U*B^xjEUcOntJQO@4mlu8b zHH`KN=V^^nu6ohdjG8+_L9wF$yNy)-WV2_#lDiTabI5as-JUL@lA*%i1I4s$iaD_N z)%>f=E=rWUa^*dLazt}#8AG{tq2e+RqhF!eZ7gy?z>S*kY~Qk6nxo@gpk#qcLTQJ3 z&gK7+7^*q1Qh&TBlktLs?{Ogz!a&arN2-03!0Kg&gM z?O5}A@k*yynhpxT~7rBNP9Q$bfg#rF_~$tIzDltqJHfU^F~q$A1h(%dQTs%2nhUx~2$s=6L*= zM#Q}xU&C|1t9P1#aoW}OH@!e0WXVN!y{xQ3r5P^(+c`arU2J@;{bHln09VP!dQmk4 z0H*O;s^o6B#c^8EpI)`q?fUX^WXNUd6!pf?A6AdzS=xeO*UrU#<*GBPUx;L$GY2w_ z74~U&d#e+?z2@hcppU^7&ndy``jPPl^JDL$v_F~{tp&o!s7Fs7g4zoG&p8oq5FS?C zGQ9jV8G^>2W^QSJEb@yM1R%VuY>1Z5M{vNntoXe*oQ??=641)Djsi?4k1Q{)af@H_ z1j}UIpQ!5H?l_;DC#_}L)u3c!nlYl468q0b#H+vU+5@S}fADLI8Jzw*6=gw%pFpxJ1b{o%T1z(UgEX9hYD2jm{{a&35E6M57L>l4q!%Tt zb7JgYZ>Z8kCNEmKVHKT7?g~Ax!fA6~fsF1VK!-q|rBXinyah8kJAAYrKO%cvaD3_HHI=$S$M-p|f z=xFnOhaEm#1VsyuHNUMv>;6x=Fg0%kE~q`+%*~S`!suI3lRD#KrU^McKg`}8UhByRnuTjyorsGzJlcVe9x4!cbkb_(`0Kz_+?+EM?N z&p6)Z6}YK6kv!&=Q&7)F=`cM;EOu?f6l)G=k55qbWChiqPiV!X*PV(fOhi6(!MV7e$s(=1gXa66J4&|{4|umb&{MVqV*hJF zv)JIwr@B2D^89iNn}@GFnAo^uH`}5ZlK$i)mtLNO^bDX*eAHK-O1F^SuOLa6;+bdu zh+zZts3-q4j7BwQVBKnn_-lLULQiMmQJ}l>N0(68m}OLb0+?wi*dnlNc*pF@9iTfD z4o^|zU#)hh^yLqiiK%36vM^vCu`U}y&c~lEj`SysikAGTJ(lvkQtY5k{Sue-dQCP4 z-Y-vb*%n66Y5;S2lHno)RHfb2b&soa}mTrV9qMWV_0rj zMUB`23+p3^$#Cz}=3YBc>RA+99-V^v4AjaXf1@W6FiG_xi8sB?n=K&|P89~LgGtKY z$1O(^sYt7nA_{1gYe03KII}0*(vrUVrI)Q*F{7J7<#jS#2dO>~FP$j`_I0IW!IS=8 zM~u{iMM)M4296M8x;wAKqh2Hy;$_z5QKS~{I1AR&y(kxD@9jHWJcK+)tZw~Ui1wGW z8H3PMqy|H7{?mQ3d9OuYPO^5eDPPN&@o#*$e(|CBVrV2IXWEPe(!l1UTK@_x)CXgd2+DIUZa_c4Jv`PrFQ0IDzQ;nGI%-_$f?RY|%tje#W?B}0+w zT>pFKk3v$K1nz)UPz~IuP4C}zYzqNq4L&a|05`Xep2t^mo4MKk zN$ms`_pyJLCPA-tg^~lI_}%vRF|fFub$>~g&n6BwP7b`dj94X_{F99NwM)N!h%hVemRmk<5AvJb_Tu!%wgLZlx3~*5+I*jQt~;3C`rl zot|XWfWaDnaNm$pf= zPrdou?5!4#a4v&fx7J6eEByr=R9LEJJCifKBeDb81)JwzOI&KcGGL>L;M`_)N+33Q z>+Cf0+HHPOY=$bd-|*%@3$5X{{DH#T>eODCg@vAmoFE z4y2TP>(;VufPgFn=xbj3v+s^vtm~NUz4a{K*=yxVBGx1knD58wwi5&uylDz0gBO|# zIoa*;H%lhvi)@F4Z~l^_)-NIQCki9AgMlA&Ir(v~RD}%xy6%MNPFx*J zTGCs#EpPwD(?f}wJ-0$Ml7CvYFW?g8mu_0_cLNAej--wiIL}(qE5giDDd-cJG`KwdD+m>% zG`_t5<(d>&{h0=%Ai;Jjn}ZVk;z?wAw=TXVEAAorkWxX2TQIV&d$DSj7UpWbMX-8)ZIg2zA{DJY;t6n< z4S`&R8!6Jpgv7M|<`eAltU|(Z)@swXD7vOCg7@uQ*a))vE@9F?Q6wHn2%u!ncs0}W zaupl{(*O{ks~B2V;oQTTMwOFCiD}}XAO$>H*|^ix>a`IB6sh75++y3rfDm5rhndUDztv9Lr31vb{cdv02qF_drZvcm zes(S?%q?jCt+Vk$erFB{e)fd9_d&kM$Kxuq0@j8h-*FJw45=u=m~&UU_4&=JH0;kB z0}f9{?igt=2$T&Fkj|g^Z=V5!2$zpQ8C~D1J9E@`upz&X^OdK*?j~H8*$M>z^I|iih{$b{c{FBs`ffg>a7Og)RM1LFlLa}DAiTNh7h6&o4+5%G=e z{IpL01a(s1;coe6aGoIZ;JVf5>k3BB3|?^*?;UZO=|*7ZS(Eb#ReHe`jfp_ap3cEb zw&r2we9hkwJsA_CLJ5!TsO=AyeIIJVH1VFSqS;YGXn{3Hl4(5tcS05Ka2+>ZydvH6 zjJDX-r=^_S#=mr?e__V+`NAf6wyvSNfw962fPw+sLL8^~xyRFiM5<{ZO2#sRGq?&( zRSlt@4LTmo7tUfOvbjT=kH&U z4`1kc&)pixdqXQJBdX2f`tyI}i#i4e+Y4^#6d-{w*pC6<2r%g6-F(R2aY7Zd7r>m8 zZ}H*DuYY`jk_U((+V#_eu`_^%iAnzIStS*zWYNF#OgvM8~r z=#OFJn^UZ#eiJEz(I;)*6R?sYtS6Q1PpWwnipf^o*jYNuUQ!se=>xcsZy&r6^4 z2G2p@8bb*pz<(e=#y6K*0toeSc#7A0h%dnQD#?>`cL#Epr{U$Bs#`<;6-n3@O#JU<>o@T5!9uO$;)gZya7RYJ_}K2Z>^~7PsPIW=a_IAlLV~WneSPV zm9nKJz}{M_Xk~}iZ(gbm2#aRAVKjfj>}PxY)IkQ392PYn=6eemr<{zHqq{7Qh!COt zA5`-!%($>uo!c;RpT&~PEnO`gzF*- z%ZI?*YEx;4q+&o41ptSYnC_QXlk3XX4!#rp^0*GvNn?EC1&AA@ZvZSQ-inJlKG&oX z9}z9qjUICbSGQX+BKPjD7wC6x$xJ_Cz(m`F384(UgaVg!Q@~{DPlIye3~{s!jh)?e z3vYRQlD`9Tm~3ST#zBp1R_p%$NYA2Oq2jaWrjQi5?5D zO7XW_M+Wo+Jf;s%TU1Q6N_%N15h~n5^cX*at9Qj7O4*X3c!`tQt@)#hBB=+{(S-8R z>x062P8(xV_r!r@RW2BCd_wTo88KasY)y}_3=|4hu8$FwR%HLJ_0}JacnXAypln3t zfSbn=cVzSSsB76SN4hC9isEq_Tdw;s6uB(*pXhQC2JMg>hY^Tukv0c4RH*V_=m$J+ zkLSM#SSpu`=B{)tboWZ?r3rslldPk@k;c_W-b8ZiwA^FuL=-e+lzI|G#75GQX63nm z_|e~dY6_BA{6oPLwX@Fm)Cb;goN#pWs=3-{or(10FWYJy#EU!5vZs{A;$n@fJydcc z93mh1b3<1j+w9Op^5~w@aeh}<%K;lB9 zrJuzukaCqqF_o3$i8HVi09cBB-c{&z^ivpsAfOf9Tp1+J=oyu&!}*@s9+g)gGkMe> z>*zRP;$G?7eKI35u~4Pg^fztYlF&OWZ!O&&WV1Ze;`UBre6GP)U)b;Q&m>%Yk_Pym zIlCX4DZo)z`-3oNWJBaci^<0$CI6S5m&Ri@x3Mal{bn;?FfqUGada}#-;e4CFiDU zsaHrH;lfL_Jg4)y6Q3BYfle`eGbHKx7$??dFO(_-OK=!$C=bgam+q~*Zc+7n#cgQ2+F`jDH( z(+dLs%x#xEcKoFWZBO#n^3haO!ZXMPJY-^nbwCH?1y~aJQ*UV2@*j9XX3tXpUWKct z2jK3>{&rP|^$-5H3oJ=EHRT|N#o|=DL_c8FbaZb9t}^1ZEA5)2hQg<^Oue?gWcS(r z^kgO-3%owp=Q%KVSxrI})YufjSesW74s_eDWk;dtGuY%H~Xe_I}e` zPOdTMJhKRyv8}aXO2UA3&*sYh1@5wPWjX=3d(yr7YL42})Gzfg8hCCi5IhB*v=y2T z0((9rAhwUo$`cUfIDulKl`kep5-t`9#3pd=1&T@NmR*eAK?{BHZ@@xx3R*8O^BM_O zR4Z{#8Q%md1Fv<~RhzgQW#WwO2OZ!niSaoPb_&Ja1KyC$7lu-iOq}ISb~6?02Z>Ru zq0^>71qCi|ArgTUdFH!h#K4U7w%1QuT*EHAC^aXVql~%k#aS2IogTWbMqcl3;9NDk zGFpA$?hyOBOI~L)3F%XRoHV0HnVOXuQtpxpoL}4K_i%xsEih#iEfn{kzZDnk2jG)@ z6Zlb-J+AqB5|d5GyQ_R*5XT5VPjRXI*jx+F=lQjN(TH}4A4(B#*aq#!cmYUjW=uQw zAHx$8t8}xSAIy2NMDdoIot#Lat}?(U0`;`5*0z~LzFppBa4cG5T?C8l=420BEG_D6 z)d)UdmofuqN?MTdlx0@*I`A64iOR-)ND<#VQO;ls@RqDYBx(Mwlwoom4&*U*a_d&Z zs=r)KlK(K4B5)aq4e}{P9{{)Z$#9MOm99XSotzG!-(1hDfV&t-tS*TK9Sn-#VR=J% z>FE9j!oaz}%}J&iGeDMrm|fm3xutU@{~keqL!&%XKYRVlfpHl#T=FCG1-Fcl_&q$3wpjMV&N6)Ao4SO91=x21gHw3J-3%y88+iN1#EY1MpQoC2EI5AK{}( z*siZqL-R&~e-O~r09*kzJEnq0xn|J~8}PD#MZ`UGtL{(e2*fzB&!JY&8BFZ4Ii37o z!@F^@t-V+yLgkh)!9vXKmJX_LtFz3YAmD=bF&Bx6Fd?l`yBH-mXMAI8^UrtO$Zj*p zYeFBR{L>#8N-u$AaE#$D>!~?2Ht}1(w6IR#i3t1-8Sg(Lt}n@E7x-dk3;|)(9>1yq zSG~CRm8*Z-PnF`dLhkZw{#Ik*O$)U6eCC5D-SCM-v6>85NhfIKLHA}P*>WnH8#vsc zZOvNE^VgE@#)29-Wz^J*dnLn$H26ysTT|_{aB#n$y7e3%6_I6m0m2FCKsB*Rqq2F3 z6l};f9pYJYc=$=;9|n_5|F{lXKi<0M6bceN-ao2(>0cHb@j43+Y^?Y%?Q_8DI91L5 zpHrQ9m00r9aum?V;+~vLjJS#L4vl-(FRLaIeL70GqbGT*F9&H!MarrCb*)IJMa&2A zay|%M)$y`Q>P@I)uHC4=$@x%;Z6JpeyHw23Vj?znN_eO7Bu)Q5>`dC*S)C2n&0b=; z?gjV9dr9(39Ce3c#bBd>D9djD1_&y*jc$@zTr3fOiHE-{BZ={4G)T=1eUbBl-N4sb%X9BQwQ119s}irvyGtBy;o+>Ke=TUzU^7g>Go0?NY}h_!)1Fk6~UXk z7o2sszSw}MX%Tyv8DN4YV_@cXCwrrWeF2CqkwHo{2ykJj78~A4ZhuA5iLp}yvJcR! zh3eBZvUH=|`GJ5ZBbUVCCbQf}vt;y1AMLieYVOUZ@-GtjiwAo@u8v(hK|bx#_yFqJ z1-3iy`}tYtT-4pF_L8|i0_qKAb)V72H@cPpk@422f@Z4@%)}sj zsq~YKaRMha+U-Q4`Bnq7_{0rEgJYK1q&|xkz-UURX~ zxJ3u4DHzm-Tfa^vKC%iv;px~?LV|$C`o~VU0q^{W?jtll_S<~}6er*aID;R=-7uN~ zE1m6;7Jgu6=xS@F z0IhmusJ<#-NUFB}JlkwdgCzlU6d?I@DQ5fCy!zVF-+k2)7uzlD>09#(jRNnsO}DD& zX9Vc}EQ=N)bs+$@K7gp(;hg^s0Itp8{-xir3}F($5D+sRZzuZE;Ch9nM)sEYZX%To zbD(D{F%9A0Hh=;^22`08YuqNuZ?_%6Oh7HO2b%t9uon}WsvFFh{cxNd(8M7+99P5+V>lLvYFM-B0q77fHLZJP9;JTwHDstN!4N0BC z=mi$y%xe`ub`jo5&M}r11sMq>c1E)c zu?6zxDbPEzs~Wa}eE2uLyGNrJtyvMwFle3C9^o6pzJq3xa@$)anr&ewFQA*Ko?gO~ zQ|?~4+f3vRSV$)>S*u99P??vP8!LwC5^o%jgkvu;mFU|B;!q zV66cJxAN>OP_JZTx%CH(q6?!mQ&4WS#v0{x^*^6iiiU74iEvLUyFaQu1J@y@OkIJ zpNKpuho=v`8pU-{O6ntZVzS35h4@>#2r^4AkI^17kTyUlIEGJ3h#DDP`bC(uwWvCVwr)PSuN}xqS zjX_1&_iOz?XMo>S?u-$j7AYAyUIcUd-%Sm=Ukh(qpp1tv?|Y)_(fm^xnMzfdaA$B*j0=5huG8TQ()-|HY~hc$D= z#%hl!<@6fU4uL%YTLUpwh8Peqz^DKUQNPW$K4o)~$~$`L(vjm*0k;nM8$8MtM=0V| zW|gvJs&e-O=*`wu0+4DTVUpelLEA%{!0PetHgd9PfuKlRXoGn$4;Bt}%V^pSK@Wo> z>$9)3C>Jh&%P57J8w)P*;&lFAmsw^(=kM=fN*hoh28M2FRHFsI%9KCGp*v`x_Fofi zNaK7fA4bv}AgAJZEK+Rg$fdpoVuj%_a@dU((Z`gCP78ENVgCeRKz6VI(&O{Q{53w# zSFci5x7qS5&<^D&pDJuvZ=zEh!bO>$`unE7zb6MQl6>Cn#mW_>2a>MndUOB$oFc${ zgJKYP%Jq-mF~;;@1?%8)&bSjODbj;}F`=hAgm0r@_K`0<&{;Ourhvw58wR%XA}9C+ zfpMP)Ou%Glu^uyE%KjpFec#@{i1!A1+bZD*O}1j{Mn(T|J`(!lR#ro$FH7aV+i8HVfN*iG;AoFxk=(jjgxxso-8k>gZ(aF3qG zh4stu%yt4EBF>O4*0J%n6Hy$wPD#CD(CX6pS{NS;!H>U4;@9zbCURYit;JtjNcTBQ zOG93`EatHVDvx*o15eC^VQ>K{ z$fbwX*f=ldYEB&yghOKmieY9;nc$A-TC?J%Y+Eza+j$-MTVo^a0|;D_s3c_^)tb96 zA4aKji$qE7^OAj@FWwu&Wzu~eE`6+l*nB;yS70H*GPkI7cCbPd9y9Vd>fSvpb8GF@02Iw?@Q(&=`SuJ`G+BQL3BS=a& zc4;{lKg+*zj&1Qkskm!DX5Fag zKWOkdh)-;;V>8O(w|+9mAhZzT8n|9Vt(k<<84xI1j)hWiufQ<{tw>`F5IbZLPO&NNnxuSkILTbd z#(TuNufp`s=y0FUD2|;ab?nm?mRjc3=WlKBqEQgsY7Dl`qT_c++SAFLBi+biNRXeV{n|c<=z4$GE?}Ab|rU{7u zD@Sf6Xit(>2K0cJK<4HW)OxB(I7I@WVJf|zBkrgU+m>L@&C-g^Fp{_jByHr2P}Ff|%4Aq$tCTVYJGWjADwu z-v3eVz@l5WdnNI@DGyE$6K0Zxsu53e7b$=o(O9LQwawXV!DOdF1Y>ODk{ z^Q%zZeEbrswdXiZkG|{NerQ4FsBx@T27(yib>O7~{p=i(LjbOo;F(jU9k?Zww#xSJ zG*(>6ROggN+ws9)0b6N^LrJ;nP0H9|xmaUC4l192NUsz9#$Y35+cnp%NUZiQzHbVDedLr=beu`S2C)5&Ji;ElLDv?lA-BZ%z+2T zglnwCv#jMRyRO{(pWCq%C2bA9eE|zCEHML?_;wJQY-K6szB=TQC2#ko;P(_i=0fbQ z-8tzeT&#Z|l!C1^(d8~~Hw#ELz^FSEbv(lb;0OA}E=t&oC2IvJGBUf?U{hzprJP88 zfm=z=`Hb$CmztE11`80?SWXnKJvw;3b!`zs@Ff>fHflBz%bBi~O`1KNZuOLM<)>m9 zOGqo_(&?e%x^+rR880x6Ym6E0zK1~Qem+u9Z1+#k;D&l>qh>Jw?JH^F{dMu;?OIe& zlazGFdVe;6!ru^j-aU(X(9F)(4t!8y&)M;y?zl z*Kk5i2)q$8-6&P2q)t#z8m!iil7i$ERVrCd{dRvRK|n>jyLM)N>k1!_4>MI}ojh|v z6KDFz-1_==RZ9hHWr6T}9+G}fj-bP!O@QAfHd0Ot?*vjdG@USb)Ol#^-oP zkZ$8*=Hv<;!;wX@Ek}rsuKD3z%98J8toP;f2DUI*wOhR=X)Im`pQ5jIZs5z;hPtbG zVAJ!f*7r6nZ1e`4`-M|kq?kFsw#a*DBU9ud{evBsOXFn|^h3%$*5>=TRLzbn*Zbe? zpfN;H-`KOh(AC9I{070okf9zZy1 z$7dkb?}zv4K}d4I@Z0(3%FbkR>MH-N)?)6tw93Whz9l;?bK{(P2h4@eFQc*3vsaiU zf>#}s&QpdJrDFBDvQ6|jCE3ZT9M9<7^zLbzAErJ)Alx&22C@yTJ|D%+8`Fs?PA1ny4M2HddIXEboxOXgidU zeJTMj58)=3Ev9z5- zdCaowO3?u=9HnfheYcCOHB~E$6RLF^hkJYG*lsq8)?`__)-$p5!)5v?>wo6NUgH}= z;M2=JM7Uwegx1Jlna_5wT~-rHWPFg)-twCjXCOw3tU+W+W|^9%UHde58gG2uR;P5g zP!Wryy*MT^dQxNkjVh;QQdC4?-K~t8i@fx=KqvCzJ!Z}ldn3O1Ad=N-slPU-cvEc@ zo8+<%&atUzB|GcRE`jp>J9oCDb2lumA+VCX93DgS6xdsT6_X_uo5UazGpgL$BJ9)U z2u1IR=$)2+q-BBHYYsufxF|2SSGPP$xJgg# zIl@9F2xwY+#~EV}jS3+yHYN_X^b}L9U%f~0nsIJ7SdW;pEYJ?s=!dA(|FlFcl9R+Y zjO#hcKBqs?AEbUFVd*%9vuUi?P2JSF?xbyaSQrM=pP ziH6#MmRrmU*KUxYx?kQ|Dq+#1#gG>S{C94|*wXF0KAkVLAilWk?85KWXCZ$}uyEh! zvpyq@3*rgt(h09#Dg}Cq-ci=K`V4_|WR?R{%h8`A*Sp_aWa!LFfK^>Pz|$uYai+9g zSecP{0qa(q8?;#O`V{VI7OgA9^{hRY^^H||t#os!o{gEq*mUMh%~$sM^A*3{_SLXG z)*8`?JnQE}eOY|bP8~J{^76%8g9UM{ZTgMApY;n|TAtXFAown#xEWq7lDXCelioe0 zC->FEhsNOpN~*SIEeW+68zxTX!WeZG91OiBxc7-~PaN!)ht(?=R0vq_eNx>X&nRNA zh;MtZsykG#n!l%#x6_Y{EopDQ_jV(D)YfRsk~}$xCUktb5%6c$xXJUBr&0VC!aFSGb_$dE7xHl*#AzF=q431auA|%5NY!R{+1oNMrqu53^p;%-&gc2@-la`>J66NCf24>RG-Sx(c+h-%>X#7;1 zyCD7*Q}-@U=-Q4!>}czmimmP6z0}+)i~ht657@WMYh}3HZ|yJMqUs@U6j!iA;8<3^ z`|ES}o%>Yv&7TFQmS28ZnejLlVz$AtRpAT>ygN|+;#hTwX8>0;%+^ue6Ez5zSExY* z%zNA1=J!B~&n#6w%6R|&eg1@VylpW}o6f|tkZO+C%vjYZob)A6%SH0yCOd%`!F;9a z`RLN$vBaQca`uwg@}<;-kF|SG>GzjJ_B0v&#iO~OnOmN$-Xi3DVDXpNV7}>oG3P;j zlY>=}?*7~@oQr66YhHssVvd%CRmDoprfjSz;;aMLKlIDmsc44j{?;?$YnnWBtXiMDE3-w@j!#$1q{J&>Q5HqZJ3Vm;cLvQ1*_zm+<@ou0PyCmJes zB%b4sv3#}lm=J>q6_BM*vLX`+SRBTYfT`TBOJj%%Yn z&-uk)eU9hzxO4T#IHtG)2OWpw+v$^opWON8>I*904!tn*(M@4k@E7w}%UUD?ubew8 z>lh%{SKT;$6!Y>HQ3Z)8g-+eF{O1~)q$@?QzePq9_tBfyc8xQxyX44on8^HYbSU$( z>W@{IyEd}q^~k?njBKs6in5}-Xe-P_^Cg5s{i=#8qwe5(@e=8wx9Q1$-bFU<)qtuUM}T$=!cx1oVQAowQt|@bVt%SJD8eM#=LJYPi?hy zN9uCpwcD*3EH#U>yl^@`KRGxE(IENVl`r-xIxNoewS=%JOZ&~zlh(F?_l;{T299G) z2JLFC!#GT2^8^07!`32Mm4nBFIazh=RCL2C?G=t?Ro>6I%=7Y#*d2A+@#$Q@;@Jo} z^s9N91r{xYF&BtolL%<`ttyRm5C)fWyToGh`>|N>@wTM0FHGOUIcYJC0lyBf0Oh|7 zirIlvxU)3oKE7}2MB)B6<1SQ_4TUI5W9nA*@{;%(O}*)#9v}FX88|C7rAyYEJWD)~ zD~v>;#lf@bk21C(>5nkYj6J5sD@lH25k|wV6sj1Qv9)PqgUV2=f8SRi0UqG$s&}$! z>&W-FJx`|1URbIcov5F8zf-L;wEN8qA6{_(Rh#8=a@}gW?6oRVXX`|Ej+CQc4P1)r z{&ZYj%8rj6b%e}~H|kqf7gSzQhsEaZa2L~#IGnb4`{n4hW4)cW9)@<^O;nkz+T`%+QZMlTZ%-~~P}QfrId zqkH|TPs`FrgI~q==9w-m)Z25gz4yX6{fKB#lpaz1{V+Y-IJC&A%kN zh$<5o7yEAS!i1*r>_v16j^QwK@1>GZkjv+&cPT^=CEdP&2uGjFbuj}VOWwI*%t9m1 z$ufmu`4y*k^bv8~HpZs>HKQH~EKO9gLI?yix7$VORK{;-|L^}qAXfjQ_~ia0j}br7 zn?B(69O!rb=LJ7cGDTTLRtP(_=_5RlUk}_|3;&EWzTOYayMo~TJyQk7_BM%#2dQ!t z?nvvk;WEb;?EH;?+>xX#+LDt7F#mvH>I#RJNO>WLz5H=OgX9I<%ThZ%(lv{6gOb87 zjj#++dq?agWtK+Bl2|Xq&%|H|ZL+c_YnK)<_n3ETTxVK$BXE>U{Kdprtj1r6MX_j6 zV0Q;zRI1CiZpCpm%SfnRIK@++=M2;v8{e)Emf;tPrTp`PcxNt!n!RM(d}+$>lQW(? z{9GZl#%ev=l7nbKA_AY(T z=O&HAGN~2JS`-T=G8uQX{q~n}zm_V<513nGBN#|go0j~aO~022TUb4GQIam{pf_ew zDkY|AmNm+K{YLzcA70VEk2v1+lVQgOd&3{D6sDc~J(1;BH&K_25hOq$oX~qg)Sd~8 zZe@8|zEqOxDP7N!5LB^d3UPP~iDgVnUqsS@p-T1w;sUz#{33pFnW%<=+I=v(;J1dr z;xS7#=QuljD_f}&dxSJ$V*fPy6r;Z~h8lr!7nR5{_(igpC+Bw}=YP$}e@_0%DgTZA z5WXkA|2cPC=4iUyW=%QHXVujvgp~F@xgU4ekvz$7^xM&*5k@n>FH-BRAw%^xV;mW> zhEu)WlJHTi*g>^$i`i~t-;TEjN2!n^8(Cp8krHAdk0C&T zngy)bKowb$?4Vr>L?^|a8ORZF*;V~q42owJv}LVVzkiDAIdr}-ixzTu!<*kIGHqt0 z0(yna3TVzEY(_V&`6{epK*L%`?7V{L;C3g{em@E;tSke8%pkYv&O;y`XD zK+QLN*`T51|KJOL^#EXO^GO%1QOV1rB!e%Vu{`b?m78uzbU0u{y-~0V+A#9V=h4#< zQXs2qNDp6KmV+Cl=RuEYw&!U5^1_#rjoONi$8)PU!*oAqH>59!Un3Df^`>wLhj?&{ z>MevkdgKA$ynnASP6-9qG`^ER=6A6?~J zYInV?GvApVIp3NzlY0pV9*r0?4i}m}qUF#C&hmw@5I!vP{9oKuEX>h&`R>-_&PnR( zmPKz4*_7vE-Vy6G$uh8VS#D$YEWl?|84)4UEE&+x{Q4zNe9?NVY{*bpK1TnmaaM;7 zS5HK$&~Tr={72jKo7?AZHbQo1pAb|3K4>U7l&!g?KWWt-XQf(m<^6mcjq{9U#gDzi zJnNgMpN{>q3g$U7f;!n6=HSQpIb%m*Y8yFs%5=bfQ7v*LqqKIl6+WNmI4C!cFbA97c)?_$U(u_+pRNuH6RtZO4$7oDZsE-q}G zr$8(Bx{+Hq=wkBtq|HDqTievSNw%~@?R!*XGlFZcEfLDJ>M%b!)Dv^Fc5kw&e|b5m z{}CKrVw7vUweg4LPKS9USci9{!XL6CR(n+d}7#2A0Wlj&PMG4D0yl1}L5n+^hkhhBYDlS*8d1VE| zZw*J`sFSg5G+tko^^Bv9`|6KMJ!zMIu}(X~U4Y+%=OeF=V^j#d?xG{INuR7Y=43aI zTSN6pdVbsXQ%}cphMtt;PLob^y_8t4*1W$CHZ#FgvXvmK6)?{1$AON=9%5Xwh-3_2Let@j76rfL=P;L`Mo1~DSzk*>jl&I@i$=(6QDn%N_8mG1tR+qGm= zBROilwwW!etvS~7lobV;1&SkLRQ(Eb*)>HA0}=iUiW6~`9&9=4&~zG&wS8vOFW(q! zT`zx+X-UaQ{O;ckOtc9MazD`~0X!M8gu}@g%qsXufkUEBcj-%+E*Hy)ivfpF;aIS| z<>TCi0dra5h_OSHBO6DTr2El*rY!VB^NPP$v-?6i*xz9$aq^P=D<^Id;dA^_xO_?_ zgY1EJ4JS9s#XHLvONlqd64OsfY;Fw}tdwTd{ay7STDqaTJF-{evPu13$8%0V5!rf4 z>y~Do!fZCMFNmr1gzD66Rl|yU3#%%0dj69R()RygZcO0Slof-owsP2iRD$?PjgE_t z85@J;f7*VKC_ixf{ul*Mh<_Z>R*q1*BeOQtu(E_7<$GMf;{NwqO2by{dOj@4liE<~ zjZTxyYYG(`wbw2oC8uX;QDc=PGwi(AN;n~IoawNh?#Aem}Y_YhnLl?z?{v z+Xq_~MUC{ELb~9({=rwaAOCbx#q~*(;PKbr%?t0-AK}XUbmGxOQ7C)+clkySM&|?E zPID2N=m@~NmDSfrPDKZV36*Z~X^JG4K7O9H=6~{d_G`}KHW95ea6?e(Qle@O!SwsRM%Ro5C?v!bmjII(t%@w)%;4g zYc>roA1l)j_8wqGYBNZK86e)gRyzjEiv9}WBr~Re-4&#M^#*3q8J_WXS zL+;bym{8>JMTb{e{B%+HPdUW8wU@!9%~d|U8_)a*FUiV&i>;!os-Q0NynDrxtIAbB zMmZFjti7i=lyPzN9Ilgjx*#-#K z#QCj2jaz02A;??$kF6ax$-`HrlYjma%_muB%nUaoNUvp~&U$yd|H$?6t~IR-weq?Y z0^^_k(oCa6OA%-~#sY_--7i;=`u_=dEDZ?X=Y5vNa%xE%FOXe&s1s@tD&eY8&2kV{ z9xq#XlM-bCI3di^cHHYN_|{1g7zF6g`5y#1{~zF}{}&$-!&-(7H;kD4J^ROaW^nK~ zZ_Uz~yS1hfAKzA@y*Un7aPT(@O=I5Q=xl=^5jdVAswp2zt1%y=XP=(Wb$==voH0O6 zaUkBZ&-}ZA93zX9_%#~&xCMMa-Sq#YJCP^a^!#}(sq@oQb)Q{B_>9Gx5}z~2)}I`y zawcQNm0H*z9&SEvKxH!oL)3%C8l~Ny*om`NF>$|$F^xPdjfnQ<+Ow614S9KI(v3NC zr&cH1*~B5(0vFJEjyQE{etTd~e#Aqok(HANu3zNbS8`_7UsH5J(i@Fo-HaS0PHak- zDv^A@S&bR@I)09%rhHzXJy~6FNxR{tQ;7cTta3R)=$EaWvuXAE(_{(~r$0wQa|BlLuY!#SjSV^t-@_#(%EX7 zW2|TP1HFG@D&&>l?325{@+u3<#UgPZ(yKi6EQsK+y`17iyoFK@5N_WYmK)bkM%YM3 z=d|XQU)b~T1bkOv&^?~OCds!w&D=jQEh0LT#PZIl$hphq-2s6ns59!u-X4%v5Tm$xbZYoGbdpB1h;{FYB^0|-S13{taRj*ro zUJxvDCuSK7^2$dt=2C(w8C5CAckWy|RSU!V_q#$cg4T!0J8XsDw9u{l_)2Upe_R?- zv&thE{F8hA;42zqVss7`NqCrXm)muH4S|oGT)V8wOx*}0*>|X@sv<_9w=W_->g$wg zdUn-6=fj#xp(=9hE*$iuhJRNUu(%!mi_gjDeoHEAuT`pROAKAMZ-r6uJ#1`nsvtwo zp%W_aW?La82kOyx8WLBqby>N>>n=+E3kQrZuu8V?g?J$OsFm`%OIkYwwHFKpyD;%K z|NX8LtlK@O$FzGetgEj>Ov8K~pNU{iIc3u$xc_xi`H$x=#(SXe=>KS_-c#c)B%Y({ zFQzBm7=sv`&sYh(iXTY@TPTi+xGihO6A9ViSp3atzVM~9-;1t=PSyoI^z01dJ#)*s zv(c4<2N*=zrm@WBHAWvTn(O?}oncu%c@}nH=1hDIJtLE8K(hh|W@r7Cl-p)fULu)x z@971>&wo2BObD~DdhGhn5Wa3XKD;11WjjZUfprNTD{iTK#!6{k`|Foxv!~~}qJzji zP1Mi(&ZC=~x5UTp-O()PG2b?8KUkn0iMycipAQ0!s^V*yqe~@x&;%LLz%{??Ts5a* znAjApBT+r?Z#}OyV%j4-&&sq$Orc90g3hil7k}I$;|-;akY zZ?rN|T*5L$V-ve}=Q@TrEr{BG*Q_?{$rTIA=cz9}#pQj6j*dxedDI(@BkI>m5Es!j z9)gI?SRqAZ$aIv6xbaWvbqrkefVd+^&~Gl&=Pg!P{Bq+TD}$)E)PonZ*`faDHu{Ct z1?abf)X9`0`w;61I%DAe9!9^reMCw-Iz zvNSlxjldQ{i4@^oTzajD86!* z*j%`F0YQyqdL-Y}vQ`@8m=DC;cLmFlI}il~B)&yD(&v?QOJpb8A)Ui2cUoZ0>{^Re*B zx!gyjuFsca|5yH?jXmzWGvVv#6-G+$|JJF+1G(QtWf*O;uttPH-oRzx2*VjGzO{Zf z@$~%dy9Y86>)0gjUf+svy^*9~{i|4x)1tYAg(EPBd7W$H=~Ju!1mL1%8TMW+Ufd)J0}N^iN?Re)LCghw)71p{CeF6RoOXeXvN}O-i7YU)HL0M*l{aM z&pa3PX~oj=ZR^R_3-mZw+Bn~ZGq*xWBd{*%<~UE)DIQTs^Dn5@+`ojt!cYo{8O&qe zwX*jcm2JvQme@$&eSmO#Ht@&31Pluxk}PLJ2IdUIbTfM?^Lc<;XaIdFhKwH@s0FbQ zWW{8?vOHXLf#xb=Qb<7C7M2+Z_(e04OkLXF*oQ`R!D%f(vQ}!o?^v}Ki_v!~-Y^n+we~aNT;U?__cgs%1y`#Y9LOJy{#iGM1AcntFWM%C`QwUQZFkZ{azELg1%T zt{Pgy! zBqCINdB+2iuUkAvxHaWw*c}2h4pJG^!mjo9I4!Day_Sn8OqK)wsP*K zdT=r{MDa9d|Jcy)@o81XN*I89dRj(_VkbYP%E6iit);8c@fr?S+{=A=4E1m9WqFi5 z(_v(nYq8Ny2IHQoQju#9<)>z`ZHABhw}@IZEqL`vDId2PHA!`MJwhPgf;cf>1JNWT zbCX0j+ZQIs#$T*OS@6yFyEoh4*Kp-EKXHZq9hO}g05zoCCd-o?H!bL42?|;hH+i+h z*S=%eICIWHI}_rQ-!Q64PHYcEre-OFtdNn^jzt77M7X?^xp{Bc{4v`Q#ae0Cp0aPp ze?5GNgF=I8QJFA!i$uviRq{-9mPDrS#ju@Nr?F;_R= z281Sw`OKaxz`BIY1dKX-0f#(iW?o3mn4juwved%^-WF8pf-e#@M6d*t$d5=`42v%Z zv7dMkrdjR)G5sncn>e zVmdG!Vhj{im^5m<|1UBHbr%UEf-9~e_|T{XmLB|nn;zb5AC@~t$}UvZ2T2i*N=G|* z`N1HjzrvTu;P(*JeOGPhesir97=8p6svr^nfg}Q12l)M^5fF-cXWhXjRz}ARvZR&?4OYy;{5k89Hd15l@JRnf86I zlGxm%E3qk&`&~~+)4EC+W3=2|wcCs($u>$ct%*X&!!LOqI~61+>KJ6uK)}lYo(u@r zH*0$kEpg+hKs<4WPcywwh7Nf zMmg?q6Vx$CLl6T80T=@0OSY~iJ$XvWx$CdOhtCAQl4}~+WWJ$kmcCbgMnT|>Aoj_X zx(u;4AQg0H{KULC6_ZY!RWrU}P56;cPu2di8svlNZ1e#00W8J$Za`jB)bq2z{NiGG6z z5}t|JcN*`oIFGCQ)FK5Fy)(t<$Z!rCK_N--Jhmu3OC9?9=BUHP?<(r%JZ5M&Uk!OKwEN9Y2kh$@7u1qN;QzRF9Nhq=6(z@yy6-OzncQ)5LSrw z^*3Oi+nr3E3*|nATLX8?sJ3^m^wMaBptSdaxzga7Vf0Et&$4-VUnuI zk+f{pisLG^y23Kym{ElY)2fYlnupzQml@-H<#N=g4lm~+AI1Dyu#D)z4u~0I-IlA+ zt8c+b9@yS)?%*`W-&nfM%!73iHmEG98F%9!_XJRHEK2zcDMKlzoBarH?Yjp$Z!+)n z)imeMg}?f4S(ol#DVz~Zvww>v2~j~%9saMLK;U;hM5&Xeu!Xsf`T9RzKeX(A+i>#|(ajL`LBPGqy1f)927Vvzxi_ z4zidl8+Rynr#!6Tc5)qG`RSiTPQe{L$hEAs$BoEWDBJbu_2mhuxR&!!P$*mORA!wr z0ZO~LaNXm%Y|>dhtIsf0?r~|ovF_(g8XRSQAq>y`<_SvU;}}G8qL0G1U@_z{>nBB5 zo)5{w0#N=Guos&L+CZA9?c@nBz!b%^?lp;|=tCnbKx?YUalzY|UKd+&8?i|;eNT!r z^%Y^v#;xm*d&*+`Ibuds0xR0aCM`cTS03+Ib+>9lYhilE>bU+~{oxsz``h2gtX8(FbR~bf;?95yVKZ7Q(X8^S+EXk#6IpNe)^xNrsAAmItGN|E6{#J}M;> zQ`Y$cicF3zgoR`LX-0^km5k(I~H)!~LUQkfP&(rlb9(JnW-Q(jd zG5~7Wt#kZHE6L&Xnko5ye)iU71eUXawm+b$WE?6!DxC%?;?g_(Sv4LpG_2Iook;K7K40(h0mfWodUP-8DL`j#TaKVaL3(gR zI39M?<|K;w1m*ko{+5AOO7e!$TV$B3 z=#}UPnxxN00_niRtS?mbk28jzXSdQD%l&SwKAB~ZA9#-Pa+oi}DG8AhaB$>uwlI$Cva{dMG6Wu1oUr2m4Zm5ZM?8VcL0(l^atD z{s%U_=oD>0q7d%MFKc~e4=r`q(yN>nz!{fy=K|%OnQPsFQ1mSbMS_b}h^lkq7@!6$ zri!6)xbb@aE1^~fQ46BX%?KbAhUuywx3BKD;SJ=RPIDN9e2m67_}3?m*ZiFW3>-3> zZZyHb#9kL+m?%U$mV$?caDU9;cBeZPw=4sTrfUd$jNZ6kBEqZ1ED?NFZMuov(LcQW zPwgb)dp&F3Fpl?TSq9lB^=T)`dSs86le=$jT$eKIB%xuEn=|FImQG~6n-;|5pzT{n zJoUMwqW>EQxNo3_u`E!V_qfM zP>S%Vw!!QwB7XCwab!eVR&we)KCC4+uTkp@2q&Q{c5ZTyZ~)E!1us09vv~p7aj4Qf z3>P(ErUpOM^0(Lfi%B-4cEvN^9}APxQ)|Xj9_Hv1f&+2c>NnW&g3E#t96H#t=DGX=-*6+8}Yi`^eM{`OC5HQcma(@80I>8yq_yUWA%9Nx@T5 zfEeCOjh`HSn7feZfa7ykv;9JAbf9Bn76(vLk3k{D2<0#~QbA%FKoLhGrzNLL16 zL^DeVc>FuIGhktryAtRT914&L%4~$O!i(@W38D%xZ>4$pXMt&Q0rO!Qg*P{ZOK(OE zY!ZO14=ixM>Vgfo%k)gm`bcSD^r|g52tz#u;I~dX5(^+h)`SVBK3dWl%BZ11w1IC2 zxMva?As>R}-WXu}aFTtIfb-h@iJ{YDwKSnm#;I3cIb~W~jE&W7!14o{AUs@E5D@74 zQS)5Q3Z&}baxFUgMo6?P>Mhb4cfr_M1XU77mPvpMemliEZZlYfUM*O+y4&s|v`{4J zLx4pn(gT8`hw~t0$`qy)W)0=$1Hwk%WEMK17p+9YXu2|~UI#iUm^o;Em?%7hq4qyw z-*~N>f7&QnbkP4UoZ+Rmj1k9@~S~%EIXA$ima;{ukl!`U}==|{5?4P1lvRGp??&(nYLS$CaPP}b(E!)%v#Fk z49Sn}wdFc&e^E;Q0sPa0NccMqmY@{*0%zbeUs=M4@KA;tWCFxXIVbtGs7K&XJ8G4n z#ZEgnkh>D3_*xEH;mzYo0`2$FOn50 z#kwc#&-X}yWig+3Ah2&DK!-m(=0)0d}@4tWEu*T^T=eWpe~G@ZEI?+q2=UHL_OSDFKkEo zCR*ZOa+5<*F-JuKdV7r zZ@Ut7h&EvcYB6V| z?JIY@s4nHh)0QM_fTcxP=mQg|-qL&=r}~s8$*R)2RM#pUkPWoq0JI?Kz=j)W)_~%eynJ=n8<6)%=&Icq!rP!Y zeJcAbu)nAUEuyAgZF&9PiU$=i>7QsX!syHKiB4MYpD&3YiAtbq+2y4??CD0RthbHMi#b}Eufmd>u*-ioHwA0x~gZ41y8N5eN2F>N{SffS_>kJ&h0c7K?jk+m}fMqy*=`5}DlNOEPsd zpInm$XdX8p|$rPkSA+E^>}L@6fTuy z^zz7y1x)^7$oJ<38Nek#Z`>Ue0}2V+)!YkN4IIjPJw9N}7S$im%qUq$byH9_J2_57 zMB~odiX>fb)dtsGEZEV{)YMA=rg}cNcNSwr{1_It(wPH*Sni2oekq|#Y2NPE)kMA> zn>%@i>$-7}n@pOd)**+=Sjz@nw1gf9LQmgQh{>xmz=-Po#cj~n+XNGlq|PJW-J$n* zM%k^-qRov~_sVR;!ZAP-s=}j9=~@9876{tRbN$#CGO!&%jYg8F+A1T(eiITrszn#c zeywybCB>fpwacxfU)dJ&Q`q}NXSff-IX;uUmauVP7|XL6)#Feqg(!tgOV)5%L!law zpK37*H@;ysIla+6&e)+`tT8;=n{2q;9WqB}%}5pQ(oz^O@VTdK@uKlK$LmX#SKGXd zVm)V};>t%cy`*RnT0g($;rOn9;-C}6dk>^&9HrWkOkUx0W^NM8h3srsHZA5ynB&|b zAgs44J&wjM2vZ7pVZ8#fM?f{8^8T7&-BTGY`iLwp&U=6Jy7Bq?1;3OjyCb{HpksrX zEt~^k;@83R=q17!C)8e)J;B*eB284h9}WQl@_9K&$w74lDqmDn2oR6c`tjn~n+yP! zu+%{n_@K^J1P}zs)?O|K3Yxc5hXgeYC++I>m_6V!&omrpQGNCO05|*wndK{If16Qg z%fH?Ip|U#+@W=dMAm~hZo)%k*ZUR;)&{S(&iEFq}vEdq^wdGxHVqI*_NzccKq zw)@UUwJr)HHLYLJ<+ZpDXrJ!=3B5kj{|OWXRKci*)ur`oNx4+?-Ow+d_e>a(Y z#N`b9_2qls8^YT=uO){brFtL@LZ;`)!!A#G2A0QPBe~wAvtM=NmKg9u@dZAq49{uJ z;wZ8{4AHIpDZb$ct=HEB1qw$|0$#sR?Q)0XQ9yD91nO4)V$4?KAZ6y0h(a$saOAyu z?-gg_DZgLIhcdv}&za)A{C73}(l6cbuW5}dCmCzn%W)^AWoFU-w)1yDR)+Sq1pEv4&O`nrfH<H&h@pwNgZ4u3i^jzg8WM0~jRquhLg^SijQ1(=r1U$SiiS{Am_02mt&3*BkVeIh?s7u_s{IoUf) z{Ay0yd&UF#NmG5q1aJdnNN9gHToe;k>s$R*%Cov2Le1-{+zj7&wg#%{qHFGz(I18b zf|laN-4YQ%$_ht3xc^;y?X(`qB)f%Rl+LIz$72%Z$O{f6SVPs0MY8)taT{vJMK+y+ zUXwTK*hbPSzxFnpo;?{U7foaYi-hPBfA~M58JPgS%+tk6Hd_&pC_Xi3#xW@JWEi`W zzQT&H(k(QBt~u~|(QvVTXVK4iLpO35T=%s$ZcH7DY+)j&EN{w+b9`#;84wjo1WZ~; zQ||iF1Jkt4Jt(!cllAH6fNKF3N$Au1W3z0W=<4+3h!U>D-_eoLz+7D?D>$dZzQaWE z_`OVyIYXuCUqjB zVaH3-O;!FMio)-To&AG{_vhCdX$g==rrDdJ@+6A+pnwjy+5(KV@fUZfC=Ot%9*d7) zF-scA;!h8|(uJaFjxE)Vy9@Ojl816H$!j!`K6$+L?9L2iRoKXM%i{x^4_`jA_6Jdg z^SUaDKyBdDR?*^8cCl~yMu+n>D8T!h_uQ=KvOWccyBED(%;lj`h*#(Bq`xHnkAdKX zEgb+;HZe;$hZfDsE8~zm(y!^{m#lzhNMtNsl5liB zs17$)&Ndu?Eq?>-WVKZP*}vs^XU?LWQ)v0(9UIu}wR}bwh(n?%6_`pXMGnk1(19{a zN^P?5ien^185r&CI`$CX7|M(v7aLCy$={I>?r{(ypuGvSz>EBHVj7B7+y@&EBExNO zyy9aZjgtQWL{l%)6+4{6G2zqZwdUI^KnKa5&sJx#LM2N)?|P4q2amyMxxv-T(ThhV zp43Rq_}7#RWezk2Adq$szzTtC?2d%K)L;E!C^O}>rfrrotvjoW_Mpvo3z68@SY6$z zC1ZLl_aSP z6P91~oYwP^3B0W>wkM)@&GSI}1^ySvv@F*Ku9~9F@Ap5|2uFojRcMy)3T95QxkE=uGGYq2Q9z_D@~v2aPXTvIQtaA(3MIodN;QIwpJ1`4gXR%rfa zeVE)8Fgih`fG7cF4!r~P7&OVMbl`KfDsB1}BB$Q(VftkKNoTpxQ8e;uQV7tjC}^L(4;&VapD1G?OmunPa^EQgNOl4E1kN+w;= zQRK^?ZyQk`TeTW21s>byK2@c`Dl|)cN40gAgTlg$9v&{9gA0+!q?-Qurh0M3?NI9G z(X!UQx4Pi$IlRCkZU0bg-uSXVPzC}={pFG32Ki%N6QtI#Na&4=*CO;|NOz(1h-|+T zwVS+=0U37uW{4G~05@^sbtjV8X~UhWHujKm^a&#kaMBi=(KU_ z>P>cp>JG&32(u6{u0Y#m091*1KyJ+!6iW--Q0)rEi<5hS#sExqZ44ISGoyWw*NBFtlP4>*rI zM%Rw;20V~MvOL?H?6x_@uT!a=(+BJN0ySsubeB}wZJYTH=>>Nb6|r)JJ#WjOWSqXf zFKsVk*w)6?s$Xl~7eQk-H0XJ#B;!486~ySu?;ono-aFq+PybW->_&4S)PYX5W5Ac{ zAT|SkC?2)|dMA_h66La^P0fIEa4ZBDv_6HjYtkScE>F7yQ5{uo1&uh=po5It7)r!^ zTYT`mlK|s^H2Q%ytxQ)8WPpsV89MPNe@%tg31c#UY-qS&){?ApsgGY^#65^2T>qdr zzTR(+^Hh6%bXWVhu^8`0qEg*rlUdK9>G>p^ghkF8Ebof5=IshP=XBNuT^^#t#Y>)R zV3MSm7@0h@M!7FYM#bmm?gKx=^_@#|OhR`}rj~{9goIXD^xC(6VS#jBcdZOKy<(2w zC@EQ@20B@wbu_hIK-0#gy$%OM6xY}St(N>$7EWpC-t1W3r8?;j_vghf3ZSNFRaffa z9PCYAc@T-EM@O>se0^S}e4K5|(RKyq64>BFPLB(@ykORYMb48=t8(C&%>Qmr)cyl5 zsb-)&I4Sv$*C6|*p3l@^lUx~R3pvj?=i0dUIf_{c?Ju6V8n38j}PSq;0&FkPs$e3}}Q;0k?23J_^(|$zz>@gCLk* zml>O#K;4EtmVmYjZ}>rh*K72J#R@_~x3VeRsg(a0=(VBOzd+fn3vCEAQP8Zy{$O|o z4pp^eKLqudW(m>+c?9&?z`y2df z0Bky?r!Sp>=wc2^+1Zhg?v1woF9`mApdL7sLLWx*Cj>GuKrg{FYNhrM8(8xQg@Gk< z%~IC`)yrxD1*7nS^ex}td-~8C(65&JVMJ;SJI&UO6ibXjw_SY4cH~;cQ(olrkI2BR zq`P_0#3~)=!k%I1SK+Xc5%G0k0YO>|c6c8)M;D?qk8Pzv7#JGHu{C8p;=j~SW{%#Q z*!JVi>v%Yd7UzVhT7sw#r&c70-=W=SEg$GIxbC>!{<)2}oQ%F3RodxnPZ9 zBaXFnej#aIHDD|ptK)E^1B{9w!9i7d^g{(rap@V00MDl=d8eCC{xl~ZAI{4 zI81=B%~$oiaG{&I=|IaJ1H?i{D~omZn*ov^Ekurr??YSj!hT^7fPg%s5r}D@qv)_m zV2&a@s2JSaQ?r4khuy)gsvd3GI1?ouTvyyP{rB&-SWJL8;Tv)YUKYYKE9J>KKItL_1~O=n+4Xc!_f`dtD7*jVEP-P~#sANw(h1gQ@=b?FAoA&63WTH;3a_Qa=S8 zOAxT&`SN+~7}H&;;>8dc6qtk2GP0LstFACn0*0$3uuiMm|6XhE!Bumt;E4OI*LuD+8|d#=0lxtfVye${3_duFb;j5)S3iK zq14&P=Mh&s+xOpHOAl-Fb@i)jWQkyY~|I`2zSAX^q$C54BL9dR&}Qglfg1i1_GVBo+McHfndhPj0M;C*xWT zl{>uz9z^|pzTad|GEW+fEe5b$uhsm(H)d0u-j}5MXZ$D|9_dcSIh*e0-GM#yKj1JS z645j{3V6cZ#9p9Nlx>#^S2>|vJ!sX&!OZdq7TvJ9rgRu>u)O3~&i-fsV9UVygCs#% z!+<)A2*^!vq%MV@$5kEs`z3VTaXDWT3)Cn5EjBB31^=oci+gzHOZoZ^ZfqY*q9v_; z@yeC&WxDu3ElpX};uccaI0$#~b@~W85>}!$_p4??c82P3#ugehMxR>R3eRxQJm8GN zH5aV?h_N_N@{Ilhli<%k{O^y>B**$>$7D|{dU&>62+o8D{7s$H)6>!=TwR0nDvfj( z@;6wXBr|{Y=qOc%3Q~&s)!Amafk-+*Rks}nxwRo{pQPTX)7rvBxnDGeaMNy?3nwp znYR)oh1UUpZ^;?xgox%miQi{HPHgJ^%sq5Fd0rJ4+CNdii}kmgBkmdreuhaO-bQcU za=$u$HK*O#a1@cMgNw1V(DtaRr{FmE;pMcg!Y?gB9!MCM3mgqo*%Fi`q^Eaphe+-do*HR(Hp75uymj_Z z^vaNYk0L%Am6;ipmaK>Pjm%Uwy?GR2s@W-$rqAV;pc7s5ZtBz8!kP6(5o2oS>B{)w zx&H2u`biKnVM}>JskE4DqKl;UE3538OAk%*sTV!xqbB|IlMKx`(X=gW)3^|_mb9%A z^6I88n+w9rhQ3nSRI=o+^$W-}?T3yWaj(bL*v!_-^Le3WYvm8tOrm(yAg3ah1~uKt z@d1Gp&UVLur=Q9J<+ApeR4wY6oZU%;$t(+g?5k3C%X-@9p0**L0g=%`|M2JG!T5qX z+b>1bkyZPDIcCZBwOT!9$}sPfGiK`4ouu2wRZ2fPrrCdap((50|75efW?z)f@5tc5 zRhZ6;VdT6s|LaG`fh!C$ztb2Po^XXyWW1QISxKh~F%7zi1Zg~fA#W}sI5)p~SV7HZ zy8B>oS48ubV%^7dRya7>x0~Na)jIj@dFQKjz4_+ANX5AgZu?XwrCsluLjkN?AvCbV z5x3n$kxAL$6;XKf*K`>l9=?ibavq0)lbD#+gz}Uin)@F^Ulqh1jvI^6QWtgBOjw79 z4)W$v)#&fp5<1N8_^q-0FZTX2s_HL#A4RvK2uK-(q=0mHcXw_&lx_s1OTUzKH`1Nb z4T^Mkhje%MSsVYq6XV=*$9ZvH-EsFD_m)qrnDNYK&b3zarT%Ko1DQ{J)2gE`Iy6!u z#v~8CYSE@%bh9z)s`TLtU5h)MEp~5j`7s$4<%8tqCSH8Zei4xNdUrWI0(@Rt+cAG zk+aXMzDxl_H-GT(4fQP;wZc5@+b%SI&!gu=ZF4s?jqeLoj()NVqlCfxiNk@m0+q@- zcZ+1^uPbeyxP0)qbs;c-LrPGoD%@R7WeaO^u@c?`FSrxVY~XLqi=%o$mh0%{tcYN{ zxXdZ^y++=Xs1=_goExZ{yf$8GVM(;^W_FnXhrDh>qbhyez>o!6Qe1yhRo%sDi7*L? znhiw*b#IE>=Q5VB=RmI`;gf!yI%gT_;#j=v?d3|`kg|CWr!cm@V8Uo~U8;wYs&V`$ zj2+s~Ih^r(8evkEt- zPAwH)reAJ;`HE|Y+*K$}FQOtg}(fMdsaItA3gpd#S+-}2Lz66PAf^E!P z^=~gY7vp3ug^)IE5vgX8|9r%Tf7~)lhq>qa~=Bx-wObG3Y1Z3onFi20&T!{bkrgTr{tk5V*zyyo)t zaS}Je7Lo$l-@p!w);7WAh?DWYHzh}dwEw5#;#beAZF74&b3N7EGuQPkS<|W@Lbs`* zY-4qaaPdy6bMH^)H!$l!B%4oX<+U*Tb=hntUZiT{^LWW_kJf^gll8WGKE$iMI|CO} zqLBHpNbrm865_AIya}foRQMK<58kn$?biZtw^v0Nf02p} z8c=)^k`Al|PxboV!pkH#`P5pDlA>=#g(Y*-b(TP2flV?~{|0tDSU^>qT?)qjtz9{d2Q|-A!YA}iHUkvI7Fq?beDX}|4 z1eQpk@LzA8zqGp>xM*zP3IlD7yFK-mEq>W>uRjb%yb7i2n2DS&q~&xVS83h=SnHI| z*inA{8HxP-s+-M2Q-N(pI-jZYIO!CZzt!%(hW{K7nEZV%7UHUo(gf&!8GCMA1<@Pe zc3fQj@A|{&jCipj0(7uh8u?l1YVR)&H_~ecSyd4~(GDwi0lt&+of}X)7MeWR0F^gi z|2>R}C}dylm>P6HsNNvZmg!$&v541WJ>BI6R`_;%Y6Fe#W@2WoYGk(f!~y`CvkRKd zi?H!NDljbg^wR@DdvI9w_xg$j{5pGFEU(X&5g`Jj2X0rJ!QARP-|WIVSy+T8m6qwUKZ@q=Z~n)fF*eSsoMz5YBmO`@1zbJi zsqv~@2#4>NfrXqWtgUPpDFZqZkgvPMz`kQoyriJO-7f|fRQB2lIiBHjzQJLLeyWbs>~<%)N{s+ zVLojaDj=1Mrw!9dottxWeHhxTeD)mDg{oxqA=_GR4NN}sHk(Zm#YzkhAEGAOfxg8jPij{A5iD zR}rx;09zgKGj6*cG>&DH4!GSwAe?7g3%pp1ce2fy64PVP@VRmj^O;!2ptFe!zJT@#m93NYAid!Ou8pv=e8wI443rxqZidBU`a;-$>c2ZHC{{6n;< z3z2y@LsM_Q+|K1*p^&{f4t+0vS&D#ya#F}vMVCdS5naFClS_Ch*PIDaa0e;}^ZdX^ z3KmF~BtRF2c`g7zV(#z+bP>x95L0*YCt&*=peFAA3d>X$%~h8Xgq~MN!|pF4BYJE+ z3ilfxI2RS8Ih2e{LGw<4lgl;H0y1p5%Sn0Xu}*$L>h1{K{vizd-J>>_Q-#ptun~se zJMaH)A1p1F&wK`vkOZy#{1Jn;S@egz?NjI z;H;~$_L;oZ2dgtBVj@C;OarJeO|{qMTe{k!bMT{O`ZDCQmyqKw`}X4G#-Dlm^xLQ& zmGl(Q(LeRD7QcsznFDdN(B+M6U^nMLOO`fsxhhuN+PVlkyXlP1ZaRlM0nS6F2eucM z!Ykc5@?Xdz1;KAEFLbB)J`;ghVosQwZ$SUV4)%OefA}eh ziQg4!Ks{smVSx)6N0(so9fFx7+k@djA9RCBa>ALTBcMMWcAj8S83bZX4D`fkbvwl0 z(H$>7K9Y~`;;+6@%ADJ21qcnYS_qpgJOMhsBNtn9oB`@uqOI+5xEljJ;7D}L**HMg z^4d6FCz;YC(LmopyaY7E5g#WaXKWIOeNKzr(L-s!Nt?NF4#X|LR-^GGbsUU<8xSv9 zP(L0;%c2BOE8XM(QAVcta{3@Uap_t!Gx`*)40T^#u4P%9CqD?rZ!QF2M(uX@VuZP4eSXI4q0q4G7PSdA{+4P_&@T`nfB*-H z2!sMjnpj8<dlx22COgvT7p+Ao%kAzL&F>X5vEdL z63KdnC^KWFrY4#Vf#qc_C5Xu3sa#nBzIxQa0_GE!hJPKJe(Wz4Kj-rl2M_9*XNiq- zvFxYzJa?l!UdT*sx*Q-M6{T*@|%Km@`&U+sbNs|p`<02aHHS6^=zP_NN6E%HwQCB2cY z>3WQ(_JGiz!YxkkH@%0_aHA!=Wf?7)EBD)@(Z!DJdjC;lJ5Szqv8?M{aBn#|1ZaR# z%k!d}JF|T4TGL=KELN)_Oo}k|?koWqVGS1#m5+8*CqgjEl0gGf@^feCJ5RJ4Xlhf~ zq9QZ(aTTL#ba!zy2!eJjLcVoV-rOx#FFshAWkd%7Jnsdbye5>z_iJ`0u4@f=yVpVh z<8=kSqZYdJx#08kpF7m*(Znybb||WczB2?p-g!7o%^>#jv}!6p*FqR(XxR>Gu?cBu z0YX-Dw-#yQ{4Z$KD#aB&e7b zspwe*7bk`26j{p|fyd_sP-Cg(zH$LuvHh(^8_|Fy#_D{z-hT?mjFWvf`LJG-RioFN;}gM{@eLG#W%j_ztvO`iBcB% zi*^%=IFCSsixZ&t%iO757%d%v<*@j{S}yzK7pF_GwSnj~z>xC{E#?gut#4XRyWcDx zXbzW~o&(Tp=TN4?*bEqnx`Q5~=JGsa)w=oPz1>(u(9`!j5;5tt44mUv*WtIWOI5uV zF(C<{Xz2~7Jez9t-mbPWfF)k~Dgz+)m-o8h?l>+7KDyeCq*NakZkT&CJ+$TVD4KhK zWdS$sgfWcBVetBenc4e2fEHL&;bdSu0}Mm+i0w_zgfIQwxpKaN{YQOsKm=Sgs9KiO z+>VzGX8*2%d!sy}l?Lo5IT{g}Y;aF(rr+gjAs*LB_d2M{jOv8i$x|xO+O)$6D&g6R z7CsWRA5cAu=#HJpd^8otQ_0h1Rc=D==acM9iD)^cG-vdBIy;YUwGn*#R`M&?~?B6Lj1P@acF?B20vhc%X#>TSQPlKVZLCCx$x$ znSec*{!Gl90P8H#i?ZutqB|)?xLJxYIH@~+W2SH ztH_l8ms}j~YXN%KEIVM?EYJXCs?N06tkG(%fJSk>S;d;BWl)_^wl(`sUx!#xnqU-OD8x{q6;egcW?EA^+0{p(bPgY5UT z9^PJjNUWHN7EyWkGub=u`mqgT?N+aIhg%*tX!fI)+65M?I9lPvjHx{pFbk}o+t?T;npBexo8Lv3 z(_=_Q6PsJ>Txc6n$Bw2K$Q-R!-4bl`@NYs;1sj^>*oqrm6JV*O6tXDk;jz_OBM3 zu*vH7$=Y$560nGp#YNZAnN}`!ne+G9xa_r`J5{+#9k40jKH!knxWmniiYR&=v=&2n z$=A{web8U{mv+(P`4O0XFE4W1pyO4_v1HZo?Jt9ptA(1wuR2vFUKB+YqGQ;Pqg1q7 zedcu(o@Io_Wa=b@;{BMeyT5FUUSMtw(61GDMy)5 zx|{~Aqs?9EUDcV3?CY4W-5WHBMy^}?o5Z+@)BS?`cwAF)n`9GYhi7H-OpI}|oC>AW ze}|f{$Z8`JvLl6+SN}UB;ASC6*1w40{x5}C8f=hqz^&SNHB9QVnIEafTzEU&us+$J z-#1StRu7)0a7xg)A zLV8(PPRX~AZl=OBM!m&zLfkucTW_J8k(?HRE3tnsEmCVgpaz{E$+(vJfSTIGj%HIU z(jztEphd4uBwkm{B?BWO5nTkv_qm`COOBh`TFcr^QH@Wb!g907$c`dc8w~y zvE8Yvh2Hz(Cg}0D8?aXpW z*G_q-6-08!_!1HM0DYff1s&sy{ysUa_l>3$CvT%#7YmxQ@1ZXuBf7mgM@Z^l=G%WG zbiG+sG;8%*2*JXsrZF(zBB+0ujP`8|wKVP?6Jm=+nA%je`X7t7;^zz7nAOc)Z{n+F zH+YP#E1X2=?gOVMa+5J@gxySh&@nfx`$_Lg&QME>ZGPb_h^6)y+e_$AU9%hr-FrwL z82FsRi5UvKvQSg27nLO}{bTvrhkr^)@)MJZtVVV?7`h+&C;2}9qBqWD4eCs8ucV#y zMC^Wx#Kra>cnvE;Qz&G`djl2jP!Zq1FPi_&_sLXQ#lf$=!Ij+Qd1$)5+Bkyr#ygS( z*$>T@Ij$r@Da07NR)KiQxyi8-VeCyWa-EGY@ddL@mDb>LTVTW?uxS+}Sj|0(-KD&i zo*)zoMe3Bv>5E=j>&ZEH!1Vv}>Ed8^#cHO!;V521bHqt|AleswST=x0$CZLc4S{$>NstA+yc+;o**+$T~#)oaO|y z0YeC(gZG&adg}~6vf~X*E|Y%aZ*jcY*#5DK!Qr={1Er?eGYKAJOShkvxjM#WZm+DA z{GNmAAfjs|RCM(>D~$U;q2a8ayL-kfUNK0Z_hQvJt&b^l-nK<`eM)%;4|?Lvqy}E6 zhfutGXHzw5VYhqF^5)qWEzwdfmNQE3V9i!<1J_-@YJ>DM42{|X;s)+b3rp6TchSY? z8T;?-p2oIXF~8Z*TLG!ARz2sH;knM*x3V+Lv{VmDd=~kH4WPcIAs*9l z+6>b{>CqxTbgrb9teM-sNcZ6=-*5%}+3COkT-%t5)-H_`G7V(j_gVvy=(J>kcrQp7 z=}QV@IjMi#A_tn>6;gif+v~qgjltqkWf?^!T>edQ--^OL<91(ColW~V4f2Jk%_YUM zAv%?cJG;(<4xL_2QMNpcF@D-Xa1fh;iE-Mwcj_5sZu|TW;@v{wrNj6b>wBxI9fq3v z+Xzach~>u4+-w``u~&%j%%wjA=R18)9oa%Mj;YrwVkeH|oz)|eg>A}MTHJ7MMp7Kj zMo;hPiD72p=O7uFrycdw!UxoJdbL<)%`lw?NlpcxqWNuc_`5=fYAq}L|-MXtNAib{r8YQpb@GY=xX zyOEY3gttW5Yl~+d5gnLn5AF(@9%q9uM%8&yaPJr2j9~6O?EgKre8n6$Xf}L}qF#^{ zk#jMvB7HjT12*90@CbbB6V6XP8NK65Y@dx0{rs6XU#@IbwVm1CuP@bPF~yqPRL%}> zucZruP~dMYXDU?O2yxxAWad4Bbt&19+XuLQG`~fgJPqV6AhI1y?2y|e^qPN@Yp?#A zaIkII4@ z;_Huv?8Un5uCgH`6>sbOoWF@46xrcU2NSKMn-+y%B5eNn?@;9oF(9EJ8GWOu6XhfP zc162q9Q2~n*-5@h+M>s4JZ;^**d%y!6MEF%U@6uweI$mdYsPAXt zZ-9#{bLbJ0D2}i6g0Qh`HtG^Rn3|dEnJ9*Y8||HQ((bc)|Nh8;UCnl#LD1s^CbIxS znmC;sm`pMyO~uD zgX<3QDDd9A=O4unc8{`iI7Bgistjr-uawdseH!LW>86WaaFVyt`{FIRMIDiJ;H8KZ zrk-gj|F;Y`1HS*9s}CN!;vP1ihW%C$!71tYLQ>!PZHcP4D>S_b_oP8HvvWr-yFp~1 zSf28y$F@})P5kh15SOzeieMziQ$#sID!Dq%%%oQGSHJq!VoC+!y#-y_RaR3lH}>W;^FAirh1Mtcrg1Ryd$BgYH zX%0wAMbJ{>DfVb>aeh^D&nr{scApjaE1hCREjgOph}^gF^_QEi%mKgWOkWX?1+!O6+Eaqv!0(q>XVFQAO&IGQBypEE8g8YflW6q!_KbkdzI%Xm>N zBEtdSI?NENHG4x80*UuP0bn`l z!Y?Q3B%ebm+Q8ziEU9bio&)Jn%S8kEW_^vO9KTAEL7|UCImltUn|>gIkTPp%D6Ud$ z>O2Y+s3qpwvyTg|&4oPoHwjKC`mVe-!0xwjyQvh4#BXbR+tz-x8W$I}a0-%vyBA^I zgg18vfN0$;V?Q}I1O#8lf#$(?^DqnRN`xhh1>T!m9mJ6zn?|i?qxCX-J2a>^$*sbq z6w1Y`y3vU{UCc-{(u{ct_3;1gDb>@&MYp|@a7Gdu%m1R{AR&eBp6 z9+LL;tx>_;0paW%*vMs8U9oybMOo@07$ZGu8I&PRrbpc38>guNA*r9A9UFfUpxJO^i9=1{ zwq;JE?}(7gylr$?CZhv~}s&LB5*+-bEZ4XCny10Ib@ zw^L@97pcy@lRwkU*Os?${hmQc`wiH+eMYf%nGlzp_PX`3M;Sl&omyspnEHYiRRzPs zb69LL^H0WS@K0H(Vt<}JZzv{cAUQIwLW+yx1rgn%ZQaYC?OV8;$J6sT4v7=isVC}| zPh%^(qEKll%?O(mUT%DkkBWbsQFmf0wu(a5Ege}h$Xm9O3^R%eZ({^_@2gOv=ij>X zZ+`f%h5m+RBc|(QQf5JGC*3x(TUr*s1c8hj$PPs$G4f9x7Ml>%S~;`)EZfLp$^Ilb z4w&lB68WBdvw!rYFM5w)^@7K-9FYhJ(Mi;-C6r<89-zL~=shVeO!#hB8bIpL6ATW> z8bswZ9;lbu*;bVcI{+4qzh3`-ePMI}ZX=75n>)@7brBXV0|wyD*1^Bb6-X|Oa_cJs zHZIz{0B~m}o_2bwJN|ZU|=Nm$tz{G29yN@ z=NX`okB>oV2%XR8CMR720gLfH_LoH0cLv9R$W6c2T6?brI6P2z0kSv8ZJrP6fQJVu zlE=hr&psM`HBI6jpaIrYKnkn-4}bFwKso@EQg(uumxCNR$aVs1QsU|agz|uAHn3=~ zsiJ?!<7M?Ql!vbG%rbO!jV|mC<1KzwQs(SRb4JIh+)LU)Pt^>xHg*1vxiLGjd<(<%|#%d2_x@jv&k$ zgy~A8WQ_Bxx*C|B8VeWt7{{7F6wjrc9uCPWb^cb3fS82z<|*bO&Hms zv4Q1P@*WxUlYFL$S^?9Gr_~4$TbbTH?)7b)4b{Rr_tx;!((!Evl1W9g@ehvl+nV?X z`h{)`F_Qh&**)1C*lHGt#$GWD)a+_#&YJoG3wQm$^V!T)7> z`48&EkTvt)X7e1Osoi5E!#{jp3p;*W=ksTyq(|A0&JzO}zEs}5SbO)nZSwcW&zs9? zWl3H6=|Ot$QeEX2c6RRz9~!(zf4&rmJ)5@lSZeW*3u5^zw;HulyHX%l=u z#q{~9PP1*dCO^`7SP)^iVx>dB%a>IC(G1_LtV=I&ggA%_DXfK_l=y<2chg=o1NG-I zUa!SgvPXZsLk&SL`gl>7d%tq(=ZiB`&0STMoA`6gC+|be>LWX~bK#=daBfE3J`lNiq=0#Zln`0ElJh3NOmMIcq`0#t9AvFK>1Ft&gxsvddwE6?^3BY zs77a)Q}xg~R_m2gV7%-R;#wPh2l*+PSoXBieG#W(LQOAX-MWa;_1*npTp4%s1wY*e z1=QN*%88R(=NF42-*Tt6&l)1vm3Xp>2CsZsvo+Y!EV!+O+(#|2S+5`kWqCn&Rg#$j z+TAWGPX`T6)fdCctvIXo6&Vb6+FsfBWV!Ry_cLL0y)Eiip z5uoisp%Ac9cmyb24LNw(G6=&U*N|{9Pj>LJ8l-Ib?tVFyYmqVN+!jO#)8^i`;@|{# zk6^!R67amr_F5z;{b{8bO7hC}Ngf@PvvsU_VEK`~AkLw%&lKI|T*ERZ@-fnJGgQbs zoLKRlAOG}be}#`oMhF2AK7e-+YZ&^@|9WI3-c(v;U*2^Y{mWqUc(kdc%T6~|hEC}6 zECp?8-ObXO1DfXXP5cZ@ah?rq~Tn<&8~o5S{?9Z=LIfeq4Pi;l*&;0#&+a{_Qb{ryCV{TTzl55 zx^M5gK>S?i+rIS@HC~7?jI=^GaM}>C67PH)`q9ti!pTxi!?aR#rzTL7Om{$}UwoZV zj;`-#_{TM8D~nwGWcOuAsdQs8xsJqtcFPhMY1u762n}3IRuk1G>F%_wsMJ=HB@TXW zmd5=3Y-Hgz>WogM>zhIa5=K$4C0;Q{Pac~7#qy3*1FZ?8-YF#1Vbpufm_^eQ#}>!~ z?*cMqbo94ffiA~Sk41=lqE#lLY6WDf7Ba{(epDf_;)>Ex4?20kuNK2f#0W1#?I6W~ zaEE1H0EzB#*bTk9Qvz78wmQ8UTmkAzytaPGul<;DF#WKNqQo0Us|Sidq!C?Oye#bx z%*(cMZiLmnva##el3H+nKAt!%HqTu@hB25C0S z)rV%01k{|VIFc7PNj#)w!}QRgzGRgvX{c#D$L&X7{eoU2{RvQ~xs$i5Df{J8o;6u zk6C3{LcmwgO?_pOpue9IlwDj*CBagbN}1L`Subc)Nbcw$eGEN%GIzO=SF$rOipQX! zBe!`)muR{2rJXcCzds;5T9+-^5s5MqGmHrwDb)7St$Vpr9n&8PEn$p^L%=3Il6{iF zYdTMJ*0RXyn71kjO@KlWzfQguQR0s=;~)Q@S^(1o>sOHFuA>;9g>mSPYSPF!hyO^u zsznLL18mY?uGPw>w#vqU@|0t@NMCfI?iADx%r*0FLKK@4hQFG=)V`v<&&b%s-Pp7q`v#-S5lkw~5QGLhwJ?U&h!Ml

    Pon|G8!D2v1-qQ*O(&7-L7@;bk2?u9u=0P8+k&ov`m! zK8q_vSUBubhThe?tlYWU;gzWg38ZTrNDt;DSSWG7;bOfhk7oG2dox}i&7-z2Uw?K_ zIM-W;kE%I->NF*ANr-W1m%eb2Qs>*g^OZtzOxGB;b!o9_>(5}Q)!z64ryt%#0Kqya?A0|nT!VyMA~S(E*VGj&Oqg29>YI_v}_o~ z|Mgsbn6O1+IK!^O!a{Ur4qDEAY5yaxruPnp=UWK6CB_fT{E1y{fA6>W@7yeDm!LLK zcmJipecyLU*suT~Be|_63?2*A2 z4aiuKJ16Hg%L~|zTsJD+$Gb=7d~9DJ5ql5^;@cCa`$&qVu4tDkt(};y$5IaZ)R9mj0ULB7Pm$ z5nfoaP84RerTvQ+9mz{o2Ue`CybdtMm$|gn1L#vFf!?Q19l?&IdtipbrD~oDYm7Cp z1Pr-Atx4V&hI9f(S5DV#Cgx(2(Tgf_bcP}0@B4=eW^CVp!blP$mNil=cA}qItjd~i z{|O#@S|#IqZen#+wzV@~1$DkHW-5CpN3DGx-pXt?OKEs5Lzt%dis-ipuVhf$Ywxnz z6WqhYgGBd%wZM`v@;bGgpp79$wO9B`g^5h2R>+dlMn3x=d; z-yV}ig@i(51;f}0C+a^395Rv@Q9pVZcZv#{GhL8X&<6t|i9-ORLOzhQ{iUIpp;ptg zvMBI57*@|Ra-hc-FXO+W;mOCnq_ewIaY^)F$pBQUQomY$S~NVtjBI-M;p0H_LanJ| zKO-e}YlzCErhT>3ro>U6Yu(31xxL|JScyREDly!od!v5?g@965a-@>EN*? z8p`~m#xMF~&)-VIrHaImGSdRK@>O@07`86no!N9G3lNK)%#d#kULOJkR-+ZN2zkCv z<_jSGuVPMv_oB|lZ|M{!0jIb51nI|P2|17a#qXpwpuoJn0d=x)QsMJ&B=QEZnL(VC zAY7ovCZ70$iXYs7EJ+;rRvm2o5WqbvtIdK2>hE z7`|@$A}rCliQ*U@tT@Zm{Ou;^x+pNPy1LF#{4rJ23tmm4ft3Pv-L*i#?mu|Y-CS{J zPnS`GjLYD@0kaREMwkUQdYv(rU?g0ka#)K?2aR6p&d=L)YQ2@8ute=G3_W)9%f`s$ zWH5#o-bA<|KLQAyefbW0tL&nA7(j6_vp)_x{H>0P(CWJzq^Cj2|lNb-fO1 z>u1y(C5StX7n?R{KeiY?)+m^N-?5!!D*&(gFRpcj`_$CX^E6Z<%)VH^ZCrR|`_r$l zvo6kl*2K36KASaeEBm<{aX}8}WVG`qsTx>*G#Q0CvL`+nQ8P7V2eM`dfeW5C9DBM5 zMg_~u>d7N+P;txj=bYt@;I(PW#^r%iL#bDL+!qgI3Qi9kK1>_P7`H8{>Yakbj+t)y zxm#a~W^*7)4~d8v#cpE#GGK!*$`SzN0nz4f7mU&C>-GtVj`xvTYLS8{9J{S@DD8_`z~+a$$R;z!%H`n&POVvmQmz2D*Bq;GU5`JJ1nlgg@;&H<{Q-P`;Iq@ZhXr`GFs(Kac1zb#g)akY+OxfUTu zugvRcuPqdWQ@ z2XFSwsf(=YQq-{2r1dX=W*{l3K&zabM4+6>M^Y~!E=)>LU%;IHmAU~KXLp1kd=7{m z9Pi4+O$MnOiFnP<-iSK43_(2G5S@^AReZBR7xm1{bdYU;a~hHeW;H!fE&|Sfd=-fZ zs?uvt_R=)x8t@K4P>LP9vyBTE-0!*W&|z^(KJE0q_WZ*(mD^`*2cxfe1WcZ^%9rLh z<|%o^!07#+OSIwZ(ub9I4O&tb5=-x`io%6*&hyZ2H;O4<;}veU+&&|*TxL??a!+`j zMu$TqcDi|6)p^IRdwUQUoZtG9YjS zl@C}gP0!dkwAp5O)4|_s(^h`wAewp&K*jfv=#pRdt%_-h+__5RIH>7mtG#oP5RZTH z9mFjxEa_!szgge2uhpaFE{Ky$1n?SRWbsQ&Fi&gXP>5{z&&zNG2mVU}IQP~?RvncF zBrF2&TWQ>fL{W!zC313dB^Nlh(`tw{WDGJSq`3YExElex%Z`-fY*M z7vJ5d>2i9+oW5@x-YWc=zj4CqoB-Paqqa}-{*EgH5kvMCxl|=YCM=ETv@S8lu ze+w|IHUZ-ko=#}OpmYKu`@qdFMpDN?xX+5Rr z9;(=j8)GOpx_;AEd`SBfi8zbH%+EET48p1no`2fYZ^4tmy&oz(V-gbn$siG-c@E#7 z*WZ~&=!D^l2MkG&`R9x6F26_j`ZfQr7ZroX3#%d|s1k&XG{FOW0BnzdJw$|50`mWt zTgStL6fbQ6u6Sh*AYlBuG8gH+#nlYD)!XRY=jW>l=s-ng2}$C=EFD86I2etSV9W%9 zsAVX<(6V;xGu9B9y7Q;J>%*UT@G6IeU1(l!M@vyKzdw*6ZY1T(N`{1^>4E_RUz>w8 z3(X&K3u_zDaI$){Pfi)VFCQ18J3PZyWB5w?B zO38KFoD9@x@POUd;DUd_#`Wu*jvtBaNwPI@=H4%6>rxi4Iz2!PmMJmkCWN)*^hC3=IQefdc51iqp(v#-$({y%qk;CPXCEsc?x#a zOqE#B5jzrWwv^cEtG>E`*PxNX)E5B#;hjDouWq`8zkYTCjUf`LKVyZLC!GwJqD!b{ zitjqUVk#A3?z`X6)3nON>SdSV{xDd{hOhq~Nk#fA%(15igSH0+3Y2l|90ysKi{rfe1# zPreYo)5yCj5=IwiTX|AnO)u7QDEGZ!L;oAq&HUCoS@&k=d;U34%Xfh(D?&jN)<~1XE}1!(W!`tiMt+r(6fKiRA38sGc-+yK*qSkYeh9Z&|g4n z1yI0)9xY2tF2yvLett_G_AVHgVhDzTL&@bZ);*AMmWd94Fa}VnS&y`Q&jO8{&ocr(kpR_AYn6>oCaQKEM-}!7*#d!1ulE zqMv3ophM)9>CqQ8j(kEZ6i#t-KXug9KzoFct0KSED~j{?brCGnhix*Nw+Q7h2%W+H zV;PjF?gvm1hYtvf!#flZjEMK(j|J~J<<{vz>{!@ZuqvEfkUcY4G2`npiEMyx%YTpw z5(cF`fprm4YgA$vF(~~|cVE~c1A}7q+(Xh_Anz7 z3!$8e&PP>W{Zwp)h@wNb0s%Vazpvzp+bXzq@pZk~Rheg*9d$!DTxlh({Z-Q{y$~H8 zbdO(_?>K8;Wc}lAc>u3d0qd}VejLPQkJN0l#n2%Na}x9!2=;*6>YE<#V5D$2<9RDa z`wnYR&6RqMZ5yxVU*a*IQ5P;L+?&i!1;!nhW%-L@Jn+)e7?9?lDNE8O-MN$d@FCHp z;`##vLInTNQ2Y-wvZKY}f9%AGYu#V7zz%`7o(TGgdmTR%(sjY@!Yh*n$o#)1v}=tc zJ9-S1Xw|)h)xDV`)Om=45HTbreQltC`%vo4@$C)HN0i|Y0dJv8#fggYS#?`mKH`p1@L^KZ`#IH%BucD$h!;dbk)z}N zY7KlM@wlF`b7Kz51n+}?fMQ}TA#Fx4fWU>00kwL#ij@#~L~?l<)c#XRBh~uj%q64e zSC-ohe;nIjr7FqKm3*4D{qw4W&IR#AZM}-E%X)&Vo7aV$X!?3bh!Qq<;brq3C6^vc z`6neDP1v$-qtXkhtFn*3cqMj39>SY~@@`^7YkR(=taNifTc}L^d7p;Yj!wPWwNnew zN4uLFL$N{JwuUb(#Lgp+iVSL)?Q-!2AgBzF8mR$?eiRpF=C_w`dwY?gjQbCZ*Jc39 zSeZ!;Iv5i5uJB-Ro&wfY3}S$vLH{&c4mdrTOB z8wPDdEmCsA(6EuDpswF`;1IY-EX5f(l`+^5jum#UualFbNbo15EI-t)*!jTP%b_|B z|0dEH7zM*>kc$Mel7s?H4YosD4tUNIXCTDG5LY8%2y4(ZR!Nu^h`CofDFXWk2-zHa z`rEOwkI+F6AeT6l@GA~uHYG_r1jHwnCZKG{3Rpz2`|0ZCNte!CPgRB>CtGvl=&$_F zR!_L|d_%d^>P7B1wK&ZGDPovB%yC0J)JQ;S{IwOW#v_*B9fMcCCZ+;{HlIh4NDmSDnv$JJz3<{48A20K?Bry zIbvg9s5on2NCB!uAcr7K6dx9YZUOSHGAxX@XK*Db;LYK%EB8G=;l%bP$H9Qj!ewp+ zCa&iW@GT(EgT*1@Gzawr{1R~VLf;C~e&Aw(s0z5qz|)7K8txZ7?}!f*xMhLV`Zmb{ znJX}bKp6<|D$-|fPSt?FErfQ!sRXPo!0+FJ%Q`Gh;QGS)0m+61{0N|Iz-R@tMHmR$ zH=Vm8{0m@P&z{a4LaBHKY~Yi?*aw2-5YZJl2yy?NzI`R@VR#p3=v_(j8=G|YI7Wfv zv1j0Tx_x?XltLq=4Eq{&IIbVw9cC3Xw2Lcf)OUq=VU_|617Wb?rOU#19p|9vz>mX+ zR7B`<;FGKy1k9$DFJNINd}w)qhmh2K5)_t8Wv15lUsSf^*gVZE&E|-cV#L~h#c6p9 z^Mf+=0K`L(lar4E_29YaT}(!I9}!3PVjtDAO340?MMehKlXy3V0xyyq((Yb5zz zF;e17`G;oj@h>Xk1Yejky9y8QT%i`!lwDCtWxYnh{ckX+QpD@AX^nd_PS zm8CPXJs&DdTnv0k3^c6rOhot~?k$X={N415@=YUNaxu)NP1*2-e$?=(B6Xny0GnWt zsB+l|?YxooB#@*arVPx0A<6*}(T?yz6W~z49cbXB(fxA&^c=C5{Pp+=nFT`gKOC9( zRO#~hwoA6y(!M9~31p(2!$Aw&0#yGvzMi}aoudD|WGgFUK|uHznSw9)sAw4R6-{$_P^=bI}qcH4zAG~UX0khB22K3$K zo3UdjGI2|#sEF8SSz)`8PFB!}2`1`@Cd%iOia?{6&^vb^19lc`*MQXwPNJe~4j`Zz z62vBh_5p%T%xU0&fx>ZE^cF6jis3AWu#usELsNR%fqA)I{G+V83hbw2QbP+tP2ND< znoiaK+@2`&6~}OLbTqJ`B%%-<`(}Lj$k-S#^R9G$;4kH^jA$}2T23ZcJz8!jyqLux zk67H>t<3*jYT`y)z0F^+a14K+HXb9cUL5;(q2uFH_nnQz3JYav_gUz{0sAqUsKracAN~_sLAbj8NhiM?fyla8+MF((1JV0>` zQ$hHFLEvEn!vtcb5mp#HSTA*_1o3ISHz z?s*%y|8#mEUb=a|Zu0gehW~$@O?BBds)+aDWz}0D&+MljMn$etM6Il>U^2&S?j8fL zuk=EjTSeOQ!`GYYy3csJqW{x@aRc)Ts>ng`HiY^fK!@jkC&Mt1Di!QT?ZQZXZ@x2$ zb7XqDcVIv%VeUSNQIw3JE`;@pxWd;GVj!Wh&WVX2U4-}OhDiW))x$E)I-v3IW@Kka zA+7+xogDCc3WX%RvI)eha1tRd{|NeswB$y=q3!{V227;!;qD;rc2iRyCO2|m+W`y& z5E`H^T>5~Y3+x9#004dw_>g6QaR8`;8l>~%2tU1A{n{D=$Qlq45KYX&_Da%wAcng) z7=S;>o-cBN;k5uq48S-K+D;hf0T)b}0=Tx2YLdor6A>@J3sY~JrQlosivQBk(D3(` z+fs@!1>D)t&FueevLa+Q$lNHW&|a=y$>d??aOAEeer)qmaEAR8`gOl*!U;js^&5zUFJs;U+R^mY;wM`TV*4i7NVrAL%tJAKknX z-d5`K`_Gqm?5|)}bUGOC{1dB)-xIhN%GGkJnOqOW>Qeylfyj$A=U}JA5i!z0!kG3WIr;Ep5WTVM5$cO^vXs zpq`8kuk&o{Hoc*Kvb^-vQfgK=`>+W9ymNJHTl2#&FYv#c6M0yh?eMC<`l?_A)XTJc zQ2Qg`AfUy%_B8>p5)h3Cfb-*E1`ioqG?bKYfb16wa4r%j4jmeh3#UBSii~a&AtPGE zs{C?YHT{GzBolF20DMypOan!MfCQ@i`(XcR0by6r%p-IpWcvVa<^;1MJBv3Qw5X*K}-?0F2a0+04^A*fZIt0bldQpJ!K%I0#<52pe06> zq9EmgCeG5vh8hZG&?N#v5$x9g%YnLqckdyn@1RVqfYth{SQ6BYdaK%4%bW%4i?fd-)ziZ*;t96CD65aR@XCGJLPPak_@9)yJo z`%sCD*_-4*?bg8Y*M@VkWc<%d$WH65>o{09z(E!nP(VNkk|fY@skJ$j{Ee^JJOLL> zq#!gL2;i{k!F+BALPSIkU|gJm;9f>cjy70A~XA{z(=S)cYZP4ng4TxG*sG60j0W|U7m;qN#4k>N^qwq1>l^53knXtO}GS)YYu+V-@T+USGs)iDF$<|^zQs06erf0d5#H2 zIooxamHkh5I&#opgG2bpckV#3=V>Jh2}-*)Jb>DRsz_S-Y4N-EmWC)VV%&j6>l}$> zhj#Oei$(){beP|d|7eJ0@=U-~ezG6YGu+|ZMbgM!KHemMx_W(iq7(=KZd82w#0d&{kxTwKa1q52- z5cVeGWp@;z5SjWFt?dh*_0 z+4H1gw!Z(pRVMp&rO8?E+{*zFy0qL9?SW~@F{Jt-MiC-f{pq6pu=+rcTT6okKq7!F z5chy!2}}jR7Lb4wfO)_v6{spN;5z^|Obr}@oqS!!ngv$$23b0Q!ikBA0Q>;d!Jl{d z;3f#oL$jpO(g{9!eo90)!8tTnkom(l>B-y2o%uC)%_~}X!EE3!4mrsTPtP~} zHFVC&0LA~$pZY|o#S%xJrfPu(mn|hlm~{lJ-4Wx1i)}smbD(8bt_`S>HESA!)_yVg@$M)PZ^s*8q15(j%av zrIA6%35d)LsvsZ~Lbvo^1Q)>enCK9SY692`bmwLE(?Z~LEx1PCWC@B&(~*32pfmT@ zzN}T|_-Lj`H7ZaioV;<3AQ{Vq%F__ovlo5`Gr|JJYmK|-Q;iLob%VbT!>)XD$dn8r zBpxR)>l$i()gDJj`n;Vnx4q9j$J|54IzNYrH!mq)Gp{~RJ3mE6MR8vHUQ>PIhdY9f zER#CakviY5(ujS0cu@HUgRFtw?eSKGM)hy>Xa0omH<|Z?E=$?%XQ7_l6l^+uG&{Sc zX^sAo?-y^Nb^zAW&m0nSR^Lan!sW-KUMjZ*Hfnk{m)_O%4aGd8A%SdE9tFgo9c;e= zaD*w7IAL0^dCS^9SPRR*S_ALAvon-vE_j?n1~F4ClPP%#cuPV7fH3qCzaGQWN<-#F z^ZZf|Kq+EtZ`%C($re7g#gx}>``G{0eH6xQJ)wSS%mC+`O`S(7Z7BsxRPvNZbxSsu z;;1cNQH{ULYF}PHm*v|8H-1BMJnhFqjYfeiyYSU6J;`jH=g@)qJ?AP;JGi40^*4S z(+fI!dc*|@EEWLL6tBgQi4yQR;Q<^97W*eFGH4d=iTb82FIP5W9Ci;45x{rixO<|y zXmYG{hB&Z;T7V36N>FRA5Zk@Y=6hmoW!1kv$t-2Ks-awohhvYvH5UFUA6IgY z?heIb-`rg|Wsr5^%y4p%ne%*Rrdt$kD7ezmpniA!sVNsJkfw8T+EoG*t&+eqa>~AX z>BBqkbbcP5m?dKyiTUk`3trkpXMM=>B#PSC3GkLmI}5Ff<-mE{)`kq+S?Dh!B&opa z_Ib5Y)$PG-8f91VhghzGJ#1<98{cNP*qLNmyLW2Q{z9crC3dti{|`uFnTrX@j4@MC z73JvLFn7h*mXW#EoxiD)y&si|_ncbYaWxZb%uB>?!4j9{PMU4LAj#f&Si=||de1zP!M>)=M2O8E0S)L+3%ZvEr`Z$u>W=o!IRkH4dfoCQi5 zdW@+@qOqN^4;)XmWLMq|VZ|p23F(}rcU_*DMT0gUkUe%D+!Rm)xuIZ3* z=+43#+X3&RZpCYE^bq82MhhdhE81)}UiFwVQO~lYFq>;Vv65-ZqWBU*EZ41_=bhpr ziaU9F{Rj4a_Y}2N%@{b}&Kd}ra7RA-<5)AQFhtf%vNyWaeqo49f7GP-OL>7U!WS%5 z^vA#%C~i2xjEfX{uJLS#8sc%=yDc1>k2=i?N{trEk{Ws0T?36ic9{Y$8Ye5AQo@kQ z5VBOoy$iGdoT~wP!J>83jkL9mQH29&Bq`wpvSd6}0$K_-G(;7hov(fp>~h|hYU-sr zU8#w;BY2Y_88(TBSv4YPxidjg8>BFZvn+o5Vk!9X*P}w-QvV90B%Sk4*ELN2s|3pT zWeASY+>+j%oi(2-OUJ1{uwhT1GW2NaS=*l(qgjl(x2I7Vqh=DPn2UYeznZ=3YJ|Kn zY>WHok9qOX%#35i*mPJ8F}h{%_%*79O>R`B7{zVvI@kPy$P)&6G1^c)fa8E15k0d`+P-eD{2i8SM3onbzOvx7p}NLZA>XE^UkdIIO|`3RKg!jR z-^k%Oez{MV!~r(EsOyWZ*stEfl2G!Rmz%f0OKjN(S+ zG5odtU%l-=^js;fsY6Ng%I{T{Q(d`N-nvOgUzhCYAQb;ryRYBuRX4#69sS=FQET$w za~25;N^5@8l&0m?i-hEHrX;jcKN3_6B;$Uadz$ZFyVaLx&!omc49{srzEN05p?H9! zncP@;-g{|T&f|GJiv22{GOhJu6u-xP@==`owl2GE8zLep-BBtOX>+C>pY(O~o%F_B zmQg6|o2C`x>k>9CZ((ph;L`A`_nQOkn8A{n$X7TmFQ8idm}{TK5ZJ!ID4dno7WAv! z3(VlU9dTwuZTaM=BENGK((d&+cHhT~*NtJE?)5nAaBSUGW5!LGWkO0`5LSM5VRNQS!U47rzc0It?Ezo>++Tl{G zj=b8$3V>eegf;lS_Ic{brsvy_o!G(fFDJP5TfaG2W4WkW#J$a?%_ zrPf}C-Ap9;^t@`C_R;Spn~sX>WZc?uoH!;5?`xd_iiMM{ad~ zha~V#j@2Qr#yfmW%BsafB205`X2A$;{a55X3Ke=k>^k>r@{9F@3ZFDag^nnxyL3-9 zWCv=eJ~e+H9lh&BYMh1BAp zd`{IeZtJR@fXQ$RE>d%IbAkUcuHy}T69H;2g^ZlL#KgfJ3xL@uK?BE?Xli716@+zQ z0+c9^p|0L#UIFrLRn_Q%N44eUKYsp19Cd)i7xj#$)07JirFZ!7QlN4}^}xc;K0Gk+ z1o)YGY9YtR9ssz4Ic7jt$-Omk`*+@cTDW!77f))@<9nMQ7~a5}Z1EGGw&#aY8bpHG z*w`3FmS-MdI7ZfKbO+*regFvib%()b@B2}8CA$Imz&D|hnTUFFLp4D!Bs}Zp+Y%S= z6tbzgmxQ#tRaj9pkodA$H`{$xJC3yu&rW(jHLQGT{&G|22GnMncZtk1$*iP|1??Wn zwIyCCM4sASbLP&a{Mq#3X5_FZY0eYwC*0S)lJ)n-9#MEIhy+i$E+;KSy=$3ccxP~m zczP3?n3w>E7zsY7pvZ-q0EQGF6>|ZGgEAgaC2Z_WAYbR@ra^?6uGdshfUPhLP01BU+5}`q>gU%)JKHK+V5$&S5Nst}9{SYg zL2-MJc?DEikoj%w=vdCB$RzA6KP;)P4&X-hXTm5N8QWdHlDt^$4DlM3C}&c(y4FZM z{-;7yH0sf1rP3T3CM203H-F$$VAt*jl2VY`i!TmY!3SK;b0NfHcDRlYYXr33V<8Pl#>I?7D#9Vw{+-$ zsy;Vr2K0*Y@<^*Tvv!+6=vNT5Z)9Pa3|JqzfA35xXn+eFjZFDs+_^<||9!k0&`#?v z->jy5Rq9Ee(?(#Ud9Cg?iyxj-r7OA>fk~78i2~3I^v` z!KIn;J+(uu4zsMt5VQ_d@DN_Jji|?ZdV3L#JIqhIObJ>zlnAd&DQjtIJxo>P=I8HN zT%-Z^CS)<+4sC-75U7y}?`kr$s#O~=mF+yVbL+-CX<+?YBd3X@hiO#PDgCK*-+?zG zQGF7Z;)Y%fGoyqN2Vd8bkaC|!s^<43yZ(|l8g{1|m35{MxC^lKc}>k*C#qv0&#DoE zcM$f2s_K6c=iBZnAoHZ|23IN-b#*X{>)3Fu@H(^y&V)?vFk~~30!9D^Q7~ITmLQn8 z!{iw5fJK@|Aken~$yWJ|_8S^$#Kp%8f{qoUn6n}61pFa(cDSNwh#K1L&HU?o zKTqA!ngJywg_firwcv9}1;;{H6kWBo$*o}9Tv(7s%D?42Br z@lBhIcIBzQq8(pb48G)|7hh4R{d}girQ2V}ZR7NV_*x#-D7W+pN!{s2zxh%7RAUW{ zg*2`bYK)ZI`%O##@pio+H-BqfCS* zNp$5b4xIuO%QG4`yMizI9UOoJn@nur{suY$g*x-=Yfhi5())QgSzWl9)Jla>)LALI z_p`^%aJPPMz-K-4ZKA#NQ{yNB%zHZ)#y?gSn+9qFY)Xg~`}g41hij=K%lsRj@X#XB z-?~xMW>&sr5@QceeE5=0S!B6<4`sSIoCa%`-W9L0u&@Y!)L46|K+&Myd)7N&6EpzF zKUToA+~K%TeEDn@SgCQ9%T|x&hiUHN5&L@=N>W8WyoVQ`En-hq+4?-5jq(c0&f_Yt zf{B?~fEtr}QoG$pZ##J@Wh{dVNvh^~<5i}&!VG~%9K5_{GUtCGagow;Tdc`YRkb4H zbw00dVib*Cm+87=4GZHH=W#Q#wKMN6<9q2@XH-|WfaJ!)PX3F9wsf+n;w`HTL6<38 zMsa`jMRK5#f4^B)QEk01m~R|>_oR>SeRHKz^w8~>pm$2)tW*D%Egf6DO^f}ZBPhk8 z=~HZ1Bd*b#J8s=|} zF>N&g$HRPYb+3Qcpt{7LT@4W9Mz@xUl_g);2$~%iAG&+n4Ld zl`8zX;@9Q2D+aC*XDxUaptQ+SMsXh2#@h0A9~}um843fS?(F2F!g4s!*4J5p2?awB z`%VT{uAYY|s{5p*a}e26)|xCCfaQh+MuXKB9Pi_~Sjy@UHw!absSZ>{0ZyC6dmAgE z0x|&&T@Rytr8#?&AB!b#DRw$kMVGRx7S5#mowDtRaw2836Oxl9#$3Q<;U+p-T({Su z_IC~(C>lY}W?G>Qj5uIkO_g#sv_pUYwyR4xI*7N^T z34o-joxf=c2al&`5=2;mFIwE)v5U_MIWmw*i;o#|-o3K{-9MN^qIRb%n|3Ep!1@lh zIQY+=ts!F8EzAf5=xMOkLvaR9BYZyO&!T7ug3&+9aT~>oU8hj^R7L`zQ=D}*jSM_Z zD*F0%jKtq)WUk*nk={A5Op@jyllm`O0|+d%!`$!>b0xN-c8gAx$O4<;8bacPxs}yT zb#;VP1+uv_G80EBg@1pCXwkx%qCDfq;%=<&^X+2y2ECeC*9&`Yg4J9$kt(^*!ymny z@MBT!{K4Jw0{LtS67he|3nJ}Np*~h-lyMqe&2Lqbf{BDedGqFjv!`E+~+{(#!V&n>6|GMiwt*EBD;AxDfPjatdT1-uj zI}R%o`)%}o-A(f>`CN&WAAj-!edIsKCG-~?W4;{@yFsehL!e@ukl>xM{qWj0qed(` zT62X$#7j0VS$Vl@|MYgLQ}i3eRJx6$X&MKdKf1My$*f`FCHD;Do_f#=%TFl%>r_lD zoNRei&|->1l)i4>R1ke@p8vLMuuf3KQ?yBeI?rouN>;98rNd**HzJc60%db^(~9%y z;0h|?#2PqYD->UeH@?GA+YTSfHz=98%!*LL#P1V%U2pqKZ@jhv_pdp`3M(IIh?Q_s zvs@;F*GTD9LKy=4f=~3{{UYIBHB*yVP-_t}=kD&Y&>WOc%_TeJPQoewEGc6)fQxrG>0Mc(x}anlb8 zY3%wB(EpDM&~D=7SZGgAoN3Zpi8F$CD`IrdkyA)aPfm4fudJjtS+49Rm35S-1#ejK zl}nc$hhS^Q3*R;63!~HMXU_y|-O|=@S{^3%-nG7`3#$^+4}r%oM`|vPSw7AJEwZB! zx0Ety2>|%=I&d>s`@8Q+VcDR6$UF1DNKXhOj_&#>PsgvH9Ao&!xa@b1fg5wD#b`Ad zUQpIL^~X`_OALaD4t{3?nB0RJk(T{7u!T1h?(s)=0afSw(UE(`Vhrrpjg7w3Qkl)G zC`}Ma(R#$}iT5o1J* z9yoGWepm7)(#pJVfq9!z+}gfgbo%A%<|A}v z)&Q1q_k3T9Yh|yZr0+sg7470xLqbk%mw&YJAnnU^^YIEp$bjX`BM+W|j^p1X`FXJ1 zEvieRod%WFGAgDgW#eGo#{Rzu5tfVIMEqS?bi`}px2J}I@4>C0|KGX1N4PdlFd zCACg5Na1^g%F3eIXJOqW;|e?(?625U<1PCvDM);uI@@A=)xm`n7jrvTz@8ga%XvN2P`q%X(Yvda9>kgZ0_-HNl1nq3& z0(z7EvA=n+|1zob5l5hV*4#@rRt{5H_+sqfLaaHj%EF|aq<{6Kp$I;7`Df|X1D>Hd zs}~$XV$Z@VI>waUWvpCBN+-w4=+K-Vn`*P2E`D~>bxKA+G8ehPcZ>NNXW4w z4XyuSK@O8T=v8(3Ym7*G`ue~`N9+Bs+v3PH$^?XaV8R(F{3|5y_Mpm#;g+fHLqT!aLk7^;{; zQ~RxZJdD(*%7(n9`LtamSmIA|bKjWpj`4pyt^X`3`jXg}i~^ z_fJLL%{)%|;m;Gw0Z(1a3)?y6qu~(=QlKlO<&cl|%%uQyHlL33olI5%nJQ+c4wgg$ zPo1?=fV7^R38q*Lxj$C8VTf zdT5rN*JJF|Rc50+dbko(5`J4>58Cy&XTCeCNJD@WPqJsX2tUXa1O%Yy2O#%}iaoJq z?ge6lBCZ8CvCmHmOTUZTu&T#EwJS8Y|1Ha}rzyIA#DJ0kV0w6rs;u z4uxodzSs=vwFaWZ*p@m5vz`Lss5B)5P#Ui6^?K~Mg|`z1LjPScg8CkA)N)- zQfYa)xSSj|l#@g)g*^j22nxZ?$EWe$vTAbUI{Wzf^4B~idm6m&LvBLLPb=E`KNK;_rHDkRd2NtuwIj)HMC(knSDf&(Draj$c4(W<({R=3X@ z({a5WTUv6O6nW~U;FXtLX*84Q9rU*7#?5cnY<&5uxZ1^y-$XyAFH_IF#;o?`-%W;b z94M7rz#Ko%{_;DJ=D~ZL;%8+?M+a~yuKodrk-VZ}u^@eV!J1eI#;seoqI=Exvx{`Q zU^v$Nq7)EbD2l;zjN)HAxdUNT8x|!Zqd^>ts;kFTq{rcnDW4f}Ykgn`!;-Bvy@ZA* zVYwK+1MkhV$S-`QyZ=q}j=Ar*7q~rUPkcsTfR|;H%+7Yv+(v;f8#sDCPSJ4q^em|Q z;@Zun=68!we(PXG%9w9@*wfsZTgr&{usJKbQ9E}2FO_?C?&pu#x@vj?N)jBMOUQY-6mO>do@Gm6*~G?Lvb(VQ@d)5 zo@clzA4Et~7MOXIZ^=lDQ-272dhET0vbwb>>>NEO)2Eo8-I$-II;lAK%KhlY^0j+> zHzMWVsW#-2=-iwC`Ge@7YJDkqlOD7Et>wvtW&hGIE=JzAzV=icc3h{zQ<9M4e|~J2 z6e>DcLA_$JSt0D}M`$Qi->&oJaA#Cc*Z?k!4Vp62Z{>=9o}TSX4CeN>+KNvI?cE;z zt?NAI>g0L4`lA8epShXYd+Y4bvcSFtwfE}tE@u4O_! z*&cb7w&Lr*fji0huKCZ@!)w^r)@>)c7E&Wj;y3h?>fYrS$Un_lE!tYrI^>*5_Kj$I zaAG4J_w*&*cygWTwh+kva zTJSuUy-a_EOwut8Q1~r=`9V{dp=OIzJMr>5+fQ zD3WmTT5dP~Xrup}Z!ErKw~6hNU1aQ3kgg^AtSiXx2eGU7n-^4_D?1FczVnkTba#&@ z$^GOU^w}-w`b$%Ema!i-en0H~LO{MRgZK6oENdC-ENnP}+USf2b9lA|U|N3V0W&hW_ z+sW~GXTQ7CxU9NKy!UCYuPr)Rml zk5lwM_H-(QJ-@V4`)Xm0wfE0&9=mj!#d^&gAN(zzVZO0Sf;dA?*m>vgYJ5u#2)KR$ zSr18|CW%tas0%od=0-Ow zHb~^kzqxD^)YzUkqq_I&;N{m-hFReQ1!vWMQnRtkxWNI2-9ZmR{kgC~et05Hzv9da z?BHIkmifu*1#?p*qbv`V4TO#e9^?ky^}|;5Dr;tX_os4jOkl<-r6n~eQ7@GyD&$Y; zBX?Lpcy9NXW&dF{?Jqi9#qVzaLydBf?*BMaLGt4}A)Vo)J>JIJ%Yu5&1B`-1byyvV z!96eS5AG#xm*p0>&Hm`iNxf$+DjAj==teg~8H2@nKhfOO<6TA@rG^T#ZNYTA=Alol zgYX5e9v(5QW#OR<%=ER>d+L2mccVkm7sSdv@4oq?*3a1Jx?;2UYrix`E3>*W-rSG- zX>E9EuE#CB@g!;a04$9xVg1|bl>g0{{+;di!!QsTNdWH|lpY8{6A<}~fx3~MMsG4s zoVOs?;}919kjZdezZW!JU`qI&c6aizJX~IDH(nXqn$3P%8K(D3*%22b?vRS`UG6Lb z`|_>B#S;JVNQZB1?rB;(BiQYxv~qDq$wob$cyRU8;MjZpsyp3_e?2gSucB>UaY+** ztH*V}Z;({40QXzqzBz5BxSJ1uovv#|!>dP%brmneMxQXdj`vlkAMvppdL{bpXZf|o zA9x4*ovnzrFKC_Sh~9l*LdDfweX*k}V2fu?#a-{XK-BnZk^HxvtM6s+EK2vecj(NC z!LrHjZyMd^T~kmn?N1%OdNg&<^6_g4SNsn*JU(yScIDeN)t%<^Ry2&PmaXc7x6*SZ zzR4>lF7vW<|KTGt*MSF?78b*b(wfqF`=djP4nOSNV4ox*IdebisQ2AuxQXV~#uXDv(nD^lu{c>uWH!YjrjS5K2pll=x(Dc+F^8gWisBc1-=@CfULc-e? zUV$yG($T$O$#0I?TK8(ded`4N`d}Hm)jd26dJ%BRpZi-K_hktxSl#v=8bU z8#FWop9gyH9OTfOJ3D_}NdayP@N~eSCJQiYAgaH^2TTw&Yk-GA>r6vQlPtE=O* zFw|-oEI4~nOeKwYT3UYj_?y2U&TDMJs-60S2^*=jI(WYC?nf7|!Lv_vUoLl8>Kwi1 z*8?DwGI~R8X;bg#_USQZLrM*%y&H@rzsWAf`o%x2t8D{VBjs-|0Cp-_Mj>Lp=TFS>4d^0mGu>OF? zQ7ZEf>{Q^+9MX6QI>%yCW)N7ID>p$pLdosR=TMlf)}=#*9&m|GnUIn~6Dvy;o|q#; zmy*$tpE~QecKBv$cV{8}BB5sS9>|F`=ie9paqvChM<1?fN;f>%4bz|f6R^SlZ()ui znv?5DjUsGYS_h3)z>J>1g+CZ0tNvnUZACn{rj|7Q-yjX|(!|^Ebdy^8`n2CjXbMcX zYrJ{X`8l}+ez+dGHhw*nTeq1GdbfyDGzug zBzV<%)E8Q+MO)4L6`BL>OG`^%N2&duu1}6hnh$-{)XCP*R-Z#$m*N#)roJ zr4@QcnOBfryOwMU*{K=r5K$u*MMFr4=afLFd#8HSxDn)!QVYOmhy`h4CTA5)&wA%qD=dzyOA|nhASvB;|luMvdo^G2{o#Lt*W2ti7a* zo&yg+sScGqwa5*C?ghLKYzGAgEx%gc51g9tUaPNx8`5r&n3OaR?SfPX=*310C4fyY zwXg{6;F-t3ZQGie~83Ih!_Ji@!^v6PdXZKGS)BFD_`T#cti3h8wsDJ_PHt=}C88tk| z>KVc-wy?Jk2hZ)G*jOT~7(xZ=_4)ZP>JDugaUEFDrYx%Ze zj~0HV>Ga3ee5v43k)|*9^uVh>-&b9CC@yFG7W>)H1x4$&x&PL?)R&^J`<{1}?4Iw= zqHgtHP|k|%+a2(1%ssMbYU%llV-OTya{q!1sT?l$-ip$uh3zJ%Un9&Q%(I7=@jF*JQ?^l|oV%3(ex^=xLXsbe!|`kTJ}#Y%%{X7kwhy`MZyC%;Q} zhN#)M9sG72j(;|m{F^F99UYdOd!3M-96b%Xxb5e8@cejI;xgHA;!+Oz1s9x-M}^tR z@0V2fGm{_BNTXuw8@WY&`MF984;#*QJ=X5MI;}6C;Z8}Pb$IN$rd6X$G1bU6WrJHg zd}uFPWk6wT%GTi0&;_RoU$R}Vr;m-Oohh!4Ly_LrZ%?0>?7F7Zs71foNxR6&joA7* zcN>aAi}b0P8|0PG?F~a6wsK{cFS+Iw1ILSC{=W?;3yl5rOcT`I1%M^|YPpB>$J|RJ zV}!H3*cEL%Syg0v?aohJN_0lv0Aq${&pP=8tEK2=Xkzs8n38S5=f7lFPDde&1gl)3 z-Q@63d7YATKui);B@5+s&#V}osrfmV`@5{Q<>mA5sS9q!WXzY>eWXo{iTi06^iz>Q zHuKYDzN5z6*GDqu(eC#i+$+y|>G$S4yp!vvXMXq!)zH_I*QLOSLsGiW~A zff}{6>qy_1M}j(!E|QjXoX(_r{MF<%O)QN;JaMvV_v%gzdY~0NLe-foSTg%r2NU-` z|5BqIs{E-O@Z?h>nfd_}jSN+GPU+-2Or98dQOz6y!5wp5(}oK0+d;3?#;}f%IcA-YF|pPt7*hy5p8}4IRK7pMg@tO{pmhd9TWJAFHdX>z+DOm*!>T=YF3eeXY#v z-|r$)Da{Ojb;j|ZK>4uhLiY&CgfWKFUvpu6%@PCsEY1ovz-pcmZ8ZdoUadVp?vm}|{;qIzp;SZ3tm1z~)?siNEdzTMSx9H67>|3NEtb#(}|0<#;Kw<-{cotV%V9C_P3_WFoDpO~KB!GVMLwpd#Jju9!J+yMEbPH_{Zreh&+svQ@m zHe82iX6$Q3;%S0``fY79=4sOnKI}&0E|wt3&~+_Apa8G;4rT>6VvE=G8a!kF2mR%# zVQI$&w;9)iPZTI`K=6a4!fz&V42ImgX4|W!ZD6nrmYg7E1NSqRx@p7;q_MH_#%Pqb zONwsgbb4z-J%sjxY!Y4#3B;9~yU1J}yb(IhD-a(vpb9DI{uT}OF|cOxY1~&E&G1qk zOwhgpE^%XPW)KevNBny#6~chkRV%Pb0RM?{+q-KjRPSDZ_k446v$$oQRT4axVW1tI zu8uGC=LHg%nYA^R!Z4!Oglh)V`(i14;LTuZDRL zQVcLSXsr`npl+xKj|h1BiS{@_K?&)PAon!nbQYxsW)#ST1}zDbd!?CT=Yg(*6t;1N zPqi|{uiL2JzMQ2G$t;x7`=)+R$oV~pBE@G&^~Vr*8{p29J60^;${KXMY|HS)B+kg|@~G zIFEpZ)7=dP1``awfhP5$<$9mo{jdK%!D_Les03yj=E6=FU{ZoI8j*~kqq+5ytIrJw;rl~*0&fNZ%kRW9#HBX@o(A$NFeV@d z{%4gdAkkGHLfQ*IbcUWdu#-AJ0`=mjs;bebjG1hJKwloLYr{3fYWtI_NRRmbf(kL8 zr8Zp|J`2c0p0K%1+mtj&(?vIL9Xf&OrCbj67o`mUea1wixLN7)Oe3SDWr>@qcDA;Q z@xH6^n;tXg_G614S{uH*U_5rw{f|2<<(LDRhH67y2i*kqrtGDP>q7EXY6ttfB#;g?LJBEv;`Q zTar|_5w#6a40Snv!f*q0rHjX?^jU%|aI1hul$G%!JuR*3^N}c7n7!w+UkgV~lZX%$@ zNVWiW(?4wJaG>{H2L2$_bncV=UfuAxgUZC&Os*b){$z0}6Z5M(4l5eYx(>9*vY4Pc zhEftD)FCQnB`cyF_`4~Js0MbGj2}XX7zOS+(pZE8u?6l+SBSC(JkJVQu!uxNKaTw5 z#-!xHF;N|6nhJYH^J8z12Sx(G<@CIz^|Q^-av&Lj-Q5wWn)BNN5W5K8 zMs{{fkhDsx(3pH!s@40Y%DQgXps;te6aZ8Z!~&dOFD8_V;kd93KSi#n>BPRt+t*E0 zP(@yNI+R@UL|I$3I=tu}iq8&OhZ#C9DPF)=xAl4QOvb}pq7PbS)NW0+a8vTq0LKDD28-^?%K$DZRjldL2+x5{gJgr`fa)3SWlMBXrQ!jPAPpWdH-PRq zySDZu{3=y#@opBy`Fl9GkmL<-5yP80x^U;7bHgME2j*hNMn-SIK@@1K*d0VtMy96d zAQl6%DqDQPyCN3c<7#lVV&?+sxe-Zc`G@W$WT#tUuBi4!Y3`0PR|`w}VTZM@qd2CT`m}S&2Yi2k zB;W?X_EcNICp+dMEiDb%pkVDO{GdN@6CC;!bB7(pHHUeCmJ1WGmtZ&U9}fwrr4F+q zfbD6(YImlm})Qc=)T9SS8T`d;&Y87n#{dX7_sF zi@w7LpoBQHb+c_{g<;&*l{=~4Y_Tm9$&dwxFSEQf3^5Vg!+Rp$-&n%9IxBr#U90fl z*wTX062!?k&R+t(@aNBvrKppn92o|}a@b-XL=Y2f=>RDOObLO4rNY0|2s6!yj%t?i zRdZt!X)%9eUf5>AAWYY>PF;4Oz3l`xgXcXGn6QmZGlM}bc-SfhKauv{wn}rOo;^xPja!k1~vd-&cdPb z+__HqgHFdzLxgYDQcfWBl$t$ zgng;~WOwB>>?66u+IdIH&5kiW9NjjlKh-Im>4C?Ys_2(_CIuTQ0&FCjLba8=yhKJp zK_4p%E~*X18S%2&V9jO5=nRlxULGUNRy)C2tXXapjQeLAyZ~b?`}|EHxfht{Te>Tt z$pAGpoCD7KvpZ72#{_E!))7<`O@$ej277;c-)ml>mM*b*ovP%Vg@okzh0V1~ZFzSE?m-I-r%Oj3S+eliyZp`oF0 zFL0lp#bF0a!h->2N*t3W$XlT1s-CnHEVATE1dK=p_J57`(i|&53xNy>m4*$~D(o9B zE<`0`HhKCOl;~wzAGBDc-Q3*rlAR1;cKQ1^350}Hr*H~CejL`lG!gYxKDMZbRZ^J{ z!~jt411tXVSGyX3cEvfw;8_@NOk5261=R4{I2fVzra=7$m(<)}3M@AxpS^p*ag>L> z@6pX(FFZ#cPQINeey@zCVz}9l9R4fL~n{4JSAETYP_@f&(qmprrb< zuCNFDILO&yn+R}}g z#->CM$%L(F=|oRmU49tI@3AA;e~JpLIZgjxPv0F#W&elW(2^EPRuh?-*(IS8DseH!$Iigsta90F1Ie_R4YOyJH~bDDPu+&Gx)_vt3*7L9UzH zu7k6W{ZfpisZqxPAp<*vh(8!{bFXd^e7KV*_#P{3vqGy!_=w)WbP8cX~S8sjuu@bb0!Ty9;V0(z}sA0Y`Z~om@ZPM(1&taogiY;oOFAqr^-5b;9HO zuU{gYXMA9WgmN5t`p)*d4lT`m;b(wn-hnI^Iagdl;tg~;lr<0!YC*#nbjsW*9fQvW z+7DKD>OCnI*}HL2pnQV}8FHGTU5d!k&>z9JRNqudqRk}srzc?_rT9KfBv92KKLyrm zhU3z80~044Oi)odIe}M@c>b5lMn4{PY$9V3Mz}DagpZp~#7DN^{7Zjg%yxs{erkp(03ke9$7L<>lqY*cOGdlJ;YD{cvBSb*k@ZdZCyW3z|ZB1OqNaIQm@pL^$TG zp~M;Sz5HKi7DN)<{d=ZHT#A1yoL5^VByfA=Wq{V2O`EoFeAaTXU1woDPZ5GOaK#({ z`atv@E*mNZp3qd9g*0{x_J0YVAe5icP!mB~*)n|Pu~j6>cqk{FQ_L&i45$p^l$nJ$ zZ2be#vU=<}t;Uey8~h6nBe(EHY7&b!XqSqd2i9Yz0iJ&roV{@!;BE^yNQO3(#hI#H z)K#`r@q0|9>vA98=$DehPcctkv>SK+d?wZA`2Lwt9&B?fTJTCX;r$8aF=!E^Z%gam zBDtR-H8mCgA{N+;sevm8LN=nSApG-i)0wKC<>tD!-^q;B3_t+hN5?kDesyNFt*CyW zwWH$eyRz0;23aC1(Q1n%qGPc-KTUn$dVNJLoACb2`y#9kr?AjDK3Z)$Ceft1dMo=0 z^_YV(SnHpBjiZgxQ!%axXA|Qb%wEupA3v;YiM@V29PGn^DH;(KbpQlY5Ob2+i47F+ zqV8-bSR?<6SHRf5RTC4=s3wv8@pq_AiPV5Bi{&WPTOn46276FsP~sqd#P~E5?cRJY>E-PIX(k2KDQw&Wa2rv6Lr^Yxar)^fP41{2UF44e=ex6 zwSe|6MoxQLSNc9juCF8Y1}?ih^?m-3o=}>vU&?FnW;bV7ZKZ5w1j9HJ6VIdbo+_cI z5Ls#Y-(b4EaAsZPg1UB{Umb^OMO<&Zm}=ioQ65VFK*iW>b;U0Wm~p$V=d`do{x&L(kIF1{PiylOi+W^9D!XS&LF#!$?GBZ2R~b^HL4y! zpOXmHbX0qUFC*aw3jZEFcT@=YP)%5oAUqQA{0NQLr1rpO^1+bP`zQy11`xJgWT`nA zYRp0AjE?`}qZ5grPz!`)#uRKr9}%kd2qG+7?}ZS(O^mw{LBs>?3V;J~*6VXNk0G^SLAp=ITm%ec-_6ar`zkfdtVMhZnH(1rooSh*B?svlf z)aEwMhDk?L|8v$7Of{?l!>j>AmMxFscNC!*n>VA4x~yXd zZ}ctfK{1NUCa?v-ffbuYUsXW2=N`7Z$hi|33AKUP>RvX*O}ME*KCQ@mPQrAq@ggkN zcrc6`l}B~sq1b{-9^52~1gcvJ_l6fJjarPoPJGDn9j`4c9`t#E9+}rQiwKsdK&jL%Sfi( z?@>UgcX6dk{leU8UZ13T-{QjiGRKTx3H^d!;Bl%|hEXwGS(Bi`hLt@~P6&?(SXh%t z%?l(F@jDCvqrQTih$NGfBf+37mRt8A?zAjdVsUZTpJr@$NE&Uy1lKElp}l3*+o`g-b$v9!ZLeuRiYSDF???w1ATABY*znMe66{ zR$-|{ilgS&^~{`B*nCG(w98Iw{J%Xy2&_IG7X z_CUivAMkz1VvTtZE2Mt@aAid=DGpULQev_FZ%W*Mr+NOVGMG5kpt??>MnBDS z0*&WGO(`r);iow?%I8^8BEfo!s-}xy&jLdiom*!2x#tj36uOuJ58bH5Z1`NOYJUTP zfY|dkGQzI1HIQdq{{P@ZA{=3@5o3U5N?cs4x5x5qof2v&S)WA@lk(f>MAsrOO)^3h z_bkY(ke5Rrk3Hh7{;k38lZL4&C4&!If0@TiWv$6!yxAsv?x)}ht;2D)^4E>6i**dF zLblxF7o)v@IVrlSG|eN zul4$$(B9)`mALtkNm)pp8MM|4Kw^ZKaISSLfn2#6%N&d-pA63=ER_i>Sg1szFC=_p zmA4aCr66`dt{xH@#MB*-$EkKHod#HI$}LloYJ*P7dCwA?U9d~sw~=s42ho-&W+6+g z&1ywr$nX9o?aJ!N8lcQQdMa>m|QBai? z+4L1Kp}goiIENRxsfh{Dn`b-Odk@}QIQQNH^s?v1PjOr*+<`46)FD0!87f>P`X;12 zeC|iE?Br30A8Y_&C3WL>aor-+Elr4hT{q)l95DKgPty-f7yYrworTJb#^|igDj+0e z0qiI;k{xC$1zPc;^udyJomc7b|B#IB_CgQ_Fi{#MDYW;+lmxq4QhJYawv)h|ZP{JD zHn$;3jt|QT$8R;vUSK6J1m_DFtl6$%^GD67R?rz0Dwt-~szJUZ$|!H9nO`5%OJP)niRO$-H_M-4VrDSdAST_Tfy8G6p6i!QjP zI<&Z`2nis084a6y;$51OnTXGCW&+o7NDSw{y!EI|s zW@fpFWZJ%sr$a5HG?~^3MQWPoc0ubJ@+foOy1Kd%NzNl~9PoGtsOI7l3JYPpq=fMR z1m>|k{HpZ7{(dvK$>RhTC46C33mFf-2JO)w;&LRxkQkSdsmm;Xy+| z&0O_xZXbn!^}_`ZszdE$QonEf?ys7hy3dD^mH+%@-b73IJ7NG9?HgtlxxBm_Z3h-T zq@Sk%-B*79ex>Cofy`C)N87bs3Bxky)EJ_g6i0KhwXJO<6QdZowPt|j7Ztd+W>UsE z+1U+tYJY5R&u!%M#u`4CuRqc?i z3G^)t!EWJ!5_aUMs;Yq36NU2iQf_$Hfyaf4EwP~n3+-F)p-w}i3c)}y{q==wAwr0q z`X|Myro|Dan8KjZKs)^(PvBMASArrZ(U%UUB3GzESrLOjM2-x~fp#hATtv6K(^ZzY zV0je<;!xj++ozvvZ=1pdp477)n4$7JQ<&0(DhN$6@f;dP)*5$$ZjX-Sn~@>%>D*Bak6eZxXh+tb zF0wa*Ar9SBsmj+&jwo?kT88pmA!2IXGd(kdj?m@l=*UO|`@NJD6lSjT4KH`+dZ(os zX;>PVBv@Nw;l&PpETVq&4ICljbaWyWw;0{8F;DHli;`oT9`*ET%ZP&hkJP~dM@!4< zG~2wzPmM>cuU-{9Re-)}ut`BjTvF3ssQAMXZPtr(BJ6X1dM1XB7p0r7(;M8iLgPuT z>AJ_k9%|1IFJqWnOxODiaRq2~put54HWl@kLAl6k@9vqGDYn#iv!6Q4YB2x;!2gDv z`+T%yP7X$W*fM#DVF#x65BF_EUgW0`q6Oer;@KX7RVmC+8%Ha=AQ}Q4=jL0tyl*}k zi|RMDoP7&*_4KHhbMuaaPGv5d=?Sq9?dW5YTyYmayDC@=lE+FzyV-?gZv57BsF#^> z{98u9+j(i|{4vwuS5q~Pb!IGG27)`(Q@)qnnjQYJg|1{LogPBErnt4u+w_r2wIj=a zq@!b{>96?g#A4nhA8z61oU5&D9BY;Fd1#lC;xh7%7r?Be2^94Qu(m{oxl)qo!#`~F zg=&OBZ&OUPL6wu+?0(ENC49$Cn71ZPN%qOTSW|ljw~#K|Dr3r^Twh!_dt=TTI5FvF z;pC^rR=@m)4qEf5VRNo`U*TjiuJv3-T0$&7{M@{E!ny&yrP7Wv`pjXW?mTLCXlCoh z0yB}(tQ}d|_};Nlr$uiQCH7xs;fnP$hv(+^^(|y@Z7Adrs?DGN`*>ohu!NeqtwZ9T zUb8?irGEzvp56eTk-^}H(!0H`+)|5U(A8$rH>Wjv`6>EOhrp zm5D*i4l+LD?=(c6F=Y}$LqO@a@m{e8mUH)(Q>5bpPk3Vx9 z(#J|{qSINw(mH_LXj9QZShttokjNMxZIKoIDViwzD0yP|;@6*t-LLwFw=;FT_cQg* zsmLa8Q}8alZWyEfa&ffIdAYMKNGlxcLWH5b8tin=9i3*)(p8$md;zD4=~3P7W-@>P zR;_ll+9(^cii+;@Q&eAQB;COZ4GM5VyBF<|9OTDAf%sP%tN}oWoCk~s2krpZ)?6S? zx}=1{LbiKVA&DmtEx%7c0cH!mHXc0HM-<9LTO%dK(bk4iu3KPRt~>IW|62E~Aa$>c+Sjjq! zGkUuQ!>pKZRb4x5Qo3i@*C+XptCDHkWj7PEi(R!z9%9$u&|d^@d9v!@dA{u%ui{~0 zfJAT=PX%)kWj*=^41>_nVs;lXgMk8CKg2EYtUDF+q0K4ZH(M)1KzV5E$UZNS{K0iZ zy^rE6t*bEiIQl!L0!>5+i|z>q2mrO?MxZRgl>O9OdXA}ot}fS8mag_>8IK1cmDgHr3ezT{(#7px9{fUgm^qEeb*mFjXCz~Taht9LM8N? zY0Z;p1R_SPFklDvYVG6m6ox-U_X9l}!q<13(xMp7Z~O%Tq7Gk0c$N?{IJDJrb~WST z;CN7VhL}thg?KLnB#4VCDLsO&obHcJRk6Y$r}Z<2^7<|GbaX5PA~!~q_4ytDlHuD) zZH^1~+1-5?^?p*U4+SgYkP{DQh6fZcpEHJTXqM$}_d(LG;0r55W!gG$KNmJf79u{Fgub!J2gROjd6Wp zbLqrZ3KyrS7n5%!relPbEKGP%PL}pM&O31on1;r4l?P+yf#U%|aXgNH5)%C`#VD!) zN22w^v)BQa7ZezwF|tD~1hWU|`l4z2=L`%L^l#v?7`a=fYtJ{>ew%8|U30QnL@0{( z>w0NI%1&V*+xm`a6``Udsxvstej6SOoYVO7zeS8;Z#S1F<`1a?94O%uMU2 z$V;XzUP7#C)%t%f3%mn3#lbPiabkAWs$JXERh4x)et(zj^xw(a@4dT0EB%e7QUBu! zruI$i8h+LNTGkxbkoL3CGFk3BH1(5FPVT~RZGmPX^DSfL4cs-%#5JY4K4?`iBA!9{B66_{kBMH%OhiPW~)<~2CcOKS$O5BGMU zCCdX!%fxaHURU`005-^EToOJ1?6_ZRm6vsqyPt>RS#-MSeQ|O{@^97+I0N}Q0bt!k zDbG8tiDjLJr#CS+#lW|jB?-?CCkRlT3`$9Y2L;*xabnouBLb@5E8^KXU`sitNJ9?@Do757ZtNdv+M z;vs>qOhVPEFW>zz+BvpIB05b>s|!Eu@ByI($jW&G19cMVgUHP+tR3Up<$~ww7!eS) z6+jP!GMw3@;^Ihxs*mFXI04QUK>V?&bGf6}9yA`pJQW}hf$Kn0uWX@rj93Q8comf; zA@UZeI*Xs*CKW_faPQx{wHp}-xz+;-N8byVh2dD=r-XSb9`;)}Q7A1|DW%bU4*zqD z!Yv2EgZSTV92{N?HAaRQb=sc#0)i=CAwh=jz>tWhg|+Ioi`V~NEaksGOf{F#yk?T= z{=w;o>;0eUMw8n}QZacsZt@+R%`RkqwaANaM(c0Zifr;u?r2^)$~o};tW5g;L!)V5 z-859SrL=-`gc0kZaor%UEW9mBTwmb!L;jKQnPH*Syq>Tzmtwf$KAS5PrX#z36DiIE zYKp-mIy!@vSJEK)NYi+?Z`5y`>)W^p@ph`jLC!#rfr;6~^=1y3>%x~?6}|<7(JMj6 zjM%3bkP zAmOBiFW&h3^La)FhWclxSW}=PkGq9hn7{&&wg%vCfN~5lBI+rqmUT6~E!Q)PIGfZa zwMDBP0h?gLE`C3y^tHQh`LBbTVuo%DB<*mYd&f7y-l$OcW_8SE){@VT55nUrM`QVl z3VSO1<=su%vCILsnD_7K`g-|83oH*0^M6$3pE)D7fje*gMJ4OPOdVPJD!{nV27{)B7Zr=sydkHt7f)!hfoY1S8NC@Y_Y1rg!#wuDF9^Rq$PSH+nAzJu z#No#7tsqOH@-elO+F{W-+fE8R85|UM+<;jPBq-5c^%ObZ#{726&g**D4)0QPHncyk zH#wpiK)n^S;9lhTV{F=UHCsr0qfqD9({aZQi*J8oRtVi_wTE+m<{b}~$kBoaTq)Ni zpXdfA>b|3#J=5V)D5`v+!}Dcj&F{A{YPL>E-;I^G!+a9N$-mU#PyYM#uSYx8eV@;V zc%`rb!{_^a`R3)EG?GwGWKNHl;oU7D7KTFW^5)H@fT+5ECYaF;8T^dE#4taAS0;u{ zysV7kva%Rl4V^Imx$hy1$l8O>yu#u7QPI)yh!6m=z@M9meOB{sUL>& z0H2A)l=78@@?rSCiXbzU9kl8im;jBm6>I@;Pc8$W>$VLM9%ozOq^aINNDN%WlB>NO^utH<88=(M?|EL~4z5xiI@X|zXU>gOIMN1G)D zTdj5v>=&VLMvxfhS8;khy$kV4@$W|q9AXsQ#7qHv1vhy@dXF&L0IH5+xTPnHFgi8~ z7ZTj_Xo{%E`2Hd&nt1fzCD8!6%@LqDQnYo$#*#Jb811+CI#Ud=>4%dPqu}o7@#X?( zZ)$4mGRx)#QQRl$T>a_4t2>NSz`Cc3y*v91uPeIoz8ZA!n!dQ7Mkn(W? zAS++$E`R;v#ib{7H82N2OGq@x&D!UnBzTkg-ssU+9j{NH>3AucpPSpH?2xURO{aFw zXtaM>iH@`|4Zpp?j{E(SPhA@=?(i_aXVuW11kly^dVAZ$}0fLzjHc4MN3%@m8z;1^@`_e!mDY!@1P&_&SLI~fYl z$+_NGXYxGvi9z{Ud^`h^JJJH$8;mxyk?nH2(jqU#A)6{{N!VWHW8NgWgE-koFuy@MKxKuN z)BLmhKhKP)BCYu43otr!1<;yF^%liPI zV}u6@EI@%rVvBjNq;^rLbQ+SI-=V`dCnFuw0!u}vv@@ak)t z=!cR`UJjgbVIrqkD@L~`|JA7HFyhc?J8xU(V0xq6Ch8=}m9gHFn-Go3x>K0c5~{Cp zasH@@;kF66my^aT!)iOI=<=lSz&kG-0x<-{zlZ2m(gMAqPq z5(oFuPLmr!SQu?*U+7y|>azhs8j}~GWk3{Vul-;}X+)tgf|jHN4|)%*+Y+nJsP#Z^ z|3?r7h2iSN*P7_#{=YPZcUk!O_;mAajfsst)t*O^Ah=GFl56$pT#zcjV*|wIME8Cc zdrz27Fw!*ox(&f=IUyMSDeT%6`q?J`$}fpNeIV@P)g^%95D9*DW{f3dmfRoJRl!TM z0)tM?dnWJ$2e;sU-2nN0cpN{5fl=(aGh=;DjQKYg{PXd3A$>3E%lsg5&&H6daSd)mdfRXqTPvR@oYzmT}$Jy^jkE z`1yxfwT5Rp2Nq}6+RdD5y9UonG@;1uM%o^;QZ~@SfLw#uX9fP$dQ`V%(62e z1?=^i-H$RAOBC-=4}l0>sj}@TF|{E&?SlAQOTR$d(HgxK4xir>yNQ9Yk;9(ZYW&;V)#G>5`C#ZY|@+F+lSo|*Z)1c;29i) zdMP|~%Ja-QZS6L}ElPb$oH5To_g^IpZuu#A&M@`z?pD|$#JDdjSf#L+@4S6(Na@V- z&-m|uu2RO7bX_{bC8lU z0+NS@#sjMjcSztWV;f~vL=u}`Q2m_7$E2CPW(7(aqLNLd1twpXw z#alBl0U4LOouf4)Zjh|87?L*(hSM30NI-@28Na<3q`;UL5&3y}S3!dXFyZ2F2+A4K zz!xm7c*8M$vA1t2X3mK|cvd1(weuQAq@X4wU?!86%n@`FOP*BHE=)AC#O)(P+$}Bd zw6(RB&U51!Lk<^ZbDr551HQ-4!97wrW|xb%xWpj9CRZ#h7e+*28e+3_bon6&qLTZw z!@(s0$0C}QSI-PYQjE)2J-sqLp2=om8P?pu%hq}&np-P7f+TQh*v0@ymm>)5EJCGG zn>C6?!#Ovgf^LpP>^l8}M5vTw=0U^~EJ+b7Kr4%_E7)K?){l)5Ecs^0hkIZIO{~;F z#C#p0UJS^NaClcCk+$wVMnod$l_aK~ME8ePb;2rDrqBEFKc2=u&^*6k%?~9TU=)D9 z=FZM-KV5~yq5q2o2(5$Fg&3d(po^tX7iWwDoCo?-P$DpTQkxaks)ztfkV^oqk}9`S z+WWgS>ih)OjL~ueeGAy5%rPRA=Hcx$%WGdCT0gm_85JBf`>rkV)h_8xX<#Im*;)EK zZ$GVn(N_rO7m?LDjfb?qjOXBJm?y7MVaU6$SjTHzCok-Czv%~FD*>B`9*G7k*0}QM;oqF-rmG`xI4eqDZs2T&-?^< z%R!x^y`Gtjn#CKG7}(Z2(^Zzds?;F><0`~=5{fl zb8k^vnNpfMxANy);$Ca{80<0qBj^pza&g4Mc^A|G$co}3>(jR2Rl*HC&w3Z!$8^WD zerxRBT>9}>1SA_=TjVjmb*l?sqn7yR(stR~8(fdVKe{g~KJ8dBa@j;>e*f8YP}TT( zV7kq{!nA@pmwXLY>f* zO7NRjylrgF%8~Q}(kUG*`p`U)pAl0W&|#38gx#wbp7=kH?y{GD(=Qg4=-|13Va;e2 z@1`OiyU6e{X(HznKx*qCyod(7b_jvz{vPzE1$C35d)9j*!OT^rNucM8k>$ z0g8XjuDWnHf1UDWTU!dI#tzT(ev||^lPxY^UZvIER2@ABvLpbocBeW)6a$#uq66xV zYwfJUZy`E`Pp2WkadN5i_`a-U-pa{@1cPn=Mtyg?e|;W*f5e@J86r49=t`-RA3#(_ z^!7d$o4}mU(Xs+A6qF~@9a~Dyv({*m9gjrHiirWD`d0;bH$8m$Flg2pr4}mMmnkIz z{s6n_a&c9E?FutS@!V`|Muz#gq$z1mNd=j34bf&@rykmo(1Ra=!v^oZPUVk%FcGRrSWO`+`DNWI|rCHGig@RW`=D|WA%84uCLzda%?5Xx!-G69--=Hops zu^&pC+1||cMOsn;I@95A=Y=n`mu;sQ_^mOO z0+sZ_OxAq-LllADnLUqB&Ll%Iz76Z|n{OjwQUS`%ipD*0;x3)Y>ld zXX!bV?(E*uo%;)o7aA(b7i%Atk`Hlv;abMHp#VH zV6%*hHfye>E&P@EK;ZQ8oE3zl~U== zd~^xeYyJHEy4z*h8ROC-qYN#Bdjv%9{idK>)ns#bbD&T9l_+wp66>8o{ruMS zPmV&5uzl5=@@u{3uy1O9@5d|y=ip1E0{g_43u0Eg_zC2VIKM1uNd^D^Pu|L15;gW1 z>_310Jbiw?8!!9SxyiwF$65!ZHz-Ve`aw>kL6jQjsi1^?ln;Xv_-PB%4H2azrKGAC z7hhR<$1tJi0HguP-SL`E$K5!7to`CkL>}Nn3r12*Qw8M^sZL+G;DeR{+drZw2orrj v64N*hsJPW)QxTT};cWM&e>~B Date: Sun, 15 May 2016 19:52:37 +1000 Subject: [PATCH 292/439] updated whitelist urls From Amit: onboardingservice-prd.trafficmanager.net sevillesettings-prd.trafficmanager.net sevillefeedback-prd.trafficmanager.net --- ...bleshoot-windows-defender-advanced-threat-protection.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md index 4378da7bde..bb91922bc5 100644 --- a/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md @@ -36,6 +36,10 @@ U.S. region: - dataaccess-eus-prd.cloudapp.net - daasmon-eus-prd.cloudapp.net - daasmon-cus-prd.cloudapp.net +- onboardingservice-prd.trafficmanager.net +- sevillesettings-prd.trafficmanager.net +- sevillefeedback-prd.trafficmanager.net + EU region: @@ -43,6 +47,9 @@ EU region: - threatintel-weu-prd.cloudapp.net - dataaccess-neu-prd.cloudapp.net - dataaccess-weu-prd.cloudapp.net +- onboardingservice-prd.trafficmanager.net +- sevillesettings-prd.trafficmanager.net +- sevillefeedback-prd.trafficmanager.net ### Windows Defender ATP service shows event or error logs in the Event Viewer From 841875446613893919e0bed2fa9aa1db1be9ef7a Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 16 May 2016 12:24:07 +1000 Subject: [PATCH 293/439] sort URLs in alphabetical order --- ...ows-defender-advanced-threat-protection.md | 26 ++++++++++--------- 1 file changed, 14 insertions(+), 12 deletions(-) diff --git a/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md index bb91922bc5..1d15cf5dd7 100644 --- a/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md @@ -30,26 +30,28 @@ Depending on your region, add the following endpoints to the whitelist: U.S. region: -- threatintel-cus-prd.cloudapp.net -- threatintel-eus-prd.cloudapp.net -- dataaccess-cus-prd.cloudapp.net -- dataaccess-eus-prd.cloudapp.net -- daasmon-eus-prd.cloudapp.net -- daasmon-cus-prd.cloudapp.net -- onboardingservice-prd.trafficmanager.net -- sevillesettings-prd.trafficmanager.net -- sevillefeedback-prd.trafficmanager.net +- daasmon-cus-prd.cloudapp.net +- daasmon-eus-prd.cloudapp.net +- dataaccess-cus-prd.cloudapp.net +- dataaccess-eus-prd.cloudapp.net +- onboardingservice-prd.trafficmanager.net +- sevillefeedback-prd.trafficmanager.net +- sevillesettings-prd.trafficmanager.net +- threatintel-cus-prd.cloudapp.net +- threatintel-eus-prd.cloudapp.net + EU region: -- threatintel-neu-prd.cloudapp.net -- threatintel-weu-prd.cloudapp.net - dataaccess-neu-prd.cloudapp.net - dataaccess-weu-prd.cloudapp.net - onboardingservice-prd.trafficmanager.net -- sevillesettings-prd.trafficmanager.net - sevillefeedback-prd.trafficmanager.net +- sevillesettings-prd.trafficmanager.net +- threatintel-neu-prd.cloudapp.net +- threatintel-weu-prd.cloudapp.net + ### Windows Defender ATP service shows event or error logs in the Event Viewer From 01a39f1306283fa7ef565be474c3bf71d70aae0e Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 16 May 2016 16:10:33 +1000 Subject: [PATCH 294/439] add text to remove blue font in code block --- ...xy-internet-windows-defender-advanced-threat-protection.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md index 9a7265a85d..aef3743b8f 100644 --- a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md @@ -69,7 +69,7 @@ After configuring the endpoints, you'll need to verify that the correct proxy se 2. Enter the following command and press **Enter**: - ``` + ```text netsh winhttp import proxy source=ie ``` An output showing the applied WinHTTP proxy settings is displayed. @@ -85,7 +85,7 @@ After configuring the endpoints, you'll need to verify that the correct proxy se 2. Enter the following command and press **Enter**: - ``` + ```text proxy [proxy-server=] ProxyServerName:PortNumber ``` Replace *ProxyServerName* with the fully qualified domain name of the proxy server. From cf569a2c1a1e85522c1e5ad3fa9880745f426dbc Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 16 May 2016 07:07:12 -0700 Subject: [PATCH 295/439] uninstall list update --- .../windows/set-up-school-pcs-technical.md | 34 ++++++++----------- 1 file changed, 14 insertions(+), 20 deletions(-) diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index 5bf30b870c..47d7e4e1e9 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -81,26 +81,20 @@ However, the PC is also configured to not interrupt the user during normal dayti The **Set up School PCs** app produces a specialized provisioning package that makes use of the SharedPC configuration service provider (CSP). -* Uninstalled apps - * 3D Builder (Microsoft.3DBuilder_8wekyb3d8bbwe) - * ? (Microsoft.Appconnector_8wekyb3d8bbwe) - * Money (Microsoft.BingFinance_8wekyb3d8bbwe) - * News (Microsoft.BingNews_8wekyb3d8bbwe) - * Sports (Microsoft.BingSports_8wekyb3d8bbwe) - * Weather (Microsoft.BingWeather_8wekyb3d8bbwe) - * Phone dialer (Microsoft.CommsPhone_8wekyb3d8bbwe) - * ? (Microsoft.ConnectivityStore_8wekyb3d8bbwe) - * Get Started (Microsoft.Getstarted_8wekyb3d8bbwe) - * Microsoft Office Hub (Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe) - * Solitaire (Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe) - * Skype (Microsoft.SkypeApp_kzf8qxf38zg5c) - * ? (Microsoft.WindowsPhone_8wekyb3d8bbwe) - * Xbox (Microsoft.XboxApp_8wekyb3d8bbwe) - * Xbox (Microsoft.XboxIdentityProvider_8wekyb3d8bbwe) - * Groove (Microsoft.ZuneMusic_8wekyb3d8bbwe) - * Movies and TV (Microsoft.ZuneVideo_8wekyb3d8bbwe) - * Outlook Mail and Calendar (microsoft.windowscommunicationsapps_8wekyb3d8bbwe) -* Local Group Policies +### Uninstalled apps +- 3D Builder (Microsoft.3DBuilder_8wekyb3d8bbwe) +- Weather (Microsoft.BingWeather_8wekyb3d8bbwe) +- Get Started (Microsoft.Getstarted_8wekyb3d8bbwe) +- Get Office (Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe) +- Microsoft Solitaire Collection (Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe) +- Paid Wi-Fi & Cellular (Microsoft.OneConnect_8wekyb3d8bbwe) +- Feedback Hub (Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe) +- Xbox (Microsoft.XboxApp_8wekyb3d8bbwe) +- Groove Music (Microsoft.ZuneMusic_8wekyb3d8bbwe) +- Movies & TV (Microsoft.ZuneVideo_8wekyb3d8bbwe) +- Mail/Calendar (microsoft.windowscommunicationsapps_8wekyb3d8bbwe) + +### Local Group Policies > **Important**: It is not recommended to set additional policies on PCs configured with the **Set up School PCs** app. The shared PC mode has been optimized to be fast and reliable over time with minimal to no manual maintenance required From d7569ea192b225f8f27c7937935d30992f1a1819 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 16 May 2016 13:32:08 -0700 Subject: [PATCH 296/439] added proc --- .../set-up-students-pcs-to-join-domain.md | 30 ++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-) diff --git a/education/windows/set-up-students-pcs-to-join-domain.md b/education/windows/set-up-students-pcs-to-join-domain.md index 3de5764c97..46f364291f 100644 --- a/education/windows/set-up-students-pcs-to-join-domain.md +++ b/education/windows/set-up-students-pcs-to-join-domain.md @@ -16,9 +16,37 @@ author: jdeckerMS > [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] +Use the Windows Imaging and Configuration Designer (ICD) tool included in the Windows Assessment and Deployment Kit (ADK) for Windows 10 to create a runtime provisioning package. [Install the ADK.](http://go.microsoft.com/fwlink/p/?LinkId=526740) + +Watch this video to see a demonstration of using Windows ICD. + +1.Open Windows ICD (by default, %windir%\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe). +2.Click **Simple provisioning**. +3.Name your project and click **Finish**. +4.In the **Set up device** step, enter a unique 15-character name for the device. For help generating a unique name, you can use %SERIAL%, which includes a hardware-specific serial number, or you can use %RAND:x%, which generates random characters of x length. +5.(Optional) You can upgrade the following editions of Windows 10 by providing a product key for the edition to upgrade to. + - Home to Education + - Pro to Education + - Pro to Enterprise + - Enterprise to Education + - Mobile to Mobile Enterprise + +6.Click **Set up network**. +7.Toggle **On** or **Off** for wireless network connectivity. If you select **On**, enter the SSID, type, and (if required) password for the wireless network. +8.Click **Enroll into Active Directory**. +9.Toggle **Yes** or **No** for Active Directory enrollment. If you select **Yes**, enter the credentials for an account with permissions to enroll the device. (Optional) Enter a user name and password to create a local administrator account. + +> **Warning**: If you don't create a local administrator account and the device fails to enroll in Active Directory for any reason, you will have to reimage the device and start over. As a best practice, we recommend: + - Use a least-privileged domain account to join the device to the domain. + - Create a temporary administrator account to use for debugging or reprovisioning if the device fails to enroll successfully. + - [Use Group Policy to delete the temporary administrator account](https://blogs.technet.microsoft.com/canitpro/2014/12/10/group-policy-creating-a-standard-local-admin-account/) after the device is enrolled in Active Directory. + +10.Click **Finish**. +11.Review your settings in the summary. You can return to previous pages to change your selections. Then, under Protect your package, toggle **Yes** or **No** to encrypt the provisioning package. If you select **Yes**, enter a password. This password must be entered to apply the encrypted provisioning package. +12.Click **Create**. + -text From 53fe36898c996e452cab6caee3924a19f51c0bc6 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 16 May 2016 13:35:12 -0700 Subject: [PATCH 297/439] fixed list format --- .../set-up-students-pcs-to-join-domain.md | 41 ++++++++++++------- 1 file changed, 26 insertions(+), 15 deletions(-) diff --git a/education/windows/set-up-students-pcs-to-join-domain.md b/education/windows/set-up-students-pcs-to-join-domain.md index 46f364291f..029afa4b45 100644 --- a/education/windows/set-up-students-pcs-to-join-domain.md +++ b/education/windows/set-up-students-pcs-to-join-domain.md @@ -22,31 +22,42 @@ Watch this video to see a demonstration of using Windows ICD. -1.Open Windows ICD (by default, %windir%\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe). -2.Click **Simple provisioning**. -3.Name your project and click **Finish**. -4.In the **Set up device** step, enter a unique 15-character name for the device. For help generating a unique name, you can use %SERIAL%, which includes a hardware-specific serial number, or you can use %RAND:x%, which generates random characters of x length. -5.(Optional) You can upgrade the following editions of Windows 10 by providing a product key for the edition to upgrade to. +1. Open Windows ICD (by default, %windir%\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe). + +2. Click **Simple provisioning**. + +3. Name your project and click **Finish**. + +4. In the **Set up device** step, enter a unique 15-character name for the device. For help generating a unique name, you can use %SERIAL%, which includes a hardware-specific serial number, or you can use %RAND:x%, which generates random characters of x length. + +5. (Optional) You can upgrade the following editions of Windows 10 by providing a product key for the edition to upgrade to. - Home to Education - Pro to Education - Pro to Enterprise - Enterprise to Education - Mobile to Mobile Enterprise -6.Click **Set up network**. -7.Toggle **On** or **Off** for wireless network connectivity. If you select **On**, enter the SSID, type, and (if required) password for the wireless network. -8.Click **Enroll into Active Directory**. -9.Toggle **Yes** or **No** for Active Directory enrollment. If you select **Yes**, enter the credentials for an account with permissions to enroll the device. (Optional) Enter a user name and password to create a local administrator account. -> **Warning**: If you don't create a local administrator account and the device fails to enroll in Active Directory for any reason, you will have to reimage the device and start over. As a best practice, we recommend: +6. Click **Set up network**. + +7. Toggle **On** or **Off** for wireless network connectivity. If you select **On**, enter the SSID, type, and (if required) password for the wireless network. + +8. Click **Enroll into Active Directory**. + +9. Toggle **Yes** or **No** for Active Directory enrollment. If you select **Yes**, enter the credentials for an account with permissions to enroll the device. (Optional) Enter a user name and password to create a local administrator account. + + > **Warning**: If you don't create a local administrator account and the device fails to enroll in Active Directory for any reason, you will have to reimage the device and start over. As a best practice, we recommend: - Use a least-privileged domain account to join the device to the domain. - Create a temporary administrator account to use for debugging or reprovisioning if the device fails to enroll successfully. - [Use Group Policy to delete the temporary administrator account](https://blogs.technet.microsoft.com/canitpro/2014/12/10/group-policy-creating-a-standard-local-admin-account/) after the device is enrolled in Active Directory. -10.Click **Finish**. -11.Review your settings in the summary. You can return to previous pages to change your selections. Then, under Protect your package, toggle **Yes** or **No** to encrypt the provisioning package. If you select **Yes**, enter a password. This password must be entered to apply the encrypted provisioning package. -12.Click **Create**. - - + +10. Click **Finish**. + +11. Review your settings in the summary. You can return to previous pages to change your selections. Then, under Protect your package, toggle **Yes** or **No** to encrypt the provisioning package. If you select **Yes**, enter a password. This password must be entered to apply the encrypted provisioning package. + +12. Click **Create**. + +> **Important** When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. From 4398c5d23192606689c0889cbd166ae3d8b0fbd8 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 16 May 2016 14:04:12 -0700 Subject: [PATCH 298/439] sync to switch forks --- education/windows/set-up-students-pcs-to-join-domain.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/education/windows/set-up-students-pcs-to-join-domain.md b/education/windows/set-up-students-pcs-to-join-domain.md index 029afa4b45..245a3f6520 100644 --- a/education/windows/set-up-students-pcs-to-join-domain.md +++ b/education/windows/set-up-students-pcs-to-join-domain.md @@ -47,9 +47,9 @@ Watch this video to see a demonstration of using Windows ICD. 9. Toggle **Yes** or **No** for Active Directory enrollment. If you select **Yes**, enter the credentials for an account with permissions to enroll the device. (Optional) Enter a user name and password to create a local administrator account. > **Warning**: If you don't create a local administrator account and the device fails to enroll in Active Directory for any reason, you will have to reimage the device and start over. As a best practice, we recommend: - - Use a least-privileged domain account to join the device to the domain. - - Create a temporary administrator account to use for debugging or reprovisioning if the device fails to enroll successfully. - - [Use Group Policy to delete the temporary administrator account](https://blogs.technet.microsoft.com/canitpro/2014/12/10/group-policy-creating-a-standard-local-admin-account/) after the device is enrolled in Active Directory. + - Use a least-privileged domain account to join the device to the domain. + - Create a temporary administrator account to use for debugging or reprovisioning if the device fails to enroll successfully. + - [Use Group Policy to delete the temporary administrator account](https://blogs.technet.microsoft.com/canitpro/2014/12/10/group-policy-creating-a-standard-local-admin-account/) after the device is enrolled in Active Directory. 10. Click **Finish**. From 4dc10a879f5a313133e0971d6e6ea709a4a18e03 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 17 May 2016 07:03:50 -0700 Subject: [PATCH 299/439] new topic staged --- education/windows/TOC.md | 1 + education/windows/index.md | 1 + education/windows/take-tests-in-windows=10.md | 36 +++++++++++++++++++ 3 files changed, 38 insertions(+) create mode 100644 education/windows/take-tests-in-windows=10.md diff --git a/education/windows/TOC.md b/education/windows/TOC.md index f7d2916ea9..1681d0003a 100644 --- a/education/windows/TOC.md +++ b/education/windows/TOC.md @@ -2,5 +2,6 @@ ## [Use the Set up School PCs app](use-set-up-school-pcs-app.md) ## [Set up School PCs app technical reference](set-up-school-pcs-technical.md) ## [Set up students' PCs to join domain](set-up-students-pcs-to-join-domain.md) +## [Take tests in Windows 10](take-tests-in-windows-10.md) ## [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) ## [Chromebook migration guide](chromebook-migration-guide.md) \ No newline at end of file diff --git a/education/windows/index.md b/education/windows/index.md index a087ed8190..47b8a29118 100644 --- a/education/windows/index.md +++ b/education/windows/index.md @@ -19,6 +19,7 @@ author: jdeckerMS |[Use Set up School PCs app](use-set-up-school-pcs-app.md) | Learn how to use the Set up School PCs app to quickly configure new Windows 10 PCs for students. | | [Set up School PCs app technical reference](set-up-school-pcs-technical.md) | This topic provides prerequisites and provisioning details for using the **Set up School PCs** app. | | [Set up students' PCs to join domain](set-up-students-pcs-to-join-domain.md) | Learn how to create provisioning packages to easily configure student's PCs to join your Active Directory domain. | +| [Take tests in Windows 10](take-tests-in-windows-10.md) | Learn how to configure and use the Take a Test app in Windows 10 | | [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) | Learn how to deploy Windows 10 in classrooms; integrate the school environment with Microsoft Office 365, Active Directory Domain Services (AD DS), and Microsoft Azure Active Directory (Azure AD); and deploy Windows 10 and your apps to new devices or upgrade existing devices to Windows 10. | | [Chromebook migration guide](chromebook-migration-guide.md) | Learn how to migrate a Google Chromebook-based learning environment to a Windows 10-based learning environment. | diff --git a/education/windows/take-tests-in-windows=10.md b/education/windows/take-tests-in-windows=10.md new file mode 100644 index 0000000000..b2ee59bd77 --- /dev/null +++ b/education/windows/take-tests-in-windows=10.md @@ -0,0 +1,36 @@ +--- +title: Take tests in Windows 10 +description: Learn how to set up and use the Take a Test app. +keywords: ["shared cart", "shared PC", "school"] +ms.prod: W10 +ms.mktglfcycl: plan +ms.sitesec: library +author: jdeckerMS +--- + +# Take tests in Windows 10 +**Applies to:** + +- Windows 10 Insider Preview + + +> [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] + +Many schools use online testing for formative and summative assessments. It's critical that students use a secure browser that prevents them from using other computer or Internet resources during the test. The **Take a Test** app in Windows 10, Version 1607, creates the right environment for taking a test: + +- A Microsoft Edge browser window opens, showing just the test and nothing else. +- Students aren’t able to go to other websites. +- Students can’t open or access other apps. +- Students can't share, print, or record their screens. +- Students can’t copy or paste. +- Students can’t change settings, extend their display, see notifications, get updates, or use autofill features. +- Cortana is turned off. + +> **Tip!** +> To exit **Take a Test**, press Ctrl+Alt+Delete. + + + + + + From 463a9a66945c9063c00e685fb1dc0c5487743546 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 17 May 2016 07:17:50 -0700 Subject: [PATCH 300/439] fixed filename --- .../{take-tests-in-windows=10.md => take-tests-in-windows-10.md} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename education/windows/{take-tests-in-windows=10.md => take-tests-in-windows-10.md} (100%) diff --git a/education/windows/take-tests-in-windows=10.md b/education/windows/take-tests-in-windows-10.md similarity index 100% rename from education/windows/take-tests-in-windows=10.md rename to education/windows/take-tests-in-windows-10.md From ded583a15c43f56885c40721d8f63ad800f849f1 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 17 May 2016 08:25:42 -0700 Subject: [PATCH 301/439] restrctured take-a-test --- education/windows/TOC.md | 3 + education/windows/images/take-a-test-flow.png | Bin 0 -> 19438 bytes .../windows/take-a-test-app-technical.md | 88 ++++++++++++++++++ education/windows/take-a-test-multiple-pcs.md | 88 ++++++++++++++++++ education/windows/take-a-test-single-pc.md | 76 +++++++++++++++ education/windows/take-tests-in-windows-10.md | 41 +++++++- 6 files changed, 295 insertions(+), 1 deletion(-) create mode 100644 education/windows/images/take-a-test-flow.png create mode 100644 education/windows/take-a-test-app-technical.md create mode 100644 education/windows/take-a-test-multiple-pcs.md create mode 100644 education/windows/take-a-test-single-pc.md diff --git a/education/windows/TOC.md b/education/windows/TOC.md index 1681d0003a..05d7f25c10 100644 --- a/education/windows/TOC.md +++ b/education/windows/TOC.md @@ -3,5 +3,8 @@ ## [Set up School PCs app technical reference](set-up-school-pcs-technical.md) ## [Set up students' PCs to join domain](set-up-students-pcs-to-join-domain.md) ## [Take tests in Windows 10](take-tests-in-windows-10.md) +### [Set up Take a Test on a single PC](take-a-test-single-pc.md) +### [Set up Take a Test on multiple PCs](take-a-test-multiple-pcs.md) +### [Take a Test app technical reference](take-a-test-app-technical.md) ## [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) ## [Chromebook migration guide](chromebook-migration-guide.md) \ No newline at end of file diff --git a/education/windows/images/take-a-test-flow.png b/education/windows/images/take-a-test-flow.png new file mode 100644 index 0000000000000000000000000000000000000000..6ba26e08d5dc12756b97c29158f814242f692174 GIT binary patch literal 19438 zcmeFZXH*kkzdss8Kn27C(gf@@DN=ucbOA-_B^2odkSZl0gr=xSN2Q4L-djLQAOtL- z6Kbd-Dm_3Vy@uQYpXWU1tpB=qo%`m#x-VE{vS;?}J+sUAQ@)AN)z)A<$8in>0x>>% z_&^^7I;8*tQNhp90^iIQ^?d;TQF-fYsDLW^t}X!wryZ5GltG~CIQl~y8sPZs^M|J1 zAkg{m$A46bg6BCwpvPg49w-~Wuw2E__g@_eS|DFRym}pf;dg9&{Cnl3&#RLxHTV5AW-YrwLd_CUD*FwP!vf04Nsn`|5%t2 z!Vjad{-k|Bz;k_Tc{&~WwJ2x$^k)M@599NJ!iep+v%4cMa4_iYQc5`XwqF@i0QN>t z4S80guxL83l>UEx$N$@={4WbKFK&e=r+=8*%pU0+?>>*2F1EV7;gst6)X^H@ImNX} ztVu3_*f1g0k?I0}QskE7eKdBz9%yUD{^Mi3O*Fjv;G6f?oW{#^x8~>>l1Kcr!wHRb z?6tvTNRNeN(T>a5J{sXm4 zYq9U1v8-6-tQnd^at-#^*)CCZG3I`+O|nEuHXfET<;S6R4;%+~K1*;x-9K(zZH(4o zfo90p8eLvq?3-CCZ@P27;~?{e46L4A%Nc1d2URVz^PFUw~4�~HYy%S#}y9Icsm*^@L#2Khv`WQ zCM6^HhTY<{PN(y7$w;Sb>LocbkEFa5ERFE*0|w=aKR>GlOx5dw%7z zFIN$$;(&)UNA9z}gC=zdaog&aA}l~-+x(BzCXq~>7yj$O#s20tn{n1De! zLbgjZ^jds(1zcsGYT6h-vOp*8DI)FspL69C*1_rF`z=tZJn`$4CtVbwv*q3?@W%PC zmp@7hvN}}WIoKwr4u!LC%jzUMa+@VjRd1K9u&5iMwhC59Cz2_PN?9{lBcg&wd(P^p zY*Gv5qtN9L@J-@q3c>i#UV9>(Bj7usydPgW%=E1Y({pY0O^|dQH#v}3r>tV5J~gqt z8}FbGQGCu=+85*IC!~?+pR~0br1+4yxBg|kv>1J7W`?!diEbZfB`*aV$qgIBf67U3 zc8X6MXf`Zflxx`l3u!7GVrOc=d$p>sllI;UYSSOp8Co0#&tJT}FEk+Q(wJ8P_aBit zNbiHvcCpoV>zi_+`poa6l7Hyh%{zt}^GJsb-uva-w)o;KjeHI&Xx>5)4u0fCvYQ+# z4i+)oAx{u)4n0e$NV!80AHBA!c2`tX>gR4Jt6#nW|Gu`OYty)tf&bp7G>z@`qu^`g z?W9ffg(Nqa>Xg5+UIIU<@^nGOxgn{*L?<&m3@_83hhfP!w<_m(B=Bm4mPKtP7)2cX z=9oNTqK+aRp?TeL@hz3KEqq%gkZQg$GS@*&d`UMRbKjOF#@GEos6Kj2*M~%Eg>=pD z%Vla(3LvaIejb#iq)p@~mf3+R^>Hg+QY=pXB=b>d-8QF5>({6`W zTtTL194my{l`^W@o?P}cz{zWgGdT|<>ChgVYY-Sq+^ zW`$aP^Bt?oY(Eyzgi75>zfq0Qp46hAimFRFb$-%8I7D%GOh^$U6lF8qsOIL8;*WL9 zJH^A*;QSz8Gt=$vCGfANrOEC-g4+|8W|Vi}Qbpm=QbZKf_7b}2(jVyxliN4k@y|ON z3pWMMt}YTuV?UL-d|LkY8sdLc@?*&mHB(pu{WEbs4J;+4h;rRt*hEWJ_YFndQ@9{` zM|P$@Jl#!ja$}3K@pS)b-O4}z2&=_>2zkg_W>(!rIxe1E*JwmWL$ z4N1|yZLG*ps$lMGe_z$S4tZuogcz`RPPl%B#oozZkvz&-qqDgvM=<7m;AGn6USqXY z7k74*PHmkqRi8dUU$u`D&Vg)?-uB3Vau&C?#}t*icbF3=6SSd8%#Z0O-US4qaRXab zkq*C_*Qt_oY$<-W{1$jmjZKc_LQC0CnnL=}y@M2ul``}^GI&UEsrF%!t4{&DS4TAa zcujGv<(OP9`@Af57>D}2c1(ERPt~@!9P_$d{_~IM2cMO>bRp_|dd92WNsZ$srM(id^+pyl(%^{n%56^mY3eOP2e(gh|2^4z}HH zDX6hv-CLD?U$P3En#SM>&tO1rj99ol*2*VUd_!Fp1TMEtqFL3@k-BPa;Zh&)tfo@G zd*t{Y6f2Qi@~IDO823MlY>PdBoJ_Xs*)^YaGyNVaLJZndTCPi!A?uzFEc03H* z?hd=iIV!ds-x*UL)Na9BFQ>6wdRgKNmqL&R#1ZF0K2z?kC(|(5gB|KU+`0)geR)RA ztuX~un z?IK4jQ(gYCsrPe3wTI$lzU$;8z0$(bp8(W3wbt5DWJlmu+y2 z^xrpKSdwrGi|}Q$FH7QxlowwBbBwat9iS8~+s9sfSe4t+mc{b;ZzuZ5NGO>ymLnPs z+o#w5JRau_*yIZ8W6CItD(&*znX2=GYDSxj{FsQszc3(uS6Ti|%Sc2VjOUAC5%RCD8b)K}7r+5CufCAmUk zNLJ~E=;@7{)5at{l&YhJS9St|BGu`@@8AkVr7t;ntaj#Tz3@Z_M@OQ@GnIVG`m9hC zc5QQJUS}`8q}$4Ync1639PMoW*tL%$7$=9iU#mvOCijo1{^n__ zw!3AlxamD*Bwwc*8T`$IIvSnL*KpQ?1p@s*u`u7c;P$OKl`e85+o-z@?@(86yKH>R zZ~@__k+`Z~x60VNF%Og8fD76zQSzKtQfLojXZfqfi{T|EGDw{2w65pM| z8G9>Nc4Cr#P?`nKY<+YOx;+(c3EkV6Ukk)qEN(YVro{KX2o&hny`8t?%1us)nFgy7 zCw9NKttqK3uZS2Z&dFM^O-(U|IS?h#g-_7!v*}ANl(>;haNz1M>;9VrqL}k{+~}R8 zwfADsm`Xx5*N6I+{TN;AtSw+=%k~uay`A`qnTGwhLj(a!lA27vY(IB)q>;$dWK{Rq zsd38>HKn?-vU4LLXT}Z9=MWg`sSNCrMbaZ#11chX)BOO*+IIsd#F zN*y)~6moeaQuCa*&XT$60n!ygAVAg~9aB`j*`@SsHdj4xO29SeEi78k%)Fou4Hy`q z0jaA0=c{E}F+U~mMZzg{wsua?a8xuCh=G0UPJh}&6XG9gn$N0X&6T2uesQJd{(>*Kf z6RyKzeBKU53bn7CL|;~oANbx9@7#Tonjeno%ZSNP7gvC$(}3SgV+!kun!*%<>e7s( z4yj{WjZ>?=g?ji+j|F+VCoOYjl47=fPRkiKX$k|6UUSSkzUm&=#se}MDmQ5DOP$iR z?}l$oj%Iol8C%a@$rUdzGWVac+b7AI@u|$TQ4}UQZgof&@5C+FJ5+v{eW&Vpdo;w_ zXuHG__ja{&%TFN@DfvpaJn3mhw1Lyz~H?D;Z6fNvyqkZX)C>b z+`}Pzdpl)mpGe{OfIzRK6164#1N?}`>%jF@Ufx0;R$^>KdAQ&vxp{97axEK^Oin8z zVRh^f5C=o;%)s__drDt2Zx;@-yxuq&a?jIP_ls-kikt#8t{jMxwo7;&HN;=}z$djef*z>=!VkQnchhAn%*O+}NsLrgR-Cobbgj!{2bd#XI)=k@kv* zac09eCKZ%hcT3Ph%WN**B=c#|(bx<2Fz|UB_l2k9cOg=SJ5Gw4h z%blhi>C`>xnRL@pCAiBi8yb2@eOMbuicD)&|53`a^HJJWj&mx+QmvkooSir$;KVP7 zQJv??&|bi#%VHNcZyyYK-X^}ijI7&hsEw{pH;=VsBV8WZce2bTwa*vs9Ex2CnzopS zXBzCeu&V^s?=x~WD{x)Yl)*6C+pohVAl-ER=^*Nz6Ui zACor+9=`jTQb-A~+rJ+tCn8_b=pVG-qNvCfT4&I>To9hr_UaWp)4SVBukiq=)925G z$DT^is{f2vSCU&w5O0C2>1TmS^En9QSMbs0diRI;QhEyuoM=x)g>o!T;2`iFgh@DP z=7W#3u_Gfg*a{lITm}g*+{#I%=_@_h;taMcc8wEiGUpxJ7tlRZUg*iWh29t{gAkGezJ?T{GZluXo0$?00}hK&yZBu+mwJ++sPa`u!R+26O| zpRf_)tHR&{Nd;4w^dK*hfYC#;*zk^PA#!nZn$&0u1~bQW^PAV{L!xy?;68~Kcj}v` zFq2t|shF&{;{Z;kmGRB*@?3`TA)Y{4O$uP*Tq?9l8R%X(Br|%34 z7hO#d>J$vmk$T=Aq&!zuI{W69zguCs2I^p>O7g=R|F^*)f~;<2PY@sZPCFOE@rM2( zHZFiuH#07u80oYCXS@h3y?AaQY+4yn<}d^sm6@X*pK0z~B*3fJC*ZmDhxfJ{d99{W zwC$#woBdiFmK;aPs24Kn!YN1>&05QZON_-eu6A8X`Ni-j-LYxO+U37@JXtuNe(Raq zf~^Rs-dpr^LakzZOJkQLoiXl{iQ0+eYSehdn1RUF(H#ikXiOesV%vODI4-nHgC}v>nBwRblWFFU7N5_ z7LMZ~pT6a=GB(0~khSx5z{6ZRI{inc|KKZ$to^=-m0Y1`1 z&N`*Wnnqmn_FHbkXV07ZkL3v2F~wmz)SX>Y3C^?YImWA3kF>8GtWJg?Zp)9cI4!nT zh4amoLVE3%EQR9mD3=-Y=%j;0tL;8@!|_>3Y+Z0z!4+t$xwE*Bui;iOhf!CZtElaI zmsllzNtaj(i-wV6cj>DNVP^gk@J6h~>PA?=pH8a+1BkbT$jD13uA&;BsR{fv!dcI( zy(A+RawU=wjN&e`8y7m$F>{0~H$Q|hj0jcxDo?6rGJT=~p37!%eivX)(F?Nw(V zvMc5qG{kA#El6m$%T8J8-GST{*9PcgcC0Ypu4l2u9}(YbFSc3xlFXoNr^9FO2yM;q zAr`+dhXh)^<7k1d%FSeX0g6Mm_=yJooU$u;dOb_U_>Km-L|v~2_C?7o1dAs-3zHGg!Oi=k}3rFP1j8x`qFuSYJ(fQ@+D73F`FX<(3K+qS> z#{IdUNk%K)ITgx+E`lL34Lg-r`#nsZN72R+g9TR>$?cDm@(l(|e}F|4A-0WnkzLq^ z$$P#^;j@VlRPEj0Ny)G`udx;f^I04Be4x;8qT+t!t4&a^rl#rVUtev?Lu9`n75qBG znmHl&XxB4|M$8>Y;(n~Ym0-TZNyCgt!`#W#DlFYo}R`8T{ejS*MPD7{ME*N5uS9mgTRbIrRjZ5VEglf0$sT^%Enz(QvbLrsCutq#czEVW$?wlctV&tG0fbm-4Ms>%5G#8vJFFe)~M}2liT8gw3e)Z z$t7f%cRUK6IWq#BZ8yKy(ttaS4_DYOcYKEw|pLKX|!@96i10&$CDyZgfxV4SzxL_?oNz%fR zGP&07IRHuoeiyHB%MhA;L`-YLr@_M%CT&@^*4>}4tC2qKb2d+dE$S@(G_8p?o5-c6}LD*A#aLcrHe=ON@v>5rJsKtvwX~yd6}H77REOzoE2P-D4|!9d^$36f=bwC zs6j)~0ha+#WMPr#`f|P>2ij4X|!W^+1!Qtugw z!tDy-|AI{?C;bcP{AOTwI?w1Jt?Tjkn#czEY5#e>kM1vnfoOf)s-NYgUgA{R-p0<= z%#{=w#l2%*aXN+Y(L+(jwEBg^I-WR{aJaI>HQt0I37bhsE{-*NJFa`6s_*TRc30(& zA!Eyt1&X|2#Y!O~VGZ8i(rJEM6ZU&D$@Z1jhJ_iyQ->=?aRe{LC=p? z0?e~^;W^(;iuI=`+bhKU}!#hC$BqO_P%|*?@jwOLfz5>^a6m3R+VvH(CUME;8cmeqn+gjX3tKyf^mk zCre>NJH0%XzMAmgMg9gYxx%8wvSJvw<&zW242Xv{6prI^eym*}U2S9n5`%VQxv0gH#m2oBZte95v;K^FKn%_yNoiOgs z$M@ps5s3cVQc`Q#j!|^NK*Ox?MGAX~)LU=R-*&0OEW-)W0?_v>(@l!$CBeQm3hvvT zgtd5qt>>0Ogc8L0ccoW%eX4I@&zE`1lD9_$CNHlS`w8n%3aS;{b@M`1HiphOKRY0< z;Jlc}n`Xij9u2yr%P(E~(&C+dyMa8PB#X8F+CTn=D@#iI5o&?X3vEG5<59;DFm*H} zwB+dHuwEg(Ehdp&trM)fG3lWY(B)xjh5C*)XWEHA<8%{&2skFHF9y1s?*)(mocXbF z+}bWTz-X&b>_%{qClT)dQG22Ut7aRPYNV)$gpPjqD9sQvjyqU=I}gt17B;BgsyRPX zw)o<>8(X017H=zet8!m2Ir`^~dX!|!*76V^o?A1~xp3HoC%MJWE@Yo;>Z;dvCsL5X zr)qb}5?V9f1{+vH)(GQ`q!lhP`r01WFnN!gJ|03XUE2=X5cJzgT3vM2ZCDF=97H|} zcwMKQJaEEJbk@OCPpMc=3>-vPqO3-P}<8DwSW3e$7>pXY``+dzc_j!^FT_<9T@2?v0D|Za)q>p zkmVbtLqP#nTa;w%7GWexC;cPVd}&6>I&aQhuzqDq-lzkR2=CDuoy1gFnyXT`(RS&AIvG01o()bN=o@sM_xmBw)pk*-gkqo zvRUD#zDgfErnc^*kYF%3?7`X?nni=_vo=f5?v}ZwZwt>pGG2}DltgMhp(sXVFFj7cyOwIuXa! zBc|Y9pC~53FVA%=xyAF*Hc`3SQ`yLETu-43tXTbc+4|*B72hY%gIrv=V(defsA(|h z8DxhSMMm(`)ub*FWI1}=uX&Gde2+rf)jz3^hG++G?shNL^0?#l@`c5Y*m^{8TRyTQ zp|+(uxafplk;>RXlP4pT1HYF0@A=o48$JbNZLW??kBs~Putk)Z!~{D&l~Hqp|Ak)N zceq?#*fZxDXkf@rf7Fs;v7TRh-+?y!e!1>jbYB6sjKRZa8CECGCtq?}+h`0vW@^r2 zRuMO~>4eZ?HZ%)CCT7=tYshMQkZdBYvvPwzx3nce zE+`heoYR4q-)#w^%t!RRksH&_WWUv0ycfP7MzX}0UW>%GVWGOdq7%1EgaMvi+_0@! zuzMQp9|+Ke+6Y5KlIagecB%SH^u3pz1jYR1&t3Il;@0D0L0o#YvjR6a=j#}&c5%Kl z-JA5uWe%kV7~DzmW2snarv&gEAub!_=v0V zo6%7;shdKyU2*FTbkzc9)90oDh9TndL{yR*Sb9;DLGK##@8ncDo!l+YO5)-rck406 zsn+LWrKt7S6_NToA80oOHi&o$U0w~un|E(-9nMj9e&@+%7YTbU3suiG0bw*Ft)+2g z)T^wxU^{Xiq}Yt9J8SD%@^V{=GwP*HvH=N^`RWxbD#W;w#rpLrYA#nP1wJ303>eR3 zhBowqsk$n@6A+wy<3A^L^Wafx zDM7OD$fduh{3Eg6COD{@5||b7upL^KF&L4FF587B3i@Cq>F*n|?m<=bEM{rtA$+No zAH~)x2_H(fsu;{NFKs4hpy`~dbHrJrX$e|cGHNMaVhT!8_oVXv(%L7?wSaAw%>Rtj z_+_U%c0oeuH7w)*2;2T&@Y5hw^x2z#N$h`7<-E}+B=&C*?dNZ6v?nAsK!hLrT7WRH zPw79QBfvcry*oZUrGx~U(High^}ol80Dt}8E2jF_NqYZ^6~%RrdxKLtu6Xf9>e>X= z_=f)U5uKHeCGHDvP=%(c`13-iObR&>uTw}l#2=3OL~cKirFV1p3R@-uzYo*I|L`SnPC1^2%=5#%L!E+VDAW*2D+D~c_2u=Hv z2?S!}JPlZ$tX(hc0tMB||DP40qestoWaO#_AI|Xbn%BE)Wm>)X^=4_aPmc7Y(5sDx z)gA)^sUT&z&jiX6x&$kqxHqq%S4Qk*U*N*nK}tv&VW2?MQ7DR4q|Z{T&T|HBzqdX& zE(i+M^@ycI@A?eqs6~BPu4od5LF4<({&_)VEkNj9Q$iPhQ*jhY`vOwBy5+F*er-uK z9r@Jr2g`WrEq}@Z9@9n-k|~mIii^gueY$6-E*tdoCEW*U9Bz4;98c z>P%F3`x$7e)VA&bIE@EmlNuiDn9Qc%DNA8W~nVhera?h?nE<(A~bL zVEA3h+ex(PC4jD&Xr-xz)Bz>vbd?ee7+bCJ7h6yD+5lP+Fyf-usMOhbIZl9_Y3Q)#K5vst%%;2)}nS=7Fl%Y|@;7(R8wS zM5rI*w^e0e0lEilvsr&VZek7WCx_QUX^t&#m;Tk4)i$;h7af2nYft*3wQ3i5yb3)3 z+Z}Ibo*7j&28r;$J=(T@E`AIyaY`WiTDq4yFBO|t5@rjS%C-9}eO~~B$WRq%m!my; zH*mMSy^!kdLBnRuV>l}3Jn!Ala(Z>SmpWp8i&29LFb|{G_5cT(PM_5mJ{Yv0u20@U z(@vU;{S%;lLolC>b`VEiU=R5Mm!SQD?_%{br5dbfLBlQ+;tD*d7p8DPDyy|=0vu&p z_m6ictVF+A%aXn$yDJRpVODp{z|9`A^c~ ztb@h=0m~ImcB5EzXSM?IMGjs!A;;su;je2Mu{U&90PN!?y zg{t6eyf%=jAC8GjE~a%r;CgcGRNL$ElezCq+x$i z8q1q`6vMLQr{H%W@*z_mdGo*}t{0P!S*#I0NF(=Jv4-Hf%Um8haWUUV43`(FAAL?8 zEgWY~PSklP1RH_gJA%7Sw8-@m_9ppm)%K8u!%LlICcPTg>omAB{GBYk+9yikU^b%# z3#63k@r)7#eFJ8a_JNTFlRectj;!Xko~ZNbiSpfr=-|#*kFj)wl67BCr`i_aJJdcKFw4l>qr=%@YI>*JsWC|?B{}x?8mBoDE5`7Z z>F$GN-EF@wJ=IwnQ|o02;cSSU!>_d2u8r7k%Pq$-h;wbZB$MLe#TeBl;^4;`uo4?P zPnLW^P&B5Vgip&zkK(u}DVhyh)Ct~wAd6KUzp95tqp2Gmr?CI*jWe93QSG{Fl3QHk zcc2Afjpi_sHW~CAW+Maz^|j=NC+T$mlqLjVl6uqQuvUGt7p`7?Pvh5RIOY){#<9I; z;`>XQ>26#@<`=wFu&6_=u$fdZ3D70)uLYH7E=nsxC+(KJi{Zky-Sh6^A>+2T-FJxx>??VL^*)=#uZU{(TOk6C{>rmRO35bL@gFF;G*dzdfs8@ zI1OE1MyIa%PqHKD_6aZNwyDdGV_5{l<9STq^pa=T89xQ*ye;WoySYKt8b98R8m;Tb z!bHcdNq0Y;GV@35Vtbi%3Z&q95_iD8^bDWb*(bV+%eHvnjsKX1zG2iafHWS2qnZiA zBh9ltms#_M5chz!q=dgjx=?<`&Q-ML6{AZ(Gia|(htFk3->%+8=O4av)#{YuWZ(QD zHtBw|B$`u%7QN7Ug<*0&M3*(1#;V4#_aT1ra6QB4Nu)=&$c{bctF3azvInJ_HP0!< z)_e>E8Pd*^DC{!-cFuD_~6nQNCjt5E8skbSqYx@$@*-;fw{m3fvW*m@}kSQ$^5WXTKADQHy_ z&&e!xG%nRLK&TSd&c>{D&iE}P{E9uh#&d4^5K@)8#uz2WBNeht*sH;tN)B9W=Wq~o zVRZMc0q?g2izn#uo3SeX)crFfVxID|kna@*&2Pd6lUNtyx6~Insc&hynMZR2-H|Ehp2@9&K(44H zbD7(f(GI%lu5;X|pKL=0PRw6MJe@?lFLnw0-PcPYy+&V)5M$5YNn|M+bOR4BA|!O6 zHyd3K2jBKq78s<~C%zw8VBQQ|Ny^l*hirCm20n#YsB}Bn*}9I~Mv5sIbxYi;Ov91C z;dP*2k}cMt-9f2?&u|^gASKCio|#;AlbA?o<=D4Vv6SG^p{3!m7tA|y?(sI@8%xgI z2TeE+zyL6sc38%XMxU?c_z^ocJKA2+B;3ewz^03txI$O|VKUF_CjH@0e9J$j zojKxc8Q*)-;R&SRooM*E{c^|pH%&bW<5g|L>Qr$pHIjp(%W~E3*N`MjOXM}qgY0UJ zY_8RK_O)th|7F7d3jThEyxc=Pl!UtM4VW9pYpRYt&H89{<;RJhhSiX$#LUva4UX(G zoiwXA|HBU&4oX`WvkR3-Y&0+)Jmn3WO~0G1SRK$AaBg#vx1*-iD1R}p((0R;FZlBE zy?4(j$t<5N&p9Q;=-oW3M(z8FkjF-2K{2=ogZp0i{qeFlVz9V)V_#7i_S65!mcw zzyEY#z|SZ9>6{JtF1#axz+8MAR#D;3=8ImKVHJ7IDJE$qrLM!YgRUA9x{@H7O%!_v z(Hf4*_8O(R8g}}8weX=V18m&l+taxFU*gtmsvz};fkUOw@_)ugc=5;@4B{zZ->?S~ zQ8VS7Z@F6gdN^uG3cD(@lFmK0jHc$Na_$Us`7qWTs88OOx|?%e3o6eDlc!Y%v+Dng z3v7E_6N9KfToZ9RPf15|zP0c$^V8N#u7z5JFH&&NTyrM1)>25WX@k1+P_8{nyh#jR z168fCx9LS8m0bo2%!rI@TR6Gv5x8OI+&*G7>&2=wmqbs|a7B?p$bhf}*mP#04} zH61FklLua|e<^j1IgsD+Q=KbUlGYi4RGJa>q4EUmKBX_#x8bO-@J@cmYIZt@Qj>f< z%{Axvby{%|0srlCT0iGhl{JM<t9MM0<$P=LE1U1Snu-|q zO}9(tEFto5v-u3P!L0qZfP+bNWp&Xq#i@Sm42@FA`ZwOe%N!8z2aNIQvkmMQB(p9# zr>V5X!%tza38dPhifaOL-}W;mZF12l1XyL(kQTG&hQyxwPkW9R!ZtI6QssD>1i%z? z42K!y`bzz+x(Z>M%XQqug{^+C?b0riGkN6-r@&2!_GU)Qg2UK~6+H0dGI{jtS)UCTvx^dzI`Nb6Uv72g=6Nh=k6S?_^}>Iq=bM zh{b7G-@wvv;kB={p)OAnPNDl7_^d`C^EKI(nCh#^XqA`29G)ety|gwKhl!-e}x~3p%6dCKtna4hoJG6E!y8 zFKa0ktlQVCUD>Wo?t%vu^#lMB<#A4n)4f>f;ki!MQrv4p3aZjIspDvX6cN=;$FQAV z()Iz)YeWr)-z_5WhJGCLG9p`aUs%GE`J8moeH0Ch0!_rZ*UZnIM4?7%5ZQ-~VAHre z{UbEBY=FwdARaoxB2Jh;V}UM%5sR)HhAm2&UGXV1m4Q+Q|G6%y|Jzd7ZKL|}kj1jp zCKjVuDzcH@&vr|%UTZOk<|2eztkWEviMw)bSgEPo0CJ?i?H5C%IdNq>u3pj@onG0p zaFm2-khr6{ju2`xa!h2jhvlGVaH54!Rb8XJqsEaVyjo;$5XsC zQc@31a2g6^x%yGS5!!yuS<(nx+$fTpT4@T0+(MM z-M*FxY#P>br&jf3{!sN_tsoF+>i|k9=Wr}};RB4M3tKKkuw2;~dq;J5xvG3;rB3S;9bHpv8|MPt%+v$rhcbJ@Y)N=LKz z_^jX2$g9;Vdabj>-zr z91FKMU?FjO;CK#iMLq-5qJh!%28tY-=vuP1Mdz^WySOd4P-&K?9i`w$`Nd&av2&_Q;NpKmZAfo?-ZQuJDB&8$V`?fZenR z>p6490EKkIMz-)Lu}ETMBXk)%``*#2(~_%pZw@zJvwnrv{SJ#QPK&7OXTN27p#h>n z(k{GbT%nd(BP`V4Uq`i_zd(eNRv14gt&OFrOLgJNN~6 z*635G84W8`loKF4fS4p#>BHLRJsH4Q2W?|-!tJA3e^cVrhDY+Cx<7%O0aZ0hPZeOm z7^9q?K-KJoxIPW2B$SVoCJ2GDQUPNx#}9E0cq1lymkeF^t&Z(|O!n%aAGm+z7wxO}E?y0Q6>x4z-g zei}~)|Fy`N$7c05uzeWOYsa8Yzm`->Maiq>obZ|fTVEXxrv6r^SCx(KpR;uHA*bu) zGg`iz9^Fx+`hJ`Orr=k6akD8=Wux{b+Wi{5gEQCG4%~IVRj7-PUw1=XSXgpB8#)*u zs7pWa*9=2{rZyI$z$-xM7khU~6<|Ru=7}ESG?`t#@@uw%hr<~u8-k4P!V`X>h~r(f zz2m4mvZBT{2F`{Gne^_gKzt5j5ePYtLLGVf;<D@jo9ErT=!~A5Y6LV9EUP&otuY>R(aen2A*~2PC{7DL{g; zw#0EkEnQgZ%PTVva!;E5Z*RV#DwtLD>+z+aD^5%&HveNb_3ypwk2j?Md81=?b}{^Os!(<`qy$=#}HF0Ox;i*Z{A3TnVV)gedlbQk{q}t{Pb~z~`IM z|9X(X67ahRNSKZmI979x8QTK+k*@3WyFT5!80YdKZC zeC%n*h?W4;Mp%bu7n^xY&T3Z;K948+FOftc6PV#d@Nr^us9x1>-q43~9r@3PLmQR1 z1e3WxBk8lAi97T>ER>LRqNkP4{g}ivLhtK9981uq0$n)8<1+||4uebBa`Pen&?UR} zoBgz>6&Ca6x|0isG`Rh5rJr(|o{3Y;&^{a3f9JTwE>2!5U19fU*b=kS#@#>FmoH{9 zo(b%K#A+4jDT@Tui$VU-dGeod#V3Ux{@vz-{Qa~~N8V@;j%ECaVs!+Z`BLsvpAP3e zjvUr!cqsqC=yDg2MTzyJ9h4%B<_TbATD%p*-#|nxA9I?5#%0$Q**#gGKBrPC-P}VwRXe1f`$US&4T6o7LY-w>>mKz%Ki5k;y6F ze`6kk0c9xwUzsh{4rzC1P$>lg$>_Boj@)QK!!gGddQ!MS-++q#qf#CE`GU$N?a!jy}gN{Nf&+FHPXVJB00T{?BT^Aef$`mRKXdeBtUHc~jlptIlL{LQoy>B$- zIsUA2{CV8u;%l>(9Iu|#Aac;N>iuqchjuPHMhmpJkK|2N_D`kr0$AyuJPcCV5YWC0|Q zvX3``LTx@DYsTKgi@*Z-FxCor2l)AgtzY%rnQ16zy=?(JCS&@2AdpONUl}Q+=xn*p zBO)UcbTr^mrn61-AZ7p4;{_6xpZlW)5ZSvzbU1ZlP7sUp8PBU zt6D+s)R-|&?PMq{)d6DF?Tv-L9zfo}OpmH7%ou3MfY`Wz*RF;xOqDpZcjBq5dipO< zT@C7Lo&<#xNCrj{8ewGYtjN((%8HTB-5Kv~__vS8@{mN)ZWyK7#+I9dfeau`vGn?4 z*^Gh}I19hQd7~sSWK9G3Z3v|12dzmz-pmH5s@Wa?nJD)bKLf7=oqGGq-*@Ha&IOIu zbzV02E$Cjt$W=CXS9lEEx1GFM8Ld*1V4hmXGO_w!KX4)Wx#M`KXRhUjs?Bg5wyF%X z73n=UMYrdx_tv;<_W)r9`WIf`giP?SXapFgvNRGceCxQ3O$o6V%^uP54F>3dXh zpVY8oL^(;AL6Yatz0{Un@&2I71uZZ7wYRXS{@r7}8>BmVfe5%wpzIBhcNdxymSQ8P^) zgEu+L)!978UgiL0`5=FUm^!FsU_KKh-cqcor@WVo**ImEx7SB~=M*?=c4*;I_M*0;Y5}}Fyl&v@s z?Sx{K{2{zgFgISe5xE+DJ245jGF`6-Gse_?U0hT_hqux#hH*r(rBju{egrM9j7r0> z(Y5ys3fjd$vdh@9bEEK^FuYM+8^z)v1EFykjYSVqLm&741 z`HHiK7`l_;?IT-Wve;FX1F3o2aNekL-HUFZWKz4E9RS*>We3hkC!}p=2;qkX;6rCl za7yK)zhcI8(3I%M_m99$5o?C>!mfv=?47`43GNbd_ypYSWi(UHu9d~i!g~GHRBdQt z6xy+<^gH*Jv4*LYR|uBPr_|<>eK#L4#vY^+XLcy~kS?xFJ1QgB@pX>h!E-_+4fg<_ z!Sxd5FR0?H2{c1&H)veL`U84X*emA$uU*-z!IiXT;kG=D-bl_=-JIF7R?E#9ZpF55 zdi^@@yUo9%=<=mEu&IGNBTkvwpn&?IH*OnH3w$I_xi=NrGV~ykVaNf17UGHYBSe0Y>@8+kt z>C^q2r-uGp|K^^3YK=Fr5CQed-`f-@aBO@Z5_^Bqnn@>5Pur1t<@^nu%b@HAs=!ie zcKPy#pP4mv^7g&44YmbSePJ%LV&|G3&>HD#b)EHhZf#m?V6~%BanX)BduLx+E3msKn%C*#f#6cj z6{{UeG&in$a!GRYu3c}ozfmhVb?8Pf@A{n|jxhJ0IP~Sc;=j~az!N9JRMyKZIrV9k z;nnv)LiFbEdb{z>)h7u@Mb>Vgn%Yx;bb9V&V4!CWqT>kBAYJcsvo4$O- zovu?WRszES*mGhqaO|D%F5z|X;gp#&^P8mqpNZ$)C?#ZSP?o&o_4^vFTL)goX}a=u z>CV2tbn5n;%C23XK1~aMzx#A{Y>ghPN?pOir&oTjYoC9X|4PWTg`oe)zPD!vFXTh_zTbAJKjRcHlD70}YN$(F|VZGqdl}74V@v tH#2~}5YRDIpyg|XPOh5aG3h_Ii-K`H*N(Nuz%#lSJYD@<);T3K0RX2=0@VNj literal 0 HcmV?d00001 diff --git a/education/windows/take-a-test-app-technical.md b/education/windows/take-a-test-app-technical.md new file mode 100644 index 0000000000..765de7a8b6 --- /dev/null +++ b/education/windows/take-a-test-app-technical.md @@ -0,0 +1,88 @@ +--- +title: Take a Test app technical reference +description: The policies and settings applied by the Take a Test app. +keywords: ["shared cart", "shared PC", "school"] +ms.prod: W10 +ms.mktglfcycl: plan +ms.sitesec: library +author: jdeckerMS +--- + +# Take a Test app technical reference +**Applies to:** + +- Windows 10 Insider Preview + + +> [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] + +Many schools use online testing for formative and summative assessments. It's critical that students use a secure browser that prevents them from using other computer or Internet resources during the test. The **Take a Test** app in Windows 10, Version 1607, creates the right environment for taking a test: + +- A Microsoft Edge browser window opens, showing just the test and nothing else. +- Students aren’t able to go to other websites. +- Students can’t open or access other apps. +- Students can't share, print, or record their screens. +- Students can’t copy or paste. +- Students can’t change settings, extend their display, see notifications, get updates, or use autofill features. +- Cortana is turned off. + +> **Tip!** +> To exit **Take a Test**, press Ctrl+Alt+Delete. + +**Take a Test** is included in Windows 10 Education. To add **Take a Test** to other editions of Windows 10, see [Add the Take a Test app to Windows 10](#add-the-take-a-test-app-to-windows-10) + +## How you use Take a Test + +![Use test account or test url in Take a Test](images/take-a-test-flow.png) + +- **Use a test URL and a [dedicated testing account](#set-up-a-dedicated-test-account)** - A user logs into the account and the **Take a Test** app automatically launches the pre-configured assessment URL in Microsoft Edge in a single-app, kiosk mode. A student will never have access to the desktop in this configuration. We recommend this configuration for high stakes testing. +- **[Put a test URL with an included prefix](#provide-link-to-test) on a web page or OneNote for students to click** - This allows teachers and test administrators an easier way to deploy assessments. We recommend this method for lower stakes assessments. + +## Set up a dedicated test account + +- To configure a dedicated test account on a single PC, [use Settings](#set-up-test-account-on-a-single-pc). +- To configure a dedicated test account on multiple PCs, you can use: + - [Mobile device management (MDM) or Microsoft System Center Configuration Manager](#set-up-test-account-in-mdm-or-configuration-manager) + - [A provisioning package](#set-up-test-account-in-a-provisioning-package) created in Windows Imaging and Configuration Designer (ICD) + - [Group Policy](#set-up-test-account-in-group-policy) to deploy a scheduled task that runs a Powershell script + + +### Set up a test account on a single PC + +1. Sign into the device with an administrator account. +2. Go to **Settings** > **Accounts** > **Work or school access** (final name needs to be updated, still TBD) > **Set up an account for taking tests**. +3. Select an account to use as the dedicated testing account. + >**Note**: If you don't have an account on the device, you can create a new account. To do this, go to **Settings** > **Accounts** > **Other Users** > **Add someone else to this PC** > **I don’t have this person’s sign-in information** > **Add a user without a Microsoft account**. +4. Specify an assessment URL. For + +5. Click **Save**. +6. To take the test, log into the selected account. + + +### Set up test account in MDM or Configuration Manager + +### Set up test account in a provisioning package + +### Set up test account in Group Policy + +#### Create a Powershell script + +#### Create a scheduled task in Group Policy + +## Provide link to test + +## Add the Take a Test app to Windows 10 + +### Add Take a Test on a single PC + +### Deploy Take a Test to multiple PCs + +## Assessment URLs + +This assessment URL utses our lockdown API: + +- SBAC/AIR: [http://mobile.tds.airast.org/launchpad/](http://mobile.tds.airast.org/launchpad/). + + + + diff --git a/education/windows/take-a-test-multiple-pcs.md b/education/windows/take-a-test-multiple-pcs.md new file mode 100644 index 0000000000..ddaedb6e10 --- /dev/null +++ b/education/windows/take-a-test-multiple-pcs.md @@ -0,0 +1,88 @@ +--- +title: Set up Take a Test on multiple PCs +description: Learn how to set up and use the Take a Test app on multiple PCs. +keywords: ["shared cart", "shared PC", "school"] +ms.prod: W10 +ms.mktglfcycl: plan +ms.sitesec: library +author: jdeckerMS +--- + +# Set up Take a Test on multiple PCs +**Applies to:** + +- Windows 10 Insider Preview + + +> [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] + +Many schools use online testing for formative and summative assessments. It's critical that students use a secure browser that prevents them from using other computer or Internet resources during the test. The **Take a Test** app in Windows 10, Version 1607, creates the right environment for taking a test: + +- A Microsoft Edge browser window opens, showing just the test and nothing else. +- Students aren’t able to go to other websites. +- Students can’t open or access other apps. +- Students can't share, print, or record their screens. +- Students can’t copy or paste. +- Students can’t change settings, extend their display, see notifications, get updates, or use autofill features. +- Cortana is turned off. + +> **Tip!** +> To exit **Take a Test**, press Ctrl+Alt+Delete. + +**Take a Test** is included in Windows 10 Education. To add **Take a Test** to other editions of Windows 10, see [Add the Take a Test app to Windows 10](#add-the-take-a-test-app-to-windows-10) + +## How you use Take a Test + +![Use test account or test url in Take a Test](images/take-a-test-flow.png) + +- **Use a test URL and a [dedicated testing account](#set-up-a-dedicated-test-account)** - A user logs into the account and the **Take a Test** app automatically launches the pre-configured assessment URL in Microsoft Edge in a single-app, kiosk mode. A student will never have access to the desktop in this configuration. We recommend this configuration for high stakes testing. +- **[Put a test URL with an included prefix](#provide-link-to-test) on a web page or OneNote for students to click** - This allows teachers and test administrators an easier way to deploy assessments. We recommend this method for lower stakes assessments. + +## Set up a dedicated test account + +- To configure a dedicated test account on a single PC, [use Settings](#set-up-test-account-on-a-single-pc). +- To configure a dedicated test account on multiple PCs, you can use: + - [Mobile device management (MDM) or Microsoft System Center Configuration Manager](#set-up-test-account-in-mdm-or-configuration-manager) + - [A provisioning package](#set-up-test-account-in-a-provisioning-package) created in Windows Imaging and Configuration Designer (ICD) + - [Group Policy](#set-up-test-account-in-group-policy) to deploy a scheduled task that runs a Powershell script + + +### Set up a test account on a single PC + +1. Sign into the device with an administrator account. +2. Go to **Settings** > **Accounts** > **Work or school access** (final name needs to be updated, still TBD) > **Set up an account for taking tests**. +3. Select an account to use as the dedicated testing account. + >**Note**: If you don't have an account on the device, you can create a new account. To do this, go to **Settings** > **Accounts** > **Other Users** > **Add someone else to this PC** > **I don’t have this person’s sign-in information** > **Add a user without a Microsoft account**. +4. Specify an assessment URL. For + +5. Click **Save**. +6. To take the test, log into the selected account. + + +### Set up test account in MDM or Configuration Manager + +### Set up test account in a provisioning package + +### Set up test account in Group Policy + +#### Create a Powershell script + +#### Create a scheduled task in Group Policy + +## Provide link to test + +## Add the Take a Test app to Windows 10 + +### Add Take a Test on a single PC + +### Deploy Take a Test to multiple PCs + +## Assessment URLs + +This assessment URL utses our lockdown API: + +- SBAC/AIR: [http://mobile.tds.airast.org/launchpad/](http://mobile.tds.airast.org/launchpad/). + + + + diff --git a/education/windows/take-a-test-single-pc.md b/education/windows/take-a-test-single-pc.md new file mode 100644 index 0000000000..13145d80f1 --- /dev/null +++ b/education/windows/take-a-test-single-pc.md @@ -0,0 +1,76 @@ +--- +title: Set up Take a Test on a single PC +description: Learn how to set up and use the Take a Test app on a single PC. +keywords: ["shared cart", "shared PC", "school"] +ms.prod: W10 +ms.mktglfcycl: plan +ms.sitesec: library +author: jdeckerMS +--- + +# Set up Take a Test on a single PC +**Applies to:** + +- Windows 10 Insider Preview + + +> [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] + +Many schools use online testing for formative and summative assessments. It's critical that students use a secure browser that prevents them from using other computer or Internet resources during the test. The **Take a Test** app in Windows 10, Version 1607, creates the right environment for taking a test: + +- A Microsoft Edge browser window opens, showing just the test and nothing else. +- Students aren’t able to go to other websites. +- Students can’t open or access other apps. +- Students can't share, print, or record their screens. +- Students can’t copy or paste. +- Students can’t change settings, extend their display, see notifications, get updates, or use autofill features. +- Cortana is turned off. + +> **Tip!** +> To exit **Take a Test**, press Ctrl+Alt+Delete. + +**Take a Test** is included in Windows 10 Education. To add **Take a Test** to other editions of Windows 10, see [Add the Take a Test app to Windows 10](#add-the-take-a-test-app-to-windows-10) + +## How you use Take a Test + +![Use test account or test url in Take a Test](images/take-a-test-flow.png) + +- **Use a test URL and a [dedicated testing account](#set-up-a-dedicated-test-account)** - A user logs into the account and the **Take a Test** app automatically launches the pre-configured assessment URL in Microsoft Edge in a single-app, kiosk mode. A student will never have access to the desktop in this configuration. We recommend this configuration for high stakes testing. +- **[Put a test URL with an included prefix](#provide-link-to-test) on a web page or OneNote for students to click** - This allows teachers and test administrators an easier way to deploy assessments. We recommend this method for lower stakes assessments. + +## Set up a dedicated test account + + + + + + +1. Sign into the device with an administrator account. +2. Go to **Settings** > **Accounts** > **Work or school access** (final name needs to be updated, still TBD) > **Set up an account for taking tests**. +3. Select an account to use as the dedicated testing account. + >**Note**: If you don't have an account on the device, you can create a new account. To do this, go to **Settings** > **Accounts** > **Other Users** > **Add someone else to this PC** > **I don’t have this person’s sign-in information** > **Add a user without a Microsoft account**. +4. Specify an assessment URL. For + +5. Click **Save**. +6. To take the test, log into the selected account. + + + + +## Provide link to test + +## Add the Take a Test app to Windows 10 + +### Add Take a Test on a single PC + + + +## Assessment URLs + +This assessment URL utses our lockdown API: + +- SBAC/AIR: [http://mobile.tds.airast.org/launchpad/](http://mobile.tds.airast.org/launchpad/). + + + + diff --git a/education/windows/take-tests-in-windows-10.md b/education/windows/take-tests-in-windows-10.md index b2ee59bd77..0262fe3f68 100644 --- a/education/windows/take-tests-in-windows-10.md +++ b/education/windows/take-tests-in-windows-10.md @@ -29,7 +29,46 @@ Many schools use online testing for formative and summative assessments. It's cr > **Tip!** > To exit **Take a Test**, press Ctrl+Alt+Delete. - +**Take a Test** is included in Windows 10 Education. To add **Take a Test** to other editions of Windows 10, see [Add the Take a Test app to Windows 10](#add-the-take-a-test-app-to-windows-10) + +## How you use Take a Test + +![Use test account or test url in Take a Test](images/take-a-test-flow.png) + +- **Use a test URL and a [dedicated testing account](#set-up-a-dedicated-test-account)** - A user logs into the account and the **Take a Test** app automatically launches the pre-configured assessment URL in Microsoft Edge in a single-app, kiosk mode. A student will never have access to the desktop in this configuration. We recommend this configuration for high stakes testing. +- **[Put a test URL with an included prefix](#provide-link-to-test) on a web page or OneNote for students to click** - This allows teachers and test administrators an easier way to deploy assessments. We recommend this method for lower stakes assessments. + +## Set up a dedicated test account + +To configure a dedicated test account on multiple PCs, you can use: +- [Mobile device management (MDM) or Microsoft System Center Configuration Manager](#set-up-test-account-in-mdm-or-configuration-manager) +- [A provisioning package](#set-up-test-account-in-a-provisioning-package) created in Windows Imaging and Configuration Designer (ICD) +- [Group Policy](#set-up-test-account-in-group-policy) to deploy a scheduled task that runs a Powershell script + + + + +### Set up test account in MDM or Configuration Manager + +### Set up test account in a provisioning package + +### Set up test account in Group Policy + +#### Create a Powershell script + +#### Create a scheduled task in Group Policy + +## Provide link to test + +## Add the Take a Test app to Windows 10 + + + +## Assessment URLs + +This assessment URL utses our lockdown API: + +- SBAC/AIR: [http://mobile.tds.airast.org/launchpad/](http://mobile.tds.airast.org/launchpad/). From ccd95201557d7d0ff1c4905f63511b156dfa59cc Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Tue, 17 May 2016 08:50:30 -0700 Subject: [PATCH 302/439] changing redirect to https instead of htp --- windows/manage/disconnect-your-organization-from-microsoft.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/manage/disconnect-your-organization-from-microsoft.md b/windows/manage/disconnect-your-organization-from-microsoft.md index 2adc6e5005..f1077326eb 100644 --- a/windows/manage/disconnect-your-organization-from-microsoft.md +++ b/windows/manage/disconnect-your-organization-from-microsoft.md @@ -1,4 +1,4 @@ --- title: Configure Windows 10 devices to stop data flow to Microsoft (Windows 10) -redirect_url: http://technet.microsoft.com/en-us/itpro/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft --- \ No newline at end of file From 8da0442ef32b5d5e1a861aa4454d47b55471c018 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Tue, 17 May 2016 08:53:26 -0700 Subject: [PATCH 303/439] changing event volume to very high --- windows/keep-secure/audit-authorization-policy-change.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/audit-authorization-policy-change.md b/windows/keep-secure/audit-authorization-policy-change.md index 0194d0a071..e9b847fe29 100644 --- a/windows/keep-secure/audit-authorization-policy-change.md +++ b/windows/keep-secure/audit-authorization-policy-change.md @@ -23,7 +23,7 @@ Authorization policy changes that can be audited include: - Changing the Encrypting File System (EFS) policy. -Event volume: Low +Event volume: Very high Default: Not configured From d58330d74fc09a8b03d4939848f94f6087dccfa1 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 17 May 2016 09:02:06 -0700 Subject: [PATCH 304/439] populate techref --- .../windows/take-a-test-app-technical.md | 78 +++++++++---------- 1 file changed, 36 insertions(+), 42 deletions(-) diff --git a/education/windows/take-a-test-app-technical.md b/education/windows/take-a-test-app-technical.md index 765de7a8b6..3f410e8d68 100644 --- a/education/windows/take-a-test-app-technical.md +++ b/education/windows/take-a-test-app-technical.md @@ -16,72 +16,66 @@ author: jdeckerMS > [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] -Many schools use online testing for formative and summative assessments. It's critical that students use a secure browser that prevents them from using other computer or Internet resources during the test. The **Take a Test** app in Windows 10, Version 1607, creates the right environment for taking a test: +Take a Test is an app that locks down the PC and displays an online assessment web page. -- A Microsoft Edge browser window opens, showing just the test and nothing else. -- Students aren’t able to go to other websites. -- Students can’t open or access other apps. -- Students can't share, print, or record their screens. -- Students can’t copy or paste. -- Students can’t change settings, extend their display, see notifications, get updates, or use autofill features. -- Cortana is turned off. +Whether you are a teacher or IT administrator, you can easily configure Take a Test to meet your testing needs. For high-stakes tests, the app creates a browser-based, locked-down environment for more secure online assessments. This means that students taking the tests that don’t have copy/paste privileges, can’t access to files and applications, and are free from distractions. For simple tests and quizzes, Take a Test can be configured to use the teacher’s preferred assessment website to deliver digital assessments -> **Tip!** -> To exit **Take a Test**, press Ctrl+Alt+Delete. +Assessment vendors can use Take a Test as a platform to lock down the operating system. Take a Test supports the [SBAC browser API standard](http://www.smarterapp.org/documents/SecureBrowserRequirementsSpecifications_0-3.pdf) for high stakes common core testing. (Link to Javascript API when available) -**Take a Test** is included in Windows 10 Education. To add **Take a Test** to other editions of Windows 10, see [Add the Take a Test app to Windows 10](#add-the-take-a-test-app-to-windows-10) +## PC lockdown for assessment -## How you use Take a Test + When the assessment page initiates lock down, the user’s desktop will be locked and the app will be launched above the Windows lock screen to provide a sandbox that ensures the user can only interact with the Take a Test app . After transitioning to the lock screen, Take a Test will apply local MDM policies to further lock down the device. The whole process of going above the lock screen and applying policies is what defines lockdown. The whole lockdown process is atomic, which means that if any part of the lockdown operation fails, the app will not be above lock and won't have any of the policies applied. -![Use test account or test url in Take a Test](images/take-a-test-flow.png) +When running above the lock screen: +- The app runs full screen with no chrome -- **Use a test URL and a [dedicated testing account](#set-up-a-dedicated-test-account)** - A user logs into the account and the **Take a Test** app automatically launches the pre-configured assessment URL in Microsoft Edge in a single-app, kiosk mode. A student will never have access to the desktop in this configuration. We recommend this configuration for high stakes testing. -- **[Put a test URL with an included prefix](#provide-link-to-test) on a web page or OneNote for students to click** - This allows teachers and test administrators an easier way to deploy assessments. We recommend this method for lower stakes assessments. +- The hardware print screen button is disabled -## Set up a dedicated test account +- Content within the app will show up as black in screen capturing/sharing software Copy/paste is disabled -- To configure a dedicated test account on a single PC, [use Settings](#set-up-test-account-on-a-single-pc). -- To configure a dedicated test account on multiple PCs, you can use: - - [Mobile device management (MDM) or Microsoft System Center Configuration Manager](#set-up-test-account-in-mdm-or-configuration-manager) - - [A provisioning package](#set-up-test-account-in-a-provisioning-package) created in Windows Imaging and Configuration Designer (ICD) - - [Group Policy](#set-up-test-account-in-group-policy) to deploy a scheduled task that runs a Powershell script - +- Web apps can query the processes currently running in the user’s device -### Set up a test account on a single PC +- Extended display shows up as black -1. Sign into the device with an administrator account. -2. Go to **Settings** > **Accounts** > **Work or school access** (final name needs to be updated, still TBD) > **Set up an account for taking tests**. -3. Select an account to use as the dedicated testing account. - >**Note**: If you don't have an account on the device, you can create a new account. To do this, go to **Settings** > **Accounts** > **Other Users** > **Add someone else to this PC** > **I don’t have this person’s sign-in information** > **Add a user without a Microsoft account**. -4. Specify an assessment URL. For +- Auto-fill is disabled -5. Click **Save**. -6. To take the test, log into the selected account. +## Mobile device management (MDM) policies +When Take a Test is running, the following MDM policies are applied to lock down the PC. -### Set up test account in MDM or Configuration Manager +| Policy | Description | Value | +|---|---|---| +| AllowToasts | Disables toast notifications from being shown | 0 | +| AllAppStoreAutoUpdate | Disables automatic updates for Windows Store apps that are installed on the PC | 0 | +| AllowDeviceDiscovery | Disables UI for screen sharing | 0 | +| AllowInput Panel | Disables the onscreen keyboard which will disable auto-fill | 0 | +| AllowCortana | Disables Cortana functionality | 0 | +| AllAutoupdate | Disables Windows Update from starting OS updates | 5 | -### Set up test account in a provisioning package +## Allowed functionality -### Set up test account in Group Policy +When Take a Test is running, the following functionality is available to students: -#### Create a Powershell script +- Assistive technology that is configured to run above the lock screen should run as expected -#### Create a scheduled task in Group Policy +- Narrator is available through Windows key + Enter -## Provide link to test +- Magnifier is available through Windows key + "+" key -## Add the Take a Test app to Windows 10 +- Full screen mode is compatible -### Add Take a Test on a single PC +- The user can press Alt+Tab when locked down. This results in the user being able to switch between the following: -### Deploy Take a Test to multiple PCs + - Take a Test + - Assistive technology that may be running + - Lock Screen + > **Note** The app will exit if the user logs into an account from the lock screen. Progress made in the test may be lost or invalidated. -## Assessment URLs +- The user can exit the test by pressing one of the following key combinations: -This assessment URL utses our lockdown API: + - Ctrl+Alt+Del -- SBAC/AIR: [http://mobile.tds.airast.org/launchpad/](http://mobile.tds.airast.org/launchpad/). + - Alt+F4 From 62983c00b3725586c8aff5f0e76fc31c274d815f Mon Sep 17 00:00:00 2001 From: LizRoss Date: Tue, 17 May 2016 09:23:24 -0700 Subject: [PATCH 305/439] Updated based on tech review --- windows/keep-secure/protect-enterprise-data-using-edp.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/keep-secure/protect-enterprise-data-using-edp.md b/windows/keep-secure/protect-enterprise-data-using-edp.md index f75a7a1faa..ee71fc6383 100644 --- a/windows/keep-secure/protect-enterprise-data-using-edp.md +++ b/windows/keep-secure/protect-enterprise-data-using-edp.md @@ -19,7 +19,7 @@ author: eross-msft With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control. For example, when an employee sends the latest engineering pictures from their personal email account, copies and pastes product info into a tweet, or saves an in-progress sales report to their public cloud storage. -Enterprise data protection (EDP) helps to protect against this potential data leakage without otherwise interfering with the employee experience. EDP also helps to protect enterprise apps and data against accidental data leak on enterprise-owned devices and personal devices that employees bring to work without requiring changes to your environment or other apps. Finally, another data protection technology, Azure Rights Management, can help to extend protection for data that leaves the device, such as when email attachments are sent from an enterprise aware version of a rights management mail client. +Enterprise data protection (EDP) helps to protect against this potential data leakage without otherwise interfering with the employee experience. EDP also helps to protect enterprise apps and data against accidental data leak on enterprise-owned devices and personal devices that employees bring to work without requiring changes to your environment or other apps. ## Prerequisites You’ll need this software to run EDP in your enterprise: @@ -37,7 +37,7 @@ EDP helps address your everyday challenges in the enterprise. Including: - Helping to maintain the ownership and control of your enterprise data. -- Help control apps that aren’t enterprise aware. +- Helping control the network and data access and data sharing for apps that aren’t enterprise aware. ### EDP-protection modes You can set EDP to 1 of 4 protection and management modes: @@ -61,7 +61,7 @@ EDP gives you a new way to manage data policy enforcement for apps and documents - **Using protected apps.** Managed apps (apps that you've included on the **Protected Apps** list in your EDP policy) are allowed to access your enterprise data and will interact differently when used with unallowed, non-enterprise aware, or personal-only apps. For example, if EDP management is set to **Block**, your employees can copy and paste from one protected app to another protected app, but not to personal apps. Imagine an HR person wants to copy a job description from a protected app to the internal career website, an enterprise-protected location, but goofs and tries to paste into a personal app instead. The paste action fails and a notification pops up, saying that the app couldn’t paste because of a policy restriction. The HR person then correctly pastes to the career website without a problem. - - **Managed apps and restrictions.** With EDP you can control which apps can access and use your enterprise data. After adding an app to your **Protected App** list, the app is trusted with enterprise data. All apps that aren’t on this list are potentially blocked from accessing your enterprise network resources and your EDP-protected data.

    + - **Managed apps and restrictions.** With EDP you can control which apps can access and use your enterprise data. After adding an app to your **Protected App** list, the app is trusted with enterprise data. All apps that aren’t on this list are blocked from accessing your enterprise network resources and your EDP-protected data.

    You don’t have to modify line-of-business apps that never touch personal data to list them as protected apps; just include them in the **Protected App** list. - **Deciding your level of data access.** EDP lets you block, allow overrides, or audit employees' data sharing actions. Blocking the action stops it immediately. Allowing overrides let the employee know there's a risk, but lets him or her continue to share the data while recording and auditing the action. Silent just logs the action without blocking anything that the employee could've overridden while using that setting; collecting info that can help you to see patterns of inappropriate sharing so you can take educative action or find apps that should be added to your **Protected App** list. From fd991165e2353ac9a24c15c1836792ec15ce9eb1 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 17 May 2016 09:29:55 -0700 Subject: [PATCH 306/439] pop single PC topic --- education/windows/take-a-test-single-pc.md | 22 ++++++--- education/windows/take-tests-in-windows-10.md | 49 ++++++++----------- 2 files changed, 35 insertions(+), 36 deletions(-) diff --git a/education/windows/take-a-test-single-pc.md b/education/windows/take-a-test-single-pc.md index 13145d80f1..e3398a8957 100644 --- a/education/windows/take-a-test-single-pc.md +++ b/education/windows/take-a-test-single-pc.md @@ -16,7 +16,7 @@ author: jdeckerMS > [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] -Many schools use online testing for formative and summative assessments. It's critical that students use a secure browser that prevents them from using other computer or Internet resources during the test. The **Take a Test** app in Windows 10, Version 1607, creates the right environment for taking a test: +The **Take a Test** app in Windows 10, Version 1607, creates the right environment for taking a test: - A Microsoft Edge browser window opens, showing just the test and nothing else. - Students aren’t able to go to other websites. @@ -29,7 +29,7 @@ Many schools use online testing for formative and summative assessments. It's cr > **Tip!** > To exit **Take a Test**, press Ctrl+Alt+Delete. -**Take a Test** is included in Windows 10 Education. To add **Take a Test** to other editions of Windows 10, see [Add the Take a Test app to Windows 10](#add-the-take-a-test-app-to-windows-10) +**Take a Test** is included in Windows 10 Education. To add **Take a Test** to other editions of Windows 10, see [Add the Take a Test app to Windows 10](take-tests-in-windows-10.md#add-the-take-a-test-app-to-windows-10) ## How you use Take a Test @@ -59,17 +59,23 @@ Many schools use online testing for formative and summative assessments. It's cr ## Provide link to test -## Add the Take a Test app to Windows 10 +Anything hosted on the web can be presented in a locked down manner, not just assessments. To lock down online content, just embed a URL with a specific prefix and devices will be locked down when users follow the link. We recommend using this method for lower stakes assessments. -### Add Take a Test on a single PC +1. Create a link to the test URL. Use **ms-edu-secureassessment:** before the URL and **!enforceLockdown** after the URL. +> ms-edu-secureassessment:!enforceLockdown + +2. Distribute the link. You can use the web, email, OneNote, or any other method of your choosing. +3. To take the test, click on the link and provide user consent. +## Related topics +[Take tests in Windows 10](take-tests-in-windows-10.md) + +[Set up Take a Test on multiple PCs](take-a-test-multiple-pcs.md) + +[Take a Test app technical reference](take-a-test-app-technical.md) -## Assessment URLs -This assessment URL utses our lockdown API: - -- SBAC/AIR: [http://mobile.tds.airast.org/launchpad/](http://mobile.tds.airast.org/launchpad/). diff --git a/education/windows/take-tests-in-windows-10.md b/education/windows/take-tests-in-windows-10.md index 0262fe3f68..c5dd2475e3 100644 --- a/education/windows/take-tests-in-windows-10.md +++ b/education/windows/take-tests-in-windows-10.md @@ -26,8 +26,6 @@ Many schools use online testing for formative and summative assessments. It's cr - Students can’t change settings, extend their display, see notifications, get updates, or use autofill features. - Cortana is turned off. -> **Tip!** -> To exit **Take a Test**, press Ctrl+Alt+Delete. **Take a Test** is included in Windows 10 Education. To add **Take a Test** to other editions of Windows 10, see [Add the Take a Test app to Windows 10](#add-the-take-a-test-app-to-windows-10) @@ -35,41 +33,36 @@ Many schools use online testing for formative and summative assessments. It's cr ![Use test account or test url in Take a Test](images/take-a-test-flow.png) -- **Use a test URL and a [dedicated testing account](#set-up-a-dedicated-test-account)** - A user logs into the account and the **Take a Test** app automatically launches the pre-configured assessment URL in Microsoft Edge in a single-app, kiosk mode. A student will never have access to the desktop in this configuration. We recommend this configuration for high stakes testing. -- **[Put a test URL with an included prefix](#provide-link-to-test) on a web page or OneNote for students to click** - This allows teachers and test administrators an easier way to deploy assessments. We recommend this method for lower stakes assessments. +- **Use a test URL and a dedicated testing account** - A user logs into the account and the **Take a Test** app automatically launches the pre-configured assessment URL in Microsoft Edge in a single-app, kiosk mode. A student will never have access to the desktop in this configuration. We recommend this configuration for high stakes testing. +- **Put a test URL with an included prefix on a web page or OneNote for students to click** - This allows teachers and test administrators an easier way to deploy assessments. We recommend this method for lower stakes assessments. -## Set up a dedicated test account +[Learn how to set up Take a Test on a single PC](take-a-test-single-pc.md) -To configure a dedicated test account on multiple PCs, you can use: -- [Mobile device management (MDM) or Microsoft System Center Configuration Manager](#set-up-test-account-in-mdm-or-configuration-manager) -- [A provisioning package](#set-up-test-account-in-a-provisioning-package) created in Windows Imaging and Configuration Designer (ICD) -- [Group Policy](#set-up-test-account-in-group-policy) to deploy a scheduled task that runs a Powershell script - - - - -### Set up test account in MDM or Configuration Manager - -### Set up test account in a provisioning package - -### Set up test account in Group Policy - -#### Create a Powershell script - -#### Create a scheduled task in Group Policy - -## Provide link to test +[Learn how to set up Take a Test on multiple PCs](take-a-test-multiple-pcs.md) ## Add the Take a Test app to Windows 10 +You can add the Take a Test app to Windows 10 Home, Pro, and Enterprise. +### Add Take a Test on a single PC -## Assessment URLs +Use **Settings** to get **Take a Test** from Windows Update. -This assessment URL utses our lockdown API: - -- SBAC/AIR: [http://mobile.tds.airast.org/launchpad/](http://mobile.tds.airast.org/launchpad/). +1. Open **Settings**. +2. Go to **System** > **Apps & features** > **Manage optional features** > **Add a feature**. +3. Select **Take a Test**. +### Deploy Take a Test to multiple PCs using DISM + +You can deploy the Take a Test package through Deployment Image Servicing and Management (DISM.exe). + +1. Get the Take a Test package from the [Microsoft update catalog](http://catalog.update.microsoft.com/). +2. Upload the package to a network share or to your Windows Server Update Services (WSUS) server. +3. Create and deploy a DISM script to add the package to offline or online images. For more information on how to add or enable features through DISM, see [DISM Operating System Package (.cab or .msu) Servicing Command-Line Options](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/dism-operating-system-package-servicing-command-line-options). + +## Related topics + +[Take a Test app technical reference](take-a-test-app-technical.md) From ea6cbf4213db5a83485bfdeb0321b211fc9bf4b9 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Tue, 17 May 2016 09:52:31 -0700 Subject: [PATCH 307/439] Updated based on tech review --- windows/keep-secure/protect-enterprise-data-using-edp.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/keep-secure/protect-enterprise-data-using-edp.md b/windows/keep-secure/protect-enterprise-data-using-edp.md index ee71fc6383..d647af4367 100644 --- a/windows/keep-secure/protect-enterprise-data-using-edp.md +++ b/windows/keep-secure/protect-enterprise-data-using-edp.md @@ -66,12 +66,12 @@ EDP gives you a new way to manage data policy enforcement for apps and documents - **Deciding your level of data access.** EDP lets you block, allow overrides, or audit employees' data sharing actions. Blocking the action stops it immediately. Allowing overrides let the employee know there's a risk, but lets him or her continue to share the data while recording and auditing the action. Silent just logs the action without blocking anything that the employee could've overridden while using that setting; collecting info that can help you to see patterns of inappropriate sharing so you can take educative action or find apps that should be added to your **Protected App** list. - - **Continuous data encryption.** EDP helps protect enterprise data when it leaves a device. For example, when an employee saves to public cloud storage, or synchronizes with another device.

    - Apps such as Microsoft Word work with EDP to continue your data encryption across locations and services. These apps are being referred to as, *enterprise aware*. For example, if an employee opens EDP-encrypted content from Word, edits the content, and then tries to save the edited version with a different name, Word automatically applies EDP to the new document, maintaining the encryption. + - **Continuous data encryption.** EDP helps protect enterprise data on local files and on removable media.

    + Apps such as Microsoft Word work with EDP to help continue your data protection across local files and removable media. These apps are being referred to as, enterprise aware. For example, if an employee opens EDP-encrypted content from Word, edits the content, and then tries to save the edited version with a different name, Word automatically applies EDP to the new document. - **Helping prevent accidental data disclosure to public spaces.** EDP helps protect your enterprise data from being accidentally shared to public spaces, such as public cloud storage. For example, if Dropbox™ isn’t on your **Protected App** list, employees won’t be able to sync encrypted files to their personal cloud storage. Instead, if the employee stores the content to an app on your **Protected Apps** list, like Microsoft OneDrive for Business, the encrypted files can sync freely to the cloud, while maintaining the encryption. - - **Helping prevent accidental data disclosure to other devices.** EDP helps prevent enterprise data from leaking when it's copied or transferred to removable media. For example, if an employee puts enterprise data on a Universal Serial Bus (USB) drive that also has personal data, the enterprise data remains encrypted while the personal data doesn’t. + - **Helping prevent accidental data disclosure to removable media.** EDP helps prevent enterprise data from leaking when it's copied or transferred to removable media. For example, if an employee puts enterprise data on a Universal Serial Bus (USB) drive that also has personal data, the enterprise data remains encrypted while the personal data doesn’t. - **Remove access to enterprise data from enterprise-protected devices.** EDP gives admins the ability to revoke enterprise data from one or many MDM-enrolled devices, while leaving personal data alone. This is a benefit when an employee leaves your company, or in the case of a stolen device. After determining that the data access needs to be removed, you can unenroll the device so when it connects to the network, the user's encryption key for the device is revoked and the enterprise data becomes unreadable.

    **Note**
    System Center Configuration Manager also allows you to revoke enterprise data. However, it does it by performing a factory reset of the device. From 3d925ce9dddbdf65d1af17f51de896bc0ef5cffa Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 17 May 2016 13:16:42 -0700 Subject: [PATCH 308/439] updated multiple --- education/windows/images/TakeATestURL.png | Bin 0 -> 10047 bytes education/windows/images/take-a-test-flow.png | Bin 19438 -> 48795 bytes education/windows/images/test-account-icd.PNG | Bin 0 -> 5875 bytes .../windows/take-a-test-app-technical.md | 8 +- education/windows/take-a-test-multiple-pcs.md | 177 +++++++++++++++--- education/windows/take-a-test-single-pc.md | 10 +- education/windows/take-tests-in-windows-10.md | 4 +- 7 files changed, 164 insertions(+), 35 deletions(-) create mode 100644 education/windows/images/TakeATestURL.png create mode 100644 education/windows/images/test-account-icd.PNG diff --git a/education/windows/images/TakeATestURL.png b/education/windows/images/TakeATestURL.png new file mode 100644 index 0000000000000000000000000000000000000000..b057763e8b7895c3795680f731db0d8af789ec54 GIT binary patch literal 10047 zcmdUVcQ{;KyEoCIwPr2^Ih*b|D8YfwXePReebpIweI>`cdQZkAw3NT4G9Sey^gk~ zF$oFjH1Tq}dWHC=J~Atacq8>TeyBlGIl{F;d?0teZ*ZT4q$Y{>!j6LYOzo*{=}khy zfcWbo?ei#gBq0%+($Tzc>i-M_tBH4;Ysg1SGW{4LuYDx+r9(Kt_IbpkFX~`=mZ5wp z2QFGFrvzJ1p@g?7SEzUbSoqih(!E!xuO(2@c1Bkyl{7ty13x%IA?Y8er ztDSZ-_Ab&AF3@UFjH?atW$3+L?3!GI=IT7Vm*-pNBLSnGCO96$F6+76kfsz&Q2AQT zSOotGp5tk(k5LAJwHH{oJbWOjE7oXB;?D!<{Z(z{FR!nEaW%VnmJNel!4FXgzFAkfQ1H}fR2Wj~$32h&AH6=)R_Uzo{fye&oe=>nW zJ6#o_gged&HkY_r;oqZB!l7#9J7=ux;u35Ozo7ixuS_LVQ&S=eT?}Vhi#(5&T(p5Q zcTW9D6B!u_#c$b2=Jw<;ezn7SD&FB;W;=SapuBI&cWkkm!fv?4{9r82vtW_c&scoY zX1QiRm~e(h5l)(J+QZNOd_Z0Nxu@qWCWIJ)oMroWzWSA|z!>~FN#DI3$>uT9GuDmO#d#B6@HIgO)&rF$ayXG^C3=D%O%%g+d2@8tJN zQ5M7J%3_yUf(`LsQE%|mHu&kL_TxLSyC2F@XK|Y!p_kRxszT4CbT-pV+FSdpeqZg# zDeI2!kL)B<{X!2Y=83RwXv-%@-6!s|d00!XEx8JH`oi>__8$8p!$0lwzpfDLyUzUl z2dn=w!~b4FrBeV^ue#>yels~f$G z8bh@tSdRVnU_ILS>&@DgT2Sc4Z(b-`33Yam1s@XM^?>6~crQ=;fPS`O4|d^~s-5Co zzeiOasA+>z4OPz^hq$B73i%Z(Rw``po7O$)X03Xvrz;U2!M{0m;>WG%>n-TX0Lf7@ zuznWi0O?8%=;uOVW}4&ihrGae0lvr9;Q+i~s-X3F=y8S3^XqfkT}rxf=r80Cv8Vtv z_iAcneTq}>(H-Q@)l`7Xrzi*9t#%jr){)US7rzqyY-#L4=CS>0udn0cNj~K{c;1Rz zTx;0!=x)*z(0w;wQ0NeBJKG%T)G|h<*AM+LI%3!Q`3T-x<~5;)Q_9#mx)a|&>D`99 z1ltKdu-cE*UN9eI3D)=x`H2v!cy*cL{qp)jSRft8g|e`k=&00*M8k7t%PzAmkIQuq z;4j2&f=)1Box|9-iqxnt8k2peT$735YnYHf&WPC0L=!qVdKynSV7{)>mGp;SF*sD< zO9dmOeRK)08fN(`>9sjj?QE5GDsywS%oLFR+MXtnz!PzCduMN&ibpQ82H$dfI3X-X zSz-17FUdjPPj9lg{n5F8r5PS^CMqZ=+k_Zz{Z7+v zP^xKucKfvl5SKRw?qanf>|{jGD`5joDYULZ%uNIA-=^}LX=4P+a=0T})vam95$wG3 zGZR3FpX{14{lWmR_TJ|g-==I*rk}PG9+38}Py~y1&rO$f$BZUfQG-(_^S%Ab>T~N* zLtwXv{cQpPBO6S)JG^}&#BbQ!u)ceQLHjX4Ng?_PjVwc6$_rId)Y*g}XgF+=m#><9 z)ZEyxntsHOV_^ah+CQPS**vki^D2lnrDXNs_})b9*eb2b@@){{h^>(Y#`rY@9l@yD zk1a2GUf=%0Nui=vVA@6tx)Ha$mlnq|$7Z&d5W}XV+hp2T?8ElFI91^teN~L|b&LJ; zd)>0U{-mVC;&Q3!B=RxSY#^krl%f_7Oh+sDQt_C5-JzaEia!fkRRCAFkQeg~E%gZ~ zV&Zm^D}duQVfj?#`ax_dfR!smU$xqx{$IwZ|GggO{}FJXh7$-{nyV5Qcq}jWZv6%q zF&01NPJ60)>iS|*ffzQM6@{9E_h!e6y@_&r`RaR}tyFz7Kof)c>Sp%pL8lGq!^kH> zT>mt1U@Zb3C6^1rUr(uUNFAht(z`465tW0}<2z8CxjFEk{u6L=Ya51hSlME>9o&rLFuuFmJpKf#|AEdn9{TeE&qN zUHr@^9F+jSv2jr(-2YvohTjl#y3x#=_H_A=FMyh7-X~FP!X^(=C}5ius}g!rmyai4 z;k*&8W091QrAgd{O=~;NRT<-6dBW&h;AptUF)2uAi z{2jlQ$)ZeLB#W=`81C>$SuR!9%Va)qm-O4W%xQM9SLHgF$kzYxZBo(zBTHar96hmA zLdRv`Tf^zmJS;MI@>}lUzqYVP`$mLbMV4K$WN7{HTn8o|TW3;N-D+TLCYK=ZlHjHg z=ELHgq|oT9+$SgO#Yr4?a!c;-VP`Ah${i_`+bmhez?J<<0Bq$HsLP>vPx`QSEIq;e zKzBmyhJ3~1l(Dpj-*_v%_@X=GE1c4*9d&Nu4ahIXprtvthH#am>whPZ-kb1E zCWBcs#L>i9cU`0J`e;8Z`9!y;fa*w2YC=>mCRXOCT3uZSskx?8L50{l?o021-_mbHMW5!<#elq)fd@}55Q5|<}{<_G;_qwZAB~ z`dnR9be7o-pQ1$A08>n#8{ep~aLYHkvPcWagHn`;TAKST^m32ox2B<&8vdQkgA#s# z?hE^T{6%XKQHI83sX9Q{`X>*m>)+qCG5 zT>98=`Ik-%qTs^`tSST6$600aHG0PJaj^CG3mBGS_EuMr$431(sSM1~E5KExlXk3I z97$pkP8=E?Wk^0X^QNqQxSma^!e8Ta2SD6!7kVq)uwQ%6NzS>IU`B_qx^SG4{pCp!HpqOyygXE|WT0w%e+! zkMmY$ScuH(c$FU&FhXNmpE`bNO^y>L|2oyMJu;}jGRQNRMWx#&MCevGSu9sX*2X)t)KH2 zeb!4xxU`M!YRGhckw@V#29hTfkYCC-`3T51@~H!)e&oD(oeK-V{pirJr);Le`wV9V z$c`U3l!1VoZT>Jp?N^Ygp^qwXjcMVLOiCC*ua}>9^g#z_dFoEb}; zF~dr74~h!xdwv&QBDpWbV-2F}yUWXr8sew)n3XxK^k+fbzAV*v-d`|w0&%vH(@r?d+}xtIdyVzQJpTvOUTKm7Va?b6(%syz%E`R|pXXdM9B6Ux~)?@9Ftb!9dseZ+*-&ACWx?}@zdjR8_I2Lo)^D=v9N%Cs)-0>Wdac=$srx4d#?ZUk=T<+@cHZSnI`)06W+@042-8-Ksba}0O z->(+tvo7&O6m$z9Jh^dIW*OfZ_PTEfvCPN-rrEy-N3D+Dr9YKfd{quQ+>pcD9=WzH zse)kaDs(SR$bBx!yozvxLGaDy1$)21p&G$seeI`5LV8Wq9UuYD^@)Wz}b9*PV!xHHDk(`oNOeb}g&xi9RGKhquf-ZSZfXb<2 z{hH-b??*|v!k6296bfN9Q6Gl6P~Z_Mxo*`*_VX?PlMuehROm|)Q^(POf`xF{G|9Q3 zchV|%YpVK4A%uqRe4l4QJe2=jTt{1#GI}T@v-(G@!Q)0)=r2^4c*RS;x#}RT8FOkD zbJ6W56nMIQEJp2`ML9g#o3Rfpm&GN$Xf54K^($Hthpp?F0?J^QiTr9H#ZEW zSzC_FKfzf~M*}$C=nG~S+%zuYSoh-*xCQA!yz;tr81q60*EP=pV|UUy`Ec@!(M9^m zVe!F@wwmRO;m(FMSpQj4CvBp837E&e4_eUeGjA36bzTILFj7;Qcox46T;*8@XBw8g zFDpYoTSK;`$m9efzw#hGE&?8>Hu7#u44LPV8{!uogF8KQr);vrdEdrQpj_W*;xcFD z&!sbmn%zDq3H5Ak=)@Z#^XJ*C+XPY4Y2~8miVW=$$I{TpUNM1Xh%3wq|Nd zG}YXr+Ah^c9MF^tDpB*-T+1GRc%ChkR$XH7rr(-4leL_(hw*5>4?j$v7)k?=#n;Lb zbE#Y`m=0si|0rK-W->`xK^S*{&sPHy4M_0aJEoi)qI0Ru#oAp`knVyKgU2U%Yu`Pp zybfl69{q9XLoLK`tC`->ZZ?gz&IzlYcZ1XPtcn*QP>0EKN(Qk$*V!kQ*}vc7EE~cv zCSq#(x@`t4Dh84swX!y|vYq0|7(r0ot(qYR*4A@7i)$Zwni*0CM$hZZiyLWgo~$en z0ku2I?<^O-3PhSjYiT;tF_@Nr=#oqm2%)}X0O)mlKh(U> z15LCqaH5@Ys`HJ?s4f+g&LD}J^F?KZM%!4L1zYrPtcT$f~2=XoOE z-~UcUrRXj(WnE9Qtf8kprZW+I&?!|!2DvL|fJp^3S8A*5wJN5Hc!6E&`hfm?vR3Z% z<&*)n+!rdK@hqbdMWEB9J4j=WYmc)l z5K0i(Cyv|g*kmtJmBQwN8|qoRb^ykM(R@aKG)?Z)~d^Jx)-fRFinCXR`@{T%BZsRJRyk@-)}s^wd=bERB;asSNC1(lLORW5rXRH*T-ST1(IK zf)frVAKVe&GquoU$*-8amr=Ia7)?5umf5l66EnpuPa$TzF!?5jpzZ5*-!oSXk2knpX1}wD=67yR-sSao z`*uuvdjJ<&e?5)OL+{2u)_ zfR|NL{`ITs)`#oSI{F4R%JlkZBZOPSPnt$Wq6?4n}nd) z^r*Dop5=hlRKOR#8NH^T?NcsIRCNI%$5^`@-ReGK1rn5h5c+{|I}+9Qun9Y>r&i|svi&98uS+O-$N^(oAu8#xKFKJeLLOrqnwGc z@C+z_;1EU9wO1$A>8JQoS>;Y1k5Q|326DmODHAI%Chf*}GcZlZf7>NcxN`kak`(_X zc3^oQ>(9`J0^+YoEiQL9%ZSQ6@SVUs%k}c5J;@fOKlK~D@5_TLceqC{SguRqV5+Cy zv7^vkS+9_}v`}mjrki*B$3ctY>lsQ{6Tk@TXT>3KP;-Iq+tAdu7jnk*w!5#&IU*eN zgvSl<_6}QaH&D5hO&AyO*NA~oL6V&snP}xOkr;#EQCL56F6b-GWMa(dc#lnhuysHn zz_V^(SdP`ku5ZM>pzo;uluu4!>zBRr@3|*1q>l9Q7-k8S*Qig2*!ac+6PrMVrg+Uf zKQgIYTM&tAuFoy}TKyyu-t=hhYH0~Yc|}W(#;>NeH}$^L#bzDVJ74W*=Vr}=ZfdAK zC@$xBi;oJuE~K5&CgA?#7}ikcfNsVl^FRitQ>7x!_+WVbMECMvKar_CCQNh=d(tL) zzKqF*SfkJmo1zjgyrcGl4AY#)r@TU9j?&lef?xYnv7YY8NlnhAMtR4*W5?jec0miq zWq&sG+)0eFuI(xEB>8P0L-Q4l3w&r0UFFs}swMiHTr4`hWaa6KG>*a+x%g97Dg)7nP}>4I591Gq)^Q+R(1GqpT~;mx>`0;FpySCngm8~u@Una9F%i#UzgR!Lp7i|DyUrRxa$8ibN-2-Vl8Zc}r42tYgnA^@ z>PnG!SaHF?*oH4iP2x&wj#tB$`n+OOo?|)t)&2qUZBt2{TNwORU0&n)r>Hg>s}599 zUSKI7WeV$Q4rXwxAYuQvr!{VH9PnkwV!31m7Ic%SP}|u19ciaVpm}85KzTGZO#fYH z*pinz!gso{B5{qXxZlzmD1P3p&@nYo^Yu}aE}E-+bTh~Ag04hJ>?4EJl;?t-{&J96XP{s7br&c^Iu)*}t2<4CV~!GIraqj_dR<5kvtM&N z>Gi&^+Rn=CZ+$fGlv|LfPq9`vT)-P4%5)Q%Yu8*Fqu3Xs>|RRGz48vM>hj(2$aSG` zGi;W0E|&=AKM!HrTj7n!IxaYmcfc4l>1BEhk`8W_8&tgE8v!E6{KjYVRHDnT;_H=` z)RxvVK27}EAZ;kySbX^nlPpM#xJuC*>M#8#x0VlLUlI!!ohFw9O(~V5vX}mw-zWXX zt-?d4O~yqI*u@8q6>BDS?;02cQ9B~kC;>?Y2#L+8UA-3Gm-1%R)1$Ih2#4rJu`71I zor9o>8Lv_XYT*yGFsFlSW-c>3nPgrk z1nLUASMQOz&l2A(noZu%m8Wux$)(>}&hm}#t8{a8(y28Y_c6}>t=|!QC=f831V5S1 zk*+Q*SEpw+59;nVYG<}Vz4ft}2Um@K8m%Ao>?&ui z!4*-0U9%$od1GROt$QM8G1<*!MC8DEw*UPLhw7UX1H-?_LNK1(rB1bSE2|+^47HJ} zAM9eB!<9VrcN-o(^xNi=PT+;Kh9A*2e{$XZawp(j$W`9+VUtIsuX+A>WJhJlBx%yP z>pYe|Tt?ue20*@dA90RW`em6~7+H8Lz5@rY2i;_)`bC%FKCk6V;d@5X${1#L`<0s*OcebohR6Y{l;T=VhJdbo`{-`a~3VO*rJm?hlz@`7;HazhO^9 zryb9^zUbmv5;hhScXaQvx$mo7ua|3HEa8BCOvgx)hn(jUhGrj}^zzLo;(K}2|L6($ zPf<6->>#?dXD@G+=aTa6DaPjM&t}xx7PS9*Z@13Qcw-Dq9UmfSR4Jju;ygb+TiicLJ8sC&>H-=zp`^ z`FbHM5oaZ$)6y_0N=d{G;Vi>WgzqgYJ%H9-USZh)5_F@v#a><=Onk%LS*b%K%B8B* zY^b+xskT4ETLGt}a#)ldK-fyN_K}hcXTiiQcE{4Q>-%oRKGL_B?d)=7xQ4-CDto9M z#@5@8Ge0txl!a@|fvM1qGs8(Sh)+fKVDa+zbmC==Ko&aoC6vsh8T~m6bJ*ZGir{AW z-i)OhfA!|;pG;RdE7{U_wlzjrUrGyZ(@P;kD!EMruNn3itXCFi3Uq0J z3nm%x^0ew*i4u;sogAIi(=o}om=3LwOQL*Y8f?Yd9h$4LQrn>%0^O6>3r+0nX#-j` zGTuhEXZC~GB*(EDc`Re?lIvDmaz+wmiW$y|l^v<_-q&(vZQOTHzE9gE0B8HtV>$%4 zJhmnDuQDN!R<$&`D{qGU0}s?kSj&p%IFD5d;1nb78B4tE*Jqk$Fbt8pkob*n8qYhB z5~P`h?p=-e=)9Yscb{kqNgSS2$(bF@MvBlZtoaV6(>xw22fpwTfvwYbyu&T)K}#al zhjwOKmOhQSA2pRMjZnf|l+>>Of~~ujfS6KZ<8gQ^YWfqP9e-`S#?-qvPpoK+yZrPY z@`J3)W5^S9J~4;}^5QWcXwH~foKa8M+8GEUWcr;)Gp&NoReFx0_I9QV={r`XOWbm} z9`Jw(D78>{w++@m?ez$yc8f+CnT%HUNuePJ&`DqKp)O)`2)>nPT`ugS6Q`CJA)Gso zy3^+q*Dx^CWNw8l$7F_H84IGttCvrgVcPdai_IW&Um^Fw<;E$9Muo(0V{`<_Za3ehplxFG#tW|?~W z!<>h?SzE#qx}QFw_1iw{knIu!&FaVRF#eeqm3t1C6r&L*|`G)&a&YDC$@ zoMtb$>xm#gTW`;%N4+l{gHMiFvYG&+gBXNPhGL*Gqe~*|&5AiEv08@~h3CDa3`A?5 z2;~erzhrJ!mN19jhE7%#-pN-yjO*}irc>c5wo^AdNB@$@vUVI4)^!F%3VH>W!TGa( z5Ut3fm%sLLf%yS8_{cBrT8iFU7aWRwc{46{^Z~3)|ANBBj7nF zW_p06rB)l_UD0@Q+=qgiu|LwJjCp4FxaNO2lDE{XzVH8;&^OPx+@IO;Aiu{n1 aOVUm^&RQ{S3W(VBMxvty)~wX94gWVEDG~Jm literal 0 HcmV?d00001 diff --git a/education/windows/images/take-a-test-flow.png b/education/windows/images/take-a-test-flow.png index 6ba26e08d5dc12756b97c29158f814242f692174..a5135c182226e939368a9fad1048c880d0065b7a 100644 GIT binary patch literal 48795 zcma%iV{j&2wDl9)wkEcnJki9?#I|kQw(W^+I}_W<#1q@em$&YB|KC-0s{8cm?&@lt zz1LbhLP1U(0Tve)001CJN{A`}03c1@O&S{VdrQx?N96Yc#7Rk97*I2ffBM}4HxrT- z0s!jc;NA@&zWXrt5*khb0OHVp4J3sY5%2prCP`5t6?ffp9SD7NaV%d4@_^m`t^W^d z#9@L+bl8wWF{y&K&dyG0;qb|?p4Qeq#~kEg_{>S_cvbo3q~?~iwCyPESR7jLKkE`RrA zNnFKmmK4Q&;-dVz8^nzae7%?up+a))JoGm%x(f}}H{Ox|Pj?E0d=~vb_(D?!l;(fq zS_BBg2Jwv$B2cM(>i<0zePlq4`nK2GJl+fvIyydGFBur$)fpDBcH2V{sIO3b_vQyS zJZ##^-24s;+uu)ezrGLV;qj(;jU?5JokrySesZ|+bbq_$wU$FhLA(yl#yAX@BH9j}ZasS#1n0bK$R}2x(IQ_S-m`qoI zr?*g3WHak3By>c^cM$ddhul3r#7`fPGMyDrQ-vdGkvM`x-#g%kbn{O#F(sG(Xo*Ynz_2V3lOb}EZ7aac6TCudjl7V-VA83iju zVS*wcm{^=iFn(spsi`3uM2#@YK;<{GmPm>Eh8@oaGc=Enu6+IGIq@10WJ*UJiVzEF zEGuZM&j~pp1ylDxjvhxHDR7oVgAV95H2k@tt;ru~$jzHBR$kz9!=N_J=yMy)Vm>u@ z)GtJ0Y-c7ij@GUSIgJ%9z1IshJCA3YY3C+i)>m{l;LX57a4eG*-1Q~DkALOg-0bZx z4a>!n)=(;Ut3l$=oJJnQdpMb$=vOcL7D`HLH|x7n`s*-fZT<%$*`oc|2bADCYb|H@ z25Sy#N4u04`kz$Ikq(P2n~e1k>#Azu5M1|@8V&w&s~va`j&KME(FbP8`R8W{g%3v$ z3)kMzgMY@1`|KSchww1seLsodrsA3-((F!B%$_mRYx9=Z>V)YGXCW(Av+*?v!r9a5 z2`)4bT72Z^ndJ!!nVN#UCQPBqU~mcQNaf6nOXXt zS0;(dA1c=SKYF89?6$|#bK6akrvA?Sor0pa2wZIn%5W%Ex#Y8LVn$o4YpySpeVds} zq!&N=yjwB;$Uqad4@Lxsilv3!tN)nV72oOgq1N;H5Ui#|pK#ONz7M2Vg;tD4^8-WT zcHHBT)pf?R=CQUr!;5*{s7ZD034QX+R)Ap~8?*!0xvHkX(fUzPnGkQ<3mx5p+a<|`) zAS+Edt#&04ACtn)y|$sWlW}&kaxwY?X@5DWx%4zi6wwO_)`NoEyfCxL>uPj^MD zv98+s7oJpYM4%3Zc!O~`zqgr*%h@8dskPRBB(ulxnn-1+^AP5QNf~{@5@ho0pgN!& zNaU&TV69Id`y)0sH{{b*pi1^U8%rd_3p{&oLj-~x&*Y>rn~*Xj@e1atv+l5(agKo(r@h}y^Z z&Sqvsk+t)1hfjK+Z6`Uu^`lK>FyO3hXeD95b#LM%j<3p|U`9FKxN)kLDe!;?jSU&e zmhH>PEbJoWJ5i-`&;Ka?{!vZ5-QPs@K0~e#aX~D|4(~)AOHtm}mi4=sK@q}LF#B$5 z^hZ$|{owi${?|Uk1%+fkX4K@bdrk6IUmTO|jW2)iHS*tMa=+?=lZn1V0~C*|DYWDsmotcG?9k*E8E#`JjL(xT7E(MDOpYqbKwtIXNIVl=ZoEzQ_TrBy#nb%l_gpgI~ zGjlqYX{j@_Vn51i6_fTRjrISW{7R}!`D4~rRB+LT(e$qtO{L74A#=MkV2@^Q+oSu? z?l712bhX6m4;$*-nCq_!?SMay1YGWq6c4#Qv4jGCBCajkzL>V`(g(%lg93zY9>+Jd zuRbf1FR?9M(fHWNNp%o{qqxv0?&|%1aTs?r7^`3`wJ}=TjuBU zz2z=T!pU5|)|y=}$PanVx+nJblM^Z><{b3OV4gBMWJVubUUs-^rJxvN86l1w9}&7e zOI@JIt~dK!3weTW2~<5YF54BG%zaZ8n-KBpX z#94M4izqPQX3JfdL9ewRBYRI$}a+rYR&%R7M<0LjLa*!i0Y z-e^8~h@e@`YfN~YUOH#;edrXRTC0jv)Y|dC7G^PUsN5BNcMF3| zQpgCZUW}bjr_l)21kewDYcPLgCKnuT#3?olIGOj4fE6}kXZy!FXEa5QxYbDBq+5_hA_pNEVF;nKzOkE{+|$RES*S!TFl=}Rzp~THS65=7 z94?@j`{bttc_Yc6^i@Z247i83ifvkls&Eo@=X2WaECf;3QhNk)HJJl_c)a&8`MqCN z`6x9v8h}Q=6p=>mGE3msq&AywvHw_hZm(}mhaVVHt~hcu<8&Du;HGG?iZy)jBK;v| z$_MyL2A@-sd5s*`+1iuZY?u=tJ}rkQMlYk}gP&wH+LdoPp=SM3Q&s0S4$VhQqVTRDE_iris$3 z8vPb`a`FcEz9)AqF}tXzA`oy&sl4;=v_E6k65)J#)9!G8W6nC{DBSaB>Rh51rbca7 z>{s1akLoH&Fn5tVBqDpWb$t*z(hrhU3JKe|lvB0|LT1 z&{rD{9{bdwpz!`}=SO?XkIY>1xTeVIcFX%YYPn?IXSMNO33!kvbw_a$BnCu9yqx}a zYjm}cf0#Tdp{(UQSsmsjjgJ4k4%sM-FhF*z(Tdy34wmZYNXKM75P5 zKWJ8~yYevg3M#WI&Qw@YW5(eeX(xVO?XQ^AXz`9_%x&urTdJSY6zU5bWcBXl&r*&^ zKJ+-L&vlD*XC)h1F(B%6yu^>*D{C&6VQO&;4A_BYjJwq)q%myy3aef68w^Kg)C=v8 zy18qGHdWG@SPM8(S8qB9pJ2V0xWA1jA{s#qkV^7l{aa~c>-POfWvO>@OW)~!`h)O~ z#eto+_1HrH?iLjfIrpzA#!2Wr-1YICVj^K(5CiG zsEO#FJ6YbG1Ku>h6HHuT_Ue~U6I)}^*Sa!X2j?fe1o}DxLWFp{uQQ!ln2U(%89*dMG zp%%b>IjFcKnk4$#jDUPF?h2aBzvMKV#kFxBtu+S|Jthgf6QPI!EB-`qy&c1ib@BIx z)eM3$CN@Y{IHNCE6RDc>LdYAAUd09lyl-(I2iA6s3DM7e7>>~}5dKWat-(#HCFVJ8 zm>X*ekw+4P1OJHOeghhgK>}_i2!%H#?D~ak*L7fJ5m|rCBe0-l|0O|3*L)1)XGK<@5b(Kj5@;)Q#dq0HOD~F?rg6cH#Qu1 zZl8+MY^8airMmSnK7;gG;2Y{tTK9T9e9XTBd;Ye!-Rx2?8H*{9zS6lzYg#J9DpU#w zruVZF-2FoFS5I=e*k)A(7;x_rVn0vx%8#=~xYO~wKZbH#2};YwJ|+u@2`fq@Q92jV zStQLx_QobqvRXvbRyBhH_jgIs;rwoI33LoePXAgnUb1vS!4o>YU|ZEyC6e2lkTZbj z_}qv7e6#?Pt^X=fy!agvh;NbYc zyR(Jjs!gK4AqX|KG9GerqP7Qt5+=i_p}d9U{PC@`F?_5|V|#X)cNZu(4w)l)UWhB_ zgK3C&&?YK@?mHlHIvNmnu|G3Jw@#K0vwV87(?J8*m}-NVL2Ko;;(zJP8xug zI9)53F@J$-trWGfN=am^<PWMRo(g*>}?eyjMgDnHd4JYtKEx&fp6%ds*!UlhJqQ z4`IT7?61=$>mSF8AN^6H7L8^+p-=sDQh0BKx;=%)Ao*|Lw)H2~X|3uI*l77a1rEhN zPjd4l*RV1k7Xh@lof^ZS_lX|j`>-#=nj1cUaary0>bew|lIG ze2h~#suY4;BKwBj8;zvthcuHVsNArTo`H236S;D^b2=fV?qf#i06V6`pV)Zm0z#Yq zL_3_W-2W6~(^p2jUWw3nlpfh6Lnr~}MAwK^Bgp=B_dU+pYwC4#eX<~B*ttUO_%`$} zndCZN&)VzCPz~_+n73XL74 zLr?$^P?m9Lk0wYDAK_ztFzP!?mB4)ARoGzeRazolvoKu2wH{7*-YIAwX52}$ zUKMqvTb31Y73+xq)i2j%x*|EpR4fkP_XY|ECI%o)A1p9e;~5OH`A*#pS;WCf(1RdT zIE`2$Lc#SxB1_Xq>)|mq9Qz)+?w%pGeD4!c)&7Zdgz$ufGiyKx|qX`IPwx)5uGDSwJtAC_N(7B#KVyitl-I+iVYGr}_`1x>q1ZG@1|ofyq_@tS|&9VpKHPO3*{q3&qYj zgPGjj25(?uESC}v@r$72DOmaEp(|K$9bCBep`n`GRjfuE=&4) zQK~bQzYySewMNOiVLzZ$HgGx^51ynoy%wyVG;etc7Ej4r3cZf2X4_{BHv-GW_zZC_ z1-j0^x7{p=B{^XdNgCo(X%WpyBb^d&rv&pj6xAPEWayv8AQ%F}pqgFx$!xn8>E>^& z89AgpE3Hixs`QLZRT`?RC5RNl3Ai+R@S(fbEAmPz`H_RgZUc*(sKLVFe8vpkAoJ?k zb)`F?m{*@qI)$XSM=NtY)+>buC{_g=s9rvdouIQ2e3!uQj)aSaWc@QK6d}MN-Noh76sf8V3Xu?2QV{I}WYP zM%%pex}ckK@c^&J_^>Q=25%W^`IEDbg7bv2>7Q^dMG3aSR zBUB&23t}z$2p9NQ&HhTc;hyzk>RAL|UiTw%KX;Rd1!mne+vUm@YKo-+^fELMQqy4y zHitvFu09y1aD?z3(m(!-$1&o2)}6`85_vzh<70~t7mkT+ zk|-%x|GC-)pU|%;)1uU0aE-H)B;dgfBq!kD2twDHX99kMAT<5B>l1S}<#r3Vq%!jq zQ8Q0=5x`*LK>OG7dUHSGlM%+9{-Kk!bSx?`%6fAW7UHAK)CdO6&W?+b%4xc@-nO{O`Hon3CVpR6WO=j#{w`F1A z%?$*)nvxW_2D2>*Sw|dH*C^R6Tf&+lSk$Zg9BrUf3I>00jWOB7F zF?=&f=awjZTu9+yw9If=2`H-v?WD`CyX4Y{Va{3bqzhL1=|M+G`QZB zZ8A_2*W_;jL-=d9_c>$=gH4vssonX;c83b37->V-1c^Mn0X$33%N>Q~Pdz2B#Lh+K z#nW=EhbcUO*`M!u=@#=4^(xX%$EsTM>-pms0+kHsbg|lkRNDvTLd4@omO{%EeuQ8y zlXGS%RiP^<>P*<_tOZ_oNg7*O53QL%C9c{egTf6r6@4gXWVGi{R1j6szbj^F1B@E@ z4AZ^ZiK4aID2O6`#!pW_ey%*US^iDX)U8Nepa_GMie=ir-;b!~7*?Szu~ut{rM1CEudLQGtq>q{%E zUKTd!lt#A4Lgd#GMm1-N^2X_*fP{sF0=A>-RuZCG>iiFH@g_n~s+9;RB1b~X$F?YI z6*nEbPY|_AkzK>-hMbVm8MnJAvBc>XL#6wKDSGxA`tk!>;B4qzD{`Ck_k|duqN?x$ z{BimG8qK}Pu&fL6{5GhANCRQRQ`r`n;B0dq3t7YD}Yuy z=Lm}&*`U&5Ms?32wO$GqHZ_MvOhUg98i%5_THAF@;8IQav-3lL<+WIH@|)44TPXNC z0Ynj{+56tQ_aXz^{kQn6Z3ImS6Ci^Bq-Z^zU}zzEjSB!c;vRV^fB%_tPbx_arp6ecsvzAvmOLh=}*zEx~rG6Le6YZEvI$`fvkJn z{!LM5N-rA4Zf=1u#h3LH92WM&N59~4 z_XTfC*0OGyxLAKFMyr(ieZgz#xZ!0kMLf5PxOd;dl=5zUH$cJCpxUr27%CZN;A*pa z^x$QiHd(wd`x;dP^F-q8F}oyKTTaHKPr;nYnB?KvBc=`5kH;kbb@>5x3t4;cb_6+r zjgJl#^3BuC#MG|8wt9q+Q2wI4ecQ$Ocgq5$fZsN<+b}O33hS>v*YX_8_N(gta31K^z?5ya!_1lonSDUPc@NE%6!HMSS4wRziI(m;S827(EAb zfzV0xZ11yc1t}!-HdhcfbVh~)h6svrwRq;=&}A^Cyu*sv#$-Ip;McWkXO>}`si;8P$PPjRpF4D(GoI45tWm1EF3f1+U1qsH} z*Y<7Wa?TS7CIu8kG#KU+S99-9nvADWQrh5bEZU3p<8wKl5-#C2#aF3I!q14@R0DkU zb8w8&lQnWYGC_^-m$A%M^0dI5Ux#=&s4_$I3Y`N2z($%v?(0gCU*LGy2uIiX{Rn@5 z4wNg(Ym4OaFapjm>Xx!|&g;V+4$k!%_kYU6wemgkV_g4cPK}<#C+s=Ws44>631Tr{ z$J`|^C#or`W*QlQs}o7)D&-^v9idq+C_rG^mfgTxK(g-#Z8Q0UmVl|ucTFf1AYQk5 z{O^Ew+?8OvRd^m_U~x{a>3nBhHPERJxboc1#VLDoPmQL4Z=(Usq_pY z^M&;J8e(UwF!fM9SW}Vk7RLNQVQ0WddkMzl^J16KNO&?34)K~3njIqKB!Jk@X5R?n z4kW7&GOQ7$DsaFJWDC7_z8E{6xRzJEIrrU5=tc-s9{ z3Jl^QC*atM>Edv91}??mxQLE#ivAE8(A8-+xyi|~3BcBf|JiT!3hDYs75%XI4#`O` zEDUT!WXO`xr-0(oUVovOPm!z>Sm304tpqakvg+Rbud2HNJMzUpaMobPn@5Tu=C+?i zdnt2YO~?Mo!qgsbe-Jkb5u+M?m;+EAo; zQK|g&Y9f3$a+LLy+g&gsg0*mKGb$Wct`N>wcLs0;!&xq^Jco?^^{Mz{M$`%JS`{<1 z9R(+i3|#&5PldT~t7o#Hw3H(06vVk%`s!53h+D-JtR>0X`h|FCNeO}$MP2e&=Q2*d zhIznW5;n0PIncUcsa(}PdQ~EwmvT&e~v|G-)lenM^6iZ!s^?|MPSz~#RyPipfk2(mj@k@e+GIZ ztoO_!o~UJXz_j63cX~g_?%4-ZV>idrzy*C5Pbc;SDVp(I8diVu$82~#dC5YoTv9&e z!UuoCNP5i!8@5`$1s)zAHwENpI^b3xe;-EBde`^NlOMbQ|?jjMr6wVNJNJ)7~bgh4Yq zU1c35cVjglAq`~-ti!ef-f}Qo+7(7QhALcIxC0jRt4*xpuf@*aqLe{fkd{h(k=nMq z_bwtr;W~MP^3CSyX>Czjh3bv9%5N20ZbS%{_ty`zf;Z&CfO=+ohn|)AN!=gfnvQYD zG?W{UHcE1_-FeV(zUkOiVEQJq9Z)dc2tavkTbjVQE}!b!&nh?>r_k_ zqj9a6H6q-A9I9XoeqbaSvjXKkJtXF%@%JgavO|Ii1{6~*#Tpb|0yPekgK0uomA4u^ zinSH6>qwYi;Y@}c(75KovI-6JxbN4#)2Q*R6zGMRTr#j^L4(cJ#YKC^mOu}GS&NlV zr^x0V#vM&WBT#4Mb_LZ+T|Oui`7D)muh#<@le=wNw>;Rb9s}IpDqO#1n9)r=hp3O+ zpdg`N6Y7WW*V=?ZO3$i<8*!9=6rLgJ+Uvp`w2@{*f^YRi@ao=vL(r-~1 z!%d!)PJuH^UdQ|_AZrujYMGb0%ODU$^{w6w-d6QcO zxP_b<7{|osMc&p1)R)^o;!ZOT3T3+^&ZJG{DaHo!IPS$Zfjt^lD^S5LF(!p=kg%Ib zWJo;Y&KpJpnNL*8xbE7CGha6Z7YiMIE0x%wQpQqpLrPp}AUS>^BAJUoPwrLIDgy2T z(9|yH#yC=fIa9}y0vL8YNGWaop#W68av&Cp&Bz#IiIFd;?zth!dOM9Mpm5$TT0u%G zJa&+hL1-M>9?|>gaSJO%;Y!g0eVq<})3}Txu z*TujJmvm$G^R-G{P5bi+jw--}>0~bo8pf}OrkBdq79vA=aX+~|Vt8bqWqB~Oa$+si zA{JCwHkTCqW`!e(Ml+7??X25wQN%XnOobcsKj7Y!Ivr?FWzj4>X8llAkcpCP?)7n>GkG?GH#-pev`FBkyGBB zvX^wi8`x;RTSEJ(pX6ELo(=glS&V2grz*;j^@zwRO>k)N6ZJNhYTTVu*brLs@j<)} zOnU(yKGa$rKfW)!j}8|>mwpDZ7>{#R^mcxBpbc-NBg521N^pwjvW$ zj|rnVG$VA1PNSE?k%~da^r_WTh4E-b;Z`lqLgK%ah3Th-dXF#ee_RGB)`f5s?T+rs zm1+XknMyfjO5~V;4~>3SNV(IoHS6f?RCwv1P~eChR{~Atg5)Ne93$0Xj1_ZrVvgaA zp=QH@8s;x!s*B&kWRt!=+M1Z|XdcwGV(sbK4?&{>$YJzjB-@kw7~2foPSZQdNl76488>7?VOJJRg6gzML>i zMQ@CF=a(yVs677G@ztz-I}8qILuO-&d(rFqz_@oLx6T@GGbinT4W=oYfityEqKx*b zoUx|CGNFZX3;3?-IpVs6b_^a$B!kdTL@~WNT~Rks%_dmGxt0F&Ibv#@kx=$pN*Xuw z4r9`aUNE|ANkhw+bk3o%joWd}&L2v7U63^0KDOga?AlL0B@ZrHpoq=#4-VV?wg%|N z*7jR8yl6(Jxh!|BQT*m0z9*J5!je`Gh7Qnc zdx%d|Bl>aJJhqd|apNCK4jF@d5zlO5sL9*Y4c%xR^HchhOU~?Z-Nz85pWZ7pf?%L( zviO&yFoWE{&Ae?QlRp8gmqIQ)wXy#5SuW_D zQE$gOz4LWOE+fg>uEH4D4>xKF65r3h+^4ZsOut)MPo_4H0oc{BRmRx>iRTp4O0|#{LTN+QY|9hAH z86%oLrSpcQaqBW`G73X`SU0(MQ5jCU5syO=ymm6IWzxmN{IQ6~m50+x7NgOS!?J|O zU`A?d1Y(#_MnGP^DqczxP45@2HhWW1@*$f3@aciE;Agf+#O}^lCW{%z(dd}UR1-y& z!PQLIw`PdV$i)I-v6oWu?NvFHNC77E8R>_88KqrKJaysZv;B2`2DS_|Of;i^^RL>Z z+BUW|v3v~s^Ia}bqN_6Js#?Ko^HXmn1mBOp0JA7Hau#Q$q_pjN*W~8zsi+GlN$FJE zg32UD$Pv|V&NXTHj-}G)*Emri2j5AgbC~Av5Y11mzb_ObSjw75v}7BVnpv1&N2Bm_~1CHp6TfyMS zpi@0d?!p&q=PV$18Zi;fC;OxB?;;6Qs?A+5;pqV&K%>Hev8#VMX7^9^za9U8OtXU) zL9hPXZ-PV(2i=ZCQ#>b$!gG)n;a3!^CRdU!ravG?X8B+eyY-OsnU_6 zBhG#}oH&dj;>ASMi-*<%-U<4xE7&{eGc6O=#S`A{BwYNSy>3}L32M!2g4hgX`r=)r zp*fXqRDJzhU3QQc40Uv(*D@g#LO*Gi<`iqMuq%bR&J{)P@V?pe__-G!gUM2 zk7LC9E7ASWdjp)0D^82d2v7QBp=_8r{es2at%u3xE)HNHZhyFcI~FmgS5};H6D4y1 zswvpv${Ks7w8n=?rj32Sy?rj;BgIscSZ0OFEsnZ(@}cTf877Y@bTRGglHVt&!AxSh}@)<&rHq(yb%Z&dazddN+F^8L7UN+vpopWxW^&Y>K@ z!;pw*|6`BUVi<*dHFzI!gWt-0Z`CQMopMLmFNiwoQW66-v+#%AYse;Qzct@nM#IVf zC*3B+yN&ls=3BlW$GSWbE zh5_fh6#wz;DeY6p%3r#PzXYWcyvK)pWHe5qK&>D_@%{nJJF8V!|(d0LDCevtDOhe73v!=Sg|>4ynXZsz;jjf*{|%pF~>KOQVqQgeGeDWAyA zrs*Uogc5om5!=n4t@u#jOy6I(pm-clYqDj7e>{5~_T%9sb8*6W98RZeA9clJMiZ@* zfFBj5t$Xd;w_gh=@9JQCTa7lC-Te+*2!CW(U#R>kOM?-Q7YwlTafT_pC?fB;pfi@J4tT@L>W&j`zYBcOcqT(P$#tgl&uCuJ)7DNoi;sjUvOO zeDN5!D^0tOq{~c0Oa@y%{$yPd!GT#n7C=%V27%MHke`NACB0pM>{)(1f;aV`&K#iz?f5L_w`WMbV1a+j+LYA;~BUlDc6E8k>WaO7fLA{CqX{A^%5yj6J=GWm%N^&ZcR3%vgoj* z<$`!p=Sm4{FGA95&fkuU>@DS*{c978+ggBoE;%iyVqM+(yJBoUdGMp9@F+I1n(V%a zkuaIWkSZh_!YbdLZ{pQmpV`TZ5(47@emFjd7t zdYC6r00?i8!7lAVG{nTfN`*eAT;|l90Dynu{qwMv!Fv92B)_TB!*(N8OA-M+-dy7L zc_xih$Lu+YI&yw-T*`I7(U6jnZ$3(niU`TOKfH7FKTDSoH*qM!`c~*4;?k!7P@q|_ zQ?ih9C+)yp+D4rUS_!Yl?}GBwlS|a&4b~JwKr_tuFO}~vgW|e)nbgr_4AukApn5=B zX_M7e7^#^2^IFrGv3a6j80pl2`&N0NGmzkxE`g}l1V01o^4a*zMpX&rhV`axq5(N6 zys>DT)!(A={Ly!WKZop$O6(ngp{mLity8<}<|zn75w{MBDN$7zV*FtkK>M)Ys{pIp z<24h>MR!%3B`&TtnjNx~O;m-S9Sa|Ul%L@J@iF`qRo-1J)}d6H8AMI)cg?A>6oCHQ z7zxH?7~sG5`J6&YUda+3*^=|a!`V(@o+&&~1WH(aVA&J&smX4WTN_fw+A3P3GZNB^ zz}(rH_c#J(W3kG>0B`~d0m>mZ(6;WzkVZZGGMik9J|SxL$t}j6`98FqgqHQrF~61= zDyX`N$*9*`QdNN(RchK53v~r7Jg(h=Q9L%bc?y~tbt930v^hDfu3jluVJZR-I0?jD zSFgvnc*$bVX%8(gMs7fw3m=-Bjy?ORXUI?|0o*59CWNHK@M|S(3MiRX^IxxQlhT2S zycOsq$oaXc06czw&uQYun5spc7a64>I5Y2fsSs6Yvr9)o$JCMu3@oV+H`&D#fKLHY zLddPYS3%!H5b|;^|Mj?Z5eMy@ato6wS}@&ceI%yya4NVfue;A6Z^lGc0*_nw*;8Z? zwL@5oJArR!eaaaoWN7Uj5kSpbnC?`BSnDTB7fjbKiI#j>?RFW*QlwJzUv7)13M-b; zkiO<0Fk3(D!E>vnpK==ut%r>iw0P>Wt|;j@xn+2N9J)%VROB^*eQIcKpgPMnnZ*|f zB3CK?HkNydwLtMf#|0}H#wP+iF}mj!yrK&0^=2PocHNznKr5-sF1`IJ*@J5d_d@AH ze3wlXxpuoABDS>?H6n#ZdP*RY+nA20D>yiu@djDR<2&Ry+-ZKBp?re%8C+x(%GhRe zJ$0qdnwIYcKPkd)ti$y;7KcE2d3p@N6!<)U@LG3yuM`E!5v)aeYlQo+`gkZ1!?*rw z7H-(Ca2?lHp;OcJycto(KG~y{Z<3*}Di+ai5s{WWz5IE_h2TA}>0Xg4V>CVMy2~>J zoLlY)4qU*|inFIDT?N04{B|PFFO=Dx2%!DkmZ3I3JW)-gAWb9Noe@=_u=`nYwl7{= zE_11}*lf#uLD9P$5OQ}-&U?spm&58c1_++q6R-;0!b?s?K058aNa}47fM!)5A`_p&k zaz|n_9jT3hdx8A0!#p8qUQW9P85C?zxKTDlB_2k@AitA`TM7U-kd)`tDbD6Wfa7m! z4;mckfwI<(|FBDR`juuE9I)g09EkG;W~o#FKseD2^UkO-;bRTD*sf#yMW30n@S@n6 zDMr3Xw9ZF2j8LX0q5B6kat4SRV$j5uA8 zy<=TL-U?Bg>zj|YmeimLl>FT5T3G7WqGqan`fZ#a*gq^IOjQxhJOhN|u@|i>kAuQ^ zIO+c?ysQtO$BikL`5r8_Lxrb5g#*No6~`*XnmlE+mWls5i5TRL1b$-g1O&!TmF@1s zQ5}pqcg%n{8NM-Fv~lL@ZhDxBo{13ZLYXRfF4GvZq?4en3iAaR(v#eZJ3Zjw=6rGC zQB*RgGs!nU&xo)Dz=I-kccu%=F&6qA-4`nMT4Nc!Oxy)A`5EOaXFqEM_Z#WLxxjNj z!BuChhO`hYc)#j{+jpMxx&%Q^Zxf>}2tb)BGp!()TxpjDL!%>0W-us=(Y~6=$-{ED z$4}O!VI!G}9GjYiZ5}Ux{+1 zzbnheG})Zs*zaqbgBrgTj5TDKG_tBP{<7L}9tCS!EJs`Fi}X2>F5GVdGBtc3=1;!J zH1-JV!bbEq!YYe>5)fI7Fz8!kpEJ)reO+2sY{0bM|8)90GP1hu@(x=fasHDe&9B64 zgE9$@Hhx4H0TUP7`qH$B+|qrxd|CJl8_MhWG4)C1ieC%e@DHOAE{K2Dj{D*OJJjpf zrV?7R#Z1KSgM))VMuO_Wcq15H(kqwzNiIfOh`RC2AfEy9QHqo1Um198l|Bz~7kzxj zpM9mtEQ)-v##Zny`Y*t%RZ`);G^`PdxSJrjw@BK$DS6tVbr!_tl>pj~NfaRx8%y*< zUv<(h%hPL2=i7h$nfGTqN~uw;gbV+A*(sW*a%^OI8OGEehF)ep@cU#OxFQHPg z6v>P1Y3+&+JCzlcXvK|rX=mdR}iVvY)|CE35t4iTQB!BZJ$Pp1P@;?}rd)T*cy zUW{8_)B{)BNomfJ5c{&rO#hHHBwE+z0U}~#c^!{H>A_U^!rNHg4%$==d^5@jL+{By z1i>(Y0+Uz6#k5uMI(I_X;Dty?xxLgcKz-{~x1ZWn$hapb0<53;%2hc+8(qFnI2XJ= zBH{h&UV(kW&cvA5q=LzAv)QuF=};h>HBi%A=tMlh>j90e>UBC;RwxVzbdKk&A4na8 zpwOZ>@$?!p0!GL>M<8+DWwoDS-&CazIOWfyY?n9D@XbTBT|-fT>|KJin6xM^G|?<( zIH5E#p+oMN*=(2WCQ%x-!{+M!%ARx;y%!E-Yf$iCqQ8y&X~99ddCyG@4OW89`04IZZAKY zRh`l7nQ)-JQ(i~9Q(iX(ShsHt103(3V55IpYv_NiOS9`1K6XO7S?%+Rr*t14r+qTv z3yW3zgforV^2fC1Bd+AXJdC4kZ7-ihS zc*?dNKkf6n1|jOxYeR|C-mU-h(oX<&1*`oC$3c)hCKe4RN6`f_mxG*&>}ggb81E?@ zu;X|_I{fzxJB{H_o@>K3A&XlQUr?s1D@ zSr8VpJlOUl!GRCt#1d6DB4)rbe|>v`b#xYy7rf*t>0WrN>EQNU-!0!@h=nrnu%po* zTuq{jVgqUINzC!rTk3eCpU@`D)%?jD&jQep9;Z%v=4b~6y$ek?ec;7C6yPB&Bm_;G zU9c8R<#Ph*l#4nN?pW&zq`*NdBDvoSp^ujU3nJQ<%Q`0jWC?e{ci4~6V`9+E43z)& zxkwwLrV&HUqWhmI_&R3}W6xU15X~Tqjy&~iGuyi8pBv=jT8PfE%v!kvHF4fT-*+wg zo;jwG_Mt88x7@AA8fA=7`-V-Tp|R13+Wyp~Dqt>x*#Hbm8O3Ht;}JK-c~1^eb^EUT z4Sx&9@iG5lDvdeYwT{cLt9!u#vw08jI6CtyjY#D69Cuyo57r~O>Sw{-zoC6k*a>;> zC(GvYi#F3vYdN$^?@931D1f@gySr?BT{4SeU@WQR7F|~)+IJ_+{gLBFg5*9Pz4KPm z*Gc-Vzg?J)O-eHws2{;DKXzvQ zb_j?Q>`1!4I7Rah|4406G_n0hp~vcaQ1M=%o#TgVTg+5iHyU* z*B49jtLLXIfEqe`oeuQ=`q#4S$r&?>96+X|H&apZ=*85gn7&>6UIu z4S>W@9(9s25Tz>BRJZX>-ygCh|I%oKeeuj^e0_atc5@A-M_74=g(y{-1!a`1Us!?pp2W}@w(?ud(*)T z8EQHR{ZA6hfPhL&)hwcaL;uo|bP8tOY$D*1VR(F|1ZXl@3BE1!I?Jzt$NU~Qk+97f zRCoW6v9k(`H~6Cl9}ZoyrGySr!3r1t{9|DTl0Y}OIy?Y* zeiUI!9IiEgpL z#`Qfr20rp4jBq6qK2Pev+w1--Tw{gUheFgaWK;U!OX)P?3?Z_AOyU-um|n0nBBP6u}TStXQ#QkY<_DN9<3*%bj#1@&@= z@nLLp7~x!q@v%_OU_6~@>`Q>c$jF`R2Db`(fSVCjOKy{Hu7z0V_6vu~@UaX^ zirZZdFAqDX5p|YG%ZM#_6=9p_~U~A@p zJ74zWYb}qO;J>m$@JM$#vr{d9PF8EJkuJRK-v;&L#a9w66oi~0o1AF;!vrUCv*cx$ z+*J~_hY@~Oadiw}=y+9Qk?zVGK{A>_qrmU^h>p;FDT3#XM^9{}IxI@0x z%|;^k(n<)`)hK?}p0XoakAKAI)sMd@sV8Yl+Dbi^ z0E%QOK@pBHR=9#Y>a1TwHD6{UTr6ciexuofwmbcB_aXIZW@)vwOe=TP&2?LgAnz+q zJ_f`#&NKWYnuErtadytzC9wDWg}W(%Gi*6#t4gOuDm~sjI|C2an@2v)=zY(o|5rEu zC6{f2fD8zD|Hy2`x2}6zWb|oUG@yuo?jw-Hh?{!{F;6f}g;I~_*7nW4I?S)f>?Mb; z>$NDNA&QJ*z8=vOi5QobgWYCizM2!Bhok>dG0MTNCj?F=Pw1=N02HO^wo;JmVh45^ zW4)M?gl<>QEYm=OAS)Q^?=k)9B}HW`IxeMN)RKWq@D?ij-#w7sSm^U6X4r*T?!!+c zXV3&uCz8D#VtZcfj8RbA^;MdusV>QhUXW+_{c{uKDTU<%eFn~Y@2-_l$0YhRvklJeiGMHd-o){5YN5_ZK$12g za_PEfZi@c4ehmd{!fi=!+GIXIky%Hp{upHv*>LzF!enQo`K+`-By)FJkkydWZz+f0&=O#_Mdst{-$)-7%-TRhE`+ix0{tp;8JIP!V1|;4Xm)&zmI1l z;LZC{qREVYkDv5{PmYhxjP@A|Dl70l1c^M3B|G(j29EryPy>s^`W%UKm#s;4C9o#a z*(RLRP)PqSTmMa$8^Xmze5tESL=!n6B4%`U`mUJ^SkgwCKRN5?SZ^080{&)W?X3&O z`+@H8mooW|SPLv0ug(Vl*;C~U!@jqf-6;0whd#mY6qBf4-Cz4gk&e>xrCHa$xWHsZ z82xjVwY1T%f;a!P%i=o1heI$r@1|#rHigQKh|t-^^5#YQnDbD~s==5WO4@moPle<= z6&&vW=nGgtR?Jo9g4
    adyc#8ewybYJPt?1j}2}3k2y3bpD7<`mmDTm47Rv~LA|*##n%@3fe$)A zK3vjSwwSq@{B_b{ujTIBYso)l^UPqjSLLsP@^?#mbV-7)kva&Uci4lz8gO`;y8B~e z#mJ`vNn1=4yGE^|eMOQQ1+N3=(zM?&zXv^T~N&3!q>Q|vtO z-^D{G&kE79ekRJ!=;;Y-3|D%YUWz~WRWdLY|LgJEzv&0U_wm9t_u60=FJIYCBErH9 z>J_CJCFe3$VJ2P5f$IZNlmLZWRq-aR+05nb*SSlVqKKdF<^XphD{V{x368h)SzA^4 zD$Lo8B-((?%H4s z@L;)!t153HIEiLf`o0bsY4dPuu z#dZP&4+N-w9eRcD4f*ocNh-i%`jF{_n~M^@k`;$%|Bl<<{P#*dOWZ6T^Ko=^;JPMV z58Qogrr(BkvqVNn*bnTq6Omb*q5jIPQ$`fhGQW#`z0IxP4<*D@7-Aar1kX= z>YW!EkEw$?51PIi1tc|=w2-kLEAgy6E|zJIak8O)bN}J$2w;Zj1VkE#IZchW0qDl9 zjG8snaSpy4i+0wSQx*E6avOw-LyG;6R6HAV5$rCFAEv>VefW{wU!rV?CtyfJTa1q@ znqQ7)#! z=eGIK5~7ZJUj(k6221S9dOT-hY90VfUdV+KmX0!oH0B}D7+Y?CFZGWm8(Njvghd$kW7HN-vZv52?aTGwCF`oO>3-HA*&G4w`-5AY`b_`*iu0j79o} zWSsoOppy${JS}VPR74><<4kNO|1s0{Zt#0EpCsl@;f$M56JNd4jF=1a-_Rq}4A%KB zHw9xpRC#Emvm?I>Ql$7y+k54Sd8Q&(L0_~n-ANB1)A$TQShU+ElM$992rqjy8Pl%j5+E`R+kzJ zC8n#vO0zFZ!!#4KQh}Vm^A~nFdhy-BEV&|L_@g=yNjZTIc%>{KkO=;ylhfU>HPM^G z?oQcK9e_<@AS@oA2{P?(mRY*QAiQ+TtW6tV_xnId0Plu^C7Q@6;WFj$1AB<2Q<{10 zqvLvDqUj%FhWl?d2K8`cG_dGl^z`D#-Q{CJ=%GVhV2LBFVYXH&awkHqM7~cRUds#x zpY9y=;$g=ZW!g)slEs4kE-Hg_rF?tp3?a36E?4x17P;e}0yv(=*VkLta|}o zNk+5#W68=(YSZoxzh!5gx^oVk!K^I7jCFhSfv~D7T_{tqj+IeKCw^O9>o{BPh zx44jf*lNjFtmdmBYHAK62)h4I3-Q*w3-8mTRj$rQv})eJ;CiGZyG5#GCGa&HNx`sA zcO0Tpi?0G+1c^wxwxOYTIl-X%!nA)_9{c;@CITmzY$RW0`+H=lIN)+gNV;lGqK>DH zB@R+W9)aGz!*VjHHfeitK3gmu2?T{1ZPa^%G?R!6P3R=n366J+R4-W3SRI%CeBl8x zBAj(;{zbx4>~rLGfDztyqhoDjkBfYvJe(%)5rCK1ADKvfr0QSnTUI*2+xrd}tV%gx zI6hSdwHNQXNFtcqStxdIv*E_+)u*OTWt*&aBZYFF|C`WbwRXOsc_2=M2}0}Iay3E1 zFvZ<3;{K%<OU!jh`RO(`)H7IEZI``)Ksrhz_IQYer()xYd8$jHM!wfTf_ypTP%lvhGrAu<%>wQ24Wm~m#^~A zWJ}heb4fdX9T>R8&R?vnCLb}n{3GHds2~r}E$axNpr``(QYeGY90^!UUto#9G19{K zDnJ0vORW$Q^h@{CSJ$fr!O*ie{@gFsJO~PySmvyF=@e(rW1;1>W4^y#utO+#_Y%}mME<0=2pa^QZ1+jwZAnEehyh2lBdIfJ? zrz@L<)<~CX)L57j*#lv0QJ%JQ^+eRYOu8^gZE10pC#SrVP-o!ivPmn$57Fv10A>`I z)0u_O>yiYMHsHgl4Wu#}@WY%VTge5rX}J8T|GwI#bf4Euy*@*uKn{s-itE>}1pyKr zNoS|O-VfV}R;z2)>p}XR)4G3`#ATh__r~yg*U-h60I0UVdh!=^Z@~U>7~?x^UR}UR z$=4&3)vASixtn*ULLr5IyL=kpvH1RxP$k%6vSzI#_=H zWj+S1>9NW`{M-@IZrO!rUiVQK8F{F)n5P$*2%Q~T%N<|!lgT_nDQ!N!8>)GNhdx{{ z;zCj-P8-%?+~Y&GC&Yo*M5-8ze{)QsdJrQf@Rg^Fu+4f}9a3>+hk>?&932|Ugn^3< z3tV5+H{?VTv(8afESG> zRxxNt9@Lp2wd-u`6~{xK}!8q!H>qkVExQO}q1^`;0xFVo2%Wf%DaQ4G3`3JX!Y-@O5r zl_rxUQx$dX5G>NA2oyX~JwMIbSF(C=Jwm)!WD?uIbo*J0lV7vm(+rPpIn_yosM?aW zi-fTJU@cSInhwr+wT3mZXwP(5jb|&-NYL$}HoEUCxhIEmaLtu;wa?Ha)?EoBtZ59kr`<)h4V1 zmEmx6eIA#t?;|AerWzuDHT$XXp*C|&JFdKyM5Rb_M2=v@{uB1(>pA-zZzFZMpcigy zJ0H@)bWrb2fRZ?zB^j~2K{e)FI5W^6vuh-`x@QA{Ef>+0uS4ys0@-EnMg3X44%f zv?M?Ggd@N}v8cNua=WrntFUdnZMgj5gCsF}!OghZw#VwL3Wpc^ebzXBB3HAzRa;Q6 zxHnEWnGOjB`6snx2-ZGVfKqbDC50XZgUt{&_7M~)YQyFv@`jie>NntCJ|@&J)i2v^ zSAN(hs#flBC{%wk0cF=synCf%8bFJlNa@k|I%HdqO0EIEH5sXZweeuZc+x|yi zML3hD=+YsrZ7tN{M*h-qT|Wya)tdwXa^1UFI0%|1>SA(P>2Z%>L~mz0$hZ$?xZ+t2VIF@!ujQ%)% zHhSY8h12i2=HfzA+Yk_7#L}g+-mu-fqJTWED#ara2$XJ&oDO4(HrM8|)VaDvN~!*A zr8uY-m6nV>oTbB*{cYgqV2%MS?ia#(i^yK6v(#%|vSIM#_21xHaBC=aq`UFc#7g4v zbh#f%2()YBWYUG=EJ?`oO~X^IYcQ&nSH^|NFcgM0gcwbh26XCIf9%np^jxKO&bgW5l{2YBSQ(aeJncdyKgbQ28O{W}nG4De%M zYKyRWm#N3`cBAPGwS5nXz<*=RIV-hMFtXstT5b=D>Bj%@!Bq7!hQjv+{ze|exOXBk zz^P1^Vk7W?37P&vBF}aUsRUR1(MM}Y7gaySO7Zz4IUJ98$JlwxJy&J6($ds&!bqC_ z8U)2opC8&YjQtl|m`vVJ>b#vGQ%_MM^bHhDHaLT>`EK701+iAsf4k3B(mi>b8YAQ8 z5%-9ugpVS=FY$^7{$fH;72H)(jh6jrR{DdzkZ z4~k2xSBUK9>-1xS<2;}2N6Q`Xbn0b*<6!a; zZ>{u~228y(iepL|??c$-1DvU}b}{O6CA~y# z9s^U*+iNEaV4Z&bH4V0qf=7IKgXaoAfN;Hnblr5t)hQ}dQ|Nlj09|Iq1Swp1Pm~c7 z4}N}Mh?$N4`=+0fjF*8#mmpB1vl$6j|EZx`0P!L)%0*rILDeWndO7?rBI2H8b>|ls zF5cHpqzWADSD5O_kix?r8yJ{6@u{N4?|SiwQ;2qw);}ke27HP>cDnF0Nb=HAGa}~y z_lXmd3CG$fq(U<>P63u#trpO;pm>P0a^?GWXh0wJz?2qJ!MYc53IP+l065`-OqF)2 zBPtY2U?jxoep*dNx(ukv6=1X~pj{XBsE?C9cZHYH?*jvI@xEWC|Av5&6^=V z2AALbz8(J*z(VN3Q3e8T519{iMc$HFu_tJl{_CFy|xGOey{ z#0nIkiLTMM>Axwre!KCAa6{bddaY|JJDW6j(c#>iW~=>9Q8)(SmjF%ls02Q^z7@Xm zeTmZJNZm00Rp8tSok+WpjK8hP!D@TDcr*V?U?>JNvr;>779A3P&+()-y&Cgg$72B5};)uMF%-x&Me||*&Z7@T06m|`#h^$$McjGnJgln=e06_cdVjt?;t2dT?`>~Wb>aZf zedGgE0df!=nXT9T83|0q%;6X+^<)Q@Vh*1ewQNeh&+XCBd9JXp>e))O_3hE$E8X|w z?5ek(p_5Bvx)~q~96S$!K~l}+FhBTP@%c)(+fSKRGf*0vQ8N~mM8NDp3Y%7u*ynmL z4v++f^dx}14D9UekUP0&Aa0x4 zC=T=C59>IiNWg(`#*+y%1@4b!(g(gDt2*f&=ZJ zso@%Cc?~<3FP$%o;D9;Ii3k}|F}lb&W>F%#i7UJ-B=`dFI!oml+$uWbkOv^Nz$A&* za*zzk$`cp&Eo*cArX9o;hFkEg-GSzlZ23s|vv6&xjwgrapdznf z??;}He+25ux>9ch3Kbd}nl;*~w%qLtV<+6hlUn@ECjbe%uu?~c0qBO>=A5o>?`Vhw zeb2xF1o#Y`K8$DTY}CdV$k;(|rR=6O(BF(mu&? zI{Xtz2P6#1hv5kq6Tg^g%a<1@I_Ww2dS4qNZ_REYKDSq%zXY{mOd;IVs1Nr6W*8yI zLKYx+Ud0dVZ>QQ(WY2wGP>HbhzYwT7MMk!zvB5%&+mU&@ooRE=OktP_q5)sX_R$hL z2StuI4*r;jRwLyHkx%j^&|YBFBbBPGcb@pdH(7&?&=pQsqq0&*f*nu+Vu#LBKi1Ix zYK8K8HEg1yq;}TYQ`WlZMcs-RJ~Y{7^S+2D+QYfX@c<;V;aLt4pTYT9WkgEcewBEH zss~PEn(WFK-5Pn?JD!FV-K(<_ZT@#^cQ1+-#q^eso;6#A+EAv~<)rbR2=cE)ZSd(7 zDS8V?>{z?Fy)Io@M&K_N-T4Nd1dN;B0TPo0_ zG|*#es|s)ziwtkj(W*k{d_QLM{rs>j@%j*;fB~ZnOdJX@W_xVH-;ja-*AmQ?no){T z9O;Gco1f;VFkMS%TOzVUe|6>m0Zcij;J3a2`;4JBRO?U(hyhzaD1m;$zfVrOO!eM( zX8GSc=U;69*BCuOgi(9%1#7nFs4V!s*>Cx{nvBo1C(|tdiu67fG;J-CBA`V{G~gVv zUm)RXZtseTb?@w+N-G(9Ph$1%KiVo?U0$a@ft{SHi)I3|q0lW(ZE*_CsdSR%P8L*X zW|jB4WYS0`L;|-zISPx)=t{!n%dd6lbUr@9WfVJ(PHE)z~uE!{vF2$KR!MHLO(3q@fw`e-@lZlmvc&=k;jf#hXjvY0Py|Qc6+qV zy6x4G&H93j(yd(86at`OrvYdxa4|7sBy}fP1=3~ z&pb2VCKoxU389__la-#3M+aG!e#xm5@bT1CeSj5Wn0RB`{Qa2@2nZ3`VSsrQa4iT& zc|Se#-JG?fy|`{M0KQ6j2Np$a*2X%vKWd-PlB=q?`{H-$Vn@@MLA;-7U7TIeKU$1+ zZnp>|r&4EU!1hNR8|hu{w3yRL{Andu)_c_6iR=WUmp0WjlH&5E@_PjCereG+u=zM%}=eRRdpnU!2kRx8RU#X-&mJiRAVthBeZw6pAhYS zO7PO|qmx40;OqCZ(>0^TgmiMTTk-1eY8D;Yl9UqGpNT^KQ*AnNtv?w8emfaDJsQsS>)=X^Xo7Wv7XHWg81!nbx{i6@3n~);mCh2c=0X` zUpTVld3%Tfm*Nev;g%;U0GmM(O z{g~W20cSC+8Np}_alhGxi&Jh`cg1BoMta0+`i+ed4wr>)7Ov4@Nu5<5t7Vo)=n}&_ zE1|e;k#j1fqhZlSTk>gq1w8^KB9pp7@HA^RSwKlg>i9l~LJ(JkOzZ5%R$Xn0f7L3>XtpHdWN`b1q zT3mqZ;X`rj&gL%FwIlHMU*xT~e>&4jpo#?m=+h#YAClK zh;fF z3Wgn9{c~=TWpu0v_m9c)UyV)Oev|FY56j8I2Ge*g3?{w@U+8C$Yv`n3Y;k^KtG#su$t2&#StGOA+Odi|7+r$)37D!(Ve)T+GHdP{17XChBLOl&Q8 z%jPIYmtwUQPX~VHpK&%R_g+0($(LsNt!u7ro(^Cp)tE>!TBJa1(U1V)A&WK2`dq&W zbP2lMuDg*i8l|-dyKedHUh`(-uX`QgKad=N1REs>JbqC0RNg8*uQ@YX9k2=lIY)e| zETf+x&=nt0()DUi%B3>e@9$FYn=HicXJ-t<2sW%@Y6DI}0oT`b3j#^m%pZ-U*FU?h z>J?@zM_Ltp-jDx2`M%B8w7_$wV7ZgkdeKtH?o+z+z+N@%=m7pz*N~P}voU0pse(*3 znu3PyWwrTFog=LPx>Dlr7xU7e?s8#`4XCrHYcssFL79|#8R%z)xQ@jhE3o+}XquF1 zD7F+mc4I%2S6Dm0D6bDg`k2fwaaC(*Xd6a&Jbx~uldk*UkL1~dx2EvFSsMt(9~%>8 z?=qx!k<3aoOqWzQro1WfyYfked>Q9Z@gH>?DFc?BL#k5bdce$(qA2KMX&tZ-`(}=` zJwKHjxn>(YFlr3gc<=YSuj_3F*lmQYNP#kK#K~#pB11h+OriZ)LCV)m=l2YV!?ePB zmjUOjwLP1>HdBEPL}~OU}TS1VhDR&%Ctb>JQv_MRRbMdc?(5pPj!cubG^d4&H{? z>C+g=;n*kgsxj1fq}%b!S1d5-|MsAb+Y#ulvPS%^3Kde{X1{<4JIN{*{JKNRi_1tV zXVqsYy{lg=pim4BG#pOmX6|#1A<>}${WON(9fKR60T>9>3GebJ(N}&2Kt-ERgL9>J zNlb69*svX@QSbfc-FU~M3XnamW?qqIf5-+5XH(EW5-rhD%IE@@>wl(WA0Ki?*i|8! z`Or0EMOv@uFHG1tb%}^tTuyPDQ%|L~(_f?}416cQ#hI3=ZdOv>kUN=)#PT;Mw==&r z8kgY7-|^((qK%TWd?b&8BizdcoRLRFUzC5gB`);Othhh%(Es71tG!I-ik*ew8x@JmJPe1W#j-vBn7?ujzh$RYvEgl z9dBPSe=n%m4J2Hr3S1B$g$4AGjHdTc$Cxcn(|qNs&>l2B!_?#$M$*Zs-3wZgJ1A*r zs@b(fTv1br-;4Zj&Pu*kSQh2-9Lt0R0}YkYK!pUwwsSe+shr6&Gq~N(3zR4llBi>; zdXNao^-Kg>#pgPT#tsjDN|W@%QtBo8MzMLZskFJe+_!Mm zIZ6NlK_X*k^HC8^Rg@Ft7m$Z;unC_JdtlwWTlhiU7>0;KXvZcewIu3+7nFpHjSN*J z^SK^lN1qhqor(z#JD*|Bp-m%kd?SyGkeon>pfHG_e8lY_1Tx%sh-Y2TA@SdZ-x}t^ zp4g&rzL3ls4N?*UeCijGM&{EU4lqcTAa)6-OHDJ)IK1w=_54e@VO$&vJ*K&zm8$QxZr8w-|Jlyu`c~WriGK6r>*s6f&RIDllTL#s!?`^4r&)_?m0W7zQP`{&VzF4U*F1Q)Hb~8!O^rOMsGH(D zlE271>(w@OCGKcys9O01NdxKUtio-t+>STRz>=*fCEyD;#Sw(0(E0pkHPxX4Hwn?N zl%u8iy^Tr$%5NwfhsP^zV-fsFu`;O%5o|c8X=O>*webr-dyuLYo>j@OUgWvuTWFDD zj-ei&rOMoGTL%o`M9i0M(`W4se0)bQP%m>1bAy)T!rWop0GzfhY`SWuT?Q7yhsx#< zm{3sI@1Kf0LpmJ;aAe+d6NaV^t6A!4{P@scz}bdeMa_C}QGy1GoukFR~?RQXD5ZT3`d$rOuWzgQ`&@+pR244ytkyCn&!ST~t)!3QT?jEYpN z6ezhQakOo5R6ZW#zqFjvQ7fI$bkmdnt_~_DoZF4cM@M4R^~S>wf92tVt28aNK)|ae z+)V51lF|+4W8a6nan$^}Oxbvn6(SOr?Y!94Qu~_->GHCY<$)?>5B4(~=$$@DP#dcrwbpBc!-WL034 z_B4F-J7DnB&olN(bcBLD#*ezUk&jtJ&8^ko_AITFXdfxR->oexL2g%D2V1BRI7mVc zVg-BXR zb)7Pf>3=^Ec31D<2e-siMU*;}mswJ^#5{`Fv$Gk)+cVlYaiZw@j|aCqY_Pe)Gf%ag znEqfQuXXTR8uyke;hs$VI+ELcZ^>V${xBb&RZ?|Jf4Ri7&>(Jjx}Ely`B(}S5~uGR zGOnZW$9)IUz9LDPI*P>|n zN&~5MI2%cJhZBWjl|wy3PjlZ5By&n9U?N)g0uoo>5%P6!fQjHK&IW-#J%|KlK2G+u zvqV!*CK~BNDUKBeK|TS-ZEGP%WE|y!W}^__i1zq{*z2elfs%wbJQ<_&nN>V;Vm+-{ ztQ}b(F*{C-lXr|jA5FRjbp`HPoD^e-IA#0f7LGDy<4AwP-jG2FR=|0e^rg*(7Rj$F zPmJopC}_Y%PDTRnMIphkgB$)Vu)7mpDE!wz6H{eBCZgy4pZd^&%~}j*b06c6=diVQ zFs2|)LMu#Um%cL16oF{mSaTL|8N>#&3Jl%;jL#fiF(-#O%38kX=uG~Gm{mTBi@6Mq z%6t^@D{l<$Goq>Ny+hcokv~z-SaPJ`Fvm|<1x=9=q`ZHG!6gZXO#3D{x*gd>hFuht z{hd<$;!)2xBRq5UHMmSf8gv;_kYX++av!4^?+XD9;nY zbdiUD(KJ!8C`NKsZjqnr-A0V7;9tHfq}*mz`?~4 zSP5Qlznbs|T!OtR+1yGgWIYQD)NnL`_lLSV?e|I0;p#h{1!LP!B8Kka)A^^4@=2p z&6Q!T3EC6jJ>h5kS_yD+3x`)Uqqm!fDZNIk<~Hv<&5ltZI5oalY|D$&>7RbDKOW?- zc@?40LvS(#NGoK9fHKo9`ti!Yu0=WiX2?8Kw$=uUp83AmxA@g{f2b zEAE((QJtL=&Q10aG2lrf=vMnX*un;&T^7p|e`d;Xgc&3>#cqQYLY!gqRn#vdN_Ur~5@N5* zw6wmJbZcE*Um@2;&0!n8!sD_9pk$C$!m#OSefSL*5_A~XnfUC)T;M9Ub$2EAqD2lXot~$*NRmZ;wn7t={3}l&QzlHSn!wM zP*<=fN$r&Xh5o%YQo7}WVIZrI9&k37SFLb&AOai>KNp!m*h9lfquiS6IDD$zeoB5HrRk0p}m{ZM00+Do|LM@Fuo-{1fO=Zd+ba`%FEA$AQ_N#&F9=8mCGy_9PcMVN?8(asTDX-4)bT_`LWt`G zDtUGNQ-EjDm)ZD+FQN6*?eQMtX1F)|$6fBwZQa%t%+M^-SqvLH$PctTU!_e~kKc(e z2+;cq9V*E`{G3%f3cu@ip}Y{K3$u~~wT&$l%pRK~&tjO9EH-kuJ8GpReI`P_q}eHY<7elTXzDdiHccEiw1c@(hcmJMWbFMmT7Cf zz<{6>vFD|@oL@qlG1!E-P=g|*cee+ksqZ&M=LDe-tH+XG?U;b`9xViRi(vY|%H>q> zTc-s&2TuTD6zA~>B^-#BL-+8>eF(z8dcB_LLFlAdGI|!UOO3`0J|po*=@YaQLIIB-U$aDPk=fwu z^VZhT8%xaLl`~e`V~8!~&TOtuYkoY9dX-#0GMDH)bi1Gi z3*hWp1^A8h*tCz-mUy6PD3eEliSorJCs!ci%oS1Uxod1moOvZ=pmi3euQ0000i9M4 zF*_~@zK;KSv}+HiuQ=*>@QH%aeHB=ZP)HUW8W;X{oRY$CxiRMZOIZYJm$1i7uT-br z7kb16P^)!YY0wu)X^5nfN!qURcxr|=d_V9;_Z-y&krD9StH`&eRNNlNr#-eNnw zH)WIZW_aiMZ#*vY=KbT;HN#i77v9&~%uBnxu43-qtyS~-Yi-q@E*TFYOc3Oeqb`Cv-dI%P z5!X@Se*p3-RkXQ&2S;Lw`B!`?R?k9?`%Z%}Gb4e;D z790KJeoqYgc(8jaVL--}{+(?7T&s}nFGE)5>wEnnXVerm7bg#rO+v` z7#l+_Kj-Omm#l(T4k!~tnXLhJt6yJ;kD|T=YF~>i$*}u3#U{sfEIC z{z&p#@eq!-sZvMMR@Z@bG&8sJ5e!|TyRslJx8l@eGtQamK>0YYB`cmV4ppw!Se(5rKQHHmzY6s&FPUgwxT)T9^sfk zTh%Yc+&HLB>?sPhQkSMl^58DJIX>xwOQ9LU>cL{2<*fPDdD2}~I$HN&g$5l;u?%)( z%hhdrB+IZHw2b-A$!)D0tz!wc3HQM-A)ifDlmsT?gAiC z#o|#xsQydCY0L+EDZ=`yKh`YcQ^>9@4S(cNkziMnzbQd=QTAa}*@=?vmR+2pfA7a# zc;)1^z8z1lzspl|q3p_4LFvX{2NJd7k&3Z|3jJ{-K9+*4is}t$p8D zkk}nwCkxg^l4FiwxU^Z`7G#Z%_KYqc_=UcLS&;CFPl>qri^QbZ2pU+uYvQhc?fSZ) zUe(LRdu!`3fMAQsk&}~#R(5ZvO~)8^der&DNPUOHv-BmtZ2ydM0zWm3H^duuQfn3H z*gcUm(>KQA>5% z1G~EBdCv#I(DLcrwNGo_Pj#?S2O6jtqjha)ud^N4Z6)p)XUb=X$3-j@PZ!-)l9D=d zz4h2GpBYYami2K!vr{c1{fJ4u;f=QxVW;YI)8?d%6(%gG%8z2N&~mR!lCDVob&~9a z?aD+GM<2T0HC7tw@X8Hz)@}BY_@S8%)nYW(-E)KJ)D14yZvaFX3H!TR?YGdH*XW;# z(OtsgLHXq!z%#=RDXcU*07Ww7ID%Maqx~{7DS8QZGnlx zH#g8qis=Srl9Q#5WqT~maa#<>YpqB)IqjW&C^v*g?6x z#a^+YG9bt*PD#K#XKEmg>8A*ddvP#F+};gXu*KE2?zz}@6=*owMZt^N?5xb*JDS;N zO~B5xH#$FTbK?6Yp&?Mi?;GbfRHpoW1xpIxFd6ksR4w~wkVJbVuLc8Y-NT*BZp~^p z2P6UxTpRl8%2?VwZtV(7X`4HOX>?N*u>7pNb>L=1j`GCw_1xn%AS8QaQ2n-bz%_Xz zv3ko|4mks90JUn?4`wob@+$_O?NaR<4j2L)#^I@_Njxpvo_z%~9#5s)dZw7<@>$6Bzww<5p3Ysze z%-SRXUBF9Li?ae(SMQ`k-BSe^IvoboLa_>R z;qfFODo=xg~eYCjhq1o5!*%1*5|uq zDbX8ied!cblQzClUs7FxuTdWrSfC|JRS*I*Rd^S5IDW>` zQ$DE21i($7xAhhd0X9NqQ7)mpS^}N|{33lT5~!q!wC@cV5h~*vDYz-tg38K9Y-NTI zmwqxybqfW;XEKZ1E$Tw)8Ed}b`FE{h$}*K2FR6or=rNedKqI^=@};Vpn1%BElNO4_ zF*xjD+(6b>WgVkG>f5TRg^6uNTV}s{#8O}A6>56@`zFET89;RL$yEq>V6EY)`rFR# z?pScIRwzZt7iMbDokCMZ|s{ZHnb|$KI%LYGP_K}nh zon@mlxo2tm#B>Z;QA!Db55?AJ;<5(_w}_{(kqsSc385z?s+A{u_D@%J+-fzOA$ z?tpT^sgr&_8jzw+f;*!BRu~c@6mqSM#;aL%rrxx#;iJnW0#gLKV#ngT92{BG!eqNPyjqAzig;?g6r;c*vi9a&hna^vOJXOl zjbjhpN(%6gDfMF+Ko&p#wzLN;k>&bnLUEa{@gGx(I75Ht0W!5b$9IZsekM>ZjRm^t z&Zeav?2^nsn(_eF-Q;SiRC;v6$B;NeKPb`%`>oNm2bn+I-k z%omEjGU~dm@RKHLZ?^7(R!6h*shVM^(gw^mD<{PG6Uc;MeuMc;+&2YRGU!uzOK&jg zMd!n4oLq~sTBng5#reB!0sC$$zY_U`3bV>BSkEFAuolXE`iX$EA)X|)a8oVvW`oYv z-qy!~zs*H}ki?KtnOGC|XV1H zD{@)nK;qD+zDQoqTZg0D6ztSbsaH#gyfw1Ii@#uovQ=lPlpN{uNnX6mL6Fuy@_`}% zcG)CfXe~(kNJnF#f-1+K)m?U`$BW*WJ(`(9HZ$b5pelE}BM*C#q3B-)OXK}i-dS4PX7`=R`;jU3N+`YRoPqa&nU2<-y75j-?-sd$bORR zslep2qG7M{HfG*sM>k~B!yqGz=S!PH&n+4Wn&3=W2_m0!Ddrs*xM2k<&j4NAzI zaWp3ABFMR*i}=2SK21h#ZZ&R`{g%w_XXj;8Xl#XE!E}$x~U0|5#y_7yVRjJ^(oB}Ja4V^4z95( z48?j4YPSiJM^b~-Y2Q=8>`tEyxa}=ThCGTN<5(5xtS7K2VGSKmT{R~<0tg8y;vl?G zaqA^r3U>Af_12l_$z52gSw82EeCMOXT5C@3tdiu*=yPfQ8ddDfwD8j}{dyFP2*Zz?8bog-n)9mU%s?zEfp&C9`#RIyzt(+{`@2d6nUGM z?9<*Jj*Si5Kv{RQ4gif*3!|@}9A%lTsV2P9>1|@@2j^!kcoPMG516^+F8e@J`^L?r z$MZZZmg*3bf40McgJ`C>YO^XF@X;QUqF4UTE4|r-Jrs^`^b+>`5jkay8P+70Bx^l0 zk?y^ma7ksUaRd)X5v}gwn#HBf(&wGTEP4w4{CCshrk%HJHWV-81ac_?H0%__9v zv6VC+Xjlp7`$#RSqF5+xragF*>@9!5I;*%-X+-^t!67OGw`p3{ID4&7ZPUl0nmsC^ zn1tp&9iNBkZ+_6wR(}t8U48~~I0$(GsFg|+%4bbj@)gFeI6ImIbya#*ODn6PmXkOZ zQn}|(m8q);lk>|Z9wpGaGwL%_Ox9yoCouvb-|fFSHwcw?$L|^|)aBylIHY%T>JL_8 zBl6`V`6=-9O1K-$ZDf0K;aoRt`RKG%Bjv?D-g8Z4E>yDeR2QAtmIH|`>r;AJDZ(bA zjw~DWG&b7Zibh|0>$xD!_Ff#*CLL$dACm3@-n$|+m7HJI=Lr-mKR+ZNr4CU?EPMNS zYvfmax7I9O!jeudQx}!jutnq{y@;-;Fut0wHa$;u6wPPy%yC(Rq4!_ibi2KWY%ZH zFhbr?LQoLKJnIZd0j>1N>@gDvGAH`(z9dyFfdu?s@Bk?m-90SRAX=pZnPb`peAD@l z3ufa1>@?dRL4U(si!f5!%q{saEnR<~q;kHk=2acf9LXBa7V7Y~TKw8iHTrqoU0u0c zh7hwZYe`t-nWrNYwl6QsD>q5WK$`qf%k$Z!mH|{C@wlL)Kb=%H_njjZ`6Og@j&g_2 zvs%HU;=m4oRMqhiu?QlXXv2_D2J=SX-tub?G=nVE0SLjsZyA0@dMO(AaX@0z4j&H> zxNGmlxrE*z?8TMQwajkFg!UDaZf_}`*y7=98(qj09yFGE{NNbB%@|8j9r+PZ)l88Bf06yhW-?I^voa7@uq=Z;fnIdEiCvP6d;ndS8s=|AM{iXXqIZS0y(_|JDnBV z2fgnw261TtQa*@3fAqOxH!WFnf2`FBr{9hP9_&Ns#)E*h$x-qM^=Cgsda+DY$u_Hi zd{vOneu%9qr~=h@0QFSrHtoPtp(8DZ;)<6brWN()IahRuxPYR_E54| z4b|Yy7Mfa{-aWvwqM-_Vou-gXexbnIiAUdq<>>lArQ+k42jSuuZ;krAra-2 zA=Go8FPPEvpQ5hF8lHa!=gb^peg)M@hGH!nQju_= z%R(&)5JhABu{`H!Hj#ualyWAF!W=yb@yS2+L8eq$wZBiPJf7sdBG-vCePd;rH#Tb& zw})}nF-UFZ1UPjy0dtqqr%|yNzz7U z;$-i1RCJ`t?;GImFS!=rpd7>vO(;~~nv&QXi=(r)9exxThB~g&?Q6%H#p*I3$Am2_ zloEt~LTf+1U%st7iDyE#2pu>IjK;7J{Y2qaU#!e*p9cdCYadkhKF@B=?Rwm5lWzWK zXCf=OOLqoPPa68o7Z{d%<3QJR+Oh~&rXcTmvcibS-a)f55Dtgu!5UL}WTKSEUkl>l zZf@YI;Gzeq!8Lqe8ku?m)7H#~3qRxFbn@l34ENYTETn<=W*T-U1@`fsFI&^g+BrR; z-3{nj9jpjfsD~fop-~Vf#6b}0IijR7rqMRHHIyY&AIHYN$mRI;M7OjBnR$#jr=Vha zqWHBAUp7Hl0%Rn1>5AM*!*9^pArUZAP^{}dQfOP5la0K>{uf#vyW?4mm}BG%I@7;g zojDQvRG`H5*cBM%`&0Jo_Z=Bj!gpq?EIE3W>{HJGt7qvdz?Nd}fS2=A#5dD3(a+LK zO!!6I@3&^M{yx6F=XOYC{{C(76y`R!y;TMh9^9z@aaa)nyw=2K^nO_kd znS390vVgC)Wp=6?f+A(=s?CJ%c_Mc*#9*&;^FnTooAheHH0UkCD@0@Z#^OjpFtx`p znVTcBvUgToJ&KC)6Eb&*{YG({e}(}*^~LQC?NPm}}rs-U=t zcLI{k`AU!DU-B-2%xZmlR=RgYmXRVvKtYo^rlt=C)J#J_%}mY|ZDM~5_2v9QM`bk` zv3#UE2X3jUux^OX0|k-4QEu4H>jKo&J{}4759>YN`4SHnq(E^7Q>>IN5Yg{kQ$6@< zdH!_UuPy2(!JU3`-{GX(;_{D@+HrN_g(FEHIn$LZT>5}*d%8=^W+PyRge*+=*-`Y3 zh)Ax4GHVe4|NNR+Uf5!4`!|Nj2c#{gkTw`x%o^8A>9q7?KN55X@RYp1#E){NyV}2L_}ns# zk&qf&84JPA_3TLQJ3312j44lcCOR35 z!1nRNxfbmkjUvfBnt>4zlTJR%VP2sSLd$ApK#r{?C&6>+vMfi%(~EkGw2P7t2z<+d zVTiC4XBLOVSL|N1+8HtZoD{Yug?GN#d)1t`49xP>DOYM2*10{Oa^V&5eIJ`f`t zU|r3}cU%M1HgSLN^P{HKs|{}hHcK~I?aC^~zVdDxxd^O-czinCv2GI!E`32k+GoPa z!h1DgXyXde$4AU~B(SsB>z?%#qHMOSs#Qo`r(f%nob>)w%CgbKbdH1J+>Vy~ktoDP zd-}d?VCm>~+QAjFK3i7qx2p`{z0*Mp%I-?QJAMFy!Ln^}h5ij<=nd$XJ$|bWcxF2K zkxijsSz;eo{;D-!T7B5=SUcsVAQL4VQC1#?++~R5ve)4J(^7zP)QzoT*PA!%FdH0p zN@`&Rt@OS}p@8vo!KzW500tPU90k0@?yrp|CK@b`5KLvlvngVb?38?Xg@ul~@)3tIbf&rIsob>XiglqM;e1H}6W zkIuO5i46vf+)Veu4V?ZPH<;SYpLT!QJN8*miM)fwYzqg~wAa9by=1XLyHdo2%`{6y z7T6=&ODpq#+zL;2)4nvR*qB2sugkI}a0;-&ju2z!lN*;9Yq6`K^pIRhIcN+-4AxYw zcnnXoJ~FPu_CHZjLA3A9aIOVpJj;N{HT?R|)WTp1O;D7#NhFQZ=~Q4w(ugU5a#x>4 z5-mxidNmbuGEF_^8bMGGak(#ZI9%aO4d>@Ttp8r_F@!el0_})m|09iJ6ohC53623v z8Gw6sPEB?k>BcR+Gh6A{bn=-5?C$}9(tR%XU;s$y*F97_iIMQ;qEH9cI<}qQSOn=E zYB32)8>sH`0+KOwT)-0h8RG>y4-%*osud^!1rLw>R+(?JuznZC`J4QGI&n-9^OLv} zTrkCGqj!DJJ`}PN1mnUutVXF9G~k`YT!D5Ooq=6$j%9)imY19i8Sr&n^qrm=i4eMD z^SGP571O+XrFbWYT&2cN-q1nvp$%Y%2ky&^0pi}$*as4*DLMxO7<<)u7&G}NyLT5l zZvhS+l9yS*N7KKrwrsL+VQf%1ksD48ykUdlCqQ?zDYk`z0p%+!D@Y#%#HIOVP&JbZ z0ZNEv{^HjU?>>>sjPI7kZ~?46D+fqW{NEb|z#^9eV3t0pR5X+S7LRg?A%aZd0W5%! z;jh(`259A6|G=gppP0n-A4j1Vrv$ZEApvt-ENG`2eiR5z6QX z%7UVRWQA7X=$Az7^1hD33J6Odcb90Ur?WDBo-u;TLLaRSrf;$**_pTda1^&;z&;jMC ze@0Gcr4~1w$j%3un}*;Pl3rsS`)~rIG%~zN2r{8sk->i|huTfXii0@Oo!9m^LN48Gd+3UHNeDv7t|A{c9R(X`p z51MkPhe{o9Ns!IBuC~dH)_ij19TN+eWn0C2YFh(zq`gNwDtUpI(rLc|?v~Qm=YH;S zG>-n=)^JpTFF90c|+^i z1*+qm#CwoA!v?Rc7i*85lkPUwHqsI+AZG~J6a76}{3dc|;~JEhG81G4ZhYxlcQ^Xp z8F1p+u^#N5wY;R0kgcTCY+eML(G!5b+-zUW_@R8NP!^rxePU5~`I|RW=q7>4dlRKM zqyhw0^iO3b7o~aUf1O<7XaXEpf3g4+@&f9orv~>gH)v>=+M5I6fK0$TEFT|VU44Ba zwQL+viC#+7pv^<+r9YNf`-Smo0m6lKlu%X0u$ag(?3~CE&J+?B-fin?hMAXoe)wxW z5J$Rme9TnE8Ri&KSV+yHQxoWMy7Hb*C8r35kdxpP=!Gh@(q<-y-2yuimt_nJMJl;QFF)JbMvUR$!m2}nk-wROtu?b&pyae1rH8QVJJEn7K2Y*t?Nuq0 zcj*5thX@U&2?`1BX%r!;UVV~P3Vva+(uRB}a<7&K^Y*4p_O7ZwH`fj+Z^ z)Bz*t!!yN2qWJUz0KIAz8L09HtP=WI6ol@f-O z-z9BjWsB&Po}S(h>7SZPU+LATj+R=f=e~c?K;i4<&lTx!rtzHVSVY@7g-*&W^hxfnV>zs%OCV`j|NmuwE- zMqpWCnml(R&$>@Le(bALMB)xB6MrX(-q4>~S;@@6o(7jel>KH3N2K$!W|xa|#&TQA z|E?7@G8+q*!J}`Lk}}Lye*PLJ!ko-mj6n+Za2*t;RmnW|M{mgK@1vyi5u!=Agdzua z*csepPJw9HLEMH|KyUK_aQLXiR0Bof5D+f-`ZRHXO+Vg28NnfybdZ7f!@<7fn#E`ECjhV4P zGh#y=khUXDyM;LADkY-{5z($^f+dnh)F5Xjb||}TgL9Mm|p(1n|Ql4RQsBmEdU&p!~NGK-VFagfPs3Q9mIAq;mpjngPfp zQiTG)gkV6Z;*dFlkk)A-40d2}k!t@(GnfELE>0XmONUenhgAB{?)>2G@&V>r*c=Bm zz+wG&4)HR80@VL4KnB=&pg>6Oz#z`OLxDbVz{3{aSuHio(IL5^Z5GSF#wN_vVw31DE3 z5^{2gaNF1<7YNqpUl3dN@4F+6e7*d6S6`8h)#+B^(JVfw-gO1O2h337C~F$(rklFd zSqG}2348!)2XF7kD6uzZS2<_*ceOo%P?&KbFi%nXe7#7vK7Y*2Lx8q;kS78h!nfvl za&MmqV>%Vq>gIUSQm%MaN#d<5#1ENd+iamC(rCzi?J1OOxkut5iB z=Gudc-Ejceq9lwMZPLSG#ys_O+E|utDtn+>DlP1H=j5bq(x5oQ>h@I3x+j-L?;*na zck;W&AaQZG*F#%?av%bsgmdYk52x@VRj#{+e_r=agm60p$lAsB9YwH^H}sS9D4OIA zvi=;#BazZ8)!j9OUo|z?bF4gH1T`t7u%iJmolG*J0Lg)LEj#;BYPUS6cT3AtQEHXn z#pX2u+&-p@Nq5P)JvePJi=?WvHrwCHP7G{6f{!VY-O z95)IO6A$Wc*s9)k@xP49Za6uoN%y?8=!Uzc4yAyPM6(JsahOj@G3(2hbV8lSn$9el ztKNn&jck8K9fUcX%atVC?2Z~aA0LTGVTZ{Y-p%dF1&qapIv_TYZ>!Lc{vO{Hn(0cU zJ?nb|cwj!I?SY9t505;ZIFFs)`Kpy|TRC#f9sa_0zeR}MEiBCu(WoNny3)Gsn;9X% z$BA>JZSB*8r#D{!#XH5I&e^LddeqCH`P^aQs;7Btn295?j2in#Yr_P1d&>-33W~@q zoz^Jqk%V@C)Z3S0d)$AoUJRU#(i@j28L_fHmxfXuJL?SqvxEB!6A%uLFhckypDUE# zf}^k_|Bo|WOVxPK9}ps(tgrs%z8h4~sN0<$MZiQ7BLEN>Pto7<${(E_8BnRBu1lYHSHZl?S0z|` z6YnBfW}%oa$ArEge@S5?#TIY0w?g>sy>|kw;~vhIx>CYm>>Eo37GiTcH`jc?pji#z zt4ZW?NrSjPHdveje(mAF2a5_6enH8IJ+K6m$mOE|9R$MKZMd?0#v=^%ta`ANt) z?AppzSf#_Bf?f^&Ipk?&yEPF3`EmN5bGU6P$HPudT=f7bWawPwmPwTthyZqS0-P* z==OI_!_=TSt+n#uyAlE47T_gUwz^<^*eA%=qzr8Z5NkBU2`z?+LZs6y6jKw?CXU4+ z*`y#>zUjmA+e6&a?6o#1_bLscm`je&i)c+n9#L%o)gEaNk;!BYOq&FxIeR}~QO`^g*3mN_sz2;>3g>~xWXdztUE`bSeKzM3uC$~*l_ z|1pc4$zoo2Th(DFe8hY|7CP044C(LoV`kyDMD6X*^q=Z;f0+fF%t7UEZ|um={QOXC z)8|4^WfMq@Gk;P4n~eD#;2d=C$6c=i^MiK-pJ=_4%7W*|?H1tpeh@qseqV%fX%bXp z<3{{LojWrn5Gwz->60UXJ)GIXYBZ(U9q+H@-uoReIJcJZbB@hgZpi%81R+s}7gNX0 z9fd>hSMZQLlM8YO%WT}Rwr|Kw%XeJ z^Q$c1TZ3sJ-u?Bm%lkD5p08RiL|>bCWlj}H^8GM+EBM#mXw69)W{KNzr1pA#W}w2= zT~t8qm;eE_Jh?dCkcqJBb3hqc3Sz`yA>AA8=Ih+%%;^RB_s!_(((IQj_HP=0`I6_cqPP$PB}TXhbw*Il~&nh({rw!Qh=(G|T`4```I_bS&_ z;Pm1@<-f}*sa|7&wzJ8VVLs1d2t6*)&*Ac&OKBbRGiWL}p`Gc|kJkyrE7tme?5cnN z1>?cO$`#Y{o7QO(FUy*>Kz7GfFyKlm10*4Nb&Qug*W6Glv^@^TtZpS(s-3g?qkOjf)A7{%-_xfzizTaHI3cO96Bx zt!n9)^1IHkBv+^M;flMJR3AJ$;RH)Zk)adAaDjPNaYx;>WRqi@9=qKe^Jx$1C1t>F z^)&f*Y_$eLqLNcF_L&5%Ul_FOIW&LFXgUy!YT<}9RraJpBzGXopD{#QKUjAi@%JVz zbzrMsifwac#dh8P7`BJI^>m{KFKr3ZC3$t75Baz-`rIQ;?dX$CD3!)i&m6m zzD7hKEY|Sm-%ZI&Q?$sz~pz8nKh;%sJ(g-{!QecEUQXL&@cG>QWs|wFD!^ycxA)tEKTieSkT- zoH6V4&=?Lu6p>Pd9?+rB?Rfdhy6&y0k!qi^UeoU&>cgOAXJW!`*!q|Rqz0%DV-GQV z+NF1)leo;~O`lc+j3m)>I*JF_*3@$ek3Z(rX;yJ-3TQK8ibc-D&7YV-vAeUB`qE)0 zHNrE0EWd|y->vJox-6mcu8$IfXoaArT?!h0gmVA$gvz-5Ik>@M`|=*ON_HqNERPM> zfh#Dd^Ah8@fdZL=!vAPzYbhFkIX&@hq*7^1Hk*qfo3nq@9}(uOuQfLAc@7v0@hwm2 zsDJ;SU*bl;P#P=byoGAEm&OE36UBXGdgjP(yZHK`Xdu6gW|&7-K>_Xw7sPt!a>$y! z*(CcordJyV5hTUy8;fB3^#Rp?_eaBtZ9Y2BeAhpVQb6v>-VzaEwuOQKeNPV$#X$x_ zzKs1QIFl>tnOxR=J386;5zp)ytkh`X;_Cy@e&!BD@GH*!|IC@ zc!LBnT|cFTz=oiHtcpeyeQxG35vNruf>Ze;;+(wY+?m!U@gQYzYq1T45uBa-(|ZRoljg?+?{Z?f{kcQ2>6Fj@MruK%JZ3Zyd-gdIHO>c}5Pep(weYhBK%@KiP(|E1@G8WsQ8mm9Vu&(>d z01`Ka>e-+1kd@G<;NveY=R&2A-d=>6_NYUl&k|q+)HdzD>Z@KD9G1DRCeAj=sNG*% zsb*AmdSPj9f)$t3oO>?CDFy)BAdPAni|mW|W75_$`6FtfUN6f6lgv@GwP~P}CNIkGAQ0(#owMg8R@BM4jccajf+bR{l z7Xl>!8y^nu^F&-^?=3`CL+=PYUy9cTnohL3xGj{n$8Q^V$=TLBN`G{GnyG;cP(QW_ zv$*fo(n^`s%GcuS(%7SVeV%)h3**@=Pzy|TwvN4w6L!xMsJ`Do@AP_z-u@CcsrCiY z=4!^pnal9!b6Pq|TH*~NL3UkaO1pl&N{pa&mCNxQtqkQ%<<{H1!skiFDv2^ zW+uAlD}OY<)7i163*g`>KqdvHgcXL6eqhT9fgjaV87fCD+OHPw`->n>8977%N>vDba?!7eU%tS@Uy7*12s-~W2Pi!N*>Z8e?hf4?Dp(+FEJ$%qH2v-ay(`ohZ+;%C2KkrJL3(gfq1Sl1JYWrM*)+j%D zpNTFV81yALNZ*O>9p_AMM*eE4gZloL@-iSkf4zLrBU6&-Bwd_s31LQmABT{iymLthgsK#8Ur7{HT2P$svwvO&ri&sgc;D_* zvN9ERVMwGQ*b10^NBk4}O<)>^HNq$-xlmsN$o2RAU`%4cJ;_~ft%aT- zbVJfck8+ENT!Nso9(jCue`*b(YC1^b$ph$m#aAR`Gbt&val6|rqw9@{i>!Swftng} z8q4t2t9>5khBXE6>%vRpu17KL`IxT_K(A!8k5iMuNTZeF?}WYo#vP#>y*(aBV>^|- z<%>@h5Ly)ZLhD&A>1@U?$A6uerxF{qZY6om1>5S|zR-~MxOKW$>*jd%&Zo(o3VHGl zP~P)Kk`VWgh4MUaZL1#Qqey$;W>u(ed2xN?6f&z9TPRdl+Du%vtp2nZ^GNid`WpdQ!rA)_g4E%t{FCJy+{aYyzFG-zF zQ<;kyt^JDcfdYFUOT@SW22?Pu5y!XcMMu_q1h}a4Umk{z>%I|hm^8qQVAsP$x}xj> zR)za+Z~~d)L#c6-#^xXE&{oO8d?6NDw$jQ7*2K(um}mbzvgE;Zd1eB~&f6q7g86jH zjENu?Hk~iW=tjj)qgkd=BL2G!XPA_ZdD2hPVB}Ct50jxR#@ZI>iz;F}8miD2KtK%Z z4(gcET;8)*Y{Vm*HHEl>;EzvsUNh9SxvrpLu$2+QK^A0@D{c z7)tER!Ntsn=3Firx=%@swS}B>Y zZz)NaP=aB#{aVLrwCpb?Ej2rjQ3O2hm96w(H}g&(eBJZ9^860|Ks6g?lNK|Bju7+X zSJf~^3q<1uyj@n+;6I(hfS!L;8qNe7exQg^TDL|i`u%%ce4#)Ev=h%?H`!z%w@fq~ z*d)E&D*$^QwP4^d)6~~ab}8nsniH9XA9hY@&OyXlp#{W9D@2{re=0r1RtO$lrW4=s%eNvf*6d_3B;g;nsPU(@$|08 z&k@Ed6&!KA_P_KAKuD<|wavY4&W;$y%#++rgZ!tmn-=;%fBpY|IpE`NnFf_r0DN+;bXoaMqG6T1Z3dL!w%3ef7`-xGT~f^4u0n0*56|-BYwlnc z)pR&xxvz6w*@CujZ5eis!r$lIiDWbG0)#)SN4|Y0&1v#cNVhS>*Z2$;l8xKWWNT*o zRm!!0vp&cmn?p4~8=vXf=I{M_^EHDTG+QFJIvcwl;dY0x>>% z_&^^7I;8*tQNhp90^iIQ^?d;TQF-fYsDLW^t}X!wryZ5GltG~CIQl~y8sPZs^M|J1 zAkg{m$A46bg6BCwpvPg49w-~Wuw2E__g@_eS|DFRym}pf;dg9&{Cnl3&#RLxHTV5AW-YrwLd_CUD*FwP!vf04Nsn`|5%t2 z!Vjad{-k|Bz;k_Tc{&~WwJ2x$^k)M@599NJ!iep+v%4cMa4_iYQc5`XwqF@i0QN>t z4S80guxL83l>UEx$N$@={4WbKFK&e=r+=8*%pU0+?>>*2F1EV7;gst6)X^H@ImNX} ztVu3_*f1g0k?I0}QskE7eKdBz9%yUD{^Mi3O*Fjv;G6f?oW{#^x8~>>l1Kcr!wHRb z?6tvTNRNeN(T>a5J{sXm4 zYq9U1v8-6-tQnd^at-#^*)CCZG3I`+O|nEuHXfET<;S6R4;%+~K1*;x-9K(zZH(4o zfo90p8eLvq?3-CCZ@P27;~?{e46L4A%Nc1d2URVz^PFUw~4�~HYy%S#}y9Icsm*^@L#2Khv`WQ zCM6^HhTY<{PN(y7$w;Sb>LocbkEFa5ERFE*0|w=aKR>GlOx5dw%7z zFIN$$;(&)UNA9z}gC=zdaog&aA}l~-+x(BzCXq~>7yj$O#s20tn{n1De! zLbgjZ^jds(1zcsGYT6h-vOp*8DI)FspL69C*1_rF`z=tZJn`$4CtVbwv*q3?@W%PC zmp@7hvN}}WIoKwr4u!LC%jzUMa+@VjRd1K9u&5iMwhC59Cz2_PN?9{lBcg&wd(P^p zY*Gv5qtN9L@J-@q3c>i#UV9>(Bj7usydPgW%=E1Y({pY0O^|dQH#v}3r>tV5J~gqt z8}FbGQGCu=+85*IC!~?+pR~0br1+4yxBg|kv>1J7W`?!diEbZfB`*aV$qgIBf67U3 zc8X6MXf`Zflxx`l3u!7GVrOc=d$p>sllI;UYSSOp8Co0#&tJT}FEk+Q(wJ8P_aBit zNbiHvcCpoV>zi_+`poa6l7Hyh%{zt}^GJsb-uva-w)o;KjeHI&Xx>5)4u0fCvYQ+# z4i+)oAx{u)4n0e$NV!80AHBA!c2`tX>gR4Jt6#nW|Gu`OYty)tf&bp7G>z@`qu^`g z?W9ffg(Nqa>Xg5+UIIU<@^nGOxgn{*L?<&m3@_83hhfP!w<_m(B=Bm4mPKtP7)2cX z=9oNTqK+aRp?TeL@hz3KEqq%gkZQg$GS@*&d`UMRbKjOF#@GEos6Kj2*M~%Eg>=pD z%Vla(3LvaIejb#iq)p@~mf3+R^>Hg+QY=pXB=b>d-8QF5>({6`W zTtTL194my{l`^W@o?P}cz{zWgGdT|<>ChgVYY-Sq+^ zW`$aP^Bt?oY(Eyzgi75>zfq0Qp46hAimFRFb$-%8I7D%GOh^$U6lF8qsOIL8;*WL9 zJH^A*;QSz8Gt=$vCGfANrOEC-g4+|8W|Vi}Qbpm=QbZKf_7b}2(jVyxliN4k@y|ON z3pWMMt}YTuV?UL-d|LkY8sdLc@?*&mHB(pu{WEbs4J;+4h;rRt*hEWJ_YFndQ@9{` zM|P$@Jl#!ja$}3K@pS)b-O4}z2&=_>2zkg_W>(!rIxe1E*JwmWL$ z4N1|yZLG*ps$lMGe_z$S4tZuogcz`RPPl%B#oozZkvz&-qqDgvM=<7m;AGn6USqXY z7k74*PHmkqRi8dUU$u`D&Vg)?-uB3Vau&C?#}t*icbF3=6SSd8%#Z0O-US4qaRXab zkq*C_*Qt_oY$<-W{1$jmjZKc_LQC0CnnL=}y@M2ul``}^GI&UEsrF%!t4{&DS4TAa zcujGv<(OP9`@Af57>D}2c1(ERPt~@!9P_$d{_~IM2cMO>bRp_|dd92WNsZ$srM(id^+pyl(%^{n%56^mY3eOP2e(gh|2^4z}HH zDX6hv-CLD?U$P3En#SM>&tO1rj99ol*2*VUd_!Fp1TMEtqFL3@k-BPa;Zh&)tfo@G zd*t{Y6f2Qi@~IDO823MlY>PdBoJ_Xs*)^YaGyNVaLJZndTCPi!A?uzFEc03H* z?hd=iIV!ds-x*UL)Na9BFQ>6wdRgKNmqL&R#1ZF0K2z?kC(|(5gB|KU+`0)geR)RA ztuX~un z?IK4jQ(gYCsrPe3wTI$lzU$;8z0$(bp8(W3wbt5DWJlmu+y2 z^xrpKSdwrGi|}Q$FH7QxlowwBbBwat9iS8~+s9sfSe4t+mc{b;ZzuZ5NGO>ymLnPs z+o#w5JRau_*yIZ8W6CItD(&*znX2=GYDSxj{FsQszc3(uS6Ti|%Sc2VjOUAC5%RCD8b)K}7r+5CufCAmUk zNLJ~E=;@7{)5at{l&YhJS9St|BGu`@@8AkVr7t;ntaj#Tz3@Z_M@OQ@GnIVG`m9hC zc5QQJUS}`8q}$4Ync1639PMoW*tL%$7$=9iU#mvOCijo1{^n__ zw!3AlxamD*Bwwc*8T`$IIvSnL*KpQ?1p@s*u`u7c;P$OKl`e85+o-z@?@(86yKH>R zZ~@__k+`Z~x60VNF%Og8fD76zQSzKtQfLojXZfqfi{T|EGDw{2w65pM| z8G9>Nc4Cr#P?`nKY<+YOx;+(c3EkV6Ukk)qEN(YVro{KX2o&hny`8t?%1us)nFgy7 zCw9NKttqK3uZS2Z&dFM^O-(U|IS?h#g-_7!v*}ANl(>;haNz1M>;9VrqL}k{+~}R8 zwfADsm`Xx5*N6I+{TN;AtSw+=%k~uay`A`qnTGwhLj(a!lA27vY(IB)q>;$dWK{Rq zsd38>HKn?-vU4LLXT}Z9=MWg`sSNCrMbaZ#11chX)BOO*+IIsd#F zN*y)~6moeaQuCa*&XT$60n!ygAVAg~9aB`j*`@SsHdj4xO29SeEi78k%)Fou4Hy`q z0jaA0=c{E}F+U~mMZzg{wsua?a8xuCh=G0UPJh}&6XG9gn$N0X&6T2uesQJd{(>*Kf z6RyKzeBKU53bn7CL|;~oANbx9@7#Tonjeno%ZSNP7gvC$(}3SgV+!kun!*%<>e7s( z4yj{WjZ>?=g?ji+j|F+VCoOYjl47=fPRkiKX$k|6UUSSkzUm&=#se}MDmQ5DOP$iR z?}l$oj%Iol8C%a@$rUdzGWVac+b7AI@u|$TQ4}UQZgof&@5C+FJ5+v{eW&Vpdo;w_ zXuHG__ja{&%TFN@DfvpaJn3mhw1Lyz~H?D;Z6fNvyqkZX)C>b z+`}Pzdpl)mpGe{OfIzRK6164#1N?}`>%jF@Ufx0;R$^>KdAQ&vxp{97axEK^Oin8z zVRh^f5C=o;%)s__drDt2Zx;@-yxuq&a?jIP_ls-kikt#8t{jMxwo7;&HN;=}z$djef*z>=!VkQnchhAn%*O+}NsLrgR-Cobbgj!{2bd#XI)=k@kv* zac09eCKZ%hcT3Ph%WN**B=c#|(bx<2Fz|UB_l2k9cOg=SJ5Gw4h z%blhi>C`>xnRL@pCAiBi8yb2@eOMbuicD)&|53`a^HJJWj&mx+QmvkooSir$;KVP7 zQJv??&|bi#%VHNcZyyYK-X^}ijI7&hsEw{pH;=VsBV8WZce2bTwa*vs9Ex2CnzopS zXBzCeu&V^s?=x~WD{x)Yl)*6C+pohVAl-ER=^*Nz6Ui zACor+9=`jTQb-A~+rJ+tCn8_b=pVG-qNvCfT4&I>To9hr_UaWp)4SVBukiq=)925G z$DT^is{f2vSCU&w5O0C2>1TmS^En9QSMbs0diRI;QhEyuoM=x)g>o!T;2`iFgh@DP z=7W#3u_Gfg*a{lITm}g*+{#I%=_@_h;taMcc8wEiGUpxJ7tlRZUg*iWh29t{gAkGezJ?T{GZluXo0$?00}hK&yZBu+mwJ++sPa`u!R+26O| zpRf_)tHR&{Nd;4w^dK*hfYC#;*zk^PA#!nZn$&0u1~bQW^PAV{L!xy?;68~Kcj}v` zFq2t|shF&{;{Z;kmGRB*@?3`TA)Y{4O$uP*Tq?9l8R%X(Br|%34 z7hO#d>J$vmk$T=Aq&!zuI{W69zguCs2I^p>O7g=R|F^*)f~;<2PY@sZPCFOE@rM2( zHZFiuH#07u80oYCXS@h3y?AaQY+4yn<}d^sm6@X*pK0z~B*3fJC*ZmDhxfJ{d99{W zwC$#woBdiFmK;aPs24Kn!YN1>&05QZON_-eu6A8X`Ni-j-LYxO+U37@JXtuNe(Raq zf~^Rs-dpr^LakzZOJkQLoiXl{iQ0+eYSehdn1RUF(H#ikXiOesV%vODI4-nHgC}v>nBwRblWFFU7N5_ z7LMZ~pT6a=GB(0~khSx5z{6ZRI{inc|KKZ$to^=-m0Y1`1 z&N`*Wnnqmn_FHbkXV07ZkL3v2F~wmz)SX>Y3C^?YImWA3kF>8GtWJg?Zp)9cI4!nT zh4amoLVE3%EQR9mD3=-Y=%j;0tL;8@!|_>3Y+Z0z!4+t$xwE*Bui;iOhf!CZtElaI zmsllzNtaj(i-wV6cj>DNVP^gk@J6h~>PA?=pH8a+1BkbT$jD13uA&;BsR{fv!dcI( zy(A+RawU=wjN&e`8y7m$F>{0~H$Q|hj0jcxDo?6rGJT=~p37!%eivX)(F?Nw(V zvMc5qG{kA#El6m$%T8J8-GST{*9PcgcC0Ypu4l2u9}(YbFSc3xlFXoNr^9FO2yM;q zAr`+dhXh)^<7k1d%FSeX0g6Mm_=yJooU$u;dOb_U_>Km-L|v~2_C?7o1dAs-3zHGg!Oi=k}3rFP1j8x`qFuSYJ(fQ@+D73F`FX<(3K+qS> z#{IdUNk%K)ITgx+E`lL34Lg-r`#nsZN72R+g9TR>$?cDm@(l(|e}F|4A-0WnkzLq^ z$$P#^;j@VlRPEj0Ny)G`udx;f^I04Be4x;8qT+t!t4&a^rl#rVUtev?Lu9`n75qBG znmHl&XxB4|M$8>Y;(n~Ym0-TZNyCgt!`#W#DlFYo}R`8T{ejS*MPD7{ME*N5uS9mgTRbIrRjZ5VEglf0$sT^%Enz(QvbLrsCutq#czEVW$?wlctV&tG0fbm-4Ms>%5G#8vJFFe)~M}2liT8gw3e)Z z$t7f%cRUK6IWq#BZ8yKy(ttaS4_DYOcYKEw|pLKX|!@96i10&$CDyZgfxV4SzxL_?oNz%fR zGP&07IRHuoeiyHB%MhA;L`-YLr@_M%CT&@^*4>}4tC2qKb2d+dE$S@(G_8p?o5-c6}LD*A#aLcrHe=ON@v>5rJsKtvwX~yd6}H77REOzoE2P-D4|!9d^$36f=bwC zs6j)~0ha+#WMPr#`f|P>2ij4X|!W^+1!Qtugw z!tDy-|AI{?C;bcP{AOTwI?w1Jt?Tjkn#czEY5#e>kM1vnfoOf)s-NYgUgA{R-p0<= z%#{=w#l2%*aXN+Y(L+(jwEBg^I-WR{aJaI>HQt0I37bhsE{-*NJFa`6s_*TRc30(& zA!Eyt1&X|2#Y!O~VGZ8i(rJEM6ZU&D$@Z1jhJ_iyQ->=?aRe{LC=p? z0?e~^;W^(;iuI=`+bhKU}!#hC$BqO_P%|*?@jwOLfz5>^a6m3R+VvH(CUME;8cmeqn+gjX3tKyf^mk zCre>NJH0%XzMAmgMg9gYxx%8wvSJvw<&zW242Xv{6prI^eym*}U2S9n5`%VQxv0gH#m2oBZte95v;K^FKn%_yNoiOgs z$M@ps5s3cVQc`Q#j!|^NK*Ox?MGAX~)LU=R-*&0OEW-)W0?_v>(@l!$CBeQm3hvvT zgtd5qt>>0Ogc8L0ccoW%eX4I@&zE`1lD9_$CNHlS`w8n%3aS;{b@M`1HiphOKRY0< z;Jlc}n`Xij9u2yr%P(E~(&C+dyMa8PB#X8F+CTn=D@#iI5o&?X3vEG5<59;DFm*H} zwB+dHuwEg(Ehdp&trM)fG3lWY(B)xjh5C*)XWEHA<8%{&2skFHF9y1s?*)(mocXbF z+}bWTz-X&b>_%{qClT)dQG22Ut7aRPYNV)$gpPjqD9sQvjyqU=I}gt17B;BgsyRPX zw)o<>8(X017H=zet8!m2Ir`^~dX!|!*76V^o?A1~xp3HoC%MJWE@Yo;>Z;dvCsL5X zr)qb}5?V9f1{+vH)(GQ`q!lhP`r01WFnN!gJ|03XUE2=X5cJzgT3vM2ZCDF=97H|} zcwMKQJaEEJbk@OCPpMc=3>-vPqO3-P}<8DwSW3e$7>pXY``+dzc_j!^FT_<9T@2?v0D|Za)q>p zkmVbtLqP#nTa;w%7GWexC;cPVd}&6>I&aQhuzqDq-lzkR2=CDuoy1gFnyXT`(RS&AIvG01o()bN=o@sM_xmBw)pk*-gkqo zvRUD#zDgfErnc^*kYF%3?7`X?nni=_vo=f5?v}ZwZwt>pGG2}DltgMhp(sXVFFj7cyOwIuXa! zBc|Y9pC~53FVA%=xyAF*Hc`3SQ`yLETu-43tXTbc+4|*B72hY%gIrv=V(defsA(|h z8DxhSMMm(`)ub*FWI1}=uX&Gde2+rf)jz3^hG++G?shNL^0?#l@`c5Y*m^{8TRyTQ zp|+(uxafplk;>RXlP4pT1HYF0@A=o48$JbNZLW??kBs~Putk)Z!~{D&l~Hqp|Ak)N zceq?#*fZxDXkf@rf7Fs;v7TRh-+?y!e!1>jbYB6sjKRZa8CECGCtq?}+h`0vW@^r2 zRuMO~>4eZ?HZ%)CCT7=tYshMQkZdBYvvPwzx3nce zE+`heoYR4q-)#w^%t!RRksH&_WWUv0ycfP7MzX}0UW>%GVWGOdq7%1EgaMvi+_0@! zuzMQp9|+Ke+6Y5KlIagecB%SH^u3pz1jYR1&t3Il;@0D0L0o#YvjR6a=j#}&c5%Kl z-JA5uWe%kV7~DzmW2snarv&gEAub!_=v0V zo6%7;shdKyU2*FTbkzc9)90oDh9TndL{yR*Sb9;DLGK##@8ncDo!l+YO5)-rck406 zsn+LWrKt7S6_NToA80oOHi&o$U0w~un|E(-9nMj9e&@+%7YTbU3suiG0bw*Ft)+2g z)T^wxU^{Xiq}Yt9J8SD%@^V{=GwP*HvH=N^`RWxbD#W;w#rpLrYA#nP1wJ303>eR3 zhBowqsk$n@6A+wy<3A^L^Wafx zDM7OD$fduh{3Eg6COD{@5||b7upL^KF&L4FF587B3i@Cq>F*n|?m<=bEM{rtA$+No zAH~)x2_H(fsu;{NFKs4hpy`~dbHrJrX$e|cGHNMaVhT!8_oVXv(%L7?wSaAw%>Rtj z_+_U%c0oeuH7w)*2;2T&@Y5hw^x2z#N$h`7<-E}+B=&C*?dNZ6v?nAsK!hLrT7WRH zPw79QBfvcry*oZUrGx~U(High^}ol80Dt}8E2jF_NqYZ^6~%RrdxKLtu6Xf9>e>X= z_=f)U5uKHeCGHDvP=%(c`13-iObR&>uTw}l#2=3OL~cKirFV1p3R@-uzYo*I|L`SnPC1^2%=5#%L!E+VDAW*2D+D~c_2u=Hv z2?S!}JPlZ$tX(hc0tMB||DP40qestoWaO#_AI|Xbn%BE)Wm>)X^=4_aPmc7Y(5sDx z)gA)^sUT&z&jiX6x&$kqxHqq%S4Qk*U*N*nK}tv&VW2?MQ7DR4q|Z{T&T|HBzqdX& zE(i+M^@ycI@A?eqs6~BPu4od5LF4<({&_)VEkNj9Q$iPhQ*jhY`vOwBy5+F*er-uK z9r@Jr2g`WrEq}@Z9@9n-k|~mIii^gueY$6-E*tdoCEW*U9Bz4;98c z>P%F3`x$7e)VA&bIE@EmlNuiDn9Qc%DNA8W~nVhera?h?nE<(A~bL zVEA3h+ex(PC4jD&Xr-xz)Bz>vbd?ee7+bCJ7h6yD+5lP+Fyf-usMOhbIZl9_Y3Q)#K5vst%%;2)}nS=7Fl%Y|@;7(R8wS zM5rI*w^e0e0lEilvsr&VZek7WCx_QUX^t&#m;Tk4)i$;h7af2nYft*3wQ3i5yb3)3 z+Z}Ibo*7j&28r;$J=(T@E`AIyaY`WiTDq4yFBO|t5@rjS%C-9}eO~~B$WRq%m!my; zH*mMSy^!kdLBnRuV>l}3Jn!Ala(Z>SmpWp8i&29LFb|{G_5cT(PM_5mJ{Yv0u20@U z(@vU;{S%;lLolC>b`VEiU=R5Mm!SQD?_%{br5dbfLBlQ+;tD*d7p8DPDyy|=0vu&p z_m6ictVF+A%aXn$yDJRpVODp{z|9`A^c~ ztb@h=0m~ImcB5EzXSM?IMGjs!A;;su;je2Mu{U&90PN!?y zg{t6eyf%=jAC8GjE~a%r;CgcGRNL$ElezCq+x$i z8q1q`6vMLQr{H%W@*z_mdGo*}t{0P!S*#I0NF(=Jv4-Hf%Um8haWUUV43`(FAAL?8 zEgWY~PSklP1RH_gJA%7Sw8-@m_9ppm)%K8u!%LlICcPTg>omAB{GBYk+9yikU^b%# z3#63k@r)7#eFJ8a_JNTFlRectj;!Xko~ZNbiSpfr=-|#*kFj)wl67BCr`i_aJJdcKFw4l>qr=%@YI>*JsWC|?B{}x?8mBoDE5`7Z z>F$GN-EF@wJ=IwnQ|o02;cSSU!>_d2u8r7k%Pq$-h;wbZB$MLe#TeBl;^4;`uo4?P zPnLW^P&B5Vgip&zkK(u}DVhyh)Ct~wAd6KUzp95tqp2Gmr?CI*jWe93QSG{Fl3QHk zcc2Afjpi_sHW~CAW+Maz^|j=NC+T$mlqLjVl6uqQuvUGt7p`7?Pvh5RIOY){#<9I; z;`>XQ>26#@<`=wFu&6_=u$fdZ3D70)uLYH7E=nsxC+(KJi{Zky-Sh6^A>+2T-FJxx>??VL^*)=#uZU{(TOk6C{>rmRO35bL@gFF;G*dzdfs8@ zI1OE1MyIa%PqHKD_6aZNwyDdGV_5{l<9STq^pa=T89xQ*ye;WoySYKt8b98R8m;Tb z!bHcdNq0Y;GV@35Vtbi%3Z&q95_iD8^bDWb*(bV+%eHvnjsKX1zG2iafHWS2qnZiA zBh9ltms#_M5chz!q=dgjx=?<`&Q-ML6{AZ(Gia|(htFk3->%+8=O4av)#{YuWZ(QD zHtBw|B$`u%7QN7Ug<*0&M3*(1#;V4#_aT1ra6QB4Nu)=&$c{bctF3azvInJ_HP0!< z)_e>E8Pd*^DC{!-cFuD_~6nQNCjt5E8skbSqYx@$@*-;fw{m3fvW*m@}kSQ$^5WXTKADQHy_ z&&e!xG%nRLK&TSd&c>{D&iE}P{E9uh#&d4^5K@)8#uz2WBNeht*sH;tN)B9W=Wq~o zVRZMc0q?g2izn#uo3SeX)crFfVxID|kna@*&2Pd6lUNtyx6~Insc&hynMZR2-H|Ehp2@9&K(44H zbD7(f(GI%lu5;X|pKL=0PRw6MJe@?lFLnw0-PcPYy+&V)5M$5YNn|M+bOR4BA|!O6 zHyd3K2jBKq78s<~C%zw8VBQQ|Ny^l*hirCm20n#YsB}Bn*}9I~Mv5sIbxYi;Ov91C z;dP*2k}cMt-9f2?&u|^gASKCio|#;AlbA?o<=D4Vv6SG^p{3!m7tA|y?(sI@8%xgI z2TeE+zyL6sc38%XMxU?c_z^ocJKA2+B;3ewz^03txI$O|VKUF_CjH@0e9J$j zojKxc8Q*)-;R&SRooM*E{c^|pH%&bW<5g|L>Qr$pHIjp(%W~E3*N`MjOXM}qgY0UJ zY_8RK_O)th|7F7d3jThEyxc=Pl!UtM4VW9pYpRYt&H89{<;RJhhSiX$#LUva4UX(G zoiwXA|HBU&4oX`WvkR3-Y&0+)Jmn3WO~0G1SRK$AaBg#vx1*-iD1R}p((0R;FZlBE zy?4(j$t<5N&p9Q;=-oW3M(z8FkjF-2K{2=ogZp0i{qeFlVz9V)V_#7i_S65!mcw zzyEY#z|SZ9>6{JtF1#axz+8MAR#D;3=8ImKVHJ7IDJE$qrLM!YgRUA9x{@H7O%!_v z(Hf4*_8O(R8g}}8weX=V18m&l+taxFU*gtmsvz};fkUOw@_)ugc=5;@4B{zZ->?S~ zQ8VS7Z@F6gdN^uG3cD(@lFmK0jHc$Na_$Us`7qWTs88OOx|?%e3o6eDlc!Y%v+Dng z3v7E_6N9KfToZ9RPf15|zP0c$^V8N#u7z5JFH&&NTyrM1)>25WX@k1+P_8{nyh#jR z168fCx9LS8m0bo2%!rI@TR6Gv5x8OI+&*G7>&2=wmqbs|a7B?p$bhf}*mP#04} zH61FklLua|e<^j1IgsD+Q=KbUlGYi4RGJa>q4EUmKBX_#x8bO-@J@cmYIZt@Qj>f< z%{Axvby{%|0srlCT0iGhl{JM<t9MM0<$P=LE1U1Snu-|q zO}9(tEFto5v-u3P!L0qZfP+bNWp&Xq#i@Sm42@FA`ZwOe%N!8z2aNIQvkmMQB(p9# zr>V5X!%tza38dPhifaOL-}W;mZF12l1XyL(kQTG&hQyxwPkW9R!ZtI6QssD>1i%z? z42K!y`bzz+x(Z>M%XQqug{^+C?b0riGkN6-r@&2!_GU)Qg2UK~6+H0dGI{jtS)UCTvx^dzI`Nb6Uv72g=6Nh=k6S?_^}>Iq=bM zh{b7G-@wvv;kB={p)OAnPNDl7_^d`C^EKI(nCh#^XqA`29G)ety|gwKhl!-e}x~3p%6dCKtna4hoJG6E!y8 zFKa0ktlQVCUD>Wo?t%vu^#lMB<#A4n)4f>f;ki!MQrv4p3aZjIspDvX6cN=;$FQAV z()Iz)YeWr)-z_5WhJGCLG9p`aUs%GE`J8moeH0Ch0!_rZ*UZnIM4?7%5ZQ-~VAHre z{UbEBY=FwdARaoxB2Jh;V}UM%5sR)HhAm2&UGXV1m4Q+Q|G6%y|Jzd7ZKL|}kj1jp zCKjVuDzcH@&vr|%UTZOk<|2eztkWEviMw)bSgEPo0CJ?i?H5C%IdNq>u3pj@onG0p zaFm2-khr6{ju2`xa!h2jhvlGVaH54!Rb8XJqsEaVyjo;$5XsC zQc@31a2g6^x%yGS5!!yuS<(nx+$fTpT4@T0+(MM z-M*FxY#P>br&jf3{!sN_tsoF+>i|k9=Wr}};RB4M3tKKkuw2;~dq;J5xvG3;rB3S;9bHpv8|MPt%+v$rhcbJ@Y)N=LKz z_^jX2$g9;Vdabj>-zr z91FKMU?FjO;CK#iMLq-5qJh!%28tY-=vuP1Mdz^WySOd4P-&K?9i`w$`Nd&av2&_Q;NpKmZAfo?-ZQuJDB&8$V`?fZenR z>p6490EKkIMz-)Lu}ETMBXk)%``*#2(~_%pZw@zJvwnrv{SJ#QPK&7OXTN27p#h>n z(k{GbT%nd(BP`V4Uq`i_zd(eNRv14gt&OFrOLgJNN~6 z*635G84W8`loKF4fS4p#>BHLRJsH4Q2W?|-!tJA3e^cVrhDY+Cx<7%O0aZ0hPZeOm z7^9q?K-KJoxIPW2B$SVoCJ2GDQUPNx#}9E0cq1lymkeF^t&Z(|O!n%aAGm+z7wxO}E?y0Q6>x4z-g zei}~)|Fy`N$7c05uzeWOYsa8Yzm`->Maiq>obZ|fTVEXxrv6r^SCx(KpR;uHA*bu) zGg`iz9^Fx+`hJ`Orr=k6akD8=Wux{b+Wi{5gEQCG4%~IVRj7-PUw1=XSXgpB8#)*u zs7pWa*9=2{rZyI$z$-xM7khU~6<|Ru=7}ESG?`t#@@uw%hr<~u8-k4P!V`X>h~r(f zz2m4mvZBT{2F`{Gne^_gKzt5j5ePYtLLGVf;<D@jo9ErT=!~A5Y6LV9EUP&otuY>R(aen2A*~2PC{7DL{g; zw#0EkEnQgZ%PTVva!;E5Z*RV#DwtLD>+z+aD^5%&HveNb_3ypwk2j?Md81=?b}{^Os!(<`qy$=#}HF0Ox;i*Z{A3TnVV)gedlbQk{q}t{Pb~z~`IM z|9X(X67ahRNSKZmI979x8QTK+k*@3WyFT5!80YdKZC zeC%n*h?W4;Mp%bu7n^xY&T3Z;K948+FOftc6PV#d@Nr^us9x1>-q43~9r@3PLmQR1 z1e3WxBk8lAi97T>ER>LRqNkP4{g}ivLhtK9981uq0$n)8<1+||4uebBa`Pen&?UR} zoBgz>6&Ca6x|0isG`Rh5rJr(|o{3Y;&^{a3f9JTwE>2!5U19fU*b=kS#@#>FmoH{9 zo(b%K#A+4jDT@Tui$VU-dGeod#V3Ux{@vz-{Qa~~N8V@;j%ECaVs!+Z`BLsvpAP3e zjvUr!cqsqC=yDg2MTzyJ9h4%B<_TbATD%p*-#|nxA9I?5#%0$Q**#gGKBrPC-P}VwRXe1f`$US&4T6o7LY-w>>mKz%Ki5k;y6F ze`6kk0c9xwUzsh{4rzC1P$>lg$>_Boj@)QK!!gGddQ!MS-++q#qf#CE`GU$N?a!jy}gN{Nf&+FHPXVJB00T{?BT^Aef$`mRKXdeBtUHc~jlptIlL{LQoy>B$- zIsUA2{CV8u;%l>(9Iu|#Aac;N>iuqchjuPHMhmpJkK|2N_D`kr0$AyuJPcCV5YWC0|Q zvX3``LTx@DYsTKgi@*Z-FxCor2l)AgtzY%rnQ16zy=?(JCS&@2AdpONUl}Q+=xn*p zBO)UcbTr^mrn61-AZ7p4;{_6xpZlW)5ZSvzbU1ZlP7sUp8PBU zt6D+s)R-|&?PMq{)d6DF?Tv-L9zfo}OpmH7%ou3MfY`Wz*RF;xOqDpZcjBq5dipO< zT@C7Lo&<#xNCrj{8ewGYtjN((%8HTB-5Kv~__vS8@{mN)ZWyK7#+I9dfeau`vGn?4 z*^Gh}I19hQd7~sSWK9G3Z3v|12dzmz-pmH5s@Wa?nJD)bKLf7=oqGGq-*@Ha&IOIu zbzV02E$Cjt$W=CXS9lEEx1GFM8Ld*1V4hmXGO_w!KX4)Wx#M`KXRhUjs?Bg5wyF%X z73n=UMYrdx_tv;<_W)r9`WIf`giP?SXapFgvNRGceCxQ3O$o6V%^uP54F>3dXh zpVY8oL^(;AL6Yatz0{Un@&2I71uZZ7wYRXS{@r7}8>BmVfe5%wpzIBhcNdxymSQ8P^) zgEu+L)!978UgiL0`5=FUm^!FsU_KKh-cqcor@WVo**ImEx7SB~=M*?=c4*;I_M*0;Y5}}Fyl&v@s z?Sx{K{2{zgFgISe5xE+DJ245jGF`6-Gse_?U0hT_hqux#hH*r(rBju{egrM9j7r0> z(Y5ys3fjd$vdh@9bEEK^FuYM+8^z)v1EFykjYSVqLm&741 z`HHiK7`l_;?IT-Wve;FX1F3o2aNekL-HUFZWKz4E9RS*>We3hkC!}p=2;qkX;6rCl za7yK)zhcI8(3I%M_m99$5o?C>!mfv=?47`43GNbd_ypYSWi(UHu9d~i!g~GHRBdQt z6xy+<^gH*Jv4*LYR|uBPr_|<>eK#L4#vY^+XLcy~kS?xFJ1QgB@pX>h!E-_+4fg<_ z!Sxd5FR0?H2{c1&H)veL`U84X*emA$uU*-z!IiXT;kG=D-bl_=-JIF7R?E#9ZpF55 zdi^@@yUo9%=<=mEu&IGNBTkvwpn&?IH*OnH3w$I_xi=NrGV~ykVaNf17UGHYBSe0Y>@8+kt z>C^q2r-uGp|K^^3YK=Fr5CQed-`f-@aBO@Z5_^Bqnn@>5Pur1t<@^nu%b@HAs=!ie zcKPy#pP4mv^7g&44YmbSePJ%LV&|G3&>HD#b)EHhZf#m?V6~%BanX)BduLx+E3msKn%C*#f#6cj z6{{UeG&in$a!GRYu3c}ozfmhVb?8Pf@A{n|jxhJ0IP~Sc;=j~az!N9JRMyKZIrV9k z;nnv)LiFbEdb{z>)h7u@Mb>Vgn%Yx;bb9V&V4!CWqT>kBAYJcsvo4$O- zovu?WRszES*mGhqaO|D%F5z|X;gp#&^P8mqpNZ$)C?#ZSP?o&o_4^vFTL)goX}a=u z>CV2tbn5n;%C23XK1~aMzx#A{Y>ghPN?pOir&oTjYoC9X|4PWTg`oe)zPD!vFXTh_zTbAJKjRcHlD70}YN$(F|VZGqdl}74V@v tH#2~}5YRDIpyg|XPOh5aG3h_Ii-K`H*N(Nuz%#lSJYD@<);T3K0RX2=0@VNj diff --git a/education/windows/images/test-account-icd.PNG b/education/windows/images/test-account-icd.PNG new file mode 100644 index 0000000000000000000000000000000000000000..4fd9bf3f28398e4a979eefb3e9e459b961539dbc GIT binary patch literal 5875 zcmc&YX;_kJ*EZ8QLyI=jjF#Ipr8YCUW$vlds-~i8rG{c^X1S3IE+|rInWC>2%BU^)yxg1ka zs6%gG_y10g1Fk!GM=K~Ob#6Xe$j}#;6%>BH>v;0mxp)YVNkCmD!`>_=d~5rS_KjJ^ zOpSw=p2cAITsK0kD(u+p-gh_akfPZy?{03{f^kry-PpNBcZbDO!cG6ZMh%dQdGwoG zvu|y^yYP+D7;KI`;ZZh6t!CKR3=OTzQaeP_3aj(tVpo{h%^Zgijov(78psZlFGLM75^Lilo!;oFw=|inrKI0h)J8%EQFK)A-VFAQCqTfZJ}G$@1Hu# zCt!UQx$wV<{Ev107e>{?{;R}JJLx>7Gj3z9_akokahgbiBU-Ni<+t%^A=i)d(}+Im zqq3iN^1|=6@mFOMOeapdYNw=)*l>Z|^j3{C*rM=;U>VY}Fw7xZBym8wX=GFXX2}Mt ztSJq*-jI7l#`jD^C$G*eq}fSaAdxNhrv4TuWc>yr&iUq_=}S!9#@qs>?Tf*txs!}g zS?WGLU*ys{h5XQmHw9ADN{|H-AE$dieu*$&DQCu>8V7XlpGOu>7PO~sNV{450wW9d zk9uA7Bu)8J`o_Ado$2_Z3^|U_X#;e!`N%Vwm~@b{#-;(#zrXIECms;$Au(?@7r}YN z(tiL@wmg)#wES#3SOuB^9Hqk#CXtb*JBYhK9)WhFWXPdFqS zFQE?WUeuj&526Pmfy$vXtT}Zgh#s?@Kjt&Eg3ej7Ycu5{}Jf%Fljst z{MK2P#_0|HgOO<}cA<@0++jyNh|QDcEf40EV)tg-aYRySVGm3TX(J>$ z)U)q1xv52JK0|W3{w^Rj=i{~A=5T?FtaO*JaDd)R+ zEgT8UrDPk{%@iM4oh3478}MRt$o$n)v+;&M6Vb5N^U}q(n40erYgz$8Oiw$0*sJQ< z4ds5ufuM(n{i7R!3tm(4UoGf#wju&2?9iTV!LfIQLq2!du7gQQBc z84aAnc%rfYE-;57D(1;u8-F#LW#n@Ybo`dF<2wT@02j3DdZPtPLE)$sI;3MjdJfob zpIs}1?>}GD?v1p+bK!rSh2=?f{Vh%=`8bnk_}hcoU#G@q z!;Ak;r$_mNSR;k{sb5usHdFo$Zb#}CJ^#(&b!LIlpOtW6a2KT47z326st zVr5qx*TFSY)|Z5c--sbJvuqOnbSHvpgNbb29U_vzm-?t}UmC2*mA}{v8$%_Z1T(}h z!&yy@QnR;nwbrg5#5PJ`&h?i}LS77U|t#mz=bZ0 zR%;*5;WD^IrSY`T!`%~E)y|6dEPi{zx}*cJ(*JEw1Ck!FKDT~nI+)kf?x!l1+bUXr z9Fz#E@sbfPoqS@yRJe^!o=+`mc`i&A$Kzb?$A3t$;}Uj_ac$Ywkl&Gu`)+qCC9{NO>KP?J8|E#%(Aflm?X%xe}=Z z9xw1`v_mTp36rC7sS_>rT}dqVOPG?Bx6wGxO@ZV?SQD}Qn+4ThC@1sADnD)%5j37u z4-z^JHYQ0gc9)YJtC1=y1-c|vZY;oF>rb8bxnm8cN-lmTO$g}?12{KI8tJP=9BGDV zH!lkNxR*lN%uj!5?-(hv=`F4}P{JE7TcIwfmE-pmWXkh`+_ zybeuS0G-Y@hV~a#4>kDdm(e}?jcwXrxxxs-G1wZt8Yx=Ukeuyzj^>w5sIPeS1Xx^| zeMcLqM%d26)mHo^Uud)h=R@3r87U!ACkGMZ{6!7c*Fs;3DqL^HBcdgTNUt=2IM`B8 zJKz2(?k3il!H)|m^DE=!X1dx!P&|TRjKq4(tdnFMOin$fvY_n#Od?$F9Eu|nlYiGj zhMZGuJkYroY%VD2@)ae@W{aj4a^4X0ttEX!uFALvC#?kHVxj?KdGV1g|1^1Dq(0Zq zD(Rw&n&RSi#Jsf*X(jy6xsUp=TYJ z#f4_V13sb>1W7IyAsxG*9qAd3EjOuIKb3xeHZeDzJFR%uJTkM0nh$NC-bE-xfwlNi zY{NPR+iIn=?2lpA(I4`<8EyJJ&khG@m@a7$lzDb|wCm{Jw6lH$QHlvRYBarjkM$0tI)(S@hFAFEFeCE!< zxXD|G2`qIJ0%^M|CwI8%j0(%92(GO<#t7C%^^GS+ zT_uUt`*mK)eXaY8&RY~Cih-Xf<;7>7i3yZm8BMp-tjsehZ~c;(R-yG1nh*X9oL{Yz}_p$ciqi?WrZfxEleSVYG(8#y(gCk>{@#(tt0l1Zzr_x zpqUE$we03I+$a!mrQ!H2e>hwgzBx%ZH>v;uOuQjDviU^I4z2l?Q}bkY7R|MV|z zMaxTQWvP2~pz{O_aq!;gYR;d@(?wXvcs`*DBCtQDhsPL> zjFf6Z*H`d+CgQW?6?@dDQ0ogi9n&0ZSPnL4^5`R@bR@R0VoF}<3^;`_E;lciw*rw( zAoUY8oXV*q347M=Sywm(_d+l|h)r)AD8MEm`AEUC=hKFwq1DgbMtKxH{y=UP5O6A=X45?g4eK z?wv5ralEBcOG1qRqvMk2Ld~#(vn*?v^Z54evHbH)A|$ht#}03sctxktj8oRwmRh_- z6xaW`vdx6>rD5L7$l`u8C2tNh^te6+7G(JJMO-HJ+FahqCziP-ood=_n zz>8!Ax6AUJn%6ef&HD#d=l9S~93X&{deFZtS93nK?7<))lUDg~fU1?Mn2!NL2z>x^gs(et%3uZ8Kdhd3|b*F|#=T>30|G++#wiE>P%np=>g=}{;` zgYR%~U^YT1EpDQO+L%@JRVUxgYNv`wrQ+&9r_M`aK&rLDzHk2NNhp{{T+JP9EDCpnbbc{CVX^!}xJ5IH= ze|8u8_#^#i&T4-*O%Kw~KL&I%nxKK-{2-@R_`ml>|E1UX|HhaH_;$1V`wx2>rt3Rp Z-(KRWpoAmQBbx>}o&ue$IezKZe*x@1!IuC4 literal 0 HcmV?d00001 diff --git a/education/windows/take-a-test-app-technical.md b/education/windows/take-a-test-app-technical.md index 3f410e8d68..3245416d58 100644 --- a/education/windows/take-a-test-app-technical.md +++ b/education/windows/take-a-test-app-technical.md @@ -24,7 +24,7 @@ Assessment vendors can use Take a Test as a platform to lock down the operating ## PC lockdown for assessment - When the assessment page initiates lock down, the user’s desktop will be locked and the app will be launched above the Windows lock screen to provide a sandbox that ensures the user can only interact with the Take a Test app . After transitioning to the lock screen, Take a Test will apply local MDM policies to further lock down the device. The whole process of going above the lock screen and applying policies is what defines lockdown. The whole lockdown process is atomic, which means that if any part of the lockdown operation fails, the app will not be above lock and won't have any of the policies applied. + When the assessment page initiates lock down, the student’s desktop will be locked and the app will be launched above the Windows lock screen to provide a sandbox that ensures the student can only interact with the Take a Test app . After transitioning to the lock screen, Take a Test will apply local MDM policies to further lock down the device. The whole process of going above the lock screen and applying policies is what defines lockdown. The lockdown process is atomic, which means that if any part of the lockdown operation fails, the app will not be above lock and won't have any of the policies applied. When running above the lock screen: - The app runs full screen with no chrome @@ -64,14 +64,14 @@ When Take a Test is running, the following functionality is available to student - Full screen mode is compatible -- The user can press Alt+Tab when locked down. This results in the user being able to switch between the following: +- The student can press Alt+Tab when locked down. This results in the student being able to switch between the following: - Take a Test - Assistive technology that may be running - Lock Screen - > **Note** The app will exit if the user logs into an account from the lock screen. Progress made in the test may be lost or invalidated. + > **Note** The app will exit if the student signs in to an account from the lock screen. Progress made in the test may be lost or invalidated. -- The user can exit the test by pressing one of the following key combinations: +- The student can exit the test by pressing one of the following key combinations: - Ctrl+Alt+Del diff --git a/education/windows/take-a-test-multiple-pcs.md b/education/windows/take-a-test-multiple-pcs.md index ddaedb6e10..c55210f810 100644 --- a/education/windows/take-a-test-multiple-pcs.md +++ b/education/windows/take-a-test-multiple-pcs.md @@ -26,63 +26,190 @@ Many schools use online testing for formative and summative assessments. It's cr - Students can’t change settings, extend their display, see notifications, get updates, or use autofill features. - Cortana is turned off. -> **Tip!** -> To exit **Take a Test**, press Ctrl+Alt+Delete. -**Take a Test** is included in Windows 10 Education. To add **Take a Test** to other editions of Windows 10, see [Add the Take a Test app to Windows 10](#add-the-take-a-test-app-to-windows-10) +**Take a Test** is included in Windows 10 Education. To add **Take a Test** to other editions of Windows 10, see [Add the Take a Test app to Windows 10](take-tests-in-windows-19.md#add-the-take-a-test-app-to-windows-10) ## How you use Take a Test ![Use test account or test url in Take a Test](images/take-a-test-flow.png) -- **Use a test URL and a [dedicated testing account](#set-up-a-dedicated-test-account)** - A user logs into the account and the **Take a Test** app automatically launches the pre-configured assessment URL in Microsoft Edge in a single-app, kiosk mode. A student will never have access to the desktop in this configuration. We recommend this configuration for high stakes testing. +- **Use a test URL and a [dedicated testing account](#set-up-a-dedicated-test-account)** - A user signs in to the account and the **Take a Test** app automatically launches the pre-configured assessment URL in Microsoft Edge in a single-app, kiosk mode. A student will never have access to the desktop in this configuration. We recommend this configuration for high stakes testing. - **[Put a test URL with an included prefix](#provide-link-to-test) on a web page or OneNote for students to click** - This allows teachers and test administrators an easier way to deploy assessments. We recommend this method for lower stakes assessments. ## Set up a dedicated test account -- To configure a dedicated test account on a single PC, [use Settings](#set-up-test-account-on-a-single-pc). -- To configure a dedicated test account on multiple PCs, you can use: - - [Mobile device management (MDM) or Microsoft System Center Configuration Manager](#set-up-test-account-in-mdm-or-configuration-manager) - - [A provisioning package](#set-up-test-account-in-a-provisioning-package) created in Windows Imaging and Configuration Designer (ICD) - - [Group Policy](#set-up-test-account-in-group-policy) to deploy a scheduled task that runs a Powershell script +To configure a dedicated test account on multiple PCs, you can use: +- [Mobile device management (MDM) or Microsoft System Center Configuration Manager](#set-up-test-account-in-mdm-or-configuration-manager) +- [A provisioning package](#set-up-test-account-in-a-provisioning-package) created in Windows Imaging and Configuration Designer (ICD) +- [Group Policy](#set-up-test-account-in-group-policy) to deploy a scheduled task that runs a Powershell script -### Set up a test account on a single PC - -1. Sign into the device with an administrator account. -2. Go to **Settings** > **Accounts** > **Work or school access** (final name needs to be updated, still TBD) > **Set up an account for taking tests**. -3. Select an account to use as the dedicated testing account. - >**Note**: If you don't have an account on the device, you can create a new account. To do this, go to **Settings** > **Accounts** > **Other Users** > **Add someone else to this PC** > **I don’t have this person’s sign-in information** > **Add a user without a Microsoft account**. -4. Specify an assessment URL. For - -5. Click **Save**. -6. To take the test, log into the selected account. - - ### Set up test account in MDM or Configuration Manager +1. Launch your management console. +2. Create a policy to set up single app kiosk mode, using the following values: + + - **Custom OMA-DM URI** = ./Vendor/MSFT/AssignedAccess/KioskModeApp + - **String value** = {"Account":"*redmond\\kioskuser*","AUMID":” Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy!App "} + + > Account can be in one of the following formats: + > - username + > - domain\username + > - computer name\\username + > - username@tenant.com + +3. Create a policy to configure the assessment URL, using the following values: + + - **Custom OMA-DM URI** = ./Vendor/MSFT/SecureAssessment/LaunchURI + - **String value** = *assessment URL* + > See [Assessment URLs](#assessment-urls) + +4. Create a policy that associates the assessment URL to the account, using the following values: + + - **Custom OMA-DM URI** = ./Vendor/MSFT/SecureAssessment/TesterAccount + - **String value** = Enter the account that you created in step 2, using the same account format. + +5. To take the test, the student signs in to the test account. + ### Set up test account in a provisioning package +Prerequisite: You must first [download the Windows ADK](https://msdn.microsoft.com/en-us/windows/hardware/dn913721.aspx) for Windows 10, Version 1607, and install Windows Imaging and Configuration Designer (ICD). + +**Create a provisioning package to set up a test account + +1. Open Windows ICD (by default, %windir%\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe). +2. Select **Advanced provisioning**. +3. Name your project, and click **Next**. +4. Select **All Windows desktop editions**, and click **Next**. +5. Click **Finish**. +6. Go to **Runtime settings** > **AssignedAccess** > **AssignedAccessSettings**. +7. Enter **{"Account":"*redmond\\kioskuser*","AUMID":” Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy!App "}**, using the account that you want to set up, as shown in the following image. + + ![Enter account and app for Assigned Access Settings](images/test-account-icd.png) + > Account can be in one of the following formats: + > - username + > - domain\username + > - computer name\\username + > - username@tenant.com + +8. Go to **Runtime settings** > **TakeATest**. +9. Enter the test URL in **LaunchURI**. +10. Enter the test account from step 7 in **TesterAccount**. +On the **File** menu, select **Save.** + +9. On the **Export** menu, select **Provisioning package**. + +10. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.** + +11. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing. + + - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen. + + - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select** and choosing the certificate you want to use to sign the package. + +12. Click **Next** to specify the output location where you want the provisioning package to go when it's built. By default, Windows ICD uses the project folder as the output location. + + Optionally, you can click **Browse** to change the default output location. + +13. Click **Next**. + +14. Click **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. + + If you need to cancel the build, click **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**. + +15. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again. + + If your build is successful, the name of the provisioning package, output directory, and project directory will be shown. + + - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build. + - If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**. + + **Apply the provisioning package** + + 1. Select the provisioning package that you want to apply, double-click the file, and then allow admin privileges. + +2. Consent to allow the package to be installed. + + After you allow the package to be installed, the settings will be applied to the device + +[Learn how to apply a provisioning package in audit mode or OOBE.](http://go.microsoft.com/fwlink/p/?LinkID=692012) + ### Set up test account in Group Policy +To set up a test account using Group Policy, first create a Powershell script that configures the test account and test URL, and then create a scheduled task to run the script. + #### Create a Powershell script +This sample Powershell script configures the test account and the test URL. Edit the sample to: +- Use your test account for **$obj.LaunchURI** +- Use your test URL for **$obj.TesterAccount** +- Use your test account for **-UserName** + +``` +$obj = get-wmiobject -namespace root/cimv2/mdm/dmmap -class MDM_SecureAssessment -filter "InstanceID='SecureAssessment' AND ParentID='./Vendor/MSFT'"; +$obj.LaunchURI='http://www.foo.com'; +$obj.TesterAccount='TestAccount'; +$obj.put() +Set-AssignedAccess -AppUserModelId Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy!App -UserName TestAccount +``` + + #### Create a scheduled task in Group Policy +1. Open the Group Policy Management Console. +2. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click **Edit**. +3. In the console tree under **Computer Configuration** or **User Configuration**, go to **Preferences** > **Control Panel Settings**. +4. Right-click **Scheduled Tasks**, point to **New**, and select **Scheduled Task**. +5. In the **New Scheduled Task Properties** dialog box, click **Change User or Group**. +6. In the **Select User or Group** dialog box, click **Advanced**. +7. In the **Advanced** dialog box, click **Find Now**. +8. Select **System** in the search results +9. Go back to the **Properties** dialog box and select **Run with highest privileges** under **Security options**. +9. Specify the operating system in the **Configure for** field. +9. Navigate to the **Actions** tab. +9. Create a new **Action**. +9. Configure the action to **Start a program**. +9. In the **Program/script** field, enter **powershell**. +9. In the **Add arguments** field, enter **-file “”**. +9. Click **OK**. +9. Navigate to the **Triggers** tab and create a new trigger. +9. Specify the trigger to be **On a schedule**. +9. Specify the trigger to be **One time**. +9. Specify the time the trigger should start. +9. Click **OK**. +9. In the **Settings** tab, select **Run task as soon as possible after a scheduled start is missed**. +9. Click **OK**. + + + ## Provide link to test -## Add the Take a Test app to Windows 10 +Anything hosted on the web can be presented in a locked down manner, not just assessments. To lock down online content, just embed a URL with a specific prefix and devices will be locked down when users follow the link. We recommend using this method for lower stakes assessments. + +1. Create a link to the test URL. Use **ms-edu-secureassessment:** before the URL and **!enforceLockdown** after the URL. +``` +ms-edu-secureassessment:!enforceLockdown + ``` + > **Note**: You may want to remove !enforceLockdown for tests that utilizes our lockdown API that checks for running processes before locking down. Removing !enforceLockdown will result in the app not locking down immediately which allows you to close apps that are not allowed to run during lockdown. The test web application may lock down the device once you have closed the apps. + +2. Distribute the link. You can use the web, email, OneNote, or any other method of your choosing. +3. To take the test, the student clicks on the link and provides user consent. -### Add Take a Test on a single PC -### Deploy Take a Test to multiple PCs ## Assessment URLs -This assessment URL utses our lockdown API: +This assessment URL uses our lockdown API: - SBAC/AIR: [http://mobile.tds.airast.org/launchpad/](http://mobile.tds.airast.org/launchpad/). +## Related topics +[Take tests in Windows 10](take-tests-in-windows-10.md) +[Set up Take a Test on a single PC](take-a-test-single-pc.md) + +[Set up Take a Test on multiple PCs](take-a-test-multiple-pcs.md) + +[Take a Test app technical reference](take-a-test-app-technical.md) diff --git a/education/windows/take-a-test-single-pc.md b/education/windows/take-a-test-single-pc.md index e3398a8957..add9c59143 100644 --- a/education/windows/take-a-test-single-pc.md +++ b/education/windows/take-a-test-single-pc.md @@ -35,7 +35,7 @@ The **Take a Test** app in Windows 10, Version 1607, creates the right environme ![Use test account or test url in Take a Test](images/take-a-test-flow.png) -- **Use a test URL and a [dedicated testing account](#set-up-a-dedicated-test-account)** - A user logs into the account and the **Take a Test** app automatically launches the pre-configured assessment URL in Microsoft Edge in a single-app, kiosk mode. A student will never have access to the desktop in this configuration. We recommend this configuration for high stakes testing. +- **Use a test URL and a [dedicated testing account](#set-up-a-dedicated-test-account)** - A user signs in to the account and the **Take a Test** app automatically launches the pre-configured assessment URL in Microsoft Edge in a single-app, kiosk mode. A student will never have access to the desktop in this configuration. We recommend this configuration for high stakes testing. - **[Put a test URL with an included prefix](#provide-link-to-test) on a web page or OneNote for students to click** - This allows teachers and test administrators an easier way to deploy assessments. We recommend this method for lower stakes assessments. ## Set up a dedicated test account @@ -52,7 +52,7 @@ The **Take a Test** app in Windows 10, Version 1607, creates the right environme 4. Specify an assessment URL. For 5. Click **Save**. -6. To take the test, log into the selected account. +6. To take the test, the student signs in to the selected account. @@ -62,10 +62,12 @@ The **Take a Test** app in Windows 10, Version 1607, creates the right environme Anything hosted on the web can be presented in a locked down manner, not just assessments. To lock down online content, just embed a URL with a specific prefix and devices will be locked down when users follow the link. We recommend using this method for lower stakes assessments. 1. Create a link to the test URL. Use **ms-edu-secureassessment:** before the URL and **!enforceLockdown** after the URL. -> ms-edu-secureassessment:!enforceLockdown +``` +ms-edu-secureassessment:!enforceLockdown + ``` 2. Distribute the link. You can use the web, email, OneNote, or any other method of your choosing. -3. To take the test, click on the link and provide user consent. +3. To take the test, the student clicks on the link and provides user consent. ## Related topics diff --git a/education/windows/take-tests-in-windows-10.md b/education/windows/take-tests-in-windows-10.md index c5dd2475e3..09ed708476 100644 --- a/education/windows/take-tests-in-windows-10.md +++ b/education/windows/take-tests-in-windows-10.md @@ -33,7 +33,7 @@ Many schools use online testing for formative and summative assessments. It's cr ![Use test account or test url in Take a Test](images/take-a-test-flow.png) -- **Use a test URL and a dedicated testing account** - A user logs into the account and the **Take a Test** app automatically launches the pre-configured assessment URL in Microsoft Edge in a single-app, kiosk mode. A student will never have access to the desktop in this configuration. We recommend this configuration for high stakes testing. +- **Use a test URL and a dedicated testing account** - A user signs in to the account and the **Take a Test** app automatically launches the pre-configured assessment URL in Microsoft Edge in a single-app, kiosk mode. A student will never have access to the desktop in this configuration. We recommend this configuration for high stakes testing. - **Put a test URL with an included prefix on a web page or OneNote for students to click** - This allows teachers and test administrators an easier way to deploy assessments. We recommend this method for lower stakes assessments. [Learn how to set up Take a Test on a single PC](take-a-test-single-pc.md) @@ -42,7 +42,7 @@ Many schools use online testing for formative and summative assessments. It's cr ## Add the Take a Test app to Windows 10 -You can add the Take a Test app to Windows 10 Home, Pro, and Enterprise. +You can add the Take a Test app to Windows 10 Pro and Enterprise. ### Add Take a Test on a single PC From eefc119cc3135e2fc90a10fedf937d9a775403db Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 17 May 2016 13:31:52 -0700 Subject: [PATCH 309/439] fix broken link --- education/windows/take-a-test-multiple-pcs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/education/windows/take-a-test-multiple-pcs.md b/education/windows/take-a-test-multiple-pcs.md index c55210f810..116da7017f 100644 --- a/education/windows/take-a-test-multiple-pcs.md +++ b/education/windows/take-a-test-multiple-pcs.md @@ -27,7 +27,7 @@ Many schools use online testing for formative and summative assessments. It's cr - Cortana is turned off. -**Take a Test** is included in Windows 10 Education. To add **Take a Test** to other editions of Windows 10, see [Add the Take a Test app to Windows 10](take-tests-in-windows-19.md#add-the-take-a-test-app-to-windows-10) +**Take a Test** is included in Windows 10 Education. To add **Take a Test** to other editions of Windows 10, see [Add the Take a Test app to Windows 10](take-tests-in-windows-10.md#add-the-take-a-test-app-to-windows-10) ## How you use Take a Test From ac641a5aaf06ee57dab1372398add11832b95a47 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 17 May 2016 14:27:55 -0700 Subject: [PATCH 310/439] correct spelling --- education/windows/take-a-test-single-pc.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/education/windows/take-a-test-single-pc.md b/education/windows/take-a-test-single-pc.md index add9c59143..724aa1066b 100644 --- a/education/windows/take-a-test-single-pc.md +++ b/education/windows/take-a-test-single-pc.md @@ -49,9 +49,10 @@ The **Take a Test** app in Windows 10, Version 1607, creates the right environme 2. Go to **Settings** > **Accounts** > **Work or school access** (final name needs to be updated, still TBD) > **Set up an account for taking tests**. 3. Select an account to use as the dedicated testing account. >**Note**: If you don't have an account on the device, you can create a new account. To do this, go to **Settings** > **Accounts** > **Other Users** > **Add someone else to this PC** > **I don’t have this person’s sign-in information** > **Add a user without a Microsoft account**. -4. Specify an assessment URL. For +4. Specify an assessment URL. 5. Click **Save**. + 6. To take the test, the student signs in to the selected account. From 6c66b2faaf3fbee76a1941cf448ea18e42c8243a Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 18 May 2016 11:58:20 +1000 Subject: [PATCH 311/439] fix typo --- .../keep-secure/windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/windows-defender-advanced-threat-protection.md b/windows/keep-secure/windows-defender-advanced-threat-protection.md index 5637c81086..9567620fcb 100644 --- a/windows/keep-secure/windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/windows-defender-advanced-threat-protection.md @@ -76,7 +76,7 @@ detect sophisticated cyber-attacks, providing: Topic | Description :---|:--- -[Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md) | This overview topic for IT professionals provides information on the minimum requirements to use Windows Defender ATP such as network and data storage configuration, and endpoint hardware ans software requirements, and deployment channels. +[Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md) | This overview topic for IT professionals provides information on the minimum requirements to use Windows Defender ATP such as network and data storage configuration, and endpoint hardware and software requirements, and deployment channels. [Onboard endpoints and set up access](onboard-configure-windows-defender-advanced-threat-protection.md) | You'll need to onboard and configure the Windows Defender ATP service and the endpoints in your network before you can use the service. Learn about how you can assign users to the Windows Defender ATP service in Azure Active Directory (AAD) and using a configuration package to configure endpoints. [Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md)| Learn about how Windows Defender ATP collects and handles information and where data is stored. [Portal overview](portal-overview-windows-defender-advanced-threat-protection.md) | Understand the main features of the service and how it leverages Microsoft technology to protect enterprise endpoints from sophisticated cyber attacks. From b6e62b9e8c3509f70c2d26c28b8faf3a75af64e8 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 18 May 2016 11:31:53 -0700 Subject: [PATCH 312/439] Bug# 7594539 --- ...nfigure-windows-10-devices-to-stop-data-flow-to-microsoft.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md b/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md index df77f2d6aa..bfc720cc35 100644 --- a/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md +++ b/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md @@ -447,6 +447,8 @@ You can turn off NCSI through Group Policy: - Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Internet Communication Management** > **Internet Communication Settings** > **Turn off Windows Network Connectivity Status Indicator active tests** +> **Note** After you apply this policy, you must restart the device for the policy setting to take effect. + ### 11. Offline maps You can turn off the ability to download and update offline maps. From 880130b4795bd1e0bb2bab30a4f5f7cc84bdb3c3 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 18 May 2016 11:49:50 -0700 Subject: [PATCH 313/439] added text about keeping firmware up-to-date --- windows/keep-secure/credential-guard.md | 2 +- .../keep-secure/device-guard-certification-and-compliance.md | 2 +- windows/keep-secure/device-guard-deployment-guide.md | 2 +- windows/whats-new/device-guard-overview.md | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index 76c99f5114..c37f56db42 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -88,7 +88,7 @@ The PC must meet the following hardware and software requirements to use Credent

    Secure firmware update process

    -

    To verify that the firmware complies with the secure firmware update process, you can validate it against the [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot) Windows Hardware Compatibility Program requirement.

    +

    To verify that the firmware complies with the secure firmware update process, you can validate it against the [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot) Windows Hardware Compatibility Program requirement.

    Credential Guard relies on the security of the underlying hardware and firmware. It is critical to keep the firmware updated with the latest security fixes.

    The firmware is updated for [Secure MOR implementation](http://msdn.microsoft.com/library/windows/hardware/mt270973.aspx)

    diff --git a/windows/keep-secure/device-guard-certification-and-compliance.md b/windows/keep-secure/device-guard-certification-and-compliance.md index d9d3bedae8..a9dc210597 100644 --- a/windows/keep-secure/device-guard-certification-and-compliance.md +++ b/windows/keep-secure/device-guard-certification-and-compliance.md @@ -86,7 +86,7 @@ The following table shows the hardware and software you need to install and conf

    Secure firmware update process

    -

    To verify that the firmware complies with the secure firmware update process, you can validate it against the [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot) Windows Hardware Compatibility Program requirement.

    +

    To verify that the firmware complies with the secure firmware update process, you can validate it against the [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot) Windows Hardware Compatibility Program requirement.

    Device Guard relies on the security of the underlying hardware and firmware. It is critical to keep the firmware updated with the latest security fixes.

    Signed processor microcode updates

    diff --git a/windows/keep-secure/device-guard-deployment-guide.md b/windows/keep-secure/device-guard-deployment-guide.md index 828d6e54a0..2c5e0c6587 100644 --- a/windows/keep-secure/device-guard-deployment-guide.md +++ b/windows/keep-secure/device-guard-deployment-guide.md @@ -141,7 +141,7 @@ Different hardware features are required to implement the various features of De

    Secure firmware update process

    -

    To verify that the firmware complies with the secure firmware update process, you can validate it against the [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot) Windows Hardware Compatibility Program requirement.

    +

    To verify that the firmware complies with the secure firmware update process, you can validate it against the [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot) Windows Hardware Compatibility Program requirement.

    Device Guard relies on the security of the underlying hardware and firmware. It is critical to keep the firmware updated with the latest security fixes.

    Signed processor microcode updates

    diff --git a/windows/whats-new/device-guard-overview.md b/windows/whats-new/device-guard-overview.md index 3f96f76b76..aac1e9b637 100644 --- a/windows/whats-new/device-guard-overview.md +++ b/windows/whats-new/device-guard-overview.md @@ -80,7 +80,7 @@ The following table shows the hardware and software you need to install and conf

    Secure firmware update process

    -

    To verify that the firmware complies with the secure firmware update process, you can validate it against the [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot) Windows Hardware Compatibility Program requirement.

    +

    To verify that the firmware complies with the secure firmware update process, you can validate it against the [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot) Windows Hardware Compatibility Program requirement.

    Device Guard relies on the security of the underlying hardware and firmware. It is critical to keep the firmware updated with the latest security fixes.

    From f53721da511aff74e9a76d2ef76be2df11c41815 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 18 May 2016 12:02:55 -0700 Subject: [PATCH 314/439] fixing spacing issues --- windows/keep-secure/credential-guard.md | 4 +--- .../device-guard-certification-and-compliance.md | 7 ++++++- windows/keep-secure/device-guard-deployment-guide.md | 7 +++++++ windows/whats-new/applocker.md | 6 ++++++ windows/whats-new/device-guard-overview.md | 5 ++++- 5 files changed, 24 insertions(+), 5 deletions(-) diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index c37f56db42..76b0ac81b6 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -82,9 +82,7 @@ The PC must meet the following hardware and software requirements to use Credent
    Note  If you don't have a TPM installed, Credential Guard will still be enabled, but the keys used to encrypt Credential Guard will not be protected by the TPM.
    -
    -  -
    +

    Secure firmware update process

    diff --git a/windows/keep-secure/device-guard-certification-and-compliance.md b/windows/keep-secure/device-guard-certification-and-compliance.md index a9dc210597..9edecd273d 100644 --- a/windows/keep-secure/device-guard-certification-and-compliance.md +++ b/windows/keep-secure/device-guard-certification-and-compliance.md @@ -11,18 +11,23 @@ author: brianlic-msft # Device Guard certification and compliance **Applies to** - Windows 10 + Device Guard is a combination of hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications. If the app isn’t trusted it can’t run, period. It also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code after the computer restarts because of how decisions are made about what can run and when. Device Guard uses the new virtualization-based security in Windows 10 to isolate the Code Integrity service from the Windows kernel itself, letting the service use signatures defined by your enterprise-controlled policy to help determine what is trustworthy. In effect, the Code Integrity service runs alongside the kernel in a Windows hypervisor-protected container. For details on how to implement Device Guard, see [Device Guard deployment guide](device-guard-deployment-guide.md). ## Why use Device Guard With thousands of new malicious files created every day, using traditional methods like signature-based detection to fight against malware provides an inadequate defense against new attacks. Device Guard on Windows 10 changes from a mode where apps are trusted unless blocked by an antivirus or other security solutions, to a mode where the operating system trusts only apps authorized by your enterprise. Device Guard also helps protect against [zero day attacks](http://go.microsoft.com/fwlink/p/?linkid=534209) and works to combat the challenges of [polymorphic viruses](http://go.microsoft.com/fwlink/p/?LinkId=534210). + ### Advantages to using Device Guard + You can take advantage of the benefits of Device Guard, based on what you turn on and use: - Helps provide strong malware protection with enterprise manageability - Helps provide the most advanced malware protection ever offered on the Windows platform - Offers improved tamper resistance + ## How Device Guard works + Device Guard restricts the Windows 10 operating system to only running code that’s signed by trusted signers, as defined by your Code Integrity policy through specific hardware and security configurations, including: - User Mode Code Integrity (UMCI) - New kernel code integrity rules (including the new Windows Hardware Quality Labs (WHQL) signing constraints) @@ -72,7 +77,7 @@ The following table shows the hardware and software you need to install and conf

    Firmware lock

    • The firmware setup should be locked to prevent other operating systems from starting and to prevent changes to the UEFI settings.

    • -
    • • Work with your hardware manufacturer to ensure that the devices are Device Guard ready

    • +
    • Work with your hardware manufacturer to ensure that the devices are Device Guard ready

    • You should require a firmware password or higher authentication to change firmware settings.

    diff --git a/windows/keep-secure/device-guard-deployment-guide.md b/windows/keep-secure/device-guard-deployment-guide.md index 2c5e0c6587..0c2654ac5b 100644 --- a/windows/keep-secure/device-guard-deployment-guide.md +++ b/windows/keep-secure/device-guard-deployment-guide.md @@ -11,13 +11,16 @@ author: challum # Device Guard deployment guide **Applies to** - Windows 10 + Microsoft Device Guard is a feature set that consists of both hardware and software system integrity hardening features that revolutionize the Windows operating system’s security. Windows 10 employs Device Guard as well as code integrity and advanced hardware features such as CPU virtualization extensions, Trusted Platform Module, and second-level address translation to offer comprehensive modern security to its users. This guide explores the individual features in Device Guard as well as how to plan for, configure, and deploy them. + ## Introduction to Device Guard Today’s security threat landscape is more aggressive than ever before. Modern malicious attacks are focused on revenue generation, intellectual property theft, and targeted system degradation, which results in financial loss. Many of these modern attackers are sponsored by nation states with unknown motives and large cyber terrorism budgets. These threats can enter a company through something as simple as an email message and can permanently damage its reputation for securing its software assets, as well as having significant financial impact. Windows 10 introduces several new security features that help mitigate a large percentage of today’s known threats. It is estimated that more than 300,000 new malware variants are discovered daily. Unfortunately, companies currently use an ancient method to discover this infectious software and prevent its use. In fact, current PCs trust everything that runs until malware signatures determine whether a threat exists; then, the antimalware software attempts to clean the PC, often after the malicious software’s effect has already been noticed. This signature-based system focuses on reacting to an infection and ensuring that the particular infection does not happen again. In this model, the system that drives malware detection relies on the discovery of malicious software; only then can a signature be provided to the client to remediate it, which implies that a computer must be infected first. The time between the detection of the malware and a client being issued a signature could mean the difference between losing data and staying safe. In addition to antimalware solutions, there are some “whitelisting” technologies available, including AppLocker. These technologies perform single instance, or blanket-allow or blanket-deny rules for running applications. Although this is more preventative than signature-based detection, it requires significant ongoing maintenance. In Windows 10, these applications are most effective when they are deployed alongside Microsoft Device Guard. Device Guard breaks the current model of detection first-block later, and allows only trusted applications to run, period. This methodology is consistent with the successful prevention strategy for mobile phone security. With Device Guard, Microsoft has changed how the Windows operating system handles untrusted applications, which makes its defenses difficult for malware to penetrate. This new prevention versus detection model provides Windows clients with the necessary security for modern threats and, when implemented, makes most of today’s threats completely obsolete from day one. Device Guard's features revolutionize the Windows operating system’s security by taking advantage of new virtualization-based security (VBS) options and the trust-nothing mobile device operating system model, which makes its defenses much more difficult for malware to penetrate. By using configurable code integrity policies, organizations are able to choose exactly which applications are allowed to run in their environment. Configurable code integrity is not limited to Windows Store applications and can be used with existing unsigned or signed Win32 applications, without the requirement that the application be repackaged. In addition, configurable code integrity can be deployed as an individual feature if organizations don’t possess the required hardware for Device Guard. Along with code integrity, Windows 10 leverages advanced hardware features such as CPU virtualization extensions, input/output memory management units (IOMMUs), Trusted Platform Module (TPM), and second-level address translation (SLAT) to offer comprehensive modern security to its users. Device Guard deployed with configurable code integrity and Credential Guard will be among the most impactful client-side security deployments an organization can implement today. In this guide, you learn about the individual features found within Device Guard as well as how to plan for, configure, and deploy them. Device Guard with configurable code integrity is intended for deployment alongside additional threat-mitigating Windows features such as Credential Guard and AppLocker. + ## Device Guard overview Device Guard is a feature set that consists of both hardware and software system integrity hardening features. These features revolutionize the Windows operating system’s security by taking advantage of new virtualization-based security options and the trust-nothing mobile device operating system model. A key feature in this model is called *configurable code integrity*, which allows your organization to choose exactly which software or trusted software publishers are allowed to run code on your client machines—exactly what has made mobile phone security so successful. In addition, Device Guard offers organizations a way to sign existing line-of-business (LOB) applications so that they can trust their own code, without the requirement that the application be repackaged. Also, this same method of signing provides organizations with a way to trust individual third-party applications. Device Guard—with configurable code integrity, Credential Guard, and AppLocker—is the most complete security defense that any Microsoft product has ever been able to offer a Windows client. Advanced hardware features such as CPU virtualization extensions, IOMMUs, and SLAT, drive these new client security offerings. By integrating these hardware features further into the core operating system, Windows 10 leverages them in new ways. For example, the same type 1 hypervisor technology that is used to run virtual machines in Microsoft Hyper-V is used to isolate core Windows services into a virtualization-based, protected container. This is just one example of how Windows 10 integrates advanced hardware features deeper into the operating system to offer comprehensive modern security to its users. These hardware features are now available in consumer and enterprise PC markets and are discussed in detail in the [Hardware considerations](#hardware-considerations) section. @@ -42,13 +45,17 @@ You can easily manage Device Guard features by using the familiar enterprise and - **Microsoft Intune**. In a future release of Microsoft Intune, organizations will be able to leverage Intune for deployment and management of code integrity policies and catalog files. - **Windows PowerShell**. Windows PowerShell is primarily used to create and service code integrity policies. These policies represent the most powerful component of Device Guard. For a step-by-step walkthrough of how to create, audit, service, enforce, and deploy code integrity policies, see the [Code integrity policies](#code-integrity-policies) section. These options provide the same experience you are used to in order to manage your existing enterprise management solutions. For more information about how to manage and deploy Device Guard hardware and code integrity features in your organization, see the [Device Guard deployment](#dg-deployment) section. + ## Plan for Device Guard + In this section, you will learn about the following topics: - [Approach enterprise code integrity deployment](#approach-enterprise-code-integrity-deployment). Device Guard deployment in your organization requires a planned approach. In this section, you get high-level recommendations for how to approach enterprise code integrity deployment in your organization. - [Device Guard deployment scenarios](#device-guard-deployment-scenarios). When you plan for Device Guard deployment, Microsoft recommends that you categorize each device in your organization into a deployment scenario. These scenarios will provide a roadmap for your Device Guard deployment. - [Code signing adoption](#code-signing-adoption). Code signing is important to the security that Device Guard provides. This section outlines the options for code signing and the benefits and disadvantages of each method. - [Hardware considerations](#hardware-considerations). Several Device Guard features require advanced hardware. This section outlines the requirements for each of those features and what to look for during your next hardware refresh. + ## Approach enterprise code integrity deployment + Enterprises that want to consider Device Guard should not expect deployment to their entire organization overnight. Device Guard implementation requires that you plan for both end-user and IT pro impact. In addition, the deployment of Device Guard features to your enterprise requires a planned, phased approach to ensure that end-user systems are fully capable and ready to enforce these new security restrictions. Perform the following high-level tasks to approach the deployment of Device Guard to your enterprise: 1. **Group devices into similar functions**. Categorize machines into the groups described in the [Device Guard deployment scenarios](#device-guard-deployment-scenarios) section. This begins the roadmap for your Device Guard deployment and provides groups of easier and more difficult implementations. From there, assess the quantity of necessary Device Guard policies. The easiest solution is to lock down your entire enterprise, but it might not fit your individual departments’ needs. To discover an appropriate number of policies for your organization, try to separate the defined groups into departments or roles. Then ask some questions: What software does each department or role need to do their job? Should they be able to install and run other departments’ software? Do we need to create a base code integrity policy that aligns with our application catalog? Should users be able to install any application or only choose from an “allowed” list? Do we allow users to use their own peripheral devices? These questions will help you discover the number of necessary policies for your organization. Finally, try to focus on which people or departments would require an additional level of privileges. For example, should department x be able to install and run application xyz, even though no other department does? If the answer is yes and justifiable, you will need a secondary code integrity policy for that group. If not, you will likely be able to merge several policies to simplify management. For more information about configurable code integrity policies, see the [Code integrity policies](#code-integrity-policies) section. diff --git a/windows/whats-new/applocker.md b/windows/whats-new/applocker.md index bd120e6f15..cd25de1dee 100644 --- a/windows/whats-new/applocker.md +++ b/windows/whats-new/applocker.md @@ -8,16 +8,22 @@ ms.mktglfcycl: explore ms.sitesec: library author: brianlic-msft --- + # What's new in AppLocker? + **Applies to** - Windows 10 - Windows 10 Mobile + AppLocker helps you control which apps and files users can run. These include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers. In Windows 10, AppLocker has added some improvements. + ## New features in Windows 10 + - A new parameter was added to the [New-AppLockerPolicy](http://technet.microsoft.com/library/hh847211.aspx) Windows PowerShell cmdlet that lets you choose whether executable and DLL rule collections apply to non-interactive processes. To enable this, set the **ServiceEnforcement** to **Enabled**. - A new [AppLocker](http://msdn.microsoft.com/library/windows/hardware/dn920019.aspx) configuration service provider was add to allow you to enable AppLocker rules by using an MDM server. - You can manage Windows 10 Mobile devices by using the new [AppLocker CSP](http://msdn.microsoft.com/library/windows/hardware/dn920019.aspx). + [Learn how to manage AppLocker within your organization](../keep-secure/applocker-overview.md).     diff --git a/windows/whats-new/device-guard-overview.md b/windows/whats-new/device-guard-overview.md index aac1e9b637..bdb9a878db 100644 --- a/windows/whats-new/device-guard-overview.md +++ b/windows/whats-new/device-guard-overview.md @@ -3,16 +3,19 @@ title: Device Guard overview (Windows 10) description: Device Guard is a combination of enterprise-related hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications. ms.assetid: FFE244EE-5804-4CE8-A2A9-48F49DC3AEF2 ms.pagetype: security -keywords: ["Device Guard"] +keywords: Device Guard ms.prod: W10 ms.mktglfcycl: explore ms.sitesec: library author: brianlic-msft --- + # Device Guard overview + **Applies to** - Windows 10 - Windows 10 Mobile + Device Guard is a combination of enterprise-related hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications. If the app isn’t trusted it can’t run, period. It also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code after the computer restarts because of how decisions are made about what can run and when. Device Guard uses the new virtualization-based security in Windows 10 Enterprise to isolate the Code Integrity service from the Microsoft Windows kernel itself, letting the service use signatures defined by your enterprise-controlled policy to help determine what is trustworthy. In effect, the Code Integrity service runs alongside the kernel in a Windows hypervisor-protected container. For details on how to implement Device Guard, see [Device Guard deployment guide](../keep-secure/device-guard-deployment-guide.md). From 2d5740897a69249fd8fbf592d14fb32c9229955f Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 18 May 2016 13:31:59 -0700 Subject: [PATCH 315/439] fixing spacing issues --- windows/whats-new/bitlocker.md | 14 +++- windows/whats-new/credential-guard.md | 6 ++ windows/whats-new/edp-whats-new-overview.md | 40 +++++++++-- .../whats-new/lockdown-features-windows-10.md | 8 ++- windows/whats-new/microsoft-passport.md | 16 ++++- windows/whats-new/security-auditing.md | 28 +++++++- windows/whats-new/security.md | 69 ++++++++++++++++++- windows/whats-new/user-account-control.md | 11 ++- 8 files changed, 173 insertions(+), 19 deletions(-) diff --git a/windows/whats-new/bitlocker.md b/windows/whats-new/bitlocker.md index d84850daca..d0b31ecfc5 100644 --- a/windows/whats-new/bitlocker.md +++ b/windows/whats-new/bitlocker.md @@ -2,18 +2,23 @@ title: What's new in BitLocker (Windows 10) description: BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned computers. ms.assetid: 3F2DE365-68A1-4CDB-AB5F-C65574684C7B -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: explore ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # What's new in BitLocker? + **Applies to** - Windows 10 - Windows 10 Mobile + BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned computers. + ## New features in Windows 10, version 1511 + - **XTS-AES encryption algorithm**. BitLocker now supports the XTS-AES encryption algorithm. XTS-AES provides additional protection from a class of attacks on encryption that rely on manipulating cipher text to cause predictable changes in plain text. BitLocker supports both 128-bit and 256-bit XTS-AES keys. It provides the following benefits: - The algorithm is FIPS-compliant. @@ -22,11 +27,14 @@ BitLocker Drive Encryption is a data protection feature that integrates with the Drives encrypted with XTS-AES will not be accessible on older version of Windows. This is only recommended for fixed and operating system drives. Removable drives should continue to use the AES-CBC 128-bit or AES-CBC 256-bit algorithms.   ## New features in Windows 10 + - **Encrypt and recover your device with Azure Active Directory**. In addition to using a Microsoft Account, automatic [Device Encryption](http://technet.microsoft.com/library/dn306081.aspx#bkmk-encryption) can now encrypt your devices that are joined to an Azure Active Directory domain. When the device is encrypted, the BitLocker recovery key is automatically escrowed to Azure Active Directory. This will make it easier to recover your BitLocker key online. - **DMA port protection**. You can use the [DataProtection/AllowDirectMemoryAccess](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) MDM policy to block DMA ports when the device is starting up. Also, when a device is locked, all unused DMA ports are turned off, but any devices that are already plugged into a DMA port will continue to work. When the device is unlocked, all DMA ports are turned back on. - **New Group Policy for configuring pre-boot recovery**. You can now configure the pre-boot recovery message and recover URL that is shown on the pre-boot recovery screen. For more info, see the "Configure pre-boot recovery message and URL" section in [BitLocker Group Policy settings](../keep-secure/bitlocker-group-policy-settings.md). + [Learn how to deploy and manage BitLocker within your organization](../keep-secure/bitlocker-overview.md). + ## Related topics + [Trusted Platform Module](../keep-secure/trusted-platform-module-overview.md) -  -  +  \ No newline at end of file diff --git a/windows/whats-new/credential-guard.md b/windows/whats-new/credential-guard.md index 3e2f96703b..148a76ff4e 100644 --- a/windows/whats-new/credential-guard.md +++ b/windows/whats-new/credential-guard.md @@ -8,17 +8,23 @@ ms.mktglfcycl: explore ms.sitesec: library author: brianlic-msft --- + # What's new in Credential Guard? + **Applies to** - Windows 10 + Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. + ## New features in Windows 10, version 1511 + - **Credential Manager support**. Credentials that are stored with Credential Manager, including domain credentials, are protected with Credential Guard with the following considerations: - Credentials that are saved by the Remote Desktop Protocol cannot be used. Employees in your organization can manually store credentials in Credential Manager as generic credentials. - Applications that extract derived domain credentials using undocumented APIs from Credential Manager will no longer be able to use those saved derived credentials. - You cannot restore credentials using the Credential Manager control panel if the credentials were backed up from a PC that has Credential Guard turned on. If you need to back up your credentials, you must do this before you enable Credential Guard. Otherwise, you won't be able to restore those credentials. - **Enable Credential Guard without UEFI lock**. You can enable Credential Guard by using the registry. This allows you to disable Credential Guard remotely. However, we recommend that Credential Guard is enabled with UEFI lock. You can configure this by using Group Policy. - **CredSSP/TsPkg credential delegation**. CredSSP/TsPkg cannot delegate default credentials when Credential Guard is enabled. + [Learn how to deploy and manage Credential Guard within your organization](../keep-secure/credential-guard.md).     diff --git a/windows/whats-new/edp-whats-new-overview.md b/windows/whats-new/edp-whats-new-overview.md index 897cfe191b..26e5b09d9b 100644 --- a/windows/whats-new/edp-whats-new-overview.md +++ b/windows/whats-new/edp-whats-new-overview.md @@ -2,21 +2,28 @@ title: Enterprise data protection (EDP) overview (Windows 10) description: With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data disclosure through apps and services that are outside of the enterprise’s control like email, social media, and the public cloud. ms.assetid: 428A3135-CB5E-478B-B1FF-B6EB76F0DF14 -ms.pagetype: security -keywords: ["EDP Overview", "EDP"] +keywords: EDP Overview, EDP ms.prod: W10 ms.mktglfcycl: explore ms.sitesec: library +ms.pagetype: security author: eross-msft --- + # Enterprise data protection (EDP) overview + **Applies to:** - Windows 10 Insider Preview - Windows 10 Mobile Preview + [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows 10 Anniversary SDK Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.] + With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data disclosure through apps and services that are outside of the enterprise’s control like email, social media, and the public cloud. + Many of the existing solutions try to address this issue by requiring employees to switch between personal and work containers and apps, which can lead to a less than optimal user experience. The feature code-named enterprise data protection (EDP) offers a better user experience, while helping to better separate and protect enterprise apps and data against disclosure risks across both company and personal devices, without requiring changes in environments or apps. Additionally, EDP when used with Rights Management Services (RMS), can help to protect your enterprise data locally, persisting the protection even when your data roams or is shared. + ## Benefits of EDP + EDP provides: - Additional protection against enterprise data leakage, with minimal impact on employees’ regular work practices. - Obvious separation between personal and corporate data, without requiring employees to switch environments or apps. @@ -26,39 +33,64 @@ EDP provides: - Integration with your existing management system (Microsoft Intune, System Center Configuration Manager (version 1511 or later)’, or your current mobile device management (MDM) system) to configure, deploy, and manage EDP for your company. - Additional protection for your data (through RMS integration) while roaming and sharing, like when you share encrypted content through Outlook or move encrypted files to USB keys. - Ability to manage Office universal apps on Windows 10 devices using an MDM solution to help protect corporate data. To manage Office mobile apps for Android and iOS devices, see technical resources [here]( http://go.microsoft.com/fwlink/p/?LinkId=526490). + ## Enterprise scenarios + EDP currently addresses these enterprise scenarios: - You can encrypt enterprise data on employee-owned and corporate-owned devices. - You can remotely wipe enterprise data off managed computers, including employee-owned computers, without affecting the personal data. - You can select specific apps that can access enterprise data, called "protected apps" that are clearly recognizable to employees. You can also block non-protected apps from accessing enterprise data. - Your employees won't have their work otherwise interrupted while switching between personal and enterprise apps while the enterprise policies are in place. Switching environments or signing in multiple times isn’t required. + ### Enterprise data security + As an enterprise admin, you need to maintain the security and confidentiality of your corporate data. Using EDP you can help ensure that your corporate data is protected on your employee-owned computers, even when the employee isn’t actively using it. In this case, when the employee initially creates the content on a managed device he’s asked whether it’s a work document. If it's a work document, it becomes locally-protected as enterprise data. + ### Persistent data encryption + EDP helps keep your enterprise data protected, even when it roams. Apps like Office and OneNote work with EDP to persist your data encryption across locations and services. For example, if an employee opens EDP-encrypted content from Outlook, edits it, and then tries to save the edited version with a different name to remove the encryption, it won’t work. Outlook automatically applies EDP to the new document, keeping the data encryption in place. + ### Remotely wiping devices of enterprise data EDP also offers the ability to remotely wipe your corporate data from all devices managed by you and used by an employee, while leaving personal data alone. This is a benefit when an employee leaves your company, or in the case of a stolen computer. In this case, documents are stored locally, and encrypted with an enterprise identity. When you verify that you have to wipe the device, you can send a remote wipe command through your mobile device management system so when the device connects to the network, the encryption keys are revoked and the enterprise data is removed. This action only affects devices that have been targeted by the command. All other devices will continue to work normally. + ### Protected apps and restrictions + Using EDP you can control the set of apps that are made "protected apps", or apps that can access and use your enterprise data. After you add an app to your **Protected App** list, it’s trusted to use enterprise data. All apps not on this list are treated as personal and are potentially blocked from accessing your corporate data, depending on your EDP protection-mode. As a note, your existing line-of-business apps don’t have to change to be included as protected apps. You simply have to include them in your list. + ### Great employee experiences + EDP can offer a great user experience by not requiring employees to switch between apps to protect corporate data. For example, while checking work emails in Microsoft Outlook, an employee gets a personal message. Instead of having to leave Outlook, both the work and personal messages appear on the screen, side-by-side. + #### Using protected apps + Protected apps are allowed to access your enterprise data and will react differently with other non-protected or personal apps. For example, if your EDP-protection mode is set to block, your protected apps will let the employee copy and paste information between other protected apps, but not with personal apps. Imagine an HR person wants to copy a job description from a protected app to an internal career website, an enterprise-protected location, but goofs and tries to paste into a personal app instead. The paste action fails and a notification pops up, saying that it couldn’t paste because of a policy restriction. The HR person then correctly pastes to the career website and it works without a problem. + #### Copying or downloading enterprise data + Downloading content from a location like SharePoint or a network file share, or an enterprise web location, such as Office365.com automatically determines that the content is enterprise data and is encrypted as such, while it’s stored locally. The same applies to copying enterprise data to something like a USB drive. Because the content is already marked as enterprise data locally, the encryption is persisted on the new device. + #### Changing the EDP protection + Employees can change enterprise data protected documents back to personal if the document is wrongly marked as enterprise. However, this requires the employee to take an action and is audited and logged for you to review + ### Deciding your level of data access + EDP lets you decide to block, allow overrides, or silently audit your employee's data sharing actions. Blocking the action stops it immediately, while allowing overrides let the employee know there's a problem, but lets the employee continue to share the info, and silent just logs the action without stopping it, letting you start to see patterns of inappropriate sharing so you can take educative action. + ### Helping prevent accidental data disclosure to public spaces + EDP helps protect your enterprise data from being shared to public spaces, like the public cloud, accidentally. For example, if an employee stores content in the **Documents** folder, which is automatically synched with OneDrive (an app on your Protected Apps list), then the document is encrypted locally and not synched it to the user’s personal cloud. Likewise, if other synching apps, like Dropbox™, aren’t on the Protected Apps list, they also won’t be able to sync encrypted files to the user’s personal cloud. + ### Helping prevent accidental data disclosure to other devices + EDP helps protect your enterprise data from leaking to other devices while transferring or moving between them. For example, if an employee puts corporate data on a USB key that also includes personal data, the corporate data remains encrypted even though the personal information remains open. Additionally, the encryption continues when the employee copies the encrypted content back to another corporate-managed device. + ## Turn off EDP + You can turn off all enterprise data protection and restrictions, reverting to where you were pre-EDP, with no data loss. However, turning off EDP isn't recommended. If you choose to turn it off, you can always turn it back on, but EDP won't retain your decryption and policies info. + ## Related topics - [Protect your enterprise data using enterprise data protection (EDP)](../keep-secure/protect-enterprise-data-using-edp.md) -  -  +  \ No newline at end of file diff --git a/windows/whats-new/lockdown-features-windows-10.md b/windows/whats-new/lockdown-features-windows-10.md index f349f81f95..265ddba22a 100644 --- a/windows/whats-new/lockdown-features-windows-10.md +++ b/windows/whats-new/lockdown-features-windows-10.md @@ -2,18 +2,22 @@ title: Lockdown features from Windows Embedded 8.1 Industry (Windows 10) description: Many of the lockdown features available in Windows Embedded 8.1 Industry have been modified in some form for Windows 10. ms.assetid: 3C006B00-535C-4BA4-9421-B8F952D47A14 -ms.pagetype: security -keywords: ["lockdown", "embedded"] +keywords: lockdown, embedded ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: jdeckerMS --- + # Lockdown features from Windows Embedded 8.1 Industry + **Applies to** - Windows 10 - Windows 10 Mobile + Many of the lockdown features available in Windows Embedded 8.1 Industry have been modified in some form for Windows 10. This table maps Windows Embedded Industry 8.1 features to Windows 10 Enterprise features, along with links to documentation. + diff --git a/windows/whats-new/microsoft-passport.md b/windows/whats-new/microsoft-passport.md index 887187318a..6ee13afe28 100644 --- a/windows/whats-new/microsoft-passport.md +++ b/windows/whats-new/microsoft-passport.md @@ -2,28 +2,38 @@ title: Microsoft Passport overview (Windows 10) description: In Windows 10, Microsoft Passport replaces passwords with strong two-factor authentication. ms.assetid: 292F3BE9-3651-4B20-B83F-85560631EF5B -ms.pagetype: security -keywords: ["password", "hello", "fingerprint", "iris", "biometric"] +keywords: password, hello, fingerprint, iris, biometric ms.prod: W10 ms.mktglfcycl: explore ms.sitesec: library +ms.pagetype: security author: jdeckerMS --- + # Microsoft Passport overview **Applies to** - Windows 10 - Windows 10 Mobile + In Windows 10, Microsoft Passport replaces passwords with strong two-factor authentication that consists of an enrolled device and a Windows Hello (biometric) or PIN. + Microsoft Passport lets users authenticate to a Microsoft account, an Active Directory account, a Microsoft Azure Active Directory (AD) account, or non-Microsoft service that supports [Fast ID Online (FIDO)](http://go.microsoft.com/fwlink/p/?LinkId=533889) authentication. After an initial two-step verification during Microsoft Passport enrollment, a Microsoft Passport is set up on the user's device and the user sets a gesture, which can be Windows Hello or a PIN. The user provides the gesture to verify identity; Windows then uses Microsoft Passport to authenticate users and help them to access protected resources and services. Microsoft Passport also enables Windows 10 Mobile devices to be used as a remote credential when signing into Windows 10 PCs. During the sign-in process, the Windows 10 PC can connect using Bluetooth to access Microsoft Passport on the user’s Windows 10 Mobile device. Because users carry their phone with them, Microsoft Passport makes implementing two-factor authentication across the enterprise less costly and complex than other solutions + ## Benefits of Microsoft Passport + - **User convenience**. The employee provides credentials (such as account and password, or other credentials), and is then guided to set up Microsoft Passport and Hello. From that point on, the employee can access enterprise resources by providing a gesture. -- **Security**. Microsoft Passport helps protect user identities and user credentials. Because no passwords are used, it helps circumvent phishing and brute force attacks. It also helps prevent server breaches because Microsoft Passport credentials are an asymmetric key pair, which helps prevent replay attacks when these keys are generated within isolated environments of Trusted Platform Modules (TPMs). +- **Security**. Microsoft Passport helps protect user identities and user credentials. Because no passwords are used, it helps circumvent phishing and brute force attacks. It also helps prevent server breaches because Microsoft + +Passport credentials are an asymmetric key pair, which helps prevent replay attacks when these keys are generated within isolated environments of Trusted Platform Modules (TPMs). [Learn how to implement and manage Microsoft Passport in your organization.](../keep-secure/implement-microsoft-passport-in-your-organization.md) + ## Learn more + [Why a PIN is better than a password](../keep-secure/why-a-pin-is-better-than-a-password.md) [Windows 10: Disrupting the Revolution of Cyber-Threats with Revolutionary Security!](http://go.microsoft.com/fwlink/p/?LinkId=533890) [Windows 10: The End Game for Passwords and Credential Theft?](http://go.microsoft.com/fwlink/p/?LinkId=533891) + ## Related topics [Device management](device-management.md)   diff --git a/windows/whats-new/security-auditing.md b/windows/whats-new/security-auditing.md index 62101772be..92e3548a8c 100644 --- a/windows/whats-new/security-auditing.md +++ b/windows/whats-new/security-auditing.md @@ -2,31 +2,41 @@ title: What's new in security auditing (Windows 10) description: Security auditing is one of the most powerful tools that you can use to maintain the integrity of your system. ms.assetid: CB35A02E-5C66-449D-8C90-7B73C636F67B -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: explore ms.sitesec: library author: brianlic-msft +ms.pagetype: security --- + # What's new in security auditing? **Applies to** - Windows 10 - Windows 10 Mobile + Security auditing is one of the most powerful tools that you can use to maintain the integrity of your system. As part of your overall security strategy, you should determine the level of auditing that is appropriate for your environment. Auditing should identify attacks (successful or not) that pose a threat to your network, and attacks against resources that you have determined to be valuable in your risk assessment. + ## New features in Windows 10, version 1511 + - The [WindowsSecurityAuditing](http://go.microsoft.com/fwlink/p/?LinkId=690517) and [Reporting](http://go.microsoft.com/fwlink/p/?LinkId=690525) configuration service providers allow you to add security audit policies to mobile devices. + ## New features in Windows 10 + In Windows 10, security auditing has added some improvements: - [New audit subcategories](#bkmk-auditsubcat) - [More info added to existing audit events](#bkmk-moreinfo) + ### New audit subcategories + In Windows 10, two new audit subcategories were added to the Advanced Audit Policy Configuration to provide greater granularity in audit events: - [Audit Group Membership](../keep-secure/audit-group-membership.md) Found in the Logon/Logoff audit category, the Audit Group Membership subcategory allows you to audit the group membership information in a user's logon token. Events in this subcategory are generated when group memberships are enumerated or queried on the PC where the logon session was created. For an interactive logon, the security audit event is generated on the PC that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the PC hosting the resource. When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the **Audit Logon** setting under **Advanced Audit Policy Configuration\\System Audit Policies\\Logon/Logoff**. Multiple events are generated if the group membership information cannot fit in a single security audit event. - [Audit PNP Activity](../keep-secure/audit-pnp-activity.md) Found in the Detailed Tracking category, the Audit PNP Activity subcategory allows you to audit when plug and play detects an external device. Only Success audits are recorded for this category. If you do not configure this policy setting, no audit event is generated when an external device is detected by plug and play. A PnP audit event can be used to track down changes in system hardware and will be logged on the PC where the change took place. A list of hardware vendor IDs are included in the event. + ### More info added to existing audit events + With Windows 10, we've added more info to existing audit events to make it easier for you to put together a full audit trail and come away with the information you need to protect your enterprise. Improvements were made to the following audit events: - [Changed the kernel default audit policy](#bkmk-kdal) - [Added a default process SACL to LSASS.exe](#bkmk-lsass) @@ -35,12 +45,18 @@ With Windows 10, we've added more info to existing audit events to make it easi - [Added new Security Account Manager events](#bkmk-sam) - [Added new BCD events](#bkmk-bcd) - [Added new PNP events](#bkmk-pnp) + ### Changed the kernel default audit policy + In previous releases, the kernel depended on the Local Security Authority (LSA) to retrieve info in some of its events. In Windows 10, the process creation events audit policy is automatically enabled until an actual audit policy is received from LSA. This results in better auditing of services that may start before LSA starts. + ### Added a default process SACL to LSASS.exe + In Windows 10, a default process SACL was added to LSASS.exe to log processes attempting to access LSASS.exe. The SACL is L"S:(AU;SAFA;0x0010;;;WD)". You can enable this under **Advanced Audit Policy Configuration\\Object Access\\Audit Kernel Object**. This can help identify attacks that steal credentials from the memory of a process. + ### New fields in the logon event + The logon event ID 4624 has been updated to include more verbose information to make them easier to analyze. The following fields have been added to event 4624: 1. **MachineLogon** String: yes or no If the account that logged into the PC is a computer account, this field will be yes. Otherwise, the field is no. @@ -56,7 +72,9 @@ The logon event ID 4624 has been updated to include more verbose information to 6. **RestrictedAdminMode** String: yes or no If the user logs into the PC in restricted admin mode with Remote Desktop, this field will be yes. For more info on restricted admin mode, see [Restricted Admin mode for RDP](http://blogs.technet.com/b/kfalde/archive/2013/08/14/restricted-admin-mode-for-rdp-in-windows-8-1-2012-r2.aspx). + ### New fields in the process creation event + The logon event ID 4688 has been updated to include more verbose information to make them easier to analyze. The following fields have been added to event 4688: 1. **TargetUserSid** String The SID of the target principal. @@ -70,7 +88,9 @@ The logon event ID 4688 has been updated to include more verbose information to The name of the creator process. 6. **ParentProcessId** String A pointer to the actual parent process if it's different from the creator process. + ### New Security Account Manager events + In Windows 10, new SAM events were added to cover SAM APIs that perform read/query operations. In previous versions of Windows, only write operations were audited. The new events are event ID 4798 and event ID 4799. The following APIs are now audited: - SamrEnumerateGroupsInDomain - SamrEnumerateUsersInDomain @@ -84,7 +104,9 @@ In Windows 10, new SAM events were added to cover SAM APIs that perform read/qu - SamrGetMembersInGroup - SamrGetMembersInAlias - SamrGetUserDomainPasswordInformation + ### New BCD events + Event ID 4826 has been added to track the following changes to the Boot Configuration Database (BCD): - DEP/NEX settings - Test signing @@ -93,8 +115,8 @@ Event ID 4826 has been added to track the following changes to the Boot Configur - Boot debug - Integrity Services - Disable Winload debugging menu + ### New PNP events + Event ID 6416 has been added to track when an external device is detected through Plug and Play. One important scenario is if an external device that contains malware is inserted into a high-value machine that doesn’t expect this type of action, such as a domain controller. [Learn how to manage your security audit policies within your organization](../keep-secure/security-auditing-overview.md). -  -  diff --git a/windows/whats-new/security.md b/windows/whats-new/security.md index 356121713b..d8784f6c41 100644 --- a/windows/whats-new/security.md +++ b/windows/whats-new/security.md @@ -2,47 +2,72 @@ title: What's new in Windows 10 security (Windows 10) description: There are several key client security improvements Microsoft has made in Windows 10. ms.assetid: 6B8A5F7A-ABD3-416C-87B0-85F68B214C81 -ms.pagetype: security -keywords: ["secure", "data loss prevention", "multifactor authentication"] +keywords: secure, data loss prevention, multifactor authentication ms.prod: W10 ms.mktglfcycl: explore ms.sitesec: library +ms.pagetype: security author: TrudyHa --- + + # What's new in Windows 10 security There are several key client security improvements Microsoft has made in Windows 10. These improvements focus on three key areas — threat resistance, information protection, and identity protection and access control. In addition to an overview of the features themselves, this article discusses the hardware requirements for each new feature and offers configuration recommendations and links to more detailed resources. + Microsoft designed the Windows 10 operating system to be the most secure version of the Windows operating system to date. To achieve this goal, Windows 10 employs advanced and now widely available hardware features to help protect users and devices against modern cyber threats. With thousands of new malware variants discovered daily and malicious hacking techniques evolving rapidly, never before has Windows client security been more important. In Windows 10, organizations can deploy new threat-resistant security features that harden the operating system in ways that can benefit Bring Your Own Device (BYOD) and corporate-owned device scenarios, as well as devices for special use cases, such as kiosks, ATMs, and point-of-sale (PoS) systems. These new threat-resistant features are modular—that is, they’re designed to be deployed together, although you can also implement them individually. With all these new features enabled together, organizations can protect themselves immediately against a majority of today’s most sophisticated threats and malware. + In addition to new, impactful threat mitigations, Windows 10 includes several improvements in built-in information protection, including a new data loss-prevention (DLP) component. These improvements allow organizations to separate business and personal data easily, define which apps have access to business data, and determine how data can be shared (for example, copy and paste). Unlike other DLP solutions, Microsoft integrated this functionality deeply into the Windows platform, offering the same type of security capabilities that container-based solutions offer but without altering such user experiences as requiring mode changes or switching applications. + Finally, new identity-protection and access control features make it easier to implement two-factor authentication (2FA) across the entire enterprise, which empowers organizations to transition away from passwords. Windows 10 introduces Microsoft Passport, a new 2FA user credential built directly into the operating system that users can access with either a PIN or a new biometrics-driven capability called Windows Hello. Together, these technologies provide a simple logon experience for users, with the robust security of multifactor authentication (MFA). Unlike third-party multifactor solutions, Microsoft Passport is designed specifically to integrate with Microsoft Azure Active Directory (Azure AD) and hybrid Active Directory environments and requires minimal administrative configuration and maintenance. + ## Threat resistance + Today’s security threat landscape is one of aggressive and tenacious threats. In previous years, malicious attackers mostly focused on gaining community recognition through their attacks and the personal enjoyment of temporarily taking a system offline. Since then, attacker’s motives have shifted toward monetizing their attacks, which includes holding machines and data hostage until the owners pay the demanded ransom and exploiting the valuable information the attackers discover for monetary gain. Unlike these examples, modern attacks increasingly focus on large-scale intellectual property theft; targeted system degradation that results in financial loss; and now even cyberterrorism that threatens the security of individuals, businesses, and national interests all over the world. These attackers are typically highly trained individuals and security experts, some of whom are in the employ of nation states that have large budgets, seemingly unlimited human resources, and unknown motives. Threats like these require a different approach and mitigations that can meet the challenge. + Windows 10 introduces several new security features that help mitigate modern threats and protect organizations against cyber attackers, regardless of their motive. Microsoft has made significant investments in Windows 10 to make it the most malware-resistant Windows operating system to date. Rather than simply adding defenses to the operating system, as was the case in previous Windows releases, Microsoft introduces architectural changes in Windows 10 that address entire classes of threats. By fundamentally changing the way the operating system works, Microsoft seeks to make Windows 10 much more difficult for modern attackers to exploit. New features in Windows 10 include Device Guard, configurable code integrity, virtualization-based security (VBS), and improvements to Windows Defender, to name just a few. By enabling all these new features together, organizations can immediately protect themselves against the types of malware responsible for approximately 95 percent of modern attacks. + ### Virtualization-based security + In the server world, virtualization technologies like Microsoft Hyper-V have proven extremely effective in isolating and protecting virtual machines (VMs) in the data center. Now, with those virtualization capabilities becoming more pervasive in modern client devices, there is an incredible opportunity for new Windows client security scenarios. Windows 10 can use virtualization technology to isolate core operating system services in a segregated, virtualized environment, similar to a VM. This additional level of protection, called virtualization-based security, ensures that no one can manipulate those services, even if the kernel mode of the host operating system is compromised. + Just like with client Hyper-V, Windows itself can now take advantage of processors equipped with second-level address translation (SLAT) technology and virtualization extensions, such as Intel Virtualization Technology (VT) x and AMD V, to create a secure execution environment for sensitive Windows functions and data. This VBS environment protects the following services: - **Hypervisor Code Integrity (HVCI).** The HVCI service in Windows 10 determines whether code executing in kernel mode is securely designed and trustworthy. It offers Zero Day and vulnerability exploit protection capabilities by ensuring that all software running in kernel mode, including drivers, securely allocate memory and operate as they are intended. In Windows 10, kernel mode code integrity is configurable, which allows organizations to scope preboot code execution to their desired configuration. For more information about configurable code integrity in Windows 10, see the [Configurable code integrity](#config-code) section. - **Local Security Authority (LSA).** The LSA service in Windows manages authentication operations, including NT LAN Manager (NTLM) and Kerberos mechanisms. In Windows 10, the Credential Guard feature isolates a portion of this service and helps mitigate the pass-the-hash and pass-the-ticket techniques by protecting domain credentials. In addition to logon credentials, this protection is extended to credentials stored within Credential Manager. For more information about Credential Guard, see the [Credential Guard](#credential-guard) section. **Note**   + To determine whether virtualization is supported for a client machine model, simply run **systeminfo** from a command prompt window.   VBS provides the core framework for some of the most impactful mitigations Windows 10 offers. Having client machines within your organization that can employ this functionality is crucial to modern threat resistance. For more information about the specific hardware features that each Windows 10 feature requires, including VBS, see the [Windows 10 hardware considerations](#hardware) section. + ### Device Guard + Microsoft Device Guard is a feature set that combines system integrity–hardening features that revolutionize Windows security by taking advantage of new VBS options to protect the system core and a trust-nothing model often seen in mobile operating systems. This feature set takes advantage of the best preexisting Windows hardening features (for example, Unified Extensible Firmware Interface \[UEFI\] Secure Boot, Windows Trusted Boot), and then combines them with powerful new app control features like the VBS-powered HVCI service and configurable code integrity, which together help prevent vulnerability exploits and unauthorized apps from running on the device in both user and kernel modes. For more information about VBS in Windows 10 and the additional features that use it, see the [Virtualization-based security](#virtualization-security) section. For more information about configurable code integrity, see the [Configurable code integrity](#config-code) section. + Although Microsoft intends the Device Guard feature set to run alongside new Windows security features such as Credential Guard, it can run independently. Depending on your organization’s client resources, you can selectively choose which features make sense for your environment and device compatibility. For information about the hardware requirements for Device Guard and other Windows 10 security features, see the [Windows 10 hardware considerations](#hardware) section. For more information about Credential Guard, see the [Credential Guard](#credential-guard) section. + For most organizations, implementing specific Device Guard functionality will depend on the role of the device and its primary user, employing more features on single-workload devices, such as kiosks, and fewer features on administrative machines over which users are allowed full control. By using this model, IT organizations can categorize users into groups that align with Device Guard security policies relating to device security and code integrity restrictions. For more information about configurable code integrity, see the [Configurable code integrity](#config-code) section. -New desktops and laptops will be available to expedite your Device Guard implementation efforts. Device Guard-ready devices will require the least amount of physical interaction with the actual device before it’s ready for use. Going forward, all devices will fall into one of the following three categories: + +New desktops and laptops will be available to expedite your Device Guard implementation efforts. Device Guard-ready devices will require the least amount of physical interaction with the actual device before it’s ready for use. + +Going forward, all devices will fall into one of the following three categories: - **Device Guard capable**. These devices will meet all the hardware requirements for Device Guard. You will still need to properly prepare devices with components that require enablement or configuration for Device Guard deployment. Device drivers on the device must be compatible with HVCI and may require updates from the original equipment manufacturer (OEM). - **Device Guard ready**. Device Guard-ready devices will come directly from the OEM with all necessary hardware components and drivers to run Device Guard. In addition, all of these components will be pre-configured and enabled, which minimizes the effort needed to deploy Device Guard. No interaction with the BIOS is necessary to deploy these devices, and you can use Group Policy, System Center Configuration Manager, or Microsoft Intune to manage them. - **Not supported for Device Guard**. Many current devices cannot take advantage of all Device Guard features because they don’t have the required hardware components or HVCI-compatible drivers. However, most of these devices can enable some Device Guard features, such as configurable code integrity. + For more information about how to prepare for, manage, and deploy Device Guard, see the [Device Guard deployment guide](../keep-secure/device-guard-deployment-guide.md). + ### Configurable code integrity + *Code integrity* is the Windows component that verifies that the code Windows is running is trusted and safe. Like the operating modes found in Windows itself, Windows code integrity contains two primary components: kernel mode code integrity (KMCI) and user mode code integrity (UMCI). Microsoft has used KMCI in recent versions of Windows to prevent the Windows kernel from executing unsigned drivers. Although this approach is effective, drivers aren’t the only route malware can take to penetrate the operating system’s kernel mode space. So, for Windows 10, Microsoft has raised the standard for kernel mode code out of the box by requiring the use of security best practices regarding memory management and has provided enterprises with a way to set their own UMCI and KMCI standards. + Historically, UMCI has been available only for Windows RT and Windows Phone devices, which made it difficult for attackers to infect such devices with viruses and malware. This reduced infection rate results from the way the operating system determines which code to execute. Natively, binaries follow a process to prove to the operating system that they are trustworthy before the operating system allows them to execute. This process is intended to restrict the execution of arbitrary code and thereby decrease the risk of malware infection. This successful trust-nothing operating system model is now available in Windows 10 through a feature called *configurable code integrity*. Configurable code integrity allows IT organizations to create and deploy code integrity policies that stipulate exactly which binaries can run in their environment. Administrators can manage this trust at a certification authority or publisher level down to the individual hash values for each executed binary. This level of customization allows organizations to create policies that are as restrictive as they desire. In addition, organizations can choose to provide different levels of restriction for certain types of machines. For example, fixed-workload devices such as kiosks and PoS systems would likely receive a strict policy, because their purpose is to provide the same service day after day. Administrators can manage devices that have more variable workloads, such as users’ PCs, at a higher level, providing certain software publishers’ applications for installation or aligning those devices with the organization’s software catalog. + **Note**   Configurable code integrity is not intended to replace technologies that allow or block programs such as AppLocker or an organization’s antivirus software. Rather, it complements such technologies by establishing a baseline of security, and then using those additional technologies to fine-tune client security.   Configurable code integrity is not limited to Windows Store applications. In fact, it is not even limited to existing signed applications. Windows 10 gives you a way to sign line-of-business or third-party applications without having to repackage them: you can monitor the application’s installation and initial execution to create a list of binaries called a catalog file. When created, you sign these catalog files and add the signing certificate to the code integrity policy so that those binaries contained within the catalog files are allowed to execute. Then, you can use Group Policy, Configuration Manager, or any other familiar management tool to distribute these catalog files to your client machines. Historically, most malware has been unsigned; simply by deploying code integrity policies, your organization can immediately protect itself against unsigned malware, which is responsible for most modern attacks. + **Note**   For detailed deployment and planning information about configurable code integrity, see the [Device Guard deployment guide](../keep-secure/device-guard-deployment-guide.md).   @@ -52,64 +77,102 @@ The process to create, test, and deploy a code integrity policy is as follows: 3. **Merge the audit results with the existing policy.** After you have audited a policy, you can use the audit events to create an additional code integrity policy. Because each machine processes just one code integrity policy, you must merge the file rules within this new code integrity policy with the original policy. To do so, run the **Merge-CIPolicy** cmdlet, which is available in Windows 10 Enterprise. 4. **Enforce and sign the policy.** After you create, audit, and merge the resulting code integrity policies, it’s time to enforce your policy. To do so, run the **Set-RuleOption** cmdlet to remove the **Unsigned Policy** rule. When enforced, no binaries that are exceptions to the policy will be allowed to run. In addition to enforcing a policy, signed policies offer an additional level of protection. Signed code integrity policies inherently protect themselves against manipulation and deletion, even by administrators. 5. **Deploy the code integrity policy.** When you have enforced and optionally signed your code integrity policy, it’s ready for deployment. To deploy your code integrity policies, you can use Microsoft client management technologies, mobile device management solutions, or Group Policy, or you can simply copy the file to the correct location on your client computers. For Group Policy deployment, a new administrative template is available in Windows 10 and the Windows Server 2016 operating system to simplify the deployment process. + **Note**   Configurable code integrity is available in Windows 10 Enterprise and Windows 10 Education.   You can enable configurable code integrity as part of a Device Guard deployment or as a stand-alone component. In addition, you can run configurable code integrity on hardware that is compatible with the Windows 7 operating system, even if such hardware is not Device Guard ready. Code integrity policies can align with an existing application catalog, existing corporate imaging strategy, or with any other method that provides the organization’s desired levels of restriction. For more information about configurable code integrity with Device Guard, see the [Device Guard deployment guide](../keep-secure/device-guard-deployment-guide.md). + ### Measured Boot and remote attestation + Although software-based antimalware and antivirus solutions are effective, they have no way to detect pre–operating system resource modification or infection such as by bootkits and rootkits—malicious software that can manipulate a client before the operating system and antimalware solutions load. Bootkits and rootkits and similar software are nearly impossible to detect using software-based solutions alone, so Windows 10 uses the client’s Trusted Platform Module (TPM) and the Windows Measured Boot feature to analyze the overall boot integrity. When requested, Windows 10 reports integrity information to the Windows cloud-based device health attestation service, which can then be used in coordination with management solutions such as Intune to analyze the data and provide conditional access to resources based on the device’s health state. + Measured Boot uses one of TPM’s key functionalities and provides unique benefits to secure organizations. The feature can accurately and securely report the state of a machine’s trusted computing base (TCB). By measuring a system’s TCB, which consists of crucial startup-related security components such as firmware, the Operating System Loader, and drivers and software, the TPM can store the current device state in platform configuration registers (PCRs). When this measurement process is complete, the TPM cryptographically signs this PCR data so that Measured Boot information can be sent to either the Windows cloud-based device health attestation service or a non-Microsoft equivalent for signing or review. For example, if a company only wants to validate a computer’s BIOS information before allowing network access, PCR\[0\], which is the PCR that contains BIOS information, would be added to the policy for the attestation server to validate. This way, when the attestation server receives the manifest from the TPM, the server knows which values that PCR should contain. + Measured Boot by itself does not prevent malware from loading during the startup process, but it does provide a TPM-protected audit log that allows a trusted remote attestation server to evaluate the PC’s startup components and determine its trustworthiness. If the remote attestation server indicates that the PC loaded an untrusted component and is therefore out of compliance, a management system can use the information for conditional access scenarios to block the PC’s access to network resources or perform other quarantine actions. + ### Improvements in Windows Defender + For Windows 10, Microsoft has revamped Windows Defender and combined it with Microsoft System Center Endpoint Protection. Unlike with Microsoft System Center 2012 R2, there will be no System Center Endpoint Protection client to deploy to Windows 10 machines because Windows Defender is built into the operating system and enabled by default. + In addition to simplified deployment, Windows Defender contains several improvements. The most important improvements to Windows Defender are: - **Early Launch Antimalware (ELAM) compatible.** After Secure Boot has verified that the loading operating system is trusted, ELAM can start a registered and signed antimalware application before any other operating system components. Windows Defender is compatible with ELAM. - **Local context for detections and centralized sensory data.** Unlike most antimalware software and previous versions of Windows Defender, Windows Defender in Windows 10 reports additional information about the context of discovered threats. This information includes the source of the content that contains the threat as well as the historical movement of the malware throughout the system. When collection is complete, Windows Defender reports this information (when users elect to enable cloud-based protection) and uses it to mitigate threats more quickly. - **User Account Control (UAC) integration.** Windows Defender is now closely integrated with the UAC mechanism in Windows 10. Whenever a UAC request is made, Windows Defender automatically scans the threat before prompting the user, which helps prevent users from providing elevated privileges to malware. - **Simplified management.** In Windows 10, you can manage Windows Defender much more easily than ever before. Manage settings through Group Policy, Intune, or Configuration Manager. + ## Information protection + Protecting the integrity of company data as well as preventing the inappropriate disclosure and sharing of that data are a top priority for IT organizations. Trends like BYOD and mobility make the task of information protection more challenging than ever before. Windows 10 includes several improvements to built-in information protection, including a new Enterprise Data Protection (EDP) feature that offers DLP capability. This feature allows an organizations’ users to classify data themselves and gives you the ability to automatically classify data as it ingresses from business resources. It can also help prevent users from copying business content to unauthorized locations such as personal documents or websites. + Unlike some current DLP solutions, EDP does not require users to switch modes or apps or work within containers to protect data, and the protection happens behind the scenes without altering the user experience that your users have grown accustomed to in Windows. For more information about EDP in Windows 10, see the [Enterprise Data Protection](#enterprise) section. + In addition to EDP, Microsoft has made substantial improvements to BitLocker, including simplified manageability through Microsoft BitLocker Administration and Monitoring (MBAM), used-space-only encryption, and single sign-on (SSO) capability. For more information about BitLocker improvements in Windows 10, see the [Improvements to BitLocker](#bitlocker) section. + ### Enterprise Data Protection + DLP systems are intended to protect sensitive corporate data through encryption and managed use while the data is in use, in motion, or at rest. Traditional DLP software is typically invasive and frustrating for users and can be complicated for administrators to configure and deploy. Windows 10 now includes an EDP feature that offers DLP capabilities and is built in and simple to use. This solution gives you the flexibility to define policies that will help determine what kind of data to protect as business data and what should be considered personal. Based on these policies, you can also choose what to do, either automatically or manually, whenever you suspect that data is about to be or has been compromised. For example, if an employee has a personal but managed device that contains business data, an IT organization could block that user from copying and pasting business data to nonbusiness documents and locations or could even selectively wipe the business data from the device at any time without affecting the personal data on the device. + You can configure EDP policies to encrypt and protect files automatically based on the network source from which the content was acquired, such as an email server, file share, or a Microsoft SharePoint site. The policies can work with on-premises resources as well as those that originate from the Internet. When specified, any data retrieved from internal network resources will always be protected as business data; even if that data is copied to portable storage, such as a flash drive or CD, the protection remains. In an effort to allow easy corrections of misclassified data, users who feel that EDP has incorrectly protected their personal data can modify the data’s classification. When such a modification occurs, you have access to audit data on the client machine. You can also use a policy to prevent users from reclassifying data. The EDP feature in Windows 10 also includes policy controls that allow you to define which apps have access to business data and even which have access to the corporate virtual private network (VPN). + To manage EDP, you use the same system management tools you probably already use to manage your Windows client computers, such as Configuration Manager and Intune. For more information about EDP, see [Enterprise data protection (EDP) overview](edp-whats-new-overview.md). + ### Improvements in BitLocker + With so many laptops stolen annually, protecting data at rest should be a top priority for any IT organization. Microsoft has provided an encryption solution called BitLocker directly in Windows since 2004. If your last encounter with BitLocker was in Windows 7, you’ll find that the manageability and SSO capabilities that were previously lacking are now included in Windows 10. These and other improvements make BitLocker one of the best choices on the marketplace for protecting data on Windows devices. Windows 10 builds on the BitLocker improvements made in the Windows 8.1 and Windows 8 operating systems to make BitLocker more manageable and to simplify its deployment even further. + Microsoft has made the following key improvements to BitLocker: - **Automatic drive encryption through Device Encryption.** By default, BitLocker is automatically enabled on clean installations of Windows 10 if the device has passed the Device Encryption Requirements test from the Windows Hardware Certification Kit. Many Windows 10–compatible PCs will meet this requirement. This version of BitLocker is called Device Encryption. Whenever devices on which Drive Encryption is enabled join your domain, the encryption keys can be escrowed in either Active Directory or MBAM. - **MBAM improvements.** MBAM provides a simplified management console for BitLocker administration. It also simplifies recovery requests by providing a self-service portal in which users can recover their drives without calling the help desk. - **SSO.** BitLocker for Windows 7 often required the use of a pre-boot PIN to access the protected drive’s encryption key and allow Windows to start. In Windows 10, user input-based preboot authentication (in other words, a PIN) is not required because the TPM maintains the keys. In addition, modern hardware often mitigates the cold boot attacks (for example, port-based direct memory access attacks) that have previously necessitated PIN protection. For more information to determine which cases and device types require the use of PIN protection, refer to [BitLocker Countermeasures](../keep-secure/bitlocker-countermeasures.md). - **Used-space-only encryption.** Rather than encrypting an entire hard drive, you can configure BitLocker to encrypt only the used space on a drive. This option drastically reduces the overall encryption time required. + ## Identity protection and access control + User credentials are vital to the overall security of an organization’s domain. Until Windows 10, user name-password combinations were the primary way for a person to prove his or her identity to a machine or system. Unfortunately, passwords are easily stolen, and attackers can use them remotely to spoof a user’s identity. Some organizations deploy public key infrastructure (PKI)-based solutions, like smart cards, to address the weaknesses of passwords. Because of the complexity and costs associated with these solutions, however, they’re rarely deployed and, even when they are used, frequently used only to protect top-priority assets such as the corporate VPN. Windows 10 introduces new identity-protection and access control features that address the weaknesses of today’s solutions and can effectively remove the need for user passwords in an organization. + Windows 10 also includes a feature called Microsoft Passport, a new 2FA mechanism built directly into the operating system. The two factors of authentication include a combination of something you know (for example, a PIN), something you have (for example, your PC, your phone), or something about the user (for example, biometrics). With Microsoft Passport enabled, when you log on to a computer, Microsoft Passport is responsible for brokering user authentication around the network, providing the same SSO experience with which you’re familiar. For more information about Microsoft Passport, see the [Microsoft Passport](#passport) section. + The biometrics factor available for Microsoft Passport is driven by another new feature in Windows 10 called Windows Hello. Windows Hello uses a variety of biometric sensors to accept different points of biometric measurement, such as the face, iris, and fingerprints, which allows organizations to choose from various options when they consider what makes the most sense for their users and devices. By combining Windows Hello with Microsoft Passport, users no longer need to remember a password to access corporate resources. For more information about Windows Hello, see the [Windows Hello](#hello) section. + Finally, Windows 10 uses VBS to isolate the Windows service responsible for maintaining and brokering a user’s derived credentials (for example, Kerberos ticket, NTLM hash) through a feature called Credential Guard. In addition to service isolation, the TPM protects credential data while the machine is running and while it’s off. Credential Guard provides a comprehensive strategy to protect user-derived credentials at runtime as well as at rest, thus preventing them from being accessed and used in pass-the-hash–type attacks. For more information about Credential Guard, see the [Credential Guard](#credential-guard) section. + ### Microsoft Passport + Historically, companies have mitigated the risk of credential theft by implementing 2FA. In this method, a combination of something you know (for example, a PIN), something you have (traditionally a smart card or token), or possibly something about the user (for example, biometrics) strengthens the logon process. The additional factor beyond something you know requires that a credential thief acquire a physical device or, in the case of biometrics, the actual user. + Microsoft Passport introduces a strong 2FA mechanism integrated directly into Windows. Many organizations use 2FA today but don’t integrate its functionality into their organization because of the expense and time required to do so. Therefore, most organizations use MFA only to secure VPN connections and the highest-value resources on their network, and then use traditional passwords for logon to devices and to navigate the rest of the network. Microsoft Passport is unlike these other forms of 2FA in that Microsoft designed it specifically to address the complexity, cost, and user experience challenges of traditional 2FA solutions, making it simple to deploy throughout the enterprise through existing infrastructure and devices. + Microsoft Passport can use the biometric information from Windows Hello or a unique PIN with cryptographic signing keys stored in the device’s TPM. For organizations that don’t have an existing PKI, the TPM—or Windows, when no TPM is present—can generate and protect these keys. If your organization has an on-premises PKI or wants to deploy one, you can use certificates from the PKI to generate the keys, and then store them in the TPM. When the user has registered the device and uses Windows Hello or a PIN to log in to the device, the Microsoft Passports private key fulfills any subsequent authentication requests. Microsoft Passport combines the deployment flexibility of virtual smart cards with the robust security of physical smart cards without requiring the extra infrastructure components needed for traditional smart card deployments and hardware such as cards and readers. + In Windows 10, the physical factor of authentication is the user’s device—either his or her PC or mobile phone. By using the new phone sign-in capability which will available to Windows Insiders as a preview in early 2016, users can unlock their PC without ever touching it. Users simply enroll their phone with Microsoft Passport by pairing it with the PC via Wi-Fi or Bluetooth and install a simple-to-use application on their phone that allows them to select which PC to unlock. When selected, users can enter a PIN or their biometric login from their phone to unlock their PC. + ### Windows Hello Passwords represent a losing identity and access control mechanism. When an organization relies on password-driven Windows authentication, attackers only have to determine a single string of text to access anything on a corporate network that those credentials protect. Unfortunately, attackers can use several methods to retrieve a user’s password, making credential theft relatively easy for determined attackers. By moving to an MFA mechanism to verify user identities, organizations can remove the threats that single-factor options like passwords represent. + Windows Hello is the enterprise-grade biometric integration feature in Windows 10. This feature allows users to use their face, iris, or fingerprint rather than a password to authenticate. Although biometric logon capabilities have been around since the Windows XPoperating system, they have never been as easy, seamless, and secure as they are in Windows 10. In previous uses of biometrics in Windows, the operating system used the biometric information only to unlock the device; then, behind the scenes the user’s traditional password was used to access resources on the organization’s network. Also, the IT organization had to run additional software to configure the biometric devices to log in to Windows or applications. Windows Hello is integrated directly into the operating system and so doesn’t require additional software to function. However, as with any other biometrics-based login, Windows Hello requires specific hardware to function: - **Facial recognition.** To establish facial recognition, Windows Hello uses special infrared (IR) cameras and anti-spoofing technology to reliably tell the difference between a photograph and a living person. This requirement ensures that no one can take a person’s PC and spoof his or her identity simply by obtaining a high-definition picture. Many manufacturers already offer PC models that include such cameras and are therefore compatible with Windows Hello. For those machines that don’t currently include these special cameras, several external cameras are available. - **Fingerprint recognition.** Fingerprint sensors already exist in a large percentage of consumer and business PCs. Most of them (whether external or integrated into laptops or USB keyboards) work with Windows Hello. The detection and anti-spoofing technology available in Windows 10 is much more advanced than in previous versions of Windows, making it more difficult for attackers to deceive the operating system. - **Iris recognition.** Like facial recognition, iris-based recognition uses special IR cameras and anti-spoofing technology to reliably tell the difference between the user’s iris and an impostor. Iris recognition will be available in mobile devices by the end of 2016 but is also available for independent hardware vendors and OEMs to incorporate into PCs. With Windows Hello in conjunction with Microsoft Passport, users have the same SSO experience they would if they logged on with domain credentials: they simply use biometrics, instead. In addition, because no passwords are involved, users won’t be calling the help desk saying that they have forgotten their password. For an attacker to spoof a user’s identity, he or she would have to have physical possession of both the user and the device on which the user is set up for Windows Hello. From a privacy perspective, organizations can rest assured that the biometric data Windows Hello uses is not centrally stored; can’t be converted to images of the user’s fingerprint, face, or iris; and is designed never to leave the device. In the end, Windows Hello and Microsoft Passport can completely remove the necessity for passwords for Azure AD and hybrid Azure AD/Active Directory environments and the apps and web services that depend on them for identity services. For more information about Microsoft Passport, see the [Microsoft Passport](#passport) section. + ### Credential Guard + Pass the hash is the most commonly used derived credential attack today. This attack begins with an attacker extracting a user account’s derived credentials (hash value) from memory. Then, by using a product such as Mimikatz, the attacker reuses (passes) those credentials to other machines and resources on the network to gain additional access. Microsoft designed Credential Guard specifically to eliminate derived credential theft and abuse in pass-the-hash–type attacks. + Credential Guard is another new feature in Windows 10 Enterprise that employs VBS to protect domain credentials against theft, even when the host operating system is compromised. To achieve such protection, Credential Guard isolates a portion of the LSA service, which is responsible for managing authentication, inside a virtualized container. This container is similar to a VM running on a hypervisor but is extremely lightweight and contains only those files and components required to operate the LSA and other isolated services. By isolating a portion of the LSA service within this virtualized environment, credentials are protected even if the system kernel is compromised, removing the attack vector for pass the hash. + For more information about the hardware requirements for Credential Guard, see the [Windows 10 hardware considerations](#hardware) section. For more information about VBS in Windows 10, see the [Virtualization-based security](#virtualization-security) section. **Note**   Because it requires isolated user mode and a Hyper-V hypervisor, you cannot configure Credential Guard on a VM, only on a physical computer.   The Credential Guard feature is targeted at resisting the use of pass-the-hash and pass-the-ticket techniques. By employing a MFA option such as Microsoft Passport with Credential Guard, you can gain additional protection against such threats. For more in-depth information about how Credential Guard works and the specific mitigations it provides, see [Protect derived domain credentials with Credential Guard](../keep-secure/credential-guard.md). + ## Windows 10 hardware considerations + Most of the features this article describes rely on specific hardware to maximize their capabilities. By purchasing hardware that includes these features during your next purchase cycle, you will be able to take advantage of the most comprehensive client security package Windows 10 has to offer. Careful consideration about which hardware vendor and specific models to purchase is vital to the success of your organization’s client security portfolio. Table 1 contains a list of each new Windows 10 security feature and its hardware requirements. Table 1. Windows 10 hardware requirements + | Windows 10 feature | TPM | Input/output memory management unit | Virtualization extensions | SLAT | UEFI 2.3.1 | x64 architecture only | |-------------------------------------------------|-----|-------------------------------------|---------------------------|------|------------|-----------------------| | Credential Guard | R | N | Y | Y | Y | Y | diff --git a/windows/whats-new/user-account-control.md b/windows/whats-new/user-account-control.md index 3ebef21b0e..0b655fc120 100644 --- a/windows/whats-new/user-account-control.md +++ b/windows/whats-new/user-account-control.md @@ -2,21 +2,30 @@ title: What's new in User Account Control (Windows 10) description: User Account Control (UAC) helps prevent malware from damaging a computer and helps organizations deploy a better-managed desktop environment. ms.assetid: 9281870C-0819-4694-B4F1-260255BB8D07 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: explore ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # What's new in User Account Control? + **Applies to** - Windows 10 + User Account Control (UAC) helps prevent malware from damaging a computer and helps organizations deploy a better-managed desktop environment. + You should not turn off UAC because this is not a supported scenario for devices running Windows 10. If you do turn off UAC, all Univeral Windows Platform apps stop working. You must always set the **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA** registry value to 1. If you need to provide auto elevation for programmatic access or installation, you could set the **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorAdmin** registry value to 0, which is the same as setting the UAC slider Never Notify. This is not recommended for devices running Windows 10. + For more info about how manage UAC, see [UAC Group Policy Settings and Registry Key Settings](../keep-secure/user-account-control-group-policy-and-registry-key-settings.md). + In Windows 10, User Account Control has added some improvements. + ## New features in Windows 10 + - **Integration with the Antimalware Scan Interface (AMSI)**. The [AMSI](http://msdn.microsoft.com/library/windows/desktop/dn889587.aspx) scans all UAC elevation requests for malware. If malware is detected, the admin privilege is blocked. + [Learn how to manage User Account Control within your organization](../keep-secure/user-account-control-overview.md).     From 597a675d42bb4e0f318e552f1310070420ac452e Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 18 May 2016 13:47:34 -0700 Subject: [PATCH 316/439] fixing spacing issues --- .../deploy/activate-forest-by-proxy-vamt.md | 21 +++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/windows/deploy/activate-forest-by-proxy-vamt.md b/windows/deploy/activate-forest-by-proxy-vamt.md index fb76536957..f178e14406 100644 --- a/windows/deploy/activate-forest-by-proxy-vamt.md +++ b/windows/deploy/activate-forest-by-proxy-vamt.md @@ -2,34 +2,40 @@ title: Activate by Proxy an Active Directory Forest (Windows 10) description: Activate by Proxy an Active Directory Forest ms.assetid: 6475fc87-a6f7-4fa8-b0aa-de19f2dea7e5 -ms.pagetype: activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- + # Activate by Proxy an Active Directory Forest + You can use the Volume Activation Management Tool (VAMT) Active Directory-Based Activation (ADBA) function to activate by proxy an Active Directory (AD) forest for an isolated workgroup that does not have Internet access. ADBA enables certain volume products to inherit activation from the domain. + **Important**   ADBA is only applicable to Generic Volume License Keys (GVLKs) and KMS Host key (CSVLK). To use ADBA, one or more KMS Host keys (CSVLK) must be installed on the AD forest, and client keys (GVLKs) must be installed on the client products. + In a typical proxy-activation scenario, the VAMT host computer distributes a product key to one or more client computers and collects the installation ID (IID) from each computer. The VAMT host computer sends the IIDs to Microsoft on behalf of the client computers and obtains the corresponding Confirmation IDs (CIDs). The VAMT host computer then installs the CIDs on the client computer to complete the activation. If you use this activation method, only the VAMT host computer needs to have Internet access. + **Note**   For workgroups that are isolated from any larger network, you can still perform an AD forest activation. This requires installing a second instance of VAMT on a computer in the isolated group and using removable media to transfer activation data between that computer and another VAMT host computer that has Internet access. You can also activate by proxy a KMS Host key (CSVLK) in the core network if you do not want the host computer to connect to Microsoft over the Internet. + ## Requirements + Before performing proxy activation, ensure that the network and the VAMT installation meet the following requirements: - There is an instance of VAMT that is installed on a computer that has Internet access. If you are performing proxy activation for an isolated workgroup, you must also have VAMT installed on one of the computers in the workgroup. - VAMT has administrative permissions to the Active Directory domain. + **To perform an Active Directory forest proxy activation** + 1. Open VAMT. 2. In the left-side pane, click the **Active Directory-Based Activation** node. 3. In the right-side **Actions** pane, click **Proxy activate forest** to open the **Install Product Key** dialog box. 4. In the **Install Product Key** dialog box, select the KMS Host key (CSVLK) that you want to activate. -5. If you want to rename the ADBA object, enter a new Active Directory-Based Activation Object name. - **Important**   - If you want to rename the ADBA object, you must do it now. After you click **Install Key**, the name cannot be changed. +5. If you want to rename the ADBA object, enter a new Active Directory-Based Activation Object name. If you want to rename the ADBA object, you must do it now. After you click **Install Key**, the name cannot be changed. 6. Enter the name of the file where you want to save the offline installation ID, or browse to the file location and then click **Open**. If you are activating an AD forest in an isolated workgroup, save the .cilx file to a removable media device. -7. Click **Install Key**. - VAMT displays the **Activating Active Directory** dialog box until it completes the requested action. The activated object and the date that it was created appear in the **Active Directory-Based Activation** node in the center pane. +7. Click **Install Key**. VAMT displays the **Activating Active Directory** dialog box until it completes the requested action. The activated object and the date that it was created appear in the **Active Directory-Based Activation** node in the center pane. 9. Insert the removable media into the VAMT host that has Internet access. Make sure that you are on the root node, and that the **Volume Activation Management Tool** view is displayed in the center pane. 10. In the right-side **Actions** pane, click **Acquire confirmation IDs for CILX** to open the **Acquire confirmation IDs for file** dialog box. 11. In the **Acquire confirmation IDs for file** dialog box, browse to where the .cilx file you exported from the isolated workgroup host computer is located. Select the file, and then click **Open**. VAMT displays an **Acquiring Confirmation IDs** message while it contacts Microsoft and acquires the CIDs. @@ -37,6 +43,9 @@ Before performing proxy activation, ensure that the network and the VAMT install 13. Remove the storage device that contains the .cilx file from the Internet-connected VAMT host computer and insert it into the VAMT host computer in the isolated workgroup. 14. Open VAMT and then click the **Active Directory-Based Activation** node in the left-side pane. 15. In the right-side **Actions** pane, click **Apply confirmation ID to Active Directory domain**, browse to the .cilx file and then click **Open**. + VAMT displays the **Activating Active Directory** dialog box until it completes the requested action. The activated object and the date that it was created appear in the **Active Directory-Based Activation** node in the center pane. + ## Related topics + - [Add and Remove Computers](add-remove-computers-vamt.md) From e9d9df6fd2a98886d68d439f2b4094fd4083f332 Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Wed, 18 May 2016 14:26:05 -0700 Subject: [PATCH 317/439] fix author names --- ...nced-uefi-security-features-for-surface.md | 9 +-- ...tomize-the-oobe-for-surface-deployments.md | 15 ++-- ...irmware-and-drivers-for-surface-devices.md | 8 +-- ...-fast-and-cisco-leap-on-surface-devices.md | 2 +- ...-adapters-and-surface-device-deployment.md | 4 +- .../manage-surface-dock-firmware-updates.md | 15 ++-- .../manage-surface-pro-3-firmware-updates.md | 2 +- .../surface/microsoft-surface-data-eraser.md | 19 ++--- ...icrosoft-surface-deployment-accelerator.md | 10 ++- ...-by-step-surface-deployment-accelerator.md | 26 +++---- devices/surface/surface-diagnostic-toolkit.md | 72 ++++++------------- devices/surface/surface-dock-updater.md | 12 ++-- 12 files changed, 67 insertions(+), 127 deletions(-) diff --git a/devices/surface/advanced-uefi-security-features-for-surface.md b/devices/surface/advanced-uefi-security-features-for-surface.md index e274220bee..26fc77aeb8 100644 --- a/devices/surface/advanced-uefi-security-features-for-surface.md +++ b/devices/surface/advanced-uefi-security-features-for-surface.md @@ -6,7 +6,7 @@ keywords: ["Surface, Surface Pro 3, security, features, configure, hardware, dev ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library -author: heatherpoulsen +author: milada --- # Advanced UEFI security features for Surface @@ -24,9 +24,7 @@ Before you can configure the advanced security features of your Surface device, ## Manually configure additional security settings -**Note**  To enter firmware setup on a Surface device, begin with the device powered off, press and hold the **Volume Up** button, then press and release the **Power** button, then release the **Volume Up** button after the device has begun to boot. - -  +**Note**  To enter firmware setup on a Surface device, begin with the device powered off, press and hold the **Volume Up** button, then press and release the **Power** button, then release the **Volume Up** button after the device has begun to boot. After the v3.11.760.0 UEFI update is installed on a Surface device, an additional UEFI menu named **Advanced Device Security** becomes available. If you click this menu, the following options are displayed: @@ -57,9 +55,8 @@ As an IT professional with administrative privileges, you can automate the confi **Sample scripts** -**Note**  The UEFI password used in the sample scripts below is presented in clear text. We strongly recommend saving the scripts in a protected location and running them in a controlled environment. +**Note**  The UEFI password used in the sample scripts below is presented in clear text. We strongly recommend saving the scripts in a protected location and running them in a controlled environment. -  Show all configurable options: diff --git a/devices/surface/customize-the-oobe-for-surface-deployments.md b/devices/surface/customize-the-oobe-for-surface-deployments.md index 73466d6d64..9bf808c8a3 100644 --- a/devices/surface/customize-the-oobe-for-surface-deployments.md +++ b/devices/surface/customize-the-oobe-for-surface-deployments.md @@ -6,27 +6,23 @@ keywords: ["deploy, customize, automate, deployment, network, Pen, pair, boot"] ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library -author: heatherpoulsen +author: jobotto --- # Customize the OOBE for Surface deployments -This article will walk you through the process of customizing the Surface out-of-box experience for end users in your organization. +This article walks you through the process of customizing the Surface out-of-box experience for end users in your organization. It is common practice in a Windows deployment to customize the user experience for the first startup of deployed computers — the out-of-box experience, or OOBE. -**Note**   -OOBE is also often used to describe the phase, or configuration pass, of Windows setup during which the user experience is displayed. For more information about the OOBE phase of setup, see [How Configuration Passes Work](http://msdn.microsoft.com/library/windows/hardware/dn898581(v=vs.85).aspx). - -  +**Note**  OOBE is also often used to describe the phase, or configuration pass, of Windows setup during which the user experience is displayed. For more information about the OOBE phase of setup, see [How Configuration Passes Work](http://msdn.microsoft.com/library/windows/hardware/dn898581(v=vs.85).aspx). In some scenarios, you may want to provide complete automation to ensure that at the end of a deployment, computers are ready for use without any interaction from the user. In other scenarios, you may want to leave key elements of the experience for users to perform necessary actions or select between important choices. For administrators deploying to Surface devices, each of these scenarios presents a unique challenge to overcome. This article provides a summary of the scenarios where a deployment might require additional steps. It also provides the required information to ensure that the desired experience is achieved on any newly deployed Surface device. This article is intended for administrators who are familiar with the deployment process, as well as concepts such as answer files and [reference images](http://go.microsoft.com/fwlink/p/?LinkID=618042). -**Note**   -Although the OOBE phase of setup is still run during a deployment with an automated deployment solution such as the [Microsoft Deployment Toolkit (MDT)](http://go.microsoft.com/fwlink/p/?LinkId=618117) or System Center Configuration Manager Operating System Deployment (OSD), it is automated by the settings supplied in the Deployment Wizard and task sequence. For more information see: +**Note**  Although the OOBE phase of setup is still run during a deployment with an automated deployment solution such as the [Microsoft Deployment Toolkit (MDT)](http://go.microsoft.com/fwlink/p/?LinkId=618117) or System Center Configuration Manager Operating System Deployment (OSD), it is automated by the settings supplied in the Deployment Wizard and task sequence. For more information see: - [Deploy Windows 10 with the Microsoft Deployment Toolkit](http://technet.microsoft.com/en-us/itpro/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit) @@ -53,8 +49,7 @@ To provide the factory Surface Pen pairing experience in OOBE, you must copy fou - %windir%\\system32\\oobe\\info\\default\\1033\\PenError\_en-US.png - %windir%\\system32\\oobe\\info\\default\\1033\\PenSuccess\_en-US.png -**Note**   -You should copy the files from a factory image for the same model Surface device that you intend to deploy to. For example, you should use the files from a Surface Pro 3 to deploy to Surface Pro 3, and the files from Surface Book to deploy Surface Book, but you should not use the files from a Surface Pro 3 to deploy Surface Book or Surface Pro 4. +**Note**  You should copy the files from a factory image for the same model Surface device that you intend to deploy to. For example, you should use the files from a Surface Pro 3 to deploy to Surface Pro 3, and the files from Surface Book to deploy Surface Book, but you should not use the files from a Surface Pro 3 to deploy Surface Book or Surface Pro 4.   diff --git a/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md b/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md index d5de7a0bb0..1f54650639 100644 --- a/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md +++ b/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md @@ -6,7 +6,7 @@ keywords: ["update Surface, newest, latest, download, firmware, driver, tablet, ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library -author: heatherpoulsen +author: jobotto --- # Download the latest firmware and drivers for Surface devices @@ -26,14 +26,12 @@ Driver and firmware updates for Surface devices are released in one of two ways: Installation files for administrative tools, drivers for accessories, and updates for Windows are also available for some devices and are detailed here in this article. -**Note**   -To simplify the process of locating drivers for your device, downloads for Surface devices have been reorganized to separate pages for each model. Bookmark the Microsoft Download Center page for your device from the links provided on this page. Many of the filenames contain a placeholder denoted with *xxxxxx*, which identifies the current version number or date of the file. - +**Note**  To simplify the process of locating drivers for your device, downloads for Surface devices have been reorganized to separate pages for each model. Bookmark the Microsoft Download Center page for your device from the links provided on this page. Many of the filenames contain a placeholder denoted with *xxxxxx*, which identifies the current version number or date of the file.   Recent additions to the downloads for Surface devices provide you with options to install Windows 10 on your Surface devices and update LTE devices with the latest Windows 10 drivers and firmware. -**Note**  A battery charge of 40% or greater is required before you install firmware to a Surface device. See [Microsoft Support article KB2909710](http://go.microsoft.com/fwlink/p/?LinkId=618106) for more information. +**Note**  A battery charge of 40% or greater is required before you install firmware to a Surface device. See [Microsoft Support article KB2909710](http://go.microsoft.com/fwlink/p/?LinkId=618106) for more information.   diff --git a/devices/surface/enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md b/devices/surface/enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md index 6a6c9f753c..1db50db7ea 100644 --- a/devices/surface/enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md +++ b/devices/surface/enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md @@ -6,7 +6,7 @@ keywords: ["network", "wireless", "device", "deploy", "authenticaion", "protocol ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: heatherpoulsen +author: milada --- # Enable PEAP, EAP-FAST, and Cisco LEAP on Surface devices diff --git a/devices/surface/ethernet-adapters-and-surface-device-deployment.md b/devices/surface/ethernet-adapters-and-surface-device-deployment.md index 14c36f3fdb..db8c55a949 100644 --- a/devices/surface/ethernet-adapters-and-surface-device-deployment.md +++ b/devices/surface/ethernet-adapters-and-surface-device-deployment.md @@ -6,7 +6,7 @@ keywords: ["ethernet, deploy, removable, network, connectivity, boot, firmware, ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library -author: heatherpoulsen +author: jobotto --- # Ethernet adapters and Surface deployment @@ -53,7 +53,7 @@ To boot a Surface device from an alternative boot device, follow these steps: 3. Press and release the **Power** button. 4. After the system begins to boot from the USB stick or Ethernet adapter, release the **Volume Down** button. -**Note**  In addition to an Ethernet adapter, a keyboard must also be connected to the Surface device to enter the preinstallation environment and navigate the deployment wizard. +**Note**  In addition to an Ethernet adapter, a keyboard must also be connected to the Surface device to enter the preinstallation environment and navigate the deployment wizard.   diff --git a/devices/surface/manage-surface-dock-firmware-updates.md b/devices/surface/manage-surface-dock-firmware-updates.md index be1d2e63f1..093579d4a5 100644 --- a/devices/surface/manage-surface-dock-firmware-updates.md +++ b/devices/surface/manage-surface-dock-firmware-updates.md @@ -5,7 +5,7 @@ ms.assetid: 86DFC0C0-C842-4CD1-A2D7-4425471FFE3F ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library -author: heatherpoulsen +author: jobotto --- # Manage Surface Dock firmware updates @@ -13,16 +13,15 @@ author: heatherpoulsen Read about the different methods you can use to manage the process of Surface Dock firmware updates. -The Surface Dock provides external connectivity to Surface devices through a single cable connection that includes Power, Ethernet, Audio, USB 3.0, and DisplayPort. The numerous connections provided by the Surface Dock are enabled by a smart chipset within the Surface Dock device. Like a Surface device’s chipset, the chipset that is built into the Surface Dock is controlled by firmware. +The Surface Dock provides external connectivity to Surface devices through a single cable connection that includes Power, Ethernet, Audio, USB 3.0, and DisplayPort. The numerous connections provided by the Surface Dock are enabled by a smart chipset within the Surface Dock device. Like a Surface device’s chipset, the chipset that is built into the Surface Dock is controlled by firmware. For more information about the Surface Dock, see the [Surface Dock demonstration](https://technet.microsoft.com/en-us/mt697552) video. Like the firmware for Surface devices, firmware for Surface Dock is also contained within a downloaded driver that is visible in Device Manager. This driver stages the firmware update files on the Surface device. When a Surface Dock is connected and the driver is loaded, the newer version of the firmware staged by the driver is detected and firmware files are copied to the Surface Dock. The Surface Dock then begins a two-phase process to apply the firmware internally. Each phase requires the Surface Dock to be disconnected from the Surface device before the firmware is applied. The driver copies the firmware into the dock, but only applies it when the user disconnects the Surface device from the Surface Dock. This ensures that there are no disruptions because the firmware is only applied when the user leaves their desk with the device. -**Note**   -You can learn more about the firmware update process for Surface devices and how firmware is updated through driver installation at the following links: +**Note**  You can learn more about the firmware update process for Surface devices and how firmware is updated through driver installation at the following links: - [How to manage and update your drivers and firmware for Surface](http://go.microsoft.com/fwlink/p/?LinkId=785353) from Microsoft Mechanics -- [Windows Update Makes Surface Better](http://go.microsoft.com/fwlink/p/?LinkId=785354)on the Microsoft Devices Blog +- [Windows Update Makes Surface Better](http://go.microsoft.com/fwlink/p/?LinkId=785354) on the Microsoft Devices Blog   @@ -70,8 +69,7 @@ There are three methods you can use to update the firmware of the Surface Dock: Windows Update is the method that most users will use. The drivers for the Surface Dock are downloaded automatically from Windows Update and the dock update process is initiated without additional user interaction. The two-phase dock update process described earlier occurs in the background as the user connects and disconnects the Surface Dock during normal use. -**Note**   -The driver version that is displayed in Device Manager may be different from the firmware version that the Surface Dock is using. +**Note**  The driver version that is displayed in Device Manager may be different from the firmware version that the Surface Dock is using.   @@ -82,8 +80,7 @@ This method is used mostly in environments where Surface device drivers and firm For more information about how to deploy MSI packages see [Create and deploy an application with System Center Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=785355). -**Note**   -When drivers are installed through Windows Update or the MSI package, registry keys are added that indicate the version of firmware installed on the Surface Dock and contained within the Surface Dock driver. These registry keys can be found in: +**Note**  When drivers are installed through Windows Update or the MSI package, registry keys are added that indicate the version of firmware installed on the Surface Dock and contained within the Surface Dock driver. These registry keys can be found in: **HLKM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\WUDF\\Services\\SurfaceDockFwUpdate\\Parameters** diff --git a/devices/surface/manage-surface-pro-3-firmware-updates.md b/devices/surface/manage-surface-pro-3-firmware-updates.md index 7a8b380b8b..fac455f9ac 100644 --- a/devices/surface/manage-surface-pro-3-firmware-updates.md +++ b/devices/surface/manage-surface-pro-3-firmware-updates.md @@ -6,7 +6,7 @@ keywords: ["Surface, Surface Pro 3, firmware, update, device, manage, deploy, dr ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library -author: heatherpoulsen +author: jobotto --- # Manage Surface driver and firmware updates diff --git a/devices/surface/microsoft-surface-data-eraser.md b/devices/surface/microsoft-surface-data-eraser.md index bf0348511d..fc9cbc171a 100644 --- a/devices/surface/microsoft-surface-data-eraser.md +++ b/devices/surface/microsoft-surface-data-eraser.md @@ -6,7 +6,7 @@ keywords: ["tool", "USB", "data", "erase"] ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library -author: heatherpoulsen +author: milada --- # Microsoft Surface Data Eraser @@ -40,15 +40,10 @@ Some scenarios where Microsoft Surface Data Eraser can be helpful include: - Standard practice when performing reimaging for devices used with sensitive data -**Note**   -Third-party devices, Surface devices running Windows RT (including Surface and Surface 2), and Surface Pro are not compatible with Microsoft Surface Data Eraser. +**Note**  Third-party devices, Surface devices running Windows RT (including Surface and Surface 2), and Surface Pro are not compatible with Microsoft Surface Data Eraser. -  +**Note**  Because the ability to boot to USB is required to run Microsoft Surface Data Eraser, if the device is not configured to boot from USB or if the device is unable to boot or POST successfully, the Microsoft Surface Data Eraser tool will not function. -**Note**   -Because the ability to boot to USB is required to run Microsoft Surface Data Eraser, if the device is not configured to boot from USB or if the device is unable to boot or POST successfully, the Microsoft Surface Data Eraser tool will not function. - -  ## How to create a Microsoft Surface Data Eraser USB stick @@ -74,12 +69,8 @@ After the creation tool is installed, follow these steps to create a Microsoft S Figure 1. Start the Microsoft Surface Data Eraser tool 4. Select the USB drive of your choice from the **USB Thumb Drive Selection** page as shown in Figure 2, and then click **Start** to begin the USB creation process. The drive you select will be formatted and any existing data on this drive will be lost. - - **Note**   - If the Start button is disabled, check that your removable drive has a total capacity of at least 4 GB. - -   - + **Note**  If the Start button is disabled, check that your removable drive has a total capacity of at least 4 GB. +   ![figure 2](images/dataeraser-usb-selection.png) Figure 2. USB thumb drive selection diff --git a/devices/surface/microsoft-surface-deployment-accelerator.md b/devices/surface/microsoft-surface-deployment-accelerator.md index 7b79663642..2c8a671cd9 100644 --- a/devices/surface/microsoft-surface-deployment-accelerator.md +++ b/devices/surface/microsoft-surface-deployment-accelerator.md @@ -6,7 +6,7 @@ keywords: ["deploy", "install", "tool"] ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library -author: heatherpoulsen +author: milada --- # Microsoft Surface Deployment Accelerator @@ -20,7 +20,7 @@ Microsoft Surface Deployment Accelerator is built on the powerful suite of deplo You can find more information about how to deploy to Surface devices, including step-by-step walkthroughs of customized deployment solution implementation, on the Deploy page of the [Surface TechCenter](http://go.microsoft.com/fwlink/p/?LinkId=691693). -### Download Microsoft Surface Deployment Accelerator +**Download Microsoft Surface Deployment Accelerator** You can download the installation files for Microsoft Surface Deployment Accelerator from the Microsoft Download Center. To download the installation files: @@ -60,8 +60,7 @@ When the Microsoft Surface Deployment Accelerator completes, you can use the dep You can modify the task sequence in the MDT Deployment Workbench to [include your own apps](http://go.microsoft.com/fwlink/p/?linkid=691700), or to [pause the automated installation routine](http://go.microsoft.com/fwlink/p/?linkid=691701). While the installation is paused, you can make changes to customize your reference image. After the image is captured, you can configure a deployment task sequence and distribute this custom configuration by using the same network boot capabilities as before. -**Note**   -With Microsoft Surface Deployment Accelerator v1.9.0258, Surface Pro 3, Surface Pro 4, and Surface Book are supported for Windows 10 deployment, and Surface Pro 3 is supported for Windows 8.1 deployment. +**Note**  With Microsoft Surface Deployment Accelerator v1.9.0258, Surface Pro 3, Surface Pro 4, and Surface Book are supported for Windows 10 deployment, and Surface Pro 3 is supported for Windows 8.1 deployment.   @@ -76,8 +75,7 @@ Figure 2. Specify a local source for Surface driver and app files You can find a full list of available driver downloads at [Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md) -**Note**   -Downloaded files do not need to be extracted. The downloaded files can be left as .zip files as long as they are stored in one folder. +**Note**  Downloaded files do not need to be extracted. The downloaded files can be left as .zip files as long as they are stored in one folder.   diff --git a/devices/surface/step-by-step-surface-deployment-accelerator.md b/devices/surface/step-by-step-surface-deployment-accelerator.md index 37fa2adb25..1f8dbef314 100644 --- a/devices/surface/step-by-step-surface-deployment-accelerator.md +++ b/devices/surface/step-by-step-surface-deployment-accelerator.md @@ -6,7 +6,7 @@ keywords: ["deploy, configure"] ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library -author: heatherpoulsen +author: milada --- # Step by step: Surface Deployment Accelerator @@ -37,8 +37,7 @@ The tool installs in the Surface Deployment Accelerator program group, as shown Figure 2. The Surface Deployment Accelerator program group and icon -**Note**   -At this point the tool has not yet prepared any deployment environment or downloaded any materials from the Internet. +**Note**  At this point the tool has not yet prepared any deployment environment or downloaded any materials from the Internet.   @@ -47,8 +46,7 @@ At this point the tool has not yet prepared any deployment environment or downlo The following steps show how you create a deployment share for Windows 10 that supports Surface Pro 3, Surface Pro 4, Surface Book, the Surface Firmware Tool, and the Surface Asset Tag Tool. As you follow the steps below, make the selections that are applicable for your organization. For example, you could choose to deploy Windows 10 to Surface Book only, without any of the Surface apps. -**Note**   -SDA lets you create deployment shares for both Windows 8.1 and Windows 10 deployments, but you can only create a single deployment share at a time. Therefore, to create both Windows 8.1 and Windows 10 deployment shares, you will need to run the tool twice. +**Note**  SDA lets you create deployment shares for both Windows 8.1 and Windows 10 deployments, but you can only create a single deployment share at a time. Therefore, to create both Windows 8.1 and Windows 10 deployment shares, you will need to run the tool twice.   @@ -116,8 +114,7 @@ SDA lets you create deployment shares for both Windows 8.1 and Windows 10 depl If you are unable to connect to the Internet with your deployment server, or if you want to download the Surface drivers and apps separately, you can specify a local source for the driver an app files at the time of deployment share creation. On the **Configure** page of the SDA wizard, select the **Copy from a Local Directory** check box, as shown in Figure 6. The **Download from the Internet** check box will be automatically deselected. Enter the folder location where you have placed the driver and app files in the **Local Path** field, as shown in Figure 6. -**Note**   -All of the downloaded driver and applications files must be located in the same folder. The driver and app files do not need to be extracted from the downloaded .zip files. +**Note**  All of the downloaded driver and applications files must be located in the same folder. The driver and app files do not need to be extracted from the downloaded .zip files.   @@ -125,8 +122,7 @@ All of the downloaded driver and applications files must be located in the same Figure 6. Specify the Surface driver and app files from a local path -**Note**   -The **Copy from a Local Directory** check box is only available in SDA version 1.90.0221 or later. +**Note**  The **Copy from a Local Directory** check box is only available in SDA version 1.90.0221 or later.   @@ -134,8 +130,7 @@ The **Copy from a Local Directory** check box is only available in SDA version 1 You can use USB media to perform an SDA deployment if your Surface device is unable to boot from the network. For example, if you do not have a Microsoft Surface Ethernet Adapter or Microsoft Surface dock to facilitate network boot (PXE boot). The USB drive produced by following these steps includes a complete copy of the SDA deployment share and can be run on a Surface device without a network connection. -**Note**   -The offline media files for the complete SDA deployment share are approximately 9 GB in size. Your USB drive must be at least 9 GB in size. A 16 GB USB drive is recommended. +**Note**  The offline media files for the complete SDA deployment share are approximately 9 GB in size. Your USB drive must be at least 9 GB in size. A 16 GB USB drive is recommended.   @@ -149,8 +144,7 @@ Before you can create bootable media files within the MDT Deployment Workbench o 4. **clean** – Removes all configuration from your USB drive. - **Warning**   - This step will remove all information from your drive. Verify that your USB drive does not contain any needed data before you perform the **clean** command. + **Warning**  This step will remove all information from your drive. Verify that your USB drive does not contain any needed data before you perform the **clean** command.   @@ -168,8 +162,7 @@ Before you can create bootable media files within the MDT Deployment Workbench o Figure 7. Use DiskPart to prepare a USB drive for boot - **Note**   - You can format your USB drive with FAT32 from Disk Management, but you must still use DiskPart to set the partition as active for the drive to boot properly. + **Note**  You can format your USB drive with FAT32 from Disk Management, but you must still use DiskPart to set the partition as active for the drive to boot properly.   @@ -276,8 +269,7 @@ When you run the task sequence, you will be prompted to provide the following in - A product key, if one is required - **Note**   - If you are deploying the same version of Windows as the version that came on your device, no product key is required. + **Note**  If you are deploying the same version of Windows as the version that came on your device, no product key is required.   diff --git a/devices/surface/surface-diagnostic-toolkit.md b/devices/surface/surface-diagnostic-toolkit.md index 972b8ebe93..3ba9e952e4 100644 --- a/devices/surface/surface-diagnostic-toolkit.md +++ b/devices/surface/surface-diagnostic-toolkit.md @@ -6,7 +6,7 @@ keywords: ["hardware, device, tool, test, component"] ms.prod: W8 ms.mktglfcycl: manage ms.sitesec: library -author: heatherpoulsen +author: milada --- # Microsoft Surface Diagnostic Toolkit @@ -16,8 +16,7 @@ Find out how you can use the Microsoft Surface Diagnostic Toolkit to test the ha The [Microsoft Surface Diagnostic Toolkit](http://go.microsoft.com/fwlink/p/?LinkId=618121) is a small, portable diagnostic tool that runs through a suite of tests to diagnose the hardware of Surface devices. The Microsoft Surface Diagnostic Toolkit executable file is less than 3 MB, which allows it to be distributed through email. It does not require installation, so it can be run directly from a USB stick or over the network. The Microsoft Surface Diagnostic Toolkit walks you through several tests of individual components including the touchscreen, cameras, and sensors. -**Note**   -A Surface device must boot into Windows to run the Microsoft Surface Diagnostic Toolkit. The Microsoft Surface Diagnostic Toolkit will run only on the following Surface devices: +**Note**  A Surface device must boot into Windows to run the Microsoft Surface Diagnostic Toolkit. The Microsoft Surface Diagnostic Toolkit will run only on the following Surface devices: - Surface Book @@ -33,12 +32,7 @@ A Surface device must boot into Windows to run the Microsoft Surface Diagnostic - Surface Pro -  - -**Note**   -Security software and built-in security measures in many email applications and services will block executable files that are transferred through email. To email the Surface Diagnostic Toolkit, attach the .zip archive file as downloaded from the Surface Tools for IT page without extracting it first. You can also create a custom .zip archive that contains the .exe file. (For example, if you want to localize the text as described in the [Localization](#localization) section of this article.) - -  +**Note**  Security software and built-in security measures in many email applications and services will block executable files that are transferred through email. To email the Surface Diagnostic Toolkit, attach the .zip archive file as downloaded from the Surface Tools for IT page without extracting it first. You can also create a custom .zip archive that contains the .exe file. (For example, if you want to localize the text as described in the [Localization](#localization) section of this article.) Running the Microsoft Surface Diagnostic Toolkit is a hands-on activity. The test sequence includes several tests that require you to perform actions or observe the outcome of the test, and then click the applicable **Pass** or **Fail** button. Some tests require connectivity to external devices, like an external display. Other tests use the built in Windows troubleshooters. At the end of testing, a visual report of the test results is displayed and you are given the option to save a log file or copy the results to the clipboard. @@ -56,8 +50,7 @@ To run a full set of tests with the Microsoft Surface Diagnostic Toolkit, you sh - External speakers or headphones -**Note**   -The Microsoft Surface Diagnostic Toolkit tests verify only the hardware of a Surface device and do not test or resolve issues with the operating system or software. +**Note**  The Microsoft Surface Diagnostic Toolkit tests verify only the hardware of a Surface device and do not test or resolve issues with the operating system or software.   @@ -122,8 +115,7 @@ These files and logs are stored in a .zip file saved by the Microsoft Surface Di ### Type Cover test -**Note**   -A Surface Type Cover is required for this test. +**Note**  A Surface Type Cover is required for this test.   @@ -131,8 +123,7 @@ If a Surface Type Cover is not detected, the test prompts you to connect the Typ ### Integrated keyboard test -**Note**   -This test is only applicable to Surface Book and requires that the Surface Book be docked to the keyboard. +**Note**  This test is only applicable to Surface Book and requires that the Surface Book be docked to the keyboard.   @@ -140,8 +131,7 @@ This test is essentially the same as the Type Cover test, except the integrated ### Canvas mode battery test -**Note**   -This test is only applicable to Surface Book. +**Note**  This test is only applicable to Surface Book.   @@ -149,8 +139,7 @@ Depending on which mode Surface Book is in, different batteries are used to powe ### Clipboard mode battery test -**Note**   -This test is only applicable to Surface Book. +**Note**  This test is only applicable to Surface Book.   @@ -158,8 +147,7 @@ Disconnect the Surface Book from the keyboard to work in clipboard mode. In clip ### Laptop mode battery test -**Note**   -This test is only applicable to Surface Book. +**Note**  This test is only applicable to Surface Book.   @@ -171,8 +159,7 @@ In this test the battery is discharged for a few seconds and tested for health a ### Discrete graphics (dGPU) test -**Note**   -This test is only applicable to Surface Book models with a discrete graphics processor. +**Note**  This test is only applicable to Surface Book models with a discrete graphics processor.   @@ -180,8 +167,7 @@ This test will query the device information of current hardware to check for the ### Discrete graphics (dGPU) fan test -**Note**   -This test is only applicable to Surface Book models with a discrete graphics processor. +**Note**  This test is only applicable to Surface Book models with a discrete graphics processor.   @@ -189,8 +175,7 @@ The discrete graphics processor in the Surface Book includes a separate cooling ### Muscle wire test -**Note**   -This test is only applicable to Surface Book. +**Note**  This test is only applicable to Surface Book.   @@ -198,8 +183,7 @@ To disconnect the Surface Book from the keyboard, software must instruct the mus ### Dead pixel and display artifacts tests -**Note**   -Before you run this test, be sure to clean the screen of dust or smudges. +**Note**  Before you run this test, be sure to clean the screen of dust or smudges.   @@ -219,8 +203,7 @@ The Surface touchscreen should detect input across the entire screen of the devi ### Digitizer pen test -**Note**   -A Microsoft Surface Pen is required for this test. +**Note**  A Microsoft Surface Pen is required for this test.   @@ -240,8 +223,7 @@ This test prompts you to use the volume rocker to turn the volume all the way up ### Micro SD or SD slot test -**Note**   -This test requires a micro SD or SD card that is compatible with the slot in your Surface device. +**Note**  This test requires a micro SD or SD card that is compatible with the slot in your Surface device.   @@ -253,8 +235,7 @@ This test displays the **Recording** tab of the Sound item in Control Panel. The ### Video out test -**Note**   -This test requires an external display with the applicable connection for your Surface device. +**Note**  This test requires an external display with the applicable connection for your Surface device.   @@ -262,8 +243,7 @@ Surface devices provide a Mini DisplayPort connection for connecting to an exter ### Bluetooth test -**Note**   -This test requires a Bluetooth device. The device must be set to pairing mode or made discoverable to perform this test. +**Note**  This test requires a Bluetooth device. The device must be set to pairing mode or made discoverable to perform this test.   @@ -275,8 +255,7 @@ Use this test to verify that the cameras on your Surface device are operating pr ### Speaker test -**Note**   -Headphones or external speakers are required to test the headphone jack in this test. +**Note**  Headphones or external speakers are required to test the headphone jack in this test.   @@ -284,8 +263,7 @@ This test plays audio over left and right channels respectively, both for the in ### Network test -**Note**   -Connect the Surface device to a Wi-Fi network before you run this test. Connections that are made during the test are removed when the test is completed. +**Note**  Connect the Surface device to a Wi-Fi network before you run this test. Connections that are made during the test are removed when the test is completed.   @@ -317,8 +295,7 @@ The ambient light sensor is used to automatically adjust screen brightness relat ### Device orientation test -**Note**   -Before you run this test, disable rotation lock from the Action Center if enabled. +**Note**  Before you run this test, disable rotation lock from the Action Center if enabled.   @@ -330,8 +307,7 @@ This test cycles the screen through brightness levels from 0 percent to 100 perc ### System assessment -**Note**   -The Surface device must be connected to AC power before you can run this test. +**Note**  The Surface device must be connected to AC power before you can run this test.   @@ -350,8 +326,7 @@ If your Surface device has encountered an error that caused the device to fail o You can run the Microsoft Surface Diagnostic Toolkit from the command line or as part of a script. The tool supports the following arguments: -**Note**   -Many of the tests performed by the Microsoft Surface Diagnostic Toolkit require technician interaction. The Microsoft Surface Diagnostic Toolkit cannot run unattended. +**Note**  Many of the tests performed by the Microsoft Surface Diagnostic Toolkit require technician interaction. The Microsoft Surface Diagnostic Toolkit cannot run unattended.   @@ -506,8 +481,7 @@ By default, the Microsoft Surface Diagnostic Toolkit is available in English onl 6. Save the SurfaceDiagnosticTool\_v1.0.60.0.locale file. -**Note**   -The SurfaceDiganosticTool\_v1.0.60.0.locale file must be located in the same folder and have the same name other than the file extension as the Microsoft Surface Diagnostic Toolkit executable file to use the custom prompt text. The SurfaceDiganosticTool\_v1.0.60.0.locale is an .xml file and must use UTF-8 encoding. +**Note**  The SurfaceDiganosticTool\_v1.0.60.0.locale file must be located in the same folder and have the same name other than the file extension as the Microsoft Surface Diagnostic Toolkit executable file to use the custom prompt text. The SurfaceDiganosticTool\_v1.0.60.0.locale is an .xml file and must use UTF-8 encoding.   diff --git a/devices/surface/surface-dock-updater.md b/devices/surface/surface-dock-updater.md index 6cee308250..9bd3933aa6 100644 --- a/devices/surface/surface-dock-updater.md +++ b/devices/surface/surface-dock-updater.md @@ -5,7 +5,7 @@ ms.assetid: 1FEFF277-F7D1-4CB4-8898-FDFE8CBE1D5C ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library -author: heatherpoulsen +author: jobotto --- # Microsoft Surface Dock Updater @@ -17,8 +17,7 @@ The [Microsoft Surface Dock Updater](http://go.microsoft.com/fwlink/p/?LinkId=61 When you run the Microsoft Surface Dock Updater installer you will be prompted to accept an End User License Agreement (EULA). -**Note**   -Updating Surface Dock firmware requires connectivity to the Surface Dock, available only on Surface Pro 3, Surface Pro 4, and Surface Book devices. A Surface Pro 3, Surface Pro 4, or Surface Book is required to successfully install Microsoft Surface Dock Updater. +**Note**  Updating Surface Dock firmware requires connectivity to the Surface Dock, available only on Surface Pro 3, Surface Pro 4, and Surface Book devices. A Surface Pro 3, Surface Pro 4, or Surface Book is required to successfully install Microsoft Surface Dock Updater. ## Update a Surface Dock with Microsoft Surface Dock Updater @@ -73,8 +72,7 @@ To update a Surface Dock with Microsoft Surface Dock Updater, follow these steps 9. If you want to update multiple Surface Docks in one sitting, you can click the **Update another Surface Dock** button to begin the process on the next Surface Dock. - **Note**   - The LED in the Ethernet port of the dock will blink while the update is in progress. Please wait until the LED stops blinking before you unplug your Surface Dock from power. + **Note**  The LED in the Ethernet port of the dock will blink while the update is in progress. Please wait until the LED stops blinking before you unplug your Surface Dock from power.   @@ -96,10 +94,10 @@ Microsoft Surface Dock Updater logs its progress into the Event Log, as shown in | 12102 | Event in the DisplayPort chipset firmware update process | | 12105 | Error | -  +Figure 8. Surface Dock Updater events in Event Viewer + ![figure 8](images/surfacedockupdater-fig8-737test.png) -Figure 8. Surface Dock Updater events in Event Viewer ## Related topics From a25459a9d7278dfdddb5ea2e4c9770cc4c797f4d Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 18 May 2016 15:51:35 -0700 Subject: [PATCH 318/439] fixing spacing issues --- windows/deploy/activate-forest-vamt.md | 14 +- ...ctive-directory-based-activation-client.md | 28 ++- ...ivate-using-key-management-service-vamt.md | 63 ++++++- .../activate-windows-10-clients-vamt.md | 47 +++++- ...ive-directory-based-activation-overview.md | 8 +- windows/deploy/add-manage-products-vamt.md | 6 +- windows/deploy/add-remove-computers-vamt.md | 15 +- windows/deploy/add-remove-product-key-vamt.md | 11 +- ...t-to-microsoft-during-activation-client.md | 17 +- ...gn-applications-using-roles-in-mdt-2013.md | 24 ++- ...d-environment-for-windows-10-deployment.md | 61 ++++++- .../deploy/configure-client-computers-vamt.md | 24 ++- ...configure-mdt-2013-for-userexit-scripts.md | 23 ++- windows/deploy/configure-mdt-2013-settings.md | 19 ++- .../configure-mdt-deployment-share-rules.md | 40 ++++- .../create-a-windows-10-reference-image.md | 137 ++++++++++++++- .../deploy-a-windows-10-image-using-mdt.md | 159 +++++++++++++++++- ...0-with-the-microsoft-deployment-toolkit.md | 34 +++- ...d-with-the-microsoft-deployment-toolkit.md | 26 ++- windows/deploy/import-export-vamt-data.md | 14 +- windows/deploy/install-configure-vamt.md | 8 +- windows/deploy/install-kms-client-key-vamt.md | 10 +- windows/deploy/install-product-key-vamt.md | 12 +- windows/deploy/install-vamt.md | 16 +- ...ate-configuration-manager-with-mdt-2013.md | 42 ++++- windows/deploy/introduction-vamt.md | 19 ++- windows/deploy/key-features-in-mdt-2013.md | 17 +- windows/deploy/kms-activation-vamt.md | 11 +- windows/deploy/local-reactivation-vamt.md | 10 +- windows/deploy/manage-activations-vamt.md | 6 +- windows/deploy/manage-product-keys-vamt.md | 5 +- windows/deploy/manage-vamt-data.md | 5 +- .../deploy/mdt-2013-lite-touch-components.md | 43 ++++- windows/deploy/monitor-activation-client.md | 11 +- windows/deploy/online-activation-vamt.md | 15 +- .../plan-for-volume-activation-client.md | 90 +++++++++- ...re-for-windows-deployment-with-mdt-2013.md | 37 +++- windows/deploy/proxy-activation-vamt.md | 12 +- ...sh-a-windows-7-computer-with-windows-10.md | 40 ++++- windows/deploy/remove-products-vamt.md | 6 +- ...s-7-computer-with-a-windows-10-computer.md | 42 ++++- .../deploy/scenario-kms-activation-vamt.md | 9 +- .../deploy/scenario-online-activation-vamt.md | 33 +++- .../deploy/scenario-proxy-activation-vamt.md | 47 +++++- .../deploy/set-up-mdt-2013-for-bitlocker.md | 42 ++++- ...ows-10-deployment-in-a-test-environment.md | 24 ++- windows/deploy/update-product-status-vamt.md | 9 +- ...0-with-the-microsoft-deployment-toolkit.md | 43 ++++- ...use-orchestrator-runbooks-with-mdt-2013.md | 52 +++++- ...stage-windows-10-deployment-information.md | 32 +++- ...olume-activation-management-tool-client.md | 28 ++- .../deploy/use-vamt-in-windows-powershell.md | 11 +- .../deploy/use-web-services-in-mdt-2013.md | 45 ++++- windows/deploy/vamt-known-issues.md | 4 +- windows/deploy/vamt-requirements.md | 14 +- windows/deploy/vamt-step-by-step.md | 7 +- .../volume-activation-management-tool.md | 15 +- .../deploy/volume-activation-windows-10.md | 23 ++- windows/whats-new/trusted-platform-module.md | 14 +- 59 files changed, 1526 insertions(+), 153 deletions(-) diff --git a/windows/deploy/activate-forest-vamt.md b/windows/deploy/activate-forest-vamt.md index 3c90b7f003..267e03be9c 100644 --- a/windows/deploy/activate-forest-vamt.md +++ b/windows/deploy/activate-forest-vamt.md @@ -2,32 +2,44 @@ title: Activate an Active Directory Forest Online (Windows 10) description: Activate an Active Directory Forest Online ms.assetid: 9b5bc193-799b-4aa5-9d3e-0e495f7195d3 -ms.pagetype: activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- + # Activate an Active Directory Forest Online + You can use the Volume Activation Management Tool (VAMT) Active Directory-Based Activation (ADBA) function to activate an Active Directory (AD) forest over the Internet. ADBA enables certain products to inherit activation from the domain. + **Important**   ADBA is only applicable to Generic Volume License Keys (GVLKs) and KMS Host keys (CSVLKs). To use ADBA, one or more KMS Host keys (CSVLKs) must be installed on the AD forest, and client keys (GVLKs) must be installed on the client products. + ## Requirements + Before performing online activation, ensure that the network and the VAMT installation meet the following requirements: - VAMT is installed on a host computer that has Internet access. - VAMT has administrative permissions to the Active Directory domain. - The KMS Host key (CSVLK) you intend to use is added to VAMT in the **Product Keys** node. + **To perform an online Active Directory forest activation** + 1. Open VAMT. 2. In the left-side pane, click the **Active Directory-Based Activation** node. 3. In the right-side **Actions** pane, click **Online activate forest** to open the **Install Product Key** dialog box. 4. In the **Install Product Key** dialog box, select the KMS Host key (CSVLK) that you want to apply to the AD forest. 5. If required, enter a new Active Directory-Based Activation Object name + **Important**   If you want to rename the ADBA object, you must do it now. After you click **Install Key**, the name cannot be changed. + 6. Click **Install Key**. 7. VAMT displays the **Activating Active Directory** dialog box until it completes the requested action. + The activated object and the date that is was created appear in the **Active Directory-Based Activation** node in the center pane. + ## Related topics + - [Scenario 1: Online Activation](scenario-online-activation-vamt.md) - [Add and Remove Computers](add-remove-computers-vamt.md) diff --git a/windows/deploy/activate-using-active-directory-based-activation-client.md b/windows/deploy/activate-using-active-directory-based-activation-client.md index 1d05f68d69..15ae96825a 100644 --- a/windows/deploy/activate-using-active-directory-based-activation-client.md +++ b/windows/deploy/activate-using-active-directory-based-activation-client.md @@ -2,13 +2,14 @@ title: Activate using Active Directory-based activation (Windows 10) description: Active Directory-based activation is implemented as a role service that relies on AD DS to store activation objects. ms.assetid: 08cce6b7-7b5b-42cf-b100-66c363a846af -ms.pagetype: activation -keywords: ["vamt", "volume activation", "activation", "windows activation"] +keywords: vamt, volume activation, activation, windows activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: CFaw --- + # Activate using Active Directory-based activation **Applies to** - Windows 10 @@ -18,8 +19,10 @@ author: CFaw - Windows Server 2012 R2 - Windows Server 2012 - Windows Server 2008 R2 + **Looking for retail activation?** - [Get Help Activating Microsoft Windows](http://go.microsoft.com/fwlink/p/?LinkId=618644) + Active Directory-based activation is implemented as a role service that relies on AD DS to store activation objects. Active Directory-based activation requires that the forest schema be updated by adprep.exe on a computer running Windows Server 2012 R2 or Windows Server 2012, but after the schema is updated, older domain controllers can still activate clients. Any domain-joined computers running Windows 10, Windows 8.1, Windows 8, Windows Server 2012 R2, or Windows Server 2012 with a GVLK will be activated automatically and transparently. They will stay activated as long as they remain members of the domain and maintain periodic contact with a domain controller. Activation takes place after the Licensing service starts. When this service starts, the computer contacts AD DS automatically, receives the activation object, and is activated without user intervention. To allow computers with GVLKs to activate themselves, use the Volume Activation Tools console in Windows Server 2012 R2 or the VAMT in earlier versions of Windows Server to create an object in the AD DS forest. You create this activation object by submitting a KMS host key to Microsoft, as shown in Figure 10. @@ -29,8 +32,11 @@ The process proceeds as follows: - Extend the domain to the Windows Server 2012 R2 schema level, and add a KMS host key by using the VAMT. 2. Microsoft verifies the KMS host key, and an activation object is created. 3. Client computers are activated by receiving the activation object from a domain controller during startup. + ![Active Directory-based activation flow](images/volumeactivationforwindows81-10.jpg) + **Figure 10**. The Active Directory-based activation flow + For environments in which all computers are running Windows 10, Windows 8.1, Windows 8, Windows Server 2012 R2, or Windows Server 2012 R2, and they are joined to a domain, Active Directory-based activation is the best option for activating all client computers and servers, and you may be able to remove any KMS hosts from your environment. If an environment will continue to contain earlier volume licensing operating systems and applications or if you have workgroup computers outside the domain, you need to maintain a KMS host to maintain activation status for earlier volume licensing editions of Windows and Office. Clients that are activated with Active Directory-based activation will maintain their activated state for up to 180 days since the last contact with the domain, but they will periodically attempt to reactivate before then and at the end of the 180day period. By default, this reactivation event occurs every seven days. @@ -42,22 +48,39 @@ You must be a member of the local Administrators group on all computers mentione 1. Use an account with Domain Administrator and Enterprise Administrator credentials to sign in to a domain controller. 2. Launch Server Manager. 3. Add the Volume Activation Services role, as shown in Figure 11. + ![Adding the Volume Activation Services role](images/volumeactivationforwindows81-11.jpg) + **Figure 11**. Adding the Volume Activation Services role + 4. Click the link to launch the Volume Activation Tools (Figure 12). + ![Launching the Volume Activation Tools](images/volumeactivationforwindows81-12.jpg) + **Figure 12**. Launching the Volume Activation Tools + 5. Select the **Active Directory-Based Activation** option (Figure 13). + ![Selecting Active Directory-Based Activation](images/volumeactivationforwindows81-13.jpg) + **Figure 13**. Selecting Active Directory-Based Activation + 6. Enter your KMS host key and (optionally) a display name (Figure 14). + ![Entering your KMS host key](images/volumeactivationforwindows81-14.jpg) + **Figure 14**. Entering your KMS host key + 7. Activate your KMS host key by phone or online (Figure 15). + ![Choosing how to activate your product](images/volumeactivationforwindows81-15.jpg) + **Figure 15**. Choosing how to activate your product + 8. After activating the key, click **Commit**, and then click **Close**. + ## Verifying the configuration of Active Directory-based activation + To verify your Active Directory-based activation configuration, complete the following steps: 1. After you configure Active Directory-based activation, start a computer that is running an edition of Windows that is configured by volume licensing. 2. If the computer has been previously configured with a MAK key, replace the MAK key with the GVLK by running the **slmgr.vbs /ipk** command and specifying the GLVK as the new product key. @@ -65,6 +88,7 @@ To verify your Active Directory-based activation configuration, complete the fol 4. Sign in to the computer. 5. Open Windows Explorer, right-click **Computer**, and then click **Properties**. 6. Scroll down to the **Windows activation** section, and verify that this client has been activated. + **Note**
    If you are using both KMS and Active Directory-based activation, it may be difficult to see whether a client has been activated by KMS or by Active Directory-based activation. Consider disabling KMS during the test, or make sure that you are using a client computer that has not already been activated by KMS. The **slmrg.vbs /dlv** command also indicates whether KMS has been used. diff --git a/windows/deploy/activate-using-key-management-service-vamt.md b/windows/deploy/activate-using-key-management-service-vamt.md index 8fda1630c4..9b1cea0e24 100644 --- a/windows/deploy/activate-using-key-management-service-vamt.md +++ b/windows/deploy/activate-using-key-management-service-vamt.md @@ -1,15 +1,17 @@ --- title: Activate using Key Management Service (Windows 10) ms.assetid: f2417bfe-7d25-4e82-bc07-de316caa8dac -ms.pagetype: activation description: -keywords: ["vamt", "volume activation", "activation", "windows activation"] +keywords: vamt, volume activation, activation, windows activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- + # Activate using Key Management Service + **Applies to** - Windows 10 - Windows 8.1 @@ -18,73 +20,118 @@ author: jdeckerMS - Windows Server 2012 R2 - Windows Server 2012 - Windows Server 2008 R2 + **Looking for retail activation?** + - [Get Help Activating Microsoft Windows](http://go.microsoft.com/fwlink/p/?LinkId=618644) + There are three possible scenarios for volume activation of Windows 10 or Windows Server 2012 R2 by using a Key Management Service (KMS) host: - Host KMS on a computer running Windows 10 - Host KMS on a computer running Windows Server 2012 R2 - Host KMS on a computer running an earlier version of Windows + ## Key Management Service in Windows 10 + Installing a KMS host key on a computer running Windows 10 allows you to activate other computers running Windows 10 against this KMS host and earlier versions of the client operating system, such as Windows 8.1 or Windows 7. Clients locate the KMS server by using resource records in DNS, so some configuration of DNS may be required. This scenario can be beneficial if your organization uses volume activation for clients and MAK-based activation for a smaller number of servers. To enable KMS functionality, a KMS key is installed on a KMS host; then, the host is activated over the Internet or by phone using Microsoft’s activation services. + **Configure KMS in Windows 10** + 1. Open an elevated command prompt. 2. Enter one of the following commands. - To install a KMS key, type **slmgr.vbs /ipk <KmsKey>**. - To activate online, type **slmgr.vbs /ato**. - To activate by using the telephone, type **slui.exe 4**. 3. After activating the KMS key, restart the Software Protection Service. + For more information, see the information for Windows 7 in [Deploy KMS Activation](http://go.microsoft.com/fwlink/p/?LinkId=717032). + ## Key Management Service in Windows Server 2012 R2 Installing a KMS host key on a computer running Windows Server allows you to activate computers running Windows Server 2012 R2, Windows Sever 2008 R2, Windows Server 2008, Windows 10, Windows 8.1, Windows 7, and Windows Vista. + **Note**   You cannot install a client KMS key into the KMS in Windows Server. + This scenario is commonly used in larger organizations that do not find the overhead of using a server a burden. + **Note**   + If you receive error 0xC004F015 when trying to activate Windows 10 Enterprise, see [KB 3086418](http://go.microsoft.com/fwlink/p/?LinkId=620687). + **Configure KMS in Windows Server 2012 R2** + 1. Sign in to a computer running Windows Server 2012 R2 with an account that has local administrative credentials. 2. Launch Server Manager. 3. Add the Volume Activation Services role, as shown in Figure 4. + ![Adding the Volume Activation Services role in Server Manager](images/volumeactivationforwindows81-04.jpg) - **Figure 4**. Adding the Volume Activation Services role in Server Manager + + **Figure 4**. Adding the Volume Activation Services role in Server Manager\ + 4. When the role installation is complete, click the link to launch the Volume Activation Tools (Figure 5). + ![Launching the Volume Activation Tools](images/volumeactivationforwindows81-05.jpg) + **Figure 5**. Launching the Volume Activation Tools -5. Select the **Key Management Service (KMS)** option, and specify the computer that will act as the KMS host (Figure 6). + + 5. Select the **Key Management Service (KMS)** option, and specify the computer that will act as the KMS host (Figure 6). This can be the same computer on which you installed the role or another computer. For example, it can be a client computer running Windows 10. - ![Configuring the computer as a KMS host](images/volumeactivationforwindows81-06.jpg) + + ![Configuring the computer as a KMS host](images/volumeactivationforwindows81-06.jpg) + **Figure 6**. Configuring the computer as a KMS host + 6. Install your KMS host key by typing it in the text box, and then click **Commit** (Figure 7). + ![Installing your KMS host key](images/volumeactivationforwindows81-07.jpg) + **Figure 7**. Installing your KMS host key + 7. If asked to confirm replacement of an existing key, click **Yes**. 8. After the product key is installed, you must activate it. Click **Next** (Figure 8). + ![Activating the software](images/volumeactivationforwindows81-08.jpg) + **Figure 8**. Activating the software -The KMS key can be activated online or by phone. See Figure 9. -![Choosing to activate online](images/volumeactivationforwindows81-09.jpg) -**Figure 9**. Choosing to activate online + + The KMS key can be activated online or by phone. See Figure 9. + + ![Choosing to activate online](images/volumeactivationforwindows81-09.jpg) + + **Figure 9**. Choosing to activate online + Now that the KMS host is configured, it will begin to listen for activation requests. However, it will not activate clients successfully until the activation threshold is met. + ## Verifying the configuration of Key Management Service + You can verify KMS volume activation from the KMS host server or from the client computer. KMS volume activation requires a minimum threshold of 25 computers before activation requests will be processed. The verification process described here will increment the activation count each time a client computer contacts the KMS host, but unless the activation threshold is reached, the verification will take the form of an error message rather than a confirmation message. **Note**   + If you configured Active Directory-based activation before configuring KMS activation, you must use a client computer that will not first try to activate itself by using Active Directory-based activation. You could use a workgroup computer that is not joined to a domain or a computer running Windows 7 or Windows Server 2008 R2. + To verify that KMS volume activation works, complete the following steps: + 1. On the KMS host, open the event log and confirm that DNS publishing is successful. 2. On a client computer, open a Command Prompt window, type **Slmgr.vbs /ato**, and then press ENTER.

    The **/ato** command causes the operating system to attempt activation by using whichever key has been installed in the operating system. The response should show the license state and detailed Windows version information. 3. On a client computer or the KMS host, open an elevated Command Prompt window, type **Slmgr /dlv**, and then press ENTER.

    + The **/dlv** command displays the detailed licensing information. The response should return an error that states that the KMS activation count is too low. This confirms that KMS is functioning correctly, even though the client has not been activated. + For more information about the use and syntax of slmgr.vbs, see [Slmgr.vbs Options](http://go.microsoft.com/fwlink/p/?LinkId=733639). + ## Key Management Service in earlier versions of Windows + If you have already established a KMS infrastructure in your organization for an earlier version of Windows, you may want to continue using that infrastructure to activate computers running Windows 10 or Windows Server 2012 R2. Your existing KMS host must be running Windows 7 or later. To upgrade your KMS host, complete the following steps: + 1. Download and install the correct update for your current KMS host operating system. Restart the computer as directed. 2. Request a new KMS host key from the Volume Licensing Service Center. 3. Install the new KMS host key on your KMS host. 4. Activate the new KMS host key by running the slmrg.vbs script. + For detailed instructions, see [Update that enables Windows 8.1 and Windows 8 KMS hosts to activate a later version of Windows](http://go.microsoft.com/fwlink/p/?LinkId=618265) and [Update that enables Windows 7 and Windows Server 2008 R2 KMS hosts to activate Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=626590). + ## See also - [Volume Activation for Windows 10](volume-activation-windows-10.md)   diff --git a/windows/deploy/activate-windows-10-clients-vamt.md b/windows/deploy/activate-windows-10-clients-vamt.md index 3fd9d3ab81..91b743947e 100644 --- a/windows/deploy/activate-windows-10-clients-vamt.md +++ b/windows/deploy/activate-windows-10-clients-vamt.md @@ -2,14 +2,16 @@ title: Activate clients running Windows 10 (Windows 10) description: After you have configured Key Management Service (KMS) or Active Directory-based activation on your network, activating a client running Windows 10 is easy. ms.assetid: 39446e49-ad7c-48dc-9f18-f85a11ded643 -ms.pagetype: activation -keywords: ["vamt", "volume activation", "activation", "windows activation"] +keywords: vamt, volume activation, activation, windows activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- + # Activate clients running Windows 10 + **Applies to** - Windows 10 - Windows 8.1 @@ -18,61 +20,102 @@ author: jdeckerMS - Windows Server 2012 R2 - Windows Server 2012 - Windows Server 2008 R2 + **Looking for retail activation?** + - [Get Help Activating Microsoft Windows](http://go.microsoft.com/fwlink/p/?LinkId=618644) + After you have configured Key Management Service (KMS) or Active Directory-based activation on your network, activating a client running Windows 10 is easy. If the computer has been configured with a Generic Volume License Key (GVLK), neither IT nor the user need take any action. It just works. Enterprise edition images and installation media should already be configured with the GVLK. When the client computer starts, the Licensing service examines the current licensing condition of the computer. If activation or reactivation is required, the following sequence occurs: 1. If the computer is a member of a domain, it asks a domain controller for a volume activation object. If Active Directory-based activation is configured, the domain controller returns the object. If the object matches the edition of the software that is installed and the computer has a matching GVLK, the computer is activated (or reactivated), and it will not need to be activated again for 180 days, although the operating system will attempt reactivation at much shorter, regular intervals. 2. If the computer is not a member of a domain or if the volume activation object is not available, the computer will issue a DNS query to attempt to locate a KMS server. If a KMS server can be contacted, activation occurs if the KMS has a key that matches the computer’s GVLK. 3. The computer tries to activate against Microsoft servers if it is configured with a MAK. + If the client is not able to activate itself successfully, it will periodically try again. The frequency of the retry attempts depends on the current licensing state and whether the client computer has been successfully activated in the past. For example, if the client computer had been previously activated by Active Directory-based activation, it will periodically try to contact the domain controller at each restart. + ## How Key Management Service works + KMS uses a client–server topology. KMS client computers can locate KMS host computers by using DNS or a static configuration. KMS clients contact the KMS host by using RPCs carried over TCP/IP. + ### Key Management Service activation thresholds + You can activate physical computers and virtual machines by contacting a KMS host. To qualify for KMS activation, there must be a minimum number of qualifying computers (called the activation threshold). KMS clients will be activated only after this threshold has been met. Each KMS host counts the number of computers that have requested activation until the threshold is met. + A KMS host responds to each valid activation request from a KMS client with the count of how many computers have already contacted the KMS host for activation. Client computers that receive a count below the activation threshold are not activated. For example, if the first two computers that contact the KMS host are running Windows 10, the first receives an activation count of 1, and the second receives an activation count of 2. If the next computer is a virtual machine on a computer running Windows 10, it receives an activation count of 3, and so on. None of these computers will be activated, because computers running Windows 10, like other client operating system versions, must receive an activation count of 25 or more. When KMS clients are waiting for the KMS to reach the activation threshold, they will connect to the KMS host every two hours to get the current activation count. They will be activated when the threshold is met. + In our example, if the next computer that contacts the KMS host is running Windows Server 2012 R2, it receives an activation count of 4, because activation counts are cumulative. If a computer running Windows Server 2012 R2 receives an activation count that is 5 or more, it is activated. If a computer running Windows 10 receives an activation count of 25 or more, it is activated. + ### Activation count cache + To track the activation threshold, the KMS host keeps a record of the KMS clients that request activation. The KMS host gives each KMS client a client ID designation, and the KMS host saves each client ID in a table. By default, each activation request remains in the table for up to 30 days. When a client renews its activation, the cached client ID is removed from the table, a new record is created, and the 30day period begins again. If a KMS client computer does not renew its activation within 30 days, the KMS host removes the corresponding client ID from the table and reduces the activation count by one. However, the KMS host only caches twice the number of client IDs that are required to meet the activation threshold. Therefore, only the 50 most recent client IDs are kept in the table, and a client ID could be removed much sooner than 30 days. The total size of the cache is set by the type of client computer that is attempting to activate. If a KMS host receives activation requests only from servers, the cache will hold only 10 client IDs (twice the required 5). If a client computer running Windows 10 contacts that KMS host, KMS increases the cache size to 50 to accommodate the higher threshold. KMS never reduces the cache size. + ### Key Management Service connectivity + KMS activation requires TCP/IP connectivity. By default, KMS hosts and clients use DNS to publish and find the KMS. The default settings can be used, which require little or no administrative action, or KMS hosts and client computers can be manually configured based on network configuration and security requirements. + ### Key Management Service activation renewal + KMS activations are valid for 180 days (the *activation validity interval*). To remain activated, KMS client computers must renew their activation by connecting to the KMS host at least once every 180 days. By default, KMS client computers attempt to renew their activation every 7 days. If KMS activation fails, the client computer retries every two hours. After a client computer’s activation is renewed, the activation validity interval begins again. + ### Publication of the Key Management Service + The KMS uses service (SRV) resource records in DNS to store and communicate the locations of KMS hosts. KMS hosts use the DNS dynamic update protocol, if available, to publish the KMS service (SRV) resource records. If dynamic update is not available or the KMS host does not have rights to publish the resource records, the DNS records must be published manually, or you must configure client computers to connect to specific KMS hosts. + ### Client discovery of the Key Management Service + By default, KMS client computers query DNS for KMS information. The first time a KMS client computer queries DNS for KMS information, it randomly chooses a KMS host from the list of service (SRV) resource records that DNS returns. The address of a DNS server that contains the service (SRV) resource records can be listed as a suffixed entry on KMS client computers, which allows one DNS server to advertise the service (SRV) resource records for KMS, and KMS client computers with other primary DNS servers to find it. Priority and weight parameters can be added to the DnsDomainPublishList registry value for KMS. Establishing KMS host priority groupings and weighting within each group allows you to specify which KMS host the client computers should try first and balances traffic among multiple KMS hosts. Only Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Server 2012 R2, Windows Server 2012, and Windows Server 2008 R2 provide these priority and weight parameters. If the KMS host that a client computer selects does not respond, the KMS client computer removes that KMS host from its list of service (SRV) resource records and randomly selects another KMS host from the list. When a KMS host responds, the KMS client computer caches the name of the KMS host and uses it for subsequent activation and renewal attempts. If the cached KMS host does not respond on a subsequent renewal, the KMS client computer discovers a new KMS host by querying DNS for KMS service (SRV) resource records. By default, client computers connect to the KMS host for activation by using anonymous RPCs through TCP port 1688. (You can change the default port.) After establishing a TCP session with the KMS host, the client computer sends a single request packet. The KMS host responds with the activation count. If the count meets or exceeds the activation threshold for that operating system, the client computer is activated and the session is closed. The KMS client computer uses this same process for renewal requests. 250 bytes are used for communication each way. + ### Domain Name System server configuration + The default KMS automatic publishing feature requires the service (SRV) resource record and support for DNS dynamic update protocol. KMS client computer default behavior and the KMS service (SRV) resource record publishing are supported on a DNS server that is running Microsoft software or any other DNS server that supports service (SRV) resource records (per Internet Engineering Task Force \[IETF\] Request for Comments \[RFC\] 2782) and dynamic updates (per IETF RFC 2136). For example, Berkeley Internet Domain Name versions 8.x and 9.x support service (SRV) resource records and dynamic update. The KMS host must be configured so that it has the credentials needed to create and update the following resource records on the DNS servers: service (SRV), IPv4 host (A), and IPv6 host (AAAA), or the records need to be created manually. The recommended solution for giving the KMS host the needed credentials is to create a security group in AD DS, then add all KMS hosts to that group. On a DNS server that is running Microsoft software, ensure that this security group is given full control over the \_VLMCS.\_TCP record in each DNS domain that will contain the KMS service (SRV) resource records. + ### Activating the first Key Management Service host + KMS hosts on the network need to install a KMS key, and then be activated with Microsoft. Installation of a KMS key enables the KMS on the KMS host. After installing the KMS key, complete the activation of the KMS host by telephone or online. Beyond this initial activation, a KMS host does not communicate any information to Microsoft. KMS keys are only installed on KMS hosts, never on individual KMS client computers. + ### Activating subsequent Key Management Service hosts + Each KMS key can be installed on up to six KMS hosts. These hosts can be physical computers or virtual machines. After activating a KMS host, the same host can be reactivated up to nine times with the same key. If the organization needs more than six KMS hosts, you can request additional activations for your organization’s KMS key by calling a Microsoft Volume [Licensing Activation Center](http://go.microsoft.com/fwlink/p/?LinkID=618264) to request an exception. + ## How Multiple Activation Key works + A MAK is used for one-time activation with Microsoft’s hosted activation services. Each MAK has a predetermined number of allowed activations. This number is based on volume licensing agreements, and it might not match the organization’s exact license count. Each activation that uses a MAK with the Microsoft hosted activation service counts toward the activation limit. + You can activate computers by using a MAK in two ways: - **MAK independent activation**. Each computer independently connects and is activated with Microsoft over the Internet or by telephone. MAK independent activation is best suited to computers within an organization that do not maintain a connection to the corporate network. MAK independent activation is shown in Figure 16. + ![MAK independent activation](images/volumeactivationforwindows81-16.jpg) + **Figure 16**. MAK independent activation - **MAK proxy activation**. MAK proxy activation enables a centralized activation request on behalf of multiple computers with one connection to Microsoft. You configure MAK proxy activation by using the VAMT. MAK proxy activation is appropriate for environments in which security concerns restrict direct access to the Internet or the corporate network. It is also suited for development and test labs that lack this connectivity. MAK proxy activation with the VAMT is shown in Figure 17. + ![MAK proxy activation with the VAMT](images/volumeactivationforwindows81-17.jpg) + **Figure 17**. MAK proxy activation with the VAMT + A MAK is recommended for computers that rarely or never connect to the corporate network and for environments in which the number of computers that require activation does not meet the KMS activation threshold. + You can use a MAK for individual computers or with an image that can be duplicated or installed by using Microsoft deployment solutions. You can also use a MAK on a computer that was originally configured to use KMS activation. This is useful for moving a computer off the core network to a disconnected environment. + ### Multiple Activation Key architecture and activation + MAK independent activation installs a MAK product key on a client computer. The key instructs that computer to activate itself with Microsoft servers over the Internet. In MAK proxy activation, the VAMT installs a MAK product key on a client computer, obtains the installation ID from the target computer, sends the installation ID to Microsoft on behalf of the client, and obtains a confirmation ID. The tool then activates the client computer by installing the confirmation ID. + ## Activating as a standard user + Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Server 2012 R2, Windows Server 2012, and Windows Server 2008 R2 do not require administrator privileges for activation, but this change does not allow standard user accounts to remove computers running Windows 7 or Windows Server 2008 R2 from the activated state. An administrator account is still required for other activation- or license-related tasks, such as “rearm.” + ## See also + - [Volume Activation for Windows 10](volume-activation-windows-10.md)     diff --git a/windows/deploy/active-directory-based-activation-overview.md b/windows/deploy/active-directory-based-activation-overview.md index 6d9c58170d..7f47592aa7 100644 --- a/windows/deploy/active-directory-based-activation-overview.md +++ b/windows/deploy/active-directory-based-activation-overview.md @@ -2,19 +2,25 @@ title: Active Directory-Based Activation Overview (Windows 10) description: Active Directory-Based Activation Overview ms.assetid: c1dac3bd-6a86-4c45-83dd-421e63a398c0 -ms.pagetype: activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: CFaw --- + # Active Directory-Based Activation Overview + Active Directory-Based Activation (ADBA) enables enterprises to activate computers through a connection to their domain. Many companies have computers at offsite locations that use products that are registered to the company. Previously these computers needed to either use a retail key or a Multiple Activation Key (MAK), or physically connect to the network in order to activate their products by using Key Management Services (KMS). ADBA provides a way to activate these products if the computers can join the company’s domain. When the user joins their computer to the domain, the ADBA object automatically activates Windows installed on their computer, as long as the computer has a Generic Volume License Key (GVLK) installed. No single physical computer is required to act as the activation object, because it is distributed throughout the domain. + ## Active Directory-Based Activation Scenarios + VAMT enables IT Professionals to manage and activate the Active Directory-Based Activation object. Activation can be performed by using a scenario such as the following: - Online activation: To activate an ADBA forest online, the user selects the **Online activate forest** function, selects a KMS Host key (CSVLK) to use, and gives the Active Directory-Based Activation Object a name. - Proxy activation: For a proxy activation, the user first selects the **Proxy activate forest** function, selects a KMS Host key (CSVLK) to use, gives the Active Directory-Based Activation Object a name, and provides a file name to save the CILx file that contains the Installation ID. Next, the user takes that file to a computer that is running VAMT with an Internet connection and then selects the **Acquire confirmation IDs for CILX** function on the VAMT landing page, and provides the original CILx file. When VAMT has loaded the Confirmation IDs into the original CILx file, the user takes this file back to the original VAMT instance, where the user completes the proxy activation process by selecting the **Apply confirmation ID to Active Directory domain** function. + ## Related topics + - [How to Activate an Active Directory Forest Online](http://go.microsoft.com/fwlink/p/?LinkId=246565) - [How to Proxy Activate an Active Directory Forest](http://go.microsoft.com/fwlink/p/?LinkId=246566)   diff --git a/windows/deploy/add-manage-products-vamt.md b/windows/deploy/add-manage-products-vamt.md index 2e6d5aefb8..6bbbfaf218 100644 --- a/windows/deploy/add-manage-products-vamt.md +++ b/windows/deploy/add-manage-products-vamt.md @@ -2,15 +2,19 @@ title: Add and Manage Products (Windows 10) description: Add and Manage Products ms.assetid: a48fbc23-917d-40f7-985c-e49702c05e51 -ms.pagetype: activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- + # Add and Manage Products + This section describes how to add client computers into the Volume Activation Management Tool (VAMT). After the computers are added, you can manage the products that are installed on your network. + ## In this Section + |Topic |Description | |------|------------| |[Add and Remove Computers](add-remove-computers-vamt.md) |Describes how to add client computers to VAMT. | diff --git a/windows/deploy/add-remove-computers-vamt.md b/windows/deploy/add-remove-computers-vamt.md index 5ac84ad9a6..eae34332f2 100644 --- a/windows/deploy/add-remove-computers-vamt.md +++ b/windows/deploy/add-remove-computers-vamt.md @@ -2,16 +2,21 @@ title: Add and Remove Computers (Windows 10) description: Add and Remove Computers ms.assetid: cb6f3a78-ece0-4dc7-b086-cb003d82cd52 -ms.pagetype: activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: jdeckerMS +ms.pagetype: activation --- + # Add and Remove Computers + You can add computers that have any of the supported Windows or Office products installed to a Volume Activation Management Tool (VAMT) database by using the **Discover products** function. You can search for computers in an Active Directory domain, by individual computer name or IP address, in a workgroup, or by a general LDAP query. You can remove computers from a VAMT database by using the **Delete** function. After you add the computers, you can add the products that are installed on the computers by running the **Update license status** function. + Before adding computers, ensure that the Windows Management Instrumentation (WMI) firewall exception required by VAMT has been enabled on all target computers. For more information see [Configure Client Computers](configure-client-computers-vamt.md). + ## To add computers to a VAMT database + 1. Open VAMT. 2. Click **Discover products** in the **Actions** menu in the right-side pane to open the **Discover Products** dialog box. 3. In the **Discover products** dialog box, click **Search for computers in the Active Directory** to display the search options, then click the search option you want to use. You can search for computers in an Active Directory domain, by individual computer name or IP address, in a workgroup, or by a general LDAP query. @@ -22,11 +27,14 @@ Before adding computers, ensure that the Windows Management Instrumentation (WMI 4. Click **Search**. 5. VAMT searches for the specified computers and adds them to the VAMT database. During the search, VAMT displays the **Finding computers** message shown below. To cancel the search, click **Cancel**. When the search is complete the names of the newly-discovered computers appear in the product list view in the center pane. + ![VAMT, Finding computers dialog box](images/dep-win8-l-vamt-findingcomputerdialog.gif) **Important**   This step adds only the computers to the VAMT database, and not the products that are installed on the computers. To add the products, you need to run the **Update license status** function. + ## To add products to VAMT + 1. In the **Products** list, select the computers that need to have their product information added to the VAMT database. 2. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. 3. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. @@ -35,11 +43,16 @@ Before adding computers, ensure that the Windows Management Instrumentation (WMI 4. Click **Filter**. VAMT displays the filtered list in the center pane. 5. In the right-side **Actions** pane, click **Update license status** and then click a credential option. Choose **Alternate Credentials** only if you are updating products that require administrator credentials different from the ones you used to log into the computer. If you are supplying alternate credentials, in the **Windows Security** dialog box type the appropriate user name and password and click **OK**. 6. VAMT displays the **Collecting product information** dialog box while it collects the licensing status of all supported products on the selected computers. When the process is finished, the updated licensing status of each product will appear in the product list view in the center pane. + **Note**   If a computer has more than one supported product installed, VAMT adds an entry for each product. The entry appears under the appropriate product heading. + ## To remove computers from a VAMT database + You can delete a computer by clicking on it in the product list view, and then clicking **Delete** in the **Selected Item** menu in the right-hand pane. In the **Confirm Delete Selected Products** dialog box that appears, click **Yes** to delete the computer. If a computer has multiple products listed, you must delete each product to completely remove the computer from the VAMT database. + ## Related topics + - [Add and Manage Products](add-manage-products-vamt.md)     diff --git a/windows/deploy/add-remove-product-key-vamt.md b/windows/deploy/add-remove-product-key-vamt.md index a57414232e..5776806c20 100644 --- a/windows/deploy/add-remove-product-key-vamt.md +++ b/windows/deploy/add-remove-product-key-vamt.md @@ -2,24 +2,33 @@ title: Add and Remove a Product Key (Windows 10) description: Add and Remove a Product Key ms.assetid: feac32bb-fb96-4802-81b8-c69220dcfcce -ms.pagetype: activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- + # Add and Remove a Product Key + Before you can use a Multiple Activation Key (MAK), retail, or KMS Host key (CSVLK) product key, you must first add it to the Volume Activation Management Tool (VAMT) database. + ## To Add a Product Key + 1. Open VAMT. 2. In the left-side pane, right-click the **Product Keys** node to open the **Actions** menu. 3. Click **Add product keys** to open the **Add Product Keys** dialog box. 4. In the **Add Product Keys** dialog box, select from one of the following methods to add product keys: - To add product keys manually, click **Enter product key(s) separated by line breaks**, enter one or more product keys separated by line breaks, and click **Add Key(s)**. - To import a Comma Separated Values (CSV) file containing a list of product keys, click **Select a product key file to import**, browse to the file location, click **Open** to import the file, and then click **Add Key(s)**. + **Note**   If you are activating a large number of products with a MAK, you should refresh the activation count of the MAK, to ensure that the MAK can support the required number of activations. In the product key list in the center pane, select the MAK and click **Refresh product key data online** in the right-side pane to contact Microsoft and retrieve the number of remaining activations for the MAK. This step requires Internet access. You can only retrieve the remaining activation count for MAKs. + ## Remove a Product Key + - To remove a product key from the list, simply select the key in the list and click **Delete** on the **Selected Items** menu in the right-side pane. Click **Yes** to confirm deletion of the product key. Removing a product key from the VAMT database will not affect the activation state of any products or computers on the network. + ## Related topics + - [Manage Product Keys](manage-product-keys-vamt.md) diff --git a/windows/deploy/appendix-information-sent-to-microsoft-during-activation-client.md b/windows/deploy/appendix-information-sent-to-microsoft-during-activation-client.md index f3880ec953..8a21466ddb 100644 --- a/windows/deploy/appendix-information-sent-to-microsoft-during-activation-client.md +++ b/windows/deploy/appendix-information-sent-to-microsoft-during-activation-client.md @@ -1,12 +1,12 @@ --- title: Appendix Information sent to Microsoft during activation (Windows 10) ms.assetid: 4bfff495-07d0-4385-86e3-7a077cbd64b8 -ms.pagetype: activation description: -keywords: ["vamt", "volume activation", "activation", "windows activation"] +keywords: vamt, volume activation, activation, windows activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- # Appendix: Information sent to Microsoft during activation @@ -18,12 +18,18 @@ author: jdeckerMS - Windows Server 2012 R2 - Windows Server 2012 - Windows Server 2008 R2 + **Looking for retail activation?** + - [Get Help Activating Microsoft Windows](http://go.microsoft.com/fwlink/p/?LinkId=618644) + When you activate a computer running Windows 10, the following information is sent to Microsoft: + - The Microsoft product code (a five-digit code that identifies the Windows product you are activating) - A channel ID or site code that identifies how the Windows product was originally obtained + For example, a channel ID or site code identifies whether the product was originally purchased from a retail store, obtained as an evaluation copy, obtained through a volume licensing program, or preinstalled by a computer manufacturer. + - The date of installation and whether the installation was successful - Information that helps confirm that your Windows product key has not been altered - Computer make and model @@ -34,18 +40,25 @@ When you activate a computer running Windows 10, the following information is s - BIOS name, revision number, and revision date - Volume serial number (hashed) of the hard disk drive - The result of the activation check + This includes error codes and the following information about any activation exploits and related malicious or unauthorized software that was found or disabled: + - The activation exploit’s identifier - The activation exploit’s current state, such as cleaned or quarantined - Computer manufacturer’s identification - The activation exploit’s file name and hash in addition to a hash of related software components that may indicate the presence of an activation exploit - The name and a hash of the contents of your computer’s startup instructions file - If your Windows license is on a subscription basis, information about how your subscription works + Standard computer information is also sent, but your computer’s IP address is only retained temporarily. + ## Use of information + Microsoft uses the information to confirm that you have a licensed copy of the software. Microsoft does not use the information to contact individual consumers. For additional details, see [Windows 10 Privacy Statement](http://go.microsoft.com/fwlink/p/?LinkId=619879). + ## See also + - [Volume Activation for Windows 10](volume-activation-windows-10.md)     diff --git a/windows/deploy/assign-applications-using-roles-in-mdt-2013.md b/windows/deploy/assign-applications-using-roles-in-mdt-2013.md index 1f6f7b047c..dab995bb1e 100644 --- a/windows/deploy/assign-applications-using-roles-in-mdt-2013.md +++ b/windows/deploy/assign-applications-using-roles-in-mdt-2013.md @@ -2,34 +2,47 @@ title: Assign applications using roles in MDT (Windows 10) description: This topic will show you how to add applications to a role in the MDT database and then assign that role to a computer. ms.assetid: d82902e4-de9c-4bc4-afe0-41d649b83ce7 -ms.pagetype: mdt -keywords: ["settings, database, deploy"] +keywords: settings, database, deploy ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: mdt author: mtniehaus --- + # Assign applications using roles in MDT + This topic will show you how to add applications to a role in the MDT database and then assign that role to a computer. For the purposes of this topic, the application we are adding is Adobe Reader XI. In addition to using computer-specific entries in the database, you can use roles in MDT to group settings together. + ## Create and assign a role entry in the database + 1. On MDT01, using Deployment Workbench, in the MDT Production deployment share, expand **Advanced Configuration** and then expand **Database**. 2. In the **Database** node, right-click **Role**, select **New**, and create a role entry with the following settings: 1. Role name: Standard PC 2. Applications / Lite Touch Applications: 3. Install - Adobe Reader XI - x86 + ![figure 12](images/mdt-09-fig12.png) + Figure 12. The Standard PC role with the application added + ## Associate the role with a computer in the database + After creating the role, you can associate it with one or more computer entries. 1. Using Deployment Workbench, expand **MDT Production**, expand **Advanced Configuration**, expand **Database**, and select **Computers**. 2. In the **Computers** node, double-click the **PC00075** entry, and add the following setting: - Roles: Standard PC + ![figure 13](images/mdt-09-fig13.png) + Figure 13. The Standard PC role added to PC00075 (having ID 1 in the database). + ## Verify database access in the MDT simulation environment + When the database is populated, you can use the MDT simulation environment to simulate a deployment. The applications are not installed, but you can see which applications would be installed if you did a full deployment of the computer. 1. On PC0001, log on as **CONTOSO\\MDT\_BA**. 2. Modify the C:\\MDT\\CustomSettings.ini file to look like the following: + ``` syntax [Settings] Priority=CSettings, CRoles, RApplications, Default @@ -92,14 +105,21 @@ When the database is populated, you can use the MDT simulation environment to si Parameters=Role Order=Sequence ``` + 3. Using an elevated Windows PowerShell prompt (run as Administrator), run the following commands. Press **Enter** after each command: + ``` syntax Set-Location C:\MDT .\Gather.ps1 + ``` + ![figure 14](images/mdt-09-fig14.png) + Figure 14. ZTIGather.log displaying the application GUID belonging to the Adobe Reader XI application that would have been installed if you deployed this machine. + ## Related topics + [Set up MDT for BitLocker](set-up-mdt-2013-for-bitlocker.md) [Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) [Configure MDT for UserExit scripts](configure-mdt-2013-for-userexit-scripts.md) diff --git a/windows/deploy/build-a-distributed-environment-for-windows-10-deployment.md b/windows/deploy/build-a-distributed-environment-for-windows-10-deployment.md index d2f59e1824..32a354ad0e 100644 --- a/windows/deploy/build-a-distributed-environment-for-windows-10-deployment.md +++ b/windows/deploy/build-a-distributed-environment-for-windows-10-deployment.md @@ -2,43 +2,63 @@ title: Build a distributed environment for Windows 10 deployment (Windows 10) description: In this topic, you will learn how to replicate your Windows 10 deployment shares to facilitate the deployment of Windows 10 in remote or branch locations. ms.assetid: a6cd5657-6a16-4fff-bfb4-44760902d00c -ms.pagetype: mdt -keywords: ["replication, replicate, deploy, configure, remote"] +keywords: replication, replicate, deploy, configure, remote ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: mdt author: mtniehaus --- + # Build a distributed environment for Windows 10 deployment + **Applies to** - Windows 10 + In this topic, you will learn how to replicate your Windows 10 deployment shares to facilitate the deployment of Windows 10 in remote or branch locations. If you work in a distributed environment, replicating the deployment shares is an important part of the deployment solution. With images reaching 5 GB in size or more, you can't deploy machines in a remote office over the wire. You need to replicate the content, so that the clients can do local deployments. + We will use four machines for this topic: DC01, MDT01, MDT02, and PC0006. DC01 is a domain controller, MDT01 is a Windows Server 2012 R2 standard server, and PC0006 is a blank machine to which you will deploy Windows 10. You will configure a second deployment server (MDT02) for a remote site (Stockholm) by replicating the deployment share in the original site (New York). MDT01, MDT02, and PC0006 are members of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md#proof). + ![figure 1](images/mdt-10-fig01.png) + Figure 1. The machines used in this topic. + ## Replicate deployment shares + Replicating the content between MDT01 (New York) and MDT02 (Stockholm) can be done in a number of different ways. The most common content replication solutions with Microsoft Deployment Toolkit (MDT) 2013 use either the Linked Deployment Shares (LDS) feature or Distributed File System Replication (DFS-R). Some organizations have used a simple robocopy script for replication of the content. + **Note**   Robocopy has options that allow for synchronization between folders. It has a simple reporting function; it supports transmission retry; and, by default, it will only copy/remove files from the source that are newer than files on the target.   ### Linked deployment shares in MDT 2013 Update 2 + LDS is a built-in feature in MDT for replicating content. However, LDS works best with strong connections such as LAN connections with low latency. For most WAN links, DFS-R is the better option. + ### Why DFS-R is a better option + DFS-R is not only very fast and reliable, but it also offers central monitoring, bandwidth control, and a great delta replication engine. DFS-R will work equally well whether you have 2 sites or 90. When using DFS-R for MDT, we recommend running your deployment servers on Windows Server 2008 R2 or higher. From that version on, you can configure the replication target(s) as read-only, which is exactly what you want for MDT. This way, you can have your master deployment share centralized and replicate out changes as they happen. DFS-R will quickly pick up changes at the central deployment share in MDT01 and replicate the delta changes to MDT02. + ## Set up Distributed File System Replication (DFS-R) for replication + Setting up DFS-R for replication is a quick and straightforward process. You prepare the deployment servers and then create a replication group. To complete the setup, you configure some replication settings. + ### Prepare MDT01 for replication 1. On MDT01, using Server Manager, click **Add roles and features**. 2. On the **Select installation type** page, select **Role-based or feature-based installation**. 3. On the **Select destination server** page, select **MDT01.contoso.com** and click **Next**. 4. On the **Select server roles** page, expand **File and Storage Services (Installed)** and expand **File and iSCSI Services (Installed)**. 5. In the **Roles** list, select **DFS Replication**. In the **Add Roles and Features Wizard** dialog box, select **Add Features**, and then click **Next**. + ![figure 2](images/mdt-10-fig02.png) + Figure 2. Adding the DFS Replication role to MDT01. + 6. On the **Select features** page, accept the default settings, and click **Next**. 7. On the **Confirm installation selections** page, click **Install**. 8. On the **Installation progress** page, click **Close**. + ### Prepare MDT02 for replication + 1. On MDT02, using Server Manager, click **Add roles and features**. 2. On the **Select installation type** page, select **Role-based or feature-based installation**. 3. On the **Select destination server** page, select **MDT02.contoso.com** and click **Next**. @@ -47,14 +67,20 @@ Setting up DFS-R for replication is a quick and straightforward process. You pre 6. On the **Select features** page, accept the default settings, and click **Next**. 7. On the **Confirm installation selections** page, click **Install**. 8. On the **Installation progress** page, click **Close**. + ### Create the MDTProduction folder on MDT02 + 1. On MDT02, using File Explorer, create the **E:\\MDTProduction** folder. 2. Share the **E:\\MDTProduction** folder as **MDTProduction$**. Use the default permissions. + ![figure 3](images/mdt-10-fig03.png) + Figure 3. Sharing the **E:\\MDTProduction folder** on MDT02. ### Configure the deployment share + When you have multiple deployment servers sharing the same content, you need to configure the Bootstrap.ini file with information about which server to connect to based on where the client is located. In MDT, that can be done by using the DefaultGateway property. 1. On MDT01, using Notepad, navigate to the **E:\\MDTProduction\\Control** folder and modify the Boostrap.ini file to look like this: + ``` syntax [Settings] Priority=DefaultGateway, Default @@ -75,12 +101,18 @@ When you have multiple deployment servers sharing the same content, you need to   2. Save the Bootstrap.ini file. 3. Using the Deployment Workbench, right-click the **MDT Production** deployment share and select **Update Deployment Share**. + ![figure 4](images/mdt-10-fig04.png) + Figure 4. Updating the MDT Production deployment share. + 4. Use the default settings for the Update Deployment Share Wizard. 5. After the update is complete, use the Windows Deployment Services console. In the **Boot Images** node, right-click the **MDT Production x64** boot image and select **Replace Image**. + ![figure 5](images/mdt-10-fig05.png) + Figure 5. Replacing the updated boot image in WDS. + 6. Browse and select the **E:\\MDTProduction\\Boot\\LiteTouchPE\_x64.wim** boot image, and then complete Replace Boot Image Wizard using the default settings. ## Replicate the content Once the MDT01 and MDT02 servers are prepared, you are ready to configure the actual replication. @@ -89,16 +121,22 @@ Once the MDT01 and MDT02 servers are prepared, you are ready to configure the ac 2. On the **Replication Group Type** page, select **Multipurpose replication group**, and click **Next**. 3. On the **Name and Domain** page, assign the **MDTProduction** name, and click **Next**. 4. On the **Replication Group Members** page, click **Add**, add **MDT01** and **MDT02**, and then click **Next**. + ![figure 6](images/mdt-10-fig06.png) + Figure 6. Adding the Replication Group Members. + 5. On the **Topology Selection** page, select the **Full mesh** option and click **Next**. 6. On the **Replication Group Schedule and Bandwidth** page, accept the default settings and click **Next**. 7. On the **Primary Member** page, select **MDT01** and click **Next**. 8. On the **Folders to Replicate** page, click **Add**, type in **E:\\MDTProduction** as the folder to replicate, click **OK**, and then click **Next**. 9. On the **Local Path of MDTProduction** on the **Other Members** page, select **MDT02**, and click **Edit**. 10. On the **Edit** page, select the **Enabled** option, type in **E:\\MDTProduction** as the local path of folder, select the **Make the selected replicated folder on this member read-only** check box, click **OK**, and then click **Next**. + ![figure 7](images/mdt-10-fig07.png) + Figure 7. Configure the MDT02 member. + 11. On the **Review Settings and Create Replication Group** page, click **Create**. 12. On the **Confirmation** page, click **Close**. ### Configure replicated folders @@ -111,12 +149,16 @@ Once the MDT01 and MDT02 servers are prepared, you are ready to configure the ac ``` syntax (Get-ChildItem E:\MDTProduction -Recurse | Sort-Object Length -Descending | Select-Object -First 16 | Measure-Object -Property Length -Sum).Sum /1GB ``` + ![figure 8](images/mdt-10-fig08.png) + Figure 8. Configure the Staging settings. + 4. In the middle pane, right-click the **MDT02** member and select **Properties**. 5. On the **MDT02 (MDTProduction) Properties** page, configure the following and then click **OK**: 1. In the **Staging** tab, set the quota to **20480 MB**. 2. In the **Advanced** tab, set the quota to **8192 MB**. + **Note**   It will take some time for the replication configuration to be picked up by the replication members (MDT01 and MDT02). The time for the initial sync will depend on the WAN link speed between the sites. After that, delta changes are replicated quickly.   @@ -129,14 +171,21 @@ It will take some time for the replication configuration to be picked up by the 6. On the **Options** page, accept the default settings and click **Next**. 7. On the **Review Settings and Create Report** page, click **Create**. 8. Open the report in Internet Explorer, and if necessary, select the **Allow blocked content** option. + ![figure 9](images/mdt-10-fig09.png) + Figure 9. The DFS Replication Health Report. + ## Configure Windows Deployment Services (WDS) in a remote site + Like you did in the previous topic for MDT01, you need to add the MDT Production Lite Touch x64 Boot image to Windows Deployment Services on MDT02. For the following steps, we assume that WDS has already been installed on MDT02. 1. On MDT02, using the WDS console, right-click **Boot Images** and select **Add Boot Image**. 2. Browse to the E:\\MDTProduction\\Boot\\LiteTouchPE\_x64.wim file and add the image with the default settings. + ## Deploy the Windows 10 client to the remote site + Now you should have a solution ready for deploying the Windows 10 client to the remote site, Stockholm, connecting to the MDT Production deployment share replica on MDT02. + 1. Create a virtual machine with the following settings: 1. Name: PC0006 2. Location: C:\\VMs @@ -154,12 +203,20 @@ Now you should have a solution ready for deploying the Windows 10 client to the 1. Install the Windows 10 Enterprise operating system. 2. Install the added application. 3. Update the operating system via your local Windows Server Update Services (WSUS) server. + ## Related topics + [Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md) + + [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) + [Deploy a Windows 10 image using MDT 2013 Update 2](deploy-a-windows-10-image-using-mdt.md) + [Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) + [Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md) + [Configure MDT settings](configure-mdt-2013-settings.md)     diff --git a/windows/deploy/configure-client-computers-vamt.md b/windows/deploy/configure-client-computers-vamt.md index 9920ba516a..b3618bac74 100644 --- a/windows/deploy/configure-client-computers-vamt.md +++ b/windows/deploy/configure-client-computers-vamt.md @@ -2,20 +2,27 @@ title: Configure Client Computers (Windows 10) description: Configure Client Computers ms.assetid: a48176c9-b05c-4dd5-a9ef-83073e2370fc -ms.pagetype: activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- + # Configure Client Computers + To enable the Volume Activation Management Tool (VAMT) to function correctly, certain configuration changes are required on all client computers: + - An exception must be set in the client computer's firewall. - A registry key must be created and set properly, for computers in a workgroup; otherwise, Windows® User Account Control (UAC) will not allow remote administrative operations. + Organizations where the VAMT will be widely used may benefit from making these changes inside the master image for Windows. + **Important**   This procedure only applies to clients running Windows Vista or later. For clients running Windows XP Service Pack 1, see [Connecting Through Windows Firewall](http://go.microsoft.com/fwlink/p/?LinkId=182933). + ## Configuring the Windows Firewall to allow VAMT access + Enable the VAMT to access client computers using the **Windows Firewall** Control Panel: 1. Open Control Panel and double-click **System and Security**. 2. Click **Windows Firewall**. @@ -23,17 +30,23 @@ Enable the VAMT to access client computers using the **Windows Firewall** Contro 4. Click the **Change settings** option. 5. Select the **Windows Management Instrumentation (WMI)** checkbox. 6. Click **OK**. + **Warning**   By default, Windows Firewall Exceptions only apply to traffic originating on the local subnet. To expand the exception to apply to multiple subnets, you need to change the exception settings in the Windows Firewall with Advanced Security, as described below. + ## Configure Windows Firewall to allow VAMT access across multiple subnets + Enable the VAMT to access client computers across multiple subnets using the **Windows Firewall with Advanced Security** Control Panel: + ![VAMT Firewall configuration for multiple subnets](images/dep-win8-l-vamt-firewallconfigurationformultiplesubnets.gif) + 1. Open the Control Panel and double-click **Administrative Tools**. 2. Click **Windows Firewall with Advanced Security**. 3. Make your changes for each of the following three WMI items, for the applicable Network Profile (Domain, Public, Private): - Windows Management Instrumentation (ASync-In) - Windows Management Instrumentation (DCOM-In) - Windows Management Instrumentation (WMI-In) + 4. In the **Windows Firewall with Advanced Security** dialog box, select **Inbound Rules** from the left-hand panel. 5. Right-click the desired rule and select **Properties** to open the **Properties** dialog box. @@ -41,12 +54,17 @@ Enable the VAMT to access client computers across multiple subnets using the **W - On the **General** tab, select the **Allow the connection** checkbox. - On the **Scope** tab, change the Remote IP Address setting from "Local Subnet" (default) to allow the specific access you need. - On the **Advanced** tab, verify selection of all profiles that are applicable to the network (Domain or Private/Public). + In certain scenarios, only a limited set of TCP/IP ports are allowed through a hardware firewall. Administrators must ensure that WMI (which relies on RPC over TCP/IP) is allowed through these types of firewalls. By default, the WMI port is a dynamically allocated random port above 1024. The following Microsoft knowledge article discusses how administrators can limit the range of dynamically-allocated ports. This is useful if, for example, the hardware firewall only allows traffic in a certain range of ports. For more info, see [How to configure RPC dynamic port allocation to work with firewalls](http://go.microsoft.com/fwlink/p/?LinkId=182911). + ## Create a registry value for the VAMT to access workgroup-joined computer + **Caution**   This section contains information about how to modify the registry. Make sure to back up the registry before you modify it; in addition, ensure that you know how to restore the registry, if a problem occurs. For more information about how to back up, restore, and modify the registry, see [Windows registry information for advanced users](http://go.microsoft.com/fwlink/p/?LinkId=182912). + On the client computer, create the following registry key using regedit.exe. + 1. Navigate to `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system` 2. Enter the following details: **Value Name: LocalAccountTokenFilterPolicy** @@ -54,14 +72,18 @@ On the client computer, create the following registry key using regedit.exe. **Value Data: 1** **Note**   To discover VAMT-manageable Windows computers in workgroups, you must enable network discovery on each client. + ## Deployment options + There are several options for organizations to configure the WMI firewall exception for computers: - **Image.** Add the configurations to the master Windows image deployed to all clients. - **Group Policy.** If the clients are part of a domain, then all clients can be configured using Group Policy. The Group Policy setting for the WMI firewall exception is found in GPMC.MSC at: **Computer Configuration\\Windows Settings\\Security Settings\\Windows Firewall with Advanced Security\\Windows Firewall with Advanced Security\\Inbound Rules**. - **Script.** Execute a script using Microsoft System Center Configuration Manager or a third-party remote script execution facility. - **Manual.** Configure the WMI firewall exception individually on each client. The above configurations will open an additional port through the Windows Firewall on target computers and should be performed on computers that are protected by a network firewall. In order to allow VAMT to query the up-to-date licensing status, the WMI exception must be maintained. We recommend administrators consult their network security policies and make clear decisions when creating the WMI exception. + ## Related topics + - [Install and Configure VAMT](install-configure-vamt.md)     diff --git a/windows/deploy/configure-mdt-2013-for-userexit-scripts.md b/windows/deploy/configure-mdt-2013-for-userexit-scripts.md index 7edb60f65f..590f112414 100644 --- a/windows/deploy/configure-mdt-2013-for-userexit-scripts.md +++ b/windows/deploy/configure-mdt-2013-for-userexit-scripts.md @@ -2,17 +2,22 @@ title: Configure MDT for UserExit scripts (Windows 10) description: In this topic, you will learn how to configure the MDT rules engine to use a UserExit script to generate computer names based on a prefix and the computer MAC Address. ms.assetid: 29a421d1-12d2-414e-86dc-25b62f5238a7 -ms.pagetype: mdt -keywords: ["rules, script"] +keywords: rules, script ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: mdt author: mtniehaus --- + # Configure MDT for UserExit scripts + In this topic, you will learn how to configure the MDT rules engine to use a UserExit script to generate computer names based on a prefix and the computer MAC Address. MDT supports calling external VBScripts as part of the Gather process; these scripts are referred to as UserExit scripts. The script also removes the colons in the MAC Address. + ## Configure the rules to call a UserExit script + You can call a UserExit by referencing the script in your rules. Then you can configure a property to be set to the result of a function of the VBScript. In this example, we have a VBScript named Setname.vbs (provided in the book sample files, in the UserExit folder). + ``` syntax [Settings] Priority=Default @@ -21,9 +26,13 @@ OSINSTALL=YES UserExit=Setname.vbs OSDComputerName=#SetName("%MACADDRESS%")# ``` + The UserExit=Setname.vbs calls the script and then assigns the computer name to what the SetName function in the script returns. In this sample the %MACADDRESS% variable is passed to the script + ## The Setname.vbs UserExit script + The Setname.vbs script takes the MAC Address passed from the rules. The script then does some string manipulation to add a prefix (PC) and remove the semicolons from the MAC Address. + ``` syntax Function UserExit(sType, sWhen, sDetail, bSkip) UserExit = Success @@ -38,16 +47,22 @@ Function SetName(sMac) End Function ``` The first three lines of the script make up a header that all UserExit scripts have. The interesting part is the lines between Function and End Function. Those lines add a prefix (PC), remove the colons from the MAC Address, and return the value to the rules by setting the SetName value. + **Note**   The purpose of this sample is not to recommend that you use the MAC Address as a base for computer naming, but to show you how to take a variable from MDT, pass it to an external script, make some changes to it, and then return the new value to the deployment process.   ## Related topics + [Set up MDT for BitLocker](set-up-mdt-2013-for-bitlocker.md) + [Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) + [Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md) + [Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md) + [Assign applications using roles in MDT](assign-applications-using-roles-in-mdt-2013.md) + [Use web services in MDT](use-web-services-in-mdt-2013.md) + [Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt-2013.md) -  -  diff --git a/windows/deploy/configure-mdt-2013-settings.md b/windows/deploy/configure-mdt-2013-settings.md index 4dc5db64cf..af41a8a1bb 100644 --- a/windows/deploy/configure-mdt-2013-settings.md +++ b/windows/deploy/configure-mdt-2013-settings.md @@ -2,19 +2,25 @@ title: Configure MDT settings (Windows 10) description: One of the most powerful features in Microsoft Deployment Toolkit (MDT) 2013 is its extension capabilities; there is virtually no limitation to what you can do in terms of customization. ms.assetid: d3e1280c-3d1b-4fad-8ac4-b65dc711f122 -ms.pagetype: mdt -keywords: ["customize, customization, deploy, features, tools"] +keywords: customize, customization, deploy, features, tools ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: mdt author: mtniehaus --- + # Configure MDT settings + One of the most powerful features in Microsoft Deployment Toolkit (MDT) 2013 is its extension capabilities; there is virtually no limitation to what you can do in terms of customization. In this topic, you learn about configuring customizations for your environment. For the purposes of this topic, we will use four machines: DC01, MDT01, HV01, and PC0001. DC01 is a domain controller, MDT01 is a Windows Server 2012 R2 Standard server, and PC0001 is a Windows 10 Enterprise x64 client used for the MDT simulation environment. OR01 has Microsoft System Center 2012 R2 Orchestrator installed. MDT01, OR01, and PC0001 are members of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md#proof). + ![figure 1](images/mdt-09-fig01.png) + Figure 1. The machines used in this topic. + ## In this section + - [Set up MDT for BitLocker](set-up-mdt-2013-for-bitlocker.md) - [Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) - [Configure MDT for UserExit scripts](configure-mdt-2013-for-userexit-scripts.md) @@ -23,12 +29,17 @@ Figure 1. The machines used in this topic. - [Assign applications using roles in MDT](assign-applications-using-roles-in-mdt-2013.md) - [Use web services in MDT](use-web-services-in-mdt-2013.md) - [Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt-2013.md) + ## Related topics + [Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md) + [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) + [Deploy a Windows 10 image using MDT 2013 Update 2](deploy-a-windows-10-image-using-mdt.md) + [Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md) + [Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) + [Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md) -  -  diff --git a/windows/deploy/configure-mdt-deployment-share-rules.md b/windows/deploy/configure-mdt-deployment-share-rules.md index 81b5f9419b..908f92144b 100644 --- a/windows/deploy/configure-mdt-deployment-share-rules.md +++ b/windows/deploy/configure-mdt-deployment-share-rules.md @@ -2,25 +2,35 @@ title: Configure MDT deployment share rules (Windows 10) description: In this topic, you will learn how to configure the MDT rules engine to reach out to other resources, including external scripts, databases, and web services, for additional information instead of storing settings directly in the rules engine. ms.assetid: b5ce2360-33cc-4b14-b291-16f75797391b -ms.pagetype: mdt -keywords: ["rules, configuration, automate, deploy"] +keywords: rules, configuration, automate, deploy ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: mdt author: mtniehaus --- + # Configure MDT deployment share rules + In this topic, you will learn how to configure the MDT rules engine to reach out to other resources, including external scripts, databases, and web services, for additional information instead of storing settings directly in the rules engine. The rules engine in MDT is powerful: most of the settings used for operating system deployments are retrieved and assigned via the rules engine. In its simplest form, the rules engine is the CustomSettings.ini text file. + ## Assign settings + When using MDT, you can assign setting in three distinct ways: - You can pre-stage the information before deployment. - You can prompt the user or technician for information. - You can have MDT generate the settings automatically. + In order illustrate these three options, let's look at some sample configurations. + ## Sample configurations + Before adding the more advanced components like scripts, databases, and web services, consider the commonly used configurations below; they demonstrate the power of the rules engine. + ### Set computer name by MAC Address + If you have a small test environment, or simply want to assign settings to a very limited number of machines, you can edit the rules to assign settings directly for a given MAC Address. If you have many machines, it makes sense to use the database instead. + ``` syntax [Settings] Priority=MacAddress, Default @@ -29,9 +39,13 @@ OSInstall=YES [00:15:5D:85:6B:00] OSDComputerName=PC00075 ``` + In the preceding sample, you set the PC00075 computer name for a machine with a MAC Address of 00:15:5D:85:6B:00. + ### Set computer name by serial number + Another way to assign a computer name is to identify the machine via its serial number. + ``` syntax [Settings] Priority=SerialNumber, Default @@ -40,9 +54,13 @@ OSInstall=YES [CND0370RJ7] OSDComputerName=PC00075 ``` + In this sample, you set the PC00075 computer name for a machine with a serial number of CND0370RJ7. + ### Generate a computer name based on a serial number + You also can configure the rules engine to use a known property, like a serial number, to generate a computer name on the fly. + ``` syntax [Settings] Priority=Default @@ -50,12 +68,16 @@ Priority=Default OSInstall=YES OSDComputerName=PC-%SerialNumber% ``` + In this sample, you configure the rules to set the computer name to a prefix (PC-) and then the serial number. If the serial number of the machine is CND0370RJ7, the preceding configuration sets the computer name to PC-CND0370RJ7. **Note**   + Be careful when using the serial number to assign computer names. A serial number can contain more than 15 characters, but the Windows setup limits a computer name to 15 characters.   ### Generate a limited computer name based on a serial number + To avoid assigning a computer name longer than 15 characters, you can configure the rules in more detail by adding VBScript functions, as follows: + ``` syntax [Settings] Priority=Default @@ -63,9 +85,13 @@ Priority=Default OSInstall=YES OSDComputerName=PC-#Left("%SerialNumber%",12)# ``` + In the preceding sample, you still configure the rules to set the computer name to a prefix (PC-) followed by the serial number. However, by adding the Left VBScript function, you configure the rule to use only the first 12 serial-number characters for the name. + ### Add laptops to a different organizational unit (OU) in Active Directory + In the rules, you find built-in properties that use a Windows Management Instrumentation (WMI) query to determine whether the machine you are deploying is a laptop, desktop, or server. In this sample, we assume you want to add laptops to different OUs in Active Directory. Note that ByLaptopType is not a reserved word; rather, it is the name of the section to read. + ``` syntax [Settings] Priority=ByLaptopType, Default @@ -76,13 +102,19 @@ Subsection=Laptop-%IsLaptop% [Laptop-True] MachineObjectOU=OU=Laptops,OU=Contoso,DC=contoso,DC=com ``` + ## Related topics + [Set up MDT for BitLocker](set-up-mdt-2013-for-bitlocker.md) + [Configure MDT for UserExit scripts](configure-mdt-2013-for-userexit-scripts.md) + [Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md) + [Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md) + [Assign applications using roles in MDT](assign-applications-using-roles-in-mdt-2013.md) + [Use web services in MDT](use-web-services-in-mdt-2013.md) + [Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt-2013.md) -  -  diff --git a/windows/deploy/create-a-windows-10-reference-image.md b/windows/deploy/create-a-windows-10-reference-image.md index ce0815dfce..f81f4eac9a 100644 --- a/windows/deploy/create-a-windows-10-reference-image.md +++ b/windows/deploy/create-a-windows-10-reference-image.md @@ -2,32 +2,43 @@ title: Create a Windows 10 reference image (Windows 10) description: Creating a reference image is important because that image serves as the foundation for the devices in your organization. ms.assetid: 9da2fb57-f2ff-4fce-a858-4ae4c237b5aa -ms.pagetype: mdt -keywords: ["deploy, deployment, configure, customize, install, installation"] +keywords: deploy, deployment, configure, customize, install, installation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: mdt author: mtniehaus --- + # Create a Windows 10 reference image + **Applies to** - Windows 10 + Creating a reference image is important because that image serves as the foundation for the devices in your organization. In this topic, you will learn how to create a Windows 10 reference image using the Microsoft Deployment Toolkit (MDT) 2013 Update 2. You will create a deployment share, configure rules and settings, and import all the applications and operating system files required to build a Windows 10 reference image. After completing the steps outlined in this topic, you will have a Windows 10 reference image that can be used in your deployment solution. For the purposes of this topic, we will use four machines: DC01, MDT01, HV01, and PC0001. DC01 is a domain controller, PC0001 is a Windows 10 Enterprise x64 client, and MDT01 is a Windows Server 2012 R2 standard server. HV01 is a Hyper-V host server, but HV01 could be replaced by PC0001 as long as PC0001 has enough memory and is capable of running Hyper-V. MDT01, HV01, and PC0001 are members of the domain contoso.com for the fictitious Contoso Corporation. + **Note**   For important details about the setup for the steps outlined in this article, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md#proof).   ![figure 1](images/mdt-08-fig01.png) + Figure 1. The machines used in this topic. + ## The reference image + The reference image described in this documentation is designed primarily for deployment to physical machines. However, the reference image is created on a virtual platform, before being automatically run through the System Preparation (Sysprep) tool process and captured to a Windows Imaging (WIM) file. The reasons for creating the reference image on a virtual platform are the following: - You reduce development time and can use snapshots to test different configurations quickly. - You rule out hardware issues. You simply get the best possible image, and if you have a problem, it's not likely to be hardware related. - It ensures that you won't have unwanted applications that could be installed as part of a driver install but not removed by the Sysprep process. - It's easy to move between lab, test, and production. + ## Set up the MDT build lab deployment share + With Windows 10, there is no hard requirement to create reference images; however, to reduce the time needed for deployment, you may want to create a reference image that contains a few base applications as well as all of the latest updates. This section will show you how to create and configure the MDT Build Lab deployment share to create a Windows 10 reference image. Because reference images will be deployed only to virtual machines during the creation process and have specific settings (rules), you should always create a separate deployment share specifically for this process. + ### Create the MDT build lab deployment share + - On MDT01, log on as Administrator in the CONTOSO domain using a password of **P@ssw0rd**. - Using the Deployment Workbench, right-click **Deployment Shares** and select **New Deployment Share**. - Use the following settings for the New Deployment Share Wizard: @@ -36,26 +47,40 @@ With Windows 10, there is no hard requirement to create reference images; howev - Deployment share description: MDT Build Lab - <default> - Verify that you can access the \\\\MDT01\\MDTBuildLab$ share. + ![figure 2](images/mdt-08-fig02.png) + Figure 2. The Deployment Workbench with the MDT Build Lab deployment share created. + ### Configure permissions for the deployment share + In order to write the reference image back to the deployment share, you need to assign Modify permissions to the MDT Build Account (MDT\_BA) for the **Captures** subfolder in the **E:\\MDTBuildLab** folder 1. On MDT01, log on as **CONTOSO\\Administrator**. 2. Modify the NTFS permissions for the **E:\\MDTBuildLab\\Captures** folder by running the following command in an elevated Windows PowerShell prompt: + ``` syntax icacls E:\MDTBuildLab\Captures /grant '"MDT_BA":(OI)(CI)(M)' ``` + ![figure 3](images/mdt-08-fig03.png) + Figure 3. Permissions configured for the MDT\_BA user. + ## Add the setup files + This section will show you how to populate the MDT 2013 Update 2 deployment share with the Windows 10 operating system source files, commonly referred to as setup files, which will be used to create a reference image. Setup files are used during the reference image creation process and are the foundation for the reference image. + ### Add the Windows 10 installation files + MDT 2013 supports adding both full source Windows 10 DVDs (ISOs) and custom images that you have created. In this case, you create a reference image, so you add the full source setup files from Microsoft. + **Note**   Due to the Windows limits on path length, we are purposely keeping the operating system destination directory short, using the folder name W10EX64RTM rather than a more descriptive name like Windows 10 Enterprise x64 RTM.   ### Add Windows 10 Enterprise x64 (full source) + In these steps we assume that you have copied the content of a Windows 10 Enterprise x64 ISO to the **E:\\Downloads\\Windows 10 Enterprise x64** folder. + 1. On MDT01, log on as **CONTOSO\\Administrator**. 2. Using the Deployment Workbench, expand the **Deployment Shares** node, and then expand **MDT Build Lab**. 3. Right-click the **Operating Systems** node, and create a new folder named **Windows 10**. @@ -64,12 +89,18 @@ In these steps we assume that you have copied the content of a Windows 10 Enter 6. Source directory: E:\\Downloads\\Windows 10 Enterprise x64 7. Destination directory name: W10EX64RTM 8. After adding the operating system, in the **Operating Systems / Windows 10** folder, double-click the added operating system name in the **Operating System** node and change the name to the following: **Windows 10 Enterprise x64 RTM Default Image** + ![figure 4](images/figure4-deployment-workbench.png) + Figure 4. The imported Windows 10 operating system after renaming it. + ## Add applications + Before you create an MDT task sequence, you need to add all of the applications and other sample scripts to the MDT Build Lab share. + The steps in this section use a strict naming standard for your MDT applications. You add the "Install - " prefix for typical application installations that run a setup installer of some kind, and you use the "Configure - " prefix when an application configures a setting in the operating system. You also add an " - x86", " - x64", or "- x86-x64" suffix to indicate the application's architecture (some applications have installers for both architectures). Using a script naming standard is always recommended when using MDT as it helps maintain order and consistency. By storing configuration items as MDT applications, it is easy to move these objects between various solutions, or between test and production environments. In this topic's step-by-step sections, you will add the following applications: + - Install - Microsoft Office 2013 Pro Plus - x86 - Install - Microsoft Silverlight 5.0 - x64 - Install - Microsoft Visual C++ 2005 SP1 - x86 @@ -80,19 +111,27 @@ By storing configuration items as MDT applications, it is easy to move these obj - Install - Microsoft Visual C++ 2010 SP1 - x64 - Install - Microsoft Visual C++ 2012 Update 4 - x86 - Install - Microsoft Visual C++ 2012 Update 4 - x64 + In these examples, we assume that you downloaded the software in this list to the E:\\Downloads folder. The first application is added using the UI, but because MDT supports Windows PowerShell, you add the other applications using Windows PowerShell. + **Note**   All the Microsoft Visual C++ downloads can be found on [The latest supported Visual C++ downloads](http://go.microsoft.com/fwlink/p/?LinkId=619523).   ### Create the install: Microsoft Office Professional Plus 2013 x86 + You can customize Office 2013. In the volume license versions of Office 2013, there is an Office Customization Tool you can use to customize the Office installation. In these steps we assume you have copied the Office 2013 installation files to the E:\\Downloads\\Office2013 folder. + ### Add the Microsoft Office Professional Plus 2013 x86 installation files + After adding the Microsoft Office Professional Plus 2013 x86 application, you then automate its setup by running the Office Customization Tool. In fact, MDT 2013 detects that you added the Office Professional Plus 2013 x86 application and creates a shortcut for doing this. You also can customize the Office installation using a Config.xml file. But we recommend that you use the Office Customization Tool as described in the following steps, as it provides a much richer way of controlling Office 2013 settings. 1. Using the Deployment Workbench in the MDT Build Lab deployment share, expand the **Applications / Microsoft** node, and double-click **Install - Microsoft Office 2013 Pro Plus x86**. 2. In the **Office Products** tab, click **Office Customization Tool**, and click **OK** in the **Information** dialog box. + ![figure 5](images/mdt-08-fig05.png) + Figure 5. The Install - Microsoft Office 2013 Pro Plus - x86 application properties. + **Note**   If you don't see the Office Products tab, verify that you are using a volume license version of Office. If you are deploying Office 365, you need to download the Admin folder from Microsoft.   @@ -104,18 +143,24 @@ You also can customize the Office installation using a Config.xml file. But we r 1. Select Use KMS client key 2. Select I accept the terms in the License Agreement. 3. Select Display level: None + ![figure 6](images/mdt-08-fig06.png) + Figure 6. The licensing and user interface screen in the Microsoft Office Customization Tool + 3. Modify Setup properties - Add the **SETUP\_REBOOT** property and set the value to **Never**. 4. Modify user settings - In the **Microsoft Office 2013** node, expand **Privacy**, select **Trust Center**, and enable the Disable Opt-in Wizard on first run setting. 5. From the **File** menu, select **Save**, and save the configuration as 0\_Office2013ProPlusx86.msp in the **E:\\MDTBuildLab\\Applications\\Install - Microsoft Office 2013 Pro Plus - x86\\Updates** folder. + **Note**   The reason for naming the file with a 0 (zero) at the beginning is that the Updates folder also handles Microsoft Office updates, and they are installed in alphabetical order. The Office 2013 setup works best if the customization file is installed before any updates.   6. Close the Office Customization Tool, click Yes in the dialog box, and in the **Install - Microsoft Office 2013 Pro Plus - x86 Properties** window, click **OK**. + ### Connect to the deployment share using Windows PowerShell + If you need to add many applications, you can take advantage of the PowerShell support that MDT has. To start using PowerShell against the deployment share, you must first load the MDT PowerShell snap-in and then make the deployment share a PowerShell drive (PSDrive). 1. On MDT01, log on as **CONTOSO\\Administrator**. 2. Import the snap-in and create the PSDrive by running the following commands in an elevated PowerShell prompt: @@ -123,7 +168,9 @@ If you need to add many applications, you can take advantage of the PowerShell s Import-Topic "C:\Program Files\Microsoft Deployment Toolkit\bin\MicrosoftDeploymentToolkit.psd1" New-PSDrive -Name "DS001" -PSProvider MDTProvider -Root "E:\MDTBuildLab" ``` + ### Create the install: Microsoft Visual C++ 2005 SP1 x86 + In these steps we assume that you have downloaded Microsoft Visual C++ 2005 SP1 x86. You might need to modify the path to the source folder to reflect your current environment. In this example, the source path is set to E:\\Downloads\\VC++2005SP1x86. 1. On MDT01, log on as **CONTOSO\\Administrator**. 2. Create the application by running the following commands in an elevated PowerShell prompt: @@ -134,7 +181,9 @@ In these steps we assume that you have downloaded Microsoft Visual C++ 2005 SP1 Import-MDTApplication -Path "DS001:\Applications\Microsoft" -Enable "True" -Name $ApplicationName -ShortName $ApplicationName -Commandline $Commandline -WorkingDirectory ".\Applications\$ApplicationName" -ApplicationSourcePath $ApplicationSourcePath -DestinationFolder $ApplicationName -Verbose ``` + ### Create the install: Microsoft Visual C++ 2005 SP1 x64 + In these steps we assume that you have downloaded Microsoft Visual C++ 2005 SP1 x64. You might need to modify the path to the source folder to reflect your current environment. In this example, the source path is set to E:\\Downloads\\VC++2005SP1x64. 1. On MDT01, log on as **CONTOSO\\Administrator**. 2. Create the application by running the following commands in an elevated PowerShell prompt: @@ -145,7 +194,9 @@ In these steps we assume that you have downloaded Microsoft Visual C++ 2005 SP1 Import-MDTApplication -Path "DS001:\Applications\Microsoft" -Enable "True" -Name $ApplicationName -ShortName $ApplicationName -Commandline $Commandline -WorkingDirectory ".\Applications\$ApplicationName" -ApplicationSourcePath $ApplicationSourcePath -DestinationFolder $ApplicationName -Verbose ``` + ### Create the install: Microsoft Visual C++ 2008 SP1 x86 + In these steps we assume that you have downloaded Microsoft Visual C++ 2008 SP1 x86. You might need to modify the path to the source folder to reflect your current environment. In this example, the source path is set to E:\\Downloads\\VC++2008SP1x86. 1. On MDT01, log on as **CONTOSO\\Administrator**. 2. Create the application by running the following commands in an elevated PowerShell prompt: @@ -156,7 +207,9 @@ In these steps we assume that you have downloaded Microsoft Visual C++ 2008 SP1 Import-MDTApplication -Path "DS001:\Applications\Microsoft" -Enable "True" -Name $ApplicationName -ShortName $ApplicationName -Commandline $Commandline -WorkingDirectory ".\Applications\$ApplicationName" -ApplicationSourcePath $ApplicationSourcePath -DestinationFolder $ApplicationName -Verbose ``` + ### Create the install: Microsoft Visual C++ 2008 SP1 x64 + In these steps we assume that you have downloaded Microsoft Visual C++ 2008 SP1 x64. You might need to modify the path to the source folder to reflect your current environment. In this example, the source path is set to E:\\Downloads\\VC++2008SP1x64. 1. On MDT01, log on as **CONTOSO\\Administrator**. 2. Create the application by running the following commands in an elevated PowerShell prompt: @@ -167,7 +220,9 @@ In these steps we assume that you have downloaded Microsoft Visual C++ 2008 SP1 Import-MDTApplication -Path "DS001:\Applications\Microsoft" -Enable "True" -Name $ApplicationName -ShortName $ApplicationName -Commandline $Commandline -WorkingDirectory ".\Applications\$ApplicationName" -ApplicationSourcePath $ApplicationSourcePath -DestinationFolder $ApplicationName -Verbose ``` + ### Create the install: Microsoft Visual C++ 2010 SP1 x86 + In these steps we assume that you have downloaded Microsoft Visual C++ 2010 SP1 x86. You might need to modify the path to the source folder to reflect your current environment. In this example, the source path is set to E:\\Downloads\\VC++2010SP1x86. 1. On MDT01, log on as **CONTOSO\\Administrator**. 2. Create the application by running the following commands in an elevated PowerShell prompt: @@ -178,7 +233,9 @@ In these steps we assume that you have downloaded Microsoft Visual C++ 2010 SP1 Import-MDTApplication -Path "DS001:\Applications\Microsoft" -Enable "True" -Name $ApplicationName -ShortName $ApplicationName -CommandLine $CommandLine -WorkingDirectory ".\Applications\$ApplicationName" -ApplicationSourcePath $ApplicationSourcePath -DestinationFolder $ApplicationName -Verbose ``` + ### Create the install: Microsoft Visual C++ 2010 SP1 x64 + In these steps we assume that you have downloaded Microsoft Visual C++ 2010 SP1 x64. You might need to modify the path to the source folder to reflect your current environment. In this example, the source path is set to E:\\Downloads\\VC++2010SP1x64. 1. On MDT01, log on as **CONTOSO\\Administrator**. 2. Create the application by running the following commands in an elevated PowerShell prompt: @@ -189,7 +246,9 @@ In these steps we assume that you have downloaded Microsoft Visual C++ 2010 SP1 Import-MDTApplication -Path "DS001:\Applications\Microsoft" -Enable "True" -Name $ApplicationName -ShortName $ApplicationName -CommandLine $CommandLine -WorkingDirectory ".\Applications\$ApplicationName" -ApplicationSourcePath $ApplicationSourcePath -DestinationFolder $ApplicationName -Verbose ``` + ### Create the install: Microsoft Visual C++ 2012 Update 4 x86 + In these steps we assume that you have downloaded Microsoft Visual C++ 2012 Update 4 x86. You might need to modify the path to the source folder to reflect your current environment. In this example, the source path is set to E:\\Downloads\\VC++2012Ux86. 1. On MDT01, log on as **CONTOSO\\Administrator**. 2. Create the application by running the following commands in an elevated PowerShell prompt: @@ -200,7 +259,9 @@ In these steps we assume that you have downloaded Microsoft Visual C++ 2012 Upda Import-MDTApplication -Path "DS001:\Applications\Microsoft" -Enable "True" -Name $ApplicationName -ShortName $ApplicationName -CommandLine $CommandLine -WorkingDirectory ".\Applications\$ApplicationName" -ApplicationSourcePath $ApplicationSourcePath -DestinationFolder $ApplicationName -Verbose ``` + ### Create the install: Microsoft Visual C++ 2012 Update 4 x64 + In these steps we assume that you have downloaded Microsoft Visual C++ 2012 Update 4 x64. You might need to modify the path to the source folder to reflect your current environment. In this example, the source path is set to E:\\Downloads\\VC++2012Ux64. 1. On MDT01, log on as **CONTOSO\\Administrator**. 2. Create the application by running the following commands in an elevated PowerShell prompt: @@ -211,13 +272,20 @@ In these steps we assume that you have downloaded Microsoft Visual C++ 2012 Upda Import-MDTApplication -Path "DS001:\Applications\Microsoft" -Enable "True" -Name $ApplicationName -ShortName $ApplicationName -CommandLine $CommandLine -WorkingDirectory ".\Applications\$ApplicationName" -ApplicationSourcePath $ApplicationSourcePath -DestinationFolder $ApplicationName -Verbose ``` + ## Create the reference image task sequence + In order to build and capture your Windows 10 reference image for deployment using MDT, you will create a task sequence. The task sequence will reference the operating system and applications that you previously imported into the MDT Build Lab deployment share to build a Windows 10 reference image. After creating the task sequence, you configure it to enable patching against the Windows Server Update Services (WSUS) server. The Task Sequence Windows Update action supports getting updates directly from Microsoft Update, but you get more stable patching if you use a local WSUS server. WSUS also allows for an easy process of approving the patches that you are deploying. + ### Drivers and the reference image + Because we use modern virtual platforms for creating our reference images, we don’t need to worry about drivers when creating reference images for Windows 10. We use Hyper-V in our environment, and Windows Preinstallation Environment (Windows PE) already has all the needed drivers built-in for Hyper-V. + ### Create a task sequence for Windows 10 Enterprise + To create a Windows 10 reference image task sequence, the process is as follows: + 1. Using the Deployment Workbench in the MDT Build Lab deployment share, right-click **Task Sequences**, and create a new folder named **Windows 10**. 2. Expand the **Task Sequences** node, right-click the new **Windows 10** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: 1. Task sequence ID: REFW10X64-001 @@ -230,8 +298,11 @@ To create a Windows 10 reference image task sequence, the process is as follows 8. Organization: Contoso 9. Internet Explorer home page: http://www.contoso.com 10. Admin Password: Do not specify an Administrator Password at this time + ### Edit the Windows 10 task sequence + The steps below walk you through the process of editing the Windows 10 reference image task sequence to include the actions required to update the reference image with the latest updates from WSUS, install roles and features, and utilities, and install Microsoft Office 2013. + 1. In the Task Sequences / Windows 10 folder, right-click the Windows 10 Enterprise x64 RTM Default Image task sequence, and select Properties. 2. On the **Task Sequence** tab, configure the Windows 10 Enterprise x64 RTM Default Image task sequence with the following settings: 1. State Restore. Enable the Windows Update (Pre-Application Installation) action. @@ -249,11 +320,14 @@ The steps below walk you through the process of editing the Windows 10 referenc 1. Name: Install - Microsoft NET Framework 3.5.1 2. Select the operating system for which roles are to be installed: Windows 8.1 3. Select the roles and features that should be installed: .NET Framework 3.5 (includes .NET 2.0 and 3.0) + **Important**   This is probably the most important step when creating a reference image. Many applications need the .NET Framework, and we strongly recommend having it available in the image. The one thing that makes this different from other components is that .NET Framework 3.5.1 is not included in the WIM file. It is installed from the **Sources\\SxS** folder on the media, and that makes it more difficult to add after the image has been deployed.   ![figure 7](images/fig8-cust-tasks.png) + Figure 7. The task sequence after creating the Custom Tasks (Pre-Windows Update) group and adding the Install - Microsoft NET Framework 3.5.1 action. + 6. State Restore - Custom Tasks (Pre-Windows Update). After the **Install - Microsoft NET Framework 3.5.1** action, add a new **Install Application** action with the following settings: 1. Name: Install - Microsoft Visual C++ 2005 SP1 - x86 2. Install a Single Application: Install - Microsoft Visual C++ 2005 SP1 - x86-x64 @@ -268,18 +342,29 @@ The steps below walk you through the process of editing the Windows 10 referenc 8. Install - Microsoft Office 2013 Pro Plus - x86 8. After the Install - Microsoft Office 2013 Pro Plus - x86 action, add a new Restart computer action. 3. Click **OK**. + + ### Optional configuration: Add a suspend action + The goal when creating a reference image is of course to automate everything. But sometimes you have a special configuration or application setup that is too time-consuming to automate. If you need to do some manual configuration, you can add a little-known feature called Lite Touch Installation (LTI) Suspend. If you add the LTISuspend.wsf script as a custom action in the task sequence, it will suspend the task sequence until you click the Resume Task Sequence shortcut icon on the desktop. In addition to using the LTI Suspend feature for manual configuration or installation, you can also use it simply for verifying a reference image before you allow the task sequence to continue and use Sysprep and capture the virtual machine. + ![figure 8](images/fig8-suspend.png) + Figure 8. A task sequence with optional Suspend action (LTISuspend.wsf) added. + ![figure 9](images/fig9-resumetaskseq.png) + Figure 9. The Windows 10 desktop with the Resume Task Sequence shortcut. + ### Edit the Unattend.xml file for Windows 10 Enterprise + When using MDT, you don't need to edit the Unattend.xml file very often because most configurations are taken care of by MDT. However if, for example, you want to configure Internet Explorer 11 behavior, then you can edit the Unattend.xml for this. Editing the Unattend.xml for basic Internet Explorer settings is easy, but for more advanced settings, you will want to use Internet Explorer Administration Kit (IEAK). + **Note**   You also can use the Unattend.xml to enable components in Windows 10, like the Telnet Client or Hyper-V client. Normally we prefer to do this via the Install Roles and Features action, or using Deployment Image Servicing and Management (DISM) command-line tools, because then we can add that as an application, being dynamic, having conditions, and so forth. Also, if you are adding packages via Unattend.xml, it is version specific, so Unattend.xml must match the exact version of the operating system you are servicing.   Follow these steps to configure Internet Explorer settings in Unattend.xml for the Windows 10 Enterprise x64 RTM Default Image task sequence: + 1. Using the Deployment Workbench, right-click the **Windows 10 Enterprise x64 RTM Default Image** task sequence and select **Properties**. 2. In the **OS Info** tab, click **Edit Unattend.xml**. MDT now generates a catalog file. This will take a few minutes, and then Windows System Image Manager (Windows SIM) will start. 3. In Windows SIM, expand the **4 specialize** node in the **Answer File** pane and select the amd64\_Microsoft-Windows-IE-InternetExplorer\_neutral entry. @@ -287,11 +372,17 @@ Follow these steps to configure Internet Explorer settings in Unattend.xml for t - DisableDevTools: true 5. Save the Unattend.xml file, and close Windows SIM. 6. On the Windows 10 Enterprise x64 RTM Default Image Properties, click **OK**. + ![figure 10](images/fig10-unattend.png) + Figure 10. Windows System Image Manager with the Windows 10 Unattend.xml. + ## Configure the MDT deployment share rules + Understanding rules is critical to successfully using MDT. Rules are configured using the Rules tab of the deployment share's properties. The Rules tab is essentially a shortcut to edit the CustomSettings.ini file that exists in the E:\\MDTBuildLab\\Control folder. This section discusses how to configure the MDT deployment share rules as part of your Windows 10 Enterprise deployment. + ### MDT deployment share rules overview + In MDT, there are always two rule files: the CustomSettings.ini file and the Bootstrap.ini file. You can add almost any rule to either; however, the Bootstrap.ini file is copied from the Control folder to the boot image, so the boot image needs to be updated every time you change that file. For that reason, add only a minimal set of rules to Bootstrap.ini, such as which deployment server and share to connect to - the DEPLOYROOT value. Put the other rules in CustomSettings.ini because that file is updated immediately when you click OK. By taking the following steps, you will configure the rules for the MDT Build Lab deployment share: 1. Using the Deployment Workbench, right-click the **MDT Build Lab deployment share** and select **Properties**. @@ -328,9 +419,13 @@ For that reason, add only a minimal set of rules to Bootstrap.ini, such as which SkipCapture=NO SkipFinalSummary=YES ``` + ![figure 11](images/mdt-08-fig14.png) + Figure 11. The server-side rules for the MDT Build Lab deployment share. + 3. Click **Edit Bootstrap.ini** and modify using the following information: + ``` syntax Settings] Priority=Default @@ -341,8 +436,11 @@ For that reason, add only a minimal set of rules to Bootstrap.ini, such as which UserPassword=P@ssw0rd SkipBDDWelcome=YES ``` + ![figure 12](images/mdt-08-fig15.png) + Figure 12. The boot image rules for the MDT Build Lab deployment share. + **Note**   For security reasons, you normally don't add the password to the Bootstrap.ini file; however, because this deployment share is for creating reference image builds only, and should not be published to the production network, it is acceptable to do so in this situation.   @@ -355,25 +453,36 @@ For that reason, add only a minimal set of rules to Bootstrap.ini, such as which 1. Image description: MDT Build Lab x64 2. ISO file name: MDT Build Lab x64.iso 8. Click **OK**. + **Note**   In MDT, the x86 boot image can deploy both x86 and x64 operating systems (except on computers based on Unified Extensible Firmware Interface).   + ### Update the deployment share + After the deployment share has been configured, it needs to be updated. This is the process when the Windows Windows PE boot images are created. + 1. Using the Deployment Workbench, right-click the **MDT Build Lab deployment share** and select **Update Deployment Share**. 2. Use the default options for the Update Deployment Share Wizard. + **Note**   The update process will take 5 to 10 minutes.   ### The rules explained + Now that the MDT Build Lab deployment share (the share used to create the reference images) has been configured, it is time to explain the various settings used in the Bootstrap.ini and CustomSettings.ini files. + The Bootstrap.ini and CustomSettings.ini files work together. The Bootstrap.ini file is always present on the boot image and is read first. The basic purpose for Bootstrap.ini is to provide just enough information for MDT to find the CustomSettings.ini. + The CustomSettings.ini file is normally stored on the server, in the Deployment share\\Control folder, but also can be stored on the media (when using offline media). + **Note**   The settings, or properties, that are used in the rules (CustomSettings.ini and Bootstrap.ini) are listed in the MDT documentation, in the Microsoft Deployment Toolkit Reference / Properties / Property Definition section.   ### The Bootstrap.ini file + The Bootstrap.ini file is available via the deployment share's Properties dialog box, or via the E:\\MDTBuildLab\\Control folder on MDT01. + ``` syntax [Settings] Priority=Default @@ -384,19 +493,24 @@ UserID=MDT_BA UserPassword=P@ssw0rd SkipBDDWelcome=YES ``` + So, what are these settings? - **Priority.** This determines the order in which different sections are read. This Bootstrap.ini has only one section, named \[Default\]. - **DeployRoot.** This is the location of the deployment share. Normally, this value is set by MDT, but you need to update the DeployRoot value if you move to another server or other share. If you don't specify a value, the Windows Deployment Wizard prompts you for a location. - **UserDomain, UserID, and UserPassword.** These values are used for automatic log on to the deployment share. Again, if they are not specified, the wizard prompts you. + **Note**   Caution is advised. These values are stored in clear text on the boot image. Use them only for the MDT Build Lab deployment share and not for the MDT Production deployment share that you learn to create in the next topic.   - **SkipBDDWelcome.** Even if it is nice to be welcomed every time we start a deployment, we prefer to skip the initial welcome page of the Windows Deployment Wizard. + **Note**   All properties beginning with "Skip" control only whether to display that pane in the Windows Deployment Wizard. Most of the panes also require you to actually set one or more values.   ### The CustomSettings.ini file + The CustomSettings.ini file, whose content you see on the Rules tab of the deployment share Properties dialog box, contains most of the properties used in the configuration. + ``` syntax [Settings] Priority=Default @@ -436,6 +550,7 @@ SkipFinalSummary=YES - **OSInstall.** Must be set to Y or YES (the code actually just looks for the Y character) for the setup to proceed. - **AdminPassword.** Sets the local Administrator account password. - **TimeZoneName.** Establishes the time zone to use. Don't confuse this value with TimeZone, which is only for legacy operating systems (Windows 7 and Windows Server 2003). + **Note**   The easiest way to find the current time zone name on a Windows 10 machine is to run tzutil /g in a command prompt. You can also run tzutil /l to get a listing of all available time zone names.   @@ -459,10 +574,14 @@ SkipFinalSummary=YES - **SkipRoles.** Skips the Install Roles and Features pane. - **SkipCapture.** Skips the Capture pane. - **SkipFinalSummary.** Skips the final Windows Deployment Wizard summary. Because you use FinishAction=Shutdown, you don't want the wizard to stop in the end so that you need to click OK before the machine shuts down. + ## Build the Windows 10 reference image + Once you have created your task sequence, you are ready to create the Windows 10 reference image. This will be performed by launching the task sequence from a virtual machine which will then automatically perform the reference image creation and capture process. This steps below outline the process used to boot a virtual machine using an ISO boot image created by MDT, and then execute the reference image task sequence image to create and capture the Windows 10 reference image. + 1. Copy the E:\\MDTBuildLab\\Boot\\MDT Build Lab x86.iso on MDT01 to C:\\ISO on the Hyper-V host. + **Note**   Remember, in MDT you can use the x86 boot image to deploy both x86 and x64 operating system images. That's why you can use the x86 boot image instead of the x64 boot image.   @@ -474,6 +593,7 @@ This steps below outline the process used to boot a virtual machine using an ISO 5. Hard disk: 60 GB (dynamic disk) 6. Image file: C:\\ISO\\MDT Build Lab x86.iso 3. Take a snapshot of the REFW10X64-001 virtual machine, and name it **Clean with MDT Build Lab x86 ISO**. + **Note**   Taking a snapshot is useful if you need to restart the process and want to make sure you can start clean.   @@ -482,8 +602,11 @@ This steps below outline the process used to boot a virtual machine using an ISO 2. Specify whether to capture an image: Capture an image of this reference computer - Location: \\\\MDT01\\MDTBuildLab$\\Captures 3. File name: REFW10X64-001.wim + ![figure 13](images/fig13-captureimage.png) + Figure 13. The Windows Deployment Wizard for the Windows 10 reference image. + 5. The setup now starts and does the following: 1. Installs the Windows 10 Enterprise operating system. 2. Installs the added applications, roles, and features. @@ -492,13 +615,19 @@ This steps below outline the process used to boot a virtual machine using an ISO 5. Runs System Preparation (Sysprep) and reboots into Windows PE. 6. Captures the installation to a Windows Imaging (WIM) file. 7. Turns off the virtual machine. + After some time, you will have a Windows 10 Enterprise x64 image that is fully patched and has run through Sysprep, located in the E:\\MDTBuildLab\\Captures folder on your deployment server. The file name is REFW10X64-001.wim. + ## Related topics + [Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md) + [Deploy a Windows 10 image using MDT 2013 Update 2](deploy-a-windows-10-image-using-mdt.md) + [Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md) + [Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) + [Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md) + [Configure MDT settings](configure-mdt-2013-settings.md) -  -  diff --git a/windows/deploy/deploy-a-windows-10-image-using-mdt.md b/windows/deploy/deploy-a-windows-10-image-using-mdt.md index 6d139673cc..23176dbd84 100644 --- a/windows/deploy/deploy-a-windows-10-image-using-mdt.md +++ b/windows/deploy/deploy-a-windows-10-image-using-mdt.md @@ -2,24 +2,32 @@ title: Deploy a Windows 10 image using MDT 2013 Update 2 (Windows 10) description: This topic will show you how to take your reference image for Windows 10, and deploy that image to your environment using the Microsoft Deployment Toolkit (MDT), and MDT 2013 Update 2 specifically. ms.assetid: 1d70a3d8-1b1d-4051-b656-c0393a93f83c -ms.pagetype: mdt -keywords: ["deployment, automate, tools, configure"] +keywords: [eployment, automate, tools, configure ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: mdt author: mtniehaus --- + # Deploy a Windows 10 image using MDT 2013 Update 2 + **Applies to** - Windows 10 + This topic will show you how to take your reference image for Windows 10, and deploy that image to your environment using the Microsoft Deployment Toolkit (MDT), and MDT 2013 Update 2 specifically. You will prepare for this by creating a MDT deployment share that is used solely for image deployment. Separating the processes of creating reference images from the processes used to deploy them in production allows greater control of on both processes. You will then configure the deployment share, create a new task sequence, add applications, add drivers, add rules, and configure Active Directory permissions for deployment. + For the purposes of this topic, we will use three machines: DC01, MDT01, and PC0005. DC01 is a domain controller, MDT01 is a Windows Server 2012 R2 standard server, and PC0005 is a blank machine to which you deploy Windows 10. MDT01 and PC0005 are members of the domain contoso.com for the fictitious Contoso Corporation. + **Note**   For important details about the setup for the steps outlined in this article, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md).   ![figure 1](images/mdt-07-fig01.png) + Figure 1. The machines used in this topic. + ## Step 1: Configure Active Directory permissions + These steps will show you how to configure an Active Directory account with the permissions required to deploy a Windows 10 machine to the domain using MDT. These steps assume you have downloaded the sample [Set-OUPermissions.ps1 script](http://go.microsoft.com/fwlink/p/?LinkId=619362) and copied it to C:\\Setup\\Scripts on DC01. The account is used for Windows Preinstallation Environment (Windows PE) to connect to MDT01. In order for MDT to join machines into the contoso.com domain you need to create an account and configure permissions in Active Directory. 1. On DC01, using Active Directory User and Computers, browse to **contoso.com / Contoso / Service Accounts**. 2. Select the **Service Accounts** organizational unit (OU) and create the MDT\_JD account using the following settings: @@ -49,9 +57,14 @@ These steps will show you how to configure an Active Directory account with the 6. Reset Password 7. Validated write to DNS host name 8. Validated write to service principal name + ## Step 2: Set up the MDT production deployment share -When you are ready to deploy Windows 10 in a production environment, you will first create a new MDT deployment share. You should not use the same deployment share that you used to create the reference image for a production deployment. For guidance on creating a custom Windows 10 image, see [Create a Windows 10 reference image](create-a-windows-10-reference-image.md). + +When you are ready to deploy Windows 10 in a production environment, you will first create a new MDT deployment share. You should not use the same deployment share that you used to create the reference image for a production deployment. For guidance on creating a custom Windows 10 image, see +[Create a Windows 10 reference image](create-a-windows-10-reference-image.md). + ### Create the MDT production deployment share + The steps for creating the deployment share for production are the same as when you created the deployment share for creating the custom reference image: 1. On MDT01, log on as Administrator in the CONTOSO domain using a password of **P@ssw0rd.** 2. Using the Deployment Workbench, right-click **Deployment Shares** and select **New Deployment Share**. @@ -60,9 +73,13 @@ The steps for creating the deployment share for production are the same as when 5. On the **Descriptive Name** page, in the **Deployment share description** text box, type **MDT Production** and click **Next**. 6. On the **Options** page, accept the default settings and click **Next** twice, and then click **Finish**. 7. Using File Explorer, verify that you can access the **\\\\MDT01\\MDTProduction$** share. + ## Step 3: Add a custom image + The next step is to add a reference image into the deployment share with the setup files required to successfully deploy Windows 10. When adding a custom image, you still need to copy setup files (an option in the wizard) because Windows 10 stores additional components in the Sources\\SxS folder which is outside the image and may be required when installing components. + ### Add the Windows 10 Enterprise x64 RTM custom image + In these steps, we assume that you have completed the steps in the [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) topic, so you have a Windows 10 reference image in the E:\\MDTBuildLab\\Captures folder on MDT01. 1. Using the Deployment Workbench, expand the **Deployment Shares** node, and then expand **MDT Production**; select the **Operating Systems** node, and create a folder named **Windows 10**. 2. Right-click the **Windows 10** folder and select **Import Operating System**. @@ -71,14 +88,20 @@ In these steps, we assume that you have completed the steps in the [Create a Win 5. On the **Setup** page, select the **Copy Windows 7, Windows Server 2008 R2, or later setup files from the specified path** option; in the **Setup source directory** text box, browse to **E:\\MDTBuildLab\\Operating Systems\\W10EX64RTM** and click **Next**. 6. On the **Destination** page, in the **Destination directory name** text box, type **W10EX64RTM**, click **Next** twice, and then click **Finish**. 7. After adding the operating system, double-click the added operating system name in the **Operating Systems / Windows 10** node and change the name to match the following: **Windows 10 Enterprise x64 RTM Custom Image**. + **Note**   The reason for adding the setup files has changed since earlier versions of MDT. MDT 2010 used the setup files to install Windows. MDT uses DISM to apply the image; however, you still need the setup files because some components in roles and features are stored outside the main image.   ![figure 2](images/fig2-importedos.png) + Figure 2. The imported operating system after renaming it. + ## Step 4: Add an application + When you configure your MDT Build Lab deployment share, you will also add any applications to the new deployment share before creating your task sequence. This section walks you through the process of adding an application to the MDT Production deployment share using Adobe Reader as an example. + ### Create the install: Adobe Reader XI x86 + In this example, we assume that you have downloaded the Adobe Reader XI installation file (AdbeRdr11000\_eu\_ES.msi) to E:\\Setup\\Adobe Reader on MDT01. 1. Using the Deployment Workbench, expand the **MDT Production** node and navigate to the **Applications** node. 2. Right-click the **Applications** node, and create a new folder named **Adobe**. @@ -88,20 +111,27 @@ In this example, we assume that you have downloaded the Adobe Reader XI installa 6. On the **Source** page, in the **Source Directory** text box, browse to **E:\\Setup\\Adobe Reader XI** and click **Next**. 7. On the **Destination** page, in the **Specify the name of the directory that should be created** text box, type **Install - Adobe Reader XI - x86** and click **Next**. 8. On the **Command Details** page, in the **Command Line** text box, type **msiexec /i AdbeRdr11000\_eu\_ES.msi /q**, click **Next** twice, and then click **Finish**. + ![figure 3](images/mdt-07-fig03.png) + Figure 3. The Adobe Reader application added to the Deployment Workbench. + ## Step 5: Prepare the drivers repository + In order to deploy Windows 10 with MDT 2013 Update 2 successfully, you need drivers for the boot images and for the actual operating system. This section will show you how to add drivers for the boot image and operating system, using the following hardware models as examples: - Lenovo ThinkPad T420 - Dell Latitude E6440 - HP EliteBook 8560w - Microsoft Surface Pro For boot images, you need to have storage and network drivers; for the operating system, you need to have the full suite of drivers. + **Note**   You should only add drivers to the Windows PE images if the default drivers don't work. Adding drivers that are not necessary will only make the boot image larger and potentially delay the download time.   ### Create the driver source structure in the file system + The key to successful management of drivers for MDT 2013 Update 2, as well as for any other deployment solution, is to have a really good driver repository. From this repository, you import drivers into MDT for deployment, but you should always maintain the repository for future use. + 1. On MDT01, using File Explorer, create the **E:\\Drivers** folder. 2. In the **E:\\Drivers** folder, create the following folder structure: 1. WinPE x86 @@ -116,10 +146,12 @@ The key to successful management of drivers for MDT 2013 Update 2, as well as fo - ThinkPad T420 (4178) - Microsoft Corporation - Surface Pro 3 + **Note**   Even if you are not going to use both x86 and x64 boot images, we still recommend that you add the support structure for future use.   ### Create the logical driver structure in MDT 2013 Update 2 + When you import drivers to the MDT 2013 Update 2 driver repository, MDT creates a single instance folder structure based on driver class names. However, you can, and should, mimic the driver structure of your driver source repository in the Deployment Workbench. This is done by creating logical folders in the Deployment Workbench. 1. On MDT01, using Deployment Workbench, select the **Out-of-Box Drivers** node. 2. In the **Out-Of-Box Drivers** node, create the following folder structure: @@ -135,6 +167,7 @@ When you import drivers to the MDT 2013 Update 2 driver repository, MDT creates - 4178 - Microsoft Corporation - Surface Pro 3 + The preceding folder names are selected because they match the actual make and model values that MDT reads from the machines during deployment. You can find out the model values for your machines via the following command in Windows PowerShell: ``` syntax Get-WmiObject -Class:Win32_ComputerSystem @@ -143,10 +176,15 @@ Or, you can use this command in a normal command prompt: ``` syntax wmic csproduct get name ``` + If you want a more standardized naming convention, try the ModelAliasExit.vbs script from the Deployment Guys blog post entitled [Using and Extending Model Aliases for Hardware Specific Application Installation](http://go.microsoft.com/fwlink/p/?LinkId=619536). + ![figure 4](images/fig4-oob-drivers.png) + Figure 4. The Out-of-Box Drivers structure in Deployment Workbench. + ### Create the selection profiles for boot image drivers + By default, MDT adds any storage and network drivers that you import to the boot images. However, you should add only the drivers that are necessary to the boot image. You can control which drivers are added by using selection profiles. The drivers that are used for the boot images (Windows PE) are Windows 10 drivers. If you can’t locate Windows 10 drivers for your device, a Windows 7 or Windows 8.1 driver will most likely work, but Windows 10 drivers should be your first choice. 1. On MDT01, using the Deployment Workbench, in the **MDT Production** node, expand the **Advanced Configuration** node, right-click the **Selection Profiles** node, and select **New Selection Profile**. @@ -157,44 +195,70 @@ The drivers that are used for the boot images (Windows PE) are Windows 10 driver 4. In the New Selection Profile Wizard, create a selection profile with the following settings: 1. Selection Profile name: WinPE x64 2. Folders: Select the WinPE x64 folder in Out-of-Box Drivers. + ![figure 5](images/fig5-selectprofile.png) + Figure 5. Creating the WinPE x64 selection profile. + ### Extract and import drivers for the x64 boot image + Windows PE supports all the hardware models that we have, but here you learn to add boot image drivers to accommodate any new hardware that might require additional drivers. In this example, you add the latest Intel network drivers to the x64 boot image. In these steps, we assume you have downloaded PROWinx64.exe from Intel.com and saved it to a temporary folder. + 1. Extract PROWinx64.exe to a temporary folder - in this example to the **C:\\Tmp\\ProWinx64** folder. 2. Using File Explorer, create the **E:\\Drivers\\WinPE x64\\Intel PRO1000** folder. 3. Copy the content of the **C:\\Tmp\\PROWinx64\\PRO1000\\Winx64\\NDIS64** folder to the **E:\\Drivers\\WinPE x64\\Intel PRO1000** folder. 4. Using Deployment Workbench, expand the **Out-of-Box Drivers** node, right-click the **WinPE x64** node, and select **Import Drivers**. Use the following setting for the Import Drivers Wizard: - Driver source directory: **E:\\Drivers\\WinPE x64\\Intel PRO1000** + ### Download, extract, and import drivers + ### For the ThinkPad T420 + For the Lenovo T420 model, you use the Lenovo ThinkVantage Update Retriever software to download the drivers. With Update Retriever, you need to specify the correct Lenovo Machine Type for the actual hardware (the first four characters of the model name). As an example, the Lenovo T420 model has the 4178B9G model name, meaning the Machine Type is 4178. + To get the updates, you download the drivers from the Lenovo ThinkVantage Update Retriever using its export function. You can download the drivers from the [Lenovo website](http://go.microsoft.com/fwlink/p/?LinkId=619543). + In these steps, we assume you have downloaded and extracted the drivers using ThinkVantage Update Retriever v5.0 to the E:\\Drivers\\Lenovo\\ThinkPad T420 (4178) folder. + 1. On MDT01, using the Deployment Workbench, in the **MDT Production** node, expand the **Out-Of-Box Drivers** node, and expand the **Lenovo** node. 2. Right-click the **4178** folder and select **Import Drivers**; use the following setting for the Import Drivers Wizard: - Driver source directory: **E:\\Drivers\\Windows 10 x64\\Lenovo\\ThinkPad T420 (4178)** + ### For the Latitude E6440 + For the Dell Latitude E6440 model, you use the Dell Driver CAB file, which is accessible via the [Dell TechCenter website](http://go.microsoft.com/fwlink/p/?LinkId=619544). + In these steps, we assume you have downloaded and extracted the CAB file for the Latitude E6440 model to the E:\\Drivers\\Dell\\Latitude E6440 folder. + 1. On **MDT01**, using the **Deployment Workbench**, in the **MDT Production** node, expand the **Out-Of-Box Drivers** node, and expand the **Dell** node. 2. Right-click the **Latitude E6440** folder and select **Import Drivers**; use the following setting for the Import Drivers Wizard: - Driver source directory: **E:\\Drivers\\Windows 10 x64\\Dell\\Latitude E6440** + ### For the HP EliteBook 8560w + For the HP EliteBook 8560w, you use HP SoftPaq Download Manager to get the drivers. The HP SoftPaq Download Manager can be accessed on the [HP Support site](http://go.microsoft.com/fwlink/p/?LinkId=619545). + In these steps, we assume you have downloaded and extracted the drivers for the HP EliteBook 8650w model to the E:\\Drivers\\Windows 10 x64\\HP\\HP EliteBook 8560w folder. + 1. On **MDT01**, using the **Deployment Workbench**, in the **MDT Production** node, expand the **Out-Of-Box Drivers** node, and expand the **Hewlett-Packard** node. 2. Right-click the **HP EliteBook 8560w** folder and select **Import Drivers**; use the following setting for the Import Drivers Wizard: - Driver source directory: **E:\\Drivers\\Windows 10 x64\\HP\\HP EliteBook 8560w** + ### For the Microsoft Surface Pro 3 + For the Microsoft Surface Pro model, you find the drivers on the Microsoft website. In these steps we assume you have downloaded and extracted the Surface Pro 3 drivers to the E:\\Drivers\\Windows 10 x64\\Microsoft\\Surface Pro 3 folder. + 1. On MDT01, using the Deployment Workbench, in the **MDT Production** node, expand the **Out-Of-Box Drivers** node, and expand the **Microsoft** node. 2. Right-click the **Surface Pro 3** folder and select **Import Drivers**; use the following setting for the Import Drivers Wizard: - Driver source directory: **E:\\Drivers\\Windows 10 x64\\Microsoft\\Surface Pro 3** + ## Step 6: Create the deployment task sequence + This section will show you how to create the task sequence used to deploy your production Windows 10 reference image. You will then configure the tasks sequence to enable patching via a Windows Server Update Services (WSUS) server. + ### Create a task sequence for Windows 10 Enterprise + 1. Using the Deployment Workbench, select **Task Sequences** in the **MDT Production** node, and create a folder named **Windows 10**. 2. Right-click the new **Windows 10** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: 1. Task sequence ID: W10-X64-001 @@ -208,6 +272,7 @@ This section will show you how to create the task sequence used to deploy your p 9. Internet Explorer home page: about:blank 10. Admin Password: Do not specify an Administrator Password at this time ### Edit the Windows 10 task sequence + 1. Right-click the **Windows 10 Enterprise x64 RTM Custom Image** task sequence, and select **Properties**. 2. On the **Task Sequence** tab, configure the **Windows 10 Enterprise x64 RTM Custom Image** task sequence with the following settings: 1. Preinstall. After the **Enable BitLocker (Offline)** action, add a **Set Task Sequence Variable** action with the following settings: @@ -223,11 +288,17 @@ This section will show you how to create the task sequence used to deploy your p 3. State Restore. Enable the **Windows Update (Pre-Application Installation)** action. 4. State Restore. Enable the **Windows Update (Post-Application Installation)** action. 3. Click **OK**. + ![figure 6](images/fig6-taskseq.png) + Figure 6. The task sequence for production deployment. + ## Step 7: Configure the MDT production deployment share + In this section, you will learn how to configure the MDT Build Lab deployment share with the rules required to create a simple and dynamic deployment process. This includes configuring commonly used rules and an explanation of how these rules work. + ### Configure the rules + 1. On MDT01, using File Explorer, copy the following files from the **D:\\Setup\\Sample Files\\MDT Production\\Control** folder to **E:\\MDTProduction\\Control**. Overwrite the existing files. 1. Bootstrap.ini 2. CustomSettings.ini @@ -295,14 +366,21 @@ In this section, you will learn how to configure the MDT Build Lab deployment sh 10. In the **Drivers and Patches** sub tab, select the **WinPE x64** selection profile and select the **Include all drivers from the selection profile** option. 11. In the **Monitoring** tab, select the **Enable monitoring for this deployment share** check box. 12. Click **OK**. + **Note**   It will take a while for the Deployment Workbench to create the monitoring database and web service.   + ![figure 8](images/mdt-07-fig08.png) + Figure 7. The Windows PE tab for the x64 boot image. + ### The rules explained + The rules for the MDT Production deployment share are somewhat different from those for the MDT Build Lab deployment share. The biggest differences are that you deploy the machines into a domain instead of a workgroup and that you do not automate the logon. + ### The Bootstrap.ini file + This is the MDT Production Bootstrap.ini without the user credentials (except domain information): ``` syntax [Settings] @@ -314,6 +392,7 @@ UserID=MDT_BA SkipBDDWelcome=YES ``` ### The CustomSettings.ini file + This is the CustomSettings.ini file with the new join domain information: ``` syntax [Settings] @@ -360,9 +439,14 @@ The additional properties to use in the MDT Production rules file are as follows - **ScanStateArgs.** Arguments for the User State Migration Tool (USMT) ScanState command. - **USMTMigFiles(\*).** List of USMT templates (controlling what to backup and restore). - **EventService.** Activates logging information to the MDT monitoring web service. + ### Optional deployment share configuration -If your organization has a Microsoft Software Assurance agreement, you also can subscribe to the additional Microsoft Desktop Optimization Package (MDOP) license (at an additional cost). Included in MDOP is Microsoft Diagnostics and Recovery Toolkit (DaRT), which contains tools that can help you troubleshoot MDT deployments, as well as troubleshoot Windows itself. + +If your organization has a Microsoft Software Assurance agreement, you also can subscribe to the additional Microsoft Desktop Optimization Package (MDOP) license (at an additional cost). Included in MDOP is Microsoft Diagnostics and Recovery Toolkit (DaRT), which contains tools that can help you +troubleshoot MDT deployments, as well as troubleshoot Windows itself. + ### Add DaRT 10 to the boot images + If you have licensing for MDOP and DaRT, you can add DaRT to the boot images using the steps in this section. If you do not have DaRT licensing, or don't want to use it, simply skip to the next section, [Update the Deployment Share](#bkmk-update-deployment). To enable the remote connection feature in MDT 2013 Update 2, you need to do the following: - Install DaRT 10 (part of MDOP 2015 R1). - Copy the two tools CAB files (Toolsx86.cab and Toolsx64.cab) to the deployment share. @@ -375,27 +459,40 @@ In these steps, we assume that you downloaded MDOP 2015 R1 and copied DaRT 10 to 5. Using the Deployment Workbench, right-click the **MDT Production** deployment share and select **Properties**. 6. In the **Windows PE** tab, in the **Platform** drop-down list, make sure **x86** is selected. 7. In the **Features** sub tab, select the **Microsoft Diagnostics and Recovery Toolkit (DaRT)** check box. + ![figure 8](images/mdt-07-fig09.png) + Figure 8. Selecting the DaRT 10 feature in the deployment share. + 8. In the **Windows PE** tab, in the **Platform** drop-down list, select **x64**. 9. In the **Features** sub tab, in addition to the default selected feature pack, select the **Microsoft Diagnostics and Recovery Toolkit (DaRT)** check box. 10. Click **OK**. + ### Update the deployment share + Like the MDT Build Lab deployment share, the MDT Production deployment share needs to be updated after it has been configured. This is the process during which the Windows PE boot images are created. 1. Right-click the **MDT Production** deployment share and select **Update Deployment Share**. 2. Use the default options for the Update Deployment Share Wizard. + **Note**   The update process will take 5 to 10 minutes.   ## Step 8: Deploy the Windows 10 client image + These steps will walk you throug the process of using task sequences to deploy Windows 10 images through a fully automated process. First, you need to add the boot image to Windows Deployment Services (WDS) and then start the deployment. In contrast with deploying images from the MDT Build Lab deployment share, we recommend using the Pre-Installation Execution Environment (PXE) to start the full deployments in the datacenter, even though you technically can use an ISO/CD or USB to start the process. + ### Configure Windows Deployment Services + You need to add the MDT Production Lite Touch x64 Boot image to WDS in preparation for the deployment. For the following steps, we assume that Windows Deployment Services has already been installed on MDT01. 1. Using the WDS console, right-click **Boot Images** and select **Add Boot Image**. 2. Browse to the E:\\MDTProduction\\Boot\\LiteTouchPE\_x64.wim file and add the image with the default settings. + ![figure 9](images/mdt-07-fig10.png) + Figure 9. The boot image added to the WDS console. + ### Deploy the Windows 10 client + At this point, you should have a solution ready for deploying the Windows 10 client. We recommend starting by trying a few deployments at a time until you are confident that your configuration works as expected. We find it useful to try some initial tests on virtual machines before testing on physical hardware. This helps rule out hardware issues when testing or troubleshooting. Here are the steps to deploy your Windows 10 image to a virtual machine: 1. Create a virtual machine with the following settings: 1. Name: PC0005 @@ -404,8 +501,11 @@ At this point, you should have a solution ready for deploying the Windows 10 cl 4. Memory: 2048 MB 5. Hard disk: 60 GB (dynamic disk) 2. Start the PC0005 virtual machine, and press **Enter** to start the PXE boot. The machine will now load the Windows PE boot image from the WDS server. + ![figure 10](images/mdt-07-fig11.png) + Figure 10. The initial PXE boot process of PC0005. + 3. After Windows PE has booted, complete the Windows Deployment Wizard using the following setting: 1. Password: P@ssw0rd 2. Select a task sequence to execute on this computer: Windows 10 Enterprise x64 RTM Custom Image @@ -415,33 +515,57 @@ At this point, you should have a solution ready for deploying the Windows 10 cl 1. Installs the Windows 10 Enterprise operating system. 2. Installs the added application. 3. Updates the operating system via your local Windows Server Update Services (WSUS) server. + ### Use the MDT 2013 monitoring feature + Now that you have enabled the monitoring on the MDT Production deployment share, you can follow your deployment of PC0005 via the monitoring node. + 1. On MDT01, using Deployment Workbench, expand the **MDT Production** deployment share folder. 2. Select the **Monitoring** node, and wait until you see PC0005. 3. Double-click PC0005, and review the information. + ![figure 11](images/mdt-07-fig13.png) + Figure 11. The Monitoring node, showing the deployment progress of PC0005. + ### Use information in the Event Viewer + When monitoring is enabled, MDT also writes information to the event viewer on MDT01. This information can be used to trigger notifications via scheduled tasks when deployment is completed. For example, you can configure scheduled tasks to send an email when a certain event is created in the event log. + ![figure 12](images/mdt-07-fig14.png) + Figure 12. The Event Viewer showing a successful deployment of PC0005. + ## Multicast deployments + Multicast deployment allows for image deployment with reduced network load during simultaneous deployments. Multicast is a useful operating system deployment feature in MDT deployments, however it is important to ensure that your network supports it and is designed for it. + ### Requirements -Multicast requires that Windows Deployment Services (WDS) is running on Windows Server 2008 or later. In addition to the core MDT 2013 setup for multicast, the network needs to be configured to support multicast. In general, this means involving the organization networking team to make sure that Internet Group Management Protocol (IGMP) snooping is turned on and that the network is designed for multicast traffic. The multicast solution uses IGMPv3. + +Multicast requires that Windows Deployment Services (WDS) is running on Windows Server 2008 or later. In addition to the core MDT 2013 setup for multicast, the network needs to be configured to support multicast. In general, this means involving the organization networking team to make sure that +Internet Group Management Protocol (IGMP) snooping is turned on and that the network is designed for multicast traffic. The multicast solution uses IGMPv3. + ### Set up MDT for multicast + Setting up MDT for multicast is straightforward. You enable multicast on the deployment share, and MDT takes care of the rest. + 1. On MDT01, right-click the **MDT Production** deployment share folder and select **Properties**. 2. In the **General** tab, select the **Enable multicast for this deployment share (requires Windows Server 2008 R2 Windows Deployment Services)** check box, and click **OK**. 3. Right-click the **MDT Production** deployment share folder and select **Update Deployment Share**. 4. After updating the deployment share, use the Windows Deployment Services console to, verify that the multicast namespace was created. + ![figure 13](images/mdt-07-fig15.png) + Figure 13. The newly created multicast namespace. + ## Use offline media to deploy Windows 10 + In addition to network-based deployments, MDT supports the use of offline media-based deployments of Windows 10. You can very easily generate an offline version of your deployment share - either the full deployment share or a subset of it - by the use of selection profiles. The generated offline media can be burned to a DVD or copied to a USB stick for deployment. + Offline media are useful not only when you do not have network connectivity to the deployment share, but also when you have limited connection to the deployment share and do not want to copy 5 GB of data over the wire. Offline media can still join the domain, but you save the transfer of operating system images, drivers, and applications over the wire. + ### Create the offline media selection profile + To filter what is being added to the media, you create a selection profile. When creating selection profiles, you quickly realize the benefits of having created a good logical folder structure in the Deployment Workbench. 1. On MDT01, using Deployment Workbench, in the **MDT Production / Advanced Configuration** node, right-click **Selection Profile**, and select **New Selection Profile**. 2. Use the following settings for the New Selection Profile Wizard: @@ -453,8 +577,11 @@ To filter what is being added to the media, you create a selection profile. When 3. Out-Of-Box Drivers / WinPE x64 4. Out-Of-Box Drivers / Windows 10 x64 5. Task Sequences / Windows 10 + ### Create the offline media + In these steps, you generate offline media from the MDT Production deployment share. To filter what is being added to the media, you use the previously created selection profile. + 1. On MDT01, using File Explorer, create the **E:\\MDTOfflineMedia** folder. **Note**   When creating offline media, you need to create the target folder first. It is crucial that you do not create a subfolder inside the deployment share folder because it will break the offline media. @@ -464,8 +591,11 @@ In these steps, you generate offline media from the MDT Production deployment sh - General Settings 1. Media path: **E:\\MDTOfflineMedia** 2. Selection profile: Windows 10 Offline Media + ### Configure the offline media + Offline media has its own rules, its own Bootstrap.ini and CustomSettings.ini files. These files are stored in the Control folder of the offline media; they also can be accessed via properties of the offline media in the Deployment Workbench. + 1. On MDT01, using File Explorer, copy the CustomSettings.ini file from the **E:\\MDTBuildLab\\Control** folder to **E:\\MDTOfflineMedia\\Content\\Deploy\\Control**. Overwrite the existing files. 2. Using Deployment Workbench, in the **MDT Production / Advanced Configuration / Media** node, right-click the **MEDIA001** media, and select **Properties**. 3. In the **General** tab, configure the following: @@ -478,29 +608,44 @@ Offline media has its own rules, its own Bootstrap.ini and CustomSettings.ini fi 2. In the **Windows PE Customizations** area, set the Scratch space size to 128. 6. In the **Drivers and Patches** sub tab, select the **WinPE x64** selection profile and select the **Include all drivers from the selection profile** option. 7. Click **OK**. + ### Generate the offline media + You have now configured the offline media deployment share however the share has not yet been populated with the files required for deployment. Now everything is ready you populate the deployment share content folder and generate the offline media ISO. + 1. On MDT01, using Deployment Workbench, navigate to the **MDT Production / Advanced Configuration / Media** node. 2. Right-click the **MEDIA001** media, and select **Update Media Content**. The Update Media Content process now generates the offline media in the **E:\\MDTOfflineMedia\\Content** folder. + ### Create a bootable USB stick + The ISO that you got when updating the offline media item can be burned to a DVD and used directly (it will be bootable), but it is often more efficient to use USB sticks instead since they are faster and can hold more data. (A dual-layer DVD is limited to 8.5 GB.) Follow these steps to create a bootable USB stick from the offline media content: + 1. On a physical machine running Windows 7 or later, insert the USB stick you want to use. 2. Copy the content of the **MDTOfflineMedia\\Content** folder to the root of the USB stick. 3. Start an elevated command prompt (run as Administrator), and start the Diskpart utility by typing **Diskpart** and pressing **Enter**. 4. In the Diskpart utility, you can type **list volume** (or the shorter **list vol**) to list the volumes, but you really only need to remember the drive letter of the USB stick to which you copied the content. In our example, the USB stick had the drive letter F. 5. In the Diskpart utility, type **select volume F** (replace F with your USB stick drive letter). 6. In the Diskpart utility, type **active**, and then type **exit**. + ## Unified Extensible Firmware Interface (UEFI)-based deployments + As referenced in [Windows 10 deployment tools](http://go.microsoft.com/fwlink/p/?LinkId=619546), Unified Extensible Firmware Interface (UEFI)-based deployments are becoming more common. In fact, when you create a generation 2 virtual machine in Hyper-V, you get a UEFI-based computer. During deployment, MDT automatically detects that you have an UEFI-based machine and creates the partitions UEFI requires. You do not need to update or change your task sequences in any way to accommodate UFEI. + ![figure 14](images/mdt-07-fig16.png) + Figure 14. The partitions when deploying an UEFI-based machine. + ## Related topics + [Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md) + [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) + [Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md) + [Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) + [Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md) + [Configure MDT settings](configure-mdt-2013-settings.md) -  -  diff --git a/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit.md b/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit.md index 37bc2bad93..765f29c16d 100644 --- a/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit.md +++ b/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit.md @@ -2,21 +2,28 @@ title: Deploy Windows 10 with the Microsoft Deployment Toolkit (Windows 10) description: This guide will walk you through the process of deploying Windows 10 in an enterprise environment using the Microsoft Deployment Toolkit (MDT), and MDT 2013 Update 2 specifically. ms.assetid: 837f009c-617e-4b3f-9028-2246067ee0fb -ms.pagetype: mdt -keywords: ["deploy", "tools", "configure", "script"] +keywords: deploy, tools, configure, script ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus +ms.pagetype: mdt --- + # Deploy Windows 10 with the Microsoft Deployment Toolkit + **Applies to** - Windows 10 + This guide will walk you through the process of deploying Windows 10 in an enterprise environment using the Microsoft Deployment Toolkit (MDT), and MDT 2013 Update 2 specifically. + The Microsoft Deployment Toolkit is a unified collection of tools, processes, and guidance for automating desktop and server deployment. In addition to reducing deployment time and standardizing desktop and server images, MDT enables you to more easily manage security and ongoing configurations. MDT builds on top of the core deployment tools in the Windows Assessment and Deployment Kit (Windows ADK) with additional guidance and features designed to reduce the complexity and time required for deployment in an enterprise environment. MDT 2013 Update 2 supports the deployment of Windows 10, as well as Windows 7, Windows 8, Windows 8.1, and Windows Server 2012 R2. It also includes support for zero-touch installation (ZTI) with Microsoft System Center 2012 R2 Configuration Manager. + To download the latest version of MDT, visit the [MDT resource page](http://go.microsoft.com/fwlink/p/?LinkId=618117). + ## In this section + - [Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md) - [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) - [Deploy a Windows 10 image using MDT 2013 Update 2](deploy-a-windows-10-image-using-mdt.md) @@ -24,14 +31,23 @@ To download the latest version of MDT, visit the [MDT resource page](http://go.m - [Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) - [Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md) - [Configure MDT settings](configure-mdt-2013-settings.md) + ## Proof-of-concept environment + For the purposes of this guide, and the topics discussed herein, we will use the following servers and client machines: DC01, MDT01, CM01, PC0001, and PC0002. + ![figure 1](images/mdt-01-fig01.png) + Figure 1. The servers and machines used for examples in this guide. + DC01 is a domain controller; the other servers and client machines are members of the domain contoso.com for the fictitious Contoso Corporation. + ![figure 2](images/mdt-01-fig02.jpg) + Figure 2. The organizational unit (OU) structure used in this guide. + ### Server details + - **DC01.** A Windows Server 2012 R2 Standard machine, fully patched with the latest security updates, and configured as Active Directory Domain Controller, DNS Server, and DHCP Server in the contoso.com domain. - Server name: DC01 - IP Address: 192.168.1.200 @@ -42,25 +58,35 @@ Figure 2. The organizational unit (OU) structure used in this guide. - **CM01.** A Windows Server 2012 R2 Standard machine, fully patched with the latest security updates, and configured as a member server in the contoso.com domain. - Server name: CM01 - IP Address: 192.168.1.214 + ### Client machine details + - **PC0001.** A Windows 10 Enterprise x64 machine, fully patched with the latest security updates, and configured as a member in the contoso.com domain. This machine is referenced as the admin workstation. - Client name: PC0001 - IP Address: DHCP - **PC0002.** A Windows 7 SP1 Enterprise x64 machine, fully patched with the latest security updates, and configured as a member in the contoso.com domain. This machine is referenced during the migration scenarios. - Client name: PC0002 - IP Address: DHCP + ## Sample files + The information in this guide is designed to help you deploy Windows 10. In order to help you put the information you learn into practice more quickly, we recommend that you download a small set of sample files for the fictitious Contoso Corporation: - [Gather.ps1](http://go.microsoft.com/fwlink/p/?LinkId=619361). This sample Windows PowerShell script performs the MDT Gather process in a simulated MDT environment. This allows you to test the MDT gather process and check to see if it is working correctly without performing a full Windows deployment. - [Set-OUPermissions.ps1](http://go.microsoft.com/fwlink/p/?LinkId=619362). This sample Windows PowerShell script creates a domain account and then configures OU permissions to allow the account to join machines to the domain in the specified OU. - [MDTSample.zip](http://go.microsoft.com/fwlink/p/?LinkId=619363). This sample web service shows you how to configure a computer name dynamically using MDT. + ## Related topics + [Microsoft Deployment Toolkit downloads and resources](http://go.microsoft.com/fwlink/p/?LinkId=618117) + [Windows 10 deployment scenarios](windows-10-deployment-scenarios.md) + [Windows 10 deployment tools](windows-deployment-scenarios-and-tools.md) + [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](deploy-windows-10-with-system-center-2012-r2-configuration-manager.md) + [Deploy Windows To Go in your organization](deploy-windows-to-go.md) + [Sideload apps in Windows 10](sideload-apps-in-windows-10.md) + [Volume Activation for Windows 10](volume-activation-windows-10.md) -  -  diff --git a/windows/deploy/get-started-with-the-microsoft-deployment-toolkit.md b/windows/deploy/get-started-with-the-microsoft-deployment-toolkit.md index 53bf7c8dc7..57d9153cb2 100644 --- a/windows/deploy/get-started-with-the-microsoft-deployment-toolkit.md +++ b/windows/deploy/get-started-with-the-microsoft-deployment-toolkit.md @@ -2,32 +2,48 @@ title: Get started with the Microsoft Deployment Toolkit (MDT) (Windows 10) description: This topic will help you gain a better understanding of how to use the Microsoft Deployment Toolkit (MDT), and MDT 2013 Update 2 in particular, as part of a Windows operating system deployment. ms.assetid: a256442c-be47-4bb9-a105-c831f58ce3ee -ms.pagetype: mdt -keywords: ["deploy", "image", "feature", "install", "tools"] +keywords: deploy, image, feature, install, tools ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: mdt author: mtniehaus --- + # Get started with the Microsoft Deployment Toolkit (MDT) + **Applies to** - Windows 10 + This topic will help you gain a better understanding of how to use the Microsoft Deployment Toolkit (MDT), and MDT 2013 Update 2 in particular, as part of a Windows operating system deployment. MDT is one of the most important tools available to IT professionals today. You can use it to create reference images or as a complete deployment solution. MDT 2013 Update 2 also can be used to extend the operating system deployment features available in Microsoft System Center 2012 R2 Configuration Manager. + In addition to familiarizing you with the features and options available in MDT 2013 Update 2, this topic will walk you through the process of preparing for deploying Windows 10 using MDT by configuring Active Directory, creating an organizational unit (OU) structure, creating service accounts, configuring log files and folders, and installing the tools needed to view the logs and continue with the deployment process. -For the purposes of this topic, we will use two machines: DC01 and MDT01. DC01 is a domain controller and MDT01 is a Windows Server 2012 R2 standard server. MDT01 is a member of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md#proof). + +For the purposes of this topic, we will use two machines: DC01 and MDT01. DC01 is a domain controller and MDT01 is a Windows Server 2012 R2 standard server. MDT01 is a member of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see +[Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md#proof). + ![figure 1](images/mdt-05-fig01.png) + Figure 1. The machines used in this topic. + ## In this section + - [Key features in MDT 2013 Update 2](key-features-in-mdt-2013.md) - [MDT 2013 Update 2 Lite Touch components](mdt-2013-lite-touch-components.md) - [Prepare for deployment with MDT 2013 Update 2](prepare-for-windows-deployment-with-mdt-2013.md) + ## Related topics + [Microsoft Deployment Toolkit downloads and documentation](http://go.microsoft.com/fwlink/p/?LinkId=618117) + [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) + [Deploy a Windows 10 image using MDT 2013 Update 2](deploy-a-windows-10-image-using-mdt.md) + [Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md) + [Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) + [Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md) + [Configure MDT settings](configure-mdt-2013-settings.md) -  -  diff --git a/windows/deploy/import-export-vamt-data.md b/windows/deploy/import-export-vamt-data.md index 1152f74801..aff3d6376f 100644 --- a/windows/deploy/import-export-vamt-data.md +++ b/windows/deploy/import-export-vamt-data.md @@ -2,25 +2,33 @@ title: Import and Export VAMT Data (Windows 10) description: Import and Export VAMT Data ms.assetid: 09a2c595-1a61-4da6-bd46-4ba8763cfd4f -ms.pagetype: activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- + # Import and Export VAMT Data -You can use the Volume Activation Management Tool (VAMT) to import product-activation data from a Computer Information List (.cilx or .cil) file into SQL Server, and to export product-activation data into a .cilx file. A .cilx file is an XML file that stores computer and product-activation data. You can import data or export data during the following scenarios: + +You can use the Volume Activation Management Tool (VAMT) to import product-activation data from a Computer Information List (.cilx or .cil) file into SQL Server, and to export product-activation data into a .cilx file. A .cilx file is an XML file that stores computer and product-activation data. +You can import data or export data during the following scenarios: - Import and merge data from previous versions of VAMT. - Export data to use to perform proxy activations. + **Warning**   Editing a .cilx file using an application other than VAMT can corrupt the .cilx file and is not supported. + ## Import VAMT Data + **To import data into VAMT** 1. Open VAMT. 2. In the right-side **Actions** pane, click **Import list** to open the **Import List** dialog box. 3. In the **Import List** dialog box, navigate to the .cilx file location, select the file, and click **Open**. 4. In the **Volume Activation Management Tool** dialog box, click **OK** to begin the import. VAMT displays a progress message while the file is being imported. Click **OK** when a message appears and confirms that the import has completed successfully. + ## Export VAMT Data + Exporting VAMT data from a non-Internet-connected VAMT host computer is the first step of proxy activation using multiple VAMT hosts. To export product-activation data to a .cilx file: 1. In the left-side pane, you can click a product you want to export data for, or click **Products** if the list contains data for all products. 2. If you want to export only part of the data in a product list, in the product list view in the center pane select the products you want to export. @@ -32,5 +40,7 @@ Exporting VAMT data from a non-Internet-connected VAMT host computer is the firs - Export proxy activation data only. Selecting this option ensures that the export contains only the licensing information required for the proxy web service to obtain CIDs from Microsoft. No Personally Identifiable Information (PII) is contained in the exported .cilx file when this selection is checked. 6. If you have selected products to export, select the **Export selected product rows only** check box. 7. Click **Save**. VAMT displays a progress message while the data is being exported. Click **OK** when a message appears and confirms that the export has completed successfully. + ## Related topics + - [Perform Proxy Activation](proxy-activation-vamt.md) diff --git a/windows/deploy/install-configure-vamt.md b/windows/deploy/install-configure-vamt.md index 67ca6058e7..a660854f6f 100644 --- a/windows/deploy/install-configure-vamt.md +++ b/windows/deploy/install-configure-vamt.md @@ -2,21 +2,27 @@ title: Install and Configure VAMT (Windows 10) description: Install and Configure VAMT ms.assetid: 5c7ae9b9-0dbc-4277-bc4f-8b3e4ab0bf50 -ms.pagetype: activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- + # Install and Configure VAMT + This section describes how to install and configure the Volume Activation Management Tool (VAMT). + ## In this Section + |Topic |Description | |------|------------| |[VAMT Requirements](vamt-requirements.md) |Provides system requirements for installing VAMT on a host computer. | |[Install VAMT](install-vamt.md) |Describes how to get and install VAMT. | |[Configure Client Computers](configure-client-computers-vamt.md) |Describes how to configure client computers on your network to work with VAMT. | + ## Related topics + - [Introduction to VAMT](introduction-vamt.md)     diff --git a/windows/deploy/install-kms-client-key-vamt.md b/windows/deploy/install-kms-client-key-vamt.md index aeac56e720..f1e5cd2769 100644 --- a/windows/deploy/install-kms-client-key-vamt.md +++ b/windows/deploy/install-kms-client-key-vamt.md @@ -2,16 +2,20 @@ title: Install a KMS Client Key (Windows 10) description: Install a KMS Client Key ms.assetid: d234468e-7917-4cf5-b0a8-4968454f7759 -ms.pagetype: activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- + # Install a KMS Client Key + You can use the Volume Activation Management Tool (VAMT) to install Generic Volume License Key (GVLK), or KMS client, product keys. For example, if you are converting a MAK-activated product to KMS activation. + **Note**   By default, volume license editions of Windows Vista, Windows® 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server® 2012, and Microsoft® Office 2010 use KMS for activation. GVLKs are already installed in volume license editions of these products. + **To install a KMS Client key** 1. Open VAMT. 2. In the left-side pane click **Products** to open the product list view in the center pane. @@ -23,7 +27,11 @@ By default, volume license editions of Windows Vista, Windows® 7, Windows 8, 6. Click **Install product key** in the **Selected Items** menu in the right-side pane to display the **Install Product Key** dialog box. 7. The **Install Product Key** dialog box displays the keys that are available to be installed. 8. Select the **Automatically select an AD or KMS client key** option and then click **Install Key**. + VAMT displays the **Installing product key** dialog box while it attempts to install the product key for the selected products. When the process is finished, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. + The same status is shown under the **Status of Last Action** column in the product list view in the center pane. + ## Related topics + - [Perform KMS Activation](kms-activation-vamt.md) diff --git a/windows/deploy/install-product-key-vamt.md b/windows/deploy/install-product-key-vamt.md index 716679c7af..a3f4a3760e 100644 --- a/windows/deploy/install-product-key-vamt.md +++ b/windows/deploy/install-product-key-vamt.md @@ -2,14 +2,17 @@ title: Install a Product Key (Windows 10) description: Install a Product Key ms.assetid: 78812c87-2208-4f8b-9c2c-5a8a18b2d648 -ms.pagetype: activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- + # Install a Product Key + You can use the Volume Activation Management Tool (VAMT) to install retail, Multiple Activation Key (MAK), and KMS Host key (CSVLK). + **To install a Product key** 1. Open VAMT. 2. In the left-side pane, click the product that you want to install keys onto. @@ -22,10 +25,15 @@ You can use the Volume Activation Management Tool (VAMT) to install retail, Mult 7. Click **Install product key** in the **Selected Items** menu in the right-side pane to display the **Install Product Key** dialog box. 8. The **Select Product Key** dialog box displays the keys that are available to be installed. Under **Recommended MAKs**, VAMT might display one or more recommended MAK based on the selected products. You can select a recommended product key or a product key from the **All Product Keys** list. Use the scroll bar if you need to view the **Description** for each key. When you have selected the product key you want to install, click **Install Key**. Note that only one key can be installed at a time. 9. VAMT displays the **Installing product key** dialog box while it attempts to install the product key for the selected products. When the process is finished, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. + The same status is shown under the **Status of Last Action** column in the product list view in the center pane. + **Note**   - Product key installation will fail if VAMT finds mismatched key types or editions. VAMT will display the failure status and will continue the installation for the next product in the list. For more information on choosing the correct MAK or KMS Host key (CSVLK), see [How to Choose the Right Volume License Key for Windows](http://go.microsoft.com/fwlink/p/?linkid=238382). + Product key installation will fail if VAMT finds mismatched key types or editions. VAMT will display the failure status and will continue the installation for the next product in the list. For more information on choosing the correct MAK or KMS Host key (CSVLK), see [How to Choose the Right + Volume License Key for Windows](http://go.microsoft.com/fwlink/p/?linkid=238382). + ## Related topics + - [Manage Product Keys](manage-product-keys-vamt.md)     diff --git a/windows/deploy/install-vamt.md b/windows/deploy/install-vamt.md index 0c0fb01dc6..02275fb993 100644 --- a/windows/deploy/install-vamt.md +++ b/windows/deploy/install-vamt.md @@ -2,33 +2,47 @@ title: Install VAMT (Windows 10) description: Install VAMT ms.assetid: 2eabd3e2-0a68-43a5-8189-2947e46482fc -ms.pagetype: activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- + # Install VAMT + This topic describes how to install the Volume Activation Management Tool (VAMT). + ## Install VAMT + You can install VAMT as part of the [Windows Assessment and Deployment Kit (ADK)](http://go.microsoft.com/fwlink/p/?LinkId=526740) for Windows 10. + **Important**   VAMT requires local administrator privileges on all managed computers in order to deposit confirmation IDs (CIDs), get the client products’ license status, and install product keys. If VAMT is being used to manage products and product keys on the local host computer and you do not have administrator privileges, start VAMT with elevated privileges. For Active Directory-Based Activation use, for best results we recommend running VAMT while logged on as a domain administrator.  + **Note**   The VAMT Microsoft Management Console snap-in ships as an x86 package. + After you install VAMT, if you have a computer information list (CIL) that was created in a previous version of VAMT, you must import the list into a SQL database. If you do not have SQL installed, you can download a free copy of Microsoft SQL Server Express and create a new database into which you can import the CIL. To install SQL Server Express: 1. Install the Windows ADK. 2. Ensure that **Volume Activation Management Tool** and **Microsoft® SQL Server® 2012 Express** are selected to be installed. 3. Click **Install**. + ## Select a Database + **Using a SQL database installed during ADK setup** If SQL Server 2012 Express was installed during ADK setup, the default database name will be **ADK**.By default, VAMT is configure to use a SQL database that is installed on the local machine during ADK setup and displays the server name as **.\\ADK**. If the SQL database was installed on another machine, you must configure the database to allow remote connections and you must provide the corresponding server name. If a new VAMT database needs to be created, provide a name for the new database. + **Using a SQL database installed outside of ADK setup** + You must configure SQL installation to allow remote connections and you must provide the corresponding server name in the format: *Machine Name\\SQL Server Name*. If a new VAMT database needs to be created, provide a name for the new database. + ## Uninstall VAMT + To uninstall VAMT via the **Programs and Features** Control Panel: 1. Open the **Control Panel** and select **Programs and Features**. 2. Select **Assessment and Deployment Kit** from the list of installed programs and click **Change**. Follow the instructions in the Windows ADK installer to remove VAMT. + ## Related topics - [Install and Configure VAMT](install-configure-vamt.md)   diff --git a/windows/deploy/integrate-configuration-manager-with-mdt-2013.md b/windows/deploy/integrate-configuration-manager-with-mdt-2013.md index c7b0364e13..1ad2dbc2bd 100644 --- a/windows/deploy/integrate-configuration-manager-with-mdt-2013.md +++ b/windows/deploy/integrate-configuration-manager-with-mdt-2013.md @@ -3,21 +3,29 @@ title: Integrate Configuration Manager with MDT 2013 Update 2 (Windows 10) description: This topic will help you understand the benefits of integrating the Microsoft Deployment Toolkit with Microsoft System Center 2012 R2 Configuration Manager SP1 when you deploy a new or updated version of the Windows operating system. ms.assetid: 3bd1cf92-81e5-48dc-b874-0f5d9472e5a5 ms.pagetype: mdt -keywords: ["deploy, image, customize, task sequence"] +keywords: deploy, image, customize, task sequence ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus --- + # Integrate Configuration Manager with MDT 2013 Update 2 + **Applies to** - Windows 10 + This topic will help you understand the benefits of integrating the Microsoft Deployment Toolkit with Microsoft System Center 2012 R2 Configuration Manager SP1 when you deploy a new or updated version of the Windows operating system. MDT 2013 is a free, supported download from Microsoft that adds approximately 280 enhancements to Windows operating system deployment with System Center 2012 R2 Configuration Manager SP1. It is, therefore, recommended that you utilize MDT when deploying the Windows operating system with Configuration Manager SP1. In addition to integrating MDT with Configuration Manager, we also recommend using MDT Lite Touch to create the Windows 10 reference images used in Configuration Manager. For more information on how to create a reference image, see [Create a Windows 10 reference image](create-a-windows-10-reference-image.md). + ## Why integrate MDT 2013 Update 2 with Configuration Manager + As noted above, MDT adds many enhancements to Configuration Manager. While these enhancements are called Zero Touch, that name does not reflect how deployment is conducted. The following sections provide a few samples of the 280 enhancements that MDT 2013 Update 2 adds to Configuration Manager. + ### MDT enables dynamic deployment + When MDT is integrated with Configuration Manager, the task sequence takes additional instructions from the MDT rules. In its most simple form, these settings are stored in a text file, the CustomSettings.ini file, but you can store the settings in Microsoft SQL Server databases, or have Microsoft Visual Basic Scripting Edition (VBScripts) or web services provide the settings used. + The task sequence uses instructions that allow you to reduce the number of task sequences in Configuration Manager and instead store settings outside the task sequence. Here are a few examples: - The following settings instruct the task sequence to install the HP Hotkeys package, but only if the hardware is a HP EliteBook 8570w. Note that you don't have to add the package to the task sequence. ``` syntax @@ -42,22 +50,39 @@ The task sequence uses instructions that allow you to reduce the number of task OSDComputerName=DT-%SerialNumber% MachineObjectOU=ou=desktops,ou=Contoso,dc=contoso,dc=com ``` + ![figure 2](images/fig2-gather.png) + Figure 2. The Gather action in the task sequence is reading the rules. + ### MDT adds an operating system deployment simulation environment + When testing a deployment, it is important to be able to quickly test any changes you make to the deployment without needing to run through an entire deployment. MDT rules can be tested very quickly, saving significant testing time in a deployment project. For more information, see [Configure MDT settings](configure-mdt-2013-settings.md). + ![figure 3](images/mdt-06-fig03.png) + Figure 3. The folder that contains the rules, a few scripts from MDT, and a custom script (Gather.ps1). + ### MDT adds real-time monitoring + With MDT integration, you can follow your deployments in real time, and if you have access to Microsoft Diagnostics and Recovery Toolkit (DaRT), you can even remote into Windows Preinstallation Environment (Windows PE) during deployment. The real-time monitoring data can be viewed from within the MDT Deployment Workbench, via a web browser, Windows PowerShell, the Event Viewer, or Microsoft Excel 2013. In fact, any script or app that can read an Open Data (OData) feed can read the information. + ![figure 4](images/mdt-06-fig04.png) + Figure 4. View the real-time monitoring data with PowerShell. + ### MDT adds an optional deployment wizard + For some deployment scenarios, you may need to prompt the user for information during deployment such as the computer name, the correct organizational unit (OU) for the computer, or which applications should be installed by the task sequence. With MDT integration, you can enable the User-Driven Installation (UDI) wizard to gather the required information, and customize the wizard using the UDI Wizard Designer. + ![figure 5](images/mdt-06-fig05.png) + Figure 5. The optional UDI wizard open in the UDI Wizard Designer. + MDT Zero Touch simply extends Configuration Manager with many useful built-in operating system deployment components. By providing well-established, supported solutions, MDT reduces the complexity of deployment in Configuration Manager. + ## Why use MDT Lite Touch to create reference images + You can create reference images for Configuration Manager in Configuration Manager, but in general we recommend creating them in MDT Lite Touch for the following reasons: - In a deployment project, it is typically much faster to create a reference image using MDT Lite Touch than Configuration Manager. - You can use the same image for every type of operating system deployment - Microsoft Virtual Desktop Infrastructure (VDI), Microsoft System Center 2012 R2 Virtual Machine Manager (SCVMM), MDT, Configuration Manager, Windows Deployment Services (WDS), and more. @@ -65,15 +90,24 @@ You can create reference images for Configuration Manager in Configuration Manag - The Configuration Manager task sequence does not suppress user interface interaction. - MDT Lite Touch supports a Suspend action that allows for reboots, which is useful when you need to perform a manual installation or check the reference image before it is automatically captured. - MDT Lite Touch does not require any infrastructure and is easy to delegate. + ## Related topics + [Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) + [Create a custom Windows PE boot image with Configuration Manager](create-a-custom-windows-pe-boot-image-with-configuration-manager.md) + [Add a Windows 10 operating system image using Configuration Manager](add-a-windows-10-operating-system-image-using-configuration-manager.md) + [Create an application to deploy with Windows 10 using Configuration Manager](create-an-application-to-deploy-with-windows-10-using-configuration-manager.md) + [Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager](add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md) + [Create a task sequence with Configuration Manager and MDT](create-a-task-sequence-with-configuration-manager-and-mdt.md) + [Deploy Windows 10 using PXE and Configuration Manager](deploy-windows-10-using-pxe-and-configuration-manager.md) + + [Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md) -[Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md) -  -  + +[Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md)  diff --git a/windows/deploy/introduction-vamt.md b/windows/deploy/introduction-vamt.md index d54d4dccdc..ee0060ad4e 100644 --- a/windows/deploy/introduction-vamt.md +++ b/windows/deploy/introduction-vamt.md @@ -2,42 +2,59 @@ title: Introduction to VAMT (Windows 10) description: Introduction to VAMT ms.assetid: 0439685e-0bae-4967-b0d4-dd84ca6d7fa7 -ms.pagetype: activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- + # Introduction to VAMT + The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office®, and select other Microsoft products volume and retail activation process. VAMT can manage volume activation using Multiple Activation Keys (MAKs) or the Windows Key Management Service (KMS). VAMT is a standard Microsoft Management Console (MMC) snap-in and can be installed on any computer that has one of the following Windows operating systems: Windows® 7, Windows 8, Windows 8.1, Windows 10,Windows Server 2008 R2, or Windows Server 2012. + **Note**   VAMT can be installed on, and can manage, physical or virtual instances. VAMT cannot detect whether or not the remote products are virtual. As long as the products can respond to Windows Management Instrumentation (WMI) calls, they will be discovered and activated. + ## In this Topic - [Managing Multiple Activation Key (MAK) and Retail Activation](#bkmk-managingmak) - [Managing Key Management Service (KMS) Activation](#bkmk-managingkms) - [Enterprise Environment](#bkmk-enterpriseenvironment) - [VAMT User Interface](#bkmk-userinterface) + ## Managing Multiple Activation Key (MAK) and Retail Activation + You can use a MAK or a retail product key to activate Windows, Windows Server, or Office on an individual computer or a group of computers. VAMT enables two different activation scenarios: - **Online activation.** Many enterprises maintain a single Windows system image or Office installation package for deployment across the enterprise. Occasionally there is also a need to use retail product keys in special situations. Online activation enables you to activate over the Internet any products installed with MAK, KMS host, or retail product keys on one or more connected computers within a network. This process requires that each product communicate activation information directly to Microsoft. - **Proxy activation.** This activation method enables you to perform volume activation for products installed on client computers that do not have Internet access. The VAMT host computer distributes a MAK, KMS Host key (CSVLK), or retail product key to one or more client products and collects the installation ID (IID) from each client product. The VAMT host sends the IIDs to Microsoft on behalf of the client products and obtains the corresponding Confirmation IDs (CIDs). The VAMT host then installs the CIDs on the client products to complete the activation. Using this method, only the VAMT host computer needs Internet access. You can also activate products installed on computers in a workgroup that is completely isolated from any larger network, by installing a second instance of VAMT on a computer within the workgroup. Then, use removable media to transfer activation data between this new instance of VAMT and the Internet-connected VAMT host. + ## Managing Key Management Service (KMS) Activation + In addition to MAK or retail activation, you can use VAMT to perform volume activation using the Key Management Service (KMS). VAMT can install and activate GVLK (KMS client) keys on client products. GVLKs are the default product keys used by Volume License editions of Windows Vista, Windows 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, and Windows Server 2012 as well as Microsoft Office 2010. VAMT treats a KMS Host key (CSVLK) product key identically to a retail-type product key; therefore, the experience for product key entry and activation management are identical for both these product key types. + ## Enterprise Environment + VAMT is commonly implemented in enterprise environments. The following illustrates three common environments—Core Network, Secure Zone, and Isolated Lab. + ![VAMT in the enterprise](images/dep-win8-l-vamt-image001-enterprise.jpg) + In the Core Network environment, all computers are within a common network managed by Active Directory® Domain Services (AD DS). The Secure Zone represents higher-security Core Network computers that have additional firewall protection. The Isolated Lab environment is a workgroup that is physically separate from the Core Network, and its computers do not have Internet access. The network security policy states that no information that could identify a specific computer or user may be transferred out of the Isolated Lab. + ## VAMT User Interface + The following screenshot shows the VAMT graphical user interface. + ![VAMT user interface](images/vamtuserinterfaceupdated.jpg) + VAMT provides a single, graphical user interface for managing activations, and for performing other activation-related tasks such as: - **Adding and removing computers.** You can use VAMT to discover computers in the local environment. VAMT can discover computers by querying AD DS, workgroups, by individual computer name or IP address, or via a general LDAP query. - **Discovering products.** You can use VAMT to discover Windows, Windows Server, Office, and select other products installed on the client computers. - **Monitoring activation status.** You can collect activation information about each product, including the last 5 characters of the product key being used, the current license state (such as Licensed, Grace, Unlicensed), and the product edition information. - **Managing product keys.** You can store multiple product keys and use VAMT to install these keys to remote client products. You can also determine the number of activations remaining for MAKs. - **Managing activation data.** VAMT stores activation data in a SQL database. VAMT can export this data to other VAMT hosts or to an archive in XML format. + ## Related topics - [VAMT Step-by-Step Scenarios](vamt-step-by-step.md)   diff --git a/windows/deploy/key-features-in-mdt-2013.md b/windows/deploy/key-features-in-mdt-2013.md index 99af37a336..7982bb6d03 100644 --- a/windows/deploy/key-features-in-mdt-2013.md +++ b/windows/deploy/key-features-in-mdt-2013.md @@ -2,17 +2,21 @@ title: Key features in MDT 2013 Update 2 (Windows 10) description: The Microsoft Deployment Toolkit (MDT) has been in existence since 2003, when it was first introduced as Business Desktop Deployment (BDD) 1.0. ms.assetid: 858e384f-e9db-4a93-9a8b-101a503e4868 -ms.pagetype: mdt -keywords: ["deploy, feature, tools, upgrade, migrate, provisioning"] +keywords: deploy, feature, tools, upgrade, migrate, provisioning ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: mdt author: mtniehaus --- + # Key features in MDT 2013 Update 2 + **Applies to** - Windows 10 + The Microsoft Deployment Toolkit (MDT) has been in existence since 2003, when it was first introduced as Business Desktop Deployment (BDD) 1.0. The toolkit has evolved, both in functionality and popularity, and today it is considered fundamental to Windows operating system and enterprise application deployment. + MDT 2013 has many useful features, the most important of which are: - **Windows Client support.** Supports Windows 7, Windows 8, Windows 8.1, and Windows 10. - **Windows Server support.** Supports Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2. @@ -20,8 +24,11 @@ MDT 2013 has many useful features, the most important of which are: - **UEFI support.** Supports deployment to machines using Unified Extensible Firmware Interface (UEFI) version 2.3.1. - **GPT support.** Supports deployment to machines that require the new GUID (globally unique identifier) partition table (GPT) format. This is related to UEFI. - **Enhanced Windows PowerShell support.** Provides support for running PowerShell scripts. + ![figure 2](images/mdt-05-fig02.png) + Figure 2. The deployment share mounted as a standard PSDrive allows for administration using PowerShell. + - **Add local administrator accounts.** Allows you to add multiple user accounts to the local Administrators group on the target computers, either via settings or the deployment wizard. - **Automated participation in CEIP and WER.** Provides configuration for participation in Windows Customer Experience Improvement Program (CEIP) and Windows Error Reporting (WER). - **Deploy Windows RE.** Enables deployment of a customized Windows Recovery Environment (Windows RE) as part of the task sequence. @@ -32,8 +39,11 @@ MDT 2013 has many useful features, the most important of which are: - **Partitioning routines.** Provides improved partitioning routines to ensure that deployments work regardless of the current hard drive structure. - **Offline BitLocker.** Provides the capability to have BitLocker enabled during the Windows Preinstallation Environment (Windows PE) phase, thus saving hours of encryption time. - **USMT offline user-state migration.** Provides support for running the User State Migration Tool (USMT) capture offline, during the Windows PE phase of the deployment. + ![figure 3](images/mdt-05-fig03.png) + Figure 3. The offline USMT backup in action. + - **Install or uninstall Windows roles or features.** Enables you to select roles and features as part of the deployment wizard. MDT also supports uninstall of roles and features. - **Microsoft System Center 2012 Orchestrator integration.** Provides the capability to use Orchestrator runbooks as part of the task sequence. - **Support for DaRT.** Supports optional integration of the DaRT components into the boot image. @@ -41,8 +51,11 @@ MDT 2013 has many useful features, the most important of which are: - **Support for Modern UI app package provisioning.** Provisions applications based on the new Windows app package standard, which is used in Windows 8 and later. - **Extensibility.** Provides the capability to extend MDT far beyond the built-in features by adding custom scripts, web services, System Center Orchestrator runbooks, PowerShell scripts, and VBScripts. - **Upgrade task sequence.** Provides a new upgrade task sequence template that you can use to upgrade existing Windows 7, Windows 8, and Windows 8.1 systems directly to Windows 10, automatically preserving all data, settings, applications, and drivers. For more information about using this new upgrade task sequence, refer to the [Microsoft Deployment Toolkit resource page](http://go.microsoft.com/fwlink/p/?LinkId=618117). + ## Related topics + [Prepare for deployment with MDT 2013 Update 2](prepare-for-windows-deployment-with-mdt-2013.md) + [MDT 2013 Update 2 Lite Touch components](mdt-2013-lite-touch-components.md)     diff --git a/windows/deploy/kms-activation-vamt.md b/windows/deploy/kms-activation-vamt.md index 52a39f8fb3..4cd554a80b 100644 --- a/windows/deploy/kms-activation-vamt.md +++ b/windows/deploy/kms-activation-vamt.md @@ -2,22 +2,28 @@ title: Perform KMS Activation (Windows 10) description: Perform KMS Activation ms.assetid: 5a3ae8e6-083e-4153-837e-ab0a225c1d10 -ms.pagetype: activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- + # Perform KMS Activation + The Volume Activation Management Tool (VAMT) can be used to perform volume activation using the Key Management Service (KMS). You can use VAMT to activate Generic Volume Licensing Keys, or KMS client keys, on products accessible to VAMT. GVLKs are the default product keys used by the volume-license editions of Windows Vista, Windows 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server® 2012, and Microsoft Office 2010. GVLKs are already installed in volume-license editions of these products. + ## Requirements + Before configuring KMS activation, ensure that your network and VAMT installation meet the following requirements: - KMS host is set up and enabled. - KMS clients can access the KMS host. - VAMT is installed on a central computer with network access to all client computers. - The products to be activated have been added to VAMT. For more information on adding product keys, see [Install a KMS Client Key](install-kms-client-key-vamt.md). - VAMT has administrative permissions on all computers to be activated, and Windows Management Instrumentation (WMI) is accessible through the Windows Firewall. For more information, see [Configure Client Computers](configure-client-computers-vamt.md). + ## To configure devices for KMS activation + **To configure devices for KMS activation** 1. Open VAMT. 2. If necessary, set up the KMS activation preferences. If you don’t need to set up the preferences, skip to step 6 in this procedure. Otherwise, continue to step 2. @@ -35,5 +41,4 @@ Before configuring KMS activation, ensure that your network and VAMT installatio 9. Click a credential option. Choose **Alternate credentials** only if you are activating products that require administrator credentials different from the ones you are currently using. 10. If you are supplying alternate credentials, at the prompt, type the appropriate user name and password and click **OK**. VAMT displays the **Volume Activation** dialog box until it completes the requested action. When the process is finished, the updated activation status of each product appears in the product list view in the center pane. -  -  +  \ No newline at end of file diff --git a/windows/deploy/local-reactivation-vamt.md b/windows/deploy/local-reactivation-vamt.md index 2e8e565d43..2cd36eb80b 100644 --- a/windows/deploy/local-reactivation-vamt.md +++ b/windows/deploy/local-reactivation-vamt.md @@ -2,18 +2,23 @@ title: Perform Local Reactivation (Windows 10) description: Perform Local Reactivation ms.assetid: aacd5ded-da11-4d27-a866-3f57332f5dec -ms.pagetype: activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- + # Perform Local Reactivation + If you reinstall Windows® or Microsoft® Office 2010 on a computer that was initially activated using proxy activation (MAK, retail, or CSLVK (KMS host)), and have not made significant changes to the hardware, use this local reactivation procedure to reactivate the program on that computer. Local reactivation relies upon data that was created during the initial proxy activation and stored in the Volume Activation Management Tool (VAMT) database. The database contains the installation ID (IID) and confirmation ID (Pending CID). Local reactivation uses this data to reapply the CID and reactivate those products. Reapplying the same CID conserves the remaining activations on the key. + **Note**   During the initial proxy activation, the CID is bound to a digital “fingerprint”, which is calculated from values assigned to several different hardware components in the computer. If the computer has had significant hardware changes, this fingerprint will no longer match the CID. In this case, you must obtain a new CID for the computer from Microsoft. + ## To Perform a Local Reactivation + **To perform a local reactivation** 1. Open VAMT. Make sure that you are connected to the desired database. 2. In the left-side pane, click the product you want to reactivate to display the products list. @@ -27,8 +32,11 @@ During the initial proxy activation, the CID is bound to a digital “fingerprin 8. If you are supplying alternate credentials, in the **Windows Security** dialog box type the appropriate user name and password and click **OK**. VAMT displays the **Apply Confirmation ID** dialog box. + 10. If you are using a different product key than the product key used for initial activation, you must complete a new activation to obtain a new CID. 11. If you are activating a product that requires administrator credentials different from the ones you are currently using, select the **Use Alternate Credentials** check box. 12. Click **OK**. + ## Related topics + - [Manage Activations](manage-activations-vamt.md) diff --git a/windows/deploy/manage-activations-vamt.md b/windows/deploy/manage-activations-vamt.md index d8e0d455be..1f15048dea 100644 --- a/windows/deploy/manage-activations-vamt.md +++ b/windows/deploy/manage-activations-vamt.md @@ -2,15 +2,19 @@ title: Manage Activations (Windows 10) description: Manage Activations ms.assetid: 53bad9ed-9430-4f64-a8de-80613870862c -ms.pagetype: activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- + # Manage Activations + This section describes how to activate a client computer, by using a variety of activation methods. + ## In this Section + |Topic |Description | |------|------------| |[Perform Online Activation](online-activation-vamt.md) |Describes how to activate a client computer over the Internet. | diff --git a/windows/deploy/manage-product-keys-vamt.md b/windows/deploy/manage-product-keys-vamt.md index 96ae3f33dc..fffe5de77e 100644 --- a/windows/deploy/manage-product-keys-vamt.md +++ b/windows/deploy/manage-product-keys-vamt.md @@ -2,15 +2,18 @@ title: Manage Product Keys (Windows 10) description: Manage Product Keys ms.assetid: 4c6c4216-b4b7-437c-904e-4cb257f913cd -ms.pagetype: activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- + # Manage Product Keys + This section describes how to add and remove a product key from the Volume Activation Management Tool (VAMT). After you add a product key to VAMT, you can install that product key on a product or products you select in the VAMT database. ## In this Section + |Topic |Description | |------|------------| |[Add and Remove a Product Key](add-remove-product-key-vamt.md) |Describes how to add a product key to the VAMT database. | diff --git a/windows/deploy/manage-vamt-data.md b/windows/deploy/manage-vamt-data.md index bfaf368e22..adbd4c4ec6 100644 --- a/windows/deploy/manage-vamt-data.md +++ b/windows/deploy/manage-vamt-data.md @@ -2,14 +2,17 @@ title: Manage VAMT Data (Windows 10) description: Manage VAMT Data ms.assetid: 233eefa4-3125-4965-a12d-297a67079dc4 -ms.pagetype: activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- + # Manage VAMT Data + This section describes how to save, import, export, and merge a Computer Information List (CILX) file using the Volume Activation Management Tool (VAMT). + ## In this Section |Topic |Description | |------|------------| diff --git a/windows/deploy/mdt-2013-lite-touch-components.md b/windows/deploy/mdt-2013-lite-touch-components.md index ee08295c76..6766bdc104 100644 --- a/windows/deploy/mdt-2013-lite-touch-components.md +++ b/windows/deploy/mdt-2013-lite-touch-components.md @@ -2,52 +2,80 @@ title: MDT 2013 Update 2 Lite Touch components (Windows 10) description: This topic provides an overview of the features in the Microsoft Deployment Toolkit (MDT) 2013 Update 2 that support Lite Touch Installation (LTI) for Windows 10. ms.assetid: 7d6fc159-e338-439e-a2e6-1778d0da9089 -ms.pagetype: mdt -keywords: ["deploy, install, deployment, boot, log, monitor"] +keywords: deploy, install, deployment, boot, log, monitor ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: mdt author: mtniehaus --- + # MDT 2013 Update 2 Lite Touch components + **Applies to** - Windows 10 + This topic provides an overview of the features in the Microsoft Deployment Toolkit (MDT) 2013 Update 2 that support Lite Touch Installation (LTI) for Windows 10. An LTI deployment strategy requires very little infrastructure or user interaction, and can be used to deploy an operating system from a network share or from a physical media, such as a USB flash drive or disc. When deploying the Windows operating system using MDT, most of the administration and configuration is done through the Deployment Workbench, but you also can perform many of the tasks using Windows PowerShell. The easiest way to find out how to use PowerShell in MDT is to use the Deployment Workbench to perform an operation and at the end of that task, click View Script. That will give you the PowerShell command. + ![figure 4](images/mdt-05-fig04.png) + Figure 4. If you click **View Script** on the right side, you will get the PowerShell code that was used to perform the task. + ## Deployment shares + A deployment share is essentially a folder on the server that is shared and contains all the setup files and scripts needed for the deployment solution. It also holds the configuration files (called rules) that are gathered when a machine is deployed. These configuration files can reach out to other sources, like a database, external script, or web server to get additional settings for the deployment. For Lite Touch deployments, it is common to have two deployment shares: one for creating the reference images and one for deployment. For Zero Touch, it is common to have only the deployment share for creating reference images because Microsoft System Center 2012 R2 Configuration Manager deploys the image in the production environment. + ## Rules + The rules (CustomSettings.ini and Bootstrap.ini) make up the brain of MDT. The rules control the Windows Deployment Wizard on the client and, for example, can provide the following settings to the machine being deployed: - Computer name - Domain to join, and organizational unit (OU) in Active Directory to hold the computer object - Whether to enable BitLocker - Regional settings You can manage hundreds of settings in the rules. For more information, see the [Microsoft Deployment Toolkit resource center](http://go.microsoft.com/fwlink/p/?LinkId=618117). + ![figure 5](images/mdt-05-fig05.png) + Figure 5. Example of a MDT rule. In this example, the new computer name is being calculated based on PC- plus the first seven (Left) characters from the serial number + ## Boot images -Boot images are the Windows Preinstallation Environment (Windows PE) images that are used to start the deployment. They can be started from a CD or DVD, an ISO file, a USB device, or over the network using a Pre-Boot Execution Environment (PXE) server. The boot images connect to the deployment share on the server and start the deployment. + +Boot images are the Windows Preinstallation Environment (Windows PE) images that are used to start the deployment. They can be started from a CD or DVD, an ISO file, a USB device, or over the network using a Pre-Boot Execution Environment (PXE) server. The boot images connect to the deployment +share on the server and start the deployment. + ## Operating systems + Using the Deployment Workbench, you import the operating systems you want to deploy. You can import either the full source (like the full Windows 10 DVD/ISO) or a custom image that you have created. The full-source operating systems are primarily used to create reference images; however, they also can be used for normal deployments. + ## Applications + Using the Deployment Workbench, you also add the applications you want to deploy. MDT supports virtually every executable Windows file type. The file can be a standard .exe file with command-line switches for an unattended install, a Microsoft Windows Installer (MSI) package, a batch file, or a VBScript. In fact, it can be just about anything that can be executed unattended. MDT also supports the new Universal Windows apps. + ## Driver repository + You also use the Deployment Workbench to import the drivers your hardware needs into a driver repository that lives on the server, not in the image. + ## Packages + With the Deployment Workbench, you can add any Microsoft packages that you want to use. The most commonly added packages are language packs, and the Deployment Workbench Packages node works well for those. You also can add security and other updates this way. However, we generally recommend that you use Windows Server Update Services (WSUS) for operating system updates. The rare exceptions are critical hotfixes that are not available via WSUS, packages for the boot image, or any other package that needs to be deployed before the WSUS update process starts. + ## Task sequences + Task sequences are the heart and soul of the deployment solution. When creating a task sequence, you need to select a template. The templates are located in the Templates folder in the MDT installation directory, and they determine which default actions are present in the sequence. + You can think of a task sequence as a list of actions that need to be executed in a certain order. Each action can also have conditions. Some examples of actions are as follows: - **Gather.** Reads configuration settings from the deployment server. - **Format and Partition.** Creates the partition(s) and formats them. - **Inject Drivers.** Finds out which drivers the machine needs and downloads them from the central driver repository. - **Apply Operating System.** Uses ImageX to apply the image. - **Windows Update.** Connects to a WSUS server and updates the machine. + ## Task sequence templates + MDT comes with nine default task sequence templates. You can also create your own templates. As long as you store them in the Templates folder, they will be available when you create a new task sequence. - **Sysprep and Capture task sequence.** Used to run the System Preparation (Sysprep) tool and capture an image of a reference computer. + **Note**   It is preferable to use a complete build and capture instead of the Sysprep and Capture task sequence. A complete build and capture can be automated, whereas Sysprep and Capture cannot.   @@ -60,22 +88,31 @@ MDT comes with nine default task sequence templates. You can also create your ow - **Deploy to VHD Client task sequence.** Similar to the Standard Client task sequence template but also creates a virtual hard disk (VHD) file on the target computer and deploys the image to the VHD file. - **Deploy to VHD Server task sequence.** Same as the Deploy to VHD Client task sequence but for servers. - **Standard Client Upgrade task sequence.** A simple task sequence template used to perform an in-place upgrade from Windows 7, Windows 8, or Windows 8.1 directly to Windows 10, automatically preserving existing data, settings, applications, and drivers. + ## Selection profiles + Selection profiles, which are available in the Advanced Configuration node, provide a way to filter content in the Deployment Workbench. Selection profiles are used for several purposes in the Deployment Workbench and in Lite Touch deployments. For example, they can be used to: - Control which drivers and packages are injected into the Lite Touch (and generic) boot images. - Control which drivers are injected during the task sequence. - Control what is included in any media that you create. - Control what is replicated to other deployment shares. - Filter which task sequences and applications are displayed in the Deployment Wizard. + ## Logging + MDT uses many log files during operating system deployments. By default the logs are client side, but by configuring the deployment settings, you can have MDT store them on the server, as well. + **Note**   The easiest way to view log files is to use Configuration Manager Trace (CMTrace), which is included in the [System Center 2012 R2 Configuration Manager Toolkit](http://go.microsoft.com/fwlink/p/?LinkId=734717).   ## Monitoring + On the deployment share, you also can enable monitoring. After you enable monitoring, you will see all running deployments in the Monitor node in the Deployment Workbench. + ## Related topics + [Key features in MDT 2013 Update 2](key-features-in-mdt-2013.md) + [Prepare for deployment with MDT 2013 Update 2](prepare-for-windows-deployment-with-mdt-2013.md)     diff --git a/windows/deploy/monitor-activation-client.md b/windows/deploy/monitor-activation-client.md index 9c56db69b6..5a3050cb0b 100644 --- a/windows/deploy/monitor-activation-client.md +++ b/windows/deploy/monitor-activation-client.md @@ -1,15 +1,17 @@ --- title: Monitor activation (Windows 10) ms.assetid: 264a3e86-c880-4be4-8828-bf4c839dfa26 -ms.pagetype: activation description: -keywords: ["vamt", "volume activation", "activation", "windows activation"] +keywords: vamt, volume activation, activation, windows activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: CFaw --- + # Monitor activation + **Applies to** - Windows 10 - Windows 8.1 @@ -18,8 +20,11 @@ author: CFaw - Windows Server 2012 R2 - Windows Server 2012 - Windows Server 2008 R2 + **Looking for retail activation?** + - [Get Help Activating Microsoft Windows](http://go.microsoft.com/fwlink/p/?LinkId=618644) + You can monitor the success of the activation process for a computer running Windows 8.1 in several ways. The most popular methods include: - Using the Volume Licensing Service Center website to track use of MAK keys. - Using the **Slmgr /dlv** command on a client computer or on the KMS host. (For a full list of options, see [Slmgr.vbs Options](http://technet.microsoft.com/library/ff793433.aspx).) @@ -27,7 +32,9 @@ You can monitor the success of the activation process for a computer running Win - Most licensing actions and events are recorded in the Event log. - Microsoft System Center Operations Manager and the KMS Management Pack can provide insight and information to users of System Center Operations Manager. - The VAMT provides a single site from which to manage and monitor volume activations. This is explained in the next section. + ## See also + - [Volume Activation for Windows 10](volume-activation-windows-10.md)     diff --git a/windows/deploy/online-activation-vamt.md b/windows/deploy/online-activation-vamt.md index 7b811c3586..5f537d3e20 100644 --- a/windows/deploy/online-activation-vamt.md +++ b/windows/deploy/online-activation-vamt.md @@ -2,22 +2,30 @@ title: Perform Online Activation (Windows 10) description: Perform Online Activation ms.assetid: 8381792b-a454-4e66-9b4c-e6e4c9303823 -ms.pagetype: activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- + # Perform Online Activation + You can use the Volume Activation Management Tool (VAMT) to enable client products to be activated over the Internet. You can install the client products with any kind of product key that is eligible for online activation—Multiple Activation Key (MAK), retail, and Windows Key Management Services (KMS) host key. + ## Requirements + Before performing online activation, ensure that the network and the VAMT installation meet the following requirements: - VAMT is installed on a central computer that has network access to all client computers. - Both the VAMT host and client computers have Internet access. - The products that you want to activate are added to VAMT. - VAMT has administrative permissions on all computers that you intend to activate, and that Windows Management Instrumentation (WMI) can be accessed through the Windows firewall. For more information, see [Configure Client Computers](configure-client-computers-vamt.md). -The product keys that are installed on the client products must have a sufficient number of remaining activations. If you are activating a MAK key, you can retrieve the remaining number of activations for that key by selecting the MAK in the product key list in the center pane and then clicking **Refresh product key data online** in the right-side pane. This retrieves the number of remaining activations for the MAK from Microsoft. Note that this step requires Internet access and that the remaining activation count can only be retrieved for MAKs. + +The product keys that are installed on the client products must have a sufficient number of remaining activations. If you are activating a MAK key, you can retrieve the remaining number of activations for that key by selecting the MAK in the product key list in the center pane and then clicking +**Refresh product key data online** in the right-side pane. This retrieves the number of remaining activations for the MAK from Microsoft. Note that this step requires Internet access and that the remaining activation count can only be retrieved for MAKs. + ## To Perform an Online Activation + **To perform an online activation** 1. Open VAMT. 2. In the products list view in the center pane, sort the list if necessary. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. @@ -29,11 +37,14 @@ The product keys that are installed on the client products must have a sufficien 6. Click **Activate** in the **Selected Items** menu in the right-side **Actions** pane and then point to **Activate**. If the **Actions** pane is not displayed, click the Show/Hide Action Pane button, which is located on the toolbar to the right of the Help button. 7. Point to **Online activate**, and then select the appropriate credential option. If you click the **Alternate Credentials** option, you will be prompted to enter an alternate user name and password. 8. VAMT displays the **Activating products** dialog box until it completes the requested action. When activation is complete, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. + The same status is shown under the **Status of Last Action** column in the products list view in the center pane. + **Note**   Online activation does not enable you to save the Confirmation IDs (CIDs). As a result, you cannot perform local reactivation. **Note** You can use online activation to select products that have different key types and activate the products at the same time. + ## Related topics - [Manage Activations](manage-activations-vamt.md) diff --git a/windows/deploy/plan-for-volume-activation-client.md b/windows/deploy/plan-for-volume-activation-client.md index 13b12cd83f..3247677c72 100644 --- a/windows/deploy/plan-for-volume-activation-client.md +++ b/windows/deploy/plan-for-volume-activation-client.md @@ -2,14 +2,16 @@ title: Plan for volume activation (Windows 10) description: Product activation is the process of validating software with the manufacturer after it has been installed on a specific computer. ms.assetid: f84b005b-c362-4a70-a84e-4287c0d2e4ca -ms.pagetype: activation -keywords: ["vamt", "volume activation", "activation", "windows activation"] +keywords: vamt, volume activation, activation, windows activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- + # Plan for volume activation + **Applies to** - Windows 10 - Windows 8.1 @@ -18,87 +20,147 @@ author: jdeckerMS - Windows Server 2012 R2 - Windows Server 2012 - Windows Server 2008 R2 + **Looking for retail activation?** + - [Get Help Activating Microsoft Windows](http://go.microsoft.com/fwlink/p/?LinkId=618644) + *Product activation* is the process of validating software with the manufacturer after it has been installed on a specific computer. Activation confirms that the product is genuine—not a fraudulent copy—and that the product key or serial number is valid and has not been compromised or revoked. Activation also establishes a link or relationship between the product key and the particular installation. + During the activation process, information about the specific installation is examined. In the case of online activations, this information is sent to a server at Microsoft. This information may include the software version, the product key, the IP address of the computer, and information about the device. The activation methods that Microsoft uses are designed to help protect user privacy, and they cannot be used to track back to the computer or user. The gathered data confirms that the software is a legally licensed copy, and this data is used for statistical analysis. Microsoft does not use this information to identify or contact the user or the organization. + **Note**   The IP address is used only to verify the location of the request, because some editions of Windows (such as “Starter” editions) can only be activated within certain geographical target markets. + ## Distribution channels and activation + In general, Microsoft software is obtained through three main channels: retail, original equipment manufacturer (OEM), and volume licensing agreements. Different activations methods are available through each channel. Because organizations are free to obtain software through multiple channels (for example, buying some at retail and others through a volume licensing program) most organizations choose to use a combination of activation methods. + ### Retail activations + The retail activation method has not changed in several versions of Windows and Windows Server. Each purchased copy comes with one unique product key (often referred to as a retail key). The user enters this key during product installation. The computer uses this retail key to complete the activation after the installation is complete. Most activations are performed online, but telephone activation is also available. Recently, retail keys have been expanded into new distribution scenarios. Product key cards are available to activate products that have been preinstalled or downloaded. Programs such as Windows Anytime Upgrade and Get Genuine allow users to acquire legal keys separately from the software. These electronically distributed keys may come with media that contains software, they can come as a software shipment, or they may be provided on a printed card or electronic copy. Products are activated the same way with any of these retail keys. + ### Original equipment manufacturer + Most original equipment manufacturers (OEMs) sell systems that include a standard build of the Windows operating system. The hardware vendor activates Windows by associating the operating system with the firmware (BIOS) of the computer. This occurs before the computer is sent to the customer, and no additional actions are required. OEM activation is valid as long as the customer uses the OEM-provided image on the system. OEM activation is available only for computers that are purchased through OEM channels and have the Windows operating system preinstalled. + ### Volume licensing + Volume licensing offers customized programs that are tailored to the size and purchasing preference of the organization. To become a volume licensing customer, the organization must set up a volume licensing agreement with Microsoft.There is a common misunderstanding about acquiring licenses for a new computer through volume licensing. There are two legal ways to acquire a full Windows client license for a new computer: - Have the license preinstalled through the OEM. - Purchase a fully packaged retail product. + The licenses that are provided through volume licensing programs such as Open License, Select License, and Enterprise Agreements cover upgrades to Windows client operating systems only. An existing retail or OEM operating system license is needed for each computer running Windows 10, Windows 8.1 Pro, Windows 8 Pro, Windows 7 Professional or Ultimate, or Windows XP Professional before the upgrade rights obtained through volume licensing can be exercised. Volume licensing is also available through certain subscription or membership programs, such as the Microsoft Partner Network and MSDN. These volume licenses may contain specific restrictions or other changes to the general terms applicable to volume licensing. + **Note**   Some editions of the operating system, such as Windows 10 Enterprise, and some editions of application software are available only through volume licensing agreements or subscriptions. + ## Activation models + For a user or IT department, there are no significant choices about how to activate products that are acquired through retail or OEM channels. The OEM performs the activation at the factory, and the user or the IT department need take no activation steps. + With a retail product, the Volume Activation Management Tool (VAMT), which is discussed later in this guide, helps you track and manage keys. For each retail activation, you can choose: - Online activation - Telephone activation - VAMT proxy activation + Telephone activation is primarily used in situations where a computer is isolated from all networks. VAMT proxy activation (with retail keys) is sometimes used when an IT department wants to centralize retail activations or when a computer with a retail version of the operating system is isolated from the Internet but connected to the LAN. For volume-licensed products, however, you must determine the best method or combination of methods to use in your environment. For Windows 10 Pro and Enterprise, you can choose from three models: - MAKs - KMS - Active Directory-based activation + **Note**   A specialized method, Token-based activation, is available for specific situations when approved customers rely on a public key infrastructure in a completely isolated, and usually high-security, environment. For more information, contact your Microsoft Account Team or your service representative. + ### Multiple activation key -A Multiple Activation Key (MAK) is commonly used in small- or mid-sized organizations that have a volume licensing agreement, but they do not meet the requirements to operate a KMS or they prefer a simpler approach. A MAK also allows permanent activation of computers that are isolated from the KMS or are part of an isolated network that does not have enough computers to use the KMS. + +A Multiple Activation Key (MAK) is commonly used in small- or mid-sized organizations that have a volume licensing agreement, but they do not meet the requirements to operate a KMS or they prefer a simpler approach. A MAK also +allows permanent activation of computers that are isolated from the KMS or are part of an isolated network that does not have enough computers to use the KMS. + To use a MAK, the computers to be activated must have a MAK installed. The MAK is used for one-time activation with the Microsoft online hosted activation services, by telephone, or by using VAMT proxy activation. In the simplest terms, a MAK acts like a retail key, except that a MAK is valid for activating multiple computers. Each MAK can be used a specific number of times. The VAMT can assist in tracking the number of activations that have been performed with each key and how many remain. + Organizations can download MAK and KMS keys from the [Volume Licensing Service Center](http://go.microsoft.com/fwlink/p/?LinkId=618213) website. Each MAK has a preset number of activations, which are based on a percentage of the count of licenses the organization purchases; however, you can increase the number of activations that are available with your MAK by calling Microsoft. + ### Key Management Service + With the Key Management Service (KMS), IT pros can complete activations on their local network, eliminating the need for individual computers to connect to Microsoft for product activation. The KMS is a lightweight service that does not require a dedicated system and can easily be cohosted on a system that provides other services. + Volume editions of Windows 10 and Windows Server 2012 R2 (in addition to volume editions of operating system editions since Windows Vista and Windows Server 2008) automatically connect to a system that hosts the KMS to request activation. No action is required from the user. + The KMS requires a minimum number of computers (physical computers or virtual machines) in a network environment. The organization must have at least five computers to activate Windows Server 2012 R2 and at least 25 computers to activate client computers that are running Windows 10. These minimums are referred to as *activation thresholds*. + Planning to use the KMS includes selecting the best location for the KMS host and how many KMS hosts to have. One KMS host can handle a large number of activations, but organizations will often deploy two KMS hosts to ensure availability. Only rarely would more than two KMS hosts be used. The KMS can be hosted on a client computer or on a server, and it can be run on older versions of the operating system if proper configuration steps are taken. Setting up your KMS is discussed later in this guide. + ### Active Directory-based activation + Active Directory-based activation is the newest type of volume activation, and it was introduced in Windows 8. In many ways, Active Directory-based activation is similar to activation by using the KMS, but the activated computer does not need to maintain periodic connectivity with the KMS host. Instead, a domain-joined computer running Windows 10, Windows 8.1, Windows 8, Windows Server 2012 R2, or Windows Server 2012 R2 queries AD DS for a volume activation object that is stored in the domain. The operating system checks the digital signatures that are contained in the activation object, and then activates the device. + Active Directory-based activation allows enterprises to activate computers through a connection to their domain. Many companies have computers at remote or branch locations, where it is impractical to connect to a KMS, or would not reach the KMS activation threshold. Rather than use MAKs, Active Directory-based activation provides a way to activate computers running Windows 10, Windows 8.1, Windows 8, Windows Server 2012 R2, or Windows Server 2012 R2 as long as the computers can contact the company’s domain. Active Directory-based activation offers the advantage of extending volume activation services everywhere you already have a domain presence. + ## Network and connectivity + A modern business network has many nuances and interconnections. This section examines evaluating your network and the connections that are available to determine how volume activations will occur. + ### Core network + Your core network is that part of your network that enjoys stable, high-speed, reliable connectivity to infrastructure servers. In many cases, the core network is also connected to the Internet, although that is not a requirement to use the KMS or Active Directory-based activation after the KMS server or AD DS is configured and active. Your core network likely consists of many network segments. In many organizations, the core network makes up the vast majority of the business network. + In the core network, a centralized KMS solution is usually recommended. You can also use Active Directory-based activation, but in many organizations, KMS will still be required to activate older client computers and computers that are not joined to the domain. Some administrators prefer to run both solutions to have the most flexibility, while others prefer to choose only a KMS-based solution for simplicity. Active Directory-based activation as the only solution is workable if all of the clients in your organization are running Windows 10, Windows 8.1, or Windows 8. + A typical core network that includes a KMS host is shown in Figure 1. + ![Typical core network](images/volumeactivationforwindows81-01.jpg) + **Figure 1**. Typical core network + ### Isolated networks + In a large network, it is all but guaranteed that some segments will be isolated, either for security reasons or because of geography or connectivity issues. -**Isolated for security**

    + +**Isolated for security** + Sometimes called a *high-security zone*, a particular network segment may be isolated from the core network by a firewall or disconnected from other networks totally. The best solution for activating computers in an isolated network depends on the security policies in place in the organization. + If the isolated network can access the core network by using outbound requests on TCP port 1688, and it is allowed to receive remote procedure calls (RPCs), you can perform activation by using the KMS in the core network, thereby avoiding the need to reach additional activation thresholds. + If the isolated network participates fully in the corporate forest, and it can make typical connections to domain controllers, such as using Lightweight Directory Access Protocol (LDAP) for queries and Domain Name Service (DNS) for name resolution, this is a good opportunity to use Active Directory-based activation for Windows 10, Windows 8.1, Windows 8, Windows Server 2012 R2, and Windows Server 2012 R2. + If the isolated network cannot communicate with the core network’s KMS server, and it cannot use Active Directory-based activation, you can set up a KMS host in the isolated network. This configuration is shown in Figure 2. However, if the isolated network contains only a few computers, it will not reach the KMS activation threshold. In that case, you can activate by using MAKs. + If the network is fully isolated, MAK-independent activation would be the recommended choice, perhaps using the telephone option. But VAMT proxy activation may also be possible. You can also use MAKs to activate new computers during setup, before they are placed in the isolated network. + ![New KMS host in an isolated network](images/volumeactivationforwindows81-02.jpg) + **Figure 2**. New KMS host in an isolated network + **Branch offices and distant networks** From mining operations to ships at sea, organizations often have a few computers that are not easily connected to the core network or the Internet. Some organizations have network segments at branch offices that are large and well-connected internally, but have a slow or unreliable WAN link to the rest of the organization. In these situations, you have several options: - **Active Directory-based activation**. In any site where the client computers are running Windows 10, Active Directory-based activation is supported, and it can be activated by joining the domain. - **Local KMS**. If a site has 25 or more client computers, it can activate against a local KMS server. - **Remote (core) KMS**. If the remote site has connectivity to an existing KMS (perhaps through a virtual private network (VPN) to the core network), that KMS can be used. Using the existing KMS means that you only need to meet the activation threshold on that server. - **MAK activation**. If the site has only a few computers and no connectivity to an existing KMS host, MAK activation is the best option. + ### Disconnected computers + Some users may be in remote locations or may travel to many locations. This scenario is common for roaming clients, such as the computers that are used by salespeople or other users who are offsite but not at branch locations. This scenario can also apply to remote branch office locations that have no connection to the core network. You can consider this an “isolated network,” where the number of computers is one. Disconnected computers can use Active Directory-based activation, the KMS, or MAK depending on the client version and how often the computers connect to the core network. If the computer is joined to the domain and running Windows 10, Windows 8.1, Windows 8, Windows Server 2012 R2, or Windows Server 2012 R2 8, you can use Active Directory-based activation—directly or through a VPN—at least once every 180 days. If the computer connects to a network with a KMS host at least every 180 days, but it does not support Active Directory-based activation, you can use KMS activation. Otherwise for computers that rarely or never connect to the network, use MAK independent activation (by using the telephone or the Internet). + ### Test and development labs + Lab environments often have large numbers of virtual machines, and physical computers and virtual machines in labs are reconfigured frequently. Therefore, first determine whether the computers in test and development labs require activation. Editions of Windows 10 that include volume licensing will operate normally, even if they cannot activate immediately. If you have ensured that your test or development copies of the operating system are within the license agreement, you may not need to activate the lab computers if they will be rebuilt frequently. If you require that the lab computers be activated, treat the lab as an isolated network and use the methods described earlier in this guide. In labs that have a high turnover of computers and a small number of KMS clients, you must monitor the KMS activation count. You might need to adjust the time that the KMS caches the activation requests. The default is 30 days. + ## Mapping your network to activation methods + Now it’s time to assemble the pieces into a working solution. By evaluating your network connectivity, the numbers of computers you have at each site, and the operating system versions in use in your environment, you have collected the information you need to determine which activation methods will work best for you. You can fill-in information in Table 1 to help you make this determination. + **Table 1**. Criteria for activation methods + |Criterion |Activation method | |----------|------------------| |Number of domain-joined computers that support Active Directory-based activation (computers running Windows 10, Windows 8.1, Windows 8, Windows Server 2012 R2, or Windows Server 2012 R2) and will connect to a domain controller at least every 180 days. Computers can be mobile, semi-isolated, or located in a branch office or the core network. |Active Directory-based activation | @@ -110,25 +172,40 @@ Now it’s time to assemble the pieces into a working solution. By evaluating yo |Number of computers in test and development labs that will not be activated |None| |Number of computers that do not have a retail volume license |Retail (online or phone) | |Number of computers that do not have an OEM volume license |OEM (at factory) | -|Total number of computer activations

    Note
    This total should match the total number of licensed computers in your organization. | | +|Total number of computer activations

    Note
    This total should match the total number of licensed computers in your organization. | + ## Choosing and acquiring keys + When you know which keys you need, you must obtain them. Generally speaking, volume licensing keys are collected in two ways: - Go to the **Product Keys** section of the [Volume Licensing Service Center](http://go.microsoft.com/fwlink/p/?LinkID=618213) for the following agreements: Open, Open Value, Select, Enterprise, and Services Provider License. - Contact your [Microsoft Activation Center](http://go.microsoft.com/fwlink/p/?LinkId=618264). + ### KMS host keys + A KMS host needs a key that activates, or authenticates, the KMS host with Microsoft. This key is usually referred to as the *KMS host key*, but it is formally known as a *Microsoft Customer Support Volume License Key* (CSVLK). Most documentation and Internet references earlier than Windows 8.1 use the term KMS key, but CSVLK is becoming more common in current documentation and management tools. + A KMS host running Windows Server 2012 R2, Windows Server 2012, or Windows Server 2008 R2 can activate both Windows Server and Windows client operating systems. A KMS host key is also needed to create the activation objects in AD DS, as described later in this guide. You will need a KMS host key for any KMS that you want to set up and if you are going to use Active Directory-based activation. + ### Generic volume licensing keys + When you create installation media or images for client computers that will be activated by KMS or Active Directory-based activation, install a generic volume license key (GVLK) for the edition of Windows you are creating. GVLKs are also referred to as KMS client setup keys. + Installation media from Microsoft for Enterprise editions of the Windows operating system may already contain the GVLK. One GVLK is available for each type of installation. Note that the GLVK will not activate the software against Microsoft activation servers, only against a KMS or Active Directory-based activation object. In other words, the GVLK does not work unless a valid KMS host key can be found. GVLKs are the only product keys that do not need to be kept confidential. + Typically, you will not need to manually enter a GVLK unless a computer has been activated with a MAK or a retail key and it is being converted to a KMS activation or to Active Directory-based activation. If you need to locate the GVLK for a particular client edition, see [Appendix A: KMS Client Setup Keys](http://technet.microsoft.com/library/jj612867.aspx). + ### Multiple activation keys + You will also need MAK keys with the appropriate number of activations available. You can see how many times a MAK has been used on the Volume Licensing Service Center website or in the VAMT. + ## Selecting a KMS host + The KMS does not require a dedicated server. It can be cohosted with other services, such as AD DS domain controllers and read-only domain controllers. KMS hosts can run on physical computers or virtual machines that are running any supported Windows operating system. A KMS host that is running Windows Server 2012 R2, Windows Server 2012, or Windows Server 2008 R2 can activate any Windows client or server operating system that supports volume activation. A KMS host that is running Windows 10 can activate only computers running Windows 10, Windows 8.1, Windows 8, Windows 7, or Windows Vista. A single KMS host can support unlimited numbers of KMS clients, but Microsoft recommends deploying a minimum of two KMS hosts for failover purposes. However, as more clients are activated through Active Directory-based activation, the KMS and the redundancy of the KMS will become less important. Most organizations can use as few as two KMS hosts for their entire infrastructure. + The flow of KMS activation is shown in Figure 3, and it follows this sequence: + 1. An administrator uses the VAMT console to configure a KMS host and install a KMS host key. 2. Microsoft validates the KMS host key, and the KMS host starts to listen for requests. 3. The KMS host updates resource records in DNS to allow clients to locate the KMS host. (Manually adding DNS records is required if your environment does not support DNS dynamic update protocol.) @@ -137,8 +214,11 @@ The flow of KMS activation is shown in Figure 3, and it follows this sequence: 6. The KMS host records information about the requesting client (by using a client ID). Client IDs are used to maintain the count of clients and detect when the same computer is requesting activation again. The client ID is only used to determine whether the activation thresholds are met. The IDs are not stored permanently or transmitted to Microsoft. If the KMS is restarted, the client ID collection starts again. 7. If the KMS host has a KMS host key that matches the products in the GVLK, the KMS host sends a single packet back to the client. This packet contains a count of the number of computers that have requested activation from this KMS host. 8. If the count exceeds the activation threshold for the product that is being activated, the client is activated. If the activation threshold has not yet been met, the client will try again. + ![KMS activation flow](images/volumeactivationforwindows81-03.jpg) + **Figure 3**. KMS activation flow + ## See also - [Volume Activation for Windows 10](volume-activation-windows-10.md)   diff --git a/windows/deploy/prepare-for-windows-deployment-with-mdt-2013.md b/windows/deploy/prepare-for-windows-deployment-with-mdt-2013.md index 1546a57aa2..a7b98b2ab3 100644 --- a/windows/deploy/prepare-for-windows-deployment-with-mdt-2013.md +++ b/windows/deploy/prepare-for-windows-deployment-with-mdt-2013.md @@ -2,19 +2,25 @@ title: Prepare for deployment with MDT 2013 Update 2 (Windows 10) description: This topic will walk you through the steps necessary to create the server structure required to deploy the Windows 10 operating system using the Microsoft Deployment Toolkit (MDT) 2013 Update 2. ms.assetid: 5103c418-0c61-414b-b93c-a8e8207d1226 -ms.pagetype: mdt -keywords: ["deploy, system requirements"] +keywords: deploy, system requirements ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: mdt author: mtniehaus --- + # Prepare for deployment with MDT 2013 Update 2 + **Applies to** - Windows 10 + This topic will walk you through the steps necessary to create the server structure required to deploy the Windows 10 operating system using the Microsoft Deployment Toolkit (MDT) 2013 Update 2. It covers the installation of the necessary system prerequisites, the creation of shared folders and service accounts, and the configuration of security permissions in the files system and in Active Directory. + For the purposes of this topic, we will use two machines: DC01 and MDT01. DC01 is a domain controller and MDT01 is a Windows Server 2012 R2 standard server. MDT01 is a member of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md#proof). + ## System requirements + MDT 2013 Update 2 requires the following components: - Any of the following operating systems: - Windows 7 @@ -27,7 +33,9 @@ MDT 2013 Update 2 requires the following components: - Windows Assessment and Deployment Kit (ADK) for Windows 10 - Windows PowerShell - Microsoft .NET Framework + ## Install Windows ADK for Windows 10 + These steps assume that you have the MDT01 member server installed and configured and that you have downloaded [Windows ADK for Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=526803) to the E:\\Downloads\\ADK folder. 1. On MDT01, log on as Administrator in the CONTOSO domain using a password of **P@ssw0rd**. 2. Start the **ADK Setup** (E:\\Downloads\\ADK\\adksetup.exe), and on the first wizard page, click **Continue**. @@ -35,11 +43,16 @@ These steps assume that you have the MDT01 member server installed and configure 1. Deployment Tools 2. Windows Preinstallation Environment (Windows PE) 3. User State Migration Tool (UMST) + ## Install MDT 2013 Update 2 + These steps assume that you have downloaded [MDT 2013 Update 2](http://go.microsoft.com/fwlink/p/?LinkId=618117 ) to the E:\\Downloads\\MDT 2013 folder on MDT01. + 1. On MDT01, log on as Administrator in the CONTOSO domain using a password of **P@ssw0rd**. 2. Install **MDT** (E:\\Downloads\\MDT 2013\\MicrosoftDeploymentToolkit2013\_x64.msi) with the default settings. + ## Create the OU structure + If you do not have an organizational unit (OU) structure in your Active Directory, you should create one. In this section, you create an OU structure and a service account for MDT 2013 Update 2. 1. On DC01, using Active Directory User and Computers, in the contoso.com domain level, create a top-level OU named **Contoso**. 2. In the **Contoso** OU, create the following OUs: @@ -55,9 +68,13 @@ If you do not have an organizational unit (OU) structure in your Active Director 2. Workstations 5. In the **Contoso / Groups** OU, create the following OU: - Security Groups + ![figure 6](images/mdt-05-fig07.png) + Figure 6. A sample of how the OU structure will look after all the OUs are created. + ## Create the MDT service account + When creating a reference image, you need an account for MDT. The MDT Build Account is used for Windows Preinstallation Environment (Windows PE) to connect to MDT01. 1. On DC01, using Active Directory User and Computers, browse to **contoso.com / Contoso / Service Accounts**. 2. Select the **Service Accounts** OU and create the **MDT\_BA** account using the following settings: @@ -67,8 +84,11 @@ When creating a reference image, you need an account for MDT. The MDT Build Acco 4. User must change password at next logon: Clear 5. User cannot change password: Selected 6. Password never expires: Selected + ## Create and share the logs folder + By default MDT stores the log files locally on the client. In order to capture a reference image, you will need to enable server-side logging and, to do that, you will need to have a folder in which to store the logs. For more information, see [Create a Windows 10 reference image](create-a-windows-10-reference-image.md). + 1. On MDT01, log on as **CONTOSO\\Administrator**. 2. Create and share the **E:\\Logs** folder by running the following commands in an elevated Windows PowerShell prompt: ``` syntax @@ -76,16 +96,25 @@ By default MDT stores the log files locally on the client. In order to capture a New-SmbShare ?Name Logs$ ?Path E:\Logs -ChangeAccess EVERYONE icacls E:\Logs /grant '"MDT_BA":(OI)(CI)(M)' ``` + ![figure 7](images/mdt-05-fig08.png) + Figure 7. The Sharing tab of the E:\\Logs folder after sharing it with PowerShell. + ## Use CMTrace to read log files (optional) + The log files in MDT Lite Touch are formatted to be read by Configuration Manager Trace (CMTrace), which is available as part [of Microsoft System Center 2012 R2 Configuration Manager Toolkit](http://go.microsoft.com/fwlink/p/?LinkId=734717). You can use Notepad, but CMTrace formatting makes the logs easier to read. + ![figure 8](images/mdt-05-fig09.png) + Figure 8. An MDT log file opened in Notepad. + ![figure 9](images/mdt-05-fig10.png) + + Figure 9. The same log file, opened in CMTrace, is much easier to read. ## Related topics + [Key features in MDT 2013 Update 2](key-features-in-mdt-2013.md) + [MDT 2013 Update 2 Lite Touch components](mdt-2013-lite-touch-components.md) -  -  diff --git a/windows/deploy/proxy-activation-vamt.md b/windows/deploy/proxy-activation-vamt.md index cceba4c854..c848bcd8ab 100644 --- a/windows/deploy/proxy-activation-vamt.md +++ b/windows/deploy/proxy-activation-vamt.md @@ -2,26 +2,35 @@ title: Perform Proxy Activation (Windows 10) description: Perform Proxy Activation ms.assetid: 35a919ed-f1cc-4d10-9c88-9bd634549dc3 -ms.pagetype: activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- + # Perform Proxy Activation + You can use the Volume Activation Management Tool (VAMT) to perform activation for client computers that do not have Internet access. The client products can be installed with any type of product key that is eligible for proxy activation: Multiple activation Key (MAK), KMS Host key (CSVLK), or retail key. + In a typical proxy-activation scenario, the VAMT host computer distributes a MAK to one or more client computers and collects the installation ID (IID) from each computer. The VAMT host computer sends the IIDs to Microsoft on behalf of the client computers and obtains the corresponding Confirmation IDs (CIDs). The VAMT host computer then installs the CIDs on the client computer to complete the activation. Using this activation method, only the VAMT host computer needs Internet access. + **Note**   For workgroups that are completely isolated from any larger network, you can still perform MAK, KMS Host key (CSVLK), or retail proxy activation. This requires installing a second instance of VAMT on a computer within the isolated group and using removable media to transfer activation data between that computer and another VAMT host computer that has Internet access. For more information about this scenario, see [Scenario 2: Proxy Activation](scenario-proxy-activation-vamt.md). Similarly, you can proxy activate a KMS Host key (CSVLK) located in an isolated network. You can also proxy activate a KMS Host key (CSVLK) in the core network if you do not want the KMS host computer to connect to Microsoft over the Internet.  + ## Requirements + Before performing proxy activation, ensure that your network and the VAMT installation meet the following requirements: - There is an instance of VAMT that is installed on a computer that has Internet access. If you are performing proxy activation for an isolated workgroup, you also need to have VAMT installed on one of the computers in the workgroup. - The products to be activated have been added to VAMT and are installed with a retail product key, a KMS Host key (CSVLK) or a MAK. If the products have not been installed with a proper product key, refer to the steps in the [Add and Remove a Product Key](add-remove-product-key-vamt.md) section for instructions on how to install a product key. - VAMT has administrative permissions on all products to be activated and Windows Management Instrumentation (WMI) is accessible through the Windows firewall. - For workgroup computers, a registry key must be created to enable remote administrative actions under User Account Control (UAC). For more information, see [Configure Client Computers](configure-client-computers-vamt.md). The product keys that are installed on the client products must have a sufficient number of remaining activations. If you are activating a MAK key, you can retrieve the remaining number of activations for that key by selecting the MAK in the product key list in the center pane and then clicking **Refresh product key data online** in the right-side pane. This retrieves the number of remaining activations for the MAK from Microsoft. Note that this step requires Internet access and that the remaining activation count can only be retrieved for MAKs. + ## To Perform Proxy Activation + **To perform proxy activation** + 1. Open VAMT. 2. If necessary, install product keys. For more information see: - [Install a Product Key](install-product-key-vamt.md) to install retail, MAK, or KMS Host key (CSVLK). @@ -36,6 +45,7 @@ The product keys that are installed on the client products must have a sufficien 8. If you are activating products that require administrator credentials different from the ones you are currently using, select the **Use Alternate Credentials** checkbox. 9. Click **OK**. 10. VAMT displays the **Activating products** dialog box until it completes the requested action. If you selected the **Alternate Credentials** option, you will be prompted to enter the credentials. + **Note**   You can use proxy activation to select products that have different key types and activate the products at the same time.   diff --git a/windows/deploy/refresh-a-windows-7-computer-with-windows-10.md b/windows/deploy/refresh-a-windows-7-computer-with-windows-10.md index 2337742e1d..70dadf1711 100644 --- a/windows/deploy/refresh-a-windows-7-computer-with-windows-10.md +++ b/windows/deploy/refresh-a-windows-7-computer-with-windows-10.md @@ -2,21 +2,29 @@ title: Refresh a Windows 7 computer with Windows 10 (Windows 10) description: This topic will show you how to use MDT 2013 Update 2 Lite Touch Installation (LTI) to upgrade a Windows 7 computer to a Windows 10 computer using the computer refresh process. ms.assetid: 2866fb3c-4909-4c25-b083-6fc1f7869f6f -ms.pagetype: mdt -keywords: ["reinstallation, customize, template, script, restore"] +keywords: reinstallation, customize, template, script, restore ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: mdt author: mtniehaus --- + # Refresh a Windows 7 computer with Windows 10 + **Applies to** - Windows 10 + This topic will show you how to use MDT 2013 Update 2 Lite Touch Installation (LTI) to upgrade a Windows 7 computer to a Windows 10 computer using the computer refresh process. The refresh scenario, or computer refresh, is a reinstallation of an operating system on the same machine. You can refresh the machine to the same operating system as it is currently running, or to a later version. + For the purposes of this topic, we will use three machines: DC01, MDT01, and PC0001. DC01 is a domain controller and MDT01 is a Windows Server 2012 R2 Standard server. PC0001 is a machine with Windows 7 Service Pack 1 (SP1) that is going to be refreshed into a Windows 10 machine, with data and settings restored. MDT01 and PC0001 are members of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md#proof). + ![figure 1](images/mdt-04-fig01.png) + Figure 1. The machines used in this topic. + ## The computer refresh process + Even though a computer will appear, to the end user, to be upgraded, a computer refresh is not, technically, an in-place upgrade. A computer refresh also involves taking care of user data and settings from the old installation and making sure to restore those at the end of the installation. For a computer refresh with MDT, you use the User State Migration Tool (USMT), which is part of the Windows Assessment and Deployment Kit (ADK) for Windows 10, to migrate user data and settings. To complete a computer refresh you will: 1. Back up data and settings locally, in a backup folder. @@ -25,18 +33,26 @@ For a computer refresh with MDT, you use the User State Migration Tool (USMT), w 4. Install other applications. 5. Restore data and settings. During the computer refresh, USMT uses a feature called Hard-Link Migration Store. When you use this feature, the files are simply linked in the file system, which allows for fast migration, even when there is a lot of data. + **Note**   In addition to the USMT backup, you can enable an optional full Windows Imaging (WIM) backup of the machine by configuring the MDT rules. If you do this, a .wim file is created in addition to the USMT backup. The .wim file will contain the entire volume from the computer, and helpdesk personnel can extract content from it if needed. Please note that this is a data WIM backup only. Using this backup to restore the entire machine is not a supported scenario.   ### Multi-user migration -By default, ScanState in USMT backs up all profiles on the machine, including local computer profiles. If you have a machine that has been in your environment for a while, it likely has several domain-based profiles on it, including those of former users. You can limit which profiles are backed up by configuring command-line switches to ScanState (added as rules in MDT). + +By default, ScanState in USMT backs up all profiles on the machine, including local computer profiles. If you have a machine that has been in your environment for a while, it likely has several domain-based profiles on it, including those of former users. You can limit which profiles are backed up +by configuring command-line switches to ScanState (added as rules in MDT). + As an example, the following line configures USMT to migrate only domain user profiles and not profiles from the local SAM account database: ScanStateArgs=/ue:\*\\\* /ui:CONTOSO\\\* + **Note**   You also can combine the preceding switches with the /uel switch, which excludes profiles that have not been accessed within a specific number of days. For example, adding /uel:60 will configure ScanState (or LoadState) not to include profiles that haven't been accessed for more than 60 days.   ### Support for additional settings + In addition to the command-line switches that control which profiles to migrate, the XML templates control exactly what data is being migrated. You can control data within and outside the user profiles + ## Create a custom User State Migration Tool (USMT) template + In this section, you learn to migrate additional data using a custom template. You configure the environment to use a custom USMT XML template that will: 1. Back up the **C:\\Data** folder (including all files and folders). 2. Scan the local disk for PDF documents (\*.pdf files) and restore them into the **C:\\Data\\PDF Documents** folder on the destination machine. @@ -44,7 +60,9 @@ The custom USMT template is named MigContosoData.xml, and you can find it in the - [Gather script](http://go.microsoft.com/fwlink/p/?LinkId=619361) - [Set-OUPermissions](http://go.microsoft.com/fwlink/p/?LinkId=619362) script - [MDT Sample Web Service](http://go.microsoft.com/fwlink/p/?LinkId=619363) + ### Add the custom XML template + In order to use the custom MigContosoData.xml USMT template, you need to copy it to the MDT Production deployment share and update the CustomSettings.ini file. In these steps, we assume you have downloaded the MigContosoData.xml file. 1. Using File Explorer, copy the MigContosoData.xml file to the **E:\\MDTProduction\\Tools\\x64\\USMT5** folder. 2. Using Notepad, edit the E:\\MDTProduction\\Control\\CustomSettings.ini file. After the USMTMigFiles002=MigUser.xml line add the following line: @@ -52,12 +70,16 @@ In order to use the custom MigContosoData.xml USMT template, you need to copy it USMTMigFiles003=MigContosoData.xml ``` 3. Save the CustomSettings.ini file. + ## Refresh a Windows 7 SP1 client + After adding the additional USMT template and configuring the CustomSettings.ini file to use it, you are now ready to refresh a Windows 7 SP1 client to Windows 10. In these steps, we assume you have a Windows 7 SP1 client named PC0001 in your environment that is ready for a refresh to Windows 10. + **Note**   MDT also supports an offline computer refresh. For more info on that scenario, see the USMTOfflineMigration property in the [MDT resource page](http://go.microsoft.com/fwlink/p/?LinkId=618117).   ### Upgrade (refresh) a Windows 7 SP1 client + 1. On PC0001, log on as **CONTOSO\\Administrator**. Start the Lite Touch Deploy Wizard by executing **\\\\MDT01\\MDTProduction$\\Scripts\\Litetouch.vbs**. Complete the deployment guide using the following settings: 1. Select a task sequence to execute on this computer: Windows 10 Enterprise x64 RTM 2. Computer name: <default> @@ -72,14 +94,22 @@ MDT also supports an offline computer refresh. For more info on that scenario, s 3. Installs the added application(s). 4. Updates the operating system via your local Windows Server Update Services (WSUS) server. 5. Restores user settings and data using USMT. + ![figure 2](images/fig2-taskseq.png) + Figure 2. Starting the computer refresh from the running Windows 7 SP1 client. + ## Related topics + [Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md) + [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) + [Deploy a Windows 10 image using MDT 2013 Update 2](deploy-a-windows-10-image-using-mdt.md) + + [Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md) + [Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md) + [Configure MDT settings](configure-mdt-2013-settings.md) -  -  diff --git a/windows/deploy/remove-products-vamt.md b/windows/deploy/remove-products-vamt.md index b5ed86f6c2..8dca272b68 100644 --- a/windows/deploy/remove-products-vamt.md +++ b/windows/deploy/remove-products-vamt.md @@ -2,14 +2,17 @@ title: Remove Products (Windows 10) description: Remove Products ms.assetid: 4d44379e-dda1-4a8f-8ebf-395b6c0dad8e -ms.pagetype: activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- + # Remove Products + To remove one or more products from the Volume Activation Management Tool (VAMT), you can delete them from the product list view in the center pane. + **To delete one or more products** 1. Click a product node in the left-side pane. 2. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. @@ -20,6 +23,7 @@ To remove one or more products from the Volume Activation Management Tool (VAMT) 5. Select the products you want to delete. 6. Click **Delete** in the **Selected Items** menu in the right-side pane. 7. On the **Confirm Delete Selected Products** dialog box, click **OK**. + ## Related topics - [Add and Manage Products](add-manage-products-vamt.md)   diff --git a/windows/deploy/replace-a-windows-7-computer-with-a-windows-10-computer.md b/windows/deploy/replace-a-windows-7-computer-with-a-windows-10-computer.md index d5ed239732..bc78de5970 100644 --- a/windows/deploy/replace-a-windows-7-computer-with-a-windows-10-computer.md +++ b/windows/deploy/replace-a-windows-7-computer-with-a-windows-10-computer.md @@ -2,26 +2,37 @@ title: Replace a Windows 7 computer with a Windows 10 computer (Windows 10) description: A computer replace scenario for Windows 10 is quite similar to a computer refresh for Windows 10; however, because you are replacing a machine, you cannot store the backup on the old computer. ms.assetid: acf091c9-f8f4-4131-9845-625691c09a2a -ms.pagetype: mdt -keywords: ["deploy, deployment, replace"] +keywords: deploy, deployment, replace ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: mdt author: mtniehaus --- + # Replace a Windows 7 computer with a Windows 10 computer + **Applies to** - Windows 10 + A computer replace scenario for Windows 10 is quite similar to a computer refresh for Windows 10; however, because you are replacing a machine, you cannot store the backup on the old computer. Instead you need to store the backup to a location where the new computer can read it. For the purposes of this topic, we will use four machines: DC01, MDT01, PC0002, and PC0007. DC01 is a domain controller and MDT01 is a Windows Server 2012 R2 standard server. PC0002 is an old machine running Windows 7 SP1. It is going to be replaced by a new Windows 10 machine, PC0007. User State Migration Tool (USMT) will be used to backup and restore data and settings. MDT01, PC0002, and PC0007 are members of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md#proof). + ![figure 1](images/mdt-03-fig01.png) + Figure 1. The machines used in this topic. + ## Prepare for the computer replace + When preparing for the computer replace, you need to create a folder in which to store the backup, and a backup only task sequence that you run on the old computer. + ### Configure the rules on the Microsoft Deployment Toolkit (MDT) Production share + 1. On MDT01, using the Deployment Workbench, update the MDT Production deployment share rules. 2. Change the **SkipUserData=YES** option to **NO**, and click **OK**. + ### Create and share the MigData folder + 1. On MDT01, log on as **CONTOSO\\Administrator**. 2. Create and share the **E:\\MigData** folder by running the following three commands in an elevated Windows PowerShell prompt: ``` syntax @@ -31,6 +42,7 @@ When preparing for the computer replace, you need to create a folder in which to icacls E:\MigData /grant '"MDT_BA":(OI)(CI)(M)' ``` ### Create a backup only (replace) task sequence + 1. On MDT01, using the Deployment Workbench, in the MDT Production deployment share, select the **Task Sequences** node and create a new folder named **Other**. 2. Right-click the **Other** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: 1. Task sequence ID: REPLACE-001 @@ -38,13 +50,19 @@ When preparing for the computer replace, you need to create a folder in which to 3. Task sequence comments: Run USMT to backup user data and settings 4. Template: Standard Client Replace Task Sequence 3. In the **Other** folder, double-click **Backup Only Task Sequence**, and then in the **Task Sequence** tab, review the sequence. Notice that it only contains a subset of the normal client task sequence actions. + ![figure 2](images/mdt-03-fig02.png) + Figure 2. The Backup Only Task Sequence action list. + ## Perform the computer replace + During a computer replace, these are the high-level steps that occur: 1. On the computer you are replacing, a special replace task sequence runs the USMT backup and, if you configured it, runs the optional full Window Imaging (WIM) backup. 2. On the new machine, you perform a standard bare-metal deployment. At the end of the bare-metal deployment, the USMT backup from the old computer is restored. + ### Execute the replace task sequence + 1. On PC0002, log on as **CONTOSO\\Administrator**. 2. Verify that you have write access to the **\\\\MDT01\\MigData$** share. 3. Execute **\\\\MDT01\\MDTProduction$\\Scripts\\LiteTouch.vbs**. @@ -57,13 +75,21 @@ During a computer replace, these are the high-level steps that occur:   2. Specify where to save a complete computer backup: Do not back up the existing computer 3. Password: P@ssw0rd + The task sequence will now run USMT (Scanstate.exe) to capture user data and settings of the machine. + ![figure 3](images/mdt-03-fig03.png) + Figure 3. The new task sequence running the Capture User State action on PC0002. + 5. On MDT01, verify that you have an USMT.MIG compressed backup file in the **E:\\MigData\\PC0002\\USMT** folder. + ![figure 4](images/mdt-03-fig04.png) + Figure 4. The USMT backup of PC0002. + ### Deploy the PC0007 virtual machine + 1. Create a virtual machine with the following settings: 1. Name: PC0007 2. Location: C:\\VMs @@ -71,8 +97,11 @@ During a computer replace, these are the high-level steps that occur: 4. Memory: 2048 MB 5. Hard disk: 60 GB (dynamic disk) 2. Start the PC0007 virtual machine, and press **Enter** to start the Pre-Boot Execution Environment (PXE) boot. The machine will now load the Windows PE boot image from the WDS server. + ![figure 5](images/mdt-03-fig05.png) + Figure 5. The initial PXE boot process of PC0005. + 3. After Windows Preinstallation Environment (Windows PE) has booted, complete the Windows Deployment Wizard using the following settings: 1. Password: P@ssw0rd 2. Select a task sequence to execute on this computer: @@ -84,12 +113,17 @@ During a computer replace, these are the high-level steps that occur: 2. Installs the added application. 3. Updates the operating system via your local Windows Server Update Services (WSUS) server. 4. Restores the USMT backup from PC0002. + ## Related topics + [Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md) + [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) + [Deploy a Windows 10 image using MDT 2013 Update 2](deploy-a-windows-10-image-using-mdt.md) + [Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md) + [Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) + [Configure MDT settings](configure-mdt-2013-settings.md) -  -  diff --git a/windows/deploy/scenario-kms-activation-vamt.md b/windows/deploy/scenario-kms-activation-vamt.md index c3e3286677..a43796b90b 100644 --- a/windows/deploy/scenario-kms-activation-vamt.md +++ b/windows/deploy/scenario-kms-activation-vamt.md @@ -2,18 +2,23 @@ title: Scenario 3 KMS Client Activation (Windows 10) description: Scenario 3 KMS Client Activation ms.assetid: 72b04e8f-cd35-490c-91ab-27ea799b05d0 -ms.pagetype: activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- + # Scenario 3: KMS Client Activation + In this scenario, you use the Volume Activation Management Tool (VAMT) to activate Key Management Service (KMS) client keys or Generic Volume License Keys (GVLKs). This can be performed on either Core Network or Isolated Lab computers. By default, volume license editions of Windows Vista, Windows® 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server® 2012, and Microsoft® Office 2010 use KMS for activation. GVLKs are already installed in volume license editions of these products. You do not have to enter a key to activate a product as a GVLK, unless you are converting a MAK-activated product to a KMS activation. For more information, see [Install a KMS Client Key](install-kms-client-key-vamt.md). + The procedure that is described below assumes the following: - The KMS Service is enabled and available to all KMS clients. - VAMT has been installed and computers have been added to the VAMT database. See Parts 1 through 4 in either [Scenario 1: Online Activation](scenario-online-activation-vamt.md) or [Scenario 2: Proxy Activation](scenario-proxy-activation-vamt.md) for more information. + ## Activate KMS Clients + 1. Open VAMT. 2. To set the KMS activation options, on the menu bar click **View**. Then click **Preferences** to open the **Volume Activation Management Tool Preferences** dialog box. 3. In the **Volume Activation Management Tool Preferences** dialog box, under **KMS Management Services host selection** select from the following options: @@ -29,7 +34,9 @@ The procedure that is described below assumes the following: 8. Select the products that you want to activate. 9. Click **Activate** in the **Selected Items** menu in the right-side **Actions** pane, click **Activate**, point to **Volume activate**, and then click the appropriate credential option. If you click the **Alternate Credentials** option, you will be prompted to enter an alternate user name and password. 10. VAMT displays the **Activating products** dialog box until it completes the requested action. When activation is complete, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. + The same status is shown under the **Status of Last Action** column in the products list view in the center pane. + ## Related topics - [VAMT Step-by-Step Scenarios](vamt-step-by-step.md)   diff --git a/windows/deploy/scenario-online-activation-vamt.md b/windows/deploy/scenario-online-activation-vamt.md index db801ea1a6..69d308ee9c 100644 --- a/windows/deploy/scenario-online-activation-vamt.md +++ b/windows/deploy/scenario-online-activation-vamt.md @@ -2,13 +2,15 @@ title: Scenario 1 Online Activation (Windows 10) description: Scenario 1 Online Activation ms.assetid: 94dba40e-383a-41e4-b74b-9e884facdfd3 -ms.pagetype: activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- + # Scenario 1: Online Activation + In this scenario, the Volume Activation Management Tool (VAMT) is deployed in the Core Network environment. VAMT is installed on a central computer that has network access to all of the client computers. Both the VAMT host and the client computers have Internet access. The following illustration shows a diagram of an online activation scenario for Multiple Activation Keys (MAKs). You can use this scenario for online activation of the following key types: - Multiple Activation Key (MAK) - Windows Key Management Service (KMS) keys: @@ -16,7 +18,9 @@ In this scenario, the Volume Activation Management Tool (VAMT) is deployed in th - Generic Volume License Key (GVLK), or KMS client key - Retail The Secure Zone represents higher-security Core Network computers that have additional firewall protection. + ![VAMT firewall configuration for multiple subnets](images/dep-win8-l-vamt-makindependentactivationscenario.jpg) + ## In This Topic - [Install and start VAMT on a networked host computer](#bkmk-partone) - [Configure the Windows Management Instrumentation firewall exception on target computers](#bkmk-parttwo) @@ -27,18 +31,27 @@ The Secure Zone represents higher-security Core Network computers that have addi - [Add product keys and determine the remaining activation count](#bkmk-partseven) - [Install the product keys](#bkmk-parteight) - [Activate the client products](#bkmk-partnine) + ## Step 1: Install and start VAMT on a networked host computer + 1. Install VAMT on the host computer. 2. Click the VAMT icon in the **Start** menu to open VAMT. + ## Step 2: Configure the Windows Management Instrumentation firewall exception on target computers + - Ensure that the Windows Management Instrumentation (WMI) firewall exception has been enabled for all target computers. For more information, see [Configure Client Computers](configure-client-computers-vamt.md). + **Note**   To retrieve product license status, VAMT must have administrative permissions on the remote computers and WMI must be available through the Windows Firewall. In addition, for workgroup computers, a registry key must be created to enable remote administrative actions under User Account Control (UAC). For more information, see [Configure Client Computers](configure-client-computers-vamt.md). + ## Step 3: Connect to a VAMT database + 1. If you are not already connected to a database, the **Database Connection Settings** dialog box appears when you open VAMT. Select the server and database where the keys that must be activated are located. 2. Click **Connect**. 3. If you are already connected to a database, VAMT displays an inventory of the products and product keys in the center pane, and a license overview of the computers in the database. If you need to connect to a different database, click **Successfully connected to Server** to open **the Database Connection Settings** dialog box. For more information about how to create VAMT databases and adding VAMT data, see [Manage VAMT Data](manage-vamt-data.md) + ## Step 4: Discover products + 1. In the left-side pane, in the **Products** node Products, click the product that you want to activate. 2. To open the **Discover Products** dialog box, click **Discover products** in the **Actions** menu in the right-side pane. 3. In the **Discover Products** dialog box, click **Search for computers in the Active Directory** to display the search options, and then click the search options that you want to use. You can search for computers in an Active Directory domain, by individual computer name or IP address, in a workgroup, or by a general Lightweight Directory Access Protocol (LDAP) query: @@ -47,8 +60,11 @@ The Secure Zone represents higher-security Core Network computers that have addi - To search for computers in a workgroup, click **Search for computers in the workgroup**. Then under **Workgroup Filter Criteria**, in the list of workgroup names, click the name of the workgroup that you want to search. You can narrow the search further by typing a name in the **Filter by computer name** field to search for a specific computer in the workgroup. This filter supports the asterisk (\*) wildcard. For example, typing "a\*" will display only computer names that start with the letter "a". - To search for computers by using a general LDAP query, click **Search with LDAP query** and enter your query in the text box that appears. VAMT will validate the LDAP query syntax, but will otherwise run the query without additional checks. 4. Click **Search**. + When the search is complete, the products that VAMT discovers appear in the product list view in the center pane. + ## Step 5: Sort and filter the list of computers + You can sort the list of products so that it is easier to find the computers that require product keys to be activated: 1. On the menu bar at the top of the center pane, click **Group by**, and then click **Product**, **Product Key Type**, or **License Status**. 2. To sort the list further, you can click one of the column headings to sort by that column. @@ -57,43 +73,58 @@ You can sort the list of products so that it is easier to find the computers tha - To filter the list by computer name, enter a name in the **Computer Name** box. - To filter the list by product name, product key type, or license status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. 5. Click **Filter**. VAMT displays the filtered list in the product list view in the center pane. + ## Step 6: Collect status information from the computers in the list + To collect the status from select computers in the database, you can select computers in the product list view by using one of the following methods: - To select a block of consecutively listed computers, click the first computer that you want to select, and then click the last computer while pressing the **Shift** key. - To select computers which are not listed consecutively, hold down the **Ctrl** key and select each computer for which you want to collect the status information. **To collect status information from the selected computers** 1. In the right-side **Actions** pane, click **Update license status** in the **Selected Items** menu and then click a credential option. Choose **Alternate Credentials** only if you are updating products that require administrator credentials that are different from the ones that you used to log on to the computer. Otherwise, click **Current Credentials** and continue to step 2.If you are supplying alternate credentials, in the **Windows Security** dialog box, type the appropriate user name and password and then click **OK**. 2. VAMT displays the **Collecting product information** dialog box while it collects the license status of all supported products on the selected computers. When the process is finished, the updated license status of each product will appear in the product list view in the center pane. + **Note**   If a computer has more than one supported product installed, VAMT adds an entry for each product. The entry appears under the appropriate product heading. + ## Step 7: Add product keys and determine the remaining activation count + 1. Click the **Product Keys** node in the left-side pane, and then click **Add Product Keys** in the right-side pane to open the **Add Product Keys** dialog box. 2. In the **Add Product Key** dialog box, you can select from one of the following methods to add product keys: - To add product keys manually, click **Enter product key(s) separated by line breaks**, enter one or more product keys, and then click **Add Key(s)**. - To import a Comma Separated Values File (CSV) that contains a list of product keys, click **Select a product key file to import**, browse to the file location, click **Open** to import the file, and then click **Add Key(s)**. + The keys that you have added appear in the **Product Keys** list view in the center pane. + **Important**   If you are activating many products with a MAK, refresh the activation count of the MAK to ensure that the MAK can support the required number of activations. In the product key list in the center pane, select the MAK and then click **Refresh product key data online** in the right-side pane to contact Microsoft and retrieve the number of remaining activations for the MAK. This step requires Internet access. You can only retrieve the remaining activation count for MAKs. + ## Step 8: Install the product keys + 1. In the left-side pane, click the product that you want to install keys on to. 2. If necessary, sort and filter the list of products so that it is easier to find the computers that must have a product key installed. See [Step 5: Sort and filter the list of computers](#bkmk-partfive). 3. In the **Products** list view pane, select the individual products which must have keys installed. You can use the **CTRL** key or the **SHIFT** key to select more than one product. 4. Click **Install product key** in the **Selected Items** menu in the right-side pane to display the **Install Product Key** dialog box. 5. The **Select Product Key** dialog box displays the keys that are available to be installed. Under **Recommended MAKs**, VAMT might display one or more recommended MAKs based on the selected products. If you are installing a MAK you can select a recommended product key or any other MAK from the **All Product Keys List**. If you are not installing a MAK, select a product key from the **All Product Keys** list. Use the scroll bar if you want to view the **Description** for each key. When you have selected the product key that you want to install, click **Install Key**. Note that only one key can be installed at a time. 6. VAMT displays the **Installing product key** dialog box while it attempts to install the product key for the selected products. When the process is finished, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. + The same status appears under the **Status of Last Action** column in the product list view in the center pane. **Note**   + Product key installation will fail if VAMT finds mismatched key types or editions. VAMT will display the failure status and will continue the installation for the next product in the list. For more information on choosing the correct product key, see [How to Choose the Right Volume License Key for Windows.](http://go.microsoft.com/fwlink/p/?linkid=238382) + ## Step 9: Activate the client products + 1. Select the individual products that you want to activate in the list-view pane. 2. On the menu bar, click **Action**, point to **Activate** and point to **Online activate**. You can also right-click the selected computers(s) to display the **Action** menu, point to **Activate** and point to **Online activate**. You can also click **Activate** in the **Selected Items** menu in the right-hand pane to access the **Activate** option. 3. If you are activating product keys using your current credential, click **Current credential** and continue to step 5. If you are activating products that require an administrator credential that is different from the one you are currently using, click the **Alternate credential** option. 4. Enter your alternate user name and password and click **OK**. 5. The **Activate** option contacts the Microsoft product-activation server over the Internet and requests activation for the selected products. VAMT displays the **Activating products** dialog box until the requested actions are completed. + **Note**   Installing a MAK and overwriting the GVLK on client products must be done with care. If the RTM version of Windows Vista has been installed on the computer for more than 30 days, then its initial grace period has expired. As a result, it will enter Reduced Functionality Mode (RFM) if online activation is not completed successfully before the next logon attempt. However, you can use online activation to recover properly configured computers from RFM, as long as the computers are available on the network. RFM only applies to the RTM version of Windows Vista or the retail editions of Microsoft Office 2010. Windows Vista with SP1 or later, Windows 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and volume editions of Office 2010 will not enter RFM. + ## Related topics - [VAMT Step-by-Step Scenarios](vamt-step-by-step.md)   diff --git a/windows/deploy/scenario-proxy-activation-vamt.md b/windows/deploy/scenario-proxy-activation-vamt.md index 6250f46422..8666ae35c6 100644 --- a/windows/deploy/scenario-proxy-activation-vamt.md +++ b/windows/deploy/scenario-proxy-activation-vamt.md @@ -2,27 +2,39 @@ title: Scenario 2 Proxy Activation (Windows 10) description: Scenario 2 Proxy Activation ms.assetid: ed5a8a56-d9aa-4895-918f-dd1898cb2c1a -ms.pagetype: activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- + # Scenario 2: Proxy Activation + In this scenario, the Volume Activation Management Tool (VAMT) is used to activate products that are installed on workgroup computers in an isolated lab environment. For workgroups which are isolated from the larger network, you can perform proxy activation of Multiple Activation Keys (MAKs), KMS Host keys (CSVLKs), Generic Volume License Keys (GVLKs) (or KMS client keys), or retail keys. Proxy activation is performed by installing a second instance of VAMT on a computer in the isolated workgroup. You can then use removable media to transfer VAMT Computer Information Lists (CILXs) between the instance of VAMT in the isolated workgroup and another VAMT host that has Internet access. The following diagram shows a Multiple Activation Key (MAK) proxy activation scenario: + ![VAMT MAK proxy activation scenario](images/dep-win8-l-vamt-makproxyactivationscenario.jpg) + ## Step 1: Install VAMT on a Workgroup Computer in the Isolated Lab + 1. Install VAMT on a host computer in the isolated lab workgroup. This computer can be running Windows 7, Windows 8, Windows 10, Windows Server 2008 R2, or Windows Server® 2012. 2. Click the VAMT icon in the **Start** menu to open VAMT. + ## Step 2: Configure the Windows Management Instrumentation Firewall Exception on Target Computers + - Ensure that the Windows Management Instrumentation (WMI) firewall exception has been enabled for all target computers. For more information, see [Configure Client Computers](configure-client-computers-vamt.md). + **Note**   To retrieve the license status on the selected computers, VAMT must have administrative permissions on the remote computers and WMI must be accessible through the Windows Firewall. In addition, for workgroup computers, a registry key must be created to enable remote administrative actions under User Account Control (UAC). For more information, see [Configure Client Computers](configure-client-computers-vamt.md). + ## Step 3: Connect to a VAMT Database + 1. If the host computer in the isolated lab workgroup is not already connected to the database, the **Database Connection Settings** dialog box appears when you open VAMT. Select the server and database that contains the computers in the workgroup. 2. Click **Connect**. 3. If you are already connected to a database, in the center pane VAMT displays an inventory of the products and product keys, and a license overview of the computers in the database. If you need to connect to a different database, click **Successfully connected to the Server** to open the **Database Connection Settings** dialog box. For more information about how to create VAMT databases and adding VAMT data, see [Manage VAMT Data.](manage-vamt-data.md) + ## Step 4: Discover Products + 1. In the left-side pane, in the **Products** node, click the product that you want to activate. 2. To open the **Discover Products** dialog box, click **Discover products** in the right-side pane. 3. In the **Discover Products** dialog box, click **Search for computers in the Active Directory** to display the search options, and then click the search options that you want to use. You can search for computers in an Active Directory domain, by individual computer name or IP address, in a workgroup, or by a general LDAP query: @@ -31,10 +43,15 @@ In this scenario, the Volume Activation Management Tool (VAMT) is used to activa - To search for computers in a workgroup, click **Search for computers in the workgroup**. Then under **Workgroup Filter Criteria**, in the list of workgroup names, click the name of the workgroup that you want to search. You can narrow the search further by typing a name in the **Filter by computer name** field to search for a specific computer in the workgroup. This filter supports the asterisk (\*) wildcard. For example, typing "a\*" will display only those computer names that start with the letter "a". - To search for computers by using a general LDAP query, click **Search with LDAP query** and enter your query in the text box that appears. VAMT will validate the LDAP query syntax, but will otherwise run the query without additional checks. 4. Click **Search**. + The **Finding Computers** window appears and displays the search progress as the computers are located. + When the search is complete, the products that VAMT discovers appear in the list view in the center pane. + ## Step 5: Sort and Filter the List of Computers + You can sort the list of products so that it is easier to find the computers that require product keys to be activated: + 1. On the menu bar at the top of the center pane, click **Group by**, and then click **Product**, **Product Key Type**, or **License Status**. 2. To sort the list further, you can click one of the column headings to sort by that column. 3. You can also use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. @@ -42,35 +59,49 @@ You can sort the list of products so that it is easier to find the computers tha - To filter the list by computer name, enter a name in the **Computer Name** box. - To filter the list by product name, product key type, or license status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. 5. Click **Filter**. VAMT displays the filtered list in the product list view in the center pane. + ## Step 6: Collect Status Information from the Computers in the Isolated Lab + To collect the status from select computers in the database, you can select computers in the product list view by using one of the following methods: - To select a block of consecutively listed computers, click the first computer that you want to select, and then click the last computer while pressing the **Shift** key. - To select computers which are not listed consecutively, hold down the **Ctrl** ley and select each computer for which you want to collect the status information. **To collect status information from the selected computers** 1. In the right-side **Actions** pane, click **Update license status** in the **Selected Items** menu and then click a credential option. Choose **Alternate Credentials** only if you are updating products that require administrator credentials that are different from the ones that you used to log on to the computer. Otherwise, click **Current Credentials** and continue to step 2.If you are supplying alternate credentials, in the **Windows Security** dialog box type the appropriate user name and password and then click **OK**. 2. VAMT displays the **Collecting product information** dialog box while it collects the license status of all supported products on the selected computers. When the process is finished, the updated license status of each product will appear in the product list view in the center pane. + **Note**   If a computer has more than one supported product installed, VAMT adds an entry for each product. The entry appears under the appropriate product heading. + ## Step 7: Add Product Keys + 1. Click the **Product Keys** node in the left-side pane, and then click **Add Product Keys** in the right-side pane to open the **Add Product Keys** dialog box. 2. In the **Add Product Keys** dialog box, you can select from one of the following methods to add product keys: - To add a single product key, click **Enter product key(s) separated by line breaks**, enter one or more product keys, and then click **Add key(s)**. - To import a Comma Separated Values File (CSV) that contains a list of product keys, click **Select a product key to import**, browse to the file location, click **Open** to import the file, and then click **Add Key(s)**. + The keys that you have added appear in the **Product Keys** list view in the center pane. + ## Step 8: Install the Product Keys on the Isolated Lab Computers + 1. In the left-side pane, in the **Products** node click the product that you want to install keys onto. 2. If necessary, sort and filter the list of products so that it is easier to find the computers that must have a product key installed. See [Step 5: Sort and Filter the List of Computers](#step-5-sort-and-filter-the-list-of-computers). 3. In the **Products** list view pane, select the individual products which must have keys installed. You can use the **CTRL** key or the **SHIFT** key to select more than one product. 4. Click **Install product key** in the **Selected Items** menu in the right-side pane to display the **Install Product Key** dialog box. 5. The **Select Product Key** dialog box displays the keys that are available to be installed. Under **Recommended MAKs**, VAMT might display one or more recommended MAKs based on the selected products. If you are installing a MAK you can select a recommended product key or any other MAK from the **All Product Keys List**. If you are not installing a MAK, select a product key from the **All Product Keys** list. Use the scroll bar if you need to view the **Description** for each key. When you have selected the product key that you want to install, click **Install Key**. Note that only one key can be installed at a time. 6. VAMT displays the **Installing product key** dialog box while it attempts to install the product key for the selected products. When the process is finished, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. + The same status appears under the **Status of Last Action** column in the product list view in the center pane. + **Note**   Product key installation will fail if VAMT finds mismatched key types or editions. VAMT displays the failure status and continues the installation for the next product in the list. For more information on choosing the correct product key, see [How to Choose the Right Volume License Key for Windows.](http://go.microsoft.com/fwlink/p/?linkid=238382) + **Note**   Installing a MAK and overwriting the GVLK on client products must be done with care. If the RTM version of Windows Vista has been installed on the computer for more than 30 days, then its initial grace period has expired. As a result, it will enter Reduced Functionality Mode (RFM) if online activation is not completed successfully before the next logon attempt. However, you can use online activation to recover properly configured computers from RFM, as long as the computers are available on the network. RFM only applies to the RTM version of Windows Vista or the retail editions of Microsoft Office 2010. Windows Vista with SP1 or later, Windows 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, and Windows Server 2012, and volume editions of Office 2010 will not enter RFM. + ## Step 9: Export VAMT Data to a .cilx File + In this step, you export VAMT from the workgroup’s host computer and save it in a .cilx file. Then you copy the .cilx file to removable media so that you can take it to a VAMT host computer that is connected to the Internet. In MAK proxy activation, it is critical to retain this file, because VAMT uses it to apply the Confirmation IDs (CIDs) to the proper products. + 1. Select the individual products that successfully received a product key in Step 8. If needed, sort and filter the list to find the products. 2. In the right-side **Actions** pane, click **Export list** to open the **Export List** dialog box. 3. In the **Export List** dialog box, click **Browse** to navigate to the .cilx file, or enter the name of the .cilx file to which you want to export the data. @@ -81,39 +112,53 @@ In this step, you export VAMT from the workgroup’s host computer and save it i 5. If you have selected products to export, and not the entire set of data from the database, select the **Export selected product rows only** check box. 6. Click **Save**. VAMT displays a progress message while the data is being exported. Click **OK** when a message appears and confirms that the export has completed successfully. 7. If you exported the list to a file on the host computer’s hard drive, copy the file to removable media, such as a disk drive, CD/DVD, or USB storage device. + **Important**   Choosing the **Export proxy activation data only** option excludes Personally Identifiable Information (PII) from being saved in the .cilx file. Therefore, the .cilx file must be re-imported into the SQL Server database on the isolated lab workgroup’s VAMT host computer, so that the CIDs that are requested from Microsoft (discussed in Step 10) can be correctly assigned to the computers in the isolated lab group. + ## Step 10: Acquire Confirmation IDs from Microsoft on the Internet-Connected Host Computer + 1. Insert the removable media into the VAMT host that has Internet access. 2. Open VAMT. Make sure you are on the root node, and that the **Volume Activation Management Tool** view is displayed in the center pane. 3. In the right-side **Actions** pane, click **Acquire confirmation IDs for CILX** to open the **Acquire confirmation IDs for file** dialog box. 4. In the **Acquire confirmation IDs for file** dialog box, browse to the location of the .cilx file that you exported from the isolated lab host computer, select the file, and then click **Open**. VAMT displays an **Acquiring Confirmation IDs** message while it contacts Microsoft and collects the CIDs. 5. When the CID collection process is complete, VAMT displays a **Volume Activation Management Tool** message that shows the number of confirmation IDs that were successfully acquired, and the name of the file where the IDs were saved. Click **OK** to close the message. + ## Step 11: Import the .cilx File onto the VAMT Host within the Isolated Lab Workgroup + 1. Remove the storage device that contains the .cilx file from the Internet-connected VAMT host computer and insert it into the VAMT host computer in the isolated lab. 2. Open VAMT and verify that you are connected to the database that contains the computer with the product keys that you are activating. 3. In the right-side **Actions** pane, click **Import list** to open the **Import List** dialog box. 4. In the **Import list** dialog box, browse to the location of the .cilx file that contains the CIDs, select the file, and then click **Open**. 5. Click **OK** to import the file and to overwrite any conflicting data in the database with data from the file. 6. VAMT displays a progress message while the data is being imported. Click **OK** when a message appears and confirms that the data has been successfully imported. + ## Step 12: Apply the CIDs and Activate the Isolated Lab Computers + 1. Select the products to which you want to apply CIDs. If needed, sort and filter the list to find the products. 2. In the right-side **Selected Items** menu, click **Activate**, click **Apply Confirmation ID**, and then select the appropriate credential option. If you click the **Alternate Credentials** option, you will be prompted to enter an alternate user name and password. + VAMT displays the **Applying Confirmation Id** dialog box while it installs the CIDs on the selected products. When VAMT finishes installing the CIDs, the status appears in the **Action Sataus** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. The same status appears under the **Status of Last Action** column in the product list view in the center pane. + ## Step 13: (Optional) Reactivating Reimaged Computers in the Isolated Lab + If you have captured new images of the computers in the isolated lab, but the underlying hardware of those computers has not changed, VAMT can reactivate those computers using the CIDs that are stored in the database. 1. Redeploy products to each computer, using the same computer names as before. 2. Open VAMT. 3. In the right-side **Selected Items** menu, click **Activate**, click **Apply Confirmation ID**, and then select the appropriate credential option. If you click the **Alternate Credentials** option, you will be prompted to enter an alternate user name and password. + VAMT displays the **Applying Confirmation Id** dialog box while it installs the CIDs on the selected products. When VAMT finishes installing the CIDs, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. The same status appears under the **Status of Last Action** column in the product list view in the center pane. + **Note**   Installing a MAK and overwriting the GVLK on the client products must be done with care. If the Windows activation initial grace period has expired, Windows will enter Reduced Functionality Mode (RFM) if online activation is not completed successfully before the next logon attempt. However, you can use online activation to recover properly configured computers from RFM, as long as the computers are accessible on the network. RFM only applies to the RTM version of Windows Vista or the retail editions of Microsoft Office 2010. Windows Vista with SP1 or later, Windows 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, and Windows Server 2012, and volume editions of Office 2010 will not enter RFM. + **Note**   Reapplying the same CID conserves the remaining activations on the MAK. + ## Related topics - [VAMT Step-by-Step Scenarios](vamt-step-by-step.md)   diff --git a/windows/deploy/set-up-mdt-2013-for-bitlocker.md b/windows/deploy/set-up-mdt-2013-for-bitlocker.md index b313a96c6e..5af8715c60 100644 --- a/windows/deploy/set-up-mdt-2013-for-bitlocker.md +++ b/windows/deploy/set-up-mdt-2013-for-bitlocker.md @@ -1,37 +1,50 @@ --- title: Set up MDT for BitLocker (Windows 10) ms.assetid: 386e6713-5c20-4d2a-a220-a38d94671a38 -ms.pagetype: mdt description: -keywords: ["disk, encryption, TPM, configure, secure, script"] +keywords: disk, encryption, TPM, configure, secure, script ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: mdt author: mtniehaus --- + # Set up MDT for BitLocker + This topic will show you how to configure your environment for BitLocker, the disk volume encryption built into Windows 10 Enterprise and Windows 10 Pro, using MDT. BitLocker in Windows 10 has two requirements in regard to an operating system deployment: - A protector, which can either be stored in the Trusted Platform Module (TPM) chip, or stored as a password. Technically, you also can use a USB stick to store the protector, but it's not a practical approach as the USB stick can be lost or stolen. We, therefore, recommend that you instead use a TPM chip and/or a password. - Multiple partitions on the hard drive. + To configure your environment for BitLocker, you will need to do the following: + 1. Configure Active Directory for BitLocker. 2. Download the various BitLocker scripts and tools. 3. Configure the operating system deployment task sequence for BitLocker. 4. Configure the rules (CustomSettings.ini) for BitLocker. + **Note**   Even though it is not a BitLocker requirement, we recommend configuring BitLocker to store the recovery key and TPM owner information in Active Directory. For additional information about these features, see [Backing Up BitLocker and TPM Recovery Information to AD DS](http://go.microsoft.com/fwlink/p/?LinkId=619548). If you have access to Microsoft BitLocker Administration and Monitoring (MBAM), which is part of Microsoft Desktop Optimization Pack (MDOP), you have additional management features for BitLocker.   For the purposes of this topic, we will use DC01, a domain controller that is a member of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md#proof). + ## Configure Active Directory for BitLocker + To enable BitLocker to store the recovery key and TPM information in Active Directory, you need to create a Group Policy for it in Active Directory. For this section, we are running Windows Server 2012 R2, so you do not need to extend the Schema. You do, however, need to set the appropriate permissions in Active Directory. + **Note**   Depending on the Active Directory Schema version, you might need to update the Schema before you can store BitLocker information in Active Directory.   In Windows Server 2012 R2 (as well as in Windows Server 2008 R2 and Windows Server 2012), you have access to the BitLocker Drive Encryption Administration Utilities features, which will help you manage BitLocker. When you install the features, the BitLocker Active Directory Recovery Password Viewer is included, and it extends Active Directory Users and Computers with BitLocker Recovery information. + ![figure 2](images/mdt-09-fig02.png) + Figure 2. The BitLocker Recovery information on a computer object in the contoso.com domain. + ### Add the BitLocker Drive Encryption Administration Utilities + The BitLocker Drive Encryption Administration Utilities are added as features via Server Manager (or Windows PowerShell): + 1. On DC01, log on as **CONTOSO\\Administrator**, and, using Server Manager, click **Add roles and features**. 2. On the **Before you begin** page, click **Next**. 3. On the **Select installation type** page, select **Role-based or feature-based installation**, and click **Next**. @@ -42,9 +55,13 @@ The BitLocker Drive Encryption Administration Utilities are added as features vi 2. BitLocker Drive Encryption Tools 3. BitLocker Recovery Password Viewer 7. On the **Confirm installation selections** page, click **Install** and then click **Close**. + ![figure 3](images/mdt-09-fig03.png) + Figure 3. Selecting the BitLocker Drive Encryption Administration Utilities. + ### Create the BitLocker Group Policy + Following these steps, you enable the backup of BitLocker and TPM recovery information to Active Directory. You also enable the policy for the TPM validation profile. 1. On DC01, using Group Policy Management, right-click the **Contoso** organizational unit (OU), and select **Create a GPO in this domain, and Link it here**. 2. Assign the name **BitLocker Policy** to the new Group Policy. @@ -58,26 +75,35 @@ Following these steps, you enable the backup of BitLocker and TPM recovery infor 3. Enable the **Configure TPM platform validation profile for native UEFI firmware configurations** policy. Computer Configuration / Policies / Administrative Templates / System / Trusted Platform Module Services 4. Enable the **Turn on TPM backup to Active Directory Domain Services** policy. + **Note**   If you consistently get the error "Windows BitLocker Drive Encryption Information. The system boot information has changed since BitLocker was enabled. You must supply a BitLocker recovery password to start this system." after encrypting a computer with BitLocker, you might have to change the various "Configure TPM platform validation profile" Group Policies, as well. Whether or not you need to do this will depend on the hardware you are using.   ### Set permissions in Active Directory for BitLocker + In addition to the Group Policy created previously, you need to configure permissions in Active Directory to be able to store the TPM recovery information. In these steps, we assume you have downloaded the [Add-TPMSelfWriteACE.vbs script](http://go.microsoft.com/fwlink/p/?LinkId=167133) from Microsoft to C:\\Setup\\Scripts on DC01. 1. On DC01, start an elevated PowerShell prompt (run as Administrator). 2. Configure the permissions by running the following command: ``` syntax cscript C:\Setup\Scripts\Add-TPMSelfWriteACE.vbs ``` + ![figure 4](images/mdt-09-fig04.png) + Figure 4. Running the Add-TPMSelfWriteACE.vbs script on DC01. + ## Add BIOS configuration tools from Dell, HP, and Lenovo + If you want to automate enabling the TPM chip as part of the deployment process, you need to download the vendor tools and add them to your task sequences, either directly or in a script wrapper. + ### Add tools from Dell + The Dell tools are available via the Dell Client Configuration Toolkit (CCTK). The executable file from Dell is named cctk.exe. Here is a sample command to enable TPM and set a BIOS password using the cctk.exe tool: ``` syntax cctk.exe --tpm=on --valsetuppwd=Password1234 ``` ### Add tools from HP + The HP tools are part of HP System Software Manager. The executable file from HP is named BiosConfigUtility.exe. This utility uses a configuration file for the BIOS settings. Here is a sample command to enable TPM and set a BIOS password using the BiosConfigUtility.exe tool: ``` syntax BIOSConfigUtility.EXE /SetConfig:TPMEnable.REPSET /NewAdminPassword:Password1234 @@ -95,11 +121,13 @@ Embedded Security Device Availability *Available ``` ### Add tools from Lenovo + The Lenovo tools are a set of VBScripts available as part of the Lenovo BIOS Setup using Windows Management Instrumentation Deployment Guide. Lenovo also provides a separate download of the scripts. Here is a sample command to enable TPM using the Lenovo tools: ``` syntax cscript.exe SetConfig.vbs SecurityChip Active ``` ## Configure the Windows 10 task sequence to enable BitLocker + When configuring a task sequence to run any BitLocker tool, either directly or using a custom script, it is helpful if you also add some logic to detect whether the BIOS is already configured on the machine. In this task sequence, we are using a sample script (ZTICheckforTPM.wsf) from the Deployment Guys web page to check the status on the TPM chip. You can download this script from the Deployment Guys Blog post, [Check to see if the TPM is enabled](http://go.microsoft.com/fwlink/p/?LinkId=619549). In the following task sequence, we have added five actions: - **Check TPM Status.** Runs the ZTICheckforTPM.wsf script to determine if TPM is enabled. Depending on the status, the script will set the TPMEnabled and TPMActivated properties to either true or false. - **Configure BIOS for TPM.** Runs the vendor tools (in this case, HP, Dell, and Lenovo). To ensure this action is run only when necessary, add a condition so the action is run only when the TPM chip is not already activated. Use the properties from the ZTICheckforTPM.wsf. @@ -109,13 +137,19 @@ When configuring a task sequence to run any BitLocker tool, either directly or u - **Restart computer.** Self-explanatory, reboots the computer. - **Check TPM Status.** Runs the ZTICheckforTPM.wsf script one more time. - **Enable BitLocker.** Runs the built-in action to activate BitLocker. + ## Related topics + [Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) + [Configure MDT for UserExit scripts](configure-mdt-2013-for-userexit-scripts.md) + [Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md) + [Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md) + [Assign applications using roles in MDT](assign-applications-using-roles-in-mdt-2013.md) + [Use web services in MDT](use-web-services-in-mdt-2013.md) + [Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt-2013.md) -  -  diff --git a/windows/deploy/simulate-a-windows-10-deployment-in-a-test-environment.md b/windows/deploy/simulate-a-windows-10-deployment-in-a-test-environment.md index 5037366f66..a8391582fa 100644 --- a/windows/deploy/simulate-a-windows-10-deployment-in-a-test-environment.md +++ b/windows/deploy/simulate-a-windows-10-deployment-in-a-test-environment.md @@ -2,16 +2,19 @@ title: Simulate a Windows 10 deployment in a test environment (Windows 10) description: This topic will walk you through the process of creating a simulated environment on which to test your Windows 10 deployment using MDT. ms.assetid: 2de86c55-ced9-4078-b280-35e0329aea9c -ms.pagetype: mdt -keywords: ["deploy, script,"] +keywords: deploy, script ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: mdt author: mtniehaus --- + # Simulate a Windows 10 deployment in a test environment + This topic will walk you through the process of creating a simulated environment on which to test your Windows 10 deployment using MDT. When working with advanced settings and rules, especially those like database calls, it is most efficient to be able to test the settings without having to run through a complete deployment. Luckily, MDT enables you to perform a simulated deployment by running the Gather process by itself. The simulation works best when you are using a domain-joined machine (client or server). In the following example, you use the PC0001 Windows 10 client. For the purposes of this topic, you already will have either downloaded and installed the free Microsoft System Center 2012 R2 Configuration Manager Toolkit, or copied Configuration Manager Trace (CMTrace) if you have access to the System Center 2012 R2 Configuration Manager media. We also assume that you have downloaded the [sample Gather.ps1 script](http://go.microsoft.com/fwlink/p/?LinkId=619361) from the TechNet gallery. + 1. On PC0001, log on as **CONTOSO\\Administrator** using the password **P@ssw0rd**. 2. Using Computer Management, add the **CONTOSO\\MDT\_BA** user account to the local **Administrators** group. 3. Log off, and then log on to PC0001 as **CONTOSO\\MDT\_BA**. @@ -25,8 +28,11 @@ For the purposes of this topic, you already will have either downloaded and inst 7. From the **\\\\MDT01\\MDTProduction$\\Control** folder, copy the CustomSettings.ini file to **C:\\MDT**. 8. In the **C:\\MDT** folder, create a subfolder named **X64**. 9. From the **\\\\MDT01\\MDTProduction$\\Tools\\X64** folder, copy the Microsoft.BDD.Utility.dll file to **C:\\MDT\\X64**. + ![figure 6](images/mdt-09-fig06.png) + Figure 6. The C:\\MDT folder with the files added for the simulation environment. + 10. Using an elevated Windows PowerShell prompt (run as Administrator), run the following commands. Press Enter after each command: ``` syntax Set-Location C:\MDT @@ -36,15 +42,23 @@ For the purposes of this topic, you already will have either downloaded and inst **Note**   Warnings or errors with regard to the Wizard.hta are expected. If the log file looks okay, you are ready to try a real deployment.   + ![figure 7](images/mdt-09-fig07.png) + Figure 7. The ZTIGather.log file from PC0001, displaying some of its hardware capabilities. + ## Related topics + [Set up MDT for BitLocker](set-up-mdt-2013-for-bitlocker.md) + [Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) + [Configure MDT for UserExit scripts](configure-mdt-2013-for-userexit-scripts.md) + [Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md) + [Assign applications using roles in MDT](assign-applications-using-roles-in-mdt-2013.md) + [Use web services in MDT](use-web-services-in-mdt-2013.md) -[Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt-2013.md) -  -  + +[Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt-2013.md) \ No newline at end of file diff --git a/windows/deploy/update-product-status-vamt.md b/windows/deploy/update-product-status-vamt.md index 044c23215e..deca904c0c 100644 --- a/windows/deploy/update-product-status-vamt.md +++ b/windows/deploy/update-product-status-vamt.md @@ -2,23 +2,30 @@ title: Update Product Status (Windows 10) description: Update Product Status ms.assetid: 39d4abd4-801a-4e8f-9b8c-425a24a96764 -ms.pagetype: activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- + # Update Product Status + After you add computers to the VAMT database, you need to use the **Update license status** function to add the products that are installed on the computers. You can also use the **Update license status** at any time to retrieve the most current license status for any products in the VAMT database. To retrieve license status, VAMT must have administrative permissions on all selected computers and Windows Management Instrumentation (WMI) must be accessible through the Windows Firewall. In addition, for workgroup computers, a registry key must be created to enable remote administrative actions under User Account Control (UAC). For more information, see [Configure Client Computers](configure-client-computers-vamt.md). + **Note**   The license-status query requires a valid computer name for each system queried. If the VAMT database contains computers that were added without Personally Identifiable Information, computer names will not be available for those computers, and the status for these computers will not be updated. + ## Update the license status of a product + 1. Open VAMT. 2. In the **Products** list, select one or more products that need to have their status updated. 3. In the right-side **Actions** pane, click **Update license status** and then click a credential option. Choose **Alternate Credentials** only if you are updating products that require administrator credentials different from the ones you used to log into the computer. 4. If you are supplying alternate credentials, in the **Windows Security** dialog box type the appropriate user name and password and click **OK**. + VAMT displays the **Collecting product information** dialog box while it collects the status of all selected products. When the process is finished, the updated licensing status of each product will appear in the product list view in the center pane. + **Note**   If a previously discovered Microsoft Office 2010 product has been uninstalled from the remote computer, updating its licensing status will cause the entry to be deleted from the **Office** product list view, and, consequently, the total number of discovered products will be smaller. However, the Windows installation of the same computer will not be deleted and will always be shown in the **Windows** products list view.   diff --git a/windows/deploy/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md b/windows/deploy/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md index 7d7335cdd0..35b90474ab 100644 --- a/windows/deploy/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md +++ b/windows/deploy/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md @@ -2,25 +2,37 @@ title: Upgrade to Windows 10 with the Microsoft Deployment Toolkit (Windows 10) description: The simplest path to upgrade PCs that are currently running Windows 7, Windows 8, or Windows 8.1 to Windows 10 is through an in-place upgrade. ms.assetid: B8993151-3C1E-4F22-93F4-2C5F2771A460 -ms.pagetype: mdt -keywords: ["upgrade, update, task sequence, deploy"] +keywords: upgrade, update, task sequence, deploy ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: mdt author: mtniehaus --- + # Upgrade to Windows 10 with the Microsoft Deployment Toolkit + **Applies to** - Windows 10 + The simplest path to upgrade PCs that are currently running Windows 7, Windows 8, or Windows 8.1 to Windows 10 is through an in-place upgrade. You can use a Microsoft Deployment Toolkit (MDT) 2013 Update 2 task sequence to completely automate the process. + ## Proof-of-concept environment + For the purposes of this topic, we will use four machines: DC01, MDT01, and PC0001. DC01 is a domain controller and MDT01 is a Windows Server 2012 R2 standard machine, fully patched with the latest security updates, and configured as a member server in the fictional contoso.com domain. PC0001 is a machine with Windows 7 SP1, targeted for the Windows 10 upgrade. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md). + ![fig 1](images/upgrademdt-fig1-machines.png) + Figure 1. The machines used in this topic. + ## Set up the upgrade task sequence + MDT 2013 Update 2 adds support for Windows 10 deployment, including a new in-place upgrade task sequence template that makes the process really simple. + ## Create the MDT production deployment share + The steps to create the deployment share for production are the same as when you created the deployment share to create the custom reference image: + 1. On MDT01, log on as Administrator in the CONTOSO domain with a password of **P@ssw0rd**. 2. Using the Deployment Workbench, right-click **Deployment Shares** and select **New Deployment Share**. 3. On the **Path** page, in the **Deployment share path** text box, type **E:\\MDTProduction**, and then click **Next**. @@ -28,8 +40,11 @@ The steps to create the deployment share for production are the same as when you 5. On the **Descriptive Name** page, in the **Deployment share** description text box, type **MDT Production**, and then click **Next**. 6. On the **Options** page, accept the default settings and click **Next** twice, and then click **Finish**. 7. Using File Explorer, verify that you can access the **\\\\MDT01\\MDTProduction$** share. + ## Add Windows 10 Enterprise x64 (full source) + In these steps we assume that you have copied the content of a Windows 10 Enterprise x64 ISO to the E:\\Downloads\\Windows 10 Enterprise x64 folder. + 1. Using the Deployment Workbench, expand the **Deployment Shares** node, and then expand **MDT Production**. 2. Right-click the **Operating Systems** node, and create a new folder named **Windows 10**. 3. Expand the **Operating Systems** node, right-click the **Windows 10** folder, and select **Import Operating System**. Use the following settings for the Import Operating System Wizard: @@ -37,9 +52,13 @@ In these steps we assume that you have copied the content of a Windows 10 Enter - Source directory: E:\\Downloads\\Windows 10 Enterprise x64 - Destination directory name: W10EX64RTM 4. After you add the operating system, in the **Operating Systems / Windows 10** folder, double-click the added operating system name in the **Operating System** node and change the name to the following: **Windows 10 Enterprise x64 RTM Default Image** + ![figure 2](images/upgrademdt-fig2-importedos.png) + Figure 2. The imported Windows 10 operating system after you rename it. + ## Create a task sequence to upgrade to Windows 10 Enterprise + 1. Using the Deployment Workbench, select **Task Sequences** in the **MDT Production** node, and create a folder named **Windows 10**. 2. Right-click the new **Windows 10** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: - Task sequence ID: W10-X64-UPG @@ -51,21 +70,35 @@ Figure 2. The imported Windows 10 operating system after you rename it. - Organization: Contoso - Internet Explorer home page: about:blank - Admin Password: Do not specify an Administrator Password at this time + ![figure 3](images/upgrademdt-fig3-tasksequence.png) + Figure 3. The task sequence to upgrade to Windows 10. + ## Perform the Windows 10 upgrade + To initiate the in-place upgrade, perform the following steps on PC0003 (currently running Windows 7 SP1). + 1. Start the MDT deployment wizard by running the following command: **\\\\MDT01\\MDTProduction$\\Scripts\\LiteTouch.vbs** -2. Select the **Windows 10 Enterprise x64 RTM Upgrade** task sequence, and then click **Next**.![figure 4](images/upgrademdt-fig4-selecttask.png) +2. Select the **Windows 10 Enterprise x64 RTM Upgrade** task sequence, and then click **Next**. + + ![figure 4](images/upgrademdt-fig4-selecttask.png) + Figure 4. Upgrade task sequence. + 3. On the **Credentials** tab, specify the **MDT\_BA** account, **P@ssw0rd** password, and **CONTOSO** for the domain. (Some or all of these values can be specified in Bootstrap.ini so they are automatically populated.) 4. On the **Ready** tab, click **Begin** to start the task sequence. When the task sequence begins, it automatically initiates the in-place upgrade process by invoking the Windows setup program (Setup.exe) with the necessary command-line parameters to perform an automated upgrade, which preserves all data, settings, apps, and drivers. + ![figure 5](images/upgrademdt-fig5-winupgrade.png) + Figure 5. Upgrade from Windows 7 to Windows 10 Enterprise x64 with a task sequence. + After the task sequence completes, the computer will be fully upgraded to Windows 10. + ## Related topics + [Windows 10 deployment scenarios](windows-10-deployment-scenarios.md) + [Microsoft Deployment Toolkit downloads and resources](http://go.microsoft.com/fwlink/p/?LinkId=618117) -  -  +  \ No newline at end of file diff --git a/windows/deploy/use-orchestrator-runbooks-with-mdt-2013.md b/windows/deploy/use-orchestrator-runbooks-with-mdt-2013.md index 7fa7ec5986..229fb16df0 100644 --- a/windows/deploy/use-orchestrator-runbooks-with-mdt-2013.md +++ b/windows/deploy/use-orchestrator-runbooks-with-mdt-2013.md @@ -2,20 +2,24 @@ title: Use Orchestrator runbooks with MDT (Windows 10) description: This topic will show you how to integrate Microsoft System Center 2012 R2 Orchestrator with MDT to replace the existing web services that are used in deployment solutions. ms.assetid: 68302780-1f6f-4a9c-9407-b14371fdce3f -ms.pagetype: mdt -keywords: ["web services, database"] +keywords: web services, database ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: mdt author: mtniehaus --- + # Use Orchestrator runbooks with MDT + This topic will show you how to integrate Microsoft System Center 2012 R2 Orchestrator with MDT to replace the existing web services that are used in deployment solutions. MDT can integrate with System Center 2012 R2 Orchestrator, which is a component that ties the Microsoft System Center products together, as well as other products from both Microsoft and third-party vendors. The difference between using Orchestrator and "normal" web services, is that with Orchestrator you have a rich drag-and-drop style interface when building the solution, and little or no coding is required. + **Note**   If you are licensed to use Orchestrator, we highly recommend that you start using it. To find out more about licensing options for System Center 2012 R2 and Orchestrator, visit the [System Center 2012 R2](http://go.microsoft.com/fwlink/p/?LinkId=619553) website.   ## Orchestrator terminology + Before diving into the core details, here is a quick course in Orchestrator terminology: - **Orchestrator Server.** This is a server that executes runbooks. - **Runbooks.** A runbook is similar to a task sequence; it is a series of instructions based on conditions. Runbooks consist of workflow activities; an activity could be Copy File, Get User from Active Directory, or even Write to Database. @@ -24,21 +28,29 @@ Before diving into the core details, here is a quick course in Orchestrator term - **Orchestrator Console.** This is the Microsoft Silverlight-based web page you can use interactively to execute runbooks. The console listens to TCP port 81 by default. - **Orchestrator web services.** These are the web services you use in the Microsoft Deployment Toolkit to execute runbooks during deployment. The web services listen to TCP port 82 by default. - **Integration packs.** These provide additional workflow activities you can import to integrate with other products or solutions, like the rest of Active Directory, other System Center 2012 R2 products, or Microsoft Exchange Server, to name a few. + **Note**   To find and download additional integration packs, see [Integration Packs for System Center 2012 - Orchestrator](http://go.microsoft.com/fwlink/p/?LinkId=619554).   ## Create a sample runbook + This section assumes you have Orchestrator 2012 R2 installed on a server named OR01. In this section, you create a sample runbook, which is used to log some of the MDT deployment information into a text file on OR01. + 1. On OR01, using File Explorer, create the **E:\\Logfile** folder, and grant Users modify permissions (NTFS). 2. In the **E:\\Logfile** folder, create the DeployLog.txt file. **Note**   Make sure File Explorer is configured to show known file extensions so the file is not named DeployLog.txt.txt.   ![figure 23](images/mdt-09-fig23.png) + Figure 23. The DeployLog.txt file. + 3. Using System Center 2012 R2 Orchestrator Runbook Designer, in the **Runbooks** node, create the **1.0 MDT** folder. + ![figure 24](images/mdt-09-fig24.png) + Figure 24. Folder created in the Runbooks node. + 4. In the **Runbooks** node, right-click the **1.0 MDT** folder, and select **New / Runbook**. 5. On the ribbon bar, click **Check Out**. 6. Right-click the **New Runbook** label, select **Rename**, and assign the name **MDT Sample**. @@ -46,26 +58,41 @@ This section assumes you have Orchestrator 2012 R2 installed on a server named O 1. Runbook Control / Initialize Data 2. Text File Management / Append Line 8. Connect **Initialize Data** to **Append Line**. + ![figure 25](images/mdt-09-fig25.png) + Figure 25. Activities added and connected. + 9. Right-click the **Initialize Data** activity, and select **Properties** 10. On **the Initialize Data Properties** page, click **Add**, change **Parameter 1** to **OSDComputerName**, and then click **Finish**. + ![figure 26](images/mdt-09-fig26.png) + Figure 26. The Initialize Data Properties window. + 11. Right-click the **Append Line** activity, and select **Properties**. 12. On the **Append Line Properties** page, in the **File** text box, type **E:\\Logfile\\DeployLog.txt**. 13. In the **File** encoding drop-down list, select **ASCII**. 14. In the **Append** area, right-click inside the **Text** text box and select **Expand**. + ![figure 27](images/mdt-09-fig27.png) + Figure 27. Expanding the Text area. + 15. In the blank text box, right-click and select **Subscribe / Published Data**. + ![figure 28](images/mdt-09-fig28.png) + Figure 28. Subscribing to data. + 16. In the **Published Data** window, select the **OSDComputerName** item, and click **OK**. 17. After the **{OSDComputerName from "Initialize Data"}** text, type in **has been deployed at** and, once again, right-click and select **Subscribe / Published Data**. 18. In the **Published Data** window, select the **Show common Published Data** check box, select the **Activity end time** item, and click **OK**. + ![figure 29](images/mdt-09-fig29.png) + Figure 29. The expanded text box after all subscriptions have been added. + 19. On the **Append Line Properties** page, click **Finish**. ## Test the demo MDT runbook After the runbook is created, you are ready to test it. @@ -75,9 +102,13 @@ After the runbook is created, you are ready to test it. 3. Verify that all activities are green (for additional information, see each target). 4. Close the **Runbook Tester**. 5. On the ribbon bar, click **Check In**. + ![figure 30](images/mdt-09-fig30.png) + Figure 30. All tests completed. + ## Use the MDT demo runbook from MDT + 1. On MDT01, using the Deployment Workbench, in the MDT Production deployment share, select the **Task Sequences** node, and create a folder named **Orchestrator**. 2. Right-click the **Orchestrator** node, and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: 1. Task sequence ID: OR001 @@ -95,9 +126,13 @@ Figure 30. All tests completed. 1. Orchestrator Server: OR01.contoso.com 2. Use Browse to select **1.0 MDT / MDT Sample**. 8. Click **OK**. + ![figure 31](images/mdt-09-fig31.png) + Figure 31. The ready-made task sequence. + ## Run the orchestrator sample task sequence + Since this task sequence just starts a runbook, you can test this on the PC0001 client that you used for the MDT simulation environment. **Note**   Make sure the account you are using has permissions to run runbooks on the Orchestrator server. For more information about runbook permissions, see [Runbook Permissions](http://go.microsoft.com/fwlink/p/?LinkId=619555). @@ -114,15 +149,24 @@ Make sure the account you are using has permissions to run runbooks on the Orche 2. Password: P@ssw0rd 3. Domain: CONTOSO 4. Wait until the task sequence is completed and then verify that the DeployLog.txt file in the E:\\Logfile folder on OR01 was updated. + ![figure 32](images/mdt-09-fig32.png) + Figure 32. The ready-made task sequence. + ## Related topics + [Set up MDT for BitLocker](set-up-mdt-2013-for-bitlocker.md) + [Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) + [Configure MDT for UserExit scripts](configure-mdt-2013-for-userexit-scripts.md) + [Simulate a Windows10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md) + [Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md) + + [Assign applications using roles in MDT](assign-applications-using-roles-in-mdt-2013.md) + [Use web services in MDT](use-web-services-in-mdt-2013.md) -  -  diff --git a/windows/deploy/use-the-mdt-database-to-stage-windows-10-deployment-information.md b/windows/deploy/use-the-mdt-database-to-stage-windows-10-deployment-information.md index 7bda954f15..14749270e7 100644 --- a/windows/deploy/use-the-mdt-database-to-stage-windows-10-deployment-information.md +++ b/windows/deploy/use-the-mdt-database-to-stage-windows-10-deployment-information.md @@ -3,21 +3,28 @@ title: Use the MDT database to stage Windows 10 deployment information (Windows description: This topic is designed to teach you how to use the MDT database to pre-stage information on your Windows 10 deployment in a Microsoft SQL Server 2012 SP1 Express database, rather than include the information in a text file (CustomSettings.ini). ms.assetid: 8956ab54-90ba-45d3-a384-4fdec72c4d46 ms.pagetype: mdt -keywords: ["database, permissions, settings, configure, deploy"] +keywords: database, permissions, settings, configure, deploy ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus --- + # Use the MDT database to stage Windows 10 deployment information + This topic is designed to teach you how to use the MDT database to pre-stage information on your Windows 10 deployment in a Microsoft SQL Server 2012 SP1 Express database, rather than include the information in a text file (CustomSettings.ini). You can use this process, for example, to add the client machines you want to deploy, specify their computer names and IP addresses, indicate applications to be deployed, and determine many additional settings for the machines. + ## Database prerequisites + MDT can use either SQL Server Express or full SQL Server, but since the deployment database isn't big, even in large enterprise environments, we recommend using the free SQL Server 2012 SP1 Express database in your environment. + **Note**   Be sure to enable Named Pipes when configuring the SQL Server 2012 SP1 Express database. Although it is a legacy protocol, Named Pipes has proven to work well when connecting from Windows Preinstallation Environment (Windows PE) to the SQL Server database.   ## Create the deployment database + The MDT database is by default created and managed from the Deployment Workbench. In these steps, we assume you have installed SQL Server 2012 SP1 Express on MDT01. + **Note**   Since SQL Server 2012 SP1 Express runs by default on a separate instance (SQLEXPRESS), the SQL Server Browser service must be running, and the firewall configured to allow traffic to it. Port 1433 TCP and port 1434 UDP need to be opened for inbound traffic on MDT01.   @@ -29,37 +36,56 @@ Since SQL Server 2012 SP1 Express runs by default on a separate instance (SQLEXP 4. Network Library: Named Pipes 3. On the **Database** page, select **Create a new database**; in the **Database** field, type **MDT** and click **Next**. 4. On the **SQL Share** page, in the **SQL Share** field, type **Logs$** and click **Next**. Click **Next** again and then click **Finish**. + ![figure 8](images/mdt-09-fig08.png) + Figure 8. The MDT database added to MDT01. + ## Configure database permissions + After creating the database, you need to assign permissions to it. In MDT, the account you used to run the deployment is used to access the database. In this environment, the network access account is MDT\_BA. 1. On MDT01, start SQL Server Management Studio. 2. In the **Connect to Server** dialog box, in the **Server name** list, select **MDT01\\SQLEXPRESS** and click **Connect**. 3. In the **Object Explorer** pane, expand the top-level **Security** node, right-click **Logins**, and select **New Login**. + ![figure 9](images/mdt-09-fig09.png) + Figure 9. The top-level Security node. + 4. On the **Login - New** page, next to the **Login** name field, click **Search**, and search for **CONTOSO\\MDT\_BA**. Then in the left pane, select **User Mapping**. Select the **MDT** database, and assign the following roles: 1. db\_datareader 2. public (default) 5. Click **OK**, and close SQL Server Management Studio. + ![figure 10](images/mdt-09-fig10.png) + Figure 10. Creating the login and settings permissions to the MDT database. + ## Create an entry in the database + To start using the database, you add a computer entry and assign a description and computer name. Use the computer's MAC Address as the identifier. 1. On MDT01, using the Deployment Workbench, in the MDT Production deployment share, expand **Advanced Configuration**, and expand **Database**. 2. Right-click **Computers**, select **New**, and add a computer entry with the following settings: 1. Description: New York Site - PC00075 2. MacAddress: <PC00075 MAC Address in the 00:00:00:00:00:00 format> 3. Details Tab / OSDComputerName: PC00075 + ![figure 11](images/mdt-09-fig11.png) + Figure 11. Adding the PC00075 computer to the database. + ## Related topics + [Set up MDT for BitLocker](set-up-mdt-2013-for-bitlocker.md) + [Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) + [Configure MDT for UserExit scripts](configure-mdt-2013-for-userexit-scripts.md) + [Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md) + [Assign applications using roles in MDT](assign-applications-using-roles-in-mdt-2013.md) + [Use web services in MDT](use-web-services-in-mdt-2013.md) + [Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt-2013.md) -  -  diff --git a/windows/deploy/use-the-volume-activation-management-tool-client.md b/windows/deploy/use-the-volume-activation-management-tool-client.md index 179a58af66..4303bd18a1 100644 --- a/windows/deploy/use-the-volume-activation-management-tool-client.md +++ b/windows/deploy/use-the-volume-activation-management-tool-client.md @@ -2,14 +2,16 @@ title: Use the Volume Activation Management Tool (Windows 10) description: The Volume Activation Management Tool (VAMT) provides several useful features, including the ability to perform VAMT proxy activation and to track and monitor several types of product keys. ms.assetid: b11f0aee-7b60-44d1-be40-c960fc6c4c47 -ms.pagetype: activation -keywords: ["vamt", "volume activation", "activation", "windows activation"] +keywords: vamt, volume activation, activation, windows activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- + # Use the Volume Activation Management Tool + **Applies to** - Windows 10 - Windows 8.1 @@ -18,33 +20,53 @@ author: jdeckerMS - Windows Server 2012 R2 - Windows Server 2012 - Windows Server 2008 R2 + **Looking for retail activation?** - [Get Help Activating Microsoft Windows](http://go.microsoft.com/fwlink/p/?LinkId=618644) + The Volume Activation Management Tool (VAMT) provides several useful features, including the ability to perform VAMT proxy activation and to track and monitor several types of product keys. -By using the VAMT, you can automate and centrally manage the volume, retail, and MAK activation process for Windows, Office, and select other Microsoft products. The VAMT can manage volume activation by using MAKs or KMS. It is a standard Microsoft Management Console snap-in, and it can be installed on any computer running Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Server 2012 R2, Windows Server 2012, or Windows Server 2008 R2. + +By using the VAMT, you can automate and centrally manage the volume, retail, and MAK activation process for Windows, Office, and select other Microsoft products. The VAMT can manage volume activation by using MAKs or KMS. It is a standard Microsoft Management Console snap-in, and it can be +installed on any computer running Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Server 2012 R2, Windows Server 2012, or Windows Server 2008 R2. + The VAMT is distributed as part of the Windows Assessment and Deployment Kit (Windows ADK), which is a free download available from Microsoft Download Center. For more information, see [Windows Assessment and Deployment Kit (Windows ADK) for Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=526740). + In Windows Server 2012 R2, you can install the VAMT directly from Server Manager without downloading the Windows ADK by selecting the Volume Activation Services role or the Remote Server Administration Tools/Role Administration Tools/Volume Activation Tools feature. + ## Activating with the Volume Activation Management Tool + You can use the VAMT to complete the activation process in products by using MAK and retail keys, and you can work with computers individually or in groups. The VAMT enables two activation scenarios: - **Online activation**. Online activation enables you to activate over the Internet any products that are installed with MAK, KMS host, or retail product keys. You can activate one or more connected computers within a network. This process requires that each product communicate activation information directly to Microsoft. - **Proxy activation**. This activation method enables you to perform volume activation for products that are installed on client computers that do not have Internet access. The VAMT host computer distributes a MAK, KMS host key, or retail product key to one or more client products and collects the installation ID from each client product. The VAMT host sends the installation IDs to Microsoft on behalf of the client products and obtains the corresponding confirmation IDs. The VAMT host then installs the confirmation IDs on the client products to complete their activation. By using this method, only the VAMT host computer requires Internet access. Proxy activation by using the VAMT is beneficial for isolated network segments and for cases where your organization has a mix of retail, MAK, and KMS-based activations. + ## Tracking products and computers with the Volume Activation Management Tool + The VAMT provides an overview of the activation and licensing status of computers across your network, as shown in Figure 18. Several prebuilt reports are also available to help you proactively manage licensing. + ![VAMT showing the licensing status of multiple computers](images/volumeactivationforwindows81-18.jpg) + **Figure 18**. The VAMT showing the licensing status of multiple computers + ## Tracking key usage with the Volume Activation Management Tool + The VAMT makes it easier to track the various keys that are issued to your organization. You can enter each key into VAMT, and then the VAMT can use those keys for online or proxy activation of clients. The tool can also describe what type of key it is and to which product group it belongs. The VAMT is the most convenient way to quickly determine how many activations remain on a MAK. Figure 19 shows an example of key types and usage. + ![VAMT showing key types and usage](images/volumeactivationforwindows81-19.jpg) + **Figure 19**. The VAMT showing key types and usage + ## Other Volume Activation Management Tool features + The VAMT stores information in a Microsoft SQL Server database for performance and flexibility, and it provides a single graphical user interface for managing activations and performing other activation-related tasks, such as: - **Adding and removing computers**. You can use the VAMT to discover computers in the local environment. The VAMT can discover computers by querying AD DS, workgroups, or individual computer names or IP addresses, or through a general LDAP query. - **Discovering products**. You can use the VAMT to discover Windows, Windows Server, Office, and select other products that are installed on the client computers. - **Managing activation data**. The VAMT stores activation data in a SQL Server database. The tool can export this data in XML format to other VAMT hosts or to an archive. + For more information, see: - [Volume Activation Management Tool (VAMT) Overview](http://go.microsoft.com/fwlink/p/?LinkId=618266) - [VAMT Step-by-Step Scenarios](http://go.microsoft.com/fwlink/p/?LinkId=618267) + ## See also - [Volume Activation for Windows 10](volume-activation-windows-10.md)   diff --git a/windows/deploy/use-vamt-in-windows-powershell.md b/windows/deploy/use-vamt-in-windows-powershell.md index 2137b0ddf2..1247d95759 100644 --- a/windows/deploy/use-vamt-in-windows-powershell.md +++ b/windows/deploy/use-vamt-in-windows-powershell.md @@ -2,13 +2,15 @@ title: Use VAMT in Windows PowerShell (Windows 10) description: Use VAMT in Windows PowerShell ms.assetid: 13e0ceec-d827-4681-a5c3-8704349e3ba9 -ms.pagetype: activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- + # Use VAMT in Windows PowerShell + The Volume Activation Management Tool (VAMT) PowerShell cmdlets can be used to perform the same functions as the Vamt.exe command-line tool. **To install PowerShell 3.0** - VAMT PowerShell cmdlets require Windows PowerShell, which is included in Windows 10, Windows 8 and Windows Server® 2012. You can download PowerShell for Windows 7 or other operating systems from the [Microsoft Download Center](http://go.microsoft.com/fwlink/p/?LinkId=218356). @@ -16,11 +18,13 @@ The Volume Activation Management Tool (VAMT) PowerShell cmdlets can be used to p - In addition to PowerShell, you must import the VAMT PowerShell module. The module is included in the VAMT 3.0 folder after you install the Windows Assessment and Deployment Kit (Windows ADK). **To prepare the VAMT PowerShell environment** 1. To open PowerShell with administrative credentials, click **Start** and type “PowerShell” to locate the program. Right-click **Windows PowerShell**, and then click **Run as administrator**. To open PowerShell in Windows 7, click **Start**, click **All Programs**, click **Accessories**, click **Windows PowerShell**, right-click **Windows PowerShell**, and then click **Run as administrator**. + **Important**   If you are using a computer that has an 64-bit processor, select **Windows PowerShell (x86)**. VAMT PowerShell cmdlets are supported for the x86 architecture only. You must use an x86 version of Windows PowerShell to import the VAMT module, which are available in these directories: - The x86 version of PowerShell is available in C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe - The x86 version of the PowerShell ISE is available in C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell\_ise.exe 2. For all supported operating systems you can use the VAMT PowerShell module included with the Windows ADK. By default, the module is installed with the Windows ADK in the VAMT folder. Change directories to the directory where VAMT is located. + For example, if the Windows ADK is installed in the default location of `C:\Program Files(x86)\Windows Kits\10`, type: ``` ps1 @@ -31,7 +35,9 @@ The Volume Activation Management Tool (VAMT) PowerShell cmdlets can be used to p Import-Module .\VAMT.psd1 ``` Where **Import-Module** imports a module only into the current session. To import the module into all sessions, add an **Import-Module** command to a Windows PowerShell profile. For more information about profiles, type `get-help about_profiles`. + ## To Get Help for VAMT PowerShell cmdlets + You can view all of the help sections for a VAMT PowerShell cmdlet, or you can view only the section that you are interested in. To view all of the Help content for a VAMT cmdlet, type: ``` ps1 get-help -all @@ -40,9 +46,12 @@ For example, type: ``` ps1 get-help get-VamtProduct -all ``` + **Warning** The update-help cmdlet is not supported for VAMT PowerShell cmdlets. To view online help for VAMT cmdlets, you can use the -online option with the get-help cmdlet. For more information, see [Volume Activation Management Tool (VAMT) Cmdlets in Windows PowerShell](http://go.microsoft.com/fwlink/p/?LinkId=242278). + **To view VAMT PowerShell Help sections** + 1. To get the syntax to use with a cmdlet, type the following at a command prompt: ``` ps1 get-help diff --git a/windows/deploy/use-web-services-in-mdt-2013.md b/windows/deploy/use-web-services-in-mdt-2013.md index 79a286e539..6fbe628335 100644 --- a/windows/deploy/use-web-services-in-mdt-2013.md +++ b/windows/deploy/use-web-services-in-mdt-2013.md @@ -2,17 +2,21 @@ title: Use web services in MDT (Windows 10) description: In this topic, you will learn how to create a simple web service that generates computer names and then configure MDT to use that service during your Windows 10 deployment. ms.assetid: 8f47535e-0551-4ccb-8f02-bb97539c6522 -ms.pagetype: mdt -keywords: ["deploy, web apps"] +keywords: deploy, web apps ms.prod: W10 ms.mktglfcycl: deploy +ms.pagetype: mdt ms.sitesec: library author: mtniehaus --- + # Use web services in MDT + In this topic, you will learn how to create a simple web service that generates computer names and then configure MDT to use that service during your Windows 10 deployment. Web services provide a powerful way to assign settings during a deployment. Simply put, web services are web applications that run code on the server side, and MDT has built-in functions to call these web services. Using a web service in MDT is straightforward, but it does require that you have enabled the Web Server (IIS) role on the server. Developing web services involves a little bit of coding, but for most web services used with MDT, you can use the free Microsoft Visual Studio Express 2013 for Web. + ## Create a sample web service + In these steps we assume you have installed Microsoft Visual Studio Express 2013 for Web on PC0001 (the Windows 10 client) and downloaded the [MDT Sample Web Service](http://go.microsoft.com/fwlink/p/?LinkId=619363) from the Microsoft Download Center and extracted it to C:\\Projects. 1. On PC0001, using Visual Studio Express 2013 for Web, open the C:\\Projects\\MDTSample\\ MDTSample.sln solution file. 2. On the ribbon bar, verify that Release is selected. @@ -22,9 +26,13 @@ In these steps we assume you have installed Microsoft Visual Studio Express 2013 6. From PC0001, copy the following files from C:\\Projects\\MDTSample file to the **E:\\MDTSample** folder on MDT01: 1. Web.config 2. mdtsample.asmx + ![figure 15](images/mdt-09-fig15.png) + Figure 15. The sample project in Microsoft Visual Studio Express 2013 for Web. + ## Create an application pool for the web service + This section assumes that you have enabled the Web Server (IIS) role on MDT01. 1. On MDT01, using Server Manager, install the **IIS Management Console** role (available under Web Server (IIS) / Management Tools). 2. Using Internet Information Services (IIS) Manager, expand the **MDT01 (CONTOSO\\Administrator)** node. If prompted with the "Do you want to get started with Microsoft Web Platform?" question, select the **Do not show this message** check box and then click **No**. @@ -34,32 +42,50 @@ This section assumes that you have enabled the Web Server (IIS) role on MDT01. 3. Manage pipeline mode: Integrated 4. Select the **Start application pool immediately** check box. 5. Click **OK**. + ![figure 16](images/mdt-09-fig16.png) + Figure 16. The new MDTSample application. + ## Install the web service + 1. On MDT01, using Internet Information Services (IIS) Manager, expand **Sites**, right-click **Default Web Site**, and select **Add Application**. Use the following settings for the application: 1. Alias: MDTSample 2. Application pool: MDTSample 3. Physical Path: E:\\MDTSample + ![figure 17](images/mdt-09-fig17.png) + Figure 17. Adding the MDTSample web application. + 2. In the **Default Web Site** node, select the MDTSample web application, and in the right pane, double-click **Authentication**. Use the following settings for the **Authentication** dialog box: 1. Anonymous Authentication: Enabled 2. ASP.NET Impersonation: Disabled + ![figure 18](images/mdt-09-fig18.png) + Figure 18. Configuring Authentication for the MDTSample web service. + ## Test the web service in Internet Explorer + 1. On PC0001, using Internet Explorer, navigate to: **http://MDT01/MDTSample/mdtsample.asmx**. 2. Click the **GetComputerName** link. + ![figure 19](images/mdt-09-fig19.png) + Figure 19. The MDT Sample web service. 3. On the **GetComputerName** page, type in the following settings, and click **Invoke**: 1. Model: Hewlett-Packard 2. SerialNumber: 123456789 + ![figure 20](images/mdt-09-fig20.png) + Figure 20. The result from the MDT Sample web service. + ## Test the web service in the MDT simulation environment + After verifying the web service using Internet Explorer, you are ready to do the same test in the MDT simulation environment. + 1. On PC0001, edit the CustomSettings.ini file in the **C:\\MDT** folder to look like the following: ``` syntax [Settings] @@ -72,7 +98,9 @@ After verifying the web service using Internet Explorer, you are ready to do the OSDComputerName=string ``` ![figure 21](images/mdt-09-fig21.png) + Figure 21. The updated CustomSettings.ini file. + 2. Save the CustomSettings.ini file. 3. Using an elevated Windows PowerShell prompt (run as Administrator), run the following commands. Press **Enter** after each command: ``` syntax @@ -80,15 +108,24 @@ After verifying the web service using Internet Explorer, you are ready to do the .\Gather.ps1 ``` 4. Review the ZTIGather.log in the **C:\\MININT\\SMSOSD\\OSDLOGS** folder. + ![figure 22](images/mdt-09-fig22.png) + Figure 22. The OSDCOMPUTERNAME value obtained from the web service. + ## Related topics + [Set up MDT for BitLocker](set-up-mdt-2013-for-bitlocker.md) + [Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) + [Configure MDT for UserExit scripts](configure-mdt-2013-for-userexit-scripts.md) + [Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md) + [Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md) + [Assign applications using roles in MDT](assign-applications-using-roles-in-mdt-2013.md) + [Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt-2013.md) -  -  +  \ No newline at end of file diff --git a/windows/deploy/vamt-known-issues.md b/windows/deploy/vamt-known-issues.md index 0f65312a47..1e014a3e46 100644 --- a/windows/deploy/vamt-known-issues.md +++ b/windows/deploy/vamt-known-issues.md @@ -2,13 +2,15 @@ title: VAMT Known Issues (Windows 10) description: VAMT Known Issues ms.assetid: 8992f1f3-830a-4ce7-a248-f3a6377ab77f -ms.pagetype: activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- + # VAMT Known Issues + The following list contains the current known issues with the Volume Activation Management Tool (VAMT) 3.0. - The VAMT Windows Management Infrastructure (WMI) remote operations may take longer to execute if the target computer is in a sleep or standby state. - Recovery of Non-Genuine computers is a two-step process. VAMT can be used to install a new product key and activate the computer. However, the computer itself must visit the [Windows Genuine Advantage](http://go.microsoft.com/fwlink/p/?linkid=182914) Web site to revalidate the computer's Genuine status. Upon successfully completing this step, the computer will be restored to full functionality. For more information on recovering Non-Genuine Windows computers, go to [Windows Volume Activation](http://go.microsoft.com/fwlink/p/?linkid=184668). diff --git a/windows/deploy/vamt-requirements.md b/windows/deploy/vamt-requirements.md index 46a8e58887..9da49547b0 100644 --- a/windows/deploy/vamt-requirements.md +++ b/windows/deploy/vamt-requirements.md @@ -2,22 +2,30 @@ title: VAMT Requirements (Windows 10) description: VAMT Requirements ms.assetid: d14d152b-ab8a-43cb-a8fd-2279364007b9 -ms.pagetype: activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- + # VAMT Requirements + This topic includes info about the product key and system requirements for VAMT. + ## Product Key Requirements + The Volume Activation Management Tool (VAMT) can be used to perform activations using any of the following types of product keys. + |Product key type |Where to obtain | |-----------------|----------------| |

    • Multiple Activation Key (MAK)
    • Key Management Service (KMS) host key (CSVLK)
    • KMS client setup keys (GVLK)
    |Volume licensing keys can only be obtained with a signed contract from Microsoft. For more info, see the [Microsoft Volume Licensing portal](http://go.microsoft.com/fwlink/p/?LinkId=227282). | |Retail product keys |Obtained at time of product purchase. | + ## System Requirements + The following table lists the system requirements for the VAMT host computer. + |Item |Minimum system requirement | |-----|---------------------------| |Computer and Processor |1 GHz x86 or x64 processor | @@ -27,6 +35,8 @@ The following table lists the system requirements for the VAMT host computer. |Display |1024x768 or higher resolution monitor | |Network |Connectivity to remote computers via Windows® Management Instrumentation (TCP/IP) and Microsoft® Activation Web Service on the Internet via HTTPS | |Operating System |Windows 7, Windows 8, Windows 8.1, Windows 10, Windows Server 2008 R2, or Windows Server 2012. | -|Additional Requirements |
    • Connection to a SQL Server database. For more info, see [Install VAMT](install-vamt.md).
    • PowerShell 3.0: For Windows 8, Windows 8.1, Windows 10, and Windows Server® 2012, PowerShell is included in the installation. For previous versions of Windows and Windows Server, you must download PowerShell 3.0. To download PowerShell, go to [Download Windows PowerShell 3.0](http://go.microsoft.com/fwlink/p/?LinkId=218356).
    • If installing on Windows Server 2008 R2, you must also install .NET Framework 3.51.
    | +|Additional Requirements |
    • Connection to a SQL Server database. For more info, see [Install VAMT](install-vamt.md).
    • PowerShell 3.0: For Windows 8, Windows 8.1, Windows 10, and Windows Server® 2012, PowerShell is included in the installation. For previous versions of Windows and +Windows Server, you must download PowerShell 3.0. To download PowerShell, go to [Download Windows PowerShell 3.0](http://go.microsoft.com/fwlink/p/?LinkId=218356).
    • If installing on Windows Server 2008 R2, you must also install .NET Framework 3.51.
    | + ## Related topics - [Install and Configure VAMT](install-configure-vamt.md) diff --git a/windows/deploy/vamt-step-by-step.md b/windows/deploy/vamt-step-by-step.md index d9f71b34cf..e886684243 100644 --- a/windows/deploy/vamt-step-by-step.md +++ b/windows/deploy/vamt-step-by-step.md @@ -2,20 +2,25 @@ title: VAMT Step-by-Step Scenarios (Windows 10) description: VAMT Step-by-Step Scenarios ms.assetid: 455c542c-4860-4b57-a1f0-7e2d28e11a10 -ms.pagetype: activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- + # VAMT Step-by-Step Scenarios + This section provides step-by-step instructions on implementing the Volume Activation Management Tool (VAMT) in typical environments. VAMT supports many common scenarios; the scenarios in this section describe some of the most common to get you started. + ## In this Section + |Topic |Description | |------|------------| |[Scenario 1: Online Activation](scenario-online-activation-vamt.md) |Describes how to distribute Multiple Activation Keys (MAKs) to products installed on one or more connected computers within a network, and how to instruct these products to contact Microsoft over the Internet for activation. | |[Scenario 2: Proxy Activation](scenario-proxy-activation-vamt.md) |Describes how to use two VAMT host computers — the first one with Internet access and a second computer within an isolated workgroup — as proxies to perform MAK volume activation for workgroup computers that do not have Internet access. | |[Scenario 3: KMS Client Activation](scenario-kms-activation-vamt.md) |Describes how to use VAMT to configure client products for Key Management Service (KMS) activation. By default, volume license editions of Windows 10, Windows Vista, Windows® 7, Windows 8, Windows Server 2008, Windows Server 2008 R2, or Windows Server® 2012, and Microsoft® Office 2010 use KMS for activation. | + ## Related topics - [Introduction to VAMT](introduction-vamt.md)   diff --git a/windows/deploy/volume-activation-management-tool.md b/windows/deploy/volume-activation-management-tool.md index 74081bd755..04af72f880 100644 --- a/windows/deploy/volume-activation-management-tool.md +++ b/windows/deploy/volume-activation-management-tool.md @@ -2,13 +2,15 @@ title: Volume Activation Management Tool (VAMT) Technical Reference (Windows 10) description: The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office, and select other Microsoft products volume and retail-activation process. ms.assetid: 1df0f795-f41c-473b-850c-e98af1ad2f2a -ms.pagetype: activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- + # Volume Activation Management Tool (VAMT) Technical Reference + The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office, and select other Microsoft products volume and retail-activation process. VAMT can manage volume activation using Multiple Activation Keys (MAKs) or the Windows Key Management Service (KMS). VAMT is a standard Microsoft Management Console (MMC) snap-in that requires the Microsoft Management Console (MMC) 3.0. VAMT can be installed on any computer that has one of the following Windows operating systems: - Windows® 7 @@ -18,10 +20,15 @@ VAMT can manage volume activation using Multiple Activation Keys (MAKs) or the W - Windows Server 2008 R2 - Windows Server® 2012 - Windows Server 2012 R2 + **Important**   -VAMT is designed to manage volume activation for: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, Microsoft Office 2010, and Microsoft Office 2013. Computers installed with volume editions of **Windows XP** or **Windows Server 2003** cannot be managed using VAMT. However, Office 2010 and Office 2013 products installed on these two operating systems can still be managed. +VAMT is designed to manage volume activation for: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, Microsoft Office 2010, and Microsoft Office 2013. Computers installed with volume editions of +**Windows XP** or **Windows Server 2003** cannot be managed using VAMT. However, Office 2010 and Office 2013 products installed on these two operating systems can still be managed. + VAMT is only available in an EN-US (x86) package. + ## In this Section + |Topic |Description | |------|------------| |[Introduction to VAMT](introduction-vamt.md) |Provides a description of VAMT and common usages. | @@ -33,6 +40,4 @@ VAMT is only available in an EN-US (x86) package. |[Manage VAMT Data](manage-vamt-data.md) |Describes how to save, import, export, and merge a Computer Information List (CILX) file using VAMT. | |[VAMT Step-by-Step Scenarios](vamt-step-by-step.md) |Provides step-by-step instructions for using VAMT in typical environments. | |[VAMT Known Issues](vamt-known-issues.md) |Lists known issues in VAMT. | -  -  -  +  \ No newline at end of file diff --git a/windows/deploy/volume-activation-windows-10.md b/windows/deploy/volume-activation-windows-10.md index 937ba0175c..e57043d4ca 100644 --- a/windows/deploy/volume-activation-windows-10.md +++ b/windows/deploy/volume-activation-windows-10.md @@ -2,14 +2,16 @@ title: Volume Activation for Windows 10 (Windows 10) description: This guide is designed to help organizations that are planning to use volume activation to deploy and activate Windows 10, including organizations that have used volume activation for earlier versions of Windows. ms.assetid: 6e8cffae-7322-4fd3-882a-cde68187aef2 -ms.pagetype: activation -keywords: ["vamt", "volume activation", "activation", "windows activation"] +keywords: vamt, volume activation, activation, windows activation ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: activation author: jdeckerMS --- + # Volume Activation for Windows 10 + **Applies to** - Windows 10 - Windows 8.1 @@ -18,17 +20,27 @@ author: jdeckerMS - Windows Server 2012 R2 - Windows Server 2012 - Windows Server 2008 R2 + **Looking for volume licensing information?** - [Download the Volume Licensing Reference Guide for Windows 10 Desktop Operating System](http://go.microsoft.com/fwlink/p/?LinkId=620104) + **Looking for retail activation?** - [Get Help Activating Microsoft Windows](http://go.microsoft.com/fwlink/p/?LinkId=618644) + This guide is designed to help organizations that are planning to use volume activation to deploy and activate Windows 10, including organizations that have used volume activation for earlier versions of Windows. *Volume activation* is the process that Microsoft volume licensing customers use to automate and manage the activation of Windows operating systems, Microsoft Office, and other Microsoft products across large organizations. Volume licensing is available to customers who purchase software under various volume programs (such as Open and Select) and to participants in programs such as the Microsoft Partner Program and MSDN Subscriptions. + Volume activation is a configurable solution that helps automate and manage the product activation process on computers running Windows operating systems that have been licensed under a volume licensing program. Volume activation is also used with other software from Microsoft (most notably the Office suites) that are sold under volume licensing agreements and that support volume activation. + This guide provides information and step-by-step guidance to help you choose a volume activation method that suits your environment, and then to configure that solution successfully. This guide describes the volume activation features that are available in Windows 10 and Windows Server 2012 R2 and the tools that are provided in these versions of Windows and Windows Server to manage volume activation. -Because most organizations will not immediately switch all computers to Windows 10, practical volume activation strategies must also take in to account how to work with the Windows 8, Windows 7, Windows Server 2012, and Windows Server 2008 R2Windows Server 2008 R2 operating systems. This guide discusses how the new volume activation tools can support earlier operating systems, but it does not discuss the tools that are provided with earlier operating system versions. + +Because most organizations will not immediately switch all computers to Windows 10, practical volume activation strategies must also take in to account how to work with the Windows 8, Windows 7, Windows Server 2012, and Windows Server 2008 R2Windows Server 2008 R2 operating systems. This guide +discusses how the new volume activation tools can support earlier operating systems, but it does not discuss the tools that are provided with earlier operating system versions. + Volume activation—and the need for activation itself—is not new, and this guide does not review all of its concepts and history. You can find additional background in the appendices of this guide. For more information, see [Volume Activation Overview](http://go.microsoft.com/fwlink/p/?LinkId=618209) in the TechNet Library. + If you would like additional information about planning a volume activation deployment specifically for Windows 7 and Windows Server 2008 R2, please see the [Volume Activation Planning Guide for Windows 7](http://go.microsoft.com/fwlink/p/?LinkId=618210). + To successfully plan and implement a volume activation strategy, you must: - Learn about and understand product activation. - Review and evaluate the available activation types or models. @@ -37,7 +49,9 @@ To successfully plan and implement a volume activation strategy, you must: - Determine the types and number of product keys you will need. - Determine the monitoring and reporting needs in your organization. - Install and configure the tools required to support the methods selected. + Keep in mind that the method of activation does not change an organization’s responsibility to the licensing requirements. You must ensure that all software used in your organization is properly licensed and activated in accordance with the terms of the licensing agreements in place. + **In this guide:** - [Plan for volume activation](plan-for-volume-activation-client.md) - [Activate using Key Management Service](activate-using-key-management-service-vamt.md) @@ -46,5 +60,4 @@ Keep in mind that the method of activation does not change an organization’s r - [Monitor activation](monitor-activation-client.md) - [Use the Volume Activation Management Tool](use-the-volume-activation-management-tool-client.md) - [Appendix: Information sent to Microsoft during activation](appendix-information-sent-to-microsoft-during-activation-client.md) -  -  +  \ No newline at end of file diff --git a/windows/whats-new/trusted-platform-module.md b/windows/whats-new/trusted-platform-module.md index 63176f7c02..34233ef3a4 100644 --- a/windows/whats-new/trusted-platform-module.md +++ b/windows/whats-new/trusted-platform-module.md @@ -2,32 +2,42 @@ title: What's new in Trusted Platform Module (Windows 10) description: This topic for the IT professional describes new features for the Trusted Platform Module (TPM) in Windows 10. ms.assetid: CE8BBC2A-EE2D-4DFA-958E-2A178F2E6C44 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: explore ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # What's new in Trusted Platform Module? + **Applies to** - Windows 10 - Windows 10 Mobile + This topic for the IT professional describes new features for the Trusted Platform Module (TPM) in Windows 10. + ## New features in Windows 10, version 1511 + - Key Storage Providers (KSPs) and srvcrypt support elliptical curve cryptography (ECC). + ## New features in Windows 10 + The following sections describe the new and changed functionality in the TPM for Windows 10: - [Device health attestation](#bkmk-dha) - [Microsoft Passport](microsoft-passport.md) support - [Device Guard](device-guard-overview.md) support - [Credential Guard](credential-guard.md) support + ## Device health attestation + Device health attestation enables enterprises to establish trust based on hardware and software components of a managed device. With device heath attestation, you can configure an MDM server to query a health attestation service that will allow or deny a managed device access to a secure resource. Some things that you can check on the device are: - Is Data Execution Prevention supported and enabled? - Is BitLocker Drive Encryption supported and enabled? - Is SecureBoot supported and enabled? -**Note**  The device must be running Windows 10 and it must support at least TPM 2.0. + +> **Note**  The device must be running Windows 10 and it must support at least TPM 2.0.   [Learn how to deploy and manage TPM within your organization](../keep-secure/trusted-platform-module-overview.md).   From 590efeee460c1438cec3cb058d43bfd6f8049cad Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 18 May 2016 16:00:50 -0700 Subject: [PATCH 319/439] fixing spacing issues --- ...on-development-for-windows-as-a-service.md | 59 ++++++++++- windows/manage/index.md | 8 +- .../introduction-to-windows-10-servicing.md | 98 ++++++++++++++++++- 3 files changed, 155 insertions(+), 10 deletions(-) diff --git a/windows/manage/application-development-for-windows-as-a-service.md b/windows/manage/application-development-for-windows-as-a-service.md index 1e068642c7..69df22ff69 100644 --- a/windows/manage/application-development-for-windows-as-a-service.md +++ b/windows/manage/application-development-for-windows-as-a-service.md @@ -2,25 +2,35 @@ title: Application development for Windows as a service (Windows 10) description: In today’s environment, where user expectations frequently are set by device-centric experiences, complete product cycles need to be measured in months, not years. ms.assetid: 28E0D103-B0EE-4B14-8680-6F30BD373ACF -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library +ms.pagetype: security author: jdeckerMS --- + # Application development for Windows as a service + **Applies to** - Windows 10 - Windows 10 Mobile - Windows 10 IoT Core (IoT Core) + In today’s environment, where user expectations frequently are set by device-centric experiences, complete product cycles need to be measured in months, not years. Additionally, new releases must be made available on a continual basis, and must be deployable with minimal impact on users. Microsoft designed Windows 10 to meet these requirements by implementing a new approach to innovation, development, and delivery called [Windows as a service (WaaS)](introduction-to-windows-10-servicing.md). The key to enabling significantly shorter product cycles while maintaining high quality levels is an innovative community-centric approach to testing that Microsoft has implemented for Windows 10. The community, known as Windows Insiders, is comprised of millions of users around the world. When Windows Insiders opt in to the community, they test many builds over the course of a product cycle and provide feedback to Microsoft through an iterative methodology called flighting. + Builds distributed as flights provide the Windows engineering team with significant data regarding how well builds are performing in actual use. Flighting with Windows Insiders also enables Microsoft to test builds in much more diverse hardware, application, and networking environments than in the past, and to identify issues far more quickly. As a result, Microsoft believes that community-focused flighting will enable both a faster pace of innovation delivery and better public release quality than ever. + ## Windows 10 release types and cadences + Although Microsoft releases flight builds to Windows Insiders, Microsoft will publish two types of Windows 10 releases broadly to the public on an ongoing basis: + **Feature updates** install the latest new features, experiences, and capabilities on devices that are already running Windows 10. Because feature updates contain an entire copy of Windows, they are also what customers use to install Windows 10 on existing devices running Windows 7 or Windows 8.1, and on new devices where no operating system is installed. Microsoft expects to publish an average of one to two new feature updates per year. **Quality updates** deliver security issue resolutions and other important bug fixes. Quality updates will be provided to improve each feature currently in support, on a cadence of one or more times per month. Microsoft will continue publishing quality updates on Update Tuesday (sometimes referred to as Patch Tuesday). Additionally, Microsoft may publish additional quality updates for Windows 10 outside the Update Tuesday process when required to address customer needs. + During Windows 10 development, Microsoft streamlined the Windows product engineering and release cycle so that we can deliver the features, experiences, and functionality customers want, more quickly than ever. We also created new ways to deliver and install feature updates and quality updates that simplify deployments and on-going management, broaden the base of employees who can be kept current with the latest Windows capabilities and experiences, and lower total cost of ownership. Hence we have implemented new servicing options – referred to as Current Branch (CB), Current Branch for Business (CBB), and Long-Term Servicing Branch (LTSB) – that provide pragmatic solutions to keep more devices more current in enterprise environments than was previously possible. + The following table shows describes the various servicing branches and their key attributes. + | Servicing option | Availability of new feature upgrades for installation | Minimum length of servicing lifetime | Key benefits | Supported editions | |-----------------------------------|-----------------------------------------------------------|--------------------------------------|-------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------| | Current Branch (CB) | Immediately after first published by Microsoft | Approximately 4 months | Makes new features available to users as soon as possible | Home, Pro, Education, Enterprise, Mobile, IoT Core, Windows 10 IoT Core Pro (IoT Core Pro) | @@ -28,56 +38,87 @@ The following table shows describes the various servicing branches and their key | Long-Term Servicing Branch (LTSB) | Immediately after published by Microsoft | 10 Years | Enables long-term deployment of selected Windows 10 releases in low-change configurations | Enterprise LTSB |   For more information, see [Windows 10 servicing options for updates and upgrades](introduction-to-windows-10-servicing.md). + ## Supporting apps in Windows as a service + The traditional approach for supporting apps has been to release a new app version in response to a Windows release. This assumes that there are breaking changes in the underlying OS that could potentially cause a regression with the application. This model involves a dedicated development and validation cycle that requires our ISV partners to align with the Windows release cadence. + In the Windows as a service model, Microsoft is making a commitment to maintaining the compatibility of the underlying OS. This means Microsoft will make a concerted effort to ensure that there are no breaking changes that impact the app ecosystem negatively. In this scenario, when there is a release of a Windows build, most apps (those with no kernel dependencies) will continue to work. + In view of this change, Microsoft recommends that our ISV partners decouple their app release and support from specific Windows builds. Our mutual customers are better served by an application lifecycle approach. This means when an application version is released it will be supported for a certain period of time irrespective of however many Windows builds are released in the interim. The ISV makes a commitment to provide support for that specific version of the app as long as it is supported in the lifecycle. Microsoft follows a similar lifecycle approach for Windows that can be referenced [here](http://go.microsoft.com/fwlink/?LinkID=780549). + This approach will reduce the burden of maintaining an app schedule that aligns with Windows releases. ISV partners should be free to release features or updates at their own cadence. We feel that our partners can keep their customer base updated with the latest app updates independent of a Windows release. In addition, our customers do not have to seek an explicit support statement whenever a Windows build is released. Here is an example of a support statement that covers how an app may be supported across different versions of the OS: + | Example of an application lifecycle support statement | |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Contoso is a software development company and is the owner of the popular Mojave app which has a major share in the enterprise space. Contoso releases its next major release Mojave 14.0 and declares mainstream support for a period of three years from the release date. During mainstream support all updates and support are complimentary for the licensed product. Contoso also declares an additional two years of extended support where customers can purchase updates and support for a grace period. Beyond the extended support end date this product version is no longer supported. During the period of mainstream support Contoso will support Mojave 14.0 on all released builds of Windows. Contoso will also release updates to Mojave as necessary and independent of the Windows product releases. |   In the following sections, you will find additional information about the steps Microsoft takes to maintain the compatibility of the underlying OS. You will also find guidance on steps you can take to help maintain the compatibility of the combined OS and app ecosystem. There is a section on how to leverage Windows flighting builds to detect app regressions before a Windows build is released. Lastly, we describe how we use an instrumentation and telemetry-driven approach to increase the quality of Windows builds. We recommend ISVs adopt a similar approach with their app portfolio. + ## Key changes since Windows 7 to ensure app compatibility -We understand that compatibility matters to developers. ISVs and developers want to ensure their apps will run as expected on all supported versions of the Windows OS. Consumers and businesses have a key investment here—they want to ensure that the apps they have paid for will continue to work. We know that compatibility is the primary criteria for purchase decisions. Apps that are well written based on best practices will lead to much less code churn when a new Windows version is released and will reduce fragmentation—these apps have a reduced engineering investment to maintain, and a faster time to market. -In the Windows 7 timeframe, compatibility was very much a reactive approach. In Windows 8 we started looking at this differently, working within Windows to ensure that compatibility was by design rather than an afterthought. Windows 10 is the most compatible-by-design version of the OS to date. Here are some key ways we accomplished this: + +We understand that compatibility matters to developers. ISVs and developers want to ensure their apps will run as expected on all supported versions of the Windows OS. Consumers and businesses have a key investment here—they want to ensure that the apps they have paid for will continue to work. We know that compatibility is the primary criteria for purchase decisions. Apps that are well written based on best practices will lead to much less code churn when +a new Windows version is released and will reduce fragmentation—these apps have a reduced engineering investment to maintain, and a faster time to market. + +In the Windows 7 timeframe, compatibility was very much a reactive approach. In Windows 8 we started looking at this differently, working within Windows to ensure that compatibility was by design rather than an afterthought. +Windows 10 is the most compatible-by-design version of the OS to date. Here are some key ways we accomplished this: - **App telemetry**: This helps us understand app popularity in the Windows ecosystem to inform compatibility testing. - **ISV partnerships**: Work directly with external partners to provide them with data and help fix issues that our users experience. - **Design reviews, upstream detection**: Partner with feature teams to reduce the number of breaking changes in Windows. Compatibility review is a gate that our feature teams must pass. - **Communication**: Tighter control over API changes and improved communication. - **Flighting and feedback loop**: Windows insiders receive flighted builds that help improve our ability to find compatibility issues before a final build is released to customers. This feedback process not only exposes bugs, but ensures we are shipping features our users want. + ## Microsoft uses data to make Windows 10 better + Microsoft uses diagnostic and usage data to identify and troubleshoot problems, improve our products and services, and provide our users with personalized experiences. The usage data we collect also extends to the apps that PCs in the Windows ecosystem are running. Based on what our customers use, we build our list to test these apps, devices, and drivers against new versions of the Windows OS. Windows 10 has been the most compatible version of Windows to-date, with over 90% compatibility against thousands of popular apps. The Windows Compatibility team commonly reaches out to our ISV partners to provide feedback if issues are discovered, so that we can partner together on solutions. Ideally, we’d like our common customers to be able to update Windows seamlessly and without losing functionality in either their OS or the apps they depend on for their productivity or entertainment. + The following sections contain some best practices Microsoft recommends so you can ensure your apps are compatible with Windows 10. + **Windows version check** + The OS version has been incremented with Windows 10. This means that the internal version number has been changed to 10.0. As in the past, we go to great lengths to maintain application and device compatibility after an OS version change. For most app categories (without any kernel dependencies) the change will not negatively impact app functionality, and existing apps will continue to work fine on Windows 10. + The manifestation of this change is app-specific. This means any app that specifically checks for the OS version will get a higher version number, which can lead to one or more of the following situations: - App installers might not be able to install the app, and apps might not be able to start. - Apps might become unstable or crash. - Apps might generate error messages, but continue to function properly. + Some apps perform a version check and simply pass a warning to users. However, there are apps that are bound very tightly to a version check (in the drivers, or in kernel mode to avoid detection). In these cases, the app will fail if an incorrect version is found. Rather than a version check, we recommend one of the following approaches: - If the app is dependent on specific API functionality, ensure you target the correct API version. - Ensure you detect the change via APISet or another public API, and do not use the version as a proxy for some feature or fix. If there are breaking changes and a proper check is not exposed, then that is a bug. - Ensure the app does NOT check for version in odd ways, such as via the registry, file versions, offsets, kernel mode, drivers, or other means. If the app absolutely needs to check the version, use the GetVersion APIs, which should return the major, minor, and build number. - If you are using the [GetVersion](http://go.microsoft.com/fwlink/?LinkID=780555) API, remember that the behavior of this API has changed since Windows 8.1. + If you own apps such as antimalware or firewall apps, you should work through your usual feedback channels and via the Windows Insider program. + **Undocumented APIs** Your apps should not call undocumented Windows APIs, or take dependency on specific Windows file exports or registry keys. This can lead to broken functionality, data loss, and potential security issues. If there is functionality your app requires that is not available, this is an opportunity to provide feedback through your usual feedback channels and via the Windows Insider program. + **Develop Universal Windows Platform (UWP) and Centennial apps** + We encourage all Win32 app ISVs to develop [Universal Windows Platform (UWP)](http://go.microsoft.com/fwlink/?LinkID=780560) and, specifically, [Centennial](http://go.microsoft.com/fwlink/?LinkID=780562) apps moving forward. There are great benefits to developing these app packages rather than using traditional Win32 installers. UWP apps are also supported in the [Windows Store](http://go.microsoft.com/fwlink/?LinkID=780563), so it’s easier for you to update your users to a consistent version automatically, lowering your support costs. + If your Win32 app types do not work with the Centennial model, we highly recommend that you use the right installer and ensure this is fully tested. An installer is your user or customer’s first experience with your app, so ensure that this works well. All too often, this doesn’t work well or it hasn’t been fully tested for all scenarios. The [Windows App Certification Kit](http://go.microsoft.com/fwlink/?LinkID=780565) can help you test the install and uninstall of your Win32 app and help you identify use of undocumented APIs, as well as other basic performance-related best-practice issues, before your users do. + **Best pratcices:** - Use installers that work for both 32-bit and 64-bit versions of Windows. - Design your installers to run on multiple scenarios (user or machine level). - Keep all Windows redistributables in the original packaging – if you repackage these, it’s possible that this will break the installer. - Schedule development time for your installers—these are often overlooked as a deliverable during the software development lifecycle. + ## Optimized test strategies and flighting + Windows OS flighting refers to the interim builds available to Windows Insiders before a final build is released to the general population. The more Insiders that flight these interim builds, the more feedback we receive on the build quality, compatibility, etc., and this helps improve quality of the final builds. You can participate in this flighting program to ensure that your apps work as expected on iterative builds of the OS. We also encourage you to provide feedback on how these flighted builds are working for you, issues you run into, and so on. + If your app is in the Store, you can flight your app via the Store, which means that your app will be available for our Windows Insider population to install. Users can install your app and you can receive preliminary feedback on your app before you release it to the general population. The follow sections outline the steps for testing your apps against Windows flighted builds. + **Step 1: Become a Windows Insider and participate in flighting** As a [Windows Insider,](http://go.microsoft.com/fwlink/p/?LinkId=521639) you can help shape the future of Windows—your feedback will help us improve features and functionality in the platform. This is a vibrant community where you can connect with other enthusiasts, join forums, trade advice, and learn about upcoming Insider-only events. + Since you’ll have access to preview builds of Windows 10, Windows 10 Mobile, and the latest Windows SDK and Emulator, you’ll have all the tools at your disposal to develop great apps and explore what's new in the Universal Windows Platform and the Windows Store. + This is also a great opportunity to build great hardware, with preview builds of the hardware development kits so you can develop universal drivers for Windows. The IoT Core Insider Preview is also available on supported IoT development boards, so you can build amazing connected solutions using the Universal Windows Platform. + Before you become a Windows Insider, please note that participation is intended for users who: - Want to try out software that’s still in development. - Want to share feedback about the software and the platform. @@ -85,11 +126,17 @@ Before you become a Windows Insider, please note that participation is intended - Really know their way around a PC and feel comfortable troubleshooting problems, backing up data, formatting a hard drive, installing an operating system from scratch, or restoring an old one if necessary. - Know what an ISO file is and how to use it. - Aren't installing it on their everyday computer or device. + **Step 2: Test your scenarios** + Once you have updated to a flighted build, the following are some sample test cases to help you get started on testing and gathering feedback. For most of these tests, ensure you cover both x86 and AMD64 systems. -**Clean install test:** On a clean install of Windows 10, ensure your app is fully functional. If your app fails this test and the upgrade test, then it’s likely that the issue is caused by underlying OS changes or bugs in the app. If after investigation, the former is the case, be sure to use the Windows Insider program to provide feedback and partner on solutions. +**Clean install test:** On a clean install of Windows 10, ensure your app is fully functional. If your app fails this test and the upgrade test, then it’s likely that the issue is caused by underlying OS changes or bugs in the app. +If after investigation, the former is the case, be sure to use the Windows Insider program to provide feedback and partner on solutions. + **Upgrade Test:** Check that your app works after upgrading from a down-level version of Windows (i.e. Windows 7 or Windows 8.1) to Windows 10. Your app shouldn’t cause roll backs during upgrade, and should continue to work as expected after upgrade—this is crucial to achieve a seamless upgrade experience. + **Reinstall Test:** Ensure that app functionality can be restored by reinstalling your app after you upgrade the PC to Windows 10 from a down-level OS. If your app didn’t pass the upgrade test and you have not been able to narrow down the cause of these issues, it’s possible that a reinstall can restore lost functionality. A passing reinstall test indicates that parts of the app may not have been migrated to Windows 10. + **OS\\Device Features Test:** Ensure that your app works as expected if your app relies on specific functionality in the OS. Common areas for testing include the following, often against a selection of the commonly used PC models to ensure coverage: - Audio - USB device functionality (keyboard, mouse, memory stick, external hard disk, and so on) @@ -101,10 +148,14 @@ Once you have updated to a flighted build, the following are some sample test ca - Print\\Scan - Sensors (accelerometer, fusion, and so on) - Camera + **Step 3: Provide feedback** + Let us know how your app is performing against flighted builds. As you discover issues with your app during testing, please log bugs via the partner portal if you have access, or through your Microsoft representative. We encourage this information so that we can build a quality experience for our users together. + **Step 4: Register on Windows 10** The [Ready for Windows 10](http://go.microsoft.com/fwlink/?LinkID=780580) website is a directory of software that supports Windows 10. It’s intended for IT administrators at companies and organizations worldwide that are considering Windows 10 for their deployments. IT administrators can check the site to see whether software deployed in their enterprise is supported in Windows 10. + ## Related topics [Windows 10 servicing options for updates and upgrades](introduction-to-windows-10-servicing.md)   diff --git a/windows/manage/index.md b/windows/manage/index.md index fff9fb7281..e6aff0c940 100644 --- a/windows/manage/index.md +++ b/windows/manage/index.md @@ -2,16 +2,20 @@ title: Manage and update Windows 10 (Windows 10) description: Learn about managing and updating Windows 10. ms.assetid: E5716355-02AB-4B75-A962-14B1A7F7BDA0 -ms.pagetype: security -keywords: ["Windows 10", "MDM", "WSUS", "Windows update"] +keywords: Windows 10, MDM, WSUS, Windows update ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library +ms.pagetype: security author: jdeckerMS --- + # Manage and update Windows 10 + Learn about managing and updating Windows 10. + ## In this section +
    diff --git a/windows/manage/introduction-to-windows-10-servicing.md b/windows/manage/introduction-to-windows-10-servicing.md index a22f5bb81f..cbc3a2f1b1 100644 --- a/windows/manage/introduction-to-windows-10-servicing.md +++ b/windows/manage/introduction-to-windows-10-servicing.md @@ -2,29 +2,37 @@ title: Windows 10 servicing options for updates and upgrades (Windows 10) description: This article describes the new servicing options available in Windows 10. ms.assetid: D1DEB7C0-283F-4D7F-9A11-EE16CB242B42 -ms.pagetype: security -keywords: ["update", "LTSB", "lifecycle", "Windows update", "upgrade"] +keywords: update, LTSB, lifecycle, Windows update, upgrade ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library +ms.pagetype: security author: jdeckerMS --- + # Windows 10 servicing options for updates and upgrades + **Applies to** - Windows 10 - Windows 10 Mobile - Windows 10 IoT Core (IoT Core) + This article describes the new servicing options available in Windows 10, Windows 10 Mobile, and IoT Core and how they enable enterprises to keep their devices current with the latest feature upgrades. It also covers related topics, such as how enterprises can make better use of Windows Update, and what the new servicing options mean for support lifecycles. + **Note**   Several of the figures in this article show multiple feature upgrades of Windows being released by Microsoft over time. Be aware that these figures were created with dates that were chosen for illustrative clarity, not for release roadmap accuracy, and should not be used for planning purposes.   ## Introduction + In enterprise IT environments, the desire to provide users with the latest technologies needs to be balanced with the need for manageability and cost control. In the past, many enterprises managed their Windows deployments homogeneously and performed large-scale upgrades to new releases of Windows (often in parallel with large-scale hardware upgrades) about every three to six years. Today, the rapid evolution of Windows as a platform for device-like experiences is causing businesses to rethink their upgrade strategies. Especially with the release of Windows 10, there are good business reasons to keep a significant portion of your enterprise's devices *current* with the latest release of Windows. For example, during the development of Windows 10, Microsoft: - Streamlined the Windows product engineering and release cycle so that Microsoft can deliver the features, experiences, and functionality customers want, more quickly than ever. - Created new ways to deliver and install feature upgrades and servicing updates that simplify deployments and on-going management, broaden the base of employees who can be kept current with the latest Windows capabilities and experiences, and lower total cost of ownership. - Implemented new servicing options – referred to as Current Branch (CB), Current Branch for Business (CBB), and Long-Term Servicing Branch (LTSB) – that provide pragmatic solutions to keep more devices more current in enterprise environments than was previously possible. + The remainder of this article provides additional information about each of these areas. This article also provides an overview of the planning implications of the three Windows 10 servicing options (summarized in Table 1) so that IT administrators can be well-grounded conceptually before they start a Windows 10 deployment project. + Table 1. Windows 10 servicing options + | Servicing option | Availability of new feature upgrades for installation | Minimum length of servicing lifetime | Key benefits | Supported editions | |-----------------------------------|-----------------------------------------------------------|--------------------------------------|-------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------| | Current Branch (CB) | Immediately after first published by Microsoft | Approximately 4 months | Makes new features available to users as soon as possible | Home, Pro, Education, Enterprise, Mobile, IoT Core, Windows 10 IoT Core Pro (IoT Core Pro) | @@ -32,121 +40,200 @@ Table 1. Windows 10 servicing options | Long-Term Servicing Branch (LTSB) | Immediately after published by Microsoft | 10 Years | Enables long-term deployment of selected Windows 10 releases in low-change configurations | Enterprise LTSB |   ## Streamlined product development and release cycles + **Product cycles and builds** + The Windows engineering team adds new features and functionality to Windows through *product cycles* comprised of development, testing, and release phases. Each day during a product cycle, the team compiles the source code for Windows and assembles the output into a *build* that users can install on their devices. The first recipients of builds are Microsoft employees who begin what Microsoft calls *selfhost* testing. + **Testing and release prior to Windows 10** + Prior to Windows 10, Microsoft issued and extensively tested many builds internally before selecting one for testing outside Microsoft. After repeating the external test cycle several times against builds of progressively better quality, the engineering team selected a build to enter the release phase. At the end of this phase, the team published the build as a new version of Windows – an event referred to as the *Release to Manufacturing* (RTM) milestone. In total, product cycles took between one and three years to complete, with testing and release processes taking up as much as half of the total investment in time. + **A different approach for Windows 10** + In today’s environment, where user expectations frequently are set by device-centric experiences, complete product cycles need to be measured in months, not years. Additionally, new releases must be made available on a continual basis, and must be deployable with minimal impact on users. Microsoft designed Windows 10 to meet these requirements by implementing a new approach to innovation development and delivery called *Windows as a Service* (WaaS). The key to enabling significantly shorter product cycles while maintaining high quality levels is an innovative community-centric approach to testing that Microsoft has implemented for Windows 10. The community, known as Windows Insiders, is comprised of millions of users around the world. When Windows Insiders opt in to the community, they test many builds over the course of a product cycle, and provide feedback to Microsoft through an iterative methodology called *flighting*. Builds distributed as *flights* provide the Windows engineering team with significant data regarding how well builds are performing in actual use. Flighting with Windows Insiders also enables Microsoft to test builds in much more diverse hardware, application, and networking environments than in the past, and to identify issues far more quickly. As a result, Microsoft believes that community-focused flighting will enable both a faster pace of innovation delivery, and better public release quality than ever. + **Windows 10 release types and cadences** + Although Microsoft releases flight builds to Windows Insiders, Microsoft will publish two types of Windows 10 releases broadly to the public on an ongoing basis: - **Feature upgrades** that install the latest new features, experiences, and capabilities on devices that are already running Windows 10. Because feature upgrades contain an entire copy of Windows, they are also what customers use to install Windows 10 on existing devices running Windows 7 or Windows 8.1, and on new devices where no operating system is installed. - **Servicing updates** that focus on the installation of security fixes and other important updates. Microsoft expects to publish an average of two to three new feature upgrades per year, and to publish servicing updates as needed for any feature upgrades that are still in support. Microsoft will continue publishing servicing updates on Update Tuesday (sometimes referred to as Patch Tuesday). Additionally, Microsoft may publish additional servicing updates for Windows 10 outside the Update Tuesday process when required to address customer needs. + **The cumulative nature of all Windows 10 releases** It is important to note that, in order to improve release quality and simplify deployments, all new releases that Microsoft publishes for Windows 10 will be *cumulative*. This means new feature upgrades and servicing updates will contain the *payloads* of all previous releases (in an optimized form to reduce storage and networking requirements), and installing the release on a device will bring it completely up to date. Also, unlike earlier versions of Windows, you cannot install a subset of the contents of a Windows 10 servicing update. For example, if a servicing update contains fixes for three security vulnerabilities and one reliability issue, deploying the update will result in the installation of all four fixes.   + ## New Windows 10 delivery and installation alternatives + As with earlier releases of Windows, Windows 10 includes support for the deployment of new releases using Windows Update, Windows Server Update Services, System Center Configuration Manager, and third-party configuration management tools. Because of the importance of the Windows as a Service (WaaS) approach to delivering innovations to businesses, and the proven ability of Windows Update to deploy releases quickly and seamlessly to consumers and small businesses, several of the largest investments in Windows 10 focus on enabling broader use of Windows Update within enterprises. + **Windows Update use by consumers and small businesses** + Since Microsoft introduced the first generation of Windows Update with Windows 95, Windows Update has evolved to become the standard way for consumers and small businesses to help keep devices running Windows secure and running reliably. Almost one billion Windows devices communicate with the Windows Update service on a regular basis. The process of downloading and installing updates has evolved to be less and less obtrusive to users. More recently, Microsoft also has used Windows Update to deliver larger, feature-centric updates, such as the upgrade from Windows 8 to Windows 8.1, and is using Windows Update to upgrade devices running Windows 7 and Windows 8.1 to Windows 10. + **Windows Update use within enterprises** + Although Windows Update greatly simplifies and accelerates update deployment, enterprises are not using Windows Update as broadly as consumers and small businesses. This is largely because Windows Update maintains control over which updates are installed and the timing of installation. This makes it difficult for IT administrators to test updates before deployment in their specific environment. + **The role of Windows Server Update Services** + To help address the concerns of IT administrators, Microsoft released Windows Server Update Services in 2005. Windows Server Update Services enables IT administrators to obtain the updates that Windows Update determines are applicable to the devices in their enterprise, perform additional testing and evaluation on the updates, and select the updates they want to install. Windows Server Update Services also provides IT administrators with an all or nothing way to specify when they want an approved update to be installed. Because IT administrators ultimately select and install most updates identified by Windows Update, the role of Windows Server Update Services in many enterprises is to provide IT administrators with the additional time they need to gain confidence in the quality of updates prior to deployment. + **New Windows Update capabilities in Windows 10** + To enable enterprises to manage more of their devices using Windows Update directly, Windows 10 provides IT administrators with a way to configure devices so that Windows Update will defer new feature upgrade installations until approximately four months after Microsoft first publishes them. The additional time can be used to perform testing or enable releases to gain additional time in market prior to deployment. At the end of each approximately four month period, Microsoft executes a set of processes that require no action from enterprise IT administrators. First, Microsoft creates new installation media for the feature upgrade by combining the original installation media with all the servicing updates published by Microsoft since the original media’s release. This reduces the time it can take to install a feature upgrade on a device. Second, Microsoft *republishes* the new media to Windows Update with *targeting* instructions that state (in effect) “install this media on devices that are configured for deferred installation of new feature upgrades.” At this point, devices configured to defer installation will begin receiving and installing the feature upgrade automatically. + **The role of Windows Update for Business** + Although Windows 10 will enable IT administrators to defer installation of new feature upgrades using Windows Update, enterprises may also want additional control over how and when Windows Update installs releases. With this need in mind, Microsoft [announced Windows Update for Business](http://go.microsoft.com/fwlink/p/?LinkId=624798) in May of 2015. Microsoft designed Windows Update for Business to provide IT administrators with additional Windows Update-centric management capabilities, such as the ability to deploy updates to groups of devices and to define maintenance windows for installing releases. This article will be updated with additional information about the role of Windows Update for Business in servicing Windows 10 devices as it becomes available. + ## Windows 10 servicing options + Historically, because of the length of time between releases of new Windows versions, and the relatively low number of enterprise devices that were upgraded to newer versions of Windows during their deployment lifetimes, most IT administrators defined servicing as installing the updates that Microsoft published every month. Looking forward, because Microsoft will be publishing new feature upgrades on a continual basis, *servicing* will also include (on some portion of an enterprise's devices) installing new feature upgrades as they become available. In fact, when planning to deploy Windows 10 on a device, one of the most important questions for IT administrators to ask is, “What should happen to this device when Microsoft publishes a new feature upgrade?” This is because Microsoft designed Windows 10 to provide businesses with multiple servicing options, centered on enabling different rates of feature upgrade adoption. In particular, IT administrators can configure Windows 10 devices to: - Receive feature upgrades immediately after Microsoft makes them available publicly, so that users gain access to new features, experiences, and functionality as soon as possible. For more information, see [Immediate feature upgrade installation with Current Branch (CB) servicing](#immediate-upgrade-cb). - Defer receiving feature upgrades for a period of approximately four months after Microsoft makes them available publicly, to provide IT administrators with time to perform pre-deployment testing and provide feature upgrades releases with additional time-in-market to mature. For more information, see [Deferred feature upgrade installation with Current Branch for Business (CBB) servicing](#deferred-upgrade-cbb). - Receive only servicing updates for the duration of their Windows 10 deployment in order to reduce the number of non-essential changes made to the device. For more information, see [Install servicing updates only by using Long-Term Servicing Branch (LTSB) servicing](#install-updates-ltsb). The breakout of a company’s devices by the categories above is likely to vary significantly by industry and other factors. What is most important is that companies can decide what works best for them and can choose different options for different devices. + ## Plan for Windows 10 deployment + The remainder of this article focuses on the description of the three options outlined above, and their planning implications, in more detail. In practice, IT administrators have to focus on two areas when planning a Windows 10 device deployment: - **When should new feature upgrades be deployed?** Should the device install new feature upgrades when they are published by Microsoft? If so, should installation occur immediately or on a deferred basis? -- **How will releases be installed on devices?** Will Windows Update or Windows Server Update Services be used to install new releases, or will installation be performed using a configuration management system such as Configuration Manager? +- **How will releases be installed on devices?** Will Windows Update or Windows Server Update Services be used to install new releases, or will installation be performed using a configuration management system such as +Configuration Manager? + The content that follows will provide IT administrators with the context needed to understand why these areas are pivotal, and the choices available to them. + **How Microsoft releases Windows 10 feature upgrades** + When it is time to release a build as a new feature upgrade for Windows 10, Microsoft performs several processes in sequence. The first process involves creating either one or two servicing branches in a source code management system. These branches (shown in Figure 1) are required to produce feature upgrade installation media and servicing update packages that can be deployed on different Windows 10 editions, running in different configurations. + ![figure 1](images/w10servicing-f1-branches.png) + Figure 1. Feature upgrades and servicing branches + In all cases, Microsoft creates a servicing branch (referred to in Figure 1 as Servicing Branch \#1) that is used to produce releases for approximately one year (although the lifetime of the branch will ultimately depend on when Microsoft publishes subsequent feature upgrade releases). If Microsoft has selected the feature upgrade to receive long-term servicing-only support, Microsoft also creates a second servicing branch (referred to in Figure 1 as Servicing Branch \#2) that is used to produce servicing update releases for up to 10 years. + As shown in Figure 2, when Microsoft publishes a new feature upgrade, Servicing Branch \#1 is used to produce the various forms of media needed by OEMs, businesses, and consumers to install Windows 10 Home, Pro, Education, and Enterprise editions. Microsoft also produces the files needed by Windows Update to distribute and install the feature upgrade, along with *targeting* information that instructs Windows Update to only install the files on devices configured for *immediate* installation of feature upgrades. + ![figure 2](images/win10servicing-fig2-featureupgrade.png) + Figure 2. Producing feature upgrades from servicing branches + Approximately four months after publishing the feature upgrade, Microsoft uses Servicing Branch \#1 again to *republish* updated installation media for Windows 10 Pro, Education, and Enterprise editions. The updated media contains the exact same feature upgrade as contained in the original media except Microsoft also includes all the servicing updates that were published since the feature upgrade was first made available. This enables the feature upgrade to be installed on a device more quickly, and in a way that is potentially less obtrusive to users. + Concurrently, Microsoft also changes the way the feature upgrade is published in the Windows Update service. In particular, the files used by Windows Update to distribute and install the feature upgrade are refreshed with the updated versions, and the targeting instructions are changed so that the updated feature upgrade will now be installed on devices configured for *deferred* installation of feature upgrades. + **How Microsoft publishes the Windows 10 Enterprise LTSB Edition** + If Microsoft has selected the feature upgrade to receive long-term servicing support, Servicing Branch \#2 is used to publish the media needed to install the Windows 10 Enterprise LTSB edition. The time between releases of feature upgrades with long-term servicing support will vary between one and three years, and is strongly influenced by input from customers regarding the readiness of the release for long-term enterprise deployment. Figure 2 shows the Windows 10 Enterprise LTSB edition being published at the same time as the other Windows 10 editions, which mirrors the way editions were actually published for Windows 10 in July of 2015. It is important to note that this media is never published to Windows Update for deployment. Installations of the Enterprise LTSB edition on devices must be performed another way. + **How Microsoft releases Windows 10 servicing updates** + As shown in Figure 3, servicing branches are also used by Microsoft to produce servicing updates containing fixes for security vulnerabilities and other important issues. Servicing updates are published in a way that determines the Windows 10 editions on which they can be installed. For example, servicing updates produced from a given servicing branch can only be installed on devices running a Windows 10 edition produced from the same servicing branch. In addition, because Windows 10 Home does not support deferred installation of feature upgrades, servicing updates produced from Servicing Branch \#1 are targeted at devices running Windows 10 Home only until Microsoft publishes feature upgrades for deferred installation. + ![figure 3](images/win10servicing-fig3.png) + Figure 3. Producing servicing updates from servicing branches + **Release installation alternatives** + When IT administrators select Windows Update and/or Windows Server Update Services to deploy feature upgrades and servicing updates, Windows 10 and Windows Update will determine and deploy the correct releases for each of the three servicing options at the appropriate times. If there are multiple feature upgrades receiving long-term servicing support at the same time, Windows Update will select updates for each device that are appropriate for the feature upgrades they are running. + When IT administrators manage deployments of feature upgrades and servicing updates directly with configuration management products such as Configuration Manager, they are responsible for the timing of installation of both feature upgrades and servicing updates. It is important to note that until IT administrators install a new servicing update, devices may remain exposed to security vulnerabilities. Therefore, when managing deployments directly, IT administrators should deploy new servicing updates as soon as possible. + ## Servicing options and servicing branch designations + Servicing options have several different attributes that affect deployment planning decisions. For example, each servicing option: - Is supported on a selected set of Windows 10 editions (and no Windows 10 edition supports all three servicing options). - Has a policy that determines the periods of time during which Microsoft will produce servicing updates for a given feature upgrade. - Has a policy that determines when devices being managed by Windows Update or Windows Server Update Services will install new feature upgrades when they become available from Microsoft. -Because the servicing lifetime of a feature upgrade typically ends when the servicing lifetime of the subsequent feature upgrade begins, the length of servicing lifetimes will also vary. To simplify referring to these ranges, Microsoft created *servicing branch designations* for each of the three time range/servicing branch combinations. The designations are Current Branch (CB), Current Branch for Business (CBB), and Long-Term Servicing Branch (LTSB). + +Because the servicing lifetime of a feature upgrade typically ends when the servicing lifetime of the subsequent feature upgrade begins, the length of servicing lifetimes will also vary. To simplify referring to these ranges, +Microsoft created *servicing branch designations* for each of the three time range/servicing branch combinations. The designations are Current Branch (CB), Current Branch for Business (CBB), and Long-Term Servicing Branch (LTSB). Because there is a one-to-one mapping between servicing options and servicing branch designations, Microsoft occasionally refers to servicing options using servicing branch-centric terminology. The following sections describe servicing options and servicing branch designations, including terminology, servicing lifetime policies, upgrade behavior, and edition support, in more detail. + **Service lifetime and feature upgrade installation paths** + Although Microsoft is currently planning to release approximately two to three feature upgrades per year, the actual frequency and timing of releases will vary. Because the servicing lifetimes of feature upgrades typically end when the servicing lifetimes of other, subsequent feature upgrades begin, the lengths of servicing lifetimes will also vary. + ![figure 4](images/win10servicing-fig4-upgradereleases.png) + Figure 4. Example release cadence across multiple feature upgrades + To show the variability of servicing lifetimes, and show the paths that feature upgrade installations will take when Windows Update and Windows Server Update Services are used for deployments, Figure 4 contains three feature upgrade releases (labeled *X*, *Y*, and *Z*) and their associated servicing branches. The time period between publishing X and Y is four months, and the time period between publishing Y and Z is six months. X and Z have long-term servicing support, and Y has shorter-term servicing support only. + The same underlying figure will be used in subsequent figures to show all three servicing options in detail. It is important to note that Figure 4 is provided for illustration of servicing concepts only and should not be used for actual Windows 10 release planning. + To simplify the servicing lifetime and feature upgrade behavior explanations that follow, this document refers to branch designations for a specific feature upgrade as the +0 versions, the designations for the feature upgrade after the +0 version as the +1 (or successor) versions, and the designation for the feature upgrade after the +1 version as the +2 (or second successor) versions. + ### + **Immediate feature upgrade installation with Current Branch (CB) servicing** As shown in Figure 5, the Current Branch (CB) designation refers to Servicing Branch \#1 during the period that starts when Microsoft publishes a feature upgrade targeted for devices configured for *immediate* installation and ends when Microsoft publishes the *successor* feature upgrade targeted for devices configured for *immediate* installation. + ![figure 5](images/win10servicing-fig5.png) + Figure 5. Immediate installation with Current Branch Servicing + The role of Servicing Branch \#1 during the CB period is to produce feature upgrades and servicing updates for Windows 10 devices configured for *immediate* installation of new feature upgrades. Microsoft refers to devices configured this way as being *serviced from CBs*. The Windows 10 editions that support servicing from CBs are Home, Pro, Education, and Enterprise. The Current Branch designation is intended to reflect the fact that devices serviced using this approach will be kept as current as possible with respect to the latest Windows 10 feature upgrade release. Windows 10 Home supports Windows Update for release deployment. Windows 10 editions (Pro, Education, and Enterprise) support Windows Update, Windows Server Update Services, Configuration Manager, and other configuration management systems: - When IT administrators use Windows Update to manage deployments, devices will receive new feature upgrades and servicing updates as soon as they are published by Microsoft in the Windows Update service, targeted to devices configured for *immediate* feature upgrade installation. - When devices are being managed by using Windows Server Update Services, the same workflows are executed as with Windows Update except IT administrators must approve releases before installations begin. - When using configuration management systems such as Configuration Manager to manage deployments, IT administrators can obtain installation media from Microsoft and deploy new feature upgrades immediately by using standard change control processes. IT administrators who use configuration management systems should also make sure to obtain and deploy all servicing updates published by Microsoft as soon as possible. It is important to note that devices serviced from CBs must install two to three feature upgrades per year to remain current and continue to receive servicing updates. + ### + **Deferred feature upgrade installation with Current Branch for Business (CBB) servicing** As shown in Figure 6, the Current Branch for Business (CBB) designation refers to Servicing Branch \#1 during the period that starts when Microsoft republishes a feature upgrade targeted for devices configured for *deferred* installation and ends when Microsoft republishes the *second successor* feature upgrade targeted for devices configured for *deferred* installation. + ![figure 6](images/win10servicing-fig6.png) + Figure 6. Deferred installation with Current Branch for Business Servicing + The role of Servicing Branch \#1 during the CBB period is to produce feature upgrades and servicing updates for Windows 10 devices configured for *deferred* installation of new feature upgrades. Microsoft refers to devices configured this way as being *serviced from CBBs*. The Windows 10 editions that support servicing from CBBs are Pro, Education, and Enterprise. The Current Branch for Business designation is intended to reflect the fact that many businesses require IT administrators to test feature upgrades prior to deployment, and servicing devices from CBBs is a pragmatic solution for businesses with testing constraints to remain as current as possible. Windows 10 (Pro, Education, and Enterprise editions) support release deployment by using Windows Update, Windows Server Update Services, Configuration Manager, and other configuration management systems: - When IT administrators use Windows Update to manage deployments, devices will receive new feature upgrades and servicing updates as soon as they are published by Microsoft in the Windows Update service, targeted to devices configured for *deferred* feature upgrade installation. It is important to note that, even when devices are configured to defer installations, all servicing updates that are applicable to the feature upgrade that is running on a device will be installed immediately after being published by Microsoft in the Windows Update service. - When devices are being managed through Windows Server Update Services, the same workflows are executed as with Windows Update except IT administrators must approve releases before installations begin. - When using configuration management systems such as Configuration Manager to manage deployments, IT administrators can obtain media published for deferred installation from Microsoft and deploy new feature upgrades by using standard change control processes. When deferring feature upgrade installations, IT administrators should still deploy all applicable servicing updates as soon as they become available from Microsoft. Microsoft designed Windows 10 servicing lifetime policies so that CBBs will receive servicing updates for approximately twice as many months as CBs. This enables two CBBs to receive servicing support at the same time, which provides businesses with more flexibility when deploying new feature upgrades. That said, it is important to note that Microsoft will not produce servicing updates for a feature upgrade after its corresponding CBB reaches the end of its servicing lifetime. This means that feature upgrade deployments cannot be extended indefinitely and IT administrators should ensure that they deploy newer feature upgrades onto devices before CBBs end. + ### + **Install servicing updates only by using Long-Term Servicing Branch (LTSB) servicing** + As shown in Figure 7, the Long-Term Servicing Branch (LTSB) designation refers to Servicing Branch \#2 from beginning to end. LTSBs begin when a feature upgrade with long-term support is published by Microsoft and end after 10 years. It is important to note that only the Windows 10 Enterprise LTSB edition supports long-term servicing, and there are important differences between this edition and other Windows 10 editions regarding upgradability and feature set (described below in the [Considerations when configuring devices for servicing updates only](#servicing-only) section). + ![figure 7](images/win10servicing-fig7.png) + Figure 7. Servicing updates only using LTSB Servicing + The role of LTSBs is to produce servicing updates for devices running Windows 10 configured to install servicing updates only. Devices configured this way are referred to as being *serviced from LTSBs*. The Long-Term Servicing Branch designation is intended to reflect the fact that this servicing option is intended for scenarios where changes to software running on devices must be limited to essential updates (such as those for security vulnerabilities and other important issues) for the duration of deployments. Windows 10 Enterprise LTSB supports release deployment by using Windows Update, Windows Server Update Services, Configuration Manager, and other configuration management systems: - When IT administrators use Windows Update to manage deployments, Windows Update will install only servicing updates, and do so as soon as they are published by Microsoft in the Windows Update service. Windows Update does not install feature upgrades on devices configured for long-term servicing. - When devices are being managed using Windows Server Update Services, the same workflows are executed as with Windows Update except IT administrators must approve releases before installations begin. - When using configuration management systems such as System Center Configuration Manager to manage deployments, IT administrators should make sure to obtain and deploy all servicing updates published by Microsoft as soon as possible. + **Note**   It is important to note again that not all feature upgrades will have an LTSB. The initial release of Windows 10, published in July 2015, has an LTSB and Microsoft expects to designate one additional feature upgrade in the next 12 months for long-term support. After that, Microsoft expects to publish feature upgrades with long-term servicing support approximately every two to three years. Microsoft will provide additional information in advance of publishing new feature upgrades so that IT administrators can make informed deployment planning decisions.   ### + **Considerations when configuring devices for servicing updates only** Before deciding to configure a device for LTSB-based servicing, IT administrators should carefully consider the implications of changing to a different servicing option later, and the effect of using Windows 10 Enterprise LTSB on the availability of *in-box* applications. + Regarding edition changes, it is possible to reconfigure a device running Windows 10 Enterprise LTSB to run Windows 10 Enterprise while preserving the data and applications already on the device. Reconfiguring a device running Windows 10 Enterprise LTSB to run other editions of Windows 10 may require IT administrators to restore data and/or reinstall applications on the device after the other edition has been installed. Regarding in-box applications, Windows 10 Enterprise LTSB does not include all the universal apps that are included with other Windows 10 editions. This is because the universal apps included with Windows 10 will be continually upgraded by Microsoft, and new releases of in-box universal apps are unlikely to remain compatible with a feature upgrade of Windows 10 Enterprise LTSB for the duration of its servicing lifetime. Examples of apps that Windows 10 Enterprise LTSB does not include are Microsoft Edge, Windows Store Client, Cortana (limited search capabilities remain available), Outlook Mail, Outlook Calendar, OneNote, Weather, News, Sports, Money, Photos, Camera, Music, and Clock. + Windows 10 Enterprise LTSB does include Internet Explorer 11, and is compatible with Windows 32 versions of Microsoft Office. IT administrators can also install universal apps on devices when apps are compatible with the feature upgrades running on the device. They should do so with care, however, as servicing updates targeted for devices running Windows 10 Enterprise LTSB will not include security or non-security fixes for universal apps. Additionally, Microsoft will not provide servicing updates for specific releases of apps on any Windows 10 edition after the feature upgrade of Windows 10 with which the apps were included reaches the end of its servicing lifetime. + **Servicing option summary** + Table 2. Servicing option summary
    @@ -235,8 +322,11 @@ universal apps removed
      ## Related topics + [Plan for Windows 10 deployment](../plan/index.md) + [Deploy Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=624776) + [Manage and update Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=624796)     From b5a0b2ff366bb54ada419b3b8f11a500aa67dfdd Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 18 May 2016 16:05:57 -0700 Subject: [PATCH 320/439] fixing spacing issues --- .../integration-with-management-solutions-.md | 24 +++++++++-- windows/plan/setup-and-deployment.md | 40 +++++++++++++++++-- ...-10-guidance-for-education-environments.md | 6 ++- windows/plan/windows-update-for-business.md | 23 +++++++++-- 4 files changed, 80 insertions(+), 13 deletions(-) diff --git a/windows/plan/integration-with-management-solutions-.md b/windows/plan/integration-with-management-solutions-.md index a08986d154..788d1ad4e8 100644 --- a/windows/plan/integration-with-management-solutions-.md +++ b/windows/plan/integration-with-management-solutions-.md @@ -2,35 +2,51 @@ title: Integration with management solutions (Windows 10) description: You can integrate Windows Update for Business deployments with existing management tools such as Windows Server Update Services (WSUS), System Center Configuration Manager, and Microsoft Intune. ms.assetid: E0CB0CD3-4FE1-46BF-BA6F-5A5A8BD14CC9 -ms.pagetype: servicing; devices -keywords: ["update", "upgrade", "deployment", "manage", "tools"] +keywords: update, upgrade, deployment, manage, tools ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library +ms.pagetype: servicing; devices author: TrudyHa --- + # Integration with management solutions + **Applies to** - Windows 10 + You can integrate Windows Update for Business deployments with existing management tools such as Windows Server Update Services (WSUS), System Center Configuration Manager, and Microsoft Intune. + ## System Center Configuration Manager + For Windows 10, version 1511, organizations that already manage their systems with Configuration Manager can also have their devices configured for Windows Update for Business (in other words, set deferral policies on those machines). For Windows 10, version 1511, such devices will be visible in the Configuration Manager console, however they will appear with a detection state of “Unknown”. + ![figure 1](images/wuforbusiness-fig10-sccmconsole.png) + ## WSUS standalone + For Windows 10, version 1511, you cannot configure devices for both Windows Update for Business *and* to receive updates from WSUS. If both group policies are set (for both deferrals as well as WSUS scanning), Windows Update for Business settings will NOT be respected and devices will continue to scan against WSUS. + ## Enterprise Mobility Suite: Intune + You can configure Windows Update for Business by using MDM policy. To configure Windows Update for Business with Intune: 1. Create a new Windows 10 custom policy. (Add a policy, and choose **Custom Configuration for Windows 10 Desktop and phone…**). + ![figure 2](images/wuforbusiness-fig11-intune.png) + 2. Configure the device to Consumer Branch for Business by selecting to defer upgrades (as described in [Setup and deployment](setup-and-deployment.md). + **Note**   As noted, because WSUS and Windows Update for Business are mutually exclusive policies, do not set **UpdateServiceUrl** if you want to configure to defer upgrades.   3. Establish deferral windows for updates and upgrades. + ![figure 3](images/wuforbusiness-fig12a-updates.png) + ![figure 4](images/wuforbusiness-fig13a-upgrades.png) + ## Related topics + [Windows Update for Business](windows-update-for-business.md) + [Setup and deployment](setup-and-deployment.md) -  -  diff --git a/windows/plan/setup-and-deployment.md b/windows/plan/setup-and-deployment.md index fbcf7657bc..590be310dd 100644 --- a/windows/plan/setup-and-deployment.md +++ b/windows/plan/setup-and-deployment.md @@ -2,24 +2,35 @@ title: Setup and deployment (Windows 10) description: This article describes the basic features of a Windows Update for Business deployment. ms.assetid: E176BB36-3B1B-4707-9665-968D80050DD1 -ms.pagetype: servicing; devices -keywords: ["update", "upgrade", "deployment"] +keywords: update, upgrade, deployment ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library +ms.pagetype: servicing; devices author: TrudyHa --- + # Setup and deployment + **Applies to** - Windows 10 + This article describes the basic features of a Windows Update for Business deployment. Use this information to familiarize yourself with a simple deployment with a single group of machines connected to Windows Update, in addition to more complex scenarios such as the creation of Windows Update for Business validation groups that receive updates from Windows Update at different time intervals, as well as Windows Update for Business deployments integrated with existing management tools such as Windows Server Update Services (WSUS), System Center Configuration Manager, or Microsoft Intune. + ## Configure your systems to receive updates on CBB + To use Windows Update for Business, Windows 10-based devices must first be configured for the Current Branch for Business (CBB). You can configure devices manually, by using Group Policy, or by using mobile device management (MDM). + ![figure 1](images/wuforbus-fig1-manuallyset.png) + ![figure 2](images/wuforbusiness-fig2-gp.png) + ![figure 3](images/wuforbusiness-fig3-mdm.png) + ## Defer OS upgrade and update deployments + Windows Update for Business allows administrators to control when upgrades and updates are deployed to their Windows 10 clients by specifying deferral windows from when they are initially made available on the Windows Update service. As mentioned, there are restrictions as to how long you can delay upgrades and updates. The following table details these restrictions, per deployment category type: +
    @@ -110,27 +121,42 @@ Group Policy does not allow you to set a future "unpause” — administrators m
      ![figure 6](images/wuforbusiness-fig6-pause.png) + ## Create validation groups for deployments + By grouping machines into similar deferral periods, administrators are able to cluster devices into deployment or validation groups which can be used as a quality control measure as updates are deployed in Windows 10. With deferral windows and the ability to pause, administrators can effectively control and measure update deployments by rolling out to a small pool of devices first to verify quality, prior to a broader roll-out to their organization. + Administrators can establish validation groups to maintain a level of control over update/driver deployments which allows them to: - Control the date, time, and frequency updates will be applied and devices rebooted - Deploy a small set of machines to verify quality prior to broad roll-out - Stage broad roll-out in waves to continue quality verification and minimize disruptions - Manage membership of waves based on criteria defined by IT - Halt and roll-back deployment of updates/drivers that may be causing trouble + ![figure 7](images/wuforbusiness-fig7-validationgroup.png) + ## Peer-to-peer networking for deployments + Windows Update Delivery Optimization enables Windows Update for Business enrolled devices to download Windows updates and Windows Store apps from sources other than Microsoft. With multiple devices, Delivery Optimization can reduce the amount of Internet bandwidth that is required to keep all of your Windows Update for Business enrolled systems up to date. It can also help ensure that devices get updates and apps more quickly if they have a limited or unreliable Internet connection. + In addition to downloading updates and apps from Microsoft, Windows will get updates and apps from other PCs that already have them. You can choose which PCs you get these updates from. + ### How Delivery Optimization works + - **PCs on your local network.** When Windows downloads an update or app, it will look for other PCs on your local network that have already downloaded the update or app using Delivery Optimization. Windows then downloads parts of the file from those PCs and parts of the file from Microsoft. Windows doesn’t download the entire file from one place. Instead, the download is broken down into smaller parts. Windows uses the fastest, most reliable download source for each part of the file. - **PCs on your local network and PCs on the Internet.** Windows uses the same process as when getting updates and apps from PCs on your local network, and also looks for PCs on the Internet that can be used as a source to download parts of updates and apps. + ### Delivery Optimization settings + Delivery Optimization is turned on by default for the Enterprise and Education editions of Windows 10, where the default option is that updates will only be pulled and shared from PCs on your LAN and not the Internet. Delivery Optimization configuration settings can be viewed by going to: Settings > Update and Security > Advanced Options > Choose how your updates are delivered + ![figure 8](images/wuforbusiness-fig8a-chooseupdates.png) + ## Use Group Policy to configure Windows Update Delivery Optimization + You can use Group Policy to configure Windows Update Delivery Optimization. To do this, use the following steps: + 1. Download the [Administrative Templates (.admx) file for Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=699283) from the Microsoft Download Center. 2. Copy the following files to the SYSVOL central store: - DeliveryOptimization.admx from C:\\Program Files (x86)\\Microsoft Group Policy\\Windows 10\\PolicyDefinitions @@ -139,13 +165,19 @@ You can use Group Policy to configure Windows Update Delivery Optimization. To d 4. Browse to the following location: - Computer Configuration\\Administrative Templates\\Windows Components\\Delivery Optimization 5. Make the following Windows Update Delivery Optimization settings, as appropriate. + ![figure 9](images/wuforbusiness-fig9-dosettings.jpg) + **Virus-scan claim** + Microsoft scanned this file for viruses, using the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to it. + For more information about Windows Update Delivery Optimization in Windows 10, see the [Windows Update Delivery Optimization FAQ](http://go.microsoft.com/fwlink/p/?LinkId=699284). + For additional resources, see [How to use Group Policy to configure Windows Update Delivery Optimization in Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=699288). + ## Related topics + [Windows Update for Business](windows-update-for-business.md) + [Integration with management solutions](integration-with-management-solutions-.md) -  -  diff --git a/windows/plan/windows-10-guidance-for-education-environments.md b/windows/plan/windows-10-guidance-for-education-environments.md index 0e34d984eb..c40e7da07e 100644 --- a/windows/plan/windows-10-guidance-for-education-environments.md +++ b/windows/plan/windows-10-guidance-for-education-environments.md @@ -2,15 +2,19 @@ title: Guidance for education environments (Windows 10) description: Find resources to help you plan your deployment of Windows 10 to desktops, laptops, tablets, and other devices in educational institutions. ms.assetid: 225C9D6F-9329-4DDF-B447-6CE7804E314E -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: plan ms.sitesec: library +ms.pagetype: security author: craigash --- + # Guidance for education environments + Find resources to help you plan your deployment of Windows 10 to desktops, laptops, tablets, and other devices in educational institutions. + ## In this section + diff --git a/windows/plan/windows-update-for-business.md b/windows/plan/windows-update-for-business.md index 474b33cfb4..7371c01825 100644 --- a/windows/plan/windows-update-for-business.md +++ b/windows/plan/windows-update-for-business.md @@ -2,28 +2,40 @@ title: Windows Update for Business (Windows 10) description: Get an overview of how you can implement and deploy a Windows Update for Business solution and how to maintain enrolled systems. ms.assetid: DF61F8C9-A8A6-4E83-973C-8ABE090DB8C6 -ms.pagetype: servicing; devices -keywords: ["update", "upgrade", "deployment", "WSUS"] +keywords: [update, upgrade, deployment, WSUS ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library +ms.pagetype: servicing; devices author: TrudyHa --- + # Windows Update for Business + **Applies to** - Windows 10 + Get an overview of how you can implement and deploy a Windows Update for Business solution and how to maintain enrolled systems. + ## Introduction + Windows Update for Business enables information technology administrators to keep the Windows 10-based devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Microsoft’s Windows Update service. By using [Group Policy Objects](http://go.microsoft.com/fwlink/p/?LinkId=699279), Windows Update for Business is an easily established and implemented system which enables organizations and administrators to exercise control on how their Windows 10-based devices are updated, by allowing: - **Deployment and validation groups**; where administrators can specify which devices go first in an update wave, and which devices will come later (to ensure any quality bars are met). - **Peer-to-peer delivery**, which administrators can enable to make delivery of updates to branch offices and remote sites with limited bandwidth very efficient. - **Use with existing tools** such as System Center Configuration Manager and the [Enterprise Mobility Suite](http://go.microsoft.com/fwlink/p/?LinkId=699281). + Together, these Windows Update for Business features help reduce device management costs, provide controls over update deployment, offer quicker access to security updates, as well as provide access to the latest innovations from Microsoft on an ongoing basis. Windows Update for Business is a free service for all Windows 10 Pro, Enterprise, and Education editions, and can be used independent of, or in conjunction with, existing device management solutions such as [Windows Server Update Services (WSUS)](http://go.microsoft.com/fwlink/p/?LinkId=734043) and [System Center Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=734044). + ## Deploy Windows Update for Business in your organization + For Windows 10, version 1511, Windows Update for Business is enabled using a set of client-side configurations, allowing you to manage how and when Windows-based devices receive updates and upgrades. These capabilities use the Windows Update service like any other Windows 10 clients, but provides controls to help businesses validate update quality as well as time their update deployments to machines through the use of Group Policy Objects. Windows Update for Business also incorporates smart peer-to-peer networking for distribution of Windows updates, which will help maintain bandwidth efficiency in the absence of a WSUS solution. + ## Eligible devices + All devices running Windows 10 Pro, Enterprise, and Education on the Current Branch for Business (CBB) are Windows Update for Business eligible. + ## OS upgrades and updates + In Windows 10, Windows Update for Business recognizes three deployment categories that clients receive from Windows Update: - **Upgrades** - Examples: Windows 10 (Build 10240) to Windows 10, version 1511; CBB 1 to CBB 2 @@ -35,6 +47,7 @@ In Windows 10, Windows Update for Business recognizes three deployment categori - **Other/non-deferrable** - Definition updates (these cannot be deferred) Both upgrades and updates can be deferred from deployment to client machines by a Windows Update for Business administrator within a bounded rage of time from when those updates are first made available on the Windows Update service. This deferral capability allows administrators to validate deployments as they are pushed to all their Windows Update for Business enrolled clients. The following table defines maximum deferral periods allowed by deployment type: +
    @@ -73,9 +86,11 @@ Both upgrades and updates can be deferred from deployment to client machines by
    CategoryE0789628-CE08-4437-BE74-2495B842F43B
    + ## Related topics + [Setup and deployment](setup-and-deployment.md) + [Integration with management solutions](integration-with-management-solutions-.md) + [Windows 10 servicing options for updates and upgrades](../manage/introduction-to-windows-10-servicing.md) -  -  From 0f223cf50477d779f91f2a3383bd6c83a2231afa Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Wed, 18 May 2016 16:51:53 -0700 Subject: [PATCH 321/439] fix author --- devices/surface/advanced-uefi-security-features-for-surface.md | 2 +- .../enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md | 2 +- devices/surface/microsoft-surface-data-eraser.md | 2 +- devices/surface/microsoft-surface-deployment-accelerator.md | 2 +- devices/surface/step-by-step-surface-deployment-accelerator.md | 2 +- devices/surface/surface-diagnostic-toolkit.md | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/devices/surface/advanced-uefi-security-features-for-surface.md b/devices/surface/advanced-uefi-security-features-for-surface.md index 26fc77aeb8..916ff69bf3 100644 --- a/devices/surface/advanced-uefi-security-features-for-surface.md +++ b/devices/surface/advanced-uefi-security-features-for-surface.md @@ -6,7 +6,7 @@ keywords: ["Surface, Surface Pro 3, security, features, configure, hardware, dev ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library -author: milada +author: miladCA --- # Advanced UEFI security features for Surface diff --git a/devices/surface/enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md b/devices/surface/enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md index 1db50db7ea..df0f2600d3 100644 --- a/devices/surface/enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md +++ b/devices/surface/enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md @@ -6,7 +6,7 @@ keywords: ["network", "wireless", "device", "deploy", "authenticaion", "protocol ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: milada +author: miladCA --- # Enable PEAP, EAP-FAST, and Cisco LEAP on Surface devices diff --git a/devices/surface/microsoft-surface-data-eraser.md b/devices/surface/microsoft-surface-data-eraser.md index fc9cbc171a..7a26697d0f 100644 --- a/devices/surface/microsoft-surface-data-eraser.md +++ b/devices/surface/microsoft-surface-data-eraser.md @@ -6,7 +6,7 @@ keywords: ["tool", "USB", "data", "erase"] ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library -author: milada +author: miladCA --- # Microsoft Surface Data Eraser diff --git a/devices/surface/microsoft-surface-deployment-accelerator.md b/devices/surface/microsoft-surface-deployment-accelerator.md index 2c8a671cd9..c29e806628 100644 --- a/devices/surface/microsoft-surface-deployment-accelerator.md +++ b/devices/surface/microsoft-surface-deployment-accelerator.md @@ -6,7 +6,7 @@ keywords: ["deploy", "install", "tool"] ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library -author: milada +author: miladCA --- # Microsoft Surface Deployment Accelerator diff --git a/devices/surface/step-by-step-surface-deployment-accelerator.md b/devices/surface/step-by-step-surface-deployment-accelerator.md index 1f8dbef314..faa4f9d57b 100644 --- a/devices/surface/step-by-step-surface-deployment-accelerator.md +++ b/devices/surface/step-by-step-surface-deployment-accelerator.md @@ -6,7 +6,7 @@ keywords: ["deploy, configure"] ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library -author: milada +author: miladCA --- # Step by step: Surface Deployment Accelerator diff --git a/devices/surface/surface-diagnostic-toolkit.md b/devices/surface/surface-diagnostic-toolkit.md index 3ba9e952e4..11b81dff40 100644 --- a/devices/surface/surface-diagnostic-toolkit.md +++ b/devices/surface/surface-diagnostic-toolkit.md @@ -6,7 +6,7 @@ keywords: ["hardware, device, tool, test, component"] ms.prod: W8 ms.mktglfcycl: manage ms.sitesec: library -author: milada +author: miladCA --- # Microsoft Surface Diagnostic Toolkit From b010b4110eceba03cf15e897148b5740cbfa7f28 Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Wed, 18 May 2016 17:34:32 -0700 Subject: [PATCH 322/439] Update index --- devices/surface/index.md | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/devices/surface/index.md b/devices/surface/index.md index fb08705db4..2cbeff64cf 100644 --- a/devices/surface/index.md +++ b/devices/surface/index.md @@ -15,6 +15,9 @@ author: heatherpoulsen This library provides guidance to help you deploy Windows on Surface devices, keep those devices up to date, and easily manage and support Surface devices in your organization. + +For more information on planning for, deploying, and managing Surface devices in your organization, see the [Surface TechCenter](https://technet.microsoft.com/en-us/windows/surface). + ## In this section @@ -32,15 +35,15 @@ This library provides guidance to help you deploy Windows on Surface devices, ke

    [Advanced UEFI security features for Surface](advanced-uefi-security-features-for-surface.md)

    -

    This article describes how to install and configure the v3.11.760.0 UEFI update to enable additional security options for Surface Pro 3 devices.

    +

    Find out how to install and configure the v3.11.760.0 UEFI update to enable additional security options for Surface Pro 3 devices.

    [Customize the OOBE for Surface deployments](customize-the-oobe-for-surface-deployments.md)

    -

    This article will walk you through the process of customizing the Surface out-of-box experience for end users in your organization.

    +

    Walk through the process of customizing the Surface out-of-box experience for end users in your organization.

    [Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md)

    -

    This article provides a list of the available downloads for Surface devices and links to download the drivers and firmware for your device.

    +

    Get a list of the available downloads for Surface devices and links to download the drivers and firmware for your device.

    [Enable PEAP, EAP-FAST, and Cisco LEAP on Surface devices](enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md)

    @@ -48,7 +51,7 @@ This library provides guidance to help you deploy Windows on Surface devices, ke

    [Ethernet adapters and Surface deployment](ethernet-adapters-and-surface-device-deployment.md)

    -

    This article provides guidance and answers to help you perform a network deployment to Surface devices.

    +

    Get guidance and answers to help you perform a network deployment to Surface devices.

    [Manage Surface Dock firmware updates](manage-surface-dock-firmware-updates.md)

    @@ -56,7 +59,7 @@ This library provides guidance to help you deploy Windows on Surface devices, ke

    [Manage Surface driver and firmware updates](manage-surface-pro-3-firmware-updates.md)

    -

    This article describes the available options to manage firmware and driver updates for Surface devices.

    +

    Explore the available options to manage firmware and driver updates for Surface devices.

    [Surface Data Eraser](microsoft-surface-data-eraser.md)

    @@ -64,7 +67,7 @@ This library provides guidance to help you deploy Windows on Surface devices, ke

    [Surface Deployment Accelerator](microsoft-surface-deployment-accelerator.md)

    -

    Microsoft Surface Deployment Accelerator provides a quick and simple deployment mechanism for organizations to reimage Surface devices.

    +

    See how Microsoft Surface Deployment Accelerator provides a quick and simple deployment mechanism for organizations to reimage Surface devices.

    [Surface Diagnostic Toolkit](surface-diagnostic-toolkit.md)

    @@ -72,7 +75,7 @@ This library provides guidance to help you deploy Windows on Surface devices, ke

    [Surface Dock Updater](surface-dock-updater.md)

    -

    This article provides a detailed walkthrough of Microsoft Surface Dock Updater.

    +

    Get a detailed walkthrough of Microsoft Surface Dock Updater.

    From 79bd919c2fc4a648570834f6a6f0a2d3f959a304 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 18 May 2016 17:44:06 -0700 Subject: [PATCH 323/439] fixing spacing issues --- ...-credential-manager-as-a-trusted-caller.md | 81 +++--- .../access-this-computer-from-the-network.md | 87 +++--- .../keep-secure/account-lockout-duration.md | 71 +++-- windows/keep-secure/account-lockout-policy.md | 41 +-- .../keep-secure/account-lockout-threshold.md | 90 +++---- windows/keep-secure/account-policies.md | 45 +--- .../accounts-administrator-account-status.md | 87 +++--- .../accounts-block-microsoft-accounts.md | 80 +++--- .../accounts-guest-account-status.md | 71 +++-- ...f-blank-passwords-to-console-logon-only.md | 83 +++--- .../accounts-rename-administrator-account.md | 79 +++--- .../accounts-rename-guest-account.md | 82 +++--- .../act-as-part-of-the-operating-system.md | 77 +++--- ...g-a-device-guard-policy-for-signed-apps.md | 11 +- ...ed-with-windows-defender-for-windows-10.md | 86 ++++-- ...o-run-on-device-guard-protected-devices.md | 43 ++- ...microsoft-passport-in-your-organization.md | 29 +- windows/keep-secure/index.md | 87 ++---- ...gital-certificates-on-windows-10-mobile.md | 30 ++- ...y-verification-using-microsoft-passport.md | 42 ++- ...microsoft-passport-and-password-changes.md | 22 +- ...oft-passport-errors-during-pin-creation.md | 23 +- .../keep-secure/microsoft-passport-guide.md | 137 +++++++++- ...repare-people-to-use-microsoft-passport.md | 43 ++- .../switch-pcr-banks-on-tpm-2-0-devices.md | 21 +- windows/keep-secure/vpn-profile-options.md | 24 +- .../why-a-pin-is-better-than-a-password.md | 35 ++- .../windows-10-enterprise-security-guides.md | 8 +- .../windows-10-mobile-security-guide.md | 190 +++++++++++++- .../keep-secure/windows-10-security-guide.md | 247 +++++++++++++++++- .../windows-defender-in-windows-10.md | 17 +- 31 files changed, 1378 insertions(+), 691 deletions(-) diff --git a/windows/keep-secure/access-credential-manager-as-a-trusted-caller.md b/windows/keep-secure/access-credential-manager-as-a-trusted-caller.md index 6ffb57b6a7..f6f7140989 100644 --- a/windows/keep-secure/access-credential-manager-as-a-trusted-caller.md +++ b/windows/keep-secure/access-credential-manager-as-a-trusted-caller.md @@ -2,87 +2,84 @@ title: Access Credential Manager as a trusted caller (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Access Credential Manager as a trusted caller security policy setting. ms.assetid: a51820d2-ca5b-47dd-8e9b-d7008603db88 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Access Credential Manager as a trusted caller + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Access Credential Manager as a trusted caller** security policy setting. + ## Reference + The **Access Credential Manager as a trusted caller** policy setting is used by Credential Manager during backup and restore. No accounts should have this privilege because it is assigned only to the Winlogon service. Saved credentials of users may be compromised if this privilege is given to other entities. + Constant: SeTrustedCredManAccessPrivilege + ### Possible values + - User-defined list of accounts - Not defined + ### Best practices + - Do not modify this policy setting from the default. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values -The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Server type or GPODefault value

    Default domain policy

    Not defined

    Default domain controller policy

    Not defined

    Stand-alone server default settings

    Not defined

    Domain controller effective default settings

    Not defined

    Member server effective default settings

    Not defined

    Client computer effective default settings

    Not defined

    + +| Server type or GPO | Default value | +| - | - | +| Default domain policy | Not defined | +| Default domain controller policy | Not defined | +| Stand-alone server default settings | Not defined | +| Domain controller effective default settings | Not defined | +| Member server effective default settings | Not defined | +| Client computer effective default settings | Not defined |   ## Policy management + This section describes features, tools, and guidance to help you manage this policy. + A restart of the computer is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + If an account is given this user right, the user of the account may create an application that calls into Credential Manager and is returned the credentials for another user. + ### Countermeasure + Do not define the **Access Credential Manager as a trusted caller** policy setting for any accounts besides Credential Manager. + ### Potential impact + None. Not defined is the default configuration. + ## Related topics [User Rights Assignment](user-rights-assignment.md) -  -  +  \ No newline at end of file diff --git a/windows/keep-secure/access-this-computer-from-the-network.md b/windows/keep-secure/access-this-computer-from-the-network.md index 97bf2e64a9..00a88b6ba8 100644 --- a/windows/keep-secure/access-this-computer-from-the-network.md +++ b/windows/keep-secure/access-this-computer-from-the-network.md @@ -2,96 +2,99 @@ title: Access this computer from the network (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Access this computer from the network security policy setting. ms.assetid: f6767bc2-83d1-45f1-847c-54f5362db022 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Access this computer from the network + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Access this computer from the network** security policy setting. + ## Reference + The **Access this computer from the network** policy setting determines which users can connect to the device from the network. This capability is required by a number of network protocols, including Server Message Block (SMB)-based protocols, NetBIOS, Common Internet File System (CIFS), and Component Object Model Plus (COM+). + Users, devices, and service accounts gain or lose the **Access this computer from network** user right by being explicitly or implicitly added or removed from a security group that has been granted this user right. For example, a user account or a machine account may be explicitly added to a custom security group or a built-in security group, or it may be implicitly added by Windows to a computed security group such as Domain Users, Authenticated Users, or Enterprise Domain Controllers. By default, user accounts and machine accounts are granted the **Access this computer from network** user right when computed groups such as Authenticated Users, and for domain controllers, the Enterprise Domain Controllers group, are defined in the default domain controllers Group Policy Object (GPO). + Constant: SeNetworkLogonRight + ### Possible values + - User-defined list of accounts - Not defined + ### Best practices + - On desktop devices or member servers, grant this right only to users and administrators. - On domain controllers, grant this right only to authenticated users, enterprise domain controllers, and administrators. - This setting includes the **Everyone** group to ensure backward compatibility. Upon Windows upgrade, after you have verified that all users and groups are correctly migrated, you should remove the **Everyone** group and use the **Authenticated Users** group instead. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Server type or GPODefault value

    Default domain policy

    Not defined

    Default domain controller policy

    Everyone, Administrators, Authenticated Users, Enterprise Domain Controllers, Pre-Windows 2000 Compatible Access

    Stand-alone server default settings

    Everyone, Administrators, Users, Backup Operators

    Domain controller effective default settings

    Everyone, Administrators, Authenticated Users, Enterprise Domain Controllers, Pre-Windows 2000 Compatible Access

    Member server effective default settings

    Everyone, Administrators, Users, Backup Operators

    Client computer effective default settings

    Everyone, Administrators, Users, Backup Operators

    + +|Server type of GPO | Default value | +| - | - | +| Default domain policy | Not defined | +| Default domain controller policy | Everyone, Administrators, Authenticated Users, Enterprise Domain Controllers, Pre-Windows 2000 Compatible Access | +| Stand-alone server default settings |Everyone, Administrators, Users, Backup Operators | +| Domain controller effective default settings | Everyone, Administrators, Authenticated Users, Enterprise Domain Controllers, Pre-Windows 2000 Compatible Access | +| Member server effective default settings | Everyone, Administrators, Users, Backup Operators | +| Client computer effective default settings |Everyone, Administrators, Users, Backup Operators |   ## Policy management + When modifying this user right, the following actions might cause users and services to experience network access issues: + - Removing the Enterprise Domain Controllers security group - Removing the Authenticated Users group or an explicit group that allows users, computers, and service accounts the user right to connect to computers over the network - Removing all user and machine accounts + A restart of the device is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Users who can connect from their device to the network can access resources on target devices for which they have permission. For example, the **Access this computer from the network** user right is required for users to connect to shared printers and folders. If this user right is assigned to the **Everyone** group, anyone in the group can read the files in those shared folders. This situation is unlikely because the groups created by a default installation of at least Windows Server 2008 R2 or Windows 7 do not include the **Everyone** group. However, if a device is upgraded and the original device includes the **Everyone** group as part of its defined users and groups, that group is transitioned as part of the upgrade process and is present on the device. + ### Countermeasure -Restrict the **Access this computer from the network** user right to only those users and groups who require access to the computer. For example, if you configure this policy setting to the **Administrators** and **Users** groups, users who log on to the domain can access resources that are shared from servers in the domain if members of the **Domain Users** group are included in the local **Users** group. -**Note**   -If you are using IPsec to help secure network communications in your organization, ensure that a group that includes machine accounts is given this right. This right is required for successful computer authentication. Assigning this right to **Authenticated Users** or **Domain Computers** meets this requirement. + +Restrict the **Access this computer from the network** user right to only those users and groups who require access to the computer. For example, if you configure this policy setting to the **Administrators** and **Users** groups, users who log on to the domain can access resources that are shared +from servers in the domain if members of the **Domain Users** group are included in the local **Users** group. + +> **Note** If you are using IPsec to help secure network communications in your organization, ensure that a group that includes machine accounts is given this right. This right is required for successful computer authentication. Assigning this right to **Authenticated Users** or **Domain Computers** meets this requirement.   ### Potential impact + If you remove the **Access this computer from the network** user right on domain controllers for all users, no one can log on to the domain or use network resources. If you remove this user right on member servers, users cannot connect to those servers through the network. If you have installed optional components such as ASP.NET or Internet Information Services (IIS), you may need to assign this user right to additional accounts that are required by those components. It is important to verify that authorized users are assigned this user right for the devices that they need to access the network. + ## Related topics [User Rights Assignment](user-rights-assignment.md)   diff --git a/windows/keep-secure/account-lockout-duration.md b/windows/keep-secure/account-lockout-duration.md index 924f405c5b..9b8fd5a9f4 100644 --- a/windows/keep-secure/account-lockout-duration.md +++ b/windows/keep-secure/account-lockout-duration.md @@ -2,76 +2,69 @@ title: Account lockout duration (Windows 10) description: Describes the best practices, location, values, and security considerations for the Account lockout duration security policy setting. ms.assetid: a4167bf4-27c3-4a9b-8ef0-04e3c6ec3aa4 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Account lockout duration + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Account lockout duration** security policy setting. + ## Reference + The **Account lockout duration** policy setting determines the number of minutes that a locked-out account remains locked out before automatically becoming unlocked. The available range is from 1 through 99,999 minutes. A value of 0 specifies that the account will be locked out until an administrator explicitly unlocks it. If **Account lockout threshold** is set to a number greater than zero, **Account lockout duration** must be greater than or equal to the value of [Reset account lockout counter after](reset-account-lockout-counter-after.md). This policy setting is dependent on the **Account lockout threshold** policy setting that is defined, and it must be greater than or equal to the value specified for the [Reset account lockout counter after](reset-account-lockout-counter-after.md) policy setting. + ### Possible values + - A user-defined number of minutes from 0 through 99,999 - Not defined + If [Account lockout threshold](account-lockout-threshold.md) is configured, after the specified number of failed attempts, the account will be locked out. If th **Account lockout duration** is set to 0, the account will remain locked until an administrator unlocks it manually. + It is advisable to set **Account lockout duration** to approximately 30 minutes. To specify that the account will never be locked out, set the value to 0. To configure the value for this policy setting so that it never automatically unlocks the account might seem like a good idea; however, doing so can increase the number of requests that your organization’s Help Desk receives to unlock accounts that were locked by mistake. + ### Location + **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy** + ### Default values + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Server type or Group Policy Object (GPO)Default value

    Default domain policy

    Not defined

    Default domain controller policy

    Not defined

    Stand-alone server default settings

    Not applicable

    Domain controller effective default settings

    Not defined

    Member server effective default settings

    Not defined

    Client computer effective default settings

    Not applicable

    + +| Server type or Group Policy Object (GPO) | Default value | +| - | - | +| Default domain policy | Not defined | +| Default domain controller policy | Not defined | +| Stand-alone server default settings | Not applicable | +| Domain controller effective default settings | Not defined | +| Member server effective default settings | Not defined | +| Client computer effective default settings | Not applicable |   ## Security considerations + More than a few unsuccessful password submissions during an attempt to log on to a computer might represent an attacker's attempts to determine an account password by trial and error. The Windows and Windows Server operating systems can track logon attempts, and you can configure the operating system to disable the account for a preset period of time after a specified number of failed attempts. Account lockout policy settings control the threshold for this response and what action to take after the threshold is reached. + ### Vulnerability + A denial-of-service (DoS) condition can be created if an attacker abuses the [Account lockout threshold](account-lockout-threshold.md) policy setting and repeatedly attempts to log on with a specific account. After you configure the Account lockout threshold policy setting, the account will be locked out after the specified number of failed attempts. If you configure the **Account lockout duration** policy setting to 0, the account remains locked until you unlock it manually. + ### Countermeasure + Configure the **Account lockout duration** policy setting to an appropriate value for your environment. To specify that the account will remain locked until you manually unlock it, configure the value to 0. When the **Account lockout duration** policy setting is configured to a nonzero value, automated attempts to guess account passwords are delayed for this interval before resuming attempts against a specific account. Using this setting in combination with the [Account lockout threshold](account-lockout-threshold.md) policy setting makes automated password guessing attempts more difficult. + ### Potential impact + Configuring the **Account lockout duration** policy setting to 0 so that accounts cannot be automatically unlocked can increase the number of requests that your organization's Help Desk receives to unlock accounts that were locked by mistake. + ## Related topics + [Account Lockout Policy](account-lockout-policy.md)     diff --git a/windows/keep-secure/account-lockout-policy.md b/windows/keep-secure/account-lockout-policy.md index b40257e0c8..edf3c1a723 100644 --- a/windows/keep-secure/account-lockout-policy.md +++ b/windows/keep-secure/account-lockout-policy.md @@ -2,47 +2,34 @@ title: Account Lockout Policy (Windows 10) description: Describes the Account Lockout Policy settings and links to information about each policy setting. ms.assetid: eb968c28-17c5-405f-b413-50728cb7b724 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Account Lockout Policy + **Applies to** - Windows 10 + Describes the Account Lockout Policy settings and links to information about each policy setting. + Someone who attempts to use more than a few unsuccessful passwords while trying to log on to your system might be a malicious user who is attempting to determine an account password by trial and error. Windows domain controllers keep track of logon attempts, and domain controllers can be configured to respond to this type of potential attack by disabling the account for a preset period of time. Account Lockout Policy settings control the threshold for this response and the actions to be taken after the threshold is reached. The Account Lockout Policy settings can be configured in the following location in the Group Policy Management Console: **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Account Lockout Policy**. + The following topics provide a discussion of each policy setting's implementation and best practices considerations, policy location, default values for the server type or Group Policy Object (GPO), relevant differences in operating system versions, and security considerations (including the possible vulnerabilities of each policy setting), countermeasures that you can implement, and the potential impact of implementing the countermeasures. + ## In this section - ---- - - - - - - - - - - - - - - - - - - - - -
    TopicDescription

    [Account lockout duration](account-lockout-duration.md)

    Describes the best practices, location, values, and security considerations for the Account lockout duration security policy setting.

    [Account lockout threshold](account-lockout-threshold.md)

    Describes the best practices, location, values, and security considerations for the Account lockout threshold security policy setting.

    [Reset account lockout counter after](reset-account-lockout-counter-after.md)

    Describes the best practices, location, values, and security considerations for the Reset account lockout counter after security policy setting.

    + +| Topic | Description | +| - | - | +| [Account lockout duration](account-lockout-duration.md) | Describes the best practices, location, values, and security considerations for the **Account lockout duration** security policy setting. | +| [Account lockout threshold](account-lockout-threshold.md) | Describes the best practices, location, values, and security considerations for the **Account lockout threshold** security policy setting. | +| [Reset account lockout counter after](reset-account-lockout-counter-after.md) | Describes the best practices, location, values, and security considerations for the **Reset account lockout counter after** security policy setting. |   ## Related topics + [Configure security policy settings](how-to-configure-security-policy-settings.md)     diff --git a/windows/keep-secure/account-lockout-threshold.md b/windows/keep-secure/account-lockout-threshold.md index 8844acfdab..56fedf53b7 100644 --- a/windows/keep-secure/account-lockout-threshold.md +++ b/windows/keep-secure/account-lockout-threshold.md @@ -2,104 +2,104 @@ title: Account lockout threshold (Windows 10) description: Describes the best practices, location, values, and security considerations for the Account lockout threshold security policy setting. ms.assetid: 4904bb40-a2bd-4fef-a102-260ba8d74e30 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Account lockout threshold + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Account lockout threshold** security policy setting. + ## Reference + The **Account lockout threshold** policy setting determines the number of failed sign-in attempts that will cause a user account to be locked. A locked account cannot be used until you reset it or until the number of minutes specified by the [Account lockout duration](account-lockout-duration.md) policy setting expires. You can set a value from 1 through 999 failed sign-in attempts, or you can specify that the account will never be locked by setting the value to 0. If **Account lockout threshold** is set to a number greater than zero, **Account lockout duration** must be greater than or equal to the value of [Reset account lockout counter after](reset-account-lockout-counter-after.md). + Failed password attempts on workstations or member servers that have been locked by using CTRL+ALT+DELETE or password-protected screen savers do not count as failed sign-in attempts unless [Interactive logon: Require Domain Controller authentication to unlock workstation](interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md) is set to **Enabled**. If Interactive logon: Require Domain Controller authentication to unlock workstation is enabled, repeated failed password attempts to unlock the workstation will count against the account lockout threshold. + Brute force password attacks can be automated to try thousands or even millions of password combinations for any or all user accounts. Limiting the number of failed sign-ins that can be performed nearly eliminates the effectiveness of such attacks. However, it is important to note that a denial-of-service (DoS) attack could be performed on a domain that has an account lockout threshold configured. A malicious user could programmatically attempt a series of password attacks against all users in the organization. If the number of attempts is greater than the value of **Account lockout threshold**, the attacker could potentially lock every account. + ### Possible values + It is possible to configure the following values for the **Account lockout threshold** policy setting: - A user-defined number from 0 through 999 - Not defined + Because vulnerabilities can exist when this value is configured and when it is not, organizations should weigh their identified threats and the risks that they are trying to mitigate. For information these settings, see [Countermeasure](#bkmk-countermeasure) in this topic + ### Best practices + The threshold that you select is a balance between operational efficiency and security, and it depends on your organization's risk level. To allow for user error and to thwart brute force attacks, a setting above 4 and below 10 could be an acceptable starting point for your organization. -**Important**   -Implementation of this policy setting is dependent on your operational environment; threat vectors, deployed operating systems, and deployed apps. For more information, see [Implementation considerations](#bkmk-impleconsiderations) in this topic. +> **Important:**  Implementation of this policy setting is dependent on your operational environment; threat vectors, deployed operating systems, and deployed apps. For more information, see [Implementation considerations](#bkmk-impleconsiderations) in this topic.   ### Location + **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Account Lockout Policy** + ### Default values + The following table lists the actual and effective default policy values. Default values are also listed on the property page for the policy setting. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Server type or Group Policy Object (GPO)Default value

    Default domain policy

    0 invalid sign-in attempts

    Default domain controller policy

    Not defined

    Stand-alone server default settings

    0 invalid sign-in attempts

    Domain controller effective default settings

    0 invalid sign-in attempts

    Member server effective default settings

    0 invalid sign-in attempts

    Effective GPO default settings on client computers

    0 invalid sign-in attempts

    + +| Server type or Group Policy Object (GPO) | Default value | +| - | - | +| Default domain policy | 0 invalid sign-in attempts | +| Default domain controller policy | Not defined | +| Stand-alone server default settings | 0 invalid sign-in attempts | +| Domain controller effective default settings | 0 invalid sign-in attempts | +| Member server effective default settings |0 invalid sign-in attempts | +| Effective GPO default settings on client computers |0 invalid sign-in attempts |   ### Policy management + This section describes features and tools that are available to help you manage this policy setting. + ### Restart requirements + None. Changes to this policy setting become effective without a computer restart when they are saved locally or distributed through Group Policy. + ### Implementation considerations + Implementation of this policy setting is dependent on your operational environment. You should consider threat vectors, deployed operating systems, and deployed apps, for example: - The likelihood of an account theft or a DoS attack is based on the security design for your systems and environment. You should set the account lockout threshold in consideration of the known and perceived risk of those threats. - When negotiating encryption types between clients, servers, and domain controllers, the Kerberos protocol can automatically retry account sign-in attempts that count toward the threshold limits that you set in this policy setting. In environments where different versions of the operating system are deployed, encryption type negotiation increases. - Not all apps that are used in your environment effectively manage how many times a user can attempt to sign-in. For instance, if a connection drops repeatedly when a user is running the app, all subsequent failed sign-in attempts count toward the account lockout threshold. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Brute force password attacks can use automated methods to try millions of password combinations for any user account. The effectiveness of such attacks can be almost eliminated if you limit the number of failed sign-in attempts that can be performed. However, a DoS attack could be performed on a domain that has an account lockout threshold configured. An attacker could programmatically attempt a series of password attacks against all users in the organization. If the number of attempts is greater than the account lockout threshold, the attacker might be able to lock every account without needing any special privileges or being authenticated in the network. -**Note**   -Offline password attacks are not countered by this policy setting. + +> **Note:** Offline password attacks are not countered by this policy setting.   ### Countermeasure + Because vulnerabilities can exist when this value is configured and when it is not configured, two distinct countermeasures are defined. Organizations should weigh the choice between the two, based on their identified threats and the risks that they want to mitigate. The two countermeasure options are: - Configure the **Account lockout threshold** setting to 0. This configuration ensures that accounts will not be locked, and it will prevent a DoS attack that intentionally attempts to lock accounts. This configuration also helps reduce Help Desk calls because users cannot accidentally lock themselves out of their accounts. Because it does not prevent a brute force attack, this configuration should be chosen only if both of the following criteria are explicitly met: - The password policy setting requires all users to have complex passwords of 8 or more characters. - A robust audit mechanism is in place to alert administrators when a series of failed sign-ins occur in the environment. - Configure the **Account lockout threshold** policy setting to a sufficiently high value to provide users with the ability to accidentally mistype their password several times before the account is locked, but ensure that a brute force password attack still locks the account. + A good recommendation for such a configuration is 50 invalid sign-in attempts, which prevents accidental account lockouts and reduces the number of Help Desk calls, but does not prevent a DoS attack. We recommend this option if your organization cannot implement complex password requirements and an audit policy that alerts administrators to a series of failed sign-in attempts. Using this type of policy must be accompanied by a process to unlock locked accounts. It must be possible to implement this policy whenever it is needed to help mitigate massive lockouts caused by an attack on your systems. + ### Potential impact + If this policy setting is enabled, a locked account is not usable until it is reset by an administrator or until the account lockout duration expires. Enabling this setting will likely generate a number of additional Help Desk calls. + If you configure the **Account lockout threshold** policy setting to 0, there is a possibility that an malicious user's attempt to discover passwords with a brute force password attack might go undetected if a robust audit mechanism is not in place. + If you configure this policy setting to a number greater than 0, an attacker can easily lock any accounts for which the account name is known. This is especially dangerous considering that no credentials other than access to the network are necessary to lock the accounts. + ## Related topics [Account Lockout Policy](account-lockout-policy.md) -  -  +  \ No newline at end of file diff --git a/windows/keep-secure/account-policies.md b/windows/keep-secure/account-policies.md index af7f9913a7..487d575c7f 100644 --- a/windows/keep-secure/account-policies.md +++ b/windows/keep-secure/account-policies.md @@ -2,50 +2,33 @@ title: Account Policies (Windows 10) description: An overview of account policies in Windows and provides links to policy descriptions. ms.assetid: 711b3797-b87a-4cd9-a2e3-1f8ef18688fb -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Account Policies + **Applies to** - Windows 10 + An overview of account policies in Windows and provides links to policy descriptions. + All account policies settings applied by using Group Policy are applied at the domain level. Default values are present in the built-in default domain controller policy for Password Policy settings, Account Lockout Policy settings, and Kerberos Policy settings. The domain account policy becomes the default local account policy of any device that is a member of the domain. If these policies are set at any level below the domain level in Active Directory Domain Services (AD DS), they affect only local accounts on member servers. -**Note**   -Each domain can have only one account policy. The account policy must be defined in the default domain policy or in a new policy that is linked to the root of the domain and given precedence over the default domain policy, which is enforced by the domain controllers in the domain. These domain-wide account policy settings (Password Policy, Account Lockout Policy, and Kerberos Policy) are enforced by the domain controllers in the domain; therefore, domain controllers always retrieve the values of these account policy settings from the default domain policy Group Policy Object (GPO). +> **Note:**  Each domain can have only one account policy. The account policy must be defined in the default domain policy or in a new policy that is linked to the root of the domain and given precedence over the default domain policy, which is enforced by the domain controllers in the domain. These domain-wide account policy settings (Password Policy, Account Lockout Policy, and Kerberos Policy) are enforced by the domain controllers in the domain; therefore, domain controllers always retrieve the values of these account policy settings from the default domain policy Group Policy Object (GPO).   The only exception is when another account policy is defined for an organizational unit (OU). The account policy settings for the OU affect the local policy on any computers that are contained in the OU. For example, if an OU policy defines a maximum password age that differs from the domain-level account policy, the OU policy will be applied and enforced only when users log on to the local computer. The default local computer policies apply only to computers that are in a workgroup or in a domain where neither an OU account policy nor a domain policy applies. + ## In this section - ---- - - - - - - - - - - - - - - - - - - - - -
    TopicDescription

    [Password Policy](password-policy.md)

    An overview of password policies for Windows and links to information for each policy setting.

    [Account Lockout Policy](account-lockout-policy.md)

    Describes the Account Lockout Policy settings and links to information about each policy setting.

    [Kerberos Policy](kerberos-policy.md)

    Describes the Kerberos Policy settings and provides links to policy setting descriptions.

    + +| Topic | Description | +| - | - | +| [Password Policy](password-policy.md) | An overview of password policies for Windows and links to information for each policy setting. | +| [Account Lockout Policy](account-lockout-policy.md) | Describes the Account Lockout Policy settings and links to information about each policy setting. | +| [Kerberos Policy](kerberos-policy.md) | Describes the Kerberos Policy settings and provides links to policy setting descriptions. |   ## Related topics + [Configure security policy settings](how-to-configure-security-policy-settings.md) -  -  diff --git a/windows/keep-secure/accounts-administrator-account-status.md b/windows/keep-secure/accounts-administrator-account-status.md index 140f423d18..6c992c3bcb 100644 --- a/windows/keep-secure/accounts-administrator-account-status.md +++ b/windows/keep-secure/accounts-administrator-account-status.md @@ -2,102 +2,105 @@ title: Accounts Administrator account status (Windows 10) description: Describes the best practices, location, values, and security considerations for the Accounts Administrator account status security policy setting. ms.assetid: 71a3bd48-1014-49e0-a936-bfe9433af23e -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Accounts: Administrator account status + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Accounts: Administrator account status** security policy setting. + ## Reference + This security setting determines whether the local administrator account is enabled or disabled. + If you try to enable the administrator account after it has been disabled, and if the current administrator password does not meet the password requirements, you cannot enable the account. In this case, an alternative member of the Administrators group must reset the password on the administrator account. + If you disable this policy setting, and one of the following conditions exists on the computer, the administrator account is not disabled. 1. No other local administrator account exists 2. The administrator account is currently in use 3. All other local administrator accounts are: 1. Disabled 2. Listed in the [Deny log on locally](deny-log-on-locally.md) User Rights Assignment + If the current administrator password does not meet the password requirements, you will not be able to enable the administrator account again after it has been disabled. In this case, another member of the Administrators group must set the password on the administrator account. + ### Possible values - Enabled - Disabled - Not defined + By default, this setting is **Not defined** on domain controllers and **Enabled** on stand-alone servers. + ### Best practices + - Disabling the administrator account can become a maintenance issue under certain circumstances. For example, in a domain environment, if the secure channel that constitutes your connection fails for any reason, and there is no other local administrator account, you must restart the computer in safe mode to fix the problem that broke your connection status. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Server type or GPODefault value

    Default Domain Policy

    Not defined

    Default Domain Controller Policy

    Not defined

    Stand-Alone Server Default Settings

    Enabled

    DC Effective Default Settings

    Enabled

    Member Server Effective Default Settings

    Enabled

    Client Computer Effective Default Settings

    Disabled

    + +| Server type or GPO | Default value | +| Default Domain Policy | Not defined | +| Default Domain Controller Policy |Not defined | +| Stand-Alone Server Default Settings | Enabled | +| DC Effective Default Settings | Enabled | +| Member Server Effective Default Settings | Enabled | +| Client Computer Effective Default Settings | Disabled |   ## Policy management + Disabling the administrator account can become a maintenance issue under certain circumstances. Reasons that an organization might consider disabling the built-in administrator account include: + - For some organizations, periodically changing the passwords for local accounts can be a daunting management challenge. - By default, the administrator account cannot be locked—no matter how many failed attempts to sign in a user accrues. This makes it a prime target for brute-force, password-guessing attacks. - This account has a well-known security identifier (SID). Some non-Microsoft tools allow you to authenticate over the network by specifying the SID rather than the account name. This means that even if you rename the administrator account, a malicious user could start a brute-force attack by using the SID. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Safe mode considerations + When you start a device in safe mode, the disabled administrator account is enabled only if the computer is non-domain joined and there are no other active local administrator accounts. If the computer is joined to a domain, the disabled administrator account is not enabled. If the administrator account is disabled, you can still access the computer by using safe mode with the current administrative credentials. For example, if a failure occurs using a secure channel with a domain-joined computer, and there is no other local administrator account, you must restart the device in safe mode to fix the failure. + ### How to access a disabled Administrator account + You can use the following methods to access a disabled Administrator account: - When there is only one local administrator account that is disabled, start the device in safe mode (locally or over a network), and sign in by using the credentials for the administrator account on that computer. -- When there are local administrator accounts in addition to the built-in account, start the computer in safe mode (locally or over a network), and sign in by using the credentials for the administrator account on that device. An alternate method is to sign in to Windows by using another local Administrator account that was created. +- When there are local administrator accounts in addition to the built-in account, start the computer in safe mode (locally or over a network), and sign in by using the credentials for the administrator account on that device. An alternate method is to sign in to Windows by using another local +Administrator account that was created. - When multiple domain-joined servers have a disabled local Administrator account that can be accessed in safe mode, you can remotely run psexec by using the following command: **net user administrator /active: no**. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + The built-in administrator account cannot be locked out no matter how many failed logons it accrues, which makes it a prime target for brute-force attacks that attempt to guess passwords. Also, this account has a well-known security identifier (SID), and there are non-Microsoft tools that allow authentication by using the SID rather than the account name. Therefore, even if you rename the Administrator account, an attacker could launch a brute-force attack by using the SID to log on. All other accounts that are members of the Administrator's group have the safeguard of locking out the account if the number of failed logons exceeds its configured maximum. + ### Countermeasure + Disable the **Accounts: Administrator account status** setting so that the built-in Administrator account cannot be used in a normal system startup. If it is very difficult to maintain a regular schedule for periodic password changes for local accounts, you can disable the built-in administrator account instead of relying on regular password changes to protect it from attack. + ### Potential impact + Maintenance issues can arise under certain circumstances if you disable the administrator account. For example, if the secure channel between a member computer and the domain controller fails in a domain environment for any reason and there is no other local administrator account, you must restart in safe mode to fix the problem that caused the secure channel to fail. If the current administrator password does not meet the password requirements, you cannot enable the administrator account after it is disabled. If this situation occurs, another member of the administrators group must set the password on the administrator account. + ## Related topics + [Security Options](security-options.md) -  -  diff --git a/windows/keep-secure/accounts-block-microsoft-accounts.md b/windows/keep-secure/accounts-block-microsoft-accounts.md index 57bf409adb..a482a7a88c 100644 --- a/windows/keep-secure/accounts-block-microsoft-accounts.md +++ b/windows/keep-secure/accounts-block-microsoft-accounts.md @@ -2,85 +2,85 @@ title: Accounts Block Microsoft accounts (Windows 10) description: Describes the best practices, location, values, management, and security considerations for the Accounts Block Microsoft accounts security policy setting. ms.assetid: 94c76f45-057c-4d80-8d01-033cf28ef2f7 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Accounts: Block Microsoft accounts + **Applies to** - Windows 10 + Describes the best practices, location, values, management, and security considerations for the **Accounts: Block Microsoft accounts** security policy setting. + ## Reference -This policy setting prevents users from adding new Microsoft accounts on a device + +This policy setting prevents users from adding new Microsoft accounts on a device. + If you click the **Users can’t add Microsoft accounts** setting option, users will not be able to switch a local account to a Microsoft account, or connect a domain account to a Microsoft account to drive sync, roaming, or other background services. This is the preferred option if you need to limit the use of Microsoft accounts in your enterprise. Users will still be able to add app-specific Microsoft accounts for use with consumer apps. To block this use, turn off the ability to install consumer apps or the Store. + If you click the **Users can’t add or log on with Microsoft accounts** setting option, existing Microsoft account users will not be able to log on to Windows. Selecting this option might make it impossible for an existing administrator to log on to a computer and manage the system. + If you disable or do not configure this policy (recommended), users will be able to use Microsoft accounts with Windows. + ### Possible values - This policy is disabled - Users can’t add Microsoft accounts - Users can’t add or log on with Microsoft accounts + By default, this setting is not defined on domain controllers and disabled on stand-alone servers. + ### Best practices + - By disabling or not configuring this policy setting on the client computer, users will be able to use their Microsoft account, local account, or domain account for their sign-in session to Windows. It also enables the user to connect a local or domain account to a Microsoft account. This provides a convenient option for your users. - If you need to limit the use of Microsoft accounts in your organization, click the **Users can’t add Microsoft accounts** setting option so that users will not be able to create new Microsoft accounts on a computer, switch a local account to a Microsoft account, or connect a domain account to a Microsoft account. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Server type or GPODefault value

    Default Domain Policy

    Not defined

    Default Domain Controller Policy

    Not defined

    Stand-Alone Server Default Settings

    Disabled

    DC Effective Default Settings

    Disabled

    Member Server Effective Default Settings

    Disabled

    Client Computer Effective Default Settings

    Disabled

    + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined | +| Default Domain Controller Policy | Not defined | +| Stand-Alone Server Default Settings | Disabled | +| DC Effective Default Settings | Disabled | +| Member Server Effective Default Settings | Disabled | +| Client Computer Effective Default Settings | Disabled |   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of the countermeasure implementation. + ### Vulnerability + Although Microsoft accounts are password-protected, they also have the potential of greater exposure outside of the enterprise. Additionally, if the owner of a Microsoft account is not easily distinguishable, auditing and forensics become more difficult. + ### Countermeasure + Require only domain accounts in your enterprise by limiting the use of Microsoft accounts. Click the **Users can’t add Microsoft accounts** setting option so that users will not be able to create new Microsoft accounts on a device, switch a local account to a Microsoft account, or connect a domain account to a Microsoft account. + ### Potential impact + Establishing greater control over accounts in your organization can give you more secure management capabilities, including procedures around password resets. + ## Related topics + [Security Options](security-options.md)     diff --git a/windows/keep-secure/accounts-guest-account-status.md b/windows/keep-secure/accounts-guest-account-status.md index 20b050727a..2e66ee3ae1 100644 --- a/windows/keep-secure/accounts-guest-account-status.md +++ b/windows/keep-secure/accounts-guest-account-status.md @@ -2,77 +2,70 @@ title: Accounts Guest account status (Windows 10) description: Describes the best practices, location, values, and security considerations for the Accounts Guest account status security policy setting. ms.assetid: 07e53fc5-b495-4d02-ab42-5b245d10d0ce -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Accounts: Guest account status + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Accounts: Guest account status** security policy setting. + ## Reference + The **Accounts: Guest account status** policy setting determines whether the Guest account is enabled or disabled. This account allows unauthenticated network users to gain access to the system by logging on as a Guest with no password. Unauthorized users can access any resources that are accessible to the Guest account over the network. This means that any network shared folders with permissions that allow access to the Guest account, the Guests group, or the Everyone group will be accessible over the network. This can lead to the exposure or corruption of data. + ### Possible values + - Enabled - Disabled - Not defined + ### Best practices + Set **Accounts: Guest account status** to Disabled so that the built-in Guest account is no longer usable. All network users will have to authenticate before they can access shared resources on the system. If the Guest account is disabled and [Network access: Sharing and security model for local accounts](network-access-sharing-and-security-model-for-local-accounts.md) is set to **Guest only**, network logons—such as those performed by the SMB Service—will fail. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Server type or GPODefault value

    Default Domain Policy

    Not defined

    Default Domain Controller Policy

    Not defined

    Stand-Alone Server Default Settings

    Disabled

    DC Effective Default Settings

    Disabled

    Member Server Effective Default Settings

    Disabled

    Client Computer Effective Default Settings

    Disabled

    + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined | +| Default Domain Controller Policy | Not defined | +| Stand-Alone Server Default Settings | Disabled | +| DC Effective Default Settings | Disabled | +| Member Server Effective Default Settings | Disabled | +| Client Computer Effective Default Settings | Disabled |   ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + The default Guest account allows unauthenticated network users to log on as a Guest with no password. These unauthorized users could access any resources that are accessible to the Guest account over the network. This capability means that any shared folders with permissions that allow access to the Guest account, the Guests group, or the Everyone group are accessible over the network, which could lead to the exposure or corruption of data. + ### Countermeasure + Disable the **Accounts: Guest account status** setting so that the built-in Guest account cannot be used. + ### Potential impact + All network users must be authenticated before they can access shared resources. If you disable the Guest account and the **Network Access: Sharing and Security Model** option is set to **Guest Only**, network logons, such as those performed by the Microsoft Network Server (SMB Service), fail. This policy setting should have little impact on most organizations because it is the default setting starting with Windows Vista and Windows Server 2003. + ## Related topics + [Security Options](security-options.md)     diff --git a/windows/keep-secure/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md b/windows/keep-secure/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md index 4a57c0cadc..9d8ddd27c9 100644 --- a/windows/keep-secure/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md +++ b/windows/keep-secure/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md @@ -2,88 +2,89 @@ title: Accounts Limit local account use of blank passwords to console logon only (Windows 10) description: Describes the best practices, location, values, and security considerations for the Accounts Limit local account use of blank passwords to console logon only security policy setting. ms.assetid: a1bfb58b-1ae8-4de9-832b-aa889a6e64bd -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Accounts: Limit local account use of blank passwords to console logon only + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Accounts: Limit local account use of blank passwords to console logon only** security policy setting. + ## Reference + The **Accounts: Limit local account use of blank passwords to console logon only** policy setting determines whether remote interactive logons by network services such as Remote Desktop Services, Telnet, and File Transfer Protocol (FTP) are allowed for local accounts that have blank passwords. If this policy setting is enabled, a local account must have a nonblank password to be used to perform an interactive or network logon from a remote client. + This policy setting does not affect interactive logons that are performed physically at the console or logons that use domain accounts. It is possible for non-Microsoft applications that use remote interactive logons to bypass this policy setting. Blank passwords are a serious threat to computer security and they should be forbidden through both corporate policy and suitable technical measures. Nevertheless, if a user with the ability to create new accounts creates one that has bypassed your domain-based password policy settings, that account might have a blank password. For example, a user could build a stand-alone system, create one or more accounts with blank passwords, and then join the computer to the domain. The local accounts with blank passwords would still function. Anyone who knows the account name can then use accounts with blank passwords to log on to systems. + Devices that are not in physically secure locations should always enforce strong password policies for all local user accounts. Otherwise, anyone with physical access to the device can log on by using a user account that does not have a password. This is especially important for portable devices. + If you apply this security policy to the Everyone group, no one will be able to log on through Remote Desktop Services. + ### Possible values + - Enabled - Disabled - Not defined + ### Best practices + - It is advisable to set **Accounts: Limit local account use of blank passwords to console logon only** to Enabled. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Server type or GPODefault value

    Default Domain Policy

    Not defined

    Default Domain Controller Policy

    Not defined

    Stand-Alone Server Default Settings

    Enabled

    DC Effective Default Settings

    Enabled

    Member Server Effective Default Settings

    Enabled

    Client Computer Effective Default Settings

    Enabled

    + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined | +| Default Domain Controller Policy | Not defined | +| Stand-Alone Server Default Settings | Enabled | +| DC Effective Default Settings | Enabled | +| Member Server Effective Default Settings | Enabled | +| Client Computer Effective Default Settings | Enabled |   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Policy conflict considerations + The policy as distributed through the GPO takes precedence over the locally configured policy setting on a computer joined to a domain. On the domain controller, use ADSI Edit or the dsquery command to determine effective minimum password length. + ### Group Policy + This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local device by using the Local Security Policy snap-in. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Blank passwords are a serious threat to computer security, and they should be forbidden through organizational policy and suitable technical measures. Starting with Windows Server 2003, the default settings for Active Directory domains require complex passwords of at least seven characters, and eight characters starting with Windows Server 2008. However, if users with the ability to create new accounts bypass your domain-based password policies, they could create accounts with blank passwords. For example, a user could build a stand-alone computer, create one or more accounts with blank passwords, and then join the computer to the domain. The local accounts with blank passwords would still function. Anyone who knows the name of one of these unprotected accounts could then use it to log on. + ### Countermeasure + Enable the **Accounts: Limit local account use of blank passwords to console logon only** setting. + ### Potential impact + None. This is the default configuration. + ## Related topics [Security Options](security-options.md) -  -  diff --git a/windows/keep-secure/accounts-rename-administrator-account.md b/windows/keep-secure/accounts-rename-administrator-account.md index d8c01feedb..8873990424 100644 --- a/windows/keep-secure/accounts-rename-administrator-account.md +++ b/windows/keep-secure/accounts-rename-administrator-account.md @@ -2,86 +2,87 @@ title: Accounts Rename administrator account (Windows 10) description: This security policy reference topic for the IT professional describes the best practices, location, values, and security considerations for this policy setting. ms.assetid: d21308eb-7c60-4e48-8747-62b8109844f9 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Accounts: Rename administrator account + **Applies to** - Windows 10 + This security policy reference topic for the IT professional describes the best practices, location, values, and security considerations for this policy setting. + ## Reference + The **Accounts: Rename administrator account** policy setting determines whether a different account name is associated with the security identifier (SID) for the administrator account. + Because the administrator account exists on all Windows 10 for desktop editions (Home, Pro, Enterprise, and Education), renaming the account makes it slightly more difficult for attackers to guess this user name and password combination. + Rename the Administrator account by specifying a value for the **Accounts: Rename administrator account** policy setting. + ### Possible values - User-defined text - Not defined + ### Best practices - Be sure to inform users who are authorized to use this account of the new account name. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Server type or GPODefault value

    Default Domain Policy

    Not defined

    Default Domain Controller Policy

    Not defined

    Stand-Alone Server Default Settings

    Administrator

    DC Effective Default Settings

    Administrator

    Member Server Effective Default Settings

    Administrator

    Client Computer Effective Default Settings

    Administrator

    + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined | +| Default Domain Controller Policy | Not defined | +| Stand-Alone Server Default Settings | Administrator | +| DC Effective Default Settings | Administrator | +| Member Server Effective Default Settings | Administrator | +| Client Computer Effective Default Settings | Administrator |   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. + ### Policy conflict considerations + None. + ### Group Policy + This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local device by using the Local Security Policy snap-in. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + The Administrator account exists on all versions Windows 10 for desktop editions. If you rename this account, it is slightly more difficult for unauthorized persons to guess this privileged user name and password combination. Beginning with Windows Vista, the person who installs the operating system specifies an account that is the first member of the Administrator group and has full rights to configure the computer so this countermeasure is applied by default on new installations. If a device is upgraded from a previous version of Windows, the account with the name administrator is retained with all the rights and privileges that were defined for the account in the previous installation. + The built-in administrator account cannot be locked out, regardless of how many times an attacker might use a bad password. This capability makes the administrator account a popular target for brute-force attacks that attempt to guess passwords. The value of this countermeasure is lessened because this account has a well-known SID, and there are non-Microsoft tools that allow authentication by using the SID rather than the account name. Therefore, even if you rename the Administrator account, an attacker could launch a brute-force attack by using the SID to log on. + ### Countermeasure + Specify a new name in the **Accounts: Rename administrator account** setting to rename the Administrator account. + ### Potential impact + You must provide users who are authorized to use this account with the new account name. (The guidance for this setting assumes that the Administrator account was not disabled.) + ## Related topics + [Security Options](security-options.md)     diff --git a/windows/keep-secure/accounts-rename-guest-account.md b/windows/keep-secure/accounts-rename-guest-account.md index d4c774b3ba..f82b907968 100644 --- a/windows/keep-secure/accounts-rename-guest-account.md +++ b/windows/keep-secure/accounts-rename-guest-account.md @@ -2,84 +2,86 @@ title: Accounts Rename guest account (Windows 10) description: Describes the best practices, location, values, and security considerations for the Accounts Rename guest account security policy setting. ms.assetid: 9b8052b4-bbb9-4cc1-bfee-ce25390db707 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Accounts: Rename guest account + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Accounts: Rename guest account** security policy setting. + ## Reference + The **Accounts: Rename guest account** policy setting determines whether a different account name is associated with the security identifier (SID) for the Guest account. + ### Possible values + - *User-defined text* - Guest + ### Best practices + 1. For devices in unsecured locations, renaming the account makes it more difficult for unauthorized users to guess it. 2. For computers in secured or trusted locations, keeping the name of the account as Guest provides consistency among devices + ### Location + Computer Configuration\\Windows Settings\\Security Settings + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Server type or GPODefault value

    Default Domain Policy

    Guest

    Default Domain Controller Policy

    Guest

    Stand-Alone Server Default Settings

    Guest

    DC Effective Default Settings

    Guest

    Member Server Effective Default Settings

    Guest

    Client Computer Effective Default Settings

    User-defined text

    + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Guest | +| Default Domain Controller Policy | Guest | +| Stand-Alone Server Default Settings | Guest | +| DC Effective Default Settings | Guest | +| Member Server Effective Default Settings | Guest | +| Client Computer Effective Default Settings | *User-defined text* |   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Policy conflict considerations + None. + ### Group Policy + This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local device by using the Local Security Policy snap-in. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability -The guest account exists in all Windows server and client operating system versions beginning with Windows Server 2003 and Windows XP Professional. Because the account name is well known, it provides a vector for a malicious user to get access to network resources and attempt to elevate privileges or install software that could be used for a later attack on your system. + +The guest account exists in all Windows server and client operating system versions beginning with Windows Server 2003 and Windows XP Professional. Because the account name is well known, it provides a vector for a malicious user to get access to network resources and attempt to elevate privileges +or install software that could be used for a later attack on your system. + ### Countermeasure + Specify a new name in the **Accounts: Rename guest account** setting to rename the Guest account. If you rename this account, it is slightly more difficult for unauthorized persons to guess this privileged user name and password combination. + ### Potential impact + There should be little impact because the Guest account is disabled by default in Windows 2000 Server, Windows Server 2003, and Windows XP. For later operating systems, the policy is enabled with **Guest** as the default. + ## Related topics + [Security Options](security-options.md)     diff --git a/windows/keep-secure/act-as-part-of-the-operating-system.md b/windows/keep-secure/act-as-part-of-the-operating-system.md index 7d61b7524f..5d4a39d466 100644 --- a/windows/keep-secure/act-as-part-of-the-operating-system.md +++ b/windows/keep-secure/act-as-part-of-the-operating-system.md @@ -2,87 +2,82 @@ title: Act as part of the operating system (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Act as part of the operating system security policy setting. ms.assetid: c1b7e084-a9f7-4377-b678-07cc913c8b0c -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Act as part of the operating system + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Act as part of the operating system** security policy setting. + ## Reference + The **Act as part of the operating system** policy setting determines whether a process can assume the identity of any user and thereby gain access to the resources that the user is authorized to access. Typically, only low-level authentication services require this user right. Potential access is not limited to what is associated with the user by default. The calling process may request that arbitrary additional privileges be added to the access token. The calling process may also build an access token that does not provide a primary identity for auditing in the system event logs. Constant: SeTcbPrivilege + ### Possible values - User-defined list of accounts - Not defined + ### Best practices - Do not assign this right to any user accounts. Only assign this user right to trusted users. - If a service requires this user right, configure the service to log on by using the local System account, which inherently includes this user right. Do not create a separate account and assign this user right to it. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Server type or GPODefault value

    Default domain policy

    Not defined

    Default domain controller policy

    Not defined

    Stand-alone server default settings

    Not defined

    Domain controller effective default settings

    Not defined

    Member server effective default settings

    Not defined

    Client computer effective default settings

    Not defined

    + +| Server type or GPO | Default value | +| - | - | +| Default domain policy | Not defined | +| Default domain controller policy| Not defined | +| Stand-alone server default settings | Not defined | +| Domain controller effective default settings | Not defined | +| Member server effective default settings | Not defined | +| Client computer effective default settings | Not defined |   ## Policy management + A restart of the device is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + The **Act as part of the operating system** user right is extremely powerful. Users with this user right can take complete control of the device and erase evidence of their activities. + ### Countermeasure + Restrict the **Act as part of the operating system** user right to as few accounts as possible—it should not even be assigned to the Administrators group under typical circumstances. When a service requires this user right, configure the service to log on with the Local System account, which inherently includes this privilege. Do not create a separate account and assign this user right to it. + ### Potential impact + There should be little or no impact because the **Act as part of the operating system** user right is rarely needed by any accounts other than the Local System account. + ## Related topics [User Rights Assignment](user-rights-assignment.md) -  -  +  \ No newline at end of file diff --git a/windows/keep-secure/creating-a-device-guard-policy-for-signed-apps.md b/windows/keep-secure/creating-a-device-guard-policy-for-signed-apps.md index 7c7ee70851..ee2f72275b 100644 --- a/windows/keep-secure/creating-a-device-guard-policy-for-signed-apps.md +++ b/windows/keep-secure/creating-a-device-guard-policy-for-signed-apps.md @@ -2,21 +2,26 @@ title: Create a Device Guard code integrity policy based on a reference device (Windows 10) description: To implement Device Guard app protection, you will need to create a code integrity policy. Code integrity policies determine what apps are considered trustworthy and are allowed to run on a protected device. ms.assetid: 6C94B14E-E2CE-4F6C-8939-4B375406E825 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Create a Device Guard code integrity policy based on a reference device **Applies to** - Windows 10 + To implement Device Guard app protection, you will need to create a code integrity policy. Code integrity policies determine what apps are considered trustworthy and are allowed to run on a protected device. + ## Create a Device Guard code integrity policy based on a reference device + To create a code integrity policy, you'll first need to create a reference image that includes the signed applications you want to run on your protected devices. For information on how to sign applications, see [Getting apps to run on Device Guard-protected devices](getting-apps-to-run-on-device-guard-protected-devices.md). -**Note**  Before creating a code integrity policy, make sure your reference device is clean of viruses and malware. +> **Note:**  Before creating a code integrity policy, make sure your reference device is clean of viruses and malware.   **To create a code integrity policy based on a reference device** + 1. On your reference device, start PowerShell as an administrator. 2. In PowerShell, initialize variables by typing: ``` syntax @@ -99,7 +104,7 @@ To create a code integrity policy, you'll first need to create a reference image ConvertFrom-CIPolicy $InitialCIPolicy $CIPolicyBin ``` Once you have completed these steps, the Device Guard policy binary file (DeviceGuardPolicy.bin) and original xml file (InitialScan.xml) will be available on your desktop. -**Note**  We recommend that you keep a copy of InitialScan.xml to use if you need to merge this code integrity policy with another policy, or update policy rule options. +>**Note:**  We recommend that you keep a copy of InitialScan.xml to use if you need to merge this code integrity policy with another policy, or update policy rule options.   ## Related topics [Getting apps to run on Device Guard-protected devices](getting-apps-to-run-on-device-guard-protected-devices.md) diff --git a/windows/keep-secure/get-started-with-windows-defender-for-windows-10.md b/windows/keep-secure/get-started-with-windows-defender-for-windows-10.md index 228813557c..f7b4350a6f 100644 --- a/windows/keep-secure/get-started-with-windows-defender-for-windows-10.md +++ b/windows/keep-secure/get-started-with-windows-defender-for-windows-10.md @@ -2,53 +2,69 @@ title: Update and manage Windows Defender in Windows 10 (Windows 10) description: IT professionals can manage Windows Defender on Windows 10 endpoints in their organization using Microsoft Active Directory or Windows Server Update Services (WSUS), apply updates to endpoints, and manage scans using Group Policy SettingsWindows Management Instrumentation (WMI)PowerShell. ms.assetid: 045F5BF2-87D7-4522-97E1-C1D508E063A7 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library +ms.pagetype: security author: jasesso --- + # Update and manage Windows Defender in Windows 10 + **Applies to** - Windows 10 + IT professionals can manage Windows Defender on Windows 10 endpoints in their organization using Microsoft Active Directory or Windows Server Update Services (WSUS), apply updates to endpoints, and manage scans using: + - Group Policy Settings - Windows Management Instrumentation (WMI) - PowerShell + ## Manage Windows Defender endpoints through Active Directory and WSUS + All Windows 10 endpoints are installed with Windows Defender and include support for management through: - Active Directory - WSUS + You can use the Active Directory to configure the settings; Group policies can be used for centralized configuration and enforcement of many Windows Defender settings including client user interface, scan settings, and exclusions. WSUS can be used to view basic update compliance and deploy updates manually or through automatic rules. + Note that System Center 2012 R2 Configuration Manager SP1, System Center 2012 Configuration Manager SP2, and Microsoft Intune can provide centralized management of Windows Defender, including: + - Settings management - Definition update management - Alerts and alert management - Reports and reporting + When you enable *Endpoint Protection* on your clients, it will install an additional management layer on Windows Defender to manage the in-box Windows Defender agent. While the client user interface will still appear as Windows Defender, the management layer for System Center Endpoint Protection or Intune will be listed in the **Add/Remove Programs** control panel, though it will appear as if the full product is installed. Learn more about managing *Endpoint Protection*: + - [Help secure Windows PCs with Endpoint Protection for Microsoft Intune](https://technet.microsoft.com/library/dn646970.aspx) - [Endpoint Protection in Configuration Manager](https://technet.microsoft.com/library/hh508760.aspx) + Read more about System Center Configuration Manager in [Introduction to Endpoint Protection in Configuration Manager](https://technet.microsoft.com/library/hh508781.aspx). -**Important**  You must be licensed to use *Endpoint Protection* to manage clients in your Configuration Manager hierarchy. +> **Important:**  You must be licensed to use *Endpoint Protection* to manage clients in your Configuration Manager hierarchy.   ## Apply updates to Windows Defender endpoints + It is important to keep Windows Defender endpoints updated to ensure they are protected. All Windows Defender updates, including General Distribution Release (GDR) updates, are now applied as operating system updates. You can manage the distribution of updates through the [Windows Server Update Services (WSUS)](https://technet.microsoft.com/windowsserver/bb332157). + ## Manage email scans in Windows Defender + You can use Windows Defender to scan email files. Malware can install itself and hide in email files, and although real-time protection offers you the best protection from email malware, you can also scan emails stored on your PC or server with Windows Defender. -**Important**  Mail scanning only applies to on-demand and scheduled scans, not on-access scans. +> **Important:**  Mail scanning only applies to on-demand and scheduled scans, not on-access scans.   Windows Defender scans Microsoft Office Outlook 2003 and older email files. We identify the file type at run-time based on the content of the file, not on location or extension. -**Note**  Scanning email files might increase the time required to complete a scan. +> **Note: **  Scanning email files might increase the time required to complete a scan.   Windows Defender can extract embedded objects within a file (attachments and archived files, for example) and scan internally. -**Note**  While Windows Defender can be configured to scan email files, it can only remediate threats detected inside certain files, for example: +> **Note:**  While Windows Defender can be configured to scan email files, it can only remediate threats detected inside certain files, for example: - DBX - MBX - MIME   You can configure Windows Defender to scan PST files used by Outlook 2003 or older versions (where the archive type is set to non-uni-code), but Windows Defender cannot remediate threats detected inside PST files. We recommend using real-time protection to protect against email malware. + If Windows Defender detects a threat inside an email, it will show you the following information to assist you in identifying the compromised email, so you can remediate the threat: - Email subject - Attachment name @@ -56,77 +72,117 @@ Email scanning in Windows Defender is turned off by default. There are three way - *Group Policy* settings - WMI - PowerShell -**Important**  There are some risks associated with scanning some Microsoft Outlook files and email messages. You can read about tips and risks associated with scanning Outlook files and email messages in the following articles: +> **Important:**  There are some risks associated with scanning some Microsoft Outlook files and email messages. You can read about tips and risks associated with scanning Outlook files and email messages in the following articles: - [Scanning Outlook files in Outlook 2013](https://technet.microsoft.com/library/dn769141.aspx#bkmk-1) - [Scanning email messages in Outlook 2013](https://technet.microsoft.com/library/dn769141.aspx#bkmk-2)   ## Use *Group Policy* settings to enable email scans + This policy setting allows you to turn on email scanning. When email scanning is enabled, the engine will parse the mailbox and mail files to analyze the mail bodies and attachments. + Turn on email scanning with the following *Group Policy* settings: 1. Open the **Group Policy Editor**. 2. In the **Local Computer Policy** tree, expand **Computer Configuration**, then **Administrative Templates**, then **Windows Components**, then **Windows Defender**. 3. Click **Scan**. 4. Double-click **Turn on e-mail scanning**. - This will open the **Turn on e-mail scanning** window: ![turn on e-mail scanning window](images/defender-scanemailfiles.png) + + This will open the **Turn on e-mail scanning** window: + + ![turn on e-mail scanning window](images/defender-scanemailfiles.png) + 5. Select **Enabled**. 6. Click **OK** to apply changes. + ## Use WMI to disable email scans + You can write a WMI script or application to disable email scanning. Read more about [WMI in this article](https://msdn.microsoft.com/library/windows/desktop/dn439477.aspx), and read about [Windows Preference classes in this article](https://msdn.microsoft.com/library/windows/desktop/dn455323.aspx). + Use the **DisableEmailScanning** property of the **MSFT\_MpPreference** class (part of the Windows DefenderWMI provider) to enable or disable this setting: **DisableEmailScanning** Data type: **boolean** Access type: Read-only Disable email scanning. + ## Use PowerShell to enable email scans + You can also enable email scanning using the following PowerShell parameter: 1. Open PowerShell or PowerShellIntegrated Scripting Environment (ISE). 2. Type **Set-MpPreference -DisableEmailScanning $false**. + Read more about this in: - • [Scripting with Windows PowerShell](https://technet.microsoft.com/library/bb978526.aspx) - • [Defender Cmdlets](https://technet.microsoft.com/library/dn433280.aspx) + ## Manage archive scans in Windows Defender + You can use Windows Defender to scan archive files. Malware can install itself and hide in archive files, and although real-time protection offers you the best protection from malware, you can also scan archives stored on your PC or server with Windows Defender. -**Important**  Archive scanning only applies to on-demand and scheduled scans, not on-access scans. +> **Important:**  Archive scanning only applies to on-demand and scheduled scans, not on-access scans.   Archive scanning in Windows Defender is turned on by default. There are four ways you can manage scans through Windows Defender: - *Group Policy* settings - WMI - PowerShell - Endpoint Protection -**Note**  Scanning archive files might increase the time required to complete a scan. +> **Note:**  Scanning archive files might increase the time required to complete a scan.   If you exclude an archive file type by using the **Extensions** box, Windows Defender will not scan files with that extension (no matter what the content is), even when you have selected the **Scan archive files** check box. For example, if you exclude .rar files but there’s a .r00 file that’s actually .rar content, it will still be scanned if archive scanning is enabled. + ## Use *Group Policy* settings to enable archive scans + This policy setting allows you to turn on archive scanning. + Turn on email scanning with the following *Group Policy* settings: 1. Open the **Group Policy Editor**. 2. In the **Local Computer Policy** tree, expand **Computer Configuration**, then **Administrative Templates**, then **Windows Components**, then **Windows Defender**. 3. Click **Scan**. 4. Double-click **Scan archive files**. - This will open the **Scan archive files** window: ![scan archive files window](images/defender-scanarchivefiles.png) + + This will open the **Scan archive files** window: + + ![scan archive files window](images/defender-scanarchivefiles.png) + 5. Select **Enabled**. 6. Click **OK** to apply changes. + There are a number of archive scan settings in the **Scan** repository you can configure through *Group Policy*, for example: -- Maximum directory depth level into which archive files are unpacked during scanning ![specify the maximum depth to scan archive files window](images/defender-scanarchivedepth.png) -- Maximum size of archive files that will be scanned ![specify the maximum size of archive files to be scanned window](images/defender-scanarchivesize.png) -- Maximum percentage CPU utilization permitted during a scan ![specify the maximum percentage od cpu utilization during a scan window](images/defender-scanarchivecpu.png) +- Maximum directory depth level into which archive files are unpacked during scanning + + ![specify the maximum depth to scan archive files window](images/defender-scanarchivedepth.png) + +- Maximum size of archive files that will be scanned + + ![specify the maximum size of archive files to be scanned window](images/defender-scanarchivesize.png) + +- Maximum percentage CPU utilization permitted during a scan + + ![specify the maximum percentage od cpu utilization during a scan window](images/defender-scanarchivecpu.png) + ## Use WMI to disable archive scans + You can write a WMI script or application to disable archive scanning. Read more about [WMI in this article](https://msdn.microsoft.com/library/windows/desktop/dn439477.aspx), and read about [Windows Preference classes in this article](https://msdn.microsoft.com/library/windows/desktop/dn455323.aspx). + Use the **DisableArchiveScanning** property of the **MSFT\_MpPreference** class (part of the Windows DefenderWMI provider) to enable or disable this setting: **DisableArchiveScanning** Data type: **boolean** Access type: Read-only Disable archive scanning. + ## Use PowerShell to enable archive scans + You can also enable archive scanning using the following PowerShell parameter: 1. Open PowerShell or PowerShellISE. 2. Type **Set-MpPreference -DisableArchiveScanning $false**. + Read more about this in: -- • [Scripting with Windows PowerShell](https://technet.microsoft.com/library/bb978526.aspx) -- • [Defender Cmdlets](https://technet.microsoft.com/library/dn433280.aspx) +- [Scripting with Windows PowerShell](https://technet.microsoft.com/library/bb978526.aspx) +- [Defender Cmdlets](https://technet.microsoft.com/library/dn433280.aspx) + ## Use Endpoint Protection to configure archive scans + In Endpoint Protection, you can use the advanced scanning options to configure archive scanning. For more information, see [What are advanced scanning options?](https://technet.microsoft.com/library/ff823807.aspx) + ## Related topics + [Configure Windows Defender in Windows 10](configure-windows-defender-in-windows-10.md) [Troubleshoot Windows Defender in Windows 10](troubleshoot-windows-defender-in-windows-10.md)   diff --git a/windows/keep-secure/getting-apps-to-run-on-device-guard-protected-devices.md b/windows/keep-secure/getting-apps-to-run-on-device-guard-protected-devices.md index 3c60db513e..f9af00d1cd 100644 --- a/windows/keep-secure/getting-apps-to-run-on-device-guard-protected-devices.md +++ b/windows/keep-secure/getting-apps-to-run-on-device-guard-protected-devices.md @@ -2,28 +2,37 @@ title: Get apps to run on Device Guard-protected devices (Windows 10) description: Windows 10 introduces several new features and settings that when combined all equal what we're calling, Device Guard. ms.assetid: E62B68C3-8B9F-4842-90FC-B4EE9FF8A67E -ms.pagetype: security -keywords: ["Package Inspector", "packageinspector.exe", "sign catalog file"] +keywords: Package Inspector, packageinspector.exe, sign catalog file ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Get apps to run on Device Guard-protected devices + **Applies to** - Windows 10 + Windows 10 introduces several new features and settings that when combined all equal what we're calling, Device Guard. Device Guard can help to protect your enterprise devices against the accidental running of malicious apps by requiring all of your apps to be signed by a trusted entity. + To use Device Guard in an enterprise, you must be able to get your existing line-of-business and Independent Software Vendor (ISV)-developed apps to run on a protected device. Unfortunately, many line-of-business apps aren't signed, and in many cases, aren't even being actively developed. Similarly, you may have unsigned software from an ISV that you want to run, or you want to run certain applications from an ISV while not trusting all applications from that ISV. As part of the Device Guard features, Windows 10 includes a new tool called Package Inspector. Package Inspector scans your unsigned apps, and creates catalog files of the installed and running binaries, which can then be signed by the Sign Tool Windows SDK utility and distributed using Group Policy so that your apps will run on Device Guard-protected devices. + ## What you need to run your apps on Device-Guard protected devices + Before you can get your apps to run on Device Guard-protected devices, you must have: + - A device running Windows 10 Enterprise, Windows 10 Education, or Windows Server 2016 Technical Preview. - Determined which unsigned apps you need to include in your catalog file. - Created a code integrity policy for use by Device Guard. - A [code signing certificate](http://go.microsoft.com/fwlink/p/?LinkId=619282), created using an internal public key infrastructure (PKI). - [SignTool]( http://go.microsoft.com/fwlink/p/?LinkId=619283). A command-line tool that digitally signs files, verifies signatures in files, or time stamps files. The tool is installed in the \\Bin folder of the Microsoft Windows Software Development Kit (SDK) installation path. + ## Create a catalog file for unsigned apps + You must run Package Inspector on a device that's running a temporary Code Integrity Policy in audit mode, created explicitly for this purpose. Audit mode lets this policy catch any binaries missed by the inspection tool, but because it's audit mode, allows everything to continue running. -**Important**  This temporary policy, shouldn't be used for normal business purposes. +> **Important:**  This temporary policy, shouldn't be used for normal business purposes.   **To create a catalog file for an existing app** 1. Start PowerShell as an administrator, and create your temporary policy file by typing: @@ -63,12 +72,13 @@ You must run Package Inspector on a device that's running a temporary Code Integ   4. Copy the app installation media to your C:\\ drive, and then install and run the program. + Copying the media to your local drive helps to make sure that the installer and its related files are included in your catalog file. If you miss the install files, your Code Integrity Policy might trust the app to run, but not to install. After you've installed the app, you should check for updates. If updates happen while the app is open, you should close and restart the app to make sure everything is caught during the inspection process. - **Note**   - Because the Package Inspector creates a log entry in the catalog for every binary laid down on the file system, we recommend that you don't run any other installations or updates during the scanning process. + + > **Note:**  Because the Package Inspector creates a log entry in the catalog for every binary laid down on the file system, we recommend that you don't run any other installations or updates during the scanning process.   5. **Optional:** If you want to create a multi-app catalog (many apps included in a single catalog file), you can continue to run Steps 2-3 for each additional app. After you've added all of the apps you want to add, you can continue to Step 5. - **Note**  To streamline your process, we suggest: + > **Note: **  To streamline your process, we suggest: - **Actively supported and updated apps.** Create a single catalog file for each app. - **Legacy apps, non-active or not updated.** Create a single catalog file for all of your legacy apps.   @@ -142,12 +152,16 @@ The following table shows the available options for both the `scan` and `stop` c   You can add additional parameters to your catalog beyond what's listed here. For more info, see the [MakeCat](http://go.microsoft.com/fwlink/p/?LinkId=618024) topic. + ## Sign your catalog file using Sign Tool + You can sign your catalog file using Sign Tool, located in the Windows 7 or later Windows Software Development Kit (SDK) or by using the Device Guard signing portal. For details on using the Device Guard signing portal, see [Device Guard signing](http://go.microsoft.com/fwlink/p/?LinkID=698760). This process shows how to use a password-protected Personal Information Exchange (.pfx) file to sign the catalog file. -**Important**  To use this tool, you must have an internal certificate authority code signing certificate, or a code signing certificate issued by an external third-party certificate authority. + +> **Important:**  To use this tool, you must have an internal certificate authority code signing certificate, or a code signing certificate issued by an external third-party certificate authority.   **To use Sign Tool** + 1. Check that your code signing certificates have been imported into your certificate store or that they're on the file system. 2. Open SignTool.exe and sign the catalog file, based on where your certificate is stored. If you are using the PFX from a file system location: @@ -204,13 +218,18 @@ This process shows how to use a password-protected Personal Information Exchange   For more detailed info and examples using the available options, see the [SignTool.exe (Sign Tool)](http://go.microsoft.com/fwlink/p/?LinkId=618026) topic. + 3. In File Explorer, right-click your catalog file, click **Properties**, and then click the **Digital Signatures** tab to make sure your catalog file's digital signature is accurate. 4. Copy your catalog file to C:\\Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE} and test the file. - **Note**  For testing purposes, you can manually copy your file to this location. However, we recommend that you use Group Policy to copy the catalog file to all of your devices for large-scale implementations. -   + + >**Note:**  For testing purposes, you can manually copy your file to this location. However, we recommend that you use Group Policy to copy the catalog file to all of your devices for large-scale implementations. + ## Troubleshooting the Package Inspector + If you see "Error 1181" while stopping the Package Inspector, you'll need to increase your USN journal size and then clear all of the cached data before re-scanning the impacted apps. + You must make sure that you clear the cache by creating and setting a new temporary policy. If you reuse the same policy, the Package Inspector will fail. + **To increase your journal size** 1. Open a command-prompt window, and then type: ``` syntax @@ -218,7 +237,9 @@ You must make sure that you clear the cache by creating and setting a new tempor ``` Where the "m" value needs to be increased. We recommend that you change the value to at least 4 times the default value of m=0x2000000. 2. Re-run the failed app installation(s). + **To clear your cached data and re-scan your apps** + 1. Delete the SIPolicy.p7b file from the C:\\Windows\\System32\\CodeIntegrity\\ folder. 2. Create a new temporary Code Integrity Policy to clear all of the cached data by starting Windows Powershell as an administrator and typing: ``` syntax @@ -229,7 +250,7 @@ You must make sure that you clear the cache by creating and setting a new tempor cp .\DenyPackageInspector.bin C:\Windows\System32\SIPolicy.p7b ``` 3. Restart your device and follow the steps in the [Create a catalog file for unsigned apps](#create-a-catalog-file-for-unsigned-apps) section. + ## Related topics + [Download SignTool]( http://go.microsoft.com/fwlink/p/?LinkId=619283) -  -  diff --git a/windows/keep-secure/implement-microsoft-passport-in-your-organization.md b/windows/keep-secure/implement-microsoft-passport-in-your-organization.md index de7ca83f3f..95e304939b 100644 --- a/windows/keep-secure/implement-microsoft-passport-in-your-organization.md +++ b/windows/keep-secure/implement-microsoft-passport-in-your-organization.md @@ -2,22 +2,25 @@ title: Implement Microsoft Passport in your organization (Windows 10) description: You can create a Group Policy or mobile device management (MDM) policy that will implement Microsoft Passport on devices running Windows 10. ms.assetid: 47B55221-24BE-482D-BD31-C78B22AC06D8 -ms.pagetype: security -keywords: ["identity", "PIN", "biometric", "Hello"] +keywords: identity, PIN, biometric, Hello ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: jdeckerMS --- + # Implement Microsoft Passport in your organization + **Applies to** - Windows 10 - Windows 10 Mobile + You can create a Group Policy or mobile device management (MDM) policy that will implement Microsoft Passport on devices running Windows 10. -**Important**   -The Group Policy setting **Turn on PIN sign-in** does not apply to Windows 10. Use **Microsoft Passport for Work** policy settings to manage PINs. +> **Important:** The Group Policy setting **Turn on PIN sign-in** does not apply to Windows 10. Use **Microsoft Passport for Work** policy settings to manage PINs.   ## Group Policy settings for Passport + The following table lists the Group Policy settings that you can configure for Passport use in your workplace. These policy settings are available in **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **Microsoft Passport for Work**. @@ -132,7 +135,9 @@ The following table lists the Group Policy settings that you can configure for P
    + ## MDM policy settings for Passport + The following table lists the MDM policy settings that you can configure for Passport use in your workplace. These MDM policy settings use the [PassportForWork configuration service provider (CSP)](http://go.microsoft.com/fwlink/p/?LinkId=692070). @@ -276,10 +281,12 @@ The following table lists the MDM policy settings that you can configure for Pas
    + **Note**   If policy is not configured to explicitly require letters or special characters, users will be restricted to creating a numeric PIN.   ## Prerequisites + You’ll need this software to set Microsoft Passport policies in your enterprise. @@ -339,16 +346,26 @@ You’ll need this software to set Microsoft Passport policies in your enterpris Configuration Manager and MDM provide the ability to manage Passport policy and to deploy and manage certificates protected by Passport. Azure AD provides the ability to register devices with your enterprise and to provision Passport for organization accounts. Active Directory provides the ability to authorize users and devices using keys protected by Passport if domain controllers are running Windows 10 and the Microsoft Passport provisioning service in Windows 10 AD FS. + ## Passport for BYOD + Passport can be managed on personal devices that your employees use for work purposes using MDM. On personal devices, users can create a personal Passport PIN for unlocking the device and a separate work PIN for access to work resources. The work PIN is managed using the same Passport policies that you can use to manage Passport on organization owned devices. The personal PIN is managed separately using DeviceLock policy. DeviceLock policy can be used to control length, complexity, history, and expiration requirements and can be configured using the [Policy configuration service provider](http://go.microsoft.com/fwlink/p/?LinkID=623244). + ## Related topics + [Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) + [Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) + [Manage identity verification using Microsoft Passport](manage-identity-verification-using-microsoft-passport.md) + [Prepare people to use Microsoft Passport](prepare-people-to-use-microsoft-passport.md) + [Microsoft Passport and password changes](microsoft-passport-and-password-changes.md) + + [Microsoft Passport errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) + [Event ID 300 - Passport successfully created](passport-event-300.md) -  -  +  \ No newline at end of file diff --git a/windows/keep-secure/index.md b/windows/keep-secure/index.md index 0093a7cda3..5b1c59fb81 100644 --- a/windows/keep-secure/index.md +++ b/windows/keep-secure/index.md @@ -2,83 +2,36 @@ title: Keep Windows 10 secure (Windows 10) description: Learn about keeping Windows 10 and Windows 10 Mobile secure. ms.assetid: EA559BA8-734F-41DB-A74A-D8DBF36BE920 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- # Keep Windows 10 secure + Learn about keeping Windows 10 and Windows 10 Mobile secure. + ## In this section -
    ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TopicDescription

    [Change history for Keep Windows 10 secure](change-history-for-keep-windows-10-secure.md)

    This topic lists new and updated topics in the Keep Windows 10 secure documentation for [Windows 10 and Windows 10 Mobile](../index.md).

    [Block untrusted fonts in an enterprise](block-untrusted-fonts-in-enterprise.md)

    To help protect your company from attacks which may originate from untrusted or attacker controlled font files, we’ve created the Blocking Untrusted Fonts feature. Using this feature, you can turn on a global setting that stops your employees from loading untrusted fonts processed using the Graphics Device Interface (GDI) onto your network. Untrusted fonts are any font installed outside of the %windir%/Fonts directory. Blocking untrusted fonts helps prevent both remote (web-based or email-based) and local EOP attacks that can happen during the font file-parsing process.

    [Device Guard certification and compliance](device-guard-certification-and-compliance.md)

    Device Guard is a combination of hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications. If the app isn’t trusted it can’t run, period. It also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code after the computer restarts because of how decisions are made about what can run and when.

    [Manage identity verification using Microsoft Passport](manage-identity-verification-using-microsoft-passport.md)

    In Windows 10, Microsoft Passport replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a Windows Hello (biometric) or PIN.

    [Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md)

    Windows Hello is the biometric authentication feature that helps strengthen authentication and helps to guard against potential spoofing through fingerprint matching and facial recognition.

    [Configure S/MIME for Windows 10 and Windows 10 Mobile](configure-s-mime.md)

    In Windows 10, S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients who have a digital identification (ID), also known as a certificate, can read them. Users can digitally sign a message, which provides the recipients with a way to verify the identity of the sender and that the message hasn't been tampered with.

    [Install digital certificates on Windows 10 Mobile](installing-digital-certificates-on-windows-10-mobile.md)

    Digital certificates bind the identity of a user or computer to a pair of keys that can be used to encrypt and sign digital information. Certificates are issued by a certification authority (CA) that vouches for the identity of the certificate holder, and they enable secure client communications with websites and services.

    [Protect derived domain credentials with Credential Guard](credential-guard.md)

    Introduced in Windows 10 Enterprise, Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Unauthorized access to these secrets can lead to credential theft attacks, such as Pass-the-Hash or Pass-The-Ticket. Credential Guard prevents these attacks by protecting NTLM password hashes and Kerberos Ticket Granting Tickets.

    [Protect your enterprise data using enterprise data protection (EDP)](protect-enterprise-data-using-edp.md)

    With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control. For example, when an employee sends the latest engineering pictures from their personal email account, copies and pastes product info into a tweet, or saves an in-progress sales report to their public cloud storage.

    [Use Windows Event Forwarding to help with intrusion detection](use-windows-event-forwarding-to-assist-in-instrusion-detection.md)

    Learn about an approach to collect events from devices in your organization. This article talks about events in both normal operations and when an intrusion is suspected.

    [VPN profile options](vpn-profile-options.md)

    Virtual private networks (VPN) let you give your users secure remote access to your company network. Windows 10 adds useful new VPN profile options to help you manage how users connect.

    [Security technologies](security-technologies.md)

    Learn more about the different security technologies that are available in Windows 10 and Windows 10 Mobile.

    [Enterprise security guides](windows-10-enterprise-security-guides.md)

    Get proven guidance to help you better secure and protect your enterprise by using technologies such as Credential Guard, Device Guard, Microsoft Passport, and Windows Hello. This section offers technology overviews and step-by-step guides.

    + +| Topic | Description | +| - | - | +| [Change history for Keep Windows 10 secure](change-history-for-keep-windows-10-secure.md) | This topic lists new and updated topics in the Keep Windows 10 secure documentation for [Windows 10 and Windows 10 Mobile](../index.md). | +| [Block untrusted fonts in an enterprise](block-untrusted-fonts-in-enterprise.md) | To help protect your company from attacks which may originate from untrusted or attacker controlled font files, we’ve created the Blocking Untrusted Fonts feature. Using this feature, you can turn on a global setting that stops your employees from loading untrusted fonts processed using the Graphics Device Interface (GDI) onto your network. Untrusted fonts are any font installed outside of the %windir%/Fonts directory. Blocking untrusted fonts helps prevent both remote (web-based or email-based) and local EOP attacks that can happen during the font file-parsing process. | +| [Device Guard certification and compliance](device-guard-certification-and-compliance.md) | Device Guard is a combination of hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications. If the app isn’t trusted it can’t run, period. It also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code after the computer restarts because of how decisions are made about what can run and when. | +| [Manage identity verification using Microsoft Passport](manage-identity-verification-using-microsoft-passport.md) | In Windows 10, Microsoft Passport replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a Windows Hello (biometric) or PIN. | +| [Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) | Windows Hello is the biometric authentication feature that helps strengthen authentication and helps to guard against potential spoofing through fingerprint matching and facial recognition. | +| [Configure S/MIME for Windows 10 and Windows 10 Mobile](configure-s-mime.md) | In Windows 10, S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients who have a digital identification (ID), also known as a certificate, can read them. Users can digitally sign a message, which provides the recipients with a way to verify the identity of the sender and that the message hasn't been tampered with. | +| [Install digital certificates on Windows 10 Mobile](installing-digital-certificates-on-windows-10-mobile.md) | Digital certificates bind the identity of a user or computer to a pair of keys that can be used to encrypt and sign digital information. Certificates are issued by a certification authority (CA) that vouches for the identity of the certificate holder, and they enable secure client communications with websites and services. | +| [Protect derived domain credentials with Credential Guard](credential-guard.md) | Introduced in Windows 10 Enterprise, Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Unauthorized access to these secrets can lead to credential theft attacks, such as Pass-the-Hash or Pass-The-Ticket. Credential Guard prevents these attacks by protecting NTLM password hashes and Kerberos Ticket Granting Tickets. | +| [Protect your enterprise data using enterprise data protection (EDP)](protect-enterprise-data-using-edp.md) | With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control. For example, when an employee sends the latest engineering pictures from their personal email account, copies and pastes product info into a tweet, or saves an in-progress sales report to their public cloud storage. | +| [Use Windows Event Forwarding to help with intrusion detection](use-windows-event-forwarding-to-assist-in-instrusion-detection.md) | Learn about an approach to collect events from devices in your organization. This article talks about events in both normal operations and when an intrusion is suspected. | +| [VPN profile options](vpn-profile-options.md) | Virtual private networks (VPN) let you give your users secure remote access to your company network. Windows 10 adds useful new VPN profile options to help you manage how users connect. | +| [Security technologies](security-technologies.md) | Learn more about the different security technologies that are available in Windows 10 and Windows 10 Mobile. | +| [Enterprise security guides](windows-10-enterprise-security-guides.md) | Get proven guidance to help you better secure and protect your enterprise by using technologies such as Credential Guard, Device Guard, Microsoft Passport, and Windows Hello. This section offers technology overviews and step-by-step guides. |   ## Related topics + [Windows 10 and Windows 10 Mobile](../index.md)     diff --git a/windows/keep-secure/installing-digital-certificates-on-windows-10-mobile.md b/windows/keep-secure/installing-digital-certificates-on-windows-10-mobile.md index b87cd6ac93..99bab3e2fa 100644 --- a/windows/keep-secure/installing-digital-certificates-on-windows-10-mobile.md +++ b/windows/keep-secure/installing-digital-certificates-on-windows-10-mobile.md @@ -2,31 +2,41 @@ title: Install digital certificates on Windows 10 Mobile (Windows 10) description: Digital certificates bind the identity of a user or computer to a pair of keys that can be used to encrypt and sign digital information. ms.assetid: FF7B1BE9-41F4-44B0-A442-249B650CEE25 -ms.pagetype: security -keywords: ["S/MIME", "PFX", "SCEP"] +keywords: S/MIME, PFX, SCEP ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: jdeckerMS --- + # Install digital certificates on Windows 10 Mobile + **Applies to** - Windows 10 Mobile + Digital certificates bind the identity of a user or computer to a pair of keys that can be used to encrypt and sign digital information. Certificates are issued by a certification authority (CA) that vouches for the identity of the certificate holder, and they enable secure client communications with websites and services. + Certificates in Windows 10 Mobile are primarily used for the following purposes: - To create a secure channel using Secure Sockets Layer (SSL) between a phone and a web server or service. - To authenticate a user to a reverse proxy server that is used to enable Microsoft Exchange ActiveSync (EAS) for email. - For installation and licensing of applications (from the Windows Phone Store or a custom company distribution site). + ## Install certificates using Internet Explorer + A certificate can be posted on a website and made available to users through a device-accessible URL that they can use to download the certificate. When a user accesses the page and taps the certificate, it opens on the device. The user can inspect the certificate, and if they choose to continue, the certificate is installed on the Windows 10 Mobile device. + ## Install certificates using email + The Windows 10 Mobile certificate installer supports .cer, .p7b, .pem, and .pfx files. To install certificates via email, make sure your mail filters do not block .cer files. Certificates that are sent via email appear as message attachments. When a certificate is received, a user can tap to review the contents and then tap to install the certificate. Typically, when an identity certificate is installed, the user is prompted for the password (or passphrase) that protects it. + ## Install certificates using mobile device management (MDM) + Windows 10 Mobile supports root, CA, and client certificate to be configured via MDM. Using MDM, an administrator can directly add, delete, or query root and CA certificates, and configure the device to enroll a client certificate with a certificate enrollment server that supports Simple Certificate Enrollment Protocol (SCEP). SCEP enrolled client certificates are used by Wi-Fi, VPN, email, and browser for certificate-based client authentication. An MDM server can also query and delete SCEP enrolled client certificate (including user installed certificates), or trigger a new enrollment request before the current certificate is expired. -**Warning**   -Do not use SCEP for encryption certificates for S/MIME. You must use a PFX certificate profile to support S/MIME on Windows 10 Mobile. For instructions on creating a PFX certificate profile in Microsoft Intune, see [Enable access to company resources using certificate profiles with Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkID=718216). +> **Warning:**  Do not use SCEP for encryption certificates for S/MIME. You must use a PFX certificate profile to support S/MIME on Windows 10 Mobile. For instructions on creating a PFX certificate profile in Microsoft Intune, see [Enable access to company resources using certificate profiles with Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkID=718216).   **Process of installing certificates using MDM** + 1. The MDM server generates the initial cert enroll request including challenge password, SCEP server URL, and other enrollment related parameters. 2. The policy is converted to the OMA DM request and sent to the device. 3. The trusted CA certificate is installed directly during MDM request. @@ -34,17 +44,17 @@ Do not use SCEP for encryption certificates for S/MIME. You must use a PFX certi 5. The device generates private/public key pair. 6. The device connects to Internet facing point exposed by MDM server. 7. MDM server creates a certificate that is signed with proper CA certificate and returns it to device. - **Note**   - The device supports the pending function to allow server side to do additional verification before issuing the cert. In this case, a pending status is sent back to the device. The device will periodically contact the server, based on preconfigured retry count and retry period parameters. Retrying ends when either: + + > **Note:**  The device supports the pending function to allow server side to do additional verification before issuing the cert. In this case, a pending status is sent back to the device. The device will periodically contact the server, based on preconfigured retry count and retry period parameters. Retrying ends when either: A certificate is successfully received from the server The server returns an error The number of retries reaches the preconfigured limit   8. The cert is installed in the device. Browser, Wi-Fi, VPN, email, and other first party applications have access to this certificate. - **Note**   - If MDM requested private key being stored in Trusted Process Module (TPM) (configured during enrollment request), the private key will be saved in TPM. Note that SCEP enrolled cert protected by TPM isn’t guarded by a PIN. However, if the certificate is imported to the Passport for Work Key Storage Provider (KSP), it is guarded by the Passport PIN. + + > **Note:**  If MDM requested private key being stored in Trusted Process Module (TPM) (configured during enrollment request), the private key will be saved in TPM. Note that SCEP enrolled cert protected by TPM isn’t guarded by a PIN. However, if the certificate is imported to the Passport for Work Key Storage Provider (KSP), it is guarded by the Passport PIN.   ## Related topics + [Configure S/MIME](configure-s-mime.md) -  -  +  \ No newline at end of file diff --git a/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md b/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md index aac4a2f380..7f4b06da3d 100644 --- a/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md +++ b/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md @@ -2,41 +2,54 @@ title: Manage identity verification using Microsoft Passport (Windows 10) description: In Windows 10, Microsoft Passport replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a Windows Hello (biometric) or PIN. ms.assetid: 5BF09642-8CF5-4FBC-AC9A-5CA51E19387E -ms.pagetype: security -keywords: ["identity", "PIN", "biometric", "Hello"] +keywords: identity, PIN, biometric, Hello ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: jdeckerMS --- # Manage identity verification using Microsoft Passport + **Applies to** - Windows 10 - Windows 10 Mobile + In Windows 10, Microsoft Passport replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a Windows Hello (biometric) or PIN. + Passport addresses the following problems with passwords: - Passwords can be difficult to remember, and users often reuse passwords on multiple sites. - Server breaches can expose symmetric network credentials. - Passwords can be subject to [replay attacks](http://go.microsoft.com/fwlink/p/?LinkId=615673). - Users can inadvertently expose their passwords due to [phishing attacks](http://go.microsoft.com/fwlink/p/?LinkId=615674). + Passport lets users authenticate to: - a Microsoft account. - an Active Directory account. - a Microsoft Azure Active Directory (AD) account. - Identity Provider Services or Relying Party Services that support [Fast ID Online (FIDO) v2.0](http://go.microsoft.com/fwlink/p/?LinkId=533889) authentication + After an initial two-step verification of the user during Passport enrollment, Passport is set up on the user's device and the user is asked to set a gesture, which can be Windows Hello or a PIN. The user provides the gesture to verify their identity. Windows then uses Passport to authenticate users and help them to access protected resources and services. + As an administrator in an enterprise or educational organization, you can create policies to manage Passport use on Windows 10-based devices that connect to your organization. + ## Benefits of Microsoft Passport + Reports of identity theft and large-scale hacking are frequent headlines. Nobody wants to be notified that their user name and password have been exposed. You may wonder [how a PIN can help protect a device better than a password](why-a-pin-is-better-than-a-password.md). Passwords are shared secrets; they are entered on a device and transmitted over the network to the server. An intercepted account name and password can be used by anyone. Because they're stored on the server, a server breach can reveal those stored credentials. + In Windows 10, Passport replaces passwords. The Passport provisioning process creates two cryptographic keys bound to the Trusted Platform Module (TPM), if a device has a TPM, or in software. Access to these keys and obtaining a signature to validate user possession of the private key is enabled only by the PIN or biometric gesture. The two-step verification that takes place during Passport enrollment creates a trusted relationship between the identity provider and the user when the public portion of the public/private key pair is sent to an identity provider and associated with a user account. When a user enters the gesture on the device, the identify provider knows from the combination of Passport keys and gesture that this is a verified identity and provides an authentication token that allows Windows 10 to access resources and services. In addition, during the registration process, the attestation claim is produced for every identity provider to cryptographically prove that the Passport keys are tied to TPM. During registration, when the attestation claim is not presented to the identity provider, the identity provider must assume that the Passport key is created in software. + ![how authentication works in microsoft passport](images/authflow.png) + Imagine that someone is looking over your shoulder as you get money from an ATM and sees the PIN that you enter. Having that PIN won't help them access your account because they don't have your ATM card. In the same way, learning your PIN for your device doesn't allow that attacker to access your account because the PIN is local to your specific device and doesn't enable any type of authentication from any other device. Passport helps protect user identities and user credentials. Because no passwords are used, it helps circumvent phishing and brute force attacks. It also helps prevent server breaches because Passport credentials are an asymmetric key pair, which helps prevent replay attacks when these keys are generated within isolated environments of TPMs. + Microsoft Passport also enables Windows 10 Mobile devices to be used as [a remote credential](prepare-people-to-use-microsoft-passport.md#bmk-remote) when signing into Windows 10 PCs. During the sign-in process, the Windows 10 PC can connect using Bluetooth to access Microsoft Passport on the user’s Windows 10 Mobile device. Because users carry their phone with them, Microsoft Passport makes implementing two-factor authentication across the enterprise less costly and complex than other solutions. -**Note**  Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants. +> **Note:**  Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants.   ## How Microsoft Passport works: key points + - Passport credentials are based on certificate or asymmetrical key pair. Passport credentials are bound to the device, and the token that is obtained using the credential is also bound to the device. - Identify provider (such as Active Directory, Azure AD, or a Microsoft account) validates user identity and maps Microsoft Passport's public key to a user account during the registration step. - Keys can be generated in hardware (TPM 1.2 or 2.0 for enterprises, and TPM 2.0 for consumers) or software, based on the policy. @@ -46,26 +59,45 @@ Microsoft Passport also enables Windows 10 Mobile devices to be used as [a remo - Personal (Microsoft account) and corporate (Active Directory or Azure AD) accounts use separate containers for keys. Non-Microsoft identity providers can generate keys for their users in the same container as the Microsoft account; however, all keys are separated by identity providers' domains to help ensure user privacy. - Certificates are added to the Passport container and are protected by the Passport gesture. - Windows Update behavior: After a reboot is required by Windows Update, the last interactive user is automatically signed on without any user gesture and the session is locked so the user's lock screen apps can run. + ## Comparing key-based and certificate-based authentication + Passport can use either keys (hardware or software) or certificates with keys in hardware or software to confirm identity. Enterprises that have a public key infrastructure (PKI) for issuing and managing certificates can continue to use PKI in combination with Passport. Enterprises that do not use PKI or want to reduce the effort associated with managing certificates can rely on key-based credentials for Passport. + Hardware-based keys, which are generated by TPM, provide the highest level of assurance. When the TPM is manufactured, an Endorsement Key (EK) certificate is resident in the TPM. This EK certificate creates a root trust for all other keys that are generated on this TPM. EK certification is used to generate an attestation identity key (AIK) certificate issued by a Microsoft certificate authority. This AIK certificate can be used as an attestation claim to prove to identity providers that the Passport keys are generated on the same TPM. The Microsoft certificate authority (CA) generates the AIK certificate per device, per user, and per IDP to help ensure that user privacy is protected. + When identity providers such as Active Directory or Azure AD enroll a certificate in Passport, Windows 10 will support the same set of scenarios as a smart card. When the credential type is a key, only key-based trust and operations will be supported. + ## Learn more + [Introduction to Windows Hello](http://go.microsoft.com/fwlink/p/?LinkId=786649), video presentation on Microsoft Virtual Academy + [What's new in Active Directory Domain Services (AD DS) in Windows Server Technical Preview](http://go.microsoft.com/fwlink/p/?LinkId=708533) + [Windows Hello face authentication](http://go.microsoft.com/fwlink/p/?LinkId=626024) + [Biometrics hardware guidelines](http://go.microsoft.com/fwlink/p/?LinkId=626995) + [Windows 10: Disrupting the Revolution of Cyber-Threats with Revolutionary Security!](http://go.microsoft.com/fwlink/p/?LinkId=533890) + [Windows 10: The End Game for Passwords and Credential Theft?](http://go.microsoft.com/fwlink/p/?LinkId=533891) + [Authenticating identities without passwords through Microsoft Passport](http://go.microsoft.com/fwlink/p/?LinkId=616778) + [Microsoft Passport guide](http://go.microsoft.com/fwlink/p/?LinkId=691928) + ## Related topics + [Implement Microsoft Passport in your organization](implement-microsoft-passport-in-your-organization.md) + [Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) + [Prepare people to use Microsoft Passport](prepare-people-to-use-microsoft-passport.md) + [Microsoft Passport and password changes](microsoft-passport-and-password-changes.md) + [Microsoft Passport errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) + [Event ID 300 - Passport successfully created](passport-event-300.md) -  -  +  \ No newline at end of file diff --git a/windows/keep-secure/microsoft-passport-and-password-changes.md b/windows/keep-secure/microsoft-passport-and-password-changes.md index e4f15fc502..4325261928 100644 --- a/windows/keep-secure/microsoft-passport-and-password-changes.md +++ b/windows/keep-secure/microsoft-passport-and-password-changes.md @@ -2,37 +2,49 @@ title: Microsoft Passport and password changes (Windows 10) description: When you set up Microsoft Passport, the PIN or biometric (Windows Hello) gesture that you use is specific to that device. ms.assetid: 83005FE4-8899-47A6-BEA9-C17CCA0B6B55 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: jdeckerMS --- # Microsoft Passport and password changes + **Applies to** - Windows 10 - Windows 10 Mobile + When you set up Microsoft Passport, the PIN or biometric (Windows Hello) gesture that you use is specific to that device. You can set up Passport for the same account on multiple devices. If the PIN or biometric is configured as part of a Microsoft Passport for Work, changing the account password will not impact sign-in or unlock with these gestures since it uses a key or certificate. However, if Microsoft Passport for Work is not deployed and the password for that account changes, you must provide the new password on each device to continue to use Passport. + ## Example + Let's suppose that you have set up a PIN for your Microsoft account on **Device A**. You use your PIN to sign in on **Device A** and then change the password for your Microsoft account. Because you were using **Device A** when you changed your password, the PIN on **Device A** will continue to work with no other action on your part. + Suppose instead that you sign in on **Device B** and change your password for your Microsoft account. The next time that you try to sign in on **Device A** using your PIN, sign-in will fail because the account credentials that Passport on **Device A** knows will be outdated. -**Note**   -This example also applies to an Active Directory account when [Passport for Work is not implemented](implement-microsoft-passport-in-your-organization.md). +> **Note:**  This example also applies to an Active Directory account when [Passport for Work is not implemented](implement-microsoft-passport-in-your-organization.md).   ## How to update Passport after you change your password on another device + 1. When you try to sign in using your PIN or biometric, you will see the following message: **Your password was changed on a different device. You must sign in to this device once with your new password, and then you can sign in with your PIN.** 2. Click **OK.** 3. Click **Sign-in options**. 4. Click the **Password** button. 5. Sign in with new password. 6. The next time that you sign in, you can select **Sign-in options** and then select **PIN** to resume using your PIN. + ## Related topics + [Manage identity verification using Microsoft Passport](manage-identity-verification-using-microsoft-passport.md) + [Implement Microsoft Passport in your organization](implement-microsoft-passport-in-your-organization.md) + [Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) + [Prepare people to use Microsoft Passport](prepare-people-to-use-microsoft-passport.md) + [Microsoft Passport errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) + + [Event ID 300 - Passport successfully created](passport-event-300.md) -  -  +  \ No newline at end of file diff --git a/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md b/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md index 839e14a630..a9483a0b56 100644 --- a/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md +++ b/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md @@ -2,22 +2,30 @@ title: Microsoft Passport errors during PIN creation (Windows 10) description: When you set up Microsoft Passport in Windows 10, you may get an error during the Create a work PIN step. ms.assetid: DFEFE22C-4FEF-4FD9-BFC4-9B419C339502 -ms.pagetype: security -keywords: ["PIN", "error", "create a work PIN"] +keywords: PIN, error, create a work PIN ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: jdeckerMS --- + # Microsoft Passport errors during PIN creation + **Applies to** - Windows 10 - Windows 10 Mobile + When you set up Microsoft Passport in Windows 10, you may get an error during the **Create a work PIN** step. This topic lists some of the error codes with recommendations for mitigating the problem. If you get an error code that is not listed here, contact Microsoft Support. + ## Where is the error code? + The following image shows an example of an error during **Create a work PIN**. + ![](images/pinerror.png) + ## Error mitigations + When a user encounters an error when creating the work PIN, advise the user to try the following steps. Many errors can be mitigated by one of these steps. 1. Try to create the PIN again. Some errors are transient and resolve themselves. 2. Sign out, sign in, and try to create the PIN again. @@ -25,6 +33,7 @@ When a user encounters an error when creating the work PIN, advise the user to t 4. Unjoin the device from Azure Active Directory (Azure AD), rejoin, and then try to create the PIN again. To unjoin a desktop PC, go to **Settings** > **System** > **About** and select **Disconnect from organization**. To unjoin a device running Windows 10 Mobile, you must [reset the device](http://go.microsoft.com/fwlink/p/?LinkId=715697). 5. On mobile devices, if you are unable to setup a PIN after multiple attempts, reset your device and start over. For help on how to reset your phone go to [Reset my phone](http://go.microsoft.com/fwlink/p/?LinkId=715697). If the error occurs again, check the error code against the following table to see if there is another mitigation for that error. When no mitigation is listed in the table, contact Microsoft Support for assistance. + @@ -186,6 +195,7 @@ If the error occurs again, check the error code against the following table to s   ## Errors with unknown mitigation For errors listed in this table, contact Microsoft Support for assistance. + | Hex | Cause | |-------------|-------------------------------------------------------------------------------------------------------| | 0x80072f0c | Unknown | @@ -208,12 +218,17 @@ For errors listed in this table, contact Microsoft Support for assistance. | 0x801C03F1 | ​There is no UPN in the token | | ​0x801C044C | There is no core window for the current thread |   + ## Related topics + [Manage identity verification using Microsoft Passport](manage-identity-verification-using-microsoft-passport.md) + [Implement Microsoft Passport in your organization](implement-microsoft-passport-in-your-organization.md) + [Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) + [Prepare people to use Microsoft Passport](prepare-people-to-use-microsoft-passport.md) + [Microsoft Passport and password changes](microsoft-passport-and-password-changes.md) + [Event ID 300 - Passport successfully created](passport-event-300.md) -  -  diff --git a/windows/keep-secure/microsoft-passport-guide.md b/windows/keep-secure/microsoft-passport-guide.md index 509ae5dcad..70f6296988 100644 --- a/windows/keep-secure/microsoft-passport-guide.md +++ b/windows/keep-secure/microsoft-passport-guide.md @@ -2,84 +2,131 @@ title: Microsoft Passport guide (Windows 10) description: This guide describes the new Windows Hello and Microsoft Passport technologies that are part of the Windows 10 operating system. ms.assetid: 11EA7826-DA6B-4E5C-99FB-142CC6BD9E84 -ms.pagetype: security -keywords: ["security", "credential", "password", "authentication"] +keywords: security, credential, password, authentication ms.prod: W10 ms.pagetype: security ms.mktglfcycl: plan ms.sitesec: library +ms.pagetype: security author: challum --- + # Microsoft Passport guide + **Applies to** - Windows 10 + This guide describes the new Windows Hello and Microsoft Passport technologies that are part of the Windows 10 operating system. It highlights specific capabilities of these technologies that help mitigate threats from conventional credentials and provides guidance about how to design and deploy these technologies as part of your Windows 10 rollout. + A fundamental assumption about information security is that a system can identify who’s using it. In identifying a user, the system can decide whether the user has identified himself or herself appropriately (a process known as authentication), and then determine what that properly authenticated user should be able to do (a process known as authorization). The overwhelming majority of computer systems deployed throughout the world depend on user credentials as a means of making authentication and authorization decisions, and that means that these systems depend on reusable, user-created passwords for their security. The oft-cited maxim that authentication can involve “something you know, something you have, or something you are” neatly highlights the issue: a reusable password is an authentication factor all by itself, so anyone who knows the password can impersonate the user who owns it. + ## Problems with traditional credentials + Ever since the mid-1960s, when Fernando Corbató and his team at the Massachusetts Institute of Technology championed the introduction of the password, users and administrators have had to deal with the use of passwords for user authentication and authorization. Over time, the state of the art for password storage and use has advanced somewhat (with password hashing and salt being the two most noticeable improvements), but we’re still faced with two serious problems: passwords are easy to clone and easy to steal. Implementation faults may render them insecure, and users have a hard time balancing convenience and security. + **Credential theft** + The biggest risk of passwords is simple: an attacker can steal them easily. Every place a password is entered, processed, or stored is vulnerable. For example, an attacker can steal a collection of passwords or hashes from an authentication server by eavesdropping on network traffic to an application server, by implanting malware in an application or on a device, by logging user keystrokes on a device, or by watching to see which characters a user types — and those are just the most common attack methods. One can enact more exotic attacks to steal one or many passwords. + The risk of theft is driven by the fact that the authentication factor the password represents is the password. Without additional authentication factors, the system assumes that anyone who knows the password is the authorized user. Another, related risk is that of credential replay, in which an attacker captures a valid credential by eavesdropping on an insecure network, and then replays it later to impersonate a valid user. Most authentication protocols (including Kerberos and OAuth) protect against replay attacks by including a time stamp in the credential exchange process, but that protects the token that the authentication system issues, not the password that the user provides to get the ticket in the first place. + **Credential reuse** + The common approach of using an email address as the user name makes a bad problem worse. An attacker who successfully recovers a user name–password pair from a compromised system can then try that same pair on other systems. Surprisingly often, this tactic works to allow attackers to springboard from a compromised system into other systems. The use of email addresses as user names leads to other problems, too, which we’ll explore later in this guide. + ### + **Trading convenience for complexity** Most security is a tradeoff between convenience and security: the more secure a system is, the less convenient it will typically be for users. Although system designers and implementers have a broad range of tools to make their systems more secure, users get a vote, too. When users perceive that a security mechanism gets in the way of what they want to do, they often look for ways to circumvent it. This behavior leads to an arms race of sorts, with users adopting strategies to minimize the effort required to comply with their organization’s password policies as those policies evolve. + **Password complexity** + If the major risk to passwords is that an attacker might guess them through brute-force analysis, it might seem reasonable to require users to include a broader character set in their passwords or make them longer, but as a practical matter, password length and complexity requirements have two negative side effects. First, they encourage password reuse. Estimates by [Herley, Florêncio, and van Oorschot](http://go.microsoft.com/fwlink/p/?LinkId=627392) calculate that the stronger a password is, the more likely it is to be reused. Because users put more effort into the creation and memorization of strong passwords, they are much more likely to use the same credential across multiple systems. Second, adding length or character set complexity to passwords does not necessarily make them more difficult to guess. For example, P@ssw0rd1 is nine characters long and includes uppercase and lowercase letters, numbers, and special characters, but it’s easily guessed by many of the common password-cracking tools now available on the Internet. These tools can attack passwords by using a pre-computed dictionary of common passwords, or they can start with a base word such as password, and then apply common character substitutions. A completely random eight-character password might therefore actually take longer to guess than P@ssw0rd123. + **Password expiration** + Because a reusable password is the only authentication factor in password-based systems, designers have attempted to reduce the risk of credential theft and reuse. One common method for doing so is the use of limited-lifetime passwords. Some systems allow for passwords that can be used only once, but by far the more common approach is to make passwords expire after a certain period. Limiting the useful lifetime of a password puts a cap on how long a stolen password will be useful to an attacker. This practice helps protect against cases where a long-lived password is stolen, held, and used for a long time, but it also harkens back to the time when password cracking was impractical for everyone except nation state-level attackers. A smart attacker would attempt to steal passwords rather than crack them because of the time penalty associated with password cracking. The widespread availability of commodity password-cracking tools and the massive computing power available through mechanisms such as GPU-powered crackers or distributed cloud-based cracking tools has reversed this equation so that it is often more effective for an attacker to crack a password than to try to steal it. In addition, the widespread availability of self-service [password-reset mechanisms](#password-reset) means that an attacker needs only a short window of time during which the password is valid to change the password and thus reset the validity period. Relatively few enterprise networks provide self-service password-reset mechanisms, but they are common for Internet services. In addition, many users use the secure credential store on Windows and Mac OS X systems to store valuable passwords for Internet services, so an attacker who can compromise the operating system password may be able to obtain a treasure trove of other service passwords at no cost. Finally, overly short timelines for password expiration can tempt users to make small changes in their passwords at each expiration period — for example, moving from password123 to password456 to password789. This approach reduces the work necessary to crack the password, especially if the attacker knows any of the old passwords. + ### + **Password-reset mechanisms** + To let users better manage their own passwords, some services provide a way for users to change their own password. Some implementations require users to log on with their current password, while others allow users to select the **Forgot my password** option, which sends an email to the user’s registered email address. The problem with these mechanisms is that many of them are implemented such that an attacker can exploit them. For example, an attacker who can successfully guess or steal a user’s email password can merrily request password resets for all of the victim’s other accounts, because the reset emails go to the compromised account. For this reason, most enterprise networks are configured so that only administrators can reset user passwords; for example, Active Directory supports the use of a **Password must be changed on next logon** flag so that after the administrator resets a password, the user can reset the password only after providing the administrator-set password. Some mobile device management (MDM) systems support similar functionality for mobile devices. + **User password carelessness** + An insidious problem makes these design and implementation weaknesses worse: some users just aren’t careful with their passwords. They write them down in insecure locations, choose easy-to-guess passwords, take minimal (if any) precautions against malware, or even give their passwords to other people. These users aren’t necessarily careless because they don’t care; they want to get things done, and overly stringent password length or expiration policies or too many passwords hinders them. + **Mitigate credential risks** + Given the issues described so far, it might seem obvious that reusable passwords are a security hazard. The argument is simple: adding authentication factors reduces the value of the passwords themselves, because even a successful password theft won’t let an attacker log on to a system unless he or she also has the associated additional factors. Unfortunately, this simple argument has many practical complications. Security and operating system vendors have tried to solve the problems that reusable credentials pose for decades — with limited success. The most obvious mitigation to the risks reusable passwords pose is to add one or more authentication factors. At different times over the past 30 years, different vendors have attempted to solve this problem by calling for the use of biometric identifiers (including fingerprints, iris and retina scans, and hand geometry), software-based and hardware-based tokens, physical and virtual smart cards, and voice or Short Message Service (SMS) authentication through the user’s mobile phone. A detailed description of each of these authenticators and its pros and cons is outside the scope of this guide, but no matter which authentication method you choose, core challenges have limited adoption of all Multi-Factor Authentication (MFA) solutions, including: - **Infrastructure complexity and cost.** Any system that requires the user to provide an additional authentication factor at the point of access has to have a way to collect that information. Although it’s possible to retrofit fielded hardware by adding fingerprint readers, eye scanners, smart card readers, and so on, few enterprises have been willing to take on the cost and support burden required to do so. - **Lack of standardization.** Although Microsoft included operating system–level smart card support as part of the Windows Vista operating system, smart card and reader vendors were free to continue to ship their own drivers, as were manufacturers of other authentication devices. Lack of standardization led to both application and support fragmentation, which means that it wasn’t always possible to mix and match solutions within an enterprise, even when the manufacturers of those solutions advertised them as being compatible. - **Backward compatibility.** Retrofitting already-deployed operating systems and applications to use MFA has proven an extremely difficult task. Nearly three years after its release, Microsoft Office 2013 is finally getting support for MFA. The vast majority of both commercial and custom line-of-business (LOB) applications will never be retrofitted to take advantage of any authentication system other than what the underlying operating system provides. - **User inconvenience.** Solutions that require users to obtain, keep track of, and use physical tokens are often unpopular. If users have to have a particular token for remote access or other scenarios that are supposed to make things more convenient, they tend to become quickly dissatisfied with the burden of keeping up with an additional device. This pushback is multiplied for solutions that have to be attached to computers (such as smart card readers) because such solutions introduce problems of portability, driver support, and operating system and application integration. -- **Device compatibility.** Not every hardware form factor supports every authentication method. For example, despite occasional feeble efforts from vendors, no market for mobile phone-compatible smart card readers ever emerged. So when Microsoft first implemented smart cards as an authenticator for remote network access, one key limitation was that employees could log on only from desktop or laptop computers that had smart card readers. Any authentication method that relies on additional hardware or software may run into this problem. For example, several popular “soft token” systems rely on mobile apps that run on a limited number of mobile hardware platforms. +- **Device compatibility.** Not every hardware form factor supports every authentication method. For example, despite occasional feeble efforts from vendors, no market for mobile phone-compatible smart card readers ever emerged. +So when Microsoft first implemented smart cards as an authenticator for remote network access, one key limitation was that employees could log on only from desktop or laptop computers that had smart card readers. Any authentication method that relies on additional hardware or software may run into this problem. For example, several popular “soft token” systems rely on mobile apps that run on a limited number of mobile hardware platforms. Another pesky problem has to do with institutional knowledge and maturity. Strong authentication systems are complex. They have lots of components, and they can be expensive to design, maintain, and operate. For some enterprises, the additional cost and overhead of maintaining an in-house public key infrastructure (PKI) to issue smart cards or the burden of managing add-on devices exceeds the value they perceive in having stronger authentication. This is a special case of the common problem that financial institutions face: if the cost of fraud reduction is higher than the cost of the fraud itself, it’s hard to justify the economics of better fraud-prevention measures. + ## Solve credential problems + Solving the problems that passwords pose is tricky. Tightening password policies alone won’t do it: users may just recycle, share, or write down passwords. Although user education is critical for authentication security, education alone doesn’t eliminate the problem, either. + As you’ve seen, additional authenticators won’t necessarily help if the new authentication systems add complexity, cost, or fragility. In Windows 10, Microsoft addresses these problems with two new technologies: Windows Hello and Microsoft Passport. Working together, these technologies help increase both security and user convenience: - Microsoft Passport replaces passwords with strong two-factor authentication (2FA) by verifying existing credentials and by creating a device-specific credential that a user gesture (either biometric or PIN-based) protects. This combination effectively replaces physical and virtual smart cards as well as reusable passwords for logon and access control. - Windows Hello provides reliable, fully integrated biometric authentication based on facial recognition or fingerprint matching. Windows Hello uses a combination of special infrared (IR) cameras and software to increase accuracy and guard against spoofing. Major hardware vendors are shipping devices that have integrated Windows Hello-compatible cameras, and fingerprint reader hardware can be used or added to devices that don’t currently have it. On devices that support Windows Hello, an easy biometric gesture unlocks users’ Microsoft Passport credentials. + ## What is Windows Hello? + Windows Hello is the name Microsoft has given to the new biometric sign-in system built into Windows 10. Because it is built directly into the operating system, Windows Hello allows face or fingerprint identification to unlock users’ devices. Authentication happens when the user supplies his or her unique biometric identifier to access the device-specific Microsoft Passport credentials, which means that an attacker who steals the device can’t log on to it unless that attacker has the PIN. The Windows secure credential store protects biometric data on the device. By using Windows Hello to unlock a device, the authorized user gains access to all of his or her Windows experience, apps, data, websites, and services. + The Windows Hello authenticator is known as a Hello. A Hello is unique to the combination of an individual device and a specific user; it doesn’t roam among devices, isn’t shared with a server, and cannot easily be extracted from a device. If multiple users share a device, each user gets a unique Hello for that device. You can think of a Hello as a token you can use to unlock (or release) a stored credential: the Hello itself doesn’t authenticate you to an app or service, but it releases credentials that can. + At the launch of Windows 10, the operating system supported three Hello types: - **PIN.** Before you can use Windows Hello to enable biometrics on a device, you must choose a PIN as your initial Hello gesture. After you’ve set a PIN, you can add biometric gestures if you want to. You can always use the PIN gesture to release your credentials, so you can still unlock and use your device even if you can’t use your preferred biometric because of an injury or because the sensor is unavailable or not working properly. - **Facial recognition.** This type uses special cameras that see in IR light, which allows them to reliably tell the difference between a photograph or scan and a living person. Several vendors are shipping external cameras that incorporate this technology, and major laptop manufacturers are incorporating it into their devices, as well. - **Fingerprint recognition.** This type uses a capacitive fingerprint sensor to scan your fingerprint. Fingerprint readers have been available for Windows computers for years, but the current generation of sensors is significantly more reliable and less error-prone. Most existing fingerprint readers (whether external or integrated into laptops or USB keyboards) work with Windows 10. Biometric data used to implement these Hello gestures is stored securely on the local device only. It doesn’t roam and is never sent to external devices or servers. Because Windows Hello only stores biometric identification data on the device, there’s no single collection point an attacker can compromise to steal biometric data. Breaches that expose biometrics collected and stored for other uses (such as fingerprints collected and stored for law enforcement or background check purposes) don’t pose a significant threat: an attacker who steals biometrics literally has only a template of the identifier, and that template cannot easily be converted to a form that the attacker can present to a biometric sensor. The data path for Windows Hello-compatible sensors is resistant to tampering, too, which further reduces the chance that an attacker will be able to successfully inject faked biometric data. In addition, before an attacker can even attempt to inject data into the sensor pipeline, that attacker must gain physical access to the device — and an attacker who can do that can mount several other, less difficult attacks. Windows Hello offers several major benefits. First, when combined with Microsoft Passport, it effectively solves the problems of credential theft and sharing. Because an attacker must obtain both the device and the selected biometric, it is much more difficult to gain access without the user’s knowledge. Second, the use of biometrics means that users benefit from having a simple authenticator that’s always with them: there’s nothing to forget, lose, or leave behind. Instead of worrying about memorizing long, complex passwords, users can take advantage of a convenient, secure method for signing in to all their Windows devices. Finally, in many cases, there’s nothing additional to deploy or manage to use Windows Hello (although Microsoft Passport may require additional deployment, as described later in this guide). Windows Hello support is built directly into the operating system, and users or enterprises can add compatible biometric devices to provide biometric gesture recognition, either as part of a coordinated rollout or as individual users or groups decide to add the necessary sensors. Windows Hello is part of Windows, so no additional deployment is required to start using it. + ## What is Microsoft Passport? + Windows Hello provides a robust way for a device to recognize an individual user; that addresses the first part of the path between a user and a requested service or data item. After the device has recognized the user, however, it still must authenticate the user before deciding whether to grant access to a requested resource. Microsoft Passport provides strong 2FA, fully integrated into Windows, that replaces reusable passwords with the combination of a specific device and a Hello or PIN. Microsoft Passport isn’t just a replacement for traditional 2FA systems, though. It’s conceptually similar to smart cards: authentication is performed by using cryptographic primitives instead of string comparisons, and the user’s key material is secure inside tamper-resistant hardware. Microsoft Passport doesn’t require the extra infrastructure components required for smart card deployment, either. In particular, you don’t need a PKI if you don’t currently have one. Microsoft Passport combines the major advantage of smart cards — deployment flexibility for virtual smart cards and robust security for physical smart cards — without any of their drawbacks. + Microsoft Passport offers four significant advantages over the current state of Windows authentication: it’s more flexible, it’s based on industry standards, it’s an effective risk mitigator, and it’s ready for the enterprise. Let’s look at each of these advantages in more detail. + **It’s flexible** + Microsoft Passport offers unprecedented flexibility. Although the format and use of reusable passwords are fixed, Microsoft Passport gives both administrators and users options to manage authentication. First and foremost, Microsoft Passport works with both biometric identifiers and PINs, so users’ credentials are protected even on devices that don’t support biometrics. Users can even use their phone to release their credentials instead of a PIN or biometric gesture on the main device. Microsoft Passport seamlessly takes advantage of the hardware of the devices in use; as users upgrade to newer devices, Microsoft Passport is ready to use them, and organizations can upgrade existing devices by adding biometric sensors where appropriate. Microsoft Passport offers flexibility in the datacenter, too. To deploy it, in some modes you must add Windows Server 2016 Technical Preview domain controllers to your Active Directory environment, but you don’t have to replace or remove your existing Active Directory servers — the servers required for Microsoft Passport build on and add capability to your existing infrastructure. You don’t have to change the domain or forest functional level, and you can either add on-premises servers or use Microsoft Azure Active Directory to deploy Microsoft Passport on your network. The choice of which users you should enable for Microsoft Passport use is completely up to you: you choose the policies and devices to support and which authentication factors you want users to have access to. This makes it easy to use Microsoft Passport to supplement existing smart card or token deployments by adding strong credential protection to users who don’t currently have it or to deploy Microsoft Passport in scenarios that call for extra protection for sensitive resources or systems (described in the [Design a Microsoft Passport deployment](#design) section). + **It’s standardized** + Both software vendors and enterprise customers have come to realize that proprietary identity and authentication systems are a dead end. The future lies with open, interoperable systems that allow secure authentication across a variety of devices, LOBs, and external applications and websites. To this end, a group of industry players formed the Fast IDentity Online Alliance (FIDO), a nonprofit organization intended to address the lack of interoperability among strong authentication devices as well as the problems users face when they have to create and remember multiple user names and passwords. The FIDO Alliance plans to change the nature of authentication by developing specifications that define an open, scalable, interoperable set of mechanisms that supplant reliance on passwords to securely authenticate users of online services. This new standard for security devices and browser plug ins will allow any website or cloud application to interface with a broad variety of existing and future FIDO-enabled devices that the user has for online security. For more information, see the [FIDO Alliance website](http://go.microsoft.com/fwlink/p/?LinkId=627393). + In 2013, Microsoft joined the FIDO Alliance. FIDO standards enable a universal framework that a global ecosystem delivers for a consistent and greatly improved user experience of strong passwordless authentication. The FIDO 1.0 specifications, published in December 2014, provide for two types of authentications: passwordless (known as the Universal Authentication Framework \[UAF\]) and 2nd Factor (U2F). The FIDO Alliance is working on a set of 2.0 proposals to combine the best parts of the U2F and UAF FIDO 1.0 standards. Microsoft is actively contributing to the proposals, and Windows 10 is a reference implementation of these concepts. In addition to supporting those protocols, the Windows implementation covers other aspects of the end-to-end experience that the specification does not cover, including user interface to, storage of, and protection for users’ device keys and the tokens issued after authentication; supporting administrator policies; and providing deployment tools. Microsoft expects to continue working with the FIDO Alliance as the FIDO 2.0 specification moves forward. Interoperability of FIDO products is a hallmark of FIDO authentication. Microsoft believes that bringing a FIDO solution to market will help solve a critical need for enterprises and consumers alike. + **It’s effective** + Microsoft Passport effectively mitigates two major security risks. First, by eliminating the use of reusable passwords for logon, it reduces the risk that a user’s credential will be copied or reused. On devices that support the Trusted Platform Module (TPM) standard, user key material can be stored in the user device’s TPM, which makes it more difficult for an attacker to capture the key material and reuse it. For devices that lack TPM, Microsoft Passport can encrypt and store credential data in software, but administrators can disable this feature to force a “TPM or nothing” deployment. Second, because Microsoft Passport doesn’t depend on a single, centralized server, the risk of compromise from a breach of that server is removed. Although an attacker could theoretically compromise a single device, there’s no single point of attack that an intruder can leverage to gain widespread access to the environment. + **It’s enterprise-ready** + Every edition of Windows 10 includes Microsoft Passport functionality for individual use; enterprise and personal users can take advantage of Microsoft Passport to protect their individual credentials with compatible applications and services. In addition, enterprises whose users are running Windows 10 Professional and Windows 10 Enterprise have the ability to use Microsoft Passport for Work, an enhanced version of Microsoft Passport that includes the ability to centrally manage Microsoft Passport settings for PIN strength and biometric use through Group Policy Objects (GPOs). + ## How Microsoft Passport works + To use Microsoft Passport to sign in with an identity provider (IDP), a user needs a configured device, which means that the Microsoft Passport life cycle starts when you configure a device for Microsoft Passport use. When the device is set up, its user can use the device to authenticate to services. In this section, we explore how device registration works, what happens when a user requests authentication, how key material is stored and processed, and which servers and infrastructure components are involved in different parts of this process. + **Register a new user or device** + A goal of Microsoft Passport is to allow a user to open a brand-new device, securely join an organizational network to download and manage organizational data, and create a new Hello gesture to secure the device. Microsoft refers to the process of setting up a device for use with Microsoft Passport as registration. -**Note**   -This is separate from the organizational configuration required to use Microsoft Passport with Active Directory or Azure AD; that configuration is discussed later in this guide. This configuration must be completed before users can begin to register. +> **Note:**  This is separate from the organizational configuration required to use Microsoft Passport with Active Directory or Azure AD; that configuration is discussed later in this guide. This configuration must be completed before users can begin to register.   The registration process works like this: 1. The user configures an account on the device. @@ -88,26 +135,44 @@ The registration process works like this: The IDP that “owns” the account receives the credentials and authenticates the user. This IDP authentication may include the use of an existing second authentication factor, or proof. For example, a user who registers a new device by using an Azure AD account will have to provide an SMS-based proof that Azure AD sends. 3. When the user has provided the proof to the IDP, the user enables PIN authentication (Figure 1). The PIN will be associated with this particular credential. + ![figure 1](images/passport-fig1.png) + Figure 1. Set up a PIN in the **Account Settings** control panel item + When the user sets the PIN, it becomes usable immediately (Figure 2). + ![figure 2](images/passport-fig2-pinimmeduse.png) + Figure 2. When set, the PIN is immediately usable + Remember that Microsoft Passport depends on pairing a device and a credential, so the PIN chosen is associated only with the combination of the active account and that specific device. The PIN must comply with whatever length and complexity policy the account administrator has configured; this policy is enforced on the device side. Other registration scenarios that Microsoft Passport supports are: + - A user who upgrades from the Windows 8.1 operating system will log on by using his or her existing enterprise password. That triggers MFA from the IDP side; after receiving and returning a proof, such as a text message or voice code, the IDP authenticates the user to the upgraded Windows 10 device, and the user can set his or her PIN. - A user who typically uses a smart card to log on will be prompted to set up a PIN the first time he or she logs on to a Windows 10 device the user has not previously logged on to. - A user who typically uses a virtual smart card to log on will be prompted to set up a PIN the first time he or she logs on to a Windows 10 device the user has not previously logged on to. + When the user has completed this process, Microsoft Passport generates a new public–private key pair on the device. The TPM generates and stores this private key; if the device doesn’t have a TPM, the private key is encrypted and stored in software. This initial key is referred to as the protector key. It’s associated only with a single gesture; in other words, if a user registers a PIN, a fingerprint, and a face on the same device, each of those gestures will have a unique protector key. The protector key securely wraps the authentication key for a specific container. Each container has only one authentication key, but there can be multiple copies of that key wrapped with different unique protector keys (each of which is associated with a unique gesture). Microsoft Passport also generates an administrative key that the user or administrator can use to reset credentials, when necessary. In addition to the protector key, TPM-enabled devices generate a block of data that contains attestations from the TPM. + At this point, the user has a PIN gesture defined on the device and an associated protector key for that PIN gesture. That means he or she is able to securely log on to the device with the PIN and thus that he or she can establish a trusted session with the device to add support for a biometric gesture as an alternative for the PIN. When you add a biometric gesture, it follows the same basic sequence: the user authenticates to the system by using his or her PIN, and then registers the new biometric (“smile for the camera!”), after which Windows generates a unique key pair and stores it securely. Future logons can then use either the PIN or the registered biometric gestures. + **What’s a container?** + You’ll often hear the term *container* used in reference to MDM solutions. Microsoft Passport uses the term, too, but in a slightly different way. Container in this context is shorthand for a logical grouping of key material or data. Windows 10 supports two containers: the default container holds user key material for personal accounts, including key material associated with the user’s Microsoft account or with other consumer identity providers, and the enterprise container holds credentials associated with a workplace or school account. + The enterprise container exists only on devices that have been registered with an organization; it contains key material for the enterprise IDP, such as on-premises Active Directory or Azure AD. The enterprise container contains only key data for Active Directory or Azure AD. If the enterprise container is present on a device, it’s unlocked separately from the default container, which maintains separation of data and access across personal and enterprise credentials and services. For example, a user who uses a biometric gesture to log on to a managed computer can separately unlock his or her personal container by entering a PIN when logging on to make a purchase from a website. These containers are logically separate. Organizations don’t have any control over the credentials users store in the default container, and applications that authenticate against services in the default container can’t use credentials from the enterprise container. However, individual Windows applications can use the Microsoft Passport application programming interfaces (APIs) to request access to credentials as appropriate, so that both consumer and LOB applications can be enhanced to take advantage of Microsoft Passport. + It’s important to keep in mind that there are no physical containers on disk, in the registry, or elsewhere. Containers are logical units used to group related items. The keys, certificates, and credentials Microsoft Passport stores are protected without the creation of actual containers or folders. + Each container actually contains a set of keys, some of which are used to protect other keys. Figure 3 shows an example: the protector key is used to encrypt the authentication key, and the authentication key is used to encrypt the individual keys stored in the container. + ![figure 3](images/passport-fig3-logicalcontainer.png) + Figure 3. Each logical container holds one or more sets of keys + Containers can contain several types of key material: + - An *authentication key*, which is always an asymmetric public–private key pair. This key pair is generated during registration. It must be unlocked each time it’s accessed, by using either the user’s PIN or a previously generated biometric gesture. The authentication key exists until the user resets the PIN, at which time a new key will be generated. When the new key is generated, all the key material that the old key previously protected must be decrypted and re-encrypted using the new key. - *Virtual smart card keys* are generated when a virtual smart card is generated and stored securely in the container. They’re available whenever the user’s container is unlocked. - *Secure/Multipurpose Internet Mail Extensions (S/MIME) keys and certificates*, which a certification authority (CA) generates. The keys associated with the user’s S/MIME certificate can be stored in a Microsoft Passport container so they’re available to the user whenever the container is unlocked. @@ -115,14 +180,22 @@ Containers can contain several types of key material: Microsoft accounts, Active Directory accounts, and Azure AD accounts all require the use of asymmetric key pairs. The device generates public and private keys, registers the public key with the IDP (which stores it for later verification), and securely stores the private key. For enterprises, the IDP keys can be generated in two ways: - The IDP key pair can be associated with an enterprise CA through the Windows Network Device Enrollment Service (NDES), described more fully in [Network Device Enrollment Service Guidance](http://go.microsoft.com/fwlink/p/?LinkId=733947). In this case, Microsoft Passport requests a new certificate with the same key as the certificate from the existing PKI. This option lets organizations that have an existing PKI continue to use it where appropriate. Given that many applications, such as popular virtual private network systems, require the use of certificates, when you deploy Microsoft Passport in this mode, it allows a faster transition away from user passwords while still preserving certificate-based functionality. This option also allows the enterprise to store additional certificates in the protected container. - The IDP can generate the IDP key pair directly, which allows quick, lower-overhead deployment of Microsoft Passport in environments that don’t have or need a PKI. + **How keys are protected** + Any time key material is generated, it must be protected against attack. The most robust way to do this is through specialized hardware. There’s a long history of using hardware security modules (HSMs) to generate, store, and process keys for security-critical applications. Smart cards are a special type of HSM, as are devices that are compliant with the Trusted Computing Group TPM standard. Wherever possible, the Microsoft Passport for Work implementation takes advantage of onboard TPM hardware to generate, store, and process keys. However, Microsoft Passport and Microsoft Passport for Work do not require an onboard TPM. Administrators can choose to allow key operations in software, in which case any user who has (or can escalate to) administrative rights on the machine can use the IDP keys to sign requests. As an alternative, in some scenarios, devices that don’t have a TPM can be remotely authenticated by using a device that does have a TPM, in which case all the sensitive operations are performed with the TPM and no key material is exposed. + Whenever possible, Microsoft recommends the use of TPM hardware. The TPM protects against a variety of known and potential attacks, including PIN brute-force attacks. The TPM provides an additional layer of protection after an account lockout, too. When the TPM has locked the key material, the user will have to reset the PIN (which means he or she will have to use MFA to reauthenticate to the IDP before the IDP allows him or her to re-register). Resetting the PIN means that all keys and certificates encrypted with the old key material will be removed. + **Authentication** + When a user wants to access protected key material — perhaps to use an Internet site that requires a logon or to access protected resources on a corporate intranet — the authentication process begins with the user entering a PIN or biometric gesture to unlock the device, a process sometimes called *releasing the key*. Think of it like using a physical key to unlock a door: before you can unlock the door, you need to remove the key from your pocket or purse. On a personal device that’s connected to an organizational network, users will use their personal PIN or biometric to release the key; on a device joined to an on-premises or Azure AD domain, they will use the organizational PIN. This process unlocks the protector key for the primary container on the device. When that container is unlocked, applications (and thus the user) can use whatever IDP keys reside inside the container. + These keys are used to sign requests that are sent to the IDP, requesting access to specified resources. It’s important to understand that although the keys are unlocked, applications cannot use them at will. Applications can use specific APIs to request operations that require key material for particular actions (for example, decrypt an email message or log on to a website). Access through these APIs doesn’t require explicit validation through a user gesture, and the key material isn’t exposed to the requesting application. Rather, the application asks for authentication, encryption, or decryption, and the Microsoft Passport layer handles the actual work and returns the results. Where appropriate, an application can request a forced authentication even on an unlocked device. Windows prompts the user to reenter the PIN or perform an authentication gesture, which adds an extra level of protection for sensitive data or actions. For example, you can configure the Windows Store to require reauthentication any time a user purchases an application, even though the same account and PIN or gesture were already used to unlock the device. + The actual authentication process works like this: + 1. The client sends an empty authentication request to the IDP. (This is merely for the handshake process.) 2. The IDP returns a challenge, known as a *nonce*. 3. The device signs the nonce with the appropriate private key. @@ -131,55 +204,85 @@ The actual authentication process works like this: 6. If all the checks in step 5 succeed, the IDP returns two data items: a symmetric key, which is encrypted with the device’s public key, and a security token, which is encrypted with the symmetric key. 7. The device uses its private key to decrypt the symmetric key, and then uses that symmetric key to decrypt the token. 8. The device makes a normal authentication request for the original resource, presenting the token from the IDP as its proof of authentication. + When the IDP validates the signature, it is verifying that the request came from the specified user and device. The private key specific to the device signs the nonce, which allows the IDP to determine the identity of the requesting user and device so that it can apply policies for content access based on user, device type, or both together. For example, an IDP could allow access to one set of resources only from mobile devices and a different set from desktop devices. + Remote unlock, which is planned for a future release of Windows 10, builds on these scenarios by enabling seamless remote authentication from a mobile device as a second factor. For example, suppose that you’re visiting another office at your company and you need to borrow a computer there temporarily, but you don’t want to potentially expose your credentials to capture. Rather than type in your credentials, you can click **other user** on the Windows 10 logon screen, type your user name, pick the tile for remote authentication, and use an app on your phone, which you already unlocked by using its built-in facial-recognition sensors. The phone and computer are paired and handshake via Bluetooth, you type your authentication PIN on the phone, and the computer gets confirmation of your identity from the IDP. All this happens without typing a password anywhere or typing your PIN on the PC. + **The infrastructure** + Microsoft Passport depends on having compatible IDPs available to it. As of this writing, that means you have four deployment possibilities: - Use an existing Windows-based PKI centered around Active Directory Certificate Services. This option requires additional infrastructure, including a way to issue certificates to devices. You can use NDES to register devices directly, Microsoft System Center Configuration Manager Technical Preview or later for on-premises environments, or Microsoft Intune where it’s available to manage mobile device participation in Microsoft Passport. - You can configure Windows Server 2016 Technical Preview domain controllers to act as IDPs for Microsoft Passport. In this mode, the Windows Server 2016 Technical Preview domain controllers act as IDPs alongside any existing Windows Server 2008 R2 or later domain controllers. There is no requirement to replace all existing domain controllers, merely to introduce at least one Windows Server 2016 Technical Preview domain controller per Active Directory site and update the forest Active Directory Domain Services (AD DS) schema to Windows Server 2016 Technical Preview. - The normal discovery mechanism that clients use to find domain controllers and global catalogs relies on Domain Name System (DNS) SRV records, but those records don’t contain version data. Windows 10 computers will query DNS for SRV records to find all available Active Directory servers, and then query each server to identify those that can act as Microsoft Passport IDPs. The number of authentication requests your users generate, where your users are located, and the design of your network all drive the number of Windows Server 2016 Technical Preview domain controllers required. - Azure AD can act as an IDP either by itself or alongside an on-premises AD DS forest. Organizations that use Azure AD can register devices directly without having to join them to a local domain by using the capabilities the Azure AD Device Registration service provides. In addition to the IDP, Microsoft Passport requires an MDM system. This system can be the cloud-based Intune if you use Azure AD, or an on-premises System Center Configuration Manager deployment that meets the system requirements described in the [Deployment requirements](#deployreq) section of this document. + ## Design a Microsoft Passport for Work deployment + Microsoft Passport for Work is designed for integration with your existing and future directory infrastructure and device deployments, but this flexibility means there are many considerations to think about when you design your deployment. Some of these decisions are technical, while others are organizational or even political. In this section, we examine the key points where you have to make decisions about how to implement Microsoft Passport for Work. Remember, individual devices can use the individual version of Microsoft Passport without any infrastructure changes on your part. Microsoft Passport for Work allows you to control and centrally manage user authentication and device registration. To use the initial version of Microsoft Passport for Work, each device must have an Azure AD identity, so automatic registration of devices provides a means both to register new devices and to apply optional policies to manage Microsoft Passport for Work. + **One deployment strategy** + Different organizations will necessarily take different approaches to the deployment of Microsoft Passport depending on their capabilities and needs, but there is only one strategy: deploy Microsoft Passport for Work throughout the organization to get maximum protection for the maximum number of devices and resources. Organizations can take one of three basic routes to accomplish that strategy: + - Deploy Microsoft Passport for Work everywhere according to whatever device or user deployment strategy works best for the organization. - Deploy Microsoft Passport for Work first to high-value or high-risk targets, by using conditional access policies to restrict access to key resources only to users who hold strong authentication credentials. - Blend Microsoft Passport for Work into an existing multi-factor environment, using it as an additional form of strong authentication alongside physical or virtual smart cards. + **Deploy Microsoft Passport for Work everywhere** + In this approach, you deploy Microsoft Passport throughout the organization in a coordinated rollout. In some ways, this method is similar to any other desktop deployment project; the only real difference is that you must already have the Microsoft Passport infrastructure in place to support device registration before you can start using Microsoft Passport on Windows 10 devices. -**Note**   -You can still upgrade to Windows 10 or add new Windows 10 devices without changing your infrastructure. You just can’t use Microsoft Passport for Work on a device until the device joins Azure AD and receives the appropriate policy. + +> **Note:**  You can still upgrade to Windows 10 or add new Windows 10 devices without changing your infrastructure. You just can’t use Microsoft Passport for Work on a device until the device joins Azure AD and receives the appropriate policy.   The major benefit of this approach is that it provides uniform protection for all parts of the organization. Sophisticated attackers have shown a great deal of skill in breaching large organizations by identifying weak points in their security, including users and systems that don’t have high-value information but that can be exploited to get it. Applying consistent protection across every device that an attacker could use to access enterprise data is excellent protection against these types of attacks. + The downside to this approach is its complexity. Smaller organizations may find that managing the rollout of a new operating system across all devices is beyond the scope of their experience and capability. For these organizations, users can self-upgrade, and new users may end up with Windows 10 because they get new devices when they join. Larger organizations, especially those that are highly decentralized or have operations across many physical sites, may have more deployment knowledge and resources but face the challenge of coordinating rollout efforts across a larger user base and footprint. + For more information about desktop deployment of Windows 10, visit the [Windows 10 TechCenter](http://go.microsoft.com/fwlink/p/?LinkId=626581). + One key aspect of this deployment strategy is how to get Windows 10 in users’ hands. Because different organizations have wildly differing strategies to refresh hardware and software, there’s no one-size-fits-all strategy. For example, some organizations pursue a coordinated strategy that puts new desktop operating systems in users’ hands every 2–3 years on existing hardware, supplementing with new hardware only where and when required. Others tend to replace hardware and deploy whatever version of the Windows client operating system ships on the purchased devices. In both cases, there are typically separate deployment cycles for servers and server operating systems, and the desktop and server cycles may or may not be coordinated. + In addition to the issue of Windows 10 deployment to users, you must consider how and when (or if!) you’ll deploy biometric devices to users. Because Windows Hello can take advantage of multiple biometric identifiers, you have a flexible range of device options, which includes the purchase of new devices that incorporate your selected biometric, seeding select users with appropriate devices, rollout of biometric devices as part of a scheduled hardware refresh and using PIN gestures until users get devices, or relying on remote unlock as a second authentication factor. + **Deploy to high-value or high-risk targets** + This strategy takes into account the fact that in most networks, not every asset is equally protected or equally valuable. There are two ways to think about this. One is that you can focus on protecting the users and services that are most at risk of compromise because of their value. Examples include sensitive internal databases or the user accounts of your key executives. The other option is that you can focus on areas of your network that are the most vulnerable, such as users who travel frequently (and thus run a higher risk of lost or stolen devices or drive-by credential theft). Either way, the strategy is the same: selectively and quickly deploy Microsoft Passport to protect specific people and resources. For example, you might issue new Windows 10 devices with biometric sensors to all users who need access to a sensitive internal database, and then deploy the minimum required infrastructure to support Microsoft Passport–secured access to that database for those users. + One of the key design capabilities of Microsoft Passport for Work is that it supports Bring Your Own Device (BYOD) environments by allowing users to register their own devices with the organizational IDP (whether on premises, hybrid, or Azure AD). You may be able to take advantage of this capability to quickly deploy Microsoft Passport to protect your most vulnerable users or assets, ideally by using biometrics as an additional safety measure for the most valuable potential targets. + **Blend Microsoft Passport with your infrastructure** + Organizations that have already invested in smart cards, virtual smart cards, or token-based systems can still benefit from Microsoft Passport. Of those organizations, many use physical tokens and smart cards to protect only critical assets because of the expense and complexity of their deployment. Microsoft Passport offers a valuable complement to these systems because it protects users who currently rely on reusable credentials; protection of all users’ credentials is an important step toward blunting attacks that seek to leverage compromise of any credential into a widespread breach. This approach also gives you a great deal of flexibility in scheduling and deployment. Some enterprises have deployed multi-use smart cards that provide building-access control, access to copiers or other office equipment, stored value for lunchroom purchases, remote network access, and other services. Deployment of Microsoft Passport in such environments doesn’t prevent you from continuing to use smart cards for these services. You can leave the existing smart card infrastructure in place for its existing use cases, and then register desktop and mobile devices in Microsoft Passport and use Microsoft Passport to secure access to network and Internet resources. This approach requires a more complicated infrastructure and a greater degree of organizational maturity because it requires you to link your existing PKI with an enrollment service and Microsoft Passport itself. + Smart cards can act as a useful complement to Microsoft Passport in another important way: to bootstrap the initial logon for Microsoft Passport registration. When a user registers with Microsoft Passport on a device, part of that registration process requires a conventional logon. Rather than using a traditional password, organizations that have previously deployed the necessary infrastructure for smart cards or virtual smart cards can allow their users to register new devices by logging on with a smart card or virtual smart card. After the user has proved his or her identity to the organizational IDP with the smart card, the user can set up a PIN and proceed to use Microsoft Passport for future logons. + **Choose a rollout method** + Which rollout method you choose depends on several factors: + - **How many devices you need to deploy.** This number has a huge influence on your overall deployment. A global rollout for 75,000 users has different requirements than a phased rollout for groups of 200–300 users in different cities. - **How quickly you want to deploy Microsoft Passport for Work protection.** This is a classic cost–benefit tradeoff. You have to balance the security benefits of Microsoft Passport for Work against the cost and time required to deploy it broadly, and different organizations may make entirely different decisions depending on how they rate the costs and benefits involved. Getting the broadest possible Microsoft Passport coverage in the shortest time possible maximizes security benefits. - **The type of devices you want to deploy.** Windows device manufacturers are aggressively introducing new devices optimized for Windows 10, leading to the possibility that you might deploy Microsoft Passport first on newly purchased tablets and portable devices, and then deploy it on the desktop as part of your normal refresh cycle. - **What your current infrastructure looks like.** The individual version of Microsoft Passport doesn’t require changes to your Active Directory environment, but to support Microsoft Passport for Work, you may need a compatible MDM system. Depending on the size and composition of your network, mobile enrollment and management services deployment may be a major project in its own right. - **Your plans for the cloud.** If you’re already planning a move to the cloud, Azure AD eases the process of Microsoft Passport for Work deployment, because you can use Azure AD as an IDP alongside your existing on-premises AD DS setup without making significant changes to your on-premises environment. Future versions of Microsoft Passport for Work will support the ability to simultaneously register devices that are already members of an on-premises AD DS domain in an Azure AD partition so that they use Microsoft Passport for Work from the cloud. Hybrid deployments that combine AD DS with Azure AD give you the ability to keep machine authentication and policy management against your local AD DS domain while providing the full set of Microsoft Passport for Work services (and Microsoft Office 365 integration) for your users. If you plan to use on-premises AD DS only, then the design and configuration of your on-premises environment will dictate what kind of changes you may need to make. + ### + **Deployment requirements** + Table 1 lists six scenarios for deployment of Microsoft Passport for Work in the enterprise. The initial release of Windows 10 supports Azure AD–only scenarios, with support for on-premises Microsoft Passport for Work planned for a future release (see the [Roadmap](#roadmap) section for more details). + Depending on the scenario you choose, Microsoft Passport for Work deployment may require four elements: + - An organizational IDP that supports Microsoft Passport. This can be Azure AD or a set of on-premises Windows Server 2016 Technical Preview domain controllers in an existing AD DS forest. Using Azure AD means that you can establish hybrid identity management, with Azure AD acting as a Microsoft Passport IDP and your on-premises AD DS environment handling older authentication requests. This approach provides all the flexibility of Azure AD with the ability to manage computer accounts and devices running older versions of Windows and on-premises applications such as Microsoft Exchange Server or Microsoft SharePoint. - If you use certificates, an MDM system is required to allow policy management of Microsoft Passport for Work. Domain-joined devices in on-premises or hybrid deployments require Configuration Manager Technical Preview or later. Deployments with Azure AD must use either Intune or a compatible non-Microsoft MDM solution. - On-premises deployments require the forthcoming Active Directory Federation Services (AD FS) version included in Windows Server 2016 Technical Preview to support provisioning of Microsoft Passport credentials to devices. In this scenario, AD FS takes the place of the provisioning that Azure AD performs in cloud-based deployments. - Certificate-based Microsoft Passport deployments require a PKI, including CAs that are accessible to all devices that need to register. If you deploy certificate-based Microsoft Passport on premises, you don’t actually need Windows Server 2016 Technical Preview domain controllers. On-premises deployments do need to apply the Windows Server 2016 Technical Preview AD DS schema and have the Windows Server 2016 Technical Preview version of AD FS installed. Table 1. Deployment requirements for Microsoft Passport +
    @@ -230,42 +333,55 @@ Table 1. Deployment requirements for Microsoft Passport Note that the current release of Windows 10 supports the Azure AD–only (RTM) and hybrid scenarios (RTM + November Update). Microsoft provides the forward-looking guidance in Table 1 to help organizations prepare their environments for planned future releases of Microsoft Passport for Work capabilities. **Select policy settings** + Another key aspect of Microsoft Passport for Work deployment involves the choice of which policy settings to apply to the enterprise. There are two parts to this choice: which policies you deploy to manage Microsoft Passport itself and which policies you deploy to control device management and registration. A complete guide to selecting effective policies is beyond the scope of this guide, but one example reference that may be useful is [Mobile device management capabilities in Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkId=733877). + ## Implement Microsoft Passport + No configuration is necessary to use Windows Hello or Microsoft Passport on individual user devices if those users just want to protect their personal credentials. Unless the enterprise disables the feature, users have the option to use Microsoft Passport for their personal credentials, even on devices that are registered with an organizational IDP. However, when you make Microsoft Passport for Work available for users, you must add the necessary components to your infrastructure, as described earlier in the [Deployment requirements](#deployreq) section. + **How to use Azure AD** + There are three scenarios for using Microsoft Passport for Work in Azure AD–only organizations: - **Organizations that use the version of Azure AD included with Office 365.** For these organizations, no additional work is necessary. When Windows 10 was released to general availability, Microsoft changed the behavior of the Office 365 Azure AD stack. When a user selects the option to join a work or school network (Figure 4), the device is automatically joined to the Office 365 tenant’s directory partition, a certificate is issued for the device, and it becomes eligible for Office 365 MDM if the tenant has subscribed to that feature. In addition, the user will be prompted to log on and, if MFA is enabled, to enter an MFA proof that Azure AD sends to his or her phone. - **Organizations that use the free tier of Azure AD.** For these organizations, Microsoft has not enabled automatic domain join to Azure AD. Organizations that have signed up for the free tier have the option to enable or disable this feature, so automatic domain join won’t be enabled unless and until the organization’s administrators decide to enable it. When that feature is enabled, devices that join the Azure AD domain by using the **Connect to work or school** dialog box shown in Figure 4 will be automatically registered with Microsoft Passport for Work support, but previously joined devices will not be registered. - **Organizations that have subscribed to Azure AD Premium have access to the full set of Azure AD MDM features.** These features include controls to manage Microsoft Passport for Work. You can set policies to disable or force the use of Microsoft Passport for Work, require the use of a TPM, and control the length and strength of PINs set on the device. + ![figure 4](images/passport-fig4-join.png) + Figure 4: Joining an Office 365 organization automatically registers the device in Azure AD + **Enable device registration** + If you want to use Microsoft Passport at Work with certificates, you’ll need a device registration system. That means that you set up Configuration Manager Technical Preview, Intune, or a compatible non-Microsoft MDM system and enable it to enroll devices. This is a prerequisite step to use Microsoft Passport for Work with certificates, no matter the IDP, because the enrollment system is responsible for provisioning the devices with the necessary certificates. **Set Microsoft Passport policies** + As of the initial release of Windows 10, you can control the following settings for the use of Microsoft Passport for Work: - You can require that Microsoft Passport be available only on devices that have TPM security hardware, which means the device uses TPM 1.2 or TPM 2.0. - You can enable Microsoft Passport with a hardware-preferred option, which means that keys will be generated on TPM 1.2 or TPM 2.0 when available and by software when TPM is not available. - You can configure whether certificate-based Microsoft Passport is available to users. You do this as part of the device deployment process, not through a separately applied policy. - You can define the complexity and length of the PIN that users generate at registration. - You can control whether Windows Hello use is enabled in your organization. + These settings can be implemented through GPOs or through configuration service providers (CSPs) in MDM systems, so you have a familiar and flexible set of tools you can use to apply them to exactly the users you want. (For details about the Microsoft Passport for Work CSP, see [PassportForWork CSP)](http://go.microsoft.com/fwlink/p/?LinkId=733876). + ## Roadmap + The speed at which Universal Windows apps and services evolve means that the traditional design-build-test-release cycle for Windows is too slow to meet customers’ needs. As part of the release of Windows 10, Microsoft is changing how it engineers, tests, and distributes Windows. Rather than large, monolithic releases every 3–5 years, the Windows engineering team is committed to smaller, more frequent releases to get new features and services into the marketplace more rapidly without sacrificing security, quality, or usability. This model has worked well in Office 365 and the Xbox ecosystem. + In the Windows 10 initial release, Microsoft supports the following Microsoft Passport and Windows Hello features: + - Biometric authentication, with fingerprint readers that use the Windows fingerprint reader framework - Facial-recognition capability on devices that have compatible IR-capable cameras - Microsoft Passport for personal credentials on individually owned and corporate-managed devices - Microsoft Passport for Work support for organizations that have cloud-only Azure AD deployments -<<<<<<< HEAD - Group Policy settings to control Microsoft Passport PIN length and complexity + In future releases of Windows 10, we plan to add support for additional features: - Additional biometric identifier types, including iris recognition - Key-based Microsoft Passport for Work credentials for on-premises Azure AD deployments and hybrid on-premises/Azure AD deployments - Microsoft Passport for Work certificates issued by a trusted PKI, including smart card and virtual smart card certificates - TPM attestation to protect keys so that a malicious user or program can’t create keys in software (because those keys won’t be TPM attested and can thus be identified as fake) -======= - - Group Policy and MDM settings to control Microsoft Passport PIN length and complexity In the November 2015 release, Microsoft supports the following Microsoft Passport and Windows Hello features: @@ -280,7 +396,6 @@ In future releases of Windows 10, we plan to add support for additional feature - TPM attestation to protect keys so that a malicious user or program can’t create keys in software (because those keys won’t be TPM attested and can thus be identified as fake) ->>>>>>> master In the longer term, Microsoft will continue to improve on and expand the features of both Microsoft Passport and Windows Hello to cover additional customer requirements for manageability and security. We also are working with the FIDO Alliance and a variety of third parties to encourage adoption of Microsoft Passport by both web and LOB application developers.     diff --git a/windows/keep-secure/prepare-people-to-use-microsoft-passport.md b/windows/keep-secure/prepare-people-to-use-microsoft-passport.md index 11496345a8..74cebb3914 100644 --- a/windows/keep-secure/prepare-people-to-use-microsoft-passport.md +++ b/windows/keep-secure/prepare-people-to-use-microsoft-passport.md @@ -2,38 +2,60 @@ title: Prepare people to use Microsoft Passport (Windows 10) description: When you set a policy to require Microsoft Passport in the workplace, you will want to prepare people in your organization. ms.assetid: 5270B416-CE31-4DD9-862D-6C22A2AE508B -ms.pagetype: security -keywords: ["identity", "PIN", "biometric", "Hello"] +keywords: identity, PIN, biometric, Hello ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: jdeckerMS --- + # Prepare people to use Microsoft Passport + **Applies to** - Windows 10 - Windows 10 Mobile + When you set a policy to require Microsoft Passport in the workplace, you will want to prepare people in your organization by explaining how to use Passport. + After enrollment in Passport, users should use their gesture (such as a PIN or fingerprint) for access to corporate resources. Their gesture is only valid on the enrolled device. + Although the organization may require users to change their Active Directory or Azure Active Directory (AD) account password at regular intervals, changes to their passwords have no effect on Passport. + People who are currently using virtual smart cards for authentication can use their virtual smart card to verify their identity when they set up Passport. + ## On devices owned by the organization + When someone sets up a new device, they are prompted to choose who owns the device. For corporate devices, they select **This device belongs to my organization**. + ![who owns this pc](images/corpown.png) + Next, they select a way to connect. Tell the people in your enterprise which option they should pick here. + ![choose how you'll connect](images/connect.png) + They sign in, and are then asked to verify their identity. People have options to choose from, such as a text message, phone call, or authentication app. After verification, they create their PIN. The **Create a work PIN** screen displays any complexity requirements that you have set, such as minimum length. + After Passport is set up, people use their PIN to unlock the device, and that will automatically log them on. + ## On personal devices + People who want to access work resources on their personal devices can add a work or school account in **Settings** > **Accounts** > **Work or school**, and then sign in with work credentials. The person selects the method for receiving the verification code, such as text message or email. The verification code is sent and the person then enters the verification code. After verification, the person enters and confirms new PIN. The person can access any token-based resource using this device without being asked for credentials. (This work account gesture doesn't affect the device unlock PIN.) + Assure people that their work credentials and personal credentials are stored in separate containers; the enterprise has no access to their personal credentials. + People can go to **Settings** > **Accounts** > **Work or school**, select the work account, and then select **Unjoin** to remove the account from their device. + ## Using Windows Hello and biometrics + If your policy allows it, people can add Windows Hello to their Passport. Windows Hello can be fingerprint, iris, and facial recognition, and is available to users only if the hardware supports it. + ![sign in to windows, apps, and services using fingerprint or face](images/hellosettings.png) + ## Use a phone to sign in to a PC + If your enterprise enables phone sign-in, users can pair a phone running Windows 10 Mobile to a PC running Windows 10 and then use an app on the phone to sign in to the PC using their Microsoft Passport credentials. -**Note**  Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants. +> **Note:**  Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants.   **Prerequisites:** - The PC must be joined to the Active Directory domain or Azure AD cloud domain. @@ -42,21 +64,30 @@ If your enterprise enables phone sign-in, users can pair a phone running Windows - The free **Phone Sign-in** app must be installed on the phone. **Pair the PC and phone** 1. On the PC, go to **Settings** > **Devices** > **Bluetooth**. Tap the name of the phone and then tap **Pair** to begin pairing. + ![bluetooth pairing](images/btpair.png) + 2. On the phone, go to **Settings** > **Devices** > **Bluetooth**, and verify that the passcode for **Pairing accessory** on the phone matches the passcode displayed on the PC, and then tap **ok**. + ![bluetooth pairing passcode](images/bt-passcode.png) + 3. On the PC, tap **Yes**. **Sign in to PC using the phone** 1. Open the **Phone Sign-in** app and tap the name of the PC to sign in to. - **Note**  The first time that you run the Phone-Sign app, you must add an account. + > **Note: **  The first time that you run the Phone-Sign app, you must add an account.   2. Enter the work PIN that you set up when you joined the phone to the cloud domain or added a work account. + ## Related topics + [Manage identity verification using Microsoft Passport](manage-identity-verification-using-microsoft-passport.md) + [Implement Microsoft Passport in your organization](implement-microsoft-passport-in-your-organization.md) + [Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) + [Microsoft Passport and password changes](microsoft-passport-and-password-changes.md) + [Microsoft Passport errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) + [Event ID 300 - Passport successfully created](passport-event-300.md) -  -  diff --git a/windows/keep-secure/switch-pcr-banks-on-tpm-2-0-devices.md b/windows/keep-secure/switch-pcr-banks-on-tpm-2-0-devices.md index a0af51cade..ea019eb343 100644 --- a/windows/keep-secure/switch-pcr-banks-on-tpm-2-0-devices.md +++ b/windows/keep-secure/switch-pcr-banks-on-tpm-2-0-devices.md @@ -2,28 +2,41 @@ title: Switch PCR banks on TPM 2.0 devices (Windows 10) description: A Platform Configuration Register (PCR) is a memory location in the TPM that has some unique properties. ms.assetid: 743FCCCB-99A9-4636-8F48-9ECB3A3D10DE -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Switch PCR banks on TPM 2.0 devices **Applies to** - Windows 10 + A Platform Configuration Register (PCR) is a memory location in the TPM that has some unique properties. The size of the value that can be stored in a PCR is determined by the size of a digest generated by an associated hashing algorithm. A SHA-1 PCR can store 20 bytes – the size of a SHA-1 digest. Multiple PCRs associated with the same hashing algorithm are referred to as a PCR bank. + To store a new value in a PCR, the existing value is extended with a new value as follows: PCR\[N\] = HASHalg( PCR\[N\] || ArgumentOfExtend ) + The existing value is concatenated with the argument of the TPM Extend operation. The resulting concatenation is then used as input to the associated hashing algorithm, which computes a digest of the input. This computed digest becomes the new value of the PCR. + The [TCG PC Client Specific Platform TPM Profile for TPM 2.0](http://go.microsoft.com/fwlink/p/?LinkId=746577) defines the inclusion of at least one PCR bank with 24 registers. The only way to reset the first 16 PCRs is to reset the TPM itself. This restriction helps ensure that the value of those PCRs can only be modified via the TPM Extend operation. + Some TPM PCRs are used as checksums of log events. The log events are extended in the TPM as the events occur. Later, an auditor can validate the logs by computing the expected PCR values from the log and comparing them to the PCR values of the TPM. Since the first 16 TPM PCRs cannot be modified arbitrarily, a match between an expected PCR value in that range and the actual TPM PCR value provides assurance of an unmodified log. + ## How does Windows 10 use PCRs? + To bind the use of a TPM based key to a certain state of the PC, the key can be sealed to an expected set of PCR values. For instance, PCRs 0 through 7 have a well-defined value after the boot process – when the OS is loaded. When the hardware, firmware, or boot loader of the machine changes, the change can be detected in the PCR values. Windows 10 uses this capability to make certain cryptographic keys only available at certain times during the boot process. For instance, the BitLocker key can be used at a certain point in the boot, but not before or after. -It is important to note that this binding to PCR values also includes the hashing algorithm used for the PCR. For instance, a key can be bound to a specific value of the SHA-1 PCR\[12\], if using SHA-256 PCR banks, even with the same system configuration otherwise, the PCR values will not match. + +It is important to note that this binding to PCR values also includes the hashing algorithm used for the PCR. For instance, a key can be bound to a specific value of the SHA-1 PCR\[12\], if using SHA-256 PCR banks, even with the +same system configuration otherwise, the PCR values will not match. + ## What happens when PCR banks are switched? + When the PCR banks are switched, the algorithm used to compute the hashed values stored in the PCRs during extend operations is changed. For the same input, each hash algorithm will return a different cryptographic signature for the same inputs. + As a result, if the currently used PCR bank is switched all keys that have been bound to the previous PCR values will no longer work. For example, if you had a key bound to the SHA-1 value of PCR\[12\] and subsequently changed the PCR banks to SHA-256, the banks wouldn’t match, and you would be unable to use that key. The BitLocker key is secured using the PCR banks and Windows 10 will not be able to unseal it if the PCR banks are switched while BitLocker is enabled. + ## What can I do to switch PCRs when BitLocker is already active? + Before switching PCR banks you should suspend or disable BitLocker – or have your recovery key ready. For steps on how to switch PCR banks on your PC, you should contact your OEM or UEFI vendor. -  -  diff --git a/windows/keep-secure/vpn-profile-options.md b/windows/keep-secure/vpn-profile-options.md index dd626ba989..6f336cc6e6 100644 --- a/windows/keep-secure/vpn-profile-options.md +++ b/windows/keep-secure/vpn-profile-options.md @@ -2,32 +2,46 @@ title: VPN profile options (Windows 10) description: Virtual private networks (VPN) let you give your users secure remote access to your company network. Windows 10 adds useful new VPN profile options to help you manage how users connect. ms.assetid: E3F99DF9-863D-4E28-BAED-5C1B1B913523 -ms.pagetype: networking ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: networking author: jdeckerMS --- + # VPN profile options + **Applies to** - Windows 10 - Windows 10 Mobile + Virtual private networks (VPN) let you give your users secure remote access to your company network. Windows 10 adds useful new VPN profile options to help you manage how users connect. + ## Always On + Always On is a new feature in Windows 10 which enables the active VPN profile to connect automatically on the following triggers: - User sign-on - Network change + When a device has multiple profiles with Always On triggers, the user can specify the active profile in **Settings** > **Network & Internet** > **VPN** > *VPN profile* > **Let apps automatically use this VPN connection**. + ## App-triggered VPN + VPN profiles in Windows 10 can be configured to connect automatically on the launch of a specified set of applications. This feature was included in Windows 8.1 as "On demand VPN". The applications can be defined using the following: - Package family name for Universal Windows Platform (UWP) apps - File path for Classic Windows applications + ## Traffic filters + Traffic Filters give enterprises the ability to decide what traffic is allowed into the corporate network based on policy . With the ever-increasing landscape of remote threats on the corporate network and lesser IT controls on machines, it becomes essential to control the traffic that is allowed through. While server-side layers of firewalls and proxies help, by adding traffic filters the first layer of filtering can be moved onto the client with more advanced filtering on the server side. There are two types of Traffic Filter rules: + - **App-based rules**. With app-based rules, a list of applications can be marked such that only traffic originating from these apps is allowed to go over the VPN interface. - **Traffic-based rules**. Traffic-based rules are 5-tuple policies (ports, addresses, protocol) that can be specified such that only traffic matching these rules is allowed to go over the VPN interface. + There can be many sets of rules which are linked by **OR**. Within each set, there can be app-based rules and traffic-based rules; all the properties within the set will be linked by **AND**. This gives the IT admins a lot of power to craft the perfect policy befitting their use case. + ## LockDown VPN + A VPN profile configured with LockDown secures the device to only allow network traffic over the VPN interface. It has the following features: - The system attempts to keep the VPN connected at all times. - The user cannot disconnect the VPN connection. @@ -35,12 +49,12 @@ A VPN profile configured with LockDown secures the device to only allow network - The VPN LockDown profile uses forced tunnel connection. - If the VPN connection is not available, outbound network traffic is blocked. - Only one VPN LockDown profile is allowed on a device. -**Note**   -For inbox VPN, Lockdown VPN is only available for the Internet Key Exchange version 2 (IKEv2) tunnel type. +> **Note:**  For inbox VPN, Lockdown VPN is only available for the Internet Key Exchange version 2 (IKEv2) tunnel type.   ## Learn more + [VPNv2 configuration service provider (CSP) reference](http://go.microsoft.com/fwlink/p/?LinkId=617588) + [How to Create VPN Profiles in Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=618028) + [Help users connect to their work using VPN profiles with Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkId=618029) -  -  diff --git a/windows/keep-secure/why-a-pin-is-better-than-a-password.md b/windows/keep-secure/why-a-pin-is-better-than-a-password.md index 558cbc221c..5afeb6f914 100644 --- a/windows/keep-secure/why-a-pin-is-better-than-a-password.md +++ b/windows/keep-secure/why-a-pin-is-better-than-a-password.md @@ -2,51 +2,74 @@ title: Why a PIN is better than a password (Windows 10) description: Microsoft Passport in Windows 10 enables users to sign in to their device using a PIN. How is a PIN different from (and better than) a password . ms.assetid: A6FC0520-01E6-4E90-B53D-6C4C4E780212 -ms.pagetype: security -keywords: ["pin", "security", "password"] +keywords: pin, security, password ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: jdeckerMS --- + # Why a PIN is better than a password + **Applies to** - Windows 10 - Windows 10 Mobile + Microsoft Passport in Windows 10 enables users to sign in to their device using a PIN. How is a PIN different from (and better than) a password? On the surface, a PIN looks much like a password. A PIN can be a set of numbers, but enterprise policy might allow complex PINs that include special characters and letters, both upper-case and lower-case. Something like **t758A!** could be an account password or a complex Passport PIN. It isn't the structure of a PIN (length, complexity) that makes it better than a password, it's how it works. + + ## PIN is tied to the device One important difference between a password and a Passport PIN is that the PIN is tied to the specific device on which it was set up. That PIN is useless to anyone without that specific hardware. Someone who steals your password can sign in to your account from anywhere, but if they steal your PIN, they'd have to steal your physical device too! + Even you can't use that PIN anywhere except on that specific device. If you want to sign in on multiple devices, you have to set up Passport on each device. + ## PIN is local to the device + A password is transmitted to the server -- it can be intercepted in transmission or stolen from a server. A PIN is local to the device -- it isn't transmitted anywhere and it isn't stored on the server. When the PIN is created, it establishes a trusted relationship with the identity provider and creates an asymmetric key pair that is used for authentication. When you enter your PIN, it unlocks the authentication key and uses the key to sign the request that is sent to the authenticating server. -**Note**   -For details on how Passport uses asymetric key pairs for authentication, see [Microsoft Passport guide](http://go.microsoft.com/fwlink/p/?LinkId=691928). +> **Note:**  For details on how Passport uses asymetric key pairs for authentication, see [Microsoft Passport guide](http://go.microsoft.com/fwlink/p/?LinkId=691928).   ## PIN is backed by hardware + The Passport PIN is backed by a Trusted Platform Module (TPM) chip, which is a secure crypto-processor that is designed to carry out cryptographic operations. The chip includes multiple physical security mechanisms to make it tamper resistant, and malicious software is unable to tamper with the security functions of the TPM. All Windows 10 Mobile phones and many modern laptops have TPM. + User key material is generated and available within the Trusted Platform Module (TPM) of the user device, which protects it from attackers who want to capture the key material and reuse it. Because Microsoft Passport uses asymmetrical key pairs, users credentials can’t be stolen in cases where the identity provider or websites the user accesses have been compromised. + The TPM protects against a variety of known and potential attacks, including PIN brute-force attacks. After too many incorrect guesses, the device is locked. + ## PIN can be complex + The Passport PIN is subject to the same set of IT management policies as a password, such as complexity, length, expiration, and history. Although we generally think of a PIN as a simple four-digit code, administrators can set [policies](implement-microsoft-passport-in-your-organization.md) for managed devices to require a PIN complexity similar to a password. You can require or block: special characters, uppercase characters, lowercase characters, and digits. + ## What if someone steals the laptop or phone? + To compromise a Microsoft Passport credential that TPM protects, an attacker must have access to the physical device, and then must find a way to spoof the user’s biometrics or guess his or her PIN—and all of this must be done before TPM anti-hammer capabilities lock the device. You can provide additional protection for laptops that don't have TPM by enablng BitLocker and setting a policy to limit failed sign-ins. + **Configure BitLocker without TPM** 1. Use the Local Group Policy Editor (gpedit.msc) to enable the following policy: + **Computer Configuration** > **Administrative Templates** > **Windows Components** > **BitLocker Drive Encryption** > **Operating System Drives** > **Require additional authentication at startup** + 2. In the policy option, select **Allow BitLocker without a compatible TPM**, and then click **OK.** 3. Go to Control Panel > **System and Security** > **BitLocker Drive Encryption** and select the operating system drive to protect. **Set account lockout threshold** 1. Use the Local Group Policy Editor (gpedit.msc) to enable the following policy: + **Computer Configuration** >**Windows Settings** ?**Security Settings** >**Account Policies** > **Account Lockout Policy** > **Account lockout threshold** + 2. Set the number of invalid logon attempts to allow, and then click OK. + ## Why do you need a PIN to use Windows Hello? Windows Hello is the biometric sign-in for Microsoft Passport in Windows 10: fingerprint, iris, or facial recognition. When you set up Windows Hello, you're asked to create a PIN first. This PIN enables you to sign in using Passport when you can’t use your preferred biometric because of an injury or because the sensor is unavailable or not working properly. + If you only had a biometric sign-in configured and, for any reason, were unable to use that method to sign in, you would have to sign in using your account name and password, which doesn't provide you the same level of protection as Passport. + ## Related topics + [Manage identity verification using Microsoft Passport](manage-identity-verification-using-microsoft-passport.md) + [Implement Microsoft Passport in your organization](implement-microsoft-passport-in-your-organization.md) -  -  +  \ No newline at end of file diff --git a/windows/keep-secure/windows-10-enterprise-security-guides.md b/windows/keep-secure/windows-10-enterprise-security-guides.md index dffeabae7b..510675e4ff 100644 --- a/windows/keep-secure/windows-10-enterprise-security-guides.md +++ b/windows/keep-secure/windows-10-enterprise-security-guides.md @@ -2,16 +2,22 @@ title: Enterprise security guides (Windows 10) description: Get proven guidance to help you better secure and protect your enterprise by using technologies such as Credential Guard, Device Guard, Microsoft Passport, and Windows Hello. This section offers technology overviews and step-by-step guides. ms.assetid: 57134f84-bd4b-4b1d-b663-4a2d36f5a7f8 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: challum + --- + # Enterprise security guides + ## Purpose + Get proven guidance to help you better secure and protect your enterprise by using technologies such as Credential Guard, Device Guard, Microsoft Passport, and Windows Hello. This section offers technology overviews and step-by-step guides. + ## In this section +
    diff --git a/windows/keep-secure/windows-10-mobile-security-guide.md b/windows/keep-secure/windows-10-mobile-security-guide.md index fe2c16b438..1008003440 100644 --- a/windows/keep-secure/windows-10-mobile-security-guide.md +++ b/windows/keep-secure/windows-10-mobile-security-guide.md @@ -2,30 +2,43 @@ title: Windows 10 Mobile security guide (Windows 10) description: This guide provides a detailed description of the most important security features in the Windows 10 Mobile operating system—identity access and control, data protection, malware resistance, and app platform security. ms.assetid: D51EF508-699E-4A68-A7CD-91D821A97205 -ms.pagetype: security; mobile -keywords: ["data protection, encryption, malware resistance, smartphone, device, Windows Store"] +keywords: data protection, encryption, malware resistance, smartphone, device, Windows Store ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library +ms.pagetype: security; mobile author: AMeeus --- + # Windows 10 Mobile security guide + **Applies to** - Windows 10 Mobile + This guide provides a detailed description of the most important security features in the Windows 10 Mobile operating system—identity access and control, data protection, malware resistance, and app platform security. + ## Overview + Windows 10 Mobile is specifically designed for smartphones and small tablets. It uses the same security technologies as the Windows 10 operating system to help protect against known and emerging security threats across the spectrum of attack vectors. Several broad categories of security work went into Windows 10 Mobile: + - **Identity and access control.** Microsoft has greatly enhanced identity and access control features to simplify and improve the security of user authentication. These features include Windows Hello and Microsoft Passport, which better protect user identities through easy-to-deploy and easy-to-use multifactor authentication (MFA). (Windows Hello requires either a specialized illuminated infrared \[IR\] camera for facial recognition and iris detection or a finger print reader that supports the Windows Biometric Framework.) - **Data protection.** Confidential data is better protected from compromise than ever before. Windows 10 Mobile uses several data-protection technologies and delivers them in a user-friendly and IT-manageable way. - **Malware resistance.**Windows 10 Mobile helps protect critical system resources and apps to reduce the threat of malware, including support for enterprise-grade secure hardware and Secure Boot. -- **App platform security.** The Windows 10 Mobile enterprise-grade secure app platform provides multiple layers of security. For example, Windows Store checks all apps for malware to help prevent malware from reaching devices. In addition, AppContainer application isolation helps prevent any malicious app from compromising other apps. +- **App platform security.** The Windows 10 Mobile enterprise-grade secure app platform provides multiple layers of security. For example, Windows Store checks all apps for malware to help prevent malware from reaching devices. + +In addition, AppContainer application isolation helps prevent any malicious app from compromising other apps. + This guide explains each of these technologies and how they help protect your Windows 10 Mobile devices. + ## Identity and access control + A fundamental component of security is the notion that a user has a unique identity and that that identity is either allowed or denied access to resources. This notion is traditionally known as access control, which has three parts: - **Identification.** The user (subject) asserts a unique identity to the computer system for the purpose of accessing a resource (object), such as a file or an app. - **Authentication.** Authentication is the process of proving the asserted identity and verifying that the subject is indeed the subject. - **Authorization.** The system compares the authenticated subject’s access rights against the object’s permissions and either allows or denies the requested access. + The way an operating system implements these components makes a difference in preventing attackers from accessing corporate data. Only users who prove their identities and are authorized to access that data can access it. In security, however, there are varying degrees of identity proof and many different requirements for authorization limits. The access control flexibility most corporate environments need presents a challenge for any operating system. Table 1 lists typical Windows access control challenges and the solutions that Windows 10 Mobile offers. + Table 1. Windows 10 Mobile solutions for typical access control challenges
    @@ -59,41 +72,67 @@ Table 1. Windows 10 Mobile solutions for typical access control challenges
      The following sections describe these challenges and solutions in more detail. + ### Microsoft Passport + Microsoft Passport provides strong MFA, fully integrated into Windows devices, to replace passwords. To authenticate, the user must have a Microsoft Azure Active Directory (Azure AD)–registered device and either a PIN or Windows Hello biometric gesture to unlock the device. Microsoft Passport is conceptually similar to a smart card but more flexible, as it doesn’t require a public key infrastructure or the implementation of additional hardware and supports biometric identification. + Microsoft Passport offers three significant advantages over the previous state of Windows authentication: it’s more flexible, it’s based on industry standards, and it more effectively mitigates risks. ### It's effective + Microsoft Passport eliminates the use of passwords for logon and so reduces the risk that an attacker will steal and reuse a user’s credentials. User key material, which includes the user’s private key, is available only on the device that generated it. The key material is protected with the TPM, which protects the key material from attackers who want to capture and reuse it. It is a Windows Hardware Certification Program requirement that every Windows 10 Mobile device include a TPM. + To compromise a Microsoft Passport credential that the TPM protects, an attacker must have access to the physical device, and then find a way to spoof the user’s biometrics identity or guess his or her PIN—and all of this must be done before TPM brute-force resistance capabilities lock the mobile device, the theft-protection mechanism kicks in, or the user or corporate administrator remotely wipes the device. This technology greatly reduces an attacker’s window of opportunity for compromising a user’s credentials. + ### It's flexible + Microsoft Passport offers unprecedented flexibility along with enterprise-grade security. + Most importantly, Microsoft Passport works with biometrics or PINs and gives you options beyond long, complex passwords. Instead of users memorizing and retyping often-changed passwords, Microsoft Passport enables PIN- and biometrics-based identification through Windows Hello to identify users more securely. + The Windows 10 Mobile device that the user logs on to is an authentication factor, as well. The credentials used and the private key on the device are device specific and bound to the device’s TPM. + In the future, Microsoft Passport will also enable people to use Windows 10 Mobile devices as a remote credential when signing in to PCs running Windows 10. Users will use their PINs or biometrics to unlock their phones, and their phones will unlock their PCs. Phone sign-in with Microsoft Passport will make implementing MFA for scenarios where the user’s credentials must be physically separate from the PC the user is signing in to less costly and complex than other solutions. Phone sign-in will also make it easier for users and IT pros because users can use their phones to sign in to any corporate device instead of enrolling a user credential on each. + With Microsoft Passport, you gain flexibility in the data center, too. To deploy it for Windows 10 Mobile devices, you must set up Azure AD, but you don’t have to replace or remove your existing Active Directory environment. Using Azure AD Connect, organizations can synchronize these two directory services. Microsoft Passport builds on and adds to your existing infrastructure and allows you to federate with Azure AD. + Microsoft Passport is also supported on the desktop, giving organizations a uniform way to implement strong authentication on all devices. This flexibility makes it simpler for Microsoft Passport to supplement existing smart card or token deployments for on-premises Windows PC scenarios, adding MFA to mobile devices and users who don’t currently have it for extra protection of sensitive resources or systems that these mobile devices access. + ### It's standardized + Both software vendors and enterprise customers have come to realize that proprietary identity and authentication systems are a dead end: the future lies with open, interoperable systems that allow secure authentication across a variety of devices, line-of-business (LOB) apps, and external applications and websites. To this end, a group of industry players formed the Fast Identity Online (FIDO) Alliance. The FIDO Alliance is a nonprofit organization that works to address the lack of interoperability among strong authentication devices as well as the problems users face in creating and remembering multiple user names and passwords. The FIDO Alliance plans to change the nature of authentication by developing specifications that define an open, scalable, interoperable set of mechanisms that supplant reliance on passwords to authenticate users of online services securely. This new standard can allow any business network, app, website, or cloud application to interface with a broad variety of existing and future FIDO-enabled devices and operating system platforms using a standardized set of interfaces and protocols. In 2014, Microsoft joined the board of the FIDO Alliance. FIDO standards enable a universal framework that a global ecosystem delivers for a consistent and greatly improved user experience of strong password-less authentication. The FIDO 1.0 specifications, published in December 2014, provide for two types of authentications: password-less (known as UAF) and second factor (U2F). The FIDO Alliance is working on a set of 2.0 proposals that incorporate the best ideas from its U2F and UAF FIDO 1.0 standards and of course new ideas. Microsoft has contributed Microsoft Passport technology to the FIDO 2.0 specification workgroup for review and feedback and continues to work with the FIDO Alliance as the FIDO 2.0 specification moves forward. Interoperability of FIDO products is a hallmark of FIDO authentication. Microsoft believes that bringing a FIDO solution to market will help solve a critical need for enterprises and consumers alike. + ### Windows Hello + Windows Hello is the new biometric framework for Windows 10. Because biometric identification is built directly into the operating system, it allows you to use your iris, face, or fingerprint to unlock your mobile device. Windows Hello unlocks Microsoft Passport credentials, which enable authentication to resources or relying parties such as software-as-a-service applications like Microsoft Office 365. Windows Hello supports three biometric sensor options that are suitable for enterprise scenarios: + - **Facial recognition** uses special IR cameras to reliably tell the difference between a photograph or scan and a living person. Several vendors are shipping external cameras that incorporate this technology, and major manufacturers are already shipping laptops with integrated facial-recognition technology. Both Surface Pro 4 and Surface Book support this technology. - **Fingerprint recognition** uses a sensor to scan the user’s fingerprint. Although fingerprint readers have been available for computers running the Windows operating system for years, the detection, anti-spoofing, and recognition algorithms in Windows 10 are more advanced than in previous Windows versions. Most existing fingerprint readers (whether external to or integrated into laptops or USB keyboards) that support the Windows Biometric Framework will work with Windows Hello. - **Iris scanning** uses cameras designed to scan the user’s iris, the colorful and highly detailed portion of the eye. Because the data must be accurate, iris scanning uses a combination of an IR light source and a high-quality camera. Microsoft Lumia 950 and 950 XL devices support this technology. -**Note**   -Users must create an unlock PIN before they enroll a biometric gesture. The device uses this PIN as a fallback mechanism in situations where it cannot capture the biometric gesture. +> **Note:**  Users must create an unlock PIN before they enroll a biometric gesture. The device uses this PIN as a fallback mechanism in situations where it cannot capture the biometric gesture.   All three of these biometric factors—the face, the finger, and the iris—are unique to an individual. To capture enough data to uniquely identify an individual, a biometric scanner might initially capture images in multiple conditions or with additional details. For example, an iris scanner will capture images of both eyes; or both with and without eyeglasses or contact lenses. + Spoofing biometric data is often a big concern in enterprise environments. Microsoft employs several anti-spoofing techniques in Windows 10 Mobile that verify the trustworthiness of the biometric device as well as guard against intentional collision with stored biometric measurements. These techniques help improve the false-acceptance rate (the rate at which spoofed biometric data is accepted as authentic) while maintaining the overall usability and manageability of MFA. + The biometric image collected at enrollment is converted into an algorithmic form that cannot be converted back into the original image. Only the algorithmic form is kept; the actual biometric image is removed from the device after conversion. Windows 10 Mobile devices both encrypt the algorithmic form of the biometric data and bind the encrypted data to the device, both of which help prevent someone from removing the data from the phone. As a result, the biometric information that Windows Hello uses is a local gesture and doesn’t roam among the user’s devices. + Windows Hello offers several major benefits. First, it helps to address the problems of credential theft and sharing because an attacker must obtain the mobile phone and impersonate the user’s biometric identity, which is more difficult than stealing a device unlock password. Second, the use of biometrics gives users an authenticator that’s always with them—there’s nothing to forget, lose, or leave behind. Instead of worrying about memorizing long, complex passwords, users can take advantage of a convenient, enterprise-grade secure method for logging on to their Windows 10 Mobile device. Finally, there’s nothing additional to deploy, because Microsoft built Windows Hello support directly into the operating system. All you need is a device that includes a supported biometric sensor. + The device that senses the biometric factors must report the data to Windows Hello quickly and accurately. For this reason, Microsoft determines which factors and devices are trustworthy and accurate prior to their inclusion in Windows Hello. For more information, see [Windows 10 specifications](http://go.microsoft.com/fwlink/p/?LinkId=722908). + ## Data protection + Windows 10 Mobile continues to provide solutions that help protect information against unauthorized access and disclosure. + + ### Device encryption Windows 10 Mobile uses device encryption, based on BitLocker technology, to encrypt all internal storage, including operating system and data storage partitions. The user can activate device encryption, or the IT department can activate and enforce encryption for company-managed devices through MDM tools. When device encryption is turned on, all data stored on the phone is encrypted automatically. A Windows 10 Mobile device with encryption turned on helps protect the confidentiality of data stored if the device is lost or stolen. The combination of Windows Hello lock and data encryption makes it extremely difficult for an unauthorized party to retrieve sensitive information from the device. + You can customize how device encryption works to meet your unique security requirements. Device encryption even enables you to define your own cipher suite. For example, you can specify the algorithm and key size that Windows 10 Mobile uses for data encryption, which Transport Layer Security (TLS) cipher suites are permitted, and whether Federal Information Processing Standard (FIPS) policy is enabled. Table 2 lists the policies you can change to customize device encryption on Windows 10 Mobile devices. + Table 2. Windows 10 cryptography policies @@ -128,52 +167,79 @@ Table 2. Windows 10 cryptography policies
      For a complete list of policies available, see [Policy CSP](http://go.microsoft.com/fwlink/p/?LinkId=733963). + ### Enterprise data protection + Enterprises have seen huge growth in the convergence of personal and corporate data storage. Personal data is frequently stored on corporate devices and vice versa. This situation increases the potential for compromise of sensitive corporate data. + One growing risk is authorized users’ accidental disclosure of sensitive data—a risk that is rapidly becoming the biggest source of confidential data leakage as organizations allow personal devices to access corporate resources. One example is common among organizations: an employee connects his or her personal phone to the company’s Microsoft Exchange Server instance for email. He or she uses the phone to work on email that includes attachments with sensitive data. When sending the email, the user accidentally copies a supplier. Content protection is only as strong as the weakest link, and in this example, the unintended sharing of sensitive data with unauthorized people might not have been prevented with standard data encryption. + In Windows 10 Mobile, enterprise data protection (EDP) helps separate personal and enterprise data and prevent data leakage. Key features include its ability to: + - Automatically tag personal and corporate data. - Protect data while it’s at rest on local or removable storage. - Control which apps can access corporate data. - Control which apps can access a virtual private network (VPN) connection. - Prevent users from copying corporate data to public locations. -**Note**   -EDP is currently being tested in select customer evaluation programs. For more information about EDP, see [Enterprise data protection overview](../whats-new/edp-whats-new-overview.md). + +> **Note:**  EDP is currently being tested in select customer evaluation programs. For more information about EDP, see [Enterprise data protection overview](../whats-new/edp-whats-new-overview.md).   ### Enlightenment + Third-party data loss protection solutions usually require developers to wrap their apps. In contrast, EDP puts the intelligence in Windows 10 Mobile so that it doesn’t require wrappers. As a result, most apps require nothing extra to work with EDP. + EDP can enforce policy without the need for an app to change. This means that an app that always handles business data (such as an LOB app) can be added to the allowed list and will always encrypt all data that it handles. However, if the app does not use common controls, cut and paste operations from this app to a non-enterprise app will silently fail. In addition, if the app needs to handle personal data, this data will also be encrypted. Therefore, to improve the user experience, in some cases, developers should enlighten their apps by adding code to and compiling them to use the EDP application programming interfaces. Those cases include apps that: - Don’t use common controls for saving files. - Don’t use common controls for text boxes. - Work on personal and enterprise data simultaneously (for example, contact apps that display personal and enterprise data in a single view; a browser that displays personal and enterprise web pages on tabs within a single instance). + Figure 1 summarizes when an app might require enlightenment to work with EDP. Microsoft Word is a good example. Not only can Word access personal and enterprise data simultaneously, but it can also transmit enterprise data (for example, email attachments containing enterprise data). + In any case, most apps don’t require enlightenment for them to use EDP protection. Simply adding them to the EDP allow list is all you must do. Because unenlightened apps cannot automatically tag data as personal or enterprise, if they are in an EDP policy, they treat all data as enterprise data. An LOB app is a good example. Adding an LOB app to an EDP policy protects all data that the app handles. Another example is a legacy app that cannot be updated, which you can add to an EDP policy and use without even being aware that EDP exists. + ![figure 1](images/mobile-security-guide-fig1.png) + Figure 1. When is enlightenment required? + ### Data leakage control + To configure EDP in an MDM solution that supports it, add authorized apps to the EDP allow list. When a device running Windows 10 Mobile enrolls in the MDM solution, apps that this policy doesn’t authorize won’t have access to enterprise data. + EDP works seamlessly until users try to access enterprise data with or try to paste enterprise data into unauthorized apps or locations on the web. For example, copying enterprise data from an authorized app to another authorized app works as usual, but EDP blocks users from copying enterprise data from an authorized app to an unauthorized app. Likewise, EDP blocks users from using an unauthorized app to open a file that contains enterprise data. In addition, users cannot copy and paste data from authorized apps to unauthorized apps or locations on the Web without triggering one of the EDP protection levels: - **Block.** EDP blocks users from completing the operation. - **Override.** EDP notifies users that the operation is inappropriate but allows them to override the policy, although it logs the operation in the audit log. - **Audit.** EDP does not block or notify users but logs the operation in the audit log. - **Off.** EDP does not block or notify users and does not log operations in the audit log. + ### Data separation + As the name suggests, data separation separates personal from enterprise data. Most third-party solutions require an app wrapper, and from here, enterprise data goes in a container while personal data is outside the container. Often, people must use two different apps for the same purpose: one for personal data and another for enterprise data. + EDP provides the same data separation but neither uses containers nor requires a special version of an app to access business data, and then a second instance of it to access personal data. There are no containers, partitions, or special folders to physically separate personal and business data. Instead, Windows 10 Mobile is the access control broker, identifying enterprise data because it’s encrypted to the enterprise. Therefore, EDP provides data separation by virtue of encrypting enterprise data. + ### Visual cues + In Windows 10 Mobile, visual cues indicate the status of EDP to users (see Figure 2): + - **Start screen.** On the Start screen, apps that an EDP policy manages display a visual cue. - **Files.** In File Explorer, a visual cue indicates whether a file or folder contains enterprise data and is therefore encrypted. For example, Erwin is an employee at Fabrikam. He opens Microsoft Edge from the Start screen and sees that the tile indicates that an EDP policy manages the browser. Erwin opens the Fabrikam sales website and downloads a spreadsheet. In File Explorer, Erwin sees that the file he downloaded has a visual cue which indicates that it’s encrypted and contains enterprise data. When Erwin tries to paste data from that spreadsheet into an app that no EDP policy manages (for example, his Twitter app), Erwin might see a message that allows him to override protection while logging the action, depending on the protection level configured in the EDP policy. + ![figure 2](images/mobile-security-guide-fig2.png) + Figure 2. Visual cues in EDP + ## Malware resistance + Just as software has automated so much of our lives, malware has automated attacks on our devices. Those attacks are relentless. Malware is constantly changing, and when it infects a device, it can be difficult to detect and remove. The best way to fight malware is to prevent the infection from happening. Windows 10 Mobile provides strong malware resistance because it takes advantage of secured hardware and protects both the startup process and the core operating system architecture. + Table 3 lists specific malware threats and the mitigation that Windows 10 Mobile provides. + Table 3. Threats and Windows 10 Mobile mitigations + @@ -226,54 +292,78 @@ Table 3. Threats and Windows 10 Mobile mitigations
      -**Note**   -Windows 10 Mobile devices use a System on a Chip (SoC) design provided by SoC vendors such as Qualcomm. With this architecture, the SoC vendor and device manufacturers provide the pre-UEFI bootloaders and the UEFI environment. The UEFI environment implements the UEFI Secure Boot standard described in section 27 of the UEFI specification, which can be found at [http://www.uefi.org/specsandtesttools](http://go.microsoft.com/fwlink/p/?LinkId=722912). This standard describes the process by which all UEFI drivers and applications are validated against keys provisioned into a UEFI-based device before they are executed. +> **Note:**  Windows 10 Mobile devices use a System on a Chip (SoC) design provided by SoC vendors such as Qualcomm. With this architecture, the SoC vendor and device manufacturers provide the pre-UEFI bootloaders and the UEFI environment. The UEFI environment implements the UEFI Secure Boot standard described in section 27 of the UEFI specification, which can be found at [http://www.uefi.org/specsandtesttools](http://go.microsoft.com/fwlink/p/?LinkId=722912). This standard describes the process by which all UEFI drivers and applications are validated against keys provisioned into a UEFI-based device before they are executed.   The following sections describe these improvements in more detail. + ### Enterprise-grade secure hardware + Taking full advantage of Windows 10 Mobile security features requires advancements in hardware-based security. These advances include UEFI with Secure Boot, TPM, and biometric sensors (hardware dependent). + ### UEFI with Secure Boot + When a Windows 10 Mobile device starts, it begins the process of loading the operating system by locating the bootloader in the device’s storage system. Without safeguards in place, the phone might simply hand control over to the bootloader without even determining whether it’s a trusted operating system or malware. + UEFI is a standards-based solution that offers a modern-day replacement for the BIOS. In fact, it provides the same functionality as BIOS while adding security features and other advanced capabilities. Like BIOS, UEFI initializes devices, but UEFI components with the Secure Boot feature (version 2.3.1 or later) also help ensure that only trusted firmware in Option ROMs, UEFI apps, and operating system bootloaders can start on the mobile phone. UEFI can run internal integrity checks that verify the firmware’s digital signature before running it. Because only the mobile phone’s manufacturer has access to the digital certificate required to create a valid firmware signature, UEFI has protection against firmware-based malware that loads before Windows 10 Mobile and can successfully hide its malicious behavior from Windows 10 Mobile. Firmware-based malware of this nature is typically called a bootkit. When a mobile device with UEFI and Secure Boot starts, the UEFI firmware verifies the bootloader’s digital signature to verify that no one has modified it after it was digitally signed. The firmware also verifies that a trusted authority issued the bootloader’s digital signature. This check helps to ensure that the system starts only after checking that the bootloader is both trusted and unmodified since signing. All Windows 10 Mobile devices always have Secure Boot enabled. In addition, they trust only the Windows operating system signature. + Neither Windows 10 Mobile, apps, or even malware can change the UEFI configuration. For more information about UEFI with Secure Boot, read [Protecting the pre-OS environment with UEFI](http://go.microsoft.com/fwlink/p/?LinkId=722909). + ### Trusted Platform Module + A Trusted Platform Module is a tamper-resistant cryptographic module that enhances the security and privacy of computing platforms. The TPM is incorporated as a component in a trusted computing platform like a PC, tablet, or mobile phone. A trusted computing platform is specially designed to work with the TPM to support privacy and security scenarios that software alone cannot achieve. It is a Windows 10 Mobile device hardware certification requirement to include a TPM in every Windows 10 Mobile device. + A proper implementation of a TPM as part of a trusted computing platform provides a hardware root of trust, meaning that the hardware behaves in a trusted way. For example, if you create a key in a TPM with the property that no one can export that key from the TPM, the key absolutely cannot leave the TPM. The close integration of a TPM with a platform increases the transparency of the boot process and supports device health scenarios by enabling reliable report of the software used to start a platform. + The following list describes key functionality that a TPM provides in Windows 10 Mobile: - **Manage cryptographic keys.** A TPM can create, store, and permit the use of keys in defined ways. Windows 10 Mobile uses the TPM to protect the encryption keys for BitLocker volumes, virtual smart cards, certificates, and various other keys. - **Safeguard and report integrity measurements.**Windows 10 Mobile uses the TPM to record and help protect integrity-related measurements of select hardware and Windows boot components for the Measured Boot feature. In this scenario, Measured Boot measures each component, from firmware up through the drivers, and then stores those measurements in the device’s TPM. From here, you can test the measurement log remotely so that a separate system verifies the boot state of the Windows 10 Mobile device. - **Prove a TPM is really a TPM.** Managing cryptographic keys and measuring integrity are so central to protecting privacy and security that a TPM must differentiate itself from malware that masquerades as a TPM. + Windows 10 Mobile supports TPM implementations that comply with the 2.0 standard. The TPM 2.0 standard includes several improvements that make it superior to the 1.2 standard, the most notable of which is cryptographic agility. TPM 1.2 is restricted to a fixed set of encryption and hash algorithms. At the time the TPM 1.2 standard appeared in the early 2000s, the security community considered these algorithms cryptographically strong. Since that time, advances in cryptographic algorithms and cryptanalysis attacks have increased expectations for stronger cryptography. TPM 2.0 supports additional algorithms that offer stronger cryptographic protection as well as the ability to plug in algorithms that certain geographies or industries may prefer. It also opens the possibility for inclusion of future algorithms without changing the TPM component itself. Many people assume that original equipment manufacturers (OEMs) must implant a TPM in hardware on a motherboard as a discrete module, but TPM can also be effective when implemented in firmware. Windows 10 Mobile supports only firmware TPM that complies with the 2.0 standard. Windows does not differentiate between discrete and firmware-based solutions because both must meet the same implementation and security requirements; therefore, any Windows 10 feature that can take advantage of TPM can be used with Windows 10 Mobile. -**Note**   -Microsoft requires TPM 2.0 on devices running any version of Windows 10 Mobile. For more information, see [Minimum hardware requirements](http://go.microsoft.com/fwlink/p/?LinkId=733964). + +> **Note:**  Microsoft requires TPM 2.0 on devices running any version of Windows 10 Mobile. For more information, see [Minimum hardware requirements](http://go.microsoft.com/fwlink/p/?LinkId=733964).   Several Windows 10 Mobile security features require TPM: - Virtual smart cards - Measured Boot - Health attestation (requires TPM 2.0 or later) Still other features will use the TPM if it is available. For example, Microsoft Passport does not require TPM but uses it if it’s available. Organizations can configure policy to require TPM for Microsoft Passport. + ### Biometrics + Windows 10 Mobile makes biometrics a core security feature. Microsoft has fully integrated biometrics into the Windows 10 Mobile security components, not just tacked it on top of the platform (as was the case in previous versions of Windows). This is a big change. Earlier biometric implementations were largely front-end methods that simplified authentication. Under the hood, the system used biometrics to access a password, which it then used for authentication behind the scenes. Biometrics may have provided convenience but not necessarily enterprise-grade authentication. Microsoft has been evangelizing the importance of enterprise-grade biometric sensors to the OEMs that create Windows 10 Mobile devices. These facial-recognition and iris-scanning sensors are fully supported by MFA features such as Microsoft Passport and Windows Hello. In the future, Microsoft expects OEMs to produce even more advanced enterprise-grade biometric sensors and to continue to integrate them into mobile devices. As a result, biometrics will become a commonplace authentication method as part of an MFA system. + ### Enterprise-grade secure Windows startup + UEFI with Secure Boot uses hardware technologies to help protect users from bootkits. Secure Boot can validate the integrity of the devices, firmware, and bootloader. After the bootloader launches, users must rely on the operating system to protect the integrity of the remainder of the system. + ### Trusted Boot + When UEFI with Secure Boot verifies that it trusts the bootloader and starts Windows 10 Mobile, the Windows Trusted Boot feature protects the rest of the startup process by verifying that all Windows startup components are trustworthy (for example, signed by a trusted source) and have integrity. The bootloader verifies the digital signature of the Windows kernel before loading it. The Windows kernel, in turn, verifies every other component of the Windows startup process, including the boot drivers, and startup files. + If someone has modified a file (for example, if malware has tampered with it or it has been corrupted), Trusted Boot will detect the problem and attempt to automatically repair the corrupted component. When repaired, Windows will start normally after only a brief delay. + ### Measured Boot + The biggest challenge with rootkits and bootkits in earlier versions of Windows was that they could frequently be undetectable to the client. Because they often started before Windows defenses and the antimalware solution—and they had system-level privileges—rootkits and bootkits could completely disguise themselves while continuing to access system resources. Although UEFI with Secure Boot and Trusted Boot could prevent most rootkits and bootkits, intruders could still potentially exploit a few attack vectors (for example, if someone compromised the signature used to sign a boot component, such as a non-Microsoft driver, and used it to sign a malicious one). Windows 10 Mobile implements the Measured Boot feature, which uses the TPM hardware component to record a series of measurements for critical startup-related components, including firmware, Windows boot components, and drivers. Because Measured Boot uses the hardware-based security capabilities of TPM, which isolates and protects the measurement data against malware attacks, the log data is well protected against even sophisticated attacks. Measured Boot focuses on acquiring the measurement data and protecting it against tampering. You must couple it, however, with a service that can analyze the data to determine device health and provide a more complete security service. The next section introduces just such a service. + ### Device health attestation + Device health attestation is new feature in Windows 10 Mobile that helps prevent low-level malware infections. Device health attestation uses a device’s TPM and firmware to measure the critical security properties of the device’s BIOS and Windows startup processes. These measurements are made in such a way that even on a system infected with kernel-level malware or a rootkit, an attacker is unlikely to spoof the properties. You can integrate Device health attestation with Microsoft Intune or non-Microsoft MDM solutions and combine these hardware-measured security properties with other device properties to gain an overall view of the device’s health and compliance state. From there, you can use this integration in a variety of scenarios, from detecting jailbroken devices to monitoring device compliance, generating compliance reports, alerting users or administrators, initiating corrective action on the device, and managing conditional access to resources such as Office 365. + ### Conditional Access + The example that follows shows how Windows 10 protective measures integrate and work with Intune and non-Microsoft MDM solutions. It demonstrates how the phone security architecture in Windows 10 Mobile helps you monitor and verify compliance and how the security and trust rooted in the device hardware protect corporate resources end to end. + When a user turns on a phone: 1. The Secure Boot feature in Windows 10 Mobile helps protect the startup sequence, allows the device to boot into a defined and trusted configuration, and loads a factory-trusted boot loader. 2. Windows 10 Mobile Trusted Boot takes control when the Secure Boot process is complete, verifying the digital signature of the Windows kernel and the components that are loaded and executed during the startup process. @@ -282,94 +372,168 @@ When a user turns on a phone: 5. HAS reviews the audit trails, issues an encrypted and signed report, and forwards it to the device. 6. From your Device health attestation-enabled MDM solution, you can review the report in a protected, tamper-resistant, and tamper-evident communication channel to assess whether the device is running in a compliant (healthy) state, allow access, or trigger corrective action aligned with the organization’s security needs and policies. Because this solution can detect and prevent low-level malware that may be extremely difficult to detect any other way, Microsoft recommends that you consider implementing a Device health attestation-enabled MDM system like Intune that takes advantage of the Windows 10 Mobile cloud-based health attestation server feature to detect and block devices infected with advanced malware. + ## App platform security + Applications built for Windows are designed to be secure and free of defects, but the reality is that human error can create vulnerabilities in code. When malicious users and software identify such vulnerabilities, they may attempt to manipulate data in memory in the hope that they can compromise the system and take control. + To mitigate these risks, Windows 10 Mobile includes a series of improvements to make it more difficult for malware to compromise the device. Windows 10 Mobile even enables organizations to choose which apps are allowed to run on mobile devices. In addition, it includes improvements that can dramatically reduce the likelihood that newly discovered vulnerabilities can be successful exploited. It takes detailed knowledge of operating system architecture and malware exploit techniques to fully appreciate the impact of these improvements, but the sections that follow explain them at a high level. + ### Device Guard + Device Guard is a feature set that consists of both hardware and software system integrity-hardening features. These features revolutionize Windows operating system security by moving the entire operating system to a trust-nothing model. + All apps on Windows 10 Mobile must be digitally signed and come from Windows Store or a trusted enterprise store. Device Guard implements policies that further restrict this. By default, Device Guard supports all apps from Windows Store. You can create policies that define the apps that can and cannot run on the Windows 10 Mobile device. If the app doesn’t have a digital signature or is prevented by policy, or it does not come from a trusted store, it will not run on Windows 10 Mobile. + Advanced hardware features (described earlier in the [Enterprise-grade secure hardware](#secure-hardware) section) drive these security offerings. By integrating these hardware features further into the core operating system, Windows 10 Mobile can use them in new ways. To deliver this additional security, Device Guard requires UEFI with Secure Boot. + ### AppContainer + The Windows 10 Mobile security model is based on the principle of least privilege and uses isolation to achieve it. Every app and even portions of the operating system itself run inside their own isolated sandbox called an AppContainer—a secured isolation boundary within which an app and its processes can run. Each AppContainer is defined and implemented through a security policy. + The security policy of a specific AppContainer defines the operating system capabilities that apps have access to from within the AppContainer. A capability is a Windows 10 Mobile device resource such as geographical location information, camera, microphone, networking, and sensors. + A set of default permissions are granted to all AppContainers, including access to a unique, isolated storage location. In addition, access to other capabilities can be declared within the app code itself. Access to additional capabilities and privileges cannot be requested at run time, as can be done with traditional desktop applications. + The AppContainer concept is advantageous for the following reasons: + - **Attack surface reduction.** Apps can access only those capabilities that are declared in the application code and needed to perform their functions. - **User consent and control.** Capabilities that apps use are automatically published to the app details page in the Windows Store. App access to capabilities that may expose sensitive information automatically prompt the user to acknowledge and provide consent. - **App isolation.** Communication between Windows apps is tightly controlled. Apps are isolated from one another and can communicate only by using predefined communications channels and data types. + Apps receive the minimal privileges they need to perform their legitimate tasks. This means that even if a malicious attacker exploits an app, the potential damage is limited because the app cannot elevate its privileges and is contained within its AppContainer. Windows Store displays the permissions that the app requires along with the app’s age rating and publisher. + The combination of Device Guard and AppContainer help to prevent unauthorized apps from running. In the event malware slips into the app ecosystem, the AppContainer helps to constrain the app and limit potential damage. The Windows 10 Mobile trust-nothing model doesn’t assume that any component is perfect, however, potential vulnerabilities in apps, AppContainers, and Windows 10 Mobile itself could give an attacker a chance to compromise a system. For this reason, we need redundant vulnerability mitigations. The next several topics describe some of the redundant mitigations in Windows 10 Mobile. + ### Address Space Layout Randomization One of the most common techniques attackers use to gain access to a system is to find a vulnerability in a privileged process that is already running, guess or find a location in memory where important system code and data reside, and then overwrite that information with a malicious payload. In the early days of operating systems, any malware that could write directly to the system memory could do such a thing; the malware would simply overwrite system memory in well-known and predictable locations. + Address Space Layout Randomization (ASLR) makes that type of attack much more difficult because it randomizes how and where important data is stored in memory. With ASLR, it is more difficult for malware to find the specific location it needs to attack. Figure 3 illustrates how ASLR works, showing how the locations of different critical Windows components can change in memory between restarts. + ![figure 3](images/mobile-security-guide-figure3.png) + Figure 3. ASLR at work + Microsoft has substantively improved the ASLR implementation in Windows 10 Mobile over previous versions, especially with 64-bit system and application processes that can take advantage of a vastly increased memory space, making it even more difficult for malware to predict where Windows 10 Mobile stores vital data. When used on systems that have TPMs, ASLR memory randomization will be increasingly unique across devices, making it even more difficult for a successful exploit that works on one system to work reliably on another. Microsoft also holistically applied ASLR across the entire system in Windows 10 Mobile rather than it working only on specific apps. + ### Data Execution Prevention + Malware depends on its ability to put a malicious payload into memory with the hope that an unsuspecting user will execute it later. ASLR makes that much more difficult. + Extending that protection, it would be great if you could prevent malware from running if it wrote to an area that you have allocated solely for the storage of information. Data Execution Prevention (DEP) does exactly that, substantially reducing the range of memory that malicious code can use for its benefit. DEP uses the **No execute** bit on modern CPUs to mark blocks of memory as read only so that malware can’t use those blocks to execute malicious code. All Windows 10 and Windows 10 Mobile devices support DEP. + ### Windows heap + The heap is a location in memory that Windows uses to store dynamic application data. Microsoft continues to improve on earlier Windows heap designs by further mitigating the risk of heap exploits that an attacker could use. Windows 10 Mobile has several important improvements to the security of the heap over previous versions of Windows: + - Internal data structures that the heap uses are better protected against memory corruption. - Heap memory allocations have randomized locations and sizes, making it more difficult for an attacker to predict the location of critical memory to overwrite. Specifically, Windows 10 Mobile adds a random offset to the address of a newly allocated heap, which makes the allocation much less predictable. - Windows 10 Mobile uses “guard pages” before and after blocks of memory as tripwires. If an attacker attempts to write past a block of memory (a common technique known as a buffer overflow), the attacker will have to overwrite a guard page. Any attempt to modify a guard page is considered a memory corruption, and Windows 10 Mobile responds by instantly terminating the app. + ### Memory reservations + Microsoft reserves the lowest 64 KB of process memory for the operating system. Apps are no longer allowed to allocate that portion of the memory, which makes it more difficult for malware to overwrite critical system data structures in memory. + ### Control Flow Guard + When Windows loads applications into memory, it allocates space to those applications based on the size of the code, requested memory, and other factors. When an application begins to execute code, it calls additional code located in other memory addresses. The relationships among the code locations are well known—they are written in the code itself—but until Windows 10 Mobile, the operating system didn’t enforce the flow among these locations, giving attackers the opportunity to change the flow to meet their needs. In other words, an application exploit takes advantage of this behavior by running code that the application may not typically run. Windows 10 Mobile mitigates this kind of threat through the Control Flow Guard (CFG) feature. When a trusted application that its creator compiled to use CFG calls code, CFG verifies that the code location called is trusted for execution. If CFG doesn’t trust the location, it immediately terminates the application as a potential security risk. + You cannot configure CFG; rather, an application developer can take advantage of CFG by configuring it when he or she compiles the application. Consider asking application developers and software vendors to deliver trustworthy Windows applications compiled with CFG enabled. Of course, browsers are a key entry point for attacks; thus Microsoft Edge and other Windows features take full advantage of CFG. + ### Protected processes + In general, preventing a computer security incident is more cost-effective than repairing the damage an incident can cause. For malware in particular, most security controls are designed to prevent an attack from being initially successful. The reasoning is that if malware cannot infect the system, the system is immune to malware. + Unfortunately, no device is immune to malware. Despite all the best preventative controls, malware can eventually find a way to infect any operating system or hardware platform. So, although prevention with a defense-in-depth strategy is important, it cannot be the only type of malware control. + The key security scenario is to assume that malware is running on a system but limit what it can do. Windows 10 Mobile has security controls and design features in place to reduce compromise from existing malware infections. Protected Processes is one such feature. + With Protected Processes, Windows 10 Mobile prevents untrusted processes from interacting or tampering with those that have been specially signed. Protected Processes defines levels of trust for processes: it prevents less trusted processes from interacting with and therefore attacking more trusted processes. Windows 10 Mobile uses Protected Processes more broadly across the operating system. + ### Store for Business + Store for Business allows IT pros to find, acquire, distribute, and manage apps for their organization. The model provides flexible ways to distribute apps, depending on the size of your organization, and does not require additional infrastructure in some scenarios. + UWP apps are inherently more secure than typical applications because they are sandboxed, which restricts the app’s risk of compromise or tampering with in a way that would put the system, data, and other applications at risk. Windows Store can further reduce the likelihood that malware will infect devices by reviewing all applications that enter the Windows Store ecosystem before making them available. Store for Business extends this concept by enabling you to distribute custom LOB apps, and even some Windows Store apps, to Windows 10 Mobile devices through the same Windows Store infrastructure. + Regardless of how users acquire UWP apps, they can use them with increased confidence. UWP apps run in an AppContainer sandbox with limited privileges and capabilities. For example, the apps have no system-level access, have tightly controlled interactions with other apps, and have no access to data unless the user explicitly grants the application permission. + In addition, all UWP apps follow the security principle of least privilege. Apps receive only the minimum privileges they need to perform their legitimate tasks, so even if an attacker exploits an app, the damage the exploit can do is significantly limited and should be contained within the sandbox. Windows Store displays the exact capabilities the app requires (for example, access to the camera), along with the app’s age rating and publisher. + The Windows Store app-distribution process and the app sandboxing capabilities of Windows 10 Mobile can dramatically reduce the likelihood that users encounter malicious apps on the system. + For more information about Store for Business, see [Windows Store for Business overview](../whats-new/windows-store-for-business-overview.md). + ### App management + An enterprise typically exerts some configuration and control over the apps installed on devices. In this way, the organization accomplishes several business goals, such managing software licenses, ensuring mandatory app deployment on required devices, and preventing the installation of unacceptable apps on corporate devices. + An important component in delivering on these goals is Store for Business, which builds on the Windows Store infrastructure that Microsoft hosts and enables you to deploy Windows Store apps across your Windows 10-based devices. Store for Business is both powerful and highly flexible. It allows you to extend and customize features without having to stand up new on-premises infrastructure. It supports and integrates with your existing MDM service but doesn’t require one. (Ask your MDM service vendor about integration with Store for Business.) You can configure Store for Business for a wide variety of scenarios, including online and offline licensing and different app-distribution options. For a more detailed description of the available Store for Business scenarios, see [Windows Store for Business overview](../whats-new/windows-store-for-business-overview.md). + A web-based portal for IT pros simplifies Windows 10 Mobile app deployment. The familiar look of Windows Store was used to design the Store for Business experience. It showcases apps relevant to business use, hand-selected and sorted by category. The store can use Azure AD accounts for all users, linking them to a single, unique organizational identity. + Another key benefit is licensing. Store for Business enables you to track and manage licenses for all UWP apps. You can easily determine which users have installed specific apps, track remaining licenses left, and acquire new licenses directly through the web interface. Those new licenses are added within Store for Business and do not require complex export and import processes. As long as your clients are online and have Internet connectivity, the licensing scenario with Store for Business is a great improvement over manual licensing tasks. + Store for Business allows you to find the right apps for your users, acquire them, manage app licenses, and distribute apps to individuals. The best way to understand Store for Business is to look at the steps involved in a common scenario: delivering apps to Windows 10 Mobile users without an MDM—specifically, deploying apps to Windows 10 Mobile users. In this scenario, you identify several apps that must be on each mobile device that are currently available for free in the Windows Store (for example, a VPN app for your Dell SonicWALL solution) and some internally developed LOB apps. + ### The IT side + You begin the app deployment process by preparing the private store and the apps before your users receive their new Windows 10 Mobile devices. + First, you open [Windows Store for Business](http://go.microsoft.com/fwlink/p/?LinkId=722910) and use an Azure AD account to log in. This account is linked to the company’s unique organizational identity and must have an Azure AD tenant. In addition, the account must have Azure AD Enterprise Admin permissions if this is the first time you’re using Store for Business. You can delegate later access through permissions within Store for Business. Next, you locate and acquire any apps you want to deploy to the mobile devices, adding the apps and licenses to the organization’s inventory. + Along with existing Windows Store apps, you can use Store for Business to manage custom LOB apps that are developed for your organization. First, you grant permission for a trusted app developer to submit the apps. You and the developer submit these apps through the [Windows Dev Center](http://go.microsoft.com/fwlink/p/?LinkId=722911), and they must be digitally signed with a trusted certificate. These apps are not published to the retail Windows Store catalog and are not visible to anyone outside the organization. + You can deliver the apps through a private store within Windows Store. The next step, then, is for you to mark the app to be available in the private store, which you do through the Store for Business web portal. + Alternatively, you can choose one of two other app-distribution options in Store for Business web portal: - Assign the app to people in your organization by selecting one or more Azure AD identities - Add the app to the organization’s private store, and allow all users to discover and install it. For details about app distribution, see [Distribute apps using your private store](../manage/distribute-apps-from-your-private-store.md). + The IT process for preparing Store for Business for app deployment is shown in Figure 4. + ![figure 4](images/mobile-security-guide-figure4.png) + Figure 4. The IT process for Store for Business + For details about the process of distributing apps through Store for Business, see [Find and acquire apps](../manage/find-and-acquire-apps-overview.md). + ### The user side + After you have prepared Store for Business, the user side of the process takes over. This side of the process is designed to be user friendly, with the primary app deployment method—through Store for Business—streamlined and straightforward. This process doesn’t require an MDM system or any on-premises infrastructure. In fact, the user never sees the “for Business” label, just the familiar Windows Store. + 1. The user opens the Windows Store app on his or her Windows 10 Mobile device. + 2. The same Windows Store interface appears, with the addition of the private store you created. The private store appears as a new page, similar to Games and Music. The interface integrates the public Windows Store with the organization’s private store, which contains curated apps. + 3. The user simply selects and installs apps as usual. + If the user wants to make a private purchase of apps, music, movies, or TV shows with his or her Microsoft account, that’s an option, as well. The user pays for and owns his or her purchase, independent of the company. This flexibility enables hybrid scenarios for devices in many bring your own device environments. + ### Microsoft Edge + Windows 10 Mobile includes critical improvements designed to thwart attacks and malware. The environment is now more resistant to malware thanks to significant improvements to SmartScreen Filters. Internet browsing is a safer experience thanks to Microsoft Edge, a completely new browser. + Windows 10 Mobile includes Microsoft Edge, an entirely new web browser that goes beyond browsing with features like Reading View. Microsoft Edge is more secure than previous Microsoft web browsers in several ways: - **Microsoft Edge does not support non-Microsoft binary extensions.** Microsoft Edge supports Flash content and PDF viewing by default through built-in extensions but includes no non-Microsoft binary extensions, such as ActiveX controls or Java. - **Microsoft Edge is designed as a UWP app.** It is inherently compartmentalized and runs in an AppContainer that sandboxes the browser from the system, data, and other apps. - **Microsoft Edge simplifies security configuration tasks.** Because Microsoft Edge uses a simplified application structure and a single sandbox configuration, fewer security settings are required. In addition, Microsoft established Microsoft Edge default settings that align with security best practices, making it more secure by design. + The web browser is a critical component of any security strategy, and for good reason: it is the user’s interface to the Internet, an environment teeming with malicious sites and nefarious content. Most users cannot perform at least part of their job without a browser, and many users are completely reliant on one. This reality has made the browser the number one pathway from which malicious hackers initiate their attacks. + ## Related topics + + [Windows 10 security overview](windows-10-security-guide.md) + [Windows 10 Mobile and MDM](../manage/windows-10-mobile-and-mdm.md) + [Windows 10 and Windows 10 Mobile](../index.md) + [Windows Store for Business](http://go.microsoft.com/fwlink/p/?LinkId=722910) + [Windows Store for Business overview](../whats-new/windows-store-for-business-overview.md) -  -  diff --git a/windows/keep-secure/windows-10-security-guide.md b/windows/keep-secure/windows-10-security-guide.md index 2e8afda0f6..2c0402513c 100644 --- a/windows/keep-secure/windows-10-security-guide.md +++ b/windows/keep-secure/windows-10-security-guide.md @@ -2,28 +2,37 @@ title: Windows 10 security overview (Windows 10) description: This guide provides a detailed description of the most important security improvements in the Windows 10 operating system, with links to more detailed articles about many of its security features. ms.assetid: 4561D80B-A914-403C-A17C-3BE6FC95B59B -ms.pagetype: security -keywords: ["configure", "feature", "file encryption"] +keywords: configure, feature, file encryption ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library +ms.pagetype: security author: challum --- + # Windows 10 security overview + **Applies to** - Windows 10 + This guide provides a detailed description of the most important security improvements in the Windows 10 operating system, with links to more detailed articles about many of its security features. Wherever possible, specific recommendations are provided to help you implement and configure Windows 10 security features. + ## Introduction + Windows 10 is designed to protect against known and emerging security threats across the spectrum of attack vectors. Three broad categories of security work went into Windows 10: - [**Identity and access control**](#identity) features have been greatly expanded to both simplify and enhance the security of user authentication. These features include Windows Hello and Microsoft Passport, which better protect user identities through easy-to-deploy and easy-to-use multifactor authentication (MFA). Another new feature is Credential Guard, which uses virtualization-based security (VBS) to help protect the Windows authentication subsystems and users’ credentials. - [**Information protection**](#information) that guards information at rest, in use, and in transit. In addition to BitLocker and BitLocker To Go for protection of data at rest, Windows 10 includes file-level encryption with Enterprise Data Protection that performs data separation and containment and, when combined with Rights Management services, can keep data encrypted when it leaves the corporate network. Windows 10 can also help keep data secure by using virtual private networks (VPNs) and Internet Protocol Security. - [**Malware resistance**](#malware) includes architectural changes that can isolate critical system and security components from threats. Several new features in Windows 10 help reduce the threat of malware, including VBS, Device Guard, Microsoft Edge, and an entirely new version of Windows Defender. In addition, the many antimalware features from the Windows 8.1 operating system— including AppContainers for application sandboxing and numerous boot-protection features, such as Trusted Boot—have been carried forward and improved in Windows 10. + ## Identity and access control + Traditionally, access control is a process that has three components: - **Identification** - when a user asserts a unique identity to the computer system for the purpose of gaining access to a resource, such as a file or a printer. In some definitions, the user is called the subject and the resource is the object. - **Authentication** - the process of proving the asserted identity and verification that the subject is indeed *the* subject. - **Authorization** - performed by the system to compare the authenticated subject’s access rights against the object’s permissions and either allow or deny the requested access. + The way these components are implemented makes the difference in stopping attackers from accessing secret data. Only a user who proves his or her identity – and is authorized to access that data – will access it. But in security, there are varying degrees of identity proof and many different requirements for authorization limits. The access control flexibility needed in most corporate environments presents a challenge for any operating system. Table 1 lists typical Windows access control challenges and the Windows 10 solutions. + Table 1. Windows 10 solutions to typical access control challenges @@ -63,40 +72,73 @@ Table 1. Windows 10 solutions to typical access control challenges
      The sections that follow describe these challenges and solutions in more detail. + **Microsoft Passport** + Microsoft Passport provides strong two-factor authentication (2FA), fully integrated into Windows, and replaces passwords with the combination of an enrolled device and either a PIN or Windows Hello. Microsoft Passport is conceptually similar to smart cards but more flexible. Authentication is performed by using an asymmetric key pair instead of a string comparison (for example, password), and the user’s key material can be secured by using hardware. Unlike smart cards, Microsoft Passport does not require the extra infrastructure components required for smart card deployment. In particular, you do not need public key infrastructure (PKI). If you already use PKI – for example, in secure email or VPN authentication – you can use the existing infrastructure with Microsoft Passport. Microsoft Passport combines the major advantages of smart card technology – deployment flexibility for virtual smart cards and robust security for physical smart cards – without any of their drawbacks. + Microsoft Passport offers three significant advantages over the current state of Windows authentication: It’s more flexible, it’s based on industry standards, and it effectively mitigates risks. The sections that follow look at each of these advantages in more detail. + **It’s flexible** + Microsoft Passport offers unprecedented flexibility. Although the format and use of passwords and smart cards is fixed, Microsoft Passport gives both administrators and users options to manage authentication. First and foremost, Microsoft Passport works with biometric sensors and PINs. Next, you can use your PC or even your phone as one of the factors to authenticate on your PC. Finally, your user credentials can come from your PKI infrastructure, or Windows can create the credential itself. + Microsoft Passport gives you options beyond long, complex passwords. Instead of requiring users to memorize and retype frequently-changed passwords, Microsoft Passport enables PIN- and biometrics-based authentication through Windows Hello to securely identify users. + With Microsoft Passport, you gain flexibility in the data center, too. To deploy it, you must add Windows Server 2016 domain controllers to your Active Directory environment, but you do not have to replace or remove your existing Active Directory servers: Microsoft Passport builds on and adds to your existing infrastructure. You can either add on premises servers or use Microsoft Azure Active Directory to deploy Microsoft Passport to your network. The choice of which users to enable for Microsoft Passport use is completely up to you – you choose which items to protect and which authentication factors you want to support. This flexibility makes it easy to use Microsoft Passport to supplement existing smart card or token deployments by adding 2FA to users who do not currently have it, or to deploy Microsoft Passport in scenarios that call for extra protection for sensitive resources or systems. + **It’s standardized** + Both software vendors and enterprise customers have come to realize that proprietary identity and authentication systems are a dead end: The future lies with open, interoperable systems that allow secure authentication across a variety of devices, line of business (LOB) apps, and external applications and websites. To this end, a group of industry players formed FIDO, the Fast IDentity Online Alliance. The FIDO Alliance is a nonprofit organization intended to address the lack of interoperability among strong authentication devices, as well as the problems users face when they need to create and remember multiple user names and passwords. The FIDO Alliance plans to change the nature of authentication by developing specifications that define an open, scalable, interoperable set of mechanisms that supplant reliance on passwords to securely authenticate users of online services. This new standard for security devices and browser plug ins will allow any website or cloud application to interface with a broad variety of existing and future FIDO-enabled devices that the user has for online security. + In 2014, Microsoft joined the board of the [FIDO Alliance](http://go.microsoft.com/fwlink/p/?LinkId=626934). FIDO standards enable a universal framework that a global ecosystem delivers for a consistent and greatly improved user experience of strong password-less authentication. The FIDO 1.0 specifications, published in December 2014, provide for two types of authentications: password-less (known as UAF) and second factor (U2F). The FIDO Alliance is working on a set of 2.0 proposals that incorporate the best ideas from its U2F and UAF FIDO 1.0 standards, and of course, on new ideas. Microsoft has contributed Microsoft Passport technology to the FIDO 2.0 specification workgroup for review and feedback and continues to work with the FIDO Alliance as the FIDO 2.0 specification moves forward. Interoperability of FIDO products is a hallmark of FIDO authentication. Microsoft believes that bringing a FIDO solution to market will help solve a critical need for enterprises and consumers alike. + **It’s effective** + Microsoft Passport effectively mitigates two major security risks. First, it eliminates the use of passwords for logon and so reduces the risk that a nefarious attacker will steal and reuse the user’s credentials. User key material is generated and available within the Trusted Platform Module (TPM) of the user device, which protects it from attackers who want to capture the key material and reuse it. Second, because Microsoft Passport uses asymmetrical key pairs, users credentials can’t be stolen in cases where the identity provider or websites the user accesses have been compromised. + To compromise a Microsoft Passport credential that TPM protects, an attacker must have access to the physical device, and then must find a way to spoof the user’s biometrics or guess his or her PIN—and all of this must be done before TPM anti-hammer capabilities lock the device. This sets the bar magnitudes of order higher than password phishing attacks. + ### + **Windows Hello** + Windows Hello is the name given to the new biometric sign-in option for Microsoft Passport. Because biometric authentication is built directly into the operating system, Windows Hello allows users to unlock their devices by using their face or fingerprint. From here, authentication to the devices and resources is enabled through a combination of the user’s unique biometric identifier and the device itself. + The user’s biometric data that is used for Windows Hello is considered a local gesture and consequently doesn’t roam among a user’s devices and is not centrally stored. The biometric image of the user the sensor takes is converted into an algorithmic form that cannot be converted back into the original image that the sensor took. Devices that have TPM 2.0 encrypt the biometric data in a form that makes it unreadable if the data is ever removed from the device. If multiple users share a device, each user will be able to enroll and use Windows Hello for his or her Windows profile. + Windows Hello supports two biometric sensor options that are suitable for enterprise scenarios: + - **Facial recognition** uses special infrared cameras to reliably tell the difference between a photograph or scan and a living person. Several vendors are shipping external cameras that incorporate this technology, and major manufacturers are already shipping integrated devices with facial-recognition technology. - **Fingerprint recognition** uses a fingerprint sensor to scan the user’s fingerprint. Although fingerprint readers have been available for computers running Windows for years, the detection, antispoofing, and recognition algorithms in Windows 10 are more advanced than previous Windows versions. Most existing fingerprint readers (whether external or integrated into laptops or USB keyboards) can be used with Windows Hello. -Windows Hello offers several major benefits. First, it addresses the problems of credential theft and sharing, because an attacker must obtain the device and impersonate the user’s biometric identity, which is more difficult than stealing a password or PIN. Second, the use of biometrics gives users an authenticator that’s always with them – there’s nothing to forget, lose, or leave behind. Instead of worrying about memorizing long, complex passwords, users can take advantage of a convenient, secure method for logging in to all their Windows devices. Finally, there’s nothing additional to deploy or manage. Because Windows Hello support is built directly into the operating system, there are no additional drivers to deploy. + +Windows Hello offers several major benefits. First, it addresses the problems of credential theft and sharing, because an attacker must obtain the device and impersonate the user’s biometric identity, which is more difficult than stealing a password or PIN. Second, the use of biometrics gives users an authenticator that’s always with them – there’s nothing to forget, lose, or leave behind. Instead of worrying about memorizing long, complex passwords, users can take advantage of a convenient, secure method for logging in to all their Windows devices. Finally, there’s nothing additional to deploy or manage. Because Windows Hello support is built directly into the operating system, +there are no additional drivers to deploy. + **Brute-force attack resistance** + A brute-force attack is the process used to break into a device simply by guessing a user’s password, PIN, or even his or her biometric identity over and over until the attacker gets it right. Over the last several versions of Windows, Microsoft has added features that dramatically reduce the chances that such an attack would succeed. + The Windows 7 operating system and previous versions defended against brute-force attacks in a straightforward way: they slowed or prevented additional guesses after multiple mistakes. When users use a full password to log on, Windows forces users to wait several seconds between attempts if they type their password incorrectly multiple times. You can even choose to have Windows lock out an account for a period of time when it detects a brute-force attack. Windows 8.1 and Windows 10 support an even more powerful – but optional – form of brute-force protection when the credentials are tied to TPM. If the operating system detects a brute-force attack against the Windows sign-in and BitLocker protects the system drive, Windows can automatically restart the device and put it in BitLocker recovery mode until someone enters a recovery key password. This password is a virtually unguessable 48-character recovery code that must be used before Windows will be able to start normally. + If you’re interested in learning how to configure brute-force protection, use a test Windows 10 PC on which BitLocker protection is enabled for the system drive, and then print the BitLocker recovery key to ensure that you have it available. Then, open the Local Group Policy Editor by running **gpedit.msc**, and go to Computer Configuration\\Windows Settings\\Security Settings\\Security Options. Open the policy **Interactive Login: Machine Account Lockout Threshold**, and set the value to **5**, as shown in Figure 1. + ![figure 1](images/security-fig1-invalidaccess.png) + Figure 1. Set the number of invalid access attempts prior to lockout + Now, your PC is configured with brute-force protection. Restart your PC. When prompted to log on, mistype your password until the PC restarts. Now, try to guess the 48-character recovery key. You will be glad you printed it out beforehand. + ## Information protection + When users travel, their organization’s confidential data goes with them. Wherever confidential data is stored, it must be protected against unauthorized access. Windows has a long history of providing at-rest data-protection solutions that guard against nefarious attackers, beginning with the Encrypting File System in the Windows 2000 operating system. More recently, BitLocker has provided encryption for full drives and portable drives; in Windows 10, BitLocker will even protect individual files, with data loss prevention capabilities. Windows consistently improves data protection by improving existing options and by providing new strategies. + Table 2 lists specific data-protection concerns and how they are addressed in Windows 10 and Windows 7. + Table 2. Data Protection in Windows 10 and Windows 7 + @@ -147,20 +189,29 @@ Table 2. Data Protection in Windows 10 and Windows 7
      The sections that follow describe these improvements in more detail. + **Prepare for drive and file encryption** + The best type of security measures are transparent to the user during implementation and use. Every time there is a possible delay or difficulty because of a security feature, there is strong likelihood that users will try to bypass security. This situation is especially true for data protection, and that’s a scenario that organizations need to avoid. Whether you’re planning to encrypt entire volumes, removable devices, or individual files, Windows 10 meets your needs by providing streamlined, usable solutions. In fact, you can take several steps in advance to prepare for data encryption and make the deployment quick and smooth. + **TPM pre-provisioning** + In Windows 7, preparing the TPM for use offered a couple of challenges: - You can turn on the TPM in the BIOS, which requires someone to either go into the BIOS settings to turn it on or to install a driver to turn it on from within Windows. - When you enable the TPM, it may require one or more restarts. Basically, it was a big hassle. If IT staff were provisioning new PCs, they could handle all of this, but if you wanted to add BitLocker to devices that were already in users’ hands, those users would have struggled with the technical challenges and would either call IT for support or simply leave BitLocker disabled. Microsoft includes instrumentation in Windows 10 that enables the operating system to fully manage the TPM. There is no need to go into the BIOS, and all scenarios that required a restart have been eliminated. + **Deploy hard drive encryption** + BitLocker is capable of encrypting entire hard drives, including both system and data drives. BitLocker pre-provisioning can drastically reduce the time required to provision new PCs with BitLocker enabled. With Windows 10, administrators can turn on BitLocker and the TPM from within the Windows Preinstallation Environment before they install Windows or as part of an automated deployment task sequence without any user interaction. Combined with Used Disk Space Only encryption and a mostly empty drive (because Windows is not yet installed), it takes only a few seconds to enable BitLocker. With earlier versions of Windows, administrators had to enable BitLocker after Windows had been installed. Although this process could be automated, BitLocker would need to encrypt the entire drive, a process that could take anywhere from several hours to more than a day depending on drive size and performance, which significantly delayed deployment. Microsoft has improved this process through multiple features in Windows 10. + **Device encryption** + Beginning in Windows 8.1, Windows automatically enables BitLocker device encryption on devices that support InstantGo. With Windows 10, Microsoft offers device encryption support on a much broader range of devices, including those that are InstantGo. Microsoft expects that most devices in the future will pass the testing requirements, which makes device encryption pervasive across modern Windows devices. Device encryption further protects the system by transparently implementing device-wide data encryption. + Unlike a standard BitLocker implementation, device encryption is enabled automatically so that the device is always protected. The following list outlines how this happens: - When a clean installation of Windows 10 is completed and the out-of-box experience is finished, the computer is prepared for first use. As part of this preparation, device encryption is initialized on the operating system drive and fixed data drives on the computer with a clear key (this is the equivalent of standard BitLocker suspended state). - If the device is not domain joined, a Microsoft account that has been granted administrative privileges on the device is required. When the administrator uses a Microsoft account to sign in, the clear key is removed, a recovery key is uploaded to the online Microsoft account, and a TPM protector is created. Should a device require the recovery key, the user will be guided to use an alternate device and navigate to a recovery key access URL to retrieve the recovery key by using his or her Microsoft account credentials. @@ -171,25 +222,36 @@ Microsoft recommends that device encryption be enabled on any systems that suppo - **Value**: PreventDeviceEncryption equal to True (1) - **Type**: REG\_DWORD Administrators can manage domain-joined devices that have device encryption enabled through Microsoft BitLocker Administration and Monitoring (MBAM). In this case, device encryption automatically makes additional BitLocker options available. No conversion or encryption is required, and MBAM can manage the full BitLocker policy set if any configuration changes are required. + **Used Disk Space Only encryption** + BitLocker in earlier Windows versions could take a long time to encrypt a drive, because it encrypted every byte on the volume (including parts that did not have data). That is still the most secure way to encrypt a drive, especially if a drive has previously contained confidential data that has since been moved or deleted, in which case traces of the confidential data could remain on portions of the drive marked as unused. But why encrypt a new drive when you can simply encrypt the data as it is being written? To reduce encryption time, BitLocker in Windows 10 lets users choose to encrypt just their data. Depending on the amount of data on the drive, this option can reduce encryption time by more than 99 percent. Exercise caution when encrypting only used space on an existing volume on which confidential data may have already been stored in an unencrypted state, however, because those sectors can be recovered through disk-recovery tools until they are overwritten by new encrypted data. In contrast, encrypting only used space on a brand-new volume can significantly decrease deployment time without the security risk because all new data will be encrypted as it is written to the disk. + **Encrypted hard drive support** + SEDs have been available for years, but Microsoft couldn’t support their use with some earlier versions of Windows because the drives lacked important key management features. Microsoft worked with storage vendors to improve the hardware capabilities, and now BitLocker supports the next generation of SEDs, which are called encrypted hard drives. Encrypted hard drives provide onboard cryptographic capabilities to encrypt data on drives, which improves both drive and system performance by offloading cryptographic calculations from the PC’s processor to the drive itself and rapidly encrypting the drive by using dedicated, purpose-built hardware. If you plan to use whole-drive encryption with Windows 10, Microsoft recommends that you investigate hard drive manufacturers and models to determine whether any of their encrypted hard drives meet your security and budget requirements. For more information about encrypted hard drives, see [Encrypted Hard Drive](http://go.microsoft.com/fwlink/p/?LinkId=733880). + **Preboot information protection** + An effective information protection implementation, like most security controls, considers usability as well as security. Users typically prefer a simple security experience. In fact, the more transparent a security solution becomes, the more likely users are to conform to it. It is crucial that organizations protect information on their PCs regardless of the state of the computer or the intent of users. This protection should not be cumbersome to users. One undesirable and previously commonplace situation is when the user is prompted for input during preboot, and then again during Windows logon. Challenging users for input more than once should be avoided. Windows 10 can enable a true SSO experience from the preboot environment on modern devices and in some cases even on older devices when robust information protection configurations are in place. The TPM in isolation is able to securely protect the BitLocker encryption key while it is at rest, and it can securely unlock the operating system drive. When the key is in use and thus in memory, a combination of hardware and Windows capabilities can secure the key and prevent unauthorized access through cold-boot attacks. Although other countermeasures like PIN-based unlock are available, they are not as user-friendly; depending on the devices’ configuration they may not offer additional security when it comes to key protection. For more information about how to configure BitLocker for SSO, see [BitLocker Countermeasures](bitlocker-countermeasures.md). + **Manage passwords and PINs** + When BitLocker is enabled on a system drive and the PC has a TPM, you can choose to require that users type a PIN before BitLocker will unlock the drive. Such a PIN requirement can prevent an attacker who has physical access to a PC from even getting to the Windows logon, which makes it virtually impossible for the attacker to access or modify user data and system files. Requiring a PIN at startup is a useful security feature because it acts as a second authentication factor (a second “something you know”). This configuration comes with some costs, however. One of the most significant is the need to change the PIN regularly. In enterprises that used BitLocker with Windows 7 and the Windows Vista operating system, users had to contact systems administrators to update their BitLocker PIN or password. This requirement not only increased management costs but made users less willing to change their BitLocker PIN or password on a regular basis. Windows 10 users can update their BitLocker PINs and passwords themselves, without administrator credentials. Not only will this feature reduce support costs, but it could improve security, too, because it encourages users to change their PINs and passwords more often. In addition, InstantGo devices do not require a PIN for startup: They are designed to start infrequently and have other mitigations in place that further reduce the attack surface of the system. For more information about how startup security works and the countermeasures that Windows 10 provides, see [Protect BitLocker from pre-boot attacks](protect-bitlocker-from-pre-boot-attacks.md). + **Configure Network Unlock** + Some organizations have location-specific data security requirements. This is most common in environments where high-value data is stored on PCs. The network environment may provide crucial data protection and enforce mandatory authentication; therefore, policy states that those PCs should not leave the building or be disconnected from the corporate network. Safeguards like physical security locks and geofencing may help enforce this policy as reactive controls. Beyond these, a proactive security control that grants data access only when the PC is connected to the corporate network is necessary. + Network Unlock enables BitLocker-protected PCs to start automatically when connected to a wired corporate network on which Windows Deployment Services runs. Anytime the PC is not connected to the corporate network, a user must type a PIN to unlock the drive (if PIN-based unlock is enabled). Network Unlock requires the following infrastructure: - Client PCs that have Unified Extensible Firmware Interface (UEFI) firmware version 2.3.1 or later, which supports Dynamic Host Configuration Protocol (DHCP) @@ -209,12 +271,19 @@ Part of the Microsoft Desktop Optimization Pack, MBAM makes it easier to manage - Integrates with existing management tools, such as System Center Configuration Manager. - Offers an IT-customizable recovery user experience. - Supports Windows 10. + For more information about MBAM, including how to obtain it, see [Microsoft BitLocker Administration and Monitoring](http://go.microsoft.com/fwlink/p/?LinkId=626935) on the MDOP TechCenter. + ## Malware resistance + In movies, security threats always seem to be initiated by a nefarious hacker sitting in front of a monitor with green text scrolling across it. In the real world, the vast majority of security threats occur without any human interaction at all. Just as software has automated so much of our lives, malware has automated attacks on our PCs. Those attacks are relentless. Malware is constantly changing, and when it infects a PC, it can in some cases be extremely difficult to detect and remove. + Prevention is the best bet, and Windows 10 provides strong malware resistance because it takes advantage of secure hardware, which secures the startup process, the core operating system architecture, and the desktop. + Table 3 lists specific malware threats and the mitigation that Windows 10 provides. + Table 3. Threats and Windows 10 mitigations + @@ -262,50 +331,72 @@ Table 3. Threats and Windows 10 mitigations
      The sections that follow describe these improvements in more detail. + **SMB hardening improvements for SYSVOL and NETLOGON connections** + In Windows 10 and Windows Server 2016 Technical Preview, client connections to the Active Directory Domain Services default SYSVOL and NETLOGON shares on domain controllers now require Server Message Block (SMB) signing and mutual authentication (such as Kerberos). - **What value does this change add?** This change reduces the likelihood of man-in-the-middle attacks. - **What works differently?** If SMB signing and mutual authentication are unavailable, a Windows 10 or Windows Server 2016 computer won’t process domain-based Group Policy and scripts. > **Note:** The registry values for these settings aren’t present by default, but the hardening rules still apply until overridden by Group Policy or other registry values. + For more information on these security improvements, (also referred to as UNC hardening), see [Microsoft Knowledge Base article 3000483](http://go.microsoft.com/fwlink/p/?LinkId=789216) and [MS15-011 & MS15-014: Hardening Group Policy](http://go.microsoft.com/fwlink/p/?LinkId=789215). **Secure hardware** + Although Windows 10 is designed to run on almost any hardware capable of running Windows 8, Windows 7, or Windows Vista, taking full advantage of Windows 10 security requires advancements in hardware-based security, including UEFI with Secure Boot, CPU virtualization features (for example, Intel VT-x), CPU memory-protection features (for example, Intel VT-d), TPM, and biometric sensors. + **UEFI with Secure Boot** + When a PC starts, it begins the process of loading the operating system by locating the bootloader on the PC’s hard drive. Without safeguards in place, the PC may simply hand control over to the bootloader without even determining whether it is a trusted operating system or malware. + UEFI is a standards-based solution that offers a modern-day replacement for the BIOS. In fact, it provides the same functionality as BIOS while adding security features and other advanced capabilities. Like BIOS, UEFI initializes devices, but UEFI components with the Secure Boot feature (version 2.3.1 or later) also ensure that only trusted firmware in Option ROMs, UEFI apps, and operating system bootloaders can start on the device. UEFI can run internal integrity checks that verify the firmware’s digital signature before running it. Because only the PC’s hardware manufacturer has access to the digital certificate required to create a valid firmware signature, UEFI has protection from firmware bootkits. Thus, UEFI is the first link in the chain of trust. + UEFI with Secure Boot became a hardware requirement starting with Windows 8 devices. If a PC supports UEFI, it must be enabled by default. It is possible to disable the Secure Boot feature on many devices, but Microsoft strongly discourages doing so because it dramatically reduces the security of the startup process. + When a PC with UEFI and Secure Boot starts, the UEFI firmware verifies the bootloader’s digital signature to verify that it has not been modified after it was digitally signed. The firmware also verifies that a trusted authority issued the bootloader’s digital signature. This check helps to ensure that the system starts only after checking that the bootloader is both trusted and unmodified since signing. + All Windows 8 certified PCs must meet several requirements related to Secure Boot: - They must have Secure Boot enabled by default. - They must trust Microsoft’s certification authority (CA) and thus any bootloader Microsoft has signed. - They must allow the user to add signatures and hashes to the UEFI database. - They must allow the user to completely disable Secure Boot (although administrators can restrict this). + This behavior doesn’t limit the choice of operating system. In fact, users typically have three options for running non-Microsoft operating systems: -- **Use an operating system with a Microsoft-signed bootloader.** Microsoft offers a service to sign non-Microsoft bootloaders so that they can be used on the device. In this case, a signature from the Microsoft third-party UEFI CA is used to sign the non-Microsoft bootloader, and the signature itself is added to the UEFI database. Several non-Microsoft operating systems, including several varieties of Linux, have had their bootloaders signed by Microsoft so that they can take advantage of the Secure Boot capability. For more information about the Microsoft third-party UEFI signing policy, read [Microsoft UEFI CA Signing policy updates](http://go.microsoft.com/fwlink/p/?LinkId=626936) and [Pre-submission testing for UEFI submissions](http://go.microsoft.com/fwlink/p/?LinkId=626937). +- **Use an operating system with a Microsoft-signed bootloader.** Microsoft offers a service to sign non-Microsoft bootloaders so that they can be used on the device. In this case, a signature from the Microsoft third-party UEFI +CA is used to sign the non-Microsoft bootloader, and the signature itself is added to the UEFI database. Several non-Microsoft operating systems, including several varieties of Linux, have had their bootloaders signed by Microsoft so that they can take advantage of the Secure Boot capability. For more information about the Microsoft third-party UEFI signing policy, read [Microsoft UEFI CA Signing policy updates](http://go.microsoft.com/fwlink/p/?LinkId=626936) and [Pre-submission testing for UEFI submissions](http://go.microsoft.com/fwlink/p/?LinkId=626937). + **Note**   PCs configured to use Device Guard boot only a secured version of Windows and do not permit a third-party bootloader. For more information, see the [Device Guard](#device-guard) section of this document.   - **Configure UEFI to trust a non–Microsoft-signed bootloader or hashes.** Some Certified For Windows 8 or later PCs allow users to add noncertified bootloaders through a signature or hashes sent to the UEFI database, which allows them to run any operating system without Microsoft signing it. - **Turn off Secure Boot.**Windows 8 certified PCs allow users to turn off Secure Boot so they can run unsigned operating systems. In this mode, the behavior is identical to PCs that have BIOS: The PC simply runs the bootloader without any verification. Microsoft strongly recommends that Secure Boot remain enabled whenever the device starts so that it can help prevent bootkit infections. + **Note**   With Windows 10, original equipment manufacturers (OEMs) have the ability to ship built-to-order PCs that lock down UEFI Secure Boot so that it cannot be disabled and allows only the operating system of the customer’s choice to start on the device.   Windows, apps, and even malware cannot change the UEFI configuration. Instead, users must be physically present to manually boot a PC into a UEFI shell, and then change UEFI firmware settings. For more information about UEFI Secure Boot, read [Protecting the pre-OS environment with UEFI](http://go.microsoft.com/fwlink/p/?LinkId=626938). **Virtualization-based security** + One of the most powerful changes to Windows 10 is virtual-based security. Virtual-based security (VBS) takes advantage of advances in PC virtualization to change the game when it comes to protecting system components from compromise. VBS is able to isolate some of the most sensitive security components of Windows 10. These security components aren’t just isolated through application programming interface (API) restrictions or a middle-layer: They actually run in a different virtual environment and are isolated from the Windows 10 operating system itself. + VBS and the isolation it provides is accomplished through the novel use of the Hyper V hypervisor. In this case, instead of running other operating systems on top of the hypervisor as virtual guests, the hypervisor supports running the VBS environment in parallel with Windows and enforces a tightly limited set of interactions and access between the environments. + Think of the VBS environment as a miniature operating system: It has its own kernel and processes. Unlike Windows, however, the VBS environment runs a micro-kernel and only two processes called trustlets: - **Local Security Authority (LSA)** enforces Windows authentication and authorization policies. LSA is a well-known security component that has been part of Windows since 1993. Sensitive portions of LSA are isolated within the VBS environment and are protected by a new feature called Credential Guard. - **Hypervisor-enforced code integrity** verifies the integrity of kernel-mode code prior to execution. This is a part of the [Device Guard](#device-guard) feature described later in this document. VBS provides two major improvements in Windows 10 security: a new trust boundary between key Windows system components and a secure execution environment within which they run. A trust boundary between key Windows system components is enabled though the VBS environment’s use of platform virtualization to isolate the VBS environment from the Windows operating system. Running the VBS environment and Windows operating system as guests on top of Hyper-V and the processor’s virtualization extensions inherently prevents the guests from interacting with each other outside the limited and highly structured communication channels between the trustlets within the VBS environment and Windows operating system. + VBS acts as a secure execution environment because the architecture inherently prevents processes that run within the Windows environment – even those that have full system privileges – from accessing the kernel, trustlets, or any allocated memory within the VBS environment. In addition, the VBS environment uses TPM 2.0 to protect any data that is persisted to disk. Similarly, a user who has access to the physical disk is unable to access the data in an unencrypted form. + The VBS architecture is illustrated in Figure 2. + ![figure 2](images/security-fig2-vbsarchitecture.png) + Figure 2. The VBS architecture + Note that VBS requires a system that includes: - Windows 10 Enterprise Edition - A-64-bit processor @@ -314,16 +405,22 @@ Note that VBS requires a system that includes: - Virtualization extensions (for example, Intel VT-x, AMD RVI) - I/O memory management unit (IOMMU) chipset virtualization (Intel VT-d or AMD-Vi) - TPM 2.0 + **Trusted Platform Module** + A TPM is a tamper-resistant cryptographic module designed to enhance the security and privacy of computing platforms. The TPM is incorporated as a component in a trusted computing platform like a personal computer, tablet, or phone. The computing platform is specially designed to work with the TPM to support privacy and security scenarios that cannot be achieved through software alone. A proper implementation of a TPM as part of a trusted computing platform provides a hardware root of trust, meaning that the hardware behaves in a trusted way. For example, a key created in a TPM with the property that it can never be exported from the TPM really means the key cannot leave the TPM. The close integration of a TPM with a platform increases the transparency of the boot process and supports device health scenarios by enabling reliable report of the software used to start a platform. The functionality a TPM provides includes: - **Cryptographic key management.** Create, store, and permit the use of keys in defined ways. - **Safeguarding and reporting integrity measurements.** Software used to boot the platform can be recorded in the TPM and used to establish trust in the software running on the platform. - **Prove a TPM is really a TPM.** The TPM’s capabilities are so central to protecting privacy and security that a TPM needs to be able to differentiate itself from malware that masquerades as a TPM. + Microsoft combined this small list of TPM benefits with Windows 10 and other hardware security technologies to provide practical security and privacy benefits. + Among other functions, Windows 10 uses the TPM to protect the encryption keys for BitLocker volumes, virtual smart cards, certificates, and the many other keys that the TPM is used to generate. Windows 10 also uses the TPM to securely record and protect integrity-related measurements of select hardware and Windows boot components for the [Measured Boot](#measure-boot) feature described later in this document. In this scenario, Measured Boot measures each component, from firmware up through the drivers, and then stores those measurements in the PC’s TPM. From there, you can test the measurement log remotely so that a separate system verifies the boot state of the Windows 10 PC. Windows 10 supports TPM implementations that comply with either the 1.2 or 2.0 standards. Several improvements have been made in the TPM 2.0 standard, the most notable of which is cryptographic agility. TPM 1.2 is restricted to a fixed set of encryption and hash algorithms. At the time the TPM 1.2 standard was created in the early 2000s, these algorithms were considered cryptographically strong. Since that time, advances in cryptographic algorithms and cryptanalysis attacks have increased expectations for stronger cryptography. TPM 2.0 supports additional algorithms that offer stronger cryptographic protection as well as the ability to plug in algorithms that may be preferred in certain geographies or industries. It also opens the possibility for inclusion of future algorithms without changing the TPM component itself. + TPM is usually assumed to be implanted in hardware on a motherboard as a discrete module, but TPM can also be effective when implemented in firmware. Windows 10 supports both discrete and firmware TPM that complies with the 2.0 standard (1.2 can only be discrete). Windows does not differentiate between discrete and firmware-based solutions because they must meet the same requirements; therefore, any Windows feature that can take advantage of TPM can use either implementation. + **Note**   Microsoft will not initially require new Windows 10 PCs to include TPM support. Microsoft will require systems to include a TPM 2.0 beginning one year from the launch of Windows 10, however, to give manufacturers enough time to incorporate this critical functionality and to give IT pros enough time to determine which benefits they will leverage.   @@ -332,33 +429,53 @@ Several Windows 10 security features require TPM: - Measured Boot - Health attestation (requires TPM 2.0 or later) - InstantGo (requires TPM 2.0 or later) + Other Windows 10 security features like BitLocker may take advantage of TPM if it is available but do not require it to work. An example of this is Microsoft Passport. + All of these features are covered in this document. + **Biometrics** + You read in the [Windows Hello](#windows-hello) section of this document that Windows 10 has built-in support for biometric hardware. Windows has included some amount of built-in biometric support since the Windows XP operating system, so what’s different about this in Windows 10? Windows 10 makes biometrics a core security feature. Biometrics is fully integrated into the Windows 10 security components, not just tacked on as an extra part of a larger scheme. This is a big change. Earlier biometric implementations were largely front-end methods to simplify authentication. Under the hood, biometrics was used to access a password, which was then used for authentication behind the scenes. Biometrics may have provided convenience but not necessarily enterprise-grade authentication. Microsoft has evangelized the importance of enterprise-grade biometric sensors to the OEMs that create Windows PCs and peripherals. Many OEMs already ship systems that have integrated fingerprint sensors and are transitioning from swipe-based to touch-based sensors. Facial-recognition sensors were already available when Windows 10 launched and are becoming more commonplace as integrated system components. In the future, Microsoft expects OEMs to produce even more enterprise-grade biometric sensors and to continue to integrate them into systems as well as provide separate peripherals. As a result, biometrics will become a commonplace authentication method as part of an MFA system. + **Secure Windows startup** + UEFI Secure Boot uses hardware technologies to help protect users from bootkits. Secure Boot can validate the integrity of the devices, firmware, and bootloader. After the bootloader launches, users must rely on the operating system to protect the integrity of the remainder of the system. + **Trusted Boot** + When UEFI Secure Boot verifies that the bootloader is trusted and starts Windows, the Windows Trusted Boot feature protects the rest of the startup process by verifying that all Windows startup components are trustworthy (for example, signed by a trusted source) and have integrity. The bootloader verifies the digital signature of the Windows kernel before loading it. The Windows kernel, in turn, verifies every other component of the Windows startup process, including the boot drivers, startup files, and ELAM component. If a file has been modified (for example, if malware has tampered with it or it has been corrupted), Trusted Boot will detect the problem and automatically repair the corrupted component. When repaired, Windows will start normally after only a brief delay. + **Early Launch Antimalware** + Malware that targeted previous versions of Windows often attempted to start before the antimalware solution. To do this, some types of malware would update or replace a non-Microsoft–related driver that starts during the Windows startup process. The malicious driver would then use its system access privileges to modify critical parts of the system and disguise its presence so it could not be detected when the antimalware solution later started. Early Launch Antimalware (ELAM) is part of the Trusted Boot feature set and is designed to enable the antimalware solution to start before all non-Microsoft drivers and apps. ELAM checks the integrity of non-Microsoft drivers to determine whether the drivers are trustworthy. Because Windows needs to start as fast as possible, ELAM cannot be a complicated process of checking the driver files against known malware signatures; doing so would delay startup too much. Instead, ELAM has the simple task of examining every boot driver and determining whether it is on the list of trusted drivers. If malware modifies a boot-related driver, ELAM will detect the change, and Windows will prevent the driver from starting, thus blocking driver-based rootkits. ELAM also allows the registered antimalware provider to scan drivers that are loaded after the boot process is complete. The design is simple but effective. ELAM is a component of a full-featured antimalware solution, and it helps prevent malicious drivers and apps from starting before the rest of the antimalware solution starts later during the boot process. Indeed, ELAM runs only for a few seconds each time a PC starts. Windows Defender in Windows 10 supports ELAM, as does Microsoft System Center 2012 Endpoint Protection and several non-Microsoft antimalware apps. If you want to learn how to configure ELAM, you can use Group Policy settings to configure how ELAM responds to potentially malicious boot drivers. In the Group Policy Management Editor, go to Computer Configuration\\Administrative Templates\\System\\Early Launch Antimalware, and enable the **Boot-Start Driver Initialization Policy** setting. Now, you can select which driver classifications ELAM loads. When you select the **Good Only** setting, it provides the highest level of security, but test it thoroughly to ensure that it does not prevent users with healthy PCs from starting. + ### + **Measured Boot** + The biggest challenge with rootkits and bootkits in earlier versions of Windows is that they can frequently be undetectable to the client. Because they often start before Windows defenses and the antimalware solution and they have system-level privileges, rootkits and bootkits can completely disguise themselves while continuing to access system resources. Although UEFI Secure Boot and Trusted Boot can prevent most rootkits and bootkits, intruders could still potentially exploit a few attack vectors (for example, if UEFI with Secure Boot is disabled or if the signature used to sign a boot component, such as a non-Microsoft driver, has been compromised and is used to sign a malicious one). Windows 10 implements the Measured Boot feature, which uses the TPM hardware component built into newer PCs to record a series of measurements for critical startup-related components, including firmware, Windows boot components, drivers, and even the ELAM driver. Because Measured Boot leverages the hardware-based security capabilities of TPM, which isolates and protects the measurement data from malware attacks, the log data is well protected against even sophisticated attacks. + Measured Boot focuses on acquiring the measurement data and protecting it from tampering. It must be coupled with a service that can analyze the data to determine device health and provide a more complete security service. The next section introduces just such a service. + **Verify device compliance for conditional access to corporate resources** + Measured Boot itself does not prevent malware from loading during the startup process – that is the job of Secure Boot, Device Guard, and ELAM. Instead, Measured Boot provides a TPM-protected audit log that allows a trusted remote health attestation service to evaluate the PC’s startup components, state, and overall configuration. If the health attestation service detects that the PC loaded an untrustworthy component and is therefore out of compliance, the service can block the PC’s access to specific network resources or the entire network. You can even couple a health attestation service with a management system to facilitate conditional access capabilities that can initiate the quarantine and remediation processes to fix an infected PC and return it to a compliant state. + ![figure 3](images/security-fig3-healthattestation.png) + Figure 3. Health Attestation in Windows 10 + Figure 3 illustrates the following process for device compliance verification and conditional access implementation: + 1. The PC uses the TPM to record measurements of the bootloader, boot drivers, and ELAM driver. The TPM prevents anyone from tampering with these measurements, so even if malware is successfully loaded, it will not be able to modify the measurements. These measurements are signed with an Attestation Identity Key (AIK) that is stored in the TPM. Because the TPM hardware has signed the measurements, malware cannot modify them without being detected. 2. Health Attestation is not enabled by default and requires an enrollment with a mobile device management (MDM) server in order to enable it. If it is enabled, the health attestation client will contact a remote server, called a health attestation server. Microsoft provides a cloud-based Windows Health Attestation service that can help evaluate the health of a device. The health attestation client sends the signed measurements, the device’s TPM boot log, and an AIK certificate (if present), which lets the health attestation server verify that the key used to sign the measurements was issued to a trusted TPM. 3. The health attestation server analyzes the measurements and boot log and creates a statement of device health. This statement is encrypted to help ensure the confidentiality of the data. @@ -366,22 +483,35 @@ Figure 3 illustrates the following process for device compliance verification an 5. The enrolled device digitally signs the nonce with its AIK (which is stored in the TPM) and sends the MDM server the encrypted statement of device health, the digitally signed nonce, and a signed boot counter, which asserts that the device has not been restarted since it obtained the statement of health. 6. The MDM server can send the same data to the health attestation server. The server decrypts the statement of health, asserts that the boot counter in the statement matches the boot counter that was sent to the MDM server, and compiles a list of health attributes. 7. The health attestation server sends this list of health attributes back to the MDM server. The MDM server now enforces access and compliance policies if configured to do so. + For a list of data points that the health attestation server verifies, along with a description of the data, see the [HealthAttestation CSP article on MSDN](http://go.microsoft.com/fwlink/p/?LinkId=626940). The management system’s implementation determines which attributes within the statement of device health are evaluated when assessing a device’s health. Broadly speaking, the management server receives information about how the device booted, what kind of policy is enforced on the device, and how data on the device is secured. Depending on the implementation, the management server may add checks that go beyond what the statement of device health provides—for example, Windows patch level and other device attributes. Based on these data points, the management server can determine whether the client is healthy and grant it access to either a limited quarantine network or to the full network. Individual network resources, such as servers, can also grant or deny access based on whether the remote attestation client were able to retrieve a valid health certification from the remote attestation server. Because this solution can detect and prevent low-level malware that may be extremely difficult to detect any other way, Microsoft recommends that you consider the implementation of a management system, like Microsoft Intune, or any management solutions that take advantage of the Windows 10 cloud-based Health Attestation Server feature to detect and block devices that have been infected with advanced malware from network resources. + ## Secure the Windows core + Applications built for Windows are designed to be secure and free of defects, but the reality is that as long as human beings are writing code, vulnerabilities will continue to crop up. When identified, malicious users and software may attempt to exploit vulnerabilities by manipulating data in memory in the hope that they can bootstrap a successful exploit. To mitigate these risks, Windows 10 includes core improvements to make it more difficult for malware to perform buffer overflow, heap spraying, and other low-level attacks and even which code is allowed to run on the PC. In addition, these improvements dramatically reduce the likelihood that newly discovered vulnerabilities result in a successful exploit. It takes detailed knowledge of operating system architecture and malware exploit techniques to fully appreciate the impact of these improvements, but the sections that follow explain them at a high level. + ### + **Device Guard** + Today’s security threat landscape is more aggressive than ever before. Modern malicious attacks are focused on revenue generation, intellectual property theft, and targeted system degradation resulting in financial loss. Many of these nefarious attackers are sponsored by nation states that have ulterior motives and large cyber-terrorism budgets. These threats can enter a company through something as simple as an email and can permanently damage the organization’s reputation for securing employee and customer data and intellectual property, not to mention having a significant financial impact. The Windows 10 operating system introduces several new security features that help mitigate a large percentage of today’s known threats. + It is estimated that more than 300,000 new malware variants are discovered daily. Unfortunately, companies currently use an ancient method to discover this infectious software and prevent its use. In fact, current PCs trust everything that runs until antimalware signatures determine whether a threat exists; then, the antimalware software attempts to clean the PC, often after the malicious software’s effect has already occurred. This signature-based system focuses on reacting to an infection and then ensuring that that particular infection does not happen again. In this model, the system that drives malware detection relies on the discovery of malicious software; only then can a signature be provided to the client to remediate it, which implies that a computer has often already been infected. The time between detection of the malware and a client being issued a signature could mean the difference between losing data and staying safe. + In addition to antimalware solutions, “app control” or “whitelisting” technologies are available, including AppLocker. These perform single-instance or blanket allow or deny rules for running applications. In Windows 10, these types of solutions are most effective when deployed alongside the Windows 10 Device Guard feature. Device Guard breaks the current model of detection first-block later and allows only trusted applications to run, period. This methodology is consistent with the successful prevention strategy for mobile phone security. With Device Guard, Microsoft has changed how the Windows operating system handles untrusted applications, which makes its defenses difficult for malware to penetrate. This new prevention versus detection model will provide Windows clients with the necessary security for modern threats and, when implemented, mitigates many of today’s threats from day one. + **Device Guard overview** + Device Guard is a feature set that consists of both hardware and software system integrity hardening features. These features revolutionize the Windows operating system’s security by taking advantage of new VBS options to protect the system core and the processes and drivers running in kernel mode—the trust-nothing model you see in mobile device operating systems. A key feature used with Device Guard is *configurable code integrity*, which allows your organization to choose exactly which software from trusted software publishers is allowed to run code on your client machines—exactly what has made mobile phone security on some platforms, such as Windows Mobile, so successful. Trusted applications are those signed directly (in other words, binaries) or indirectly by using a signed file that lists the hash values for application binaries that are considered trustworthy. In addition, Device Guard offers organizations a way to sign existing LOB applications so that they can trust their own code without the requirement that the application be rebuilt or packaged. Also, this same method of signing can provide organizations a way to trust non-Microsoft applications, including those that may not have been signed directly. Device Guard with configurable code integrity, Credential Guard, and AppLocker present the most complete security defense that any Microsoft product has ever been able to offer a Windows client. -Advanced hardware features such as CPU virtualization extensions, IOMMUs, and SLAT drive these new client security offerings. By integrating these hardware features further into the core operating system, Windows 10 can leverage them in new ways. For example, the same type 1 hypervisor technology that is used to run virtual machines in Hyper V isolates core Windows services into a virtualization-based, protected container. This is just one example of how Windows 10 integrates advanced hardware features deeper into the operating system to offer comprehensive modern security to its users. + +Advanced hardware features such as CPU virtualization extensions, IOMMUs, and SLAT drive these new client security offerings. By integrating these hardware features further into the core operating system, Windows 10 can leverage them in new ways. For example, the same type 1 hypervisor technology that is used to run virtual machines in Hyper V isolates core Windows services into a virtualization-based, protected container. This is just one example of how +Windows 10 integrates advanced hardware features deeper into the operating system to offer comprehensive modern security to its users. + To deliver this additional security, Device Guard has the following hardware and software requirements: - UEFI Secure Boot (optionally with a non-Microsoft UEFI CA removed from the UEFI database) - Virtualization support enabled by default in the system firmware (BIOS): @@ -392,141 +522,240 @@ To deliver this additional security, Device Guard has the following hardware and - Kernel mode drivers signed and compatible with hypervisor-enforced code integrity - Windows 10 Enterprise only - X64 version of Windows + Along with these new features, some components of Device Guard are existing tools or technologies that have been included in this strategic security offering to provide customers with the most secure Windows operating system possible. Device Guard is intended as a set of client security features to be used in conjunction with the other threat-resistance features available in the Windows operating system, some of which are mentioned in this guide. + **Configurable code integrity** + The Windows operating system consists of two operating modes: user mode and kernel mode. The base of the operating system runs within the kernel mode, which is where the Windows operating system directly interfaces with hardware resources. User mode is primarily responsible for running applications and brokering information to and from the kernel mode for hardware resource requests. For example, when an application running in user mode needs additional memory, the user mode process must request the resources from the kernel, not directly from RAM. + Code integrity is the component of the Windows operating system that verifies that the code Windows is running came from a trusted source and is tamper free. Like the operating system, Windows code integrity contains two primary components: kernel mode code integrity (KMCI) and user mode code integrity (UMCI). KMCI has been used in recent versions of the Windows operating system to protect the kernel mode from executing unsigned drivers. Although effective, drivers are not the only route that malware can take to penetrate the kernel mode space of the operating system. In Windows 10, however, Microsoft has raised the requirements for kernel mode code out of the box as well as provided enterprises with a way to set their own UMCI and KMCI policies. Starting with the Code Integrity service itself and continuing through the policies a Windows client uses to verify that an application should be allowed to run, Microsoft has made Windows 10 more secure than any previous Windows release. Historically, UMCI has been available only in Windows RT and on Windows Mobile devices, which has made it difficult to infect these devices with viruses and malware. These same successful UMCI policies are available in Windows 10Windows 10. + Historically, most malware has been unsigned. Simply by deploying code integrity policies, organizations will immediately protect themselves against unsigned malware, which is estimated to be responsible for the vast majority of current attacks. By using code integrity policies, an enterprise can also select exactly which binaries are allowed to run in both user mode and kernel mode based on the signer, binary hash, or both. When completely enforced, it makes user mode in Windows function like some mobile platforms, trusting and running only specific applications or specific signatures. This feature alone fundamentally changes security in an enterprise. This additional security is *not* limited to Windows apps and does *not* require an application rewrite to be compatible with your existing and possibly unsigned applications. You can run configurable code integrity independent of Device Guard, thus making it available to devices that don’t meet Device Guard hardware requirements. + **Hardware security features and VBS** + The core functionality and protection of Device Guard starts at the hardware level. Devices that have processors equipped with SLAT technologies and virtualization extensions, such as Intel VT x and AMD V, will be able to take advantage of a VBS environment that dramatically enhances Windows security by isolating critical Windows services from the operating system itself. This isolation is necessary, because you must assume that the operating system kernel will be compromised, and you need assurance that some processes will remain secure. + Device Guard leverages VBS to isolate its Hypervisor Code Integrity (HVCI) service, which enables Device Guard to protect all kernel mode processes and drivers from vulnerability exploits and zero days. HVCI uses the processor’s IOMMU functionality to force all software running in kernel mode to safely allocate memory. This means that after memory has been allocated, its state must be changed from writable to read only or execute only. By forcing memory into these states, it helps ensure that attacks are unable to inject malicious code into kernel mode processes and drivers through techniques such as buffer overruns or heap spraying. In the end, the VBS environment protects the Device Guard HVCI service from tampering even if the operating system’s kernel has been fully compromised, and HVCI protects kernel mode processes and drivers so that a compromise of this magnitude can’t happen in the first place. Another Windows 10 feature that employs VBS is Credential Guard. Credential Guard protects credentials by running the Windows authentication service known as LSA, and then storing the user’s derived credentials (for example, NTLM hashes; Kerberos tickets) within the same VBS environment that Device Guard uses to protect its HVCI service. By isolating the LSA service and the user’s derived credentials from both user mode and kernel mode, an attacker that has compromised the operating system core will still be unable to tamper with authentication or access derived credential data. Credential Guard prevents pass-the-hash and ticket types of attacks, which are central to the success of nearly every major network breach you’ve read about, which makes Credential Guard one of the most impactful and important features to deploy within your environment. For more information about how Credential Guard complements Device Guard, see the [Device Guard with Credential Guard](#dgwithcg) section. + **Device Guard with AppLocker** + Although AppLocker is not considered a new Device Guard feature, you can use it to complement configurable code integrity functionality when enforced code integrity cannot be fully implemented or its functionality does not cover every desired scenario. There are many scenarios in which you could use code integrity policies alongside AppLocker rules. As a best practice, enforce code integrity policies at the most restrictive level possible for your organization, and then use AppLocker to fine-tune the restrictions to an even lower level. + **Note**   One example in which Device Guard functionality needs AppLocker supplementation is when your organization would like to limit which universal applications from the Windows Store users can install on a device. Microsoft has already validated universal applications from the Windows Store as trustworthy to run, but an organization may not want to allow specific universal applications to run in its environment. You could use an AppLocker rule to enforce such a stance. + In another example, you could enable a configurable code integrity policy to allow users to run all the apps from a specific publisher. To do so, you would add the publisher’s signature to the policy. If your organization decides that only specific apps from that publisher should be allowed to run, you would add the signature for the publisher to the configurable code integrity policy, and then use AppLocker to determine which specific apps can run.   AppLocker and Device Guard can run side-by-side in your organization, which offers the best of both security features at the same time and provides the most comprehensive security to as many devices as possible. In addition to these features, Microsoft recommends that you continue to maintain an enterprise antivirus solution for a well-rounded enterprise security portfolio. + ### + **Device Guard with Credential Guard** + Although Credential Guard isn’t a feature within Device Guard, many organizations will likely deploy Credential Guard alongside Device Guard for additional protection against derived credential theft. Similar to virtualization-based protection of kernel mode through the Device Guard HVCI service, Credential Guard leverages hypervisor technology to protect the Windows authentication service (the LSA) and users’ derived credentials. This mitigation is targeted at preventing the use of pass-the-hash and pass-the-ticket techniques. + Because Credential Guard uses VBS, it is decisive in its ability to prevent pass-the-hash and pass-the-ticket attacks from occurring on Windows 10 devices. Microsoft recognizes, however, that most organizations will have a blend of Windows versions running in their environments. Mitigations for devices not capable of running Credential Guard on both the client side and the server side are available to help with this scenario. Microsoft will be releasing details to TechNet regarding these additional mitigations in the near future. + **Unified manageability through Device Guard** + You can easily manage Device Guard features through the familiar enterprise and client-management tools that IT pros use every day. Use the following management tools to enable and manage Device Guard: - **Group Policy.**Windows 10 provides an administrative template that you can use to configure and deploy the configurable code integrity policies for your organization. This template also allows you to specify which hardware-based security features you would like to enable and deploy. You can manage these settings with your existing Group Policy objects, which makes it simple to implement Device Guard features. In addition to the code integrity and hardware-based security features, Group Policy can help you manage your catalog files. - **System Center Configuration Manager.** Use System Center Configuration Manager to simplify deployment and management of catalog files, code integrity policies, and hardware-based security features as well as to provide version control. - **MDM systems.** Organizations will be able to use Microsoft Intune and non-Microsoft MDM systems for deployment and management of code integrity policies and catalog files. - **Windows PowerShell.** You use Windows PowerShell primarily to create and service code integrity policies. These policies represent the most impactful component of Device Guard. These options provide the same experience you’re used to for management of your existing enterprise management solutions. + **Address Space Layout Randomization** + One of the most common techniques used to gain access to a system is to find a vulnerability in a privileged process that is already running, guess or find a location in memory where important system code and data have been placed, and then overwrite that information with a malicious payload. In the early days of operating systems, any malware that could write directly to the system memory could do such a thing; the malware would simply overwrite system memory in well-known and predictable locations. Address Space Layout Randomization (ASLR) makes that type of attack much more difficult because it randomizes how and where important data is stored in memory. With ASLR, it is more difficult for malware to find the specific location it needs to attack. Figure 4 illustrates how ASLR works by showing how the locations of different critical Windows components can change in memory between restarts. + ![image 4](images/security-fig4-aslr.png) + Figure 4. ASLR at work + Although the ASLR implementation in Windows 7 was effective, it wasn’t applied holistically across the operating system, and the level of entropy (cryptographic randomization) wasn’t always at the highest possible level. To decrease the likelihood that sophisticated attacks such as heap spraying could succeed in the Windows 8 operating system, Microsoft applied ASLR holistically across the system and increased the level of entropy many times. The ASLR implementation in Windows 8 and Windows 10 is greatly improved over Windows 7, especially with 64-bit system and application processes that can take advantage of a vastly increased memory space, which makes it even more difficult for malware to predict where Windows 10 stores vital data. When used on systems that have TPMs, ASLR memory randomization will be increasingly unique across devices, which makes it even more difficult for a successful exploit that works on one system to work reliably on another. + **Data Execution Prevention** + Malware depends on its ability to put a malicious payload into memory with the hope that it will be executed later, and ASLR will make that much more difficult. Wouldn’t it be great if you could prevent malware from running if it wrote to an area that has been allocated solely for the storage of information? + Data Execution Prevention (DEP) does exactly that, by substantially reducing the range of memory that malicious code can use for its benefit. DEP uses the No eXecute bit on modern CPUs to mark blocks of memory as read-only so that those blocks can’t be used to execute malicious code that may be inserted within through a vulnerability exploit. + Because of the importance of DEP, users cannot install Windows 10 on a computer that does not have DEP capability. Fortunately, most processors released since the mid-2000s support DEP. + If you want to see which apps use DEP, complete these steps: 1. Open Task Manager: Press Ctrl+Alt+Esc or by searching the Start screen. 2. Click **More Details** (if necessary), and then click the **Details** tab. 3. Right-click any column heading, and then click **Select Columns**. 4. In the **Select Columns** dialog box, select the last **Data Execution Prevention** check box. 5. Click **OK**. + You can now see which processes have DEP enabled. Figure 5 shows the processes running on a Windows 10 PC with a single process that does not support DEP. + ![figure 5](images/security-fig5-dep.png) + Figure 5. Processes on which DEP has been enabled in Windows 10 + **Windows Heap** + The *heap* is a location in memory that Windows uses to store dynamic application data. Windows 10 continues to improve on earlier Windows heap designs by further mitigating the risk of heap exploits that could be used as part of an attack. + Windows 10 has several important improvements to the security of the heap over Windows 7: - Internal data structures that the heap uses are now better protected against memory corruption. - Heap memory allocations now have randomized locations and sizes, which makes it more difficult for an attacker to predict the location of critical memory to overwrite. Specifically, Windows 10 adds a random offset to the address of a newly allocated heap, which makes the allocation much less predictable. - Windows 10 uses “guard pages” before and after blocks of memory as tripwires. If an attacker attempts to write past a block of memory (a common technique known as a buffer overflow), the attacker will have to overwrite a guard page. Any attempt to modify a guard page is considered a memory corruption, and Windows 10 responds by instantly terminating the app. + Windows 10 resolves known heap attacks that could be used to compromise a PC running previous versions of Windows. + **Memory reservations** + The lowest 64 KB of process memory is reserved for the system. Apps are no longer allowed to allocate that portion of the memory, which makes it more difficult for malware to overwrite critical system data structures in memory. + **Control Flow Guard** + When applications are loaded into memory, they are allocated space based on the size of the code, requested memory, and other factors. When an application begins to execute code, it calls additional code located in other memory addresses. The relationships between the code locations are well known—they are written in the code itself—but previous to Windows 10, the flow between these locations was not enforced, which gives attackers the opportunity to change the flow to meet their needs. In other words, an application exploit takes advantage of this behavior by running code that the application may not typically run. This kind of threat is mitigated in Windows 10 through the Control Flow Guard (CFG) feature. When a trusted application that was compiled to use CFG calls code, CFG verifies that the code location called is trusted for execution. If the location is not trusted, the application is immediately terminated as a potential security risk. An administrator cannot configure CFG; rather, an application developer can take advantage of CFG by configuring it when the application is compiled. Administrators should consider asking application developers and software vendors to deliver trustworthy Windows applications compiled with CFG enabled. Of course, browsers are a key entry point for attacks; thus Microsoft Edge, IE, and other Windows features take full advantage of CFG. + **Protected Processes** + Benjamin Franklin once said that "an ounce of prevention is worth a pound of cure." His wisdom directly applies to PC security. Most security controls are designed to prevent the initial infection point. The reasoning is that if malware cannot infect the system, the system is immune to malware. + No computer is immune to malware, however. Despite all the best preventative controls, malware can eventually find a way to infect any operating system or hardware platform. So, although prevention with a defense-in-depth strategy is important, it cannot be the only type of malware control. + The key security scenario is to assume that malware is running on a system but limit what it can do. Windows 10 has security controls and design features in place to reduce compromise from existing malware infections. Protected Processes is one such feature. + With Protected Processes, Windows 10 prevents untrusted processes from interacting or tampering with those that have been specially signed. Protected Processes defines levels of trust for processes. Less trusted processes are prevented from interacting with and therefore attacking more trusted processes. Windows 10 uses Protected Processes more broadly across the operating system, and for the first time, you can put antimalware solutions into the protected process space, which helps make the system and antimalware solutions less susceptible to tampering by malware that does manage to get on the system. + ## Secure the Windows desktop + Windows 10 includes critical improvements to the Windows core and the desktop environment, where attacks and malware most frequently enter. The desktop environment is now more resistant to malware thanks to significant improvements to Windows Defender and SmartScreen Filters. Internet browsing is a safer experience because of Microsoft Edge, a completely new browser. The Windows Store reduces the likelihood that malware will infect devices by ensuring that all applications that enter the Windows Store ecosystem have been thoroughly reviewed before being made available. Universal Windows applications are inherently more secure than typical applications because they are sandboxed. Sandboxing restricts the application’s risk of being compromised or tampered with in a way that would put the system, data, and other applications at risk. The sections that follow describe Windows 10 improvements to application security in more detail. + **Microsoft Edge and Internet Explorer 11** + Browser security is a critical component of any security strategy, and for good reason: The browser is the user’s interface to the Internet, an environment that is quite literally overwhelmed with malicious sites and content waiting to attack. Most users cannot perform at least part of their job without a browser, and many users are completely reliant on one. This reality has made the browser the number one pathway from which malicious hackers initiate their attacks. -All browsers enable some amount of extensibility to do things beyond the original scope of the browser. Two common examples of this are Flash and Java extensions that enable their respective applications to run inside a browser. Keeping Windows 10 secure for web browsing and applications, especially for these two content types, is a priority. + +All browsers enable some amount of extensibility to do things beyond the original scope of the browser. Two common examples of this are Flash and Java extensions that enable their respective applications to run inside a browser. +Keeping Windows 10 secure for web browsing and applications, especially for these two content types, is a priority. + Microsoft includes an entirely new browser, Microsoft Edge, in Windows 10. Microsoft Edge is more secure in several ways, especially: - **Microsoft Edge does not support non-Microsoft binary extensions.** Microsoft Edge supports Flash content and PDF viewing by default through built-in extensions but no other binary extensions, including ActiveX controls and Java. - **Microsoft Edge runs 64-bit processes.** A 64-bit PC running an older version of Windows often runs in 32-bit compatibility mode to support older and less secure extensions. When Microsoft Edge runs on a 64-bit PC, it runs only 64-bit processes, which are much more secure when vulnerabilities are discovered and attempts are made to exploit them. - **Microsoft Edge is designed as a Universal Windows app.** It is inherently compartmentalized and runs in an AppContainer that sandboxes the browser from the system, data, and other apps. IE11 on Windows 10 can also take advantage of the same AppContainer technology through Enhanced Protect Mode. However, because it can run ActiveX and BHOs, the browser and sandbox are susceptible to a much broader range of attacks than Microsoft Edge. - **Microsoft Edge simplifies security configuration tasks.** Because Microsoft Edge uses a simplified application structure and a single sandbox configuration, there are fewer required security settings. In addition, Microsoft created Microsoft Edge default settings that align with security best practices, which makes it secure by default. + In addition to Microsoft Edge, Microsoft includes IE11 in Windows 10 primarily for backwards-compatibility with websites and binary extensions that do not work with Microsoft Edge. It should not be configured as the primary browser but rather as an optional or automatic switchover, as shown in Figure 6. + ![figure 6](images/security-fig6-edge2.png) + Figure 6. Configure Windows 10 to switch from Microsoft Edge to IE11 for backwards-compatibility. + Microsoft’s recommendation is to use Microsoft Edge as the primary web browser because it provides compatibility with the modern web and the best possible security. For sites that require IE11 compatibility, including those that require binary extensions and plug ins, enable Enterprise mode and use the Enterprise Mode Site List to define which sites have the dependency. When configured, when users use Microsoft Edge and it identifies a site that requires IE11, they will automatically be switched to IE11. + **The SmartScreen Filter** + Recent versions of Windows have many effective techniques to prevent malware from installing itself without the user’s knowledge. To work around those restrictions, malware attacks often use social engineering techniques to trick users into running software. For example, malware known as a Trojan horse pretends to be something useful, such as a utility, but carries an additional, malicious payload. Starting with Windows Internet Explorer 8, the SmartScreen Filter has helped protect users from both malicious applications and nefarious websites by using the SmartScreen Filter’s application and URL reputation services. The SmartScreen Filter in Internet Explorer would check URLs and newly downloaded apps against an online reputation service that Microsoft maintained. If the app or URL were not known to be safe, SmartScreen Filter would warn the user or even prevent the app or URL from loading, depending on how systems administrators had configured Group Policy settings. For Windows 10, Microsoft further developed the SmartScreen Filter by integrating its app reputation abilities into the operating system itself, which allows the filter to protect users regardless of the web browser they are using or the path that the app uses to arrive on the device (for example, email, USB flash drive). The first time a user runs an app that originates from the Internet, even if the user copied it from another PC, the SmartScreen Filter checks the reputation of the application by using digital signatures and other factors against a service that Microsoft maintains. If the app lacks a reputation or is known to be malicious, the SmartScreen Filter warns the user or blocks execution entirely, depending on how the administrator has configured Group Policy (see Figure 7). + ![figure 7](images/security-fig7-smartscreenfilter.png) + Figure 7. The SmartScreen Filter at work in Windows 10 + By default, users have the option to bypass SmartScreen Filter protection so that it will not prevent a user from running a legitimate app. You can use Control Panel or Group Policy settings to disable the SmartScreen Filter or to completely prevent users from running apps that the SmartScreen Filter does not recognize. The Control Panel settings are shown in Figure 8. + ![figure 8](images/security-fig8-smartscreenconfig.png) + Figure 8. The Windows SmartScreen configuration options in Control Panel + If you want to try the SmartScreen Filter, use Windows 7 to download this simulated (but not dangerous) malware file:[freevideo.exe](http://go.microsoft.com/fwlink/p/?LinkId=626943). Save it to your computer, and then run it from Windows Explorer. As shown in Figure 9, Windows runs the app without much warning. In Windows 7, you might receive a warning message about the app not having a certificate, but you can easily bypass it. + ![figure 9](images/security-fig9-windows7allow.png) + Figure 9. Windows 7 allows the app to run + Now, repeat the test on a computer running Windows 10 by copying the file to a Windows 10 PC or by downloading the file again and saving it to your local computer. Run the file directly from File Explorer, and the SmartScreen Filter will warn you before it allows it to run. Microsoft’s data shows that for a vast majority of users, that extra warning is enough to save them from a malware infection. + **Universal Windows apps** + The good news is that the download and use of Universal Windows apps or even Windows Classic applications (Win32) from the Windows Store will dramatically reduce the likelihood that you encounter malware on your PC because all apps go through a careful screening process before being made available in the store. Apps that organizations build and distribute through sideloading processes will need to be reviewed internally to ensure that they meet organizational security requirements. + Regardless of how users acquire Universal Windows apps, they can use them with increased confidence. Unlike Windows Classic applications, which can run with elevated privileges and have potentially sweeping access to the system and data, Universal Windows apps run in an AppContainer sandbox with limited privileges and capabilities. For example, Universal Windows apps have no system-level access, have tightly controlled interactions with other apps, and have no access to data unless the user explicitly grants the application permission. In addition, all Universal Windows apps follow the security principle of least privilege. Apps receive only the minimum privileges they need to perform their legitimate tasks, so even if an attacker exploits an app, the damage the exploit can do is severely limited and should be contained within the sandbox. The Windows Store displays the exact capabilities the app requires (for example, access to the camera), along with the app’s age rating and publisher. In the end, the Windows Store app distribution process and the app sandboxing capabilities of Windows 10 will dramatically reduce the likelihood that users encounter malicious apps on the system. + **Windows Defender** + Antimalware software, also generically called virus scanners, antivirus, and a host of other names, has been around for a long time. Microsoft shipped its first program in this category, Microsoft Anti-Virus, in 1993 for MS DOS 6.0. At the time, the approach of running a standalone MS DOS program to locate and remove viruses was sufficient. + Times change and technology progresses, and antimalware software has also evolved. It is crucial to have multilayered defense with interoperability when you manage modern threats. Windows Defender uses the operating system extensively to achieve interoperability across the varying layers of defense. It is important to have an effective antimalware solution in place as an important obstacle between malware and enterprise assets, and it complements features like Device Guard. For example, an antimalware solution could help detect malicious behavior in memory or even within trusted applications, an area that Device Guard is not designed to address. Windows Defender has evolved to meet the growing complexity of IT and the challenges that come with this complexity. Windows included Windows Defender, a robust inbox antimalware solution, starting with Windows 8. Now, with Windows 10, Microsoft has significantly improved Windows Defender. + Windows Defender in Windows 10 uses a four-pronged approach to improve antimalware: rich local context, extensive global sensors, tamper proofing, and the empowerment of IT security professionals. This section explains each prong. + **Rich, local context** improves how malware is identified. Windows 10 informs Windows Defender not only about content like files and processes but also where the content came from, where it has been stored, and more. The information about source and history enables Windows Defender to apply different levels of scrutiny to different content. + For example, an application downloaded from the Internet would be more heavily scrutinized than an application installed from a trusted server. Windows 10 persists the history of the Internet-sourced application at the operating system level so that the app cannot erase its own tracks. The history is tracked and stored by the Persisted Store, a new feature in Windows 10 that securely manages the rich local context and prevents unauthorized modification or deletion. The rich local context improvements also help prevent malware from using tactics such as obfuscation as a means to evade detection. + Local context also extends to how antimalware software exposes interfaces. Windows Defender implements the Antimalware Scan Interface (AMSI), a generic public interface standard that allows applications and services to request Windows Defender to scan and analyze obfuscated code before execution. AMSI is available for any application and antimalware solution to implement. In Windows 10, AMSI is accessible through Windows PowerShell, the Windows Script Host, JavaScript, and Microsoft JScript. + In Windows 10, Microsoft implemented a new technology that allows Windows Defender to work closely with User Account Control (UAC) requests. When the UAC system is triggered, it requests a scan from Windows Defender before it prompts for elevation. Windows Defender scans the file or process and determines whether it's malicious. If it’s malicious, the user will see a message that explains that Windows Defender blocked the file or process from executing; if it's not malicious, then UAC will run and display the usual elevation request prompt. + **Extensive global sensors** help keep Windows Defender current and aware of even the newest malware. This is accomplished in two ways: by collecting the rich local context data from end points and by centrally analyzing that data. The goal is to identify new, emerging malware and block it in the first critical hours of its lifetime to limit exposure to the broader PC ecosystem. + With Windows Defender in Windows 8, Microsoft first introduced Windows Defender Cloud Protection, which helps to better react in the quickly evolving malware landscape. The goal is to block malware the "first time it’s seen" in the first critical hours of a malware attack. + To help preserve the privacy of customers, Microsoft allows customers to opt in or out of the system. To participate, you simply opt into the program. To opt in for Windows 10, click **Settings**, click **Update & Security**, and then click **Windows Defender**. The opt-in choices are shown in Figure 10. + ![figure 10](images/security-fig10-optinsettings.png) + Figure 10. Windows Defender opt-in settings in Windows 10 + Of course, system administrators have centralized control of all Windows Defender settings through Group Policy. The Windows Defender configuration settings are shown under Computer Configuration/Windows Components/Windows Defender, as shown in Figure 11. + ![figure 11](images/security-fig11-defendersettings.png) + Figure 11. Windows Defender settings in Group Policy– the sample submission options are listed under MAPS + **Tamper proofing** is the safeguarding of Windows Defender itself against malware attacks. Malware creators assume that antimalware software is implemented on most PCs. Many malware creators choose to overcome that obstacle by designing malware that modifies the antimalware software in some way, such as disabling real-time scanning or by hiding specific processes. Some malware goes as far as completely disabling the antimalware software while making it appear fully functional to the user. + Windows Defender is designed to resist tampering; it uses several security technologies available in Windows 10, the primary of which is Protected Processes, which prevents untrusted processes from attempting to tamper with Windows Defender components, its registry keys, and so on. Tamper proofing in Windows Defender is also the indirect result of system-wide security components, including UEFI with Secure Boot and ELAM. These components help provide a more secure environment in which Windows Defender can launch in before it begins to defend itself. -**Empowerment of IT security professionals** means that Windows Defender gives IT pros the tools and configuration options necessary to make it an enterprise-class antimalware solution. It has numerous enterprise-level features that put it on par with the top products in this category: + +**Empowerment of IT security professionals** means that Windows Defender gives IT pros the tools and configuration options necessary to make it an enterprise-class antimalware solution. It has numerous enterprise-level features +that put it on par with the top products in this category: - Integration with centralized management software, including Microsoft Intune, System Center Configuration Manager, and Microsoft System Center Operations Manager. Unlike Windows 8.1, no additional client is necessary, because Windows Defender is now integrated into Windows and only a management layer needs to be added. - Windows Defender supports the Open Mobile Alliance Device Management standard for centralized management by many non-Microsoft device management solutions. - It includes integrated classic command-line and Windows PowerShell cmdlet support. - Support for Windows Management Instrumentation reporting and application management is built in. - Full integration with Group Policy offers complete IT configuration management. + In addition, Windows Defender now integrates the Windows Defender Offline Tool, which formerly required the creation of a bootable, standalone version of Windows Defender into the Windows Recovery Environment. This simplifies the process of remediating low-level malware infections, which may prove difficult to detect and remove with the antimalware solution running on the Windows desktop. You can update signatures for this environment automatically from within the Windows Defender Offline experience. + Beyond Windows Defender, Windows 10 provides deep operating system access for antimalware products. Non-Microsoft antimalware vendors can take advantage of Microsoft’s new APIs and interfaces to gain unprecedented access to Windows 10 resources for malware detection and removal. Non-Microsoft antimalware solutions can implement ELAM drivers, which scan Windows 10 while it’s in its initial startup process. The broad set of new low-level interfaces lets non-Microsoft antimalware solutions perform advanced malware detection in a way that enables them to retain application compatibility even when Microsoft makes significant changes to Windows internals, such as are often made between major operating system versions. + This access presents a security challenge, however: How does Windows 10 grant antimalware software generous access while ensuring that malware doesn’t take advantage of the very same access? Microsoft has been hard at work with several non-Microsoft software vendors to meet this challenge. If a third party wants this level of access, it must meet certain criteria and vetting requirements, and then Microsoft must digitally sign its software. This allows Microsoft to verify the authenticity of the software vendors and prevent nefarious individuals from creating their own self-signed fake malware scanners. + To be clear, Microsoft is not restricting the antimalware vendors or their innovations. Nor is Microsoft changing software distribution channels. When Microsoft has signed the antimalware application, you can deploy and install it through any means. Microsoft is basically ensuring that these software developers are authentic, industry-recognized entities before signing their antimalware software and, in doing so, granting extended privileges to it. Another security threat that customers face particularly in consumer and bring your own device (BYOD) scenarios is a disabled or outdated antimalware product. A BYOD computer that has an installed but ineffective antimalware product can be more dangerous than no product at all, because it gives the illusion of security. Windows Defender in Windows 10 mitigates this threat by helping ensure that either Windows Defender or the customer’s preferred non-Microsoft solution is running and in a healthy state. + Whenever non-Microsoft real-time protection is in an inoperable state (for example, disabled, expired) for 24 hours, Windows Defender automatically turns on to ensure that the device is protected. Windows attempts to help the user remediate the issue with the non-Microsoft antimalware solution by notifying him or her as early as 5 days before the software expires. If the solution expires, Windows enables Windows Defender and continues to remind the user to renew the non-Microsoft solution. When the user updates or reactivates the solution, Windows Defender is automatically disabled. In the end, the goal is to make sure that an operable antimalware solution is running at all times. + ## Conclusion + Windows 10 is the culmination of many years of effort from Microsoft, and its impact from a security perspective will be significant. Many of us still remember the years of Windows XP, when the attacks on the Windows operating system, applications, and data increased in volume and matured into serious threats. With the existing platforms and security solutions that you’ve likely deployed, you’re better defended than ever. But as attackers have become more advanced, there is no doubt that they have exceeded your ability to defend your organization and users. Evidence of this fact can be found in the news virtually every day as yet another major organization falls victim. Microsoft specifically designed Windows 10 to address these modern threats and tactics from the most advanced adversaries. It can truly change the game for your organization, and it can restore your advantage against those would like to make you their next victim. + ## Related topics + [Windows 10 Specifications](http://go.microsoft.com/fwlink/p/?LinkId=625077 ) + [HealthAttestation CSP](http://go.microsoft.com/fwlink/p/?LinkId=626940 ) + [Making Windows 10 More Personal and More Secure with Windows Hello](http://go.microsoft.com/fwlink/p/?LinkId=626945) + [Protect BitLocker from pre-boot attacks](protect-bitlocker-from-pre-boot-attacks.md) -  -  diff --git a/windows/keep-secure/windows-defender-in-windows-10.md b/windows/keep-secure/windows-defender-in-windows-10.md index e2f59150de..72d8554def 100644 --- a/windows/keep-secure/windows-defender-in-windows-10.md +++ b/windows/keep-secure/windows-defender-in-windows-10.md @@ -2,39 +2,52 @@ title: Windows Defender in Windows 10 (Windows 10) description: This topic provides an overview of Windows Defender, including a list of system requirements and new features. ms.assetid: 6A9EB85E-1F3A-40AC-9A47-F44C4A2B55E2 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library +ms.pagetype: security author: jasesso --- + # Windows Defender in Windows 10 + **Applies to** - Windows 10 + Windows Defender in Windows 10 is a built-in antimalware solution that provides security and antimalware management for desktops, portable computers, and servers. This topic provides an overview of Windows Defender, including a list of system requirements and new features. + For more important information about running Windows Defender on a server platform, see [Windows Defender Overview for Windows Server Technical Preview](https://technet.microsoft.com/library/dn765478.aspx). + Take advantage of Windows Defender by configuring the settings and definitions using the following tools: - Microsoft Active Directory *Group Policy* for settings - Windows Server Update Services (WSUS) for definitions + Windows Defender provides the most protection when cloud-based protection is enabled. Learn how to enable cloud-based protection in [Configure Windows Defender in Windows 10](configure-windows-defender-in-windows-10.md). -**Note**  System Center 2012 R2 Configuration Manager SP1, System Center 2012 Configuration Manager SP2, and Microsoft Intune can provide centralized management of Windows Defender, including: +> **Note:**  System Center 2012 R2 Configuration Manager SP1, System Center 2012 Configuration Manager SP2, and Microsoft Intune can provide centralized management of Windows Defender, including: - Settings management - Definition update management - Alerts and alert management - Reports and report management + When you enable endpoint protection for your clients, it will install an additional management layer on Windows Defender to manage the in-box Windows Defender agent. While the client user interface will still appear as Windows Defender, the management layer for Endpoint Protection will be listed in the **Add/Remove Programs** control panel, though it will appear as if the full product is installed.   ### Minimum system requirements + Windows Defender has the same hardware requirements as Windows 10. For more information, see: - [Minimum hardware requirements](https://msdn.microsoft.com/library/windows/hardware/dn915086.aspx) - [Hardware component guidelines](https://msdn.microsoft.com/library/windows/hardware/dn915049.aspx) + ### New and changed functionality + - **Improved detection for unwanted applications and emerging threats using cloud-based protection.** Use the Microsoft Active Protection Service to improve protection against unwanted applications and advanced persistent threats in your enterprise. - **Windows 10 integration.** All Windows Defender in Windows 10 endpoints will show the Windows Defender user interface, even when the endpoint is managed. - **Operating system, enterprise-level management, and bring your own device (BYOD) integration.** Windows 10 introduces a mobile device management (MDM) interface for devices running Windows 10. Administrators can use MDM-capable products, such as Intune, to manage Windows Defender on Windows 10 devices. + For more information about what's new in Windows Defender in Windows 10, see [Windows Defender in Windows 10: System integration](https://www.microsoft.com/security/portal/enterprise/threatreports_august_2015.aspx) on the Microsoft Active Protection Service website. + ## In this section + From 64d97a2016516c979553c7fb9880db89822d00a2 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 18 May 2016 17:53:00 -0700 Subject: [PATCH 324/439] link spacing issues --- windows/keep-secure/credential-guard.md | 118 ++++++++++++++++++------ 1 file changed, 90 insertions(+), 28 deletions(-) diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index 76b0ac81b6..7968594af5 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -2,32 +2,46 @@ title: Protect derived domain credentials with Credential Guard (Windows 10) description: Introduced in Windows 10 Enterprise, Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. ms.assetid: 4F1FE390-A166-4A24-8530-EA3369FEB4B1 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: explore ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- # Protect derived domain credentials with Credential Guard + **Applies to** - Windows 10 - Windows Server 2016 Technical Preview + Introduced in Windows 10 Enterprise, Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Unauthorized access to these secrets can lead to credential theft attacks, such as Pass-the-Hash or Pass-The-Ticket. Credential Guard prevents these attacks by protecting NTLM password hashes and Kerberos Ticket Granting Tickets. + Credential Guard offers the following features and solutions: + - **Hardware security** Credential Guard increases the security of derived domain credentials by taking advantage of platform security features including, Secure Boot and virtualization. - **Virtualization-based security** Windows services that manage derived domain credentials and other secrets run in a protected environment that is isolated from the running operating system. - **Better protection against advanced persistent threats** Securing derived domain credentials using the virtualization-based security blocks the credential theft attack techniques and tools used in many targeted attacks. Malware running in the operating system with administrative privileges cannot extract secrets that are protected by virtualization-based security. While Credential Guard is a powerful mitigation, persistent threat attacks will likely shift to new attack techniques and you should also incorporate Device Guard and other security strategies and architectures. - **Manageability** You can manage Credential Guard by using Group Policy, WMI, from a command prompt, and Windows PowerShell. + ## How it works -Credential Guard isolates secrets that previous versions of Windows stored in the Local Security Authority (LSA) by using virtualization-based security. Prior to Windows 10, the LSA stored secrets used by the operating system in its process memory. With Credential Guard, the LSA process in the operating system talks to a new component called the isolated LSA process that stores and protects those secrets. Data stored by the isolated LSA process is protected using virtualization-based security and is not accessible to the rest of the operating system. LSA uses remote procedure calls to communicate with the isolated LSA process + +Credential Guard isolates secrets that previous versions of Windows stored in the Local Security Authority (LSA) by using virtualization-based security. Prior to Windows 10, the LSA stored secrets used by the operating system in its process memory. With Credential Guard, the LSA process in the operating system talks to a new component called the isolated LSA process that stores and protects those secrets. Data stored by the isolated LSA process is protected using virtualization-based security and is not accessible to the rest of the operating system. LSA uses remote procedure calls to communicate with the isolated LSA process. + For security reasons, the isolated LSA process doesn't host any device drivers. Instead, it only hosts a small subset of operating system binaries that are needed for security and nothing else. All of these binaries are signed with a certificate that is trusted by virtualization-based security and these signatures are validated before launching the file in the protected environment. + Credential Guard also does not allow older variants of NTLM, unconstrained Kerberos delegation, and Kerberos authentication protocols and cipher suites when using default derived credentials, including NTLMv1, MS-CHAPv2, and weaker Kerberos encryption types, such as DES. Here's a high-level overview on how the LSA is isolated by using virtualization-based security: -![Credential Guard oveview](images/credguard.png) + +![Credential Guard overview](images/credguard.png) + ## New and changed functionality + To see what was added or changed in Credential Guard, see [What's new in Credential Guard?](../whats-new/credential-guard.md). + ## Hardware and software requirements + The PC must meet the following hardware and software requirements to use Credential Guard: +
    @@ -100,21 +114,31 @@ The PC must meet the following hardware and software requirements to use Credent
      ¹ If you choose the **Secure Boot and DMA protection** option in the Group Policy setting, an IOMMU is required. The **Secure Boot** Group Policy option enables Credential Guard on devices without an IOMMU. + ## Manage Credential Guard + Credential Guard uses virtualization-based security features that must be enabled on each PC before you can use it. + ### Turn on Credential Guard by using Group Policy + You can use Group Policy to enable Credential Guard because it will add the virtualization-based security features for you. 1. From the Group Policy Management Console, go to **Computer Configuration** -> **Administrative Templates** -> **System** -> **Device Guard**. 2. Double-click **Turn On Virtualization Based Security**, and then click the **Enabled** option. 3. **Select Platform Security Level** box, choose **Secure Boot** or **Secure Boot and DMA Protection**. 4. In the **Credential Guard Configuration** box, click **Enabled with UEFI lock**, and then click **OK**. If you want to be able to turn off Credential Guard remotely, choose **Enabled without lock**. - ![](images/credguard-gp.png) + + ![Credential Guard Group Policy setting](images/credguard-gp.png) + 5. Close the Group Policy Management Console. + ### Add Credential Guard to an image + If you would like to add Credential Guard to an image, you can do this by adding the virtualization-based security features and then turning on Credential Guard. + ### Add the virtualization-based security features + First, you must add the virtualization-based security features. You can do this by using either the Control Panel or the Deployment Image Servicing and Management tool (DISM). -**Note**  If you enable Credential Guard by using Group Policy, these steps are not required. Group Policy will install the features for you. +> **Note:**  If you enable Credential Guard by using Group Policy, these steps are not required. Group Policy will install the features for you.   **Add the virtualization-based security features by using Programs and Features** 1. Open the Programs and Features control panel. @@ -122,6 +146,7 @@ First, you must add the virtualization-based security features. You can do this 3. Select the **Isolated User Mode** check box. 4. Go to **Hyper-V** -> **Hyper-V Platform**, and then select the **Hyper-V Hypervisor** check box. 5. Click **OK**. + **Add the virtualization-based security features to an offline image by using DISM** 1. Open an elevated command prompt. 2. Add the Hyper-V Hypervisor by running the following command: @@ -132,12 +157,14 @@ First, you must add the virtualization-based security features. You can do this ``` syntax dism /image: /Enable-Feature /FeatureName:IsolatedUserMode ``` -**Note**   -You can also add these features to an online image by using either DISM or Configuration Manager. +> **Note:**  You can also add these features to an online image by using either DISM or Configuration Manager.   ### Turn on Credential Guard + If you don't use Group Policy, you can enable Credential Guard by using the registry. + **Turn on Credential Guard by using the registry** + 1. Open Registry Editor. 2. Enable virtualization-based security: - Go to HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\DeviceGuard. @@ -147,15 +174,19 @@ If you don't use Group Policy, you can enable Credential Guard by using the regi - Go to HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\LSA. - Add a new DWORD value named **LsaCfgFlags**. Set the value of this registry setting to 1 to enable Credential Guard with UEFI lock, set it to 2 to enable Credential Guard without lock, and set it to 0 to disable it. 4. Close Registry Editor. -**Note**   -You can also turn on Credential Guard by setting the registry entries in the [FirstLogonCommands](http://msdn.microsoft.com/library/windows/hardware/dn922797.aspx) unattend setting. + +> **Note:**  You can also turn on Credential Guard by setting the registry entries in the [FirstLogonCommands](http://msdn.microsoft.com/library/windows/hardware/dn922797.aspx) unattend setting.   ### Remove Credential Guard + If you have to remove Credential Guard on a PC, you need to do the following: + 1. If you used Group Policy, disable the Group Policy setting that you used to enable Credential Guard (**Computer Configuration** -> **Administrative Templates** -> **System** -> **Device Guard** -> **Turn on Virtualization Based Security**). 2. Delete the following registry setting: HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DeviceGuard\\LsaCfgFlags 3. Delete the Credential Guard EFI variables by using bcdedit. + **Delete the Credential Guard EFI variables** + 1. From an elevated command prompt, type the following commands: ``` syntax mountvol X: /s @@ -170,20 +201,25 @@ If you have to remove Credential Guard on a PC, you need to do the following: 2. Restart the PC. 3. Accept the prompt to disable Credential Guard. 4. Alternatively, you can disable the virtualization-based security features to turn off Credential Guard. -**Note**   -The PC must have one-time access to a domain controller to decrypt content, such as files that were encrypted with EFS. -If you want to turn off both Credential Guard and virtualization-based security, run the following bcdedit command after turning off all virtualization-based security Group Policy and registry settings: -**bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS** + +> **Note: ** The PC must have one-time access to a domain controller to decrypt content, such as files that were encrypted with EFS. If you want to turn off both Credential Guard and virtualization-based security, run the following bcdedit command after turning off all virtualization-based security Group Policy and registry settings: **bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS** + For more info on virtualization-based security and Device Guard, see [Device Guard deployment guide](device-guard-deployment-guide.md).   ### Check that Credential Guard is running + You can use System Information to ensure that Credential Guard is running on a PC. + 1. Click **Start**, type **msinfo32.exe**, and then click **System Information**. 2. Click **System Summary**. 3. Confirm that **Credential Guard** is shown next to **Device Guard Security Services Running**. + Here's an example: - ![](images/credguard-msinfo32.png) + + ![System Information](images/credguard-msinfo32.png) + ## Considerations when using Credential Guard + - If Credential Guard is enabled on a device after it's joined to a domain, the user and device secrets may already be compromised. We recommend that Credential Guard is enabled before the PC is joined to a domain. - You should perform regular reviews of the PCs that have Credential Guard enabled. This can be done with security audit policies or WMI queries. Here's a list of WinInit event IDs to look for: - **Event ID 13** Credential Guard (LsaIso.exe) was started and will protect LSA credentials. @@ -203,34 +239,51 @@ You can use System Information to ensure that Credential Guard is running on a P - Credentials saved by Remote Desktop Services cannot be used to remotely connect to another machine without supplying the password. - Applications that extract derived domain credentials from Credential Manager will no longer be able to use those credentials. - You cannot restore credentials using the Credential Manager control panel if the credentials were backed up from a PC that has Credential Guard turned on. If you need to back up your credentials, you must do this before you enable Credential Guard. Otherwise, you won't be able to restore those credentials. + ## Scenarios not protected by Credential Guard + Some ways to store credentials are not protected by Credential Guard, including: + - Software that manages credentials outside of Windows feature protection - Local accounts and Microsoft Accounts - Credential Guard does not protect the Active Directory database running on Windows Server 2016 Technical Preview domain controllers. It also does not protect credential input pipelines, such as Windows Server 2016 Technical Preview servers running Remote Desktop Gateway. If you're using a Windows Server 2016 Technical Preview server as a client PC, it will get the same protection as it would be running Windows 10 Enterprise. - Key loggers - Physical attacks - Does not prevent an attacker with malware on the PC from using the privileges associated with any credential. We recommend using dedicated PCs for high value accounts, such as IT Pros and users with access high value assets in your organization. + ## Additional mitigations + Credential Guard can provide mitigations against attacks on derived credentials and prevent the use of stolen credentials elsewhere. However, PCs can still be vulnerable to certain attacks, even if the derived credentials are protected by Credential Guard. These attacks can include abusing privileges and use of derived credentials directly from a compromised device, reusing previously stolen credentials prior to Device Guard, and abuse of management tools and weak application configurations. Because of this, additional mitigations also need to be deployed to make the domain environment more robust. + Credential theft attacks allow the attacker to steal secrets from one device and use them from another device. By deploying authentication policies with compound authentication in Windows Server 2012 R2 or later domains, users can be restricted to only sign on from specific domain-joined devices. However, since devices also use shared secrets for authentication, attackers can steal those secrets as well. By deploying device certificates with Credential Guard, authentication policies can require that the device authenticates with its private key. This prevents shared secrets on stolen devices to be used with stolen user passwords or Kerberos secret keys to sign on as the user. + Device certificate authentication has the following requirements: + - Device domains are Windows Server 2012 or higher and all domain controllers have certificates, which satisfy strict KDC validation (KDC EKU present and the DNS domain name matches the DNSName field of the SubjectAltName (SAN) extension). - Windows 10 devices have the CA issuing the domain controller certificates in the enterprise store. - A process is established to ensure the identity and trustworthiness of the device in a similar manner as you would establish the identity and trustworthiness of a user before issuing them a smartcard. + ### Additional Group Policy settings + There are a few Group Policy settings that you can enable that provide more protection against credential attacks: + - On the domain controllers, configure the KDC support for claims, compound authentication, and Kerberos armoring system by using Group Policy. Set the **KDC support for claims, compound authentication, and Kerberos armoring** Group Policy setting to either **Supported** or **Always provide claims**. - On devices running Windows 10, you can turn it on by using Group Policy as well. To do this, enable the **Kerberos client support for claims, compound authentication and Kerberos armoring** & **Always send compound authentication first system** Group Policy settings under **Computer Configuration** -> **Administrative Templates** -> **System** -> **Kerberos**. + ### Compound authentication + Compound authentication adds the device identity to the user’s during authentication to the domain and resources. Without compound authentication, only the user’s secrets are validated. With compound authentication, the Kerberos client has to have both the user’s and device’s secrets. Enabling compound authentication also enables Kerberos armoring, which provides two additional benefits: + - User authentication on domain-joined devices will be armored. This means that network captures will contain encrypted Kerberos initial authentication. Without the appropriate device key, Kerberos AS-REQs are protected against offline dictionary attacks. - KDC errors are signed, which provides protection against error spoofing attacks. + ### Deploying machine certificates + If the domain controllers in your organization are running Windows Server 2016 Technical Preview, devices running Windows 10 will automatically enroll a machine certificate when Credential Guard is enabled and the PC is joined to the domain. If the domain controllers are running Windows Server 2012 R2, the machine certificates must be provisioned manually on each device. You can do this by creating a certificate template on the domain controller or certificate authority and deploying the machine certificates to each device. The same security procedures used for issuing smart cards to users should be applied to machine certificates. + 1. From the Certificate Manager console, right-click **Certificate Templates**, and then click **Manage.** 2. Right-click **Workstation Authentication**, and then click **Duplicate Template**. 3. Right-click the new template, and then click **Properties**. @@ -242,14 +295,15 @@ The same security procedures used for issuing smart cards to users should be app 7. On the **Extensions** tab, click **Issuance Policies**, and then click **Edit**. 8. Under **Issuance Policies**, click**High Assurance**. 9. On the **Subject name** tab, clear the **DNS name** check box, and then select the **User Principal Name (UPN)** check box. + On devices that are running Credential Guard, enroll the devices using the machine authentication certificate by running the following command: ``` syntax CertReq -EnrollCredGuardCert MachineAuthentication ``` -**Note**   -You must restart the device after enrolling the machine authentication certificate. +> **Note:**  You must restart the device after enrolling the machine authentication certificate.   ### Link the issuance policies to a group + By using an authentication policy, you can ensure that users only sign into devices that are running Credential Guard. Before you deploy the authentication policy though, you must first run a couple of scripts that set up your environment. - The [get-IssuancePolicy.ps1](#bkmk-getscript) shows all of the issuance policies that are available on the certificate authority. From a Windows PowerShell command prompt, run the following command: @@ -262,9 +316,13 @@ By using an authentication policy, you can ensure that users only sign into devi .\set-IssuancePolicyToGroupLink.ps1 –IssuancePolicyName:”” –groupOU:”” –groupName:”” ``` ### Deploy the authentication policy + Before setting up the authentication policy, you should log any failed attempt to apply an authentication policy on the KDC. To do this in Event Viewer, navigate to **Applications and Services Logs\\Microsoft\\Windows\\Authentication, right-click AuthenticationPolicyFailures-DomainController**, and then click **Enable Log**. + Now you can set up an authentication policy to use Credential Guard. + **To add an authentication policy for Credential Guard** + 1. Ensure that your domain controllers are running at least the Windows Server 2012 R2 domain functional level. 2. Create a security group that will be used to identify the PCs that will have this authentication policy applied to them. 3. Add the computer account to this security group. @@ -280,13 +338,17 @@ Now you can set up an authentication policy to use Credential Guard. 13. Click **OK** to close the **Edit Access Control Conditions** box. 14. Click **OK** to create the authentication policy. 15. Close Active Directory Administrative Center. -**Note**   -When authentication policies in enforcement mode are deployed with Credential Guard, users will not be able to sign in using devices that do not have the machine authentication certificate provisioned. This applies to both local and remote sign in scenarios. + +> **Note:**  When authentication policies in enforcement mode are deployed with Credential Guard, users will not be able to sign in using devices that do not have the machine authentication certificate provisioned. This applies to both local and remote sign in scenarios.   ### Appendix: Scripts + Here is a list of scripts that are mentioned in this topic. + ### Get the available issuance policies on the certificate authority + Save this script file as get-IssuancePolicy.ps1. + ``` syntax ####################################### ## Parameters to be defined ## @@ -750,17 +812,17 @@ write-host $tmp -Foreground Red } } ``` -**Note**   -If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter. + +> **Note:**  If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter.   ## Related topics -[Isolated User Mode in Windows 10 with Dave Probert (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/Isolated-User-Mode-in-Windows-10-with-Dave-Probert) -[Isolated User Mode Processes and Features in Windows 10 with Logan Gabriel (Channel 9)](http://channel9.msdn.com/Blogs/Seth-Juarez/Isolated-User-Mode-Processes-and-Features-in-Windows-10-with-Logan-Gabriel) -[More on Processes and Features in Windows 10 Isolated User Mode with Dave Probert (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/More-on-Processes-and-Features-in-Windows-10-Isolated-User-Mode-with-Dave-Probert) -[Mitigating Credential Theft using the Windows 10 Isolated User Mode (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/Mitigating-Credential-Theft-using-the-Windows-10-Isolated-User-Mode) -[Enabling Strict KDC Validation in Windows Kerberos](http://www.microsoft.com/download/details.aspx?id=6382) -[What's New in Kerberos Authentication for Windows Server 2012](http://technet.microsoft.com/library/hh831747.aspx) -[Authentication Mechanism Assurance for AD DS in Windows Server 2008 R2 Step-by-Step Guide](http://technet.microsoft.com/library/dd378897.aspx) -[Trusted Platform Module](trusted-platform-module-overview.md) +- [Isolated User Mode in Windows 10 with Dave Probert (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/Isolated-User-Mode-in-Windows-10-with-Dave-Probert) +- [Isolated User Mode Processes and Features in Windows 10 with Logan Gabriel (Channel 9)](http://channel9.msdn.com/Blogs/Seth-Juarez/Isolated-User-Mode-Processes-and-Features-in-Windows-10-with-Logan-Gabriel) +- [More on Processes and Features in Windows 10 Isolated User Mode with Dave Probert (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/More-on-Processes-and-Features-in-Windows-10-Isolated-User-Mode-with-Dave-Probert) +- [Mitigating Credential Theft using the Windows 10 Isolated User Mode (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/Mitigating-Credential-Theft-using-the-Windows-10-Isolated-User-Mode) +- [Enabling Strict KDC Validation in Windows Kerberos](http://www.microsoft.com/download/details.aspx?id=6382) +- [What's New in Kerberos Authentication for Windows Server 2012](http://technet.microsoft.com/library/hh831747.aspx) +- [Authentication Mechanism Assurance for AD DS in Windows Server 2008 R2 Step-by-Step Guide](http://technet.microsoft.com/library/dd378897.aspx) +- [Trusted Platform Module](trusted-platform-module-overview.md)     From 9aef656499f8a3cda9c2a5fa96a15a16bf6b02b1 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 18 May 2016 18:08:24 -0700 Subject: [PATCH 325/439] fixing headings --- windows/keep-secure/credential-guard.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index 7968594af5..60e1c40749 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -345,7 +345,7 @@ Now you can set up an authentication policy to use Credential Guard. Here is a list of scripts that are mentioned in this topic. -### Get the available issuance policies on the certificate authority +#### Get the available issuance policies on the certificate authority Save this script file as get-IssuancePolicy.ps1. @@ -533,11 +533,12 @@ write-host "There are no issuance policies which are not mapped to groups" } } ``` -**Note**   -If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter. +> **Note:**  If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter.   -### Link an issuance policy to a group +#### Link an issuance policy to a group + Save the script file as set-IssuancePolicyToGroupLink.ps1. + ``` syntax ####################################### ## Parameters to be defined ## @@ -816,6 +817,7 @@ write-host $tmp -Foreground Red > **Note:**  If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter.   ## Related topics + - [Isolated User Mode in Windows 10 with Dave Probert (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/Isolated-User-Mode-in-Windows-10-with-Dave-Probert) - [Isolated User Mode Processes and Features in Windows 10 with Logan Gabriel (Channel 9)](http://channel9.msdn.com/Blogs/Seth-Juarez/Isolated-User-Mode-Processes-and-Features-in-Windows-10-with-Logan-Gabriel) - [More on Processes and Features in Windows 10 Isolated User Mode with Dave Probert (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/More-on-Processes-and-Features-in-Windows-10-Isolated-User-Mode-with-Dave-Probert) From 9f6fb2dea7a3ffc934c3f9d2f2670b964ea9af6f Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 19 May 2016 11:11:49 +1000 Subject: [PATCH 326/439] edit image --- .../images/machine-investigation.png | Bin 54481 -> 53354 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/keep-secure/images/machine-investigation.png b/windows/keep-secure/images/machine-investigation.png index df55bcf3187c016df3e33397810257c70710bda9..d9ef2ad4a2516cba639f6abf0766eb4ba98e7672 100644 GIT binary patch literal 53354 zcmd?Rbx>Tv_a{mM1cv~@EqHKuncyyg1P|`+?(VK(fP^3+cyMy0~1CuhH9*z~2Vm7N(J&m|TL@E4TFzouXpt!d8IA!PSI%_JP`?9A+4;VvNQ9YEc)$7XM> zTy4$Zz8p-@!@<3TlamyC>j~al2=L5yYkN4}BCWujH3X@CF*75<_-2-3^jn}T-icij za|Qf8!HL_m-%hg6la!qwSu9peW&IU87zc*B9!mCwJbIaRBvds~KuDODedZe_!@_S; zvZwQg@aFVFclS>8R{l`A$%^+9ULqBx({-Eo&^!u{iMqVYJ6P)>M;lNg|CP5{Sh221 zlK)ECD@#hMzvZ2r7#jB9QX-G4^RKz=JGCF;kBv<;_q1G?6h^@bJ=K9@`U?;)ADLzu zDyl=4e{Int;%}Ocb$6|9N84@>JT8yYuwmW;>d;JIB*glapd%B|&Kjzax`Jz^l-p&_sDoJj5ei?|k77 zkZP`IKSiAzDglwd`q`njrK2B|Y%+2N>R8%7!QXhsIcnOQ(ymX%34Kxf{P8^z@$x9b ze()0t~*vCB?Z+ecDzG&nRkZ+yw__h=Rl z?C92&u`$nS4`Ulb<(ee8eO!36YQr6Cc?x%B6Oo&uV8bfEQ?RixKjT?&CyB7_gj5+} z`&wdPm#bWI{N}vDb~FqnK{lJWtrBhMu3kmOIiHP$!S~h_OGeH5N>19*0Z)04>6;}g zXgezP4awa~DZ{JK_E=u&42NRW54vmfvH=&7qUMoQcKb+f&YhLX(gHDFvgU&a!%v&OV0 zeRwoeo9vpYG^jmX4Bg=&tBg>o%G3>19P5~sgfNb$ZnG?GRL)2Lu{!$_p~mYE+Te?A z+$`|v$-0XKbjzLH4msO70_Tj+LRnfow7Re%%ClONeL&g%5H34qVkH){p8k_#l(e%C zk}7HAE8|mavgI{hCZf_N#QyLRd}?CtSSB{vHM&$}{7UW;t>nmom*A&RN*pOMY-|Co zIr2Ztm($jJ1~z?nw4&m4{+_96<9fGAbZggUODI!gGJqw`X?#6gOBXbY2fW^u7xtfL zp>(TkqXUW7c5E}7i3M#uW=(dzw#_IWi}kUh3-1{m`O+}ZXGn5p)XHl$TO0Dbt8wU; z696l+;)ND;e`@c|t)PSU{%$~3*i=^~#SC$jc*XYVOC&lABFmr6GrSLTbx9;I;Cf|p zio7XHmkox)#CLWUFem27a$yt$Ln9v`qE8&DOQgZ!%)`fV1?FVN_zI08CI_9PWp@P2|aD{DG86imJF{>E9R zIa$5Av-HJUmsy@4mj<%vs3{SdBr&n=u>Ne^M3`e`tMPStt2d>UCMyUt)jN!=SKEyE zw`WvESen`HY$I=u2w_d+&`${NFUi><%ON1H@%l9$Xy~2)Q>BVM4YX{w=y9`UM^l^M z9wcE4^NRVbfz*65p(8TfZ)Vf6G})iIfE^> zcYXJdZTJW2voWc;WF$(tKgXDIMR44u)KZZT7of+o`uPlfy>))RIfjd%k5s_W~aV3G2i80^YsV*^GyNt{X^(C@(AoQke~r zI~9ej^vu-$XH05Y>+&Ai)i1j zOWGpBo%R1slFpb!v+A^r+$+;eZH6vG!BjrUycI>rI~x^HY2{ z9>}?V55ZDfNV?}3Es1m*Rx-I2@2mX^M!CXh#2 zth^<^_T#%0w!Q!DdYK#!#>iVXjgd}4`uRay9>=qrEVB-vw=RTy z{@bRu_zIjZH)>_U?gswZY?A7&=hN_B7Mp3M1&Z%#nSd7!KRsGwlduLs8@f9-9dO!o zg5KB)HR7XtVWIcHy(Es)aA(Fhfi!JxrnRgmD||CcXEPXmr};k3!*^$@q<5{7!y)$^ z2G;>oVzc*%QtmefyUp7PpZ)$!I{uLObz-zm*HIMOQ#wFCn#WqQB{?iiYa%e=j{aaO z6t0=Oy_#&$(X%8a80BN}?W6ne>->*>vivS|Z5Hva^y_!u;~NBmJPKNz2Fb3S9$qM0%JtIY2dbU^oPBQ32w3OZ&^hzhwb=n)hD;^vS_zP_p>cQ9Wi5z8LtFj_X~h8 zvE;@saCaxsakx3}0m>$5tlCj<3ShGFmUv%>`S zTpK$X637|-_9Q%it(wqeluVtpaS+9kKWCJZWPozIEslxeVC82P?#yzzi9BL4slU7k z%Yf}xw9w_MPF>u-LAJ)YSK1(&PMJ2*dQ`apn<6NrGdawQ-d3kB7%6ul=iVNN-k>p6 zs-~Q2j15guFbge%HNWzTSmRlqq0OT9#x7*L+{<2{0&TanmK8gR^6Zv1*MFPL|8_wD z>NWj~6A|lZzg`ozh3Ga5*Tcv9AO6B4d0)4Ic`8MYHMM$B-$m?gD@-df1er0}FWcNOL z7%B#O+MQIT_3;$^4L?qHJ+2PcZW{L?pJ2mfY?jqlc<*KOWnU&{tzfEUzBymlIfi@h-I**AT+t8Or)~aK{19N7{|u( z(C+uclY4hG?}Gt(4RknZOCSg3EccrA^l*M4Wm~OyBS&3cY#x8h&WpVdGV0{&e*(v~ zb`#{}cc*gc@Y1d#PIzp)1me->mPWFR4p;BeSLXwJQ-nH?;N9kS7mFK-0nT zNW_H={4s zhB#f|;Oloj?@Ku}P>e%mJ7Z!Y30HRl- z^PVtWehqUT>-b*(K41-Xc%PWaM8JC$iOKfrroauusfep|KF>OT%Pz62xzwFI8>5xXS7R_puaet)P(d(@&`F%@@6I#=6R9X?i>^3rd^x>`#d{{3SO&&uo!~X?E#iTc z{g&%w57B!%gE@itB@6oF&QXud2X<(7#plb_;~)3LrxeUCPk7sVZ*2_LDzaoO=2`s~ z{o9Yuv;-XlqZSntSB{nYp$!Srn%B^5x*uBgBhyj0M_$TH0;2E7zB3&k?@Vdn{MB-g0dy4#tFDz zedUX;?8(bR=OXV+(ihAwS^9mFLc+(mng1Q5qyh|m{@qU+2QxR=R0C z#SWR7Z+Q{WKq*Gs=iN)w4)a~D^o4hxYxcI2@ys1LD;o{4rFaq2hw=O1gl)mY2d>GT zc)=@SO#FS(vpEB=<1vRL7zvK=ML0s<&0v@pWGdI2p+k zmK(2}BU3p^aae@pW$1PFQIps3hmYbhHST;Z<=-u<@w7p<(Qm)Cu$}#eIQC5f8(pB* zy|pSY!p8b)uDh!unQ*LIn}@W`1oWV5-*pW4_Wmr9=e@0&;JKFqqq)n}n<^nPJgpi| zS;s!cGI7E}vc5NF^%)2uOgF)#o26ymd)o1WCMf6d*2Ug-UPom9z5M=pHEM=I9#1n4 zp##walWbrw8V?nL&WzkSOkmT$@@MtfsF;FtkKX{fgb=#KZ!Pv$3(wvc5k0S}x+w7z z7BCaO+^mQle1?fSI**c(o1+e@#P#w9&CogO^2*4NHE8E#A75qrT5V|^jFwpR!%~`j zhWy*JP=Ijs*Q%&WpU;J-vO=5sbrkb=Z#TehXTA6I;rSTUFg~?MRW8J=0AYqvZKu*J-N8QNJPfsEh}Cr6Oa#kM`J0y( zg9oaKd$;p-gn1)hDTw5#KCv@+yb9O|8_p)nW6BH|fgJb0(l*m+1%kcJo;;D+`02wQ z{1{_VFtr>FanEMVCL+3C*YiSWVza4V^C$2x7Ty;?4{rTw8zzHDVlt&3%C7yMA4U~s zENwPbG&DJ`)N+PhxXg|TW%0PkXT9uw((X5%cV+ASO?2b4%<6+)lOU7P!hu)u^hxQV z;5UN@=WCfpIp47ZqGyjtL_{}|8to%CA#=@i=?M<}d?lxO90(uL)2f{q z>*?r8MZ;yrWq>E@G+b5+@j4Ei)!+;+e*5t3$7WY7&-)PAS*0SG6kjs4OxA&gy$EN4 zHNNAB$dbikvrS{?9bWtSWL}N;`50`wp*{E}*hY)*(C7B|H|b|iDgM8k7S1jX5DmLC zIUrzx6iw#ny83!fBM4!CK?iCGY1qIMK_Rq;oLEe@_G?yB7sC1wPxyfxS3-+ZR+|Wr zWpxxmi#u1zJ%TxW_M#^|9huxpTYHI&axmZGmshIQMK(-|m51~4C)e3~=1eLGAqXL2 z!CiP-taF3qCL8d=K2t=@42ucIZ!S>kl?Ag@G*sQ!TSswokUBL|C<2!yAURL>9ZWTt z&y*mQk*z%mMX?rEMx0{|CNQlo1uo)#Ct{@ERbYt2Rt5vV-6pm`P-N}r0cYYH*v48D zTYRCB@@NCe(rQJHBkb4>e@myK>7wwC-Hg;?{a4Rh;-bzJhugZ~>h#~I;2z6$I1>FD zV*1U3dI$pVB7iWY^yf!9vYbn$_>+vb2AgL^U+gz!5AFxIRXnl$Xg^3b9%fRjJ`Lw; z%XX~Lo?Vf8ZXGH-3(_a$KdDbjHLh^35+FIn4V>Mzd?}^LH~SMCLn?%?(n8=unx0p1 zCYSteD@%B}KZlb2Z`qDaTL)URQVZ1<29h0SoQ%R75lQkL-;~es!r(RL>37C-1+7N# z#d$jOD$k9X`Sh=k_e}k6Gw*6Iwy^>go(ECw#nDAHv9$zaJe*Dh^l=HT3nX zmT%QTRY_Tp7G(U2DMjhXe%q^j0X`Z_+SHb>oY>uDrA*Ce+VgB&W_y3%tScCiRLC5?Iv8Z0qf8IPqT5OV zB07nwT$fiY4bbk(jt9SAm7szUeo6ge6MEItCnstRptd-h!&$XW8xpSoZ{<6sMw?kE&xJ5f>YM;c3eNvUKrRK|-6-*JVIeWJDIp8rgw`W}ZcHoBHXx2; zzYjZlSb;kWy7+|G0)|qyA;}}MO;Mgazug&LvmPe56)l@J|LVht83O|8ee_qAut_gg z)U)z}DvmFtN*B`LdiL^txz-E&Ib&Y%8=(q8zI#g{xyqb_iWj`a0jk=Q5g?~2e{!pU z93YUWQzV70-3WPI7kZrJqNAdzFezZb>yv8okKP$nUZoZTX(8EkeYi6*i;edhjFe=hv|c!${tU zy!1u_pR5}ecLy#M2f>DS%&{xT#it2zSN>s_?YVZsw;`3s6eRb#Od%c11MyZcCPr`f zZ^zZ_eEQx`RD4edd_Bgaepatiu@J{`dK~Dbv*vuKUkK441&5rY(UO_MPRFbjl7(C{CGVrNSP7A!`Jp=AP_S7dHQ<%f&E#TL@qYNCRa311$Bvw?OpR zy!d;gcp4&5fVk93 z(ycAbIX&)cE55o_<_YoHEro;ll68!V@>-D!=Eo1y4+-y68wEs>Ve=Ba<;GG+D2x0s z@uv!>A@DUL>v%6%k38>2796ME&^|@6(IVn*a6!06(MoNIdN*bl)>=-pJy2usm%m=0 zJR6hl-0wOwS66gp_%m~eh-=`)bW7KKVkB9g{^UqBx0Y=KZLq#-)qJ7pjD#PS{}SlY5ol|(ZoG? zBf*g8HF9H8X%nbLlC)3eH?O)E$8X0mM>W4qIAO;pvHNM1PeC}>1(aRiHUcZoQ#H?T z%Nw>|e0}<1I_M61Hy`{$YwU2fI<7@vZT((DdwqH`pry**#eZi#!hcCg*V;i}KmLCB zkB$6%*=9z$HT-Hwbf1dQ88@cyM3d1J-Ff%(Iiq+fOV+Orkh&2yh(fw!UMj+{j3YoS zTN?DexxBzd-K>;(l#42D+v-68r0qkjd82^9>^uc-j67UiHr-e9sHwNGys5U$LJG9O zpgwf#X-p^LGOuE9DY(RIzy4W?PqXYBQ)Ax}hlqwxYAPCSa&XAu0bqm^2ZpD8|s{zTb~ zj^k5qPkh}sM#8h3{nmgmDQhIZutxjs(awi7vD{_!r$5_c^C`GSLEz!ag<;6x1sD&x z5*N0T&3)UF73e%1(lVj)gFRtsKGWE|H3e-HqSW7%H|etL*_tw`?$|VJ%p^A#tUll} z=jW64u)OQXB=Q&_J^H;lZxby(|9IP)=bOUTXRsFix#*(YcjgM`G*2+rZLxV(CNmfC zl|gsJ#Sce?;DL zb%X{}orfjGyf=}PG}sAwnL?7rlGG=xAE5VVC*Ru#vae0n9ZHB^2dHvcN>wk??t25u&p=}LO-39N(@0MiS21M;aYF`7Iy?X zu?`eoO|v`@MhY3J!^==|B4t z!BcHsM0mN(n3hobdL;OieTQvjI>A2*aSL<9I>zMpo^O23s32SR3tUJmZrD5zCknUA zg7YwoR4H}Y(A_3qTjQ{4gh4%|XTM=-v?G_Nxju^2XO(~SzDMZRbwpIz4a2-`NA#EN z!AhM8*4AOTpk?)TAFI0xC?t8C%A9Q#R|UyywfY^HeO@oD+Ulo?@bGujiMIfvrMLyw z>fPgczlop1`6NcERO4h7MPcy8Z0!yQ;ATXnfJB7u?xF$Gb4bIgOuGpueLeMkO)`Cb z_Zin$kuPrs?D*^=Y)(&gz`p=M29EsD)cod&vJDuFK?UJ|aAb8@%BCo&Qu=uM#lv}r zaCm_r@2&rCKM=ipq`(G$wv%Gxfis*o6}`7j74`LFs-b?z$F$0s(U(g>6z%DG)7`v5 zivoD@ZllL#EmyRgOBs37tIpGMW-i{1!6??dB7~Sov$5z0&o^BkAxW|Kok2+{pl(;%O%u+Bgk7gJf!_Cp1n8<9GkxZQ}~h?1Z$J+_PISZs91{b z^-3gc#DIV7bC6O!DGeDh?8_)?=~k(Bnb3B~5(?$){b7XLw`xBZ1s={3`?g1^XJ zgU!Va2?3dHR+6=*q^apFKmv7_*V4Dm4BuK|V_iMcnAy9QPFE;W#HaKJC98sveL@Vv z^z)*IxAi)}qWEER?21GGvaiGt6x$mPeU){dG zP~>x*)6UxlpK<<23$RSTn-}5|;cd{6rB~Amm>qM+I|K+Ro>_xu=Lqi_=Tb-6TLN6bZ~HBD}cwOC6`Oi#-*x+ z7PtlmgH5(SA_|~zpeYH$#M4Q46xaM3Orv4RQOnW61-q#TECjdyC&^6sG;u64KyTnKxFov5V zBpA_ELlF2Lk-1VXi^7mBNul(n>cmqWnFH%^Pq>J@RXq)SyYfJ~ zDRE=jo7tTi8T44RNNWd6nCR&x#~FLn#A5b5yVr|Se+w-!b~-wmjG)!8zxz}i7)gpM zG;QAnbHu77_u)@4P#cTF9m)vU%3@`OoeSL-6@@RcWp$NET(OHHvPh%+WdNo5b`3)# z2ajf81LdCnr<$v=eM{U)!^$Eb){5ds7@Pw6)GLo~=r0|QPmz{CQ>ymq!YRgfjSECo{CRU)rgWxF7Eg2driJZGK8nx_^1POXo7t ziiM?6MJ4fH@(u>O?ucq0KSC16FBCIH;QvNxiLy_S{gD;`R8DpNU&0LF%-+)eqdX-g z3m6&xR|O-$;Qn9vvj2@;_dwXu0p10(^JHTf@C#x$G>gz%yCGRzr}2HpX2g+wCqv|Z zXX9lCO92Ma?|vLypOXUrmGT>7(geUVOHIkIIsXW>o?dqJ{#c?OkxOWbpWW;?v$Knf z%>ZEMSIiMi3%H6f+di!@>x&+3UE9jl^*-@?n0Kh5E^gngXu-^20y!G}%vinG_;nCV z#C0;ayT9MJPwttOWDndR?>{%7#5Vz00M|43Wmm!B7k|AL;PQB{Q;25%xaGa%eB1Nl z$?s@vT9t{7zw=}G>9%gnhJ_Wu{7DA~LFWM7(9)8{??fe&O7up`?CZz(*d_k|(a<0@ zWCO^t@*o<$R%E%+a5{@;It!EfZ)DMn>I94cgYf1BF_IE@se-wGiXYD4*mQh+W-V1w zaFxGEwN@;y3NyjXV98`-`lBOtTaO&$p3!miw7k4r@l^`wb28_<*^0=wWdBS-dg%K6 z_BbJ6{bcyF8ERWM1dXkC-#r6GytPl;A}38rSO5s0^2eRsG`gD?y1}H=?>)$h!O3|6 z`N^C=r-6>B|I^Xn$Aq3$ww)_4EyjIBD1C1kn#UW$;LsQ?b$W zJn)Dadd?^;Ed63>MB~7tSd;PovsWNO51V)B$iZV0WWkjo4)2<)vzZ;A7g|<)0nCI+ zPdG+xEn(xr_>&x=O!uwPoMC`~(OnEqmSewR;!@j>mUUDACo-ZbTk4uBQHK@urDOH5 zd%`v{yecLIKXT|jn?DH0Ai0_u5Y@NiEtSsQ+FK&EX#6tk9kJa2?4l`86=a#YvWmKc|o`P!&bn3 zgv+P^{ozdiwEnP7X)-7EVnt*teeCv#>CPW*0Ps%<)xYrqEY<%+?e%|X@lyRic=Z2` z`@;Y4yDmVrn`t#GXnFZZvB0_d-|H3rzs~a@do->i|B+-e^+J*a718msBSIurtsX$G zt$g}6Y^p!`Iv@_c&=f(X@6IRS%UN3mcFM` zI%={kH`j}d?~A{CrDH9l__&CoaC+i6Xb!*2M&m~Q!X1GzM?g7lvtEbUaER(g?Jiq) zV*r?{D855X&_*@Qyij1c;9el0grUOj<*5xJrewvxvF*+O%<+=?aWHO=gQ44w(wPr5 zKX-2(K@mTAVf1+@!wk#X_mIn-Eu2KHd>R% zZ=HD|PPaof;=Y-kOsP2xYtyb+Kk_2RPPtxj%_mDS>+XV%CWIJ$1I;b6D|9Z~j3hQu zcKm7arF&bG*4Zl8H5#f$!ihIJOBMnh$^=TluA~5&&)DM(nC-$*MX0~wFd>Nc|B=Vlx8eKG z?eXoj4@f-i#>eS^yL%UTU8QF?K^(1?$4cNDBp}9t%(re^$I*Ngp&rKaR;%Ku_VvA+ zN~mK7OLjL9)gTwKHJ76BG3cPNs(owYaags>J?LDaFD?(Z!$)Gm>qia()!=~&S&t>2*vr#QEH55dTS_@vkr?$dzL zU)J$cnA;DWbh;UA+rhi`m#c^LhvLG^^ya74{Flyb7e+N7 zA_))|AiE|myvA&(%Y_Yb{3I;&HNQ+oVwo;$fOqh4>hP#T9j1^wzT!Bw40YC!nEFL< zd+X+rw}AOZF4c@IS@t64H0unj`32`0$@&Gtc$mORF1$KP8t2 z0cUYt{D@gY5 z%&t_Z(2&`H#pwpEh2mL*4y6N%zmp-n^C48i{UlF$FtfCNkvG!04g)p z1x}Arj;W65DxzW~5z#uu_NN4Vyk4yqJJ*%45ww)gY<2WuS zY#?DkQiz>&o*7PvHJn+@>J=tg)huf{3z6a9ZF`h$FUwriWRq)-&+NOc_oFGqQJlcz zZH^frWi7BD*Av!X_i;Df)DN0!CYV-AH9>iP%~vwQI^dk?mV@xS8A?qnHB9(IWHjX7 z3~w4%PminCe)v*#kJD9j*3=a9_F7lU5ouZM_1{2aX8JwAh^+cwa1*$2VXzeQ4aMHRS#A zfO8Yfdnctp6HY~G;qBnHh~rz@8Gep1ui^en@9Xq$in^A zZh}-i;axU7>yjZ+81j76$MzX|PMkZ}mke?T4^2jk3HyP0+lu^S-3`Z2dg7!0_iS*T zQtaz=_%V3pi$pUsr`iwbSt)n&J7f2xX=uti2m~=0T|AL6v}@xZOZFUq67RC*QTNV? zdcJ46HutW!tTp4;h|dfb`+@rbXunu5)kmm$&ELLb&5HLhfOsi{kIN}Ng^gJol8@+; zsm3MlN5KOTDq67&?PJ}&o0Z~J7`PKCv=hyzz3{M@J0`a8zUN)-(y5m*nE{Uv%`x?n z?F^5o7A-tUs8ofv;u3%THK5TPOatr$w2>)?2SK*_mv9EMeX6hTI^Y0AlcL9*OVj4rl0AnW-GU z_7HZ2>5raF8NhCLCd0&H`unW4^N?z(f9)3Cpp_T0GvY(2J3Z)SF=7n8FK*nAf44V? zzu5Iv$bPNlZY|U8mlyZ1IJ2?MpP`j^RC!L`SMKW`tv|SeO^6VmrB_Wr19F^6W`%y@ z<>krg5Hc*XfqsalDIoCwXnsb!Xx=1J@NpwqmmU&z|9bd*8l172*q6duwPwegk)I*I zzNNFrRr#hDf~QuykZj zy>ijo9@C*Kj_jE2%t6IvoJ%(0xKPtIhoqy`AFY3}99GVfEQ5DFn(ibWPPA>p!N&H= z1M)S(l}Ad2-43nQZu(7x1_qQK&XLPIP+jgkD*A0g?ri*f6DW9l@P)|lIY2r!6t?;m z_oL^b0Y8VRAKY-;U2J2QGK|mLRF1!D=#qlvah>Ua^XQooDvor~7#s8 zLU`d7b^%;ZE<=2@2su0&eT?;YmZEkApV+^?X}tTI{D8I^1O`)W;zxDU7YFvu+|i0= z&lZh*54hhF!mVNiRNxTbCA8C?UX-(&-uPgdOw2BxDsqM7NQ=naDZumOl(+JUME|4> z=Eu@fAI>81b{duI(BsMoXzMntW0UuVo%=3t>oiaI&h~J}GTo;&@xbvYX07$k-{2&a zDUS;rN}9((UrS>EnF<{pVU5#^d`?j?r`}tELV%%1`M`32<$;JB2;V_1eSw~xU|Az2 zR846A`JrXJ!Z3Kw8!NnLT(ek6^6B7S(}0N~f43iflLSrKwFOVR{A}BmUpb*a(&k3h zN=&#T$^HE(wdm`FuHGq2?6w2VS_I9QtVZuveyP`efkWE(_FVC zb&S)7NOKWN1HkXc6xNfIXl*?uDp<`cX&-xkV2uXI(k0)+$sAk(8(38Ln3y+-DszC8 z)P=>jWxqq@Enj?wI=6h!n|FZ6G@(-6MK%0AkE)vyOM2dN!9}Q>Al|g7V(YFsFfIboNp%4&+%f|o7yrNz} zArko`V(jZCAzw+CQg@C&tGYmX=uNvk9BSu;fQsciov)!0%C z)a`gixWAS{xna#oAyZO!h37a9qzL`$1J-jAcF{g1rz}}7wT;(qs25n!2Y3tE z>I8u0;{e)>z9S;wexKHElAkb{oC6@q|HkSPw1LAqVeoCI*VDA4~}_iqU_*{0oZ~ zd|)UJLl?)gX@5x2J0I@gyi+gcFdCK?Z1zY(VTsM&05GSvZG>$2a&Pz~HUnwT)B7{D zwJg2)PB4*=*9n#`><41Q(flqxz8w>hT{vs;pZozJWgtUCXRveMH+81+va=WMs^OtE zK8)w}nDTwA7p}_PHcLF{5{&aChTQ$WDO=?5X@pY2MI%FBSHy=V&%@S`IV6MiqlCPn zJ?#OG!e_s=doCZ28U10qgbDrtf2zz-@&51dr3nCMrc;nyyKn8rXfAmy^9fqu2L@8U zL)Z9h3n%e0-d}eotOt#yX(K)t76#;ePWYn=Y--fy@vYCs^qj`$B@zMJ`0 zwr>#3geIFKxRa;wcC6d2yQgKeJXzVsth{|gTVg+9TAR^?y>)y>>U6XhOe>5z_N#* z>GgX!f0=!m&eR&>`P*7UxFO*E4FvgO^UyfC=JfRY6vE;(kDEPuc zrs?a2sD#UvDDM+npG2PBaC_N5umzP`&WqZ_psd5S3OrGK-xv2dSk>#KSf74oSI52= zu89^hZZZ7O#j-M-31R_-NR8CO^zhpeO^ElR7rGdSH*kGsTLnY6z?D_L`v%LO(T>U+ z(UxwF2(y7B9Vl<{fH@Ad&g5MhF2}kL#%o9PJ$oIE)X^5|QsEm}jz~K{-8b`$xpn=N zJKY;9qePu|nfsl;9$R->-_el?>%AAILi^pz5_k%;AP2+_&m)c2)8e@6;)uV!10fQp z7SCknVOyF3bZ8_+G-(~olK$BzW zEt>r~KF!{XKd@cW8znKc67ql>(8;OO!KbYp?48Hx3n;Ptz~CLd>#JFvY4ci|v&cHH z5|mea5T)V;ueDzG6^-VYmCnH?@;p)a>)oBl>l3j2ErqK>HcLSRX-RIjrOOPD2nJ9% z1p!DHeyXS54ZA}4!G#&4a)Zsp4jiy1ud(D!K8YsJJL?g?u%!7oMdoWK{otQ7TWzzDo)kDb-x{ z@OyFpE&XUh0cAI-`0t=UFJ>+RCFvlvHAA?EY%3tFrGCU@cI>cs@`uWCE=JjzUk={b zK72oympwI_g|fNk7V#Y4o-qacJ+4BNNNZ@*9qsI%<>qjn!RWPB#z_qlTMuVHhrI1f zYgki_d8{knzXwPKRy$lycQG3nscb7~Aa}dNb3`va^w6a5n@c9oFbj$S0`TPhL16?Lh{PCj&CT8MhH}l zj4*!Gq<|b2d({KHBXCDSLLlTfTyd~mlB~m~+?;>|^RbprBis@Zd-*r3N^lpVJv&RS zz1S3>wAq??6M5j`aG8UpXKSOT;}+Mti~sU@KL-Kk=cqo~eWx<)b(_(#Nx$Tq<5O>2 z@Od7(^Mw7NVFBt?JZ*d~iJ=~!J(}w5c4_{zkF&TurgO}Gh(PJel` z>>J)+n;W$J1RMs)Jj}NcDMb^I?n6~L#zKpsGm8sB?m%%-g2}@sdxoDE?e{0s*`^yA zY(Q_IwW5INQ~c3Fch0??#m)~PTQksP<8Lmsa!reWoqqY8hR?}g?E7KZcg^!ZXN;0u z1dcnncOn3_+WwM!k;t*|u*%}n-%wPuvN7&7fyZEf7G}Zg;2nL=M&9+5w&pKy<+Y^x zL;P9ElZGnsdk<_(Jk83B0kRN~lzd8IVFNQ{>_C4NW7M>Y=6BSG?Qr323UC|n#d6D*=U}31T zQaiC>VGY+sCFGrrXFW9v+FnHd@LvN}D@>gf5C5So$X6Jc1?Cn3>6)wDwJN;Sr*d^kqI)l&WAZWW!n!Rp=kjqIt zCg6Y61UReFx9$p_FQw-}Vnv#sq-)Cc(Q@Y#R(w=m#xx$wP1dUMh{iE_q zo<4d6#aqo6D3iw=zx9kR{2pGN)DJkA$#4%iA^jbRz5aWx~7cmuh27_0$jDD5qD z-6KmdG#TLs_Wk)uEG06BH82}^NXGkh0_xxKc|8zM&d<*aP2?oLDYBp^nXbq;+i0t` zU+nP@bSicp5dm%FL!mijm#1|K{+;UPPv}OSPr_(pv}+A9)fczAqA{`?*gby5KBnP4 zmcd9M(LDU;BFnz;bxhuo>;lhi2W?*zPYP4V5LSIac)$%*n|m~q{i#Tq@;}Zi64G^({kzmT2cs*`4y>vbDWCxycZsm6f=fRCG@h}R{(&{k$ZAr@!cU*tb(>znJAf` zMcJ(Q&uU+b#aJ)v#E#*AwhQb+(qtE#0&-I;Pgqa^EL%v*#)rp4?eE6;H7*$cU6=Cb zNoi)mqkVGsN{YO4{+EDU+_^q^9f2nqTR6Rx%elcQbtXAUw4rkG_2N!qvfa~)B2w6yAP)CYeM*w^V%3{Nd+AsJ>)nWPdi@z?F066s-p!B!B?ZTr0JZ1Z+6z!j4Wh@S1 zuUlE39nh7T;5$9NC*(EY7J-eq&f26OHYmXn#Q4>(8p=rzLB`&I9j8=`zH}bgjqXM? zwG|!B6?Sfqjqzav3QlKS>x*Q+*@M2r;U<502F;IG#LdXh6r>(;K%f+WP<7rWeVP$Z zdQ@#!8w2BcMmEnupvzyqQSKc%iC?p#t7jaX164-i1;_m&qGz&7QEVy1an_+BX6ewO z^oWTRP<9( z*vuEUSi#p_Zj7HNoSXh3XP(4_sI(I0pFyBd;=b*$c)J^PTzMSg@^0~_4i`*L-wXbh1RDleJP1)U6~Yw@#x z6vZ+UA1yN#D#xFfK>hiPVCw`<*8UKfk#9iamV~{m+xUB!_FsEU2GkeU>c{w~T*VKgfAuBI0fJ%c(@h9ZC(QE4rjv_T0D=ef*Lo z#f=yvwGA(c8>3dn0`9HGdD8(*I~wU}-*+VzXOq82qO4i1NCB$0{U_Nl4$_rY=L6N? z&^~gs$NcLfA>%79wmCqd#4;Dv=SXtrFjWQQSx+H45@LR9tAa&(BmJT)&@>Ny6i+{^ z?(30ap9=4BNNgfKP<>%A^|3D51vjuKfqL_B*JLnm<&aRaNt`3**v97Xod*r$0Kxn| z*|xImr$2#bl3}eV2N${H^YVlVy|gF>>BaC7-Ao~yep!#d+1aL&Rz9-tIB}i(^RcCO zd$=N2k1PI87H6|nVVEr5#NRK^z{W2B`@I!FoX1%Be`g@qA8I@voRrf%79W;s8be&s z+{p9@1cSxt-w|8>bZve;o*qBWv)`lpLN}yAiF)7N#p7JgUw(|`JlaqYui#8$YTU3S_MKM)W1I?BCWqgbFjoh0Amt=4X_?D1RmeWgw0*l-& z*`>lIC&i`6#qXp^lmPew7dUR3VEo75a33kLYyW(J!-)Eb_~(dLS1Kne>iH+gT@Z0*D3Qz>_o2&GRTD)FK1hMqRHwfYZk7ph)v-D?prYw}iop8V z^T*lewU&4XAD@ac%!58oRQpK7-)VnuP+b&swXx7)*Qj0QUy%@d`^i z1eSgd6ZuFP@|xeF9-mZ(E=o=Ja)}bLYhIyh7f_`$;O8<GTeQLsOb20x6Iyt{Rp!~fn2A3Es>-;hvm@KvT>bbLm zpW|=-oVZ3svrC_7{GupMVd(EHvl70H-eV(6k;+KqOjOS9vJdHTmxQd_PVQ z%Ph8--czq2xOx~vVqg(j3*S5fmGKyoS3XZvzTb1FSZZ6-&i=9ZQlhW<^CAObL{vFSLBf7ez1)=V4jq>SI{kx7Ud zjW?bSBKbARmhAQ2Wn_*i<3mIW#m)tn_kFDk;K46cx=H!ioM=N8Q-rj3{`5 z-$Aa~;Pg@{f4Hce&4we-ZNEW{ZQ)`xUa7}zq`CzB#@t>zl9s-ZFY1(7=?AUKd#Ao? z&=Y}Ydsq8Q;R)w{XW%o1g`Q@D6x8_4@?);P=S*cJAVK>~pwGyFLD zrP*i!<@(>pa?oiq-8Qm5%(q)49K*q9MNbvbZ?hllbG|KgT+-rqCMifP^b?SppU<_BImB)gzw2O`pU+<@K}Bsnz8b}UT{HY$JG|leTZVt{3;FnZ_}bsU zu9Qr1XY;hjVTj=0N1+V-`{YrR@&t2U!{b{ z7MXJc6{Y-l?9w9FxzzQn{uzGn($NpWCDDWd7h=7o@?0BMz%e0Mb$8b@4pz*HQe?%)sgNESu@3(J0dm3(e z8h#$mX@|XR6f1@ot4-_IK5tMf*Lb$ARm;QX1J4YSl}LvUJ27Q`=}oz#cl!zT%dpD4 zb;+dTZ9RV8u^r2b<^&q`+m6o@pJP?n`1Mb|1A`6KPsxL=$TpD^uU?}vJz|k@XZ{%> zQ<&QDKp{ou_Q7{W_T}4b2%SxjT22sNC?Mz|D>DDg({PTaBY9sVIT6*hd+4|NkM%S^ z8z;6mX+PG}trB2YV3%!IILU*(Y-Z;?dRkWDJMr*Hq35-NuDt4B(=F>?&b4-pQ1;Zi zFsoAF&67gJuSBm1a?*8w$lEFNg?9X;H@)*dt`&LkS(t)5A;oXtW@8#_^0>|db$!?? z;iGBf!z7-EV`-vg-N2jw-1J|s3_oamy#BRdJPvqnj9x;-$Pi}1Sr9GMix?j|<^1FqKns~Knwb>@L(?JP|Ermt1=-Vm=EoeWIA^d_VrJ>tCgP3E?L zXZX_|0j;sPrC~^_s(CQ_dKh3L2V7j+{|R}xQ=G(eIg#9h;?1Aly&~k z!+YZt0$h)FCzGKI6Se^`@W}-;rS?`Ic3E@$j$G?yk4v-rcxsC}Jv#lK!4! z#~eHF54`k0&1XJ6?I}kyoYn%o2b;?LCe62PocY^OssuM5Z1>vmkOlaSzJlJHC3r}{ z^!L1zYcz7%HRk|z{5l>UwdFq=T-r~mHP8ZD*UXXW`-3mSGS2R2XXN38SUaxSC+g5$ z27BJ8OQJwKgX3xB*{kO7C>@H#4C^t@6qCgLA~*F89UL#6sm9$tKQ8yn9ui(MDT(I< zyN#fz0E^8&tSs(OMmf4IQ1rPW@s51dHF|@NyktSXce0iSFc~GKBE9dkFPYfxRmw_h zMqS_O;OX<3yOlGQVyVKOAeEBGtUUMfMu0)bwPU#L@`cPj777jFR8D0Faxy3+V|jKX zX8B@y8<_c!k+)X@nMN5uI5Le%Wszty!)x@g7oZ$n};zJadqKbdqpk$E?E8k!P#SY*}gtR~+cuH!GG&%C5 zpKzkef-mJ*)de9 zb#J5?TmJTOBPHCfap&-^tE*u`m+53Xg=U^w=Yx`^g4JlsYb^7HM9kNsWLHq=7X&o+ z3Jm@x#CmMGaN5Q@fJoUoGsRHjk58*}gQSTeQ|a*_u>O^H0Dvdv^^*^9dH=#@PVi722lqZ8s`#oOnr7dkV-&58-*l55JDUg#5)pQChKEBDsnnCG+7WL3#sPlbx@ zr8nvoKG`KdHq6F3D;W5S5^Ejz3?xt&cJga-Ko@xYbPk4itVqV7d`4s6{KGaiBW^d| zDXhK8Y37C(t~vS$a_OhR1K%$pU5nDmKx-Xl`>$nsKjXsaaqKHZd?OslMhdL;*Lb2~ z!Jq|6m=594WpmKktKgp6ggwv*&^B;%0sIqG$q^ryG8aw5R32eUfE=fpq#3YQch@ip z1wUt610(BNEA^a-0}aK0`jU1no%3uR)j!?RR*|qZOm&Jm_jBLnIqVw5It==HSoMq3 zXfG61O!#DF=dMZVmkyb_SqzqG+`IDl+TH^WUvUa0vGE;=6O!{IDuxN8Xw0Z3Hb{Gd z)sYTye8hQl&R90lHqR81!s=Dx-(!0STT5|NCGk)oJ(H?OS^7ASgY^Q9F88ohaoaMP zf1}yw^JfYzVj&3N00GXyS#bUM<;64%*RRGnypVBfi~Hevp+0uxU`lxSdY_kmlsvHC zM}Y)C`do4D{5Dss2lVDK!$e~0T;onJrqT`ic|SY zDv>-+M%cNieKlzr{8w6uiHYfC>oM0!tE+##+{L!+Rwrkd&*HL=)a1w5p9!S)=dYwj z$9V4QOuc_&v{JtX@v2a?^`i)~3m2569h*cqyfTZHD2aW@pgH9aIz)-ic^MfSaS9$) z3wB;8Y~NL&oi8Slx}2NJ`s?G6MdjQGA;VR)*A-gBH9e?Oqizd|(1ba=T3aK2GwR;tjNT!y`pM$)zNjYourEWtE_$ z1joha>9rob&bab!LdZVk+)!8J(w?-~&*-B-8&yQY8(%|iS2$?x$OT&T5coCPH4(I) z!30T_#?BZgDXjG#q=Gn;O)6+;5uMqWnjPlRMU47+YO~a1AU)P@=xV8-U0`;5%8&?X zP5a99jNg4poMURp_EzJ$fd}{9ZTV8yv1E-jbIzv`v`6z{EE8kgD(~ zC8Lae*5EvI1!5PYa>fV%W^rXybM`VcF{F50U}geJ*6xwZ{7bFF(P74mQf?C(D$V=8 z?Ft*%nW1qCpYn0NW^1jtS5L+ZL>X??P|vpI%DRd;lvW>lWGrE3XlEE1UH2Vfe&xJc+K zrnRg!AJXy8eQV6jv~0kKXL3&TOH8zL6ZGxTeTi?b-qmtpnaL!kdS~esTQ`-e5>Do9 zH@BFz%D=KSFs0LEdd#yt4osp35&{$wJC%?`Q2-IMJLD&#v2F%l+`{2_%vHIu~ zOHnh0l0$-+j%rEI z{_NNIqWL-D=^!jwM1@(d?Nb$ZE-g${Jmt{$&1UB==0=wjCY<$-!d#7bS^mPA|0&Uv z$a=?JA$WnSgh<)3$YT>9g?HUD2`mnsVL9-oI(fCrV!itEfR~P#X4BKlO4S9+8(&xU zi(VveGon*2x>UNT8=hYlV~(?mil~%eKYjs=zH#|y0eYNMXZk)%j?xJ0t3q6$;mp(m zG20O@IjLC)8Vw_CLR{oNe_oQ`OF-swo!GMO7TpWuj4(^<)BQ3pJSjgYT`5j*J!DSjPqR`g_5)X&-r>cHyw_0F z!TzM@5_Rpvu7&tn_}#kFW{il!Xe6`B z$Xc-0>*jw;fD7 zKsI(iiXf9~T2G-oh(bn|x4e`rW|hX5ZkI{4&Hjg4vVszh0o%rZ!eLriU*u7L8wT1F zV2yZ?a()*Dv)x`o-}bZFNI&u1GprLiIYx!z+rzc!b_;x!j52lc>t_D=&$;E8s2SW; zhz|SaH5SU`_ehE!q=lWnsnNMnu%mwAQR4itlyA}&=`xp`nWK|pa5H{=!}k)cVbkd} zYk%{ZjTqsxUIXzayG4vAcZFl+3>3;Yv^|B6H2k7t6fD>=5F*>*iW-P1s1E-FCJO2a zQnBR{F)0=O;;^>3ojhrS3?oxTPT`Js?t?95j=r%WF;bfsUlja=FQ-*>epf4`WuJ#H zBl}YXNw;jDJ=IK=5(~fs~Bf1JBI|3tfkqv2m!XRWe+E2cs8Gv)dxA+3ZBm z%d|mr;qr$e$qvo%ihqAS3t*n7ugo*FoXCCga{+_cQx#Y*YgfUYnD)yev$BiE@~?;Tg+vTyq=ZkLO;^`W0E4n$Vg6EbM)J0^*S=A;NYRb zFF2`D<8l~z58*iK*h@7K7t5ACZgS5AAP`xm=5 zYFtDT4%55qczKL}zSHG+WYt4;{7qnE--!GatAabRbgZ=*pe;8z_#On`TA*m^c>I?4 zuv!puUKJ!*X>xiHAw&o@pOYhT{0M;^TIeYDhS;NIBBU1bAqhe@+xrzk8rk}u@Ik4C zKUh7zx#I1GgA%?b$NsvhV|fz0u=PxhL)@&^IG6om?Ea1Wu~Iv%d}Hb@E2q+j!f;ZOav9zFCaA1LAS(k@NTOmW=? zPs4n$sL;&a8Q2r-JdI%?QyM+bg`lVY99CJne+R<4O{aNc~z>)DUltD9_vHQvr)CN zKb!)u!9=+Q#P#rouV1~a3C1~b#({9%pbcMU_}-24{Z=42s%S2G1><=bd>EE@Im=n} z;P$toOs&F@^`OGMJ_=O^{$Q8M#1})Ou#Jn&D^#Z!Cbm z_}HGH(fv*XCDqB2%!;j#wpb3~dJj*eGvNDx^9`X+bv8Xq=_3IPgEb`Hlw2anvkKKY zEb}(07De-KY~y2{L+4F=`xCzH`n}A?p(ZVCQH=H<8Kk^dc&hB93DfYU%p#TeGMak` zC%hLrbL`X_Ug-{#wtHf=DA=Uu&y}X5Tv##;3pQ7P)na8RBLW>pRH21I6)H*~2Mw3s zft~u~CbOmK12WMa3vvtDGr6Z)>vvUCxgYwZg)gWosD?INDd7v>XMUGY2h5z6nZ8@Y zrLv850lrsZS~`ZqLfC!=#K6O( zR(YY00Y`I{*QINzG{gcDz&g_bd3Ry^M(!4w=+?_-L6<;Hf`pl(4Dd8Y%*@1~`;~B;KG*sdM5VVWFNG+&d<@#=q`WH<`mB^k+ysqWHmqY`PPG4>J55-aDF^yd zmR8SM_FBXHo^=p1P%R0bQ~)Y%u_NBDzW{ZRd1;|4>()E%k`v!4oLnn(c5N0w**`^) zAI(0<9U>>hD{;~Kc~o_W!*=6llEb7{AInzV#QLHOGTqQux^YXU2rRo!PO2c+wtiQR zvcve`Pd;~}oxxH;!(a!|7CdivCW?q_K7$saGJjA~G@qh;KQ(79UsRV1`9{?3bxn57 zoiFs!2-5Am3Aw-zvWU7~a-D&>QX${y=uBGtRO1W_t$@fGmwL4yJ(EMlv~Nn6f+`{k zrPtrU?;1eo;4h?@S*d1E)M5UfNEZ{KN9BgPOALnMMocqcL8W{4L0B5U-lH^bj(Nz8 zhX9Mid%#pG0B)t*zNc|ssjHvthFXg{CetHpUAb>fO*|i*a-PW$bWTDKnF^`-=}MQ# zuQPen>E!_tomo1cfm=42zDIivfWFH*^OZuEmsIDfL`(YmV^S6yc{WQh5+x^6huLjy zaR<%V_O{LD>K~sB>)vT9MFn#qoukrA-L$DgbjojhC2sW8FFA7sykPASZyivVa2lXs zkI~vj6Rt&t3oY-oQNkU*i~Lw8iI)D&4T5CXgi>d%z9Zf#!ls0RSTSOc{Q+%nBi)x- zUX?s^t55`8YRRItt3%-{%5bJW&E$#GS@3D{E<*YufSBfb5~jnL+ZT-v+3yt665)=!$(OJmy zhg8|+1}D!FX>V?JxwobV)*@26DY|QeSYR>W=>8n#4u3O$uNs=e;>M??0*}m(nJ-j| z45>hdS*0tQYk;@N@^biEn*zVa9OI>t7gg)oC?{@UJ7K+955xVLXJ@=3OSGU>c$lYzoc7P>lx!O@=se&q`PCii_G6KGby-h1lm+S zU6f4=#!|LCr4Jr%e-^)S#szL6eKldt={Re{&vDn7t`1peG-=Je<@R`29P`QMD!2n; zn^>KhK9Ul-%-fGCQ1=td%^$yb_&DW<2JF2>A@2I|43qWELxgi(i#@lk!3i$$VQ~`W z9WJx$6K+wBeF$ZCp9KnP{O9%))wDN@>grS;2D>WX=%xsQin{4L*V{rJQk58K`E{GA zkA$`nmJ?*w|ki_KkuI=Y40cv-@kej&0*2VA`9q%-HZ4 zc9n@N0_3?1CG44p6fJ(2`whMU_NQwO4f?AoTV6!pNt!`*p$jQId8pcEmnvY6c~^}; zQQ^@(d`XPwCB*;7vE`AyAr>ZDzuEFb9$sjK4%CHV9w8TkOD|3sE2>Cxh9v5Z#%fJ? z&ivG0iAIK{cR7q^+xJGdP7uG+toOYiSB+Naug#z22aEz$li>W$?l2ZRo1AgRetw0V;9T@m$} zPRNfX)Iu6%`IFzOT@wT`2dHCRYJTU_{F~a$r@tCi$|t)tMigIoEI`)iD|8I*=k+U+ zK(BiXqWK9Zlfs^mmN^e`T_l_I+Ol|(-&|?B8C~BK_@&x9Mq6CB9GSuUxV5%u7hYv^ z`Tb>P!i2vQHukHmrt_9IYil2)V+kci@HS8CG?%*J~{1M&4tu9-wucMhR%4Y?co(5b~yll4E>INf~3^P;oI7piev1=lNi^$NFt2$ zEI7Jal>|5yXQcc6IdOnt#ZMrnHVXELz?LEV4fh4-o^Cr3t@|288KVuGYV0BsXQPPo zksw`|qd8kZzL{NDgHIOC`|`uH{f)24^_)VpK~C93x?pUjw)I26{uzLO?QEb>&Qvd| z>0iPxJb?2O;Fr#u`EHG;N9#5B zP&AY^D83Pyz+h!D*##$rUp5=hyt*gUd&++=9g4B)y&iX$gi**jaW*tV{>&_grBeWj zmxf(xoAobivt9eCVA-P$BD^#LpcswXVcxws3R2khGj~>YRBM$<@f;ep+MQfkXfjhH zRe}r!$zq>nvpP#?WfMsjvtll@7%+k;Zn}Aa99Bg61o3Xd@ugvtSwiCw7%L(GB%eIi zm>YdMEOA}ke&?6Le%h`K85PLPWKR)Y(hgJx=$814#dwQ~*%Csila@%a+c)f;0e=_y zT$c~ftY5rNdINcjzB4dENA^#wmNy6#dIu_oS|)iF#9DUKOf<(V61+{{k0U;gK{+9( z>WwNzXrn5<#&fsn338iEmVvr5=_lZV!Buc>JON#v@2`A}hEYFLmxh4D-1vXoG9()l&1b;+kJwZWj%0F2;md zNL^%zn3%sISZLMF{naNLc#(uFUAR;}N8Y8;k_U2nH7~Q>xP(T&>tg=#!QYCwCESXA41@r-cIDUpj-s-z=+9S#48 z+xjRgYc0UaJxXF`oTrTPG`Z|4G~}-jZ%?<}+U4dtMRh^X_C*||DpjOTi)<$#iBGaB z6Rf@8MW{O51#+gtGT#}l;jR4ou6*?$9__8ttFL(hDb4>5i}ClT|1#j~{}tBpA5G;@ z6g=5~e->ripZ((9Nx4*hk2O#_Uv>R`m!D#QV508&xNQKdF4YQtZ!z`)>C@L z%`D`xYc$U*4h&EmsJ7c#cX-UIp>h=-yU>6ITr88Sdi{q*+;M#>BcG={gpGdco(a1QN!LSm(0%6c@mkFn0QCbxHS(fcN|yY z=6rA-TVRzrs2OA%aP7%8D2o zVI0y9@Xidz>NO!`FQu$cO*H-}?+z))UM?gDyY%hqo#0|FzIS;*U@TwOB=JJlWdZch z+da@1I%*`PR{FOD*QHIZ_7>tbElp^!Z}!Oi%N_xb#@&evJDC?`_Jw2iH1EhPhwtfX zZ+Xs~Q6=%vaMLOmlJ9*;Iy9&w-q8?F_7XnMc`zbDR4}GkG_b`E7C>PX$d6S%6zJzz zg?x>@L9Qd*8q4`mYaFBZR;_Io0LXEIf8SEd&Xc-LuTzq`}*`zuDkPFGAD5{TxlIwb{rlUnK zF0al}^80V9tb9+y&J|sePw}5m*KQw{vVMiYvwt2b$chvFY9t>pLqdAH=)yh9Pv!|j z-T@_<;ojz!2z<&%3NxjXK|;y9B7_g<01R0T$%UNI+9L{H2b=3oLY}&)+eq}DvUqMm z)C;L*l*$LE)N5Y|sXWKq8D1O;2#`tmOHuGLkonnQvSsJ72~uM18)r4$Cc+=!)j z?5=ymVZ3K_MD#BN31QMUly{8<{92re{R)s_EHQV2T_Y_K3jQJ|1ytt+D();18Aztj z!t~~(3I(d1df-a{3hqM-wVkd+grnnHbjj~3T5ReO4g|nRph4X3oYbTfSqjUK9uiNz z@PB5&jD9OEnK~(Qg=|1>#EVfC`B(kPAm)o=O_1Fvk%=!rL1{a@&_q*lyivCG$&R}w z4%cfD1y2i~5V0z~sINA`M;_<~Hh%wk((^!=ZKh%sXSK}7U9kqk9*d&Iyf+L_Z2`r3 z8_>%k9jfKQeo8H3U-f)@Ljyxxtnd;MU7M&{(qA#5^_J_AO?G@7Xe$T2dCWFhY@Iq|+YTLwM=h@}aox@u{3)j2{8XBUqKXvqtn|Ls@;;$O zLOBuKz)IsWGcHVXwn92M?m=Ltq2=I-VA|)I(VEOP-S2G8n#S*>zBx)&%7?m*Rs~P< zor;=;SxV`x=y(wQC?2e-YB}pxJN!dIwOMVSOcnW&pZ{GR3xj1k>?Nic2H+|!6z^D( zds1P{%nM`0H{OPMtao`1cq)YJ)O(B;4(6e)mxFFt7+6-$*v@m^k82mG0}^iEuVv|P zZQFQ%7Mm*ia7Oe&Lh)l}7H>uJ#|K1Cs^CfgC)wd;7Wi?B{tjy4;PV3yVVP$+L@5?K zzWx+*JG^iMAN}>Uslh_!=gv4~n3Inm?AWns(4<4CReNokOH`3$a)$m6=eX;|h1Z`J z^i*VtVzv=G)vsy~xTHdaM9--0%!JnQr>`@Fc@~fjcxz6RSQPux7eLUqk$oL) z*>4O-MWes6(&;oeJ$GHu?;M>qO&G5zE>Z#j(Jcw?1paZ_LDH_bAFSSd-|2{dq9gts zrN=*#|60_9`exCS{SV*v0boYoB$wNa&(7ckVk1Xv0W|WOjF6kO@NnXxn$~H(>*z9# z&39mzBj~CgW>RY2FV!Z7!`(apNfYg?TQcddtVHieg(D}e(BRl)s40Aq8P0ZE3*c(c z-dmE#@Vl7R9xF$FRDU%*K)<6U%65=S++EWJk85g@hv-As9O9bt1+JHUIk?4oTB9UO zuG+Zj&Ybj#C#n8pbjq|C8_bWxYVG^NV#+MaUmIB-6fg-xT)m;0pXDjO^<{`^AV(Wd zkF5$J(h+XpR1+;aw^=bZFu$8dyEVz%$@M=&N52+M@rLaH&n71amEo;0UzqIMeg#fD z%`oj@V~VeY+Z0Ha%9OZm8Jp1vkmix-l7=WV~6M2 ze$J}VZp9Uqu5ntA2MwvWmSTIGDiMt|F#4F8Tg;R0<2OX)?UgZvT?BTyTDxD#djFg+ z6Gco={bqj{oqR^h-a^%z*<0G#miJJSi1j}X zw=UGBa5E2JEX^fcrLE;d!G2&!^M#n7?&y!z6zJJ}EbZJiCb_Rl9oOoX!#~C>2OY$@ z7ZslOpUZ2-*UIlHOB%9Qxgg-7SUl6BYE3l?*F}C}gu%7N|NFp{P=3a(F#o z*vY{xo2|iNVbCsM5m+&s<9m2Rr0+%1&J=^iLC`I#^3nJxy3^`>*=D6z0BTWow~)Nb z{vPJB|4%d}6ypRSQcNGip4ctI|9bXyTL z9r>L^v@P>8ZZIo>OsfVvg_X(#4(@)V^RpP+=8w#2|3+NlDYBr4u=($AkF7{ek_BT3 zq?v%qB3=`R#|(37L_024Du9eM_z#2S{g)fQBbkK?jn*@2X$L#eg525HB!HP8-Dt@s zCp$v-wWCgdFW4a~vc_w+=x2hhva?RNDh}O&Qv6})!8q>>%iPPO!X^qVp<)FL0OdjF zx;%SB{{^O^?t8i3^flekYRf}rpO7fK3PAZkA=hbJdclLL3R{ZD5t#e-r;k!7vZ09i z-BgI{!#ZyxrI^gLw`K(xW0K$-{0&!TgAO7R+iH=0O|qlC(>A^|_iIJDc{&oK#V;Xu zpg||;-_sxu;7Wy$%jt?1C;+gZ5|%dfxmoS+(~c(og4d5gcFjhCFINNrTvl6Fhwd zJDYa*EJ*u!tKvoqI;PuFqLuczZ|@ky?7QQ|Wek{tUWVTdLq{L3Uf@r1c(o7`pD)Jm zmok|i?n{{pyDw!vm%=iK|UmYao zp@Vtr^q8&(QGHnz^m1w~-ZiAVgwX~<3O|2ai!j58L(YX}eRFq%Duph7esx?oliZ&m zIsLLt-DUYR(;EHtTiK2TX}WVMqn?Rx z_2&*0$bnaWMHyC~<^B{mv-B0-P~3&V;07B#9bfu-r|Evu;Q#^h>-Vq77g8H5TrdS! zyf4yOIKIBeU8bJDS^(CR$Mc19`F_?NrXJ$P%P|1BHR|eKs{SqvP>}_p`m6v2joQ4E zDI0TMq~8H^r1$sj^v``5?ai9ksW4<}!&yX6$FbjSOE(B~z~7Z&e!g~eZFGRjxP0*p zcjMVp8Zer*#sPkG!ArA+6zKPf6k#sLT!%ag1HG%xHo# z6XFz^HC8IdOBjM5L$A^|2j*5%AyUXs1JE=8gm_XAST#+IDju~I-@Ddp=Mwp*O$=SG z+s7tpLbkdsO;_P(3=J@&SI7S}{L}zKs?OVgVP$WdAO8dX|6lNtipHA=@Ir9Czs`Z@ z>YDfnyf|jVfplC2K%5}(es-6xFPCZmL!n)x-uyRzE1+X-AQcSoh_d~pIk~gFl~2)T z!A)?pl{x@6{WcD*6gHE(hVs0J3CDzb71x89>h}kpO2w`s>dbfl7teKWovW zvwfZu%pQlN2bsIumj?b#lI*UNRnVPXm5peVo2R1`^(sKbz#13@I*kbga8K8Q*hh+T zkXOVQe{pl!l{uTe!9>KbYQUEuYGmI1R`8PfOylUom|_z%6W+b}5oPs3W~o?b3nKQf z=oj_C_bPH8Xt2kt8b!UQm6iPlFCGn?KZ9wDf;8^v5Ha@y(AIrI@hG-(Q&*A=hwYko zG0L+QA*@f{ZTybE8%===Jk|Jjg37!FZs)R|IFh7 zMs-IE0K2;+BQ^Ij0tnv8U^`J98>nGhpXX&j6#2S2x%mMg#hq7#mbX;~+ol;sjy!3F zJqavoSx&)C{-N`y?PIjUKU%u)9CC7IQ&LW>XGo4Qlb{FGzI6kR_I>6A?ucYcssm5^ z^~1cB**VlZg>e5&!UOPtLeE4#IwA2BfU-?UNH6~yxqSSBc5_G(9wFOTM0+aA@B(U} z02|lxl=itIq**?V(H7C$kZiK%uLANCcmsb~I?+<7xFY3oq;o~fE8EQAWD(ibYk^iH zt(&ZBq~O!#&#VnRfHSHP5pCvuq#yL0j};dSqeza4%HZ}A9l{5fm5!OyM&7?(3_iEg z&$3b&+BK=~;h_A@rn}!b4*SI@x$k)py%ratdfsz6~J>8d{$Us29?`Vqwq$ zEMd;jchURYra`Y2oVkN~GQMc=IsaNU*{o6NV|yM(4__AHJkBa@>MC@)lvd$P{7#rS z1kRS_$SehDgo-XU(0c$y0euBbol?noJe1HnLGLr0+j{=pDA=?yv{4GKOsu#-Ee5a^ z;XpWXTAi8N&{|1u#{#i?=195CPwd3}B%pVP>o=T~VruStrfk_M*c|}cWlqm?iR*Yd z`SPS&g(;?@puoHIA{;8TE2KU83_AN$+lCD?iiZlCieIIb4S?9)_}&kC?KUbcVY(3+ zSC^6qwUJ-S%;H%A4)92TJu*Y^G zd&YA_$IMTI+W^2fl|YIgz{Rptbq0W~Oh@SJc#D6W|K?cxX^(<xR5HxvJj1qhM5qIK0act{0hUu<-3&t0V)bI1k$pX^iM zr?(lxh_oy6j&%ON7-Rnnqwzl@u@d8{6ahPZ&zk`407xcaS%*FUZ$26;K9C0Zt6+g) z2>d+>WP^djkl?>`0^p-1F<)Jecg07;vlIP?QdS-cU~)mP!l;20!?Zy9^M5$;m)iD! zPW;80|7))P|C#8gQz<*$A{ zztJ%N{BPHxRDJ)+f4UAQh7{{{Fz={i_O2kO$aD8y!1ShUFW7xajhgzR*FY(d;RwIo z#|s|A2bgdF8b{8%!Y2$jEKH(6KrVGmQT~cMc5}<+#%bQZwPn=0{4RU>XX~}-WA@EK zC|~ghDUOH%!O`0h6KeN0*7HN>NjMnBx%K%A5vdt=wN{-LiC zCM^s+5U#|e=;*bL$}6P4mr*z&hkE`(Zr8eAgcy?b^->T~;kHOQ=-k;;yKjh=WR$+j zp8HWL11WfLr2q8>z#IfDyYv{~gxV>mh6Y)$jkV{^Wc;Nnx17X8oVAHR(0H;1@T1@H zs-@Vd^7!@4l{2L9H%$6I&z{LhG?qYlQ?;QWFEl}W9`2>*8Hh*)Ii0@V4EKh(3D0MY5C|9mF%B z7a*^GCX7RZ-&?^i_Gq`?c&W#o{S5bWIjzhhE}y6e^=k}yO*(E-MDy2MT4drRRbhaU zxj`RBs0#$(ygk;cnYS8s0++@EXTBvhUZXG+tP$BUva0n_*Hl<+2XEg#N|ICO_|2Y% zE+54L-c>ZmTwiq+9$q5AFaxwLKy>VNw=psEAm)R@4d{qKLR)lh_ zQSK?6$Yhr0C$Wrv&6z66~2+Ff!TBhH|0zcYae08B}47=OnnTPYE3i zbAO5F1gM@r)7&y{Ar91Ze<3S`k5?S>FBMVn88>9hh`{aKS8+Fi3`a5Azq)MY^zJeN z_M&AbkpiE#VjGT?MlZUKT28aaD~*YQ_PFQnpZXlR{`so=fjh-<^uG0^RGIDNH>YUc zB~p$>Am?9M5%l#lzyS}nS&r(gwy9FBX|v%ou6AuG+2)MVT;vvTZ{^q$JV6V1XW`x~ak-jFYW$(mpD0NT2p zIZzNB_5_Ho3TX%E17->ER&<4Kr7h$H^?KkGBg9!LS@0Sq*0`dUHFg-N#^LoQ?S6y7 zWnk9*jPFytdJ;eG@6K16PG@dx&v~G{X;;3~3vu-TA6i=i*n_M9QS=(GwaMcMkC)f4 zN@B`OZm)@3U|>o~S+W;Nzu)gW15RBbr|O&==TwTW?JvvH`x=3*0YlcFb63PM#o~(D z`{99#-4!9_5WqF5ZR+&!0`V&9*F@9qA-_xsI zLh2R&+(!(9{Ew=P7)E}~5*L}}V=S z3?#}~%V-^B0f$~!8uX9a2Wax#Ev`|Cfi|V4!xV;2zK+Xz4-d-;B@47bnYjRYX6!<0 z5D~Ua^N7c3;za_exuVpX;K~V!{qk2T+VYO>fR<+t*PA>qP8ae;Y`wZaNi{2B+?D+N zq>+RL9dif?QGVB#+}LHh%$4Ewwqtw}rTyk@lL)Fv(#@pZRz%IvrLLw7Enmg8Egh>rWU*{H`i?Wk@Val{U(-v{Qki?%}>m?`t2}YQ9_^(I$|LBmVQAU zq|@4PM09={Y*gfL^vsR-a8>AV((JvqYv#erf$U}_Tkh&%N%>sD;Nrz*OM`Pu zfTEO*u(d=AIKlb04!2NgVoH(OCxxb>M;w8tQWvIFaR(8yw2&)<8gc^&jnh;)Z48Ug zl>;~Dy++IRHg%zzi_0NdZzMsl((+0rec~=ImOm$a^ju8Z#U0h~payEBO8WY)Kl@19 zoEI2*!L~)Nk{XmOswkKaVE!3VKeil?koB3R*jC#wgQ({-!TS$`%X!3c-xJgVOLB>119`gUuXk~K- z%(gmX@D;)6uR#Zwmvdb%a2>UhU1~Bm`edRnf19BYX3d7wiE&y+LC0hgJX>d_QhBHe z=8v^Ux$((!f9T5>g5Hp+W)}fyTunVwakU~f;ey@m*8GPl5r@NwTofUEk*N_EpfGg# zS_eIT*0;fwqHlK2USaA05{*eN>i%ys%? zbNl4hFR0bXRK?LYr&TUhl#c zK(ax=*mcj?oqqNQ)myrzsn~Kgxsh0h_Y5TFC;bk^ph~ui&i=K>;wbRV#{Bp0rSEXR zdIEVKZNfSMW%}N%AtUXe zRP5@yf7NOuqj}$H8i|q5W4~K%8JM>kEz|CdYsF@(9kYCk>Yh}F0vLGfntX#xPs>z> zc@#yLDe9 zm#sIX2Z<}az>-NgkCJNi6Pt^^RnMK>GgYzo8GS|)!DjUMWdR=xwj9t)vFz- zkq33&RcAV^qyQTU6a`A5~CQh|lJu^7HEA5InZ{OyQ`9hIQ?F&<*~jJk#T z1~TmQ_ZXvTBsgE-A!6u5sc4uNGC0E4Xk!UOvH{(Exm{!Kw0)z*5mYkfhnTeaK`cC2;7_*%TQ$1nH z{>HbXZxa16Ly9LWzl)-xY&?^P6G`o)$4j&;mHMGaWKyAZsDIM!(V;U@$V;SFJOtYY zsev1>iAYoe9}Pr|Z3)E=79I!T<0V?0TRdzY!x?aK@;10pc~Ric{;?DhW|!~wgb>CY)cE#vUOMmXr- zJr1GVu(}^OVWbe)KJEB)DUgKfo0`F`-Z?TF2yG%!z?|n@?uck0z$RX?*;f7{rmCFM zXm<^pHple2O$_9l5~{lK4ic!v8o$9ZM%bq{fj$_`$?vY3EaV@FzQeDTAT;+LUt*Zn zES|D5>_;C#f3bq3xI{6`<3AHk;VOtgmX(%gqkhhNgTkVQ>PR|x;Jh5zfH^cuX7AtZ zX)=>sT$QNmw5LT4b#V++9un6YBDV94ix=iO8xuyhLGaR34PCcg@fX!g_&RIRNv9D$ zUcAK{6sfxww0i6OYu4weW9R+1rJ;(hJ)%>AkY<$rbf?X`_Z5@otKQCS`q*UqJytde z*%D5M`gBTaUrf?JiWdF;YfcF^Ks=;Y=4D-!b zQ2b{>w=Yz>=^;YDo}fHUpNI}uoRJ~#_@b^7Ej}L?q$+U>g^w-pCM6L!Ydc5=e&Zw5X-p%tjS3`PlHoI`}DV=3{+77&zA*}2@~`r zftC7(6~B=cjjt>O$A&_ZzrOTqrYafeOLebBF~Tjrgu(d!#(Fd~JA^iw&Pcz1pg%5P z$+_0Lx}Ln!oO4E5HQ!Q&sOOCl8X;>m2KjP|ubLqWUsshL_E^1I^exfRg6-$}+^RfY z=`V1}RR}1=0+DlyVF(XwM`Cjsvi{u*bwjnSGJoW~o24}&D;!A2i4X~^qnd*&6>Wou zb643V=Vzj;32oijCY8bO&=6bty3tG znFfQdi}AZT>A2EGrrHsQYLd_|no0b1*k(8ZEvP16K45)fq1?_}p&N9mQEhOL=dO?`+N& z8Z~w#SUTeQ<;Xm3V^`)Gzc_z+!`k%PYL-@L*W+8K?cld?)pN!hS5MN-O5d*hRn-FhpHD29fPDiU_{BU~QRQOdnlje$3#Dz8kjl`nFmHPk4QDZ$4VHz5T7*#itDsP|~p@|HvwH zi~#zpr*MmK`!FszForG}Spr_E`OST|_(pFy(pEdx4&i-sA(Vr{amT6mGYCx&sjTsu zU|N9$H4}QOya{cJBb7$b9e%H(>GDHqp+a_DE#XGfc^D64k9;hvVs=XAC?|neNidyW zOz1R=qC2XwnYwet&a6Ry=Tp+tj!0=z>PgL)r82B~X~P*p(B-JNIvt7DFFA7HNLR{7 zTFk3PmhICbUrPnc2Mb0wD^TgvQ_c%Z#;=VOa-J{fQuKu(`YS=o8qKJ)d|69^y_031 zOLfx(+kPYW>3cmWEmK7<2vyuU*a<@S-dUbS^$n`ha2TieO`<+jV()KFndA`7r(wgq zUp;3Yd*()+mRBSW(9$WE?^l4qF}_{0jIA$bHR_SSB*>wNom9S`c0Q1PKUbI0_o?9g zPGWQ^nc3`=F33R?bn&$ERS3!=A8No@HOlIEG7VjIAc-!og3WW1Y^i(G%P3SyQz0?d z${H=cv35_4@6%_i&uk+5%a;|;BRLxPn<82~ax4YnrMSX%|O9 zz+lR+cWD-O%2$9heJ+_t1LgE(+26B!8V-|#bytGNFHSd0b@?Ny)FcRK-)B63ObEWt zsz0LeoKlU%DnAup+UTCI)*c2G>ew^x*v??cL;;JAk3Lx?ah{goxg3bYwpEk7++{d5 z&|Ll@Pmt5m6XW|?sOm_f&P${Blqv~`FxqR-`%IIc1M$_}@#s)8LbzlDRDEm*Ty%gxz4s?8qf4HDAT|ZOO+d6Pp3dFh{+f%=Up6|VT;Ik z&ImWgDL_%a89CygM^=gGiZ6B#BbGcjuje*`t8-xQ#2;aXI_`;??DxVN^1!IC z5yc^6$?<{K{Z450aNcn7#&eEtx{c?9fKu*6U{$eu=#cm5EG$*r9PAI8RM~vKh9&ni z?oXAgN9N6sE+tFbvKcUj{vU;%^&Geo46qj+tcCVx_)E*;Vs(XjiUKZ04Q<$bvd zhxm6yKaJ?*@4=4ZSy)B5)*XLVctllCA0J?K6sB9LO#OMqpARjY%*qMEi;m{P(;3&* zF2GLbgxk(7DwYjo-V}HoYA{jNsBXei zG_u4qKa=mc4~{n2Crm$+k6j9$xfJj{G#Fp)or~P1y^K3}58#bzVk#D6>Xc3-s-?v#2kj(z#BZ!VKYH$4<>Gu^ zVfRFc`tDzXVa9WsM>?p?QW9mSyMFEY>Jnm8xinv;f~d^_T?-b6Cig%efqaP z_gEl0GbJ5AWTx~;;8y@I*v{nJA$aM#gI$h6h`gJZz>c>Y>f(|w506QQhDplTGUhC7 zws8yA4DTP(#)Kw}8hfz$K}be))UD}Bedu^jvkHdS#ZL>69|zRuvDC$ZZH9@z|5WDv z=pW;fWrO^|U>+14A6$-Mjc4hWAmSV^r|Fv{LiPO{MA|l~r$tRE$W*1gATc7{3Pbj5lfF+7i)Z~_l`0m{viE|_uPGNV(wR7$||)=06ODbYw4L(;%QAhBSbUz`7%NfeSDdz>0aoA^6L&+ueso8r2=-+eT{`a&8tv|(OxzNB_kvwHK=9~Z$9*cQFsF00d{1b} zhXS(MX!Tx}f4(DVHHdqbl)?*&(Mkvkj$UWC}oQe}bD z{xW^KGDDONDbf8Kuna2X-B=;S7a^Kd{PzbQUCri6G3%u-285Bk5c@Y=uQ7duU!E-ZQ$!6p(O)+d1^+74Sg}QEHZ)&tXGkvOiJp*viol$4ry^0Y4-r*;p=PFeHQPGq> zbN!L&_X6APco_I4vIQLk)V)0y{7?aT^gzk;zhsp9Zmto7PK zoz*$O3n-`n9n))p3s@e8K-&Fmm6TJjn+ei|EN#Bfs-#*7;evyR`$T&s1$bomU|;5K zypgPX#^YLTCr)xl)!IGj5C4^pA;f`HcWB+~g3HvWii^AZncU+#bZjzTVZ>^YFCL6% zt$<+dcKP>Ax&NHeupGrvP(gQqYsbP1E3lelAuaQie@FaopV@O*mX6vm~+HTg6ChF4anvAujy!KJYl*WsKbN}-Vud}VBb4b0>& z4%}A@<@-9b+A_-O<1fEbpZPO>->A&i34;T6N;k?t!0}^}lh&ZfzXdS8m5kNCYa&cf zu{zd4*CK~XHPD$)H}R&#@$~Ez*-(!{l&GDjsO` z55esmiT%aM4P%#fXX`fr$pNaO<7lQj}7rL~sj3?IR}AkXl30mJI|21_}cZzghx z#4W57IMhm%cHh6B`KLjR7jm|uwN0@4S!aT!M9F4X-{a?wuF_bmo35=-6gAS;Vozqu zjzI>RWCR~yhlG-~qv3LJm0AAoyGSrzOd+bE$X(oW2rp18yN0OA{!_Wh+c;9LUdV?b z{l1KdJ_E6t5hZ6lf8+sk3XM`KaKpI)Q$9DCec&dJds*UK(xE!9@1`WkS*qJXrToft z-v3(hkGsjzaC)QGF>@Tlja?}fQmReX-#=f4EX9_Mqq={-)dy$$TBz;pZj62xoX=(~ zdfJ)IpA@5?o@3EgIM;d;0v&>M&zVn*mX}dNCg3CT?d3Ts&%XA7x#``P!vy5+4S@rT zZOFv*Ml=PiUOyx)RJ%ujLl`9u24lS(KI zwdMALX3S4zs_Sw~bw93A?HmJ2H*+!D?mij*D|`mWAwV`%)Ss^t%zznyW<%V=(HE7E zuFPtvCYHZF^`C4+y;oGvLyD>q_uo6~!Hn*oh$FCG_bq6|jA^)a=O^()CwEmLwzbm` zMQr=)976yOEYx2Z=|ucSvFQv&(-XzvKl!{B(jQb5jCAV zh}!fM5e`9U;MEY`%#hR0@n{79ki^QwTwD*Q9o5wC6Ue6eCT4iB$%h$os~3*6FCR@b z9R}Oe5#&JbSw|cA7akEoOsa{0KO(K0SgPwg0}FBys`$iPIi&r0Rn=RvQ#xMCE`)K}_hH=&xA zYL=xzfjv3FaK;_f{)HpKA*@q*jLVvLi98wN}pjW#;0#=LPuwu za2ub3eh|o!p;{n**j1|VAis@UAS(LoDaHZPIw05NTEqpV{cR2_lJw~Vic(KAuSyqUk)Vpd(ytdKzKNFNrX9lfv@ z2&oaGDqLArA*it0QbC+Wf~jCi*c?641beIv#O&fa7;cyp&a{%kOkQB&KD6dJ7~JfT zKrCSjl=CX{GOsE$l7I(sk709(-8cJDmCl9gz&BST5pr4YEeEeDoAtE zMJIQZwP?%-eo`olwMgbUkY0*~6qlot=~$@#pgH`(8L$;VA(h=Y-c)C_kuh5}S;krq zcL+Rvtp75VV^{sTlZ~>#0UmlW8ermFTnP2SZhys$O7Sy^MJRMoGHHBaB{|2a_Hr3~ ze9EsQ)xIJ)C)GY}7vr#Ynz(73^_0AnzY5Fk`8hVpaxri*OH)^1i)#IAQR7HdvqNmi z>Ks>B0!pW$lkCC<8Xl2d6V@NDq*Dsaprs9I0i5Xmt&nN(-)_pE|YV0(qLFFp59r;hC(!xv*jc;lI5uQ2%d&yR_Z_s!h zsd!PIzijX518>H&T*@$R^2F2UwL&42$CgFmbmy1Kci^nyKT6(pFu|&%GqWh~ zmPAoD)g@Z*c^66)gWrFaqsL)5?FIY-Iy z2Qkfoykljh%>!~^@TR^34>kgh64duy*5bRL8VURi>b!fE@$6I)asAIhX)HoLvTNV> z96f%lMk=sfwzJsjhT+y=9shoao+jITLvF4jR6RzJ0bOmVih`;*t+`Bce{9b`8gnw< zx3=DUm#DuA?hO|Z*rQ{Tbn|hhb#Zri&cs6Y!gT#=fXH1t$J+e~A1SC4wmT~ORz>i^ zS;BJsD%8N6JFsvX6Z;Tw`5WeSHQoAezpsagj<;D_V82-0WYa-62tX4lb$<2W+8YQ< z&v?fjNUJ4s^$E48#=SS(xg4Zhjo|O|F0II8krp{0KVwJjeakh9)8KUe1^owZj2Vb5 z`-c~k>Et>cUsvK9Ds}?PRP<4hKjXzsYiDD%XFDzaGM{j9Y^v9b!5M3=$4cH^q0&fc z{dc1QnBX=HRXTe<)Xw0LPF&@evRXUP6s_yGmKTPb8ch1*4}c;(d0oW)Pnm*AKoe#U zB@P9AlHD&6*W(LTf9S{Rw0*mW!Sg+kFDH0egdNGQ2Zz|>>F4+2pHomV)97U990-|j z1Z&9O!t&dRo6=wgX+}^NCP+Kp)C9?W;XWRM(oam63#V?dK>_h(;BWgXl}{c-#0DLcmLB_bRqha$+wZiNoGg(( zS#0TFR~O*t37p0bdwqX;t`r{(SL>k+O<8i`S$*pNs%Rxlh2r!Oc1I4js#pMg0&bUi z-VqQ9ve8JU>AgiE> zt-@k=lF@joI*=q=`P@7>{|>(WSb1af4B(;!c=TJk)lrfNzV8qCz6ly=|jK}JpR9nvl<2OTh^wrsbl-fe$C8%(;u>CjPZr|DNN|sHl%r z(HvzQ_uuZp7JSzI=i#^u?JqDn_`(L>P)e!jqOk~NMu;LKa>WFrP-Mi4KQn67XYpn^ zIOe`@)^-z1KVj|h*VCnUt_mF$+OVgP8Z%4#QA2#Gqmh3rD!#0Ivu#g8t%fE`r`g(I zus0Rlf^8f9Vk^Qj@y*AmRZV`_p8VmWFqGLp>%CS6wOvw3rtY!0PiyWeY&8nbE<;0{ zm?Acs3m)p0;?Pq@-C`MQ&36%-2bH~7Y@H2N$@|Q)sd#a)E% z1q<1wR)Y>nfp#fq{rZdh?b8QZ9J7nXDJY$lFwXl2@eol5ITcBL&kO@^J3O6P&QN)muTP7!22BVfps<{9-n`_tYFm4eZ|V0s597GChJE3xBgelv@y8U+!BSsWozkiZg&URxrY zl7+kr{_(LJ2i${;KjH9|yB9`HmogPShWd`lD&-EQDsM+UTf+U|pmr&bO1alf@N>ap zBSu>YLY5xh6+jo#p?c^o)~~tOrBp?Aqu4Mcjpu(g1Z}?0EtW|#6L*+|i&lcWoXzi% z|0;#i?(@0mY82G7lS8z`ls~c?EbU)RY?8&VJ_V!-?odBip%=qJLYY zE{OCdEGrIUEU%y&CRpst*sz!;uv1UTqb+Up*pAqHYpVgtYmcutp%KTQP?C(ykpot* zi!!eOUbSs-dfz6V$aJ9DuKs+O-8O{#>vSpgDuC%~#p7<~x3yZ@c z=E|nNi6ml+Oq!39*D>L|)!f1dRf2{{+Fu&V)U1 z>hGU6=76oz%hb4*8r+v5XHZ);o!Umwk(xjvduyZ1x&=l<7wU;&ukR%;c|HXx_OaaO z?rI^D2I*%cg7G>rSaVmS(>TSuqpkeR%$Q&ECoqO~k0p1mf7!3z8*S!lE0%4S(Jz`2 zS)q7GPkGGd^<88v@BX##N4cpwUbaQy*( zLKHPE`1cZS?~??XPAEaWBn!z`BDQ5CD?NukmVO@6lIeZvMNcVoto&;d?_Y)Ef6WZMnf6M^#3LMDHH-~S&y3_#9X;nmZ=CnX0fr*m#<3@8%g`L`^ofSB=y zyl5#LxziOCug}E~#D`99$Md&z7>1Xj57BqTL8M7_&eZ;^YXfnQG=d%;oamt&mMlj_4EK4bQMD_0 zFwrPrNh!{kq2I8y!$1e+XEbq+>OE%a{p+gx-5Hw7i}dP;n*}C8C=;#twR_qmXO$K? zL}zX?MDJny4}24^s09Gld>>OtUw}jS!wA=*HGCGuL9q-Y5C1_{Y zKGt4L{0G%)ZlME;cQ8Vf$yPyKAF%`i5oXRYBax51LNG_VgQnq2of7P1N}8|d$7POq z>N$ZRxn$lQ`^Fd|))EF?8Y>U%=&`M!=aw&fC_Bzi;K~F5Xc7L*k_&M=E`C@%u@YTQ zU3}{u3^Hn5n}$fM!s^!}j6@=HtPz?(NfYs;M1a_Yj`l?$jQ^y|h8>aqwC0keER zzpb~s)o%?*e|6UI5M~wP3)ruzu@xLhlw6nOJCeE7{;pbHj6FUScnt$I|25>=8i}IO zMe@blcwj_oz;NI$%Kg+@BS;{`L3!7XvXfEopUG( z4)kwz9@d{iT;MS*Lq$UZE60;Zbwa^V>de8ya`HX$)%19Cu%I+VSZtper*-Tj9rirI zRN;9>vTyUhohUHM!I5>!rV@6M3|2xIuS^LCUu5KIiMmc21T_*zOf^?O3S(zoQxrGX$dEX zU<#kF^`2UOa-@aC0?y&S;7Ci$aYFp*!NGcgS#3G=yCBeM zWL2W zL7*C85^G5+(4AU!^%Q;;OHjdlX>BLYOes~yXGSa3 zK?$?~b6v=;g69NJWDEEL-d&N{-(N{h(jDTRg(}z?&?M^=TVLm%9wZxdh-)D-4G2li zuA~x9Gy`FPy(18LSC0*fz*r@SUq6|&C)jg}w(|ZkFBc{LX=W`4;*R(yGNGoZWsMff zB~2SE(-swmyAD4mB~fkLa_0(JpYy4n^Vsnfwek_!(sPE~5r>W4Pt5_0Wr^Gbn@Wu2 z+^hGFgOTm^Z`8REq|Jvx4_Wp6Cc!~3yf)IyZgS%KqCtZB@gN3W(>Th1-)|=Ju|SYdp(!H&&bQtXOkf%dF>FPds#Kr^%xU{0#u zn+u~?=Op>oc4Tn=OXVwJx0J9*AZ-lp^+ym=T|D`|9y_^R4G$XT#te}Wqp5PPNl)5- z%SW@54i$@*<_9(<)UyD4G7ho_Ldam;K%!=$*f-?mN4e?u0Gswkfv>WF+vbL+8``oba8~macA!z>F#0 z00wz(^5{VdrHq;ntw4tb8Oa3sU0DCPe_^MKk!DXM8Ens%9q^BvGfaAdi^l3ie!$=Y9lwcrYq@!r<;tIN&qcQ5(t%Yhrg*Q#uaWq1>O@?bKPnS> z(>B|c=zO|@%q#gE(9LYMSz#3bam?v6Z2d2Sh-;aDO8i6zai~Dlc(bnGlm}PK%l2C> z-<$J`_Gfw>Z_?Yr-rdcSwMP{8BQEaDAHxW{>y^e~GX?`v1frE7q8iM19xWQf z&1Kf0FK;el9dc+c7x1)&%%g%Nc$$pMC3ECP>`Q%A}$E2!v{mA=>9pRf2}&P_$c$e3B9IsM@8K&N8wP1$2Q)^EqR5kbW~Fo;cm zjSqwf;)3>QPkCrsitDUYXv9-(;W463Q>NaFJ>)@c{KEn4!l#=zBfIO1!TDLxpg~C( z?ga1V&D5kwg!6B6^~~)CX5Wm=?LQ$K4))56OEqqhr|8KYVHA9FhQo|TK&c;I1E+o3 z#9C(X7+eCU`QkO$!smuk3!nwUyM=c94c&m##AtVdF`UTp#_%eInPG1!0yJNY1_J&v z?uasz1nbL;UA89v(}WR4SjNP>a!|88M+svQDc{z1;!ezI^68rb7@>blSTgFS8pqiN zivr_@3Gz*y8CtgoCZ|YQ<c95UkvE;u41z`po-6XrdZOlj8m8d<3XNY z-JWe{4k3#n47>5S&@VO_44trBD50`WpOj^vQ_GpeKk4WH%Z7~Wp3hZ}2DuZ*uq5eK z>v!RS3OhK;%Gcu)7lZPg`~J`vV4l-yD?+S5!bgtzpF>9=`2@<(h-2}nZ6RsTN6^`# zJ9g7D!K zw80H$=z;`h>}fVOz1Z~MFFMXP%J&`&B$6HGR)wkDlA-+-#2UoZrVZ&Ik$<~}>b26s zj_k62ltJ#WpViFY;7#s%v>l*ti0C2P#`pb~vLYbkJ797{(A4D*BmwR1i=fM|o3V!G z(DX0@6XS)4zpM?-3#84c{75|e>w26LN^@CK)tBG|-Cs&fXbQrFpem6EJKp+*04fPo zVn1@TLsrs>)w^kYc6nHew!d1W*Y50#dgj?+4^`qHR#87Rkh5(&52leD9R-8q*`adm z#)Xe+`T@Cm8qMlF@JAp!e?PGV1Ca>!VwU8lEwr6$jI`$P2JgP~oF@jfW7DhqSHZ`V zeZt&T+S7e<$|F$tnJkiLza0GCf({*rB{h-4P_c7T;Ku_IRYI`oZwGm^7b9d83z*** z5PhU~@4HT>?W^vRY(gXc30q(o6J2{!YyJ}amx~UV+l3eFUVW{=lJ*xbEw7lCUgL&) z&78A|wvEy}@JZazR(3p=!cHUYt3=EiF_obH@!aUSGd;!7V0?zes_{^JjG406g#y#(Zw<}a?`Hft#Q{>5u zB{~|xJTy75!He&$)q;CTkjd8Iy?F+kLl(!~Le50rYqmRFA-u9N=FOyk@0>c8&V zjhR51u(jdoq}lG_C%l$Xg?RcUUxW3*4|Q3wB|6;So!=i3;Cc%B5#9b`8BurHhPS&i zM(8K<1@Q0#GpL;m8QaV9z)%$m@?eCMl*&fqJvRLo-p*6QG2b8ct>N|i&HB9v%P_c} z4pCi&Imt+cz~uz#tNVu(Km)DtjI`IU_+zevSBq6SqNzE_g$@8m!@CyT$a2VZCFgJ7 ziaD;GhR+e_KMOV=kxfdZ-eWkIoECuReo zGzv3oi;ly$#OJ{c6VX_)&;3G8S?jT3M}>K@HvP5ngIEV9N3@<+;S|Z}9;>m8T`8my#BTJr zV>ogY3+ZBp>BL9OrurakJD15CAM`7kL1h^W`Wo>Vn0@v5wHCl1Kaq>$SDbs7vXsJK z4w`-dF1HAx)c4=wVRK0QM>(n2RcA)4zN2y4odjfpRijDsp{?`XST<)Vj@JI{xXEbF}{Y2#m7?O<*SZ-gXc;a8DL6oW#a!SPzCnfjq8S_v_Vc5;Tp zj8CmB4?w|)D!X5W7OaDtel2>2^i&gRX5)-V<8Hi9|wLJmY*xtH}uItA4Ja(*(W=RU@`7WF_Pl^2xNK{l*-P&-k2OGqEy$luXe`FmAxEk<(z~FzCI)oIS z{ZlE#{r=qu_tE9w0UNJ<;}uf#A6`nB>NsFF~SCM6a4&)ooJ zzdf(a{r|S30XeY2|8+<7|6Eeit5N}0as8*AX8-5*v%9)qO961;{*^Xh;*h)o*Z&W$ z^?#r8e?Qp&7eoF37(PlZ?$?$*t** zadFJHN)b^#7%f}mE#m@crn>j2i0T=MYfnD+NEz-%FgknBTyYUkIMAb^cPm1GiNqMb z+87QTJVV$7X3K5QH*oV1^UMvRciO2h94O6&%KI?{U3sVpQ~L>4hp5yM4LBi%>SVvJ z9biJRVZb}eMvqXBwm0>d_p80!rVaFLC`|_54A|MX2BQM5&l7ie!$cvJnm!SPr)yEw z+9H-n+)6AV#sZa<#5lVUgqyVU`Km2u@2iLIprw^*?l&hqTTp)u?kG<;a}+$3Pgfe} z{gM-tuq)aL=eUTap018As%_UM%ezf%q2rw@Y?>C{PZuP}j?%7mW37?^jE@rjA}~OLx{VEMxWc(d~O*@v$tiy|OZ3 zP5Z5ZEHONF?MVAx3#?tHek-Q7px|r;gDFp%1YJ(w;#5}yLq46=hc}@0{L9|b7(x^E z&7g(&1JoOrt({%;PJKcquM-%CyV<{vk{&)>WosB*$DS`6Dx_UEe9ZFq4++GhXwLb!tNNE3F@XA(9D+x{u2yd^4v#5mTdfXK7 z6kMLc7u9a}KvN)v?$bW)d*mHSl{7&7sOfup>i|i+lp2mcWzY!HlYRKjJM5wxZO0v0 z0C^y8f>(4AduTr2=^Q)nd75Hw-C0H<%;;-ne2IFQRg6bsemu+n>SSv$=$548@Da`1 zbJ!MLU0W^dAa{+~gTF81iHrN%+}f#9=omN%pLzUNM>|%COmGO6XiX6v|b6dwbH6B zv2`6(>(aBY`XzB~5-VB^U%^I~rF7MUP;b^ryI#hIE$SCK>WI6^^*O4w?dv7mco{JG zuH&DZ{{HjlPnA0H^QW7khFcF!jE85cUd)C)cO1Stn1;U}w6cCz?Je9{JPuv!#Emo} zqq`SaKocy)E8J{$Ht%GXy6`=3&+%~#r7bG0nZZ;L^IeeCR_uhfLORsEbawQHfiZPx zMZ>)RDC>vXE6C;Tdr({n1L^O~TxOJP?|=w$M~UC`*gXl@Ek8#4fInlQR8@_HFeHYA zT=>80$x2F!CSM0$bUk05*j69JF^BCcPX$`wGOr1p3k}~1%&$IbI_3}zy(1iPs6-~5 z6$~uU+3%qP)~QW!4?~6GcZGFIH^(pyItcV4^Q0@ zcLbllMNq%hG_X>B;Ottx| zKf9U=S(7v1< z)h(B(X+}|hyrnDs;>a=x^|$4Q!MgcM39SA?5IM@H>V|dQRBnj!bKZv;s_9(3S zGZN#e_eYcFzYeJzA71-A`X78TZP|PS)MlRNP-CHc+M|#{HRwI6v)jBMzwXEC0CQQ# z0~7lwdY@A)A7mh=-BK>TO^Nn2=Klyfo2XQX7~-|Z?tk!teLCCFJxhLdrEZA z_HOvO8HM;*hr!1PJ*AEmW<31rCI8L+(P`h1hfrs{?pT6x)~dp_y`T2ObXGbeA6gET z+uOAa<@E0VIx^g=6QbZX#4+tKID(CpCYG(HJSu#+$I~;!%5c9X@RVcW|5KDt*^vZ4 zZQdW7WMU;nE#EN@MJ#SD%LWpBL>4^ci45lKaf0CUH4zC-8B@k(Z*?mG218n0H{_-f z+H1ci>$s6+`jYF;^mnSfWDu~QibTM?1M+jrU2)53fV1bMM+o_no;-7kiep!Rd|e;~$sV)bHd0QQvoO8pm~KpK6@~3jl*K-LK&SY+5)G)r?731w=kA z`xs(FP>Y9I^iKMh+dd9s;R_d6r}~{=q4J1_vt2IRK3%$ks{sNYf_=KrQ}JiNv=KUs zMwaIz)qN6S2g^FSOw3om$r*6@vRsGbRRExN5a!=g&1M^#4!5K8Juasiue0Pm_-qqr zD8F@uhr1F|z-8I{IJ6^%A4U5*7XfAacdnt6Xv-Df0(7V?>u)`2_E#REJs*jnn0Gge z+<5VTNWA%xudb@B{6A-Y+9QbG_sAV!!gCN;<~nU)$G#XZw{OPlI}gIE1}o9OaA(yxy)bH&xZ z^QPh?hu(I#+&e1uVEXi$h&S-$;9F8D+s}y@v0&!1rmwNa6G4$Lmwc{!k;oNCxT%$o zRnK#20Lq{I4@x)99ICKwL^gC^>qw!g-wfGVx$p+o>(gzcQfzQ4#dB(89;_$xa!x*BM1Y(&F;qGEqJM F{{@i=zFhzS literal 54481 zcmeFZWlUXP^fpML1qu`??pmxk6qh2!-QC^Ytw?cqFJ9c;9g0KIi)(S`;>@A#@1Hl5 z$z*0eO(wIG3uJTdk+s)e@;qyu5Ls!FcW^jx5D*aW#6*SUAs}AULO?)T!a@Tx3#w{2 zz^}KqqG}Eh5Qx1mpH~SV5pjV@7)LRwFEDGbabKY$A$BT{{h9ir>d5cpXli2*QB*!6 z3QQq50#iap4hHsSwvJ{t))1&~iAjNZxR-fB8(TMfGZRxsh*G2xPGA=C&#b+X-pipx zj%HRy5TC$EZ-M{3eff`qjj^MPp1l!-mhJP);qZS>ZsuTMsRtZt57E$B8wE_mzD%p= z*;|`gn?Q8p?gRmIFn_=AWN%;uarNwf@ZVvAHda8J0r!(N}(UW`U%y%pOKyyxPXXkF~&a?cjKQMy-4VGks{$?nW zf5RHB78&Kwi20WHJ@CI{$llNj{T+G4RHno)2iqqfF4$5G(`yFIwIn}#Il#!A;2sc! z1mkJ_I|T=xJHgiQ^Cd!=PIK1tO%&mIkxN12EeQKg5qX>BUc>Htn1g zQg1yJw=}s4ftSl{+0Hj5P+-E`Y~4B}b2=d=(cM#0*mx#d87$MI#N-D1Vf?w>pq`LI zhJ%jGykYUT3pHLJ>C^3Sqyl$goU4j9!vdb>o;Pf|UCvJ{V7__1)uEB7Ck-(9#Ysyt zr5cHUfcWRp!X-|0e%3v&etMYB=ao)}u4s3sp7XY$s(FR={T^n{!NCPrCvtf#&!l}^ z<@qU1@@^8d(Y7B8tRa;5)inQ)cn0KHDi6}B#2U= z?8%^JJD4Zsaj#}8Di^6Ub{iAR9wlqlpNlgN++m6%>n5Jhy)_0}@YvGrc4A*0c!vzG z7yMnUK|SUa?33izsD%th#gAv3?AH4dt(V0K@0ltyRu8!|U8FgBhqq&2x1zXrQ&lg} zELeux%H*+&fde>$?=Q$U@;5S4X5OAZvEvhK#EO~V*{Gz=2q#)D$#BYh2xLh>pF(q) z$ry$0=66TKHoqq1+{{ZYk|!pHx)yfvOz^PC7c}Z zG^)wu%Qhw0II*jkoJrhowlY9O8>0Kzg@=O8_)oVY*^vn0=yv#?_E48D>niM~DXcf1 zvz*^0(ec(QGnb%lMKHwZLv#yLzV8<;42|3eo9i}Q^&;CRiv1BD$R^lyksm(e#CX32q%^Ggv@uGVbz&Q{arMe`;Tb25I|FxS> zCEE8NQzkMB5?6MdZUT;mHHMqWXOT14H6)v9aCV_DnvCb{qi=I9H~YBKE;xAbaFfp(ST^}QQ+npzn@D)1OZ3nh|Ngz(*SKst6d6RoH zk`akPFOrZ%0Bh;r*5%crDV3+)mJk-~@Qho85C>)M( z>VGy8p7pIq<87i_I=G8D+1kVPE@+c`4a{VLM!y|pf^9yQF3~Tht7=9<%1Am zTdTm6J}Ib!m@dI$@5S@kXf4MNh5XaVk;VabNeZNaE*7vRMmInGSiCnDRJXLxyP~l7uU)^Ni(4mLR<447a&jl#3~=o8c)YacA&O*Qzoz!NmW%b541*7XEV2EtBEMnphA1}jyEEHaAM&uP->U4;QEJ;n3rVz=e*Y01PWMlT z5yN;4+wD1g9?J@oZ;!2(ZqG{8>fCgHPa}S{QNtp|x3e5bAyzM~izdZpbAb=JEoDI= zmFjJJBh1UcG%HMpO%cNeOJBmu2(F^BjE;;yxsH*5)`a&`J`I4qyCC!1eig6DB)gQ+ z)1-AUVGtbS|dAO)94WDku@X~v^2(&6#h|_*gk-g=a0SKvUPQ*1zSEq=;(l> zXj0%jW>P486+eksZ)Y~o(nN(;ex}(0EW-i z6XyQ7AHH=AVrjJXm=M zs*m*OxEFl#8g|xRKvF0eH|h%F9osE$ig!~OXm(-BG#ys>>vW4inIkHVJ0G6|?PlK5 zfU`zh!JQ`!Jc8~s8Qjs&AKPtDFi$g>X4~TB>Q0ch*gCpv=%0{ePS^G9Pqq$wZd0%?wK3Z(F8v8!z zzG6rT%+|Q+)c{v=GTZigP~?_8cR1Uhv3bjQAbH+FP0u^kbglfxez;@3IOwauX~jtG z_jg#!B7EebSZ#_MZ4v1p1dPrgF{e1iT@%?W8{f$TXTrJFJ3LfNow*9aA;vl@N#0$8 zOU;h9(&aA}+T|^y_!j4qH?#1EwjTDw@HExn1=`qs^M-pnRAv-Dq6~)n|u27F2Rc%KK_UhXH&SMQ)!dF^aPh=9%#< z20h3<#|Y_yX-&t;FRga4n|KzFxGob<7ksf?x9m^%7tlKQ6GQ3l8$ttesBR5*Og@ix z{;S$DFueh_k}$UTkTuqr!PDXYA=%HO{5hi`@U&7RSLnTwEwm zZwrVHwEOk#4Ct^saYgOpz0!$90v{jrPJ|+{^)cK=7*QAQgC0c+BtE_N=iez;?aJ)p zhYr*6NMZ4RU??K<}Oa*_Oc7=X7)J82dzb+-ed5a5+eb~%tQD3jZhLj6_?(@ zVgmQ&Vae=sf!!?nM^(<%wzG4CuVyB8eWCgBh^w8&^9F}BTqVwF^((2niC2>g+HF=q zK$_Y|?B90{1ITxio_pYy{?ZOps&C*JXFnN-mA8q|ShDw4Lw6G%rZZU`E`W|b;$Guo zWcdl2i+$27wqyI<@ljUqX2baQ_}o@X%krbU43@%zquzQ9`SH1xiNKB%tF|{um|M!0 z0t|b_6`2O|wU9tkYgZc*LM6)2lOfx?7GQ~H-+{IAAu57{MK_bhYR)vYz3Z;!D%u}3 z!go>tNh&=iM&Pnl+iyEd(|J4?w%_#86R1x=eW-0{xH!;R{krO7aOUoyQo4rOfz>OM z8g|@VVvHJL!G}xe9p{tAl2TZ1uHSDfow3l%26Cyq+qF4QxVmpT=%&h@%9WqcKTvmH z^?EaDs`t$X8bZ08CkB1CbQM7$z4Of^It|ssbGA}CgAa!Ub?Qo|LPbZEY3=EV@@%?0Mle5)IxDxEkf9K(d@W|lw@c)}4C5=7|D^GVJNAiCHt)bwSRUt zg_mKDD`|c74;1nl6l#pOKR-adM!hW_kCS*0>pYbi`k7mFU6wRGhxGN(=RL-Uvuc@Z zW;uG44MR|~rPnFyc>ig_)i6=|KGBw)_Vl%Cc16Zf{*w`KO62kS$?XVPJR>zeAPVQ_ z1SvSq(>f$xc1)lcSRjL;8=88ikrF-Kf+ySKl-I#zkpgF)rF^$ zlmC+^YLo`og?vB%mleHnL(P1P@{_i0E4kC%1uA*>b;JBCC1sdaNg2L$HZZ;*TfH~e zE?B0j9j2r-94qooVbz}VMb_~ihSvib(%dcHstSeF7Wef<+*RdGH(zxVq58O;X9qod z;_L<^>A^}r1^A*joNB4UH!v8ljGLIVI=kvPaFFt1V$qu^>uy2)$@)xQlMQyECNb;r z&~WiNpYf+{A`Av%VcbId@*Ua_<$clIgIk`n2coRTQ?!*6<$6QdxJ7B=1dms%iK`A5 zful~IG;Fm~-I=!%YTB$dI^7&5Qkyd?y9;og(3$SnO2#^}aIzyhcl=|i^>I37%llK8 z?-P^WQ0&xPde!Ke(Br}(S$Rdw2~QoAS-1hgbutg=?B*e#Moa(sn^F|Ey?Q7V))UdgTmsE;WYbu3& z<0z+$;ael&(w&^Q0jw&&ujN^*{5(-jbDT4XMAn zgsc_Im^_p%`TGZLbG~_8;`KyGxvkt$q+4x`YR&SrG4AN&oL}zW%2{qe)CvNgj0c~( zDccDTUxj&+h^C7ct@aOU$6@Ml!7@jdrH)k^jDFNy<_obwz*arnyc^*^Zt3Ouq<_|= zz)s&$5pVqBLT0_955_nG6hmokCP#%ZGPhhkyQ*p-mn#z52acZWORjGw9%)}YtmG>K z=s*ngX45|N!wK!`+Qq7uAI}&Cn7hk`@7c<`=E1!j=OVdp$Wo^%HqE-(?AL+BlHEW@ zrNICqBpX49?qE#a?i`G(>$xFsjbUC1SwW@YilOwPgYUCO)lXf+{R*?H?4*p5f+kC` zK2K@(SK4(skhscy!DX6Z8nC&|sO;Io?qW3c#b{d$ghofXiQqNtTm>8``-NCPpdNCu~U&VPPqb5UX?xtz9UpD)YtX9G>Vx;#!mZ7@k z+&eK7t>xU96?jc4BH*!)9RykYB$wKmvJEd0s$OryIN)^~=)*q<^g?B=WQLhshm(W=wL>wdcVz6L8*qa)}(wRCmt_BLe6 z#oEntfhNz)+beu8A3|4&KJHB$e$q=Gq&cbUUYaIDX`PeZb z#Qn^D6bW9uj=IzUUdIVzi~&?^r%i6IJzPAnzSyCsc_G_xUZ;Efq-2^~&WRuBy$Fht z`{c&h@NjyN-nNIqyYY7% zg#O2IaQn~No#_-LORu9($=BBDSumM5$7ZLC7EW)dSuc+R7Dn?GW0Q1tm7LF2X@qGo zNHH`*4szak;Fb_>3e(yph9)B16JB7%9Ev)l!pn zvOMEjOeFOJ9R!#RNPLc6O{Is)#x{v~%H!M|ZW|5?Q(mk+;%Qtpe~+ucKXuh7LvNmT4oH3 zW@W*!<9SW`Q#KRY&fnc6wcI?OSP!*MS?VBYSt8WQ7CD5Gq-a0O=p^Wzx9p9!R0vZl zJZ$!bHPA%l;W#AtPp+u9^EDKPV4Pnb7c_F_7WPWs%lAzSog>#>z-OPY{twzYeP9Wo4k zU@PUclfT{0qX=uKyD)O(y5E70ZGHt#g-;firnPs+L3*Pd=WX=WHTZZ$!jiYpv4emO zF<#jSh~@&BNZ>v8EKMdP9jTSg)Ous6rB)TYA~>saoSa@&__Wow3^wYQI~$!dwt}8c6zjoayE++&!B>z z(Ps~Chu*37Y*9_KD#snITl)dfH5Fv7712H#^T88??y_+uZqF4>kPlqne)D>JiDshL zoa#4iiG#Oval{sHUES^z_)&aYn8)p0`c6tiG!>5g9`92Qn3NAuXNddnguoJ#zstjA zHC47_o7xE&7A<6SwJ3^b^L$!=UQPP*d(7Y(%!Cf6nW5qDRHNmrh-!`QqAF*=2Th5? z`J>F3p4U!Ull?v%LpeVz_-HkedA??GjwM3Rms57 zYunpi&AglP2l~m6JQY`Y)$R0%QrpcMV0`&91e6%YIEh$sE)}8vU>CQL(lO-oo6>~T zwz=4`%ooG#?WaTnPnvH=TiLUrk9bZ z%smuL?A{-WH$c}n>1)bmQ*PkB*SBkKMNu{pa5eW_*?8*|{Z6f}Z0fDwN`R7&<;Vqk zq&HNH>rGnLx<%S^D6T%=PF7pZPZdRk%bM-U*E;Pxq}?+ z)vEOAc5g)L6EF}CCP zL!)af_EtjW^!$L4z{4C$VwWp&sq!Z^qAF1PWnJckg|YBolnc%67WVBqlwO<5DyExGn%d!8WQM~g3y zEj3v^4CA}lZZ;NM*pbjOYx{lWJL8O3)<|a#1C3(~Gt)nZsQfrzzk!V}46@W3{yA^Z z>O6}sq!JGUvy;~M(U$Ji_4Z0-Jpi@%^?TMzYU2V2p&(e*U-b!f9gA;`ipXZKOSuS3 zQk9tilR%gJj?05hk#~VXddsf~)lL5%SBd%t6Tkr0AG!7L1_~tbz8u1xL!l2Bj5;EK z(ce$>iXeEXe;bv6aq|=N%v09Y?P_T>?&m)~D)Lzv-7LGm0I znMeSx47o=a>&27Lf+q9vNI13JkdP-g)tR|ALTne2?P}p{k)K+=0)jnef-hd4G*qWu zEV-+j*{X{#>DLc|HM`ypnh~_R(383=sHLOD)%Ok(3MN0(mSrD5DfCl!jKkN_p;aQs z)yjDD`s7zgx!l3PH%rihZ9b|``sQoLHl9)5p2SXLQ@gMXxRLlGW-+1ohCE8 zP?a^CvQ@EuT!NEu9xv1~-$o1W_~wpif^XpH7IWfx0)1`G+4cQAJ45qh<5@ohL<6+H zQ51}S1Cz-ZULso3)D22sfZmDkYbsHb;X@+U4rr8JG{ak zh+C~;GCjhAI1>BDBAA7Lpw-SdCng~A48O$`3e!kW4)iQ5hx z0Nj(mbkt1;6%~{k`iAvnjNPFH$+o>M;tIsUCo_uw8cyk9*nS_#mq;1}ve2c;9LLBq ze|r~k`vUPl2KrqU@N>c8n%^6~bgxP63(uD+s0{lG-6LFESf=5Y(P>l|O0N$dji zZp1jeIwuV~2OX1D!Sp=xN2pCoN(m0-{V{AmX1Boj3->P))b3d0)5l42uH*)4F&_pR$Mw*#H?6U>>#g0m>Arai zz0w`g@*w|pM^L2e?W2If;z$MA`V?3V*=X!8>87_{%{ViolY}qq8!_Z{eB~)56p0}` zUoVkzG~C|SeAP0`5PrV;Sf{#|Syzpl(NQRMKLYEGkafUYm_Sb79ANDie6(bO=I-*O`EwdPnZQj&y=`*?#}f)fxkrDu4l~Buexq$pHTjx;^6mmjPQ z+zz!*6_)iY)@Pj-ltpl!?_;L-7l1}-RU|%<><Oh^4^;6t4b<3`@Ia%G>=2Vwh%Bhi$I6$X9f3&g;T3*HBU> zX<+nO6>etg^}Kq_;l8ZGxU-xs!nxMbPoZ4d2%>>rkB3ALDo-tY?d;DQ9n1(feg#aLzGif<{jDLjKtQ zwiko!l3uhzHLhVWbSwLz$<(=DfXHl{8L|;^8Be|t`3z9x%zfRkanz-%gCE|$9wkW( zTm#rLqWJ}F&VK5g3_8zBU60ZM?e9#eeYn}xi3!7>MrPu?Xbxc4?aZEK2liKX@rF9h zQ#s9N7OTe;D)k+YJfp{HKtGLo${Z3yHXippm3^MYh4%zqINm#-=-+~$I&&Qgt2urN zEh~vRgY6!XuFrf{E~M{xnMf`FWnq`l7z_&7jtzbd;yffYA`2fJVVMB3lp0{{o__xNM=xDWA6o0uW?A0ZI z6o3pBdGGieta(4XGzZJa>QkK;WZKufpSkymF8DbYWv$V~Ylb zvDUm@^oJn}4sOjDy(w9Eu=nPRD&O0+dAd;Az|}U|k2hfN3ngi-dX_o#hF@WHBVqGC z;z5taD$+|0){zH(^+4@d=4rsi}>>7d6!l7 z!;I4;^Kq=_eJQ2vUlJXl@QTy!q{Hi7^dVFT)+I^`{-@F;@Bdjf${)(@Kh6uqO!OZu z4FK+foX(|OL@$cQM6ezE$}hz8)?YYTQ3O_Ij|j5s^|lChfC7F1_pgDKZ+z0MJ0E$H z0JY1**AktSQ`zK*{Yn(#nc%Q*2D0)T^H}4|`{}V8Wm1JSy8l|v=Cug@H z9wH#yWzL7*e<%?Bxvbwo3{sn3y8^q?w!`$QJ{MbqOS!X~kZk}Htg_<&a~Koyg+--V zXe9J??A0)DnU`VK)eBIV^%{#ErPd{8%B1{To5QsDf&;68ieZqlgE^`wR>fR^yAW9* z1EGc{cfC7zbe==08~h-aznt~cQBCH?-}pWg8KuS!pv7nWp_enZUXkK8+{xR$7CXoh zW|yCI<}`vP3++PlX>Anf#thqZS%NYF0a13zkR*VB-kic%%*FpObE!y(oDxveG%{wM z<&3QUF4-;~(En(Ml>NP_lq4%SjfyFS(s&QSztTy;9#F}ScYQQM{cQh{`z`XEf{a?Z zr>>o0a~9rTrj#Fph~boCLsFdxEsHSG0hyPoqwWP`R+P01%{U-_vHS3L-XE#&``hS{ z*&lIoYhh|mH0NY~+8RgU@;IZ%-S+X0d9EjLIz~?PLR&uy|Eu6pS`37G=p813CJ?}1 z&_@|+T!mx!mF{U0EIdVL#ZjJ$p!yZAm` zKN!06s@19&*u6jcuB(5pl|8Ig?~+F0DE_ZT}UGEws=UDbX-K!HU3@ zNO|^dM8?NJl1dgUZcpdy76#)T{Z9cH(`0pgxMcR6fB zGzw7lG$fgDhh2{rnc0ql(M>a3{=2K~twH~`xmFQcsdz$To|S18Cl@pn zj^_VSaKL96Uk&QbMN`gNFr*f#hOKEf=}O#J(ivN4t8-6QDTvv965?rzQ`7^!>1&4) z)hkh)^H#x|j?@^*=|w@Nf@U5elC&#~b;L}m?g`bX2ydPE5zK=2Z>fdV%Sm+*3 zUxt{a89qQwYgk2UGU;LWs<|&Zv@s~%L-mo(x$*0ajZvpCy zCQs(8j(uNj@?c|v4Duy8H6dGf9;dn)Yr}PCTI77@B`RUg^%ow`DjMcAfb4py)#>|q zv)QMJ4jvT^+5w=5ZUg~9xkgYDPfq2cBVDQ9+5D(V2^34q(I(kD_b>@ia74pxAT;Ul z$#pmp%CnQi!UM*E^gllk%ue;UWCSqIII;gKBmVD~J^UZr;D7eu|3CF#VT%g>e@!4} zpVJzSuny?{K3_P;zkMVm^gs2Y|0f>$eR(4^8sW zIo$8ZXWn);=OaIOrGeU?qQ*Ui|y)BbU$c?6!D zJUlvUd#NuIp#UDF{~h2TvOM*jj%27F?Wz|_k3N2Bq+kk{xeEdi#I$_UE$qPheZ1Al zK}^!LBV88jxWYPof0iO@dSkj2l8CIeAFbpDRDvusl0UDtBk!k$;J(7GGIa|l+^<>m zAYEQ6@h0tw`yV)P+`0QEl5_h4NeL@%4_mW84(SUkG*xtl6%9OBOl}6SD>p+v$sOR# zmaYi?AeC6kqCl}cHCiCWSp|ht2u&c}j#($YHH|zTMs}T-VODaY z%#HYnqks3g2gv-TK=mNj{$BoqdUz~j_zqv&{?s1ccpg5k zamw6WnG>J+;U<}q!h&0`^d6|SyM0}vHO71*XLD;2bC3(e*QG15?a<;ev{`6-u#anz zz>@Ahpmg!Lm$+llHi!4lIOlpm{ABx_)vNaQf^5k;(JTDZ-G=*ew@1+pLB)gjk6n+Z z2NS_MY zk@6!+Hz&|l@2z)hpwPsf;PSM1%cko^9^F*^P=>-wsmva6dNu8V4Lz>})7pnAR64qQ znLrP5Kssig2}~tiW(`-Q=>1N0VkX>QYMeAjV0K=A5Y6dJG)F!B5Ie|KA-iigHl4E# z=D{7%xtQk`X8*!!yzHoh>wWIXX)RygQe(Mcm3iEU+vQ9vlG>O3lLEG%SYGrC(>dA3 zE66TwzrK6x=*Y&`R);5XK#A?3?ANg6%bo1}qROXkO*y$Uf;Y(v;p?zd+s#}C#dRDzAy?xL3#erI2aZ>T+fgC-27X1;TPwE1dOTVM-(Sh1n zRHBl<7QX;KnYKS?jU~=Rv)pPlb-<~7@TVvefs9izQwJ~LJ8po&HCifx{8x4%%OW!} z*xB^Pv@T!R>)LwuC&%6o(Q|^-+O9fkd&+>5tneC9=1jj>%0xR``R*2O@Miq?vj5L4 zn6t#}etKXF0+D<;8$gx%YzNduqMDgkJ+c90546t`>mERyv&7C|!<7)E$EAmJ2-?f= z4ZZ~6H=Em6xSqrovC(Q$BsR#A@#OC^W%F8DyJRH zjf%%lk|+?x)strgQF<|ML=FnH4R9!}2ohE$595!1cq=r8wH}{q9jtNZFJT@GvOu`e zFWSE%`ZoIHo=Szgbx}KCuI9GNTq?cA*j;~r{1yc}=UCuRLa%1ru{_+3WsQ0k`aR9f zC;VEO8~qjcN2|QH87HO#-r4TP!xJS3&FvE(q-;^FTu-uu&4JQfl!mfz$qR=!PoQOq zl@t1oq}hEGX5&dIla=pnGX@sS%FV)cmnFnL7_yQQOgdS3L#~i`k3rnD{7F?RYVQoR z7fZX|(|bH)LcXRNFwf$q?K%hB8$0>6qL9nGlcvl$W~SK?|Gws74Fz{v(X^|!?wb<< z7KZUf?-6eo5!-b0L51hKQt|G0444|VT)bst69B(PUvfUsVGz<5cWdU%Rc3^W&z!9P zEY!4f6K<!II#1Me#vGs$Z5GH{F8op!o z-?b!PdQ&SGb<)f$?9MV`FYBo6WC!WC&^up<1@ zm95sDBR!vbZ`8)PbCJ_l5g@piSav7g%7C+j~^m`U9?p(F|%%h_< zX!w<{*y?82Mf-Tdbrh-x!IlS@yRRNf21WbADl%(sY#@=|U~l8iNHVvu7a`k-j3nv{ zEq8pofDR`yKw6(0!B9kfyBv5B;OG55hK{K!!|3iTqS}}yLeP~v$=;LOQHXP zjAi8qNcm3R(2LRGgD8VvLt({X-RXb=OQD|-!vL-Sagh zf^~36onJR&X?oL%d3M|mnE&KhzmsA6m1+MVxVi;-P;>#8(FGn(uT1)_`(6a5dEMuA zFI2S*V#5wK!6zDsLF9-$Mg)gCVXxIRW&Bv(E7H*fYV;G?eXp>);eHob;dKJV0((H3 zgR-?#0>a~+6}M4am~U%!MkuVMDy>1<@b(J>L3uLX5PJ4N1SNXk+9xV5W+!FnP$Rf;Yj zW4$g)Pg$kBtXQ(XR^RH~xLMqnk8J#bnde(G`PUgZdyG)E@_O`=(%mK$d#b0ms(TdI z5@{ud>0r!K4@(I~py1$hbC{uy%-&VCynb`6*X1wOW!+i2B1tJ*Z^GI8Hsv2w@AqIg z#wmhT^0peo+th!CyBUeVMM-Hs2S)+) zpOUNj#+&c6w!rFEcBcEZgDDd4Poc%uD6z~kPDXsjKR`v|QIhgvjQ z2H6p$oGaTy6a(EbSFm`1@@W+*rkK9q6L#$!@1Rf+p30*q4LoihY2+LaD(%c|rE^hH zX_{<)AN3oK(YNl4P8*sBO(;}o<}@IxzG5kPZ=<=hv=e+0@o4llF|tajwNYO+&KRN- z%2pg&i-{$xyguw1+X9`Liy8n9nL%SzAWP>e^c|ijRa!~wlSqquJ_oxH>u%FrsttKA zXI$wq0qp`+Jyn5wluJhk5QY z2cw259n-YQ8tGMwPk%b>9GOf1=Bsfl&#Uu*-~g_-!mY^-Jw)lDn@GanIHxrqqy0WJ zh*qUNu@?cI3i_`Hltf#WfCzOeY%X|B%7sIoy7cm^XZybR*WwBhkt44Cu)e)>VeyK% zzYIdnj+xU%0H-Jl5!R)Avy%6Qk}K6 zD_xj;tqXex)Q3rv6%mEF#?Eed%*k;7NeP(0i63=|&~U}=dIH*f)=Hy_sA0)oID748(wga##UcZjTpy&zV7Ml#Fmf#pqI`yv5l8 zkbq=SWTydJnZ!U6&@=%a!&qFm&C41NmnUv%T1&9q-JYwj)H3Mzj)3}6;fU&BPWMLG zLXFnqp|J+|Rp;AQb@R++1qwl{lsN-C#jC{@L}LYyyk5(%aLm&u5<2y-9xQd zr3vb)wjIy-=;HA6@>I{U%C*M$_(rE1ulfp~x<8N~y`*Bo1*sTJkWiL4cR`JN6h4O6 zFk=S$k+heG-hl$9dQ+_o;0Gc@^m#n%=`=C#bM^NiL{%h7y}J<%jFE)_)aRx+7tbxO zhkHJ{BGHf7Ho_JE@bAG%iI22~H+O`@j~8vW4&C;=X?M_O7w|DDwoyO}_@v z^4B!bzn@2~uiM|?d2ln!WXNHACbvdUARX)Nr0#MY(~lWFwJM}AVq?vB&ha^-^4+?n zityG2AdUa9)B=;9nWykJD5#-0)4(NJ|9 ziLQyR-M8~KJI(zWree)E8_`IvdJiBlEdCRKBL0T!DA^i=T{QEPYt!opko93k3P7~(PD=r zZAGB7EopD}o_w0;4V-hB)!~g(aqre0X@M}~i2LQgEl@&2z{!h-YE;ph;|P7YI;lFJ zR@;6O;sv!{PZ4zLJ}oV3c#W_h(X+psznHR!G>P0zHn@f=M83I>YGU4^oc}|Vty_hx!WV(7f&rFdn{CCmH=*_(AEmQ&gWb z%Ru)QtTWHuJ{OR-KS%b^%?N$2BdIzGIIW*3*~r+cN+Pv{|H|0V6QF&*nfYp^#V*<2 zim1iR51x?YXg+N#m9|_k8FNKiYHgWdRIUf{<+P|*>U~cm{4nR>t9FA~$C;TvYUEOG zFq1?-kbJ|%O0Il5Ic!7JWQG~4^$%(C0dDftQrvbl^!1J~0oytK0cWr#XH=2(K)Vms z++AT$IT~BwiC&yRN^fVm)DmiY$S=C&I=Gvi7IP!lvR&)7hJK@#%}@j z+~|KE9~=CiiQO_iX8~(IQ5`Qkv9dk=hIy_2jonk1xuiSG2+%z!h2-|igbxmd7eBAx zIofy!K6b`~%ho(XwrTK+2aRQ5vK~NOuEw*U9)?pb>>}*KQ30S#cfFOvVENsj3&k+z zCtxs1p6vRoq`%|t5sc#Hxm=IKtmZz0_-NA_?>0cVl`x8XvnS*8^V?{J?dgr1ru(Ki z!4C@ESKN=k1-YTpz4~AVoI3wBP74W14n#V^Z2g|LKa;0>IA$*OIZd*>>AhED!p8c& z%Lb}H-}31g+Dp=rCkRO94*T+zzJ}5k_pxJPbfv-9Aj)K?h?yGB2D0+RZ1!>E&B_(# zE|bqn(MU1^g5_Eg(y^ZyX7%MpcB0E)=?}Vo{~n028Xk7~e1%{7JT!iLysNVl#8p30 z1CqRgNWMI2Y1)M$PMSfDOR?LxH2!7oq02lp?j6}%4>b!&j<+W8jl=a>uQvM=sW)Bm z!XNzmrC&@ODF!8ZBsQ$V5CdlZHVb#Y^&UN$H!e_uZWF48!cJGi&w{Thbg2?FTD2cH z7d!9lD^|nTX#}K>4xFvk9?ZB;4iqrSeF>QKb~+h~5)ca-kkO^gy!|ZacRwRjL3T z^k=NFqSZ#Dn0H~?7tx+QTx|J@m0g%R@y>OmNP(iZ5A64tkvp9n&nL|_;LR_T-SOEm@poZoZ-LbX6n1*w1BW2AE;sHYg0N$ORM_M zXE0LZMVE^1od8|a;d>0}AQghvI6_CHczia4>y(i<=Nb*uK3kl0e^2mE6u9^o(9IPy zM2p(9Z0s2ABLW11<<9D{cvaZu+49Y&c6X4HM&xoV0_ktL)&tq?!44Eb}T+Mv$09`Q`~dBfL^N z;7lBrNu$mZ-ift8=C7WW?-CTWj4!e{g?8l=awUNgeCy%I!}r6iK7^WV)xeOBGhOP&kw_7*t8-joo}^*f!`g)KCu30KB(T% zZdEQec{HO}wFS_&6RVe%dr|S-`b4Hbbx&Ik_lsB~fnvsUzoqdT=uQsll zJ>SIQy}Q_cLCsT(9zAEOl3&H+6uxwH0{JR?{`bD*3uHK;FIri_LEAb&%&5lDO6M%` zbyp8lHW+2tcn{W1xUddrXK*xsC=)&H8#Ly^$_J7CRW(F7br#4M6g;(D51J5QwTdeF zIj7dB;9j7<%&}wP8<)Z!PqRbU0a`;~W-}4LvA4b2R0*pZyXN6*oB)%jloC5+H{ z8N-|aKy@~~Q(~VYiDtvVFVPyG84Je-$}G2&f&c*9Zyl+%DN$W_3F>$ zeEz#UOaK##GiaJ8y9MCIEv3oH3znZ{2zT_uoWrY?kg%Jlpx2F*$mfA>5(ZNnrwVqp z@lRBm4eI>TNdmcbDj(++gn(xK1d&>n1Tfol0(5RlO5`TD6fG&|*wEZgkmJ@-jZ*1f zJ<==q{)H49=w4AbEpC$NN1h9i`#5Me zn;JYXFC?!>=f_~`ER5f2mu3C~%+93~4!o*@7e$fhZ})SIob92i%jd(9UlBsoLrgk9 z#>5<6x~4YkjSydIK*}ygt&~y!7o2HbX6oo$YXNYN6z|of$hV4OLzx1ARahiSH=igI z_F}AVPgX-SmL=-!!6`Q6r*RyV01q_IW#Gv6vU6OxoS|MHZ@* zFc1++#&cDpYbfWW3MJfwr$=^vsuMsowP&K>tHebYOXh&kSv}qJ~;ZwJj&{S7d zW4u^O7&7x&eUjr&A6ISm(qor6Y^O{m8#_&}x`|-&5V=2rk9yaq-c>b8!6A+)gQVzY zZOqaBZPK?TQe4KjuQ<)mu0Aj_EZQEC@_B5ga=Y+`u~SBuzo)s)Am#I#XdrA6>+ENmWfr*+3k>R~pq<;^_;%^xKJqSpW9=rPYsD>rz@9hNH ztaoev{)d3;b9T?iI32M&>SChfG5FF&1RIpsxJ0BuRJxDu=wbf^Q3c#6-0!Q@>yroN zyFAL4+%wasSowQ*_T-(KjXM`@ekTbUO@kZaP({w%SSF22*PS`27kYmh5Q}M9zxAN`>`yFr~PX%VcEfNIkFz#g3!>< zf5$E<`q+jy&_GM-D#@(O)1U~cc;US8N*_Oc-Qlm#EaRd?3-qs{m3iXCxpH6RK8BKT z0=$bL*13jO9(zT_x0kwtOXVL__1H0b=V`Ql*h9r%qf1!YzjI-D<5k3Gj)!_Iwu3ZE zoPuwNnS&xIHLZGI`FYD1NWJfUR<##!H8jCRxmy0?ix+4jZrY@{yR$_yJrJb_%q1>D zrE|8pl+UrlmR(fW1`4}K?lXr|&F5Lr@&cFc&+{{#yhG3?XA$C`I+{F)nnDAVUlA9_ zlQfeJmz7bE;3)XytxPshm@q1z^U)_w#^q6IN;%jhvhw|oM8mTuP-PfOy>h72%4$-i z%J9p}wFu$)Ke;c=K~@v&F}6G*lL~CMsvp7he<#)8hM}^MK@YP+YL2u)N0%nA42wj` zcEnPz^T>HD@@I@MM~VDI z$&C(tg9L`Cn$|E2ceWeII=78NRh_vb!}YZ=^ogyenjW(N)cF|C}Sn zn3Rj;!Qd@2PR7L0Fy)ies6kK9Us5NSX0NpP(-@WYhxas@^my!<;NBhTPZHFfVqN~q zdktqnn6i+c3^4^ss)9_{vIj%ZkokV*cjD9~LQ#0UF?tfIXDVR6c= zUmmbiYRGJo;zbo^`K?t`UVuSEllOrRsi9#A$V7&>+Vw$dE+}X9BDu$R@V?bh@w*@S z`5NMO?%IQ#RNP!d_S;O~4U_mEI=}g>hwrC@x92eS^C08&8$%MgTSPA&4i#wsnMUqv zO}wNkE~#TzAi4eXrM;(qoTQ}eO3(EIqie+X=I=kJyvY)=kY~XhevAH`T_IjVq^PDV zya8?aF`-|WkbN3$`iD}9T=%*yz6$~_n7zBZd(B)X!S_1bAy2Lp!NR#E{E2`9bMOuP z0fCLee}TRrN-KuL;d3T`TdZLVqP8g>A0L0`^;iFleZ66r4Fgma{-gbR?5c{)Ke{TL z7Pye(#Xst5`c93cR-EnMJBmWHiPFNA|0*p>ev@3^X|lgJ<8|Htbi>Bq_4J=_xW+Z6 zZTXL)D}HPfSim&-cYUjqy&`={^^dj;u=_t7)Bo+_-!CsGd=0$i?4G;-K|+3geCI`wSqg_obP$b^oN18#`Z}_M*9hOG z3IN#&_^TZL8Ka#c0T&ZgQ|OLvaY=T`WY;2+MhE{WHh+(!juE_Y2Cx zsNCXLSePY8o{SZ72LHm-s4b3nij={3Tsd=DG;f7#V-B7fG(SQD-G7&_1m8#tpML#) z?fde`e8rP|+%ZHRC6HtTp2PW6-&{%&H$eJ2q*5cGWdkakR>aT0gkOtKEDxi*+>ROi zM8+PUU~cQx8_Y5wXjC2jeXMQH)M)Ni!1W{NC(Ol2kNU_+Nm*GLxl?+HYy7dZMFDXd zY;o{g#g>3pr}A;x#cLl6DZJk6xXOyFh5XSdRYH~5b~n3A#vj_38n(y_a(RAaz3nts z>|8RP1exG!Z&1?$pVl0ved2B|QgbU1fMFE> zyC+j-%xQ0}+!DehJ?#tGVS$e%+2XWX%bNd~E0Tk+nHZO_KL#LjLZQS_r1S zxTwc|2W|cgNybckm~{6>R_H!8Z`xmt1)Xfyg5Rm}A*@z!aFZycMirYxcNTBI31y;v zIY^>Io${KNJDvWmO5g7k0VaigcsUC2&T4Y#w>IEZ_iqfM!9PM+&LHRe9}cUH1)SJ^ zL=4=IWV3vd$VS~?aq4iJOv{~ufZ$EWzt;bz%K6dwH29a*=9F9VkUXeJZU$A(vt+ly z*J(QuVY`Gyq`Rw6bgEpIG*9p-P6nMuy29JsFTvvbZ!~-N-8_m-XZYZZ)6OV|qZ8#j zomSx|FJ27lw)gicDFy!0x@lh<8<;Jw@~trPE)S`DisBPGTz_GLeA<3bl8$P5#YwKN z`lHqG086Tvh6pp=-6kqYSDwB!ofdCyE2Wgv-0+Xetjs%Y>sl+Ccb+^C^Pu_?3)e zK9_iqik=BUUY2sF+SaCt6sjp%;1Z0^BdhpO`Fx`e^PiQU0}jxnrqF7c{ar=2_2h&o z&UnB1P{OO=N?kKMNX z$wIW~!R1?7bN%7Q3*f<8JfdEhUmLR|u6Bit_1l11U{Jp%1a`SU*grQ0vdvCk<-g;% zt8!ZC-=Nt#D%*{k4l}piCSyH32z=8={cEwts+oE?eR9i*a!u>4Oz7#uA}YK?;LSYw z*J)s}eZSj$=wx*`_4@#93K1FFGu=&uPS#(RBe7Zaa(nKn`PV10AxV05M>_2@mLbyk7bXl&N}euiJQp2$#b z@1}9|+bH<=w+_IYYshVO)+NLDhV7>pcHr$y{P1mrr)mhI>m|-)QO#!} zn^{nI1)wCXOu;hhLg@ zd)y9F8U4&wOcmzK#f|FhhTNK`YT5Ew3w;nPv+e6dt)~SnnMDt*M@!eYpEA>)ebYIesV=ndIi5jltuv(a*;D=XH=mE+sUb+q@4iYy%!n(#z*zg2 z2qrI{_WUgv$;~x(akSB?0tDQXpN8x(j&Hp@RyiHp#(1n! zp{Cj|mqI9-)Sv#1ag|^CPi)=JuJ-WofB_!q9~3>d-QP0_bn?aL5D7eb+i|+YOZV1! zq^Wq?3CtAv62j)LL3kxXd~kVBqqM=XHq?uLre+S(^mBj6LjmQWBHE(V4R@Xlk6F&y z$~u+H^3#xKOncILF&W9QBzn6LuiC#i;NL$jJw2By`DXtmWJr|%6pBzn0^4+iH0`)X z1_OWj2@H7Sf^p+B4f%|XuX?(sAm+$}N2&0-)#Bx+nM)xU4+;!#%Q&l?k$B%8`5iVf zgmK4>usaqv!f9$jCo$j+4~4K9OdRym$rpili#vE_#;$f$9v_i&x?U#NObN;mXEm!K zA?`3IW%0*|*`8%NYzM^1y$C0@!yo5?BhAq*N>;Z(dARl(?KTA-``7y- z5cf@S@Yj;1WwQ%o47mbdH{-aKj^4dg*ie#L?xcr2#{WVoF^ns#!5Rhvn`k~X&0;}K z@N8a$UAHn8+5MEHg?G@##IA7#yxYtUkQvY(X`UJ**F}{au+oD+lrOW{S6Y|r6s;PY znQfb7ipm|7l4+aHuYQy`p`ed< zjTfwxB8OEoOKnnKFRL7shP-uP<<2@tE~9BImVUm>q-iCowCOFRb(_}F%h$ooe*V0# zVYcPgpBhWMPVHEjo|(_OJ?fZ z-$MmTT2+u|I6}iyFS9X}CUTYSF2#e8bE5`&|W6D_hJ$1T|Y72hdW-Oa1 z*GmNd37GNDbP68Y1AYg*|bpnkhNr2Q^-@>jR%a61~u;v6M>OEOWr0u}wm(~T3|Ivd!@9hd*u}GVi`T zM{BaW_=_r&CkhsISnOB1T|qqx!MKt#IGEwWCOV2f+mS18UD-N>(Vn;P-xe8y49guY9v=yf+Df{|~B zcL@5H7bJ=zlHHZk3Y0FJWILqdUmB2p^+F#FsV16^a=4E47`~TLHv2QEcNj8DW%z!N zU(wPmNwrnE9`#^4D6Lt4`tX$&wEkngZ>uXnAI?Z*UFvh0S@~!q5ODHmKi9Cu9UU}glKX)Y} z4K=m!KtYFikB{=a1(!Bz0It$ikto5*ntHSdAgMBb+x7Z4SK1_vW$apPAA=y{uA42m{jP?_zlYBxdM{Cp|PaUZ2jKG6EH%Bq|~+eh-vr8ylJrEwq|I`U2h}R`Jy60KXPfL*uoD zcHyTg@kb0ZyLrW^$fkLr$(rM~uVpKGTQ9dXeU2%E(3_i4bqldoZ6mD*wR-M>$Tt(J z>^$%DqV<%mi_+RmFUYp;DvQp#%I~XiJ)D9T5ltRr=INW=lZ!1CT0HgBmQ6HX7mN$& zlp{F9uz625N2}~b*7Fo5D)>`4k7}QtFK1f4@h3EOb&9?aE<5-FuSXkB_bUqHhZrj> zpcK(3=Gd7QG(jUKLz?B6|6<|mnd$G8EI#fn<d34MCf(Ii_c4rH zf^NMnHN2p9G;B4?A5_vMuw7ZC7&@{M*Q-5UJsEzMYBbD*GpQXNm3XaIQggh5z0l7B z)SN4j{1W1RV&+|0CT1d1uDyP=lo9-qb_Cksi z6Rs>o%DezgmM@13{z6aiKvWq`e4|H&`%aH(^o$Gbm$6m*qO`+xvuAQ-_VLsinn$O= zb3V2GQ;R0LTPm^jl>hmgx`ko<_{C)41xADmrDRKer4wDI%ZAY zp;jz$XBlrJGeNb3ZDu-X+s(biXrE3md71_iHG%gf*XLW_>#G$T=}o1Pyg~7Cg8KwI z%Kdl}9pnwLN@Z}NHt|30c{7KR;A5ZK0|^b%0yw3z!M;Fgnx8xkWqtKkMYYrART7Ys zyyNuZib6DEjj~h(w(lE?Q!O*}$u%S>w0lz+w~j7)`P=x4j&VA{A4V6WvG`?tnixzSwCF5Ybw=xhCRDcZtfe&gH*^7VkylNZ7YH) zk(hLbCc2M?VUyRR*Bh1JteX}|?pPb1m-^4xKW$Z`F{#r(C{#;&skhtg?j&=tRqix- zDS{3*M9J!!@D%(GgH!}waVr(Lt)}W90l)DhBmb%Wbe*32wpKG`CW^1l6K|aG(hbsc z`?)t_Q|S!6cF~CBthbkXF*~O%Zov=2vyOdC(z$Q~?&US+jRy;V7?!9O3!1BSIecwV zVIHNKGLQI8gIBfzMUnB~&Zq-{sLm4SeT{mRR!sFzM?>r(XVcLN{b`49-y&}7u|i1A zu_kqhkKMR{hn0UhnUb}Q>)YRuL2pWv#r%g`QW0w?SybjyadY(%xoIjlrhYCM#h_ps z*zh3SZ~6SgGrwI*E@MX(=9C`|a%cv)YWiyZAFEXQGM}%%qgp&S&W!A+`aKo^5#S%` z_u$?UAw?1+Jgo#1=k*N)y+)F?9YeB0caPueUjKBkzOl{`1d7B6 zz8=pXJ>V}Lj@`JWLw(34R*m!M22<^hld z?}FgibcV@_ydB#@yB(iVjotKau(y_MZ=dSeO^LIwv}v~LHF}ucKPgldLLUOTH$^p= z5uoy9)8&GdWLB7w5_j_~vl~I;Z96SA#VMl%NP{Lz!br<6S#yh6V(RGy2xf0bO)eZt z2j>yf*j`wboln>seEFwi5i%jbIr&Dlds~rHLz`ZD4&{k5D0HTRZKApDSI%Zob(U3S zh#h1>*Zq;W7u+!Y>>5n1V4qmjx74qu`b>ud`vj6p0%XRFecA7w-m1f##M^wsolG6c zcLdsVa7T(r=sJIGe^%Gy0g~CX&cUxK&W!%UGBos@841WnefA}tnKF3E*ecoF>n4!5 z=lK*aoSo@Qjk$84U0zgPEAh)?+rIC!)i&FYO)BP#V=87F%Q<9pNRQFj&VBPjUCDww zg?R6@%xF=|B^=9#zCJ;5rGx{52r_>_Z$z9Ijx@CWQG$C!5zZOF!_D zo=~XS^|JcIiA^CYIQyNBg$v}7LRt=-ShFcdo!;?3Hnxg8KgrH}+p_eu$9X=~JmR3^zy8L<{uN~q_awc} z1=3kdudc)-bCWmg7c}Q-(883?@q+E9S2=xB0rb1LOPYUZmcA4AfT2%t06PzS2g0+R z&N3F;^SX%)U(v*+L>={?bX!VD;!J+IcWmH+hfN4(psth!`_L(5XWV4S%cjA*E&o=~ z{IU6Cif?yW@L>#+PCkjz{+VMFw!uwO?DCfQn6=$bonQ@6DG51LeT&3^Y^|1@B$bk1 z*VO&bpwhE9zaG_JtMaf;rLe_ZNf5-bB6z6@|oe||+ zC0#g#_n9I6g|}HYYm*NdC%MOP#?_Psn9SX*r{Z-o?H@LYY*$iehP15hOi{`saH0Ff z^Q~IH%#5?iMG7{CeJ_a&z5DpUuS8C>Lrfkaa7LP5^r1~dx&pKBp4pKbi_JR%lA)q7 zZ>A{9Ba+=%?=X$+toAU;Jg2&@V=?+MRuOxnc%~vYGfKVxdy$D)r7q;E*LEBSA=o;7 z#CdkeV5SW;ecdjR=rx??Rc%IgTQR>@@sby-E`hRPZA)M$%pO&TZLcr5N=ec#vb|JZ zW~5wdxHCyCTSCRtdp6Q^pifqp>NdfG=xm4EY_rcO-lsAkqY9CKXdqHMv7na5k{X5; zZ7nvNRSGdxca`W*o6z1Bc3Il>j2q%O&ZTlG(S03xEQ~+==DJ zL7ia{cOp-#E9b{>8_mh58}5|pvvwQKS-wSmj;c?W=oY8yu6tZNorW{LpWw7J)3tKF zeUoR)qVKT|P>9N?F=m@N4DD}kSQp;0Ag)JVF$(9=w-~EAiJ{fa+@i2fmo1MetV(?M zt6hh)pk32i<`V}e|I2%`fBo<&l5lUA9Us4w`YlafzPDi8=WUR@7L^sZ1Wt>*UzN0u zZi9KN6Io@r-qdpoVh;}8UDqW+U228ae67~AGVhWHhQ=4A?UvT{bY(3^9=l$m1nYzM zHQ3d^H>f7Q67gx&7nK)Yk92}D!N0w*hNr^PU!ZVFC@0wV4sq z4X~;p3W6FTUGghq?ub;xMr_{6u6I2yN*v?9YofNPew+%vTua8BTYF;0w7fQ#J*?n5 zEjao#p3O17f-F(f%&bq;W@T!bB1JsDJEmmfxS%ZhCOv3`M4p?3M`~|j^yV!Y1SUxt zuAiB&PMCeiw<4K$%f~3{jWn|(+6CKbx+b~QRP9SJVbg2~=nGLun8!BSasIpahi*gr z+8dbkjo|#_8Rto&0%Y`U%zPLY>XE-^Hl3EeBP8U`}eZ{O9t8{{RR_%-#R$b>NHR%O$eUmpX(owe(5gP&NAB*BXK+uK3!|olj&D!8RNzn={G+zkrJvc^GP_~JaX=ZjX_ypQViyUcX}cSVj5Phamj2ss zwLwF0#ZoSw27~Tj^ootqZ>@KPMj>L*RM{ziK%a=m+Fr>XFdd6F+l`wlU7vYUd-QY2 zT?0j@GR+`;rsqJND0U}u+5PquYqbTt4AfR{%uiPff$Qo@`RR%FEK7l+J|QRAkmCZi@wzwlzjUW+ zQocH_(|c}r1K&`9gcLbU<~Hl@#5>KIdGLn_KUHv}=ZuvvE;<;KPY-SN?C>zn!tFJ9 zm9R5gH!NgSye$bG~?O*TB=PgVYu86_VhKviaF~H9%mDUqnP?eoK{L!xF#y%F zE|r*XE*#OiG;342#5`5ALv7w=_5Wk*)715f%>S69XMzWf-+$uqyW}Ht{IHZJG65+b zHSsJ3VaM}Dyy*I7w=E}=whf=}vSAR`KS=V_CdHw9FkCFm+2k0gxO#;MEW`^;_U@z)Y@d0#x%qM&Ruda+O7yA*=x z!OIW148HqM!SWLcSsc=eyJEP9g?R+Zxr%Ij6RkfyT3g@%odg zz)lsVxinj^UD=vm`&LEqco!F2W@4$Y!hf@{nlv{swpXEZA4IVjZfb`xuzE?hG^ z{iJIwqPFBCh_Sx>lhBl?Bld<(%ZkEmtKsMl&@%nU&Bp}KUquc9Sree2kc$6OI0w+= z{{u2aNplxwW3c>GrNKkyigFW*T%;W6 z@;YFXy)kgLZ68*_6jzbJP*OP}z25eOyYtGL7)l6yVI!TBm%~3-bk?_Ve|wZh$-aWn zX&8)fa(T24@xMx-P6XgX0xX7a>mNQzfZtcgQPCgXx5VLh^~lHsFLY`o?AU(sB^r0v zxAd8*4*}>af%n^@%Xh_^2?(ZuE#3{wHMhkWOpe0io%?hAx}iOinY(%i>>-5t!Y7?F zk5dQuEmAbU>!~@PTy!a}DQ%vN8jYsi)^etmF|hL&%6B-?4s%#Mo!jx>Os%rJB^0w# zCa7Ng>U-M!TeWHzwd4C?wxS_^GmbMIQ}i)z`^VU!WCg(^T;89#1QX^yN(#&wnH7uG ztr(1+z;yrlUSgSJW&2)9hL#9A)4IocS4eWHEh+@Uuye7{7j12_u8GTlGh~~C6)lj1 zOA@<|q{!++;A?nJ(hz0GyBA<&)7E97aXY6X6oyN+{e8I*j&Q8qwljlPG9K8B)>cF? zHI_*UfXLIKr*l_lLl+-H6vK3Q|c1&C^&tfkQP!xQaU ztRFYM7O(2hU9EQKXQ+yFMcI4tac)qb$2acL*MMjgaz0KMJa1(JFoJI)*^;;&Ma{i$ zEr;GyMAS(T%8fm1{Up19l6cayP>V zX3DnK+0JY^9lbL7IQF}my_k&5Dpw)^D%d}b8vS9&56+aExVarERMxGZwRFAAgUOO3 zm5r#T%0B+Z>zhb^MujjXga-Fhj4Pa8x*q@zN{3ECNAb6wTK>2q6W^*xS?=h(Z4uqw zDB!zG*m3QzoOK3H5Rk^QY)^2uKSZ2=AigJdl1uAOcF`-a_UK`~-8*Sx!5Vh#!!jQ+ zJO*=rI41l01g~B}zq z*74rYzufhD7sCwy#u&xMf)iQSQe;^>r6XBi_25Z@x+$2#+zYmhbx7i;T6HZNMqBS5 z^Y;GU5_k`+`;vf}w30jrW7&ciZbMs94O#W4lRaXiYSA69<~*s8PoeQ1ALtPfmkzgu zJyB$@1O-8gJRSl|SGSq-G|SfWX}F!5unYNE>8*gl)BCOBqk$>>zmJB`egmk;5alb) zCeAT~VJ+3~aAK#cU%ZTa#m_tYy&X1hU8OwQO)tIPCB`6??+kGp-HJc0ddL@FZU!l% z0H!EK)JqAEa(Ft)Y?Q~=AfM9}0Oy9DE)iFcE-k{AYDJ49`|AAQxjT;HAPEH$E)ICf z#3ZM!bn||ELZS!zB2;PRV%DJAZTiIA7P%h((EU1V5Usqv7RM@HWa0+jRP{ApqX{WC zD?h6!F>2kvUQsq3YplS#hGXpZI3iIL5HKm~v^Swk>7!D!{u#jq_x9t&y;&-!om&%6 zDSz)54`ECqzByE;_7~a8(GEPJp6D;342=E`gdjyyU;NsJD ze`=A)#mB=*+Dt4pc=L&K0d{l0dizAMxS<8&q|Wn;OTM)aXUTI7aDL0GUt7gxzp6}R zr1j-6#{$?ah*?4pqvJ!;nKD{k+xq8w%;9gVb##1cGz~e!ROi4K{*xQW2KNu6Qvo?- zgB`k1M?TTS@f!f%e-mwBclP?f&9^ zurTgugBWglssDC17y40{`h+DgPVf+zQY^b8$c@O}nA8=|l){MxFf zljJLZ?cmRuB=>LTpDG?4m0CU9K8nwK%zCvo{O5bxSnd0>#Cd2!uv~2R^NwoM2)2^_ z!1367n|}FjjT6s>9_n@UvnBM~R_NDv*aKp$rw7fwSOt}u)VO|M#g??WFDaleeqjyY zH_;b(Z`m83!jI96PEFEB@%A8VTw@> zC(A`QFe^M#a{eSO@w9{%)|Kc6v6>c=_twr4%=bh3I+r&t1TM%FoeG~sLSAv+BggavTP)<-w_V)zuq`1Hwm&KW4|@A0 z%Z9^{M>RKMPDz@*z*MUa9}^jti-RI)OVc%GJBp*!UAg*4eOxv)HQGlxW&R7JPNJLv&$d483Z9v| znftyrc@Q!?$y;nybd82x+o}n%lc`e>EBps{y2c4L*O~;@A#eNfm27^%u&QhOt2SfZ z-o9aoF$y6`);Y6Uk9%+QgZx{u8-!Ifs_`tQrs`ZTz1gu)(&uahbbB4_@T*l21w|ij z9AkrdcoLl_hQRNzg4k5GXOnA4UnMn#`Q(!zU0=u6-nx!YIzKfBKEeNFvzBYmUgR#? z+e-N0Dk*=K^Z}aK@(C5Y89PgS0v*u~3DMrY=!>6PZxKzDi6yWnqaf=a(YDg1Yz@PP z`FUG>gT3@h4ZWGWIuBpQv_7)-I7*;LzIH&7%g%9-&Hahv5jA`QK-kTC*%r)nU6HkW z=!Lj}UNS3^E5LUw^hwWEYr670De16Z<9U;QE}VdTG|)@6$98C7D^})qZe4#-JIa|@ zp*wc}MpDoa6@1e&vWhi|%u3rdrT*f?0O3uj^zyHV2H>s;6hTznN4dT?Cvzo`7XG`0 zlAL&;bG?Y$JnLLYS7?cZ?<9l&ABMMgU+sPv7f)1Z(m8@wuFoa&mt|cQ2c~avy_J#X z3wBiL7Mb7g^4b%YaXON%8h?=9qd2rX^TJZ)Ly zIRK;o@shFUM|EYHQW|!wzyG+72h@B#Q8mXz;o?ALpbo z6*A0!;-O=|h?7Ilf|^T@o9`1mZ%bjg znq5>Wyd82l{pmUx=X9<4$?KR8Z8Q5W%Zc-(ZV;8-fu5|P!A81Hx>G=a-VOUWe-%`n z=s~rpncW&KK^@({$z80G`?CS2B}X6=#r5H{>KHA8n;_c+zg9K9RDIqu)QY3(E3$lL zG-|3&W}F*5eQACPG_88oe#u6B z;lD%l@FC)lP#_A$fBqAD=r8sfAQk|KwSb#JX?T87ip{_9|9E!Mzt8`##DfVul7}F> z5g)xN926a`MC9||$1?UXRD~1YilW2%MgJUgCA!5P_fY-!9|k=5&I3pS6WHwZ?T!yB zSu>2+`7kuepd2e4|HY=#02U~oV0DFws80@vTETS_Gd+5i*3!b z7-f;Kj^yoo#mk=9@uNpYfpmm6K>H2&=w_pa(@C8BFLR(nU;PsWLAHWc!R9a@LhP&m zWC5K)XsD6yo}}bn32qvgD#=H0E=f5PdD?Qdg|a1u@_l7|noaN#bD2Yq<68-<1??Z8 zx<1d4^K~r}Jq$`eIyI^}TCa(kEW_TFCfefqDo1k$(6eJ0K!A`;J)Z})ylVfmb}(_K zhgAB4DcWq)7A{P=l*z^5(k* zd#2khM6qSYGBsx8ek#<_eo3LoCV2l@mQtyOVUK#g{``&)!2Dv#Zg@|7L%^l13}n;? z1TJ`IC#S;(P%#rddfRYv0N_Q7f9*naQw38d;Ej>$nk_!)cvZWQit{Aj>A0R>o;Axz zdZn4f$sAu_+ryKDi3jWnE+rdx>C}N3sj(nd;?7i6irTyPQC0C(uAJ)M%eZWd1z!|R z1hM!5YSj0grhRe#V@m*Ge@e-hapgLv%bnucQElgMt!Q~rqOR;?Ryz8dx4j*W#Ik2t zR8GugVbF`B$P@qx{kZw-Xe0P=j**}8z$!tNKVA<&@{OhajSU3smJUeWr-|HN>P$?* zw3eKYGt0dsjz5ORxbp0GzkWeA@wI9`0|*N8;!JvM@AU+J5G!-<1-MoF=2@VTES;nH zcC~Ymt!47@8&ESZ^U3M7UfexirD}-gyIj6~^|s3vfZ)VlQv?M2_C^SccY++u(9@yY z8@ro{!r{`#&s4UI84!>;h7TI`Xx@{fuj0z z74j;+%^+4Z@WsD8ISZoT58lMFD74aC<{$YVXl%FsE`NEh@7Y5G*YNuKs9YP5Q-@J# zw4-@4nv6tMV1k+!2v32qW*O6FSr&eEL^qAnLhVypDorLq^}=0`QGS5e6<}p?g`neG z7vKv9bh~q%Y(;?)(Zq*|<-Rhotxp&Aqtju|=M|$|0*&&Q+e__8=ZoV?Oh|jV8OTk( z+hdUTr`Ao@k=TD+E#H&7RyCDptUe;LJvDcYTr~RmxpKdeczzsQFKO^8Yx9E+=d6V4 zvQ?57#p+26O^G1Ce~nF;>$d}x+MBM&0DaOW-M8tg(xq(uG8lgG>$Ttc2P;A>#IkX; z+}Gml&%eOlR-y+m7hCo*U&YUPwltU;Qipeu;Z|CFp>B+LmIYy8)9II$~AeoiJxTch1C?miZ>T{xL^@D`Qw8*P03zAf|R|NsYvgScS z7y*I%pAHOoC4?s0W&ue~msAkx7G}v6!|@k?4FqJY>~L=u_DPyA8aJ5mLOxm}kvNe}nQE(4~oRVUKP=A*hP)1;Ayc&$q+HlcznrOh^I$q|;6=@-|0l1yflQ zHQ-`gTt`d;R|3>D0N^ck(+37{)&h>E{++ZXh+Zz>TBv=qoWbjSeAd34ov!OFQEY)Q zxZq#H##Kk#G5+8N0vC0{S|&h_#)<(o5OCXTMs8=~@=U(k2M_Aj{`zmm>i=M%;s2$4 zN6zpsVarD6UnH*oH@52k&Yom%yL))>H~*!OMH2!s+5G6nhD|kIstLXeJ+iryy$z)M zfj``@<4@lHtK226|394wEz@YLx`uCwfa?>Wr2lGaV6E~2wrI>#{tlj!CPD~o2><63 z|5(8PdjkJX{xw(s|4qr8Gl%&qlk_?VXHP+(KQX|Jk9qzdcbBbWNkx8*QgtoeWuxJ0 zU_({kWj|h?0H*bSm#0vQw52Nq_u*w_+*fHNm2TKQqH*wi3P856$rca=)V=P&W5zdb z0h+aj9-yX`b`{&+<>7n=r&<{Q=8cdl9vkGS`6d&bJ@$Xr%U95qjbw0x-(~mGyTVHDwNB+45C-pN&-;fge13 ztn1Md-W7Pv2a|T4%9>8ggQ=UVYxuwAVO9*Ih<^)^(sY#-WbCd3q_kI-MP>j4Vp}#r zbxWHiS&Lgw$O-Uoqz9HiwmPbQUY_q8{)gV2zx^X0;5U;5M#zp%qpNxEaUKcNKa6|z z{VG8K)4!ILWW?ZKO7pjX@I>w)fH0=ailhu(dBqiRV)+Eg#>xIrFySWa%kLafZ;J(2 zZ<+rAl7joG3Z*asAPWspc-h}c>nsl66>@R52F`Ef=J|4zMoK9PiQJ?6JzwW73FH~~ zdm=R@&NUtY$;M5o?A-rg*qwUA0m5<3qkoUZevq7eKwCay(9Uf%ZTpL?Clw!cIN^b} z@n)o2rPW%G7$i*`zQyVfJ%vp4bMJQgdRoZtW8nz1i_vEzM*y*DwEy+V#Q`nDi~KPr zBJnz`*t>sd(^~--S*8O(ZjUSj?gc%s@~kuh^yTzxf||#=36jj}zM^2hQUdd``TKtYWP z5NNh9KF`O{Nm$sT`8n@rb)l;Cd2zc78b}-EFUv=XFU-;HP=DB_jnlr{@EZ*_3{Je8 zK#TW2(TA<0jiL7j$toOx$)5(OPLc~b1w?tlry~fhCa%Tu2noN4cyh;a%op&K*NIFT z5+bj*W zV?eM*>N7+#q~+A0V5SjBiRBH;hC2ZpKmXR(@?WrwYU0^p!-Q$8&DxcT5@XD-FAIK_ z)??f>pza&IOXrzkwQ})CVkNta=P9=b3OClBkfj6ulVi*hV}rB#`zpeZ4swVOr~G3b zdAZLtWTXn>?;fLRPP7|pC~ZLb(i1fi9`i&3e6l@Num|0ZF(s?AvLrHM1@W^%LnYY( z_O&rBns3Xcpr$4<_#BL@2TQqj!&uBdt8yt*`h)IPUs#oE2r18$s2&2OH0M1Bx&pj# zWdK0nS!8=fA?qyg4KB!LZs>qF@U%u^IR9 z5JjWk`FUV+9WEhKOdli0;te$xp$<0%Te8AwYu-h zMM7NwFwW%>x*~Vjb^teyQ_l?@YBt`P0baeL7xn3Mfy##)j=_`10JhaYbJ9SBTjZGpa>-lHQqq z@i#wYqnEh0{CC%Y9(qBdRUsntCY29zvzi8#(??s}`P|hJ(Dm^(fH(5w_*+sG=bNHH z!@Gcyp}_CxXTG8rwO+vWhFXi6;t2RHdh3(d)Khm%e4;9`GdYjk#^tf z{ch=pd3mEqk{!50<@bmu)AldKi~;y#BC?^OkUR zPsD@PsV8f{pGocXq>4;hK)a1XJ>)gN)9fiXhn|BI=1(Le?GpZ*eu391fAovA zni)Q8^>EpC&*t)KBAv2ZW2jfPKpOmhTG6akAL2TrIM2zS)J#uP$V+AZeL={Ml^OQs zI-$xdo@;koCM?r4cNy0+QV-mIDZfy7GK@L#{$rDwA-wK3dXkZXz_m#1stMb*O7woI zPT#{Rm35LqO#?VNzn$-1hP8KjW#I&+{jg-uaK0ga>-f53FQ446dGz&W;l@?!D)U>$ z?(LsiOM^QynqBNU)^g~m^h_i2^-S%5hg_kP_(SIjYNX(j8_j>grY=B5N;~uRylJ7* zJNgA!BYK|7D_gfV=KZr~>`=$DEU!kYB&n(i5@YARFI+~h6@$vCf zmpsLnT@z0psggwBLxQsNiIIL&6LW$v=+WDe(7wH{I5)OT z(+DfGGp4qN66#4M#7aMDj72vsV-`p(_PhhR6v<;k`aKHzBOfW}OZ)f1ly4c{8UOf2 z`H9vXwaiJoRWh^iZ|=6=5s5S(zOOzy5{#G@M9rU5rp06+8n6R41jk$66f{r#uVXx4 z=CaauSsbHcaEzpn=O-fRF`(c9n&ofNK36|w4c8PNc(<~DT5`V9;ren{BBh)HU;pVV z9k0zRX=x%mUSCnK4n2S2-=>s-%}&9hzpqAG(3D&3ez}{`N$1T#YJR>dte#lG1`Y1P z1bYwj5erdte({N#d^*bb;mVa`$3MM49KFetbC>H0MIjM#D~tH~>nFJm%;S?ZCPRfh z-%)dKs7)`z^N+g!$(?&6pXmd2P|bMCTK((ganGp5gM&}L^u+yp6Wev}eE zU2yi72z0|ir7*FwfIcWfzQOCBp2B+R9{Yq zs`rpYyn#c61UgdCt_1_phT8I z8j-w(Pm2m8(D9xX2#;y*Giy<6SJ0_kL{p7advSimiBOq#KM;)W+z}Dt^mNQau=Nr9 zO(V*l-t<|v1@L(IB6pUc2Wx8_a*D^fnmAwV3))*M>XjnD&+BYIVsQNEqw>8K!G3Ec zcH+-M)IbInqFbzoMCD#z@u(Igedbs?aX#$p=+=CWo=^Xl<4JGv?89j%)4Qy-0f-%j zZodLDW&WFW^sZY{L)zYef$sC*`Nw{V`Gspzcs7D2P4vyvr)zG;)cl272R40|-uc#N zqw}d)oLi#4AGk1kx7LWjej}bUowoM(p25rMM%L~M06*M=MP2kTi2N^z59U_l9BWJr zq7pu@dWZ;LZ#njaV}8X$B>cH}1-q-QsVRUtxgYUGml0np0pVW?!R`CU9SI-CRkRn&WMGw^;D31jv-i;^2M;7l z=U!FU)8>>q`khi8e0nsnxq|03^ta;YqqKMDTS!xL=$M&Lu@42Aa$C&F;wK;Bk?aCt zyGS$(Ftx_bV4?D_Bzybgp2?6-`^9@l*Oh+Tu;`_|lkk&|AN`uXNRtKQN=jmNCmTIs zl9HZEN4EweRxbstSO$Fmedv6HP8xF0Z{Hy9PNG%qk*6C${y;)TZGW|8JB%XpzF*yhx;Q&UJ=wml2wfk1f$j1_)IG{>*40KUZ0&^gDtOV53n~86 zWXiT^Z-HIJ&0ta7K<7v6prDhYQb_&nb#0>X^&U|2S%PbCU|*w`*mkn}jh##?_Tj#bHY|2#NM?W?b;^sbj-sU;fAY z$;o;}PHtYIkcbGRX;Vf$E(FloK369S6!HXPNq`KGFMJ|P`njv3HT;djn7*Vzo_+c1*Ps zJ+oi-6+Uh z7!4XU@_d%vJRJ58MBeB7xII(G6A$Kuc3*(!C>282P`c4 zMJt`nyKi(%ZHOdXs z4eKzVXNR*eFI-|HFvg+&+~%U~ z0QkV+e4U7)cw@9#`LAn4Z2eCt*!uB-yY-@Zw?5WlvcJKco~09L(-z-MF~gj0lQ!$K zIcWEpWIq4)JtwmyXp%uiy4PK)uE+CmPudhMF2j2yGdUMtC-5?|rG_CX`Hri_i3Cgc zx~h-n^XY`5AH+(m7kd^5RrR2V`R{24EG1e_6F9n&$`ti1O!1g=Aqn~%>ixY%rjhL} zHQ7HX7&UP?jsRO+Qrl$u;lP`;^bc{x#rU2mosFf1h^gM5Aiu_fsJFn4+eT~a#nfOu zYWb3@4Pv-T*pkbK4!lG9($!9?dq3#@GWdV4Xm{RooyFBA#$Ijukhc8e9bH^C46D$d z@o(BC-|e{h2e|2i?LX)CK(OHxh0{0q%5NgabMQUW@0h^1&!udr45qoxhHad-Qn(UXxXI>ZTpa>?0^wq<3}TsKb;LRq1n5H@I0xrP z9>G-z@zZh6N#8zLD01usi`PXA;=Itc)t@L5)~uByq-yB=zM5VB7y*Q`?zE?Oo3V~L zbc#-+oD-8Cdg1i+htK%n*lFdfGs3&Ja?;-{#N905TZ~v!VTaZ$-09H_=v?SVo|UkV zqdVswIZ&~>D_-xpr{AlrIK$_q6GW!tZsy7n(5m8;)+>sA{>=-=$esWX{{fgQ((P_5 zFD|r8caweFj`>4%9t~qh&uRfsZDB7>f|7+3OV3x%A7sQ9Uk_HgBa3 zVe7G{iJiE9Z`jB~-P5d~n2d4TSgw%9wzgW_{fjA!0%Cim2&lKGD5;iU6sQ>v&0TUb zmYHHeuSgLHCs%n^&`U@Yb2@VHe-ihW&skJ5ko+t&h{4StQ^WIlbu2^-tjt#V25M;B z1F)@jdWhsHntUI93e(Y(hf?W^{^0UE#vhxU^L_6xttp91tl|zI{%7-UBKWID&NMcy zfj@zJhdYw(&DG}5P+-0$#6SzhEfEAX!;ETU5h>(%3^{taWo&Vfl1{VzFBzOzq>QaoMG)d_pT2AgYdxK#7;-ef4b=I{pg z-4CDy@Oi96n(K4*e@#>s>4XG3FzTOMD*!dRVvJTopLcx(&O1g1Bp5RQ1xor(r3zor z!F8;^dQQot#G>sl{k~CQ5h6$Rr3x*|YQ)?)6U`6`))CBBxQ5Bqu#>g-uG!(XN`Jiny0DsCE7mrBJs$Nw<5FY0AQq``ucVLkdSL{7(gg zfFr95f=a*?|6K-8R(R{Di3OoU6G0aJzot>Zh6W~cWawHg6(9!}-BF~j2@Cx56r()%@#Hv7S!r}N>jx(-pBRI}w&k z%vV3xoMzs{FsdUYO~SO@>DHLhcPG)A!33N?cn0so_053A*sRo5a1}MpDGLc|aADYV z)-|rnE|+eP9)B-#V&$SBoNx^V?B8L?u=TBHYnm>76BbRVGbvmZz-lAq3vH~q?rBpw zA=9e4K|F~P1LKMCR0k%EB@Hz;$?^+qj0BmvO8qD6m2V(I_<-jSnii+ z=lH&f&qw90rbRwMrOM=DVzryeM~vx0|M-4Ly{#9-=+eVH^@yS_>|W`yvg(K&jncP}Km+QF;$-n`5u>g@?L!pCNq)J>UgYNVW??bB z_QpDn(M5!)0hiy1WpRQv_IX3U#-fj;Oe8Jl5s!>zXxU^!aRAnK?$b(X#GGfF+$gMS zF&&auyct+zQ7A$J$J|r;%FFxLd=Y$4;fwm2J?b3({q;IWTrPY^@P52NGR>S)u|~{B zSFI>PP=@c?t-d>kpgyPq*MGe1n{qNzFri}(UrVt+kmZs=O9lWbl=)xiR%6z(VQMRJ zb0!|Fa_#X>?yl>3slcp{zdbkCI-|U|^`6J4O);-cpB>vUWrU<{?ffS0`-@tR(7SpB zXaYZaaS#0xeg|QwXJis!FBj<@l?DGjT>Tddmxu%NwUe@)TKMbR3{V}ZR_+NmcnswR#faFn*J{iu4T{NxP6-A7RRFwGYtT2Z^Ib@p{$5Vi0)f2;}8;KgQEAD9Hu)HPd zn+`N9M=0PJqhZkbgk{pN^-d2h0yFGTpy74FCpb$z7Xb90bHrHV_<8D~cu zMz%eawEjH>U0a1#Z%vI50PK;2=T1PL%#u#ai1s z{`e^TcOU71GSZ%6dl*C1TQhWofj>I?gIy_urZyzykjzS3a<3~u0H?w|LKA|jC0zF- z>wT~ep&E9K9T2a=Vl(i`!jSYOlYA<{M6%Yp-a8t|B9WNi)0oz7F=59oTV!UIdlT$a zFI29(LB)?)s-;zHd}ltd$re$Rt|_x9{$;u&wfW$!-BDM7%{EuJbqJ{(*|U|4cn5ow z#vhe7wQ$YyPI7}_37o__F;Y90%&4j+iprG|{T|65+5h~kjwh;csqnt~Qgb1m_EE32 z=BNRbYA5EVMU?7h(>KeRO}~q}e)ptT>T(x|4*wyn!eOnvaog(tB>kJEuNq15nblKz z5vZ21#yGnxix-HaO(C|~p3m~@O7!pU?Bf3#MPN-PG_Qd`nO2W{;x6*F-~B1*hY_4^ zX_hdA(G=WPW5S>O;ViP+NuOJHPBBm&`;@;$y5Ye?1SXnpcCCb_R>bEc{*3d9;m zaz0O+Uc2+epiQ?{*l-VzJjn&pQH^l#Q{PKY8tmg){qeM-z4?{Ux7$L%!`1Y_VtP}3 z>uF^-V}pSzDW>$&00xp46w@}tAgi-7W&=)1abMwg7~jd=xJ<+pQfB|{XD|}G;OWN< zCBueQL_J;fqxpyB-=okG5d>^5@Z_W3N;8x2lB8MTyEFyrdPktfzJ@IP*>#PF*-czd zFY+7fg^pjzrFv{+WYYejR61d&LO1wYAEvOBP9D)5o_qX_dzhRI7DN3={4lz>2%45U z!)j`DgEOj`$BM+!$S~K6W|)VnjXpZG#7^dr&FCk@7P>6c+^er0BO4xx^- zp_|5xZIC4bSX?AD2Y@$PLDLV;@OYiCE85o9)uRI6C5*BB7@NCwCk!%g*=Rddhe8IW zHhvc3J{AZGH+sa$Mo{5)gK}uQV6HUOjSIyYAgCPbLL|N2p->nk$P7g7Ja<3?phg4i z*H{NH{6c2pydq~K$FQ>B<9VCe&t&v=>UO8kujR_IGf3}X$7I;Ep$@eDernT$W!=ay zC#>s-AKMNJ=|G@Rm*n&2w&$}LdeEE1(-!C#h#rYdIo;yb)Hq_;0X(`(a+f9>cM)(z@^arj;v&bt>7_O+Fg zzoNabSN~sh9X%l7BtU#7vyGmAR`HZ&bt(0T#*5TG_3~$#qJQvV$T?>wq8N{3*Y# z_w`{hveTyleH(+NsC0#a^%7TcM2lS$TNEBUViMCe3*ooQfpMYIDZjV~a(YsnmnzrD z*mA!<68DQ`ccRO#X%qkXm@|1JRbkIG(rMXf4>|N?6H(W_hsKOam)lway^M-OwF^eP zAKr*JjJoZg3lD^IX|aQ}B?$UjvZGdD^x7(z1(1sNno=^f9w_oK>8VrwBhER=Unf%P zBLX{2(3^;%RJC`#xTo^i{^0=*M)+(s1`nM}FmXhPJYFVqc6iQk7`Brq^Iv{Ck^K-d z3DFYRXw*Aamm0$ntwbcvw)5**!0#IX<3#*KcoDORQgUE25Lbjl%pg#W^%GX{$Ne@r zs0r7^h8O%qm`+d$tZTWrNqeNQSj?U%RCLly%~a6a*Y2KhWOiS0U1=Tcrdi+^N8lIS zSp=(LgM9u9b4CkG;n7{g<)6P!=(aS^pdTap=;d-gCOQRiT@MZI+E*gglFOw-LgT0q z7occ^f%(+&IGJKeC&O;!po9bR6m5g`g}-Fu6e56DlQ@KI?$e?E<9M&stol&kHLrGY zuc!rW=0pEkpx%CG%vb-IGl_BBxj_gz!?E#l=c9X2^5AFYU-!ya%H~~DmvRN}HemEm2gpC&csT8+m4qgR z87AE@#*I`fD9!W~_ljq%bL8tg3+;@UyW~gilao7*r!8jp$q8PiJqdwqQylzsjeBY( z);k-(AH}k$e&l9V`~J_Q$z$9K*5F%F#Ugs%NfNa6RGKgy#<1dPR~Q6ACRD`1{&BN9 zR$s*40>Xf(skcFAMa{_C6pWH6aVu{T3+Ndg=JrB(Yo$dO!6ffh`MWYYln%rkBWf=o8aU%Nx(-FO96%Vy`QmA7+cIo%9}9>2dQizXsn6w<~e76+7sg~g~widv%mF3nD&%@2A& zLl5HG7sf4>yV;1g|D9ZqX_AAADMnEHhRXDUqH@G_AFYoB6f%9W2@^f0OLq|7M*%83 z#Fk)O7nfwk|Kkyk$-9HuoKTE3AmPB9*Q z#4jo>OD`KhTE=D|`8#$F(zriqRBWYb);M`?*iJW=)I34}+K?g?QWj0x|JD21S{+f83?=u5%Q zTxnQ%%mca#LyQ+2VUr@FS<&Sbi|Y(ukY&+DiQ|WoEP8aKddFL?vr;mPqc_yX>epoZ zsf(uv{^)=I;N|-S$@B8tzoo5~l;!EsG8 zpuUl~h0^a7T;m4I)kyVRdJ7CO>c}?qG2th}*kEPWytVE|NzF^;g-&IFe55}v%Q#c=mY_6w4lCs@_+7RF$6Dih(M5m(iy~dE?Bl`J%=E4rd zB%4s2a8v`r%UN~K1TE0zomf$H@NJQSCEz&f3n`1s_GzxYaa{}dEb^=xZk3W1a03Y@ zEr(aqnot;4d5w)8e3Tyr(z&*D7DRY~K{Xgw&42-i@w|^rOX-UmYs=i&du9W@`YbYX zp_Ik-G>d1gY-_HHM|ugPp`ufD)y)G6Ny(%PPecc0WJ1mg)P4zvf%Olqgn{`VyEd7k zTj)cO19hk}RYm$0)@JrxeBxJQl-2LnQd?LC5EjLK{yp_+A_A+2-#C8M7M9X|q>rNx zgMEzK9PZynJYN5Y1bn?a-~5liGPUT|$ruE)y-iCthPEx{IA-K(+Q@>U?1LSnblfpg zs}>ey!rJ4MOWT<|-kF6-$gK<|5gWIT4tlqBb+#AqN}BJ6)|^qIhh zUnYf$jWDk2B0~8zAf_xpEDl>8;9V4^@v&o5qD?!XW&ozA3wCUp!#)Xa3R+nnVbjnj zjNAM`{SF6{IAV{5nlS0vf-|+rA9OBk75B%u)?S#G2-7MByhfxi@OwP!Yfn8)A$;q? z4GTO=@Q-nW^cup(5pN?|SRto9^nCuvW#!;A3cIr?YtNfS-T-TCL9SKsH_OF{WdGzM z7M=Zjjm+1`6H^|6JiR|qavD9nWtP0%-HSjB>goO1WxL*GG)I$dYxP-g&ja=#kkC_sC;2;0gGkDE*YD_`4btw7aJBA(7~=it%>}VV zF}SVMBN~g`2FjFB;RA)zlCpBG^_CAD}X`UaVf1Qls@l|9%WM; z6b>|tY_RCNv>gf#-H2DKK~Cbm>ie*Ql6L89@!>Ap0ImRuT(v78ViY0o7mPM#M8FP( zrs6Ir9*tJcanVwnpovTKQ2c!1i`kn;qCLSIx~z#+k)u*u*77*^^g_`@WzodJP)XL@ z=M|f?_Eg1sXmSIZt$oIS#=>S$M!RoYa%mg*iFHqtvE=oKIt6V6Lx3-TrXf8SfSR4u3C4Z{0 z^U*&18racb;Ff&+=|<<;KLRq(*vbPj`nk2wcbv7n7_=K&($6JYJQ3j!<$>k5#O9@4 zCN+{V+@%y9c{s>7zg)Jq#o|0`^7IX0|23)$fzwP?xV z9PYR>BY!2!Wtm9h(RhRV8+C?9dKV-7$4+G|q7r~-p-QTg_G}|eX297_8T9kQxk%&( z)6v>+rWqH*F1>|agRHu;>v>vTwz{yzu=5oXlp>EGR#w+SoVJ+(uh#~wq0bW!uc15N zfrtPZ4&U+km!GLv@(*Z_T+MeFW3xt?^6PJ5f78vSEo|6F=1rak$V`~nm6b^ibHg~% zp42e}=zyFM7wVZZW1t!YLN3|#p+fvNf~u`Iu$6WE;_QS&GX8@1XQ$DJzNL#0X-?{C z*Q_uzrP0sc$r{)Ieq1jpEDXgomzRkLHzju)l0zI!tOnKPpfmSRR)N1-%Mx{nWe2!F z1^#?>>M@({Zoi^)j>pCBUlS>t_O_(zKPkvuVksWo4HtV3aec6}=P*0FAK5{c5EVrc zhMi_u3=t9=xa5oQYo}*qHlg>|11r0hn7DUkFe={F`ea~)5s?~njckaBFF?f0zePd1 z*s4WQ+(D{cG9MFUJN~Jvs3;VLcrpnA=jFUf$0LG`11I+4m6Pb<{~myWnavjaegYS} ztqslB^asd&>tsFf%b{*~2e4_F`90pBwmilDtya1-I+Zm94_1G&oCVTueb*s}i5|-) zwU1Hg?`pc90{=!)uX(LY6_~kEd#pJ7{evJ}u6-bpcPQL=nz?W4g|tT6w{67=a1JI5 zuO<7Tn{AIadw+H8oZ-m#YrpNjqP}5CQ|P?g`kR8c^3C^b0E>$Mr<2>skG{gVXtpU~ zr7%O^?#=pd;01_6&t+LucNBW+BU%o=bTbR~DwrkWC-RE`O+@HqJ*V3X^GEOC%gZ+t z;3?znP7pHp;GRk}|N81^jk`ji0e5` z33j_arp2KFM01R4@%ateV+kV`QIAiYKP?J|k5xy)ad%O8bTj5NoyVNVcIi>Q-*S^p zP9*{QA_xOk*wlC-e4%_T2q#^zj zpcnnu{ts{X-{2P1F)u7T0Jw>SY+z7QErkQSvw%b7n1V7tN`aW78KDOjl!3lM&2m)W zRv1r|{VhyY2p;v7Vk5~Z*o-)T5n~&Ev%=#aGUNDhiIenmpUX(FP63by1+!7kn%=&d zll%f5G;hW&ytr~0Z&nNesudxdz~3;M)BpyIU}i%~I8!@e=V#zDNK14}&a`&X)(rl! za&rMxB-*Ae38|q~M&HN%I_IiH$z^va5XxbM>h&z% z6)*M@t{n2sQGgUUIF;kK9Js%4V{ zrsJyazf@q%uX4^!;WPpzc4qcPoi8G`mqik!Eh^+R@o-LdB|y##`a~4KFo4q&kg9&s z3KQ#IAo96LG{~T}3c+CyK}#3Gd{HO^jlaVRi8xpSW8G*|L(@! zf_DH5vHB4UQkPM4-d*Ez!LkbGr!QP|i^QR88-WD_w^dc=0TWO%^Hx5{yE#)!CZp@i zv#jm**nthyG~`Ce9y4}{_oM^a3NS8rEgQt_6^v^%_F(Ms@vX3@AG-J`JMPbt6W54# z+(d7Cgd)6;%Xb$69XFD(_|`uh^vP>=dQFZC7LXh!)C#UHo)PHi;cLsblugT(PF7Px zp939IusOtA>d^^tC307O`R7LX6_k5B4AUDT-(DTmp{+eDx$aqVY=<3*={P4%{JK<# zVZ`$n<8{iMSBx!x<8Im8jx1Oq%GZS({tqc823l2^I;2m86e%kBA0ya`(2u8{_F>aX zpHPK%zQZa~(}F;yxEaTn>8!z({G>5%mF#>>8g`KiqnD!6y|`Yx7qc5@h(aY1%lXd{ zQa>jYh=z~|=eeAyn+~}9gC9?9yq;*kQ~aT%nH_g|Loh!_q|Ybo`-BLO-1m7yh&BYP z+!I2kwd8&=nN}zbeH42L+X2%z_T2Mt383*Ngb;h-GfbF+9l~(|KBqu?5IR#fu4{is zZCpcvWd~TbLB`Gs(MM$q^AD+ghzqBKvnzm4;z185ia0YK&NO^x8Mxn-;JrET63iZm+k0D`h!A@?{+UHxvfvVr9Gg)Z&gdr|A(qN!dU{s2UvJM}}o=&m2 z_R)B%B$nC#o7FmZoPQiKPpD#vm(v$<0Okn?m#@o=`F?W}N~c!PfO^Z5WD|2q44 zwRoCH&C+b-pDzS3DeLv`F_y7#5Olf86b4)9sbN6%RdMe@b6=x_aeNG5Uhv3IcT_ha zp6e6J$xS{Kw}q~El~5oKCC;CPWmvihi%N{nUxKkNdIEld#zfm|h-$fVnWsWOGY9_u z7l67G{3MQbD#2q{nqGCcZ1{!H3P!?Iw47SLmiYkh&oLIG63lo19EB|2FjyPobIkgm zXHRlHu-4sUZ2Uv1)+$aj*-w{j@sr@?i9vXtv2$jQBQhG1t4Alp}W}+bCmRcYJM((r3 zDnTDGt(ykJb_>C3G_kR7GousrZ;QfO!E+w+ZM$%1ypS&K+siINu^z?;XaM(7BAHd8M zhoNSyrYsSq9!*sT6bLZS7Za(Fm%@_R?><&-uoWyP z|IUtIxuWFe_1Cy`^QQVifF^UF5?@i%g`0AHl1%-1CV*2)=5B;^O4#Rk+@_WvnfjX0Xn7; zIy?j%vF+Hw((ZI#awU=l98tzus}}PoBxm|Bj!yMQbdI6CP;5>cc1cKz-o%Kp|K5gE zrJRaqn$aGFV>nY_{Kl^nB}csNEm(Sz{1bdhwIfcB8*HLHeo>G2iV=gvRCn{Ld%}!` z4}bPcAj;UCg0AF0mC#b!i8%a`KT0VG94(1uke4@8lv`gi~0ns}}9VU9-4V*YzXR+PI=;-*$ zG?)EM0*CAl!yD-+f!(1nDJ}#L1fw8DBAqbR%Ton1lEb1AaO)pn zH&o37-x+VKja7e#TJgK9!erk>2|6!MmBv8tVRG%m8`CH1JAIQ+&6=5;)Oi0+zUX-n z+KB?%gp>cr$&(yIu@$?C;H0Il;i8^MB{u#qUQIdE8}2U)(k6*(Qgm9yrTg{mN2|q` zr*%3gF-o@TEB%D;N&Ebb-O@8R++j<{#MTx<=_Pd3V3G`dnF|GLU)7z^)ikfw` z2(jTP(5trM6nCFCxWK(W5r_p+HSxPaV;dTjf$F>cOv5QFkrmHfDQ6H*Zgnxk-l?rd zTO{S3xg&bLS?E|@1nx2E5I=6o5aP)V8A@Qaq4Y^vj>cw8e>Cf=SWfd!;9nQn`pqBy zF%B*g|8hM{NUj$XZzVwK)MK+Bst=#D^?|DIH35vZVR~&Z^$3P9m z40Jz8;LQ@vH2gG)=hC9=Jt;&M3d%Zpl3K!4g@;#vj&Q>coAX~$jfwhX!K%l1+Sl8W zR1%pwQ#6FHQG1E<*RY`f-z8(~PRMnRU7(3Qx$cu?W)R$Yyg*~7o$vuu0^94+n^pgj zhfu^4P2+kFnKxqGa}8Q%w`R*-##;ZV_AfpC@C*?Vf>Tn0ajg%3#aabfKI(ejvCIJ< z+QHIz;R3Lahky4Ga-!%HwD;P6tGpx9qRvGvEwmy&A}VHcg-~`aL%Jr69@oAZ9xDFj zbM8Px58s$Tvu7MqFmJ>R>W_ls2-&jJG3j6^qj?0P{xa!0YL?9O=70MNh7gVL01bTPpJQ@~%Z*8bRmm3^Q(uuE|4QnT| z=F_Yv6o#zF;{P4`HnFbH-ag}5iOa-&OMO5nZIWDEO12p}dzV2i^YcG*gyjCjaqN2sVCzVG*LVy$Jl`r6Ta-E(<#%+s`HPNB^vT&ez%HgKLg?0X=0tPaMaHmWkQ{dPoh8s_*tLs zr{^#Ax~HH8`nSNj=D{u<>1W%>?zbGFYaa2 zdcGyNG~$QMFv+AB;g_u-$1w!v%7BlPj#<+wEpEK~=`73dv88BJ_R=kWsk5D#3A%;- ziwfoa0z^8V@FM*{`5lh-Q-9vnwI(Y`SOm(Te^^AmCQyiorXO2QX7aFN0^KEHp-##d z_)6{w$&_3FT9Sx6pcA8s)hmub$lCw&A7OdQEqKJLH!QvF5?4x*$s+Xw@wIMRDI|?k z1J~_Pa)l^GowQBd=~4C688w!%pb1iVxa^aDtkV_pK+>bkZn!D5@Pd}ie9M&yzz2nI>VIaMmXT}$9mz)^5rF>v0lib>?I_!9W$vvvPJ z3V>gC$xFPP|Gzu9FQrXNN{aTtdU*`3%q!hZRrV!dhkd#JKVMMeKWc&`=lSbfN(H99 zassf>UsUh^%^#EA-5mgu`Pz^$UJkfRXKM+}_!m&_YKsBks1 zB-1%UfRT=~^pXe0UwR7=M}b_f)qi4;TI&lhyPDMKY@c1z>`j{g$<=zim)`ZY({r$| zvCm^>9Ke3pkqjZTS!^$Lphl}s&wKW#d_2{Pt$K>>Y5Zz6j?A6t{uWb_{J%{?OGjt2 z9#l%6DQ&fe(d3YpgCq(tv~#^ZpjA+QE_nySMB4vPR?+A6O{)u;d52ps=oykC-r51` zlafY+_Y=&Zv>*gEkmQqgMh|tB5bYNUi_ zs>h4+@GwyiGqde7bFETadOtk5D<$cgu>OLc(IcVgVBka&oUK-%368vQ%IU*u>+f9; z>b+~cGrUi+?fS{HZ5uyF3m@%)a5b$&L}F5W!fH!TzF&5xXm16e&aW<6cDBtzv6-3u z_9bRT(pd+xtxy3X*rhAE$%ek5x_0Do&DAC?$n`Zr$GuABli$!%Drp<~`1^pExssQ6 z`m;y{$N2e|Bn4$U{wt`N-wnWwp>_ZbK0w0q`BSIdZq7uY+Vt2+XLHjZFV|_sK`nzn zrm5ewsmjt!^BtD{OM&4!C?f~xtBjWfa8XbT*t*{5y&aaBpF(h}^gO1K!we z1LK{LdL=N?BLPe&`cEYjE9i{r*UnQp;nxP;6ie^J8i_SN`qVan*|R66zhaCA+(3YY zAl_h=64QH0I`LKu=Z;qyJIqR}6GA7Mq<-eq-wKzHuwtG7K}Q$?9G7>u7P#%P*F4#SksqXWps$ zo`>*8!|~*+@Pq{NBYCAYm`YS839j zG~vJ+NMbeqZxQMhk zSj^bnJUp9d?M&@;e{TM@WNhK7hX?f4kM&?VQSr%H0mS)YeB22^Z+FB}+P)Ibobe1T zq*gTP$6mQo4tkXzPHzvKOm2Zpa1HWTll^M(LN|d#Sy?D#N9F;l0n@C~)WVu6fLV&> zplZPy@l0GRR(YH|{Fjy1o6cN7M>nni571e#1%Vn!rVYWlG+zVHRW|V(=ctBcJy=#d zV{31LqA-|(Os2~HjRtwij21xFe`O#2H&F7zZ847OSwN5!(+RQ4OtZ>FWyrYgPsHVh zJby&wZKr%uSGcCL6}mK0cg2vcQecmM{7~UrTAT{(&M~yo;`|0K+gJwkj6xXt1G8~G zw>R9T81l*X`>$kN9SslQT-T(Q@&j{46$T~_uM#={h39wANJJq0!k8`AI#v0q{Vx^v zNI3K>+Q4#H1%Zl)n6MoAGhetSlC>}bGrfNOM+4?ypOzP@`7q5`~-sQK;<%kw|-Q)eQb$NiP6 z^UuHbux>XNGJsE?+Nug8-LpuB$3@&hHzK#>QUhw98Bp_>s;b7tQVIM7QtR2_=e=qB zx3`Tsp-x-ocPq~bEL&wV9$TRt&#_;vpChGrtwN*#Lm7$pf)W7tb?4(}^>>1ogND-B z8P9|wPyY%SLxECOB2EPl`hvc5MA+TQ90{a7OT3&haQx?gU~e5z?3$tXTog2)Pk8ct z%Dj}x>F=9xq1AIIYx0(HJdpOP!qYp|3;XV(D){gT`?0{47#N!AD>D)&)O4gFb@P_{ ziH3VUN{XPxlf)-GdR>13b-uyBsQMd_550x&pw|CuYmhDX&Te-2YTi|XU`#5zKYK2` z)eP{wCjWDa#Mvx9f>PEG90lV@r0`qzp0~%(E}e}bc*{Dv1$P_2XrT|aHY%R1#sZ^W z(q(?wkU*;*^Vrr-KEf#sItxD58?i3|I)hgEKXt4Uoraqa6g0TpN;YaX#hB~881No# zh)aiR?&kk@9-9zl}u2w|nF=G?{+sj^%&4 zQ&amo+(g^?{0Lk9^z$OZ{~~=8QU9_l2<9G2-v`U#&nI1!hDX@vcCgdD8?)LK1N_Za z4tTOSjoMVkAQ-jVpV;_++gotBjvsPe{CL{ya?;*e2wWj4O={2gs^rwgS*vJ4||`m1Ko%)eD9vu%~Iy_o320m z9zC~5ufrEWaOO5#a+;xnyLufLxkSqAH~2xjo2Tm@cY<`lf>RE>uv1l4ZxJ1z_oC(l zNIaj2w70&VJB-otdjQq9xiv;-AIMjus>O^CjApy5?^KtRo5(*Gqwx6d(mnXR3sIpB z0)r0(TJnxiDE0heFYg1Fpdck7wLnm9UH*n*xFt7~Hr=LxCjJ1yCaN+^_WJAF_(h%W+N#aKL<| zR~)4xt$Pfj+xmZp&FLsYk$reu(_Vcy!AKL5C9vLh-nA~WDiGZlzSakRNFmx-s>2FW z&uBg8H@q{4rfq}EG04ADm4U8-Nww)hn)`cE_@YCwUn7sb&F||r`pCx5j+=Xi+EMA# z=)-lD8_21oUbxDqt5L~wRUz!es=}6R?Qu`gtBh?TtsXqtKrX=ZXP9rv6=2*rvVJ+x z?`p&Nl0@LdliuM!YIc&|`jCR|M2z|}7t*@;v0sM{QfL~r;83acQl^AWK zv+ACWcjimm^AFO4R4HN-rZ=G9wU;h9RD3XiqWJn>(&EK7%-kx+lVHj1bKD(~pI%lSFAW$Dhe{%hI>#UH&A(Lo65o7s0 zsC|A`p>4bpmtObuW24!ZlGpbyEhyK$r`_4%4M1!^`Y-Io%R8*~?m$*YFdAs0x!Ek- zDcSBr(E)Wc8gxVRw%*9u`M6=I8ywa_DA9FZeEU~&XT)B<#)f{}DSruCn}4Y0FhAa! z!6~d|*vlKghM$1{n;wb-ZX>AP59WQ_ju6-JAohfQ-t*h@D4RSsb-MLM7!x+WmH@)( zdY--=a<-@Y&L};sX2nzY=?1(IbGs;Hdsb4iGXPTYmBxUC(>vio?X@1CVS3l9N)BtQI#8`d Date: Thu, 19 May 2016 11:20:32 +1000 Subject: [PATCH 327/439] update image --- windows/keep-secure/images/atp.png | Bin 42316 -> 89187 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/keep-secure/images/atp.png b/windows/keep-secure/images/atp.png index b300976d5ef0c0423ca0fcb0d27fa376e31e7795..840f89db48ea5d70c50a13d1e0e4cb3e4ffd7929 100644 GIT binary patch literal 89187 zcmdSBWmHvN_%FIuLZm@jKw4U)TV>PTxk077K^kdAy1P52*_3p5x6+Mt!4 zNNCzaAUF<>KTnp7$iIR{WCuxEQRF{}xKCc<;aH{>{?{a`;qbxH!Nl4QQcyY|0h-Vp zKoiu^Uf<5t#=+Fu3WAG5K?T}hJhqEi+ql@78k;ykiZKWHKr6<7t#*c=A0K_~U}|Xy z;k>{^0e4Uy?S&W1UwGMU#ZDQgE?R;qcbUF_pe z#g@dl9ezx5JD!@V2^r+4shG2-d+E%G%^&~0Kof_ZObUa+CplsK>}IvXc5Tf)pxy}S zt01|c>u=7q-NahF!Qf%VNJAp%<3-8wjm0|%T-Rg)5|rS=>B5qHywOHT`5iP%#Fw7X zuvAlkJDEe&l6D@8qCo<7YeD3}|1}AHn#flq4iU@Zc`uk z(IOsSr2a_}`8Z!cHYg6b8}au4JnjE`UWWf}_K=k9Jzno`aHkg%y3dKz{Sgv!X8#|R z9TcBnM38V>A%rI;?s)zxEG&e>uS**azW6+@`Gwp!v72uYJl+_wMy#xO6NNJtL!brIDgvYrD=RDOef{fye0(e#jPLl>bU0PeOy#R0c>2k|HdI!GwZ%t%(Rn(KyZvC* z10JiWsF;|T*q^U$&`T5cx=%eEOcf;Y-qpS+j*W_1g{LMaCdS69DJf-&r3e-k79Kw& zJ#MHYzBd+8xK+=}$_jX!h~4NV9^TopB5UKnkM8b`k-m?EG^(kqJOBIBIyE)*o?s;e zf@XX%g3fEb)X3s?DMLHH)*Iz^l6!S^#mmckvN=55-_OXzv}dRyD=W*)$hdnjSyjbx z5i1xb)WE$|Wg5k(0cdJGQ~sIVXh1=1-nxE0wsy%C^}VBGwOw%0uN&NG;VfsbH()<@ zKFG=r7AWWGEYs4^_y+{Qn@fs{_-$AGjvZB0CW5f3ZeeN5SNzcP5p{6)!f#F#fFMwlY6t3dY)H?XOUBL)#flsxdi!oyY)T{lFtm$|73?&_^h!!fM#HHvuqMNxf&Ts^LARQsy9&ep8mmRP?W&mi z>dwv%r}@;Wf|#xCuN(dfOdydGf?48WP9B0^I)bjRuLA;*XrQUQ_OuKP419dV?@dfh zR8&*|3#IRzlC%W$9Kb1*m6Z5&=$V*KRee-qC)U>1-Ygp#7<6=ZTZ4)1Viml~A2(## zV`5>EE68XkFVD`-hQnREei9uJ@c)d=%guGFEAq_{34FSBwh|!SNcL7th z`XV>zqGMu~m6ZYg>qvg+#FjKzDjD7$h= zLr5RrW@*@aw|s}qI#fnc(Qnl=6m9A39{Kvn!#Txmpl@JcV0ifAEg}P8ZXNz7jzW3A zDtYZURMgckM&7$PULCKKmUee{yXj8eUY*ohFPBbCecpXkT}tvmf=x{F$IfP^rjUM{ zaKLp{o2|h1y`mg6svI;@4(MFWQ)E~+tJYelp&^}`nCR&2OpwXNxJv{)`|H;)sic`1 zjhybCtU@6CDva;yjb#*+` z1bxg0S^M{Y|C<_+&xXLli3ybpNk1X^@V1}g=O3Gck9^IUBi z>|$T|2^9Nsvj^y~6fIB8$00>&{3-{inx|VfuCj;pN28n?El&G$WHnI(y}gerx85#i zx34dT(M{+%(D6%m-^`~=9jn#v%SqLCu)u_*bZpEKNYW6oGli2kxU@kHY?yLEh?&<-#@T6drPQOWGM%jW+})?TU#3l zsD(xGsL8~(LnJlD>uxf*v&g#-fE^Y8p`xQ(nw#6B6YVBJQ3y5ck00v9PUJW{ovm-Gc$uJd^=)oE&k|Q?Vt=8tv>!Tk@tVAa}{6O zUsO_3f)Ut0oC72RTM?^5t0aZhiIfs}5Xo|ReP{o*E@KfB&;6B}rg+E3Hfq9AsD}xj z#YSwXsi^_dj6uLl_x~>+^8X9h_cZdfX>HBmVi$N0rEyI7!Mmqe_>)X!^cd@C~|3{x5d9dnS?{r-N#Ed~!m- zq%l(e0r)dkR;BM^(SLK2*qv+)j_1nihXMyXQ%E+_u)dupxHB?5{1XT9GbM$zsDuPf zAi;`?f8k$#X+$F=L`99SGtbV>LZ(WzH}h~F#m+SY@L)y7J1(v%6OJ7RKFP@6sXa^c za7RXOAD^e|^FBU4KoeBXE<9=p;9@*Xhykg}#wi^-&lwvV^G79cI#}5M1FZSLV@xxV z_ls_fq%?%$$=dq*6NOw+tGOzAZthz9o3Sya93s%C&)M$ua0>r4Ys{mIT;M}7Mlzl! z@0=o7`MDiw+D{_5v*JtVi;F1J=(>dP@IUZU2UR%!!lNjhiRx&GJj%4--~WlSj?w>L z228@dZs!*1(yzhZ91{gd2)k_O#NpuL@{_-NR6P>}Y|!i8XP5%7`;Vxv0abgqXDlo&DS5O^!aqOi`qEN-#Pww^BetVQTuHH`46hUES7$yVLzqr)1$nca+FA0gsvlP$hG7%tA%*!Lh;(H()` zX1_FWaBzN#>A!!mvurdFk4-|-U^-5#ntEU%ddE^lCc3LwMJjqSZ6b&?Zwd+L81ef( z`oq?%J?MsS`TCqDt}2a>hCgNK+-dy>1>YQxMZD?hR;zL@G$&U~KJ^vX7e59=+%t;v zN|Tx3t|p!v`XSF3=A6k>CuLH65?b${^@Nj#TZW&8S9v4wQ1HK=ALgDS{1nukUO>o! zhaH8@O9cOL|L_bO+a>e=!9ZBs#tlyUQu6X%z?@k(9*HdrjE?%jQ}S6`6E19>xFIGV zDV~H*mClR9f{TQAY)XJ@0V1S>r4QyDe3o3Zf8Ta=pf&Fl#uq3f%O~In+tW5Mn7%LP z&OEZ`*c0`jCq7T#*M^J)h}6Ka$eVIUMaJ4kpF+AKf@DNg_$cY9Rv5M@-Twgr)%z5L z_Ch+2QC*XuhHLvam?N z-QLn9KdVG`%p^cAE%mLj-0eU@L>!Fvn(p-rrx3kAYb5!eh|ETi5yHO~C*#@;ON>k? zN6ufi_JiX8PUKfe@vg364ZYgeQ;G297FaM~rtYgC}_h%(2 zp}COhtO+bG{Pu&73;WN>3I4bSnWTRSLc<>xyjTFLWYFm3PphvWJmW9BO7qV`^-pDi zEU(UW-OC*(ab1iq4)&GvTpwiK8^4=PN|XWq(Z#ax&Je#yAo}j$c+hQ0=g%nXbOv(S zKp#qer(E>FETX@0R1~PTwGbBKip&2E+6M2~|5MO*C z!4NMJxBvK5(uWHz)Cel`v2B=5%ALbEsD}|2AaQ_8L?|zKHUWZ5;k(oEQa!7MuxHMh z)KBojvaZY_&644eY!)uZ$P}ULKMs8R%*+t8B`>e(MwdfsS~Y=(M(b3WHT&-SAX3{m zUW6exkl%l2i&r2~e@&3QyF5S>|BB6C*f*B%K}akCJ-_SLW3_>PuQi)23}xjYZ~KOL zX+SC0g8KWy{%X;g(Dq0*$f4LL)$HalIq z)!nQcL%5L&8MTEcF$&+gg3S$wy>xK-GGVs{&%s)xL*LQcIZ=n7zA&3^?>3l619r|It zAM&XPx!jEH{!n;k%J!nmbI7!suViZRVnNw;x1^@>URxA;r#J8XrU5(fz<VLPp(Gv7B2DEq259B>w6o$oZU+zw$*v)^l%UPz!%EGJ)fUt#ooWA|H3L4{L4U~icP<+qGFEftoRma5ehteg4YWX!#?Yc)o zUq`1sLnJg7fA+7p9ZQW|o_h(S zA;|ykioeJ{KlR0q^e#7m${-k^!I7>_OhhP5Dfow2cOy7P0Cj>{mKOq!ZP`g%jPTmaGX zvi_tGe&I@QB~Rd9mmSyz5ofQWg~9?UxGAoYpfacMnIT~FjfHOZ22ur851X7_r&%P6 zCIkH5bdy{sdyc#=8U1>F1`P6kyn=V#RiQvy&^3KP&wHM7$fW^V<7uZ^MKPU@%`*fac)E|ylkJh zBsM9Q>`GFBmpBrPVfdWn42$J1DlAPBdiPQ!n>^)?@aE9FWGXHynFFcEsble*U&Gxr zy&YRkKtL7=x7Pjr#kI$c`#c-HDaZGVrKI!PmaCm_6U%#Pfl=1i#|XqZ^Va_yehzev z%tLyONdDk%BPCm1>Q0B zSwU9`gm#ma`7ZU1ULVmzVY^Aj*E)CNS)$Z5BVqSGZ7&2?$d-wPyWZ1zI54e2=Gtt+cAZcb(L`3+R-5#t{#VJ z+g0-|ixulpoxyGoZ+3(eF;}CCMox3Aak48`RaN+M-Fm5tM2z%z zjN=>ed~?s6`MiJ|85R8Yj2$fj5u#MaeOk?(xzE#Q)b3hwF^N6u-G;TzFN>_mMUt4x z<$D@LivS526753yc_(=4>!Fk)+^J(fc$&grHd{A}MOw0d*7#gpTien0sC3@yMACAi zHfAuOWD0rlHWDM3(RQ6y=Ifv^Kgp$r0Woc303&z115LK>#dW{ajGVr8`9KwIW-|yx z#I=}b_;Dc?P5edbBuICkWL#0zo1cm#%S)j~OM9MICWVp9Yc{{~?y~tM8}GJeVO{2a zu{c~=>7hb=CTqx@aYZt->vo1^cX=f9gcTk9*RT%Qc$dQ zd7QWyb_66qLeHeEZBsa)61|3fNf@e+0K_`pNg%x8$7OW(q}=7cwb$vWct(4`Hu9O- zM)SB?iAKx)pD6k3LarTsjKx6qhwXhI9Ld1)UtloFB6nrgw-P$v&HJ#pYHDGTp+*xP z-mHg5iki@g2M}o{-Z7mIeyfJ7dxR4|`xrn`{an3q%~w+HgHccQv=NyAA-`o}_V&J) zwVu$)&vkzScO|?t8gaGN4pf^Ow+946BB>QzFb;N#utm~ zSLgH1j3GWt-w70dRjA8{pS}(0<}{SJ4GA-QA=O9NWO`fgGO1fB;E&6Coe%u#VM0o` z?pu-xtBdJQ@qm4K+ND5T5-bnmsQS7ql9R>WplBl7$zJI8-x6Af4r^DvtB#y zkiLS~Iu}UzW(c=Nhh2Y0HZaDHvN>ZxyE84jUuH42-O^2V?RGZAR($Bdnnlf9_Fp$W zoc>}i>-`g@?EGXY0+nXLVZ6AaBL6#XlV0_{gPF)jA>EnoIA}N>u~7Sc{fOwf+3TA~ zWVXMY%aaoXI-1_2El>ZfXYf}%n|r(0LW-VtRmDWPV@*ieWLVPL+R&8dnH}uSf}<=X zw&0!?JBbXu{;Sn6VY!1&C39^NkyY;HJ&%7M$kjw!w?^*54QJeJA!CN-5i7gx)i-{> zT&lC#Wd5AG<%VExNz(G7M~Q znCC=lH*UEU)px14F3L<-(ECC4u(}==pB>1BW=cco+5lcK4_FGQ!ZG=&E63ni^VfuI zN7@61k9~%V7O^5n(AxN-Vlm0Bn$|C*bCRaHw4h9CXejkx!?KHW*|^yxVMy|;Sz%H* zCj5=H)kNZ_pw?)4EXR~G^PQy3()Q@E405y-b&~2GO0chb(@^Lgf=Kr3+3&1}yv{qN zZ+gAUU+TbCeD(XTBW%Nj_*m$=8{907!4aU%pWOwW4W< zK=Jx^DnH_~ZIkkpj3oLUR&%GH@$``^W&oO;5KiK7GFey+jtrQiLplNh!M4`!Y{zzRd2Z-fN?` zJ&ecLp7lHaXC6d{&HQWdT@H$+V(P_<<%j($mxd#LL|-_j?H(_WmY;R>DPc3hclkmE z>tRp|t`LI`D zuIHgjPJ|Nj&nscSx*D0xOD80~9v`m+GHh5pDHdXBTl> zgrB;C+{Fm&JeT$)0G+uztVji~Ajgwn=$7QX@{6;nETQWSM8IQ-du4;_9^)@AHmPj> z4dkq0qTqYbHDN$caQM8IR$6o3)ji4Fi5Fch7cATH6!Yym)lV;?tXQgjk&dAw>5#i{ z&yn=1vt81Xwj{(InOxtNs}N$Eh##TF_y@AlXd{F+oxwXVIo|%fnXkWse5|6?m?4sc zLPXX?s~=7-&RK;Wr`*lmto2V=OKY1?hJ%;cE!dP&MNiRp)Th%zlDVxXd=N8z=gxC; zsjjYM@$eW_MVp<^ag&!A8cV_~I_ox@1p2~W!aoq!>VD;I%tEQ2w>`)GkK%q572;D| z^DU^OOE2En)bv_1@3Y?3xNJMzG_^O~y@}z%!=Oq;Cfg)lcZ*kayA<6g9H2x%TQPa8N%=x0W zxN-cm5MkXI5&{g`q55#slF3+|qE@s{{$Nv8U7&(@rPNNA>?&SIqC^tV&l|o^wR(>f zGP9=7Lu?Cwj_x)=4>lAnpeI#hdH#99xNv3-K1A-MHCAtNtma&?{;v##f#j{&g6B=V z+X1!^#^|=d@tE|E3RK8(&C9QWf)k0l)Q{z3iVqSQ3;`z%OQhJ83G&O{sIzLDSOp#`3N9+;2NzXM&v=`+jqKT?I>>g%4M${8>u^>xY~C)XA0m z@NBZja0C;-p>s4y**eQVDy)|rqt=Y{>zIdVHXI%uR%eGy_6dbqUPr}fenT452s^S#`N80qRJAK$wA^G%{zWT`(- z`<#W|-OD{$5D;{Y6wp)JJBVIGY7IWgs%x}U@))$!+!WR`kxKi$?#$;kf5{@8VPoUn z4s!OWTKX}4U8v`J6?a?vUteTCT(2V4{@{zFG6>F;`1BYyOdPSAJEogw>V6K|OWePk z&L9xzs;$;c(R%(jOFU2DG@MK3lL)`I{%WmujmGZIM9~k|oU6Bq7{6y(Y=XObtR(P4 zTx9<3*%1xuWnPtQona}C=!2e0OsHPFE$O}sFfY6QX0{HZk;$@G%wI_6Owj`RYM0dt z$aYGitUof=@rdF2NRz4M5kD2Xn(jL@d#A0l9G~&-UVP2%?bm_ zKqGL1T*_#_F`x;KOk4W*oe3!${#@GCRvy18e(FJOr(H>LV!RUr{Y)iJyWn0qG9V$D z$FHl9t}8jgs7mtpr6y|*+m}-+*k0`WW=hky8*C<`H8-{#Sv!W4FDT(b)#lSIdd=>G ziJWfd0IgvxFDEwy@H;UyJOCo{hLO>}dZEQj*!vkW#+&8XxHxrn_2GCns@H}WbhpBG z1bfIrv27jK5*)T!RjYZ0Dwy<Ov58&}^QN^$>NqY1S6GRdC~`s3Z~4Sa zTqXW?x{q&^jk-(tD+RG+HZ}?f3k%cH(NR%})W7q(zb!5L3DG^gVyAiyd?-zL`EJDz1s4(>9Sr~%0F1#13zKSD z1=u2R<`{Ey0G14*bbc(=3vRRs(%zE6&>zprwGpjMt;Zk!sGUhs#;xsH$Oio`?U@@H zvF6Pr^(*9Rqkq>vIqKurpjs5LfYyNPH0+e4z>}zW=2fUFGEovmC-2luNKSru&BxBJ zyzL4QAE|%-XC#x!Um^7vKU=bJ#0H2xwgb9|ye;qt5#MAhLe0 zb{7&nSroWHw7MFotuh2bXaa_bbkhS?$H*o%eS)tE;Oqy`e-zL`O$Qot>TFTtvzs`R(VAnwqoV zE&y1#UC?FN6H@Y59A3TW9UBo*`s!zOj1Cq^iuSNA@A&sAy&eg^+D$JVXlfhsWST;! zpC_WcV>oc)LEJcbUz2H-XEurD$P5rxui$$^-A(we z%TMsUJ$^0TiXTl4Kh5=GH@BjX3qtElt1mM%JdQNjbiAUx!Dv>3*`#{1^q2PPVij&q zC3vms%$h?>cp=2Ik$JdM?Z<21+=H!=!#Kas`EWHngG{DSMvXK6uYQJXb?!M@y=1kS zyG3A*;Ub-*n|zh(gw~UIw8V+OU7ZEKu`=IZIGB==yhDaRpAo!=X*p&7+FKb6a-|R! z*3)z5rVpb|F-%xlu@s;f&= zIk74E^Qo*GdGzUiHSJ@T@ggLLgfUqDuHf|Nagr`Fx2~D%#U|CAUSwSJKwGa@D~sLK z7UpjHF8_ywAcX4bYE?D0uC6WsyiAd!lf;?9o&DBS3?17s{Q8QrWZ%ph^Qr;Ute;_C z25ImXCBj*j%t7SK42E=nzuWM=zPv}&JZ&8(Dt0rY z^wEZ6C#){3nlq>1*LUMtnWr$PAA99hYy0^ghyOa`N-TJ7td2Ht#{+-<*s0r(DY zrxqJZx)@A*u(-H{B-H?1pLGj5$*i+b+s!YeRu)Ea_BIyfyqC+`clV}{0+cTQC`$6) zpeKK>N8Ju>#=V+gCwWP$PhnZcZCyV~Mv+Do0$PPt@`x#4D4|6V*u)-2X(Qr4NGXbN zP(@A@iATKBe*-tpW~5&VCv*bqG894QJxnRKs(Ls%sXRyt26Uufj5XirsBc@LB4Vr6 z#g4e%q>@$Jyq4eL^XnmSnl5|D9-5p@c%{EpK`@?EdZr^TJ)Dxb^F4v@%)ID#GINNo z9uO+Dhz}XItW~r;0uS_2Y%4-|yGPX+DR*H89RiWq?B|;Hq9tdOcjz9pPz*hvA9M(F z=ItYOaTJjz>3`c2QF-K5UsO$zRK@9)Xfbc6L zZGN~nK7m(lGvKX)S=1I82Z(M#II7dqysO*CG94(F1coN+?-tcl_`hBcvhvF%q;b(Q z9d>0b3q-ERu3s4Ufj|n=BL=aYA4Iu?u5a@DG@STj*PSX z_iiEBirZ#*B7!6wcxU{GI9~I%Jc;T1E7R(fJ7qJtE~%B*buU+rtd}6CNP{DPfeN#g z!k3ZdX$ftvXvKIf^l=*27W{k^l5h5s5cMGRIR8CSWGV|kBA=rcqbMyyxD+u0e^Ih! zP;#*xz2}+XV12c#hiO(?Pp=I}@FL~)VO-EP&p9-8vseg8@-?9;60%+BEzpsDa+H;< zf-NWK+|_FC!UKyr6A1d6hDq`t4Zx>)R@xe&NFP?ad|A-Hd1He$!#G|o!2_x%1`SPD zGr#^xvnZBP!|S@?({wK|UC6 zl*9I(>J;;cQ@2t_Srd%8#{5joUJQcI0AIbm@St4W6hBXgJ5yAg?Dt{NUNk8>cIV(29Kw5+C%yOSX75oe>=Y>^rOyK3rSn}we5FIb@IoNlEeT>N8%~k$9dMC z^2tI~G;Bng#{~=6A~+@Gm7Gz`Md(j5G3W(MhizXH4*5CK#F65P16Wd z`^aob!V)$5MYqq+cgN0V(Fn8aQ^KBq?ltq7rZnHt?EE6{dego3^1!;Mnf5vWIw^k8 zCKhVJ>$%Y0B?l_+V%{k?DHwGKTWY5zmyW&_Z$A6NWI)Gl) zV|?`+cQcNVYt_^$7Crx~ngF4SVS8aCJODB`O+QqQdfrl7aXHbbE~mmhmluM<=w>3L zrxmgIO^6sPq1}u>ON*W(J?FnG21M#tX28eL(wa-=wRgQ@>9bcW)tT+zM0?XpNC{v- z;GEr1GuDt7AX`K<5EQhu;GTD`7mVOI9Ux3An34uJ05B#t_D5REA1qyS%FavEV%hD< z{QPRbSWCUc1F$Eg2RfCr7QZwWNQ!lv__(>J&n!(%3uY~bdV3WQU~q@+T-hYQ>aI=4>>YsP|yen_27}u@o&)?Ts^~`kA74hGKZ~`s`yN zzX#NBL`iR6)3XgR5th$BGrQ?Z8Dq#n>$_3SA9#_VU*VP>hBLq3-8$sCBe^P%%YREV z?RMSZ0nn=emjp<>83!OzE2|zOc~Oy(6(9{~oa&N$5k}18!v=MVjgQ~D=3`}LWn(*n z@0OnIYxnpdlRfoTGpGr#C37vxg^#8tesaIqBp?^mdq*R+{qt5m&lmm4EwG*t86;Uu zkA$Y9wgXo~#;BJqeiA8?dlqOI#>lBz!4FIgH2l|U@@v48037wC+(=GmSvzQv2F76! zF?pJq6ou=;#LkZU-qzMOaJSDvY+d!Z%47#gkvG<02^yJ%e$VR@qH; z^-`Sz0r7;0f`LL6wD3;85AaTTUEQT0c#IH>rN&v#D)dhPamMd_u(#j|kO_c|`>c=dlCX~ICn?vW>~N2I(ibktpA?1m zIDM1n(RA;6dKJ0lClNHvI^05uWEYi(_9jg5^cxU>carzh;mJ{-^ufZn%%Rasd{z@qb}|D89$0RqtP z>FFs(2s6GkK=cfy@W;eOMnxSq915*FJ&|iom587rZE{{FQ59@-mDh@9gg%-NSLp>n z7PAUI^%gI!gw;dWZRdnvO=;VDisq^T`+O>f?@Ur}kFa98`uOc@swFAeUm%=6qdcB+ z3rvb0^*uPv!IFF_1JHf|YXk822QMP#Ypv7%3nqWKRT`&xaB*^~0{ly=%SJ+GX69p< zuU%uYKUY0DIeFN45?XYW$Y~zSs&@brd<1PvMe8c5|BDB;EB&l3jb0D;p5&Ci9z1S~ zaK}CcM^n@78q0aLVvUTwRd&lcj>=gkNhQ!oe*X{o!bVd^r`SRAhb>QsE54}Q?D-sB zH)3d@Q-YhJ!K{e>fn@NHhkLAjU?~Jm6-6(8p7yGg1eTH~Cw@|))nib?{fP+^uG`CC z^OO#UyecXA_|R8HL9v4;La+&|Ra;h6+dj%&@DTMn6v!1aK3aJU9s39!Bqb$5==hU} zov&)!oeeCN=Wectd=95hYMuD@)6Ktd}Yg%LMJ|I3*3Ug@>uvR}lI=h53}t?!4Yc$Q3n1 z8~LZssiY_-Cg$#b3)C?CyLUC#%b*-+jslUPzxL$#INA`01#AEWltZ~!geK_#wPs{& zEPVT~y|1wgpdl^iYb+Px)q&@La}&8N=N9ViW3($OE8|#TFaCfap2v0tYHx23B4}_0 zvhwK)YcEgCm^eD=(|Tl5557I-ef{xsM#%8xQ%RG)7CYE?wjO|!NU*Qrn0>V{dguSdR2lR}66k(?@*bG5Kt*e3u*D$!2BjKmuG~$!UgIr@`ax*V zP5&uK5ciO!P3KMa8ecyo&wiRZ9psiP%ER5`;Dc@b`wLv_K1oUS0h z7ajBodh=;+ZjOPGQD0vlR7`^6M{1PTmd-F?NncTX(tf%6n!F|wNlVMg$yDyxl%etn z0%7jRiJUO(E3Z&oHK%iA6}Rg5J_w(-%+M*Z&-BnDHch|aA~<jA~{&!`SFjx7DIYxw8u9Gv3kBzHyXb0YbdZ&*WZhSAD=bUte?^ z?2D80T5=7~W5RFk&VEqHo60_Kf~GfBqMzk}oTDJ$4Sn)c;V*AP{id?D9)r`zzH}2A zoPK67&9}_tXz?ydOG#te-3iUnlu#)!!@z4<;6hWrh81-J{k)Jg^~55zM#~P zM3-tvtuXX=?Cdb2s;VlL7Zp@(@?NJA3T}CW`0R#1q&man^UXVr<}~HoT$OUPq91Bv zS{UILu_^yuadCN7lEC|KicU^0zTK+}=z%RuMNa%Bs0Y!(^x43G%ycrYWTcLB{n9Uc z$^MK^ah-@QB&but>mI|*6kY)o|sl7e0;WJn8 z&M%TuQgc9!F#&9UnZ~co^z`?<#uZhk3nPEQQho#n$CL?QZ)E`;cU@v3uVT4a81|AU zN8O1hlddv}ng=QqkfphXghHpQP(%p%4V?d&G=I%XBgbj47U1_oq$)wl-{VB3Q3+T$ zk_Ic7=xAv-*4LSJ>J;vEL0#eQH&A%+=vAGKW{F$R*9_iWl{P>OjE%LK@Ym-T7IbJT z@n62Qm?{5IU*~dSw9axtZb1GZa%JT^^DS^l?Hr1O{{C@=x~a6<^N3a>+bMy*4reAH zXaWjp6SGtJ_Ae#~Jb*XaR|~%TW)*-}3KkRwdHM3?n*zn{{jU#q7r;2(YF>$|HlM|o zWVD`~U+3qSD`rg;1tLISu>6?}$hu;5l;SmhbO{JFH8o3@Q~2UJ&DG@OLW}MInRM(! z0YyP<5mWZ)|JrZLO~XK8s?;?TGxH+24{8cxcKe2NZ%$zKBVT?M>$NO3<;+^JFf$8! z-qsZ%JGA;Be*gYm>Iq0nmc}mKKiiTrM|61FlJ{ig!RUMbp?*-K_xV`S>#Fzj+f`o8 zBGq=T(pPBqXRHiN`29c_bh3bMELJF$PZPSkyI4k6P*RGFh+qRJCyNcv&t||3qCXL% zS_!z>rZ5<~~vrXvX3sIq>OtF(-faTxu>&+GdO zT$;&xPeFSR%U>GJHwO)1XX}MWJY;lS%-2!Ze?^k4yMjZL$NpQL)rkO{eE*n0l$_^^ zcF!1bE|B_tcS=`*^&2K88EI)oR#r?0in}KwYlzt&d^tr#h5jaEXm8JlrxdDAFoOL7 zZ^N2g9RqihxUFMBK_i*{=8$T@3}8VJv4uxOD1r^u(&96pV!DtY@h)Ovnes>76UanI z4Nl`#ZgQ2-=ujOYM400zw!J2uEIf)VLLJ!z6(wt^^q*B?*HieN<&wAtW0SOh_G4PG=OM*dKel#?V!Qb!2!k_Ya z>1EZDkYqr`2yzl;lsBv@pp!O(V(U|Oz7I=`gHrAarznE z{qlo-&>q&diRt&2a@?S&Ogmcd4UXLj75+CCz%nFTWDpp3<*1tgO)0%ko6E(~j0dC- zrLk0EKeyhZRJ7N!0LB1Y({NWmHa>2sDJLamrzfTiN_mr#ZaQ$~pWl6VRXTxd^i6MJ zlj^YR2K4|q3jbJWiGoXDK7$`i!uKTXpGQ5jb@7OPM0~KX#)|c6FN5DwPp(m7NTv7hfETWuz=(meeE zIFeRYR&j%N_V#)8mbB|;38|?ELI(@&5Qi^cR*C_;z|T?`Lx8il5VfAKm<8&K+@km1 z3N0~m`rG{2i{GvK(i0-&=DgFQ8Wpj+4Gch0X}$d>!!p>waSN`7 z;iDII`bk{dqH_Eb0RdgZ@fo^;Yv|)K&!w@oZ+A^v=^c&5&Mmgba)7}0g$)cOus3LT zf*2+$DQP!x=YDnH8g|ObV`)k%&tDh$?CeQhZH2eTHySdnD?Qe>YZo>gE_1ph0r4_2?y$i` zc+M#z9N+c^YG-HX>FKF(7vMDX4Uq>%{gw_KsE>xdwvG8gqv&;HmRF+TrKD>3GpuDR z1UUXcclF0I@BY1xq>+X+{%flzZ3PiJaE{i@>Wu~y*ZbqjG%IPTsItn--?Fk=0~q75 z(2a%WZ2g@oI9giWCpS+w0afS4#XmzrIEh2}Qsfen2UB}kwu~1jse zpQOdEcKdf#7zX+lnfZ*4Xd~iKL&Q<#2tMHR`m+Yn7jO{bW?Qru)OM;(@@Qdk>s9*% zH39*zFd5AR@j5uu0SBMrlHsItOrUxUgg#Qw+|xctz7#PaaMqI0cCxa3&tLs(7 z#{)C5#Lsai%Cx+pp6Eq+Mcz5(LFYa#enRJsh5qOU=z$od1PdL|v2C2gdhs0B{91tb zrE0<33UjFWyH!beM@a4Uu(KQWZSS>g$bkV}=&hW^U=$Y`N^+OT{m7z?Q(Q=YUmu^0 zPAWJZ4CIQUO<9g(Sn{QC+`)09Y{*Tke{XUjUY|31Z~CkKILDO+-9}INrWin{GqgGQ z7T?tJvc1%SidQ}1nYZ1;+))wveI(pAi;;o*l9ZXS52gF1PUC?>@%f_C(Kla;3UjzA zw}`<3DTJP>P3s>)%ns2XfEpK$Ota=^wDAkzVzRijtd%6bCm<_sWA!%`plbkbv_4E=E>iT9 z-X9y7*5rc&>i-FF>hug78Z`-~4KX_n|8 zH_Iv92jVqqEz{@;UAQv`ha@;(4f-qpdHv=+QGc^+idm5BI{42UpcL9JB?x3lG*nbx z&O}}_2J~2MmtKG4Fex8lwv&#!t9;-YKxSEr7N|M=8_0Pac?mmSsx|+NE5P!>ye&KlYokHmF38;&6jXzMO;L)th>Y<{1Jq5| zd5a+~STxe@lbjS=w;&YtJmGTny-(Ea()%Sm#yv3nzu5cAs5pXXO_D$o2ofa0-JPJp zh9nGb!3j3FyE`F*yE_RQba0p84#9PBcN=7YVVk$-?e5uMyJye)w;c|Xbf&tht8Q1_ zy7&9O7Hc!#RT*olmRv8bshQ`B83r*^kzB4!6#qQt#_Wc_`G=ma2ZmJ&7|m#DS^uz4 zM-bCA!Hj=0{i)|CQj(EDcVYK^BS1=MRu2bN)P$ngX!MRjrr0H*?H;M!A?=8N`=0_ln%&_&JB{nxO7K#*ptY41eM=+=ySa>@+ zK3&;|g@(T6+{(;v?OiFqm5pDPn2+iHnI{oT7 zjurM5REJj%uMD_TfCQxgfH67||GB~A%>y8xDwvpwfALVmXcog{I4-N06uwox!H#*> zSj_+sG&CJcS<#??kAS^Rc4l#~wD0sjjrwe@1PZnGcePb2n6Yqmn1zegPhCSsZz{_C zjt-S`O5pIz9!Vt{jYLVKBvDS~W-`YLK6med7KGF6Cl z`|I5&5z|}`Pj(tX=DNZh?01xu`(?uy&dT@6o}Gc6qoU^ac#9uj_qhl~`J4{}LLVBX z+6l3-z})$u7jY*2CWQ5;x#ZL6i|f6l@|oh#pWDo!y_#~raUnii7LwyE%QNC&UwrXg zDa^V>+MiONyg^d3zZooCdtNw+XZgrrpko=>-pd2{T(WC86t1kCEnxNO6NmrZ>B(v* zrSHYqdT$iK05+JbGzIW2KulG2y9Y=q^!F3mI3}g1v-v^?x6RGXo0emflC~eS9aP%v zt^~f%jLbgbExabE#EN|D)14E7>I;{9uf0N$f`R^FoW|^Vw*BV<0RHSvL?i0jo@!mH z!DCgj+pUM79Nu3|%nuE1!4dh4h|8KhgcW=F0=fQ!IlVfVnYC5r)T=A@pV*{s-S#7; zM1Z=45Kc&zkMf-PG*8bWT*#l+4Wnr6M?)2;N}Z&$e{oYfApZ* zoGx~h^IGO?^y?j{opW)*J=Lxc%uq($CYuAquS;d+Uyr5f8pM_`|_qcE-eBIagb=|nT$$(M{I(6CbKV0{UX|yURDz+ZC-bzN0Ji0-EN`#A@eT5ca z*h6N{Mn>8DMrLMP7rPSzHnac!C&^i2&L!YX>I5cK(cQrzqeOiw10kF|Cc7bLX~y`L z`Z>HFCkfdr(TP1K*VZz`K$mi8ye1 z8g1&iJuL8Wy&feVgma}?;X7IoMwrFH?plrR9xW{d`$uZG!~O9o5dg1BerK$^%))$< zO&)ZF&iy~q7z^cw-z{wE7&gBE^p!6PFFpWqUm(reQhWJ*cOv7EhLH)I&J^eV;Q;3DqYl3p zJGmlu-`v_VgKd}vu{{m=fr4v{&xFPGjRp4r=`RvPfLn9Vx z8SO{B7>l|notgo?1QCFq32nL5e((n(=Mb;myy7eFBLHr;H(7YZvZ5$}$k^9q>f}

    @q{G`iE9Od~s$>DyKpo3xy-_^{!%r63Fu+;00<}w^x5WC}_;0q&kc`2pM5+I4&LYtYF4+&80>@|xzFAZfP5$N+k}1OC@%6nDp00mVg;S`OBz$0tVS0;lO6cc}%ctNy z3_`G5!vU{Sm~a5lEUNbpxNP=3e-upWkAv3Z)H`7SWu*@qTrk5eppiiBHpJIOsmJ^wEx?3Wr)*0F!L%R`89JmG z{5riM_%HJ18^+gINN1Zx7u zg5DfwGoD!$h}IDY_K%D(WET~&1R5fNZ4d27?2xhJ=$3u2qn#bvpcut)M&HOL>qfp^ z=N+(+p!`e~79*~p*Slye6wPn11(`&N9LxEL^rm<&COZl~sQr1#jqS;|%*>X%> z%$g=-_)B%LW?>oUM?B@dG0v?JAHP_ z@~JHN(>JxrjU885m%H(|+A=UT^>^X^TZc6%F_ybS`;eV^sO|gLtO=6Hl^3)W{)_D0 zkM^mqPWb%83>4DleRUKtLBm<&caH!zQTnFIq>EHroVnrdp0|#SK>^?wZ$v)8-A`KO z;Pxu*S26_9?Y&uW*GX=8!EC}2$14;&%9kEZ&RkXF`&CP{OuC_kjtG_6OkkRik;Bs4E*)8cWuCMTfOBCV$f0|qC>-dXeANyL~v ze&_3B*L(JO5pmPOMa_SuId__BXKc9QE_$%L^cU~gB6>14P#pMXZG1i}ik^apdnqAT zJ)+GjmI6ev0Q2IS5aMEQC{VhUAsof7Kje^JQ+192)(;E~mW;G4C|UU}?PBeG?L1U<_X90s%Fdac~f>F;TCYE(Dv8prZ5(}vBd^#MGSK^4+x$ZhI}V8+|X_!K9R zvrGyGbl(D8vL^cF_e9rgi|n*p%y%Z~tZokwfLcrlHpx8&uwC+D{L$B*ir7rj&yjNG zo--h^oUJsSNq%P=gws@9l=gY4YIIBViVSzI5o(>VGo!NXB`54%n-=;_=VKo}!TG>1 z?bo)G?vasC}>E#LumaP`7@mcQRau1pI({rBb#TGp5!ocif!i2b7? zEW39(%hby$U62Qz@L=icn8G!;{n!#DE4dPbFu`ZzdaRGx=Z;%D7Qhz$U&b7* z#-*kM4v)ldnxmc+*vUFlK1C`+1n;M)k4!2ojnqM_N;#)yhT1K77pam;I866+C-J3 z`e7Or11{hW89Y`ym=|hen6SB}LfwRMr%Lpi*tsirl>8fyBI<*b_mTH6%!da&cc_hx zb2?2(Osp|Sg8*`V&)(D#6PBH0zp%`j)Pbulg#e_lsW z;R)`ZsPHVdG>wr*?6vBEox9p|6!+IZq}?$_22yLi1qRPcz}$WLWM)-64g_t8J;L_( zH}mPPS6woC7jOj)$_9rfs!bUYa zBlwT8Kn9W0&8t7RT`R>+xQ$Am{oVp64x57eu+U>QV?@$p-D7zTPNtsxB}bzkAFc*K z)C*NXtDYeB zdqkElfX7@Bd3W9}fL4dIDV^$&DuN%Z+W4Dqd#4tZrl|ON$v4*}} z&Fju5EM2>_w0E@(^|?LFJm1cE(^zpjYo00NxsD~k|FSNj3MbZ%H3YkkudlFgOs2%<|}Wt}qf~9mN5QqiOE_r;X3MLcT)g zV>HIb>r|TbkRPf{WDIdLJ7Y0ocZS#55}oziZi7oLSXqAB@b(vMqfG+BLiDYOy+6x$ zJ%_^`ws|hZQ}><2woViqT==Z?3UATwqj}w%8t$!UY9mr-R2KO0O1oJ43>}uDiRAL~!GLb_K@I=6{td!h=Wo|C?@ zjZrbB=N-gBsB&~FYtJ!!94zKvd|kl*v{7DoJ?gJ0cF$XJu%gKdLF+un?0m^j3RNq@ z$M*%`T5+*z6&0b;uO%F~3O?(~(Q34`LbJ0Ue<~}1-|Lfwnb|Z(MEZr*q!HpeV!b!! zW@aT{a>B#O8ms;u7Vf_UoTbR6cKy?1;R+|bQaTJeEIPQynJgnzO$8j&6-3wCnk3<$UF}O?n*6c*JcL9y(*(Da#wygh~Q9Ve&;gwg|N|=W*MX-;A3g(p+)Za7xXR za1YM4DY{eo5HXo&eMPi7!gE6XOA42n_S_tuc&wCXlO8c&Z<&zGbgvqIGopQ6c=~CB z%b6&G(eG{@fkmoScp({Bl}2{F+kfKI6GR!f=sfB$^R%wD=c@2xyGwep>eMsKGc2FhX)2PsX3(ndt5r-w-yM9dK;wAA@M0UHrZTKDQhOk)Aj>eI*ST*a6;DNB@W0#c$uf z67vK$k<}aj5cxRaLI4+DYYA>C6-ItRJ7pm`)k)14e?f<`hyq+nNzkY(mt6;_dnF;gL!aZf&Zh=J0HL49V1%VpeifX{d&JX(pqS)Zr2%?u9KB9`%CLPYVle3!ffB!=9uQC2{+ zjAv%KoJ>sK_wYR&kb#y4*+5tqCT`$5IH;2cNDS^4toxn53S19tqWLN}iTrMbOtR4v zcd6(~)gU<~QitaC{rzo`85|Sc6-48&fXj(F49GgS2Kdt06EDfg>>jsesq2wH6hr!J zv}qdEr++z6P=E<|{gD?f-h_!sQ9i3^bkg-Q63rhbw3(0Wb4jGYUCbeN$Qc&#^w?l& zzQ{GC zPwa^EWvyVJhACAbxQ|mKsZX5UQOE``gGM{?qH+HIdfQJsPag3UMVD3g@??68D`jsQ z3PrAbzs!-6P~J$8_0A&oo6-{tTqVE=8rvZzCr8{L2Q9g0K_q(|rk`g zEDmvfZE9kXuLvLRI~nY&Z*i|dt^d0u*HTc(7

    87H^pMMI+~lO2J&uYTlSN*$Z< znwB~!CRmz6Qr~hzG^JTZIzjfX^c_A4$`NW3R?MA)CffJx&G`!4wiFJtlV6|GB#{IATaI*o9L%!1|)xY9zT*EYM0)$kIE9w1TWT%&*f=$MMW z|BKaK-0%MU2D^SE)__`vaIT31nN&#cmG#X}ItI7v7O-03d;60WjiA?_ zX>l)5`<^}ZQBe(Qdi`~QfR#2S(In|W`tS7X7A0j?ChoHyLcl7X8Du?5r=vI!f1-Q* ztjDCrd;HW5eEleej=~`xjQaSQL=AovY5zL-n&t`c`PcMi%;V`5?jQg6#TPlbxzCEB zt)aj&dGrYdB@hFs`)_nI$QR*|go48Lgk82`%$;s0?A z|9|oSL-TLO0*tLxtHP+h7%1^|fmm!2?KQ6LVtqw#570t2 z^*v23UZDZCIKa5Bz(=zcK!(y9;H_q6W&&_T-~j#tK z3BdIL;8AA~j{kPdqwt`j;!>0Q@n2FPtqlXPyTAb;q;bap+N*QhwEqyGUWSO810p|E zuiVrDh<{H6sr?2qFfXiV@TQB#0D^@*0LCuU53w8Oh5s1Kj35;#(`~3MD%zVf&vIQS z25?IPzkUMs)m2vmVs3jeQWSvXaadSbQ=~IMegtIKtbhbS5DsOgkn5gn^-2-YKvIXd zz^&C|Vd^Mt02K<@&Q}9Eb4XOda&LP8s!*&^3SIe`MhUmX9qyfVq(jl-u}>qM^G6KMe>&n_gyJ407h|r+h8;I*n7on`j1@#jAe)g zFm(al=v0Wbc2V}!lvx;|_9y@n*2o0__Y;$lFtt4542TW((MG)<0~DSo#>WvsV*svY z-v3Hq$-|h50+?e^7M%jk-+SL)9%`4m0l*(kF&p4FFnn{ZzPEtViQi!akc7|o4_$q< z5}*md2t7v00FDB2_!2N~$nTF=TwFX5Y4z6|%$5jCU*82f$tjXn_WJ6z22I)-|u@Ta_FTd zBmhG6m&j+2l#T}%y+&PN@K~9c`aC}XkYfWc^+!u^;}#K(K|@0WVyP{OwA&*YIsh|8 zW&Ig`tg~z$PpF>NdQSv^rFd)+(j5qL1KRu$Ap42C>(UsIGL%O@K2l+`Ju`xP7?wDr zn**2%RJXwi2vjF!sN5Vi9bYcD0;2e(8jlbFIUF58G#`*zzZGAF`oW6bO0Q%`3kZpC{ z#a;!>96*RcNv|Z_IUH_AEcSI5eIp7lWYb5Zoaargty%fSUI2BGl&u~BL~#HM5oVVz z^i?v)aVZ%<$i&BQsH}hd`0*YBsb;O`QG>t2#B3gi8$Wl-*V*nG2-B_)cJ}TI=ripv_hO`5#z?`g;$l%^ql)F%$~p_4wy(=V!`9HafAxo*7i_J959h2CAq^p zAKx%hRRx@JK4cemHuQIEwxGMpp1eM&8nvpK4|vuN1n*qj&VYG1TkIT5m&O;awWa&P z*|IL{oVwo8vdVeD>;aK1_oC#M9pL)I_oki+pfn!*br&nu(9zP`xoa#bu~{kkcXxLO zn8(K{ET9c_VXMR=kzrxpC+#l)ddSVO|3g#T#3_xftu3o&nGbLlIxboZyv!kiRrB&; zM$i%pP<6%BfV2{J`q^W{j^=9yJ;R(mynttXWXx*&$-Ve$KtRAq$XCT@y_HFvkXE4Z zRIw(6*G5l6qZW9OkgjutqDw#vfU`~3imSjw?INW2&O|;cdOF)zVMd3=EW~TxE$G7j_H=S-iXL)yrz5z%d{)mYzj))Lo zrD}V)KL+e2fr0JO-TND1$e)&$n#xNOq06!DnQ2HwvSe-Eb~eBYq^jm=qeLF%2tx1~ zy}Z2elp&Di3gcct%=l*IJ5KAxxLl_e1#k@%-F}Blun^!XmFhL|1Jh^&Z&!m6qN10g zDKYQg;}^IlITr8*@BX{vX=esF_MKHiq>uk&XZio&X8sqrD8SnNSK(tdx#I;peMMTZ zIq`2j=x!C;8T$3_DEl3Uq~}1J1!yn+7kBf&pb`I@quzt#{=|V4mn^V$d|bO&%0b@b zPl3;l;s#fWHtC2!71Hr{JIfqjTQGchdnBpa35d-_yi&(nyZBa9P*|vFei0cu?lpKy zLBfD-?0tXpZI431W3TTew740wB=EAahvYk*lT9+^ASuZpix=C{ld%{-3V|Xu9eZmz zxwv*7e(il`!;1(s33~F%ugW<+&zbGj&;`(&^p;h=X^sUc9zo zALUAF3#-Vv)0Jt_BcTvu=+SgE9z?5`ylkzVPDD^dCF2I@JK5D2Hw4&CWlE2g9NSsj z*jNC6tPUry=F7S<*qB_SbAOPz=NZUtPu z9e&J<@n))7rc%YSyNg*!W(a1 zxu=ceb2mUaef($FX;XxK^H$*Q>Tp;%bUq{)H7E}%zHDAS+qUmVShdgUX778SPY-^n zcf_D&p4^*M5qf)qQb#H#KaQhyR!aJ zvgA-X#Gw1zhGu+*a{2DGDa%H5?w|LwSFXaq?bH<%_Z|cmKnU3Kk0LWcVeo-bl0}2S zMpbVyF{Tn;ue1m5>?e#tn7e^S~#xZg`^-z$0iuSni7TMjFjH?Ky)5y}goz54h zSLerBvfKEMuX5~-NNJ*pf0jw-EH~B~g=_}Rn3bR6P1{{aXVhH(raw1s2|;x}U3Fht zbjkkRPi;)m``c(-%oEv47D+p=Bj-|Tp9UO)Ltn0&zD zOBKWjIyta6ub}w&5loldgdyf_8nj;4;C$5ovhfpR-HPJdUW@xE;(LoK(&5;|{(%%Jbe+mHKjaH*!LEYs zQF(S<+(L->(xxm-4-#&9?u@oXZax)#KgT(14fxrpXWpJT8kJR-+k7&)fieTK<1iE; zAotvE886Qo(vIdH7!=)Xr$Q%OTEEm;N&2P(1C%1otOo8k*4c$;G=oN)gx|HoH}WHN z+_XirtJ^XKw0UdNIr{`*B>ug9JUAdFx6m^UH?F zM9hjpg8K|@gy7wYuv-B>2@VgccfZdk^OY`-YJSp3dKh_?tabF2=*>9Xonz^ovl>%+ zT8v0<9qcK*5JN;K6@T|bc%&daE>hZDD@3g< zTBe>g;x7!WCAni&#+1k)W9I{;fv3l&v>-!4Jm2M`!E~GCh{o*a%YxbGN^BZM<6s6| z@z=&$iY%&qd1UXvU9!1ODY{MxlWTq$De^Q4gC2>vA$^^UBGbLY<_3LBUv#D{B3?sJ zB3C?q=agpG^L$|;t_9u{g4ro!g3+MX5&G0oRzZ5v9f@L^8K7JdAdp>8-TlQy!8I@6 z!|#MsBxGn&)wxXH&Q%v4#aJIhl-PDc(RSm{Tt8JxNJF0AxOSiB9NPWYQp{)Vrb&gh zZh!R7Qf{?fp|>rIxSRW%ngcj019_s9l}h3_cgw@ZsP5sxKxf7q!mS#%vP!)P1lxL2 z@n4MATv~Ed_#LE_3U%Z08Sc$_l{bpGLoC#R+!QeS3d+P7*#%FGF`p~K$9C{~sl%E4VE zl1o@AW!@bydby$fbn70GV9pq{_=nNqPx6JWYn}qG@%C`ok$#qrf6*VSPY#QDaU*2p z3TWyQ?3p=R-9O98#3wb~&s+*e@S+n_a^Z9z4~jq;FqR&PC_qk5f-ZH?iJwel*}STf zOu}SnL_QMEK%-2TXiP6FcT;iyf;E%`E8P5p{9gQ=%zeYu=M-lVMrdvlwSFEprI@R> zZhc2StBCd@!?_#@DZ2*w?M3mkn`yVLuG%_ygr%wq&$uK4PgxU=%n*E&;q`)+WgQO? z?ICe*u*-NwWE32XsV-HCqqf`0AfHCM3DeGWm)%am8&Ow}-^j3EYk5i=%bi~U_Tjl1 z9(P90j(qRd1JiUmr=GeGD@2~saq~|lscmb2V#o`6;lLJ?SGD0`SE~M2)K5EHASOdw zwv~mSHG4hoZej4%z6*hf;zad>)|a#;hOuyklz47{Z(Oi2tUw0&vZox#8Lcj2K7 zOD0u>mi}E|9Amq-w^48Ax3_6jm293-X(HBlS`UNWBC4vcA8jqOSg6PRkbhHBFF~)? z@zX%Izrn2`Bp3E`7>udZCbdQ$dzY@h!#^4( z+RTYof$XQG-%AZP$(U?_+VQuB6;D)O$5d1l{VE&!BTHn=33AAQQh7rU*#yF;IyD#MNa&Gw*HHcjJbgYBYS+PLW&MZ^%V+$mW!Q8;{XRJy%(; zYELE}!l(T2EE` zkd&gJndWY^eYt*C6H%kS{>{IbI>up`sNK-cn@mVVvN`2pR%zchc zo)NJIsu|tr1qgj;>P~1vi%{gavS9upNFO#o4y6}Xok$ypCJ372v{U@}HW_c2< zKlTpNg~Ft?=5sA-&RYY=$#0c3rY~g$gQj?V4z716qy*b0zId&fI42zkUtGL|(9pba zRnHQcmQ+?gJsla13sp_SA>31Vn`rzEpD~hBfaBVU#~97`ez(Q@Tu2@}VAI5q*|{eQ z>s35{Oy1#8WJW`2i$)CnS$Gz==~}Wh8g5MIxSB5ubct2)N3ktu|FG@an z>ZY~pPPkdv^{@^3h?vdUnmGgHnlcAN?H095?zMcDxr;=h2NG< zRcl5=P1{^XY4on2lcx|l`QpLD);WL*?;WN%xTj+=?oGsHvJ8oppl7q<20)bdTg~}4 zb-+H0zsprKmGpMfBO;S9nQm~g!PWL=cd>ET@ifWB>!qkdfx9hC2GO>rCVQ@*y%VMdA$)vdqQuK#+|vC01RKpRir|i7`v^y)?staPbimG7v-=Ly21NM zLR2Z|FC$}!k-(yFsT66yM81qkgQDbL;apJ3Efo4f{3_Q!NE8fBY@L`qE18c!;riKd zSv+O!+|qkT!?xJgdS_xMlcCI6$h>D&$=V@~KVei#&i*sYey)1orpdr08Kk;2cWKuj zTN2`@xwB~aUQu>3uFiga!5UN*D8ftQX&2nQcM>>r^@YJ4$WAS!RBb-5`t@F)_P%qS zr_+FQxm^72T@{cyUcqP`@BS@j?VXb^H0P|iui{gM;OT7dnfaQx7ng95 zo^~ChG#%NKDmoJlch43CD6JBi&{&P_gr`fk5{DFDeb&D`>>Bj&mODi%EwS{kbR-T% zovZ+$N)O};A*FrN5Sb{ol|isewZMkY<%m>5`>WUkzMA1JqMKyLU20pbg0{taPgUiD z0i!rAZKe3oZ|m)a#C{l(5_v;O~`p>-XzeGwWwfRrvXB=d=(Mdf&p(7zVtFzT=+BT8NQek&F#~anY z(W@}TxJ|)2KHeE02}>s^WvGBwo!yPFlVZPdt=5@pR_J9pW4Q>3^0!y37jPWzZS%P8 zyLopNsQ)s?twPX!LC15=7YDWb1&bH!$hJ?TAFTf^@o}^^iJD%sW?%hEa2SNNb_9Vh z4EoY`W03U8vg&k;-`=={frc%5-$v+micqKSsMw8*KZdb|8md?T2*)?%)W~XZX>Qqh z_=eez|B;@~VSn&wXy;(MoMz$`OCi~x$zc^$^{6cik)EU!v$Cm@Vv~+cs$ws|v0pAf z{O~g}?iF_7Tu#xbeSb~}?IgGFVTh6#qFgc7)!$=cY<}eg_0FoGcVU%ZVtC(M_q+8A}_m2i2Mb;`_DN;*Xr^S z=T5dRDq5d46{k|ZRV|$*R^`3XZmZ7)IF)y2IbxSvh`l|t7KqD6@*k?U#zls}3ak4` zr@|k>nm5;$-`Eo_rz7o}^yrL&!OC}Drq2esz@H=}zC`_QJc_@8&FkWX7#!8cO09`M z9Gl}rhMqQ7FQujHYeM4PWpRZ?$8}cuXsElUb@kMi*t&usB5s}5&m@azBPp1Lt+`MK z2x4nT6ytuk)4A2wz9JZYZ$mz8OEM)55sUcu#m8iQOG!scYyM=66oAHaJ}k2v!CNJhz|uBxe%Ra)1dZDR=~wESUFIK!vilJn`lS*=Ts9m_RgxCC zmY{I}xj`fzw0JY*cSSx-a~1Nk@$55#0zx@8juVEiJ9FI8Zf`tU{+zC4;((C#AhXkB zKOSdPNAM;Dxtjr_EM2|xyU|iv>4u7gsLhX!>$+acpS>ESP*8XLbRQ74jP$v0Dp?L? z+(so~>lH)ZdYd<(i(SJ*9b=rh1-6cLub>L{o`rrl78+d}-dWfunxzX>QF3>~l?@f# zHQN2PWV5Yq?f})b0JN_qxv9~IUOdv&T>p~OmP#Nqb(Xn(OQS2 z>eo#*w}0o8KtrJSAU1xgsVi=FyU8DEe&%wHq(cdkpIF=w-z*7QvQ-Jm0XTItPD$_8WN!(BrR ziBjID5}{V(`ximJl=tvB9?9#Izz(cqJE2-nJ*~S+K(R)(Y8y7SfQbzAySckl4(J)U zOhq`SL&oDF1zn}PIum=+8BGW6xhOx+bewrjaM9g4_447@cb&eXJP=O{NrNBIf^Q_F z2R;w?@L~O^yCWzMt*BOZrLBEymH9mh$BL#{a!JFE>t9*A{L9PQB}DYL|GiddrPV`` zI|$hZ$x7vNM~bsTloIEaN_5o1B5MMH7^m)n$iQrbFLQ)rBbPCb%O*L_;w(~QkK z-GvD(Ep;i}^q*hJhhCW2VC6x4u8+*2z6TFc1>4uxvRZ+ra{;uWn4R3=edXLVzGIo9 zX^L~Lb$1Egk_c%MY;x;yCJsGy#><4mg+{j-X17(Ihh~BAj-O%399wN1r;E(x`~KT~ z#UhHEIfyxfXE|m9rRVu!>HZ8?YLb5PTCXEs;EzaE9ocVw4;xiV_sLL^hut85!ISRH z@Z7(b9AMKhn z$m`9h?RwCl!4Q2@z~3CX4X92{V$jeq`k~hXypo*hTS5jo-$J?l^T(lm> zp0=b3edPrzNpQ^E`0P@L1AAi`C?};ar>S^i-Wr|saMV%Ym}Dodu5u86xHd4-EX=@+ zF5NjWPPg!4+Cs*F{o5Rf`}_qba`oQ-;ePbtd`KLB-Ro7cyZ^~nSw~~0oOvS#puAKp zt2S1Z<-OP5FO%>4;CnOLhV0c;Fq~++x)?oHytrt#`NevF7B`B0$bLZ?7ca;>C1qi6 z{Tj76emxkKW<<3VJ{C%|?(h;kk}2P`zK>pqDgIPh(^@sCaAwgu?zVvA`jj(MJNef? zK5~S?`R}tt9eZ3O`{J_Zo08F;V2eD$3V@ilYE}f&RQBGD3GdLs|9y5Sq^dn>?(!L8 z`^B7UyWnL`2jGvVve8fdynEU9;}2Es?#0-7X-y6xh-*Pix>TcBYB)VJA2*@^!#bP| z{b}cUt4v(Jd1M&YxCL(oevd*VDSJ9QQ|S?Z4D4TbzxsUg*b=C9)v=;#ODRl~S+Ekn z_gthmm~4<$?Kd@veaPaVFcoiK@1VF@S)rJ!(?1cv@kM4CL*TXELc6P=+u!p|25M_OC^pI>OC%n*PURvk7dR!6(EyT5Df1!TOF!|fC zh{i$Z%Z!P^HS^&t(Vk`C5aV*07yq*BWAAQfiIsCX{fAF~s(Z?{g&{k?2rmyR+9zC@ zUETP7D8I2Nw$VYsMLs#*RSPYxuE&0{q$Gq^{3&lLplHy0{eq;JghT&u@WcrRVjCTm zq`S6BNb+`Xy)c@n*cm6iOyH*iq}-v||5qDuJalX3Cc5V<*q)j~LoUJ8fO7Dqaj-&#fcPtP(0KQ$h7o7t~CB~i02EacIk zLQb?%tRk!CNA0H#Q9|pT+&*Ha@$5SAeslPP9me{Wa~C5bQmBOW*$Cj{@LXPxv{ZiooIiM z+5D9mqXeRGYHy`~f?JAdqrtpb=rFLgs=!SEQ83hG-kysZ(dG}9yz3I=iSrQir?eM? zos7U|VTRdnE%n#l@f1CgF#q}+4m@kQm zP0Wlsako`&b1Nl_ACbOy8aN*fz9on5RewrgL`kiqkm1G+lF*%Y9V*NDgx~uIS z5***Yx_;vqvYQ_Iv$mu zxV{YnWK)JxGqO)&;uKaqGq>|poT>qClFFnRB!xf@PEPl|vy<$n6MCHL-#a^V`DJ}6QKDRO zk5}2rI%`Qu!5s_Ts{-D}VvU)_Wxtwxf)eo`w%TycBZc_lbYAQNrV(f3tdNo)=o{)I z`aSj|FDfIETS9MQ&TOyhggZg#^M0v{tSFzMwm)S;y5WG*5vw{zju~er@<>~i(zOkw;GsywbqJ8bgFN#}*=u_98(((FF<{iZB z6Lh_b?@8L?lIKYyGwzBsGGh2xT_;}xP4l0f-L2Y+K(E>&AWS`!m-YxRs;w(2l2n?U zSjsIXlxA!q1?$Swqv-Wwi5D3RqZ1NiBy$UzG9r)& z`Wu|BWZ>cO%b8c^ih} z6luD~wN@5};(oh#b2Y~JTOudly?YBuBIu*1DRc2*dDAjgFmvwbkQk8X_tv04kZ&G4;p^mk)rrWOfrL)Ve7nctr6jt>T!yp z6$HyaI}20Fz&nGVKB0aWqr4qkgHR6yt4hWM>tDbbzn*(C#{RkY9eTq!-Fo}w9qTL^EW-EDu`6W5 z=Q~8cdLcv=t-A+Y5i~Hs+SnseEEHO`pgmNf${3_SUIn1&xf`T*c7A-e-yUtKQl8P! zQ8P@syWJG2QXmLPxKzs$vI~{9u;X>$b5-A}_vWVg#?fp+px;ir_N;3n>E``w)PQvl zTc1xR(dX>T3uQA2S=KfJKILb1WHD6Sc+UH~>!ofLW%KWQye_p$HLtIF>8}0nz2d!Y zq(k~XGK9el-L>SOXAdf%)}+X56pNRC31prBo||lRE4O( z{wd}nFJTfv->*J8;Ip>0BH-1}VRL%Rx_1Z(QH|R#U;uA-x(tzS5$Y zS8L+;t*ru-1W6zkqrtgGA#vHEH{Ld=!ZGd!KGDmq?ADMQg}J-lB$G%L5B;qWD^}*d zeT&nqMvLsx8CNDzb?_m)W>b`WU~&Up|6aV8;?#JJ7rtG*r(@Y%$Hd)*=!v8x&r!$2 ztq6zOmk+4?o3h~wiU}WLC?4jR9eyr+b4KSfrO8`6HAyyq=GJK!q+pAw^E(n zzwJvS(@<(#>6;wl+Eybe%$i>2D6~1=p*v$p>$jnGe_l7-e-B}bC1sL;Ne)Hgd@iboLc+DH*L1)zzH!!o((Wg&Lsu4zM&BOFVA6v^Ju z$1Qe=$JJ>Eo6wcCeKK`FiPUeBAqehUoXN8vulS}*eV&MQEgy{*MIs>E*f2ghJ8x93 zXPZbpi2sG%wO7phHX_3OO~vTLTFSOrcin;h?ZR?f<5onK?OyVqf0Ix#MX(N}v%;0~ z;p$MYg}CtQ&fzA9rx$^TURt92yArQJK)9~6>T1`OyoQXlD0+aSNh^$6r9VL>kk2xw zdd!f8rb!zg_pg`t)E@xoYo$V`kWSH~LB61_zPPdQMF;;Ni)4?JF{j;xXRm*@bSA7T z7~JLX(U>tXTxM*53_GVUBwTmxRDqDX_m8Pn;wEZLpY_G!E^+PjVYgHr{|v@C14Hg; z#8nd4f%>JsgO;scB8C3v3paS*W{EU7e34U7@Er&9x8yKCo_A!N^IoZ=lttDr{cU8- zBuyTiFk*t~fnZO^&z-f`HjyAHsL`MJh*FMa0pIt3-0a`+}+*X z-644J;4Z->xXa+~?gKl|^M3pP+ugp-kG@X#bXRqsX{oBa3OW;6JXIT`_<51ZLcWGG z!tFE(HUg?38wX9^qYCgqZdEjAWa=jTG zEf;zH%9&BiiWRdfrtea{LGa&SS3iS-JK?&iJ<7`>)d-NoWa4q9QtEQxY8w%N5O9}f zX&o$>ZrySYdlX(>lc)@07VY)n@)PYHLG3mNS9aqL2T2(>iI*qRG$M}c( z!s3>_Pqf122!CyA7sQ7G6q{<7Kd!A>v>DSkl_h~YcsFS>AxKQD(G!Lo_kT(+F6>G| zD9DYtrjF(#X7E{9ixg+{4~a3V6Tb*>;~{_ENJd%oLiK6voSz$_^F|qxi8sena#;Rn z7M*K?L7qKmmi|ZiIW)7VaKfsN4Z6Rc2t5;J;V_N_)b;T*Q>g-rt90tfAz~eSslNf) zxCx=jHkJg+P9V0Ks8BUrei`rXCz{$We7zx%@i+C zlsA!;f#3GwtsaKM^mWsFQ#m1#o8H;R=1NS#G`nWv+hr``UH6f3$JEb*)VQD3Q!V*S znXzh*1Tmt}kcfL}kMSkEqS+vmGCSik@Y-?aS8@zqIo~f5@%$QP#Urgr|L!Wc$NoH#h*T#XeU$IkoF${lI8_F;bc4Q97>a&TJ^X8bp3L7HB- zPF)sfyxutKoJ-a=SWa0|SrXr_t;^OvyV!EB)OMAs9OesGSVpF)PMT?SrenzhD@yKT zzjXbG6zF?P-N)lw_xZ(HZ>F#&nKAEYL!VV;eq(f=VVmC%@c*8LVg9 zRhVd}<270RiP@*w+~{|$9v_-$-ux4A-xXxyQ}iiOXtr3qx-7D8dvX$C>BXdIYITD} zM7d&QzLjf|bM+E&tk5XNX;qMAeUeJmnymq^hRY6wvdHiFl97*i*RFxlP&7BWBB;Jc*WqH0QIQ=fwD75Jn z_u8HSDsQhLU8v}^Ornc(SE<4F#>U@+u_%%NXdz5ubJgF2U~qF}B%l_z!?wt7@qA9S zg0h~_I!)5h#%F#NRJIe^@EV2y{gn(pDbWkqJvpAvKWK_L^VUulsh^0Jx6jYX^7EQw z6j`dYPu5q%zNogj?R!o&l6VRM79Ak$FnBB^BdW~*{y8YLMb_V-7LDK+KeeO~)L*7) zGAO|GKIlzz0}|idt^4{leZy1${6e}qfGN&bl-vR~Y;@~}cj2Xq*b*z5|5x9ag+J@72#QP7GO zyM;T(o99Qw>9TPpA*Mt7d-6m*#iuou*-p)OqQg|bQxO4q03moB_WER4Vf}MXIRF}4 zAhX<@leYBa=<}Q0)WN)AWBQ6Jh6*nykSCi##=4-#B<`1d9*=<39Rj_36eX@d9=nj5z zHdceUdA@&agiD>8=4C{UxG4<}#Q)@68QvC5jWV4w&0?@wm+w{8I*c zyuaK`B&2oL^V?rrBlKAh{}&^NMusVql7g(aKMg`rG%^yY>R~c9&I+?XY;c7{F??b87HjBIhouRR!mlzt|>&E&JNa+KNenW;Pfd%yQAZkK>{1h$Zn zMI?s6;aONajPcUFi6XLURG=2mYf4RfOWE3ip^g+Se;JhGv{0_f==!$r#V!wW%{f<*6vOV@mu?)v3%L@ZGJu@9v>L|B65Zc?fLYp=R76H;E8c ztipK9@7Vg%$(Oh|sr-gAu!s)5@-ebm@YBty|NHgf<@2`n8YC7w-}8H#nJ1YixB|J3 z9S`}*SHE`Y5_eQtqpBh$RO&>Yh-XvL|6+Cp$$ZtQ&?vpOA}-&O6~Q)P*FzZIby!w@ zT#DTsHNV}%R$5)*ti65S#;v*th2#kvuU_kwtyA)cqk)LCc zg$loijjINtpKi@&W23=#YHWxPv=enDCrc-PRi{F{=YwHwKT9j~dp~7LGiT4?nd933 zoao^f%Ps;PA3$aa_?5EC)fCsLUH#FgLk64obzpUG$Ghk5NZa%<&V7S-u~C$%{?i&c zdWhJN!#95&mGIp$)VHhYj38itzZ!rndEi)#aTewzzNX|E$xe0+ABAve{K z1dQL06ajVeIl>|vJuo9oQA6axV@Fkgaw&7FE-k8Uo&@~gJHEu3Z6zN0KRVR>GB$@r zsA6ad0n=}q+%D9)M^^P#eHEO3W^xed-5=y|F2m8Zv$kSZ(+bKKZ<{~wd);=}wjbO)#md&ok!H6+68H0@$4?Ht>*0+FM7@0iAo|uq}V%90lJll8e$F<$uQAg zJ5eP@!C!}Fc-HxNd`c7%Isx#ZP7P$e3x_?Tl4xkqSXp3ULUc+5M1GWNkVYC>6~!*! z_^>V|=^MQy!Oy~;iIXpTo6kpK>yr2Y2fnGgzJ+*QG&Dx4`%+E++Ukj&HH4j#-!XhoAf=4&_$pzRMEGU#TVzMSA9zWMQo8myF(GifkQEUP}oq`?K3plP;m%-&g?UAP)abv(8dK*%@-Eupx`HUnik ztyr{;oQ)%WOG(GML!@F%T8rJg*YzL_i5x+hB(?4Mp$T8x_LP?ie1*H|=V#r)Q~uUH zwV7$1(qIe&_N8v_xy!cqInIQrPQYKK?oNigoiwBhzcH__t<0{@@SF6^>JK+CU?MX! z3_AjfM-qD8kG<71_WLjSAEV9l-pBmG?+ZAoHE$|{KED{$SQlnyr)T*Wx!IS$&vWlz zc@sW#-Zj(;fCrfbp677|A6IJMuG&DcE>8O}?&+cE&ACkA9rF)xB_oQD)BRBRWfgMr zKK{cU#vGhk4<`bop)PEI;y$U{V8&BHn;ZK zV!M)AC`(KoSy))={+ni$B1^=$34H(5H9LoB;fWu55SClf{^Biot;NC56JHiV2$*?M0tAKfwj-Sl{$AN_$M@JrN)2NLmny}6^=9Rmu$ zMPNOpTNPOG=3|>-Qswt?y}GD`6QB+(rV))<6WHE|C6jDr70m-|aoeq5AcW|97qMig zQ<@`EH{0?qeFtyQ=}5e0>hZ3H45sS}1Aq}6EK2kwZ+8UMkMn~1?}z2`IDh~knzqY# zVM!rqvgwj^oUqr9FZP0~?9OFpf`9IXgv!5-jVnV1$kr&tE8uhWc)N##nAohOB4WSG zpzMaX5Z~fcVC?n{YN)qa5NfospauBI{+u;M*{9R9GECHBbu?P*c5XhVtfF>5YhfLz z-|3^w^Ay8~v~_tqTO^(+(8KYHCu+AKoleIEP9xe{nMxJz_HFx8ca(}m^S*o|TK49o zWBN|tCmEWwvi+#Q<6GbnC$HJe$F{uCYOXLb;G!(@8pm(`!n6h@DnmS!$^>1xT0O&Q^tMU%OeG`qu9!SKuj8#z$k$ExFoXe<@(4 zrP;kF;Mq*ViD{cji4;3H4KJ>49M`VfQpb}D&g}e(X~#;=wBvTVxUsN^SoZ+86~V77YaMB_L< z<@Ybef5yk438|9L=XJRMtbk<#t)9*?pRSszt%=5D6mP%gY4 zk}m@nNAxBF5+DdbmKaipVFo-}1OToWUs3bQdydj{GfllWqR=q70+W(h#_63q`*9!7 zx$XC%0G$>`HgZ3DFW}HW!G9g7BV!fEF~OFxdc5GC1s5PxHJ9mhTa?{Pi8#w&`?AmCQ5emWnd17TfM1tj;l54HfIHq7(ZQTv+dAn)) z0R{x+SNeafkao2{_XXhgZo1xqdcb=cr0g9*TrqF01&aCfi5~it&8v6@3CR=lwjft8 zkC(zrD}L7#pCU!2l*(jjfKYZq-pQ@Y8NY)^@6U*&@#4aNF;$~krFzEay5jOD_ZzxC zU6-2}@FFByO~=Aig}-W-P&ySYWk(q`^RNn_C9AqWXpJwnfIFJ%BUKR*GIXFncpF+U?C)j{xGE?So>k?&^gRXq9*^I^SMxUS&DnibZ zX0a2U#c7WwO5FV($~*&?WB4$Ip#U^@&z1K6;?=xMER?YLjaEehl{XtZ^9nb<7)z5& zD*lCSwtPme+Iw%r>0#7EgdDEa)&wsVB@DK zvI$f{%jrr<0NH-zGrf9s&)q>9uK#n9v3O|4R+U|fwzeDFr-zWt zj7|uiUaUAA-lVFfy`6MiTKT?Dr28+qN!q8tLxme;WhAvY&ahAfqCVxQsMzI8n2vSa z2d?q>*FAS#g4Lf^DYDf|SZ$_vuRphDj(7CJ`I4lsOYFhNA93*(scSO7)kP};RZZ$tZJc9{ZHT&Re7?Y5*7i~9YlSe7G703ZVOh2IVr zJID8!!U#+fZ~jm+dzWNB@;U)`dfR#x5a8SLwHICJR7nN%*pE`=Nu zOLwzqr)iF$Lw<<>U7)BEW90CGG)1z*=jX36W#OU!Tso%8t%!!-aKncB*!{2(h}*M< zWtWC%*JGc(+3Pp0xP~x_Xa+w1Z%GAt%TrWXt0#96;t?7?YsNv=ke^_?_~G3{v;Z<@zxeT8q?@_>xDeTV zrMiRWTjJWzn;V6x^Et?Qrw^{~;O)LmC>rH>To7#WXuTHqvCo^ENL6l+0smuQV*Ex5 zu~4OfT>fGOEV%h-|C>SUUP$ZgZIUo$EFsBK{cPj;)u3^&YTf1Z=B9BLg^=2oH=gfx zj?^6AA`0#E&``=VJ!jQ8s*a0+5Z~!zt6mb|doFauy=Rxc7iW~P?)2$RRIu>p-h@0o z#e|hV&!ME8)Y8R>P1BdfDblt1aDWiap5guNAD@6J$)iFE)bN>(DJd=Ov&KM5=&Iq?^kLf-CI6x4{_bX=@EKB-@lGT zUv^n*Rf&rN2C!Aja!zZWU#EJO(oGU%xP_~gMkHs)5ruAd)2-e;3%WT;BoV`GRJaFE z?It619f}*NJokwS&+Tn^-){|K%n3Y1SHr$OI=28tDRF9hOkHlO`=pg^F2l74O_)! zt=;o@;txS^U^NXi*B7O~Ld#)$(1-!XF#5IhN9N`fu5s7x{B{O3U9?&@HI#m9k=0XR zjo~4b?@R`%`CRr48OB#T??tag89F2excyh)ChrYWg(=$hCZIn1hPJoQ+UR`6RPE@z zq=U}Wa1;(t5CXHTt9qmNQ|-P z@PV%(g&Zm%PI^p{d~$AuwuebeHVJ@Olxa(dP*K=7o9>BoR9q-?{Mc)CcQ7%8K zbdzf%k(_tLkulWr^wbg)^VIj+xeM8;_zjeihd{0^Js}~GJRR-KoQ{a+Q>a*J8~!j* zQ?U4yJ|cWYh*p?npc|KxV*dBgs)DD?>NE~X^kej6u+u#-s~Z%Vt+rB`+6G#poq`7(q_89Z)%FYABr!9e&U%*z}iGhTU13u zO|kJi!!|U*+F031Mn-0wj&2O`_SWb=f1Yo*4`3t!fQL?i4fKKf)Nek9)yBFa(Ur-; z%)&YnZ4{lZp+kOvB1twto+ZXk9XmA=$@0xYl1hqJ3@M1G$LNQYTd_Ja&?qQI+NeUi zjfLOQO9+Z`W^hP6s;s>ujEd@9{;-&r?zD9OJGR(J=+9}2Cm{D@6$jVwi?;S_uCTH6 zpe^b~HZcrrfbM_`>cgWOsuz(86ik#nVgD8r91<6}n{$-_u(aCr86`weQ#2bmFLctr`k`G zxace)cPj^sEp2MgZEnl7pUUe!?mztf>xf#cvElm4uU1C~06@>r9FIC}YTC;j{#mkY zP#OwJjra4lt@n8e09wVSVaVOP#(TcCht%I`RtwO5l@30u&gGXc^Bo&(MNvClG{wam z=zZ!U35k&!mrf?POo9b08b3y)Mjj77*BJ_7(5Ym&{A1x>H&zRyHZ=i`_U_`cTZVc@ z)>-9_0(XP^bIMrUU-r#{FN72^GWB!P@dQAI2}u&75~q8Zdi*~)D?!^iHxgJi zwKZc=Y0$Kb5;_>T&HaaQc!5JYQ5oxB=3N`WAK>b+L_?#+0h(M-bnz>^N0UkXd;Ui;AwwoXLP@jBM{G@Dz zrJZ7w3RJ~T?teFxP4JjGC*xbwu_Ym58pT?!AP@+{dz?dw+34p{N|pWOe*lz3jDDMp znw<%mPe`*e0soMb^Cc+@HpHeKSI5yNAKYr@87wWnd+Wrb6t?VBQ7-ZYcY%DnRP2U< zwe?k2uR!lsIx9m5md2MjcmO7 zNfBnzps@Xc(th^hepw}DFKmvTK2fr!ZjKE+N|hmBvOdpxl6D4u?dPCH zynY}=zztzxJtfJ6h465S6yxrX(U0~Lb|$50vLkmzrA$+;l^Fu`)7!*~i23>()m>L! z&wCU^$CxS0+jjhL(6-Aev0L^6qq;b?sritosA*}q!d=V#1BzVRxk`?u);%bGJ*zZ_ zwjd=#92uK9vCioJ!~+HZFakq;<*)6mZzbE|A@G}W%vn2Er@>;Eo04~xVW^ zg@&Dylne+DjX0spXD=)|JO6J4eW32_E+wzv`7JH$iQi>@;H+^-a!d0|B9@p+2pK#) zyi@ZMuSgJC?|N)dFUy>73VaYwBrcE`B5FHeAl3exL!0tLLhv&C(`!RSZyga6Kx}T_ zC5j@?wCq(JJw?-}iFa(ET(8Ib5S2f3s`JgEDFcWO9aLzJaVPEM0MUv{BguidK71$! z92w#R3PtDdj&qZtg=US=xt)U&0uIa(g){th`KGRk6cX6wR0;x-ofTll>!Hadg9-jo+QAD6cEFzPbAM42+h=wVG3TdLU z@)>`086dPK{WWt#3SC{7vMR46c=$jP3F<`>ISRuQNy6fAhTG;&%O9<0@A~5t_Ck-T zG1=0KboJGkQV>5-=%H(}+G>(0i=AThYTp)xEis-?@kR@t2*x z1o4SR4QN!D)Btxn@AakVLtq2%WAgpoU-3=ordWpc!GPK%Zb9}IMe>=>58XD~f4mig z;jMR@hhXu@v=>ar)XQ2;a?%7O9!Eyo>vAnL1x#4(kI^7q=4F4Xgsg0hbV-e*VoIc& z*(A!Ne(B?&PPxgIyYRHm=TkH$J%O4meVJ4hD?@I*R^K39E8b{0eWtdW%96it&Mc4l zNK*t4*I(h23Typ{^>5N#_NS1d=hSKtm%b8-8sWLQMjQq~Y)yx??}&D<#g8!k%x7Wu zAKLrSVTO2+=YcffKh>Eb&so+s8ODEe$Q@=}5d;5u2WbfZ3ps=cNbZky*#BMCB@&~r z@BwgJ0Dur+fCA{#=NLRuYh5gE+)7A?)}dq&b34B2U;N>+7O@Jdq*&`~USX(<;L-zOEU)h#M;SwVb1s_nQ*uogu)y@!2U|jwCzFDo)jB**Usb z7P+Z0HqvMU;adE;kOQ1=blI)BIgNU~^89Jk@WWb1m{0b8@xBg2Mb<0jWV4+JKJUGK zb%C5~WZxwO1tK1L$AV3fqWDKPlFq3mcYuL2M zW|2v}b%ImnBiJRvWda{pKChj==454@y$!Tg9>DzbxC}+-A!nfyrp|7V(s`_NX51wa zlvCoHs+65M=Eg?I@<03~NEOu6bNo~9J4{k>-%cY}zdyqiTy>Y+?w3db7J94gYdET~ zET+XcCC8NoEf#Ww8goFvmZ-h+X7R7+ap|apZ*PgNDDI2-mu|x)>gJT?z^6Q~E@2;s z`d5)xvP$U@8L9a(T*hAR*LLl8s^7(pg&__YHFan_5(M5hF`VSoeGX1%IeYOD38RJRR?iW*NLxL`le~sZ9DFKQEnhrUOUlfN3c47bsVfJ> zqX8mC35uj@lcVj50a5sNo44ttT^rP!PpN`}4PW(TCf7Xw+V?c>GxaPl=G=_5biXK? z>=e@MA`WyxnD4(CYX&FR}>bx+n^goV3ora>Qs8FMCQD z&?7MV<-2L{ag4a>u;gwhr}9qt8VT!unF+J@?WMsaF%7mTW4DteJ2ySdS`{M;c5C<) z)qbU(-($@me6+~A5FQ51G48w`i2H6;1w;S}1JJNWy{W{*hKtkW;(a^Vh1pa;9%>b6 zNOfKn?+`IzZS|-Po*%}W>Ou|P_BAeB2Bt{(PFxrId8uD z^UwTreoi$)Kg~>`D&7=5;8Ut8j!-CUMX0j>1^(Aj+vV^_qJ+h6I@8z~+3BR{ij??;|{L zSzl~d*y`UNI#WD|MD_jAb}d2R?9EON@{V)!O)o3C#5CQj+mUDYkGJv1)!m+}>Yl9h zfRWcHP6$+$FCuS-#fCiJ0+-( zM-U+w1D6@Kv@J)Ddq3D$8ecpeC@hwoxOfF02;$cw@b$CGJ?AG z*?q4Nk2piTG@becNebsBfqOyIDiLDGa|Op`f9Sv`GNzctd4nqZaV9#B$=4astjG4v z3XU-G1k#5*x+wJcALLUd!uP2>!2m#~`_aER+i-=;X03~NS*Z(?iG!YezPNv$v<8~V-_k?h$F;&I&sW=f z%vld-!qrRq2Yb5fEe!(F;T%<_J-Ep_Q~r@H~0kUvhgTcUC_@N1NxT`x_M;h_BT+c5HRCz zclLLh3=E9*92>UAm;&?Bu~j)#ok;1-+@3^O7_3wzr4hQ^&PF>%>PGSG2fYji)NAkZ z?{81`w&KW*lH?eXzx{dtA|%fKY*!AKO7t6ccvM9u^^%1Sf}C(Q8K$woO3ztn<9*~i zedIMh#=L%=`Ph{9?T_z>!8rgN^hQx&p@=Ie0uwkC5u!%>Zw0gLfwC;yZZuz>336w^ zV37+?!>j^HJlL!lM_2glbbHfDo2%#JC1al5SF;8HAt}4$Ni*AzOD?cUu1J zoaZ{kfC(%Z8Y)NV;Ng^!jRX`}+fIB=lw>FzWDfSy_Pm2Ugn@^o7ToQX z&A~Bx;Bq*Dmik}A>|Qn3=gnE?hie+8GZC2AHp=4r#Hjp=_zim>wA!VyQL#+%^Y^n& z-G=&9m=I6OkahDybuDB`)oaN&enXiPYsUZV)w@GM@5rx}PfGwqAU{2}yv~728LGD7 z=beU_1P9l_lh@&Lto!3NjBB&a*7bZh@;RRW?uhu{C-l3FX4k5g-jczPMKR{4!`G{XeAsPMmb7brJ!CO zLn;Q~efy%lCd^UFt$o)+ZYhHOv{}uRn<{e4hP%V}lAC@QASaPh15!+~)vO@6ir|W)+Rw5nR@-|Y3Ti&tbC(oco zO}dJ)Xx6&|4h7e9kXxf`-;hf0xUqAk#%2yS%c0T!DYxU!Pr2Y|p&-?Q@$&XcpoXzM zpF2~WPnbBB1j@(1V$#LN%`yatisuTBfey6*;Ju>HK5N`hI_&*wm z?^h#oz`ES3@sBBLL{D8$J+?d#L&ac`|F?^+>jXr_~*E(AbROq9vHdy%WqSF$1l_`c6x33oBkv2+a-KFYG^ zfc&3k@#x8vrFAOoE63z>1WJE(Sw6 z8~X$D=R$RjGCC=C2TzUI{**FIZV9Wnd0r{gR&M)+u9E8k*~tSKehyyu{PRchU$LJ` zSi?n|T$=C&IduJxjZg=e3=AWIE8WTAI^`phO<}em$0~_m>{)v^uGS40ICr#A!r zMY)Xv6g_lWGEe~cPUh*(>c6IAGPIG=zXGx=cpINBWE8jHlgN~1F7>qx)e`||e^8s} zb4XZBu*^;I_kjS|AqnkOd3k~;`Z>(Kl%o4B%gUIvk-qSUoO*F8bw4k$FcEGYlf$P7g?HP*eL)v*0%VcJ4@xF3MeJj}aFpCxarxBeD^2 z^b$={O3KIlM$+z3+O}j`wVq*(=(_TNn!`J@TS9@PUSjQOuP~mu`t?V%U%l<`uBO4F z*zpSe4o-TfojYFdZ!Yq%14Esr^kZrMcdj>>ZvCGUeG<-3FRu{aGsfNq;1e0PQyi%Y^2zqOT?KlrPzz-1ZF_|zsXHL4Qf#} z>5dOlW1Gz2zS=Mn2mh^4+JVcX3rmcyeQ$O}q9)5AVc)W>sy@Xx+Z`*OY%U7_hR~>6 z9wGUS`Lvwyyb2BaF#V+8SXr)O&OG~t9?2Ms2Llk0d3MINb~M&=NL5;tY1F3p3!`y$ zE&fbknOPc67z3|?^NUx;ABm+y3-ePkcx@sVc9L~(JX4+e2^R~&jyFWEI zleXNGFZfXKX_xk1V{T$ay7YK`^hdZ=X$sw6xNqiQlft9xB-Z4Zhc7NfKD*zCBh*?5 zZNMsv%>6fr-?&!%kFVC&zOc*9vf^00u3SiEUad5l(q@I0lMq>2@_GLJ!0%8UbPjR; zHCa(ay4lDlJ}B#w$9r|L2ugqRLT9=`y?dT;q}AF^xfcN~wzw13H8`ae+UjRBFp#tT zsNDhg>zNBIH}86sWg}0sbLCW@@2ZPD3pH`;eg@>YU)|NXZ>;*eWh{gs2qYo#q*k&r z)_31tc6#Ee2`DGnr?FMt@6-hkPoccLDM$MMdD!XANO*YekSpw+7t**)SU3gJHaAGo zFKVX21Xv%Pmc}2a7bCy&k|2~P#zuYk5+C;^Hg2gUw!zRqJHP1V zPrKBRmxVvLmEm!NS3_ag3yBaDA<#SkXf$@w=6=TH4}#zY+mvr7O52Ecr4WDCR~8K8 z$7r{)?i&1N*eT^9K<#m6;Q7kk%@s%9yWnRvPO48x>jA9c>lX@SUa9+-T6=4;kD`;p zy>HCt{&SgXX~AWi$HZsv83)e@MZTRF}qm`U-xvF7EA>3vJ=n|$$k65W$s<`86~4K z@(C)dw3XWqnmXk^G5XIkq!}iu7 z@2##M5~svDP(i&Nyu>UO3L2&vDdZd9_1(Q**X%Ek%*l&GM9;9iJ7J7nL|LVvg?cxg zola#qR^fIrocq+ehTXec{K*9U^d4N$j!y+{HZB~G>s!^1wI}C1{l=qtM{n2}%dhTr zPn;GOIAVA%#+>qa7uU_R30mUxtVmJ9d@X%z)Lj-}I=-x1Y$L*Q*V_I=M8>S)lm-IG zl*CSCm1|JtxFl9+R#Se`I>g50tiPNRbBdSiUq9Ik_I#yKmS=3&tj}RiHU4kS)8Tso(KhKQdmu4iEoY zd%j^Ba`tD(mYi~1JCgJ9n3-cqq4&}4xDDZY3%T}EjY)^O`-Cl5vUr~7W%_?6jM3Jr#h`>be0X_1%vI0!3siERr{ zB{LZV%j(M26S@4m@A*b7<;;4@>k+-dd;dG;pwe;ayn_f3lh;PrUhgUnw_C?fS*9eV z!F4$Mk~Ev0@8)bueQ3J3r4!s_kiXtR&#*mSX^bPv?pLXhq6$9BZK;Xc=f134>VE5c z#uStK#6lUjS`?1DU_tWnx0drDYUZk77wjla@LzLBkZ}_qczCKNiDsrm#he=(a5cFd zR$VLLzutUsJGHKp`0I1VZ_vl%(#QLhe~84#RyRXp#HHZJ#pz|^Z^XQ(a}AAwD|z#& z6`ry%Bm6)JY9gXg67Y9wHCS~Nx96ec-@L`~e4EBcr|U;^u9`IoQ>6ZT=w;T#327cl zvnv1Fzbtlb;DODgihXBec%<*s+NMr6!6ZtHt@r7a&PP2HxJN*(T+Qub?dD+HIcj0^ z`5e5z9kj&@-f;goJ4#F35xdU$#zC>RG&8rj+Rro&{AA|fBSPN15@c6~8Q6F3@`S%Aa$)=e$W9t^S3` z`@&yeu*Kiq(r`$wv{F9+&-~nbEv~3Bo3n<2Q`hz@AaEBUOHSW?jZwntF^|{T?0Jk= zg>t|KPYM8g#+jWFJ*pu8qOn@NQ2I06!Arc2_n3zX&hVK3+{k&3QAN(jraX z<7f>nH`}O5UN}O(#E?{KdF_(SFBM%p`_~v3*hZiCc8qCY*fG`l{6_k4!R4$Xt6U(p zZ^I4VIAFXVJ2BUPb3vdD+?L7C?^);nhgGF>!t*16oiPm{1`P$VbSNpi&sa-oyBJN+ zgGZG;^WM*{%@gqXD#&l>`7ei_f;LK$ek9r6^77)u5l7qtiYvdYpc<5+or{ax-+b=7 z%T)VaqUwE-^zs`ldavk2zTe}pt-Z?0a&4^~g;W$y#{7+;~&A!4_A?4rl{&+!Dyl|c}KAZ&#LOmA|`)!?>6;Ud|Z}hqD(Ss0N z7j(cc(=nmT8FbeJIfM7P%cNkDbHVPHjyY=i1MEHZGR$D&@aAsEC>qa~?=7iT3)9{& z3O%6a%Pu{9t@!;-hsPa4coBFH^)waj0zT($A!n7%up<)!0AA^~6E${$LNr^)3r_+D zloT|4V6-gUt)L;w4e&>!AR*oQTm>=~zCPPrN>--3eHujaWZU?sg?=0~uc zn!aMdCJ7^_>t9cQ_q#cf>G_yY=(!(gC!gnayK54>Xj_Mb-@sMa3VlZLXq@fbiH_gY zN}D3ue2de4F2kAp65E1qBaC z5y33rASd&H`s)HG>1W0T5p}`?9!6QhH;L~8sr&}P2Jai+FPRV?m#6If9yMQo-x|v| zeE{OHiwS-lj8*(gER|^jsp9~0^nB&|4=L#poz-|kd!5+ED<*~t*Dh*QC1@?P;-qC1 zQYxMTS$O}c&Onn1lc}L6vId>mosdGS2Rzi2K3Np$7M>juiEcUG#k$2G0?UpUlocsc zt2LWS+4D**%awFe(xeow!1C09gkB_!+#y{pRU+I1^|67wz5P`x`yRu=EV_o2QcLY5 zJ>@)BbUeEYd|emGvH98Ag;RClG&^IWRTL}Rpg{NL31Djl5UJ>)3c08zj$+#DYne$g zi;&>~x#e-~l*31hSv`-(q6*h#+n858kMByxSL?A)Wmx49Lq!UhHBzeS=oY_o+#$aP z6S?FHPGg(VbeyYH&SD{k^3c&e9;AwCH>K=*MitT|2?2_gt@It&UQF??rL#(7X(Mrh zM>hmndNGS7>E?c8kwPZb^B9uA2hx?vQGJDaZ@NF8AB;L(~oE*Vo_c>UK9 zmAQG_PRC!?&Z%A(5gIzGP*M~Pi*X^We9uU^Vmjn_AA?0KA;L6xjM?@*OeY$XVjfXU z-P2WHHly;{Y4d2o2@~<^UT2ekFG*A_RnX}yR3egNpCC%Y- zLiZjw{+Kq6ng`4H=EBDc$TBY7f4_fZ6A0M8Fe_I_H;*{8y=(}|$3L+rmSqEqN>m0! zjnQg0Im*#7mRM$e8~dl~SQw~82*BV9Lbd3NC8*Y>OUA9D`8M%QceyRKcz`ZdoC4Dp#3+sJpE89Q zypfm6oYV-LqvtbrWjZxI7J;wL{!MnFZ>MqJg`R_`iL94A!PVsAq8}6BN?$|8JD7oz zihcvlhRe@qnSyS^MI%&%kPdbsdl8#_e`LQoQE^0a28-KV8!m{9*2@hS9!N7=#5fqr zEgh;$Re&2)DiI_kvtNf@sgY(XK8Ees_ROtSa*d%fxSGn%!V^l~;pExOo<>a23~aq%rul?IC^x!md8DO&vpGebYD z%klA`wZ7o zvfce>4o7smYWOHXSjh5Ai6N|ZG)({KCE0o=A?m5X6v=)W4K)oD$}#M)oX*0tdW*Vp zmx-u8k1i2I+UhZu%(iaDnyxsIg@PcgoYkIH7FNOWG_qzG(#tyhH8ffAqQuA@IskAi z<+QTgyJd|#MOtmIpO^Vd&7f;P1{M%_Y`y;YH*s#l&i3JEp)K;^<(2~lH@=4+ebY&z zK#R9U5EIeu;(5aR^4!-JcwRaMx^L@8oY3ENZ^w zK%MH8FGih5c8J_sYT76*p67p@zP9#~OZMPmu!k81?{~2Z3)PE7$P`<1p8dzUd-?C; zZT<3F{j5I63hy>t*V;Y_i@9m0Dl4>PoA|yZ=sF!2m0blknn;~DS!x!7ES|ciD}lI} z^7h)Q+~nc2J3k`$({&S^<`x8UwFxVr>*cL+{!9V|FOg9mpA?(XjH z4ud^&UH5bUfmh~Zub#EKtGcVJ&f5FfYztV*O+2*ZIxQZy-K0n!Tsd}oJ#>sIy=hMe zNX;rRfLaV5q<~!MG)W<^>$}c#zV$67toz@}3Ea@yybbEN@_#paEYR2-*7ExNH9?^5 z62H@TK1Wy)@(auN$yv3<_#ARc@BRc&2}$o;S1K%(FWZ!}%d~zG8TbSQIiH#CJmOZ0 z@r`P#dhD5WKHGhPDo0oFT$g+m>=bms3SWbc2J)5Iv5{C9;v+ZQae`~;(V`o0y`Vof|TlX}}&gf(5p9#5CYoilwULl@RYdzE5-UN3wQ9@6{eT zS59gVZ;zd-jW(^&B*W5&b-R)FFCKC%m`JJdyI-4uhngV-{q@ zV4n-;RCT+d8gJ%S9ni{1-HkulQqy37b92|Yzy%)0-@5d)EFPDAwgYG|T_sdU8jK!} zq41bTmX2+bh@I%58bK+pl*G#2D!^MWcHi}K9P&hMktDw9IEp11tWhAxx z_&tm#6uFCx^JTmYYABEa(cLmT4~vFB?-v?oz=tYJumZ>;_^Vi#RN0*C7ytpn*2b>v zTj(L8hxipRPEjjV2=)(wJ#m|MB1X>s3CGEj$cH~%=(=?hNDX6@ka)B_yi$eP(uF7CNDz3q* zF9ki~#b(s1wl0>Iy#!c-mZ!KN7;%cV1NRQd@O;sqRg3fYZtNS?EGaj*3BUI`zZ&z`tjK@hSUAIi=yf zUbV!@PXOhQG10j}Q&+4YCm8_wuqhWHHH698ZZ zR^+O~BI5wWDSqc-rm*4k4JKpb39E3~n1HOkAdF}Feg}PQVeXpQ#JA!SOX3L!neYg} zaEd?RD2s|V|3h($gKDlfoN}hLc5f#mk?8Iu6~Xr|vySw@K%PviNn_Ky|JOUhyY+xuA1?*o`01^?i z47~h?xiK*<%a5Z$-PAoR3?@SZV~Dg^A12`Md>Z}8L_?>q-}6xHKnh?e9=k-jQ0bDN zgL@ZURr>9d4kbr_$ZgW-%|R${@Y#51z)!jf9T~1{D=5d4anD;fWH%B&EBoi5=gN~w zE1jZiEKT0_ECnqVJOX^6XKwV=(+#QKQJHlaU-eU82OE{_y!z-Mr{5wTawx1$@ThUi zR&TM{a_(+iNDx3e$$oVL-fIQ~C!^!;7Eg)Q%o6qz7*0bLfr3z9w`BiKdI6H{X@J>F zTUL}o4&ad0^NIa(^+TNO2RSJ-5`ZiAHbFOXWF}Va&LcWDXmn0lUkb;MoMWmN{<#fC z;7iu`wztrL++FJgVpMnpVd*5GtM4E+(lO*B6hJGjA?g2bk|m^9n!8&TYGLM|pv=Wd z3i^->2srQr{_91ilparEqrN{Em?8wSTi5dsD#66&(R})y@F{Gdl;xMb?{+u^+#yH$GaX1m&vOKO{Kd$q~mVYgOY*bP4+weg8WW89FXaaQ3oRTuMiwXw_!J4)Z ziq8=oDcW8Us7tTWu3NzUq=5O8mR>0Yc+{VmLI&CnRpyZ1?*60zpZis&LY$5kAua#` z5O^Q~LvyWg!PIdg3IruenxKktLo#%U&ecnxEWZ6B5%BC1bbE(K>LEEHo{qMUq%SnI zm5K9SN;E{?0x_r7!_-krNnCduD~4<0j~pf-=odbnNyUYIdH7<2_Hj<12UJ1>Vizm=%vjwH zMPyzn4RY{LD~|iq&_^c2zV!MMion2!T4OkP-C4dz4`lyvK8vP-WqP~oY~YGppREoB z23V@r3@}vUw&8BXpOdMR&{8h3~_;S00Sa-c*+8@)$Z&OB`0tI>Q)G2_0ATA;lFc2A5I>n5JK)TnB`A#GcVEjmV8WXXX zm%$VY1j#20?;-E)K~Vv@we@lMCuc=6c+@4kz!2$_uUhfpUqo|pkg@njhH1z^xb)OC z1YUM6RIp7MohxG*m*ih3p1)w?1ZnVC@S+@QZ~1?t$@+o_&xb}J92J`v+Q{^4co$IoLwV}-;K^RmcG@)z0zv) zQdY?Oy2Q{}= z11;@6Ax2%R+%$(qy_&?1pcOOeODeuN#k3F3CT z3fnF3zD*JxSV|Y;bI&@od_Epxk7Sfch0CnIH4&PDZq~{X5i#1*4(i8dInq?JI}A<^j}D=0iA@Ao zMpPCYD#)59q?NJn!A>jFBpyzfX7f%D4~q8y<+1ama`g-w+g_a>TAoZE-fc)FVUn>7 zEK@RhxR|s)9JjnM3bdPaY}%zG)FWc&E7dpNd4>LohHsTgO9vN{p)sabD#7EJnqse zEdc-Il<4~)*hjFIHxUtl$?wNBhz$e<0YA1O0lw>B4*I{|`WQx-OH=qDoDD%hyKxre3}t(DdE&o9^$agx~93M(K~a+22C|AS|oD zy%N1|%TcLS2FI8}lR_-t1QlL)YJ=B91z4k|4@(tDnpRf`X{9G-ORWI)Jmce60(W>B z>lbNazOQikLHHIN-~J6(AlAx7hx8=g!3*s-O>@yuM7(HGUjb& zrqD2m4`P_q>&3=81u`g)h8#Hpx&mR=dz<@!S4^nKXZZLuWB3Yj@qh7=a=mSn^1GCl z2<4q!SXn!{yyXph&h*{-4s>=}xbT0xs}j8G#WwWXjxv0NJowi>W2LEGUBbD@UH|Lq zd^_#*e>!>4`L+7fM##rO0>|eJEfo8q9}FZ1LU}-DV;fEOXWh5|md==8A-eAudvsC- z-(UUx?Db3598(1{&;l?;k-jdAl;7;9LZtYteL}bQ)eFEZUT@^=tlD51qiwY0(XmnRWY``{DP!G&VRcf67A1 zo)4y#%A^}E4N6tVO!-Mtq~{d-=U|ePz5K97v=NCJ-}cH58)D~L`DA;TTRNxsLF-{ z7qw6MM~_w_GG$fKvsnrVT5t=mIW?sEQAJU9W!>T~#=u5StOTq=A{ z-TAaJ$?0h6lO?mL<8sm&_8E)sGn*s=F|boG03 zVtIXasw+GB!5*r;)fNY!ei^e4C#e$Kg#jRr=LmY=h9quEe8=Z4{2|isDK-|kqs{~X z;GlD4^RDe*NwdrQZW=sp5+fp!BVQ4TQ12!eFO|&bt_$p>wZ(i9T+{OMTu82-=3nE|k>KN5ab3)5z4_2j1-O-|#l(+!uGhO{?RxUQ zaq#Kmew-!d;nD_&5u%?8txWD4Rk?91kobKHn3Nho`D8KItojP|R=GL8NA$C`&(=31 z*fY_R-e2&|=r3fU31d3XoT|qOn3Nr!+y#cm)6(*J6pj6XmDYYaRE@w5&c|ZDoQ5@X z)f1iSPP_WJSxZmyw9hT*h}>x^`+|>qhMMBWGtS#zv!9hLT|QSnhjytfY^89cOAy?q?VWtY zzG#_ZmEIKn9U#rX{$VP@_IQw2O!lZ`mCPw2$oo~lS zQJfkToHqKOVwCqVBB0Ed16Tv0FKL#;zfnKSg2!gtSDIb(MM}s6C&f=J74Q!aG|hnW z{B&k?2CT*VcLEN64>lHdQ-~>|lHYKCcYpFTw)!2gfVW?j6>h6H9*JwC=g@JNLF(7~ zEw%s&6VCW{TbOBN3$w`mG5L7F%;V*E zLF(_kMO;DmHQO!xiq0?|PvTPmtiHW{S1iPY`Q-A^jy*}7lLQbQh&;y!}7buBG2?y{^3N>%#8$cngB~bqc2p?w3$eOyH zuRO@HUn8h6Pc99|XC3Z_$%f@6vgNsbei(26f?z$(HhzS4uwF}XGq0fzbpEaMkNFyV zY`pxd|5-mr;Mj+T*UgoKZ|q=k;ZDPpR@F3KC1ggJ*ecMeGLmgs@f2xh~EJl z6H<>h+KRiPg8pQ^$j~=gZ}0+5oEsTNT6B^05_{`Gh)(VYJIf!Z~53d5AF+aw(e(Hr^p^Xs6de>XZH3bU#NI)J!WV!{SeFp7g>h}= z@DNx*a3@5X3X7skiOlh&jlcu{xcMNv^+;-GXNNE*H2WGs(c`0roxJ=QJrgZ06C>l0 zLIjsQDur4fu)zE?E-qebQc6k+j%gv)F#!NTH=G%tqM4aY=+LB-ie1jh#46Cq%{Eop z$>}KfTTyO|j+T*@mXVQ>b_gWTF$4&Rj+7lAWR{7l?fZq+Fq*mA))tfp22cO@S9483 z^`y;7i2|TAv6j?u0)d>ItUv}jZ6IHH^$7i^4tv+y!2%UFDSC^1Qsf?dj?5 zw#-wlHR@URX#RHN5hhGZ;duC5%-`EFJTkh0qQrNf-hLg3CXIsQRl$}N$XEeJrqBgW zK1_xwDpSEL496F z_m))1KzSN10pi4V&#lv2OI$PnQlLSON{6dKpgI~5P*JVL!5@wG(9AlqBMDTpRq_VW;;EXJc%H`Jn3j}I4V z((y@8Nih=X=xmPqomH*971{)N)`20=P&eXpB_IXTa`~L0Rx86$UY;;2LMsHZXX`H+ zIHlRGH{{4c%XzLd)y$5#xX=L zgVn~*NhVVi712^(#azL_IC>cqJO4mZFQ3FCpmukhCZn2v<4+v(P~D*=mR5yw9H!8> zQ{^(oAulf{9XGj_n0;82@r2you%2Q3m1rMMoOE0q5gHQ}l{;wKhes+k!;tpM==1#N z-sMCrtQ|HJ4%N&Xh8`@LU@DvS?!F^dpge#!f+8bLgVV#l#H_~g(ufov`?~g{iX2_8 zS&L;>_ud`CY9>LQdPmm6jrbSQ##Yz3?Z%cD?>L#Vfc1S!G<~Hwpbvy|F0O?k)iRZ9M50E zSWV#tpz$$TMK=24rY*DZ?+1Ndi0jvB6RU}N9m^P$Gm9#T(FJ8?zU)L>@Co5rjcsii$~m$`?NJ`qp>IjMH1t))#GiluHB-+y~spg zvNXUs*6KsZ09K-}YLY$*Ry7H~0m9qCpXQSilG2RgjA?4eN(rvHS1IjdK}_^a6?#cTtQKE0fE!8^0h*ieI#x{So$S;GJlN{2lSVE+S?c z?tN`O*L9DDEALV9y;4E8wtnu;qS5K_xdCQqIyOU@ks+2Ehydx$?j(k-oWxs>o{o-_wwxn-&gn(eqPtnEtKm>G!x}M=y!)zq^C(!#y0!mCvta3J z4x#7mZfk}JN}71iNeD?Om9Mg|;-8l8pJ;nvd*@_J>)&}{IW;6j{}0h&@f}sS53NIUNp@2Hz-|4Xk}L%R&-_#ckNV%^sN(kV{v!V8 zmjD0iqyLxv4oO@GoEnA?wnA0#4j&~7Q=rh?*__+`7wjiu&0{`qB>kz=Xv3udJ+8V+`-V z@JI+PEA2_iO=e`KO@!vnp1o~!h+&3xH1LZbxl^O`6_H}x7BpMktUyB`$)&I#_{dNz z=v@EE8At+IhmL!CZGILS@5`uAO@Acp;AWQ-7s*&DJ^!Z4N!%JtM$W&g=T)7!P&6?* z_HEtUXnQ~>-8v&I?ewMjs2Yelqx+&Y@$<7qFQ#U;QDN}!hEjogU%BD!r6-M<0sWk{ zwDWmP+9sb5#7wCk z&(7Q5;qUByy+`;F9(P<1aiN}p6v$-Kkw&KM$Uv55tyXR3V(NE;Xis9|*Gi>$G2obr zb0QTJuOwUbm!JQ>PfY$9=)r~;`4f|3StcRX+1WQ9*hP*(qsE)ap;1Nl6^{mC;6rOG zF^n>-csv=~64=;e_H=DgJep#hzSR(Nrn}bv?Egso9F*D0FCo*V9L9%fB#-=cFHD_2 zpLoDGw-&oqBmZ{l*7QR}k{B=l^}~I}!F9E!q0j__C&Q}=dO{`S>>}$t zk$LDJ`86D9)8j5WvQC4vEK#vlVW-Xafb+eG_TcIR11Y)q^`zh9+(O$_*~NtXq)PVq zvVi}S??QJmc>7GoyZn4j^WK&A^BW*+@I4rl)KcJbWyAK|Wa0HzD5uS$Xsdta2hO?B z!+DN>O+DjN#DzvdUwkiP1%R}?>V9qPKo4QWnXTNKX(6)AJYq6LgY{Pr{8#m8xJQsOJa_0a zj0~rA`RcvB`s8-+e$?zi=%w(Y^6%x_axin7UxCGHnJEDo;7W874^TmO5?CcvYyVqb z9tI%&*0H?i?|1KjXO$4omgkVkr1v=3`8rVikpags`&f)w@O>WP0KWtnlwW$gXVZE4 zE~r2JH{>5e4`uyDNA+Ho-9c|}_a27eYm7Pp4hlf}(qO&S>?Y%47KILxJV>H?gv94s z)uvY79d~CdF*`EcXiAe^QGxKxDw>n}`S(2_ypB zu|+rF)rJfS7C)`{Tt&>+OpcAcx*N zBwnH1@4gTuXQR`rDzhgJ}&XO2gUvbD96* zycP5E<o@;VtVbqK{y^4o>zj>CYjX_`w%CG`nkdk`vx^_!F zGKi?4_NcJC*%;pUUeKl+SwT3FZxZqDqlam9t&JL%9u*DP@}Pr|RV0PruwPMN9>M-G zNHQKc_E!@_Kx7)VXR`73)Ax5gXwZ3R{pSN-=4YvNZ$t~-@`YE<*@eYJf}0~d1XK`Z zNYP3L8crVzyI2B1IKF^l_|m`JW&1pe{>Pt#>xkexV%K4TFI;}+A|k2P2Xbfo4e42U z>8WOH6jC<{1<`3`oa=mi_QRdUyE-=Re$`ZLSJx#o9fAf-7DxcFafMZFxm6Zp}iH%w<) z*YiA|h23Qb5_88n>9K_1uvi0h%zu9vy<|z68rccI7wm6#K+wIqhB*q6p{Nx1(~S;` zMX->^RuB%F^!gi{?mF+35Q!+zib<=(e(3b^;i2^A#fMMP;PCcuNUxTQjOJ?X{u62TRZR~aX&}U+PQQoW zVh78wIOL_qCgzop)m3pS1V8|0SE(iKq}TOaW1064`)tmXN}cvPe&1t3U#3Op?TU(G zAF&|untpkB^j^9yUdRg+H0R`PB6)0cDlnnX-nZ;$6Klo%!+DoM45)yR5`iCP$Fak_ZR z@($O~wJWljpe2H^vC2s54l^yOIgcd)|BKC^rMZ7NOiH}g)@3#=FRsSkPeI8xwd)Qb zS3_QC>AWk{N!fh9Z!cw7Ttj4IS|%j-;kF_8!#dyGDY9#;-}MICkc2F$p&Dl2G$sje zr^Us6Itc+ZLZrU>$6o5^1A0N7Inowq+mXN-MulvI>1v%V!9_1oVw+xPDQ zh*Q~}rc0#~5rkbUF6IZ>h<5wOUM}D|hRcrZndFrW$*6N}0kIt+kH4W4k*r96te(3x zM8CVHgXawOQVKgcYea4viGMgr#rW`xexh;f4>gmGWL&8HB|7o@;XbSCVuyCqZD_BL z?ZBGPfXC~_R*{so#qKe!@*2!DLc-JtE8OIEu=3$JBg_k{#1`S^qS-@ZyIy0sy2a!J zI!W`cNTimDo;M67>$UDkf4w?-1F6v8=9(-#4nj9bjdAS4p!BM6^qM$0fNYPJ3W1XH z?Ve5D_vgvk!ZH_8s$#=U8;`$6n`leN5ih@^-^1Hky#PBoZC(uYGup%g@~U4)jms2x zOcis3Q7}%6#@!1H*8u&8DL`~y%I8_9Xu#qiSt2p-3$gUgpmra6HRDW&2Ozm?kl5bM zII(FS5WpLr^yL?~rCoK|58Ls%$Mqe30d_j z;X)5eIKeg-d~8nJEP2tEol|CVKA}_k^E5eiMxB0?X%=;nlPFrfz@(TYSY+APpI7#- zc9=w1p;F1h0<$4)a}Xb@gqLC}QD#c$^}|`D@>K8H(?!?cbiBO#nS?%M3nK69<`9k~ z&t3`V$*jKca4S{LS$VQLejgxS#zAN^o*9iF+Wu_+>t{f188n`ude_gTA#e3XLrhcN z?P0o&p8ych8>heCcsB;E#F$qT^AH7Zecwr|6_dM7C81NCU7H@EismBSsP!3WzGqeb zz1uUMvd$Im37J|Ir9CZQd$?DsO-g$Z7epCvvAZDQCamZ7LKHSFXgwcX;ZxvxH2WAx zHjsYbgiGGng4Sn_8_u$-_VmzcS8*?i-!B&jdEvKWE>pVWJYT6(zaj9|=`sy>eK6p! zIf@@kN!FmjXj8|OU^KjD+fD4 z;*)2DBpm$`p1V$*^JmKqRYePUU!&_bv0C^b?dE;Oc)J6&-zp!rJI?q*op+)6$a0~# zZ&9rtv#L=^Q6I5sBYWubjA8n;|sP{{xi=5^dA$Jl|e6L zupEd7m2TswXwPAc%dw3h)3QveJ*{tS@J-1Nlt>dO;gw49Ws1uUCym+s?wT5*M%To6 zP9h@5KvVOGj{447MaQmW{HN7#U<9ggcUH;2ZR?rhnqOa363DCdweoUDb=m2cYU()l z&4^|FvaK3PEmq*rwEtLiqvLC(lafMMDtLeX+nU_NEUlYo`|`tw6-D<)n)$y@8a3(g z>nlE1@47zpt^IpMgHM5#f#0>leRez8gC6vGp50aRC2is|QbWC&^%tKYFovLEiceSi z)EiGeF)A5nDp79#s|C=F7vs%T0E_8!w39I2{DWv~R}&KcBw|!=g)%6{KTRQrBj35A zPf1T!=_VJLh{#pbo=k1ID)(*z89Au^x- zxY(?&%mq$GPYBGOkeXEFbaIg+3KKe1tX|)z+?+AVZ2cGw#>4GhcH5?&S)<}Q0RmHwJ!-I^ ziF+GF1`a$au72h*d$#y~epGw*X&Ke1q^x5jr@+_Ms6(F~`{mUl)?uyXEF`MBOqxJ8 zQ;2VQPIg5_8WupYm3`A{$d~WKPFXgKHRp5xuhO?&V(CQotC;DZ=iSO+bZu?OF@G>V zbQpMBcnG;3#ji(3d#LBA*Ka;`+{ifVRGT@u^a}ehQGee8zr!`3OmJ~HW#^$Ej*4Qi z@E3(56J%#h0EoBByQ`-Ajjh*V#H5_|OZ}TB{^dL=WG9fEG(YqG$?$EUMKmL{xv&Mp zX?qUKg|f@3@P2iRS5Z{qeEJ#(;=abBlH1;Vr4qK1nPTvZz~WSZO*k)HyR68HFhJ!b zTJnp(1mVr2xH2pmO!p@dQS1{+WB}$e@AB*K?CjD>o3%Shv@=o?v`Ot8$X#L_-T|R~ z>oQ*wJLl?*>sB6jpFVYmN6_@5UT* z{s_$B%SFUx3hIwA==i=vaJ3`9?`*xU#Bvb6pYaLl{~7??p8LIpJ;$E1?;mVrP@|!f z`0n&28bjbVATJP9`n8ogj#(}m%0M!+k3XZE8>*1O#-<+$GV#Z1~RN zgx(zxQ02k!+?h1?Ta+7q=H|*tnP z0!?~8Z;<+pGrn4G@&Qu}!`0Sz(bl?qYJZ69XC%F`gq=a8?Yj@Lx#TW$c<*B9a8gx^ z<^pf+>do-rOlpJoor}gA6ruNB%9GkUvKDU)C~q^>aFHnEcD8>OKGfXQ`KPG6K0zUV zvz{a?4vg?*v|Qew?DYO=s*U&QSMBtzolc*vWHujn&I(`S%CtQQy`jI052+4hccMcj z0k%tNt-wyRHNIh~Mw`&yp+?DEAG)URZg@uG0;VVtk#t<(=&4nJ)4TYe(?5B&BpczYek zGug?09-ZbU*t@2w(eSmtTU8$lShZMxJ(_69DP@#a;2fZoT6;TlxH$UjzjsueidQCm z$bVV9alUjB4$8SUXFjB)ve}wZtYD_%=zZ+deA~!jBI5J3vfuh4ATeT@e$SEVi1T{f zH8KAD*`*LtkLO?Ke{qH2vXfuWyWMYBq?M-9^>_BUFVR%HFtZQ@^_HtEzkGj)Z>GM_ z=zOv!MCO2s-YhOM1zalIXn0cZJmyGOuNA~z4muvPa0$FITixG|s-ExdcvT;R=d@)> zUmBN5+m&@aoD7=L^h+ym*iJehe-;vWYc~%55!F9G6d0(;r zxqfY#W`8V^QHcMsEe}Q9N2$W)#1^lbQ@DlY8Y>O zS&!<9s{hr*oZ;C(qTi6H%KL6)-q*voAryXUO{doFMo{W0v{>k_gdOdXIos3e1_kQa z?cDtGaM;{s!tAilL1*|p%iN)q4e&FZo6mWL?EcEmFFFkUEGqA_?tNey>@-#@^usa* z1P)5p&3+5+loFfd7B}V+K?>|0aWNlNN3nR&vp>|coA?f$a+a2z7@L^XU}N_$XCx3J zf#HFOr4P32E2HIJr-~Tk5r|GNvz3PYooC-e*Nw9*jw;q}#`!+<3>m%;&5UgC0nU7~ zef>0RXF8&xo3D0zGC!lqL4Y7*Gv~q}U;kMYk!t5Ox&Cp0xEUQ+?R=Y(wTLDClcU(I*bT&Evk-z*kha|)2)#gum}f{Rf_3r3?7q-x<%z3oBZD;9o{PyZx1+M? ziot@d_`s}x&f+|!k=B7ws)%A~EMeGOwe&+8Y*+6g@J*wRgs7$D|U|z84;eW@Ugdn{B#)7$FKY=NBLh(hG@@AJy`n=$2~+=h4s= zyDD@@9JH>^vZ2GL+eQIt2!F(=r|O}PWj0eKa)^m)7^#GxS2++jRSRPw$}(UFj*s{% zY(6^Lob1&l!4v$oBMt`aP-f+~pXWt0#DEce$G0VJEX<(_x?Qz&#w^!sUl`~{L>~Az z2OS42Ae~X0zw@7cYjbcG8K^nB&@wWGmNt?CE-?L=@~ojv0)^fg6-PqZR!-%q2G`~G ztX*ErgntrM1gv`6IFv&M%F}N4J&%;A{T7YW*T0uMF%*SyA9okQFYGcl_P3R{eZ7LhPJnJ_q2~}Vq1*3YH^w&=H_bwq?m+U;l7<4~0GEW7M;g>4Q3dxp3g(g5a^|LNCw~InW z9w4k{8xsAECu*yg4f*BGrT7+r$s@?g z=sUigoQB$`qBb=8^QinQJ2xSsBij7JT!ZOoS|VNr3?O%Vy4IGkXK$HaK=|*{4QDyX zDW+lJTwroma2dDphkJs7B&>7@@MDAv$^p}_98qPQK1-LBQN~yjch0-mpGHk5qOvF7 z-|~K@StA03v(q!mK0Nj9+hbff&Fgb_nN{j_wor`8DJL=UbvWL?*nY?T7HLEqS!5=I zD*+a_T-7#I9Wuj7+8v;U0VE;M6WM)MURXc8L&&g>)rWnKrji{=q>aq0YgzqCk4M#q z|EI+L_Ofp#d9A>0ez>p}+E~W;@<+?{d!UGAmIq}-R+IMuGWa}TL2`_vw13r>x079*UF^07O<&z!t@!$A<)BUyg9;jC4H5w#=>B{fXQWE88SehL>@<*3 zi>LEnUf!RAJng6Il1U-g74I{2r^b45EL1bK6H9ROXP9Or((6_j5Eeki>h9wt9AL5H zq@*MEzEguE)3&LtfNU=JHTFaB|iSBBjO-|eU z%@-MLvo61%Iv;wuMUevF|Q4`#$M&?ihqJ3cShG70Lb7wKFgBP75*)6tB3S0 zyiHSZO}z96-O4cvFAAKyHn?+nw7slB77#)JG(#&IT*i^0i=%tVWt)~f23hb~k&TVf zt_)I`;3gC-;Yh?B2?ja_!DEk^CW-dBlX_a*e0k#E}6syB*F(3`XXaHmF!t{*@AD zvLNGSzGr=V+FWag63*iFM4S%cPwn|cEZIty?2L{7{(MI!GnH{Zgl5LR97&f2?NgF8 z8Y(L&VF{~=nx~(hUiiK56k9LwL)zyg>THiAe7Ftb#X-AX03>gp58is|AzoLXZ|av7 z@pR+CNK#n>>zAYW$8d^NARO&T1v&bK;v4esI;Mg-h=NPxPWN7)i zM(Zp|Nvk4$+vFC(p$g0y)H2=>E>4^rRg|mKJK6kwhj4Tx=axIb!xUgO%$Aa8iF5t% za1ZTi1oxeKK8xU?&pDQDo6bMsKCukXIXm=Jk5#oh^-IY>C3ud@$SLIHoA~D#v86II z*Jg=7Q*SGXLj|3)EC}4w-TGO)()MYdkduQj))M#9=!4;Y#siRP#6Bt8Ln^V%8 zFAHAvR|*!}lT|@<s5dEC5=UGG*EvJ==C5gtjuz+Thyk)T)|R z@QYefh<95mD*kPJKK!h?0TYxOAl$Y~czQJE97ZWt8Q6tc1vQbh>cAwFT8bqZ5M=sQ ziyN;$4+`YG3sxFkGu!{H+*tDOxB#4!$1#R1`u zQUbv{1;7QG=qp_wL?e;*Tkxb^hM^xIR-K=d_HGIx!F1V z@l)nC1A{Q|^|b~aJdMS*GGJvo#2_lb4ifdS<;l%99_jgDn~t7q%_ zmVkOG$nZfI9}G-fex9AD+DNPFB(a%wi6m-wqpPssj<~=e^_svP~f>B zrAx6Ra5Tt9@yot>eI%_iAJ0q^aM|Z7uDF{^Ma<{<7(nPyRc?z!w>q|7p+GFx5m~Y{ zg0>-z;}vlk_ByTpKq8vIMV1#%lel!wE@wxYn%=pdlz?9b15m+E{YAvA*{N01`o1OJ zs2~E1#7~OpRX_gu%<-5SLsaG5RQ-qF|6%Pd&oZBgQ(kLLB%V7N1P}T zguuo0nT3eK`R!Rkx!|eo2j% zAy|l?B$=EbyVtm$o)#KF&p^*DQjnUg*LULrPY;(N4t_4z{(M{~nnrhc(>^m(;Js;c z)~s8uaToig0t;7%J1(&H3G3owDWEM^!)Hx_eEVdVj}i=MeOPEToPKglbFHn|&+QH< zp`{Es3z3~YJ3hG+LKQb3R5J163~6 z>&W{P0Th@tcx;tWN$GTtI}RJPjEZd z2~vRPS|l$vb}*Q9JkhM2=ABX%6oP!9s%j;8UuSew5~rHY8KUVJVguLMw&xGo;9QUj zP5vTJse8z0_Op=QCWKGw?WO2g%u21H{;=ZnB&r?{HpU~}O;117A@;G>IaOP|Z~ihZ zLkoMO)@zIyJmpLmtgd|HI!Yicu}d20yQdBk#so-vH6P!aJxCC+UsmtCUJO$|Jal0( z`(JX>vCaF0qYHzv*-zrYfBb`~dDIa#7zlb2*y{RA)-S6{H9iaM{!vz!<;Pmr_qqI| zT+5^SYvof4x*dw@Lz`ln_3}jGE}Xfta8R@JV)gnUZ&KIQ?xF)d2LOxucG;8d%S|o= zWPNq&e^q4E(`deL6(r=7!)dE|IHg;vF9HZDdrQz>3yoEGARtHy6BgrV=fjsyHTPSDWnGSkAyANx682KZV(BMmMW_Q7^|V4rBad)d$)i<* zg#!62me5td-9%^>?Jc2s!{kZ96_UfTahx=mLI;v)I3f3hwbQwuZ>Uv|KVLx~ewD^=rF)lP7AG=@-uC##e!cbcP8QwT>Gan zk8ULsnpigT+`fK+Fns#-|mn=jiphkgJq|rn&W#v zG+fv}7@wSFr}(d^TCcsYID^&(jE;Dn7)c{9VDQ!I5x)$s@L&Y()U*9TdAaKzt!bvt zZM=iO{ngw$9JZ{zDZhtA|N1bg+wTo+Qt@g1;y<51sUmGQ81Fg)7W3bY65-f#?9&Pk znz$=D*CL4sNgTGPE34Y>OT=2Qy%&IZ2oA$`EVTK=0PzM&1-rj|1Sb?}8hVLhiD-y< z^PV@T=gQ-k6V<=RHbWhyiYz4?Qbe}`1=+NKhp4ymeFYwJu!;+Q0>j4wP?BZcr?S>U zCd}MUqux{o6d*5gBZoCAtwbLiF**iT1WPn%>PGQ1N|W17q@l-;LaOI$C^DfsF@jV3 zs*%O%Zvi}fq*5Xv4#^t03eMKXmHhqv??fT^6R_D6=W;{e#A4?b<`9DBDowe@fn)2c zd%kFO2VD(IAaKZ1@jjg<5>oPT28~@q1D~>+&Ng#jhb@{ue6AQ>;SD>{_rnLUGd1gb zr@pDotZ{N*M?~e9H~FvF$Ia3O&K;Rxmq!MW^K0RbBtGpoz11r1!*rX5qW1?5^Nor*IbP~yRf1j)|?>?!^=(Me@LOo;kRlWCC zKgvw0NKHFwomEv$Z~6<%bqC((^NX{aLB0a5lrL(N&^ClDsNe2P-1{L-ZfgBN5 z+a`v*?@Nk-WhQYWZG(rK>m4$yO9MuvXh@ZSphm;l)_ev7Fa%jBE7U(4(81CiF{-1X zB*Q~c+}9u^>X=($lEFBJ!AcU3nmZwyR+wAUhFn;=QwR|iP**X-o?hG09^|jj+Z}SO z4j&SedWK=ph0qH;*7(kIyPEtBTu$CTVyyXd-T6gY3fXxb4ThyeC`q;Vw$^I`~BHklueUZSwU&F#?`{ znV#6w)ul~I_(Mp?lKR!tcSteuKH%|bI*`-qS|g{WYU&e;e$D0u3WUZtcIXE|{bhC; zrzeU7V@)G1`1Oi2!Nr1|?Xw2$mU^P&%dQrdYuXY>80UD0>v(t-ancChQ^ zESJBz8_D?ld3QkAc%VYp)#@hy`-@L@+aJzV;?_nf&RKm?bdWft5|soRVgu02WG^<_ z-2CEnwK`tW6ki7`)C7z-))fVvZMu3L**j%@bm(Quc_qHWEgxw&%6yeB<|ryQlgNmA ziXQ0tCPt39U0x=KFzh04PcHq%=k2&bYBXwl`$_@Q3Oz75y1Ak>Gs^|V;(tCB6kUGa zp<{2*;<$&obvoQTSP^a-sW7aUV3^DOy8qdN>R}jOYjulaP$A12CS_V*wS}d;)pK&X zO@J8?((v)|l3u1E|HO*(<6U?B@hQ~_z^km`cK++wjGm6@MH_t;0qqxZ27y{xBD22y znp@wbh7t2_SG@3j&I+KBl5Yx7V&Gbt)2(}6Mov+Av%cb4#><*gWxpGpc>5S_jW4cQ|3njz^?e>lLm*| z!}3v+erWZJIfh6b!}mHlEHP_mdpW~@r$==ItN{9;-yYv4Ext8L>2fQDP;?2ENPbTb zSprm`YSDy2_Fhe==i$;3F{HMEvOwZ@@msTmlAdRt`@n0sjsXe!=h(9BcW{RV8Zr0! z8Z#6Cn@Jx>!Z(}TXeq3nJWw=!^wj^>wLu2_lUF5PQCV9Nq^ko#|G`hQjscgW<+ier z0YHozF|V%oQ9)X^35Kn9VQut^ql?3LLfF9R8H)aciFw!(m{S|s*E#CN-7F*S!sRdC z`CGbbAtZpr583!r!3B)%;$aU$*YUU{lE_2^JiAtLILN)#-8tX-c^VWzrA?5N`HaqQw9QX#3hcA~IiOVV@ga;By=+|58<<7-Les=ua?V=i~x==O>!4j*0NFarp^6lU%2 zSwtt7N^6AjW9o|PVB?mG?cFfQpXgiix7D~yVD zsRcZb<;-mD)#GMS0df(9VKy)&X&@W3c9YoRs*~lrPa_lnEaTeqH(bAF?n6nZBqS10 zBB)8qFa;w3Q%X+19&FX>d2|MG8oZ39FW+9!>r{ zd_?mlGavVRx|z!mFF;)3zvvnCZ`l4alWnPiFH&uQ8{RL)J@gSA10>*)-QIDeg>z;! zZ#=IrL0TvC8-xPF@BO4b)?9}lzHE6S2}aD64b{wq{c3x3;(ceibTEFe z#_OT}I(4J#_~m27+r#d`X5F$b9pHhzDgGaRi8Ba&R}QxDi0>)nqVx0J^UImOd;b;R z7bYh*z(_0lA5;K0Lo_-1(-`H61JSYH*+sW^L0_~gc27jhl3KIFSo^*V@QszJV$>L) zo3h$bQxgs%DVzB`zIKU|A>$|3hoeYROyti$ z>3uBTZTh9PwMt&V#+O7VTqV3UokwPgXkj8-!vY%7O_Qrvd#mB^&X$vklQ^GmVM)lz z31-VD*J`=HWRd|5=LM7>nL3{C)81ZdP23d<8(N82S+SCt(S?)bBk}_c_ARUhK~Y-? zg1;p}_(9}OI~o`NI(-c*R2jN?9^F#-c=n&=ud0Vp1#ag<E_Hh&Ro+qxSk^Dj$EOM0 zTF3oIuL;;&AwlQ?w^N3YwaO$Mhb)gnMalQK-jQDO`u=e?TAm37!A}_C0O&IR8x3BL zG@>ahA@T=N3^M3svTDb(uQosY+fANlOE>0iXpQiW*qk-iyIELVohC2dRAt(THQAV@ z9grqx)2ZenAR0gh4R?GR` zZf34G`Tj)*Q-qSSFlqmCuOOhA$f|qEuYnv{2gv{ptpYaIAg77+43~GLJWHveoCDs@ z3&^Un&3cFb`T{ePG*idPHT|l;-|0Q)-uo}hJ#@uE?z%KVWDrXEoDNAh#luyPN7w5E z)W=fxlerPs__8ok=$A&bkXr1u=idv9o4l{vDh6J&eaDT_G#XjG=*o|x(9nPu<{#kz z8uAeYz?2Ld2~Ie@KE~+1S+s5lUL=Xa7eFZH8OY9%XkJd8@Mz_@+5NEPNP~xAru6~5 zFt+NdVRxS!?+|c&$zF?;L2cQC_x#)MJ11Ho>scQLXH8XtJ9we8!}X$A_FgjEtV}X`~Y& z0a3(RqrKg)#BJ`&(Te!TgMx3DY9z6-u~v=RnQt6}X)z;&pMQW8GcpoWQZn#t*yY^u zE9Bfge7(ITB-9}fb8V3jGBULO`&i~_)ha_=p!onKE7j(N#*9@$ zo@2Y*?OP*SpDI^&BV`q(9d(eSGin>Ns8$lwa}pC1vr{s_$#{j&q2y8=)3ltYa8dBV zARr8((QxD&k4thU+KCqK%SPZra-E@)(prja0VYFf$^3`d>7-2KxPqW*A2zn6BnE2& z02mgks4Vl+A})<#5yi$&eHL zDC@kggk90RT!>C7V~fV_xtf4scDGB#Cr5xIWtJ>mqx=99tZX4SG$P~fW6X&V z27`rZ6Wx4J)#8$~oRR+HkVTRB@rVIg#hFO!OmFXneP3T3`vV1l^XKU*$jChAXZ~n@m4t#+g$^7o z7=himd41R7{HQ91j7MAr9>HD@hYtU2z-Q#E4BKuU7%N!>5(QWww)r<^5(FUiXL zoz~;*RrYIj%dTnjtkYTB_3xutsxS%ECqy?@+p7-P?=raA*bez#7l*LQzZ&RPQe8%2 zJg}*(_6gBxWkV-2vvLy8IqE?9js1fseZNDQBUOoHFyC|SL>q{U;teifux_}S&W&o5l= z`sGI=taQv!!%7Zoz)=Zjh7xN|mT9S054n=E_E%bbo=cVPx^UCPnZaW7qLP(HpCHN?&$hbX5Bh-e`q3tqhsW@g(`z~7Ewhg8;;MhD+!UtDzhegJ?xUl$y&5t z%fliUc|)`}(vQtwf3*(r;%8&UENnaXlNykU3?UCr%Xqw%Q_8YsBLSpptkO{fhD#(j z(lY88cJj2k9W>J=WC$s&63q3`7b@Iqh|;aKAHt@wEKsBUSsCcDk;~jl_p4TZO^qeO z{_?gch%F2*q=1Txt^0AkxYj*q7cVdE#An-9vG|EJrDUnkl2HyBO}b$wFW$g)b$?A$ zQN%Zkez+h%fkBBbgq=dL*Gm1H6poaru8g&N+u5;_{n9%Ox=5ard8tnpt2JgIIX0b( zt8LGpM<%RZXh;=R`8X@*Mz=HwB=xt!sn(ow`1yrxkgY+%gkIOhM%Wo!6uP38vM+;Y z^IJgrU(I5QfYFkI=EBBKFCk+DR1__GC`L4%$^Br%G^5D?2nQ?0=ND zKR=`{; zRSeQ@a8kJhalpGX{*T}ssAHhe$}vf2gG6Q51jb=VAmP?u??kC{;|5R7fz!l%2L#8E z7_H0i|2o`p_UP9BJ{7S;a>e6t9u_A56TId6KdyO{|KpnP{ok(nb(a4vQ~&?Esi03J zWDWopjt=aDDFB8eBT2Qy5d3DA|0h_ig48T#%pO_shLP(U{@>{A^V}cC|K^3W|5U!h zf&T-v5cwdIKiyA%GoZ+8@ZbIRli4DLm?B9z)akCPGv3PudMXY7^MX73@Ac*X`DRQ1 zSHBPQmpCZkVU?F}bAwUb6Iu!Y+03nEA*qabW%rP*u{;GI`BUGSimyQNvzV1GPCdhw#fm5f!zV%axdgUH`CbVOt-Z4icfz zI4IV4M?UtToN{oaQY-`u~*K%FTd?t{%db$W$ZEzWDOdm|-b2i|j$LwGsuI9#kp;gC1 ztNnPn7L2w2iSm{x%WHZ>ZZx8kzp6 zTJq}h={#j0Jr9$eR`YInVjm#(4h zl~+SZxelYlo!wq{-IEKl(*vpHY}qB9Kf%t^KfDVq|>YJ?gu0}-c{=2>~y?rY*MC-0sj(f)^+ekg*Ve-`KtT# zg4|bft8f*tNO!1ICV3Quk)PM-4U!4g_5(711 zNIciT$Jiww(yMrw@iF2xcc*IYeKl!4gP!DZWu`@uml-eI&le%Mi1zqcI~f2MSw)i~ z;0L;vY~EEFtVJVaZV7PAkwad$%p{jS-bWg>uU>-&0KsYhoBp$B`nZqZyKWA*v(6z* zxP2+a(ty#|u~%^r1~Jhgp+&U)>fI0{oDy3?13A?KYdaJJw`TMEW7?eo-eHP_5Fr7< zZMYW@J-u7=oY_hWio}*i|MRc-tHb*nGo`b$jCYPsX}Ucp;b|4OZ;Qy^RQ`v(Sp08K zKLk7d3>WPSDVff7yo~!-13cS{y13r9YATy0Wgy^%i^SLC2ku3SG`{1w_qRPRIvt-* zGH+8`&oNxg(yQ&7)#nidgO$zP+N(|CPELFPp--I8#Eoke(o@vqSWcr7GYtTMSF^3Y z`sGOLl`P{u4i2QAKg%Jm&t-mOXNyd`m-1O-MLT|e-t!~UjW+?rU!nF>3l2DpN~hs0 zo&IcG`SkPXi-ZvyaTcnAI8;AKGrFMed6IZ3DUGPnD#y-Q)|k%l2QRPi1imd~ppkF}Q(4gzt`%DQ z7Scz3Vg6AA2>s@BHf-W{X1h|g+O$#2UoSuJSa7o!cl>%_(`4!*61gkt6a`n|pp|ry z?h+tDl-*$2zjEUk@c1k#xk^qbi3Pw8_w|_%_9@tL%*@fb({0P~c=+49Sa+mm(oq+! zB)9GdIWWy1FzH~H2L4pTr7wpVGb^orI!GgDtuC%{f_dMgR-5gdu1lt`_uk!_?hY@H zZ^cvb?mNsrE3^5~%PM@yx~JvN%sL%CulDP1sayx&{>9pCD8NI? z9DpUiJ-btWYoQJ7RU^sFF6V+e4@Q3d!lr=3zm(pHcr^wE_Pyik!{?9Te=rcEL_mbF zfAF5C(2h|}{Brc;|u#|M0_#uo{pl(NDT zL{NPE-P@dhnZyVo%5phuGzcj1qy$|ahd6Y3RF+4S3bT|HRc+kuiQi>(!i>YCbv$ll zU?i9+>i)YK>71eG0?w3nA#BY%9jsxvOw004>O z)bDP5rgjTmegtDMxSh*R3tSBa2p_k$I4FMoVVn5cxfd}JYq?e{u5;1N7$$Ik(0pg` z6W=)Y=%a@1N*k|z9e+cPpIbn@z#yS0GLiqu9D3lNUH#|3qN6(~>~@_)8r=t64ykdm zp;pQ`gdZ=u%&xaNP=KMjDM#<;{H>)h9QTIn!*F`Amor!2iTvrvZ2H^mn$7z195*vG3|0eP zUb}=5?%!VcaM_R+H+(d5K1Q75-34?HudXe+Tux<}n6x#bG0U1HgMgdG)Ajb9S6Pa@ zFPfM*Rg)07pB9e!z6IY6AoPon63dU;;8n-U?&Mpf!jEpVUd9T3rQE{|-=C09A#4g` z4GkAf)b{;@J_#&BOFgaYb!Cm8-Nn^{mc)2hJ`oX_^mkoX@#Ya5)^ZF>=|*h@EBiMS z9gO$8LHDYYVM%0UzGq~+LbpA=?FvnG89&rF^><4SGhU_rEJ zYf;oX?yaqa3OKzx`2zHsl6LH$;N@BVepCQ_A3m#@{#71M(2&y4&b6;`=|dx7uDYO= znk}owqW1@);=gHI3>>#NF9=>Am(?|hOlC`S<&4N#lj#}j2bZ*8_C-DAt1YCLDLz-o zK7F7ZEifZ?kYpT6s)>>C*b?CafN0MjHj3S~r45Wf=V)EusweiJ!u4CIB0+el@;7(M zogQO^yOaRJo!(M6#aP9~dIv}WUJ9>*S8sZ17576S70ZnGjUx%RW_LQ4q7&&;CfbGX z>)AbXn6WM^sn`c*2%_D98%+}lK>tRF&NA&{{%qh5A?a!qLko|*)yhh`ch%kBBuo&B z(;5BRQ#MdzF2E}NxU4ywv90G5*N8USkOMa?sOk5w=6!1PzIsA_ft57wUW0hO^W>qG zSh*Ai)39OxH`6ry{bnsw|IqM@quV8)1KgN&t(CdaL{IwG+f|a!+v7@^erN9o*cgaG z_;z)9dEns^qb#Dujp&VcI`%8bta(+`%C#AxKy&oOxF%@95q+9INH6K<(H^Q$|~FBJBYJS1Rs0-DouTXl0sZfvuiYtd#M5hMh&+vG3|r ze@~bNz5iDArifV3N2Txo^*`k~XH(zBhOlBr;)VR>Xd(3luSUo zqKF15a7HX6raF=){_zDu{rm<5C9wDjVM3%Y)>bItZM>t8i*43b5)+H_d`Qx($eS-S zFKc*r=9!u>f#|~D7zPzk_R%w$^p8pVmXiA{NxeV@f~m>glUY`VgR?XII3lAy;GKKi zW=I%=nun1~mkkkw6iGo8W^=CZwi_@qky^}nHCF#F3r9!>`ksH7Y!-&Br{aA+b{IVV z0Zv?~sJ_7Ho9w=MDUYPg){0Srv*F*DGA@M=sjoM~0rb&3zPD~DCMGU7<_XwD#AoM- zUl^CJUeYv47?%BK7x=zrn6(<&Ptj%_@kiG5$PV%ACV5S@&N%Wr{dpwxe@DJF2 zC`mrHx8HMEUlG4ftJq|bBI!{p+^ulq!{Vb4|D+Ki___YN@}7LRyY`$txmi0_h3&1F zz5aSch&B(U&ejN`+nsxit3hU3MK^-913=0yF0WbYaXudyBk13aQ~W!9-osY zJL?8*-P>?hf1ZO)YPuiqgnCQ_eT`+=#G!9;U*_wXKXqTHQojy!B4YQlR8oCguULC| zoLuW3aT~XzLT$|2xF6Uu+B*|`SpK?92OU09IYxZu|1%o+ls+!fe_h0V)!Oz{bBijz1ulELi_6Hw7UB>gj76uq(DCjTU zpI+$GeD!obi(azL3sgULHL)WqpZBPF+F1Np0Kmn)p4m*EuH-Ma@0`nF_)MO!cfF4N z3wIEF{!9J?iBvVXlJ)w(->HK+Qc(@rez(j2=|_9q z-@UPH_x`y(*R{>w<7M!0Yk`{yMB8DHO!;rt9Z>s6q5j@{KRYD-NZdYpP*rV)Wnrfrwgi;;C_WEZN=3duc!$1-X@{!@wqGozhZsS3dZj6NMQ% zWoc(2g>GeC&i6y9tbu@1G6~^NRX-$gP}KkQ+ho(*vFsDb;HX{j^;TL8YA^wUCKs2N z^MtoQ3)LgYxSFtd>F&on}x7c)w0kS z2tp`GuG{T#5O_Vn4R~L*c)xB(v#ooeurLTPx_I1oI?4>)J&ENL(!*s^RZT0@ba8gC zb2+E^jJWab$R=RfWa-(|3qR1Ia@FLQZyvD*`Ciz7yrvnfY;8JwCH*>@V16FbD;e1Snb6ez z7hzzkq~sI!xNJIwR}`)*(@yYe^QXfb5X7@|g*(SU=$GlJ7i7Wy;A}WTE1P6*>gkix2h8@NGGDaCv06@_6pI(5W zxK4{BN{_Wx`yd@ebYe?>pX&Y}zwAek8;1AwG$v;HWzziP%(j;P%vXHG zq@s2?A`H`U(4)DJokxocTr+SfsZ*R-YVk7Lo**&i{F?@nR^Xv0y1X(B8^i@2X3ga|e%yfdpQ6Sgz-GX`gI?Vo& z@RCRx=me=aTFoX`ul#Ii8Hb4xour@gTFw4e>UB6m+2AY^ou6kUMDRw(6=|-m-=o!; zC!(MM(mAh>>Xg$xJ>eTp*jDzutJ6YEZEiYUX3klmY>k%VS7WgGb@|c|*Z}nK5J$k? z_9r-L?7*4S248<-t`QH|U|^@w%&p7mHTVVeg%CBO*C>g8ok!SJgDaLCoM0wV7H81t zWfr7^BBVKkgj3WO{I!=Ti8398NQw~Lv3#rrsbeEZ&lF+fGp$};IRxCzj`}}Vy!$u1 zatzU@mkk9$Hp`g;J#d;*TEw=QwQ2vxkkbUs>r(fL3XLj4F?D24(ABMd#1|JTwG8vPoINIMub1kDVwoTpal|M)z)@_m1h#FpRVYNpud z$(eup>2o_vE={TmWSTkoa&$SfC=E+Pn(myo<}p|$yN(Q%h-MiP+SOF_%Orx>(wAdNIk z_L;w)Ox^02S>us%IpX-UGwbe2`tZ;ofttw#f?VI$+3+~GR!uz@#dm}uZ&C!zF{bu@ z!}Jq2)aH3rv^yK;q$}(+i>_H<#xvl#54Mh3mV?&9o~^Mr8(Yn##3xTyA(BE0kf>O+ zqQ0hNM@rJqNKeMEDux1Rw1=&=@OR5Oyw_d`Rb%4|qs?^XhXIOK$Qd|bZze&TZx zLIVTPDmJJ-CB=U1fR-L*8)P|uU`R4@R#d1G4xJO^2aU2N6p_kErBW)TpKKfAxhIL# zMM^ECH@hFb6zq=D7f0pS&fLGdif#96p=f~6$-(f?s}WX^JcU_~KZu1OM7aMhQ3VZ4 z3r7v9k&lee`l^wDyD`%UodogKA$zWS-~1za5VwSlOtemKV} z)4zuz-Pvn~fyczbCNLmN;zgSh)YR5AL14F5b<_&S+s_%08Z6rQ?0?<7c&Ep<@&4P- z1{H5?-FtQjP8^(;NZv%MdHOL5fDiuaxjX{zzJ0 z$l$G9NRWw#`qT?>sX$g)$;YjTCW39LAu8=Tvzpakp!or4-zj?R;M#@owxE*K*TRjQ z?{tV#!iVKHrv#|(H!-ka#`hU+bkHb}%zJUi$ul2d$>aEQp*5Du61pTaD1|OX!7PFH zX(U(?3_=eD8B90PTnkT?^p#TeUGO`V*#{*u@-U{yT7{J%BTse~q4kJS?%6*6>D*79 zf#iyw&W^6XpSPKkPUk<%FiE1txIge@QT6Y=Kw_B+ zslr;Ra00fqhXsxGC2YgwJ=UV+WQfk`2lFy)EA}AjK~p(>#^_H{DR`)gxMrN9=q_l$ zjeN{#}ey6pJ346O3?9JYTax6FYE;TR=i%$AIm^2bVCe^|g$ET%nFaMJQ zQo_NIo|H+WI2?VaG)+}^QVoUuD{7P*K7%*TgaO6r!XOcgO*0e^(?aD@YCh0GD*YD@ z8~I}$Y#lbLv>{vjY~6a2U0Gz&cbtl^WnL1>c;b;_q0Uq~q|(OeX`=jb1gxj;#t71p zMU9Bp8n(JAY(B)6+%uQQW#&fi=+b}`!oVN0-56&H8;jJ7Bv>Ue1bK~YguoBV!nMKt zkE-Z!7-ZnLhMI?K+R2SZn$)`G9qe644{`bXp#{(H-OtKi%;H)}^_V6wRVngz`g#h& zC0d`3tC{&Wv5>yy;PJ({t8>jYOEjE^CKDdOzsf|^G
    3y)|gr)Tox50LRJ8K|tT zt%~y28Oyhw_XhZwEaJPrrggvN#$zj7h!Zs6#Lr^ep4OCEe?}~^eC%qci^er^{Rc{aC=eB43W$DVb{HM}3z z+mvTbUxRkpilPwl7VQZGkakR6tCaE+eJ#H0D5|8{?^S6XFm)`I*Q~R1+pB=LK_!%u zHpb{t?1!)H!R!5LXu8ClSnt31;ae!CAE8UX7@-JGV8c?<*J~8Y(uw)$$@EexyDrO1f%L{J*>YUlJhW}((%bR*PLCrWqVLgy)`2ZD^M zVJWrR&RMXv8~_frP(5~+!YFW=#<(rqz0b(x-ErC@=J;?+=z=38j$w=%|#Ysz3+bTiq-Qg zX6lnHWXePEyJ#-K2*PUcdh*NKPe2y}UtMAI!%Bf`hX4TsVAl5`cgcYhgt53-$t3cuEz~t><(I=t|%_LTpChi?ijREe)KnFKb}l> zyT7C5csuW-HY6s0w0vBf;q%GsvyG0VudT8#G9pXG zrRoPDmUTV*;IQ2P!c;4FFg43q1JJ!-!le)~9HWK_wCcg_ej`!bbO=wy!p*GiB)|^) zBWz%BF?6#Hi1?`7iy;*E>Gb_tTUsq2(`&VQ6!{F~MV&XLlA)WCO8>!2E5bXk5%8$> z+usg-5mrJE5)+AxoJbEC#3fm_{LI_pH`pVajRCM^j1wqKLu^cfU#GsXEiEX|ei4F@ zN>ySwS)(p2zk1Ye2xgNDPOE5enX_jU6wt`WsFWK1P)JjaA4gU};pBwCVR*>|yq#IL z;Qc--DJWutwI`DGv$Q@0p@n(rbF^ZnARQS?JH-b)S&!`4ouL#O=@hIBE6usVGfu|l zNxlD`nsT%}{u3%mf5Pk4Nj6bAeOP&k6!uNY`xh6B-*VAqQ&Wl3M(Uv>AU@&802^o; z#n$KTda9{oR{VY?5#-3S8w>baIzlow+v15WQT_qYkhOypr74*{F<>0T2FzxMCO!w{FTs5iaN6(?<(FU_&5{T{AAtK1?Ov+2KGX3+UfH{>+zp1)zhPD8!p zdi#68%Ee1s1KeW*1W0?n3>Y+yuTQ3hDe9lg)u$LG7V7xh=ltf`ZaTAQH`EfGDPgnJ z5u`+FFNn$ri1xg4Y6RW>Nr|F0+iEq1 zsj+E?Fix>9tgX|DJxrIEWA*z~6qBN1!$!2%F-@N%1zw%FBW9{5tkT8=FUc!hD zgV9mhrzc)?1U(iz&Z7lij^=xBL&%MySka3loY3fw0mYSDHy?vS1J>I&WOJ zW2hV{+w)|8b}MT5%E#$qD+zbvMzP6A-|Y$V%W&l}V1N+rKD4z*K;V2KJ9fyu_T(-C z$%Z8oEibwdIVczbX%}ikW+DaclK+C}glWC={?C+QWHy1Mi`hJD##~CuM(M2l ze?)3P;kd#5&}`JnhbI_PGVHy`>mrFVp1`75g9ra}#$K#Cn&`+~WOEy31#J!(<%N;S z_o+_dsTTfO7c)eYiR@g6j7ws8_fC$PQvTaQf4nc}`9cEKG?w5xp48NS!6d)EegMf{ zWUP|qW6`_*h%7Y8E*w4-fC;Dk87nu>qyYQJ`D2&G+utE>Xjr-mK3Y~iP8-!?O0!#v zcLSe$oYe(C633T&!Gi?;j-+jIkhn7B$wgmaI_l1NV9wn1gIhm~(`vgwzTP-6QE$a~ zS-%N-;FrBkZL?c%pq<^Zt2{~r;tI-nldGs+1KNq`OapUg<%eKXD|Kc!6D@MI$ttwy zwLW#WETgib+h?y`n8&o=qP~~iS=T-$9;>Y~oseFSrAb0T$3=MAD!zA@exeny6!nP; zJhgob`)$*KPxaS^jbAAb2gxNqA@t0?XBTfT83Bxx$({?OYgy@f+$)~vf4=YC4bR-p zRwq7Y@a(+Y=lGpRL^#mziHZ4c)>rjRIaRlJWi56d^2OPqoN`sVOXxg9YWFYmHT<{P zjg4tE_?`AEoCcBG1;5mF?y1~w&a`g5?`iv` z$n;qcllZ-jNlxmwHh6o9SDf>BPYy3fR*RJT9QO4%_+RA;-nGA*m)Nvl>05j3Z7cRQ z5h)F4h@y4++@9j*3S8$~*eET2yf=e17+rKlpRA-dy1R{oHI0trA}-$JFZ{0z1pN1p zN4u~8`8~(+|8l>rKM=T1w8*(ZW}Mzop&4hUGB{j~V=gF|?nL9iGC6VRdO6w**p2d@ zJE<5VZ9bR_@i;##a>by%=)CQkPod87eVG(^*-Lk@ehZNHK3{ky@wHf-6XTz3tP0|6 zSRel=9X5b_?t32+;&LEx84)k=>E7*iWMrvl)6>vfgS+|pT;;;R=kyeU7;Db?Crb8y zYz^vec*#kU%p_AvJz44vGSl-h*mNPXVR8N9J$}EQZ>RM%u-kkf&F|RH#)9O1G+yBO-k)Z-rcwe)maF?OAoO=Sed|--`f_LPneWU!_nv#_zI^99A!&^wF08t6GM%VsbdLJeDXm*s*x&hd zOA}up;w+tr=m}YQGu8c&+EwyH^h^`{6(zn=D8o5W#Xb1OUxFlYVd3dHZvme8Ln2Sy z1Mt5!5V-)g0bIMmNRfHFv_l^q)|OC=5hTXcKB*o%ifn(1!Aus+#~(|JnLE$)De@_| zHS361dD!Q$vk(SZe!RX=#7P@*%)pK#&H$_{zHaOT&Y>W-^xTn={FII-eLE9x8D5iD_8m?+7;gF5Ar zB+DI+hhd3Cl==M^WN)SYlv2*7UJKB-j%f&Q!!V;64e}O}aniDR{^&%vNPB5G6d`fk zv(7XPw>xQ@+)ctLM$b^Rp!6c+DWpf=_0S2KYh0|XMVx}onO#!Q zjodk?#<49FBZN4H{9Vn9L=!1 zIV+`%%pkJ$%v(LqGYB;TLdR%ysPhif@;cIE6;|S9;yX+c%1)`1UgKOnj2|Ddm4nJ9 z<+>U4r+JjY2_Y}rD0apMI-h2(MAJ{588Lc&7zaHUWS7VGT%ol;V6tzTO{hp6N}Q!! zzA(Yrc=z1fLOs1pX&%Mq=222p-u1Hi@^NX@*}2+ljQ+}pCC%LVKpt4znTUs#vTx=x z^i}U!ce)a-4R6e`w|92X_;NOoamD+aEs63j1GEx`?W;?1w5xgh@vw&<)e=eg8 zf|s~T>x~Wc98K2}U0Rw#r7M^5xZ9I<78Vxs_)#lO&%VK=8|8+Gwu{g3)hOnp>8!KV z`HjJDZ?M>Qf!{jdZ(|KOM&N1}Zu|24nlF@{=MW-Wf)`!ZKh==e=0#$vSx@SCKyt;s z&5(_neN7uA@~PF3l{T4%q?z}mz-*4Cues$oUx_O8vGVM*%3LCjLX9`zy&T&7V|aOPz#c1HKks^ethSa zpZ~Zt&i#<9x%D$DU7@BiK)S!1$z{E}D5Pxx39i`+_mr%}&4O)IA#2(wRZD1 zFBvB&FsIYt*^b+bwxh<5eopKyPK)IY5cf}lZ*1u|pH%ORT$6)Fh`Wmyz;e3u(_gD$ Bk%<5R literal 42316 zcmdpeWmp{TnkG>`AZTz64TJz8xJxI{xCM6z!9BRs5!^bBOMu|+G%g7)!JQ6};7%IX z?k&D^c6QFr%r&!r_XijCQdCvf8DmBYuS#>K+I!dH-oXkcO8bHKv7JNVaK zEUY^L*7>f$i92o@a#C33!?at#;=c7Ol~-6;RWQ73vj@N$=bgO18x|Ic`|Z!2MJonx zEUet$3XoS?-X?oDI4!igJ{uTQrRnWp$G<)Yb;I@FKDjsc87nU6&ppuFU^70-z7CQ* zsGu$?k`O5G$Cu0RW#m7qOOeF7ypaNxThvhgc)ORV8x=*-(l`CqVP&D3v%lJs^9JJy zmV*sTOidY2)i*hx?2TM`n0TnAiz3`lwhA)K_mL9QFJ*)iro4BndVycRv~)r=^{G@X zE$1@_g7GLq405X6w=`7h9plZu?3oUC!5>P(wq6w)n zFqnNYfoQ^b-Ntd9$Ii5UMXTTs<*s`zyk7MJFGhlqdU;M>yldF6J(1&fyWf)Q=!wYL(Q{^7WfLVIN8srrf}m|l)2 zrPlW2W(~eHA zb!Gx>LNLs`x}bV;u4*`~K=?POFS}RkN$!F(rjc7y`M~<9SSV2}L8A`JKq{F~0e;2u zgLLAmX!m!EmNz@AQ}1FpTXw3Z$m#DLX-?k2<1x{M`f?+x^~jyyExXOljRW%+W}fWv zA_>kHbKDb$7lRCcA^b%XM6=BD8|YQ@j_Y(haMK6w%@{9=Cpe4p{HULmkLoq|bT~by z909Y<%OK@mYRVMw`uw?QF4n24uRyZ%u`gYJ;nqwZUKtQ^>ri%SO^=UIwH#p&OGp!R z#6^S;OQ5~e2STC8Iozf{yW*-Hk#!TQVvY_D4&OgMn9jbewj7*vs!>6rT}8hPh)YN| zzIv1^vC7Kv{^6H_T!AI4XCTn3#gDgC5qvz=nOK&Kkl`=N#4llH#WfN_cLRe!bX zSlVKIZDG)2+y<+X442glOfU|o&UV&u5r2R1VnYx;nE|Hj_@_@%9KBke-|Bv|5cJnQ zFuF&m!@u3}%6sKQq;#v*Q$P0K!U+k#|IPUSlSTeeQB*}cmr(;Zy8bm3y092HG09Q3 zzO^nF|E9YXz9hF7oq)UYh3C2Q~Hak2#3inabu&i3+v ze+4p$iD!9HCgdbOtc4}?w9(}_hPihs3e8~)(*kZa1>TD)J*^sNN5h5f)mg57bQif# z!4%WIn(w|HF_<1VAmPOsim+Dd+2>Z7n*A+3pecp(rROt&TJLWEXDi2|otdIZ6AxK` zXrgX$wk!shGmW||yC{8NSfo>{YNeKDT*<_?pi@@gQ2ZO6npi^0Zc&iAmJT2lt#`E% zQn}y_yZO_(_nKSz-ddLnI@Z+Ei3VZ1)y3chPfu}22Sl)id_!N4Ox^x`uVRi{mMxNK zD=fjOn(&=45NnYvjQ@wl#s5{ z=_~tOWO2G`p3aUhJQ}-U#kPPqPBK9_>K~Er-zz)eHU^68d^*y@A2t^dhTSf5hJ21A zL;5Xsn?d$UWs(}6`#-7d_Hs9PM7#o3yI(lYCk*Ub4#Q(_Ty*GX{=?P(yj4U-uS_I) z^vOzzPeEjMK~Es;gJw$Tkw&z_m)-&6B*I+w$btKSUwr91?Pd(@dGbna2pJsyR*v4pc=?zK(HHvKH{g0IBIZSJ6tdFcN<$OiEo}R-9m{g z60+ts9oh7j_9AA@8z-PPGPrwfyVA{PanCH(B2J*25!_-j5$U}`5{45CLQ4)c>1AK| zdWTmQyp|RQJ(kjUl)en?Kr0{{f$YBbJ?)xesy{9?RccP0?Ebtw6A%g4Sbox!kyB2m z_(wD4?EMLWW!x$HnOEA4vc3prZp7p!vOW3Q!g5p8CosRo2#q(ya1&){my;wNK4M_x zbbVYP4a4oW=6tc!slA$-JZbFPX^J^PK+zj!`AhT-4Hwdx9@;sfJ+D{(FC+d}i#|IN z-fQ1Q{2EbBRoxg{5{#TPTrsS3NLk!)+3lR^-QYPZ8|WNA(mOinEa6=K+Y#hPasnjk z*ip?f#$c8AccOc3->JEyaf5J&a{{0xVAziS;o0)> z6v}1cTji7347ml$W(m)=VY5TQ5gL4mrwrft>4j?z%%56wIgAIC#)0eysI>$-d`S` z1xc806#Wu6STq-jmS{Iz2(5eQfgE!rQ<)m}s1daDlf5h$@~L$p#T)$W{1W9d{|~`N zAB(dKD<+FX5zT2QtndVCR7bGz`}WjZL+yo%OC)~K>TK-x&i=j_a!E*+Yv$gtW?al1 zPTDY6wr*GGB#^v7h-cZwC{H`N>jyV>a@gmGCnURYFI9;bb1nPZG z7NtWpOQp3YHwbpq7oEC(gZ0NxXMxyG#L1xTr`+oKm|W;IIviWE9pBZ|L)#bf0;q*2 zLD*hDUt2(|ppqBsSEq9hY?2^tDNW3=sG^SX(d$C8nVq&v)<$U#SeQPGti^Q-PD$pw z4jgCiP8!L}F-;qO9{)JwbG6gk=cZ9&_Th5LT*+4AOUZ8cq`6FCj@WuYNegjzP~;50go#Cw%&{$-AMn>~i_KX@%7RTB|J%N+(R`28*-_a0p$W zn1((Gopa01pmnU{iWS;nn5Ug*m8J==Z_F>xbfx~<7S%V^ejeFR*;H_SfJw0sV>kP* z6^{KmVUd|e{gqPt+g$%6>%gZ}%IqcUL&%x{zfHLL^=3{SqBN-67brc@+-3_`AIw`l7Dmcf46jJfTPua z>$WVD>4cMAuc=(U8adbOox@P#3QR7JA1od%*VKVeqSAUK{aX_%zpepw>G|~Y7l)z@Nxb2hMI$YT@WnH$P0HTEVrH1fS z|H{dp{De)X=TL2Lts1SM^h$sl9$58Kvz;du;n|v4Ut+YF0dexEv2mQN2AbaHujVZa zf^Tca4JfV3+Ku1TBu-0_W;cHu$=a4Z*{(p((ye&G4yLyI_1MZoDT@{^^0<_hf)C|$ zvOa4;2=A(trJZoah?D4RUXth2=$7N%j0Q zuLvZg$tB%#ZH>mZi)rlD)zT>(yQ~82-!3?iWg=#sIVC{|O)+lw(NmQ3hRVsh_v(ZV zrAABjt5)T;u=~~d?huo2pY9axGijt`ua#xU&F?%KGz^&DHem}Q4v%W;m2U=3d;mW@ z{%Z_Rw1i^PVvAa$MS77zKJjK}@!+KGayDLBylDAmrRx~=?tSBuofnhIn=FfeN~5Esd~(MsmDsc8 z-sevbT_$}CgY?8p+TWx4cea0<^?>CdoVXFc@XlLiyHLP)Y-8kQl+y0xe~y+064%H7 zJdfc<%U``~xZ%PZ)s2gWquaIKVx(B=`j~58S_5emzi3+C(0jY6z`#7wLkTV7u{EA& zcZT`v2ug0)=I=8HHSZ>BJe{}q+W*<;b+E|2WQT)r0^BK@UOjK`odfPQ5HjR$14u-l_F> z2u+7_BtFExWv>odnulPX3V_%hyL(qZEY{|iz5D6=KePRR6vKZJApR+&+q2_I#3F*z zKc9@=d;6~`y$#l<+kQEfmDm9FSg8(*=r*Me%ck+;i}&K))fLnep*j|_Euvb840*E5z}GQPPsi= z|Lpv@t!g|rN}fxaNZ`mxcOx4yI{ZX7cmMs8ulD*2)OhTpu3Wv$`NkX538Y4y4PJ5~ zhKaY4u;tnJCMN}RO!;WpSc8YZI8~U7{uM_%$>mg6YU38?VfAmeXo<1<#lrH$To{ET zHasw<51UJ2q-`K|&dgSB$!9Dwmbi#llBwlUs&9XEwd+Hx&aN5d9ct3TKI@-a486io4D!p3OzlHeN{w4t{lGV zS(ZUI@ArlxWceddc&tJWnptbl?EKe%ctaKs^SFW^+^e%%3_>D+dgCCaj>!4*mufC1 zUde8D*aF2oD=R&mJ>r<1a?0ZXi-9al~nnCGz9^skMx%d^l#_AVyZwOy%-&&8{s zWb^!0e<~bS2i)efvlgx<*_t&qsXWjvP((N|DoUx_R@eUN>EikNOi&M83l;YB8=q9o50xAZ-zlSL>R!BcymY5Q!&cKlOL& z4Me)FJPA>1!P~2nbQizce{_N_afi^;$FOG=5t32|Ko(CEDuSll4E%n=t6Znjq|DdK z19#x9r4mp1r$5A4FNf8duIe?s`#qkg1OS8CMF`!u=d!E#nV0dfKJBB8(CN0r5830o z_mJvj{4X4z&yUb)=T#FI&G1XodbJ<1WC`?+9|%^w4n!Yf^9P{xkpgsAe@@tkEX$g- z56{E2a8v@OCSFz{XHV*sM<-(PQwC&L_vn!v`RDR!USc-C^y5RxTF)? znN6G^JrqCWPC6_snZ`rSXNYaRVhNjf!}#g;2S3F0*)IlK#9#kO&#Fp}8)*}m#BJL5 zg6-~XYf7zzu?d0p7^*0q>wO)#t#zaGe}x^3^=DM)g%bM=yY%8aLCT@yaCN{?f_mmTLcov-{5B-_OLnQGV99!SU*sL^#P^wT-YRkZ5=5UoI1EEv(#pq zqi09KZ(5|6mal<$OB%w0o-`NoEYT{(8n~RVL#nF;Eb+2 z;GiDK#*+i!%{r_@dM?%9PliQx=HmC}vP>$nQ!t5DRtYB)Z*{r=&Kg2UOU0twCdhx< zpAZRL5CZ-ynkm1D*k`~k075^TdbQIZzUV1BO6>FI46Z)D-*Lh`g1o;I1Fq)U^I`_7 zUWS``wOdV<(Xp{isdf_A7Iu?+2#yl7Nh)gbx?c~N0X>}Eac@69K}Kj-T&n&^HveGd*2wI2Gt%r-zfs^{QZ2ph5Gw5~sgD zNz!V!p-Qcb#!Q4ZwLcOpnvm%$Y1dnR^d2qLDuf!+OHIM#t)(|UMr1d^WH_=A-6r)w z?JT9~H`fe^W&Pto_ey>-#=_WdH)trP1*lCC?Z--}&5Kh!Q%dq<_Qh018wq75jSA}k zh(R9LivU#67~jPm_wP|ShRw$^Sph*O9I{W%3pb!v3)ffenGW0QBLOd-r;(trs>f@9 z+IDj(EZ%~-==#qJ1L0uA#bFdxKluxhlgUa4+_IGP80G|xSPyL-20HTS7ReZSg`T(s z=X7@sy)P@ncrWC2s$6eaC5e5N8!g0xHGY*Kb=3S*Pd|2Eih(SrzKHaHJIpR{RhdB# zR2ZEawx672UKSBZXm_k{uM`XA=diQUWc)n;-JCj+E5SBT019A$SKsW`#QoN;3&Nio zP1WD}i^GHf!;ba#6D8bgV#hQys;1oX>yp7(jWqUQMkM$YX*&qN%^tsGb44n>4w7J^ z>{LFsBHM)}l0PdBY`1bEGtwV5udiK(b4Ew1K1zq1k23MPT+Ot34vpt68CF~DfH6mC zW4X3C|4j*B>y;R&b4;HYx>aA!Oj8_GAmpd?IFB226-GRFPu7Bg2jurHY&Yj*XC{;y z*Zl8(IH0S>laLY~&=t0O=RYsW|6RuY-@W<&m92wiSJ#Kqgq*|=HS^QkH)oPw7&lD@ z`pg;BKDb)9Q&v)H_fxyhX)lHXp)dnLkWV%J5A;2H`>mIX=gPs4jQC~e3#&6bj(8{t zhX5QU?L-#;yEnvcyHnJ}#U*lT#q$xxm4r)Lglxt(b>u0sG__cUX*|*MwL63w;~SWE zi8cOtJZy5jVN5@gQ0}BQqL3aYUzLgIt=yr;JBkm3i*LNe8t9h)x&&Yhx9z_ryPO3k zkor+)Bv4KPrSx8Lv}rSO^T4yfEY`ODXP$G_96%2+02FfZn@qe1A1{`>BU={%@#rrA z7h1?!_@i2MaAj}C;?I5-`b~V&b@8BuHwC|SUMzg;{6K#p>9SOJxd`SkWS~Scj8O5* z=`)D6^@K(B5$rx!@Q)RkYJKA_xfj2kqEl1W)@UaRl5j+%6?iryrpsj~cE_@Rmq?*4UWif_af;Ai;;x0CKE~1G3mU$5W+Is|JR`Psna!yJ z8_!Q>S~wcu0s;wsYmvzff(s-tk@UU&2f&h4LQ%K^{rqG z_s`?J8Ve8g=6zywrg1St7PURu+=rj(YVjYG*l!bZP07^1)*PbtsLQKMoF&qdS#W?D zv?3}+l)DX^RH@)}v-%`r8-e4gpWtdaX0v3}aGy`#m_kLL32%+Psd;cB2;yn=V1Sc{ zN>E=-i>3D6h6fmm4k45N6WfCij#4|Cs0XutgbZ)MXCaL8JOvK6b_OwlK&8uN!O& zZ&8{wA|LW)$++yBE=4f^HbT~(iU0pA#c^Vv?|L;@#Q&)rk2{!|NT}9ib6eF`n0S5c zUzC$l$4ALq01!j~zYApk{i&Jb^6VFR-)$bE_A0jR(UY4^0;Jmc3Q>S|FJP*K7EDi_ z6!J~R-f3C;DJhT**+umnxD~5wJ{FoU;4gKGbYRjsV`Hke_9R$Q#0DZnHjmjSg`8YO zB^$v9N!e)faM9jO9u)CbG!FpC7C|TF4F=OZkdb>y#B(%aeq~4V;#I~IjiNE~_)Ij? z#mKPZ&4hGnk4w5&=90JMfer(Jaf_*!aZsfN8v^ZH&(O z>}@ia&2rfN+|jTfGUf;^8c9uc+DVpJ&0tPUo%9>WA%A3Lqb?xvA)$gViVG9z4<}}lE%l9O87TKg(Y2*N>p@i1Fm4qYbRmA+AjV`B$9I8 zV9`&K_r)x~+Zrgwm%*_sVCC3^(u^rHW2}jO#Ec1z-BgN0Sky|6rj6Liq-LkGB+Lm# zUd_nMwQDfq&0bgJO@;@bk9WlX#$Ekq;}v&!NUA`w^Fot$0-cy=VIb169+4>I)bKl` z)$gp>n9QE7@FNjhL1ti6eyTPlI|(g|>V6`ZsZ)uPAmnL_G?K`+nsFSib+=RggPJDZ zM;Dpr)DZ&n`~>jnw~QJI8c%6J-FJ;pzy8ANW-IT`;!F{+t6Ck~j_pz@@osJC50USd z%X7Fdhb1s6t*or|S?2CH_x~uCDM`rw9jx6sX>uH_#=qcLpCgI>`vd!Asnw4U@TB(M zNjTkkKY(uoc7#x-a#krPh%gc2f=!MNfflIn*$knP0zdjT z4HG;_6>wwysrewXERPc_PLNJ2H!7M=1f6fcsJ=YrG25DC6#KBZ#dT6$2(tnXnR*?L z4~8#tO_4h?JabMBlJ~ish_MISu7EeBY@rLSfdSOGkqLf+4u7S+WZQ{RJBa*Fx<~QM z>RfsiA3CZhF&KjOQ_DD)f2L&>w8u|Pxa4U_a;2C6OhGK6Pbxwkvpyk?_|7^=$>?xK z$GAiL))C!5z8<`Gx^UO4in<{L`(HFKCO|sNSxTd3VZ(N%DM^cLJ~CW?P17SA4#dnB zG-{^}T62X37pzS5`RY+QBS9V?!b7+r`$kK8XASQ0){*q)hG^zejUqhLv!;X^D;6Fe z!ycHVXz6MiRI_HSm=WFUstoGLWVR^@P_^p!M5viU4l zX*l5LN^D;;XV#fb(|+q#YaAy)Sh~}{9}JXS@THJW?g(Lo>^HO0HJh9oQCv>;^u(#D zel#}AJxnHeQc2Iz|VA( zpVPye)p5H#$i2W^DP}sdhelQ}Kzg-YGou-x8FqbF!uw~rB5jpfaaHT*48Pl^K;p_9(- zg;Z4*ZUKad*4U)Mc9AFJVHIM78O{@5A0J2n1z>>QTjbgt>}qb~$nVtVoLOHIG~Fo) zy|_2m)6gzRV}M7KDZ&>H)9F|?+aQe1HM&a6lFoD2y$oHDU-!_ycxcn8eE5uq@R`^r0(v>n_8;bj!|=LQA=p}RLEn?w$qY{-eMLu&_5f< z@@HjFxKGScVjYrqlY1qjW^0yj;Db?(A=Ydsx>(;}{ywIt_cKoTxo@fa+@GY{XWHtK zNuvfm`;N%iUz;q)lqQDY*oVX%JDH@S$3upgmD9!j7%4$5bZCOxv z=g#;SjPGKg?B*zT6JFp&rV|cdK=z876FfmF@P+%!JN+^}!!xuu)OkbG5QZB0E1w;e zG(lTCM%S@ynbiCxB6^W`6WR(E$0WX_=j0q7+ZZiveA4dfa%z*jz8Mb(%0Q9G3^l3<%1KC=_$9{Dj@jl9)0;c&&FcI-j$*Cv8z5_^7X6Ba2M6fvsySim z2rg}7k^KC+!YP(xcbvol)Fj_-Q-GHK z@F~2jtv-945ODR$egq%?3@`GMr`mafqEBnz+7ObMd4= zyHhKcl3tx+H&g67N`$Lj*@m_sNGt7`XsX#0Pu=)>T`#`b8Fm;iRhcSOxtMMmypoKJ z22+WC)j%IMhVcK`CIhkH$Ef2-Jnf}-$i_}y(DQ@n=V&X6e`yjqYXAbM&DuD?upK8q zJPfqk%h(6w6g9s*l*+Z*Yy0D;GWI%}{IQIOpQ5J3Vpwe%5Smn-f+;M{y#rT=Utn_R zW*!Iije7#;-?dhrkfr9h^;evE3?93s ze(pyr$M$r?y#c+4P}My6Cyfa1oVpaSpRt4Aaby!MyP_QvfKYD{G=zZ^F$8H zC3StxWmxxP3Cc~@7CtFQAt8j%<8py&4|Wnjt#IYaQ6@!(prPd43erTN1w!y?)ot2y zk+a<6y3yF=$&1ZV94Pil4^-kJfWLK~7e&mv+lW`PMGLs-d->l^pN+8Pn)h8*(Q!19 zQTj+f2DP7MoOw6&b7bwjSwNLJ2dsswDaSCsz>V>%OG1+`ZaoPXo^w56%i4Hv9AM|m zJa@PDktR7Cok@?c2&VDVdGNXP)fwxRqv4C2p*H`cQ*M1PBkF+IYyu=2SxI#ih(|!8rbmO9`Zotacs#Vh_F?t5lT{L|;}wEtd_ad@NV&O=+gTqp{PnSaD>1 z^5$oL5w1cD^fji3o#|P*$6klXyR9+YsFNg!QdoX9^&8N1x)@LDxLgnifUz0$MP|hp z2}71Stx#S`w|o=dP?aa}Gc{qlfdp2e{To@mR*sVvSC^*X{k6hM(a$_xjN@d=JD0|S z*Yg#@_oS?0KNE2@G_~BBU&>7|LYg8M&wJcrM4pBl1#l{I*ZYS!_ij&pmve3B&W2hp zxD4Ig?N%-!qH4bEWKiwU4_+&uD(Q53ouy=|bscMYr1?6f=TrtcnfM_?8A+7laRk2Z ztj{&{1kNRez}H(w?&n zPs=Pwia9@y@#?um2stB(bU0D?_a~6I&xk=hltJ>3SfrRAej*D0Z4MUddfAOd1mY=` zXXe2I&MlwwN; zQo0Noq35)dgkuxHdsg%=OZM#0gL->=9j|(}r-wXqowiqM=!F6_J>Q6`rajo}x?5@INh6xU$fC4C0&)lPUDu zw_WTL9*gWu!Dfn-oF2+H>zIz1Au~1hr&#PI__jUVX+(>E1l)AT6CuHkWyyBR_D27H z?Pk7w0eOjEm{uf$bxfruB7ht;HK!XTlua;Q*4Xj;ne9o2_G3`@V+HjA@?JSCN{s}d zl1~o&x4uA@AF}UzgQL?Sj#Vpt+hR=x^_@?MpeBJ)FqxWD`g-=2l@&om-XatzYz6_* zws=?h`dS;>d6Z~cC2O^I>TREybG{057&&-2V$FgB zN8QA?B6lTEE8jAG!wm5d2uTV%*jCdS+G#H3)5-pvAiv0WxawE;kfcnz+*1*J*1w(2 z*|m||S@}@3lGyUzkC41*76x_dM9FLZ-0q$_*t^V=?+%^3^xs+;A$3XjDcbLe({?>C z)x!w;+oT%t*w8@y$(p?!PLr_s%$4^rwY|qU?qu0^g=TtREz){KM{Z zN3jorr1!XGnuOKj8)S$_YuF8E4E)9B@O1zW`WnVw)5j*U1{ugP%9V(c@lvq?=Ab6T2sPFXJ z>5sooED_a`+FbL{zBwU>;N9JbpswFN*rA*%b>>Qr+sN9^Fu!@wQoJKrq<9$HT(iBk z{~?RMac%JV7kA3(m)L^Y4)5nGYpYh76g$U5Gec@;XHSXuYb28$^?L3#2mud?{k81% zKJ-&^Fxd`6D4|Lm$3w?YVHI!B%J=$c%HC=^4%K~)?%kWtwiVAUCE4-kmaKD_K0jsA zUzi;$&bCDwV!K;1DN6T+RL$x|$eD}RIZnC(p@-_u4rZ1?PT^IF4z19pkiG$yEbMQu3wa}>q|*S!l6D$Czo}}p668Xd4cCP`Z{;9X%FVwIps^k3>1jN>D?6RpslT|A;n&q(r;_+|(s zfWVZah;03f=F6N&P110fO+y}jr3cOEfixMD9#rJKM~mcQV87Yn~GN|_mX+cK-Y(iVE@bsX-`lHr7RMiUYk zraJT{&QI3ch7zCE%CxZ|16{S!348Jb{o?QytD9`_P$FC0r5^|!AahtXX13=2a`7Q~ zgkXHzs;WJvpVk4~$jT_}ch0~=SiW~3U=d>T;BicY2^dnJ>OPu(NNfsBTp-~>2HpAd zsgAE`V8}9=32%9Qmg$Q({tk1cs6D0Xrm7rmnTfi3g3STh_>j-|=2casupVy*WMPfm z7kniN?wV*4*wi8rzC38(*7t4)YO*+uWg$x!NX$9sd@=6$KqDeW_&)2kB{@~7V2QmQ zTS&d$rMZU+=iB0Pr{ZT$#h)@>Tq}H4d&mH~^C)May6?4^GW^BxV-_d%`^TjN(+Kh< zRnJdT0QB-Kd*Hci*sY@e_EaWn(4DV;-NG`|Q$zr0`3&nb>^7GIS~#Uj-<_Pbrr+yC z6-S+2TH2tA2XSvNeEr{ga5Z2)xc`XK4cdY3jM?vJbs zu^7m>!*?ZIRE=tOCn$-wh3&9?HQhNM+s}PI=Rf=6V`2Ls z4NrjyRRmVra7c6XwWtkCCDwE=iGtg zX=cxH;pB~7ok5(6qFqReozfx%^3-vVJ|ywt?OdlhH2p36N>-o0Rjhpb#}1S>~+wI#eGQnh>%wJ>o;#^$XzUwe?d>97alr{Qv z<|%%Qz7P>dX*PdA%dY=Y-g?PdlaGoOqA`&dJm*8TmfdPB1(K z7*o<7J(iu~44Kz@KJ4q~5{D1RRgQQSp|i|WCGSsKR+!Nf*IdWQYqsYSMyf<_EC^Aw z*S)X!rtev~zD3JUd2^{uOL>Hh>(ih#9szslauVS zbmDd7>MCJcn^m^o&;P=Dz=p3iS!3}!p4m(f?09WaeE^-!1mzJ8xUy698DPX;2mW66Y&J2wNoSAnnSz&8~njmX^J+)M~a&B)>7REg;{8U%6cA?n^|-^T_+} zU){pvFa9@9{%;56S%mNr-{~4De5_(Yy6V3A_M5#dov!b#(MU|5%bv5~G$yI%fq69I zh`Rp9O>ffX%UP6l=@-6@L349cpN_{b#4lEn?dX$AEKM8Cr)WdTg@!*=Lsv?cCu7k9 zN5HNX0i_yOcN<-74^8W@qCi)OUOc!lDO{Vwyj;mA6kw3qiNPZ*XfUedcDLszrLD09 z=Gs>Hter%5N=I?-Rqhn`$N(60vDVmjb2)+GJzoI;j2B0vV1$S+duLKZAn1D2dyymoU=5OjhAF5 zOdwc0G<{?bbVTfm?CmZcIA(NO%ZcrdZSPd~Q*k2&%Z;&ERN{!(em8T{FUCp=HYLXD z=O&@3_=ZLH8$Q7#sdZ$XJ)hf~XejT;OOox`^ro1#zq~WS3fV{2ADFkN`^b~Bt_ZM8J?R2sr1V8H&660*X zurlFirWipWjeT#G=8))Og^PLS9E@0%Z`EwP&KpvC(;P@t$2S&`WbD~lAnCElmjQ=- z16i(p5rO@5k((u|-d!ooi)f|9e0S#GmuRm#D6dRUrbfuqO_qhOx_3fxkau`PL?9+^ zcB0c_@rYhQVAo!cv~G~cV8h-Qx3 z)iC}wORowzuhvgP^kbVG?rUcD^dFbXGm5`A-Q;lm&n1HFD zjS9*?5^o`k%8q9ohwDG`xNy_2HpVFm#D>Ua6rS)pFuG3QY$dA>q&7w~v~jraw>yg; zrQBX*4?cvC`tg^g#4XAx=m)qjURg~|#5AD^M^fhi%EN;3a3F4C>x|IVqi&zu&JK^cs~^}&>Kl_b4X(Jir7Ye-vm9V*IFTW~+O z)>)v9s?5TLANG}nV(*U)`5GHvPuD+%j}40S($k2lC@n!x;J;!yJrZf{jLN+&H$RPO z?hrMetsDd%FG&(xz4f|o?-|C=GSOAAh#Fiwp#B+(#O6FOPF)9on!c*X@$mLpBB}K> z0GDLtP>1#fz;*!`V(2j6`k;OH#ckSDn?2E*E}_aR8<&1PlXaO}NJS7{YU_R|VPt4mBh1f;gtj$^exfHvEzhibkm%<47fdpazJ+4pWqj?s z-*8h2Dh&aA_|>qO7(n4j!5CfEwhCAQF|?(NNf&G};yg2%{((;yA`^;Pkutp42ql{1 z0xVBylSllJq(8b{vh{`YTEM5_Q$DFsvnq3a-^VRq%dU?ehu)Sm&OaN}$?R*3sDat1 z?HU2CnOiaikTC$;-u!)szo2+5*V+==-y)5XJUabjwuCwOrQBoSc7SNA2qiKeLT3a z+T=C@5K3R^($WmsaLmgtMh&0rU@7NXh{m#$hh{HP;|}MD55 z=KSjY^zM@;Tx1O({BsQ7q_1#m)!!eezmLg!H^t z^>Nx9e)O3AZ7-xPD9ZX3&f^x%k^B{O8=w@GUaFBjB>q-03t z*4QV})Jf2;;|*T9uL?j1A4hFrDu<{3QYESBs_##0+pXr|aHS#EIQ=A35v zW5Rp26Q!}W)+~UPe@DW)8kToIked3$Gheec?_NrY<=gDw*t#UO?-&DecHMGTVHYb8 zX8x$RwSl3Vr*T4?7`4~lWc!hk*1h}Pan1(=EDS|>S&Q($a6KuS>g~HqmT|JLy4^|7 zzffx%H{{#(10b!EdfMcqVI8qvCF#^)=mi|+WFr`!l`g%iInq!RIx{~&eruQ~N~YAl zk1B4ThQu467-?4G!s}2rUAw6fd@6eQWaxER6!@sn7bxEC5MzKn+Khopo;e=>D%7J2 z9exg8P_V5fsET*k<#W03KqK4SHcG%}`LovF2VfGvoE;a0(o1ju%CWtV8fR!t$Cxk+ z^+r1Jg5>CPsUpH%CN(9{4Gnq$z{a&=j-}dR6n};`Ls>b$CYkB{EeV&%Zt%61sHo3| zOo<(NIFTM-+3-jrF*bYFIx;@Q+x*lQDhTnlPN*}hFDb(utKAB3kuQ_V_fb)RS3Yr< z613|q7}%ZU+CPNKPK%Nc#V&gAO6FyzL0E0mvvHrw9a@kh*%Z(wX>War)+vNBYKW5> zSVUFG8?e~V&`|vJJ>+Z06lbERq0rRK%Q|algAt}*?dkWi0k1$OJxs}A7$7x$3BKoa zCM7Uc=Xf&Z$=|Q+7-}!AmcDN7@(c|+CF-E3XHF2 z`X0t*UVo%$`88DmY#K(dJEKty7*v7eNfB2dD$+DyPLm5gl{tSoZ+-4l@4DIcJ8-*g zTbe-;2nHVQmnDGVDT2ZhvaVA5o-dZC@IQD};ti=$ybg()+2i2UswzToJW=f=5}|5d ztb76x@294h>7(YtWj+^!fZEsm+OL}bc?;V=$l{OYWkbyl&s!&)ZoiafWV$ZbuWSs^eKEy^Tl>!(^ekj#@;4>=Zd(xx81l< z2DY|0^ST_?L$|L81P7K^U4wP)f6+Bj&9=V&NFdoLV)D0h(_o*n0z|$LnAJU*Ke!Kc zP^Pqa)7rNcbyKEg7u@Y zqt2xV3(Mt_=>1Or?EEo(na6B4HrS-w#tZPW3bZJVsC1vSo)16vA5_Vp+|sm5WtLys zdX=Dh8Z_ixrCYudUI%Pb7n_Iqua<%pKAJxRzLw)SnHFkZA2w`iXBcBMLd;Nq3jAl7i$Vj4$Zm0ZvE0Ut}W6^3W0C#WuxPT4b;UV`ic6gECX% z3Tk|kxt;#ZG$14hl9=cv;yQx4j0P;^9BUvE$jP&A#?&e;z*i3ZFWTNSEUIN|7i}X; zQE;Jvh=8;WNLHd`B{wQP#b*0GTWCq|!5F*z?aoZCXBXUI5N2u$PO!y^pW^d<;l2?|{?JBr@+di$eR0EKO zXf?=&=Wp%^Q4JdiMvy`qb$5q^GfhzW6U@nl76JSRYdBoX6jpr)KiThNcuHnrf)Iw% zF1F!WD7~JaG?rD7$_gCI);hK!E6R>?h)UsRx;GYIBz)TAC!Wynp~xt^ zq?ZTtx>4>YD;(LbQ!n|2NSk&o)>}M=?u)|RsFhy5a!Zp9V8RSt)i42Hg7Wl$%1`bv z=2KhkQ`g#qlKFcdK?>Rg@RM@-oj!LNblmd#*-}=$K@K&UpvQP`Y~B~DxJus_34c<5 z!fY34w9wI!a5-ffzOf^(FB^}?D%&chv%$*qvvw^zjW(QxkzNG$?=jpG`w|x zwr=&Qi_TMMQ3KL?E3T}}f8(N(haPSm*rRGk;I*-ypgeLT3}0NeNF;NMclj&j(_`;* z-L$Hsh|b5cAm8i-)-BJYid2d^Id(qo%$ByE4b9LC32)URJ*Rh84&L{5#JKNfcVoMy86O)U2vH6{H-d#RrC!JLcE3ykSN3>L@9bC$ zyHP%W#vJZ9Req^ja`%EZ=<1gQ|04#rcB&wjOT`WPnByT~MnvROJ)Ln%avXRHgtl~c zn~syobyo_;jss^)t>dXQ5+klyLj5JN{yYWRGz6$4J7PeRD>jxqQG+5JU~>Kl>~0LPU=!6!Ts0t;4oQHdny&bLEXGp{SV zzzgBsXLR6{V|5WZd_(%K_#8n0(S*PUcX2)y!8LOT3pRNkPC!rZevPuOdhr)4_WqL? zF#_4k$JzpXp|9cbT3szL5SjoFN5Ay#jCNds+0(JCK6UK9pL*%E#;dU^xNQ$UB1R!R zfpQq&PG~-e_>^+TM0}0MbsFLRQc+W&!tM9B_r9GXcm#zTk7-n!F3wl|=X@fbzCjb! zg?+&w#R+F_onIa=9$QYw0JEQU{N-!l z>s_~ZFw(sDi4Nu=-`%Z=xQOfdrsL-D>Ps+ovFSM((iyOvs(f}|WUBmZt$i%#)8)nczC2yQb90lCO04^z zGX1}OCBJ&K`Zvm-9PPGexO`%E%C_AoRIT%#GZ&5@s!Y#rK>G%hA~!Q5w`dx^Cml1X7N1rK z;Y;{cQ#J}bOuHL9RwTbs7(a3zU&JVHOQO2vC{~?YlP+@I;htAO6xGElvN%bA?~ban z($SnE(^SjK1lM>JoDQq_NR_d9JJ7<6_mkxQ7@ZK$9gQ1|K=i1wa#3jDOQ?jcw9)v7 zU;@aR>DedADL_UiYPhZND4}(G$OmKQbP5gZ4tB1=EE?>*;T~ZSO#rx1$#jj>ZuOMk zpGu`=hMAGGp2s|aCeg8+j!*bvd<6hVqV<8r(bnW{RgPd4rsTOyIap7xzR#b8mXfQi zNtjg`YWCYz$}! zWL^Gh4KR8>78KtVP+-KPve^R7>~NFUcsqAYALnv-A55(jJ|PVI5zzKC)G6S{@97~T z(+^G5{|%s#CK~YL9YAM9{egOXPZ;J$L`~%LHsFT>RMhY#$V>n%abOz9_&@IrDAFi{ zj()fVI1ddQt2^v(khnV^J&k2v?4cTR0pN~Q5N!2*GH8bTFOc||LUZPSqWvQDkCy&3 zD)~QQKK{SA1M=NV0HY^z|C@@&*{p|f(OmvLR4^&4;C?SV067$QpRT4-X@P^w6q}$R zr77*klcLJ)_E7THUW4g20Mq>5`vU{?t_HOh2m<^0`uJ2Js$KXfd4a`jg#!O>;Uz}B z-5>?4sRlR4r{=t$Itf1Zz7RAO$uvw#H;%I)g)T~|fjGf0g=;c?zHNYaIko|gY3D%Q zth6quN;|+45IH?9fmneTTeR_WRza)!Ds;9rqTskN;ep%Hl$pQQ(x|fh{i>u|BkEp} zOw~vC$CUY*s-a7t9#|v}b2TwhrLsU%By}3nyG*Z z)!qAYN{7_L&$XUDTzs(7(wVNoCCZDh)bw^$`?u->25tIqZW820xI`1GwQmgG@Z}fd zCInb``@!c443>%^BOC;dG0bPub|44*V?%4gFssVr_H?49aOU@JKpg`w!~T8XVwe(F zu`ckb{r^1F+in1Ym}+K6Y|bgl?;0AT>|z0b0{CA)a&(-e??2Ed(v`TdvlvQ z;=vt|srdI*9bg>XHWS-pD=V8~%@)BlyRdRKHVB^ZVmMNLq(x&}lSh(gh%T#Rhz5zi z7wHKP)?0cQ@49ulEKNeMNK&mEl!Ni4iVEr&HteX`&`35g&4bpYL6$~4smhft&PhQ= zW$h^yRn52jQgeM<5`Rg=XV~5m08xDj@HRn3+-xDJ$k*=IfCbA`kB|$)K0rY_SZe!G z=MONdcOAQLqW!qE^MjtKPHc>`jQ85>+$zTa49*#w%U;xQx6;&Ho&){&}(Jb*+ttTIuXi4 z!|*RDe?o&zQEJCQL%Ibd!KCn1n5TxuP+^60*>5@}tGoK_^ z1x%nRWg1*o$vMU)LJjOUtFb|FvoFs=q2$Bx_xF4X+hQy&Fw>mTdo{O{V^$`uJ#+PT>tgb^Z%j-h9_RnSd%ipO zae-fSS_Hme{(|cgL%rfNn635-o}mh0Cz!!SpZ&T(?LrnVMlP!wnD?6_dDH_<=I?kf zLqJ~qkpHKJZ;lF!TzO&JiPr9Lru_145-4KRN&C#p5pn>JrdGQ1MMGCneyHWT=uCQ$ z@4XVn#`1H;L*r?o8~6b7qGduotoO`6etc7E;Dzk)Lh>CH#1f!b)(u!?gd2b z0Ti?c((JhFzcEq&}^?(d-n?7gNPodzil)5eL`2y9h3R3aU`bftvYbZSP zEa<_Mpys>EU5n%rnsyQ zAEiN6!2;MoCAos!A%>Js(}fZ=v&RXc&!fJl+DLd=^NriqSCko2v*~5#aR*`KFy8j9 z)2e}*Mn~_gnFH%JXGwWDr|m6Khh@&fFn6QpgRO@AG1lgqy4Gri+as>yl&{rlx{Yy0 z(|K}-nP+j=y1dgcrldeK^oCWGYhsYo(Oi@r^<0!Mb+8{LS&_(0pGan3dqy9_@aenq z0&@_zrARCjw5N5%=d&7QO)6kLIjnpZ zJ<-7sVT>}wH0dvfIy+i(396L1>Po8~f3(8z-cw!hLAma{v8RM$(qQ%+kI1i%9_+t0 zS1yPHJb|h|P|j<+EpD?vnAJ!Vi4&`|iG-eEb0h-_Nq*gUEUs#ba;N-V`CXZTlumQp z(6h+ZVmQYE*l``Aj`^aA2XdC#{UGnALSb=k&f2?cP+P?|VZVuJJ^Sa3J@zGcf+dJ;0o_)kI9mb&8H-xx=g=Yf>qg4$E%c@u~lYPYO6Lv zs4@T~#NXEF6RZAcZ^6$0k#?rJxqf|OsEg(9n>>W7y4VG?s3}(dHV#zhbqAH;9$Y~p ze>;*ODDZCbIHE3B!L(8C{Wy)39(4iPKwH0A@y)W3a*yd}Ah zGW_Xz=`YRn^Q^oU22G_^6*D%pW~bZg+|1^`VAA8o#gje6|Is0bwMTbQ(LWaQ*YcpF z`CoEau;a&;Q;}o}YDayO##|_vl9yP3H5C+bgr2)bu^mkiOlt?BF7FhZ>-YKtwH7LF z#9tXPRoEnm182@K4e#8p7iPG7O|8ti%uGnJ+k%)=t1VI?@h~?Nt5;$FN$I2llN)Z+ zF>T|*rN$)M9?WqlUN)OI%WA7p&+y8smolV?#-6(X3(XPdlVdIy9G3$Ni}g)+jgXFr z`^*KweL-VhPX?xMbZn@_-xD@Ien2LaMq|dGB1@v#yNBQ`uzwdyWT%YkpG(|h{*hSz z(s*d_c?Ke&-YuYV%C%BcjF(Ernb=0wqsE9G?8GDnHu!TwbEFD7L{QG}HZZJfbz1bj zAy;6RM}KUPQJ0&OSRhIs&sJH2&G-QR-QSnEkJpM6A35xNb24aLf|&1d{e%rfvj!%b z55xmp8!;_EJY1UI0tezTNsVoNNu1N|yTdQasgrMZyzJDn&dVN8k=ZwGo7lKdUG5RU z(M9nfn3Vq0`lVXib^qfD-QuI_w=h=G=`Up=16Xr>!MM?st^S(%U$3(;EhmLkei|?D zv-^|M81-|bopau(KQZFU=lo>-bee-QXhCFDT#LUikyzN6RmxXV^#{~IrGh?PgLMxRIjfDz&@->(L4+A!e05Q?Y$VtyCjdlQqwc_a;?^3>pmy8Y4b@M8Wjt z2Xnqg=kK~<#vUqF`Roh!(g%0m<*JfEF}EDzEEX*<%;3dOVS!w z-Sy1o!SP`G0xO>w)1x~$lNtLYDaM_nVL@Dl#>dpQ@nQM$=h9Dd>x47=xayDY|KlT_ zX}C@C=6`X~Cj$H=Auj-a{eNP}TB(RE-7-qEzR)ng_5qxK!TkWk^RH{MrSQ_;at|pm z{Y(?19^l!l5(X0@6@788eZh@?y7mj`T~!7EoKtuMw&DL|_<-O1=Gy;l_|o^h#_4Gp zoX%V%7?`Gy#oDQri2F=yX7ItRIG#|Xv5HYFDhmbANI)tio%=-FfX zZFjMm`ZNwOX^qr)M;KY+gfUVjWFp2A2EMY?O-ud&LN364%*6pHQf55)+m%Iw|A zsPWm!mruNvw5)OCO+evmQQ8(3c_QdyD6AqG0rtXlGc*N)!c*7oIW^IRc)(W09<>so z$F4IFxy#s`%5m9`xFVAUVh*7gdCW7h&)N`p=m;f__U z!Xv-LOSHvQYK+EBwROKkDRNW`XE(-MNKS{YUn~;Rj6Cr(keP-Gs9+RL!%@KTM*BV$p#zc1+x)lF+XeNbcujJV21%cFsGK33iOscS&g$scXJlcu31R-TIG z_~hDLW8&5o)fuk%-oNL}qpkS{>Ffgzc1?Z8O*uP@*t&)!1DF8#%R5t32wUVUYZ?OmxaZrwq~9d`q+dZJ>=OB#HR_NOhD>uPs}y!ub=|_Ygw9hyKE( zsT_S;x7H%7sg*bgY+S7%Xd{?+;o*k|nlD7%Ys>haH%S+6yJ!%lR2F|%_N3Dku-)yS z4#05F1@H7QRu|7+XsK5S(sCTmwt=y%K+sJ2mR;`tDK*pKOlO}F)?mXoNN6LH8U7|z z@4h75&z|rP6iu<%hTblp2yp>g#mjSiyJ2NvTp~e*^cGW}`()70S8FEa0plm?*1Ci! zHFYuNO(Tjeb0bTRI>m&;%V90b4d>kaNs@((a_0i{`$};>vFf*I*81}g^*aQz zD$`wQT@y@TJ^yz9WyHf84d8iMk5irIdyKBdh5SLxwxt2XIK z!78C>zWNbS`{C7sUpykJ1$$*;>80g^NJbcK9 zVM*vU2t+|E5w`aLR6h9pXGB{J7d+Fe@cd8kn1bKG zoQ@)!7HjXI^yn>-hyY+-$d`u^lHdx>u4m17? z+C5Y(fjQh{$Dw;8sBS<$q$y{>9Db8!9%Y4EHG{LzeOWTCOhJQ{m)frc8TedHJ{dHX zcG2NNZR2yT_aKmOZ$@bXw?4m3aa)P+t}N%Wn|pe8*j-UWV4>3jQyNu1)rsp;K$5O{ z)=^u+xlCqdJmr}5D@UMIS0^1s3k{BOc3t%r5XifTZJfy7bC2Wg`}kTo6><_F>1$In zOQKa@Ruv&TrobH0SxuH{8f%sWNM0Lx>jK9!56=#z_=pR%X>;=W+Jop&mh11u*h%cz z;m~MWTJk_`74_96QB6}a(=Y4Lfn0nk zR4h!9y{W1mJl*OkYUSp=PReSd+qXSg)=Dx(!UR_}iins_uMIz`yLj0K&&=T~gVE%3 zc||pBhS?}r62LR{1-E*`gyxcI3a4Of#Wkug1D%|c#E5jjY=L**5;(1>`C2sFww|n< zvYMCEMf+tVgJdx|TJ$Vh4)H*hDNu%Ml1>>(GfXex*~X~%=c-6_PWUi&iDkX{9y~M4 zPwJ`7IGbb_Ey|FaNAUKTz%}NG6-(?~^QirG$OpI*t=XL<8pmBkhqa}-Co$=92)kGy zAC@I5uG%X@Cv@Y1>Dd<+xN*eWqvu{=^5lLVeqDcQ7KLfENY@Ri)RaH5Rum5A=d7&y zp{7#LI^497Vz{2+QcW@+Y}37Qp%4sX>wgBP0)}!|DIwSRRqws=Q94x0+Xz80^B=`F zObNVGP7>9+oi~Fz0A}+pK;|MEXASo#{^R`qk47N{LrnmA$|}&@o1XC^?XQ0u7?CR< z`Tvd?{l~}rV;T5gFxXCpP>SkzEq@J;mIGn5(s$M}W^9#QPjZr-wajgBlEOgz1fpOE zLwTh+DZmZl;w4X)0eYiBZs89I#P3hIvHp*ELzx`KuB>b>blv6S&$8eJQVSDJkp`16 zOU(^cAJ_xg0t3Ot%9xio{?XFK0+7UOsG?B5Jw@Gydws+ao!u{PSvRuIKGOFKxhiPS z6~j2&3~QQ!bs_D|e_nwc7%pb#FJ|x1CH-8b0PjoVv#4AdtLHC#zyk+C_B;DN_P>YP zQ^?7Wz3T1JLR^%!FE~uM&|e)lSA~#0u}w|`e)sEZYz1oV^fe$~*ad!2Hdd6ap0(c~ z1%z2soP62L*%aXGaoe6}v=h#cCFK{BR9WSn<>ml#D&#RG45hr29?YUd>2?VadZ%4{ zrSr3VX99;%|x8X<} z|5g`^3O_#~pMTc#BX_d7pv=*0F{ar<=diuqSDr9DqpE{ryjO6qG(kp_y`aq5JJ$+3 z9ek7}VA%{&Acvu<-XG7pPXnI$9C;#ilrOE^-E4vZ_@#f|!Ae*aL;*SQQfP)1=( zYN7p4@MA#sx+pa;iuyDS>R8Wd=#x%qIxbxd^i`0DUGh!4 zBdLNXlST$+-$r?zzS#HZbB_y^xiKRTdk?O$If>N>*ND|f*5E_V{9xtImk07!2R|Ol zTW`&d*KP~+t@%?ZG&$|&CcGEusxLO1{Ti>|aQuyGKa%HQ zT`fr#q9E!3=~2CXu8o+Dqw8<7B%xL-O**^<`4oa&v06eDxZ=@nNBY{_#mWr=8VSJ>Am*Q5=+Y z{`IdK&8W;O&z?y!CN_X}UoQjuLf)f0$dA1MYuVZ!?Df7x@9h9zN6lpb*R6@9@KD`S=V-HTIfT% zBouFXZeLsfw%%;jrZUF@R(=`Dz7f|9Emfe z_JWWL;KUjB8PKCE6C9Mau&s1ITn!0Zk$v-U&vf^4v5(7pv0MXm5GPThDI}rZT*HAz z7uvG>t@?oV%)zgAqhtS2!f-50qZ3d&h$#OC66bAj13MD{fhTR+Mi`7dw#RPUT5Bov zF>+vwQw!uR_?^TiPaX`t+U!iMSy+2sle?N8YR#MGW_#@!9^6<6Gdu1XJS8~55f3u| zj(o~kS}ghE8C$IiOaq);Ri#F*5KO89ri9sIlJ@Lh&ZESwo1a1GjvNsFFt$Cyvxc54;T% z*E;6USJYDuGU1JV0!Hni&JtzAN z4r{_)bLllX`bXU%l@?vvgtZc@J*$`E-EV{VjmCzvP2y*riiM2*OxxZuHVRU)f6Z=?VBUidCJAP;6%xF{v(rRd7}yN=Om#8@7LZL zwJNuw1x$K2rb4BWP5t^K?5f3=^H*r))^d~OLQU=@H`B=n+5U-wGa4f!{vi{+HZlHO z{+Ms;No!F@M^#l?_C2YeFp$TpFqG=+(wtMOmnQn-+|6%|-tKR9pmri^8f|dQh%k-J zB#-l5a*|#BtdTac0h>!vv%NnUG`!D!OaH7qTtrF_Xtb1XpMaJB4*9j05t2~G!*6Y& z(t3kuWmVVJX?D&BN=fRbekV)->JT0LVQ^H55XJ(J%7e-JR;&5y*}+HUQlNcSyWME; zd~M@we)D4f8iMNDV>s{~97p^UesN;uxo~8jqj_PfM@Jc~NFMkD{1`yR0oaW7@Fzy^ zoNXnk1jT|P(hlX#w~)`QZ{AuDDMA_=^_?GhlF--XKtd=ZIxk0h4tn&*Ln;cium0?E zF+SJ;aL29F#1E90L*d`mUNTYEu1SU|H53X|+m9u-k_`G-$zgV}G)~BCk6*!1jjl_n zg5{e)dNc>@y%zp{2-mmW?J5_&nJc~)U}3{f~`j~gMs z(tZyTTR1CaTAu{AU+Nm*$H9`j?#sgm-lNz;nt2GmsKZdpPiwb>?tC?>FUQ)jD#U!< zVZ3@Y{+4QMu9~^)&-$2M&5EYOhE?A~MQy_Qq!k*mAT~-BoKn`lPUafr%`>}S-+e*2 zn29Z_e0xp+8QjnPfQgcaAU>r;*;L( znk$_MT4xrIx#OTxwzHM6{Q>#mAH_JEz&qX{+{_R>(uoy}bz-(!;Uw4<_~Mn#-cWsh ze7QDvGe}ZAtQ!{52@aDmx3t{EC#vumt?t~szWmv`wAT@x!UUMvNLYYacN*Rf{$@sM zvCw|6W0(L}*CW0tz;#)PsA=LX3^}Vk`I?2~J4h+-=P<*!oeL=k=wx!EHPwe*3LVz@G<~I_L zU~*0$A#%A;kNnxIJNNy>T$DFdp3?|FOv;QFKK&@SrC& zy-tgNqLRC6jHr1e6trE>=eiRfd9zH~ZQl_HfO&lHzNkE?KR(|RnswNcuziY?^aiR{ zo1of>{k|9W`+{?2cksZp?M2lBkhiVdNbvt&9#*M|7}qjrqCi`t)06$=E_MeGC+K(# zS8?xDwgl;=L56t$OFloTS5T=2Y{k4y~ysbi=a}U zJ&80B`$8CXN^`y#a@1a_Y-)j_#VSe`#bNxQpucGBy3ou;HEDLdVTZ%->LP>XONDZC zd9nPpQ#f;iRz^1f;nOEdX>I4K$_eeTXrJYU9-mfd&F#l?S$zfEh-V^Qxd?@n{34pH zclo?z>R0QjIDIbMU=q%|TWOFfZ(brSE{C$7j!hoL8q7{tbof$!aQ~qxeLgs{IP}E- z+Yx*Bg@0(!wkBkR6mINNKj&%~@!Xjqhu>wV{EBRRi(KH&vaY?#?L4z={mUHf@1DT| zMl_+~JgEZlnrs{VG-Gw$*S)xy`V~_9Db6q`z8x8dAN?i(bBP29DZl7fRmFl?r>t!7 z%b_%2>R`AAMVLlu_x$G|dWNc|i^?O|bP>QRTg0>bgYkM?7#Ne+@5jU}5+;kDHeioR z_f$$5!*a>4EmMFKM;_7E8?r1R4|u56!*tSLDl<`>oNPOgjR<6 zGr#dd$0~-GGDM~tUKGBr#7zbdou$SRT`P4KxgAvh@@?<;*W#)rp?o}*``a9{TRL;K z@2-v~{G;*2PU8irlY#1u&3q|KoT#%mU7ck5RLroHwxaeQvKN)x>PUp=cp*%)ml1GN zy|0i*7dHym4EL>uD>Fni1?tO|!&`$|#aS!2HZt^d?vH3s-bucy>c~8n_ICiRJmQbP z%3fZrzJEZT08_#%1rYrLAWns=+NkCNN;^IwCl5xes>`cZ7L(-pRFS&;9#0(RDAVRS z=u9bfNIiWR5z)MaG$hj97png>b!uoZ0MB&lGi0nhCA|DH+5zQedUDpIC1N*n$6|U2 zw*b^0?tt#J>aX7)xiVb+dPoJ11F}1@1j|5Sp7^5_XLAGHnO5p2FDv=;!_Qgfy3$Zg zFx~#qUug|Q7T}m}p;+z;SjhCU2e4rWse<4bsW|$rZ`D+^Jcbj)uU`htk5rV*(x=2s zp}TFa5bc8Ec?1T65(Dt1Rl=*|Z|~;5)?YqMeZ2~#%w)<$PRHSNzMQXArM!F(H{wG* z1_&7mZZs1K{fMP}chx*EX8|HceCRo1 z9(bb4QPBPux}-Y>a88u$%u=tC-p-hGB7P5X{94nZY=9N=-8=s^`1N1CCYkMd6Lw%x zX-t$Cba6eD#>`$o4m$RjE+M^eXfE?es+W5%&6bzx(21+JrhIIx$!~fPhLXCAxTmHM zG*;0eFPn%gPP0nVGeulA90LKjZ=Gin+! zHYFajn|i0+>P<^DtUT+Pktw?&X8gPM9Rn%$D(uY3=D!}UzhouXA$jko_~yTY{RsDlxtflu3}j`Z zrICWNe7sSdj)_7|{`8sq&DFi(=K5!jU;|Quw`aQ#6Vah!^xLIDnAvbWxp4$zXNI<( z;VHICOgL;%Ko4xv!%z|-rbP7h$kk>V3&R|T?)@XL{b10xZwcT{(ODS!ms`#?Z1z8U z9&b6((0IDT246vGn{s%c^n# zja5+aD-(QG6*)IOjfXc}7U$1p^LCCEc}`wXou*pyac9R%tPY>Yq}ur*UcKYpr(q$l z3EI|&j68xHlj0R)^%8)yl*4~qwr_PDR(-)3vF3eGwg}5%LFPQ~y22j$w9HWxE8YBP z{Kx3@K`*W|Q9l6Nu+&g2d)_EbzgS0SyV;V((_Q1wZ@5$EY>JRpl4%e{&$i2@uto(} zl<4$T(PsQ`vkAM~LZznBd|1>uX~UI&{iIN{b|dZf$#_i!cm!E0&;C(~H*lZw5Is3P z7ZEAlP4%sHssU8^T-7#~h4RATw{}@eLYvdn4wp<42ZDqGLXfdV)0o7bLS5#jn5tZ# zzM!fAst=P*<%CP!Ye{s+!mH^{%EwF})`MZ?^`OpO>1HS$ZMXJ%X&MS}dGCE2RUTbDMCEWqD{F91=>Mw#?6K4gw%zedGyP;+RjPQqiv5p|VUrL)j zbBQ;6p5dtJVZAs#e{WNb+M5YBPe3B%Y#6ie8y~2xaCI`2>1@N^E6VzA%>-l&L`-_i!lQMRWG&%U6js>;H9Ja?Id-7|;vRkMKUTZh!XZ}B@_w~;` zBV!+FQK?!Z4u|U8kEBxSvS(z0`GMLbk+=;y|8&3PYKgA3JJ*M*p=oA^Dt`tWTDqOt z7VZnH>B)8%C%k!wow@0jfCewvMFhs^+@4x+$w8~E3JQpXydOG$B3jWN)n~S$8WpHJ zPFz3TQ3|sJ`~%>r`Yd6cbY_}BT0PmMISfzivna{lZ@o5vmwEngUtFzF>ri@&Zm z-cPtGmyqSYYt%AL6OVA$`9T=J^lAZK2>1&W( zI03PPSAveFM1H)F5KV}&{8F}!j8o?Ej_g25|8&@1KDRFdPtGFA#DQ1|s!_N1q8l2-`w-GG36%jmeWg(UM_&%HR@eQtM7^?e82SEW^LNsi$tZ;_Z zEnnwg20TO-JOt!>+@@(!_OrQ(ydCh&>}ttcF3p>8<2&I+l=Fyg$4HJcE1pt}zk!zu zX3wQ@6NJ22?z~Cv$^Ys|NKrV{q57&Ng?z**(@K#tj|tDq0a%h(PB`&w_?uVo0JZgw zXvzB9WUB$gM^c&05w7%mpG9LTT&AvYPB!jf=J0N_3N*diJt8l3e6kq1Hc~Z%BdU0f zj)ciadnjw0^d+@3Bgxeye7z6i9h%?gmOBgb2;6=yM`C1OPX{XM&RSxrts^?So&_@5 z9PcmzcNe<+O-;~9FYB0O!kgON zAGtsC^#!)Md=UBldZap7`gzsc|?$I|nX~vEzSQ%*E3%`6}ef=;;C)1iT@7~Hr&8M+faIiAZAcu3;&h5Ny zG$^(iYe z3k#(X;5y1KD`O1_O$MbXW1F$F1`i*TB$7t=KUW{HEd+swD<5$5|JXlwMi+f4|HS0; zJQ6W^T|wH}lhQclNbQ1pD+wfo zD54WSb9R?{&Ti-hh=Rk6AyEK7EDm1W8>W zVG-UN&%WAxIdOFc=(AMgkI_-5x}Q(THH1e*bE=vG1$t%9sTWT+vxn;Yf)gf4BMY;v zG}&`b$NXN1nH6p|59Jo7Oii9Al-`0o_k%fSPh&yFtKtM9 zBshbwQX6+6dqt>&bpAY zFk!VlL5WK&C^b}Tx7uGCt%#V_zliSlBWgKWief+y2=ZAMWP%JV4AkX}5M>xr0o5sm zX3otT&p!l3gQSVjH<#nD2FlMjw;dB!)3&%zT!AFK{fPhfY)A-KMCZogZ>k@9QSP9o zsC>gB`uVZlEJ$uO{-j~m1Qk^sgo9#1NQvdd?uyyEm<~>qr%B_>QYrU{4kh(UWFmlB zIGXZIZ~w~Fz5ipO^{Kvr)$`?SA&c4baqV+~sH*)${f**%LI^Vm>XjJ`r90BuGxv1^ zo|g9HOr`UPrrCOX%*CB8>#zHN;eRK2b=UT4f}@RITW!D+sH3!lYO(j_jOs$?J>1q) zQ@co#9U%dqLH*4+w4KmS{J>Kjp?ZQ|wcV_L^k75iVx)A)VredzRqvuaHri`MNE=86 zPXadbW3C`Y$5{`?&d?}Xy|V?2IN1#n-Re@e%?Px1HSnoUsOQHBzuX70!n0lO=BZwU z`xzdpR)fvG&11g)xElRE+kd2JadB1PVqE}fBCn&?pMU_KCRuf`qVv=M_qc$dte5+X zKI^?zau)Ul;7hRrZ5owM{(O-Sdnz^9-1SZm)cZ%sv>Rwn>)Aof*U!lDm( zbsXC2qR}^7VKD*}>uo9B`U&-7nRz1e)lzbN%WQ|SBMo|XBli&FAuptM@Tm3vaAXe7Or_MPQp{ju|$6>%@UY6?rrffaS` zaGQuLqo_y8jRkX$ov%XxyntZZh>*YZS5-;TM!vDqmd!#{^LdZ<<&j;F_n7kl0cIYF zR&R1Rt)I8KdaCR;zGi}LMqJ50`?4-!#<`!C(tIyhMAJjY${puJSnPhJf#2UQ)OB_h9%!HdxeZ%G|{(aK#I$&c%(;`hTk-t@^b$)j#p4#K#+HY4Pey z*(j;1EUx~7F}Er(JG%4;Zwu}Z?~mvwhD3=H@w5>DkWE`oO1^bo{s6vQc>2M?Oo!0r zQ3+BYiS`|v?NxK1b>ZKC0W`~%Xsu*2$Qm)+SeM`7c$T#Bv=7e0X^D$f>bosGtU><5 z|CI?DtGm!Aw^|K#;v#d9Xxjbr%`K2STpeujnebkE-WOtNTr3+lkaU`yiv5Z^IOIUq zxJ?xMoGfh6jyWSVhGvDqwb(EosJUiYmf^GBA&wS z^KBPaEM{Jh$4YHqcSkEb`pEg*O&)o62IA?X(N;Tl93bdTkAP{3xQ+V&P|#m(b-3cM1Q+fgS&*X5UTQ{v<$Rj9PWPV7c7w z8v|wdLXrF2^&p$?e@lk0zS!3K!hA9P7PUX)6{>qKQgS}_sMu%{q52vIiQ|Q#MrP7( z;B7ZA1Qn%Togd5d+4S}3d(X*VRU!vYLE-0;1aA5D72s?o(wqrc(fC?g$gK`cj3P}| z8N-q1E+D@xEhlg|9qxS)!|G*mEX(aX3(2qsSuN}YC#c!62ugLbc#7{gYw({cgRtIy z{o{#VWoYf9v;=o#Cu^RGZGnlLqs5HorX~J#Sar6IWe-FFg!&;bp8;7wb6S+Ao8SkF zj{rJ#`xA`lo0BlWINSi2cf8brH$PkhmzT+(MX!JR04{NI0L$_24YoEpI8FPPK%tG89-YD#O@YgyxGZ=%e_N`j9Hh)mP9SJ9~qoKn!8ud9^H0YH%4 zJI+q=jL6bI&!;ZWF)rLm(q%MPte@>=PrG3XntuMS>_hIj!t|IWUPFITS!o;PZlCC3 zO{2nhL{q;^Y5hr$;SrMPfIvcVFOE(0X{*q=NWtTQ>P78Y>LNVIySw!2`!YSs+%(4a zK`T=!F%0Y#;t$O{;Iy$>h(#I2y+3m-5)$U5ySC-2h>N>i>@Ty zA=`O1<OrqsHu-HBjjgCTa;ThW~NRU&@+YReO4Kz%qP?w)uX|{q9 zT{|X**i0%#F#EHQ>leQA_$`MmS0(C7s}{H{CJ(QwcF%M~{}|$mGm++09T2UTl@oaDrNWNqhWj@kzZeXNJj`~5H!_sWeKJLCW6Xw zqswces?C$eZIAHHjR&g;&uR0#%tM1rtX^0OjVy)dzXTb zO%5CQ2b^PdE%}D)47`WonOu)ok=2~i_i5x_jLjY0l;R4E+EV;leQ^!)*nT&ktrn$uCG*6^=#adtET3GJFu!_Tyr=#y&#=-@F&UteD- zhna+?rts0Iwn0R?i~xY52?(9t zqYdQf{*#%H=jwbvx+#DmLDfj_3}C@Nyv;ZI8>*G?zkm3P&0VEt5 z4D}q=^-L89TYFiFDeRwy&q=*sZ+4KV#0^;+(o+uI{s%138jB4aqQ-9Dl zpGeR{TP}9F?FeH3B@sFeNe=MadAOw?;;tMEQ(~Hzn&Yb$dzEEwDIXynD+@J>5vAR9 zmOLzMY^A2Dmp*fv+>4TAlO)E05C;>V(4Y)s&qDP7tQ74#MF`e!(b)&ZfQ(UiS9L+N zeoDxx-ZW)|RboYZ0W3IM?eF1K>uDE>%Omq>7+pG)QFs42x>0rmB2d97O;0Q*hd_iR4Kh+5T6GJ2 zgVygU?o57WsUMiWSn!_091^GlpHhSI7;cU3-12EDe<)8PaJ7~sI;}JxMp+j#Z(LI% zCb${ym{_HYRZ1jAN9AsJ7!9?MwppX-1OzwvlxB_m!)9veccI##Bs6D(RVDPAcx zSEQWkx)_nfvH9*$bhu(Peu!(4{Kc-pWcInO>VT`RzGC#!e}x^KG{m57QXpJmtKiEPr7?0QPTXN_ZnC_?%eg500U3Li&-(*UmL zN(MyhgpXsrUbI_Va4B}$&aW9{I2#dCZ^m2C6SPyRY^;R8&+zHpR^%6dT|_>g?po0< z>{lVS>%36soX>1-iLON32Fo0c2c89wWnnOVbK>z!@o?Mv=|#<*vZ9^VEQ;i8_7i zF9BJ9<{NL8nZ9Wmli;twnL-zpW_Z%X;2%P9k^baZTKQM$Qv@xZkbl~^3OL~2QOFn@ zE6x%`8+aDXQpI=O;FL48b`dNHG8I@Ym58DW=?kKGQ(m0A?GZQ?WROh*&s;!fiFrfD zw}T@vlNcp4ZHDm{b@~6Rv?~uwGJD%LHB+OLrWM*EP70a}np&C*ZCZk;sPvE*<&ilOY zx$oz>&vT!Xu;(rz@V*w?pyA$l)@G`nc9Bx1?bH&AwQsB<)Q8r`0eigjbx-wbj~45D z8Q2}yabt4**I)d^D3md=7i$T`sKTPFJ)Vw4rFoH$8ahlqc#P-hBnwc!-u?V;{$PE< zNtlE-A|pQ0_4T*GgPGEQYEcukTQA=R06ZVqaKbfJUX5I(HmXh?R9zdX{2%?djG+!% z&5T93+MIOjM}z_+w<1;S)3BQieA}Hzd}1 zKsXG&ef)qM*ZIQXL6)7rVnRwtFj1zgl*VV5R$}M_Crq_a$uEQ8paK7vW3r$R{F8Kn zZ^~5q(j)6)U%Ad7sF%Ad%o=Q7N-OyHOB^%o+G+J2Z^~fZr5^|#edF|~kojfMZ_BNH zni9Tj@zL~-eX--bx{o;Nueg_f>NB7#{KAq^Y>H%TfBUq1X63rBGUH)_DV_Ht3RtEh zWQqz$D3;R`wbtP%aBrf*y!3_ny;9?xGVtzQ5!wXa0!c}T4PSrTh@RYl{u9o22tn;% z>;?+3_XB=gKM6af|M5yKl9W{lUNDshO(iw2%Y|Eo_a9T(TiG~+1!s=%nI2rqo-sGo z4B)kl?nl)*4^;=cpS&K4%Aa{BC^tpnM z4L^UU<{fWJ-1FLtQuMWE2gXZ!MV4n9vfeI$- z+${sP{`X)TiSvu2LLqv0>SmfLhQXq%p=-YmC-=()VLUW8E^jrSdzb&PBF2xrJSgy> zpnxm3gnNbi*C(VLSpO{jCL)$lFO&X_IuvKEn}yur8FV`Qg0&7t$Ta!sf8&k3!?jks z1Lspy!8w(+%PY^gX|s7VyY8~}eCr;FOPjCP_`=C_&xu`ay>UpVin1g=I*~T%`lE=^ zBlRQC96xOL0TJ%97Xr7D)R0*`2`M9R?RjWB2$nc+za$&0gtgW?sbC7+w90M)a{q;b zbd7Pd_sT#?qA_74OrR8Ps!=>_8>ra6@V_aXyePB#Q|u$CiYK*Y{M$9&XI_w^AwW7H z16k~K*EC#N=ds4T2lzaCK#QmF9ZH6l8sp`DNy!SXc=6t33f7&nOnm#e@`GY+IAR_f zd4pFxGn_hHJeY4xI0z+)*YC!Y3}4P+$H;uB0Z4buW2A>-?d;)te$Fr)M<>U2J|Jtk zaYyRp9qf9#5+ysYBaXdo>`;uvL!D5z8CmF;^dU*{26=Fmh2vuwg` zs%(_ep2OYloneZ+&VWWHmCYN7^iA(xID_~TNHF5R?lDA=+>)JJXknm~ zd+i&n?cQmaNGhG_%4{UgxwTgTK9^J~kA&PjgF0jc^tD~5P|=()?> z64Kff#>o4bt+O}M+R`nNL&f^dCOIYVQ~IniCF=F&1~v^(bF$~~eTR9B&+^8f>p zw~0qN`)hEA5*%>5^cvw}v(QFklG^x?yu?)<{{~*45OvA}n zXST)2Cf_^tdI0ipH<*uCkukj^u0b`7m0>3_kRjI>y-Y?uJDYuvqlRS>rxnoMo8C!c zK8=h0kzeVf9mr~X$b1+~Ft@EDlsMw_w`NQqtc@Y9Tk7aI0EG7UQ$?X%q+ zSArpFu%r~vC&6!tXOd;SOHFQykhvZ2zYm?HEu-x5YBPO+lMEP z&ZNZQ#YZRPXt*U@6ZcA$wbjg>(lG2 znA?Q+X@Y9(3qkfIL-$vP3PcWd3SzBBIc2x)%3xogG7?5^@2wt;dH~fS%2p-)FXoW{ zv>Sy572HqU>~dp<>R$6Z*Y4!qgRybIx#ITwV&Dq;5o>0y-hKxmQ zG*5(CamOa9D1V@|-7haMfRdgLDg7$um0@up<_7-HB?|mp4Gnelj#K+wsM0*pSIJ0y$xKCz2rrG$c#Vf z2sDbhjq5MgSG=a*^626k-3WHEKQUjOba@(fjrQun)n~LIZzb! zF%te~?wn@4ytc_xE>_ba!+c8xPd9Y1aAeS^B~+1D6~$PeT=QPx$%|i^VOtU@b2sxkJ2;N~~%qmO85Ilufx)^N7DwXx9vpYii za23TakWEynuT0aQ@)u&Xt92lHVLz^EVZVCF>4KvW73Lb9(O{>M-<*oti{Nc6FP))* zi{!60I}H{S_wqq*9zVAx&lIiFlL8GJ)gFoA^jsJ(<4Zx5uq!(rZX!cEbIptGa=gbC zXsdc+<&bpF?;%o{iRvvu7G9Q8E)(%nedbenT7j z)c8TabG$XTBGpuyy83=N_oQ2tyGtD#{O(spoQGs5BxDZ@%P@xrw9R+CQH^1#MrNI_T;jWA*B$V&44V(A_Pkkd z-5~XHt8Z!@DdXYaa8GgIvs+3H7WwIVj_2hZ!kgtmJmTKvJeQU~?4cJSsyYG4QOw?Kp+in#C#=*4Oy6BFE8YZvalt&8%W^BigALl*V-U0GE#k;X@)FqmfZ~ZG^zkK}|mTy%Q zx}s8H#Mw3fr@ej@vNkHp@D25}1Pi!G3!_1hUzCAhDFd7CqwISpGY6bbOxYY$4!+`j zlbBSs4}Kn(kvgZOVee;W?SPB5d)vrJHcGLOUy#a+uB-sfIr`qzNQ8$HqAke;EW2z! zq1NsczugB$&K0VV{48UiuKN^}bcQ%nfd$K-${e!ejS%{HI4p;Xx>5%!4{F;FXs{x) z7DkrAgOFQ+LlI8zSY$_}=^0KVXD)3i(8?~YOwoliarTHgg%ivT|Jeje!rL+)-&#Op-Z&jx!M-V-;E zcMRvx_NMsw>d@CFB%0{|#&*AU+FzQeTHFPz!VnH>vn3DeOe^b%i5RIwh+cz}d&Y|v zST)h6)7uV;HL8k(Wk2Cdntb3?3=48P%0c2Po0eGcYX)8p=kvDCP17BZ(&z4m!G(#9+G$|4H@j0(SE7-1(ynxu1{&bi%f}*{cB9w5Rycvgh2$W zS+^$jp?4aqj)a-9w_y?rjHU$s zL0ox*o38krC7W7tho3IGN*?@iKdA}*m^8r#2dPct3hirkJZHGELb*&h)APDvRujBw zooWtrZH{CamQF%mAGc|;i+Pi5SN|K#nb9G9uz}G6zR%CvSEwk4EC(^y-Uelk9pmO3 zWGsAal7x-Yvh;Zg{twt1MWi#khU(jgFA-dtXLm5LbN61{AGa; zoUX2D{pEjvyj(j!pl44i6MxQ~&V^Je&0cj_d}*+tN_JupxwVCQdsmU@4lwth`>27Z zW%f--DC3UpUX08t@>uyt4zT-W5F0KWR$k-ww(zj6Q&vHrUaFaC?Q z(Gp`RngxF&7{P9BwIt)B>9rDuXXU`hvt!}!M#E-5z8h-*J5m5;$qQ7IBAdk0-7qUc holT^r&+EhIHRW@4ijp?=A>a!U^id1r(jzXv{|_7!rpo{T From 64c6d0daf991ce3e9dfd4c52bbb9900db5f82b07 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 18 May 2016 18:22:58 -0700 Subject: [PATCH 328/439] fixed formatting --- windows/keep-secure/credential-guard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index 60e1c40749..cd7d9d5707 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -202,7 +202,7 @@ If you have to remove Credential Guard on a PC, you need to do the following: 3. Accept the prompt to disable Credential Guard. 4. Alternatively, you can disable the virtualization-based security features to turn off Credential Guard. -> **Note: ** The PC must have one-time access to a domain controller to decrypt content, such as files that were encrypted with EFS. If you want to turn off both Credential Guard and virtualization-based security, run the following bcdedit command after turning off all virtualization-based security Group Policy and registry settings: **bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS** +> **Note: ** The PC must have one-time access to a domain controller to decrypt content, such as files that were encrypted with EFS. If you want to turn off both Credential Guard and virtualization-based security, run the following bcdedit command after turning off all virtualization-based security Group Policy and registry settings: bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS For more info on virtualization-based security and Device Guard, see [Device Guard deployment guide](device-guard-deployment-guide.md).   From fae827c843c6a6a67a7500dc53a03d20eb02721e Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 19 May 2016 11:25:48 +1000 Subject: [PATCH 329/439] edit image --- windows/keep-secure/images/portqry.png | Bin 68569 -> 67815 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/keep-secure/images/portqry.png b/windows/keep-secure/images/portqry.png index 227b201d83670dbfff48b5954c12de6b6310515b..e14de2dc2db9d6d2c68951dd9967796f892388e3 100644 GIT binary patch delta 23810 zcmcG#Wl&{7vn>dXJB>Sy)3|%%+PJ&ByUT9ep>cP2cWd0Oad&rj82Y>SzL_gvFKAzMxH_+`G#D+A4^UJ4={TVCq#r_G2LHVCjX`P9Sfbo zPMjT$ugYZr43?r>Oa!5!YWYl0GPQ8H-;mM9FUORQT{;Kb(yp=VPBAbdA07In%Q$=g z{uBvTaeUrw@7YXItu^?GmgRLxC#F4I-suABQ6JHD%a$0yQ0;tzdCIF2sXLdRI^QH( zz+gXOmMi_SWNtwefV>?n?62ZKza-t};b7D!(KHhblv-T1;yJZ>4)A)}P$0J9M-uth z>@Y#sC5y{Q3*iz>x*r&SEq9aes4(ifgT1hMibvXT&q^ObOdV;gJt_|0BAF4#;s7tu zr(e0TD(-4t6o`?dLR=UPNa_)Fmb4p4#0Q6YI$Ml)r- zD0larbg|j&aAo_wu{(&uh#cM&M(=WJxYGzWyRaZPU21$;Tyh&eACt}-A}5J8tXRav z*c`Vb_Mo7#A?myZdcTL4UEF#{qkU1dt`d#{Bn|}Vf5%!KuW#$tuJgb1)EFMZ5mo9U z0_VOST3-S2!7Mm)c}5yCP;%g~re$mQNf@Xl*-e-;Ec>nxO!zp2mtH~oVRM;K!E9+L z{Ee+i6_iNhNs*U_T*kS1ygbW@#~U?PyeFXIataU$%B&IW#~O4OGF-ZPXSP~xOG@tr z0vGXo4lQzvn=?0eyYtD(vuCIS)IOG2-Smy3(geMd6YJ}Z{Kj(NGkFqYa^A4nTKS%E zb;wLVd|dWbciJ)|c zKt>l+E+b@(_f6X3Rqg^+aVczRSd~8CB+tBHD6ZUXvXtm;D`4bk`^(?CJ0UR%!DA#db*}Q7>`@2zdQ7mrV}uSm~P~8*=L`c z{X0BWlEi4gOs2)|O1#x=;+6U3{(^q6;+c}3KCkqaqknI%8O+14T*YrpcSE*Rp%LK5 zXWU7St2BOzasY{#S7REKA+;Rhj}4B}*V_Mf3u|_3QjVcGdBHx70}acR-5u6{nxh9G zR#c4RaW!Whw@!R+7O=1`>c7x82A9NO{7U&Ok~)pMBOb9Jud6mx152NyFK~FL!SCOX z6R}6#CWh`;(XE8JC$}~wC^1b08;%PD&V#mho?oIUscj8mY>ciHk0x&jrNpNkd1fS| z+2@Wr7{~bSng%`fkk1HQ{+&FEU^H*okch4ioPTW#U&(@54Pc;4$4~Q|pE??gF^Z5H zoRRD6jCEiMqAVZC^f;j|gBeX8=#L|3BsT={h|KUy*RFRmFR9>FH-wRPp(UFC2JeBt zpZzTY5^Vn)wdh*P1AbYh!hJ#`gZ=v5STai}jJi;0qXmN+ibRO-v7bSh<(B{vwJAzi zE<;kGK`A{cQGf|7IKt%h5-kFUA&8vGp~s0y@gz>?E3zb--)>fd2CkzJ5rRjj8#_ zK5blN|6mHwdfUZ7(O`4@0HdEd41QiF_j^ImfBc3I1@KPn%MII8S)@{q(3225GNFpW z>zg?cpC|sLO5>7enUb?lPfe^ExAs^G8BUf~Iw4ZzK=!52DU>UK|$0by>6;&m){=y?1G8YFS&PxVigq!x6_~&C&uWl z1hi*lfJ?n4yIw&&rrtX;P(+hU^A$>Ci-~$r*%#7Xhn>jDm(W)BF_?iH&csb|o(xx2 zXSDE=CCf7(FgZ(+3n}bSZrp*|0y>LzYJ7SWfYFo_q`PaKizOq-z?834nk%Rw(_e{j zn9HNIs+z7`)B3u+(g+zzV#5J=viU_39eD_8bdh>2C?@Y~v!MJUlsxMlIdzh-1sP*= z2z(hR<-NUnF0Nvl@3}QQQn+8d;`a&qP?`N;NM;T(%?mr*f2BSvj4b;nv$*px3b;7b z0Zk6Y`ROvOi8u7ALiuf(TtzXU`k+z!gkqRKB9<_v1XeUe+HiiR4-4q%qemJC)-1YyqyH+Fix@K6#LbCalg+xIxj0~FPWlm~V>(R4vgq3bCGGhiYzvHk zM?dQE(aom)N|c9SvZ+%A6duQ|QYkzacp7J8wcB6;5gpSR&&B?J*x_ z)4YJg(c0SDq2b}~ExTJ9YA!g4>SMiaa12FY^0zniuZ|6!U4?{IcFmz){vXo} zN&mq7`~H>@W%J)K(K8l|-MYsA8nx%`~0=X?h{2&o82)HDQvuFLYujsz=gMX%Y*1A89~+AU6IvlJK~_a zc2Ue9$&&k%#KKRAI6Pq1YUE9;cYx!BY}BI<&Lc%~@1XtKSs7M_Q9q86K$SdbV5nmf zLu=QSR?@%!@%rt^gRg*yg9)djC_$wSGlSJnJTH1bQRa(Ts3f+OS4iluK^bRvn2HHz z-F_?_p@3;=M@1-J7I2XPZocpI$5M&JCof1tqv5C^i)XL=fe#cqH7wx{{29G%i+;gbZxIinc%zl;92& zav@i-xmou|BrJLlv7y|mbv-A~4_3`y80P01POn>BmJpJY_kqN}US1UI`mj-?;&}$r z;@`9ma%!8C*&dd-xmfHOfMG_ASQH_B7(&~C8e>^BVA}1!LYb@1QW+3 z1kS7qD#r!X)j7{(2(g63C1pv35AtiPp*3AM$0E()10bQkqJ53*Y>TrI@t@1h>8yv; zRpU9bm(g**6o|rL2kxwMLg8hjM0Q-|b=}j05b5WC>%G2%OiPpm08mzF1XbPmAS@~h z!G)+6w}0*0lb5415vP(#BqUFwMT(}@6hzDu5UOB!QVI$()qbhU%jU_dpw6>7Sk>pX>a-hL#=V#7TFoFnJ5h`Am2N9N0<3Ru)* zD`QXcjOvv-@D=122KMPIwp@n=nq{zU=Z<^5-YQyIgzffN0>VmHb+7i?Kblrwpu8@A z^z0C3egAWW<=Jm7Ww!FiyXpc$Z?m4dxg9`{?r;wI8fRK<_mk@hH}hLpEd>K&ial); zy?9X#F_P{qp!fQsd+@&Cx_v?hc1y_VkFKf(?}EEE97+l0?IwT7r%xANgh(=EM#?)s z<_UPG8^(|%$FgEs+A-`D>4p^Lr8a3=9!&`|-TA?#FfhP4rYB4_I%IlWL;U3C*|3^Q z{}ZcuvH6Nd5yejos>!(@pts&~aB#{{$avQSA$4*A?9n%fuq?|4%!BT60P3CxTxjekw3_x$H!Pkq(sbledPp^h($ zMFq8#d9IpNLs}mZ&yx%D1Xc(YwPBXyeRn%9HQyUsS|2`OKX1D}q%rj`c$Adc>Cd1L z&>+K#1E}lm(SrnUte6q60qk5}!UMu}A6HQBHcgo;gzqqU1{j|YhN_ojoV{7R)D4m^>NcU#Y3`Xd({$GA!lWUPc z?@>-+W9U_msDju8xw@uI94{7-jjC&jf3m>MB3)9n>ke-D0+6u*}Z)M{(({Puq)|k1$&(IBZm<_qidh*s9K9>4HFSepjhh zS7$QMTKo0lI)>+N({MHm=bl+1t1At_<*y&q>&hR_b_@paYB zvwXEE4|dTfbl`mpCe_<$j-()@r8unAgkj4_M^j05x>ATeUbqRTsFRIk@dH&9hM$k> z;CY$40hj(@WRJuj$QDihF*}Ls`bLNjN(%=(f4iX<&)Y;rO4)&wzncBg?v)KZ3#+j) z8%`@cv-@;wPg+5GLw5OGYM8{w%Pp^oB+W$fWp6vUY@NF7*wAd>Q4sPIUL#M81KVd{ z_jNv<3;_(b(;`l1kEpJIoWrqQk2@wK^<1}5mruGz1Wm^d(pZ-sDTGSkh&JwGVcGzx zH1^9+<$*%7Jgdt6(=4OUTL#z;-k|}N0afzq%&fYxNy6=d_0T(5?m~9oyIb}C5N^eJ zxOogGl-qFFC*lA+VX`jhOb-7L!OKW>E7oSUBht@61?f@Kbwlu@k|k&xkwX~TSscWt(LB}_;GCNle zm=oLVbGu2FeAb}|nKGbX50uN3E>AfUKE;QV88Yp#9#>-4xn^)?^mkUSz?n^c>u_-Y zys(%f?ts2%c@QctI1Ppq4mz-D)G-Yo#T1*B;i%yT#=;drhs%vUB!bc_&88Ir=v$;67k?9ePi}@Nsk=VA_vB$c;r~rt$ zC!)&@cV+Vtu3-)^64_gGT`zbuY8yZv^Pna0|H|R{YX%33acFh;{57@;59tU~LbYE% z6~ss@^iLa#x5lz-|YDU&#m$dH5+#6xm`r z7bJ7uV%=xk2Jmq>@Mh_oFt|%6qFB$Pa9-t6sZ14%z2BY6Na}6r7dA0rv`G%^ZA1E^ zM{P-F@<>SxLgqz@8Wbe2yc#4sm$Ps*g^T`2R@IbZO$S}h{=0@jUal;4O;GEzC~Q+l z?~kso;I@l)|BbgN>C$#&Uj46_NVPTllWoav;|=-3AOLvr>J8h&x-+Kh+7oxCk1NI6 zugN6|yM1^A%EFO0kk?S~SEd)Fm+-fuQOt`BhWPT!Leez>=;?DQjJ2t-_s z4x(~f5do6q7H<2%ds1-L3tsS&pMYa+^iFbv7eta2ei#f0M8(7}`6>}p20ezuY4Zl% zb$`BJxzpK@GBT9h=2s_JF|46g7m~^>8n;222-$ux7-`T%3XT zwH`d6e2rj)jvs4$2T7Lq%qO+V@X+>(E~^3`(*OwrNMYY6PcbX+(@t?2tU;SBh2bY_ zJ9{vg$Bcsc^(j);*lNVRy!}dn$_ZAuOQ8fW>fFZ`N5fPW&$}JnYes*b%r`uk}Wx*=%(J zInK??D<$p*qHqn|3pF*_xMaQ29itMPxc=&(F4l{E$!S%4)A~2x zSKoLiD<_S6M+qHn&e-iPiV<&pC|=lr&M{Br(A9P;HsyDYT@zRu$>=bj#@ z(x!`6Q}YUeynTX}#;op9R4NnVIqj{P*?lnOoi;?hkhi@kYW*J?hL1CKxOOhi+lLMh zeMDJlGM<>c4MlpAk9L*K&gd^c5o^kFv0I~VCZNQgo@ia;mS+Rn8lv{uFm;ZBrRJiD zGPuG9ln_%GSo274l z6zmv!A(Pw7bCTjrrIez4p7VgXwkc*N!iC~%Tv^LQbR0wK7rd84k2kDc&`k?G;alvs=jZ`jZGo^MNbW35PN+>q)+dsk<@ zlS3HLf#2f96{2!r9Ne1b4~L=EW@Z=F52yFD>LJy~ho^_T5t8?45R!7pot1PvrHGc* znRIQaB80+5N|eoQSC+R}b~8pNARRFN1Hmh2LUYHAxGZimQj7pK4p`zhu=jHtt58>ay7Jylz>t)R3k9EUS(6Kfl8WFW^ubJ8SX4|;;YWRa4J=m#8ff zF%!K17w}aU_Qv$&Ajn9@&y7UqZi>=3LTDV+3sm*vwR ztQL3VW8}2wbQJ3|yx)R0#dG~4i+S14tScx)ts{l|#S8$Yjzyd_`?752lsKv@R@hXc4@JrnRb5(()TQKu1t^ z_44$$R&ne)nU!zOee;uh71D_}YO8-j~zbfy1D~gbQ^a;c1xHPFu<9o#&)W%n~+K82w&wJyxWu~$u;A`=LnYRUwTBhg5 z1}FLcz;PdkL_}~b%z2p>(tdnbl_9*W(&e9K`sPS1Y5NEPJZ2HvZ@B}8A#ihsAvlB4 zzzc5Tc*;bCB;CP+>&Eco;%}f#rHVKCaS<9`m%B2xHzXQS=*3oB`#%OBDZTzm2_+#} zYA}a;_U#Rs!_Q}Ppj55W>Mk!wYc)7G>JxEsVDA_Sc7|E?x2a^*rw8z9m<}!gE+;9szI|FOh`-!o| zs9}JDQnLEWWXVTu`kc^I=XDS5w&1*p zr!f&CPDpfA65zsqIUPP(T{R&lHwK-k?TQTs4|+R~Y~>CR*4~d#*0^^r!C+%*jUV^d zNkqci9dv+QvSVJZmf6bBeaYLe)O(+WrxE3DvF#Y<<}9FKzF-$d${LR7HhGOnkvg;` zqJL4=8Kr|X#KNp<%?JgPS}b#P+gd_0yDSUni!wTz3&%#wEo!Uz{jlzqVmJbhn2vQ?Ak*X&-S!$&Hb z(XEe$Tk>`DIU%ZMutSp(gUU|Jm*+7Te>@uNtmy!v2J?YhHF_8|K_)I8O;Jb=BcA3= zF(RWXHAcsJ^}V*c>x>z*_|M5j8ynH0S$*4SDoj*#&{<`E4If^~5!+uk!*O{G`fA!7k;~3#u&=N$iz8EA z5(u2pca9A7XneuJSETDmQBSc?&PA4>hAB#!hm<=r3e%r0+g)oxR{4<4> z@cSJV3um<_$eI39M1XtVCq=8qfXrVg18?KyJH1ykCOr;hRQl+4zhcO&h55wB5cP#s zL4T3q<86T!3khnOXpX}qZhP$(bmcm)n;-y9^nPNdlm%x!CKoigqW-Z?mx8ej->_#ZC*Rj`7K~s22i6`^WnWT7qibTV9g;enHdF_nI8W2g5rA)#(mT z1f(C&C`@X2jsTO@@huD1fXq|{~Bm<_%U+1DZRcT1`O{nQBR%DLbmB#=X zHb=b~Tq|C+fh(b<_RAi)@|RNv(CoHn=!=f7uR_;uOfMOD64Nnk_T2VoRJD zfpAD8;3+jOROaG8_&%mq5ID7pwX(f^bkO2!5kZ# z%Np^(ICaS9iZd#9;x#32I@?fg{E{?=yd%YX?MBx~^3F&<-gYm!-v;cjZRHitWWrS+$#* zH4nI6trnh-RmaovNW(o^$q?Wq)3SgR-*x90(}-w_nHio63`DYaYoc zLC8D212@q>`ruZUTXqXA#YM&TMcAv|lA~31+@dh~e*9W1%Qes&D9vIZtB+^3oWGop z67({Y_dP6cS#8}G)OhHeq}ZF*a-Z{hh7hUVZl$iV1rmb^JQFsrB-H^9a>)8Cnl2ZZ zO6{tf%e?5z5elfoOTWeqwMuo~$k>OE36f~ufwq;XotR7V&uGTNwTi0eOokstcT6owS#|tm!ia<=DJn`lPJ5s) z!;H+Q_pPRPrlfH$&K1~%<}RHHm1>MxOP?6gufc-%pnB+-2*1EDm{1itk4VW!LNweF z+na4z#6B#^tIge3%6UIWv>5$a(y(*|A>)%~e(Azi>pZA&kJj{?q1hLEc=~Y45ccnk zig&~a6``{O*J{H3|GQQA=QA1&>1qaS(Tj+nI?( zROH4zaAz!|#Eo*}hEcZbj?<+eIY|gozDi=}HO61U!ou(>*N7PM-th6)*S?O%xYu4z zsbt2;lcd4ex)an!Je$0Ykgoxa1O_+f3S7RjO_K)w$t-?#;YW`HNzFfxI>&d%H3ohq zt8I%S<=79t;2i?9c2^sMKr zXeq&O7Sz{9k~z{-D9**`1&aC;WHcq@3I$rxo{HTvP-s%2s&Vp$zWYNlo5`Umn$Q^q zpomCmaK%B2)O0l-r%6ArEgqMdSzYujDv5{~8&6&x!oUN#hlUGpS@P4T1=nYjDX%Y_ z@R9!3&Za&-rrQrrhGB%=BZMCzZ2f}8-bl9A-#K>1&a<5GH znX3cTe>guQ8QK6#y|M&rD=LvO%ixK{d&lv;lxE7mMc&+lMVT$7#7@% zK#TX6-F6-;iz+wh6mBHe9CJCPL(A36TXVWDf*g+Zq~)DPAV0rIf8bh~>HW6uSLSZt zCIb@L3l5vhvKW0pSN`4;Wk5 zkp}|^G%O`KlUD*f^yn`dmdqep`Mgv3b`ea3M;Pe3wlLM^c?DgiXSvFzF7=d} za5q9LU0ORHdDe8D_5JTMChS{xt>ySys?;u@N zd@JUji{`DuMR-&9K4DdZ+c1*s%sedL$}Rpre&sh>}_8uG!tj!5rO$*I>zMU@J z@mAbLnp!K`vKY)}vbFC!Zz;p8jdA@6XC#FWpOAH>XD+62cJ{n<*XDTDT@UYS%NY5a zr&P}|#9f_5Zfbj>g5~x8v$BOFzG=ZHER|qjmlR^Ie9%n(a>WxzmT)#pPLbNjA2ALP z=$~0~q9`0U2pB293AvGLPXkruRd@oLOJ z9&y6pv3mIRv69>EI!A1%tYoW$?>$PWSB%+W74Q9^Qef3}19jH9G#d*V22Rk~dF${# zJ#}KiOd32mxDrn=fT@eX7vn0@$!6a+*^gsy%g? zzkdH75FCt(Ymi&E5-N!+T&*50W7}iEl+Bz9!-Ol}L0A4J%J{JjLDQxWGu;RnTG3iU zW}m9TOdDd>I&2A=L`#BwBR6Joq}S~kif}5_t`7O$`vOV@>4QUyYYaTa`4D>W zq%`MJkElUfS!uRWe>T%Qw56gQ%XHUHrK&w0f_d=k*WKK2o=D3vm~|FM#Fg!L9zmAW zOPy5@{JE^j)sQJ&&u!|jWT!&_uOA&<nEWRMQI!Nf>Z4X#^bQ;2? z%YQQcF#e3kWMs`0N_-+%zmQ94!Fn4F?G7J!26aD%BTuRYoN@4!TeE5)o7Hlf+CwVw z{WiKfd-`Mw$7AAwN0Ed}2ze_9r}VmxQ^ool9cNT^wRkQqYz5+j`b$T1vES}Z)ovI> z5`*6U#iebX2$M{N6W8VGVfI@x=h}n`mH#1muZ$*;)q9d zR7hR87rvKt+LcL+b&qpE*R&>g&W#~ZGZZPBjAk{UrY$ucKQcnY9wEF+ZQ{B`F$9jy zuOr|`u$PwI3xZbdt4E>~zCf`65eU|p0C-AQ>v;D}bNCO=3gJR{t}CE7WX*;`FGRm* z3~pEoo+R6O%gi;WR4)pz&mB{X-yt47`Z&L>*ZX)O{*XrTX@&y0aM&0z$C9-qp)qHq zxA9KPk|DfKXoQMvOKEEC>bag>tmB3HM3LU%Dtsr;o?5mancBf&=B^w^HYGWoEnu3G zV3B7sRB)1)0Ru5;COy*%LheEok8R&+%Y|{%gtdM{YI>77kDsCK6As44iz+B_#Hi3Z zv(C*fup5?DwSg^PXtDhMx! zeQ_?EVs+(YjVy5FMcG$2JOfYtM4b}Nm_&{E4Zn(&odq0g;n7#+uH>PZ*=8?o72FRI zT+3Q19hL+1g{wA3;ua`h^>Yq?RG=xdJt(;Us+=&P8lkRPdV5TF!6_>%Hlx}*w8w>! zC;`XSTx{_nY1x}&VP%_9Qk8a>#z(lDi&s@q&{dQW5cmqQM@w2zgo;WaTD&f#Zp=z& zdjZ#+`ZLUICNKsK)o){+UtSq(ZV>jcc7W*{Rr&ysm*&3Lk#WoGR!C+pjuEr25rt<< zx>zo!sV-w^Ns&Q&r?fCPGdH?CNMFLDil4WHKfLKX&4PBie>3?YzqBglECGZ6Yz7JG zTCq!W;sJ)O%dE*TKF~v^{$; zA*Sj{E9Mw2w=`>S@kb58?Z~Y1+r_5*F;^#E4#K0>;&D`5lBRfF*~4VzXM}bn;pNT5 zwQc_zeV|#Gnr&JV1(``bmrL0-p)v<$>hl4h`$&J3G+ouXYp*_}VIEoA?dcX^H~t>H zXb--_lI)!PGBm&J6Z( zpc%Pych8oLow8BSJTB)@b0A)xhp$E8u=6(y4H$`ItwG8-hc;XzJJB5^|E2i=K6IzN zUnDyTD+*TJ+ipEun{l!!Uz`bs-ZLxz>8POX5$|fc0;&GPF8%)?0|EZARsY|~N&a_^ z>i?ihIpps)Ycv4<1a_=Ig(24U|EgLEWw)yweOW-r^hT%NH_EA48Yay04n|z)a_=6> zDOY1j^+Q@GUzmUCk1&A?n+!bJIOFkVxU%0e>(FLd(Xe|#8|&T*fJmD*V=1=bmZm*> z^e`8lK88Vz{I*ywB#*XwkCDpVDt}AfBiIYgbi|Lad0GujA76S|a++8|bInEOjYd8j zQ>zIH%KeaO)mpdh2x8!?brw3$p=U;sxYL>2wB^wZFCp=2Rd&@cp%ans5&zyIoN z;h(_iJ&sxB4&%W7KfTeFP$Ae4t~}IW-i#I@ z+V<3`(7+11KRt_2lF3Y@7!{M_IkfaK85=OdOrHIF5kH}OmK-9G=B=_Z>{c{ODy_5E zzD9cF!a9Cjjp17BF9gw>U0PtXm=lm70E16qDr%y&dmY(iFgiX^2 zb2;NaeTSH=uivDpE9nLMPd{8@wb`=xYf00ztpZd66nl-0C6QTfO53%AXkThI`~FS0 zByPz?f$rzqT&gjIA|oT)-QV}w(^6N*hJk@8^6}Y?5gQsE%_}Gf{M^PwT1`>F-u|k@ z5qKKaZQhNQ?7S1Qd$uHS-~Hqx~oq&%w>*wv|jkw*x)zLtt(_L1-G&-34ol|ph*#O>#=)7!x6g0MqN?o*LBxL>(68kwfCJTNWu$n|Hj=uQ9l&()tjS4V z=)czHvJ;UtfS@`_bSRALk%1usDhC4nSTUyNMHV+R#!rf=(-;teEC-Z-Uv*k5;E1-_ z-SI{kQ@6+O&2vhQCAWV$4mYD+?9cRms^|*Vr?fZ7VeE{bd;IXecjz zOPG3jE!)XZxEU#9$!@JH5Cif-j|Z*v~WiB@;lP^=qR8+nzUQ<54R>P3_eeI zjDIgogD@&CS{T`nxSQboI7S1W*5@;?dSmW3mpujBhn$5wl+D(a?_+BM^44$(Po9e{ zmPk+NY~n*krvP%`X@hO8bmpbE5;SDVmS@3|7IljHqVv3>5%rY4GlX&ev4ca^ z&^@Mhk7}dI1o_2hmLCM*|6$Jzo1Kp3>~GTq)wK~k>TFQZb!;@*`1ZInGlYjL`*0-` z@8UlUOx20X*fJS1Ib9yzOx70UCj15^YQ|l$1M3t1if=G*aAB>0B?q4@EqbeQWaQfr2eseg6ZBKYGLreAH zf=iLMsHwqhnpnquFF~>U$m+l+WWk~p2neK{MI-FTP3)T*BSq^<$e(?8 zJ4UkG6^96$m-;>TE0+-k%}DgKt_@S0&5i|w2-CgRoFpWcYR6%Xwu>p}waXy(6Zg>h zBU@DL_gt8StHxrtwEQ_8&ax8KNVNQKAi~f+xWo(z8HGEf9-40u@oYygBODZlaY_N; zx2cI*DobK=IaRA{(MQaD)q>T8CoME#a+e~1d!}Hve}zUN_89nr`}5{10LgSXUEp-B z9*%EHqtSmGmZHKMefNMc?@^q9tN|gOu=tz7s+P%k@}JyMdQ-ss@RnPE`gVu&@P&=K5-hWHn!|9zn>LiGa)IwX^zsck-Qz zifgB}DGu(fi#C04Z||+QA^j}Xv}{lJF3aYhqdn&QrTmHMzT*0OWf#(xHtXy)K$`Hp zXn3v(2Ea?AOA$P|e^5`#h%RafI6Z4&VT-SGe$lZgi@sXgKT}#@zXtA?*$_EFd{@?s*_Y@Fe z#37^k*Fc&UCm67d7dNkQ^6c>FOx<20TVlukF;Ufb#%R6=7(}W3h}5zCcMn9o3S!4w zQpkP{PYpAAlbZtoin9?Qgrd#>X~v1J-QSZ9C2;*JnW!~Va8rna`$gGvWABdMBALnf z%X{9*(~ctH)YK?>5CLdoM@wP`ZO&Nc5C3U%dt|e%wXUihe(a%i&N^r`?;%uro9?Ai zbQu}bWh=H%VY6DB3vFp>t;HM_$o_cRV5j#>Cu3`3diofU%xKuW6U8laR;u-xET~(Y zUESfQ11~EZk9+ihgrwwX)BNAGx;ZAxd74uf?$0%hM=^Zv%5<+jgOm433!#GNXCUfp zDKzuB3B+l>cy-hc{+Ckr0U71xG!709b{u%c$Lc0ehfA^MbKQN?L7Cr`K0W^*+ad0O z`mg>FaQOeDzWIMoNcZueI7q&e3@|a#ZfRi>2mH%_r%ls$R*m+1PA)bZN68I2ngTzK z`czwEbDK>tO6M>S{b?X)1x=8ITD2hQsfch^>G;?7^R<3n84)sf zPN*nJJtHT!q+_;Xs2P3V9(d2&Pguz-TH^%vfW50b);=lS;Yntkr?Wg;ROWNRMEc~w zbz>4@@x2C$EEAw3T76-)AL0nq0w)q69XMXPxi_@3mpW)t?Z4^!;E~FqNTdc{sc+i| zcT(`zjHI(h{Ul1zY(0WVjK@LpWiAtDTQ&ST2btia>a%kVo zl_u|R52J|bZ-Y`(QyY9xQ)a>n_vD6^vTAU38T9;_6uEYh^0yt-)we|tzu>66tX#vz za!KeijY0p1jX~Y@H3{h@Mj%Su?O!U@2N2=UbD;D(qxq;UI{qmZQWg+-0?yW4z0j54 zKdu(W&K?RWkWrv%iHHL2opDWqM8xLXh(@v)6c?z>*ui<(+z-&rqhU2S;3=+K{ z$$-qy=t{)P8?>&NbXjKa0Y43?5oMNq>v3CY!MoBB7{tKA`vljug!50$rL=c494UNz3h{d2}h=K5RSBrXSiTxQ&CVC5zKZbVySzKC~ zXVq)j-d=KAo@l^O#&ugbzXuI!J9_jo6LqmVTu(T@nR@PQA4}d z6pL0R;+N`Njw-95KJIiQNWLGV7F>~i$CK=Ns_cE z+Tixm?7n;?XUNf_O4I{^K-OgvL{rsUbT8%fKh88wS8V3&^*n)Lg=)LwD!VS}5h17; zhY1GSx!RicDDQf6Qgm*Zy`7&sArykM?s=owI_C9T_s2VRrpGNPIf8h=Z=|fjKzd|e zTZ*VyZD5yGG&VoJ<}DxhS8_bj>t&2Cv#l`B(T>e#lIz$vL5S#;(3KrAFz6@ywhpr} z(eRn@LaO8lE`z@Vb}Q*$vF<9)2A#2oX_4sk&58~k5orrH=2q=Lh$}-lJR{3Oc?}O7 zR;-yNVoa0%9o}4gg;_D)g&xU4gGlLof9X6%z?e8%2Yp;O^Od?^KcVQ2uwi%HI&KXO~mtAcu7IwaS(*2CCok`9;kVEOOeXb!Q zcb?FcqGN8wrRL!N5OKT#gF9j~*flA4kAnE>*JZlD>kl9j_t5eNbo&)$r3~KUTx)od z04EQ)Mscur42t!s6p#{jjT&`lH;wei-lCvovAA3;GBAika}nGsQE%T4<;I8U?exJ%G$vz8A-8zps(B%oIYl!w`+Tr+Z!E=57~>YiSMDo)yB{`c@J0L8`khx3H8 z<-;Scx!cM+-Bnc*);FCmB+w;=VclDzr{Rf|I>Ek@;?Lz_y4rr zWc*Lt&BTAV-I$sFH*HhT{NI|O|NAn)e~EcqL<4P~z;1FQ{Yt4eTq%~nLu90LeHyq8 zd={;%F({XoW-6j z5fa(6q!vzbiGXxen`8Rd`eS^x9+u$aNVnu&#aftoE3serT(i6F<#eN#5O#hM+=__e z9%E8{jXCCT9s4vF67RS;5OADxDa?pyi#50G8=><(S^1J()uFu^L(>4sgIr|Oo=ZN0 zO{z5d`jrPKp0d^HT*@mS1|qVsR4~jE%t`8}@ZDmG&228TFbbw=c1xpg2pzUl)cn>} za41WeQUbdC8PjxyBB^sjLbDf6;*cA01TW5UM!+w`HRdB6+kQn|K*q-$LEwom;nTmX zatvoPqD_N-{!6zU59srC7t9QZBb5mF!uZTV!Y?|r%u^&t?@mP)5OMYb=}dU)8gK6 zkEFxK#QZF~B1=d}topp1J-+GkaTI`vqQ9$r%6^OK?swb!Go`bx{^TLmT+Hd-xWn-C zI9_zbjqNAA-bSZgg1~%Vn`VJ~=0_#$YK(6};-3e`yLR3`TEosh%bp`}TF&M8&-Ql# zTcmvfhsmj;H|t1G2O||MIS&2JPh)r+SVGAKdO9^J+JauD41NYlmzEQl;)nMGpM33`nN@Tizn#$ zFJJ&ekaihv!uDrRUXXYKzRe}V$$YU1Uc`Cbc6ZBXHF5;I>f_Mp>K9NJF9M`_8KIWD z9CxR>)*<&h&d%BAn%y9gh@*czx-L_DO$z;dSGS26m+Lx5^eJ`h(dD0=G4sZ{_l!L+ zd7Rz|OY%6hJqn^9U>7mt?N`xw7OV-Gs({Q+Dj__PN>SePCRbwD1KD_YxYw`+IEkt5 z;Np7*V}L*2n0u(J>+CNJz11F1>;>*9xi|fFH*@slYKF_n>Kj57oXV#iE_r2E4 z?CZ0yeMw5TU0)_->a;s8viY~GjK|6QM}WJh%U1SLvPyg3Y_8*71Lu!rB3i=Lk{lWD z-v^45L8p8AIcT+YLX3lhgex>O7JIs<39k>1jPp=K$;s&27o=PYl?kIlj?tx20zpP- zD%;TFLEo#E{yDupWLFd_oG(h$rBD9~#H@Ow2X%V;9UYRInS~owZQUu6x=M@lq(aUT zcV?xc%i^5`uI&0wfUvz^O^A}gEf$jEwxz0USo?LQneJVMq0-r!u<~K%o0E?DB` zMsDj=^@^Ep$jIjq{i+A0B_E|lTb$t78q#?6YuY3GQTjYyAmfK)v{FvZQR6lgwdk6r=1`9T%kjHf!)tNHc`Y*WEF%2wIo3@D0hHsAZpy_I2?INh zNRR-&-=f4!(czNU>;c1k!|~021^lqEN$76EV&LURAbld3pY!3Cy*EKVQfQ+49O#mmeL;OQPuGV# z)Zy!4p@o9>J$%w$)QA`xt%|{@Gmkr$jNb*th6*Rk28E(T$R{uLmqxCFM%$J2`gE?P zKm>*kVD%#BAT!SV*QQW{QZ{FXnV%2%nGZ$@Q?)#HX9H(QRK5rgI-Zq+r7qv-H7CvB zQ>S6_VVCnpRhf8FK-}wR>Il+j9PUUXC%o@+s5=YG;|8S?g|mkY@ZXuay(SQQH}=eEgRAR4^QQi@lGRKRO*GLuiq`6G*Q zZ)6lwWpo>#O$r}s$<$gC)3MEw-%@Wb_)O+H^WmPZ{ z=!Ew{ci~%8YS+7Xl5M{)?;M1NFW@7bG-ii&(UzM&rrociV(<{pz9tDXZVMWIaetmFKMFW$P$fSL&BZ z1Vj^r&;qOWY~?hr$e}u=>(LS!!i}er)^Ms9*>F^`Bo(YkGf4ogM`N1#(2K7<(S-;q zQDS*{QhDA@Ldj;=bVW^!%0Uct>?2i96-SV4k1?f(nO5sBu%(1nlVf$vEs7Qh}HQCxk3>v*VF>qyZa+Kb(VI6r#79F+? zhJr>MND^Cb9{f|4@Q(X3aS_D5HuB}kT%GXPFHK;5H(c3HWI>&7*~kD|N0BZ@Ca8dq zj5|ezEWwp1X~ne1S|CSq-?p3u^Sw~$IC54YxPir2hx+cpQo{dG_xB~mP{2d3*G{Z* z#{DSIi7ls?)#0n<@l0xVa7UsanZ(0;|CDbXx#Ndj+n4LMKen#mgtg$1>(=7vAucy; zRA&(bWSvSlexd4Z6&0{ZCXkDcEPo9rg>4?|H_)I3(sm)z6y`*zMlrCBg~QV`K4YLg z_2F^DF{3vzsTe&=;}=qSv2fkckV}T8630Ea#CEXtIOLG1@g64fH=hzxI<}kEAk-!S zSr>_yshE2ALp<*&s=a-#)skcHQGu0r-kqrPXh9iYx@q8N)qv+Xu^fdu4pUcM$h^+4 zBw3joLYtS2OBdcr{qkIE{ktFcGm%Or-^yG+|BX&<=^{yAHzR==!A>qvEon5@ccYtR zb}2UGl}14IPi{CXS|O$9blXOBc(J{>Rz03C6m5j8a5l~!OUU}u$6BI`N{D=ss!*@B zqoVKx?s2;SDVi^h8IfrciEc7H`rmwvhsC=Fi*S|Ot=J;A->iin^d`p6v^E!JI0<6K zY6xI&i)X)jW2S*h&ulzy@6M@{A2RQpcPHJFXFk2!+ z>k|ixcQqNm^e_*)8!|=4SdbkXGqqeBjl-C04`k{`<%maU7Q*#(-Dn$xm+T( z2!^cd&CVM#Gf2?=9Jovj}~ zvb7qY#TtKEyECLTlOzSc@yARGptn)dXt{Ke=3hF5wi}M#(~ge?jO+riDfCrV<=kL`&>G z#7OaC0PzgAWwv#N=>Z$}oS4W(sHTT}eXDL?d`fnc!-j=}ko=^rmgFz0EAkE`UxWwFgQV8VBqdb% zzq<8WTdH_&Vg(no&W-+jU#UkQ8aX9YWkvHPxMqj^;0r#(C3)u+yjx*7()=Q_%6=7S z3jvM3{yZ8UjR5f^aq3rT$Tn$7p-)@+({YtAcART)edfiePv178b|JH6dfm?}s zw*G;t7XQbVPk4lq^+~O+sW7vY0Z@g5__xZH;rtbk@iOO##2l}c98j6xvcrKt)D=T_ zNK3Jbc}%_dw#9Tuzk_wjKg&qn8RNYwj4vo)0u7%C>uHBEy9NFW`{VN|O&hH3y4*nE+@qm>Xsy((X2{FCOS>7-}XHX|mr z#l=fPom>S&!;AK~}= zf584)LVphuB1&foUfDiF10`ni@4^~?&EG%rY)fE7{j~}6_sj07;_yzfGXszM} zu8bNy;E=VS^gp-EJq|E8xVsvB_2w-0Czt^%zaEyH-13Q&(F~PK_rM>R7qB_CVW5YT zSZ|lCWNUO*GOLG~DC93r7R)b-v7dYbeZH&rf6>vCV<m&K-* z+j5MbMb^MZnR5INZgbTNA_W{-9b22?a+$xg*dk3kwxzIZ<*3(zppvInCq(i*t^q0h zb^;sEkoxor#xtZgf7ZcDR4n0m&nHGp0&3#$blbg42jSRfy>Lhpe%Gwbpb*wKd>@-Dy6mkWr3L97`;wJ_4i#d!MC#VjYJY`uueY6qT z3}FvuhNeOuoZ21{_YMC^d2aDEK?2gLyb)Lw?;Fh)5`P~ojKsDg(LrLE`M(Zl>iSAM zTy1Y?UL;q8VWm7e*+Ke|NMxKj!X6Dg9ERB zJ6;R(Ck!HpRuyxS&tpnJNsIy=WDcJPk{@f0rD5mT2WxPmd(^_wPq8aD*v~9dRtV#hFfiVYOSh*e>m&`SLfx*m-$flmS&0xp#|p z&b76sZx6c%5SK%_Kjk)|CUvWT&lQJCU~{EIEI@hfCY~*s+o*5T1A<0djY3E0;z1Y9 zGlH|0B5{2=eSOxncWu3~eO`SgqA8ubXcAZ31__DZs&AJYSh%ewS_(6UhTey&SRQ}1 zCj^r$y%NMxnJIEMQaqrHDb0zj4rilWfgamPHb-qZv4N}O$I=PxkY-=~4B7>wfBp7N zH3s-CjlOAGsTr{gEXhznu@8uLTa@ z^F%TDh4!VoJed|*+;!H=E;q2)tYCSDEF4(Grq8V6d7l^AbR z7lEy#wHU>}pQa?i#5p|?1{s;3r-3A?;gajyp7#k+!8lfl>)3oRfa?Qye*Ud6WB6 zll{CtYi~$bgc55N*d-jX3X$@S3v>3)3JoUQn50QWg_e?gu3*$CzS+~c@+B()NC1AV zmeKP(-Av=2+ht;()^ZXz6|W_be{ZA`|D>b^%k1*c&`--ES!h9CsnIn)^E@Y_V^;Ik zR#)?*L{;RAIhI**nrsqRBbEJdd)1bMOw2Nl;nM=2K;GrxX$wU zv)9D?j7q;djeW%&TpXr<+83LHQdBB3P@+4lKJOdn`OY_5lqc*N){dy9)A0C1$m%jL zRzG}{Sm4W8x{s1P=}XGa!Eyr@hqV0irS`Bw>fkn@0RaJB^KUSL!57CpK z^}0Oz(=L^ha2iIfpYk*x-@yn4;?y zk`)!yqFGFuWOdlB`GW#@Z^;_^Z69BOmAst>b$Z^rU)kYSwKFKJI(L&TiN8y?_J=S1{%zPm<`aZnYO3RKrJP-QWVshh)BEYe zY&D7i=1ZGMkJ{PL3KbmOF#p>(dE`kfFn77s;c$H-=xRBk>c*yd%toTo0!b;R9et8Z zZx~HY(bSeQ2QrO~WMrN^uxNNvqvM_6+e!!%zO_x>k0q(g(#MGYkdSOR8Rx?xl`534 z>LNdJ>1N_(hMovT#6rg+XRCs7Q`kE5z7x7FYdKqX&tX3ExmOOP+H~Fh?7&o7gSZvA zFw6k{5RGLpNL1U1@*buP6pgja@4*J+M4!izW@qgn!~8vkZ->MX_$U`-qaf4-7lxP% zxRQ)^pokw-G6|&8lY9CPdmu5h0Q}4fefcfC=kT9UK^h^Ma1I{2@ih*+C&}aRqv^lxzt{RD-(b7WERSqjJI7T7 z@^833b7Km~VcAv&GRpUN$gy=W_1gXjrRH=L`-F!}li{G|4hDiQh~C5iiiPX&8w@+p z_B&nLrT43*Jm6oYC}OYf)@wWpKvnwKpYJ}l7K#>SvAj1B#VpAokP8{Km#$#zxbB}G zdJ8?XVfgmZsyp`m2q}?>>?bGur0o%U;e@MBv5Ql0-|Hlk$|{z*1)Mg5_`v|o&p{Gm zKi8U=XH2_ne-U6_!EY8F!VRT1z|9k{3-!3Jcu{a_6uu zAEP?+n&0%-zIpNRcs1mr-9kmn%uFb88t?LKPq5cW=%SVAM4h+ z>F0vXL74|%7wGk~%>L2*%*ZV!&-=aUiq?;pO^*97vD4hKP74dPnr~?ASw*H#ohD+K zz2JX-zV8TOKThn*!qYuoqPDSGKAl~FyvEwRY#hI(u66oqy2!HH)B=4r6j}WDWucLM zJlA=U3BLb*bQKCD;g+qxG3!MQD*wBho=YjDrCw`V5L>wQ)lKT(QWXF3-AU`e_{Y%y zDT5vhWsNc5b^Ct>!|-R-!fsQpbpP_%eT|vZ&D8&$59l>FJKY+Et+vyojeeQ2&CkjT zc(T`-@}!Ivv;QY164>C$n%yrhDq4H;bLCf7el00sd${VC)O>PyjulZ3u>CV@g$@Uf zZ-YmYxu0C%Nl(z8I)3nTfsJx1A4dD*5_;<3vwzu>Jr*6?r<0|+oc<^AnQND~Rf`8= zS8GAoltRa?2+Z_O|5lTPD68SrWaxIZ@?G?(mB>DGTs~96?@1JG&m{gQu+o{_xn=o- zr6tmuOVcYo`TwYxo=Z8I?DLSlaZ>9v9`Tktn2%4_iPFx$TdtyiUyaI<{)||Aoc~lS enj?Hidc?z%N*eg&BvXO#bSTQIzWE_-8u))s$yycw delta 24570 zcmcG#1#BH%%r+QoxZ#GGlZKg@nW2HEVQ83X!pzK^8)_P6=A>bUhMAdh)A!S^w9@Xc zl~%uWN7ow9^|8i2w$EeV{Wz$l6sTBXSZHV>TK2$^-fC&9U%;TG-tIFI;9cB!lN}qY zPYf4`#v=tIoK8(GRoz(O(SB^ZI_F&3+H%zLaV;w;SKo`E7c~kI$HuOCQkt-|`v3rx zlBWOt*>6`)*NJP!hw)KvvvJp})cbA6aq0QWPDE!Zd{zzJu?KU;?cXb1iH4Uu3YpzQ zeZt9J6k#vGoS<=U;P>d$C;!!u@WX@q0Os(v6(^nh&cW8dvN)|zUy^qLb$eA>hN^lM zl{_^sZ+m@GtNFQKX=uY{L~SD$nzVS8dj7Z+K`HA4;a*6suE20NtNepW|D%bwsxdBl zaU_Y%eP^p2J*+=5?7IvGH6}HI!qbjp5-N;B2(mVyvE{sE*8*cnB+v+%F&8e9(A#v$ z9f<2x2r|n>j4)cRgYYM3tZ59*vo-K<=OBq zIW^8(;YcP%S#2$__gcL^*f%G-x%e02f0+7BEv!15pwN09F7Po=AY032~eKB>(u@y*J}X*o>@_aZYk0b6Le!b z!-Y+ki`J6E+IY4$->Fi=8<&jBClek^MP-%0!OhL#1>%x4zs-B_V1M*2miC3vNRLSM z7b1`tT^UPAS{|HIZ}v9ct2%>HPg_4L+bW~tqB?Y=$}DSvqCySVpC_trFAT#Kl8qXG z$L=+0aT7e@Qtd*jz5*3lsEoH_&kK=Z0>PjrB?=szQtVq2V|l{Cl2~$yXzBc$1Wg(q zkHps^`3H#UM=(uSJ9NB-mF_o%h4(5!VH7CghfdL;)i8Ey|F}Hi6DvD^(gZ_hTH0@A zO2za+U0p0mIt3DWvEygz32;Mb4niQn;kg{&vaGLyE!Td@;=CSgQoALpQ3jlR97B`U zX8EgWy7Mf-o9|tx&hKmYRp1sl@4{-(h{BJJgZ*CZl)$ww;Zv3)Cl?#ixXx!c#R-}^ zoU~vs>Cm`Q#;w)z?3L)@b#csB_LG4V0KhQdt8S-$5Wqt38gz(qqj1!qJ8uD)E4Mj1 z7&>I0u5EspjFv@#Uq^^X9+qRSMvYe0n!%-`6pFlknCP=1*h!y&?rqz9A61s zuP-A2)4?!~KQT!x+cg%Wa6xzZ6Bc%mbys`9s^abFQX~#@geNF^E2a}jZn0tH$@(1i zlz~Zu6KjGaoqXAVzjH|S*8;G!N@IYI#l*$%Ap)27Qz0QiZU9#fC;qA>>e}@lHL_ea zW!-d$tHz$AI-e(08hiQNse|k6>HSdD*)m*%5Hk@oaecc%fjnv?G_YC~Q~Wk7Q83=; z6cBTyK?PRY`(v`?{nC>h`ol7Y)T)z9qnoc4a?OU21rocpFCccYG(dLIU|GS;Rges% z-`#hZV!!$l76^TK>HdeyqwaI#Nx|>m$ph(@w8!aoFtgb5l#x%J0*bV%o=%L(2bZH` zYBjC~1YkOXWUxB4O?Q6+OSLVn#Cftz^6 zk`(@O!ffgoQ?qOG>iuwk=y+kF_|!1Yi)#&}tz`M@>u+Z@)hDf?jRm6!ymu4~2I|6s zb`WElhG3n^P4>|b&v$Op(0KSi{RnUdtIJ-I3}6YN*zR3yGy=XOXUPx=kC({tonqpb zmWk$t^%W9e+kO*8&*Pra=CeREattoe(4wK^5o*+vmYr#4)|j$TN3&+hS1zB#i!x`& zy^%oInG2dA82ODGJ?q43zj-^F$rc6&O%}>RGl`8B8WRkvk)h3i3=GCol0u{X2}L%b z@ZDO0c6iB%dK8cqEeHE41yMjbO3cY07TG2;U`&;-a$|oqMB;%@o1Sr0T2WEZ07@Q@ z_V`0f0jf0U?rTnQ9P6PG!@<~x)cvz#)YBh52>K7c0YZqZ6iLmJnxW zpKy7e<1i-m4dfl~4Jv+mc!rIqi5gG1tnn?v`ZBWw$nH&$53R|xjtHs5rX&O5H!BBB~;yBtbcDiDDF3JmdHYn9p_kQu6xxc7=2 zSXAWwegqKJO_8>#Fwlt3Ks(or-0BNL-*OOwc8c;^;A>A;2HYq>vs0tkS%Hn6Ilea7 z2v`%n3+{>A;uKD_!OY%&+#FbD!seD}O0C5uKt(m+@-hP3Ea=MI%hVN|25w#|C`<8aJ|5pv0L1Z)m^7l{|(i z%Ss;5c|wAVB;fVOuE>fH_ux6EJD8_rHM+vCVVw!nxO2#FfE>0e$^#Kb^hy}%5%6;$ zAgNrcUtcfS97o z1Ej#Z;#GX6?-hm2WT=q9WRK^*2IZbu6e@lu(J(70Y>SItc6f@k7)@0ZaxvwJgGZoX zk5bdDN6TgpZlk8+Z9E6nNYx1 zKIc5M|1F1EYI0#7kn?#O@(%QV1M7S&{38D1b=K*K#!L97*f9ULDvBSNo%RuCI1XIx z7kY_iDiwAI3|>$UBMh!X6f-(26{fI7!{o-yw$n$bJx?3kG##qFojzREpBT{ufQE*~ zz{E7HUHa63sTT;9s>WpB`e|-~h2-NiaPsRp1koOa;d9#?hDEvNWkSyWwkA!<^Oc4E`uvl( zi;Pz{gpHQA&}wnzRW+>bKNSFC-7ZdAyZ^NL*gM&s^$=8VU&{U|2it=}29f!{nF9Xr zi>$a#C$QU~L8o25#}2bln8xQ2hFlR%&acb-j4ZZ$GLG-PdGAy9>c`F*+)C1{x~h5H z>BDP7u$ZNOcWwks;VK9WY8od;)c{&pgQVAvtF|+*}`~bPd`%*9Z ze``pWbrY$eV4wyq&xpp%Mf|}~2%MMHbQJ_o>;svgV*Mi9sGe5S6pz{NsW2DKhg)bl zJgVCe^E3ySTCb zLa!HA%Hu1#?mM<3r|!rJ)_sXnIQYr%^jASyGZvd+A!YD)o3i3{ND}*AxTK$Kjjr48 z^RN^mWchI`?KjJOkVYIqsAacC4UgE#@ja!DZ=>VsDqdy=c?jWMC9%x?gXo~ENhNLR z%4c8;ogh9|+_KKEFYvpr4YFVD!uGTzIuYs2s;;be2&U+b-N2Y`S9r6<&?|r4-EzrC zG@jUm{K%#|B=r`fB++3!olC0I z`a~&|7eh=&1{WaHv$QHDUw~7Im>%m^qq42^NI#qT8}xoMS+s*6-$wDWRXxT9uGU=` zgF6zBNmosD6tbn@@fWYes!`X;C#u@Qm?99(PN$@@vSDewvc zJM{SojQdYX&^H;+7q^_XwVoGXSOQxtKFvJwgXcb>ESeaauY=x!r|yY@XSdZ)14xC~ zFAt(}2S?#4KXf6%qs_ZMHAAAGXd2 zj8kp)m{Upo%v!DNA>jQ))8HymwXsZuqW$=_)3ZG4+u1vN$35ZZr6ME7hFat|XFPNd z!A(E<5OAsNj&QmJT=$bP^c}_Q;c1$*M4v0DA|yyZX3xF)l@9WR=qEHUAWr)s#%7cA z+ub%EIV5>h`f$2>M7Jg7S9b8jCS*o5Y4p8XuOq2Q9eR6akG1ES?aZ(tGa2D8pj={j zv#(u77F(y;U%rOJg2umf1@4I5R8xw09J?J2%g<`@t)D3oO@x0t--u^}X%K<{cO-av zAYN-eFFu(uWpeID15vp@0!FgX1oO3d&Tb@}`T(ZIn+?xb(>tGOxmJp{BhUfs=@zWcXC_QN%u7(+(@FR0vH zlQPe$LL@C&ZWv^6u}>f$@J{_-Qs}=BO0~MtaY)O;?sZmzv&GqStG~ zI$s{$&)U4%J6kk^ZWpci>g%C6bEk2caoD7W9##~rKO+NU^jR3e=F&v$A!;TBSx3Y# zem-9O6<#+zy*IM=EYkOLKFmQf0fR2_X23PntwqGct24T^$30m6IKpTU#$Zu-%1q;S zBVT=a)M9_*^~@%%+ECNznAgp;3$BN}?&Ziji>CumD+kb5(C%{9Y>A=B|A75-f5b;; zSqAxPs~D)9#NtSP_NkAvhwGlz8eKnAO;&=I#rM2tKMBHP&f@ZAe@2V1*{-%(?M;Z8 zH*9;>@ORq(5=22suP^=MujI<(&hP6aiOF1qm;qz%(OP8w82bU_W{VXm6`t?ou!4#! zuLiR)iCSWWhY_{`q_!SUzG}bPyzKr3Cr%C5;c2S)u%bUgLCzG+WY_q7uxv<$^D%Si5_qGL7=WNgfwSQi|6%mjWDK$<> zM}nj{r!4bT-;^B2==ZN4Xdx^l6Eh+SuycvN{x zI3tFR`bA`5cK78+p96V8+_(nJC-&5D5x}COCF;F?PItltQ4boJQmj%{?5*rzzNUu- zS6x)f+Gj+O$2I^ zPjEC@SY;(U)n)zvjFU_dQwU1?ot)&B&V+QYgcX%zol4PDjx9k#e1fD6iWIc7X;U^9 zx1?EBzp20YM6G77XL?8QSG1An>vQ&gcLDg;mlcuRqWC*7-<-1W&jb6E`PHWz6N>G< zQL;Wg=$g%3P1o%D>q|0Pf&TOS?2y1ukBrh&H55FX{j3Ti)k9cH^?3LDEZ0Ncg-Qa(%k8`~ycvtSrpPTM~^FHhnt>sQ37@{XvbM=oR z09;*tNDJ{_KBMGrPX1j1?pJ{o?*&Hpr`1<3@SK92+?6yjRp}r`KXLQ`3#$|UZ^H55 z(9;V&X(D-I<(!E4VoKD?G?@EDb0K>U{qk0+nO-iLHmsj*se4s>iK(OLOk)OfuktAa z>NVweZ<0M9ciS^cYGe=CA>Ee`FZ1D$sC1s^PQ!4T6EV>-`L5s3HaCI&jxG>qu5xC^ zww9?ueeehT7aN$p%O97I6XD*!Cm!zSDVGtqP6`pUEF+jdaFXvYtN-hkCv zjlWX32{E50DKMBQwZ#FwTcHhPW}L}GL@4ie)f}Q28Ch$$zD9v0W{Vju&+XkED5OZ5 zjkE5um>(xYaqDjSw$2DobzUlnzC6LD=n02qmi?PEc?+dV<#Xn2xNNi(;pc}{p?~^P z^1#4|!KB56)&6aDF9QY@ziYei_avrkP6)`6=KXUEk^xJRSO6sJ?~ZJ3Ze?m?!ME{% zw%TLeTTyw_P15I-?E~>vcp4at!JPxS4FzfqEG2xHK*C8uj&qynR%l^yf8$77#}y z9QvZ$s*1#CqF|D$XivGRm$xNFyT#|~rBz7#p?%Q0ZQCLYzpd}=o)#}XUCoI7Y>QrhGyUY!nwE9WKY?Y2 z-(<~!PYA4Y?w1?W5fOBRMIpZ>`$Fo{8(i(ov#{Ai>$ciMhw0!*AMZ~}5=}4L4qgvG ztG$`?-@n_S>FD{g5_SGbF@wxp-_Bj91RQPi*T=DP&NkG9WZzf_*m!jNyV zm{y%7>+0s5>_pB*omlK7Vd-y!=xp}l!Z`5vXo0nrD>Re-oD1#wij{}S04Uw>m4Exu zb8;xXZz;G|_4&Yg?|kuM{z!Bl@has0Pi=uMeR<9Au;F(Y!1t>Q8&^0~K*+T?$X8_G zIEgt(5~Wa;jAXmYY06CS9-1+4{%ESK+r-h!h+CnQ-B8J+il?LDP~U`{k_V$`LRb>m z7wVT)DV-|CY|=YJ2;`a!kwCLi+HUy9^zD;~F9(-DY{Hivu;@3!CqBy_B>1PV^L{hg zw2+&Wn6Jq`3{57A@l4oJ4<{~sHSnsjxUF-3g&b(8I1n~eK0&xhHaufrl#VB^$3YC(&>){ot{@S6`vX zaboUItP*)h^LwU-30pi{?A=W;T2OwFM!KD9{NkYU;r5*%0!uuQ_aM)~D;|mXN;7H6 zJ|w_MJ-2c1CxfJq4DZd9C#Z1;D4e_#dU8qOc^$0R%+3z z;nvaGwRZ5Nc}6qyr7LAYgw)6AA9rCVSrT|;p*61h-CGf%$SXm`3F{c=WOS@$*Q$S` zkF!TLH(}h1W>{e{}K^Bk(f>iFdQ)Wvjh!h&J{=<*gHI$Tul$B9AGLW=89&D`P zm`cBIxs16&bNyp~97>+A8b39W+(vl)JED9Xdr9t6u>UbWKByc2Lj>dhUljKLngagU z?EfVeg1CXM^2)5(95~#{7I>SP< zV)Q&s@7t0>a#G4{rGTT1N)^B|G&-uc@YScIPHvM~ECi?1Sr3anO;X>-4+%Ztebc)v z%CJv7q~JyKm5@V>#dei|@2xMV$?>)ixHEq<6d~OXMVx;Y4DV3UBIcA>@3K(G&1j$>5DdVry)pg$E%CnMm_haf zHb2YH?|ni(XRY~8BG}>s4LbKZ5)5gNP|SI!&$z2cLq&a?ARH4My(#w@onsAt|4>yX zcwfPI7s>VN`28M${33@ZYaNO!zvJff5Rp^safWEB??NHidd~oFPNrPrfYPL` z)5R!gqg^!RFF?@MxvQ#tsuOFLRk; zd!e8_);#)5uk2o%npQMO6gLt`4oT6fzgw@Dl#66?+447yOE;vxG*o`VN2t|+lFJl> zZh?`CLMy7aAoE^-eKd_BY%x>&mp*$0c2*3qx83TtJGQFz(OGC~T48AOcwZu%+hNe^ zg*uhif6T>h^@pNxc57=x z-OgQ}f%dsAKB;$ud`%iD%!?f9hoGIA7nVJboGUS*z5^SLTm(zO8&c;5@$|ZeHi1&6BE*i$y|E9aS&IDKwFeN5#d0D z|Bmvtc83={stko*(Kq+qtW~FHwVg4o;UZQ?W*Tzb&+X%MIhj4|i!h4+A_LG^5bMp5 zI7K!TQF}GzNp&F(V&nzZ1y?x@rHmrI2J&5P);vX zyqw?Lci+sKI6O#^&hkN87!Cb#EIV|9P+0A>2SGa26u74X_Y&Gxx9!hPyuvZm$K<4pnm zWV{%yCCa7O8b4Y}+h1tGTwk=>?L9;`eew_LD;LV)$WAjtKd^9(6|kaD*?)51t6sl+ zf`iu7ccs`2IGdSf`2jrXf_9G$*O=-F4g$$5=D`=t(-p$zdAm$zL7qh|xDWKa?29 ze~QH7Xdi-k{v!-;vQ*K?G_5{*J;6WtmaH|uR^vZ(zF1)~YXK;g)u)apcN=RC1vn4nzt4&Ep743+nMYB~WS73P!PPvdC`Ob^m!WN-KX9IWy%F=iXp zy(a?&&R+B&Fkb9+ICxRV`IY!TuC$nf^M|bO*S1jq?l48|jokdzd}jH}GiNt%P@kg2 zjzV@&B7h~j{5PQIcii=b(B}qK|M3L-3nO(%lu@txOsU5^Bj445QCn*d4!<@Y#bqO*P&s8XVq0;Vp`CN(a`h`3Sd!DQduF5747 zo^WZhxg$n@DK+@$N?J8087tBu-QMoQ9J%V4msaHUTlZse-Twr2{ax=q^JcU!smXZw zr|IM3Z`L4Z+C51LG>-f#?- z9p|7z7WISyY}l$vKKr6L2p0zw(F{8(cZ8224@v%F#v|JNis4 zqfc^;?<|8Q2T^z_GoroE9e){gZ@pZSle;)90aryRaeprOkc>#lUD6p7p)lM$(ifYb zO`B>Vng+nBw{`?i~4|8xyK_;^-49G&d{6#NEPD2-w zm?#Ar)sgAIkam)wOi&@^UY>q9Wq7q2{TbzSvoz(xp|U>7WXEp_L6+c+|1h>c>*{Xd z20SBBzFRVo{V-HK4mw{Cdf-=ZvVZ*bx`}*{gczuWe7QGXhM=(ymWkwiW5W3Tan9)S zQ&FyF#$~w?4mWLBnVzD`w{@t^EVnDCTv-#bhA<=GG4;sR1S+(tX%IxOle!b;ip<*i(M45gPr)?aKGwgjYPfE@lV&{l}T8TMTp;9nq zF(tMBGObz4ZtkQrd!@NxQVCf(C@m{b(|<}BO}H9RR1j3f{aAt_qee>+Uno=rs1U|Y0etLF%#xpSim(+U?VC)8L{Ab3av-Foo3$o^`U|#078`##CpVT)4*U!I1 zdi-NoZM@8impAXWuDLpoW>vbg(N}lm2%{LM#SgLSebG86qS}k2RH?!*p~4rR^#%1B zgwakO-PN*kBy$#`{K+}iTEJBw@lL*~qpQcl)I=gm8FUs~Qb2h<@F}dg00>FNij#Y{ zjt5=OH+9asb&B;G5gL#6SLq8un$zDW%fT3zHRolqRZq`5)RCtluivBG#8A zMaL|TT7M?u^U4$(RcXo^>(wM9MTojR7yTSc%ac<`jJ>t2`vlkNoO?Z*NG{^U|G-Y` zgo~s2-gUb&D^^#gU@WwG3;b~Wyh3EQFYV&&&%unkv|m`-lDMUSEE#hK>Z}a{bGhTc zCT7=$-igW_MLzEcpd#`JjNda|dtPPaj^hlT+TOoDcp^_lI)Y&5wQ+@RON;TN+nyt04wRhz%k$!NtOM; z`hGhpd($6jq>+u;c_dC zxTs_6>FEiDn>Tdjv7?ECI-Dz+pu9`u1nJNH&cX5P zGNT{|=pJv!La>EAH!xw!Q*)aPN()7ZAYqdWnO_o{0y;iRR4#R0scYKLz0mZ1vgp?7 z&qEj3TlIlV(R1df1MQ*b$H9Vq*rVVrV-TN@0ESC#R#Z&q&r%K&y+(PGFJ(Gh?U&dL z6d9qzp80)|WMQJXo;vqysVKJ1I07#Ev+GWfm`UoNb3xA(n0W=s=XwDV^pxwZv&P5E z$P?QeAdBVAbZzAsUbARW_eS6!z#$r;!vFmAtZVxo4oO9OSj%na!Z|Z<(!H{(Aej>o zd_~JgQcWIwROQU6y0C`qL&d&}L~Vo?#!k!B$UeC|C+Tj%9^8kBM%Ek3L}T&OCcmNr z!BG~{dF-^V{$C1^k~N}Vb%0Q%D%w0e4*}jh8rt4C=wBf*{X2qXmc2irZTBj3@zRtZ z6SI*dWbQB>$tX@AYmoh2F0nl8F+44*{++E5fz>%9W2Op;^ri$FOBD+(h~Cp@yj+UV z;?f=*CNrx-t_j{dwaN#Li5vfbAc@a9YT@DeR#sw(9Gl6E*j|zCs_zqZwbo5%Cjg{m zMT0zW|F(46Pv$kZA$lr7;J_)11*Y0LaZVZEC1mo3*9B7dh_WS~zWGi>vj=pBOxJLb zPP2y2wk$ob(Vfs93z>wHQVGKF&~mLBQ;6;6xBNyemZY3qP)He*9Vrz}%;qndT-T7! zQkQk{Al=L(DdFc=V{<}cxdOX;V*rkhahbloKHzKcq~n&J|Jrn_PkZQd@~>Mxc{iu) zcb0c@ahh6M7SnU2JN+p?%g#1Azapfq4Q=AQN^WY3M({-@bXoMLC_2OW23`|SIqiXZ zP&_t4Qud;a#69)0$|L8AwdoSklN zX4Y3FRITvtgzp4=#6jhkhyT(o~R8(H+2kTQ2)aL|vd`inKZb5-EYaldzMq33W*mCZ?K z94m6y7fV)?pJGsP#`3XD1n;7msZm2!MOPuk>SE&eznnaQiiI^8#km$bcugQH&s3!@ z2|h7L9aorh8ovu;=KW6gLMN?iyG?~~%6D;%h4ZWFs!=6U_s_Pg9`GlQ3K-j`kLBCu zVNj&mk6Z5$9@%(a{2y%RO%oFXLrG07aLiORnbGHmJcJx=YLi}oj7r(3*Lv)As&C)m zo@4xffp_pay~RNN5!g~>#L;5*ggnOBIN=-Hj%g?B$@oz4WAc=$q~n=pJtjN7y-n|$ zpPd1wWU)SI{S0`@UdH+lG?M;L~p{_my!%S8XX7x|a%{vX#+ z_5%VnY()YP%4cBW;oF4+CJwvs9?X!>ZBy9yapyx`u>5fe8m%8 zg0WS#CTwG_So7U++dmP_9knb)r=HzI_do0&yf`%dU z#9!1~JGU0a!|-3;?>oEknhT~3Z8}hbh$iImIN8rBM+l>&)e88i?rr|MHvZ3ev4R>n z06SvS8k5wE*R)F&V?-H~ajq|P$%=ewvOOtpcN-$ONuk{hF#MsEtL)l(;#~(K6eXXA z@LL+o8J_AM@!lbOF9+RUl_u6#l9+AC=@>c_BMq6MbfPb>_ULDy;+GzB1j#fP6pB@& zYHf%Z+umsOq7fQVGdXiSZM6J5i!o!qD!0DN>#u0Y^whDhc=v0y@U|*Jt>CYBq`4w< z=sEGVJjgcfb2g&r-{HExok0TQ{l9Wo=-h8QOzONZxH^};e1*-lEJ%%RzH+>Lr$`U@ z_AqB4(EI6t6iwUvItC{X83q5$Y##yGJI$xeS79)GjY5D+p%8(n;Cq{`O>A6*vC{kJ zxo@W>LQyiuU7&H}H(1EZWNIcT9A#M+DOyT~rLM$LCSCqruZI^&HbC6Cx`c^f=7Oz+ zmLiq|UwvD8ZQTR0m?pZYe4d4+N4~%Nw5_%A#cD3yRwa;v*+L9o-y385+QDA^{Ktry zq}>Ct{Yuf-Gy&Xz*5H^1FCq6B1STe%DR_|aVD3#bclEW2OVS-A>ZrCOMZtCySIfjj zH$u)NL{kMnTYcS(84w{NzzgsFG4e5p&2=%HQs({!1Qfn+~UhuWIpA{=at(B6rk=E^JN#gbHDJh)%Mo_ ziX3n#`EoZLbK!m3GMrm%zb?ynbF_JG10{sl9d5-Sx_{DtoWwteU&nvk3UYK{%B%y^Hpt_}*P z`Ctum@QBSDw4ipP!s8_mON#!)AAgh|S9=btTYTYwi`Sp(Z0g_5HkjQ)vw^$1yo>=x zyp1*93xt-fE5t!n7f;{PzWm(W@C)GD0y*|RHDgcQiV!Ju-*tk zA^g@7R$!6>vDvhoIp7yJULD4{?EP+zZj-`n>62dRxK#1@^V#k|ie@z$%(6eIApE38 zN!uY2XqhKWFPGtRdw?}TGL7xg@|gK42g~fZu|d+-Yi8e@E<1_D!U&30HZCfk>Kotb z2qD_r7t|3ilYp}kJlfEb*oh&gXJJ<(63fF`N7z}PX3OU8B=_&zMdt{kRqY-YmD z$MLWg1%~6ez^nlHHwy4ZBAqU|sLAP6`#t;yezvuC!sj?$mKD~Y!DhU_NV>4=#3_B& zWg}-I~pNOkRBe6%Jt)iDV=nBvhwNS;a9II!za@(Rvi&)b}RgUd+Q{<=i^EQ!eh zPhSV36#7c$(b4guNI9b16D0D9ewk?x*p`}%7-Vl>ui9RXhZsy6BN_HB%3>2zprR86 z=o^x|Ph)_@XfL>U4iW=!vf?EYYf_#RIK}pqQp*h|WNoW}cOQMvP1)Ik!8ih+O@`Hq zkVWSnIR{h9Jo|#s`{c{ zm8csZsQ&rQ?V^*gfYcnq3Tr>_$fB@tKyJK_P79bBd%4-83*#(>X|KLZb^vIfMVoG} z)K`4=6_=Q7@g?9!or}%mRJ7|oFa;l%vc3|fjDN47Hj=C|u8ZT$ULMV35TsqXfm}Wr z9*sKPJv3V@o+crA)YENZ;O_b;P`4Zk=Bze!)yX>oywX{Tmf9^p8OkZgaZGh(MMhsE@S{HsTl0|7%AO{`xS#5DN?&G zn{JTz@k$BOqXMn7KO{2n8$p;M}nuQ z>6a^5MHs?=v_r@>y8Gy!N&9IO_Z!h|?+Tt5^uQ#m@;;88^P~#W06A&pKws!A{fm1e z5jRQ~5jHF|Jh>3hH)qJ=zX9v#z0Nl887CW)*#+d7rm?)^zO_$K>5kcJp4SJ zK|d!1W%ay~r)2%@U2i^rHIk4-!~8Y4Ph_o(9m{s$tTX$kvL8v>j~oUzlb}aPaXMEv z8b0ZxTbBV^=J@JT0#qIp5mTU5c==ak_zY@*>3u=Ae!`Ufe71YIg}^w#a~$Ee7e@-l zmcVhYSCIv*8YBc`crbxWqf!?$06AWAg{GP`E$gx zKY=Vfg=J^f(Z@M!ymFlJu2F5O6nkJ4=L4@Cr=%H@o=P*_l2kD2ZaduBHAbHW;;{_Y zWI7k*=Y~J^APleyP@x-a6J`VUcwZthMst_IH?mq{b~DIiy=z9?T(`?KNTOC=!^yZ>k*O9Ua;uHGHR@ z(OnH?F7WNi+%(ra&HVkd@I{PlY8xKs2|XGLMSf&tG$TC#Xc zX?s>FOpxAl(vLtrBtxZdwpX#Avuk|Z+&qV#g)L`$Yavsna|yu=;Gm~+y5cTb(3tDo zU+;iosvj^5F-DE=A}@_Wl!m;wB#Ip!?_NXmxMZ*h4k|70?~ShOQ}$}E?}O{Ce_hq- zhii<7Sjg0U#i9s1k=n#G=GO*vJdPGHJ!6Cr?nLo|wf~Eb~hB%YAvDB!3 zDzmM;ein7;g(ma?NE))e4E9I4*IHfASJL!yUJurqYdxtQVPM_#*k%`$^z`J#1Mq+) z5{^^Go?VA2B~4LhXH1vkoPjny>yc8+G<)-VshXNnwz{1596IG&V5ROB zaCeCx7#?_#mAzmG{Ch&|nDkKo<3W`Cq&P6Dz>ix~f24fT|NYk7guDyxgCkPMg0}JT z1;CQ%;K14aW1&<;LUH|Lg=$DZWd0|IjtpGk|C^i-F=-L_8*+uW1X7(g!&t3k|08lh zd|dtuXw8kYaf~SXa?3^RKXG%D1=M5jp$hrm02zGCAzAOA>`5*#$*Ej7exGplgl`(m ze;|?^;bsQMV6N5RqcvZ+QkTf2q{LpR#;Rl8^ z2NbcnG5&G?@7*++-=wdLsY@RaW_S83r+}=gW0LQk@AtF(ZFGN}neS$X zT>oKA75|pXVK?jE@L_MFt*&2mFO>!u#hp)Dxn+#=9{nt|FeTgMXhU=qeNKh49&mBy z>V6Vc8G6JNn6ugfn{Iiq=t#|co8k6jNtI1ae}|R&pJgwJK$bSFq99#inXy5>%bjh$ zH_IND3$8rMUy=fzAP;l|osR zR8o;R@`(nUBMzC1iW`mrH)8+!y)NwyR2CN>?J6&oNJB;`ur2X{2#bOVc2`O0W;FQ5 zOa(ln6wIPrVJItWiw+l8US0*q&*+4A|2mq?NKYYyYLlm`ROD^(=A8kU6GnLFs^0oB zp%jjVq*RsaCWi;Z%YM{pF+=F9hv?722K^NK3!%0k!DK!uYv4q^1CUWN>w6Z1>t<#k8+fvsDwNv{n3bvp^;J*?!SDZfO?4@X{q@=w%uy>6BC8AL~3 z>+kakL%G_#Zn}W(F+1&3t_#R~l8R46Yan!mL;(_bQgiq(u&+a0DZEeS_?)igNYyTy zvYPmP*nDG&8vjOs%-Oix&CC3UOUOXS<~HfP_yrx!uN*XFO`B)O*wYM8k)pDvtVtO_ zM`|`|aiu-`l+`GoO^d~sQipT2|00b@_*0jrj@uIUuj(-JMYbbVs*8<6^S8T)bs9vV zT&%yIVi^|%%FnL){L%r2i-NiktyK;#jxeQWTilJ=WnC>i6tO_`G;fpN{I)sBZ2Jxg zjL||1*@hD{kbIdtC&|TT-pk*1)!a#a%I!fTAH%w0LsNUD2b_<%yy2ww)n6*ojD(rHqKPlwv>5&y> zdB>M!GV3$DkL|PSYsY){s=l8|{gCO{dyF!n8VL}fQZE{>Jwm_O5Mcg`a|LWWJa(Vt z7tW5GK>GB|+25Ko4=38_59VDZTM8q~-)7gQ!#}OEJ$34pZQgTT=IH7D7eLh~fmUKK zt_VT(gHkR}${QGqU)10KrmHx(oPeh9AsM-@mxnzLX`=5B<^9zu@E_89dGA%}dd>d% z(gUNDi?8Fnl2f!_H4#wu`vA-U^A!*Girvm_AsG-A{hz>{p*z6%FTVW0W{&^=iG%i~ ziwH=?qQ_8EZ(htYFT!wgIQo}<-r4!n{Q?tz7xsO#=UzRaM?LVDPuw9YUvCj^3->9E=osMY$NJs^4Gm9SZZxyW&Dx*DUxJA*#xvjjt1#M$o{ zH;X_)H#Kex7ExlXv+HdQM*Q^R7SdbACqs4n=C599O9w&Xia^cPqNo6pbH-f}te zae!Vl()(W0fj#3lZUhJkp$=Be0(dXv+L9 zw8!lSh;elmM!D53(V>ZFbusgsmmy(n%zgmRW(m zfeJWIp|xA3^c0Ov;khsJ6oDvPyubmr`v@6M9w|r;XQB-{;$Vg(JynWqR}y(!@n|sq zug~~RBzb&`Q-P?zghfY0+Wl9f?pUa;_?c7=SDyJE{HroNSm6Hct#kBYsTYxrz;L2^ z;9Pw@nI+pm@Rlor1;Xp?5nREmz45R$bY0M!k&Lu#XgM2sUQ0qgYj9}v4AAAUBVGNg z?)V@D{f0mgn{T$_Z@@&oM@$6xV7m?p<=8tO=ARnMx}2st-%hRA-M5RS*pg59&`O}? zjO)3sNEzLws5QNDnr*3|NSK95IBVJ+d?#5Wnhiz{sVCE%z?GfzTUBcjU4M&YsChM};IH!9&Id!tu z_X-0X1T@c6JsCgt?A}=F)9i2`{V9{l{h)Xt4SNASNhDC$I*M~~`5Uyc2?<>jc^{t} z@co?SUqrpR&lL|fQZ?Kk@J%-)Z~aq-a%4JM0y)vd6{k2mtp6I-lel=bjpZG5J*8xw z_9`Ij)2NYtPtzUE*{#^|8BED+FMvZmFa~gsFD5Bah`BSJ zX}KXrTWs0yF_(w&ty4dbWa2B0sq1kl6J)O^u3M^TXjtk94UEvNBxGmw0J1~KI|G!x zFO#d`88x9uHQP?hX`&(F4;0O3aK_&c2xOuV6uTyxMek96K|MqBmRpJy>wx;h-R`Kv zbR}3}D2die-|XJ9c`gX5UzR!=l-WMq z6CAte(pswU@*k(xbL_8~oQ9!FxyntPTM60c5VzC0CXTbOB2c?+_l@*AZRek86Fr9g zzf%m7%9lTG5!P|FG$k$`>=lYRwAr2_IO+)pPw8-b2#|XpER7bOy>X`&f&p`2c2L@e z|9ua7Ex`;T*(FOls#;VBlfXBP1bHOAHtkx_61p+@rb{iBX1`O*=9oP_i=Y z;sg$XpUy^#24VwjPBkV8fc>E{b_P*9^z356^EVWIzR^{?$cNC(zN4pOT19b%r`HXM z*l`OM->ipvs8MlIZNFn?bVN_a-CX0~RJZ;{*+QKs!z32gdcG?W#T{;LrJ^gcwKa#d z?9RAVDdF>F;ff`#0ylYjZp~qOum~kId|Oi16TkZ}of4AU4M`uY0LR`h-I4HY7L)0L zX=$9a!9T4Z=&oR$yy`-gKAU1b54j*rJ%7rLI1lS2X-h*dMs>XXQiF#0^M;S9bK{*e z5bX+)f~d{~(KTbIR+*WR&u&K*GPhkNJLN0G5gse6Gx~a3c1%$zEnlurAwEuS*fh`+ z^8hz{Jfsk1^ZsT90G;0=R@*Ck#={(&GDfc|`GHYxgl8;$XQqI9T3_o}*M_dzQdvsd zElPRTzi%za)iba%Vs=HZd*t5N-(s#*H@UkqZo|LklFdlJA*3@;33H}4DzzV?+&LXRmo{F*&2Kig)Ts=A8A1CF^B z4`IO&vx3=`PII;jvK^T+b>2)^m=(_vW2{ zVcgGH&mOY>@|T(R zY4y-(`IH8N9WO^jQ~c1LoAAR+Me-ZdhlPNTkZY+%kmRp@;i$KkJ=MAYyazw>H{YN7 zQ2?IORi_Tr%kqqxgclk!0^w|8vVjsOuW;lQ4+j?|V*Rft{3w*tLO&4q;H3D)fc0$g z%f-%^u|S9ISznX`b<=X@C%D~Se<;SNqYp`863INna>D(Pe2Jz(-7geS4o9nC+~d`9 z5(?4P{5OyiR#MYNv+y6mE72D?(BLhGlKtMn=4tG{l`}WaD#;u5cLRzXrcGSiP|Q746w3YEKOd9IpU47AkxDvcrPOJR?FTH(^aLwIvx5P> zzTMJ?FTB=;tXtNmq>8Eq?8}h{W66iMFUp&r2z^HI^B4rJFtep>!^YzoHtIYWioE1P z7<8HXoys(v%G+%y6zhJY#?0_5L->h+jsUT{_0LCVIBTqPos&2s?aeHfoL2+JoHpyk z&DV=^6kf19+Ae3EPLj#Yp%+NUp^||4>;Y)y6$3bEpK>9b+>f;7t{&}XDt-hqnt?_I$&jLl)E2vnzCS^emSJL^K zgQc;~Y&>_K@hqmG-~(OQ@!&UDTIh(#pjZOnH+J!0Cj2VVU63HZ$NuL}%F zEG6%^gee}PrAJOxsPCAF?Q8zT#Is$wJ8RbE(R5%A$9-!&nabq+lVRziS1ZO|=a*lm zn8=e2*dz$KM)dw>DHA4L=6ryu%7}u2Z!m7|T-f7JCp#I{v0oDYR0tvtLb7Wm$E#QT zr*m#?pt{l5w-=QCA~@#9`|+dS)B_F$+`LXiA5Wdp9@zJ~D_pdXRc5`Z{5?@b+iwsZGpmt8s4|B6~J5(S7EIi0qV?cTKi+{B!05--#{JUZ2P z9^<|W1jSmSEQktxmMB-L0JH6R1zutQlAsRZGb9lLlkJ3<18>=Cnrp9K_vYfIxZLq1 z4Mn#TE<_K~viNvtv#rGt(dOEdj5JCahTVUDE2~f+A+Y;bnXfuf*=g|nFc$*2Zr3L2 z3?ZAz8Y%9+r_|N;V?ICHO80Wm8TOs9TeOFh%#-g=d%3E9MB->~XF=ZQKecD-NEuOlVh|p& zPQX}f{jO-sar?avw11|0g#+XFo(iI3<93_ca_INzo@hqT+*;AUq~zE2-; zE1KwWowjFTq0$YZ9!p(^3!T43j)Kc2$52^Dvw#;4TYi6RwbWjEUDoJ}rVp82FB-90 zXr*xV0+eiyn5BF5&;&bIOLGQXY#;eWE0L0%DHE{@k|ewGAHHnE4BO}ZfRTv(U5sX8 zG7>NV=QS5rU+jky;`sP^#p+XLT~%;JQ71@vL1T94MO&ABg2WXBJMX;2u|A2miX2Kc z&8bhFqJ-s`)XKhochFf-gdFD^V|Izj->Q;Q+zj0>LXPD9+{Y9RZn`wl;Ynv7cSMzN zEnkZw=T9gjRUJwd2>Bu8rJ6??R-rqNYjOp|2s^f3GMtz2yIObN?Nir9H3hnWj49X{ z-Mkqk$&v7upDR*-M(EqyM!BEEPcPZNlvF1D`bA47JZwxe?bFoHJ_%2l`J@vmc^JbX zptHuXYLm6^P3qa}1x%BGgt#n!S?C}tMd{(&E$fbC%X2)2fd6RQe!q|hG3a!lls^HH z`|}79L|H|RQQ+>)>o$*QZ68Of!#=u+I5SjU&2Mh^izS%9vi}JzM@gRiASH!#LEk{Z z#MFzAx_;HDoTN=iv1Q_dRh-8bfO5&mD@qh!9_D2P#2egw&F{*p?H^n{*;s?m67ceR zO&xit82Lw4k>TjIe*{~gea)MG$s-1Q6_A0?d*ry4er51O>z>9w7Gmn-V5|abtI-m^ zk&jV5aO_Me0)=4;s1S-72OcvlV32V=m*GP1;zthf!ua`4cAAdj3_Tz7O1S!$c3^Yy z-><#TJy5*&4p=E9u>96=ccc2x50d1~{8{UZ`#9{{k37_M)%s3$ouc!Rp&G!2sG8V7QPPrj!S1J;Fa^0TzE ztwyQn=)3Uq+~U-Al$bCJ`SOQTmFthedn3Zq!=2FkbX*Ty< zSa?jnVpMoz95{jB)}8ttg+8Dz+K?!US4!iG5ixEyL9*D!QW>k-wM*WwSNU0FlW`wyd!mCf;Cm>8zJu2=vbXE6ZN=Nd^>-vuK zJ#u(Bws}KZTBnFvNY=%IlHE^0hCcCKT5*w^0Ml|4q?3Mgf5GQ9SRU}2@0A(TsfA$a z`W2q~uPpp|R%omb0^x5orcn57c$BFgnDp&u1?H)r+}n~&A5Sh_Dr-gYfjp6mE?&J^ zrp~q>igu?j9p<WYtAm)lR~hF$M- za(|4SKO8Dv8GbH%>*=r{Hwkoe5a`&D7ytP&JFD_1K3wX#09e0M`@7~fi(C#*vA^08 z&EuZArDc`fEPIC1wvSV|$7e+8zeYvweM-x}{(>C{_&*p7|39B1P&`Pzk3=|0l#=%8 zq2;EM6h!jQ3=_KHPTa&Oi3&WgTP%f&?Ijakv`!yeJh#fv*S(%)TR)VqHZW|q{Z%#Q zo%6BAT+WY-Ut2Tp@!!Z#Ao+QFb*dt`ANaa#ULV>o-SaLn8jkj{6a6Z*z6`#9h{i!H z7+ovt*LuAC#X>N>Kq7MGn(%peiZKS9h)-;)pAv8 z-pq(RXuIOeahAYRaYS_>AXE}?Dwh?*g`ZY+u3##?nErdY62uW#QKJjNg^$^jSg7!0bLk-jwYlR!3ye3g51BrE9Igwc1N9*azMjP=^P-GXhqYymCjrhunqB;4oS>Z1QxfK|U6JJN`7Wi$&rV0rAA|AB(q<gJ^~MSz&K2lr7pB>2Zp9~(hljk+u|kW@g3 z&y|T0(nq!N9%FyAoJF*taan3UMVB>G4105x$TQ(32{%CF0>pq*?xJZouPu#yp160x zA(iL59TdwI$wPKWmY!y>MxWdWH*LMPl;H9|2D|>KlG?8{6I#9I{As$IK}uq0V8926 zCV>WZTRq9|s&U+!8*$rKLYMGIuhB%97HX39o{EBsA@9xF$2!d2_vCZfq-$Dm_3s?N z%YLR@2Nr8sT#AE{y~5yAm?4<^a$IuJCrF(_;LTtI5jW zUXFPai>bH|cypD9Nb(C&Q$`yr2nguXe+Ltob@X`ym;TV_DT}csht1J1kcI9d_cMfC zG5!XVTEc$?pNAD)?f(cq5$v%vQhqM}2Q1BX)nV)FlC^=w`WOKZO!(aG?SYk8=pguQMig6H7meP6@Llup+GL%c|d-eL2u9WJ_ywXJ82 zZLWmH#;_@t!cLq^$9jbx%4eAv_C@J@04~wnWsNWqI{fEWh8sTfgB-)DKG8;GL2{ms zs_`j#@#nd1;6poT(f2`d(Rax`?wn?~M4p+MIs3Qfr|OwVj?%2@E#Ua@baQ`%dHr}< zZK(esyb2)(T>4~=Uvvia8^)uUJo5Xe{5{HCY}CV}>1jxJU7_2hV=C7IS1Z2MduMw} zEFRTvdyYANkSwsY+lQ9f;2a28;|Yzm(UQy%^y9i&F#|Qh7aCDK3A2}&Ohrv}*f0se z+dy__SjB)+h^PS<$OJ)I(1EmnmV7-xBS#D?8xCbzcI_K8$1Iix#o?_*QuVGoX187n z;#kNhJQNnw+@s$XJYS3opYgP{1|sr-KTcsLoK0WSPJ}|*eRH^Pnbdr1dMoYlOOo1# zB1&7le|@W?kCdzdk)jc)`CiIsU-G8A8Nl%c<0nS?#%loT%JmxJ8`h>+XLWj5>jm-5 z5u5o!TC&d}2e94A){y0CvfG^c1v{W!pJmxHpfY^!tT(RsWns~~cA@e>ai0yBW&IPv z=X`~hHOpxMN*?$icE5Hx_b$efu1(Z^cS?W0%6Z&5#%WpFWsue3rWH&0^~;K3`ScKWr!6#FF!Lo=WaZF@mOH_#1sb zxElxM#63(4-WD*fy7J*!`=sXESkD)siM}HID(eZ1Z@>}Q!iy6GV`I!N7&3V14!v*Xb==Kh|@;5+~Ha#Qd7Qy8C^iB&y+3H#T)-no!9`kD=L5MgbiuJDn#Q38 zpkOZSASqgNEG-zxV^qPdgu|10pgd801h!h$}wLpPL z8;9)N3FUvwd81#V6ufC3pe}!O0s<;tl#$_l2=>F<{P8C;QEo@b3O(GEKNA6dj;vtG zZCQ;LYy`<+D)dDniq9<0@6>2qcx z_(Xz<+z8Qs5Bu$VX+P3Clg&*k!deR4d|a1P$kL8OD^Qmxn9bEjn$kS5>;?MZ74{?P4G;+TdY-JS<2YX#SHnejU485LksMp+e!|!%i8(ocb;Pvv>f728 zI2d(rKo&>c^wU!K{m_Xhv%WgpyeTSza*|`hJ>Gc7sA?E=#QrGJz3h6M^l)jK>2vmR z;OG0CQidpG5!q_e+>W4*EGa;fz#YAwY|q)3HY^&_Rr*CG!J1+D6v1ub&)JZhlQU~! zu1}U?_TVw>xLt}r*FvQCpe-O;Qu(h7Cwae;r%kKjY4s4iiRR^YAOe~AgQXI9?e;vW zRJa)&^?s|$6sf5H_M2fwLsgaiUNQx>9}+i8>E=PMCXa@u>fTRvHGpK*JAkA*HzupQ zC(7=~LJj7PIrL{7#(0{nE%vNle6|e^&Dz>-j}`eXvVq1kt**YCH8}-4?W^FNqF(D3 zYwkTMM%HTk8ApDUI-EPWWum(0ef5>NpP83y-y7>toVS}$hG4G6J)20`otTKdF>V=+ zfk39iZe{SS+<#;z9_R|?v$xnfz$cjtWK4$|)*mLxxJRp~oWJmFZOag$r$X4R@>1E% zRQ?jc;lmaROA~;0YezB2V`N*`umTrI!lps5jRPu@qF`)W{Z#P+^*16$H{N0;#`@jS zb%wq8!7cD$rP{IpD6hwKg67__FNKEI?7E8}Gcz9^r>Dsb!1j@3aXEqvJNBtRvbn7; zF69zGm51r8NkjZxo!Ee;tPo7}2``;|os_GY_|DiTE>Q>_ILC?ln?ACO$^g{_MC6;2u7v#zov(1rpM$kqh}Nr6f%7oSK&-!Ei@IAI8SjW zqbi40&pJBj-xR zEEInS@7%!1^ijiND3ztm4x%n^+Z1R)OaFkACfg1ibyH))gdg#@wO{babX)U*RS17N zBh>Y-xCWlXHLx_0WLvOh&^E5T(X7#ZH9_8)`mKNez4eL2)YSem!zO1z==QK4Ba`?S zs*p1Nob8_jfsjZyHnSF$VEXh~71!c*8xHh3gWmkLt44kF;0!8{kKTV1{vI!J5VT1L_%Y3mJ`xy$+*{8C@`W@NEOR>e}` z>t9#*&FxXysqveAMz00N=ATbUF`LOyZs0fi-$*jR#9JMa!%)@M5?}I~{TF$-hQ!_d z%a8mQReIiV(+Jl~tXum3C729o-32L;gV+9mTZ|yZnUu5tA)5>kS&1;n`5nzyS_6LD z^Ob6``1ttv-|iHoDCBeR%KtA1RsRxx;X5!e0C-={S@n;O7Ubl77JIrGB_JTk;Ch2n zg|7MUSB_gfyCD(r<#~p~wr;jzz2oWs zYF|GD?t2P(tpxBt++B&WwD+U_i&Aybi>neCuoFWCJ=T--9Xqzq#!Iw0GL+1>bv^$3 zK9Y-${G_C$2=xYKZZrP@w_L`pnRuR59(EAf)bk6HVMfZzI)P~aLICS#V>e4oZ=^}Y kF^ucW5Sft2n2( Date: Thu, 19 May 2016 11:27:51 +1000 Subject: [PATCH 330/439] edit image --- .../windefatp-utc-console-autostart.png | Bin 68628 -> 67778 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/keep-secure/images/windefatp-utc-console-autostart.png b/windows/keep-secure/images/windefatp-utc-console-autostart.png index 99a69e555d3bfd3fb452375d07b4dbb7aa93c02e..93daf5e81bcaf2f6469472597f7cfbb27e8823c8 100644 GIT binary patch literal 67778 zcmbSybx@qo+9e4P+}+*X-QC^Y-Q5Z91a}A!oZzk@xV!t{E&~kC^1F9$?f&t7yIWf| zT~l-3r)9eP?S7uqr=yh>r4V3oVZp$_5M-pqRl&f%Bz>kS=x?8h&J(-G=NF8#w2m7X z7(wJe=}Y3ljm0MjX)HVzhG93Ui^ z&nGbdJW+G9boVlGwE#14{`kin?q7x5xS83Te44s~wf<>J{Dh(ZfwfFr9c>(~!2aMJ zem48Fwg1ZR;c8|9cK;E2_8&7bCkF=$M|ZG?iS*u2?At$P>Nf877GUL^5_D$VsF>gGnXS#ZizYge7QvFI+X~sducj7U*cB z(9?=mAR$vxe~?PVEP%<3tdCz#fuvBSC7^#60n3Gejy!IMxomEpmR_D1Bw@m&Nz&xW zsz2WsVWr7YqxWAWC{d!tNt04>v&27ti>un2qkdYT%2XuDe8SS?C6fQ8L2?jEcB#v{ z1KHDKijpk<;hvJ7~gO5WEb+hyF2#;a|p$wrd|d? z4P<1x#+`(4ZrlRHJvca7_yVq(pXIX#d?)RhHtWYC0^VTZO?A&%MSGKr56zPCu(*>0 zYc0OK zn|~BZ#I^%#>fKM~ATMd@(3p>=1_FczR;JR*wV9nH`E1CeFFVSE6K@71c@NhEH^(M9YO zvPd_cf1ML~KHZ+T$^xA-JB`w@?UD9o^KyrW;b>ZNdW*he@i!f&{S;%}8wi6aYRJRw zJV&)Kw_N{sM7d65DK>Xtc2oxOS@ZgHOiydK=Vh8;=;P${aEerP42_2PWHyIH{HeyE z2bvLP7KO$oKHBIS4d%p$YM5KjbjYYzwBA*Y%CEe%h%~kWTzXbN#^Oro15J{^1jT z>b|2O``1<#*1mS(RW?0v8AS|<*+tvP7Tz~2$-vIU!~4QUa6Qc7ejIx_{hek}nAK z->$fZ>W-SKQrd`I@`pF-7JMH#OhrH4e{+C%+(|onGI8TgfJJEY+qn3}Eev;IHnlD^ zcQ_WC$##!{NNecW;YK=H*{0ONBxM-|G73y5YQ;YcN#AU@lD^uLuyQo$Q>*P#Qf6~m z<>)sV_D`?blmh_wt{r-_qsg94FiEz8DjtDcK`$h={&xbS2J(OImuUse9*3&#u{paSe(4n28q_z{?z_`TdyP%%HdY?!(hI)_$%}^Guhk;bT z!@edapNC1vfeA)O+!tnsDxPRdd#feD?}b`I(@Q|W2B#yK-QjO?kLyKs*G#!4&@+=D z$)+Ki){v6_wFNF#OK-?}?U_qgHCm7IiTfn=vq!mJ!!${-3BR6Jz(`O0>W1$ycf^*Pkc^*Zy+N() zv?79BlSQ-xEm4(FzD$!YpRQ&D$*ZKJAN^@nz*(>PS{!7U2inC8;$Fv8eBu=yawE9Z z>=l6bwZopV7Bi+ZnWs_k#vO1l{nM*9zfE7!5!aOs?5gVxGmp=MmjQ=LA&=BO_`v1` z+jo7&6ogm!7I(gsHcC|eml;0Lh$rPT17ziwj+pc&PY{IEx+Rnat`eU|C;011qqTua zHu~j366_5dwC&Bo6!1WY85_=I6cEg!cJ!t0?WOf(#RN=`%@iAj=uESg(lXPP*Hg?G z`a4bjAUH*CujdxDrKTGmx%WD)Dg2C9zRJt=M&yJ2A04@&aXr zHHh}3)f$UN25~8nH-%3!!Sta)0b4Q`2Wfj^rp%I{bvkWX=}(!q@+%*XOTR}oA9|=6 zUncu5Vrf@LRMapa(Ao?Z%8ZeiyHLvnQYm z$l!+~x$4y#c0J!C!jlcrO}}Okd48+Ql!dk-&58{c!hz>#d*i@JuMb%ecj>)sWZVko{V=hxlKp ztb38!HaeP!sdA;beBZ9utn!$UkvFO<(x)cwRsD?oZizdGMOpuDKHc+oqeCIe)8-4h z2cm5P^j7yy>9_#1aOA#w(q?~zn~9@#U|697VD6M-U_(KKq+uDe)9HPwdIvjCnXNQ+KH zW6h)MwOY}NjSLx^z_(*!RZpYCdk;6jqphmZH*G!9sscpMb)WTFe2r-45J(PRt$tX~ zJZbKZGn^GeLB%MB5@KXyq7^ebX^&vB)O*ON=6J_5S6po4Vl>l=*q)a~^i+sc<~dbv~S##=3t+Kxkp0Kf~1iIg)z zmdYT!n+?Eksv8}}&Funaad@1Md}LBmNkf(1C+njn zjd3E6KiG&ulce)=XzTk=LKNDtxcE(rvOYJVk$qg@k%;#_BAh>V1=s#v$BMO_tU>OD z3`c%8aS_Xq8`!v)idA=5dJ_}xwlo+lS1BG)coG^|A!~lo7E#ZiTLbh z*bOos3`O3&5?ed!F& zcC_wNblZhcV`9W(@0e9AnBkR1GrTOnCAM-qy1yz2DT866Vu zTSX%_gz{|?p2@d)Vq38GC#LN>!XvPnNv8K{;`P)xfMkK=E7RXMdmDF~{cP@n%#bsM z6I~@L6U$BdHJVxOE05&y_BWSUvW%A#0CzP?>7~UsnrqEH=t_<{i)R|cU0lNCu9*Rm z3UN$3aBzN}_6($O#e_I9DKhh0mVf}H`DZe!*2JJp60Igi<>d*2@%D$I-4$E+pT0VL zinVC);9;8f)nWZAo=)3h^PU;1B+Cl<9SSz8v*DJnv;00&Fr6{6X&W6?F(Dza=Jj67 zgn(IAM-@AiSkxfbmqExx z?DSIGskmloP_x$5R(|Tj*W6x*Qt;Li>rhHyo@eTB_4L)c9{LOT1}!x#wd`n1SJ$M8 z?WQY~l7pagmx93ah`@sE7*{D*oR2mIp(YL@Xwo?F6=AreNOXCL_4Z`TC7Pp>(e7qMCN=4j$s5Q&|xt@jymZP|+bm ztH}}qJW14`Sug=S0g3v;hK#(*gdijujRtL!b`^#jR+rpG10y_xtfuCVU*ZH+6gd(F zzf0fZ+rLx|3xBt!k62A&3(8h)4+9FYnBKh6>ve|8(Jp_1Fk;dZo7pTInMf*9}-ZypHCBrYtlazs+@a%g7T`4tq<&`iwi?QQ} zOvi9!lHp@%v1w_>SSz?*yPFaQD{p)79SFD*p%~*f1~=mT0Z$Kd19k`|C!L_LCXUCq z9KMdM)HIr7sV)rZOMy%U*Q=Yi@LygTw@bIC+FEWQI=qcWID~CM}I;* z7wHY}X1;|nyB3sip(PHZL?~V=0bCGB)T`6=ahB23zN1XWZ|A-s!hVH)9P8WZ3&^^g z&4HN6IdQ!Zj}e6ZIvce!M<)fGD-M9Q*HVTZk*m2_SYrOHtqV>Sh&6Fk0bc}{5!i3rB{p(OXkQ|;k(uM_-=N5=j+sA;0u|-UL`ZMg>a7Y`?1`J z4e(AhGBrV&e}rtZGd)FK1cR(w|MJ?$+}yb#55me|c0Yz*TdImH9In`?quXd8MT+S-0+c_5XgvU-T6n21o}bqe!Xx>2u;>e&)Qs?3_Q%x5 z5P+kg?jl?dhZ8{9qjQbVnG?E6cf_)ggd6F46`>tY04pYCK zW>gruqt7D@BRWe1YrybwH#C`|rzPjEbnamWLdgqV0Y;S<`_8b^ep}^@ba1uVPi_7< zJg)4Xr-0dW*Gn9KI03_tuHb4~tb60TpP2mK>jdWQYIWj?sx7(!$+?i=jfTL(*XMV= zxQ;zAO@WEEO(~mFJc=P%V(gODv{sdu@bQxcGveQ8rO1LU1e#fPjSc?zOC!@SA zc)8rEBx!fCnbm$j;M%y}r>CV%J-YOhoOODP&iuXB!DXP=YIgQg`|7fBuxEcCJvb=m zITI!W=b{EG)#rXNdj_HelsZ}s{;k+ptRmoWd<&LY&Ra$EiZHnzoGXzJxNJ8q_18 zepPR^0EeR81<5e$f%(9JSlPvUe74#Ett&m3<@e%liArOO`n7I-`#9$2auWx}IQe{| zky25w)4s4Kwwfw~W0wt>g}$chX=}08Fs}X9BVP8P#Fd@nFI^oh2Hh57yAQ$z*2Uw@ zwRFQbKh({XkJtB97oCd5Nh`aSbUFC?OImKSAVj2RAJ^tD5Ilc z=44rO$64-gq*fcgkg|WEsMZpQte;x6|Ma1|1Mf}J@5MP03jBigQ1T){>3M;~Y&>Cp zd0fEeU%T*=AdgYj{H=65YS2UXzAJ%Ip{kIUw&oYQZi{u)eDzOio*tXE2hy&oFw}ca zo!{!ex1*k$X%E9fR%M?m?`_n3G1FonO_{NNrP66?`Z#@sKx*_^CJ8I%O_cWwc^-u% zD)_D3%Ycx~(Q-BVvp+aVf3qH?`HZVr7RRc-ey&c2PIatordLUewZ*BA2^ELMt9*EwYek#~Xol*^da9_f%+@0V3Gx6JP@2z!vIlo%ZR1;vOdYH=9 zNZJA;GS$PMC)Zp=e2}a{Dl6|!7gL_^&(gf*yM6DE7ptgB|0+47hmwZ9@?Sm;d<<<4 zESFw(y)E1aHPa>w#f~7>*atDRPQOPGHcwZB^VqORX}M_RM0&GcxMde~n#v}k>?fHl zo1WYdgAnZ}iM*VWg+hUL9&usT%)#4OuT_gbUTKc$-?!0yjb@S7Da1~E5z(M?GY{dz z`;VG(Rf{_^xouD{A4yEhf?`!%6CSM?bl$OMo=@?pJU{o8=&XqEmc_+QqFL~g{WQUf2Qv9bS@a@#tT3ye_U`4{y+dO~*f z-xQ$`edVqu3+#L7Wx4H1{46y$AVz`IXWRC@%)Kk72>(OrpDL{qNoB-U&_xT8`;4!V zgkrsWjIqBlX24~P-)mKU=Fxbk!SYQ8W|&HmcGT?M`^qRXKJzRClj7pwi)N37Y~3l6 zz+A%^p2lfz@}nv%%kBa;fnQQa#kuh*F=O8rD|1_8%f(A1X!jZZ05%~$HeP&nCCHk&F;JIA984*Ep0@IK_E%P34wVD#QOh@p^Q6lU= z6g-*Jfrku>2~@MO^S4xnDzNd^>SENE_MB`~bUG^N@|5#FvnmG#MchX2j0hj;zWH$b z?CJYgqBJQ{lHM;z{CrP5mj0c5R`t=XJX+g6NNBY-B06OUzX+an$dZRT=QEO$Hoo&k zv<}=rMZ%HXdZ@!vrodt!KkJ-#rRLfQr(~Ob5nG<|C|;;-qb~>Eh$<^kPLzfq2||lW zEqlZP>zD)=ecwGi_@!<>JMJizHX7S6{r0@yP21>A^N`_6SRy!d+}q^AG(YRgczA(yD>hzpF;Qr+hY6%klf|vLH7Fh?`lJdOVkftQ>7l>3O zk4zU_^_9=2vh2Og)6;-xSq^Y1IXaT-Ook$eF>m*Pk+Uqj*W^1c*-=s+P2La;n56hx zb?sf=8=mrmgie%%@u;y8(Gmz@G9o03{D?pNYHWw>IS)98=7pP$;cE8sv;v9A+67wU zt>fuXh58i@MKmz(9E?~mp0F~X_5vp&LL&s6j;35fZPYX&-{^m#EQT<2B_S0AX44SW zkR@})TMbmqonQ_nLsI< zHW5gaGTEb9e(nzNbX7s&bT4R6~);br%`u5pt_$ni^w zSI{V=eKl_?sOL&HzPfoL|5nh6|MyQp_EdEzdj&`WtQjy;-$KgQ(Q*F3}m`{ z2_YO^*{xQ;Zh%L0)@&UNFf8C4TFYo^wmcrpS?cJw8AeT0*^J7QlE4d^g^HLF?zi2UNom@Hox9E^ad1_ z_o8E@jLJ_1OGxo4mC;gs*vqDg11d2J_j|n0MrbYN^Cy~=xX|31Oh$^moOO=zIG^lT z4u40pTY?ky6byA`LDiq@jwBenNh;=#nJ?RJ`B21j7%}x%(lZ@CzG-{DN951t+^{+R zs?bA*Gj}E@izC#T&Ry-)sduNKtSU)m0vm6ib!4T1Y^kUu#vK7z6URkhWGsiS+lXNB z&IU7Cbt<#y*mLVE=5nGzW5n{r5(()kRI8FXwgYu_)4)|)_{f}u#@bf-9`C9qo6a>t zjhUtSF)2}nQckEK2Tx1o!)+HTHPI5kl(X12en;p;be(`th?8&lisCN6vdKdx*l3Cj zXOVIOhl&QPnSqtK9*|8;+V=G$ZY8W9Ba@TU{k?QgC8%A@`y1xA&+7 zTh33Cy69a#A+Hj@QG{N5<`SmH*ZoQ>I`i}|N+R0B%QePrhD_oPh=2lniG|0_bg(ii zXh6MWzd)=aIchMfu-taaxkn!_Lhx4TTf$p34%2Uu?e6agP(gq&$$5h)&PFUb)1AB47o%cNo5`AOSs!+MExT{wr>Bi#jl@Uh za$M%i6;t_gmYB0xtZMh)$_lKWLng!GWcB&a8HcvLDDD#&`FaG3hN4$;TqXt3+MJx( z@L8B&TIvHsk%HPw7b=U2ApcrdVt7qvFO2F>*BmtZJUc_qWdtP(b$u^r8K~HB;WitN zFY}AXzM0PrRJ~{JDSlaP_Ts9+UMXH*wQ4o3RSkF5v7ygo4aXAP6vu`_@Jj?FbVAK@ z+OWwP`6pC3ef$Y*lss6#!*K%z+*P)vx2FIXpVD3Uovkbay-jJ2&VIKa)U)XS1$A8? zs_~bpZY&H&8yeDpla>L80ElT`L;wui$Fj(m0N(~4|!a+ zogTV+bEloX*9U>D+#Aqbqb5mbE74dRO5V!HCM@fir?Gj^qx+cK(^$}-w%+5;CVL2`onqlEcL$gThb({KQl|}sI-4e9z4tBO zYf~?WQXpGiX?=nB#o*%cO`}&Mt~$LX5#3Su@UyYU<@*i?FMfVszg&;W!`$heAam?} z-{}Siki(ZEa5%QMnlcwhbQ*8Ongw8i>YS!P**D{Q$LbE)A|K=FdL$!BxYQnbxR!tq z*r&*M^B=BaT z%yzyy2Aq6Zt4sE>axfj;m>%_{-(3%l-ni?v&^NT=D-dAIXuj%}@g1wRhdZhT9(4gP z3^rB@>BoEY#nw296lBceElc#vc*D~DC%y#np;!P;X&+V@v z;;bu6%tEMwIP|8|bvdf62ggKv32$8`N{Cw21rDh4mT z)mONh zK=@FliItIY=Drc=9&7v8-=575ls0V8iYBmLqI@H*m;L)WUwBQ+zeH<54`k|Vlq)(o zfj&mr!Tswn2bN8*-rN$6-6HvSwhVDXVRqeP12^hJiV24q<8p$g24ksPEV^n!$q(c0 zfkNxMJG8_-cmNi*XjT})Y$nTljRmTo(>BHqRFkW=S|Ub$z0_Tu}X>| z6+54?MVny^0@@$=azD32<5d!V?;L0$8rSC4PSN!MMx0L6yPjwnbwQ9gcs+Z3tmXPO zEE%o!_4lJ16Hm@)r>*U`{e-H1E&T`ON}(N-)^kmCX}$~xLF>yYEdxW8wUEV*bd0QL zVS82pa>x|lxMHc_<$d;uFPv#7*t6N-ZytKH4T`WB<4wg+RKQi>0V!tAGMm$b z?toW#;+1etLIu?;U}LDh|4iE~b=csuhgy{iO(g|RwfICI>M!j1+ah=x=am&T67u7U z9|oz;1B1*`tBHJ0;yJ|MI#*P+4M#-IU_Hupa1f`0LSG8b2kY#d4u{e)61HbD=)}o` zus-*9d5#X2OO?JxB>|~|1wR#;(tt!xef}nnMRz6#sCWujV^pPk`#y+8g%rU(A8ToW zr76Rqq%IEf7|615nUz%eQxCJ~H1DoxZj2Lm1%p8ETbpl9*_-r zsEpN$2LUguPK~CRE`a*nq|Bnqk{JVHb-w&xu<8|>7)tn+cV~kQAg?;xNy*BgDmRzy zs`i84fC>x*RQS`C`^hdYpjAV-Yf;x8+)}E4x2j{_J-4K)S+?eDx<$^`fdTI9Pe(OI z*@Q+;<@R!a2ehlnHDP6y8HCT#)GfN&7+QA<5@}6nuJDi{xU;@%vdi9<;)KB8=r@$; zFV7d9o1$L>1q7Rf-+ME~|Fj*0aoqevogp1E93S9Bu?Ffcnz_OAaav;HA=~#4RMCLE zRbn~iji~wZxtwC~-d%X$x~Aslyh5JmTiu%OKNVARLTSc|3}2FQXLE*TP$n8rVt`z( z0tCu2X$He1#a$Dq4@|}2raCg%Ol)b%zN$b_<`Qyg#^OknYcp7OY~1rRL_$QtvL%Fx zqvl!S#yLjSXxD+SrGlv`#vkLfg(NYNg{ZB3# zun8IahIkd{UNo{;sIf0YB7VWpUEq=TK%MKsFSH)*5q7lDP1jkE$6zp|eQq8~& zKj^*%&l-i%-s`O=s}cmix*R{qL#pSz<&$dAu;u=tWFzy=ncLU7rLZDkQJ$GBDl6-Q zx}k{AN$2UOXvn%MkXn)XiSeN3VG8%1I`7mS)z~RdtPmjLd(P7kIt`{NGnRG5U{GhA z51KTZw5}`RyWv8oq>u;j8Flj{R56}RSZp#D17|+W{F=wDQ?B`@4Rd5$KdQ+qT!7bM|rc2>SL(olpF?c`K zmM|StCcdJ+qMIT>ZGzjNW@Edo!Y|1Uft^;hTN873MI^a%OXO$_r)#yBf}u0+2(E-R z*In zJ>FcM;n$=ev7G%<^A)CnPZ}re;8i?Xo?1pqW>z%@gipau=d24YX@&O+65|Xi2^H`T-{SY@zIuY@Oh-JL z7^_TG$7f3G_*J42`<*PDmm^j{T>}gmpuMaMM#gg&4u)Kn{Q!^AZ5RqZY&23r-g*(0 z>nHz}3(v81h8L_#&j)VbJL)89h}va8!0-BFaWRpveb6_1b^_<#-H!CSKg@cNJ4U}# z^~DYsBHvr3Bn5^|{75(eF?nA`+K-iOji?3KA}1V9`B76&$mafJ$}#&+Ey}WYP5xuY z<>x8NUlRl|4zpH0<#_HS>8-1fX!2<&;V*fKS6I5UZWuGgB1PFDiwBYjFC$Zk$P`jg zwd)Bw98r+3kN#hZB4Q>l2G3l~)Bs`Nfemj@r}kQIOM=wjW|h$i&^XHwG@#WRMfrDz zGpM$6ghR&V>9HlW7`W+?ms^=ZyGko())T=W55=DBF`6SxLE6)%{^l-}KXyFKM8MTZ z1W?CSMXF7n-3l6)w~|r%b&V5qTqwM6RurHiZj5Dou^wU}%lgIXcgE{uS7R1Uhiw{7 zymV&1_NZl~c=-!r??PuMI|T&>`Q&CcBYzJ@3X&FU_Ph4oT+sj*d#%49|0EBC z2KD@7#f*n86^8OMo#4shawQBO%xNi7At53tl^I^1PVy?`1NP)RbL7iA;(fIe4#(td z3y*@rsLT`1Fs)g(tTDhh3IzhUM&;`!9JBg^(}mzDUr9Kka4q1MrS6`Su%llF1S z+K>px%`Pp*gH8Xs?%{4A#-?t+^;ys1qK?>j8eJGnl2=Txj#Pb3ME$ zyZ+)Of<{RRkS4&;{vl-0h8#b)fj~1Q<-?2jmAV=V*0v>Na<|0(30<{Pqn{w*vl-d> zZhRf$-Ldy@Pv@eJ{>R7J+yXoj3DY{S)}HNkSe-^<^MK<@1f?u=)MU4@r6wVe1{3ON z#dR%iG&wnW>Sc_=Z1nTnBY0A7mCaz>{KeqsMiA5ZQ5{!AZEj@+o@#j1i!6}{06oD} zA)@j-+E-FPL>IZKDixwc51_pPE^pCVB(;1kl)wQKi z7yJN`Yg|^bH*v4=Sa-%08DsOHZI>)RF^SjjFskK4z_S~W8HOZH$p~OzJ8*hV*Zh6D2tE+ppQ{2XTOY)Dt+VG7Q zgqvWu>DQR{7Cn6$%gD%l{qCn?sjC)O_LEB8zf)OE)(Xw- za72N46@zs1W-iy&&k%YM5Ovo9{?V!Nk(_vvCw(i+|tD8BsE9= zHWL7O;yyP^&!yroU%wNhD2Q-WP(#CS3TIxlZ8&bUs7hnu&Xz}fuK4yJ8&~;q`};doD@r(ePs!{s^Gxj*nW*nUGoQl#K$Mqt3@DwNs7Y?4u+@VM@u(DwM{-XXcf z=Jq@;U(lW}eM0`JRPUv+3L+SXx9sP()F;l|wiKW^7PnoPN7zm>tI$&smT zk5OH{{+a#N0^ivKlhF7Z_!NagI`2-h>DZa1BBr-PJa*`#biGI8i5R z`$mq+GiEp$(QIh8rujQ6CuZYGR4RnUnK&x^_3_ojU7njC#yi&%FiTx;O@8#D?cBlN zmW!zl59niN=|;_ix|3?=b^-Gx51z&%r$n!2WHM|eP(xWY6mZ!a#Jhl-1OlF-~ z?`MBxjjJTm+$KY-6>UpHlleWhkE`ya;!68zQpJ&Q1u5tBFFsuI1rmO3&f-DenWwQR zGSbt{CmkZ%XI{VO-s!xyLH_wMRj!w3jjWJPOGQ@&6CkA6fkTP?+}lG$bG^IjHj3V5 zn04wiLZe0<h`t0qNUy%ek!C3sh;Jr0t1DC{c8^0rME17Lg{F^Ct<=M+`PyfY~zY~rz{^&D~ zz;1$2 zd%DomO_0AKw>h%pV~@~cakpO~@A>;MPiyI>zwAtgfHUmH@O)@8%j9mv_i$osGKML` zWa}Nzw}j4T=OCgw^NzKOwbL0?y=?us1nXJ*^4$V2y>Zk?KkN4i^C{(;$$LuK)|j%O zgq4;#QKx4{pX#R6ASRddRcs!1GLB@Tz425vLG}BClznNUG@Rj|fp(@j9v=j@(pu77 z9Ntm)6h&iTtu=-p+wLTu4FGfCD-QnX2ol%g5@Fh3^MngLK_ueK| z3-GK@lmB5=ST_}D`iAzKEJ=Dw@M!;pelcA>2k&D%r+WzP{f#a^zzzJW8?*2*-^2g< z5;v9U&;$c__eUh6me;_A?SRDn+FXYyY(ikDbw>aVj?MNh1CBbwa^_YBm*s`s$%=o@ z6HhVzR0lzOr39>^YTHA-r1uT%FUbp_iJkWLQV{UC?s-DLkh)wDvTw92&c`(1`c$1cI-uptA|bP zGgIGML*wEm?fDi*rzA;+=?8V z)wI#7qsrb(?i}(%#A?Oc$+@5wQ{?Gkz*SGxdi`lHDk;s7YOI#%rf*+gMP0!UTnsa( zg%UYQ0ebzNNJ4%4kwJhJ$P89jz@&S1I(@-XiuC)J+zwLVEGA+=B~A|ViQxiU$mwsZ^ZS>k`1WX~Q7JZ#3&G8@m!OPAn~KW(NY zI6&68oSdJp_}r29ivN(bS_!wQn@w%DI+agGTUnnrIKO?cnPtaq3u(aS%12BUuUA&* zbzkP+;mbtx8@Je&1#m;H;sma%!6$0H{#8&XN746L*HXw`NJ+30#?Flkqx#8QDX$NY zZ8_NmFvZ(}NkzEqR%Q>;QB#cfP4_=Mnx&NsF_8KN0h}E{fejh@?low*Slr;=dTU5j zN6y9KRQydOR499t9j{nxy#nKYe7ApAwtg2KgHu z7Oup5$en1ovmI-n2epT+LJWC#p(o}~WZ|U^5D}$EK)HMbcL?539!+8(+G(4gHv4rOp0Ed<_Z7)ZD#9<{6t&OKYdEFBIt9Omd>h14h zZHh)ST5(Nhm|P8>*paN1cZC(4ZWGQVY68E!KLY4yzlN^RVcf z<;*0vfuen>xhm9#%(84&*BaNSKhx8doi99&=VW{xwcgHN^7GtLY)yqkiDfWk{@`z# zR)T5YNrM^Na+%x*?{Q?lm2eei)3LyJ9wB^k9vTvmH=8lzomUOxa(szh31E!>4~VH} za-At~`g^0p4!=5;MH7Sn!yI)-X=!ryS~S&M<=j(Cy}qtqpJ}TZ$70!dFz@k+8gTIf z4CWG@k&ru%Q|86n(U^+YqdU#&@Lj%iGnTV(}kQo`IsFIPHF}N&eLzp)-q3< zIwk@qXFf*8TAb7+%yiI%>ma4j*o}(NsKh|qQ?zGbzy+uMVE;|if!iLp@7(^C1fj4z zlL2wV5ibTAdN8j4+pIIbSaa@UXB6Yp_(Jq!|7X~fy9;}Zio!dq94yQ%s?UW?t-Tpd z?t7j&6ZJWwIpY_9Ov6UFQ>RpnpdGH32U569{37ldN8_`|O2O2EPxV4UiVxq)ERo;S2btN|T2y zpGic8%tIYfMoYgR{sO+;jq<+%P(8ENXY%wHJ{&*KlNcB_Zw13YRTWY4q{*Vk;^2X= z@60@Qkdxd3Fy025?bn}z2lQQYnSK23V3k|YP}pQ%)MVbH7Tu=~V#;lQ<1_33lQiT1 zs@?dHfz?Mdl_(V^A}X{*)EUo}c0D&*Lazw9r#ijVuxsgS1ccrUyi+r{#>=k6i8h4fA{N|Kf?;4gTxaQnY~RLCbo-Bc2X;YRUkH*?4c5y zkF)i%K3{9$N1jr>wOsIV`wOb(D0I9vxhQ#MUWC)~|8)3!emH?{2lugjTyC+>1x{Mn zh&!SaDG|!ddbkx76fCa$*|a_O?a_b4eo7j0Ehjz*X!^9IG$(g<`*?1ai(JsM*&Ri4 zJ_8OYp@}#EyiU>d^pClLg8gde2Psm?AMp309h<&n#gWYeBB_&Z1;(Rv(*YO)LUMsKgS1UZ4BxGz#N6 z`49({PU2N&3ifD+p$E2dP(ig_R$We}5B}E%ca%a(ui44b-SjG&7_ZRK!7Y;y3@{98SFBM0sHdwEaw`l%&?C@t?A`vY?Hc-S8wi!Qfj|>+! zWADiCNTsQP4EJ>N)PJ1m?A_&^tBLMj^bU<{dG2Eb!7pY1$Rlogkbc)&56963MspW* zt>G(l8}+n-Xlt$Np6rg`dPY<%so*Nwv7D5nx8@k`Etmf#r(#} zIN97E(~&~eW}Y249eLWRe>*6zKR)kVdt+!k4-2{Z^^%Z>DVK1SU`4BnYC+&Z!_r=! zc98y!sWufsL6^|7z@XPgf%{q%3>y<8{9_B1n3zBn`lP*kV&W>XDJKUHx{&%MXBzkj z9m#jpb>z2|#dehU`I;(Zn;PBvT)&8`OVVk|owPwi^U|^0#M|H!5zVzANtuw)785ig zzFv~@2f~Ori4$D!fL^ZUO0p{plO+o;d|@8#-FtT>;UBEyP=cx`chIV4gygLn5po8V z@7qQKHxQ*V84m>LkOVM5y}WxtHT9}z4B{sY;v_0u9h_F>a-omjF&Jq#8ILA9K^nO1 zrvSGOS0P$kEZ_I1T*raRDWM#U(AubtICj=o9`v^E6^^f8Y9oWEm6Wai+On8Mxd$k> z88fQTdc&|_|1nw%{tXkq`nPalv8&Zuh^5(=wd3u}R_+a~Tnccur9HHa3Q=;a^*hEm z*UlZj$w!4Gx!@~28&SL{T)DesgBO$e)&x&AZ_!sC;k~{@S1UiRUWYA(;v6H(=b7hR z-FsLkr-`zQyvFvjP{J<1M^{5sJTkF`2Jnbe#IY}v@aXgSGZ+0cH9c(T|NtQKi>NUW(>1Pd~RbRzFd zGcp69=mTwW?HbOH@jOX0Z_#`bP`B|vAe5AFCNwTL>2uy}F)k=~UGXVbS3~Qk1%`oK zP*0vq)vgMXf_+Ue46FA~pTRqB>BoHHZ13d_EHBrkpHQLzPu7=v#M{YgE!wzowCN4S zsy8_wmxnWdgUa!gX;&{Kz12zihxA0BgGHauxgbgn1O@(jQ(t_%GM~N6sN~TM{95#R zAIb-bn3vQV=#0irEBsr8U}cyq?T&i6hPwCh6>ma9ox2@6^&ZcVZxzyo^8K`ixD-$KnOpYg_{O28j6kuwE9WP`j)q7ab^c(3m|bqZ#4PEwfkNl=w|MLIh^T6+B2)F_&1yC|?&dGxzh3hQ2ytk-ar3u*Vdwv%34MAr|XeG7LD8&OTMfeLh9FNKCS+7Ngqh z%R!r!iM$F`my_|VbpJC-pnm!T{98wcD4@!$6-UbBfe(c3NhShfg9F~H_eR>?P}e-S zN5)%T#aZjD=Ug*xfgmf=QVGivY1F?uuhaV1-DF%QxV>-=f})w6_bkfVS+<#>hlJDq z=;9^FV9RaSjvo+#NB7ATn`3v16}60~=9`K5F1t+g7h)~Nkz5b2{MvAZj8J*-_`9jk4IV}-^0@V>oq{|=vVQ5WTDbcaNTkz;e6tQASWBE(u_}oqqTq2sM3pP|;Fp_0`E?$m_~j?| zMw^YqoC%k+t`kem0p}748qiU6lD4+jmCUwe2J{O-^#<5%+<{&8>4nAg#E+cD22J|N z0!=P||DRj{T;36Yl1p7P)=2gFF4Id*>Dr~011^`8{CoGEbv$N4KgdlNec4)Qj-1Hf zXvmQ%c@w<@)$S)}o<0S=)Vn!x204FgA6|#*n!^M7>$EVlc_+19H(R5RPC3-Y2%=T@ zfaDI2+vn8LGHN`n+*a4F)@mc(A$=ZzZI)08W$3*~urxSfaFUE+5 z7K`0({wq1-!HH6pJ5zXY?q&J%X0=akM$JJ6J6~I~qV?b*(l5lCE|?a92SkL;wer2K z##f$%dun6@(qDvxwaxP^R{a_ z+H1dtH#HUaxMFHA|Df}KI!lQ0*_{VYB#pR$da2C|SYfOUa;ItDQ_XqYMO9vNyI!xb zu&CFXBUBK`oHE7#EG3)35nSCt*17PBnXFO;cvCQWgr^{DTzscp};5>mpWMXck6jD%~J(A*X= z1d|pp$0?|nIP7=|^h9UPXUf3i-oaEf8#P_7bIA~uk$n|JUZUEAftG20Id@p;2n+-d zQ|h&auEaUNYH8$|Wca7ign`Nn`P$?SOPmHNcvka z<+}SzLKEe$q$P@?3w8(}3J5RP9(ub&TOK0^#*d%*LOKVTj&*jcRhY3Hd5>k=MA*U2 zT00^IU|`oC*fVbPbn$+ba7%i@+BXnFM@~dSh}T|UABRDIP+-a)H6i;zd{oP(PV|@D zzRe43D`-NU!A0i20(zu_)C^1YFy+W z8IUC_Z(?H5H{4yE>omKSM#MpCzjsP-T?t?7IEmbRpfjA^@Zi$Zxr~3l*%`u=ry- zuK59chKz!QgemJnqhSSM>S8{<<}7jnLIFZQun-8z%xq#yBu$`8M#hz#A(_5{dJ>4jm1bVkN(n`oq z>Hi0p|Y zErIN#*BJCmY*9d5 zdJW)9jAv>=;#}kUH9?u~p;z8kWxHuCr@9nkOrQR+ke*HqG|v*@!&zKT!0n0sKs}m2 z`u;13Cvkm_f-6NO^yW`>ET3MNNJN{!6d&Xs6x058_7xdX%4%!=zk&fSZGGm(NIq!tNb8(@fVqM7? zt~jt>$Orf_$*7jj>0hPQo(A>>J6`ucP_xV!Qde%J|M3q3Lq#v-FeX)2vaX6u|`GMsF%@pYMg@hrM)vMC)R;*8o5bQIxJHHe7a1p8m zomBM5VR0n4^0OHUJ{gQWznV@w1MY?Ak?)DI>olZ!DNJY=Vn(~VUwO6Vr!sj#V0o4A z>o&3g-8)14YwGC09l>zWk6p>ew&&;l&#P*l)P8~Y(q)d%Y*FXXc;59=wDXG$%o0WO zj(uMgjVUPhkP`tzWKdz3$@-c7oVq9z>f`)V}o^7p8bJ-0JBJ z{t$7)$6xx9Jru_GH%5wP`~FEL=En{-?Z7rXF$^`UCW&bx#ONdB*0}o64<)k;?+^5h zV0w@}LS4IW8q@!)Xcd{4X}q{+>1QvvXWLeWPqKh^&YP*^dp z7S?7qLWQ~G;Rl#AE;@&Pcp&}JQ5THo35)XIL{>?_%6nS)+egeH)bztEiB4344#KAn zp5G3!?QSMM?*~=vxM*;_3}aU<_d9wD zY0)UKX{BdpX@`z<6aW-dyz~8f1#u$+U%;e^yXx=>E1Su5HgPLed1%4*RDOJ8NzU>s zC=C;q_?A55FJCE+$co8IOfO-%@HH8ZPfQG4Ivq4^AR0qky2tQCE~nZ&?-VcteRc?! z?XEGp-?cVlXEb}6>vZYlVKE)omtDf{R4mD}XAkgtdb)4go0r;~aloTrTBC%<2%I}j zXW7Ntf3g3qjg=_*6p`OP9L|p`Cgu(t^nI6|sHpT1#cqf3s;tm{Hc6-bV%ye)p1|Q0ch?AbjM!mA0oO+W55{0ck-s&|l%lmjtXJ2#ow8%EYh$ zUbjxmtmsR9eds;PO$CLiZoN)b7RT0JIq4)ki}AQP{N3b%>Hv@xApTv{_vCQ=cvMFGeg?_ zUmWj-wI7n&3y=ICY$nWsnwryk7YzNQLf+kk^?5>i8ZY4Ob9%CH1#ASyP{8xLAO8m1;jZlgo*y=Tg@+gmfHetBx;eGT`mD zS&djFYTu^8ybL?-R!N-OrW@3rFiD7G;O3X9(FO<&?Ny&sDQYp3^QTkyPB@^T} zVI)v|L$9}Ji^p+O>3^gGye&b>tBg0#I2LV%uE)8|SDrE@Mrw+;EG3Fw}cexd-@8i(lY%$~u1!#H6cIX^; z1|r=T>tO^P<0~x(^B^w``nJXxOf{WQXE0dW3GsG1f^kNh-45;CTv{D_@N@^&2Opkr z<^=FYQMNy-*$kV+5q~}Gx^g>UzhiJ1AJzQ+d>0T-7X>IAV@1!%E6egKO3p_ECa_Ls z3HfuL^tqdCOqsvS-`vzAe*f;-09RRj_j(E+fr~FXk6F!LMYbi!09YE$p`)nfIO+}a zg0N49Bg{dX+cXMO`-2D$;)WCqk5G`;Z`feO?mtCA4BiR$X3JZAo_-(pLD=h`s&D?x zb%xj_9}%JbWCD^s7%_86D!>x$?8p9`L+Bvxf;RjYO!{wN4hyPBU>WQ7T$#Ugp*XN` zOiX>FY+%H{2$Sy0TYJ8G(l^Y!`mSsgPS8?pNA<7*rU zo+#dT>5MY3RjVm`q--#}QibU)wr5(DxILBs=X?-=1m(^L=ItB6jRG{v12qNVJ+Gd` zz^btdA7*RRlq+`duoLbM`As^W62oYB9$W3(yTAr^UZJZ;V>T?yW_0R=7e;;^`!wYG zQxYTpLHLIO5{`0uaQ(EpVZBb{xZr=y%XH54vINY?RH?b2pYpXb&TT&oyT66UJJ+W~ z#c(9+m^qi7xD+dmOyvAE?>7a@($e4rVp)xZC@o9TohP$2F0K&0gO8!1^PXK-I|_@M z5fxAhrguG1&imaO>t)u&>!X8r4!3GJsXo(Gqu<~mQb#pj9KHL;u^nJ49l{I0vI_9(QF zNbkdQ=i9ZNdT7`98IS(8(%jQ=Bc4cq4A`&5xJ%x?52Y_={l74-G}^iCz&@{RL<5ge zZuaDD3mCN}vm^DCym{~B)KWqto9t&PL80HqE}FCL`lBztmm~B0Dc;`Nbob^5rh;ro z_M%tn&Cc1Z8gw zOg-KMGE-Ms&yJuMEDl%3RtD;&p(+*Yc#aDmDrv%fT>TtECnv#jzJe8H+r{u- zB=`4yY^})`$>kQ)?x(fnQK)rY;m#6+T*=28Cz;DJIf?tfa|QjyJ~zd`%Avr%e=~1d z6>uSL1CAm)0vR*aC`gX;PY!a0?D0P(Ly>F$+6?SXC4x`Ni81rP-Q@YHk_cWlPf z(SF^msVfKPwC-*kJiZ(L@{)$Rg;=rPZ(!$Arq^a28ZQ<`8L^k)D&LB}foKS#Hzrf~ ztPC!S<<`zEBvGXH$Zb_IxZk`IXw=qI+yi&{1K-BY z(%sl8&GS&ZQ;B(Vw{Rh8S3_8xj0-hPaPU*^Y$Vpldish~?n_O{Gm zG%{Ch+)_!U)Z>xqTeUsdrseP&u$?WK0wPpai;Og#H-~4k(E=Y((&6#Cc5vqFgEGtx z*nSP9IzzCzjNG7orNuj+Aql(gPkY%`=U%8+WIwEE#EfXZz2_mQz4P&r;;C-6*y+J? z%8gu*`ZT#Q4r6xFze_U6@_y{8s&)cZ;>VJU++%RJe759&F9vBb1{m9^oG;=`Dk-!W zzQ5hOL(eYPnmYw;nHKOp;DzdBdr&HWZY4}t_LS${wsTIfc{LkU1PJog3dDNpvO950gdhj(P;PGE4;?ZS*J9#55cq%9#_#_#u1VFD+nJ zQpaUmf9|aPeSg10wTy=EYW9zgWY1RVFx#{kE=j+vC94rg#F!}E7|!JEwj#kvpn2I( zVEFtOXMK>tLr_v)O|Wanas6C$c|C}5IOSaECXR_4z$wfW%+JK0fz2jeun!N) zDkVQL(0v`EeU%%CFA`ln1&hUKMxY$?9JRUJ{j*DVYMb%@8(E%yAxnNK*RF0-Rs~wS zDSLnKSePBpxdtgiwzJwvE{#3*=vj(u*C4D5=UsVi%sc zjLIam*L2qxnedHj>CUl>6RD&P-hV3Mf`4=USATogRnBdU)SetoN{hG|jo4fBgR)xNRQlzlKiDbUSUyw~pszCLQy74lTIjbv&J=A8OQ6V%^6U-=|52SxGg7#C5ld zrg{C}rRv)N#<&C z!n$b9HOs5Dvv#Dsv;YpiFlE!EV7(5E4WM{|4AvxBo>1WJ3bazK212lA$!Ry5;{!N^ z$lS?+OBu~FG_6?i>uYoWC$FK}%l)n8I!_Ex{F8taUPA!dZnNtdI$yz7bv9@o`m^M zxbw(ba9PIV&e>NNT&!RkNL+w1SE|8%rY}Rk9e2+ip~+6r_|5afN(;tr@XDMd-RPhdc%9!5%RP zbz>P@hG9;=B&M#^``t@iT96%4WM$itL zdipd}K-kn=Sa+eg>inXHX~ZEd&^^U_N?P4r<|UA=>fHxF|17@;CbUgWoVDQTyz1VryYJ-;xhMk}qTbz+4at<6)YQj?Td~f2+ z5pBBh@*FmTPj+aMdKC_}MXNXm%@?Pnry8YeV(a$(05SW}TdJZ0{GLZEj0ab9irdl1 z`Uq5lGi@%W?msy6+}Tz3UK9p4HV7$cE?VMBh)$_+a<+oFF8mixCVtNUx)P1X^K08s z1@z})Oa5(>Cj4deydIpXlU4gSUK!K>b^&r#Vv)~*{JGciNL?mSiQrFeqKHsDNRP5F zZgfZDKfUn;6$@5O-jt5BR9m!yxnuP%PnVSA6#>K#W-H9GD@-2)ti6r5`#nu1ALTt_Fu=r;7-K(IUII*Dj@v0CtXgS-*{XKL0+- zY#G`}t+P{EP<@su{kgpK`#W?#9CwOvSPp)9J^k+>PD#++53*<-d(^|&1Kw{{eS4a_AZtd9D^ogQwJ1`T<_+um>St9;x_H;^Z>q`}0 zq_<_L-PX?MC$KbX^WE!mt{PGod$42C8CIFmYeJvkx~E*2jC$7Q zo{jsRI5aKc6m@@V%5nE5h)N~s#FN=X|I8t{xZ^p`CTjh^~z8_W8w&B zq0jtcOzAVu-E4>fHT|v(R6Z-EoA+AsyZ9&irl$oRd?AugZJ4(bvC^jtAG!nNW%m^c z){Ia3i=^<##-3i_`C1F;bd!~uVBh5fQGvMKY<@zZd)MzB3}{&Fp!%LuM(p`8UC3Z? zdGC6NLOy7(0SvhBtuWA(H(>Ed(^>`6o3)A89g&o@jws4lbxZX|v(oN-AGHqwNvhO^ zkXC^gIDJiKfH13gAr}gyhdUsA#C$NFYr} zT1jvXfTs!KmO{i(8h`ypBomfGB}J(Q%0!5s;Yjt>!|A^!NIh%e{rhA;iJ~L?rR{o6 zTlAF!j~xDuuZ(nDS`$yL243%S=g(o*Nvtp>4=hw#s}&EHLFQ8UD-X7+*4IhDiwtvg zP9WR#yVPaQ1iNZJ>{3(zKg{|+aC9Z^r+-IWfMt{l*(W_!b$id@G>LMD<#CzV9jf9H zR30<-w8a9HIitClc8qd&dR-Js$>jR;8y#!MNS$r&ROs-o5F(f}Hy-enI(&HR@Os{o zYD0<&_PeI%1G`IiYJy`+yBRs&1gmhyUGe60e{b*Ky=UEubuv4nZh?IYbd$K&M_$Jf zCWW%l9{GJZf09CtVn59gZod&=D%QZQ=l60H_uaOG*0*SQm*BKo>}lmNnlXo_+6>sE zH=*z7`ETmRdp|k&%(OqHM^b8p&7j*Lky$aLGN?ZR?CRkFD?W*AO+pP%bBmJ$qO?&yAG=p*ighQDYv*dcpMjpMZYr*!?OUcq=`v ziMootEweh7#-78%jW%ax92?QlO#2r%{*hE!4P2|+}+^@-MUXLU1LzaUN z7N8aK6j}}Tq_WM*uyUkEndYr2{JeKd?=7PPh`+5gZ#QMzFENIWz#f*+Pm?xLf}1M32)^V1aTf zWnuW8ThHs405k$kH5Ffel}KG&@RdDu&TE|{Tndb^yk31)Ls*3HUa{jEVN9|NPj8HE z!^%aYYBZVbtLaU$BGyz@moWxNjL&q*Vt0E7h~=_4ywinnM;ES_gyzMln^`0FFyMb zEjL^n>_d9=jd$&t@E37c#ox;4f%1hDBwBC6=yFj-hhG78%w>htxM}zp|YL*u!`1koHUW#@GJ(k3zm4xfxsz>1MK4# z>caThN6tGSqmfOEay8tc9!_S9H%u3e7|!7X*wt!QoK5A1*dt*i>htZZPvVc13undZg^bVuFns*=K&LY3n!xj#5U;NsFJ?x^bEcR99!P$5nJ=Y zuam=Dpq~mHjJd&|(O^;S@KM?G51$&^8iH}Wt$1ym>xOKJ;GU76vA{_{#7dD^u;`!t zUWUcOtr4WMM)IgEGskXd*K9pv!QRV(Z77-b(%HNji#Q)K<3r>86lwM#OX-ADG1*!- zfGF@dp{#yf`;P1RYK6{8e_fp{uv*3{c&>HwNVLEyAzf4MV=}2HYwEna$@aSoR1hI> zkQ$sGHDM#BLXH0qVGhR6%c~xyaOHdU=}$)L z>YTnUjO&{$INHs4oeAULI1U~$wU0qD@@{;ijaZM<;X1VLCqAwo(U{mR`HF$~Q3QB{ zs~o1x9oVDK)TDM`q7p?#zvEFr_}P4z@nU_)BN;*|E>0t*a;Gj#Slaw7up#Gg;-9Wq z#=Ti9+`+M_dN;XHz)c(WZ^dX|jj146wXQVAd0+FA_4?Vn<+IrnUe@?c7tb6sGu9bn ze&2t$*8Bjm3RW6m8z0C~3!7U{{PE~Ec(gIm*OqCIb$7(JQl<9*!{s5qy1^Vabdv4e zWRDZPP(L%3ueVfdumVYHF5p7kH3|-GV=bot@SV2rbg^16k+Y z2@b8yq{P|*d`=E0;wQkE*=7kN^e^>&zVoha_(S4pt?MSUY8CZE{*7q7i22UuP(k{( z6qktarL@Ty2uJU#!GDa+KDt&oY-Pu|E~!)d5Su%^_13q}$+d?c3==sx2Q;9PS`A72 zG$Lmee>Z;-{IZyS1rF!b@+aD*>k*yg_xEcv{9>h{;c)}6N>I{@-9W*Y5?z$sW4OgvSjk6AI zIig{$Jvi;{VP#1?#Fv~7_VBxBzh)FAI^I#Twuj4eZQWkP;GSr&1y|lo#hHZ(`H&$xG-(B4uKmtj!s)e>?9F6df+o){}B9lJ9GeSWyZ-JEc~ zVuSg5fh%BCczN}4cjSV?vF^^&vN0bK09raa=|))c-sh{J_Hlji%A0v) zG|{Y+<%m_wo#k%bM0ju3jN6j@=yd8Evv-)-bPWDPm;#UJ^=XR!2Wgv39mddtXBIhi*o^g9h=z3-mYyl zoS3VSFVVMth3)x(GZY8ioe=r@)A9a{?w+U=riO6m*8S@Eyo~z!mA%=HzUVr;u$8F} zI$GvU|4`wTig`iU#hmFhX7L~f8e6>thq_=w&b zDK@b73fY*>$-Zrv#yB_AvbAPQybUI^tDvGi)ToC?5#%?U-%pF z05C>fmGtmKukqEfR?1lpe{ixCHZ&|Drjymq5uEyl251Lj$y2}zc0MAlT7W@sjR z4~G+IVclKI{ z!pYV?dQ%B(@(F(t?5s@##MFgHicqzq0r_22Rd1m+>e@B@iq&4BWc#utrM^6X=Eov4 z7(B0YMfbC9*YXIF#DE~wrAosBaS><@^O4mq|CSuz=;Vq_59^(8*k?}>7#KD%*U6%W zr%m}fW0tF0Cn5zwc?*SrzAZlAA4F+?Id1hBWT-WSjI>bM8-m0O8Mw@V)b~OwdZ38P z_^D4I$<^dPGUr0Mp{63k4*f@#`!0}|8$(Uc^T!VcD2B!pwgLV}eu1&Wp5IOrun zfo7tE?c6NKzzypw?QoO1emQ zU>GB~FH^EsoSuH_~34Z4(uK*lDNr131Q1`^SGxS(*{V$4f!}da~dg?|n z(Ah-Vp&_1qUIsQEnpVx;CAA8+K=%vR+U!)x_5Ri$?S;^?k8uQLogZs;XvBFO$Lh}) z%%XirOh?Q`wvP3 zZdS3>M-+%x+YL>{T7}l@e%?SLrD1GxzE^3Mdr|b<(i=7`H@6A zR9RiU?hAk)5L_0Qmm*!?I%55) zA4OfYSgS0Wi))YDXFvDlo{yn;#z_!kht3z4>pL#|X<#1xW~xBfsec}S&v-mWtHZ9wW=&eWmKd< zV$1B{vSs%jBP%0CF#}eWhh)n&U|)R*UP}Nf?j9}1eLa4RPO6`o&9vr?=+ysi!`r~l z9zs$C)^fe_4QJB}ee&l2{#!6OyzCBCg+I4u=w27-b;> z-i^`09Y&d32QB=jBA&9=8nirvP?KA&zKQ>RC~D`zKy4eLiHa)l$aKQOLds~DhsDFS z7i%@zLh5SXDhjC58N8iV@zLA6B!Ty@oYcfbhrBe_7KK{J!O1I$xb4FtDuL`>! zw;pM-?4{VEApk`Mi09%S0Si^W?V&g;9cnNOqYb+M@s&nV~|7jIOTJ$u)GBb z1(MFwTqw2bn90ps3~6sq^tgM9-Jo@}-H7j2oYCD9iAZIVJ0rbsNH2L2Z0kL;_GM}W z4`DR^ZZq|g1}=UDKHpfjd>-)vfWA!m-)@GR4Y#f9+bMz6bM2li?YD^#=+xlzHMhJ3 zpGJ#?gaT|b7}V?l6|Ap zrvh5cBI$X!VtZag``RaNN7R0O!*pDmWrs51m75s%V8n$G{`{rUb#tJ9ve-5<(gI1pBkHk#bA z@^hP+h@>1A(}oGtDv9=I^rSKM);|}b(dUZm%nB3`)#O%%SpH5U103Ng9!32iwO*1X z#b7y2x|xuhtsItZeK~7UL8C_TbwVw=jXrB$uS}$qE0sEjrRpK`h|c_$r(pjEyG=S^ zcfv2o%xmc4kLvDvtX2-`S9QwlzP;zwdmMKBe)a}3iNw($)k>4+n|+hYm|45rl#l6-5Y99hg0!QLUoXG5|g*AqWJMa2)GD z4UiR8zl^Tb+*=*Iw-s%R2VFwyc73Xgrz{-^S_4NY<~iXd)1sqU^1Gv+FNDs8c7PEZHU&?PtNdi6Ee4G|J58#AM z_4=NUD{Sg?@D!!DBXjEG75-DF6~|8HKJ}e{MDHOId!cToBQrSuMN_5itF86oA_c-F z=^a(7G4K9qRY^$`A0M`~5&a!Yxop{uxO)|3&YjAhTCe%l3xyvFTB=szxv-;f06cXz z{nZ5ecckr`nDDxnEslwRZ752rLPaZX(pzh`e3q?%U-V@P6;Rnzo*)~cpeH=48W`Xx zvGC@d4o^8VT$-87y6y;b<-CT7^eb&qXL`cjGbu^LAI~4L5iDlOgXSI`8xw{K3hgug z4*2fKJU4n}mU#IC*=!!s9z*fyiV&KcmL11b$|ZmbE&qyD(h_A)!E_8lkwrCm#^+ zXS0z>S&F$_x!-C<&3_|V8n;YwRDs%%eBc=kF%JbyQ_+_;wOFQDDf0o-(lL&Xl-nn>D199ot~o`)F?G znZDxoXNRJ+zKWHeqMWwe_6|Ki3ly?`~NAc1Wg^+mCKo1vwh!bCd-I z!rptrv%b)a>H1QK$um)d)ep@|^(!CWFD96ht*v{i^J{o==JFKN_{qC8-WEYV-)<3uw~aY^NaSPimV=$%my(WWh51uO z^#a4f;}B{!aeQY=2}yHnpf*IH)>w)A;(HkLeDPWkMfv9#PSrX=(f(1wmTyW#w~`-V z$#3d}4x2kRQ}#=c@v@={z0JmLVJ|Q!Jbii$0+YRv>tyqyYYT{ye%NMx*r}6x4_jy( zg*$?NK1j@@21RK>p-5zzBZ$~o4%nvamx)ZI#MEiC2KDP>tYX1^YDWuTKj|F9Mi z&df~b?&i@f{Q_@`mYuazyc@sZ)6B% z|GhvtS{21XsDBd0U0eihYx3b0|GamWdkJTeV7Z>gMDf35d`)b*`cgNRXhkR>uUp}q zBimEB5d`}FO!)17B-=lFG1zN0$nyIbvE=&22fUQdZfPDD-#dxxrM9XrIXR`e%MP%- zJXc<$TkmXmWK#Ytm)R^p{#oggHo>i2|D&lGy(x;isMhx|GP~7H7`Cpi>v)ATp2%jG zspUwlh3r2!^hFzm({m4O-c@_o*+UA4ZRpr!a~)qw@l@^?AY_02$9s1C(Wk*&|2K@S zoj!VJR|K1LG`5D`SWDAQSM!w|?_Dch0JxKCSmGygJUB?4kj>XND}uvUfrm++&Iso7 z{>P*_Enz4`>7y>UFc?WBG#!|S`UpVBL$lS|dzHSLs`B3ma1BM#K|mgBZyq63{$oxY ze!|>T7S$HPVG-g_B$TCACp`>qE|0_XL!U|G9FJ3m7*l`BMa<77HdeVBdOauPDg%Fm z`3$6D^$t>bR_IDBBqZ2lpG(` zM<81ahRICsmSA`5Kh8Y0(6w0`8r}$q^3k%hPB(H&%L;LwIN|Xf^d8^rG(?1h;TKZRP#f;TCxLJfx0%XubOAYl`^-# zASkO!NrN&1`4L~|vL5*c5eWfb|8i);nwpl>ZjgFWB0!y|nUD^fZ0AI{r#D5jyK{)f zX;G2deBe8g@NY~3Mu%14?uR|K{ENge{oZ58ZAVQ@x}>qa`AD98G~Qt`(AT-o*vBi| z2LtS;OF;@ZdYV$c$s(-E>(bJlYTifp<}3VMcCOvY{bAyx*{7mfF0fhX0J<;>Z?Z809XD*y1=erwsL|Dm*t3sx8> zeVoVPqG=%2ctA&os>bwLvB+}iortp59g^8?82O7mB@>JfA={eGLqA67Y|o5gViNB% z*Q4G%m8Z4V+~{^#?>Iz?pOvl9QrTfNU-kIcdltJmVHIdi6Rb}?RndlQCCe3VVmPgF z;UQJ4TK~eO z0N{e-dIAL12N6Y$BSBM_ev3sSU(tlY^QcA!`DbxHwmKp;J^!~0&dq zu}HAuVU^q=XMa+6`YmR{#Zh51Ews51WB+NAs6LjWqt8{t@XQry&evX z(aQ(|8R7$oDDtnMh)x%k{R(+(mhiN%$YM1`X8H;)ixY!7B7f-ty%>Q4kcCV%RWsUX zb!AYYA=ApYc|v?Rq$RQ{c*uG|Ly5Jx0QxltE@Lp*dGk1R?Y^Db-@uw*w97V#FvHVg zR`;|3YMq#Y%Vc}t2^+PXKH)1WD*VR-0cgrWsIa8Co2Z@e&xf!3j)rJ(JMrJpfaOWP ztF~a|j>TX{8$hLCyOgwFH2w9``3%-j(@cunQuql{ITqRCxGO^^J$*@0gbAg}!Ji9C z1t=gQD5dZ552+}g{rS$$R1SJ#K=XuYvNf^&+iIBfUKGM<`&{9ArJ1mhJ_ z7IvfBY`2S!@Se>NY^(31>7X-k;~x1pk31fJvo29(vz((l2|Wr2V_gQy-;{|v(68>! zF_<}NBCD#Hw7ouYyJ?gd!y4{I-`ltKswkO$f?9dJ_6o3&mzO$z&?%{VA2E(?rE67A zeuJ>|IKN5Ms67S4KweDljzBkB3K(5?{1B|Khj5zN($yd3N7IR}b=o$z?a^n{(9nRz z^`n^U{>VVP-Q<(k@g+*$TFHW=s42eLn$CPC^W^~Z!9__V$e&DC{EN6+KbR? zk5)YPlHd+kYE%=ttjTxjB-B41Y?(bPL}M#h^l|mKotnm8pG`knl5!;f>}I-Kt&Yih zdEGM1sZos_Y$W^A?&|HICKK34^YpcU(i$ywPr2`}k+43Wde=9kvfO5IhN4#yP8H;x zG@abYNLg0BmF4^&!oD#&vM%hhW81cE+eyc^ZQJSCNyoNr+crD4?PThm`DV?}`Bke{ z-O{=Dp7U&+XHUs1s^7hGscc(QWHnP`1B`p~J!q8*OVAl(P zrT5t-n+b-x)$iLMkHn?GDacF3SD>sgv#M7V3ajTC#>;5kSionL+lSGwrC`%8M; z)MhQ8smzieV$&pkp^^a02uKn+ku)H`pqW3@5kz3b=~X%9`eK$qJ6uXPR`evu!Z9i1 zUze3YZM1;ycuHwXqvaj6PL;&$<@EH6j^vIC(%5dTdvcxkjN7rlXWBPNC*hR#=c3=! zrMygjygVDvN=-NBLIsvxhT~=w3FNRC?hNd6m6lH7j9^pp)dx%7?k_>8oim?mL0_oO0 zruNevn9zHI0fM3;ZeF+Tv=)1mj{TvFrb40=_|PbeC{d(;EaD@nebE{C$AgBgc%d zRrGq@Qd9GhqlOh@Q5ALKW&FCd2u>`vGbZfB{?z>(8ei}sd0L?)CFRX%6JH!`BV|72 z*S3y`;p%mjaw-4U8}3oAHui*0WE@e zk*tOfEB5u~#`u6Tu`gTmNYb=D~lD-$tyISFLvk%jZ-fjgIb6 zP~3vxMXO;+CCAe;7dVBJ&2Ejfm;UQxVXM{eoTTYU@MOt7IJV9;={K*veXnF-Ie6%{ zm;g%QRVSfu1?6+ z@J5?KdVt4}f*{);|1x6HYDIJKj9QC#PCKS@^NQjBTM`-A?14hFl4=-LG+$Z?wxs2c z&%96A97wt%4zQgDbVNo1o(gSX5w0$+3!7Y8rRBTRwyBlQ#WGMPNCG*Dt6RU^IG_ z`si83xE#{LpQKBCUy0RAiuUu6Y-`*8Tzot6wPw#}xi;>YE7$S0&Ui(&nr%yO-oyDY znqxt@Ukgogra~Og7zI^_gB0twyV!eH&IVH z#`^Gtt@cES%sOMus|?NeHqcu~Cn+SIdJuf>lix(L$sx`WG#`gHq zRkG2Xk#wT?o?!Ki$sBdOG>p&q#r3jt4YbzwOqOg_B`Tg8_vQG4Jbnjg&uJ_D-0m8PgQ6KnbUqz&F(6VSGL@fc?tlTr5nuI0C~H%STkfrSN^2n#hyHgdr#T+i1=n`!v;1rHd{%;!7o5Vzy0ZU9Hic?+$F+0=F3kc4;{YKbz4diZjJS= z79KpD7h?r;9voeEr-Qo+Azkeg$E~Lup=hrYrk<=1-dG%b10Az0l1j5Xe}?LT`>;%p z!-~MRKN&kaUMYCz5}kV35CUlv+estN2g|F@n!T_Kcxvpvt>Fz%`gdriChTXE1YvzI zi;E5}_|8rIGQ(D8{5J!eA5B(#Sfg&Ss5R!*|6t`;l`CD0!E1Cx*Z*-o<8!w^B(7Fr z#R1xBTf3PKyEVEFo@>=RGE$b)u$V13e;#4#rpJWqtEA$co=pmwLT=kaB@I{VAB>OY zoFoZy|BFPlG9(Jy%$bOJ(Hjh(YSLm*0xlpW8vnb&VkGQ6l0BD$)E#4axHjAgk+EBa zl^VepUV+py<)2cT>p^$d{j;?ucPXR-w4RK}2$(;*$QDK$z`7kkE_0+^GpEQPqL$?*c=qzMBNoV6$KN{)ti%KP1vbn>ve&2{M6xAAxZq@VYCYP zyD-4u;cki4P}~qnoM=<-$MSe{@(WrzmnrMtXpF?>;5Er|IYW;-0?$HsTc`^Oh(mUs zzBq5R04g~-*KIKeN#PF_tXs$JHRtbfCRaTfPhRm`&ZBH?_ym3j%1|4_V;UICe@#rK zaF+5>2^{ye3@I!hk*I2XPGoVvb%knZi6DXV3PqW*9LGuj>E*~iPuMi1`u8QZX3Ke} z0ww+m4Wibn(?C9es<0yrM-IjACxAxzi~G8um9X52QhHfWHIolkd7I@1p-k=T{VIL!?@3l%0|aYjC$#a1U2B_IXYyF8Zj2{Z+oa&j z0Qu|w?hyb!4m7qg*^KhP%5XfNAr2Hl-aP8xLa16}3QP|f#f}Vx^BK{KO;0TV#KLp? zrd+8=420wRuC=F!9Q*nMxs%wAA#Cm~=TApD)chqNRjhTzI+>8zg00y+g!&3gwsL8) z{4G_{laTNfojc2uW|r;~te))zFLMdSHAmD7!NGyl9j@`GF*^7U0LI%Hd>37`pWG~J zYWm>f!IqPdyoV!x#FA+nomP9zw^l`;_GDjLFGF+e&e#m@HRG(uH{yGLq)3%oTg9m0 zUz`Sb_mw|7aFxA2<2*+Y1A}|&@O_6aIubjSUeZ*4ivS7Efs_$Gz!Y zbHC{`KNHR!A-z$w%DK;Hq_5KPY^J9v*NdtEYRkue5&NwJmjiL|lvecqG_V8yc$cUOTCwB;X0&@Paa54ap zX@Yyh5L*xqL0eW}&7rc0jc_H(?c~N4Zw*eC@Se;8inY>=e>zFExZ~*Z7qU|~+xb=j zqu_iFAjLIB?vCl`gK#04K0A}e$A_oGekWtJ9mo%e5H@{$1abqR<-9THL$E8x0Fsh`4gU!4{HLF?P(FR}e z?ah|r?h8bkQi`5lH}!vmXKV+FH$^vBFOIWEe06Fo4<{onjDPx9vn4nhc_xeS%Sx+v z4?<`r?!r`Itt{+6!{Nnw0ofriYrJmZf5I&Z*LBuNB`v~-=3tT5EoHOJ%Z3UZUFL%Z z!RsaW*Yw(rG~!Sqs818|QsI&n;sq(CbrzWr>pGMrxh5cDEb@Zx4PZs$QMj+=CKa0( zJQ}^4jc8mR0;N=45HSkTUQ-8Is%QQu0^5U8Gu09ISFVaNab_F zzar}kM}b!XG?qrn*7M=Va9WaY*B5f|l62ghv$iUIRl4OeO_oHhR;#Lr1%rX_^hw@n zSd@sIjUdA(MvO#^vL0W731`R9i-V9@9s&#Y&=6Wg-KPu*mLA}!jS`(rjYWhBL=#lp%d77(d4`jaDG9`?V5erIte(13ILzvH5ypd@+q{U(M(q7(1Cp&;g#D)+iz z1+ZmrPjB_4O7b|28J|X^I5|r$yg#-A{}F3`pw2WNfVTmF=E!g2|3B$AMGDY~jEtNX z(xd>aB!HJJV)`HAPRf`Z>3=>*r~aQ{#0Z;k0%wMyRZd1)8ZLnpq5~K08r@UtS4p}k zHs!2;O9a);iNVVn;{$;Ald=T`DhR}MkG>h~K6xr{y-1TP3RJp`W3DqN_a_ht7^_cA z0Q|O}15O*{q#b>kdI7E4Ri-3K5HVyhA3GenMcxpjyPp;wz%ji{I_xm~t#DFRJ9K^1 zqzeJ_t{`H|;g#?580>&?$Q4dtb?N^8=(wPYz#Jm+qyAK61+B7U&`T|^dafi42lTQq zAZ0z7-a`fq$$Jrg$t!l*(f^^q0PIs$RbZC?qzU>pG*awv_{b89cO4dWy~X3uS?`dXh+u;umBv(-H^a$w>2V{C zk=S>>{aQE*To|OpforZ#rA=jkFy}4>rV`^6FF-ZD0u4?rI)EU<(Q%%~toYNL6C<0H+YZkIH3l6)rNk3K z`vg~6S*Hb)MMV`sK|w_%I0O-gL-=IHB!m;msBy4EiHxAC_YX98cI9#UbLkT_@8sBz zsDe3P_Wd{$*}?ke0E!PwDP?9_7GbEN3RzSJbMxQv!WNgSTA^(UBySAxCWQL;%GS5p z1vj0!!5E%pDWMr^wQ2u9XbXBu-fsKnW-y+H`>5!bNd4i9PD^yW4wINp7~P{1xmBd7 z8zbjehD(nkthVWKwN*iR)|9O}9KR%3!#GO(WX9|U$uS!Dzm7nOz1O@blM*<#Cx5=a zTs9_v^Xjb6hHamguqXi{Ek0kyH>>Ktpp20=O3*C%YAS)z@&>>RX*QQwLPd= zv_zTN`zp;byZ?j>ahU%I>UEy&#+YAqPD5MdH>1erJn31q0Kh0-EK$+=kf1FyR%|D< z(!9bWn-U`jbSKVe`Y{b#=7Jhzm{G;pWQQWkIOOIKK}tE}aY3jQB-lUmb$gE4_gtLTA>44xkOWU z)L~&;aSAdblG;IPWa(|$VK8GKFZ}`#yb`El_s=)Oj4oO&SHEzxRh(X~#1Tccnk>U= ze!Tn@U2{c2IlgK=0&xC}dcMyj{C@5{^*s}4`w6X&?jV&511zTkC1__WG;Q`9lH|!^ za|Jja?*IIHbU)edYxpdtXZLbnb|xp%qo^#LxH)24nLozKUct!bpNs&rHj!|s9IrdX zT{KJk#TlT%_8r~#+dQzI?p(UW_Zm7B4W2}d>Cm6K@^P%s2krCY~uDa4hI;m+i{Xy*9?^ zIAkdg#O@Pj_v8XSmaOWM#bz{gDTm_lAdAdo~@WtituQyU&;{e%M4#E#21UUN)fXnH_(#6fQyT(cevwD z?3!V%Erv4PW^=5+PpjSktfiy?E+qP_e*ozTgQ^^a^W;)Kz1bM=B6V{;%}D5!DUBcE zrEZn4Xk*0trtT&R;Z5Z`$J4%QSmTjjO@s`&g{5yZE_gzr!+YxqsUt}|o|L+!ngkn~ zn0wK|%P3jgdA+5Z&5Ko-6L%C5FrN^qz|(!ikT%{ZbZ~|`pAlp>+CKZ*AhaH3Xfn+A zdax^}(jF&?fmn3;b7(C#zCNJnuD^ax+Rzh>qp_4MUSHXB)|v5@%BA%+Pm4Ro>Wf8I z8TV6sK%L=p=eqMv>yosey1?Yh>C3Gt4U_-|yMyuXgZ_+}#)q%Z*C&sS*M)AzKW{YM zOD5JvF2HK5L#>S~B9S9Ri*2}masx6~BZKg4w=>l+yHo0ErX3o~dyrOB^IkHO6pn;| zqR@Bjl$dx;NcM#aKD#{{TMa>Ju>)F5XjmK$Cg0niu_eS?e+l+Zxx?hVp~WgDl1ew0 z_)9#xt%3r=7z}h;aPH60YcQ<=CO5T#ka*(J&`C$^KUOsTBo!rUyoDrXT`+|}_AiLS ztM!p7b#%t-rt3%i<%q1*XTsv8hP|iVwVg!6)T~Kal-a`UBIG-X{_Dc}=9?LFTu^Ra`Nm9x`@M88eh2 zI7qrlqiU>EQ8scV#2Raw9$-t%y=gkN-AEc03A|jI8YeADD#{_}yQ@4Ou>O7efEW_1 zSom_D%oa-i6?OQyZF3QWYh4>j`@hB7|m|{Rgii!F{MQLN{gBR%8MXXWTv?Y>v17l zP)TyD3avhHRpk~F8KXK~)j3g^23oRMSEQ&1Lj75fC^|5Zc27Tc=M(-}(*v)A@DZyu z^hC3mBB}g$W;Q=_K>4v~kr6s=XTGF~F~{3Tr_b=2cAReeV+{p*P86ZhnLX<&qD1Lq z$qP^fO|pNOCA4DqS8zraR~vF`&42IrufMr;cJPSzJL|C434Hx{Al%eUQP3@i0n&9$ zQ|JF2ySSXx|8HqsSM-I3J0Cw|N(}Hp+m8$>R~V;z^(3uujc<*m?ff)Rd+w%-WwT^k zj#`seVV87?Zulqjn%0yUT62xg&Y^Mk@+URhh$?vHwrR2w>uuqg5-uelN3BdHo=l6g z=kh=Ot#yJH(`!&7mJ^0*zrC|p0Z7L|7vh!_ku+i zb(Bia9rJ5f&J7J!sm+_>;~s_*iHwv^x~wXmIiD|E8x?u|32CyI#$+esW(~hW&}JDm zt^je>1s2vtRjitK1(}Xl*3r1t+o3cZ@|z?Xm#SD25viFnzX6&0({NuatF4n}TMG?k z`-5px9ZgBECxs!`H(WjUE56$iCy`3pz{p8hg*;JNJa;vn0$4zi=sYM#7BoMdTig96tl2 zB$|l2cb!wFG=8sraB}E*(&@hNj##5Kq#d6PkKtS&G}MFZ_aw$G=CsM$$f?H|^Qe`> zfXtw;vAtPd5his@P_V)fGXqnYR*P50GBXEBK> z2_|8@^d)+6`aQDNURR)AnXBG+ZFG-&+bRE#beIa zj^=pXYXXTRMuHw)0HW54$HY}e4#_Re7;08#K`A=u2rD&WVIHFbROF5k%Op>if7Dv$oKDyOQ%eKORkNdS|u8>;MXCgBNZj&^gs= ztB`(1QX75_U|?Wksu)Rlfm4eN_#luliJ>_amFd27xx$EACeqFtR^5^7267B)r%z*% zk?ix4OtmA~0f_$CL6SUmb|zRnIy=I4CCLYNZmatI|0Zl~dN`g4NM^Uu*|H#$!K94X zlhn1>m;!=Uu1t@-pE1o-Hot1?yF$Mj+n3i-@Qeyv^PoV#XgbhDs0#@lW+o;}1=i2f zlOM(cN`nM3+6*pgTfidAimoa8iN?;)_8+e7Bg9svtcFBU^n1~k0U+4V-^6O^7Aiuw zOZF1o{~=iT&KQISj)$}NuAdf~|8S?`em*6F&PuOdts!{=c;udS;F`E-1IN>L((S|~CZE-z_taKVQf?luUM zNKE61N<@h(fWhE@*xLoyqDVxLnfXg`CqzQt9g1x3OZOkV)_YkZs?U>Q&1$Q0I%>kJT$XU;zsrA_%^h`qK1IK*?Cvgzd-Y z{`24_ZZ;7vNr8S)*puXgF7KE6Bn>gs{S)WX^69ndmHFB8%H|ftcoO;@%bDDWo!JJn zY*go$^b-bSrJcs}WLnbQ{gx_)KoIvz{x9R1dGXj5#O-1Hk|X_Vp1pv=r9o)8Ro{tG ztYDeTzpt>xcnVHgGdWw_3flVh2oV&fRY-UN(PkE8y#bu|U*<9J zyCU8OY^nhQRV3@E6$zQ~H$Zy@dI|JyIAlhLt zTogYf{OhF+wQG~1tG%SXiVZO20Ck*!!Q?K8?C^S)h@uCzd))IScwKWWUJKS!jwOSk0YYgjNZ7nZ1H{R;`M{iow+3`Y2qLD z!LGR4dH_D(I3u*;{QMFp^f=D)X6QL_lN-=|_uPObiwA_#(ON-b0anwR~^Vq}QJ}D^>XP6aH}#^XA>TpwjeuYRQ{M`l0V57+!vR-+>h{ z|AT9Pz2EjL_s@g!_fwrXkVt#sbE!1=uLtwf?*DNXF!$S$?VskF+VrP-R1jZumH)ic zj{t;)mrGS*aLr?>5w&PGw7&BF@e5W;xi4{#;B8-NX35#L<#qjJcke z^8@ven9+NvsOY;2aYvM(%4N%UrMtmupenEMjV5<5NT?2CJaDq z=`er=^Dh_tASyiLJVk(YfIn$r(W-ruiWOlm|o(5?5 zCGIDiQa@&{XO!R1&yy~>&53yHI9xX!m2aa>i)|&eLFn6K-Zz&dWu9m5!*or~ar-3? z)t@J4#UZrAJ`ewB(edQ|)8x6D-wacF8B^``zvENlbmeXiF_)eNtbf8&9_D5+3&8kab9<0bV#GX`0xuge`u`780-(bJwL|j>_sW4 z{&Y!u9{x4J;3>S(5tb9<0l<9sft5_0HxD~*)0Vh#sOF=82qjFBV!Z6GaC;jtJYX1K zH68&M!=s+Z0OF#?Vew?)*>kwkqQI!ZDTEp;=}g7g1ry?bX~*e5R&efgh(fjhJ$brh)! zDcfhqI1};kYV567a-$<(m`m$3;;At@x?&11jV{NFpBG;@m87w??O&`5rbvUCL94|i zGVC^i)m3!XL5&ZPGgrBRNwD)CYYLi2?}s7q7Bda5)l*&mfKGDG#I0K)u>WAwiO?wk3n?7WKwd93nbR+ae*)V~PCp7iBLDnv zOQk9-4MbRFEh!+wrC3;)9WW%2d-h-W4AVm@T%^>m4SjNvpsVxmMU0jj5 zR;HU6xFOt+xF_55){p^e-4R&v&8~#>T3VAW%k49k2EI&mHuE8}6K7{QER+7V@vc>M zMa8qoihRpaI|gNC_>I)-K6NsP?%W`F*}LWVU_I@{TubZuzai{$e{q}Cuv$So@F7G* zPytj?Qj*B8{YU`qA+DGlvR`JnWJ%0)GXowc?m6R*OV1lrt4@%?K1o<;X)O+GA9$`j zuKhQx#a%*4%>zQ)`C%M|l=MGT8<1$={cd)Qvc{f^z=5W8J59X;Mvb`1NT=CA zr-Igeudz7ig2#3|a&}Kj7CZT$nZ1UP+$J?y;ToaP0-8yl1Kb2139vn$pq8en&H?WM z|C1t)pEH+E+Ew;aHUmXj^xg?Z5SekGXhP@#xp6no|BKEJv8Afrm!dq zii^1 zm7kUBTJWUFs0D*RHyO<@*7O6mqt#Z%dzDB{&ObTK%(md`ufJgcK=sQ?8m4kLTP(X7 z-tx1fAg#npRR%u{v2k3k$E#fWJCETiN|U8T=a`i(QRsGccE~+6Q69%+Ib!vB#*gcS zt%>n(Chgd?i+YV}6=%u951#Qa&bH~X!IuBl1l z$ydd(;oEiuVecQTn~f&Z-ls`GW)*&Ez;`9z;_Hw+I8>wyia_*dc6aD z@w)Nx!Ti)}VNxC0u28_nXCrG&tV~ z&MzlolEA#4X4qb&L1r3toYpmoD{~~!8Tkd+Oau9xW9Wbq%ILiUoeVLYh#MeosD-O3 z;6oNh$aPWa(I&>?E6<6+G=RB~#nLbFwh(EnBpZMQ)g-1bH+DQ1_lIKv>G>) ztH7B?C2K6}BK`h-=UTe!xZ*d+4(b14e_W$#;j^L7St*<4@Sji#1QbOBR$Dp3rTUD# zFf5lDjTBW7G5Run6hHqr+vj!c10cT~+)K<9E<4)3Ic!t~04e$t(<=!lt{>GAO*DH2 z#!%KrIt589!Ec-ln*Aj_ra)9d%;wjD4~Lk%TaErpLj^%MHvS5lv=f1{na|*1^3Tl% zg#PH;(e~o~ndyySFK}2w<9*qw#$H?S0$%rQE*~TYhhxO5`Mc`6YNxhg?}rf>QH=;O z39;G^6vzmA`NI?nxnNmHSgtR4Q*60UR1`#{$w2DCzydKm(Bf`S@&zcb0x?D^yaA*? zKoV9|lmA(xo|tRVv9t0^NhLf2oz@a?Xl<7nEa-YL*>*4*qYEU}(uTgY;HfkAjJyEA zwY@WUl+V;8^`MxJZJkT9(o`y>0F=LQa`0Mm>^IGV@I|1E0Bf{QVthADl=l-*jfn}l z>?ozjQW1z=`D7aIW}?rsHQp=5hovm^tTs$k7T}Skq52%7I!rMgoPTt8m+3wK_d1Ke zOLhSR1+e2%qu9>9h!frn*)ng9_VyioO)F>Z76F+fsw5a*(&%f4_bHIjP0-Sj#Zkmy z9rs+VK?6s$?!+hK*^SveHObxmM~z@+I-IQ=Nu;Ua90X`EE6dagIh@#rCWJmEm;OWM zKhz`kYrv5bPMrct_g5z@ItVbe#is*t`Bu0Z>N)@VQd4#AkgI4E2vB&4f5YjlNF7o8 zVm(N{hAYisYgmYdEAg-VUH?stq|iu8@*E^HnW0071kgIkh{Hhmdek;IM%bvnhsr%3 zu-I1jT%fi@?UB)@4qu#FOP-3rZQ#TN3$@%^S85b_UmJr;iYXakql@Pq+9xcKq#r0z zCdb^>57+Y_Wb$6{3ZU%8ewtwIAi1*$^hi6ER#?J2P01i|1<8P<{^P) zN!~#h5EZ^Vh8l{F2^BiWDvFdOQa^Ri9B@Od8QG1LfW?mf;j8{~vd=PF9C^3S^t3cq zo2its8_?~5V|va+7#bjRV@Ux}LzuB~^f0-C&dKutaXCqhKI_0dAa;<&|hs5={!*jBLZM^3Bnp+_KS#{1^1H*6&R@M%lg-Rz*PU)Wl zad;+dt6+l!wpoW>WEc9;W2|9=WG;d*PzJ@7&DVxBs|i#^Z>wQ=bPXaB^u)J`7E1kn zYS_1jI8?Q(V(=`ExdBLW0gHnV6!vfip`|T0ocYDb!~`@&dfzF?LD0}gL;1rC~iU*HMHnWZu*4~+C&VXqUwjQ;IL$NgvFK3V7hoAv`yWn*?4-qPT zyP$Ns3dYSAT#RGTL4d6-)I9Kphhogw`63tyd~^Bd;e)KBAruf!Lv`Datf2sI{`f~o zclXx4jvu}u{XZp!6fhKcdFONU5Zye&lg|$Izx0rT`iFMijxZre6D2rvUf09>k)UR7 zg*~ZgC;sqq*h~hXGOUr*72>Y^75ZSjgdYr5IxP#rV5DX2;?bGsHso0bhG`L0fe;D| zNW7J;7vg{boiMl~qD$ua558qP$LZ3o22X1e!>P8?|qyJc|jQxYWxeRQ47o=?e@MQIS ztS=bkfXEyE<#9+nC+Yy4dleiU8*+8ws!$MdUA?R==+eJzylaIQBz9{CZ^Jq&0yvMX zfXz&B$q*Q5ceVEUB8%h^mTjc?*MBRQ;E=ToC4~#T$H{}^FLR(PBUXY2fy*N5Va9>+ zt&I{4B&A4UC61Ey(W;!PjY$%4FV!5RmbGg{_w&eXakLs>qD7;`TJZUXIm*(MePn;1 z!zhM)nM$12(wZS2{)r(cCFmOBO;XNJZVK zK0kxjxG`uk<#kFjMc}$VzD{wmWjaGrEhDEbqT1+*4GxbL&M1H|XjI54SQ21~=nzNE zlLQxeJ8S3#{g28ra%^jY;Pvv_H&>K{PqU7I;3UOgYEaoGE|VXcSQ(3pS<3{FXMluA zRJGcw9qa#m9Y(+8U_5MpVT-ehN}@To=}7*aM&b)XRz$Lq%W8Sw3XzhP?2cqkobD3zxBWeJWQGXxjsu2s+XydmIl_`=5tlNGrXL2nTZA@tr5O#Vw%X*~sgC zRa7i#yxt%Q|HpSREBt|G#-9Nw@B?ZPAK&Ue3QxnFpnyc(>nyLpd)ARju~pAsY=;ye zAw)n2pM3BDe{l!bY-jKW7;c+6psEGOVJveE7k_BCKx9a}IqxYxrHRQ!g-le8P*Md9 z;8g1J&}C;86N{3FpfM!A!_FNwIt_}RCMUt9u20KQ5FwSWYr#_#Pa!28_n`pTPxJ?W z6ZfJtwMo9@Oe=t9XW=nv9bp)zUOnEd0t+=MrU57c3IHX*M;wGydQ_(Ev74fJ==X-U zUfBQ@x|-OnSvYOk`f!V9y!Nw>e6Jkp2;j{Q!tD%ZqG&i19k~y9Y7I7++(Jn*J1_ul znWX=4P0;s$xz#?ZM_;2m=G(sZ>_mYfa6l&ZxB=d?`}j@G&BLmd&DE;b^W2q6mCx!G zuC-Q>2US#*RV<0~k0v?>$mR~93I>hp58yykcm>n+(5Sf!7+~W_cjv|=9|IS3)NsSXE zUY3EAI~!rLxt17N=}2X-GHR8sx9nhH=VQk)^L*$`IE(}dD!X;>h?eX7jHUj>69UX= zl@VHEnVnso2L>-;@iLsOl69>{UtF|r#eLnEnHYy7o22+qiWsp49KY?Xb4U|E>A9OA>Kwzo4q~5fczSBzAVGudf=?q{ zAdD(KuV!e{+0BTROXW<@m&$b<4uXA}xPmM*MTLpZ2fRK~_r%q2KS}&g5>C_+ZD;R% zrvcyTf+H$l#AEQMTqV?DpMn15JU4n!Hk$3><~Z1&H-!Cy*NXomD_bh*?M#fsv6(`E zM~)Md_^>epCwv*vVjizlx0Yg_5FcLo1U(Q7Ea*DYfp{AjO7kHhF+tW&4V^mPb-lQ% z=Y|EHj`Cy_BP&e#c~6)^M_Y!`sKCny^b>!{BYa~8n3`MVQiIO)sF*SZM4vD~T~#4D z)PHSgP{=A6={M@u_bBKe)%@xT~S& zW8d$)34f2fFStvsCvNwjOVSeA%z@}hyOSeRChAoF;aoFWyMV&+X%ksj2PR)8V!rU zXuj;J<*Gn^bIoY znBEVmUJJpUOz`YyyEC~Exv=tViy1tMl+p>T5w{JM-Yi@MR@!oDmD?ty563E&)7j#fJau1yCnk+u3^V zrRLXk2nRD5`ZocA&^ypDVeE0cD1l{HySwB56~~~jJC>#$Tc|E^&${}s!lJK~!qDFtrozZT z3%a2oPs0G4I+6x148sP-%9YU;Zah8qI8ZzjI@5p({?J4q19T0M`C{jwri|XCFB~Wl zfonKS1bi_xgHt1*2sB<9q%6Qx$cQk4Sa{|-F3*F+SOx@#f%rvP zH5^ha4*Tevj`#X!N&p@OZWS43{alxxPCYiYjGF=~Lm{_SBDqAl%$mo^UkYwp7Wv)=b`VmfA4%?PFnRh=kRq&#&Nuw?zy{%?q?60k&u3(D!-`}gasogmo*FE;`|4z2Y zrhBu;G5rs!H%Z$bRj)mF4UcQ923X!zVlQm#kFL~Thc<*K!uxgRA3*TaSyEqMOzK?U zvzen%8eDt)9-z=AH^--_h{_v6xo=Qw+MRf>Pn~kS4`C`AVvi#0FFZ|VzPef(pl!#v zwmc?t+iaBBas{5jaWJRSdwBx0o?=SKajxgm_83B3LSu)$^tO-UsDPc@Dcz% zoIfmF=chd$7l6%+nZiaHLByJuTRMU&3`Q4nD66}LT+gROOI15#$JN^5&76A8b|{9$ ze|O-x6OH9K{~-0m_%!eK`ZO3(gxVODaYgg(iOS`q1)GJh9z%mdAP>U@X+({rng{ zn)2^~v~>nDTcO%|?E6#XLTv65Waz#Q9kpEvn?(wvvUB>bm-Ti6>{u*og+zy}9{^GwR4OgFc$+_3TsA%lF zDBd%=gE@8&fzfc6G@LA#F*2{N-;cU9gA-)kca=O|@sUWO?~}!#cgq@rBV|4SrvC7d z+wS?3;I5G58;zYNmDiD6O=D6(kD+yhOwISj^{}ANveKUDEpVSxEh;J zASs}lThs}+-ON6g>@djc-BkQaOMAbH2$}XkwN;WdeY;p-9CXoXQxhR zdUpQg_uvU%5Rzw7dRqFQk1iR^?mH6d6#t1*mG~s4L>4)$arXyl$CVmGDKYSz{zXn} z9d!JLHisD`QNZ4{?-hZ&sYx0|ew(Sy;nzNmmf=#yEvR_8+CB8me;&!1*Sx9vGaV^1 z5~#NmNjnNjS;CRpBNf|2{wI86TW>o^O@%5M#;LeSvuuEE_QxDzzEy9^G&-EDA}06_x5-Q8UWcXuD0oqTtH`>NjCs<-?8 zcvMX>cF*b4_sqGsyFcAWRS64PYvdPrigV1bn(TtUVmqHT-SpS5Cm%gB)-)K`0QfAQ z-uV~f1l*`sPb9f%! zV@H;}-I03r2cE+C?EIUrW;7EU^Coj24GUc)I=ioNMwQ<7*R5azcYYoi{wnw|pG-FuXp_!-$v(DOu4u88V8BOdTcvreU{#K5a>9WNGP;)4}=ap$iSV z!403YzFsKTwy`f~I}RqZvCMC5lbJtR{RC}|b-qE%UBo9I7x9ySMZs+c zZ@}&K*@q!^j`RLUa(6dt1O$%uh3Q zOpPRy->|rrk|k^PQ6p2|Y8WyTVr;aumcz0Vkp41$?M1fTTx+hZDY=GYYW>%eBhAJ@ zLp8niOz&YvgliS6Lbf}DVpiyvrJoEtVr80*e}b#_2b#;{#tRG6BvzK%%Fto<3$9B?b()wI0{3Yr`P*LS!@S#UF=>8(h96{5D<-JyjnQy~ zqajBnG{pBJVtl_~fLO3Rq1nC3iH#2LVh3z@*wAAgV-NibFX#Cthu@K>x4qmq>l{}Z zo^f68?VEgl5O1_!Lz}@r3k!%zu{b>(Wlcy+BC2+)UAYU2Cvg-_wB;-|v^HI={#ngW zyG?ha>U=vZB;05W{!XGe^gL#8m8qpVWLv69Op_}Z&<_?EDjXD$ermdTd_Aj8ds)|g zV*&dF%7C3;v3ei(8(PzNw-hPa6&E=}a&tV%gBm-B{mwfRS5%2NHBu4xGj%SE_vd(r z(q)+=&wJB3OS{x5cf#Cu+;;*F(vg7Fa9W7vHg6x?@DV3Um+ySA zNGk7)dS=e*UYn~P#qE}8%n5>#j+_~eRfSl+wl3Y~VqMYbfBzIQnFsCmrDg?h6mq=K zNh`P#vFh|^C&|}HQ4vQN%i=R>?3fEBy7PnvM9%Jft47LKCem@*bfbg!kmm6jR;UaB zr2kYIjfrSbkOTu`qD8i*H=p?oIQRaK}m+Q}|$zJgh`G*2=F*iLek zhKf0F-9VB@qMxWbVmxR(9HptJ4L?I+{gg6LU%^($pge{#Z;LI-+jJ;7+_JV7i@9^z z`AM(IwODf3`A>$R0g^`7wm(DWexPb9==oTsj@qQiWtM^a?++)%>bF^Ms^`4z_7*wi z5buNkDWKK}#DmstBubYn?8FQfzWQd__x2hR4UVX?{Uq{Jga=Io#|XXb z3p%3Y)JIAzpm2mg$Z;w-4B}%D&Uz)d7k9wT+q|XPxuqgGjD&arpn`FoQ6ap5NEn); zI4R^Akt7dVz&D76kGm!Q8FC4lG783k9Q?oYg`)(blN2+f408=rAI&`45q*>Q%%TXZ z46k4^)H)KG1SL#p2`heqqN;<5z2{T>;Qed~ue!H9mk5ldY7^LykPt6GT41|L2DQ)g zJry^1<2VPTj^kgQMr4KAdz0}NoR*5j)YQSv?w}QUiqqyBOQ2rRR2#cx<$`b$lOuVk z(T7b3o<3D4*f`1vY08=3COUmPj-LWPG&eVErntY(c94&+TD;u zZ%9TuEMLWr&}qnJAlVrOw2>_S$WtX7;PwFd1WE`7d*p&ZGxO0@OLDf(?TF#@F>F@9 zRZ*Uv;{x|N{|-e${7SH|8qj)_Yq){h0uRx#-H|w@%<@?Pfqe~ZgX|hAyq2;OCLVlM z`IC&V9NcS=m3b$rZ4<_lm=5aG+qaf%jCe{GB%)rH>W^CU|E`jss;n-8EZXzxgg_y0(@!MdjtH<>L&S7U%{z$GN3X%m|6LVsEf~`Fr$DBjeo z-*e~-=%AXqH)>QcgPw^bi2bkFY+P!L89pxcP-Ha2FeG-L5M!2+Ry5T_oXBH0^K_eU z(CI>Wh0tJEp5O8}u1kHC=NQ;swgvZiH)9sPyv~ab~+2 z2$4uM%UyZV#H&%Z^dY(H9+=fLlOEfD`Z0@lRWKHYlK{r9^Pk1gsdR_xD!L=wN+kW9H?aDI~;M zNfk9U35j?{`Cd!h^JFD8ED2ukP$%?ybp-+$u1njpd}=}}rU2W+!-(Y)gc>tr+*a2) zOuQ8i@KoEhhh|X(KxYwB(;~nOAM&r1mbPXM;=~tH>}#l27nWH^FCB5KDOeP{FomrV zBUe)ub3Ni3`Ay5znQChR9YVmZime=H3uU1#46|Q^UPfDFYJt>1l+R~sXsygq8TGL} zQMo_SNiZeih+t@_<3_9Fka6EHtyin}Q$aFsNZlsh(tV2DM-O?1$NEg9{2ei^>FIcV@HpU4~E8&`Z@; zUqYzraZ5heJk8jDL;kb8#gP`lwdf*hG}VXW;xW9%8Hct*WdNVm6QFXpwN7#9A8p$MMd*tE>C=4&=uF+6u(z z9;o3^afUTk?MiVqsHLhvJ6y~C$ZPf6?5L?8(TUB62S5V_l%^W|uvB8~S_7I>8a)Hy5(+p9K*Gow-1|Y%zZ<(r#t= zBDIR|DBmCXhf%=h_ZUF7`faQ8*A1Mu`zu;cTe?2!+=)s1_Gn+5oV^Yp&gJzpRMT0K z5bjm4;9N+wF$~?B_E-fu^okmsDY(Gz2g1ksmC`lYAFmFEg4mFCgfCF-6v3!uDLQSl z(9Ico>zK_g*!s`B;BG9wC_a|$it_jbk)8MJ?DXlm-9f~1sq|u+V@y&96z(eXx3iR( zIgZ()P`&;YxPH;J7(Tl{lxkWbWHPiW`THY|Zz$_)U>*%V<| zBDIDd8deZ-et>gNkhvTEtd68GJEew)SRG%%UVe!KB^Q%Urov{tj~# zpCMZ#9KzxJ<>Krxz+zK5OMotD>>55=_X#VnCtJ-N#k}e#VZpOSLb^cw^hH~DXdwZu zK&^25Hg#AdK{X4OaQdtB(F%9D?~sK0GzaNI=o*(!gSN06vy7tdI^6X3_}`VO%vJr@ z!&FT3=OSy_NbC4AH|6jU;#6s;->6)a30N(U)_wcS)`x0XcBU3}vC`$KntGi4QGut{ zGm_N(XT5uI5u8VhslEYx2#xCb+_P;)6Mb9dona5AflMSqQvR5oqUGcTgEsI3WlLIW ziAn=`m409+@)VKP5`%>kx7Ij8I?6Ldh)*uOnaEOlNH%Szhe)kI0hi5;!)k#E0ii5| zdi3~U^l$JmQ}sXzFM5N%lsX*Yx@nD*=k_so0IR)SvEdH#$kXo~NK!Js1tEc-MeQ@I zoJc$tW=23!>WK(jw?OASscS9i4w0qWWSYW{7+{X2M-i_CL%q8xoT2ewX0U?X~>u%$p(pAH)P+78*~#E=@F4c9=*oh*~OfS$U=zO5mBPkc5KQCERzOy>AtuGgFvM z)Jw3Nzki=`OHo#-N>|{QTe=))`yp|n^lTPyt`#n1(2k^?GJjh+O%13GSsQRM&iK+u zX%u!+5+M-*Ef!qhhzO~RKYpUAqZAmQBw?=oL1M2rlI0EI6vA72_G@M=i4dX1{Ih; z&W>TTb&{)Kk=l_rL}=I-6GMs8c02@xR_wlG&c&w&b355Zu`ltVDw?Mv&%#-G`p4Vb zWEs!iN9Zwq`3_SqkO6yIx!>a#u<#vpUe`tQ)l3v#^--n3)2xX{mvD4qMN3L9p~cNY z%H-1J^}FL}U>My`l%3zXuYtM5xneI>xhNmwl-01*WxP9Ts{tfO=|ZL4_A*r~lun+M z@#|vbP1XJvLd@SBX{A-rn~&&jFTVzJ*_khapqmmrrz`zPoKy-l$ZDKImPGXtmnx$+AfJI zE29wuE#4~vQYfqB5ygsqbCe~g)zs8`7LX8oA!W(cyR9{AG~U^vC6Z5IDXH)z;;R&( z#O&oe{c_PMWylGUXUjC0pYBdT<}LGO8mj8*5*r;pVEYe}S|T&ObI>;M{eU<^cPQT% zAuK^$O58|_W^YPp!b4Y)Kvy)xr4V7>WET^7px`}T|AexxW+{Bvva$wtsjo$Z`0VM4Mp7M51SNdb2n zSHj=?(yx)LRR&VrEChC?87+P=J1aJzDfNuTigG}@CiYM%Ldv=*0oE{=8}k)lPIKd*$sZS#`qU2P6}nn2qM}`` zL$Hzpc3M^UYok-LC;)(HgxXG9T>&THDW%G3;$_W6%ER?KtEzgN=@(~Xt%%&#%(u1C zh;NzQa~TGI*N{rjY>{81R+1MXD^)$Nul1s4vb#I*qGBuSCb4@lA(Rji4GaB3WW^1X zvUa|5)w|T7BY4sGEFp&Jj}5OqUF`#oYY_TL^V*t=!8>M&m{%pdPB29`gxn@X(;9}2 ztgDVpxAr+O=%0ZTLr>cG+{qtGDKq|KuPy|za@eBCfQ`Xic>DokxSV*lx?tbG^jcLy ztfH5&8fNWxrIx;k5^JA^4e+vZ_qx?wH6w>YK~YgCWIA0Gk;PkQwjhV2*U2k;ZMD&wL#7J ziG4QRB6td(*Q#OoDccY2C8eCyzW(w#JE-d56*%=WC8A69|IwEGf3-%BApWSbFKBtLFxtwINfA zMkyA|W)GzTh5KSO*2iIW+%{Opdr+D#MhKeUu9)dgPCubY+GacGg)4CkG`tIqR4Nh= zHv2u`M1kF|6(j+oF1(ZPcNZ^r&3oefg+kAZhR7i>3rnsqWKTcq^{4j)KzR34T92pp ze51atH8HQK_~$sTMz5Oyd#^l5zwyH9-O?IZ7s6M>&|HSLyJzoSKqrv2`RgvNr<+>< zEJZbE+tux8+soA;gT8S*{}I!h+q*hpePbf9a<^aV;OdaxrW+~VFs`LUqPXvHUgNr_ z;Ku#7(EIlOH@C*kOvi6w)IRW4)^fZ-*xiPP4;YJHv5EauBS)Ws@6R;r&RrKW?jyT|b{_w<5D{SHoSU zg_KK6A0B$1>K_z)91ML8osIQCorp=HYFfi%-cI$K^hMFrm} zRbFYqASz&9&_p=Y2N$NG1_b&~2L13eK3gz|1fj{-ap#g~Fi4xpph+;^eHzmwas?bG zl$eO=g!k(lW(Gsh1~sH@k*{K|l&#veWbk9Sd2z9Y&6mwsV(r|O4ASRWE%7x z5kQg-NHtT&UrG&!?60zR9d|GTn8N)&V4(q6XtqVZc3^wxN(FDq8HrC1PE-duq5epZ zI<*flcYM6@B?IG`1HVkh;izo&rmJ_%Kr4jn*89z2O=hvIbF-Yg^B0p!SH>AcidUUC zhgq3hBxZ{@AMnkl-w)KD(UKdx-TjU1N!kN!A>W6bwY!X~FLv$wn6fy+qc?uQC_~s#19kKQBBNGWUf$(D*^S*Gms4J|X7ZGr!yy~@f zu*sv_sl&G9-QK=6erM(f+xt28-NTvuz(Zz+YwgW-v{3Snr;e@1GnP1h07k{}d=v?W2~?TzcA{hccBvyWZp z73FGF?sg8Wwtm=vfN%jdZdZEwmcwqXwb{uYOc{5LNf%yLQklxr)d|D7A6es?P}rB7 zAMEev&-fEdlfiQ4&Z3o{usa_==SpYFjGPPtAW25A=dF)&1x)OIgJ&Q_^GCTGkDKht zl2X@M6GMA7DIo(ty-2QILc6v-H>OO?Z)EFCulCJ5py>4%Oh3h{M&IJG?O@yN$_?*8 z=(?#dv^p=C;Ko04fw3AJBiWtj-GPJqHw({maBsRV{C*Zzr~n^*=Gy z1?Jn!|6&17vULTVd;+r@>bjq7TCB^0SaIHSR`zu#a8s_v7~f5`=3>ewm7Ki38{dZv zGq^t}p35~&u01>(IP2bfu1k-30r`k{k~ZGA8u+W+em+6&&#4o--)`At9R2|-E9hTXD{ApoGXMwZq?;9TS`KOaP+$Vuqz%UsZMUM&W0(q+tHY* z&j){5H@vFI({;NLczdXw{;Y9fs1uSavr}_&^E>=q@E#3%didpdT5f1$L&i#ijz5Y^ zse*X??%g{)le+)mA@gE!e~8R%IMcg@GeXtAJ!Z)QT=mENtfL z{Rt%K&HHD?O~qiU?Ia+dR0@aths+ zurEr$;@^QMcvSddOPygYB|`Y(^8{Xc2){4pPN()a2WM7wWF!TEtvf<#e*RbZS@X`la3O5iH2~$EQ z$EcT*zdJJIusA0FKf=_Z_Pcu?d^25i^2g~R^kKMQb4KE=!9I&Ggnc`YcbH-xHFZCq|UZ;*4&_x{g7`qGn! z9$&t{M$SuU#xADHD%+1U>Noz2ZtRS4QVJW|-s>V3v$!C2nPKsS1Q{9JjP8c2+AvlD z3XxpD&aUNtnDFj$>Y=S$3@{oh*%<(qr&UjAVQ_64f}$Up7`14WKZ(mDG2 zWpgtlBNrfRf8CAw=FR>LKVys<_{X|_bvTaxh?Gp5(Er2)(vs4pjxlK}Cm(g%nKX3! zB}~|cOBxq0KpV;5BkV{CLSF3GeFRn=a+3FPeZAMNZk5a~>!-eaVP6ehSQ5h%Y6{6_ z9HU9%4~);j9_-Xspryg{JHEVaO*VGN0K^^2-dVPIBte3s*gbVsH} zWUU*L+*h_s#GHjwAsi&8okyMbK6d6x@yDui$YS1d&Ul^@K?PNl$xdQzBaw!p*M1UG`M~93@43%>~{6`I$3QhB{we5pf09PS!Hr4 zX`-i{pU*K%lO65L>3y|X>^*Cq^A*|cdcA$}a-10SwR)8&^lzS(?5o9>-&_+~H4B$B zwe)Z+=!WRPUAEW2o8}g+jQr zlN*VjVhb53+0lEe#(vx`cZZ?W<=qkUK^RR(h_B7KoQPW?pAV6M8{TGqWB~woDCmt& zhn0IZ5=QlM8tu$8TSM!4Vspy=-Nd#Mu|e+KZ6(>Xe6R2z1!LxZCN}O!*bd#iKrfdi zOPM{iYMbPw3uKx2Jhjj|4-#0zl?>uL--@23BWtn~vfoXuxfzvUDElLd&mB755>f5Q zNG~Txr&k+L&o4`>h&dyeb=BMoXYUTd8R!e^Zu#|_U%Ad(!RkL2%;I*D;&$WWZAxh? z7>b8#x~HaHG0Li$AW>0jhF?+t*oO1X*yoKr^RbXD$L-Ia{Xdne-EjCpl@$wo1klB%jlKy6oF(n(CQKW=hL8FOoX_ki{XFlE?eZ9MB;Cx%M+<>>5+Oo(F1nr|7_Wt2yEf;{7~LDMG6 zr(^Jd6;x6%iPXaWC*u$s_?WC=nRc%0@sVVPrL5jGGVE$i{VwGi~D0 zw7*-?$Mf9{>&f>k>VVUSYEwS%Tl{Ux-sw;z{2xI8}NAJDLU$KgUl#k|9u){p!BEpC?U7xXdLJw`^>N6BJ=VP^^3Eyz&5Oj)9@Jv6h+1_dhc!XLL{Id9y|ENyxkret4 z7&tO^wg{wJ4)=~_vBWxBtd5l#q{O8p%;leAyMA=ob-Z4}xWt~=n=w(`uW;4BR^-q9 zBc)dRlKtFleXJJSY(@5`z{2USjtsH$fiHHFY3FKofYok>vyFMrVO4_0VcA22ouXQw zKQaB~hCVF=!XS8Ea+OIjhawH{r#Zv2m>y0QNkDyQ@?;&-=t~8zjc5BA$O9x10?hBg zn`$#@p3_K-$J1dL77ApwAkf~$ zPiIgk_Qm>&31s7fp54wB(OimRmb<@iX@I>W<*B3L=o{Dzsu+Y4MxjQ>iCu@DyHpm1 zwVngN&M4tG8>(0HwJ{k+7hbD{2t+j^cU^QoC~(ud*kszUw1(H+&n>kur&S;fr*K$E z|8Hd6A;XPW!8`KQqw;L$1RSYOmNIl#LRTSB_5w+*2Ef@z3Q~W~0$J3p>C%(a7839$ z`#=};cU50LCqcrzMRwqqGGg;7TWItIg;N&v4*>sv%EeJ|KV@stM1Z4jZKqOtZ&zH&8G*o={fbO zkR{}IhSF-o-Q_t{f;a%c$dnp&dwUyuU`rrgz}Emt5#g)|ubJ+Jpe3QKrra`gGVXOx zM$t-uf0-iX);tj8xe;TKSk60WP7Q=sOO@4O3d!9_>f4ZIE8QPBa3){k;TiQxw|AC3l^J*%`9KK~@l1E_g#;Wh#^qOpvi& zD#4f>B_icrio!21Y~hOCl_6h(-O4!T;&g6J3T^3&6NLDlEnY9h9&Fy+Ho|P}6>{D5 z!rFhwtF0=AOSmv-t-LnJI4j;;rp0Sp2Rc#$b4_zGY=9hJucR?+uUZ=CsD`7&mSJDb zXzYqbN{SwN-J$F_*daM(A^KA-OxLn+yx`7L%RdG6X`Qc+Pz|j*$2Mp&5aQwsdxs-4 z*W8q%G1+!X^s!5U3=G=ZC#~M{3~>thvrVs4>+i4HR#N8CEkDklVC()_g%!3YADNMx z_XP8?kWMO5uN)Aeu!;u*X3Ur1!Oeo_!sT;+zR)o<)8NOT!+owg+ZUX!a3&8UpDuiH zKF3iro7e;i6R$O6Nb(C?oM-7g>THSckEQog?eI5UpM68u>cQ~SlQz>hbml>OPN5-w z^ZriME9br)-+rib5AFQ^5Ee8V+7hJqr2}V6d|6IMFlC}E8trd66}i`Ot~PRD^_Wi) z{T*+XWv#`F;1h8)mkY~+%+%4T28}UfljT6yKF6J#X9u?h{j~N|Q=ET54yc-&X66Xv zgkQ)v+8|rt{uv7SoIcF@k_X~)Jsfa(s=BY4bUqZcLI$n5lJ&l3r&X_^22XgQewN4h zS0H2xTG3R;6CceFy`2M36^IrS93jQ1mWvXGNux$E5OxapFDN@=2LXJA75;8c#3lZ!d@_k~+3v!Uv7s2aesh)3lXVf>uzr64ddF6Yvm zO^znVkrLy28H0t9>~g7!f|rkd=t~H_$6oWEG|3z6fe3b&JOsW%R&O!vObfBXU2F(0 z=R2lwS$1^k9k9y^utXe!nKHi=B#=?es;%PTAtP_N)iRth^nZS?UcBqG(I*DJ6 zf}i*rxZQQd9&48oN`H(U00qZqfj)|k7Exr7>9LljxKT|UvoLAWq!;t?7GI2~4m+-# ztV-9otKGaCjNT($hX`L?*}Y>)@1HKif!qD9|LkXkAniZu>=PQl+<$O1^UhGgfBaeZ zRuBYA{WrB)dLkgN1Ag`X!zv*N8!|;!IAqSi@kRe1f5D~uS^RStIs{tNS|Gl1fb^0F zq?8$|iDvkz=O@Aw-$tE6s(0HN!8SrBV#YKF$fPHWiuvUgZ$h=GX-38HRp z_W>1=5Xnpb=wo z_WvO6ibg|g%qR-8ED9LE z))dVQW=Y_XL--IN>wv}-Rj=0L=>xaL(%?avdKkE4_eH8pi zc`%P5DU_e}L{e|XjjM4Z^Ea>DKj3m&W2TsWygNy8)f;3%R8t2$A-9IL%g>5~?#%t{ zH!2{z0)pCip8~b7Ym_B+6&e79E_vf3bk76F|KH3zyGOF zJe3D6tT(_27b4MzEJcgiaphT#ALZH-va$$}aTG#!6h5L8VrB-mwFxX#=#AExjiw2B zu-P@XYCTCp-jMV46;dq5=w-p>vc-iQAOVRg?eqG+JhZ1|=H>$PX`^vjKlz)Drm#Bg z4i(ja%5^|;1PU z0c1aVRN!Fd40ny`Fgir(V`;354dci2Wyd zSsc~$;#_;f=>T}llv#ws04TNc&2@fKTJ3mE+4xhs;q}uC3CXhD%G%m^B#Dl;FkGCx zFoLc8ZpFGBBdTBa9qiM&0w5mt-MQkCrSqS$*#J*#*E;S zG#N7*E&#mV|D?z{NPg0bW-a6oIB)QvdjQ50m(Q0xatJeHGXCz=X zLutEG1QBOAkp`l?G+{rXC~QXKoBi=Z^S=xG*$sCqHGoVc02{)Ek->8}zQPa(x-x7swrs+hs?rIdl{H*>={Jd0O>TV^axkBey zQ+URQ#45YtSs-EOtU~eG+0sBNqdFLMFyF*YI&Q2ORWy8r-#jrKF#-$nEU|Di1XVOi zAt9W{RJsN=|AGfU7hr{f9yY#$CVGohP7k<+IOhi;kl#|R1&V@#Lb4DhSs&~e*e4Vb zZ>Hcmj?yWMfWs2CzP|oC%a!bjv=B38zP24ZK|Izu#q91OQyy;m=Wt^fq}Li5bTm;o zWiAF&9DanIT^KBEvga5lo|34ixetwE$gp2;U zds+Y+B1XFsZfN#fMK5K3eNlCF{QmwvF+VNj{lQQcL>WqSqPO!ZO5?pJtN!Eee zhi-VX;KQ{f71~0+F?gbN$d9Iq;fU$qQ0JBuB#M2=opAmQi{Ggg(#Zd9bgs)ZJ`rC5_F$-l~ew3>{&;m;kTB(>`DO3;YJt=ORiMvd}WBT#VjZ;fgILL!O^+T(NyGT>QA?tnj&kJPzfOtWL#p!(m5@ zuEWPIL4NDF%saZq zacw&sQ&qaQlNV+B^Ke?sF;VVTj**p18clm={JyTg$QE^}G}X@HgJ7!ka({azQd7Ms z(8ZZ}qb6dILi6G-wistXikcvDC$6W4bg?eF`Q3>qbt0qx@2JpV)(Wx3-8!mStN6`{ z`^)-sGq~Dy*MwEqCvG0NHi872Fgl;jywYt&@pH#aL0D>ia;ZASJYYTaIgk^Yftg1@+hXJpdv>GNH^h9fwkpW*H7=cDBl^#1Fq(T_qRU2nD{#3S!;KyMLM=PnMt8=Kud zck@wCJP&kk$MT&uFH^b(@qX;H#uUen*NfejC^l0^<|N8$*G%)zn*%|3V>BEP;~P%{ zQ^iX;V;#U`gvb_Pgjb0Rj{g3AuT*w=c|Yc9o@W936F{@kmn5aU zx^AF>$hMdhInvm6IaNo~=*lO37_ZJGH3L6Np`0r@t(JaVYn#VpYZ3NgRJH6fEY{-Q zHPunOya$m7Sn2IS(kRdo(LV{;J#_}uouRq{klSu`d>{MVV8)tqD)qSH-4B&ZEG;Cy z*Gw(=>g&|U9Fw_@wY>;Pg781F`*%J*0eOmlO`Y4VFQrpo5JcBFn8>I&rjnANKJd1Q zrexV~4WLtE!0QsJ3~|(S(kXP)u8K#Rl8f|R4{>qNBu$|GiYR(gwOLwhSp?5DYFgTG z+XG1Y{Esvon8@Dfkxp~n`0TjkgmMSL*X{#UIr8!0B21aRHahz1y&qOYZ3uQaoqt`C z4)BNr6gCTo-9O3>M(}2Tmpy||5bwL{pE)d2_^St!-|?5pVjJtRpV-o2irDJKtNzJ( zV&I$2nEO|PUaZQ9>?ea)B6rxt?z2X2w|~`C7zSMb1L0~{iy)Krr71Ns2V_5IQB1dd zl2;q!Q_VMn7vpn*6#IIm0h1xA%Ka0A7hHScXTQJRk5p{U^=)1|HJiyJBj;_bntNi=tFoj#yijJ-*9cmNogS384?my;(SWwFq> zM>>+h*V)`8COy0xyZos!#;*m!TW_7jrniL~`_32zyTEM()PG7DWZt~1q}E@_EhVMp zk_-8$ug+Otjp>Cz>~V&^_DqiQ{$`fJ&8V%Oq@%-se`3`SvQNhnAph&e8%7 zDp!1_iFA@InW@>=I-R$O&-x5y=tz5CFjKZ`5)&_uPNU zGVLV$!{X$z-Dw(wI0+Ob0qfBQUdRURdtb6tgn=Z&?a^VmSv|kTb&whTtnpA7)5l2Z zO*Pl>5Le!)TYpsSjE@2q$~i3kzN*qtUA7nSOX@?`t+z#{iH;!CIbZzxA_U;n3{MQ~ zQYOIIASOmGJoP)-vzql8!hkaelKP_-8)^bh z;Z1NcY&70Lpkc&vaxEY11E5bJ)g8o|d~R8#swORnD=Xk`X5~= zXsh-4qT?2fNJ1z=aLHwBH0zIfMQ6f8)tTAzi#57DTXb!ZW^0c5pyGho_-&U}*Vz+G zWc?y@v^Myo$Q|tfNND^z+eWkTKz@RFb34=D+XRF6nK7r?S;%Jn&rU9JM~qbn)~euz zy67a$9IGx!B2(ZoP|EU~R^;}0w5U-etExZ3Wle9Ih7)V=jTT$FfA~fh1+ao@ zEme|H6H+%*u*`|Z@d*j+Fi4}=H_N;5a!!WdP?^7;+jVFivjEc*=U~XGK258Lt5n6u zH2ECL>ZSU$S)1&GX|8cYZxwrm$ zE6~TDVJF8xxHsUIg^AAwGw%T77t3eNw$CKZy9g8VoL4XQ#76xUALemZ&OXAy_q;{t zI(>ruS+O6#A>2E#=CxRBj}+zi#_0P{3E4bu;^XfG8I@NCmz|GpXB&fxPy^u0SO4uf zSg}K_p<+q)$6!IzjRz<{PewmCPSGGeskLthOL}F+Y$UT3!1joP)oOO}ok;P=b+riDtc^=Lp zmLsI}4CO6C-$}*pK-mQ4V-L95X}@3Bd%FH*vO@J?k+ae1hLeOGJRzv-x6bSRA}72X zk?J;E$tNQ~Oha6+JYbllz(L$wZ~ZW2(K(hLgmSs5!Mxe?yI$9xu%=8WeClQ4jUqMS%-D(C!Sxx}9?1I|lYw7Ups1TKWSSz3<+Udf zm)DbHUc@XkyDaD^kX66vQ!Dl-^os3Pxy*-Y5@e@YUbGJ9P-mBg3G4Lg96M`<2~8;s z1$EVA+w5xMxJfVEJ=6%xq?)Q8funtf94xZ<=zK4CpTc0M#*R(L=Nf^HmR}iu{LB(9 z5Mu&VY4DvXb!Rv6`FYJE1F1d`<haORrfkHxN)rSOPhcurpu*2Xt$amOSP<5gbTP-*nXyVQ_MUHJom7iC;~Az4z4zysoA{^EJbq(CF66`%81|MYX_8d^IL;=$RB5!@pFm&6gkleyI|swr$r|M}-mEGV(LzW8fxQr6XKf?#nN)`nEtk zT5JLAqlGP_Q>dWo4W5SAy)Q%|`Jw+(D{z#-C&YeW_x3~Lk8D5PEf`Y8v4kt~OJIX|QoV{D$6fVeRz~x9H<#%GYGFOP@~# zo-V8d6~^Q;;%d66pAhyduAA&*XngJ{BE%(gv1VHCIbkO) zdJBoTZWU#?vgl}7X0&bRo?6{L(v6%igei*4EbdZ=P3pQ@legEP~9PVDtRY_xp_Wk(UX0GHr4=4;(c@ONWP j;`C~!|I6Szd;h2)@rQQE7jEkVZQHhOyECzqiEVp=i7~Nl+h)gkneW~2@z%Sqs!w(GI;+>& zwa?jmul-y96QL+C0SAo@4FUoJCnYJW3@X6bZ`bKuNjy8GQqljnMBQ8Oq{J8 zU9BAKK~SKGNWSdQ|Lh_Tj$Y1I7M89cRS4tUUsm}4Se?y`{<#vmTG^R_umKUEzRp1X zJEP)Y?&@LWYzCs|`1#Kr=0Cx$Tuf|@zFeI_n*TP&eVHNunKg`@?XB!BK>p$!el`26 zwg36Qo3n`-$irvQ*?-+c9PI4O>|H?~$5Xn$Y~cUgRIOZX%|Oa7XDL8H2tlMog;YJW z&a*vy(FYcP=591MqYA@x$|ULsK|%&XQ!0y!qJC5Qp_){%6ga9@m-jOlF4;y1EWSV) zl_v1JbSkl!H_Wf#j?VK-Uw_g7)gsbGulZcB<}5Ck$#gEBhKBahkE1b|0b2-EQsf9x z;#S8W!Z0T42E+#^7Lym9UWm&lYF@!yY*TPFV&b z9QQGDD)|**|4Lq-Ug^`6?_acA1QBxdub}a$G|YAX&K7CLM~D%B1ssT!rTup~Ds@xi zub;?Lb;Kx9Uyg4uGpsQ@SGYYCxd82brd;0_DvwRB?{agKGLK+nDUB%QMI|N9#1sBR zrJo1Oo!(R~sWsyJYxMV+{01O;`zw-vk4Q?61YU@dzyS{66tNa7>}(I5AC6U?W0Z=f z(b0)kqLJ;P)gX_(k#valo?KJQ?@xqXKW0y~Ke z9H||%1ERFJq!;@URhZoI9~PB~VZRv?RW=Qoq)>`-WJQ)_%J|F+!4Oz%UTEPVrZ($7 z@LomL)K1o0S%B+2p#xE=sLS1+H^`T*9bJ>4SnEy~C;rG3{qcb%_6p6J+f z;S5W2M2*{Nc*q*_ovpy{Q<0f6`4qpzv1BB)N>vm#>v_cYAvu&fV$+G1hUR0xqv!;U z7vfzGj$B!Ms!<9J$rQ5CvSD3i-1==4w0!S$I_y(7R#9{en=ylg$l zN((+R@V6s5B*=4=W;eQz$21W}w-C$hY3(XWIP|v9+6{^voLoSYq-wRk2(5PG(|waz z6na#}f=#%BfR3wv{rxnRlc6@85&zN;RPM%{v)XR_;!V48okwJ|3+fM(_GPr^%JCAa zj@Mfg)ovRky3?$!botaU&gR0u?)hSpGGl^cEXFg#k}@O(SQw@DANBW)U3p=jT|g#1 z>$Y!T3dSeKbR+_c!Gj&|7rLkqS$*3M0jI8rscGR0Nx*>$v<$tm`U5;hR{@mJ$CA~* z8dx*Mcw3+RDq9xKD0{ z<{}vQ#1k|X?^0^yz7B4R)q^%}6CHNFlT_DsCbg;LfRfn0FR|p`lp6g4j8t>gI#1B>!jZH>acLu|immty(PV}pqvvkG|1aqYQAPr~% z|1}SSo7JJM#Q8kD2NUYUUSlDpI!)T=&DSc!I!(pos_IvD|IvA^v1vN{(2Y;X7@F3| zX`SERC*PU*)KhHd z9xA}ooA(htVlRf;o-3uWT=~#&4~Z{2PsS9a{w)1XencSv{E3%Y)$7v(t>M;N#4;#z zZ8IYETV0}B^-yAP=)Nbl0fLurH1QOI=fo#oxHi?MO+|BU<(IqH;CnMHvDVzb)*z55t8qr=)IE=aZB$`cA3cVse;BumQ6e{5)u$r-sX1cp65T`aI(DkpQ* zc8D~3>*Tap5JG79jYnNElo~hCuXF5k(}oOV`fi!9*4kQZp2cOy8f@hN);B7dU{dV! z?H3sD_*cYRvFYi%y)h>$Ejnr0eN9nn{aT}TKwo#q)zlVD$-7ins=Uc4?)HD#c<#OC zLK>)K#PL6ew5bL8c327kKRj^JXut9MK79kJg(^NZ_s}jNp01nGL@q#JBjvwcn4rUd`u8>Y%TbIM+QUYKc}f7K?%5^jerU z4+VB{H=fXxOz28Va?I2K6~T39j_xwoeF2Ogv=(ZmEB3i82lG?Y!-tZnNa5i6r7LN1r( z=3#1DRcD6)o^sdbJ9$+0Jsk`t;|mpQLr6G~kq04%TKCEd=37WIjJYGQ465pRLgzQ; zLNq$}a8diE;e46WI?JP!d$ElwE#BS;6R?2>b`3-J;1m6djBBRnWy;(M7#=^aRfpCW z&g8Od2kT}2X!WY=Gw0b62{zCiw!?v7*jGoHwK`FBUkLZA?t17M$~m(XSBiXI-xWDIENm{=m|I{-2Aw~BwyHG z(rbr2Xpbp+eq?zKic?y5>QA4=^ckXT%8JexokW(%FI--5mc$t1rou1LNn@X@7+EeIx zy8w199;`96F}}y5flg&I7f(nDEnV{zleON1vUhd(yo7<&*ISp{y`A37&r?0NL?CCZD2#23GBJfrUo4v*|qAa1uPkZqsL2&(C?lHMyF z7a2U`WA!e#1qFwuL3!O?liw^3Z-q_V_uAlsMI_SSje1&Ws6**16r!_yI^N>TA_Ip% zD2{rc1G!RtXuS{JXWGqVZYH`U^I!e7u7k_gN}4%+y*&iiHy@Ol4ky%vf3Qa+)i3nB z7?@7+fHz0Rs#QjK>3|BG)-bqk1>zyqeO8tis7F=y5B8-CFS*qLUpYi4$UFO$uBePRhKr=P%K@noSOQsy!jN?~CrQFn0>0FGuxGk5yw{s;bEOJh@6!L(eq)IoA6g! zz0D$DvgWGw%pY-$x<#7)O*0160^lFw1w`XZfAGi`jdh}q6*Ip#N&gwE?LFbS0^|J! zxZ7u9YIj;XN}4ebeWoH4GN+|aIsuidH*pN%CziSX!P>)!h)*n%Q*~;JkE_fe;U{)< zY#JC3@%~9Mg~&F$*GQ9<`i?b>D49wQWP@{R<4rwaWW1kF6h_K9XVg^v=||5~kMVU2 zFa*(vX*a_g?40}d;3@>t9{FNa9m%1JlQbC7__Lm>SFNo}(@7HLtN-uQg?8(424Uo) zBHP=J5@#x_F>n00powk=YyE*3UcP9ne?(dByknl|2!p5NqB405=nw6&B@*P0AxwN}r?oxGg=ZYC8VoI6Md@9pUZJ6gqY zH9uy#hJZK8Ed6GnLpdMslkd$r3n?B`nsn~|AGQJP$x9vpCZlV$-FLR32EA61d%F#7 z+LawX7g<&j*sg+-wCirRQjUw4H!h_HFNgTkG1{WfVQY(!!EBG}W9`C9O+Vr!jhLu& z6n_T&)rWS2V3=mXh~Jho#!A)VayQQyWBo@4v?vSK^W!d42fAFfKC~5uxHX&%IPUnx zDhm~0k5|ub1TkxFC4p=fQHl1|YxRa}4wlv;yS%B>t!|I~byVrrZbaL0-?(#xA45cx z9A z$PvoU$l>qQy9=#at0Efq39)u={hc#TXqmNAp-qda6l6&%dSP>Uke*G^Qm5s2s>_x} zk?Z?Y#K#?tcBxFpn>EzPS*6=6O4yDT7B8_7`7`|yoa))W8Wv!QJBRxq*=E6RS79*$ zv}p?gPi-O}+8>G0R^oa$0m$%-$NNDn^X`4a{@AkoK|W2Qo48A6yzHoEFS=2or2@~@ z93e}-+}_UEc^034VwsWLRL#9RLSJdUQIUr50u>hLa@-Q(-m_ymw2_x(7VmXpmpl(X29E(o;)1PyK1(=y(MHOgJpD>$CE<@I6?q{>BBl zkwT-~Du9C>2_r=38R+SJUCB`xRI~FHWaR;{{G7#Xi)BfzJ^#Z!+j@#Z ztLKsgcq}d=Z#p~`mkJq57{(?`vYyT!*b`TtDc+WgIf!pQTk5p1YoOPl%P`P>Zp_v; znEf^7zcwa6XU{yz)Wy;PXtc!a{$`Jc3Wi#2siVK~!pY{)ooUg8$F)&{?|%-kCO^zT zMaItm9s1{2`6O=iG}A2025jf4tnI?-ban=oK^==5LRjq4l>n{jxxUnA?`{nweUrl5 zhUW@;vFFt;`o!*l3?`R1D}!9Fd~=P)cSgTeR`FPTI6>g$QdaZ0OZ$+qRFOyXV|1>g zfCigS?u%5@TzlXSCRzn~gV9biZq$aD7mVPq+Qkpin9QsGDjZB<#2B$}Jeb_VWo0Xg z1qHwSpveSBMkYXoR9NStsdJ-+pJ3}jj{=P`l!bmdOH7*gfX zTZqib!eZVLgNiE{3wJ;Az8UL%%vE?39lS`@>qJ0-ieznhJN}F->6UsoB9Ywqz!$)4 z$x&CUN|Qx$zgh*k|898H9L1TY8@Vcl7S5m%dih>*bN_3st|HLToV$$;{{7ekazQW- z%TR!&p98i`v8?lrG+pk^7SnPtor^|~Ls1Qd-3FIFlcAO&n(}~JomN%7L(kA=J{^ee zVZIf|a>DIM`k+x=r1s2mbHA`wi&)8(W_HB~65P^y$8o#@RZyl$r8YY9qM(6dNJ>v= zH)g$f31lhz9RcJu9iih@uRp87fgAwYm7+F?y?no0Rcq+ahu|Oyj_+LDlBGo#!Q@^M zh!|iER;<&mH(OU!1Q#de0W@5iP(lvx(Le-&KbX%BIqYya6yC+4P`0f9AT|;jvXQtM z-Rr!y)lj@0mZ?$xptVB}%-4Hs;|T(XLkR$p@z)kx;JGZW@L{+)!rTf)C#j%mX%LZv zMBKG)y3ZS+^;(@5nbJ7yqkzb<$|Q$4NaQUlHTxd1lFWi+FzV8#%T~h*AC*crw&<+o zu6wE7l{OD;R;JeW9X_gAaGah;W*u!*>@lJngCVcrd%Ppa!fvl{wBYz(vt}~~7h@*9 zb=PDg%yEO?zv}h|(OQ&p?|{QIg-{`V_g!5}UUXdiM+btPgR)957z9>W2vRsB}cD0>>|ANallMM+$$^D;cLM7y{s{pJTiFKxNC0)NIqKI z6b7VH<(-|Yj~A6lC~T?RMkJZMHv|iNn>1o`^%iXSfa5wU~vicp4o~tdSiy6{E4zIa&)a z$LPMZ76Br~AY=&D?0Gii-rtk{&)#@dI$wyD44_yy-P1ky_e_y4v0F_`vi%%CUE}(% zttbJ_{$>Z%Va~RYAqj+1_XIRWOOFf3)5@*uEiE3c`b!n}E>{SVu&t?P7=yp&F25Zf ze8IQ&`l?@_4;vI(+-`|SJ$JFVj9Ed4wnPlqlKa!qdWAyPDEJ4+h^58bfcGw3z2Wic zIZ~9kg)7M-$B(N=A*XmZuh&TY)z-A<6nm(Y=m;i5u>~IX2CSVKuMiuPY7V~f66(b= zwZ`**4|$!BHcVR*>qO<1+obuBv%P};*f*HJz4UxydI6EDyu%+}gWTAprU?rb&=qKDP`{P z%E`BOeSixuWjG@1q@tnVpl>vf{~3o8fC6Syb@bqOcP24=GNB*Rq{Y{WuQEPWsSv&Y zdRr{H(VB80u9DNyM1&S2+Sb{4oVDAoI)I(^wnJv$H8*|?K_Da===rC>w%qxsNUFap zZSXGFo@b*3TZ2CLDsW1=dNg^t#e+Z*u2`_WZrbnZ$H(3FhAsyu4?P_=P4`PmW^Rt$ z^Hcr0$EV~AEDuUUvd%-1Ol8yg)ApaOxOQDsja*I54pVU1v_`^acbi@^6aIV#f;pR0 zdUd*t(N4Zq<%?K^bk^-%^%tzrp471vriTy=XubD^1_=*WIg^vw;`_GC)jMh05+)5Y ze)OeX`1&p%e{@v}JRgJ-Ju#TIM_eIDp%w58teH>gtVd68*z+(t7l^Pq5>mFd$fXjw zqAIu_)UhqhtafW@oHC1^%ctRmMsw^*Q4Pi}sq`(iQZ%Ef(gi-bm!j~tJCfp%D#mj5 zt$zrLb=4Ej{uE1uS=+AN;$#enP2t$*OIu+~=&(}kT?6Ko)sBD7hT{9RqpakTAyV0LbY&75JDJN&l*Xp(YEi2ZZn{>5N54G#Ql)yj-kIfxT~pT3B?CH`3ChVaVJHGs9D<+b|#=^Ac00(z=ZrT9Ed8d0bSOh?V4Q&|*P5 zwcuI)m-C+Esw$n_gE`$y+?%*^XGzh=6PfO8rhRJ0vd^+Y_e^4IyTjsixA1$DYa45T zoQ^*U_MFvm9naOryE4h$)?UB#Mla6_6w?0vV)j*=Z95A0V$KE57yPM z-S-0?wsNJu3U#vcSEdbz-AvkQ%k1alMr60-?n@l7vo|zXqi%M}ZYP}3aBV{oH6ivc zPFI$-FZyRNTV(^L*+xxOYy@R5(we+R)@+r%CQOXZvi3W3hWb!dhGjfncS(_Tqk|Wf zQ}O6bfmTXweUkk4^i*yhTSq!it-Y#c=lHX)TgiLI?aSsaRsDqcJ470=hyD`q0{`f+ z5nE}@Q_{tqPA!i{E4D`M@7tchkS|mp0va}FIbQ?HHcGCzlkg(8d@Ih)Rv}%kjPJg0 zt+MBErkp27o;K^{HwpdncoO+F2$ag_XhX)hUH|iJY<)c&znPxmtzgd<5%UZ`XMpC~ zrLKAU%ICm6`Z&3$QUzLC{ZZ9&nMChDh=T7WcIEo35p?CyR1?^S%4nx-b}|q3`1Igk zymzLM=izjL?l!H>?QFJC!bA31BLX#Gn)qq4GuGMA+D+*u_Mz-CI7(UhcIftUS?76h zKBhUh^<+w2>{bG4bK=j1{eBJCma|%Q)S2p}_V@^!?$V1=&gK)?gmg_B%n;=D@-$AJ z?gJ#ky~9AOn^%Iscap4;9juA{_TG;g(eD7?&A++Tq5B9z79;H{$6j&-wy6mDGEn4b zoGfD4up!coSuo;mOh&V$>vblgQ=cit`v}{)55o`L;p$6UvR2k_E7p=9gs^(0>Pt$z zOdpTP4vpv@Y~uXv3D%baw@96LeM;p}!1eY0DRmL$AI{XW{~`H-SCf*P{VCza^ASV1>j37MW zE6|7mP9hr8eb6w6@yH1KKfm}a4B@OvqFelb6@vds`~#0Ii&9DqU~+vo_AP(Hms1k0 zg&Zx{*5pU2>tJL-)`!BshLDMT6(5vP1A7Pq1h+f*rJgkg8DVwlG3ZmzzHY%+DdK|) z!#}|v+ybxexJ_PH7gtIOOrZGHgOrXgMw0Y44m(7O^e1kF%!l&ZB_Fz)+SIepkiVNO zIZD1_xFze0MWyrPKIvb7@6sEGatkR#OmO>VoYXNghBQ)ts1G%RU#P;{j-1z?y#7(( zWt7nTxd_`|iBHJ&Kj&X2JbFu?wrZpabEqQ5OyN%~Be0?ko2(_PH>CYLjc)-OIl?5! zGl-E`nG@qH((0&Si6i&T#~scJ4sUv{U5Foa542GGsA>DP!(W{pGhM^r3AlwBf3r7O z6k&3jX!*!_O?MP=k>;VZxY&=1xfb8d>-duoFU9l3!Fd;8?qZxJ-#tFj)$C)47cnT zOhZLA?l%TmIjS%pH&<~72(1yo3QG1bgkafTNicygr=${wDpWOr|%n~ zC4fI@%V|0NPJfBT6TVoiHXTLurwrXTpU(IGyg~Na5_BhvN{~dnSiYIX{M@sq0-NZ? zBiEauF(;5Zb!+^XY42EDL=4Ga@jG3Br;;dYH%DZ?wi7qqfQu1H{M(4Gs<9S94Gfy9 zHhD#!#P#d@5905Y8xdo6!axVpk9~`DW(SmSx~!K#khs{2i5FnE*@1!pGHi|60eZHz z-lcIb32=_fisdeM)ZZ769l)8ZfKEp-hY?mC2v+%k(PXPG)L-U0K#7mFfIkLCuRGTE z9S+g4AJOaZ!damk5>{_2XLMA6&Lq!<+k4WiVI|OP%lPB^BVT*a`%w1z zCr7TDA_1PTv@Wb1WnNj?Xo$iYrS~t_KkORo>_6ASntSoS*;vv!Osx-38B`TKl(F|q zz|Gt0P00?KE%cZwD-G)bdbn-c1lckbnWq1oyC{63Q?}a1lNsctsj8|?WPD?dkuR;>pqxH_qqZE5(oVt-V0*vr)8V{hO ziHZn)@1YDW$jcZ%qC0BbP-67)-zfwxCB!cW3I%2CL_`FBD67hnvuJ_h;9WRyPf$Gr z9hD-;O0PnZ8d(s{bAi;Z!~lmy_k82}Wyh8*PCIf$ zYIK*cW^|=khJ>yIreYdtK?__t#Mj*t>RjCKR+iQ*X9}?c1b=F>igLO$sc1k)F36QT ztCeXLgX4oL7S0>9WCHOIlCW^CPE4Qrj?;d(H;9Lt4-jIHlWyP;QlnPYaPrz?u(OF% zmfCAN4Gio!K?at-9ao@*jYUFbhc7A2GnxRG8Q)H_uFb}P{bn(YB1XnLjCGo*8|VEO z?z@bc(17gA_rqmkc(G=E-MuGxO-M<6j4BkbD+A~e~<0ql~ zmApm6v7dd9$7nr$86#^#?w$ui)D|FLJF{R18DHnFL)=swpc1VSZ;D+`bq~_u3IaOZ z<2)9Mb#kFa)i7c;qkm0BapZQ(dSm7SNdtbxj-;c}sEfUklyH%K%F6PL8fw>rYi+dGQKqIaLa;S{w3)iu4SaYKO@r;EYK}b@P2a7PKqqH89AEIg zK97<$Xo<;F3K$FB9BYB7ExsHyI(jwFiqG+1Ex=6(``z3lCK?Z{$@sF9Yb83Fdya}m z1%9v3Eu#;@Wgi-tk10mjx%zoBwGz1r2~4T%PVrO|a<5QO4oT~4mr$eB`e1#kf#K?_!f|mZ?x88b6?l3%a0aeOC_ElCu5Yuo5tSXm^Jl|kAd%lTp+#HaQq!^ z`Q@}h_MKGc!wtv`@U&x}dW|lY(LlMsFit#xwkP-miF>T+t8K{LonR|%DcV9=UtE^g zyu-g@|*UwK+PXnqs54sb)nijYb^<%BTZ zY0lr?jMKZklg-)Ti)K~4#!|rG%YG1|`++^sxd)+a@fyY}@PNj@;SFtbfxpgX{=K=l zA0-NHX@fhW$g{Pqe|G+n#^5}zp1qJSm15PAV%bq=*C|alST)VKyLM4wH=*JoKIAp=>bkaPorJkH4VctNcnCxRQktfmXtPilG%fBb| zp8P2hg-nAMSLup;6Pi+-nvW7CQxr`CZ@@V`vJth6)|NyR*Vzjbd(gq}!Xn`Rj$$X# z*pJ2?$K{g<*6u-)JLwyzV7{UhLWoW)*RFH5m!JQz%)aN<^i=6GM1wGwvCzTcLnCwK zCsblWwS_0Qz38Fg=ysv!`?1cu*!_uKKGI#!lGHwFa6Rb(be4IYt$MP?!}0L8>J?wK zQXh4#kaIktuzfs8_?-Fb=OfC)cc1CR+QW}>ljoC@*7J8GmRFzjl@4*k*gr*PC>(Xm z1H47l(=k7!Q<;8)159o*c_d-b^Cg~Xu(+%k|M;hm?8$WR_K~3-d)>P2UPkh8>~eY&o5^Qf%RAE4{geK6k)pQ} zUo(BNSu-`Qk0U(;A4lAi4}B@`kk|5kq^Q$2ecnoIRg^=O zHBJ9A+Dq>2<4yMTTZ+|b*9qVg2Vi2!+iUk!SA1$Lfhspg_T&e~(7f)Pr8!N?z3lfA zS7tSqn|?-B6!b4mi!lFemHD{Y>TLb2neGg4`o79Y|5~#%Ei%{Vewj`1UdFV`zG5i6 zoft1*@zViWM%mx!YEp)?)enzgY9+GG7s;JOobi}w0QsQk53QMX^FhYrfn?<1+)@13 zOs{@(Y9sM`X;ke<&A?^1S#@;F9WT}XDWP#nc&V}9^jPfDazU1m!h#IOx*iY zaJ)M5?XJCf&zAzSQyR;%WuKMptR7FkKl=YkBRiBE&uzf3ZD_HFU^N?hF68c^)ct~6N zO-HF1uG1B|cGjxFg)p1@`K3OL_k(LK#bT{b|EvKHma0#h0 zcr=mr{tdZtQt2F=+tbd8#mSO0awI<4v8<8im^f$9w|+1IjzVK*o!{EknqZoRB~_WV zrARBEACnzT`Go@uB{RkNvG}Wf4q6+XiZj| z{*tm&uw#0}3Oog4E^4)}l@vVr<=$`rqFt-O9wymDt+fjHu>P^NIUoH4@`vmB3;Sm7 z153Ivm&)cz*m;sJpPGC21E#n!Nk-CVESk>N9v`-Hw>%2HTx8v*L0z7&9nIC$rmUdS zG+Yq3oKD`=%E+37ztj@^pE55myL-v~4x5ZM3HBej8&g7JePtQ4yE(9{4}i4%=Lb)J zl5Y!1X!~seO5_2aaX7C%(2Zw)a$S4P*B|Ew_2RRwZv_?5`#CxDZm@cwt_AthjaM6c zy!(_|Fi^M4d_(&o!*^new(wQxLGT-)F3x+h`sut`ZcDtwpa}Y6$=6`I(UPS8AQ;a- zi@+?hE3pLFLUukNzoW><;ZzPp6RTFCvt(cS#iIwkiw0v!_IS{#E%zbvlu9|fC?&)c+aS3G&DK=p1wC%p87%XTwnc$@l8LjzqyipaNfIFC` z$iz9h)cvIJeDelNMxCSNeI$3~d?HU<8ler>FUZ6HBU(&=wZvioyDI$#he={`6hHot^=Y8E&Ud{yq!`hL zD?UiuRMrwJLz-@T7(=^*yz`e0Tu#$cr&)3Iw=HP-c}wZ{w)86f&NMQCuhFN?^ZeH8 zb*^folvGuj_b91g4(=h`1B%|x%m~<|du#94sKmhJ}-oRP(mUc1HeA@94;~=?Rv_WR&OA;eSFyA zZAzK}^`hY9d}QxlvUs##k-LIBUi5OXG*f(zugrm(??IbtV5~%(Gg!o#di$JV+g?<= zQ%cvpeZn5hU;XIlyWutLeFo}5|yo~m~ z@2=(0FmQ@~*a6KNRxLjitbtE_Bcloh?qvSsc2)3reK?4g@t<@m8z{XREP`=i_2lMcS$ zc&U2q;h%WG>H88Q*!FS+xN{$ug;oxd+8Sw2OtO4?Q0)0L@n&y0OGSZOll50cZ3cU_~CXN9q@Uu8F{Zqks3a3=v9kb@ z*wa~%*AI=B_fvk}=CJ`X4Lt=HiyvNB`nMWlT#SD*u3gdh z#Kw7)A_zBHh_3w*0%odAXPBw`3USH=K8u1hMjEE?o3irHB#;BqeJBbYLje_GP$8_a z3(*_)LTtvteO%plAYQKgod%X*Q)+^7Kf*1c)l+fU_Q_c06oP5-cGum>+%Aqa`B;xsVEki z-a{BTEggEU^C#+t##?sxu9xK?f7A&oc^?6zz)Jf>=dUK}qgK9VvmvVnBM+_Vw@sJS zL>FKB_9371<9x=91RH;Qf3K{xKZJm83F6S(Av>Q|<(rM6^#=Ft2?>31h3|~4w<9yttN|Mr z!b%g%@P1=S78EzDALzXIxs$qqgCXmBRO1p{+&JHdYayVmO9Cg5Bu?r_NHxj>c~HgX zSXuebQas|lF-|d@S3=I8rf1lk0M5|3xetF!Rt|dgj{$IUQTdhZyu}F-3Zv9Ib05n~ z%aWu=W8KdE$OHubMjGys^8H7BM+g>rZZzgumz?YNI2Dv1Y}}CrztYp89Cx@sBPhLp zGmf8t0mkMjC{le`n`I^t+m;s;e#TX=~@ z8Z*`lg4d3rEq-xQe;Q~0xoe+X>n9DeFZB2YMJ=^Iv_87&x$wlq#Rqe%q(*N4fkZ+( ziswQ`SkTn5FQo^~y9QZGf4}JN-rlDz+ZU7FcaYN7Ugh#zeK$zfbne2Z`iE!lB-ExZ zppuO}WB;SfPGI?eVcY+o+U@@dnf*V=@BcD{a_^Q2Qopc1bElCjYSq^m({Mv# zM}Y&ohUn|RuVQHXH&lG+Cnvr8^NSkw?0-k#XxF8&z!5-;Wi!ON)Lb%qE;k$Qhl~K)!%QMI+rqTtk?AE<2>Q5r z@>*fyWi%0!k%c5Bp}uShgqZmV9}82UwlMl+YqBIp1Sv~OS;^gr$5^eGaaF4*OJcFc zr`yQurq%4ojc0sN&so?J`x+sC0qm`x2{?7(@4g?qxa>s+lSx+}ap1-%1n)o_Kw5i3 z$>)je08D)O)%KhRVB6FfCvi37y4FcJ}9=4079LaHo{Jw$14+&`%f~Iqxx*`d!IM#3eBv33f=9aY%$ie-oHo# zEsRkA?zrFxS<1B(yfu538_rCLv)6jkQBEp1Vt62^5bJT@8BD%O?@q+f9_tsp4;Sy% z`Wyn)?$P0V-?EF?B+;bX9GWo?y1>JG+OCQD?qo%_} z!M@6%wAiGmD!*HIuUjrCl?3<=e*Omk)wy9N5@&w$RkcKN=a6p@nkNu#XuWC4)?6qU zosW3xwM?t?u_a>#E6dYfCrv3AOx`yg7rf2OTzMIHR`>TwSbG8Xl(aEQfSSI%m7bZq zd4;?1FcO7>`FXw*vF01rFFUpAaoX7<+u9>DQW{W4>?M^dJ2Q{`#E;qrf=7tM21^MM ziPNSS*b9C3XI5#-l7F#!b3uex&Vv}E8_#P_T4!rn;^#0$=ZFFQRCG4bs%LxlD}YK6 zKiozO3W}2#YOn+7U9MLO)g3$1U$H#^!u4?(x9yuFe=hAyfZ#Dl(|PmkeF=oueuR$Y zDEQ{{6pk$<&u@)tiDc>O*0aGMU4Bl;Q{zu5eicFsv3)I{J+H^QMi4N$-iOiW{6H3f zut0`)efz^TIlr$Lna$$6Bx6fTvW{zoTWi!OuRDR<<69gBMfdnocR8W4YMU`?T=Z#g zK7+tv;uPSohc!l+^<$9^8cVqWy`fwTj@SOomp1BB{SZU@5UI=mS;bvB%!Z&PVU*0= z_8)s8Tg!J^D5F+yuvt^q&uvI%hQd46KjYEQVNE9ME~g~^!qOg$k3CGT^qn~?aeNal zE*waTZUvL->u=kAvK>?w!6;-UXUC=^6pcAR1D*ca;w`69oc}?O0V`QDm!Kxcx&Q)$ zt|!*1gQwCtNPPU2Z}}OFI^$(CLB8+ng}gULKjjng_jdRn>XOs^z6J_`)Cd{+fZSa` z9HX#Tq{Wb{apaQN9?sz1Fv>fk3wr&4M&it8rXUIX-3$ayy1*G@3SW0Vg~7z~kv-|n zSgEJg0yJO~z!IZ1guNl`EUiL)F3@{(4F$-0WjDZ=GF={`InmsK94nnVJo@Y$i{E#J zhj1Rr`4b178h;M)|Dlpo}EeNeNWg8yGY z`(h1tsMnpZ(UKBoVE4B|st-|Fu3Y38pCY{11xp0mqGILQ?CTq!1YeF1+bd+1Ae?R z;Ko>$t@3x}+`uwS8pJ6Ck4$GepOwicN!3Wax7k_gjE$yP!KB@j!P=mtq(L-X0-BoHXm&0VD#TeZ(EQy*URJ0@y0vZ zpv4N)4`7b4kFBssPeKMKT`JUHL0wgs@5Nv4KVQl@8UTCVe;M2DAWikhcaU6ej|GzR z59~(>I8}H{h|9Lbz^f(fQwv4x6NpEUp(DZUMg>kBkmg4R1v6h*zVGO}pRZ356;o$_ z;lRoN3l1CyIFJC?eDX62ktPzm4_+r6ZqQ?_G@H3%#xScUyOJig4~q6PQZ*D&vn9)* z@m_%@rt~YzdsKce37S7wA|}iyDtt*p>1CJoUZ3wn9;*1}BTKup^I5tUdM0tbvoU)Dgx*uq1p=kom-E~)Fs6T}Bho3dI@ftM!T1tiw0g&p`}9_M>= zRA zLXJnm{Cc_4)~DWwyf26f0^MjfEF1?_t)>duBbg10iSCD&d~N6?=yMIFK0n%O3UR=- z`-A4tBs$c@CdRiVU!>r1z%8*e%n1>XTR&sP!dp&ftNw({ru6<>U%vnF#i;9l@j$|? z11XiqKQOeWE-#08GGBbf4aZ__t)Rk!oC@ImenzR9SF%SxJN`o8u=%X3Q4 zJY0_P2#w4001h$vQk)FwC#E!Qo#vUr)NgjEqOMJzv**aOEy6-)3UT@Rf~ zCrkBQ6F#vPmk1J4($Q1=o3Lqj@7dL3Kbc(16*bc(o<0tmy=z zNKO(GzAi+Ov#Oa+bBQZ5qz#SUj#pWZpZ&TZu8^HkX)h7(LE)nHncpbS+Yj^3GgCf> z$IEeLF?+G78(`FX=(IDcwcx%AAU7tRI|=0mJK!FhX>#EI#EmL_xYn`M*$kY3ZY$>k z4P_guKR_erZwS|$NnrjZO8i`?1TR}n&I_7S*p`S?x1Ej`8Mt&dVBf6L=6V8?SQB<* zmeWgsl(+0i(Z5%hS?}>Y%zHpVJkGg`BI%eB5!!nk3D(YcRBoGX$ru=ll{ptFWf|PZ z6l^?T#Bq?2Z|Fji1z6?nK7Z03iJW7u9~*hDUUgh%{hprw6o@UX#H54UvcZl@^i^;V zgCowz47KLE^Z2IcoLY|Z7&6Vc*D_486D4{q8VGm`U}V}5%rkVO__bYU^0gD7ZnLLv z28}`@z0jnl=oD%U+G4zDhaGjp9i8K=Fk2fZ#E#B0={;;LfR2&m90PaH#1a#Q^1K^! z+i5(wi=znm(TvB3D@-!K^eE*K?hpFy5_OCfi>fq}s+P6}*eq}cDuWIc#uwwLb8=PSkU$g(k}+VKdH`dCdW zdH5C4vEjh0HN}zPi=GE(#fn@x+UoQamz}K1ec#yw=zDAv2!R+vd|O zB%mYhhzFK*jy3|>k?EO=KSME*X8kh;NJQF9*IL>9uDn7A*4{;>FVBp{NLYz?7IWSfk-vcUiwS6+$Q$^@pNPsJ~*u zk?wOX#y`=hdNn8($4z(hs-A2%%a~$t*h<}`p{at%nHv~I&`<87_Jwy9l+Tma!v`RL zmFNpE@z@*9Por~&|F+vyq4m1}qiud5x@$kcjdAGvor!HCK;fkn2oT_xPz9Hz7slb= zj?m~Pns$OV=vF1b8PdF&ZJ_nKMAKD>If}gX|1Df+@U(r9T$E}*b*z)=C~siVB*=={ zZ}7L7+o+a6U`N+ro7Q$s%N zUm!|s^d-zEkZk=9?@>*=eDCn0`Zq8Cu_vvH14nLVdvQ znGhY<>Uem6fYF&(q9yA8JxZiL$z#*1%W(aYZYdW#!>BiWV_SGYA+1Ge-v}{4pU$Ae ze3OT6U>UwYQa*-CFjPcw2Fot1 zecgWH`9}03`?lA0E;I}t3IIYaNBsyGagNaO;M-+`xgl1Rnzm*O8hE~=@8IK%y{rg74uk62# zpTV*=EJ2bN1uriLXw&%O)Ff01AuPGiiR>@-5056=t(-UR#&KtU zsZ{E3Kg5K%wz$!IxGn~GAmq|Y8jZyoIJP$@)@u~3Y)A0&yHM-Jb`3R5F&Mg8`Ne?C z8xI!sm{w_x-X`NXq2du29!Q3=A&qF=k?Cl!_ePhRJIS>B(Ppxwrgkj{!JuT57g;9! zR}0|aohE^gC!!&Peuh!Ct+C2z{ep;XAR6KU#$8asFwJ&eplJ5nm4~m!TU>|Hn=4d?^!|g3b zyOVLrn4HS<(tYMh70+OXM$X1*{b!>A{%CG9hl?Y7G{PxaYI;q{|z{ z+wzb@3Co%mbHhA4FDkSi7Ke#xj7bA^47S9J^Je-pZ|)V9=-MTC2|rhqQ!0V+N>(dc zQ><4KR^n>C#RzkX|2xZbtF`tPR}dD$W8t~EJee0IcVf>?mUpoSGO^ei#_ikd*>Bxf z-2aWVcMh)XX&bdC6HLqrCbn&7Vsm2Kwryi#+vdc!ZQI$g&z|4&yzl#bRp)$Fr_TLf zYOh-9eXriNy05v-DctOyG;FNaK`p2vFIm6*c{VcMQIxshnemQvBL|&|qK)sG z(R~G+9!wu6#cqeK_&O7*zj8-XL{k|`;o5j#Qlm78?tFIjAQt$v#gB?WFAsNyiWpmZ z_&YOh1q$ul?ncs0+k7adCcRSWMjhSGDXg!oXu7&bHUPME?Jd5*t^j%P!5bTSRgU$U zNuBzv2{$w<`!hb4{CNXZESh|EeG6M2yhM23&&yLyI0pLSJcy*LYe!mG#z*Jj)gxGA zwJ0R2F(_+~l(Aw*o|VogJzMd|yhVm!#vT}-*E7@PZooNW$W3=-v8$u&$@5OK0OuxS z@*3CK3bEO<9 zE&h;vxjBsbRsLb^Orf|cd$+PHe&=}P_w$~Z6qmG&H+(UZ4~gvg*zaa-V|5!mi>8a+ z-;yx{dc~@9DSAZTX49^9kiuuEI(@m>m+X3WFy&!}AG zUJhoj99@m@R>yBjW>JDDzvzt-KU^Ao(V zw>p9o$C|fi8;zejnhjQKGWuRVxStlsxYyUF5Z0XS71lyI*OY563ur2`^)Af6-3*Vp zAnBY7u`cnmUlVD_s1jL@4>?(aYdEYi@oM@MLqB(a^F%LlSl_%TxZoJ5?epMBGBAEZ z(YybS8sBzLuU3^MmBp9UKQF}?e&=|+hAmlIRuqhLyjeZIwI=U~AF|%7&n=o4)dl^$ zB&+7KuW6tpg7j^%z%JO`5py+~vo7HxVw0#a9^w3GI84*i-**%6|{U;9hU<}L= zV6-li-H;C4FFG>)ncJnAtM91IrOqNVOEDc{Rfm7AZcURTRI!WCixb|+G(>1z0aX9a z%on9S)q|l{g^4vQq-o^eL))B{?V0*&4V(pb~~uv z1Y?6eVvL3?f(4t*%j@)v{)g80g<%k|z%skjZGPv>vY5hmMC;?d&A-Y zO!yqxvweCTc)4RI{`ZeNGbCke_MdvzoUe7wfSYe?NS&W~4cW>s;UM--VZ;q>;b*O6 z`owXyvO2+Af1-k5SmiazqE-8#lrJ~OMY9X?%Iqx#kvSg@25G}E{BizNn4zu2W6vO< zQlkDOuizFEgG7qoGh6SBm5w;NtzKcX-_lCJa9N>H=1%Y3jd@VCz6$(XaEoP?UcE)&IovXj3Lgdq+rPp#~MWOt$AzA-8tdBg;8cL5^o#CY|ooB1g zTbiBXc-XM-M02Ux53m}ZS-qGJp;|Rv(I5-{I)wCqv)n6+cV1F)1ovKxnefM6tZVe; z=v==|5y4>Xpo-B^uht2S3_Y>1Y5;! zCMeem&c$1fT)F0cm~fE#ydrhZN{pQV2?3jpgurmX63y)C%d2bY5+AvkMt{4>U@ey$ zB3eFFJ$cf4YluJ~@~JKp=Cn9IR&@RDL8j%@@qmMcPGN)(6^zbW;2h12wU|voM=7* z%D}C;ln;Yylii9lvt0PyS`U63qDvP|hV#6Yp;M_at>_O;HFt4L0H-Y~>Q0;@q)``^ z8ibmNh)7i)Xo=!i$eB^WC+?^p^beeuFlWX1pQFWBHbr7Z`tO2>v4Y6)-vvaz2t4sf zAM-iGK8kWQwOHP>krRmbkat9o<<`b@Jg9f z&alGrNb_oKS#2iGGf&>fhhboe_lY3ng~`Y+PYcqQAN*PXEcma| zt@osk?3qC})rV>PR;C&!zz&hF*&ilM`rTIkck)DO26p7ra`PRL%u71s+bMCh=M9ec z0*LbDYepq_vfb-mGrhej@2l1iY%ck4Cg=RK4w%2#oS53UWmcW7g*Wc@3_}FKywD;^ zsaPwam8=QWz}?utdItt(5kK?o&MEz1#$?S}vlJllDA4u&`IE9^Ha?CRsxSev7FG3ES^b*4%@C!gYh*GV2&&pIQT z2wqjmy%`eOph};6@I~~dB0WK}O`Wdo@&+{GBP-+L{1jH4bQFhc@_`pf9AZ>^a)E4J zaXt?%yU@8c%9lUpo9g!J&U?s8r5PhClnHyuF<$LL$~P7)cP*UDCKskTYLR zpIB%{YcK3qVin9a_@UEhAM`P}srC5+!d@o8=Y>N!Qj!GsM1BtP!&}_-vydC#O4dKG zZiaE;wFSuwPR5ooA#Eu~I5JmssIbW)63G=P<--N$am$kvy=Lxb^N!SJxGRErd7VGs z!OcnqxW1STOL=5ID#s9}Bnmq3fB=&$4@@%GhHwLhEs@|E4xxuA%SFTL*I~M}9_N%sFNl%_rZZcdEqi;`{r-^JG(ESPk zg!}cn^lB3C9ljO4-2P6|%rS3XU|vrZS|=9jJ)==anB~wsg8Wcn3YAV5C#$0Sw(1QZ z;VDuVEdWb*q1X3J=^;*Y>{figcJA5-LGUWH|lJ1Vaa94(Gz#?74B&3n^Xgq9g}!6 zYVGS8dJ7vxnD?AQ=!GX!f@q^i;X)4T8k4D`MZsJ(eUXVvYm8^$6q_-MiYNl{bgmWX z%f@ni)5V$!yc;BDBq<7Me$oCn0#o|5yW_IbYHJ*glSkp7kxy%(GFr(68hHA)0h-!) zGntniWVI5eqtj4cV)zmFFq=p3;AbPPreBkFk6ELOKR6)ARzt*OBnT-^+&71%xy@a^RlRRj-ijC=@m9?Z1*uA7uq(r2Y?ilh=&*B}&1Ys$!jzBArF`15= z2s9n`-ig`BwMO{-uHcL7QNF@f@Xz_`qXC{?36^cJ-{d6?Ngea^qxGvF=n_6A+0-G07a~^@pk>@ z^E8?{wR83PYd8HQo``jVIEO=30g6 zMW$szuS`-hqb8LyN?QVkvT;>W)kT=*aEkQ)h^{1x$>ci9{!$)OXZ=w>?ri|`@Ptuu z;AO7r?rqB7HvD(`Oqh|eB-OOu3ZKY<#IarV^b@gW?c(^}eRp?vvddVl_sV(K)(z@+ zut>uphCa3XJlKu<*I`N=h)hL5OD&bJZi9koM{*Ed)ox%X`lIY|xH7YDM6KR@;I;c( z;SiV|D*B%7w>WUryg}a)a%8~!XmWj$UGH*~M)seqq@8AHd&FusUux6oGvUBGAC+I( zD;0vVMuz`o(z!!Xdu$%1AGIQb_ha4cLbQ=GSETR z2ZWb5_zl4v4^w7gzmdeap{;FzEr?h$EYjn!96OP4KDG1j*A!l3y*0^Zgzt7K!;{D8TD#>wGE%$RmZm#78b zHf>P}gaJ6gn>8M?xub~HbD~A#d!-*P%lrEeNgtp1A(>ht-_ab=a(N<1LU;Mz1F`B4 z;2Vbs003OOcc@k>8*=P^=u`?jAMHFDb_-{y(tf{k-b`!u>kTw4+FU3+tZik&N@2T& z(&pNXP^&j)s2T$29x2MPW%c)Py*g;zUywY^h064~BGdWq4O6_tWV4ts`n=)9`r68Y&Falcrm!980*2#}T)N_ka#E zwd8+ep7Q_lqGt+PJ7RG{L`cPnwfvl%>tq2$TI!xu>M>JhOre`ct_>=bF%lVfcTO`i zvzaaa%DkwO6i&5gc(g9u!gs zzt>{j)~xgNS?|s@5^Q>jP{)sm0bl!=AL1+qsCV18-}m4|o|;RBENgX32o3KIyh{ng z2`Lj#{YjJRjMFEMT`wmKQ^x3A$U1Lr_hDagdADC@WM^LMQCsQ z^xo){>TDBDfgpRbo>Z7Mn>seB$~9{=>H@LB%;sTA=fJb>%dbQ%zZj;F%H~b=zW1>J zEgS|}r{yC^Y}#GuO(tB3TsYC$+(u-Hn>+DX6J^^$eVj1S1i*wQ)gaV>c zT7>i=<@uUuO-f|*`-PALQs*1fhN0Oh$cOnMA&;e$sf~He4d1N4Ifs0MVu6T2l|1n{ zmppZgDEkC zn$JkK>t|lmkd7;BG4i}sq`S$K@_hm)NvRg=fu)d!E^0)N6=s-5j`~j=ci@ulx=8nY zs%jO^#`}-QmEPO#9JRe>4iN5Jh0%wf=*)_i-#Oe`~85+lDm zQfq8;MTwx^d2F$5?Eou?KSPL`37*L7$|*MqI*k)FT3Yh{8XqY1h0j;#t3ZZov#;pl zrSYD2m~j9Z;5ahmhay{|k%RVjA>G4vuh3CC?qQth(DZ@=C+DW4bLLDQaM8F*4?T!7 z0JR*%*4pT%;>dO9R&hO-lvvg?e&yHRlikOZ<@yJV^`o=Gg9I}cV^Asr{NcO{U#*^l z>hsEZiZ@fH(~#=zs6%^;EzOV;fjV4QW)GZyf#*FfMK6QpMHk)`NboVnSz%F8h=LQ8wN|m|36c;pRl$A3DXkOA*btF9Pbgo{ zz$*6$SQX05HIQa(>yT`L0vYp2ZpqERacps?0nadmJ@T6|_rTo_97p3Rxb~K+Sct}v zz35Q{P#sh#g#`Qh#gsXXZ(`s6h7@g!H)*m8TgRH=*hVUoH<5q_wsGzHkN)^UtvsB& z7G(1+9b!xs6eV2QIE&#-f)6iS_Mf5)>X$8R=eGus%Gh3BQAu3aD|ybiQ4_pNZl|3;<{VuV*$IJRQB!6K{0|)uHdu zI(NG6StWHAQdt$#EXjPJ?_Jv0avpR^WkNFyPOdXr5tDsB>MSm{rI}rA37pNxxOqOC z^FGxgEtyms+BjXXVhrrbHW!x<2?P62oZ%(H0<{mWP&(nNp#Oz zL$Wza^lx{C<91aH*gX;dfrE&hr~H%0^9};dLo0SHnteFJQqw1(6P3->`a;~$@gLxF z>Q7?OEt@>{ujGHg<;q`hnG4USeCHst#d2S&8@bq|J7Rof zj+OrhUH%SRZ$`HExm6Q+7(VcUTbm=OLg+Xn%d1{X&XVNYTXxa8X>19QMYj=+UbGGY zBHw%?n@kMojF1%%`tU5ayCHokQZrj1xXj)hU@gTRWPKlV>NHw3a>Z$Tx*jo6Z6HRy zcQLxh5SK6&92<;%{@;L02AdTb?7C!uQYsgja3bE-C*ZA`^Kjvwa zytZGwQzmFkjoAA)BahvGTP#V8Z5k)fa8_Y;teuLpU=2^jTqeKUNDNw<3*;|jREYdI zZO#|`3oqTk;cQeVxV}062jz~yfS^iO?0kRFP_EX7^OY&yOS7nY{@aJ_qJ)1IGW;Uz z1d&EYLGtV88mzr~&R(f?M-R9U3*~8`JCTNWjOKB%=2?Q(;Zv&Cr*sMI6Ia;vXs|5*UZKBD<#G6#xD7lmq5l8 zQ0quz(f$SG8R~Cd~E-QP*Yu$P(2V{8q45G7=YjhTxn~LH$`f5H$Nz~J~h|b_Ba#!_{u5reV16{ zTT)dLt(l*M#DgrX-|u7guluraEHBOl{F#bq0bC#hPv00DvSoRf12oWp5VKNP5k~B1 zf^`QJj*Q99T6v4H9M&rF=b;JoR5I11(h?Z%?E3sCL`?K7jp#T*E4jk!GFZ zZAVrKPMCn($x5+m3%G|;Ndvo&?&f9g`1HUzh zc{4d8{v4^3VQ|NZ;%1Ld7p+w2)cEU|^_83mntIv|w0$uY0CKfD9u!6e`k(l6O+REs zpr5W&TW8xI^<-@L`olC)D^GFu*WCEx7fSdZr6g&gEFjT1AI(SOm%R4_5IAQI9Y=oY zo#}Y_-3L{gO?QVqE*W_yF2?V#Pn_F-pKCI3(1*u92;{Bc5f_M89L`N!txaO8Y@Mm~ z0_l1K{14^4cYsIz!(k+W&q^2amvUB5+uPdwHds4|tE-)FdW*7@knUqQR25pD6Viu4 z)xSaVmLAI$C&J%Ti8h7nXQBQ}IaSpxTeg$`%LQ0Z<-+R1`^Mu zUqIqnp_C6LvL;9I-@p?r^5B5?f!ZyAc@E!rGBC1X$<1X!%zuR=gO*dwUB=+F$l5r$ zJQNMoTHo|dug+O{&N`=H!~DMDZUgeYQtQOzCD?{F`owWZf@UK?wVR$!yxSWOgz0wjC{)SL{qpKD{g!Hb75^-QuD5h(~SQR0=7yhqdDoj>p&{&(8eviYPO{lB} z+byq8YdoL2yHPYZ*%aL;Jc6S~SM_5H{zFN{H9Hp;P=-E3d5NM>I2t|tDoj-#v_ZeK zwGG57l4-Us1|>mXHhsukHn*C&i{6d|q9*lw6`k2gfG|}G)k54KB7fxnOi>}rCzh?S zWu>tr4~qZ40@AOj3)Ar&jS%|X zqE~Tix$bl}(zxG_L^j46C-28y7&tz^v(ewui?^f;p94iP(A>^j2qIgou`{Czo1{N| zGY9M(8x%M27ype)-!6&cT&YM+`I?hUV%cW!@Y9(v^{#i zkSQ-(E(hi|AU9&BGa2KXf;V zR55~E9m5^s;&)f`#vP4XWKH#!Ro%wkhS*7 z5C`%PF-5uBwdv#3BVQU2dW|zUE}&ES4Z_yU&-o5*;O<=fIxPC+X~61qww(8xOPW$vR^o!1AtSfjCtvn(9m{bu=3{2%E|n{jtliNSD%g&eo(GQytLQE(>=u z-30P(Z7II?a6xAts)Yy!tS;r?(p3OwEcSh=S~vkGRCO4))n>;Dg` zJ{qI7U!(lF0d?E|ppvLwl&O2WA;Gp^p;){$8sS=tJzJyHZ*k%4XMvNgJuMVIzfwS6 z!*yEG!A#2Z z-cwF5$@R3=)kQ?*{ACVL47%;~&7sEY)%lD2-7!eub(@!1$;^+&l6`z_o1Fbz@QzTq z4;vbY4$P6WoR;A*Su}=a{TgAf6awG2638~P&`94&>|Za2*^ygT#mkqZC5*b|27M(^ zJNHjSt1t@6rID(jT$anDcx<#()ut-fs}yywNRepzv+LmHg!_x{GJiA}jM~ zfVLX+l^ZeNRbQ6DaB&TQP{NvgWFP8JdeyMnwCS>vJhjOGM6&+^*NPHIL^-pmwX5S8 z^Z0Jq?6<6dE;d$q-IIxaD6N@r2ulXm$U?gp^ED+i`s3~+D8w>j&GKc{%8#8rtQF(Z zrnuH+DbqeKnpeA(2)mYmVSi|OgKo=3f?@l{Jv>|VUy1>>WxHF2g$s|5*zSQADnvLe zVz^ub(O)P7a4SWkd_%Q~cI*po4=Ri@=$-c#O{$8GXog0-c=2#!zVRbYn>SMHbYf>u z4N0?YD0V)}BZ754?ZP;6;w)*oXg%XZP>*522CI*dr6ebZ05xgzM&%91(nZ3yTU$@Y zZT*m5#S&rZ0sYo@3^GOj{X@7g9!0UO+I-3(dLo0CsYrvzZUR*}b;me6-7oSHtqPH9 zaG{C2^Y#Kb)FM3UKC!-PCG2QFIM$t}{>a!;wCnv0TEuX!Bn~}>({KD#KBMVhY|hA+ zfg4P5jbw;B_^O^C<(f}ZAr-Z0oAfX>7hQ7TPF4Hj;7L|yH6w2(-9OJH-{^rExyT-g z^m>)oSj?j6;6+(7lV&;3lDPrj*yB%A%X`y=5eVGrtlCQI#(Qx(nOpooy=SleqLME; zaHKBPbD<^+SiR96Ph)9VBuf-~ z^X3Cqk1eb75w28rxM*BLh7S6erpM5nXF*Gq>lT*RW-Ye2r{6W$nvG#UvFP8f^~wJz zD>c026@_)V{-NNcyjw}eVOL|{{%-4+V30)044*hCLIMRvvwMPFClfMI%JX*xR#4!@ z`vEvj3iv3y*>I>r8MYmv*`(5BETP+L8nMdf+pN4kBJE`J@p*u;{`DiQ_JfxJuA_7R zR3g3?AR>mWZZ%@`hWDE$xdLauQ z@RJ>~9pJkprl{IqY~_|Io6EDhG`?b^Q|vG0iaPX@SD8_DiH`ze0IcBQr^`Q!P?4OD z`?Y#KukBsBJZk9D>_PVX_`KEV)pV+EdhM-%+fsGFF8L@)*Kk<1GNAcQ1PrO8$CrRH z1EO(OCkRr4<^IWh2drXIuM|bLW4LBpxPaP4ReH?FhISKEGV#e?+;}~uCi9Ucd`CIV z3g(!ap+Dtb3>TpXuxyIBQXduc`5p)BMR!RT@oUWzqwy<$430t<}iJ^XC9CC26irButN2Cf8=-p_Em$4FodO-|>tmGp2Sf=Tdm~xRC`uw8J3# z*zSX!ZzjvJhRe--KD!OWObR*MJ|MHH?sNTHRjwa3xN_0U+`i;_p*b|ZKldS;-wgiZ z91a)88Yy=G_xa3ciyie|hbNA*=WiH?(}jUV~UkQ2SLDR zos8a9lTODcK4fz~sdcn><@Z^fUS%_hTh8RI~8cSrws4@MD{oT+cUM($j zy6o#{RrgqxJ`$oL;&tndhhV5Nih57Xoc1p)qpwwjfI6lT=tDi1GkLT75`U$HFy)!b z_^3bM-M`K=1!@Van9uo76bL@N#+6+Nt{CrK!}WWAHRAmqM_sQeN-+8uArqIHDh|xb zDyycK0}*j!QY@eE5T2ETJ@^7yE9~t>{i?>PAZ0AtA*NEP8Io!6X!KTIB{}e|drVkw<~z{5! zpkW=`y~(8)xSkzvSi>z0^Ror{D)sv6n#GZrO15n2Ap+8VA&m&-pD2%rMC)6ug$`Mt z%DpHsKn*=ixm^yZs3xh07QIh!Gq^#1Xq6gjR8vCLE1mq!yTV2BqQQl~QH83~t|00N zW60ckM-)jt5lTX^*H+?W5~#Jm6VW-~;;4K;!}d&A(LT0=;>=dWQU-UiVb?{g=E5s0 zor|wm1tOu=m|{#Nctt6*!-%&4dFJ`yc7g2VX%$$?b-SxM zF2y-*P8%sl-u6C$DaF-`sjlhbXn2H)J?5N9a4q@UmUn7fnn}F#9Xa!#q$;nBy8@wE7}V>Az0nCsVHl)1pX(dMeutIKGc?P*lJT zswMAS)>_}&o?&O=W%AnfcQl1_C_Qse4ljskLst@=ks&YgM&pO1=h(R*mDp=H?k7i9 zMWr_{tTi_Dxx2+$%>>P;!9wqv+t>HyC?`3bmq;hkGkXUTIH2%Lb2tPPe&tJb(A-^Y zeoAj%kc%Vt=wAD?@tXf#*KO8uY}>H*@6o-x$4tchYW?Q1^%=2I`^HE7U2(2P5SQ=$ z?!t{&s@-23Dh$IKQ#4s{E1~Pv#G5pG@Fo+(&56vJcAVd2YpUt(36qpOQcPD(%f8!m z1o8ggy63aqj;3~)ls3jz46k&;k4*xkUuT_nZ*NS|?{x?&bFTUqAEBOzlCgj zzr=zQH@6#ol(Xk(y<}6+vjpP}-0EDdG~5NvEdfPf&P;CA;1F2{ z=5ba_(tYXGHGJlu3N07Tp^#}C-tXeyE#Zb|#@vJu3EV`(zg8-PrcsHAo% zNT!SqG9!iLxG8f^f@3L7p#l2;^5x`G68-5Npk7kvlxDmp5ciWr-Gw08YlRJvB$FdIrF$GMX8OCoo1*B@472h&wAlgzv zuYc;p**D{-lua=$_*E?=W2G}PdQmKPz5=B*EsGEI|1N$`k^X7%c@IbBau^<287Y?K z>2dg63291C4ZLnW>KI$YyCm*9XH!bUuBj?Ae|=Vu{fd+>D@fqKGXfJK8INw9C*TAC z6aDoVpOheY_!19Sy}AfjdUn6d(3r1b180}G`s|Ca`JRGsIHk7;QVBPd(;JOuw%!}=S)fPxTdHM)>J(Yb%7_WTN#@m=7;eId2bTsa!h3WpPN`U$n#V)l{Nm9= zl+Lc0QeNMV3OM&_GllmE+u9uGoJ8GOIiiTlfP3)c-s5TCyn%KH5+oROGmDkSNne8c)Cj@5@)pn>8*F!&LCs^#i1<&HYV}l?N7sVX@hg zfW_SU@T`AHpw-f7%nWAq46+&D&gU^XVlM@6mnLH*{1%$+Pge8L+^)l5dZ}N~LBYC* zGqak6U7N?sy1u4vRjRXt|MYf&`D3(~XEk(v=AkT6wPOEdz|F{uv@{aRt9ln2mmc-E z5lA$#n5*J2baawQZhbh8mDYW=+Qh`nL~c>jOHU7vPtR!{ z3B1hGMH=MaHw0q1@V0xn(zYk6ME15CPF{K++D#kPy`Ofzb$+~9fbstXgY zkw1Vw8OatBizy2PwL1$zZ@jg##^(w$=O`GD%sITzL0|~WG|jq5;*9?Qc9J)_dHP2< z=jaRm)xOUyAuHCWv!P(wGss$H z3T_sg2uFH0kkw>}i$z85K78ePPd;-+XOv-*5;+sa88877`*{Qc1eIMS(_Ol!*tHdOifcj6B`uLwU(X@M6LQ6`pggDJDt zMq;v*wNrDS-Qe};$l8H}g9ml7#}nr&m;YeU7kXA7%{Ed1G18Zplap&9hRW9L9s7X& zms-|KBJniV@j;yc{a=4i;B}1gVvhFPhuwG{k@8r+JY<1>k-8`26uTZJqbF zunsC5!yKLul0Roifj*k1VT1YwURKe8ryOaLB=$kHF#k^VRH1#bLU4Sb0zWWvmE}p% zfK3ArQWs8D{r)%1QUBE_xe}${VZ#4U7bQj{n@S{IduXz6Xn&1|{kQ#d>VS*Ye*{Aa zL&%vqT$o65#9dld{h7@SOvIC<-OZ({=c_8`>($-aYD7T+5aqht?=`4A?-;V!a3lmg zwQINYLbbO&Uw7GDZw<8FD69B9KL)&+ZHXzMV0E;qVOLf!BvJvt{M*PMR}{&AJ5F9v zEEE(4Z`YhEL#``;31`ijPCT)L{AZZdPcu%8?mgS>yWp~}wwq$W&0Em;CvjA_@L9i& z(5iQ6fTj~wJz)u4yo7M*n%xg}iD z7sjRv;K^L^-#p5}=SmpY#dU7RO;nDdJTAz=|3-lLLnHyJC46{nl6WjzGM7xupP%@D zOeZQ*ul)w%Jr}MTE^e_B230GJfiJWwUuI1E3c$O{F z)~;zi8G%%e1W!~50^FgX3EeY8@xR@?etm+TicQZHZ{kZPtQOKrL^pBml2)b$%0*O! zujl)R2RZO&3>sD`LM-M^Cq8k`$!ml=4z5sydCkX@IQoiz9|}%O2}*I@_O1txtJ%qr8+uiNEp)94dw@4pObP0%$p6Uj@`8xvUPS=3azm}*$V8U(MNRq}2SQ8cvWYC!B{m+ztStgbii!!S~=gv?DRhZMsSYoC$wwQptP4lU*pyclHH0&LMgp5FxTM&43}R1D`1 z%W#RYc?M40H(C_h!tk0s%(RRjLtc?qb%yT3I;Poqz>pYJ&9CJGfxd084L%(mLiJL_ zg1K-Kk#h8cx}ghhv@C>XKUdO!IugPBhz#nMs?zu?2)BK`$tlg2WbiAJe)EZKqzFY> zC0{LImGhT8dob917!#l1>hjy5vdfUBB5AZ(o<%tZCjPg_)DZddPc zVq40IPIFt-4#TUyFIFGjBs`3^u{|uZPQ;p>k)JY}B7evSOl+XU;=zmO{7blEHAjfo zgd5cFc`KavirQwyWbuA>6$Nl~c|lAnzn|RCgq%O?q4*V@6ewQm8hl7>`aFsTf^~Vg zx7O=iihgS@pY#?01qBVz5x{W{Iyuh6aghLJWMV|7ZOFFKc28Dv>u|H4v2aXOVKmw` zpO*s@{xt&*GR<$V+o-O8B%D{m8LHo_2`VkD)R+bcL$Pq7D)xPvBS48OSuC zEet9^EQ2L#RS<)-I(h}*d-Ey&{+&yJ%p;=4zcu*nSMska7$_AKL}DcV86;+cMRWSF zV^bj|)P$-$7-TefhNA(4d5!2iy&>~PJ@9GfhL;gn9OsI%U}J??L1_%v`@;3OZ5UQM zGm~hrCO^NPPoh&>zk=v8kvJko08+MvDH0oe@waMWp$hi#o>^o7IFdM=yqbc5n-QW~ z1aef_%@29bva-A~s8Rt$qA<$rD~aj`%;G|*TL_soWX$o1VOtBpD2nkZpU*A0-Dr-JvHi(P({SSOOeaZDw=^EAW%-!XRD?vriIR z|9y^gG8-glJ&}DU{U`KG>g&lPIpym4Xq~-@9q!Y6F$g#Ell%&G>a(kfL$hI1jLraP z%DIFa#Y_)sjV6%>`-6H%z#KP&6Q~;7M|EM-@_)GiiCNKF+#YtUN9);w63rGZHm(V2 z0RM!n{7VznK7CTH@xWfd6V@m4|c2q(U;N`z19vZ{E zw+66tDf&e3^Lf9iG2Y;8rnUqII6VkrVqjooU^}t7R#OG`$vgH$PAFR(w9ulIRCJ>& zPJ<&QtVGWl3{?c*D2;|XW1-at`cgPwGFY9E6YwQ=Li+a!#*g_USLC!ah7zvckb2mq z#AsJn1$!y}ehoV&#TM5-&y&J0FmPzAmCOnDd=lVnGDJuU%?8-xA#DV1oDFF3Y_yC9 z`z|B~E?EgmR3wZ<4pjJ}8*)9)wa!%lEH!!w; z>l32^I|XRKukbik*uNn|A)?Pf4-EFg`JJ!gUxMU}I1&j^OIB)XNz+S(dMP1ED;CRS zo$_|R$V>O?Hya>_Uff~D&PcIlIHP>!lvtJ}rqpZF;1A1#GPYC>1tT)eD>QykZLAVM z_uxn=K>{@nVPh>XUnPqQ?eY)zjf@W5NC+IV=5*`IfTzxrVcyTrV+;)U9XRMYYsd{G zI`-$tot&TVPIek$T$f*F#YR-#if`*JRHbv%yGRH8dMSb?N0--SiZuSbaEVGUIW@w6}r!TP2&k z{-n?6W_%evH5vVtxaHCdxAPp+8mBq->lb*&&p&G|pAVlkfNp2r4Eofi&8^T$WnRyH z_z(B1wF)yGGE5z8?B(-_QrmA z&fYT+Q!J4!5>;a`$$r^dfxfch)dH}ouGNk4FA7}db-{kr-V8ZEw{(wc&ko!2nTk)v z!^x-ZiZ9!;d}-CG628?qzJJ5)nga7801ZGXm_(K|y?BjGZTAi5-&2iE5R{p;w65$5 zs@6&CpWQ7}kUriZ6_cAZx_O{nK!TxBXBKQ8J|BkpLeNx6RrJ;^qo{}H27(_yRrRi2 zvK3uHsz*r$`V;`2gB*2!@V^-QrYJ|Ew%uvlwrxz??rGb$ZQI?`nzn7*p0;h<_Q`zf z|IWo(|Ha8ovXWFKsnp)JAH44qg|M~%IqesH+I_+-==b5pE0MMky4xZXZZUX3yAx0U zuFmmFc63x$`g-sF8WE?VcdcrAeDJ$LA2;Z8o5^Cr>w_}GBFiP;*QLhc_Ajgr?YO1Sn5?z%xa6-yj0p7ne_Z zKQ5o9W`xIqmUqtsimhvi`hAb+#mYUJ9X+>nSI-nNg&C6)Js>1)3i)o5Ia0NPzUNP? z*reRq?FViNH9m##W7iW5tMh`)M5=xI=TF8`lCw%0>(6pR$rw+^p`6gU36S4?XmMRr zuLeLBCBMW6r4@S&Sl4R(14U^l?Ka~`L3w1f`gVEPs@DUy7}7TToVgy(B+DwIUDlO7 zml^c^8ekK++$e-;K>?;M&>6IaVhpDI<>OQY-_d?v-WMYhrfMtX^Hju1`hsBtmu(1 zicJO<%W2&**gN?^&mU%l0j1%a@qN{Y_b6wu!BV5#Vz0mae*D}aF?KRY0d*#mpe!em zBwq+8(32m!a5jummRJ2P?%Tu{Bf@$jHIsO|=b9QWM*KIP(NRRKrOiH-mH3OWd@*GG zuy<|;_v%YcPox8-q;RhNwB&+%O;9u_!{Z?yhLJmSMO5NyJ*{XviKOLR@TlD6LbfuB z9_8WnCPY~po?W*D>nA2TwYmexWVpEqh#;}1wLuBulafM}-F_cU8k1I~_{pt$CLoB5 z8<}gil`STrv?I}evS1&nD4W*-B7E(QO&9klaruxFyG~PhM8ulN#=``)VLhhf?5(L| z+&M&oG}8M8aVW$CRmAEcBzEDm>?|P(O7-h*#Zy)Ud!u(pP0@_*Ptz=XI9&VOWTHJ& z2ZUTbPK9z4+NdFPp(^Ytwa}iHUBQ!ci>G<(H6huMmijRbndcVdTHAd15rGh=a`=*SszF{TtrS&hQf+5oXz52`yV*ISwsZ)4c(om~3xI+1_6ye|)~s=eInAMxCB> z$8cT`R@X6^%o&3qVs@I3`OVJrWF~w+MZX+}R5k#Fr0~}rq#WNX$20u(04ICgVSx*f z^JwV$;UJYrDXse7xko2!TjHtAMx77pZk1QUVBQeV;;1)egtX{5iTjZzS~ybEh@qZ zpzz-80b#aNWg7Wk9crfN_=zM?G1vAU$j@*Z+zEsT^UD*=P$-@#7}nH zA?XfKag(WIl;=cG$<2pT2wOXURM}jsHxzl<5Le&G7&e_C=4t32@X};H<ryJFU6w zz7a!YQy6Qz!@I;)bW~CDgEQq?kX$zY4$6HGlsZRL(c~M$N{^IR>p!Z(*_>OdmZHx= zxDkHrN_i*dOq|34=>ON$o+a*y`W8OJfvF)>=&II-He5$^S$+5NiS!Vu(N|-xwtyp^ zI}P~lo>%dFFc^1sGqCZVH4UFhlKopXTY}lhvzS~Le*USKXc?%wQCi)pIUnBE(_#G7 zmaehwuP5qt>CM)w-3&&$H~*&YU=Gzvqot0D8?p^o%RxC&3nWnpsWRBm@X+PEs|J*` zoaHDcCyM)Cq~)4Z`uY9uYFf0vXWU7BYD0cKNHH4RpJd&tdl(=SCtFHt*y604xITJDA2g(>c7;Nq1q$aSum^LlS0s-^K!;B%#ko; z%1umINs1ckzrf@#v$Uu3a^vPuS%{Hs+6(K?jz1!EXf>5io%ZKDU3P;&pBZ)z*_RnF zgPNT`q!@6;7uwiU8vn#9`2JMFaNcdEnWLK05xz3SIqxE0xWaJA^8=6b~m+aTojeAdUwNu9b*iT0K zd}2>B;j{g-fqFZdnC%2|-myPwh?N4JP?qU)HEa}jVKtVhu!1bp3NXA_BT>ZS_RT}2~CYfRixaN`G#Fg|#SY#RtF&hn`WsyMM5f`U$?d7wG3M`8A~w7Vm1>?OJVjcyHAY;W%G zFH@%ZYB|GKCH9+zV6uZWQc%GktOxSsAT{{o5K&HlHPVHr_T=2ZvhV*oo)JRjj#K7i zHE^==<(YE@Qs&VRQG*EfC*avxqSSXZim`%m%I70$+~do2wjo>WY<4#r^px{p0(anX^NmG+q2c2_)-%{?%V_FKvqm*AJeS<^8FF!rw_LMGJn1Dx!G(~} z+*DK7p1o$`6Rqy&kpNC6_!(`T^QpzL{T6lcrybIJR3s&}=165-%iYX2MP1_yCKs_H z4Y(^BQGEhf2C=ye*L+oF^iB5Vg~c2w#?F}aaNpv&MoI^|mg;`%eS{{R$_O_0&KYNT ztSmR$xUYU3C2?+nC`eKYs(o&0cz*sTZRQvLyGe-b064R~JNw{go3y(H`gvp|>yk24Q0SF9*Kpeh{P zj;8;NU9eBPU+a+0`63}hmq&xc!&6a^FOOA0lVK&f{t7I~@yjeRJyKM5{(Y@xM@-u> z3hg~|Z^UPS*VX2#P9j7WM#**3BAAayw$Q`bWux-3_7$J5+nc zu>a{eU6_{kG+ez^+Slax`P^>o5}%YUC?*Cybp$6lel`W?hb_9UQ(77mx3m+knQdb|MMJ3f+t5=a44UfJY?khRCf>ngPg2+Sz(N=E9(Y=L@!r_z{e|D- z?N-B@xxF9uER{=&_UUT*{>4VvfuTL8Z*|q!OmFNUkWKsMd7YEuQ=N+#Sh6c@u2tIf znqu2Y!dj%^NCs=8hbaxKtd1CNeYWZGbz`m?PuSCV7DfNfa2M3>(xV6|f5(&rk z9BpL+XkeDH35*lPCYBxzbE=tB2IE0<7)MV;@PavqpWmG$7n;n`+=X>L#P&4sv4E}L z1(zr1z8rELzKm=ygVehe)+R+n{<8S+(uDRCcvuGPZg)oeNMQoX*+%K#kvts>*y|kG zTZO|8V#S%*P`x#f<1Mu|-`-cAt|8fT{>^chN7s7u{&}9;C(rcl z2gCuCMzbTxG+2V4nST<%Mv&^tIbBnKUeM7;zWZRUu6}y#yc>IJd-3Z$x?J!#M$s|l0I-7GMeC)q8r%6)K=Ab%SSH-YlXb+4H=O!t4@hIP0 ziF+GqKP>=8Z$T+RQ!ay8j=c)-*eA_)-<7iLPa55cpZtAa-sq)kFpHlBKbetu$kRI~ zS+`v?1c%_DYp4y4>)i2-gx_9G@~7N0+uAxR;e_Q)aScbu0Ik zb{tSRi{u9&D#-MnH4Bmoh=7fr4N?nA2ayGqN2TKaS@CEWBE=O&nOvztgc^#qQK89c zqRgv}CSSGJ6oh}d1?v}4fx`oeqKPOZ@s@{rr>1-sp8-RGmy>=cMS2wZ0G1zkp&q*x zcSfviP3Ua35tlOy2N$9Y#Hx@XQrC^W4!^_xx|8u{Hf4Lq-E4a*lNwFo<=kODViOsW*`_Bx?m|%<*`nG*p>xvw`FvfZ1lVr7j6d- z^&zt8P6HuQffBbK)8*+HEXzt+P|mDi9O%n=lrbV%xhyRVAF99zs1YyUwv3%=aiEAl zsLu-(rcAAPbSK`W)YQ%(*DUHF;k@zW<)H1C8y0qMy=|5L+np*?(xGZCE0i*_`?$xs z<-BjnU-9t=O8F%m(sctL;-|qI=VkUE>6 z7NvIo3sc-(PFEKeiz)2#v-8IXCxA!;2h=B!|KZxAnb=WF+zR98XNfu&fsn)}DFd*E zA74z!$$*P)X_ln*r!X z#pwT`=Keq5q`H-}8(csgAdlMg)Xn>EUk;>#y%y|7EIHY95;230q4#HMIGFt07#Zu4 z@mc^<&yoZZ@kzAR&R7kV*ED#skYzDH600a_`GU|WKw5=$uFFEWnsJ10j@vN8Bh zA2SXTK&z^v1Xd$PP@X_S5{nEF<;O$T+x8va?lh{nw4aKA944V2I5BDpIe2i&MnP39 zM#vz~EF$LF2bbCo6^j0jtIs2W@KJsfDwSB-#NU920j5UM!vsTNYk72=AEJ;1erK!d zC%q6#c5b$%D^jv!$cGNB&a>nqBuuYb5u$l9JX54roZdal@HBuDLn1{C;Wck>+0{+Pb9mBe&A~RKgv~8c>Z}jG!yI6Yd zQFv&llm_pm4BB|t#Er6_>_1b-t&E0Q%u*mdlZJ(__Ubx9N+u z337e+fjdpmUa~%0t(@g9cD1*%YNP!pBNvq?5>}&bLtN`#1;~T0-BbNOKY7wKKm|-k z`aQh)-(?&xL_y)D0jl7v$KX7VuK@}CgilDBQ}>aVo*y;K;f4--j%~m5la-Ue!YR234IL=<;onO+lH}?XMbZ*vdZOm#MJQBtM4{ep z-akZKfEosZ#t#RBBbhz{q<#sKX#7W4$E-`t@T3;7IC**}FEu0_wJp7KBa zM>Ou7VBd9DL$}k9ai2QNx$TI6$8+62R2#3zWDe05Zz&*fw5prsC3uGo7IV7 z{KzlPVuXGn6yttcoWS%n=@oT}JC0jSGxg~Mm>P_8$);c&^b-iUU5wQZXEqwfeP_tZ zyy?s5>va`(D}6q+Mubp{HxSIkO43UBJ*LHdgXnM%;`q ze@vnu^| znaKC(^IfCZr!M~YR&X}JM{wy^HF9Q=Q)j%(9GJ{aIe{zaYJ_4U#b+jbl>G4+Q1@`( zGoJCCHi7Ui0?PYqppSj7#y2TuyL*88PSQd-xTIhF?`leg7}@PU&h+in0~u!f!SlB55Y7&@dZMK^-xsIiSZQo%|Z@Ka(9P}i5vfdtabK=X>sBkql zW_zD(A3SqbO*NM(n$F2Ss*1uVZS(_T=t&-ro*uVI{UcjXlV;ozuG*IPsx-{x`-JW7 znL1#}Zrg6fc#3stzTHglsj0DYB13#2GrX_NBw0tFqTWgh2&5tx6rVO14^#a-nI{C% zvh?%xdBM-{TaoS~$e70joJkP_iNVX4q*QGb7F8DJYFsF|c zmYdAk-MotQ6QTR?;`pQ6aMydCivb>Igr-fNvcG&3w2#VCxcpInFh|URRV@iBbmo>k zJ)SWe#&5RS5;sugcFhQF%9wvp#6%VJ@^zKy? zkaq!<36C*L1$EXD2AW9yEnU2FoF1ymk7d_ooKTKCw>NJKChu>``<8pP)}O?F%(%A! z?~FBtM9Ko(kaG`|Z5}vt=s6mg8!5;xK(6<~ZgWgyPyGS!!D=<)2GUP;q zTpR75^OXLCWW}r}rp+bCR#{)zt3y>l3%RpbYbW zldRXjwKKWjWwoYzW2w~x-!kVq=A8)$2PSW@CPf1Y$`M?4xqzn-rtb_4(VH|JWzTWY zzlMLZUY8!2K!LT)cNN3 zuFVH%_VT|O(a;_2&)J$$(c*iIIjw|!C#tZOHnS1;Tz~zdd=#Hae>%eT0LeJ2H0)Z) zz{dhU>m!CnwgDYOYDX}0XNW+(hkrtg3SVRE#{XuslhqS0%SFBggM1-tJa}~k3*p&#hA+lAC%RsfHPrS(j ztkk9p%BfW|Vu&zwWd|mXy!oG zW=l+Ah6ls89RB$JJhZu=62wElT5G);g6GFA5kM;wu&l=jn~#_`6+*$D8%v)4kEFgv z#HGEBeb~!UJuyZ89_!a&ULzph0;hCOh|}X4uhr0ibt3>zrBid%eawlg_Fpf66V5V+ zu@!2|J*}Laj%eFVxa@!MA-c_4lej!<;gKL4uEGAVE8LY(_~p%k+R!2C_F4$uw~hZz zkw^QRDDa!~*YdGrX)CN*2mONGLh2h<)yZrNQzXr=+w>sw_m+l&+VK3W^;IQ#i3m!f zG6P@}(IhC1Mhj&T^AR&zU5&wP6`ED-QUPm4f)-j7m7mVetfGQtT&hNNf-0^C4Q&o& z5s=AYRGivlM1ms91E6ESN=sppRSHCO0Mlq;>dn=(MrUXE-QA-1`yEQ><6X%`tY$nc z5d>gmlTY22$?`z__0gLMxX<4fRSe*|fJT{sU(>z$QDYi6OfV~0yZ7sEulW~i=Q~*=Cuy7K&2$TdgPXh{hKRH&H+>44;PNaJ5fRf#_N}*z6RB=D_je{2hw7H`uwnE5 z((=vr?d!w)z0(F~ISzUvo*lsE&1tan%Y5*+*YN!P5oG>ipnCSW+jyoi+sU-YCTX|` zWC)IftPKu1kojoabC=Myf-iA9RL4I=7A-Kay|~jgTG?O`0`_U|v)1U01RtWnxNkk5 zwlIA^D!n@1y%*ulb%7;ahClJdZ@<`UT8QC088~_m<(Yl>gkzhxS#9R-rObx1nT6%O zPNL1NeZ0;NW4~h961BK1&CzTSzczPI9Duj4d$1cYO+t+%)Xb;NY)qNAVc{SNSJ25q606z#_8N9B38S~m_Y_Qp-yc2_Hk&kriYSa zd-1U6sDa43cmm79$RP>16ny&}Bw9|z%23kjwC-*_odmuPqEi(=>`hNk>~YNsCX67x zPi)2DTwS{FvH6Cbw8u{F3m^(8S>n&N(;GatBLZ%czliuU^YY5EAzd$Qk#tn#mGPoz zl0COr!`-~f(xEcuk@d7k>*8Ecs*N$S7cA`z`5@UYY=NrEsq(E#74SyWM9L`+!@&~7 zjD~u5E_N;?Xak`#K1s`oH5@2P2v!rgG;n&98jaXOj1XRPIAG{@tz=^GZ?D%}<9sR$ zsPCA_nasskg$T0;ef!A(rV^GvEZ>rr{*=(EGQ_5fn6ChU$bsA-DZ(?E(Ssdv2rDi? zf%}K53KBVC`t9;39Kd{%@OwyvgO;RKPLHDJA4a`kqsck2J{WI$?P;RR6w-7>p;W(=baADcB8w}Hc3Q|HS^j5GIE^A8mv3zdG0lDRU=b%3uXCRa}k zg^mO72&E&oIjTnYCGyh|HOGYRT4uD5!0&eprYDS_*MVK;dcW@l4oA|s*0+X`#o3Rm zFQ+)A4w`-kn~}m+GoE|mebbu0Frh@Cmb)GPYZLooD5TRtL+?R5#oiAGf;v^(QL?zN zc($W$QyAwUmYn&nf)FPDN7@5{E9lBSc+`feHMryvhEiL@;b8XEm%d>=ig$0?d>nVb zJsj!GHn5dZjQK62H8U;9oS9KBwDE2ezXXxQsBeEQi@w@*az+Mb_1 z8@wYLkSNQiw-AR)+djtNoR~aouG*2@E!IC6Mv7X+HG?YC{y}-)ujs_z^W_T z72fxfl(UN{?Y7F5*|sx4hQWIz-OdrqRm-g~H!jk0)tte0R=H}uU<`;l_GU6@pb$j? zRhkXMRZ>7rDA*V+aWMe#mSUwmA$KWaxTq|7hKPCqI=^g*Tcb6JXEC%$CkFMIw+22p z|AzaEd-p|g1HA-7j*jZ8^TYesp&@)2>sbpye~86v<#t2*rY1{$w3=X$ULYYNRM>2R zAfV32h%C}D3n~CB;?TOl5ha7xwUVx8XD@L2#W1cv+YsS=>-A4ylKZoaJ1@(2>i7pI z%-{74DO+cR?B+@L4 z>0*t;D52M>Etqqev-4p)`EoaQ z+FtsTP4`i$%^dViXE}9*0_=L@sKNFmsV)pVLvl~u6K)f)` zWQy};{LRhB`q;1V=)4!TV|Kj~7;Oz6A$QSVUHPuhcZT$P-+|+j)){NgeAMQ8BmZK$ z)wZRF$qQY+zYX)cslad7^TVLi7H-{VhWYk#AOdn?;`ioB_JByl`gDK~!p1kgwPI0! z8ZKe=J>qHy#K;eX!5cQ27yh*PVcExInI_Z)j_vyG%9m50mLP!cCg&3_YrRwOynH*_ z;UQtlqRA>0gwIYYp;vRfpXN16BbV2dB;uRQ`lwhNVKdXrK-iKG2H1$v^t|iQn~x-m z`TY0*JpKNL0tKs|Cp)b+QvY(OG%)dMnSZ!yuc6cVTYp%k^~7_M4J!{+~i=}qlFLxOs>gIB+pwR(h&Fg;=#7n3k$8^zUJ>vbQzv?t~ z-;TVd$u>#zy%KIXeo7~xRoJmqjGyhAv;3CwG~OW$vKn?Kr46DoNJuHRknn$PW%tG! z5@ib(;0!s$dDUP0^+?89yidr(BHm~v=IY~gw)Ctio8mIm)+<$(~a+;^ckE&pdSA3NWq76zY$ z{Wq|#uNNK*UrnxoCzqtSgu{2nEmU3m=~Z4KyR~?S>*vY(SihJZ^Ddxd=kh33XBIXv zxEO2Q8T*6zKbcSp>gti^PVor|igZre7?^-rroScjun+xXH-0+J(btGo&~(5{Nh7Bx z;n5Letqp}VYyT{sTt^fG)Nmb-V#Bx{-qZV1q)EClnmC;)qv#(#a=O^Rcd**Ko2!{q z0rX#!te6!-LaiEejnOn-{NX&A3<|pY*T6ynRUS~A35<(0YFy0qtbApXQ=0$NPGl^0 z0JhbWwnc4ROdPS1Zo=CQ59xiYz$c?NT0lPUvX-wDXPM=2vMrjU1w;qJtj<7J7+lu} z%MD4QPZhuI56BOGlQc(Y@^{+cgD0ku3oVF zEhzR`42wGhIaKkxhljxBxw*CQo{jAo?Kgvjgk|`ca7fZi!^s~Ff4gy7zD;?NU4(Is z{R#o=CI7;3Y2^qivGT}3MVHF*()3Vdhh6*j{ku66Tv|FJIYgsosb7>eu*4P2NN!%9 zruf9Imr8tkN+Jrg*rt46a@oG#=ots;=__YHNr|Hlj?n^1bH)E($(clfOUH*L$m>M> zuh_K5rB1Qjcf4Umcs2e&OFi;k5}>=duJJg|3acC1`OuYf*>Y&Ck8~l~8umB5QV%Sk zR}9nF zdg_|5e|7EsX_TZhwVJJPkUUmXZxk;PzCSYNM5uM1`yccAM@V+;CXd^H4eJ%H&k0Ks z=s2=rP>e&Q1r>2N>V>YbUG->|voF{lr05Mn(i4=9fsm=$n^Zz}ijg}0i z=RjL@>x*Z*^3dU~+iM+9OswraQjdSpXHoQ(l2l~Jto~K^C3Ab))6HjL9S>g>Bl(bz zNF{ti`bC74gOs_DuqN02-?RrIrUMj8Lzb#lladkLtDy7T; zMr0>PCAvVEy$LP7qBQ)vMGJAdRBjG=^? zNp%YFf_~)42*I}ut~!GEfD%iK;iU&$T&%foxg9~!Hw6#dHzQ1s)ZIK5ZYn(Ql?<$6}Hnf?(cAP_uhNh=jyS4g9Hu zM4A_a2bdeJnaT*x!OAnDEJw=h?aC)l^B-ZA>K{bwAp{fzmYJEubKEriX41ODcW7A=dbqqD{+m z%jZlkod!j`s9#JF%f0zR?S5@NcRmdEq}JB38)ak1vP1J-ax@d?k}M38`A*hCTNW z3)g%4Z}1QVmmghxwK#}ne%$Tm2Co#r?Mze?I~atKwMCF?>3-c8W&Qv542&2pWKm0A zXAZm~t-sV);y-qqD76UQm2ZEBBA;(_iJ>jdx{l;8e`6MvjT?wInj8xUDPpNf)5A|H z5(NST`Qm4#2Ro%K!t@l)s7VV>5kl&(5lM#18cy0r=acIPsjCA-W5TiY6~eU>ZC68} zAa|+dm48_a&Bh|(St;q;zg+f9%%zS)Jt{3Fc!lk`N9&9k9Q>OBacITISF^^$lfg`W znUbqf5+V*t8@W+7uF06Ss~8NZZW0!l5W?pdC@LRM= zojoIeIJRlUF=fR~<+u!ywU5kU9ogR2tCboC*K#7Rynfa_LjIX>fTeiA(3 zQHyF{DEI~hncjzLmu5cLK1S;*;ULid1E1x^rB<`oB(}>T_)r~Yz%sHaT$&h?I@pCV zLtw6#08A!2%Pyh^ZB*eVjfl#YTg889-AKm?h{&~i9N3hwT!0W-A-V+@B&Y!lupp8- z$>q*#`_VU0I|q+JD#*fM+!P>Y;7)-NnPo5Pg}H#*3I7*0uMxKRA}GppASXSLu(x=U z(E;S)1ePQ{P(RR_z#1~3i?0!(H%X;-1Gb<;kR9R#IO%xc4YF}EIF<_+R$veq9;>)2 z%$HYRncLoKhbHiOsc%DZYC_|mP%Lgh`lkU>ChURrMsueY_R!Q`GfxIvqIe}$eDR2m z9_NA^mD|h<)%3z&HY=|Lu6Qzx0M}j*hJyiydQ< z-v>zi8o~L3Gz`ubU@;9l)IdCdDx5l?hjJ#AaIz$Q)+ak&;4m_dZIHtvMh1jComw)G z1Ri~uzGg>tC2$SF6|7*FqM2Vn2)P*s0uZg;789=ZSVz`@wcvrUd;r^nb;y(JO>*A{ zh&+8?Nrgc*rWT9QKk~c*1n?iwo#b-n1%dfaguJ^A4YPVW`%lrEQ}oA5SkGqT$}y4? zv7x=XL#lkE5M+u+!wu44pWLRA*8?BB1YXIeK9G4c^qoxAG2v2Osr7&3xp-Il;Q+h` ztC;&mW>D?mSdY2!Fdt!gGYFzU>bjtwsAok1lTbD~^88rXZG9CZ!y=h%5{vp?WTZv? zwPG{WAe!rW^~htSj3XGDkwV^x{JykM`pkk7p<|3EsyAyyRDI3M!01S{NGsYv*{GOn zn4PMvg%mssIBRK!bkzU2A%cP-$3MB|Ge3FRSggFLR%Gfl)WW28^jTIgLOpHW&!FY= z2`z6%bt#(!zv=D85x+XnR6TZ&cI_L0InQ?obnFe(AP3zd5yazo{``C~AYeU%lGA}I zhlJm$;H}-pZ}6!AcjQ?5*=&dsF57B>xltJKjo6t2a~^a1?|^~>4k%cuXQkCyhxT8h zr{3iVnO!uYn_I^hk#H9o4H?40j^@B$l`2er+_{6pLZ%Es9{j`TY~Tm#$geLWFAqjw zeC0lsBgn&6_d9fDrrc@rsLDX-)^V5dMS~cmq5d9iwbo9P&PF}f((G)Er8I+@Rx7d) z0Kde*EKnGfB3>PkeU|&3g#6OnL%L|VV}EWWNw-5yc>tkcJxjBIVnj-vX0JhvPw~h& z!M%F;szjqr(;#wc`Hgjg25xEiLUP&2`Nt^r{AGm#<$<@R^HyTPnDvgp^vQgu$>v zu2C+YK@GMjlUYYgsaoecDd2H21-y$Q_fAkLV^bRU^D5>7BJQ| z22o!0;I_0UsKiG|uXUsG^2c>UJm=-u7?Ad}f(j49{(uT&7wA17l*UZ;gylsdDyP7U z8>u5jD^U`yhud=~IIT(?glv)#S5-g*6GeKa0q*;Xwx{KVRZ78Ps%M89HC%1yctu-x zD5D>a8y8N^7TR; zvh$G;Ju}eu7 zS44AhPH&V7cRI0QK(F&k8t=D-wP+N1GrI+67UuJiu=RF7lps|Vl7c_-Dn zlTEqWeWrdoC9O#%oftSG&z6)a2p9#tbVx;7#EWCdk-7O=xQE8sXa(w0?N_dvBm9Zh z4dA<9QB;2fnAq-TGdtSsww6IJFART|b-PL!J$hMVv9g1vC&(6?{=BuuR+dwi z&t1@>DyxX96v5AN238WZy#WX8jEGBzeh+iMprE+m> z4t4roJJHf-{l&Y-sNMM#Z+nY&07d5dbJln2%(`hY=pv0nDkBC+T9C4YrY!rl(j0t2 ze-z_7&oq?ZB|v!6jTB{odD6b6GYVtA7G8SJRlYVC%~ot-I0(la7E8$TsXknE!0cH& z`4${up@Hc@fM1h?8WydsBITj;Q!F&)D>Sw`W0L#9Mp~F6elAQ9jjU3qCloCi>_Dw@ ze|-+R@(ToWLxHO}qOB#z1{D(Y9d+|aoy~fscPyDEk=`?~dYCGslHqLVZ#+o`yaYBr zpd}^@@*U+=&#|3)eV~?J!2EfC9_;?#Q{)QUwyaYWTTx~d5uOljE(6kR3DEWVPCjA_ z_fC4lSR`DJ^ufrUjj4zJ9%8eSy*vCd6Y&`RGv|!M?c`Vi!WD-2U#8CupU1v|7vp_P zB-}l}NwINo9NM&vO--*H`rE4u&ON!6eg;+x^&iDuFXvfcKWEOsSO>XFk0h{a)4LoG zZL)uwMi-|GPi{drGJcTgyk`3xa53yT8>u9tI6b#*m4dKBPYwU=xxD3KuCiZVB^ zWt;4Vv#fA3^X)Vqf-Laj?q(oT)Us~eGSp?QuDEVHGNb(&^%){sMf0<-SrX!eh!-j0 zL+?2p9UDIZ`6PXD(ds`=C0EEJ%v0q_L$^Bpt34DYZaZFd-_f;P*IF(*zpMAX(gDZh zBt9HTN{+ZYJ;kmoiOPsVQC(faz<|h1&x_&OF4Ay~eAYfyUgY|Nr0?JG>Mh{8nQ%1B z;_NOt1ljCT4R0Mj#rf0 zS(4MTh)|(W@0ClThCd-PoGDHg&UIKNM2Leoh&hS`YWWFqrQ(Eymb?p14i$eV20Nin(Za|w9Z7ZvLQ#Om*Nuu^+5bYDz59wO@K$^-jYypA&Wfh#em#V zK|?KiC18t?_&uzTiUQWc@4vk-03c=fY(-k;FP)=8%^r&(ZZO~6R)FVK4g_DrSrFIdc{vOOYBeGTxx z8b*P{6~vl+XAKpVpel0g!dCn47*QKHoyLkNC_F57dcN0i8l15f%kT#1ZS%#MAi>bo zr()Qq^)&{;P-VJ8xqTkfSZb#;as=q}3q-4X@|-@5F|Fd#m^e9*Zy{N|zAQeTWW#v8 zEP|-}ZUZlMKZA+ux-t2AzL@)NQF9z3YbQ%Z6v^$?bL;6lzTR)#taW^NZ3!N5{A6v4 zoz_$TTRtOD?Y-wIR-cfPtN6$Ogu;6?K8zJ4WocVyWwKMda&uj`eZ0H_lxt79W}rfE(VNSe5TBK{}e-+%s(Mjn1cmi z(!B4izAWdg;FRFA!xwr`pvl(e(9{}{(TyfB z87Vb}CMIMiIrIk^=8!h>_*iwA3fJ<(c$EoxHu_S@(biR5WJBox^#bf?t;*dEW-x)n zRuMm3`gypRkgcQB?TjZ^P^K8yg^3cbAe@+v7#4`*lvY<3);n^$>|&Zeo3{FqcuBA? z-CU8RI4K(tg@nwv`e^Wpf4pHA!zaw(%Hm?}bAC16x<`HYy@nBt*jR1C^1LBvf8PV= zubZ;?^t%t|c=IyQQBsi5Wi?LNc)yP2a2C}59`Nh&e_)z#J4*ujjR%iw2_AB+JrLif z!sEE-J}lRs;8y4z+qq*d%W>!}=EdePLKT907uM#jlQSCNi?k(g9NV!s8!{Z%epUK#5FF)tJmN^1yDqVLk$mGD*!8;1mwJ5Y^F5b2s8 zFyh(Rebh(9@4W;Ne_haZdVNRHR`F(f@%x4&Jvn|kt%rGk%>fT@*^_!~Q^+{s)$l)Z zE?Pi1jd~O~xT$D7qVc@X09&#k?3ZI1xmC+uoO1F5|Di*Q6?PfyZxm1kDgFA9KKIa# zJ|5W4k@_dFl9CcVH8gT>tale|Jx~l!T1(i`G~Xk4Xo{FzJraa-F^(LFEm(%p1xwV0 z2t*9`xA$KQK3wKhHdfMJU{W&wOnd<_TAVXjMij%SLV?;Ai*TtGuUpsFcU-B;^r}#l zkr@Tt%xxTkuC}*6s$i6zEfXajXy3R<{J6yMk@PR|f&It*NAthxC%cqTEGZ<#->@3@ zJKz)Q;lsm>P#qq^InzxUa9)xtP{e&=feJ8_=R;_Axy|`W^&)7GOo_0ZVw4sQx%0;( zXb6g03St`h>2DIz{?baQJAWAO9YC}kcO272uyG*8ssOl>4N{CzBK{ZpJ@t1bXZ?sx#ES2PVYm|Z7S|G`UIvKoqiQkN5tR*ld!b8ke zPjNWIw!X&#@pRGdnd&?N7E*sBLkCU;l%A67vIJ_sk!AkkUTkL43rPuw0d0$jze603cab4gqcNz^nFQl6_mJ`8CbbBUAtNR8QeyR&Q zLrtkLjw9Fd){Po{rt)+NLeH2dxYHOx9C;6nNw=pq)ZF)02_@4Xy$@?vdI5Nh+l>Z2 zC3JWsI9nqx(hOmQ^DuVhK{Guxlx0-ZQN#6OVna_Xt>&~=aDri^Ft|K}O>j1wRq4*j z+x8}$2+GTkD}P~*kCT0@)Ae4A`|lC)@fL%>~ohJK9j6hHV@2imFI01OU@S=riWXbg|bJ)6u-jJ}ZhJMwv%;I$tM;d{6s zj+-(R>IQxt>r53@3%6aAde`F~-;acqFcq*xVrflDeXmOYyq#LUbiW@g5n@80)zH)1Jbf9*ufkM8R3s;sK+ zs?0o@2a}ZCkQ-|5c2d1TF1-_2o;?!^Z zSSI_756#Esa6}};5DjoS(K>MYj_st=^9L5&pFH97@7YgQK!!u7+>A&2?U(-e^RIm= zz9};B>n^pVjA;-$aYFldEQ)HuewXI#9y?R*5ooeV_v`Cwa|v0p2?iq$+dV(03zLU- zJGfOA%Zb{zx3c`B!qM1xv2Lq8T7-x)cKKSGl869$lNqz+=5enop7Thi-L={k$47N`g^TMbr>hf8dO+mw?xtz5TKBbrS^05Ud#gnwRN0z+cRD=B5bd{@79Xq8^r zDG9m#=j8ZvN)pF9AF(Djzg!*t6PJu_7HN_q4V@yr5d5k$IlZLT3x|P zrA%{^g3)?Zc4hU8SG{W{L3;;O|JL)dbJ%j^)%YiOqYk=rcX6^zYHOYm7Mx+}DJruh zB;r@v4eWSRs0yR$g2$5=T(wNL9MtSLx7ji{;XdxaCd&$Z&Dj+HsbpW1<#v%hwlf>P z#_|aW!|>GO(0Jl7oDkoYA6>#G?D%-jdCWN!|MY-q+R=bvv*+>VYDt*LWbDxJ-Dnm*bF{p@qrgIW{h#is`>Vfv zsce$DJ+=8nACd zeycsmVZ1{!FC(SZdZB{$DGXnab#_MxG%JtYs?cX@UO=QBcW6RP={D%kdF==Yv^jO^=@lo&1Vw_W8>f7l^BbzPJmFh z7dPZE)gNEj$4u_*Qxl?m`Bwq1DeO@$CSNht*$<4Vnz$%j2Q(^{h`2sgW>tP&6h(@_ z-eWa%rq*cSB=sK5K*43A^z%9q<5r0;rnk4B(rWQr^5#^k%mW|*X}@KTvgQcj)w*@% zHG=Pl<=5r`1KTB#AvEP1sz17}?Q;#+*>=oXB;SHLB7^E6dk~KfFt}P=db(V1c63@5 zczby3@pjp@kzvXV&ddrJbAn4DVDUF9F0E*Pt~zL#+H>m?3RSGK@%C1Gq~9O|Yvmi9 zubz(B_CJy6IDypIe5sgDpS>%gZ%Bn|UyAK$)#Tv*i5p4ink7J#$hG?lwWu18{j|As zm!1WBUy>aRo1S=d6OdQZ%(iR`I5+XifEtNZRk`xR1@nM6^6i6xMCXjiOq-aAw2aX;7EyL8N0vLGg zfr$m|GiNq#3^5vh*6=bcD1x22UM$z+Jl(GCY1uw+23i34`_5aFR zuVL2AO{4UUyqBC*kU|f753hHev1McMnhUaa21wHS0~8Te);1qGdI)Mo5{%coWrD(R z5RgM72uq7u)|BM9e47JI0;5;&@Ib^^Z064n;zMr6D<@tAT1pD%)C(ZmQi~{k>-R7} zZ*B3*(iHn4$@jLpCa@7md~awI96{c4Rs1-(d7(%@*xNZA7o*2-#yV8oIsN~S< zhSl1^?&{_Z8y`Xy8%`DLJdQ~$aNHQNkx1W8W8+(FQ2=}c3Wd7PiuEk$L_XTEuf*l| zg*Iz&GsG?w@n=cr_w53`^+t+O)<)J*y2dC)zs^ng3jveaim}cVRiVEAn)>;h3(FZI zP3C1l&)xCm{^(15#88fKH=SW70@N#6Z!KKg7wBRp%wnedA;vJU#RV3%Iq|DM*vz05 zWCXTweEpR|iXZut7!|G!V_O{xTryn%X4aEo*xOfb4Lu4KFd2DIog_wSOL!>WDY z8E(*lj;L9~g;d)@ZDMk=lD2j`Xp(kWpvYpjT2BZ8ffxBmT}7pTwb5#Z-G(W-!Yucc zS0ohKN3xk0tB?7MJvaW2?TZ(&B-)I*b0~lyPJ$fV zRB*mneT|(YO)oG5Ut(fntOU8MS2nl}x%I9{!nZ`D+2-p>&gDjN%ZLmy%UJ*X!=WPjEBT8xuUFuzv3Hh`->0x}GQ-ZcSU@f|B`b0a3OKWea&4{6 zH)Z$K%kXFm?9`%Q6A(L(J*KK^Y=7Y;?Cc*c)E8Fi-p zEqiLX{RdP@F_sf*P)%IkEDXIY#8`LIOb!Gj>L03Wf)<~pEL!mkvO2yAFA)yTHbrGS*6^R*Qx#MnI_g>4NUL$@Lh%eZ&Z@c#F z;O6Jej`zehWHC(kCy+n0Yz~QIZ<8am(ZX)?H&~U3h$t(et_!xno=_e@izv&Zew|`h zsB0>-ARB?nj_1WCWkEw54gq9WM3)h3QHInii_6B<$~yg+(87-}NndUXW+@$_AuuO&(k1bREpNJxSsWO4%fD4s ze$^pm;=JRi#LBf7Wk%Q_ExV?^)cBVUOt&+_JV=USy3Na~Qx@5w=D$oBt@JLXJ?aV; zBcp7|IVpjOM3Xyj`6Cn2-eC7`K^6uZ?Vk{Y9##yBe4!&hbbDO7M)$^AFK@b@rQyVz z>vH+QXWv8Uss-aeih4GDPJHzSe#`fV1@#?y#!~-t7g%=D(&&m@FZy0tMp|UT9%Eld zv!We%F`g$c6~=(arM!wQe!oBKx26A52t~8rlC~2ehN$wD=lw{CImg+?FAZk3w9?Su zIyg*{HDV~5O;P-LP`0uWN9C`O`sko+28~rz{>uwe-p`?UYe{!AC*(oTKAPA10C025E45z=a(1& zpfyG+1PYyVWj*S4zCntO=50z2EiJDS1BBG_uOQ+d6;>JZv4~^&IDPFcZRizV@`>Vk zwUjv~`FLJ(a;HBsSf*iX-Fc(I$hMy4+E*~mT+T?ES{ogeATkwvKn>=QcRUQuxxRtT zKW=QrCUc_gYP%MG@q1-=^I^{Uv4JxzJM=gpadv6IZ;Zhvv7hYNltQyyBuv~a1nD>n zSF+)H{--Xz2rZ+A83}#vdx5DJw#bCZ9u!k_hGp2inj)@kf#RbAvnL$Ryn>SERFe`{ zCq$aLt9~n&W|u$W1<^l;TNqqTi@ENH8?@eQX46POh86tMqJacjL}Ep& ze<}6ywZa^S@${DyF5BG2QNyiN#d+&W3fu}4t&%EPLILSd!Xx$cSn?k@J}|qN0;s*9 zm6k?-nUF=y5n}aXLk_OKUlqh(q`;TqrWfUwvSJ(F z8d#BIFk}QyJ_$g^w4t?H3qE$$ge-mjC{Xj{E&X6;9iM2|S^YNkPlU%-32S8m9UGiG zxOV_lGC?q|f9XDmI84dsLTa?(opdj~sO&xZ8vD1^UaPo*$5&{VwuwkSzLiS!`bXgO~LRX z`Tgt2?BvE2!X^$hF4q_#GK3-_jahj+Z3N#OWvv|l%m$>pHRpfV5W22dKSOoW5Z z#W)z!7ZXHO8qAvcoReaWaXg0jyMnlyiC~K!DKxv1cB04NObW?BwzIE$({|>Jf@A&Q z@4G7g%|{(9jilC?sGKd+NmEEkwOzkStK?~d^yi;d>fv}(78)gzQ3tdCO6Dh{fY%S49c#Czl?aAu&QUz_0J*z$hZ2JwhC@rNJeGC;jZ9dYc z7U}fchL40|A(5}pb-MufcoFKC_)?phU!w6Mo(>XZshcE)I`ll&p;uEJcfzR;8TTP<5;YBdFmf4bldZRY0xso%f!JG`J0B*T9~ zU(&TFB;)!B3}xgA@Otaxd8ng%9*EK#%8=y;f z(f20Bi+@7+jL65-+8BM$=uDr|lpNRu5<%XuI%vHH`dpS(Mt_R|6$mDFr>*3i^?Pzs zS}8016>14a63uWs;kHNZI7i^bu#uYOkM1l*aJ}V#GM_AeuFuooA-BDCdIc2~%!-2{*bLvIe`bP|hm+L@y$@s9}qA$Rp4s;BTFSPe zpR+V`s)A|?x1e09T)QJoBZ#R|0q9B z?)jRXNMFM}5pYCMcq|64Q|hsjas#6Drlc6>x-(*2k03}a7lj+Fa{E}g zE3w8}f168YK}TRr$+@er_B?#-!Hdq%IM8*YePxvO!gEEUG7c~si9L{$sv+O#u!@Ah=c4rGQG2Kk%xpqvXxHVo?M23S^^$p(nf!Deag#7BOZ)^s zT?r`MANh7I_;49YE?Joka{>oynsLc;=V#QtyBCNx!O>abE3B_MB$5MfYeAnEZ!GBf8hjH1DBA@{C+RrZit(I%>8ai{eP=n{y!?Hg&=%sehfKLHtBu#D z_ctQ%?z{mk=mgu{9w5{1^t!5GZNMR6dY=eW6$IDsz+b{Fk&NLw71diSp$Avfw{$an zPMxjkhmU)2M1lQ;i>2ttK6dYqDw_fWQmDrWUJB`^$Zg|Q4_G=TUF$1DzHkS;x_&1( z+1~dcqRo-_pKT1*oow~7kxZ}2n*xu5@*P=YBdYQ@IcSk&Rp~wRGO%I=aWDE9%8py# z3btH+@uznut7gh!j&OzzAz7C`Ulue>{7;vbR_`_v>Q!qjItgx|fg#M_pgFwmOBX{* zL_~p*xG>a(jF?yL%IIM*{s4>~&@3SoqS2*l$|fd^$sO7yw}$Qf`K4MK!Wu1(IJ$?L z62TU{;0^gVNVkF^6G(^sPG0C`TD|o|T&NcU{<@}_`YJ=mS364N)?`xb2Ba3cYq&?- zo@I2S)Ldm2Q7y3qjK*ZYZEPr%%5U7X0S_mI9vv+^Nb`RZm6A*H1Wn^fhTxz@&dsr? zzQ^P)*%ek)M4kM`bWzOGwXLM_0TE|2PlINLB0}LpR;@z0!`%~qul4>RCwF%4c=txX zhH4rM6>pRXBE^;?^38z_T`QV|5UO$~;*U)S;c*0S@<65ML5@*nzxB0;?K6dFSZov88+GhEQs zW&cWW$phv?L<-tg>q+3pxwmTog{@bunB%E{;HU#7=6uCFeGKX23Z25ON9rR7r{?$J zs8D!3tn{%^zEYWpxyX1prOhXS7tiKpyF-w>{OhuumZf|j7M``OGCRMnkZw#!R4^eR zp4o}V@MS8N1LXp_$|;L>PVgsJXN>5e-&L!2oh?VqrYoh{J#R)NV@FUV<#SD--t}9h zoBg9SU6?wwOoj(p^9N(XBhgcs4Nj=TLLuxnfWhbjGDmUl#?7hhk0BY+njh8Uc$$2z z^^Ds|p|;;HM-+o!0Pw;))h*Jv#^nXy0h&w40ZME0Gi(aW_ZN9x5OlfB3js&MsofL7 z(47s7e!^CKO3QBcYg%(2vdyx_+jE&wt(xE9X|<0SwPt^_*0)s7Ta>rwHlyPo8iVb? zi-V0%MyjZk88h9ndq4ijnaK%n`%ePCF^==4HTQvQ6~_A>)Uy9S7Qi#zjL;`1zS1O- zhHj-nqPU1Sg)Am(Ae!o+_C5>fv3JWGlH-N)BRT|$$fw)vme9ywQ|huk-yVqBmA)6Hg~vNtA*oUm&j7GE@-6+=GQ*|@yv zu2^ZGld8|Be%~_D_1bmn-R7Xz#OoPe{yiEi_;x(L%?)8l=YBoI<^GyA1y6PCblW(z zqk9MCwl>#9pgH>%6r%sdtSY3hHeQu(b&5;9%YW9N%E{VaY9F?`#=M(n&H0vo5~nTQ zqj_^d+e`?3GG}DQLzLe0oJBC6Gmf=Eh${M^JgOF;h)%q7`dwaDBf+A`Q{6=#oMumnrgR{ch{=uE_tH4kj%+O zu8mQT{6&ft3oSfr%Q;mo{3wA-`8D=a(!sjKV%w)5(nhx0KB0=!W@v0vk|rPT&5mlb zE*Gmp?*KBVrE5#aRbZmU=FirHmU*pAGC#oHRbZo2H<(59+8tk2_1c|(lgVX7a^ok_ zfF6_sCjJN}8w!aupvL`T-CJQcvi|b}yB-jA`@uCv6Ul9_YFjKdayTvdZ0^bO4IH7` zk#9G*`NcJLKz@Dj6z?t5`L!$6<^I~ZN^?9u80k*n(ONFm6>TWTp4KdrJ?NzoR8m$> zrF2Id*@Uv&%XfH{q6Z*pX-ka96-pR9J{LJmsCUFm;z+Wl(~@uW z#8&$}6|Bm@I1H@r%p}_9D}v$$Xr&cTG*`d z?h#HFePuT6*AD>@O%2l=Iu0>}Cb-{fHO<4M+W-DLAkSDNOf(jL2q0CClRU3f(8w5t z2+bOBVSB0j7!ZGAWsm=6Ye(aUvrkg9=sldb^JVCgdPr(9@imQ`gs8Z|s>73^e9*b= zIy$HSDZJQe-@|D5m@Vo$v~i&#WH(`Vm#mgf0J5IX$zsHfbuy zH!wQ8RJ&dzr+TH^UXDL6_Bu3Y**AR^qw1q8qt*H)9G~r8Mec}rQ;7dcnpN;Kbs-#H z+vQWVAjLX=F}8N;jj43fheoHt-?LBT(!dCZ=h;l#tB1MM=Y>U(L3VvbFtV$##F#HP zZy}Kvu!SN&UhueNRVs<$I1vc$*Sx4%Pp&?c(-@*c^p_N+c7g7BWq`3#ylZ2*Rn5Au zV<^C|zksdfq?f$oi`|C(Akl{Z;;O-0ljzWZ^a`%aj^+!66+!6byxX->Q;5zJ9@*%Nz?QQxPL&LJr;Sv7haJY5E2}FJxOE{%rY$PVyqk z;oD_h`M{=^Lcz!kT3dk@$Uw_12RTSoy^TGrOi|nFfmmn zHDMyEOh=NzuJD+h`D-5c;q6QfSTtF6i9uZ5G$*3^Lm!c8fT9^-e}|5BWK=M7@>Hp_C*gWhu65Sy)jFdSi`TlQ-*=+sf=T zRIf3oCf;!^#Cf#wF|frY4Oz)D&zDXE;zZk@p48Y2isBBEYjL@5x_BO&W~^~Fc>1sf zommr5>}zN#lFX%OEhOi7m$6(g?8S^Jj&F0!H0sTfKrs`Cb3AVLc3u|9*)j&cFjZHM zx=&qREuTrqHw1h7s$Gyg#7_7LAua0LPRh!2x>@fsJWjZRb`Ue1&JPHmvo}R8_xC2~aUWMvSWb6l z^m-@z91lSw&UX2Ux|ruw+?#qahnwsCCsR3!$w4~}?Sx>ntHeJ`t?KqPQ)^FZ*`5Z_ zqh16_7MuS-1mBXwDIn_-omu1^E1Qs-qAQ0b;PFP{(+_M^;qkuZum3JAz#unnO?jQoiH`L)?RavC|1jTLFhvHakS~CoAk~Ht zo|uk4cyVOYtA@_XJ673mz~^S_^Q2AE?-ORDE5(hpuvHkW1OyAG|0jTkrt~!RvXC+f z{h^uYTNBW8uqa`te~{%=c&YE$s_DR_+EDtilmN{=YtE*jgWB^|+25$No1ggml)7UeEq| z@9CpYUwqSj)F2CeJwb<*$7MEh!-nV(yAnSb7b@A_v0Ef56S}=iWl*U((}@J(BPK&y zd4R6#T^*p8?af=Pj%8Bq7w$6}9yK;*SiX1Bpd-16o1FuUs%gsb4I2M@oxrSh_Hy(+ zDw{KC|5N*0CsxKNn7owENQaO)$V>P zyXJBzT>)njw}TYB6B~zjLS0>1G+x&;J>!C2UPupim{JOir>KwNxvlpyxOGYPEjw{P zr^4@1NR?{TXW5)C))v*p*UA5=W7m#hzrY5h{fn*o|KV77&;P@&YB|6lmQy5aS809p zZrXXKC4I+S;nX?=xse8kCsp{GvCz$j<0r-&KgCBGi&<1u6?L)*_gX6Z3dpVTB|0Rq zvuY*nZt_2jbInVD=MM4BU8RcJ5d6X)WjsLKG^D%h%=p*7Zm_@7HMx+|<1&t(%&xq^ z&?a7RhIsX#_AHsMHc)o1H{#VTp*lFrnC;=>B?fZJ zeonW9O)Uxj!>T;FDPckDK@JrZAcBF0!X0m z7&pZ61T4Ezvoq94_x1$W zg$liB$no|2{3ch17$fURII%;YssAx6bbQWA9E|zA_mCXo_m8?^kjhsq+_5=WLMx>= zwxTJtM$(uORwVwNI_&sw%TSkCI%U1GxxM*t02~DC2!J$mg2In{Sdw5g=gvJliYNsW zY?eS^Z8oW`P+_b{mB!DP6 z<$jJChLXBF%xA@&)AWGa4JZ;JOm%JQ4t^KM@8-V!&I209g2v{?RvGKdkOF|u=Ih4J zinjfe!&=kg*fjc7-c`3}a)$?33MQ80lgl>=BDSotVnl;}4>boBTg(_RPUSkGYKwp- zhipn99et`j(_&nBt1Y#c9y$~h*sRKPgDps&(l>=Y9Ba_$%Afk>FI^0zw~6=1 z)%n`X5h-r{EL;O^7i@9-ukF^Q1{!faKpIQh8Q|o;GK1uY-o*2YsQ24d<=UGHbRQF; ze@7+cgf?w*B1k1!-0rZ+k7>2_aX5bFMO^*)51tQln#^`7Br~7XT>ihg3=1=)jR_vw ze@)M8zp_RSkIJXaBHGgAi8`XY-n^jS&9tX#ZJc>r2U!r62;8;NcmrK6E)A&U%@WJ& zUx4;yecU%@unkpx0gkh<$c8o5&T1Xh`j%cUa@RXYLu4O zmr;meWH9wsh^*@nCls+soO0|?PlD6%q{;}dK07$oUo44HNIZo!x9jl_0?-2TyX#WS z>gxS;E_F%NYo|{K-+43eWm%Ie5YQ2%r|rt4?AR$H(#>W~o-dZ!FG(iG;@E;<8ea+C z8cnz`1_v^>{r%?0kx-&6_szp)g*9_r)u8}c?4Y&$mchnwV!av{$u5RuwSbNiGQJn2x6bR~g(EYVYkzw2zQ=Zo4w z4Buq&5(1E*`gr51ex}z&@I1EnVJ-b;%wfR_J)xv%Y>leCQFACRh^^ao*e!5;R+hYP zWj10#OsD*`R?$wEU1?Y>R)jd{&CatVKAJ5YO*n) zRmFvo=*y5 zUG2nzbjem{YD$A8e(zwHa0?(OBHzljO`bcxTNKNzOSrgj)T&4QB>rpDj8jXCd?vxs zb69*4%z-62uy30Y9dsZ`GL|rVPy=Zvg|)#M3d(DFD|mdke75^DSRf~j&6MVN_3;Ch20MJ}^Cjw(LUYVfLgWg9w9-gHj=vWqaq@;y_PpJ6> zHmjz5@uhJtrVPtPe@W=y|InM=h)%cMD%q`hzl9F<0ZfmLH#WhEX#ZXi)xKdIn;Xwz zraA;fNB=gFpIe_0{j?V-hClfcjmcMQ36U0S-xF=kraN3AQ8(Pl4x{fc;70z9 za%%CSvscM}>0Q<2B9r3_=^W*1=XPU3dbLO80=Mp|bk@d-zSKYbZ6_V?d2T%L+P6Ny zeX?}z?qN3*O}%fijNkWj^{b%Q8Tnnrqx(s;3wZ?Rzr*a_=&8?)$SlyZ5?@dn)A;re zSnib?>f?8)x)ALLh<*HS3paZG9&r>$XV1)Pp_iyBUEj!s9)IoUekcCN{-nEVy}@>~ zgL)T{@1{;4RIjup6}0-Mvph^f@0dL~FBvXihm1Z^E=Y{N?u?RRU9wE?*9hTg%|@ub zx+_u)*BzP7@b}8VSsVI7UOOn*q6YN8)4SvqR2>kLvy#RHy+OHI@VF@$Z#Lk?FPUI( zWd{>1GtR8n=RhmU|JtEX<0W8d3OL%ak~f_+Wfk7JZ_rj_#vEP>cG}>JFrK8GE<|na zIyf{1b{d59#vshS97<#MX`O?zLkWhR38}W((2lcL9uT`sKtQAOwmENAK~M)GmArc; z;L69EGkw`+?76TWZ}O+;BKxb`2ss`En6w8+{WKygwUC8nNb+M-;>#ctQvU~T69D@T zB8PUnPiK~K6cl=Xf;gzxQ|nt#=6k4-)nFmuKu|ysMTv5 zRdJ$Q3N;x0RzoyxLjq0`UgYwCJ+`(Hu= zXa}}%=zQ#wmUqTlaWOE0ZuKfZ)Y+kR6@_%!SE21-%kw<*(i(3y&!#0(0O{XS56{1? zn^$lvzxJRQF|{8_{|CBzMgPA<;r&1QN&YW^d{Y0JcCVCs>*(pnRyk@i!LxIOOcJe* zo@~s^jGhEP^2^_{GFtFYLDc~5>o55}W<*Cv$KlDz4Z7#>@~|&|f0O>w)WmIVZ547= z1Y-$*DC_FVkzRkEuX`kFFZgU-U-~?DsA;J+YFaW#&hL+I{p_zvKd$5^dNd3>CjG(AfCB&qe%Eaj4M$jxJ zOMq5BV_8B{stuYaqOSL4n}?Z#C%$c9$Is?**(PudSj}yCFKPJwXKA@Lh!e0I<*FQn zs%i>)2t#%n+v_Naea0lAEQ<5BlQ#S=45z5tCy0Rs^~=P1%0;IkIrIa8r2jW(MK}eR z8vAVdmzNjcm+0tdc6RnHZscF6Ul4g_GHsq`mw{2t7iuW6mRzoVaHO77X>oEatq5t!DXrf9=jbsD`Ui#baEDWjD-6Ko@M zE33XHn`8zp&Mh9Mj=R}kr#7~>MU|CEe?=p)W)>I4=&{QCO?v{Mf6}xTD$(>ZlV?oS zc|SX@uC9UyuQ&-l;GdEoZx&_B*v#~Fcea4nwC3FO^p_~_nEhz3jW1how^Kwjp24Vn z)tZ-=laq2c&-|q-CwCO%s{_V-$G%4=+vl~*O%uJr-_qF3kiXd2*noRsdTk9c(UW~Y z{B0fRmLOL=qdB*}F6-pPCPhOUC$WE!?fASgY66yJ-)!>{R^U+KBzkCOgkUMWXcjYibf{m2AA^Hp;HEDF-Rvl~N0VuV!>(=Bg$DSi z_)GwzG@`i*U*tLr%s@>x;3Q{ds^wpn+gz+n7>l$otZlDqZ89DnTyLJ={vP5>b@GxIJ(fp-55DE#Bp}-t6p%5A)s>GD=%qTpVppQcBvccIKVf8Hfyh!wp6?tiWCD zkC!XH_UU46pYvjEzwGBxcvj#X%uH7BOt}PEUGrD7#u!DF-eJS=fn_?^S;Q8>4&eqk zN#VI(Zs;6y>^ruO?s-4AcZ{hg2VcH^X=rXnhk|fAoUEiDBdpA2CJ8D@HqfzMo1Xr= znBHi$ROfoG3GO8mCC`y~isdF*-YnDO*}{H9mTdPOc(6BnXrsf6PDFn{H+N&-tKKFf zi_fjj_x(kR06dZDwOj0`osbJRIydPG&8@A;aihT;*Yf}U^AZg&)>^@D$Dh>}0z@6V$>QWSrWU$;Is~whh%)(ze`Bd1VrDUy-Iz?FujDpgx#WSKM z>hBm!xzB391d_YgI3fQjS_2-v`uJ6!%2b!SrEMG@>3o_qaV3vfBoedoSx1KIW_zmwAeZOZJt791vfov6(VN7Br0(OM99%_ZaU=-5ytB5 z@y({6(ZdZsLva5SVqB7&Ss-`VJ%2sEmSj7zGo*~amR1c^%$t!afjDJd!V(8=U}pDE z7HXepIFsB)!B)}o1aW(;tfNkCzyUi%$kEQ^ol_Y^Ok(<0w6 z(Dmmi?wDpvi}TtY>eSjx%!psmF|dF;l!pFW!1`3}LAB6;Z1Y+#1D9VSuD@9-nl-MQB5eWJjg~+v>;T^sV>ft=rAWX9s|Q=f|P7?iP30 zl)6<6Dw#MR_iN5R=<^EW{Jz;?^QGA1C70>8YFv8lvr>FH-ogHQ#I(*Bfusouxb(^P z*>H^-T`n|aR+SN{e3w=-2Tb0LUw?pmsfYCT^NjY^Zte)> ztON)-k(3L$uw7QDrP3^273XjdrVwsU%rTwqls&GRgGf$R+Z&(3Am>s@84V9AKi^x! zom_DT6)K^Sgy1GXz0sJjr5U?JA8fUOZwCpp^3!|Q6Rz41%vFKjj8Ik#??6Q?+lmn5 zH417dC~(+uD%qu0ODz;fI8+rfjVX|OBP-V&!?d%%2ebL(L113m4rS4@kY|<$W3WNObN} zg@~!}tOl31l4EHN{)N~nOgP2ma7me}NC*4A&;6XmwW*LL`o!zh>#CURAAUEszPE3F zHOEO4#82^@J!w9WmwvZqZ-#!uR7+YiJWa>2-q-gzbw?*t*8>@cGuO*p?psS#seW@m zo{n~?gB4dtgwZ0o-JV6;M;iN2sS*$ZW@Gx#fVxKRfbWIO&A>>T%WdYxEzkUaG%VU}&y-#<|P^Mw)eYB%jA@OvRNB@uUJ{ zL0#7=?Fke7Z@=+QiC&Rbv)ymik{9vin`6iB{_U`pl+xUoeh@S8F$tfqN9y@;zadV5zDs=n_7pIEJL5hC5`I@6PVC$`X(XCyKt?_wR z*YJ(Jwiqq-j{KI~x8&$b#L=gqBp2~Q7C&h^l__0a?<=pjEi)VA5eI(tepoem)6s@8 zb=U2E?FIh8G^(P6sPnv62|BGlPeUihUC0!9le&~WlndRcla0}sPG6Lm_fzDGLqEBG zjFE$Q?FTQqupv`c0gkfoC9K~nHw~vY-rMiC5*j|omGu_@2b>yEtQW*ho=(J{!2FUL7D-!dBHB9BDx z_~^&0_qWm@!o@qOHd#MpH z*Xe)Re#Iq09xi%w%Y#w?!P}Ae)b$440rR1b6CBKnqsg+~Ny#E(e+m5c z8!w}m9@~pPpOE$~R5iZ9V6DK^_50;}d^2l(%g3lkP`3QvUQ~rUH2SV<5$(9Mg8@H} z#OP4S`QMqaUx>-!sOoE;z2)#%NArcADS!ayS&xd~;;wg(j|)G+?y=CK*osmTo)KZU zj)CpnA#UUDC&Er5g*J{pR8LWak!N~=u7tJhoZCw#qW!1v%8GX(z1@t*^IjcXv$Fb7 zF64fRAfU&CSIpJ4ycRd1Vk(RK?WWz>YzP^H7SH@M)<}rxcqT`}t!aB;5}g@Zx`?%3 zQ&QjSL+$Cbf$sYhL&E{{q%R=dao&(p{y0Ql3Q>7Y6)&ToXfk}_BI1N3t)Ir zDf4PZ5Lh=qtm^IqUiqxur{S6NI|{jJ`w1-hJ<+ve>x~Ruyr8DcyJJMl(qoZf&0tTF zm1y2)@W&WQCnTC`juo&v|JM_?rr(I9@t zWL_)0V=Mo&w*TJSz&JDG`ik1})0^A#?4`~a?58Vw0@nKQP<3mVy%D8Xmet}Q(T?gdzohJRpQlHPWHL4DB1$J)hM(FQgY4@ ztb~Mm%&Gua17lfnD|BajS&wNKRkK--=6NHUN*w!qmyih1DEauL-=melYcug&LSH>8 zxnGU_+;U*3%;XUDHyd$D@--#l9!j*vTH&0xk*5JPWZ$BUi>e#PU5t@*sP6;{ z!*`kdRpFG%1!$bQO+WwPlPc;Y?HOudRd+n#&X^}cf5W;1+W0OQsTX~X5P<$_P0C@n zX;V!fed3+%)m0yt??Tt|9+MvSl-^%3GXI*<^0Pqz<-bg7`*IVloyo+i4J1Lr7CASp%W@WSZXB--bIOFjt_@$3qtICLs;)^W?@yGa z-|p<7N`Qy2gc})Qf%60TWDmwM6Du%sB$z3HysDYI{#NIapQ6d6J31PE?sckBtG)=* z->cJJ-wJ2CGbksxl-ziHCE8T$0Ho~Ng^{BfxiVF3M%0EEX(zG(vK%J0~)PA)W*`GY}FzRQQS z>i14>4SJOHdJD90kU3Wkddz10wl5xG^G^$OSRKKlj;@e?HJ*%OJnHK>|I0q9Z}yXj zJ#tpQ{&?nb@BLv4!Pk$tzuVXUf6<~PlM1_9FUqlKgWK(E_}w?TZ98kP`MMzN{4!1Z z&9U=t*R9&zd9vg9g(A-@E*h%yKfKM&`DGoKc6`O!^@*E|SoZlRT-lK4VR>Z+u%Vvp zCcwmXE$8Ep#BTNe2|B?OzI*>?YmS*9mHfe`KWU=||H@Z~H|f}%KU{j3@w6w;Z}Te> zUO-(<3r!mBSGoz`crg1?z+MYUY4(y{wTFCr{!f0rOU9z0!AH$F=&W?O&H2Ua*5w^A z5<1+-tJ=0n%cqBv>%`BtIq4F`{L>}0d5*}qo_S}#vn8?P{b}R5>`AxHrd|C%R}9#3 znrjGFZu(TtTT5ws7_W*!+JT1#YfZQ5=D%*_`Bo9z`S1Z-_d*x{9!W=zMxQl*{GM38 z-EZCb@V%cNe=A1+aO$%N9ri8EjmD?W0!J4O^)k0l@n(?bQLE=!EZZ|(`sp-KzjXSR z=9BWwJlj5Uf3Yche6shk+wN3QpH!7qqWNR-pZeCX^=mjK_uXUw0#8>zmvv4FO#rn- Bj6DDV From ff25cd6af576d115ec48cf40d3470a531802bd06 Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Wed, 18 May 2016 19:23:40 -0700 Subject: [PATCH 331/439] fix notes --- ...nced-uefi-security-features-for-surface.md | 4 +- ...tomize-the-oobe-for-surface-deployments.md | 6 +-- ...irmware-and-drivers-for-surface-devices.md | 4 +- ...-adapters-and-surface-device-deployment.md | 2 +- .../manage-surface-dock-firmware-updates.md | 11 +++-- .../surface/microsoft-surface-data-eraser.md | 6 +-- ...icrosoft-surface-deployment-accelerator.md | 4 +- ...-by-step-surface-deployment-accelerator.md | 19 ++++---- devices/surface/surface-diagnostic-toolkit.md | 44 +++++++++---------- devices/surface/surface-dock-updater.md | 4 +- 10 files changed, 51 insertions(+), 53 deletions(-) diff --git a/devices/surface/advanced-uefi-security-features-for-surface.md b/devices/surface/advanced-uefi-security-features-for-surface.md index 916ff69bf3..9eb6cc703e 100644 --- a/devices/surface/advanced-uefi-security-features-for-surface.md +++ b/devices/surface/advanced-uefi-security-features-for-surface.md @@ -24,7 +24,7 @@ Before you can configure the advanced security features of your Surface device, ## Manually configure additional security settings -**Note**  To enter firmware setup on a Surface device, begin with the device powered off, press and hold the **Volume Up** button, then press and release the **Power** button, then release the **Volume Up** button after the device has begun to boot. +>**Note:**  To enter firmware setup on a Surface device, begin with the device powered off, press and hold the **Volume Up** button, then press and release the **Power** button, then release the **Volume Up** button after the device has begun to boot. After the v3.11.760.0 UEFI update is installed on a Surface device, an additional UEFI menu named **Advanced Device Security** becomes available. If you click this menu, the following options are displayed: @@ -55,7 +55,7 @@ As an IT professional with administrative privileges, you can automate the confi **Sample scripts** -**Note**  The UEFI password used in the sample scripts below is presented in clear text. We strongly recommend saving the scripts in a protected location and running them in a controlled environment. +>**Note**:  The UEFI password used in the sample scripts below is presented in clear text. We strongly recommend saving the scripts in a protected location and running them in a controlled environment. Show all configurable options: diff --git a/devices/surface/customize-the-oobe-for-surface-deployments.md b/devices/surface/customize-the-oobe-for-surface-deployments.md index 9bf808c8a3..9b85678e22 100644 --- a/devices/surface/customize-the-oobe-for-surface-deployments.md +++ b/devices/surface/customize-the-oobe-for-surface-deployments.md @@ -16,13 +16,13 @@ This article walks you through the process of customizing the Surface out-of-box It is common practice in a Windows deployment to customize the user experience for the first startup of deployed computers — the out-of-box experience, or OOBE. -**Note**  OOBE is also often used to describe the phase, or configuration pass, of Windows setup during which the user experience is displayed. For more information about the OOBE phase of setup, see [How Configuration Passes Work](http://msdn.microsoft.com/library/windows/hardware/dn898581(v=vs.85).aspx). +>**Note:**  OOBE is also often used to describe the phase, or configuration pass, of Windows setup during which the user experience is displayed. For more information about the OOBE phase of setup, see [How Configuration Passes Work](http://msdn.microsoft.com/library/windows/hardware/dn898581.aspx). In some scenarios, you may want to provide complete automation to ensure that at the end of a deployment, computers are ready for use without any interaction from the user. In other scenarios, you may want to leave key elements of the experience for users to perform necessary actions or select between important choices. For administrators deploying to Surface devices, each of these scenarios presents a unique challenge to overcome. This article provides a summary of the scenarios where a deployment might require additional steps. It also provides the required information to ensure that the desired experience is achieved on any newly deployed Surface device. This article is intended for administrators who are familiar with the deployment process, as well as concepts such as answer files and [reference images](http://go.microsoft.com/fwlink/p/?LinkID=618042). -**Note**  Although the OOBE phase of setup is still run during a deployment with an automated deployment solution such as the [Microsoft Deployment Toolkit (MDT)](http://go.microsoft.com/fwlink/p/?LinkId=618117) or System Center Configuration Manager Operating System Deployment (OSD), it is automated by the settings supplied in the Deployment Wizard and task sequence. For more information see: +>**Note:**  Although the OOBE phase of setup is still run during a deployment with an automated deployment solution such as the [Microsoft Deployment Toolkit (MDT)](http://go.microsoft.com/fwlink/p/?LinkId=618117) or System Center Configuration Manager Operating System Deployment (OSD), it is automated by the settings supplied in the Deployment Wizard and task sequence. For more information see: - [Deploy Windows 10 with the Microsoft Deployment Toolkit](http://technet.microsoft.com/en-us/itpro/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit) @@ -49,7 +49,7 @@ To provide the factory Surface Pen pairing experience in OOBE, you must copy fou - %windir%\\system32\\oobe\\info\\default\\1033\\PenError\_en-US.png - %windir%\\system32\\oobe\\info\\default\\1033\\PenSuccess\_en-US.png -**Note**  You should copy the files from a factory image for the same model Surface device that you intend to deploy to. For example, you should use the files from a Surface Pro 3 to deploy to Surface Pro 3, and the files from Surface Book to deploy Surface Book, but you should not use the files from a Surface Pro 3 to deploy Surface Book or Surface Pro 4. +>**Note:**  You should copy the files from a factory image for the same model Surface device that you intend to deploy to. For example, you should use the files from a Surface Pro 3 to deploy to Surface Pro 3, and the files from Surface Book to deploy Surface Book, but you should not use the files from a Surface Pro 3 to deploy Surface Book or Surface Pro 4.   diff --git a/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md b/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md index 1f54650639..61d56fa1b9 100644 --- a/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md +++ b/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md @@ -26,12 +26,12 @@ Driver and firmware updates for Surface devices are released in one of two ways: Installation files for administrative tools, drivers for accessories, and updates for Windows are also available for some devices and are detailed here in this article. -**Note**  To simplify the process of locating drivers for your device, downloads for Surface devices have been reorganized to separate pages for each model. Bookmark the Microsoft Download Center page for your device from the links provided on this page. Many of the filenames contain a placeholder denoted with *xxxxxx*, which identifies the current version number or date of the file. +>**Note:**  To simplify the process of locating drivers for your device, downloads for Surface devices have been reorganized to separate pages for each model. Bookmark the Microsoft Download Center page for your device from the links provided on this page. Many of the filenames contain a placeholder denoted with *xxxxxx*, which identifies the current version number or date of the file.   Recent additions to the downloads for Surface devices provide you with options to install Windows 10 on your Surface devices and update LTE devices with the latest Windows 10 drivers and firmware. -**Note**  A battery charge of 40% or greater is required before you install firmware to a Surface device. See [Microsoft Support article KB2909710](http://go.microsoft.com/fwlink/p/?LinkId=618106) for more information. +>**Note:**  A battery charge of 40% or greater is required before you install firmware to a Surface device. See [Microsoft Support article KB2909710](http://go.microsoft.com/fwlink/p/?LinkId=618106) for more information.   diff --git a/devices/surface/ethernet-adapters-and-surface-device-deployment.md b/devices/surface/ethernet-adapters-and-surface-device-deployment.md index db8c55a949..fb580c032f 100644 --- a/devices/surface/ethernet-adapters-and-surface-device-deployment.md +++ b/devices/surface/ethernet-adapters-and-surface-device-deployment.md @@ -53,7 +53,7 @@ To boot a Surface device from an alternative boot device, follow these steps: 3. Press and release the **Power** button. 4. After the system begins to boot from the USB stick or Ethernet adapter, release the **Volume Down** button. -**Note**  In addition to an Ethernet adapter, a keyboard must also be connected to the Surface device to enter the preinstallation environment and navigate the deployment wizard. +>**Note:**  In addition to an Ethernet adapter, a keyboard must also be connected to the Surface device to enter the preinstallation environment and navigate the deployment wizard.   diff --git a/devices/surface/manage-surface-dock-firmware-updates.md b/devices/surface/manage-surface-dock-firmware-updates.md index 093579d4a5..3dd3741b56 100644 --- a/devices/surface/manage-surface-dock-firmware-updates.md +++ b/devices/surface/manage-surface-dock-firmware-updates.md @@ -17,7 +17,7 @@ The Surface Dock provides external connectivity to Surface devices through a sin Like the firmware for Surface devices, firmware for Surface Dock is also contained within a downloaded driver that is visible in Device Manager. This driver stages the firmware update files on the Surface device. When a Surface Dock is connected and the driver is loaded, the newer version of the firmware staged by the driver is detected and firmware files are copied to the Surface Dock. The Surface Dock then begins a two-phase process to apply the firmware internally. Each phase requires the Surface Dock to be disconnected from the Surface device before the firmware is applied. The driver copies the firmware into the dock, but only applies it when the user disconnects the Surface device from the Surface Dock. This ensures that there are no disruptions because the firmware is only applied when the user leaves their desk with the device. -**Note**  You can learn more about the firmware update process for Surface devices and how firmware is updated through driver installation at the following links: +>**Note:**  You can learn more about the firmware update process for Surface devices and how firmware is updated through driver installation at the following links: - [How to manage and update your drivers and firmware for Surface](http://go.microsoft.com/fwlink/p/?LinkId=785353) from Microsoft Mechanics @@ -69,7 +69,7 @@ There are three methods you can use to update the firmware of the Surface Dock: Windows Update is the method that most users will use. The drivers for the Surface Dock are downloaded automatically from Windows Update and the dock update process is initiated without additional user interaction. The two-phase dock update process described earlier occurs in the background as the user connects and disconnects the Surface Dock during normal use. -**Note**  The driver version that is displayed in Device Manager may be different from the firmware version that the Surface Dock is using. +>**Note:**  The driver version that is displayed in Device Manager may be different from the firmware version that the Surface Dock is using.   @@ -80,9 +80,8 @@ This method is used mostly in environments where Surface device drivers and firm For more information about how to deploy MSI packages see [Create and deploy an application with System Center Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=785355). -**Note**  When drivers are installed through Windows Update or the MSI package, registry keys are added that indicate the version of firmware installed on the Surface Dock and contained within the Surface Dock driver. These registry keys can be found in: - -**HLKM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\WUDF\\Services\\SurfaceDockFwUpdate\\Parameters** +>**Note:**  When drivers are installed through Windows Update or the MSI package, registry keys are added that indicate the version of firmware installed on the Surface Dock and contained within the Surface Dock driver. These registry keys can be found in:

    + **HLKM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\WUDF\\Services\\SurfaceDockFwUpdate\\Parameters** Firmware status is displayed for both the main chipset (displayed as **Component10**) and the DisplayPort chipset (displayed as **Component20**). For each chipset there are four keys, where *xx* is **10** or **20** corresponding to each chipset: @@ -94,7 +93,7 @@ Firmware status is displayed for both the main chipset (displayed as **Component - **Component*xx*FirmwareUpdateStatusRejectReason** – This key changes as the firmware update is processed. It should result in 0 after the successful installation of Surface Dock firmware. -These registry keys are not present unless you have installed updated Surface Dock drivers through Windows Update or MSI deployment. +>**Note:**  These registry keys are not present unless you have installed updated Surface Dock drivers through Windows Update or MSI deployment.   diff --git a/devices/surface/microsoft-surface-data-eraser.md b/devices/surface/microsoft-surface-data-eraser.md index 7a26697d0f..e35e41bbf8 100644 --- a/devices/surface/microsoft-surface-data-eraser.md +++ b/devices/surface/microsoft-surface-data-eraser.md @@ -40,9 +40,9 @@ Some scenarios where Microsoft Surface Data Eraser can be helpful include: - Standard practice when performing reimaging for devices used with sensitive data -**Note**  Third-party devices, Surface devices running Windows RT (including Surface and Surface 2), and Surface Pro are not compatible with Microsoft Surface Data Eraser. +>**Note:**  Third-party devices, Surface devices running Windows RT (including Surface and Surface 2), and Surface Pro are not compatible with Microsoft Surface Data Eraser. -**Note**  Because the ability to boot to USB is required to run Microsoft Surface Data Eraser, if the device is not configured to boot from USB or if the device is unable to boot or POST successfully, the Microsoft Surface Data Eraser tool will not function. +>**Note:**  Because the ability to boot to USB is required to run Microsoft Surface Data Eraser, if the device is not configured to boot from USB or if the device is unable to boot or POST successfully, the Microsoft Surface Data Eraser tool will not function. ## How to create a Microsoft Surface Data Eraser USB stick @@ -69,7 +69,7 @@ After the creation tool is installed, follow these steps to create a Microsoft S Figure 1. Start the Microsoft Surface Data Eraser tool 4. Select the USB drive of your choice from the **USB Thumb Drive Selection** page as shown in Figure 2, and then click **Start** to begin the USB creation process. The drive you select will be formatted and any existing data on this drive will be lost. - **Note**  If the Start button is disabled, check that your removable drive has a total capacity of at least 4 GB. + >**Note:**  If the Start button is disabled, check that your removable drive has a total capacity of at least 4 GB.   ![figure 2](images/dataeraser-usb-selection.png) diff --git a/devices/surface/microsoft-surface-deployment-accelerator.md b/devices/surface/microsoft-surface-deployment-accelerator.md index c29e806628..e38d23d94b 100644 --- a/devices/surface/microsoft-surface-deployment-accelerator.md +++ b/devices/surface/microsoft-surface-deployment-accelerator.md @@ -60,7 +60,7 @@ When the Microsoft Surface Deployment Accelerator completes, you can use the dep You can modify the task sequence in the MDT Deployment Workbench to [include your own apps](http://go.microsoft.com/fwlink/p/?linkid=691700), or to [pause the automated installation routine](http://go.microsoft.com/fwlink/p/?linkid=691701). While the installation is paused, you can make changes to customize your reference image. After the image is captured, you can configure a deployment task sequence and distribute this custom configuration by using the same network boot capabilities as before. -**Note**  With Microsoft Surface Deployment Accelerator v1.9.0258, Surface Pro 3, Surface Pro 4, and Surface Book are supported for Windows 10 deployment, and Surface Pro 3 is supported for Windows 8.1 deployment. +>**Note:**  With Microsoft Surface Deployment Accelerator v1.9.0258, Surface Pro 3, Surface Pro 4, and Surface Book are supported for Windows 10 deployment, and Surface Pro 3 is supported for Windows 8.1 deployment.   @@ -75,7 +75,7 @@ Figure 2. Specify a local source for Surface driver and app files You can find a full list of available driver downloads at [Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md) -**Note**  Downloaded files do not need to be extracted. The downloaded files can be left as .zip files as long as they are stored in one folder. +>**Note:**  Downloaded files do not need to be extracted. The downloaded files can be left as .zip files as long as they are stored in one folder.   diff --git a/devices/surface/step-by-step-surface-deployment-accelerator.md b/devices/surface/step-by-step-surface-deployment-accelerator.md index faa4f9d57b..b04c37e9b5 100644 --- a/devices/surface/step-by-step-surface-deployment-accelerator.md +++ b/devices/surface/step-by-step-surface-deployment-accelerator.md @@ -37,7 +37,7 @@ The tool installs in the Surface Deployment Accelerator program group, as shown Figure 2. The Surface Deployment Accelerator program group and icon -**Note**  At this point the tool has not yet prepared any deployment environment or downloaded any materials from the Internet. +>**Note:**  At this point the tool has not yet prepared any deployment environment or downloaded any materials from the Internet.   @@ -46,7 +46,7 @@ Figure 2. The Surface Deployment Accelerator program group and icon The following steps show how you create a deployment share for Windows 10 that supports Surface Pro 3, Surface Pro 4, Surface Book, the Surface Firmware Tool, and the Surface Asset Tag Tool. As you follow the steps below, make the selections that are applicable for your organization. For example, you could choose to deploy Windows 10 to Surface Book only, without any of the Surface apps. -**Note**  SDA lets you create deployment shares for both Windows 8.1 and Windows 10 deployments, but you can only create a single deployment share at a time. Therefore, to create both Windows 8.1 and Windows 10 deployment shares, you will need to run the tool twice. +>**Note:**  SDA lets you create deployment shares for both Windows 8.1 and Windows 10 deployments, but you can only create a single deployment share at a time. Therefore, to create both Windows 8.1 and Windows 10 deployment shares, you will need to run the tool twice.   @@ -114,7 +114,7 @@ The following steps show how you create a deployment share for Windows 10 that If you are unable to connect to the Internet with your deployment server, or if you want to download the Surface drivers and apps separately, you can specify a local source for the driver an app files at the time of deployment share creation. On the **Configure** page of the SDA wizard, select the **Copy from a Local Directory** check box, as shown in Figure 6. The **Download from the Internet** check box will be automatically deselected. Enter the folder location where you have placed the driver and app files in the **Local Path** field, as shown in Figure 6. -**Note**  All of the downloaded driver and applications files must be located in the same folder. The driver and app files do not need to be extracted from the downloaded .zip files. +>**Note:**  All of the downloaded driver and applications files must be located in the same folder. The driver and app files do not need to be extracted from the downloaded .zip files.   @@ -122,7 +122,7 @@ If you are unable to connect to the Internet with your deployment server, or if Figure 6. Specify the Surface driver and app files from a local path -**Note**  The **Copy from a Local Directory** check box is only available in SDA version 1.90.0221 or later. +>**Note:**  The **Copy from a Local Directory** check box is only available in SDA version 1.90.0221 or later.   @@ -130,7 +130,7 @@ Figure 6. Specify the Surface driver and app files from a local path You can use USB media to perform an SDA deployment if your Surface device is unable to boot from the network. For example, if you do not have a Microsoft Surface Ethernet Adapter or Microsoft Surface dock to facilitate network boot (PXE boot). The USB drive produced by following these steps includes a complete copy of the SDA deployment share and can be run on a Surface device without a network connection. -**Note**  The offline media files for the complete SDA deployment share are approximately 9 GB in size. Your USB drive must be at least 9 GB in size. A 16 GB USB drive is recommended. +>**Note:**  The offline media files for the complete SDA deployment share are approximately 9 GB in size. Your USB drive must be at least 9 GB in size. A 16 GB USB drive is recommended.   @@ -144,7 +144,7 @@ Before you can create bootable media files within the MDT Deployment Workbench o 4. **clean** – Removes all configuration from your USB drive. - **Warning**  This step will remove all information from your drive. Verify that your USB drive does not contain any needed data before you perform the **clean** command. + >**Warning:**  This step will remove all information from your drive. Verify that your USB drive does not contain any needed data before you perform the **clean** command.   @@ -162,7 +162,7 @@ Before you can create bootable media files within the MDT Deployment Workbench o Figure 7. Use DiskPart to prepare a USB drive for boot - **Note**  You can format your USB drive with FAT32 from Disk Management, but you must still use DiskPart to set the partition as active for the drive to boot properly. + >**Note:**  You can format your USB drive with FAT32 from Disk Management, but you must still use DiskPart to set the partition as active for the drive to boot properly.   @@ -269,7 +269,7 @@ When you run the task sequence, you will be prompted to provide the following in - A product key, if one is required - **Note**  If you are deploying the same version of Windows as the version that came on your device, no product key is required. + >**Note:**  If you are deploying the same version of Windows as the version that came on your device, no product key is required.   @@ -285,8 +285,7 @@ The **2 – Create Windows Reference Image** task sequence is used to perform a Like the **1 – Deploy Microsoft Surface** task sequence, the **2 – Create Windows Reference Image** task sequence performs a deployment of the unaltered Windows image directly from the installation media. Creation of a reference image should always be performed on a virtual machine. Using a virtual machine as your reference system helps to ensure that the resulting image is compatible with different hardware configurations. -**Note**   -Using a virtual machine when you create a reference image for Windows deployment is a recommended practice for performing Windows deployments with Microsoft deployment tools including the Microsoft Deployment Toolkit and System Center Configuration Manager. These Microsoft deployment technologies use the hardware agnostic images produced from a virtual machine and a collection of managed drivers to deploy to different configurations of hardware. For more information see [Deploy a Windows 10 image using MDT 2013 Update 1](http://technet.microsoft.com/en-us/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt). +>**Note:**  Using a virtual machine when you create a reference image for Windows deployment is a recommended practice for performing Windows deployments with Microsoft deployment tools including the Microsoft Deployment Toolkit and System Center Configuration Manager. These Microsoft deployment technologies use the hardware agnostic images produced from a virtual machine and a collection of managed drivers to deploy to different configurations of hardware. For more information see [Deploy a Windows 10 image using MDT 2013 Update 1](http://technet.microsoft.com/en-us/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt).   diff --git a/devices/surface/surface-diagnostic-toolkit.md b/devices/surface/surface-diagnostic-toolkit.md index 11b81dff40..61e867468f 100644 --- a/devices/surface/surface-diagnostic-toolkit.md +++ b/devices/surface/surface-diagnostic-toolkit.md @@ -16,7 +16,7 @@ Find out how you can use the Microsoft Surface Diagnostic Toolkit to test the ha The [Microsoft Surface Diagnostic Toolkit](http://go.microsoft.com/fwlink/p/?LinkId=618121) is a small, portable diagnostic tool that runs through a suite of tests to diagnose the hardware of Surface devices. The Microsoft Surface Diagnostic Toolkit executable file is less than 3 MB, which allows it to be distributed through email. It does not require installation, so it can be run directly from a USB stick or over the network. The Microsoft Surface Diagnostic Toolkit walks you through several tests of individual components including the touchscreen, cameras, and sensors. -**Note**  A Surface device must boot into Windows to run the Microsoft Surface Diagnostic Toolkit. The Microsoft Surface Diagnostic Toolkit will run only on the following Surface devices: +>**Note:**  A Surface device must boot into Windows to run the Microsoft Surface Diagnostic Toolkit. The Microsoft Surface Diagnostic Toolkit will run only on the following Surface devices: - Surface Book @@ -32,7 +32,7 @@ The [Microsoft Surface Diagnostic Toolkit](http://go.microsoft.com/fwlink/p/?Lin - Surface Pro -**Note**  Security software and built-in security measures in many email applications and services will block executable files that are transferred through email. To email the Surface Diagnostic Toolkit, attach the .zip archive file as downloaded from the Surface Tools for IT page without extracting it first. You can also create a custom .zip archive that contains the .exe file. (For example, if you want to localize the text as described in the [Localization](#localization) section of this article.) +>**Note:**  Security software and built-in security measures in many email applications and services will block executable files that are transferred through email. To email the Surface Diagnostic Toolkit, attach the .zip archive file as downloaded from the Surface Tools for IT page without extracting it first. You can also create a custom .zip archive that contains the .exe file. (For example, if you want to localize the text as described in the [Localization](#localization) section of this article.) Running the Microsoft Surface Diagnostic Toolkit is a hands-on activity. The test sequence includes several tests that require you to perform actions or observe the outcome of the test, and then click the applicable **Pass** or **Fail** button. Some tests require connectivity to external devices, like an external display. Other tests use the built in Windows troubleshooters. At the end of testing, a visual report of the test results is displayed and you are given the option to save a log file or copy the results to the clipboard. @@ -50,7 +50,7 @@ To run a full set of tests with the Microsoft Surface Diagnostic Toolkit, you sh - External speakers or headphones -**Note**  The Microsoft Surface Diagnostic Toolkit tests verify only the hardware of a Surface device and do not test or resolve issues with the operating system or software. +>**Note:**  The Microsoft Surface Diagnostic Toolkit tests verify only the hardware of a Surface device and do not test or resolve issues with the operating system or software.   @@ -115,7 +115,7 @@ These files and logs are stored in a .zip file saved by the Microsoft Surface Di ###
    Type Cover test -**Note**  A Surface Type Cover is required for this test. +>**Note:**  A Surface Type Cover is required for this test.   @@ -123,7 +123,7 @@ If a Surface Type Cover is not detected, the test prompts you to connect the Typ ### Integrated keyboard test -**Note**  This test is only applicable to Surface Book and requires that the Surface Book be docked to the keyboard. +>**Note:**  This test is only applicable to Surface Book and requires that the Surface Book be docked to the keyboard.   @@ -131,7 +131,7 @@ This test is essentially the same as the Type Cover test, except the integrated ### Canvas mode battery test -**Note**  This test is only applicable to Surface Book. +>**Note:**  This test is only applicable to Surface Book.   @@ -139,7 +139,7 @@ Depending on which mode Surface Book is in, different batteries are used to powe ### Clipboard mode battery test -**Note**  This test is only applicable to Surface Book. +>**Note:**  This test is only applicable to Surface Book.   @@ -147,7 +147,7 @@ Disconnect the Surface Book from the keyboard to work in clipboard mode. In clip ### Laptop mode battery test -**Note**  This test is only applicable to Surface Book. +>**Note:**  This test is only applicable to Surface Book.   @@ -159,7 +159,7 @@ In this test the battery is discharged for a few seconds and tested for health a ### Discrete graphics (dGPU) test -**Note**  This test is only applicable to Surface Book models with a discrete graphics processor. +>**Note:**  This test is only applicable to Surface Book models with a discrete graphics processor.   @@ -167,7 +167,7 @@ This test will query the device information of current hardware to check for the ### Discrete graphics (dGPU) fan test -**Note**  This test is only applicable to Surface Book models with a discrete graphics processor. +>**Note:**  This test is only applicable to Surface Book models with a discrete graphics processor.   @@ -175,7 +175,7 @@ The discrete graphics processor in the Surface Book includes a separate cooling ### Muscle wire test -**Note**  This test is only applicable to Surface Book. +>**Note:**  This test is only applicable to Surface Book.   @@ -183,7 +183,7 @@ To disconnect the Surface Book from the keyboard, software must instruct the mus ### Dead pixel and display artifacts tests -**Note**  Before you run this test, be sure to clean the screen of dust or smudges. +>**Note:**  Before you run this test, be sure to clean the screen of dust or smudges.   @@ -203,7 +203,7 @@ The Surface touchscreen should detect input across the entire screen of the devi ### Digitizer pen test -**Note**  A Microsoft Surface Pen is required for this test. +>**Note:**  A Microsoft Surface Pen is required for this test.   @@ -223,7 +223,7 @@ This test prompts you to use the volume rocker to turn the volume all the way up ### Micro SD or SD slot test -**Note**  This test requires a micro SD or SD card that is compatible with the slot in your Surface device. +>**Note:**  This test requires a micro SD or SD card that is compatible with the slot in your Surface device.   @@ -235,7 +235,7 @@ This test displays the **Recording** tab of the Sound item in Control Panel. The ### Video out test -**Note**  This test requires an external display with the applicable connection for your Surface device. +>**Note:**  This test requires an external display with the applicable connection for your Surface device.   @@ -243,7 +243,7 @@ Surface devices provide a Mini DisplayPort connection for connecting to an exter ### Bluetooth test -**Note**  This test requires a Bluetooth device. The device must be set to pairing mode or made discoverable to perform this test. +>**Note:**  This test requires a Bluetooth device. The device must be set to pairing mode or made discoverable to perform this test.   @@ -255,7 +255,7 @@ Use this test to verify that the cameras on your Surface device are operating pr ### Speaker test -**Note**  Headphones or external speakers are required to test the headphone jack in this test. +>**Note:**  Headphones or external speakers are required to test the headphone jack in this test.   @@ -263,7 +263,7 @@ This test plays audio over left and right channels respectively, both for the in ### Network test -**Note**  Connect the Surface device to a Wi-Fi network before you run this test. Connections that are made during the test are removed when the test is completed. +>**Note:**  Connect the Surface device to a Wi-Fi network before you run this test. Connections that are made during the test are removed when the test is completed.   @@ -295,7 +295,7 @@ The ambient light sensor is used to automatically adjust screen brightness relat ### Device orientation test -**Note**  Before you run this test, disable rotation lock from the Action Center if enabled. +>**Note:**  Before you run this test, disable rotation lock from the Action Center if enabled.   @@ -307,7 +307,7 @@ This test cycles the screen through brightness levels from 0 percent to 100 perc ### System assessment -**Note**  The Surface device must be connected to AC power before you can run this test. +>**Note:**  The Surface device must be connected to AC power before you can run this test.   @@ -326,7 +326,7 @@ If your Surface device has encountered an error that caused the device to fail o You can run the Microsoft Surface Diagnostic Toolkit from the command line or as part of a script. The tool supports the following arguments: -**Note**  Many of the tests performed by the Microsoft Surface Diagnostic Toolkit require technician interaction. The Microsoft Surface Diagnostic Toolkit cannot run unattended. +>**Note:**  Many of the tests performed by the Microsoft Surface Diagnostic Toolkit require technician interaction. The Microsoft Surface Diagnostic Toolkit cannot run unattended.   @@ -481,7 +481,7 @@ By default, the Microsoft Surface Diagnostic Toolkit is available in English onl 6. Save the SurfaceDiagnosticTool\_v1.0.60.0.locale file. -**Note**  The SurfaceDiganosticTool\_v1.0.60.0.locale file must be located in the same folder and have the same name other than the file extension as the Microsoft Surface Diagnostic Toolkit executable file to use the custom prompt text. The SurfaceDiganosticTool\_v1.0.60.0.locale is an .xml file and must use UTF-8 encoding. +>**Note:**  The SurfaceDiganosticTool\_v1.0.60.0.locale file must be located in the same folder and have the same name other than the file extension as the Microsoft Surface Diagnostic Toolkit executable file to use the custom prompt text. The SurfaceDiganosticTool\_v1.0.60.0.locale is an .xml file and must use UTF-8 encoding.   diff --git a/devices/surface/surface-dock-updater.md b/devices/surface/surface-dock-updater.md index 9bd3933aa6..e54a683fd7 100644 --- a/devices/surface/surface-dock-updater.md +++ b/devices/surface/surface-dock-updater.md @@ -17,7 +17,7 @@ The [Microsoft Surface Dock Updater](http://go.microsoft.com/fwlink/p/?LinkId=61 When you run the Microsoft Surface Dock Updater installer you will be prompted to accept an End User License Agreement (EULA). -**Note**  Updating Surface Dock firmware requires connectivity to the Surface Dock, available only on Surface Pro 3, Surface Pro 4, and Surface Book devices. A Surface Pro 3, Surface Pro 4, or Surface Book is required to successfully install Microsoft Surface Dock Updater. +>**Note:**  Updating Surface Dock firmware requires connectivity to the Surface Dock, available only on Surface Pro 3, Surface Pro 4, and Surface Book devices. A Surface Pro 3, Surface Pro 4, or Surface Book is required to successfully install Microsoft Surface Dock Updater. ## Update a Surface Dock with Microsoft Surface Dock Updater @@ -72,7 +72,7 @@ To update a Surface Dock with Microsoft Surface Dock Updater, follow these steps 9. If you want to update multiple Surface Docks in one sitting, you can click the **Update another Surface Dock** button to begin the process on the next Surface Dock. - **Note**  The LED in the Ethernet port of the dock will blink while the update is in progress. Please wait until the LED stops blinking before you unplug your Surface Dock from power. + >**Note:**  The LED in the Ethernet port of the dock will blink while the update is in progress. Please wait until the LED stops blinking before you unplug your Surface Dock from power.   From d036e1f0d44cb83f1a30d6de58974dcd873ed0b9 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 18 May 2016 19:45:16 -0700 Subject: [PATCH 332/439] Vicki feedback --- education/windows/set-up-school-pcs-technical.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index 47d7e4e1e9..3209eaf7a4 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -25,14 +25,14 @@ The following table tells you what you get using the **Set up School PCs** app i | Feature | No Internet | Azure AD | Office 365 | Azure AD Premium | | --- | :---: | :---: | :---: | :---: | | **Fast sign-in**
    Each student can sign in and start using the computer in less than a minute, even on their first sign-in. | X | X | X | X | -| **Custom Start experience**\*
    The apps students need are pinned to Start, and unncessary apps are removed. | X | X | X | X | +| **Custom Start experience**\*
    The apps students need are pinned to Start, and unnecessary apps are removed. | X | X | X | X | | **Temporary access, no sign-in required**
    This option sets up computers for common use. Anyone can use the computer without an account. | X | X | X | X | | **School policies**\*
    Settings specific to education create a useful learning environment and the best computer performance. | X | X | X | X | | **Azure AD Join**
    The computers are joined to your Azure AD or Office 365 subscription for centralized management. | | X | X | X | | **Single sign-on to Office 365**
    By signing on with student IDs, students have fast access to Office 365 web apps. | | | X | X | | **[Settings roaming](https://azure.microsoft.com/en-us/documentation/articles/active-directory-windows-enterprise-state-roaming-overview/) via Azure AD**
    Student user and application settings data can be synchronized across devices for a personalized experience. | | | | X | | | | | | | -\* Feature applies to Windows 10 Pro for Education, Windows 10 Enterprise, and Windows 10 Enterprise for EDU +\* Feature applies to Windows 10 Pro, Windows 10 Pro for Education, Windows 10 Enterprise, and Windows 10 Enterprise for EDU > **Note**: If your school only uses traditional domains through Active Directory, [use Windows Imaging and Configuration Designer](set-up-students-pcs-to-join-domain.md) to configure your PCs. You can only use the Set up School PCs app to set up PCs that are not connected to your traditional domain. @@ -56,8 +56,8 @@ However, the PC is also configured to not interrupt the user during normal dayti ## Guidance for accounts on shared PCs * On a Windows PC joined to Azure Active Directory - * By default, the account that joined the PC to AAD will have an admin account on that PC, and well as Global Administrators of the domain. - * With Azure AD Premium, which accounts have admin accounts on a PC can be specified via the Additional administrators on Azure AD Joined devices setting on the Azure portal. + * By default, the account that joined the PC to Azure AD will have an admin account on that PC. Global administrators for the Azure AD domain will also have admin accounts on the PC. + * With Azure AD Premium, you can specify which accounts have admin accounts on a PC using the **Additional administrators on Azure AD Joined devices** setting on the Azure portal. * If shared PC mode with the account manager turned on is set up on a PC that is already in use, existing local accounts will not be deleted. However, all other local accounts created after Shared PC mode is turned on will automatically be deleted at sign off, including admin accounts. * Ensure the PC is joined to a domain that enables accounts to be signed on as admin, or * Create admin accounts before enabling Shared PC mode, or From cca6c58687ff598b5c23a7a8637a56d0c03bc389 Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Wed, 18 May 2016 19:52:59 -0700 Subject: [PATCH 333/439] fix spacing --- .../customize-the-oobe-for-surface-deployments.md | 9 ++++----- devices/surface/manage-surface-dock-firmware-updates.md | 8 +++----- devices/surface/surface-dock-updater.md | 1 + 3 files changed, 8 insertions(+), 10 deletions(-) diff --git a/devices/surface/customize-the-oobe-for-surface-deployments.md b/devices/surface/customize-the-oobe-for-surface-deployments.md index 9b85678e22..1985b76438 100644 --- a/devices/surface/customize-the-oobe-for-surface-deployments.md +++ b/devices/surface/customize-the-oobe-for-surface-deployments.md @@ -22,11 +22,10 @@ In some scenarios, you may want to provide complete automation to ensure that at This article provides a summary of the scenarios where a deployment might require additional steps. It also provides the required information to ensure that the desired experience is achieved on any newly deployed Surface device. This article is intended for administrators who are familiar with the deployment process, as well as concepts such as answer files and [reference images](http://go.microsoft.com/fwlink/p/?LinkID=618042). ->**Note:**  Although the OOBE phase of setup is still run during a deployment with an automated deployment solution such as the [Microsoft Deployment Toolkit (MDT)](http://go.microsoft.com/fwlink/p/?LinkId=618117) or System Center Configuration Manager Operating System Deployment (OSD), it is automated by the settings supplied in the Deployment Wizard and task sequence. For more information see: - -- [Deploy Windows 10 with the Microsoft Deployment Toolkit](http://technet.microsoft.com/en-us/itpro/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit) - -- [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](http://technet.microsoft.com/en-us/itpro/windows/deploy/deploy-windows-10-with-system-center-2012-r2-configuration-manager) +>**Note:**  Although the OOBE phase of setup is still run during a deployment with an automated deployment solution such as the [Microsoft Deployment Toolkit (MDT)](http://go.microsoft.com/fwlink/p/?LinkId=618117) or System Center Configuration Manager Operating System Deployment (OSD), it is automated by the settings supplied in the Deployment Wizard and task sequence. For more information see:
    +- [Deploy Windows 10 with the Microsoft Deployment Toolkit](http://technet.microsoft.com/en-us/itpro/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit) +
    +- [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](http://technet.microsoft.com/en-us/itpro/windows/deploy/deploy-windows-10-with-system-center-2012-r2-configuration-manager)   diff --git a/devices/surface/manage-surface-dock-firmware-updates.md b/devices/surface/manage-surface-dock-firmware-updates.md index 3dd3741b56..758f8027ea 100644 --- a/devices/surface/manage-surface-dock-firmware-updates.md +++ b/devices/surface/manage-surface-dock-firmware-updates.md @@ -17,11 +17,9 @@ The Surface Dock provides external connectivity to Surface devices through a sin Like the firmware for Surface devices, firmware for Surface Dock is also contained within a downloaded driver that is visible in Device Manager. This driver stages the firmware update files on the Surface device. When a Surface Dock is connected and the driver is loaded, the newer version of the firmware staged by the driver is detected and firmware files are copied to the Surface Dock. The Surface Dock then begins a two-phase process to apply the firmware internally. Each phase requires the Surface Dock to be disconnected from the Surface device before the firmware is applied. The driver copies the firmware into the dock, but only applies it when the user disconnects the Surface device from the Surface Dock. This ensures that there are no disruptions because the firmware is only applied when the user leaves their desk with the device. ->**Note:**  You can learn more about the firmware update process for Surface devices and how firmware is updated through driver installation at the following links: - -- [How to manage and update your drivers and firmware for Surface](http://go.microsoft.com/fwlink/p/?LinkId=785353) from Microsoft Mechanics - -- [Windows Update Makes Surface Better](http://go.microsoft.com/fwlink/p/?LinkId=785354) on the Microsoft Devices Blog +>**Note:**  You can learn more about the firmware update process for Surface devices and how firmware is updated through driver installation at the following links:
    +- [How to manage and update Surface drivers and firmware](https://technet.microsoft.com/en-us/mt697551) from Microsoft Mechanics +- [Windows Update Makes Surface Better](http://go.microsoft.com/fwlink/p/?LinkId=785354) on the Microsoft Devices Blog   diff --git a/devices/surface/surface-dock-updater.md b/devices/surface/surface-dock-updater.md index e54a683fd7..38115ae721 100644 --- a/devices/surface/surface-dock-updater.md +++ b/devices/surface/surface-dock-updater.md @@ -94,6 +94,7 @@ Microsoft Surface Dock Updater logs its progress into the Event Log, as shown in | 12102 | Event in the DisplayPort chipset firmware update process | | 12105 | Error | + Figure 8. Surface Dock Updater events in Event Viewer ![figure 8](images/surfacedockupdater-fig8-737test.png) From d9d54f40a6ce1495f5d882345ac0d01a6f29b62d Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 19 May 2016 08:04:39 -0700 Subject: [PATCH 334/439] new art, topic updates --- education/windows/images/package.png | Bin 0 -> 4523 bytes .../windows/set-up-school-pcs-technical.md | 41 ++++++++++-------- .../set-up-students-pcs-to-join-domain.md | 12 ++++- 3 files changed, 33 insertions(+), 20 deletions(-) create mode 100644 education/windows/images/package.png diff --git a/education/windows/images/package.png b/education/windows/images/package.png new file mode 100644 index 0000000000000000000000000000000000000000..f5e975e3e92e22d17610159988ef2735725b3b84 GIT binary patch literal 4523 zcmZ`-c{CK<`=4Q~!weP4o+YI0OJ&b85u>bOtdUoCQyA-5BH2QAqq0+$!DJg5ri`5^ zgkhwRtx?&R`FX$Zd){;2@A>|o=iX=eJonx|p3gn!o^um!!C~yIysQ8KfZgzho*4iD zq@Kk4%=9PLqwpK!i31|dVAlaPL;T-Q5|F!&i4FjOO$8r1Go0isem888004ye=LC{` zD_l>&;akQQ`X?R=g>rIo3JVL1ii%2w49LpL%0~_=DJfmOdi7fDkhZq=^~b|77|b~3 z0~`*w$QZS@wsy!Fb98ic$9(kg@bK~R@hut;E}sYq2?+}ei>aPWNJvO-n99h=$j;8r z$;rt*k=AJp22)sASX5M0TwGjsBAw*&^788H>bkl*EEbEy;oh7`-y9x~Z*On!=;-L` z>LL<}Boe7_{L8?=z~JEE$jHd2PoKue$0sKzKY#u_Gc!Xbljr8<78Vv37Z=yo)@U@E zwA~~L0N`*l)YGvDo?4rj_ngw^A#K9?wg`q?mp$dyyBjVz$cfsVCF07rsGN zsNkb4M-+VPBLTX#Ekn>^uZ{V|oHAL?98sa#`miI^gqp#iHOY707eH{&qxD(#BXF!k zOgrW{U|1P+XvgzYN{prpHS_K7=e|3h>l_8J2`}qlKh3XPt?IFO-Hg4OFVF7U%mc#4 z_l)B++v$Z04|fDRQO}k6kzx~mfIlw&=$chNWWO@vcQf^?<9-IL!zWI9&yLz*cMToq zsh)B`efr7@J!~OuL0n+q$E?KsqBUE)lNeJ5j}~-h2-TX!?nJCQd!v zyZ-gm9V3<(1wLA`0bsy$kfht*3Xf!Y@jU22f}UGJU^e8C7;$d(4TN~>H*0iel)k#8 zA5i5{6q}8bSfbh=>NMJI0axiw-RW=Dn=Tyby?u7xCdWqf=#O@kP}Se5kk()H320_=6XN1tG?1y}zM4~iz!+wgqb>zBs|cl# z?^*S1EFL&(mh90^#6I?_^_^!m|l@IanaKvp%ljn!ONJ4ra- zqA*I!3%phCloa*!MH|qD9m~}|3qC0>_fl)0=iqCW)D!Ai+(v^NkFz`dlwRP!(>#O-fu&RIu-%54NV#9Xk>{ z$6MIFt(lX10n+eW0Ci2(W=GLa< z6KCYkfGD@mggxq!(sAk{3g2*MzCaO~?J{v{rqS}vZj9e=niOHWd1d%PmvG|I`0#Lj z|3@}J)>NatwJ?<=ezaPg4gpl&5_cV~!$}u#hHmt&X34F6W8FF8f-`z)?8+O6s5US< zn5sA}L55XKTA)0JLp;5lEtkaX2xj?jR#`#EDP@DxjrC@zCZTGSRLi-m*8+FOSaRbY zRgO;wKqXYq`Vdwp4?Lwh3cYlD`#zG1SDh~8_F;PvAu7aCqkSx0RL27L5N>s#=RlwvzSZA5AzN)X*y zV}2=!0@hAP0m5weGpcbxsX4t@0W#y5H=LCl8`V53GKie*sYV;SD8j)7ds$QX_MP#( zU;81y<0D=|p*2upIAe`z!HG%bF=d21yzOx4>3^kZuF29Y;-^n}Lg0#$rn3gsFe5ns z1~MUsCRZ&%GXJ~!=kl}v-`4*WcOx6?4X+I|(4yza%S#PF&~X^mm%Q9S&{E%(IP{2d zjQm`ydm&y&n2k6m$IM0-<-{1JPm!x&o;|rbaP9oYpp})4XhTKvC5$H6%hi|K0ogFd z&&*IF1!rK2J4-JQ*l0`?(l680KzjaO!y4d&Elx2zK+gNsmUW>IJ@1IMYoa$)h82<4 z&!t_qVmf=?9fgC_SxEHiIh)+_4Vl-6+e#5Z(y5`xd7+1_1x~6j`WWR@b`~w8YFx}} zkI!e=ral1>Cud%%!e4bjaS{tPl=tt(Gvt|Wo$(y*HbGb13Ed2jfho?4lqpu?Dz+f< znBMjfWnrnUtS;|;V6ZiVaBfTIX+k6S^5~sG0fKF(4wG>kH66spHPp|j`j9J*X$2rz zrES*c^WA?iGWpKU!V3?DCzY$C7BuNKnMi7AkI~iKJcb9QM{%>Y`N|(HnVlG7+Z&79 z^xne?7rqU=Et1m0JBkL9^&axHX+o5{J*gTI3~%KUQ-Y{i|Esm34Vnp?txAqIwQifo z6_$A*6+efR!_8Cj%4^R8VhAw&+A};p& zy6kD6cb6Ws$f`8{(tFu0^OTzuUhJn@VlL`pum1}d*vn^Dv?kXJ`N1BNO-*WP0zS&)#gU@@o^? zowTr=e*Ak?hhXSp7=;=?h&ml#P)vdMW*|Z~jg?}n903k790{bu2$vB?;1v*s1FZ{y z{1g0F`VanBK)?G+oijXahUPwZG%c{ZxhCU%Hq!H45Z{@88c%(?W)R`H&(wZDf$6ta zzELYv^Td{hx8uYFdcw|ugSslC5!zY~)OsL`rrEn64W5pY*dtEiMASHlazJxkMMuKS zjNXpc7=1u`;9_UddT_(>4L*kIJmygV8@Ni2=ae?{2ga|HX$l+npK=0i)B#smujFV* zhK1u#X@AI28c4oI;oNs_yPrk1xSTm>R_QhqfRaJ2ca0imr4?dXZrn^~sDEZ$VT-*T z#QxN(+~MwxkXfuQbcgdnGn^>GR9d6nqXRadxKGwY!k6gTIp?KctAzpnC~6u2=2sd< z8U?@Gf8FEnCb`N4iL-JIkW;Yo&mM!{eMe_xE;834&Gy2y|61=I>oTbjg(OwpH?vSd z*DL)!wq0pP2_l!9EHrn3jZ^neZ3XU%^5ce(u6ZBDb>0ik!){y}-*R2GNsBo*FlCJ; zghK=4+cIK8EV8P}Y08&DXrCfe=|1jlbt@j7G8Zx^cAP=Y3$=HC{-Fvk_G1R8>mQD_ zLUU%rog)hr@h{7ju%%P8OZFnuHMdX>u=qD_y)oWKhc6c@O$cn~Q8zE+LK7?|XdHs3 zA>tNlMhh8K6e6v{PWEV#jO^LR7$#?^9YNX?F)@Q@v8o@27cT8QO#ac6tDUz=u)?ne z#n$p>2^{A5-#W*3n#mpKTFo8aM82r^mBdmaGbV1#Q7lHTL%09&PAJs<^}-c4`VUf* z^%f){r&@=>Lz=3+PFgzV($g8YohO-3gyqJwdL>fh7`sYg`R{c;LhkVju>*uXs|rMH z8KeLdDZlCZ3Ipqu9QEE|uKsfY{JnekhO8%FTRlD9yy`|C`lU1S&|&yjw=nKmX+}wi zCd4)M(6>+jw^5*&2c;qX7!Wq3^jv3h4(RK(Dd|N}LupLeGURvuAb5W+VZo1r%l8Kx z$x*|UXDhWpQ@ct{0+{Nr>}`s+TTPzI*PS&Ty8epKTRn^bTC8D zn-~ASrdG4Ij2Fxdly7g?i=Z>jlr@|?9xvI5Ks0_f8`Zch$f%I3fsAKwCY618bPCl zrRbXoSQ4lU73-mxbgjzB!25+5pSQ&wmM}uk#y2QZhfUNwFl6U#Rc^rTYwI&fX2n}` zh}#}{<0~xv-<5@!8j+6#REN6TJXS*una{0>jDZ4^=rrwk%RI(1gNGiL@|Jni)w;%e z{2CG3Q}VM47sVmz&8MrXP>clv+TEIz+fEMw0%I3rm6U=7xCnXg&;GustwQ0Kk2EgT zZsS%JupIl^CV%5btJ78_X4L#NGo`Hr30QU>Y;Zl};~ZLmr+3V>23otl!6xko0?VHf zQv+V1hx-R?m7}cd8}<**P*YQ86z5RTB3bEAGSR+o7yRdc@M?h&Q`3aGW&9455V`*x zc|=FK%XL|n-uktw`y316LooWe|9=mf$5N6%Uz{_bN9QI}@<0jnkFz7U!8BSKq{Nk5 zKM}-?Xllu)18zRO>B=V$<$y3V#nN{H=h1$DJMAmN{4%nKNAO){&cBND!z{zl?Ir(R zH55FJ0e*TmQTQ-3cB1eCfb;mrBU799XfB_h(dKtPVqEI2+Msho$_KW3c#vGl#;4rW zvAT!K^KBt@T_&9Lk3ah*i>1DA?BG_!$bYPnW)WY%qmiOG%AtkO4_;4Wu$jNG%xd|}W$QK20xe|rU@olN2t_Up?!20#)1rk$fVS!4@3 z91V8M0cQ#%4j1w5@4?4{`d8{o|LXal&E|j%a}6QCGsCX@hlanPzghW*oPVMJ;)(;( cL1Mc9 [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] -The Set up School PCs app helps you set up new computers running Windows 10, version 1607. +The **Set up School PCs** app helps you set up new computers running Windows 10, version 1607. If your school uses Azure Active Directory (Azure AD) or Office 365, the **Set up School PCs** app will create a setup file that connects the computer to your subscription. You can also use the app to set up school PCs that anyone can use, with or without Internet connectivity. @@ -34,51 +34,54 @@ The following table tells you what you get using the **Set up School PCs** app i | | | | | | \* Feature applies to Windows 10 Pro, Windows 10 Pro for Education, Windows 10 Enterprise, and Windows 10 Enterprise for EDU -> **Note**: If your school only uses traditional domains through Active Directory, [use Windows Imaging and Configuration Designer](set-up-students-pcs-to-join-domain.md) to configure your PCs. You can only use the Set up School PCs app to set up PCs that are not connected to your traditional domain. +> **Note**: If your school uses Active Directory, [use Windows Imaging and Configuration Designer](set-up-students-pcs-to-join-domain.md) to configure your PCs to join the domain. You can only use the **Set up School PCs** app to set up PCs that are not connected to your traditional domain. ## Prerequisites for IT * If your school uses Azure AD, [configure your directory to allow devices to join](https://azure.microsoft.com/en-us/documentation/articles/active-directory-azureadjoin-setup/). If the teacher is going to set up a lot of devices, give her appropriate privileges for joining devices or make a special account. * Office 365, which includes online versions of Office apps plus 1 TB online storage and [Microsoft Classroom](https://classroom.microsoft.com/), is free for teachers and students. [Sign up your school for Office 365 Education.](https://products.office.com/en-us/academic/office-365-education-plan) * If your school has an Office 365 Education subscription, it includes a free Azure AD subscription. [Register your free Azure AD subscription.](https://msdn.microsoft.com/en-us/library/windows/hardware/mt703369%28v=vs.85%29.aspx) -* After you set up your Office 365 Education tenant, use [Microsoft School Data Sync Preview](https://sis.microsoft.com/) to sync user profiles and class rosters from your Student Information System. +* After you set up your Office 365 Education tenant, use [Microsoft School Data Sync Preview](https://sis.microsoft.com/) to sync user profiles and class rosters from your Student Information System (SIS). ## Information about Windows Update -It is the intent of the shared PC mode to always be up to date. If using the **Set up School PCs** app, Shared PC mode configures the power states and Windows Update to : +Shared PC mode helps ensure that computers are always up-to-date. If a PC is configured using the **Set up School PCs** app, shared PC mode sets the power states and Windows Update to: * Wake nightly * Check and install updates * Forcibly reboot if necessary to finish applying updates -However, the PC is also configured to not interrupt the user during normal daytime hours with updates or reboots. +The PC is also configured to not interrupt the user during normal daytime hours with updates or reboots. ## Guidance for accounts on shared PCs -* On a Windows PC joined to Azure Active Directory +* We recommend no local admin accounts on the PC to improve the reliability and security of the PC. +* On a Windows PC joined to Azure Active Directory: * By default, the account that joined the PC to Azure AD will have an admin account on that PC. Global administrators for the Azure AD domain will also have admin accounts on the PC. * With Azure AD Premium, you can specify which accounts have admin accounts on a PC using the **Additional administrators on Azure AD Joined devices** setting on the Azure portal. -* If shared PC mode with the account manager turned on is set up on a PC that is already in use, existing local accounts will not be deleted. However, all other local accounts created after Shared PC mode is turned on will automatically be deleted at sign off, including admin accounts. +* If shared PC mode with the account manager turned on is set up on a PC that is already in use, existing local accounts will not be deleted. However, all local accounts created after shared PC mode is set up will automatically be deleted at sign-out, including admin accounts. * Ensure the PC is joined to a domain that enables accounts to be signed on as admin, or - * Create admin accounts before enabling Shared PC mode, or - * Create exempt accounts before signing off. + * Create admin accounts before setting up shared PC mode, or + * Create exempt accounts before signing out. * The account management service supports accounts that are exempt from deletion. - * An account can be marked exempt from deletion by adding the account SID to the **HKEY_LOCAL_MACHINE\SOFTARE\Microsoft\Windows\CurrentVersion\SharedPC\Exemptions\** registry key. + * An account can be marked exempt from deletion by adding the account SID to the `HKEY_LOCAL_MACHINE\SOFTARE\Microsoft\Windows\CurrentVersion\SharedPC\Exemptions\` registry key. * To add the account SID to the registry key using PowerShell: - * $adminName = "LocalAdmin" - * $adminPass = 'Pa$$word123' - * iex "net user /add $adminName $adminPass" - * $user = New-Object System.Security.Principal.NTAccount($adminName) - * $sid = $user.Translate([System.Security.Principal.SecurityIdentifier]) - * $sid = $sid.Value; - * New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\SharedPC\Exemptions\$sid" -Force -* It is recommended to not have any local admin accounts on the PC to improve the reliability and security of the PC. + ``` + $adminName = "LocalAdmin" + $adminPass = 'Pa$$word123' + iex "net user /add $adminName $adminPass" + $user = New-Object System.Security.Principal.NTAccount($adminName) + $sid = $user.Translate([System.Security.Principal.SecurityIdentifier]) + $sid = $sid.Value; + New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\SharedPC\Exemptions\$sid" -Force + ``` + ## Provisioning package details -The **Set up School PCs** app produces a specialized provisioning package that makes use of the SharedPC configuration service provider (CSP). +The **Set up School PCs** app produces a specialized provisioning package that makes use of the `SharedPC` configuration service provider (CSP). ### Uninstalled apps diff --git a/education/windows/set-up-students-pcs-to-join-domain.md b/education/windows/set-up-students-pcs-to-join-domain.md index 245a3f6520..e0634038e4 100644 --- a/education/windows/set-up-students-pcs-to-join-domain.md +++ b/education/windows/set-up-students-pcs-to-join-domain.md @@ -16,12 +16,16 @@ author: jdeckerMS > [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] -Use the Windows Imaging and Configuration Designer (ICD) tool included in the Windows Assessment and Deployment Kit (ADK) for Windows 10 to create a runtime provisioning package. [Install the ADK.](http://go.microsoft.com/fwlink/p/?LinkId=526740) +If your school uses Active Directory, use the Windows Imaging and Configuration Designer (ICD) tool included in the Windows Assessment and Deployment Kit (ADK) for Windows 10 to create a runtime provisioning package that will configure the PC for student use that is joined to the Active Directory domain. [Install the ADK.](http://go.microsoft.com/fwlink/p/?LinkId=526740) Watch this video to see a demonstration of using Windows ICD. +
    + +##Create the provisioning package + 1. Open Windows ICD (by default, %windir%\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe). 2. Click **Simple provisioning**. @@ -60,4 +64,10 @@ Watch this video to see a demonstration of using Windows ICD. > **Important** When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. +## Apply package + + +Go to **Settings** > **Accounts** > **Work access** > **Add or remove a management package** > **Add a package**, and select the package to install. + +![add a package option](images/package.png) From e217169341f2cdff361e1c3476a9ae0e51ddfdb3 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 19 May 2016 08:51:16 -0700 Subject: [PATCH 335/439] adding minecraft --- education/windows/TOC.md | 3 +++ .../windows/get-minecraft-for-education.md | 22 +++++++++++++++++++ education/windows/index.md | 5 +++-- education/windows/school-get-minecraft.md | 19 ++++++++++++++++ education/windows/teacher-get-minecraft.md | 19 ++++++++++++++++ 5 files changed, 66 insertions(+), 2 deletions(-) create mode 100644 education/windows/get-minecraft-for-education.md create mode 100644 education/windows/school-get-minecraft.md create mode 100644 education/windows/teacher-get-minecraft.md diff --git a/education/windows/TOC.md b/education/windows/TOC.md index 05d7f25c10..450b18a3bb 100644 --- a/education/windows/TOC.md +++ b/education/windows/TOC.md @@ -2,6 +2,9 @@ ## [Use the Set up School PCs app](use-set-up-school-pcs-app.md) ## [Set up School PCs app technical reference](set-up-school-pcs-technical.md) ## [Set up students' PCs to join domain](set-up-students-pcs-to-join-domain.md) +## [Get Minecraft for Education](get-minecraft-for-education.md) +### [For teachers: get Minecraft for Education](teacher-get-minecraft.md) +### [For IT admins: get Minecraft for Education](school-get-minecraft.md) ## [Take tests in Windows 10](take-tests-in-windows-10.md) ### [Set up Take a Test on a single PC](take-a-test-single-pc.md) ### [Set up Take a Test on multiple PCs](take-a-test-multiple-pcs.md) diff --git a/education/windows/get-minecraft-for-education.md b/education/windows/get-minecraft-for-education.md new file mode 100644 index 0000000000..67cfeedd8d --- /dev/null +++ b/education/windows/get-minecraft-for-education.md @@ -0,0 +1,22 @@ +--- +title: Use Set up School PCs app +description: Learn how the Set up School PCs app works and how to use it. +keywords: ["shared cart", "shared PC", "school"] +ms.prod: W10 +ms.mktglfcycl: plan +ms.sitesec: library +author: jdeckerMS +--- + +# Use the Set up School PCs app +**Applies to:** + +- Windows 10 Insider Preview + + +> [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] + +Teachers and IT administrators can use the **Set up School PCs** app to quickly set up computers for students. A computer set up using the app is tailored to provide students with the tools they need for learning while removing apps and features that they don't need. + + + diff --git a/education/windows/index.md b/education/windows/index.md index 47b8a29118..7fba6e3d70 100644 --- a/education/windows/index.md +++ b/education/windows/index.md @@ -16,10 +16,11 @@ author: jdeckerMS |Topic |Description | |------|------------| -|[Use Set up School PCs app](use-set-up-school-pcs-app.md) | Learn how to use the Set up School PCs app to quickly configure new Windows 10 PCs for students. | +|[Use Set up School PCs app](use-set-up-school-pcs-app.md) | Learn how to use the **Set up School PCs** app to quickly configure new Windows 10 PCs for students. | | [Set up School PCs app technical reference](set-up-school-pcs-technical.md) | This topic provides prerequisites and provisioning details for using the **Set up School PCs** app. | | [Set up students' PCs to join domain](set-up-students-pcs-to-join-domain.md) | Learn how to create provisioning packages to easily configure student's PCs to join your Active Directory domain. | -| [Take tests in Windows 10](take-tests-in-windows-10.md) | Learn how to configure and use the Take a Test app in Windows 10 | +| [Get Minecraft for Education](get-minecraft-for-education.md) | Learn how to get early access to Minecraft: Education Edition and distribute it to your students. | +| [Take tests in Windows 10](take-tests-in-windows-10.md) | Learn how to configure and use the **Take a Test** app in Windows 10 | | [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) | Learn how to deploy Windows 10 in classrooms; integrate the school environment with Microsoft Office 365, Active Directory Domain Services (AD DS), and Microsoft Azure Active Directory (Azure AD); and deploy Windows 10 and your apps to new devices or upgrade existing devices to Windows 10. | | [Chromebook migration guide](chromebook-migration-guide.md) | Learn how to migrate a Google Chromebook-based learning environment to a Windows 10-based learning environment. | diff --git a/education/windows/school-get-minecraft.md b/education/windows/school-get-minecraft.md new file mode 100644 index 0000000000..01a29c2dc4 --- /dev/null +++ b/education/windows/school-get-minecraft.md @@ -0,0 +1,19 @@ +--- +title: Use Set up School PCs app +description: Learn how the Set up School PCs app works and how to use it. +keywords: ["shared cart", "shared PC", "school"] +ms.prod: W10 +ms.mktglfcycl: plan +ms.sitesec: library +author: jdeckerMS +--- + +# Use the Set up School PCs app +**Applies to:** + +- Windows 10 Insider Preview + + +> [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] + +Teachers and IT administrators can use the **Set up School PCs** app to quickly set up computers for students. \ No newline at end of file diff --git a/education/windows/teacher-get-minecraft.md b/education/windows/teacher-get-minecraft.md new file mode 100644 index 0000000000..01a29c2dc4 --- /dev/null +++ b/education/windows/teacher-get-minecraft.md @@ -0,0 +1,19 @@ +--- +title: Use Set up School PCs app +description: Learn how the Set up School PCs app works and how to use it. +keywords: ["shared cart", "shared PC", "school"] +ms.prod: W10 +ms.mktglfcycl: plan +ms.sitesec: library +author: jdeckerMS +--- + +# Use the Set up School PCs app +**Applies to:** + +- Windows 10 Insider Preview + + +> [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] + +Teachers and IT administrators can use the **Set up School PCs** app to quickly set up computers for students. \ No newline at end of file From 4a649a57f5b0fa6b141d7ebaef0a8c850bc34ea2 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 19 May 2016 09:13:25 -0700 Subject: [PATCH 336/439] sync new topic structure --- .../windows/get-minecraft-for-education.md | 23 ++++++++++++++++-- education/windows/images/minecraft.PNG | Bin 0 -> 144442 bytes education/windows/images/school.PNG | Bin 0 -> 106632 bytes education/windows/images/teacher.PNG | Bin 0 -> 100608 bytes 4 files changed, 21 insertions(+), 2 deletions(-) create mode 100644 education/windows/images/minecraft.PNG create mode 100644 education/windows/images/school.PNG create mode 100644 education/windows/images/teacher.PNG diff --git a/education/windows/get-minecraft-for-education.md b/education/windows/get-minecraft-for-education.md index 67cfeedd8d..3a815018d1 100644 --- a/education/windows/get-minecraft-for-education.md +++ b/education/windows/get-minecraft-for-education.md @@ -11,12 +11,31 @@ author: jdeckerMS # Use the Set up School PCs app **Applies to:** -- Windows 10 Insider Preview +- Windows 10 > [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] -Teachers and IT administrators can use the **Set up School PCs** app to quickly set up computers for students. A computer set up using the app is tailored to provide students with the tools they need for learning while removing apps and features that they don't need. +[Minecraft: Education Edition](http://education.minecraft.net/) is built for learning. +This summer, teachers and IT administrators can get early access to **Minecraft: Education Edition**. +![education.minecraft.net](images/minecraft.png) + +## Prerequisites + +- **Minecraft: Education Edition** requires Windows 10. +- Early access to **Minecraft: Education Edition** is offered to education tenants that are managed by Azure Active Directory (Azure AD). + - If your school doesn't have an Azure AD tenant, the [IT administrator can set one up](school-get-minecraft.md) as part of the process of getting **Minecraft: Education Edition**. + * Office 365, which includes online versions of Office apps plus 1 TB online storage and [Microsoft Classroom](https://classroom.microsoft.com/), is free for teachers and students. [Sign up your school for Office 365 Education.](https://products.office.com/en-us/academic/office-365-education-plan) + * If your school has an Office 365 Education subscription, it includes a free Azure AD subscription. [Register your free Azure AD subscription.](https://msdn.microsoft.com/en-us/library/windows/hardware/mt703369%28v=vs.85%29.aspx) + +![teacher](images/teacher.png) + +[Learn how teachers can get and distribute **Minecraft: Education Edition**](teacher.get.minecraft.md) + + +![IT administrator](images/school.png) + +[Learn how IT administrators can get and distribute **Minecraft: Education Edition**](teacher.get.minecraft.md), and how to manage permissions for Minecraft. diff --git a/education/windows/images/minecraft.PNG b/education/windows/images/minecraft.PNG new file mode 100644 index 0000000000000000000000000000000000000000..c758c28ad540904219300b02eccd5e635d100738 GIT binary patch literal 144442 zcmb4qRa6{Jv~>sx5HwhDNRVIw0zrbi2X`k(fFMI~7+^whcL+MTyZhi8Y;bpX7#LuH z`T6d{|8!q&uT`tN&Z@4{)m3$B*FL90Rh4CNFv&4rym)~lFDIq`;sr|Xa|*&hdzQ?? zPJcb$P@L6eC01fO9>&KR=vfTXiBIDr{G(~*63=BU~UVeFO{ML_&iN*FMwOTC$;cm2B(4mJign2g&uLd^D8I3Bf2hta&{Rv-w zwe^u)Qs7#5c=X56>L-k5bxVs<)(O$YSJqZH-(>qS%Ll_S!(C)j)mWL?tJTy)0C`ko zRP~dwvGmR6#}-Ff+sdh!TWg)2Stdc5n*=jP>eji3@e+?$N6d%3uXWnqtMoL!be%sx zFT%may=|A6QPVcgT-LeE^`~pmw(ytq*VfgP%J*H7mhe2Vh45K&-OBnKIekh_&rM%bBRuVa`xL=xC0n&4!7IO! z2%v)AU0RJ446f4Kca!A(kfQCjiq%Tekv9%DbTfPkn2c2$D%O*?sqQFx!6E6C=gfB;n^h;QXtL#eRpqq<=a(_;^h!(HeC8+G9 z)q?Hti2DrsYr2F&khFB){m5T=b^pyxS_k`YNDu3lxWEq)kATxN$j!a2cw?SS$nH^`381_5RgAm0a z=qSo};?XO1G|$HInfc4~f!q$x1CGSYx92rbE}xI}lPQ*#J2@ZBQT_dSxrMeBM94IM zLl%Z%Ly(KEb_>VPgF$G)mJvY=8!hP!HDxV>3S@>Y(N&_6jM*%>mxEu;D6^~_t*6lz z5w4u#I{{8ZCbV*rE05aT`lgSPMSorq<+I<=*_yOH`ev3hYL0hmYm-$&KPfGLBkZ{g zx%Ka&t`5^@CLBuZcX*jdrVeyNez}PiSl|_t$mD#C_;bh`EardIecVjvy?{yUZ@0Vu zJ0q$MW{;z8Gqqr?e=FivA-ZbuDBcklE>><~X7mZTz4T|+DEh(xqOSdG$ z<3o*e#+Hpeb*po0*^kCnND8jGPDoYCSp5C!5Xi-gWfVi0yNTQAMEs6e-(;2afmO~TLYKM!GZoPLXv7&kVzosK>Z+Ovzx%(usWHcua8THrM0o=Xj?8K z@e&BsYK6YU<{Sw$(wpr7SvN-RkPUbxHfgFu@if47Jgths8=Wo=2;K2 zm=Eb*&Sm{_bQ+u7AEMqeJj{iYu-S{Hu_INrnw@~7q*?Bpy_Mm;LYW~HJTU~wF%U`D}LY#{EVHGN23Y8PyIqJ{IR6OUAHi>FGmF) zx}0uMl05r^c?epBA_%q0Pb9~*#3;()#L#@{frnY^v?Vm{%EN#XXx9yKM2!)rDPFP& z<{9F*WFWHQ5H|n4W5d#usMhbU+a8OO*xPZpJDe0 zMtFveOY>9li^f9>f_z;eOn4L&<>HNEf*2#cM$mD#s4^jZFrD%>yJ{Xb{CcB&SFj#) zIms&Sv**@(`O9Lp77=m*2kbXI%C!y*F6ssBSFsk?1h-?tataY|&`%1CGP_Hu$*7V( zbZV%-vz`(j%8BZ|k9RVcb!0ohg?F^ICx8=hUDE|cU9n;Ch4U9dAzk@E@&Gc5y8C;n zELooS_g;u{6`5RB|7fmd;#?s{!?pMl!jKAlvYe@xzozYgria6C@o-HT+q zOqtW&27MB<-jt;GkL^0D;ZF)0w+mI^!vwq1w@r63`V=?=l3z8ykW~Y(x_`)^Ss>t7 zDw*}{PM=WRz&KBT80xMK3trtjph!b~y{pt>(*@(J;W(4)*0;N^kL3Nz)FWv?f7atP zM(XTXs2((!@7Hidz4alhym`iJNwB=3Zh1I-#J;j(a? zbDY||=+m5L3G&EL9j=NO1gTV;85CC=BGR!d+7+h74K0TE#wV&|@(6;_yh`5}Bq(88 z((*R+1;qD3FFnYcWGHId2uI~h+jr8kVr)Kad+SoF?3!x{`%T6W^sF6=x)*4s7})wa ztp&=>Wr)8e3wh}ncvx$~=l6xd)q*gPbz6}%g;Jc8KhBKmO`4p%fIxuDLYg53VuA<4 z;pHOGUrWCvt&FMsT2|F!HE~a@Pcjt#>$?_OYE-8> z-_AKd%if<5jI64U+|#Uo)WFPLj_zP$;B@%!+zHI`Z`4%O_`wt(64we*__2Fj)`qtc(7%a&g;WQNs0mJGe?$-&QN>n*UvF2zhJX^Lk zK)lpu?8Xf$_&o+babs8fHP`1G$+z+CNvNj*=J7-m0y1aX@29uG%mE^J#4%F#>@inM zs)AZv;n4mUL-aevVh_k_CVeMoIrggB2hds(qb?#P56c{s|8!k{<>S=34~jMDPyRl| zKk)S3Ing4!|L0il-YEmTj|Wbd*Kn=0ptC_)>(~wyubCf9{eOwD1pY%2Y==1GdK`Im z4UoxpJIrwmhF?WVg?5mUk=2D^N;|*SHMUSAsdeO^hUC3Uq#4tSrpVvcgncd;9C&ADc6)IHIxhsxc$V+?5biXg%;5F7)nU)ZS3t~ z(Rq*QRjxvfB|&Fk@%T*`>)VEsby>VS!W&9z{x{^colU%w}&Bl5(8~#4EptQ$S zn3_43{kj1#n|A4UW$%2Ofc6cy% zf6}R@&B3Pyl4Y7r>K6$?zmY4FneWu)RCkx~eB72lG>A>i1pSRrbh8t9-_%Jpsy-w9 zEuf$)ncD!=8!Uc#_~jQ%oJxX^v~*xPkpGt?Y70(eoi?(@2j43e;@DL=h0DPRtkgui z_S52RYwE*P=w*za8*{No$2^NAuLc_gVFGwlE?hD?!=yel zEG2pMy#_+Hw9K}R6~nUr#VJR0L8UVH%JBA8W?u)~zmx$3bU%&vRYXA>7cgUJq6PBJ?NYW?0pCd_?RbP}v`y!*RWRc-v;dU!6 zAAz^AvM2c*p4Dgj8(uXr%yjC;4v_m9!12E?%2&>Ng~Ndk33nVI*W3)ZMP_aG@rlBh z8StT;gFlSmy85HprIbSOPoGCUx&s)|Ldne0F$Vw#oUk zo(n7wIZci88NU{=`eq5SZ>#5Q2e+#3Pjlp-eUQC>*B^kVdE0*B`=U9WswHumSnK?A zvTUZ#+&+!UU*|Q1(z)AFdUOmgaL5MgbLQ`;H=JLWH_S3ZL3CZ~#%b3>Mn-6%W*&N> z$zT4U>zam6p+ab;_9i3zy7xG-y|+EJ04=M$Eem2?=Q z*>++ME0o{p0BR>2j0+iYtk|RjIm{hP;x$Ca{|MBqNg^81Uu)&hUe5@Y!wVS8veN50 z?&*N>aoLIyE~x#Wy;f)di!j?k4Z)5JgHsGQs(DNVR+7bET<6SpI!lZ7!s_1)HSSnG z*9Ch$L|1q|`f`Tb>4k=fC!4_Pyw}SZYw|8@Y&fM14-O1TB4TNCk!|9$l&t&)qq5Zm3}%U#sfa_W-bnPEE7A7cn3R0c<- zt80?LB5;x%1vmaA$GNCF*?da*3(b!~tN1s_HNJ%js_L) zhuqT*?;EVSr6#tnhd_8Ej5---%cj%kZ7$ zzgYqJt{fizYy%X0%Q%+F{T8$-h`d5YEUh6Oz>hG-^3u|gk4l;JsOlA7;m4D*H1#UT zfxVM^4&PZmj)af`b!o~KVd2^N`7AG$x-^G}K$ZN4x`xHFlrI)cB#YVTG!|=jtI>9+ z=_zi*@*Fi!ekf@ImSM6&9#)X{gCB?+cZe0_VIjI)!_^EXRxHsW3|}0H622j|HG#;) zs#Uj;;8k~q&EOK5s+d3$wRGq+ORy4Xt$Y$nAPbYS^lze#c>kFB4N&7S`0QWi#(&Fx z)vij-5}ODmuu-$9(L>2CuTv*yzqQ6r+zFF$dGGG+M0_C@t45qn^R*?Em3hKsd5_CRW9ZTB2Ix2)cP~`EAeXI`G{cHnQn$Kl%=~#a zaQoF()`5t9agre;u!Eiz(+@M@hlO>o*Q~2H4 zR<0UHWi2g(GT~Tdr;LEwZ-}YL$%;P|xqyeBdw{1pHS@`EjT-1Pt%F5d56lF8?DNC* z1&XYZ`xKQpErBn>`5(vRn8= zlB}d6?<=`BGrn!5Fv(F|5%3gQ=V}$HMoYC&lPC*bRwihz*^trhh=aZy%#*RYQvaM{ z8Wa5U1FC1dyfRm$U(FPfGB1CFQU%c%`-&s9r5`QGM1CFhxAuMqyP*BTro6Nf9oGW~ zXhCoGc}Z)}?Wyoa7?juM&x`@@j!ve)4^8#^={2Bh5Tt4=T5#6OlIY13F5ED_iePdg ztDbG(6+D@aKdGuKQwbPhqj5^+smv%zf1oaR&N*Qaj$!u;g%c96#qH z@yF!EzpO218CUSoV+pwCZ#V9PTc^`;cs;wkoTGf;B=U4FD_TEN>5;4guIA8OXzMZ_};B<=fUYyTv-2+10ky$Pc)$T7z}r3SUR-zK0$j*O!!VB}GlMqtz~S zz7HS9Sd!V*`&7h4GMVB}X?LhbdzWai0&1QKLd_>G#?0 zUSjPN%tDC#k>Y~~2j^4fQ3(iW8q0#`_NGdHl3%;JTo;Sv$J@CTcSL<+tC&bEDs44! zfg!fg<@t&)tdC%^?OVsg)C*%f^a$pC^5Hy1Wd&I)$lT17WZJDVP%HTq2N(O^6FnGu z4Z9i9Q%BUo0_8FS5fx+9^@`qy2MrY+KPV^muhmhuT5eFihyBR%ivMP2l1`sCPX6ic0D?H zI^B701j;yP`jSMIyJdG)fO(G1RXdR>nIsP>?=K7{tjEvPLAG(`F^+u9DvJqrk`XE-W|Ko^+to)IlDu-2~5n zqaOdwjjC%sYhQbUGl~+mPo1RKj@Qi2@&Yf10^PV`)j*JwcDOMwV3pbp#yKz_?s9VR z8mmkSfBq*~jq|uqv&!CeF_rtnwKl5;gdy#HuhFEzHX2>1LYQTqHENDN%Xmb2eclJ! zP0wgE9Nz*`pAQSQU5+Bx13L_{fe}I#e`tNIw*CxvEA9v=`$B^q1ycZcT(M00hjDF= z8AJ;z>v}aNw}b96gN3R5O)6&x7QkuXNwb!}&TN#=9s}Cj{!n9krH%DNPhRiT!pxK6myVt5uANnyHz^j!qgB;U{5H$ov69?uj0^*osBx7Q3ulD zsU8c-I*%em9V$UH(yP0|@a2J@nn?6jpU8}>8lCxtoL@t6(l@K_z7xhiPqrs*&g@lW zQ&zh2zlwcsQEA}ZGc)yW2rBqeZ@&Pd+v;h`_~P>F*<`9TB2JOP*hayu#m-|Q<9rl# z4ZN)p63BWT&_DK$eFEvHod(k`!keJ*RXg{UJ9k@r4$(^hO`|N0k5s>qXA_Yu|0L^u zj*3agR3CNXNa=9!M4n{bgFVlOHbF|GqYTfQnjQ zt1K2mt4qm6d?S(AywLL$N7}nnAwP0tWt;cR?H08n5gpxYuB@-W^m>AM-RX*^BLEm1 z{qtSKobv#BcVRJ<`$O2R&fx^#;but%4vyOr&z$$?>@LEi96kjdRZQwZ4^&M*kw*zL zg8;`kBJKBpo~eD&j7(ik<=SuGFi8fJDM=L%w@jSS^JP|s_&7T2EpFC>Xj)FeIZCp( zm~9qgwQKRc#g#e!JOjdROB(KRuE{Me`hup&$7B2C_Jx}jcYw}|Z<3D(9E}U#gQ-)E z3YpLM2*@cIi{fPx3dfX1wmu0y-I}|UPlg*ec;}C%@=PftxXUS+RSLta@QfZs5S?0Q z)zLn;lImhp%Ws=ZF)*U<1(xb0;Oq;O5|4<}+D0^(;_^`%pL<0H3*Fry9k~U$m@JiN z6WZF^ae#Srbwh)j;C?5n-OA!MdFM(d{9F>RnzhoSG$&^S=GmOk#kvxbq^T*_#dhvS z13I46UYpqOe;xgAZ)Zk}lqQyEmTo7X_~{2)128Ee(Sj=JJI*UIN6)iQ(EE?C0EEr^ ze#iWC+~<0{>=wD%6(3()O%>&O%f7`HBZUpw^Szh2SEa0 z*c^CP56SR6T)0^bU$ahz>=7Vt>%sM&&Oeq^kb5#SYgWmSE3+l%OpD#V%Bq#UQ=3ZA zHN(vzpOJ;h?KrXq`2^*&-^gJ+?g4v%sp^nj)S+Kr3id~RCb)V(V;Z5Rq*R{ax;t{> z3TTq5gLFM3aI0gbO33mP0%-)OOwMlFhbj`kxgPWsn6&X6rQm27_cNQo5Tt zgVUO}>tWRQ>zoB*@c{w!N;cVk)05*n&Ow?X{qQgcHV{ z6b2m=#*p1(ub1s#)wJckADI4OW@8Dl^Nn6f?MEAxOWQR9rR)`s=F`0Mmf%HXByV|J zSB3YvZQNYMXhphRp_0I~ug5lenRAg!{kwSv=P^hB{wrmmrb;8~kz2eI&BYnuuTRUI zr|AkMaLJ!<-l#l!2`{Q?QGl317)Lo>ArJImTC}g9m7;;Hs4i$|HlCTYcqhfU;43ZL zjkotEkSP{)D{ee2H*D_yT?xl_NIfY*((k?Ca#1jB$jT`k_@=49X*XSeNQ`G+~jKUl}9)+k9`6tI_CV zb)8PvMHcCcKk%y;jx8LEtN)G&i*;1#$Xkzw(p60}lk^s7>@c6Lkv?#(AB#d6ki z_%rY{@sz)zzCmBoCu6Xa@Ke3P6Vvz&OhY);3{?!=HU*92vJzS&5xq`ON)eKuQ&`!5 zIP70rGzOk+Y5dTz2ytjRfb+T@YLd|JvrF%AwM^|rOAtA7yW`MEn81~ ze)}LmzU#*H_Dv@@f)6+ZQhyjTyu&Dz@J_UFAEmf^lLPF-Ql+c|7kdQWJ$6w#*`z?N z9qHu03F6>fEE0VUKaW=dB_utW0@*3DyaVX@TuHveFrRVlgbx~_L^j1~tR+5nf@0I~ z4@a@w@Hjk{2qtiG&%yg>T#+6f%Vm%A#{=}dC{R|LdhqbEhLi%mFpH7I^zzEoj?-nc z%4725K5(rbul-E8!E984A2)arv3kvp=x>CWvDve!&vMi#RyIwu>|`JZk{zmeZ0F`D zWizt|3nhsexWCl%aDSyAkov>AMNf5R8-+M?j)AlsIM0D*5I2iQB6i3&I6L!Q?lIEm ztn_B;?4k2!1sEiJvz;4OwEA&x#{#jv*Rda^t@<|YN%0W482bgAU$^x8;UfJz%*Bb5 zpP))3cH)?8T-(4qc4O1vVaL%-{sHYW!|x`@U1U6+7U0b5 zj5sWZx+*FP7jag(X4<&?K!JFQ?y&#jmS*OE2x`E{j<_XBfMZ0(w>^EB{d@1_(?F|7 zrxVEhHn4Kv2vDdb(o2_HDRP~5?6MLwldQee<$878!su(q6ZZEBQM~3kJw_GG8%&9%QRKV;7nqY|i7nkPC{%#j!>T?jV>q7`^~V-^2*g-9eN>=sHZS}2esAH| zIygdb#r=c!9CP~!)8pvx$?NL9xVUWYq%oBQw3dk#=|D+xM1(lOzG}1l^Dy;sKM(a) z>G0c5=Z=sct6lfvHM)H14;y_&A?w}HMHJV@-Vt&oP_4VtDuA74Nw8l zseS*PfNp=eg%Aby_P@sI`YZgr#zhC1xJu%|RUOU~tWV*PyL_LED{yVtFean}`Ggqu z7zS#tO5%zP7AS)q>bdf8uCKL?wr0g-vgb3seulaZhSa=oTk}I#OtJJ<@UxM2TVtSp z+da|`BqADDA=a;kR%xY2$OT2CWdME82FS_loVukFu@iE^j=^(6gv= zNm|{ND?JlweRT3ZzkW@=LFaa|(6IB07<$8%m=};7T9zLbBjRfR?O&!_5hVn2@t(D^ z?5+{-F}U2gp?mk=;^@eX18+E$`P1uK7Lq50a)lqN%g@BloP80S`JB)0PXpNWOP$nC&q|He#M{mu z_@X5M0$sg74JRH2RE?W}{Ec8qSH~0nQB?zHp3{~K;PXO7Cp_yx;TJOjlBNTD%lxfN z$cOc`=gEo$Q@Kn~KdtXsb)0k7!$-Nwz_9x10kFsP>OJqI(@tN5^(1EHk~lvLP_92= z;KSeUwoR(D`YYor^=H^FV)_c>tmE=0@FInyUf2z6MbmWXFXFsjiR$F3U{Mb8=!_D& zv<63hMgEz))3)XPM$CNq&(x#lRS#GS^Iwals(>Zw@KMQiMw5{_YYGjyWOcwz^%${R z_sLmf$);25bpQyykKW_QYo1}HYH9d+%L8$Wud|TY3NZ{~GY2i4R|!u)B^cH3-OY~F z(&!~zB%vONtXh02v!;`hL!TR~MT)>O+`esf+$13&&l9x+IvAGRFY6TH`g?d&kWHaK zK!hI_$fILI2Nmrvp`e3dg7cK9DxzdlX!ocsL(TP4$P?-Gj5I#z#Wwn#OJe)0IBxCR z@RRC@v@~rE{Smqpem}9FAP!VdP`CS*TcP-y`4?;N72a?+Eg6nNj3!Z3-fugdqi8@b ztXP0qcxNx0W86&L>{3FP5`MFf_it!6D`G)_Q#YLzgmP^aO^=O@E+}2ZnZ`KLAB+pb z1#42M-$`@6m#52~S{JcKO6D;Qdq*MQpxa#G+d*%{;vD3AX%a`h;_A8AO#HtTH+dTs z4SN6YUQUy=X#&m_;M)EkI0{*~Bp(0#Pmf`P3hHpA)H^BZx}A_7yxJp?8~oNAf0`-~ za(kd%nYN0676&I4@8Euh<{`_-=X&NQRK*(_83B=z8nzxw*SoxJX`}L}u`})L%q|K` z{4rL>udbPEt`SlQcB*;YX%G}rFw5wptHQsiD>6W98lMtd8s1^`{!VtUEP8E`#%mkI z`tFsi@D^&n=bLdC2|PM(OKHnP`Gmhx@}bRJE2S+lD#Pb;f1NbZ`p%Out9wU2RAUu& zSf2P7UZeC&ca4k`>`c+@=Q={I@Hj}#UO&~KtslMk?vjrORZk*c_iV=oO!oVC_444- z=n{?7sHE>@nW-cQ!;Fe5N~%@7Z^)OfCKlY5Cm9!e`K75pY*7v-F{zW+=i-Sjid==N z%!7O$TW=tchghq2#H!$lfyrY*PKbEx<)xzCE^OiE8sIZtpps@IOVa=u%@7{CSvxZY z!m5Mmqp94AY14H&cCn@P=MEOluCH8xaAJVk6H4oi&m0Sj0Ca#2ehtMu+RAF(<$rm@s&vhrw$7>D=q)}Ti}#5pblrW{3b=kXBAiY){(4j;CM8-W7PNh z2)u*`x>U5)Nzqof$oR=>D=8f3?=WN^p767EyG7C-%v~-%S!AKZRXWM;skz2zbYPl# zx_mJ39|W!AV80gy)&T2Ai~m~WL(NYlS60UwPu!Axl+-5Kj!v&!=eSl%If@%N*dOxS ztvCI&OEEC1WA>6<;Y-A=V79`F`6&D4akRYs5lltRQx@QyB+`D4<37I-OK_dH`?YQ` zX(e5(S|lAZPm=!6PYtfx0HG3L0q?w6B``H{TyoD8OC?Que8evqe##u(jBma_P8Ahp z%G!v8(^bXfhxQqzNu>?H4Xe8G(nn^Io zZmHs&RXPL`_bjrGsM!A5Z5m}KEbw56^e}}b5UMn0o+?K>I6NMir1xj8qLfya*M|~P zl-JkKJl!-3o?I}JEIjX~eo*joFBu_k3)y^}{FG8uZA&fdPVWYcxa6?PbtMdR^nS1= zeQFS0c8RZV4(Qqy}z(K=jZctqDt5%F3JNg8(UPdUc&= z&O$CoAGf8G#wG4V$oCcfG~~JDO|&4=L4$F6A&95c{)rB6NtC#qXI6WmMT_;=4{=)0 zxGVY-XJ)6ttIr9zJ~?1Fx>)~|b*%5hZgi1QZktFF@qWYD>b!}d>pL5fNTpHh*pnAx z&910%$uj^&*(-ofeoKI=S)E8T0zYx``wK)uS)n?p1w9obOF2=+b$IQQ+0>tCw)|wus13X;*>vlq(DM85(F9JyP43zuowq$9hx8L6xAc)ysa?<2b&KNs+63P%R?~`+51Jvezj}=IoEGv@zBUOO;%Gua3Kd&uW=}o*i*`m0Nozj;0AtJvkxDZ&I<=vbgt_ zB%@aWIwn{6rNzwkgv1QSw}(25@{E~3bd0ZmJhO?CC((^h#x1!fW4eAkfUHO9n*|Q< zG2^>1tdmPV$joWmkuu`S1i7s|D|vNRk51F1qr7ZL)}&1l!!TA9%0QlGw{)6pt~sM? zuT`J8S(z?FM(f7+aZxSUy3%U~KWWIpR4kY+4#mv8%hK7ztP$Wb?cmTdo}1UVVtazr zMy@EQxP%yS!M~9ueMj^|*AS^tXr^o2sT$&Bv9&!yRxnvlUc6dX0tE2i*+NBiq}Prxl*4qo%wm{v(l)q&Ckg+|`4BK?PKVy*b^i zDWlwNNgZOTA69^+vE8j+=Obf@5#`qx@)<^Q4|sv)D%~NJJ?8`a@B>McU9=`qNJ0)w$I5ns+1CN zR2OiL+MhwJSb|UGCF^^FgG-f1Us3a7)uE(hYW*U{B)JIU9XkW|ORK>cd~15VYfhuZ zksB+|>iJ}@Atm={meKA?c?U1g$B2DqR*rL?9;F!j+8)98k<;*F=HgJ(`}`)>ykkl5 z`L0zC?OvhCaQ->sUd!g)!oZyOJ*T%78=+Nws{zTtW%d^?_O-SL()p&G0rbrSTO`DR`P53B8IkyA0wpFktl?=jmz#b7wUjX(YO_w302%p+W>AuREV2*EHN+!rpBwY(BlF=l6~{f~_Ov`R+8s@EYDOHNlb7>M83|GZ^(%JjYEwM4rmyczRrQZ}}|J^O{Xpo-Y z>j4LwtK}?~bJJBUF|m)Aiylw5KC(T`3VS<;$!Odct5Ndx?|Srrsg$f&ZT&AxmA1~) z2^uNMXZDqb_Y~Fp3*eWb^X81=>QY$C5xOYm7N-D0L*sHA>=;-`U?$AN z2s$}MP`~w`ZQTUxHU^(nn47LW+v}YbrJAQ39JhNN-!m7L1a*G9Q+k6*sHHQ7?eWHp z{j9Ep<3DBG7tb4yd^&;Q3}e{}2ctd9#0ojv9YTf)~uPt)x=RUu)$7Bw-<^IM(Ip z_<3$UVNMkHfn}8$%U0%}9|;#+nO~3L^&0w)YmMA^dK*clcbgW9dG9+1e6bD;ZMIQj?Zr}QGKH=)rtIV?Ak4ARMqHPP zOL}&cQ-&+L1Eg&)qwKodGGdqA`Q;KqMJDA3)%%CTN-Rx@$!fAuS7@8N-~LK=9lfj} zVAb+6_6qywnQ>}(G_@1s#4nXSQnfAbB(k#y7(<{183md~c!9t^sQy?0XnLneCv$S! z_|--H4@UPude>77g?^H@H^qao5vbH5XEZEzH)FmT$pR3*)2tPYy?inDw?7??RMgK( z^Xy<>jn>Z^rahnO`X9uYt9PgF77owEZk+UZShR@$`JUve!SpAVbsg20zHbWkWo0sH zuomb9R5g8_zqoGy*?u6ig_w{c<^{It`_lq`{8jH2Trzxf5GO+PkN+?EdLeNb*2u~A zTJw_Ec5DYC;jzs8$!J!eZy-~@X<|(DQHl(^R#4k*;ltF?aUhLaEhk{=;1TQk86q7nkH>7J%;}OGAInC|*0%v5UF~@HuTbRkPsv9q87>*{ z!*(H;=;MJ(JoE1u5S`LelwIJKnIas_vrRxi-hOcX?3jz=M_PF0B7qzX5g`InOySJ4${&QoC}Eo}hDYD`2X?FvtL zyOLb6^%wTDsCaT^WUL2wvKm{b1T6D>Tb(9m*Fddo$UB{~wgz@Z9|!c0n@z=+ru%?` zFTBoJxi!V>L89IP5fo>L(LzuAJghkh>dtx?JS0RZc2JjAG)*C~;{aJ;j3{8{rA?Ee zd41W7Wx_dL2HGOpV@Fq{#H(oh7pJ^?Sxe$hY%v%w4wg=Z7=&NkciHs>;kY3m@pQWw zMJ_`BMS~u;dP${)a8j~SSeKCWg7;9oc~d~+HO?26GF7=%`B`_zy|`2H9~i>T{Y#Z8 zNfHsdB!@JyeE#c4lq!+UdcLXI5~zM$;VIn~Z#}`quQKAJotn0>B3hDMS(e{d`Dz+# z|5U=-Tlxd=nO4xnTbGfN>YbI`3IjWPjQJIx899VxdYVR1d+ldiM>GUXcKK2)9FeB| z`bWmgHBpE~7dnaIxKnv%xGCfVpbYpF1@k1Q4hv56{-aq?Hu-(Atg^mO|LN9;b<3vP zI)av#Hd8jF-r!5M#U_!3gHc-Je*3y>%W%SuT}34z~6PV)YK4XrQL z86w4xwcrqu?Ho&xk7qQ{lg?M!lK%f?Xzh%=*=g-OqeDVMJUTv*=7Jt)sxw{@Jvm=L zOP)n^U0UJ0bl{&mTlec>clZfid9 zL<`^iB^G+R-AY+;TN;&-k*P_h`=8e`sfdV)7c^9aiTOT1w^d5&*h|Ws=s!)>BlwYO z|4Dk;Ww~Ykli;^fPLlrjN2HFO{+B}DW7d>JL`1rJdMU*3b{pq%b8~0c*1(Sq_}kyt zyxD_-f*uB?ZEOxc0wAQ6lyw^$8^?{Wnr(`b@2@@>fj-7x)Oo*LR5vz0-9v#PIy=Q~ zmZpw2scoA2+snH=+J=Ic@1b&2U;~hdZ&E_SEq+XN@_Rm`7dAuj;ma^Vb@=WgmJ`BG z@nCB3WQ5!4V2S({|59qh4wP&gO-RFDZVtsGpKOcweR6UHR==!Rhwncn!WT3}90{+T zrlMpKv*%}l*tdhuGLxh`;;PdGK4!M{7hQJN)>X-E+YD(KT9%giE53-62D^nC zr3liOplLPP=Y9NHd+52wb8lSW8MJv+&xOWhx-Hu9I`97D%$G|AJzasHPCr6pz+Q~s z{+@ID_jcY+fuAgF=PIsof2_A{5?7x4iBYt)ww@HEIgsZ@K1>xT)yAucEG&r|!Ph_# z`HyYv6|cQKB-Z zZFBOvE=9y+VZ?a%B=3{QQ!k;4UF;cbr#F=Fq>sb*;v)=o*z>##y`9Q{h4F>H@jWzI z-`qU6k;*r)fy#3`Htn1^75M~*v@Z8(RDhj^nb{5M5EZSbHTjCk4&7(oV(6oPIeV0a zucr%{T@N!wK^=|$&QSG%>0*t?bhpPf;CoOgy3-InYd@0zymj~8lv+F&r4h4aTY zy(&|`73Xnb^9RB07)e84RHX6#@8st}f%3Aav*WxQYk;cl9P@*@X$&vMbC_5mmHYCq z%#ZdFZw1iEP*J)Vg)tN;q-8u43=9m8{7F=KZBz%NMed6V5BB$~D!q4Dl}$`cz=c@v z*)W@$n->l~o-}q`vsI$rcfj&F7DzhIU(@LRzHE*X7gKXe_q{)0Cq4JO@xBN*shfj5 zJ+l{Z$eQo{6u9O4JS9`SUxZW1a{wu;jyNae*+$fwJU3n0R%B-x3f*k$3_&hI9@82F zd2@=^uT*?5$s`Exf=)he!{til2~PW7Vz-!*h3p9^fWY{ z9pGCu?RYO&5`cZgI`hw+ZBUqU)0HOruz^>Bai9WiyUIALGeO?ZWuoOGPu(F)BDY<5 zUMuIMsdAG1FmsXjBniQU+<;Xf9VghAuutH|Oth13(#L0YH*VrqFJP0;e&wX$H`V}v z`%{kL+HF7I;(xVqb{M-%O5e~RFKAYI?<4OWz5Y;6J>mK6OWsttw~yd#dG2NGncK9v zp--SithK{eTSFz#>-;W#uS-q%qqDb^0ABGvhZLg=XCc@su(4 z1}WP3cmJBFgT-aNcfWvtW$s3;k+7^QdZS9>nqvBso)PT6pJ!r9&^Yy5FCb>>9{Zhz zo$%R4!g#pL*09kbV@(A$8_#lfZVn+Pb5MXTDS#uZAG-VUjCxTHor(!&N}9}Ja#|PQ z)HMFv-qw~PH{9>t{=oU?su%to+e=Wt>Jcl$7jrh_ORG1$trz_i!rdb}Xy^}Eb-9C3 zxKkko${f_jDUrrI*W|(%l}3W53mCzNugeaavJd8CqE66ld3ZiH4V=I;N;Y%~U2z&= ztFRl0XRhcGynOW>mt^BSuuJ)Rn5=Tu8{NkLTb|9jSA{s1PpWc{2gdITM}VTN{;6~I zUM4UqQCc)>9pzEFE+xqxci*_$tWOt2y9fIMC#5@ZcY>l>fSF=MXqDD=Nb&v&1k`-4 z`O3qX?$}KV%F3vwxX(O-ARo^L4g+uaop+l)eLkh-mFAXVelPUjeDL{++a)1(;i$TQ z;6I33iIz{)*=ZRTrE>WT&u`}owszaBH!A;c=Y&bVjtiW^4?4_fc~{$iivO(76{kT>1d67dpEmW3jKW@=ZY*06!Hlwm)yf|f4g$#yQiVk{7Clpa^j5UwiDgk3pcRO z^`5b@ePjRd@RHll{h$TKDVc*tHl+LVB12%qMov-K#*v0@R2ceN8V}074JE8%n+xT7 zNp;}wMFzP09g#KYZ#SjfkCBC&9$_kkGWU$@2EXE+$QEqi?co0kzT9_C=P6iyiPub0 z0NuB`|NK5dye>Rl9o;9=uv2z;>)Gq`w2^qevQrK{1AdD8`m88ADk@pXvR+-M-&n zK0kf_fw{frIj^~v$K!roPuJOnm4n0840eU_93!rUOzq~+gl%zdaTUOx-d_{uC;NYU zwa7nGBKimUb?Vi3o^RLx{-;mWscraJB_)Ld@ciQr+VZ9T`?B+aK>%mb4Qm`w7~(C# zD^Ux?_~0~2o4nfOM6-B0ML^?w%1t<$3!2c4^7cn5@U2^=FjO=#X~nqA>f^6|#=S+V zx#vM5v|)?(0`)TcA=<4&*m8y+??sx9v_G`}`=rM&?VfwN|NV3IbqdesBh}$wd&$4{ z0yZ;ZP#wG1FH4|a@Tk6`9F!0Dr`UH-l7hxC2frqhk4wf(uairRPqqsR#7|H2TwJP` zqCYe4Z=W2tdf@K;MDe1DwZD1i+FAeiQ7zZNAnHeUo;+yj#GJJ8GYld36L6ik;#8<8 z%`T$4cYcytpUdlVggg?ugpGL@JJC7d#P{~o-idKJnqK(sLC@J-#bbDtg= z=gMVtg@z~o_xGQ}TJ#Wp3unF4F|)CLKWvi(V!L>zdFK2_*zx@Q9IEI}h`$zhc!v(& z*i?CC(Ga4z8z?bucWfWw41bOepw~6G%qNkc2BEh}Mlw!IvdpS2*M+NqsD&k`t9K-? zjpLtseSKtV?9aW(6<74<5|_c+3t8cs8&t5Q5@0ekopkr;lexoKlovtWwx;?)6W)P! zNoKMeA}+8hYrrk20>L-)bRPcqG_D%3+OfZoTiKVenai%ih3lXqseKr8tUw%xMq(W& z_q@-f@T8y(5uPUTC?)ig=rTi5tMZxtBd%1ZWY*nksh^$aJ!z!(-MCsKgw3#q6*ip6 zS$Uakzr9pcO zqw!wK3Qlyo>rDb~#o`U>G(G*t{IztX3oUcc-a=Gl7)#=#_OBT4>Hn&_U+I?qgAOP1 zIPUx#6A=t)0XqH^d%NE|wl7^1QxfEht%9p^cd6pqL5B4Fy@$s*%TtVI0 zg_=%108a@Xspu)Mlgf>*aw}TD`GW}sm9)Eg@PpdB3An#R;%yu&y*_8O?a-tl!}==~ zi&31t{CTL`^umIaUe9H;81FTapXVptysP)$De34>S>DT6e+g;J3A4kESmceLTF(&m zmvAf%GkW805f4W*F~6$*(qpPN9_K+t#1iUcJ}UOLT+JG8<=7u8g2ZNLj#(RHB*zGo z?(v&v(0+q?;P%!&*{?8vt;?k;nHx>7hhq%n&3A|HVoBM;1L@OystOfiG^pBDgS5$sniU zpj)yAW;j8XN=hUzNu7$g)(8$8_FOawc(Cqen;t=D{8^l@zfVf9NeL+0#<#qpF*Df zUU}V-xNSH1SY}YyT!raiu {>_;gmyrQZ6al;c03*gKc1bfk#ykB_nFw^*S8T>iY z$5<~F*GzRV^g+|IK4}FCV%)2iA0`Z1isl<1`oG0%UGPY6PVE|~{7jj87A1WM4rXSJ zV8#q*xA|q}1Q*$DC6dEzpoP;chbEVRLe%o2!yvq=;`D_JP&Kp|%0SxRS624b(xU0$ zlf-L9?HBrSzDy@;r{eh(3kVM+Hwuh?S%}y1EVSXVDREaH=G@hAtTtwzGjFkM8#(QS zut;13yRU$E8A#!aoYM@I7P|HBslmdHPk!xc_AAS&23W=^$CA&1OjYy|;xN_~BU5uO zjH5f{xg>nNbSQ@3=MU79pTzjRFNV(@lY>;$W!rWY3=jG&RIk0|)4WiLNPYGg*V+Rn zyZ2~oPtGevLO!062{Z*R@oZSmvjclzBi8~kW7}e;C+#Kh(?jX#!3@9qX0D`yl_Pp! zq~HNNa*IBD1Qg}NA-swwD?!2cVk=O_@$!O7tH&19qIhLrNqb+4$qP~@{aSL}xCAE0!Iz}>B z_O{P$C3~^jbQU{1^@~W);LUIB3Xa+Bj#?YD1m8m5>N%n2gSiiIEMGDAY46Ms*BR@! zHBv#^VRx)CMr`*BtFqJkc2VaN_DqWAmk(lI*Ynm4_VMUZHCIsP>Kk?mKQ>K?AwMd; zGb6RSCp*K;ZWfvSMu}Plbjd9mgo{rQ0c+~FnK^+i*&i%Zwy1p}Njs8r2hksWOY)3l zY$|sJJBIJM^l`v%M3_*GtH;BZ?_F(wDBc`v;Y~D)lU2ZW%`9OMW7bZngy**~62m>; zpYaQP$?GxdRCr%E0$ulclKE1#Zl&ub=hr13tMoXhMpVF{sTZlG2E0|EqXo+*s9)pN zga}^d=l!bwEL;%Vd%WBAU0WuiDBc7GCfoEahN=2Xmh-zGuV4Ln2e3SYl#p-S@9KO!#)S4v9X!0Cy1C`*;sJB?x;G@bL^^RL?KZ@mB@l zUWXyt+$X`0fC^65A)g&%)%|^bu4`)ib16Do7{%S99vIc(zsun)H%q)gxMGAvPG-SUL~yer76;jT8#c=ji#CsK`+ zpu=MsgsjyV1bKPONh(T-=z<2zKwGBqY%JbKsWP%yrXoW2)48fzDVqWT%?7L}upqDP zHdzMSFXokifCVA>yDQ-^jn|pjG6RS!0G2V1&RxRV51t|btO$ukcl5atFUz4 zQ-IFD?swN5(b2{*03)8NF;AE1GUcvnm`SRQq*sq~k_vz$WWemtd#bs9e%-A*NT4sr zR_PBX-K{L|xLo6#68P2o@hz2+UZ4FVWDkA4B&-!>ssV#VKf2*qo?nl*ro0Qjua>0Y zJzn<73U)Q;m5JRWAG`x@T`LES@3?WI7w_o@X;Op1 z#k3abHbqniT&IH%aod)0bb+-{KAPiKg7+tRNqafEN27+uE#-m{=E5g8%vCl+uh7R9 z$6RC|z{E%Xk@e}46-1H}4tSwCX+Ke}qFQ5SgPs&a`P-P$yZM2pg2nvsLjCm*DZqDb z5!fWJKtV`Q*6oIZ_JcYp^6V?9x-E@rG~KNP^;N$XpyazGPb?iO38g>>WpAkZi>Z0| zx<+NyGIXOJ4KWON&F1n!8A4<))ZNF@wLLWJgqxHAt-Tt_m6WWQ2#T|(0@zSkSwUts zSvtvLl)gno63~5x;Ho8wZwXUUbMs=sT*n7)y7c61bIg3%Hfb zl+H+dPK^P~GIJ@#{J!QbxI)cq0(ZV?lo0%S6X{_EG1q{d5$Z5~60i`$x%1=Y+t2mK z-HG|zA~K!=8ng!8I{5P9ca4`Lq!r^?1>X#9Ii!{Rn;96XVk|Pesz6DqF5@HtHkmED z&5X5lZZPz4kxRUD{Aq|YfWEtpWSaf8KX`t+uaEaoOqyoRK@$Gkp!6D&rmg(38AgOL> z3Gs9UWq8rt-xUy*sc9A)Aiex$1${B*(B`F)7}3&XG=>_EI!m-G5B+1`Co^r^+<=}Q znXn=)`^U<6yC5gh9r;^W%7`t-|cmDGRV-UWbjchN)LB3$5{K-2|ZGXo^H zM{`vAf_^)b3da)H5J-XEaTL+lvkXX`o!E>B?RXbMmA{ah(GW@!y z+jGT0&BL-SbU3PYKXEpQG2J zm%%OS=LZ8H_@Ct#Q~LTOBynSm)on)>T>C|dU%LOezwrJ>hpYPMq@?S>MF&Z&t9h2O z4s;r)YSt;9d;pMPK)tiuLGXbgUXEi+_w{aPpP-DmhwtA+vLmiUH%4b z*64!}LF2qn8Jj9{b7oQBGPATS&OBKc1zFS#* zg)Klbvyc$msLdNv4qtr$gjJmgg{NB-LSb^P{Xt5UtG1O#fbeep9}Cb@*Y(OXC4s9E^3y zR9Q}7A=3n_>%2%wpV;3Q=WgodK3+BeTu%@c66{BJ;3i3Ct1qsd- ziTt!uv&N&=LECZSpPWa+qr$7V5DH0=1&*B&p07X`6YBH4a?w_0fd>MtolnA6 zJl=-VzvSgxp=?9utALXeS}NDeOuwd%{+9Edc?RlMX9P)4g9CM=^C4P8wBoX8$UltZ zC|nEbLt%-5(@`7r;6Msav^$A(sR-d;Yhee{H}j;E-Ii0|y+X12N`i6+ZKA7`DORdu z6+2W3uG=Tylw~;UH59~mWZ?E>gp4v<+BWN?XPbW;(EvB6FfGzuP-bE#@Ma zBoJ$^<2bDKp(LJ3G+fSDtEsa+JNkQ>3gGu)=9T{46@<#yWU zMxF1p`paOcj@Im#o_HHUe2VV%Bepa>yC8C#ZAi+qeLN(j$T^GG=^g4i&YAl%Hh`p8 zS_W>sp?=Xqf+%lmI45tstgh0#k$X+jR;FWk`R{+4!beU@0l^A`p2vzWzd4yaE#mqv zticopcL_vPUgc^2>+YSv!{E_2SYOt6Y4^81VQeXC|GMyo;U}JD4(}>BLYBPT{ZDcq zSUZUUmSMIowQd>C9ppReFTkGlS>D){bKb)CY0KYq{hzZ0KBDqmO_R4e5E8^OZ(bmZ zt##i5ikvoa0b7HPjF0tl1P4 zH01f;7w&ooNq9Mj-mU)31)!esE{4t=JB6JzU}Q2@pE(s=Kct6*eTlL z-LM(ksWjve5gM~X4Z3-!cbSeBXR5qI`N+eX*p6mjaUg;HYyw2J0F;`Pn`DU6=V8!t z_|iX;i?*&LI8BtSJhowJ5pVCy8u-H7R3vTw?o2xEM7yCtyF;V=rK2}YuiLe)4Xzd& zk2YyW%HIe0_h7u=>(wXUXsOmV@f7RrYAJ1!WtBMG99V}Cr4*}r~SFdO(f83tnjNEfR@?d*x zU)TS68r_3)hFuP3RzCkYg)`+YR|36qOl*9_dA(uFBjj)Cgv>nVX3A~3y(sNV|sP+$$|HG7VeLcPwG*K34+s9kUd4OhljN- z{3WQ9A$MJRfv*q0rc1xW-?&F{<>xh{@|a8!DO&~^|JJ#AeswfCj{LQJi2#Yc`sDg@ z%bj6F#t9eccvmqoN3PaBsXsRu|B{`e*!9+vmGBh*9;bva2S53gtP{jp;n^0$zE4CQkk9uXly7rV<(8y^ff=KsgW zN0O)KtT5WvlFrPa*SG#Shv1ve3`=4SC>dSy;pR=_RKN1o#?J9ih?5d@@#OpMjq)Oio>_LyErSLrE=H65^=%NMe~uJ1&svu}U= z`}E&~9rorP>t-N*@w=8~|47WkbPe0a3nX3*H`ER3&ZT*}x}qp1u4+-AZAVu{7Z{+b z_f~55oeya}h7;k*?Ug&19rSzWa{FJi9$fb}A{^0%w2>`LBe52qwD;e%CZe5I>%6ZQ zucVn75qnxg2%;^|I{O?yyijdPI0#RE>Bis*p7;CM!*5Oy9r+_e88eZJ6%Z|(hf69C z8~+R%DVQgz>KIXCbZjXy`x1kG@5iL+&%V8j`8FDIR2LohB>Ug9(H2%lg3T{d7DeYS ziZx%x)he<~41{l zQoN1P_xigipiTXJ$*jMS;I_T2?bUbuVBY}|$w3W7G3k}MK+y4-IFQA>T%74Pr(#Zu z{BxVM@G(qSef>Bc8dU)GA3Pt5sQYm5ZaMykr_;{zJWOy*p#ZI^vuwrDSKc)b91E0c zG5X4$4(~9VNV--&kG|oj%C{7|;X1dz9A0Vgc&iI46FG}ZIMAo=499eiDO?@og6)lw z98u+(`g(H}&AC}q;%t!RCO+l4Z@p9w|D!>XD~Fz9Qru;$so!~sUIs{>Wpw$w==oi3 z0q(;1wdX8kot($D`U_x7$@ST?=Vr&mUhV%TmgH_zUWGZF?uwbVe$%3B6lF7$eQ9ca zxQ~-OLG97El}S4__$aA~)7w>&Fv5aMV(%5pd*I7g} z34wjiN;zcFrRh;Nf^$Y-k{}<=?UYV+YLcpv zG`t&_Ty>EtHPGb0)3osY3&3cEEFEhsC-Lx{fRKCd$W}iG@XKA9$VERO!l?r(!HKWs zfyj42AhJiOIuZhGljb~s?+@G&Q7pZ9gJ|i_a@H|XV%Cbip(dXxi^J7(+as@XYk~Aw^ zZM@%)R2gxYHaT~6IQh19EBV*YD!lGZ^RbbnA6hGt%i&HTC@4jYzo~w$p71F!03*By z_Ba@R`fpVNYv3e;pC*P8XX1A29^RStp*-z1^KQsZix8l5GLfMwOnF@V5*wzAH>(1y zAF>U~nBV+PH5h9aE7jHkXB(QWtPAn9Gr>JUg<_+7)-fK5+cXL6&Qy_yt zqWEe}BSme{Zfxkhd)qs;?Mxl~PxhB6&@@kmx^S^mtgrK(GO;#oj&x1-l2pfp?(Y}c zWfX*h+=bk6o-}4$GRI23;Wy^oyeU>tJ3T+;2OA_B&EtG)Ft{}<>kpFxWtuJcadrb9 zRm_CE{hYzv?w8ryT3S&VJPOi2z;0;1l^S%EkbO7a>nQ)5P-qTpYU@j0gf0*6FQ zvhpS-UX;YaGioLUl&1}>2u>c+bD{01l9xej27=FB%~k^?y8h~?+( z;aHnvf5YR~x|(*c0CP;J1=tSGJA%z6pR6QLvn#^bWao3spCiXEo|s*k?%w`6_baLK z%`Wme#-PdB*aXU7u+M*y*7u!aXS}90eX`8nm=${=X}V9XHHkf}wYNk1%6_4Pc7|Gy zBB65!=_b1-YF^6{iFxnwCrif5^8f5AN6M8SX+wAM2`zV{$3k{58&lN!c(s|X4oiy{ zj-k?6%9dOYRfN53n0k&yeYy^D$Dhcm9o00xJ>CpCF=C3%j-6?eJFACF-tUn)iZ?DS zIH_xr`L*9~tW$`Lv?Qgxd~9xB=(u!lS8=Wfkw2C7TVe|pcN239O-Wwi>qk*!X(%%$ zdn3tvsHjOyUNfdyuJ8yq!?xa*L3_VNwTx{AnS-pe&vf6cT~u8{$Z_oOg<#W=QRB{4 zq8Y5;fJ^cS-VySZ-GCd8{A5E~qsf`Lx#x25?mQOefjHoZA!%ZO-{ZQ0N`LugGq?#r z+Il{ux>MbH3-Fsritgr8+TY@-IoI&BWz6A4sg~b#wo;Y9TI_(Go3p0BIN?*hF+?3K zuxR(O<9u1GMpl3l7_JC|?|+aYDw}}ze$zt9EQzvxivzl7t(bp5b0=c?=hqhnziv4= zWqs*f(6Q!70Ken~Rb_ECF%SWAiZ${kr z+9%sm$<^~4%OxIn#BM|uZGYJmZ~=-4C%js|@A_$`uYuJQgK$eKmNeh}_i1AAd#;-N zT(!=rQ|Fg!zN({5xj;#&N6&irBg(SwGbDo_ZK0sjOshNlscy`_BBpoP!V&H1c3J`z zWdg}6wrZMX!%A_#IO{nxK8&>CJ>nIotvcP07Q|-c@KQI~EZ|G)UsUV%CtZ)t?r7ks z0_cUwTLV3={Y9M910gPNzMOv=7CW!PIJ$KzoKhexKeMZEQeh*x3ho1Hn$NMtooh|u z-W5Bmc zFj(MB1h5%kqR@yx&UfiQzok)MAJWm`1*OWR>Psi$%4bbV7N`kq#^J;JY7-NMUdALK z;JknqUOKKJxukZ$pSIs7V)o_tR=5bRKr3#Qowkug)tw%h6WUhF*{2YEW6hvhYoNb1?Hlnt{Tjg-K;=+n$l4{~i_?Pmes}=%~D;EpB;j*n1VA87Uq+ zcET?1PUug8;#7is2Z7M=QWyoI+LXqoz#sw{GM9;$04-J?jL`LpIiv@6N&X%x9BW#;`(Muc}YbI#GoV|yyD_cCeU3=hGamY;h{Z5{sne>fk14Y^R`b9<0zCll<4G$1Akz{T21xPOJBwH zHIjy}-Ho_k6tOh7CaJHT#Q%g)?}V4K`$g1RtTz48bFKdEnw_klyn<5ih$+LgOqG8S z)9Q0YYmPmj+TYh$k=h()t>1Eyzp>ygj*Tcj5f_iC*LwL$Y@NM9u0DH4Km(!--{Vdb z%U-GE86d`6;2b-ykiD5pSr*JQJtHBD8bEX%fa^tkiJSLza0svCy#~$@KE}s|E)abM zR8U|8etM!35}O;3wQ!twZ-8IlrZO82j3foV&3~Rh52g#27Uf5vXBkgeNCw~HM^+_O z`RI1Q{u_C;G1?2`UVFYHk(~X&pewgO&?o2aPwYPyITl&=r^s(;7+o3#`S32QuY6*F z^WbrL^*H~rrDRP}e9euNw@kjRG8o?fu0Jli=>7@JT}NBp5_SU@fAm9O5{xSET*A#^ z4{4NGe=$L>UD~f*zDQ;z^`5_E)j(HhlE$f=pwW>dX`z6FQ8W5wlSGQzXt#GQ$G*fW zCrtt?fEB_dTBOo?fq6B-6;R{R`)v^`hx*S4#t}stiMBIq53jQO1nD9H(+u{!9I*>) zI|O=*vOC@lX!jWC8J8M`tYvi^+;gRb_>JPd8Vm1lLr7r#LF7v&INi9`NUyTBIu@L#O=%6J4 z0yz}7pU6r1+EWLu_C%;lB zAYc>kLeHS$`v~GqSv7ZcG(Kc&00UxSn1JRa%DB{6exq`Y{ea|ZKT7?4j%n;dw$hOV z>FFwz{3p;saO^Tw^q3%&t~w3Yh}| zvCO&*D4mA&iZ4lh+41?7R2B7B9%H!nAX;!v$=< zZM~dJYU0R_?XHB&%{APp7m6Qt%7Ek!bJ-hL!0vhhF_)r5p}a%weuEMuRqc*TG<5%j+vc z7ox?4c@v5rZ8>G3tXPzni}{Ab8(ostDKtl>Hg=o}-q1yfh^WmT{Z1Eetu1naq!5rl zI2f{?{hjOh|HM$?s;phbKT^gg5SUwOf5b(dDHQYJRjF&o0>4yJJ;pg4boG#tp#Nn9cqf&wB~X>s#f9BP0=i z6PqOADmj@t%P(^~ReM-*#Gio5mK1}q{Z%_`t{1o^`@7*%)rq``11Nlu7o%QWmj-7( zh%&B#5ezY^HDbm$8%vKdIvVQ)v8Cz=fA~?(RMvjHl`@GSz+ij^qzlTXf9jvPP`_xL zI*79t=<$>{az6!DOyB0UAW9sJjq-4FIu>pvT+#s(HB)KD(4~j)Uakf;nm9cSE`h+V zwItMkP0$9f!!t`qXx}g~cV6!gr*vDiX)!-q;3o5G(?kb3h+J>k^BSfkCD{*Gv7pZt z__!KqCue5_@~};G-`bUw*HI&5Zq((%sE8wFw1!na$EZGSlm2#DH7Y_T4y8+|36=34 zIK#1i2DzMu@h(&S7D3U{xg}8Pi4IV**}KtRZJta~801WVM{&}uux9ZQzH-D8tM(@; zKio>~ha5V?YZU4nheA-2g_%EF#PPC5d6ow2b-}ofaq%Vjmh8{fK|-=Z;F{x_DkneG z+0SC8_d)bTkVlsL$KdQS%SzzVL;LmG_ik@6`k(MhYnp9P$MAz=Gsv;c6{$RDet~Nb zgo&KpyKbfe>+0C>xA?A7X}1w=CoA4Q_5GTZRbXecUA}2QX;z56yxg-R)$EfrNjnw9 zKNt~+6(w#>)Mbd-mkaiiaIKIfuW4RR*cKze>HSQO%C_?75ZAO%tv%+4SnER|?Usn) zGEHV?#vO~C2#7gDDu}MKwkr{{2 z?eiWB?N^cW;!T^(UECf@@vnc0r`ox$_J0tUC!oe!QVPaPT-C;!$A|t6tu~O?>E)S4 zWOVg(=tq3y~sses*Ve%S|<@WM$*#JE%*G4AEc&~c#(RPs^)H9Kg%p{Ey8C6i#9)o zgZZ}_!0lNE48w@MuNHNmEiN#N1M40p?Ds^RL8B!0?c%S!CXHMJ%d0>ST(%bZpyNY* zoU1r%MBsD<87blKjeT~11AVox4Cza1D11y3`RHjDhjnbDna!+>RBwIXE*)|tsvMZV zZ5HG-?(*iJ?v@bRP_0ukc|OoCTJBre57@Vg+t2J6Q^nfKm}*%S95JiogYx%-f0(Xn zld{tc#0?2No%n{-tTO1U0hvDWO}rzmGw7pcJesTcYXPk+Fq&ro%@%JYSc(T-mt>myLVzDtq2@ zkaMIwkB>NTQwai^_c29g^hEOJ{tZ*H&266|4`J-Vk2tUS^vVJ|JVdXH+u%N15ILuu zF#18Fuvs)ox-~@WL4ag1FWk9yYAOIP@A(;8a4*B3D9*m2@3Q0f0HxNB=TRlkr%;qL zz-cLnDtESaP?;<;_tiOv7h#}7Ct6UM4crQwGwM}XjJLeK-bGJ zK+sW#fQMOOK0BNc9OpWNm*h5engY^&y4Cg2veYwcRd}N98UQbfwRnxS6xqc<4PQ@v zGUc#NhV<~LpvP@mOy4kh7tLgD+JCH|%%Ig5n5C_zY8`#*rfRl#qu_K?VNLU-!v}mo z8m>rTn%CD8@wfn*(=#o?FrF*=^Dr;mIrFQ3x&vKKQYxsgX4B#mDl)ozbPMsSg;zd? zY9J|y;%V1#Z(%E@qv6Ol?;s~#P0_;#I$dggoSGx#%-=1XdrYAuTa@?4Iv5-R58k=l z9D_PQtO_gt{)#$nlnLnPYR{&wne%cvAU4nlI|AxEcQp#c{gH+%8%7 zAT0&$Q{VMv5+@RARrSim?GMiNN!I8;DNFDL+b|yyQ=i%IO)&@NDQNWzrD}<5c1BOp zeS{7z6X+%W6ZI-cX$d%A{|n+*`Wa`~>HQ+Hic!XHJYcrb zWLe%$U0SoE@%MiXnL{=q}d+oXM@C?@+bAHeba3_v0CERmHb?t^U@L; zUx04RBS2^`f0uw|U>{OtKQ2r_`maX``hPj#<%QI=aA7uYsPPD%I+N{p!pBmwJZoWh z<2m%LO>oCQW=2c`Bsclyz#&B|v@JH%v2^xlMx=Ts`wF}_3s2_fAIaEyZ~QSiM)6*u zxXRa+2*erS>LJYV9`huuE7spW9*7R>jv$LOzisa_)3=#eRp?X6t-|M7sQoH9Hp(K5 z*h7??!G4UgOte>ORy-xZH!m)f=xiJ)(1znj>sFoWlI)E?O;=#eNBw~&WK9nJm|(P# z1v^aFC$Ov?ZEeJ{K{XBr+#>1#&{j>H?sxC+4FKt(4n7yO!D_%2V4dTh@Gge|75X7T zX>e$B1mlYF=V4S(QyX%P&-@K@ZHn083{|lJ(1!H`icXP(vWBx7%#198uzeOY76KMz zi`y0)L4FQttpY{RPPu>V1uuzqKo9)68Pc0vu!IYHlE(t_fc2Vu^(fK8ndm{TM9Fnb zQ|TpdKK?cZ5ciRikvB&yh#JSRUX{T*h+MqF0Uxj<4tVnijo$jeJ)KpRjm@HDeJMOE zeF4Y63TF-KYn>YBln&=F4ltK~(CG zy#-Xy>!!3V726#djwzxI&2At#$nH+B5N)y)*beqG2Lk@3QzIXz%&T+bSt(FaSR??8 z5becVriRUcT_*tBbKZYR4kG}OsCI+HT|i`;2V{&s zMTu8;ony7M@ zBkjdOA`+3zM&U6}FNwR~g(@U{)Mx;cR4;CZVaMR4anpQcI=(W@OwZ4@G_C<23rjSg zDedMCQ~*qOC$6VTFBK#`3J%K0MK9rwcIC$I*}oo;{IP5A0`&&I8cutMcI4P1Wvn@1 zv%UNx1fy7>tK=SaR^vn9An69x$g1$M;rgxHM9tE0U!+pwz&1?_9A&0?rl(cX@CPBa;%Jj^!d#>LBHU@2I`j#^`ikid^fk0|hwa4Q z{<;U^l$LwYOWCAX!=H4VT>$QAjGU7W_qj$53XlKd<5+?=&lnT@==~mhgL>p$yxV}I zI}t4Thm$cP1PjiR0N56^B@z&8U_QX~E65wulzD+?`IueUML<&XUn$^jRg8!S)>BA; zYyNvTc;e+0u4@{c12t}*1$a39(G`%QO5oqb-P#{1<3DKYKQAI=E7+M14J_i50`Y?L zxxO=)fQc8Rdr5LKn>9Cro&%}E+RjQx44~^ehz8+nF?u=2P-JD)E=d{lnZQ4IalF>32QW& zD7?PlZX$xNx(#oGvz#LwnlQ7kZSI(~avtIZg72 zGgEyDY!kO?$MXieq)d6ENP4f%Z;xEaUUYeQ8VJcm1`vC$C{K#R>`j`-imGqQ@=cEA z_ytnN`DVYhE}7Rfdlw=jEMD7hn~CLU0($#)Z!nu)rh5iC#}O}{wjfesY6o}qti?5v zeNB2D3FN8P`$_wRW+fp${=Q)lH`4r66rBe=iZF8Q!aRD4XbgC&iv0@kE&DdoB8Hdm zleCL(sN>_7bP^rpc|?t6hW12>h<=Bpubu{Qmi_oL;CRe7Fmd^eN1#DQ(&2Sd_G68z zf4Hi`+P^aHLF#5W>3cQRk7Z~3tv;qe$c=h_W%rbk|A9z_fKcsqTU> zfrF$v*uAfA^gcTBo8XNa26$^;!7~mYRZKA%diquq`qEm4zx4dx;P986A&uGU$GrxQ z(|RN{>F#&=F9$XFqxX|L#eazyjXYD&Fx95y8%=yf$)xyv!2K(lR0b%!)^aNXFd5sK z6&SQnx)WWsZG<|vdXvA}@5U=QpPL=H(=$OGwB-AyFz{Sxn&(u{9m@&44LsPb{+MQl zv=DJKuX%of)4l7m=zs>m?IEu;$u~x!9DY4ZGAqwUxAhswY%~Sk>I&_4oiO>RZk}!3MHnp{rT!2RdcbTZu zIMBl&QKB;r;YdyJpyQ6Ij5);Yfx*4-FS z0eZ#de~?6LBcpG0Cu0e~Gb%hk^}y`YNO=B&-(4tW)R>^X`H)w1spksv*q$S!x$YbR zB*9zS(k`vB6FsXquHE{wAJgKdXw9mFbcC^`upg&txI zfCxg|oC@hHIbL4RcG@L7E>lE9B@dH zGgll@cLQnJ3#YHc#{NVp5=CW^Mc}9xJN&)U{?;Eg{(~H2SFzJ;YpOW;KHRhAN)$K^ z_BM5!-?xUU5d`S5m7Z`Xo$Ad_^)(>Cgl8#stBNYn;H4)JX2#*iFiT>VU|&|@{ouu~ zyFId;%RH%aAX=|zd~^~!9oi)ke5a}54o34f;8{*@HvPG|7zV0U8uXJW_#DGbjmz?9 zDEc;UN*S25d%B22nX*;kRy=-l&0>m)=rJz^xM1=ds#~`scyV#&GGoy3^7v{^hVWjN z=)tf<7c;@*-Hs$X78VGQuQ5>v?4`_L#B$EdteccHs|)H47jk2AtnIy41ld0MQW9k4)is&_>$Y4cefMrIw_ut%GNJVjx#B1@gWoB(8 z&yTI||8jS~+f9@yf=R1g#-b#NqSjeS4dphe?WNHRm8ms%L`z6H#Ic-MHa;JWCe9cSdXXG_!{cQg12^3jymc@ z{9xX8r-xpDF0>>_3hE?E4B`r8nJ9$&AlDww{_81yjL?_N6)A(^=Z+O&OwOPU;PJdqpqp2d&)#>iv#a-o^2bnFo*n>SzmV z`$_dDRt9AD#Y^}LrQKe9z~urVo*a%v>XlQ0*Xp_&NEM_EyadqpZh#s&43#ER;*Cs4 zdSgcsLcBszH5LJ2tAd8~c9#fQnR31d-L_{#9V?>Qgtr@L-ezGNnuwP&*T%r4LKdr1DS!|xoI#`W#J*MHQNO(>;UT1xlf znSEWX&z$D1!>mJovCQIHdg{lEzqV_M4r#qul-?UW{m$BKTYhWjL&x__ac&p(+3$}v zOIbG6FAdhYFZ@=1#fo#2FrVK()#n1M8k}fcmv)EE%KcVHYg^t^Qoe4bw`!!NE+fPc z$cDw5{>l%D7mkCx&8TMHEhqb}h*w92P3zozHk~aAi*KY$wZ&xaoeBi6-*%kqomP|g zPHx33v7TTQSUyJ{^t)p|Fz-z(ORGmWSHpkNFh8RCthD{Gi&f_q_?hMJT$1h5Lv^*t zJEN+DK|H+vGl6txjWJJ(UMujOm*xcMd#;DNXnjoW644nQe7rm8-KSPSSEXJ1ut-HF z^3h;8{>Gj6jn(q{X>ZG-^DpRAv{G#-&evj)st|xH$CWj?HCrA#PT3q#(hfwUU z-(P&$>2n$F4xu`ZJ&kgYy8QOS@mMy;DUFYDM=Z*3L$6IhQb*w;#DyjJCDT{E>Tj81 z-y%FO`@7S)*1`|)LQ*B_Xg#qB3vSiS&~|KM&_Q$rex@GJ-U=pSYieYUJ!0p5_+Iq; zpIDou?|FE3)|V4vZLEm@@aI-{G36VE|95HMzffKOA9!N_M{@XoaRvQvd|8p?`c~zS zCVw^jDUjYvmH!*$)V31PlAfNvUl|v-#hmak0S2p)xfHNFp+g*$TJdpn4@acN1s#;t z)C?De?AHF%Ex!EpNMPICvDorL3z|ac+CrDjnrC6?eABbY2y?EG4;5$o-k$i+7bUs* z_>qxFq1Hr}_Em-iXp1TPu`Rc#N6Q!&T1U;wS+-vm4aK9+Eb$hnqpsV7+eJ8)fSoHw zSSbfX`Gl>D-;z_7UaK|J-~&hFpgktL4UItI29d3fZoV8{7GWJkk5eb}};4!arIx<}qI&b(`8cNnq3h>KCVsqQk7fZ8>y z2@8yZEX?eD`Kp&1ArX!Sx#6BOLXd+TWQluL_qQG)ixd57M!42Nua#rujFtF_vLry1 zj|&4iCZvb;!^#@xlV`>g;(?a0JUeT<09lFBaU!|;Kzmd93vlR)Y;j9qoZwtx%nB5{ za2|%L57_|WQdX?1-hdu44aY_D{HtcF*($yvO(Ma_g7q+p{+(#oOmd``U_07MX4BjB zuOz&Cv3hK>C6&-Z{3f~6P9tWONATx@t#L#iO+OXfzY`mKJ=;%9A_Rc}wKnB3*f z{X4G%R=RPNDh}5P7Q%7b>~>3U&A-8fjckhLe+l3+%jLNHeUXbq-OhT_vw{V|Z%NiP zRh$RxgW1^r(mcXDwR-P{)eRve@TEqw<%@Ie)I3e&RV~K?E9nysY4=eI+-|PW@qO;Q67+@SNn{sq zUK>u}z772yTCLdL&DZies)_e6M<+~A=10IRZ|0Nb#OaIK5`LThWBj?HY6G zZ8V33cDcvEcioW*Wq>{A-4>JXiGYEw95h$)?|6LVme*4I&F>0)D#7i4qPCJ>R+7-q zS-}p&{71a7(y_fm_%r|cK6=gR@#OQF>Yu`56#_Y|yje|J(XJnl_bq7gVNRE*X89$q z$5&tKSNFoQUcbF=|6|*^|E6K7@;nlqeOBK#$Hn3{knl0Crpi<-WIkZB)!xHu!8rA+ z8D9u`o*fI(AhK|Lo$F6>jyX$=1g}{}K*MdOOfN1>@wXDnf83N?GRW39x8L!!Eaz`6 zkM@xEw67PTVtTUYBm`f7!Cz1PO+HfN8iz+V7L5kjcVzy z`{ONHgyAqn5t;|x?Ii+7Qsr@$Z|dsm_R+{6O+(CygWTWSQxjE#+#s^!jjp!KV`*xAdAi~aA3LMi|Jf;>{v@|^c_ysY^06!_)$)3SU+ zpjYwoIprRG@?lkCP=JE*7wvvL(y+x8$vlCNSjAu%@D1gJfUctXEu|BZ4H=b`Y~l5+ zr;_zMnqV+)+vVbP2h9f}sw$N9ShC>*!v6E*A8M4so6;UIZY;slR55e|@Rfhrbf@mW zW##4JX*xdkVPw*g*xmTY)AY}4>b|fX9?RFG_zl)F+5F~BvJmkko}KouebP+I%KiQQ zcnnZ1_$oK9z_ml{-%s@*RRssJP@KnFW+Pr_`Ng&4-w;rbGeJQ?BtEgOU;bZ~?T(qC ze;4dK{cXbdofkTxYro2fe_E=l}%1Ap%K(Wvl^AN5O36P;@{P%9$EhRB9Ml4?@*atU? zistDcVhNij#skn&#)A^IK%Ku@TRzn%I=A#hVc~(k4alV@$f3|%(tV7W-yZg%J1bTe zZEf<%)2sfVAh{#I(BPJGKpXp?V$ywHhPJlVt-A3A6bd6U^u#_nIT`tbW|voIhZ`5?^1h5+?Fr8GjbQG|I=H zbFeh)aI{5xi$eJDB#v%{sWhut=-CbOZL#KR(S`o6CsWU?+tdiv*Vfj0En8TUZkTq4 zwg}dzPE@u$^m>?XhxdvftL9*we5j6r`*BPt9AZ{d7ww7cf93d#ay0dX8}y3LW6HvfU~SENb9;E&upG z_*lP3r2l|3J)?v*m6c#q&E~9Y^Ird{*EHHQh}Kp!yrNd8ST5WnbGpNSZ?Ni@&wp^V zy7va(lUk+99LE)(JfW25{7jDBTy7`*PnWj#>4j~qgtSR;jsHxU3NC-`Y7m3L46d}( z{k!7m-gAE`^xy{(%)+}{uq~9?bl7lZ zqpKBrH%J?`3z4U7#Yn&X`^X$r;mjoXbBp=n!+TQ!EPtVFIkA5R zw||o9|0*R9=RTS6ikJ(O-FQokJTKJgYV`?~&Q+;bSVz6pZ-l`-@=p}m_3nF-!^dMi z^?Ire->7j0Vu2%FH$^sr@KuPA&WkO8CYk2laoVO*UBDj)Y1#AGHvqxfkD^!qXe%od{3tbLLP$1%FSZKB~rq$t9k4jQ;Y8>m^RQ>?_Ly7*oUS!z?_d2w(iD)L1Y(zjg@SB z5Qc7-%{r|ZuBd*VR8N2JEfS~BzIJ_-vc-6ezz@x5hXW&h)foO99PZmYM=3VR4y#T5 zOc6U?VL4nvo$lC&;vrxge1To|&QGn|r@l0arZs%U0}TEgBnRRze4uv4$!0lE_${Z_ zxVYb6p5Ci=a3_289}2SHhN#7#l&H6OKh3j~WUnyx!$bP?v_^N3V$Z?BL6fjh@@f(D z-i!$I@E*CUBYcz2ue(uS&7euwq&_97eumn>ZD2qJXa%f4iE5P;>2X#Jmnj%7Mz;RqA3UT$>xxl~wigaPI1^gO>H{o?o^0Q4+fkTQjh( z!AfV7<@^nPGm(K@%UtvgpFmoQe}@uh&OC4;`eZVC)jF7Qe=deioMMLOG1KH*mX+RtHYfgT}&elT_#njLO9U4VA#mkwwd{P-SHiYNuyp< zn`ou}o>lciaq+VvS`ujFa%YH)fLfCayH1+G-xT=u`w%Ia?ns2~j9lEgc4&r{W^~fd zG*|POB4hZ4o`1^rFF&-;IygNgBg280_^%-?XHwmh3Ncnz*UYs!mcg>LXLv9K6pTxV(sF`11hj$Q=LK=F} zxLDZNZ(io;DtBkyWgtv)jts{XbZO{awC8Q*B=0-MaQV91d5+FD&g!O05-q)YxhlX= zQLV@{v-;H)nk|rxa;43|z`eb{0CvBmf4j{`$7HA~BBxaS>;!f1BBjLfN|ZvIQ-AqA z>=9>1W$GKN?Pdk$11>RYYKU13HQ2y0h8&YJ8Nq~=upf2c>7n2gT)ZV9G=`Gg?z4XP z9cY;WCf&FLTAX#_1J)zDw{+Whl1)&OG7d~wrrmWpK8IJVr)&fa58u~*93GvoMUeWV zhb z+tiUj%x5B(CtU+rUhWWUR8=V_rZ>5%J7TA&AJrCSq88-c+OBai%Qf|ZgHsS)We#v08LFSlq?HL$xkix zKv0)7AA#&yV+M$~uP^kV^lL?0EQfS-|LPPCjZcm7)_NLoJwNijRH&H&_CUfH<%v9P zTIP(D#rG*aRs4Oi;Vc(v#}1J?CjN%Nkd2RJl=|AIoB((k9O^#}6mo03cy9q(IsG`c zeoB975jj;7WLO)qM}70mEYLLP>vC|2ZNVdx{XNr!l{2|e%R)V2S#a~V&yU-; z3w|w6fQ_1&*yQ`6N>R9I^dB@#YAn>?`MX!1)_INba20Z zXn`FXzqo0Q!e9EB2+wB=mv@fw^3AV(H!wdc!HP7!yb@@eB!x?ak7|ed z;Y4s_qf$V**C`YHue?ID&Rkw;pxy(Q)O&yHOH7e1g-Yh@i`glyU~wB4G^j;s2Tle_ z_ylzSixPR73=Tc&uT$2$ViBSW-n{w9;{&l; z!1(nBQM4c*k09c2{p}I^{ND>+<$$}EqidK2@ZKW)tjD6IX9DQEk>TD{ z(XH%*alWU*x*Ef&unH#jMy(`+9K!3%`filmQFe<2Rbu#+523RZ{Mq_ zuSd=wRq_EoTj2nBBEj8YpmeL8L)E$B9pxd-82>$PML{|ZLb!29sPLp&Ho4s8hhK zYaE9L*J0&CGyI{xi(W3xwxrMgWOO;Nba#-vSN!wvVTBW)L((&`j$?tB^mXH(|K1LM zrP*-%y$^jBo4dub9V5pFx@rLZcwGkrv`|d(y&7>tz~qGjLi*ivE#e$h_-Ujs%LDHm3hp=l5L8)_unwoD z>W&d9lf6~~5Zm3P1xfNNy?Z;To@~dF6;NXRUgwHlpFSGkeec5XX=Ohi4VW>LHmg-O zrO1P{%U@lxF)7RW>(9s4LuMP~;LXSQ%q%!OSzMhyg@g?4trnY=MH@fV?Q?&dT!kfL zg^iv(Nv}3(Hg1>EfJpSCupxT}>-A%SGR5$?fhWdA^>QOc+x75z*5Tc zI%;ZBcEI<#9Mx(YeKzJzGaN@!n?#uf;@mWg7bz>uV1f#^j7k|AA}*H?LYW=(zMe3; zXTC9OX&$L_W^!AMJPU!Qt?FyOKHgc{$m_9*qf3YH#d@Ia1yIj}-wIg%`ADjPB$N8> z;=VHNkw`1==DT&k8qKXFSlMpd&oE=`AfU5{ZI&!%ZFf1X3GBcG4BfmE=&y`e=;bO7 zn?*qjp;s;~g7nDS<~Oz*7C#c0`&{X0Sz>wA6L=p|a(CV2gN)iF&vSgX~q zPT1=hr1lk0!7FE>@J+4#8mg4c+x5+ey=;(sXiEWF@a!_}40�|3fU)`>zq+C5w+c zFl{pn&mBy~NHuiK>Nk7aB*GnO+` zr2EJ|i0ZVqV%!inlWMffWhP8WWcOToMbhk3tchbKFeRGZ({JoK?iANi?u!NqBJ5LS z`lM?=st?wfP9jK5GOqM0bA1DlF5IOeQq{m<<=jG0eixBl6Fq@A<5l5Y! z8(+X-j#DXg?1M+Gu5U$CpR^CsQJ9sXAwvh=pB?wY}=XGs+JRbtO;QQdk7CW~jkFc2-@sAbtoqY9^`$~oR=`&>o2ClbvZ7psIffh8)Mk_vP zdQ9LYGu(u*x{g>ARlFy)6?b=pe!2?p_WHg_*Js23+h6)YH!f=$(XMV_?8vVO!Up|WwwVvb#3DzkEtJ2{7&XX-VVOk9` zhRMV{Li8HcjlY$`-juQM*EG^!GP_oaCqTr8Lt=@sO|i_)z1N%P@lnw6jylTaz<};D z*2+cJ@0Paq&oz|^WVkYT41-LoZr@os&DERPd17xU_}65_oqz6A4MbF*&)M~DlBK_6 z7D+mW&sMdl6xMB-p5p)oCA`)jtkg`mp}?v68`rJS9M_H2jlz_#RYGG$0l&o;fUsi_ zhMMM#hb`@mo2RSE=_=o$rQ=9k;7BRk#m@FVLV`(vX+?9*QD-k7-j0~d<_Ed*0pXcS z({=(0QOg@8)H%ky>ZPRfAkS{)$1Ac)z!B%t!6*lv{Q+*uKV&;0tYDgC|FZ={g@k4Y zIw%L9TSfBlT-&imMzIDm;_MDjEbEAEang>MGfS9GQ_q=*%}OdTRROQMYgj^!$kELag?TMiv=4rs3~lXTsMC zZ!x)1&4*aWp+mtQa^6u;!*T4qsbk$-fhktjhg($>=9Py1OrOObyicDIcBUb<*GcWs zHd;$t{0wNUahtq@)oYgpi7<@fY^g@Seq7|-(7Q{V-?MfQkVAcw9C;NjFzuZBJ3bR( zsHt5aB>-ybBNSUbm$HeJz8db|A1+Tp5RgCrLMHvw8`K__4r$#rG!_JcEY06MX|dRI z0V5wEs5a8HTdOVdz$*%G79d&6Uvd7(z&%ZBedOlbR;MWHg0}1-4rS zY4#&*#^@ouv~<<#IxmsNRnnrCt>I_3Zm7cu@gDuSnT~&QiVrla{CRunV3l?qB6p4f zoEj|Zu?u;CT;AW2P+a8Gq?ypTDLc(=|K!S$J}1M*OsZ*Rph*yZonW_UQCgO*cyy8t z`s=xeLYg~!Rr|dhbkffEoU7I~Z~zHhbIjF;$#z@TGtS)8MwFkAQo||3bF%nC8s^0p z21o`QpS)o^`$nY)2cEWy-1=PdR1E}BeG0aj7HHkVBMRCXiyu%uTLQPOI6bxsD!u-} za7OO7Ipta*0H4a&jI!0T;}{U*(RP&#chQH2-#h-PC0>Gmk5y8SZN5OE zv~ove^QO(f{{D`3+O^_h*-KwE93?b{HU(CKyzWuC0S5kci5D#ih7{TeYR}T$ zU+p+n9=DlTJST~6T`qX>xVAE`PWiIt;j-40%s|SE-wOEv+p?_35T4PrjQOZF@TwJZ zD}rdbBDZra8U|Sx2^1tZ#PaY0yLA=V?go{Ev9bW~6{ISKfv<0;8ZqLG@)z2u^7%81 z@-mvcEabJ#W!io68k*(C2`^Q3HT$-5OH=F~4hS7-cdWg6UGice2*sM(TB}l2$W}AS ztRgWQZTt2{xg@TRh1<}Qw?bjdC~DH*%WQ^}@V?p`si0bMmRAL-b(Y$RcK1bAm39~9 z9vnsyvIpnBP`UlR-CT9hvJxO}Uh>&sL-S?0!7EoPcQ+aZYTlQ_OMgSB5IF@QZwo7b zjL+#dX6ioIWWJF@u34RU9IiMozd80GmvPZ^_ehHtnHIo!=Mh$jiF&q5OLxM1p=*Q= zuvmw834YyXT}Dxrm{Vu7ZY4Ul3{?p8?1wx2SwB9VYPwPw)u6>yjvhzS*+-W$&DgM{ z*?D32A*GDJ)Dw%~8F++oznnqy4uHE|#r)G81?u&?J6*u6Av1l+9p<^9@5xK`TD(LN z?7S79OWzD{Jk`_Z7_qk8RE`9+az#_56Uj`wZ)TlIIJbpwKu9nfwW44JK+?4i% zU`}-J_y;kRPGgUt3d~3IqGDP?OnfX3VG-FDR3iZ>RFkLaFTYczy%|Rh(R_n54~$I; zKWvm`Ra!N$u+>5#FbPOz5L8ZT`>W~Fzzxn;`rxVs?0Uk`c{UY^?7RucNgmbD8hHvc zYu9DQS<>=EELDa~cn{HivP8%QoDnJv+~wE_cX#z2vWF&iBbBuQAy|Rt|+&uus$rxQ0(V ztbKqv%r0H__pg`5xQ489BST@2%I}ZKj6v@CYIFkll>t_+Aa(oLwMV=&zYh(m(Wsev zxxw_EdAhxsZsKLH;$VruwjHF$AH)2crE)<%X~tozcE4wnj|k(Yj()+^REG+@->Rt+ zB$dGxgjEL&f6E?+Nn3#CKVuE44fD$hfE=90R-9A4hH5713-j4L$K1#lJO!g}cn)7aq{qxl zP^TRNp60wVGXr%g?fW^I%f)HLqw;*6QACsGws4Ntqu7_960JI`&=~0#uWZlxzSlq- zn$VQT4D=v~anoO6*=?iL-P1R3Z1?teaiQV>Lq|uLv&NsX6Tg@~NF_CsQQkd6L98L$ zM4_d`(*e8~)JV1R7;{vnNj&x?+JGJc$VVK`9M8K`zpm9&dkFr_euBlxuT=OYWY1gs zAAbxe#ypLPtLAnp)8;|FtL6q!my@JZceggTIX`6-QQ)7mp<@^8_2Sp>vCHXqu&fFE zXnh_(uUhf$!XrD#d;GQ9QrF5B_XXs_s8!#JpPj9@-B`0r*%8P~T-N|=qBq(FUu+Nt z!~7XO0=5BfwR5!f9p;-Nx}V%z;B&M#1oF2}*B0Ct3JkbTto{CcERPPq;yi$m zvxir%7Ntb&xiBA#4-X_BwjAJSBsjS0j17b~{rnNj??y7I{k4M6T7Ty$sirL6Tp#B% zD49&QxFP;Dn-=k|#_Q6f15`e^FN*I;=R3xIB8InsnmIzW#H{9*cdZeiA7#oEYc*YG zcT{Tn8Q6VkM6?$^x>1o575Y~(-CUTWUCeXgR-Kc;1}j$`s3|wEXCr-P^(dOZNiYjN zk72#np>OcInq*51)b0s~TeYY*!)vSoujW~m%BE_4&ztjHGvO-flQkq$MO1a*j)HkR zsqE=?KP-caBqRkA8L`6K)U6+)D01o2J5eZtCNuaF&{fvDiVJXGZd~oy zOe1k6c{bNgfb^VjQ;{mOJoOLsUmBi{f?M@`WuE(JQ7;mCu9Uh&tb!GFI&@mmp5i06 z=Iei`$5-cWxf%zH`(z3;?L?qFM{oWFn3!$9Q+~k@0#}iXB7>&dOAq9biMUPQg=9j{<_4 zgW^{LhE`B3mJU=^`}Rtkh%yaLgnHAvyZJ7SU1ifwlONb_=eZg^(@QU*8PnniDt}U7 zX`+ZBW&b`FC1WY!Qj!elS3>EtIu6ZeZ@>R}hsOe;3AP`4-;>zQeB?mGV5B{uDXQ32 zAknU>s+IuMoV`pqpcIfBsBZ25&SRiN2!%XU5rQp}))g{mx!OQR=`NmhyvujxH2G=N zNZ%Ear36YemV3El)pPu9ldESwj*T5*biR4YlSiM%z}&2n$tcVFBu$}h^n;kBSEE(% zs^jjtD-{D+vtL=I&rpK$?@KA+&D||?&B*zPll^zm=Z&|66Xe8s1?^f*plY@;bwu{& zHQxD7u{Fxcfv>-O_|E_6bDS|k@re7Owl|>_UxQ!!($gVrGRVX@{RqA=yy;qwKJ4$ z*3;{ZZr-&2bfSbLo5a9Nl1xRl>oAb(P0h!O3T+?IK|Tv14Ve9e`zr~fId!T2lYCjA z#_P$YKyv9LMXyq*N(l62^Trr#%fqfpI>4ldZEyypq z&oQ`xS2;{?xKzl*Aa7 z#e#EUb^xY4RT7=|jI@BF>S>+W$1E=B)rSnNq^EW9wXl~^V+R9va^%bRy0up-FFP~Rv-vbh(;{a z$|I&}xqTSwKG-QaQi(4;TmV*8njQ0JE?Tn=SnzpOjW5#H)u~7l>l?h)W7<(z`U9~v zo-aej;a<}7m+=+rQYFXVDZlsN?PDVY3lGHcPrgyr@Eo8WS}Mb}3>lzHL0{SoBf~ z??xf(M+iegVOqLtR3|J(kkr66zM>|h=6SqE>&A^>(DBGnPbB z<&izB?Xql>jMb5F?WcrV|4GBPU$9DhV%Y;W)+v|WFG?1~9bhe%gevwC4z1c33X65T zVY1s0D!tZ0417(WV|0->7(2DW zlSw1u>~UzG>9P8SVb8-8>6mDWnZKw7Rv!6|vtD9m0K%7(MYjH7@}~;YM>Tlym3<0Q zi5xTaOcGU-ss^hJE)<7bJDOw-ATPV<0c2-Lr)!_k^>iZaw?C=B#jIS-vsQf9%6~8< zVDE`~;^nX(y*$kYnf2w4)5wQ+1^a`PHwoUq{j8b-sM7gm!TE`Qc(iwpJ2Ph@ko2z1 zjBPNaUrB{BgB8?+T+AN1FN^3}$>w)QPNwLtupEP@{JOYbSEiKdKpOlR>i=fgFx|?q|6^?%3_7loU_*IR$LGft`>+F+{&NVb{p`O91u` zy&)|PdUwQv%ml}$>^1i(bU*$~!hQ7!@XX}EvFthVhV5hOM@Pf<*{47t4<)Q#JAkN+ zJB#Gr_${@?IH~%lL=_)Hi9#x5(1qErwAc*Uw9XIxISdqZ9FxW8#mxL&ll7QrYX$1p zYm^e=^+un%l@cGy-H(mp|Md5-O(wRQ~20nkq#)i>8OJt%0eGgL_az*Rto&E}GlaIa#1ol915qG9CI*W0z~Ysu9>+7SwauCuo)Jb$0Y2} z{H&Pbw3@VLV<{ss{Vn%tJG6|dsEHw4#KQT6C482a-@=nG&%$HiLPAO&%gYkVRmtHv z1`+KILys|JJ)xG6GqOvTmhqmQ0EDPWrjRKBVgN7k}OG5bHkfQXT!lF zM+}+K9KbdW_#9O`)y%5?7tg;X7AcE;wg;hU++n$M%sbv*J559i@Y9_@z?p zku!weGwq!jQu+m2bf@k{YB{<69H+UCIT-q|5n!iOIFTneQ8nCBB<9+z<5J)D5tXn99dM_avcLZJ%Fs#DaHrCFm<8_Fy&585e}m z^ycE{8k0$bEYdF+ccHLV>Ug-NtI5O|xS@x3IZ~ejqz7F%mjJ1pP(m#bpBO-c7E+ZX`z64m%FA9;vK}G!<%r=DociO&2qR;l?H*_urfE-- zDIF|&HG59i1@wDZvI z4?T(ODnydHtKR13p*9S?4B^{7G;aMA@+FPG<6RrcVe51?G0J1RDLX}xiC7KP3Et6^ zsbt<`K@DeRd{{Me?3{qL;HM6$FLEyPCvM)zja68ud7tT zhzDxsmB;I>W8P-b6D#M+Je3lB3~pI!1u~7mSN!%*F~Z~8ju2?Hf%^Uvho)RtsvXuD zff%mxol&LHj4i@2V(sFf5t(8U{=bPbJSY!BPRB)^d>Mos&wwG#embo|O_yM;U1erl zQEg-H<&#S8CS7ym>H`_vwo<^QKpQuc0sE=O49Tf^epwbXPjCPfF$x8zFRsn5+E08x zBMi>ilMeL=S8D)o@3#O^UpEBK$6T6oOCE3X$INnZF2MH)%(=>o&+g9*PAVXAl$_gA0v<@YN zAcq+?rA*`g#JI6cQqAxi<(=NFtG`L|=+*fkGFCOQVyUWp%x(c}c;&Q^6(g}O&D;sA zD4VhJ!Hq4DAuJupG;kQqmpx{Bx|zX2rUK}=OMH@5@h*@>EYKn{P}N{6%0WMzSKel% z?~?O!58ePpUxF2q?PN&E$<^ZnK`Lh)(1v18Pg=B4girLS~CnNB?;G<`+2fa|)6W7XIYH2jxVMVJyl=c_Y+fzDaO0CCSxP|J zg3#vNtWe01an)@Z8}Vb^fP9h9RXUKz9C~GW`qt57s$nz(V@fr-y;*UZ=@6G`j_AVb zUh_|czcW9MBm5VRYnGbWra;jxRj(870>xZ~MGKcW?~Sub&Z+c#kp0^5S(0ND$WLA~ z`j};pOUw)|BaTeW(bC8oRzDjF2hS+v${jupMgSs@{fHgnf_}#0T2_Kzh8G4UwUOyL z2pbcD0OlUf>;zt#HVj_PcY|KqclSj+$lrAgzoR!9h}!wJO`gJjl|cNS#y@LVoJk*K z5F+ysZ{D(dW}U&!eV=QR_@ZNJS$hpYGpzfCO@{TN%Wx)(5Fo6f*EIS1}-CC+qZohWJMlQ%gHP;@)T$(F8o`r6xj#LjT z$LRTLv_pg)%kP(%k|~tknke4eJt?$2-l$w6t{~CkgPzs4?glbHDU$WgV|&SCo^@OD zReU1LFY(&w2}=Hr*_&56NyFYH!*L4w5t9!sxiX>~jKcH5aB&S*xJCDB9!UDDaH{4X zr;2IsyZ4)9zQ0U4lX@r8x6V3q(c`c~DWwGXMdEklZ4Bn-5y+-0uTfg0mFvMszz%6u z5@Z$*N^h$uTmvKk+U0J`HrA@d2BX@8HQluf7N+$rDG0-~@3GPX$J!kj6neMv1pMvl z50aeFrkO? zAaeSd=1(WxqVJ4yW?F8pd$_`o{nLVZeJ>g}Dx(&iQR$K?06lvV%@@`kLvyHUeG_M5 z4hAnV1~a+N=R7CTe$zJm9D$^A)pT-HP@6~p>d~Uus+p9wScb!m$leq*B@DVn4ifcW zHDYdDK-B`KUz!y+Q%0j`auzIx6iN}AJMP}lsn_EV;ryaCHLy{qL#d%%C%qP3ORLHr zkhs20+qG|d_}*n?vx$3X#W2@}Jps|a_#zp`OGx^6nvytbfas_MS*4p{u%CMC>S!u( z_`b(<5O-T8pwT1D#l`rGHeAX;%+6;G$|hn-ojNBGK=yw^McZd2wI~z zmVcRZ!t3hrX=7Ex`kYfVeCJsI!q9Mtr>gMen(J3-PX5`pUo0QmMV4?bQI zt4UA2{&qg6aAz)N8Cy4Q0Z~m(!NfZ&LX*^cJ-gou5TrTxRMKV#vl8x$B+v;VOR`TC zU?hwx08&E#j9aE(JubGlZktF+RB9R(DoNA9<=Y6iQ7M43hffdZXVYjs zV_q$e2!vXjF7-d8#ef4>>=UyE&ziaPa!U#0BQ%PaK3jWnHNV?$eE%bG!8_TAo&+-y zXi(##{ca?!-)M>_m(TRefS*a>0&nxPj1Pd)$tpf#Xf4byg6#3|=g%LTa;+IZ`)RP`9jIo7OQ4~q}e#uimG~oK2 z?*}`Nu`7l?dyv3rwi1LUTZ$uh^)T-1C7tx~hnD^Iaw`w2s)L`Ycjiq|d=oW?yA_d+ z1mWPJYM}*dZ5GnuA40b06}!+{c$?J8&p)0opF|n(=$$29WF-q5`gjH{T?qbQuQV$y zFWRYjKy~#;WZRrmulto|E~1Pz8G$=9guwS`Y>`?#Wa{l>pXm-V$HzqIvXqR~?03SM+`eT#-0umcUeJ`_(k-;b&W2AUP=fr0V=UOD`f7Kw zU)z#~+5NbiFB|w?etWzn#DDikOd=4o_V-WRO2C#9Zk_$%J}Pn*D|%14=i9HNefxkh zH4A62F^V*oLV>4n7bI?pA&H`#9bK}16mOhNCO+96IBG~KG($seFF9g5{DRO;@y>8` z3HNeex)q;knQlzq1QY~w_0J@9OnkXw1?sTtUJ1ToyIht{#7+`rFEO19Huqlr5b3-= z;My;}$46aOk5D=8$!P#1ex@+*L41B>G3yCh3Vbsyo&2RdLg8r4`?5Cc6U85DY7;Y^ zYh(AUwzaQ)IQPC~w&27B9|`;@l#;>DIqR-Cd(0RE@g5g^B^+s0#Guz4h%1fAtUhP4 zZdHEKqf1aT>uPq3m#BFe8Ga>jYA!Ru{7on30w@r3pow#VMg zw`o$M0>xwV)9x1BV||zoAetk;n#|Js#!J3xZ??Rin`axog{DSPmE5ZobT7YArUbNp z57hCm{2kl3C{G`KM~puZUx?UYm^Gr3A%rk?2 zK~@3}l~8jloL1uPwoirj;$cKbRk5sDKa8LkL%MQ5(L^7rY+o3(CfDg=)(^SI7`PT4 z-oB-S*79b*tZxhnN10HY(abXxe|@?6O-gLjdZ z!8QY+raqkll5voJ{^FJ03K;NVr5~URSobme!0^5zU6JSH;EcD;8j$GoraI#>J(5+5 zV!)9UXeDiKa81I;lUe5W!OkC0<_?56HTNlkdiEpSVL~U85qBRwXdbwXVka}rbxdfz z@YvkVLY7*N8Zm*43%U@wuEU1n2+f(GEQr73>p_Oiug30O#(yIZ{u1aS_g)+-n^upS zSQh%8Pe`#7u|2xQBODKLP|?bEu*e3F5aX773Yv!GiO{0ivQvlV%tYv8eF%3t^=-<# zqUvlv2)`D**g6<(e=&Ij^3Q+w9HKlM0vX!+UeW=DPNJO;X?nb{h($7q4IPRYyIO~M z+}&hwGjT|cZo|^o*#gJuZ~ien>0ZU4fzk&bTX)OyMD3F}GGF5S{ni%iN?Uy1-3hnQ zo#u`1a~EAZYFEFAc=9agrC{6gGWcEC6PUL_BEYgKb?LR>-Zs}WpRJ- zI4{e-)5CtdLY%aqS>c99>mcOQEaHRCjHzWh?d9LY;A&D*vfo$bs9JdGTtm-Ao@MWA zf=}j+c-d!O^8hUNJ{$_HSoEmXk-?CIvOh_#h>d)7wuH}DQDne+ZtHE@RCki~e z^$X(7>6{YW_=>nXaXMUD;tD=AdF~fcUVc$NSs3bC^SARwKoTA0VYNQ;orSMp-qpNj z1oIoB>He|d^(R5ZeqSlmqezjl9v?+*1)ionG5%W8xza?-xO0!mUwOylgDRi8D9W|4 za0N9tXWto+ywvm~6gzIIwqHu5hhZl#Mh>w^+3U%K)Ts zEX6SR=f>FVJD=}vKkTp?wh+EgK-^~5q-QeBcP@vTvYM-x>}}=be=AJMX(w@K0(E zLv5qqFgjW=+ls-H<4%IC2Rb@1bj>&<)xX0i)A?HerED~n)oH@GsJ&U7b)Nn#fsW^9 zmmA7}VV07vV*KP_bw8C<(fpLm3J&)!n{JA6?dIfaw z1MO_gDfRbs_$0D277=DXLf`X!g>4(6PJdx!RIx$qpdDrv0w8Glfj;yi>qs?Iuvl>_*4Rw-AzhtvH2ML2Pf1Mq%uyw$u;uzEj zjx)&fD4MPinbMv24)s|wOgogaO+OWpM}@`PLJ>>At_)C6%4T2=E0)O=d_k(#|EXUU z_733qH2=}2oOWbHC9>8rx|&y$J~T>yZJMg21h55lZfao|^1 zVO^@-*4<_IA31?D3EMW#r+K5sb!uP$m>BnHZH-xTeAwz8do8}}KHGQd5!-*}3EO@8 z3G3MRfX$TY2lVgH{qP5Dj6U1o{yMd$^7>W!b!Ek}xeV zWBeT)Z`Ez-mh8f}a_(gCedl-nZ#-nkc08jd*JWt@6$MsD^HhyfpKZLjK}3fdVI@5{ zzw1w0gAoceSx2JH20J3wmx!PYTQ=I0v`6nhVUIt2%-;UMA)L!md;G!U_UHpA?SZ=v z+Jko;u=~&Kw|h_TvNK1z__rSx}P-+TBQOjK#&wdR5qOq8gc-7k)c-mHBpFDK}l;UU2809 zlQ(ZzE>pJQu@n5g&DoMBBQ@c@w6x;RO6kRJI5ECe*pI>=Aq>g}!nKyEStYk^sYNLM zGHisO*9$FHEx;w$!#KYXZ3$YPYj1A_c@`OLzDr-$)|GTn_KA88fyPCHg1KZ6r0^O& z-r-e!p}7_PzH_(}QW#L5<8)`F6Xo7H^uB(V!pmU^XvjEY_i>zj59jQqZ0_`r(68o# z3?nDUq`z-LEr)yhEXvp)**j*VgM*%&QNa1v>GQRk43-?zhIJ%6ZQoe0McUS3eB0LD z(PqaEkJ#{Fr?ctfhY$K#JJ4y&W-1kP-tTQ+8eKP-F1s# z{7>%RYY&_{?ipPQ3#&6EPdv7dZ4Bp{h=zS0sjs^mAO?HjGwRFP#grF2-KrOGo~syK zWRG!BJ5-LyV0!`-pNzi2!}1sIt$g!MsPil6Gih5E~G;ApH~p`Nz;< zUjQn@$FrB$n{2vNw+#J%V|K=hd@tG6K~JH7zzkI(snNC?V;E`+T2CLWvAu`!#2J(T z6473>&QU8y2W+MqwiEY1YP-jVJYv%tiFv6hE$;2^>ax+{5gQvFv+hnMP4yys(zOkn zQwbv+X)Em$aFU!Ai&{Yz1Xzb*Ds`S&8J>Vh??j2g7X8+!7~=DyynSnY9AMj!F_iK}8PTf%NAD$xpRXac1C z0Y&~cj~#v2v7-au$|(S;!?WqmojV8G_CnY@yxo86q43Oo4?JLxKl-TC>YeKX z8r-S)&pYqE<(}RKlyt3Dwo0}kwB`#tm9EU+e7;eJL7lm6(dIUroL;tIB4!8o4}zXi za6a4OWo3}u4Uh&x*Srog+bm-!Dvh5(Sejs7!(wY?|8`TrmNHqJUtG0dbF0OotsVz& zAc{sgkdDq_d-nOS+V6ezS)00zAwXb~pgdLPmb55bqWHYbxeU)5s5*+Us=s~lCxfBM zSFemf`!}1E0tzEat)i&ScH+=3Tb(@1W9j(}#lcx1kg9;73fQV1p)8nn%^QHKm0_mr zn-ndt51cNi54e&f;k-~||cG`{O*~XwX$6*XySLyufqkO)M)2v!oXOG=?&;0<61=}p8 zXpbt0%Q4cw@?gkour=hBKsMIP82Ew(VI`YeAnxrbvIBci#vRv9uS|2#ZvLJGk*jjZ zrf0Lskq0Aji{r>uO!f1he~$Ml!?p7@7(HW^p`W_B$J-yi$7UzSEe(UM@R=&IyQPpLeXDCBaOe>%i8d+( z>$MnZi&(cpon1JBG2}A9c!dJZwwhhF;n87qF^98<72trBOw){a4x^B#2RbduHO7}S zHnE&$Jd|KXA8|b`ID#n<}hWPRbn+&nhb@ zHYhoB9l=2$iL{{)I~u_VR^mUeSDJddXH*;%hZ) zX&8_q26g&4fsXX`b~Umu5y}#Fqmk6qI5b}0s{P+_MBnc5r&fWXf$PLB8n05y#t(N+ zy?o=t^DC<9#;^%x)uA~Lg&7ob@Wp_%{RI_Q30lIZ#+^$?6 zx0$JVs}%EAD`q)!AW5xY&O(8+uDn}H7lo+^r3&Z;kY1(Hs@0fflmn_v?=7yR?JHk> z%|bYm-h?U);4sQs)sN!=-E3`uvk*3AY6%@H#Zt(=G0(t2RB9gIm9eW=X*X`NjKL~Z z@^jKjoOqWlUCs6z0{ zvW#OD#oVy*>AbyuZN)B37VXkZ31uuS0aHHj<#vO#T7vP&;RraverDFhfVoi zd`QEm%&xB;{3xLcVEq-sK?gC2%{V9=IZmz(11W^vNNI0m8LItKE|uU3h17;N3xs$s zoSH63D>xf-ExzJk6VrUAA7`viZqb`@VO-&rYAZ3r4E~vzu1NVQS5fLUa{aSW#<# zFv~%hL(Um9?+#e+J7YukR3Td3u60B4#4hXTK4$&HC-{4(x5I~+*Kj0a-~0U^ zur^qSm<41511HBzi!rRuhG9Kom68>DLIlT4{!G)4<<_VzVdQJD^365?j~u@O51Opu zIRv&EOCM;T+UxUc;&L+XZ5~RF1cMF)LdcQAU%lNOmPu#m8?g_r(Gg=z);vt5lZyZ- zU=-X!Ym-(BYgVFB!S+6@G}E4XvyCGQ*8mge%60ovs%Wn-%wx!}Snk$~R-bvrsuM5S z_!s|+-TL&e+wIT&rj>ZVwWykK8QTnoc>tV0j@GBJDK4Gt( zyJi=!+_vfYl!xJbdL75EV$(AVD>gYbO&4w30J@+e&ZC39cJJxq4kZ3t4%zN+_uM(Y z%g%@{ymN0g!aeEN+ww;oG}`~q6_nS`&4+a1;Y~iLL$eW*0N;%F}tg5O%3vq@)xt(30 zDir40m8%v;IW#e?kVkh<)T*^S3c*L^FfmZd4+}_>$y$ZP|r!Q$++hLaikUV90r5kYmLvm7<3Q3tFpyHK;d*xt0u35J77= zsvg=o(AQ+dV}?yL$T1Yr-U_VIH9 zWR}oe6^LAnOvOMO_tQKPN-2ZP^))}BtuVT~yYH-|hkewm){9|IuP!+Q>EdT8YA#>0 z1sqZiM4T?*h)Zjh%9cUiFl?N*!f}~Q#jakPw&}T?J@@92Wp25z6{My8~MT6r1rm3_M(i8K!=PlAND>`8740m#3=?oOodWu0!Jf+DcNkyn_^S>yY^mMn4WAfO!UC#k{I`<)((q?dvN}$pbkUX z&^nbY@~`bY3c?#ck0UpyJ*Cu0T~mnwS{|V_QY|4+_h!W+@i?*&;*9ch_nmgQmbgPz zQtMz}zs2M2hJv_rRu~cOf4o7mCq_$tx{^#`{Z+fQitq&!=X0h z=8rqR%g#s-+Av*?@MO`xrGxKCvk@XGyL%6QZrW%?5SpyGT(<0D*)mJe=Os}73N#d_ zBq*j#5itm%l6EL*Z&%C`$&gn@Sjm7Ys$o!4D=2BxmNG52w5kG)TQ)Uaw3!)Y;T3IU zbijK0`aBjK>r7g_tJ^x0z1CD?pzEs4odlT&t$(o3y4u^V69X&j-GY-5;?snC3+OG5 zp$UR=)-aw*KULh_6A^?Wc|;)|ZK1FU8rMR()@B&p!Y#|COEx#B75wRj(9?GXgjuom zViwe!g}U=Rfoj>BK%Eun_&R7P3cKjR5q0(?EgBDaeY-GDwH0GtN5QnBzfH-`rG3;qmb?H zi`$;wn2mLZZLBw8yKqutIP_tV;(#1Htf(W3Q^L3?`%0k{F$87(Y&1#PVH-d^g$I>+ zr;NAx#)kAFOc?g-}o^`bTNo+SpHFP?h`PN$Cd}6J(HQR`rkOK)4~M z{N7lzrE$f{sAFiWUbV_T&h4fSmBPwBJzTr%S+ z=d?prD_X;yw%(kut=4V}#zw8ZdpAfr${4F|8|=Ie=&6@+KpV(Q##97V2Fg(>m)A3b z&ycA$#S@T=k{c}DClpbZ=o;gT{I<#1`IGR>+E6ZIpZWN6*4y4~7tgAf$8~ImDru)x?E^rhM31G#logdxi!KRNXxt@Bjk$8!DS(y$v-F#GG?=Ay4Tl3b zMV#GcYJq%J&Iw)DJeaDEs3NzVv!W4dt`aCTm#hWhZITfHfXYW{(@7;T$sP*GdwC^v zUGq?K&?=HF;Qc3YsI6-I!Gi~VBR@UY&NKaC$JedMckO6A?6>ZSIHUvqd6X1E_tGZ} zreiRSc@1Qsk}5(Cni$poBLN<~X&b>5vgG+y&q|ZRs=CnC9YWDUwx~_U<}psy7K~J@ z-J033*DvJkrPt={^>dSU?dAf;tl3WAb;L$T$9(g;7OtagH!-p|U%h0_wGA5_7=UGf z)_E24(!w)^X_WD$u!q9Ixmua;1#Ng_#Nt||k6~R`*aU@CmY%1!H*Z;CHRZAIBmQLtyjy49p-4 zx`z>@vbMCa0Mg^03dO;^Bs5xGUt0&QV|c|V6e7_3I()uIN`{sF+I#f9ltW|KFqhvT zMnd(NCExsRLzzj+o{|x3!Xd&qF}nIbV9-K1#CSw0@*#_ddBtgW@N<&S#c}X@ZI@G3 z0td_~ac9A&q(NanF_`5{!I5B1;UNsg62@#BC(+okmi~98)`nw62O*GQ)1FOh7(8Vs z#bXIOaPW{#&&=7<$}-|6hlk{VsKsPeO+$`I^Es|e+cLTVD~nl)ZIwXdFfY~2QxEC; zjkI;KO!c4oOvVs2%I8;Ba%w%Yg_A{A#GV5IkSom54U!C|`c}?gYj$X-C;IR_`kSt$ z#l#kf;Ybq}?cQrK&TwMT9YARaMq0 zSMLZnSwrqZ7H(B0U)-tyn*#Ee&lkAo*H_o?=>Rcpg5Zc8NhO=gW5f>P>*k824VYb8lXr)L5(Z7O>3$&t{7p7-Pg|+UP$~)@`vg?uqu^Kg9`?wwQf?3yFf*o!Gi zzKUg>HTo@NuFd&Y(QCC`Yt;08&3S1FK7VtFf`CuirCN(+ zOBj&0xWzD1T^RS6vk43gs74#4$r!36$KqVd5sz&uGsw8kFo=cEaX%rJm2?{6knpUd z&}(+#@^w3R<%XsBUCvAk-Hvs6v$2N9reoq|!603R1*T73i}KlyE7Nv)5j~V%0+3jvP8} z?|kQb05wVw*}#BkJ_n;p)3hj7K1Jat^c7iC*ieRjld(wKtX8wnFTpyrmA>Y16b5Oa zTZQvncEv7nmP(AMZor5zcFAO;6pO-zEt_o?!I*1X3C)YG>H74!LTcIpRbWLA&f9t{ zYr+U`V9=UDA?p}>Rm^~s!1CvC$Ti=#UW>9BJ`M~r{koxw;p;W}nKwbq>T`vh`(Pkm z0GRtJ?HJnxqQ*^dGk2B_sKknO=f)v)ol3**(V+wT_VKLSwz{0PI{j8bK2#lh6MfZo z_y+S`)?6m?xv-*=L?Cd18)T1*dk9K>rfppc`7Hg?fkbIXtEHpBAiM`sa$LN5`8!Qa1cuN^;e1ijYWWze4c{O7%z$-AC> z(qfUgJ9#cnAIsr;cRPU4*h?60~dQA(?MIxT-VbK*F?fs^I>a!`_8ffmgzZm-di zuq=EO*FXmJH{`?TzIcT8NWuY=lA^Y7c5*Dz1yy~KY4*enw>jt=Z|V63ZuBghHLhE2 z?DVR|N5tg_KDP)O1=? zh(Tz9GAn%1WV`l`Hp*KtxE{+!FgF5GTWe#$0&y$ixHPfdiZBKvZ5Uy$uUS46(32y$ zhcZ)HaKDf`q?cGkPwPqlQka_Yli~=Nk zyR8HYUP!}K1jG9a5_t8b{=x_Ub3FHK}?Esf&N%5)ODl6mLz zLf~9q;Y6j)HWCFI4hh*-uglyv9EOWLy};++DqH$-Q;P?Elo-1<#z#n8=$yYvA@%I4 z=IzdncQBPGPDAKpX$wzDQ$L%+bbXt2(@eio?V zZyxfY4RW&TpLzu_!u^!_rLeFH*4FEoW4@?;fb{!1eO}%`*7Em|eYoQMn4pLgVoPrFac2rgAAQ`4$m~o0VSv(oC_HNjAEoJHX+g8b^ zkk`B|FU)x{R@oPYS_MK{crHeg_u#{u6)U7CEVXdW=BKY<;Hog^Wzc-qE?>Rm{Vs#3 zu&a_G{=mUS>x|()|JVPrtD<+s)~KZm zu=C}4Ym*b9|Fw2VMkxXt>)+MuJI_ka>zf6OhMH}pzt2t`K45p_Kz0xJ`+T4;W|gcm zPHvd_r?OL8c&<}nGi_a=+I4a;O3l_DM~aLz<{JZc{NzdN?eDSaTjMr!^OlVb57^05 z$Gw7sbW7XIYuSX)3G%2ON~fLN*4jY!0yV1Nws-FyXClf}q)|Q^m^VL@R+T^Z1u060eEQ&J?A-j@!J(;gPlM7O83|RRW4V^w|Nuiv>oM68udS! z!|%`7==sI$e&aWO!^XzOeE+C#7OwjS3H$H)pp#I<7L;16)MdUjWO@S8T^~R?x2cW6 zYr|P=Lyya=3|a-(yLDD}VSt+L87tMF1?@#J>=?@$V^)&|~9?n#4HEkHDsuM~Zazn`PG{nEHQ_g-% zPKoPC^>iocu~-02`C7a5Cf#YZa>a_Nj77MnluemdiUZ1ls!WqcNp7o*V&>PYFj3Gr z%CGfPa(+sQotd4s#f4crer&(hs(Bk7?6+Kc899JmMpP}K#kWsy2dGFk+BvnyQ(sri z27B9WY_P))?H{sJNA}vOqr2@4*Ez6f7z5g4dv_1n$rA_cZ4Vx?CmuU(Pd;|P-F5d# z8yp+4qoAsS2Ip0>Cjxr3TznUvk zpQO_nz)Q)pyh^TRgp?4WaBH=$b#EB=DA$g`dJ_9A-g(3loSQA}ZX^}%s#S7!?$s~Z z#q(daE0=M^7&OgqD8%H;5s(!zEFpFQ6OGBvAwyGuflT1^=4scpe8qn6<#TrWo$t3Z zPkzAiO)(4h3|Q~JBUWw2*~2(hj}3)sj2T8*hFlZ$s`9-uzhdLpX04Xrv{)bv`KVc? zSa49*-x;U>1AGrTbcw+fNKPdT9Fk|R|H#;@f;u0uF!HCpi8|V&cKE;^cl5KfQ^@&- zjqTlQ2ag}|az~fWzln|o?B07%I~W!4l9a1LLNniy+&Np|nqI03!!MSq@2svact7@b z^|;=zEY91?@&awIHyp$Upjq=;=%BXyR%lGu5Tg?g)1u}gdM>*&(${549FtP&l?EQ- zxy6P;{G5vsQ%%2HTy!wh+-8%^k<60<^WF z=B_s_55QWfZrjRc)cf~O`tWXZx(=zETOReCrFx-YSizV88!@j=$0k8Gc7RG=g_!8)Pv1XGu=6tT8Xa6CK z^^e%av*#?JRC4I9LVC&0POFs5wzRx#xnkW`GTOeNWLkHSj0Rkp3LxsGY{@GzXiZ0F z?|_%5$)s29-S2qRs@Yjsz| zaH@#mI+9=HJ|$I-F6e$WTjlp?GU-Su)TZs2H!RHOkbQS_ZJa6%BH`2|z2jG*pm3;K&kXO{Wt|w`HULK`-f11Z!xqQLhT{pGL5D@! zIr%--rNX#f*3~;|f#j&QbnF61j9SOQKI
      >u;bLW~$Uo&`3CUE`qdaJn-SGxSr7 z-S@x~cIxzFR?abQZQK)sA8YTo-oZWA*}dB$;eLyUyDc6cvi6Qq&Jmt<*w>+`l7Xtk zw=vjJm|_3Ws11$nhhd31_j~AYU~rK8g)O2`68&BS#ee+6|AsyXJ*%H_R0sC-*um4M zYy;=>F}P2pgs}n;6){wguEqJVjTLD08I-* zEBVwC1Jy$8>Fcp4pL&w7HCf-#5X{c(`t{2=taj^xg}wUPIe?DpT1t*^=scs=lp&%G zMuSn+{WKt&o8CRrZ@Wf^Y^cBA(wP-I`^E)3a$vt*zjoDk4xXKv2OPj)XtNTTlnJOc zith0EPglb=VW(iMT;I2Epsk98$kBAt*V?H##`iQYCa{_l5EPh0_j>!1rlP7|Ll94+ zaBromWeA$DRp<|9!u8`gGlj=dBM0uy04_d_fN?JjhSq(hU|MB>a%=7Dl{R#Zo%35c zmAumE2OkIqieVAQ_uV^h_2B$3EH)9r~`%7q`$%`=pG8F zYpH;wF9ep+pbhd@Ug(k^xe%BEIp zHk&Hj{A$G(vsKt`$>tXeURG&#sbrJ$8Jpl7pUv2<=@pxt%h|+q%5F?9+s)}!yE&P% zD>s+y@~uU?cw^BnfcBSjW!nNFS9w0*ku`0$;u!YWYd2sf6IENxZ`%R`l4gwaHJ-W! z*+_O+8RNattQ2Kgk;Y{F>hh|{g$<7$v13Oc_IZhV1prdnMy^$j1KlX{?8P;JM`ODM z72s4x;`(~oBLr=&I3oHep^EOk{qDqqktEKZdvPdrSmRaadTZ4h*R5J6wQA3N?Emz6 z7@>X{`1_BIS?}m>d+m)kZGL9KjvhW@_uY55UA%tLUORi%E?vECpM2&smQSTEh+Jsy zr#;c$00{i7y^jRC1ai81yR99@xiCKkNH9L9P!4Ps1TV*!0&MyMX~tFdz!O7|9bYib zxa)Vdi!Zsu;PRYGqt^T=`U2y4=-~&EV}3+)EBbhF zg*6aHEkxTyxn%?$m0;i$E|6ekLB-W#h3jjRwu+^2CPBsSJNqowJ7g`fb_+z?E!j0- zUXMNA?ffkuwKv?}0IddK?;>0)1C$Z?nZI8h+m0yDYHNn*NKxu1yp^g(!6^3=a&!^?AbPHu3 z>2{I{{YBYVGE%B1rl)AsWRuZDXr;Bhr%mNfoH_|29KbjgamWd~_u;qO_x{k2Ti@>e zwvC}w)8oN_jrDi?{7VQHpb24ypEd#t%Ij9ZSZi_M@4+QVnW_%vBg zkI-pih>>W7@yBVbZCf^#aznp{L0kg_ZLQU8qXM$$^V?19jL()Le!gK_Alhb`{3;BG z_W?ED;~3ep`U7WKpz%5MC^et5)wv~G#<^q{=B%)^VCB_}t>^PNZX6S*irwl&6RpTN z&&)4cZ+Djs4Gr4A`q#f^uf6!HEzd64*;ihJWp7$1GOPKNzM%nFA?Yec+{`dy{fFo7S$GO=#o-<_A^V6PD`}mVjS?9nY z&P-)}0D~D-V`;Kfx?oGId9Mah#hEBH9n|7-*+%3%gcHJ0c?IxZ%>nbXfOFW(NCl8j z>>PTd>J0cdOQ%%$SdOFarH9s$5zRkJmoz`9LkUY23}P1Bw?bPpas+gn$`UCg-PxhK zfgu~~i`uR(ff)dh*x;R0ed=R4M+M zA*1w-H{2-)^w`_phLQSz{{5RBI}K;JteBodF{Ze76GjDNu&UB1bOzVeDt9TLP<$j3 z!0SUD7}PeDSJ^f)W;L&Npp@rLpSLNNptBflm3rTV*`P5ta&XkX=e-!XKl5HYdit1k zz>Ji&wJEw!TVDIz=dDTk`K5vda8fg=B|QI}jo-RO8)_(6$*T;sG;R2{0jig#^&Qnp z(a}tykoRZOCT`hmfqS=GZ*Px{f%3KZad6jR8yeeZ`$nMtv$rhKf^dc~Mhruh=gzGc ztk%57GqrjOcMk}y86(^T0}$L><8vkYp-`w}V5&HvxQ&kD{E}@bR>GRfD#22;Sr8{A z2T#%lODtMAuxX(HW=egAQfO7X5Su1(g?L&(=t8hc?uhmuuuFuJ767M-L6bpYoge^HeXYyDIV(pg(s0493N*O z62*}zjT$ywMlLp5Q1qhBEa#m0dZllkYiGh)N+e0udwwF1N{{A8J}Wecqqy@o9!0p4 zzH0b&g{3wb_icb`5BLa{*WCxJZjf& zUIK*aLfpGWp{Q1yo|?oMHDN^hVBUArzcqfRKQW%#?xGdLx`DM(Xw|ogU_`W)#r8(Y zRu?8btvMV@BC8u#E>*0ABNBsJFV}4yM6ES$+oF=(R+{fsLwH2(XY|ao|Cup{f$O=k z)a|jbWnrJ0e8%E96R}rqmvHd#e(UM&vi*B@@!IRpuL|g+d&g*FBN<1AZe?ZJx&US! zogLf@$DGOf*lDmY!%*bp4j(>j^V3t#BARf*N|_gm@dCDVOjUrhj&o<69H0r12^i7& z3Vm16i<75M;TR&ehR(G_6ZQ%q@iSj|!IK@da5@rG$*Wc?VkokV6;uL3Gzn_CCJnJN(4{+-__Y}ot(o$7oj>R|e&!nw{oRc> zhN-kV$2p~U-PmSQSrkhv$2FL=}ov1at$my6%YU z=zXW`iT6Bddk*Ze{RsWR6NhYUFKnnih=3PtWog>-`Lr97Qa)$peAYsW+k*O5R#t5u z#k(~%?|aRxE~Zd`Rx9A}lm(+&V%rFp+L%hGZGL{mD@AKPlxLr9m3`~u+2v&qEq1m? ztUZ~uU3(APqmMjfrKRguSiWw3T>%`#x|O%ISQ96x6mSWijN$sGC8IG5DSQT03eYxX z+|`>wg*@X1#-(|?X5FBlWQ^+wJ*tu~eYMW_Pu%^W9X;`Y^$ZMS5Ry3XcHi_b*cOEO zwRrZ9lw9FDrFJwb4m4Z1M`5}>vXK}LoYA%0IHTWf%o$;jR6YIR5KbI}7?x5Y3o>w0 zG8sGHzzbujt-{w)CY6s-CYl>v{?~*N4Qd>*K)i4?vgqFaj;B1fe{*~aV&QZDkfaSAU8yf7h!}~_?){7Qt zO54~#iya39^>!s~;`U{LNxSVH>b9xLTki1MFuvMezNIC|ds7w(MJ?IUYkT+YN1ihD zqZl-OETkQYWB6$!j8GGOO4*L!KuWNXQX$RH+TAwctdlR`oaF4e3IBP>i?+)M>Ti08 zW;#*Ms0#CX=Gp&hs;QEkD?UM%AfkQoV#GY5s|n(Wl+dwoq7LvF3K^#=O--1A@bWf9s>OI1|7R8^>j zXXCzr%oE*7dkXt;PiNHjhqrA%V0APUw0=NoZ@k$C<85}JGhv6YFMDbK7>?#^=vkon~=h|_tsl#x4$~unMp%_0aN~0f3hCF5_5^(& z1~|jeDjP7YqRq{%S|(G*ccJrqX6JaTGy076zvYe8wsI4;np(wU*RLfS&f+0~3KEu}q$diS9N z_TKM*pN$lf}?0^3HV_3@Yxu~x)+4i7HRiVH7m<2R=`LJ;pej{ z3mUY(JZbIWEi3W9*143hFj@-~!4YW_x()83^#LmNQ7=@X;n49~9R$?m_Z0I|HRT{m z;8}MVZ0!K5brM0<#_H^`@BN{lvd5o(hn=|hUORpF10dQnHnw}eZ>^yuiwa0iwXBrc z69~#N$P9-p&^=~-!~4uPhQk0{ff+pyGulaD=!l2x%-&w^+v?v9qF5m)LKx$ust`($ z(01?9aH~c6yE3LCFfvtLi0OU47eyXpoJu@V<%-jHox0P#-P+^Ai=Ic`_SC#{SVRCNVBEo=m9 zD<&mrlOeuyNIqTukC6~VYtK{~M{C+bT)?3abH6F;T9OVX1w}RY`4QpHIxV`qu z3mC2f4y6PFZnC>h9RWNj-oK7qcfo>SG5`UsZ9{Cif6x|S3rbxd8QbfuK@Lx0PI(MD zD>>=rmY8QTqJh54Z;d`E`S##2r&dtB92FN->l)9{V0LJl|J-o?VzpI(LJ2u9VldM7 zsZW2@=i~g~dt+lmu&`EJoSpR@O$*4%ZrD&Cjz{ZDvgw??@TIR<6a73mG>Cj}*lC#U z)yvl{y|RK)?0{*70cs0ApDgF4EHwuJ+(MPFuiP59GJ5si4}8EjHP>6MSrHv8@Lq=R z{NSJaF<|OixZaP?G#<@24Q3>d5KSzCVz{`eA_9{7Tk7`P`Q*vy%4>4im_gs*rey z8AGjQ4jbw>*x8wmF6-W`S`Z+iV5u6k4MP?P5hx4thLQtft&-6Vi=r=EIJmCCVavdR zDz%DD-nwa3?1Cz+_jPso78_l#FeTb-0LT<(R9I26qD(|zTA6OJ5%e8p!?Eg%JRRT=fhgIn=_T6=#qAyMezzSvc?{>1w^DA^DlneS zO4SM&u^Lo$4dzlSReh3OSyrJ1bVSS{IPDrd7Ri?+NnPv>qUusAv?Q(M$FFjiU|oTF`8DW6K0TtUQATpn@y zJ^?G^cxMP{UE_zh98z-axq~_=S}L2*d-{C?Wl-e>6sd`myJ-`*P^;3_HRc!&lqig1 zV1+FP3cdUOQ`SE`WM?m2vLeo3l@yv<1J*Y%Xt!?Mw7>T&f6G4dq2IRMyY^W>EN^ak z$u5tN+n%E*?9nHmv`9z7I(vHTjW;jYrK>kgJCbT`nvAtO86He?Q<6OWf5*YdC<=_| z)Zwo@vq*z~n(ywM`n>+WBi9Y()v2s3RcKZiNFhnS%ta=qrfp_%*_KxeHZ`r?Oq=a1 zU;Z4jZ40f{bx3oP>{o|MW>jK~xt5xX>sM<+LIDLqi9+1ddA1mlLt&*kDLur>c|z!`iIjw92ahvN-R`R$CYx0MkUwY_oZ`Fddjnk!ItqSpG<>Q$Uyw*$7$mU`%Ic=5RV;fKmtsn}Wq`08S#F=B+;5*jS^#&~?cG&Z*Ad{{2Uvv9_*$tKbHT z+X0)-mTWGaxAvX^8`^Wg$~fqAwceAyQ0n6uc7)vY#91gbHnHO68?Vb7KjW1^BkFn)wu z3%IucvO%s9z`&<(PFaXCnS%K#lTIaj6h#r^Q-N0{V5mC1`d&#jz7>h&MzTnssse;S zOh8LI~}_=4#}dj{=^hwirRdd2k# zA>f)4+{W1D(4YCm#x^ustE3&LeLW#^<6`?A9Fhm6Zp*QJC#Syub?N#pA3F;ChaIl$ z{LgipS2a|~O#>$*rOA11R3^g~(Ih?tw~Ye{F}N`dX0wzTEa#1zxF!4^fVTBjf+Sx1<)ZTLC@ zyS;(nXx$Pm)wT!9pjqSlMT91uUjvmDJtVZ&61DR;=Io^l*KKMcYqzJCKtNHi+@J~8 zL~_8s^p$h=+QlWiFkZCFi&eXTvAQsxw)2yDJ3F4Uv$xas=6Kd#=X~)-%D#MSh1W%U z>DH3Hcyr!fzQ%cT$zHp$WN+~PS$;l$d!B17+NG&gyS0?HWl&sRla4%xK$fPo75A1Q zP(|_#R9}TgHTR&hHOjE^>^dJ11lI?sA>GXww8n@v4*!#cpYd(8VQs3~PJ@w>c*3%XBb!TdT^i+zk31N36-uSOS z$Ijsi1pIx++3fthb2wwV(-)HIozLj$<&cGFHOHdAH72XKtY>JL=j#IL^L-ra8|SXt zwQJ+_Pb+LR3tOJ`?|Dd2OBiUQH`seqS&cy)7L0vE6%!&BjdfTAkkmKW18eHB{=RmQ zzrxKRX0Ssr9F;h$)A@Z3MlEJtM`rU@tS=!8bDRqp-$ko80Vb zk5($emcuyN7zSGma>E@Ff(a9cO#>Wyx_WG4X5RkEzx@yPnODx+Qf13h>rH@+9*ZZt ztT~>rY9wa!+HSqHX3Q{YtCEw!4qBZqc*nJtC9#rm|s+(!>FRfI)zwc8t#EuFmW zGTV^h@AS~zs?RTf2d9odwJ@EstakqXjf$*S&xS!Db$^;`5t^|8p+H{0ID6Bwb5mSr z1C%NB1TvHWgKCsbw++V(x)5)ogcT@l-L7N6#tt5}dmgyQilr>qRj3WLkK>_{rUkBA zd!+Im8gL;9W!x!6Sbz5o^%yV>l$xn>9qRNj2z7x$UtCVxI*v%$WhE>Na>i$IiqW{2 z?pXj8RbXCK+P9L<;+Tpk{~BzkV)Ln@Rb+q>Ls9MifqwgizxLM{)qq`@UbN{{$v0h7 zYVC45XET~)SA2IR%Xjl2!-~zqTtwxUi+l#UorXDNYnzs@s(|B$FMicC$Y?i*FktnX z?ccxOdIv{s*S=%6=fFX%A;OQ~x60Vz1h!#k<<$k4W6q-SuxkL@69;+iv?bWyS6{m9>FbIxY5ylFqqa}hcU96x#z9FEAOFNN_TYnWvw^`Ot79nA zC}@2%XahroAkvb(^Bs@d%+!R+TF9QtKF&k6_?D5m zwT%`#aOfTw<5NC&)QPc zXP6e%YW)$n6Yp&}3Uo_J3ECoEu0zFUm7t{pzlniCi^QXrSCR+)rXsKk?d{$@YS%7b zaT)3C?shvqGdFF)Xwc@DQ@%Vvc2shxo5{{7>V%gyDbnQyX^nRvr{})5=>>JFGCl{0vvu0<;=bnR5dr zr4xkG8rxkrnJVoHl=)&zgvZO^(@f35$WF^aiQ)^@gh5!xPo45?pw-lpXAG&%lnSM4 zUmB%d>)O#!z=ry}ZDdGjwbMpN22k1o+r4kE^^f$~VrtGNXKrF#o9y2EPl5QS?7)%z z_7DHXui68TJ_>@Z+5<<&?BSDp?dZWVOD5Yv{=IhBnPZ;*sdWYl8A_Pdt}VK916HQ^ zb92jR{`1jvtjX&MAhWdoJH%_y3fP;Tmk~` z;>zdbJftRiR&>hN=^x*blJR-#7)r=Bgz7u>p(bHfQ_$LYgJI<@Z=X6_j!LLd%BA{x z%CPGi?6+fg-DTleH>@^mANsA|$N9HoB*J{X*%Ivu`XT9yGZ*IOF_em(0}w)5b)T?* z`j7u94!nkPc3F4ds4b;H_vP8&ae zT~>GAf9vm!_jC$~`MdtQbIr!Fh2hm6Nn6&{H{^gI67K_bcQKaz_K8n?#=~|W{_tn) z!sQ9Oe)9$hSD;MJT;JC?G<%lhHf%MMD%kSulFd#{a?aV*_?(q6*nwcgL&bIEQL?q& zi~(#aTXh?tv6;8c5C*xu$>Ia;){cD2z_%e=Euide*a+W1HbCZb4(LR)gQmuz$JBb5 z?w)?H1fjVf%}WmU57@6{MJVq>kT_}=!nl9b#@O} zWwXV8^LIXOzx8|1dcwk|KK(h`+Kb%8oxyE3;dsMMIIA9@{g{-}ntJ>@IZ)3;_U7w)#XYK!fA zhg7Zc7wqbsMS^?Tl57ZihMMoPg{%;@8j^Q{9W_X+Csb) znQnnOs+44FNTq`UKE7I5JAVB(avue34Feq8?efhDp0U;PfL_(#)V!3$rgf{?mvdke z8e=Ml6W{K!^S$pnGrISFn9(DR)b6hxRL=Glx%UeYAdjSWf1d<=2h04Eh9&i&sh-zSFE?dT0q78{x|;i zU$=Z=)lwNv{5BYl!bD017h@4JkkjyVOOUAI=`y@+LYWALXtk`Tlv75#juQE#vYZ(M zc=Xs&d-c_Go~fceRAh6s&`?`4Z1UaF{w`lormZCgdoemVsZH)TGdt%+}qxS|#re@@-GN!-jg2R!h%YdlE(RGAS?*P~5RYdl0rb2)e_fiEai<&QkLT zjR{%R6WhOk)D9ooZF}}=LOBMqETOn1&*s9uSS-0>1xHaZKDn`%GhQpZN=qz z%VbwEA}!XQ2+<$Ng65U@>{htPI>wGR*kB1zaQ&iv{&Qb2ReNw|q-?suq%$MoFHfn5 z&G@dX+&GoaV^}r~0td5dwIYVOwJmHakJQoEZO89EW7lra*!aW>ZCJzU-`g-GD0McK za|Ww$Rv71`-;3G2b#%h~gz9LM{N7i-@)f)9{`)Kx8Dw0?EP^pxnZIQ{usm6wr{48m z`|!s;L7N(B+dGH8zay7Br(e_0#%FlTf0oR+6W0~=9!OSluSx6flNho!JFx$NFP_#~merMIoS7C+ zk6BO0peMf6>t$afC&$j?*wDxzharRU2b(PffN6#Ov}&spWJ;b+ z^D8w;PYqdil+37(IcXEo3)|Q4Kir7You@#N!F?-)uI6oDR~h7)j(# z*>;-86`Ilfq4cqoFZmj~PWn?-uvM#3LnIxR9x65b#`w6i2Qf_TM7ySSJlsQT`HIDg zO-@bWQ1duS)pXmmD*D~l9Kh#oTPk0$wYC=9R8m8v#oBs;IEARK^4U2YVWPhWHW~Ji zb-rA(0s!bA{EL5SW2a776YRA%zho=p^LG8llrQg4(m?>Hti&oMIEcmSVa0%?gS9R6 zuZf>zbJ1nZV@)lsTDZHsdUxy^d-Y~wyXKW72PQwxR#EZ1pR z3TLTWhO#?ieoAceB^&gVhv?~B&6ft~JIycEzd;`~);c81f7GGR{l6}OK|-X%Q8t~f zQ}1bD8tXgg6d<5n<2pt;++4O~%q-ZtWeO04kuq%`E`tu7M(COxJw+pm$G2EA+JTX8 z2mRIUFaF}s*_I|{D-}-_R!VWP(Ab4lrDvMZzHJbnukdH^B!KEvRS4F=!y#RWJ!Hs8 z3dwlACqB1HyIX=SwhSveb^5qH@X);=yb@2cW^s^;%JyipEGwti2Ll?y~_p$dc0WV#zvX@tFR*d4nt8oy!Ncw zrY{=|29~f5A_SE+Z{tXL%$+P8(RX|XO47)v+oo?NII1SC#8idWG_qei)WP&=y`r@& zFsF?s1P%pWPTLg>tU|Qv%QVhqd?96@dF{G=79+KVaqQc3$e#JsOLp+UY5Vhk@vqoF z{%8Np{`xQdg8eFN=imQ-f8Bom=l-hI%QaUV)$khIHR1^gH*Vd+ab?|zDwzaZWdHhK z{Tqu#G5qv#F1Kphfp>9X1|yWW|NUS7Yvc&5C^_)9BL~Qq<{}%YTwqDwv|*He?FxUB zEa4K@18oHk~WjrAs$08pgS=DGO0c8B~X? z1>?Nt&l-v)t+Rj7hW3ov?gRVW;HmtP!hFigQWftS47(Y*XbNGJl(9yiDT`1>M)RNo zCvvL3l?gxT`4l!4SZjPwNgsUZ&LL2@M*lR!GV*|dU?AjkjZePk-B!}o_`SVv(6aS4 z3$#RCr_$QwuSOpM1{IELPj>hu`Z}LchG3T#ZgNj;s;5bNRUJ?=kjig0Qodz4F?twG z%~N^!5IN3b=vS8(Z5d;nUQKy+qC)tp@p$a$aZipYm$URi9Y>I`k^Uho!yYGYPkSi8 zQr_UKIU`!*=Q7`yE!sp07GR#+L9v!HqENPIV9j#XJbjLnhgG%0b+poL&+fhUq31pU z!yL5f<*dEATCf#*GSV5dU5v~AgL|w8=BOwEW(8k^jABbvJzi@VkuVK_vmt1k1G$Xm znHZzCo<4MsJ2Bp3u5CD*o*C{Wb?%yLubFsv)1)F)b3-+|jI_|5w=R9#^aQ_4j+0hN@1+RbD&);}_*O}4%4?bj%YMqgg zIPDQ)Y>^Q_2-oX4j^{Axf=C55PP^ z)`4N-W1xZ<*VY2bnEi#H`B7V1x`{}jFwk!;zFY&<2o0!Co{%J>!5~N}87xlz!#IQD zm4?S(C8T0TQa% zP<0_Nn8D)mGQ+=a_ug}g>s76HU=YJOVC%Ia<3Zn{pqgijBzx?Mr@z-$vK5=XIc`Tm zdIMTVh0$ro_y(h}DHxAR^S8jY6~9k_*!Jxj@@>Y2b1VmsGp(1L8D-O}mgn9vo-0Zp2LcVCAfaxG_gVMYG5=YHV)Eu?`|M}G&WyAV z(O_51Ry7ZTA*d?5t2ty#nF6c28$W&?)B;gW1|DsTGei%8}=hV{6jVcdtO{j+1$*MEv1&NtFzDAJKA~fO?%+s zr|sB@do0=0ZS64X7>-=!Yvi1&TJ(s~(-H@jaLO{Co7yA~R>a#bkN$)hcAvL%Bhhfl zazp}V$|M!=(p-c>XOi3B|Imj_+l|YRD48YM)sAeXeGX7{+$!kqfukqg!R#7B_PV;= zxvk96&)iY{xu~pG*@Zd!#uO z$*sbS8z{vl;8aLm?`hqW?wjQ2c(ucD+ zv|#t3wYKAouv68t5~lb}IBK!3PU{&Ov(CX`>lz-jO`QK6>@h)GwS1zrS&0jqI9M^H zhFwz}PSscBi1ayCbrCCSuy?=|?bw8UOAdC99jEc_FeCjezp;DwZnwMo?l=2cpVRL< z%;>x7jD&`EjrQ8uSf|ZRT?5J7vXzAiTUxknOY=AVT%Nzi>kXT{{Dzfa3W*5*8g!%> zXfuKk#Q?W;#B2-H*cJeN^S7kds=%xjnhGJLH*QVX&;I<+VklI{E8`)wVxbHb%^;$>s> z;2jvUa=lZOuv!^KrPYgF`gkXkcHe{d+h;!aIohR2IA9Vq zsg3fwI=g*R6np0r`j;-gVaJajgfXkK0*_a%Vg|Q8{8-LT+y23r4R_%@69F6S2-;|O zgx7!#C3!E|=D&}0h51YvHWRdwo(S)St+%tq`jWiQ&-;eM_Py`C+wMKN+m0XEWed~e zcJk$6)Suoz_CGHej zmCUQSsQN)5%(WC9L8M&=#0I^I{LPIKGAYCT%>VTvFD;})b|FlkYM!+b9&9pgBzNk} zJ=UizH-&{UZrToe{N{w^kR??dSimu9Tlpv7`Gh+&C88`XF8f+L8AJz#Tw5}K>eO+Y zo13#pERG&;07_~|?UoG*sQeGi*Peu!9HpTMc8~)eZB(Ssgom%&&Fn;w39r z0J6xM_SNZZ@9@;}%xaoPhFv4Gs`S3IyRJf;yiGsWc_u*UMvI5tp9WCeJv74D58LUH z19oC`6qyQJj=uhjfA^o*M#rF~VOA*|WD!SP$*Eq zO1h%8K{eSE_ZBV4EG!HMn8t}zV3a{veRDYG(+XP1t#GuW6RNeRj5s>W9nskSeb&?2 zX-)NtHLa;Swro|v^2JTl0%4yc>q8dld)2gTkH&ZpKBS5jjI|bL@D1$he|wltwqGUA ze&~mO$gWbCYrfAmNFXW0n-eEs@$UlyRT{!?*AGMb0>_S^A;y`WT8HYnScjNiIK zXLKUywF&egqu7LyE2S|6BG)3e5)7pkVbN;x^^jJpY@#C|Hf5UNjIb>rzZTmBVRa4k z*gKzo+*THEVPs)I2$v>LdWccGG1sD&q{msyu1jhl|a_WJ_Z=P=*mme z_^x)2l<+9COvbTAX|{FPNQX+!DCJwIxd{b``?{owsTo^dNrBGvESok0Iy-XYuSL|vkrQ{}jFh=lx9v4pLnUil z)x4!~Mq)-$R80_!jZ~Zn*8{1mL0F+UC`W=tDvaT#I(cTseOOLY{Z4T(W zx-yVj*eb*~HnztrMttcDFMx_;0>}<_=H})-wOfWn$r)O_`|`^#z>YrPW8cQ_nhbAg zs#{lh&Gz;uY^W=0qdhPhIi2np4kyYh@AXD~aq4g{4yi9@qkX*3-$r`lUdwB&FOH)M z_;%{aU=xOR(k5%Or1=GF6d?aJ#I<4Ied zx@nn}d24Ilv~HYYOWTH>y?nviqV4wZBk#0iN7QbE@RbR+d(Uor9%lI7_q^9Zlj|D) zG)1i{2+}&uvuJL!AjZ6X%mj`mVAIpH&X8_hxnd#gfeflP&r?PF zIh<=5JC>ldd}16K)Sf*!*-8;81hYqOy7%m{(gv->!9$O6 zPVE@IHXL2+ol4PFd*zi^Etf0ukefKLA>?8J2Uf6|Nmvo>R&ml;H0t+LHthy_D;wa| z>P3@zCTB{tZ2|yz>+BV~dG5BQW>c2W}oaYL1 zj?<)*lQ?2!(n%KDU}MtpRvgRV$gp*HC289#_(V<}UEOGagsz@;JAQb#btOX9g`Lta z1Pa9~m0oh9(7r;@+NAWYX8SvFM*6HA%_8<`X=%yldNt>#pOv||^Rqsu^J~uN;fEjo zW1Z1XgTB>6-}`3HNNL!6#|G`tfn79k&C!lnhF-Nsr&d~nisEK4_UmOF6hfdel4sY1 zcM#XDw8Tuc;xtbKEu*j1`$D}c8d~P}ANY~)!+EXxdJ<&>DWBfU&%hiMHq*KyW#}kG zph>*VZ3L4Gi2Zn2O)QD_R^_?%Pm;;t%P{J1s&1@T35JwsbF;~AVu0E^x;$LajDYx_ zK723M0iEvYM=)bJrw-e{@1PA23`5s9K=BC}z&wI^(1ozQvyXlQqkxPx=@^Z7@Z2~= zSfIbpJxjo1QT0ckc-r#0ye-eoIwh}(F~HEE4?JJimoB*`sVFAM!C9_B{26JdI7}fMs_|1!JW)?xflG%pAXhuII+s=G= zbq|6d%Q;D3^%)hZ)%q6K0n%FTn6ZL;4rcP666bjrx3b~;+{Rb ztP2n`H95mQ!?d*(xh~_1aCoQB*wa7qQ)cbGw&&Ps+jHcE?b>qyKZ-#FAgS2!8)whk zD&r_;9RU;^J#oYx)ZEO1|XDt6cl3pZlw}HMG}mtN^U}jKX7Cz`zA;!S-6sMn`wq24k?z{r9R+>%bnnGQEIf zyKax%d)n`#`f$=CB^;=zbB^nm196Lu?zW1+u@+}5%!UrAIzrUjj9eq@LB?FE-~tpu zn2vzBHuda-0bY6If^}nGGT9tJ8C#PCP!0FEtoskaB{q2yMZ}#)f=f0M}pf~=gQ^z-Z|BpLmK)%^2ph>0<~mXgO{#KNeuus*qYek5u$0h@ zSWZ)G%+|KV4uW><*ilb&)i%aj6sL4iQE4%*-rg>h;h3E{bIOK>2CO3)wOwOk1Q=TG zCBz@bS*g;*mK-AtPsmh6&ax z3zo&T#4ei|C$SgR)l*8WO0%q$>vRP7=bn-+ZL2(WYr^V0|2r%wTrRRZo;#-r)~C@SObb$6&tK!Jk~9}TDF0{egH+) zKK_6v`z#eC&voav3|cXFs12NYHlg zAvyPO>7AD&`0X@G0!CF2r4@eV@RCxZt!;jb?4rX<|hSN(q5S+o;rqdYz zT*ZQIVe9U0w;M1!>*%+@=mBf#8M0%KeUAnC{fl3I*|P|>b-C(mB9y*cZgba=jh?>G z)-1}oAC9llN3cV;hg&8t$?{v=`&lZ!OU-Ym0YTv~$=(?ZXymALVrv%7}Vm z0iz58-@*>^0Q93aTGM|1zJ-C%4DTyErYgPnKlCsHf%0z_>2$>-aX=XH3WiPdHYHVM zK=CwbsL8|{j6lg0T7<@h{AX48l@n7qPyHjO;`_KrnQ6c3J?S&r$u!WG@auH+@B6_Yw_vQxT0;ojde%BIlKowS{u<#qB_eV#vN&QF z@feJOHu?s75@eF%^7P8;n>*wHr{_ZwzG_>a<-?+fWs!^1iMSd?USGS zlp{r@hHGnP?dQ@dCxhci#&P5*b`J=@D-pMjM8w(|$B>LEov3hSi2jUntq{g4j7%sL z8pB9NquMeAr>3wEAC7Xy6sDt%aTUqLF{{FQoZq$ipV(ap$J|Q4s;rL|6syulfbmeM zDH%nknxppHzyC%1ufOx0ed&v@*zbJ!S^Ln3e;fI&Sa1KR{gq$%yY~4ny=J|z+~wI@ z_P+0Z%9d9bX$!`RYbi>QDdvz188s=5UK-&!8G;4_Y8VF}LjLZrcmCg4aIU{=gd4IU zh9UzVh8_7f7RZg;HTrTHhJWJtQEY0!ZorgF#Ug#1u!+kzY<_AE$ARo3Yso~Xb#!AO zo3~)xQOlJW58A4=YpO;d_H!J^wFncPfL*J!kt%fy2zkmg{g+zJS`yIF+23ic5$pp- zKgVZUJ9}-uP_-qPQB!Thi?+)8b=C?c_Uu*m{rLZ}VAXoxZJa z032kW0BLggJv}|xGV~P((o8?AcAbaV0DTIX7K%y=&>ZrH9lz^-3n1I;^^z*7S`PhJ z1%2t3)>LZ#RZBsljH!VB7P{Mo?8{LoO15*VPt;d`+$lSzKHE7YU*GDvb2Pv8m$x3@ z_`z@Y*b(%%o;ubyTW#OrhwSuyPur<`-f1W9dZ(Sb_j~N*J@2sl-u6Cw^64M3w>|NF z_SEt4c^g)b(Qjk^WX?X8G*p@cLDxo|WQb*Es zD)coEif+YNG&2BR%(PZT(B*)H6Eu;CLt+q>udlRH&FyGmpC~OCL5bD&W|$C;fkD;6 zGoOeS65(fL6@e5h5))8yQU(=;lc5P?oD=*_NLkxgYd@k0lzsyt>um2vxnn*TrnG9& znUa-ZFj};i$rrs6LMl`6?7&4>Z5jr!ypqN#YlE+Li^#Zf zdlhWdT%FWESIBc+t^aCctW@p0iorthan}9){a*7c3WGU);-ot+Wpyc3xIy2^;p{)K z-zKLg9rY@Fv7B15FMRn+7RK4kE-l-_YR0A)mu+Hx$z%PqOBvqF`8maVlXHu@R-s&)Wa?tN$xbIS+_IPjJFz3{e}5O`b-hsjyRHz#1d> zHSOjHS9Qi!V59}h&v3hOX{5I!1zd0E8?pn*G&~O`g?nQ4V@wiI>cBMI{MrfzGyk* zMxlM*o*W~&!E?Z!Ey;CMEO=>p$_mSiws&O6R+m$D_Uu&~Ie5&f0y8{^7-CmfkF#xM zS{48zG~DN-1oFg8^q_jGFmkA~x~^1mMFPAz{7rwQ_h|#_%NrPO9Ki0Q$AFUB2Bw5< zXmy(*;GDt{x?{s>r(sIFcaOoGR&Cdwz36_zVjbP~sh7{${>R>Hb1fZqxrl>4`k-wO z9it<^wgZJI9U>_*T!ie&;(m9N2!h z4heQJ9JhYxYKtb^VHWc63g76|1iMxtW9xB3O}78=F`ppUdI1ftwhvcP$0(>Xi4z*` z?XV6MGy+n+^ce}~1{7TAOY<&T zf22$o6+iVA;W#TP<$7HuXo9pqWQkbZorO|W1=a$=D2}MzIxrOV^)l!X=G*Dl+=_uuUkrkW_0VyOscW;I3oT5N1+1O|1}ui4(6v@gE+6)#Xa zgX3v}p>H<9C>bB6+Um8A5v$=4Rs2(6rHVrpB6efbu*)tJVqadSpU-Mo*49yI$&K2_ zX9ObF_5PX+JYb0qm7!Oc$+@eRVzVyDha1<$iA&CSz;(VKXx+B=KJ}oz=gIr*{=1LZ zkN()Z?A`Bv%Gx}CzjdxQQy+%zJAEqXpZjKiKBMt_+fj`_rKqb?WGG> z?By@NXj8YQZ1Tp0t>KIl=w?f;Wc`tVz3+RTu&3Vjl$}0x8o)FRK!TOR0u?4+0{|(r zOzbCx(@;G`?R({pxlpzybX64sHo5O0taoX0&f1DKYZtf#w9L&;+0^W`t!68B?A`~h z0>EmEgX+-(?IWbKTCBssHqgl!ObH94aX_Y2Pfy7(Vo756dRi}^qbH|rT6&@|vDP(gYiOi?=2iHIJ`qAv zgfoN*7l4m|Xkr+FE;@8id(6VTw*l>5lM}&d4ec7XN)@V#Lbt$(q%`Uj6-11~20X@% zArHkOrc(54N(LyaFsedMjRXfFY8f_7D5@=*R9r)VrJM?LxTlm+p~I#0Dzzdru9V$f zyY||-bFca%D8%70YsGn?%OMbIM<=iN%|r}`mWX2Hs@Bo17_dSV+7VGD`?dIVC$k6! z6>0bSb!`Z`7GKua6=qNZh8Fxn!M7?l3tB&T=pK40Xz7Jnt7cX#fQ5`ofl#in_CQ+a z^Ef|cXsednT6N8mFpilEZ`zHQU$p7VmuzWf$}_(zwK7aAZii2wvaZn)1J2oIq{p^6 zE!IsJtYL7jIMd0|k9Z6E>g$JuQ4YDgv&)fgP*k5j4+1LW1obL#FgiBs3Z#CmD2zj2 z>+iCTn$*?AszM26#z_WI>rGVpK9k8iXi&MITp?#YyowQN9hnw33os}&S1J`y>Q);Y z-E9*S6R?fC|LwD%`yz6H%(aG{$wnAkg$rA`rT~vhw+0wH^;HYTNNg~Op=?D)0vdOX zEsk9kIyBgt%okvB`QS5Jm?;pnN#83AOi4OiqVZYDCJ?)=O=H}U^({b1Fx+gt13lI^ z)MsIsVlWi(Flh_2(Y#%zzf{P#f()zvq2@eP+s&-IZ?FCC$G>1-eeres2Y>(X+MoHr z)Ar&2@}F%T)}ek@C{{k5W=rXOen_u7N8<@Nd2Y2^GONaVa*qarKH2&A)J)hpM0 z++>O5WHm-Y{bQqJHaIZoj=QSR8t=E!8_*i|9}nc+wVwUvR+a;HI74|h7opL}K4I@aw%eW_?6D`h682O)YVW`yzo#Q=@4^m!pu5w4bk~@@ z2e4L?9sUlF9Y^%mpTCuJ=a6WAR}Up6=+Iph5o;A_%M?=?b1nrv1^TRNL@ z*20ML{sxA%ijl2Z6-p|hFXT#=!0@RMrVABHtjSKHccpJ@{y{&-8DM2j)%d*)BdL3O zZ8{+{5QTo$sTx>~BmxPqu0wk;JZ)Svz;%>L98wiulwBbaJ=Ny+I*ujjiiQ6BcUx5V z3hxtvl|*8&6SLCG{|;#r1J*@OYmV{u2stz zBhZ;6WQ7(LDk;&PxE0DggAy|MTN8%8O#kHbIj*mGv7rDe6BOf_LYAJ(*!8oo+owMK zAMKN%>1RIt8+Pf9*X`PkTeh07S!=S(T5w2--Y#p6f-W&E1(cavSP|rU?!_E0 zlx8qASVc#Yj4S_y@I9=9)6(xc8Z49^=W}Z~N`*uf=T6*-Q|tK^ijzDjl&aPIH4wGt z&Qt~6Wdxy+@|VhaOQlvYBneYJIx(c7p&_3W(1g0eEDD)wYXFAYlS8DiH*Va9HAQ?) z*aB=VldEvA0FHzHa)Sf%ME(NYD;8j^LNHsLoaTl!(X4A~e#2!HBciett*wnoUmlFV zg)uysGa4#pw}m63={TD^^32~<5=rUDnzK`Cv5b_Amnud}l(e5ue}AuUBQ0homYUBj zp)XuO_jNDGb<}PyS}Y--fe!oKkABv!!$$tuKmJEHHW;_he(EFE(~IozA<4Pc7wH-G zB{|K87V1|8V)ZzBM-H`NjMUFQZ=ycuA3yo~jRV#P)4cG;IlFP`s$F^WvWI z{?xG7Yh~J=!O)g$W_k{zJ7?!#g8|IU@|+4|H~U&L-*8gnj^b#I+4bvJZF1^1VqCZG zUO*6yP-OS|gY$A_CN7LWT{n+@b#qQbk@*Eek1S)fuWfrBI~t=0ih)v}6IT4kMJ zlCT~nZ3&D{Pfyy>qeq>sX}(SiyTup>hliapUb}i7c6jU79Zr5#ptLE2f?4Q!nupr;X!)2aB zqAdl`qx-q@!<|D;K&3OLrk8ASF=xx^vdv{MuGp(82qBN6E@n&M#*pPOvWJcw$GBu2 zz3Ad9jnSxuw$5v_WwTjd@TT1z6{eCBDyv8fQYAl1f7IlP7(??m#!(@Qtrmn$i@-oP zTvzs1sw=^hfavp5TAw(_@M$7f@n}^;(1P4ZMDs&tLB1EJE$()?UKzn}Yz|n5(qsBi zdew%KVN&C@;$QnUmGdQ@M~gKhrj7BUv7}Ez3W4dMiN5$(!d$@#C5QIe#mTf?n$6hj zS7+?SHz)12%QJRmI%`*^^7h7+Ia^r9kp~hOh&5YYS;d}WI9lp30By&vayA&s$bhA_ zxV<^#*@AKou@0O%y{!ZQ+r*I2r_D5=1oB;7o_9mrI2wjd>ppzZAWm9{TaH%Gr?C*) zRT^keF={@mP^^L@Lab6q9qM0IUl2>wB3Fg!v?x*YY1-brSk#7ZDACA>rB+h*u6Mu7 zt5xfJT8JqprEExzi`azHc!xl$=ia=CF{<0(*e;ufQEs(G9D%knz%n>mm>3AOc;bTU z@dX_f$P`OjWLPk^^mz*iT>II$yFgA|hcRH1KZSPGUa=steN8G04G179!%;>}GAEf= zF_z>ig_@JMZdf|YV?Cp=(@#Dw5JWwahC4pgAf=Uz4rnA4__a^Ee+iPd;f7my&96<&y zyzz<^R~9|dsTupwF+6B(fE6+D3ZSf7)S5xYm&a&E76(U%ZP&g%fV?)C699%W@Td&~ zxP#dB$g)w&;0vGwjqZn$@84$y#y|^^6-kg>tCrsS=9(#cP{^Shw&C)xd#WFBN*)nl zOf~l-Hs9;avI|hAB#SW{8HG6w4f@vPsZ81i1_%Aj779Lhrs%>b&y}FhUVrU1+XH*- z>FR}52TjFhHMgqFRq0~$Hh|88Hs2hy=U%^R&wl0=`}FJA?9GLot+qz3ZPz{vjqHP3 z57}BU=1CX|Dbv_Lwd1?)j1=C|A++EV^eC4jFit5)wYgdKkcn3h5c{gGWB6c3p%8zQ;REf^6H0j%>v5FM^)>J1H=s|ng>*QSv`{pO zafQY4HxDz&z|%HWkjU1yZTE=>?Z#5st}PVo(oEXU-d?bma6qqL*WO5rIHYBpTFshf zg}R12?Z{nsqqL*83FC@%^g;D|VVWgRA)cFFwajwCmX~s{h%`*3z%$@%Q6z0`zTLLr zTMW>BD33sZI!K4+9vDmdQlT7$D6}|M>p!HYGF&qJYPY_j?WY?G%QFKoWOTGh&KZ?o zlRgkD)!HtsgOW;QoRps2qSIq^~fk818m6W3g4Y`j%3vtK7Z;OqAuJxgUmzXVms3LejKxXPnv^ zZI&FVjE>eh1wt(t5yk(57K#8Y=mbxV$C%4#wuNEMFm2V5Qx;`B61SL`H!Mu(Tsx@_ zjqLXv=ia;MhZcEl$n&TEEGeX#fhc zPM>VkQQB}bk%+6OzSdVNKPG*U?kW>eQ5rcXRiKE#hI+bt?XWf<%;sG-Iy$=T6zpzx zei4~&^CXYHzFynEZ?9dtbdkPobylZ6mNexcz0i9aXW5!9MHP^rdLn9N@v1ebi7cR|WOBw5dJr>w?(3<;qA?wKUpVFZ||E?WU2RE`Ds>&_a;Yj%o zs&-+yb0|FEd!`7nBAkgX1`ma9ibt%*?{zwO8>CR<`+K0O)p7}|TyW!{y^XYhRYt9Z zaf>Ds81ksCWAxInqC`C5;kXjtQOdVgUrPv!Dv*ewP!(h?ic=e;o(lWOp=nM-0w#qL z8bZ_%P&p^jYHhX^w3DY!`|4{MOr`KDT^BopAyN&jW{XGLcy@%IGuf3i?HA*jf*5!e zQB`GMH;92|7*r8sud3lN1vkVI3&o<2HZP?1S16Asm23>jfJc>1G^pAekhP!?n^o$*XKr8uk3 zo9duR=@q8XVnrn$NRjn*IXPuTEiEpZs)frSYrHj{9hxle>g2O9Jien)h*sWXzqnqV z_cSN4Zo?o;@Ty(7aMnh4@3vdh^CBCj#hlt1RdYyMYt-&%*gBN$*B7>%8NIfFPSoT9)6 z!s7`PHTq9-s)gU4tqImI*JWZFPIePOqmZYJk664{V8&aBK?*3%!$5xRKmHeMjmGVn zk9@>l|I!yM&R8l?s3FqYAN6Hpg1&L+>O$<&Mg1%Ts-IP>u~p$m^i#L&p$fg<%+Hkb2i z6S;iB=cVP4RFpM@Ufy%>eU{3mtx!_PJ#2e$?y5FY#fd8XIXE&DH?va<_S&l#?YDpb zS^LyiUa2W^_b+G6#9`8_-cCO zVl}k@y3rg>tMw#f*4_~V-C_**xdWlnD*FzM{^O6m&8oGuA)TP03^&po0|*>Jlj7!3 z(4c-su#}CGE9MXc2B@r187PW-x=&AHM;%(g1C&4-O+)|!bj!mEUhS~Uv-Z+CRPr491*1%wV8k0H_A6wZ*ojHs=& zApoyHP`^`5HxdYNSovJa(kUEMvF3~;hN5a7O>uQqqgJ(nnW=e{DbM&-X>YT|qRKwX z`=t8z8V}UyipKMC4>_~i8f{S1n-tQd@fcSjZ5b5&g4e#ov|2i=ZMShC^qVG}HL)zw zRR3$?t3q!w8cJ(UGHz1%8Bpou#DqJgc9cyEgCBh80Tj6C{h@`7QcSf+NL)r(AtP<` zp)}cYp=7rvrmd%M$d7D^^RRushMPzgefFR(=S;J8X7pd}xKv2VJ@jd`1omsXr0OsHQUmvnZ9(}|<{Ga~4 zeeT(hSu(Eh%{H>2aIuC1mPEg}lk&mSTph?70rX5u`YDXVQx>Q)GE4bYzOQfUP{yee zZMH1I^Hyo=wQD!+V;}vvz5e1W){7(lu^;(S``}OgIWG*Gh$N9yu7Oj?X2iH>Ewj38 zM~>{XANzAZZk+?YHorV)FJlwdHL;H|)?DY*_=FpBE#y{~t$<@4Mis^gYhR#y-}W}^ z#Ym3=MmK7kmS4$P32>uDq{8>=n-YDx!8HYf1@s=c|3T{?9JC^AO!eaA_@sYgrqXjI zhbX+NMcrb&>)RX77F=i6YxaXb^Ha8leUS|A*}K<6%+keZFlr${h1g(>_IvG1E+K~& zrM;5xo$bcElb!Uzs>PL*fJ1!jkw^XY%JnNe)s_wQ_E|qHNLg~aUI#!&OBn<#$8X&R zcmX(Zc9nXCd#_`60)Ed5y0E&Uk~?dF2(2f={=l@00OlfKp|;MrZ2>HKHqTyE7B7Cb zX}i_Zt9iR}ZNlx}pVrax$Rm&ZFXzvncV+*^L!R9;OTNuR-_wNP*U<8vL&#RUL9XPM z>>Q|Sd36P}JxQm}LUreDO`Qe;O6T+Lq@MlQZ+lr4t(NajVrVgfN+!@;0X^-Af1^@| z-oG8?$k;kaQ8rIy6VsDW>Tdp~tiVRngKEurwiW*= z!%hn}HNojskm(yS6HPM9E-0!Zm^jyn+XA^iXQgQq*VY zyH*T&8^%nb(#8TyJ+nfVinaR#yBsCrj6IG)4!Sd$^l)1TXjTZmR4(#fr}vf4&wc)L z?$A8!%Qd{*3dq*yt9(oWKR6P_^A{JF7&rPD{Tsm`3fXErG%r*Ka446p83v>EWt&^{ z3-YNwVpioWkgp<$IA7MjS{MP|TUyL`>7zWquUBhcA*5W=)&$6OrVR2e)6aFQAgA>; z&4F$6y6*j|xlNyI(sR?sO^iZFh`m*FhFWJVGIOJ=y%CHSQ!SKw`wtO zIUL5!jjML`+^hEHYcJZ_m%nOXfngPkb$5i4Q3<3rsnpzu8*j;YPTk zu`k%cy}RtG$DXibhYna2C{JM#z}~>_F>6BKF1-A*?cTTBRsoI!aI~5yyXV0N?JHk>5!vA00K)$MZtKMvC87y? z_TwM3y$ANwC+HUAuey(^)s)@3cHMQc13;xks0ycR52-M^*n*vH1^BJger3x^$CR2S zb|fI9HJZXRvh}Y6(3LH^bLhQqwBz5(@$Gz1q4{6@#b5mHJEKHr)D9fmZwC(_ac{ql zF_AE(L5bIIO*!op9qn(ALw5sq@r{>IG-Y1JK%fCSRNMOIJ(RJviE&Cq?WuR%V@pfZ zwpl@$5mNCYDYoVhB*S7gN(<%s{}f*?qpJ|0(v#%?I$#z@Pn@)DF@q4$n_Ds37Nn1ArahrFr=zSy`Puba z!4{Slosp@Wiq<|U+$G~sueVw-G3Zqbrfyxf*DmZhBc))6tf#Zb(Rh2T&Dz5WPv=#c zCS}kmtmRIhF;tB#v9Tb1qcD!nC*^@Y*{;2Li9Tzyz58}qC6luG+v9fa!a2Ks z{+wMo_qu)YQ@?MY`@~1>tDpO{z44_N?3FLSV7GBdv(r;B*cI+yqyMEs>QB7_&~Qd# z0AjFOgf3jR&8z;VFqXz=26TV(#w|Wuwv)#X+dkMtcQR%Vo!D=M#R;pGa@GOjpSpe9 zrWY2`&7_BZSC^KM0dxW7Q&ys!i9lsD{kiMtej6Dau*~9uUAuK1$FhoBwsnOm?8CFbyb0W4LlpPQMnx!F0dZ>dATx2LPemgg55fJN^y2A=ha{OR{R zcIxRL{vjJYe9V?IT0Uad4pYB+<%(Uue$&&?`*4PtY|0D4`o@6RJKt!Lv0PqV^7T`3 zK(&$#x^N=#_@{oxM#lE}q-Z(20=t1S<0Kw?;_dd1Cmv?7Flu~PuIDRX z_%yCTMGYH>wY<4zs~`xKsM%WEuty)h-v;_H)|I?@G>BWOt2LRYwrgHUrA?|J5-qaO zT#?w4?k9BPF?YO$O1HFQST)C^izwqod)D~c1Q0nK0fV8C2%Z8bx4F^m=vpbv3_k{u z>(XAuTodt_y$otQbP%E8TKY_*FB%3?VaVI#b9Us2gbE`>JDZz9r@Bv*(!4Qj+)vvJ zG^rvuD7pnBr=MlWmX{VhB&ZA!AVKHmL z_<%)l;uF^|+8dXz!}uC9q-w&Q9dVF$#V1qOc~!E3!Umo)>#qtEwE8~%Vtd`H(9Pdu z#N@QaV01mLl2?_5I0~+beor#tS%m&n6jcsNwZVG3`(X`p_L$S`QmPoO}P>MCxju@^JYb_8Ox?|=6bcK4|xHqtj>?|RqM*3;8rmoA>gX(sIF ze*Wj}UGM&0P;A*|rl$G6wj$xWoN_QR`dEvwrSB<>oz}GpV9Dt!R^JLc6*`fO%2ldC zG8*~`ThWj$A@fkkLaHmq7%H^6xhY4iqOMs>b`06m@A^Ir8LXQAkmD9R$`zKay(`EV zx7eePK0-U%?9iSuD;ILUoA75o{jAZU_VVXHZ(n%!85@7|O}l;Jg01izg%oU>zE<6i zu1eFcLq;Hf-T zEorFRz}PVTxo)S=oPlNZI0!2tUrV{X?b?3;fP$ zOZMP{57-JUL}~85v`hW4!8HX$RZS!cv(bWVfy9xa5sLv>o_*#SK#+TsY&0Ea~5YR8+Y@{HJ-oEBOcOCZI2_6tZm*4 zxg32D$VLX&a9CQ_CY?Yj^n}igBx@QnpGTsPF4cHew^fbf+i@yyJ-(gq?Kq=9)YE(? z4fw`G1Nqid2B>dnw+-z+K}Q5FwUV~<%953HOE%CQvA5rI(hZVowCV1?KMw+-ss!pl zRcqE{rq(F60;8kRpuO`QPx;o6lzgbaeYo4vSD0)&@eLxuFp3p{KLm zYUReHzGAalIql3!ue1*dL3kSL3}hhns$#3#+X|b6t+_3Nq16@-Nl&=YyintT5E=wV zyVWWKDHPN*X}(Flr8QG^oJzm7@tFv>2?u28nqUg5DR*Z+ife?zNy}u`?CRCqHaI+h zv4`bgAm?x2vJH^xS}A4C8$}DZY}rs}7{<9`ndLcdzV6#!$U%odQdJ4n_rv7+V!r9QdB6e=lfKnlkC=->SE`^P zr%?uBtKo9&N@LX+&?U(=RU$xyMd#ydv$#Wz@ z%NqueWQ@%UHB~^?%_M)D{B0dZ83cWXk@bL;s>rg&2_vttU!k;a`GOWGqO@%|Se{QZ zr&Q&}{E%2-gAEk&SsW6;h`!OYC{)~$)cPm0C}X@?%-V&oe#%~W=0DqS{rbPOfAPQm zE&Jua{6Ty9%b&OZ{Gb1m%`VPcwk#tbwC6tZ+tvlJJFH%bFoka8KnP| zG9HB~Muo2FABn7zjWotzKX9x(i?;rL+d~h-a7w0%;E0SH6~QhI0dS2|8I*Erje3sr zsj_|Y#Y^_*=l;loF* zy{F4w`0Qt_6WLDyt`8?8Hn>r@!u4ww$L6T=yjoSI4>V_c{pwBIyXSzW-Tvz~i)DUaU4{ai+oIHpsI#f9;yeHeFIWYnCa&6rz>)5Eq;QH|=;RC*vW9L48 z@14$n>*+CfUcb}BWAxwT3Lhg_>HfA1yG_4 zkVafnC0SI)N3*xh&FdiAX8Y79pRsJZVBuC}%i-M-zBmStr*OlqRn9G9M4G@8bqYyH zK+G^3WwuDc^%=#E3k-4@qoI;3%HXQNoP>U)3~L)zU%V%wRg73h(kU+O3Sj8FIyBj> zj3^vHB;?h(wb@r#$WRVREdq77@Yy=Qm#Zb7ktoWp(=P%7rVourLpro3sm;Z`sS|Z`g|$F54?_-mq7%+_KlMOjsR9 zk5st9)pLmriJ>dJ(@Z~#4F*8oLQYC#P*_b_feMuh?dBC?gRKsYsPaY?7F#-PQMLms&2 zv@IxW3xruI7rp$>(c>p!*lS)rI?H#p$CbuWslwXbRtu8lI23}d&<0iJ)|k^oMobc_ zBm%JsCGIqmHWaFryo-@&?T=)ppuN9%-L3<|U_gPE5{UXY?N|TF-?IPtfB6gcmp}MU zd-gy6b8A_dv9q85oLzh44NK2X*#`X~G_Ex=Z2+$xjNQoSh&})8vzF*+x6%E(t%#A< z9Gc|RcX-A4#ps_9eU&Yh>DO&bEf?+foKlQw&yIay44MH@+SPdX$dH{raojtFJda(fT30e@ z_uO^2U4G+r>xc!d8&Fj5ZMRn{>z3^wv7SA`hef|}D^Yt&$DHRZ0zy>>eoPsJ8Qbfp-i6ny# zn`sK$S6_J1u7H-hJBDy}0Z?4TYOpFPK!D#>EqDv%uJe7Z6s=UZY<_7Kqh9qg?_v(x zu*y5oJ4P8_azrWxB;|nugB%oo(!5D9q-xzE3}lf$LZG9X6Oaj!F+w3QO4&4wMwN@( zlk|m@v&~VHLMo|L-jBC7^XE+CWPoKov1;aYMYWZ7SMgw5L&e zWNBf>Yh7t;06Bs{u$_BrT}r^`X|7y+l{RSdJqQwwI|~b=AWSib{TxJABD`6cu}vExd-U7T;jP>mh9|?^;9g@)zAGD@4s$W$EPe3 zre7EVM!lbf zRn<_=&Ty+88tcW$((lNaYKX<+9efU!2J)1X)!K~+ZF%7Sr|hxsd7p)1aeMBwpF<`> zmJA0hf#QdP$^g~86sO+(+`LhJDBD3V#Kr&gQi3i>54n}h)PC* zTjxwhV}9-KyK&C-%Y`+iZGu*+Kw`5dEtyE%f-B*j8vr zF|>Y+v1IJk*IxtG@3sMcUtXH^iWWt{SPSjkA5WqOn>MaRofsvtUtcUs52{byHZV#N z730O>ifR6}|LK?Qw?6VajIlz83SaYSUiBR=(FhOe(5qjnVPEvSr%t1nD=QhV0CM^2 zxF<2x0g#CpAgH$+UCN^)8@2~Vmnr8h+STE6iHCNN;eY^T$msIyoE4T3_~L|KTVV`DyNsOsgK3zVZ*b?_TEZhF)vm(L>;&9=C- z;PX~uPNz?w_W5(|ewv-WWkUwg!ckW`$83}Dw|B=Z&hw7L{`TzI=TU%zM-TaYou`-& z4OszTeeKd^Pss8uTaZUj-f99kmx@-KS#;p1eVOn@4%nJ`)-}eVq-Tdw&0rtXnWF2) zjziL+zR}M+y7R}KI^NboDa@+)7TGm;U}O?OTmdi_qFks7~qot;A- zyqiw#3N~9|Zrs-MIbXqFN7=MDyGmiiLm&x^d?mN+o0T=SZFx1|?v4&Efu zQIoLEWT=n# zg^a6?EL4k5p)VmKIWmtCE1s@Fj&R~ML|NKkIa;kRhLla`tyHX_=ul?ZRA+aOy>a1! z?cTo+Bj4g-A`fSwoD&nX)`64i>jCfhcuPR&>((%iNpl7W&8D0l#)!dE)>~_<3Z@2Z zdh(jpDg~SdZ9u5CwT0f-M7So>2l_kg)t8>9KW2HpA`Gm+^Ax#`3W-*%${EF2`F7t4 zw5^)9u+qmtYbtdwbevwzV8Ar7PJaOolosCHgrVXy@o)@89Kdm6bZBof5x0q3*X`2v zn_ruE)U}HFj3+I$!LHnN;iQ#NBIe>k%X?bLr|^^nQWLGpKvLY>feW&u&$~gRf5mPT zmsiTK(5GtJDeF*s{U|v_6Tu4$OZMESpK(VZh1XpqzwU@6izuG1>mfUgt=6Gw-G;&x zS|}adUdOl%_*{$TxV$_J}I%Css_2!^`^|jY*ZebQXzhw!WSvzb! z8dWO47CPRU8&mtmpj#D^)x~gVu*wMXL~8&BO%_B}qab2cTUV(lIVR25@uPJDBHHQq z7=1q6*JFEkjo4jh?zTrCd51l4@7rNY3A=LrmR-4d%c}Ifo-M?cRlZ6YZwgf@yHSf# zmCjti5NoZ|`3rAa9}f4flgF&Lr_-+AylFx7WN$bDd*8M>%{4Hlt*{SemoadSe&o=& zC?P`NA(KhjFZ@rxWHZy_cJr3fgT?ISuH=P~2fn8S1C6_9Zt2ZChp*@1l^#N0`3d=7 z<1_he(ZgsrZ{38wMC`=zV|Mr5rvZLppKqDGHEzq(GnQSRw-)qOZeEouQuFh4@48pZ z9_G}VFYW5OlER4tFlD?mD{0%rP=;|HS_U9nrTG`h%8t?1fo9>*wybw_%>Lo8{hCcK zE!rgv{^G*2iS910E&{09eNI)~avo;$zW2O~?*N{-maeI1Uj$qW@F*0oepD8%7JEzn zRLNXfbqW!e(`75nPuihylXVQnEQ2G|HactNl=XDLh=K_l8XUF0;eNVFyG+-R?WRVO z$!ZEY!G2;FweD^c*^x7l?Fj&AYdCimd=+cg(>0+_sJPXTw=Doknh{vQ4sRmcU(**3 z^@)D|c1|5Tj_I5I{TojK?!Wmr|K=aR?f9RhGm-%c<8%UbjASWqg`83@RhNrKv#o07qK9jg5!b|f>g;eJYPnnrQPey}*wNoYL}2*5|lnJGJ6E0&BZ+?YfQa-sK@7ZEv6uj6y@#u8rHS zu@OhBa!~c!CihE7e^FY6Y?Rd(vJ7ldJ2+Non`-B2V*29wm#nWVPCFVIcj`CY5Awko z@=5lo@v|V~qP52w6Pewe?Ka4B_I7EVRuW?!u>giwb3^MmU?EeXIz6}6`~c;-zvff6 zJ;hn*PAqK=B^N7ZSU}qsboheQY+6TLn>^mx_naXbS7AR(`GQvtc>3vg+K>F`PuRf7USvf3 z(rhutJcAbe;Doj@%JubToKMQ4$szmlS6{Vfe*dE=f6&7r(NHVT-2$6pT#yTGmG3-{ z_KC$QcOgPMwe52p<0D4ojD^3+C@QR@%Hvw}tbXYl7{GtF+9XE#rB`3K@!OL&J2QvV zn6Ot~K8s_a4`7r(^n*Wa55DaQ8{2c(#-|ocTVjWCp$UMKCZn}Cl^mR^M{BNe3S(NX zf|$c`yL{~ijHqDW_ks7>$zuoX)|=;TKy!-p#~kk~^r$s93a>S7tFL{8^+*<@jktQ4 zTiG6c_#u1bv4`!WzxxrFT^<5m+;S(ZuM2Yti2MPYAY;|A`^bLdbDm_P+i3=u@zVM% zh2zrMyrp4=N@h`5YXF0;ZOCt2zG4%%Z@VMc4!>ehk|$+Wrc-Hm97=uGILqo1HRcI=J?%rMhID= z6@j3`wJKUDNTIewq}`Iq0UO?b(t7qEw{Yh$9iFu1iQBeSENp1N{F-=R-2;N6`T3BT4QK#BRTn8gN2TlKkS zr)Oaf2@m~gL89W}+9u%&>}>!xCIt{qQB4Z54Q-*J)ZR^$zFyz*ZO65Hrck03etzZ_ z_o<E}bk z!#JRB-dAzTye-TvASVe}u+rO`Y-xGLe*Y66cW0yV&^Pf!+_Qo7xMRa0im6~wD)g<4 z|3mkkwqO0n|Hyvq&;FzZqFokh@3zr>2Q8H@c!*NW7n{g;mF}yY$ySSX_S?~8ciZD{ zd)Qw1@^c=_3Gtl$9brI&See4L%4~zR(YFE)S}&(9J7k1}*0p!m8t-WivH}ZHs(7Ni z%d0}COKbMROK;kRD-%|A6bpOB^egeBh#nw1mQBstrE@Rh06t{nx2{=V-;n*(Pkzvz ze(D`|VDE0wc*+Zv<}h69Gi3{^in^|&xzQHQ+i*RlJx`3^urntP!IF-9_-HDVwKQ#1 znJm?=+X9$0zttJ>Pm4K~d?Uji2QWPK-XFBN=^Gg4aR)QXFy&EQc7P%N9bdc08yXAE z%ealuHMx&I+n}M1Qz%|zCs9%2gIIKmb}cP0y8%G;(6MO&Djv`QUx zRH}N0k`P_3w(YC?s|ebd)}TOxy_H*db%a?+PEKVV>Gm3O2y>xWb42;_*>gNto9)@P z8)KujHg!*YkYdOg`BvQ+ScO((kQfdzteeb-gSr>zBsq4_hMttRx99rdM8f7F_kM`RV6jr4dJW z9{cCj=LC4w_^iQJR5`g9GF#n<1o8@FfBjdo;{ue52|ffoAqcsN&pLE)}OeKSDR z`nE03&)OTWe9=DniQfT$Oy=PCnGNWGoD8ek0i zdi(9U=Raeo?mA_Aj_$UXE?%+}AV~X;F$g#vjftGP53%dE_U+qTE5qUfHZs&}58tz& zHg?;mp8FjAsCgrdy8eN}Re|2WD`n)6Zu!BB43{ge-ebIVZGDrwIat#?mAsU~u?;4y zWeu=oz=AfeQ(@eq5{u9i)R?mYp2Vd6lKj&~mR^+u5GK&rxVvtST+qo%wrErzXvmGv z9doUHJyHAL|Nbx8eTRnZ%wW{ITQ+QI;+9>!@TS`%&EtA1G-D};bnWt0TLt(&_|U_4 z6{fU;Ln)Ukp6;!6NQ#m)>eON6X`kjwqu~fLto41^53UjD>V(l?GwJ{`&MT8M)_(M1 z8#;ck?LWNFE}lDY&wk<=yM5!9^$!l&u|tRWUeT787A=#@xIIaBXeoqt1ZcIHvllE< zmJ6a+X=)|dVtpqLT2_plzSJC723E9;qtx<}ouSe3Kddv7kn|*@Hr$uw$#LV8^8JnUOsPgnX1h!=WIR&0$M59>}uYom$aXK$P#Zf=h7;5FY)poD-ZRlKnRAB9$$48o_yweCEWk;NOD zf2!4?_(Hy+ID%z1Gp`tM#tpwhXPwD7&Q!k+owPI`?h{!x;+3 zJr=F4C_Jo%BDE*l?D~ZltUKCb9bpU^&ORR2W`AMR#(>?uy}mXF*W(OwV++SuMfrIi zt^0_>3>FYfRenHRxmRO@L+x{<=TjCAO|x)&KY|?dvMrZyj(^=5@l5T}kUJ`gfF@Hl zhoZfol$n?>sB{s}3mei}Eg2w9a0^WijSTtRp4fxNO)+sV$)k4Ce`2XZt=i-)9E#c? z%Bb%~7`MweuGnWk^SnC%8GmIeY3@g<{+f%*V;Fw+gFkJ*@K=7$o_z9gJALXT&bnsl z#fL&;~~iS`LHu=CzxCg0<);oH(pFi_@w& zvInK(s8wfCa};B{$2_zaftko`Yb$9v$d)$AYt?SRlD_cyFWR%8{Dh59Oz=$GcJKZ7 z+fV$|PgxI4Vr4arQLb5PWd-IQMP7I&uAfZekUsl)J9PA*-F@FFo1U9RZUw@Erfs_$ ztYPQawxfG`?1#Va-S(G$=BMobGsi8vFz-%lIalzMYtM;gtQ01dWAJa?dDWqxWh3}2 z`qyxFh%{HG+vQaRAntr#8E6V8OSc+!r2#S|AIiSesbm;A63LE!)}ebe93R)A9db;( zssH@5dS9Q_;%U|X6OhuiWvey|1^Yk#>EE)u?mcW9xwN$bW+K~Vj7h;W>Bgt#VLdfx zTx&(-42Kv+2hYCrvfcC0gEqcAk4;;)5cXwYpx4=nlD*PEMa-%t*N8S);b0)dEkVlu~%Unrarf4?>;+n>?pu4Vp9`0k@vEvn`;q& zjBBfkdM=lvUD(SvFIooxL^7Pkc68y;*0Bc}+U+~(0-CfiTG1CJ1ikh6AJ!R30F<4z z4eCr|&9X&04Cj!}tywl*vDt+gyM6P5t;}Du-0GswBNS>|R#=Btf`n>-l`5TD2i+^o zqcR(Nb`M#-l0(i=c>XRVCZFWxen2;MjFt@7I^PqM(sts?ItqlEFhB`VVF%7c8Dtne z`atD1gvPX;aIUD@YgOwX=z&W2;aFyDa%v6%irLsmpA8T9+t5I_S0M-91{HU|Syta&+|vrs%? zeZzycnr@U?+Q!*#V0_a!b|r0S-H$?G%KlOfFd22jg#^T%y(aN?BKRaV3-FQ8rZ!kg-t-9;IC?M5kR&wGpA>=lCa| zH<9s>-0W1)P?$*?EtaIYH5sTlin~Vpl+~yNm_PqxKVk2B>K*pPqmS6rPd;G-u(*@DPFG{VN1&?t{d_CbXt=k1=U=I(yxV$mMMY2C4Ej0~o-EAGpWvz3Vie>#%Y@?V+M`Z(c=y z1D1p7zxu`-cK2N;?STg#vRjPn_kG~|Y#GN@#Nf(+%TOzF@vDF57w!Jj$1sF>U(@2- zLtwx=k?+@DeZ9e|`OlpZ_Ta6K=xYaWeQmzzjwA8U%4qYmzP}UBlhaTobgx!{tTwLK zkPn5ub`pfXb{`2KKkItREE6DVuq=IFpJ_NlmEcjxUW?VmP~><868kzL_G|zA@7Z=a zMH^J>5L=Z8RKhSWK%^mwXvRj9pwIffyod*5T6l%4-M-JP~+v9fd;6dw#eQLih zIRv#wHSO8}Szg73ceOM@%l0FBWWq_y$=wwch_!fjYsU&b7$@4 z*I%{yxdjUXCX`&YM!OepPuUVSDzDA@=&LAzVCC8k^df8<$Vp_^pydJXnv2$)eZfm0 zZCeqYR~=8yYrpmQAD9`TjLB~68Qo{G?tUBDbHEOtxyKHkJY)B~?J;}!o!?`Re9zPN zw#S~d2j2cJJMrM7cIx3L?QWFn!N;Gldmeex?&rMc-UsdOGk4nq_Z_n`h^1O6YPtgh zE^05Mp|-0^?Ybj$-I{i9-lc281Jnj0D=@ z!v`_e+jimnRnJ~g72!b~P$B`d+r)byO06JZg_DAy4TbU)>QlvO(QmCUIB^0513OXJ z>c+KOHZnYHVL3nqQ6=85sfwoY(2c1ewsVFTgj4U9* z8N_jx<1Oz!Bukd%ZS{Q5)lZ!K`@i@8-}eq(C-<>m{oirMbDn+9`<(YaP+sz~mzOIp zzq}d`fA~x`py3<7{`KXkO2^Azd|7$%i!Lpf zUHYQ(rLTNtIjb7Tv(GuFy{mcX!CmD<-?OVTty8NUKKRgmb+&s)ouyn<1D9$ns!~2y zBg+FDYLxighH~#6w^!a*o>Uk6__Ifr$EvKsXY1Be%FgSqsl~;YFT=mhbs!kjz?|aXC%KP8wjvzU$G) z%iVP*eBXn0He8+N6Lo;sRReZEgIf*jJ@?$xjI(dk&FwX+@?CL0|D;Wo*N?X?3C8k7 z6`Vbf?k~q5yQu{o*VfsQ4ZWOjj1z|vyD)c;Q>aF;8sxTbuik5W?&>dbn7i+Nl~Od_T7rO(4^b_Fsk8X8oMThReA*eO*5K^u_90$r zH7@wk&tY}vnUQ*90Wyu*67273D|kKN;d+8@EJy4W)QDqroTlI_=){j1FT(#(DL z-c~L=|Dtln8E2Kx+;DBV<&Hbb7hds_a@Lm9%PvV0x9%(t-F0u%IeQDYZauvvB^_Jq zK5*lW<>+dgPQCO6;-&-T`fEQ`XGVLQ!25!&KPf|SWsX!iZUXv5H7-7z zvb!?>!aBV@_0*H9!1>}r1a;XQTsb4QicBdU;I)?Pf`R+)Cz>8F>A zEvP<(Q{;mp8xhYs+cX;2(R`<~r*-(DoYHxA9P&4Yd6c zH6pXLQ+;)9^T_r-%sZG9>kOr3FIGn`P1WW=%YctQ@oYJ1%Q@AVREKly@$FOoJ8!wU zTwiC6Z6k0+3r#m4eW2pHu{j=}VX2MQF>b6f!35MLR7B=5jhhmAtH}C8N^M!01Xs!8MzT007JV)q5u$-O! zRu4V&aQnWU%q@FaPTq1-H6AzDXD2qtE-_~Rdf-NYIq*Ad$sC`KLLKr z%~zKXzyEitbE}T<$!9BFo+I^l)o{7YU}PTu;m*3VOq zJy?Z%Pr3YpbIPuJZY^K&x>vTZ*xzyc9p&mzT~ltTGojn>zPmj7`2N!J4rKdxN zSrXPz73WIxdap85I}#n5GpYgDrWy$OUYtKoVp+?3waqo)JG1Khi!VH@Tv~bHD*v(py*_AT zsC0hn@qOh5)i!?f8{gPI?)$)l4^|s=Tn&V7C^vrknkoi++j6<(IWsOgZVA)!^pP8$ zDYspJeR<)fFD{?H7r2bi?s^}#esi5wRAXn8<*r?O z%dNNGRT+9zbwn>}e`B7ZyX4}FY6N{^HJY-*Dxs@jn$9woA~epxGK&cqL-A-;@Ljte zt1||BeU2(ue(>rV(VSg{^S%~Mz38%+wJ!xHgXalp+nZ0W#^8*ycdxHSGqCmFs+^}B zx3RqIUGJ<;`iyc62Uwkv8JHdEGX1uj<{kH>IC z8|!SL&fNBGsI!CPYgB%qwsS@~r8?NpTz74``Hs8(cxF@`^D#$OT&t7uZlbcY;<&Lr zw;9>2!*|tu9UZNuru*7)^&Txk+j5Ewx#QX_tSLj2lnu=plNEc&Ec4kP)FSPQHF-l% z8ENfn$7Xc3e$|QQ3_W|QIw)CQx7T39hgR{9^Hc7mQ%@~7@4T(b#u@GX%;VJ=?X9!p zef##-+2g+Im>#XP-B9ko`?jjwSCxD3+F9vb1BVLxtJ8Vtk-hEw+zT!$PgNQ|UFr46 z6Q#}$?k+p;e6T!i2W6$FKMP%@^PsYpYB2U!z1Ux8eO1<sQLw1bkOqW z*MI$2S3TQR_U^B8Z`q*&r|?7H`R(Pdowt++?z^pQI`O1(+uirKzrW*qe9vr{+mL+y z4L4L>skWt7YgIX;I&gex)0KKcN6|u(5A~l55i9SMYrQF^fcHOj=3aU13mkB@xl%HK zB|c6{aAJeGcakR@e{4Ci1|KpsPd??i8qi)?F21PhL$!7OWQ^@2&(=W9vasb?Jb;IU z2upQ4@4TbD_X8iQf!5CQV4b}@`efyEogLoxz@Bo`?f17YweNZKu@?ATR_%p%q5j;( zZ8z;KuYUEHmO3dcANj*8%e7a3q9qBObH>)D2YAr_yiFZDoXMMvKz}Rj(Q25V*zcpX z-g7?Lmi)}3o~!oYm9KhLx#{Mcs$IFg++Q7%grm(>S2rDhOeHHPTjjn6ah7lGyR^h{ z>=DnjM6t)}jO_0F@2d`{lv8S;V`_ta=&e`U~<)yNVkQq)p-tN6AJgYCD9btS$T%i}dd zd+8UytXx=UH{R3`Mt|GKi+NM^efys&x8Hep6O_y9EN$1W2iscw1?Qhz4H*AeXFf-B znG~kBD}tyB>@P*`tAguOH22^CVB7pE^7PKd`;B9c*<3#Tnd{4zDx`jQ)hPSXT3$5V zmYI%0-|FO!++0pP?cCayga*q92g<%Wg+IFru=hL9Rh&0_uVofgJz{ovOD*-K@8f;* zt&T$)^bwUNo6Ekk``+uTL$8r;9s3D2aDEolb^V% z?5s1b{9&&4XU3~xkyB=w$6qZaN9}z>H7XJm7#uH+rQ&-j@2lyS>&$E_8_T(8o!z1~ z*2vO>SsO#KxjL!xTy3|GiG#5`V^&NK7)otcGuGM{H8WO>m(0d0%}p+EsRneTbk;gM zd1%+JYCNm)t`6j(haaiReSGm}u-o5mst(9<7sK|6kG{Xk-<4(WgLjl;H|($F>a4Ua zX+GPQ*^b$GTsh~W7nXY;dbC`9?XBh7Tkb87RGE6V9Nm^%%`Po^Z)?@by1de*EWtq0YpPsk-pnh^Mbo&8*S)z#(38st3ocx|;hAlnzb3$w?|M{L`cgBqpyWzc1fJ$s<)OvPhQ<#o&Z z6JS-oky{_rJj+LEYa9N2$gWBssnlQm%2$>fZkqf1I>3s-SmfNc1m$6z0`^S8#L6#`|kaei~L{~XXvmEb!$O`*G;|>9R zu0L>Xwx#}$o{YAAYwFnWOC~P6{E|Au-cn9G`Gj)L)>F$1&Ofuf@WOM;1vN-J^@Ppk z@)!Bb0hg4$k33kmRO3yyY;I>SfZ+DYN}D}Zj{wy`D!*^PcXzq!+MCO#Z@R18asQt3 z@Z&zCQ=ixJyX$x_z2xF@-UVALeQu~Tq!X&l@2`4xeoGj7;l&p>hjgF@%%`91!>s$- ztp2pErQ( z$=5Mk(dprH)*00sWy6z?mxu4zS+4u^C(2HrsK4dra@TD;%YApu2G;;$n5 z19V;*`iqv2RRgjA=^D*dBe}PpKeGSX7Wo}G@N^~eo=WfPe5#_gcMVNkYgE;ypq0Qi zO1<;GUF9pk=Id(Iu({4qZmAK3cM%(^p*g-9jOWUocihwP{env`s!Xm%q}JV1jieeWVjkKC=qe6UFzvj`g=;Y9IGh+Pv(FOUpg?+*vl( z8A^++D_OlDZ!^g%L{C)uY&>>z8~IapYJU5TpDd5ve_c8MluhN7V~;DRop5?f-+jS_ z7nZH3ZZ3QF++L&lJ>}B#PbtS8Rh{1M2g(t3rg-9}YB)EGCXZ=Cd_u*+UpzgoIzF>a zPQ*sdqo1p@x5pnTXV~`<~m%r|ziEh}W*9Z}@qiRb_|6_p!|?>NV;rEg3@U z_%XGtqz`G+W_k=uwa@MM(dr1!I`gb%tnoy&>uV4vopN$@I#1Ub>;08CTiR0QlTX+O z#M#XKrAvRj5ltl__&8?!tury{@s>YCzl_F~EvHxcIkjx6GvbqLyFNBq{aK4n;l0PZ z$j2@1JzMrXbWi#CmG3UcRtJClanj5=qUYLQ4?g{@bBnK0JX~kPAG_xIa?gXi%Mq0q zn@>EYM%;BqSqU=t9z&8tB~LXF205o1H7II-46x;smHYNo`91qp&wTQ>a`&z}{%2}?b;fg)FS1wK9#!#0 zYwxYR^Q%2KXVDsHA~OM;K=UVPT6b@uyoeQ-o`v}O=K1bW1g zbIYuN@&AI0&n>U`qL-B$uliUG0%{OZ`MRqbJo;cinrzX{bq0Fl&9_xYDMJz-Eb=FyDwB=w<$)D_KuBUd`mXKB$|#2KIEbDLBB`I%RI z(TmE3=bTk%Ll=~DY5;a}mF<&`-&8I<@0=PS9o4?I_#;2~z2*DA`@71o{rYd0C#$W9 z%`$tmuZ-k2L;c(l%?3SK^?di9eRU8rOgERUr)@2#oj#X+`aqpMK2vR!%-OAHZLQ;~ zI#7ehopq+Pb;~KWzZ1(N)luAZ!_8H<_g5XX9QSnFmndkGgyL0(js2WV+fwlKGj(?K zcnglc`}@DQ+;Hp7ExS|}s1K)Z_7$3wPAw;FI-&hNrdw*;HvJ!Xd~bEcC)Y7pX?dx>|1r?kI@Ds?%3-=%Hls{;CTjq;zW zg85ASwH#xKUh=`->UeB4d;E#L<zh$WRXhm)iPc!& zTQ0fSM@b(pU-HT?sgCNT+V07fK2@d}wHhg%P^0v-&%2}?z3IgEa@bdzckaBtoN@9| z<%iz#UFD(bz(4SzkCqG0J*T#NOmh&&R)uN%jjAKN{np#d)gQgO{N8)tTh6IY=yjK# zQO-T)xw7Th4RuCU9l^7E>Wpb$IjNqX?}MjR={Ftmcscp#Bg=(bPcN5Va89}SoYSfy zI=NhUM#bf{<7*UNol~6wY_1M#V-1-%`cva&e|1ccS6bId^2r)7?5Q(=eUFt-+_}5a zo^=oy9Czfi<)lih6D#d(7(Sso;1jC?h!&5mvnI50E%QWlCgDS5Ynj2U)n5=j{q!x( z>3TQd9hPqbngRLDkWU)f%-8~u+MXqzr=NbJ%3U=|wSP;TZHm?G){#{XWZsqXNR5O) z{i#pZsQB{At5eGp)rm<2@Gi=qShsxfz8B+<9F^^^qFI)@ZgG zpVQ7cx7@dTf4Q{=IiI@muJYt_8_Jp0fpVCfWA(wcO`BxB2dVS)rb`tc5&r?Rq&l-Z z@<3aXIl7KPqRqY|FDO6ybH7;5IIB9j$M%*zANb9(_v&9No1Uw)pxf>(SAF!xYK-=l z`ya0cs`AmhNpi69h$`fFybVPkpaWfxV)E`jH%;*Tx*f;WwP@;Pb0)yPym_LciLeZyCkD_;6VWmlEG zNAA0`oOH&ibsXN+*i!LSm4`Yzt9*U%!9B$uvU<1K1mACL(54|AbG@!OaxrGVTdN)D zz!_aob?{YR@ulVZkA1X!@ak(S?p2N|?PT{E zVBo15BnwiHslms|Z52RvolgSUbWiRq`+e|_K3a~gxJeke=dK6J!}r$N?C#xd?_T>t zeYJ0oRr(9O@T&E1Xw|M+wRrg}UQyoo<~NmF@4ma-ddtr8$&Y`$JpACp<<>eozPknr zJ~I7a4OsW>d7#vovb^Y`3(Mvjcv~{J*?G^yc(8BI!BzR(SZ85^WZ!*6ds1re;c_`6 z_Mg3<1@bwd4R3wxTMzul|M(x<%hVn;guz~fje%z@i%blnwOQ{SU;8?~DuZ=Vk~Sw# za|)}5>?yzPUj3aLSQQE}QRNUt_7d{^3ooeC-u;!JHOi>Z+p=6GrU0;3I8?VWwhHjM z7hF*8zwh1}1y*6N_bho4c<&5sbhTUFR|hD9Wep15{`7ZkmjVFk%bvrL;x~e~0kp>r zwAXG{T+Ar$f8e2V`qr)Go_p^v=bd+M6F&5Dzz?n)j;Ic%3iET-P+3xXY~S9pch9bJ z{@LEkY_3!9-Q~I(^;p}s?#vLi7mwB0w8*z2V42QZG=qQY@pZQK>=O-*)<>n?97=?( z&NgaYLRrby#*mlHEn02kIY|3<;d-u~Ylqu&{G1CI9(>e$nYp4ORI86J%~Tut4z&#l zrTn99PZ(}{c;;}$6G$$dz1rzoaiqcv_p=+}bNsGgpV?$jfkF zT-aM@rCYX~T4}hk&7|OEGi}EH@IzIh>kQPa3I0z!x~J^fb$?alC)$QvOI-I?Lr_Uy z8?AJ&xE);`LR$i>ifs&Yc!{W6A;=v3t+>?sB6-fKC0f+G{`%(TE$5YsFMoO2UmfP7 z_ug6^|C8m3eS6BjYA}2Wp$c6cf7OGw0x3!#eBqQ`)T4a~#AW{qB2$VV>(tTfTkw(wDxpJh5kYdARD; zQI%h^%RHwW=s+JWSwC8%-!?O=FlQI$Qq>j^vm3=9p;z9=wg1&vV<&+anEO*vm@xEPqTX0N>$w?b}?L;|b z`~RTzS$R^QTY8R6&Q-(TxvdRt7E_7qW1x+`b+$}y?b#v&N%3Y+=Dv77r!#ZS;7^^o z)P`PSPh91}-a2D!i7&M-BW~}RCA>=PwlZO51RdzlTuOb_@mf{@Kle^-&PkYkI)@W{ zo1W31gM9<#v^B@C*+F?@bIbzX%}XGe*BOC^Y;ABTGJv6-R?h(EjMYRb9 zid}zO#8;umyY*k60k@k|t>vwsx4KnW+t;Y;LwGh^58{6Cr{UJxsn6yN$z1!CxxF)J zS95UiN&cS-@DQnazjbJ=Qwp;c0)ZYl1%iB#q@M*-nmC9X=Oz-ITgD+LbGO^5<_f9Y zPSJl3=5G5MJIC_J1}AW^mAUd2Pq;=Y(bGGY@WM}XX!OZX2|A=1wcjbzn?nKjTTM z)|Q9$wjZDf2ioXSFC>@5*{2N95?Z%+ag`RzDBp_srxqaR>S(LUzGtAF9J>1dK#Q96k$b`Q{Afs%fiFntV7XJ9Dx+cRdXv zW6kb#*KqUO#yQu(9Q17+LTJt@p*JUTh&I|i`1{9YW4p95cMpHs-+`;YDc0Jk(CW?u z%D{V}GV{TZ8P)yw-`}<8vG#Gy81>`5%uqh+Z>-H3QZLSExRkBKI;_Jwtiw7iGpswKby$aWSci2u z?C^QFOs5aH^`K9<8f(C{sb*-PjB9n>%XB%*AHZ|vQU;`4`qXaT87Geiy6sPq9K_N6$$kNzd7fwL`O?aKe4Y>B5!{Es(0ZSj?~JtX@Rt_-0{!`G zu<$+Qlv5fL;q85ZKl5xiv+~Nw%lA=5%7TE_#C?$);nR)`7oYu^`}EC*a`)YLxAOkp zNQ9gbQ(hZ{QX3Hz_mtDdamO8Z2v2;Fb<)ya>%BA1IHUb)N1qOOOoB4-nD%TI(Cr-ov$6YL7{Hr7d-gOMTKf(kwExgU4>ex-_^dY2&OLQpqnC|^fI@mEK}K8Z zX%~-`RR=GC@fx?j;OHDq{xrI>?opt;hz98gxYyRf>zLeUMDz^@eY*zQl4*qoz436K z`^uybZRpc||gt9f35xP_P{^;XaB7H_>cd1Q>+-$ zZ~2yQDR1L|IX{q^NjpZZk!$VWa>UiZ4! zHAN?{|MuVh+wz7tyy0NUQa=6ZPnWO$>aT9j3eSK4_kaJ869M@1p$~nija3_Ds0V!c z_HY08*3TDz@fVkuz3gS>iYu;YW9;G2{kcC^{@uU(cL%Tj7{2c7zOKCMUGF-0H3y&g z#3#xtU-`;%?X}mIOD?&joOj-N<-5Q8yFW{IfAv>?_5YI{@bzE+^=QDWtgLg_Z zTo+t$!6C=c13r#*M(D}7?%cWa;GH@6gFpC#HZD9zUqHSD2y_$gdJvpke);9)AOGWj z+;H#VTfg;N8;!x2e94!T@BQBIEq~>&{FQm>Nq=ARl9!af`d9zz!8>zf6ktTw@an9y z&T8l2@BZDt+vI|M1i@=wa!-uAXuZxYZyj*DGkuh}MeusM@JSB-<51g^U3s-_ctz_b{k z&1yQM;ZpWI21E)lg0Fq;Ys)u(^EWp^Ph?22e((o>u$}+HFZ@C?n!pke5Geyu2f^fc z2*wZmzz;MB;&br?Ml=H$Hv*`Pe!zeIum80y)P$VrBmf|M`(!Y^#J{f*!Fjq+7r^;NA;MoZc^0|5_?=%;?_r^@SJ|N7P!hZ%@$ z2_|0in%9&oue`Fg@rqZx;t;O-`&)nOZ?&;7$Y1j{U(@)@$r*bLlzu(;;ZE?L_q?aP z_{A@7j)_Ba*q4!+x$%j5Icx@-JbdFfeq;HIfAKH2`v3cX|L@ih!%nu|_rCWv<82)1 zGA)Q%4u}E0_10UP<1|jrpNz+`&=Yhe3o*p>g#*HW{C)MSUww#IbU=V$eAiuf-66U7 zNB`&_HKPWM({lkDFkZa)%x6B+Xv+y|^P9fun;PAXA1(2nBN8ky+@AlB|M5SXQ8gAi z#sTP8z(`)+{N^{8-~R32Zt}pO{yGA%^A` zfAJUFwYHr|JoSfFKr4IA`s@NLF3+O>XYE zAnF%Ow#u7UDokqhv&pmDQv~`YW?h8T~EK7fk5JO{TEGW^o=oOfy zQf|*hp#qA?1PC6z90fSepZS@eY2!0q#_&J=r~gzgyX>-7K6s)HnaP+%@9^XR8J}sN z?^0G9?rVp9X#=>{xA!WXvItz?f-%cnG14mm9E;TgwC3R9fR<*3?lJrTJvm+DEPeja z5B*T1xusCJ!cPD~_SAKlwUQC^4$t-N2>&=)&J5%pNcqT&J{<0A+Y+y(%gC2N1Aoy9 zsHfjvZp?n@)%)N7{x%LYSN{L}pZ~L>d|nRtymLko1`)IfhjHs2gL6^0b!0-3@(czg z&e}Sm0WW{~%iH?|Mv2gwS_8_Gx}v~DeF4uX6R_-}-Mj}%+kn9k?F7^_?LPbLvztQ& zl&d$0&j&CL28RJbKg%A#c>p~qJ_XD87=tJr{xEiwk`tl0p`rGB`oHjnFKje(FKwxB zInd$UELl62ltkTliWiKS?ttKS=M zys^!Cy!*jZc>lwH_z#pQo&Zu5O9hEsBq~_)0M_C~7@}s8oaHhO%$l-$ zmfA#pgx0$PGZez*8DakZ@BjYR4n;Jjj!+R6LT8$8X^F5>KJ(5#`6DEdSss1!t7ZJ}jS-hr8~&s~KsDE9mOTy1e%S*6iWK7{(FB zSX$EIyhPUev~-eX6-LJLk@tZN1LJ2o${5K*#u$UeFar^-F=|V&L*|SHUhp+mj#ht? zGssJyIi;Nb7$@}d42}$xcOu$a35c%YhxbKzh;L@5{xvjc4q zLiA$n2&n8UFL5agW5if0^RbV8tj!{_M4?aZrT!$KsrxZZLjnJdb10xkjKVa~E{9^B zUmyTKhM7}RSC*V5PC%h#k)b7H>)diE`Z7*<=jAiQVZ0(%G{R{m_fS5r~BUf&@`L!>3(1Qh2i#<8;8Gr!xb?@EaqeDrts{F)GHdACYff!ZWV$ z&C-v)$%Yw>F`38JZpUi{=cVtAF;11NMPvjGAwTp(@ zVaVZb6@h-!M}dQPPH+S0j(+{@NFV73;5&Z6T^aQB3*e-_XY|oHIC#$0wf4zNX8rg` zUf2jS5gVx-p2jxeyFSnz?X+j6D0pQ@$Ub>;AI{{$%u<2~xy5&mUAx-AXYUiUsxt)0 z^L(-~AHaP`J@!sex@J?m!|K!TJp#WEOT?i)Ih9jE$&GS^g5?ZPAF84lxBRyn}<_3gx{P}I(>iG!N*G}r;rSlj= zkTM{+=3emBhcS7kjOWg^6Il#BfU*wP>O0q7u7hL7IG^l*)a}Q$7-%o_aJUYh01YzE zp4a$le9Ah9ulk{}GCioTuJ)ZP-?y9bMrK0Kj3xE_hOfQ6fY2yF4+Ea{j$B>sq)nhL z_W_(TE&)WK$D`*XNdNj(pPe=aWzb2T^r4*co@pnb9=w9ntbk7HsyBrHAoXT}nVbyjTXixDv#nV0;v4C|%VvzFtsg1>+k-Q!s}AKs~q)m4T)3 zu{Q#<0z4`57`l$>55(Y&!F7ytSPG1x3*07+_^hDr7@Ddl7#UMn9rzA~rO4_Sn*-uB zheDk35I~nP{pm*lFzXoOj27hpgoYl=0R}Yd5t#ODmSb#PFm3z`9X(8YKHmYR;V|nl z7N+4c>oFFl;lJ1sqd5(a#g1w1Ep{xWzreJ17dm>F*6vCiU>Yt99RUV@TAK?UW9sCX zhRdu6n09}@BQWjREXSC-W9sAp(`dHP5t!EALPzQhh2i1AD#0}3%y;xK?fF7SVA`|A zj>84haGCFTzQVMzEOsmvrnR}yu~eAW=0eBeglYK9cLc^5q@}_%d=@%-nD%_WqlanF z7disdo-K3)rafEeSPq!h?tDke4}~@BjI5FN!t5pXtio-HP+7}i)>l^oOwarEW1ug6 z!gb8@#zJ6eXC;&yt@`!ll?HV4a$bgz7pvCJEw7ASei#b+nssRfy}dwICxE|WaMkBh zWRW~g%G+9j&+6$&UtV6m64G`$YrtE$KssetK)aFj&nzzPyQ<3UlSZzGCny& z(A{IOWZKApv$4^7X^(3_Kg#DfxG3X%+O_^<3gxAAAoU%}PisS&9Jx+ew33-)gRXP+ z`f`rGzomlq?TxZm!l#p@zS?E(TVm2(djr;w!vPo2@j{Bf5-`7t)hx@L*pZv>z`7a-m zx6}(v_Mdb29cfQnecAq*^P!OXK2u{$0@-(M?~En4-~#+A4+k_sN1xxKpFIwq2S2}F z)XRuu7ebq~3EXpl^g*6&N|qUC-;m5qpK^*rQbyUd<5#=d$+Q02d4KIUcsO$HfG1lZ z%|ABFp-f*7Xv;I1nCRd=n^gALERZ^W1Hn<ZgwJYC}1F=ug`WnQ;L)c_z&i4wS%e#;t9s*YI2}fkhYT+jf?7 z)(n^rOiIr+1_#<32O6V=apE&P!WZ{kdyX$~g*!fk$LL^eY0vo4N@}&|_)JFd9j$=6 z_~kxY`Am^i;D7$l|9R_&jM*o`a0JjA9o3a;t*)~8VZ5H}%Rx4bQU9K!d1Oo5+JPh9 z;F)vaT6u{^#!4oQSNS+_WzaXv>FKEs+5znds61EBxiN$mvjV)0OZ$w!^kU=j zy}<-f;ho`Ep-5?YUNu+>l@L0VjRy2Oa>Ow52YHOdM`F zvKoT7Py4*cQo#T*WhkhluGx(}Bp89PHmMRG5r-L%{Wmru5@ZI#<~@v}?7q9j=-FIo zgB{_qvDIc(8`@m^K&fkW7#y1v?ftQb#pY9cckE-(2j=O+#zP+`v=_v_4f*}{v)Eh- zPZ5}nuoTgU6Md+Yv7rzI&we5M1VlX|ZhKwqO>n?TJqFE;%LX{@5+=(ZW_a*`qa`kf zy(EmfNQ&U0k8!FaiZ+Hn{KG$N^g{=mWVH!LWz06=26xH|XXQM%LD8NT_@bjSLm@`8 z2kp3TmS8^!n%GUxpqZgj97YO#7*?M}F@D#Kv3)uAo%qNkgiM{t6`AW#MZjVT091j6890L8;> zQ33d)86j3h)U=$eFn)G-fO;6Z)crP0aA;AUP~!WL)qc&jcA{Kg&uCK7NrQ zhJ*uSoYhOSTDUwe{(pVU3juW4?@6Tf}{P?Xd{Y4MUg1$~cm(kdV zX7z)I(?DH;r_U@g-hgc&e}Y*D8KM{P6e!Uva>Jq6Jk74K3uuO}f=@KIf)U*p@S1(m zC4nEuj|KufV>ND0h&^Gm)UiR8jqr<3&;plWueDsaW`>NR&&E(>XQ-e!M$(KIXas0aRB%vpyBB4dPh6TO%BjlP{EGC&MBoQz#ipnYT5UV|7;4k$x*|MkEA*UixwH+~x% zxq}0qIN$~E)QhZ>EBtieq2P^NkVCqjMV^%;9W8|zDqplP z4s<7zo-_Dn`gjLNjteaWXLO!k;h*sumjm8(iaeNEF}(Ul7qrJiMpc_WX69HUqBl5dGK=ZI~f=k7+Tt+D72MPjgrN%^VNJK; z7kF!v40v|9VNEX6VUQUFLriGRQW$*%v`puFP>ioNSu+dDMVQq!4p9q(te$o-)6xN> zM)C5uXxt+>`eO_*NhD`>Ai{Mo2Hm%>2ofVg=?H@QK0~5Uk)d^8?Nba>V6!#t5fH+u zFYUqAb4G$upa}U~hls}%9^RA-Zk#70N1+)&<3V5VKg?Vxfu$+VlQ46hl!=gwBDF7i zW%LL)<3JHDEy34@Gm3%M6i*p5Ft~>&V}K$|s|znQ6cK`)iwfbwu%U$|2F4)#<%l?3 zd^e*oHh-T8&KwOnrlk0%P3;*2*-_qXN2F?IBHDD#SilpV@siQ=u8F}RZ|I|qI01bz zvgFTFocAQ2oAn5E@I-%bG&|82Y&)+1Ll(fGOaH%Pd+Up zqKh$kS7Qw130(wp=tl17l<}h{{LtOW9FRcJ$Ymwynhv(qA}W{l{U~3 zE>;!L({sT$+sS5-Iqgk@#rQuTkfC0V76SA%>s<5;3}b;I7&?F$FAM}28|5Gj1SZjt zYtJYmLNXN2)lWU`Xwx(JxK_sDo@+oV|t$l5&r{5SOZEJ@x`*kSq8Xk@q4|PEw z!Kx2}tFrC|$FysVuHmG3y`Q3PsCo~f(vUSPBjC)dGW zU%`7QXm6o_1P=PqU(Nv>)Xmt@!ZX)t&pqWrE9JByVuW+X5AZd#RZe}^sgEW(@B0n^ zJ#!v_gEIPcU;B9O8V;TtlWXVd_cEbx%BK(48N2(D+4Q0R$WF$H&(4)kUHxe*_1)K} zdfIY6IWG6L;U4+TGi7^F&NFr91J5(|(84*~oWsjCJkw`z1j@iK{P3%+1O3#2V}CDg z2egN-?rRI(l!JHLgF|>3dTCpk;HXV_X)p9lo9eiRKSwJ#;v57YDW@%U^#`<}9!THX zQa+9dz}1oQ!^<^X;H6FNhi2O49L=UU7|WAnL)*&fAD;TjI5Mu>bFLrP^MSq>{Vo&myOU_cH6mh<_J9;Q8C z=vZlpyIeDnmK{WeJ>)sVlye7Ksgr90q|B^9&?oy^Ng(LP42;`#pdZ&P zM`#C(1Kk{vr&(ZHyOT$ca{$dPg$#vh?JsonFzvbV!!6g5J@m-=kfVob&lfsEcaDCN zUb6r?ho3`W5)XXob;>oI$T_-<0eU3}6u`&fYTL|=4jONacz=)+OJ(HJGI@`eV=-G7 z$T{7HLmY5uy->X&M-S7U&v&GJerGvA8^yGTOF3qRFboh9Yqr@7;2DN_CxE~hnevGY zT)RIBxu0jL3)Jh|@|$z_323f!xbE*ecR26coUCgcrt0Z}W?K4kzps<=xi>4QJMGYp_c-1Y zP*4d5mKD*=bI|wYUhoCRoI@SB%N!yz-Yt+DGk)zGPx{qH&!@EMS6k^1^mUYRcnR$# zx<1`UH#20}dei9U+>y3G+Dl)4bFR$fGkE3P5nKZ9;lB;UGEnsgKg+nvp^f(+kt^+` zpIlEndYJZn+5tqwmXGj)PJ8!>Ht(fwgseg7&}fBD+7B%p+M2vh`zfo>zMk<(5~73Ne@SpiIk+g}*ZVT>mL*v9G6PqC zYby>ZbwJ-QNZ;-|mpNyA-i5O_WHNn&zJA)C*lWlX^#0!H|yTYGT~Z|!+;uC6gU zWOhlh%sB(1U42P875zwE6#*GPCDo2=W78IZgVa`I32oHX4g(5*I0aYjz)4v+0WU}; zQlMe(!wU^$N=P0 z#OQf}&k;$2;NT=ED2KlcwtmsfJuivLmKXTw0X!oYXiGl5YeNTRjLFM$DZFT^uKw{` zpP8AGTj!jtw&1RBhdv{dXbSXUoN)4tv-3=U+R}%1-17_9$SHop6OLqu9s$oJD@bNB zCbA~7y7zZmMlyj`pq%z`LqMhvgKsO;UPTn4DUQcD}B08-;4)7&hb$j=&FpD z{^%7RqzruN0K5WZ(=&Yp7v<<489-C*NQhwzBo#^05dfhX8j^EzqA&NIJ3M#jQy<2K ze(I15@@R}+!b_Kz{31y~IrrhIp8nYm0iOU9 z4w4nb;2MAo5mA-MMOv#Dg;GwXNfR!Hzzaj!OAL!mo}vv?Uu}vwFiIxYfBw(^xz)8_ z0i!X8LJ}H`v5$bkq&PBBcI?=3NQq@_IoBqmCOc0%GWi?~3?j<((S}T-Y#No#C3}To zv0s4_$(9lkxyJxg1hc?w_Jf}c7m6ZPUEhS(wd^nB@tv-mER*O(}wtTp8X0mi6ZSx&O`C?+0L zYI{dy9La9NOLWzSRBQWLWJ{3~Y0EO+$fQ4LM@GFkrZdw1(MR@^RBUpYKZ|abLI&&& zLq|N~oESHJl5TGwmE;mxe2g0YlMx00@8HMK*nc7`&;Ag4VSF;L7#VuzxjxCCj5RN` zIWFxp=GNo!nd})8*@iEpAuU+O7=GZZ_HqDx1pWPm4vs`nfVa^Nv}Vlx(sTL-7kkOb zl(E1;+A{go21Crb;vt#itnL4jT_)`x-(=5`Lz{f{O?JJ=k0GTK=q4MDENRc|1HaKy z-{{NX(_8oo=;#XF!&iD?c17+4qU;b^kT`_C%9?q}P!l|oGxzjC=WR!zzhn zT+7bIPvat6oG%&BH#)Fo%CM8s=k43Kx72oJ)%DzLPe!0N@zk|`Wta+Z>AB25G+_$_ zZggdmcasN*Obmq~_2`8CREORf^++tou^13W0zwE(S8Y@yxYCeqM59;~njs;y6qFGm zIPMcrdqR{oJr>odZ>h_3`TvX<#YK3V{1|_Lp#%V)n8VOwq$nm4n5n#93eVs$KFTwG z(sC&WN9vwvk03IjghE}oNULO!D2tSBLdhr)Y=T5#2_E6mw+J={oT1f^G+AS3%s3!z zOW&kO_F8bno&(BfAB48h$++!X;+VC?0W(sfLdF+RV9LbN5oF_|IPPm-+l;6EU3RIP zIl0jWQ|;KY82fyS=2w7Axru;yK#^aMq9s(kOSSdiSG;|xg|p)TQnB8$RfjL zOM-f2oURF8I9MwJiM+`NT$clkUvNP;^i6*RQVcg;z+b$<7c`Pa&AD?FQk{*@bAW$z zPcR^;;~dDeF{&d-LO*)L+3B03K(B!Dp|9W-kI0F8_)9L}$^PISCxWhM!J(tA{_zIS ze&aWOqv^VUNgHPNWI^ym2BeJ(fH??yg8sG=2w(ubjaOgxphc%`gk{6Xo-uQJa1$JI zrkpgMR4zOr;L$~n918_BqhKUOw1k5pqI8(&7tsl;YYby-l_9hYmj2SG$c7?_ z7)4x!SDTDF106-DxRl0o3P$ktW7&ZKYTMW{Mh1uSn=Nr991+3bv=|2C;CQ1Tlr7+# zGK=;_Lh4d%b(JT05p=+~=*LnOLm*1mhKLW&#%T=dp@jqPXrVnvXawA6Sj{{bW3wzc zFm56)yc;XnF*qELw)Bk``qwUpYNkOcJu}Y!IY4WQk3N<~D68>NW-}>@$WSqk#*|3a zti*GCWpLc1sEiGT#xFcUJN42pe(IZ3;@I)twP&0;!^GfmaAqs$hh`inBVsJdp&5BH zCSzlO^hM6SCsCG@WysVOxG-L51|R*w$vIshhxo#o1>mK9Gf#cuIsUt6hQ_d)MZk|^ zgvW9K93A9F-_GHxU-$~H=ozDJ7D`?jQmX-G^k@dq8onF}nP-$aEHqLct-ViGA0M@c zUTg>1K{udZ%bI3HW)#jtL$czz1D@*GX9P$1SZ*`ZiL)|GVuzGvSI8c{g0r^JIUp$J zAbVT@S+|5{=1sTRJq{3$IT`#Udz>vN%z1H!0x5RGOy3weVtC`5HU(DB$rd{zND`FO zePe~AgIvIWEyAH?I>cOU(5Fa+VYi$>s3?i)Deq2b7WNkv5^Xv}B$mzegNX#(#x=%{VHfd;GAIFBndNAk!vpZN%)lTL z9ty)C5*F{l%vLBoCnpMm1496Bg2}L17E_1Qv}~zw(J(yVs~tvEv_dzx@lir_X4 z;7ieslTyMP{`wK5Fp~JoVH>+~8?Wce!5iJS`ei7zr$5mpTA1B3wE7OtXkaX&RgM~uIY@lq*o+5G3@p6y)Y6nCH9Ud~ zdYd^oI2KEHaMd3}Y>Z}+WCyR%0X}xnGd5;AG47rjul^Y|ZJ-@Psvp4&dZDlWv^k&t zC)k+PfGNiqk~4jyD}41$=8OrA=o5aSqnQQ$rB57?HaKp2NB_wO$Ho||t37;C-!=Tr zTx{}0-_YNf=r8)BiEA>gOmv*AqoZ-UFOWbN4wNqAkr@+1PF~OpKk13~1VHS987#db z2l}>DsaHPsSjzlD@4VhYEEM^%5ToQpe2&`ug zObuflh^nq~1PYTF8$yS z{MCbB+Hg-D4orD%rQg(dop#^?^qnz#uAPPW-9!4&-VhjCk8|fN534gmB!K9^wR6M@ zQD*^zR~7*X3xWfT=-XB<*J<0Y=xJ8sMM$(ILLLIC8^xG}jDJ2LbZKK&=xH+q(vP~1 zC;;VgEJiD1i6NL3CUNa?2u!;dpnyG(7lZT{c^gt!dCmwvleh#&G?=8jJ{XWm8Bi9a z|6Bv@2ftb6bRp38&h}jBp-O`>ph9} z(WE&dq%xMK9Ig>~+O>Bd7%EbA&f%o4Xvs31bX^G#-gk)dl>vUe6ztn}9`T)oWq&c!`52W#Bwr0&*@KE|S5I0biOaqhmd*4uaN z*wHes)KSKIH@xDIwHJKQ&$|LLMV8!8U*VrR`gE-iU`*ssB8B%<=pWiEn=vYBT@r8DEF7u=FD1Q}9^z0>L2oE7xv9i5l&Ho1D|qJ6a29==IDO5%qX{mERkOh>*_ zR^QsgJLl*T9YH(t?=Y5(3E&f_?cJz)Xd7A^OWMWZ1OkFh67k(-4TphTi3_RS| zPU<*Mx&C>|>Bq7{h)QX~{zIuP*1+OT`3qWO(GARSk zi$41Zq-9cUnJ-c&z4VkO&MA38ZF!C$$jA3G+U7WIdEtv$aMZWVK8D2$LJDlJgkR~C z5(Iq7S1PhLf&BpaiZnry$>Rki_Xax0mOH#eNz4gN%=1 zBG6vex~G4eghiqDFGyFG%I#%0!K3KfgtzQ03D^W6&BqPV>94eetN5moOkd@;7 z_4)n&zOMhS*X?$_p3leQaes8)zk?w{ctaj>satp+NC-#8)k^Sfca-o~&Ex#BIhU&q z^q}%It~m9gBGzegFga}(4(@3=(aRM2?xM}Dpz)}@y?D>I9V+f_+tFxC z8{w(YZ&A6^%P7hARr7EOK>ri=R8k3Eq-b)YRw@utin2ERwVgk#tp0Xq8jpA#(OBNL znl2S;uO%Mo_m3q8H65#yV>KY$U|a}+>XAg69{LR(HOD0|M-Fpw0FV6QxC}>ZI80Yl zRIKW7S&))l+Ap-eex>LVsvzgO6&uR_(vc#iC{ljNxgsLpwY8R`$NH4kw=F?Q0({Qy zmJH-+!Mn!?+=fv`J2mFG7PGg2;=}Ynp^TkJCsNw0CCyfoyd=`SkhAy~b5yqdk&Uf` zm-KmqF+oT|g_%h2Fpq03apu&@R`Lu`gLgE3>eY*Wxski7kj9TC$w$p`^$bqaD*oj} z?pmK_2xZWgOuOQYPCS7r?~xKlffeLshD61n+@t|XyeXC~@v!S9gQEt2s99L@BOju{ zyuj@9TaRQZx!f|ZQ?g+nZR0!0i^fX+txg^@VQ!O--c0E7K zMB|4=T;d(wwLmscma%TAK}4g9r$!|<@0ds8-}%XfXgS419?Ow4 z1z#1EK&TRYm~^S(f}(M>NZT@yGy>m;xc=?Or#t)7AQrpRiyHEH!Y)Dg3t0@e^9?S( z@u{2TKC#k(c}@I{baWWbNTUbeDF-Ezz$sv)rg!^ab~LRfQ2P-k2k6c}iohVic^~>H39VNtY~<)WUNTvIW$STv>g8 z(JpG5k3$sC-10vO`S=6q?>9(KmE0R7m3;NQ9N;eD!0;QlYvo!0TrawsqHVFJD|WJx zgs<#8##r`cTyfLYMd_3B)W9|I>AjE&7?afTm8=3O`0bQKC`D%IxZ&{mBD1Cxf*{s6 zSv}Omi2DF>6lNN~3?%_22l{WD4mNs=oBKq7FEzH|rK{?6qzwRd0#j*y5Hu(5NYv)b zJzf`pLT#)m+g?B#W2g?q5o);xb#4=SSgG;TxZ`ozPXe>gO9QFLz63BaCNiNvtzU)5 zfyML+RF}80M;aLxp9QIgji2k;vXnF?*yEXH6vxLw_xEdaFEpu|{L(AP1yqh!DM0bfnX`OE~FkATP70EYYbrihbmu=6Lkc;1o;NduNE zzE|^o7EXj^+%DKifW6wWY=RlE-?d!hbF9dZMZp>v?6)IGZ0rmtWx$;+7X(c~f%{hH zatXnhb5{xg7}V09X2AO9a(jGQGpUAQ(OEoWNx>4untgA(>4yO<-6*0zhyB7{(7*B= z-FA^4(-~GyKR1dTbC~);>hrVSj&BMvQ@Ne?nPX2XKl00!@UsLTeR_&?I?qk7NE!re z*9V1|)i3I;gib$4H40^GGd3HuK3^?u*ZP#u5}qLu*U8wS%D{&8bJkJJ%q)K#(l1YqD%LleI3|Wryl0y>_sT?mb?=)S`=Bs3J88gB`O0iw&o#!0j@3Sd=&@)@> zDJX}-BEo`C@tG?KdAWZHmn0{W;?`kD<6w(jT={LZ$Hyd1YEh1C^Hc8?R&{ zASv8aqt%B5QHaMV`(nn98M0m7@d+erQGgl!(atmB!EB$GT>*l8m&io;@ilfkm*>Ra zJ|FUChhvroKt3@5n5Tfn+nKk)GM*$c8>9=%XkiH-5|?=#|Ebw~k_qX#bvXuCS`K+2Is?qF~kkYBD%TA5ldVTrx!>P#t6`p#Xw7|{VA5w%1V^k zm)=?8)Fds{d!bGQ?N`eVB-RrhL{v)o&yuukIjx}^qg5e9i}Si717%UGlg(iJ{0~Nd zgha{Cn%d{LMT&M(3b)u!pZep;_j=BTaM9N@N*pOvKm%#8m{t-^#B5Ox)ts>2_z0@U zr$9zfT{!aFEoLTZUOy&0W2%g_{AIlKngg#{M)lCVA#m#AN}c$Cx8@+qE{XRMyNZuUtA#YzW88>GZHAf6}=rBEjfAxo71X-Q!;kN)lxRGx}F9!b?Ty}unT{>oWCq=kDO zBh(`-60`iweuZ2S7<8c~W)PCfjxs_HEOe6uY5~2;Hp)5 zWhKTYpHfk+&O(1rbRY>WLYR@q&i?pjrhAA6DJYwLh-zi~#Kv+$QiDAn~t?x7B>> za?suAPmDS5+=49xJi_965d!CvhF(;?5MbkB#c%)cxp8Tl-S|PYBo&D-Hi`mB2=8y( zf8%qIABPLb?|8ApzF2uQnAppZ4)e7Bt(|s+NN%gFg{>ux9T59ty04fLSGDh@FnoDh zp}~`&vGShhra0#&WW^zV#VL_Ism0VzQqlq_{-WK(IDr&=&it@19R4gk9qY;C)lHB& z^Cuf)g_(}YUz`6OX1cAd@FDfw1B@?|&*~%)>;F%3r+>^<>&(_xR zQsA;aizeSq`U}}vW}i(o;#Jj1bLH96P6qnS5Foia4l}Brzz^m8?LX<;eqfMCI@I{l zdNrP>S3bayW89Wa`uFnOT;|**PVmPKv|# zDhWwQ&h3+f5FL)68+oCQAMdS3x&0A0xW9L@Pc294!oJsM#J0-p@9Ix5*1!HR#E|NL z>sG8gED0}3e&m|l_)JNME#l{6YVmpf!yj(0KdQmmUACnkLciXljCFq9tKzo&sVw9` zjE!|X>TBsJ@IPia);gI9#Rb>%s7sz9+zdHDu;bpV`OV7|H%+}g9sdk4?Hp*+|2Fo= zj?<-i&up8YblB(OBwUt;-*IDN#`lB8H!OLl-psaF08# zd(7=>rcXg}6`@PC+~#}^xmJC@H$qG6-{nt~%@O``RHWG}DiC0KjP?3c-gi>Gbp29y zLq_~AmOiNu7-KI~a#GNoukSL;guUL5 z)jC8E$ao~|zWKVm_GMuAvP55GVQYQH5>MuG#!#{0%tFWdykVv4y=4uKvsRFjVBw0k zTvrwhzqqXU!Vfu_`A9n3gSoy330=K+zg?9T%D!|&QnF%;Ag>4uN7ze4OlPwLyRB~1 zr>*|b2Xqa@0xT=&1)@xrhlvf$4_sdN{(T?5830FO?>-yI`ClsatJ*W{meX(ugQ+vS zg+*aW(LGpRZ?>$!0c+&jZ*`S>t^sMYedzuLhBb7vR&C3JiI*`p@aDF~4)dIXg8h0i zbuP61tHL!~-OiyS8|4p$lNVgA+nz-PP1dYZLZ>1&ZGIXtqPDiqF(gm2A?|G>Ui=GC z!FI(NkGBG~t$=NWnB$vWIYzaBiBY~CUh(KC)Ohgp>_<6yOlgglnsv`vXu7b(k0&c^ z<@R|CWe)ya5q5C}*(RItqJ!RZIfIYv@=aqQ*I8V<%8FW?Hnztqq1baKA>}AJ@}#e~ z2N88CO^XCRoyBdxCdoe@yOV3DlE;0MTx#2InId#-orimUqC9)MPJJk6aJhs#uPv4I zImJaYH|5H6lG8zP5s@g9V+KL`RMrlMklOJ1i0c6-SQ8t^W=%JUM_VImd71SXCJXDR zeQXm$>JpkcXhr2|^(c+7PvpWL)#7OV z;hQZrgQ9!5^G-_}>f##{-JK@t=%`#kOp>~*%M6>BMXBhVB_mLn3=bk90b&KR0PtzVrrd_rLySrpjX2@dk>ppFC|)XaDExcGw*G~@w_b{ z0|1FHbH#KFW5()lGD7^{c}Awpz)Z#%|N8wWSRyME!Fj2hd=2vQHb{J2JbzD83&pJ!dCSO$6G!|ZroPOI$RYA#D8gHbm$3?eoR^uFE%h|)O3InmatQ!e z;+N*9gXM!hl~y))nXexE(rT#}WCTk>tda!lHj^9{2!U_&{FC#TG^o|SkEB=3C`|(X z-#^HB;{}r%Bw_>4-N6IDC)8-V1XQvJzgfn8p*_De*kagGDeBa!R3_jY0j|jR*+ZU1 zPKf695_0cEG84!ji?o#ZnB#FjKe_u1)wBs%R~nZn8Lo_Bp_j*_TDcV9vJ?1Cm@Scw zls#LWv@2SqHOjay-Fd@x9mpuWVi=Vtmy#T#G0ntiH!d!hQUUBQO~}eK6;Yb<(*-7G zyq+aMIHp~^XjR;7JY}qK4pFnV)%UZ{j%hsFFmHUDHaU6eF(0fL|8|DW5pzg_aMKq; z-C0qrw*X(kzTF}fSEB~lRx(D2gYg$8sLC>r%UR#oC1GW7qJ}qzB@&9m=>m2@sAarD zqH0@{%9jv++Ehdc^#NI?-TQzsh<=sxrDSq~{Cb4Q`kgK%da_XE&=%*3K=um`CKICj zS9)s;$J9oCKW?%rAvE){$Y%e!8M0I4?yByWHs?<-@7~Q!o}xM!j)YF1yUW7DbhYQa ze~Xc;w^!|}P{|{^(~hy_%M%vrv3VytcS43eU#)3=P)H(z-7g=0_$?a5!X7ARFZn{A zz$fplIVkz~qH_(ev^iT@{BL@>MlVZ$i(+A=ujEQfFxb=^>})#h$SZGcDRukbY`vjk zzH@E=s7)GM{YPnWyUF+N(JZ(f1&0GOjhNyYQpq=XCJWOkpNi=nApKji8T|O_bqKi} zqetY8D7-w}jkio*ucYBshrgS3h#25;KAIOB2n4a=x=Fk;K?yEAC>NW$hSy(I8A!^- zh@|e4lb9$k-&L;6H+whx!H-SUBSN(T;0Y{*d^8>+@Mz-3W2whVKb$+V)UZiS(dF<} zVi~)uKB!;n)p`-1-_eenQF1vZeKE7sBW%jzaunNLD#-&pwx#_zT?mf=1; zh^-)4XeT}Fy%5? zumc?TE2TI=E4eF!y!~+HdkC?U!3@T8@z}nfGn_}`#<>BR35{dRm;yIma#`4zdl;lf)*{Gsl@~-bC z0d7LokT``CsM@j6t7NWI>N!fT+{p_=ifkaosc6y?aE7SLC-wjCWC=jF~&W9UYdgBt#fy4c%ov@EL9wG+-&>$KYqN>FSG>P_(3(fA9+f zA%!@;J?udkzm_)4v<$N>nKJE2lc1n(o5zdtG{_yJd%@*8LSc!e`w?Ml-k;n5A-nK1 z5vk$EVk?5FSSql)q!Q6^u) z%Rt6tjKRuTwAX#bPm<31Yk%f)Wx}s7ul$Kf2uEMx6L1u9&epL~K3n4fjQ>xYro{st zmmKKLxEBk+8%c$D+y7;A{ZM>P6+2%Gvy3S4z8bIwt=3SPp?nEesR3JKk9$ z1`cFv99?uqSoR=5tN_%zT$qe?`QEzZf5xRob0`(RIRe9<<#+g@g(0CM^7YIlxP}Gj zVXF|s><_$1ne_eDR_`N0vII3fSS)$b`Ga~CyHB*UWUXX0Wt+SG?H zW5%@@16o+YAox^sSbu3ub!TviQtSQceF>vHxaM+yM*8y{cSa4;SGOeYd)WZR&1^-C zTs+hpNOT4hUCd15tIhEC#W>QYA`jJ`WPUNg#?X4LB%Gi;V7bEeaT z$`MTW?q@d?-L*AjunbDdmjjDF*ZbL6!?S`7B5XRt#{ERghi_nJx;xIvY1S*^Pd_`) z=%QyWF$^6N28y~K`7@J~7Y#a?70dOG(_l4eJ9Sg83_nG)6~&B*J|0#66yPti05^Ur z6iw#*GTxoizD~#8r(c&ir74c%2bEg5d$FL|7L5y*Ur3g(H+v46RJ+|$+RgkdnpCaD zAJ9s7RwSq5r^;C_5}x`~CcF0o&$f41>HApHc{f}OeePx8_vIRU7;|Dn2sW{aIc|Ub z`puIIKRmo>=N}K+m(t@)*D2WN-2aLN>pxV~zTDZk4hf@k8E~Ph}fFd=H3}DRgr?z|2|vJxy0Y(`8!=Q)u1DUUzCl{Q_33GAd={dN{P;$_J3F*r zLx6puI0_-zt-CirL^>@P?jH+JF{N0!pWOSoKc7jJhzWh;;hh4p%Sr4})pCWXeYoCc``N z8k|WdPV!Kj{{kiiC>kyf9WseR954cdnCyk(Kaabj&r0*|Z?mVO64Q4k6aVs($}f-k z_zloi?n^W=(vpoZOZv3|**jOpE#KC{xR>rHEBsFAGF#UO1APyjR`RoA^ZJbVZ^$b8 zgt*b~uaw;dlYa{-@&ZIk%-L_&h#XhTMAe_T8o$jE)LR#}A2Fpv5|i5Y$_Zwm3}j=6 z*PR=4)1zE3|7WrCV(A3>jsf7%_mrj|iq)NNhrN5YemBPf`E!{eloxx|LAcPM{h4Pg zZol_c0^b7r8taOt#-l7Ho6L!VqVIQnUEU6iwe*~c6P@mrgraA#_zqV8?LqUm&kMLS z%l};Y#CK4ZsRbq6%3HK3?O_EE=2mAdyfiz-Db zf{8B=m7JpA+}-i5*csI`^n~ENkTA~`ZHpE2&_jffriIY=;|KFqbzjTR zJTecC*;o78T#t85#j=)J2d}>!r}5C#mDW)fUYikBQ{8o*M8VCbzw2`&;l6o zNfAG>Fr;vAa40@{a}V9IK{4?}e~)aiEdTu5Lu`6%zWvP}kNAMI?q2#?yiOr@S%x|D z&h1CFd{#U;j^C+F4SjYzprZ`QK1(xG^>?iC!`}2~nySBRbnCbSV zo6FC<#_VB#b~{7Hc*9~<2Ocl%QJB9;=~PDrY&q}161V2FRfpnX&C;fW~K+KWi(Bz1JS z`$Yz)*L7Z$EJ+)S3JO*=h)`9j2uz#=XPOW*nzhw2bqV~`e{W=wIro_Fo`gzLjG2`P z2gHR5Qzg>KDd%3L2a(M_XuNh;E!%g(EjK~V8KC;UwZ%HBb5g?e!o*}Z-drnBMcvgw zRG5D`#w_3yS-l_cNL0Y`|S;i9TLCl_!cGK z&bX^)V}q4Fm%ozpy}_U?`&fN|X=V)kg>ugP`Xm+YTP-0{DTYjd3qPv$XWUHy9UF%t zL+#nbbmi`!Q8~uL5tf>*_id=j;i7CqY12+?Xui#_V6?Tci01_bnUAN^u4ungl-FOB zjj(2qrO+5N(zfW|8_6~^fLsanoCm6~O^%Y1-bF4DS8j^kl{1D<_#j55Kbd$f%0&%N z%Od!(K#Jt0E|1ZCgwVD=i*RBP(z&7xA=8`la3r%zVQDA%K|kQFj+DW)P6C6~M~%-p z1y&$DPK=>TAv?%*l>g4?cnI^WTJ3fUaODQP)U$z6N(#?nDw~nRQuGb>94~9`n{S@v z$IO1$nNX+3gxKIvUGqs%9JJ8=UMoD&7Mzvi?aj{LAjv)3VpQiJWoHF}CHvigL`CZ= za+`Fn8h0y+vjt|Epu@oCri0mM(svVkfibTOvLIY7Q3mgHW7+@kVvUXNb^sN_4mF>v z52J10Tf_V#j&$27$zk&=1|2vpGOA33Vs-K6`t+JDpcM1qi}kw{@DHa1CTCa&)f-}d zh#$I*=il^#Xs%MpIjs%dv;Er`e{Y>D|5j{uxJ9zIHWHjx0R-v z)(`ksvy~5bgzN}eJ6rz733jh5vMM%^P;%3E`9YRb&aPG@i#P9?6G%@t|{W6ua0 z$jK?Uj$x(h5==R=SkN>&Mey$XbpowQ(he)jJ6Erfea+%=IaNwb$fG}1~9enF!xL_8haGT_L=SaK(gj-kcnX?;u9^=Zk2(jW8#(T6=SY&i%31j zxFb%@1=f(UwQS2K$X+_oKQxpFD`mgMS!zDBD0sLi4Vnh)ax1Hd%H!Uhr}0Saq>0l$ z9pFYeaOU^PtkXw8?eNr~HqFalcH)sk>z$n2h(>Vt5%iDp*wyj#TWt|?S>Y>n9%Wx3n~Lr{uNbH9bmuz04ZrkW-mlR9$+Aos_!+=HQeQb z1oXnPwd-EM0kgkjr_u7NQ9|$xyuIs%+D&60He|#V}`2;i+~1X0B?D6VOxj;fuBHUVi}PF^f-V{oLu102r6!! zQlAWzeLyKs>~^h9LCDy<;dUZlyBMF zjqvlainy6^s)AccE?!2wD#xGpL(-Wz$pHN76!M3zti92SmR{z0E4CfDgL-w)I98Z)(VGOuFCdxx1$4aFuN09E82V zKX$H}UN6$?_t-$h=Xhjp+(abCD{eLDW6knf#do7Zrr21Z`HeX%M;X9?Be*#=`9<1Q z4rz1W+h!6hj(Ztn`PtdG(s$3X=VV`u9;89*(D8f@nm*@cE+~X;O1}t)7Pi6yXB$c$ zD`t6PzP9|O*Vy{>{-xCGNDEI$;sqIcZ!ywY2NN&~uIEyNm$YdF|P;?KZjuy2HOXjF4P z;!?!XdoDL{dYuMmisdTfP3LKyokwl%<$O0`ipTJu^hBA4chX2Ar@D?gF~9w6b!jF- zR(#d=WyWg3ph=cZOq=LXsy~y^H1BgJ zo?ZJsh^uD8TjR3?<ZijjzD5wx`Ck#l|zrCP@X1peft;PCkWI`*o@|q;WF3w{iu` za_m@m)26IIFJ~XAn%2< z6H^U7Dww|<>50E+E>93;UiLj&ntvG%xjs|iKbgPrD>O#*u|`QkNl9w)vQ0oo!)^LK zu^RSEC*AcleELB`52PX#r)TVn^m$Ks-4bW|qc3m}WIw}vOqQ1;wVdMOcZ1_kbO<$B zr-|*Y4p(P}L@K>Boz)VO!pZC{V_^DHL}k7x=y8t|$hD{Y^dEP>A^<#EO>`o|xHD2#`DfxzRG=v9}Ba%CQcd&jMf zH8*FF#pL16&?6?;vR*70L2>?QXzon)4MkP!u3+IT?~~TSlxB1)+-BP}(WR)X$OT z8|72n`M_8NkGn~IW%N`V2myR9dFGom)Y>AOoG;eSk z9nY@wA_`AMr~NlBp-moCsFPN{ATTd@YbRrZRM_S=UrnEMaPR6%?4j3_T*qw_chkxK zt>No|E7*bGgAl1=4D8)K=xTjwI-fpywJftWmBzIK`2)&?a6VUybVTX*At@#(weS`x1Wqb^*Nft^uT} zHJj`0rjZvzU*WST!VvR{D`p9$gigtHFB^+`uz{154#9BPN|4h7vb)aDj^(>PDYLp< zHrD#RPwv&&-#lvh&W+Cy(~5%Rvr!p32`lcjWg0PN3T*TwMM4yu?I7LMK!~ zX4mFlg?zLL;%x^uoGjfh?|S2KxO??2%V4PGOeMAOFQwf~rqmL~EIQjV6lpB6sbtUa zkBuj&F6ggJZ^U=+Pzk&7<7+P^&T@(dq1+1UMsHRv)%WI#WIEo<$1rWWYuVoF?a75v zd3!qpGla#Id@pr?2=${2W+w#-q@DFf;-W^9E8k%D<8cq{E#07Xd`KLa9?_<`G&1or6W_aO|yN_!p_3 z2GHlW3(^7BpPYVYn1`e!^X+F?l|r(TrZ0!kGuaKP%V)-453ROafT<4hO06ySy2RyL z$(r&&k^VHbPb>0{7N(E-I_om%2;Gq7le*}Q-`K&Nf+u%>{r8+0!bqGE*7XI-y?kqY zK5a{@#G!2^H}>Hl_Ltk#2cV5&X}^?tiQ9SCOzG@E{XYM-%%_WV5z&0x@+~FXcI8&XODWUGNFP{Z&x}VEUsz| zr~A7YZYQi5E4VX~%43A#ud4iy*lT-h(qL_)wHfOZTt}JVh0SAvZVMsCLbnSle-Tr) zoyv9wwYW4JUNh;q;xY2qM6j}`8-;{j(Z}mY7GHG)_k7RsN9349chKJza)rG^9JLA^ zA+#ab?pB*4OczU>p6}YD8PP|TYH_%6ah>TLq}koYBp6~$=#42Ltlj@nA7-RN$V5Gi zeEtpG2+}Vqa-4Iww_qcUjaFy4v4k-zrzN!!<2{exsYe41lhl_Mo%ZBph+Rv4-WruM zxvxIHn@shVDHe@wEYNC$RcFgy#X|>Hb$0J#6}4r2?OE4{QlXPheX)%uwFwL0?2Jay zcocVzDywX&Q#<5l%5Y)sp%`n$yn{#mUL7B zA9{CC`!72HDHyvtV&QVVB8u@pUCGSk_BH6| z25+DqV*FKg(xtmo7;2O21ve-YrOiI6*8v4X;Zcc5gh-~>C462h$9a0n(nglAi1PX{ zdsW^kIkmmE7o+U$U{~=I9&$8>#c&xNBvS=(GfLDqRMwky(IV+x5RMR){zR^!apPbQ zCeUA377M)5m*vim$jpzo6E!|m?D?k@EivyZCa#04?Xe;&snRtOHGLXzJR$kSia2h} z3EU80XHnQ4sY>tP{u8`i(nHAS{;`(?&*uMSR4IgVc=Qs|W|$ITX}M8pM9%8tWNIHM z@CdMcy(cu)S>>gN4t=7Bk`9w`7X|?quZ*->{Y2`*Sg`wZfQ1^4Hhcq-PTnyyJHTSioAaW53SIWw3Hk zj$rpKz+GJ>zNeuBc+6sR=};DsxdX{SFJJMw9CI^)OvR6iBb6ncKeBnPTx0`{-aQgL z6_!Do`hm^hTp|SBD>0gdr*F=?b}Lsp1pzuzg5+AVG)lyD*PyNBmuN%2faX>%_@QXA(oCl4YcD?3mc1V zXHe#dnAlLlNe~P@RAM=z!1t9kBb0QcOHsy=RAF_RC}mKLT{^1fr*7}bEul*rFAnAk zkFl&2G&33ZraFmG#gI6;z-fFiRrkBwAVR2 z@bC1wq9a32!^}9bOZgZpDz?m!oWk+vazemBkhHJbL#Uvj690K}9U3$kkcL22i%sYP z83*KOlp)|?Jt(2({U)D^^G!6=Wz|F~Uq+?a1_CWV$N#KkEG-O@3N`{D6s%L=Ll(yD zo-FykPDX6q+Gn&Rg{tQ?d(Giuhg;-USKx?cznK;=i+ys-HcX*C zH;1x9HIM^{l`4Eb#EY5{=SQeU|NBiyFa`u|YTJpaMNE{0vH_deJyx4k@9oJ63r6Nb zVjP6}#`_I-uN1Nhfilw#;G9Qt6onzWWgxjtl4WM!67WrtJfZ6rF&$Zzw%Fp268}m= zj1MK*Ry|A=dAqF3)?scxR>hEABX>6<0Y}TXhq;D05mn~5;=d>==*S*2Npug6z-aGIU1;kSCDhI>Y^qlHfDN6!-k`#g)?NHA*hn!j#Un?bck; zGLIkPt5R>UK4t0ii*~)H;fdB23fdStTDHG5+7Nq>P}Uc!xN?Xce7xwNj7{d&(1o-! z41O19R=tK(y=81l(4Gv4C* zOEVfD;qw%kY)MW4yPn>Y7SIxYq}x>Hu9NiSr|3^pM+zxq9&RUsOZdmYx|Q85Guk1}YpgoP83F?|UUXZ1%Avg}G?%Msq`Gi7ox1ho;&=*(aXz`PYhU2g{xh4#V5s>|9Bh!lyu}QOEsf501&1r_L78 zI*F62g1(w_|^I;dkBWkQ0?uKQG*>O2hNs z0eX{e6xZ2L4)L;oAU;K$_18!x%Ox`=p8GDw#Nu!h6r|XfFa78e zOMb%<;@H{pkK&R;>I#_YSVkMMQ5}O{CutD--(h$dPafK}C+=d#pXiUiw+4%+ypqV% z$n~)ZcZvVu@R*HA5sl@pvy9+%t!vpzZ6)$e0XB(B+>HBF-4v}rh~JmJM+{BeTxZ7^ zaTQjueO-vM)I86w#w?{LD*cWwY@PKzarpSA+LHVy z<1t8iuo(jnPPiuDUvUa_eUL9&5?fRh9_OB@>O!wGj{FfRcSl)tmR-DpJ+jh9YL1i6@hI z0!}wl?Ut39#6N<3*_xQ%#A z<54$=Pby(M%}V>$2CV!n#Q@-|Kb|{&U*1Z+C|rmCd(t-H>rG(%2X(oZ5&d!J!V2xv z_?w3e&k-9;9s21xZfYc+o9Uk1tYKxzePS!YQ}H!#TbK3!Fw-_)MSDy2M6u0RMLhMl zKraSW9VnPwqVItyz{txt(PY1~aAWmDv~~|pUa80kZV|-Jkgt*Q2aAn+Y*@ldH`=QZ zg!Q@lKRw9mlCu&*K)OBRjSI7Ff1%HfHR8a2-S);*qK;4ZmW+gQr@Xa;;mh++4IHNP z@1A9mRIgnZn|Wh^_J(T5`n?ez*i(-ju(_MO=V6Ez+Z;fM;qTjX)(d^~jM=nwcl|k6 z4`aA9&Mys|E!zDV{l}W`X5c3{dJEzs@b@nTXNjFLQ z`ElzMI!vtW&1D`?GP%2R`??5`)1cIV1bvkA`ynXaGeVuu%ujOpeb(vn^Sj88>aICD z@h;=F9>iyaXktTo>;87OM7tda3-OMvU#91i=vU9SP+w`RBY4M8$Ksg4bH~(2)_!@iW8P?ZMJmH|oGbnMDQDH!`T6BUt zl}H=EHTyCn-3e6oV{V;X*EnvF^F)%Te5de100JyO>X37)*mMRTT)Y5Qa%=tJR+v-t z3moY6P{8YL+n242KE`H}o_a9T1KEhh7BPqlzU{UIzR+4p=0YR+KrX^0P(4{Ik9F<4 zT#Z`#W!FR#42p5gZtkUu1O$=qaI59YBd7lDB$#I=gZ*vqsaRJF80L2J`wA^IT;rDC z4N(~a`Vibcl|oA?^mM6F9>CT3=bQOu^_^YGN90{&`BD4%Ib?sHvtR=#Ba>#u<{C|^H&vxg~6l+KSiJgog8|zt7KoZt3^oaTT4HxWpFKtkg1s{ z=l)BojeT7>yyn(bUy^UD_%DAgWBv&DmGT{oRvSpzdUYV$j|i7X%ANzhMSJG>l;i;w z6wq(ez28NU#7;WZqdC8LL8j{FZP~xeKlrf^36S)nB5x}@H>W@tJSOpS%YW)VP4#yN?o$aO5|@u8bF zOp+h5r`nGyy}ojbvI@-gwYjW&apQ?obGu0aKQFi)3Y71S&*KeXV5$=J$5b$RDCKAo zKG|2r#cpQ3fYv8JbQsG;(h^h@#&3n!8#1xPS(`I0w#4rtwk$aVdCSL-+m8U4j{gx^4(q+EjEPam+V}(qndOwh(}T6Za>(%;KP z2j`pnZ^vs)oPleabuaz2LBJHgr*~aYJdq+u1T@M+Ide;a+jE@796WkARcB4Px2y(nZTsgTGp(7YaT z`Tm~j3qg8__3ArYh*9EYk@c~&7B}7nNbEO3L#D8+rD0qZIyN9%hbH{r=|#PN7q!CH zix=2;RlAcem9$C~i+y+3?^RB+Xpg;tNr@AcQ*Hb_I?5s3)rB z|E@UAQ%TvvM>B!>;2u=;r~lJib5AhLGK^K{_myx`#pO?2Y9DujZ{Jg78#vd=%g!my zIS)!2A%%E=)vLcPL1A7h@#zBB5~(k?tGvyfrsYAtyzMU_Ucpt}pMOQ`0rcrUFim_-qcST)%= z8NQNKt%o8?8H?{hL83-A7lbGL9~LqZ;{n7}JIsdo17RVwEy{ijd_f0hhBfBNWP1}I zPQT*40vR!fEZ^M{pfs1j2h-oLpgJb7&UeUliUt2@>Hl(=vo)hjdCkYF-TR?WEyHz0 z;k+R-@sfdwikXSd34kFmF12tKQ9F^w$w@cPpG?hR-Q&aO%&UYBe62DxAlj_(QrT1lr%{wWROT`F=BUM)ijP{gxM&Jvc%^x7hC0+ z!^c@10>wZ-CNB%z8lQIHmGvysP+%`kcV#KyldLT^Gv;U;WCf#unEPf85ct%{KuGsdGPRj!<)eb-GIqPj`%z_^ z)?JIS)+hco;tIBZ%y6P|tmX=P4j=W!CW<5cBGdYZLY2I4(|k%);m9D)%Ph)3&N`So zA34;x`tly{GvT5|UgovF0}@LR0#hTDs2XTb!UR;qXE%Z&; z@x#+OTFkd73F?b4{{_jLSx_5;H0#xYc_j?~UAbr76GeAI7HC#kU|ZrxFg5EuXx@df zS+uy|alsQFuYdB5T%T~(6G&`kJYp6Ub)iK}FWGZL2=TEObwdDosPms#+IWp`-l(A%awoJ_(5vh=!Is!I5ZyM#n!P6zQBkiMMlgE zD8I`j4JPE6$MEIuO0!R98haOF#$N5ROd1+TbQHigMM{l6E6^!Y?8P&Vw=7+4{UkZq zR(SRJJhy!#M0o&8xqNSw){RWsUVovqotYB%0CC%YKV3WiVI$)Cy1 z3XXcNBD%Lx{@`DAqZYOCrY2Vg{@U3!5u1XMx3a#E^`%upyd7cGusbFw@QdQh7+Zy-L5>uZ%L0?$gt%7>}LB z&7S996N>%7@umM&U&4A7&*OU4qs^fs5~5_Z2ZogaY(^AD8-H5Wx|gqEw@%zH3ElNs zB=ZX}r@Q=4*rk^cSB8ymYHG?Ox$e9%s>#t%{L!aTDfb|o<1hhYp)N!7x5Wf~9CPLJ z{_OlUHfH;>( zD;5eTXV_3R^74WXdh&Ls40Mn1+#-cV2kWE;yG@|aNr-l6vrubePk2}(z#}TLA^)a? zMD6@Fxp^6OQuZ1_iBd};%+*e^rlt(%nFbR)1*Cvs+YjQ@2erfS`OHaW=Zp>9n=|$h z;1LE-S)F3R!a*LGP|^#q;z)5_Gi29ch+`i7Rtjn05iha4aYHf>6(D8Fvezy;jd2<6 zP8q#WBl3SWop)3d+xzwDpoAcTkU;22Q4o?)5~O#fqXH46g(@H=fV3bzBB4o*gx*9E zq^d{<6M7dVDuRe~DK{X7a^KwFcfDEpGqcv5nVd6oo@ejkC#lTXeEPb3uO|o!e9FC99vX|wh7aU z-X9Hk^mE=u2TO{98iydtM0ebDWTcBS+t<|2QIpco1BS-jdRO$6Sjbg+wD=v6F*Q0a z)Js|N0$bncyWJzgx6$)C`Yc94{4evHc=}K}$k5~;tu_~;N1gEGCCIixqc@!%ejnaq z{s{Y}*HEW4;QW|ajal*W_ND^M@VZR%3vu+#N5hssvLz>mgo@iOw0+RB&$G2!TlvM& zB|n$yUJIgU*}JH)7MoHm`@1toTz}hyxA^3a8@6vGrw}^WvM`;nIjZMKM*MBna3xm1 zABMX9j;K!e#rj%)@tMJ#m+0-~G$-|&Vo@5yzHlb=2JqpE`DsFiid%{RZC4L@D#y%z zFgw+d|7_asm5QK{BTW^H1b~;!)U*8Ca zDt!BdpFX~R`Z=|NYlOv#$y6iom14+ccG}jua5Qx@>76@xXU83OpDftDPpT{$%nw`I zF7|o~?MN7?IT^}wAMLfCEBph#cvI?CX`vK@gYY0*_a_E<$vg&vj%y{=_LkqwqKdTDs8&!drO&SH!Y~%90wz1H_BDihfzN**WwkF zrq9MUNObHKLwH7QO*ab5-fpTC;iO)H5cGMuzh5yheGM!bPdwF9Er(u!x%zo#TVLih z)dX8kcWz&|HsIcRg27-@*y7j! z!s6laHW>#VfN4{YrS(rDqT?2MMdqDN-{@`%_t^QstD1S%t#p?dY}vh;sFm}P9m3JH zC9n7pDdV#VAfECAc*x$-hjxK@&OMMKi39c_`&1IcA?&euBO*VBTi|H8&dpIyb@^(V z5Vr^2!?X|N(5&nZJ~<4OoyY>e^n-Tnr*achF(e1U_DEH!zM|#br*^O>Em0FQC25T` zJ@#O!sGBgBt|1G(fao_<(^@Kj+^6Pk7p>TfDlsF)@y%Ou=uEE1>_mRATIbkn8;d1v zv#p9o?Qbdtf@S+}Mm97Ga(2DTc;h}~FV&*7P*!z{B#qABFM*1)!+@+;A^0GN>ghbZ z2~0n4s3rfWO?@sL7)7L#l}Iu#xyissUK+~NA1tBZpAl$dogkW*4g<-VbA5QsOJ-9`}}BmzdSh zsOoD`#ROin>6W{y-~0B)dW$%4MkBRC{PlFyIThw{D{BPP3ekqLod)77;Vpek%v9yz zjms+^iB)=RBYUopz*$oxtjDHi7W@5h`-_l>4cYK3{uQ6adNrty8_sS)de_ofG770!Jmp*x-k-9l5?TI6{w4|iMYqOF5vQpO%iV=^UOrp%BW37f28+wi%?7^y!XO<=HUYkZ(J9eYu4gw+u0?g!TrAxBr#!`bx-cB&qOBj+-rN}rnY@0)A?yC_si=eg;;$~TTS{dCSJ{arzL91A7Pm@uxk-9k zt9AcNJH{tTa?Ic4px9*I1#ny~b2EbuDc0y^Ui^@P7?tHn_wH{>1D`|d=@__3=-_1U zxmOf_H+wa8xlpOqbWjsLC=2z{8RV#3dm1#YxM)W8vUR)L;LJ3pwWIqTCpN8n*cJdq)g4i7WAsvlf#sd|gZx z1(cqK^pfioPjI*>+BxR~{W<^pb8V$2QuUT0vpDsQa?QW1?t{r)X_n5Un{%Tvp!+}z zrDQvbvXgEs;rhFoU-y|%(3!=7J+l2EyB7haj8aPNVUE;gpA?IHVr#3gn^CmuOEA3` zDd?2VW$~rx;8Lv}h< z7)7~2cqRzv19_<{Zp3ys@u+s!gPo36o;`gp%@B4Ym48ghKqfJ6^2*G=!DbRNBUqNS zKx+_?Tk|6?7+PGtng>A))NySVN>;3?N<0~qduonNyd`DkiZ_=cJ%%C5Z%?%!52JX! zG!{n!Z6G56PqsB(-7%2-2UMgU`)O4DJ!Lod$;7y48edCx=JjyuB<~JD?fiMk)Ue-W zYIpnCxpS5Pcx|eVuT zEOQ_jn^sO^BT37jU_cbKSyx*KV>t730K_5y0amO}W<>rzmp90d)Lot|>cAjufs6OU z$V1>aC>+7iLA_Sl>twN0uvELFr84FBQDT0)x_a!Rg*S$3Y4GKw3VPd4!uK~P)4G}n zr^%Y+@h`B9q0C^xio1nDMDqpHL`tR1n(_Ck3+a?OcH;*B(9^p`7j_qu+T9(I-QEqw z&ZU5es(f2Tyme{m4z(fxHUTVUB|tVZCrzXDfuX_wQOB~>^a!qWnSNQpeDB-~tJhiB5@})cKcKACvpABwd9n(s6>D=L-G3( z-|&|W8ejKJMZwu#;q+QF`@>V_i9JqH2K3^)V_M+aEiiSCO@B$<1u|?{pGy|S_T+X@ z5$_u^K;j+N#>c`Ep zBY=-qJI@e{W=>1B-MfLdlTMZ|Q98odm$)#Rnid255xvbIv|mb$nap*Z{JYDu00feP zMaTiahJud9Meq7#Ll7+$T^N6%?zTzZS2$pOAKo2uuMrT>bu$+ zL{4U?(}d51ER^WM`8ka`+APVh#WdoGtO2LiPs>Ud?0c>9ZMdqqtO8^e4{-eGHFf^! zRnVD`=wGmYNm;4(iKyf-io*CqlL>eUTI(O55GY5u#M!P^0eC6?7TEvML%`;-k zV24L_SP1%h&p*9jt{smwhUGYWecht61O6+DHjR~Paye+)Icg}m1zv5zZThPFs}g_7 z3dooOnw|^J-7XoUEJ!_GFkA#QpdY(}zpUP6RTsQ#HZvcJ=-BNDF@o@9a3#y)n>;Pc z6H%L0VaM_8fsbl@H1rP+xAGRv~=#yw$ujPd@UGgUz8PUHR3pDeoiY1vt0_nzwpYV!*AiA zY-HtXYD-}ho0^Yiy|d!7ay}yl1*uMzPIMLIW26e9USaLkU%GW z0l0^LO+b%lRnf&Y9W+|7s73KQGa`SfQg{c@p&`Sb?O)rVz+mja+Od=H{_vYA7|pel zcCWqbw#SZ2R7cKCa!A-Y*hLw4zbpk<1HNgaN3tcfyQVg3$u)fGQz(TH=D!(>|M;K7 z%4_pA@G6&a*DsZZi1+xa4wLQPoEXX}Di$W+;$)&*X%Lm--JPgx4mN~^yW@vU_V(}C zK5KC%1Rq`++|Tm4ym_-t&?667U2n!;_`&@NveNVB$I3xf@!_XWYo-2mzF*bq6LH#v zYw>9_|DUvFx-QUC)5@htMWAq&q>^CZLm;+e$j>vAZdU&YN{y ze{EBKu-q9Z5360Gx%v4i&$f9O6RroYf@W%ogTJP)Ip*fC z^+G>8pi9_l3b8^qV^!}ey6dD{k|p)icLEQlKe+}xty4rlMJ2M)@u4BMPA{6aRI$T! zVdEndhL(TRG^WM0y5*|B{j-ie3~+Z%$szS9chATfac#%NV}8i< zc3$+&Wn9CGcocdIl@*3Jw#oCzm}gmcJQO2{J2y48aEcP19$oh3ZP;FtFrH3I%g+8O zzb*4mYQ4Kq+TOkE-UeOUNqP>Um{%RX*tL9(X&#vNFU@f`RTn{7?ZeK;46fdfOc}9U zsKYH+fPc^DGtxBa{7^w8No^DKH=dx@SDdC<~HV&*Y$N~PaVF>@>*kgYvzyay68%I+2LfN}8Mat0_E zGh52_sMbM~bDqI-yEqlo4MWZg)OHeuan+jfJ)oht6-WQc*3qiW(9Nv8vCPj(>%_*a zs?`t0r*eR1Gg&r#9Ly;Fvc;z(T8JfZRP$JTk=|J#d%Pk_wsb${p$fIrBWWS=iVRAV zbDyR@6ij}>BwKu^*^mor7_}(OBBfI< zUTk|QL7g&PO{nPFLiWLdLL$Rib_hX%it#wiJ}HSj{k(ZE%MbK^`&>NOfl;=R!9d9a z;_m41Gu|Q-6CA60DBC-~b*?yE9u&u}6ZQ6okXLH{&yOn1vHZ5@>6X4Z?=@tXpn#^% zYN$Q#V{HE~Jm_l4_Jt*D9k!XLPtrVy97$@v7jM|OJQ>kR5kYc4k)x>m@}Ru5Lof1vGtfNNcg<;)47^M1n}4e#K!Z6BWG_#*_{_=>#5@@1b8|@`Mm5Zm%!+% zVL*)y;x}J=nQ@+&N(IXwr3@I7C~ldC^?=s)--JsfB+XE9>Memg+U+&s5>H(iGl?7y zmG*>|{~j#>nJYtQpxM+R!2_h1ze!Y50tWkoOUIJBM4TF!`h(=kf$HCpnzD6Mm*yLV{w@%5gBSETq>?V@%q^k#ryHUhqvdgo@mpialXKF{|MKF8G$4=>ve8 zjO)1pntFwCTu#L-pL_|HG0z2LJR*R9vZ84kj?aq>w4Q)l#7mZT@Y#W{HyUQ++dQO~ zOSg8L8M7prA?a%+P^)BUYTT|+#e;-GjOk-fE&R0vbeOEV%CZ|E*E*xuHOFu(udrjr zn3MB|I}1-SuPxe1M3nAVF?cZjt~wJo7wuqZ0Lzyjt6v`?Vj{VE+h$j zwSQe8#*+w8(SrUau`71#95b=*_ZB#)_G73^I)iLAPh=ohB7^sV*N>JKUn>u}ex?pi z!GFy^=A1;m?$1&h@UAT$`w%Z>B2P&teoWaoRVJISo8=j|F7;Hr=0#1D?Hr zoH`2{BF~Bn}5QPi1=R)`$;|&HSG?SB_uH*XF=??mBVp(W-asK;pu=7+m zhoF@pozz&{rvjm=$~J|`Re12;9F)D~cr&157#cWk*ue*?-(clFN~!zkCI9hK($xw} zqxhi7WUt|Y!RI?*2z;Ss`Q0(aa~Ge+m}rboJ>FfGG8pi@0T9tAGlDBt!6m9ouR6k( z9*k0S*}DUiIUQ$e+Bak?#=fq`8h*~}=-6zc{)*uyxo^>$q&$!xr$uOsWqYy-&ch!3 zKecFyWX7Z3Z<=rWFTI@;2`uTSjuyln-V>_W>mj!`F{I7n9?@SEIuUYzW~cI1sXXuE z1892J(F~*t?(G_L4UShIt!=xrz@-4IbPex>I@ua7kEQCdLHfofNGuPcAdVS7C$U(6 zZ#gdiJHi1A$`8}2&*dDCNgLa_pd*UquB`z=^p4A7>-F~_oPi$&{t7dPYb94_HI^wQ ztI{ft!(n{8F>}!R6!QkW#&Th>sjJclR|x5XMsf_tn#_2RNy%^qkL*EYuhPP(8HXVA zufNJx`MrWSg-V^m30g%p6F2CUWE^fyuz&P%2G0gcoNmFWh$IR0zn}i!TOw!L6lhRV zf81I@V6iBMJQ?~8JjUHDxFJIQ`)&(wJFY&;;3=$s&H!of9M8_gJaxVA6>BW#S6e3h zr_YRxy4pqyOwo9-JmX zYIW2hfuiB5lm4$5$Qk3!i1OT=Df-N93>*Yox17;&%X>YkayS?uRiGZ00&?EL%A@Ry zU1VFcB$o@q8nmmwl{EOJYjFR3R<fRFl zBTYpQ#TMQLfr<|@)d4RA_R1AZi=PTrBP)H5Mn7o++L*XYf_!N0KIRoJzK?l(Z+9XVX2MYcMmfi2Wq6J4n@zjdjQ=p%lRNp zGZdaadUrYlD$Co&lD}52Uay}qYLIIxx^Z6{aeU`{LuB#w{jb4~JN;qoo#+tDFKf&t zR1ZktD3ot{wV+*pbInv39n|$K_K`kgefV`x;*l~NiON1m4`*;6f^yndWBkH59ll5Q zh-NkR@gYi-EOd8_Q0yKkMQ1HswAj$G^>7PP1RO$Q&ujRc$vn z+tiYSa$$Zmm7`KTbV6sTQz`s$4p$r)n0!yVC?~M_s!u21LNJc%Hg5(aS1#QY&wJsU zfp5G~*tU}l-S4xn&c}+wUb@c>6~t?6oa9k>7!d>A8LkOgY`yf~VCBf;L<@utEC>E80F;WapJhSQbSnoBTtFBWv5-bKZ zVVbXwl>SWX|Mk|Riynkok)77Dn|ZIMc+2$o{qBwA(kOS6Hkq#;zm{?doo1TRIe*z7 zF6WpJ2cdwMzpP0)a4+U6hk`NgyuwrYbyIeXDR|_3vb$|E5jx3_6dCoGZrk zkRZ(rOwhNm4dNH>{?AHOyeQpVCl&e$>(6UDEGt~VTsrXkmNLo^&yheXL)AAm<_2xB z=9WX%0Vzc^)ueWEthGDo$x<%c7NJgM#2p}rmbv*0-$qX>2B=o(DA9!gi@{oWX0HLU zf+27QHK}O2buHSQub3V6$ZYP6P`!@C>g; zXQCy=H1QUhelX@`vsZ_Mb+t9_(5KgI%nH)XXX`hekAftVrpkE|>aKO&Vo1l|(&LWK zRCwG*x}u}RX_GF0UTKTxN9?YVi^M(QZ@a)EM9hg%6wIqzu-~G1GHolE1p+Dl;s~%z z*F`#TO-h^`0Jf3xap(U^8QaWGS&J5L+GzqU+qKCB+9Uqovlt#X|JoY59?fELWGUjl zw4R`G{%q|#NTvmHK?t^)rHS?E`z8I^$*a)V;RAID1nhuR*k-#=Wu z)6`{v3Y);_{kO$vW_>aYg1T(@=0oFTqFWmR4${n{D6Syzxv6)kQZT)b&CNCmN^>aO zRo23Vfoy=20OV4Y z@2DamuWZuf_Jd!StsZ9yzTn#^i0GL(6F~$r0gb+fFaDxL=>mrpDLqAgN>3qhM@Y)W zDT6OeOvxZ&1af)m+I$Z)b#auM;kD+;w%mD9AD^%F5{)Ou#p;VyLQYz7^=mIRn?<^d zFBinB$+%QkYZyNxNNMa6c`rzDFf6W{AVcn?LqLi(USTHMqkTvbnr=FahSqoeHi-A8 z@Qa@pHQr?9Ed%32c!>5sjx9CgK|%=a?^B^+d~C~D68ObB{7PX8iGIo z)u2+>Y;%e&xoZ2Bl;VjptFEIP3_{2;;HY=Y*gIG?K52qCrF!fPWNsQG5i`|P-K`t4KbI+HP9g=uCCF0*V|))@5zVZVDdpS%HOpzXoFw}M(+s9?7a z^a(2n!s4_k@NLWybW6x$k0k#@L#dc z%Dd!p6q4a#zTAu-5yPc#*sJmbGOejM-h21HT^5K?PH0Trfa@HQvoLo_?qGB9{zwG$ z$Q$UK&NOyVPB@^-=Y^>?(H{BoA6HII|U+5ZC#|dY0M+ zck{ymnX+ZS)s=ETG1&$4-XsSpsXn$uXnLKryzFpJ2;?q?*l%35oEmcY`rI7-TyWL#3(yuI({sqpF=@7KK%6)U#lcWsbry#AN^1H!Qn z`vV_#t)5WQi@M{$WJ^kXs8rwenZU0^^_uv(_St#0LISwYyxx z%l1mD(IPXVXAS(t`f&<=y+7^-8fgwN0M>6k%89T6Efu##dZg{y17v*ybmRhc3IR2% zw5fmf;x96@un)0xG8SK2WX>-;vC8Nbxf`I>KF&0}`OvHcy^$6-c~Q}}qWdG$vP8aE zWM{!vAVW~_6!*%fqN$VDzwvqOKk&fK>lL|dPu$;$H%otNR+lKPYp1LUTXRdem?rVL zihII0d`AARUbg}odD#vET*OVl{&2o=bdKHm=}&j#LB9~?9~jakO7y8{;W=025{3eP z)lXqz`-(#<1Uzd@Iig8s`jV!v^Y6U8xb$Zw7PgQQc$jAZw%ajw&x*)X&px0r+*zb)&C3UXuobWtKF_f#4j7kBV6c-vlL3|1Q%)2V+$JMiYe zzgOu3aw@0s%FLSqj&rc4-(P1eoV(SIkWvDbexxl5{L~vhv9uOJ8O3}m#x$kR?i`PX zf1Lp3ay_WsJe6;cD0%xEKerUv*ABmn>u18h&_0w-v!4@T_Q{rAzV<#fC?{0fU9;Vb8`Mu>?!RjOB_Fg^_VkWy)O4|E?N^)f&W2Rp%sVosmPX?G@>i$XoC|%% zzEXFvFYqd;FnqhfX;)uQt;y8t?d^YIoY_5Ysj+xt)P0)OI2M%yWARw=`QC6D>hq+=b224@xLY|tAmx+Bh|{jnRl87T*j6DJ)Mfs|s z!+FhTh&B&W6y9f-KwLJf@XOcVaM->5@S!R zyXl4V>HiIcL4Qc>W?_Czzz)E;r!-h2Z=SBFymag|>WScUE_5;TPgKE7T0kzc%Sm4`ArsshC6Q zlx)}o!Au)gzlWfs=k@mhfDgQDoW-Q}yQLG*XcqiWQ2Pc(tKF#0fa+FvCBDTMul{n6n3PRFiEmxzpn*FpI+u7N{BF$LoGG1KWN(}l((krHtFgfWfKiUY$Tv&d9e$nYo%mYJkE{AA21#lh&pZ3aA z0a8!MY(LX`JvM&WUHcMG0C+J*&kg3QjkamL;rY}XLCbl%Vwg@z*7g4^g`e<{NQkhfGt_7Ye z>-O_0a6!05czRq}@cBhtJ$e_yxhA0ln(<0ioB2MZFwRxd7tTiW51esFmP= z*8C9q%VBZA|36?A-TacP?NDc^GCN4Rm#i6;a?+?VAJ(+C^(E__*O)_Cp`w#%VCI1g zuayy9H8pH+>+sNo-a-1O|GyPH6v5$S^2OzTo8&!W_7Z*z9ITK=aXve+bM}`yFl2>` zHj9NqAnDrv58$t`=Bi7PjrHll^rJVGg#YhR)UW&c>o1Jn+5HAWM#zKXylCM*JAsol zu?g&}-cP)v<*@-XK^jEVbe+O>ke{dNA?shj1nqqVy)N|E^&9;;sSaToAE>tZ9@X6Y zvF72)Wf!6SXoWuc!J6=sD(7a=!Z3gN6+eW6X+++x{Ga*k0RrmBa$PJ}W038CC$T&K zTKW$dwPDi!z3z2RBzndjTm(HJ#e0ZE8QNy6;xKfrbo7)5@(}EUn}H^;CHhX>doPNM zzqUbfyk7^L*k+BxVO3RM-L1Z5i)>O2E8*!OPd?4iHpu!ZUyXt^SVqMTw{fOHLrK0LfaV zpnzn_N8#3;trvIcqpdTve`xgInbW_4pZ|9S{_p;~;#iBaRJt3<_w{MS0dyXE^x4{d zW=IKlI2-8)n%1t~BTup<$I|qV z4Q8NVFWUZ_=>0BF4ty^!{)RM%Iho2%`mw=!2zn=!S`&%htXJ*9)Qy3!8=ZidpDL56 z@A#rL_&pDV4}U5gef)i)@CTleppSNyoyvQ%Y2Ql+5-g^u_D0xR#mE`?nRQZ;Byd@p zSyLIqMC04^zvWO+VUh|7%os}Qvj@BQk*QZDEuc#=u4-e>gG#s{gx*KmXO_t$2A@_P)~u$txjmNw_NGO z#}Ff$kV8OS1&Q;(jyG=uZ_D{zHufy}%9c&h)crntFJ(5nQ+$w7Y~9UPXLH&l8QKyj zNdqvRDouOC`KV;@tF|owE80=P>!%`jz~?UPahz}cJI{rx7tql=UUe?=tfWKSXY@vT z3XKZCz03U4+>*X1Tg2ew6)%wxzTxTT-u5ghNuxbnPx#1ZP1_K>z@;j|==^1poj532;bRa{vGi!~g&e!~vBn4jTXf|D{PpK~#8N?EMFv zCHZyVhn@~M-`i<=deYA9Y!28(Tx5U%bCyVolqe`rqAbd?f-TwB)06CHJ^7=joUBai z=~02Am}!AY1W5n{NPr{~iLlr>Id$&7`F48W@2S4K!zCzD0BnzDwt8x+Zq>j3@tofY z|1|Nw_r336b#*nSrl#U{KPDz74)0z*UOxV>Jq`{I4)1R5<5uR8TfGjykh}Ekn7>=KVaNG<`S{O2Ze`jtU;TbRMx)U! z-M;(#`!PR1pVwRM7}w#gn78rqh2YE9)>eSUG4Z26`lAQ$de^(MA-<5qOx((V@^b!e z-{Zf8x*H4zv9q&tOXpFro1LBgya46@io-fIkGEnSexWqDxw#qN^F7}alZU@wK3+av zK3+avKK^e$UIyfskC%^^kC%^IiDgL77uOH!N5@#cIxrqCE0uF zr!Us$VJHaJyMi_j|fjOWFp0JfqYeC}u7n~VJJFmUFT zbCU2c#CQ0e<;}VsGq+*+ZK#aXd!CKI`%OnaF5YG7jq`=W9~n#W>+oG({E>O$z47~O z{NIZ|^7=xa4VP!}+?Za>yLq-$#gX3}=G|x3yR?+;==*$@x5nasc?^fc9BZ2S;uwE_ z^O4{2da5+d)i&VA#1wp0N`W&P0Z8O&5_&OBhtW+X_5Ieg&zT^q*F+I)mso2}y%c!TP#fr(y z>v$-e?>(~aIZaXlGj1OR+8)1`moMLPplp6$2IT*YqiEpCm}yqy_rBxt=ni&h?1Sj` z`Vi9&jKce={n#B0V4h;U<1mSga}OqkN9 zrudHN{5vScXgG+SQIB(&%rG_Sw-Eb;AT3YB2*ha|ljMDhIBJy&d7g-Rbt+0Fm|n)` zTaVIIC3$OSv`ZZ1;Q$Sf1c$q$m@E^2trDeLEvAWMvQ&v?YbMIxQ=XFbGZ@BBw;RKO zXD@d5M+MUkM^T-cjuPn#EY@eGLb(-4Fr#2~K;8tAN$SJ0Sl2t$mkclSYDFASA5+9* z;r2s7is+c$4*8``jjvKJ#k6f^y-opO)F-8fsrO^Ywxdi_f&?^CuT^8V)r?BDN>rrP zhX(rH=(V?Fav$0-ALPxeZ9PS!m$hjymg7N3_SnB5gynJoD@)W7ylEu4-}W?uWscR`j-mI@^nx))aLR z&{f2C2jHe1W}DCe32zf-2jHHX-iy`ctI?>}q6|$oD$Q71TZymxhI?aS{%DbbTjY2d zkpD9e^Cu(BHEZz)zVbD()dn~~x@2y^?Er$2 zK!HiXY%&2{tw3Nlx_k$-sS(I-f-r~|dw_;iEWr^=rXizC@%#HQJlfEHg6}R&y@zH& zo$`JJaLec*L`;xZfn*Xeo}x?#2fNaL#$(w1Jv9o;OUeL`$3Ea?UZwyNb5|>u6C9d= zdzrFLk&fwRaTP?wFEH+KuXZyMV0=D35#@S4N|kC%RRMM5X*L1mastbw8VzCh9W!eE z9qhztXFz$V2LOJW_ytM9Ur;L{#H?Ed$h4p=;F3QDlH~zksk=hgQ<0ja{ynC-W|IQU z(wyh+VZ8`)(>@bLcxJurk=8D8w7Y}o^w3txtDtTg70NI_JA-g273~g9D42VlE!sVybd1?s?#qF*DPOU;FTTVq#}Kra`iHrytKf^9(dF5wlBo#f|n} zJn+ctxEi zm3-1}x2eAoaqq>-@|9Rzn9q3kMh6JWc6`ToyaT*iJj}(daeT1=S(3e@4si;8fXS#p z2v#j|LQa=yM|)_600~Sv#qZL@UR3y?UWUlfNbvED40EkECX5$EE=8+lB*;zFBdOmN~ z8qq)tt(B|f1C3AZif6TQ4Q5tTFQK&oUNRbJybJh_IJ4-U$FpH{5ex&)J|Nk_N@xQpJ;Lq)$^weo-4KA0LUzXj3WihzngEb?Q8Rak3Jt*r zK;fLCp7sEP9_jToR{{AF^-yb4?$&J7DR;Hrih6SvP;W%F(E?l=Xx(UwFytN@^S&UA zR=$UovCruh7yzoc+Dx1yG|>TVbuclVfY|Ge$oo$8xmu2mt#+)eZ^iP;MyzkP(YU&R zW;Zr@*5y4P!Z-py2mg^}u`0pQ>)4vuBOM>8-R^Ur<~G`~f^vuShX8wzx>W179<;bd z3R>fWIW519qcBl$m7pO7Q3?7{(=PLD8Ua_L+@&(Vd9NU{{$+51wWwR#gZlJp9r#QQ z+Jen)t} z@wea5UZrw_FbXK>f~w4P$oCYA&(_9roO|{&asA3U=%^bbEUA^1OVn$J`atMY4@PDg z58%Pwoqlxt+tjUM_4YlczWv+3{V)CS5C8BTF?Cv%sRF3J>Yjxpved@7?(Aq%qm`xE ztk$X_3}8cWmS&o86LKwNrba5DYo05?C3+=eiHBv(g7uQE|t&}$U_a&xmu~@wa)t%=5z}!RFD^#CJzh?bCbErNzHe`MP}HK zJ|H<9K)~D!AUiu~6@p2Ej10Y>>06Eo!45z+w`zB4&&lX=y)cMYG7V5z30|{l0l`V0 zr&dG0tMw|HB}`{#2+%_V?e&~d712a6m8$i0y9@xXA*ZamLtb<*3=kfJ5gIgtV>kj- zG5-a+KH&xkl>q|6Fbaw;0;NA3M4PzV+a0th0CsB&O%br=TwB|SRn8mBE3ppnZg00^ zb7PC=>#@4Jo?*Lui(E-MP+Q$6W77x`nZKg8Pq}D(@-s>|kUm;9P-$ANTOgnEH(H^V zhwWQ{5ZWX3pk9hh%sK{tIG`s1IKkJpu12jc2xAfGCZf*t2kY*s)Sw6QFbN$@@mnz8 z1I(rXwYek5X|qbKUOflN4ftj{t-JQtHgOTYREwR7Qk*z_Hs1KA*ON~*U2{O5llq_! z+dCW3W-6{XA7cx^Q_>#uvY_krrT4~Q`4!H+?g(MmNx_zu4wgn$g`zbR3kypz&si!} zv0C(vPf@QZ0PT&~+FB>h{WyB$7;WB<^XJdS0?J9f)=c^mjOCj$bf$Yx{uu4{QtTIvovBqae=_E8fSWOXx8l`tIuE5q?e%|gTk*_ zg%T{&cPWAMLSWKQJ243ZBDr^skMH#PN>vZbMM&!Z2R3_bUVG&YPa~kxz&Mr zH}iJ_zS=%oxIo<11%dg#wcU%2jqO+mgg4QUw*cf0aqOzSnGb!(spTeY+InW0LU6SV zq6rTKJF3m9;V8lsnxQ~t$I@Q9kF=!JiYEa=L2(+uOn}m2@f+)gcF;W|kfiLMl-gmQC6j*JsH(r99PglenQ->UWNBY=a{8+w%}3?yv)*f%%ef zA=?8q9KlFQZKq2T7xxmCda|cXy$c}}zaa>HMG3}4Cj&yjGKpNFcBIczLKRtcDahLb zqMCR1k`uRnXWqipJEW;Az(9hwf?|}2Ab{#GCIe_@W*sKijLzS%9E3Wx2jK%E6#*Fr zm`5vVqP0%i@kPES0DHv;B?HtazW9(gbxeCU1{tVJ;~JEsJ5-59%+i~MV%lggQB@PxIWm6A1a9 zW=O!u>Zc7;YgdEkOi;8f?a1Z5@u?A40O1N(U1GIbHJVMp7As>4z_qFbH^I7!z|+E# zcKp^lGA~697+;aMggbsD&`ZCB*P_X9d8X?^x-xto#pk?-PQ5vNED`T+rx;s+$j<>nMLsqs=1Dh=orGEzf}~~j%A54ZPEfB39Dzk`-VQk3 zC{;Aa)ZP!Dc|T3PC{X-Y0%$F_8e>_1vrU!x|?& zQ;&7D-#P-aRzt90Nh!B|ZzE1QDu=j9I!|3pWW%}SZc zM~+s3-%u#*f0&x2eaiJHS8CDU8Ab=I=*W@9sMc#)M&r>PWLu~x6+(CtL9Wm+_1p8X zD(|R67%PTRNl=HxIAKpc+7HZ>?grkgB`NOp#U(NE+)hAaa8yH{zUR6RfgM0-YI)gX zjs_($>8{WZnxDamdw@$0i6gDlqWKd>jH?7_#S|bo zfp*FpK~AAC8p;T0sKX9%j?h4A@x<$29pCiL-w(M%yLTk4pOLvK;vhJT8tpZpHE@N<3 z!=FrTpQ|84U8Vbl1oK-EO;D>)KMs@fSy5*WfwO&!bk$}P=s**}id>>>7eHf&W?|73 zuAUKX*zI&;NVt99^Nj%9r(K7H?e_cW_tw{JSsf9h@4umoi83_+VLNGSWy^p-L9jUl zafiG;&@fp8xhwEdynEQ96ux%qb}q-bbgh+ieR6R&lg zmYQ{a_<#QVJPzx}GA6$eiI-F+s5`Q7c#!acu07j-6zeP3Vr%mn{ICv%c489xvJa;= zT_JCM%IUoUhm0j{dNVme-BG8ZIDL2DGXGufx6szNVdtfJzzW zsp?anX~jaTg@(Ksk3Muy%(om>QjZ7kJrnnxJqvI*Vz)oc`VwrcmmwOYrf}hR*L6U7 z$>$^j$$F2J+n^Ffsz)-5Mj-5Keg;I~?8x=H{B6H{AFO&PGXeHF3_Q=3T8OAseY<1x#2 z+G=6c>(rkDlsx3nK9jW!+?(G_PdXza%dKx)As|h7=ypk02!8^V6H7+4pXn&5^IHm^ zAAOf=t(DK0hUe0TVr1<4Sf<9Ok5abs9%G~*+0rmC+v-5!+9c&#r3 zbi19na^+$?|LkYt{JAIN;)SPUef4S#+ndp8Z{(;7hmP`b)`=E`jj56&4eaexRum6A z0K4ri!co`My?q?F^8vr>+`NNNwlVJSC`N=vD!K{-s2Mmf$P27^SaI zWuy`sPr(rBABBefMl8{n$v>-)Pl*Ao0PIK&LMBO=6htI1)6`Wl*6tuUjd?XDK_|6B z;?42Fc~8V<3L^J11&|t6P%@)}^29!{3D~PqJ6=;pwWCSGzU$P zQ={wkV;g2@x3_b&gW=7qK->U8)PQGdt!OryIX>A@9d;;|V7$~s%^T+WOsyVEN9Lnd ztHd1V180uME6|i@D-+S*+#n2~lFUikSw4#b!*b?5<+q-=NjHaA5lx)1eXQ&3EEVMv zK)LXrny!I_0UNGhGvWsLww^(T3$ToE^Gkn=A2f z&1?dUjwc_{;5($dPkjV*qJLa>lw}g^9kN#C%+W6h^_rt5_?@G6D3{r`ObP+fSz)RG zQwFIN*oF>WG&_ZhLfWLAtwWRK`B2x8KutW3=N4SeTUvPJxsqd#>I1=h)WlrjCN-o!8a8P3-eKL)MB{PL1`FdeU+xG&|M=1 zq;#(0u!oRGycc=84bP;1>(cR%0?-$F3VLcox9Ta;kguA`ycQCEHUE){s zEJjJFEeagAeO-YHAlG4NM{3jnS}ld5tR!w-?F@6aVSBrcb~+tRg*brIs!qqz`9?hP zs)u5hZ+Bd8fP7iE0_C`_vvW;tiuw^m1qZ>YBp^_(qQ-d7MW8r@UcN2dM=6Lbymdgl z)?HdQ2|BjJA-LEMgj2p*Va2Ek5~a)niE&zw-Wa49Lu)*?se-Z)2D>Tn^ujWoY^V@H3eX=kQ0 z|K!nkf~Np@01*25N}XC4i~d#1`a%IIv+Zo%cw`+>prl*gr;sS#WZfp+ zjvw(OL7cl3S~ePWVtw-%Va9V(&x~>yr=Y14GF_(bQ4F+rl0L0h>kwh?xwqGet?g^E zx^XSKSZSu4Ll3F1%adp#2B6MUHYeJPmz-+fxYpX>R5 z&gqfVGH$dl^e7nPixb!XnTJHKeJMZX^kRrdAKh@b2O((=S~10_i!xv(Age73tT{b8 z8BlJ z<_Uz7;k0mEKfzZ5y(1v(=(L(N)w{%JT(+%(tJmqmD1xcLZguR&$>U4$j<>%NQ?wli zq*)BpD^rVr2mszs9XSVyoo8BhQfG$ZiJXfMzZ_a4RX;+nwWGfsg~8a{lKN0y2I z6n<*QyVQ^6GYumtTu0`}x-jD|SksG6rxV-TTd}dV&AFLln1`bs-szq=1VIxLtSPV) zQyfX+EKdcEnsB4ph}LW?7O)=XW?ETZv&N^HR*p@kp>>N5`$GgIb?Uh2LxGSQw;f)h zy)>fWRv2x{F_C++Y+Ggrng0#h8E!NjA z#@6OJ;@=`;@)0z23!NUH>-lf@93Qs%opltnmgFQrSOckLaaE&$Bqcd`Lh$gVM8-n^ zSPP&aOb8Xmm?}Z6K8Gpo^-tG`njj$r^StMKfjSw4Ya!i}Wr$MEo984hNUMpA8A;|> z6;Ufw*Dy~`_He|;2(Z*AtPq$a-CDho+OC~VIgS&p*O^vo`{aib)X(CZu6JI}TABjB?1@us?_`m`5#m*z1xeJk;;T;#@u6_NFJ$ z;QO(!RH3RStv=Gu(H5ksNo!tHW41mhlj)eBLgV#Wp}Bhc+jqr#V&FULN0&{Gkl>d9 zkZqX1#0JXEZQ(X5v=8f1-*yter)dD#L&~+e*^cGq)wq7`dbF`Dx&UUEvR0|rGM2zp zsT$ShOq42h@?N!4GJcUNLDnhZ(2GJUqgKf0)%Mod1>V0aOg`ZterbOAM`o2pDW9tnvn(?9R8N+8_-)j;iTuHOwvU12f@;%A^i}Sg^|7vpu?HjrI=s3JC2`xAWocqB<{Zd z@i_ayV{!W4SH#`-JreT^Ct~P`3xHWcF*kc8`6wqlaSnI8C_xIUer#?n$BorXvAlkP zchbP^dDudC)FHr3sJW@_2!7r}*!l+b&p9h7J9M(62Lj{@>Lr5-9uB9P#I$#P2gB>{ zOz=(shxmP;J;4Roc=#=poB&XC4#9XbvR4?@YjN@p0`*=~*>i+ultO^-1yKEnvXIl7 z$Lm}i5dR2f7DO{XG_A2#C(wFz(0z{mHA^s9x&mPSK3bj{V!Bb}E6R}|$v3Hqsr~bT z8rYy$xITt`d&LJaK)c)}AA*Kj_@LX4Ctmq@yyg{;#V*>PYg#0h@ZOnt3KT)WOeo0A zn*zc^=9VcftHm{w1sE3~q5$(uu;rb36x7UgmW7WpZaxvTtgm!adC!?m;JZVRR0!!R zux_*{mY0{&!qCuG)&ONR=5`msht}40k_$KFtp`x|0cs%^M#L zmx2o`#dgY$z(idw4uF+gOEe%p^J3ne#y$Y3shFgrECumSrv(R{?C3w`L!R*fpjGSE zs!~4{c*VlPwV@?c2)9CLkIOyo#7uWX#&3?s5a5@^)w>+($z3Wark8*#&?H}ZsBNJ8TaJmFE*p+%K z5L^jjP-86K?b~su77GxUt7uKr6*MPTJHs?Zs=F3LxJnv8Kasx$=L$6}h!i?*_V8yO z09_b0K^dUS^$G+p2-@em4fX^u0eAoi4Et$X_Xb@wQ70ono}`;hL7W2!ctH38fa@9$ zPCd@G70AEqEU2M5RoQhRvOE$woMzdbl;K(yT})`>O`kUcNx`Mhxkg#*XoqTJ=1Uhy zE+r}Gpj`?YIWdI4?EC|0-~5IrVrg-n=ah+jxF&=nES#P#Fs1HB*wlCrEssK5lc@y^ z+p5sGe3T$!y#X{H=|kpy`cD1LnIl!K53V$qfl?FqNd8UW+sXIVziH{WS3q_;&K}%~ z<<*T?URjT8%WJU;IA6Q5607T5af4@9uXE3{%}oRn_|YR{rbI5bhfsmhj8mU zBa!+{@U!qGlJ?^9i7MX3wG zcC|Uf_|YLok{DG%z2=x`0*^cOJgut({mlpzha(mihuX7wEZT+~(`=NBZ_^z?7Q}8@-)q5B6evu*-EPdQjx9?gzByeF$;FH4G|%xg9@TCjj*c!2JLQ+DG%)hiLZ% zn>-={D^5i6y z5%0Hq!(2XceQOI15RDgREQX@#$A;m14keq$yj+ad{A{{e)T{(R-520V=Iwy^4*;3n z(I6HH_vph9#{RHFSQrbyNS6ZP#+p^O24!^79zn6N7!X935vCO!1X7h;uWIgsk)Uqg zP^}XTbF_$gp^U~Y0HjN#tiKdpP}dT_t+~{SIeDCi0!yGYT_^F#4r;(dedyeG4qX>p z9ol?#E4E!vgLYM;b@){cK&xke0ak?IL|cq#bG75Fn*{D6Ewxjv7q#+iCjf2&A)Z4P zsdY6)CrQ*>vxPu0ZwI4jHENWD_rvWdPZip@`QJs@37SZi6b6E|9kafpxu_F6Qe6*1 z%Zs`vQiGenZr6pF_7NPqpA?v)rtQLq38R2LAgxQqX9ex-A#4U%5B=DN);G6$(cW+x zJMBTcJJCZhPUQl@x4Y|Vc^laox4+{U_daDB#dNxv6s1L5rz=VRP?4ccDNeEY70SW^ z^|L=w2axZJ#p91~J{--NyONe}*W-=?WDhlgEwq;&%;Vhpo~9-D1DOOe*@gREIcy7N z-0TlxV|x%QTL7?t>k0T?TicH7YaKMH&A4=9Bd!71%bT6JvEI(>)wQiy;VM9{@Xd;= zkD)!SV+O00Z@3~^djOb^611W9=zk)Q=2LzoHNYGnR~g^5#eDaP=ktzi`i&;%9jGA=TaTCeU3?=zEJ($`Ko3x8^% zwPkRE$^zDRVA4f=xN7;x~JG6;{t#BtPSOhp4jdZ3p|M{%|F}`Wj;F(v^#jKbm zL0V1GBomG((@3GncOxvcrBkQkonQG?aq7&O1nZnJ$T8gM$FF_jqjB-V`K(tv<8me> z0=`&Jx|oe9EhuoaY_z*mkh5&O6IAu{+DX~o0w}vE3)|552B5mtjRByl=Bq10;8uHe zT@2}G2#s!UVnJ=`rh-P`hpmk^V65v3@D-3LhyG=K)w+rFp|7v6#B^tC)7C)h3->y$wPZ5C!1`0~l$KGyS4ma}_o6P4SY^5?tWc9$K57Rsy)H z6u|)qKSvAFgyy|#G^j}y>a6n3cMyHF(Y0FC<32z5q zaTG3>aooJh^yFVdtXtsmQX~30JHHNBI<VY1We`>e~`wDL~&=kzj zjDCo4&20qkt}YR+FVeHQ3F(oYz0ko3Yp;*uumkAsBFHCpQCP4L`kRC3qaBaXv`5gq z>s%{*bVms0Ho@+0Cwf~ev3lcNT)XsCTsildxP0zYapC#T#-;O5$M)7LnMX_Sb#sJ^ zlRorCJ8DGgvW*JMO1e_WYi&^9fc@=!+;M;`k=GiHaQ2hK#a#HMhFR!xey!P=s5h!n zsaK;)7?+pSXM6yKc^_y`dukE_8H}b`E1;>t4%BvF5dDCC7`fS3&A11_ z4I$btn$|V|-vRWuA@&VG+c0X&ZJxJ#JO_BUc(x8GZ+7~zx&a`gm1vsFz&Tj~Mo^Qp z83n6c9A6;g3CTm$fEW3zU<#Men2O$M08Hi)%K#aHCe3!@6CBi3G`-X8HX;En8CG*y zgj35So=F&wI+TY^2L%$qLlff@I~etazwtG%iIF}|n9De2bSzflQ_EAMQp1&zO_!(y z8Z}ezp-f#RKFbA+$Z&QFYVz`Zp%n^RXk-a;;l}>`iVLZHFCk* zPRpk2HP>BrtU~_xV`F0@u3o(nD{C9n`DU!GZ|2Hz?n+|ksAU0li5Fo7Fgvw7^LiL> z)=^%lH*QQ{S*6g+b}@ejCY+sQf~sZs)F(d~SFc>lak*n{Q~&z?_udz$?>a@8!a~^F zwVc2z^jo%rnXparZzti}3i-uyTjkmVFpHUzwv9k*-SGVm`7>YSIP1}S@})a!a-xi; zy&GLXec&bzLu!O`1Ujf=_; zy4x}A@x8+f*Ot+?d)epUti8>x&7@leoBa{`yq!I2rcyZ2{_aWG@3nbH-5&~$+wr*L z09lUAT`OcU#d_J9HeVF?TnZ!#5{RT}xlQkE5f&Rr0I z>HI6hB$`|4w}i>6FnPuCmXl@Tm`cr6!0v-!cEIU1*v*{~&^BQ1(T?MWAws};#54WC zYQpZ&b^#05LvhBPeF8qWBhqX7NzFTS zl%r?R#PxYw*V1Ff=iN5#sPK`xrYXCdBQyZxyHbPJd`FQigbTHvLWrWMiSO@2H%^`3 zb?76SK2}@@!S3!Ty}p|eI699ThY} zQ|%AYczbK)X%)q`4UeqHPH!1{*#S)T>+evPYP6%6($#PnesNCK-`N@{M0r;NZQQNZ`vvz!mqfFyfA1w4436G&81 z{EoQCW0lioYsl>>-y6ioEkDw+POrk?8;ugzfZufU^Gdt$6b3XXCl^ z7vs{k>u8e8aS6@t(&ekMytX%*$zV4hpS*{eUk=i3QbF1{_|woUV$^_6LwJk|yE?*yO* z^;^?Ia+S7$zo7rypgtP!=+t;I5jEefE zT&|wiAPwKmHk-M9+74hk>JL&_5ouz#c{GFiRddpa!ZPVb+AvM&)cQbpBdlxCkGs#z zlHX>viGV5*=PsHl-=pOQnlVzEZ1GjfC!Qhn1a)^^ab0OU?Q~mZJp#0o0POB=pLTEt z=8*d5&M@*!ne6oR+(v75IG97ho;`Oye)%IGiJyDl`{LjK_)o;o{@l;U(@#AU z?X3=Z+>foT?d)h$*c7YVsc{u~w%&wP>&a8I)G@pY0P|#;MO||ep4?}7`GQ|+%nA(J zhw#R^1Hy>zXJNW|fTJsNlFeZoW*j++plE9?h0LdEXL@_tG1_XPWdp)z?>-%mKJ;MRbLQ^c z{X?)eoaHly6ug`{GKTha_Mh}r(3);5+L-4GOzTOIZ`IW95$b@VBVPpNz?#?tkR4Ic z>$n?=5{)|5*R4>`O7q^L9ClnHK=$@}t@wxiJ*lrJ>!ZFqjPpLV^wOcGPC5=3^Bc>n-_*{nPIo7+ zUSGq!-HBRbCgvB8#i=uAV+p3J)|=seb!)5Zn7Vz!c2bbIrIPt9MmGo?Xk^x#!__Rm zLct7Jo^&JlQ~eOdE$jLLj8&YpWOy^wJny9SnLbLXBuGW%u1G!sQ z#%VqbP_)M($ni+Or)L!{wqA3`3N>f9Pa*RNcOQMb^Z&7$FQ30CrA`xWEL71G7% ziKHvTklr-H!sTIIa#c;ay|tM$DXl(ivDAhI<6)Qj8bEs^B0@7xD^2az8cI@<#uPwW zXvDwc<^i2NT`1@vr*9YTIu!>&Su4P)^U`=K7|@}edqXUf-2*K{H@}^rjT}ZvIUFWw zCnM!>tbeIe%jF4d(;L@sWZ#7wEOgo{)XDSF>#k$f9b{WbPmasaw!2M_I}VU-OncK` z&~PCniFU`zpl@=r z?9K6bdZ-nVnas1j=?;6^mCIxbn8??%RgMj|_g@VM%GbXv&>!TmBAFMfHS>ari*OmD zk*V3}QjpMdA_FOz$D(dvQqb}@3&38shI29fNN#N~ltj5~%B_6k< z0w9;B$uF9EA3=XJFWzp)9R|p9OTjQ6HtdU_SAggET@pR_1w)SkN-f|;zoFk2=Zj(T zH-sT)7SsJJ$VlM?J$Qo|(s1v7I^W~WS+$HThM(F^>v&MjZz({<<<-|(Mx zuCKCaE1wy-$PcxVb$=LJ4y)6b?=B@X?hxK;a<+0OaCZPvleA5eE{ZS6k9AqJeOdw8 zek8;{rJH#a+zi`X|C036R;%fU`A>s>O_t)#V}RppFNn;=~Twl(jK zFNdh9Ig-qDMe8PFe!fW_seZNFQJdV2C<}CO(B~XL54{+4Hlw|HBl_)iK)Fqu@f;z; zO|C(_vA!DpPB-hVq&5q^rC>wro#eh!H4S~nS|+xSlTj3=mU{=GJw-cpV|n>%EMLDI zt1H)02uOply2(@y`u$D}?8v5UGqbbNnrZUA)6m_mMm|AV+3jEfARrvK%vn_E?Rnf` zfJ{?D=q~`L%mZR>>w<`T)jB9xDem?wOGQX?3q&uG=g&qAHj?CC<0(beUXk@y}vDMVO1Oo z4(ps3gxa%7vD1_F#StNrQ!bo_HB z;D_XuDoo9@Vn<)CYAN!23**(S>zB3-)Izf)fV0CLEw64Sg`MSHI({^cEX)A*e7=MA zGwjk%YccF{_Lk9x*Ll7fgYHW7x0eCi6@GU}e<#XQdw{F-paAcuFmUR&)a-D|^!Zyq z2_|=dXMQbk=8*Pv+&WfKzqcLdpMN@@efm>z@!a#|)xn~KAr9NY8KX{J zH^Jklj_2mOosOF*=<*`1Q3q}LMs&7rM6bQfH_+i>8n@$d#{qHzs;5NHG1hp;K<)eD zEZ%#(_)LN;fVemcP8e&n$w!BPG6wSWi~5e!i5n848lFmpj3`mcSTfiiuZsyQ{FWm~ zXGCCU&bgmojyZ<$bNyTy+kXJvpwo|5y&m`8eNTMq6TcoGLt{M$6C9bFiFdsH&9Mkj zyGydWm^ePT?@*}juozZ1a3P$+Wgz&0b$PXH=5KC(K29Dx7K<=Cwl$zJg?Sxu;>1Fn zIdhye942-U58QiK96vT6M~}=wRJ*acu@a9wcz-nN>1rUU9LG#~ z1X;b>j&Uxgju-WjzT^B&9r0c-W_rI9CMJ|Ccn(wxZ<*lOiYeSlw25s* znuYdBTk-u6!J$ipMxp$Ur!FQYD9qIU3g2pxZnnF$qo&MhnLG+`vTadQX)FENo{nH} zr|sO*i+m|a6%_UnXtGN~&brfoZ~D4U9F3FXzp-=#{M1JIdyQ zL?ys*Vh_!;w-v+fmFTQriO%W;!0ifJ@fARMmAbw3;l8 z0!-oT=#dJNWU4$F?ao%T(a_bj``xX$a{0M<_L)y}eHNvnpLKt`9yaeCbQBF)XfFkW z{s!>m{)OL$rr|w3ypG?E@6+4{Xwn4Z+0af9{lSEhk$skFK)pLd!lz~`0HP`RErgpI zFo#;Qz?d2c&!JTs8DYtr_j@t+;miQZi3}dpq9! z@BfducJ&IH>RoZq*?WqK55%?WP$lw|K2#Wr?2=ctp{bmumz|l;$TA#^vIxjNbpNS% z~Of#PXZ@NWj3(G2y$;i1%-lSXUW0(>~ZJnYfNaqye{4Kbt$#Pn!ymJ(V9c`(3 z3rxi4I}e*qcaT4AHy;S535KL8AX@LP_O{)1oGk!m`)V-|x8ReVX{2pk8HLvz|1GE! zhi-}@uciq*k!D&x{IV0(ckXxCAGqUk58>2{{;2367P+&NRRBi&EjBXHO_GR9K8eme z7*^3DQE*MaH*u#Tp%}7Eym9o0`ws5*0l;A|cD6QRZ?GBV{a(~!5T(6#9E{dta<5CB z^+-$iMK4_f2f8sP0m|uv(1-3OtqK8!g~Hq=SsmSDKHcR*i>TA@(yr2emDFv!3g0_q zZ7Rpzr$7O5b)QYpPGzk}>U-({!A4lecss>^IJBOrt7M1$7>xSVx&CD82QYVu*FkTS zZ@U!RA$JAO+>XZ`2FTL60O=io0265ESB|jo zTbYh$#wC*&20qH)0!0o%OS8Y|Tr)m6A(^q5$8R|E!0$W(S+AgQf(M`?3FZcyJ%DXU z+D<9~fO@@RarFZio&k+!W@qB)!qJ$SnaOm|J^vi0X&a!d#=>kX>eUjAA{N;5Pa33c zhnX`F-J)~{fN^aFC$Bg>%0<+j;pH~$M;6eQPacbpvM)7VpAl;2a= z1a(9B5llM-n|Am?wZ0&@)Y2qm>)m6l4UaW_N2F+V2(TI4d!8#)^}p&TZLe)ae{-AP zg*!*VY5c`?H?=os^JNDwf6{{g=N^6@q?hBud0~HndGN>B($f9o`Vynv$>{g@(8i15 zVmXdnHIZ=Y^X^P-+&N6pLYjY`3)qPo z657*h5gbzx6QjfAq~F{h&_CiV)*AsTr^``sN9bvHFemCs@=80ksi!{esVlRm* z%t-|uEo*t9q$0;zEtH5jO-mrJ*okL56UIgIQ(#()R8fuwG5o%(DbB^*;@N1;pN{&> z$(TKIGL9ZQ9kUC^VVjpHhTKMnO>Pgmoe~c5LMv0N0Q6Kxra%^lEy)tu`wKWHW5_sE zmHZ*?7v{a7zz?V@{laQ_0EvsmB!3W}3{|k1{$ZJlJBV3RFn8q81ce%9B!QeSi4*e; z05MIEG>;+J^m_szYOgN#BN*#)P!ME?AOzlM)`@GF8rI^%Vm$D`Lpfyc%B9Pq7aC+g z$EwzA)%>o{y8)(T56#tCP{s0`fF6KXEP4arcl!V^zx~1|`pwTATN#}2$gB70Eb{o?I!rb4;(hgudclU?$t z+axt`ts}wI^u&CgyJHDI0W?g1Xh=M$;aSP1LKvU2B6CGeEx9S?(a zJrI4=h5Jq`q#Ui8Q?Ypb!I)XRKaL!GFy@x-i{p1a7>h^mh7KL}XJKy7;|>Gl;wT8x z6T*?0APUEE`b;v?4=2Ict6VPE(2nYynqm+tgf9{6@2l0CfH;f>7v%&406qPRFs{s` zY3nHyJEgi@t>myZ!>DN$v-JoAAP)iZ$4|uU{6cJ?^{uS0$BpGR*?{s?a`y|D{&a=64konPz6-Lu0J~xO zeN9vu4{Zy^?{tT`ZmoV$v0rp+0KhILUZsBO)q2#?9;*O-8KxGxb*1#S(L6Uhv9Y|7 zBSF6Ho4+;gz2}~|1}M95yKVtjQB#}pxB0MB&2i5(37}W3*ReCwGnsQF00zl)%ygE^cf4p6hW|5^WCEktxM}S;~|XC1wq{kYNNtR z&bZ^B@tD{Cz}aiiOukd+6ejrJcH+6S4bv@Aq?YLlMhQqf61>%}ZM)nU721)8q=mw5 zLcE$XHn21xc-pwst=h6_Nk7u5zGc^;c81%+Tr1{Vv(Z90o3?^KM`u`m>P>&N7K7G@ zX{nSLcM1;Ua3ajKb)*GG8E7BFN_+APMa_I2ASj&3lh3Uh>D@eYA~FG3XShlWrzm+qq<7m&}wY~UUPEEd{pbR&}l#OeY+la93b124az6MFBGmbt8@DT)n%1xiMCjHEH1+zz3lg$O#?`2q82 z0xm2p#IfT?0L^wX-|S2)jx8NcP&t480!&&%t8K=Wix=b6$x|^me>8!#)@bEeQvI{; zCFiaoPKj19$QrrY8DQOYp&2x~t?hPBoz4*&oOVv>1D>7&giBQz6{};P@}Ytb+Jju= z#-8|tor&03Z^zXu%M@ZNzT-Q-lXwtx@9Pb7}!bEoNus zIAj2>a1A*XTmPg`r&TkZ8ofRC0<*qbHSFn10}7`lsdFbQ2x4Qflkf|W1sM3&xWtSE zRRB&mk;mBOP(XkHSGWptg*#7z19QYr`sA(G!>sT3Gk^7(>zrs}6Nlf~IY%5N>0_LK zQ!*$FBfT2lU3VBxa{bo?rhOsn*~rR?F2c} z&%O>po$!JsDl6?*qqx)`*1-YRL3SKcqI9vL?T&V_qI%oZJA!+!j|I|AV6G$drE7a$ zlU7NdTxA`NEerE(zEm{awOkl3Ocd(Y^)50r`8OUO?dn>gUR(mzS$w5RD@H>tqAG${ zIzV95=3Z!%+wr)g02y*fjbZ`qVII?a0ic>~09c%J^;)#hV4G+eb9LV5vuZTUm{0)V zEX*~-?-{hf*@n*nZkVSALpa2%&b0yK8&5@zg>-Zn3h0h0l-6m?TR1akYO$x0Lrq#+2^wOwK-~yUcgQOn0Bz%cT9J$^| zexrB;_^3<2&wURQwbb~E`d8EACeQpne-k0$v-8Z(N4}fXGUBSHo0A~Oq)WG|xvMp* zMLG$iR#gz2OSOOUN&XbV6=-d`ELdAOfr~3~<37e(9D=KBTIXU_ z>8el|LKA?qlUNG>x$RE0oYsE2+GtSo?D{39OVi|$E<*BDbeQV%F6zk@7Zm_@96J76 zOR|K5qL8MP@J=HpO1dhh!^Nr;s<-Q59o|ugnnaqWRYxnT zaO&R`tc$6q5EjIr>*`9i(l@7Cn!U~Hi28>i-@|(}Gr)F)sp!(7RWw||NTzk7$fXOH z^Y@jjSHh7N4?FCvT8^W0bL6EQ&pi2=v;>@?rH@fC(jQqWSChzPCVl1uffy}NFf4q@ z`e7#k*ioAQt_$obDC-MNtr=C(9X7a)O*G`IH&$b#JB&|1{an1~y}uM6`p8G)ne&(8 z>F3X-OF=!={n3hX*l53`lY0SD7C|99?x+$wp5*cLo91)1H$j;5klWSR#%qH(j4Y=# zQ>oP|@e@P&v!e zaWnwhym1t>+$PeE;DS)LSDO5Qm@Y08^}TK>ws-d z%@>AoYHSNh?b#Guc`q=}%?Q#Jv|~WI0T2V&GtF|$r}0x1Broj2(+AwMNrK=4d}CXB1Gr8W%!@43?knJzkSIAuV-OU8!q zcL7#AT+&=6-Sw@_)Y3M$I&tp#=W{)VV@Hm}m%ig|@x~`!m!ljsAC22iEcr;kp_)rB zE~FMB)e91smPVTZ4B+JSY5`iUnBOjo+3C5)hhV%1Gj(I5-9t&9j>TgqVhZNoYIoun zfBB_0-M^o)0wBSnx;xM%1(P?`tJe4y9ZufVGYd_ z0It*)u(0OIUm02~CEeK>DIL(vl%p82;TY^x7yx6pUs6kUnsvLgP5RETEAnWCnr}x_ zFyvN!M}y{cU7(y0AIsA%Vi#62;Cc1 zzLPmLr)&CV)6CW1T@b3BC2EaMT1Y>gpg}7-#<;D)yj5wy;8b5q)hS|Toe z-V@o`nr1ukS-*Bx7M)>5JD9EXUhzbYuyAW}l84NX!i1mRXMT7qU6?2H+?<<_YNHkV zQ)tHe=BMkiH`R=Z@=TQKN21z1n#0Iiv&Xp3BlxSd z3OrpsO18Xrw2nL{FL@KGELsSnCUIi-Vo zrJnU|z3Dr5xSTv{=d~TZDhjGNxAP%w+<6BL?5K)T5;p{7TQm{B6xZcnyI{#z2|_aE{Z8sgEB;1LnYR?>w3CXeTiz( zPJvfx0qfm}$}k7y#sAX9>(xfX7ZK=S?|Q^ttnwqB*+| zuX)3pqTGNXVa`neRZu#2@k(4@-7LU^?{YR3%q$wp+%i;lT)|u(GQHZ8Cb=NgRm)DG zi^81&e;8Cjn$Pk;-j9ZU$rhl%0+Z!d{X6mO2Bi? zVl^>)_w`x&%@~XerZ;Cc5SqLK1oPaT!w2xOTWr}8*+)q9;o&Y?YlnOf0IhWS@NN3- z)iQ~}vg(@94Pg8pq>$zD5Cn4=9)JGJ(IEhQzdJynXl6TM!nW2GKv}61zobU9PIE{l zM~<|?BFp%Q+p;MDOw+KQxpoL`43a^I#fXChYmOqEz-${K1YP_`z~-M5Zq&Hl^=70% z*a!Fkz=={bW*3e{bK!WjILoy~%>S9(SXX0W2QVJ)^#MG6-&<(>Ta*XdATD>!G2U^X zg@B)eio)5>3W2m9C{KWxO+eeZ*D_P&Q>ap_d%d9*Vi+ztwf zBbCtDsWV*^GcyZ0A*n~57J$DOYpcuAX}3uaUPRN*4#C^_xZ?m>!WU5OV6o8;*$+Zf zC$X1V#-QB+6rbc={S3u-fGbo<7|kyp@IHs@2&#IjV!-jv;nk(I}hw;05Uj48>3{6r`*d{l|_d z(3Ex(giNUBJV4{Uc;Rwfy?Q-XSJ(L6i@EuQ9EG7EQ_FEpThlB$kJJ(|@pW4q{!TMo zFyvHQOCLJ=e`AsgTrNqUM)tQd2hDI4v*1 zi%4=<-C=&RlS}Zn9rDcL@|}5;=JfH^g7zcYOL z*ZIcsNz}6oN8+y2XXEr;_eN`ez9@&|l;Hv_4bkY@5 z^fORLQ&~P&MF5v^mFL>Q9rY z97^Oqas+|U1O>Gd$c1>MU;h(;GDQehaJKV}nE5S`Y3A!^Oqfmz%X9Bd^np?nMU*3odm#@Z!YuDn&#(F&Y{Bv;)jiXd8p$SRo zebPrOBdckWS}(+-FmWV-d2ukm&)kY?Z@3#fXoWjyG2jg13oXmM!-Q_#e)-x;T)n;# z*RL$cpxsBaZ^Ua}^_qCw+ujyWy#9?b%%uzjH$JqE(46-Kcj9#_xcOHPw6--}<$Oh$ z<@T_C9ns)SMmslCyN0oKIoKX9E9#_$9^mWnGuWtpMDLHHi^}<3k|qE|1?TKqmETI7c-nCtTE{l@j>~@_0j6TetwMl;Q5)Z`q6pl>xv_K-LM2&DQH=~>C9kv;awG-jmGbkfB2hA&g&A+VaR z@d)5aeVo4Yxp6oqce}d{C?-Ns2EK#ZrvX|C*Xg(}`fYFZ)O0m_|3CZGQ}MA+{93eH zGcc!NT}qo;#7H=hSk_mMg1KPPO?Cn!9H3?w-QddM+#+HEeypw!KX6 zK5n2GZ3Yy&^96xS#|9`gdP+)IHCkKDb{wGzs=*bm75f~@nBvqu+8-2=?JM~R^3nnd zVKkey?A&uhf$~^j1K27D`t4H@(1{Kp?sN6M^k#ccRRB2XEwxa>7uF5!UADdJxj4^( z>rqsvqcvNJS`*<+nt7&=4q)zYM|<`#|MZd&CUecLW7nPy?CFD zEJss)sc}g(sS!x<5LBMBAYg$e=h#Y#)e)tnl#!U2WXMV16Z@PTS}VZayR5FQr?1{PR0;^1f?23GA130s=yDBVSTE znXy&J+$*AQ-(y^pcg_JZ3o>eh**QhSPeY|LwO|J}p!E69FcJk|=sUo{@S0wl=-xw> zNjQRWc5G0aGDyZFaiSUIluOe5UGD(mUEW->I?Y_h`mm`A2poPYKf) z^*8F9BYl9(ZQmVfq2@(y5^Nk6w+8?uaGN*X4}{OHc>pa5TUQ7fMz9p&1~7*cJbFXS zeSN`#v)U=;cbgs4(zRg$E$@^*O3LIY38F}#bk^Uo6HBpld?9A%W~kHYc;zcz8Gr1% zzBBH*_n!E~Cq7C1Ju;|(10=0yPI+2EW;OX=A&iRh>YrEO?KlE}au-v7c}{vVbm8yz z#F_yBbzkT<5IoeS9VDfmg^blIPsX;wRrb`tvJZiH9cybxlUot(b8mblJ`$+yT(q~J zmII9K&~shlgQx>=3IK(pz^jn69BO$2@_{3EY!ve3X*pAPe{&70@-hoq{0k~Z(0?dE1M?L{& zM+a348XXMU05M@H%dqRvJ-`@RYPZ|5vA!AYoF?C+{8|pK5?>B48@^7+r^_0ol>;<=}v%#{Eur3z_n#PiQTm!mpd zAnQ5quU@;F{2=`o0*y$MOROX{aw{^EyDbk(d*>a8fF>waDm9qIY7qMDbU_;wcx`l^ zr~3e2kqX9iAb6*1z#jq#m()}Uucqo63lf!`fNC-cyqu;f@untx7&gBn0dpY0jI}%U zjslblV9s#nFp;YOnLdm(rMBp73_-z2OxGO27?5x>Y?|YqeB;Ch7t7g&flWg&bta%1 z>JT6s0)E|5Kc`8n^$HP|+~H4}>P2adyKv!bY;MHz@{MSBHUW<5IJ!8W+vWFQy31EC z(tS>@7^YhRNw>N>>AQ2yRn%_5o0r+>gOWH(83^)Cws&?ZVS& z&NY+X1S5w#W``L^v6xRG&~?>ZyN-r=Vd z4xI8nStZ|1+OUO&JqvixMu~HOs>QcXv9D34THf#OR%xvodE;IsBWY9e2f(30w}9GM zUx^FPJ{1?Adj?=W7uT;`j4RhJ#M;_Q(x{p1A`F~np6iE@N5?nY;hr-9%{=i|YqjJd zdBb{hy_h1k+w++Cu^;=fgYWvT?}|B0+As95(j+cHhLE09pm$w!fSBDn{_U@QZPe?!9|SKo z3W*jWLegsZlCP$^&jsfWW}?%Udn3o6YJv+C3Jd*oSPGQaZ*+syD^<+uMwY>6HQgQg z3jnw5u3o$z7cO3nvkyHKed7PQ54=Bi&@^3tL!ea{ zNF{=l!l}@j0Ugd_#Xa6>>T^xSmP*LcD3nRf)Xqx_Iaw~{b1i@pCased^d&o1+HVzp zn%D03+`u}hH>z1SHAm|<+vLz!U*dUA=J2ILli$;*xw!!>AZvWOWk#H?xYz5@7PL_V z0p!jo?p5bjND~4p^`q9iHv|Z^I8uAHj3!K5OJAfdnA$mJygSr=WpODcYOUCru0*Nc zOgE3^m!||&rx2?_Kl$rV(*8RMp8D@+jx5Btz3UIgCRda6EZoGF?J8{pR*&^r64`nY*p! zJQcb}7iR(8%klJ6pCAqZ)=o<61>R8G-aDwqsZ;mInY$kZps%JtKXdjpZ8k)pT%{go zVs`dOUbnkl+OwY>rS48rt~3Dm=i~Q&Dgw|mp2B^g z)>beF@eemX>roFkd8<*Eeq%=`xMLr?Xct87sFyiNVnfETokQVOg3g?mwGFe z>*PfR7>7Vb8BC{Ko{3s>E}Bh;z)_~;Ip~4{>NawON_Mo85mf_S zFxI6Rt5zFv?dpa2JzszSZ41a#-~R32{+HhU?sumK@r52{%HviAWHnnimwfdDC(u|O zT1H+a1@bN6n0@uCJS9qh^UyE}Rxq7m>|n`{InosYvE(TD~nuC8GbOhsj89?hD1tktPcOk@~z zlGACv-j`rFpHH9-P4K%|x7rOw`3*=;m+GK}{_7I)2p(LiD?P>v8F$3?>NM=pj%}ig z2$P-maW-LZp!>izH1=YvyMwi$|J99x|s@Ajh0ZwHbLse>KLZ9js2 z2wshIhnJ;NBPzKJYa@nxrRZ`F4lwbf8bA%@XvSo9CJtO6hwHQ(gI1c9waIra?x_PU z4~HwlgS(V-50G@>A4j;TSt=m2J){FIB>?{#TCRK1Rf)qsfu$37#VcR^)~HwKsgdcJ zYc0mY{8G%e7NSD^77NZh`eP=VE!qbS)MaG_VwbwiNf&zxER+NaYaKe1(2*`$i^Xm# zC?&MLf?*5IR;9t^R}1HE_-fch!|!74SixDM_PLsJ z(Ti_~R8QZn;A&k#X##q#&p^BmElV&y1WVIRZQTwm;_LN0gxib1@z?%R%m8$bC$?97 zW#vXJU%MX9JpB|fP-ud?yRHjh$Ci4ATB>-~=b;h>GhsR-y|i=>v2mfy`e*Yl7=B z-wP90lihv&oNO@LaQ{3t!YROKhwrZgnp2pqGt?`E0+B)fVRd5!$XAt6RhP)YIn^bW4tKAdU+4?wTUyD&J3*qE@9G#6C^_ z9fcM2}cj)4%rV=u)TC?OzkGu9?7xv)Q6L96vR10kY{_2`PD79ucl0XNuaP!#&v9(YWDy& zzgx4-r~|mYK|5Agu4Owl>hlGdPq+(pEn4#k=Ms6Gz}kRzrzm7D3`HzjfkZ?63R9n3 zEMlh}vv5v$3Tq6_{1!Uo^Dl;me1`(^Ytm%T zh0w{fKv00@E)43>8u&yl7}Zk$tL3q>1v=;HzX+BPkLwZSeE|~5sE0tGnlaCI4j^!z zNs#VtQ4ptu2{ZtDFNEbr5SRZjsnu{7mQT)Vy;Z+Ytz@t6PK|5IGJcrms+n=pPE z;+)Hg4O{E$@zk$>HZDB>9K;JlVulMi6QrHPtH{6FnCnhBy2RDl*0(U3^%r`YCcu~@ zP^g1knGQ2oU+M(FqHnbf0eq8fI|Atjf?-%@6S~_*xMUYuE|(DG7lIx0lB%Dooi%gplR08 zh$m?$M_|mi=He*Y-`->+&Rt!P4}A1VfO{^>T)GTC{p(M1ouJNVXt$|2e*EtEJ-`3I z$z3(v%+?7NPPow%V|z)f34%$x0;1q3{aFLnv7pNh<#(8-zWoGHYYL%TsnebfT}}t^ zQ8(6>uZHWKH0wtbvbA8;d}rpc2530HSBN=L2ck-MnQ1F8P1i#O#f68G0SIp+J9gi; za1Tm<%ZKC6P<_-_ubz)T^~c@;UM*%Ex61Lw0_3Fb&o`2r591i0x9XARzl^I^t45{9 z1#uMH2LXl<=V*T?XJJV=YNfd{71#WeKm`!~az8hbyd_8-#Fu=@J9F%&jo$(cidEJ6(dq2~ z9>?OXU;1V7m0$Y}asNY)#sOMer;qWBc_*{z@3d#%5eF{AnahXHRADri^7OP*Z#p$& zQ-^iQuk~R5iaLW=Fzp3!%7$6%YHzN1ru$-Js}oz@UUWv7xB%~Z7a%Ilpk243-Jghd z*YzbzG2E>H%$4YmN(h6=e7@D*kByElgS}|`Y%m?0qp4``O!K=GoxO7OcgxZB_h2e| zeoI`P{$%uaOIRG`817d&xgL~bccK=fi7IXBwN6{>?x@G^B%tD6aG2^KUjE)iyVFH7 z!Lx}9COld%YHnIHqO=0avQAD^0M;7yKa7>NHUR3FVCsm*QZNYfG1Y*ErYU1By2C0O z?{sv?*XF1k>z%2%v3?L2ZtTSQYlFD5u^)Z%J273ynplWhYrX(aKwRJx936S0Fi)XH z^bVhd(sJzwefyA3OruTKrzs}_)**aDr-}Fad=FGgSV=>~!Kn*PVNeKYHPM339F8Xd zipyRVUIO=|ZUr<`*C?KVKKeU-gt42o4u~FLM|k8CUC=R53f}0<)8N1NcUYqiCy0MEAg%)K7Z^U$|Jw7jowC6$mIby<7CuKjoQ|Js=h}CrL($%xef!B1G$gaMXB(%rV$1 zXw(G!ElBy^PC2|3Ayp?hNP(lYxGj{#UFiCch$uvA0YkhuX$a({;h9|BTL5t zG$(NseoweR^C0lrK~_hLt)Y3ieug7V+}R|VNM=%K2}sJ2tP?w|3dXXIv?hF}7UR0e zu71|*E5!6K0}jOFqz`B1RjQcQhvl>0ZIA5ilIhXFZ5Q1t#gtvr^u2eyvu-_73(jXn zJ7gOX-;2rsk8LNvMvE&*gIh)eOmZqEJNq>72!9iP4 z?~VDnXe}Oza!FKf<_5Nox#la*B2BYo zl_vON2@au&UI&_RT=T|ObR6TnwgupB#Mat6APnekwK=x|;O#jt=v<8p6P=n4OLvn8&6=aY3kWX*eLB{)P;WBwZk!+)9J1d)OOJ3N;Nb< zxa!*423lJ=&OZ1^yzR@rGT!vIcRED?&2ku1fUw}~usgx7OkQhf*)!zLB|#fyOw$VY z&Doe~%wl3U0m>=_WAD1z7E~Puh9(J+mz}PQxjJ$!;GN0n?oP(#8(V0)J7~+habsgU zmeGD(AdU4i8?gQExg=xK))@oNsDj}uLEqQ87EcfK5-bD8|@0t2a`VMJ;nDl zk+cS(<)TjkP=p@c`NS&PgYFIx0K4ud2rz3yWv!8>TJ}CX)7=DcY4gpsO*Gz3>TZ)d z1durg-9hZYbFPW94`3favwI^H7h1(9f(?u?$*hS07w0Gv)koz69A-CIiCYsu4uZLNsDUR9X zqU)|4CScq9+(rA`c7Qu(yqkeyT_$+j1Fsvp=w$LN@*&Wabq_QEX#KAMZ|(#w7!%Cd zW@;zyE+YN8>+s^y`FP-gd*X>FUYS~x`El)n*}3^x2kczYY#K0iD)Jh_=E$)Vu};39 zJbyXr^GnfKT#9e}w%-%)_^PjuEwsI|9dKx@xsx=2?6&W&z0lyfJ8@~b9p|rZ#IqM} z#O152p-a%MqL3oVYYDiha5rB)#sIAQ$NEwul32&U>a!f#!oAN8|I%~Z-rkRieSD0= zjE{`Z-&{5C3;#9Y5VmTYIfD`FZwo+aqY=9Zy@EV_?wkjJsv5o%T;^M)xcvOD#j77& zir2sLSbW>>cvHOowWngX4siEZVyC+bp!K2zsMv|;m}!x-T&tv8AlC~~;FAHfq_`K0 zfo}>6c%i;q6i3wb`?NU(B7kW@b$e~-O^_U+l>?Of#62bvex zN4@qScSPTVzb2ru2`r}E+s}K|aKV>5Z87^PY#rYy>?aUbhF69N^wxui@$0kqnW1mj z<3&onLkQ?FUOh!c#kOErVU& zIXp;kciBLPUOC|;*IWR!U64nr%2>JDlke^b`t|H(cZ#lCD!CMAF-y?ROTD5Ia21@- z+p);$&LXpO5|-B|AocX4tW2l7|{;0uA(m;+uX@ zz)(xcgq)1BV@EJ;zt5S=Pa-e{r}891zP%j3>+8NGmS!Rrnpj!A^YPH#t@x^UzB<0{ z%U>6-d;C}b#1?0#>zWi>gm;oiF%4XB*A1ad!n(9}q$h>FBSCZ&SYx4V+Yz{VDPm z-}t}6C)>_ZFhr!LZl|Inaa^{vnD$OPn8+*yDu(a^Yav#s1Fy-|nYbP1pxx}%4h zs%s2X(OPn-62NfiQH3cWD(%>GGRjC2P_hZ2iiX6iX$VsQPsyL;2yu>|LAWkPUjcB- z)VlYYv1JI%ov%I1#8={-t7GXG(Zqc8(TC#fJ!hlVYQ)0gV*JRD{U7l?|MGj|{qO(9 zc<;}@KR)=u55?t6m*cKecSUPvK37(20oZD9TbtW4zi>3i3VZHM*crAP_dWDzJn`nY zMY)BkTvJ=FMHMi1Y-jEutzbCxGuL!qwC2%<7h-k+ZFznH=ADjJ1i*!>*JEw7jaH0V zigj>sP|A+79p3j8OfnQN??F~>kT2E_3-!O~L(HT-W8ju-wa?r%EA zU_1VP9DW>^r|J8A4ASE(GMOlgPE>&-L67=yl|HSjoE*fnVx42nZG`E>4(+!eGnL8M zSiKbM%NJtf#<^&(U5V}W3o+cf7;}w5yy>;~#9LnfKvXB&w0{q4WDlW7KCKthbN6d$ zO7q`Jn$o)B%>0w4hZdKkNTjaAQb8}oA>EMo;iyadxOo9p?+8Yl0NN@+bcGuX%7nht zYT!Eo(DB~7lgL3FC=3ZVrIG?~xM-0>1RX)-=pp^XlZ3B8H#wA&1Z>gN=8aR3wa&;H zzj$wT`re{Y-_W)`Z1ZJ+Th1z ztA6XIshIz0A2rfw0P1e>H&)j`F?tkF^ zWD2SFS3df&`1r3s8PA_PA0PO@FU3#%)X&C`0nmTvZ~y)HYk&Q3$0tAe$$0gvUjuWw z1msLC9yx|)q~<;ZCu{L*pZZKJZ*RxeU=Wj(g)=z4svd#^7&$Ir)C({NUtj}GxU zEgh#2>yEOFuIy&Vso`^U435v9NE_}VVD%Uj?WxGHjnkQ8 zPV!p?g#cPK33bE&;%)vk17pEK`E*g`Du@8FL+~t2&Pb&m($_t?mu1-BAEtnDC?etp z;o!LJ!wR_#531)*JJ43$OAl!~ty>`JL|+}Sgr?%$FE=6uBe}vXw7puZ+bX&Jk^nx7 zHkrT;h_`A}fHr{J@C0m|C7w+K%r3E5A}sfWaSJhl*{zub-x)NLS>pmI=K#REzFg9n zYc}JaGpFO7?|56>i)JhZJ6`%Hf95^$(?9$3vEAtbmaV8YX5++(lbDWZwtWBWGtb4} z{X2g@{)a#N-^aCU*WxJJw5)pa#EDosb{tUNiPQI7TLHY9a8}a%#y(PZx z8-HiaEgpsNCt~UN(HxULHwy^Q%~DQxOs>ZQnznw_cmKpsr4M<3LVsf^_5fdN%~1yF zdXPocbdvdDP@Y?cG4K{60ASvioNB0kKL*HTW4I<<8#{p2lARGa0kAsqP7tIP z$XB7+3c^}2mci0H@uQZ*8p%0v>Xz`VpeR`VYOlHnc*t+!0Z{wHQMevQ_Ho!TNqH5f z1Kn?w$xdkVVt!oc9nbz%i+`c9ItqzF6 zwG`~}mNpZN3uEoY-P$83)Tom4u@OY+=vSoufa^E zSYBPvT|l~hcNli`h1z{RjvQIY*>X=m{Z#zVf8j62U;pcW4XwQvL&7y0tvC)audQvx z!jYw%u6*vorEt*F(`eh+v+?!c_&ef}#~wrLIRN0@CJG?VYc*P}7U>P+-9P@5xrt`Z z{-O$s0sdKOUl<(e18SmXKS%4B2k!N^7M29cgt7!cbOcZC*vwUzi{;V9P;AX) zJr(g-1^Q}%O~Bt0(f)w3>t8tjIX5!!J;KL0=CG8UC6`mSrz9m5;u$LG2x z%#&lO{aqxMYBtYkFK9a#SaPY*QIE5W;(&$G--;gB!Eh_OgAD{k2fFMdM7F7;0eSqb z+xfrrUGqEr;AB%JI@#`P^c>MW4_vhoIANd%}Rg2k~ zg*bEi44|UvM+RWp%akZ& z+0BQtz|&(4*1su^m;4?d-j4;q_()LUd9kFW0-AQ^y=BU9`P`Fx{yBT@0L@mwu{oXf zn2RZK?{sJP7aa6PvAxlcN@+GW*1GYrk9;E9Tbt2suc0|#jC<}r9&dZg8*@!!)3$~b z_Rr3;v(>aHmcv2?McW^(~LJW4nKdB4hAE5kMw z=sgi+$px8JPH01cSTgsrCNz0On>FN8h1aod%bA!{wu!jYoawj1GDb( zO+8-s`X|W42F&8HuO1~-19SK6V%Q#)Q~>i~`HO>Ep>hS*@nQact78nP35*=cbcd(+ z3CxH086uMs{EPT)qj4NQyBTovoBv4K#o>Fy9j42@onYg5(ywd$1S>{;c=fyes5h`s zXcJ(PI+#i@>;bYHn}Q1eX4Y+gpcbfmKw(ds z)*p!_?FhzsHGhTGV$u%VD$k*QEk3L_ zmm4irpqtthmQ*cfnrO%R*Pv0;u{x|9$D9kwrteCKdpov;l~B;NI<{@CHJP2=SdXq* z4eG|uE_5?!qeyg6HrmkIMs$0dG2BH99`PJN-U~G3gJJA&x?abWc|ZZ50)VILrKrr* zqCVe>QbWriGj&@Y1;yS;N5MsT+{~ojr|HJ&V}B=Gs2w2n9cwDlJ5DlZ@`2|sR3Bly z*Ox}X{GID#K#w`46it$dp-p{p`U?4trtK8eD9O;Zxc{O1qu#7xqB--b63fdQ@xc#$ zG~7YjJ@6a>F&yce?1lS~9X+}jGc&EYdhL2V`|NX>4F!v4X?E~TyW&Aphcj z|7Y>UYhOvZ2b^dwJD8cfj^&1d_;W4gvU?i?=c3@o74B(o8ue*zBwMxarki@9)^AKUYy#^1(&Auxe8DSCM}7Rr|#x=EgG{Y zQEz7upv@eu(43u(8!KyZeR(~Ba(#U}H-ps&?cReQ`N*%v5`sIrCHcqE_8&FgsBXDm-@zc%As&>Yx09YUNT53#%24ri;(l;^^W+ zy2ehOIu-ZccZTay96Nd>*XyXH1}cbBC+-U3tUCbSKq0?f7to+ zS6bC5yU76bTjg09{+Q4oj@9Pk|NjvZ`Y-;t^8gu*0!q)@WKx*vP|+=h)G&Njn2v{^3d4stYE7PciZ#=Xmxv8VV1w-HFUy`}h#f*6LBRD^BOZ9<{-~mv zIQ7{H8@0w9OuHP{Z*1_5J1e-r%s!wjlMMhtJ3WTUTt^n?qK(G&+_`fJ_O5i^opI zF$C|i<0oSY4c^f*t!5*R%+JT{>|8FY@3?oz%MS;AKzL*&WLqi}WCj&!LD{|m!Ei_z zY1d6urvT-B=y89)4|t>Dqy6soHe#p0g(bCtC9oa?_tD#J$IgBSASR7TXt}h96-a5T z2T^Gvm}YBHo#R9ysQ|#!ZX!@aE9UA31iIuVrX_0Vz#jJ7__)1G_qh(*HC+<=<~UN5 zlHoK5eJwNlT;CVxB-)|=Iy*FWU!Wg{7O7FHN$4Ws zAL*(!_h5jTBXjZSD<6%qE#JmuGJa|<`QJi>T5J$Shbc> z=&G<2&e>$kfT`f9_T+Uk2Q{1KMAQNAW5<@_AN`|$9RK2b{$-rJ>vS$CF0s!o%tyx! zEo*MsJ{1=)-H5IBAU^ZiXQKu4x<&l?^UuYl%je^pf5$h(|MdU-A2GS>vE!ImC$*4F zjv@U|95;j8`24Mo&-MOuedqlcK)rg{rZ@i{hxhmRSvCfT?+kzQyW$z`eABZR-boeI zec{631hjM;xMs)vk>k;vJBAQ+&EpvWZW61+jSxz-T?H+8Keo1q0O4YM_Os{XyZ`rp z8Jla}xPEOT+U;R%Zgv2@8sPzav}-%(N~MV$5o9N_6E4h`hiPWn5eNzir?Ah?FCw5% zpy?jtdOZ6aTCF)~2CcIUxba;Mmq^Bj5&J%an1zfbOgizQ0@=5P#W5B0G5=aCgd5apj4Y8pJlXPXjpB$ zi3W@XClF6p%Ybm1@*|W|6Gq^WZngpC*PoxGZOGH@eAq^J+>u%?j3kT6VEIhu@;MJZ z3t$s;^&iWm0`%b@$SeNH9FDrM6HmXeCZ!!N`p|Mqo?#y|PUg)d62R>U>kkKU?5-2> z_^V!>!e1X0Lo3JOa=UxZqH}AcX+U=nr|!Bpsb33o=*K=2pZ@eYfGiS}Kk!Q*j`giAlGzJzDLeR5XaG#b>_M}{J+zsfpR_`~ z(Tv3-OX-@>MWNfwS)$upotz-Fwze9p>#MQ0x`ws00T^%OFuiSn*)=t4HXQV+o0n{ctJVRQ%EydR+XyZ<7zf~Gv&$8wrNcvPUvCg9sBN42FZ zrxo?tnY0K?b?6qwVgj0-DmjD2T@@`CZJ+?KtSN8``p8LGK37xM9Jq~-L#Vj3j$|$x zI6Fk-MF6W9?gTA>!amPwn-$DbYDgcUt^g>LpsJjNA#lN}NNos4;#UcF=#XPPT`A1< zEOvRO4^HB1tA$p|ao@ua$Lrqsrd$KVT`Vfi1qgN#CLF~N|Im-ejpfZ~z|;*ih+ODJ zu#*;HoB?sWbI1YO)54J>Iqc1{s6AMMtCy}vztamBn3s5gwFG1`4c)tydM#%b{>)GQ zbbRmwAB+Wn_U^my1`PUf{P?LjapG*OZVuw=_3b!y>cO}R0J-Ph`=T#sqiNlJ>STQ6 zL%*1_3jf0YlhTrfbHS+W}viq$RC0QqK_|q~nx+@6AKbnnPQt*s)4kI$P}o+O_4CxOVwk zT)T8FHrLnD!q;PKeIxp90CY5nj?1-nTmnFWasUlg({)7=d9QG_EyiuMo3s3?RYB7o z$ve3gOJF%pOkt%3;0yql0pC)y6y;e!c)k|pxq6gmYEheOMXlA$8KLERGxnud%9l1} z31J1@xb!U=gGDmMOxwDZd7R}s0TWK_p;R28JzE<^z}xb$t?#JAwiMiQmX(?fPjb~Z z9%|~lBZ$4wR*j}(E*PI+4e@Zg{G>hEoemm8&#m)!avPvsG?LvZCrF?Tq3!NrqdC0D z=T1lM4xDimv2^lOoW1|P*y?tp0>I5KEJ5_8`1r@3ihusy|2leIC#F|{q`>31R+2kr6h7BLJFdpetm}kK zMIAt$ouA{JjpHYd(q4o3#IJoMHa1uIZUC6>Vg1a-kt0Wmb1I(v%rj`tzeHV5Q0Ld; z`i(Vc6x!(#7DXTzVIobb)^YTcQ?4!SxLlwzfp#-z3ihF`U7qjn?LY_6-R=&jW!)hh z0LpL20K0%tm3+?5HK`9bPbjtmQ+_ACIg_>Fs0%v__pz8(v;2;naJ9He$WRwVZKfHO zIW*r^CF)1#0OdwZQuawKIHzP!K$|Kxu0;nLszmS@j8nMf1jvOhmyq4v(^G8rtOZIfv5Z64Oo0*MSOvoSn!5@mJKKoRH zRRgoPR%?d)(UnTASYPkQ^Uq(3D`;DjXeV7+R(sxBUS11&SCjs)ZOAX94q5+_n>eZOE(;1C^mv?Hv?z_0F(4t-yUa1X{ zab13n49zLi+>6Uap2!ttbGW6WJUn~-0enKf$s4s?#B&=Txyk7d|L_lIkNp>VC{<;g zTlOGtE*kXsU9Ogf`I8+YkO4pkb--|F2>_~uFoKXBbs(t8sN0=xtYP-K+E+nAN_u;p zVF-xC>8UY2hIB9pZIiq@PoesleXf^ zzx*rX5B$MD2nc_Dy!kC}jW@sf&GEz&uZt&M|N8ivul<^M#lx?NcDozTJpF766x|ML z_R}RbwEfh0a}U5nka4L{JNX11{lacMs^*_ylz?X_!M%*27{rAO=i`w_A4_+|);5e- z1>k2EbHVVH8|UN3^$W2x=s+WwqcCIk$P;%1?XH8h@OS^-KLmX0C_RN%oMVr@Cl!Bt z=4frMsRB^frk~g3Q{VAZ(?w9s(#d=NU&KMixfYtRE{8F&j*kptoSfP5Mcg^+15h;? zW6YUk+$EjzSJ12RStrHh2-iy3KLF6sW^+MyO>&2EIU^IzaG&=sZRsNP($YPr&qf7J zQqXqqH~SJa?_JoZL4CCVsr0j=xwhNeab$5m9!7w@=}k|>+u!o$m_;yNymUUUFJA)~ z(SWBX(RvYXfV(p+@4D+$`cK_C#<9Q6){Lc%m6c`wM^i49X{Vhyx_B}kyzf!c*LN&P zL&E?WB~u<#mk49%poF$-KZHQsM6*>GIG)*MM(y87p-Q7zKj|*Xj^Tr7_Z-63E=E_B zb=wv7TFfFuczKVKU{6b`*v2CG@-sDG_&^Z$-XrOR_E5V|lE^mmJ)lfJ^j)WmhJ2?x zj=1edaWjo~|KJazy?^0&^~FBE5d5=T-}Fu26ca!Cqd$7^u6MmF=I7C{zJNmp$?>nB zXNLaIK9YeUlsUANcfINE7+^nTClIZMnnn>ATA297K&ptWh17XH!%Z_==nF&S13YHvFJr@#1D zqk?Q`=ks0#L`ksw1@EgRhjVz=O$ z8W$`sAladrvk0+9> zTRcjuPsB-t;LrWS2jj2)jlUih;&<|n>AAD>u-A*P{IYk(>C-0?u*>%>WutPL(_KpT4#>PalE)g_FS^l`f(!#Y0F)u ztrRyRa0yO<(lKubVDHYsC~mA@CoS53hPVLgLMW;P6m29pdyEC8ZSQ2N)X;gS=35AA z!Ydd39wDOzXs39(QHaEG?YSH&?Pq=yWv%m$G`3OAV?N6om=JjLh)~N zb2Gl@d%ow+1LRq>mT!II*>Kke8`=HodV?K6#)Y`6(e89on!EI*w%L_y*JERI6|mM6 z#XPGwqFP2H0v>vUUTk)|XuQSx1)JSrTwmXYh#lboi+2a{$OFgXcmM8hiOZP%@A(h^ zAs)Q{@%V55#2<-!@4KIPw{xhQ=}4n8uT0`JZh=NKtz2y+AW4k=cDCO4e&6@SkN?EG z5tSsAnRpZwE* zhZ#LYODkqtb=I%M<%>@NE(e&<*8vfj1vH#QOYg&s|DV7052DtbrMzf}G9HYSV{{Q} zYNysif~s1V0LyO`Rkfw@VcVD|!>OUEAqlp|lgP<`FKFGKJV}P8&0sk+5iobu z0Pl(^>;n2eLaxuZcE0V>mKCfcL5Bm-dGNur@xXm&5DEz(wKlEkZJrG=yL6oy<#$;I9sGw*wE{M+yU;hdBs*jNvPUKi!`AZF+4@tW7ZGG7108{BZXK%VYj6zpnv+TKp4Rs|LCMHtfb__bBQ&3hZ zQPbD;Vm;ddI0nS*W!LJ6*cA8y5wE?c}$%scooW^kuOxqYY13 zFIm5|dD01y5SNp#cA-@@V`9j>W_-ray_06vS6AY{{+4gOZ2|d?a#@(SGTP9?r;kLR zhHs}PIm)3o6*Qn+suG4aoEopQpE>{?B$3mRHLi3`7|xDAr=~i3LP8cqhQ#UQj=~@9 z!sh$&2Y%nT$EQB|sd)0UPhyh%&iK=R^1Cn>o4F%Nqaov#F<0~f7Os$P$L)^vWADY< z+6Jas9j5DM{x##=>Gw6Sc}?7N&)N9!FMqfIzAT)siVmP$DVT%&2((4~n%w&d%4*0G zk5{>BigL#B3JB1lV#3ul) zerj#HXL8{r5r=!1Idx40xJm>~jmVuca-Ct zmh*Y9Ae4b8jnDA><-T!ViD??4=EwurDMsHSdNkjuQ7pEmVqvxd=vHC@fIG^0^4J3B ze7ySc2jkI)?uiHQJrie6o#fdPVP@j!kt1>J=+QVqIZtse9a-f0LIQNF+2VdN7xmZo zUU$VlEC=hSR<9zor_+)uQ!fIOTXfZG6}0D>m?wM#kZjRb3WkOGxp>nX-x&Aadp0g# zxe^;|>q!sp+|onHyKBw$8`mk}R1R%h0E{X*9=(;dz?Q7p0uYUC#quQE{y343S zH;(9WdcKo_T#F^an7VSoBHP?Q{one+ZBzMIu+GJRs9)*YE|jgU&2XPP{o#Uou3_vy zo7uME5JD5^`B`9qzcX0=PJx=?iX#C#Z%mu~NK?F2At?@W$9D=Q>jLxkbpaUrs=A_!*Rh z2I~@pyaiYUqDi$8Xliq-AHV8Vna{+vYggi{zwRsJ8@}P|qF!sn2EeAD({Z33 zK-BdOhQmQ>brL7hrLS4=U09e$+f}=p1jM@u<}#7m?$U{4@elvWzli(qJ)IhzW~o}X zEuerX!SFV;CZGU(6mW5bhNCJx(iN}^!IPl=bX_)|`t+xBcamerj$-Z)qrJ5PQ==tq zZlr(Hb)vgi25=4*MLj#Ep8D*kqCBmOV4tg6&oHLBuOa+)Mm^#_2uDh}Mzm`_m!|gl zOc+KPY#e-*$#lsKYOx>XilCu8n1Ztet;OjT{r^ZIh3#* zv(1@Uw6hdY)J@d{{M_D3cSgCSOUEh32^(3rn(@|uYQ|Kl{`4Fbpb3ru@wpvluBUC8 zrWHicfO)npYjF^8r)Pd=VMe;#1oj+wdnq!j~PySf@z0PJ7==tq-I99n0G@!e-0 zz~Xu+9)9#y;gYBVuv)%bFA0?U)MWx9>1+MDS04mr@(6kT&4QyHzG}uoX3^hZ2c~;B zZnoE!*PxaAOT^|a z_3_BV4?tu9+qScq27vM=aZSd|tfLt=b2}yh&m|nyWCTrny@6PO(+)fk4HA~wb5R%m zz4BGB1h8B2kze^px-{(Ub9*TnLG8x%ZS_ejM94g#P)XN|?>*JRU6;Xn*>%}a(%sx# zi;EY}$6Md}#`JeyJa;}$0sPicdwUxoDi}mYcOfH9@X=r^P9C3+Q%9R|d|vId8pr0F zu{2+cW3#nbnyJU)Y!xlF5{omHI6l{mqgd>|+hC@OJwg(!c z?PPoCpSEp>2&`Uro3`AB&f3rr0vF++=I(N=6V&CD-(&IEIan&$Syzn<)cf=2pNms> zokCl_FWc_&U-i{r9w$$oijRH#lW6BNfKwAXnu{}M?@8^LT+=>kzJQ&= zA!$axJ^-n|ASp?U<^b6xI2P`!T=+_%2KY)76V$=#=1PnXcF?#5dcr190`Oi5kN%zc zbDX|3!B2R~bO>9h%RbFR@RkQsJGM;u-cQIa_o_YSCTF|yUAorzOJJt%bXg4gz4-C( z`vGY0WkCK<9=AFmOB|Y#Pdt1QV5&h70;@yEG}{Yi6I?a(oRr~s()pPN%#N7}a4yU? zs3+dl$~mlQuGI>66Pa-lAI;T9Jtu1%KYl!(d*<1g=lvi5W8Vo-5*`BT_Bs$$KebJJ zwe{64pbc%eU4jr3zgC5bT!pQgM5t@Ti71vnclUrm|#mX?ksSf_7~!;v64rqvptE@Y_Hl^b#5_|bUcb+3sF z=bod?jzx9XXNW<=J<3RK`_nKrqC$MF@vC*sZC^O>LS1_ zn9kIvxv$2N*-FecOMFwxut#P*1>tHe5Z40NdEE>E`2yc90KmE(=6&Aey&ykdB@Ui7 zdCzsOMf${JK9&}0aq_e}6ps z=wtB)dP-qN9$iK6C%zv*epy5QPan5FAO~7sCEoeEN3-K&ZFLd$Ny+_F!x;6P(apiyt%O+t=3F-(81$z`tH*(Y7cElvsZVAofj_t zTJ$PAks~{1Fr(9T0nutkI+ZoU^Y`#05692^%zI*ctIanJ3aW+-7xB&xJ$==tvEAOz zYH({FJ9<3axmX54Daxw=F2FqV%+v9uB(+*_r8LG@6WR+76#;QSQ~{D_FvP zz!hL@0ElSKZhO^oH0o@}WFq{ZdXiCm)7FtoRa?>*I1b8&t^yN&hJ>2Jj}`I{~StT}btDAk1paH!A7 zGYvuXP@CndhO360@tT0xn*i%~#bH=6SY_J(%$-LHg#3W-36M|u&hqrg(@%c?%Px!G z)^V!?vc#Y^I9u6|8-VfEt2fez=89SF810(CTkS4dO+SaaIp$c+b<{7mf_FHXVCVM# znpnCO?DTVtZ=Y|9X|z-EiBEhw-tyKr$9?zRovr{!WoWJqi9@if18&&~I2vWIy{-kd zFtuSd5D%3HT@Z!q!HzPRly7PPyV|nrAv@_qP51~}`O3;_Jo)6)IgsBG0KQXe*(GlR z?dI_?=(>>3CSb^S zeVz%pE$Zpy(owFJn95E<+L^FBgC1eFV~91=2TZpC@vZgcSYNvm>#J8|efeq(+G^Pj zFD%0JyPL7GdLyn}J{LDGor^8%uHWB`Hri#I`|VW(!P<@3;J$}Y93a&CoDTJxo`Mdz zc82|Umik`b>cU8_jHnN53gWTT!{IkB<}%Gg zx0%T?lMqp%y&}t1yU;eW6NA4Tw>#X8=Iqe~`#<~V{tV`D7vk+knfOP&QG((QNGlN9 zY3S}54?X-?GD;s{5!f9YT_P?!I2!e4p~=9oP3|Sl1b;xu?U~$;zlH{D$Ipcem*T(u z(|W#NzXhee7d-e+=#F^y$+m;>Cmm-Q&AMGBUXbbM2=)M6L3V zf7hRkFaPo{jc#W%j$=MQ^VG8xo5E9$W5*Wa$A08r#V@`8r_!hEg8XXj>ANHQyLd9{%#q+9mo1Q0;Cf>3i~0y|=0f^mYwvXY!9V;*s0BbBI+~oQk`MD}eHWm->kLx_T5hj|KrTi$C^)s4?BJe^Hk$m^ zmCNBSO|_=GPxIaWC_z!Ha+3HI_||zkLWo#iAPNrR&x*ce%I|g4*AZ~kRc8kf2LCOAbU!LN^Z4X zwO+UbBBLB2?o_D)k*OWHDwTvyc!`?R-G_k^G%6UHINTVrF*BQc)xG|WZ-~bqdqoZh zlblKbjzgi0Tdhc<%xT&?eA8&Ab~+f?vFH#j_bHo*63`}ju_q?1V?65B+dv!g=vfx3&eK1m6{jzl#L_fM0F91URm zrQibOWYqKLpU+`d`i&*Ho+dY%lzw*CK=}Fh{8T*inNLOwlV5AWDd%dwPMXwlG}Ven zSP!Nv^6ZhGLk86x`)Iy)2wCTD_^PJr_wImV+_uXAA=F0u?X3wR+q#-@_XosKtfggU^W%1iNZh1h4m;~e_^@6BWsO;!)YH=0q zQ4P{HXS2td(`)*4r}ZrgQqurYF?%TesG9A7q(gP8bqC~^<1%LCANYgc9<5d*{aw3& zLT&{_`U0H%ehsP z>n%7G>(R#^jeq^U|2B!0B(e4|ZP8Mg|skQQt z^d}O4R|t3iy$@h2&jLuD%#WRVvy|~eAAE1j)=Fq@?nY6`jaFTytc6hUI#VyMu79DM zpxLaYPu)othMk+4iMhGimOIqHB{)?bZbtjosMn0sFueD^7(49mD$o7x_tpHq1Q6N&HT}$J zqb=SUR|+g@)nRO9Xu~nrHEBqCpltyp75 zK=yESM!F(6?HbO`IgT;!kH^MmeEb^&aE`_>K++Z$0h!a09UfXv(z~&EYN?IC^=e)A zI^Fn*AN-M*0r|Ic-0FZ#=CbqVfm0B^zzTuP&$Q4o=d!2$h#hxxGqEt+jJerH%+Jr{ zD2sWReg?u^m<0p`n;C(_POfSK*&N@yw(#@MKOc|3>hXB{+uoY9_|(i?BSG!OqnO2p z?I)2T?bWO$%9=o{7L{6XCH;F&*@d!m0T(qntJQJBYKDT31ZpRqzFgP2aI(UY#ijVn zlTXD{Pd^RNpd}yr1oLAKzu6@&ug>^WOKPL_>C&*%P{1$3s!8p@6lzA((caq5G#`7# zD`IOH?Fe!j0zM-7C6-#FgatD_dGw6SBTO9+sP zSK7PGJ39w$|0?$aYK{%|JT(QrdfAS3gw~P8Vx_*1fBa)b2ldh8NjpFI{ofzcljR)Z>6Gh- z9(pWk%@IB#p2Pb*Qc>Zmt3pk;gAm^CY$olwP&`Np2;Tp|9@q;gG$iJ=Q*4L0>NSNWl zlQaH6+o8;us!I#=fC&r-6PL-p+HeKnt|tS*pp;9naNSvl&B^pG>;vy|EfaI0Nk9GU zx%i`h^g96q%sbFF2e(6vg6nX&mq4bkF}LYKZBcXG0uUF_a&vJPz|x*%O-q?upId6o z0J%gi_-Mw-{Ayw&o;kV2h0*lD#W7uWg7ul^!tc?ZR6Pvt5# zElD7$KxUH}lOc=xPpw_IkPl!u^NGYEFk$%HCtZa>x+$m+T?t-`XLe8)L+|oRyb`hk zE7#@#PK;K!L8isMGX;wU&S?*UXOeq=lVavWFfpzJeZNA+p^5C|2)?l`OxGut&9>OF z^OmcimqW?aFgcA!pFaV~o6icDjn9iAgM4!cK7x%M#>ne*gSlkuQx~qquRV1>mN)uw zeR(t1*V{2WyAYrHwNJ)5g#C3u_u_?f(e5K45e8L+F8G`~g#6{d{MU$eB7WfC{Q!cX z8V}xgZ@lhxuZv&%_{Vcp#?wzd8z1BT?eBaCZ9HR^Vnn?;A;@w{vueWjaky^Fj_Y+a zblFiKIowU>0&QsVC|h)&r5;_*(OOQaPb!MMB=VrY6jweX2uCK)!=lqc)&_X4dPj)Dpb0W25hk!lw=p$&0 z4##sMOf!D`$A1JS6)X`bltnGyIvSt4NzA8fJa})1ls??P?*O&|b?P@xJMRx2X6E;U z{ANJ7oUsUS`HepFA@8*&T$QiK?*jnSe2sn7f^`Ax1sLki5j3qQM>FU{w$1D_5ai9H zZkx=@fba?e(%Tu3*B$DKXS<^UnC-ChUHV~j*qA^9h#_o^H=m6JX~7tvwWp4nw9F}7 z2;+H@s)RLxkHMDY+f&=es znD6?4YXFS?+-ZG*Rd+eycisKb-1Do>w|4459BK#p-X^CZ8aw&+V|jTs?!EV36G+0+ zXIO@SWI(kghoafbtqCePc?il%{We4;lBSA@BM-(e66ja0dbC)uD6+kar0?MI!i#v)A2=E2|NI{cryL_#=Ph zkHz~x@JsQFAN+6%hVT4Ce>nceU;iud6<_`(arMfj_?v(2uhRa~26U*(3u)@UQbXSE zwW%94W`#e$-CWeXNz-F+eBtn3uoQ54_nY2xi~%|?zDgC_A70G^x3mGVa2DT6v*Yi6 zLwr2TG!B2>j>jFPAv;V78jGpDeypr*#@2QxrEUk%Q0wgh9PM^Hw^rJ0cL0%gY;Jb} zn|6kEMYT3z^vMYdJ;0;GdwsdC9QV#I`%*NQnH=kDhm9JLnwZ+Fj4CGYd4<;O;87bZ zToN!qf@B%S-Gd?Z|H8ZyI)E!6>yPwmTy`Qle%Cg$gU3@XS(k+)ES&oNlEDEtnZUGtKR>?^moHz+;ajfLtG`pXiSbm)XSdTu+qx0=-*-$?6epi#94MvyCcYG^Fh9Td z0k^^pVIBzRv=YM>12@1E!WIQ9PU>D^i&3B8M-C|Q6!(IM-|ITjrB(D9WZnS3RaT7Vm0KcGO?*SXDP@lxAJ$E-)9mAr@stkU8_ZpulbC!CAe}LURo_iPw>+J zh)XaxnQ>YL=-T!fL;m)ZPCMJ}_~{@0v6o#Izn$Y&2V^xniD0j{mAer1(8!!IC+J9+ zP7LXdFqhS+G?97kI~Nxc*j(XF9vlK_YDJo_#qXVX?dx9`kH6}bFxNq@TdX1=J;|to zs(@(+oWsEiVl6<_jZM|uWaHF=N!Jk^5_Pdv6G8-V$<98$b(oxK7watmI-E`?b?A{} zWgRDdbm?fk?|tt@>ueXkWI!*8oVLkP7o_GPAg3>vC;G1SC$?s1(Y7z8kg;P>p!Peb znYU(IvAnvPd&jxh{)Gz{;wOIU-SNnS_oaU|W1?)Pm5j-?xTkD@d#+!Qnkdac`9PWk zQ+{O~382Ngxje~y70l|P%f=_U$><@gI(}S#e6G`AdVVVdb4?#E%&%3F>n(p_Ww;$U8 zQyJkr9BRtf;tg+jOB_4C1ig|DLg!1qV4 zpZ?Q-8aJ@&-tnbxiG8$nbJFgrjBIB|-gHH`m~};oD35h(MJ1^6m+dQ<=I_HQqz>}8 zSL^ohnZn6?-x)aTg8M1khdLmo1mrP(@W~;N7r;G^bL_JC=^wd$0lDCZJLRBpW!yOk zwNk3)M2(ZjPsJRX;S8Fsv*28)MfXK>t`##d#*BNSp)EEETPz&p2#nbrPSxUcPqZ^< z?~aEadYHzTOgDf&R>%FibBDY5%G3g$({Xb`1czFmVB*j>U@|5FTwM=>@VLXu@xi-* zsX&$c{=pOOm8VXa8W{vFh`V^Yi|4zjjSJbFI&~uMz2}|;EQv%y_DGEwf^kHJnzQ5jc6kcP`86v}1Q= zc4CXbv46m~)6_Hh7CNjyC)8+)>vttG%1WG+<$%+b&Fs`O4g%)$y@OE-9s$QcHCI71 zM+lInapmGWb{?YH>Q10V@_zDg@(Ch``ZV1Uf^bOtb8pWb@6Dq_xu^}|RtO&;K%0P< zb;K{)qDonuqc;Jql++){m)kB)ObrppUFy+k+xATqK5&HxMIjD-+SCgmj!Xww_u{|( zGk+@nw}15A@!WG4=h|Mc(0`+xpt;ypk8a|n5bv>n8q z1Yj+xT+5mIu^!B)IP=1!4GtBGu{eF{aWg1oXXjxo`5%n~6ek6zKq_7r^=mtf!}BhM z-66;+0OZ|VbHgCF>2YTP^5Kz^omO=ym4v6JliHkOI?YSTjdqu*)rReO0?g7}J|s#t zH{AvjQmZu!;UK+x#aa_;Hd3&fwsFYVx+r{~ZU){t3Bx_tT&}7twk<(VW<}9Yv zz#vHC)Nd@asr3rnzBWx~e7OaD5l1PP_H+WoJ@=l?-9}PF;afWfJ^d|#7c~xD@3cCoAu8pf#uNCDYALdCgUtU>@U;M=nMNMs;dfM*v5Gd7T6!F&aw|1VE z$+y63+1<+z%*X|drV>~MwW1znPC<5DuRd3Yoc3GVL-2I1jT{{TAWjpndj}df6`aG` zOx$mC9JO4}qtt*2Yg>BqGYQ^%!x&#?+VprScnIX#&OWv61ZcwLw|>l_z|2@)&>+n- zg2J=_xBCyW$>|em*8!^8YkaL1BTWORNVSsape2k{IDwSoP)NP*|yR8Mrs(G`+#i@ zqtc(3{zJl`jp~lj-|LX71V~Oz|6-KIAUl^F!|U1@M;8|WS^){LNa~ZIoaCX2D}*u+)no zZ@Un+n)J%*TDjqHB)4zZByWfa}$H_1<+w@d5ug;L0RDC8dF1=g$V+)Nc|A*sK z;{j}q&&e^)Mw}J|crSSCv(E9s#P2AW-0cEWd>U<1lUzTnJ50Deyp=_4#Ld^d6Djod zdK3U_@rfffQS(v&uXSL%+74>)S?R=QM;yvIG++ei!<5NkUg@)@j`caacb(;-Dv|~q z@0??x5v;nC#2GLwJ9ZU9CzejcTi*2McXcYbNS;#H4FW3~~q3-h@KvX+i+ zu@OY*wn>e~R4mM)t#WUj<&(l!qiFfMfOVNH((y@ywSYisyTx@^ps7DR%vVG%lN!G<>m1z5f_avO~D zc`Gq;KNgg?J1AS1cid5Uekanun#AER{&W1X0GOH(zjFcvFLLJ%PVZBbf+)OKqp3D( zx#Z^TY%9a~u>j~o_l8N31ANmL4I@cd9%@2@pxTx|?4m$wC+>CTP%saN*_BIm2-P@? z8F#6*6PKeS9I~fR*gWe#aj27r3*XPr&cz$v@cIPbtxeZpE{415tMW*{ZhmW=5Ikj4 z!?NHqg02w#n5R#lK?Cl_g-e&RL$ikV>}qwoJU;S~j}VbQ>_WSCbjlQH8E3A znK-L6>rTyC2Ad>2x>)Wo;_333HGnK<*kL&cZaD#i(|d)R8*FM-xDkNbW=5?>Y66s_ z=p)co0yt5&!ujAqTPa8Y{>%gSP7yXAwviT-tx~kB;q^mvZ}#&=2F<$CY)-*I{CNtL z#_w}L#lX^(qgjmG@z36O2km&~nP+18#`RcTS&p4SKaMXRjmIB*JYM&j*Tjiq$J6DL zJKi2hCb<0 z#%Epxljfa3 zrVqEO51jg_xY!PW4s3F(^ozo9YCZnTwReb zzcF__?mHZCeJ$3PSK`X~3-PNT{&2kiJ@1K+ee_r3qaXQ|IDhWhTrn^=05I18-nDDj z<2{6NpG22amDbFk!bJBJS;(>$HOt92erprhMgp=l=t!0}aV#D^6YqQf2jbDkUKzje zf%hXEE~7aE%3ty3ICIy0{G0#ZKaQE^bhu2anNFpFZ;RuwF2`w!wSs>>EsmS{#AAH* zNcRL+LyP5k5XYE5JW`W>3BQe_FWQsSM_k5XZl&{!aZpcACv~bP+SwOy8i#Rxu`>3> zKFpiucrGHuy_%kyi$Ec>=YlI}tae;L9@24u$Gdo>qX+WflM zk?Eeg>#kTtn{yP(GtWIAopvwFYuQiS<@Qm4$Ld}x(hrAabi>l>6+d;uVI)J*ug|E5l&M4Z$Bo8QK zMgXxuPQS)sT$a-ZwqvG|ouvRR_okhK1F+Zqlw-lUCi-xu*39=)Q-?s5?@Xmg!ZSgf z`ZJ!Q-qrpv|M^bZ5=>n$rDFXM->BQmMT_k4wPVq|@L#&Aysy_8uqt4tB+udsVSaM78xBu=xjE5e2MZEtPej%Rz?5E;AKm8N& z&bPk-fv_Hb?{EIqT)!Ekgk+=z>8GIK0!cZ!=1N_^F00DI(h+AztHnmKkU4c&>b%1 zqB5G+Hg!Q1MW>7!qT4*#QIvi`G`6uhTKEdpypwSZh`o)TiQ*pDErHs!3oLa4cBg@Qs2vIHpFZI)D;aXFq;P0%>}ttPA+Vwbq= zFiiIfCc8cGM;DjkzI*SB&CRVO1Ve=@^8%JTv7p{x!+#^2oV0@Ot*>C1$>G+9s z1vs?s;-!l@Cfg1v(_C0O76U-|`3qNa2jyvJA|}jYfuM;OmI6X3ITE53NL?;-8X;rn z7K~}$QYaEGeeQ7PWcq<&%;ZuIufO3Ggk{`HL z$!%*bH8sfWyrgY2KEqWT@rp+ur;eN1)|n6fTuraD)yY-+1UKW=W#nNzT0gr9$b_d| zixt|aYx36V?Z%O#cg5fNd;d7T;;X(c-t)6R7a#xVN8(q1`NQ%1-}QUq$lOf)(7*dW z;@^bMOG)RZTPOlnYe9!upQJagPmg>)et&rNJbYXH{8YVOz3f^{&+xZSS)? zTV~tue?I5!k)MB_m9^4J8d-B@-~N8T_ij1&+;hJ7-1>NmJS$yKW3wunSDVU}_1{%K z!*d2fzH5vpa_+lSOg5PaGXASFwm$h}dZlRy=fJWmsqJ^7h}8K*r#i3(O816AqqR}+_QS3yk1_i!*FbN*|TqN`}S}Dj<)~cfk*`) zgn@(UJ`F?c&|rYsB*&y3Gftq@T=J3C}HD`ax+50KyiptrL*LL0zi z7>7KKm1^{&+!2g{;*-o%v4QA0!|)mZ1-Qj`vDI;Szv|X=ymjlJ)eDclhJ#Gd&CAKs zk?6iVEzZyp@B{|=c9)398^-0VycebBe4|NGFdM+5Mh_UJ6;%7f~f0|P2)dgNfFDpPsl)`pf*RcSk5JxHnK_mckBjR3(riA5_!j#hS zDm%~C5+|B9Xa^1+N`n)IVJGnWlkT~DNLutRQj7=PkdfCr<$*roIeN}Wt&cu&+z`i^ z=Ir3k6ZUowAObYH^~6q4vm(TE20FHMNv{9hzjt3AFtcQANg8w4=yYJ@H~x9VD2ETC zK`=II4Xqcs;`yYtz+p^0^_8nuw53ZHN9d5@_`$Yg*N!%RC_JfXIF>A1)=r(7-L~)A zo!%_~h{VDWd7!+`08L;YKy1ry1j({=W9ZSag~6W*?>M{oyi>p(u|P^Lh10!_@7-pB z?viG9^COS&|8i&qVCDp1G`89|_w-cK_~UzewZidI17I~Y^8i|c?c6-H$LVpSW1|Vk z8eXTKE%1F|$U9`60GGXr0PjfK_;rG&1|%{X1W?bN7vX}d972h@!hJ-_hAJu|!Ua!J z$6ZrFpSn5?*a|t&)2OFebKCKgfS9t#D;m=rlh6#rM>e3{StbCHo}G!`RtzCU&4cvm zV$@>}`^29{`B>EF*6oMd-~Nez(7xo|U(xP)gGfWuNF)U7tgK=Y8@B9#nzK&2*%paa1jx)4>~-f*^U$2K!7f4vA)# zpPTO&6Qx*QRuqcFGdvz()OE+gs3}E!XIOax7{j6~@z+-}%EHrOxJY;{Hbb&b*}K;m z1TTQm_Hw{;&roRf0h z*#_MKK_m0KZPD{19V;(vy#_+Yxt9e{zVn^$%=_I+kIsYde|o)Ab_e6?yh+~XxvqOW zcTcxkS)8TptrZcp9X@opZG2*5v*p~7#z=VYTf?aL9~w_@v!jqt077n3VQ^7)-sOUj zO`anhpLs?xaE!)mG#VJ^COc2r%Re2(*&WB}Ok(fl8_6?}ow2-dY$VS{)=1dcqcO^J zj-!FdV?M)6?T+dUFdZF@dvT4r9{?O_*|?IR9C=xLUC(UnakM7z&EF9=(~9po864hn zj^Rcb6L7PbQQjzH+z9OSJ%Bmt+;9N^hF`)8V+q(9I*{sZ zQ$N$b;ZJ-^`}ik5)gFG}{`N1UcP)~Td{m;f~FysC5y-MVETM9?AYSAJV11DG$4xu@En-4 zG%iP>E(E^enR>Ztz8G~;w;XQ7!8_-M5f%gI$k$P#fZcMqZmfS!0)C#a99JGPAN=N0 zx{$SUlCu}Jnn%zu`tEg2v&D&YdBDJT{yAXgX?8u5c_D`mc&!TXLeTm1BVIIyIkXgM z0c0yXvY}1I;i1pXjUcB&o|7S)69I(I^U&}br#F@jNV_4W0Pe_x$8BwV4yT+0DP(e2 z*aWTkojtGMC6~GJrg@Zjb1&+jP5^E7mBTZ^hozNA=&CqT*1z^Q|7QDvANq^!(T5+6 z_@~;TgZta&jgJRFKiF2UTov~^eP;t*LXmN#<7*#$lgIepaoRmY?&sKXdew173svRm zLJ%o1)g30G8$18>>6803zKC7K{OlNfM<^)(wMu6yWCy2RpB~OIGneonTqP&7s=twto zbIxqQZB~V8?ofprO2}2Bi*^hHH<}Db> zBSURpW*vrV9(nYM0M#XJQSYEc(8FOaO54lAe zbTZ`HP4b1_o<0%!d8ExAiNegE(DWX*dG>VZQT8H&Z^Iq4X9X`II|ETx;81Xr!d-tX z${O_%L4)sjMqk7Y8+6{q>`2et&1oB$qBmC{|HVizD?sile0E#3B)a(Fb?FM)ahF{@ zip1PP>GE8H2;E)LDu;q(YaU9N+mLx2p*TEapmO5GvFz^JHRU)--iIrf9SKkE7*^zA zryuVJQ1FHrO92N@*v_?lGe{^ak8k;kWw}Aav6|kWw_)wtws!5Bwj%C#OXIqiYuYk> z^w@^WMC%|;>ywN-vZpEtADNkP3mM6EhEnBy>Yp=dGJj^BSiLKki6O3%4tR#@2c1{LX z1Q2Jg)eVb1rKJm=d8?;XlGO=3*8u*x0pJVfFAVQ_SsPurI6T{^yYNUyN5-Q3i`vNI z?$uedg%1zd@u@u7xgoMqdd;VcGk7V@bIC7?eKxa?a+aP zxtYe0%;AIH)O{omi{G>FP}_HKyzPrHc|}8XAi(xO+}nR(JU$~0s~-Z44;?zz4n%yL zX>7)r@EPE26OAQ~$3hQI0MLM`Ga)0MGat0us;wc=xTvPii>4d78UKnB#erF+T$|HFT*Dv^YMa4g%V6l+k6AamE$|U>wDT&S6`KllJ(IW zAAPue;J^OowsY&IXmA$<*qX!OAZL@BLs=S%?uv|)tGF0idZSBb|kEh*yu~MG)_W%Ch|I1AW&y@%j zP1hEzTgU5gp|R8#%II7L!)lH=i~{7PRZazVQT#9ls|0eT1+Ox^HtC#-Zv2AiLOU9B zQFO_>^B~T&(Rt3X<#3-fph(SWZM<8<5hm<_2I{(~q0Yg_>Bz(OS>epkTTH{D< zqI(}88J=0bYc6=TR(4K!)Hc@uRq~oUmsd7FJu2R8@)O}qc%6*81awa2%R}r#*4}!; zlQv=H%;kw=Cj$`eXguDI1V|nLwg}y91sKjBYp2f4YpXBa(BANdx3q=P zNRfHI#X0J)!{cx;BL7_Osd0+B9Y1_1-#TK$&DdhALFNb8j<$#IyQlr+-~G{cV6Ox5 zy;OB>o@w$&pZG)$k*#05AsY8JQQw`DkqunrmFI^U5&?;o@E%bWl_>HbYVO+C-DNvYWH5AR+s5dWd0_r*t)p3V1Mei+tQ0xH{u#w zWlFHcCUtGyM54i(kw>@+5&+>POFT29=9Y`HHJl>Xt*Xn(B4D7}?zCL9R zq?9pVQ6=G!y|L>lXf>wh%BH;g&J^Z4%cpH9|>@^Y6Kiw4?HhG zK3U3gc1zMsKDl=`y4pOuz_SEFt6fDXb2Z(ne=Y3@4N_Lr>-;#xjsGgVf^sH@X(Ki9_cME%pTSUe&N5h|M2hrP1_d$ zc*FJAh5YwM<8-2JSid293gemPlUuj8H@yB0!P98eq3+L_b~*qzsx-@@;bjWGr|_ce zxpIeRA6~h}0uY~>j9$r6`h6h4cVF8d;Jao@je^dBgVZaB9fD%Vj#z3?N@1B_M>AtXg?#uG`dVFJCs+M#EEEJT{WE z`^(0brV)%STG*B>>5ki68er$h%~dN`MEIrg-J6U@bE3+a9FL0^+wHWA&j6%3;k8m4 zz64`Ee!^>(<_BP$NZ_Nk0N*NsZfor9Fud^`3Rt^#U4{c<#*=}n4H;gsv~2O>G%9f& zR-Y4q@#p20CKFezSedIZ#-a=nEImW~-1e#4+KwH&a&k&NxoU=6wRK~6j0zB`KXpm* zJ0QUW>Kd2MOV@DlF3Hq6&tdbKt^@LOMMTJOWWk(Vez$+${xI?b(JkKBcJJ90-T4F2 zg+JK71$TrAzQojL&{9vIr{z_DvsrID|I3a|y_p@i9U3#4u%i^D_K zkVan4%K*rZfc5$&!)TFcG;$~M1U_#GnLn~5y!O*=_391nb#HicTf8uOO_6Gj`$zUR z;As4m!8;dcMdP9|I(q6@$ZoRDAB{Xm7vu|a4~K63?r;8Pc+s=NL6}Hq!^EvgSTD9c zc;G-=7W%$*>*jn@%_XZ>M_JC~IV9#1=0w@({E_iPZF2l@n+%XY;UKK&l^qVRckhlJ zZR4X4wYzTrWc$o*pJ=yz{A2ACfAG=v;Jx>@y8-ZL?ritmd1u?X{mEP&c|77CIe0J{ zc|De+A&XAW*u=48-B96lqZvTHKX z&kzPs_bT~IFIf}eyEh6GDZ}+!ca=dK#t_~!OX+~!czC9|l_TLL<>X+LWAWl;@w|I8 z_3!=u@3mcfb|)b7ZfZ?(0!1XmGxoo#%Z(ZNOg+XGpXqf4|A@C&b)3K+zlAZJz-Uee zc#`j;MI!;INAo4BhsF(If3OH(b}g@+;rl-hR{D^L**M?s_=AHfL2! zPnR~mxafuCsc#FqWrBb-H)lkn;Ip&MuA8ng!4Cj7X_{VZq!T~#yF-lZz@+b%$JvRQ zo?XPrH)X_g#o@sMZ9@=-iGZ(RlFSF->3(N}28=_7p(ET~K+*NAA}(HxU1KZcL}n># z-$U1|p3vn#ORkaWXf&d;=Z~gNYGhHf26W&XnW}1 zyW2x|-JRa;199E)$xpO7qInP?1;Jt6%Il(5BjAxn@$u+HWM*=9i^~Q|B zc%oqt!vuy4tdj5@XlNvITsLIrWt~)R<*JobGCkOQ|DUnic)n!uk~|J`QFxTR?E?5T zbTL9nCyq>HnkOeuhc~}0$Chm<`2CN3wC&luCjq%+0enz-!N~n?Y%?f66Ig;5Ra*6$ z1|m#UH_uY9z}vLD``LU%LZ@=QGSEAAtUIO@&xR~aR9$+>^7hqV^`5qB#nN^v7Iov(gzw2{h)vMulCnrI za5Bo-$pcvULhHMAzFqIZ?+B6goY}@5_Y;8AL_$tc_xYVjJ&OX4Mp>LIZHb(vbG$)w z07oXe7uJ%khQS!}Y%5g)kO#9Dw5zXvRd~p6jJjQz4M4s=OVaqkv!SWr)5{1BA2}F3 zj$;vaP5^Q=J~^epV?W()eA633UbEVsJv-aif9==gFvBAcKiuB>)*IV*e8;!9CqmAC zn!2TW5?74H3JDlBQFj3bU6IOm^$Nqg)}hiKC%wkq+Tv<-Dw7rSKX(lp}RqFcB-JR2aPBa5E|3Uk^~ZwaKqR~m18 z2gJ#HAduQLtKX5ZVI=X>e+d%g3+n4#71Y8{r(p%s1rf47!w?`hiKf%Pr*5&IjYd`RVKNz0e zbpfUe+Ttb4+hvzukz>w}Z+s#*$aJ13jswA>4C(vpR&<33AP6wlD+(j$&3B%cGpJAI zShJNER-FL!d^>g2!Kpxs^jaevfDm8WK%>04d{16v5!FLNnV&J=co3{~JdmKD@~imB z(l+O0kAyy1U6K?4WDPOBI}y%-N#}@?!y5qEZb++4PM?|6)^E7Hz449Fh(*J#*U&Wy zQO`=%Mx4v)aPZ`ME)d$9pos^VP4uF3J$~Mh7Ad!%K$1 z)VZZ{n>TL?Fg}!^e3spW9v1zJz zAq}*eC~n0!I@bZR9!HiS%19q;)ek%2q#QhWEcuykGy}*NNPvpx_39h0VHM#4od`g| zv!f)(+9j(mZDWf^1MudD7rLm8jdi=f#=?6ukwHd&n=s2O0M()J`PSh`=1c&O*RAu^ zRt2yyCPpnY3I{L^F^q-b@#GjiWz$F?+jb`oAIo>wEsXA~O%`^Fk!QZafmapEu6wO4 zfKz-%NI^TVISe_TImK-D>~4qIu@lGIZ~WG8wB37mN0`prcG)N~Cp;|Pe)1UkSZA6; z5NS4u*9T(ic?Z5cK0s-;1+U+V6<)bj3mZ193qDV`1LOPK(rB1?xdq0+=0Q$_5c8Ksm(_ zGFHw2120*1@OxBmephn64Imy-lf0DHgrs%bHgV8}1mqwqPBgU4!a-8GQ75jP1Bjb> z9BRl~ewOGtlqt|Yev3CJWMC&|)MqpnCg>~`(|~V&a$D4`dLN1OW=8{fReQsYH?|S= zAFctAn;$%4(S+K<1#{cv(L-(G(C&6%|F(8?Vt?>?q#Zu6r|sVTWP5Vcrp zk9jhjfD=b2Qgd=xDEK)OWyo#rsVmVN1h!Fj<-;I(q+ZAOJQg?gJa~^VIawUi^k-;k z;b=5CA)CGXk7Q#y-Dn1oFOYbT!1i^oePxbk?%#VLXOMxVNhmYmd6;~5^TSh_HMfn2 zk{!*N{1f>$>La0Wxom3uNC4cvd>#F~k%i~FwB348%i30jhe+d6nWAOa!Xv=R`vl08 zz4LTC*)1Ghlq(`kK3RzYki8y?!8>z-rwrf?4f4{wTFH4C;GPmo!*B*~%*F)wz250W zc&Z=%@b4w>0OBc%>auP%>&xwkpJR9Dyv#ghE$dRf3g@Ts_5hLi1J1782oU#dE-}Un z_$H#8Ei2!7VEKN$@YF3ceEVD9)Yh(95x^GU5%Su+>4~=K@yAmpzHi>LDR(?-d^W6G z-M;3lzpCBz*0+UM8(!JjFznNjaCoHi!$UM|^pQXKXuhII!^DkDz9LAzr6qv!ga-2* zkBb&~Q+IG5K%h+CykT<%kWV=VU~7;}ZqA8b)8x68A0`QNI3ya84$wQGwbL?JVMJci z!5@H`7p{1on;d1&IfKXz4>oTAd!U`(Aui+>`Oee$#;0e>VlF^DODCgxGkYg z9=x~R_Q{X8Pu%(k?PGuVk@o4^Kh^HK^Un6<<|o?3f&DqDX2MQ=(Z^svC;74`5OP}? zJwPuT-M4RV^js{TYwZnhczv^_+?+-HOee!T6ZOtCeC$cjE{Bhz+)rUe{0?mkxkcj_ zw=`lIH{?bKdCPQ&{m?&~t&SY&w)#&udM^0)vK_MEH_Qt}+qz|2+p}v=Dja|6%vp!M z9}ExTP#Cur4TsyV{Ri6a{rlVA1LJMKrB`tsJbbk63*+DC`^51yjOELhhhaKICk#8f zT)I}PSFcXc1YpK(NrZgTYYs!9UB)CCnb!_wS38uf1G?z?g@^7ia%U`n3P&+crVAI| zVdQZ-o-xL5>=Ib=LU|h9xO6UW3S%+;#$){L5C2Y%gXb9fIlzfz)5x+jey+;81|!*v z|GMAeXtdna(G(BJFj|4^LNvh@97T6>yscijv|YAgZQC2&-6(!|y(2kMdivz4c6Hpp z@wL~r1rR1skX`WrcZZj3=70IBm2K&gu^jSYbXQ$*c^G3DdVtgT_|fpF1|eS)qviod z1B^f1e)o5NJLPcb;NfW0x*;V)DJKFTkB7)k;x+2rvysR*ZCR@pUn04Di})!+Cvo4V z2a|jpu(Kf}!x%Qce&adj_Jjm8MrOFTY# z?0PY|IwNi+=m4LnOOv>{x+9(ep@WAG1*4&}dMLq@2I<(uWZSuYcgEA(p>wZ!%?<6Q zo8A(Q@S*4}+!-G9#`ft?f4u$CCx5Sf>ekYO_KoW`{n{iH6yk(cBB0Wa4f#rgS~7s6%yh zEW#epNS*Fq&J@tJFYEfq7F6lso(E=&(tSl+pM zI2rlpIC4CnJlU-uP4AtDA4Vv>?tFrI*$wO_<-C$A>M)GUbBF0DhcQrI-$(x7_uJm^ z=)GjqI5eP6kPSA{8w%bN93pPFX4r5_*L{>WV+6v&&i-)I2O)mN-(E0!%x@0mgJi~!}@b?fr%<}2fJ%AMmyomgi=b>fI^$F_z~ z1VEfl85vRn;@&YB3`DQz_3aIBx-r0LM|*Pn-iW^tl!ZrSJF;P(S-Hf`vh#UlB>#wq zatm+vG*E<%Fd9h16xKGYXJeNOOacZ-<<8BBnnNQYJMzfl#DDp=laN(<$3PjthHN!z zhA1>)h9T5hH$EDTwK!2n^G3QC-~urqePH}hJOjMEb{JYaWAYUNmSZ(UTi4cGzAJ61C*U}}65|pjMoM%--C?8LDUdRNI0t$zfM*c>}2xd`8lzZ)~97a@<7 zO?b1Bm*Ju8C1r>RANuAOxhsCac6QA}eEDgDI0Tp=OxD)^8dLY4LHt5IJ%zn{cjsY9 zvuAf(@h8Ib-5Q?i$;m@)^4Os$m+^8#D`(q+_#6%Vx@5(YwsJ+JAN(DNM(lvz6QGZB z=GboPT?;Qc8nTeP@~UJFDrY4dg!nrh0BY5bA&g5_Uy}7kzFW6#ZwI5%qzkK8t!|fw z?(f*PEqFQ+{Er40pUk?{OVcQED8dtI^Fpsz%wNLtvZ` zLG#4{Ap&e!&NvTS6)9Kr;HaxhF|%$yfw=UX1wuj?NX=7v{4Yff}gO_ohsmm6^-En8$m zTp4yU%4U52z@dX}-@g6Lj>V%#x}}AubAoUpf!j%P-au`M+oI@JTW)puz}|LQcxX#U zmxRYV5`_~ zUL$eO5Qr5h*7}BqwK+DHL=2Op*;fxaS@xIP)1%xPyptzSMAv^J&nuoYEA;8iiI7P& zY$qoI)K0gfhY#hUS7%LFYQ#bpG)zG4_^IP<-@*OSXzj~ogzDZH|GaoUe^&IuqD~Wx z2`=z~w>#xuC@b}$!U%U67dvX}W*uSBUiNpKb zp+kFfgNSY02Z8RvL&4{bZxxVXBuj;BZg04{KHmsiNc>BegF{cmAh-B@fsPVhN+ z@L*m!wi@9KN0`L(j6w6NcGew_-?PGq&YU8*NXHe)^Db?&k%kE_2dC#Mf-rV#z|GR1HO8Kzw$v)Z zMOk>A#$>&R?rhYT)f!#`JLhbaD|f!n4PG=XjxP;R3h#J+cxHxXjKvQkPf2QQfo9-Z zlrew+82PT~m=r4h<@hk2i2PC(8K6YwKaFeGg^wgMjePZ2c*KB9L#FY|I1v?2=b6r< z0rHCsxpddUK<9^TMdhktoZ80L^6!!=qfb ztSt%;HzeGajV)|fZCKORTykk!vcy4DmqagQdGK$@!I{p>+hFc!+rDq2-TlyGZEt{~ zgPW}4NWBYIdF><7lQNDwCk)_ZI11_^!I_>%ne}wYZ8GXfW2s)O&DW@s)A|kTqhUSJ z9*#Wjec-{IboO3H4c3aKi`%kgiz1x&T1EpBpXywrF*p{w8oIP7dUy0=L6nmo51e}u zc0v!>o6Cgh7c;#Khb(Ns=nj-&SGGG-I+G@Y=;F9MyA!!spJ=>BMtSL_m&zue`OUZ~Z*I>8Fz1v^p1Gzq!v%mRSe*_7n3pGyS#bgI zfVzf3myvgmH(fYhwDGmk@Fw~8`8uKSX7X%{k%jFOpZY|5V$)-pKK?Z-S%%s1-Cv~B z@x#mOWPsc!h2$^3r*|0nBmDZ^@!Sp7>#@*b_|=#FW`N8}TqQ5ziq>V*t6B*2l}XD8@t5N6L^680Kib9m#CX*Q7m{TF^d zJmx6(LT68h;YWH-&I5c4Bd>Y$4L`&cy$20uuCWeQkB0p6D9@-@y$oegtyE4U0^Asqdey)I3pf@x4vE60PM)m*nCcQh5R%!PFw5NDr@jMISX&R zb;G)~?aIq9YfHzL=CH~YmtEPezwX-hs%x)puYT1l+f8r1slDgR-_ve<)U(Z`?c-e@A}HNB;wt5*S+o2cih#+k61Ajat|4v)H@298=pUG6-qRq zhGQH*s#jKCvCT85qfQTn`U60=tk{M*((apZWOy}S43 z#Ov35^;foQUvW*l;ng>^(M4nJ@y8#{MtI5mkv1AKUL6h0is*?18{HjJ5f*!}AHn85>=cV`i50pE*4l4o!FBnJ#~M zMje0!1~Hb1?2{p7H$T#v6^8DlH%pjw2|Lf5Cpss*+~YZpoMXNbR(i=p7^VpsVe>(F zB)m`0{pKZuNy8(yVtY59c*nvMvGdNBZDVWV*f^3NdgPt?0;Tv3D1i&$wQ1zBjgPg5 zAATqRv(D1!fEO=F+5Ao(f|OHzy6@iS+>fseCC86LX7bY@;1N%}F6R>i8_T2|7Vjme z8`iIHZ+PA7+lI@p48vR!nTD~;Bl6V~z^k#$+|@{qKsfkw->}hH-PKw1;7%O%%bx;6m&?d`o^`Bm+P8(tgW zxTNjawXZpg`Lu4}oba!Mzj-0w)8RlE6!8AM92(JhM7=nC$%c_dqoY}uoEHtOFq7c{ zAB>*c-tdYiqYTHQS8|$iXt1L04~-wmH_C7huDcvZP z-SkB0&Gzv_?RfMo&ae+Gl6cg`Z1oWmqlUQ-d>YaWAYUM*mm54T8JXWMxnxcArV8VL zIc^+)+!0Tvo4D!9!)SmqW%%qp9x?E7z`553p#-bA(ir2)F!9@Kk4hr$^N@IDQZi-< znB8ZP4$QIr8Yo#^u_6FDpM_Ebc;m*-hOqu~=dNABRdj^|5Ek2!7vRXV!{?c1vMF+n zxPbPKyY6WB-g|dE53f7Y>Hs#Lv!D1Arl=3ZMFr3a;_;VV$OwbtR{+|n++s{N)+NvP zEXv~W^`+tceB;-BUHjAD`JL^}Z@a0jU4K=(WbNf``O4@$1OOk8F00`UW9q;*QV2f5 zUdTIcn1FOJ4rWgWKpL4i9^SVVC?ktkMo(dB+qP?W`|$7nUK0YvMA1?+aN1r$U*8B0!i1XsHA+Oqjk_Uz*G6vHbv z{6k*qGpUBBq%P76M zW%<&v0A9=6y2ixzW_9d9Bc~e1?evOmhd0)2>ENleoCo^Rx-t6zOJmlSZRW66$j*eL zqggMz;);knKkQ*?c>3$wp}o7?_@2FO)sp3DbCVHo`@#Kff~-Q0r$c`vo;_H47P5DE z)11_W=|>$lP$AO0Fnaj{a@4T5A9Uxso(gZ`NP==$etI#QWu8l}0!UTssDsb0Y>Xcjtu)rpFo= zFIgP#%HzRDgd7__c<5m8awd#)Urs(P2mrTyDu+Z2_61o!g{M#7aYwu7zPln`7*O!f z>*RlAe;oM;HnI)@5bH|^UTJ{hXJygd%iwuGH;P1_lPTXY(&IU;g5_hNdSN2>)+76@f-eFu6%j?v4_IT4(~V`AIld3i|xZ>K-h3ac*taA1&SU~ zmNh^@55tyvyx5*SJHC^vA%yPuNPy4{L1e=e>1NL$8+D)2z=ym~8yi)xp;w;qiY-C3 z%D`uOra8X9w5?jRE)V-Z8~H!<*rs;Z-S-6;Kh$>Y*qc2CUbQ#U7{;-AC?^)KL)*#Z&L+4Kh(C%y7pM1RCf6ra*fdJ_3+qMQcPb65r{*5;UFu$k0^UJ=htz5CZ ztz5RWEsVy+Dx=9`6JZyV-Q;VOPucX!tVE#~Ci9kzEoxT2Q=dnyTngQesB+A9xJ?r>EUdnOriR1N!VF!?P>qqBh_c^{LAo9*& z(_A1CjCZGYkWzqftocmC=2nj3D2;NjT@h&rWAse|zxs^C$rSanHsdCxYl zKZ*pSo7~AJz2s~|HG+cxHJw(TXz(5Jt(F;$?k*2`>9W;vZ+_gO$eY}a>jw}-eW}B4vxh{KIrQhO^A;?5i^eBB z#oRg{-z`lf1H?m?YL+9sx_axgvM*V_GI|JW+Nw*}wnYI<-X?PILr=6%f9C$SY0J(w ze%Ol-mbA;Rys|A0usnLg8s9TH^dt>y%$@k>C8*xNCvR)t)t~x375Z%qSTBLTcoWLj zEl;%j@4c%%`p84=$?#Z@j2}oqe9iUOx7XkB+IIabU)3(XbWI*+wEy6tJd?$)IJ&{p z&F%T2Z-7ICp4;U^V(P`3eRg8&d~R}yJb|gnRE?2g!7Hw~yzLC|btd=f)z;|G2}fmd zyXLAZ+wMJk+Tm!#4~J~`9zN10qtVM3yK)**FV(+^#b8IhM46`}%>eQR66500%$x0P z5XWRhn2Y)2zHX;Q>yDjVv3x}?2}+O+C6$*Y zWp+9_Z+G>jDs3GwQIE*&TmR%AZ$JC9|0F)YIlSLBA*=A9 zB7ZW<$+yVF`3i*Lg`*CoKN~>0WZ9~=>4~k)K{#ivO%CwY@G*D>nY$T-XP&h+yS&R0 zudv1=+xZV z!c1nJc?$|~U3dAFZS7^3$HN6}$KJi|w!7|bw}0lIwsY5kkcDNBOC#LMNau9(&b_6} zm$mC&d2Q;UMt9-DvCtWHI49Rx6R2So4WkCm+q8kA%_n4k>`0X1Xw*-{J$`h&?c1}X z?by1pJ@U}q?beTeI1h(kxpH|limTeCYuB|`T=(ksp7(xLyY^MDjvmZtyYs$#bLm+m z8aHJUUy z9i1Z{mMbc{8z4VFc*wwm>kjwveCqv-{s-e@LYJRqtSg8 z#?rU3@N8;5wetk5wunb<&Z3b#O7#Eyzh7%Rckf6~O8&aNCKkb+uDf%2)t+G+GyNtj zqrJ$o;*nRFD+R&~o&Uj0^5$so_glAqZF~LeU)R3x2fnX;%Qt^Zb55>p(i*m0#LuJU z?F8u!WWrJQI@iIgnlyBmUUEr$^0CJg6ak(=!w_MX)t2zCE6fAafEm_^9>l5e+{2R= z-`et}WAoa>58Tlnd+eTwcQVIBy-*-uZFB}u82b%52OlZ#08zsv&IFkia+o!*E59iu zXH;0$m&+ET_d-VMsePwjv{XKzVs#r!SC3T=$eP;sTZ(l*@|{( z;#hn5vB%n-ci-C{d30mc)rkNx+r;N)FKYSfr2+6q+wo`!B7=Ox`0m|%Lmx-lrE4|> zU@y!KOB%V*$aWw+PC%IT6>6DF9HU<2SN3EU%!{5IoeHjbtyaNUMdAI6M?z1W8}dh= z_@j3J1NXHZJGMuj(F2H-*KJtWUiXGKw6FX6KbHEo`N^#b*d~R|3uxrE_9vrZFrk{O zV&XH;c1b;CL(Z}uO*>&nD_5?_#>rV6J9h5LL++Q3jfI?MwPo?_c*y#pM;{A5t=pDv z=N)&wQoWF9=ps#x^K_&cK)ygqKn|K8;OgkiC7}#>)ipInX4c&%i+poLD8&4cxHqo@ zF56dimw;;^MkrZ$qG7;c3+YAWQl_}f*1MULUZF_Rro@YvjD^81592=-ifZ^Hf&t@D zUSrS3VR@p~8S^HAb?# zwqslS)&KpgVdw$mq0q|QEm;#Y2uQ{^6M|&qL^B{{n1ol#fO$xbwgLbEplnG*K~&n# zi8cZBwzuBYzV@rWvc2cs?{05@$4%`mZ+=UA$Ctc4-==c+op)-x+VZ8#JHz1;8xG)Y z$5#M07=&y9Z1ezf7$N{ww|lX-oP@{Cn@b9|GQ2NQE@uF@@PYwM*lv1}lam3>^GEWS zQ4>ZF+;?01C4fW`Bu^_@ zY>8J{-BP^x3_c7K=n2vH+Th|{i$GFLyDyioj)v;WYud`ymj+PHX}k9BZ;u54Kk)FQ zZRehSx$JDk%GJ?JSRAr3mK>gM0MYR%|9I51I^q4#kDgMv(_yfu+WrFvgQwHcn^@j1 zzv_y1)zw$GSKsjJc4v6m{0KcUItWymVE4V7oYaum=+f<^j2>e2Laf?JfQ|-a-@ZN3 zgL*8tU_bH1V{ON-9rngQesqy%Kj5{79FFF+2a(d;HULkpizG;sPpSOOT8_9Y<*LP9DIT zr-%nDF0%6;;qq*S0ChlOteN*2#cIwB0LIRF(4FTE^XNVN=CHfBUR;UY@h&taJ99z3+Wr zpX<6`KO0`UP(xEs!*fa_`MCv#KIg0P7Unj!h{0d!*YuJ{!$eccb_W25KMqWU*Smki zd$@^#myEn(-e$Niv+>Wc=tO2*vJs#{hZIW4+G}B%=QXBd5h&ty_Ew((x*34yHQy_H z=7kn^_bwTh^{RjIixKEkL(P&WD=+ z4t_^{)}jC&!?zy11DdeN(KkMcx(MiuE++9mzPej}?j9EMYl{II)gE74{dCP|omw}D zByyYIsy8}h=!f6nexnBfo{-70Drfw3a`ZR8_{zrsCkS!$3XQ!ctikNM4h=^2M4_{l zf$s#ocavYt5__W3?QF{--L(yo`{Bi9WW9O2W6Tl|!HL7aFYb7uN}cV81y2}FL@@ew zvh-q4+-Rd}Khed28hPCJUl_K4m_ik`URKXv9S(^`UXwFDVq{jSD7aq?^U5Y?b9W}3 zi2H`ku=#Tw3w|s(Xy>Z%xsEMFbNcA$XrvQo;Nuz90e54tX$G84I-ZZWY6_$3k6Z3> zw;)(looQ*_Gdl*2WR)q_WX;+hR*J8a5FjQWe{~^Qz~C2x*B5R%q>#w@o3N#AVNSz{ z-yTmey`oZ4&+PR-qoTCkXjDu}H#_WRh%U>!D{y*9c()5NV|03CGKOkAUk1137t7d-pHU&%RLPBX$^I+zS`6g zr40(S@-aSS#5voao!1H7g!O(X>Fk}e&^4fjf5~NrkBF;gXTRUFx9mKuV$zf`H-%*l z6B_Bctj?@#h#vaCVaNF;g-G;OBxfHN>=&ssSBxJ1E^=@+1a6=1ulwrQSE;5HKP4Zk z3>vI=_y5+{`?;{E$EMT?Gj$#y72^_^rRmQUBO~d-xjX0S3QtWO%nu)XGBbr_S z)n{w@Z4fz7LoHWU)KFG2hc0;4C4~gGq^gp=xP9 zw)zZwoLt)Q&13A>1faZ6AsXm;u>x4~X^6L~6t;L>Ue1msYC#djU=Pd^pCzrqVf6&)x+VhV_@>l|1c}dK7|B?m_-i6nh z_m6uMhuy4ileS%-vkWn7MGn!GrrHt0XH2cUryxR?(o_byZNyA+LP%_iqyBuR`@$F! zvjM9shakM>LI95q#|T*(1!RddG(zR1Ad9(S7cK?cjIbA3ZD(HKr@Fs(Y~BZ4S2q~Rp#s>Asg?c=aq`i zfs4SC?!b^m&DfQv7Ih4phezyeftT6JW^qb3OJ^;ukAZ6gZcDfBu;KKBh!AVzt(7={ zDP=BPPi0hsNb6$RFjr7uZ51ri2I;(V9TV20j#`1tw_3XQ#qgVpvxh!b&yu8H7h~&d zmw=M)VkK@#x<-pg2ugqcbnK8n3>b>^cU(FG+-8myc`v8<{%KzCVLYDHb9?0(P}=i# zA0+cw%Q1deEo->eFj~d)BRgr$i}Cm%da+#QA#0}z?mQ0`f`L%m%GoLFr4pX z`Z!@ME%lHd&vy)6J@J0G#cpvhnT@nKp?_h5jRUj-q?MMWvt zK^aW|_$(>%a}N-^uI$`7y4lO+^>qFer?0Lt`b~?K?MgiN#CGJ8nhQQ4D8RZ10hO7> z?p2PLkqHhtZUUs{yYidCgJ*RX6Uk=JSWB?jVR9wnMox-@E` zG+VC@Jh!z~8{_LM5m}1~q6*o`3z%tw*FkeRc8cP!B!O_j$ay zwq=?T9x}8+Yp6w;5`vF4i&R&Hd3YOpZH;L3oSQYov-iFhm0vmkqU^O%a&+Agr^IEP zpvIdlU}vKvV4c-?Iz5kOxi8&%09o-TlCvtF{7KNB=$p8NzYPb7s>}nxEj}FbQ-?vr zFLuPHr3hEE-o~`-Hh*TZ<2}S!3_6#sm;mP5J1NncC-`;BF>PxLab`yS)J_JEquxTc z7>wutlq!uC*>E(i@be0)*D5IY=8iF2qk3uUCT)zcU%TB_USGr`LQ_A;cIez0IHs1J zkQ4`PO{q*CJff#%Dw$r1?&BRWLE$%#)xy}vOy5*1lrP=Y!D{XAr|iM^CzgKvOBXWY zpeb!GaI0KWy7W{@OP-QRouN(1nra`*h_lP_fr8)<-* z%LW6HO_`^Nv1MgE%X-A$r@R3{l|p@=FQ!W8bGWFQp$^~no9+W#ME=zx-|eVxou(E! zyG$n8%<1~BH_bmw31SYmjbWA^lRZ*)4+0u8kbQ*No{0PHy1%w;zFCQ&j5Q81>%;M` zMg)!XJ=6${OQ%}xj&$Rt?=Vr-*_xW|_(Dn42nqN$+x=;X2{{@ZRrTBsm_XN-l;C@m zo}&6{_--&z*Bp)>-&)1{jC>grrcC@flIK{6gq%)e_%zSdgdvnt(iwctTFzh+Qb>(} z%NoyQd<<)4vLxF8&DYvkk_Gb_SBmTh!@PSKt2Kh$^Hgk(mE0?aR=0RE9xcD*Pg5!E zNJI|_1z0&NM8iS~^Imoax(FeEo^{N zGZ6<*)v>m*c1=2rjs_cMtC3KXOliIec}xnP`aum|3P2r6uQ^N=Yy_P)pI|3Qa4b+VvIyz4Uyaw{8y7@0GO*Ld=tGSF7Tb~drxZmtgOCH6eT*6m1W#x5tFqm-Vwm*})biTj1BxXN5E(Z1yl0SXJNRC*H9d1_$%`Fs-^UO_2 zO}9FEIxO&}Ihz0TuY^d(tcS9%>vX$eI zGvpBCe`Y1mbO{;hmt5PTk3Jd2IU2#Y8X2CBEgIH+)dMVUyYYbxjHHbA=ps#U92Py% zvz%eLfIdZ|k!2ZRo5jx%zC=8nk2W7-R3l+3(+1;YEcE0Rb7~IY^#PS9-lRlyPzS-7 zmu4#YbarJm4_QYDc*ccfzc)ER-!a`9;?b6&xbT8<7j)t>9;WisJHOfJSct`3u#>~Q z_HW+kWBHmD7lX`cMp5bfbpY0;4qKj0zI)jEDmSl*kJ!5ld3 z){@D{ygC@7i-?)_eLAoVT2s+2{b|%$bw+%Trk%sOZ`9V>=+wem*8e9k0Vy+=S|U6$5q=+R#FZLOd}#;b2P zw|vYb^uSC|W^*Vg-OSunM2OJYO29Qz_=#8oWgi9DcPn_3iiyRo+NXD)=|g1;l70ZC z%$Y-$914{XH?yC4J*|-Of8+&GpVleyH@w2xKZ)5aL|u}+%m{9M{6}reQEnkm`a*w-`bko&Hi$rJc{P ziY+MMD4w?KzV28FCN9t52Rd5#L*vL@=`4Z)Kf9=b${WfNqXO}yRbZ!Vg_M*qMMrMzf+!DSL;B&B^70S{QShLgBFDm1a& zsK;L%{Ls!BoMQ}i@!Xs%BW~n$$dgEdd#^e6^tw7O_x&)zu^FcHp%7Ce|E0H(Zu!_7 zwX!ctg(IR}cts3VVpF>&`38=ZQDOak3rKbQv}3uEy8eg4e;l#ACPP_1I2ow06`oSR zfxp3e0m>cIr|K85;pHbqoP{&aFFdfx0pg9uWDU7aRnPa^2?@)i|88v{B&i#{uRePn zq_j3S@1K@`x0x!ny(Zry7jUx&ey(wyj~0`41j(O$mZr)I#lt86K8hD4`jIo-W6?9f z)0R^(hCqIYLa#}UB?c(TFfPcaAZNM$K0a6L%*sh9BMfXA$U?-tOf6tk$9Ll3E4IaI zP%cvSzB%gd?V0D+_TN!v%KqurtE(bZbHkpx)P`h9Now@}U>*$|%)-cov!H4zm)bH$ zrUrlc-^;M={O1}s)o}q&yQ5B`aT3=}B1wxj=&4LIFsUT$FO?pakWkDxe8qJ<%25RC z0qD!|ObWX4D6Ktj<2?K9z`s(Csk-_zz2idjKf(Vl1k=Wm%56Q}T>C5nFogf+CPo;i zBp0?9H6EvcI{@_~d6|1;FCUR7Vt3NCecEUR*4jTL8ec6kHX=4=>U34N3kD9xRi@VR z)PuqyJ)xc2#J(>m*0f&ewZOs1nrF=%Tub!6ugw3vs{9^QICM?W13^7Ijx71^sG7Tf z(SIm-s);#Op8At1i3EBaLbs51ky4Twgms9p>*E~no#QuM($uc~2^{HbFW1l&UY#P6 zG|Y;T1tPs_wD|S>`n8kexX4H_5<}DLNiZz`i%O6(V>kZH z5cNjP$}x_yq2AJhz-nLxpOrQ%`G9`J!C>8dYoyYO&r(r98Rd9x=w90oDEp+MH2*h0 z;!BMrk@wERo0Jffk&G?2OtA*ZDVWv{Xqs*l7&yqdm;Fpz(Dwvxmq*9^Eo-PJgArD9c zE41{F6imRkSFYgO5K_rAsDDPIT=gEBe$3f)EBLp_&!WA!hQWaVfPIaJ-_Y%xf1As^PSRnStL)d-I(fmMjK2&jlFH&#(CC&y_Kg z*G?Aq%(+e*Q5YRoZhVwTXoIWTpF6z0&uBlYGZ`7H`+igcIFv-Ex#ps4r_1fj8_)jM zxeY%X_SzSl`wMrpnXd!u{%eQiS$HpK_WyBnS$zX=-co?9Fwm#xm()At@iq%?fLD`@ zifjlO$6S4$l1dkLE0Oia|Fx99B2!ezPHqrY0f zo2*3qQ-O%oT9c$}7l-bPN191d_5gR3ffO}!g+T;U$ROoo{@$N>+^YHj3+uT_nCJT6 zI_|b^eEKl@eSlRP{{$kWjc#Sk;7j3rZv_r@zLB6tikGjn3pa?su-m!kb$dX;OBp09 zw6uI*e%4+<>lCAXuySo{_$hEqRMs$ec_6IoVpzLs@HsX~7pIPpjOiib1k$wgx7fLP zAL(;F7maQ@Ho>4Z>};-A8yvUEs=vY1aFz#C$|IcwMwC>)B!p1@(ADqQWwNlxc}Y;l zhM`%f9!viPa;!l^oSeNb+OIL6`%#pHxq`i~*F1TrXc==}CNI697+MM7W@%xz+~JUH z>Z1vAhkxz<>)kxT$`GMftvnwMKwh&TXP^rnztJ;Ia!rQ`g=#0bMf=N7s}O2DS{Jqz zq~5rE773{UPx8$8*# zJLf|#i;RwDdDyUP$ZVB$ccP37cdOMk_EQ6PIb*s4#9$Bnp~$5T#8G3xEx5a*6Fi#} zR_8mp=XROTj&);-I7V-~BONW9Hrom3&bIbhVtO_l{15(Uhj?$)gvB<5t$`c`2CRXv z1%~waKc=Yb1?Q|}4^|T{X8cfEG(FohAV+l7)OI2mR5Z?k67k#W zTwmpa{SYBgU3q9(VmQ^n%SQjh4yZ?B_FDiEN z+M=r6P#LG`KU`2{@-4fPhtUg!HRp?de$jaPcqIW9N;4}jqj556fiH3+mYw=n!aGq6 zmX_WES0kukp_6+e@BVxfi>WV+ z?_d05sWA(6t0OJmteaGcsg<;JuUR)kfzboG;L|F0@X-yHy6Bt2nolLWT^AmFj{#l1 z@%-CUSgN$mNv8IcfKqF-2kdd}GMlcBp*9&?n4$mU&DO$glgM-D_&QO;z6TzpQ&b%_ z!cX!nRiF=++G}5|{rZWXTc@inhxbySu7;pFli1hO=>Db$TC|uik4>k`^b*XbR|G?E z@GiQeuS4$0)R^}7o{l%}q}gEqAE0D7pncng`cCb1kJ!+5S>q;5&e0Jk^(7utbYV3`#R>Sx`uM^NMDracch2IWzYL|u_ecs2R|EtZ%`DAc zntTAK7#>mzEmaXi(Kb_>(qOoC9q3kbYuegF{Jjj z?2&^U1N0D##WiD3`!l+Ti)`4BPdIQvt4%g#%n+O|=Z-_rT@uGDCMwEtuFH;?Ci z6DPzWo;6$QE^KaZnfapYr0w?}ncJhU#x`Ura{cFF~@PDog$+ppA4xa!-|HQqNB!nmovFQ$y`y7;MPTMZz z9R6X~Tl$l>*dGD_iT7ko*toi`emo~&@MNiFA#1NJ(h#B$cp9qR28PZ|Rc8PCzRvTz4xP1x#G}xhSK{8;cIUyNd>ShSgGqEw`)NCuw2dN~ z0Lk~hM}H6tE)9>pvW>sE`{A#Iu?6n?SoI8a}?LizYPN@Gx zTrTardj-7_AUf84EcAgj0qB@F%ltw8PbU+%F-AywDX!Nn?{I(p^OrT#x4{(d&@FRc z+@xS)9K|k1xqm>vy`w{KPAm{M=oBBQY;`_axrLOZWnF&CJN-Z~Kh8Sz)ucPe0UWz$ zri$z0+^u{w^*{qe)=|9=JOA^5QBsND_(+tg=XXr6aIag{#{%--nP%SSnJ{HMdf>#K6^A-g^zK`UFRL!i)Tl&IIoTlz z+tByp4m@M`OKLQBd&efFq?Hdo90nTQOn@!U0=*$-^OW-5oNXQ}Gx2p_*PlrS#fR>{ zQ8GMd5Dd0^Ba>cHJID5j<&=fgHc{M5<3x#`y;WUy=P1KK4W-EBbjl-xwk@l*V;_6S zXLTJzI=2;0icY^D%Cb488Mf}lO;pd2nI#Lo;fyAqo18XUy1OC2IXx@CTW_@~_gXBT zOE+@B9b~YldcoRFSA*m^cc*M1JZU4yres zQiG=px3F1pov~-M<2at@s6)`iQ073pIvV9@HI^Y# zBmJa;-f7G2I5S;ds}hIcqCZn(?DH?d)Svq@s9&^(&5CBZD=!85D-CQ+Vp!zTP}5jY z6(|7Einanlx{)Nd;>Cd9WuHFvDPOV@F@p-%@!93d}y6F=IS#OQRl44kZl{r>l~tC+$zI z7m$Z0mEH zcWTQK>yBA))IMnMcBNMw)=b!g7rTMgDlO=iHP%GUZPPg=6I>QENF!B$2o>VfgSk0A zfwlOJzHGLKZ*iV5RgnHupSsx9A7ME^};2!hrHH5>GyBZ6qVwX{L^4!zj79@!&E+OH?j~~-=C)mhLMQ1OjwkaoSbLrCja06v zrDN@0#15kQ@8Cr-6D!opKub$lpmGi@AZC;u)vlueVY5D~?@%dd)e#G#;X)h_eUY{vwZ4#jLTPLTfBIuhU>{UOLedrLR{7|-M>G__{RX61LTtb0lp1VDnmfr6&TNAC0X@fw z#${;_6-6X1gvN4wLh*u=3p$$It!_-nEFjs16OAr}+LBKt0fSAhR^%qrkNdQ-cCtiW zqd&bkdk&ZNkm>fNrN_3Ux`J~J!}J89Tx6TSYN?;;8efKkt~-^;2#Yp}zMJxiQ8SUW zoEqvFQuf5MH32o;XG$`JNdKtqrq2f@N34b zP)$*iN$N$C^mn1=S^VD+`AAC-@9&7?hebzh23H@IegRGMR)oE{dp$5XK{!?N_y1C7 z(T7K~=q;0y<|CEXI-d!5KR>Mf0b{ADzU;kfx}OXD1qcqyoN=+Ace%E&?LD|Cb@RSw z2ixBLsl!Ss&f0v8>>6d-7A48E6{=}!11SsV-#~s9Zs2ogNzurQO79F_z}S@(rf~rt zWprY#u@;e1B4wFTKP?@FEgr+a@mTgAUz9DM3_cD3j%<(0?S_lyLFrqxoI*e0c-bT- zO@FbIDR6na>ip^-J=X)z-Tc|;vK0L4D5-LT#tOqqQ$x=l$}wW8-Nob;Rg;Xu7qq%A zM)RwRxeeoAkws=esRj+M|7ofT%;AowRe&kMx4EV-1Kx`fH)j6 zq8OYs6}W>_cHoZ<{AK!0gI`K3phqeRP9##}^z@YpySB-l9I=C+>shnn2&?VHZ`-j{ob$RA>%nS{l=eb%c( z69t-3yk8zD9T#o|pcJLNJ(GtkfZI3I)lmZA)!C?W%=DPBIK9Gv$-=PO(?Y+|!FT=` z3!u9|`q-TndJ1Dgy!D%GZ?EcPS6xEoqw0J@$u{5r=oPaAV_OwaXvHK2+|tl+*E%yz zTy9`cUv-(Jv)%IdhePJ&Cr(v0WWS3X-SUx^%7IB{sH099Pn;RJTK+DSw&H<9ugOl}^vJG(#4puFS^|+f4M9(BQ%_BqY zZ3@rrZ6oF&(oQDI*lrtPj%B3)qEEuNBfjeuq$?Q{EUp22Ek;Z;^k|dqL|Nm-iG>k{ zpl?e^Cc3Ii#_uG-Xjk!1Ig?zp3rSe22$WG(cjh0OTf*TJ9p%u-Lqs(Vzm|9cibI8_%MumCZHLuy_agQk*$ zfPAFo9`F8Te$rxRqGJ4!GZK>#=}q-LZLAxx7U5a{7y-~mgk*1~f2ag#{L2$p3es7V z3BQos6Y9A@>xG|Z#Af9fEniIqANmz`$*P1crgSy@Yjo-KZ&IUKT)krQi*&&$Gm(^} zdGrg0Q_xzk+(M<_D5=hDv9gVq;!Qds83N#sseyc8G0e;$PAFOPqu|#hvyc=nj7)#0 zn6WxNByPW;uGC4VV_~&yYyV(PN0^R)q9uX^{|5pflEwMxh2z8)cOe+o^CW5!Ph-1q zdZ3t65?Ge;BsRuA_Y|CrU|s#}6}EHHwx zb@n+qeFdd74g)j32bj%%&d7)a1`Jb;zXRf4tors=!=-n2sEjeX(fdZdxtdw)!g%YM z(T$kQ-1=1O?tI6AM4?t^kDl8bU>1);v@ZV3lHV=k+pL=ppVtqL2KAkYSx}hztZ}BW zT8Qg3f4{7%P-bNz(*O-#92uv$e}mp*Y;G)1M=KK+V|!fKPlGqhjQAtrorkUW=l6FQ zTyuhQH|=-VA}7brTg24s86)06pLP)*kIjIGD&KnCZ&f{ah<7CJO0s?SQBU0EdN%Lm zv)obelS{3pBU@l~$pB*QyCUz<%_~Uh_GOM5}E|0RI zHkx0q&oE8AF*A#n%2~H=(F@#SAyyY>A75Q>`<&62Pn(-4XQga@{HL29OMoVh@pQdUX zIhD+kxYBFw_05x-J3IBGf=9|dNil2!p1%qvflIy5kbNA6x>g{U`FFNA zo8WXG%yZvp_bwc4hqO}k=RXjbZ1kQwV?6+ z)wCr&++Z2$buf%|krK6;0zDYmA&$8|Ll4#@x&Auj$?RqE14Z45mV2nRWVqGy?N|;b z?{kQPhDU=Z{x^np^9lNzum*o}w-a)UcT-DO`j=k6kauS=7$J*yMe_>Qs`Y+j=_Vb2 z#uT@u^@y=`4C|J7zF}{TN5^_U-+DXmfzabTz!Jqz7S_*U_h(BZ*FINU%5rnQ7omO< z)S;{I4zg|%{Kokk*5aMnq;UECwgqnU@t>FuD$v{$`W+G;!#w5vSEXBzrRU{tLhlcG z5X~BL_s4Qs7UwNuYoyQpb~JAPoSokxmuys0q>gr-x8?47?|*^LvOI{-&;9PtVSZtao=d5%-sJS-;7CTmCm10hq|OLLN!@=6?@Jjxh2Q z#PBDZ@F@1_+|6(LJ9@kakX(Gac>2C`7sDh;F>-2ozn68(B)IQo05WV_%lu~VF{nR> zjiyJ)JRlqAZQRH1rnX+t-anOje?v`r%nC*#@B6vc*Jr-QTHCW} z+Q3;Y1f|6oF6h!;J<&ZWgT~{;eNW<3A8{+QbS$&kQhVlpH?q|4jXWt3&*zE&;4PQA zP#iF7*1KcPDmG;l9#0$l-EQW|4FzJFQOpMt=f$;IH~m?v(DKHeziy|Kx|XT_rhZ%a zZB$lB*J(qvD^}~5{0ZW88J2Ysh7VnFI^7ny32u#b@}6!&CMk&i%pj#a!KvLEY}p&c zOgs+h34tf+UW)#>xEv_I!McMkHWv1TjfKkHtek~o;pofNOvVnLt0d#gB)17Q@qCcn zMLYS13~5Z`?qI*Ws~@%xQipZ*+LQs7!57)to1^6}0_FPPhXh*`^xoSkzSdaSly?s1 zJqY7qS^bS2G53}j6(qFD_e9xGWL+A?+*&Wferv6|j>dUJU~Yx$Ku2hP<5N!j(xs~c z0$H6rl&5(7->}B0+Fa=2%(e#-&dZ!HB(#AeG357$&YTtqXLfp<(LAX z;a5N&)(5NdBi+OVNeRK8HkBuQ&{4b~&H16^Vh$;4(jQx~(K{h06#c%Rr zh@|-fJCjT#(nUF{<*D3PW5F%78O!x&^?`=F)7HD`ZLQO&N&DZQXmgo36TIPHwojWi zJ`(Uk?P^54aR-mJ*29*3>jm)pR)2Bxja%IRC+%EAPy5|YJKsR)xFM->cPKgN5)S(T zM%?dMT$n88;|*5cYOGQr$*E|^7zvMU}jJSbrKijop(EOaHEdRJGlrb3<);y z!HrDP4KVM=Kae|7kV`Z}|95Hn`KSY)2({X$-lQ0W@6Ds!3{N~y#V!5TQ+?;XS*9OC z)_qG?Q!rnnTpf~RXG{p@Xj~{Vxrw6bp2^_pPqr<;qeRxs8 zkN_ljkI4H3f0qTb{I*nIIryuFR^v3MR9smT8~)(F|2vAq%Pub2BS}<) zPdu6Lk@n45K%K?~$|v2{nLbyv>`tZiL}l}}0aHiJk$aZ*(O6*%+z`=KoW$vIQ+R)p zHMgE(eD^PZOuQ*3lAZUU8s~<-5%RwQ0!R*%9-M##^P}=^`?DE3`L4rv- z4{6ZmqP212uRD8;O+8Zm_F`@;GayxsIh?c+S8aoVT`6HNOe3yLV?|rw$W>BS0Km|~ ztXIe4LPSj8@fykC@lf0RHD#86*LZbKxU;MY-VJ2*@iJbLY6z;{UNH=#=esff5VZJs zWI_uYzn*?j`=iH61mnf&{}##cmG(|;!-q|iQ=^k+^>=7uHR0Iq#d@(8`dTy>d)0KA3kIW=$H2uBebIh^ZqJc#y6#;{DACV?F zkIShlzO4KvjufH05P}l#J@zG0K51G4Eg9cV8mmF?uyaXk!wBs%Hur1J{(CVaK+RT)CoHk??olwC zwnO=EJ##N+ch6l41`^6XhvnQwGA2|HdTxFnx)C$-ZNUtU5-SLgXBBig^R#h4H$(N$ z4LS5OyXRRF#sb{5f{T;rI#KaZMpBhikXS2}pqWu1}RaW$JDyPqT4?|qf3#DK zp&(;%qnuk1N`fCvBML*lUwL?{Pi>+;DOi)FlU!A$X468yx$UU2?+nJ6;y%%(H;A)r z%N^*%!!$=$_6a9^jU03CA^10-$qNE(kUk>cqxV=6To+Jf8499ZYL@jISf*!fPpLVa zFI?5D|5L}Lg7CETpf2z8*;dhJ@aYf-Cc((t#*@i>L)N)TFB40&M4w>(z(Y`Mh{RX$ z)oy!a^U0MEwQ=J*nt1ayv_T+4VnAyp4<&wA7!Q-64$0`EE!eSw(DhXR8F*^Y|68Dm zzESY09|k>mlR7>$wQcAR4n{xVQHAlg2%Gx>Y z(D|Xqy~ROx*GTKWrCzaf#nAV>^Y@>QhLBEDxpI~IKM=Qfx>wp`mlwr0&!voI%Vb-} zfh}?wy7!kKK~v60SBT*9nk$bh*^F<&yD64`v1a z)%erUFXK9EUN0&eXE+vV-y?U<^EJyA%_lZ#?-9B(C)h@j1_nLf?-I)nz4DY&rJWEf zAkIV>6;x@Ro_LQd;+RvfO$wi(nwTQdZ;H$BcFISNNtpmB5Wq&Su=?mPU@(yByRi2O zs+uin&z8VG-yzz6T@k|_?EZPUn*eWnHtv~R`a`IOhxSPMWmr%P?eTohg~q%Kx1T0b)1{MpC^Y^ z;A?ylGFy-P>!qxwCV)_|i+{L+LCu?v*>8WTonoUS1pR3c?K;{&0L!OW4D$xys0Sh) z*Zk4lXfj)hX;Z1yx4N%qx?NKl7K z4Wo?VDcGvw56b6uugJeCKz+ zbf03$>6K6c3N8l^V9I-xu99G&8%|4)gru6d3x7qRk5kJJcAg~WtjXoWv+#S_eg&hq z5;yTt-d(4Ra&J8$pX|2B=)Hdmz`Ym=51hW}eRQU@Pn z0G6(!5p%LHSS;8>eSJUO=L@`D{D-3m=@Mw6c+5uZIEnN3F`X#8IdEM26kI z?qfNTS>S5*WqiYxj$eNH`13{Q)}LhWW1vKV_LxBGTc`KBou52ejka4O$Y_C7)}u3m z%oNB%(BY=9sr))S`rvN=!0vwqku9C1RtGn2;ZTHizbf$J*>siK$0~)@6ZAl}sh1>6 zn3tCO4h83fwxWYy9DsAG*yW5-#fQ&#EqymEF)iUo8>Z!6TulCIY)tB%RvE7qc^-DA zJM%;Z!hPKPNO2^#6x}sfx@nOS9GM@L0y182{Np$J8Gg8s9=$GLcu=ezH}3S4>_ckg zq^V?L>dQYhAHKaYUE5Y0e*Qu4aM!$4>VX=Ns^it(gMUUcdFzT$$yVJIozFcyhFR)o z9lYgTuTIU2Kx7B)q3>@7{VoOM9*CH4{e16{2xIrL=FYvQqLh!VZ9IJa;mCEdndfRF z-F~D7C)hiW-MFxlG)qb8+qk=W<@wR=fAbh7mi-8)R!Lb_ao@{Kq|GrlZV4L=^1;aC z$RsI(FCYb0@NjduA36GJWNjr;0=RyLp4av}8O>-3$pX*US^N^Zh!5~iGES9Ycg}(o z(sry6R^SO8K#vVBGoih0bOo@4A`MV{XrM<|zHm|&@zRLB4wp-1$EY&E$GI0S6^-0I1?B--Jy>&9~z&tO*$IF8=(Vwp~!jUcf zgV8%5&z@iOq;22igLZ28A54Q$`NSGy&CJv7dyfzg-;d$wc<|t7SK-L9>p1ibXl5>{ z%<_bo0g1w3J5P-75@UP0SfT=}gVqlWouY#|%sl|Qk47SLG9Vo>5wBH@QHLY$Ey6go z+zkA`B|@GL2(OS5m6If%{#W#-tsjyc;?j87)GQnm;eYx|@bje>6Ew*ZZi0eE8{Y`~ zZ6G*|Jvm#nrAQMY;~!*c$q8FYY8h18cIlBBT6>=^26AjRWGg=S%0U03{vKe=cVrv1 z-@Eo~6-OAYOj6K~;hhS|IS~qCL`v}55^-W6ns%h{>1(ero^s<$65;wTwn8CnW178n z*Vdv+YkKWjnJ(9n=Rayqf-3nZKc($I8{&uoH01h%kmJIhD+cDLZ$seRq`@@-S#SeD zU%EusC9mIlIfnzl<0e)bVDe9%6k*=O`z&4PYnJDyld$6eOAIFb`SMeE&qvu2NWnco zdv1--&?%*`9@D|@gPMuubr^d%iYFgDbPW(?RTHy)hZ>m8R&e=nxqh%-ggJ7ft?M1h z#4k$W@hK1eOF+PK!KQE^oQJp8TXtoCHwCCKw42Gn*u3dS6t}?d!i|z;FB9#y%_vl} zRra7II3ki2l$Q~MWZQAq`GuIVw?(ij<7O{!_SWq{N?J*`leR-j(DBeue_iM11D}Iy zrr&;?B8+&CTwd~r7gY&<3g3oloKtDOqN2H|w=B_v`Qr#{z7{Sk>@InfsFbh&`hMN` zZXMtGMRT~{US)4p{Kp?tmB^o1IU*{D`?-P9$gjyKAM(yy?{6iiiX#d>ng9Hv;4O$B zg^!~xzpeQ_<-Lv;^0O9!f}THPjJ6T~`m{rA9AqG9^Qmc`f>@+V;2LE^`O8CoNsO85 zGyBVUT13ps)kr<}L&R%dwSJFWIAIl@L}Cz(yxu>)QpkISHya#+TQC1_DA4u zFpvUN-57E`I|(0uNa0`aq;xnl$SmTu6hvXAV<-OAMArW8dVn9R)*Rj#rBm5HnpPLR zw4{_Ps$^Z_p%eeETzmhtlK!8nYY}|}fH6H!qjNxxm;YOjjP;>xR(AQ<2p>Wwe^tZp zdG8V7dFxMfP``)TCdbmv<;s}XKd^_`36@Lh#@I}sqD9A&+X9<3zJ=pa#a*4(`sTKZED-EB| z&|^UPF7a{9{*eSA(2lBYBA+ktkIScIp+ube@~77ySFVrpj5+MX*P&(9c$@815<*h% z+a8KMZzDcf)%yG4{Ut3q35)UgiE8R1ZK&=#z{8~ICH~pC>A%LP0ek}&UK|NYOfr3D zO~~MfrSE}_}n(&IvFJgx&}5PA%K@mAS;yQp}T z`Q6ep8JEpW_X70K2yah*S)Wg`>!$7@7m)4@c4t8*{$>5EP+iiHn#s7qQFED;vYu9q z?q)tM|3`}ym#d`j`v3Ux5dzXk*C^>uiP1>o=uQCxVmL~=MhK2>X$2W6B^%1<5NUW5B5V_+ z^~>k?JKw*)|KIz%=e*9j_jR9-j0|r!poGWPT-*K0vt>WzhsXk`g0+IO$8!shTx|gjv%*bf#~;lh=9Bn`Z>wOJ2?1Ul z9$R1ke9=-GEVh`t z8$IR(UUb&kClXHWn=uNQ5Hg9#5FWa3_^Iy1B7#FK@^{;QqACCx#jQ0>pZ9g2k8`Bx zs)=7|~3!q3<^97sDFsH35LQis|#Mkd%X1OQOXKnt%zS>34-GJz*;a zjsB`T<+n*a1EhOQ-=m1l`FdCz83N^t2gJ#Q2Anwt-r#m-ux|0=CJhI_m-~J#2ie0c zsJ6T_neMVJ*uR@kxA@}(Lh!vm(hRU1Z#qmhe{N(1rH&fWitcV^nB?B7+KeZ1vK$tl zmyva(fk(27{|#A&iDkUrEtf5$0ErKQI2h!3g-db`3di*NrmKDkiOv!MLrLQ2_9%2U zP{$m4J^MjdO(yep&K{vL=;RuMQEyX@JFr#h?uh(^@o+4z&e=O@x>W5>O9GFGO2*8m z{^KezBrl-_d67oPOD+R*Sc9cHN!5eS*<3EgkKl@)v103%=O zP)7mSRsWj?kTiHWWzrSeKylt*i!^>lkOZq*Ji6mBoP{ zt)V+!B@jlWA5Cj5TmwcNz~;F)lF5^(b#bNY($C35;nX?sA;0YY(_C$+4t})VlPMAN&1K;?g zc6xujUz+n&%nbC#?$lWixGkn9Oa?5g0d6?X*I3tb)`&uo8)+2=7hKej#_iZykS6FGzQ?=h_>?3871hJ}QDLIigG1 z_=^KZHmA`iT|PXy@yuVse8#oiC|n}Draq8+@!FXf(YNf8l&n2T5GB7;Z3>d{5b^xD zH%&iZBPjY2^mV5TB4s>|`??olYrQY8wNYt>z1rCEP)wBB99vVz<7`ZFx2?|N8<}|x z**wJ4y;aT;K5i^y!M>;HfQ{S+LP+y;ZUB2u7RnB~$vaaZ)GCS$ka zY)`!Pj;PqJ-mqm~hr7$?+o#Zmyt^Ai)xc_moA`#9(5G9kzlmTDTI%a#cK-ZWq6@WWvW!szE)gFguU{0m zFpQ8<1>sC9l4IKT8M(cw4sIRQC0w|XQG9aD4t+_KKwE2L@kCY)jV_1o^W=cOi~n-t zBeIc@5WTktMG^|7=YztWr|7=n99H1$Zc5jCtG|B1j<3c@sUky5L_Qd=%L26SxYs_S zw3_Mx$SI-mK9}eaR=EhBNP)=I@`+>c2&Pyy`zVV?_)*@E|=)iS14yPIO z+lT=$zXc1#UCpp-{A--f5)9GUqm{%!tU^92B3!|j$dSz}%)22*{C(3NLU(d#+WrEO zW$srx@bu8OZHNxCc%yLW!7Q`vKqkW`^S8>V=>T&l5C%^$iCUKW_3D?Uf@!6;fN>|4%g8b0yS&9;@ zJimh=1}6~zM;N9DlqC+5^wwMLlrDQ6mGZ#67Fbt08tqUJ9WE*wk(&pmn_envT>D88 z)!hJVV23)%(@>)O`@9-U6fLLJkSw~JhRaSW7U|HS$8P^p;)F@svYJj5P7a6)#EK%U z&N?{HcC^A(z#aW04^IOgRP`vXdzCij+Po7NaQ&tHLCu1F%*AE;xd$H2f;&=iuqGLs z7@Ir-(Z>4>6izJ1n#3H=T7}DK-8{1SkG0s3`feF*xngmcoyY=j4@O($Gq2;EHf)gB z@mQPfhBppG@tIcRaw>yXhn?Ia3y#|(n|elT``$haTTV>w5eUbD$ccV9OaKttFs*6^ zgh~=6mtOq#84gBPwhaYGPrsQDX?ZqRuPuUKpLYu2j?4Cr5XlXvUzexQV$&OMQu-Yo zf|f6l8P;YqiO%oCnzv~~Lg9dYZP*qsER23M8=q^VN<>`f&o<_Mb9oBKZIcth3iSbl z>ow5_HFC{sH!Ex0arsIVLyt6EFl@Yq`(&B4gGprnBWx8Yz(OU7I<$iVTyfeo<=X6V zS=7WZG9nxtha~ghg@^b4bb;eetY`^u68r_BG!Bw{1B=Iajg`mN+roLcTTAKfXqkLUo7TP3(c zhT%9Naw2;Np~x(0hd2w`@>t9{5d@wQb?6CydQLXAh4u*%AK<^BAmJe`pl<3uLYcy^ zE4g9#*?{XQ(H)BiAyOQ%+ORQRj%3qzWOuHc!%^SWkv8Nz{3(~bv%+K@mPijy7mb4# zHu(?WT|2~%j493kKwse= ze9z&D%T^lokE>hC^6#u!q#;jwOMD=0HnzT#_0m$w9@MDr<;nxrU&sp|=bZ6wb8``| zeKj#z-Dow|VwaRi$K?w*$Z346kA<%A z!Tc$zF#U`nb8fnVPA|jc8bO|&{6y80W#MD`jOp6dq`(AaYN+yq!UbbZ=<}$-24K>q zdCm5tW}5g(20U)J5XEZSTx}S6K_#6ELd*$*ZiYFr?dR3MF-Lu$AU1iM+#6OI=F&Nh zEp@l_b#_O@K+cCf@xO?~o~pVBhDfi6ZjiPJ#lGM6a~Y~tod>Rtq16=X+w3`sCnIl0 z#m3jw)O8~soR|fSXChTA$qAL=7^~A`wO;rB2>yurbN38TaEEAr-?x5yg60Vox%rSsyWqGY9)UU>yUHfP<AttQTt1hSHV4t>*BN%r!exy>zUH%ZNauuy z3bxxrW1(g2i`MsxrQQcw3#c-SQmr1mLKwZ{1Ww6_GO`!NdBQ@p?Pg^RATD*R8gq4W zxjg{w*f%JPnj1cr`(V5?wbNTc0q+Iw>VVN@8Y8wGTf3<2nuOVw*JL9QXHWVM3@1$_hU;w&qQ;d=Kw%)Viz)smZOy@ZFh5cFL zn;*GGT&G`T2Ojj2LK2L*BJa54W2J-sbFO6#4H%2HdOXMmp1#+CRpSgAWAqub@7SOm zqVnQ(UdoK%1*gXz)5i02I%Uzsu=QDVPJ0d|{8Co*o2b#hJG#CxQteAKmXv8-&BBuD zyMHa@PWg@Pnk=N}e)9UcHsVeQX!nKr2Y%+EPoS+|vO>Jr1~M3v&NctbcS%nMXj)6ZDO9pjvc=`2d$Gw*r!_4DpPj?PI&xO&AF&7k)y=J$S z5H0cmKul~Es|L@@2r}ZlcrTYHk$F7Gdhrcc{Be9)SYS0>fEPWizWM+*FR*^+cM{t( zO_vC-9}YL-i8-g+U?e~fhym*#q&({VcXN!jnoBj??1fookkE0=INhq4fK}oTXH1~&=;!MoF_L2kZqDwi z+YHNThltHWJI$`WXLJ1@Ak|Tpv^19cwX8IOlsFSNJow9OtZO-LT0l1~7bxklKPS@O zmdWRe_(hizp_?I+_gDhFlIi3!6MDv6d&dp9 zUP8k#Qr`|%^Zjed@y1Ai^*fe~1e4iDAIxrdPgEYzxWbL6%8d{V)$dFCaty6%Ufter z=Q!a%eG~4ToqoOZursqw-~t8c)~BW80ACYDr7>{w3J{p`it$pZu2kT+XEcGQ^N|0F zCDp|vr#SIrP1`P^e;(5p`YOBLtLd%lu{77={JTQ8#dunRXc2w08+uxDwl&utk^aMz zNh4kxk$A-n43vSDC)-(XZ13wJkXL;R?U?b04m655YA72>ZHP1qTVA_q8xh)E^54aI zEo3ap`*T0`Qo}T=Z^Qs$u;XT(=DcHJ{c`23cattLKSrH#!iJO$l=G;B)nnzjCIxhy z|3!Yg>k0up*q!UwEKc}@&>%jVXkelJ1dz1e_z`|OJ_XkOjy$_SiuI%H)*W`vy0NdS zHVTh#dUh-bVLUbw51IRrGjF0VYawrw>p_OmBRuuWh`yHp(%;w1+$Z`(^uA0q=+_s7 zZI#Jr-Xji5;+_P-#>$}oWa*pam~N+VX{O#vz{TUNd2{bv+1^6q>bQwuOz4Urd zdXib4eBJ6vL6g>LyCDKF(7Qu8qmBCg%P(pRCfxoam!y8st;6`EWb&^g@0vQ?U?5Kq zX})Q~Ps09azqva|7yAx?Hz7)`5qL>TUB~ve^eQ16Nt?<5Ap6do*xT|h|FyuaLgfF- z$X)Nj{3ML>t45Qg;)WGpntS@O8lyB7|6H4*CzJf2#S|Z0@Vm$}s&7|3f1rykHhwZE z7~P@QIeTWUs!tB8V8kZuajzm9rKWD8m+I9t=X%A+qjUyO#=R&?g;u4=S{r;UrP^`= z@DA7NZYMh5k7dkWX;ssYcD^X8DrO~4-F!>a!8M*YO{J*H{P^j>FmZ$sw86B!ONe zMa`&pemz>+yC>5zsN3nXG~7wp{vQYIT^S1gZhOdP+iJFEsrqt>df7?{_Vl9k=i^)W zqa!3Y64~VJr5|=1C!_dXX#?a|DxtaSx=3!$m?wSTOifD&h7!5|Sr1W#M&=k>ePT1sM!&ByN>T=lWY{ za^VD76SE7LTF45B=yok$9z>5czhbWb=Xd@}(|M)YXUN*)vSc^qLFB)E0iktS>FIOMxvv#rKWbU5LJbKu?0M&1f^gCtNJ;p)vFQW8px zmd}N6+8Jr=DQ4*G`fK(0aP*6Y>n>j0w4K5PpiZHy4b!9hI=%! zyhNPYU!3_C^w$mYDm}g}fcD}4D>(C^%*qo9<&W_<*9LNGVa982$P9PVv|`hVxahsd&tf$hmrh_ z-J^@6+nqWdWDbZP|MELpB`Pmcyzgp|!tFj?|4MV)rMk_pQ$SWE7p52ju(Nnv5LNKt-^F;?4b+7zy>ZGSA0rba7oUv2ch>ML>XAPl=Qf(=qkjxuXfNH za&1&`P`~YP&D764ALUUs1vVhrersHfePG6^CB!w@={>td)5EeX^vk6)VUoqcc!+T- zs`Y0=_Pyd?JuHz$X&*ypY$v}@h&LshTWHONIh{$WHaC6?wM0M&or`~kqc?@`9Ui)G zsw}E_FXV%Mkq(yh;(BO|9piY^Ru9Lro59`iL$dadvrYWogJ1^1cJ6sqqYXqmOJ6>J ze)ba4ok-{qMCbu#=iCs>&MdHfBUgWTfGIp z_UGz3!-!-KuTPxq)6f?n6_egW_nDy&y$(^!+I5EsPv7gg%cl=nyZWjI4AClIfB)uN z1iENrNK2PniZ}#Dg*~~8Ox{y`W&I@di9n(!^;mO=o@(fKZr9ut*C_^+MUf`;>EhVq z#S!(Lvg4$88+83%zQV|N@azR)v35z*)g~;v41Hz{QSW6dBK1OsKcLNe5L0gqPderK132o z2((ZDv5Jxlct`#@6mNLZfpMY~>4A)%aq-+W^%MWdYVS7RkL(zo@5*VVg`B>EXP9VHXG=D-E^ET>+$ik$-n0xi_y* zP-aQOJ8B|eZ~ORHJODy=KB}Oo1F;c4f%|6@!32st9t&@m^6~4+4Um)ufmNeT>|EHf z2-bHqfmv@Pcfx#BJ7AG}Oe>cCA#3x|q4xLviI5eKh}siu*wHLgMnOI~T*RT@#2+|s z`f=bZ)5xz)`U8%&*38RWIB3Jl`^L0LoH`5=Rm4KHNJ>G6*n%GYRR30=OZOz5LgmLt zHm=eNx9_p-(!|5SO%|}WH@z60uE_+vbhwW$U zTe8c`10$kmS2lM)|47!RVPh{!BONdMlyt)2JXd<= zvp>KK@R<~OB%MJF!7qwxvY)=;QY0R|YvNB$S&McOxKERCSC38oF%zb$nCE((e8ws) z0T4JKO+rio;@uTdwu;S?@96uI5ui`15Jg$n*az#-*Mvz@tu1U4;u^^;C(-80onJ}QgjB;mkeG^2vp7p z@pHc?F~{zH+sN-hYpo8DX%SSR#Sx+h>GGu-h+eQ4f7GdV#ym!MEU`qviS!xhCI3EJ3S15mi0}WggLHl%0}KL(;f!Th83MoWm9!Pmk;6rsXl_ zO#ra#UF7B@Ux!}4ieH4l#|lDxwJ*uo9al%I)%2sES{59LXG(ra@qttmTGUt+J) zH#NpNZ8obEZadt067;&iY7!yd99+G3kxT;R1=JSNT4;1YkDkjT*r-g113RyVA~h;P z$OXWGO&{b3yy$QOzkW;tad(WfqoIfLL)VM!yvFV<+Fc}{$(a*u+(y@9RiGl$GOTXu zwJ|{osg{vAFGT100Er44kK{W(`9!tT#DWAP5LQv>B-4WA$&d(Y-*9z0N9wOj0{s2$ zkQW^CR)gP2y9ox-))T^h!Y2w7`j-yyqQ^0UsFULqP^Nzb3KFzxBtY>5!Qg5nh8;h z-A!c1u;)LJOPnSY;7gmmyIuBoF6EL*U!b8=&;Kz05&PfiSMCPW=1M^p6RhxR8r}vb z7d=TPZCQ6MgHNQ-oDIGAFG*P4F*B3=mU5IdrXrm=YZUKV3DkG<2iV^`_;}i&lu4-JXAj z7odf2iXY0o7joR4Q*~7z4%o03><&C9{e;0T@9UMr0i9nWl37b?D%Ajz-h8BfSb^dR@FpO7|p#hwO2 zCQ`ZSXQ(1iIECc^vjed;b*x&_V`gW}Zgb}+Mo|sVy?3>J<0#Fy10V_El-BCaa>+Gc zw)c!!wPZDnX_F3dvEip>&RitD)UM6IGOL+X-5Fn6BbtV>667<}6D3H<2`O)#_#cmg zA<(#tNKRwxD_sUdx-_Z68D6_Tm5AqD-d`(AY9+r<_*suh+)IyWKvnZZygT#~ zYpG#P2srtnFuD26JvS|#1zi*N9Sv3|d6CwEl;jNyDt3*J*hr(Y3;Wz9WBr7})U^fv zLy#6ba4^*g@Wcb{Alt6v_mZC;A?E8O>~0jV zf$K-UyO$F!__AF-xBF5g)xjsj^k(lqn`zFm%h-H5Oz4?qEChI^!DTHjl7+#%6K~8} zg;dccXN|1@EkcFBtyXKldemxZPV-{D$*jbl#IR z&rQ_VRT-Wd%f1DRUys`KZZ&W)Dpl-`@@27dD*X@yc1`Q5>O~(os{c+#Sw&goD2`>1)_zO^e4j<$XW)0A39{)r0W-C6rqa#7IQ$86fXGH7u}P z=l6*FmB=_69!XTl-;Z!$Pr<1({~L3zzHhe zAHqO~BD}vG&5^k|KbX7elM*NS-}y86NldfnJnfeCFwnl(aq-R<>JkO>NLOZHjSUK> zHD~ji6}FA438ELDj$QX_j-^R`BcD8aRaEAq=cT{oCbFZK3YVQSfsKr@l>n`X21A5- zA3HAz!(WN+0bOeZGQ13U`s`nH0xsg)TW-YzRJ`kSaWuEZ#TYd4W~^nYFC|2O!@Rde(HzJCy*%0au;?SEwQX2LE3wH6b` zH+wsuBB|7u&shbIeT;X<8;= z&-PT)?X$SE8P{yU%g8<^3M^{d=Fu9WTPWv%aHwMl*@7u9S$H;UNGnL*Pj5YYn}o_# zh_gxXDLRWc->G_k(-SHEu3Q?cUkx^xw(Ro}D9IN<^vvco1T-VFJom-b`xZ|_`DS-N z9=2(eNF#3_D&Av6KR%n#x%J0L`MICug=~|dR^EU1*yq0AOk%Cy3wr1A7uJ?X=21B0 z`N+TiCcK*deEv$u5H;_Z?9-Jm7}V#KESNzh80s$DD;RK)a9AQ*N43M){{&kiJy;Vu zH(K0?5qXTW1=?>t2Q6IMntYdH$*NP_B7C@bEj2ND@uo*2*t22&_rkeq+ckDL?}FIG zcqw)#owdDBDsB(u9h!GN#jWJ4OV{n~gC+kal)C%dQUnHg`t`n8(v=ul0SX)VF*Wr| zl)jCL_3*D6VVdp`7(D)TQ$FlDwtX~041)t>%2V!pGHJ4WR^S@RwU3F;CT+65eDjZ@Y^kE^8Ig06Jz@pp-9d4k%t)Bc3(? z{TRRvoFBIGrQudKspT(7x3Q9g3_&z*rU>|>%bI!m7UcIoi6K8EYvzOEf|)mn))4w` z;km6?_^ZJrxZPR9SHuxckmgao>Qs_3Ie4De>6QNrg{W2rOt$uE)u9!-dHUx#eLrHs zTCM^-ovpv}bG&&v4Ey$J4kiRsEw_wc5{237M~+tzUNtTFvCmbagL`4AZ`eu{iF8}S zgqAK&{+{(~KCl*v%QK*QS^?*N5Eke`p(z#rQ4PHbd7TB+UfKrq96r`zDO;W&7yoeE zYfRjEzML*Wb@(EoCB^8{(WiUSPn5;(vgdhZ(dTecs^e*YaViY{MNNKkxbxPx2W!Rd z&&KQ0$j(11q*xI1Kvmh$+FD|^-$Bt-YmzYXj)Bj0PeBh5QrtP3kT!8MU|6|m_i4VP zPm!F&W+#<}J*Q_fov@2Tg$X;l{=i0gXWkyKq+l=TRwU-<%G+G8>+Vw#Pa}Zw-y+w_ z@i%KzY5)8 z5Ft%Y1wZ0a@vvZ&op-5|mvMRsM*Vc#Qi|q5G}@_eP+lknx1%dPXYfK}{oAs)5RW>` znOHBeNl_Z^jj)`xlAiv#Ww;mIP0fIaGSgBsLR~3f%&J$+b4^2GFsyExs7TvSqcwpY zHaB7Qv+$I5jy!r#0yoI0j$2Xh;N>P~TQU_uzAFkF6fGjObFN!=h^rH-SvjnCI-t5( zVz+~(|ESt3OOzUFW0btUDSoN#@M)+SeEnDO7NQ9=_~jUa9pxa1IV?x{v?r>zz^9%F zMJ~^7JXp$7K^{(vue28$M6Mr9itXIzJQaE&2jdH?XuG?g$#60GQ}xx#Ba1)OCW~xN z?MtTbo-5>LAqQkpN;VGC+vRFvk@RHBNv0*gnO8Qo0jpN|Au)efp7vak?9W@v)L{ zZ3-{?gq*eJ{=b*nB161AJJ;N$x7R)SZovQtY-)$V$)+f%|7VG(S-m+5_xWTV_c`ss zs&dkN0R5=^r`uc$@&(sdFY*M$AoP^V6lHYfoT?P`k5+Zi@<)tdP*%^KQrhxO@-l_O z0JhonTZ)?FN63sByyT*=1l>YJ3J1K^wqE3QT+oI*g*Q5N(njORV*=?DN_JADPI+?$ zXDpF>#B@5Xa>bybbF#8rIN)4cK@T0w=7SN-Rl3MCU|Z(}JjFGxT{gl2ZzS9Ro})JD z=G)o;um6NydNx(GRL6PJCV6wA^rK3jw$jzeh)Ur+|L{CKajdep+JQI&`SWEvUayVcmw-cpa(xc-+zOhd|7)bs9hmmI7{kF~vzW0ZYn3s&` z(7}z!5RTKoT~$;ZD#q#%PeeC(PJXr)6Z0Pr*;{=4sVR5%!(09xRMaE=YcH$vXzc1$ z|Jf^YA`SR$(guV+L74);K{|FH>v3M#bUqzqWEbsG3=fnb)4a&hR7q+IpZ5*vv~u;R zgadm1C!|OXr>A-7>T%)_9l13*q~Oghu<~}!*RZ1>D(C+T z#^|9}&!f8%y(ygf_}ITc*^1454k9?=W<9M0x~)L0(iJ@n({O)5OmI(UwU3Dx{WnV1t{t5h4HLihkjcdo;r{y*y_n;o5ib$P{!;GP6(0>An%W3{Kk#3Q-j9chx>14D_qoNJZR2r1T>>Nb<fCV;^|I8TBXT{{p%q}E*BmidKf54Y4 z@V+ND?n>)xd-Ur0)SYSX^4#=Jj@&MmW?fgOpnLyo#Luv{s(xJ1vHYo2>4vO8y z10`Z|n6HSBy{nD1O@8VZbA2ICp5lqvdOvnyHKLnj! zZ9mY6q->ao_ukvAGtjrwulg~t7Tm)mnz#Yn*fvo@*k-joO;!AqupH;JH_c>gw;+=! z�h3K|Ccxw@mK9woG~nz|dPFZtXBUJ$p(G3)6HL=eOF0Eu-%kodvXZVZ1-F(8oc_#K{m;mpMn``*5lN&Z(igv!T%DOt?r2D9j z3j7?%6s44U7Z$7Z#h{R=xvgG$$2OWk(zm_&AbP1ljxBp~GS3uuoZa6LQiplyx|j2fPk? zx&%?69(Emzjq*H-=HqVbXeyC|at zARbs$=2I!+an~D7oYOou5LmyGFJIy~9+e^qaNyXNv6SNPb7qh2~t2*NdS7!<>_dgvt$>f^W z)kNF%c+^LtZQc=wL%ZEr4`RejvevwG&z5dGR*J&?>er5DRQ9J$dRnw$zq%U&Vh&zc zXk{$wyFG~ta=Sqd`-mTIKc4zcIaWZPF2?X1B}kn@T-drTS$C}(Ur%e=jHYFF-_&A_ zZ-H1-h#Ua-6NpG%m0@}SmpdjV(S%cH4krEYsbyl0RmRN$uv9b8$81`Wu2giHK`4k2 z6U=8MGqlQDhQ59jo;cBN6Upl1Fjf+dT~BNv~9*EN0FR3t6A3-^Tv++FUy(XJSm6*%nBEa2L6tULh4M5(*p{_&9%TpR6dUe+M*Am%~K^F6``dGDINrvM>Lh? zu{x+pHU;pUbo6Kuc&V;)*r9WBMgafX*BU|Aw*&RfV9pz%plp^t^Qx*x2c3lMl;c`} zWpB}pl?JR>chGryWb-AX z0k=^Fhk&{gbmoQqz|mg9C~-`PjX?PWVKceRbiyEmZ-bSR@snvWptGQOujT5eOHVo+ zb%(Qr`NU8>M0Lnz!ACdONxMEMi}HRks=0--_O*>Al!bJQou4gUSow~m7Co8$v&JYN zToiqFhC?V+);|B(5J~MEePjoXErcMANZttWT%TUBq%)|HFPJvtq|%Zo5lXA`+ykGWty_mdE?rFf$AXdX)^0R zVx{ht9EsM>d!~M``maY>tyhC4ZX5^mpBm>VtDc|VZ+

      flkb@3YisGfENp9Q)Gx8r9_?d+VZP6`1J7mOciVUd|csc@uA|A=MfGnq3`m$ zpiRdaaP((aoX4+d7-lkj&|YCX>g?V$t(oErnvIB0@I6^cTC`W$vnyPO5uNn-@hcdv z>P8SGBHUJb>JBnY>AN%jj=PgqQ5DcP+Q(n6*$Y^YR2MMVH<$DjJ?<}E)Jr+mO}20| z4aBy16%$TW28xiH>~zHGuR2nAFt|YpSt$vhr5Oy%R><*cuPdCXrbFjmY^*x}5)LC# zJp4eVVT$$dtItT_8=~U8+xN>`&D!EaMA6{i&ek+(mM?y?Ae%pGG)=d%zo1hv$MBLN z4X2|@{v51ySI`I*{fTO!++MVqU~bYZHbl-mQ&91>P9Qpz*)_zALtlVWjZ(3QF)#o8 zv&?YjA)Bqol1X4*tN{<@X_=_ch`0)yjVxcz-)cvLMMpJv=ZA>|xN?sF0nk7%zkJT8 zWe)h&)_6Dt5t^@eT+4a9`Qg1%9OnPMkgBFBP+C5 z+v;jteKw-JdZiom0(Ahs@Je>-z(*(Uqe~lP#O~P(xfj3-pZ54KeegkalR3IQhpT)` z89`cyP;>BJE@|7_d$g4N$O8}L50|W82QMh=giO!)F5tsW#^vMqAYb;N?nFSArT_B* zG)fpRSx^O~G(yE3MPLNueZ^9QOBv4yLwgkv{RZm0-~$zS`gHZn7rC;6y1)ej6qD`H0GVLm_Jr}%%Q(HcZCf{WZdNt0d<+ES+YEvP#1laqSxl`Q-o)OA6> zy`m4zWQ?Y&r)?Kpro${dlzDnCz&eau2ZSHIsay2>E?ci5zYJ8TXcT3Hpu?;-UFx6( zuRc!)=*HtP-p&RtOHjR3a5jQDAK|G(sSM(L>Q)`!DOkqKkPMv|KpD<+4bXL|^?W}1 zxm18Qm&}SDIdb1&FBI);&2=`oE~LERIa2_-5K#OHq_TEA$j*)C$hKgRH^EQf6te_a zqW~k9x_`cMxKKg$;!Ex_z?p<{Ar0_sq2HeG6eyUQ4-%xGjWJwIAgjv(&qY}jpv`5} zVwgP`fG!m6=OX(H+2*CvIk~wE>y6gn!9>qbR|izRiOMkyLy{U|fj*D@ zx)b5(!(f^I?>?To24SN6gU~NibtbBJre_6%WhSaK2ovGgVHt+%tcJm`dc*Lz*SFbz z88$?RgBkoV+y(vnzN6DM2ou%s!$kft(LLpTuV;hx`@hd7F!gZ_1J4F&0adT=lc8W( zzTo$u-umSM`XnLhn5r5a+7Fg5sCz!iz4Usa;i3gqOx9IEXoN8+p#JZEc~HOA(}VTP z7ye;5hCQqHf%~A!4T3r@hCuhz)To~axt8aXH)tKBlnv%xV~rvKabqTlyn z`1<#i9fZET3aU>3ULVf%tf2TWn5fPm4C04_t~jZw6+_AjCVd#J2L@^I-97rC7rzJF z;{1bwV;Js&{(ZPBnDpxdf5fX%DjH z72dX%F#B{WQ&39vX3-mPW%1$aw+lS$gZs+Bi;h0tK|rr^RtA`Ox6YGec*|YuY~d(+ zv_&o@Q}@x1o_d*3v{pIK0bJUumu*G2@9LMl7+;^KK0dh6TEHN%}#T z`s%nWfwIWmy{e}S+) zU2=fmRdnIiQZi>pDC0Lds-rDA`*Q0oEMG4NQ^_CV(TOxt6O5sbmgjhXo1rkd+ENh``ino-5FbPe7wQPdGN{H3_ zTh?J|NEs;{*7sTO=8dg(+}GP{qZVOn6O=-%Q{+7ESEg%Co#j*I9Q`0vG*}9Pe{@q^ zDZM~B?W@Zfw2wFRX@k*Q9|#v&7F|BoQ5Ftz!UH2FQw9joiZ*=W*LU>d75$ZcktN#b z1Wy&{`p&Eze9Cz-K$d_`;Zx5udI#tL+NriZLp%ELsvcbKqfr~$R;HGq^_`^;<&es0 z8-8`k(^_TQUA+mmObrw-$^cHxK1y$8i@v*j_sl1IC0{Q^$k=o3_|z61k)exxYe^Bl z&;{^JhxE)I)TdW(z6B9{kOjT~*|6=>(IDVQV#2>p3x1zDZ4GZD?kt1Q-(b7p`D`Br#kSWg^b`vGrugqz%Lrfi9W2? zC2z8jK)GLj&W5ywZgsTbyYheyz>N;=z)xp>1GwPPHvGz1OIz{bLPJN@c|aK|=qnxr z0)w@CdJK-mzzKtJWDktbVsUHD7@!Ok4hzinQVt=Z6uk*ysau9h(G>Yz-}POIi-EeF zoob=9{o%3)J2|Z1^ET1iH-V8*8JxNngS%&ew>6%6bWUi&K80{90v9+ess;|T;DDBI zP_ktoG9t>a&H;^#$%1WdQ(Wzm!8c<7>M(3uAkpuI2YS6hgo6{}oAEh7MB5ghqsJi> z>d0z!ROIEiI+mlDytm&QP1++18vtY`WFSC#F+lFxv};HZBUc+MoMAv8ev^Sffll~= zh1uG0um+wPH(Kq{R-O)OT_HKyw~l^Ug2OKCps`tjJUB7qhl?Z23BKe=;;9n)~j%FL^N{p-23{r7gN}BAPm$*(~8~3B2LQ?i+eHqQN_RK%3Pu zvP!g~g^XpX0yr;0y>@zWTpzqxn5a0 zl#eKv?*xi*0Y&f0KsbdU#0b6J6U;cgAvlNDBdZ4|Wl#j=ItI->I5??{rLq^hVgzKt zh7&R~%Y`AnPf^Kbout-`xjv-?g zC^-lx;1nFwZWITJkRQk4$lABf)ZrYmE~j(pWbCGaR}dm|_XTNLja@O7)q$eNK_Qlm zs4GC;fB*e?)_|k@v?q9=QAP&nK(M1PPOP)zBo4wL8wQWZ3iO`QrOuSj?Y=`ZnbQY{ z!y6vynC|TeBTKpzEZxT!J+P~~)TJ-OU~(52>qtqolO_G2U+~n)a%}Vna5_aYf``2* z&(_FAJ@&_`1?@VmN?V@OjX;2BGSeoX5aG8B{qMe-1|*sj2g7v({H>csF0C!a8y z(h=$W1af|)Vnis?+Ap#t+J>)Cs3tAN@t6ehD*`SX+_>oSC z{9@-)DP)462Zy>&5sWAw&$;Ct+{`!y?SsekapY zRy|4)gp~80FbGp!ztz>FFaX(=;49Pd-8054P!gUXsXjxHT!ywX8riQbRgggw`Zy-J3%Y0({G2U-2eQ+?4iE3; zkm$E%l-w97T5O+GwmJ#)l9@WT7NUzjIjsO}WTL#zM|n78IrJmY%h+`W0t{S&si5pU z0SB<4M~6bMXp!Ab_n5#%*r0?LK}UtSxEz(t0OC9_v}O`0w>#In|SjZPT#euZQtRuQ;JN` z&z9I0Tcqpq3G#r8zoAn-0iE50qK{nRC&x-UlwtRRDcdW*ffHToX@^X75IT6aZ$yDM zzEbibUrCV8*E6=|a^3@Zu{-p$Pi^|mXV|9fSX{tcwOOC|c{Ue5pP5r7=ySOM1pNy$ zgsFFu1;{oTym=#aig?0Q*3~z9zm+36WhsPU5GyDUB&QHO1t~jO^#0~Y2w4510}eui z+i%MA3E*QGvdPNs^kRYu11K2eukN8qeKeOcT-uU#$%JHQf(fH7-s=Kr^BrF@1hmyw zQ}p%A3*g#eWO{B+BCra|3|fyYW0RS3vf|ZQ0qV)T1Vj7^#6}O!ge4;xnZRmFLFS?D zI$HtY7Y?%LZ1~nO)Ik<>#8B~wf8aYllp`xTcF$+&lbrEJUhcc6!<3Pu!!VAs%Y^V! z^?gT^pv;cc(;@iu8&341-#zt!?*dvKgU2pqG^InIY}aS$+vQ&2$B)3QJpBPQ(Sa9PK!Y8|u$;r^@$j}@Oc<9pv)P++P>f8YVR3{_Q>g)v) z!B#dZG0_H4Uz_CPd&v->nf%b{dFfL*G_V1kyBB2mVuSea%dE=7sU6>a3Zi6#PFXr! zef-K4XbTPG%_q>}w~mlMku}h%X{L7OkUuOr}nN5)`#5(~}hn%8VWkXAr2<=hbf)*}yHU)bpEvl}&JFGF3*q)i&_mGaZ-_ zf#I4_jA1?}z(1px33@KTqX#Xv?~*B8>_kW9QXim2kTjY>gEC}O@+_gp<~cok(IL@`PkJ$zryVlWj`jpC*`b$5WT;cXqoF=qW^=MunWSN-7p4W| zqFs2*aSE(PPISs11ur_*cF7aq4Nr#AY+fgBWKwn^z(^9jyKt}crw(9;+Jw`0_p6+H zrAO`fT~|%V;8Dg+U)uMqK%KH-&q|KwQ6(?zmtSb3bX1@2q01Lj)`+8m1YF$u#w>gf6(Dhm$cr!z{gjuD)U6^d*A!slnHtTF1@S!0!a<&85j8pvgAb0ItRlh znF=Q+2SZ3Y5d;NZK|_0sV}I|ffq996d<%ur;M7@3LcD>?#ajykbZp1U<4ZS zgTtJf-^!5ze1fmwXKIJcWg!e+CPC+D;zVfS1Y{2%U6rkIXc>z(s%>%>e6@#9@;6VY ztUy6W_#hLb2zIFsdr=NRXqPQ`CLppcL0!NTjExp#k?ep>=)s&Jy|Xp6%UIDx zw&*9n;)~7kHF{w~aG2J?qj^R1wdgY%V`mZwdPTnxLEqo#0gvVj@o27EQi2xK4)_wp zJOl8v6F$Ty$%-w=`0!!s$cTm>%J0|+oMj8jq8Wbm@refY1X68kPp3qlI&t^;5Wb9x z$bqZ`eslC_pb!36qc1kjN3>BRH2M=zO|#$`joQ^#Wvy(v+QEmfJ~At}SyJQFMlR4>kH z^~@Yk8A_=@%b*BCaASZBU*K`iZwD*DL6F*_M20|!GJ(o0D4CIP3c*Sn?sITMXU`Z0 z140AEd8U211%b+l@F+kUVyOcdG-E-VGI)ZM(glNlIc?}1III9G@aS+jw0r1BH#wt4 z`?6NUaI%G$K``(dW~vL1_8EJfnnd<^;Y>yd0)~zaUWP0X;YD5YC$n-SZIL7S3gpV6 zNgMEy4};Pk+Bh#mt{_0h_@i%*iY7xo5Qt zL6>&uNW19rnNlam*QW(u_zFKzu6|eh%KOa- z`gFR7hCZn8o(pd6S70pqv|ZpgoMZrJ8JYTnvML^ZDyMw$Uvw28Xyx4Slzfygo=OfS zYqa`Zv?=FOPg&*Q_Fa9?ly~*zP_)$shfJ#u+O)}r$qrs+m8s{x zmrUR&e=Bfbd+HaTKs~<;sy_J*@~ckOL$k8gw(`LDy02cfS29)3RqZOPobt*7Z5DoI zt8H>r#&fiJ-skar;i3iAO96y;HgKVYRRC8R&V|N(CeU6P*QIP*Ta2)r{(J$R3Jx{I zldZ^vDu4}wIvkjz^d0t60f$A~AfQVY=DAD>Z5M++?a=w9wlnPw<9iZL4;54|y`^3t zp!_qzg*L_tXy8&Bdcma*s0A0IJvd}NG6r*5GCadu9kb!@+3539!P(GacxqJ!5P&WQ z{grV|!WS2O(FWBoSGXL({6c~tYHrQknQT?&DtMfZujd-i=rLdE1(po{O!QB}mls^L zplaA+xOb-Bw&p>qr}tUc7ZVK9Eh96LU-M7ThNqfWs_(96186%N-3)_4KFS>;0SrDvq@kWSZsi#L=k*=&=F(&?pvp~DzJ8a|`}gbFL@-#c|GR&`59jg> z%@pFdPeWRBhu#L8Z!4#-@`Lq3|6X12%ILhg_FZ=5rAR+0fqtD~P|x77e8x*7a_rZ0 z4Z`4k?e>FAzwVi?DzDwaw);@`v?C)dJF0d)!w0!~gY9j!mtXExT~|T>_u#WW43-1r zB)cBO?V89AT?K>p`oHTQ71Xc6J1pfSovV(0KXNx#H3+5KN~o!b*hl*UG&;6jhRO>bR(4N zl?cs!-z}@LhuI=)6S(fzh$^Yz5gQ{CO{TwE!qJ*%J}VB(d=Hy34ZtC@6#{{ z>Is~dn^_lXb3*Z?j*T5Qd{}?&WuK*HmNi-ZfoAo6YDe2>(jFWo<9_?fReUI()hQmT zJpSFQa)sYLD>>}WwB*gwHtS)nPqzM?yx`Nm@+HS%0GD;DXBAWtAZS?Z&Y|?&0)&PH zLBYftFv7GZ4bd_*MsL@J`7;DtK7&EMn0p-4{&n? zHEqJ{xo6fF7W1H#p*=Lp9MNuFtMz$k@T?Ymqk)0|;R){62$GFw@Zn8ab+k{pp6Qh- z!`p1Q9Y#T}7Aq@n@v${?%F3$H%%Jp$)_F1jYeBU~c4Ubk?O8mp9R?~OqQiPU9hZgL zev=*Ds0Uxk0A8Rhn(-pQlPB63s&#z~OW>v>odBHVW8pQtdTqprE+VDchF8J7m1?H~O30bjEyML?!ExO3VGdR>07}X|SfoU~OwRJ-`8k|leo_UXIYBRBFF1JH#xc(qAqvs;9Kr0W7WL-ovWKmY_PyE9Bg zKZCK`N*jbniOSpIA=v0a2~zg#s5}C-qlLgYm-h6wJ~qtKDae&?0}hIHtg8N1Er}Fmn=mAU^?yj2N12oOUS*toWo0br>mqYL^Vi z&pvm&pu?q(Kt-O`j&edqC+NsvO*1$Wkh9VyhvFRcPmcDStLwBP_8~|*d%zAgH2ZD+ zrohb6bq3_hZaAm|jM;}EM7}yB8w=o|FNVv`I3i=V%Zv^suw2emFUh%KvU>9g6FEV5!c*BpNrE^oBjNxI=XrUwW zV_zX4kQvz zm=a`duwY9%1@zj|&Cj*L7uXZ~x6y(Q*qOR)k^Hr9_my}-o@BtzYX>IT$&}fH@?r@Y zNOa)mW6D~6!ajfKhkhvSja~(1vJ^|mpG?RGA2zL&4Gsg(#5Si1jfW7%gOSg>LXhJj z-0^Vm@i5-;F#7Qj=y(t{9tJTU0cHGWe&%P!gSqiA+VRK+#)HA}7$%JeQR8oT!yCqf z=<#4`{Oxal`}kYm`qpP~{>YE~$apx(crY;@4m2KV_IL;*+X}-NkH9$o#y7q(+l^qA z_mmAKkB1SDM}Qv>;~I|uH6Fqr4}%*I!yb=Ja6Gc!@etH_C@g6VXURGdn8w5T#v^bf z{cn5Q+s2~<7!M;({yh(ck4GRK4@VvkrDyvgtMU8pyDw?d{xARXFOQR11eWnI(D88Y z!{NrmxW^-4jmI!!JUX56F#2cs#X}fQ$|?+JJhFxHFrt)S z1n=<(2;;L?p|1C zI7u)0xqPRu2oh-n;aub4=;IMgQ{Nx_;0KczZKId1(|ZJ>ls~=s{HdS%spOOX$R+}C z`hvFUjqgNflCq1AZ#*1+JUa7i=kdoMPrD-vdW#^Gz7?HH+7!9+JHA8SaF7ANiJ+JK z(t9}lcyz4!oBxovPdvhl?#Oskp7cwv(U~Uw+K3K*JUX_#rw&`8^I!OdU&waZl?#18 z{^LKM@`INQ>Qa~NBNH8e%Uj-(w#BC2`ObHaNAOJjy#M|0PucPhc7R@OM5mK-B5N@N zj*=NW)i(RVw-^!uEPa*?BWNdY{E^Rn>QkQ@kKmd~D@?G>7@%0=o*@hlYcBO|?M{jF8t6nJtoxPmiMP{t7Uc@#x zy{&bFdQQEpy4r=;eRE>6%LtCyc0JeIdX9FzkW2zkdNLV|A%;vv7LGnWcL+9*N7I&! zQXO=Wlb#A+dN{qPh2eThZF+_`Jvbf=TTPwFn(ABxZT;X6{$L(7qOIaV@85?S8W{zI zA!O!ACbB*F&|7ks4fvF?&>23BOwgn^mU+ks^u#hdbjk>1jph;QTqZ`|@ZbUOdUzRZ z&F!K|CSTiFf$YwO2id&)G6$I>`Gg^6w#vTT#|vJaZ$KyH7{;EmWj6(A@J!YZFZmlj z%l3^_(B`{r$gmksc4==s+Q|n#c;MD9JCoti3BK8!=gO(Cjx4eCBdf<3IcoAPW0H2Y0(gB{> z2l>z?9Owi-*=X4m9?|7KIr0^UkvL~UIrQR*zQ|bHGEKI^X8U;iKsN9iA*g2r!@UDh@Qe}YBE}$G7+A8?~G!@XFfQnC@A$ggW5v-i{)@rzZFVbO_+4 zAu1RtS4K%5%J^igIzK@}yXbRXE`#Cag0>5!}LrY!NO@scoIZRO$gF_MsU?BdEsT+13fw#azs12 zN>17V=*Ev{X!o2z9|lY(&6jn!zC|( z-qJU{!s9m^))6?U#dL%~N*2mjdlgJe-r6r(eNII8Ae=F%B35t5Sat1=)~!7{n2(`W(HqmXq2tLAP)UpI~c4*WKy053Bd>MnxPn{TgWM<(vXVF6nV%jhdr}xA^ z1*6MVPFl3#iA>;^33E~zjSNSy*OS5_V_}Hul#EL0pl@`H-<+zsUow=XRKN$yaDKSR zkUY#`adNWKOLHU!CMcMbl_lX*rX)j+H`%*N z9|c9LGW0JyqZ9Sajg}s@Az*USIyfCaWbTvQm@hXkD$^qqFMM=De8$|r%#x1LjTWD9 z({Vw?w&+Z9=K!>KT`AIfG4)h(v z+??OM|Ni^aHrbPo!5p-}$VTYOrM@!cpnf0Jb9wf_0}o`Ppgca%NkEs zjW+%D1xG51W_uczV697s98Wz2%PG7OIJ2ny|jgXIzem(GB(;#Y8HKrVsR3IqYo zS&xP{lw_E|_yiYa6CbiLn%WpfQ(#*z3j}=HT2L4 zeE1_T_Ks$<=fK+4SKy2epYSodAV;#GWBQfI@N>x-`(fwejQjBLFZ$E*)01|{n_P?r z*|$zfz#azL_M+;H2dZEYVBY07!`Cq35g13JGz17D?)fcvQXm5mlsJ}pdJ2S5uwFnf zBAZlJ)`S-21YE)pK$k9EnhbFOK|^3tPMc_AFz^T%oDY8Y2~;`CEC+&Db_FlP*S33t z8vz3C$_&)gF2jdc+xVk&3UD7k42*p6;5((M$AQR+0||x%4~MqVrLJiO_jC;IGcJ7L zNl;N2?PNoaXd^dm2zW*arZpIPW$y*b!H36^u}fXJ(W70uAu~>{Z9I@U{sBJmgJv>9 zH|Nt~2o`7(&;(9z_VKK~AVv>lR&CbMSDVV=OPc^aoXJpGSvp}yzQdz!pJ=6TdP5ia zu`@VzlsY+1;J!`{4z@uSrQ-tkl#^ZJ7jLprv~hfTbK#v$Xon2p(GHobM^Ena0k**& z&ysK&;=J=umN@f7h2dj zc>?#z6>soV{NNMXCqFpRi7s?&i=4HC2Yjmw@XV%^({|Z{GRpey9@^Qmd&;tdiUlPP zbPfZwpY6t7_muM;eeii+ zG?Z+rzH)xMubg`>_gnyO_t_~GdD@!~>v=@DJ%@!W5paJuJG*M0T+@~d)asd8v5C|=Ounfl7Q??RVn zK)vEuz|fw1#iM#v*Kg0Oe1T^rV`a6e40*$eUf)Z8eO>^Z?(-kP&PWtab%65lSKEHW z3A9ND*vxav+~IjN$l~I@pt;4wX|GiZLiM9n2`t1qSQk z@p8!da_RPb;X>;DY-O%Zoh^M&2Gq}oFOUX-a*o04bb`JZMtHW$Jzro50@2y>I(V;d z$QPT|VNgabuw5>rMgtk5!F3_CI`X`b!J-ePuS=z~!L}|$+ZO@{I9EJ_<R`5Wf*5}rLO**&LDVZ{$Usl5>^`qGcLVykJV%4?MT_t1_+8*W9R0R^udAScuYdnc&@b<^XsO?Q=>M*IgJr-(_rXNv z`!KBj>FV`A2g}jXJm}NVdaN`(Veyn2I~*QGuS3L+xDvNFdX1)o()3(z8El!f3ofCt)S`- zmhZzebE@9fLF7%EB`D@eRFnlVj9M#J!%WZ2IeGK%ySHxrOr`1;QR?(Fk3La@_t9a# z&>K;B`vzHMeeY*z>J?7+eXp|pwhFZ2Z6Ny12^MZ;Ed}ugS0?CQwM8z5x!!2wRau|# zP>wg1g`?Up8jBWC{PgJu!|3b-11`M4cewBZS6zi4_+9k$+Z$}FkJHuvJuDmcyku6t zLE-gTZTF$-6`h5*a8*6JXVh#Ce}nCS;?uqU{b6mo+-J*H0(krF&8{|zPFIz4ujW*% zohk>EE1F%Po)w_mn{IEmt)8GiIK5-|ae6m2F2tpVmQl?&L0Kur1tS}IUr=F!k{_HS(+7jfg;bf52OBX(u zdl)V{;P6>(xnH0zXR=t^?l4P#1k66KplGY*8&0vYP7iMD3N894GdpLjFBDX@<*m4K z3>4q)!Gph&30l!mG#1Szzdk6B7Uh)j373qAQCrD?mU;$vIR(6A3Y15$dua09g%0?N zh62xkdfKnwr6Y8?;HvulEX;lN3fPY4Kz+}Bx>v?pFQv$|cF(}4?ZI|{dj0#Z>U>;f zuMED*SRd@L7dqELx`$4<`gL5|DZbH4R_5#}&{h#=WpGY3W132*jwBN_6e%%{JUtbPDo9dytKC6rieeRWC z^zp%8?W$8yb@+j0eAeq)TaV_Vn~befC1af+KH>IUTZI=NeR>O?S^O_(L8cM=)$MV% zIM#w}i=PpJNk$={SfglNpGE2#u;A9h+9Ft#x2TrVT_V42knRZp80RpIPC&A-+PXJ} zM?e~cX5o&{jv_2|~_p^NdO$%14(Bl^kOZ}eG6 zZgID)q2FTyv=p}w_pQD zt@Q)sMQ`XPU-#Jn{liOE+AsceP^K!ZKZZ}S~h{eZ{a#T+Qg5{O&$2@)98sj z>7GojO++_+&;$9P2Uv`be!R0sHpC7&khP6uP;zEJ+Vz`lp&kFqTNz#8Ge<5PzR4|_v1r{rVwg&+KDmwhWEv-O;PS+XR9q|3so zqqfK$eO6hJ51#O%j?Nr?ULcje=#cK|h>Y;$85eY8n9?z`{4 zTu1C4y4Wn7bi^jqBQF7m{4MmC43RNd|qx%P?!M>1hbUm!UUvxH3ShjA=VBZ#M=46K^P8!*pWn0h_#;4jtqh%XpAus z47nH&1v_t%0TV<814f5%&*4?iF>DN$194UvGp8X0N5{#Y8G<0;yIn2CTY=|j!?T}8K3qDS&yfKVgSn7Q;m1D=n!l|ATtV= zIWy>fFV1ioq<#2kA`4DuyB>ofdvuYD=gQHAw$KPCTBTer;E!P|2M3lF~N)N}UfJJ~Bs4}MqTgjdebw$O`Db?8kUKFYRa)95XJ(18aRTlc$y zEnUzPdc^^D;y&BgiSa9biC=bvPn{Rp__QmE4WUI_Xrm+gBM)t|I|n1dEw0c_#iIKn z*bBgPq4S^@vcQ9Fw`9()jezKlT;LNt)hQlbc-9`;@JY_(qYZW|Cb22@s1rd?A2P(2 z10%wBJ&B!05D8}HQ*Ae8GyI9AfyK!WQ z#fVdV2vfF1zM zYu8pv&Pj2C2|8qdGBLcOn}MQ7W+IC!8Ic*I5g?S&nZRk+3E@*90;cO4|TRZSEQo)5oGX}v!?_IQ@Lpk+0j2_lLZARwg9kdyu;osDbV5&_c1kcFU zG>Gknf=YEVaB~{6)br~M8I+(R3&#ti$AdlLIuse0fG6YU!00O5=wFpd(YH4I)*hY& z3dU@Urco5R&@KBAfRquC$;wEIp6QA{wJCrIwD^OUBYI{uMXowu&ijkM_=|ax5jq4? z85mn7Pd33>*@U+1%uV>|QUI~9AO8FAzdvmb4P*y&{Pc|na$-|#MX*APz3|#6bJGEA zO8^!?Y~M8^VmD}KS8R-pY9CJWA!A#O`J{x!iE*~KmY)c4~zn#j*wBAY;;T~_EKe`VP_J0N4<=|_N)EZCOH zp2(9O(QN@AB3JZ~AKNpPB6hHU0ZnjLkL~Fw_<+vS_I2ld&tv$6YLma?SG%%Qz9fdRcUx!K3LBI}*wI*1hG1$rCE@ubJV8vF4zZUu6v$X)Yl11` zmf>hrP(ujixG<*&^XWGN2>?zGt_{5`WeZk<7G=w@^vvo}1fu{H?l)z@<+;pEa3MgM zC;=Igb0qvQW(J2BMx>n*TwU;@TU|yf;4mmdRgOZ~c*DCakSuE3BmD59#ix5NG@}#W zWPlb<#6TGY!(v3r2yDv9&;=q!rG33Me*JbSt9^#U$?3sXTXffs$8Wy*Fu*FNB6Yz+_aGhnC6(f$JFC^Ix|B_wua}r)N`SS-NDU&I4U05 z6dUCHY?*##bK2I4u@iX7t8jwC%jP(^dUOx8Ay|`_tPK79ja{MpJ@0u>mJ^KGGWqjm zG88=UC_t(2IUZf`mR|5e9&ifyE_TDm$x*;%1Iim&3Gf0Bo$-J6Bc7m}tx7U<@XD8e z0=gqFcBpegkE~cA#tVH3tmGsa6EKY$=-bG`$Os?gYh+39Y*q3=2X-QokM{6VGA=&J z7#LZI1v(4(=?u;MMZ0(^-Q;+yluj4~EWkYQzyokO&CP6o}CZ2=JF; z{APUWm%?25f%r4hhDnXDWHkW%BCt%lBYV_cWJNasSBMxwcVGs-yDJ7 z;MW<*8U!E#;OBns=Q0cDtm*^K$VLF&unF?l2HMCQpaXum$(xOnr83%aN|*cE)v+n3 zj>N;T^52I|s*_Qye4M zS4Kk-oXi}LECPXgNdZOb?-?gBAEGUFFv(%y(&HcyK6qtQ7$JBxxZq>l0x??QGkkK! zqB;Vg&jLoOEdY0cG7Ql$0G}L#kQt8Cl{hRO(JVvq44@Ysg_F<)95P`<06&b|@RCew zwSb|KOjE~2NreNTr#dG3C?hho5+FFOVW})yn-mN1M?Nki3mKU91XzaTH>2fP+7@WF z%OL1T=IXw{Np=j6EdcGK%gajqn16)}J#;598?Mp;{$y-|fb152*^myw&{7r&$XA9U zsNoZ6$AxE3$6nY2nKF7)5T4;h7UsLGgF)jPki9zSXLp8xG9x&lCO~pAPX1Ws0Y+D%#_*5RAu|*i>Go*_ys)ldH=u(wS{-jK>c=+8$I}LL_@~f zg`@15?9i`$eu*!mM;W33Z|Y9wCo`lo!+y9-4;aDF2OSxm8O^a%w!jwE=WBFIw&?BC zsZE(Rneq*FOP4;YTy=f|Cs{~*=*+W9CM0O+Gv_L}^M}4K0Bsj;c+{r@U+&0CMrhoC3?_tn=bRBkgV^&|Ni8)^aJwk zKjY(=h~gLm4C7=7oS`OzDUPtsm6-fyKzbh;kwyths!yqmkFY3|BBa_j23Zj~tG1YO_wdN1t+ri2@t_FixG5cF3P`(YxTKSJ!qq zl%QrVjehXp5E@3O9sIcuhi7EwXgWbr9U~bs}qId-!B4 zWFuJAN(r5VXR?yAJM{%#&ZQllbJdZ(k*%Q3QRv60M|~YDo6!y%AtyG@M#zco(QJq+ z8=_x96mLcjMgcldIPilGwymDvgg&~U2ew1!=;TA}K;|zv@S%EPWXgt&=o?LNy6Bk0 z(;2x+c9by^Fjp$UpcnJ2IzBX;#y|r*=S!Xm5;|4%YMULAl_53x3mE)e+ZEW@n0EOD zUI1Nq_n`wPW61|OlRr95@xjUd_y-(hfq%)B`FOS=_^~-{;ZY~acm3r9v>J9xUc{8@ zxdUx@rk%1c?N{alSJ7Fr(T?BnDO>o|aUU)= z<+t|eNJuC36pvt&cb^7(H>@b{FXHc*GGJ{Zc`t1y><6gm;@SO=y z|2ZI2FswWnl(};KvV(Od($TQC!C<+9D$}py``~AR-*ry_H?lMhBdh(@U;WjbPLfC{ zqw}hu3WnjD2zUQJI32&B?$>YjU3I`PrLXa@H>kxjp2X}%ygF^`J?(WXu?jgY)g1asM-A`M! zRr@}5RoCl&U9ao*y?xI;C-b~aVZdf6Vp#_9xVt4`{D_wTp!6bDOE7GXE8P@4GW@|8`j*GYIkJG$U~ zCpkhmS*lhaP#&0xUCH>k1nuGWTt9BoTMLz#r|n0?oUAtYDR$MLSDZfyTzlRNba}|O zF?ik!Zu)nR8!D(hYRw7Y4c>r)k5X=z;b^E?SnA2+?nY?H!4g6~Zua2D)b3 z!Fov*d(WPM-67{DP$b{L$Xs!*M~2pZdmf2weM0dK9! zyVB!664@iG4$CI9NeI~bc@9J&S3O^7Zc*Eh1Q!48{vFRZVP%C<9Wy=i)G1A&3*^x<5i-y^SDgPISuA09XQZ1;0JDYVic1 z!Q#E9rD%QgNLlm1)_6dDEn1p4o}9tAJb!y8Y4m>C<6BM>xx>E^_EtELnRP1lrr_6` z)le58EadWHqZ983kkqr*a%pF_CtckSF~*mpnfJXXYF&MsHY?ly@~$7Rb*`#)Ukeq6 zWXq8!Sxqy~d%b$vv{Cm|jQ2eSr*BJ5XKgxQA>QMl+Wj&;a|#8`t5j%T3+<(M@1o;Q z!hFM_yySh}zr?pu5 zxH{G0*@^l`cYZFZB!X&***5g;0|O%?-nK4VRAi0w^SRq2>?c}_eDu25N`9{D_=ydU z$<7v&=O%aaL^|j;GD)1oRk)Nj>w4TfoK*3b+Wfk0{OjT|7wH<0iF?)9h^dU538D# zxSHT65o~<|L@KBON{H&SON(xbp~pz186gZJ>nU?c0z@yZ$RSf;cMuqHbK$3 zp$bdd>rDz2HcKIRw@aw0x{pzclyW0{)7@wlDucpeAG_@H!W7U&OB>z!{=Z5PiN+l=|S^!8ryA79lez63AhSWdp$N#11Rkx?pBT~md$wopQ z5MZO+cz?pmIZ3_LJ%tQHMW-Fa-)~vBgs_RYqLS0J0+b0qdLsc%-yr_%#cJ3RzwKnh zkrFwF-0lQ2XB*Jd`~`J}xG)DTZm}{2qFn{!vinP>_7mvmH$5d3)(PFo`1jVsTur#W z2lKb4Na(&xEJ1B~jKvpX7wDG)qOw_I^X7T={?5S}S&K~T(?k6!tb{N^`#w-14pb8K zgv7<+2qIjcGgN1%IJ6z_u_#G1F3m9K)u)BLK3$(iK(NS)eHi978dd5o;mmOdvT#`spVhg|*1b*F{e zTZjWO9ee$a>JCrjOk9XXnBM%M5OQ*uE`Zx{=)CbBdpJqng*!8a_s0L3q}te%h?N=F zW_F_m_t~bS@YlnftgFmimjjVT2Y9pu|y9dsP_Fu&e^Lsu@tEOUSWqa;YmQ?d1~FE zUZSR^LL^UpJEEyh*r>oWbgmU#!J!T^Xy z=(WlucwPH`0kAfbnNB4khhw{Z-#4|knHZulFiq+EW}ysZ7}-ZBI>%Q*Ei@7J{3IzE z!ZF3e07?@`f}-MLYAoI&P2^~O$<7}A#yzTyS$|OKNoKCkC0(vCVJ<*dEtHb*K{c0- zshLL>5t1y6pQsEQu3qm=SnpXz{*Sx{A;ipOT6~yF(STG41@k&m5%ayW$xrM!PBO6R z2bP_NQFMQyvy^fJcP2bE<%F{JqDygz>0^5CN+1?k+~=W}qh$yo16(>g+qM89&qGJW z1fi`{-Kof&eW0d;7^xp>kT7ZY*zaNG4W!A-gAp4&9on66cf3h0roK+3FV4LaOp`2< z^sZ(@>;e1ZDY(B`Rb}{p~(cDb-K`Fx_-BF3~6XB5mYd64JQh zrx#j46re^o{ox!yO`B1Clqo*CJI@B43O3LBm(Vq#9BZ_7EK`*2^bOCao6=(j?5Ec4 zQ02Q7DdOyWb2Zw2|Gxb&B?Dsi1{OKlW(^Z2kVg^^4PXQ3)Huhuo>*!bbeTRr84Q9v zW|rS&$ljwsnZZx#BGIl(hWB{-`?qNwwFaVJk^?^IUuk3zda?xMNHom2p~A>;FbO+} zg5K*Xbt4vBUH2NVlmex8UA|ek5)o=YdE=Abm_9hS9Pxn8 zg`M(*ihcAUTx$4JR0ZZklelk!iraqtI^pGEm$7Y}=}xg}G|jAp$fE|a7C&qWRab$(T5p!yM8Rwz zCa?ho+{mP@K}n4KD2~TT7$AIL`4CfnDc<{oq55GhXYuWjMhRBR;?v_9 z^XFYkA(1|(RO+l;Jc%~Ls>4JviNH{l2!ncvh!uTwEE@gK2}w(Bu%o zs}SSl`t4Uy@6j;7=hWoc`xMRx@4J8hkxHxE_`{Zo9*HdGQ_(x=imigaku{9$Qje{1 zYu`$_4O-&L?J}PfqED~}mXM;(+uu;pe*JZDoG7}S7m<@357%0 zz_s6o;!G5Uh$Trf(DlE+T?poVf46oWu|3A>B2a5lE1}dSqSNhviZtnB2c6<(pvKVW zvGCWWt|dX91_*DjM^!5RrsowIz9OqO-(MgR7o)&FNt~rmjh|{{dv|LZXu`&OrZ4E9 z?w>mlNv`u#agtYL3Neir&*Jd&x8OQF_nrg<^e&H&H)gD?zu(W{pn!SzAY$%jRmWtY zV+}Obiz0q<9zX)K3yAX{Q! zpZP>lXIoX&sM{?v{b1p3d?hcBKgF}?bZ_ys*(bw1pmT~U8Hfs7&z@;%&Ph64GbGH_ z9fh)Iwq3=PnrlKzF@Q&(s#`xwXdAJq<@2oz=6lB2?=07BM8NmJylLF~95lnbL0+9l z7$2fI$vS^00(tLOmVNvw?7jx9spI(JY;xfCurdl5gfmwp=CTyxR}6GUy2k$Wd;{Pz zd7mC$K2?#h`K9*DN9!z`)xGY+HZ+j1T1u3_C$v%{Yg%XdZDYHieZT(WX5is3Hg>BK zn?NgaG=XF6_e=5Z{z3i-3xYZy$}jPDcq%HzBT;{9g^0a{`9(yIOpHCGG~rUq&5i)HMh@2rEz_>Eb;*lB z!|Q!Hvk|;|PLE4a^M)#XwF_e4NkF>9t+SEV0jVC6fsbWQqmhC)ATr@fFJmuL{dRY` zjq4kD-bwBEB+GpeJRz(MoV0I|XDQz2qF4J}NT|8^^rgir{RDm?U^fTR-hq#1?BeQp z*&=>2TZhH3ufK(fxH(EWVrch+p-XPdUvyC3bNBm1G96mv7T+_O%oQ`S`0@@S*IBrB zkt?vUD9W>hGn#ymTa{!;HHi}XV1>?_HZoHlK!+3UTz4f6x=J_f5OoJan-m`R7u!X< zPRssz-e$JVmpv?&=-vL6q1deW+^X5w*$n-g0mJt|A!3y|Jq2!SW5uy|81$I^I z&m`b&G~(q0ltdH6EX#da*wgj9NyR-^Ak<5;lH~b}Aee?W3*~(RY)hhZX^QJ8v`*ys zE;eO(ns4Qe=LAQ1q!%VILy=EE(H-(oS7Yyz1KpM)yI(%f6*-iodQ5)`GFB2m@=FPq z=^22aiG4QnxXeIs>HT}C)J$z|1H|2s!9E`n`0LJ>IQ{{(jL0?@wrvd`yFleau4_2$ z9x3n%N*L_)y2z#K9isGt*u%-nX#L4dVGOnPZ;hNB3jtF$)=VkEPqm7Kl#bsJZasF&TlqEuygbaDwv< zxt^#R;35a+iW^Vsp{#Ulfwe{ipMbr~!f2{Jc27X1tjEBM_qELHBxO-}5#?R*%^=-iw>s&=!ZCT<$3Q z<3o&J`>q=84bykt_3NO78?PNpqUYtfuG5dTvGqPMajb0uIqOmCny}u7g>uuPU&oo7R5H@(H-@aPmF)h_m&V|2g?4eD) z<**%{BIAY(0R6#t2M_lnlv9;u1z%=0bK9efg<6hvmUsrk=Vr*y>+zM0&z5KOUWR4O z;5E2?^iabWC+f|XX@ek{u@BoN0hF#hvgUC1G2yXD_ship4lnc7{31675s5jFkTZ}hDksa%RGGHsUr z)Z!5GP|M!4Soa-l2t?nB@8i$5plSWo;m!CR>JbogC{u!$jYz^H`xjukD#(DIoRJ&+K?jkt& zA*AF&xIs0O_Y#i+ua+Eq?)@x@_{pTZ_Ce>;+5lJv26I-Q$S;WX&*DzCJf>LI&ftDA zNwr3Lg@NFMUl3aO3^OEw^IymDX5)rAqs~tw%g1HnKK!bKkdWd@ z>f@_+67{pxD@gxbsIK0fVSx}4`Zl)P@b>zI{RrX4d39jjcPg^2k9(O@R_>Y6ZWS={ zc5=m!i7bkQhkoQJg(YAsvMTQHDwgB_yEqr_2(Hobb&U&h0QMYj-h?K=rxl;b%ot=K zlm_YkAG(!~Nvg3I=ARHi`-A8nDN~#Z!Y!naQ@(f>(q*A=RAT%KkeL~uNP&uFbPz4i+CeLO9G;Vj2dYehQwWFxFsV{ zEXip4%XtQMdBV~hBA(27kT-`DrJ$PJc0W9$rM2^p*rEM9M9?$M{iv0vPj=D!NMI@bCk^49;<97;4WtD>t%XXg$688Os~ z97g-!hz-YXjZ=d8uLI*4Fv)nOku$=(6>@4ntXX; zFDL7d!k0gT9A^7vrU8_ie{5e;j!pCZQLQOg-U21Ba?h*}tCf zC-j0ETE?@H)R|Jp<5s#A8(~2iHU}2B8xic^lnmMIPstU7-Q;N5?9T|qyjF|AocZIM zoL8x}U#OmoZmd_h zG98afqpwhW!8HP>pDs_}1;Lzc7MR7M>3&OZB7>QU_yiMx&1%3ztM1U~%s2QCVZ1ZN z8pa>%o9F|TaE&75h9Cm91&t=mc2;9@QNHMtWp6*>y7>| z?KbCFP{Pz|dJ^~8AOd)2IH~1W<|{fNs2A(02>ZpDGJ?rS#3SzS1>o<+de;^eoBo@v z!t6EIlU3WmkLio-4$O&3bkQfD9l_#Ei$(zs174OLV8~phifyP8J8^IHXHW9zlGS&n z2qBR3fXJ-o>hn_AEX{Wnu$*j4Xp&tOE?yF;?h_9};KThev2S}c?flkl`5l`v&1nsU z_@pOI!R`KlAp#P#3iNaI6f}}=43^8Ho`EQ&YMA&4ZBQgCtuSbu;ml2J+Vm7T4yd#S64@!WW+|r61`4KbglMj3P zruA|~dzoI9{`4#r9on zg*pp%Rl>FeCLYni*Q6S6Ew+BCc?T*$ zaC5N`Y%3q1R0Hmi{(dv}Pym+jSqP|IoxO22t7QMQpC36Bq03fQnovGLZC%}zKw))6 zX(Ah=KRkIo@ZSu^sC;X2Ba!Ik5Jl?coOGN>7i+qvGL$3c?~6o>mE-Fm0)V=?xRKHB z`5Cok?+1VQwp+Q&e;Myppo~g?cyvVha_o)$5^(V~PSsqf;9u#vO8-Bfrms#7cTf$B zEZq`N#B@;kzhAPXom+@hUpy~^MI*wToHuh<2#Uq%R8=@?tE5dPU-}!hZbw~yui^UU z$)jBN5YzHD)N+;FIE zKh&W~aZoi-Ag4L%Vm3NFKA@(4Y%bI1H5K2ivo3Xdzm@x|WUgeX1b)jw{04Rxh73}x zvHsAmfmC`F%bJPSO4I1pN;(R=B`?pyhs1oUe{7yVepiv8UKLil(C({a?k(j5V>#v9 zH?2w@TYs!7U6|`}SRv;sO%20TheDG@J~##FJE$7AtnXC~Z=Z4|{-)96=+bMKq|s?M z=mgsbraSF1kYAnr7^7IZ!au*wZB_i&WmUf_=94I^VPKrS zWkT{cHtKVn3y$OEvgGzi`15u>EilPEIVtSDS>*feFlUvj_-GfsH!N{H_|fz+lLAbn zdmj0&G;jG=Wo;o!0On!FjfPS~<3iSH#@K+=r`clr*to#95nEas_F3N=RZaVqqW?;f zR!T6Y`z3KuJ`tJ{e}&qdf3|kp8ia7sOae1W4T3oAjjdf3T;8pxT0M0hdXCFoe(;(J zS%NfF+dzv6Xga(96H5hNTOB`G5G<`=iHtJZlu10ZaV*#5$V2afZ|Vssk8iDYg`qY< zT2?evWyuS(f>viqufH+abndgT>TmqU1YELLo$h5*@16(Z04tj^UNdDWUQd2VEswPX zjsstPK62AHOEGIW_VtzR(3Z)WZVqMEt|uoH(A`dX3;S$%jLW!v&e4>3=((D9JPHlr zLv8Pyl`3$Yb~B6vK|g#Jby~?Ds`I^4+uF{p>7WFDfv#4|a6JxSvPtR#4Ldxxi{aoO zyT~nPL2fo~CF>cElRV4XsyQc`zYFbHvIE@oU%l_Q%oX2MxOOL^8;{m109;GT84gfZ1tfiCYNZ?{rQsm%O-0E@AvnKIKT9!Vb%dnBxsOo+~;Dqe{so@M^gGZWzmcxI)P`afO0de`QV|tQS!Aw8nLorDiFU|3&@W`)c!P zHkv3uzg@FZ%_!_+O#x|nL{H80h3R=Y-q0rSak~@cw@F!qqZV)ANT?X}v@pv>aPsNRj-E!Xk|!{_%PHSkD}&qaYbH2LXjL`Ag(x>{bu zCwuxtwXCiS{2jrujYW!=qLk$sl~@LEvXUtfX}1YI=B!HC=x7__7jrB>Uee;wdhsk! z-ypE^?Ry{{g77OP7wFv%gGh<3!PZP-MRocfs$wk%V?B<$9T3w4O0O@!9_dA{Y06$7 zy*<`<2=BK_4Qg$x{`w{UE~Mc|KqVdtJ@wMyI~ot7obNLDpvr>7m1xv)VKTkz!*kk@ zp_+>{;j<6f!%5;`xrwvhtBiw_oQ5I4*5X~I&>D)$(HKA(QlgH4Yp+KnI(Z)RhaZGJ zEcjctdN(e99F1%r8decXq#LO7BE1SGVKYI%1>p~OU9LqDh=B)Nq#QB1?o}IRplEg? zP`u{9;@HU39|kXHBe*)X4lz%*rX^$Q5?)_#Pc`s+G6wbAJ z8Q-q&ZL3%PLV`ckmB_`axd~rvi0|7#V5nxj2GP3R%4G9;8pBMX zFJGh@hyS5ZQ7$pxR>e+=*6Z$qfZ;2xCMR|+2j>klb#!{t2hrU#PVesb?>aBmHwjzL zwK#Srt2(KdK^mZkgf4x0Jj=U3DX>`1b~g>(`0KIBcyhpPO5KlIeVV%?O`YNsgWT)% z=i@ZTKYdaclWM3#%f_D4xhE#LT&3i)nGs(BLBR0riB^l|k53m!Y_Ip~Y+d%H$IZ7Q zEovPyLA7O`C8Ybtwa0AdQM>#* z%JCS$pMCS@VamtBN(_k0X!|vWeMX99|IrVcDu_nd;}n1SCSPNhXI!4=F#l_LCYT>% zq|wvLcg@SL&fCHSL|)-K9#Oim(L&rtsDk-oQ5-z)xwbMfw4 zAkVNJ=TPP;@GuAWs37L{eGw&%jhij}6Z=v@+tr}T&xC68S=T4id&PT*N{P2Z$9Kzv zNYTAwItOWCauj1xr(9p5=k9r16Z7F!ExB#0j;Zs+!sq{jw=I{xJv^wV+X-#`9I{zn zz$E8wZ;MiyoNhD@bxGh7%wUiZk)*X%J25aVqa!KV)9J&aIkYP-)+mWh)>veD5NQzf z!K^DN!_>V+SsO>gWJ7**I$=QqZTTd^g*wF(I9Q&HDl#K6=6G48T;1dUlp){cyfV_psG#Iqr*$#>&otmt;kp&SnX#__{s2 zA1r>-$~4epF?`M9H+itvlsaIv?>fIz@ind3g(J$vGi$&TeGP87jSvv8Z7?sQR_3)s z63Cm2%_!JOy1cG!1=Tu0L7TB~!%ANfK;vrvmV3~PSau`vp#e^pah!aM`2qcJ@>{Ni zm~jt-BGA+lbJsd+>*TmFLy$XwgY6gfmP^~N+3-_RL9y?9Z}Cw}RnWDz zxus+y?;JZc)=B-%<@lP-=jqS2tjm@3=|SK}vgpJmAv;$&B3c$q1O27Z*X^n>i+|4E zt}2n=O|!#`qa=QunO!}u=>~@Xk!ozagI*_b^%9zD4 zQIA7Qx8zU4M4w>@m$hZTQi9L7lsYh-OlD#$YpvS;X1{F=%(sof*j88m!>MY_+a$yL z`pL-gr~nS&`i~~~dQ+@<+D)e@roxcZalBf)5XV& zuQLiGjOI6R%?zb6fuw|n0%a!H&nMxZA(6!j4*So6wzBQUl0L#r3vH!8dpO=rm4cyj zytq;^|FmM4a=7Ncg6DWc+)|9a_P#2_+DA9O-ih8jPV7UcS;GTQH2hCj;2M_1ZUNTJQw-ZAo81GXTS7uDV^@ zSXzCd&orrmid^YShSIp4iS#~~c|FhO(I?EjAW^PEhHu^8`Q@#X|8dY#t^p{@#q2Ej z$yfN5V5f$3d$1!Qo}pL3(^)M6MjV1dU)nvTA~mbe40`w-s z%Jk5#hR>N=lTYDCgHoU!RLhkQhaHMyPO+?_T#3;CA@JzBO?Fz&75qP-SS12R!kg5Up>r9N$~X{&d70*xo-z| zklC%bvj!i)c-HfJ5|oJjg4Z*uI(dZT)1OfQoxacW8p%9-81mx5_+6IObzQ`7(o@(` zdw)_IR9%WcF5nXjy@G$8Y_}<~6`;G0%X1OW?Uup$igw>c*tD7+;Y0OIp zzFu}-{Fi$y9*dj1vHa^_a2jAFG3QU7@2DY=JsI?D*5JKWs^WO$Az84v2vrqsXt-im zefHcQiKtSHn=G*y*Q;f`D7E}8!*Z2`Rz*YUF>+;?e5zHYa+{^sr1#I=GogH~GG=p* zm;CSp&$Llxq51xMmz@6bg2x@mCI3jrEG!1~*6?h0G1o}b&DT3IYAUTeZ`5t%9q*uQ zaB@t-*mI!ov=UgKX*88^Ox!oR?Rfiz=dtvI<8b=ocBUnxiA~pMTe-lwgPP-9zS}3; zNblQJej;1uyxT~;7kkpXs8ZK2BT~f8o7YH_Dh^arK$#1tI);kRm!+Sm=$FUWy}pe6 zRZWn_@pKzag6fin2z}Tr(nqQP8II&aVbAMVt>HjX8Z#xY!@TCwPW72F{@PU9Bl7*O z`Ed3>gWPt4{92z+GX}IdUKZdcW!mbiUm;CrlAf+{89NQC(YIe2b89K{V=(RTD$JS6 zfAND>8qY6eev>wo3C=ZUbIZUEGARqpk&sM}r>_FlzaJz3ji?bi?pLqR<9HN1rY&Eu zOR?1_JFHVC;%-MwP!~j(LYra)RPDz}Rea780J68g4dbc6(5q>liX^Mk%2LR78oLAv z>Ab7|Wbue|bGL@J`+0psz3u|B*3d6o;^|l51A0f=KnXbtKJFuZbcEDFr|xn#68W-y zRqTI6!bIxpU7i8kruTeo#rQiFy+sUCnPqG2DLnnMmrHs&q&rSi6H`9z)|lG@ z%LSYDABxRCN@BVE07;;9467eT2fLD3dW!r8U!_>B*m}0hX?JkYvFqB?{BFRu`Fbh+ zwcvQmG#kSTJ4AclihM~0-ryOPdrd~C5pY<~@n+jHWQUw31w7t2Mo%iBOT3rXU(Gyg z_Az<$s766S?uW)VEb*FflYCd#W&J; z`$dPhc$oMt9-c+oKRxMtdL|M2iPEAo0~CW~sNTv7Q@nLuLbuIFyF}EP%>Q1?eO6yP znl?bW-UuF;ISA>J6%2ee&=!9GKO+#5B@uX(0^iFLYx-6WqBLx6{GT}g{}oJUBn=t> zGSq2@X2e?i@)_2=g;y0OGae>7S2S8Bl!U>rPnS3bt^G-tpjSL-v#djbO^_wR+w)aQ@k{0BZvp=cL;_WD literal 0 HcmV?d00001 diff --git a/education/windows/images/teacher-get-app.PNG b/education/windows/images/teacher-get-app.PNG new file mode 100644 index 0000000000000000000000000000000000000000..329607edb9f0aa65065e4a20e2c19742bbd6b128 GIT binary patch literal 103443 zcmV)8K*qm`P)Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!~g&e!~vBn4jTXf|D{PpK~#8N?EUGJ ztVwpC2cFD~Ju-5?`@OZVy`a0%3%b!j10Vr{07yX+C5jqxMj|nyjZ7xZn7+)I&6v%6 zn}1+F>BB6hF@6yjK%_JzMM4k>ZUPB(qZjm2U3IJOo_p*|Mr6+O9M7yS6btCC-ch&T zynZ9%UHtXs_|Jdm_;L58-}*v)ot>S3`@tMbOH1e9esp}ljvrK= z{~+u7am@1%>iBMy^Rn`kR0AZ=U_dzxWqpV`Jm|(hv7Bo6TZ6on|3?zbn65 zt!DWC9_Dj7mY0{$e}8`u%UNOhK{d3C_kX_+%ezKh{~%z^{Lbg|^IzZJLt^#4sOuk8 z2l34g^J-atr!qDkkK=FrjlU5~zy9mLe)em>_G^D)0QKbLm>FH^PZ&yqd1>aRg z*s8T!5sp9V-RIZx>No!T77p*rH|4Ll9!twh1yFwgGI>gV&M3R@#_@-f|IT@R`*C)5 zQFrfr?_1;iR!jPu9mZ*SS1W35-&(BiR5gF-$+t)IP7juuH-Yk^O=QCIzdY?J3BeDlL;hBdiw^8NN#oJcQT+A4{@368fGQY_ zCX;;TJ2{qkU#(J!O1)lA{4pS7x|V2=ODn>_3Nm&^(^w9l_&3tb?;?Imo_Aa{BF>(9 zFZoGR6|^n^!I#eS7@2tHtRVS^Y-uowr!_`Ng!K zzk&Z~H+(FYMn>?%>}I|_#rHGf%ZNRD_BOycKkY|e;?`3E6@gzVky8#ZsC?`BHKXCX z2XE#c8?Uz-%Qvohlr!b{Nlbd6S^Qzq)~08JX7u{Z{@l3I?Vi;&%Ep6>Nk$e zCeJP-2jyycE+0JqEM=8H2wsOVEnrMGaM|Mdy;(<;-T9Mmxtl-Id`6niW6w|X_2!9- zhdA=odHPMC9p;-is0kU5vStJq@_3Pk^ZUxv<@@Q$EIT|OpgQvQ^Vs=3i%PW;je0Yd zX*)lx$BzK@TLe@q+WY>~|Li}DPk-uDG2yvyx5yM9h0Tz{`bQilX*`|B{^4=Vr;|9H z4QL#bSUw%c>3kY1N}bx=g3q&g0?a9&OH`@?n?ifGKpX`Nz7t;ouk*JiG8y>2B+!{2 zK?g}zn7O|QetCYGxbraMUZZ6S79vr$6XW+;<0rntiq6xK0hsdDODnO$b1O8qO0^!# zwF;o;!~Eu+>B(6Ph7&rkK{RSBvD#jxA=P3sCXd`#sh~phOpWIS!mK(Ha0XcWt_6R~ zE0y!So&yODdIe;ilg%jtKc38DzuS#re-!m?mHD)}ParvUS0Hj7bz9MkcHYUO>FAkp@Ze6C*AL_IBS8HY0o8)?zW?`s^WVgu`=wtxKl{Bu{xBN!_A2()=wwjrGZs`)yLll(63 zo?cKo%0zJDY=TvV&jb?wDd-73H0pc}@fzLoiEs0&pvs5$oFAo#h4*D}1GXXKXtrXB z#&HIaEO_r3jb}QV$5C$_!*Mq{tM%B~+yn%g(I1X7wpwE)TJ1)(EA_&@d>3JHo<~X| z0d)l?V?$pe2;lM@i)#d!_J^~$eg9z`9UMiA_uss_6HndPLUZ7G@-pX{E`X~&D?797 zn26_;|9Qt!mJ#m-aT1icww&c4pz@2)I(cii+fiR_&;%HWSkFV0yI8F zA{GGlSiqjn0BC@nj-ozZzfpgU>~KwZqvTzT-!L`fdOfhVuXTum9`# z5B|bmh+_&3@%o+|rer~yDyXFW?jY{IaVI8&LChydaXRhNs9~tHF^y#s719Ng0xW_a zYzGxjNC8PQU->D!67~3QHWxNj8wP(%Fucq^pQj=sfN`2dQF51dM*v2kOIDp{FRsdj z{7!=;Zf;Hx@R_uoafK&|li-71=K%?|%61b*R&M~Pm0HY+dpcXhY;=;1c?6>}KkI9a zSX)~IXDAB*RbZ>Z{5qX>G?r_`W#>`q#`npZlX|Jnn>fnCZ23(_d_r0#lSPciCvoTD zF2dV|MXtn^t+lvyZHqLmWSVD`=U_18-ojFsRNal5!dZaI<}S^meBXwDLkO`f2PL0e>Z(X#@4Qi6kkL=?SX-7|@txXIBO2 zYOu!~A@^P9d0Ig&uUJ5`Vq(a+`Iqi`q>mKy{3*;3W z$Udjxp3nd^;hYF=77i3qmM*AHQ%(2!9H2kVPvf3*9&F6MLYr*brAbrP33Xu^m?**i zl=s-RtN@f10Wd2Ua3TGcp=IfF0$^d%olDlbMeDqnHD(vfr#Fi;pAWkc775qVELJ8AO#QkJoi6}j--GWTeIHUYk4 zPC3o#aK>~}c2rZ!X9gH9t<<=guEFm-m|~D$jKsLeAn%lId#aMM#dkYoPOMlqoF{kO zPZ=s`e$TsoJy+f#{4gBvl&)_zTpW}O1&q+X+wg-rY@o7*0!-f|c;ENP4dmi@Yk{Vq z^Dcoj8>~Q>-}wZnE}$eoX#A%Lt%8m&mH?$nnxf}5<4s^I4bl6~REdoXfwys_%}sDc zf|FS&*u=er>gM~ooiaH84XY5lYIRu{-#K5Y2pEEVVWrEdx)QHx(K;if(u^5wS*H*d!glK$K>Jk7JtWJ4$(Cx>g z-Q75bnT^I%8a#jqkW67-gW({K4i96{>n9`Y4|-hVy)d{F-Yp=kz?!#rF2%L0H#2PQ zT!jU$#gww|O-|x?FyRvbwl1J~mZL?SY~EaHLtawF1sDkn&=G0RYnmZs+Lnc9QZwLT zfhQj|m&E6NgZ?CrVVDC{_9@J|bW)Zr;0&X!!!~QE`F1jC%}kVcR9|q`j$4DZ)?$^k zcRFjyntg+viEPT)a^xHanVlqMEx4xaDMwUSsZrB-elPcAU6Pg}KPu^@m(LlujbN?g zF=Z`ypKu@XoWgLaVx!M=DRaOuabyYPJ2Pvh+dtl8;(V)ZVx>~ea#FT!6Bp@wr||9K z(041Cw(lfd9Fze4F2ek7f(f_)k?;3m;cMJ(B9z}WcweJIgQeAckB&D1HH)K^NuHx& zDe@`Qo~F#Ru>FGYA!SsA0_dk_xi^Kr+$cD!f(xX1EuSQ|bD_968UZG$?N4l zvz(08gxY|S38C1yG79hV*}R|U&-mZ(oHkC`dEQH&(k=;0o6g1nbFl@cpv$TNXYUu> z#={W+K8jYe9#^kiiW}Fi#m?4FY;W$w&8yer*{7a~mtS}(UVibVc>nv~A0PO!AB&eh z_`!JgrI+KzttX?+y(h@eNHzwBO&t8;w~5jt;|xZeX+CGG#RO8Sk1U$01hrCD+K&Y| z&H<{PKOxf5U=|}7`(%O&4$IV3kt z&h-tz)PX(0EM+R+s#K8_5|v<@9df=Rf$yTeyi`Rt%$|9&!n`dTKi8Et$%grwQ63Z6 z?~wHN=yddo8JwFCmdKl(MrrRQ-$kay04v`5%NOMLLLSc3z&YP%`%`m~2>nsP``(T- z->+ca-VX5ZHe6tgC6N)n+wg-rE)xIt483FEzH~iNh`vY1MckH2e)r$GF!_&EqzEcx z+~8%ua6gy%VIxVBLnB^RRg-B_D-L+5B3J!XU53q7>i{5ND9aQG>x~MHvjITXGBn%u zXs_0z)v_b0@>vB$xo5S;eHFmea{wv7I~^N$Eq~W)0<+08ktH9Q75=l)3Vf=*=fdLu znMUumoU1eleKu%eTZ#U0H}1UlM%;e&)wuojSL6Qu z`!PZFUTv<$W$wH6bb1ZT zFAL1FCpA6?kXonOp*^q0qIZO)pRk%`>vvMee?<^U|j?IPQ;PFq+0hvjZJP$|;eV_rg>y2je4;q{)=4EG{xv_FOV># z21eRUbCIh*I=mfYzF)!PoznAe!o^V}h2x!WdZ+Lw>Bz!5FR<^$aZwrB$P{LZN7df5 z{?2px@9kws;{ZHmm&;X{L;@Os*_1s3o=w>#pwgmYwPBNhVP~z8q1CFz+Byw%y%}pX z%w`)VE?}-UVimw?HLEn(daU!k(~%7UnhB^5wwwbk_ZXUl2ET2>*m@SR3{GBqrc35^J< z?b-<|sN&U?8qby>Sg+7pTa?Yy&)ft|0n+E5f)>tWfA?X0^-EujFMr{S@%z8~+4%hL zelGst^IwRsf9Wgn%9phb?iLhp@ z6TbM;@@B;*&=K)sp_yb7CuehDaS06pV5P%z05HeZ2zpIuXZ2lr zc%*rQ!;>zQpB|uH)2;g-DKGeNVH9G4J025H$1QY?!)wO1x zTj$)`1`M>rGk|Op#+eMLC2#_k$zTD>I)I64DPXEn)?quTRsx*KGWb-`RpV;_UR9wt zE9A$9E&E6&Vjj*VByFPrs^F3gj_U$(vk8y`?542+*z2umzP(3wBe3ZGpsiKl9Q0s7 z2ctMR9K_L4FS^{67cV7K^ z+JQ%=6hj9YKn!!rvu&wEUc#r$BzxOD1?>>sVuiph|UxC5Co@Ry3 z&Xu@+_1Rc$UncKO(yeO{m6EwIpEdGXG#pDK>sP}DbYAu)u1!&o$Ee9;KJ5_F!Jf*M zW$O;rfjxIfa~oi-)&&rwu?;lzgLJj1l47Y{Ex};_~i6$$6M+Cw|m&o3TT$^3bb+# zq83J=3csZPD4&9rf}Z!E0vhn48fv?&6mXP@)&xM+K!B;nZ&_*;mRdozUughuwDn4Z z-w6IPjnzT7B^YC@*pO!k{fu|O1!zFda8m0$L6~Q#wR5W4MqxvopVE-xgl4^nlT2qx zzbvGvy@V4=kLeKgbPPxUYz|b-W&j23N(cX?8L60`#2M!Y{eC=nup3|e(%0e@fK^tyx$#7- zZ`_JXeLcpM(@apM94eIS62CkWKm@%6DBZvUAg%(++B#QbV|5jcU=d+-<9U3iVCqr8u^fK4_ZPARA!AptWr5lt z(`5)m^R)_RwF>KiJ=OqJnZXjwLbYG8RPR&xX9(k|jSKd0N&|qvA(~pQP*L-f0|3oN zWP{}$itou{DIj1mnXSZdvJ`_6>gfRR)H?^2HW>$T7?x>28f0TjbPy}a-i(U8`-L#)O;Z3(fE=I_3!-DdZ$g5!o#x;MvCC>S zJqW0?*(ADvuIhNT)<|Y{=gz&jd*^LDYi_E*_aiI@eXEO86 zt+m+N+C+O;i!}hX4I|YQB8VhoB&<+qPE;@+8LYDBfYzK$2|{xiqDI!NLiw6@K|0$4|ER8%T|RgRoiE>&$@9d$=MVG!SRM*M z3IT^g{9QSe-TWZ#ltBdb)gu1H;p2;M5?o=cr zE^vZ)i@0VUXmDq+fyJ2)^A*_KG9Y>uqe%cZXK~z}0Zb<_!f}4iPHgOTVnW4r=8Nt_ z8F*I~LuoJ;O}c&A_;{TSJkOsu55HB&OkFdBey4Am7RV!MvP@;2`3V4_{ioe@s&6Q? zQX6FPX(c_GkCLBdX!zNDIc=)~rVY8(Y{d}3ymuEcMV;3lQ&%dd_&SSeCSZa`b~1CK z)b(fP`ROd2HmXmnGn>-AOaE5cFhFnu$Q~T*$HU!+aSw1kB<}X+6|{lPn4VQ*zEUGT z!KtX}mfTrVOVUcHRy4QB=1}R|tI=vW4c7cyc6J1{RM!i@awrdcad6IFNmEGaWJ}p6 z&}x^IS@V0&cgv)PhLYUXbnPb(ybBQ?ANs-d6!6 zs}6+HAy;7Bl@&e->BtW&FXxI3P&K>`sr6ysmEj^!{L6auQVI(1Ea@_N5c_g}o_X&d z7SUsQD7+Uys-S(h4n;@1q%)>uTyi^YPlmKfaYnT|8x+!4Y?++3;i2ATqaYq`&+`IJ zvYM71Y97-4X2y3}*$^ z)DD6;EeAUb(th5QvqO+QPET~ypQSm#Sxo7gb1JA-07Pd!p*8|oGTFnUZqANM=YD`u zKo)G$>7VY2=@+- zjCR4>J7u8K{0BP-T`W*h6Z;z(kql{}>%?>tpz{Z~&>fmQjNEp5up1i}lZ zo}H>CK^(HkWoI%e3lycLZV6{+OWBn=U!tQRj|72T7VE67EJ^OM{1b>}x7L|*#ydnn z{?8+8&3p1hIjfzurJpOIsis8Q8`N1{zhJNP0y|DqP*O%76I{tIKx}qWHvLlGkRP_G zb4)Ey0@gVwb^iNtIINq;@<=vx4x~jr`pym;?)jJeW@8g`6wRDT<-2I)MZA<)dU%-# zEkeONqhTtkTBICd7KFS{wbj;e@q1;ZP9s`IZ3Re1^XLMk{o!eJ2lMFlVWP*A*xm2N z?p`;#M}r(JnV@3J(k3u7XEY7R#m?yA0E%hM25PJ0b+(gyqm3uah+o-wOrzJ!rx^sc z^1Cc7?;$K{x=@w$S$=0R_@5xlpFmO3wpa(y`K}+QBmWEF2Hr&4PLoYKh1YZr2gA&V zCWAQudhyIj20I`D$M1sdd54r`C47+%I;#rcTu+r5Kr=0ZEI>Y==rcOX#Y>F){=;tc z#}V6?pF%D=#9Ng_5+C;i$ee^hYqKQ3oTYmpP=5ejUZ)6nU5@5A$X~Ug>3};E)Vb3~ z41CG2#>W>sFYZVnH4f#1)FptPp7NOkNcy#UUM_CYS~n#+%cKkx3DErV2G9HDyxiw9 zbAD<*Xx3ZNasaB?&h-e2_Cz`5pks{(?Z|mF@!qtXIy(iI?|_9mJAC^aOEA^u2sWxK0R@1+dMm&#(e66DkqfNG9A%L zY;HXn?ap=BVU0SfCjKUr!9Wu{dCt1E3&<(HiPF?9Cw)ipl@{d4e|A8o8_?vd-T(>w z+8_z3^7Ci<%~+16^F2Fy;#G~Goyz6`)-%D?F2h^BM@{1VSq{s))EVzfsQZS7VdrS= z33RgTDxGtBZ8(4=>!vdczPoanW~5TLfM!N$EW~C8jMMay2fpMb-{xH<0p*8Xn=xU zy829v0aTZ&%UYxo6VQBzU_rhv7O^QJr1u5@o`7w-%Aie_qU@D)n>LpjlvU@S9YUH{ z^7e12)^t48n(DaeUM}u!*%|7`3tJV`J$SF6?NLC^6Gh5$pwf8#Vdui1*scwCG1u>R zo@)lok+;QM2789=ox;|&b(5|c4|2cuVj?9jN|ZRwcS-=4ttY>8s=Pbp;~a4FaZB#; zIjr>`9p8nc@J@uw4?tDPO*`1qc?0w}%rIFS-xTk>pWt_$*q3PV)2XWbA`W^d@euX> z?%pIG(7^8>ObD~Mb1;q9_s4O2e;N-D=5aU(7+u5|4c__ePCwo1wBy=#CvIF>kDCDL zmCbhSY`{{T9I#rCCcq?+Xm68nn07yHdo~i4&uloPRYoY=lASuaG(psSohRPw;+l<# zTx0_*_CK0FjehRZgnW1KLvMg~vl^Wiph_CsomSM_&TDS~BK6qV-hq(N=PXL)cYu-)yAQOVA(713wh^%v@_&+X|v_;f+j`7ux`#7Wq!{JDuMbG)H5BR;Nrvqx=A|b3+gAFv)o;Ba5$Po zzcG_b+7cZM z(m7oKb@D;8-Ofd$>wM3^d9S-Zshx#tx@x-&*XG~1hpM$=^U^g~rlt^8VswZcgeoAB z(=ih`tk2T;(Rd&_^d3t)Qh)xP7!f1uSJ=(JFbD+ zqTHM%=O@~QU`_t)@Vw7KrqpzJK~@>EWF078S(TQky`JUjZ_+Nf!j-As^BH@*)N-Fv z#v?r=C{L%Qs<=29=hJF4b_&)_K~E%sG+l zI|2*{t1W;6rl$(4YA3tUb|^CwY@AZ+z(`U?js!Mcq20-kHy6#vu8sndzRWh9L zUO{>~b0Ol03Eu~k0Aye<8K$`ih>J=)Q)mI$X@{goAXlomhVov4q5+sXpIsoU01UjI zcIUlB&h@2wD;let>H4HCRiM)as|Dz3>(c}>nbG(Gz5*uP0}CX{sk&;L)w4Ed8d>g? zLE3xyon8jK!#WT&>&9Ux$J;9aizC~Ol@{+=BTbE%qXG*OP2R5u#I@^B5Oe7?99+yM zV_hU*xf)X`Lor4*S5U0iNFQk|-om9rxd2epQ?-Mk5S+hXC)B8y8gaRsLt(t-eRjmT z%K>qv2_Wl~PJ;Ycv*yJlrE0IN`3%2JWwJ!lmF3|t05q>>%n7B`bGg@Y)1=^gbw?`; zz!2YgTD-~o(#^|*^F_poAm4Egs+kxo*Zb!bIdPo9p3mRc^vf7e5|Ew?E1COI<|6Oeg!I0VZ2@@P<6ADr#QH z!63k433g`jX}}g0oaeQ9dXocks{I1il5x~wX)w)Jdo@8*u&`9K zd;p((A9)o(9qcK#R?Ptp>djGW&zA#q**|~7#+K-4WS`5+jnepe=43ho#9*Y9;pX<0 z>Dc1VOcU zekdsdHy?xqNy^ktQD?i9Ex+@T16Y;-0GKC~Cq8^WKlt>|PodSXcIFqh@O1X)swR{K zUtVVU+v%7G6_WGl_&k@}JVOQfpn3MYj6GjWzOx((z!O`(=W#i*NPcvD^CJaBX;SFU zgCm~hToJa?xcy5+O_?kI716#pY#=_gEb{t1-)#%p0Ox>+XL8VB1}$97;_Q5ZWmm>` z^xnY(o#g#=j{MYxM|e)JfNp;r2M43rI|c{|4q)k%`tWcP54FYa4dV3&-FUFyjk~+Y zap%DizmGZZAlLBx+(F#s+`UKLxX>1Axz;8=-r*=X_qwvw(E**x?qTddI*K0YbRpR!qcJ`DsOk++rM~TWmbm{6ia4i3^OMpd@uD4_$s9;p(9!st4tAM)m&rp# zzgoV#$g~Sn>j9Cyw?PYpnm3+2ai)}?XsI*tP2%n92~5W$ zfV-=oD}Z1FJ#RcRgIh7mmTC&m0TFBRGM+=^3AjX?;ad;u0rSF zJ7KVN7!{|05|wOKa2-3%)TQ!z!%TGO-zDS4)R76K}ABN!T|-^ohKsv^gC<>}2197HVUhoau6+#+*M zi&j%|l`EgEt<-XMTAdE2xP%G##7RU>CdmOR0h;nQuf=Z8n>a@Wz8SYBnM{NyACn`q z{5T#msc#nEdZgCEsXu&=zc0?8f2QgK0`Pr_23yp!w}_S3XkfbE_*?(egi#{Uc{^DE zH`fs2c5Nva$7rbDa^01b2C%Chz|)1r`F%DS(@>{0AmXC|kNEAvBM%=P#=VCJ@eszT zqyJtmGuHzwhY5uH$1uR&2vBig0x)rq$JsNTHjHrtRd+qMwm0L-wM(euSL5cbYjN}D zwYa>qlYXSCu!5)qYbuw5raee58tqpzM_zMHS3tE6pt=fH9kpK)H57rB)Ke$`wod+fJUEq>@7gmhcbTT$wCh0>p3F<_ykW?G*Vd{RO0IEB zI@KIpLQt;)H2|t6LDwyK1mdh#>zPjpMbW;@Ug`WV{9p4fv+cXN*Rx4L)I=VmgRDQE z#~%j9KRToxPWqG2D4Ph$o8cTdI25Kd3*>M9^BDj|xbY|~q4eY_Xo@D+jkEklz`3ce zosFGa*zQONn@$8dV<2kP1xVjZv8yh*>Cif4bA*V%=^pzFji)}LpHOR9AJT5q02do`v zs%ZyKAmw@2A9WPI-La2}xpqy$#TF$l;*tYWfY6vcPsggd#aHq~>WO;n@QgOh>C9(! z|Iv(KWx$@i<($DL)3Z)Ul;^eUl>s?51b_~}n*l~H9^=55&*ko^b2HJ5-UwC<3)R~| zvxSRxcPM8!x3h+|$&N^)>jPvSNT-bP0)IsMQ%L5hH;ul#nWAY-dM9WeFxe658}d1k zp>n-TrwG_4sP>#8W_+3fkO4q{F`x260M&sy@{;Jqk?T6h5(zG%xI*VRi?3WuG(3AdoKEPVyfc{*kK{DmCpRYBc*E;TOSOF8?e;%~>PJiM96 z_xSNx0;+P7JuZUqW>B=K__qedzygwimFozT^7Zz>JqC{pu_^lx`HatA1bcnX@jjL0 z6k4upWwRaR;?OO(zo^F6YCQqcu-=5-L0xMIYy+9UyuKRG+`JMmJbyi2e&J@kpYZZ? ze1HB%y#INBKN;_P@#%QsxhLcKXP=6fo_{)CeC`RZKTUXwXP%1panH+ympK38bGPEf zXK%y{&)kUTpSlvyKCu%|-`b9+uCK?fONKSVMqGipZf%sEH&uvr&nS%eQ!MJzTTZ!!>9-Ejq9DPOPuDbI?lLb`M6WDZ)iroW*rvUo^d{ z#d8P#TsswYemc}E;*3s_a^O>2>I{bKJySg?V5WU%zjZbBkj~*eW+URUFCCNi6Uy?` z?gW7#UuS2|=+g6{84GQjX9PNj1%PIr&99QIyr!y7on?of8kO3BOxi-SoC-L;{h&+8 z`ZS&b9JYsYCKsDN2izhEo;_#DMKB(Vs^U3R*@dV#*5UyYG+$DZ*1B9!DPF&t<#m-hUE^S_X)?;g( zu+~b3y8)oLtL_0`A&>@M+9W--_3)Sz@lmh^?8!c`w3O&w2F;rPTZBJ#&DJ75% z(>dtc`^t!VHsr-hGD~pAQi#3%gZS)ce>WaJxC0m$mN?}FV^mxRlO}$Gh^qgZ26DxJ zXY>GK0&7_eg}}YuFR1z{`^-gD&d>S$#pt#Gt5<|&egcpXV6^=HX7>c60SVM9b_GMmKZf-SP>et!Ufo9B{O-&q!bvD+kXIn!zpRXUrx z?od3hL&37^p;~@0)CDTO%dk3AX##VV)egIq?*PCZQGOF7iZB~d_Csei0hln@lSP$u z==!uw{Z#nPxjEPPj_yPHdCq|@@^443)VY9+`+3by&;X{c`2cGseX?84PacxnBGE#s zb$h{5E&KCw^+wwie?DNl@^?Pzqj|%7|2QwQ$L07&tzI;&3@ILeI4B4uc(1`{zXhpK zjP{H{oHKGh>b{vn_MmV%eUsxWh|%4ZEgt8$0xHLWJxkKR@MH=I2q z5Uw|4bFC5UZJ2GR$~oAROgBNX5-nGOqQN#Hl!9_?*)=w4&@^D09u1m6BVRr(VQCKV z@t*w5nM30^OsO7&UMOxDSB0;cM@ezuO-XQLM| z3En4or?0N}W_cG?-r~=|^#la3@r>pgZs3Z5SD2aalnD!rxrH-nKHR+@fAFQRfD5g- zdhIEIuSpcXkAkFk)cjB;Ho%f8i_)nOOdr2bTrFp%C75h ze7R_hM@-9J)W;F1$JB|QFrx?n707wT;9LR!!EoKA4kT%^X4C6GXB66M2vhw{1 zK+1P#wul01w2*RDLdlQb3&%+J5>B_&=*^|WQ|g| z09?n+)SifAH0KxVs;< z_G(n?Z3{nx0FUxakZA)}L|&EZJAWi}lSW2#*o5FQWp zUMTzV3;HXhX@#<_z*hAJkfHXDPGTPbJ=hz@-osw(-tWf#{a!qJFp7H*rt$itlX!LS zEN<`4!3H)T1oWO7? z!(}?+f{l8&5Xi6YT;5g&0PU>oB&aJhPrSKgqV4H1IUX~HN`_TOi>#N=i(vh~83Yb{ zTc0RBZ0ThU-{jyKowMz^bLu4kq*%WBQX3pXC<|2*WqN{cxd~CN%6<@N&I`a^P&{*L zAOQu92CTb`0LK+ta4ydWa1ICV(bS9M!{azWjo#bak4F#pV}Dn#fNt)&bUGdafPqy6tz)iqvg2^^*)JG-d0p@U9l$Q*S-A9o=Si}@0tN@GdrRzXVheXbv#6EANONS z*?j%guf^@Vx6{d88+T4lQ2QXHn-Jil53ECTE_;_#S#uz!usRoKaS+aP?rPvjx}B&K zDf;7i^hUGj19n3?z%lGGw?r}Tq^)$2)X`|16DW?mgV@{cQMY~ScnHA4P!9lC*y?>i z_SH9z<14obcl+_xdtE|5Ug!K>*zKNfSmxD^#14A78g*?A)STd$X*NHprW?-d*1wB$ zf-1LU$4epAH~5#65(_Hue{UTvL5{YI2_qz-|NRkU8YS`;ZS|?@WMrS+mV9w zZiPU>Ny$=*{1jv?WPT`w2wTo!SIW5H-bAv1(k%In*FX`71rjqBE4Qe288Z$KaLKLU@}K>xZkA#b^%+#6SWeMRGpo}MDvrNf247p z0G#tw`6j6SsP}+QI*60*C9eCM&T-?(OeVRx%wsqbxW;^@O|%=$w%T+G$Z%0)6rO zUCt?)z9;wB=UH94Z0{KbL6bo7B;YfnB@d@COjP0APPzi1QpO|7!NDpL59m)~((h7s z1M-AMP;nNN`F0g3SQ_t8t{VDo*30TuzDp3fSnEK*vJkY{j_CwOq-nx=_-BlGeheU= zaE~@=8L}P%78_a2PQ}j1OxUpsRsJ@=4xZ_HCQEiv6SseM_F5k`e=t1*q|b83TX%F4 z13d`H=U6v0-skFGZhupJMh&))vv7u(D`we3vU4<$j*Cy3s=%6;tXSL9#XW{MKR9=B zyyfeA{dg<@^{t2YweMvOXY2^3K>$q)n+Rir5HRzu(mZl&6z&jX5$$jV_tO~wOQWiI zjYegoTmVwEgJjJLw0s~zntwJfZFOn)gMpm5um$S+*cF5N13-3y8a?IvIKgZN0IBA> zC2_V`o-IC-GD3hAAj^d_L?Y7bj+GgFC+{!7PZ|AMM-!p72##t9FEoNePG zA-YI8z*eiGnm&k!4_TxN3cjY92A%>u>vS&*t|Ps zlOh4!O_%B566XuxW{CrwuwqzWZo>jFnl6{@b9RreJ$7a0W@X6{amt;z^j)1%XAV-O zZI$w<8~L2FJl^Mt6XKwwgV^aJW^G#&I&alhV4#{HjGH)|N^D1$i?)!4^eAxUtO=?& z^*iC23Ga5Bl~X>AM_IVA7wb!F{_1rXasjOAv|Mmy9TuPaSFLqoea)?@*P~i%5{FZb zO+UbVM%hLanP~x@HQwiX2m-13R+fB+Rj(A157D1&T5p1BE)-*4%%Nh&%|+w#le6AV z9L3+(@0=nez@8u9_~yX_kIC_P0qS`z+fbFE@5PbPDr|zM0w^k;3zW?-;m`&w1DT&U zAV+1V{6-DbEk?gYG(7wVJCjEk-do-a`e4Q(Cyz1@UQ?(Ds@HlDa;nqtXY}Et;o<*~yr) zcV^Z&CZl2Q%6i6i%gs7)&}T_A0pH6mp`{*7i%j1o09V@%JnEjc8XIda%-zX7{T!wsbUlJx1cy9Y4tiY7DXTIaSItDWenNhgp8~QZ zFJ;NYvM4k7EF*tgavs(JLQFZmIq>Eq(u4~NkEQZ}VD*KcMJm%aigWo4ZSq_aK zFcwfV8o!etf4IlHD--29ngE!4^0#tbP6ulixmwc@aPE!HVoW@~<-J{drD_91lq6a7dm`0LUs}$-6qOXz;$O%gVu|Dl$@6i)yu^ zy|x~mb|+SwYf)cml5RVTNi>`t)mZ~*n^`{X&T8%$S_7qbwl?GDjmx>`QRy%)c#n*Y zZO2Ykzb=EX2qujHN^OO$#071Fs(d`on8r>-*Eio#($yS+$zY*bq!N08hdy-&>sq=RG?hVhPKXkp%i2i6Pj)o^0 zT+n*|co7fx=7iIDu*>J8N!)+XeRH9d2ZV#8V_4V>cGQlWx30&P>sMlJV-wZB6*a)L z3FB;{mR1}5ZZrT%cUJ|d0HMQ&M*zn>T!h&{9Z{xT*jbJ8~j#GERcK9UA|AQ4?wN)?sCE*K?D zG69rAZNiwf=NA9u$K4_22zwm^o&pOI&lh%5us>CP zRdDMLu(YlPvn9^2(4#Mtwq=+rC>m6DxVP0z7CRZnf@`^A73r`}zcB~~0Ls1zGZ?%! z@M8CNkW%pHJ%S?FSE5W~R_@ZvB+Ec6kIY*Qps4$v*F@nq+paB}{-fTgkdcP8`}12+ z)y$(=L?-IF3rW;XE^p5^C7_nZWmGG<__e>vy?@m4R&2Szn(s&OCPG`yzhmd55fo3-jv)KQz=+Bq3&s{*5O+NbNB>a4zi zQJuz7ZxLNS`;eLO6b3qR0DnM$zux+3>>bVH?!#%^y*G|G?hfLOJKebb#sS|CiD}X&?ju1UmvKET(j#UvaZM7@&1a89Vb|7U<#bqMh}P*xcOA z1(+S2qQEI;0EV*4KqYW0ZN3hwIaOB8A?Lo!?1q5mU=a06HP#z#Is)#agJ`q>@fAQ! zyYv7?>b5j!5%~!_b@M=da0hgTJvzUkD}KR7T_<6vPbutwP8qwYq8f#6N;T@PwL++z zMW?=!t6Vj!Fnk45a3t>t4`8P!0$|HI2NNeVmr5i|&|Dn(C%vQYAl>6!xFx*`%$tl| z>kEG=bHuA#)0`fN{w%dN5df&xC`!Bumw;C=Yun^L1<%c-POmg+3w^i8p z;<$K4zRUM#V^)$BL)5GD-({3u<|qsfI$6l4T?4!e*sm~K~7r)}`Ovz1gy{lRlf zupbxP;2CG&_|6<%=ei9jeGF+(b->DPotvv}Gg2q+3cz^+n4-FCv(#9w|3TJXL~bM^(N}QOfh%&B#Cw*4gwi; zejg3TvG?#GUVruVsBy#A`g(Lw`Q0MKolGaF<^rlyQ1xlebw3F?vQHhRyzxho(AnsU zrM0BYpy~oDgV7+%dzEx_0BcvwcaY37KA~(Wd8$FRmspeso<*9GXMmq_OE)dRYH)m< z+bXvj&2Wd*b<(sBb9NH`6b5PjrxVj<)xkamC(@vedqDX(!rq0oI$gBqoPDR6jx|B( zlY5pxCcAS{YbRWE0PGD|weQe2y4LCBz@2N6+NtWkb##1)Msb`=3c8ZMaxLh|GF>}h z0C2k~i>`XE61C*OrZUKT9Kf_Ll(+?8nmff({%~VtfwKsS9hK{!x}A&zYw5j^$XH}q zu=MlduRuqs69kunAiU+cxXb&J$&xP33dOrZ8}lCy?!w@wNA9vfx%>J33b|Dcc{aS$ z^=~z#CPA6JYleCOstH&Y^bcw9NL44l{^3ghUK|ul9yZOXA=VjU z832W234D&Fx+l;nf<5Ke7)Il~bx0}ssK%0OfXZN+mDt*7#%2fb0svi+DVKx;T^y*Q zeGxN_#)j?)7Sdczrdp5nRaeY!^Uey4iuhrqOQ^SX*j%&Ij(TS!Y5>uSqs2iw7LFKK z0W4JYCDe1+XQSz^sjIP0qjyiJHo)VC08U9=Mqk!P)&{%eitXy+7Chi(XCce(c1Q8> zVK?^nj>#LKIUfULbMm4CKaHqC8k*|>tj_IrG?v2*=7&lR8*>*_vPSu7_k>xGTpwg9 z9ueQyV7_1Z`s?w^y$5mF2Vk6T>0EaEGYOxAeooEI*+P`r2>`_VbBRR2%W|s0;+HFS z!p@`b!A1wM1JGUFSwj_fC8+^r0>CdXqSByqvrYhBl=7GWrem}WH%WxV0;FXbzSAji zhRVO9U6g#BcKfi^vDlst{w>O?O+R)`j#CGbXty~NPHCa;F4m7| zw`HND59_KLd?H%tF=?_czK^^JVq_81g3MG<~jWh+BpJm$!gvVR5 z`eb7zri~nV*Kcy7tqxFyT+o=@B;x;5zw;};VDlny*D-F@h+F9m-dT6t;g*c)wlX2S-8+7i6 zMDaScR9mI2S~jIms4ia%(o}4DL}M&|A)jSBXvCv~eZa<%Z*6uo%;hRTz6zLj$dAk% z40MfE?r#9(z0ojs508?`%4YNrRmJt)b|%_YoiMO}bQE_1)YtAmh=+%VIUUxSS-BS! z@^GQCB-gc*Gu?J>oB;+Xet-y|zy12F@!KWEW~xy=BqlbjGho-IL5ER=;n z<5X1_zS4ayml1@Cx*&^_3lM;)QhyFYEvah*x^7jSGqbqg!9v~LEK3)lh9X9Fow`|V zg(}8~GM(_OKBKDu?b`N64o+=c+KNrW_NC3Jx7=4u86$scEaXjZ4i}Y4Cw>FhiVf9{ zinQ3#*-l8mY`9JtwvmAx;A+6OkO`OFGhSu6$n$wo5s&q+q?Ge?sLBb!-^!Prxdeij z^Qmlq17_Z-tzLv5#37J>H;-={P=8Pb@WXysDyo{=I&&W%0fkR1&huG+G%^9B+|6+Y z>v!OVCafEeGk;uQ!};M3BDhxRDy(F4YbzU+`zaAcHe`b_pDtGbRUiN$b(NvHKq8RB zfK+f@NW{kJXs%VKi9pp(5Y=s|EVozEnjlHKlZo)#h9Sbci@?JD;W;N0SH*XrWi~=> z10i%gZwy#`=B{tGNsPlU911$qi zRZSJ7$CdY0aUEgLH3I-4*Z6c_trjf10?W(+7w&a1D)Va6Dd%kbTyvh8MV@6xBbVhn zb++Fd#NMNQ!o%ntAAyc;c8Dr${`j7*VFF-k1bPq5DFZ;0@=B9}l}i1IG?rU-6bY!d z6YG_Zh`%azqhD^VU8icGfi=L7@^rwEXt^06Bfm?$+nrdAf4Q*|jkRVp0aRJ3%vd(< z=6$YqrAt~)Sys+?A<&fHRp~E6cFerrmAOo+uPSL%<1FP<4xUDiaz8F_;Mw$v^?Q~d z1y}x+XEF|D$uk@z!MpQW_{hHg7#H1WjRd-b+r`bmSBO614IjgxikY z5z_=h8lvFpYV)qLBwJNWisEzI(sxTD5}Ou8(CQBbp{`5Hc^`LpuCaO_UEOwFUk+$R|D%Fa7vW#KzSd(E}`NtYnycfrz8Z;Qdmi+`(sDZjJTiRLCih`N1Nh2_dv?U;<)cW6GL`V7m|PZgDXiF&^PSxPqr zO%^Fbtx=E34(+&=2>{jf=?|RJh-?X>vSMe4ks?xvjM|x6KbbLPf=~T}{VZArcM(#- z;-)elQRULW_-R~#5Fu7hb8`_@&37rv}HZIpCo68$8- zE2aZRn2ZxpE7KuSX&u-x6Nv;uctSDHQXbMS*&6TEeJSm|0Eg>mZCt()pZ-&SHZI?M zE(QSp{!uR%cveM~@yP3Zrqx=Foy(U2%XX^wIRb6DIqRv?00B^Wmz^n8huN+GjzI@< zLVjViX%c}&62Jk1H33^ApEE#aWO)!@1$NxpSWECWFS&#uZ2Rl4d^!H{Kl(?cc^*yP zqb)M0g%Y0{t>xt6HG)#k&?385t)SwTFU~m9ch)~g-y79tuASO!!&2!SSK8Xh0Xrfq zu27_x_u7$K&VrRTX3Z>?p{9c2$%uUErlqDpm(06zXI%lEG^u6eJ2|I}atq}sK-#GZ z$kYQTbN{J)2SK3J@s(@JbD0Fe&(vOIv0gIXQZ|C68Rc|#oKApH12B#LSss!Ke;cRy ze_RgBzf;CJ8rg{+`j~9 zI_RSlyJmoS3|wGjFpbfujJVHXs1Agk06f}Vo&BTPYNTb!0k&E* z8m%^Y1K4<`*XzaoJFlnhxWGiIOHG~hb+N)bs#H@A23qCZvh3SJCZF0RbEX*aUf8AW zZe8hVNIeZ@#iWPFiVP5WF6d(Vs4!Qanvt)>IN-^C$xgv(t0VKycgwGsHK-4sx6Ur6 zCEKd4YeBAEXVHKa)p;gIQu$q@A;~aZJ;Hiv?Vx3b5o$4DQ<{biiueRyIs_L+sj7Mcs>=XsGD#wv zQ5KpUxSP0CJ(pmHa(2>Qtw*QRP8Qc6^yA?0Fj-TUQQ8zs!l&5l|bC&O_o@eI@FyAaEA4&PTOhphtu?P9Zj5|!T0`{avK$` zLl7g9RN=Fnc(K(;niJHl-K@A$7qb700VQQ4<<&oL&0TdLrjw*u(9T}O&Jy6%j#2JCvtD$K}{BORm>Vc zV68?8Oxv3C9#zv+{{Sx+B5@A9%xz<9JHe;l?Pde4)*6%xER#;fQG5rvT+l_f*8;E| zM3b>wK4Vz<{^5SScKh{s$j?*{+Fi-eZvnM)< zv)DWC<<7Q8T|1N^T8Jisi+54{q~8w6on;+V%NbT&&=#7y|3zK!o-`Hk^`f))C;*yY z3mAHkzkG&&#Fk~@q0GE_ld{1_#+8?q;5?B}JT6D(`Eff+Z~DDD1Wr}-BD@N-Yftiv z27-!;y6HS{=j$JJC#bu!4M&>Cu+us0=!{0<`kfBmSUoT(K3!9@DVPG9jY=~|jB8cY z)J6-i=|rp9Id^Dp0X%i&xPV03F_CatL=JfYWMEQGVI`5d;D@U+CGeBh9F*XlGM8NG zN(RfH+|+#8Z0dlM69qIM=&QJ(VJ-j*?JO^J{tM4Pf9`C*29pF_bz1^@>=PO=`BlL4(&eqVacw7V zUA-I|>y7lWY@x=t+b~bSe1IxF1~diaGy_a$l({QF&0wsQ{}9GUhvpR47hZlTo_yx% zxC>Z2Xr&p#j#9tQ#;F>@aRy7~+aVEsOu5)2T?fbAc<54$N8LC+8uHms|J1{y9v!fYxlnf0 zo9xsM*2w{Opsw(h17~P5GG9G1RPRli!Sb#kCw3H`w-d>2d5{rhp#1i`Zd$am<-R^8PVz;yfX z;*wT2Axy;QUS&hjsW+X(K&Q0=u)E6w6{{#_hekOHY_5#&q=yxq=BdFGS-bXLz_plY ztXl{A%5zq(oupl;Nbuot@g8MpaWB1wm9B&0v~V{()de~b>QKLPbSJ&Zvy`G&eA zY|GG!07C~5V%6j#uov58jApYO3^^VQ;|TWE8;oGBI(s9;G?H9RKG~DAWAwK~SY?xb z3Xp(}(^JzoGZ*%d(eWF!)ApAxOZiOcILaSjpn#J~0oOD7lsa%TCJ6MoQC%`n5R3*r zr$d;|%ZT!Xd+in$vQOCY3gEU>Z@@AE7r><6T8&0)4fVPeckexl{YS7)*mjNkU2xf% zUK^J-;$xruXgu-Et+;yaQatnA({ca7-53pyQBlp_Bn}StX^^~!cbQW0z`6O4?mvou z`cHm4b|2i2HtPG@YBR2Et;MrXUXN!0(Wh@-jc1>@5!bJ{t^mx`K{C?@h`K{SoAl*Y z+G`uJzUnGhGI^J_1Mg&qFl86Kc2%Z!t}oh1=I{PivcHO+1cDC_q}`Zwi7PU|Wf?f2 z>DmRdW^Jafb&#sIFYsorsa`K9$XW}6jGd5@LdfrWHSozbnSaU_|I3P9NvcJDnyT_u zw|uUXPqzzi^ShRvESbpnS-+re+S`4-!4A#ACOf|3MPli4p7{MUbG|D@nd<_!UvnUe zz~gyOf-W}|xlc$=jo(46GSKB2PVhS;$Ri&vUmt_R68O>aZ5|1rZxNqwix>HXYF&kPIugo}R_? z?|Uvj{c}G>___Gh&weI;{F9%G7e4U8xO(GOtZ(kb_LXa~y15m#b~F0jqxk>+zy6=` zcmDQ&8(;eD@5S+hhXJ3B&8_u#|A#&p&%F3-^oGar#FJO!!QI#5OP~AKG3f)SYKt`F z(XgMsp-z82L!A}~%%ZF1yLZu*olQE1rI^qO^}2`AJKjg-?a{dB3Cd?@l;dm+I05FV z_7V>rjEJzYz7a1z`$Ft&Z^v`bJ{KQ+{|Dm7UV14$^!}IQ#TQ>9O;5*jFTNa?uHJ~c zD`oNQ(f)3@3xRfL?VOTz!6FxcA)FFUU}|X}rSnv6*EiI{)@{rJcOhzR+^YJ?^ktTW zGpT*rugSb%N<5`*$uD&_pW6X@%_*)e(!Um)n=UL3kghdjt<#PTLQBsI0hv6?1hrSY z4(oi5mV_LMiB`MC;Ns!#X;$3xC}*GHPasvLzX<+Lc_BvvsV6ic!S6ZGMFCvZDYxSB zKAy`@j*I6w=i$%tmdE3GECKbqRk;de>8~kB8blF5&Z&mUIJqvkDu21p6piN;wMe{^ zt-2Mmw$|Jm9#GZ6JC|w$VN|!AiaG}PXn*-zhi_MM(s$9(^eRkinZ~+|+L?P%k%VNZ zGEEwR@0IoBo<}qca2Qs5LY$Kr=&Q;5CtRCpT}5Se+T*oncH*O-eqa2B|L|AhzxY4> z=kZ_tpZ^c>@BK&rethQVKNBDM#K+?56IW5&i~Eubl=S-jILHB^ajdS^<4=F)C*vnR z{GqtC+KE0Y^y^=LH6A^D7>7p(@wqSlejN9XVl*1Wzx=2FB)^n`+7`!`qfTg z!_%C%f4ZoVmy(~^!bPKJacO5Go_^w~s5|pZM|=maxZe#0jqi|m9UdOVF=<)MXSqb6 zAbos%7`wZ>ly&h`aJ8qM&F$C%pmsLa0VQ{k?Zg#2hONuj;>l;81z=x}>sPNt2WEZq z>gAXa|C!6|t)Py(dLY=isM9&3&yMKGMx=2Bo1ajU0;=pZeXA%VCj{twT5mSf-_`9< zc(1vuAQwODUgqtmL!dXvvaHL99M0CHXT z)2SaBIyo63V+P76JA(>!?hdHPhQE1N`lIrGf2UzV{NuOcylm$oxC6dOPJ*m<@npYm z25#kgK9E1oAyoB00ab0MK&yA>wa4HnCG(gZ+D!}42!!AHq54LX$?wG`dv3Qvs8Yp3 zFbj*dT_C{RllCeC7a=S*I0PI3RCQMft2AO8pHnVX1*ZUN+Chzl%-Txg_3ds~$J5ZpWp~ zMm)OnbyV$$W^);aI*a87by@{7s&s-t=wLC7zB{Cz0{q%ft2*@qJ;(vIogJhmff^lQ za~W_YxN=wn>fNT^%DtwEXRZJIbVmcB2(5*@&nF{9Y61Yyqd{G^2sLf2+UjQm3TYIT zvoV2kJRPOkR+C4Ku)NZw18yNWO*++jj89xde3_1Ph4k}D0BgBc?5bsp6VmKpRmwKs zB@THWY36%Myyp@;Ig04}FQ0Le1DBE6az5{QOpYv@_x|yXD$P0;b?lA5(*prZDe^0E z7MrC%@=W$d?;umytZ+UI8G7%!3ks!ge(yqj_A9yx?=Fk32{QNKfeEh^uel*Snqz+AU9Jb}}~BvgSaVI$)F&zUS;A z^6#`+?aeyIyBXbacfvacasS?KJb3U3kUs!e0e0By{-gbPaQ}X|>EHJDdNi7~oI+{` zxU;=MRm^h@((SGFxO(MET)A{9Zr;2apZ?S*;@|p}Ux*i7v8k-sVN6J~>D7T;ZCG)d?IxAI~(%gZ{@9S_17U>8Jtl^Z~K4x)M9<&3NM4jrhR( zJ{X_;iBHF;e)6Z{<3I7!@v%>SCSLxrpNJbzzdx?rd?B{4J{9e)Ytdfap;O*Oj#g0$ zV9-!-=kp7VCeHyZPAI-9?h3r8a=_4xD(9p>XJ>KU7EtWO)TfsXKK7U#WcTqpicIAH z-<2cf>HJ7nBmY$Il|I=hD!rdN;5$n1(rGI+&Q%(V%jy}Lw4O%I4cV4+8fc?IKTplb z08U|3+GABCb!u1T7kwRh)>WpA*rI;ZU`K$~1eWG>OII7x5nR>oh4;T4zx40?O8mKh z`agId>hE0q zTrmk<)PN`XKl@{AVmVh>6>)`v(xF&0WIgkDRmgX&in_5 z2b2@Q>oi@xC;&irV|7Ww25S6bdK`<%VVus6VA?0~kq5NBwXl|Q#JyK9t;Lhqx8s8^z8IhU#HZq?f9f;w z3xD>{#xMNxFU2qX%Abor^DBQoe(ulwYW(ESAO}DB3uq=k9nZe+Bk|<3?~k2pPef<^ za)wvYH6N5k>u=fRC9^51-fJH4KpL}6$j|*yOM85dmA~|t{?h;L z*MI%jDagk8srSy2Dn6gT^vk~-FTeB>OhTdf_N(_B*eQewc$yCiK7T{yj~K$#x_ftF z6eEKEl<-R$i*8Kr$>bWL?RFh@imI;4=imY2mouGefDO{@oP5myj`+4SMpW3jQb4k+q#IYb>ECP+GE z)zzb>3)s%dG?|q9)aR;E6To;r0YG$e7pNdb=N<$CpV`%gC%0tg{W30Xx9WNBp)}|X z07~*~+0a1U3Pbm>1%Pw?)-B!zQ{_E+5zLIAc%9ZNNa=A<+;(_Zs-kp92~>b3_qrgp z6Cga->8!%^S92{-ZKCU&9b_5S4_kEY)+M)K;obGt8o)b=M~`+hZT((14!gbRk>3Gj z_wd2J`0|&2HzvosF&#Xl-i~35uG>0`@c;nkecC4%bOtk2X6@i=!H(!V0G104Q|1ar z`u@^+S=+r37+>f7U?QC*Z81cGJYc;hMK)aAK%5q-c?nHZ?GSXhWy%igq+ko{B=QeUs zadmYw7nx~kN}?0ez3+t1P@i1=bd^7|mAe3FL*}>XQ^VkF%&V07rR&6d35?gh45>_0 zfDL0M4vz=%_y5k{iv8V3#k1mv@W>8B2J;;pPV@fNU;WkdPUT0(H$4hm8U)kwzo=61 zS>fR$OA}E_aNwG(gLAs(EYX0RXRkkdtL4f=OMoYhZdrdzZC*4UFUo2G4OM*)<1hY% zvbyv45TAdZ70iaRo^-#O#*p8wwe@)U{U1Qx`^mU^<0=i$W$$`4!U@qkzu$eT00>&= z84PoVS~{iyx%8f3E?bgiyA|?6b=5R!La+njt-4vcSCVUgS`Gr9Yk)e-$yKFvJ*qUD zv^T*)FcolIm$ed28m{G&;31V+J|(ZjwQvB1j)hFgc60%AaTjf=dPa<)srrNtV3#`K zPq}xQ&d5EiRJ9f83E*Fo{t>ZgYN;r!Jt?w-Y4(@f2n+qovHJb{>GN3zfs8V>op`F!%i$$L?W2 zeVF%Q`$u#LdTI2glVrUk%AreVF&UEw__K;qX0<|G0G%_#T+IAzg?y$zu?x#oGgwwr z;?v~P)9b_K6-kd?Arb{mQVvpCLn)HVBHwKXwhw>j_58sN{4N7jkI!MTJT^x%%Jc8v z&SCr4QCZiK0;--wXi~=!Tmhc^O%OB^SQRK4s)JPU8>HK9HkyDzt%9HesLLyWstmx| zfC0!pbME_caSoT61UtGX_u<= z6WFMG6FGvc9nVpSTnHM5vv5IV8oG-*3;5dj1Xf4I(_?^pl0edEs-&GHN0sk>l4KAa z5X_E+@(_ecV*}Q>zO`jLOI0;jZvr&ysHbUOApX<`$(J@e?~?=1mu23XF$5!S0iwNVQI2G z7e8@LSM7Vb-3&mpzO@n8u3v$@9!Kx68-pWVvrb{JXOtfSWE;(^sOd|&BfyD+Xzpxq z;?4$DfNUkk;}w{<<`+H}D|zqn@HBS&Cvkr?i~E4+qy991KN?Kq(Qq0M2D8}XbH6)@ zgZ?D;2je*4+JWZ=Cwvn4d~iI9J4eH~e>jMHheN_B9(2bU9(6~Y@5e*(`tax|9_~Mi zquv1>sU8y!cv9DN3ThFq$KWC@y4Ow8(}T{II_ZuFanwDIy@P`|*zZP{KaHn<0PA)Yxr z5I_c)oJ+65Wn*#C<%7ec*rhRDzVSqS;?tjw&gN!}Xe3kEs4Bk8`Z?+?n|1Yh2Z-E7 zbqVG-f$eE`b=7@G)CC&{k94mxo4`DIDUB#qBdCeKnQmrRd@XHVq!AEwz|1yR;hKP| zKc{w0pLNNRzxE-)6jo$r;(w&GryQs=3AncS} zS?3tm=3*hL^qs9s(L#ki2CVKrJd6jAj^qCBeslq*AsvQWuN)j4bA14_bqj56yG~|M zjdcrRzR&37CIBAkIh@4n2ZMMGFuZdxjJtcixOXs$HvqwVfMf#XelPAH^tpGy zC-?35`Rv65?z_9!jk{cb$aMkL-xv2k;NAkJ-rLO;ykwWIfspFAws#8@St>*T8RS2M z@^FHTXnt`paWK$pg3g38%6+P+UU$>g^(z;e7CBY-jfFZX?6Wim>)j)_`tjau2Lg;e z=i_rcHa67vz4TJrt8Crpb^oppt$F;Hah#?nGjZ__KfUAtk!tLucNpFM`?0KBi?&eS zTNeG0^#O{|T-AH+Z>m$W#W~=n-R%qzaiM0XfjW(`0Tpalm!jPegb`+h)rFdM4xdiu zG^~T@^+xf*k9;_O_D}sxs?CF8pLak+X;f1H)y1I&ch&hRfND!|H7W`y*~=KUR<6Li6o3XaG8r|b#m=1tV**I*?PW+Y?~(yi2AtRCxW2X-wR$67`PwV#op1!(&rSCLY}w%< zEb<8TcfU7;Nse>rzdab^F5hL7`}}s%l|$aW53@T0P!D?J1lHr>43L{~UM~ezeHkbB z0Q5&PQQ|$$-`ocqJw}Z`hRt>fgV6$ToMvzW$e3qG=|)B;fkxo~Sabc} zDVhdFr`g6S%-XM=#=59>(2Aajwau$3Pu}D3l%@r4i{t&h_d&0-M0>hXCcD z4P6#UycJX~7m^ z`ZTUArG0bf>g60znbNVS1y*adTkH-G3Ob-`ma2{Eh%T7oc&S zg5_!h5UN>was9^4_z(Wle-!`G|K_j6*5w<3-aK{z(cZikM<+{h2(aw|l!vg-<37yw zu!ly_g%$SW4eI0#nC~5!6k#LVQ|NV0iB5R#_j zY;Iqs!)hnfmp_ySu8i_Qomz{^sU9b;*Xn0ojfwJhP}Cg@TnE8=veQ?>h2JuZN)RO; z>es?$!G}sc-ue*%{EPWd6u?-xdlSzTS zsM*B7D7I47UzaEnU-~?Ma5RdCsCxGwxEbAHymI?qJlH#m_kHj~aqH<)8{@0hlu?z~(L3fDSPrKZpGuAh-wc z-b0n&gZYilRZ`u&mg9-1ZpCGQ|Kp$fRQ#2{_SfP+{7?RBJVUuotMwQYaq$jWiM3WM z*4s_Ag|fqeWve@xqwT#Mbed4Nut=D+OELE71P)=UhuU)cBLbZPb)KFDIrub>32{5{ zHl~wu3l#d_bO&=5nwthDOeuH#*?&2!YkOxiwzk*PMy}ksQ|V>SUAuNEHrG34qJpKA zbz&p8BF_&IkFxWEV5*F0LXv?}ocWyj@|_+kC&_RHQ_@8;I4o=e|6C$avraM1sJRL9 zrDL>gBm-HYTzedj#{y8laVQ7~h2dK`WTD)g-xE-IzNq!OlDIZ04Y~poBRD&#f%J6` z4&(N#x8rd4D2`z%`^Tt>fZ^fM1XXYvU09AbxKtyLorQ!72|LjqDBuddw8yfKnEodmR;JGFTSt{u_ z2!@_loi4V~(pVhb9p}!XsE`1JBiDs(l;GU|>`3&Xp-hsk@;m3HbG@wYB)g$pV5BZ0 zGI9a{4Q}hwrFi1Wr(mo)k1KNIt=~=H7OZ)Fs$4l`mfs1?#G_4CHeA+3uua`pIso?SZl}T=0@DOel>0q^7H0RK=Mj#Zn^qZJ-rAHkDaZxM+bF8KF3+7Pd<4o zb}ntgaPP$3`)`ouNqp#IACABLYkxKV%%A`Bu|i(lUZz=F3Z3SkytWn3Uf+r*u5QJx z%UiLtiHhBBaorhO^|*X#J8tp*YgaDEDrwY*)D8b~EmuMTC&5S)N6}UU&8#2FGc}+5 zBftEwTV2zsrmHpb%jX7pbqCZ=3s9$%TRDwZV}&wtT51hBRKu~%tS<+R&Lx<0S@J2; z)Si_lNOL_k7R#J7nKV8NBlYwAUV_?_&)XH1O&yg2Qc68$UFLPQBjg2;)o#C_JagJJ ze~-iQSoxvqvsVOyBPGqN<@m-ouL?Bh_m-P8u2k)jGJ(aNGIvoo_xJYVfZ&wOH(vjG z{PTbI+wsa5zZks15+pljs7V+QJ69|Dew4M$;di6g3pk98OM?#cFTN)#U*- z=i3jafDhLk1nHrQ9y=1;8^%-5JR86GE5ArwL%>icdS@ij@SC*+r3>HCG$oJ+1wL1) zl3kJpCk5o7PlB!aa!3r;0$^3NlV!_VN^q6EB%ozP1(dxeI0&GQ#9M#~1j$^MGd|bl z)GbLi=zdM>u+zS#3siOO$@*^E2>s`voa>Id+bi(NDVleJI%NXT^U_!YxVG2VVq@Kv zqdEYIUJz%|M*XdmW^KH(T*1wBIpE~Fqn9r4kbczm{fEAaYs(41&pz{H{P@Q|QnE!^ zxeZLOdqn3pMs?nakAD0UaS6b_^XgY)c|MNoI~#HH@VLlR)$SCP^j(;WnlsDI!acO%k zwgB$U%?_V!+NwJkz-otmF!3Z-SDTcHn;AA?%etGL!eXz)wX4?v^>yl)xX;SoW@a|q z#fbxzLy&Kj_S4z07bnCw9_VuA0yC%S6YY#LJ8FT|Y0@bcyu8Q1t-l%n!*BdXeEzeai^GGX z=)p{LdSn+is!I$E^^ou7_Y~$jMGbX8ViCuq(>NM(4Zz*c01yL`JwT_2KG>T?y5H<~ zXFNBEMyC@${ilB}*`9+ss)Iuqp94_tqXar+%Cn*J#jN>Vr+xiL9Wm!;0^>~gDSqUj z#R|+a-I$gU5Et2i!3ebE*?|lr5(s2dwkJV4U2?L#N|`1r@f>C8YFJGGN0%klb*F&- z_(y*{KJbB;lR-N`rkj?4y#lbbnyvgk2Uusk-%ddXbJqcNzxegeYA#sPg0;1{e`jMO z+LcCJ-rNSruEwQ}t=Md~0l(AOeefvmy#9I|9qbYI(*|ua1x{yBUAuNYo__8b0Iil& zV?Cdy8*WlzKHT4nyKmf%kAM6p<3Io3|5x#Wk9@>_BK=%f0Z8|^sx}+ZXagvut4%(& zNy?ztR$H;NwHCLo?Eq@qaRoMe?Z%b31la1j)d7e*Z9%yaF6&nqx&^B2!E(@k+#-7W z(pFr(1>3!OEw10X99M4c0Fdo;z<2Q#_wQP%*?Ey}DkS}Stsi9oMy?zqFB? z$~HnF19rO>zi9%HKoq&*GuIK|2^pxiE$>mF%75h<4q_|sqr8jh$8$1NHJ9>kS#Wvk z@i-m}KrPkJkrmE=2uk@Yzw;XcSybS1_TM~8&+cU#{RvF+(Sv(&u>T;sM|&|G9MWjJ zaRL}PYOhUDHCdDQe{pFj=&E{6e8K;RvG=#L%cMyOGvb-rFK z*X1p+P4vAZ)mW;~0$7G7~)Q;f+sKQvgo3#d$~ZWvWe`{JEzK zs9Au|KKE>FZ*QlHtOtU##}<^Q>TMeq>cY^1yjwf#RiNrBQ>|5tXM{lD+OdW$Sg+H2 zXTx!<)*7h7>#)0ez)@ps6-Ige222s~qbxQ$Yk=umT)%!TuA-8+0kz!dj(5~}mbOow zk>+z?8ISw1yZ0cTd+Fu)U;mZ=G(P&tPjfHjO*pgTkwH@y0+gUe7Rmn^^#HqUH(-sc zarNp>niMWw+6EvmrwO9HMmp9uV3h4lTZ8hc!0yVrs>}IXzu4`|+dR7+8-Vl1)_N|S z-5_4K|1OFEWv(-@?^Y19eyD58UYohI;3%9db9+$Pa#;_xxb>xfuz_ck0@I&nos3c) z!H$+^0ow$A&L_}PI(aBZl)Z6fr|R#FgMh4AhnAzV^tc?42cX(@a-^X6sYvj}%GT(f zLoEuJJu|{*^`}as@bIWlD-@3ItM<5O&=L%*zPyOl>S=TuFs8aTzq6q)TaS9XMq{4F z?!hk4EXB3!FfLfzb1yu@3!MdYNC(p+50NT-(}h#$gk;9L>J(D~Iq*9*=%9_Nse>X; zG1a_a9a^_8zWn_2&&P*8{Gqsd?P_dqZKE!4#ya7Nr=EZp_MF7oTbH=Whh*n)w( zkAI8ua0+YIrQQ-wX{Ib|s^y%jtWd@)$fUr@ztkdN+^5PN^=Z{wvkuzPWpLk=+vX|H zxwZtro1GMOtoETsQl+eA>h1y|N@kqMyY*}%N)rJ0xSIdj*-2>=UgBL2a^=2blt(T_ zXajmo4of&2#=8wa$m5;T^Y-x0hc#|P*U1Ssuw0zP^{EqX)OuEA8~jFsl5M#`o}IrS z;Q}Tr+|+YPx<_|%HK5Czt=Q_6MNXVPs(?2H1sY}twRF8zi;dM9jeLdstFZ~gSZmi~ zmG7#tE`+g)D!jqDHR9XqG-7kL8EdXG-)iL&Zw_pjrv@tGU;ImdA=WlpIaRW(e+dIg zm2D}3^kQH~|4#>+lyc|h%SwoZd^?H2fhCw8c@MCs1Rd-3aV!kSC)59s zvh&%T6(u0kT3u&UPIm_2Iv62SmCa@+L^&2;$rDuNHejiX)GRuvv~xO^kN?C+ zkM<7Z__!B?oQioC&piE9T;AEr2^GiPgV+b)FJHYDZi6jmJ2loh^kp!nsH_v7eeI3A z={oh9Kl|^-zx9`XEiT=9G5QnA96*&(uhz8hZpO}PC-;}yY}I3@)6B3*9j>zyL}iuJd5Ms=1%IETVlge0 z^R|<$XW}L@K$II09+!eO-S!XJmbl$pJTBVj+rxY1pd+zoDTVZI!VjttzSZav`wwFk^mHJ? z^)p@LQc-j^lZ%}QtPU#3mNq)D6qtr8n1^)|jYuYGxn&mG~#tF1?9pLm{Rt33Qo(sefRZv^4VwOFaOp5ZT#Y&|F@&Q zeu?E!S6tSvD%C0O$(A5qs-g zFNxwGYVoBF6L4S9xw$)RzkkHdt{JEiIEp}48IG7k+3!5a1t zqu1S!r#aFqfC{dz8r5tf{De9zCFk!W z{K}lYc~dq*q?N*RhHf&I)-7@gmQg0%)CKFeK+S!IB!o=?0zmq zS(xP2?PQ!XbC=k2imZcM0;`K^U(Ds-Jvxfl@7|3!?%$6G`@3=I;vl3`JM@72&8xGv z)ClTyUTw6A1|3+HI4@tmk|XVwOO_33F8g`8%pi4us;!MM0gCz+8S6#`%qJ9z{Z;m%8&BZzt^$` zcT*PhcqmhmRq0`_)+^tg`8FqA#R~wrBAz;NWT&gjugv)_WJwuR{}x=etY#3m>?p{i z168u`0<8Y_`HS}KCxH$!Gr>OrR2eXeGO*<@>)9^d&d55>o3j3s$dE7H>E7Nh-yWEe%yKW^YI3shTE@vE^fc} z`vBzUeq)X~4@g-inI_*8$F!45XTBp7yLj{dKp>YTE5+fP^-H6JVjcm1<&Tr3TP6xR3Y2aD8vO zWdUL~G#jXE1rSXhdJ`DGi!KY*jvm*^7GPF#O2R8{^g3h1Ocm-M4j7@lfk*}iuU%lq+q2e36 zv$Yvp>m2}G^}Zf!8yi_3GU1#Fm-(O^2ni^pjgrc+KtowNodWE=xC>J~IM|I(eBvkK zKl!!45{8wU;+g<(qV}s`T2uO-wFM?KR}Z z&h%ozoQqv(twRsZRLi+w4)IZc#na*>2cdjdP66h2Re9~3nyZ!*SS@+#oBJu61V|U) zCX=K~PXNK70Ai^^?zf$By_`e_xFDlV72i{wQ`*asPZ4~VCJfCNq;*O8@P&C3*Oa9{ z9Nv2P&L2ehZoJ#PB%ppf$3+C+&%^im-gk9y`*d&+qodbjbbK$S{rj-XN3gd?F`p3n z594I;fZiW9db9@+93XUugf6VJ4`B9?ksiN~V`VXnIs(%KDACw*YYYW<$?0`6R9*(Q zrL-z&g1IZXpP_~=q_VIQmz;CeB}f)=BJecgDtEiTkf2)S9v7Id=@R1t&;aVr&RYEG zU-&5+jWe(g^PSpq9U*sSQ;z5ZFga~g`6uuu(#88>laBoB#^QaJ-W(Oy#gbD+<4;>D zCuzVYzRYql$U5^lZx2HNPxDCywkz|<_;^QA?W%-YdJecxQ4U@ie=-odj5IfhPcmG} z3ZS^WbBWGEyD#|$1!SxVynusK7WIc++i=;vt8wGzjkt2-dV=OrZxD|T5987PJ`8jk zrvOZ~*`c#??Net>0seFbO<3gf&p(&ItsQiGV>MoQ{;2{$l%1xBi^Zxf1J!EtuSrAG zNama13i&H%`t|CThCJ{&pZ3sj9-ztGj!Rc|;@|tr|Eu`5|MI_x%TGTW4+mqyEc!&@ zHX{oG9%LI&#%T_z1LXR!*4s_KH|bo-JDr_cN*(#Ap`}{CV1F_-ors4=`%?~f*}xINbcW|B48jJ4$_WGux<->ij?lXmae|O4x`GK~`PrZSX+Y&t z9CaV%ylDYJmn_hWw9@#YLV~lb%F%Bbrj5x(Pjs@j@r_aceMT^|A^Or48n1gGsd1Su zp3L;yAe4Va#0F(U5)eVkY)ArSPGKeAs%fr|s?E{1C#P9hRIpbEt(>oK!&<4jZF6C= zMLi1C@J=>3S#+b-qN9PCyKoAh%bd>@@2ArQAqShA%~o8xbSY}w(>?A*zdy*^150^>kg*yF%{(=d8Q$k_#)#64R9^b8UIS z_9$C_*3&oFI-_pr#PshxI~_&kTvo=z!?^$Ojo3flk0+jcKK|ps_P>h{f9hvqd{&Kv zzN>bv!~&LP1_W%?cFi8{R_Xv)yA8{x9t6{B);sc`EZIo;ty#soNx(EgRF<8J)t{?n zDZ5;>JiW(SOV*mT!KZ1?2Jf}ZQr4e9DhVhNlXpk!Q$9ZA?>xu*i-W(i z?x&1_+j)=gSVHsCiz9uP?PL|Mlq7F@?;r1ZKvhj~krKDaNXPaGjUUz35%7!P==gNZ zchuAgpC??OjQKt?aPJs3aAH6;h3z?Lp_qs^HbiiOH_6y(6#S?W=${Ki6jX@cRqTEL zsld$LszbU*<>Jw*Q=TOP0aj)P3gzO&&NKh;$3GauaTnkkaGlpCfYK0hAV}4%FvV2U zNRxw9X$vLl@z4=|%7Df!;QE{mG+)cZZWp4e=wOWR&P@UVv<9G6?5Z?ipPv^-dvOS| zrdm*yQM#Roey+AC8(rF0=@ewHVzJH1PR8HKbO6aJfaV4Fp0X_5|6Z_kPki_IZ?CS0 z&i=Yh)$5JutgpxQCvN4I&zCP<%X2EKbMo#MFfMlT^s~>#GlZQ>mrI_==hmjPt2)s} z#U4|C+D>K2GSp^sl{%shNuSJ7W>wZKu%ok_w9Qx!o}qjNA5?d3*>g08x$DhN1oCd& zxqCM%txo*nuly<+#V^H5Z8f?BnC+Qyk~iygTGm)_Fmiph5$oF5n=8>wm$}0BwQUQk z7Pn<77+Z(AQ!Za-mN{TZjTXR65h@*>GUzNPnSLImTcOFd3%tfDuN4p`0Hl(Fw2P8I z%O!KlJ$h&e>dK2Un=H&=q4H9>u0K5zbV-A@a8LPL880?=Vm?pKd;PFv-rEPYD?4;= zpRymmDy{ZHKhFc_knuPHINjRW^&F-XK=>R?XP%$RTm(>ibp#DHO(s{w=Ui^-nH|}s zNx*&)NJocZhK{~ZonqP_Bp@fSaXklpXut*BN?PA+6#SG4eB{SJ675bS2K{3MTy~_r zi(75rf*olRymG@k8yoCXCL=RQ_NTp(7ntm+9suPfh5Z2vWgn)}5Nu2)A{(44?|Fxy z`tJ;@^k3!A{9pX}OaWlj=kvzn9DH|eb-$)m!ELjowE|0Z@Wu|q_qpHv>S`xOl#ykt zKc+Tb&uhYvt>^jxH3whn38+`DUX7bi+>B?Qc{ZMZ>7{u7g_q;$r=N?b+-v_sKOWCN z^8)eLVle2%Xgs291P;v|r+{+Tlbo z1L=@&ZRa&Q0QbIX02(ws4qb=q3#^zQl^wG^Oc8n z>!<$_nVo}j%1Hsc$d!5LI&mo9KJRt^6x8yWPYc7u{S8p%(JWWfEC$O~^-F&9hR5Kr z{NLM$m7GF?5Fm6kuN;7I88quz4AD4m!_huy@VpFff_gXwz-ELKdh!Jdu9XqA8Kjd?q0DFecw!D0T3I|XTLZ@jOl%h(L zMb;;A_3EW~-^(w?Y&Z<(smrW$p=cVjjo9zGDW9w>!JM?vSQm62vg1~@NjgtqMY9B3 zH_HVS!=wu{9l zt0fJxZx3f)UA}QWZrpk@7l?WKndjoUXJ3k~wJp?sXRA$Ot+SSklnA2QV~4$NY;SIo z#wEZHHfWyR_JjB4v`bQ&j_50Vk}dh4u4pMS%XBE=hI-T$O#KYGu#A=|2Y;s-gK~4h z75!-U_77tSGyTL*{;Bx%XMPd&9~J$qn(G+|o^{@{JV%qMbYi8x7OhSv)>ifI0Q4Pb z)7Gy06Pxl^L8jeT%6Ds{Jws+S+nPFeY&9jaX|=A38~SlR zmW!#U-1Xi+-ur+`9Xo>RsIpV~WJoT$D;siud)Jn%t5*7*>+W;E!Z||)HnYtA%QXHa z7k1DVW-l%15@c|yHLhT<5GjZPO*T$H2{J>;k2__KG$R0R6CLgO6S-+7dB04-UpbIv zJTR0OUVJgt&mLfq`#=GfG89>;>U9Rrsm@>6-O_%_-)ssP(1?^ctxXJijhqWy9p?w+_$oaHY61N>=mHewUr0+8M zEOutVih{CyF1#7$)MIfy5|r$)^!X(pvmqVWAP%}mvAcU1AOGa1;=>>P7=UVAO#r@5 z8S)JA==14JxF&h*v^%ju(6`xHM|4BT68Bi{S>(J8c`N14r*F2S<9yB{vw)O2o=Ck3 zV9WkF&vBM}az!bA3%^CfDc6kC8BN;Z)8#LN^+Q!D*QSE}Cuo~`&QX9wN|1_jHanH_ zdVUpIPBF>rCB2Ws@ty}%RT4pQ33b!0FIH+z+B58=(nP=kPlCOutI40ypbelb_csuh zdNPZ2j^cB+@UxcT^xU?n(6}8)okmG4rFW)S>Ch2gxr0)Lc%5nobMT`)4@w93>35j_R`bp25WjszlsuZoH-NUPq< zh8$3G_K*N6v#feAU~FV7oOjhFReFK5wc3EWHR&{Z06FS4$n3z39iXbOYO)KDI1ysC z&1Z`a5d9dO2Z#jFN^EU30o7V;Z#U!0mGuPDI@P+g?52I@5;jTxWwzRUoe5QMnl8aq zArVoi2l86-18Y}i?4vXw+nKS6b@C0W(M91yr}0UZ^#={kBYXGK#%}U1aAh zKKhAI#nz>(lr^&A;w_|QemVxUCgfo$SI25K=oD60VX3ufQVzPzsc|Ih6G*9-qG<_m zf<2(`A7$+%f@JU1WveJH z_y!ZULo`^w+?@C7H*5N`C^>6<7N~VR{(09YCPrxOv@V0t=M^ z^4m|B$y1R_@IsJfr|y8MK+gb6Rd8)y0;%lLBa<&kn06Zk(%=>F#qFhYNN~;7@oj*DB&xsHcw9i$%b>H?$~9eWu&qW5 z7U$e`fo%n?0uc0*tN+>NYV={d{YbLrq|IS}5sNt>@1{ zEEDajQ2KnDLKnG#UU45CqPAaDZnNpYUdf}NKt{=5)^GmiCvgr3x=;x~z$OfJF$W}< z>73?n6*CWa4|Ngn*7|mQ;*&o`2e*V4)Gk{>qeh>e45GR;%LyFZn7J~Pf*^=; zMXkZliy2nDmOK^tppj&}mP7hE6G!n<;Th6vN1==)82ftP%6FrGT#n54d-qUkU}C2* zB7ku7(o^x&Gd~v3zWC$u>r=S0DJpJ5<(O6TqX0q0mS`!cvWf2BfPIpgN_& z$pU4N3a`S66lMdqS5IlQF^P!VwA&5?NC>tK!Vk}+ww z90Q)tao3blM%e|evlyeAs)D=qvZewBT$R>_Vwzlf%{(kjyA6Z%3F^+UngI;M0nCer z=fIHbStelftWDI$MXD^~Jfk{4JtvwPFd-kntp|$$`D4*xJ_i zd6*`G)zub&;=mR8MBVmNyNST)D*2XKjc1xX>oi?wmDMXQN^=T(bzKB~c+nWhqg#6j zq6sIItISTP_&VU#Zm)6;Erm-Jo_C6*fS}8pQ0qDg>F{oyC1fO`rHO|=C+liD8Ia~l zrpdZ+@JsWLc;a=UXjpG}A4W!!3^5rMu(v=b}U*or* zS8oEqS7Kvxhp-);jjd>|?Zn#7&3NCBe>9$c@ueJuI#KYEp6rGBF0{I8&z$f67Hn;p zF7T_J&VdGj!P!y*M-ILq#H!5NY?t_b`R4Uhg-0~F+(v@uZLqQv9rA5h`uW+g1y1dZ zvc?hM=cvA;+{p-GDkBPd`sRx5;k-)f!-_>(sh#U4W{yw=_v;E4H3<07@22o@A{0 zuePaI7f@;NUcuGvy^GonJ4LQ)Ei?j{d+Heix2%&wOLsN1tlsZ6?#MwZ8Fv0j1}I44 zAuCzW9zJVDSPf}oS1TirdTI!$UN5Esv@1@S7T3`6EnFqutiZ?Ou&CbChd@+=kzBrV zGdimqurE|~f{xLK6C@`$o#R~kGtRXk8uY!?O{Ih>KrrUPG3syyrgg=2Hk&O3mj(QeP~$~K&wHy2=X#mS*Ps9fib_^ zz-7p~5$Q%HyY^m};Jb78cC^XA%qCr{C|ALv2`g?9T%u2PR+U}*qT6o^;|{i@)4l0& z<*S7QZgw1&i#q{~(*|2>I1{VP1QOJpwPn6lU2{w9^Zcn{SbYKow-IFgFi$%@msE6p zRXT!nRU=sE zbB@xdnWBJovQ*M5tlFQb=`1K)!B>8&NdU3u4q~EiEDt-J%pv7my3&O2BKuh&{xTJh z*YTbQR9i%~*38Y^T#VO2iFATK{}U9JbXl_MQwU1%dq8u(-7K#)H>kdz={ktmuBN$8@SKw&b4*oLict zixfyNb0R4S>Pj|Rfl0QT%!PL($N@0=q#hr+qbO=9?=+3tLsj+NUDeU_IgKti>`O2$ z*JgmI4aDExpYJ2yvNyksM7!vP>gHkj$$H#I#b>lZ%DQ1jvKkUw=iS;Q9T+jLoNYuS zl{II_L%CH~8UT~_(gq#gm3Z{0Ot0A}j7UXh3 zi%yOF+M#F=Z)KLNm zb)jmnroxA!lE`X#a_RiP$K%NIcyAx)jpjT^Cj^6BELX7P^UMW$IiG@+L9hU<3`+=H z4&%u56jX`~R^{j^P?PSX4TRCzQG!$gD=k}pLK}eR>s(rcRc*KGvDrkWBmV5w5olU0 z=^%C*w|<6CKldDjrPD!kwJ4LI+%c>@itf&Iz|s@V*nir+pP5_FZWwBTytf zV!mK6yju?gZMV9t*(uo}35@gtg%uIk46qVZHFsRv*&+T@)c#!nwXkurn9t;33ioT@ zO#2}~R&DTJ;&#=jR$EpK=mIv{TxG6~oXdO#^=HfMKG){D| zt}R<->~T2W`+%A)MfHS$@aY<|g5*^MMY1m=D9qCezX%>&<(j=V(v|=t0Od;c+NEfC z0*L>s&Zh0n_+=+HHbBA0>NKz>jHv@lS?63+U~(!f!anNtV$>fYi1XY|+C@FC-M9|Z z(e*}lW2yloU+&vz%;|_PFcFWli`;Wb7Pabv)a&b+HWx7&I7pJ_TsY zwAy+Cj^+UEs>WG$NkRu)IOp@8vww1Rs8v+{%Yf=1eCdnEo?vZ9KolT~^}snhA^_C| zq;u0dK(&$UfwmH41;aKVy0f(r8=IZ<5RmnoCueS{x|((YRAxB`P!_J!Kpi=eVKy0X zp0b~F4iL*}nWj~6gKaMXB8#(?nDd@oKCoWq`A@n36cEj26jKJYL6Tm}kaA8RPvV;K zp5rd>I6-BvuK~u+q~pDVQJjrn)TG5V0_x;_g|b~C|7WDp^(5T&0eu6RL{7N2M18oJ zblriu^-ip9xoCDHW<$y!Fmoq|<9m1FtN-$!#pnL#-;Ce=t$!H5``iCheC_j}i#J|- zB_7_pABX!#gu~c7+>5=V{TKt-?Tt=sU%MQaZe5M7>szt9u@;p^J0?)yiH?D_^*F7y z<7B1D_ja5iW4+#C+Wm8;=fpfOn5POp5#}!jHl6-Un1FQu|M- zPa5WV<)*_jjWh>n1eH`x-x@gQJzVoXLBp1nCIJ6nIJw#rLO&W$Vu;%1+tK%mE?0qIet=Up_=!g^>V0y*bR`-Kfp zYAEA0Pfh`K!4Dba@i9zfKs+E)wb4v4RVB+oCPFbKlspK`W!X9cjn$541gL9r(B7#d zz5Pn&o;2Cz$V_rA0Iwe_CZ;1I_euQ=W|WbWTd)ixms5-y*MJS!?~S+dpOav z0$4KY!bBZdQ}wqqNjstdm@}aOGq0Odp0{Ilxx#8qkA*T7HN761WxWFzcS$=j<(PGW zoVn^2|56q-Gs%Wsn8jIZPJdnB*y7$|v$T%Yc=ePrd<0$8F4*a<-u}E2_`y< zC1qEC-*jDDEW-27KT$hR3}Gc0opy(&KQv_W_l9v_aBZvcVv;2`-4OXY)Yj z%cu9gC4A%X`3qBkPYOhfbVVBU-M$&M55b=}Law?a2Lc(TQ7~nCGAvY^$ajwHe?61{O&+p+CrDB3FNZa6Zc9Yi84+L&NOPvRA^*L39zJ5 zJD$@$T}?^GW?4D7WxCSUs(NmZ1gM;hpo@|NPG%}+j?ux$e%l00b&8!X^@V1i^~pBHF$?xpg6P2siT7t>MX!08`sQXMeM-f9MsBHrT`922gY>) z#O~d1C!hvE38h8ASw*f7>wp_@o@FEOyCx&WL0Rf4pqeeST*=PG8Bm%<^bk-A?2IkX zGE#pMi}Qu6UA)B!C;Fz&;GW~fQn-!y5S6_@c8l?8bO+-&>LOnwCu!IPRVddLI=i3) z20ZzkO-SPj=LXz=*o&jRzcWx- zH)XNTvhp@30}NrvzF%O~Z&t9%k!P}Xq3)9~-d`A=JE3~qxpNzEl1(~e3J}yz>L8x$ zCcySJRDh?vQ^w|@&FIDw z&veZxKQ}vc{e!aizCNaOIF!Y7Dx0k2{CwrZg=b{4xv!UT)3MkYOaXQ`|4U;#@}t>e zh-|bvJF(JOk2{aLasOx(54w}Me>{x4k9zU?gTr|3;c>irA65F%QM|F&jeEQOcyKt5 zhlDq{=gvd!0EqGI>7P!tcWsPhFq`aFCVSU}ccG z3n)jWDHtGD^RLj4dYX&S=JRK?4Ho%g8K*a^YVd8_Nh4v~p!XDjNP z*W#7?2k|<9DS*EA@F-rnyBA-3V>iBh`yt^$eEHQ!@yZ+f@%6h0@#?+9y#MR>_v34K z9>!N+e;AJr0X6d4?5yX`t!rDGQE>^x&RSf)el51IU5^Uv+d;xgtr44>+pz^ZzINqi zv>R=h>R~)0&inWF;?=Lc5fAu2Kz5IlD7afh@k_RY(%ni%?*ORUgDhN4%ed|Q^;~h* zV0sH6Bksl3L*uY49|x%Mcnoq$1IZ@OagGsms`=F>=>LL}f`6fUUxa`2Fcu@AanLZv z<5O7Jj7B>L%(R07YBa1a;SfPQfF13_a`ySX3oCg9a6TNsL}0YLy-Dl?zK;-E!FP4z zQY_b6F#*s#5|{`&38}i8U>7k_Eq5@)U>b8izkj4%_1V4pWge?-cK}@_BJM%pYdWOE z(sEiVaU^g6I618pK(L_*oW&j}@VWOBDliBp^Gg+2G!<(sC%#*H#wB6Z95M%h(&3+b zG*cAEegVpkft&!sRi~lyJ{`mbI#EWLwh;=>moD!VdvpTuxmy?CozP%DaO^HsJ8 zq2n?F(@h89BGz_5OR#v?b=AbcO$o~BzI3kU>NiW&SwDJYOl6Lm5MY#7pLjmHXexv0 zQXHeD9MeG`Dmx>!96Dv#=fk66+&>t`gQE%G$MJ~YM|9X~Kwa+ZPp5=Q3|(iHPOQ1w zh_#)~xbf7Jas8=h5?rUe?+h?)tggoyX$JK&pO)Eh;PR4a8q4H?v^X6%W|V2YcZowM7UFZ70?v$M`+v=mmFeOxQn>CBeF<8UA$@Abn5 zQovE3>bG>m0S){ROv_R3DW4bTzHyYRNQFpZJOHX&PvmlHG~#rU7eEj+nqnI5hcqm- zC|Kws4p6c75dJ+r4^e{;$0GvY5#SkdUA}g+*xmr8^hfk9#3%a_Tm>8fLLhNaOZ#7E zeXT4~qTNs19)KjM^!hziu+wC!0;LR8#^m83+L-4vy)-K0Oa|Ae<+Wsz-0MnA4ss>% z$T)d6r?9b;RJ7B|{c0{ES9)W=7K9~wH*oNWRM-@fDP$NyD0JHz!nVD`?ZhyyqgVr zUOTb_L|)5NB!7Ma$9j z?jqA?uw)0vls{L{>J5)zl=}eaSzNuj6V0_Yvek_T`>5QcW@Gzu)RBkrSXt2QK!<^XjN!rM~AT2?tpvG(so_1>$f_G$vRD0 zwn~Rar*=XeIypr-`;p53UOA{pS(i2?>(oJ*GY2~mewmT~JCGt+2o&k7%Aud9zu!Fa zJKTi^;dyt!)M;EdB^RHpv?|eBtw*cl>PU5jmxk7CMt!vzOMq3ynL4PmZYtN>Tu*nV z3Jg$uzH;?SJo(hEIDt(q(c8NboTx)nOn}s9R90tdWrR)-?e=;x=Ceh^kx4pOB`VoC zRO641k5RV<(V-CuWCHUTCgXxBZojPEHP=!_=pCKb?x)|Nd2>WvK%D1_N}dB8NT)y} zcv6U@M>`_mn*ido00t#gW@V}7F2Rbmdjj+v+SsfEAGa*CILVO`=pISF*Fm+l4OCVd zcemS16;d$GSwjGebJSOJ@sv7j3oxdvo2}xP>Q*A{b_H-0G%YWIQ9I&-jz>1hyOs(- z$|l|1(6lBOTXGtn#r3hXz{F_gZ5?1%?TjQx@#Ngy5YcS z5Sr4_UcB+}HcWO3Xby6e-YLS)yzBRebUID)50IVYR9I*IwM~Ee zY&)3+8Q}Q^gy9tV$;!2WAA{pP52&&uXRz!a8~`G)DI1yK;<}iC#)`~`L$z6902};~ zDjU*Yz{KWnJE6hnD8G{dxKRe=$g!iu&cSY@Zn<(&vsHt&RA3+aM{IB0Dkucs&3DOG6cHH`~!_wZi@MwZoZz zE5sdBWv;%#!72B&cZQqwAv?-S^X-(MYJCm}!3v$i>sHhk3`s_IQLhP()cVDYEYGJY zM8aOT16Ec0%spt`23ah~nuU(vX>wMX9uq6ksyC7Gb^`puc1ApDs!DS;H$NuFdm2!) z3Gv?u0r=Y2z80VV;vd9kzxc)YXaDkF#y|MY-;6JQ`418VWUI~@f77oKAw@3AXfINo zjb3S1g++**58Xv*PZnd;HHy%N$<3~A)F6&ryc#vAj!-vUevVItPR632W`ZmYuTg2l zMrS>qd;Uon4(w>|Fe{A;q1Oj-&>J9_G$@{vHI>ClR7y`1%(P?mkGcsq=}eEBl>o_o zuBarF>h+JaQ|YwVVMz6u(deDcqR**iqdJ^EsXSBmb#hvzg+jIjmTIv@>N~1B?SPAn z)@`EC0FyEp1Q2oW1>2JyI&!bummQPpxqy>e0iS{-N$2+k!0E1aMwwJ$J1xp&El$Rx z>=0DxjW1_FQP$Rv0Ao4VRV@`^qSt0i&yeM#M}p@Bu{j;5wm$Qvzpd#vpH`=u%LxFV z-W#wsRdXttw3Dz?(z!4`cRHZ60kr97N~a+BAvpF+r&%_1n5{J~YHo0S0#sz`L{rOT zqKlD?Sn~tX(*c~E!u*{KK%K2^T_zqo8}30f@jl~D=1+3YEOXwQni1t-S!u5fHKa=E zTm)5Jmh=!g=pD!U)^^;u@no#7ZY1M$f%5UNAA5VdF+?j_%<0HT{H3jpT-bVRV<$G( zcaRSkY1xdeoh`^g3m|S~`D$ktgdaZIjef6Bhj9|R3{J?cfGQrE!3mA?wcB5hfAKH>N&JI<@b}|4|M73d@BFKO760Qu z{D<-RFMTQ1;}j5jRy$K|X*!SRe(E$t8H}UG3WY4~(W8g)$}6vAgHKi121$daDbmPM z%Lw+|`8>j=vYzwKx!3lRbIb)RQn$6a71yp^M)+VgvMT{YSC#W#-9|ryY1u$kzky2x zlncCAmDt8TL@jeqBmGi!CF;Y7ggJlb$i9pT>E77bApUAD=IqX&Zi*+<9-#Wk24&01 zf(f!m3()-ftjtY&Y?@2}Cc#V7f;Lxea;DbBr3K5}1dlRI#?SM%CCvgdZ95(dIhQmP zVfdbIS2Ex8_pGh9=>*MFnK71A7?YjK5`Bc+foXOknnK<**ATL5mF9s&YH4>gx4d>F25a)#V=rQv@SHs!T7ovnm})vR2ciDDv*KfATj) zzPraqX$o>nnVp?W+0m)4_qw|Dp_O>2vPcK1H^AoBR<5JEPUltEgTu~`I??k%jjK%^ zv^%TOSzRM<&8!>iPjgZ6!5+q=-NQIOIz~2S@OGAZzvwfohB70*;%}YOVcs5tL-~Bq z9tjEv=wv#G{r!9C-*|ZN2$nXa4V)!=`v-sT@5O)r8~d>tBz1ckdJ#u`$cSXmBzd=kRw> zo7Yfx=IaK6r!XS{Hyz@MQoVsJ^*pvm2P1I zB5}%cPhmZJ8pu$Sbxp^~KxCSNL|H(D^a+jxN5h?9kZT5H!xKzZsf#T&Sv4%$dvjhs zalAQmi+rp03Lu(8WN50TK4&blXh-vHu=lrO>#3X3T3wB1rxlG=_vuG_p>w7D$*@17bFIfyPdpiycDB=1Zf|!l&0M;7wHh0-xqS_lyn`&zQO)%q zRi?&tY*PTY$2r~9=5%CzSZz0kgKkV^+0?ru{fK0&ZLE_HNA~$aopxcvZ`^$ddmSJf zRDeW)U^Q3~#oNL001N&-4K;5b@9kV#j|3MQ84M1o>;)`sHTP-XMmTo1w-SI3kM`rv z8+QQ8*W&Y^|5AMJv%ep|^E;o7fBaAWMf{WB{%7%pFMb&z8>Q=!_NZGoo`~x=Ze+uA zHce@JND-gT;8C5oAvlO2;N(CTjo+ozvK8{rolmthJ^AF-XttJPICOCdKyw5mL*36E zRs|{I&k^Kgj;f=M>bmHJ>K=dq8+6CfwYAj*hHTKJYYwv$v}7Ryu@3gC-h!95L2Z=+ zo1mh3Lgtv8>k0S(wvE-at3D@S(THUlIctkQI}ln+Uh{q4>z@EAQxcp!C$Ollns!;E z;3C_x&82&dv5^~apnlO zws;q!(X2qdtkm*dIeUyc&OtBJ#0#}d@KW#>hEJaL3GHmHrJZ*j*<9^3)5fkHKFvif z2j1MRRg)C*MdmC67l6r`Zj}Aj`g+{F`9!R*tpjddRQo+T6SS1mO02fsbz+S;R*APw z{f{9Md&t`n*YyR~?QBGuo<^gp+Z=#986tG-s3t(y2eIdDm_&0ITxKsT9_ix+}>Z zi+XLZ`qE1;#?O7`Q}N7G*HiceH;I&jys^HK%tKZuAQ)^sCQX+dRYikfDp2O4#XRRV zL1i==#M4hd5l=pG3xRja9t;-2(}pQfXpd4=wudhZ8`~JULuO>dC!GSRtI<2+@03TG zmu2L=r!b{%x10CYVK|PU3(!8Vle=zHsjAZeRO?r1fNO13&xZ5j-A09U@V;bfykB+M z=bcW8UIn80fX zVmYcM2)x#|c5z+AWbV%1O8;NvguD0*Sg1a-GE+M#K~&j8j4UgjcQDE_(KPbft9Rnw zy*)a)DkR_%fVrI=-QiIewmBjXW6J3?u3p`a>zB9V^411%QGeq;toMX>&f;ta7(2+M zyWH?N=F=hXIE&7zYxuT!9xVo0PR38%xpo9#PJ&|O1eSy2ID)B~KkFsUKALE38|TN{ z+q2=~{Ke<@GkmuXG}aQah4ZZj4?!&%!uL6Nd`syyUo<*}bnEhsc<$wo#EmCkh^;F( zVr_j3A#RjH<(>tq*&MZJF&m`YiTk2|>JuN2pZ)2d$d%rcp(z-=`+{L<>+^&I8bx3L z2hQ8*93Zl>xPQK&dg65&M*%5rg|+IQ^ogJNXp~t$Wl`lENFlv?5ojwDn4D9eY$So8 z3NtF8=_vaM5LLJx1ac5!?i}vvg2w0Co!Sr)Zqlgxiom2fKwnN9*myYRg0rtCG$sH_ zz&I(u;gJJ4G-Ps@dA0!=kMSkb6l{5qE7&_@$c3U!i$LwbjdkEO&@^rEtN@_BGnd4( zqamNp{hp$NQmU!K%C2Q-4cN`4txaw_%c-2XAc<&r0j60-r5-d}2rL|3Y%S}gG(DX094c4fScx8Kd$D`akA8O=qoJK`(I~RX_zYl}u2#C7Q9ma` z7%Sz!v(}9D7WrOGVlnALD#rP}K|NjBZpT)u8uQU{F03-s4ZEnW0){Lr?VdDR2XN946qaJEagh-h19p{m9k_2jaU&hO z_4U)iK9^`C4%wkDRx%+O;l#y+VK*MCi{;$~OsEFw9zdkc(VZ{#4iLNbk8SW;)Lwv8 zc9c^%5pCiX=+HXI4?Lk0$^xz@&t}PSr z;{^_s_?(>s7m{)Msp-M85$t52%7E{5XHe@z_NvE(0JsdBlo{rHe9FqHs;c~+clD(l zSRnvOIgq1QfQ!eN*Wtj`#rnx|wR5K+kRCg5%{ybR_mL%jC4g#ju-<%+b!MIfkSrt8 z)Fd5Ob}r?Bnt9haqNj*kypS`im(IY>)Imz*f^26!@WryWTpSQvS!n^lopAc|m%n;D z?%sctCWP(n^<<(esPXLv>7Wd{dk4`w+^6182(qKuOj~vm1Je0U?fC~Ctc&cJ zk=K6%L*7O3`NRPud^h3ZcNi7M=~b}#vpp# z;~3G4o(M3gIlAf8!Go))L=A+%Mo4id%N1<+LM15jk!ArM(${ zTOgGQ3w8pp4deYUzYte0U&_wG_c-!Cp_k9KPXT7_feNU-yDDeSXyVU>L}XNHKjnqG zObKkMauYvo9#8<7+kmVi{N&BDAff~`eIqpyB!CllXRVVA$sIFYq}maF>sIg*NOOgL z(k`InTzT_HdS!(+7zdzo6F>7oIoWtjhYcz7PP%f`+XhC*F&UE&>&B7uIjo4rXg8T| zYJi4=EHd&o>A!qwJ6?bNHqRE;U<3yuwUg?`WjbWYPVKcZ%A5s{Tu{c22+c&FXQDk% zSw#Kc^&9vd$xv1)EHzm6{0Ht|Jb}6u?A1?XG_(^SQNk+~^ zrx~wxHh5>5W#(=Rt`?PSbLoVn9oK!#_J%2{W z1;e1Tbx$weDcJH-_d&aSX)B(3@(J3>l@vJhUiK1O&5q7$G2fC0J5<|6p8O`q4+2ws zXQ`8K4O9N8;PW2V%b%#@qR=l2;*Se?A7Od9&i~a^v3k9OINW~_#|QUfc(@k}*hEF) z0UQ_OVa#A3)9w+yH9$gi$03iZof)H6SU78ogf8kb_?c7&L5xWh;OUy!p3Fm5&_I;Wk1eN zQD{|fwcSl+l@5aG^i3nEt)fcudI8rFf9KH)q&6n2UuG(3=j<2MHuw717dNMf0swgv zjivY~k}p5cS-Gt5ga+u8QlOVK5d>D_ACHm^I?$9r4@1*d3DVQK2%t_4b#uBUfK#_1 zRc$U4a-sylS_kBB(P$5k4oLGj%>epKy6&hzZ5qs+!kkO@@#l14r=aWVvv+t1pe(0P z>k|2)n}GQNS`HwQCp)&>#18;4qol0-Ndc)30DeG$zen(E)h1xHN?}{ZbVBnHvaq1; z2Go-vUoZK$JnY;6anqr*f9YUk;*^uD`V{$c+Rzz5M_IYxxE--??yRrp1Pihk^#gXietxo!)3hIvfyONlGPlD_K zFg+RfV_DE7l&!Fbq(hShY0^&0-+1nJCIe*kEH*bfv9;cgPP-m$WM*q^JudHT$JWMr zbeip0UeH++xANi)IL#FLVB4w7_-z}dHU4lP?}Q=WYPdN5!~yENJrYm}&XXU)NDm%9 zh=T`jMDNjqRP#^msR7!B43KcRyBGh$S-4Z*zJOm511b=^w$CqQ(b>N{l!Fbx4q?SwK9!6+TL zX~bil%X{T{dl{E^(`KsekJKiB$|7^HijKu{=>VE;hb;S)L0W3E9Xkv=n(J4ur>*$@ z-MfImEP=2J^I0)|?l%6M6~+AyC>D?;%M(aZQzh{qnuVq8=uxmr`3+_ z&8^tkz7%WgYrJQb_qMVe98|L7+vqrR3gKN$qJMkm8V0+!8-8g=9F9v(Nae|t2IvT)EhXAQd#UY5=J885_u(><8 zZ^v){!+#Y2;mB0NnR z@hS}=7p|ajrfUm;lPkF+Xxhb`gRM%fU9C~qZDlp~cMsz4|GnRg|LHe>J6`|#eHyU? z8LOy(G@|AjacGw+4PTH^)oiyrIg>@kEF;blSFVfgf~L#|yh^*R3t>;l({Zm4^PQyM zs%pM=OWleDLmNjlT)r~cjejC z?*JhB2zRdSIje7yZlL=`SZ~#hmH&tc8OQxpNzbL1vM0V>!**hECaqo?L$*%1{ z(jLk)mV*Fn{R+r-COK=0KW*2CFw|D3ovvzj00tfO)3KgsHDw5{b_$go_2=DuKRpBB z0kUMD#7DML^wKoCObpQ?krL%SMm^FcKYb)BxY>^RE zdj}=8>1us<-ha2Z7lZDDsKcLV!RBFCh(*M|vRLfsjHP>4oqT(q0~EFO`=<5(5d45K00`sD{u@ z09RaPS-r2Mm9)F6@BHS|v9CXWE3KrJWJ~whSKqyJXU?2CbLKy1=FZGUdOEfuWFWwO zZd@T~j5@;eJ}?@Nz`n5Yka=uZ*|_HZvUUC1u#Ff!4ES&wBcSNGc;%*+P~GKa4kP|Q zSLmz<)M#&I-`-u(OK&K_`rDm3zOr! zcb1*u&5mqXS9Wb&TmRtMuJvom?f~U!<9kYffavT1B|}k5jSPi`X7|@;U)_0*mbKJv zoQ6P#v2lrK;ksUZ;ethB$bB)?KU8kN_0ID4xBpxDm$$vEeD*W9mMt5%mC-#;rw{9o zYkzo{Knn=&*s-&ISgNZA!n3QM1b_%{qB;X{MSF?x837#rXy1Vfs=mAe9?Pg8?)1Lt zW%07b;UR@L6AA3JvJ4C_OKt!KPm3qUYvpn6H{Teb;4A=B4fU&f#POl5&KrhB0o6K@ z5zjmve|5Be*dtU0)EFj3JX0EVZZR5i-B1u|YI)*6AZz8r1s7ga%WGbkuId-#NDojA z_v?@=z$x&yju0w{1utuEtur>LHt#52M6d7ZNatjV#yVDU%)Qd551Di|Z3gdfC_0}7 z0T%sr*gQTSAmrT8kl8#d50;#EaP1r(4qI}RVdn#&&gM|9goqpYD@!D+dNP-*w*p@N zWRBDE`(_V?{zDIuzAnX!bUMeXKhpu5T=+M+Z7?cit` zoISnF2>|UoJX&VC%KiXcp<_64tyAv6{| zjmE~pDL7m|RLwXnj~JbBM&j4m4eFUaSg-24gHDysndG@bXFZ^5qZzU zFCYEr$IE-({l4;F|Ml^*cFl%5_thUB3(wToR73ia7@k`purt8M{3(F&mqzh&Z@$>V zal_j>CmJZ?>$73LldY^KSQ3C^nz?xP$oK9Zt;?KzJ)ai&7%}vR*X39_ zQv`uI^)Hf`I`Bomev~3OPz|82XWB-((fu*<2%Q7f{@HUve^zcB3|Y-p^5i1o@Y6kD>_Oa>U64hP1(|FtMKlTk>C#ujSNB!(P28TLEV`0u_}eV&M1+7-|o=k z!SGaPlm+3g3f~`X#NPm$7b6OD#RnYx5;j!lqxD{4H&k#g&{++rby-CGZV#_=^U8a| z+YAqL+txDX%Qz5?M!Z)eiNlU>0?6@N`CIjJ7*NZ`%*UFn!s-`wRD! z54`_F>O3- zkKfr$uwdc*7+wyBSGu5f1RB)d(a=SJHZQCL#+~_7!&yLTi4YH~ezi6<4zr1D>P7-9 z2I$!Ih6V3-$5`uX9;!E?dJxvThc?I)52; zF%q5J!ez_Kw8($`#?9q$bW(wF0Yl~{R_RM+A9TE}*L`5&BLZOz%ZyLLMbD{Q8I5$w#-^DOI1kg$7S@k1q1 z|2{MsafJPb>^2=Z>r`iAiPvC&>->4&EHW+{2D5UV=+2*AR6_)vMYv<{u1Tz-u>|$h8k%M zd#A;aXnFw9!HA=gj_vILbuf)98mb|2q&*y-;^FY(Y#~7{lHQcmbN#;|netDR2eaz`Opf zqPX_PwI^i7kEdvLLk{HwU8)D|u$0YPHdh&ZHLf3)GJ)c5)go678g zIRQBRwWEyOtC!6yuKVx5-Xp_X!&Bec>1?7SbPQmfdI$tI4P`xTJ#{~9eR_13diT1+DdL$w zuRGwVG?I5DXQRP~y@$M^w5YSu7$I$mkxFOH_1?WZ1L&hIh3S|}txMvn9R=0;Is56X z2UI{c8o;r8%cim?hQ~W&xWB`e#sF0FWfphOn$|gyeAX;qScl5YzQIU15Z=(t;=G4F z0i3(S3*37k8oVn!m;Lc#+ITb!^KH?94jN*Im$*Lw?QqB}md|{y zth)E!`qw3W=yDLsK>t7(w3Dn3)H04(*|2?c8H~nx>7^G{57<#~dq;S*JHtcW8(uo_ z^|2?!HV+v2FbyA#?0xs)sO~Td(5b>jTVh>yboo;v{xq|XAnJj~X_pP$sfQEuuA;G@w|qqh{P&s?2oJh;a8ZBJVC6@b z<~0GLk2BkbhXa`Ag%^FGZUoSn4@a4uHCkl=5mC0fmN)J@YY?M;%vS=}kUN~#klT`` z1p$H6%W#ZpX4n}PWzh*)a|$?ihkmzj+g#=j1iy&s!whh(hb#vu)vx+hUmZ9#-N75~ z?5>NjD5np9^KBQMzc@U|=s@OL8|-g_IcLIODHy1S^4R9-G_(10!pk%oh+k`nmn>Nr zz`87S73dfF?;rQqW_Lzec#2M23$P1$`3pL2fBn>9Iiq2poCinxbWXYKD`3q z^ym=62I&c)TJc~*#NmTvjk&h0>-xQl4ou9vCVYEPpQNUWC=L&@u&vuFi zV{UNI?ilKi)UUDT2YDWKmrQu3)5DYTw~Z`M8JKI?$l@}8(RpRjd6&je?2-AJ*9)z5lFe zs52Ov_+gX`&cgc+xP-BWar5F-O8tMN==t632$yJJheSBGT1XVT008U2%+S104Up35IO~P%2tQ|AtUeD+EObTc+YmB zEsXrZU;PUS=A&zM8_JKB)vH&Atb4+n1<>j=>OS;qTFCsdb-xaz*{@t<=86Gr2ed8Y zGAi(GesJExu&beXA9~zp&1itth;$`9&FCC=jz_05TDJT1BQ~Y%+8fXQXx`rH5!)4I z6NCAB!|o_$s5k1h)}N^borQXiyxkj?`!8%z{nS6P6JW1HsV8yqqyv0yl3*`BhMJ?U z8y|wHjT$IIllqNqXi(?0Wv2%ka>d(V(4{2S#j}| z<$}juTNYh(Rap?Ax^UUWWy!KjDggMJzH8U^@HBS?|1g}|5W~BQYhTDW>gz9$FF>>I zpfC@0Fmku3JWQGgXr15E#Y@WCHEY5%3PT0%!72vDVaFX~2C0BF7}T;&pYH*O#r~H947m^VV(U-h1yUS6qH&creQ=C~4$AHu)oQ(I&#w zL$>g`;@=7?Lh3mJfu+-CM4XT{vQ_D|Avwd;T2S&v+pRJJ`U$T4v-Uj1N{o z&NPHSxjj5$nOdhYR~w1~90-r8>M1VZ<|CW+tN@Zn$s1l9p1CQ9rFNG^IqC|E$k$0y zJf-N*qA?GYb!#@1yY9ZTTzB0ybvchAt+BN^RlwjcgIf4sJB}zo2SijMP>G>$$Yk21 zGxZTVkNoQ{tMKA>?H&!Uek6vs(QzKy7l5|4+uLz_h58Fmc2z-fa;DN zyUW%cy8_%ppThyHp-=iYT43uu`4|F39UUtC%4z0mO>rng#585oANo`WfVdvh81kxf zA5c3TXy?OY-Rc}Naz0Fx_~5CdH@vTZ;UerNs)8#Y|M!=f{g(0#*7~X^ens9}w{9$V z+`Tf&5gvWSn~09LT~8%VMcz8sZ~2yQp}w=5sK{dD`Ga%H(2(J?KRXilbNkAi{s4zr zjNY79^yq!j)6WiXVbI@)nj7AUoiZ`Z8kiUH=hr_-W*DsVF(0)zjB+H5e#f5uWq5ZO zPk0TRw(l<6M@Gxe(Sv1IG~(USAoh$ODtq=HF1z;~ilJ&ehnK}zoknlWZylw|q3 zpoOkFe@ds*c_NLKen`lEE^GI2=wgAMUZ1t}k0M)9q0Fw9x0{*s>exmNPk2m#bztFGkn??aX zWceFRR!^*2d0*MIaYI?QbV&e7#1Fa6O>^OuzciwDC#XO#Iv{bgv*tg>iuW?9%@%90pBE*mIiQ8)pMV`#r<&On(T-saGN z`PKdkto|AU>#5TgQD%5nx2gJ=6t>~}YxTZuE{OcC)Cj1JwlKF&b?KP=MG7AWnOgnm z7x968T>}h==}~db7e|jjtq(6Fgow)~t%8ZN)Oq-7PG>#DJdDnP(#DW38r6}(Y#4j^ z31RScN<9prE@BTOupG)VlASxYmv!q_m3zK$OZogwA1$B%)CbG0H{Don`}Bv)9iRC~ zS$X?^m-P?a9YeBhbtvlt)sDUU%H{yo&EcJH3gFrhAi6OCb$wjGbnTX10jN95+RZ!5 znho2^`iyD17Su3M19=R;CR5i2c8U1(NGVtb-XA;HjNXwLx9Lz z8wq(d7$E11ybmAdCF%HJ=yp6>>F(gaZR_^3W%KsxF_X=QC-ZCh*9?Y+oKQb606U&7 z7n?U&KWNPLmosgQIO65iGXkQ3^LT;bodQnYsIUAF9@G+Ermy|}a;vG273ZB7;0~l` z)c361K_)&B>4?UZKLDRSjE#nO7ejd~4org_05tR)_A-0UoC>a6HxHLBo1&8q{h4am zvuAf%yJmG+81fHUF%g_XZI#ra%?Hs-L|SUI%&9X}&OP|z)P?VHuPk+rGeC98vH;XY zOQQV!wF8;!iu=Lv3vM3$p&18a*y@k80X4@1cD!?khAbGG z8{Uu;tu&PIZX#bxg)FP0FMk`Vo+K4O<9+RX0@Qe=wyg4EZCe}~8m!)n>4U9Xhs);8 z+bX#EtDM%<8h+2y=oc-FhCfsm1aJaSXU$sZPqta%>C6pzj37FVva@bgeOr2E`ek^> zaDZ`u$-McY|Bj~$I1N*wroSV7MbIaVp1tF*P zwxP7}t~=XjJ0RfW)9e8s@n%+#;$@qECiDIG-W4Fbu3UVoqG?5ry9e_ z=xr@E86Wqza(0F>hNpFCG_Dwy@*Klh_4@n513VB0crdOqqb~p~#%F#lu8-ft_1?Ba zi>5X50HMJElm!cGqqXR|HoP$WT(if!IN%Fwc&?Vc$jh(4im4&(i~L7!?n&4poHf$w=ckMpaR950Mh#BV0^6& zFq_#QWeC1?X;lE^$j*_nGk9uz&LLg0WJy`J;{1?5I)>e2Wy8jeWy6LIVO*nSFu-xe z(&c5@5+@TajG^&@vUuTO{hMBcgR>)#08WiQ)K>rYP=FuZ8jjDOKc^EfqCqsK|JQAc3eeWY~8k{&Iyk?cqKXl7q76M^mPQN)NdUDX`oS^MnUGB zP3_n?0-St=j0hEcZ7t>XS=}&wnk~ual~oUHFDqAVE%!dKx!kvQTe)k^mU8Es&E>9j zTgu9fTg&S3{8z>Aed{*WHPU^KT^yJbb{9Ggnb-^4a7?AO*5-lt$LIzy?+Oof+i=)) z3@rL)&k11d3lJVFJ4QyTS6UCv37uHxrZX^Zs#7GP>5^`%el}ifm>sHzLJy+EXQ|o>le- z;2m(#goV!iG4z}}So#O&mHv72%D{pJWoYqvW$}tj%G|{(%G{;rmHFpgQWjlsNm(4% z@{2Di7hHCEx#Y^L%OzJmzFhkF>&g|^KCxUL*JW2-Q?7{Xs>fej9)In1;Xz#)UR^YR zYH8s`g_mo1R_9G4uzp_Q8H7h*-C*bMv5U*UQfbrcyr4Noo^L%aFnIB3eZl5Q?FcX0 zY54O3jE3gT4G;^@vjS&;X8n^W!7TvH#}9LVKH4pcA?!Ru?r4;C*I2{}JPq)PynIZG z3t0OTD(A(pdcnK}6}Y!--BDJrURSnn+g9Jr3w_CFXkGwB4DV;n4DdP}9`1p$3h*Xe zqAf-~ofQJ67&<_1ZWGV}$pG2`OM#qy5Ih0&^5p?sd+Rj8{P{85_Texh0#n|sKaD*v zI;%M`MCLu$KLQxP4urARQai6h*3ff3OeFMpsCw4>%82t*0~|Dei}HQYvgC>9GPBQo z?*6iE$F_3M{r5)4u{L;j>cYV%>Wr6H!6m?q=j^Kc`h!=UPKoq&jc4fF7`Tq`%%KGN z_!Y^+0}XF;a8X&cc5{H~#6m{U)Qnpvl!_5{f9ijK~RMF(Q|?!NwA{pftm8`r;9P&)t~X~>}? z2;J~*^$@)Jx=e4+?z&XZyflEVV9Dmp9z@49=sec22P+m#=<6uPoiQ9X8Vow-dk)aF z815hb{_p?(@CX(h2|7B}A(-AN6n!Shm*@lL|3Zdi5m{ZAU4B)$;DU=n<``DiulGDQ ze>-V*J<+JY4tqOmJZJaKsYA2=f$-Ai#1JNiF0-RS%?Yn)P7D*B)44Aih_#OUX++SkkT{f&;U3P5QU{W;V?h8A# z11QixjJg{3bbQT+hR12h7T{UeF-F6+Ep$Ar*++%CyCoWt#y=K3d{N)EXQW*DxGT%! z9)D%Xw66~BojvMLTnEeIZx_|m^`qfCqm)I}VN2pS%p`n5(F($sm}Xtb*zSW|Ak?epaYU-!b=fJa7lgm-S3hAgAYpqDACDS5imM>AmkbhxfYfM%Pxo!$#_|}c2nqlX8p^t zJW6Ht=S=*moJEV5m7OEI%I7}&>9S${+R(|?7?Q6oi^F5SeFfePv*7=P#84 zSUApm1KP9u=LGQ2iw#=gn&7Y0D=9E3*#XGNe+Ch8j zqpeJj;d(d<1gjs(!fx!r@1N5j+4Dl9Zo;POkUZY$*sYAQ#@9Ms?(AsTlkKPT=FhD% zMfB*zW7M}d>~q$f7=5e=0FChe1$CRQ^6cHcrL13bUwO|5KV3F%9gcc8qUcS>)2^qQ zrXug*;o>Hzz`Hkw>?6BJ%GT{WV>oE2sv03aHFD9n5$8R=c^ z@!SBZhRlNm(!4mHGq1;xyz@~ET+gUq`QP{c_m}59=gZ3DqO;hwYiDRD@(8fn5yRMj z{kQj&D=vLpx$KHd%Dw<*2W<1$d_{LiHSg3P;5%^0(zgX=$?}WJz5wF~!VC0~N=NHU zo#B4x2)m)OXvy*bkeTK7FWg$baNEsg<-K1B5Di@{Sx^=(oL|>3n|d(!+!y*)j{wIs zgwDYSp*aDn)-TVV9Ygck4!F^w57ka^rs;_&9WQm>q6KB&*hu-MpLluMvw3}a(lwWt zrHd9teT1hOAh~nLt};Bbuk0QR8N-(L?AckK^~|T0Z~K-Pg?{&!+iv+>8H{??A#B{Z zuEtT<_2jUqL#r@MG1l_IWb5~ru z!!Y+mBOD2k+Y{d52oMXP92q|xz;(E8OSKgh(AjEdRy7=!@B+hIn=`#EiiS9E=Ik;Q zU^f(vY)*JW{tu^$!Fd+7||I*AC!PsR5y3>vgUzfV2)DLrTL(N2JY&44hgO zh#L(;BZ(r$f4oz2n9JiKUUu;nF%%w%v^UFmSEGf&E&X0VhiT~p>1XN4}zCFq14uW!!L#mhF|sl3*J)}>nJoI?-6B|I!1@chuhta9%? ztIO_PKE9ZD7H4|dxpSD7Dwxg>=fGjkq2>UF$ns?4ZVi0La^E!_RWlrWY*l! zk5vE>H{=B-4t}W~?Y_|p^oIgu?!EoCGQKN1tMEiEkE(~m=sW||4;&nevNZ+v|Mu0vU2qm z7nUbqeM!0Ivh&JS7cD85FJD+L49|5@-FDg^<=$EDdtg=Bw0%pAln#~6TSo$b!xm>* zxfeyPFq(Ls}{C`@bLfp7rop9JcZZ(4MaMlaI?{11da z5BP2n?Ph$xl?&E$4@UW?*J*|s!EdGxJMtXRaUP1%Q-qyGn!Cpb zrx?Qe9gW}mWjuOd$CQQT*WtC+9==hDQDX%ni>br(I=fG5PhDd89|jXn*qmtSv!m6B z+aD%8egB?PoU^)ZTiLyNW7+z^U1ih#x0g+;?kMY5-C5SHyt8arv!?7D?JQj~oU08B zM#fbaS!)2{RRSSHRvv`4kM%wpp#A=~d;0tBv+EKgb6>$H8jO9^mtA^MS-NCV1!w24 zc7|HO&5?6<%Y-))0AF`pMZ@xU+<8f+5qLqq)bHLMU>fqxj`S;*FRdSke306-X+xb` zG*@}vc`NGQLo#1#7*CE6FD}FTC{ySju<-rs+SUNcdh$`9!==MZ3(&Jf$cGVABz5^y zbZ7^CmA2Z!hm?5s!E49P-L=CQ8d_MFG3^~S{~L{X%tx~WW%ITj;T6p*E6%$hWFD#> zVe~k`%cnzgwdPghIXb|QCP2Q^#Oc66D*pab?HF}t5yozOs4{nG3c_6Q<_!)2@95Y9 zeDkCA^sqn-f6cX?S{46U-o+aR^mX)8br2m_=*Qf&&d>H($NSm;Uh6$#918FX&6Foz zdtF^U&>!`_B08$&iwDd33kS;bg|o}jq0ZXWx&711yclWi9obb@-FJW4ywM3;=1R%m zIlx?*&70y5_+(T&>+q0$Nc3we;9vlxIpD+5@%W$$jP0H~939ZXLo?%DC*0pz*&hJ8 z@1Qx_8D-Dtp)$6AX4xH{hz%?UBb$&Y%OcnZYb;4Z7lcQx4PVR`(5SkJ68rk z94=b|JXfw-TUM{$SXMusV!Yx4qtp0+;;k{$!>dUSyOQNGXd?)}rJl`3I$HNOO zW&Z3^77k2{D{MCKtv|rIKX~~2RJMZl84b;uU+2StwCSR{NIw8m{rcN#GiHS68s6lN z(DBabsH{G*WpsLY>6T^f4*>1!pC4ZN+`1I-Kq&A)bcXv6`V-mH%kI$<02(#*dBKVO)~{2{*>3OTH~oKA<NqoF?@p*rXcL7ik24Kj489;>$(o!jOO z!{wG+Z!cHG(0=LCCDj&O_pMx2m!e&J%{A3KwKHyDu)ofsk_&*E-}LwDdA61)&0Dyl z%wKV78Qwlpx8&CI820nbt+Ta0+1Aw(-uOT{Z`rZ{@Kxon{_b_!hlxTrkg+N;aZ{DHD@{i^5)Zz&)6 z{H zX>01=M>nnDtGoOvpvG?`s`ue1Raq4TSmEPvkj~$Aig+=lzqI;PEjg=DnacXL0n4#m)PdU&&g^OpypURL((-d8qn-d;Pq65W)gO~Bm|ch0k& zYcx~KeYm{oEpH4!Iaue6{ngPy`ouo~wRR{`a36B2+@TlK2la@;0L$5P=7vlGrg23n zgIf%YXZqucrd`6L4!zAjJXVIc+*elL`?)ZoJ>iLl2O0G^ec$2I7r%!>k2}Nbi$1*^ z3jT-VeP48vfqC^W3RrVGbNa!uEJhFhzSZhgtIL`PVnh_6TIZ!>=xzu;8aCul+svLb zQ05N$^Up>R2crx=#?7f^W!t8g)F&AoU3lPtc%}$+kmkRw95@(5f6MjuhhCOOr*>s= z9>%sUYs*dl{ps@Fo9`?;#`bkOwh8EL0n~G1r_{n27VjU~Q8uhwS2l0j7@lEVn>Ur= z0E*o^w+EOEN2Aw*!&GZDcPLkQr#innT>#s{Gpt)nJ;zn|#0QYtnyLYr zZ(XopepwOTsrlCJVJKG4IHu1O!1NI3Ky*CTq^bvvB>zT|d~1hmULvS^|9~j~bPwR$ zy*t2tZ#CWuq;YTUD7`5$V0ON$Gh2t|b=H{<+T}K2zAri*fEE934ZST{zO-C=*<}?t z9mnX8@?CJz`DI}Ym8Zh)L6%E1CT61>zr3GyUZGx7qWK_L5ZKL1Hf;( zf|?z8!UlYtb2#|H7@F_hJ5txe=F~|a@TAiteMkLr9yfHQ`pC@-bpTD>3LE*;on3B# zwEkhg;J@HT8;y>!_E=$S{=f!|zw2yL`sI?T!Y zbzQH{$aIhqjB*)Wm<9>CJ2lIpnilmQ@i+p}0a?Ojo$;cf{<3_@{Nis}9U9+NcE!l% z&W+pZfk607M915%r;?^3@7yVM)&nX!fARb>XaZm3sK95wi`VHFFm=36>+_uEgg@$h zF!C%8?`B$EKu-pqnPpKtCw3ZaBP@R7*_y$6B22Vq70b(txHfOz z5FYYqFyxI!;^51XW3Wn>MXYuh4}hG<8v@n)j+A`?1k=k%0HTxSuYJ;W5uX?=EW?1*yhk0HLlz;SpveCgBU-QgI{t`ASn zq2zG|xYVq4cyXypc2;!~Wpzl3@;W@*M?eQh(=SjT3$Jqh+I8iQ+ixu+!|ThkxiLcM zpH>!GGi=U3$~zb62Kd)yO)+Zj?+@?`J^M&{=-_yO@vg`}hX2llI4~ONO&^4%_~;d# zrBx-fqfCR*#vK$i&kBL)9DPriH#a)ap@Di?H89r|ad_ne(NPSQnaK~8-JlG6H>9&%~m740;dC^~Sco=-em%pW*Y8~vdf zoevJ?7yY3#b58ZkE&vap11``1s^^z$ufDo`?z5jLyN9=i!SAadh^o;><0M`!UGO&V z1t1RxPty%vM%%2w&)XS25HbcZY~Hb}Jg|O4`Q=ytYIu?}%Wb!PHoWegWnk{y>XjZ2 z!}s~ej-;U&zUoN)4X5GZ0L=hBo}mMZ=g*s87KexG&n}Mypjy~%961?fuMh82QbX4YP>j$xL1L;-oGb0+bp)qi-omiyj-O{{AbDef_ z@fho(^AbbW(qC@A^|rEM~Q&_FM4uxTGsJ)I=sDm$IIyM zy;W~9TCEG!9g5xg%M62M&fwy*V96zAX58=GvA2wj`{EvQO$z`FeftB5YgXT1M)z!w zZtGxq=2NdL&-jw3lro@7I+gmt1^hSvWKlofM#%R##o9%ld~Iqnvf#lHLLk zqZFZwu)olak<0Lok#hH4_td3mI;Lkn`O5O_Yc4D^_V11S#>%YFUmc^ctJW_2asjgv-2Ok4D1(9WK6Nls3c3y|n)N^Y+hdo%qF%%s(9ZZ`R`VV>j;p6v~HQV=u z7d$a$oK-{qx4-@Ek2w!@vg8Z;V0aP^`{3Qo85lfbXqLT%Ap|Rnm?ipM?q$1+fD?lz-gnZ-GE17;|SZ5obOq^&w9$*TTzWC`+ue)-# zZQT+LhR1iX^o36K{B;O+#7pvLMfw5^HB=uu`Xk)0h353{s!Ob5*bn9W71I~~&ll7W zNbA?Gt_P6#lhr;#IaFl+f}zNFs1DH$*?Db-!1Kc^U9#AI`$c8RLSJ~vZbwmP&%84> z0Wr|^(Z$f;*#M>u{D}^8g}has<(!CbQ$bzY6_-Cz?IW3d7sfSjFouKC;3}|3zC#fo zPs2=Jo3*eG&VFz=n-4uaswhX@FCO07@Nf)cW0?O%U-U%*$g|7+t5%nbFTSWe{_$7W zG(1N;eH^-6hp@rlM>eNg8Jasc*4O=kffzK8vQpLGx0981Sy0BF{R8_|A$Q^Jki)!}Avh z9Qb|TeJks=`uKdGwdRO+_qgZR9lH5y+7gX zlU`qRv~zi}F|?l(G7rQxyLztta;s1~o%HN!p@XO^n=R&qKH*y5j6-2t(OCu$>qgDD z&xosp#~VFtc(+dEa@^v0I1IMn#;`u#`D*|Xp+5V2TG2`Z4`_~uS6fEJiL}<`2JqXm zd)wOKvU@!A60%H0+KRS)x(Sv|Mcxm3r~#&jufP8KNqeY>5NDz%K^4>>*d&Rb9DgqX$p3fbuVdn0f;GXk+o&Gqk`p8p?p`u^^DQm>jg>=>yMuYJXjKUTx$ae1ihHPP2 z)guT*?o1h2i^qf5R~!3vPq;3)9xlT%B)8Pb9IaFOg<0YhNLf8RU|ESv8u`^fCg;C+ z?0g`L&Lv*&CqqP7w*35Z*_D@;`|n>_%QrWMzhof;FV)&pU{zN$j2q$xqo97%00D3o z>H`H+8O~VsN9Ht5pj%f4gbarKNaLX$92B=>69I++qVDT)gYlN9R!>)o@>L4Gbk1Gv z=r+_G<#88z(QCXig76_v>5VArv3J3nH){9PmMvS$#w}aQb=O^2KhWK~^8Rwc`RA9# zOBctmIywp-N64we=&Xn^LQobmkh3%7pBcmTx$`<--VYp{RzHr_-EC1H=AO4jKI7xN z>&~bvFT1E*bpEp7)7eFJdw7-~|HMtT6Qv7>k9Yozcz{%ZR^U_}sVESeRT`revef0k?{qPrcMyKl8oHeWP zXI`pt_=$Mc5%E~{?@nOcyN&x=8*H1+9kG4$zI8Mg|Fi!ZUv%{wH{_|DDj#<4rO2Y= z$BR8w?$|I=_6DFn*wlK^@wV%!BDQ)Uywj7-`(a=Cf8Ymx;J5%);X4bLkD{SdM4g7) zxsF9_K{TeMvKf_B!g+TLt8#f5uZ}@PU|jAy@1%86d?(F=|5V1>CMo~`llMtPK~z9- zn<+a4fSIM+PCOYqiOBxyn&b#LcOJxz=W3!IU^&A6Au$@ik1RhAVR{&cO$;625!QjN zBXZP#P=wa>M|j8^&$ues0q@R>+88z9BiTO0!*9gXHtWIIM^a=@e}r?rsk|dWmPuc9 zMDz9Ehf+VBfJoiO8J$6gL;M>;R=vf&VZHm#lnuM|uHHt(PRUV6B==R2`03o&|H3dj z_9RZml~3rf0(rcMFpy}ZQdvZhx#IlD(&5wLS2GAE^$s&p^uClE@2addvv}@As^Jyz zLKgbA{n*@d%8zQ2N)Lr~Qg-f?wsRYyRpz)Jiuz!@&RxdN2pxHmk?KRsnc@iGz$Q;s$|;bwdOlMy&(qP{LydSMI-112lHx0zv3CMGKa;2K1RXvdcKNPX&gi%^ zJ0|G_>)$cr_0|x1908}AozPAP)Cp+H*7clGQ3bgpyn4v(l{)spEZ^5T$41=F(i;RcMm3gh(|ZcQ{Hx>S(jU}_5`Vldz>VR6$^H=Jp`2xr%t&aUbLwoWj|BjWwdE{ zb~5dnhYCF<{(b|OAds9)gMq`v( zF@jLl+7iT!ptk;ezJL7wIp?2qp4W5EbDrzmQ1LR_uh0iB5Y&xeURLsh3)BF+r>;Mx9H|HDuP&3fG6K;m-LnSmlGxP zGiV|YbYB^h^Y(pT*t+6%KWRy8-h{?hvELBxlsK@_$vFN26gW8s|Dok;H?5_@RH>KI zn|gTEsUmTey|HP6E1fI2L|%v<``R-8?iN7mK69x$&gkP`y{Xh2ZL0hN25CQ?c{d+9RvK^&)RVN$R9)n1@7$2gSbYazWUq*nJ>FwiLfEBmz3d}f3CRcv(JBy=A^#i z{v)uuH~7WnuV1|YMsP$Un*(WDLzi`5HJvKCn0Ni{Z`8Qbi#_*1r>z=056JSWewtL9 zN^EWb%jX#l3Qpggi^(yZ)NA#osFAMRAGHy=o8;FOdxA&)?Oyi}_|COx&%ul?3vM-b zwFA{JVt6ssJ%pohR{Kt+swcf=6w7fMHX}zaxi#&;D5)BEks>bvj6fo!Xo~ zMh!1pcxu?8@$cebxT)Z%js|kP7!h&$Ls;Dud;R}TMlQoP|NiljQd|u6AKmj!4zZn& zWeml}z(@lcSNn~wqd7FF8T%0Lw(DZInmYDY4YT8A#)ww3X8yB+zs;4`6=TX&hKkfu ztV*xj2^GQrt_S|SR_#SPh+nK!KdNqo9<0&414Gf~=nN}+>#c{Yt>eGHcn-U50VVS1 z<$CZD`+cl4t=5!{;a3NRQbCJhL0`Vdo+kf0N&Zh< z7Ic1E`0tdo)pfNcf9dIP{+mSGMWn?mVW7r%f+A3yARN9Tj4r&KEqqpV*0Ffr5&Y}P z8a*!JP$!}pbw0mW@AvPTcM;x3?4k8k_O&$%|M%DDpXL9O?WLgyiV^;&YqczcFmVPzLM9p#ZK z&9e;`CHxRfck?A;rQwgVNW^Z3%S|hd8x`4%QrT8#X$Vx=#S-I{W7tn?q5T)o)~%nP zYB8!rMArpAW3e1z|KicZ?^9f_Svy2Z&*5$5{>j(-O-B?+e)9qczH)~4%NCe+u84P* zgq|WIpr^&$XT^<9y)jh4J0|<%R|Ee}xTjaoG5;CGy8Cp^vp!Kbhs$XPyUyi%oy8ZJf2SJ5RO-Y?ns#v5rulX9)6QabK4h;WkR70Q zIs~rQbl+Uk3CHQY`h7j%V*LV#j380o;Xoe$zr`NrzWB~P<)9VjtQ=WKT9F5-|M)|m zHqiSP0(wbmws4px{{bhUS2*)h~{;h+Y4}+JXGAWm<y_3v^I3HZNn*yU(*T7HhmqU)y9-K6kCaXsXZcZ=E$RF9o{p5VkS zscg5+AUrz5Wwk%?epW&6|M1cna3|~PH}dkuXz;sqb9h7V8;g|40p6yu`)_j z6H-e`BR$iFmkw`vo|5p_+?!%*N4DP@1U+y~D1e1{V0r`U7M`JKm{e|nu;j`XZX+%~ z+Pt092sA!z&GGo*i*JHBoPTk!2|ufhXusG*UcEZ1F?}o2tuO@to~XF+oMZg8`rjjD zL|EGeX;{2l%)nrs>w04+F{i9r@6YX`4#qY`NxSWl4}g4XUp@dp5Aok#H+ZLo+6@_m zt6FFdX+1@$Ywm);X~=yTmcyq4>{kewrPHBa>-mP2ryh^kY66RF^}qLs^o4$1du9Ya(fo^AS3{0{A^k|U{F^yu{|b1-A>6yp{coQesp%3vE>oRH zWoSa7xu!=S5k`DaHoE-HVPB@+4GTmyC!}9%qm$WcPUwhg1)|CiQn%jGN>=$oivFD; z|GijOPakv>VGK=vnys<&;XFl9$}wjz$K?^4=3$_;(kI}rQ9K{%g*WkkXmVuGb?Ukl zFC}xo7&NGa&m6lSJec-ES(y4w_z)sg@3i0NqMu~6cxW`O5^@cL{~CB@yFc$vUeq90 zRsbU8x;b3MjQZ+#t(Eaw=1fF#v|h|)XXg2v!|O7x)_#2cTCgP?z;FX7*S_62ylHh@ z3bZ6EI~@^#KIf`RP`;_<|0Mjve}UQLKs(G?W*{Et;gKbC20O}dIL)}@1w;~Vh|^4h zEVYkE$4blnWB<3OKg7lXgdLk=c9B<`Nc7^x=puaaByq87!Rehq!|Cqc)h;P0;yCDN z3pyr#Chcrj#i)9UU-aX1m zB&U{K1`vHroiZtYJ63qupIo(IRPaR{#z0o!YbfEGMz`k~s>)Op`r#km;R=5?&7o=I zyazI__m>aFJSDCf`;S)5Yp=`(y0}Ezfk_k=nkpS81+N(XU9L@$v5kb0si;CGNFKre z!|$ubvk3!RRH{sR-@tvDUp%l-x{$w3g?7W5l&FnitBA7_P`;Vu6*#%2+&}(zzS+Pd z^e159m<(9He1^bJgA|Jt(3^!t;dQ&m#-C@)<{uv}^=8oC455kxq)Q!cQaKbM3_bvo zn_+Wm$qynWzT2pFmnV%r)2D4FzARi=28uvaCSTaQ+)Y9hE4Gynq}!5Kz0cnW7-#m* zecow0p>7$QddkpyGUp60bEgddh+jQfu2MmjbIKX|U!^KJE8+VK-YMVd^qy`Nlf`|uoRm#9Ay zGJ0afq&}fC6*`lkG7*-ZBNNnxksBr2tERQD%3~GwOb1`(A^3;Oq)m-TPCai zRpz09d?6TbYl$8=&_0IpI-$2;^$!K1A8}iA9ednn!}wHq+mD8(G`!xtqZlC@o=(MN zoC%*j$6*bzhBM;EW(Rf^!_B9ELJN=U%Pz?N(B+Dyxn;KK^@JT+DV~103@|m9I^9CQ znL_EX2_pse+ZV52>g(`%jPT=t90fJDP5ZtH0dE_-fONkqjTz?yCHBCr4M=?%n^gFI ze8lKmP0te{gS#StK1HeMuQ$)myZ)Vfa@a844=J{-Z2lv4HIW?NEQUGvY8`cXa8eOT z>o0$5!~KDg)JO)W_vS!HYj_`+^FuDCe#E@BwIKH>--`5#&Y_M1Fijea+W`-<(;@zTF9wu?27f78~`IWac&V@ zFr4iMNlOov^c@oE{PYp`qt}JE?Q#kC6Zml4TK%id@4^D;L~*{_Nl4-8x8qv#@8Ur! z#kl+QY1&HgL}Mbe4%Z1p$KC@~8G(P(n670)6mr|_KOa#U7BNer2h)^DPVH9^Z9v5nSu)%dBV@>-z~e)I zJlwfG{K^ipj;S0^Mh*3;N0QlDk4SMtoA{3*uAL{M=D)L~WkL!O(gY&-&v%=G$tu?6 zO%V6qhDpJp*5YA7V9D^#wVn7ny7In=#;oyLPeet8bbwK2*^u~92N{owfk=<+_e-;2vBARf zH&vf$N>zosRV?0pe^{+sYDR47*zrC(3`AE3kXNzA$8vcP-Ld3w(dRJLrBtTn=+5w+r!+ks();fa{LkW_v$n#U z7*b2bdCN0xH9=xCXZoXIotJL9=#mkQi(U;|7aoK*pA;t8k}CE&$2P`2h2jAnRq(G@ zgn~Mp-}4)*S|>!Z3$a=VdiO*rgRU9cJ6S{PV!;yHxp&@)M2i(fJ=ul|S2oUWJ8^fK z?*gOGK&qRu1D_^jUo`&d1#=zsckho;I(Mn6o%r)@>e>yZUum3tXSB@Uq$4CtdMjnv zhaO4Y5Bcw+8^;>4&sxh_&1zrU`+`GdgOM~*82pw}Gs#l!_R;!CWW=?vQmy<_Wpg}o zJm6hn43%T}W@UIyMJiI}H$!gX#0PWda#}8wM&x4!u8s>}R`X%0?V&EE$9$91nXfDG z-c4=R&EYoSCP-?jKL6s{1rJOdsQ<$3SM$F{p7nF5G>Qg3ks^&#a!T_vx=eYHSu{?l z*`=CV6IdtWWokj8gt5qZ^n0leaSglL5Y}v_=1caDZn~W~`uN(*ht4|LK;f&yzL%Mb zf36jkqDM@#&W5(0eCXUlM&!^X2L`4;R*-`Ge(M$GyVv&7mz1nMob@cmeDYcUzw?NH z$aisC^6$-EN#v@34P|*MxlPp_O9i@1Zn5*p&}HmM`H(GjT?}{Cp?{b&>Yc`U(G8^J zK1ffd8p(Z&bdw8c>B>!gIM-XalhP8ldiAa{fJBv*@XY0babkQZJ2W$TUk_<2%hz8f z>+Al&r+32dgv>wUT~w%;!R%0V9XiI1ea`1<&FAMuq+oW$_CRbPSs?8~h!LL@wtlLWjgM%^c}CEN=3@ zWlxP#hq$QPFZGxc2No`^C^iUxwlM3abT_*Le5)Bd^P zOOX8XcKl3zQXp!ZIcq4_zldwYwl%oOJdoNX)P^{~uy1L_P%)-a{n#~;LmEVdcUDxU z_5CGXWWIRyI`i-MifKi=ECoN;`_{nBpzZrQl!wV1=1_uJcHpLFeCQ!kYvQyznZvG( zzQGLx_@kR*wDo@8QwObw@iGW@S-*Ir{j1dYJHY`LF>JG7_NO$pX5xbe!>M=|NqqYC zuREIS-jkosyv@FfD~Lq+670h6X8TGw#=R7nP4T$rVm`wWcaiIUVkn<4SEQil^1$)q z)7!aSMzH01!llS~HUdSyM7=FC1I-JD+@V^!`|NKxKnH(%N8qeQTJtECUv%1zt z7-D;cerG1s!4AL&-u>tjiajwa5KC|XZ15dbC+@Ft_(^M8BMN1x zP@38{sH+&@{%gQ~@VkQ9>*E0W?q4iEln{?M3q!0E$#3ZCs{~R~3sIXEmBp!~cL9bt zx0l`eS1X@EcsLiv3xsphS`g2b`KChxJluRozqtX)9n}U?9qKB)T`75a6fJeNJ1e5* zq17!{8E#gHn<(D2Rg&}gMsoV5s+)*J@C2RY$Fp-`(bMN_uSulWam5)AQI&NZPpIL8(nKeB zcy3H=W8|w7oRdYcRtF!_Y_Gt#@jnO$Njh|SpKwX%Ag@_)=OtMk0P$IzpZ|ekum8S% zFljmay&{{12qxXFdyx1ymuIC!7z?amIK;(BSLhJO{P<3na-qxlP}(3-6?;fruO{>( zJB+kkIkAL^k~S)`1<)W5b8^d^9$Y7(YGcamr$Jg2VlW`1%UYnjrZTS#2`=}avLi8x z2=Zc2(iURy`OuP4Kt0rVS` zne){5!oX<$FnX(6m-p;~q6?}dD+wd}7i%Mrt`_9S<4~-N~M_WO+E8v&WBsS9F zw2FUcT-Qqd#69=W5OE!;7a6TCY4@V(K4c2!rYkOZHLxh-vS()p=6s>@41$D(peXhPodc5#O}2zCL@T zg?A!2;*hsMtehg_lzx*<;K28=md4aVwOSDL;0aKkI1r2Y5e}<$Qq(M0k*RW^FR&jy zs(GnwrGE4tA(Q$jSlLl$&B*BKK38JN4`J4#?+$7WR7r8|&pK7ha*cn9hJbk{lsxWL z^uW{AGlt=;Y|W-e>zug{!m!Q2Be#zO$Y5ZnGVNC_3@Me$tWc9aD|^ieyVjnOdWBl2 zaHHDe{4?pa9$Lew6LZx)9gwS>&N!cng-43A?4%@3-MjSVFq|Na%<^>DMO+?zkqk`o z;E%JdPv=#rGc>2EihFzn36|`ye5`ix@Q$&1@IwL{AM(yp)on_hQ$qg6eV~x^uqv=v zE`eU^PT$S+G2^1 zk^AR+*&BpsV$gjHp$ka75J3$@lbGA$C8@`SD^koTk?kpT%6==|QcW_q*VYV&PNasa zt*+WDsd{=zp7GYUJEow-Q5yn*MqCSYdofOA)=NbauqRMldGAEl$fbuPdrUCJnlt4E zn)YNWN&~rFqEbNLd1cHDR?|SSwWn##iwh^ycRQ;+2*-C@l?unlJTV5K$2MkU^Ov3? z4yWw8G3C8#Y-ldC&1@os@WG680ff&)Ep zc~tFd8P%RV=xmUJC#4wGG^vPAcA zwkAoNGp9>Iuv`LH8PT=LGNg6oWug2PlQ~$jlND|%v}0a?2ERRZ4sKlQ*m4#Dekq7W z+l<46v}kw_>Wb`tKwMI^KQ*ifyVo{XEFXy31$Q5El=}k7RC7=kF|F)~7+$G8;_>kK zV0RHdsuEQu_>EH1KAkwgES0gL*2|)S?+5wpzaQ>ZX{1H4UVA;%TDZYRmp!I0 zkTS{mw9JVAakULptV@-RPKmg`-Qh;Si6#b}2x~OzA%edfsvZ1jRs%_nh9ucB z3GuLxQugNIn8|O)g0_|Yf5?bExci?j%nRzyakUInEz0}$vu51Y5gvnxW0KLOAa%NB z4%|w8vRtx*zblAzGilO(@ZFq&cvl@L^u1f>VFEY}1x=1w(q<$rk6x>W)U^g^j!6_s zhZ0$YG)`SFE9+Iiv91+-`hZmJDfisuKguH5ZR%OWEX{YPo~1Rqe(RP!;Bk{>R2|wu z*h(JfF*ddh@CW9GMu$|yj^x&bV_9Si4f(m)QdFbk3;*)^9J47N#S_!Nvc2Ua9|^o! zNp6xZBCMAqWOQf@5xbA9U=oe#d0#G}$ENcTy*?to>IP911n=1ysqc!;hne?}bg?N` ztBf=?7uXGzsu-dF7+CJ*66S=Dg0(wvPqP_cW%46kLzQO^azU$jm)?y`)AouB-MbhD zzyVr*?zOc^g+X|DWCCRdO4MOZ#njd*nN3sePFbVqRlxeEIqIr)rt({S!Bl0a zz7Oo1Pk#7!$H$JB3H`JGkxN!nX|qQ%*bA=F)mqOMlP&3eolHG+069{5HbsuY>XB5< zcY?)$NAQ{76JqO6#3b*8qddR@NdL&BazsU>tnz{9z@K0E?|-%^&8OyJLgwJgcFE+v zh?3(0eI1{}0jO{G*yig&NZuxiGg0Q>%OPoNw&WIx^q~+LxjU-H?<+X2^_i3ebl68G z;8R<6>OucXP(GxcBt)0dW@f2Xo)8qHGU=(H*Gh6>vs3!vPV!n%6vYOZ$0#luDRA*c zwKc(&)K2XMywQ2EpYd+#q%hf}5a?S(7n|_)>iHk&zd}bf+K#HqFubZTGJETh7KD7* z(SuJtm8({<-II9% zl!~zw-u1b$tKz+Ew>^613o>cMxoc;7YOx;MLa5>_1jipm4dD(I$|*IR)TArTP5hke zriedJC`Hwe&|YV$)JFsK*nVztGQ}WkRTxi&0yVz5MNAfz?)$_TP`y9sO$o~WH!*n} zJX2=Bm+M04>pl2Pdg?VEhE;Fk*ya_*I=7da%Gz%}QrFX2m7Vxj+UH|dQ5dI#3_6_? zpDU-k9-A{r%tIex1XT1Kt~+iD)q3jL+*$8Jv3_%)>14JcdQ~{@Q5j-_j(NsMY{-u` zzG}aPyiWy1GH~-RP&^nuyiP1}gK}I_lLa5MyuMfQq8?;B^aT7C{T%zMEhTy>GxGUD z)OA`nn(E3UAzRpbKh?p~3!O)Zj+Yvd3KuPX*b~hgoQ?>L#x>^k$=vZg4!vmDu5C*L zMEFY742a{0l$oSfg+z7Gh*O&08D%qrOj`)8Fqo7&HhtYK`b0nj)6)S~gRaLneM!BB=g|RNsveX3?gSQfbjktjjr;~3#hTFY1 zwX!?X!RXYfsc7QvI*#|#x&-3kLTb~H?3NxoE{}YeDQu$@A+V(rZ9^H0Ae{#mk5uYa z2l?aJ!0JEWPnHYnUc&?Pa)w8fgh-&#f`mZ~G*dg&rPNAQEo7#dYRZdyXh2YPr==Q+ z!-u`CW3y5{HtG=SO6Lu&4CSnO{Jfjqs}6kNwM)10oK_%Z z@g^zs&j!8Kg}L;nJ!|pY$rdKa>0jlo}Ic6>Sm8fxw4F`JPt)WvoncN~PqIq+c)=Ru2N;gQ& zuMu@Uwwsn53VK~94SMYYw7EWC9XvJ?=NrH~A1{7(y$GVS@XomfzSpAz&0YHAjQ3J+EVAF`{8}!Kw7D^I*FqX6^kd54fPSxA^DYc?ADo_WeaMT>%FQg3s)) zXTcxTmJAiCCa_*>rKYOhO_eWxE4rWNeNZmjuO$pi+&r9tlI5`>{zEf1f zAMDh?qJfQ7&a{tey*k_S>{N9kVY`BqHYC9f6GUdm1F1JYn_>6$G*_>Tj5<}e{<)h zutYRA$@AY*&eGRZQ<78@d1Tp3nFV)sXuw9_w&i8xyxFXKk$kn0yxCykB&sfMA8o=C zUBjco$ML74k~~w)cy(d}VxpPK6xqn^Qs#C@*Hhs9@$HSc9WQ`ssre)J|D;OX5#F9K z2EfAthLqo6hP=D{P$0#BaIrsQtd%qmUWMR?26At5ckBAB-;6R>hymQ*-fU2b-G%?j zd5ZVHovU30>b5$)NaL0!{&%-XAMd?yIOyT_v11)=K>38Sy@YW;GCCwMQVQhtHWN*~ zJ?I#F`|<;$rX0Did@!fX%}TH@kTHz+ymOHlqd1j>ovi~DF#L*+-(KLg`Hx^?H>;Py z`F`v%RT+Po)#*m)HVHlUc=qO-$v1NBvDv@&K^#yU_Toh9ui~3a8wT_GQVuS?I(9Wy zfsYx!4rv3ohaIj+G|pZ#k{ST2ITJMC*M@EQ_F$8;Ai|Umni75GB@w$5P*Dte{1?d& zV)@OqG(A)U!vDs$fm6g-_$vq>-L%&@X+1lfdnFS_;ycnN4qW;wPLE0l2RA{TZ(PC`Xu88pL| zMIE}0gQVZ>5Tp}Ryk=u=DcgB}_>`vd$WrCOf5lcRv(0RQ>eF&~*he`z`?!TEqTXJe z8(9eoq+OjRUm}-fYfL5pjrv-kS2_-VE!7fpLt0*FNrHQyEgBMR0V|7q0J*@G$I3ek z#8Wz-m%Gt`Uv3NaSIkfuE6%;q+UbyYw9hIwX3vG-Oxt$lrEQiWsw8s-F7_zjn-m3W zpgtokPCl7nwGYopiPOeo!Y)G!Skv*MKw{kQ%0C^>E;(RW?$H+6OcyFnrS}X8rrLrWC zmK&~=`)JI7FP`@9q~f2o`2*6%@YS2IvjQ^XrN;3|s@PoBUlL*0p%`k|N-4-i9D-GH zG#!A!kKMS^=Ws1y&)5PtMwKJj3WX&vye*n^`%8)U^>v5aC?2X6eWV*vb zj003Wg0v&#1hj)sPw%SM=hc% zV4GDN2BoSD!-IKZ-2#O>mSr5LisT^ly5aM1k|4LsKJCp&0C>iN>3oW4MhW-GFzad z3XD30MTPAYMOR%4aLkyn-$t3de+q-*=Cf*+ve@pk&F@bIzBMi&PvWO7VjM8==&nTzuKxyi%MGH2AReeSC`6WBAqt=mlc2A) zhEBSkc^NL`zBZxM=0}p>IbPxMb8Q_~V}tMnyK^Zb^?XJ=CsUw|?5#Aettbk6So3uf z+1O>ZoVY-*mGQw%6OrB0>Kyn$qS5ssG|lWjuy6Vq{FS!S4#yBZjH*E z8-axR7bdg(#+@JoSlJO7uhp=7?>tgs&b_qO$)xFCmM>F)RypuQIxH96I>a2XP(=}l zz{p~L3~8y#*&~%y7Bp}t??>WL7Zxp4J~EC1b{S@^qZ27c}xyY=oEXw7C+ ze#%g}QI@OB3R9t1MK6x_Mq(%3W#Ss3D5+3=wA27O)+jNVCS2H5H|e@ zbJ$`WZp`OyNNpT0FHjIi?U}epMeEp|C5oQ=$eXe3WZ7!)h)p0|clB>xBHEulI9PVF z+R-B|S-;pMkp)b-JWKp20W;Pzk7UnXkfpz+m)s&pH`Af7&la7|j~7IQ$l#hDvVR0g z(mIZX2g) z)GcQFq}qVrj*y`>n{%{o-PW;wb`y8Bxj$5>k7x zC)n}8oG}3yp`VG288Cs+(ZLK)jnzr!%gzP>psuqSm+w&mPO$K!5Y@{7q^jicib(9o zN`6PNjuUjc_RfD#=&V&;cx6piJjfo$?s0Nl9%Xty-V5>F6zV@auf4R=-`prxoMv;wZVG;EPQ-#24WBBw1uNwA_b=b{` z?{8R$V{eNeV4H%Az#c@onGsj`#Ce_nk^mzopcDPrVRAxr7Vz9wiu7NNF zL$)gEM|#0jbbE;g6iamq2L~UySk$UFd$_>le{(49|5vzDmRK#@xOq58#z>sv%80GU zOO0F(-Hh#qFTuH!9v8#Ai&EdwXuWsU4Htb7f{;iE5;K2lDv|axgD_XCiE$nuY}^OD zD&X$XS)fb2rf8HwC@@?p>otvKy;^N)#Pn;&DdUe66dSTHIc&g%|K6)cs*|Xu)#j1x z5x>XH#byQR_gPCWduG26&o{&cN!2@GMq5u-m+hG5Tg?_HR|F+NBNu5h#^}lf>oJZV zJtUnGG+IwsjZZ5xQSyDfxC1;;l0JV>iv#K&r|Q8iLs&$W#^l0&3-~#oT?l$^YCq2$ zP?7nZUT5Wt&6J@p=#ewCS4@_x^n~}ZMrfws4brsjNv6hK5cIcdb7USw)5*`kV9dkpPL)Iy(TXLs{29v`IRAzf>kTlbCxhByKdt4^2x>Qa=KY(R z&wuTc7X)|StZ~sK5w2zsg>2n?R^atG9HK8SwY(rMJZttE1Ce)8x~1#_3r4+P+$R=4 znQ_*m_<*#U+A_~u&_h1`jFw^Jt8A`p97&(<+u!t(kz*?`&)=IkfmXhj`{)JVOcovk zE%R0q*dfq`PmbZRg>n%;NdsW7am%kM_oC4)e#7v+A8p}FbjRpRt zry9ICNk+iY4W8JC1Z;SsQhptrap8msOof%Ztp1@D}>!L z2P=1fsV)0w7}@Le_Entxt)q_`x1hpZEfw78&TQIaq$Pp9U&&$^(C+;N)vZGH3 zIeQlhvQ7k>5vjRBlMwB&d9;%6**D-tA4`I=%D$1RpAtz%2Wcj%zk-N9xDU^hWUpq2)g7Y zEXF&?qE72i=WriXhp{05DIagjyELGy9_W9P$4VI81v*cAB^_}Fb)#-iGK&@oy~#GA zl28Oxz@;6Rd*)@UzHL;5`@d;gLuiIT_cNk49HvVnT* z>+U+mIEMEzJ8$xR2xy>n!7gd_6J5O!818{XK;za| z3#2MKUsZ<77%46nl3WY2t<>Grb)RoqX1V#Q(Xv_vcNNIetFH_hK=Tv3Lz=0h>>MJ( z+-%B^k|sYE;!4w6H*f5XaBCF3(;&@F>7etEGM!e=-?)a=C@tE`2+Sc{cg+4{43n$u3JeEtGFtJ8bqf>O)W6B~*t+5`DNW z9Uz6FWy6s9(>0Z4%QscD+&8Dypo2AZ)&sh2X^1!C9(Cnkl>4dPm@AL^xh#CRGwBhM z{A*Z>>?TnVi`10?!}xAe#I5Jk$w{UkhzjTf(|-irdJ>tU|2>|pOz`e?Gp*{InNM)Q zTh@?$31mb6C=*j6P--7W4I&vTu%^YvRM_Iu7}fQ5@$2~^_<%h$s@zHvMSSM!SCN+5 zc#Wqq6)WlSrn>9B6v(H_WhHE_hm%7CQl($rZKEvIm$Q*FOZjKUYHq>97IHqp{bu+3d*VN_Owr#@|zD+x` z>N<=Ro^9;3bH43x)qOk5M(>?lChK*8&9Y7H8)_JZ5{^=~wDiSi7`&4yczA<5km~jq zS{vC^%UfP8Ea8{NZprz_L{W-*QrEGuxm_&>XW>amZG7R=mdiAZ* z-SA|B4)*sGq>n0X50|*0Z>5sGzHQ3?f%`R49J$^XS4T@4{f0m6Imi#42LH!8OZ@u8 z3{qigMcPkDiw*A93ilFGv2p(LJ|M3R2R3$^6ne%uUC$|X_=@GvRxu<-Y+^`-g?;Pk zVR*1|d@Wl>bhpWD4&Po79s(gKjiR zKMsXdQ^Qak4lVh{&XFCV1e;DVOOF1Og}a;p^CO*bPuh&a8S(pj8Hz>fgnO{sm)b^_ zD4fsdFO4Fg@WY{DQ`i1}<~25#J!E)FjAjtS89fyk!i^E%4QG{}n-n;v)Rzmm&>L`xxcb_~^0cB%TpISHH(`i3bVmCEzYP>7bgoUA^oRfyY|8ye>N zRlq0)u(U-S2UI0&8ei7Xddo0&JYaA3AQwra_(c{LPb9!b&@@yWBBh_igzr@{6Rvym zSb3+1iGP#Xp!+4H@>8$D$1`RB8CaQWInEa5(9vM!r|a_}mm$jAQ+#tS^QG^G!|W{5 zq1{>bYm8^EGhf%&Eo)_&o?Bmwxi+jgP_?l+8~VJNOtW7c3p+SfZ}%=8Wonv%g3xr$ zLaO|q^M@sADQ4X7Z)CJ_Jra^3mz1QT>V#of3@e#{uQdBLVM+^{Gp6qBk67ef$ZZqM zR+~beEX07sKI~iDjylTe_v?!$nV2ikKVHr-2o1&FoU48QB>Ylh_AMF3NQ%Fu$JE**d zFtC?jKope8=`BwQV=Q(@QOFp#&#K4-W8mGk$oDZD*(27NpKw2!jl{%SD}^Tx=$BD( zt;)K8m(AXOEh|oqb<3d7&O7{M>-B8lhMX$a=`CauUI!*?2vSX{jF*P5e(P zPdJogte)Y%Pj9T<=cm4dMgG@D7~q$5x$fT=pjnnFw}i4 z8{Q8%v=ERo)cP53nsvFz4w8Pe93AT*9Vnmqu9XRmm-;y z_4-zmE1OW#Gjo%civ0k^{ojX6sW2!Bo$3b+r{k>2)G5HwJAIBrBg{OCT3G34LLEZ} zoh!V)`=(q=Q~{7(Wr2{zqrYPC)Ge2cL@v1CmWevuQ{j?*LLjhC8cOPB6H^)-G{@f` z7u6)@apqmHwf7e$KA&$JTqfs*E|tDC19uy{{Ww^g{wRL!?j$EKY-q7_6+*T(U&0mPk$P-ilE(!YI}`+Jq6HoP3U^GvCb*W!A8%Uc@5=?U zdol5BY+t-$L^C)}QQRxO=RKNf(T@G#p`|$>@=h&oz2x5hw0TS$Re)^sm>aOba^}^1WiR^^kb5cMS2u4FtFkMiT3A6m!W;as!yn!p)?UoNqp#ioawlEo z`*u4OskrbXAvg+{*IW$ej#dHg+I`2zF45DKhU`4LoJcgVJrhX(OQi$1=J-3n5GZu` z9XKfGWo&1qS#E)rrkn6Lhij)MPN{UH^*;rYm)xerq(mZ*!y}XA>d7^Z2YuL8K^e&* z%dkie_DobCsB_^P>wsFCG4PU1fCL>FRQ)EC7((B3(|E5Zowqi~x-C4Aj1Cq{{RD`l zd7zX?#i%J&bHUDj3f-L?vf;YsB8nLgJdVI=Dhp}9-!K#uDU{Q-Wi8Rc4?}IB=%_0^ zp#v=h($eqX*(*!Uw8zzcC*A}K@B?0x)|c6pu`Q6vYFU!#H(q|&Q#u>-?P=bRs zzMR9_es8G4)MIX2pUY!PSv3)`kuyxjHJNVSx~v9HU@)KQj-T^ll zx56G4ry3CV`(67!!}4-LIIuLS`=$msD-HSZ|1tKS(QLo*!+(fT6|2;$RZ47Xix~Y< zd(*1gC01=QVwKvpN9+W(s#+A)B1Wkq)C`JJE4GrLcEA68e-C~S?(;wQxgX`6X(dJ@*4;H}?$6iD!c z9G6PAFVMtK>_ktp+nQE4NbH@#6h8LXJ#yx`SBSVt0wWnU!jRIX>Mq9iY_)vyHp_~D z_|Ztju>xq4CBeR=rsr@ZrP7eaxHgq)c`J(@8AuJvI5FppThfC8Ybcb;_$0O!}+UlTz_16^P~iy)D4Z_m#E^jB828DPymOM#{Fu5Fu*!IA(NI(CEBI^_ZL_G}~e7+fbRT;=yRw z4~_#)_r{Nvt`|ZGD(&@v559j2_p#v@)O%gr7EN?JTIDl!%uE-0O&o_W^8aC|3On@ zEaoL;_2(`1AY)0yszEiy*!sZ|F7YA2)0Wih>oZR-`Gacj@b&PETiKs&Ej_O^PQMdghMe`4`-OSK-iE%!I{e8lD7?`Uxb ze4JXccmU3Khida`G>$ zdA1TFKd>Ezb>V=*WfbrqTGeClA%_BoqfYF%ydNL^93S`=N=4RL5s;csh(_iaUb)@@ zj;XBhf*v!};myd{K@Yhm0VtsH>d@+7Pe%pWaD}TH<=v>XJswlTQFge}VxPIhF$@6e zf6!p>uiAyXJ&lXdU{~wus`fDyE0o$;>7xle*vr3u4i05c4tG6p$)#64L-J~-6_?RS zf>;}+eY7cAIHFHAzMDQ+`@_S~d;dn+y?V56#=yebm*fHWkv?*X2w^%u#DKvgkI8M+ zam%Ec>tnQBG-FvrC+kZSK8WQ9^*(|gRZ z-)aE%vTVcT@Y;K6DG%m2Nd|-uNaBH+aU$yW@T#sYqqeV)93X$;MI$DYAEDcYs*Oev zJe0tgCDSYt_D77=?DnfA)@{F(Yo3c^3l-%EnhPQxZ>YYe9$TH{E}VlA6YtLF2Z-nd zzuIBCVUnU9`DBdhJ?yKl2-SUE!|R(S@%-_Oyv>%?pDFY;vyDGHAhotApqRMuZ&S@s z=voYBETk9O5i(?>7Mi@q@nURsNIgxf|1;DrkSOTZBM<;Gx@xsnPMn-lzhEvDIQd&zKKMuJ;szTT zhuEf9DPILLlzwmPLSz6I!@i-9INvg{G4#t(0cL`?p77Lu60ZwCfUYGssSQR~4!4iA z4-*yl!KD`e>h> zxMiI0^gHcV82L^`;f>PhB1#Af_x>y}X3MsX*9a!WY&tavDz>xGI|G*q5nh8brqwkR zaR$;4Eoyl$e*gJuEDy8C&WN8D@)O4uJAu;{B2$(vyA-&@u7nocq;nj5m$s|-YX<3> zA~_$P#*8AhybH?eB=H*BV`FO7r`Uh!EkvrVdFTM@){wPmPj_csM7zl5ZX2%wy)1`H<@$cQ!NX2or)ZhL^u)3gfi%REaQ8Uk1^I3!mTf)$oZVZ)O1pIx!bB= zrc?RU4Ev1Ts~Vk1p5NWBmZf^bvW{Ka)B>$*rRhVy6*#cNjp5t8nIF=^*Twu4PhO@?U1pVnMOyu4V54@rHL~-ZztUWyutlw3gnf^$T z_}soTNnF`Q&E7h@a!R>qREaY*^MMW@Is(jp0B@K z|GGkN+g87v$M&>eNb|tg~5X z|JP+VD~}CUA!CROv9RjJ3qpU@Ij5Ar7icM=Zn(NBmSOnooz&RmtLJTLlyiA!Prf-1 zN=P(SPd&BVRDUxd?u^CTv)e5fH?4@NUmkBy+>$uxWTyW2U5L|p>S1Mm?ySny-eJ?| zq&Wm?>%qGSHK#wYP&hDxJvnu!H{*7L!t|n6U%3sx4QsthGMucrTCJt!oys+VUYXCX z4}gdH(xfAPcKocl(wj^ImyXD;$?Z;dtp74vN)bypm>18FXvQodT*YRxpSHTpRRmav zzvaGE(mgfeDSQm=UcA_q%#e}mOV7{kZ>klc#96-k=c(iK4EekAPgg+E0SNOvlsgM+ zfKASh0I*89G5$K$T!5JVPo>VJEPeQJZ`KP42=W-;g9Xd@sY6wU6_cmVmXfV)#Ug z+tJIJk^AIGaof)E2YKqr@1S>6{@w123Qs{I*-W0_c;9RZJ~k4%AfQP!lnq+CtW@lv z@VbES72&(odo)L7|I|*xD6|9jQTix_Qyj59-;9X{b_K6mZ}}!O&utrZ9eaI|TO=d3 zYkirNRUT@1KoV9gR2Yw|Ai~|Ai&-PBAm?>~0Uwwz9>2hrc`ea|=u&kB4}4H9=D>*{ zhO{!)nG%f*YMeE89&$w>$%Yo3)K|$O+XZUmQM%|IO?y3;$`Ft38&d6-4l|c;c>}h@ zhe(Q&RSyS;FqfkgnaTL{Z0~GqXjtpx*&EtWZ*49Qye8{~zG;?J;n)1fi**(U(%UirkOmY%0}+s_|fc)0XLbPZ;f?QH8`20$)83%CzAm-R;M|6as^KU z9B9`i4j-9q6XrVCSndI|9w%n5e>S=8xqoTXP0B}>x)An%7)qeYIpQHK? zT`qBd2G9fr-LAs~OIWXeSDK2=tC10YaZ6R23jm|7+>gX`*|PYU$@#`*jcfik&H`(0 zBom%(-|x1aiV1T(3zdaa8B!CS)-{eV4o&6d+FvsV0k(3pz%ILul(Wa{eC&9@s~%%u zrc`4-*m~Q#O`hFGm+h%D zK~}%^zCC@6r-mB?oCP$13@baSh6+*3cX@k;v`aQBedg|rI~MPtx#!y|xPbvGH8>Hw zEMzLib>W}>N5Lw~q?-8;PGPtqPZP+Cx)(T(@X0I}j*oYOGx=bj$|AOw>K{O-GaR=Fk zz)K8n~VNsdAJ2X{B;Sy7W`b1<SHLo%M zxgE)?F{7LIdh5a5kKEB$&KeE617H(JvY$&AGoK#&l~XqX%~7v|NLYAO-k&_1l%cyn z;qj0%wpJ6~Xp~`Xpi|Fmc>720+!6>q;m~XVVu1i?2bVQ#(m2Au)c;7xy4_J}Wt=ps zfm(?q0p)OJcdi3dam|=H)yqnQlW6ruiq`p$?XDzxz5rvGnVLNW<@rJ*j8wZpcH6AL zDK_Ct&XoHxKLE*pvX%PeVM_5$?dTN6=NVl*4+Wkzf~boV?)80xA*9PHwa4XjDF+EnfbGIvZe}Y zEV_i79OcrOX3*s77eCC@n~{c{EDoB!Np|_qCBOEn*JHs;38tx5vE(;7g<@9;+g|KK z+(6(xJ9}%kvn>~P=}s~^$g>e*z}@auGI9;)AKvIEcD2vDiGh_x5Tn1}TQGs#W#7o+ z*gLL*o@y(>E9j#$fRBHMWK^0*X=Q{S84lL138|Qv)a1CmZDO$D9TK3=G^h7K7V7i` z2ff=#=kfLyEDj?x2AHt_^(Z}S3;9b9CL?p_W@|80Dh9Aa3>>Qh2NZ*1e>8_pZjoiL z5s7^C+%caw*2rEqzGLRA3S2F}oHjmW&G2FDYDIY39FHomq`lRQXfc5*{{!!9CFtHt zq<+5MV?9pD(oyx?oPX}K|4lR8g11KoZ|MM`XsxFM20^!;x)}yvZsKXhaL5+Y$>go| zuRTpWVQP(8ZMqXAr8>+woT>|Q*IPVD1}O)Nej6R8rrLOyFJ8tHSwRRjaRQ6)&u(M$cM1ZRnWNam{;+51H{(w-8_c2`rVl8gsLc**A!R zf-D=}YaZMkt*0#S%2Nf|tj)Q9lJd0*e6cI&o7WdUb}knAH@N2ZZ*!@rA^m)e0zy!j zujzRil*iGXg-i)<3EA^0WJFKGIy*LpK3H?pNZ;=#7bY`P)XR|Z-s$VSGXE`<9Q&i& zppdlnxI5+%7`m({StbSgp{pZwTC0K>vbuijdqSBz-4=EFTwk`@mOjx@`R zqa~-hnt70vQs-`M*RK-Y@)jFDmoOXC=%hr=G4V}D;lvmUu6OUH@!;MQP2`P4%FMZ> z^ctu@DDpnW+xlN_^U;YQU&H*^< zz;rzx&ihgi1jvFpS^lEs!+7Z}We)W5-79pyZ~8(#LNya8B%zN)3(a}93AvwmAmEu8 zrXFWqj48}a4gb}FlK5@p*ZH9aD;-%T?SKiVeIc6JH&9hM*Cp3?J zQdd8-Q%WH*lA2(2>`H!yH&obv(1lZ5MMJ)z75&z!EFp#!x5pJDqNlmLcmP&K-zk(&eROB8mVH{iZu|I8H!)s1XV zd${kIJxya!+D+Q(8Mhm79L<#+?7f3E1E3*~{f9t%Kg7ZVOE8%GBM# zkI&$}MK!|&WKns>kGVyT|NBOZMK^22X)tc-sdi0re-0I8+3Oe`Bvj5rOCN{RO-nw$Qo!~w)Y_V zm9(~?A&lTEY+P%6oR8!~8wHt}?DIdedaVuPj{3C%*4i8;)wAqw+064b~{H_1$6;@yZjMsvAr zg~iW~yMAt#++AbNhq~mmP9$nem^fm`2f-*z)gzxYEownE#1^jzgCB4btLx_CWV@tS zGrBdHslT+eRz)bvf6eAN=pLiEv;#Ehd3}EcjPip{H&E#sL$_@OgzAh95(QMRcS;74 z!OJMIm=P6xZ|plxSp>d@XOK?{&z$fhGeNv7K}0IztA+Z~%2?}_Xnu>!clFqnird#h zCNj$pq|OMdLE4b#ux#+9#aP~BGV&!p6%S$=P}8EPUQ<`ajP=A|bI&O3Vw@whm@ZQ% z{K(kWX;l<_I9@oedS`+MucIC{r`A{vhM1MAT|9l@2=80DTO+fIJh>5SVRBs0gNW;m z|3bdcACyGeI8VqHDvQ8{I*C)ai&y;`rGoiQ+I1PLEbt)>oof;js6O)ZsgIbdshE`k zwIE?Hv!}T*2#3Za*YxRJ;M;GSKfEGx-}bT?f9^GNz4h=WTYi9QN9O0;Jj#ABQUh`0 z#Q`A~j9(ToD%`I9<0=@Hh<8TjS>O5D%^NT0b3a zxar(N^da&WhiG7_Z)l zKsTjSZrx1rY`r;PHKx=+=~~bsB5p;GN=84QSPs%5js?IX5j7F(x?Pi=O1+#5g7_V! zXwbQfF<9Frl}rjV&sBa=_b!dF);@qXGqk@}bbO_=!|rf^z*WyhbD2`cEuG(Nm>LaE zT%W?dm$|sDbNyEA)cV)=D^qMDbz7y5b-n8%0xW^<9g-4XNK>kHi0C90J~}ja;q$L1 zqjISmBGmq;T2VClA7TF6N{@11jo!rFsbi;_vm{yy^T49?h%iG8C9+|_*m_hh3n`u< zv@`RomXA*5%j2kdYTwNKO>*`D0U$S#lT1izNRYwGoSa{(kPgta_A!QeIt_zN*8IXc zclRI@WU;u!;|(7LzUA2nz4-#FEmY5Aqh{o+V?p_*QyAgK!As}(YEZM)!fZoFOr*Kp zis8KEq{1GspS-1c(NdZW;5a1itc&n=*Jz%84;u|o49bMJuPdYEZtp|LPF9lq^UOtG z-T$1fy-M!&4gT)4k^a&^PPHEATkUUmlx{nQy$(Q$!CTs$nR|>D0R=+}7$5Y|nmavN z$J$*UIzw>wkxQ)zugxBng%-MYq}xU(BdAEO%-HhKIbQKsh&qY-(r{S05osRsq}n54 zH}d$R_xK;o7^#pk3+Fv@Uavxj-iR<{f_EF-TH3YCsX_3_Yy{?nscueJ+B?CcL+BTe zBERjY|GG{UdR0s!CW_f7aPQig%Zf|2o3WlQ`nT7f*I!099O5Rl{4*YMNUdGK7!pR$ zOAdW4dWBdJR|O>SQ?>| z{M!g~d2^xC9xC+O=WkL>;VCg_sfkrJT*^6LXzB!OG8d64bMkt%7*Y1SWvIal<66*k z1c`_gEIwY^^bNTJ=@>k$XQfL2+L~3+Yuu zt+@4H>&3Y1QD1E0;RabVf(Nl7$b)FFEp{+hQ|v4Dw#rP3~HIgem!V=F@ACP=(E(ITf?*rTY8&bfBH>eondRzTXHz zCIw2X9jBv$zt&CYn{1+9Pl|UoCVZcLy8EZ;Q}!q$wVs=vao+vp*PYEg>9$x{sMces z{a<4K?Dcr4^~|c`RCp;qPjWaG%yAe<^XZV?WS254+#io>&uV}VSrqpB!&J|!c>VE( zmn{;#t*Ls{(TAq?P*ZwYf^Hi=Ekw3ES74~Q-M@++UmQS_GlTRuf3cb@1w9dfu1!^) z?M)Tw@p_5N3)IL>zKUIsH#e4EXidgNaYyIyu>#RL`B_zLm9-Ifb(Hx4e3jI08m?3AIu{T07UOtF^YPf= zd}!`_LoIkaGh{Wh)C|2o%CrrPGKg);6%*fJCtapHJLtHJ0AWb-j_1 z?o>ly*c=|-s4;~djz0TqJ6263gaA@t(!n}N;#c3DoQNmCx`1Cdjrc&W3%As#1XMeEL0!TXJMbrBF#P{^!$;MK-_S z2MPpa|HUK)MSz|&cLQcxFcYa5*-VM52=%b|ZQ&awK|5I+rW4X;Fz^z72lRF7>__?8 z&HxqDa|ppIxc$LSCYOtq!_2X$O?_;2U^iBC4DS5Bn%J23?gh-K_*wI@#u)r=y>Z-9 z3neXnNEF>Z*_KICKK18SRw;TLp>nd&xbh2A1=wTB0PBUJYCzf*mjXqomwFzx3ZL(M zIV#ZQ-X}~8jdv>MSU{a{_?Tho16{ij;_Bw7@ul8~u=3NN(raoby1rf}cGwIx!b@cZ z)$xjpO6F1Ef;01>w*3y>hOj!vwl$=6)5BcO#aAtQc?eucTM>&ua)rLC-gQ%;goaYWY)n!6^sv_paE1F1U*x{9n~}F zBY7c|(Z5eq)bkLv&9`l%jFYVhewzPH$DRk;NvsT&#b$Ivrky^hj;&8y{}8G6B4t|- zEp>W_))~3OfUPqL`Z^|$yBi<*&+&IyY@VCZ3~u=yx(ImeuDkl~B=E$L+dNy?8>7FU zh9moh9aSjm`1&JRV%F=y0y*pP7iZkrkY@$ZjvX<e1Q1zk=ShF@zFZiXOji7Osz6tV!Kbp()mDU2^yuI;n1QPRsCSTq zOO}}`g!rY`wF7OVO(Ip0DVVl+w$L3%dHRHlqFGG!{H;dnuj^5ZyY^OWZOsCRH)27a z>0{;MI}Fi-W6$6!nS&Y*UP*RgiEO@o-v_(i5#{!z*rAa^Rbg^7PHAs!0S=Yj z0Dk1Ytx33KZQpP=G}19eGIJcT9j8-Cg6^`I00(SH)w#h=Zxf@UZ!j>w2nHlgEp0ET z{yp}1{-M2+A^+mk-g>URb;HXM8vO}ck|Ji(ZuM(DAmOFzIfN^ie&leHCtB!^mG2(k zLiXu8Q~tGZ@#!Q`aoIEQRqLDg?rh5MXHwvXB^=zBq=8Vks>_{jznJAr6;n%EE2W@(3yps|i zDuFx+X~qGFS(G4tv4PO(tj#vc@hvf;|A2vyFNT$k@ZYSe4C)M%FuDQ;0@N3fyWb=n zjy$mL1>^;C=1XeVuCaYNTrNP#9cJBSC*fFL%}D|oE8XMI@Ev1o`3tW@;qwhaG!?_y z)x1>w0~!0Y)EJ;qTH^Qd=Fu^|$DG{>uZ^c^8mEP$>#myq+ClXKnjgYmzgT{D!^Aiu zXf>1!YR_UPEGvCC@d`&%JpLp%-sjMQwMQVegyf1|-X;*YIJ1&Vp!`e9Ju)n;iu)$c zv#je*ztK7rmO=M6o-330BzxByTx54&fHOio2GE4N0>yWWNxx!jEkF0e7rf*isc&6uv^WkK75P;SH2L`+mT3+^{bUj{L)qpZG$+FKn`q) zf+b45W>W=~7J8!8FAg$KC(XFfz5OStZW}r)G&ex$`PJo>A+80^!mkY{S2Y<#GYxx( z9x%YO(n% z6?on|JA4(IbCw-HP`Bba4tU4HeN*9Dl3EHRX+|0wqrd2n7_oi3 z&&Pnm>o>BnEMx1h0(bsK4M~g$qMNc!!mhq%jdqftTO5eKgeHg{TE0fx_MQ}~Tc%J_ z#{0oot=PK#Qa$cIxi(}q%vATVZ}_m#yVAG_hf@!~{||m}#Y4`(2i547SQJQpXr&{( z&xV(>Cyu5>CY7G7@=Ha+BJ#t=nRW}D$W^zW3~6=iLZH{d4kwYThWCUnMK_Q%rCqP46& z3~w-uO~UMdi&*-8b2dCEh!H7GaH3BJ8z)azP6`)-Yp@$t#6btBjFDv+e6 z%@V7I0+%A_8E8ZBc99kn3?wvc}vK2X0&$4hVm8x<4khuNk?v4Xh4{8e+K7Ipv2OGrh%Eyih3% zA>d0#r%NHyKVde#h(`dU&PlWc=^&!D=O}~;Qoyk z!Jt=PofhWXm7q`1pCS&;|KPyAZ0f<98P!HV-Z={!^|3R3$jFt|Q_iM_ItggkYA5gf z*h-W9I>gifsi5_kzGDX-0||;sX?4wZLGcQlOms~ur^MWH+yAGpNvhum4niS1Qvj$ zm=_XmX#CUf?w9b9<@J|7QJpQfi)s(p$!nxtEbk zM>APlP_qomI)i#L{N2C8t0Q^}Lmu*q+WyszucJWdI&ZxdKZDucz8M;-u?~Y{^?8Z1 zpw|o*JRmy9P@S5km2K6EDGp(9rWq@#6(yexD(Bv#D~WK|U4PA>@g^0c1KHf?te1U8 zP(6}CWN^}HYi*z&&@{AEPLkPbXx>L*{R?Ke24GgjV=LJ~9f zUL~3cg)P&N*~9qr!`2@(0eO&u4--81o1sv-SOZ7}^lDqHa7r6TV>7R&z&?w>ic~8c_ zCA~f0;h(gaGEs*6trVPeG&gRQd~nil(=9kHY#R<->R^BIl8sVe?6<5PkxB8$ppj?~ z9TPDj<{1}Z2BsdW-MlAd>Z;3`M&x)Z)GY*C0%>r1;K#NI#y~y975{0fK6-K`E1(7% zs-IC4ad^DTUt>^IefKT%N~jF0M-G7Jme7lPbmos`mgCj!hI!S$rN)Wmv>^2QGHrL* zeVaaGa+U_}(&esP-mdN=VF-c5Y|0EA84q?D(1oGVaM+s}L_y;%!iZ?NA(u``*$x{jyh(SfRVe&nP4l!X(^h_Sn|kbw{747PApf zInu(>P*{K2c_s5AcjXP+i#Q$ZuG$NPL2gx!bVj9{xksn)d6jsli}rbO?t#UN#Q@sV zVxs(c^*iB{pAnn4ej(+UxIgR|8#eU&6%i% zSGh(Afb9;js!P^>V^KU%R=l*|H*Yo&JBOkdRBt+JGO{?-N7QQ1Lmlmv(L!^~};jRP1)(>$nW?9K;({|$tO0!GPKX-r~-1I^G$Z_o;G(iH~fan>|gL}3LL#w zX{=VV=#uTyhn{12j((Il)1gyRLfUU$iLi*4ap(7HCJDICbln9Rbr1SHqeDYp+Tbh! zW)083vn{dP2^BFOIiuDZu=Oy(&hd$`QP~F~1|g)}GUq*Ij&kE|FG>bHb~jWv;$+6~ z7bZR5SZIHnAAn^AOc0_cDq?WA5hRtmSHZikF%Jf0c0f9QLSub-yUI2U(U(!l#j5&r z-N=(X^60OYZrgUxK}GUb3H4IRnhL941$|od)$8N+W)i2Nl0dk3vQ}usm0?>GJ2;Ku zG02qxD|{AuKD#Mi#;=dvb*Z%`J1? ziXwf*g!G4t9@#RH4I#q6V3>%~6&-^qlyO_+7lknQY84)yMO^Caf6f+=Z?<1F-npvE zY-8pY7b&cml^@#0X*1yc2`Rm68CYXmPrBaQJfVY8IYRZ*y3W(Gk;kFt(B9-wmnS(6 zA(+}~*M$Jpyf-#~*0TOBp~BVjCD0s-Z%Y4KwGwb@LCcHY?mc@iqzfFA!?3O7;m$N% zH`BgTCvegiG`cUgD|@`V+wyy~vt=g#!bq(*3n~kRd3GH}0X2NLFX18>XcS3At z3;n`}dt`-vhm+_V{3aG%>$Hslnz2gXW!k|E`qv6aK3yjK&LP(>bL(Iu3#ziJt|qVE z?=`gy9j$v|IrVx(FXCxx2K^+te~?g`U&`hCn&Y3iQaHBGcF=dD6d&lj|IW@ujo;>u zzT`6KGf8TrlUHlalOOIR{K5u;fRuL+k1ewg7xE)`O&ab$y7%jMz;kwtZer)5Bm3v; zZdO$rkgxgD>i~2zP%nbwXu5g3)*aL~zCa$*5h*U$dht?+++7}Ipd8`fBGPlA)KSCL z^fIv}^paAW)hosM%f~db=$_Z1Y3&`LNq0E0rEIC8Ax};8iSB#bXw{5pfmj*$Tm^aE z9NJ5K#U5Nk0k&*5H}Zh3C;8NaOaUbl8-S;xyl5_1T=l~@3XJw5XwM`@T6;M8gsFLm z)v}1AEwV~zXgduH>#K$2O3mJd0Cp5h;ZRa{1TL0x8~y-HY!)z@^VT*EPT7roH;7kX z&7MmK({^kZFYP5&&@Q{N6;vs*&Z!*s8S@q22B=(5GR=jeSQqPfQ6@8q5p!hMjUu#v zKU#&g-u^tH>cA`3aunefgEMrKCo~XI- zRmJ7->9;)ZFQ*Hh13(sz#X&QU@_f|(0MKRi`!VMq96oIMR21xTy2zU?5zAz18Z0-S z^3rPUd6B1c7WYs7fgG93`6Sx9pK%sRyf`D{C0gft-6{VD6fXLj6vI4s2-L3T_6p!r z%7;;fK`2i$)9mMds!;dR^FmDXHFB?ruU~i|?WlL=SOAXwCOpL12OL?MdT4D? zW5wn?W;Z~%{LwI#A*U3R62SbtmlxU+MRmO=eMRCqJrKVpw7>99K&V9Lg17!Em@nu^y2J@jM$Y>E1dQRg`j{hWK;h}1AX2a1QYcHWod(N~A3N^D z=*zu_*W|ar5p$9|XR7vD5=e~1vgC*>Wn#3F1DWvhf)SL1?*7=&y&P>xHAeh*vQtIO z3f+mW(&cVU{KG4#Az%$I1_paH2It?)%5ZaCc+)u_9UDR+zL!CLjFGp|9%3ljN;Hfj z%cJkFwU7*>072Cu)og&2!~o)C5t=G0bZDXcK7_p^B-+R4`$rUGff!q479Af!!7Jpk z5GqdM10;51-m=HrioGYKC#7PED~I|lG!|nG*t()TspJ7D-pR^Or!G*g!nV5E1WAZe zx5Ev5AiWD;6d^)O9|Gn*_w>zuY?Ki1w8gQb#Z@ot6{D~w4#Zw+T`|pIkOT@!G7P@_ zdPANH@THmDbz>N$ilFW3qfz7R>>U3iy1?cY*3+1o=oET06~PSRQjf@Tx))73(xy70 zQZ{&osO_O5qeG|OZF1tvu&4lTV7Sp$O1gap%m18Z(cBm=O{^{_Gg{sQGD&Z?iPoHj zz7pf+z<>ozE$IVxH0%kltZ<}yJPuVo=O;UpgG0T~^U^nSb0LhpzG1H!qN{(d^RZp? z^R(0J7BU~+GVGM~3LdR?aExsTIFo;Cs&I9sucH>$!fV@w(KyMsxK*p-=<-=Y(%1C* zNP0-86mm!As4Peys~a^Y*<(OOy{0Q>6t;alR`F+q$}na;HXL@ZK}py8$IZWgwvP6U z%74(jk>zthdz2f)bI*vT$h6KDIeC&AlE(bc*4&vqBi-PNV8Rh6z$Edsw;3Re;n$Xu zY+xi%$eYqtk=l?FDju}U6$uTgf6@F&L9MF^3#_1%<;e%&~sSAGTZn5mXUZZfHtd7^$-|MJ!gjUc76+pn0#_4|sl(Y*gm_zn6H{9y9;YdkOyYI_ z30$dG22BTH&jfT<6lYDbT7Z$xj1T)!$CXkohe45Q@?-#n?Z&L|O=WGuTL=IZHIcn4U zXgPK^Q71L;ayKy}AatBN+Ef99e6YyA%74D$hZg@$cIz*E|A}_Q^hXA@^_oELjL$pC zwoAK8hT(5?j>>q!4@E1H3(&$Y4Nu?bu1FxEq-?^sY{ zkru-1a?^dgr|Ewy*V2mms=V4?BCwvj_+LOxmh9E5$VQ&~_t!&E-?!!<&<7|+FzKJNkr;h12drbGM zL2Q@rg{&G+^z^J}*-i!J_y+R)a1HvD_ZuKH<2KFB!Wk*k2QK_;TIduRKoF16fli;R zsoJ-**K{q10~x6r-x_2%&_E@b!MoLKUP)l6^2mWE4m`3XfK4_wpsp5x)qy|3t?oX2>5+{ z>o^XY0&PF(@#0dTUjf+$U#_dN>_ zxkU_n!ufs8hdj06`F?E6MK`4%o)s|5rGB+SL%%sAGi)cxx(#P(4KuV?Z2}S!Q#1jl zCai{FP4Mu)mcz4?g%uOYf?h$o#;&!yj%Ihgf8sHV1z{u+cSdPqjUp=4-HEA%67 z($b9f%_jTD=qYo98q#g?e;n*Z{GMbV|8uc>ym~{4`_IW@%Tc1S4F&UMHmD}zm;lcxB!Hd9KR?MsqeNR`4f11hdu{InHWjlF+owy#G^q`ra6` zT}Nosy#w(Vf6<;;tY`g4D9WWA>ZopUF&bgw_Sfw-y7;TV)0*4Mmggst5Ru(B>tCcJ zW#MkQNy1)kfO{yV<%?dYCK3)-hLkj}BsUJ}O8Ovjxh-VFw-18kz|@!#HIXP9KQhtQ zNi>bQJ@?kO(8Wx>NljXvL%W&>s30c@xXLr%E)@QUKVypR9$pH zPZZiJ$lo3gHIDmHBvW@VWwc{mI7U%zINenHpU)aLPx5AV^F|$n{|f&Jt}gxE-|bdp zc~-ciFy1o7BHs3Wi9Z)I)v5vef_WT>R-}0Y}JMsF#r~jGwJmZop<&$l< z-cDcA>_3Gp+{i<>`MVg9M5mM1+W+f0{TMxOPI^!7A&%Vhe?DU&t*if2hH7+qHlQAL zW<3@*lQobxDra<=5R%ulb$sy3b6dP@-x+_{-L*BSX;4$FMo2bkiN0{J@c4CFO8OG` zGYZpx|2|KLw!qtI%33x5{-2BTf5-LzwsQYpFWR1XxJGTD?C0~h{Bs`9CF%d)_RrsE zyIp{~&P#(i=Gor@-RPJf<+7)2cD$9DYp}7-GTZPkj=`eqbh`!8VRLoB`+ z-HN%wpE_7A5!Os34x;cD!wdF=b>gK|TYJQ2^W)r@ztZu{WRI?nio}g_UH3H3>)1%< z^9=&6jfVI3eLa%D_B%x*xo*Rg`=5SZ?YQN=IFH%I%1UvI+WgrQJN4q0n5sq+Q6_ee zmyT6u^YSAmngB~{6dx$GcLm$7y=0|Y;l;xtHDyouLacN+4?X`f`^*0S>+4FxlHR^G*kH4#JZ0uU!znXU`m4op z#Oj>PqornLW=fNpLt>f&ilBAW(YB2x;vAFfn%=u0q+Rf;&Vz#`pcyEjN?i1-9?@j zNQ_LM<%#9}nUwMzGzsd4(!z0mib1Fa$ue6!{UY?{|9}Sjygm9&TXvtXv;4WIB_2I7 zsGVahm%R~!+GMK2w(N7vtQw_NRzS6I(06|1V{y761Gy>Tvp7Fl^?fF*G}XQbUa&#Z zzGk!kp<6R^KjodzKiDOK;Kf89XZxULaY*zy5!C%s|14~$aCNu6tsWs-N;?z#m{eg? z{0^&ETT*t{qF`rPG#D{CMPmnI%Jss8vFjTop1#v3|C?x#+vB(*?7|DEFtusLbx z2722NH57I;ejCT6Pq${irv9X{wyjyv2{if`Uy*=q*;D^4zt#SMx(UkSi=w5k zYFEQkt@l;nmHcFWt@<$g08}pUXVt0Wqs=RWO)++ByINfJ(pT+bD73Smc)-|U+d~DV zh8$nqRDhI-!iEQ|8bhfkeVFUXe#Vq;rW!Pw0N#;cQ$!rajm`pLBC6;qX7v+eoXVH< z0mL4tEF#r|UAiLHUzVrAu&=R;MUR8#khD+K#dZ`?Z{2s9|5VicU%264j@D zcpQ2gfaTk;E#T_m^-KeV4>iwt`CW*5lcu!L7fW=NRbc=@^W!J(=}pXM-D#SKL=bSRW3y{q4n`WGCup(ec;kLn$X;xH8y7$ zq{vypGoeIS!huiz_L5tRkrh2T{rD4aojz#73vZ4=z# zbVM`DjF!?Nct$-hGY}t-5%Z6bD4K>C9)YIC?MG(<#Sp!85vDtvCl;JwjwZxilP%Hd z1=QsfXgVz62*?p6-u!EncI&_lh8LNd=r`I7WFMpzw^$@Yo6x* zyF2j=rKtoCH)-h}zbcVjRmwX~Z2{&Wj z>Ab53vY|Dl%0_9Rk8^#TudMkWjY<<4Eb|z~FEet_&=f2vy5%9^jzNbAiogrU0a>nQ zJgVv0055*`JViBP!jmE|`Ou^@EEXRxwKMS>oFP=+y{ISgKH)R|di6J@92Ve>{;l>aYI={iW$1F9EKc1av#65el|6-MYW;zCM<&c4u24 zl{sNdu|}BzysWG4vxUg-7i;Z#BU&a{@Nh>X_ELLXJ$C(;43oDBwvq6P&t~aiI7LxK zkbu*1_HT=n&kBvagjv0vh7Sf!=z?uTzxCSjD!aOE|jBlIel0rB*M&>m2V; zr=Cipj@}Jj(Du{tyE-1Zkz6lXDkSbIM(XKQMHQIkUgT`f`3|8?&RXkkU;P5xtxw93 z)HSn2BilK`yCCVp`0QcZ66{!x$<~E(Khqrlnzsqy{WdyZ<%xceb-f5z&#SuK@n848 zx`JPIJ0z`T-53YYj+Bj=4B3Mwob(*fbm5dGZ-CUk{u^P_E^5PQ8dsW~Db47^|310+ zv=dnI$3Mrkt6NfwTlScYAe>bVCyTRO zsf>_eAkQdb@N91?KQJY~;AwH#6}(I=9Y(-ECiHciUc6iMNE0*K0T@66`^;UNAz9~| zQy44={(69HFl-yi?kP=j2BNt0D+@XE!DDM~sA4Yk-_5k>ITt^}9L_6H7IEkV3ji@m z&SGjq)l4CBX9~~L@1pv*9dd4a0T&~*XkrxX>AMLMI)SeuZv9X-JZeZZUzzme76PO; zYxFOL6uvS!))LFl=(IMt%(Qk9$q4>l927s&+&fL4w4Zke!g-|^h4@k97QSV{zRQXC z>@_fmq`!-`&ehcOGjf-K^^JA}Wf~|OcNIUWm|{oFBwl--*4FKO$nm^YfbBOo{iC{@ zOb)=x(g2WTev=hi*~I826$jW}C|@<4NG)X8YKf*JXL@F5xu9c0lszcaw#Oy;FgTwa zH&o9{)u__|A2PjOIfE}FlhMAF*IFE)E)pbN{DZe(M6WhhXOhzdCH8%z%_>0-g0|1` zKuTlgT(jVL(U>pEC*}%!&;IeY^@Og}e;bjw&&RE&B)tY1{D9iLxgC0uPCBuKopEbD zfgo^}LM@l^j+4=UVd4^JI~GoBCJO}2A>_ct)gEBu*CC&S4<_EmPm}q-9%~Q2XbAe^ zI(>QU4dD_2w z-xlOju(bGYJI$GkLLTtc+|%H`N=o7Ka9J|Go^IR^x$T*>3S8d$BqU{2^X*mC$jT^Z zn@QyWs(gdz!Y(iDc3G5WvXDnXp#4;NRSQH|24B^2iWjd2ssWhD?_95NyM;|WnCl%W ziUg@TI=@M;KllZ^`bNi_Kv`Pn3Rh5VA;bEo!MoZ*cvJDIEVHZAN;+-n8K~!GEtPg{ z0~`FZ&?D^H1^n;h99onXC_&=j^Yd~2lGb=sdeu;)dx=o9A;|@lt#^Wza)anF->+U{ z7?8Wp&NqTHG~*KIoh~_th<3v$%KVudA(y%hn==iv_37YV_tgs1BZXYtd;AGMEO#eN zesX&A7NpXp7TfAFU~A0*GuDhZu^D}lG=B|Os2;N+k^Euv=BQh1?c$SA?gaBtuq6Dq z$96l^Fm?Ma-dlrBM1-cA@f|uEW98kry4*^7d%yvy+Ba@zk=fyrz!4pD|dMNjHz{ut3gX;L6#hucZIyAF9okaOSQe7&mrgpU8pTVwc_q6}R-y9SyE~@A4Mb;Eh z?Wymjnz?S~L}TTSb)pjJj=C`Q@Jn9B!&D{=j&U0}9GiD91bk9d6XWk!l~9W18qjMN zU6ljij&Zih3-6rR0V+U-tJ48TNTJTjW}QbI9IG0r)J%M-xIW`DBgzb%T7Iz6HqLuz zM}oh!SLD){4WsA~lIJV)WGmg`x*FO5oB!C38jMA>&tkZS%*?ENKjuG8pX{YCvFsh* z?8~2C!@&&o0tudoz#ObF-+IrT6vm&dsdN-wc|T^p(x3yO*~?&%a}x6n_Ev zh2SJkQWDYm*edAP2~GYJUe##ipMKW(*q2+mm3y4CIX}$U7L>A4pFqj{xoqO5Z#6%G zK;Q)lvei!Qd!Ba`?T?6+nPh`Oht z@a{!)ENNALJx@Wl^gU?0AH|650rJ(Ly!BI35(OLUE*sG+x5^AR+Bk;o+IyUr4NW*^ zxCyG&9EooXK9T{~j16`Gc@evP(4q8&!zAJ;`tx3%e#r^u$wXO+I^mp5S>`XWXXawG z;gOzNoRo@pgTOD)1Ot2`4A*x!Xi$$ziQac~!OxLQS2FbAA1;~N*M+feqSI4#!iq`m z+d9fwWSRns6t-=Z=06$XT0xdO%}8chFf*pzMJLJD z;OG_?IR#4lgq;u|p?K-DFlJh3LRFi1e1!Kfm;}?hAxsluWXVeTzXCm9%Iq5KCH(E^S$93K)*8UFiebHJQ~tRh@~LWv@&n?)C3Tcge;cVd znE~H^d6q>lD~92~K#l{#Jw&8V2Ar|KTzrGSPE0_$q#KkCRGj!7Y(P&MI3rlOYL zw`x;V!@_M|kYug&&8u{AZ1bRAT3G?N@nFOEuySv#_?}nMnXj!F=Dw3A;Oe;7D~Ad; zW7^FBdT6k7_whu$8NqbMCubkX4Z+&x>vNjga@+RMsZeHD&;3Y}GXEa<4PH84!W<)D z-&fA$Wl)|Ltu2~flSc!xr9?O$fga`ro93T7+o7+$0egRygSL7==THif>g8~EcB}MD zT#|WLf0COG4t6td7P}9{5-a`j+Dg(d#>~F_Q@zZo&MH={;w`; z=w$Rq^{yT+t>vBQYM`KSlU8*v$!||9A_0BACej>Fx6K{7F}IUB4;+Xl;*s@A&?^v)b)Q=0B8B z7N=rp-Gi(>5i_MlKY6Z@ij}_-q{p8vTfWG#`TrP=|D!!@h0k-9liXm(2}4&?fBSA* zp@X_IJ-PU@AjCZwzL7v|M21jua?IsD#m?u7M$i+FQxyuu!xhQ?_LY;!L5Cl2)Sv6L w^vdZdKy%Jr*EBXI%)K}@>$!uobD$c&Wv!rZ8w|V>q+M=*p8li!*yX$b1 [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] -Teachers and IT administrators can use the **Set up School PCs** app to quickly set up computers for students. \ No newline at end of file +IT administrators + +![Click Get the app](images/it-get-app.png) \ No newline at end of file diff --git a/education/windows/teacher-get-minecraft.md b/education/windows/teacher-get-minecraft.md index 98c194c982..f3fa5252e5 100644 --- a/education/windows/teacher-get-minecraft.md +++ b/education/windows/teacher-get-minecraft.md @@ -16,4 +16,6 @@ author: jdeckerMS > [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] -Teachers and IT administrators can use the **Set up School PCs** app to quickly set up computers for students. \ No newline at end of file +Teachers + +![Click Get the app](images/teacher-get-app.png) \ No newline at end of file From d2f065097b2818e66fdedb9891dcd37f65dc7432 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 19 May 2016 10:15:32 -0700 Subject: [PATCH 340/439] removed colon from yaml to fix staging --- education/windows/get-minecraft-for-education.md | 7 ++++--- education/windows/school-get-minecraft.md | 13 +++++++++++-- education/windows/teacher-get-minecraft.md | 14 ++++++++++++-- 3 files changed, 27 insertions(+), 7 deletions(-) diff --git a/education/windows/get-minecraft-for-education.md b/education/windows/get-minecraft-for-education.md index 304a564556..ffa0781017 100644 --- a/education/windows/get-minecraft-for-education.md +++ b/education/windows/get-minecraft-for-education.md @@ -1,7 +1,7 @@ --- -title: Get Minecraft: Education Edition -description: Learn how to get and distribute Minecraft: Education Edition. -keywords: ["school"] +title: Get Minecraft Education Edition +description: Learn how to get and distribute Minecraft Education Edition. +keywords: school ms.prod: W10 ms.mktglfcycl: plan ms.sitesec: library @@ -9,6 +9,7 @@ author: jdeckerMS --- # Get Minecraft: Education Edition + **Applies to:** - Windows 10 diff --git a/education/windows/school-get-minecraft.md b/education/windows/school-get-minecraft.md index 2bf69a266d..256ec85ac3 100644 --- a/education/windows/school-get-minecraft.md +++ b/education/windows/school-get-minecraft.md @@ -1,5 +1,5 @@ --- -title: For IT administrators: get Minecraft: Education Edition +title: For IT administrators get Minecraft Education Edition description: Learn how IT admins can get and distribute Minecraft in their schools. keywords: ["school"] ms.prod: W10 @@ -9,6 +9,7 @@ author: jdeckerMS --- # For IT administrators: get Minecraft: Education Edition + **Applies to:** - Windows 10 @@ -18,4 +19,12 @@ author: jdeckerMS IT administrators -![Click Get the app](images/it-get-app.png) \ No newline at end of file +![Click Get the app](images/it-get-app.png) + +![Enter school email address](images/enter-email.png) + +If your school isn't managed by Azure Active Directory, you will be signed up for an Office 365 Education subscription. + +* Office 365, which includes online versions of Office apps plus 1 TB online storage and [Microsoft Classroom](https://classroom.microsoft.com/), is free for teachers and students. [Sign up your school for Office 365 Education.](https://products.office.com/en-us/academic/office-365-education-plan) +* If your school has an Office 365 Education subscription, it includes a free Azure AD subscription. [Register your free Azure AD subscription.](https://msdn.microsoft.com/en-us/library/windows/hardware/mt703369%28v=vs.85%29.aspx) + diff --git a/education/windows/teacher-get-minecraft.md b/education/windows/teacher-get-minecraft.md index f3fa5252e5..f76ec8535d 100644 --- a/education/windows/teacher-get-minecraft.md +++ b/education/windows/teacher-get-minecraft.md @@ -1,5 +1,5 @@ --- -title: For teachers: get Minecraft: Education Edition +title: For teachers get Minecraft Education Edition description: Learn how teachers can get and distribute Minecraft. keywords: ["school"] ms.prod: W10 @@ -9,6 +9,7 @@ author: jdeckerMS --- # For teachers: get Minecraft: Education Edition + **Applies to:** - Windows 10 @@ -18,4 +19,13 @@ author: jdeckerMS Teachers -![Click Get the app](images/teacher-get-app.png) \ No newline at end of file +![Click Get the app](images/teacher-get-app.png) + +![Enter school email address](images/enter-email.png) + +![You can get the app now](images/get-the-app.png) + + + + + From b3227046e30ed5a32c2150fc501391a3587fafd4 Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Thu, 19 May 2016 12:11:02 -0700 Subject: [PATCH 341/439] update notes --- windows/plan/deploy-windows-10-in-a-school.md | 52 +++++++++---------- 1 file changed, 25 insertions(+), 27 deletions(-) diff --git a/windows/plan/deploy-windows-10-in-a-school.md b/windows/plan/deploy-windows-10-in-a-school.md index 53a866f3b8..f1ba01d1a5 100644 --- a/windows/plan/deploy-windows-10-in-a-school.md +++ b/windows/plan/deploy-windows-10-in-a-school.md @@ -49,8 +49,7 @@ This school configuration has the following characteristics: - You install the Windows Assessment and Deployment Kit (Windows ADK) on the admin device. - You install the Windows Assessment and Deployment Kit (Windows ADK) on the admin device. - You install the 64-bit version of the Microsoft Deployment Toolkit (MDT) 2013 Update 2 on the admin device. - - **Note**  In this guide, all references to MDT refer to the 64-bit version of MDT 2013 Update 2. +>**Note:**  In this guide, all references to MDT refer to the 64-bit version of MDT 2013 Update 2. - The devices use Azure AD in Office 365 Education for identity management. - If you have on-premises AD DS, you can [integrate Azure AD with on-premises AD DS](http://azure.microsoft.com/en-us/documentation/articles/active-directory-aadconnect/). - Use [Intune](http://technet.microsoft.com/library/jj676587.aspx), [compliance settings in Office 365](https://support.office.com/en-us/article/Manage-mobile-devices-in-Office-365-dd892318-bc44-4eb1-af00-9db5430be3cd?ui=en-US&rs=en-US&ad=US), or [Group Policy](http://technet.microsoft.com/en-us/library/cc725828%28v=ws.10%29.aspx?f=255&MSPPError=-2147217396) in AD DS to manage devices. @@ -140,7 +139,7 @@ Next, install MDT. MDT uses the Windows ADK to help you manage and perform Windo You can use MDT to deploy 32-bit or 64-bit versions of Windows 10. Install the 64-bit version of MDT to support deployment of 32-bit and 64-bit operating systems. -**Note**  If you install the 32-bit version of MDT, you can install only 32-bit versions of Windows 10. Ensure that you download and install the 64-bit version of MDT so that you can install 64-bit and 32 bit versions of the operating system. +>**Note:**  If you install the 32-bit version of MDT, you can install only 32-bit versions of Windows 10. Ensure that you download and install the 64-bit version of MDT so that you can install 64-bit and 32 bit versions of the operating system. For more information about installing MDT on the admin device, see [Installing a New Instance of MDT](https://technet.microsoft.com/en-us/library/dn759415.aspx#InstallingaNewInstanceofMDT). @@ -225,13 +224,13 @@ You will use the Office 365 Education license plan information you record in Tab To create a new Office 365 Education subscription for use in the classroom, use your educational institution’s email account. There are no costs to you or to students for signing up for Office 365 Education subscriptions. -**Note**  If you already have an Office 365 Education subscription, you can use that subscription and continue to the next section, [Add domains and subdomains](#add-domains-and-subdomains). +>**Note:**  If you already have an Office 365 Education subscription, you can use that subscription and continue to the next section, [Add domains and subdomains](#add-domains-and-subdomains). #### To create a new Office 365 subscription 1. In Microsoft Edge or Internet Explorer, type `https://portal.office.com/start?sku=faculty` in the address bar. - **Note**  If you have already used your current sign-in account to create a new Office 365 subscription, you will be prompted to sign in. If you want to create a new Office 365 subscription, start an In-Private Window in one of the following: + >**Note**  If you have already used your current sign-in account to create a new Office 365 subscription, you will be prompted to sign in. If you want to create a new Office 365 subscription, start an In-Private Window in one of the following:
      - Microsoft Edge by opening the Microsoft Edge app, either pressing Ctrl+Shift+P or clicking or tapping **More actions**, and then clicking or tapping **New InPrivate window**. - Internet Explorer 11 by opening Internet Explorer 11, either pressing Ctrl+Shift+P or clicking or tapping **Settings**, clicking or tapping **Safety**, and then clicking or tapping **InPrivate Browsing**. @@ -256,7 +255,7 @@ Now that you have created your new Office 365 Education subscription, add the do To make it easier for faculty and students to join your Office 365 Education subscription (or *tenant*), allow them to automatically sign up to your tenant (*automatic tenant join*). In automatic tenant join, when a faculty member or student signs up for Office 365, Office 365 automatically adds (joins) the user to your Office 365 tenant. -**Note**  By default, automatic tenant join is enabled in Office 365 Education, with the exception of certain areas in Europe, the Middle East, and Africa. These countries require opt-in steps to add new users to existing Office 365 tenants. Check your country requirements to determine the automatic tenant join default configuration. Also, if you use Azure AD Connect, then automatic tenant join is disabled. +>**Note:**  By default, automatic tenant join is enabled in Office 365 Education, with the exception of certain areas in Europe, the Middle East, and Africa. These countries require opt-in steps to add new users to existing Office 365 tenants. Check your country requirements to determine the automatic tenant join default configuration. Also, if you use Azure AD Connect, then automatic tenant join is disabled. Office 365 uses the domain portion of the user’s email address to know which Office 365 tenant to join. For example, if a faculty member or student provides an email address of user@contoso.edu, then Office 365 automatically performs one of the following tasks: @@ -265,7 +264,7 @@ Office 365 uses the domain portion of the user’s email address to know which O You will always want faculty and students to join the Office 365 tenant that you created. Ensure that you perform the steps in the [Create a new Office 365 Education subscription](#create-a-new-office-365-education-subscription) and [Add domains and subdomains](#add-domains-and-subdomains) sections before allowing other faculty and students to join Office 365. -**Note**  You cannot merge multiple tenants, so any faculty or students who create their own tenant will need to abandon their existing tenant and join yours. +>**Note:**  You cannot merge multiple tenants, so any faculty or students who create their own tenant will need to abandon their existing tenant and join yours. All new Office 365 Education subscriptions have automatic tenant join enabled by default, but you can enable or disable automatic tenant join by using the Windows PowerShell commands in Table 3. For more information about how to run these commands, see [How can I prevent students from joining my existing Office 365 tenant](https://support.office.com/en-us/article/Office-365-Education-Self-Sign-up-Technical-FAQ-7fb1b2f9-94c2-4cbb-b01e-a6eca34261d6?ui=en-US&rs=en-US&ad=US#BKMK_PreventJoins). @@ -277,13 +276,13 @@ All new Office 365 Education subscriptions have automatic tenant join enabled by | Enable |`Set-MsolCompanySettings -AllowEmailVerifiedUsers $true`| | Disable |`Set-MsolCompanySettings -AllowEmailVerifiedUsers $false`|

      -**Note**  If your institution has AD DS, then disable automatic tenant join. Instead, use Azure AD integration with AD DS to add users to your Office 365 tenant. +>**Note:**  If your institution has AD DS, then disable automatic tenant join. Instead, use Azure AD integration with AD DS to add users to your Office 365 tenant. ### Disable automatic licensing To reduce your administrative effort, automatically assign Office 365 Education or Office 365 Education Plus licenses to faculty and students when they sign up (automatic licensing). Automatic licensing also enables Office 365 Education or Office 365 Education Plus features that do not require administrative approval. -**Note**  By default, automatic licensing is enabled in Office 365 Education. If you want to use automatic licensing, then skip this section and go to the next section. +>**Note:**  By default, automatic licensing is enabled in Office 365 Education. If you want to use automatic licensing, then skip this section and go to the next section. Although all new Office 365 Education subscriptions have automatic licensing enabled by default, you can enable or disable it for your Office 365 tenant by using the Windows PowerShell commands in Table 4. For more information about how to run these commands, see [How can I prevent students from joining my existing Office 365 tenant](https://support.office.com/en-us/article/Office-365-Education-Self-Sign-up-Technical-FAQ-7fb1b2f9-94c2-4cbb-b01e-a6eca34261d6?ui=en-US&rs=en-US&ad=US#BKMK_PreventJoins). @@ -336,7 +335,7 @@ Now that you have an Office 365 subscription, you need to determine how you will In this method, you have an on-premises AD DS domain. As shown in Figure 4, the Azure AD Connector tool automatically synchronizes AD DS with Azure AD. When you add or change any user accounts in AD DS, the Azure AD Connector tool automatically updates Azure AD. -**Note**  Azure AD Connect also supports synchronization from any Lightweight Directory Access Protocol version 3 (LDAPv3)–compliant directory by using the information provided in [Generic LDAP Connector for FIM 2010 R2 Technical Reference](https://technet.microsoft.com/en-us/library/dn510997.aspx?f=255&MSPPError=-2147217396). +>**Note:**  Azure AD Connect also supports synchronization from any Lightweight Directory Access Protocol version 3 (LDAPv3)–compliant directory by using the information provided in [Generic LDAP Connector for FIM 2010 R2 Technical Reference](https://technet.microsoft.com/en-us/library/dn510997.aspx?f=255&MSPPError=-2147217396). ![fig 4](images/deploy-win-10-school-figure4.png) @@ -365,7 +364,7 @@ In this section, you selected the method for creating user accounts in your Offi You can integrate your on-premises AD DS domain with Azure AD to provide identity management for your Office 365 tenant. With this integration, you can synchronize the users, security groups, and distribution lists in your AD DS domain with Azure AD with the Azure AD Connect tool. Users will be able to sign in to Office 365 automatically by using their email account and the same password they use to sign in to AD DS. -**Note**  If your institution does not have an on-premises AD DS domain, you can skip this section. +>**Note:**  If your institution does not have an on-premises AD DS domain, you can skip this section. ### Select synchronization model @@ -426,7 +425,7 @@ In this section, you selected your synchronization model, deployed Azure AD Conn You can bulk-import user and group accounts into your on-premises AD DS domain. Bulk-importing accounts helps reduce the time and effort needed to create users compared to creating the accounts manually in the Office 365 Admin portal. First, you select the appropriate method for bulk-importing user accounts into AD DS. Next, you create the .csv file that contains the user accounts. Finally, you use the selected method to import the .csv file into AD DS. -**Note**  If your institution doesn’t have an on-premises AD DS domain, you can skip this section. +>**Note:**  If your institution doesn’t have an on-premises AD DS domain, you can skip this section. ### Select the bulk import method @@ -456,7 +455,7 @@ After you have selected your user and group account bulk import method, you’re With the bulk-import source file finished, you’re ready to import the user and group accounts into AD DS. The steps for importing the file are slightly different for each method. -**Note**  Bulk-import your group accounts first, and then import your user accounts. Importing in this order allows you to specify group membership when you import your user accounts. +>**Note:**  Bulk-import your group accounts first, and then import your user accounts. Importing in this order allows you to specify group membership when you import your user accounts. For more information about how to import user accounts into AD DS by using: @@ -482,7 +481,7 @@ The bulk-add process assigns the same Office 365 Education license plan to all u For more information about how to bulk-add users to Office 365, see [Add several users at the same time to Office 365](https://support.office.com/en-us/article/Add-several-users-at-the-same-time-to-Office-365-Admin-Help-1f5767ed-e717-4f24-969c-6ea9d412ca88?ui=en-US&rs=en-US&ad=US). -**Note**  If you encountered errors during bulk add, resolve them before you continue the bulk-add process. You can view the log file to see which users caused the errors, and then modify the .csv file to correct the problems. Click **Back** to retry the verification process. +>**Note:**  If you encountered errors during bulk add, resolve them before you continue the bulk-add process. You can view the log file to see which users caused the errors, and then modify the .csv file to correct the problems. Click **Back** to retry the verification process. The email accounts are assigned temporary passwords upon creation. You must communicate these temporary passwords to your users before they can sign in to Office 365. @@ -490,13 +489,13 @@ The email accounts are assigned temporary passwords upon creation. You must comm Assign SharePoint Online resource permissions to Office 365 security groups, not individual user accounts. For example, create one security group for faculty members and another for students. Then, you can assign unique SharePoint Online resource permissions to faculty members and a different set of permissions to students. Add or remove users from the security groups to grant or revoke access to SharePoint Online resources. -**Note**  If your institution has AD DS, don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Azure AD integration to synchronize the security groups with your Office 365 tenant. +>**Note:**  If your institution has AD DS, don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Azure AD integration to synchronize the security groups with your Office 365 tenant. For information about creating security groups, see [Create and manage Office 365 groups in Admin Center Preview](https://support.office.com/en-us/article/Create-and-manage-Office-365-groups-in-Admin-Center-Preview-93df5bd4-74c4-45e8-9625-56db92865a6e?ui=en-US&rs=en-US&ad=US). You can add and remove users from security groups at any time. -**Note**  Office 365 evaluates group membership when users sign in. If you change group membership for a user, that user may need to sign out, and then sign in again for the change to take effect. +>**Note:**  Office 365 evaluates group membership when users sign in. If you change group membership for a user, that user may need to sign out, and then sign in again for the change to take effect. ### Create email distribution groups @@ -504,7 +503,7 @@ Microsoft Exchange Online uses an email distribution group as a single email rec You can create email distribution groups based on job role (such as teachers, administration, or students) or specific interests (such as robotics, drama club, or soccer team). You can create any number of distribution groups, and users can be members of more than one group. -**Note**  Office 365 can take some time to complete the Exchange Online creation process. You will have to wait until Office 365 completes the Exchange Online creation process before you can perform the following steps. +>**Note:**  Office 365 can take some time to complete the Exchange Online creation process. You will have to wait until Office 365 completes the Exchange Online creation process before you can perform the following steps. For information about how to create security groups, see [Create and manage Office 365 groups in Admin Center Preview](https://support.office.com/en-us/article/Create-and-manage-Office-365-groups-in-Admin-Center-Preview-93df5bd4-74c4-45e8-9625-56db92865a6e?ui=en-US&rs=en-US&ad=US). @@ -542,7 +541,8 @@ To create and configure your Windows Store for Business portal, simply use the a #### To create and configure a Windows Store for Business portal 1. In Microsoft Edge or Internet Explorer, type `http://microsoft.com/business-store` in the address bar. -2. On the **Windows Store for Business** page, click **Sign in with an organizational account**.

      **Note**  If your institution has AD DS, then don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Azure AD integration to synchronize the security groups with your Office 365 tenant. +2. On the **Windows Store for Business** page, click **Sign in with an organizational account**. +>**Note:**  If your institution has AD DS, then don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Azure AD integration to synchronize the security groups with your Office 365 tenant. 3. On the Windows Store for Business sign-in page, use the administrative account for the Office 365 subscription you created in the [Create a new Office 365 Education subscription](#create-a-new-office-365-education-subscription) section to sign in. 4. On the **Windows Store for Business Services Agreement** page, review the agreement, select the **I accept this agreement and certify that I have the authority to bind my organization to its terms** check box, and then click **Accept** 5. In the **Welcome to the Windows Store for Business** dialog box, click **OK**. @@ -565,7 +565,7 @@ After you create the Windows Store for Business portal, configure it by using th Now that you have created your Windows Store for Business portal, you’re ready to find, acquire, and distribute apps that you will add to your portal. You do this by using the Inventory page in Windows Store for Business. -**Note**  Your educational institution can now use a credit card or purchase order to pay for apps in Windows Store for Business. +>**Note:**  Your educational institution can now use a credit card or purchase order to pay for apps in Windows Store for Business. You can deploy apps to individual users or make apps available to users through your private store. Deploying apps to individual users restricts the app to those specified users. Making apps available through your private store allows all your users. @@ -596,11 +596,11 @@ Depending on your school’s requirements, you may need any combination of the f - Upgrade institution-owned devices to Windows 10 Education. - Deploy new instances of Windows 10 Education so that new devices have a known configuration. -**Note**  Although you can use Windows 10 Home on institution-owned devices, Microsoft recommends that you use Windows 10 Pro or Windows 10 Education, instead. Windows 10 Pro and Windows 10 Education provide support for MDM, policy-based management, and Windows Store for Business. These features are not available in Windows 10 Home. +>**Note:**  Although you can use Windows 10 Home on institution-owned devices, Microsoft recommends that you use Windows 10 Pro or Windows 10 Education, instead. Windows 10 Pro and Windows 10 Education provide support for MDM, policy-based management, and Windows Store for Business. These features are not available in Windows 10 Home. One other consideration is the mix of processor architectures you will support. If you can, support only 64-bit versions of Windows 10. If you have devices that can run only 32 bit versions of Windows 10, you will need to import both 64-bit and 32-bit versions of the Windows 10 editions listed above. -**Note**  On devices that have minimal system resources (such as devices with only 2 GB of memory or 32 GB of storage), use 32-bit versions of Windows 10 because 64-bit versions of Windows 10 place more stress on device system resources. +>**Note:**  On devices that have minimal system resources (such as devices with only 2 GB of memory or 32 GB of storage), use 32-bit versions of Windows 10 because 64-bit versions of Windows 10 place more stress on device system resources. Finally, as a best practice, minimize the number of operating systems that you deploy and manage. If possible, standardize institution-owned devices on one Windows 10 edition (such as a 64-bit version of Windows 10 Education or Windows 10 Pro). Of course, you cannot standardize personal devices on a specific operating system version or processor architecture. @@ -738,9 +738,7 @@ In addition, you must prepare your environment for sideloading (deploying) Windo To help reduce the effort needed to deploy Microsoft Office 2016 desktop apps, use the Office Deployment Tool, as described in [Deploy Click-to-Run for Office 365 products by using the Office Deployment Tool](https://technet.microsoft.com/en-us/library/jj219423.aspx?f=255&MSPPError=-2147217396).

      -If you have Intune, you can deploy Windows desktop apps after you deploy Windows 10, as described in the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section. This method provides granular deployment of Windows desktop apps, and you can use it for ongoing management of the apps. This is the preferred method for deploying and managing Windows desktop apps.

      - -**Note**  You can also deploy Windows desktop apps after you deploy Windows 10, as described in the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section.

      +If you have Intune, you can deploy Windows desktop apps after you deploy Windows 10, as described in the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section. This method provides granular deployment of Windows desktop apps, and you can use it for ongoing management of the apps. This is the preferred method for deploying and managing Windows desktop apps.

      **Note:**  You can also deploy Windows desktop apps after you deploy Windows 10, as described in the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section.

      For more information about how to create an MDT application for Window desktop apps, see [Create a New Application in the Deployment Workbench](https://technet.microsoft.com/en-us/library/dn759415.aspx#CreateaNewApplicationintheDeploymentWorkbench). @@ -897,7 +895,7 @@ Microsoft has several recommended settings for educational institutions. Table 1 Use of Microsoft accounts You want faculty and students to use only Azure AD accounts for institution-owned devices. For these devices, do not use Microsoft accounts or associate a Microsoft account with the Azure AD accounts.

      -**Note**  Personal devices typically use Microsoft accounts. Faculty and students can associate their Microsoft account with their Azure AD account on these devices.

      +**Note:**  Personal devices typically use Microsoft accounts. Faculty and students can associate their Microsoft account with their Azure AD account on these devices.

      **Group Policy.** Configure the [Accounts: Block Microsoft accounts](https://technet.microsoft.com/en-us/library/jj966262.aspx?f=255&MSPPError=-2147217396) Group Policy setting to use the Users can’t add Microsoft accounts setting option.

      **Intune.** Enable or disable the camera by using the **Allow Microsoft account**, **Allow adding non-Microsoft accounts manually**, and **Allow settings synchronization for Microsoft accounts** policy settings under the **Accounts and Synchronization** section of a **Windows 10 General Configuration** policy. @@ -1042,7 +1040,7 @@ Prior to deployment of Windows 10, ensure that you complete the tasks listed in Use the Deployment Wizard to deploy Windows 10. The LTI deployment process is almost fully automated: You provide only minimal information to the Deployment Wizard at the beginning of the process. After the wizard collects the necessary information, the remainder of the process is fully automated. -**Note**  To fully automate the LTI deployment process, complete the steps in the “Fully Automated LTI Deployment Scenario” section in the [Microsoft Deployment Toolkit Samples Guide](https://technet.microsoft.com/en-us/library/dn781089.aspx). +>**Note:**  To fully automate the LTI deployment process, complete the steps in the “Fully Automated LTI Deployment Scenario” section in the [Microsoft Deployment Toolkit Samples Guide](https://technet.microsoft.com/en-us/library/dn781089.aspx). In most instances, deployments occur without incident. Only in rare occasions do deployments experience problems. @@ -1055,7 +1053,7 @@ In most instances, deployments occur without incident. Only in rare occasions do After you have deployed Windows 10, the devices are almost ready for use. First, you must set up the printers that each classroom will use. Typically, you connect the printers to the same network as the devices in the same classroom. If you don’t have printers in your classrooms, skip this section and proceed to the [Verify deployment](#verify-deployment) section. -**Note**  If you’re performing an upgrade instead of a new deployment, the printers remain configured as they were in the previous version of Windows. As a result, you can skip this section and proceed to the [Verify deployment](#verify-deployment) section. +>**Note:**  If you’re performing an upgrade instead of a new deployment, the printers remain configured as they were in the previous version of Windows. As a result, you can skip this section and proceed to the [Verify deployment](#verify-deployment) section. #### To set up printers From e008b3711443e3ec0c928f456753628491c89b25 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 19 May 2016 12:16:16 -0700 Subject: [PATCH 342/439] will another commit get tnstage working again? --- education/windows/TOC.md | 6 +-- .../windows/get-minecraft-for-education.md | 14 +++--- .../images/app-distribution-options.PNG | Bin 0 -> 37125 bytes education/windows/images/get-app-store.png | Bin 0 -> 144683 bytes education/windows/school-get-minecraft.md | 14 +++++- education/windows/teacher-get-minecraft.md | 45 ++++++++++++++---- 6 files changed, 60 insertions(+), 19 deletions(-) create mode 100644 education/windows/images/app-distribution-options.PNG create mode 100644 education/windows/images/get-app-store.png diff --git a/education/windows/TOC.md b/education/windows/TOC.md index 3d85abd08b..6708148826 100644 --- a/education/windows/TOC.md +++ b/education/windows/TOC.md @@ -2,9 +2,9 @@ ## [Use the Set up School PCs app](use-set-up-school-pcs-app.md) ## [Set up School PCs app technical reference](set-up-school-pcs-technical.md) ## [Set up students' PCs to join domain](set-up-students-pcs-to-join-domain.md) -## [Get Minecraft: Education Edition](get-minecraft-for-education.md) -### [For teachers: get Minecraft: Education Edition](teacher-get-minecraft.md) -### [For IT admins: get Minecraft: Education Edition](school-get-minecraft.md) +## [Get Minecraft Education Edition](get-minecraft-for-education.md) +### [For teachers: get Minecraft Education Edition](teacher-get-minecraft.md) +### [For IT admins: get Minecraft Education Edition](school-get-minecraft.md) ## [Take tests in Windows 10](take-tests-in-windows-10.md) ### [Set up Take a Test on a single PC](take-a-test-single-pc.md) ### [Set up Take a Test on multiple PCs](take-a-test-multiple-pcs.md) diff --git a/education/windows/get-minecraft-for-education.md b/education/windows/get-minecraft-for-education.md index ffa0781017..7ab224be49 100644 --- a/education/windows/get-minecraft-for-education.md +++ b/education/windows/get-minecraft-for-education.md @@ -8,7 +8,7 @@ ms.sitesec: library author: jdeckerMS --- -# Get Minecraft: Education Edition +# Get Minecraft Education Edition **Applies to:** @@ -19,24 +19,24 @@ author: jdeckerMS [Minecraft: Education Edition](http://education.minecraft.net/) is built for learning. (need more marketing blurb here?) -Teachers and IT administrators can now get early access to **Minecraft: Education Edition**. +Teachers and IT administrators can now get early access to **Minecraft Education Edition** and add it their Microsoft Store for Business for distribution. ![education.minecraft.net](images/minecraft.png) ## Prerequisites -- **Minecraft: Education Edition** requires Windows 10. -- Early access to **Minecraft: Education Edition** is offered to education tenants that are managed by Azure Active Directory (Azure AD). - - If your school doesn't have an Azure AD tenant, the [IT administrator can set one up](school-get-minecraft.md) as part of the process of getting **Minecraft: Education Edition**. +- **Minecraft Education Edition** requires Windows 10. +- Early access to **Minecraft Education Edition** is offered to education tenants that are managed by Azure Active Directory (Azure AD). + - If your school doesn't have an Azure AD tenant, the [IT administrator can set one up](school-get-minecraft.md) as part of the process of getting **Minecraft Education Edition**. * Office 365, which includes online versions of Office apps plus 1 TB online storage and [Microsoft Classroom](https://classroom.microsoft.com/), is free for teachers and students. [Sign up your school for Office 365 Education.](https://products.office.com/en-us/academic/office-365-education-plan) * If your school has an Office 365 Education subscription, it includes a free Azure AD subscription. [Register your free Azure AD subscription.](https://msdn.microsoft.com/en-us/library/windows/hardware/mt703369%28v=vs.85%29.aspx) ![teacher](images/teacher.png) -[Learn how teachers can get and distribute **Minecraft: Education Edition**](teacher-get-minecraft.md) +[Learn how teachers can get and distribute **Minecraft Education Edition**](teacher-get-minecraft.md) ![IT administrator](images/school.png) -[Learn how IT administrators can get and distribute **Minecraft: Education Edition**](school-get-minecraft.md), and how to manage permissions for Minecraft. +[Learn how IT administrators can get and distribute **Minecraft Education Edition**](school-get-minecraft.md), and how to manage permissions for Minecraft. diff --git a/education/windows/images/app-distribution-options.PNG b/education/windows/images/app-distribution-options.PNG new file mode 100644 index 0000000000000000000000000000000000000000..75b3374720f1e9ce44691e561cf0e48bde69811c GIT binary patch literal 37125 zcmd3t)mvN77w(Z3*HSFFI~0fD1cw5pxI4wY#idZB5L}A8yGxN`AwY|}yGsdB2zv7U z{Q>9dT%3y}v!5q<_Uy@;nYBLeJJFizinv$+EF>f(TxBIWEhHr5Sw#B^0}b&m1wYV5 zd?0&jDas<%j#C~XE?(Kmyq7^jYKX^vw0MoU#&lCM@I*qw8~pEuoXUYmfrONhsVpa> z?PGeDgC1fcKQ}ya-V?Z@>UR-N@J8z}oL)Y$lwSUo{16t&^+!U@)9)x){~`(tX}^A_ z$D-HqQw<@IrR`2XJ3DjyxdG34U>0A%W!!zOB=WL*-u>nLcLx8}dCp5VzvltTn#UMd zcMK^{8Vu&)E@B#Ucy^ZRB*Y;vFW*5BIk2?|oD51yNjaVTSM>9z(dQLsVYd4%{NP3Z z^Nxejzgq)bR*^d`uc*JOF*A%<^O0`5iBPUYG&b@@4_S(Z?|dqnuQTJ3y6eL)J{;w! zJAIl??_nH>!1a{%?qZ&rnXw8#CaFZ+ME92?frGodJ9lw?zR7aEMOeU@qgk>g%ZFh{ zs@0+%_*L`?16WW7Zw@gj?m{x1!mIZSUOJG1ULO)aLlU0VE8 zrZ{!4sSv-ivKy*WFE@H{(foAyW%j3B9WyJ%1z&fj4L0!ZXD(jkz$HxcFG+x74du4i z=g%reMk~5QWd#SXU((V@jP~sn8B(kqy;e*$Tjl8Kz+iA|a7S^g1Tfi7PcPle%d3mt z=CcT8oC)r0hS|x4GA%ZS*Yl>YkGu?*S5}-Syp;&)ZB_zr*KF>uk6N24w`ie9*wZtI z6PbdlX!z7l@DKtisXsAPkynp90r_7h<8hPdaGqF6JJDW|2iiD0>mzxf;{q5JseOxM z0fM9Bee=*wkwY|cG_BnL)yo0jXI>7%OaIe`Vd|{lcsGeb%tIb=DbDa)i7)^4iTrho zCf#_lI#79B^1;b5#eOjokBZ&w=~&OEKOFNj9%0bk08N@zoT$S3zt*-9bjiP=f55^a z0%6}s`rW=+rt0eIjU@p?uh{r=w1=p9)MZ0#bb4H59ewO01I-tz{0Zky8Zec@g< zvu9X3m$Rc|m2;Mmb5cYE8Uu0E+s0qS-#PzTWE0Ydz7ld-{bc0ndA0v;7ipTFLx1@F z`}YcmgLE|0GC8 zn}`ob`y#YE;Tseb{*lB>hWX}lzO6^+`KB&-sWVwdYPx{`e(PM}vztFr1SL%3ynW|) z=hKPVivtzXyxl&w>>yJ-(s6Wi@zxJP)(XARFPB54VV1W>zJo+>t zwK!o4@9gVd{w*2FOH}3F>HN6+!rpp4>{Zk{ra(%(;W5P#qjgwX-6|sVY<-=1KE0!h zwThR})vYyVyIuQ|7x1qsuVrF+l3>Ga0GH2Z^sVS#%E#UB9JL7*AIkuVlWx72VAtjd z%9GT)D!sZ^H|VRX+i)WFciT%}HUjsgUf}WKe}AF!dF(2|7l$QnNgPc~a(?HCEmV(n z|65i~<210`{k)%HH~O8Jqxw?nX7(f4m^Sma>p;SmDS3Fg#gPlgQuO(5XYUs(zJTi4 zypd}v{OTYJ4=M`ZO$Pf+;=&&;dV5FcBwyV;UQJ}FD^hu<9Qi`&A~C#GMUS*8KQCG| z2EaYWA|LA`qT^%9`EB*7WH)ye%U+p4V#%#M=tPu=44`F%rY#P0`#h}XXD<&MFG8}# zAH#<35u4YC-@UoYds&5AEjQbj z(#(_MauwqkB>$s%xr|7?6^Dr`1GSf8hWP@e4nhAE4~E%o8J3al8EUY!d)DQ zn5fmBzXXlz^-l`8zYaxm9>0czB5-)AqOPXmgJ!*+NA-Fvb;Wfz6eVGVo*+-0KKEp# z>mr7x+jV~mndgm{r@RgboJtb0IT&`!MCi}z*QVsCf1Q$uXV90IfM)FJ zW8QrV)s+!!WvT-tW&NrS%R>~eaiAr^OgaiAl3$CtV~W@5aqcGanG#E-{2Iw8q2X;q zF|7u`j`Jgc8qlDe%$&iIibkypmRR_->Q>RSLv@jW7`Yh*Nqyabs?>KFSdAefv^BSg zzV2%c^7ZRrkq10q<)tH5@r)}RXnDLlBZj+uZ(>(u0AH(1N1&fF!y9(Ejm%RTJgS|BA_K|zFY{BG9P9iOs zTuzB>9xzX{tE;19leTgZbSvh2e^geZcKE*I2*-TwLu3l-o8q|V#{;P>Vij`Kk){t5 z=rjTKguDkS(H@o=TIhW(Q95!|mS>)7zU4;8U`Qrk#70u5=t*@`wP{1^(cq+gUya&9 zcwE2eLAKQ^m7@0|x#3lHJ{@0dOa)+3<>&Ia*f^qL@clDy* zgDjjJUfX1EeldZKG2WhJ`#{Sik!~c-e<5`oS61yJ;y{p;?-djx_ij|7n=aXpnM*D* zhK%p!NF&(61`Ai{GV%R@nrKC`G(Z3<@TgyUILycj2|Riyy)V2G&@}h(n$+0*<~=BG zC@x!XK=x}FD?d<1_Yu!43gcy$Mao`osQ#6UKd19?*!_SilED@v=qhW&iHg;D=W%}H ze!i`m!TXQkf-7T&7T9w$FKl7Z;ZnPmTz{48`BfEVjrmD3a-i^>yYKgd@=* zaS8)i03y}$040oc2p*N2jO-l&6Sn~;7eMb9b$_Jv2>PuzEdhjh3Y|W3mW12*6PT4={^N^%nX@YwvkbRVMIVT>N@U=u>~-mmRQh=Ii)aQU>nhn7c=60?}K#T|7sONB~eNW(jbjO~Ui85Fye~j4@0V?X6^*0``Jh z#WRJ(q?{yhk}%^kbj}=_Pc8JE)>e~08gveDcqg~f?;R++mOVE3Z#G4?vY zhF$tNsTyv3TomwFmFoNGr>+{cS9B=YeZy33uj}ZoKO~De5VoQG0krsm5`%w%)yt71 z2Bd2rY50{v6T%54?T@gAgFDdMig~=h6aRKY&Y_0*jKp7>oNw6W1Ua~GMip@jM4uS!{T~4I-%ut* zjr;30WiW|p!*Iwvi`+{K4zkg*F?j?kokA4SWG(4rlLW{JNWm;e_W6m5;sDoa8H_Qh??76mk*@0pUVIm=i!lC@Q8t zp9ntnE+Qhv&zu2&^p~JDx^yR0A=vu$6DCU#ZNTXF@xEgWY3>{O9>gD?9P!A8zhzuT zX{@Lr-Hig1XBk%>^MBsrMay|})So%DE(QyE=mc&2y-D6nCN z!8eNNt6l96?kf>^EG;Zq@ZF?&VPYUc8;PIb}C z51%_Q*+J9B>2G;`c^NMci{b(BUO+BNnemr=^2i4VA%3F$fd6=QN>n2@z$zCSz`Ph{=BryNqR-B#TvsLmpALKzs>o9!H0oEG4R4Dz* zq;W@b(zW6ulvg1zJOTTu_-0CwIZp{k=j4=(B)*vaWMmwUM+K-q!#t7`h#JmM4Za!K zZ1xC(jhN0H5}iJl>aZ*8@^cJ&;XtGc7!Cr=3nZCnNH4qx!7 zZ=3|SJ&J6J&^+ZFM1H#>NDHR!|NPqgY#MI;n9O@ZC0~lP^!qiGMZMZiX?0|F%je7@ zk`Mu85EQ45MFg=;BT&c(r2kiqw-+j7{i2^G?w*d^M6g1s*3uUFs-&JT&~8bXkI?$1$c;)RPN4JP-b<=K$w=_72^;=0m(k z%U15hlMoNtMfvv|tK?Q|QMGmtsLO4uKT6YXJllRl-wVOP@*_KndTb66>3*Pj#yOPk zz2yE2B6U=mLe$LjF`}p8$B03~8*W9Fwb6IrFWA<-x@7wwnrfxi?`cn_(+Z{Xo{qNA1+c?Zrn!8@{R$?$-U9d(e zO{#-JjP(7esw!uo2ulz%$oS8%@oS68UMBgW$~x-nuxusN#_tbY+5QNb zNhe;v9d@G0u@^{P1R-B(R%fK8U61H%G%bZGrDn>9#Edzs&HNUrjLz4L6 zlCCaeAP{){eC9jk<=+6r1v&UnyHTrV4JSr}8f`+Og(aIyAP~tD+v#^kwHyR8jq+vcuLu zvM1G>wNqr$+=jmThUkMgJ6CdJpB255lO|&pb%UCAZG43_Dy_ydTQ}a zXJ_ZN*+z_9LOHa62 zRaJ3xS~?}cPWP5SV z8&z@auW+~CwDTXpEW^^a7MnVY_1*WCV%D`9LMw&4mQ)))3!m;!gr{5F3!^6WmPM;q z*A5)6(WAw&OJ0e;GX>Okh?RFb=R8&qg4sXf1;#LnwXIeKvHi80-kf=7>elyKAtm@> zWutm4l=W&af+iR3h(8Y=%c);4jUbo3WYHe{zY)mz^G4to?6MDjOf_j|@}J68RaN&u zH1`R{fj4s`&(F8LWF&=G5*!t1evs>5`}j9fDy0`eEn%%~-OiCG5t8D)PU&Vr z9ghf#^vDC-0p0{Y-7JhPHdwuseH`}Y{BV37#SoVeA9!j7t8oof)vYt-at%B&vRUu) zB|(qL3OvL}L?0ZvXbXDs%Mfud47i`kYi)*8aYgRzh4^z3uwOTruCGv9bGfW^ zV5=)ngdH2QRn?}etTm<1%{ml)vjw`jsJ{Hb9#7(xL3jj~%YnpO}=Lud(TjAX`phhVc z!4Nghhad##9bxNS-3bKd zvtpPra_ye01zEQv_dcDu8g(2WA3rOit)w9-OI`iuw?&>?STH(39bys5A$ONMdu38j6@+XH@U@Mr+*>F@EZ}er*rBLNCZ5#OU4%_- z+&ns~=J%8*E7Anco-ZKQh^yXX&&7HR-2*t^{pc?6KC+XF&pIk~FUIV#FvqA&S4@=D z)Tcl#OX$ybqyQ>9UP^q>brGyoxceyh8VA1X8aQQ^T`x+x^1eK3(=5?2N)r_SJY}cA zCD%P75dJ5w14`3!EyBY--Cfd#%}85n(CYWakl=h5+EnR(wXnY%E)rfY7`>-lnusRg z);Tf6LMmW^BXmeu5-WH8DMau)faaFdz6k6XMd!_}I%*GtvLuBix0R(k%=)~|ecF$K zHt@5}cUQb+l&d7cY5#i&2eG%ikQ;p!zmgHB_Wv~{keX_-L#Da zCcq^+ic;M9?fdC3j3UuZJ$I0f+a9)qG@eMh-7xiT*)@NGRdF)QsuhvkQo)oJecI7- z{m(^DC{Md@*Gcd`5RiVw#pq0o*wM^=mKGPP&RlW%`KOxQdJQqrS_^2r0bX(})@V;C zUxQASiM;SPMN-;aMeOhA^`ZtOU)tybgSv_0bXqNkuujyFw#|pmeqQwGQg0umhX%5u z^NolZqr!a~4-BJJJ0IJPWZmG;2+brR7!gygA9~wXJ;rQF0}}==h;}`3+DW8WH3E-6 z!dmJA-y0els+qMq)^^zPcO+38gwGrS_kURZmR~i?kbUgAeLcJ-jAD%Mes!{Xc`uKQ zp+h5Wg}-*%yMEZ&wqoM??ryU7O}^3FTK_eAl|6?=`C)=gldY7$Pxwl`R(EUkIgSVAp#$GqTUv zKxafFQnY3aCgM^t5SjGpg8y+98cU8yij)Y6%s~%^!}eeZdcE?)6bX!sh{P}f0RjCY zkX7Q8LK=ijRBiXywACsY?X@f(E;R*Tzle*KRnZU=?xifHkoC@Y25K-3OoTZb^5dPc z7u1r*xcN{TII0BL{y+`G@N)x$$NNg(XK_+{h(av!ap|^@)-p3QPw$2Ra=SA!ebZL) z>g|e4oPx*Gk@)LF*<7!743NTPYFCBc^(FxBap4BO`kUp1 zE8EeJHiZn6Ch4WRC4$qX18wv0Vf&`Iw-h!*MIqydBLBno%QTTngHH!UiIP+IQm&2b~zTxs+ z0?$rK_($fk$aiwI!plbrWDN|&(23a(kXVS@4P}m3{7n`v-(8V~0sEj9DO!QM$bVwi zpPQc>PvZcTel}7HF!oNh+AcymTsObO#0QJ&uCbM6TY}%!z@SK zw$=Z%M1(Be>JxG;z$(1vmE0kx7)NREPM%)mj&ljki+EHuyH6S#=#CVJ`8>l9xTxou zxKB=Mf2t!yRL*4P_k2}ED8P%ZtKXwo=Q0rHBihNs=l|dn+Bs?O-M4Qa(8JJh8`b*{ zr;7em%8?$UKGjd#hlnb0cXq$6hyeR+i6C{8tz?OM?(cgf^1Mr=7>p1kM{K_; zQrk#fPlB9xe!M&W-uVPol(d8;sCM&BVR_I^1S5nc4+JvH;vgD}^O<#p-g3G6#(;&V zN6ekb`TT~()-CoBD|ax5|5;1=9O)MAW8AFRjYcl?39+j?-C$SHlBy=TkN+nrK3}{% zYoOtfnfJ2Y1id`nuDGJKYUjbBbrU__oo-vQqPq#8>eX2m@8RyRxyY*rb~)Z@N6I-K z7x@e>enQ8dhm!^W9;Bll_od(?8bayh9>yIWC2Knc)NJ@SI30!Pest)!cL)vBHM!6y zj+Ot$>)(={(b`{s=l2;@KbflyHn>^+2X7SExwslegi3hVu94Ze=Iei)TP-Izl1*T~ z8p`f;`#Gd?ow*)T(g2kwnh`is)76q7cYbV4`hBg^mV0ZR+P)~jvsxcQ-Up4h_nRJq z3YQKa7Qih1j15(K-hRN8kLILrrXDFzC_Znp{{x~}vSzRGl{eD$KN(5c&-!=ug7%CS#V7!huM^TO*sMcKal8S{Vl!yq9FKhWqx&?2ctaB;V;PwlHe z$z{Cy$~1bRuyd1I7chizU7W1m=tDrZ(}7Ou79zNxfZ8dYYxZ)#P=jpP>XadVIY{L3 zcsWc_fVwNQ8yh(Nj>oVW8b!T83*JP)Nlyk@Yfy76a-lH4&QxTyR6&7Ri$f|Q3LhCi zNC-^T6g-uxkO4`$gX8)J=Rc-|0t+ae1lEhg#P`Q@9Fsfi-P}xMeP$_$o)2*}dy!xm zP4yr$X*}P0_t@H9VcXwiCyblZ#ikWRK#b3Qyy)9Ud3%_~G{;((?u+;I~;R`=xTy z>mA9$TBOb^Bex3={OyK5`PeU!em(z|9l^ipEXP3|6&&aC=lnp+!^>!mfd2Eb|0GLh ze36PC$p({f6{11h<=Mo9e{sdl-d?Jz{#p~>ju%M^60Xx%XlpFV

      (`#kTFZ0R`wX?Lcbc}b6pT$QxDAc;MG5&bk{4~%O9$71Dg182cdfNowW&1J%tFTn0=t&IAK1+9A-d%)yrrD=GmyX1?M`l|f zC3b4s#{yaAo`4*8$tK;zHVxe`i3OKxSJZBtvPtceQoJ}!$#W)f6P4y&lKA7_fxZ6; zx9nhHT=G{VxgM{ud5fqRO;PDzCVxb@0Tcm_)t_PY8-jI@$j~D9|7k<;;J;xs&FUlg zL4Q#hK2}o$F_2_KyWEBO2)_d-&|wero=6sSlz|P8pXwW`X$3gxj>9*I`@>S;CO=lg z1i#6vcUv}0Z{@3bk=;qKQYkw@?bRlFM4Rws><)FT80b*Vo zm3%;(Z=;4a9=gKKBkU5Uojvaj#TbP1-UFwvn=8EMZ1~i#$oR{(6!2>29xIESHCtk* zuXsUK-W05;DVhrs0Zq-4o^{RQp1lH6-s#Qa5Bb;SOk-Bj)OVkM&Z5Yt6K5IPfcLw- zOk%w3(Jf;~DaEw+@GBEPpz8b!aS%0M#>n6gET$B-ip8nr(W??XW_*i9An(>@8I7cb zkMa#8!|PSltro^Buj7icWopNW`bpZzOGV}bbMLLn*8(mfUr_pjpRZ_EK;`XT4eaDa z{p|A0ol}HJ`hWz~%k~K4R*8R$0~iTt1SiSjzH6v%5{FnL;mW$9j3Y7i1d*O`(V(3P z5@>*Gz8ZlLSb}2SxZbdSoAxs&3Bf3cYRB|7-9^o7AnYD`y3|xN6B-A_x!1BCZ|FoK z;jmT&;a4Qn*jUC>Q+^ZEJ1mslcByc;QR?HI&f^D)zy3SNHa*BB zEVp{)cBASCIHZy}{Vk3QhJfR*>T-V-2xvAHN=>I$FmG;R&c49esW#PZ;;At9mdF@W zistp6m8{Omn=j=dI+zD*A6$ZSk%biWif-lI%a5hdYy@iw*`k#rDTzr+24JzUmR|N% z2xw$*+gyISYF6ByN4W}}l7HQx5LU=*3LA9}H;4m}Z;v#xMK|j4y&lByhfRD!+x>=D zjWp!rf;m@3&MO-2k?>WXM#U@U(xWo9svZN3CJ`i!ssuvL*t#zi#x;!#?(tl|ML*JreI~8{5-6>mAhJsaE5bKHd8kW(WFONFa(vlkMr009h}Z-gb>86V~H z>e)LXy^cSP{d~s_|0=*e-ZS2Va{CQhc~v@llhwk|XCn5txHTz)A1YxiKSYgIQI*}V zICNwvyH$i0>hCpKm!vyM!ZH;6s9fC=N6q!8AZj;$3Jf#0c7o3MM}pM;tf-<1v@hU* z53;wEM%25}vI%0bb@1&+gfUrMIb*%Tx|NoyC1rBAO!ovF ziGMd`GKDgfXA;Z==v1%fC5Ek|W2w0kQt2oXf%wKk$t_(T6Bl@W&kq-_udX{L0>_~- z%3@vYA!Dvagi-tD3+^n>r(Tt4>fenb|Yo-1*&5c*WHJy z_P-B4sZg#C%bd5;r_ed^ybcnEVd-K}6es6N&VnTG4LJsxsJ8+s)}MiB`nJe$->DE# zwq3S+L2l_!W#GXjOdsWhf6Nwmqp$e58um) zD4mx?SD$~%ztpeja!00683KgFBD$iX9cP?;a54 zr7BOBL45I0rY>(?&?-3Avyq1piu#TO>j!uwRvWU}54j_nX9T~w@UVQnbv)FKK1u3` zx{U*a^$8jWx37_zSyf}j;DldxrORIX%Oz_f4fgT+S~<_?|4aX3Mi9vb#rC(2nErry zu4zpamkJ%ECWuOvAfc?4g|Se>L9+ywQHqqd%X}2%n!&WaJ!ExgJ~VE1pvFVFz}KQ7 z;)_bCt+R*x|F9ZXeGhWd6p`l1a!7-Ojq8nM+izQm3#bPo@O=0tLoYuPK&;qEy}xtA zZBFr_XAfDouXTmJ$A0kS$0?Cwyyd~jCFS&r+$qsSlAViS-Np+fqo*HuGh3z_J?I35 z7S3WPSX;Y0#OFz6rZr4eC+W#0WUebI`-k|g8MgtrIwKx*2NKZ>2;;Arr6>>nWl91^ zbBJiVC+VP#?{6lr7u6h6mVFnUYD~e{MP_Qk3%?Sw#P~Mz`tU=ym1=|n0C8oZe4F%vot#-+^;@Wc{I>Rgjfz_AQYDQ^{{XQ`^~_tuWUz5onWWbA)=blH5@S%gpv1S1 zEPy8~zhC+;zV>P=V=5(;oV5$r{lRTqJQVFm(zMN!ZsB{2{XZiM8Zc|8-Nthx_zAc% z8fo(a%w-7jB=XZIssI9?1r*ele_0k1TK?m~m1wLtCr>Ucu>8kLLRdU;r$d&-@bdV` zO4{_ETy-aviaG2ZVI(ie_PG%C668A)DIkN!sM3*f`09sv|3jF5+wa_=)ZbMsND>c1 z|5Av^)vo)%apNgqJ}op()+k(3;Z1;5!l4p8gBYhjoEEm(g7>Rh9|(+{kgX>`+W8&g zk&UqO{`+}JvF*UbJ^uzqcb+f2Q+*hQ9>S{~ca*P5a*QsqL>q98rE5DG-HDZhYpSs& z$N=O#;fmd<$*oi-*;yIr{Tl@eaQm^X>gbd~jq7}vRNMaToiO=t?Ad6QJdApzxqr;)BtLSrBGX%HusowoXfur^k`Y6uT2r>ah_!C1JWU%f zK2L77bDa0HSN0m)ZsBSSc;CdSKgF5@h`-!F+tUWT0jL3_Z3j>=A|fgKfA#l$#{pyH ze}E9je3NHT0%;6{>JUhWX@p_%?h?J_*0VK~RS%8wwTXy`MT-h>3!8rTCPFMFBF5*p zfGs`7JOa4lvVsNcv2aVudhC&DfeFm5*6149z)1i52b@v zu_+nQ$C6q+FA4IcasWspyDvSnL}@}tcV~CF9T7K_yKh)lUA?pp7xPhRvw@+Em-^v< z185`NV06?rI5*@%UawY#2U%XsZ}^d8Babe2lUdZN7yx9saAK&IcQzf_p;y)d!M!mp6J@O~R?J|ESs#x0CK(%^QM}-947pV?ohZN%@ ziNE>gCK}}YN_C_eC1WUWxTw}(kN38JcpPT*cGt^S&*N3T#&>SUV1gcHg zSc11$_?~c8ymD4yal9J(qt5!1q_$1#rz?ZD6}lr zny$35_WKNnRNL3+qf}lO6r^y0<&<=v1jR}8ZOnPdvthw15XNM3$n|P0kGf)r16L6w5QOGJg-1+84c@j zKB9O$P*ig8M!sD;jdVTzfW*DljhboT+F-%B>{`S<27GrRdFLk7O=_Br1F4`kouOGz z*t1tzMMR}sCHICuUQ2eb;8+laeZGF27@M)dwqS6Zv#M0CD!hc8{YH*I08D)218Jwz zD$!-)ASaBy>CobuQDBme;%huyyzZMgavb66E);fH^x>XXapRnPSDiZnnR3)N5m<+$ zakr2VX<4#0G|qjmtW7ZZiL3W?V|-Og`CcXE#n<7RVa?ubW=Bzj))yN7U)S4Q041uE zfTIYKt&c8=D_JiI_QezvoMV)gz}9k98&~5ttvHE`NWQ&<9mbBFa4Z-_M1X-2#kyJ7 zSz<=~|BNd3zf?Zh3LDR`b9^4fJkl7&Y*{F>QPE1;c9;J0qa!j;3HBmM zcUv*`V&=8E>LqON2HaHQ80hVGy1d!OgHb?|K3H639~SU;6SHx+I#8$a-*16{_l~2S z0>*{XqU!(1OgV@mbypm-hj{&Jj2ZCi@XbvW20L3D_z%WyNSJp?YDBc_bm`li)Mlm* zf-K<*1`APhSlwxdCX{QFnp}gJeID^U&s>mi)~ApbdU7ozwlD|Z_}^LzY}!=*!YL@9 z(1v)=`aYNJRoG^hT8eDlhz*L=;C8IM@i6waYSfCa zK6Ao|KikXcDl1ZfLX(Mm^708|7oXPKrXhmjVr{PO_P0ZpLcY=NQ`VJ=Bkym2 zXWJkLbR$LchNYcAVq3eV`3;!3pxim3WXgGS;)2}PWm9*Bu?Bga4fKQ~Q!zD4BRHyr z!W{nl==`>$KOFQI`$#EYKQqN#0(k+;^79>IW}ih4#Q6_NO+yThsenAsc`$+PVukwnZJu zSL&zGO|BzSuVAi}zAc~bBBb!ju8R3|!Zbs70xb<7lSD>wH(#>yzG>En#yMy&b57k+@*!hR-61OHuqy z(4p=RC}S{H7-bFdIdLcYic+@7z7|01q+XJ+(kI5 zIaH|>^TqXaK1*d55- z(q-$ZOxToJ=`wM^j*P7xmr#Q=zv3>cZ=jUUOK#S>P3gt1UI5R$g6d4B4vxib`MQ2; zCl8(aq5yU6CiGPtY?6q$#w#OP^^DgWOI3)V-5Z70oN32}>Hcs{#~3=rvc;-s_eCpH zthuQm{CE51zprQ+1`%Dd{a-XiAzHQ*cOrFoe}UL_ZUhP@G7hIpw0+Xy;UGWVJU?}x zjjM#TjGiu$3IEV8qs*xdHZu}ApE(`9B^Q%z8Prami)V zEQ{F&{hG<`!XI9o!74yKajud}6=z~U=ZG5jqz)_JyPL~}$J-_6A3{zg3TgrvHp{Y{ zYm@90hGNbrgh0zn`Q#r61zL?{p-Fz~M3{hogN{nqjDZ17JIgU$9O@eA8QIN0#`}wY zTVgKoGfhES@eltr-ueAF?hgNF73Yw-fDcSln3lOfzl20C623i~w2SSVKl=!DSFKWR zT7B|rC&^Wyg}Uu;^M|lveH%m?K*wTwXSK95xzpyK#)HehJ2dvvWi}!f-ZlS=+&*} zx{kfxf$-w?vewFnl%!Dtafrp~67`%%2yrS%ES+;Yo;!ig8-yOBCyl|Np*t+YP1DMZ zqs5Yat1$)EqpXiIQ2WXk@%oX?YNL}e_BQg8_4Mfq47*zbm9#Q5H}$lc2Kjq*|EBy{ z+j*m89Gu5=CZSa!+_&kGxNlvDquF>ef8CwgswQR~{g&vc@ZlXbk^SMQimaFk1N%+x z%mcxMJpD{n4k!_`WoWv@8e^l4SsthZaq%9So~Qa?Qn7Z|J)M7dpJ0W%Axw}2vN=UIE4pDk0*Px!q&48u6F z7|kNgb4AQmH-#kMgt%MjlY}CcT5+dWdXzC+I5VrQ<}JtPu-Udpb-wQK+wCoD_IoE- zW|TT>6#t=eB+3)Ot<|npnqIyuhZH5wyr?7z$bR@iqQjN!QBkuAnlzqq11~z$yq(x5 zv7hYnu40cFX{YmM7c-ng7e{frTX1|EnIxRZdK^?Nt8GD{7G~|#OZiRI_&}t z=F#?Td`ZI0N5qxV1kDZD;{&E5!5UUFQJnK3I6Y;f-vz4^1`P)S@&WxeI+P>^(!#pC z7I1MAQ)zq>uaI8`hk0{B^G)h+aDK(`a2$jrCxwrbkC*l{A6Uy?kDG(NlJ&Q*ZK)`)KZ^$;4D;RGo1eioL!$ zd-%}6nacc7G4Tmy~U6ZED-KG~O-IxxebECv0wlFIg z*nin3aa78FLPhjtqsHT^(8bsKy~?^!kqX}Zl;6@9xe87PC^U3uY>z7VQ;L7u)zoA4 zsl@j$-`XyEJVYpYaB+xw@Lr=k(;TKcg3JS5qCoL?rk~;st0YvW+mV|Bq?$?lg>-ov zcSVIA~ffnXbfB3@- z@N1BP8G{!xdRG>x6XEi+w9WgAH;4q+MflvHJ4#HXz|UwsQ^@HMa>vFW-|%@6R0_p8 zA!8U5n){HPkVt)kY$GS-cxt~nmsI#ql#8IA+Q9F;=ixm0zq5I|KuZHDPLS!k-5+gE zP+G3lkpxNR0mEo@_CVpk1U74VKc$pCB)T$$!IwfF}fM3yb(&E z0U2frr49j6_Sdm=M_#7x?^<&;>5JseLboRV!ZA8>NuCBOzQ#XsD`~K=Kib6}O#e!< zYnFHU9bjGnd!2=4sMXzETJpZO_Z;8j*naAb-HPEYJcP4e$lxPs8*1K%uy?%(>Gp>| zaXQ!ft0;`^uvvXRJaalzuPJ%vF!%ZY++F?fR+gQ@kOsB1|HIyUMK$$BkGd)fC?EpT zL29T0q)Qj+p-E^-C`t(sdhduzlMW#XMT+zmdhZrWLhl`s-a%2i%8kGOx#PUwanIX% z+XFIoviI71mAU5pzI(O^`F9z3H5`x9uU=TsNo+$*1DT99bhB!eXs1S=nLAc(z%vwx zj&e!`+`N!rKBK9GS6UGAHm8+eMmNI;F!*@suMX3Ed$qM+fvh(%G`7k=?~u_kj70%R zugbMw+4R!SG{QH+LYq5 zwgq_aD0t2ZQu=)}}SyKkmflP4M7H(j(LN7*=#^Ho7-vjT*ZK6FMW zvOech0&AbHkr)m1W3ZXB9bnvYSZ5$>$P9o^7R`XiEfxU>bG``O2JN6)Ls_w`@$4O>)RNzcH?G$x)_L1C z`9wjeRx5F)*sMTz9$+vIu*i@yC<{{1>uqz?DzC3d2Fz4Nv7FM?~J zQO&^|CezyRyHbm71#r$lG@?f>PV(N}+F|~JXgT`wht_Zl=y>EX(GG`#CIuO$ z>dVt^LTPf&U{>4$eUqs0Vo?zfm-(+Z4;jgNp7rLzpN;>^Dlid-=aDDLm`J#~REk>; zq?)t)0AENQFH?Vm$n&QVqj7PcMA7N!{HbRL;NxyVQHYTKV);PE#C(ka@)ND7jJJ8q zpz(O7OqmgnL+e%cAxiwTDg{%CMLA@)?18~lf^X&EHuj0#+9+F7-i^Fass1}n4gLI} z$hh3E)gQDgpMyh=2%}Yd*h%l?Fukg@nO5MBqI&a-m$8{=BXrQIX|B4+R9Igv^e2OX zS>Ex`2Q+ie0a7ko8}~iKdS_e~+Dugrm5Y+m*J^;(b{TSZ1_gj8)LMP^Tu!?z$Ot7S z`PEA{B@({>D&z~ybArJ(b1tvq&?1j-1q?;Fvoto=CQC8c_3cQScW18Lw+lvzRL}Ys z#=HcgMDd)1WLV{R#?q3l`FE;EG3qmeGqFCIZJAm%mDRfi6nbv@>irk3vG;~b0K>I! zSwR^(Vzs6aF9C55{vyVt7t!~ubY{IH&Lx2TFV31{Cgw}>L=aQv6oC+ zi;K}GboXMFk}Bnrk%nJAVsvs&kK2ht-WcPaaN3j%wnpICB}r+TM3~o-{JE-+Awbq= zt7&+xf-RO?00m(f?%wKp9h^7I8;S3$?UA*`rg-a+TFawqpmeY(hMMpe>1rtsPeqYP zfc(F#5zY$>b`!eEtyq!ZPj{px#NXh#1=JjZ2tYJThmlMn1 z25@J7v%@v8{=ow-*39A-j@*9@PJi;4=V-AU{OCnWa<6J4c^MGNffkjq4K}|&d7kfN z?fEMkEoOn%}-SL>3?hgiZMpiybmys8y zA;#c%DJ#*w0BzUQGXEMD#atbX1bky1f%aT|v{CyWx$k-+3Y|?#POz=gG2HX_16)c0 z{(7BOiS9AdpIn_)qC9*G1)7Xb8O#NO?nmQUgeHE+BN&YgIN284U>iSWAx3tDM`7(j z@AIbRjq+y>+hq+@-*z@G;Cy7Vd7olakB6;bcujbD1V-!2Q>u6*>rt{N1=z4MIj+%Y zjFTKx7N|G>HQRy1cXbx|mMQ1wP*@d@ZV<^ldJETSQPzq|#UTCynIS;h4S0s7mf6~O zSA@29n=f%*Pp!)j5`dXz5@WLhy5l@|HsG)dqL+|s`{X`_j3e>alm($Z^FdDCON z&e+|;XV2tMO=eRbh){dw`+Dn1b1<292?%HbG6@=yfBw~PGYDJLae*=0D0=_5fC66Q zU4M#0*k|%M3gV#xugnq(*1QTa{fOTt>Y3U6y&a;{|`PhM3>hh}W+| zl?g{zh6i7iFDJzc%f8rk%+oiqYFL#juPj6HW@m^r{kihJnB-M*T_^R4@&GgaC1DGM z(8(=sb=!^>d;TiUgOzV&p=Rx_pq9a$ z>*kHAv3WqK(X$YZH>9)>-ZeNUYHcIW?eYM92HqCws_5CY<-muQru!xD(OpEmySPyG z%sUS+S0AtBHYG|IKs;-X`ynmlB4q56OkzzuqSx87GSIok1f= zT0zr(Dz_&_r`ZjuIyq8mQZ9~3UW&n({f3!rG2eX$K!z~CVfj|P#v`6O`=KNS-yC2? z#X;@JKBJh|Ci&6`D#S~+H#CK z6hiS^WeQy`z#CYD&~&rhi8BR}UxXZ>#@E}89+{!8W=V{d8wp-B$5fwZ+12HFf#V+^ z@uk9|;%980LD;CS0bdfX$QFXL*|I|)t**aFT$f`>FuhN}6q($&-e9vFO6%M*LO8l4 ztHoxgxCL);^2erX%bN&F|2^ShRPYRk+Ug6uulxS_FvTw=VfcQ-Vs^5QUmL8}SgNfq z4=79@x>nw}`aHxXzJ+L}(u`Mkh+n$h(fG}FUShVIiy-F=5Sxaf)9cqh#<~P!O#a9+AJdj07?b&Fb@tAU zH_By@f_<4IkwHQ*xs{J0cU;N-?&s)~A{>s2i+e7sp01#wL6?B?0rau_I-mn7JaOn~nqK@H z$D!H}YF^qYK0NG;tPqu+3M~T<4rKsFv}oy$)Y8 zzo?*9K6A{9?5n>QgqWMGHy_pYc2H`6w+Br@Zp|m2$62rD`8~hdU+XJgg>Hc?EGoPO zqmPKRFU`*T6s`b=JT z=;8-yw+#Qm^n9K_ex~aiOU^6<>WybDv{$QjzPNX>*(8Eq;?YAz>c$@*99ibtra$If zoE&v1Xqc%-j91uBe;wmsmUcmPoGuztN4uiYNF&)oj73MJG}8}s&sweP7vdlnqS~_3 zQj7*$mf%+Cq4;rhVkk)QS8m;geb;$|ku~4LT{$by8@XZy5Rx z>!v_*=y@0$%1iODmduX=zy3dj+`h_<+FDQO`QWo1BkRMl;a3*E+UU0VU1qm6;j5 zi$5L~*Gnb3KWmDwU9j}wP~2Rp>0=Y&%?hr~Ja05ywDI^9Vh-?vB#@d{pj+7 zmO^92>z*oHKBW@()uDpn?yln`NYJ$0D}{=j?os99eL%4?5ecrufGaKy1aZERV*05} z4pJgY;biROb-W%8Hip8*!viEY^2kO~^@I1FFFr@)q^u>%sf%d=H5$O^8zh3tIiX+e zH&Sw*m=6CrZ#h12vvdw0F8FW{05+j61CKi!=T$x@L)}$7A=*QIlM~APv50U~GcA>0 z9Ash-(#ghN);tM^wPf_6_}d0PDu)@l*7WOYx=GmtM-OvC12*R(z)G)=QtZ~7rP%~` zgiRz@Gx9z(9Q`YHH>J7bH10$)tzAyN9kU_0{v+Tg0i+YLsqW(7*kJ4cnzA-)bZ(I+ zfFL}NLMRzHDqsz;HIdXSw&oX1%*?h^wSe05Is5f&xxYfp(^cXvBSQWlj7WgqVcXB; zTF(nG0@7u&sd$-$9j)HVv0x|52?Wz2GOrF>RUU<&D>raXc%HFdBYVi`amX#Y{yMVF zfzKEE{f0jurJA`B!qpWj*<(MqPA*dtl{hUbglc^+!~)befWenq2sdXGMY-v2LzLvf z#Q4}e-<}CDHR`BC-vnq`a4C%LEwW>-vuLr7z?yZa_iL+BN5_9Q^^J+GNytC)#2C-u z51N(%Bf{p~gtCfcaKpP;h+wBQY=FM0{vS=jm*SywVF4!qee>iCJO?W79MIL6pch~_ zX1(&$4ggvJ{%Kk$hz3JHjeFk>aQyUa&Zb|LQOx~AeM7^*BR*l(iIq| zMRPnHE(t2@;qmL53qr^Q7L=Ep4amO`I&d{Zx=&<$7FHnO5eRMm$WER%a7THA+Mp77 zm&Pw;$M6i5u?vDOkFrxLoEH4DYvZ0;;^)%PP5N^-*M~z~#2D8?D&|y97tH2mX~0*# z;_&W48RY)15!A!V;;T;NjDBFDV6p@<5^{0s&;ko=*XZ{%bb)>X!@Z1I5BOOMh+C}r z#fV5}fVOzs4;j0TX54RQgP+PH&9Jwz;bpf6nvAq!2c*(L0=cQ0ZU!|EPizYUKR!;s zP8BTN{?UaW^+?gFx?c3lLBeCv(ZT-kB5o65V`C!Q9L6A!i$y%No{UajP*=#Qu(J{@ zK{8k0xbz>x!Pj%0#_?09)R!yF?AwZpq4BTidXF(I3?)<{gw(2W4@m47N!Oz(UIO++ z_NpTm>$O@@-8?J-NHK5o-kDVVib^a1v!6uNH#tyWhKgg8QoSo7bd^|%5j7S~x18p$ zh(@s}!Ar=igwa~Gh`FGrI+3Pm%@8&7Q&tG~1Tl(FG!>s&a{^|bkT))FI*`!;p(lAL zD$z1wv9=K7(m1x~{6vLjdTHh&@Mx)YMc<@q;15x**nL4x-hEM3;@*79XKr9dg)A4b z>uF}4ulEifN=Ujq7K6{Jb(Va2O9}bB@xv4F8-+ESd8rMQYH|f5i)h~VRGds_qYU+g z7H91KjoUwV*%?yr5Y`2@L4y(ZM6ecZ=9?oqf{BW!)!u$md|_*P#&0JUF~TA0bn-u& z2{lFX4fo98e1r`yGHGADoE^Do?Yg0{kLP)} zvge)`vnU7r>=G>FeEb}tZ3l-tMYVX^->*vE6+@fSr7jU0_b(JBCfO9wT|)I&=JLa+trVb zJG|qHyuQ8>U$&{I#kXaY`l}yHHRXA+e3;U)t4dd8&MU3dsrgmhK88i{ z)$8AXlqd%#MnqEHG)#?uC}=P3Fw3^6({h~r48(KWw!or7Tl}(t&;~tldcAx{aD4ZG z;QrERNFN2}Fu|^6t+WtqXv{zGeln(#iTx+0DwQ|2Duu|GSy+f!3dhFw0w}HUJ-k2` zrl!sHBSW?nY(cTfxmhj&OFmCYPbwIkTgcy-3Nac^3$a0$Z8}xN9e|{a+RO_74dmq? z+*6Q)nu4`8BMxtqkcG&5s<9jQo-xe1FP48wPr&Z`UG{B!tLp+DP=NeFa*`m`tT{_L zJzqaj|;4BS6Op|r4h z;J+6elz3#+VN&fqKDy&@ZAq`CGZ-r!RO1tdX+6&}whW^LC9JkUUMf-MK}!vumx$sk zhX2Ow0vwx)5JRq*qJw(IP`|NYh3SE)LN5g@55seW;LLXCf*9v%+%4v{0Fq?=(Pg}j zY|<*LfbOV&LF4@YsOG2X^{3|jb`0VI4ZU-JH`%#8l42e8pzJuhu&>9-^@T0%8nLic zt>mpQ0LQIxui-sW#^|ZUqoS8ho%52=TU%J^YAFp;s-s zGMA96w&{KlRsHH|rVz)vEyC;8EV>&s72}Fr?=J+K7m2>q5%+80Ql6`BAB*Ug31O7( zE$jVbW@sUdz}f+38zT$M%fka(Y5r@tdOp6~W37g}pc427ZGXgL@^G*%UHOmV7**i= zA2G=~-sDRdhub{6-z^c|fLkC8AM{fdi+EU5Jyrr#?4d2`Mi=j(%{@s6Oz0Jrr0I3W zbFCM9SC|)(+*W;S%o}fCbgXnE`fNfGjF30=+#l>Q;Xv* zbBWyO<+th=)cO6%I&6_$jxjkmlr6IPSf+*7fn~o~;zXEn8WhN-qm#oN z*Q+~vHPd(B8w3>ge`YpovrXTn_hHD>0inWkAkz+)Zm>3x@NYcZdeWL6Qjhn)XO=%% zzXWu5frOMRw_qk~(1oRV0y(-Cj;s$!nVkM6lw3AW%^ypvr3Q^QB5Y0E4wBFVA^CM} zevJ3G4^m6v?QWN4@$v%}RmCbi#K!TKa8pbwE@}SWQopUcOAD2&g^xM)l9rZ3dwBoe zc(X#ZUbLUI7PifJ6>k>}Fe{Xvg9iXw4U@Amq4jDAu8>wQI=^+j=?(+WWK@2at8rlu z*!WZ5aBRH_a{RYZHqzbR4|Ts|mbj+M?gfWUq|pF@G$-caUx8AYq?-9h=(6GMBa||- z#xt)gkmw~T*bkd{4uO(uS9T*!BFW1F6*k}LpgZN`wpSpPtZY`yMzhwkB+CM1%O+oNq^yvUGM56pXQ>_1~zKA0C5V?At& zcYv)q-0^^dIhjtlGvEEG$%v#s14&iP{4KW(MBmOoKLsaP2*+SO8szz%o<;kwR?DVK zB1*E)W`Qrc^p=qG(I4ZNmTL8SvyRnDb6z#uQnR}LBaQXxz55I;kr}sUNKxDKfUjcW zPXjA&-x95Tr!c(iz!3;gf~y9Z8ejkLVeo$!BKxJAyIWm?BzZ;HjvVc$?_!vaKo0>| zV`|e-eKxSPG^0H_(+dQ^8Kca-90zMt03FxpfIzkU{L?}hJ%L=fgk|zhd^rPUjpxhy z2%BHvFqz;b;!c}HJJE(ln;u{x1Xu_FlyT9NkG_~dY^V>A#TfN!qZhTOsHb#=j+>FL zx@zW*0@{VG?UOuD=0IT7e~>RZ$;QOzv~TXm`J!0T7*sXadEz&lYhxY&E9LEP-{Kc| z!MO8)WG_xjbw9|(hXbor;65l>2$8b2a@p-QwPPQV@I*5j24+v$0AEC^TUje!5HO2w zqGXS^i>|P)!1|92l^t?1C*@|z&`(Ti6VOMkyl&pnc6{lzb{=&P!iAo`QI5fwVEE#p z-eXk! z0E(P8otJu+s2u|;Xi(s1jV`G7D=cWpUs&v>>e^;I*SK3&(Po;_8d#{-w5e(WqX}G0 zM@uQ*Ek-Oz2<1dM?P!9$c+HwzC|vID=$y`CSLS1yCrvO~A;#tcAZ^t5F+ol}&E&g! z1ukRWjiuOnVHw8ungt^!B=!BV4Sz0Xd7cYA4}nHIyd;#>d4z3Ob*cmU{b>+wcJ zM`r7p>YURNqa$OHi;l-t-M?|Xi_ErN$(&(6lG#+kG5@3q|`<4Ng}S~<`jl^9pAju zy>jyTI0n+G1?aJwN2JyDxkn4ujF+;P>w=2PQE@?|+FzWpCO&X20Csaa-f6wWt4olE z@`*aq;_rOizvxFC-?o!D@di0A^3IC59b$E95c(qN12tFo=NL^$U9)v`>eyr5qIMJ) zjlw5|I3N$_iWJ=Q!EIX_Bs+k@ewETnM{n1P8i`~o=YgNd!@NI*Bc=_0F#N0!2C|GB zUo`S}Z6vf~&7Rt>(Vb8G6o{Mc0Oc&%f}fpPtigB|8^P_Msu zpz~Vi9M%OF@BPmm(Knp%_Cc9vIQ89vZsHZ?j3g|QBD{o-jk~)U;2e7gq54@s^T9(~ zG7n{q$5bGO-ZmZ&(|rBtWlPNiRWWp9w0xK3_cn8ygh8DXUlKb>$Z{cwivyZGVf}ruwv%+^)P={J00!I2;KsrY;?ln3izX zWj4W^DgGpy`}55PFt=m#-~3FRGnCwiKt-%W@E)OgpHFN+6c`sj7MCRi>6$$mB~i;>VV-&!1I27ib0wb)&K1k&{WBlZAGags=De zJC2xAx|io4m`V+wMXWrwwF#_HsTcHVG38ipfQLpuXCVIuHZ+HP#AsiCr z82U;b_`?n2+iNj!Np`!v)ki&mLGtU|-5bKp;r;y4z8JK#JAUD$%B)JuB$x1OB(859p5^8lKnO;*k7Y6CAMhGgr;2 zP@b;tS5|4g&Lh#MMRANTcc2`1_vnx#BK(z`dJQo-hI>-As`>Yyro-^t3_P+_l(lXq zPU(9l_i4lB($o7OO*cI4seYHP5v#G@(Y2xZ@T)dUkf_N81|SLEre>@=de1#IhvCtN;Iz|TG*HoQ$;S))TBIc7hYFnsw08W#3LMC`NI`23+|FLK`G_Hj| zB$*K}V$uz_rt_j*s{(x}iF$MYlZi3PA)V`UQ;i|ee2FXU2`hyYd_H|S$x1u{<=yl@ zE3Y`h%BxWzH@i_f1!>2JC_t-1B}-uas6nF-)G08}{_vp+Erd4ruRt9wiolq6WAF5! zQE1f5Wg`zXwQ;mXn0-);HTBUB(%((CFDveK3^}1x)~2K#LydiDCZ6{DycqiZPKItp zR&8#LAqXV-!bUaOXDDlYblRoT;`J0>K!Yvdr}tFF?BXDyPjXg?4L+HVf){MwVgC#s zdMC04=~Euz*jx!KTTd#@uOG}XDK%}em~H~tUR+8w=!|XNc{Y_*B#6Ys3vR^cG@J9V z`eQ}*zY)4QIsW6jw662QPtD&~JZ=~qJSe5hhB`K4Ty1~UXf<=G7Z_nS4V(y5AOs`)smb&*_rbfYs8JdZisUe<7=*m$v} z6lqeTZi@;_W*nk9U1DRbV`U(+OK*c|6Q&U5k3F*5M-!cNir(%^JbvI%ssFN%P_+}9 z!E1%%${Z$gL&9Fsoqo2fw9pNMml^oPVxhlcY|DVRy#EXPTM$KX7y(kNB|bp&AKWp| zrRPu5ic&g?o2B3 z6SBL(DY*EyVVQTIzl|aN3r7Md_4_MCw`LvBeRMKW`GF7pS60B+w^Ij=wFa4QG~;`_ z^G+*;cTE0#;K!x?m|7tstkxgL^U zgMcLLu8Qun%1!*V7tj_p^xevx?Gzd09j7-DrNQ zo++65!XnyimZR2_qmppZ&ZiaXc%l90+y_gH(Ar9^)iQeVaOp-L`~qbruy`;XJLAtv z@+{(Y@{Kplp&62`oh>S^f&QgboOA*hUmtksVD=LoSz{%v)@MUd???qA`C%4G1(EI} z=$0dXRZ$oW2P+^LpIcbTK5JKCN>#AIZgNilW}dD<(ukbr>SV3`&y@|w1V8J+&Fk@{ z^J!H}3B`UBPv?D$#MDyA-;5?0Vm`2>Zr{Oh*Ea;Cv5@W8YLv25$2QI>^@ErQ|JfU= zF2cqDi+9zU*Ry+4Jc-|_+bros&=5p2mGn{mvzOSV_s?r}tDD~*%C$iu9Hrdv2M-MG zKJ`v93D?y-LY)F-Z?gu*r?+E?7PAI3%w(Ca_oH!C>c$pp1rxtALR7cQ$kh4QN}H<> z6pRy$m%lf#UXTsv`y6;;bqra{XH`W2>zxj1eYsG=tF2@@T(v~`XgvZ_)b z<)ih*E82&Usz+6^`S!&8dM{$pmM!7r-gVseY|X}M-g~Ny{@V6mx6CB2=vV{e&PU%! zm`{jnpS{f<{5^Fpux!U}C_FIW+0blqXgP(q<&-kb)&hV84W;M@AcspdtQUjk=|r zRkRY%jhb`$l&mL-33E=CJFfTwnpS;~6yBrhQ872#&io-`YhiwSaw6@()|#`Sr~M*I z)Y9wP`p0f|G*~_R0cRN$Cd3`eu%@P~&~r~iD)#*6{ql;9fouR(O=~I9p#Hc4Nh|b~ zfQYAAYTDdz&HvgH`}izEXG+Y_^;?KOhQ;XbJ7*Dv$7H%yGbX9{=9LDqK=+0?W-!;9 z`Xm!V($`zd%(SWA*LUFwqP-p>K!6yu19>(ITYGH4P)lno+8^Ljfy6lzm>eXABmslG znP2EX>X3XnMqSR#krCfhG2ZNBJl3xhe{dIJav^k}h1eN&`Kg#2BsHXz90xQOBE{sF z*{v1mvhpL2K)V5WlER!sCQ|G)h9x;};Y8@jMOxMAdES@_wQB!PVWw z`je37Ih(X1Db5p2JJ~@g57EXMKJR*PTPwsf$I;Dv**i8GA~&+qq3r~cfRHwi27+AI zteE1g9+!Q`Q{FJ8*qJ7WR!(S> zXM_3a`@N0XrW^qm7e#*jza32V(M@_=Fg42!{g1{;TB>{oY4HHhB(8hClo!@MSi2{pd- zh%Ww-{{uGl>373=*Z{5cPcmj(gzN)-yoBuZOSzf7Ry8&LMlCRI#u~D9BUbAD#)NZg zDIh^EL%~D_pFCt&u57SW7L{Bat^Oag-uI648LX4SX{Mi}?SQ9_r!PJn!sch=HI6HI z_;=KwMW0pSsV|%4bG)XI5k+^P#l$3sMKpG(OwyB!CBa}|vR59x2-3FM*{P*qrzMZx$K# zmP+6$!@~53s$Uh_4S!}cz%J#&xJAo9rEX0+|6;jYYKpn8O^DkZFRfgLdacPX%tAeU zyQig>|2F;|@0dOH9RIbH`QImJ-dr*Ln_{o<-N^hG2LAtkVCh-N-6^z7_JHsc30s9- zvqfm+f8X(C#UJsnb^e{)z1`Aav?2JvFLFOG;QsfgC--js7n~&=-1xr-|0i$4>pTL} zx!#W;pG4~Lcq#waAWs_U;BfdcL7S*Oww9>$RnBWuXXo&6*n&{DMfgBX1D}YddpUJN(32we?MCA#gD3>ALhRaGRL7T+WRc#bX>-OA;aXlXtRevDRF;%|-3dd7-8iz+oyVY8Pag zx0Sz;cxWa_*bAS#82TxNR~V68@OWV!a1Bdu%hT0cwofC(pFML4R?(zyw5H}9`U)pT z!nO;aOt~T{n0Wwzhz@;>$P3{S`JXz6*y^WJ6h1e$2-Zb>mW-tf7S;gzOW?QT2%5#h z@^bA*LHnW?KN3TMBTCo7!o3N7gj1}qM6nJ3uS;kq2v-a9^Ht8}9SDzwuy^0zMn6-qD z`H6}GWOP7WR&@88M`=k3?%zeYi_{KfE0_@wwQMpw1u5$Ugl=21ql$`(@N|M207Fo4QS-x@IZ^ZK5fYiouF>nq#)*H)bKQx{yM0z9e&B4 zE?Nt#406btoaxzMK<6ZCADLIkx}a!v?*@2UL}fm9sm3}UVg`;Zg-n$im0d^Me;n#F zTf%=_U+9Fv>h}h9gEvJs2l^6NoK|l70UeQ5f4tIxvuQ~=O4TNt6+1~c(S^rLZKnN+ zM;3xZu<1X&Q=8VY=2Zcqd#ALX2aEAY+%Ft(YRSNVl&15rb#MJGnebyjO3KU8T$KZu z02)cK{yitW+PpuvMw*CUj($)cpPhB+*#4(i!oIsp!=q_t_MYmeD`8lzfed2rJu=Z` z@_QV#=!4^7V~U?DH+>%zy_dqP-zZPyu4E-NoF!-a4>GQgYi(?t)_lOYuFv8<59X?N zo)c>!h#`c8Df(XDBq}H?>o;$M$U_v@6D413Cr4(~x@XmUKYW(2Zi)MBT@*~it5^S> zz&u|tPx*D&B1LeLUO5~SQOdvcA>of>5dFL=+xTeFevvnbAmiLjxZm|cS2upCE{g3{ zbA$)mAA)PIF(_{NLuKXg>Y~?(0*}o)E*UvwCv^V{(_&b&v0KXq9hcB6(?hRUen5>w z^nX0d$YsWs|J=4Bhly>6tplsynZ2sKu5TWS98!AoQ2c%%ngjyh2+rp>x3XF zkCT?aes$gWsI9_E)mx{vl)x(ITelT`zWq*TH%Sc1b{vo}`X)hOgyuzZz;%G} zD>xUlAC=j!*PvZ|hYTR!UlO{6-h=>6dJ#+KzSmJ`;@x<+;CzLWo}M1{`~PaR2J;G& zORK7yB43k4M#-i`w*&tPDJl%)R^M^ie*5^wli2$r6^egPVTIe z=PIjruf0)y(VIh{yxUz&Z2u-WFGmW`-9}5OQq}heHn;}$m4BMkcF%}RfE^bZu*EjKz>ALWYs?Nv0vxG345kVY)W+Tc=$33{~i zimO}nLc$KD>ja%{b`ehn41_4eGmfaCdVpe(?fp{1&{?s?7%;|Cip1+Zzi0zu*nC$Pqwo`^)Uf=U3e z8e^Kh^^~XtlUo8QZjY3d4}%)F;ved#%NXe` z1ikxxS>y1`FaWDb?C>=;M;7|mee5P3hSGdY{H!F^??_Ikh`a*jH_X7jCaAqGaq!T+ zv&;9^p(RWF#;b3wYMw*TiFMo(3C=2o7#D;#5^1qPTX;RBlMo#rVID42$v{FVH%D`g8Oo zi_Nf?yY&Bbufzbat=a=(Q=i26DITyMh zP#&u3N?*JZY^Q&~d6E$I#{CdZuo>EtjS-%ME&~3TP8IiufiyBV_HVCl&C>w71i8Z} zZ6X}^Y*!<0KpF@=jW|++B%9`Sg7>ZFk-HiignnzQ^L1SFSpa5M#V(0^ggVRAy8xR+ zOG@|spO`mb;{8|Kz&oS4A8SKOw<4}mw_*uAWsd-wFn7G15xxb*(f`Xb}v7qKY@`y;|5r#n^;%@DN`t^vs z8RI@U8is{-aMWcSb>D<GJ z8yFQ)Wbf(-LCe=VZe=N4!tU5AyP+QaCCIV`x(G6fLBPYnt|(UDH0Swxtzp8DmdoAp_$P?^Bzp4~HwNgf z|I;D+Fw62Ke7?b1IDAp@J@A)Lu?h=B(+bIQ_Lx*g zKX1L+47*}jz41>faFG7m|9mLS{_Ph3as!#B{XrlbLFl&ZLAi#TLScdZK?GP=dDraJ;2-J!js2^Aka=YBB#hR=8EOvURu2d>don z{_H^82Ua0dw*KUnxWC|l=6w>1CGDBGYondje& ztNteaw3q9oT1=O=)6z%u&uy=7tTjashMtwMYxF8>*N-PVcVBj$;mAgvR%(}?wAg&~ zX#UjNApU)D>nvq6mJ$>HB8RJ^D=-CnKCazH!LmSX{^VC#*Y6FHfi1-|nTu8WF21No zfh8@TH%w*-qE@I3L2NzLad+hwwqCHReH`0$M7S^0dz6QQuT%n;zhW~i*uVh3*!8c$xr_of8HMeFI1^oy$Cm(Z6tpXG3M|hILUt5)Sizm z>v?tI6|M8o&+!+~CL?+jTFYuH%P-rfc1J#VQ#_}}se2%l7)S4f-U@e@{U#Fmmc|h# zet@r`>P{bSfBM9Zdsk*xv9ZiTHU*k4-wal4zINXk93qd@nDH){d=`Jt*z{4#W+RGq zxvAY)O4w<^*@9E9-EyM5FZ~rHDGAkoZ^kaM0^J~Ry-Sjxt(yWH2+eF$)=L+i9ga>_ z+q$NOvv*L@Lh@E_m8Me_-|42H1>B%`m{&%T9GN||~xi1);2>bJ_jyg01v+`9N?RaA3J zLU_CH+{6Lv-sGXv$IkYEm4+*gU0H;6^vwq=GCB$h*ejyB982fd3B(k34w(!jWYaQ; z;|VKPE83gpcDaiQE<`>ff7D4Ro&w`Y#9k3R#hp{1-Id30k{9%=iXAqo+?VMl?2D~R zZJgz%L`e2Ev!A(qSO0a^7Ih_foo0W-DJ6*6{l&`khN6nT?d{dy1a61TR`^f(4=N02 z@I2NLmC$ge_3*2N;~(u2_6b|D9xIQv?kyerjPwy+tabWdxBg7sp;P!E{5nJb?#KoTni;k*Cl(ZAs)IV=Au2P7=v&=`VzQL%Q=F)e*)iR%6pY$hG?$$zw3#q zpDB=Cn7igIqH}GrOe}#h%MYcr6YbXjo@$x#6IOJ6%hGPvv46JIxBi`NC}m{1-MQSv z+tXRW!Q21I)o>-N(yR8CVt;oB;46ZNY@S$8@xs<=G7bNZIVxH`j`3NuypH_GeXSAy z4T6^3tWz2Tw-k7LtC*-1~12Sl18!-(mYZaKUjizN<^WRw<;HBAypF}THOi23au zF3ulKcvBVE;>0~oSr%^XqKI=^yX8LriG-gJwCZl+jLHmZpnK}I6Op;w_t=JpeOwwGnZS+hpZg~}K_xZsYX?T34 zyiHubxNFQSRK$J0?oPlnK-cKqHR$SJyFrxw>!95sw^wz^PoAFr4yqFQUe-SQ^Yc%& zzSPV7u%|6QbB4Z?-^lif4CW&lA?WCH#dR~DZ{2|Ed|SQfyYrVI?w0i{41KusWp04T zgzvEj>Em3!{AqJSfmOz$GjvbQ+ukKJ*@-YzE>M;UEd3Us_;_#e1GicE4tue0gY80_ zxKt?)>$_3V+{=sQwB!_(bdr-`J6-9R4EElrOy+q#_eCf=?*9pN3XApS%fzJsEaRkF zoPiYkqVM(YjQ0Fg-|E~rDtR%RxxDm+ywJTS!L zK?@H#jRZY$9=6cf5TEdTdBhU-) zgPbjaGN4Ca!UX8db;gy@fpUaA`qL}O%I^g9Ee}9H(o!G&)v@EH5$>sQKjt^?eG%?c zeyhIqjSPO9Kw#XL`HernC-+kLojE2AagfRNe3@KBM*ckz!0%2zgopbiAm|9$QYMJI zKko(B9O?31v4pYZKXZUQ!n68fc(Lat$mTgEPQJYU${%Fq*LB}#02w^9A#LB^Bp=Ka zE;yk&9J>m5*l>F?21}!WrOV6sjHmF>Ivfs10EGI#=A6UfFwk4Q>86`(Mj$VTtXSn2^DQ3N|NGhr{t=a6)xB91e%0 z0B}Ne?8NAmWIB2!3-t8xN>cP%60@q=!u!mHMsp%(cjcD%m8eVELx ztOj^>F8}qp=so$Dcb`Tpwr$U=c&dv&H{pH$Z9#apNV~3$mFBibk6i;!sE(Z$G$tqf za(<3TMb5nDS^L@%_|-#v#b}d#2%*0PKeiWtoV!ULUa@r_X_&vZL%wm_3OVZ!i{zIN zM{DXjUO(8>k(P7+yjYfOir#g+nOJ* zvU1nr7PVBfa@(RN`EBm2LH}CRD5LA*wt&cv_y+EW=ZugecKh%3P`88;^=0zO!$-?? z@0lte(gx7+`ofUvQd!-aloc(JhvLR(8|63iqSd$l{!EiCgtMtVt;XWE->37}bxC%+ zEYu<;#co+o{@aLUjos3b%*v^=hRDy}F-0C()gkvT+4>Kc?22$gb?nsm;DN)HJe%cC zCDp6Xm?}#eyR>mgN-|R<`;V)YE+yLIe({tPo$_~?yR21CSBv$tH!ZQW#s7D=TA42_ zS4MAtz~}Fi+246omTMz()Q{##%?0<$Q9qa`w`(4QF1lZaeenVN_U$`3(>^tPXr7iM?A3Y(XzVe_{pL@5w`}fbv;L1`Z_cHnTUlz;N@1B~= z&GC8x3%#5$eULo9s?9#mF@1E6^lB#$H}G#BUMHVEVw6Ae7h|`GvVtG%UA!kLgJsfM-J6{wCK1SOSkqiW=LYNd{?E!foga7KA$H^5Z?k3ZQSIdG8T~ezS@K5#pcki1fgQ{XO zWpJhZUJ3CthmVy(N|NM#o|5x_KE1arxL{wII-$;1!WuK6Ov!x@>G;9na?L~0n$h3V z#*uZZ&)jF2ojYD%IAnaSb->nlr1ZY2lA+acd3br7tZ43**`sP@zIM!R(EF_G^220J zYqxypz>#wOlhN?SAhmGcwSV-bmGx~&xoLibEWT)eS#bXTl1TN+{d(`uU)LdBmmVf9 z7awd^;xT&GBAgz}kDg%`y@6k@`g>M`yzk28HGILm!G^@NX-@06WaLQzP_6z&Vf#Yi= zoz2RE^<8rHV;kgGr%y2*U(awtb?nsGb6BOMdPM%QuvrFF#N_n7hsx#mtd>27N6VU( zswIGRn920oQk8s{cd#~4AN})Ux!|Z5J{N`MfCV{38yCLgyRM~MZajO2jd7iK(^8o< zxI%t%>SS4{MEkS**Q(rT`O9^!N!eYA*1%+wo?h*>$D|^xE3FZ`mDP`)GC;m`^tdR@ z@w&raBdeuM@5P_rzfSfWQzOUjIY{1r!y-9x#t^-2dSqyA-0r8AM8-a_L8mOP9k8E0 zuueONWilkUJZe&}F=b$2d30VDE0PwyuS;`F|8b3_Q0HhzajAA3zpNJK4^Nsb7u~W# z&fIU9xoE>ut1Q#nr4J8Z_hNOx)#y~fAX6(cDkFIQ!+ZHujBeKtTAD8vofHbI8@vlWqa>YHX z4eEqh_ zh39yE;>~*wmLK1>N)DY^CvTZPNR~XjUf#3caA`~S$Vw$YzEZ_H;Y*vkr7PVdKRR`H z`REPL$vbAh@O@4?gk$T=adt*teYb9a}4l z^#05$SxLSRy&HVdVhkA?HO649mx%Pf3x2BMMsa7Nnd|RN%T2+Zc{=| znl(i3R%`d43mfIhmF==r!_GTmjGUr*TyXPJdHC^-Ha`K6&)L^6menoWKB;O~gRhk2 z*y+JIDKmM)hX>lUmtS3`y=v_)Zt6^F?>=rbfm^!MGO#i(zkF!DJiV@6t~hbBXnV66 zkS+}g4HlN_vc`lF=VY}`k&Rmoi+7JeK>l*86y` zZ$B!lzj~0x&&ML|sIhQ6_hP`)dVlhsuWsQ%Y14amKt-vN zHy=&lOEg%U(FZ+NHYa3LM@D9kuC}pXUQ1iJp;Ly`l*#bgn3NP1%NixlmPA@64z4sS z7fZEOpRM|eSifJMdA-0F$9KH$aJyQXS3R;pK706R*?UY)F7)N&j^~=>8MOo+T-GKN z235#6kDrjc;&8ltJh`SrK79Ria_yOW$fPi&;CM~L3Dxns!*klR$5Py5SYaBe#SLAu zyeTQ#QJ2HF@--TVCI%lja<+Z8)Ji91e%WQ2_Yj_zs7|;cyfPPN)ut z!{Klg0L6;jp~K;DI2?|b1Gu#4-h1!u<-^HY=1)5u4u`|x*d~;elt^1!oBTgri;uNN Sq0^)Q0000L0Z literal 0 HcmV?d00001 diff --git a/education/windows/images/get-app-store.png b/education/windows/images/get-app-store.png new file mode 100644 index 0000000000000000000000000000000000000000..14ae888425aeae3fe1ae80fd96563093f49ba550 GIT binary patch literal 144683 zcmZ5{bzD?!+pQu>H_{;kk`mI5gfMi6ba$h4NO$+p-5}kJbf+NFFm!hh%o*S3eZKFU z^9R3SZ)Wd%@9Vy5t#uKuq#%WXN`m_0#S08+poGec7YMvBUc8J(egi*4212WXf4p>2 zkrI1RJwdh)KR~n)l^1>SqBa%{YV;a@jN%CV;_~7JX3yWBmv8B1zQ1?@E0UHFRdd%r z>O}fpr0ya7yu4b{eB9YH<3-3c_a*?r^|Ib3N;3LAZS8v!S>s5Ob`^XaC4OX;)TSer zC9m}KEd7(^)#u5})ko&~-lMvo0o}0MvFuI*zNgI7j!6&2%Vn?A&g8Z>{v?_AEsh&K z!Dxgmx*bUym-lS^{HT*7$xKXAWKI&twSUk5{X)MiX@y2rK(j8(yuIGPSLi=rH=qBm z{-5J#bH^cMg(5YHqPT+L0+qty-8<}|)L-<;F7*7xN!6|YF4W>~wEm^m`15vYK}`9I zu-g{wP8I(IjFN4b*5$cQd?K}V!3q(1qWmn|>d!4$swPvKMBM^Og9Wc?YJS`M=V4nM zosiG_@D$1TF%&#TN$^iQar%+$*;QK(&2vkTVy{;tzj@jBfwD<|H0>&Ct+=3#YcgI8wLJ-uQdeB6|zhqS$2rI`=QR5JIUrJwg7kRu-6Ds3;@B!1^?J5A1${6oa8#8}bG{P& zYCwvFlXpmH=-Jr4xE`Vz29U+{n8Tgm-q+3?^4C zQRq)$*0I&vKdPT>$}4Vl*@gI=dQp0MdLBLBEIBk=r0P1Oa67CtDsdz+cPDQ5p7a!y(BH9F#*PhYq zoLpS#KJirXcvhZYeYWDI0J!0QYC?)uuZnp#s@qR`D4)-es1-RZCOCWQO^0zW#kDEH zYq2*st_=+h@34{6$p7_sS<29;b;OG=?*t+M@(diPrjqN^w8QL0G)iS4nKH^`r*3QK zTI7-alAM@R?_GhGs~OqoG1K}l)KnlQY6O4)h@*h2WToA0sq-l8#V}Bu8c=9}p&VZ6 zeW04do`4rSIG)vH|9dKV=Uy&HcqOD?q7V^7U7Bg@zftSHzZr)^7F+U=6T2mW_*wWc z{%QAIJz7I?;Z$|%Ozi_fZ{?TzvmG8VaU>xt_jtt4CNR)t?BgI2aVsQ($+j^uBTKbXDlh9;tX^9NJA9rv(C@TR?W6!B;>IFx#v<;mYT$gKZbUmKbOOL~2_fX!2 zTBK)#tyn(8T$>t){{OOuZ2=hU#THB{l>Qn4@bRtTSRjnI`DKoK06HBI4Z!cM%P>y` zJ77kBtuvOjvmRC$HU=~)u(7h>{90s0{S8i|g2=QXnj)S({Aj&flI zlG1=1tYwH!o1re8V*lgMESUR}ev!DsWYZKsovMU0KXKSZV5#;|gGjy);C&C-y!S#M zH#+k~P?rjd;c^2;SotEaL@py^zQnnb+mdty#=lx1RWz3{9#}&Iuwu623_LQ!be%W< zF)!3^J0bjLUp$9KS>>)t07Yxan|s&|MRsLcdBzuD&GG-6B;2aO~>YL?Y~)F zw_}#de)CJKv)OhSb<7WS3GL2*chB)$B`7SK0K;lcU~*2=KyMneCtRZE{l9mLO#L9? z_!Z|owYLWyI#swFR1_j77-i(FF*JK{Co&rzn_lvRlDEyd$w3wnE$_S!3e*_ z-VGQ!3jTT7OZhwn|C7E_%k@Zbqy-Y!4E&khZyZr#A_?Exn;iG_*9R^Uv^$dlRmx_mP{gfb2RB>x@*|ZrHQlCYq&y0tN*z~TxgAdHTjzYcnI^Za>Is{LCW4t3 z4?YZ^JWea|y~_F){yM}n?7Mh=w{*#`mZQ4STx!a;wzl=l`!fgFjRWuFQT_DN5*qo= zefp&L8<*XQeqxKv+El3Jx9DneD!P{&adDGACoYzDc3c}&?Wp26W>U8?q(X^t)1Bg_ zWclmJWSzhII-5I>?d~?P{K5>L4m5e6u6}*w=eG`$J$YMv#6(7?03u_8ebzTcTp68k zM<}pqg-y711s22#FNVe7S%h8M3b9ILZkJpPF-ZL<`p?JQR}rNUWW?Mz2cq5K?rMejS?sX~jkT}B;K>>t9X*Y^ zxV9FjdDWAt>pa>aH!ts{|EHhX^6;!iVvoX&aXOa4gEc-rPWxf228tHitM$Xs9|dDJ*}PpF^T=6CGxbd z=ybOcs^jh~;B{mBi<58blaso8UB&Ip#8Au;)9Qr*IFf+5r_OBD)(UhXw(l~-&dzRp zgRj{?EnN?xW5*AdI8%gODgJ4&!h7DJeC~#uxs%X8o-!i#!V=yBc!jV1Z3?`qc_j;! z$I>|lj}Fs0RWEc3XNF&)m~5NK%0_NyLFYRm+go#yuTgB{`EV5a4XjibDBy`#Ln_I< zNV!k#o7_}Q{fH@qV^`ntXb5?8g`ANdob)DnX;Ap)qxW@%L1PD*B3l-3bnN7vMH>aB z16}q+{rRanI7zYG?LUbIlI{f5_D0!zJZYZ{dVtbjf|IB%Qp z#Dv|&!YsuV!O(41`Aw(oWKGbG#b^ri-6I(0^|xf-t=@K76v9*X8sdXp^Ge9y+}?6n z-9F}k^A?Ao6Ly&cvklM%<;k+NBJSq+byps-^>9#8>+|U9Lapn4 z-cPGVqxH5X2L|1hq=46UTTt?;?`?Y;|F`n~?T5pf!RD@OX73F&12zDaC|z@n$GFW0 zN@4hJk(S*pO!|g6_+Dn*{mOX`;+Pct)uWs#eCCgJ^d2A6^>o$FD7xd>eq_% zCriN1`03&L&kv)(BCEsSRj#b{@Q(6Q92`TQ911Kok&-Nw_5$$UhB8J+#D=vWb4SOi*KKRTFJ)%G!{05I^%xSUot?iT#U-X*kAm#Eb5 zTtx1>1;c#s)^Xq9CZQT^0fQt#8B&x!vkge#yM9*N{A#Fr+JV2@*RShAcnWN=tr`gR z3^h9yFC~B9m)<%x&S&6FsQlDoX|5z1ZL}b z?iUeM15==WlU}PP`?#VBA@W8{l%EmxkD~h}&>tTjqLO4>sKv_fN+}o&lGYy7yR4~4 z{<^lLlBubb8LM%X!JJ4u=Nyk!z68xxg=fJ-f%ET9j>22-JZEKMdWYoLaxX05yWHSf z_j5=msl`F3@9oio2^dgKqCMMqP;w9x);iP-RTWeR7gfdQl)nPN{>DS}-XSS52}ybX zKTW|AR%p47q?@SOsCtYB};S9Qlol za6RL;c+v$>Q5D;?;(VOKjtgoF$)M@r%#jS*%?qWdv%p>VgKknrxVf14DTqHH#riGKnNDEBOz8$UiiJ>OJQ()}?#u`l4uO?5 zCzA9cN<0CE(C|>q3_ZQKRbCQ>Rfoic#1Kv2+^^KL6xhLdWM){B^kxE(Ch8NvN6}YC zbQEB}`aR9eS=VhRR;=Jf7>-;k434>M`$Q)tnyOoONPcYr4J&N*<>>Wre>X2XqhSgh zv61qtEvgx)@!%`s@Z)4AD)0}Fh%GX9ChD|K>oViK*{(&--ti1aE*G|TSMzZ0f2+B! zn)8rkRhKmH`Rtunm(sK&@8FqerTGlcLrVwW4}u_N7ufqMe2n&>!y;$GZk%{;==q>s zsj3s9QSy$WS&eh&N!#I3D>P0+RXmGl*)eb-(Ol{IKP^_|tIarh8SF3E-AX1OHVP;z zkSCe+&rwOO;|x=k;(kth;b1h0s`bO})YrG&HhlkwcUW zlA@7X#6uy!2fH3?N7j2D;40yoM}UDLz@)HnX!3gERN{aH31z=1qT)uxGGDJM=CHEh z+C@q;(Muc;JO*6pq_ZSfaRhluQ=qu}3=6~4h%64?cISo0bA%d$-V6eLH2`GuyR!C2 z;mWj9N|--1`NbSI2$%tNuibT{pTw{6I%yr`^xMt$V(EH1cF-Zg&x!TkqLx%kvLCD- z`D6y!%0h0~5gv}Y5Ca4714i`jkD)T+fP8A^{LSZ9F^?*!TBmZyTgBwa3#G!@Y1}e& ziLVliNi0u{%#4)VU6v!J|;Z}2^dDc+0a}wja;$nit0j2XbM${;8 zu16fY?##gCxLaMi6Ln0q<>=I5{pf3%3VI9U5+99Fqm&ajd*JlM3g| zWx&XJ5IV?vyZ*nh?$TgOPF(+>-{xdko@d3>mmWqVVWt_RBu)ZA#my#RPXv$9waz&v z?d())H;y1@?ZiXZkwkttyMGKVO+t#u8OjPl=c+7VPdv+EH;cgGjn~$*(NDdQ?-jzm z!MzyK#LW$kHzaI^B!p&sDVQ=(=e|c_|`NIYn_>*kfL#dSQGU%7QBC zUdi19jB~yE^_-Nl!_gVDQN`zF3aYnDs>yF7N|s0W^y7TCVV7?o5=A!{)-t`Fb9YfS z@2To&t0G1eoYeJZ$w;0e`sn=%v#93^v2K%$m%dD^Z zX@K^Son()ZC!NRud_`xM8`Yq|D%sWIZq@x4Itsc)(ec_J9zY!4%mi5?wC&VeUes{( z-OmRU^iO9p?&>cRVHkv;?XCX9bF%#fkYEN&OQ}Vi@%snxr+0;U(?4eJT1wrjjcETu zL^$DzhV;)b{{c-qfAQr%c)5R#Y*~5$j!7-wC(#nO!*Swzo{_v;0-P$Hq#${4(^USK z=X@?^%U*90SNrF>;7BlE3*z8^o&dgQJpa$_4P6{F#c5Xf{ufCzX7cg=?G-ofpKrki z_shG&7NHbv|9ibkFmg;x_cZbM>?H?qXTEA?V{pg+;%s7mKuK#WarRp#4Ye5l19}1c z>HjXg0VzT!4=r#(5rP*_pxHv5nd?KH7x({Q+agr?#_9B+3e6hdh;_^6FaK)<{c`N? zX@zwF?+Lrp|Jp(~;J@5M%UwpGEPU(!p*;UTy!>}}|4UJf|7XYksf7QpMMA}!uqON` zYC&W3=S_oPk)#qM@+j~ejmYiSzh<7wUrZt!N%;wX5x>Z^sQRciq}@1dGLOA$8RD%n zTyoD%C*Z47rkLi<#SgLb9tPhW*xVkqIJ7!wg&UA!1}_S1Z^}2k?n5>f(Y*97+szGD zhe=qst35B14B$I-cbNOYpaF-%6>D{W?I`zs*q$Vdk1M{pbcNRxu|$`JwDml+=j{F! zL0zn*|L9pGmo~fEv*wP&_pO1NdLb)CDgv1~AcOZg%>p?k-sjN`am=k-{UJZv29;{s zrXv%jvdg!RNp5y87juJF~!tV^9D-Vtr_9R0P@qd%`Wf0i%F zFkc~}6mn2O%ab2C;`&xM^1&TJ@0B$Euy!H&7xs3HT1VuUB0s)*;z5)}xWC1$&%4!p zu2$;4+Tqprz4{RJq<@8B@uOWN{L@dV1c^Fvu#l;2JCfuyPm+I5W`;y$?yN%Lk`fK}3?g_lz){XH%U^kE*{{Z>Tu2^Fb`i8Y|jrF};3X*3r)FW?1=UKogY7mY51jfbINdbyTb#53_({v|= zT(Z|hxEeHWZ-x3+Owx|FhNq3iZ1(oK^_WiHTFi^~kG7~zz|nxRyLUfo6m6onmU`SD zFMZ0H0ul+5k!@U=dju58_?JoYI;xO%l`^@yM5#QjEiR03#qjyJWg2^uH>3TyYlL^Y zr{$-koX)DnoigFl+#<5(^9@|=#T3R=>Xxzd{Q=P2wX1nZ?hmUPE%TNuu*w!k7wftH zYweNUw;uYZBBV)QVw~8X)8*b_f1<&yMW=8$4gLemW0%nV<~kS*u5@1sRvyP9cfS+nmf5WzRd7*ie9W4 z&Zb1Y6nl75VP~8Vmt1T0rK|U&AG>24$ROljhS`KzF*A)PO*|wMRc~3+Q>GJ=7{!d=7IMMyFYgEa-PD<09?0({~FFE{L@^Jd=kg&x8Pt@UR#POEck;Ob9 zky!hMKy@9jbV*k213=oeN@%qm>G^;kjJ%kc5A%L@@7E0LjGBRg!#uy85UZF(7+K$@ zQ+rB;t-CuBTp&o}ama4<$jfbzPGh3DU3S4DAt7-bVJOieD|g8)j}yYlJ>Q?MFHB?E z_%r8pF-Y!4_FAUVStRu$Rba3R!p+NT=}~Jr4Y<5rxZA%gXo;1IFI2Od6-bYd#~HnZ zM<0nSyiYwy3*o4j`ni@~gPNx1BK?AsyCm z@V{7yHGD7O1d?FM3dk|e8=DZe3hFyhb+NcVR$ua%ib*{wRQvNdk}Y5mT3kXTTHZRx zD+i$X>})%BWK|x%x|Ea%5|DB}|1Ec%oIWt{CMr4xlrJ&K<)(=!KfAMM5;L$FD`f9H z9#0-njdhIu7G+`ud`Hr>dW&R}>nROH{rpCa#YjQw)oV-?%;8}t7abgnQ{R;nVdz=0 z`p}MS+BE1V-{9o?vU6k8520Nf4LD@)`+|}uBddhO_wsY7>axGa^t2FEtLWw_q0KiN zK2)rt_|bH;MOu0u(b3KxKt7T+=8m)9oFof4u7MQXi4;_6qITNo+nODE)_hJS#{?h} zrgYe3W(h$%a4I=^$-W)K0FJ(IP?gPAYkaSnmOT%vS`Nx9&Q?x+3D@o?+w~H_shHu;KW;l?(m$S^U%P@p}Jo!yCd6bXW;oW@8stMxYWWAo%eep3<(K|Djb@`Q{e4}R6nl4*^9el2R|D# zYWB;{Qy;8Tk4dkw&ak)!{uG+P%JS?EDsfCU!U>~996+KR1Fh0&v+dcwp$3}>W>!=+jY-5vMP>}z+49uKpXZ-{k1$4op2RWDi>Z@>&%1#` z3Is=a)@V1HF-VD_NU!Mh9-IQ|4t;v6R`1gOyz{H4;iFI_f-#>p?~L2S5$f`4JwwEKCMhjzUNUpj&&=i=-E;Y#Y;;%H2>q~r^XmLdGe z_lZxT%wK|{59hlT7cAG+}_~DD4j} zJHBHLpC=1xIkt?g1TGc(KrU9nz99DzNkfD>C5F-Ym869DOWPx|z5*RD?A^waeA)_r ze?9}#9Y&5c9<*Zage$g!LY<1nx9F%V#FPox;3NV5^V1q^1=ueo@}T@H+jg~s_%Fw+ zQK@B=&OqG^zzqm$2&!fOf|qM5ftV@yyAg^*oUo$CXhtLYOy9{q!6ACGm3kBz)p2a+ z(7Uwu?Aoz`;qb!%C;TrG^GdG_`?D*2%Xjpr_SIju>*hh(bTRA4c5$upVpT-H&c3=} z*4eizwrvGh37X8i;V!5XC%1#=uZ%Nz)3^qq_6i6KSsty1s%Ybf^n9z{ZVsuxs_@#5 zUL6K&c3mXzl;n1(wFLOWu1Z9RyOW$QEa5^l?|xz8hcz<4*W0OynEm1)9y&oBs{Tpo zoa{qSZz0EXi2s*ZrQCq=6;a)G!6^DjjiM85f1g~WhoS3Un^qr%T%AFO%Y547t(;3; zBEL?;hF;nozTWV9&-%@RNo(tu4_A&e-v>p{)yVEDN<|8u#DfBd9XXQq8ZyIrVkE_7R4zWQqmy6$TBZ@(~?)>(U+S3AR=z$M|8~03Q=9_ z0h?BMWhrD+CnR+=d1_W|(&Dwdr7?~t0HM$E=@~oZjg-@Gn~84L>MGpKbGs&}N(O7d z=3_hfv7NP{xmjlurb~MBi8o9gYdQM(P@`K`^kdrCyWXH8=hq)HSNr6QjMMkXh_h%3 zc87jOL{$=fNh>U2!7coLo^L~M*Q?1GU3tW=0N{E58*!MYwkMtWTUbyhGTWfIX=vUH zj0J^1WA4&D}T+yT=Inn23`II>=VFBF!Lo zBvo<=XWr}nNFN+rPnN^cSUaW=cj4%cl$1i{&GRpjr^JQ(VMX5n%?`+0I4ysNwd}qb z%^h?F=h&Bnx|V_TupK4hI$Ab2vSvn6z30g`{q-X6^AK z8x07eeUCxM!0GJT+AXhd_OqWr(_Cw1bo2rb-Fi{7tb^yIb~`G_T&OCyJl+eq^@_*@ELy%`V7erswV;BVF6oAjnps zbn%UXc}I@f&bjJ+p~b}Y-7aU+%#9A&?U5n+wtu3CLb}efJFKDQ7w_Vxp(YUHJG$Yj;Yd^NM4XR!@Cr3MejXLC??cp)MJg@lVDBu~T}A+X{^ie?H? zF^JsK4?Uy##_&mUMCC!1_A*gJ9x+qTAY{`&$C-zK`U{SL32CMUzvO@l)Qref^ZkgD zB+}=)8~||)ExVMM5jF6E1>+)hLTce&&H{DlmxIr%h>RYkd&ZLm+Ysodiuz7&lEPJm z;Aa^SA*#n%W;?b+%NBbg23~9A7SO?==35*l3g?Y^Nb5$)bWPBk`r)wfmekS$P4wv0 z;^f+ZDKE)1;`ejOv8SC}B2c-gdy^{(#*b}GNzz)3Lo<3Y^XxP0-zzcw(`XT=vq>1N zG>EVssGR$JTXD#7K0FZsy9%e{wdH(Iu>jP6MVF%ocw@o&k~x8j9gxR*wA#6Z*!1pV z>esKpN#C3LKaDno)txumg7;gAlJ+!lYj*=Y5V)LJZsjlhd>)%2DcWlwo65p6$3(V}m`ivMcsYP1eD?C!4R9&XC@0qE$b=h7l12_#Gxq}q`!uRVUOTJWhwGt5!n4CHULavbz4=Vz8@&nb(do5~0E@;r02pP{1MZ4WVXX6lMlA4w+6!Tls0 z9MESo+b)V@%ClJCvaC2|ydsF^q?+A?KFsQ>NFbzU?Cf0CNP#UTD_qi7UH%y4_gHAQ z-1vc^Gi7J-$zP6(GTT0Bprps=93AGhSRXzhU11s;DyDSFWXAYGY49vr)I%hX=4!oc zO&UG%nB#7sWZg%X3U*b+@)bYJW{pFDyGo*18HAiTC$|2anYUY}^;B@Gt0@>5p zo}nv;#wwKIs>%cTTdjr~Lc>o7o68t|+vVS*UL$(Ah!{Tm?RBTI!6r-@`_ZWs5uZ#i z&1h7u5;wk96S05LzkF4mLITr#uv#0e0erd@X3rv9!H6}BV^qr4gl-|w@S5QQ7UQD` zr*T9|-J!_r_P(8Yum{PvSXc-|(vj$8b!0?0%oM2ffn06_lZ8nad>IWoM5Ll|%#t)@ zpXiC+C2rPODGL_&4{wztQjeiWhZKgNe{`auzb()#QPxIg!$BHKCEc?VMSvo?F{9s2B%gN{OPJ|K8hVX&@zEuQ&K|b!g z&t=A1)Zd9G+CS}WZH_k!7E4O8?*I@v{@*p6q%&v0J6SZq;|!6des~Zxlg}k83Rr&z zuNpH)`d_C%@959hc&!}Dp-~xC7!hG4O8qZMr~y}4G! zg~;-3tu)C@!jjK0jisni@xh1wF>>hfUjA`JQv0f8pl$I;GaAF{l&h@l}W%^9FX58JA(Wppk!_KWV9>7C9W?M|Lwe&%WX z!3;h3OI&zcQAxWrra#;9=P^@d{+?sjH}iHgx|Q@+0VYpzbIDUlgMRqJFR{ggR@_3J zEjmR`s6LcSOqFBq;fsr^R}J{waaDTRPWuwswbCHQ{R1Manag{ko}DVMA0A#j9lnc~ z4;5Qw1l7~YxJ3+JG;}%9i0ZR1>Wv#kq_M2uYrhgm zCuEQf%cmDgj$n~iFxi-W^SATq?onPhYkHj1;^>S@oTLPlF;Jybh$mg~Sc{(9Zba|z_kailQM@?l7Epd66Lsvgu+Jo-t_)U??&*t9;J^;8-gI)#fx zqS}6ae%#`FPiuQZBB94Ck&pk0cklfD%RIYM;mu~<&-M;vJyw|(95_oqxLf&$7(|C7s z%{0veYRY5ZzBHZE#i&9}$W?zI&o=ubEXZD&e+ERptKIWu@nv`VA(e6NJr&5C2_w3J zf5s5FZXG6x?S#9fe}ZVmEAdW(v2a`|Enrn(OJ-}JR)oTncBa6HaJ&{*BBIa^S3-dd zCNTn^Sv%6+OqYp74g@AZPUC2;)H%rtIe{F7ZUMk}Jjw<2KY+I}DWBuGWj970wqv0L z_(+3(qVt|L8*KeLB-HUZ@RW}X@SG^L-cE%oQA9#{m3Tc%pf0p|C^F3uDjo&C;cQi3 zmS>Qm&>7G*BviPJ%>&I5s*#vn`u2Rovp1DaIQX~||{t&0A8I4g=n}`7~u>#)H@m{AI%p@O7+Ty45 zC?nnMQ*+~J||L(Y815+z;DkR%5W4UhWQm=#WPTuxAM;d=w;YBfUZH`CUPM*7lKPNnSDZoKi=5h?jKwi24Qbr6AIS{mXqC9!WCXMxAIEW5 z5ck3dDBpJNoCZk;ZMijS97i&4R#^jSW?y5lGE9IB02{}a%7voX>DUsyWXA!^2U!g` zxWzg5V-~hC6MskI{-{`B%!ScgKF2iRm1Eo4*?DnM5gK@Z{9XCQtWXhu(<~12rwi+ zk2xMAo=(c7fRpc@DQuk{ixa(+iYEBIae;@x2z7klVGWo9#6vsO2~8jkuG$dBsAqT{ zLBdEJ2XT#tK)Ya1r#f9WS|d~<0T*M_FQVymSoFOSrBgJS!Gt+pgP&XO=_m&>r<}=n zI?<|pZ+3=6bJX|G@P3!$;5lzbElyg99bfYJzdN*+BR3Ieu;#mWrhKUxxN`6$arq(F zQTFR*kQJ8oMtSGA9-*`YYlZ!Aw_oXT#W9{1+B5E zEZ|ajn!e&bCZm2?X81vsJ0RhG`0x&pKjOXXvpBK@UKm$HZkY)xfAOT`Wy3;R=N8)s zp$p4Q-vMIxYa9LWB3Z(C;f6MSB>oT0#{uqk5XxNUpLWRk3tpOv(w-wd*vS$sAk?7^HQXJc z{V^oIY~0CXg#m3kGmN7rN_aS&mca^G=3+Rel}}4FnKAQSi{22Fg*5M`uBrTyQ6|&3 z;$Yzbv9`dxQI$;<`&=9Ek3^DlzaY087Dqu+?b{C-bCRhY5HHH$6o%o-i@4~S85|cK zCkVs}cxx+lG6zG2&Gsq{AGb%yxPE@Y*-?1-cL2^Y>E@I6YkBjzsfe8%%lGkP@cA!0 zmPkY}Vn@UK&j|!Vgj6%8dfS)7bUC(&5&?RB;?KZd>Z;(KUQ3p6P67ZB^r4bZ=}VyyTf9`aF3Gv3`zJH@G*~%o!!A>RA9vbrc5JLJMxx+iq;#i8%sG$P7nedo?8>t3M(P6VX0KWv^o25&j?U7>#IwZNn#E-s zKZJotzB1UOKjgkr;~V)GVn&-&FF9IwBzN7g$HcprEqW#P8Or9vqk%Q zC|r48{oap~=na#~4;$EXqX**U!Ki{5E~)*om!Lu8VDGEiIpm=7U%;qYC0~Xr;gt3@ z11f`3g-`h#A+y(+8^mN zor$Q2Tkk5(EUOjcl9T0@0P-VR{GsGRy~QCmVZlF?m_TW@6;0QhtKS6T4b6!ZHT~J9 zL4AcXEL^|C(Mr-iD!delGSJ|@l(@5VrS*d*TGdSOoDWB!Bnufg!k0V zGLfqSljJISw-3o{7pf<3S54331uW8JCf_z4jb?>xTvfQSJ6GH~GqpRH*bs{vF|O8a zesUtAY=T#31%2L=Z3W32v&q`cK1JV(4*cp1T_axC?TPUEqgMCxypGuVF6j9!xYvut z4-cfh@SE=5E{NKFQ)D@yFJEj0_Wst?~WISn6RPhIjQ7r1zF=I#5s9S3KI&!(<0oztr#^gYakD-mm z>G^B~QSWeLsmK)H0l!dMWGw$tnw+o}GCsn7e0upCCntIx_`7_ZQXVry#l+n*2~0ea z$$8O=?ra;WT1F#@BvrmfSa9HN!HwE0bBv|Z6hfq5NfGaul(oRmS&LU_RIyOMyRNf# ze}bmym|u(N3!U@p(VKrpsO5cay!pYs=i|Us=#4I2K(e6V2YJ#IW9&sJ9SQo6x{8lf z;!G)a1>lWZvK#awTVxrfg~(CqQM`h9J$3ZYs&BnDm^iqO=rTSSU;ozMVs>MMGw6e( zHFR0bxi)OC!Cl0@jSnde8h)-i2$2@t1rCn{WY^P_1!mpT^yUeP#Rf*Go;(ZJ&u4Ns zSwC)eC+jhKyZxa;L?SuN*|9mBD-`srNP$oNCUv`bz2vaf@X$y?O2$xL(us^}FfOI% zqnV|ReZQ7d*zqSOeb_MRG~2Zne*K363kG-Ee#CA-Qm5I?qO>!Pm@v>tunwtz`f++{ z2vf-zCnVyiP>CH$_I2Trp%LyTU|4{ZE9?6StERx~#aBU!W0Tf%o-*5zl^oQqef4P{drk38qwk&Zvv6f^BtWK`$O3E)AwNll&% z0qgK7sDwm>AQz<8HKV(Z5TnE&y87W%ZK$^#ANciifm^y{>WEf}MvXmnUd8a8@V1$h zw6a(Sy;oqz1B9c*|FOJQE9;ACiP0ai_{hy4rpp-pob5}46#7w+J!*?cS~ljCAyWPJ z$rp>=s;O2^O;1lq00cE3!U+%+fz~IX+jZV$jf)-= z>)lWNG%be2h?EC<%#7d0hfATVUn-ZrWUVtoHnDyf8O1zC)g>aFYa%%}(Lz3yvj09k zX*OFW@#Ht#=j7yYX>eMnCgmR{m`g5O4_mNndUf&Q%l-&?C-<#n7rgW(rhqn$8o2su zZALvij&#xKJf6*~h zffvz4p+vt&DpI^0_00*GHEX3uslG6|cOKEgqcpp!@>6_l))80n!(8leTjgG^g2iAlge` zzc@W=Uc4S9pC8e%uL=dR35jp(84i#npMwS+?uA|Ly%96GuL0_qR61juTF&2jz}xcN zg!K-N*!)N;izi|Viv$TETY^^a7}NK?Y)sr6X|YG`I&EK34oFSTf&;@6`)CkoB=W*A zWM2pHzgx1<&K0ytF45g`%fD}>Y2@7BB699;AWvhki zTDprQL4~#ClXcZ5;ZY(9VF!zu+IMd0^q|l4O>P)?@7_9^1P~8t>zG<$##r^^+QngW zNpj)S%sIcNCN7S|h`H~duLEGja{^bgR$2~Xyc|c$ECiVov)}Oj_S$u0-(#vPdw$3o z!(3scMY=GdoIO(P>+ahoUbkeXE%xx6)N66iJIC+7e=B?u!!)%z6O?zvhWicetW9zC zh2N&w&8nqSLb(Thc?AQi;ODIceYx;^$5TZZL+%IMz7GwN?J3k2+G)lup5UskHG7p)sBnGh$xj<8a(wClv^4hIZlrDJ z|52RhDulCHptNbE*n7E6d>}`_p!JI8tA8#b>2D};h5bEY(m)$dRHKSv%sV}@0VLQr z>Pxl&V^BgKu|h`p6_AntmhL%XW%|KS1-tIVWoU2m03A3R)1tYfe*5 zNV7;Aeyt4XdL%ZKVl7aQ`g6xgfaZFXYRq7xrha%dX;X%)JbN3zTcd5HUsRzbay+bI zMTR|HidWwPO&N5TWxqV;{9!w8!cGlbca|xky!UTv5k_Q{X6M2<7uKEZ(2Krci0k~1hh^U)EUFM)p;1O=WB;fUc_A= z%DWf7XPu`D3vWsAn+os|P0q?2Q}opLdbIJxM1@sb9<<2^6`1Eb@j~8#j@(UrN6)%V z8yACka}rlpeFw?i`$r9Y4FjkjeXFi5h*WB2*7%I#)aWw2w198xbeFcLwbMX;6I_1k zwH+5s1_j{6+#cu!u;vT?c?ROuph|9iGke5s(4t$AOm?K8VuulK4DHRDBucko(gogMVWZKYdo79M`)l9C~p^jAvUL) zL!GtQ=u77fLVDduqe4R0b3}B0iGJRl0`^8B(hHrK5I)js#%1OxfkcgVVLFV452+iU z{UEHkXPqIbAY>kQnb2%_{9Y(AzSfCQO0Zk9@nSML+b5_v``i~o$7+*;)M)b*h?q&_)47CI?F)`%+5_G?_=v zn*SBJsmT8d{4mbNirGDltAG6F&}6{U*zs`LJi}w9-37T-Zq?j;>BByZT1kb&G-Gj2 zBjZM1#xYG<65aS3DCEq;VVlFY8Fpll?Hr@v_DHoB^2ntsmq6Q8bCt*1jM zRGn01I+3V#;5jh(_L^~jOO;EsQS6=UxVuI#2?H4#G4o#f1G_~Pp)pQir!2ivxai%$3DxRsu49` z_=u))H?o4De?|=$72f>lXi*jr5y_g|RB}i=R*N#syiv3prHj5Ix|0X4^XA09bFSux z;die+5^E^e3#?*wVkM+q+1)Yp6yXEpk6VrvMLx0d1h`CiG}>|Ur$Bg)h#M}QK_yw= zwI0iW9_9c8`_cqVc8c--c#@tQ*t&?k%x`aeB!#$%lA@MKn&E8y1HOU|o)|Cks6d<~ zCtv=wzJp)6hU6s|gFWO(UIvko>sv)51OC5strWJOb33k67|$M2_m-VG-ncGDCu6O} zOxNN|n}!K_jRYCu=Y4w9+fUK46TQ|mW3o1$ExdBPwnX>_@8ajryI4i9#&q+(G|^(S z^6gk(>(oh-#Mc!T0NzBalN%J90FxEQ7>(5O=`EjOPRrIf!gk6hz631a5Oyj_VmwJV zYjle&9~?>7+YJj57z2o;NC<^GYq}6p{$ZMcwLFgRx7j`Gaa3&GMgSV?Pq)?AF zNmO)X6*eFzTVQAGon%l~(UAzPrzRj`^}#xLL9_4YKe;=e6B`SClEOC3_T6{M=|5R{ znhE|>=zG&@_pa{>z*!{tN!avx0PrKP`fD-#pOD-!eBFA-k!W~Bs~P9mJHDB}ifMOb zz?H|rzj#mP^=v#QWd6oLQ)xzP28J`6-|jaRut@Kq*U8|(&UEr~Z$(q|iJcYY4YAG~ zh3rqfk}SjTt|wyV_sl6}U7m{{XGCMQ!T{1LF{T`;iSVRR_fu?N?QpDAH?1VlkogYP_DPHi(%usBT0RiC-o{G2WgXp*prH*q-8# zQXS;8+;6@qoG$j^uM>S-u(WDq40P3d9`u7s31md{%`*<)g^UMB5|UMJ@^jFC7A1rr zsn$q`<^_GroVC{UHuL2GkSqdvgh?N{uc%6+6O~sq19#&{MZsS3$BF^VI(gWEJO2m$ zKmxz?F+2+6yKnqY{N>mGjMaDk7tTKZa7^WQd*|=2#%R}e+e9=oRKVtkSEKW>TQIi$ zI>fv?5Up+F~xFg`j8&l;-<#-7)pp$QG}i_AEty6K!O?+3Mbs0=*Jn+@yk$3wSYjRHGc4Y4TV z!7!qAF_t5RVljXvvo1ng#~H{`uvr{l1njK~wYW}1m1yppb_4Uq>K!j-_TzjX$j)SD zvWMcwy42RQ-ijs(SL>H@lsFwvu>i z@-N+Fi+JenJMh~pe~M`xVG@%F-7&qalvZb%Ud>n4d{>c_LN0^Zb7taQ?|cVe0$=&! zzoIyrLTjRd`9ZwQQ>z5H!JoX@qkS@Uq835Vpc zO$ovqZnzOU1~+2X;Zv~f@hCru}Sv$44kmlr+3e|0-buzd1KiNlvr5fb( zqck#r!C(J7GMiUojAWv)b3Mxb2+|MVsvXG??3j&w&rXc|@yAF#`4GnLxdw&p>!5?r zQjgvN57}&J+Ct>Ix6;lJ>CfXBz5UlH?AnTQK8@u4e}s=c#X$Q^6#8~!cikwUqgDs!${q89r9aNAo_-n*$i`ik?L(YkOoG3 zzi5YIZBVGgFhyi^RD<@m(LOdh*i)PT>H4w99y5ZY<0wRemM>p!$0AO2tn`7+!4LJnA#s zeFCi=hnax3`IYj+JUY}EpP@DX^@#B`{-Q^YnQ*Us9e?j&!tK*wA&w7r98^8WdufLM zIYV?#y;jYZAJTy6QttGhG=sdgNyJ`nkwk-Joe7aUd7@*EVxc0=SjNt7VLMhVzm+83 zgDu@-c=E}e80hIoV^e}Y5F%5Q$=Y~N!$j3b44LIuC>Knooq5XXShM;GJoJ~l5bHI6r+qE>)KaB)A1*1;9j(3Vgv>gfMVy=YwOBdr!m%Mq>(I@eXLw4Av$U=Q<6sNr5 zaP)2)Lf`HYn?NM?pBze|cl$8f=QX3DjjWv+ICI8KBR5AMeUxqXGjrw)w6(QbMCZ+$ zYv%)~{$&HH_6O~E{{%9+jI+kI|;jhKwGv9_;$G#qUf4~~PP%coN z&}%Kd4)zmSDOc;MHSGHu)n0q$7`Av`N(NuC+EZn-ib5rbf|fITatP8{ncw4{ox8B| z!TZs(dkc;}_9Ps0=6OhwTs`{G?by9>9dhh+B(rI3zU^07b=@a{(T&JN1IUC)z}Ps` zn`+qOjUMg~<18wk)o;3bUG2BXan0y?)#^S*uMQN1gT3}AfjxID9Ka}ElRbA#^*uYE zB$1)U>3Ge>A7@8*8PXZ;oh3S{c4rvJo_rzZEjHD}t!K$=S# z4|9+tnh6L}R!Q5#t|-3;x?_U!Sr6)2Ur#;3hnZ7h=Rg+29z4Fb2dmfauuX9zF?JY8 zj&#bm*Bc~(DA^9iQaEHuBDA4jj=vPymX6zRzYQBUY(QNiM!7*U&wLY^(uw1GFM{eL zK@sWU7shmIzqAUDI^rmN{9_+OYf~M5^!@+FpRWHsa+wt3^)cI*N8g)`j3^EHEPt!3 z6jcu-vsFgY)@YhXk#-dujZ_~@J+V*c`9c*Y+7QOB^}R?9rg8pCLDr`z`0EVGX}={0vRqzThn=OMaREfh0+*5_Q4#YXT1V5KK@<$)4-NE zM}n0^`#U~|mJj|HEzo6_e8(R|G|Y-pZ3Xv%Dyrt*2qG)a28GV1c7ilvDhnN;`Op9S z&-P4napYFo8y7BKOh^@e^a*F+i~sXyyzh&Dz#HH9GaP-|yHL(W5Gqtq4CGPtXHoR= zd+dIOk25pku+YBsM!!sBMB1~pZPO#`z{a zQM*Cj_XmUyKaO_ZiTuVVP}sSd1y$==vg9?qoV@MVh`;P~Bwq6-WLDjW{2m>AsU})K zthoFcyXz{1kDxynz8Tro_Zq9#JI%jQc*U_4#vZ)`kz-Cl-T9ZHkQ!y7PrlkpM_7hFKkU@-?c2BSJyXh^gX7}Ggx43sVApEw zUhyRavv(jI=wrPfrpY1CFGZS@0(+Z9Pmp!m&%O$Ul^WGat0})3Ti(RRvSu`Yhm44w zEq>ctEmavrYWuAiS@k~{+ISuO@fe2LI8&7HPkZ9{Oqgt1^%x%b*;QCPe?FF;c{-A* z3RXP03LOiV;jq&$K*+ZpO}Q-y@cYU+6DB6&>CrL6$4`TvsXZvuFZJlHk)TwnnBgrg zm~prruSISq`u$91vS=O}P;g2=#Y8VuX~tqm&S|qh zww9I-O|W$)m>$STxLUr@s6AGhPBfO0v@8GQuiVI#Xmr27eTMc2CS%fk+@JB$C~m5s z`_xfhYd(x)L^i7Fsvr|AAs;A`$Ww0cxhBdq3Xs zj(6CQ%+tp4R2x|Uh5l|72fESvo-d>R{CA=_G5~Kdg5Z?7RSgas++u$hihH)B<^O#Z zb+3FIN~3-7B^nWEpT#eTwJ;DuzH=K2-P_Ue>7OBS=Ed}cmcRQC)W7;|rv0f_J{9>>P+F8Okr*AO zsnt_jEhml6)TvV~&qaXFJhPg=B0nOGIydXO>#noaRXX!YLt4+ZUbt}aY!N2ee)OLE z@b!QEM+|g6hQ_)yTAEVmn4%RoQDjp3CRo?m*lSLL&2%vVQS*R!s=n%1y+Qq|7s>{m z?=*4K8c}x4JY$=1@3mh--^M!;V>hI2=4@ox7L4@|p|O1`rq7y-w)PoFG&EzVXE%0i zUBjlKfcc9KLphzn_B9WYi1^SD)NA+?WUB{c$b?vrv0S&pl-gRcPY42ge+K z3Ld=cw#Dx_hJ#ms*`!P7dDeAH(qi3@7G*i3K z&-iGLhu%FKh>JLWIsWh06Fwgw?nL|58eIG1ORYANZoOD!J!QuFDw=1i)o32XdPZqCq8>EHJtQp^k_VtYQO1mBKMr3QvpF)Y2@jUvcOAa`x%XntV=EB!MVZB_ z`y>-AkAOFTR5pb?JJI%y)Z(S@!{VlnH80DmBpNm%U(p^ka;G^lnje?qH$V?oo^M3gsh%O!=qs=`K!*e&byK}RYXm3(uoJv;6=Vf+_Y5PW7A4( z?p8jB0PUo*MJ!&r7#F|k(x=OA!kL3}NS295!eRW!*S?0^?zj{8{P`}_CF;>Ow}Je? zi{0z`n5aBv&8|-59q8{jjluBn2oj07WsDt&$<#=*)7;jATt>T>#%xH%$HZ5cJ7-wv zRh3s$Q-duH)3A$k*rT8flK@YRr4S;)664hF#=ZbQG8TAlI17I?h#>Ft%pgs`l_uki zGbY*SkE~K9S|Nd`Fta?GP*p1w?LFfSL|6uFSoH;x9NNUfaDP z`7A2IDC44i0oYfe8%;F!hUkyNQsrh?B2^weV}58Be0h{aD9n7SMa%rAbuaVK2#{_V z#>BEy7}CPrcH3<>mr0~Xc0>Y|hVf@JsWJ%4UzLq^v(&+#B0YNcT!W zXtK9!D@yDOs(xnyb{eEDD6kic-Uo2g58sVMVGwn(7K}*1NaHXtjQaKt`_AfUZ{ZO~ zpk+!c9{%$k7~HuNzL5GYA^KHf<4j`atwSm}f@K$e1C28;L`n_0qQ&qeP^2zUl-O2R z$%q5lk^HFL?gP1#g}q#Fsb=ssjNBHwS#yOwGu@`*+*`cbY zyGTm%d+uO9w=-NO?dqqj^Kx9Ln@Sm4Lm^<2k|I9(CT+4Z3te(lb)q`)n5kyGWG_cjm7okC7|G&wZ+s(ub@lIF z_+{dXfHvUK*q%;)*2Ewm8=qh{VXSY~tT|Y)Xt8M-Bv=)JrY81s_)_r_xzW4&hI;nU zbois!c0iOp9ke+{!lG;0kHsP;l$8JpU|nlYiTsst7KzeX78Mq@9ect|wDBR*;&3!# zD(yn9Vj2x$zrtG#l!c*<3)O^rM07NtM#Lo;qr>W_Cf6PjAV1TR%P_2bwZa*>p&eOZ z+&#fCZI@A^9r>Y3Ax)4&Zp==AZj@oPV;ctY*B43HNAJKUa0N(66dzRrd-n7+C_i;_ z_sd`Yaw9h)Hqyo@9|cYFb`IK9rIV2xJs08A3Ef4P+_-qr!N!U8ussYULQ!NZY4r5< z;?^5(#HZeWIllJ6SEK*YZ{Ya4d(c+ThK-+(deo}Bj?uTIPtQ6MY^=R(9KCF*E1on7 zi3AiIOV;Z$n*e{Aq@K?_?3HFIK(b>4NDlNM>(OvJJ5l{z7#-S!)eqc-d;WL>PCw)2 zIOUwz!CyZEBjp&p(~riovtEnHlsMS;La4YKVRYHxgg9!3-hTVI9)TIN*|x=46Z!G^|CPzlr-c31Su>j4=vyA zcndab8iG++k_igOr^qo54(OdFW!$4`I_PXNV+|ysbRRH{2WhILRWT4LlOX4{+Hn0U za<%*)Zhp&hl`@6lBg-E`U3~)%Uv>oArnJ$tWA6NgH1n`^(`GwrUBpC2 zS_2Ui=U#+E&on2;AuRT8{B_Nq?j8HOmVI42_vUv<$Fo;Ym#&_PLHjH;{f5{hdq#pI zsIe53;Y4*_4(+po?aexKuMb^?qW3hiFXQ+&H#kUX9&5w_)kw%dl+mQP{J69X4-&1k>j& z#;K=XOtLh9fsMZcQoB(MgebhqHu;!z3MEP;b$*@(hB2uzRMW86NK)4BCSv?EeY@&@ zSr=@apUM}Df@4`XGLw1ep!Uuy;Yb1OWzXNMbE7C!b+BlVoyj1}OXRVtQJ{x>Cry(L zBl6xEda|X?d|mS9k@0KM15g*F`_dr1>FsD?pD*I4IHX|Htc<*08jGi*IayS7KmPq> zMwsZ&fy^_a=9kqm$ME0NKuap~iAKet|4rW^cSZh}DdE^7yy%!3LcTyt$^k}Ny9k#m zqBQi5_o|kf(gqp6t$++R<3{H6jT*&0UjP(Es6 zuht~so(!o!{A+lLPp5J1=SYlWuB*!vHkENLa#?>#)s6>&5n<5B# z;zl5I8Ga`uHg$0i=FV-zym@UlYEi0?Wcee=7Axo<8MBki+4V53kF+yJg3VhWWwa&{ z>l@|+#=$z}49w@#Cbf(&(?cixUm15`RP*@|K*U03%chO!+0%_M8;r)LMwH3C)~s5I zRB9BlXta9H!~u*$WMmHXY@!)&r)sL?X}@-uiNZ4pahm|e4A!rs{je5uAJC8S{^R=h>xY%2(n?-#(z@N``G)7#p@7ZM`iow zVPthcu6oFU z^vDeTbIdbAIV^%$A+b?TN>gA%P<*F;v?fAJ`=Vjm|Oi9^`1PNkA>JGt4<8w4h<0Ov{XeNc_7xPtZ zq}tW-W-`#e-b^&gO^Fj*T0#Qj$rrF}ei4Vw3Zj^=kW7qVaBvUsbq~5I zTf4fu(Yd=5ot-rN?ds}8cUKp>`Mj&U(=_**;t|y714(I_CX-9sw^Sx65@C@{6N$;O z^Q$8eG*Xhw^Pa>i$LE<`$yQcn^ZG6Edt|Jo8q#-Y!@^#=DcI1J$CD=^EuxUlV9}gb zyyC3Guz3DdG{zf9c%Y>EZ*k5QyduGX&uL3w>hkY`2Au%XDY1sTnjuzLMw-2c#H*fThSqA$Xp zQy3$;3WjTDux17_74(c1(KT8`f4YJ+nd}(NC=0ot?_|a@I>j`NbUKBh4DH$T@?JAY zGg|NhCpqMFnYjzl>j_$AdZ8Orn(%_KM?yq7J8n)3q7RP8}?p~5ZIM)st z82?U~c<;i6i)R2oC2cgOHZK;7BgoE()Z;n>C(rNE!(Ln{EUgYmHWD`MQC(9}MfFSE z7o<#VCNba_n9g zd{K-P0;ohAaPrx&#>r>C0)44G9)5B)Iw@GrJpBTMqfJ<|brp8+-i4VRb5I{0MVoIB zI>0&Wm!^X~XEp~$x}Fc{ULz!X$%13}Ou4|zr$f>}FUA`^Q(WZepbQBN35(9@(r}6< zy|y;{(B23{eF)p1 zyaD;1HMr}B|HkU&Kg7C6eu9A=k0VB5>ZI>!X?`}wN$)`#I+-L7YDSotr@G${q@hu{ z?_<232hdb7ZYM2;ZWGNC6ODs^z*x@6ay$`ya=#vOrKG~zkc~5y#BRk*@l88P1hg^ z3G(}mMnY(F^drrpA5qzw?Qz-h%|!X90F_6niO8o(YF$k}(^i|NX|l;jZhiLOc;8At_phsX= zAXfAW;}>RcsJ=2dpvI3+org{>H~ zTre<_R!FQc9&`_-|HisnRxP9v;Tz%`kIPRoVSc&$X zsN_u2J?*s9Y|^b(8tDjw%P+s&hJ0j9y~ntURq9&58WJnk=B~&%!$U4yxHvG>A*h~3 zbq(J8=1UQ)4_JfhW!s=REoxA-m@r?+@LMb5onL(%{`MnK$cjF&fu|pPzcgNG)4=L5 zN>u}t;5U8e_3y#-raBCb_F~(r6$s>q`0c7!nm~zu#v>FOff$BHk{B6F+kC!gG^~T` zP~X4~4ttSHjyVaf)92#uJ8#8U_cqL5vIHlbd^R33Frz287o9Roi?U#&F3(a0WBjaPbbywdEeCHp| zLMgcgB?|IaUh#RXdGvO8Gmj#hi@;N&0F6WujQP;jxgOINo`^TR_j(MDlAMYaJYS5< z0`pGULP!hvG$`NrTxGQnEI(`46QFFKSfmQlvcGoic&F_ODxLx=DIexf&*Au^q6o3z zcWmoIXLqM*D>eT_D~r5)%WvO^GF$b($)M^L{pUBN;nyH})5qWQYIJw?A{=Wlt!E+{ zLOR(`IjHjqC0S+Yo?hD=7=@wAr;fRYWk+(NSrqzqLiA8`bAl{;Kdopt;gE*8yg9VA zHe%kK>Bwi&DCa468|yHfOp&;xNP?pn8!KaASlT0!ty~t<7cRuy!w<*3_uPj|U;ie= z_|1Ry%U?y5B+1XPQkeo}b_q>&5!)D2%i47~r=Oi0EkTb*0@&4;!Ry{|A+EXh`U6ff zJ|qMuM1u3D@BbTC-*z<;^>yeP7_&`&l!5cw>n(Fdqa)#>88m&waVxb_WHpfV6 zJQzynNOIB$1$^wWmF-m10Nr(aThZrfwD0gRY-dl16@#_XiEWVtrjMjXL{s7HR`^6Lvqd5w-Z_Ff#u0?QcK*WZn z64_Dw@C);B!qOuVYn!7@aFAu=xO>ZX3=VYDRvz`yW_a0C&GMU;Hl~h3p*|6}iOF^G zFzvAYU|Z8MV-8L{^A%XT;&H57bsqweIvjTVS!io%#^ZP2gmfu`Wv8Bt#t25+-n|?F`e-wK?IAEntlC!9t-;mQ#%d& zDcwrx9z1gUx6!rkW+a%0MfUP5p?bud7hu_Gmt*R}Gm%P@-q54!>ENO_J~Wfy{OF%A zL?zn^KZW+flg`1`C!T=6yay#uoOvs40f{8bV5D~k+UA^sbN}B@F-QUFE77z4MeG0= zKTku|VlT#fH;KQ@9@wPq+WlVWx!lT)<6-SuM8SD99-44%`A^?;seI88T`p6?%qcmX zN^%pYi0tj@$NEiOBoVY@mPjC2?`#RZ4fl!QD6sKxLaatY^I5clQ1fiIY+M6>FotHz zu|(8^EgK%fkH7bIbocBrvY_uxiUyNS^hVkd5gYla{b^L0G}&8at{XoS7$m{hPQ%j5 zOl@yKtWJB|gi*-R4($g6Bs^0Z&^J&-I+aI2%iR4H3?-8`{FP;0S#R#Lz&J9g74;+1aq6K_!*p_Y49ExjphrPwjs}LohHi}CFgr#uO*SSu2!w3dxxk)ckqxv*6DUn?R5$Ik#>}VAgt}IwJG_=K z(!@oz+Ie)bW7UYA8`omp;}2l>%2f<2hbi;tqOoNv{q-QB{h$szg5>3FoO0Hy5QsM+ z#YQ0JMCTuMGAhv~tXQ)K{X|-QcyCLE$A?#g zoIMTlPeP7@cxZ4Nc5ZnPkxBsU$Fp3RC!QiY*WZqfk6w+j)F8`-f>Q#Lf7(!yMTm5F z7Xtn)No)+!SRJ-JelLY!4+>=pO%|TtLn2!YB26Ni*6Gy2diuk#6-UW-+OZ|g&%#)x zkf9&O7aYTTjnat3C~Zpfc%yd;b|U0XE2&hBQmmM%T?-0wqOpvq5lrJP{L?b))_4xb zAEEu7fUZ5m*uK4|Ms6&jbjW&A^?>)vh{?eBQYn$xh#;C~kiW%J5et_r!#vi{wpJhR zx#idR(f7ZC?BEDOA}MqtZHeL|+MsOE+!}4|QhmlySx040%hUbdD2Z$k0VZ_XlsYV! z-GP?o286spBYHwV)I5h;jt`+lViwb+4%9hjj;`g2kZE)wIZn19<*2R`e`T} z+16+ovMrz0Cru%)iJ-v{?F_BP?)BH<_?Nv3zV;4ek^}ILjbdc|25f%p5e)Y3v7xY` zfj&I>_(NFz$V2cJvp9U|5(GkFwi!M&wNJyWd5duTNvC4bVau><*G@d~*h84w){3*v zI0Lh$PsOUo9z_4(AZ9H*63y+ikS)hdV;rmVvwf4uQlrdvknNnB1#2267zr3QdDb{H z$p;6yt^GXBD6IV&y?@GBzU>DUwcLzUG*m$}$lf+ti(kF&XqeZH2#4YnN~09^RpO+$ z2ica_Qy>lR*n~e_{SgdwuSHkq9(ERYVNcg?3^Kp7Br{o()=VnN@B>HD!sAKj`+yRU-kWdy{vh<&0YEYUdbxWh4i7@N@Z&Jg6CU{Zp-10(u&S*z$(OPYI zTOY~bTI|oWv*6J>4XExY1`JM#Q5b&c*qGdEbGDKAa1_vR?Jv1+m2e& zD2OZdXm`OHH>v#Ls+%F z59v%E^QJUlPJ0~^k$_F8lIm?cneN8!0c`0W#L;tG@Y)mR;G{)U%>RvD{d_*e%qcUh z66(nM&OdfG&ZCKieRyK~0M_mtq#45c-NSftTfdQ<10B1r;U#HfPB`HND*)}gBTbE< zU4S)I_5JUEAHV$NFYTFj|GnahEA0Ne-~H}hyDnU~I7sk2xAugjqQLI|uofWBw7VgUHJw8^Js~MQl3Ix$1hXz4hPGzxp4JM^jUaIq9bZ=jeRqVu!jqx2jNn5sT#_C5O!ODm4Lqo`i zSDkSphWom(c7>ijfCba1;FRN+p=;|}tXqBu*4%pw>dRvYW!Ro=y#bN@4yB5MNFszy zH2>KWSqZ_K(Y1*|-Pf8WU9yee$4m;f`jZ*?vp*xhCK~-b6(zeCqzKE8Cb9P68%S^{ z7=uL{RD zBRi`UidyLt4$(gnSIyxmkgOWv5?iXpO$5i5H6M&&K1&m$Wb&5&@Va(yzcpjYvvBq` zPWs22y>RkxqM?7|jST@Q9`sPF{dBfcB2>UB$3)QD;KNAo0CsNPE+s{EE)eZhnG!v- zYsWD8e60E+BjO}eoufl{{LkjqXcCa}i+P&IH1zdHuzBr9G=)5f2AUWP)_uBDy0uk_ zzBFA+8&VzG@>_XGCW>Gwtf|cb9DR5l=FhK#r|3f|S4X>=A45VaEd>*<^fffplSJih zB6Ky*6_bD3uT3OJ$3tj-&d|URHg4FAS+nQbaBmSHBuR{NWExtK-6j zi-Uy(f~Ml~ibO+ma+WST2B*IKT%2{$>Kp*pt`p$`V)}`fC$T#~Ho1F%SNeie3UpLTtQY z)W(^bz~kSuf!U^CbS3aJr{k$etjN=T;Ivu56C zw_Fct$-vG>+1?gy-ycn09U2_Qp6>Msc!CHA8*FF!>L#yMjf~n>_5P!Y2K4vsX19tAIjHwgHXM?JY-J4Ik*N@U@zcftN-gF*}ne+&b1Hi(i@%js7)I~%{%1<~t zfN4#BjO9Qq<1JcV?=91svAH!~jZ`>Bb*RjItOYlzfnyt3-xas2&0) zxBSxep@)Nh#6s)`&?t;PlA&Zek03u7O-_#Ry*?1R(PYG-WQHb-3>z#3uFB(7glY~= zo=f`hH2+2i(ka!k3Vi28x3cvXQJV$<;#~F>5(4} zS#sgR#WO?gfqj|$FT#d65eZ?|j1HWB>hXBfWf$YJcYgq{KK~N<`K@ce99!e{Cu(K^E#csB8nYD2#gSk{Wy(#xCLwXSN{eDC~KTl}iAW@{hl0S#a5 zZPK2>IDROkeN64bNWk8QGz61_&TWse9tJ8?(Kn)@g)tIM5<9lRV|^=7 z8tWn%^x2%9NOry5RCTdftSrLvy_GmVkaBxcS&0cV_X zIW*t2mIKe;)Z%Sv;ji6Ju%s+CIO#lCvp>}QRsPDzs)(M{ir!)dM=kYX=2SmM`!m?G zWgEkn5p^;b)^8MHStyZpEgWlvQ zNpjvM5y$JA*pbL17K@T6kS{Q7EfvodvbKkv<_0OwB4J9kd8;wsXTTvjY}3z*y5Z4# zFtBR_n(Go6O=mHjQYMzMrF$5iLt3_7#JR`K!C|wS*y{8JiKua_6(=7a9R@< zPH)7lwg$RaA!s63neK*R)eeyTeZ4s9HE%{^`*ePwPhUmm^e&2w zyRK!NCE^;c(ub+{j?umHar`rzFy_LAi-UqzKdf548o&Mhb+$BBJLeAcc46J>$FcIk z`>^GqJFsWx{Rn!tV%GE$W;93OF9(pJpwNMiQTCMAJoFRfcix5A*mm~#hEd1HzIp0A zw6x5`;u993v8@f+eyAA+3K#W>ad9fX}1tByZgB!J78l4wgp3o)XhWloMYL3 zNGNGP7`Yamkr2}_|0J~bHbcD7D>Whd6(s0*Z9^aW)g%6AT4^(pbm*Yd|bf?F_2N9;eLkQCQ`&5^5R7z>kH8y&Q{-<3T9?DN^?|&TwnjPYCb8@_rNxm}u48HkLabD(2hzTXjA-u~&F%4#tmJdr>xNP|62)<6oP`t4 zIvp2Zektb9orQ-Uc!=R9(ZD*9Os0&i#o|%^R?kf=ijeWTO!6hIla6>;co2te9vXrZ z3S!kmcVp-JRhG%aBq(Fq0@6}DlFXD-Pj-6J*$QT4VVT3v#!4{WSBuW5PG z%$&wV1XCKLWRMIqqZRh*of{O>(I4*yY0~0K5GH``v=(Z%46PPhoNoiOe|e; zIOZ;#Z~Jfz_3uGpqzB$?5}n(&qOY$9WBH^tu8qNnkrxdwsqd|Qw#sb8)tB+;06ad^ zDz6GjSBTF>2D&LYe27O!k=nTqb<$0OE)A`nzkVgljgnH$|LhrIquv` z*z&jNLGzRjJaNzUsMH^hyuXj9AIn|!Ad`R`i5;tF51>XxzL6`{N!EeU3C-l zvlE$e3aOzyh2}7ZhlemcFld_a(cxj_*Z~a(v^i@Q6^1io-qC1TbOw9!B!U)owx^7O zrSCZ!rL&qg{u^iP*(8t#<|))}Xjl8X>D|7jI_y~0ScsHW^Gs!`u?i3KY0fmtsaP88 zpWJMnW(^Znm^gL3bxu>ctXW|c);7#Qf9S8%L1yZ0C|3NpYN`ZV#6)&t^$Bz^&$Xdt zE|)P)*cb)B=ETf9>_nXZx=Zkm_kI|cUU3CxwkNP@(c;@Bd8SEvET(+cDh|Oy$MNH{?$7M z(LI#HgX_DnVoN_(?dZb^i`sGg0`|@r*76PA*tRE$?!hG8YJ)%zn)v*TWz#UHtsZTR zgAp4hJQDI5x$=_W%su@Lh&4|^X+H$Vg$oxi9z<}~KDm+v=Q=xQDiR8?0r$br9%+c3 zC!J5FUVoV1a+dAFlWW%Ck$dmN%7^aY{Z>?x-N<$C!AO4>J3*u5Mg=1wQkkpaUAW{3 z_`>QX``Kt}eoYE}ot@Yt64bc^$>AjG;xXjen6kCEqaoC(8cB}W9Ktx`rzNdges0TO zX#%|VNMNZa%+PEV3!fF)+w@W3up4W=>S=RkAjfARPl5inX*LhC)hP-_Y~-f;BYlMj z+A&xMSxS)UiT?Q7p(-?bCt;`GD%p}Y$(Hw0@JY0q@u+RDhGFto@s@i&)6j+aMCmU< zEPa%E_1dSU8n0?tTGgZN`Xg+|*FSM5Qj9wSE%Ymm0)<;)xRaJL%%d`GUcLxn4H%f?uXYfaH+t)!2e5A>|aw{@p@GM`F_C4A@~ z=)y>f`R%Vm2CQcYA(z+j3<)$gHlV(qo&9*d%|kJw%ZR8HRT?6}ssa1_F|g{Kn+k?U zMr=xiNaI*CiBvL$G3IM?OADrUG?Qp|;=BLxIox^MjeM7+YnHfA3I_Vh_-d~wMOihW zfg~gth+y}QotQJdQK9pDDkH@2Mnrm){!0I&os+e~sl;!kzAi@MCW2o*PfEujX<)WG z3|XDJqBv^~kPg;fvvL)-Z{C90^XD6B86e@+6ci2lD$Sa!lg;TE2p{7TVBKQHAapKP znVpn{OBUiym%inI1V<%sXuuRO{bm};yrwnBF{i!3CJ^r#Okqfx7B&EygQIc2o@5bw z#%PiS^bTjxJCsJ}(3q`;+R-zLv8;A13?d#5k~wN?=IR`t5q=DVsSJivSxjjl0h-2! zqbXt9p8nA^`uPDV4mpOQ4|>7W2F#sWPxrvC-XwMpiey!Z){efUO^SAjjSCn5hd=>B zI%4Wu<-$$*;J)`UrTwr$>qzua*Rdz%e7`_&iX=rhkn+x(?y zoiPW6Kp0wFkWA&UYj+p=x^}~x8^Mx=b8+19Cn6jsaUv;*`ASHV7;RX)8bgBvrZ+14 zBk)G+;E&ZKO+Uuc86!8^R?thKouh!#{6ftyP&-nhU@v&puuCgaZC*o~cQ7)Dt*h2y zV8dfre$9umYpX{7*H3$(WtqCXPIeoD!3$%jxegg{06*l3;x+faHgVx=Lb z>NUe>q$CuoM^}irREdyGQNwpK6g(vvwxgOaqwW1g{4~4}3NkD*wMYmEM|mCLZ;bbG zFXAy7KVsxG4a|p=&Ul?I5pRq{(a7ghBPn)Jfx5bSw6`^5aCjKKJ2xUbv;i}xPr-~? zb1-w}Y|NfH*XBCSTQuJeP)*cp?nRv)s2Yk^_Y2c%9vgmBHq>&&uKAygQI6`%XJsT{ z$3Loi^mNEx)rc65H*~kx)Sg+6*9@PF1UP?A-0ekK=O~4+v$Kq?optC>PebQ$J32>O z(bd*%h(>$X zh*;)WA=YhJhfjX=-Prip{j9Mio2x3#h=%_}*feiO>M`wkqiS1VhkwtW9y=yU3MJF@ z@gkSkgkP4E--iglJFAZr>LPa*0lL?`9u0M6^LeI2ZVLQv^E9l#BrRojIyBk1zpvjk zqB@IeXmr%%yygSRD6R5Cn**yXL>Q&1N>R>h=W%@>diG3E4jmF`=R=(rQ)HyHv#^%K ziSa28njoZvYwk-rS73&#r(^k~$BeKhqmlL52dDEiv?q@CjZnt1@MvE{UMZ5ERJw>X zuQN0nlT)5*tWTuL_QYWr3SW(mec*iWT&v`iSqj{KXmoQB`Q*Zdix&(0FhyfDr=h|g zp~l@M_(Vi(IV&3t^$hdbto8P!(P?jO$7oj;U;paY@bjyGjLyD2m@)52T=eb_M-FGy45*RIC_HlS?J*f30+ zGZQlwEy0EviMl=PIJ<6(qQMkL7MVozBkS#k7?BtnFxT+E=kK_f0cQ#6RoNHfAJWTYWL z(o@t>8Q%?$CE?}$yWaCo)5gd@t(21;rN2abs?!?zsh$a?mCGdrgCP|2*HB(qcNMhBE>|6VM;@*dZN?KMS283>%Ar& z8*exW_Hsy$Y6!>UxcZx4!19}}L_Jx&dP`Cx#lr#9l4P0ShIkNfIb*TSmFXSH;<2s0 z2ryGL>38=)k{Qd7t}cRUEeWe=gUK}ZjHGNf^#v!)#c794CpprNrDCYGOx(S)6Fnno z+v8?>3wv2=_?U)Go$P(dL*BC-EOQ#`!|Z*q!C`pXa$MQfxpfoX{-4)j_OcVIClf!% z^t*83;`u|Jk3^!5g7Hec?UJ{ky)BB?hJ?*2u#=G4z_M9`j{;sTfI339y}S;_WalM2 z=Eoj3%s#E~V6Ropg+J!UF-IMR#s;?Rr5v_z-B_Iu*ieTNwo`qn>SBOsEQ*fidfO#= zK&v;$QmBuIP$5ZCZ@MXwz^th=Fmu5?Jn`fjlv7Crqm3xW8c7VYY-b9#>eCa7v6o6A zKvL$XVDTnuRkZaRJ zA0>|FIRtzu1WF!u;4&0|DK%^q90dxLEH6of3PUL5Mvxv$BcG?CfEXSb0MaRBM+a;; zE}b4iCOL{M^E96uBLNw*A%=V*&43vw^NszA7YUR1zE&S zg%$zr+OgY)l{Ecm&iqD9pMM0>dA}WPQ7WhCP1J;FdL)M;+gQz|N<^cS3ptFAjIuYM zG{M)>+J^p-ew%}H+!o}UuVeY)S_}VwWfp32E>+p_r z+Nel0M0X_iMcUEUFWO3hiDcO^TngHjrUdI8zrRqzw3ee|W2RZEORxiw&0#FZ?}Hw( zcrkVMY;4}Ni_QaBdc@(_vTh5yyLey8AWq_=63`J0jSclku|7+d`$&4y*}M%;_xGpq znhVayZ?C)YfJZeP8iK1ojh<&PHZ+Uz> z`i4?APCvJU4GmxDgIv3Fz!N%D)H{k8}ZI>{{eHCo#+xA z7cTzFa0t%tulY4DyYzB&H2Bd_pD-b=o}m^TP#RmONaOK3zfQEkN1>Z3WU*xFv9_9O z>y~Zk-_>d3^qQkAfjxbCyGbo+ewx@JYmV2mvCNX>jMxTq>OHDgnMv~*NsksC)F;C1 z?Xnx@rSPq1Z*we<5pM*I)8`;a;*+7hVUh?0osgI4eNVDq{^;qE_v z72(Pl+v+kqYT6G(J>?vQ2n7f2=@3#aLDz~J<&(7Hn&_$B_B`I83EOa>IzLgGFE0g# zhOB~KzYPzl;gt+k+bSKqwCTm7R)T7Xg&j-2uM|h&^ViW|_NvQ6Y*$-sZ?g4U*20qm z7R_%(`>Z9D0Xam-G_|rUPazi4JRJ(BNFvGv@?9iuf=L^}4G)c&plxYs$M9GWg{T+D zpGkuA+Ru`Rv3!l-(857O5oLz%ZO?Vjyrg{C>&rOrs)WdLyXuaxc~8>dm_5yL(mVZ= zzx-u{WmB(JR)Rx4l)qJ9YVYZ_4l1>i!?nR1GfGSCk6$VcS_pl62GQBMgEEQkyv!dh z8CQnv^_kax*V00-O69uuSUWCQ=GN&UyKB2kOb%RAA1|gb|123FLGIFRcI~9 zP5^mIEb2pJv>6QzaqRBvL0xk*PCof`{QeJD;^d{XZ0?m-JnLMs0158ENYXScns}`J zYg88#{MaHPFEYjInUB?YGEMx^%H!Ul3}rMaS2&8}PB{YuLum|B_8+!v5gxqnUTodC z4y}z5i@W4@Cao1%q<6*;Nu=nPhOMOF7#_;wRp-41*WPgR0SS(igU=7lbP*H{J!x1< zLq;MP8YV`w6-s5`>Z;3Q%ExfL? zbXeuksub$g=zY&(tsNIqiA#9*hnT;@G2>;a%@}JKq0^kKo)(-he4{ z=Oa=dwVtW99qc4Y|Ks;jh-eZEg?mYY$3wrO?0Gh|qOPePIkp!%*RG(+EHv7qr4k65 zN?(oEl#W)Mcj*sU$Y9UyJQq)?wk?DLCuYV==F-0fRf&Vf&_artR=Wqwuo* z3y}z=^GSBD9>(L>|2I4o`XUvY-ykEQWlPN^F8SOWV0Vl`_6|}24sHardo1G~2~;SQ z{3cYI8tc&1QjeDQcC@xlLv!m?G}0uRIuL7`!X9x8;#!&=siS}i!ynKNh}w*e>96FO z9Oi2w#r8XcY(C5ORV!ffY^NoVeDG7CXs$(wdF`Xy&70R_+qO06+P({0HmpK=s25?M z_Wl8O>>0x-JFso+d24cZf$cJBlI4Fgonjd!kzsk73}ymNKCrws5mkR$Risv3LQ2Dg z)?;Rw<&kMWbYBgfjwP5VH<%`S&p$<_L~>Rl zNvTkXOVgwY&=txP6xLs}y5DKU>o@Pb85X{z9ur6DvWLfEmh z8#_pdZ7MuTrcL^08Y&d(nlf&`Rt4#=No(GS$XEhNI%&5WN0pFdrO2ra?NHt+NhQWJ z5UR)QB`0Fa0@m53r{L&Q&&S#4yczT7&cFqyF2gw|oP@(?&O|-yxaPbK4Ue${!T9hS zsc5A$qZQ!uK!jzcI!YN`%&Q~7GA7~9^V(LDc|zjW_T8kjC3ZYizKmPNhj5|^OO87Y zOO85;)h_{mD2l1Gr(<|j=d=|V9tk)}cOgf=C7YQ95gZ$q;`gpjhcty+#b!!U1@sI! zBpRGZJb|Bo?X$S=#$VeIl`Y+7Wzf*j@e4a_cuM4Aj1}7|kJuP31pL*>QQc&6r1uC- zUyQm1CtBsscWpp!+vB#Jaz<;MA54siR)VVTS-r5WhaXF}$Pb=*!DouU#ssIdBp8ma zNoMFm4W=d`kFr;xPivSxuYs`~wyxifpWOBr97Co$Hh~4YaN**`g`>f_?zg|eTQ0eb zy<9b9YAf_@vq_hfVrNDpP@34NZ(H+EbOLdVZNP9cY3)or(SX@AW@5qO#b}y3!y00V zgst1R;nBw)MmY(aDctYVOw#M9vMVKOB>ocrlY;35f9yaH{;K~C*z(? zk0B9_n-C9@Sd5O0;q*_hMai3}_IPVhGS$p!U6fZVu7UyFd*=_Z^14r=KH7*Z1&_2@ z)uqK+xS>v-1VMo5tX@kXi=1eZs%_0rH}bc{H2XDoNCZOT_p~QJ)LyE0Y@JQEp(=}N zZ<+ZlVMcP6V=uhDqmA!@EnBvloQ+b_XlwmQybjUE4s6@88;yxL6594-$}}TAsdN@e z$`@NH6^SxG%4n#oGyl5xbRm@*Gocla*25DoVz|GEBTu;;FT3pXDB7vyA{rtd2Lq)` z1j!lllb}>yF=vb{nUyLr;HB(HGawSBd{Rzm0=LeM($2pcI+T44K}G|bYN6-!n~yc8 z#72|k5B>9LKN}69GGjD4Q6*W7w^Sq=?$YyO5cLf~L_#I(+R=@n!9kWAJ=rI9(v~qD zjFaMJX`nw0f?(VjJ_F%X1;V&c&M}K7K<=fl4Dg+(l1IuKk`#9I6=+Cp$8Tr%nzd-4y=;emk4jV$Y7v)p@s+`LZKI zS09g(Jdym6UHA4TZEu_c%OW{az`3tK4_9CN#{+6`4&5^Gdv3+1Rgak(FqPKU+d7jX zhj|@!)<9??(!g+A;A@+26|R`;QV*1S4$UhH)=fZ`HLjyHTYo1(*tFFBcGdh})NoDvf%!ZHBf(^1dMkWh<0XBL% z3Z{$^c97CK^G)4Vz89ex=1CTzK~HZl279_OGT2A^y*61gJvNFEJ7Upr#I}r2XR>U#^Qen3{9+b+wrxRg zPp1))1RME01y(tiLVs^J_Uztn!bMAQPdMRJw9TA??%pA`Np=ReL?33J{Smfz6hDl* zh>6-D5iZFvFI#vcC+x+R^MlBAK908LgsnIVQ7CFjZFRmzm6Q~7S(|5*Az{ccKgLE! zkfiV!p#T^f>c_y~0Eycm`j}4b>(j?P>hJ5r0Q07w>6Ne@86Lzif0G(M8XGY`GU+t3 z8O_! zJoEW1W=xw((w9O*EQY$e1miYFS>i)o+aers@+GKmTR?YCW?1nb5F%+JLf*2(Ije%N zKsSsF^R&8wqV$6Fk7PqSLhT$ZdLv2dsYqMGS0pxCj%_R3Y{Na-s=!~#;mC!WLg7Vo zT^UU@jfoN(<0X%wwOQ zG{Xp~k|$Ea@?`u)5^VQtM!QncN}>>rG(4;eOrw&c;~11y#arpE>Yi$b7DOUMC?xQu zq137EC1_$Z$t;aDGwB^$FtB+WdRYJK8m8jpb6$sVb1UkiF|?g{9ELl4&>Cg=Q|^iw z7mH*3#B_i)WiVx~kFt46dlQH7x4uR ziE2^Nz|b(JPMczL-*#@_D&EFA6te|G+9NN|Z%~Sg>f~l^rpYp-olK^TWk(%>*T3;i zlPYHp**-YRJT2wiv}Pp+`H?gIp8L@_jyMm!#&Kw=|J@)Gs?(2$5>{@mGk%`48vh38*@<4-;gGZxH4Q~Oks z2?;cx9jl;yXhQ5rX}Cp%`J4eO-Ho{j;^Iu z>h9`hPu+*ZmmP`LrY4LI_FKb0d&Mze9Js1*_1ZRr%5Np z9G|g+$@~gahqAF-@AwJd}wcK!Lg@aj3ZCK6sbIY zm4vTpTNH<9g5{s`l5x<+c(#!p{qTC&zKh5(U$wf2xy$^eVcLT>KSl(BWPubw+8wV5 z4ffPw$R%e#6{^T;+M@b!d9V?W_m?qMa0Behrk+HN*vK^z~P7ddg z8Z9B2%<$O=iQo|HCqtvKS9~#i!M1J!Fk?8R3bR~0OVe$@~UuDNU9u)h*mc7LDjAd z|6>ta1~{+@!7}z?SNFV;(O9P0Hp^8%#zUPszBV}CRlT8WU6|YI^J*CO$lmEvoBPE` zcx1mCF~=7dE?m6W(03V6)ZzMTuf&@#eha2{BrrUfL^B&vX@hNuiln7J7O{CE1@<5# z?EQC4pNY09Q_#Ym=iIq-D75?-N{(VrS0}b?SWiN;6=M`G>IBB45op_qKp=>wrbZ;< zF*c^^ah5TbN+Q8tqc$HMp}^`JNm7vHF}!u17;GV1l>Ip0YFz z63}dU)#~uMhBA~U3Kt0_3fELVjgT*HbAnQXdnh3DIQw&3*yGi_24z6C9jjfMxGj51 z@M=@TpDT}ZP#vV&x7=*p|Jsxa2SIW_@g5vY3U^DA_*)w^MhFYvJa6kQBcue%`d6O z;+Y{^w(Q=^p1;ym((wl+G&QQ;D9sf8BsH=prJzWp64})Qk`I#OfO1B2Xn3vaMl#nD zFJRf?0Q&drL~591PI;r8+Z!dhAyJV7dS-Nxq(U1;N+YD@%-Y^Wb4TGP@uNGRCRUle zktZs%r(nyk?O6r&b#dlFiiCI%vUcKq7;RJMusq5pznCEAkL)^rIZ!-mzSEA)XJVZE zo)CtUz4+tLzlhUMIUlFL?mTS!`PY#c8bxX46Ii~x2O~!vfsRv8LQ5!*==K#@-7|_O zws$cN{Wx-d6Pg=av88i_pQ4ChbwaVo*XHd#*s^noL|G#?MI+9tbDEf# z8C|oNqsB+i1N0{#^|aZo`Z3;EST!SiGP*W@?f$87Ail#kq9#?VIQXA|6J1U z!i9@N3)A4NUWKc!{XLp&)gyb}Y^imsFh5cf5lTJ&`ba9&OVhVI(BF&h9Xqgf!#b>I zqqcUdA7PGL`Z-rKT#xUnYUmr((Dm;9P`fVemEM6VG|?)EOkP)SFZ=`h>?^8Nsu0`)*c;czZvm1YEzj@n?83;%FtaFy5YyE-o5FSeDb_Z7J({4b zEUo2-jNPlvW(@e;{%XHQH5jg_o5`k<7XkV)wcU^AIzQq8&7~MtW4C?Z56W z!(KeO;z4ZRvKreqJqevwABwi1VDa;_zG&qfONIV0i|L;zie>;Y=nCtJKZK69X6)Rt z0^j}SKjC-3{x96|$KPW4eRp8Wv{?v7>w#bdMSdG1bacKqe{498;gtLgO?gn!Y#R-8 zRf%+j&V#D=^l39_--8^_><4B~s2_TzAHj?at^H+q0G7^c#2xiTl2lkk-_VGtiM`Gg-)S;yzfd=*lbztC7 zI&azwoow9NHid#9kGYE$p{aESa%0*7c^jJBry@>5uy)0Alv0Bf#w0TI-{)aZl+9ly z7^ifi&?|`$rP+v=OnalAY`#pwK>I|rA-*!`8Zmqw!=>{Xp?rmLCl;t*A6Pxa`yQob`pY$K=+ny zXk>nSq!l9JDx`+7XP^tmyyEjX?3Ev6oJas9ylq93kHmu+QX>MIdm?#f?3b@K$ya4< z%YC#WPU;I9&AMR~LR%xtB9%nBI83*!OXUQDo*`&W9Z&}^JIr1$JI7v;0TK=78A}q8 zFnL6%gzl~`RV{|Cl|@XoHfSVq%7aAC&-7D}@7TN+snI@$k;IA>_uvn|y~=#o?rop_ z@(;1>w2MeihY>3ANik^UYP3v*tjbUr1Os6m2^9M9;7vclPrv_7B@aO(m3_ywv)7#WgAl;qhHFh7-F z>o@Pj&b~2m`Kq>+ZZ!9{n6JQ3zfL&qEZdnlo6VxFy^Z+??AWyv?Ng^CSY}xib)3AuAx44@G)GCDoROg%&b{zLT>XdZ52(R8WCX{B3l}b)57aQl z;tAY#!|(8+cfJ|JsWKYd;>f0p2nW^k%cHTe4IlZ)2S`S;6u?8+)42y-d-hO(_F$lY z0J)4NL9#)$9;6yZ3Jvx&B^)ya5+;AZhEC#aMB5tcP)F%EGM2(HNlcmoxFL~Xqf7zn zt5B%KkYTS@#~ftxY1?n>xTBU~DjVmn&fVC)b1T9chhmFAs-?Jzc6fX-#ObFd7HcwZ zfr5VajOpyv1~ED?fMnm0ow%IK4A>mOV_ta~%FSmW&~k#UM$z!e@P<3FbMw6v!qrpA z)i(Po^^8}Tf}@D!o+pqVWN%l(j7AGJiqf!DC~)$c{7Vue%{05dTEV3ruxW+_zN=~< zqy^In-f7d;FiT7ez~B*YXp)G>$lxI3<7Y3N_A6fIX%1rr9}4~g?Rw!WF>^^gV%`au-QsAR&7Rvig?QA?;j5q$PbKf{qHT!5jhHdf5B zY?-el)MCieI+4;cHQKc|%6jR?!}t6GKmE=Z&>XI_g6SUaf)>$4NKl8fMO^mbPvaHm zeU$YmYZ^ZN8MC2ZB7;V5l^?nl>0`Ny{FL|&q&>~ZjBY`G$7A@@^*_S$<@eh;VVV?ClO>^LnP>9$uzv0cckS2 z{FZehxd_uB!`82~ldnAQLR@w2feFqbSw-c-g$oyl0vev~-?IZ79={jlB1mPl)3CG* z)n1{80`;-S9>&HEn`~&wAC6=3VM}n#@yFrhlTX3?g^SQJZ3cXyFq=;wGT9tL6plek z@I;~s(fU^QAoEC3um?jC)4XU$<7B2l`y^Owltqpttm6?sitI^hS7XgNsnfyc=}~Oj zunq&GN%m?(2v9&KM@f*9MPw-S>YCdzchN#Sojky}J^sWB3bY~xMmt*KK@4?oWg0cf zRb(#AUUCI_UlU@j%S@PugB2{l`Nz2P+OME{{c?0~T8n|5tFdS6a%^37FS<8Ai2mMf z>=A3IJ#0N^?Gd6=oujdOG&Q%OzNy)UnwnZ$F=gsBv@z_qjy6o0HpPD1r?jKFwb}Oa zS+aN`6IDVsLxDneQ#~%BWCTcCepDyX=1e$h+x$X-VbVs3LdMuea3)d}&^lh>Z?{EHdx4WH`k<9U1CloFf!ue(0DVg;Qo2Q|6zIrn$!& z+0Z0Y?Z~TDMXVhNlLRRDO4=`n^2&zE>>aK7B-C^8U;A;C{`eV`ANw^*Py7~zC$2~4 zk(=Qk*oxrUZ$+gLBR$Gl{m{8jA}x8wE0ZeNs=W;JBAupTnQJ3Lt(p_TlO{nLGA$kV zh-8s?lmi8XDs{N|x*uWJnpLbfUYm3qk48z@A|!YkMk4_&rdV&5WBI)|AsCILW$HYV zE7m#ssi8yh&uGYpXgG)MPu`8&Zu~j2qdiQW7devEBI|u57_iCAo@f(}J?(rN>%_VZdu+Gk!Qmu&`bIG_n#QPBG#5O! z6kJ1_+G{DIEfLho;I)S0V(c&!w2GSkC;9#8=oRhuErKqholk3`dRKxD@kcELgk<7rp7tlPYHp*(xd*E?l@cRM6bJZ5vkM)*G*arro63 z+tx%y_29Hqd7eFK&2`a<)Y_-!p@&yv`NNN3)ryr^zhS)z%7%spELpk)XP^BFn^e5& ziB(2kX3txM^DlTU79F+>Q)bUYP#fRHVrZK-+jiUS?&)W5w1}WDXqp90woOy$YBi5$ zoirpO?41UoGw^(&dia_4qG_K4y4@4 z-f2(w4)jvUYgi;0inDiL#86)+$<1Qa&p3&_dJ1TEREKu0gr~3(9UU`}sGovZV-%4@ zm~qH~ZNHJgILVAwJr#>Z698Gwxyd9kHZ(}$(2rp)1Mk^`?%mz!-r0rD?VT9t?nZK8 z0Dav(yzW8wo;^sW(l%dFf-O%0QeyXA`CDHfrx5p=;Ig?eiWtKd(+E-^#r;M2!W9%E z3sFD!ES5(vW^|COFsFMuyKQe9%~|R1AF}y1B8e@H&9*bOk7TGxdj++(8j0v1W}f6r zCiojj%Hka-pn2ZWDCJ2fqa3lixdMW8(m!Q>IV|3?Tg z55qnYHJYH0Leq!HXg`w2UJQS13Q1?i^1GsWGz>zk!L)m>HiwlaOv5?St4O;dl40bA zLR#7|&3h56s`zN1`4tZ|WAl@L!R{Rov%V#yKw()GnN>O$vA`P-wr<^kwQC-=tqTrY zdNPhb;guvuF+{>msE;?0WHg|V+KpfS;8VErXWzt@b*#%d5{L8%#xf*^1rlMBfa!CN zz=uEnUDml*F|Lfbma?;aL^?&dY=Mn(gCrndjw4+Plho);vm5znL7ap(?6+ay-ae7}H0wXhnnbU_vI+RK zGnK*&pku~t=;)11HeWK5YHDB)u!t}TPn6`u!v-)&fv1zO`}a_2ckRZb%b&m_4==}Ux7~`t z0XDL19N`aQNLqt|Ui9~LSwpM2C^-uF#^!n)bJUSI@#K?Cxb=4T+KM1Q1!Ic6&1{Z> zgo3*+5{8yhv%STx-hOnFVC9lSNDU7lOrdbn87JfXH=KvQT^rHAaWx6XPR6Mdh0$SD z*x*l}y%4Xt@t7A59=zEp=;^GswY zR9mJVj+sq)3~yh7j_LC-bNWo%9%RbY4lJBIp8~ATNRskgLqEgxHxlyL@fIRhP0h^~ zhR*9Mlm0c&I03U3AA^n-lFG0bi3VWC6d!i3x*p&D%(2+M;SS7Qatgxn7W%8g*LD(~0x}wwqRFI1J~W3cKtd}b zpxumpXm9PXy0>}Ft=P2sE&Y=rVa72+Vj5))jj|3!NNgg=7D6QE{8o5v6O38b6%js?vZB&L z(lu*t7=42&ti1brw2{d43}qOu-;On^)39BA1a%3&#i61DW|@^kBL&lTY6vRNI-+d@ zM6NUsN0Zy9&74DWJ8YX;wzajIW>B3G?K2n9%DJXSo5U_sqCJ~LO*L%QOY*&^s|!JP zEL0bzsftMhR1qN}(P7<4G}L2wILR{OH^^`Du)`0-8!tZaGI5vSxNza({|rQMc5GRP zJ8!;@jVT+!oQ@<2o2Ekhx@h&I^zv-3|3CKr1J3fJI`hV#?%Owa&fPQ9lY?ePql5wo z5GEQh#sp(y9KboO1M9WDYp*l*dUu`HVa+-(#sQ2?GFc#$a~NrIj-B((`F+0C{;~b) zFC>A5U+?FylJ4}qzfg7R)TwixI(4cl{APLs-IX$kNmvoHw+!($1S;ZfKoR4`Z+4`W z?dcAihpAf7f`P~6`LkM_n^MI_|KgdGI(ht%<`)e{Dy1-8z&7z^EAg6*5ySkRuC7pC z9$-M$dvhf*Ge_yBTTnYz(wwW%L$M4>= zD;SaCVFMYDh6nq4!bU0qXn9zXD=8yIB z20CH6xc`RLNk$FTn)w<6mfHi5)9tCS$IHgu2h_La8&r#LR%zw5db9oRnY;g1jZ$8lcD*tj!%;NY1R1swe`K23P_OOr52`tP)_h7C zwE)nV)Ux4po%>(;P9?`CT$aJAjcLAEQ3uCx7}f=pV?@;McK{~9THeKj z0X=&6r*!7zW9n!vYs_{y+t#Oa+K8^LYS}NTL%nVX@-%R=7^ZrL^r~-shw7$1?RL(W zQp%MLhD>kSbXN^*Y6dhcCuap8rL)Dc<6Rj7VprdsScf+ zS<;fhIMa0t?gw$U3*cx5^KEU{Ys-GV=036%RuGy5(`h*}xB;+n(m-$jV2~dM3N7=3 z>kSW1x-75k*A#@@?VRm2cyar(@h=-mva#fA3_xr5MVnbj0OVL2T z>i58+yRX<|fb*@-1Dxm6^Xd8Ye@6-)oO8!@`{zEQrTp6JB+QT1lYvIlMwyYQN6{#6 z8{d=+!g>`}6RjC!yav|3YpY3^>o?LU**LQME{5-RZEqcjb58av)yWQz8C<2Pt1yaptozy5Ol->C}QNgW()y0_(IUD zlxHIY0JFiKyLeG^lNXfBErn6=;P6HbPi*s(DgT$$V+TK>CvN`-gRd1$Pfu$4(q-jy ztLp0Sbk0nv#KJDbbHQVESu-B_&Rm?-I%g$6{@lXd5*1n&4#D!a&I-`WgU&)5O`7ug8?O4_~KZwp-1~CzR=% zP;35iv%02Oc352=^>=mlDAUugZi6nC2{YA|G)Q4TAp*UbQj5hBE-sX?Vm9s=eZLsIhk!+cgc{RK24hXjZ7G)z z?K^02IbG zM(Rps(g8qoz-HQYW%@4kE4S6+;;NRHi{=%q@V}-DZx&uFk43a|_s%f2%)Uv@T1{2= zH&*8{b-BDauSy|rnKY1^pS7IM8PLv$Da{pw8;*8@H^lJ3bOtjV=$TBUou|Qi&EVVh zWLI;*(YBqto-qc8rg}a-pPo<8r++gE7d0!H5=oYzwg)AL#tysk`ftr6)l#)BjA+@d z7$5-*VuZ(XRz{GF&hfyo6rUs+{f0m_8x8f{}ZhzcZ!dF?;|E;jlyKATGwrHW*9{jTJSX68r%Kz~W)R z!&0-69vs=I8^7)~YR^yV#Akj-xze;+2`Og-vY2zJHu!4>n!sLG^w>;vlw5MjMy*Y; zxDBjHAA(zxStZjMrBdugmI*6LSecUbNSG0I%7%+L28?yh2$CRA0*hHe z*5!Oy9RtHd{aEU5!w5J_Hsj`xbY^}|tHqq!%T3eAN-g#}se5#vbNyOu-{tl_q`Hwt%XMF= zlnj&&?hNv#nrYR}-m3EHJ1j#DP3NZ6R$X%YSayQf#vgNgZGRfq%lr;90NQYKGnQw839OjoO^$E^gqK491szT7u8SZMU|1&GKN>SU24;9q$f+*?2DiN#a#T zMn<)5>t+KI8}?K(#8&}GEcIbSztv(>KlZcl)s3(CPFxHQp1H=8HfW2xu1tkyfV<|Ke-li;w6Lg^nTuMUI;X{{v&t<@sa0GFTL3ib zkc z7gTRI2(g`CX3Kq#w#lCjLfLPGeRB$Iwr9i9*PZoW#{LFnR=Dj3R?#wTbn0rkp@N6B z<+XV#2BsmvlW5{%vAniy+G@A6r&p=XuU5LPQxk(DN_1v)VQSXp7i>r}%48bKv>SXh zY%GoPipAQRF>`(#go$yWOu$(vJJ8^JE|&Y@8PmsVvJlsSSD{)9JW0np!Zbo}Pp8I* z1~q2@h_?Z}2DAh2kXOPyee1VD zdgQi0R<=V@6k0c{U#Nb028k3i7#ko>6q?rjq6Bui#j)NR-wOJ z$9s0GkQmj07hk2$P1hTKmOmaX>D`EOgaF=xMdO` zMF4TdyeSteman=xIt#p@w~fI^IQ-LX#Abo) z8HGG`xDT+IVV6OEHW^bo!L$@X`fXY=@R)t#b4tbHDuzJlY}f=bW1w6v7gQ*eb?oH% zaLV`Psb!s?T+r0?qApF%m^TSsbN$WQynRoY7TvaMZ&?1_-P@-fd-m$?yY5nPb;V^h z!W0&R6?QIW^%T>!?HvX%2I8!e3a95g@eE%xX#;sTV#-LDUCLd_0A`TqaEu7Lz;z>@ zr&ew0iUa%f=I5uVo=?xG=hOc!DNIqFJ)zHj{2#Q!@+FU&tEF-nxuMv$?A)QTiQQo( zPO-46qlZs;^o}P1qkx)c6l)WNaX?YF6Az?2vp z*VQlodcEq+Kd#q*$IpfH`A(d^Bb=DdR9nfwWF=>VTC14mj5-a5m?BFg6XNhqJUb6>C(q_xjhXJvE{exBjJO&fKokryjP+^gSDF)mbVW zHy|;bXe{a6#Zv}o%gR_Ty0dZZxq6>Y&XlzKnghD_6|d8#Yj4o_uB-HkLnri_*S$k| z1GWGCcfYQ)2OrQq58bM~0n>p4H(M~6Y9uI__>zvmQ@ns|#0O~M6QX`n#hE#4yI7yn)RxH-e$_L#v{!T__qsj2}2 zXS3DZFXEi~U0K$-gMY75v#JUn$x2L>q5)G%8X6ch*lX#+?4m(l(qI_xO*P0AJSW(C z!lv?l8s7R4^W0^nl&sSR z`+CG#L`){JCl1p~oQ90MyWVUMOTzq;hlss{Rdv~greeM4hfs95=?do;0gzqVd+wT32kDBU*{48h!TQI{uY!sxm) z>5;VQ+&DfK40PGxY;7vT3f>w$mg&-t9eb4=7*oF1uEuiBBX?oZ#Fva9R6n0}_lABY*zk zyd+LaZ>Ur=ps{ghrP|mSM>p7*Rm#rWps3uY^NSvV$1S$SYwye2ogwp{ZKYBMnS z??3WFOb-{DfGS8fM8{Vs$+UiXe4Gs=JaK8a?n{Imf+qHD|4s{#!Jo>~59X|eq z0c)SjpVh}c{z)Ad|jt7ZR8ZZM9>x2xB)Fo>H*l)kv>}o+~=3g>lIT>joLzhKl|JO{!;)R z17w2CsjD-x{8dAsG>mIEFTy!gmOnrm@4zF1jqyt2)nYoYU|GTg#MxfE_UzJI-uCn! zoac8kem*^)o=^WK5{f;O?bN+r__%)l$KR>RC66$xjo>9gVY1@l%Bycuc5H(UWV=?T zF6!_@581d`iKk;)T+D}96BIm3vsNi-?~XBbW-}hiqEw}28$|0+<*dZnz4#ly@hv)e z5;KCv&_bSHvU%b<3oKOm3R2Pik6qzF;(G=AOedErMhO8Rt;R*wPAEb zSpqXt2_^c5mF^!UzF8T+aN^*@Hj2|8!Fx39x|BT%#lwzgjMsA9$i{_!}|v z(6o2jh?Z&^+x!B3{o8*)Ba63cytA%9{leoqG;=}U^Qw(nnOoL_Qx)BPUrF!zwwGwn zhCw}WaZdmEz;X4aM-(?W%H^wa^(};J@g64D{NzM>*WMpI3chLXHdJlKbl}?k+Piy9 zkACs?uz!-_kd1Cr!`<27FW#At+SqxK*=Fi2sqJH|f@6gVxUn0Mvo-Tt#vo>!$XqLJ3R*36C2AEp3s2TW6 zQ>PB<($Oz!>GFeWm8SK@&);XD(57rhNx%Pl->9<(kLsW9ENh^*Q?W+L)U`}|MNb^N zY+30DLG{s;CiQni>Z%)F9QIDSc=>`x#x@4oTbQ5IpzD70(4*lutMAJ0f9&#%H!zb< zYBj%VJ_0@rkj+!hq@o|yA^M+r+?i%t&b0}b+AWVsmGeb|YX&g}Hf6VsGnrd*-~Fa< z&<8&J@u%I%7^fU|_dX zR;Cb7vKD-Zdw)&Y5#UJxWSLQ@M~|&~Nu5@xqrKhQxnW2*?cJcs6Zb07T(Z(_s_ZhB z{15xy5Mxuc!e!ZS#l|m;YHPUKZB&~z)eV4_4N@>%#6!dyHP!I&EX-);=s}&l^HVzX z#gFOm1GlMODX7J?kbzLU(Z^Lc-lDJjrf=8SzMItQ9M-Cp{%SR+j=o-Xo360x#m0$g zl0;VO?iyEb_a=iC(+N$rWZ(w}95O=Yn1V27wh@Zq4syL~b-VzRKy1H5oX;gCd_Ng@ z$4J>Daf1Xr2N)Sw$HuT-T^>pIb|uuANrh<@JVV4i`4OdTWLTNT(F~2YvPzd9*1|pS zRr%nD)Up99){`o(dh|{ZxATu@dR5JCP;Fqhn%NPVMM`$|IHO)I__?Wz=QMrcOxWbG zR9G^AsHrm*SE<=Iiioh@8|X2e}97kOv=E+ZA|@K8G>a~riJ*E_IOdm`RqJ! zKsSEfwVI!PKxgY&J(?eLr8a7~ucC*KE$hzX3yQa~y3OFQ(k}Kls^xP^RqLuXS5z%6 z862!A9WS`vN%eFlG&GdehVc=N40US5rhaYRzEJ}seHt3>(@i&Bsf|P3y7N>z#Ksb;qMkCEFWeda+8tJgfAW#|3Z^q#h2? zPMS`p=-4{IK+|$goYqkPkSYf2%ZrP_OGW%r-T;IF1VAS4-{6jx2PQ3}$9mQM#PzQj zurWmyH~0fsGv&mC;Z$_XDc&July^%dz!CdTS*G2`0f9`5u{%IJ9;atW&reZ3pPo<8 zr++gEclY_TC-te1enhh~<)F|C1&?H{-151GHjIs`t9RHV-xVEv?4dAy6t}^O*)R}@ z2;fP2bcq|B_=%qWZY$po>uVbnVjyf(+Cn^u0TipVoB&R2tfdpR>}?4x;BPQ?&{5|66F;&7EkN1{^XZ*(`Il;Y!LAd&IoJx*{*m?n>J46D(XqkYTEK5H@Q1jV{Ayms zTq&#o8tm^iNG<8e6OXxV8wMYBjdE}#{IzT)OdGLa9Q4XG)mj`+Jb=7v0O3K)lKP+Bnu9yefrNre6&l z48W@{2Tu*2zo|vbD6;IfA;zZ46m7xn(2>v;2d)a>XJv6Y$QYmwzyhyUS69@*)LQ`E zOfeaR0G60K_IJ+C0=W>=sVI>I^wX$WTZPQ_;YF%rkjbUYV6)U88f4MEL z6YNXVGYHZO*AfOA8#;TnZNr4R`ud$^LzgdJ2=8o|mZ;xvWzL zVv9=K*d<$5?y;iZHIQi~Y=q0281D^nAN30Rx!C&qUfE5&u*g|THVDZ!Z5T8-!{=|K z2?(`!Q3Cm4fJG(nHVlc2&XzJXGjjaK!@rVJA!RbG*^Z|qr z-xGIxHCt8J7x}O}nOCtk1Eu-t;H^kxx(qBU8XpP$%a~p-d*K^3lFVuO%;Q>~X=?xV!y4~T=+3)x>fd0QLvHE@3Fc2K zQ8%!1T{{d?@;QSOoEz>Bu3xKB^IywkrdK_E!)n#b>gw*bj4x?rby*uXZc)pCDwWD= zb!FLo%7A@&+47%PUtg!roI0+m`vOzN1pd=s!bY90d&6~HS39uI0N!FSrH=0QQ$0E}Ib>w3eR-lV_!yMKJzDXQlL;E*8=M5Yi- zqN9MKzLI<+WzJtvZ`vad4n1SU@YT}xOo_6fmHBgMjp!wCtEZ=D&6P%va?0g$U!w83 zOzZRfTI5e!U(b9#AL{p&mO~!2DQ#V?uI*94weIfjaQ|z?pZ_n@`uaTEx~=C42Mk7h zLY_!?OF6{v>GI-v68X?p@OEt;{HssoNuQ$a{w;cJp^v>=9zFP={`{~1T$`;-$Hqp& zsJS!S8N45H8)JO>?e#YO=y!gP&Yb|@upf+#w+&%B%W5l@Kd-Gc*}7>YObf8}J&_75 z<@NYZMJr3Dvsl8~vVLLYy_PZbk>UJ)V_%%X#+Hb^90YG!T$d9WCXZN6f?eOnXKd zly;q%nH7VRn5J#;8tq~HYY;<#we=|mzMfF4gD9J-0gFM3!Pus;J|%2b*`*he3BjhW z;oM5zqh&x{OryhnHk1VB61W-NId?|W(=#$|P`OYJUWRtF6A#GHz>roJ=Yq$9v#3Uf zdNezo)6P9tXzw*QC|@e5vRn*1Jy+{RO>7*}<}JH)>HK*eec~~t4H}LgeI%?XB6bDo z?{yn-Y(<5sCG*EUHC$)IJBtT6*Lj(*F5ks!+s3qcn$*SFW%Un@x*cj7F<4u)v0rkg zoGzbogR#9p*+w1N>&?0yOUNDpw2iPUHB(Y7_czYa?EG46S6i%ZnIAD&ZI~7U?1{l? zhNbqzRqem!t$OsteY$+|j45o_*3CQAmT5Y_jXJR7MlDS}uI-~49XRkZ<(gA^_;Y1wcqYj$=@{r!H%@_{@ND17<+8P&=Kb%ryjEJq$hu&NC2OS|Q%R4RwKD?k+h zrc^ViHs1k%3_$SKB=Ls1{`BJx1E?5>oyOS6vldpQvG8DVxukD=^BeUyANeFEIjpLXxw9TdRRwSSZ% z{`_ks_)U=U9iRTNe(}fNsZ^%VGFAxyhMj|39Ug7>q-`%#8XnlBL-!rhg-d7E-Ioee z0RR#l7424-C{NtkERAL}*R=CUTfyRC$aZpKIQxh&PISAwU8}`ap0!a$`DSg{CJZ=arQK-R{JXGNc0e)C zM6%+ZTbNVJiu&un{tX5cLpBg=M;c6Byl5kQMwNQWhSZARF-Gt=?Bb!R3!wRX{ zg=w8SaoRMyo-U0&ggEC5Lmy%yjDj#U?FLM1B0vm}!I|sbV>u$Y2Py{ubLMfm4*%Q3 zG)sf1*QN(R2206wDuAe*bt(q5(>(0zbU6lGY)+UlI7+x}F#ZXHvBw^JRI^hvHf+f- zRl=B!Ip-0-LDlX9*H|vH8XRnDWyu3;gDYcJ6<1H1ht_qK4(-2Uv-&4? zht+mxjy|sbOj?JI9kLAdYxDM9!3bYIeq0@wNUY^wA!ji^DM+{y!Sl=ZK0_WA) z)8#5Am0w;~ybZ5PLkEvu)PUPRWpLDMBfqd(GN>Uy+B|k%tGTjDu5ZR|)}1w=U_Ydi z0Z=Mtpw?^K&uXc)9e<~$rUQ?ehS|1#N0>h3(N7x=)%QQmPHS&GI4dMdel3_lo=aNCbh6q z)k6nQs~JluX}yk4XH(5E(`Gr^b+knj$Mio`p7Iy*bVZxRLsfP?ano_oOyUZD5A?|u54zxf;O*s(+3`JLYx7*E2u zLl1R|yiHN!TExp}7V{-nD6|V zpZS?D(M7@_!wcFVN|E;{N|C37#C6Jz+65Y^-}-i9(Y9_q)49EzZ-o<+(0=W;*XnnF_jmQum%cRIBf$gezP?=eM4pixu5Vuw<&yuFEnD>QkAFOX z_lSn59?-B}-k^(oB09g;2|55c_ucjp{rb;-xBB|W)#fVHQSvqjan1^|p;&E{wOn8j z)Y8)GqS6`DS8dsd5X(StVw-tn#fnUKS{Hb<81^0U7&dGJPn)w>PFuS&@uYc{RF{oF z-i4jE0d4bW6C+i#(T{s%+2IlNrh%?7)pcp1q!k-pjN|t4{xF>~wOBMbX{p=q?AtnK z+ivCUvRlp4+Ef^GVkVKp2FumDRt=D1nNDSGwDN@om*1(2=cjaOaw^2WWDT@3264-k zqAp!rF#U)aWS;LWF`K?-pv;~OWG>g*018P3noggBHg8)sW|^N#gH z9=BtBFi18;fR_z^zIUKoo&AH>Axuj!9aGi9{H*zvP@}Y@R64G~jXQL4YEDgquXbN= znV!DhJ{>uFTydA5NoTBk_giBnxg_F-KZu6G&qCWL1`k}6g zi48h>`Z^5^jcImz(g1Ea01eKJVucx-6sBFTOOw-KZzK8}$AVax3^o^3SXnTTcH6rh zjM+S3FkQYEH^5n3TDG3?prhS@sKnL-9%#5PwhT(?|D0>p!G1l+j=?oks2QVnymo*n zvn_bWmR4$d<6GXKzx&X~f_+-AqsRxj0pL6*LB=Rj6!IVc@gM7FfA(j?wNs}~>HPWg zdi&eou0Q*;Khtmh)^7zReEs#;hY{?r{o1buqyA0b^i9DaV>JHm@BS`$0Z_)9H*eM# zzxc&)?=S!IFD*;Fs?%WxS z!xdLt5#Ia7U;IUV_OqYWo;`bv{09RF``E`m7Q7P2jve#J>gzok8qiPu)K9sS9n$AN z|M@`w(9n=x{Nfh}L;Fj=^hDC<+7`jkHU(T|3|7^eUFU;k_H`n>$* zFAqlaFaF{$^!va6`?_@Ll5W2FW-S?=lNa70p8xOv{lABN$?rukdQoU3+JwSG_9Gf5#nng!e!6p%3ZmtFI0`{HwqEE4}0;F9{9(@WT%W?-alU zAaeBRQT^(#{%WWr^w3u1@q54bdw~Z$d;0Y0VBERCU;+Nyzx`W%-Pe6x;KSa%dqca> z=J1a8;ki$K@{@tj0NxvJxFHzezyJHc5B0nE-h1`>*S|g(aOy|Bkqv<5KmF4`1&~GC z@IIgt?;o`M<3Ijm;49_fA^eqJ`IP{i0ie)AoslQn0UD4QWSRW`*Z=xof$tb<&Oy_t-A6w1ksyE28}$v^n)`Sr;R$U)J0M#pPo50CqYVLU$QJxSM)5AfU+Nu|3lN|5 z=;wy+%NA3V?$kV))B)mY*=r;hSx4rFc zK@N~Hgpa+y)>W=H^)q#b&T^mJ)NSaTCu#pB8Q4iw3D} zHrm9WaGEj8l3AJ24uG*SX<6|%twd}7&dxD)k60V=lu8)cWL6~`+FUE9`D&XcZGbuw zX>A(apaVPi>BTqPtZh4YYt*CpOjnPT>DSPvZR)eZOBiG%;El_!$1`CXgZ)POISdnp zZFZrI*^7oVdI}y%ujVUSDHV{nxbOVg`1 zLOHg!53IM6$B_A6Hr-`|yBdt-h7IFNCOTDXmJOh&cSi`qT$-D)vBFD|*5L3+=x>Iy z*3~TiZUykNI6r58S^nLfH5xkMr(R%4aJiO)q1k8Lv8>QTdBLzw~fZn{zN?j7nM z+pMv1KOgT@vDU7IoH*6#Zq!&Hpri&Cpx=2 zZ6tf#GSUhGs>u%XqUcY_G!aZ1Q(ra{HmS>*cM0=y)21POpUQRk2nz^!a5Qp-wI9y+Er0j5(6ISp^xZXl5e%g0&vMi6|}jRs(eCo{_Q z5Z`3NEfj3j*wfeV`;9OqW7K32F=fzHSFunF`n}|SOi=twUvjg-O}C~moYLu|kL&Ow z_i6U>MFX>L4UG@0({ebx@e1wOcOV=_+EH26U{{;5Y*IN+pEu7249ti8d{-LJb-`Zewj()o`80-EZ)U zvP(IAtjhjP&~HHIK@8JWJNN9?+rH&r=`55C>MI+!i6x+^W#7M2nO_(uY6_je0=)T zpAJR}8usts9~3_wg@fWS6c`z<{pgSWsNV9Hw*)`{P{QBkeFea4widVcM@B-t;hkTjNpniZqj2htSO>cUWwr}6Ax4!kQ!GMxCbz_A7AO6FC z2#x#R_r5pq006?Mo%{e$7((j!ec$(ep+i9r&wukbe{ofahWg2${K=39hL?H* z3?6#up#W0xw0-w?fA^QXCKoSW4DAG%<(a$gx-0Muql+QtKD>vg7en?U!zeKtA<1JoIC3{L^N(DIwV`J16_FwEqSv3~5a$G*g4 zXn=me2_WlRzx7)~p5zbzpcgvuYyfni4<6vTqf9^s-V^`;c~Xz>`mXN^?STxF*H8cS zPY3=13?okp2^j&@Fil0d05$-|yWaJ#z?1*>-~L<3hu?U905`}03HoSz+MM==#`nGN zeP05tzwisc5cG!0rB21@{uf|YlX>8xx*^>j?Rwwm%W=b!TEv9D7lE7?m1=Z7CZs0+uRP;+%k zF=x75ZnJ@{YNWqQH(qsxUUc07kK6~^HaujCDVPp3Ct*MoyhS!xjEvbYgt(1{!GT#~1HvjE8$aJemf}fbBiSw2 zIaqJ90*xsuRsnT(c87k0L1RSEA)5pmclGv|w{DO0fHFJ3L*3iI-yrXL)`l%t*hp8j%weDBPHFPO=`gj?-8XD-Q4fcLCJi1o8mteDjH|;SF_rCAuiqcs zu+_Y)Yi?%Vbupl}DdAX(nEBYO;*QMZ>EhH zlBO%w)^1+63?}@@@=DHw)0q(POfd5Pz1#Kmue!x_+@yV1U#a<(1sy+iTAA)Xz3l5> zr+59wpVwP{;NR<}SH4N{-Vrq{*F``=x+fe|T4?4~t|r1}i@UdU>e>UFwQKXZM*F+n zmTNID2oxdrZU*z&Os-d5w^HzGvg#{eVs%_i8SBt&XP0Hhea_DjGlX8id(Xm_oFYb{)#(?rsk{D%-7x`h7A~!vM0Xo#_2Y%oOg13O@Nz@;Zga_ywzTq1J z{TOKg2P5d?$BzetebY@h1p|j+!ZU)5AXvTC?9?T zR%lxiJb~8$FUln0nW4=npKExYs0RQZnF9y`z5q2*LZoB!U*Gi0Ib*`GUA8A zWXdB-8!)3IkJeYzT$$6Xb;82gGs+oIls&@C&CYA(a!&dAiVE{3)mQvx$pFV?q=|#r zv_YH4hcrKZLFbMf){#dZ(DBC~(a9$s))Nojt*X&hPx}icXxH3QK`EY@Er zXLR()W4iseFX(fh{6f$hh!KIB1aKO&g(bBt+a_270EHXhkT3A4YB0y9X&h$|Gl)Ti zY<>bgq5aLDnn%KnsMk(qZdY_d^IGhW4N@w(HjQV?fKl%1?y?N{n!hJ2S%btOB?p_z z#LwCAPwU+IY4xx)JPXJuD&5tiRL_vQ#%}2udko@S2ZEDp?P<*{76NUlOd>3^cB2O)S}T_f zP-}trcpl#B(fu3W@~wL9H@#JF{?_l*_j};kXB!bW=t-wD8Xg!8{?@G@eu=~MM!bip?O zN(?-A3@a_SE#*qZaPa4H4i5-ZTs!og@BDtf|1bYcANcUc^gDm}``UlaRj#M&Qz;l2 zG2PhE{M?dG9y_HE{LvriPu}y(`h%bQS$*n{->dsR^nN|@*$?T9ANVs}IQ*#XMpLVe zgmTTSR;zA9gNQ0TF<_~+I?S7P6>4o-G*DbvVK1Dx$}NMPL?#?f5=(Wu-x<8P&9Na& zurcQGD-iy!)-9|}_s7zMmGjK(ou0G~%5c_bKS@&OFtq9;)XhMRf-dhWUB zo?tMTmf%?uW$+9hAz~|-I>Ja`O!*6~(1>S<5i*JIBmftA0<`!Gkm17=6GjS;5Q2e1 zqg<2`i8?W|28?06c?RPL*uW^lW2Qh5IJ`6%P7F8iF(m;H$q!FhL=!aP(PDZ8fQfel z9&#PPK#J-G-|@7;M`*(6!2|MzPk3Oc6J9CmAAv~P^zh-sVX6uK!E^Hd^FROd0K%dK zUv9ni)&P>;_{KK|4+Sy;kl|VCL7Tuw$^-;Z4k@|@2&N8r$&fpM5zhfci5KEIWRfX0 zKp&tCUgEvD|Ni^Kb7#+<4W1q3iub8wlrZf4j$+A>U%(rnhG`{aoM!;jDLbJ8eNi_5h|#Eh5L{Ns9O%^#xKSL-3nvFs9I`CtwP21E9oXhz#?I@_=tq0x)wA zI-rYt^p8j;qCN%yryKwj{GiS8#*rs&@vjAPkiR+}8yCm%3m7jpsl(;owBfQD3GpAe zx$BK;PpFv( z10(&~7;kCBqu{ajf;v?-ANFWy>psOd?AJ?Q_s#l|ANoQ4;1B-4*%-9*`CD{m|o2=xR4HRuK@7Kc25hWT)6=!C(w7RVJZdQWTG_qmXIx4Nfu9*L>dBpk$hO~A2W@E5~ zDz;3;d`_#&3+i#*wohy@K#IHWWtUyn<%_4obXYcn?L)L`u(5(X?^DXf1$^2^I+{`AJRjg`?Mat{R_Ispt`hh-tv<5fXjAZ zWI)N04XPV>#SAoBZNz28!lsgJAob=~==vAGQrF$^BJI281-kL(7ptqM*KN-%jPaxG3j<{A1ofeBp`)-F z03Z$xrM_i@sjwH6kvG#$kru-<#58l!_x)nw!z#^??V6 zbjM_;^Y(zIT4Su@XBq4eXk2j{w<#TD^#926mrMWR7#!Y#P>>z2ai)hb)F^S>mq~9L5aK0AL6pME#+c=^)+(V8AQIJ))Iz@B~i>QNEtb*i~UzvjR`ZP_%gRW@a@G2|M%+a^6)uDHG1 z>Xxx20hb;)EYl;gP2OGU_P{K*X}LqAM8@W z{h6JQ0Wdk!LXa=VETl7C9z>0WJn{B~5xMhOTDD9Wn3%;B71E~7TS9;;qw=N21+jn3 z(BNpulM|wAg=uxQW|dr>Qq%S8h^NDn><$BpHh=Hw>e1}vWnDOTTKT1Um2I%P`-cob zYg$=eF+fTwk?plyuPwDsWzufbhEAH#rNU}hy_U7H=Ja-As!DEWRz~H`S9bFq8{MFy zLEov9kE^_5pkAuz@Uf$sHppr=Dq3RV^aOqXke)brP)CnEp?mMXQ#sQy zGQLsmY%pjbiT8^551ZQ%zr+e6T><@ zEE42y!j;ZuLSN`jQSG^g#QbI}BnzZ&^AW`qa>d4cdF%^?H#( z(1z{%w0YN++H>_y+Pe3uuv7ERuX?>+@Y-+H4Y#~X2ai0i<@}sFyEE>)bDCSoX?|`| zRmZ%8x$A z2R;@yR(PR{7*t{laAGjnLsy{-xQ7gdfM}P+^&A5-18@$04ZQWWa3VNzZ<7YNL4|M+ z00r>jdc6_%KQ(0&Ej|A5<2rNdvKB3)1nGkt*Ukxpn+gj6mUC6@-M>d~dF#KzMt{-B z4wMIwprR;!Mt~R&lsMnH2BRnkVc|K95k`dTfD}I5BQLJ;9{ES#c^2i&yHtYrqdfVI zP+=IjhLY!b-jDL-FLXqWv_60Gpz$$iq^Qxj&pn=}K0FiMBXKV(gM8M1kMe}SfC|6? zzo7;CB6Q5N+~*pPV ztPFljf+piF3v=qLZEoQMwcr_Fc{TB5`~cnY1ALmrXWg7PDNP=8Xy56a{oAKsxn z?vWqwA>)(@?;}1_4)x+1d2&CZnH2GkYm^t!3|+_)ePsP}B%Y1lfp74TGWZ>}8|@qQ zp{PEQO!J-V{N*>_=^wnuwTM2hQzrlrKpLP2&;jU2)11)3v(WdoO5~r(WOdISpVfc; zrFUznr{9Lt#vFq}Y>RoeQq3u!t7)~+)Z9{D`IVx9i?vlheWUMcHx|2$$ z+MH)fW5eTm=`AlcC@82_GC$&-;ZR7HnKVm9^~64b;k#P9J_etmf(&8ql7-R|arYXBCi51S@+cFI);h zB+-sxM-B|8uDM?AE+4RT>csJ|4gc=_2f|(?Q|C`9*R1MwuYa>9FV5=H%q0VwgfcFV zsfVt#LB;ZtjcHCv1EM<9gv0|GaL!LoX>5Eb1aOxyutrtv4>UhFtG?dOFiK|%3b|$T z!iwAZl7SL{v9oi)eX7TFmfS8GEv*)8P?ywcK$VOoHE+2Xo7fgku|9t0l78Zczt{Jx zy4wSiq{|0f72Izys8biG%)c?c?c2XYi-od|dEk@muuR93T3sk=X>LlX9)q5a&QK>j zYGDe{?=sD^G{30bdx(!Khk)DdJGSd{x8A1l@y(`-leFgo9|s4Aw79fr&@dPJ)|QD; zZ5|!cP-mAmjSp&MVxtBO*1E2Ol(uZ&PQcTX)@eRF~$9`nI=Sr;+|nec^MDX|sWPslH_Xbm;K$Df7AL_K*H! zC}3G|U)$p6h>s!&oRjw3v8BGw;iz~6(JR+i=;#I6` z*}%A2M!wOZ2I}Sqz#I7sx-V{>?03S>#HF@a`XYwU%ZUbm8)fZh!35 zKL>NWM_d17QpEWb4Z@N-KV8sU-u6cQ%?G~5``|>0Oi2hS`JfQ_@STd0A|=W1_1B{3 zqI=Q%(KXWg@9Upg{~Uk0$F=A=6nXTW`=sdp`aIWv=UEcJqYsH^BI7|G>#sjKFYc31 z^giGDa6P&g-G@fr;Wvrjl!L%9y+@EO-}$W1i|@RLQNlX}NQjJA^xS&7qUWRX`A*_D zDY_S3kDg!uT=aW=9y}L)BHBpn>EOfns6C*Q4vhB-`tefWEufB3c~PEG8Km`PNB5tq z%qYP}()wqkJfixn&x32E_4oM8y(i}pl@;Aze{KEqB<}Hv^5;IE^>jq{`Ad3oK2hJ| zd-Pm%KgxG~9^8W-zDL)i=lLDw%Xffb6ca|fFujNe2L;D_(Q{wRL>cURa^~VWedLq> zq-_%u9{Ik|BYIZ1ctFB5i)lb1n=@e)owp%qw$@ftv6o9R@6mpZDR`m*b<)HPRKrJ9xW?Bcu@^D6;FjSh~e*kDS0TEFxspU^}1++}0re(riV z6Wut1#A=?V4eZ3W3FmJ>x-zBQ(s`|xV=4e{x_foqfqfe6?oX*;7xbuWQ74SjO5tXlY~P!cG;;lVit@8k8+*Xs}6C{0`@?FWR&_})*}hGq<9+JrjjOLMWpGzfxm8lCQq}O5KKHb;1VE^U(V^# z2k$c-Ee(whYsb!gmPfzs|A`~vh>NNDd5z-@E3Fuma;!wBCZ}e#Y1=l9_((zmtlohkwHa7kzA$40U(oBm>1NART6f<5kU?|C z2*#u*JM`GGNlnihbar?E)U*u5*YqLBK=cibYTM2|24-wkkXC0`#?Q{F+k<2P8~}#_ z6kvgYSQOXE^eAAtR5ZN?D;e`)b;W~P%U8Sm@WSM!0C1R^Vz#!ki|sEwFtv&f=f)YS zbEHSPj91ak=>FBJt;H;T%bTxrGaKkFHFU>Ar$XFWSJngjI@=kvn}-$4d5119*Y)C? zZqS|g-X8}0>-7`gpL2jiBI9RDkz!q+)|dNi@>rjq>D~2}{+Fbuqx;L1`_+~iy^BF( zq#iZk`g`jWf(XK9gumXmi@MP8U^O3zeIREKAxWqnCC8V<=x%e9gO!tU%&q758kWW?!Hr- z`$zOsKlN_ypV*`$$4_`ieH z*R4(cZnGXgGqo_Sp{|r>3^s~3$~V7ok8Zl=8vVsT-l|g<=k%f-Bl@G?`gy(QZ*J3} zi&M%Zh#6U1EkleDhc7ZUb;0c;ZCYJkb#Bzx@ zu75@28#ijpjw{@@mOH=aAwdB8fa#u|UYqKKHgDdl1N--=$3QDX43UB8QG?2<={d^? z1B<4%PK=p{tEw1Gvjg*r`9_=yo=Eyr%m9XC9YWm=%4(LISS(?%U?5a4n|=?LI#L0I zCE|76a{XQ{%$IcT@{~HeQ*Oq!-F~z2r1}Rl26eNs=xxiKf+zULiF3)7r zVOs-Mow2tPQ_RjT*rwpoHjl#Us`}cIEN;jzm8pjNVy&nfZ`u|1Z>rZ5mVqhrlEE-e z1!C&lZvL-kSzR`u8Wqc$p&+0q3U#E=*HpTXa#+eq#8Y~zL%;jrZvO#H_o>8|ioY=8Lj~_Z4 zj1IdM6Ts|du!81f^Nekw6?1$=>CQnV6TK?bmpsDuDAObVqYvJ$<)z8sR-c<)(d-hu zl$I9rS}u7sZcx%=8V3fuJu+`-^3qZ`<^eAO+;n$PJRQ@{z5BIXz_`XjJWMz!)A__* z|AD?i4Ga(Zg_sI9z|&K6HZE(UWz3+KX8@UnPp)gv$;;L&6z}j^B*kNtlyjd@M`KxsB z;30K&c8fEl7|o9l4{2d~TB`;i-91TVSsAr7tsAbrN`nSg$4*_+sguX`su#XkZ+Yzt z^hck3RQDV{t-&7j$*K)%I`E11WT)k&`6V4YdDs9ZYa`tgcI_?Z<_y-VVHrNl`*ekX`>rED&X}YPGkwM_aaT4tv}@aL>Iu zY=G0&RySCBu{LhmX~1&IJSX>79y$O3|MW>jK~(Ia6b?n5@P}pQtYKeSS#;;1i5?FiS%5jzQEzQkyz%0j;#KUsxG{-;m_p0oIXJ-}+j@h5dV97x6)TBXh zt`gcgtUR;~;yJ1M*&zd*;gN9zH@q*V%Fjpk8XFW1uA{!b-W!a)DwhgjnrhGP-67r( zP!vw9Z(j?-CO;D1!-8ccfUBzO<7;SIz^rHv9|eg42ML4b)+fs4`St0ku036f zi~&oXS+dPuFc{IO!6IWq0z|B@>-z8O%Ou|7eeZi;*ncJ3u|ex4N7ExP_x&qV3T_tyWWZCRB>05^Q)I{YC$ znV+QfzoR_pG=Mw;kO@epF3-ke^K8@8)$Q4)i0-d6pY>%w9UbfM0VqEB!4HO&O9T-| zeUK?45-wp@XR)*$nTcfi$$4{)^p(;aCEA6)$!a;KrT{dw3++Q}7s36kprhX+&wS|5 zPn9BCzM2I6U0vP!&WDoSGXp5FijMO^iXT zZbQLTjt#)Vsz=NfZQpaPl3O-u@8E#G_vTk<^aXo${}(^2DH|rGy4BNYSJET$YhLm~ zmF5==P;S%Fc(1a38*S*0@CV|E|o4;>ngaO>EcReK%@)dD6d|>WtZ- zxcxfRqkOrj<=U#5VWZ}ec-)jNtmITEnm*@O$}eeh`jSWYHPf5W;6SgoZQbPi73GU1 z4cquGEf;L0m~vZnePcErdH;=TCAX}Z%a@c%r!>Ei)6DE;m*WvG{4qF5WxBM%hO4VH ztuNgA8S}KJtFPRrR5IrBJg8_-8=Up%{OOZAfAWO+#|V3k|1W;Y%^}`qekrfV9y?^v zSk^T+u5FKS!GI$>(yx72UZb4f=~)kLwWw6E>dX45AdVCQ0JuRuqp}7oIq!nfXcIv*8}u zsEM(D)rw2LUkb~ciNOFkv7z9hkXIhZ!&|lnd*h7U)4~e63 z!)pKjeHt6J5jAg%rM&L^{1Ocl5^IwJ>BB`E{-jz8S4-~*>oA9 z?^~9MVLE^Av?>Nm?FJ#l+$4~DBaoQouGQ=a9?ijF>t44xyG0YTG&7U8^t1O;#e8$U z4dk1Zx<)qd(vB;x3Z6y0hHZYHz<8$E8V1mz3$3$9=yvov{U82CdWQs!*xB{*r(9zJ zLbvNhEES0*;^w-)p{oGy^Y;Ry<2q%j)T36&ILc zZT}ncA?O~^#;U5-&@bAZIyE=CUp$%+8fKr6oy0K#AY^GP&0Y3l7>BiBEFHxhv#{gcc=^ZBQVJ|64#>p z(2lT@c%R>t5%Dyt1JA&dh(~}Fc*BYz_UFL>(=litXn=lF^n6qYe$y`OBgD!&0;owm z6VboE{D_|DKG*q>55FmoyrVYYIj-@EuJJ6-@E(b4v{S?zu196iuKXqO9?wN(aUC9z zSM+W~E5CV$I#Mp5h=zz}-i>JDH}}b(W%Ha{#q#(lkeMKBR@Jfki+l7LcoP9j^5VIO z<|siMiE<*o@JvK=^d5Odb&7b%hq`i&a(EW{*z1QlFjfdg<+Hs4tL~74^?B0n+$W!} zCh;x+=kGuGH~O}3eTN2n6WX(VOana`b%f2tJYo$iFL3cQfZ{E;iT};mNZ0D-N7bWr zk1FHs8O`SmP-1c2yn9ry+P7D=@|;wtt319-?KV2G)iX*gO(~J?_j6rpbhur&U8g(l zeLxq_ozk_}UZV@=C&Oy3l|osywn8`-A>Gz(V|re@Hw`Eo8&}cw-?VK)Q-5Rf zfv1ePyE@lSPhQE>=Q?%oefR6Wd+!s6hgK>rZQC}YPWR8YW=5?i2WgL82G7adXrk_7@=%D(BHdxLRI(z(( z(gunz{<@dz^69gx6-pW#>Q}@4V7{=bZiA+{X)4XkYh&5vw%i{K)Z*ivs$5!D@xr2d z2Yd9*Z``Xt{N(-m;<1YcUG85oH=NtD%lc$_WnMkqeL7`;Q>o;`%B0@GagFzz2f2md zm1)J&AzmoiUh^lW)8`kJ9oVF+uDe!+>e`g5?ckUC9i9wilU~hlWEf9TkNL_)j&%TB zF}3x`{SWD#@A|gjJ*n1X+PrtWHg6oa4(Ax44g=MeP8+~YO)Z6(5Ihqvf7wgi2k1XB zJ^JwDVLuvmzS49jM^7I|MVW5=j5mcD$2Vo!KLDi_y8L0Q^UR@ETv_s zDbJxWsQ^ozStd)_(aIwBsX?jpF4uUTeLi>|mm=>ls%5DwoAXftmcnumg^h=Sz(^X1 zGN~wvn2~bSC@hC%zZJ?NFc$z8DQMnf=`#0N4Fe7Ad&6>Cmf!-~Snf?8tU3W`AOO${ zt?c~*O)RseOzyGI3v{z&oVpXV#eIwc*8qFa#u8%6WqC47gBdYnKoK~WKtmtAg3kaq zzyW!|FIHLcJdMioY3ju_o@Mhq{<8cYV1@F6cFG5NgMisn2LK3NvJQH!Gpt+ZOUWmGkm2^@SE~6=;X;V?`U5o zo}~9DcEkAK~X3b>uJaktdxJUcejZp^eCc-?Sxd0xf`3 z-l49@7)!zF{N&9ZHt-)FApPmhnb@)Vm;U8_uU+9N#$O1A?ec6bS z{z{_m&`z7upQEzb9UD+fe}+EV8-BxQXeLj1_|+z4OwQ_* zLB~n+|J2EIIy+U=xzlHK=HhW12m|b{A>H}OTa}-g)3HY%)sz9y%FLwdtMe+aENbE6 zq~_gMN4n?qjyLyf@7A)u@X62Xp)Wq9nUm+WI(JGlr;lm!$O%1u&z(B^#N#^cvM!uB zsiTiRpvUjOU8kOSOmi2`X!iVR9XoiBCXYX^i$@;P;Ro*0gSUN358w7lop|UD9lZAo zy8HA0r2FsqtPVYJr|!G`vpQzb0jMJm0dG(;)il`Q#PF_E?$}no(PP}y!p}AbU$;SY&R&# zo41^(6PZ+J2q-pGu{@Ss9}hyz0pc+*jwR@2 zqq-i0PF6RWCso(C=1-+$P--K~Z>Bgo8wtJ8YH&spazdv&OojUx)QJp$=#O?W@P9Jn-1N3n@&7(m-D+##~-{?=Pd^t*cee|rP}LC z$FZYsH-k(jvf?dY^B1PB3Z=YxQZOK7e;uj6*ETIi@NK*DrhRdNa}jOa@%pqULU4LJ zQ@F{LIt%ucocwE>Ei6cGmq;dQL{TCjg>(C|GP`>lwUIcQY`&{E0 z03f;m;KXztf$De+*#VmC07>5E8lajs;r&w4AGZVT!x>-D#NJC5(2zI5%-kb(sp5LF zB9Wb!X*V{rWG8)SA+6Utkv@FR01lO8qco<7FhGp>Sayn0#PBmE!7jG!E5p|G>{o*V zWiJ?3|FAh6${eCFBJ6d7yBtHnhbbaFDeNBtD1bR^n#VnqFh++|8XX?P@WBs$Fnq^*1+YQE1Dx0}4&VW>!U*#mo(eoBEW^fl04CTAg@(g8!awqa zevB5Nf&Eh0b(Vc;$PeR(H;8kM*malu_^>e^yu*lNV5kQ)z#H~-!P`N?FagF8Qp&+V zG5W`Fv7DE-gGcN{OIxxj9KZ~(8GHbI!dGZ`-}~Mdj2`p@3ZWm+2C#qz%7C}*zRVW? zj4}Wz?9;<8zz7tE2!2B^d%~~+3Ioo@aDbj@k06XY9y1I+U=f~@4}Zy*eRTjF2s7<~ z@dPX|r;9v66T-@VLhR(rHHG^sV1(H)kiW$Te*XSb=u-I%2AnXW%_@ zgFN#L-a7b1eUW=Ms3d>dkbATfe5E~^HbR~`Y62N$pCH-69=q#fX?MVfB=a5F3_Nt-Nu|W6<$t5PXW4BE)NWNHLr7LFS+*SQ-VFaVj+Ho)n?1fi_W(kj2HWw0B$jAfP?PNZok2n6U$-h zixGb!mhebBsamV4OOqGF6jaRyhCoz61|--r%jqq9`t|0o zzuA3YuNDg>z5K=(+fcXb{OkpnQ`V0DgkJfgtMs~;UaNzL9?{{m)7mz%L&;1`6Pq@w zr?V#jvWpikx?J6K|TP}wB)YaXqxtV3ND5bHD8UN{e9U6wq`?%(}ZAjHvQx9NcQZ>=U822Bkgv>)7I{`G`kHFC3K z^duj25Q9aY&$jU>cPVLE!9~4Dg|i@bV;*>ENlMFLcC{ zK@O9q7mt@qH(?5=@N>Ka9wN@WLN`4fz*+M@JqL-*84ZG{Fj9aUj1Nj4kU+x7!#vOz zo2)VIgK`EGU?lKfpxAMVVin+ETC{HA3#EW7+nl4 zU;z&Wqh$;udEs5c{SRnh^htxU!5fO6yfJ`uVi<)2=Xs0)MinCqU2MDuz~M|L3>jV+ zHWI`L0K70tcm}8+BV!C7Mu5%d_z;srf_F3$28lcY8{~oE1=s+HD2M4OrU1#4d@v+{ zC_o}05~GXJ1l$0us2lYK;7~_^3kg9(D4`cG5Oh#B#)_jWXal?m7<7ysc>^lp=laC^ zkyix+3M~i~fD3R1@AwX#_R6!09ff+vVJfKSkXmkHnq zr~pL3GvtkSr`{YpLaYq5Qa2LcqrU(?V!{9)05;kc(1ol5x}y$?yiqS`LJr_1V2^!* z0F!u1=uglSfi(sclmUsbvROwbmd84Crp{|ueN=N1{+6dNl z_4Rpeec9J5);FM~#;v;ZAL?3~UDcLMrw+6>DbATbiJCrt@d@SHnp&~(O4%UQ+6)fd z#LIJK-TqGx8O&rgb-Cz%*J;JQ=3R@YvKr{NvGV9OWxf)d;%ceO|I`g}`fZk~wm=vJ z0*9Hp=Rqp#VQyYf+b?nF~ef*;z*XzIKZMx2V?3@8s)p_JrSF~%#maswK`3skVw*=2n ze{W9+j$T@v4;}?P3rllL>gpXZ7-7{Ao)+Ronr;vFH!B4121go{k!Ks|Vrf;eMpYRD zlSU({Mx|Y;Hg<$&FCaW7c->-3*4I`er44eb1}9;9*1!ZHL*-kB_U%Sdobwd3jD^5l z%UP>pQF0v!TqceT-GoC9@mlMjOwp}PT@%5Et$=UbLoe_*x)$jM{_;DrS$s#=kfMPN z*E*0TmqZz)sGKNIYy-i=v=RNCYis4wSJtNV`Ar$WIWMcoi^&yaRJFNPI~A zh0%PX#QT(mVdOmw2Zk;>P?8ZWo*R@ndGdUe2j8QZ9vTChDF0pWdRN#*mZKY(MuCk)Q!U8YTE0 zbpSvIJ48b};Fp*v>P3B{(LZ1quM(aLfC!)fV-I-ZIi{^hfDDX3iMm4vfEOcAg7=h7 zS&{r;?2$JTbpcFK24&*e!k7cNksUlN04``pUP-hQ3Eok6@*~l1l!dY9IthCC!0U*A z@RPi$d&DpPA{SAL1_ z`fCktb&RIAvUM>j8|2^d52bF?$fZcg_gnu>8@BB<5c7!MAfjOfo$Sb{2Hz|W1ViJsK{mKwfqwIcLp)i^yf{0lx#`Ou zt$Wnkk#udF+PZ18LB^08t~YE2(6y;%`pkz8M%Qb3)&Nl{%YVxQ%-Lx*jPgz!aGW`N zLFrAS1|)r!`C;wYy3M>bh_+5a=Ul#YS$}=}QLVDSNU~eKn+CLDw9mCE>csiWnx3Bx z8>^i&{UyA+hmYyZp~sYU*{8>cTt5Shc+B)Sbn()R_Ky$f)mOhQoV|7V;=S6wZ9psK zMGa2uRAwx$T?0w=XS?*l3-{{KQdRZi7qnnw{_3~BUb(piRdTD+K!^IrHfYL&!@l9M z5HOrcW-Yr9tGC&!L}#zk?dh;{Z?&+hx`AK5ST#7LUz%$eU!=u#iewfUM~}uk6570V zquPD_zB|9DFMRT&DqD{6nhjdk*~kyD`FDT&ejR-1Ubo4j+L9R+UC#UsF9<+kZgEK^ zHf}L^>DjYWJNNC;#YBhcnNz2MGIF$W^Mr1E!HppfD~|WZve4mtE*c#EPLs7dd_3f5#*AH;RaR>>2vFIC2 z`(t1fyhX;v1npK$YMTM!g7tpfK+nIdPu6q?UY2mey6Hf_p{LMc^kF{yMh9^XxsCJ@ zx+0op=N`|Y7s&@Z!*h|2i*yX{kSF)J#&hI}&f*?z#doen<&vUjBRcp?KIG5uNN+t| zdd>h21xE&#sSUg@cv6_YKrurcmF6!*qsT}QiSouEW3*7N+~ZxQ0+`<5H=YHQF6EF= zvb>A3j+hV`0}{#}Bh5&Y(KrbM$%m0Gqj5&x05TX!8FU2hlP4b-5A86W>rn#GMCVj- z9Rmiqi|8RQ%Eu$cv;+nbU;@nm33ltnXj3+2Qa%O(4+9_z?+c@T0#5;Q00!<;4j?L` zB?1nVN4b>2G#=(fF#PH9#Oq{4nPBa zv?;)t^2wWWkZTe=i}?JNCdz>pHXF;8mi*g_-J?1H0cZVK{h_D*F~4lonYwEFd(NZx zf=7(wEUosnwgeAV)l+HHbgHGhx@$VyR?-cLVeL*QwRN{;E^W)uF{M<-U^!{y7vG>< zYsDtMtaQwS6w7bY1~xO;t4h4CT7$S2%TObs`C>s+OY=4)?Uv;QC1z}ZZQzQ9q79Gp zZ7>Mx(UGG^w0XemNI*;N7)rk8&%En%l8m zg9Gj-%PSf%sGpmj3`b2IJ#|hS$49idFcm<}g^QQmrkiwm>Y~bpl43UGXU?1r9wN@` z3Ocb~(uR>iH4KIp+#d)uU2z*0+N?j~y{4(IVtmQ@&Fk8$CUodj-g;prtkhyx=cC7t zi%tHz28YcT1441!gWDq6sSyL44g0TChmGrFj~r81sjRl1gnB#rboG`iRf#24oLsex zy5Dx@m2K8kNwjM=U)1;f@P4nnepS{&h%#QOt+Ocg!KlPt} zUNf@`dg#%|wY;>fZ98{|_>z$gV>2i4L^l}&Yu5d( zy@6pbsWX$(KzEl;oj$Eio44uk;iImV0ieO=nbM*GS5d1r&Uh5=UR)cL6-!kWT@Fj3 z&mFu^58e6+ts0mCI!bQee7T@>BBd`5{&nzhu^Td{a>uhhK_;Jg>@mw&yOwP$n0~7^ zQwF>%VI#j@Khr;)R9Cal`ee!i9CN-+?Y&~c^2GA%mM%;$gcI$FtzvmT8$dD*n&?RD zn(IBVYwHlPYS3JCTi5DqOV&A)iYXt?6GM;Ck0afN4xnyPpN&8UwvT?uvs~vHt}#Gl z1|`yq*ca?J9`wjQ@LXh{NfCGf>_lZn-vKI=!LwZFJBjNgp5YpKMt`C2+3J_)WEEA! z7~Irsw~wa)0D*$!J0oj?f|=^z8dC!>1|x(r2`dYac@l!o+}L$Z^Bt$sjMl0gVQzAjX7un3@2bP!IB@JPZfk2FgOg zLnrxRxSI1N zKBi>=iwFQyHGn)k570yaEQS`Z2<1{fe1~`c<-h!wkOxMGyr~;P$n*l`LJQy%p2C0f zrhZI!K@-LfV@bIfTLN9-IRJ^j7-9@NV1nO#;2CWTubJlJ8tnt{V#<%UU>Xr1Lz&P8 z&3q?c>cJEcU<1HQAT7@V_VCOwy+hjqics9#CwLe6ji&nm36~y`gT%Ei?lNkU#3l`?MvAwqcqF@QNo6S)mUQ`$PT_Xrye~lRTK# zgfH*}00OV@bOJI_98pK7o_Jh1?~68uXLw7H56X|G&5&Elrv4}tWQ%?b&xqfOJ7gDaa`kl-i@|0U^GT75Hdh{yi5OtKKRFW1^`DqaP$xIjM@y@`D*kCi9VRg zcIwVsKc-*!$sf?<%!;<`*lO5PR?KA+AA<9p(I-kCL&HXHsKjzxQ>!+VuWh>T6$jLn zNUP5y=ybJBPjoEl%!>_}FQ3$g%XPhSLs>6=Yg#MYepdBXPT4cRqlJGkNI$(>XPdKX zS}*ss;!3X8)&0wFSNBze>S%Rok+Y5xEv?K~G;`j4=dO>07>Zrjyx9CpYuEN|I(`1E zR#%o(E#HOE&&(9@Q5tryQ$L2=N?vQ}XU_#9frC9{txE24t*0 ziK{E!uAY>6SFakdq_k=ySt!@E+DNHpx`}1TW|A5mW(V6PoxQN6N{yYy*H%z&+_*un zdG%|;3acfBc*ZRyK|F*vQ+O6ug4A=Tcwb7MBeYDk|qa0IifYV;!-$w4#E69(%bE7qnrd zF9dWiuN2G|j&msadP1Z9ed;ub#?8WtFXF`Ts&v}s5!=LyDvPrga;9Z>x4~*rD~mO4 z+|(87`M`Z13>zaGTk2IW->;P0fkQpNc+aU22;LE210LvE+94VDpy`%ZtE+EN$=KQe zV3k!_rF@vSEt_UmikTRVj*SFef;~Vl(Z?whn}?o8H=$qY$Fx1=(D&hC1b)!#@RED{ z<~#a;>+l)6qQoo&vf2nT_4%+Nbm5S z=de%D**-YDi}FKh!Z;K)#sUWLo61utG;e5WD#OQH?{FKFWf{X9p0(86=ngG8fnk3{41JhYM` zdMGENKgt6y22*#8fXRz{q=;wyr5y6)9m;`j67=vq&qZ~FFZ`t(3?oJzV}noW}b31La2V^C3^l<8S1Ji+DpFcn`kvo%W3q{3V}AZpb&{NyH}-^z-4_h^O4AY_7w* zh+olf=;1s3;JxTK-}#WD`b776k9u>Bx)V?|UJ>oc5YO@+-^mYpp^bM)l*2v#@@zyab>=tkaPO;0 zyqoRp(ygEPpnmFyzfD~|qhU&lgDT^;5Dgp5yhpx`MkxeKvV1gbCT3tzu<>rMHuY`Y zH>o&4)v6jzGHS zqg=P~=u^J|Ij4U&3^;7(!juxzDDbn*51u`BOiMEt)vB@vtWAkH@kC8+8tw}_PG#7@}?{i`{a?!N$D!>QJ!fLK;fYWq&hC()mT?CqTcN!Gh7-qT^ z_s8f&u|%hhZm-gA&m{3I1`RFKS}`AyMsy(ou3cRm-k4F-btedv*b=~Hh=FRhDchaa zVGlIUKJuV`>YHxV$;(sv#Chu&lgd<9vpu7d4fN=M4gTF9)fFBLq<7t*=EQE>+?KZY z^r@rEgH{{zZUeCm!=qaE0OLa+{;)pw@lUCS1OzC*1 zHf`UeN{hf=*UNOmYxY_}Hj!UMlJkx@m3?evP+L9VU?o?>H`-cdU4Qj;`pI|yw0`u* zendO>>^9BPo_%{Yefg4V#j+OWW;8G~Y<~5H?Ep%vD_UBZRf+!6;XY>2z3lv0T~^I6 zt5$NKbDwW>{n+>}<#xzsiR)rYYt_J`P0MqW`mXPLy^bH9)E##n(!{0_cQC+vOV{6c zgFf`3Pin`;F@w*pAm{f#aYjq*|6;jlqDC676vF1;dk(z7{lzi^DssC+PjS_TpZ{=n z`f*~1n4&@t(AUr@^ndg`K#)Nl{6e1S*XR{w0GojRigYphfkYm>!*#w#Ivv?wC2TJrDuBot4&`CeP3-N?`*b9 zw|)9U`o*7khkE-4Z1UM-B;k>7ODE3Ego6b;lNfHxdnTpr8^>)F4g9PKdu*^rk98?) z>&8AfnN~s#ViycNPA*KUdGk)Kbk~(Tdb@7i*{9#WHK)OJhkoasBPyJ%tNqB8y7l5g zwfEH2uejQ>OS&*RqLtXN4L(OH5FY@*vUPDivz>T6+`kx%`Z}w2qWTxDh_~B_65Pvl zi3je!XF%ZZAtuM)dAD%slon<$i6a>p=ChK^E|LF% zwV4VlayU5C$j*9g&4Wiu8*Cju_(Zt>f}3x088);`Rhd^U8)=L`^}t}W63y5~?X8lg z&!4b?T-44TSA>(qIc6b~?FqDO+Pqo41_75Yp3=506Ixte4NK_jZods<@Bfv@m)ZuwbK)-_Y$F5J=vm5& z%BM_rFJD?(v`qH|uk*hOzR7;)=(uQqNP zQlXhvtWee1w81@w%m&0ZK!;bCRcS9NSITL0-!5$#BW~k%^^I-RT~D-YY;0A(@!h*s zeZ(f-K@Cvm(25e}FZDqIGpLA^H%c0V z!97NwTn7o+KFj7(>>}IdZ*ymlY3}lQgCo4z8IR1X>g`HusHZcG#@TUp)u1HV-KVbM zP3j$+Q1{@V#y5;<=dSJH;7tGt+uI*GdMw23qzynADRbTrV1%i=4ue7tP)x?U^cR2f zmwvvWWO{8dWJ3J^TAM&GBWC_$+^8S*p$?ZWUedzCysP2g1hqI(FFYaLrrB^u-+kSn zHX0QE-I0Rkt4*a)tpQBjj46~9_0)+W;^-}3I>&*H}K5Qt6ErAtAf|jIL8LH z70+nCNL*D`Jzd?#KIl&fTx$d9>&#^J$O8|A^PH}K$;}3dHsS;UlT0I<{6+K!Plf?f zt;7lRbFOz)*IawO(w)636^db+nkDvl%7~S^eBq428J@SQDm8;k0*fu1#3kjbc)Rh& zRn*hltu0$OY176H8ria6W1A-o=sNVdyYC3zHFnu<)k>=7SG6=Vt1inxacMzygS4E1 z;ND%EH8V4>i_>!&9OzN6!FpGBhq`)ub@9S<@OmVY9uymhJn`71=2q}t;yJIW88fYx zrM6~VSM0sg@AVl(_6M&S9!0##00LxzZA<_HOt~|4&2>JsKi2^i{EoaN033c3Y7v1E z}za9WZz$to+gRhH1QtpJDs8M>h`H-IO*=O_2vrXjnT;vla@`DF- zTsrpu*EB}F;&1ew^i=sp_n)q;XYDn`fU+*Rb3-m&MSs98j|@ zu0o}%mDOBWMqI16h4>6yI7~qe^rVAAkGX$!R0`U<@sfr&F6(7)ZK{7yTz~b&Q)>1W ztSB4m>>pIdy6)1YbJ{$*LC4Qof%jDP+UxqYdXD{Fr0p+U&=q_3sV(I}UoN4?k0&&> zY=h2fCYQm=sHnauU;1@aAN~S<_={XnU%sPHSh3=s5raQcKEfA|5NJ9SLQAAeM{)8}>c;G;Ts=DZ39Bpe88CI-6K&Z5E%wKnRe zt@ukU2KOU_#pZkG&Kr!mZfqo2Ht5Vbue`xkI4IP-Xg6@$GCrmgOI0JeM)2UYwoRaJnuy5C#V-xzwPTMD86>}`~2t1E7>l$)8< znd66a!n{6l^if?tcUCh~lR?%d&9jxIRRbmS(B)^7?FR2D&94-6*>XAej{&pg7Wcnx5+Y=>F5?{p7Ts7CJJF=R-gyfwwHNr6EZeGM*>CfCgQk zo~lmKHIO#})CBnwc*+W!FUOmwOY7^$CyJ3F(ddz4db)%FAlxKeh2+VHx{=l+;3wB- zeWEOcjg?0Pl+tP737r9ONd2B%$EV5@;p5tq`ALeNr#<+N;6GL3UX-4WW}bsS=zgl_ zqI{k%k0?d7G1_6T7!)i4&~*5xO40M{)0eyUbTqC{5xr63dD;b<)~BbESJIPt|5Wrm zUHd#aQ8u41*G^GFR{reI{wxHuvl0uLe5$%2M-M&pXxMPF+at8arP;8IdVcysP*@m= zgq3~MMn|!xwv2RYba>FlCa-!USQ97lX2E~eGA@$oxJgO`*IWJq{Ke6JZ|XDt8zbi@+@%y1?V zu_MH7tXi?3J9$JiXHSMBEVhgdg{dP>hhEOHOxvGl#%=rn3&mo=&l%8J_E$?y%^Gk` zS$9vQ+x0_lyjl0pR5eop(8ZN&CJkPeluEQ|U)zihoj$LVxps{kT)gp(Z(wH1M%;#- zl|IS1UiRu&8ej~oqdl%qf8rCm_s+Yuvb-7s%Tvj<7>?)K||Fj;Q=WG=f0EK1Ftk6KYk}#^= zCvX1J`RO|% zGoTP=^1?u~!Y0~Pn)f3fudfUAKnr{YfU>z9G~mL9J~}(W&E!K+Gv!hj+J=1iO`at9 zjeJlJ9gk=5a>3WA9^8X3{AS-9o{xCSa}iIViQio3enfM`OUflb+_TaAFV}dUXQ>z0 zNKqa<4^2^7)H#y3=rP_Mv&(inUx969C`Ikd}tmIw+v zSri${jeGo#=;u4nlE@d?VRakr!aeebX7VEOK0ITk9NPu(mo|;+5hZA$F06uk&#(Pj z_+GOSTbjA7sq-gQz=LCUC72y?@fiQDn+G*E+@*w-eOIUJn&?xn4N6B_TBUeJN#=y| zab3Q!s*Wr6=~7`;%O0)wCS7+M-&RM$MyINwxWPs$tw-jLs3+5#(sP_9O2; znuG^y?LvD-^@NZ7<~#KAmk+#(`c04>^Ua9GaKbWSlf>}?@l>bc!Jw`Ir-scf?O83a z^_!a28NkHDR@G~39uW`LHGSr&mM@>wj*X*XUmBKt*F1WknOhBUr*YHRolP6K*ibmv zdX<IP%F$~m=_N5(C1~Vf=1iiMY)5g;^*DYWF3cd5~-w{9o znih)L$ERVSR9Idx$Z9A*zo6g!?pJ7Tsy1Kh$=o$dg+QgjO#WXG#@;Z0^j3zBlN1k|058Zp0<}Y4Q(f}!KA?0kRMH^yc za@WUg+mTYCl2^7Xp`PBXE}p%lsiietbN&7a4fS?wav`V3o;YpUTazz#i*6dA5{vb9 zH*M2~oj0o5)@`upJeex1*+$fg!RtiK6(^(vKsj5iw|7V@g_RKCjy%DS;gMlY8PFhS zG<(`Ws^l{I`g+1@PCz*;KamMMIoL+}HL?K@p%nmxeuh5c%a#@aIDnfq+snQ?-F_y} zZ~cLWWsf3&CyBh)%5Mw$h?QJXKOui;<#!~DB!17%%xYk4SlbWm)WL@ybDwYN!3Q4s z+D%bKnL;p#kJUREUKl_H2mqo2FbX9H(qoA!g=6$l2oQnS1VLnZYqX>sqM?gQlR%s> zl_jZ^NkbsG0230+qj?5p!|0mE;29W9q&Lf>QK~3i1fBbo#d26Syu)il9_*3Ba$(-V zT^BviH557bSl)gzO#gx<zIuG@VIs?y>2mGKsWCIY$5`E+wS){#LR!uuV3+=>?&F~EVKodMcMyMCG zQ7(Ls+7j8|dD@?6kt>#bvvV|nf-MG+74GpD`k;fvmI2U#Op*^D9P5s$kfcixF(3g-;c*{=Y?1zL*u`L4IFOUyyM_WS|?S;-@P=cJX zET3lqlN?n7&C~}TP(FNzm+Y2J-+^D0`{cw5iJ6&6mv^sN;#{wl)UpE4#+%xzbkAK6Xl2fzA7g7n(qeWv{JGWvk`?hpe4J>+U%G= z>0t0NFNsW#+EX^zsh$wSf&oXy0I0N8(4p~^db@fwHZc}XI>+n8Qsd6ftgd_E4Jy_- z6NpXa3?vNzGv-ZqXHtVbefrJ+@|$}6j?b$zX+T|FRjWFqOle6m8^XEjsFpgf)pFU! zyT|#aJ9O;$69x&Fbn(JD|8;*obxhM2FKgzK>$sd(PglP(sf^Ouju3Zr#qO&O5VHF8 zXFp|N)1}^?Ze=qDnXX4TMcj2UTLTa1dAE7YGGcj}y`+L^3Fm29cJkJJ^r2PX>ohP+CD-=* zqJ7~98y?a(iJ_`jaV%Iy+A8L6r)6*@$nAQ$My8PqKG;9{e*inyVep#sq1a)&QeB&> zWoPlS!4(1dEY)Y}JUc6MObHuP@}0cb@qC{Nz`&ENdZKnO;Oyx4OEMad4c7;BUv`6GlJQ$S;3$T1dpB);=IzcVnMt?Sv1 zmTluvEG)yOOq2^7*O51k{H}MsD~!IO6^{e&vVRYr5T0RaHHME(0x=XY8Uu_W!Z<(+ z`=dY)BT+VZ!x%y@@39*%497r_Km4FUF&ex>op8TXcN9NBhHDso02ZK-BL@H&jL4}I zJRnc#f8YDw7mN#a;x|IVJM3Y=UM|qf=pEpOVZ{JbK1PZ?Sa=@ZW0c4PUQ#yCFdBtF z@DIhn(G}zgZvi?#{^LI$?z7CDx{xPEi_HMxCwr(c`o@a{{dnTo^9Sz&;DIIbxIHn( zbR>9+;bfyeIu&h-5e8)7F{4bT_CWY-m`I+;6?DQg>PiP>H(y2{7+U}(?_%i56TZP8 zIyIgRJYcjlc>nCZJKhlh z4ZH_f(RT0_K+HyX06#Xt#G^*tC<8j^AKb@yvVRRU(r*AIY}yAvgLj+*1{j4ul*tF4 zAggS;2VE#7>O~(Sf7+R6kZ}Md`yA2Np&LUDIDmib=>x9-SjZ268?b}%Pb;>8m&v1uY~@n14v!4P1a>KFnWT?_#$oH&&^#8o&?WR`dn&W&P} ze)CN?C>d{8ab>}D)eM4~26%OGL>G1TkV6UoO~qqk+ka=YX0Q`k)otY~tTr+|#FQWp z$N_YQYyL0p-z-nYcw)rZa1n1-xt!M}>l${E9vtos@i<40p3v=ge@=h%_aD?9AG=%q zqcL?aaC(oY)0k{onHlpRgb7G5@mX?F; z^1-H{%aDIQWdlbxV$2ylhI(1&VINk*bIS$`v%1~=?EZW2(V3GcbolTS9*EqlOBc=u z(0Sp)Ma@jj>++>3ojH9@XV0C{q`?@Q56;amX(hj^#hhuVl$A2rBS8NA`HOCE0|N7y z-<5`qI$H&V_NWKHRjgGD;M0v1jQiX|QMDHG;yzA;wl%|fUzaYF)YaXi3zshYdF#na zL&ZD?>;e|>UIPZ!2FrM=W@cuC45HT}9mNzMAUc(`Tv?`jd%MlMMlHyv`eX6_);4ISSkj{^b7Jt z_mN+?ZoUDW!hQ3Bx^Mkh|Ob#Sl{@NW!N(9zWlx4{`4_8YktA6GLa#bhCp^* zrSoG1QKlFScFVs88X7dm=m9Z!bRCqQ4}dtDJVfkxELmkF$qP@J3NaQ zh~K=AM*^<~Ui?IeQkcgH?f#QY0_y8U_!wJK~#(@~wpZS@e3D0pp z5{8t~H%b5_is9rrj0X$^Y+xKPJiNH<9+J_)d9lRm&0?F?AOgA;XllmTsn0zr0=J$M4Z zB(96{xetJ0muX}auM2>fwq_uJJOTtF!--rYd$c_u0e}ctjLIX?7Cg&4fI!NEJ~}tv zLu8M7BjbQ11_Q*m!B>DdJd4_xen~y4GqOdyA_MRea7X(?DhGBc-{;d>D-Y zmOyF0$CGU#exYfA0B39$tYBL~2R96a2tw9UNu$lQ1~TKSFRmzG&uM|FlWI~N@X4lj z`Bqu~`@?^)qvm5Sw_>}3_lD`CwHN~Q9Djq-HV@zlyyk-pM{>YluJLU28@b{`dr`;8 zXuuC=<91k^s^=PiNjy*DH+gViA%JB6HP`7~-|}XC;IIBf_gy%nO0!+H@Qi7wq%t-f9{sb~U`I!rR#pMaX6Zj09K2>l8&sJW9UbOrg(boU zo~cII{OZFtIUWzD#}8?U}zog))! zT)bbkT+#A0t*&^V;s$BU)wsr2r!}6RR7bX3wQR2zJo;aD1D2C1t(xR>D`h3x(%QCt zpUzJ$>yQ7$17Np(f2>op4Gy>Ts6Oz}Omqr$aNp$v@3~Gpz(YR#j`&HU9cZhlEg2}H zrx@@8EJ_BsoN~T-(?;#zca=KYI#eYO=h@+WrgN)0e)L#qm$YflrZPHn_KXKLXVsbQ z)J-pcxjQT%(_q9pyvk;U4I6IPGhSR((cqRtI}=8wOfBLSYp@%!+lTTS4Lmq8XVK94 z%d+ZuaSe=(8uTU9 z9pB>Tn0{W{)DJxwCG1B4CeELH`H&X?ob3w|>6G5}z3;UAX2Nu8A)gB%ofxoo4>k&` zD+Vp)Km(`WSIj3)4{uo>0e%gGG6pN0FitzM4FhpU032f8n1*gxj);Tm%NIi*$j#== z8@35p+XwII(!U7cL}|TnkzfYKgTIXO7**q`VC0HnM7R(#lp_X;gi)hGP}C$8Z6t&w zkT^;g1&VK_0<4(ISrd#kW6NL4!+-%aqHFLP8p#J905~b<$@ya>F|>dWM(NN%f==oMub?%e zF=}W2Mk8C=5@Qd2)HUKAyyZLPkOv7`@VIaqHwKWY6B2nw3Lc)~`60n0Xy6`s!hbwB z7=MT#0IuoGcvdjTc(kYo@52{>9*HvH4{ZnENYo{gdlKJy zjs#ug!^kPR7Dhcz)Sd6p4-c4fWfVyrBO19LDH#AY9y7os)2Pq|Eqo}Gb^x#dA^|i2 zA*Q9p;mP zKv$;Ax@^F_?{d8i9L@fvd5@a?x6#62t!;%|`4YF*uazh(eZXf6l7<`xVb%=_{{ zR!>akwesL$t(-mKIxQ>f>($;}%JdAVxpYan<%*V9(wblplP+od?5Fkm9S!|VDXHV- zriQzFwEf0g)QTCX%q4Zr;m5VTd(Qb=AH{6^v=+b8ZXh<@SkNQs?Ru~Qo7@RUA}jIM7B`T#nNHsgBKR{Vyqv!NUCpwUO=L7X zJ);kJ@cqz^hs~o*m=XklB-|Dp3vuSu>2P)$`|+^TbIQQ{%Do3HGsO^l#fjKlui08N z<+->tuR@97V@@7l*2?^xW~?iwmh)m#v1NeRthlXRpO*h=`U5`ATislkUI_Bf>aMno z+qiR369a<*q$8i`1KN=RC$lBgojwmAs3TKE&Gw{fi$!%O&Z$;$9>_P+w1o1~910(1!N3S?;Eln{0rLK6PSRniuZbqDVKDZ7&fFMTM>&xdm4NBq~w9{!weCJ)_ zBv9fUi@?a3P84-CQuI7|@u4FzZ2?~Z5f}kR$p9qsze%dc${&FM0F9^8g6N&_NHQfAZp4JTG`b@U~&t0VhnoP#1UrPiZ>@ISLNMxWXg6 zW_Ui}8(sb?^kw1>QnpiSYUWK&U4?rA$Bqa!k3%HXwv@Xp=~Z;A!F> z`4Dpj{dh=tE~+cuBHpDOWCO6o$O~|U$B_OQ4IJ>=0X&KILcYj@cA(9m4G_XJT!a6} zH0?s4;~wS059lM&xAB@$4qhGlIoIF~ZNxM(UMT1SNK!Z2?aL>(TchTYZQlJg7lJV} zod%3d*CZ2R32>p9vx4_X)gY*4Fv5N#rFy%HHi-FZyOwQ4OZ5&L0_%zHUIU&p9<@HK z@A{50{pc^gLO=Kmud?14(X01ArfYZ3YX5-=4WurswfK;R`^GdfFrpWE@bkhOuh-Sr zTo-f&GRy!b;z6L)yrV8rTacnYNZ;Z*eBuMo*7xg3w~%Nrd-+Qy6<+y8y-N_Ys#~tiNM)Zr&7Zc8r-s1yRW@PH@?yX!JA*BZCAa>*RIgW zw!JnE{hC`YXgTN43NaOHw9?Le=;KSJyk_~VE~#FwscC*Ddqy>GUXGr5Tra(Nx87NJ zP`^4htv}da*6)q2>do=9D%zNx$+cu zsJ^9kSX=9y?7cS4gkI+Z58*L=g5T5&p29o&Cv5; zTE1FtPvTt;KK7_S{khNRHV^#ny7ddX?bgrft}ooCl4X9xAS3IxNn6*Xn37tyEvOjm zwA;W}%tKbVRXqSVaO=hcmFiMgc1S&4quRRVO5N~+uXF!i$ zWI(OHZguo$R5froa(+suFU^G=x^r$LK+MeCZ15T(cjyXcGSIOMXwVsWg3;5+F4I6u zg`CR8yso>VTfg~>x9HmIq}6iH^{=@7^C1uP6FLVQ2Uud7oq-DZIQ}r;C>^hIc1OQ1D#mJwOx+GD6pQmk=6g!K+25f<~T2x#4Mn zc8nD7VFaO%XBe4dL~!{79=HyTQU0_C28vFLvLZidMbOEQx&m(CEry@AqQ1003IOm2 zzwwB`U%WsFI&F)wf?q5V=N&o{#)|~_ppBWDLa{LIg2JTDD1&FI6JP~7AVFL7EK^R< z2``|XI>2iTFM+AFBm9LPJc96mcQHP+Bb|upAKD7V#Pj4&JHQ({Ep=wO zWQVrq9(;vfe)Aq}N4xNw4|RY(fH`HsGx$h*MpIbi4-n-qAe3oZ%4SLxJ|h>%4KyK_ zluvz89uZ)S_N9P+fCiuj*@XWDb3+pe9`G!3k20cfL>^Acq3xn+MnEGxMlL89{*vGw zWzc?jLg|~4kzinfCkmN|zmx?Z$cty_hvbDE0>j1nAZcyLAu#IM~hQ_yADQ?w{J^M90 zvPq*GH*43PYqWd&l`34iPeUCgjrK09)ib1&%cxv@ScP*3l{G!dp=(tv%WtYo$YvRiYk=rS}YhCnFkwpT%qByO&S~?SH@t3Ra^B|oAQ2# zy<6yyC5&vgQ$u|O=&}MV8)&7k(8hSRy88Q+%BIxS)2sH5q&6kWx~6hSdlnznwaIy1 zzp<#T8=X&ALkkxd!m$LIc)QM4o9Zzry`i(Ax9(|ZursfQ%UW$_w7QVj-p-~;d7*W_)8260nArjbCvt!UTwFb-EN(- zYxhpwU^{TrO*bf&PH1{&N=ehYT389*3EUBtN>PofWux9yIDpk)B4ha{z_*a+sDYSu zb(co)toiLmSh++ni^w|F*@lx_Exxa%2!)Xz2Wu>20R1Dw+$Vpop)^P^KM10KQyJdj8Oo2!rA*4;KF@QV6(lT`#&yoS5e<|@eo!H|@mx&`<0T zN*~V#3En_2iR;k9H4?ytcljMDo=7Iv(?Q-*KDg+kI>7^eM~VA9M;_dZ>PUiq?o)@T z{t@3PD^h|y6Xg#be4^{{K9U9Uga3SocHZYh`Al^ZheAvi_i1;YS>M*tR0HL#?;FrU z9$ZIucqeL0Iw`;c-eP2VpZgK7ppn1p%YlB%=XxYBd?#<7$J0grk-SB9=NZ~3l5fhQ zoXBgzyW~q*5ue~S`SC3I^B(V$_)VTs|Kbz%N%DGf;#uCm+kNy`f9=<;6uU#fY$?BF zqnuXOM!QO2u}5xMgOC2fQ6&kYHH~@G#bJg7O0KM|`m-Ed-d(mi(|7-Yc63*C(~BmQ zy7HSsLtF%#-?5n-BX^W^Cevx)JYn#5 zUjU8Ng%rsezu^lBzED4|MfXYkMh4&qqiXs_Bx@vO2_Ep_I((v?_=|iKf6$rjQF;EX z7SA75+C1nR-Q-dKMpfFGqFB>$v}fp3jb<<^>}t!37lJ}L`5Gf!b)8}aVkgrf)`92w zurj5vQd7M!tLqM=^vYcZG7INbJ9}CAOG_HNVyoiAY0XYgskK;A?p#jYqeDuLq_o=M zelcTxwp7;OmBUJG>QnAwUiEW}TArE_%i}LkT%+GPIiSh8<#2Y_e|d3BuiKx|Y`LcV z>7o`+T{aCB8|JuD-8PVwl8RF~#d|X9-rcLrrV+JIUeMp3*seQUTMe8phm}IeFLDRJ z;2#OT!Skq(tWUHH@9<0{`?L-69kox)vbFEZ{d(h@-VnTq1iZ!!NH|~0nPTVl(T{yZ zk39NF;3a|E1YLKuxve_ZHjQQ4aDIL^1P4PWaVW$&aX6})b>$0r-|G%-McJ9O`=<5O zKyOc2{-3toH(eGxNOwEGa><3p;;J^vs#gl?GH9BbU(~eq1k1gN<)YtpcC8(CFzNx> z<*6z2CZ=S91679&O7d!PaO+A=LotJZMp4rXwjc4e<=V)BagIurH5))ae1d$Kp9Cqd z?KNajwYs2eM?>Ao4h`83&do2Y*6Pq655D(ZeT|+tc2t=}N-wzfdTrl#rCQFT;C$oB zM3~a!kXK@H0DwUUnm4S#GIPu?mh@Y%m>*0-65F%l!4{zQ@gtAxQy=?;KKAz?`;uOb zbPBYh@1OId8p!y$Nb3disf061Prmnb&yu*0Fr$btcI%bP`t(fsL@6>VC?@hn7|8eO z(zDHbed3)cJ^9_QCcmdjPnFNJ$s3`E4-qhYGEcu!`l7l%(>u@Rxo0Z-+0eHBnWuZ6 z4#fw+_jJ!c+iN7Q!(WUR{S*0GpST~TFZcdaU4OdtmAv!S^md9?+<@py_pV;Y~8HI zMyKXhTUuDEsO8Zwll1WpgU&>UuDg1duD^1tfrpK@jVlLb#@g7e8V^V=c(UegOd^Gf zk%Z<5u<@P05vW<;7od^*(8eGFFD>3l^agFqb@T}Dkaq+!@gUN__|CNz1JE5?HX7JT zr_Wq8$m#NEdX0`uCL5NPlSf1cvcq?-(NZjR=UK{)00HIkL3RtplE#yDU6;PBeTlQ$ zxIL?dT8EO&q;zss=Z>6JEZwfo;j9M6`qa@K(^8_Tp@}giOn+OxqQx`wT0Xa;TEpPk z2CTcML#f`hiiwyu9@wForj7VYK|_rtU3%=W>eYl2sU91!qOvxW9r1RxXX6^Y>I%iX z&7V^jwVX5c9_bhB=3l(2zd5lFS^ceKGYkYz=P;H^cOrp zr{k?#&E*XiR<(2YF8%zk{*sa`$**!InL#44Pd3DT=^n#28`tok>Gr>C@ZM$q^WVcq zkLb29+~&a#tIt|C>T3f6c_%FGNso^!uq2 z_Ygu-)N!9FJ-Iy6Q_&E8|7z0u_oMvQmjTUD{ho^M_0L8r%7@O0LJUgDzrR`1S6b%3W{T*gt=5nBzS6Y5uIqX5T&DjU`1vnQ)DeY`mz6;J zZjX8aGE8fQ!Gw+V@X%WDIG!!0!7vOMaoP|A#k3y=ihMXXXmWZ%fBg@iQ^Tewo^97i zXF@%hR2UtyvES(En0h=~W@EAyk4C2_r?r3ozR>?BFHeT$t{8}Vvl@;ic>J*^fHRvX9c*e9R*PxMp&}dZ@udXWFY*X5! z`f99hFw?HmQc+VEXVu%&6#_>)4PMw}@51rpY8iO+4fh5bhx&$8EgLYMJnp=TQh!pt z1HI~s#kF|koCXFnez~DoCa(Uj9@Q@Av~c{g>*ew}=)AvEsqT#C%>N;Sfp~w1+MDev zUzk&)(xa8>Dc#<_RgcBDsFYhf>~TH+qxwcrw_jn0qYG$1^i!ndf+dAYlLuf1~Xi{`6RG zXiKJbdir{`x@3U#&$7cFO!aClgo|`_cZDgUM8Y%~T%_E#L)n(^=QY>tRU(=7J?vIp zODg~z^Nm$_rVqKKzrj2DMS~p-TP`ozRJvIf2gT-#=4qlmY@lf7xSp0j4>p+UeCNA= zPV>t}?Z5U~6zIYC@c#8jD&~p2o^B|%=dGR=hm0cZxRhmBa!I*(e*Ev zqRR0B86(6bgcv&bO(*7lG}?YH>rH;t4Iv=bhd2#lS)x&1^bCT%zFc_2Gt?K*0BzAq zm9I3Be^f7&D#|{}|Jl}+_oGo`l-AS8Uq-aVzhF@4tm|cnw&EGydA4OfR|(pq^h{;* zEFBjmkBqGED9@*V-4w|j+e6^Np-qq}WQ;_gqEFDjkgKTw0&sYbMEhYVkiFiXzOZDv zXd_i`SjpPfWxLnnjtY4;xh!eR#Fj8JpPio7vHyp?^8nPWD9``<^?twGx3lynAVoxM zD2lzsj+&?`rkeZ{qlwYjJ5e;Y#1aj$7p$>k6b0#Z7Z!G5*?#Zd{`LO-pWl2tc(VZ% zSQCVK?w&p8J7>=HGw(C+yfbt2%_0_SZI#FchLpFeeR}9aPj&U2u<3D6PtWLWIyJwn zXVe$M#SPys-viJ5cfz%=Q?x&{J&-oy4cQ^?TvPvOvoKcYIqelB&ih5Wd0r4H$PML9 zl1=aYvV(;k2H}xsocVU~AAk8x+;HpL7@m6#H2KMW4rX6PB&50th1*C-Ky^)`Q$1}7 zWW_0yN~!}MwX!2#ZA(W6yP#L=A}ZyUI z!m=&gR-4%5KdeSBiY3K5nWXCssp=_!@UB4b(i?qG_|Jqv@6C}I!y|@uahpf zFyNjkTP%sV^cik$xwWMVDr>gUsCTg05}A-+tgBP0GUXc+k->LGeEB9JQY<`)cD3JW z+K}o=yi;+chP8RRy}Ht!vZ7>Mig=YvmJ#7g=0~k2e;@SVlkJp;oo;V^^IPoi{{HW5 z=k7gr{K=mbphb#Mhm|)KQK7cned8VeE)!$wZlvc3_mGk!s4UG2$C5wxF>?kLBaDbez2|$Mv&OI_zDP?$Jd8T z#l={Y86?=pP(i4KoSAM*qe10jmJtS#%W-G^g1frs!v>rQgX!C>ZGzz?Ju$+k67!so zhgmo*UWaiqi@K2)+$YWC6^kNb@X0+N9=M~h!SdgHn4VN(+{>&PRIa|^_2AmS2bMp> zE%9RJ4>PMEYu+fFJcbl7V+y+y42&sP1d%T@rW<42N}2nH75Ffhhwa1N|329NH@GW5 z0C6Dw+@rpLJ90<8Kp6V1Ea;v1dbm6cu>5_09dO`*&|#JylL;tC8dbg>4%!ULlLn1) zLoj&3L7nu#?U;yATs`jeNXpWB#)`GGOMC6MsqMCP+ig}^s@T}%xGkyi-77&dCqY&y z7Tww=^QznP^Kk)keRbKuDcXX+RS;nQ9L>NK+F}I0#7=0z`w*>oH>sn<$Z+`oM@8zj>eU6#qyA z{*X7^CvUk%=bxFvZcpCv0vw{S3F&(qIn-N&g`9WyTzkLLQ^+c z9JV>N=R?Y4_THLVnzNm=du_+;ZksL7+e~TRDk7otDwoB2#db{Xw!JE+rB=<&P^*ZH zbVX*83|EP8)VqTPlYp`@lQ&F*nSi`K5&&RN zHLKa}|8m>CYr8%8A*VPSr6uJT-zIiFQN$Q}#Z(fHtw#oHh~EYL>p%y0RCCWYr5_`^N?@b|dJZ{p_Hg$@FZyYkh!FPr|4flyZ@$@8&IQeTx2I=A3<~`EK z*^?0Jxvyu`JL(^P@ojN1(}cRms>3Z9`nd!l|plWkdrdy4wJaeU9;iwf<=>E_4cFIi?yvdma#~$ zYLQOQhH_)dpQP23Su4#nY23*0jX9 z+Wdo*r)wwORP^a;$##h}O^FoEi;%EwM5U~{D-ujTDw5XHJq*#&sI)o_5j`}6B8uXa z(;{SIL(Wbn5|J!TW{iQfrs`&XWK12339BnD=|tQ%TyvG>;>ypS>U4F%K6=hO?1S%o zv;FuRU$HOz%lqwuFa5iH;Un+0Z~Vu{?QMVYt1z{yx3I{C%aUy<9d8UD6Ixed% zLwL~cFs+rbaclrS@{y0YG%-b)^btoiNoX~gn#?r>jPOV|&q*88n0cQWRrI0|wmc*4 zOz-sq9Ssig#c$G18K7w)T&B{~h%?0)?E=%+X&~{3Dc-DX%i2Nsfu9fw)?YdAyz^Z6 z5DtDb%Zn-bG?dH=puxkof%o{(nKH~YZ>ENmKQs_bktS^3A-`$h(f$BFN>-;OorK9$ zXV!N?_)w0N2MapVdm(Q*QwPW=7K~#i5P8pZZ&s~lrC;umKJtp*0OilxJxYLMW;7J~l4%QZ; zelhhOQcB&$Z`?rEC~L}w{HDC9kN9y;u5pdgaK(hK9`qv}cSQjZk_-M)I5dz_$R*Je#5d(VNB?p{nPQFN{V>H$xz-BZ3y8B4M6G`YQJbLG~Zrf>lm=Q#H%u?wpZU|uPAX3qcdf9bn__|nD{XBofeU-l@*V;dhJ!4nV)sjl$Ye+9_9H~wSO4HcB(Ze zFsCF8ON!sz^j^Dp)2$5fsE6OPrI|(BJ2P){3uT*~FWJ&uRU~Ss)k<}1&NW1Aw%PXC z9TIR$${X^2phfWqdC8eJneUbS_2h-KF9+N#FB9^bvoDWB4n4#z-*AQ6Gi1W!9`{&B zm>NnqdBv6@%yv3YZ5un0U%%mc*Ir&D!Oa#AS6zFJ%3-TbN~og|nb|w#W>^)eKMH$B zc``OWVVNvi%Bs!J%{%)t++c%4n?qe_b~|!6Zsl6ZHq7p{Eelh&ZDHDWmgj7{&Z-Hl zr>D9Tb;JXL#45tf0E3L7bsT76)H%Z#UG*oO%cADgo6OE*e=d=dtU7%9redmVJrNHy zCH-j6X^L{gBAxON1Ljs&`Pu6_TQIJf+Rdy+6S-0_wjeo0dKTphR2j= zHN`LLhTt&asi=obyrn;S5n>>3G(}fZVVs9*q&U zH4qxyTuUkD(^QWQAC?OAsRVo??v`gfr=2 z{Tt%TYPgUNRM4y@%-SW`I6;(XoGA!E*z}+f+KjnV7_1XQdLUt>nMMyH#mC2Q$Q)^g zxUt?0LYTPVCwl~umuwZlnkf(rrWZr7AWgVqIya<=w4vd`FGwZ=f^}%n()hRm!bj+n z=a4SIqH?4U|4BFbh5wLD$OL5!$)bD^Qsf)&6E5&NKkJ8jSvkJ z+jT%p&~$NTUoRHUgCIiEAYLpUNPK9ZDQDgz?u0|0lUDpAUE~St&~Q-xkQ?rCKmJh53WoiED={>eV zLMy7qe*OA`6z-%I^2OWBpRi~|eVaoa;qY~kba(;k-Esix8ugv$+@oGWif~I~4Y*E5 z6P6W;!N#L6BGRd-9gy&scW!o4RKf>)1(w)H(A+A4IyJRhz3jS3O2-=grqyF?SlDoa zuO}hJG+n~ziL|k2m#&;ZlQ#;qEdkz8pSy33cGZ?zOK!>hq?)W&OW%5AqAo}i6jY_S_W>-SV8j9I3D1s&y1;jw+e zg2?E?!iPw%okNn%m?CKk@wrDzHtJX|9 zA^-`+KBZb^Va1AwA1e^EVQ9)`rl(XNso#SoIy%aqe!XFp4O*3ih<#UO4mnpxl4;{iuNN_fKqpd3R}Uhos12_f zvBOR}$|jEz=|60x9eUbvw*Hi3Y*g2iN37Ga#)=0|SYg$;9sAG++ffgBunny{$TAbF zPZPV0eGqbp0Ny1?7Ej=Ud#X`o0hSA2ZF-5~pJ?==$Wn%ik z%vP+Lv_n@<*!t1D6_XJgSDnA)J72SnKm5Aga`i7Pfd#VQW$GQ_fDjzW2YVbLuu+4) z>}4-=ga-k8-g)Oa!r?U+Gzj#H0UsI!f<*!O;N6F(jGMgOgTNuoA#mganhaP!?l`djAspgEen6twaFV^C`0&X`;>p5rXhpmo0r>~; zi)Ro7&cuf@V!=NM6+IjpVu%}YA}>e-@g=YEoB9CJBc80HjOK*8K|IhZk@w`82Lb{u z8Tm;WL+pqT;gO$cj36Yqqkhq7K`y-^D1exd=hPWLJbO*lLQ1l2la}&OdY1qLI`M2C~N8`bs7@SLW`Wa zM;(QQU!JY%+S^bhNBN4?Y=}AX1(y z%)0V~>B4R0UrU0XEiBLyBqAbf9i_V~^3>3KJ+%{2<%f=Dr)Hgc)gt7X%C_0nxh=P? z1dA}MoLK)1twq^QAFd$K6}}^AA`X3qry>KA*s-d5uM*7lA?qyFth6-mhAQ~R_a6r2 z;2!1T%fz1n{*lMrE>aUBrg{ z&KP!KU#CSqTX*m}8!F}qT|2j1y4gW_)-N?2xm{4* zs5UDq*ShLR$(AZhstD$e)h}u zub=ydo%@N;+S@+(348TB-fMsInzz{V{_Jn<>A(958xa9&cKWtQ^>uNnXF2s#{ypMlqivZ!^hDM8fG@xiFSdt%23FHVe!*B=mcfgw1df`30~Sf>c2ic%OZzxQ8|c!A)b%5D`OF z4C6o|AxaGA5I%kqM>J^U6(2qCF;BqJQ ztrEg=d0qt^I8crd8&75^Kfhc&S~k8p%8N7ghdSczFsS354mrQzA8+-9A@E36xcnwjr)NY`>K4i7 zY~ql$HnA#a(R9Y9t5Msscfoc`2+q|?5^#$at1eouw8O^QyY2Xqnmy;3l%0KW&z^g5 z)Sh@y#GZ6$!XB;bqbF;2@L0*#k1g2|tE#qkWYH#v=4`AmFVZw^iB{R7b+yM!YO9q` zwY|HoGdE-XrrK~3j80p`sMWJw<&w>c2$Uq)mn4vu6#tgUORF8Xx(L&P2v(z=6B)|u z7_yqKOPzw%x@vD#CdRBJiJ*r3Y=}fPx0aM%+{BvP!4smu(Yxy9eI zB9&+Z_Q@ae+vhuZ$AKn~d*n6usYkSX96rx+L*4O1opf?&LmlDK_l}`&A(yws`9-_@ z7nj(F|M`RVkq`c}edMG6Y#;pRbM0+!_(%K9$3HH@RkDJFuvnu-+fB=<-AyU347IeA zW(&Q#ZP~Nk7DU>HM@OvMs8~G78doCRP348^P+Hd*6Qglsk2R)gN1}Z@{P08FsK-;D z{S14|6V9^3k2u^Oaq7eECC_@Hz2tXZU{84DnRdca$JzRo2TAx(*qYH5Hj*B)XfI~{ zM$dX8vgKJ3$k`>^xkYia-go zW$YuBaI+2}L+L`wzVWTE+fOe3saL4%jRzSTKSI12*hhF#1Cq!Au|o69NGtPA?xpg7Bh2 zLYPqbXr$0`AdmsQY6KXK7{Uc+4e{VNDrvMt2s?J8rbo_D78(N@4g95{K-&Y!VaSIb zIPcPPM?1ntL3j*xAarS5XgulBqitYFg<%{>4Z{|Y1%{6xY-k-w6Ivnijx^zhYu-g8 zLxYUg2NFTvk|+3$z$Ksgpde=qks;L4il8Avy85UjFizyJrv+_Ekb7hP?x2fj}Y73@?#4G_sT_qy(}7 zL11VLw}eGH$One~$Rpy)uo<>fgiTt=dq^l`1I-sim!T%Yq4B4DXkY;8qJhD7iUx+E zHm)Hflne18uW&s3ROcu7ESoeA|X5if@*>!+kH9c?bUxzSPTD+-!Ve z!Y$vQ$`ssCQADI>U9x23rbfQI&5rHwu!r_{+hY=CdsJfDPVa5ChxK;aX^Cxi%Fu2* z{h+d)v9@VvtgPEpj!4)u502Ye@fmw^Zpof7R<~y#UC@!YXC0BXXC0QaCm)=!Ck|Ka zERmnH4(r&%531Q&4^G*`k2X6YSFz(FGj?jRY^Sd6+R5uX_OOYj9kZfkhvdt4WU6FG z#45JBzt`497i>+gZfmktTa~HWXlluZ<0V^_ty?}V0+8+5P^NE*NY}FZgoa}Y^@`L% z?KYjA5QLKTW!OF-rab9I`c})f-O9#^cHOc`Y!^icL@M}3$vZ%v`uYIKPo9zA)DPSO z?~Z4<GqHlPqt%@I>sJ)!YOv<>5sMFdE8U&c~AZwd)`x@W6yiabL{s- zeqQ?Am)J|5_hNg|bI-PyJpUzj_H$oo&wA3c>_yLhp*`)ar`l7W@H9K)VUM=Qp7v;4 zHM!b$?cHhfA`lB|&)Lp{gDL9?F@rk!uyJ?k`B(f)v_u3EF+M%5u{D1$qev=_bf_ucmcmbb-}8*=YAwp9Za z1kf-coT)$vGb$ROqTv=|!!zD>8Mm*JdA|UagShe0^S*BcAUz($p92s!30xi?@t{!y zxT6vi9)2v31Ma*k+++E>fUs%ANGBf+>06$6-d~;*SDpjj^FqJMJT3tLaYH>ai4MYG|MWo8xR1fL2ZRHHhhaAGJz%gre~A}iQN92-#F@0+Q93+G3(px=qYSYx zgLpv%c}CoqzaMb#;oA@hKl#l!M_uILnRi2ZkoVlDY^m3LhtyBLRkUxA8H|PL3{hs( zFW#XOGOXWjH)DN^94u^>N)2Y=VU&qrBMj^ycn(Rz7?Yj1u`BcSggQxlICBs_@u&W> z#tz2F#F212ZFL${&#^}t8yy#M8MlUnT3ddyodS(I_B1RIN8M!w*GMX()?R6@%-G6F zG%qb1*?p~zmF8?Tldwo3D&fW= zEz?TBK5Msaz`inAUQZ}H-!9Q9!lvqJ~e1aX>)mDmt z-8{3?uGxHp#i%nKWg-iaGc%4-L?f{6epZ;ygm5%6K(CfwMu)!wRb{qBpZ(GK_MZ2hb;KQf~^mGOtq9wG%tOn$?Zn3Haw=d)I?JFy=u)trkZcpUv;%T=JdzdaYr9- zM;vy9UH08?*!R!>tjpJAU*D6`vswhFp**axgT3S*D_PIZ&FlM2iQE-zsi``kijj%2 z?MuX_=9;!rb!)a%S3McCA76BtYl|sQ-yU;~d}qYtH@;N^e%{gjJHzrw-d)_)yT5Kc z?#SKUO~YN`K>GEY!d>O#Zwhx7CISpC8;u8=6V3=UhL<2EXwf+H{;wPFU$+eS5V65w zcn_@~4UUHoE8xI^GJ!lWyv?jeh=L~w%LNhFv{#e|bpbbAb5Iv(^bt~M_IOSMNLfO3 z0Po`ujUaydFj%41%|xnHT|quy`!ZE|wRh9Deu30ujUd?sxp#COF?>m;J;$+xXETd_iC!PYmn+L7%!J8ZIR zseDsHtZVTu!!liq7Lzu4>X9M=X{+v@w;nT#B)qbtMa!<7u=s=sqJ(lJmy(c*T5Ic+ zZTsP+)}1d)089Ak{oysrBaxTI9Wz$itnRio#<9!LtnuK0gsZB>MJ5jX4+MKiHfB-SYx?O2lY5RgQu4f~P zTY9KqHRV&kBoeYvcfI;vTclO-9Xo8LrB@cLZe^<|99xv&o>2#QRzzVaX5T2UvL7x@ zSTw2cP@gj8=<5RYh<1YVqf96#v~xV8ZqVuDn)}oN+;i|7l0#WTj9JN;wOrh^d=b-? zB1ve5=SvGJi~K%qjYv&AVoimo%vT&lJoU#cvb_s)Cgvfo7IS_ze0#WtV<&bZ`HyTI*J@{^B>jVxRxomu#W5WCanNhU#c6 zp>IR+VPCCb5#y@j-&KB*FZsMkIQdw}SV8f+<&w4*N%^Tf>?V@-$&1={{;he-B$d}H z3-X?_1e6u^f^ww1C_g$Wls&(F+krdEk;8x2TtkNG(0HxAuXEH7G&`Gayio+UZDZpi zhi;mBRAnJD%aE4585tdRTMArz^F~{0R*VHB@t5TZQt}%W4WTvBw$z)Jvy`nGo3O_| z@=^ArCq3DQi{m05%5M{47V*H~T3s>`Uy(t@lT~~n;E z*`|b{ST?%koYXzGnjq~-5i7J#QI-~v&&;Ai8?$=FYP+S6yc(+yRHG9m%A8prM zcBL)0MYfAWB57)em4?#XlBH7#%M1;P*)S$uZp6 zYO*!PV7M!)GBBo)i!dosB4A02cI(z{*YrKCuo;NDzKMyUv^oNL`9c1xEZZH6MZ30g zQUp-1E?LpO_S1_4!3p^71{D@8ub=)N_)XQ@%K+#Uhl0A`|SkHFN>=6N&u$61pNN}~Sr`~s`vS^v5-FA4a zWGClmZKzkWh~nIsYg=ilXPsErV)>}$R^)AX#i%8-Nvkz$)~GeDvb$`JX$kR~S*DP* z^h(9Iz>36ut1s5Ay|=0Ea9mb&LFkGNg08xpodhpkahyJOQA-(am9 zcPZ_X!3r-`%sGurd2hu!OL|u%DK`?g=$J(E>LE*ukaQZ0){?+Y9kSMjPdrpT`Mg!G zzS$NwY_VQFWZmTkK<>pS1#e6YZ-TlotoTDNnD(f&5S( zxaSEm;5YAa0RJv^g1Sf9bB}VSym8Oab`E=z4cEKp*nRTcX?s}UP6U7&naZYARuj&U z7^7KiQW?r&Ru(&lL$+B-n*}9V7*Lf##5iiJ*Q~aKjy%FnI{73=f)%7Pje1VqCj+rP zV~rcMndRJf8Y1Fbwr_QNZawV@PqJ$+y~?)C?y@}7*mDEBq^bx7@5l8$G|Cl6V0kx@ zN?My?DmR^8=@Ic`O&-GTHahm8BahW}U*E`Jfkn3Ls4a;oHy9eNxotU``i82d!L}h2 z<7i4*ejw@${pV)(>fV@TMATZfuBArS+P8oHi$HJ!0s`*)pkeX^2P1f9#vyPJRGeuP z5i)?b$`cOXbLV{;M(l97hhH50=0G?>aF#cQ_{lZzdEthip42eZg>d7!7l^p?@!|m7 z=N;@W+G^Y*5=z-*-!kc}^>tqqO1;vEZP<9D9kljf8_H!YUfX5I3@_Tc`c9iDO<7$2 z$0F+Kc9|(8!7gEvRvr|_Gj2-n;+|=1Pc6B1Xrf&;{1RT3B@sO(C7sJzJSqX3kU$>8 zh9%~-E}gRCJ697yDO*$iCs!$5lS3BC#w^o`SWCTrc9`xg^sHA>EY(wv6y(Q<2wg6z z^u(=MYFTTsCQ{Wl6JN^3)jNkotxntOBPK1Li&-_Q^eL~q^Ie<2YO6K&l$dL7$#mS= zUGY z?-enewiW9Rw+pYlIuM+IfPnixXqd2X!OjK4as&)*5<&@~gOEYE&~PIdyr81(!VUKz zA!ue0Ks0i^$2CFj6eiX;vFUXh5N zNSoYt>9S9xt$6r)397Ws-MG!lTlZixV#+Z~Hg!?zTfN*9alyDWZvD8fvk^;=W-Z$8 z=@7}RM69+T;Z?3$3!*bF61i3cu&t|JN*|>yi%1wiw zZ>onstMXcCi0CM63Ep-(Vwp8VHgwFmjT|~|rM5h8MJ%$nVGCF7u=bL|TxwcBqxw;Z z+6oEI_f6&OYYSsmWQ0m-rFH%k8F4PUm7;PTclpW{qXhvAsIIDVj@f}{wCy%$55urqDwnoWv!c9< z+T`ejmF5?%-|Sc>n|9kb3>Am0UaPx&O3J^+V%dEM49Vq0iYg)~?5vKqij|Wq4ZanX zrLypl@wLv5Y1QbYjq4aKj@lvX){DRw-E2j9WJ@ABRrmdNRUZf2ny{S;GwYZ-zqBxK z<(X-_@~X>h*X~*S@lP)d1ScRM;JyzUCI}Ae5;1!X!LcAAKDlDj&4QuPqt{BKhj2o0 zA#@-p2sVD>2SZW_8VC|++BKGSfUGby07>Ft7y=>2JHY$t{o(8h5&m!wKM``=!;l!! zmsa@9#6rk58x8eJC33Jk=*4VG?P{!3weiZV9aGwAM|E~t&dL^Rbu68WS}P$z+d<)i z`aj~xNS^(6hB8)B+S^l$7G*6M35#epX~Pntbhj(@hV>MFMr0&8k+Jx=j#kg=x2Xrb zw_;5Zf<{$BPtFsgX8BbGOO56%v2w)4J=Yew69K5!s@B;xV;zx*o`lTA!;h4pPT0(r zZPwbmWXV?4`q7xR;yO2a7OQnEF0wRs+L4xBJuYH4YcoH;!J>NBO82Z&sas4Wr&Sh7 zX-L>A9bH(62vc5hkLFTt>M@%&c4{I{Ga@b$Xzhsn9Zp)5;S>qlnDVWV%UVss5^aD@ zV}~LFl}*^Fgz`srr|io!5{x29p6rq?%8WC=IVdv@uYsYyAmn+*HE#Xc6CQ*kb&ooN zwgEqRh8z6x?x~YZfS`^PL>O4vc<@~HNl8Z=6LmvR5j`8W$(!dPlh;7}u!!Ees$1d)K%}(XV#X|FK)Na?y(!U+-&`n z2y|O{u6mYAX55O^3}LZYCfXmSwD&q95kol<&$3$^C!JGxs{iv-do3b@&4#LcuV{{% zs_X2MUhgz4s`rY8VH?R8ZFFeJ4qCa+@~NEL=WTM;8e6?~mA*+;SjD%dy2M7CO%W>W zi^zBE%6dJvh?ut@{^z&tlmGI`+lQSgQ$RTff)fxBaGwGV6GVb(;_o@<9H;t6rN4Uh z8Y@cBlto;a2I~Zf++uLa*}sbr8Z?4!*8_*pu!x%+6Lj~DYgDvi&up*X9Fr}8gbZS->@lq#K@rYPWM6B5?*>SBsc0_&3 z4r`QcB3-lOuo~iiRzyamAt9luhCe5P9UoEH<03GJuQ4liZRYCRtaR!ne$d6@k(6@9n?{-{nr~8(eh+8(Ewf5ecwPr+?L~Pnh z3sZCvo^BXM0-|27xM8(^N`8oFV5FStM69x-Wc9rbYm}L#rf|m;%y`QsWnCz2ei|Yias3`u z$79#l?G{tMq_Zqa+qJd`J~Ou5a9xWfI+7yHX^V+0LDb43MC`T2FdN%|B=me_XxJu3 zCu}G?Yz2LrYxTXeEBmT7tCasN*`f-sw9RnX zFPq6pNF}V9YCD^nNK=yv&L8$WI7UIvKaF zdgA4os?}!d)~j^f`aAK_sKwU|TYNZW@fdX=Wm#;LM4H#v*Y%;~od~ zf%iFkGR$-88t-FA<4H5_d_43|^`+-D7zllc!05z;o%Mt#*m1|7V3n5JF4Ng(u^DPq zWTM?`OYp~yy~bEmM^#(?#GIz1R9mvkFTTVs`svT?`s=Q>@zF6G8yS<|>;qP{T(Mw% z`7=8=t4hWKhwOPJ0;@uo7b+j+Z7S=CL|i0e_ntkL)VBg5!hVLKG#17zPK;Tl-L!hY zW!v`d8N^A%4UHdhbEE@ut@x6}h|Di;L@x6P95kPZ;TlWslBC}&8aO>r^H7X63aRY!&8ukg&DA^|=6&sSkLJN~dFe4Y0N0O?Ne~MSs zBH4%~3yNPqZbL_}6~QQ4V{grN{^)w^Z(6ioE#kIjXp8iq!OCPYgcXTOiWDe26KN5~ zxJZW*l__K$`DrMBdx@wOM10UxAmno^hOF5hqS1jsqs%E&hzG+Klri-I`y2M_gT!)8Sp$S3<;!p6AAV5hSU(Bd7*=`5 zPwyW8aK}CB3UvffPdL2%^k>}Rrmwtqvx#(@ddrX&!>+G+^Be6!M;+@7ewp^&XNFTk zL|DXxx*b);!>5kONw?j#v3${5k)B&_psIR%!8gBa-}~CvZQUX3ZA?Tbok~lnUuUaU zt{iAkM0g-n_`9g@W@=%tZJ*lhrl7|#&Q`osyDTl{gGMN#xcLn_AuJh@qlDf^LxPcX zR>T=XGf0=}z2XUZA-&`y#>Z%qqKTvkOWWN;yU2{J;|@F8o_XqHZA5uHEb=t5dX){0 zjaXi_7@(Iyo28ngdWlw6M22sMFo=)NZcQRp%AV?GO`V)`-u@0d=WTCyn|aNq8L6*=A3TZnVe5ciP%$&7x|Qml|oS&)2Pb%Z$xjUA5U8Yt}3=D?~zzDdL%) ztvqVNhE^7>F8`Odm#tfpV9ZFUj;K*DNZ3h8#K$CTR^%-)souGSjNu)5b))XN5_TiPc#fJABysO5duJ*4xmd53=m4ymjXr zws6Cg)%WylVNc5zHqF_dtEX-D)>-S^R<)g#g58)q+;T-0a+JVRd3l1tfdHob5wM)G zqk$-6yG6O;7B`eNZk8XAU7ka9sfQ30{HMNg&2xV9F88?Rz;Egm*SPcUZ+Ek=UU8I4 zOD;Zb{jrhg!7JHGo87*9R<2h>_7Kt%*nQ(?oa zj_umD!?xafi`+uK5{}Fb7f0-tTW@t8gG@4Q>knRUD<{US+N@f+TDH_sUJN$o!o@Zx zR!Cb-p*KY|nyREFxr3ar+c_JKvf?&`1_R<|Lo{1y@_9*qvDz}E91V_3w+`%sqS+jj1>?b~>+fh^}QlqFiYKyU&A0`4Ik2&MfHZ?t^MpV5~^*m|65I)Ro!N?c_!$HFbQDOTAw)Q|{!_Wl+fCC|f zaN<7i;SY@?e&QFZ{%UU?CGt`?HP&fc1S*Ejabqa z7h6`{y=ax$1)JSnwdP)gx>@efgca8pESZ2*f{WSEXu`*>#5N}(nvV2MGTI^% z$hVFjWE+d)ZfSop2GxJ4srMqT0>;D+D+K=9(mKjWHu28avKx$nqzxne8i|Jl!ffn}2!OGe{X92&M%LZunO z-h?<|qcYgOBdNOJ7WmU6u2}_`1^&8`o*jJf(RR!U$66tiwVCM|H+}l>V~(~}>(;s{ z-@AA3v6k|N)v{wE>MMswZS~Not(#nB%?dl1FS>YQ#LGBnP8F3IOAxB8;uBZBfv7+< z5@=?WmX10dnG`Dv=bc>)-wOu!43VL!(#K;FG=wqL1vD;g<%_OwU7E6Ov(vVH&n}x? znspn*&d$u)&h6XX{&O9M;({0YWdd(WQJ;&jP9_BX89hn@r{76xabw)kF9rn$yp0CEX z>kKpjjW3NgLJC2|Z-fem7ib=|bqGV;0EiWhqF*SGYYuwSl1UcpF?7(inRdl;66i-) zE4Fs}78`BfW~(N0>WlZShJfrhZDc5C{Up0?w=7;0!Dy>@j17&1MMbggvFB1NVYQ{M zRTeNPRrrdUWY=IQO5_8><5)oiBHA1*&=!r@@K6D&BeKDc-5p)EEIW)5ri7t{S8cW? z5|DGN{nl%3TiR8%?u;6L$((2c`y+MOC)Ax5!O0G#+$mvl&b@}n5=O|=RjV&`ti2>b*%En(D(+DU)pSg0QQ0X@5UQBs6~(xk>F&yV%$O_D zp8ah2B)e|%5L-F1%92Veg4dIZL75F^z;Qq*(B82Q5;N(r!J(`vW3T0d81X)&)<5GN zX59VffBvV_PWWLeuJM<8FXGN5eL9C%FY>r>m7bWnh!nXP&@ytUlnmr*iy4* zO$lr^mn4m?e%EOZArC1LdqQ#3!dZSm?-M>@VPwpVJvP8BB(iq%rj2&<<}DV_rj?iM zgB7##{Gu()%((s678mBNr?M$6Rot%O&0fc@*l?}woZTy;N`9$aS>uN9W*=#D%M<7~ z>Ehf{Jz(f8$v#}9TV(|xM354v<C)k(>fXyfsVDOF*@&)^F6UU5Z$I`xYB5Z5OfXTcaw0tmvte zYU!l>O-YdDqSntyxWv)8^erm#kX27PmdmpJrkrDgQ&JC}jX@b>a@!7clx_r3 zykl7rnvsc7HxsB`XFl69Aw>eVYhC9s%9#(19F?pswb!&B%hiud- zH)tgo{-I7Y6gGg^+WX;eR-x6A^a=q%bGpy3hX0i2Z z!)E7aMTT@OLIg1U7nOFTuq_hBH_5ELs`3?$WG0hT`q;8TWv@77b9pN(pKDA#k0h;_ z&D)xZm9}znrA>@a+Q{&*jSdal%GIlE?Yea~IXY$;2oAHmRG*uwlka=?`|RCsdAHT{ zt@&~QJ^{DF&n-QsT(_ck= zGHRsRw9*kQJ;(lq*)B2lrgI`f`QeOZ^JBJDTCz*8zs`=|^b>p5-VIi2$8c_`oCKE$ zLq9cG-^Ef&KeMR{S?h~bwJTkl-8Lg~pu|b8wi_)8APGD@V>RP;LqbdfjCDtt1?Bes zsq{py*o;&{Prd7YLJfaP&n4Wl8H`9JltmOI`y^=EmdHmfIhwT<>sPCHk9J6cY)QTO z(m-QUnyZS8M66nBT1;nzS5joEQ#C6qE;*4Xa=WAO6WNI6RwOOAGH1zQm0dg`Vpp^F zLd9Bj2~fqaGg$Xcc^$Q((Uc`7vX;mtt-8dN{I0D&`7oz;0%%!myYQkF~VeKZFuGs+#I3@PQHEIIr>RF_?LnJaS+$`|*L7|sk) zQuiopZ)bx&7ly_cTyTLSMZRv~Cv^!wJa|TZ@osqT>l25+CLE5Ht5({lMB-bu#(+G@ zeWQz3t}9|7_bOvIEnD$+BvnreiIf|bs@B-lRrQ6kYUX(Twz|r(CPLKjiBwUKn{`K!>LTRbX4}ogf-Er$aau$Pn>wbYLu?zR zs>piBM$$Qbo8x4x$bZaMsGL@hP1+&r*IIUTNTkW^9dCb^z3naU5g`o(CmEJ3@} zRJUFEu59j0&h?ZfNoGvtL|%p@{L*?BS6M6}bVV{HV8_?4kU*8NR{B`TuHLFzZY)0- z%4o14qRO|RxJWvuYYE$a#k2&X1Z1ph`Ao#6W%r78c7EZZ7ReVaC%;C9M_gHX8y8Px zDI@9w2V@r6wqe5t=a%xOTsb`P;5}FWAl3R!9pXI}gFOHI^PN2h?mY;D`or1(_TYW| zLKEccmiL$Xg$8GMWZ1s&o$uIEdC5{L#~~K zyvS3;-tzXh+nav{!3jpj0RaK`4XFL01wy6H0%N1Y*xL-q2&AMa!jof74Bg*)%ND!l ziYuIeMmvEZVTc8xLR$t9Di9Ke12~xei(h`m6o(gt2p$?q44It}5g3|aeG{HRju3bV zE8G#DcSo39kBfMrWvbLFwtH%q?b$Qyrn)xO0LLmVJG?w^hqdRdCqWIlNf$-BCP<$I zrJ~$eY}(?kMK|-Rv)HztgnPHG-gX<~R?-8>5K&?Nwxri!RabiE%C(Nj3${58h6d zRsuuVz6eOC#W0!TBWYC~F4*kkkR^vOE>2jyn6=C>0$4>!92-4L#o4qoWra0)8$PsX z^;A`P#Fhdg6G(2wxiQOjr_I>JNpm2C{#EdFWR`~7ZC2sJ8 z@cldd_Jj#H9KgFH4)D_FJpXyt6*+Kg(8zD@@g74-kkyvl6|#9pOdNf}wo2~t4f~pu z$|Wa~$}FmSz2U;a9~VEBQBU`i`kfSUVMxl^$EaACna6NuPXvT%>q(K0%)aly5p`ms zvcaEZJZZgz@|R&mh@-x-TuNk3b&p{%jEkw8Oakc0KW1Q66;4Z}sv%NSu2toxX$_I3 zy3$lr{7dz!RrO6UV+{MUMg#k=x)Lw846!1gRPV7jONb1itx7AMlv_+`X82Ct+l3ci zWM`iFc;%_`b6;M2P*!0URX{+%eFm=eQ5!_#MnlQQer~o#K4-(lA-Al&8xqprhHI`9 z!MV~IMDh;f{NC;YEedVgx^?T^8A3w?2zbtcpaS&#`3(`m9lh%vJ9ao*0)!EbD*hob zX&-$X=>;7?D}=jprD8MFQ#LcRWMyU?bt2A2p;(==hc4Y@C&u<#G1s$XA#T~xl+ID5 zli5mjYc4jdS!Eap?joTpuj4}riw#TgvZ$X9rPA3$DObt}fd?7&>m*Trl&c@6qznOd!e4tg zyLRnzLsx*hh|BVWFp;PD!TX-zOyU%}#BMsDPrfFB09<8WjUxPmo z4U}|9bNqp@xZzM8*x$tUF2k0NXzUa6a_BT5tfCAlMH?7Z+8E+(sZLc`@K1lvNLaw; zhFMc>#R=^l2F?VLz}{t_0e?3osv$z{R!`Qu@xJ_yFw04Wr8uxIO;6!&4s$vb}U+BrYT~As$Sts3Oc$YNvP;ptEs?5 zJ|g;^NGpvAJ&UWunvUA=XwEDvq0iLprINKub?eq8Xym@9e8o0{;V*!EWGZfyA*q<2 zD}J?VTj`Cso^)SACsQ-KDZj>kdi*I?%B{6xG;Q7Cm=%Wd5{Qbs1XfDrmZA)@B4~+} zRhAYd_?jY|>qSgrcEzPvSXX59*kcd3L`v?G5w~DrysKWidiuF;#Y}OHmdlpXyC#wt zQT`ShRr}1udYf0ik4YdV;%x9ZF#e^SC{uq>Uwj#(l|y^SVt-6W#_k5vg3JTX21b5R zwxpTzrtB#bw0z9Gy5y2e?CPtpcJ8Q8oB?6*o4Vn{<~MM4Meexg&-himnw3VBZlaDrgs?v!z0a7Ijsfi_AhpFw80=gE%m z<#TvpgFAZ0^m5rtCz(V$#E?ZoJ;fl}j#{|Yj#=7j zha~3BMno_&IoE4df8E*3NR+z9JE@*L>(WGWG08Cro=MiU8M1DoYmM7VR=R$#&D=I? zv5I=ZA{RY|Yt);i_p45}dg=qAiYAAZh%s8Go7^G4G71;XkJ8+z)Ri8j(7^u3+1f}d z#pEVElyklIex04do7SyKs5RA_mT=3+eIl7r{!8FUINlstVHX|yFk2d4p>(1dh}j4l zGP!eu8wjNYvt9I_1R-`M7-i>08dtAfZ8u)G!8UK-X5$kRj+92?7>}nc-cy`nXs(#; zqc|qg%F?(^j*VMH*F)^Jm8{w)KJY~ea+0C=h%8|@!bXsuKmf`VV&X{;gcVyF*0k|k zD)5X0!3g}jp1=U=6Tcxx3{!sXYhQD9i1&c^fBD&81Kj%i)G5w@dWU_>r@ru6i<1Ys z$HAI7X@)D6F6wwPyU*rFam4T!JC|0Z>ohTKG#MfR3B`|%Hrv?2Kw9LktydrsNs$Z; zu%oJ**lYFmEs(TYSKorJQ+h_-$mt#YDTx@B8g)zMMEI!hid91IHtSWzN2Ec73bNDH z(bTtr<`6PFAVY&`SX=cpuDrm`h;?{av7GQBP7&43_x{s+?HzA>kJSUg2?z-IZ2-N!sv6m8 z_1rO{q(Q`{1bYh>EW35{&34nKn{DfsEfNwP8yg*Q(}WT5^y+BX5K3N{aP0*iKyA%Z z`PkRs#@pfeGr|W_1ZXsAR5Qtx4UZJ9mr7c7VaXaxRSAQN2!I-L)^<^kvaGn61o?y7 zQ+9l9o2|F9WwO}Xh|H)LE50UyCpT#I6(@$AdePos8Z{(^NmS!G%O17b*p#udZQACp z+-Z$l>8(pBG$k?GF{@Wm->XM1b^{NKCgrz;UL+xbB%;LrP0Wm8@iW$x;o2>rrf?(l z*vIk`RD--?I``1paqB8?JBxMe?5^0}o2IN^6)91$)NTt7Vc&l8lM7WwNvAoZtewnZ z9AdyJ+;6l6l7f!B4Gj(Kp4`HFr6v2u`Cqr31Tfk>Uggegaiq^ddv-5*(lk=tK00z$WBW{MMCrpH9K4F z#B(A~iJTJ#J=Q%@?~~n}>G492m{~Nsdc+bd3YIx|+!lAw+tQ7DEV3Xsl3z_oR7(xN zNK&T*;X`<+S03wIGA}a6hLdh_K}9AdRsmno!GeDhc@|4cU}lo8N1Yx@*+QoxvJyle6TEY&9VHycN7U2`w=_t9QnwaG);z;M0^-p7#|yVM&9i2#A?zE`Jh!HugQDL1h8Qw`zcX=lqsas zmld{D82WzqyWe&9kXHyYPb54bsQ3w4_4je(Ne4ru!DeMwCo9zf98Q-+~Ya*3Vh~^UsM_g8XISKB|jOiY$)19UB&B&3WScu{F1Df z6jfbq4*X5IHE!fcHYcREaFdWs-B`omwyt$dG}l29fqg^ z0s`*)pkYFA)M|A#PS@GZTejE@8#Y?0GUz=Pi$fwdIX9C7w+KSoEqbSDE4<)gn2F&9 zge1cf7z_gh5JHolJlCA@1A&83Ln!)&k|8U0Rc4C!!rpmn)mX?cVU_l*Ez~O3k1$k~ zvZBq{$-QlMN@Ut5vugNLSQ2zC(oHE0)H3Rcs#)zToNirYg%y0OdX9DjxvqwtHECiZ zDzTIVkQ(=PRl=^Omzr`Tp@LA9GyOoQ4m2c?A{GaX>%CMauHJmZi4TU8daO&Lo^rQ8 z*j<}|=tZNyXhqetABx%dVXMv7h$M~{t+lgkyDr~sHr23xJ#PIrq=xCaB2db@b}DMu z9&w^wGI@-}$0lq-geK0aw`mFAo=Azp=p%rXZx8_TlYHbLUk^R>P&dT$^Pm5mVsJ*j zxP#;XPXs*Kq-+t0zC3XUDZ2LBYn?3&Ww)F>;Er%SdEgqqmV*e%qK#Ce@f>bBn#+JIzY%cN>%7J!;bl{CLz)j(1c+2IR zen%l%dPL`h*r07BZVb8A8Cung7%Nku`yG{`{KxMImgO<|+t+(~hK-NgqC)wAc8g(a zmw)mPjUn2p_q_Yv_O`dYOKH1vf)i#@1q1}#X8-}&u;F@p?|a{C(^JznJY2N#u~E0O zDf`^e$g+YeS^_rRW4I%eQIAwTf9!J*Ts&ieHV%Xn0u=*fgbocKf`|qYcYynYMq3U3 zK8*q72#vww!h$u_s4{yg+OF8{`6X+r0i8%R?7`{X_MF0Yd-TwhO{|tsUL}E^Pg}Z> zwfw4##j{C+RobqrqXX(6p{1RwP1#Z^VBbI;BmJZ3^ zem8E7YTKfgorYwtGq&!lQp|)?TL2H#8H+lK;Yxvmx2F{8&626 z6Zl7YGQ5a8PfYQHXP)rjmgmbgJf4Vfcv9oT^Ky?f&%tuH9QehV@SNriGNIoLqafh9 zCcgMdyod{DA1}xqzo}FH8FlZ>Cq2>Ps=slSQP@$Ll{yL_z)SUgJTbaQ8q(K zkPe1;5+eGl@S->(5lyC95B63Q(~v)`w^P|yuSA;bB6YgQ%sU2$uzg|?NY=<<{UbKX zWEK-cUl<_A_i1Qcx*cH>Ig$Tpa@;;p$^(FrdqZRz!)1s^Tpfaj;>lEYC>HqvQ6Ycb z>ePx~+-a6nCd%J@HfOm^%0yk95jxY#n~GDjEC1wAm-U~}N~u_|!y_(^WT6?=_jt+0 zmxgKL0RaKOJwQ+}qiM^QEq2gB>zu$sfOx@2gH7+3Yt;L!iNk_*sNoTyXlyVb2EOO- z{csH~jjP%^8d$dui2Tc`p=G8GwlNGvuv#&G;g03y<+ZLMF6fa;e zB99fHwpdDcQSC4rTe7NfMuef5wDgFC;BegHqj9%4R7T_}y((+z@tp3ZEI(eb6$edN zZmeMWQ4FmILa1G9Tdh=6Pg(7{hzqtDZTa18cCCXg&wR})JLjw~p2r?h{hE5~O$lg; zl7!M3S5JP!da)f%wLX_xuh<_$JnDP$!LZg(4 zr`+%uZrG!X6_4GzJ$%Co8zXro-F|WLFYIxTdz>p9^7xl|9tciAK)`(vG)xRBF&u#q z0SE^Kh-+jeK+x1M)fcS{_BlItZg-j%+A!YdK7thC$#2><{NQ~WZyNb{FKXFD)^f!W z367pk?c5=Mc3Qbow?tPx&aQf*YFJqpglV?zwi@Hwl0Ch0qdls-#U`Uz;l?bgR=!h_ zfM1e;pX*s=s%*9G4XbRfTVt9%sMNSCJQmE$NHx#ZiO|&R$N(hz4%tWZ{;cZ zDSw=BO^fUm)zGI0YlNu%b^0vXM(zGMkcsNvY=?cfI4zLfet4nXU8Inr&EZ zy5S6ldm=S`2^t6qLWAKghCM8oQhq3Zn#yAdjZT!I2?-vhHzT1mtvvkxswY@7le3A* zywaL;&lyUAYWCIRZ$#;7EA36?S6zguQgI{%tp(Qz8EjPe?S}nQ10!(C210bkj{YId`~6TR}eI7I*jyJn_K|z>Oy?%Y`84{qF&P&l45S{DxFJ zdk~ewV39nAT?Qlrqv%w6kRCJ-2w(UE?=b`=N^Pu23^5{&y6t8MKJf`pvEi{{324Csh-&0g=E)r^(XTN)Y}+qOjp19xhDzLEU8M@U93i zdyBEu0b!zX8W_UMFNMuk5Ulm%w6LT@`O3zg)Z4n;q9Lv6+>u|{j!}LXExY;>5s6d2 zumy!Ep7r#ce7xwQi|q-Idx9gK`E+Sr)95BL5;ke|JZpX1JH6Mc&5Cs-prdVu zd+N0R7L_ESSBpt;rct(&OWW;)?v$;aSg@E#ModDa*H2ip(r`y#B%)V`M5xzU?Wmh9 zkrP*XiXtK`*q2fN6f%UsOqva?8neuB-Wn20m8}h%*;KN&-izyDEY-7gPLUAtil-2! z>h~%+iL9=ZeUTdpwWJz(#f>c#m|@k`(OytbUBm|P3R^X>4hio<=vb2`F)D$U6iI~K zv}0D?F(*GnT12pxvLR`J;^uYef3l!|3$XkS! zJ4;}3kpCPEDPi1AxiVD9JCv&@Fx*G5`{6>$2vClM!5I?7`ZbqcdZ}|qJ%Bvnm#-WC zj4z(teK&(id6v#*-0)Jl%6dzzj2si0$ts=*f5@52OX*;(9Jg4W zsuxDRG4fksHS`|ciDIT85`m47;wi$rP}R3FP}^7ngJh9$w|cSMG~{1g2No_D^-eczOkFI&REuV8}{5D;*m0>TFJqK=olrlIl&ZPeCV zZ*>9_p~w&h_vyXTc6q_ZGY*6x2lo-AxX50Vai&~x?63vDxthsElcRv ztuGTWVN`2u)^4!b7B} z8&gj@-?bG7uW%%(yI7WxQ@oa1R{}&B1eLq`%*}19Lnjam8M-Eu|@e|=-x-4?yMN<0R-p$oUfORZBZu0@$?~4nY z@eQ(NQj9b|Qi&(;#HIu>!LBqiAhT$GbF|A)5sum}eScR^X`mQ&`YrKou2|dI*Y!&% z=xRk~JKP8t>1|3*z6!~s){1VytG?}pR5hLc1X{)}O+M1Q+5iK}wh)RR7eP&;7o@7K z(?5a-c9{l${q{8lDlascv_DoEVvZV^5`QdTm!CAb=1H{J@#c+SNd`)uLo6i`< z`2H~HoOc;r`V6K{_L=0nM-|)Ufcx8}Pd^k#WN++?c_ysd`%L}s){Y~~1nl4FYrIc# z02}H=e!9@m;R+K<{Vf=9@2)^?D=cL}<|0x?jIQrYBi6N{(Y5ApU1M4ahKQ;6r{zV* zY$Ihwd`XJ%!V?=-mb13{<1a$HabwTykxTT4nAphFGS6$lz{UyT|DZ`xv=#QNE$!vK zO^S8}k~mbW6oFGa;(ej+G2xWGgO1*=hGsy&P+T`evj#zf11?(+~dvFEEP%YjsJFniOUR-hsb`SvyNHQE(sq47Fxu5~4 zI{b=XG?l%WXqDv@9u;rX59jebIG#tE>P577>vyl%OOEa1t&G|_mcL+7WeD`Qg4qdi zWZo)~Y+v>Oq~G;R2SEiAczIw7a~@Th)}0Ttwk=B*f3r%4zChL-#oGUxV6s7TiMSlQ z;ky9_z5cpp9x3Kor1`O?#i!;Ky8O88ubCeT%riOOHN4>-HjPUppGnZ4SF?EC_dXI$ zMy*O^yoIU8KZdhu&q%2_>M4)J(6sg~uaei(;Co~rN;4}qmevnNqG?9BiM_W7?Zd+o z;loQ@;>mNZZ#OC}N{Tm$!-FeZT7^!LAS;d)(VVfLE*i6)FkxfiDqQwp(E zAmk>PtP3g~E>*zU%{#mV-wu9SACLenQTgm=)xf%5Z@+)}U&*yi6`mF)>wbCCf8QJY z+g!SCI`ATvAKfH0Q0C5aEA+eE-39q(et1H7ie)1GBjQqa>T1kFrS@FnV3i4TWgSIj z=nxFcEB5V{5b~$Hb-6=p{6UcqRNh18-L2!$5%*SYd1%LvT+Dn)OWZtfkC7*xObwV9 zU)HPbDBgP>8~N#{#k^2bsWsY*5ME-BcUx1V63_us9o}32D5trh&01Tg7rHjU<6Urq z*I+Zl(==k!C1;*}g&v?~{jRdKTSGf%qjfj2Z@j^|6g5sEiMb|Ec8E@QZ|~D*|Hf$7 zp$2?IGlCR{lu_=O^ZEJCjkOjr?ROnpp~c?dWL5X^A2`j&^6^eQK9}@#H0jNzwAMm< zx*2>QQUMdXdVCfE}V!H4ThE1D_zp1i?vt zvzZfVKdemVwF&Va#{5~bedOL5L7`x5Rsa;{uOgQr6}_ytT#~BP7O6%z`B2qKDwBx# z^zAYfQIl^Z);ewJ$t+iG<#NYaPVJdUXPo7M(A9p{ZB2P04MPuF?V4)Wc$A%o-vU8wK2 zZ~{56&v<;o@~u7xOEAN8Zm83&Sazs9eLoVqdWOLWYdVqo@~PXoywLwD=je56Hl=$ z=DUV1z6BSWub8&wG8&ig`qDvN1(%q!7PEyT^TH#Iu9ZsW_UeZwJM*VZELd02hf34D z?9lhhvL+_RJP1OHC3|Qx#Fr8?QM$^LoOKp3L8Y+^t+^6`i7}%$S{p3UEBR^iORCfm zs{v-4l(1Ay!m}jL32r(iyRxOTXwCuec=N8Va@RZE3}+zBPr{PWL0P5N5% zCVqGbcrwGZ;S&agHT1?6tk&HEu!1~!6R(w0=4o6UkpmeW4*UF%_qEl+sT!PgdKKDs zu5f5BD@}%DpXv6Q@!q<>)I`Vj(~z@Z3{zlm@w?%W)ARQ#Gwe7Vc{jzBL>z9h;iJNv zc61KY_eXAV&x>3(7M+!RVHbhYH7Thb#g*Y&(~5sF!x@C&u;J@!_asG-+^g@WGJM@D zsXKmdKj@lVzlYq0hCTmRg$>?(ye^e!7U(D5 zKdv4HuX|hNqOM37ZF(7*y?d2mgQ3R=_Nf*)>Eo=sr`IUHjDhU|?iV^Ko35<2{+?mnxhMOi%@00o};fHFF$$?RCg@lMyMg?#OX0I_hw1bn`jMYHY~Il z>h_gZd%XFTIi0E)wXDE+gO9HvTpIH`kk%hRI~tK+=(=UOfSE6~$z3Bjpc?5#YG*+s zd%0U^I!52M+$Q|xvNOU0HRt<4$=4myO7?{+jim3Nh#I)Ld7K}TGw!lJJtkF(FeS9G z#!IZRu&rmP>aTxJA1_YJKrdacV?gt6{cLY(tn*Qb=C#;c#84bE;?Z!z7-o!9wRdfn zqdgq*qhYqgfgI|awdEM8^fy8Ig5d`+Ms*H9A;cQ7NT7=+0CG$2(IrpvEZ&y_1?>nJ zw-qnrnWX-yj?Asn?Oe#e2XEBNC8cMQGbS5d(xsRzy=A8pDRbP$N*~3vi2czWq|;FU zRja@MiG!N4ca6j$0TwQ2+2I8%t7z1w+0h^*ygL9-fRaUVnmb+&9^yv;dV1xi7EO z&U!8KDtx~BrEvY^$sic%6D)Wbpe~j_q?vHge{Il6=8^7K`#QsQ9YWgZ8ga81Mv&#r0iaBO{~q)_N;ime&pdpo2|K- z+8oA-O`FXs8?g1$PeroG{B1*doB?gIcLCM-pEGNHpfEqgOQJ&SmSr<5GNV^)bk(a$I8-ZCQs4{Wt~tvOMX?-8Q9}3|InDgr(08IX&H@cPF>sf#~hd+z?1#X zX}+Jul20!&CuCvET(8nN!1fk1mvmj)C)I4F1EdDy>a1hF_{dUITwHiJjQI0a1Cg7% z5D7hEI3gM~cLEXG&fXjKOQ@R20p(e}N6$SaieZS%$~B-9yG>w|9^^radk%+!mBJ(# za3v71L&l7hOKc1~Dcp%i#xfZ=N6CgC#+tZn(1?CYOi^@9J^mja?C0 zr?ZdoZaB<$;BPwf&7iq=)x6XF66aFPF8xWHY(AZdC;Fp`kpz^8kzsb}RW277L!$|u zDxJo?b5ab&3LILs!w3HsyUChvtznBd6x$0n-`-%LG}>4t>cSWkf=LG7PG+R3ilM1m z05L79IoZWIJiw*~DN7CBb96pO{3+~92~_?a=d$-2hG@UW8PXBt(I4%#_Eeli%CBEphqMTm+M0qVwf;XU9cDtuum5!SZc z;NhC9N0>dw5vLBBk^T*H| zM`!-GsWD7DMOEFi#}z8al(~g_JHNGP!Nyc-1|h}sWNwxOzy);sOL;FQ^u0(7k*?lB)T=QrH5wy}nH{XnUlSe{KB=DsD z6d%en%aqmwPElZ;1tPy>G|W*ae8XRXT)!vn-tjev(QNv|*j~UNc;+IWLGSBo&*A%= zcCVDU52z(`Iz!}|sb7-(b<9zT_h?%5wuWPQP-$tNRzmi$A}R~^UbvvaSI)F9 zk=14kR%_xs_YQkq=enp5dg7%_bOJ>K)4kE{_EDSzgmOz6#S2Akvh1Vhi=*tgpe;^BNC>%#A~K_Fg*(oreI85Cb4I znAB8f1jvUM7gzoW`6is?YfMWQ$Lb#gw`2S=^y{@{ zL#lC2)%L9MJVG9#V!vW#_I;YRW*}LviZUi>l`i>iGv}I(lYc`{Vb-tvHPK_XZFWK7 zyO&0nT=*ut-=1posJG;$`UVz6U~aNud-QzSik2x^iZ_jF4-2T}{SisVP5vg>;Lj=@ zO(HsKjLWn#{Lp>`yEILk)dw0YD>P=tiV*to%NP^(;eue7v#;eZzxj{L;<FaMzN=*vZ%W#1)4uIa z5RidQlqpJs6d{b*NM`;S_xJ5#(vk}e1c$XEnO2f-Nc>a@F$G+W6F5r)wx z@d~Zbas4S!u|b}NJ7FLf_`%NH_K3Q^sm4#kt5bJnwt=noJ>&cC6QdGn*=fMRZMTrg zX}|9e1^4XukjvIti@W#Tr)^|k`N9vIyhq!ESMRv}MY-Gv422%aY+ z({0a!Rk7^W=Q6_0f=1%fweXYq_4M-QHG#A3(1Vt=3_dOO)TQwYezPh68Q7hKk%cHc zck3PNi~CLN_**D0%6-PLC5j&XK$hHPA>CvmhkV-`yHvALoDqln5DTR0=wxI2pPlRr zAT{r-i~a)NMc1Uf4>E_Jp5{84@vya6PK`lTN=LFg3sxphHD@2)Xi1fq%zJ1OZW6oZ zj5LdDK}1ojx7}LDSn`Rf<#g{uIZRnvQ_EfSZjl?SI}GMslSG^J%U)A%X)J#hOf2%0 zFg^1;76Fetdd2YV9>CKH`i)iGx-8dZci-!ayq05mjRV?2VLW9SJ7qIUo&4!C_6&Be zJdrDn)h`#f3PePp8vgDl#reF6B2fo;S_QZPm3X638L%bnGs7oR$T^yTzYVnf?`yG5m63pF>}Z*(qZ3 z{b9E3A49KgH#LL_Z^L8|a>l{g4P{8keKah=z1zXd;Ka~^P#xR4;cR_^0u$~7O|AaY zO(fIy4)Zv@ftw}m__#xg)>VfUyV=fG{r3|%;$WIFh0Hf^Jd=NWm$T_rFqkYD>nQc9 zBXASg>nb5tENV=)jOz)}y{?*Li^{6VnNO>+T`Vxyru1*>(*VJ^rO?S&6HSujcT;$r z!$r~Z-zJwPB5p?h>Jbfd`i#A_4)Q*(t`X(LEscGPh;5|hKa76o63n?td`6pjzDhu0 zp;E8Lg!IaTgbeZVN_MC<4|L_cmsN{ll})2|H?m)V%Yz+AzI`woMh!v~OB3Q3^ur7H zZZsi)^*nWgvgU1NvkRcx+m)i@srzBd zo=1xpYR6LT4KvAEW0_gp!vPMW^^Z}!Kk_6y;nm)YAl#3bwABEjM+FKWKSYmne-#ZG zlri!679I8J#-;)hI+GmwheZX~Sa=R?O?z(b+Cvjfe#@lS`KF7O-s*e`LCrEVXuiBC zO)Yo2!nCN!*Lm=^B4x?a?OSmg{D9x!wBJAwVTOpQ;}SX7o>8qZNy?Cl!+Dh=I3M`6&4TAb+QYk__T-l&M7{FpMF1>khzO@=-~EC%ePIBPM!-WQ zz=fZLVm*)~=+Ngr7te4kqUU#+UsEY7tdr3Ayall{ zw_Cz8pw-l|pxVOEFfPI?l~gxm=fOJb8w+mR-?5jg8@l$C%Rc zJH;zVO_dv(NtN}n;o43Qg*Z$g-8~12PUT7A_+K4FdYr%F7@KlI*t5WR#faw z@m+Wcry(z)UbttWz7(FX$0O{k&fj}YlHSM0W~uGfcY!V@0b`CeQS`TX{&OgOmhP0+ z2)3zNzV`of@rllP;Q!ql^>&qa?~L9=$b z8K?X938H%T$Yj~%FA1YSbTDWr^}A-&{&mXgNz>;?{4mKt?FQPEx!9b56R!Nc@l4<( zw%8QleenZQ(YSyNqfeum>Y)kEWPDy|?U~0GyPjHoMHCzn5FK99pR99Rr1J}7;MqrNG@3&E~4xAzgnQrTIVy!$nM|d58NPcCkZzWRlQ*6a7_{chjP=WOWS zE;=r4LPp7`Eco_Kh>1*!D1V(Im}xSFzNT`g+C}5BAX%Zg5yGntMZ*7;U-XHjp?cM! z@hsq=6W>XUlFkLXy&su=nc~?=ON@k%vItuB7|%Laz#vNkVvGE~2RQG%Z)HbxaE>T= zR?0QV|6>3HB^Dg)vOA!Xe+G(O5&_^@^%~FVcaf7ru&_@JvR~D}KeOQ=p2rGrP0qav zpA|j4Ksj^1yKSTDH@Gj+f86&rA86}72NUZR&D8nQp7ByD!80|Yg>2DJ5&O>ldeQ*W1q4$tNc_Q8atSx_0r@(amo}rP&^5e_M8`I5ufAubN>v@V)4F zuThh_!B3oVYZYrtE(w<$6SlIN)rue)0n)7D#vUncNu26MD^^PTRu1AEpXb@t z$@<%_8-oWee^^#W4@Jd3T7jacD%^fmKlGQ=I~7a)@oh-sqCdxNTSn`S1yg%@p1#m= zUj49>xkx8L5e${u5mH|> zUoav&yx8u?t$QsXr#&~-P~NpaWtg=Pmkh?5Op2DEQ+V7G%sUj4ad>3q13-c;NH7aob% z-}`0yK{Eb4=O9o}auCj$;koVUkG#ZDjeNMgY$!56%N?-uE&*_dc->R#tP`Mke)#FV~nJ< zXqE|oCjUgsD{xrLq`RUlA{ME;fYqZg{!Eg^YPe>JUFWYtFZ6L`l-kx6I##{|4xqYM z8Z}vFg#upANHWt;o2=ihU6;tKRQq;m!sx2cZOjLkW6D2??r$nzV-?SADvf*&ezbTy z5@Jc=tCkDzFx6icE?g*c*sSL^X1u$XkA=PNOh*1RAo~lQOX22wz9;TG9|JxSEGA@H z_QxM+niGeIG%qOP*fpA0uZgb(`Zd2EpH{LxJou*q&b*p6MS!^#HeaH957zlTO;EG+G@n<2>h2&a#*#1pjiEr}y7Q;Sk-c^5v0AmYvO( zoGnus(`yR*~`i$G3X+hNX+(V7wUi@_90DssQ0To!Un?$Dvs zrzWfe-aJ@%v`w~F)|u<Oo~-P|tbcT*jZU*PZm%44zaoNFbMM=d(I2HLH>AvbUI=W?eQkwVD5=u=#r&HFG`?TVcRfO16*Op678x+* zd63+*7*`lo(aCE(GZePx2zV40aklS$KHA{VCe$QJq;=7Lp*SDXwqPk^Wiv=Y`dSwg z6XDVMBF3%9@uONX24t=b7A};Ill=N=^w12y-uilb;ZJG59>Ky~JLU9H0?HgW!WUFn ztGls~mC=-z@55|CO9tR^4|<9WBNuyArSJeb$M;V~{Wxi(4-OfA287Vz6X!tpjS9?F z1>O6fH^*{L76#J0cMc=SVw`@?aOJ?dgg(i2t+xdDj?zNFDU8VGNZW-zsv-`*4Ov~x zU2;Ci+9RDza+)Q1qnxPd$61J*(Bo3=w_H$7@l`p0erB3N?eGZ`M}9j}oF27Oa#a2Pmz}03-gd{2NWm)S|!z%%3MOeqS5s zJH?=zjX14i4(!Vn7qNK{=|)Qh;`hcr%V-4r`u58cdW-%q^oyBo~2C4Ez&4sete zv0_c2>+=lw;uuhIJVd3{gyE3eN}#n54!x0q%u_owW{B^6@|izyY|s{W&-2?F?S>3c z+w;u2@(PwxaoGfT4U$3EJia&tTzAof%jsAry@$TK540!L4+Z=o>pZ+ET?zQowi+kZ zv(Fr%w=1{7rS8c{=LP|4txl^oGKqS}J>8c&G`UWS&xrdiQ$goo$}=A8kDNY-#Qe)? z0Z+Ih&>eDcAr=q+RnpKht>bf6^D$wL0>7PTixn%~6`dg8N4f0uSe8_(7@Fwa$jv!+ z>pjE4eIL1`++cRy^@^veW_q;aaTzCUoWDj->bujAhYO?9)m|z91wyfVt-pcI@v(A%v0!wa=;%ih-&z0bg#eADu=%_{KR>`Z6 zKX=?OeAoKj!G}yLOST2Rbx$YqHH`vK)6Nhaqqb$dT-9gOR=)>*{S&D7OV~@#G=I-2 zug_^jZF7ucc5C;GZ+Nv2P%iyXy1iVX1?#qJOW!^_dAYvuLd(i_GFBXByS0N@Sg&|f zv%kgnfkQ&O8VT@3oYjinm6*tZ9bPVzv=cH9JnSqH`9w()24t=6qZ}FELppd_KxQIr ztZZRhSq*4f<9~cAhX8N$OsM@PlH5lY81S-ARAR0sBt(0kw@D+G@2pmypUL&XF@P5u zpF?#V_g&;}(7Mf-;alnJAr8SA{E@Oai=A+I4;6o6C>}JX)}h`*>{h{N=#1Ku!zX#& z7Lr?k9_Mr1Vj*Z!D-M0@bN3M32+6Pg20lTzy^5eR`#4_1Zf72`mFf5Rb!e#%h1#~@ zZh*@6UEOy)Rw;M3Wyj7ebr`)NrIWKw?V9KPe7b_MZmm*$-J>@!ypWIe{V2cr*Rey7 zm8GMCC|6S{-u)j^IH+xuL0}XlBns5WjmbjkHlAt`yk^hr!>lrK2q|f_TYqE7tBg!3 zhZ~~Km3BV*C14+xXu}o76!esAs6VQF2SlJ&k2DBWdNQNNUb{se{vgTA4mhGCU%K+$ z#Pk_^wR++zv3@w5p}bi2oL0KBBkmMu;0w%MC$JuY*vW=|W$Q3!E#wg{rt|c{qeXy8$%&sgc?L7J&sS#!G<57Ip$o0eLW4ZmOhMyVe={( z2B^iwJztH1W+SD114JZBdJH|iq7zEP_ObZ0l0t*`J=sC$$!b z^KNcP!r{Vwu%yMY)jXJxu`|7;gizKlT8Sg!oohU%uDPH0Rxb4A)0iQ#RIR;ca8Ty4=hcs>R<{=Vk8NaOJDC2~)< z^FK>f$HyWjGLst=5Q=&;z>>wTo8{I{>XGd8>24bB&Aba{9Uv3LxJ9gMab}w7==WhDL z{lZdVeyS&7CDFDMZLmtICnZ1T&}%Si^%b|4c-+4|kpNs$!a$DmJ*~fM0RBZ!YsZFW zl?w?v&fk7#cbBb>n)om~aQOB2LPT(cMo0PWrmqv_l7(U#)O4>ieCA+z1Z=>W*KJg} z-HY2By36o#rfjxugxCq`JZ0Q23xMMnvV&3Tw23FreeR*5Cy-Hm&(p83q4Hd|USmr0 z&qq8NtH1<3lUmU$)Qd#?as6Y#Jw zxw?f?yL`I>u6cTjp*DRY5vhM)ZSOqx^(y_Hk`5D}Mg8wGIUXQU)N#8G zXWBtfN++zr1lD4Lj!Vu@v4U?3@#aq*byvc38dKWHT)(Rz_4!9|;RkgvM?3 zN42pJJ^K^1pq%|urIGB<$b0bXI7Mv($RnYgyRZo_HD50}`M(6^q_2BGxEFNl{QV}X z8is_^x)%t0nWHzmo#?2 zOvv10lyiE|o=-)D_Tg=U$)r@w|6GL=ZZ~voo)&4$qy83Yh=2wz>KqBVJxiNI{u0WFBcW5lqGn! zV)@Q#^jQk&;HTqVE~VS>%NxN>1M0iX8-Bm#=f^Nh9f53@eX*oAR26Q=Y4C^RgF*J} zg{0T6@q=(m*pdCIJ9;7r2K9Sr2c=5RTjVJ(6>2f+in-EL>j&%7;IMrgNdxPuFkreXMP5t~_YiLq`lhEpD=vnj= zL?*-%n~$pAYTvB_d^qXl8ytL??Ec^E;X28;iR>bKX1QD5xhcZ3=Cq$5X0zAwHIMD{ zUPRjA#la$%FE#mIp!r4-nNN5iGY}eld&nwm^U&ZJaNq+up?;i;7kuW0f`4K`PX}@a zB9?O134d(VQ^^>`FV!((w}^}70b~F27{J6<_>p(}L5UjLm#p46!^4gUL7O16GPqkN zp2waLmo=DnThGIxtNjCULEWWWK|QgAci3K|b*1Jpw2QQBR||AlS$Hl(SbPBKgQd-X zGiS%0#p%9BM|#}c&bS`>H}R{+NJ=K})CnwHb#t-|>NWxnW56KSNw-@S!Dm4cNa!p$ zX()E7QAJ`n-+6^aWbaQJk@A}=oT#lQ1z#sYZ=N!m-a)~C4}*N#$f?el=fJ@05#b>j zI#_4kDe>hiXm5hQ4YlX3#7Y*5HaHx{*Aw)0R&lIac(7)j+i}f*j!XBxyAd4lD<&o| zsb#)t(X{Srn^&n1B!a`|hu_svG-3Z&&T3L6c*~UO*qa@pMp>=(Lk~9bPgm`&|9iy3 zw3W~hdhgw~((M+u!i!Cbq8O?HjymNWpFdadod{V{Ii3X^O7V+pHK|BA09*&_Ap?_n zmg6du{!YDga~#h*3FWTg|Rj~!Mvj2Kp?qhIeIP2!4?E`bObWB*&yyJqJEq6eQ}!Sk_M zhjaEiwd#!ue$yTE%*O&5Aa|@Ml`-$`l7Y-^dxMYtMOx*&Y?KEAIW9*hRv(ZQU}6s? z8En~mTKaDcnmkz?r#%NvFEZsob;P5EpQ!%*0l>S{8|eTXo$tCqu7a!NU`rQ^L%f*c z_f-WfM{hG3E*BC?Vfl@IBha5(=$Of6A-LTR1fcJ=6zv>o~|J_1Hw-xbSSF zs_+(txcbkS!WQ^<=xNkr@r`I&tIlVn2<8J4!Z83R@4ss}8RNb=5(}gL5N*t}qlms( z^&ywYYb5&juAD_Q(MK%ZH*w+e#qV!T6~$DG*@%d_w!5u#n*Vc3NjltIAB;)YsbBpx ztXwhmcSgJpTus7O9@~joL0nvbqIy4>&r55vMK09C%Kx&EAXyqg6x<1gOpMYbTHB)d zVb1G*M~}FZc>f)4d|rY7tO5@y_=-H3UWAU*K`T`P6yi7ec=q37AjV5NJri%DDbw)( z`|yj%->SsFDB&ORKPH2}PI&6^|L^U#MWoWjW8KzOw*y4yO>Mx&#(~fOZW)$3t;z3R zj&Yn(2RvRZ*zuo1$k=g{?f7k@WKB2nd=lI{?Qgu-44`*lRnOD6`Rn6(KTYnhM6Mj$ z$!8#y{D8-^=eoi1o-xEwk=Vu>94F5Id>4a;RlPjbAmHidHg{7JE_tMQd}3my{UF~* zWaR!#`ehNt9KrPJVG*z%9ucwDObpK5xo8vF&=kE0@m#~}GJ0Ma@@NkbO{g!J6aTK< z(O4(?**T2aQRHFrUWKHq@sW)U=LOq2!hw+bXZh@jJ{>;|KYQ4Y*>&YM(LW=UL}-{L z$o1iqO&c)>m*hCOAfXfnLViwLweg_9y9wv52Domkxh@3@Q7x5s48<<9xPaTiZP84{3zNIr;+eN7ll2&=wb7u;@NC>bClkRnB-y?!<69cRc@;vg*yzZh}O1`{X9TJCd z$rn1Iv}a{y)&KZGdw{$R6su8>${g3!gPc;^HRxNiE}UMo7x~m>w>31+fOTlg!GvnM z6|L+Hmk2>pJ3L1Ay_ReR@%lxxjUDkn>}Ed1#YZY{%tT4m=UxGGz*iZLjUB_|2OJv? zj(3yCYfs*#wm#`c>54z<(ck=Y6XSq>S%vi`(}8FsTR{sU8Y0{vSVzrrM$a{aJR83Q z=uae~Y!DQ1H^2dwc;1nq;A*=VBtIc2xC?!HJdp4}Lh8G!@#r4wxgU2Fz6@dv^Du%m zWGusY-6(?K6EptSFd==!JyS_PV%~KOi{JI)tne*<*%_XXF?ux3$;oj=I_TVZs>$=c z9Dy8Z17O1GD_4r^OHvXZ@gz>b9q^QF zM&`@APB6E;JB@ZsObleU;CXJq@oIluCFR>NZG_HG@_Gyb)m0wVFO~&_ctXB(jsf=r zmDO`L%cbv@ZDwJpJH=x2jN#!-)ZY;S-i>R*>dlUhAbWvR=GC-SVlW7Ue|ch{V?2h< z4{})zsmAI&i5jZG$BSO>HS@ZcFhl$4I-oGP@Vc?ZM0|cmN5&e`3UhBO5r9==x@`KCkJcJq?IhoC8OJO2>JtafQCG_y8C{Kh}Kw!hSksddZ zWf;}CEqWM)cV4SkEzFMDc0Kd)1ZHhTvm^#?^O}&1fcp%{T&ehcQX1g-7|?RE+6rT+ zl6ZrL-|YY7O`NgVed;!Wv;EQYuG#%WuaqG;wOX%v^!YB~WeHmZ%&D)VQ^zwYI=g-m z@3Exab4e(2Se%k;)b`Z90Tp8_SXbCF)ljv# z6n#yQ@J{P~7#Uh_t=+JYUZWu{@!n zY}S&m2kUc_)we8RbS8U<_=U|je&ePK=+v@t2i490;%2gP{+B4F?-<%Tk(>s-eT2o8 z_B_w+C`hcOC@?8bT~%xzOF7SZkktKdD`K@5h1!n8@9^UZ%)7eCJA!p6+~(9yDI-T@ zs4j7Rj`cSlBzOfwrF0}<=9atv>ekAJgfUo9s)|ObO~x!l!s-huF*)_jASdDEG?myk zUV_sK`Sw*PlW6aR#EY-I11^Oy^lS)7QW$4S@YQo@22PKC4 zu;=oeyVOxPQF#b^(qkfvE7D`4U?WH~=mJPM#Mtk zO=@SP14YC>LIE$G2F?S7DzoY=X%4rD9++N1^znjyc$ASSjn$C?GMaZG-M^QXGRYh0 zzSMNTgidl2?MBs!as`8Msj+zl@8Fk%HaEj<^Zj5bZa1W;Z~0DrXdf&mx6wVc+a1K} zllWw;ZEwe2=&g$9;NbXh6lJ9}qRKQ^4J>^{Y3Y)qhU|c+FkYo_1BizurM>mjy0}qe z{g=^XmyaZuqcbC!Co>}bZiLxXsoY6Dd?J42_`2EU{08gNk(ru=>g!E6r)$iO{~QU* zlbC{Ho-K%Uz$9@W#q-AhDrW;6%5!^$ii?FEiMS_m3=9ZC(Y3)f0l*KL=o;}+m zOBmZ0kpn-_&+MUkmU_gFmz=rxS?&0(5A1srw?@cY7FzI;$!&3n?}rT3A8sN`mE@_v zU|ll&%Q}qVcCTO{7YW!Q?a7H_KqtL006mci6_YHrRCJFSdisq2+q+{k7$X<{(j^!% z-H2M@J0+bs6)uHpS32V70Wn?~DDWVsl|9SB27V?#*ydzU)c_KsBY+aP#kZQmhD%FwQRKowl27s(_QVOY#>QwKw@5Q;cgcq|*c?$}`MexW+d2 z#BUXfaAu(i1r(bZT-1r=f%^HUu5_6BYj~>djnF{o`s9D9Sm$6jqadm`wkmQaUKrjv ztI_=jOY=vtrNrv<#tSrHBK+&|LiNP>>00Mn>dD@(geQ3Cz&YQ2o&x7*srRBke)%Jx zQ^;6i#?rpSeGTwKTExX4#`!Qn4d6M9-V(8xiMLxa3CFF@&KMxmJV#xSn%Hcg714<->umI4jG_Ue+yDT?2 zT!FH({?|p+?WAgwp^DY?YZl9zBqlvA4Tl z6G-%`u-9gYZDHuzrO%{=&=y>0%5A&!cv$dUo{Z*ARuti z!NkI0#RV?t@MZDY&S1%~w!8eCU9Vff+TAmH-ZKJ8hb{f7 zbHD*=;?mU6Du-ST%ZtzSz~;KMZVG=ZTn;&doEcVC|2rNxb^?DFni?^O$LOpg2iHlE z=$Re~IOqV8eTX;txHsd&%V^$MY1AF}5+NrCIdk_1htzrE6arTS+JZK5IktoIFd@7f z&ydzNmcgZo#P@*G*Zxl9q;cc*LsULKqB?IPO_+F9Nr+{lX=JT@rZ9h`NdtkdpcHDU zlz%gF9uTo7qk$5;DXBE|jdLKUJI|l;aYy30sC$py(RtBB)+sW9NhlPBh8@=NV@Z9m zXBj~Kk~uI?FMDeJ`=d@_W9+fFzfQ)b_V`MKvJCg6M62Q zab=j%D_&YmdMRFiLeVIi846rlUY2|vr~SZOCr^6}OJ0ctKd_l2lfYeAOT@vtYQVVb z8SyiIJiyR@1A2z@h`P)8Z>Q4}hN$AS6oZ~af)gGL*B{L1v{Z+0W(YQ20z}(7X}<}w zyxo;t4Q7noV)6F@pPf#`8}0G`XNNsei0_?9W=#BYJbJG3S{-XfVv8Cl#aBs>3!m;< z1E2yv^Oc5snDJcP7J@NYg7ua6ZcReBNVu%=|J*GQ1sl6;H()kreb<6iN~f;Y#QSy; z@azVC+IaC3sEktPCCz_W+jug7E)9wAM`9O8W~u$#^T5NSpu=X_I03<0>LX$%<$%i0 zQg59NC&nI^Cb>`M(^gz^NXdU;byIRPkO#d)%`60n;8W#=sN)*WJa6U5IrFN`WJ`ko z$XwGb*6rVs1_A;$(kWl>azQ4=w<#$|Ka=>hL)#Xz$klJ2yy|gcz@3}`<^VdZR&-r- z;#vUB)knK~yqatcxQhsI(xW7L!XW#$QggNc6~C6g^>)@DS|UH+THs*Aat!x|1(pn++a$i>2}$ zKF6uPyJpL!+Nf$=8a^e&15!P5{@qY;T{A+Cu}eZVUZ%6#UYd4CHRa=nztrFV8vyK2 zZ4`BBu~}jR*#ZHVOaZ1$`JRQ1z02*crD9KqsvhtAtKM|E9cz`AdkwG}Zt?O3oTCI7 zlk?lvS;De#hYP^0ipco#aiFBlzXSx~lpUL-w->T6$Kjns&tm851ack{>I+HY>Wq>& zR8(~tnwF=wpY%I*&2x{~z*Mb&Kk@fLa6on%fXMp|FQT=(tOueA9ftp$TB&|Q ztk2rBZ(XxEgJDzbZ;s|6Fy=FmwPPkrkL}{SR!YRqhyYk{a_#iqa2aD)iIMUAT}JmC zCKS&tOCv1`;AD^R{O! z^*VJv2h5=tI<~-Dwa&n1CgJtk|66Gz6sHJ8Q*%uCpxEzGTjz_34Dn9^uH#^qm(`6c zhb|x0*#D*vRtkif=2l=LMI>+)K8!H#Ka)Mh!bVLwmpzcA__uH{USlFDP5l4rIsjk* z5BGmHI2iZmU_g$XTOS&ePPgI4?c0BDOtaZaz-9t`@J_0%>8O~TSg%t17tH>aG%*); zIvNJkW; zHx0c*kP?t8Rhobxh;-=?dT-Ku@14+jJAU_$``(ZD@4XCuFiuXAefHUFtvTmfdmR$e zh$(#V&mXKhC^}%d*k(D|I6e6GJZlJ7g{yR}-e8yjXk~O}W~NH7`sP2dUkr*D@&54B zYGt{1S(#Y*%xCU{v-{posu-naem;lt#(L?a#+ zjZ%q>{n{L~B1wPVBDE8S8CqLgtCFZ@b_2yLBa;_rlba|1M6j)F>l!j@DiQ1gl@-cc z62Gc(-!n2S7CRF*Vi(^Oo9Cye-zwQ0$ksdiP!e%}@TYp)exi-Hu+d@ z?|R)gK=2nj;u5;WyAMGWHFG~-bhivvs6V^S>x|oQn5Grkkh^hM>3*0NK*R`?63us#sS9(l8zPOTp)RbhgI z%Y?>&VQlD@gI)X12clnIWe;eJK{xSCu#s!f9Q(N9{rpCG`hG9 zN3gNgwYb`*cfK>KM11au%p$FFgFP|_5N3XJ@_c=AL@?<{&=ZK<`P{Mm!jFeHK#gXWCA=EldVGQp=e*%AoEjL~|63e~e@>O<%F7C}AE zEpM|O7XyRZ@!8|j*$_JpDhTf++18{VXR`}CmQG~uJ&@LFh_2@&kHV3TeXWt)xU-5y z4`LU9@C#EhQX^LbeEL*a`9k)Jx+%#j7|Jv63w%{l zfuiJ!+S4I8z578yl9&ON;}Os-rhNWBq|=!rcEA7Co^U~q& zFYksT%*KbE9>_aS#pbV_fGsN;i*(EEfU?dq@Vd@HmldBeIj`mO($El-McW5qFcP&& z=l}TTa>dGzY;7?(Dqs-LW$})W$@6v5he&0*W$Zd0vm(#8F*;*XKnWRXpwn9u(hW@q zJ;BR>JDj+51@%l zbG)D?zQfY$EoA5V_x1a-om6JoZlEEqyKXusNgnrLirr62-0hann%qwnH4>A~_cGSS zx*S6i+|Q44nO`JA=vRmw5`?6dWN2)sr4^cK##B^PhW>;Q%rbVe%qTl*J1wV&kj*aS zV_b9207^`k+_1senR?WON$tej;Jh+x8UfW3k3T z9;rHy^sPnaxumme!D!sJyc1YG+bzaQd&=atpqzejkTH{ckhh^EryS>eF4GhV>J+w~ z)uCBW;)KO`E*)JBY|x&7($qD-E9l%LBA6lh%4R{PO?=x_USIYttDyml3&dqYn zhIqlul9ORfk={;Wsd~+rufVQTtSNGGIU~u^eP6?Uo;ZiJj>YrJ-ES2WprK{ieFcxy zudM4`PJavHS>I_=6R0q2e;hXEtwyt-Gn<4~hdyZL_y%MB0jxDzN9Q^cRs@xPlCo}PR_N}vz%KmvanK4q-*C@>^#=kpm83mU&CA+Vsw~} zfPQ4m=e8ZVUe@KB%YHXhT)HezGrtbX+=q@==>@ssM^<0vEyA;fJ z2l`!TMW}rb0e@^_cBxXUe}_!&<|+kmX-$|19&m0Pd0wj2FC;Z#>yDKsVKvyxC9s*3 zuCHT&;9R6Ob3LnR$h|VBoBrt>79=-$h($K#R=S_U=gzEQUP1P9yjA-@t;+V;wrDt5 z!A3GUImn$E%rCdIRXr<~^DTd-mYro8O*TaJPGp{FGL?*Mx2?3oUB(?hTgIC=Z3!p6 z3sdjbA%!3&ORO#)xGa_k$)kpSmh)+rKU?tNG{!nOb*xt*dSqRj=Np?F6b;&E3MX<2{-Qg)@_wiFRy#!Q zcddl9=6I$=j+Sbl-5hzsLP9D}E)wca)&U49LNTQU`H1o69Y2};9ym=GVpj!sdW+Ao zMM@7JoS9Lg`f@LYX7=`$$>pBYCray3J4y$udUrvtzjtaUlY6;N<`NXX9Neq?@Dls! z^6S(V1A00t6S28@OzmZZc8#en)9B!UXY?g^ycRZtd z8)$Iv(pMP@LIG*%lzC}X*hh3LZQ>TOqCN_P!ut|?+3QG14#s7UJzeeFpuGB{2L4z{7}zM93C^-&zmh zfY~;~JDG?Vf&@FQr@s{$#86z7kA>Dyy2|Xaeu}s&e}f7;{61+tQGmGFnttTk%%k(4 zI^}}5!@Xt9yvHNV(mVJmmE7+2sv zi^_V(U)bsT={)}WOy3fEZ&tq z6-%KvgyYd)3f(P2&@FFw403IIhOt&v$arp^<+PTi)ae*6tw5RdRR7(VN7Bp>bE}S5 zq+~Zm2#BTXVC$EsVwr!Edi5dedD7myqt?j?S!%uFi0+dF7aw)5 z;1ltD1Sd^I!txG^9zpl4d~kH3ZAs(MGJ;S-)vG3Z(c$RHYY=|QqMmx3^!{c`CzHVi ziU%XIHTdaP#Cgf(UM62f=E<;2RT*<6Yf10;D#)9Vsizku%~V6kU?5vuav%t9#cMMe z30`9!5^d$>ga#AW%LuTu8b?GMKbSqGE%8fu=`a|y?IPTu@tFH2a5TxG{}1QlVAVEM zPo-uIq!p7tOUF%kqU98}M?Y-OAKHGlgU|=^K zyEr*oKAyNR`_%Fdw^n79G&pO6+*m!JJ_n2w;6d@-uhL6*oSgTfV`iiafI~1CJGH#j}=j z-<=hFe1w1J!T{$}2B?6n_H>BE2HMP~=OJBDdf@AVcad#;)fL)~^O5s-QVKhBx2)K1 zypx?=3VIg?_Nl&jY5C$aq~5fQtEc2fpXYkg(2;_VXfW5w}q$IHR0 zZ?v9@FQ-LKR63Wq^8PI76wgk7#a~3pBwlFz)i}!ZHAu|N7M!1*l(Z*Gmd}HRM4tz7 zV|J?Skx^0V(7s-P(xOONT=*w2EXXS3!>wr^cEyk&vrm(*IME3%T`hG@1K;A)G}qOi zC5`Vz4~C51I327pB=J-o&hWhWu43wfpE3@m_rAr;)-;`lfjsJ34`s!Gg3#K+nFMnO zQp9_g;`8Ixrm^_H6|)$+ckM9()1ESUx|OYfSN}b5%&tMhv((|&bQ9E46(WlUbtR+( z=`vnz`FvUgX#}(j_fNyL!YkpusfrlX<^=$p+5jmglpeGTcHR5wm1+KG`Fr{+{i6Aj zi}RD{pT#3w2xQ5mo3j{5V5P1}mCr}LX>H}sgDu~}53{#y+1gVsjlL7k)(P}a+uF-? z5&q0hcl=T}DsdC{ZReV8r+w+7?7AdHe0-Eze5lES+|G_0w!S2%iP$2 z^E7pEil3|%wAIrfwE-uryyN_D>JpNu=|r(uX6H31TjSV`#BhUpKVQW(tH~+>wZmWa z)ZG3oZm40a>a*5fWj-BsZJUPDgX7ga8k(-d?b%t_MACe;UKL^+OS|n@p!l7^@cZlT ztx}=-`WKawktZAFd5Hb~7xNxO)OTn(p9Y=IwYAN;5H^j)-F@*r!lHQidk~`tFR}Xn zjD!!|SZ&!9!AT9jX$e1RtxQ4jRCEK8c_SaC;HT?U$$jC{PoQX3d-e@2E3_!iO^Xr_Om@z~1O*d}C(D)r9L>_B$Oa z;SY>~5~kBSRqJhJsrEk??B{w~)Z}u57Sn(owk%(-ds8rKSsuysaR^=^p8c~}3&eZZ zR$b@yR|gZIr9A6G1B8(n;z!AFHQY@xh+gfsN({vC{kX#*5BQh`%2T@(+FAn+z$_HPgFIRVN#acIKy_5|lc?5^!LUbh3AOO7@jK;-3{QW@u#h zNZCfdQa7#8u|^?sVw3P4Ekqo2N;-y0wbR}mh58!lQ5`c?ZYHa`0@=nu1fq$0Z@ zxjbI}sX};o(9F(Qc+9%~QPbQMuz7!exOJMCevJqHhxf@O>6EtX{y?yXPB>mfpAS=HHmz_r z-2k(?gR8!%+_sz+01kU+t)NSIq7tDB7*E;$-#3h#;!!L>wwMQW#CTR`P`@)?Z2n-> zicb}>EkE1LJ^QKpM8|QfmXvW5e-XYNY_y_CAVId(coMY=?>=BwswpK+gLyTAF}SeSZ>nV_#YB&Ws@?+zXE^()NqTGyG>JB@@gN9hPoQC&!wVd<8OFvtw$7G zN$-QDXP)&Y7od3IL&eEt1+H?F2LzUTz?Jd>3~5(}ca92-7S~kU&wr@tx@rh(6nvhoxP5WhgdCAFieW}gdG3JmW1TOOfUWOr)zdUNd!-Ne_4f8& zO)64-bB?d6XahmuhA9GMui(Y;dRdOC8hN@lyot^mWrr8weQwIjcq_d#`bC+SVNtdW zF+OPb!F2?=-Nv}$s}=S5x6dNz4XHhgTbB13gWv#iel{dTM8>O?Y zKnw^#<-w%FBVM%bE%(hzLO*s%;(S=cHLBgt>guh}_6M6nLyUI( zSWv2)cu?0S&;)ydhb^cp8h#~}>lX7smwzn=3YuoLnC}i+{i-Dq=wDED2aA=`iku*S z?RQ%gzL;sdzN@VO*iy7e)pqba(D-aAy&;a9PJ`vGAiBetbHUOS?96hR=hh=n<+fNn z2Ra$%R7Mmcz;akanqqlu0Gg@ufEmQKf-nkL^~lCgD_1l6Hm)Hw8ccXnkKbx;xh0vn z!|;dfpD8r`gU$|k%~IfhS5~a+rK!n0dh!~P3Gj( zv%Ts~|6({cLgq*(TT&PIXYe7z{7=0-&)=CB0HnOZgP^5)kkjVv1?4Gj5aT@^dy6j| zE!hF2OVqnlIh6+^+j7gK8$f)Pn_X&~Z7O6yekcCIqKf?D7J3%rB>vV1MSybQ!apU3 z(iP^klss)}z<~%5+(=aj{%nR=k7e9FD5;i2D9BUG6@rv!Ap@ab-wW>AT7Gr1+bIvl zN|zbr70y3%=aOv_vX63IZ3BV#dSm?5b5eyD!&6GbWr{4W_Vgl`syfP2)>Aaka~FR&66dtjW&V3)+$3x7nJz+dBMfPN+Nmw*)3yynj% z`_L}~cm-bP^bfnuE47zQkO4h156y7r!Bs5FSOfzo~L(b-U>&XPkjFMDqZOrQ8 z*}-TYfa5~Bz8?pkf^zGZNBiMb-HOK!;ZKAEPE?2K-!~P}Oe;hP$%!`OKzhj~qOJ0A zO=jOvzES;i%>!3_|M>Z2X$hLRu3msy$g5aZUo1(J-O|xq3Rl+EP-d2s zuaK7PN-lxBW*}R^l~in}SBCpIVw#Z|et^?C20A~Z#nWyW@ZmiZ@&Qu2XPTg(bGAIW zav&`8mhGM(G}nSmM$Va;1pNS41w?EMH#Z6pM8v;P(~1T$z_);E_simNHgd`|(SN$b z%FS-HZ{e!)Jt%Sw0bd|G^t^RtN}JgWUx5ffB18d8BVzMHXO5DQeFbUs3uwxI^k1ap zHWf#X615m6uE?>|+$$Ngg?~}kGEINfgh8avXT__r=0qsJF7mXSGSy+C|Fd2)DHW9P z8$wITN`UpoqVGS$hS-DMyG>=yJA{Y<&X`=)vmezM>0MIM(GMk+cDFv`&L zr*vva`2{MjRqS>K8c?MK)ZStSFsWx|y_D2qi##RFfcfH`)4wmq)$h2!-#`z06*8RSN`NQ!KB zQ{kq(4cj%+y=WKIkH7)^%Kt9tChWbY430lq+06LM_&9ipl~tB8+RWF+Ob+se-Cvu|)NC z;n-)}!j7`))Q()<74+SoZAHJsc5r&H=N7Z#Wp?(=hgx5VeJIM&2O_x74h+T!|#!3evL>7wGPq@({oPCu4H(rFd3T0>7q-WNWZ_M zE2fhtg^=%MpQ{jt8Cr%Ej?wPx_P8I%W%!A{WL{h%GF9)oF_v0!#V6Kw30ZHgJ6Pp= z@|iSqLhu2faUb$}%EFX44RshcyfJX*JZEv0(|F)%QT2zL9jKdQNETt`*LiQAz2cWeFUg>Rr!P z?`FGncNdc7LEEdY*wXueZr-~hZcg3F?JKiuzm|0k%=dNr*YyI4IgYXj1GkgW$&hJ^ z#yyZxQ;t`y;nzRk6{a`j$23_}Pa7P{A1CVTu)DhJ3R?Cq_(jw7)DlgZ4uLAEQjI*! zDkA;_#u9m#_(^vl)sWMg^LY%8VFl8z2L)y+c`3~`)^&d zYWC>K=06T9zGzKp-(fe8u)?CD`Lh1eE&Q>yCU@1HP9v3$+HTU7j@{coN08T5k3*o=EA4h{7DwAJ?*<-l>JJ2( z3_LydPJVA))C2d2U2Tjj@x(oj-GIw+B9#1We#qQ5q@Ts-OMBj5mko|ql3148B!`{l zS{_fFnV=)WZcERnRvqgktafu@;>8{<)NEO2l~?SM8f1HVeC#W@+N0Lwpkv(&F3gGi$yN^iyI#u?P4{Ih+^?>PCR`g%zRXc-pJ6lP zV7Ki2Ac3Da-9jf%2W=zUjLV^Bm(wdviqF>dDRfjCiFu~{g~PE(;8luZw!XTtV%DS%tGP zB>(nY>?J&60=$Yp)+YcW@S?{j4fgUbp!A4gvOYA;i`b}*8*2)@BE>HvI0SAPum z^=u4rle5^ImBWyi{s1KT@4&Gb_=aV1`%Z*(KG#sN*5&Uvc-09I(zK?VSwDiQ>ojn}VRHmw_6_n`G55GF1D|kYYsj8b)sE#re&ov%M->o{UVW{pa9igH zeW5n{1?_IQTp|Ro%Nd-hrdJmz=448_)LS4QEe$d0ejhdUx6(~pwYlu?j@8k?ou=#I zt_^8wlPd(jb4G0qdOogNhoqN|$W_LQv|pQhc8|Hu8$J;*Sp242w_A83usHk4O0Vg1 z)*GE4)DFITvckE(Wg&iw2?oR1J9Lt>16G%vel$Ad@;ZHOX+y!T_( zUuz(P-=_2w7@{miv0^D~q&bH50u(*(*yMiuL|J0I*g7vcYo$z*NTZ-NG2@E1lH&+S zO37*c8BcgX?xWtuT}9@}?iXkmz#!mSc)fqT*UTZZs+32H);B6tt?K3{U+byb?J}}T ztQT&DTb+Dcb|?To3)^<2G(EC9s+jV^zQU53q>;PAt3vk3xeb+1pxPZ_9syVDf`=kX z{(#Iza4GK$4OBqA7@E~P@Nr_-JS%mu*Q67PXXgLn`AiD`M<1^mr`;>wd>*fv{tB4O z-hn71*ojGO^ew3|bEkzk+7r^0pNJ-oe{1ocS^w{HKU#K}9vDgg*m5C=-h*I<>+*m})sg zZ>lx?+I4GIw12(zE3>3BV~yt)e|#5D6SIh=_AsE1GYAN4@6}g-&ox>f3yJD|O@Fwh zdHl0;=j#4ziPpI0X@P?H#26n|7q1EO`*$+q#FZy+htUERhWlxV?G;MSnrXb!;-xTB zceu)DJpJTqd#8Kdi}T}0aV#H)4500*zoZ=S)9}St#=o-`I$r2#R3BXrqg)Jp`DS(y z^~Xo_wG&+5&cmjo<3wgGS2YWZo0{fMYH`W`>mPI`;ZLgQLopLbl4APA?R~j2zQY zh!q8&om-SED;&E<@m+C!@w^eK)EalQaq`zaA6jn}Z(SqLQnmj)mve7LYjJF=G-hfX z*7p7B4#{-txOAFn_U8(-^K)gnvWKYKekim4*C$ybe9?dU&%G*aF)9CiNN+OXdp7}& z=appFn<#0>DZ2WsTkmFIg$XFdj7+_yQ&Q`i1#=cA`@0W;8W56vQx>gJ&pUyj^UFnX zwVUPB(9m2_C57wLe*Zt2C% z+{E|3F=`^^h(R&r0uMvT48a$vt^o1Dj_YyL+dr0_pFpk#_<60RH?TkSX$kMnPZd&y z2pI0usy#$pwaLvJGL7d~qn0!GOETBfUs7gyIhTRqA`WpW!c=CqXU$~&rY%X9If37e zbG!dG!zzHcJ}d;U=K?EMzI-g0=j-obvP9NiCUEy)uTRwq_U{I#WgCq&vh7c`^Z6Bu z+wMx$b2;#;;_p1ixc}G>_`h>3A4cy^;SVW&X{XT9ozgV!cT4X%ojE=TcMQiLU;cB? z*3-y0A4V_3 z(l4b(VlPo4!#`x1oFCiU;8KAeRvn8YA3y=Ak%CIhO;3#>cY+hV0_i!AErWV15bM|& zV2eCad^?=6<{7Ms!FI%}yPSvdC_%$+bQZfpAfmx4OXdps_t?!$wNy5;q_Zrv0Mrdm z!>GWO!Rovs69b0EOW74F?do-fs}Ij3mqq_pyINpM31F|SO&8xwmD6{&3f&(L_?sHihIUGe`U-Wp+TgS^pK_q9ZHr# zG*z0ag+sCqw$Y|?r_Bf`I6c%}Y+T%Gi}84|A=TyhG4Z>3+GQ=b9ft(zfCoB`&B`2a zm*ei-*0FIeED*i{eI18JzBNubR2X?BKC^+2z2}iyod5V~4)gv;y{wXdS%?i~|EKrg z&BhcAax18itF6=MCqt@X(hqd%-66#BYv5Ve$&w`;(C&@_$l zOK@I!T#?>&ZwrdcGYZcn2y4}8DBn@dk>=YF)4ZhfJlAg1yn5%rVP-h=cCzs!r80{b zwV_;gBMjj67elpgj#i5)32~m= zbj@A5ZwO&4Q(#5#69?-1A8fJ3h9J)mGjTvmq1}H$a|GpPy@3|1ldoKVVq8ul1JzL$ zS|-{?%d6b(N7e1gjk~27Qc%5luw@cpd9U(Mbc~Qib+Xm^$-I_V>(PUlWFB~7xU+Iu zA(70Q%h5=CIBV}lE6KXTS}9$Bn5csa3-^2c8arF&_hkQ_=iwNHtJrvGj9vjcBxQZ8 z=I7Wp{s3&7wctBpYtRV0Y&u<^-cfmt^VZBJ5W{Zz<<#-tccIKELFC8{ac>f;E8coxB=st++nIN0Fqc#zMlA*PsfK)apkK(TmD+Q4V5 z!f1;1x1A8E5ep|_rX@FlF3%v85E~$TbwD!~I~gNjBwJD1IiZGNKrjYL8Aul%1zCsj zSw;TYeP_xys#n@5CLdD~Szo30DrQG^SX>Tk%*N)t$ z`%pRgyVLSMEAKA`5=bApbxiyQejx3nH`&hG{F+iwJHZosW(kYZQhvniBqU!s1Af`KKFB>6#QI@S z8f)Vme15-YPGd7nnmT8h_}#s0Ii8}V=G=ku-H4!JCR}_JNXDA-!(?Xs8Fk`~lvO;1 zOMQB{byeWt`u;1HLG>_M4yYJHjj|lhc(gqiLy54N!8Q*b9eA@*rm>G}`H2T9TAL6t zGbi#J+wmm#Au7^z$SLG(g}3J#?l1Z(1~fHwPeT=9(7Fyc4PmYMp8V)nf(~x4e#*H% zIUSCBJh^I>c#929nt48KJaIN%#rh*6JUT!Gv#1E3H%=Cx^&&%oNxNXTQ$o=Rq2Slp zp5J?rJ9`U|aiu>DtzkZw(Vs1hlT`A@)0%QkGS3s;qTeNL0Z WWPx^A-+yumyp$e3mCu#c_xfLlMx&Vk literal 0 HcmV?d00001 diff --git a/education/windows/school-get-minecraft.md b/education/windows/school-get-minecraft.md index 256ec85ac3..f5f19fedca 100644 --- a/education/windows/school-get-minecraft.md +++ b/education/windows/school-get-minecraft.md @@ -8,7 +8,7 @@ ms.sitesec: library author: jdeckerMS --- -# For IT administrators: get Minecraft: Education Edition +# For IT administrators: get Minecraft Education Edition **Applies to:** @@ -28,3 +28,15 @@ If your school isn't managed by Azure Active Directory, you will be signed up fo * Office 365, which includes online versions of Office apps plus 1 TB online storage and [Microsoft Classroom](https://classroom.microsoft.com/), is free for teachers and students. [Sign up your school for Office 365 Education.](https://products.office.com/en-us/academic/office-365-education-plan) * If your school has an Office 365 Education subscription, it includes a free Azure AD subscription. [Register your free Azure AD subscription.](https://msdn.microsoft.com/en-us/library/windows/hardware/mt703369%28v=vs.85%29.aspx) + +## Learn more + +[Roles and permissions in Windows Store for Business](https://technet.microsoft.com/itpro/windows/manage/roles-and-permissions-windows-store-for-business) + +[Troubleshoot Windows Store for Business](https://technet.microsoft.com/itpro/windows/manage/troubleshoot-windows-store-for-business) + +## Related topics + +[Get Minecraft Education Edition](get-minecraft-for-education.md) + +[For teachers get Minecraft Education Edition](teacher-get-minecraft.md) diff --git a/education/windows/teacher-get-minecraft.md b/education/windows/teacher-get-minecraft.md index f76ec8535d..ab019d66fb 100644 --- a/education/windows/teacher-get-minecraft.md +++ b/education/windows/teacher-get-minecraft.md @@ -8,7 +8,7 @@ ms.sitesec: library author: jdeckerMS --- -# For teachers: get Minecraft: Education Edition +# For teachers: get Minecraft Education Edition **Applies to:** @@ -17,15 +17,44 @@ author: jdeckerMS > [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] -Teachers - -![Click Get the app](images/teacher-get-app.png) - -![Enter school email address](images/enter-email.png) - -![You can get the app now](images/get-the-app.png) +(intro text) +## Add Minecraft to your Windows Store for Business +1. Go to [http://education.minecraft.net/](http://education.minecraft.net/) and select **Get the app**. + ![Click Get the app](images/teacher-get-app.png) + +2. Enter your email address. + + ![Enter school email address](images/enter-email.png) + +3. Select **Get the app**. This will take you to the Windows Store for Business to download the app. You will also receive an email with instructions and a link to the Store. + + ![You can get the app now](images/get-the-app.png) + +4. Sign in to Windows Store for Business with your email address. + +5. Read and accept the Windows Store for Business Service Agreement, and then select **Next**. + +6. **Minecraft Education Edition** opens in the Windows Store for Business. Select **Get the app**. This places **Minecraft Education Edition** in your Store inventory. + + ![Get Minecraft app in Store](images/get-app-store.png) + +## Distribute Minecraft + +After Minecraft Education Edition is added to your Windows Store for Business, you have three options: + +- You can install the app on your PC. +- You can assign the app to others. Enter email addresses for your students, and each student will get an email with a link to install the app. This option is best for older, more-tech savvy students who always use the same PC at school. +- You can download the app to distribute. This downloads a provisioning package (.ppkg) file. You save the file on a USB drive, and install the app on PCs from the UBb drive. This option is best for younger students and for shared computers. + +![App distribution options](images/app-distribution-options.png) + +## Related topics + +[Get Minecraft Education Edition](get-minecraft-for-education.md) + +[For IT admins: get Minecraft Education Edition](school-get-minecraft.md) From ffbbc8f9cf3c30006a9922560ef60e884453cf4c Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 19 May 2016 12:34:48 -0700 Subject: [PATCH 343/439] update IT minecraft --- education/windows/images/minecraft-perms.PNG | Bin 0 -> 36340 bytes education/windows/school-get-minecraft.md | 42 ++++++++++++++++--- 2 files changed, 36 insertions(+), 6 deletions(-) create mode 100644 education/windows/images/minecraft-perms.PNG diff --git a/education/windows/images/minecraft-perms.PNG b/education/windows/images/minecraft-perms.PNG new file mode 100644 index 0000000000000000000000000000000000000000..1788d6b5937c65613ce6736dc004b9b2bd39663e GIT binary patch literal 36340 zcma&ObyQSu^#7}Zgd!m#Ey@tm(lC@XNQrxhOO0czIaKNTq z_>bu~CTN#x@SCQiipzoVIEe|G7`U#9&($P)$7OYZX1fd$IxJKx_y)T1O8FbHrBdlt z8)kjD z(flm7&3ju&@>C+O%L?!h+bUa?`w$HZ)o*a~59zNyyp2$XEPju_m&OFeqsa97AbQwK zIUstb`Z8e2uEW{IMo3TIv8(PqTXvhX-uXskzHQUQUvy_F`8%9MCgpFEIFB;@X8t*& z)p(MQ7}DOx&bW1;D+8`d1?lX_f`mJM)gs5-yjb&;6Is;03;1=k8h^Eu@fuVQW)Grx zBVv6a{KKSB>A$~OUj(Jo-8}68PRg`tnMc3^Y_C$D+GRFY>y4!;oe@5;b&)}(bfd~Ytc~}GW}+M!51cpMwUMBA$FzRdf};iww%L7MsPnp!0qkmZ zV&)Cc)(jDL{P&yB^WYzPEm7lr3pGWjNJHs3pF}w5uJ3xfg9^~n~15a1zql^OLB*U7@4EyHdOc%JQ4p9q^HECRaib07u_MpqnN8ve> zszb*ei_-FX_JH$2$kvD3G2j_nVN~MG@b&)c^oJNT~Bx(QMAeXuy2GIY=(AGEdG z#qe4Tr8!@pqo$9BJLj4sAlDam&n)N2P2BB96n#(+5=q<7*E169L1iMsaFT$o5D7Yv zzgb@_R~Ws!Ub^4uEbCV?|JsvEE+@`~P#=HXM6stU0&%?IyY+oImt(P~*xS+Fb;URr znb&Stv{aNeZVbqkdh@XjSwKs;tGSf-n{4g%S=&Amv1m_{%K5ZZV2Q@!Hu_8H~%^Nv7R&ep7 zA-<2@;m$|H!l_V?r6z8_y}D_Wy78M$jQ|7p1*g8PSiMZQDSh*=6z^X~@w9uM4_QiT z)z5s4a_+cKIpK1;;4tCk3e>M3R$QE?o>*r$+!lXDkDqEdJ z(fuGB%j-U=>#DN$i!JlLCRBxg4sOrO0b^QxYw9QX{rjugFp&wR=X3>y({$D@k6rZMJP zs3TPN4c2lvid258_C)N6Vw|-4f* zMIzN28DbL()}pVD^(ch8v&TtYds0wCw~j`nAgMaiJH!&lf7wk^lvDLB($NjDt8(~b zLi$n0*5#Y)vq4}XHn49!>}7B7egSrZ3a(;X_L@tv!0Tf7*{M?89SS(gSe_uh?!af@ z+%9i0IbT3Y>h87dw=1gzhA8;9ALsKV@7B*(aNGH#6SK=chGt*wSh}5lUcbCtzG;78 z!O0v6k|JEdqqTk8^-I_P^K^l;UK7`0UmR27s;x{v{|rD@KuO;RIftEyFJ8 z&tKfAOP;T>PX%0ULu@2v>15(>r+kXfep|zXGwVX=dv%GE34<)JHehL6QVomzp{|3n znhG}dSgdpZ4qpGFN7{1MijvS7G662}d4HXpzBz*zlZz8KJM)#&L~jWgtkm6x<@UMs zax#6yk6a;_^BqemL-|Qt+YGz06_E$XIfhtQCtM zEd6qr{pF~y@|aA*ohmA41#%wy!%+O%bl9-q22N9YgY*i7R;_gKnwg0#0#0s z?yoj<5dJHDEs~=`?|wX$w2@*Ajm}={5gbgw`|lT%T4TgqRo^qi5y*$Y`vW)E`!^}m zkbpKL@6G%~blOYqs_w_;fRUH;d*(zorYq7krNX*TXDze2c-k=^xhSopTmjc`ECiOr zC5$GfV1>HAgKGM2X=RttS11y>VxBvKuWl|XZ`c_wXZlL0;KIwk$WqAFXK0(=M}Z9M zs9DBC-WI-^vCYS?_!Sgp!2a_H8M$*i!Vz~vPSzlw8nvMQ@>u%r*L@5J!TrG4Yq@Q{ z_2xwGwO{V(Fb&m*k1zS`8@Hd+%-FA#9*6@#hYhKg{r%loaU=Jsu)Y-^79CvDCd?@6uXns!k>=xfCnm)$Yp1y+6-m&zZdk(3CKY z{G+b1^6hlFrt}KHjV;NA4dF&4!3|l@Pbvf2e1WB<@}8yjs2jgZm<4HtpMEDO9IV4n z%TJ2%7#5tKAa*OSn<}BNv+Kkc?nv{}j~p+)Ss@8{scYh8PJu(;#5|Rj@CuGpG<2Q9 zKG8*W)F~XgC5GErhIH4p(Yw$5e1@u|PVzf+H;Y?M!8i5@b{YNTng)+a_a#m`;ps+Uw{Lh z)^AAvj(j^!VSG~~_u0K|+5a-x(7q|3n7eVc(B*@>4Pg=tJuz04F1l8V)(6abduZIb z+$J2G;?6(39{rzp;eaAbJrg!Wwn|y2~zer<{4!!Ntl=T=!5YxYoCJ{2apEr>{t5_;G$E|>I?AyxPIyI+A3;$aly!CQM30}hs>x233p=T#9GXqJIvQ< z!m3>9Hlu5A*D<-Jv71Mu1f&v#%C3ICJ z(A6jtv!CWdSJVCG?d~AIT;_9PY>bH99OwqKB7S`|=%ipYALRfDZigSTa-^f94ZEan z-GOGK9YL2HpE97IGrP+5W0C69)eB!my^lAVYf%@u`4Tdu_M=3V)C{M)J-j;^hYzH% zp_l9D3r-BD;TX`)cgI12#gH4dn>3bKe%#oMa7+H3AL)3g4{r`vdxt27MFdu#)}rE8 z?N&1Yfu6AukNgYInf=pD*!76bBI)ezi*X&8=*)Biym zBc4lDv;U+Hh!hy1&2)468}Yej?pl%hKUxI1wolydhSa7*^$T2&R1^uGXF3Q`3ODF6 zKDq=9@menKsdNZwT3w@8&tk^arbV>Hg_v_eFM~|~@^yS1AcuEHSLI2;oAm`!qxzeB zoB_A$=V6=7e_=`M5T=M{e`@4J8}QZ4MyCDYu$!y>6Q2M|BS&dJ9`h&f()#o2 z-A(7_X5VjS0pW-9xSH@}C}H2dd72*{krx+OK<5f?>U>yX=p1<^JzlZ-Osz$v(3;YI z6}!$GGpxJk0Ju~d*t)11Y%QTu4%6I5jI-M$A2KSQO)D@WeMI#g)yoT0>umQbE5AIg zCqwo4j~mYn;zJr?z#_%s#$wtDTlXUJKr1a3;Yjk?w(K^MS!6EPHViYkt=)>}E1?|l zm@9*Q7xyVyU)S;v>uK@Ia${S3yEtL%tZ{Lk`V4ogZONUFQVV@N!Rt;)MDQQWY(IBD z(@VRCMWIccf!N$lOAOhyJZ;-yFYWgEN(yZ5x8K>KaB=G@RVQpF&P)|U@9v)=u*j#@ zQjh9xzg}GlW2k^=SQk91U(I}FT3CS@i)`-!?|&i2J(zMA=5)jx$!{AQr%3;`%z9J zo4&!HY-MixZ3oGH*4R!8*1p`}C&W_S9PHm3=TIpDrhRcrlsDANGOZgqQCsz~^Hrya zeJY=D#cty{5Vz`@N_UUfLYHVl;ezOhyEgccTqBfW?1LEAV&^D0LgeDnStpVOo!nMS zm`g3$-615r5LGH7Pc6oS4qj>aMc3evK}$b%G7W*Oj!3QicG|;qKpWAro(ol!EIuOZ zHQI&Q{@zy<#0_>w6YamSbCx^&ovR*6%6Tt#(kw6tsuOlZr`j4t!v_W!S^Fx2>Ke?t z6?)~!V7RxB2|#JhJ+e)0lg``ZHr^_aT)B8EB=M$D+{Cc!Wl@_But z3qI#pO{grxEMN4WEnPZFVkxRk3ytHRt|kN<1IQR2^UG8W@zhk5bqB+6nV@jlnZV!} z-R2j{fQGb#3)>u95~Xt$<0L;-B^;$5J)?g2KBFN?6NHyKz05>KZru9tF=L>@3@Xz_ zeHI8Y2Ef~8T2fb_8s@2RBqEBZBBp!#AH@%{$^29k0~jf6h;J|n7~p1q2@^A31iJ0@ zeaq$OZ&GrTsZ143>)*dONfHe5P-w`GH(7VL#}&Sf{_MxIb&ksBxs4^uyA?RvRbIB< zf2#N6y+}>ayaTLlj?5t28oev|sQ2ajE}?HolNXV}>YdTuMUIC(l$ALF)5adj_|H6l z^cwc)Id|=lo4y9sI84m4p;X_18>COoj=3M0nONb|>iKpp_R+skmz;-CDebHvjuROzR zLX{<|=l#OwjB4%Z5r<3OG|{c1+$|+7FAhlVvOJ}6ZLdxt6YP05hTgP9Y(ep2LJP+G zFdl~X1!DHn!^CWK*bSDH;Y1zuUW(|~S{209NhR~@*BD`OV8tNR%RxwfL3 zK^i|Z=~D4dAeWjZV-KOV7($!k{FIWuulbMI9-a@EyY>fML)<2H1bsIX3KQ_rA#Ib? z*D*ALC87CtA{t&m)LoprRUT_d1w_^Xc5!pn?s=;^9(nTT2fFm+_1@e8%STyf6XFxZ zLqy5N&ZMDNfQU&VAu_Gvfg*~b545hK&I4?My9iEu&6Lwg1~2AVG{lQtWw)xU3+s0|AAWSxqqF#)64~HgsZrH-u~j+^X13i-fg#`;*5mtD{0PgBKeDz} za&~%*FOY4n5e=)I6qM&h?GIJFIC!iRva!=Jr&1GZOKdU(ySfiVkRsOgB@SYnd5NF( z=XFz$YY_HdDvXkHvB4MI`*gbad4>jcZhnm}Id-LITd9~phKq++MSQek?zUb#Rehfg zQ%AP)Je6u%A6K}_-AvEEjQc5zm%?k-mwMToT)m3!vblEeSABbrd7#fe;9@*`DumrC zz3>M?Qs~c)OZL`#kAL2#TAqgAn|@0yg+2Jb$=*!lvGjnW?Cq7M_Jd@3>EcXyLLeU> zSTA%jf;CI8>+J`ctk4`ydXELCI%k`Ox0~IHKQ~o%UhTOBvBxX$?9sIKvT^1Vh`m08RrU!Q+3VahebD8kQb%k1OWH089mp`6u<45#yn@_ZOdDvXK>W|=UgaBp z&ky@oGrn0p{tqMjML>MnSljfxQZ^z%G(g9IK0QeILwEwT)or0_`D)KYa3n?VV+8s( z)wF*1M!>=x)Lxk7{kePw{J=h>R8xdSV~5<*>ktU`s(ZDX2*>NI|NagiavtQ;y<((8 zQ$WN#m2=TNf7sP&iJuS{0GO}vL5+9 zrB_KUvFZyUAd>_Xt_oC(WuQwGZH!;Ew0%5@bB;kt-84U{3l& zmJHi>Vt6ZHlFo^{WLwGa4T{}=z!S6dtRtk=8g(ns9=S0>C5ID)hvRpouLnF(b5nn8 zT+kYHkMt(B&MV8HppkiZ)ty>%^W3iKl@ejF^ri_g6>Kt*_#uVr8?N~Y%a|^P>$kg; zyl&bpdN$>CpJ$7O=Q6x){<3S-Qm<^x^iU4S`9IKLkWI?d4dcLq;>4>@aTW$u%EGIm|~ zgihhc>eVyzztEvy1PUDk{V~EzjlRIcR?zcEe~GO4RwO_ZjK>lDB&c)jxz4k62f3eS zZ#OBXDq8jo#B@FuOZPj*xOY7gF1uuJI?^WU`_%lPs4Kn$$TQmM18F{+RspJHy{|KX zLD(Q46L&+*%}3hcA^qVDcVDf7;%UD7#aO2ryB8-r*9;4l(iezqWOfGt`mOv>lUG~D zX(F)52y9%#>2GbNNr?R{@(K)U1@hSjk7Td=Ee|JOD58q^z>0;Ra53#?ZIxLyz*tU4 z7NWPpaVYdeXyQA1)-xPT;s$w~lGN$*k5z&d*zG#kc*J6K)AoUoycAlUP>JB&cdG{T z(|^NMC$bva)#=2<@$s*Idv=}iq7(aI7g}!9Q1*K1OkUrg7`WhBPC5QAM=Tp&Xe?HDpbm1lcc-WT6S% zZiZn@zSd7ey%A}#G5<*4ov6?sa>V5iJDIaFgdjmE9CWIoXdjqvUn_SeS*@e4 zWxgLP%0;IU8eUD{g@6K@$SeF+B~@UJ)=|GIB@8ylbq93)eo89dfR?smTmQv*v(sIv z{)qW3hE@{YQiM_>{~Ei_2uc$QH*0rX13BS_Jr41Y`MG9K{z>E0Yd`#>q-m}tnu-62 zlBRX2s?xci393sM_MnS+fxYz=O}LDXbhj+3va{dweorh69_)ARWN9dmQV%OfY^n+r z1(QfNUT_#)2Zj@b8HZER#f?h91nH8$gp<$n_^v#xGmBK<;wEEQ>1!g(@{|X=ks=Dv zrC$)cbfJbQ$L-96WnMWE1p9JRobNXWi{d~#`^-TJ;nR#wS5;5M$60yBTva3wtVfNG z(L{5Kj09woljlDJq*q~(IGa55>r4dpibTjBh*|7h4+$C_g{g%Gz+_1MWce&u-^rrl0`q^ZSNI29}xR zppowDbpDDM#PW{f`L+lKRB;2Cfo{WO48i_U_KojuD(w2Ca(Y<<@WypFa~{inrD=*y zXxMDnfg&BL-KhTroBM(swmF#kX~#>dbo+XyU;(RiMp?IT1#X2(1=7d%kgt3)yv=V3 z7E0(|<<>aVGMkxKn<-2>4v8i-{ZpsI@X&#nLEi2(t#4@Q!--ImZwV9<6nq|Nf*Tu* zENXKD)7=Q9z)NX@X|u(c2jl&J$G&NPgCxtbGOMCgN~vSS$<(_cM%@vHn3y+oUcp75 zEaYgy4x()ZsZeRg>K8@~TK;3tD+Y9Dwv^Un*J98pbulu0FGe`L%Hfsy(;PU> z2U0e3mc{sI=IXEO_^rcz!v$s<%7-I)VEG&stMapvamlPFVWiHi49N-UY0WIHMPXw+ z*JDg0$uVXZTpY#=0}y+{@Lyj!#1$ko6)d86>PEw(AlBih1$KvBMC#(mu%l#psSq1; zHKXCNH52Joh|w3-W>aF1yQ$ESM%79 zm2(m?HK77(MiLlCxto%wj^JXIDK%)zW%{9m7~c4m$0ay!i`~`tM)~NgXBu{lZUf@~s`}>;KA(f1!xGx$NTvJN4 znFimmQwS@ZV_mZvOI4jD{@5yD1;9>^3%1{Y7xd6tn}WVhHEX6RMemBjakZKG2P|Ea z9xRmUGV|Y?INT-@tgxUHpyOwZ$@u$+QbiR0uz@{Np!7pZ6#;=yvW9^U`(+ASGzMd8 z{oTh4wEOo9QbJq7nzEqP!#G}qDscM?r(ICdfXbm@qGhF#fXw0h(=irRBr8Ktc9Gl? zIZ^QQ>wb<$ztO1|&m|Gu4uVwo$mm;|pTn^e(i^W`?G+jPTw_Xm)w*3@ZY3P8WjMR3 z`X3pJuhsP0S-i-isWHQnp8~~e2raXi*LayBS_x;GH;r)PPIt@=T2XXUZ!P1%Z6PGs zXXU$_a$$YWHPsJ&aAM)WYrT}~r2IyuBcLFrKWOYVILOi&zdVn56YR&dR%UyYTXQQ^{rI&{EdA_OkyIqnuM(wZ2KPr~hQF^`f1uBZxAJ`xm z=KZ{m-)i2;Q6hu*hslM z6tJPi3txzc^ZcXhq#1jggQovyeR)CMC%%`zt9Tv>^Zcxc*fYoxcn}P&2Wp6YQypK9 zH*bz*x5^xUUTwiJT#)1@^z({N?K5a4w{jfc6Z~nFlYD$S$Ja46e2-b}-e8SG-(?dm zef=pZt-qQ0=sWTSY|_uXASSBe6|%JXc}%yF(a!d2QsD8M7U`0UUK0Nn+k7<}L$n(G zug|1ck(iepyYKXNPNKHr+TSfE#*+5JWxVHFcrAWYTW0c_=H4S+ZB)J)#CaHpInYRBH#dU)oq?|Eb^mEXbd2<8_XDA8m&QD4b~sK${S~^;>lFF( zsF5s|?{YNGUpw_kU_wdwtiGv=i%xDSs`LQEY`@UqkOysh^@wrV(Adu3J3##`Q^1)x3FizA+Dh?riYFnHGCj=BUYL0=2~7OH z*|3269>Mw^6>NGxs1HO8x8!My=e~CC%VJn?w1J3<5T7PkM!Wpe#f*_T9S^E|f9+X* z>9LnfgjFz@Intf$Sr(10p^Phvi&X?eIgIw`Ec-|<)uhfT4g*&a8^WF8d??GIZ;Y+s zBuUAyK-X3m%ydpG8qbLnq{#67Wzyg)Ea-3`G8|->Pe}bhx%t@Ru#Uk!)`drP<&|dp zPSZnS(n=9sNs*CymptKtM5kvyPEP7;vKWTlE+NoO<_Pxy-vBdu@w~H2jjCtROA5O} zvi+{4f7LijC-h7dDnK_P7Acfjm z0I{+cUR1L-G;{3xnUF{=BOqBI0h{lIH4Tr{*QPH0swwYi?3z+iUuu%>ACgvNsErw{ z{VNn(Pd%?TqsCTYH$vzU3pzEOx9zsNysfbA;^yEy?5zA%Ga_(C=492I&$aX2sb<(O z@iaCJwma%Na#Md!>L1c#L5H1-+jXRzm*$snDl0d}%oB0!WXxn6UE{9k{++V(G1Z7I zfE>=N8uHW4+l@~##lq%A{pa`a?MCGJCE-z51%@F~3m=@FtRMHy_gcTPH*K+Noe!mS zEaVYC{wrI0r}NJ24v$=Wn}Fc1SfV;*$I_c8Ut%?+)kv`6qu)Clmdixw<+bT#xZo)R zV2-jsWE9Xl4>AZ;Ty(V&aJlbP*1X}H1LA7m+Fu{bUyN;#5V4pQ%r4q}c4nN>$g@Yk zr20x3#3ykeYuaa3So1&(OQG&T@I0jW-NS5aZnhH(&T+kaYIjw?QFpz5xBS8FWr~!K zbH>&ge*%8u@5;<1aPN=d75C5zf0%QNJ&mO|@_aO?T=tk-{HbFc zMqD08?dcXDmPq*Vztb?;zdr6HzgDXL|Stl7r=d9#6BXWBNFpk6Y zVLc7c#w$>!CfUxf7TMwJA%a`dDz7FSl_wS%dsHmn+VT8<_T|~wP%0rz4p0v2^9v+Wtq>Ak|njuWaLc+;p z?rjXB#?hmY^MFOSX|)9(d{j1&j=fnv%4CZKDtEd|O$0N9em~;axdHajeBQ2s3-}nT zSfSEA*P!|z9dDr#j*7+{xciS_doh~{Z={* zI9%shh5G!1pWBB={>tcgF~vR2@Unza-}GmkqPc*V$2w-ZPkft%8x)3}4};A*m{X13 z^+r=`0mN9_+$MM1@fh-;i==WMYy`=~{Kl7j3&32B;PF|D47-8m?FvI6Hs4PM^3W|8 z=T&ijWmqIn0GsfltCl{1c?@#5?7Uk~GmAyfn8hVaU2STZ1Mpi#PVW_~)cGIhTTIEO zqN$)a;u2tks_8uc1)8sXrR3&mJ&@4{lDefLdLI|OP*9r%|65WgHp|n04a88~=?L&k z)4IP8SAj4eqDIn6sY3-Ia~!gvL~NIPEe=iS0gmlx58&)vhPGAm`k#yQOAI$*KvljJ zR$5m5W)?7uL6qcK6FTdxwGi&x;{~82Jb)y0nDtzZ83Z2O_!@w*w8^N2?Tya=hDmB4 zy)imn4!Cg!_M1K?VUTRS;28k|VefN4;B6+~GE&h1sqtWx#->bDXwh|itCITM_h?x6 z>-HBM;+MB<)HbJ9Q-2t_hIkdxGx0`%s9I}CFA{%x25@4HdxNQMr*ox7x9M5>f&X$P zJarN~zq$s($v~f}cWXu@1+xG{r~hMMQ?3&$b&aXUAfl$P%lcZyYPrDc8$Yf(#g>PN zNWdFE*qy;!qq&NyKph13AUrlL95@ZJ4ng>ak;|}7oZoRSLphYgbqe?U<|%c1SW-hua@7JaM(Mshk|mtH*Z#T^of4G0rzc~$~a3-I<3&eEQ2@% zz^mp5`?or;!Ou%pGM$&aTr*c88DP_X6$}#1Rn-%uLTK$9O)1##DdkC>6l>@tfZni& ziFXUPAI4Mz@S1jl*0bnV6n@|dpTRlz6@t4GK+lHRe zTyg{8U7hc(uWX=20h2pRp)le{J}-S~?1UlAZ32vxf2yAsnP^wTt>RdLT1=psC4 zmCLRgGB#8i5xWrGZ#(9cW2La6@-!sI({Yt*#XLmx279Cdh7{UA;oWaNnsOl=xn;jB z1LV#aZZL{%6;Jg}6Y>1Jcy7++7ruwXUgamukZQ?1c0#67CmuhXub(ZR&84<*`QzlA zOIP#iBeVKH5*UaZ>lFQgtM;$VB>V(o-`({*Xt^HwXq23X-x;A6k31w~&3wDK1I#qR zM}2fIsz80ta_gU5Q$K#EE<5@fa?6#Qco3027&QcSxBHAkvM! zvU602>rw$kPruic_G=-`t&=tkK1u*^amj0giYHmK8NO9{wgpyf>8}qpz{s2bGUV|j zA#kTbTy(aNIcRvyeCqS77siN}#(3NS#BCNsA~p2*wpxx8tPuCium2+m#ez=*^Fnx#dH-$U<{7zEP16^>TM+G}fZ?9TPKe4sPU`Oo%5j(@T?35T zU%)`%-W3^<;p*L5ts$V@U(f6#-nVDi9qE4O+J7wNj+V_j3VS6QMw`Pag<ICN5^G8qD`^sb|6q=zqwxa{T`% zDs5vW$v#EqT13#hdwJ_u$EaOv;jS~F$ItptuLmCTwEmLxgnF3XLf7>7%MWvi_vH%s zv&Q$r6`6qIy@coPUAz7CCsp+hp0`JTqwX1$X#KKQlp9;pyc%ODA%iQ=xTLInr;UvH z_V3`w4wI1$p0mVP=`;Xzjg#=gzlrEOaGdMY+TIWw16D&QcMxe4@B`DPYJp|-By*)2 zd6j_m7{G}a@T)0)qujr}%Ktg%4eb2Ca}@ulkof=O;1UA$jSv!w+ksHlC}a-88Tc&> zVRL8`fETW?{$HBpOCZi*MkUO|#P1|Ig|6U#VD+$Ox;F%dH-J%tlL^ULuwjIAd#uX3 zqw(#T_kmsluaN#>fpJyyTdW*tD)`RiAB<1J4LG;bK7b(GRc49R_yc#JKT4~2R~~z& zgS+fss-tYc;s(53c#t01Z(z}`{10%gY(>AJka5?LIMJ@_`ukIMkj`aDGn9nE#9;;$ z4*=`iOkyGZ=q0Ah>BSHs$15Yx@ z12f_VC}Z@0u;Qn)TYeu4WaG*%0dU(^6fpMz!D%C{`;H5ZPRQ%aeV$YkZ|kP(i|xT7 z{t=`56W743(Ov@lE4wp5lb53w0sn{uAjsl-{gpr=wqXHyyva%?YZV(7k)N#+o_gul z^-V;R|4BSo;%+OTY`}FZE4%AT(vb#cn%LkrFw(agi`|Mu67%8w zYCixXzX!1Q+;QS)rA2>WecLYkM%oTIP9z}Vcr>K0T$=#ZQ`-Ny^C5TRk7x#|b|Zj} zz2$P#YjHD}I>dx~YuS6|^?3pNyEn9Oi-of*-Fm_%0BaurSZ)bxLYHKn_r>!ey8x9Q&pjTwt{=Wbf(lc<2gw`*4Z&&}7c{n+nP0b`Mm-qp& z3cEi(GMCigF9piqDiqrI#pZ7{NV2Ypeya4eo>@%ulZ!c<%H&%>I~pk0J}@@g2YJ5I zV#-O8FunvT8j~gc`p?|dNUZ+jfD5{i>R1P zSms%OeDz#wel!hlW9xOn0C-e>jP)d7ie;+6FGth{}hE>p}oHU`k{l5%1k zaAsh6XSQ{JymGE1eWK>Y2Vq`4_3u`ee`#xE+ZLOc2T|r-RiG44XcpV|>`2PY5(cR=4c?75UPukTx2rf6Iu8K{}ybyMA<_#9=22HhI?v!6Ye8Q&!%drJzm_iIh>6 z-+KC-sp!Zs(b4)4!pw;r_%cbhYSg{lx1CSMzq@xA!kAr{u=mA-p0?c0cQy%gCR_A4?M+z$2rviJe z3u8ZPSfKMc9!2(0n!Gdva8)Cxb0o4FcGHI4&58Ql=ZvW8OQAIJtug|*3S=>Bb{RA| zGL$`{4yw>`WLm4KA72PWyzn)-bl8V?sI<72AT5o^?L*Bd~afMf8>_j z*fX}EE8LiD&zR3Kk#2ZkvfNKO4ae1kDZ3ssKTRl)jV3<>N_xs`#Al!gh-z+{&)3oK zOUVsB9rlzua<^d7$UtC)iK|tZ=P3InGwZuuJ{Xb`;IZhWXe_B`ovibjiZaVZ-5spl zQbeA}uLYKDGQ%^l2u+ci1{8F2H_i0TT(jD@df?rXb6Ue2e&0jZ1GYU4;e6y3TVev^ zAG446nXgViK+T$MWa)8MXAvxGu;)sjxb9NEI#O>D8f*ZC+chkkRKT`Ms)ya@b)>TC z#OfCuuTI>22JITkL71gj?1pvCZ20&@Z|SE0=aEhI0>P{o_8}v-W0gnq6YpFOIU;g z)jj3ctkm`f?lq5S-}g3P>27*y-9nq>Y>p+I*ZR?s`GqOgC$IMxvm{1AD*erP#?U)V^uxMJhd9hj%C6+^yXSyTDyEk%%-eIJ2>C# zUlLUInie9KAak;%InUV<11%*;ZN2evw|dn6?XJoMJkxR{?5@y*$TN_jwWFRbl2v%2?Fn)e5cP&id<R2PIpWZ0r!D{zd+_%UqzmH*JjXF*A45M2i1R2D<-A-1e(y?hidvnrIzg}wO zOl~auVEHeZ-Lhf2^YRtf!aI?bjuNiM)RC*%7=e2AcTbnO@9S?TBJB`L-TE$UV;{+q!S})CuJNd#s0X!ox480ZcCmfaE_jZ zKijSSIGceGM(L2&kDL~CD{-r6CvPWvOn|x#DYFBJ;kFfMj3$1%)wQrN)`Sk^N49L? z+c{E@@p5%0)~p`62+&@TWhwS(UbEhbRmAV(CyY=$0lW{leP!kN8bE_fo^(2onw;%ENu<*BwPl9V-r+ez!iJ(;k9GpJ z94KNJ^GJA?-t4`eb$<0V9&M7_6a>aOPNPGc+$-vobf(Fol!Y23h`cN93Xk0;qVrJXl4@M>P%O|5%L%@itn}Bp?J)6< zy18vGVz*kVkm(l}`jN}WN6EUsz{Io^&*%>pa1x42#v2JyphE_x$9uRx)&lVF*y(w_ z@E_Chgk9TxjpPO5-`>N~yJedl;~pOP*>x)G zzytJPE)#mxDTv8oE$VoX$C~9MUcp!{cX1(F>&nfCzcfA{ga4Q5HZvc6@LruwSCDyDE&h#6R`c$d6XscEWxTChpX zXvF`lVZg`T7HGmKqyI|DNghKg%vfx?txZVyb0suK#|f?Fs&{X&atKtl1h7MF~u$+CDs2XN#c! zLF)XYqyj2{Zo;`kGI8taL(u{k*VKH=Jq+{mT5{NUq3*#XnG>@C*jB;ltAjhs&257m zn0)j+Qn7nK#n8Sum>Ow~SI9r@VX^BHM?S1rHigjPI8V$2Zc{>|q)511l?u;et3%%ssa!UB~ii%k8V?E+c~~x zd%D3S_7fELwfOFB(zq_7wb?%zUzJOd+tIkk?EcxsSGz1)OLUpmAyBdWVLHd+UvWjs zp1c_CP}z3M4&0Irefbt00D&}APrf&tOeiI0276xrcF*hB@B#YeO6ZkayG6k^k6`?y zDVpMD$96(br?IXE^=?bupH3!qD{CaJrvj_b>hP2(rNU?6V*5t#jol{a4wWs}G9W8< zK>pM1`ERbONkZ}!&l9Q!Y=%jARjZad?i&n}BOM0aDu?uYMg&)u^DyrL>!|lO}_<<#epbTPgo6yuLOUiE5Rlu_k zak}M%4lVcTyng!o%zp7TACW>)l@)JqwYIV*p^d13m#J1hjz~+=F1*?Cr zVnDeGb-vI}>5W#pWu?GJygtvVoInx1<^0os!a-utLc3gDf4PP9jbp<2RWL~S5mmle z1^*bYD_*D2pjilEu3M1$^V_Dm>4fGHV!?z0J((!Jcy3f@yZET}ACkS?qj9g<_1mFgpG6V3y>_FnmlJe}HjEBj%2Hs%FQMX0S; z@4KRry)=2M#ZKGb!!J^V34iE+9etH6t%(1a!J%#;Vncwi5CVtgfv`65~gU**-%C$8djV>$ir zC(1DWANlWUKJzGsS09VDg@?tCm-Xy)eS_YObdL1wbFc+qL1ri3t~xr)KU%G8k6t9> z?U}v)s2}HJ&TQQ2rn=N4_;y;13pzMoG%ay=ckJ_5W}je@O=m83$#7O_{)g_WUf^e& zvO9xfB8uniH@7s2+rJP0On(%{Oe_gA#_caL{cx#2em=ZKQ2>HG!F zVvJ`$h%vvld-yjunmgq+VSaUZtyn=8n57NfDVidM4Bie{C{TFPZ=}LfR;@)UEMS5o+SD_>o#=-wEj}nlfcLCrv+w(|6k^Hh- zBQu1Dd*|byKfIgYp1}|}<}*eq&ROcCPKS7R{}mo#$j_NLSt=&~X!SKgO}b?&i(N2z0VkXoZmTPocI0DFDw>|=XvfquX$acDd%Zu4u^~QDXy6@ zI>N_G*3kNJ7p%`V`#81)mH8T;*O5tTaACcFNoKZXkpRO;O$)G+%0av3PHV&|#L1X? zTVSHKX6UE*JBP0q2!oU!wvN&WC4*CXRt3(KpqSHA=Q%pqr@hC@uKld&V$-ClG4|hL z3{!rAXBC1-#J@E?$oEp_`jAHOD$rnwNq>u0Y3ap|SFLepV-5S#c-TXct@H4MNoiNk z2uTtZDl2(T=YFJY5LLU%bUUF+1fFRpuw!?^lHp37*?MGFAkI9M7)jE@dA7#qd|`$f z(AV!WZJzxz@+nI&3GwL6LZJIgeUP^ewdBwA3}2D!6#MQZixNGjN#l4Foa7tgPF1{t z!A#O#-+0p9InT9JL|XmM_nu_=Dk-?Iw%bDE$@ueO<9MCo-dO^%aw+-jeyd9OeqBdC z+DC3498t7k7fQFqFDQPxEDa|;|DVb2O$#qe+4QAq;iTNUxkAo;o?P2W#}ta3VJ4l! z6%R)$q-$*I%##-9wvuwQu$q&uswzW0E9R^zZFZEqn#?C=t*4K;raK1MR5)I9pW7S7 z=GaU`B=5Y_p`f-@=c^H~P;Te9Ix!;eyP{x2Q*!T^@U6!LHdc~KGHJSn&-kSt zEmt8Yc}2?JKkjON!#!1C3Qdgu13-O*@b zdwpUHREGj`(x2KUb1Dy{mIWaylway}gpFhblMf7OGO&_ztRq@mQ zpNuA5{%p2l%->B?_!cO#d$*IjD(O16tI3iyGP{U&!bS0&im(d}(t@I>PT=x=SW~rG zZ%KsIZpEYpx&=h!v+2#{((bHBpys1oi5(m%o#=$Fk}{NPw1Q!GylC!6U2prh_G4q& zDjA4VwjV{m9JYF9KErOPCJisTWYRBc_-VP}vc(xueqii&-X8ha;PQ!TPjSE)Y{JRF zTtc=J&+6wCYbI+cr)IMLDG}Yp-`!DywUEx0CE{{Mx>LZmI_+>2)>vKpi%XvhIymIE0Sr&ev-V(p^8q)-(fSd3%2;ea6723$U+P+ULN zwNd;Vu+X*~xqM+ljoXL9*vXZMWjXQsWnlY(*p+7X6YXwLHELUPatQHE@*D zzP|PEI1-w13tzZ`2{$~PXF9+Cw1K--2hXoyaqcdX$LL|8o9&PI!#XtiFNKqHLz&Lc zq84I?ho((Om>;^XTCu$|sIIjjMZ4RXeD?49Y^pCPG61Q>Z(L-*4=1d4AkTDHm&089 zJvhAl#bQ9|H(C=}39l&$9;34(oyncKFG^j$z4M=F^(f!+*6;NzI8B3@b+MbZ0_OS? zUb-ofgI>-}-(%Y~K*#7WBWOCda>@+zplGECg}r`g@6M7C*zCBpl{12NWnF*5oOft1 zEjTy0D8+V`K~c{rKMhUGN8`EH{et~4J1U*MHXjI{7E$&{)9K6fH^Tm=tP?jVkBXn{ zPl^9+e|0hX;Nk2+XUp`1hI`l|E6vg&hxBcah##KTXK5$8tj~s8zTaP)l=wGw#BFRkw$o=#fcKp44G?EJ;WVdg=_U0m9`{tuj(nt6p7G;K&; zPd(C=9>gYOD(E&hz$|!gE&<#SHXmCVng2@r|AJz6FCw}rua2Z>c82rqOL(g)_FJnC z+4rS|pPZfzOmu98?E=`2QZa3tcLiBTPZ0)Pq=|K{V{rhjO^SuL*=E88B3+u%BmU=$ zD5X92kwI6vk`A^jm^9)$JK3#*3$kWZhyJgV`z#Op+{?r2NF6Kd@ibl)rEPq6%!X04 z$pLkxhik0(ROMFOu$lyJ+pEM_j=Hn0?zImDlD9xPW z)4W=Ydk^z=-E`^2x_4Kky-QSoN|Q;gvqA6ot>2q{K{YQcsdlhpToiC^qcD6)mO2~V zw!@{-mGv19@MxNcGnyn|r)+6WxJ&-i`%?tPbw$E|sJ=1aprl-tBoOIF$B1SaokDYj zEM}DIgx~M0>=>o*PWs0zP5a`MQVSz7$iu{UT*7g$bB4vrR7u~yqKMSsOpJJO$k0M6 znZQ)o_BL2eYG5><0fuGs=46^7i{5s)r2#Ek)a}5hP2+uofJ%zn8+r~QndPjasP$55 zDm_Ze9QnXS*A`A4iuHtX(GO|rIgRy|-WC>BE49smI@UWDI7*b>TcxPM^PVDHlgcp- z(E6MW^rRNq)mOxoz^44QDSkzJJg^eLSRxC@%g;45NFMfkxwp z5jLM%pgJ1StK@;xTK~q;2gc?&ex_emL>mv^DQ=$r%EQ>y{%VF^x4Wl`O>F%~oIi(( z$u!mbSj<_neDnGULYHz6r+#*qDCMT0*PG|1`;CWDj1IHFa98-9??3DK@& zW$y)SmXsJoE>w;MC*Y(F6MUy|p33Q+_+D{s7CfyDYB2J)Vt~DvYKU_hxZ1ufjZ`bG zZ|2tg%6n4HbQS=TWIUGKOb-W}2R~vhYa5?O!3E6l^s}ne3+*RM5s@BF`Wkq~X2J6G zSx+1--?2RmOBmyJ#na7Lg#D zlWujl%kFaO+0r#7ir|KO&R*A>%~ypU0JKy<(=`x8wTBn~Ph;-=9j7JP*_K8=`vFQ7 zc#ODic6vs_cGttT&(})?SAor5nHNUMB7VHxdV)m``0VC}1Apvm-e&aQE7V#@U_j&J z9j3C4QaU>YGC*0#i@(IgowOHea(ST{VbQMbf0D`{^h>GdBKN+3k9gc7+RBKRMW6Nb z{l=m$ec7X9FidTJ9F44x!a0%Bn#DH{m#2LjG(427qEc-c{2+iy9du$+Hs)qhf4 z8^^j}d`p^NLUIDjQo4>COD$0*i58nH$b%A!8EGn}L+G@s;{ z=CD;-$?iM8=3L^J>s+`8FW*}OJ$ZsW zlGmE^D2Ufp&2pEC7fnIlb8FO8J{!iJ+QgGMwSeSNub9VY@(y^d9d#b+O0 zGZz*ZEqSeH2C7$s@B$xfhU#)%I;QwRU2&(7duq8>50tqn88dI*C`@bw5YaOIHXd0` zF%>WNm8I!YH{SL}$2RtNa#ZIqtTPn7s_FkA_3cWFX;=k$EBn`H#iqUTtj)DiYTdn` z+4Phc%rJqaT-EAF`9^O<9s=w1^pqB>T6K<&X}*_EQZ(joV!Y^<`wDmz;2#B>gy z&Z`(DTXjkd_TjEngH#rQ&OVn)qchqPhw)*Cft3f7<;xM?a2@{~wohTrL(=(KvjnP~ z5__Z41#C;J9-buCZ4SB#!!+K@urdy6W^}*Qx*TS|P2H=`+O25|@(Y!S;qJyJ8PplA zQW#hJkq~lO{~{s3eycqa|KXY>h3V;w%eJqkZG=>ND-YfGR?@%ta;Od%zI&d!^!{v; zfF(s0vzz6**4A2iU4;JRr$>AfyOhZv5~7yl6(&(>>H{^iI9NSkvTaFTxXlTcs9FG4{gf$X7%#8<~1dPiJ4zIzB zh6?-JhgVm1thFd@xKj|?oa>u9SzSaLS~>TVyOrOvH7xqLVb0zKLzv_1UeoSo?X`wc zSd*m1YQcf}yxthrH|9hJ(}_^*CT81U%;o7|j78W}Lsv$!YP*w}RAYmlBBFFr;X1-0 zddFT9P(zdg_Ql#!(j(hv1X0$m)Oy|3d86-bN9eM`WsQQKF7pYPSF%wIc_llQmc%^t z&PwB_oay74(|5-d`PFFDZ;EMai(4OLlVZByYTH}ul@ply@`)+Ub!v~z4vlq;xaKgi zm;FHc-9Sfjo4#aC9^dNV$$SjsOi&wT@~v@OuraFv}M zVa25`IManiRygtGUL^PykEBBND?IzuG{%VS7Y38GT=}b=qq`+{8pLu74_<3$3I0|U z4D;&?X-iAR|7q-2!E&DVW(P(S^w5aQS_&`A5@B9D${@T&!xA-~77fox955qaa4t`N zvQ1$#?QigYjdyFvNyH3=&vog-d(wAVHM84Me>PI_U>Y@Z?2;0A-2X855e74wjL4L@mhk21=@yY@YYOBmwDl}ZLG4en0(Xex=n9&HMhE3 zO2KKinbgR*{6qHpAClys3f;54PgpUxi^DZC6y`p2`3z~9bo8@&qWMwlhk*4LI8Om6 zNA|zWR>+?dxxar8-#EK0a~%=EQjRkgBaoRZJ8S)qtVWVLAVv}tFS7xGS!mP2Uc<{w9V0uPaW6$*83z2rtWFII?Tw+Vwh zTG45*{`*IB;8%EU77v+oyQZ>(|Ab_&lRytntX??h%Ze0L3Jrdc0e!>pkOL~59eprQ z-@{`MSbb6tJI)JQt2d!R3zLsRQ!?aHPo%6n>L4-b1b)l<9%v?5*3DEH`y1${Asw95 z!UOix=6Pdm#+?%(H!gWvWSNDJ$>%Joa3)}3(w_oZ;*GphdQ%?YVJZXB=J>nBx<7vj z4-ig}%oxdaP7_$?jeA1x#U9Cl|Lnsa(JtVb<#>hJ%3)A2a_zk~))6uC{zzGeU2T#( z90Pg(hwH&tT0X!}j7G{}Jz1tBuOKQZAQIi%KLE7KxOc3B8(Mfe%ZNNGoK*lPF>H=qi)i6P|Ah z0k{;}kP#e~P`)tJ!`Mx;kzO~cv0)%h;L7pg&sXiMq20rdx>-Wx2n`l5Viq{45a3O- znWnj#5J?gRW%LQ3Zyn*jopl&dG`=|9J7UK@e*YHM4D80HMGmym5zNpSnG{fHtQr)Z zFSZnkRI`T91TPOq5CEo_c!(u$W1~A1%tUPN1}d`6t+^(ylib5#i&3?s12EZ3db?}b zGEN@F`i+$W1HNH^t-j>4pN_COubQz=9+gHc8&Qa-KNh3SozQnLx&T!HOEd7fTikU6 zED{SNdr!y|_k(xoiNm0n+LL=zHs0qmW!G2dV5T*dvsJy|h46X6%0O;ap)v*Pi;c=& z2!Hkj;A6&il>u53@l_m`5elc13b{EzUUYX!`od){zOMlgl#v-wGmXIng&D#=G=|16 zo{aZbGJeM30X8&i#Th_8HaG^}vgu42cN>{>z7V$3b3ohFANdJf@bM5=6XM4@-dfYN z5kIGPQdg}=HjdY;f)4@ws;-8y!+w{*S+>C&OfO(kS7y2fQ^cYahhf>u3nMk^L@(42 ztnVaDgUgYiub^yzEaCNvj+9KerS7MH1A8EAGGuq3J}b0@D?pA{JMhmF3lJw00shzp zcaZ$j6zc#wpm}!%!n9sd*|y_5UW2PDiK~38;14l!!qw}zJiX}bFKIt83>N5u&_Jas zhiDL~y^RDZ` zC=jGZg0mwGOb`=S^zgG7WS(+p2JTW>4{PB783fI&v=;&Q#ilLJ4irF61lGeIC{S-I zPTBeLfgA8yX*||<`THLaTC^!~cne64q%ql*KFWEz3vBR5r{4>UwRdWkBQ~6srJKxT zq++bzdv`PDDQLqt!q-KC8}SgPY2E{_RV@KRYd4OK60yYFA$-;Tf5=-%JdWtT=|OMY z@%0oO3KJlP<=Kj?QJnj-*GofX5a@x>>N@=ViJ){5)kb*XZJ}Um3$gpIawbxryc}>% zOa~bW__EAsKhpld3OxO-$gW_|&w24QV=KAyvV-T`1wA`YL(aU+!J?o>NLPHbk3nN1 zaax>TAlDa(WS~dm>j~J#H{U`Y6|oE(o3L7KXZkA7chS?BRTc=XWD4h1$9XGf$xFV3 zQD%Lb=+FItcZaKJ9X)s!hj;chTTME!-yr}m)vFP0bT|*u1E?pZPd>HWhCHGr6A!`_ z{7o4Rq zuUQMCbWH0lY~8@1xP^{YX?Gb&svK>gCRF~Q zz2IO)R0K9Dq?4iTeL#_L0q~soV{(3P{@tjj#+B;n?Ek?lUOBET`sCv$1DIpF@#WD( z32*$mU+xEoTM!#%3Y-C(1S=I0E?7wj`JN<;AEi=_JE9)M+Q7JT;Y)S#?&tszZHsNE z!8`4FBhR8XP~L#7w2G)Vvq^8!qO4@0giDtK=jp_AwN7GSD%}X|o>7%HU3#u(@*DnX z000b=7G8dO`TAc6Yunn!rLqs;YyW zYMU#Zh5LS1syWf)wM}$28j3Vesk_6q2Ln6;S13fkBgxFtI$xOXFP7VXJ8UOdE&>cL zN@vGMe$x(Hj<4Mh19Jw3&=q>Y?>j7h`ncs-LeFWSCP7L$l?bdM|I$SGTFif4p4YjysOR1hrZQUW&1kcGBoWo}M@98Q$3 zGt_G0%`40b_IPvEEz~W7@jX$QQz`z)NhM*#Fe5`C1}m?b#ydH;WJp2BhSkD$_l3Fn zF!9JJX$8x5_VS&ZRl}Z1z866uP=(F6T`@xUqq>^|5z5=I zA>81>sKds6z}3v&;hP+Ea(UzWH~kwIIl|;~?Pb&}k64n%h+Wv`GPwNI_W59-`CXe} zIo$5l3V=I#b($>8P8AUT=8swv?zx3ZLhsRmZXQRlk;Y}1r37xj-b-W~0g7urY6+Z~TN)ueIv>WD* zj9swgw0AX|J>?ke@yG1rkoP1S2n$IF%J~n6KGobL<+ky^uZi6)x6yi9K=D->=DGM~ zzuRSDv!@dSdcmf?#YBua({$HdFK*MtWo1GAG>?to{jGn$dy)w;st!x-;aq(jbE2F@ zbn%+dH$*ILgXI9_{lccC>8Oa)s#={JhfNzUn4!4< z`eg0xAzH5sR0nU93Ty33GzWlFE5qpfm-}5~${%=7{jPmKfz5^_`SxU`x-1z~PV{k- zHndBEJEr-RpD zzw&cn_EQpf=-K-ERD46Yls4h-G4P=!9!7uKInDaJ@y<#b)A*QlrvD-D#ru>V@8((C z^jDLm>oRfa9?d&-o831INQF_~d7ql^R2w0@^AI?@l2tAlHj+F%EYTo7dQ)+MV1y#U zuSad!FOUa9Z1~_9^6$R$fcZ5jUF+?jcp{Xp@PObf6f`RKwEckB_{P)?WCdJrvI<}% zrsf4v&FZ!0GVGVbdEp=cT9#JdcK<~z6e1J^#no6Oo7Y~bF%&Qb?aTL`;^odrHVA4U zbOI5EttK_}9Mz^kY2HI1&#VF!bYuNfTW=?q5X%vM?Bv&Bv=4=h+`uI^alwP-HsC(5 z>I8ZtZG8osKWliRdzTP*T^$s_`;h)`0lO zG$44OVATsc53STa3V^6UWCl`x&vLwTa+AJXgOW2)ZECmp1rrXgFz4a00nR81QuLQg zF})<+;Eb2Y-|#_XCW8771F0CRWBTi~j5DX1({PrXr^jE<35b8>|Usxgvi> z_k-$4Ltq?=wcK$3DTeC2?12?^0-^HF0=;=y?!^uLAEcJpD^(%f^mo1vBU(l;ia?Z6 z%P?h{K-_NQ^X4K$2@3O2t@qN^amAuDZ-irX&Vn{~WQU0y3b4p3J4&WryVFIymx6ug zi@%jf+RlxY8WMQiHxJ?R>lDnpIA;miT{IWo(D8a1X|a&yPi1>j#2%cUKs>zu3*D7# z0Iq*qB8}e;CI0H5He)j!=YqDuBsykuF&f!i3Z@8o{f{k*AaD55_?x z6?}eOP&CxrJsI!&!A%9Dql3+tQ%IYJuM}O7*(32fCn87em0`WmvgU|FBpys!+AQ1r zxO(Gz;rJ)V$9}KT97Y}tX*$%*u#W1WiHZUcBk)Zy_g;aCQ^# zfn1v<0||d`Fy!S*@>Wp4>E& z!bovozlGuO=lcLJ?~s})e!1RN-kSdlT^u$$OPFu45?$M~wBc5^PHsaSZKKLLzkDr|yVo^CEy)v^ zSWO3~g;~oQ!|V(K2s-ahkV-FM4<}*&HlJ#7%TS%NkU)sST!pO&rVAE`9AW%`=ypGV z3R9U@5ZPF?!!?tU+&TM%mIWijnvYZSt=Gu#e9X$+e;0;ropx)Z%=Uho$b7DSbD|bH z+d{{g2%0TlEW*E4$lUEczVV8O)6=##&44C+!6Dm8;HoG(N_!5|MvIt-FDzNhida7$ zqRcjunwC@+CFgh<%hP_O{UKQfmc-~K`K??fGa2V(F05lQ{=CYNy9h6%>Q2zlhqMu; z6beWe_v4syah>|flVk_Ms1lQHTb63x`_%1I?_R@xP}dYloUd;?N?#QDF_0tWZY$LJ zvf{V41i|wai-LzdctSq7y|($blP}*`OBw8LFFKYyLLdSAW{Hxki=LN^4|!MqO}PjJ zFmu?(a+)UT%2Mg)WWm2e2k+st|Fs^6^nZ0huJWYZhM!z76*mtF^%S1l63Rp0=I~tA zUN2D!hl1m07^y(hEN^ivMLd;$vo^=vz`YI%J;gnXrc|(53B(%7BOmxvDhA_vYwBmb zzcYYRQ2YSB!Uw5L-o5t#)u<{lNY1=;q?)#QuxN4rW=9WE`?IjCcKeE$EY*3EWt=DT z`mK1PJ~HSd|5*vt&%=JNT&S^kPys4AW$Tg)@LO@y@9~VeeC!PyO!K~pgwo+~()JG8 zt&hIz_>)lOmesr&q-x}W7Z)YE*$90XB4y5sQLq}pW3m+|Ki)I84CyPQM1P#x29x|rEqQdZ> znyV-6{ZrY3Cp1ALB-7;*@!{j8LosRo0%@>x^fOhd^KKrv1F;^RkCmzYaoz`$SUi9| z=$ttD1;)%qj_SzVWV26CW5w*#lmGK@9pD>xNPpIKNVwgFh;~_)t}4kc1bxIijm)R` ztj<|b4+r2#ZN%MBnX(T;4V64q34i?;rHsNnJE5}8>!f~REdEwIcULZWqq$VR3RVt4 zk}8?OD1?MPD;86KS&d|>1e+;%E>HNV;70bD&+UKWb^6yB^2x_D+hrs= z5P9mOzkgf<$z0EGq%%QC3F_blQ6YLokd*r+X1wizj0Fc_+J@rsXR;cDY!ZV; zq|m~h&HWxK;G==P7@fow{MS;a`*FM)L@i?>sn7!m5o}-#_6gdYw0ZX&Qp(6U#pJot zjKY#Fbg2}gKTN*_zSYdY4abvXK+(XYvwkkSHey91BSB{hvm^C0Fmd07(sYmv15k#>X;Pb1ENYJGKVHzLr{%zI~#4E9L|0Uw&*4 z9;;AACrIsomCuxo2iI@@n@&BriKdCFt+<>!hJ>k8Dh5*B@KtfO>Rp4 z2&Ag`}St_sM=$1W_BpSBC=Vb^vpDM+wc@Hb%bpZTMT3sf4=(MmWP+_+RQJZ~iJn zJ0!kuFTe1Z{FJ{{+4-m?J1Y^W9`#`BO+e`1uzJ?K$KTq8I2*%h$aGrLbM;hvr^_t} zI?KP%b%l*o3E{t5xy6aZuG@Y=pptn{E9^9P{F4an9jw0sA__VJGw;C{C-J2{>k1>> zW}0@Nd=Bn=VuB1R`dy!zz3f z>pwHkMmE5aNEGm|^u#jL{?+d6$$;3j_w*dLutQXrQpIZgTX#BLkXpqpsIU%G-^7GRw~;`~h?=KokbzsbuA z3hqFFl-uf=%l9{}m@-FVaER|Gk(1g1wR-T>tD46D-~@FL zonS!AA=y~XU`U|D_YL}!D-0R(7o0z_-k5@1}XFQa(F24z*+cbeW(QPJtfYo!A zGrge1@Vxo@yqT#AAZvB`_u2_JCtjq8`+>o)h%%}lC=-{yc%m;P2?Nc@9L7tA16?x-&N*7MikL^(?ofviFC>0zFT-sK2&JGZpI>~Qm+vGkps zflzAOgQYD9fUOqW*8d}PQIp_^br4VD73KsAi>Q~RRnY@2+zel)T$qzz{u>;2?*~GI z3h6i-U#2Gx%^G?jv<&Kt{sjF5&^O57KYbrTVn%V!K*&3+5M?^8j}Afu!+BHlV0xk7 z%p{iYp*mQ7SFGh#tcTSSaC2B)M*Ca%3s=bZ&d%Q9?U`IlOVFZ2jPF4i$H-$8>~86i z9<&@)sP`sjx$6^eUVQ0Kd>4I4wX`27&xFdgyiN_h*nulEIuhFsO>ue_ zxBia*YjoMTO%Lx~4SHAOSRA;Oisn>I+hN;wms4;j=@TLEG9Is2r?ekhxy)MPy`)qr zKmFCtcjZJ@Al>>rM8X+=;*?n+;Fb@C5$Q}ykW3Ha6Erh14XS!avh$r?CmLeCY7Qn@`Ab@c*+Q1$M~aT7%$)N;#M>ve64x zyM``cNyqTHrX~5mB+Y<(jYtOA)_d2e?he@ycE27Wi-NKl1BbBn$EhJ=?YUKkH^i~g$0vucq|SWdi%z%G^>SMJMH{n zbXiE!l>D>y)`oZm)Ima97&ZdU1eU*Lgeoe50Da)cjs>vmXubC* z>b_a2W-W(J%8?xgWZ5TR)-+0jVb)^iyc@kF_z=+@_`nem+8%c#$B-Z zk+TPA9G9|f$av~++maiT%3%DjVo0%5E^6-?Xz=~4g1aGED z@{bVl#10Xs0f+9$`%4fH4g8!cCO?UO>>-7LppYO*|0E#8Zbomd4`ua$a=MYp3tA|8 zv56_OZy-LRZ@~^ zhsSLwGsw({Csr=d3GE~JZ>6U?jFdAMj0&4UnA%QGj{|7gnBBxp|NQOF5b^QQ$X4xE z30T!}vxpNa&Jloq@uR#CS|U0|Arh3;DQ5Q;4ypk|(LSifar`-2+6k=| zS}6`iP(zU)rPCCII_?8DV3y-56Poe;-7A)v|)A!d!F@4nEa2r!2z zy1n(Kg3I8SH%8G)t3Q371P0di@pz8fo$&u*lCIz zm0}aOB0=hWA820{tf6hpyV3Hj1?9qc^1Mxx^dV5ku(`Dh@y?EZrDn}r9ssXMO+>#g zA(%8F84it5oM?8wmOf^ZFHE>D@1glbC^*NjX8cJGcD4Kq;eM7z(}Inl-4NMYlNH~F zv21`E$qHH!1J7SRrk0?ojja3eE_Kds6>6dZGeJCXe zZCBMps}?Hqx6b}BZf>%wd%pDQmesFPO(kkO^st&l|LGGxi3alyc4tHW&NJXrSNSjy zv9N_&#)43ZdBa6)g8@gIKv}k5ny+}jD$|=Ah*yvInkER3u`{`IvXkFzr_;%OXJ#5Y zJA?wQy}wi?MsI#h%SwK{oPs10#d{VY!(K{NA@tZu(b=kc#(rU(6*@r99LysXse}Gj zBs_`(S66nqj6ZbDpja-Y(De!}EMPtn$869S!chKLb+*49C3okIX8X(&9i{wx&Wh1G z=CVNJ3}|1Wpd$3^0x9h=(5$GYuaN^hpHK&@UyqGyJ6$!E(_YWR-KUcGp`p_5H|0=j zF^cNlBXNG?RU{{ zPS9F6UmnZuK{rbTKdT`o6cuU!OJlO2I54gh>bBLarv}(}W!^Ls=v%Sc=9#r=|YU~+J zo@ulgJ;CU^f`C^{KJx-e6L-Mx>PB_B)Iq|@&HNJpV<0*{kqBFTKqA$oKSP>r2dN|Q zx$QTxo4JmjEA=t7HbbjFtl5Bcbaa_(5)b`7p^rR+_?`D68dd(ny~De%yk!YQsEp!x z-SZH?O*a={o}s^&J3w>x{Q~kK+kE~D#|s$bUx;Rywe8-mD({A_jkOU|$*(T>t&occ zT4~AzZISH;GV7S#pctlF<^j9z#Hq*iKv|v*4nZvlxM%h6K&NReG{ZS^%S<*5qGtC) zyjjy?I!b-Dl-QFAefp9Ahh0!Qo}TjJDD-xVRLAjxZ_+EhOS89@H}^~eAdn_eb*j^J z0d#^EIft_XpVARxu8F8-&S@qNqAP-(>Cs1p{U#ouxiBNr;GKqKnIjA``J%lP>f3-> zDC>rcTKylt!GD(RZ2IN*fZ|wBhR>Epe~LgAIkYDc@YBe3-~LhEUdc$*AuNaF;~v7?Nn zZ_S|AYPN5R{CVkgVllkDb5 zkZUg~^+R8FJ!~WKb+OiZZS`^W@4948f9M@}kE}@!rl!32K)weIw4>Y33y&(4(UYyW zl>3W|JV&lUD-FtKN>l|F0sX**>w{hhX0vd`0d$H{-bNROG%VOSmq{S73!QsUx|$3! zmlZX3(iqOLuLbZyTBA_9@CzRkWAwo=8)(Y(u-cs#TWkixutH7W!u{nKIl$=qqy<{A z9#EJWG~@08!(NSL#gNodANxF$_~Zp7?y=BHh2`5s@PlFf_n&UJPXNYKeL>~^4LtY| z7v&JCm;n)9IX;f&qXH5jwy7|Q2s8stHfoSQlomm$xB_jb8&cb3dlD&A=!5)*H%B2V zDQfB&)$&oMp5ZAN$Jf;z;We_UrhsWu?K9}4>RBJ5kvR>T1oT}k2;YD@d&c>ygLthE zouU(L%+fS<|L3K$`{*|W#%O-@H*_DG=y{eNgF{2>1|2mU&(Mp`5}w4qDt-W6vVq{^ zX#ca>3yH7L5j}1|HBzbDm2j_4JQlCba_|RkL}wUC2Vi01qZnRT-(utna*TlUjr( zk7Zz}I+|?g0Sk7Sb{+}a41^1Ms?850OT3N>>$o;J<-zFj-KAf2&Is0v-!~Wad&ALP z;T(xr52oOMt;AHl(?O|P>1_Sg!v-a{>;4)8E#W)OpYUaqFA`r{&I~0+*f=HcZ0rT4 z;D8I}&=Q5ni`AW>eG3;MZIdK1n%Q5!k*I)}h8lC_6z>d5+Vt(G_dA|JNxq(%Qu?po zz#Jdl_TxZ}{b&{;v?hBBY`5Cv{Nh)H%ysp$uNS(}SD=pnlU+OWfW>G6-p%;`deBA^ z&+n%>xT~YDByZNh%Qiokgl;BewZpo-&)Ix0bnCoG7S7F1z06&-~v z?y*>H%&%7fl?W~cok-cVPrdXlrj|{7XjbHR7(YW_Y6{x8=k)Bzq{lE%I+B}f{aNbm z@TZ?kg;*4n(9aL^Vxbpo692)aG~m}$n~DnZllgBWh!rdvm+(KGp4I=M>-=9s71{q^ zJ3ar~qx=&8Ffk8!ZxkBud8{!58;+{Y(yuxSu|N;4CZar!cP)O=3x5@(3&fKd2{B@; zb*?dR$ld}M&o1um6iWP**?5G26uQoy>(xg0_mEKr^)Y5?`T9E}AvBu~xqyh|L@8>s8S=9r2+K z0G43!N6JJy)5C#7Tn2v&A(2J-6-PjpPJZ^yE{wnzS=;9&=U0YC7)k}Eo7g3rI{oz zzyV!>(Z%Wh1*dZSTDo^`nEPtt{3=KfkyuOC74R+uY%%<1Jps|Q#2|S3tWE( zz#Xr4A`SW}|1nw?pavRL(thp-d%!z&e23Q#a6}t}9<|QP5S6LZdb__$z3k)qu&R!h zlEc#g_8*oD?oEm#{+{o!Do1*L<2HEmxaovcR z%Ii>fmK~0#*7w_hpiA3^(26KS$#!*J+uuyu&8NTFx*@*yF=(72Ciqy+FtjrpWZll> zZq`hKxdeg(KG(5q*42~{Y7C(td>b~QJ6al z$#I@yA14{F`(5}G3V5ii`W2okpdR~m^;(|(`@37=ySKdgd9cK-84yfw0PU8*V2S|Z zNU?RAb!GTNk3}>`tpk9-WB`4iDL>Fw3(fTHx}GB-QPA`E9Q0f5L#+{O(Y$RZ1p+WU z`!p7gUP14f6DP5tw|Bb2Se#9dirjGzhrvdY2gPp^27PEpjq zO)y!)z@~hQQ7!e|rmB4}E?%EmS!ho)PFVh1QK`LfZD3HFS|d|gP4xai%6{!*Y-WL;LOYpVBDRh-4cTwv1;CAU#iR~r z1~($gZd}VWE-O;F?*5bN>CZhFibEC3|2n`7GX6~^n-l!zYPqS*A*;OcXugUgoRqi! zS)(twSmg?Bh0l9O5OMIIjeI+299|a|#-A)qWIB4W4BX!9T6{PsFa;l9iyO|r%5fRz zRrn-6px9zmq1)@aZX<{{ad=EZrd(p0{7_qD3sBPz!8PsL@ug!SBD*f|u0iIZ63%uo zKd90L``HnY8QfZY>!OXv8)9U+^#gszAYNoyDgnw6I`SU@&g~CQX-)~w?(CD7|Ie%2 zQOQU9LtK0NUvHZS9QB&n6zlcbmYzyh8bO zlVFpGu&K1f1&~(Ighp;qY5Er5Q5p$RRc$J2A!!86W%MCYq-@r%XUxdNuZ_SOmsx<) zxDIT9RbW~u=rgho#3j}22%|9AA=l`R=y_N&;c@VSpb@VAcY<_IfJoFgREqZ}ciY%V z)m3$`fIMs~vD!+Y{>b8)?l##PUFv|2O*NTOa)}HS0y)YJ%U)KQ7_+&9m`>e>M!Wr! zSUQ3dyC$RopZQIA{s;+_xAQGr0gs!;B{_%p@T2|%T(vtM!{tc8rICJ%2v&B z22tzw743y;x5GXxqa@#Aa0~bY?AJUEo&t}LO~=WI8i5KUiGSN~(male_BWCV?LH;&Q1(7F%dJ+;K*4r(R!yAz8vb#HQaOgM@7ks!4%lNDqYC3?hZRTZ zW*HB5H@mzCW zassaa8)-P8Z1+w+o`o>qw7t(VEyO*oraLx&s0-U8ei$zh$xVGo%tTab2!-(t0b6it z%V&=FpV`;j1I9n*pl#?#(vQ3WrNz^R8ZWpOX8ee?S80mC2UC>H%FP!}^5`WshHd`<5}Yl7iXts32sBYf^ P|C5zek|=)l&gcIEHDt^b literal 0 HcmV?d00001 diff --git a/education/windows/school-get-minecraft.md b/education/windows/school-get-minecraft.md index f5f19fedca..684fb0e0c2 100644 --- a/education/windows/school-get-minecraft.md +++ b/education/windows/school-get-minecraft.md @@ -17,17 +17,47 @@ author: jdeckerMS > [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] -IT administrators +When you sign up for early access to [Minecraft Education Edition](http://education.minecraft.net), Minecraft will be added to the inventory in your Windows Store for Business, a private version of Windows Store associated with your Azure Active Directory (Azure AD) tenant. Your Store for Business is only displayed to members of your organization. -![Click Get the app](images/it-get-app.png) +> **Note**: If you don't have an Azure AD or Office 365 tenant, you can set up a free Office 365 subscription when you request Minecraft Education Edition. -![Enter school email address](images/enter-email.png) +## Add Minecraft to your Windows Store for Business -If your school isn't managed by Azure Active Directory, you will be signed up for an Office 365 Education subscription. +1. Go to [http://education.minecraft.net/](http://education.minecraft.net/) and select **Get the app**. -* Office 365, which includes online versions of Office apps plus 1 TB online storage and [Microsoft Classroom](https://classroom.microsoft.com/), is free for teachers and students. [Sign up your school for Office 365 Education.](https://products.office.com/en-us/academic/office-365-education-plan) -* If your school has an Office 365 Education subscription, it includes a free Azure AD subscription. [Register your free Azure AD subscription.](https://msdn.microsoft.com/en-us/library/windows/hardware/mt703369%28v=vs.85%29.aspx) + ![Click Get the app](images/it-get-app.png) +2. Enter your email address. + + ![Enter school email address](images/enter-email.png) + + - If your email address isn't associated to an Azure AD or Office 365 tenant, you'll be asked to fill in a form. The information will be used to create an Office 365 subscription for your school. + +3. Select **Get the app**. This will take you to the Windows Store for Business to download the app. You will also receive an email with instructions and a link to the Store. + + ![You can get the app now](images/get-the-app.png) + +4. Sign in to Windows Store for Business with your email address. + +5. Read and accept the Windows Store for Business Service Agreement, and then select **Next**. + +6. **Minecraft Education Edition** opens in the Windows Store for Business. Select **Get the app**. This places **Minecraft Education Edition** in your Store inventory. + + ![Get Minecraft app in Store](images/get-app-store.png) + +## Distribute Minecraft + +After Minecraft Education Edition is added to your Windows Store for Business, you have three options: + +- You can install the app on your PC. +- You can assign the app to others. Enter email addresses for your students, and each student will get an email with a link to install the app. This option is best for older, more-tech savvy students who always use the same PC at school. +- You can download the app to distribute. This downloads a provisioning package (.ppkg) file. You save the file on a USB drive, and install the app on PCs from the UBb drive. This option is best for younger students and for shared computers. + +![App distribution options](images/app-distribution-options.png) + +## Manage permissions for Minecraft Education Edition + +![assign roles to manage Minecraft permissions](images/minecraft-perms.png) ## Learn more From 63eee9d5a99be0841f116beb88256ab0f1110dd3 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 19 May 2016 12:37:43 -0700 Subject: [PATCH 344/439] add video embed --- education/windows/get-minecraft-for-education.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/education/windows/get-minecraft-for-education.md b/education/windows/get-minecraft-for-education.md index 7ab224be49..21bd8a182f 100644 --- a/education/windows/get-minecraft-for-education.md +++ b/education/windows/get-minecraft-for-education.md @@ -17,7 +17,9 @@ author: jdeckerMS > [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] -[Minecraft: Education Edition](http://education.minecraft.net/) is built for learning. (need more marketing blurb here?) +[Minecraft: Education Edition](http://education.minecraft.net/) is built for learning. Watch this video to learn more about Minecraft. + + Teachers and IT administrators can now get early access to **Minecraft Education Edition** and add it their Microsoft Store for Business for distribution. From 454859072b25e3987dce582f73f5406cec5120e7 Mon Sep 17 00:00:00 2001 From: Trudy Hakala Date: Thu, 19 May 2016 13:37:36 -0700 Subject: [PATCH 345/439] adding content to i'm done topic --- ...done-finishing-your-surface-hub-meeting.md | 79 +++++++++++++++++++ 1 file changed, 79 insertions(+) create mode 100644 devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md diff --git a/devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md b/devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md new file mode 100644 index 0000000000..5e30b15a8a --- /dev/null +++ b/devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md @@ -0,0 +1,79 @@ +--- +title: I'm done - ending a Surface Hub meeting (Surface Hub) +description: To end a Surface Hub meeting, tap I'm Done. Surface Hub cleans up the spplication state, operating system state, and the user interface so that Surface Hub is ready for the next meeting. +keywords: ["I"m Done", "end Surface Hub meeting", "finish Surface Hub meeting", "clean up Surface Hub meeting"] +author: TrudyHa +--- + +# End a Surface Hub meeting with I'm Done +Surface Hub is a collaboration device designed to be used simultaneously and sequentially by multiple people. At the end of a Surface Hub meeting, one of the attendees can tap or click **I'm Done** to end the meeting. Tapping **I'm Done** tells Surface Hub to clean up info from the current meeting, so that it will be ready for the next meeting. When a meeting attendee taps **I'm Done**, Surface Hub cleans up, or resets, these states. +- Applications +- Operating system +- User interface + +This topic explains what **I'm Done** resets for each of these states. + +## Applications +When you start apps on Surface Hub, they are stored in memory and data is stored at the application level. Data is available to all users during that session (or meeting) until date is removed or overwritten. When **I'm done** is selected, Surface Hub application state is cleared out by closing applications, deleting browser history, resetting applications, and removing Skype logs. + +### Close applications +Surface Hub closes all visible windows, including Win32 and Universal Windows Platform (UWP) applications. The application close stage uses the multitasking view to query the visible windows. Win32 windows that do not close within a certain timeframe are closed using **TerminateProcess**. + +### Delete browser history +Surface Hub uses Delete Browser History (DBH) in Edge to clear Edge history and cached data. This is similar to how a user can clear out their browser history manually, but **I'm Done** also ensures that application states are cleared and data is removed before the next session, or meeting, starts. + +### Reset applications +**I'm Done** resets the state of each application that is installed on the Surface Hub. Resetting an application clears all background tasks, application data, notifications, and user consent dialogs. Applications are returned to their first-run state for the next people that use Surface Hub. + +### Remove Skype logs +Skype does not store personally-identifiable information on Surface Hub. Information is stored in the Skype service to meet existing Skype for Business guidance. Local Skype logging information is the only data removed when **I'm Done** is selected. This includes Unified Communications Client Platform (UCCP) logs and media logs. + +## Operating System +The operating system hosts a variety of information about the state of the sessions that needs to be cleared after each Surface Hub meeting. +### File System +Meeting attendees have access to a limited set of directories on the Surface Hub. When **I'm Done** is selected, Surface Hub clears these directories:
      +- Music +- Videos +- Documents +- Pictures +- Downloads + +Surface Hub also clears these directories, since many applications often write to these directories: +- Desktop +- Favorites +- Recent +- Public Documents +- Public Music +- Public Videos +- Public Downloads + +### Credentials +User credentials that are stored in **TokenBroker**, **PasswordVault**, or **Credential Manager** are cleared when you tap I’m done. + +## User interface +User interface (UI) settings are returned to their default values when **I'm Done** is selected. + +### UI items +- Reset Quick Actions to default state +- Clear Toast notifications +- Reset volume levels +- Reset Cortana relaunch count +- Reset sidebar width +- Reset tablet mode layout + +### Accessibility +Accessibility features and apps are returned to default settings when **I'm Done** is selected. +- Filter keys +- High contrast +- Stickey keys +- Toggle keys +- Mouse keys +- Magnifier +- Narrator + +### Clipboard +The clipboard is cleared to remove data that was copied to the clipboard during the session. + +## Frequently asked questions + + \ No newline at end of file From b8b3254502cc4d593cac4e6dc9f126d79492908e Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 19 May 2016 14:35:03 -0700 Subject: [PATCH 346/439] link to blog (activation) --- windows/deploy/activate-using-key-management-service-vamt.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/deploy/activate-using-key-management-service-vamt.md b/windows/deploy/activate-using-key-management-service-vamt.md index 9b1cea0e24..4c5d735436 100644 --- a/windows/deploy/activate-using-key-management-service-vamt.md +++ b/windows/deploy/activate-using-key-management-service-vamt.md @@ -30,6 +30,8 @@ There are three possible scenarios for volume activation of Windows 10 or Windo - Host KMS on a computer running Windows Server 2012 R2 - Host KMS on a computer running an earlier version of Windows +Check out [Windows 10 Volume Activation Tips](https://blogs.technet.microsoft.com/askcore/2015/09/15/windows-10-volume-activation-tips/). + ## Key Management Service in Windows 10 Installing a KMS host key on a computer running Windows 10 allows you to activate other computers running Windows 10 against this KMS host and earlier versions of the client operating system, such as Windows 8.1 or Windows 7. From 689be8641e9ce3765d1101c82bfab67ddb27f639 Mon Sep 17 00:00:00 2001 From: Trudy Hakala Date: Thu, 19 May 2016 14:39:25 -0700 Subject: [PATCH 347/439] Adding FAQ section --- devices/surface-hub/TOC.md | 1 + .../i-am-done-finishing-your-surface-hub-meeting.md | 8 ++++++++ 2 files changed, 9 insertions(+) diff --git a/devices/surface-hub/TOC.md b/devices/surface-hub/TOC.md index 65f42da6b5..ea7471374a 100644 --- a/devices/surface-hub/TOC.md +++ b/devices/surface-hub/TOC.md @@ -20,6 +20,7 @@ #### [Accessibility](accessibility-surface-hub.md) #### [Change the Surface Hub device account](change-surface-hub-device-account.md) #### [Device reset](device-reset-suface-hub.md) +#### [End a Surface Hub meeting with I'm Done](i-am-done-finishing-your -surface-hub-meeting.md) #### [Install apps on your Surface Hub](install-apps-on-surface-hub.md) #### [Manage settings with a local admin account](manage-settings-with-local-admin-account-surface-hub.md) #### [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md) diff --git a/devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md b/devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md index 5e30b15a8a..4e46440aa0 100644 --- a/devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md +++ b/devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md @@ -75,5 +75,13 @@ Accessibility features and apps are returned to default settings when **I'm Done The clipboard is cleared to remove data that was copied to the clipboard during the session. ## Frequently asked questions +**What happens if I forget to tap **I'm Done** at the end of a meeting, and someone else uses the Surface Hub later?**
      +When you don't tap **I"m Done** at the end of your meeting, Surface Hub enters a Resume state. This is similar to leaving content on a whiteboard in a meeting room, and forgetting to erase the whiteboard. When you return to the meeting room, that content will still be on the whiteboard unless someone erarses it. With Surface Hub, meeting content is still available if an attendee doesn't tap **I'm Done**. However, Surface Hub removes all meeting data during daily maintenance. Any meeting that wasn't ended with **I'm Done** will be cleaned up during maintenance. + +**Are documents recoverable?**
      +Removing files from the hard drive when **I'm Done** is selected is just like any other file deletion from a hard disk drive. 3rd-party software might be able to recover data from the hard disk drive, but file recovery is not a supported feature on Surface Hub. + +**Do the clean-up actions from **I'm Done** comply with the US Department of Defense clearing and sanitizing standard: DoD 5220.22-M?**
      +No. Currently, the clean-up actions from **I'm Done** do not comply with this standard. \ No newline at end of file From eb9290389d9671f9ce784afecfc3034d19c6166d Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 19 May 2016 14:52:11 -0700 Subject: [PATCH 348/439] fixing spacing issues --- ...schema-extensions-to-support-tpm-backup.md | 16 +- ...ged-apps-to-existing-applocker-rule-set.md | 7 +- .../keep-secure/add-workstations-to-domain.md | 88 +++---- .../adjust-memory-quotas-for-a-process.md | 94 ++++---- windows/keep-secure/administer-applocker.md | 92 +++----- .../administer-security-policy-settings.md | 111 ++++++++- .../advanced-security-auditing-faq.md | 115 +++++---- .../keep-secure/advanced-security-auditing.md | 46 +--- windows/keep-secure/allow-log-on-locally.md | 100 ++++---- ...-log-on-through-remote-desktop-services.md | 94 ++++---- .../applocker-architecture-and-components.md | 17 +- windows/keep-secure/applocker-functions.md | 63 ++--- windows/keep-secure/applocker-overview.md | 155 ++++++------ .../applocker-policies-deployment-guide.md | 60 ++--- .../applocker-policies-design-guide.md | 63 ++--- .../applocker-policy-use-scenarios.md | 25 +- .../applocker-processes-and-interactions.md | 45 +++- windows/keep-secure/applocker-settings.md | 63 ++--- .../applocker-technical-reference.md | 76 ++---- ...-basic-audit-policy-on-a-file-or-folder.md | 13 +- windows/keep-secure/audit-account-lockout.md | 34 ++- .../audit-application-generated.md | 49 ++-- .../audit-application-group-management.md | 77 ++---- .../keep-secure/audit-audit-policy-change.md | 93 +++----- ...dit-the-access-of-global-system-objects.md | 207 ++++++---------- ...the-use-of-backup-and-restore-privilege.md | 81 +++---- .../audit-authentication-policy-change.md | 79 ++----- .../audit-authorization-policy-change.md | 56 ++--- .../audit-central-access-policy-staging.md | 32 +-- .../audit-certification-services.md | 185 ++++----------- .../audit-computer-account-management.md | 43 ++-- .../audit-credential-validation.md | 57 ++--- ...-detailed-directory-service-replication.md | 66 ++---- .../keep-secure/audit-detailed-file-share.md | 35 ++- .../audit-directory-service-access.md | 35 ++- .../audit-directory-service-changes.md | 59 ++--- .../audit-directory-service-replication.md | 37 ++- .../audit-distribution-group-management.md | 106 +++------ windows/keep-secure/audit-dpapi-activity.md | 48 ++-- windows/keep-secure/audit-file-share.md | 63 ++--- windows/keep-secure/audit-file-system.md | 44 ++-- .../audit-filtering-platform-connection.md | 80 ++----- .../audit-filtering-platform-packet-drop.md | 39 ++-- .../audit-filtering-platform-policy-change.md | 14 +- ...policy-subcategory-settings-to-override.md | 90 +++---- windows/keep-secure/audit-group-membership.md | 36 ++- .../keep-secure/audit-handle-manipulation.md | 47 ++-- windows/keep-secure/audit-ipsec-driver.md | 86 +++---- .../keep-secure/audit-ipsec-extended-mode.md | 109 ++------- windows/keep-secure/audit-ipsec-main-mode.md | 87 ++----- windows/keep-secure/audit-ipsec-quick-mode.md | 43 ++-- .../audit-kerberos-authentication-service.md | 43 ++-- ...udit-kerberos-service-ticket-operations.md | 39 ++-- windows/keep-secure/audit-kernel-object.md | 52 ++--- windows/keep-secure/audit-logoff.md | 42 ++-- windows/keep-secure/audit-logon.md | 51 ++-- .../audit-mpssvc-rule-level-policy-change.md | 100 +++----- .../audit-network-policy-server.md | 73 ++---- .../audit-non-sensitive-privilege-use.md | 45 ++-- .../audit-other-account-logon-events.md | 83 ++----- .../audit-other-account-management-events.md | 41 ++-- .../audit-other-logonlogoff-events.md | 80 ++----- .../audit-other-object-access-events.md | 91 +++----- .../audit-other-policy-change-events.md | 99 +++----- .../audit-other-privilege-use-events.md | 8 +- .../keep-secure/audit-other-system-events.md | 142 +++-------- windows/keep-secure/audit-pnp-activity.md | 34 ++- windows/keep-secure/audit-policy.md | 31 ++- windows/keep-secure/audit-process-creation.md | 38 ++- .../keep-secure/audit-process-termination.md | 37 ++- windows/keep-secure/audit-registry.md | 42 ++-- .../keep-secure/audit-removable-storage.md | 11 +- windows/keep-secure/audit-rpc-events.md | 33 ++- windows/keep-secure/audit-sam.md | 58 ++--- .../audit-security-group-management.md | 111 +++------ .../audit-security-state-change.md | 59 ++--- .../audit-security-system-extension.md | 57 ++--- .../audit-sensitive-privilege-use.md | 70 +++--- ...iately-if-unable-to-log-security-audits.md | 81 +++---- windows/keep-secure/audit-special-logon.md | 35 ++- windows/keep-secure/audit-system-integrity.md | 87 ++----- .../audit-user-account-management.md | 110 +++------ .../keep-secure/audit-user-device-claims.md | 11 +- .../back-up-files-and-directories.md | 95 ++++---- windows/plan/chromebook-migration-guide.md | 221 +++++++++++++++--- 85 files changed, 2243 insertions(+), 3427 deletions(-) diff --git a/windows/keep-secure/ad-ds-schema-extensions-to-support-tpm-backup.md b/windows/keep-secure/ad-ds-schema-extensions-to-support-tpm-backup.md index 926c8832ea..214bc1763d 100644 --- a/windows/keep-secure/ad-ds-schema-extensions-to-support-tpm-backup.md +++ b/windows/keep-secure/ad-ds-schema-extensions-to-support-tpm-backup.md @@ -2,20 +2,28 @@ title: AD DS schema extensions to support TPM backup (Windows 10) description: This topic provides more details about this change and provides template schema extensions that you can incorporate into your organization. ms.assetid: beb7097c-e674-4eab-b8e2-6f67c85d1f3f -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # AD DS schema extensions to support TPM backup + **Applies to** - Windows 10 + This topic provides more details about this change and provides template schema extensions that you can incorporate into your organization. + ## Why a schema extension is needed + The TPM owner authorization value is now stored in a separate object which is linked to the Computer object. This value was stored as a property in the Computer object itself for the default Windows Server 2008 R2 schemas. Windows Server 2012 domain controllers have the default schema to backup TPM owner authorization information in the separate object. If you are not upgrading your domain controller to Windows Server 2012 you need to extend the schema to support this change. If Active Directory backup of the TPM owner authorization value is enabled in a Windows Server 2008 R2 environment without extending the schema, the TPM provisioning will fail and the TPM will remain in a Not Ready state for computers running Windows 8. The following are the two schema extensions that you can use to bring your Windows Server 2008 R2 domain to parity with Windows Server 2012: + ###
      TpmSchemaExtension.ldf + This schema extension brings parity with the Windows Server 2012 schema and is required if you want to store the TPM owner authorization value for a computer running Windows 8 in a Windows Server 2008 R2 AD DS domain. With this extension the TPM owner authorization information will be stored in a separate TPM object linked to the corresponding computer object. + ``` syntax #=============================================================================== # @@ -212,11 +220,13 @@ dn: CN=TPM Devices,DC=X changetype: add objectClass: msTPM-InformationObjectsContainer ``` + You should be aware that only the Computer object that has created the TPM object can update it. This means that any subsequent updates to the TPM objects will not succeed in dual boot scenarios or scenarios where the computer is reimaged resulting in a new AD computer object being created. If you are planning to support such scenarios, you will need to update the schema further as shown in the schema extension example, TpmSchemaExtensionACLChanges.ldf. + ### TpmSchemaExtensionACLChanges.ldf + This schema update modifies the ACLs on the TPM object to be less restrictive so that any subsequent operating system which takes ownership of the computer object can update the owner authorization value in AD DS. -**Important**   -After implementing this schema update, any computer in the domain can update the OwnerAuth of the TPM object (although it cannot read the OwnerAuth). When using this extension, perform a regular backup of the TPM objects and enable auditing to track the changes for these objects. +> **Important**  After implementing this schema update, any computer in the domain can update the OwnerAuth of the TPM object (although it cannot read the OwnerAuth). When using this extension, perform a regular backup of the TPM objects and enable auditing to track the changes for these objects.   ``` syntax #=============================================================================== diff --git a/windows/keep-secure/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md b/windows/keep-secure/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md index 3de0486b5b..c05eb4ebd2 100644 --- a/windows/keep-secure/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md +++ b/windows/keep-secure/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md @@ -2,17 +2,22 @@ title: Add rules for packaged apps to existing AppLocker rule-set (Windows 10) description: This topic for IT professionals describes how to update your existing AppLocker policies for packaged apps using the Remote Server Administration Toolkit (RSAT). ms.assetid: 758c2a9f-c2a3-418c-83bc-fd335a94097f -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Add rules for packaged apps to existing AppLocker rule-set + **Applies to** - Windows 10 + This topic for IT professionals describes how to update your existing AppLocker policies for packaged apps using the Remote Server Administration Toolkit (RSAT). + You can create packaged app rules for the computers running Windows Server 2012 or Windows 8 and later in your domain by updating your existing AppLocker rule set. All you need is a computer running at least Windows 8. Download and install the Remote Server Administration Toolkit (RSAT) from the Microsoft Download Center. + RSAT comes with the Group Policy Management Console which allows you to edit the GPO or GPOs where your existing AppLocker policy are authored. RSAT has the necessary files required to author packaged app rules. Packaged app rules will be ignored on computers running Windows 7 and earlier but will be enforced on those computers in your domain running at least Windows Server 2012 and Windows 8.     diff --git a/windows/keep-secure/add-workstations-to-domain.md b/windows/keep-secure/add-workstations-to-domain.md index a03bb784f4..7cdeb90a8b 100644 --- a/windows/keep-secure/add-workstations-to-domain.md +++ b/windows/keep-secure/add-workstations-to-domain.md @@ -2,90 +2,94 @@ title: Add workstations to domain (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Add workstations to domain security policy setting. ms.assetid: b0c21af4-c928-4344-b1f1-58ef162ad0b3 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Add workstations to domain + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **Add workstations to domain** security policy setting. + ## Reference + This policy setting determines which users can add a device to a specific domain. For it to take effect, it must be assigned so that it applies to at least one domain controller. A user who is assigned this user right can add up to ten workstations to the domain. Adding a machine account to the domain allows the device to participate in Active Directory-based networking. + Constant: SeMachineAccountPrivilege + ### Possible values + - User-defined list of accounts - Not Defined + ### Best practices + - Configure this setting so that only authorized members of the IT team are allowed to add devices to the domain. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\User Rights Assignment\\ + ### Default values + By default, this setting allows access for Authenticated Users on domain controllers, and it is not defined on stand-alone servers. + The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not Defined

      Default Domain Controller Policy

      Not Defined

      Stand-Alone Server Default Settings

      Not Defined

      Domain Controller Effective Default Settings

      Authenticated Users

      Member Server Effective Default Settings

      Not Defined

      Client Computer Effective Default Settings

      Not Defined

      -  + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not Defined | +| Default Domain Controller Policy | Not Defined | +| Stand-Alone Server Default Settings | Not Defined | +| Domain Controller Effective Default Settings | Authenticated Users | +| Member Server Effective Default Settings | Not Defined | +| Client Computer Effective Default Settings | Not Defined | + ## Policy management + Users can also join a computer to a domain if they have the Create Computer Objects permission for an organizational unit (OU) or for the Computers container in the directory. Users who are assigned this permission can add an unlimited number of devices to the domain regardless of whether they have the **Add workstations to domain** user right. + Furthermore, machine accounts that are created by means of the **Add workstations to domain** user right have Domain Administrators as the owner of the machine account. Machine accounts that are created by means of permissions on the computer’s container use the creator as the owner of the machine account. If a user has permissions on the container and also has the **Add workstation to domain** user right, the device is added based on the computer container permissions rather than the user right. + A restart of the device is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This policy has the following security considerations: + ### Vulnerability -The **Add workstations to domain** user right presents a moderate vulnerability. Users with this right could add a device to the domain that is configured in a way that violates organizational security policies. For example, if your organization does not want its users to have administrative privileges on their devices, users could install Windows on their computers and then add the computers to the domain. The user would know the password for the local administrator account, could log on with that account, and then add a personal domain account to the local Administrators group. + +The **Add workstations to domain** user right presents a moderate vulnerability. Users with this right could add a device to the domain that is configured in a way that violates organizational security policies. For example, if your organization does not want its users to have administrative +privileges on their devices, users could install Windows on their computers and then add the computers to the domain. The user would know the password for the local administrator account, could log on with that account, and then add a personal domain account to the local Administrators group. + ### Countermeasure + Configure this setting so that only authorized members of the IT team are allowed to add computers to the domain. + ### Potential impact + For organizations that have never allowed users to set up their own computers and add them to the domain, this countermeasure has no impact. For those that have allowed some or all users to configure their own devices, this countermeasure forces the organization to establish a formal process for these procedures going forward. It does not affect existing computers unless they are removed from and then added to the domain. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) +- [User Rights Assignment](user-rights-assignment.md)     diff --git a/windows/keep-secure/adjust-memory-quotas-for-a-process.md b/windows/keep-secure/adjust-memory-quotas-for-a-process.md index b97b1d7de9..4568ef9fe0 100644 --- a/windows/keep-secure/adjust-memory-quotas-for-a-process.md +++ b/windows/keep-secure/adjust-memory-quotas-for-a-process.md @@ -2,101 +2,91 @@ title: Adjust memory quotas for a process (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Adjust memory quotas for a process security policy setting. ms.assetid: 6754a2c8-6d07-4567-9af3-335fd8dd7626 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Adjust memory quotas for a process + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Adjust memory quotas for a process** security policy setting. + ## Reference + This privilege determines who can change the maximum memory that can be consumed by a process. This privilege is useful for system tuning on a group or user basis. + This user right is defined in the Default Domain Controller Group Policy Object (GPO) and in the local security policy of workstations and servers. + Constant: SeIncreaseQuotaPrivilege + ### Possible values + - User-defined list of accounts - Not Defined + ### Best practices + 1. Restrict the **Adjust memory quotas for a process** user right to only users who require the ability to adjust memory quotas to perform their jobs. 2. If this user right is necessary for a user account, it can be assigned to a local machine account instead of to a domain account. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\User Rights Assignment\\ + ### Default values + By default, members of the Administrators, Local Service, and Network Service groups have this right. + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Administrators

      -

      Local Service

      -

      Network Service

      Default Domain Controller Policy

      Administrators

      -

      Local Service

      -

      Network Service

      Stand-Alone Server Default Settings

      Administrators

      -

      Local Service

      -

      Network Service

      Domain Controller Effective Default Settings

      Administrators

      -

      Local Service

      -

      Network Service

      Member Server Effective Default Settings

      Administrators

      -

      Local Service

      -

      Network Service

      Client Computer Effective Default Settings

      Administrators

      -

      Local Service

      -

      Network Service

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Administrators
      Local Service
      Network Service | +| Default Domain Controller Policy | Administrators
      Local Service
      Network Service | +| Stand-Alone Server Default Settings | Administrators
      Local Service
      Network Service | +| Domain Controller Effective Default Settings | Administrators
      Local Service
      Network Service | +| Member Server Effective Default Settings | Administrators
      Local Service
      Network Service | +| Client Computer Effective Default Settings | Administrators
      Local Service
      Network Service |   ## Policy management + A restart of the device is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + A user with the **Adjust memory quotas for a process** privilege can reduce the amount of memory that is available to any process, which could cause business-critical network applications to become slow or to fail. This privilege could be used by a malicious user to start a denial-of-service (DoS) attack. + ### Countermeasure + Restrict the **Adjust memory quotas for a process** user right to users who require it to perform their jobs, such as application administrators who maintain database management systems or domain administrators who manage the organization's directory and its supporting infrastructure. + ### Potential impact + Organizations that have not restricted users to roles with limited privileges may find it difficult to impose this countermeasure. Also, if you have installed optional components such as ASP.NET or IIS, you may need to assign the **Adjust memory quotas for a process** user right to additional accounts that are required by those components. IIS requires that this privilege be explicitly assigned to the IWAM\_<ComputerName>, Network Service, and Service accounts. Otherwise, this countermeasure should have no impact on most computers. If this user right is necessary for a user account, it can be assigned to a local computer account instead of to a domain account. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) +- [User Rights Assignment](user-rights-assignment.md)     diff --git a/windows/keep-secure/administer-applocker.md b/windows/keep-secure/administer-applocker.md index c9bbf2a122..232b69b1ef 100644 --- a/windows/keep-secure/administer-applocker.md +++ b/windows/keep-secure/administer-applocker.md @@ -2,98 +2,66 @@ title: Administer AppLocker (Windows 10) description: This topic for IT professionals provides links to specific procedures to use when administering AppLocker policies. ms.assetid: 511a3b6a-175f-4d6d-a6e0-c1780c02e818 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Administer AppLocker + **Applies to** - Windows 10 + This topic for IT professionals provides links to specific procedures to use when administering AppLocker policies. + AppLocker helps administrators control how users can access and use files, such as executable files, packaged apps, scripts, Windows Installer files, and DLLs. Using AppLocker, you can: + - Define rules based on file attributes derived from the digital signature, including the publisher, product name, file name, and file version. For example, you can create rules based on the publisher attribute that is persistent through updates, or you can create rules for a specific version of a file. - Assign a rule to a security group or an individual user. - Create exceptions to rules. For example, you can create a rule that allows all Windows processes to run, except Registry Editor (regedit.exe). - Use audit-only mode to deploy the policy and understand its impact before enforcing it. - Import and export rules. The import and export affects the entire policy. For example, if you export a policy, all of the rules from all of the rule collections are exported, including the enforcement settings for the rule collections. If you import a policy, the existing policy is overwritten. - Simplify creating and managing AppLocker rules by using AppLocker PowerShell cmdlets. -**Note**   -For more info about enhanced capabilities of AppLocker to control Windows apps, see [Packaged apps and packaged app installer rules in AppLocker](packaged-apps-and-packaged-app-installer-rules-in-applocker.md). +> **Note**  For more info about enhanced capabilities of AppLocker to control Windows apps, see [Packaged apps and packaged app installer rules in AppLocker](packaged-apps-and-packaged-app-installer-rules-in-applocker.md).   ## In this section - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      TopicDescription

      [Maintain AppLocker policies](maintain-applocker-policies.md)

      This topic describes how to maintain rules within AppLocker policies.

      [Edit an AppLocker policy](edit-an-applocker-policy.md)

      This topic for IT professionals describes the steps required to modify an AppLocker policy.

      [Test and update an AppLocker policy](test-and-update-an-applocker-policy.md)

      This topic discusses the steps required to test an AppLocker policy prior to deployment.

      [Deploy AppLocker policies by using the enforce rules setting](deploy-applocker-policies-by-using-the-enforce-rules-setting.md)

      This topic for IT professionals describes the steps to deploy AppLocker policies by using the enforcement setting method.

      [Use the AppLocker Windows PowerShell cmdlets](use-the-applocker-windows-powershell-cmdlets.md)

      This topic for IT professionals describes how each AppLocker Windows PowerShell cmdlet can help you administer your AppLocker application control policies.

      [Use AppLocker and Software Restriction Policies in the same domain](use-applocker-and-software-restriction-policies-in-the-same-domain.md)

      This topic for IT professionals describes concepts and procedures to help you manage your application control strategy using Software Restriction Policies and AppLocker.

      [Optimize AppLocker performance](optimize-applocker-performance.md)

      This topic for IT professionals describes how to optimize AppLocker policy enforcement.

      [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md)

      This topic for IT professionals describes how to monitor app usage when AppLocker policies are applied.

      [Manage packaged apps with AppLocker](manage-packaged-apps-with-applocker.md)

      This topic for IT professionals describes concepts and lists procedures to help you manage Packaged apps with AppLocker as part of your overall application control strategy.

      [Working with AppLocker rules](working-with-applocker-rules.md)

      This topic for IT professionals describes AppLocker rule types and how to work with them for your application control policies.

      [Working with AppLocker policies](working-with-applocker-policies.md)

      This topic for IT professionals provides links to procedural topics about creating, maintaining, and testing AppLocker policies.

      -  + +| Topic | Description | +| - | - | +| [Maintain AppLocker policies](maintain-applocker-policies.md) | This topic describes how to maintain rules within AppLocker policies. | +| [Edit an AppLocker policy](edit-an-applocker-policy.md) | This topic for IT professionals describes the steps required to modify an AppLocker policy. | +| [Test and update an AppLocker policy](test-and-update-an-applocker-policy.md) | This topic discusses the steps required to test an AppLocker policy prior to deployment. | +| [Deploy AppLocker policies by using the enforce rules setting](deploy-applocker-policies-by-using-the-enforce-rules-setting.md) | This topic for IT professionals describes the steps to deploy AppLocker policies by using the enforcement setting method. | +| [Use the AppLocker Windows PowerShell cmdlets](use-the-applocker-windows-powershell-cmdlets.md) | This topic for IT professionals describes how each AppLocker Windows PowerShell cmdlet can help you administer your AppLocker application control policies. | +| [Use AppLocker and Software Restriction Policies in the same domain](use-applocker-and-software-restriction-policies-in-the-same-domain.md) | This topic for IT professionals describes concepts and procedures to help you manage your application control strategy using Software Restriction Policies and AppLocker. | +| [Optimize AppLocker performance](optimize-applocker-performance.md) | This topic for IT professionals describes how to optimize AppLocker policy enforcement. | +| [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md) | This topic for IT professionals describes how to monitor app usage when AppLocker policies are applied. | +| [Manage packaged apps with AppLocker](manage-packaged-apps-with-applocker.md) | This topic for IT professionals describes concepts and lists procedures to help you manage Packaged apps with AppLocker as part of your overall application control strategy. | +| [Working with AppLocker rules](working-with-applocker-rules.md) | This topic for IT professionals describes AppLocker rule types and how to work with them for your application control policies. | +| [Working with AppLocker policies](working-with-applocker-policies.md) | This topic for IT professionals provides links to procedural topics about creating, maintaining, and testing AppLocker policies. | + ## Using the MMC snap-ins to administer AppLocker + You can administer AppLocker policies by using the Group Policy Management Console to create or edit a Group Policy Object (GPO), or to create or edit an AppLocker policy on a local computer by using the Local Group Policy Editor snap-in or the Local Security Policy snap-in (secpol.msc). + ### Administer Applocker using Group Policy + You must have Edit Setting permission to edit a GPO. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. Also, the Group Policy Management feature must be installed on the computer. + 1. Open the Group Policy Management Console (GPMC). 2. Locate the GPO that contains the AppLocker policy to modify, right-click the GPO, and then click **Edit**. 3. In the console tree, double-click **Application Control Policies**, double-click **AppLocker**, and then click the rule collection that you want to create the rule for. + ### Administer AppLocker on the local PC + 1. Click **Start**, type **local security policy**, and then click **Local Security Policy**. 2. If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. 3. In the console tree of the snap-in, double-click **Application Control Policies**, double-click **AppLocker**, and then click the rule collection that you want to create the rule for. + ## Using Windows PowerShell to administer AppLocker + For how-to info about administering AppLocker with Windows PowerShell, see [Use the AppLocker Windows PowerShell Cmdlets](use-the-applocker-windows-powershell-cmdlets.md). For reference info and examples how to administer AppLocker with Windows PowerShell, see the [AppLocker cmdlets](http://technet.microsoft.com/library/hh847210.aspx).     diff --git a/windows/keep-secure/administer-security-policy-settings.md b/windows/keep-secure/administer-security-policy-settings.md index 7bf3505369..59bc1ce37f 100644 --- a/windows/keep-secure/administer-security-policy-settings.md +++ b/windows/keep-secure/administer-security-policy-settings.md @@ -2,28 +2,39 @@ title: Administer security policy settings (Windows 10) description: This article discusses different methods to administer security policy settings on a local device or throughout a small- or medium-sized organization. ms.assetid: 7617d885-9d28-437a-9371-171197407599 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Administer security policy settings + **Applies to** - Windows 10 + This article discusses different methods to administer security policy settings on a local device or throughout a small- or medium-sized organization. + Security policy settings should be used as part of your overall security implementation to help secure domain controllers, servers, client devices, and other resources in your organization. + Security settings policies are rules that you can configure on a device, or multiple devices, for the purpose of protecting resources on a device or network. The Security Settings extension of the Local Group Policy Editor snap-in (Gpedit.msc) allows you to define security configurations as part of a Group Policy Object (GPO). The GPOs are linked to Active Directory containers such as sites, domains, and organizational units, and they enable administrators to manage security settings for multiple computers from any device joined to the domain. + Security settings can control: + - User authentication to a network or device. - The resources that users are permitted to access. - Whether to record a user’s or group’s actions in the event log. - Membership in a group. + For info about each setting, including descriptions, default settings, and management and security considerations, see [Security policy settings reference](security-policy-settings-reference.md). + To manage security configurations for multiple computers, you can use one of the following options: - Edit specific security settings in a GPO. - Use the Security Templates snap-in to create a security template that contains the security policies you want to apply, and then import the security template into a Group Policy Object. A security template is a file that represents a security configuration, and it can be imported to a GPO, or applied to a local device, or it can be used to analyze security. + ## What’s changed in how settings are administered? + Over time, new ways to manage security policy settings have been introduced, which include new operating system features and the addition of new settings. The following table lists different means by which security policy settings can be administered. @@ -82,7 +93,9 @@ Over time, new ways to manage security policy settings have been introduced, whi
        ## Using the Local Security Policy snap-in + The Local Security Policy snap-in (Secpol.msc) restricts the view of local policy objects to the following policies and features: + - Account Policies - Local Policies - Windows Firewall with Advanced Security @@ -92,26 +105,40 @@ The Local Security Policy snap-in (Secpol.msc) restricts the view of local polic - Application Control Policies - IP Security Policies on Local Computer - Advanced Audit Policy Configuration + Policies set locally might be overwritten if the computer is joined to the domain. + The Local Security Policy snap-in is part of the Security Configuration Manager tool set. For info about other tools in this tool set, see [Working with the Security Configuration Manager](#bkmk-scmtool) in this topic. + ## Using the secedit command-line tool + The secedit command-line tool works with security templates and provides six primary functions: + - The **Configure** parameter helps you resolve security discrepancies between devices by applying the correct security template to the errant server. - The **Analyze** parameter compares the server’s security configuration with the selected template. - The **Import** parameter allows you to create a database from an existing template. The Security Configuration and Analysis tool does this also. - The **Export** parameter allows you to export the settings from a database into a security settings template. - The **Validate** parameter allows you to validate the syntax of each or any lines of text that you created or added to a security template. This ensures that if the template fails to apply syntax, the template will not be the issue. - The **Generate Rollback** parameter saves the server’s current security settings into a security template so it can be used to restore most of the server’s security settings to a known state. The exceptions are that, when applied, the rollback template will not change access control list entries on files or registry entries that were changed by the most recently applied template. + ## Using the Security Compliance Manager + The Security Compliance Manager is a downloadable tool that helps you plan, deploy, operate, and manage your security baselines for Windows client and server operating systems, and for Microsoft applications. It contains a complete database of recommended security settings, methods to customize your baselines, and the option to implement those settings in multiple formats—including XLS, GPOs, Desired Configuration Management (DCM) packs, or Security Content Automation Protocol (SCAP). The Security Compliance Manager is used to export the baselines to your environment to automate the security baseline deployment and compliance verification process. + **To administer security policies by using the Security Compliance Manager** + 1. Download the most recent version. You can find out more info on the [Microsoft Security Guidance](http://blogs.technet.com/b/secguide/) blog. 2. Read the relevant security baseline documentation that is included in this tool. 3. Download and import the relevant security baselines. The installation process steps you through baseline selection. 4. Open the Help and follow instructions how to customize, compare, or merge your security baselines before deploying those baselines. + ## Using the Security Configuration Wizard -The Security Configuration Wizard (SCW) guides you through the process of creating, editing, applying, or rolling back a security policy. A security policy that you create with SCW is an .xml file that, when applied, configures services, network security, specific registry values, and audit policy. SCW is a role-based tool: You can use it to create a policy that enables services, firewall rules, and settings that are required for a selected server to perform specific roles. For example, a server might be a file server, a print server, or a domain controller. + +The Security Configuration Wizard (SCW) guides you through the process of creating, editing, applying, or rolling back a security policy. A security policy that you create with SCW is an .xml file that, when applied, configures services, network security, specific registry values, and audit policy. +SCW is a role-based tool: You can use it to create a policy that enables services, firewall rules, and settings that are required for a selected server to perform specific roles. For example, a server might be a file server, a print server, or a domain controller. + The following are considerations for using SCW: + - SCW disables unnecessary services and provides Windows Firewall with Advanced Security support. - Security policies that are created with SCW are not the same as security templates, which are files with an .inf extension. Security templates contain more security settings than those that can be set with SCW. However, it is possible to include a security template in an SCW security policy file. - You can deploy security policies that you create with SCW by using Group Policy. @@ -119,19 +146,25 @@ The following are considerations for using SCW: - SCW detects server role dependencies. If you select a server role, it automatically selects dependent server roles. - All apps that use the IP protocol and ports must be running on the server when you run SCW. - In some cases, you must be connected to the Internet to use the links in the SCW help. -**Note**   -The SCW is available only on Windows Server and only applicable to server installations. +> **Note**  The SCW is available only on Windows Server and only applicable to server installations.   The SCW can be accessed through Server Manager or by running scw.exe. The wizard steps you through server security configuration to: + - Create a security policy that can be applied to any server on your network. - Edit an existing security policy. - Apply an existing security policy. - Roll back the last applied security policy. + The Security Policy Wizard configures services and network security based on the server’s role, as well as configures auditing and registry settings. + For more information about SCW, including procedures, see [Security Configuration Wizard](http://technet.microsoft.com/library/cc754997.aspx). + ## Working with the Security Configuration Manager + The Security Configuration Manager tool set allows you to create, apply, and edit the security for your local device, organizational unit, or domain. + For procedures on how to use the Security Configuration Manager, see [Security Configuration Manager](http://technet.microsoft.com/library/cc758219(WS.10).aspx). + The following table lists the features of the Security Configuration Manager. @@ -169,18 +202,32 @@ The following table lists the features of the Security Configuration Manager.
        ### Security Configuration and Analysis + Security Configuration and Analysis is an MMC snap-in for analyzing and configuring local system security. + ### Security analysis + The state of the operating system and apps on a device is dynamic. For example, you may need to temporarily change security levels so that you can immediately resolve an administration or network issue. However, this change can often go unreversed. This means that a computer may no longer meet the requirements for enterprise security. + Regular analysis enables you to track and ensure an adequate level of security on each computer as part of an enterprise risk management program. You can tune the security levels and, most importantly, detect any security flaws that may occur in the system over time. -Security Configuration and Analysis enables you to quickly review security analysis results. It presents recommendations alongside of current system settings and uses visual flags or remarks to highlight any areas where the current settings do not match the proposed level of security. Security Configuration and Analysis also offers the ability to resolve any discrepancies that analysis reveals. + +Security Configuration and Analysis enables you to quickly review security analysis results. It presents recommendations alongside of current system settings and uses visual flags or remarks to highlight any areas where the current settings do not match the proposed level of security. Security +Configuration and Analysis also offers the ability to resolve any discrepancies that analysis reveals. + ### Security configuration + Security Configuration and Analysis can also be used to directly configure local system security. Through its use of personal databases, you can import security templates that have been created with Security Templates and apply these templates to the local computer. This immediately configures the system security with the levels specified in the template. + ### Security templates + With the Security Templates snap-in for Microsoft Management Console, you can create a security policy for your device or for your network. It is a single point of entry where the full range of system security can be taken into account. The Security Templates snap-in does not introduce new security parameters, it simply organizes all existing security attributes into one place to ease security administration. + Importing a security template to a Group Policy Object eases domain administration by configuring security for a domain or organizational unit at once. + To apply a security template to your local device, you can use Security Configuration and Analysis or the secedit command-line tool. + Security templates can be used to define: + - Account Policies - Password Policy - Account Lockout Policy @@ -194,67 +241,105 @@ Security templates can be used to define: - System Services: Startup and permissions for system services - Registry: Permissions for registry keys - File System: Permissions for folders and files + Each template is saved as a text-based .inf file. This enables you to copy, paste, import, or export some or all of the template attributes. With the exceptions of Internet Protocol security and public key policies, all security attributes can be contained in a security template. + ### Security settings extension to Group Policy + Organizational units, domains, and sites are linked to Group Policy Objects. The security settings tool allows you change the security configuration of the Group Policy Object, in turn, affecting multiple computers. With security settings, you can modify the security settings of many devices, depending on the Group Policy Object you modify, from just one device joined to a domain. + Security settings or security policies are rules that are configured on a device or multiple device for protecting resources on a device or network. Security settings can control: + - How users are authenticated to a network or device - What resources users are authorized to use. - Whether or not a user's or group's actions are recorded in the event log. - Group membership. + You can change the security configuration on multiple computers in two ways: + - Create a security policy by using a security template with Security Templates, and then import the template through security settings to a Group Policy Object. - Change a few select settings with security settings. + ### Local Security Policy + A security policy is a combination of security settings that affect the security on a device. You can use your local security policy to edit account policies and local policies on your local device + With the local security policy, you can control: + - Who accesses your device. - What resources users are authorized to use on your device. - Whether or not a user’s or group's actions are recorded in the event log. + If your local device is joined to a domain, you are subject to obtaining a security policy from the domain's policy or from the policy of any organizational unit that you are a member of. If you are getting a policy from more than one source, conflicts are resolved in the following order of precedence. + 1. Organizational unit policy 2. Domain policy 3. Site policy 4. Local computer policy + If you modify the security settings on your local device by using the local security policy, then you are directly modifying the settings on your device. Therefore, the settings take effect immediately, but this may only be temporary. The settings will actually remain in effect on your local device until the next refresh of Group Policy security settings, when the security settings that are received from Group Policy will override your local settings wherever there are conflicts. + ### Using the Security Configuration Manager + For procedures on how to use the Security Configuration Manager, see [Security Configuration Manager How To](http://technet.microsoft.com/library/cc784762(WS.10).aspx). This section contains information in this topic about: + - [Applying security settings](#bkmk-applysecsettings) - [Importing and exporting security templates](#bkmk-impexpsectmpl) - [Analyzing security and viewing results](#bkmk-anasecviewresults) - [Resolving security discrepancies](#bkmk-resolvesecdiffs) - [Automating security configuration tasks](#bkmk-autoseccfgtasks) + ### Applying security settings + Once you have edited the security settings, the settings are refreshed on the computers in the organizational unit linked to your Group Policy Object: + - When a device is restarted, the settings on that device will be refreshed. - To force a device to refresh its security settings as well as all Group Policy settings, use gpupdate.exe. + **Precedence of a policy when more than one policy is applied to a computer** + For security settings that are defined by more than one policy, the following order of precedence is observed: + 1. Organizational Unit Policy 2. Domain Policy 3. Site Policy 4. Local computer Policy -For example, a workstation that is joined to a domain will have its local security settings overridden by the domain policy wherever there is a conflict. Likewise, if the same workstation is a member of an Organizational Unit, the settings applied from the Organizational Unit's policy will override both the domain and local settings. If the workstation is a member of more than one Organizational Unit, then the Organizational Unit that immediately contains the workstation has the highest order of precedence. -**Note**   -Use gpresult.exe to find out what policies are applied to a device and in what order. + +For example, a workstation that is joined to a domain will have its local security settings overridden by the domain policy wherever there is a conflict. Likewise, if the same workstation is a member of an Organizational Unit, the settings applied from the Organizational Unit's policy will override +both the domain and local settings. If the workstation is a member of more than one Organizational Unit, then the Organizational Unit that immediately contains the workstation has the highest order of precedence. +> **Note**  Use gpresult.exe to find out what policies are applied to a device and in what order. For domain accounts, there can be only one account policy that includes password policies, account lockout policies, and Kerberos policies.   **Persistence in security settings** + Security settings may still persist even if a setting is no longer defined in the policy that originally applied it. + Persistence in security settings occurs when: + - The setting has not been previously defined for the device. - The setting is for a registry object. - The setting is for a file system object. + All settings applied through local policy or a Group Policy Object are stored in a local database on your device. Whenever a security setting is modified, the computer saves the security setting value to the local database, which retains a history of all the settings that have been applied to the device. If a policy first defines a security setting and then no longer defines that setting, then the setting takes on the previous value in the database. If a previous value does not exist in the database, then the setting does not revert to anything and remains defined as is. This behavior is sometimes called "tattooing." + Registry and file settings will maintain the values applied through policy until that setting is set to other values. + **Filtering security settings based on group membership** + You can also decide what users or groups will or will not have a Group Policy Object applied to them regardless of what computer they have logged onto by denying them either the Apply Group Policy or Read permission on that Group Policy Object. Both of these permissions are needed to apply Group Policy. + ### Importing and exporting security templates + Security Configuration and Analysis provides the ability to import and export security templates into or from a database. + If you have made any changes to the analysis database, you can save those settings by exporting them into a template. The export feature provides the ability to save the analysis database settings as a new template file. This template file can then be used to analyze or configure a system, or it can be imported to a Group Policy Object. + ### Analyzing security and viewing results + Security Configuration and Analysis performs security analysis by comparing the current state of system security against an *analysis database*. During creation, the analysis database uses at least one security template. If you choose to import more than one security template, the database will merge the various templates and create one composite template. It resolves conflicts in order of import; the last template that is imported takes precedence. + Security Configuration and Analysis displays the analysis results by security area, using visual flags to indicate problems. It displays the current system and base configuration settings for each security attribute in the security areas. To change the analysis database settings, right-click the entry, and then click **Properties**. + @@ -292,18 +377,24 @@ Security Configuration and Analysis displays the analysis results by security ar
        If you choose to accept the current settings, the corresponding value in the base configuration is modified to match them. If you change the system setting to match the base configuration, the change will be reflected when you configure the system with Security Configuration and Analysis. + To avoid continued flagging of settings that you have investigated and determined to be reasonable, you can modify the base configuration. The changes are made to a copy of the template. + ### Resolving security discrepancies + You can resolve discrepancies between analysis database and system settings by: + - Accepting or changing some or all of the values that are flagged or not included in the configuration, if you determine that the local system security levels are valid due to the context (or role) of that computer. These attribute values are then updated in the database and applied to the system when you click **Configure Computer Now**. - Configuring the system to the analysis database values, if you determine the system is not in compliance with valid security levels. - Importing a more appropriate template for the role of that computer into the database as the new base configuration and applying it to the system. Changes to the analysis database are made to the stored template in the database, not to the security template file. The security template file will only be modified if you either return to Security Templates and edit that template or export the stored configuration to the same template file. You should use **Configure Computer Now** only to modify security areas *not* affected by Group Policy settings, such as security on local files and folders, registry keys, and system services. Otherwise, when the Group Policy settings are applied, it will take precedence over local settings—such as account policies. In general, do not use **Configure Computer Now** when you are analyzing security for domain-based clients, since you will have to configure each client individually. In this case, you should return to Security Templates, modify the template, and reapply it to the appropriate Group Policy Object. + ### Automating security configuration tasks + By calling the secedit.exe tool at a command prompt from a batch file or automatic task scheduler, you can use it to automatically create and apply templates, and analyze system security. You can also run it dynamically from a command prompt. Secedit.exe is useful when you have multiple devices on which security must be analyzed or configured, and you need to perform these tasks during off-hours. + ## Working with Group Policy tools + Group Policy is an infrastructure that allows you to specify managed configurations for users and computers through Group Policy settings and Group Policy Preferences. For Group Policy settings that affect only a local device or user, you can use the Local Group Policy Editor. You can manage Group Policy settings and Group Policy Preferences in an Active Directory Domain Services (AD DS) environment through the Group Policy Management Console (GPMC). Group Policy management tools also are included in the Remote Server Administration Tools pack to provide a way for you to administer Group Policy settings from your desktop. -  -  diff --git a/windows/keep-secure/advanced-security-auditing-faq.md b/windows/keep-secure/advanced-security-auditing-faq.md index e41d1389f7..eef52f8d63 100644 --- a/windows/keep-secure/advanced-security-auditing-faq.md +++ b/windows/keep-secure/advanced-security-auditing-faq.md @@ -2,16 +2,20 @@ title: Advanced security auditing FAQ (Windows 10) description: This topic for the IT professional lists questions and answers about understanding, deploying, and managing security audit policies. ms.assetid: 80f8f187-0916-43c2-a7e8-ea712b115a06 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Advanced security auditing FAQ + **Applies to** - Windows 10 + This topic for the IT professional lists questions and answers about understanding, deploying, and managing security audit policies. + - [What is Windows security auditing and why might I want to use it?](#bkmk-1) - [What is the difference between audit policies located in Local Policies\\Audit Policy and audit policies located in Advanced Audit Policy Configuration?](#bkmk-2) - [What is the interaction between basic audit policy settings and advanced audit policy settings?](#bkmk-3) @@ -30,100 +34,118 @@ This topic for the IT professional lists questions and answers about understandi - [What are the best tools to model and manage audit policy?](#bkmk-17) - [Where can I find information about all the possible events that I might receive?](#bkmk-11) - [Where can I find more detailed information?](#bkmk-18) + ## What is Windows security auditing and why might I want to use it? + Security auditing is a methodical examination and review of activities that may affect the security of a system. In the Windows operating systems, security auditing is more narrowly defined as the features and services that enable an administrator to log and review events for specified security-related activities. + Hundreds of events occur as the Windows operating system and the applications that run on it perform their tasks. Monitoring these events can provide valuable information to help administrators troubleshoot and investigate security-related activities. + ## What is the difference between audit policies located in Local Policies\\Audit Policy and audit policies located in Advanced Audit Policy Configuration? + The basic security audit policy settings in **Security Settings\\Local Policies\\Audit Policy** and the advanced security audit policy settings in **Security Settings\\Advanced Audit Policy Configuration\\System Audit Policies** appear to overlap, but they are recorded and applied differently. When you apply basic audit policy settings to the local computer by using the Local Security Policy snap-in (secpol.msc), you are editing the effective audit policy, so changes made to basic audit policy settings will appear exactly as configured in Auditpol.exe. + There are a number of additional differences between the security audit policy settings in these two locations. -There are nine basic audit policy settings under **Security Settings\\Local Policies\\Audit Policy** and settings under **Advanced Audit Policy Configuration**. The settings available in **Security Settings\\Advanced Audit Policy Configuration** address similar issues as the nine basic settings in **Local Policies\\Audit Policy**, but they allow administrators to be more selective in the number and types of events to audit. For example, the basic audit policy provides a single setting for account logon, and the advanced audit policy provides four. Enabling the single basic account logon setting would be the equivalent of setting all four advanced account logon settings. In comparison, setting a single advanced audit policy setting does not generate audit events for activities that you are not interested in tracking. + +There are nine basic audit policy settings under **Security Settings\\Local Policies\\Audit Policy** and settings under **Advanced Audit Policy Configuration**. The settings available in **Security Settings\\Advanced Audit Policy +Configuration** address similar issues as the nine basic settings in **Local Policies\\Audit Policy**, but they allow administrators to be more selective in the number and types of events to audit. For example, the basic audit policy provides a single setting for account logon, and the advanced audit policy provides four. Enabling the single basic account logon setting would be the equivalent of setting all four advanced account logon settings. In comparison, setting a single advanced audit policy setting does not generate audit events for activities that you are not interested in tracking. + In addition, if you enable success auditing for the basic **Audit account logon events** setting, only success events will be logged for all account logon–related behaviors. In comparison, depending on the needs of your organization, you can configure success auditing for one advanced account logon setting, failure auditing for a second advanced account logon setting, success and failure auditing for a third advanced account logon setting, or no auditing. + The nine basic settings under **Security Settings\\Local Policies\\Audit Policy** were introduced in Windows 2000. Therefore, they are available in all versions of Windows released since then. The advanced audit policy settings were introduced in Windows Vista and Windows Server 2008. The advanced settings can only be used on computers running Windows 7, Windows Server 2008, and later. + ## What is the interaction between basic audit policy settings and advanced audit policy settings? + Basic audit policy settings are not compatible with advanced audit policy settings that are applied by using Group Policy. When advanced audit policy settings are applied by using Group Policy, the current computer's audit policy settings are cleared before the resulting advanced audit policy settings are applied. After you apply advanced audit policy settings by using Group Policy, you can only reliably set system audit policy for the computer by using the advanced audit policy settings. + Editing and applying the advanced audit policy settings in Local Security Policy modifies the local Group Policy Object (GPO), so changes made here may not be exactly reflected in Auditpol.exe if there are policies from other domain GPOs or logon scripts. Both types of policies can be edited and applied by using domain GPOs, and these settings will override any conflicting local audit policy settings. However, because the basic audit policy is recorded in the effective audit policy, that audit policy must be explicitly removed when a change is desired, or it will remain in the effective audit policy. Policy changes that are applied by using local or domain Group Policy settings are reflected as soon as the new policy is applied. -**Important**   -Whether you apply advanced audit policies by using Group Policy or by using logon scripts, do not use both the basic audit policy settings under **Local Policies\\Audit Policy** and the advanced settings under **Security Settings\\Advanced Audit Policy Configuration**. Using both advanced and basic audit policy settings can cause unexpected results in audit reporting. + +> **Important**  Whether you apply advanced audit policies by using Group Policy or by using logon scripts, do not use both the basic audit policy settings under **Local Policies\\Audit Policy** and the advanced settings under **Security Settings\\Advanced Audit Policy Configuration**. Using both advanced and basic audit policy settings can cause unexpected results in audit reporting. + If you use Advanced Audit Policy Configuration settings or use logon scripts to apply advanced audit policies, be sure to enable the **Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings** policy setting under **Local Policies\\Security Options**. This will prevent conflicts between similar settings by forcing basic security auditing to be ignored.   ## How are audit settings merged by Group Policy? + By default, policy options that are set in GPOs and linked to higher levels of Active Directory sites, domains, and OUs are inherited by all OUs at lower levels. However, an inherited policy can be overridden by a GPO that is linked at a lower level. + For example, you might use a domain GPO to assign an organization-wide group of audit settings, but want a certain OU to get a defined group of additional settings. To accomplish this, you can link a second GPO to that specific lower-level OU. Therefore, a logon audit setting that is applied at the OU level will override a conflicting logon audit setting that is applied at the domain level (unless you have taken special steps to apply Group Policy loopback processing). + The rules that govern how Group Policy settings are applied propagate to the subcategory level of audit policy settings. This means that audit policy settings configured in different GPOs will be merged if no policy settings configured at a lower level exist. The following table illustrates this behavior. - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Auditing subcategorySetting configured in an OU GPO (higher priority)Setting configured in a domain GPO (lower priority)Resulting policy for the target computer

      Detailed File Share Auditing

      Success

      Failure

      Success

      Process Creation Auditing

      Disabled

      Success

      Disabled

      Logon Auditing

      Success

      Failure

      Failure

      -  + + +| Auditing subcategory | Setting configured in an OU GPO (higher priority) | Setting configured in a domain GPO (lower priority) | Resulting policy for the target computer | +| - | - | - | -| +| Detailed File Share Auditing | Success | Failure | Success | +| Process Creation Auditing | Disabled | Success | Disabled | +| Logon Auditing | Success | Failure | Failure | + ## What is the difference between an object DACL and an object SACL? + All objects in Active Directory Domain Services (AD DS), and all securable objects on a local computer or on the network, have security descriptors to help control access to the objects. Security descriptors include information about who owns an object, who can access it and in what way, and what types of access are audited. Security descriptors contain the access control list (ACL) of an object, which includes all of the security permissions that apply to that object. An object's security descriptor can contain two types of ACLs: + - A discretionary access control list (DACL) that identifies the users and groups who are allowed or denied access - A system access control list (SACL) that controls how access is audited + The access control model that is used in Windows is administered at the object level by setting different levels of access, or permissions, to objects. If permissions are configured for an object, its security descriptor contains a DACL with security identifiers (SIDs) for the users and groups that are allowed or denied access. + If auditing is configured for the object, its security descriptor also contains a SACL that controls how the security subsystem audits attempts to access the object. However, auditing is not completely configured unless a SACL has been configured for an object and a corresponding **Object Access** audit policy setting has been configured and applied. + ## Why are audit policies applied on a per-computer basis rather than per user? + In security auditing in Windows, the computer, objects on the computer, and related resources are the primary recipients of actions by clients including applications, other computers, and users. In a security breach, malicious users can use alternate credentials to hide their identity, or malicious applications can impersonate legitimate users to perform undesired tasks. Therefore, the most consistent way to apply an audit policy is to focus on the computer and the objects and resources on that computer. + In addition, because audit policy capabilities can vary between computers running different versions of Windows, the best way to ensure that the audit policy is applied correctly is to base these settings on the computer instead of the user. + However, in cases where you want audit settings to apply only to specified groups of users, you can accomplish this by configuring SACLs on the relevant objects to enable auditing for a security group that contains only the users you specify. For example, you can configure a SACL for a folder called Payroll Data on Accounting Server 1. This can audit attempts by members of the Payroll Processors OU to delete objects from this folder. The **Object Access\\Audit File System** audit policy setting applies to Accounting Server 1, but because it requires a corresponding resource SACL, only actions by members of the Payroll Processors OU on the Payroll Data folder generates audit events. + ## What are the differences in auditing functionality between versions of Windows? + Basic audit policy settings are available in all versions of Windows since Windows 2000, and they can be applied locally or by using Group Policy. Advanced audit policy settings were introduced in Windows Vista and Windows Server 2008, but the settings can only be applied by using logon scripts in those versions. Advanced audit policy settings, which were introduced in Windows 7 and Windows Server 2008 R2, can be configured and applied by using local and domain Group Policy settings. + ## Can I use advanced audit policies from a domain controller running Windows Server 2003 or Windows 2000 Server? + To use advanced audit policy settings, your domain controller must be installed on a computer running Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows Server 2008, or Windows Server 2003 with Service Pack 2 (SP2). Windows 2000 Server is not supported. + ## What is the difference between success and failure events? Is something wrong if I get a failure audit? + A success audit event is triggered when a defined action, such as accessing a file share, is completed successfully. + A failure audit event is triggered when a defined action, such as a user logon, is not completed successfully. + The appearance of failure audit events in the event log does not necessarily mean that something is wrong with your system. For example, if you configure Audit Logon events, a failure event may simply mean that a user mistyped his or her password. + ## How can I set an audit policy that affects all objects on a computer? + System administrators and auditors increasingly want to verify that an auditing policy is applied to all objects on a system. This has been difficult to accomplish because the system access control lists (SACLs) that govern auditing are applied on a per-object basis. Thus, to verify that an audit policy has been applied to all objects, you would have to check every object to be sure that no changes have been made—even temporarily to a single SACL. Introduced in Windows Server 2008 R2 and Windows 7, security auditing allows administrators to define global object access auditing policies for the entire file system or for the registry on a computer. The specified SACL is then automatically applied to every object of that type. This can be useful for verifying that all critical files, folders, and registry settings on a computer are protected, and for identifying when an issue with a system resource occurs. If a file or folder SACL and a global object access auditing policy (or a single registry setting SACL and a global object access auditing policy) are configured on a computer, the effective SACL is derived from combining the file or folder SACL and the global object access auditing policy. This means that an audit event is generated if an activity matches either the file or folder SACL or the global object access auditing policy. + ## How do I figure out why someone was able to access a resource? + Often it is not enough to know simply that an object such as a file or folder was accessed. You may also want to know why the user was able to access this resource. You can obtain this forensic data by configuring the **Audit Handle Manipulation** setting with the **Audit File System** or with the **Audit Registry** audit setting. + ## How do I know when changes are made to access control settings, by whom, and what the changes were? + To track access control changes on computers running Windows Server 2016 Technical Preview, Windows Server 2012 R2, Windows Server 2012 Windows 7, Windows Server 2008 R2, Windows Vista, or Windows Server 2008, you need to enable the following settings, which track changes to DACLs: - **Audit File System** subcategory: Enable for success, failure, or success and failure - **Audit Authorization Policy Change** setting: Enable for success, failure, or success and failure - A SACL with **Write** and **Take ownership** permissions: Apply to the object that you want to monitor + In Windows XP and Windows Server 2003, you need to use the **Audit policy change** subcategory. + ## How can I roll back security audit policies from the advanced audit policy to the basic audit policy? + Applying advanced audit policy settings replaces any comparable basic security audit policy settings. If you subsequently change the advanced audit policy setting to **Not configured**, you need to complete the following steps to restore the original basic security audit policy settings: + 1. Set all Advanced Audit Policy subcategories to **Not configured**. 2. Delete all audit.csv files from the %SYSVOL% folder on the domain controller. 3. Reconfigure and apply the basic audit policy settings. + Unless you complete all of these steps, the basic audit policy settings will not be restored. + ## How can I monitor if changes are made to audit policy settings? + Changes to security audit policies are critical security events. You can use the **Audit Audit Policy Change** setting to determine if the operating system generates audit events when the following types of activities take place: + - Permissions and audit settings on the audit policy object are changed - The system audit policy is changed - Security event sources are registered or unregistered @@ -131,20 +153,31 @@ Changes to security audit policies are critical security events. You can use the - The value of **CrashOnAuditFail** is modified - Audit settings on a file or registry key are changed - A Special Groups list is changed + ## How can I minimize the number of events that are generated? + Finding the right balance between auditing enough network and computer activity and auditing too little network and computer activity can be challenging. You can achieve this balance by identifying the most important resources, critical activities, and users or groups of users. Then design a security audit policy that targets these resources, activities, and users. Useful guidelines and recommendations for developing an effective security auditing strategy can be found in [Planning and deploying advanced security audit policies](planning-and-deploying-advanced-security-audit-policies.md). + ## What are the best tools to model and manage audit policies? + The integration of advanced audit policy settings with domain Group Policy, introduced in Windows 7 and Windows Server 2008 R2, is designed to simplify the management and implementation of security audit policies in an organization's network. As such, tools used to plan and deploy Group Policy Objects for a domain can also be used to plan and deploy security audit policies. On an individual computer, the Auditpol command-line tool can be used to complete a number of important audit policy–related management tasks. + In addition, there are a number of computer management products, such as the Audit Collection Services in the Microsoft System Center Operations Manager products, which can be used to collect and filter event data. + ## Where can I find information about all the possible events that I might receive? + Users who examine the security event log for the first time can be a bit overwhelmed by the number of audit events that are stored there (which can quickly number in the thousands) and by the structured information that is included for each audit event. Additional information about these events, and the settings used to generate them, can be obtained from the following resources: + - [Windows 8 and Windows Server 2012 Security Event Details](http://www.microsoft.com/download/details.aspx?id=35753) - [Security Audit Events for Windows 7 and Windows Server 2008 R2](http://go.microsoft.com/fwlink/p/?linkid=157780) - [Security Audit Events for Windows Server 2008 and Windows Vista](http://go.microsoft.com/fwlink/p/?linkid=121868) - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + ## Where can I find more detailed information? + To learn more about security audit policies, see the following resources: + - [Planning and deploying advanced security audit policies](planning-and-deploying-advanced-security-audit-policies.md) - [Security Monitoring and Attack Detection Planning Guide](http://social.technet.microsoft.com/wiki/contents/articles/325.advanced-security-auditing-in-windows-7-and-windows-server-2008-r2.aspx) - [Security Audit Events for Windows 7 and Windows Server 2008 R2](http://go.microsoft.com/fwlink/p/?linkid=157780) diff --git a/windows/keep-secure/advanced-security-auditing.md b/windows/keep-secure/advanced-security-auditing.md index b0a362ac4a..5ed85a625d 100644 --- a/windows/keep-secure/advanced-security-auditing.md +++ b/windows/keep-secure/advanced-security-auditing.md @@ -2,48 +2,26 @@ title: Advanced security audit policies (Windows 10) description: Advanced security audit policy settings are found in Security Settings\\Advanced Audit Policy Configuration\\System Audit Policies and appear to overlap with basic security audit policies, but they are recorded and applied differently. ms.assetid: 6FE8AC10-F48E-4BBF-979B-43A5DFDC5DFC -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Advanced security audit policies + **Applies to** - Windows 10 + Advanced security audit policy settings are found in **Security Settings\\Advanced Audit Policy Configuration\\System Audit Policies** and appear to overlap with basic security audit policies, but they are recorded and applied differently. When you apply basic audit policy settings to the local computer by using the Local Security Policy snap-in, you are editing the effective audit policy, so changes made to basic audit policy settings will appear exactly as configured in Auditpol.exe. In Windows 7 and later, advanced security audit policies can be controlled by using Group Policy. + ## In this section - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
      TopicDescription

      [Planning and deploying advanced security audit policies](planning-and-deploying-advanced-security-audit-policies.md)

      This topic for the IT professional explains the options that security policy planners must consider and the tasks they must complete to deploy an effective security audit policy in a network that includes advanced security audit policies.

      [Advanced security auditing FAQ](advanced-security-auditing-faq.md)

      This topic for the IT professional lists questions and answers about understanding, deploying, and managing security audit policies.

      [Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md)

      This guide explains the process of setting up advanced security auditing capabilities that are made possible through settings and events that were introduced in Windows 8 and Windows Server 2012.

      [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)

      This reference for IT professionals provides information about the advanced audit policy settings that are available in Windows and the audit events that they generate.

      -  -  -  + +| Topic | Description | +| - | - | +| [Planning and deploying advanced security audit policies](planning-and-deploying-advanced-security-audit-policies.md) | This topic for the IT professional explains the options that security policy planners must consider and the tasks they must complete to deploy an effective security audit policy in a network that includes advanced security audit policies | +| [Advanced security auditing FAQ](advanced-security-auditing-faq.md) | This topic for the IT professional lists questions and answers about understanding, deploying, and managing security audit policies. +| [Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md) | This guide explains the process of setting up advanced security auditing capabilities that are made possible through settings and events that were introduced in Windows 8 and Windows Server 2012. +| [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) | This reference for IT professionals provides information about the advanced audit policy settings that are available in Windows and the audit events that they generate. diff --git a/windows/keep-secure/allow-log-on-locally.md b/windows/keep-secure/allow-log-on-locally.md index 997c23bdaa..fdfa7ab402 100644 --- a/windows/keep-secure/allow-log-on-locally.md +++ b/windows/keep-secure/allow-log-on-locally.md @@ -2,118 +2,106 @@ title: Allow log on locally (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Allow log on locally security policy setting. ms.assetid: d9e5e1f3-3bff-4da7-a9a2-4bb3e0c79055 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Allow log on locally + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Allow log on locally** security policy setting. + ## Reference + This policy setting determines which users can start an interactive session on the device. Users must have this user right to log on over a Remote Desktop Services session that is running on a Windows-based member device or domain controller. -**Note**   -Users who do not have this right are still able to start a remote interactive session on the device if they have the **Allow logon through Remote Desktop Services** right. +> **Note:**  Users who do not have this right are still able to start a remote interactive session on the device if they have the **Allow logon through Remote Desktop Services** right.   Constant: SeInteractiveLogonRight + ### Possible values + - User-defined list of accounts - Not Defined + By default, the members of the following groups have this right on workstations and servers: + - Administrators - Backup Operators - Users + By default, the members of the following groups have this right on domain controllers: + - Account Operators - Administrators - Backup Operators - Print Operators - Server Operators + ### Best practices + 1. Restrict this user right to legitimate users who must log on to the console of the device. 2. If you selectively remove default groups, you can limit the abilities of users who are assigned to specific administrative roles in your organization. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not Defined

      Default Domain Controller Policy

      Account Operators

      -

      Administrators

      -

      Backup Operators

      -

      Print Operators

      -

      Server Operators

      Stand-Alone Server Default Settings

      Administrators

      -

      Backup Operators

      -

      Users

      Domain Controller Effective Default Settings

      Account Operators

      -

      Administrators

      -

      Backup Operators

      -

      Print Operators

      -

      Server Operators

      Member Server Effective Default Settings

      Administrators

      -

      Backup Operators

      -

      Users

      Client Computer Effective Default Settings

      Administrators

      -

      Backup Operators

      -

      Users

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not Defined | +| Default Domain Controller Policy | Account Operators
      Administrators
      Backup Operators
      Print Operators
      Server Operators | +| Stand-Alone Server Default Settings| Administrators
      Backup Operators
      Users | +| Domain Controller Effective Default Settings | Account Operators
      Administrators
      Backup Operators
      Print Operators
      Server Operators | +| Member Server Effective Default Settings | Administrators
      Backup Operators
      Users | +| Client Computer Effective Default Settings | Administrators
      Backup Operators
      Users |   ## Policy management + Restarting the device is not required to implement this change. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + Modifying this setting might affect compatibility with clients, services, and applications. Use caution when removing service accounts that are used by components and by programs on member devices and on domain controllers in the domain from the default domain controller's policy. Also use caution when removing users or security groups that log on to the console of member devices in the domain, or removing service accounts that are defined in the local Security Accounts Manager (SAM) database of member devices or of workgroup devices. If you want to grant a user account the ability to log on locally to a domain controller, you must make that user a member of a group that already has the **Allowed logon locally** system right or grant the right to that user account. The domain controllers in the domain share the Default Domain Controllers Group Policy Object (GPO). When you grant an account the **Allow logon locally** right, you are allowing that account to log on locally to all domain controllers in the domain. If the Users group is listed in the **Allow log on locally** setting for a GPO, all domain users can log on locally. The Users built-in group contains Domain Users as a member. + ### Group Policy + Group Policy settings are applied through GPOs in the following order, which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Any account with the **Allow log on locally** user right can log on to the console of the device. If you do not restrict this user right to legitimate users who must log on to the console of the computer, unauthorized users could download and run malicious software to elevate their privileges. + ### Countermeasure + For domain controllers, assign the **Allow log on locally** user right only to the Administrators group. For other server roles, you may choose to add Backup Operators in addition to Administrators. For end-user computers, you should also assign this right to the Users group. Alternatively, you can assign groups such as Account Operators, Server Operators, and Guests to the **Deny log on locally** user right. + ### Potential impact + If you remove these default groups, you could limit the abilities of users who are assigned to specific administrative roles in your environment. If you have installed optional components such as ASP.NET or IIS, you may need to assign the **Allow log on locally** user right to additional accounts that are required by those components. IIS requires that this user right be assigned to the IUSR\_*<ComputerName>* account. You should confirm that delegated activities are not adversely affected by any changes that you make to the **Allow log on locally** user rights assignments. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) +- [User Rights Assignment](user-rights-assignment.md)     diff --git a/windows/keep-secure/allow-log-on-through-remote-desktop-services.md b/windows/keep-secure/allow-log-on-through-remote-desktop-services.md index 53a391cc89..cc51c9cbea 100644 --- a/windows/keep-secure/allow-log-on-through-remote-desktop-services.md +++ b/windows/keep-secure/allow-log-on-through-remote-desktop-services.md @@ -2,97 +2,99 @@ title: Allow log on through Remote Desktop Services (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Allow log on through Remote Desktop Services security policy setting. ms.assetid: 6267c376-8199-4f2b-ae56-9c5424e76798 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Allow log on through Remote Desktop Services + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Allow log on through Remote Desktop Services** security policy setting. + ## Reference + This policy setting determines which users or groups can access the logon screen of a remote device through a Remote Desktop Services connection. It is possible for a user to establish a Remote Desktop Services connection to a particular server but not be able to log on to the console of that same server. + Constant: SeRemoteInteractiveLogonRight + ### Possible values + - User-defined list of accounts - Not Defined + ### Best practices + - To control who can open a Remote Desktop Services connection and log on to the device, add users to or remove users from the Remote Desktop Users group. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default, members of the Administrators group have this right on domain controllers, workstations, and servers. The Remote Desktops Users group also has this right on workstations and servers. The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not Defined

      Default Domain Controller Policy

      Administrators

      Stand-Alone Server Default Settings

      Administrators

      -

      Remote Desktop Users

      Domain Controller Effective Default Settings

      Administrators

      Member Server Effective Default Settings

      Administrators

      -

      Remote Desktop Users

      Client Computer Effective Default Settings

      Administrators

      -

      Remote Desktop Users

      -  + + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not Defined | +| Default Domain Controller Policy | Administrators | +| Stand-Alone Server Default Settings | Administrators
      Remote Desktop Users | +| Domain Controller Effective Default Settings | Administrators | +| Member Server Effective Default Settings | Administrators
      Remote Desktop Users | +| Client Computer Effective Default Settings | Administrators
      Remote Desktop Users | + ## Policy management + This section describes different features and tools available to help you manage this policy. + ### Group Policy + To use Remote Desktop Services to successfully log on to a remote device, the user or group must be a member of the Remote Desktop Users or Administrators group and be granted the **Allow log on through Remote Desktop Services** right. It is possible for a user to establish an Remote Desktop Services session to a particular server, but not be able to log on to the console of that same server. + To exclude users or groups, you can assign the **Deny log on through Remote Desktop Services** user right to those users or groups. However, be careful when you use this method because you could create conflicts for legitimate users or groups that have been allowed access through the **Allow log on through Remote Desktop Services** user right. + For more information, see [Deny log on through Remote Desktop Services](deny-log-on-through-remote-desktop-services.md). + A restart of the device is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + Group Policy settings are applied through GPOs in the following order, which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Any account with the **Allow log on through Remote Desktop Services** user right can log on to the remote console of the device. If you do not restrict this user right to legitimate users who must log on to the console of the computer, unauthorized users could download and run malicious software to elevate their privileges. + ### Countermeasure + For domain controllers, assign the **Allow log on through Remote Desktop Services** user right only to the Administrators group. For other server roles and devices, add the Remote Desktop Users group. For servers that have the Remote Desktop (RD) Session Host role service enabled and do not run in Application Server mode, ensure that only authorized IT personnel who must manage the computers remotely belong to these groups. -**Caution**   -For RD Session Host servers that run in Application Server mode, ensure that only users who require access to the server have accounts that belong to the Remote Desktop Users group because this built-in group has this logon right by default. + +> **Caution:**  For RD Session Host servers that run in Application Server mode, ensure that only users who require access to the server have accounts that belong to the Remote Desktop Users group because this built-in group has this logon right by default.   Alternatively, you can assign the **Deny log on through Remote Desktop Services** user right to groups such as Account Operators, Server Operators, and Guests. However, be careful when you use this method because you could block access to legitimate administrators who also belong to a group that has the **Deny log on through Remote Desktop Services** user right. + ### Potential impact + Removal of the **Allow log on through Remote Desktop Services** user right from other groups (or membership changes in these default groups) could limit the abilities of users who perform specific administrative roles in your environment. You should confirm that delegated activities are not adversely affected. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) + +- [User Rights Assignment](user-rights-assignment.md)     diff --git a/windows/keep-secure/applocker-architecture-and-components.md b/windows/keep-secure/applocker-architecture-and-components.md index e91704b0e9..39e8bbf34c 100644 --- a/windows/keep-secure/applocker-architecture-and-components.md +++ b/windows/keep-secure/applocker-architecture-and-components.md @@ -2,25 +2,38 @@ title: AppLocker architecture and components (Windows 10) description: This topic for IT professional describes AppLocker’s basic architecture and its major components. ms.assetid: efdd8494-553c-443f-bd5f-c8976535135a -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # AppLocker architecture and components + **Applies to** - Windows 10 + This topic for IT professional describes AppLocker’s basic architecture and its major components. + AppLocker relies on the Application Identity service to provide attributes for a file and to evaluate the AppLocker policy for the file. AppLocker policies are conditional access control entries (ACEs), and policies are evaluated by using the attribute-based access control **SeAccessCheckWithSecurityAttributes** or **AuthzAccessCheck** functions. + AppLocker provides three ways to intercept and validate if a file is allowed to execute according to an AppLocker policy. + **A new process is created** + When a new process is created, such as an executable file or a Universal Windows app is run, AppLocker invokes the Application Identity component to calculate the attributes of the main executable file used to create a new process. It then updates the new process's token with these attributes and checks the AppLocker policy to verify that the executable file is allowed to run. + **A DLL is loaded** + When a new DLL loads, a notification is sent to AppLocker to verify that the DLL is allowed to load. AppLocker calls the Application Identity component to calculate the file attributes. It duplicates the existing process token and replaces those Application Identity attributes in the duplicated token with attributes of the loaded DLL. AppLocker then evaluates the policy for this DLL, and the duplicated token is discarded. Depending on the result of this check, the system either continues to load the DLL or stops the process. + **A script is run** + Before a script file is run, the script host (for example. for .ps1 files the script host is PowerShell) invokes AppLocker to verify the script. AppLocker invokes the Application Identity component in user-mode with the file name or file handle to calculate the file properties. The script file then is evaluated against the AppLocker policy to verify that it is allowed to run. In each case, the actions taken by AppLocker are written to the event log. + ## Related topics -[AppLocker technical reference](applocker-technical-reference.md) + +- [AppLocker technical reference](applocker-technical-reference.md)     diff --git a/windows/keep-secure/applocker-functions.md b/windows/keep-secure/applocker-functions.md index 38ca82ba69..d3ab5362dd 100644 --- a/windows/keep-secure/applocker-functions.md +++ b/windows/keep-secure/applocker-functions.md @@ -2,18 +2,24 @@ title: AppLocker functions (Windows 10) description: This topic for the IT professional lists the functions and security levels for the Software Restriction Policies (SRP) and AppLocker features. ms.assetid: bf704198-9e74-4731-8c5a-ee0512df34d2 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # AppLocker functions + **Applies to** - Windows 10 + This topic for the IT professional lists the functions and security levels for the Software Restriction Policies (SRP) and AppLocker features. + ## Functions + The following list includes the SRP functions beginning with Windows Server 2003 and AppLocker functions beginning with Windows Server 2008 R2 and links to current documentation on MSDN: + - [SaferGetPolicyInformation Function](http://go.microsoft.com/fwlink/p/?LinkId=159781) - [SaferCreateLevel Function](http://go.microsoft.com/fwlink/p/?LinkId=159782) - [SaferCloseLevel Function](http://go.microsoft.com/fwlink/p/?LinkId=159783) @@ -22,52 +28,23 @@ The following list includes the SRP functions beginning with Windows Server 200 - [SaferGetLevelInformation Function](http://go.microsoft.com/fwlink/p/?LinkId=159787) - [SaferRecordEventLogEntry Function](http://go.microsoft.com/fwlink/p/?LinkId=159789) - [SaferiIsExecutableFileType Function](http://go.microsoft.com/fwlink/p/?LinkId=159790) + ## Security level ID + AppLocker and SRP use the security level IDs to stipulate the access requirements to files listed in policies. The following table shows those security levels supported in SRP and AppLocker. - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Security level IDSRPAppLocker

      SAFER_LEVELID_FULLYTRUSTED

      Supported

      Supported

      SAFER_LEVELID_NORMALUSER

      Supported

      Not supported

      SAFER_LEVELID_CONSTRAINED

      Supported

      Not supported

      SAFER_LEVELID_UNTRUSTED

      Supported

      Not supported

      SAFER_LEVELID_DISALLOWED

      Supported

      Supported

      + +| Security level ID | SRP | AppLocker | +| - | - | - | +| SAFER_LEVELID_FULLYTRUSTED | Supported | Supported | +| SAFER_LEVELID_NORMALUSER | Supported | Not supported | +| SAFER_LEVELID_CONSTRAINED | Supported | Not supported | +| SAFER_LEVELID_UNTRUSTED | Supported | Not supported | +| SAFER_LEVELID_DISALLOWED | Supported | Supported |   In addition, URL zone ID is not supported in AppLocker. + ## Related topics -[AppLocker technical reference](applocker-technical-reference.md) + +- [AppLocker technical reference](applocker-technical-reference.md)     diff --git a/windows/keep-secure/applocker-overview.md b/windows/keep-secure/applocker-overview.md index 27ac2175a6..6918af6f1e 100644 --- a/windows/keep-secure/applocker-overview.md +++ b/windows/keep-secure/applocker-overview.md @@ -2,42 +2,66 @@ title: AppLocker (Windows 10) description: This topic provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. ms.assetid: 94b57864-2112-43b6-96fb-2863c985dc9a -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # AppLocker + **Applies to** - Windows 10 + This topic provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. AppLocker helps you control which apps and files users can run. These include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers. + AppLocker can help you: + - Define rules based on file attributes that persist across app updates, such as the publisher name (derived from the digital signature), product name, file name, and file version. You can also create rules based on the file path and hash. - Assign a rule to a security group or an individual user. - Create exceptions to rules. For example, you can create a rule that allows all users to run all Windows binaries, except the Registry Editor (regedit.exe). - Use audit-only mode to deploy the policy and understand its impact before enforcing it. - Create rules on a staging server, test them, then export them to your production environment and import them into a Group Policy Object. - Simplify creating and managing AppLocker rules by using Windows PowerShell. + AppLocker helps reduce administrative overhead and helps reduce the organization's cost of managing computing resources by decreasing the number of Help Desk calls that result from users running unapproved apps. AppLocker addresses the following app security scenarios: + - **Application inventory** + AppLocker has the ability to enforce its policy in an audit-only mode where all app access activity is registered in event logs. These events can be collected for further analysis. Windows PowerShell cmdlets also help you analyze this data programmatically. + - **Protection against unwanted software** + AppLocker has the ability to deny apps from running when you exclude them from the list of allowed apps. When AppLocker rules are enforced in the production environment, any apps that are not included in the allowed rules are blocked from running. + - **Licensing conformance** + AppLocker can help you create rules that preclude unlicensed software from running and restrict licensed software to authorized users. + - **Software standardization** + AppLocker policies can be configured to allow only supported or approved apps to run on computers within a business group. This permits a more uniform app deployment. + - **Manageability improvement** + AppLocker includes a number of improvements in manageability as compared to its predecessor Software Restriction Policies. Importing and exporting policies, automatic generation of rules from multiple files, audit-only mode deployment, and Windows PowerShell cmdlets are a few of the improvements over Software Restriction Policies. + ## New and changed functionality + To find out what's new in AppLocker for Windows 10, see [What's new in AppLocker?](../whats-new/applocker.md) + ## When to use AppLocker + In many organizations, information is the most valuable asset, and ensuring that only approved users have access to that information is imperative. Access control technologies, such as Active Directory Rights Management Services (AD RMS) and access control lists (ACLs), help control what users are allowed to access. + However, when a user runs a process, that process has the same level of access to data that the user has. As a result, sensitive information could easily be deleted or transmitted out of the organization if a user knowingly or unknowingly runs malicious software. AppLocker can help mitigate these types of security breaches by restricting the files that users or groups are allowed to run. Software publishers are beginning to create more apps that can be installed by non-administrative users. This could jeopardize an organization's written security policy and circumvent traditional app control solutions that rely on the inability of users to install apps. By creating an allowed list of approved files and apps, AppLocker helps prevent such per-user apps from running. Because AppLocker can control DLLs, it is also useful to control who can install and run ActiveX controls. + AppLocker is ideal for organizations that currently use Group Policy to manage their PCs. + The following are examples of scenarios in which AppLocker can be used: + - Your organization's security policy dictates the use of only licensed software, so you need to prevent users from running unlicensed software and also restrict the use of licensed software to authorized users. - An app is no longer supported by your organization, so you need to prevent it from being used by everyone. - The potential that unwanted software can be introduced in your environment is high, so you need to reduce this threat. @@ -47,116 +71,67 @@ The following are examples of scenarios in which AppLocker can be used: - A single user or small group of users needs to use a specific app that is denied for all others. - Some computers in your organization are shared by people who have different software usage needs, and you need to protect specific apps. - In addition to other measures, you need to control the access to sensitive data through app usage. + AppLocker can help you protect the digital assets within your organization, reduce the threat of malicious software being introduced into your environment, and improve the management of application control and the maintenance of application control policies. + ## System requirements + AppLocker policies can only be configured on and applied to computers that are running on the supported versions and editions of the Windows operating system. Group Policy is required to distribute Group Policy Objects that contain AppLocker policies. For more info, see [Requirements to Use AppLocker](requirements-to-use-applocker.md). + AppLocker rules can be created on domain controllers. + ## Installing AppLocker + AppLocker is included with enterprise-level editions of Windows. You can author AppLocker rules for a single computer or for a group of computers. For a single computer, you can author the rules by using the Local Security Policy editor (secpol.msc). For a group of computers, you can author the rules within a Group Policy Object by using the Group Policy Management Console (GPMC). -**Note**   -The GPMC is available in client computers running Windows only by installing the Remote Server Administration Tools. On computer running Windows Server, you must install the Group Policy Management feature. + +> **Note:**  The GPMC is available in client computers running Windows only by installing the Remote Server Administration Tools. On computer running Windows Server, you must install the Group Policy Management feature.   ### Using AppLocker on Server Core + AppLocker on Server Core installations is not supported. + ### Virtualization considerations + You can administer AppLocker policies by using a virtualized instance of Windows provided it meets all the system requirements listed previously. You can also run Group Policy in a virtualized instance. However, you do risk losing the policies that you created and maintain if the virtualized instance is removed or fails. + ### Security considerations + Application control policies specify which apps are allowed to run on the local computer. + The variety of forms that malicious software can take make it difficult for users to know what is safe to run. When activated, malicious software can damage content on a hard disk drive, flood a network with requests to cause a denial-of-service (DoS) attack, send confidential information to the Internet, or compromise the security of a computer. + The countermeasure is to create a sound design for your application control policies on PCs in your organization, and then thoroughly test the policies in a lab environment before you deploy them in a production environment. AppLocker can be part of your app control strategy because you can control what software is allowed to run on your computers. + A flawed application control policy implementation can disable necessary applications or allow malicious or unintended software to run. Therefore, it is important that organizations dedicate sufficient resources to manage and troubleshoot the implementation of such policies. + For additional information about specific security issues, see [Security considerations for AppLocker](security-considerations-for-applocker.md). + When you use AppLocker to create application control policies, you should be aware of the following security considerations: + - Who has the rights to set AppLocker policies? - How do you validate that the policies are enforced? - What events should you audit? + For reference in your security planning, the following table identifies the baseline settings for a PC with AppLocker installed: - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      SettingDefault value

      Accounts created

      None

      Authentication method

      Not applicable

      Management interfaces

      AppLocker can be managed by using a Microsoft Management Console snap-in, Group Policy Management, and Windows PowerShell

      Ports opened

      None

      Minimum privileges required

      Administrator on the local computer; Domain Admin, or any set of rights that allow you to create, edit and distribute Group Policy Objects.

      Protocols used

      Not applicable

      Scheduled Tasks

      Appidpolicyconverter.exe is put in a scheduled task to be run on demand.

      Security Policies

      None required. AppLocker creates security policies.

      System Services required

      Application Identity service (appidsvc) runs under LocalServiceAndNoImpersonation.

      Storage of credentials

      None

      + +| Setting | Default value | +| - | - | +| Accounts created | None | +| Authentication method | Not applicable | +| Management interfaces | AppLocker can be managed by using a Microsoft Management Console snap-in, Group Policy Management, and Windows PowerShell | +| Ports opened | None | +| Minimum privileges required | Administrator on the local computer; Domain Admin, or any set of rights that allow you to create, edit and distribute Group Policy Objects. | +| Protocols used | Not applicable | +| Scheduled Tasks | Appidpolicyconverter.exe is put in a scheduled task to be run on demand. | +| Security Policies | None required. AppLocker creates security policies. | +| System Services required |Application Identity service (appidsvc) runs under LocalServiceAndNoImpersonation. | +| Storage of credentials | None |   ## In this section - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
      TopicDescription

      [Administer AppLocker](administer-applocker.md)

      This topic for IT professionals provides links to specific procedures to use when administering AppLocker policies.

      [AppLocker design guide](applocker-policies-design-guide.md)

      This topic for the IT professional introduces the design and planning steps required to deploy application control policies by using AppLocker.

      [AppLocker deployment guide](applocker-policies-deployment-guide.md)

      This topic for IT professionals introduces the concepts and describes the steps required to deploy AppLocker policies.

      [AppLocker technical reference](applocker-technical-reference.md)

      This overview topic for IT professionals provides links to the topics in the technical reference.

      -  -  -  + +| Topic | Description | +| - | - | +| [Administer AppLocker](administer-applocker.md) | This topic for IT professionals provides links to specific procedures to use when administering AppLocker policies. | +| [AppLocker design guide](applocker-policies-design-guide.md) | This topic for the IT professional introduces the design and planning steps required to deploy application control policies by using AppLocker. | +| [AppLocker deployment guide](applocker-policies-deployment-guide.md) | This topic for IT professionals introduces the concepts and describes the steps required to deploy AppLocker policies. | +| [AppLocker technical reference](applocker-technical-reference.md) | This overview topic for IT professionals provides links to the topics in the technical reference. | diff --git a/windows/keep-secure/applocker-policies-deployment-guide.md b/windows/keep-secure/applocker-policies-deployment-guide.md index b9f0050193..f0bce74c2a 100644 --- a/windows/keep-secure/applocker-policies-deployment-guide.md +++ b/windows/keep-secure/applocker-policies-deployment-guide.md @@ -2,20 +2,29 @@ title: AppLocker deployment guide (Windows 10) description: This topic for IT professionals introduces the concepts and describes the steps required to deploy AppLocker policies. ms.assetid: 38632795-be13-46b0-a7af-487a4340bea1 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + + # AppLocker deployment guide + **Applies to** - Windows 10 + This topic for IT professionals introduces the concepts and describes the steps required to deploy AppLocker policies. + This guide provides steps based on your design and planning investigation for deploying application control policies by using AppLocker. It is intended for security architects, security administrators, and system administrators. Through a sequential and iterative deployment process, you can create application control policies, test and adjust the policies, and implement a method for maintaining those policies as the needs in your organization change. + This guide covers the use of Software Restriction Policies (SRP) in conjunction with AppLocker policies to control application usage. For a comparison of SRP and AppLocker, see [Using Software Restriction Policies and AppLocker policies](using-software-restriction-policies-and-applocker-policies.md) in this guide. To understand if AppLocker is the correct application control solution for you, see [Understand AppLocker policy design decisions](understand-applocker-policy-design-decisions.md). + ## Prerequisites to deploying AppLocker policies + The following are prerequisites or recommendations to deploying policies: + - Understand the capabilities of AppLocker: - [AppLocker](applocker-overview.md) - Document your application control policy deployment plan by addressing these tasks: @@ -27,43 +36,18 @@ The following are prerequisites or recommendations to deploying policies: - [Determine Group Policy Structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md) - [Plan for AppLocker policy management](plan-for-applocker-policy-management.md) - [Create your AppLocker planning document](create-your-applocker-planning-document.md) + ## Contents of this guide + This guide provides steps based on your design and planning investigation for deploying application control policies created and maintained by AppLocker for computers running any of the supported versions of Windows listed in [Requirements to use AppLocker](requirements-to-use-applocker.md). + ## In this section - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      TopicDescription

      [Understand the AppLocker policy deployment process](understand-the-applocker-policy-deployment-process.md)

      This planning and deployment topic for the IT professional describes the process for using AppLocker when deploying application control policies.

      [Requirements for Deploying AppLocker Policies](requirements-for-deploying-applocker-policies.md)

      This deployment topic for the IT professional lists the requirements that you need to consider before you deploy AppLocker policies.

      [Use Software Restriction Policies and AppLocker policies](using-software-restriction-policies-and-applocker-policies.md)

      This topic for the IT professional describes how to use Software Restriction Policies (SRP) and AppLocker policies in the same Windows deployment.

      [Create Your AppLocker policies](create-your-applocker-policies.md)

      This overview topic for the IT professional describes the steps to create an AppLocker policy and prepare it for deployment.

      [Deploy the AppLocker policy into production](deploy-the-applocker-policy-into-production.md)

      This topic for the IT professional describes the tasks that should be completed before you deploy AppLocker application control settings.

      -  -  -  + +| Topic | Description | +| - | - | +| [Understand the AppLocker policy deployment process](understand-the-applocker-policy-deployment-process.md) | This planning and deployment topic for the IT professional describes the process for using AppLocker when deploying application control policies. | +| [Requirements for Deploying AppLocker Policies](requirements-for-deploying-applocker-policies.md) | This deployment topic for the IT professional lists the requirements that you need to consider before you deploy AppLocker policies. | +| [Use Software Restriction Policies and AppLocker policies](using-software-restriction-policies-and-applocker-policies.md) | This topic for the IT professional describes how to use Software Restriction Policies (SRP) and AppLocker policies in the same Windows deployment. | +| [Create Your AppLocker policies](create-your-applocker-policies.md) | This overview topic for the IT professional describes the steps to create an AppLocker policy and prepare it for deployment. | +| [Deploy the AppLocker policy into production](deploy-the-applocker-policy-into-production.md) | This topic for the IT professional describes the tasks that should be completed before you deploy AppLocker application control settings. | + diff --git a/windows/keep-secure/applocker-policies-design-guide.md b/windows/keep-secure/applocker-policies-design-guide.md index b36e9be24e..7954db3edb 100644 --- a/windows/keep-secure/applocker-policies-design-guide.md +++ b/windows/keep-secure/applocker-policies-design-guide.md @@ -2,63 +2,36 @@ title: AppLocker design guide (Windows 10) description: This topic for the IT professional introduces the design and planning steps required to deploy application control policies by using AppLocker. ms.assetid: 1c8e4a7b-3164-4eb4-9277-11b1d5a09c7b -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # AppLocker design guide + **Applies to** - Windows 10 + This topic for the IT professional introduces the design and planning steps required to deploy application control policies by using AppLocker. + This guide provides important designing and planning information for deploying application control policies by using AppLocker. It is intended for security architects, security administrators, and system administrators. Through a sequential and iterative process, you can create an AppLocker policy deployment plan for your organization that will address your specific application control requirements by department, organizational unit, or business group. + This guide does not cover the deployment of application control policies by using Software Restriction Policies (SRP). However, SRP is discussed as a deployment option in conjunction with AppLocker policies. For info about these options, see [Determine your application control objectives](determine-your-application-control-objectives.md). + To understand if AppLocker is the correct application control solution for your organization, see [Understand AppLocker policy design decisions](understand-applocker-policy-design-decisions.md). ## In this section - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      TopicDescription

      [Understand AppLocker policy design decisions](understand-applocker-policy-design-decisions.md)

      This topic for the IT professional lists the design questions, possible answers, and ramifications of the decisions when you plan a deployment of application control policies by using AppLocker within a Windows operating system environment.

      [Determine your application control objectives](determine-your-application-control-objectives.md)

      This topic helps you with the decisions you need to make to determine what applications to control and how to control them by comparing Software Restriction Policies (SRP) and AppLocker.

      [Create a list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md)

      This topic describes the process of gathering app usage requirements from each business group in order to implement application control policies by using AppLocker.

      [Select the types of rules to create](select-types-of-rules-to-create.md)

      This topic lists resources you can use when selecting your application control policy rules by using AppLocker.

      [Determine the Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md)

      This overview topic describes the process to follow when you are planning to deploy AppLocker rules.

      [Plan for AppLocker policy management](plan-for-applocker-policy-management.md)

      This topic for describes the decisions you need to make to establish the processes for managing and maintaining AppLocker policies.

      [Create your AppLocker planning document](create-your-applocker-planning-document.md)

      This planning topic for the IT professional summarizes the information you need to research and include in your AppLocker planning document.

      + +| Topic | Description | +| - | - | +| [Understand AppLocker policy design decisions](understand-applocker-policy-design-decisions.md) | This topic for the IT professional lists the design questions, possible answers, and ramifications of the decisions when you plan a deployment of application control policies by using AppLocker within a Windows operating system environment. | +| [Determine your application control objectives](determine-your-application-control-objectives.md) | This topic helps you with the decisions you need to make to determine what applications to control and how to control them by comparing Software Restriction Policies (SRP) and AppLocker. | +| [Create a list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md) | This topic describes the process of gathering app usage requirements from each business group in order to implement application control policies by using AppLocker. | +| [Select the types of rules to create](select-types-of-rules-to-create.md) | This topic lists resources you can use when selecting your application control policy rules by using AppLocker. | +| [Determine the Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md) | This overview topic describes the process to follow when you are planning to deploy AppLocker rules. | +| [Plan for AppLocker policy management](plan-for-applocker-policy-management.md) | This topic for describes the decisions you need to make to establish the processes for managing and maintaining AppLocker policies. | +| [Create your AppLocker planning document](create-your-applocker-planning-document.md) | This planning topic for the IT professional summarizes the information you need to research and include in your AppLocker planning document. |   After careful design and detailed planning, the next step is to deploy AppLocker policies. [AppLocker Deployment Guide](applocker-policies-deployment-guide.md) covers the creation and testing of policies, deploying the enforcement setting, and managing and maintaining the policies. -  -  +  \ No newline at end of file diff --git a/windows/keep-secure/applocker-policy-use-scenarios.md b/windows/keep-secure/applocker-policy-use-scenarios.md index 3c538ffbf1..ce30809f52 100644 --- a/windows/keep-secure/applocker-policy-use-scenarios.md +++ b/windows/keep-secure/applocker-policy-use-scenarios.md @@ -2,29 +2,47 @@ title: AppLocker policy use scenarios (Windows 10) description: This topic for the IT professional lists the various application control scenarios in which AppLocker policies can be effectively implemented. ms.assetid: 33f71578-89f0-4063-ac04-cf4f4ca5c31f -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # AppLocker policy use scenarios + **Applies to** - Windows 10 + This topic for the IT professional lists the various application control scenarios in which AppLocker policies can be effectively implemented. + AppLocker can help you improve the management of application control and the maintenance of application control policies. Application control scenarios addressed by AppLocker can be categorized as follows: + 1. **App inventory** + AppLocker has the ability to enforce its policy in an audit-only mode where all app access activity is collected in event logs for further analysis. Windows PowerShell cmdlets are also available to help you understand app usage and access. + 2. **Protection against unwanted software** + AppLocker has the ability to deny apps from running simply by excluding them from the list of allowed apps per business group or user. If an app is not specifically identified by its publisher, installation path, or file hash, the attempt to run the application fails. + 3. **Licensing conformance** + AppLocker can provide an inventory of software usage within your organization, so you can identify the software that corresponds to your software licensing agreements and restrict application usage based on licensing agreements. + 4. **Software standardization** + AppLocker policies can be configured to allow only supported or approved apps to run on computers within a business group. This permits a more uniform app deployment. + 5. **Manageability improvement** - AppLocker policies can be modified and deployed through your existing Group Policy infrastructure and can work in conjunction with policies created by using Software Restriction Policies. As you manage ongoing change in your support of a business group's apps, you can modify policies and use the AppLocker cmdlets to test the policies for the expected results. You can also design application control policies for situations in which users share computers. + + AppLocker policies can be modified and deployed through your existing Group Policy infrastructure and can work in conjunction with policies created by using Software Restriction Policies. As you manage ongoing change in your support of a business group's apps, you can modify policies and use + the AppLocker cmdlets to test the policies for the expected results. You can also design application control policies for situations in which users share computers. + ### Use scenarios + The following are examples of scenarios in which AppLocker can be used: + - Your organization implements a policy to standardize the applications used within each business group, so you need to determine the expected usage compared to the actual usage. - The security policy for application usage has changed, and you need to evaluate where and when those deployed apps are being accessed. - Your organization's security policy dictates the use of only licensed software, so you need to determine which apps are not licensed or prevent unauthorized users from running licensed software. @@ -37,7 +55,8 @@ The following are examples of scenarios in which AppLocker can be used: - A single user or small group of users needs to use a specific app that is denied for all others. - Some computers in your organization are shared by people who have different software usage needs. - In addition to other measures, you need to control the access to sensitive data through app usage. + ## Related topics -[AppLocker technical reference](applocker-technical-reference.md) +- [AppLocker technical reference](applocker-technical-reference.md)     diff --git a/windows/keep-secure/applocker-processes-and-interactions.md b/windows/keep-secure/applocker-processes-and-interactions.md index 19857f7670..0243055da8 100644 --- a/windows/keep-secure/applocker-processes-and-interactions.md +++ b/windows/keep-secure/applocker-processes-and-interactions.md @@ -2,64 +2,97 @@ title: AppLocker processes and interactions (Windows 10) description: This topic for the IT professional describes the process dependencies and interactions when AppLocker evaluates and enforces rules. ms.assetid: 0beec616-6040-4be7-8703-b6c919755d8e -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # AppLocker processes and interactions + **Applies to** - Windows 10 + This topic for the IT professional describes the process dependencies and interactions when AppLocker evaluates and enforces rules. + ## How policies are implemented by AppLocker + AppLocker policies are collections of AppLocker rules that might contain any one of the enforcement settings configured. When applied, each rule is evaluated within the policy and the collection of rules is applied according to the enforcement setting and according to your Group Policy structure. + The AppLocker policy is enforced on a computer through the Application Identity service, which is the engine that evaluates the policies. If the service is not running, policies will not be enforced. The Application Identity service returns the information from the binary—even if product or binary names are empty—to the results pane of the Local Security Policy snap-in. + AppLocker policies are stored in a security descriptor format according to Application Identity service requirements. It uses file path, hash, or fully qualified binary name attributes to form allow or deny actions on a rule. Each rule is stored as an access control entry (ACE) in the security descriptor and contains the following information: + - Either an allow or a deny ACE ("XA" or "XD" in security descriptor definition language (SDDL) form). - The user security identifier (SID) that this rule is applicable to. (The default is the authenticated user SID, or "AU" in SDDL.) - The rule condition containing the **appid** attributes. + For example, an SDDL for a rule that allows all files in the %windir% directory to run uses the following format: XA;;FX;;;AU;(APPID://PATH == "%windir%\\\*"). + An AppLocker policy for DLLs and executable files is read and cached by kernel mode code, which is part of appid.sys. Whenever a new policy is applied, appid.sys is notified by a policy converter task. For other file types, the AppLocker policy is read every time a **SaferIdentifyLevel** call is made. + ### Understanding AppLocker rules + An AppLocker rule is a control placed on a file to govern whether or not it is allowed to run for a specific user or group. Rules apply to five different types, or collections, of files: + - An executable rule controls whether a user or group can run an executable file. Executable files most often have the .exe or .com file name extensions and apply to applications. - A script rule controls whether a user or group can run scripts with a file name extension of .ps1, .bat, .cmd, .vbs, and .js. - A Windows Installer rule controls whether a user or group can run files with a file name extension of .msi, mst and .msp (Windows Installer patch). - A DLL rule controls whether a user or group can run files with a file name extension of .dll and .ocx. - A packaged app and packaged app installer rule controls whether a user or group can run or install a packaged app. A Packaged app installer has the .appx extension. + There are three different types of conditions that can be applied to rules: + - A publisher condition on a rule controls whether a user or group can run files from a specific software publisher. The file must be signed. - A path condition on a rule controls whether a user or group can run files from within a specific directory or its subdirectories. - A file hash condition on a rule controls whether a user or group can run files with matching encrypted hashes. - + - [Understanding AppLocker rule collections](understanding-applocker-rule-collections.md) + An AppLocker rule collection is a set of rules that apply to one of the following types: executable files, Windows Installer files, scripts, DLLs, and packaged apps. + - [Understanding AppLocker rule condition types](understanding-applocker-rule-condition-types.md) + Rule conditions are criteria that the AppLocker rule is based on. Primary conditions are required to create an AppLocker rule. The three primary rule conditions are publisher, path, and file hash. + - [Understanding the publisher rule condition in AppLocker](understanding-the-publisher-rule-condition-in-applocker.md) - [Understanding the path rule condition in AppLocker](understanding-the-path-rule-condition-in-applocker.md) - [Understanding the file hash rule condition in AppLocker](understanding-the-file-hash-rule-condition-in-applocker.md) - [Understanding AppLocker default rules](understanding-applocker-default-rules.md) + AppLocker includes default rules for each rule collection. These rules are intended to help ensure that the files that are required for Windows to operate properly are allowed in an AppLocker rule collection. + - [Executable rules in AppLocker](executable-rules-in-applocker.md) - [Windows Installer rules in AppLocker](windows-installer-rules-in-applocker.md) - [Script rules in AppLocker](script-rules-in-applocker.md) - [DLL rules in AppLocker](dll-rules-in-applocker.md) - [Packaged apps and packaged app installer rules in AppLocker](packaged-apps-and-packaged-app-installer-rules-in-applocker.md) - [Understanding AppLocker rule exceptions](understanding-applocker-rule-exceptions.md) + You can apply AppLocker rules to individual users or a group of users. If you apply a rule to a group of users, all users in that group are affected by that rule. If you need to allow only a subset of a user group to use an application, you can create a special rule for that subset. + - [Understanding AppLocker rule behavior](understanding-applocker-rule-behavior.md) and [Understanding AppLocker allow and deny actions on Rules](understanding-applocker-allow-and-deny-actions-on-rules.md) + Each AppLocker rule collection functions as an allowed list of files. + ### Understanding AppLocker policies + An AppLocker policy is a set of rule collections and their corresponding configured enforcement settings that have been applied to one or more computers. + - [Understand AppLocker enforcement settings](understand-applocker-enforcement-settings.md) + Rule enforcement is applied only to collections of rules, not individual rules. AppLocker divides the rules into four collections: executable files, Windows Installer files, scripts, and DLL files. The options for rule enforcement are **Not configured**, **Enforce rules**, or **Audit only**. Together, all AppLocker rule collections compose the application control policy, or AppLocker policy. By default, if enforcement is not configured and rules are present in a rule collection, those rules are enforced. + ### Understanding AppLocker and Group Policy + Group Policy can be used to create, modify, and distribute AppLocker policies in separate objects or in combination with other policies. + - [Understand AppLocker rules and enforcement setting inheritance in Group Policy](understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md) - When Group Policy is used to distribute AppLocker policies, rule collections that are not configured will be enforced. Group Policy does not overwrite or replace rules that are already present in a linked Group Policy Object (GPO) and applies the AppLocker rules in addition to existing rules. AppLocker processes the explicit deny rule configuration before the allow rule configuration, and for rule enforcement, the last write to the GPO is applied. + + When Group Policy is used to distribute AppLocker policies, rule collections that are not configured will be enforced. Group Policy does not overwrite or replace rules that are already present in a linked Group Policy Object (GPO) and applies the AppLocker rules in addition to existing rules. + AppLocker processes the explicit deny rule configuration before the allow rule configuration, and for rule enforcement, the last write to the GPO is applied. + ## Related topics -[AppLocker technical reference](applocker-technical-reference.md) -  -  + +- [AppLocker technical reference](applocker-technical-reference.md) diff --git a/windows/keep-secure/applocker-settings.md b/windows/keep-secure/applocker-settings.md index 527922ad1c..77509f8e43 100644 --- a/windows/keep-secure/applocker-settings.md +++ b/windows/keep-secure/applocker-settings.md @@ -2,61 +2,32 @@ title: AppLocker settings (Windows 10) description: This topic for the IT professional lists the settings used by AppLocker. ms.assetid: 9cb4aa19-77c0-4415-9968-bd07dab86839 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # AppLocker settings + **Applies to** - Windows 10 + This topic for the IT professional lists the settings used by AppLocker. + The following table describes the settings and values used by AppLocker. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      SettingValue

      Registry path

      Policies are stored in \HKEY_LOCAL_Machine\Software\Policies\Microsoft\Windows\SrpV2

      Firewall ports

      Not applicable

      Security policies

      Custom created, no default

      Group Policy settings

      Custom created, no default

      Network ports

      Not applicable

      Service accounts

      Not applicable

      Performance counters

      Not applicable

      + +| Setting | Value | +| - | - | +| Registry path | Policies are stored in **HKEY_LOCAL_Machine\Software\Policies\Microsoft\Windows\SrpV2** | +| Firewall ports | Not applicable | +| Security policies | Custom created, no default | +| Group Policy settings | Custom created, no default | +| Network ports | Not applicable | +| Service accounts | Not applicable | +| Performance counters | Not applicable |   ## Related topics -[AppLocker technical reference](applocker-technical-reference.md) -  -  + +- [AppLocker technical reference](applocker-technical-reference.md) diff --git a/windows/keep-secure/applocker-technical-reference.md b/windows/keep-secure/applocker-technical-reference.md index 415b5baa88..164a159782 100644 --- a/windows/keep-secure/applocker-technical-reference.md +++ b/windows/keep-secure/applocker-technical-reference.md @@ -2,72 +2,32 @@ title: AppLocker technical reference (Windows 10) description: This overview topic for IT professionals provides links to the topics in the technical reference. ms.assetid: 2b2678f8-c46b-4e1d-b8c5-037c0be255ab -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # AppLocker technical reference + **Applies to** - Windows 10 + This overview topic for IT professionals provides links to the topics in the technical reference. AppLocker advances the application control features and functionality of Software Restriction Policies. AppLocker contains new capabilities and extensions that allow you to create rules to allow or deny apps from running based on unique identities of files and to specify which users or groups can run those apps. + ## In this section - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      TopicDescription

      [What Is AppLocker?](what-is-applocker.md)

      This topic for the IT professional describes what AppLocker is and how its features differ from Software Restriction Policies.

      [Requirements to use AppLocker](requirements-to-use-applocker.md)

      This topic for the IT professional lists software requirements to use AppLocker on the supported Windows operating systems.

      [AppLocker policy use scenarios](applocker-policy-use-scenarios.md)

      This topic for the IT professional lists the various application control scenarios in which AppLocker policies can be effectively implemented.

      [How AppLocker works](how-applocker-works-techref.md)

      This topic for the IT professional provides links to topics about AppLocker architecture and components, processes and interactions, rules and policies.

      [AppLocker architecture and components](applocker-architecture-and-components.md)

      This topic for IT professional describes AppLocker’s basic architecture and its major components.

      [AppLocker processes and interactions](applocker-processes-and-interactions.md)

      This topic for the IT professional describes the process dependencies and interactions when AppLocker evaluates and enforces rules.

      [AppLocker functions](applocker-functions.md)

      This topic for the IT professional lists the functions and security levels for the Software Restriction Policies (SRP) and AppLocker features.

      [Security considerations for AppLocker](security-considerations-for-applocker.md)

      This topic for the IT professional describes the security considerations you need to address when implementing AppLocker.

      [Tools to Use with AppLocker](tools-to-use-with-applocker.md)

      This topic for the IT professional describes the tools available to create and administer AppLocker policies.

      [AppLocker Settings](applocker-settings.md)

      This topic for the IT professional lists the settings used by AppLocker.

      -  -  -  + +| Topic | Description | +| - | - | +| [What Is AppLocker?](what-is-applocker.md) | This topic for the IT professional describes what AppLocker is and how its features differ from Software Restriction Policies. | +| [Requirements to use AppLocker](requirements-to-use-applocker.md) | This topic for the IT professional lists software requirements to use AppLocker on the supported Windows operating systems. | +| [AppLocker policy use scenarios](applocker-policy-use-scenarios.md) | This topic for the IT professional lists the various application control scenarios in which AppLocker policies can be effectively implemented. | +| [How AppLocker works](how-applocker-works-techref.md) | This topic for the IT professional provides links to topics about AppLocker architecture and components, processes and interactions, rules and policies. | +| [AppLocker architecture and components](applocker-architecture-and-components.md) | This topic for IT professional describes AppLocker’s basic architecture and its major components. | +| [AppLocker processes and interactions](applocker-processes-and-interactions.md) | This topic for the IT professional describes the process dependencies and interactions when AppLocker evaluates and enforces rules. | +| [AppLocker functions](applocker-functions.md) | This topic for the IT professional lists the functions and security levels for the Software Restriction Policies (SRP) and AppLocker features. | +| [Security considerations for AppLocker](security-considerations-for-applocker.md) | This topic for the IT professional describes the security considerations you need to address when implementing AppLocker. | +| [Tools to Use with AppLocker](tools-to-use-with-applocker.md) | This topic for the IT professional describes the tools available to create and administer AppLocker policies. | +| [AppLocker Settings](applocker-settings.md) | This topic for the IT professional lists the settings used by AppLocker. | diff --git a/windows/keep-secure/apply-a-basic-audit-policy-on-a-file-or-folder.md b/windows/keep-secure/apply-a-basic-audit-policy-on-a-file-or-folder.md index cf1717d5af..5828778660 100644 --- a/windows/keep-secure/apply-a-basic-audit-policy-on-a-file-or-folder.md +++ b/windows/keep-secure/apply-a-basic-audit-policy-on-a-file-or-folder.md @@ -2,19 +2,24 @@ title: Apply a basic audit policy on a file or folder (Windows 10) description: You can apply audit policies to individual files and folders on your computer by setting the permission type to record successful access attempts or failed access attempts in the security log. ms.assetid: 565E7249-5CD0-4B2E-B2C0-B3A0793A51E2 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Apply a basic audit policy on a file or folder + **Applies to** - Windows 10 + You can apply audit policies to individual files and folders on your computer by setting the permission type to record successful access attempts or failed access attempts in the security log. To complete this procedure, you must be logged on as a member of the built-in Administrators group or you must have been granted the **Manage auditing and security log** right. + **To apply or modify auditing policy settings for a local file or folder** -1. 2.Right-click the file or folder that you want to audit, click **Properties**, and then click the **Security** tab. + +1. Right-click the file or folder that you want to audit, click **Properties**, and then click the **Security** tab. 2. Click **Advanced**. 3. In the **Advanced Security Settings** dialog box, click the **Auditing** tab, and then click **Continue**. 4. Do one of the following: @@ -25,9 +30,11 @@ To complete this procedure, you must be logged on as a member of the built-in Ad - To audit successful events, click **Success.** - To audit failure events, click **Fail.** - To audit all events, click **All.** -**Important**  Before setting up auditing for files and folders, you must enable object access auditing by defining auditing policy settings for the object access event category. If you do not enable object access auditing, you will receive an error message when you set up auditing for files and folders, and no files or folders will be audited. + +> **Important:**  Before setting up auditing for files and folders, you must enable object access auditing by defining auditing policy settings for the object access event category. If you do not enable object access auditing, you will receive an error message when you set up auditing for files and folders, and no files or folders will be audited.   ## Additional considerations + - After object access auditing is enabled, view the security log in Event Viewer to review the results of your changes. - You can set up file and folder auditing only on NTFS drives. - Because the security log is limited in size, select the files and folders to be audited carefully. Also, consider the amount of disk space that you want to devote to the security log. The maximum size for the security log is defined in Event Viewer. diff --git a/windows/keep-secure/audit-account-lockout.md b/windows/keep-secure/audit-account-lockout.md index 206ac496c6..6c7ebbb0e2 100644 --- a/windows/keep-secure/audit-account-lockout.md +++ b/windows/keep-secure/audit-account-lockout.md @@ -2,41 +2,35 @@ title: Audit Account Lockout (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit Account Lockout, which enables you to audit security events that are generated by a failed attempt to log on to an account that is locked out. ms.assetid: da68624b-a174-482c-9bc5-ddddab38e589 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Account Lockout + **Applies to** - Windows 10 - Windows 10 Mobile + This topic for the IT professional describes the advanced security audit policy setting, **Audit Account Lockout**, which enables you to audit security events that are generated by a failed attempt to log on to an account that is locked out. + If you configure this policy setting, an audit event is generated when an account cannot log on to a computer because the account is locked out. Success audits record successful attempts and failure audits record unsuccessful attempts. + Account lockout events are essential for understanding user activity and detecting potential attacks. + Event volume: Low + Default setting: Success - ---- - - - - - - - - - - - - -
      Event IDEvent message

      4625

      An account failed to log on.

      + +| Event ID | Event message | +| - | - | +| 4625 | An account failed to log on. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-application-generated.md b/windows/keep-secure/audit-application-generated.md index 23e33b3b6b..f7c31ca13a 100644 --- a/windows/keep-secure/audit-application-generated.md +++ b/windows/keep-secure/audit-application-generated.md @@ -2,54 +2,39 @@ title: Audit Application Generated (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Application Generated, which determines whether the operating system generates audit events when applications attempt to use the Windows Auditing application programming interfaces (APIs). ms.assetid: 6c58a365-b25b-42b8-98ab-819002e31871 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Application Generated + **Applies to** - Windows 10 + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Application Generated**, which determines whether the operating system generates audit events when applications attempt to use the Windows Auditing application programming interfaces (APIs). + The following events can generate audit activity: + - Creation, deletion, or initialization of an application client context - Application operations + Applications that are designed to use the Windows Auditing APIs can use this subcategory to log auditing events that are related to those APIs. The level, volume, relevance, and importance of these audit events depend on the application that generates them. The operating system logs the events as they are generated by the application. + Event volume: Depends on the installed app's use of the Windows Auditing APIs + Default: Not configured - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4665

      An attempt was made to create an application client context.

      4666

      An application attempted an operation:

      4667

      An application client context was deleted.

      4668

      An application was initialized.

      + +| Event ID | Event message | +| - | - | +| 4665 | An attempt was made to create an application client context. | +| 4666 | An application attempted an operation: | +| 4667 | An application client context was deleted. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-application-group-management.md b/windows/keep-secure/audit-application-group-management.md index 15d44e5eab..3055b72f6d 100644 --- a/windows/keep-secure/audit-application-group-management.md +++ b/windows/keep-secure/audit-application-group-management.md @@ -2,77 +2,42 @@ title: Audit Application Group Management (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit Application Group Management, which determines whether the operating system generates audit events when application group management tasks are performed. ms.assetid: 1bcaa41e-5027-4a86-96b7-f04eaf1c0606 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Application Group Management + **Applies to** - Windows 10 + This topic for the IT professional describes the advanced security audit policy setting, **Audit Application Group Management**, which determines whether the operating system generates audit events when application group management tasks are performed. + Application group management tasks include: + - An application group is created, changed, or deleted. - A member is added to or removed from an application group. + Event volume: Low + Default: Not configured - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4783

      A basic application group was created.

      -

      4784

      A basic application group was changed.

      -

      4785

      A member was added to a basic application group.

      -

      4786

      A member was removed from a basic application group.

      -

      4787

      A non-member was added to a basic application group.

      -

      4788

      A non-member was removed from a basic application group.

      -

      4789

      A basic application group was deleted.

      -

      4790

      An LDAP query group was created.

      -

      + +| Event ID | Event message | +| - | - | +| 4783 | A basic application group was created. | +| 4784 | A basic application group was changed. | +| 4785 | A member was added to a basic application group. | +| 4786 | A member was removed from a basic application group. | +| 4787 | A non-member was added to a basic application group. | +| 4788 | A non-member was removed from a basic application group. | +| 4789 | A basic application group was deleted. | +| 4790 | An LDAP query group was created. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-audit-policy-change.md b/windows/keep-secure/audit-audit-policy-change.md index beb42d48f1..65b7d6261e 100644 --- a/windows/keep-secure/audit-audit-policy-change.md +++ b/windows/keep-secure/audit-audit-policy-change.md @@ -2,95 +2,54 @@ title: Audit Audit Policy Change (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Audit Policy Change, which determines whether the operating system generates audit events when changes are made to audit policy. ms.assetid: 7153bf75-6978-4d7e-a821-59a699efb8a9 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Audit Policy Change + **Applies to** - Windows 10 + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Audit Policy Change**, which determines whether the operating system generates audit events when changes are made to audit policy. + Changes to audit policy that are audited include: + - Changing permissions and audit settings on the audit policy object (by using **auditpol /set /sd**). - Changing the system audit policy. - Registering and unregistering security event sources. - Changing per-user audit settings. - Changing the value of **CrashOnAuditFail**. - Changing audit settings on an object (for example, modifying the system access control list (SACL) for a file or registry key). - **Note**   - SACL change auditing is performed when a SACL for an object has changed and the Policy Change category is configured. Discretionary access control list (DACL) and owner change auditing are performed when Object Access auditing is configured and the object's SACL is set for auditing of the DACL or owner change. + + > **Note:** SACL change auditing is performed when a SACL for an object has changed and the Policy Change category is configured. Discretionary access control list (DACL) and owner change auditing are performed when Object Access auditing is configured and the object's SACL is set for auditing of the DACL or owner change.   - Changing anything in the Special Groups list. -**Important**   -Changes to the audit policy are critical security events. + +> **Important:**  Changes to the audit policy are critical security events.   Event volume: Low + Default: Success - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4715

      The audit policy (SACL) on an object was changed.

      4719

      System audit policy was changed.

      4817

      Auditing settings on an object were changed.

      -
      -Note   -

      This event is logged only on computers running the supported versions of the Windows operating system.

      -
      -
      -  -

      4902

      The Per-user audit policy table was created.

      4904

      An attempt was made to register a security event source.

      4905

      An attempt was made to unregister a security event source.

      4906

      The CrashOnAuditFail value has changed.

      4907

      Auditing settings on object were changed.

      4908

      Special Groups Logon table modified.

      4912

      Per User Audit Policy was changed.

      + +| Event ID | Event message | +| - | - | +| 4715 | The audit policy (SACL) on an object was changed. | +| 4719 | System audit policy was changed. | +| 4817 | Auditing settings on an object were changed.
      **Note: ** This event is logged only on computers running the supported versions of the Windows operating system. | +| 4902 | The Per-user audit policy table was created. | +| 4904 | An attempt was made to register a security event source. | +| 4905 | An attempt was made to unregister a security event source. | +| 4906 | The CrashOnAuditFail value has changed. | +| 4907 | Auditing settings on object were changed. | +| 4908 | Special Groups Logon table modified. | +| 4912 | Per User Audit Policy was changed. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-audit-the-access-of-global-system-objects.md b/windows/keep-secure/audit-audit-the-access-of-global-system-objects.md index d9e3f7d10d..767ec7c30a 100644 --- a/windows/keep-secure/audit-audit-the-access-of-global-system-objects.md +++ b/windows/keep-secure/audit-audit-the-access-of-global-system-objects.md @@ -2,192 +2,117 @@ title: Audit Audit the access of global system objects (Windows 10) description: Describes the best practices, location, values, and security considerations for the Audit Audit the access of global system objects security policy setting. ms.assetid: 20d40a79-ce89-45e6-9bb4-148f83958460 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit: Audit the access of global system objects + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Audit: Audit the access of global system objects** security policy setting. + ## Reference + If you enable this policy setting, a default system access control list (SACL) is applied when the device creates system objects such as mutexes, events, semaphores, and MS-DOS® devices. If you also enable the [Audit object access](basic-audit-object-access.md) audit setting, access to these system objects is audited. + Global system objects, also known as "base system objects" or "base named objects," are temporary kernel objects that have had names assigned to them by the application or system component that created them. These objects are most commonly used to synchronize multiple applications or multiple parts of a complex application. Because they have names, these objects are global in scope and, therefore, visible to all processes on the device. These objects all have a security descriptor; but typically, they do not have a NULL SACL. If you enable this policy setting and it takes effect at startup time, the kernel assigns a SACL to these objects when they are created. + The threat is that a globally visible named object, if incorrectly secured, might be acted on by a malicious program that knows the name of the object. For instance, if a synchronization object such as a mutex has a poorly constructed discretionary access control list (DACL), a malicious program can access that mutex by name and cause the program that created it to malfunction. However, the risk of this occurring is very low. + Enabling this policy setting can generate a large number of security events, especially on busy domain controllers and application servers. This might cause servers to respond slowly and force the security log to record numerous events of little significance. Auditing for access to global system objects is an all-or-nothing affair; there is no way to filter which events get recorded and which do not. Even if an organization has the resources to analyze events generated when this policy setting is enabled, it is unlikely to have the source code or a description of what each named object is used for; therefore, it is unlikely that many organizations could benefit from enabling this policy setting. + ### Possible values + - Enabled - Disabled - Not defined + ### Best practices + - Use the advanced security audit policy option, [Audit Kernel Object](audit-kernel-object.md) in Advanced Security Audit Policy Settings\\Object Access, to reduce the number of unrelated audit events that you generate. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Disabled

      DC Effective Default Settings

      Disabled

      Member Server Effective Default Settings

      Disabled

      Client Computer Effective Default Settings

      Disabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined | +| Default Domain Controller Policy | Not defined | +| Stand-Alone Server Default Settings | Disabled | +| DC Effective Default Settings | Disabled | +| Member Server Effective Default Settings | Disabled | +| Client Computer Effective Default Settings | Disabled |   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + A restart of the computer is required before this policy will be effective when changes to this policy are saved locally or distributed through Group Policy. + ### Group Policy + All auditing capabilities are integrated in Group Policy. You can configure, deploy, and manage these settings in the Group Policy Management Console (GPMC) or Local Security Policy snap-in for a domain, site, or organizational unit (OU). + ### Auditing + To audit attempts to access global system objects, you can use one of two security audit policy settings: + - [Audit Kernel Object](audit-kernel-object.md) in Advanced Security Audit Policy Settings\\Object Access - [Audit object access](basic-audit-object-access.md) under Security Settings\\Local Policies\\Audit Policy + If possible, use the Advanced Security Audit Policy option to reduce the number of unrelated audit events that you generate. + If the [Audit Kernel Object](audit-kernel-object.md) setting is configured, the following events are generated: - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4659

      A handle to an object was requested with intent to delete.

      4660

      An object was deleted.

      4661

      A handle to an object was requested.

      4663

      An attempt was made to access an object.

      -  -If the [Audit Kernel Object](audit-kernel-object.md) setting is configured, the following events are generated. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      560

      Access was granted to an already existing object.

      562

      A handle to an object was closed.

      563

      An attempt was made to open an object with the intent to delete it.

      -
      -Note   -

      This is used by file systems when the FILE_DELETE_ON_CLOSE flag is specified in Createfile().

      -
      -
      -  -

      564

      A protected object was deleted.

      565

      Access was granted to an already existing object type.

      567

      A permission associated with a handle was used.

      -
      -Note   -

      A handle is created with certain granted permissions (Read, Write, and so on). When the handle is used, up to one audit is generated for each of the permissions that was used.

      -
      -
      -  -

      569

      The resource manager in Authorization Manager attempted to create a client context.

      570

      A client attempted to access an object.

      -
      -Note   -

      An event will be generated for every attempted operation on the object.

      -
      -
      -  -
      + +| Event ID | Event message | +| - | - | +| 4659 | A handle to an object was requested with intent to delete. | +| 4660 | An object was deleted. | +| 4661 | A handle to an object was requested. | +| 4663 | An attempt was made to access an object. |   +If the [Audit Kernel Object](audit-kernel-object.md) setting is configured, the following events are generated: + +| Event ID | Event message | +| - | - | +| 560 | Access was granted to an already existing object. | +| 562 | A handle to an object was closed. | +| 563 | An attempt was made to open an object with the intent to delete it.
      **Note: **This is used by file systems when the FILE_DELETE_ON_CLOSE flag is specified in Createfile() | +| 564 | A protected object was deleted. | +| 565 | Access was granted to an already existing object type. | +| 567 | A permission associated with a handle was used.
      **Note:** A handle is created with certain granted permissions (Read, Write, and so on). When the handle is used, up to one audit is generated for each of the permissions that was used. | +| 569 | The resource manager in Authorization Manager attempted to create a client context. | +| 570 | A client attempted to access an object.
      **Note: ** An event will be generated for every attempted operation on the object. | + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + A globally visible named object, if incorrectly secured, could be acted upon by malicious software by using the name of the object. For instance, if a synchronization object such as a mutex had a poorly chosen discretionary access control list (DACL), malicious software could access that mutex by name and cause the program that created it to malfunction. However, the risk of such an occurrence is very low. + ### Countermeasure + Enable the **Audit: Audit the access of global system objects** setting. + ### Potential impact + If you enable the **Audit: Audit the access of global system objects** setting, a large number of security events could be generated, especially on busy domain controllers and application servers. Such an occurrence could cause servers to respond slowly and force the Security log to record numerous events of little significance. This policy setting can only be enabled or disabled, and there is no way to choose which events are recorded from this setting. Even organizations that have the resources to analyze events that are generated by this policy setting are not likely to have the source code or a description of what each named object is used for. Therefore, it is unlikely that most organizations would benefit by enabling this policy setting. To reduce the number of audit events generated, use the advanced audit policy. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/audit-audit-the-use-of-backup-and-restore-privilege.md b/windows/keep-secure/audit-audit-the-use-of-backup-and-restore-privilege.md index d028cb4d3e..49b518da5a 100644 --- a/windows/keep-secure/audit-audit-the-use-of-backup-and-restore-privilege.md +++ b/windows/keep-secure/audit-audit-the-use-of-backup-and-restore-privilege.md @@ -2,85 +2,86 @@ title: Audit Audit the use of Backup and Restore privilege (Windows 10) description: Describes the best practices, location, values, and security considerations for the Audit Audit the use of Backup and Restore privilege security policy setting. ms.assetid: f656a2bb-e8d6-447b-8902-53df3a7756c5 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit: Audit the use of Backup and Restore privilege + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Audit: Audit the use of Backup and Restore privilege** security policy setting. + ## Reference + The **Audit: Audit the use of Backup and Restore privilege** policy setting determines whether to audit the use of all user rights, including Backup and Restore, when the **Audit privilege use** policy setting is configured. Enabling both policy settings generates an audit event for every file that is backed up or restored. + ### Possible values + - Enabled - Disabled - Not defined + ### Best practices + - Set **Audit: Audit the use of Backup and Restore privilege** to Disabled. Enabling this policy setting can generate a large number of security events, which might cause servers to respond slowly and force the security event log to record numerous events of little significance. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Disabled

      DC Effective Default Settings

      Disabled

      Member Server Effective Default Settings

      Disabled

      Client Computer Effective Default Settings

      Disabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined | +| Default Domain Controller Policy | Not defined | +| Stand-Alone Server Default Settings | Disabled | +| DC Effective Default Settings | Disabled | +| Member Server Effective Default Settings | Disabled | +| Client Computer Effective Default Settings | Disabled |   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. + ### Auditing + Enabling this policy setting in conjunction with the **Audit privilege use** policy setting records any instance of user rights that are being exercised in the security log. If **Audit privilege use** is enabled but **Audit: Audit the use of Backup and Restore privilege** is disabled, when users use backup or restore user rights, those events will not be audited. + Enabling this policy setting when the **Audit privilege use** policy setting is also enabled generates an audit event for every file that is backed up or restored. This can help you to track down an administrator who is accidentally or maliciously restoring data in an unauthorized manner. + Alternately, you can use the advanced audit policy, [Audit Sensitive Privilege Use](audit-sensitive-privilege-use.md), which can help you manage the number of events generated. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + When the backup and restore function is used, it creates a copy of the file system that is identical to the target of the backup. Making regular backup and restore volumes is an important part of your incident response plan. However, a malicious user could use a legitimate backup copy to gain access to information or to impersonate a legitimate network resource to compromise your enterprise. + ### Countermeasure + Enable the **Audit: Audit the use of Backup and Restore privilege** setting. Alternatively, implement automatic log backup by configuring the **AutoBackupLogFiles** registry key. If you enable this option when the [Audit privilege use](basic-audit-privilege-use.md) setting is also enabled, an audit event is generated for every file that is backed up or restored. This information could help you to identify an account that was used to accidentally or maliciously restore data in an unauthorized manner. For more information about configuring this key, see Microsoft Knowledge Base article [100879](http://go.microsoft.com/fwlink/p/?LinkId=100879). + ### Potential impact + If you enable this policy setting, a large number of security events could be generated, which could cause servers to respond slowly and force the security event log to record numerous events of little significance. If you increase the security event log size to reduce the chances of a system shutdown, an excessively large log file may affect system performance. + ## Related topics -[Security Options](security-options.md) + +- [Security Options](security-options.md)     diff --git a/windows/keep-secure/audit-authentication-policy-change.md b/windows/keep-secure/audit-authentication-policy-change.md index 81c47c8ea2..e26a96a284 100644 --- a/windows/keep-secure/audit-authentication-policy-change.md +++ b/windows/keep-secure/audit-authentication-policy-change.md @@ -2,21 +2,26 @@ title: Audit Authentication Policy Change (Windows 10) description: This topic for the IT professional describes this Advanced Security Audit policy setting, Audit Authentication Policy Change, which determines whether the operating system generates audit events when changes are made to authentication policy. ms.assetid: aa9cea7a-aadf-47b7-b704-ac253b8e79be -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Authentication Policy Change + **Applies to** - Windows 10 + This topic for the IT professional describes this Advanced Security Audit policy setting, **Audit Authentication Policy Change**, which determines whether the operating system generates audit events when changes are made to authentication policy. + Changes made to authentication policy include: + - Creation, modification, and removal of forest and domain trusts. - Changes to Kerberos policy under **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Kerberos Policy**. - **Note**   - The audit event is logged when the policy is applied, not when settings are modified by the administrator. + + > **Note:**  The audit event is logged when the policy is applied, not when settings are modified by the administrator.   - When any of the following user rights is granted to a user or group: - **Access this computer from the network** @@ -25,61 +30,27 @@ Changes made to authentication policy include: - **Logon as a batch job** - **Logon as a service** - Namespace collision, such as when an added trust collides with an existing namespace name. + This setting is useful for tracking changes in domain-level and forest-level trust and privileges that are granted to user accounts or groups. + Event volume: Low + Default: Success - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4713

      Kerberos policy was changed.

      4716

      Trusted domain information was modified.

      4717

      System security access was granted to an account.

      4718

      System security access was removed from an account.

      4739

      Domain Policy was changed.

      4864

      A namespace collision was detected.

      4865

      A trusted forest information entry was added.

      4866

      A trusted forest information entry was removed.

      4867

      A trusted forest information entry was modified.

      + +| Event ID | Event message | +| - | - | +| 4713 | Kerberos policy was changed. | +| 4716 | Trusted domain information was modified. | +| 4717 | System security access was granted to an account. | +| 4718 | System security access was removed from an account. | +| 4739 | Domain Policy was changed. | +| 4864 | A namespace collision was detected. | +| 4865 | A trusted forest information entry was added. | +| 4866 | A trusted forest information entry was removed. | +| 4867 | A trusted forest information entry was modified. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + + - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-authorization-policy-change.md b/windows/keep-secure/audit-authorization-policy-change.md index 56c26436a8..3bff0a5dd9 100644 --- a/windows/keep-secure/audit-authorization-policy-change.md +++ b/windows/keep-secure/audit-authorization-policy-change.md @@ -2,63 +2,39 @@ title: Audit Authorization Policy Change (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Authorization Policy Change, which determines whether the operating system generates audit events when specific changes are made to the authorization policy. ms.assetid: ca0587a2-a2b3-4300-aa5d-48b4553c3b36 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Authorization Policy Change + **Applies to** - Windows 10 + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Authorization Policy Change**, which determines whether the operating system generates audit events when specific changes are made to the authorization policy. + Authorization policy changes that can be audited include: + - Assigning or removing user rights (privileges) such as **SeCreateTokenPrivilege**, except for the system access rights that are audited by using the [Audit Authentication Policy Change](audit-authentication-policy-change.md) subcategory. - Changing the Encrypting File System (EFS) policy. -<<<<<<< HEAD -Event volume: Low -======= Event volume: Very high ->>>>>>> master Default: Not configured - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4704

      A user right was assigned.

      4705

      A user right was removed.

      4706

      A new trust was created to a domain.

      4707

      A trust to a domain was removed.

      4714

      Encrypted data recovery policy was changed.

      + +| Event ID | Event message | +| - | - | +| 4704 | A user right was assigned. | +| 4705 | A user right was removed. | +| 4706 | A new trust was created to a domain. | +| 4707 | A trust to a domain was removed. | +| 4714 | Encrypted data recovery policy was changed. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-central-access-policy-staging.md b/windows/keep-secure/audit-central-access-policy-staging.md index 525c573cb3..e53abd2a09 100644 --- a/windows/keep-secure/audit-central-access-policy-staging.md +++ b/windows/keep-secure/audit-central-access-policy-staging.md @@ -2,38 +2,30 @@ title: Audit Central Access Policy Staging (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Central Access Policy Staging, which determines permissions on a Central Access Policy. ms.assetid: D9BB11CE-949A-4B48-82BF-30DC5E6FC67D -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Central Access Policy Staging + **Applies to** - Windows 10 + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Central Access Policy Staging**, which determines permissions on a Central Access Policy. + Event volume: Medium + Default: Not configured - ---- - - - - - - - - - - - - -
      Event IDEvent message

      4818

      Proposed Central Access Policy does not grant the same access permissions as the current Central Access Policy

      + +| Event ID | Event message | +| - | - | +| 4818 | Proposed Central Access Policy does not grant the same access permissions as the current Central Access Policy |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-certification-services.md b/windows/keep-secure/audit-certification-services.md index 4d94779c67..f23bdde027 100644 --- a/windows/keep-secure/audit-certification-services.md +++ b/windows/keep-secure/audit-certification-services.md @@ -2,17 +2,22 @@ title: Audit Certification Services (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Certification Services, which determines whether the operating system generates events when Active Directory Certificate Services (AD CS) operations are performed. ms.assetid: cdefc34e-fb1f-4eff-b766-17713c5a1b03 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Certification Services + **Applies to** - Windows 10 + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Certification Services**, which determines whether the operating system generates events when Active Directory Certificate Services (AD CS) operations are performed. + Examples of AD CS operations include: + - AD CS starts, shuts down, is backed up, or is restored. - Certificate revocation list (CRL)-related tasks are performed. - Certificates are requested, issued, or revoked. @@ -24,149 +29,49 @@ Examples of AD CS operations include: - Security permissions for AD CS role services are modified. - Keys are archived, imported, or retrieved. - The OCSP Responder Service is started or stopped. + Monitoring these operational events is important to ensure that AD CS role services are functioning properly. + Event volume: Low to medium on servers that host AD CS role services + Default: Not configured - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4868

      The certificate manager denied a pending certificate request.

      4869

      Certificate Services received a resubmitted certificate request.

      4870

      Certificate Services revoked a certificate.

      4871

      Certificate Services received a request to publish the certificate revocation list (CRL).

      4872

      Certificate Services published the certificate revocation list (CRL).

      4873

      A certificate request extension changed.

      4874

      One or more certificate request attributes changed.

      4875

      Certificate Services received a request to shut down.

      4876

      Certificate Services backup started.

      4877

      Certificate Services backup completed.

      4878

      Certificate Services restore started.

      4879

      Certificate Services restore completed.

      4880

      Certificate Services started.

      4881

      Certificate Services stopped.

      4882

      The security permissions for Certificate Services changed.

      4883

      Certificate Services retrieved an archived key.

      4884

      Certificate Services imported a certificate into its database.

      4885

      The audit filter for Certificate Services changed.

      4886

      Certificate Services received a certificate request.

      4887

      Certificate Services approved a certificate request and issued a certificate.

      4888

      Certificate Services denied a certificate request.

      4889

      Certificate Services set the status of a certificate request to pending.

      4890

      The certificate manager settings for Certificate Services changed.

      4891

      A configuration entry changed in Certificate Services.

      4892

      A property of Certificate Services changed.

      4893

      Certificate Services archived a key.

      4894

      Certificate Services imported and archived a key.

      4895

      Certificate Services published the CA certificate to Active Directory Domain Services.

      4896

      One or more rows have been deleted from the certificate database.

      4897

      Role separation enabled:

      4898

      Certificate Services loaded a template.

      + +| Event ID | Event message | +| - | - | +| 4868 | The certificate manager denied a pending certificate request. | +| 4869 | Certificate Services received a resubmitted certificate request. | +| 4870 | Certificate Services revoked a certificate. | +| 4871 | Certificate Services received a request to publish the certificate revocation list (CRL). | +| 4872 | Certificate Services published the certificate revocation list (CRL). | +| 4873 | A certificate request extension changed. | +| 4874 | One or more certificate request attributes changed. | +| 4875 | Certificate Services received a request to shut down. | +| 4876 | Certificate Services backup started. | +| 4877 | Certificate Services backup completed. | +| 4878 | Certificate Services restore started. | +| 4879 | Certificate Services restore completed. | +| 4880 | Certificate Services started. | +| 4881 | Certificate Services stopped. | +| 4882 | The security permissions for Certificate Services changed. | +| 4883 | Certificate Services retrieved an archived key. | +| 4884 | Certificate Services imported a certificate into its database. | +| 4885 | The audit filter for Certificate Services changed. | +| 4886 | Certificate Services received a certificate request. | +| 4887 | Certificate Services approved a certificate request and issued a certificate. | +| 4888 | Certificate Services denied a certificate request. | +| 4889 | Certificate Services set the status of a certificate request to pending. | +| 4890 | The certificate manager settings for Certificate Services changed. | +| 4891 | A configuration entry changed in Certificate Services. | +| 4892 | A property of Certificate Services changed. | +| 4893 | Certificate Services archived a key. | +| 4894 | Certificate Services imported and archived a key. | +| 4895 | Certificate Services published the CA certificate to Active Directory Domain Services. | +| 4896 | One or more rows have been deleted from the certificate database. | +| 4897 | Role separation enabled: | +| 4898 | Certificate Services loaded a template. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-computer-account-management.md b/windows/keep-secure/audit-computer-account-management.md index 60524de373..5211936625 100644 --- a/windows/keep-secure/audit-computer-account-management.md +++ b/windows/keep-secure/audit-computer-account-management.md @@ -2,47 +2,34 @@ title: Audit Computer Account Management (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit Computer Account Management, which determines whether the operating system generates audit events when a computer account is created, changed, or deleted. ms.assetid: 6c406693-57bf-4411-bb6c-ff83ce548991 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Computer Account Management + **Applies to** - Windows 10 + This topic for the IT professional describes the advanced security audit policy setting, **Audit Computer Account Management**, which determines whether the operating system generates audit events when a computer account is created, changed, or deleted. + This policy setting is useful for tracking account-related changes to computers that are members of a domain. + Event volume: Low + Default: Not configured - ---- - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4741

      A computer account was created.

      4742

      A computer account was changed.

      4743

      A computer account was deleted.

      + +| Event ID | Event message | +| - | - | +| 4741 | A computer account was created. | +| 4742 | A computer account was changed. | +| 4743 | A computer account was deleted. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-credential-validation.md b/windows/keep-secure/audit-credential-validation.md index add71830c8..7f4232806f 100644 --- a/windows/keep-secure/audit-credential-validation.md +++ b/windows/keep-secure/audit-credential-validation.md @@ -2,59 +2,42 @@ title: Audit Credential Validation (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit Credential Validation, which determines whether the operating system generates audit events on credentials that are submitted for a user account logon request. ms.assetid: 6654b33a-922e-4a43-8223-ec5086dfc926 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Credential Validation + **Applies to** - Windows 10 - Windows 10 Mobile + This topic for the IT professional describes the advanced security audit policy setting, **Audit Credential Validation**, which determines whether the operating system generates audit events on credentials that are submitted for a user account logon request. + These events occur on the computer that is authoritative for the credentials as follows: + - For domain accounts, the domain controller is authoritative. - For local accounts, the local computer is authoritative. + Event volume: High on domain controllers -Because domain accounts are used much more frequently than local accounts in enterprise environments, most of the Account Logon events in a domain environment occur on the domain controllers that are authoritative for the domain accounts. However, these events can occur on any computer, and they may occur in conjunction with or on separate computers from Logon and Logoff events. + +Because domain accounts are used much more frequently than local accounts in enterprise environments, most of the Account Logon events in a domain environment occur on the domain controllers that are authoritative for the domain accounts. However, these events can occur on any computer, and they +may occur in conjunction with or on separate computers from Logon and Logoff events. + Default: Not configured - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4774

      An account was mapped for logon.

      -

      4775

      An account could not be mapped for logon.

      -

      4776

      The domain controller attempted to validate the credentials for an account.

      -

      4777

      The domain controller failed to validate the credentials for an account.

      -

      + +| Event ID | Event message | +| - | - | +| 4774 | An account was mapped for logon. | +| 4775 | An account could not be mapped for logon. | +| 4776 | The domain controller attempted to validate the credentials for an account. | +| 4777 | The domain controller failed to validate the credentials for an account. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-detailed-directory-service-replication.md b/windows/keep-secure/audit-detailed-directory-service-replication.md index 99ff8d4881..ae2e46a570 100644 --- a/windows/keep-secure/audit-detailed-directory-service-replication.md +++ b/windows/keep-secure/audit-detailed-directory-service-replication.md @@ -8,61 +8,33 @@ ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- + # Audit Detailed Directory Service Replication + **Applies to** - Windows 10 + This topic for the IT professional describes the advanced security audit policy setting, **Audit Detailed Directory Service Replication**, which determines whether the operating system generates audit events that contain detailed tracking information about data that is replicated between domain controllers. + This audit subcategory can be useful to diagnose replication issues. + Event volume: These events can create a very high volume of event data. + Default: Not configured - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4928

      An Active Directory replica source naming context was established.

      4929

      An Active Directory replica source naming context was removed.

      4930

      An Active Directory replica source naming context was modified.

      4931

      An Active Directory replica destination naming context was modified.

      4934

      Attributes of an Active Directory object were replicated.

      4935

      Replication failure begins.

      4936

      Replication failure ends.

      4937

      A lingering object was removed from a replica.

      + +| Event ID | Event message | +| - | - | +| 4928 | An Active Directory replica source naming context was established. | +| 4929 | An Active Directory replica source naming context was removed. | +| 4930 | An Active Directory replica source naming context was modified. | +| 4931 | An Active Directory replica destination naming context was modified. | +| 4934 | Attributes of an Active Directory object were replicated. | +| 4935 | Replication failure begins. | +| 4936 | Replication failure ends. | +| 4937 | A lingering object was removed from a replica. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-detailed-file-share.md b/windows/keep-secure/audit-detailed-file-share.md index b4376be5d3..f60e4dd5f2 100644 --- a/windows/keep-secure/audit-detailed-file-share.md +++ b/windows/keep-secure/audit-detailed-file-share.md @@ -2,42 +2,33 @@ title: Audit Detailed File Share (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Detailed File Share, which allows you to audit attempts to access files and folders on a shared folder. ms.assetid: 60310104-b820-4033-a1cb-022a34f064ae -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Detailed File Share + **Applies to** - Windows 10 + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Detailed File Share**, which allows you to audit attempts to access files and folders on a shared folder. + The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client computer and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. -**Note**   -There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared files and folders on the system is audited. +> **Note:**  There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared files and folders on the system is audited.   Event volume: High on a file server or domain controller because of SYSVOL network access required by Group Policy + Default: Not configured - ---- - - - - - - - - - - - - -
      Event IDEvent message

      5145

      A network share object was checked to see whether the client can be granted desired access.

      + +| Event ID | Event message | +| - | - | +| 5145 | A network share object was checked to see whether the client can be granted desired access. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-directory-service-access.md b/windows/keep-secure/audit-directory-service-access.md index 7448d1b505..230dce9a69 100644 --- a/windows/keep-secure/audit-directory-service-access.md +++ b/windows/keep-secure/audit-directory-service-access.md @@ -2,42 +2,33 @@ title: Audit Directory Service Access (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit Directory Service Access, which determines whether the operating system generates audit events when an Active Directory Domain Services (AD DS) object is accessed. ms.assetid: ba2562ba-4282-4588-b87c-a3fcb771c7d0 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Directory Service Access + **Applies to** - Windows 10 + This topic for the IT professional describes the advanced security audit policy setting, **Audit Directory Service Access**, which determines whether the operating system generates audit events when an Active Directory Domain Services (AD DS) object is accessed. + These events are similar to the Directory Service Access events in previous versions of the Windows Server operating systems. -**Important**   -Audit events are generated only on objects with configured system access control lists (SACLs), and only when they are accessed in a manner that matches the SACL settings. +> **Important:**  Audit events are generated only on objects with configured system access control lists (SACLs), and only when they are accessed in a manner that matches the SACL settings.   Event volume: High on servers running AD DS role services; none on client computers + Default: Not configured - ---- - - - - - - - - - - - - -
      Event IDEvent message

      4662

      An operation was performed on an object.

      + +| Event ID | Event message | +| - | - | +| 4662 | An operation was performed on an object. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-directory-service-changes.md b/windows/keep-secure/audit-directory-service-changes.md index a474407c2f..361827a614 100644 --- a/windows/keep-secure/audit-directory-service-changes.md +++ b/windows/keep-secure/audit-directory-service-changes.md @@ -2,65 +2,48 @@ title: Audit Directory Service Changes (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit Directory Service Changes, which determines whether the operating system generates audit events when changes are made to objects in Active Directory Domain Services (AD DS). ms.assetid: 9f7c0dd4-3977-47dd-a0fb-ec2f17cad05e -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Directory Service Changes + **Applies to** - Windows 10 + This topic for the IT professional describes the advanced security audit policy setting, **Audit Directory Service Changes**, which determines whether the operating system generates audit events when changes are made to objects in Active Directory Domain Services (AD DS). + The types of changes that are reported are: + - Create - Delete - Modify - Move - Undelete + Directory Service Changes auditing, where appropriate, indicates the old and new values of the changed properties of the objects that were changed. -**Important**   -Audit events are generated only for objects with configured system access control lists (SACLs), and only when they are accessed in a manner that matches their SACL settings. Some objects and properties do not cause audit events to be generated due to settings on the object class in the schema. + +> **Important:**  Audit events are generated only for objects with configured system access control lists (SACLs), and only when they are accessed in a manner that matches their SACL settings. Some objects and properties do not cause audit events to be generated due to settings on the object class in the schema.   This subcategory only logs events on domain controllers. Changes to Active Directory objects are important events to track in order to understand the state of the network policy. + Event volume: High on domain controllers; none on client computers + Default: Not configured - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      5136

      A directory service object was modified.

      5137

      A directory service object was created.

      5138

      A directory service object was undeleted.

      5139

      A directory service object was moved.

      5141

      A directory service object was deleted.

      + +| Event ID | Event message | +| - | - | +| 5136 | A directory service object was modified. | +| 5137 | A directory service object was created. | +| 5138 | A directory service object was undeleted. | +| 5139 | A directory service object was moved. | +| 5141 | A directory service object was deleted. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-directory-service-replication.md b/windows/keep-secure/audit-directory-service-replication.md index 907f50fda7..9f09abada9 100644 --- a/windows/keep-secure/audit-directory-service-replication.md +++ b/windows/keep-secure/audit-directory-service-replication.md @@ -2,42 +2,31 @@ title: Audit Directory Service Replication (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit Directory Service Replication, which determines whether the operating system generates audit events when replication between two domain controllers begins and ends. ms.assetid: b95d296c-7993-4e8d-8064-a8bbe284bd56 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Directory Service Replication + **Applies to** - Windows 10 + This topic for the IT professional describes the advanced security audit policy setting, **Audit Directory Service Replication**, which determines whether the operating system generates audit events when replication between two domain controllers begins and ends. + Event volume: Medium on domain controllers; none on client computers + Default: Not configured - ---- - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4932

      Synchronization of a replica of an Active Directory naming context has begun.

      4933

      Synchronization of a replica of an Active Directory naming context has ended.

      + +| Event ID | Event Message | +| - | - | +| 4932 | Synchronization of a replica of an Active Directory naming context has begun. | +| 4933 | Synchronization of a replica of an Active Directory naming context has ended. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-distribution-group-management.md b/windows/keep-secure/audit-distribution-group-management.md index 91c5876a9c..1e259424ed 100644 --- a/windows/keep-secure/audit-distribution-group-management.md +++ b/windows/keep-secure/audit-distribution-group-management.md @@ -2,97 +2,51 @@ title: Audit Distribution Group Management (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Distribution Group Management, which determines whether the operating system generates audit events for specific distribution-group management tasks. ms.assetid: d46693a4-5887-4a58-85db-2f6cba224a66 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Distribution Group Management + **Applies to** - Windows 10 + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Distribution Group Management**, which determines whether the operating system generates audit events for specific distribution-group management tasks. + Tasks for distribution-group management that can be audited include: + - A distribution group is created, changed, or deleted. - A member is added to or removed from a distribution group. + This subcategory to which this policy belongs is logged only on domain controllers. -**Note**   -Distribution groups cannot be used to manage access control permissions. +> **Note:**  Distribution groups cannot be used to manage access control permissions.   Event volume: Low + Default: Not configured - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4744

      A security-disabled local group was created.

      4745

      A security-disabled local group was changed.

      4746

      A member was added to a security-disabled local group.

      4747

      A member was removed from a security-disabled local group.

      4748

      A security-disabled local group was deleted.

      4749

      A security-disabled global group was created.

      4750

      A security-disabled global group was changed.

      4751

      A member was added to a security-disabled global group.

      4752

      A member was removed from a security-disabled global group.

      4753

      A security-disabled global group was deleted.

      4759

      A security-disabled universal group was created.

      4760

      A security-disabled universal group was changed.

      4761

      A member was added to a security-disabled universal group.

      4762

      A member was removed from a security-disabled universal group.

      -  -## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +| Event ID | Event message | +| - | - | +| 4744 | A security-disabled local group was created. | +| 4745 | A security-disabled local group was changed. | +| 4746 | A member was added to a security-disabled local group. | +| 4747 | A member was removed from a security-disabled local group. | +| 4748 | A security-disabled local group was deleted. | +| 4749 | A security-disabled global group was created. | +| 4750 | A security-disabled global group was changed. | +| 4751 | A member was added to a security-disabled global group. | +| 4752 | A member was removed from a security-disabled global group. | +| 4753 | A security-disabled global group was deleted. | +| 4759 | A security-disabled universal group was created. | +| 4760 | A security-disabled universal group was changed. | +| 4761 | A member was added to a security-disabled universal group. | +| 4762 | A member was removed from a security-disabled universal group. | + + ## Related topics + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-dpapi-activity.md b/windows/keep-secure/audit-dpapi-activity.md index 0d82bf9af5..1e7c77ac71 100644 --- a/windows/keep-secure/audit-dpapi-activity.md +++ b/windows/keep-secure/audit-dpapi-activity.md @@ -2,53 +2,37 @@ title: Audit DPAPI Activity (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit DPAPI Activity, which determines whether the operating system generates audit events when encryption or decryption calls are made into the data protection application interface (DPAPI). ms.assetid: be4d4c83-c857-4e3d-a84e-8bcc3f2c99cd -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit DPAPI Activity + **Applies to** - Windows 10 - Windows 10 Mobile + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit DPAPI Activity**, which determines whether the operating system generates audit events when encryption or decryption calls are made into the data protection application interface (DPAPI). DPAPI is used to protect secret information such as stored passwords and key information. For more information about DPAPI, see [Windows Data Protection](http://go.microsoft.com/fwlink/p/?linkid=121720) (http://go.microsoft.com/fwlink/p/?linkid=121720). + Event volume: Low + Default: Not configured + If this policy setting is configured, the following events appear on computers running the supported versions of the Windows operating system as designated in the **Applies To** list at the beginning of this topic, in addition to Windows Server 2008 and Windows Vista. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4692

      Backup of data protection master key was attempted.

      4693

      Recovery of data protection master key was attempted.

      4694

      Protection of auditable protected data was attempted.

      4695

      Unprotection of auditable protected data was attempted.

      + +| Event ID | Event message | +| - | - | +| 4692 | Backup of data protection master key was attempted. | +| 4693 | Recovery of data protection master key was attempted. | +| 4694 | Protection of auditable protected data was attempted. | +| 4695 | Unprotection of auditable protected data was attempted. |   ## Related resource -[Advanced Security Audit Policy Settings](advanced-security-audit-policy-settings.md) + +- [Advanced Security Audit Policy Settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-file-share.md b/windows/keep-secure/audit-file-share.md index e1d039ce4d..8040bc118a 100644 --- a/windows/keep-secure/audit-file-share.md +++ b/windows/keep-secure/audit-file-share.md @@ -2,66 +2,39 @@ title: Audit File Share (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit File Share, which determines whether the operating system generates audit events when a file share is accessed. ms.assetid: 9ea985f8-8936-4b79-abdb-35cbb7138f78 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit File Share + **Applies to** - Windows 10 + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit File Share**, which determines whether the operating system generates audit events when a file share is accessed. + Audit events are not generated when shares are created, deleted, or when share permissions change. -**Note**   -There are no system access control lists (SACLs) for shares; therefore, after this setting is enabled, access to all shares on the system will be audited. +> **Note:**  There are no system access control lists (SACLs) for shares; therefore, after this setting is enabled, access to all shares on the system will be audited.   Combined with File System auditing, File Share auditing enables you to track what content was accessed, the source (IP address and port) of the request, and the user account that was used for the access. + Event volume: High on a file server or domain controller (due to SYSVOL access by client computers for policy processing) + Default: Not configured - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      5140

      A network share object was accessed.

      -
      -Note   -

      This event is logged on computers running Windows 10, Windows Server 2016 Technical Preview, Windows Server 2008 R2, Windows Server 2008, Windows 7, or Windows Vista.

      -
      -
      -  -

      5142

      A network share object was added.

      5143

      A network share object was modified.

      5144

      A network share object was deleted.

      5168

      SPN check for SMB/SMB2 failed.

      + +| Event ID | Event message | +| - |- | +| 5140 | A network share object was accessed.
      **Note:** This event is logged on computers running Windows 10, Windows Server 2016 Technical Preview, Windows Server 2008 R2, Windows Server 2008, Windows 7, or Windows Vista. | +| 5142 | A network share object was added. | +| 5143 | A network share object was modified. | +| 5144 | A network share object was deleted. | +| 5168 | SPN check for SMB/SMB2 failed. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-file-system.md b/windows/keep-secure/audit-file-system.md index 1eaab87e2c..53faccfac6 100644 --- a/windows/keep-secure/audit-file-system.md +++ b/windows/keep-secure/audit-file-system.md @@ -2,51 +2,39 @@ title: Audit File System (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit File System, which determines whether the operating system generates audit events when users attempt to access file system objects. ms.assetid: 6a71f283-b8e5-41ac-b348-0b7ec6ea0b1f -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy +ms.pagetype: security ms.sitesec: library author: brianlic-msft --- + # Audit File System + **Applies to** - Windows 10 - Windows 10 Mobile + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit File System**, which determines whether the operating system generates audit events when users attempt to access file system objects. Audit events are generated only for objects that have configured system access control lists (SACLs), and only if the type of access requested (such as Write, Read, or Modify) and the account making the request match the settings in the SACL. If success auditing is enabled, an audit entry is generated each time any account successfully accesses a file system object that has a matching SACL. If failure auditing is enabled, an audit entry is generated each time any user unsuccessfully attempts to access a file system object that has a matching SACL. + These events are essential for tracking activity for file objects that are sensitive or valuable and require extra monitoring. + Event volume: Varies, depending on how file system SACLs are configured + No audit events are generated for the default file system SACLs. + Default: Not configured - ---- - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4664

      An attempt was made to create a hard link.

      4985

      The state of a transaction has changed.

      5051

      A file was virtualized.

      + +| Event ID | Event message | +| - | - | +| 4664 | An attempt was made to create a hard link. | +| 4985 | The state of a transaction has changed. | +| 5051 | A file was virtualized. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-filtering-platform-connection.md b/windows/keep-secure/audit-filtering-platform-connection.md index 4931fa3cd4..a23961c6d9 100644 --- a/windows/keep-secure/audit-filtering-platform-connection.md +++ b/windows/keep-secure/audit-filtering-platform-connection.md @@ -2,80 +2,48 @@ title: Audit Filtering Platform Connection (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Filtering Platform Connection, which determines whether the operating system generates audit events when connections are allowed or blocked by the Windows Filtering Platform. ms.assetid: d72936e9-ff01-4d18-b864-a4958815df59 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Filtering Platform Connection + **Applies to** - Windows 10 + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Filtering Platform Connection**, which determines whether the operating system generates audit events when connections are allowed or blocked by the Windows Filtering Platform. + Windows Filtering Platform (WFP) enables independent software vendors (ISVs) to filter and modify TCP/IP packets, monitor or authorize connections, filter Internet Protocol security (IPsec)-protected traffic, and filter remote procedure calls (RPCs). + This security policy enables you to audit the following types of actions: + - The Windows Firewall service blocks an application from accepting incoming connections on the network. - The Windows Filtering Platform allows or blocks a connection. - The Windows Filtering Platform permits or blocks a bind to a local port. - The Windows Filtering Platform permits or blocks an application or service from listening for incoming connections on a port. + Event volume: High + Default: Not configured - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      5031

      The Windows Firewall Service blocked an application from accepting incoming connections on the network.

      5140

      A network share object was accessed.

      5150

      The Windows Filtering Platform blocked a packet.

      5151

      A more restrictive Windows Filtering Platform filter has blocked a packet.

      5154

      The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.

      5155

      The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.

      5156

      The Windows Filtering Platform has allowed a connection.

      5157

      The Windows Filtering Platform has blocked a connection.

      5158

      The Windows Filtering Platform has permitted a bind to a local port.

      5159

      The Windows Filtering Platform has blocked a bind to a local port.

      + +| Event ID | Event message | +| - | - | +| 5031 | The Windows Firewall Service blocked an application from accepting incoming connections on the network. | +| 5140 | A network share object was accessed. | +| 5150 | The Windows Filtering Platform blocked a packet. | +| 5151 | A more restrictive Windows Filtering Platform filter has blocked a packet. | +| 5154 | The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections. | +| 5155 | The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections. | +| 5156 | The Windows Filtering Platform has allowed a connection. | +| 5157 | The Windows Filtering Platform has blocked a connection. | +| 5158 | The Windows Filtering Platform has permitted a bind to a local port. | +| 5159 | The Windows Filtering Platform has blocked a bind to a local port. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-filtering-platform-packet-drop.md b/windows/keep-secure/audit-filtering-platform-packet-drop.md index e9afd9f620..fda5bc89e7 100644 --- a/windows/keep-secure/audit-filtering-platform-packet-drop.md +++ b/windows/keep-secure/audit-filtering-platform-packet-drop.md @@ -2,44 +2,35 @@ title: Audit Filtering Platform Packet Drop (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Filtering Platform Packet Drop, which determines whether the operating system generates audit events when packets are dropped by the Windows Filtering Platform. ms.assetid: 95457601-68d1-4385-af20-87916ddab906 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Filtering Platform Packet Drop + **Applies to** - Windows 10 + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Filtering Platform Packet Drop**, which determines whether the operating system generates audit events when packets are dropped by the Windows Filtering Platform. + Windows Filtering Platform (WFP) enables independent software vendors (ISVs) to filter and modify TCP/IP packets, monitor or authorize connections, filter Internet Protocol security (IPsec)-protected traffic, and filter remote procedure calls (RPCs). + A high rate of dropped packets may indicate that there have been attempts to gain unauthorized access to computers on your network. + Event volume: High + Default setting: Not configured - ---- - - - - - - - - - - - - - - - - -
      Event IDEvent message

      5152

      The Windows Filtering Platform blocked a packet.

      5153

      A more restrictive Windows Filtering Platform filter has blocked a packet.

      + +| Event ID | Event message | +| - | - | +| 5152 | The Windows Filtering Platform blocked a packet. | +| 5153 | A more restrictive Windows Filtering Platform filter has blocked a packet. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-filtering-platform-policy-change.md b/windows/keep-secure/audit-filtering-platform-policy-change.md index 07394011e0..97f04007ea 100644 --- a/windows/keep-secure/audit-filtering-platform-policy-change.md +++ b/windows/keep-secure/audit-filtering-platform-policy-change.md @@ -2,24 +2,33 @@ title: Audit Filtering Platform Policy Change (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Filtering Platform Policy Change, which determines whether the operating system generates audit events for certain IPsec and Windows Filtering Platform actions. ms.assetid: 0eaf1c56-672b-4ea9-825a-22dc03eb4041 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Filtering Platform Policy Change + **Applies to** - Windows 10 + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Filtering Platform Policy Change**, which determines whether the operating system generates audit events for certain IPsec and Windows Filtering Platform actions. + Windows Filtering Platform (WFP) enables independent software vendors (ISVs) to filter and modify TCP/IP packets, monitor or authorize connections, filter Internet Protocol security (IPsec)-protected traffic, and filter remote procedure calls (RPCs). + This security policy setting determines whether the operating system generates audit events for: + - IPsec services status. - Changes to IPsec settings. - Status and changes to the Windows Filtering Platform engine and providers. - IPsec Policy Agent service activities. + Event volume: Low + Default: Not configured + @@ -210,6 +219,7 @@ Default: Not configured
        ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-force-audit-policy-subcategory-settings-to-override.md b/windows/keep-secure/audit-force-audit-policy-subcategory-settings-to-override.md index dd5a17ef22..2ceff2fa34 100644 --- a/windows/keep-secure/audit-force-audit-policy-subcategory-settings-to-override.md +++ b/windows/keep-secure/audit-force-audit-policy-subcategory-settings-to-override.md @@ -2,90 +2,94 @@ title: Audit Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings (Windows 10) description: Describes the best practices, location, values, and security considerations for the Audit Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings security policy setting. ms.assetid: 8ddc06bc-b6d6-4bac-9051-e0d77035bd4e -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings** security policy setting. + ## Reference + You can manage your audit policy in a more precise way by using audit policy subcategories. + There are over 40 auditing subcategories that provide precise details about activities on a device. For info about these subcategories, see the [Advanced security audit policy settings](advanced-security-audit-policy-settings.md). + ### Possible values + - Enabled - Disabled + ### Best practices + - Leave the setting enabled. This provides the ability to audit events at the category level without revising a policy. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Enabled

      DC Effective Default Settings

      Enabled

      Member Server Effective Default Settings

      Enabled

      Client Computer Effective Default Settings

      Enabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined | +| Default Domain Controller Policy | Not defined | +| Stand-Alone Server Default Settings | Enabled | +| DC Effective Default Settings | Enabled | +| Member Server Effective Default Settings | Enabled | +| Client Computer Effective Default Settings | Enabled |   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Group Policy + All auditing capabilities are integrated in Group Policy. You can configure, deploy, and manage these settings in the Group Policy Management Console (GPMC) or Local Security Policy snap-in for a domain, site, or organizational unit (OU). + ### Auditing + To manage an audit policy by using subcategories without requiring a change to Group Policy, the SCENoApplyLegacyAuditPolicy registry value , prevents the application of category-level audit policy from Group Policy and from the Local Security Policy administrative tool. + If the category level audit policy that is set here is not consistent with the events that are currently being generated, the cause might be that this registry key is set. + ### Command-line tools + You can use auditpol.exe to display and manage audit policies from a command prompt. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Prior to the introduction of auditing subcategories in Windows Vista, it was difficult to track events at a per-system or per-user level. The larger event categories created too many events, and the key information that needed to be audited was difficult to find. + ### Countermeasure + Enable audit policy subcategories as needed to track specific events. + ### Potential impacts -If you attempt to modify an audit setting by using Group Policy after enabling this setting through the command-line tools, the Group Policy audit setting is ignored in favor of the custom policy setting. To modify audit settings by using Group Policy, you must first disable the **SCENoApplyLegacyAuditPolicy** key. -**Important**   -Be very cautious about audit settings that can generate a large volume of traffic. For example, if you enable success or failure auditing for all of the Privilege Use subcategories, the high volume of audit events that are generated can make it difficult to find other types of entries in the security event log. Such a configuration could also have a significant impact on system performance. + +If you attempt to modify an audit setting by using Group Policy after enabling this setting through the command-line tools, the Group Policy audit setting is ignored in favor of the custom policy setting. To modify audit settings by using Group Policy, you must first disable the +**SCENoApplyLegacyAuditPolicy** key. +> **Important:**  Be very cautious about audit settings that can generate a large volume of traffic. For example, if you enable success or failure auditing for all of the Privilege Use subcategories, the high volume of audit events that are generated can make it difficult to find other types of entries in the security event log. Such a configuration could also have a significant impact on system performance.   ## Related topics -[Security Options](security-options.md) + +- [Security Options](security-options.md)     diff --git a/windows/keep-secure/audit-group-membership.md b/windows/keep-secure/audit-group-membership.md index 795f24a6ef..bfbd5e7887 100644 --- a/windows/keep-secure/audit-group-membership.md +++ b/windows/keep-secure/audit-group-membership.md @@ -2,43 +2,37 @@ title: Audit Group Membership (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit Group Membership, which enables you to audit group memberships when they are enumerated on the client PC. ms.assetid: 1CD7B014-FBD9-44B9-9274-CC5715DE58B9 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Group Membership + **Applies to** - Windows 10 + This topic for the IT professional describes the advanced security audit policy setting, **Audit Group Membership**, which enables you to audit group memberships when they are enumerated on the client PC. + This policy allows you to audit the group membership information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. + For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. -**Note**  You must also enable the **Audit Logon** setting under **Advanced Audit Policy Configuration\\System Audit Policies\\Logon/Logoff**. +> **Note:**  You must also enable the **Audit Logon** setting under **Advanced Audit Policy Configuration\\System Audit Policies\\Logon/Logoff**.   Multiple events are generated if the group membership information cannot fit in a single security audit event + Event volume: High + Default: Not configured - ---- - - - - - - - - - - - - -
      Event IDEvent message

      4627

      Group membership information.

      + +| Event ID | Event message | +| - | - | +| 4627 | Group membership information. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-handle-manipulation.md b/windows/keep-secure/audit-handle-manipulation.md index e168f2a962..da8a48ee26 100644 --- a/windows/keep-secure/audit-handle-manipulation.md +++ b/windows/keep-secure/audit-handle-manipulation.md @@ -2,50 +2,37 @@ title: Audit Handle Manipulation (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Handle Manipulation, which determines whether the operating system generates audit events when a handle to an object is opened or closed. ms.assetid: 1fbb004a-ccdc-4c80-b3da-a4aa7a9f4091 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Handle Manipulation + **Applies to** - Windows 10 + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Handle Manipulation**, which determines whether the operating system generates audit events when a handle to an object is opened or closed. + Only objects with configured system access control lists (SACLs) generate these events, and only if the attempted handle operation matches the SACL. -**Important**   -Handle Manipulation events are generated only for object types where the corresponding File System or Registry Object Access subcategory is enabled. For more information, see [Audit File System](audit-file-system.md) or [Audit Registry](audit-registry.md). + +> **Important:**  Handle Manipulation events are generated only for object types where the corresponding File System or Registry Object Access subcategory is enabled. For more information, see [Audit File System](audit-file-system.md) or [Audit Registry](audit-registry.md).   + Event volume: High, depending on how SACLs are configured + Default: Not configured - ---- - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4656

      A handle to an object was requested.

      4658

      The handle to an object was closed.

      4690

      An attempt was made to duplicate a handle to an object.

      + +| Event ID | Event message | +| - | - | +| 4656 | A handle to an object was requested. | +| 4658 | The handle to an object was closed. | +| 4690 | An attempt was made to duplicate a handle to an object. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-ipsec-driver.md b/windows/keep-secure/audit-ipsec-driver.md index 7c7fd0de22..7394906faa 100644 --- a/windows/keep-secure/audit-ipsec-driver.md +++ b/windows/keep-secure/audit-ipsec-driver.md @@ -2,87 +2,53 @@ title: Audit IPsec Driver (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit IPsec Driver, which determines whether the operating system generates audit events for the activities of the IPsec driver. ms.assetid: c8b8c02f-5ad0-4ee5-9123-ea8cdae356a5 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit IPsec Driver + **Applies to** - Windows 10 + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit IPsec Driver**, which determines whether the operating system generates audit events for the activities of the IPsec driver. + The IPsec driver, using the IP Filter List from the active IPsec policy, watches for outbound IP packets that must be secured and inbound IP packets that must be verified and decrypted. This security policy setting reports on the following activities of the IPsec driver: + - Startup and shutdown of IPsec services. - Packets dropped due to integrity-check failure. - Packets dropped due to replay-check failure. - Packets dropped due to being in plaintext. - Packets received with an incorrect Security Parameter Index (SPI). (This can indicate malfunctioning hardware or interoperability problems.) - Failure to process IPsec filters. + A high rate of packet drops by the IPsec filter driver may indicate attempts to gain access to the network by unauthorized systems. + Failure to process IPsec filters poses a potential security risk because some network interfaces may not get the protection that is provided by the IPsec filter. + Event volume: Medium + Default: Not configured - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4960

      IPsec dropped an inbound packet that failed an integrity check. If this problem persists, it could indicate a network issue or that packets are being modified in transit to this computer. Verify that the packets sent from the remote computer are the same as those received by this computer. This error might also indicate interoperability problems with other IPsec implementations.

      4961

      IPsec dropped an inbound packet that failed a replay check. If this problem persists, it could indicate a replay attack against this computer.

      4962

      IPsec dropped an inbound packet that failed a replay check. The inbound packet had too low a sequence number to ensure it was not a replay.

      4963

      IPsec dropped an inbound clear text packet that should have been secured. This is usually due to the remote computer changing its IPsec policy without informing this computer. This could also be a spoofing attack attempt.

      4965

      IPsec received a packet from a remote computer with an incorrect Security Parameter Index (SPI). This is usually caused by malfunctioning hardware that is corrupting packets. If these errors persist, verify that the packets sent from the remote computer are the same as those received by this computer. This error may also indicate interoperability problems with other IPsec implementations. In that case, if connectivity is not impeded, then these events can be ignored.

      5478

      IPsec Services has started successfully.

      5479

      IPsec Services has been shut down successfully. The shutdown of IPsec Services can put the computer at greater risk of network attack or expose the computer to potential security risks.

      5480

      IPsec Services failed to get the complete list of network interfaces on the computer. This poses a potential security risk because some of the network interfaces may not get the protection provided by the applied IPsec filters. Use the IP Security Monitor snap-in to diagnose the problem.

      5483

      IPsec Services failed to initialize RPC server. IPsec Services could not be started.

      5484

      IPsec Services has experienced a critical failure and has been shut down. The shutdown of IPsec Services can put the computer at greater risk of network attack or expose the computer to potential security risks.

      5485

      IPsec Services failed to process some IPsec filters on a plug-and-play event for network interfaces. This poses a potential security risk because some of the network interfaces may not get the protection provided by the applied IPsec filters. Use the IP Security Monitor snap-in to diagnose the problem.

      + +| Event ID | Event message | +| - | - | +| 4960 | IPsec dropped an inbound packet that failed an integrity check. If this problem persists, it could indicate a network issue or that packets are being modified in transit to this computer. Verify that the packets sent from the remote computer are the same as those received by this computer. This error might also indicate interoperability problems with other IPsec implementations. | +| 4961 | IPsec dropped an inbound packet that failed a replay check. If this problem persists, it could indicate a replay attack against this computer. | +| 4962 | IPsec dropped an inbound packet that failed a replay check. The inbound packet had too low a sequence number to ensure it was not a replay. | +| 4963 | IPsec dropped an inbound clear text packet that should have been secured. This is usually due to the remote computer changing its IPsec policy without informing this computer. This could also be a spoofing attack attempt. | +| 4965 | IPsec received a packet from a remote computer with an incorrect Security Parameter Index (SPI). This is usually caused by malfunctioning hardware that is corrupting packets. If these errors persist, verify that the packets sent from the remote computer are the same as those received by this computer. This error may also indicate interoperability problems with other IPsec implementations. In that case, if connectivity is not impeded, then these events can be ignored. | +| 5478 | IPsec Services has started successfully. | +| 5479 | IPsec Services has been shut down successfully. The shutdown of IPsec Services can put the computer at greater risk of network attack or expose the computer to potential security risks. | +| 5480 | IPsec Services failed to get the complete list of network interfaces on the computer. This poses a potential security risk because some of the network interfaces may not get the protection provided by the applied IPsec filters. Use the IP Security Monitor snap-in to diagnose the problem. | +| 5483 | IPsec Services failed to initialize RPC server. IPsec Services could not be started. | +| 5484 | IPsec Services has experienced a critical failure and has been shut down. The shutdown of IPsec Services can put the computer at greater risk of network attack or expose the computer to potential security risks. | +| 5485 | IPsec Services failed to process some IPsec filters on a plug-and-play event for network interfaces. This poses a potential security risk because some of the network interfaces may not get the protection provided by the applied IPsec filters. Use the IP Security Monitor snap-in to diagnose the problem. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-ipsec-extended-mode.md b/windows/keep-secure/audit-ipsec-extended-mode.md index 9b316c69be..89f0857940 100644 --- a/windows/keep-secure/audit-ipsec-extended-mode.md +++ b/windows/keep-secure/audit-ipsec-extended-mode.md @@ -2,106 +2,41 @@ title: Audit IPsec Extended Mode (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit IPsec Extended Mode, which determines whether the operating system generates audit events for the results of the Internet Key Exchange (IKE) protocol and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. ms.assetid: 2b4fee9e-482a-4181-88a8-6a79d8fc8049 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit IPsec Extended Mode + **Applies to** - Windows 10 + This topic for the IT professional describes the advanced security audit policy setting, **Audit IPsec Extended Mode**, which determines whether the operating system generates audit events for the results of the Internet Key Exchange (IKE) protocol and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. + IKE is an Internet standard, defined in RFC 2409, that defines a mechanism to establish IPsec security associations (SAs). An SA is a combination of a mutually agreeable policy and keys that define the security services and mechanisms that help protect communication between IPsec peers. -AuthIP is an enhanced version of IKE that offers additional flexibility with support for user-based authentication, authentication with multiple credentials, improved authentication method negotiation, and asymmetric authentication. Like IKE, AuthIP supports main-mode and quick-mode negotiation. AuthIP also supports Extended Mode, a part of IPsec peer negotiation during which a second round of authentication can be performed. Extended Mode, which is optional, can be used for multiple authentications. For example, with extended mode you can perform separate computer-based and user-based authentications. + +AuthIP is an enhanced version of IKE that offers additional flexibility with support for user-based authentication, authentication with multiple credentials, improved authentication method negotiation, and asymmetric authentication. Like IKE, AuthIP supports main-mode and quick-mode negotiation. +AuthIP also supports Extended Mode, a part of IPsec peer negotiation during which a second round of authentication can be performed. Extended Mode, which is optional, can be used for multiple authentications. For example, with extended mode you can perform separate computer-based and user-based authentications. + Event volume: High + Default: Not configured - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4978

      During Extended Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation.

      4979

      IPsec Main Mode and Extended Mode security associations were established.

      -
      -Note   -

      This event provides event data in the following categories: Main Mode Local Endpoint, Main Mode Remote Endpoint, Main Mode Cryptographic Information, Main Mode Security Association, Main Mode Additional Information, and Extended Mode Information.

      -
      -
      -  -

      4980

      IPsec Main Mode and Extended Mode security associations were established.

      -
      -Note   -

      This event provides event audit data in the following categories: Main Mode Local Endpoint, Main Mode Remote Endpoint. Main Mode Cryptographic Information, Main Mode Security Association, Main Mode Additional Information, Extended Mode Local Endpoint, Extended Mode Remote Endpoint, and Extended Mode Additional Information:

      -
      -
      -  -

      4981

      IPsec Main Mode and Extended Mode security associations were established.

      -
      -Note   -

      This event provides event audit data in the following categories: Local Endpoint, Local Certificate, Remote Endpoint, Remote Certificate, Cryptographic Information, Security Association Information, Additional Information, and Extended Mode Information.

      -
      -
      -  -

      4982

      IPsec Main Mode and Extended Mode security associations were established.

      -
      -Note   -

      This event provides event audit data in the following categories: Local Endpoint, Local Certificate, Remote Endpoint, Remote Certificate, Cryptographic Information, Security Association Information, Additional Information, Extended Mode Local Endpoint, Extended Mode Remote Endpoint, and Extended Mode Additional Information.

      -
      -
      -  -

      4983

      An IPsec Extended Mode negotiation failed. The corresponding Main Mode security association has been deleted.

      -
      -Note   -

      This event provides event audit data in the following categories: Local Endpoint, Local Certificate, Remote Endpoint, Remote Certificate, and Failure Information.

      -
      -
      -  -

      4984

      An IPsec Extended Mode negotiation failed. The corresponding Main Mode security association has been deleted.

      -
      -Note   -

      This event provides event audit data in the following categories: Local Endpoint, Remote Endpoint, Additional Information, and Failure Information.

      -
      -
      -  -
      + +| Event ID | Event message | +| - | - | +| 4978 | During Extended Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation. | +| 4979 | IPsec Main Mode and Extended Mode security associations were established.
      **Note:** This event provides event data in the following categories: Main Mode Local Endpoint, Main Mode Remote Endpoint, Main Mode Cryptographic Information, Main Mode Security Association, Main Mode Additional Information, and Extended Mode Information. | +| 4980 | IPsec Main Mode and Extended Mode security associations were established.
      **Note:** This event provides event audit data in the following categories: Main Mode Local Endpoint, Main Mode Remote Endpoint. Main Mode Cryptographic Information, Main Mode Security Association, Main Mode Additional Information, Extended Mode Local Endpoint, Extended Mode Remote Endpoint, and Extended Mode Additional Information: | +| 4981 | IPsec Main Mode and Extended Mode security associations were established.
      **Note:** This event provides event audit data in the following categories: Local Endpoint, Local Certificate, Remote Endpoint, Remote Certificate, Cryptographic Information, Security Association Information, Additional Information, and Extended Mode Information. | +| 4982 | IPsec Main Mode and Extended Mode security associations were established.
      **Note:** This event provides event audit data in the following categories: Local Endpoint, Local Certificate, Remote Endpoint, Remote Certificate, Cryptographic Information, Security Association Information, Additional Information, Extended Mode Local Endpoint, Extended Mode Remote Endpoint, and Extended Mode Additional Information. | +| 4983 | An IPsec Extended Mode negotiation failed. The corresponding Main Mode security association has been deleted.
      **Note:** This event provides event audit data in the following categories: Local Endpoint, Local Certificate, Remote Endpoint, Remote Certificate, and Failure Information. | +| 4984 | An IPsec Extended Mode negotiation failed. The corresponding Main Mode security association has been deleted.
      **Note:** This event provides event audit data in the following categories: Local Endpoint, Remote Endpoint, Additional Information, and Failure Information. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-ipsec-main-mode.md b/windows/keep-secure/audit-ipsec-main-mode.md index 2f62f592fd..203307a841 100644 --- a/windows/keep-secure/audit-ipsec-main-mode.md +++ b/windows/keep-secure/audit-ipsec-main-mode.md @@ -2,87 +2,42 @@ title: Audit IPsec Main Mode (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit IPsec Main Mode, which determines whether the operating system generates events for the results of the Internet Key Exchange (IKE) protocol and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. ms.assetid: 06ed26ec-3620-4ef4-a47a-c70df9c8827b -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit IPsec Main Mode + **Applies to** - Windows 10 + This topic for the IT professional describes the advanced security audit policy setting, **Audit IPsec Main Mode**, which determines whether the operating system generates events for the results of the Internet Key Exchange (IKE) protocol and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. + IKE is an Internet standard, defined in RFC 2409, that defines a mechanism to establish IPsec security associations (SAs). An SA is a combination of a mutually agreeable policy and keys that define the security services and mechanisms that help protect communication between IPsec peers. AuthIP is an enhanced version of IKE that offers additional flexibility with support for user-based authentication, authentication with multiple credentials, improved authentication method negotiation, and asymmetric authentication. Like IKE, AuthIP supports Main Mode and Quick Mode negotiation. Main Mode Internet Key Exchange (IKE) negotiation establishes a secure channel, known as the Internet Security Association and Key Management Protocol (ISAKMP) security association (SA), between two computers. To establish the secure channel, Main Mode negotiation determines a set of cryptographic protection suites, exchanges keying material to establish the shared secret key, and authenticates computer identities. + Event volume: High + Default: Not configured - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4646

      Security ID: %1

      4650

      An IPsec Main Mode security association was established. Extended Mode was not enabled. Certificate authentication was not used.

      4651

      An IPsec Main Mode security association was established. Extended Mode was not enabled. A certificate was used for authentication.

      4652

      An IPsec Main Mode negotiation failed.

      -
      -Note   -

      This audit event returns detailed audit data in the following categories: Local Endpoint, Local Certificate, Remote Endpoint, Remote Certificate, Additional Information, and Failure Information.

      -
      -
      -  -

      4653

      An IPsec Main Mode negotiation failed.

      -
      -Note   -

      This audit event returns detailed audit data in the following categories: Local Endpoint, Remote Endpoint, Additional Information, and Failure Information.

      -
      -
      -  -

      4655

      An IPsec Main Mode security association ended.

      4976

      During Main Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation.

      5049

      An IPsec Security Association was deleted.

      5453

      An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started.

      + +| Event ID | Event message | +| - | - | +| 4646 | Security ID: %1 | +| 4650 | An IPsec Main Mode security association was established. Extended Mode was not enabled. Certificate authentication was not used. | +| 4651 | An IPsec Main Mode security association was established. Extended Mode was not enabled. A certificate was used for authentication. | +| 4652 | An IPsec Main Mode negotiation failed.
      **Note:** This audit event returns detailed audit data in the following categories: Local Endpoint, Local Certificate, Remote Endpoint, Remote Certificate, Additional Information, and Failure Information. | +| 4653 | An IPsec Main Mode negotiation failed.
      **Note:** This audit event returns detailed audit data in the following categories: Local Endpoint, Remote Endpoint, Additional Information, and Failure Information. | +| 4655 | An IPsec Main Mode security association ended. | +| 4976 | During Main Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation. | +| 5049 | An IPsec Security Association was deleted. | +| 5453 | An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-ipsec-quick-mode.md b/windows/keep-secure/audit-ipsec-quick-mode.md index 969ea8f4d6..79de06ad17 100644 --- a/windows/keep-secure/audit-ipsec-quick-mode.md +++ b/windows/keep-secure/audit-ipsec-quick-mode.md @@ -2,49 +2,36 @@ title: Audit IPsec Quick Mode (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit IPsec Quick Mode, which determines whether the operating system generates audit events for the results of the Internet Key Exchange (IKE) protocol and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. ms.assetid: 7be67a15-c2ce-496a-9719-e25ac7699114 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit IPsec Quick Mode + **Applies to** - Windows 10 + This topic for the IT professional describes the advanced security audit policy setting, **Audit IPsec Quick Mode**, which determines whether the operating system generates audit events for the results of the Internet Key Exchange (IKE) protocol and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. + IKE is an Internet standard, defined in RFC 2409, that defines a mechanism to establish IPsec security associations (SAs). An SA is a combination of a mutually agreeable policy and keys that define the security services and mechanisms that help protect communication between IPsec peers. AuthIP is an enhanced version of IKE that offers additional flexibility with support for user-based authentication, authentication with multiple credentials, improved authentication method negotiation, and asymmetric authentication. Like IKE, AuthIP supports Main Mode and Quick Mode negotiation. Quick Mode (also known as Phase 2) IKE negotiation establishes a secure channel between two computers to protect data. Because this phase involves the establishment of security associations (SAs) that are negotiated on behalf of the IPsec service, the SAs that are created during Quick Mode are called the IPsec SAs. During Quick Mode, keying material is refreshed or, if necessary, new keys are generated. A protection suite that protects specified IP traffic is also selected. A protection suite is a defined set of data integrity or data encryption settings. Quick Mode is not considered a complete exchange because it is dependent on a Main Mode exchange. + Event volume: High + Default: Not configured - ---- - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4977

      During Quick Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation.

      5451

      An IPsec Quick Mode security association was established.

      5452

      An IPsec Quick Mode security association ended.

      + +| Event ID | Event message | +|- |- | +| 4977 | During Quick Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation.| +| 5451 | An IPsec Quick Mode security association was established.| +| 5452 | An IPsec Quick Mode security association ended.|   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-kerberos-authentication-service.md b/windows/keep-secure/audit-kerberos-authentication-service.md index 59067e3f7a..85498b7404 100644 --- a/windows/keep-secure/audit-kerberos-authentication-service.md +++ b/windows/keep-secure/audit-kerberos-authentication-service.md @@ -2,48 +2,35 @@ title: Audit Kerberos Authentication Service (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Kerberos Authentication Service, which determines whether to generate audit events for Kerberos authentication ticket-granting ticket (TGT) requests. ms.assetid: 990dd6d9-1a1f-4cce-97ba-5d7e0a7db859 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Kerberos Authentication Service + **Applies to** - Windows 10 - Windows 10 Mobile + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Kerberos Authentication Service**, which determines whether to generate audit events for Kerberos authentication ticket-granting ticket (TGT) requests. + If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT request. Success audits record successful attempts and Failure audits record unsuccessful attempts. + Event volume: High on Kerberos Key Distribution Center servers + Default: Not configured - ---- - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4768

      A Kerberos authentication ticket (TGT) was requested.

      4771

      Kerberos preauthentication failed.

      4772

      A Kerberos authentication ticket request failed.

      + +| Event ID | Event message | +| - | - | +| 4768 | A Kerberos authentication ticket (TGT) was requested. | +| 4771 | Kerberos preauthentication failed. | +| 4772 | A Kerberos authentication ticket request failed. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-kerberos-service-ticket-operations.md b/windows/keep-secure/audit-kerberos-service-ticket-operations.md index b174f61378..5f00cf260a 100644 --- a/windows/keep-secure/audit-kerberos-service-ticket-operations.md +++ b/windows/keep-secure/audit-kerberos-service-ticket-operations.md @@ -2,46 +2,37 @@ title: Audit Kerberos Service Ticket Operations (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Kerberos Service Ticket Operations, which determines whether the operating system generates security audit events for Kerberos service ticket requests. ms.assetid: ddc0abef-ac7f-4849-b90d-66700470ccd6 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Kerberos Service Ticket Operations + **Applies to** - Windows 10 - Windows 10 Mobile + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Kerberos Service Ticket Operations**, which determines whether the operating system generates security audit events for Kerberos service ticket requests. + Events are generated every time Kerberos is used to authenticate a user who wants to access a protected network resource. Kerberos service ticket operation audit events can be used to track user activity. + Event volume: + - High on a domain controller that is in a Key Distribution Center (KDC) - Low on domain members + Default: Not configured - ---- - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4769

      A Kerberos service ticket was requested.

      4770

      A Kerberos service ticket was renewed.

      + +| Event ID | Event message | +| - | - | +| 4769 | A Kerberos service ticket was requested. | +| 4770 | A Kerberos service ticket was renewed. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-kernel-object.md b/windows/keep-secure/audit-kernel-object.md index 646f5f6d75..783f4c3e18 100644 --- a/windows/keep-secure/audit-kernel-object.md +++ b/windows/keep-secure/audit-kernel-object.md @@ -2,56 +2,40 @@ title: Audit Kernel Object (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Kernel Object, which determines whether the operating system generates audit events when users attempt to access the system kernel, which includes mutexes and semaphores. ms.assetid: 75619d8b-b1eb-445b-afc9-0f9053be97fb -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Kernel Object + **Applies to** - Windows 10 - Windows 10 Mobile + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Kernel Object**, which determines whether the operating system generates audit events when users attempt to access the system kernel, which includes mutexes and semaphores. + Only kernel objects with a matching system access control list (SACL) generate security audit events. The audits generated are usually useful only to developers. + Typically, kernel objects are given SACLs only if the **AuditBaseObjects** or **AuditBaseDirectories** auditing options are enabled. -**Note**   -The **Audit: Audit the access of global system objects** policy setting controls the default SACL of kernel objects. + +> **Note:**  The **Audit: Audit the access of global system objects** policy setting controls the default SACL of kernel objects.   Event volume: High if you have enabled one of the Global Object Access Auditing settings + Default setting: Not configured - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4659

      A handle to an object was requested with intent to delete.

      4660

      An object was deleted.

      4661

      A handle to an object was requested.

      4663

      An attempt was made to access an object.

      + +| Event ID | Event message | +| - | - | +| 4659 | A handle to an object was requested with intent to delete. | +| 4660 | An object was deleted. | +| 4661 | A handle to an object was requested. | +| 4663 | An attempt was made to access an object. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-logoff.md b/windows/keep-secure/audit-logoff.md index feac0833b9..05aee8928a 100644 --- a/windows/keep-secure/audit-logoff.md +++ b/windows/keep-secure/audit-logoff.md @@ -2,48 +2,38 @@ title: Audit Logoff (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Logoff, which determines whether the operating system generates audit events when logon sessions are terminated. ms.assetid: 681e51f2-ba06-46f5-af8c-d9c48d515432 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Logoff + **Applies to** - Windows 10 - Windows 10 Mobile + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Logoff**, which determines whether the operating system generates audit events when logon sessions are terminated. + These events occur on the computer that was accessed. In the case of an interactive logon, these events are generated on the computer that was logged on to. -**Note**   -There is no failure event in this subcategory because failed logoffs (such as when a system abruptly shuts down) do not generate an audit record. + +> **Note: **  There is no failure event in this subcategory because failed logoffs (such as when a system abruptly shuts down) do not generate an audit record.   Logon events are essential to understanding user activity and detecting potential attacks. Logoff events are not 100 percent reliable. For example, the computer can be turned off without a proper logoff and shutdown; in this case, a logoff event is not generated. + Event volume: Low + Default: Success - ---- - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4634

      An account was logged off.

      4647

      User initiated logoff.

      + +| Event ID | Event message | +| - | - | +| 4634 | An account was logged off. | +| 4647 | User initiated logoff. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-logon.md b/windows/keep-secure/audit-logon.md index 396d8cc641..fb98f6691c 100644 --- a/windows/keep-secure/audit-logon.md +++ b/windows/keep-secure/audit-logon.md @@ -2,57 +2,44 @@ title: Audit Logon (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Logon, which determines whether the operating system generates audit events when a user attempts to log on to a computer. ms.assetid: ca968d03-7d52-48c4-ba0e-2bcd2937231b -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Logon + **Applies to** - Windows 10 - Windows 10 Mobile + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Logon**, which determines whether the operating system generates audit events when a user attempts to log on to a computer. + These events are related to the creation of logon sessions and occur on the computer that was accessed. For an interactive logon, events are generated on the computer that was logged on to. For a network logon, such as accessing a share, events are generated on the computer that hosts the resource that was accessed. + The following events are recorded: + - Logon success and failure. - Logon attempts by using explicit credentials. This event is generated when a process attempts to log on an account by explicitly specifying that account's credentials. This most commonly occurs in batch configurations such as scheduled tasks, or when using the Runas command. - Security identifiers (SIDs) are filtered. + Logon events are essential to tracking user activity and detecting potential attacks. + Event volume: Low on a client computer; medium on a domain controller or network server + Default: Success for client computers; success and failure for servers - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4624

      An account was successfully logged on.

      4625

      An account failed to log on.

      4648

      A logon was attempted using explicit credentials.

      4675

      SIDs were filtered.

      + +| Event ID | Event message | +| - | - | +| 4624 | An account was successfully logged on. | +| 4625 | An account failed to log on. | +| 4648 | A logon was attempted using explicit credentials. | +| 4675 | SIDs were filtered. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-mpssvc-rule-level-policy-change.md b/windows/keep-secure/audit-mpssvc-rule-level-policy-change.md index c038f872bd..67760b944f 100644 --- a/windows/keep-secure/audit-mpssvc-rule-level-policy-change.md +++ b/windows/keep-secure/audit-mpssvc-rule-level-policy-change.md @@ -2,98 +2,54 @@ title: Audit MPSSVC Rule-Level Policy Change (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit MPSSVC Rule-Level Policy Change, which determines whether the operating system generates audit events when changes are made to policy rules for the Microsoft Protection Service (MPSSVC.exe). ms.assetid: 263461b3-c61c-4ec3-9dee-851164845019 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit MPSSVC Rule-Level Policy Change + **Applies to** - Windows 10 + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit MPSSVC Rule-Level Policy Change**, which determines whether the operating system generates audit events when changes are made to policy rules for the Microsoft Protection Service (MPSSVC.exe). + The Microsoft Protection Service, which is used by Windows Firewall, is an integral part of the computer’s threat protection against malware. The tracked activities include: + - Active policies when the Windows Firewall service starts. - Changes to Windows Firewall rules. - Changes to the Windows Firewall exception list. - Changes to Windows Firewall settings. - Rules ignored or not applied by the Windows Firewall service. - Changes to Windows Firewall Group Policy settings. + Changes to firewall rules are important for understanding the security state of the computer and how well it is protected against network attacks. + Event volume: Low + Default: Not configured - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4944

      The following policy was active when the Windows Firewall started.

      4945

      A rule was listed when the Windows Firewall started.

      4946

      A change has been made to Windows Firewall exception list. A rule was added.

      4947

      A change has been made to Windows Firewall exception list. A rule was modified.

      4948

      A change has been made to Windows Firewall exception list. A rule was deleted.

      4949

      Windows Firewall settings were restored to the default values.

      4950

      A Windows Firewall setting has changed.

      4951

      A rule has been ignored because its major version number was not recognized by Windows Firewall.

      4952

      Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall. The other parts of the rule will be enforced.

      4953

      A rule has been ignored by Windows Firewall because it could not parse the rule.

      4954

      Windows Firewall Group Policy settings have changed. The new settings have been applied.

      4956

      Windows Firewall has changed the active profile.

      4957

      Windows Firewall did not apply the following rule:

      4958

      Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer:

      + +| Event ID | Event message | +| - | - | +| 4944 | The following policy was active when the Windows Firewall started. | +| 4945 | A rule was listed when the Windows Firewall started. | +| 4946 | A change has been made to Windows Firewall exception list. A rule was added. | +| 4947 | A change has been made to Windows Firewall exception list. A rule was modified. | +| 4948 | A change has been made to Windows Firewall exception list. A rule was deleted. | +| 4949 | Windows Firewall settings were restored to the default values. | +| 4950 | A Windows Firewall setting has changed. | +| 4951 | A rule has been ignored because its major version number was not recognized by Windows Firewall. | +| 4952 | Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall. The other parts of the rule will be enforced. | +| 4953 | A rule has been ignored by Windows Firewall because it could not parse the rule. | +| 4954 | Windows Firewall Group Policy settings have changed. The new settings have been applied. | +| 4956 | Windows Firewall has changed the active profile. | +| 4957 | Windows Firewall did not apply the following rule: | +| 4958 | Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer: |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-network-policy-server.md b/windows/keep-secure/audit-network-policy-server.md index 1a7b659ed3..5f060ff57e 100644 --- a/windows/keep-secure/audit-network-policy-server.md +++ b/windows/keep-secure/audit-network-policy-server.md @@ -2,71 +2,40 @@ title: Audit Network Policy Server (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Network Policy Server, which determines whether the operating system generates audit events for RADIUS (IAS) and Network Access Protection (NAP) activity on user access requests (Grant, Deny, Discard, Quarantine, Lock, and Unlock). ms.assetid: 43b2aea4-26df-46da-b761-2b30f51a80f7 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Network Policy Server + **Applies to** - Windows 10 + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Network Policy Server**, which determines whether the operating system generates audit events for RADIUS (IAS) and Network Access Protection (NAP) activity on user access requests (Grant, Deny, Discard, Quarantine, Lock, and Unlock). + NAP events can be used to help understand the overall health of the network. + Event volume: Medium to high on servers that are running Network Policy Server (NPS); moderate on other servers or on client computers + Default: Success and failure - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      6272

      Network Policy Server granted access to a user.

      6273

      Network Policy Server denied access to a user.

      6274

      Network Policy Server discarded the request for a user.

      6275

      Network Policy Server discarded the accounting request for a user.

      6276

      Network Policy Server quarantined a user.

      6277

      Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy.

      6278

      Network Policy Server granted full access to a user because the host met the defined health policy.

      6279

      Network Policy Server locked the user account due to repeated failed authentication attempts.

      6280

      Network Policy Server unlocked the user account.

      + +| Event ID | Event message | +| - | - | +| 6272 | Network Policy Server granted access to a user. | +| 6273 | Network Policy Server denied access to a user. | +| 6274 | Network Policy Server discarded the request for a user. | +| 6275 | Network Policy Server discarded the accounting request for a user. | +| 6276 | Network Policy Server quarantined a user. | +| 6277 | Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy. | +| 6278 | Network Policy Server granted full access to a user because the host met the defined health policy. | +| 6279 | Network Policy Server locked the user account due to repeated failed authentication attempts. | +| 6280 | Network Policy Server unlocked the user account. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-non-sensitive-privilege-use.md b/windows/keep-secure/audit-non-sensitive-privilege-use.md index 086e940d66..e1321ebc6a 100644 --- a/windows/keep-secure/audit-non-sensitive-privilege-use.md +++ b/windows/keep-secure/audit-non-sensitive-privilege-use.md @@ -2,17 +2,22 @@ title: Audit Non-Sensitive Privilege Use (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Non-Sensitive Privilege Use, which determines whether the operating system generates audit events when non-sensitive privileges (user rights) are used. ms.assetid: 8fd74783-1059-443e-aa86-566d78606627 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Non-Sensitive Privilege Use + **Applies to** - Windows 10 + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Non-Sensitive Privilege Use**, which determines whether the operating system generates audit events when non-sensitive privileges (user rights) are used. + The following privileges are non-sensitive: + - **Access Credential Manager as a trusted caller** - **Access this computer from the network** - **Add workstations to domain** @@ -43,37 +48,21 @@ The following privileges are non-sensitive: - **Remove computer from docking station** - **Shut down the system** - **Synchronize directory service data** + If you configure this policy setting, an audit event is generated when a non-sensitive privilege is called. Success audits record successful attempts, and failure audits record unsuccessful attempts. + Event volume: Very high + Default: Not configured - ---- - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4672

      Special privileges assigned to new logon.

      4673

      A privileged service was called.

      4674

      An operation was attempted on a privileged object.

      + +| Event ID | Event message | +| - | - | +| 4672 | Special privileges assigned to new logon. | +| 4673 | A privileged service was called. | +| 4674 | An operation was attempted on a privileged object. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-other-account-logon-events.md b/windows/keep-secure/audit-other-account-logon-events.md index d924a8af0d..57eaa771fa 100644 --- a/windows/keep-secure/audit-other-account-logon-events.md +++ b/windows/keep-secure/audit-other-account-logon-events.md @@ -2,86 +2,53 @@ title: Audit Other Account Logon Events (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit Other Account Logon Events, which allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets. ms.assetid: c8c6bfe0-33d2-4600-bb1a-6afa840d75b3 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Other Account Logon Events + **Applies to** - Windows 10 + This topic for the IT professional describes the advanced security audit policy setting, **Audit Other Account Logon Events**, which allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets. + Examples can include the following: + - Remote Desktop session disconnections - New Remote Desktop sessions - Locking and unlocking a workstation - Invoking a screen saver - Dismissing a screen saver - Detection of a Kerberos replay attack, in which a Kerberos request with identical information was received twice - **Note**   - This condition could be caused by a network misconfiguration. + + > **Note:**  This condition could be caused by a network misconfiguration.   - Access to a wireless network granted to a user or computer account - Access to a wired 802.1x network granted to a user or computer account + Event volume: Varies, depending on system use + Default: Not configured - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4649

      A replay attack was detected.

      4778

      A session was reconnected to a Window Station.

      4779

      A session was disconnected from a Window Station.

      4800

      The workstation was locked.

      4801

      The workstation was unlocked.

      4802

      The screen saver was invoked.

      4803

      The screen saver was dismissed.

      5378

      The requested credentials delegation was disallowed by policy.

      5632

      A request was made to authenticate to a wireless network.

      5633

      A request was made to authenticate to a wired network.

      + +| Event ID | Event message | +| - | - | +| 4649 | A replay attack was detected. | +| 4778 | A session was reconnected to a Window Station. | +| 4779 | A session was disconnected from a Window Station. | +| 4800 | The workstation was locked. | +| 4801 | The workstation was unlocked. | +| 4802 | The screen saver was invoked. | +| 4803 | The screen saver was dismissed. | +| 5378 | The requested credentials delegation was disallowed by policy. | +| 5632 | A request was made to authenticate to a wireless network. | +| 5633 | A request was made to authenticate to a wired network. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-other-account-management-events.md b/windows/keep-secure/audit-other-account-management-events.md index a5929d83f0..737c91e478 100644 --- a/windows/keep-secure/audit-other-account-management-events.md +++ b/windows/keep-secure/audit-other-account-management-events.md @@ -2,49 +2,38 @@ title: Audit Other Account Management Events (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Other Account Management Events, which determines whether the operating system generates user account management audit events. ms.assetid: 4ce22eeb-a96f-4cf9-a46d-6642961a31d5 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Other Account Management Events + **Applies to** - Windows 10 + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Other Account Management Events**, which determines whether the operating system generates user account management audit events. + Events can be generated for user account management auditing when: + - The password hash of an account is accessed. This typically happens when the Active Directory Migration Tool (ADMT) is moving password data. - The Password Policy Checking application programming interface (API) is called. Calls to this function could be part of an attack from a malicious application that is testing whether password complexity policy settings are being applied. - Changes are made to domain policy under **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy** or **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Account Lockout Policy**. -**Note**   -These events are logged when the domain policy is applied (on refresh or restart), not when settings are modified by an administrator. +> **Note:**  These events are logged when the domain policy is applied (on refresh or restart), not when settings are modified by an administrator.   Event volume: Low + Default: Not configured - ---- - - - - - - - - - - - - - - - - -
      Event IDEvent Message Summary

      4782

      The password hash for an account was accessed.

      4793

      The Password Policy Checking API was called.

      + +| Event ID | Event message | +| - | - | +| 4782 | The password hash for an account was accessed. | +| 4793 | The Password Policy Checking API was called. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-other-logonlogoff-events.md b/windows/keep-secure/audit-other-logonlogoff-events.md index d1068bc02c..14b371601d 100644 --- a/windows/keep-secure/audit-other-logonlogoff-events.md +++ b/windows/keep-secure/audit-other-logonlogoff-events.md @@ -2,82 +2,50 @@ title: Audit Other Logon/Logoff Events (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Other Logon/Logoff Events, which determines whether Windows generates audit events for other logon or logoff events. ms.assetid: 76d987cd-1917-4907-a739-dd642609a458 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Other Logon/Logoff Events + **Applies to** - Windows 10 + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Other Logon/Logoff Events**, which determines whether Windows generates audit events for other logon or logoff events. + These other logon or logoff events include: + - A Remote Desktop session connects or disconnects. - A workstation is locked or unlocked. - A screen saver is invoked or dismissed. - A replay attack is detected. This event indicates that a Kerberos request was received twice with identical information. This condition could also be caused by network misconfiguration. - A user is granted access to a wireless network. It can either be a user account or the computer account. - A user is granted access to a wired 802.1x network. It can either be a user account or the computer account. + Logon events are essential to understanding user activity and detecting potential attacks. + Event volume: Low + Default: Not configured - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4649

      A replay attack was detected.

      4778

      A session was reconnected to a Window Station.

      4779

      A session was disconnected from a Window Station.

      4800

      The workstation was locked.

      4801

      The workstation was unlocked.

      4802

      The screen saver was invoked.

      4803

      The screen saver was dismissed.

      5378

      The requested credentials delegation was disallowed by policy.

      5632

      A request was made to authenticate to a wireless network.

      5633

      A request was made to authenticate to a wired network.

      + +| Event ID | Event message | +| - | - | +| 4649 | A replay attack was detected. | +| 4778 | A session was reconnected to a Window Station. | +| 4779 | A session was disconnected from a Window Station. | +| 4800 | The workstation was locked. | +| 4801 | The workstation was unlocked. | +| 4802 | The screen saver was invoked. | +| 4803 | The screen saver was dismissed. | +| 5378 | The requested credentials delegation was disallowed by policy. | +| 5632 | A request was made to authenticate to a wireless network. | +| 5633 | A request was made to authenticate to a wired network. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-other-object-access-events.md b/windows/keep-secure/audit-other-object-access-events.md index 0a0b4e92c2..71b1ee1965 100644 --- a/windows/keep-secure/audit-other-object-access-events.md +++ b/windows/keep-secure/audit-other-object-access-events.md @@ -2,92 +2,55 @@ title: Audit Other Object Access Events (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Other Object Access Events, which determines whether the operating system generates audit events for the management of Task Scheduler jobs or COM+ objects. ms.assetid: b9774595-595d-4199-b0c5-8dbc12b6c8b2 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Other Object Access Events + **Applies to** - Windows 10 + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Other Object Access Events**, which determines whether the operating system generates audit events for the management of Task Scheduler jobs or COM+ objects. + For scheduler jobs, the following actions are audited: + - Job created. - Job deleted. - Job enabled. - Job disabled. - Job updated. + For COM+ objects, the following actions are audited: + - Catalog object added. - Catalog object updated. - Catalog object deleted. + Event volume: Low + Default: Not configured - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4671

      An application attempted to access a blocked ordinal through the TBS.

      4691

      Indirect access to an object was requested.

      4698

      A scheduled task was created.

      4699

      A scheduled task was deleted.

      4700

      A scheduled task was enabled.

      4701

      A scheduled task was disabled.

      4702

      A scheduled task was updated.

      5148

      The Windows Filtering Platform has detected a DoS attack and entered a defensive mode; packets associated with this attack will be discarded.

      5149

      The DoS attack has subsided and normal processing is being resumed.

      5888

      An object in the COM+ Catalog was modified.

      5889

      An object was deleted from the COM+ Catalog.

      5890

      An object was added to the COM+ Catalog.

      + +| Event ID | Event message | +| - | - | +| 4671 | An application attempted to access a blocked ordinal through the TBS. | +| 4691 | Indirect access to an object was requested. | +| 4698 | A scheduled task was created. | +| 4699 | A scheduled task was deleted. | +| 4700 | A scheduled task was enabled. | +| 4701 | A scheduled task was disabled. | +| 4702 | A scheduled task was updated. | +| 5148 | The Windows Filtering Platform has detected a DoS attack and entered a defensive mode; packets associated with this attack will be discarded. | +| 5149 | The DoS attack has subsided and normal processing is being resumed. | +| 5888 | An object in the COM+ Catalog was modified. | +| 5889 | An object was deleted from the COM+ Catalog. | +| 5890 | An object was added to the COM+ Catalog. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-other-policy-change-events.md b/windows/keep-secure/audit-other-policy-change-events.md index 297f8250bb..7e2c53404a 100644 --- a/windows/keep-secure/audit-other-policy-change-events.md +++ b/windows/keep-secure/audit-other-policy-change-events.md @@ -2,95 +2,50 @@ title: Audit Other Policy Change Events (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Other Policy Change Events, which determines whether the operating system generates audit events for security policy changes that are not otherwise audited in the Policy Change category. ms.assetid: 8618502e-c21c-41cc-8a49-3dc1eb359e60 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Other Policy Change Events + **Applies to** - Windows 10 + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Other Policy Change Events**, which determines whether the operating system generates audit events for security policy changes that are not otherwise audited in the Policy Change category. + These other activities in the Policy Change category that can be audited include: + - Trusted Platform Module (TPM) configuration changes. - Kernel-mode cryptographic self tests. - Cryptographic provider operations. - Cryptographic context operations or modifications. + Event volume: Low + Default: Not configured - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4670

      Permissions on an object were changed.

      4909

      The local policy settings for the TBS were changed.

      4910

      The group policy settings for the TBS were changed.

      5063

      A cryptographic provider operation was attempted.

      5064

      A cryptographic context operation was attempted.

      5065

      A cryptographic context modification was attempted.

      5066

      A cryptographic function operation was attempted.

      5067

      A cryptographic function modification was attempted.

      5068

      A cryptographic function provider operation was attempted.

      5069

      A cryptographic function property operation was attempted.

      5070

      A cryptographic function property modification was attempted.

      5447

      A Windows Filtering Platform filter has been changed.

      6144

      Security policy in the group policy objects has been applied successfully.

      6145

      One or more errors occurred while processing security policy in the group policy objects.

      + +| Event ID | Event message | +| - | - | +| 4670 | Permissions on an object were changed. | +| 4909 | The local policy settings for the TBS were changed. | +| 4910 | The group policy settings for the TBS were changed. | +| 5063 | A cryptographic provider operation was attempted. | +| 5064 | A cryptographic context operation was attempted. | +| 5065 | A cryptographic context modification was attempted. | +| 5066 | A cryptographic function operation was attempted. | +| 5067 | A cryptographic function modification was attempted. | +| 5068 | A cryptographic function provider operation was attempted. | +| 5069 | A cryptographic function property operation was attempted. | +| 5070 | A cryptographic function property modification was attempted. | +| 5447 | A Windows Filtering Platform filter has been changed. | +| 6144 | Security policy in the group policy objects has been applied successfully. | +| 6145 | One or more errors occurred while processing security policy in the group policy objects. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-other-privilege-use-events.md b/windows/keep-secure/audit-other-privilege-use-events.md index 145e348e6e..839251f763 100644 --- a/windows/keep-secure/audit-other-privilege-use-events.md +++ b/windows/keep-secure/audit-other-privilege-use-events.md @@ -2,17 +2,21 @@ title: Audit Other Privilege Use Events (Windows 10) description: This security policy setting is not used. ms.assetid: 5f7f5b25-42a6-499f-8aa2-01ac79a2a63c -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Other Privilege Use Events + **Applies to** - Windows 10 + This security policy setting is not used. + ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-other-system-events.md b/windows/keep-secure/audit-other-system-events.md index 26c8610d85..2b28658209 100644 --- a/windows/keep-secure/audit-other-system-events.md +++ b/windows/keep-secure/audit-other-system-events.md @@ -2,129 +2,59 @@ title: Audit Other System Events (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Other System Events, which determines whether the operating system audits various system events. ms.assetid: 2401e4cc-d94e-41ec-82a7-e10914295f8b -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Other System Events + **Applies to** - Windows 10 + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Other System Events**, which determines whether the operating system audits various system events. + The system events in this category include: + - Startup and shutdown of the Windows Firewall service and driver. - Security policy processing by the Windows Firewall service. - Cryptography key file and migration operations. -**Important**   -Failure to start the Windows Firewall service may result in a computer that is not fully protected against network threats. + +> **Important:**  Failure to start the Windows Firewall service may result in a computer that is not fully protected against network threats.   Event volume: Low + Default: Success and failure - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      5024

      The Windows Firewall Service has started successfully.

      5025

      The Windows Firewall Service has been stopped.

      5027

      The Windows Firewall Service was unable to retrieve the security policy from the local storage. The service will continue enforcing the current policy.

      5028

      The Windows Firewall Service was unable to parse the new security policy. The service will continue with currently enforced policy.

      5029

      The Windows Firewall Service failed to initialize the driver. The service will continue to enforce the current policy.

      5030

      The Windows Firewall Service failed to start.

      5032

      Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network.

      5033

      The Windows Firewall Driver has started successfully.

      5034

      The Windows Firewall Driver has been stopped.

      5035

      The Windows Firewall Driver failed to start.

      5037

      The Windows Firewall Driver detected critical runtime error. Terminating.

      5058

      Key file operation.

      5059

      Key migration operation.

      6400

      BranchCache: Received an incorrectly formatted response while discovering availability of content.

      6401

      BranchCache: Received invalid data from a peer. Data discarded.

      6402

      BranchCache: The message to the hosted cache offering it data is incorrectly formatted.

      6403

      BranchCache: The hosted cache sent an incorrectly formatted response to the client.

      6404

      BranchCache: Hosted cache could not be authenticated using the provisioned SSL certificate.

      6405

      BranchCache: %2 instance(s) of event id %1 occurred.

      6406

      %1 registered to Windows Firewall to control filtering for the following: %2

      6407

      1%

      6408

      Registered product %1 failed and Windows Firewall is now controlling the filtering for %2

      + +| Event ID | Event message | +| - | - | +| 5024 | The Windows Firewall Service has started successfully. | +| 5025 | The Windows Firewall Service has been stopped. | +| 5027 | The Windows Firewall Service was unable to retrieve the security policy from the local storage. The service will continue enforcing the current policy. | +| 5028 | The Windows Firewall Service was unable to parse the new security policy. The service will continue with currently enforced policy. | +| 5029 | The Windows Firewall Service failed to initialize the driver. The service will continue to enforce the current policy. | +| 5030 | The Windows Firewall Service failed to start. | +| 5032 | Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network.| +| 5033 | The Windows Firewall Driver has started successfully. | +| 5034 | The Windows Firewall Driver has been stopped. | +| 5035 | The Windows Firewall Driver failed to start. | +| 5037 | The Windows Firewall Driver detected critical runtime error. Terminating.| +| 5058 | Key file operation. | +| 5059 | Key migration operation.| +| 6400 | BranchCache: Received an incorrectly formatted response while discovering availability of content.| +| 6401 | BranchCache: Received invalid data from a peer. Data discarded. | +| 6402 | BranchCache: The message to the hosted cache offering it data is incorrectly formatted.| +| 6403 | BranchCache: The hosted cache sent an incorrectly formatted response to the client. | +| 6404 | BranchCache: Hosted cache could not be authenticated using the provisioned SSL certificate.| +| 6405 | BranchCache: %2 instance(s) of event id %1 occurred. | +| 6406 | %1 registered to Windows Firewall to control filtering for the following: %2| +| 6407 | 1% | +| 6408 | Registered product %1 failed and Windows Firewall is now controlling the filtering for %2 |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-pnp-activity.md b/windows/keep-secure/audit-pnp-activity.md index b0b235fa4c..aef1c0ae47 100644 --- a/windows/keep-secure/audit-pnp-activity.md +++ b/windows/keep-secure/audit-pnp-activity.md @@ -2,40 +2,32 @@ title: Audit PNP Activity (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit PNP Activity, which determines when plug and play detects an external device. ms.assetid: A3D87B3B-EBBE-442A-953B-9EB75A5F600E -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit PNP Activity + **Applies to** - Windows 10 -\[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.\] + This topic for the IT professional describes the advanced security audit policy setting, **Audit PNP Activity**, which determines when plug and play detects an external device. + A PnP audit event can be used to track down changes in system hardware and will be logged on the machine where the change took place. For example, when a keyboard is plugged into a PC a PnP event is triggered. + Event volume: Varies, depending on how the computer is used + Default: Not configured - ---- - - - - - - - - - - - - -
      Event IDEvent message

      6416

      A new external device was recognized by the system.

      + +| Event ID | Event message | +| - | - | +| 6416 | A new external device was recognized by the system. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-policy.md b/windows/keep-secure/audit-policy.md index 8456383cb7..87cf555f43 100644 --- a/windows/keep-secure/audit-policy.md +++ b/windows/keep-secure/audit-policy.md @@ -2,29 +2,36 @@ title: Audit Policy (Windows 10) description: Provides information about basic audit policies that are available in Windows and links to information about each setting. ms.assetid: 2e8ea400-e555-43e5-89d6-0898cb89da90 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Policy + **Applies to** - Windows 10 + Provides information about basic audit policies that are available in Windows and links to information about each setting. + The security audit policy settings under **Security Settings\\Local Policies\\Audit Policy** provide broad security audit capabilities for client devices and servers that cannot use advanced security audit policy settings. + The basic audit policy settings under **Security Settings\\Local Policies\\Audit Policy** are: -[Audit account logon events](basic-audit-account-logon-events.md) -[Audit account management](basic-audit-account-management.md) -[Audit directory service access](basic-audit-directory-service-access.md) -[Audit logon events](basic-audit-logon-events.md) -[Audit object access](basic-audit-object-access.md) -[Audit policy change](basic-audit-policy-change.md) -[Audit privilege use](basic-audit-privilege-use.md) -[Audit process tracking](basic-audit-process-tracking.md) -[Audit system events](basic-audit-system-events.md) +- [Audit account logon events](basic-audit-account-logon-events.md) +- [Audit account management](basic-audit-account-management.md) +- [Audit directory service access](basic-audit-directory-service-access.md) +- [Audit logon events](basic-audit-logon-events.md) +- [Audit object access](basic-audit-object-access.md) +- [Audit policy change](basic-audit-policy-change.md) +- [Audit privilege use](basic-audit-privilege-use.md) +- [Audit process tracking](basic-audit-process-tracking.md) +- [Audit system events](basic-audit-system-events.md) + ## Related topics -[Configure security policy settings](how-to-configure-security-policy-settings.md) -[Security auditing](security-auditing-overview.md) + +- [Configure security policy settings](how-to-configure-security-policy-settings.md) +- [Security auditing](security-auditing-overview.md)     diff --git a/windows/keep-secure/audit-process-creation.md b/windows/keep-secure/audit-process-creation.md index 46977396e4..dbe4b6bc69 100644 --- a/windows/keep-secure/audit-process-creation.md +++ b/windows/keep-secure/audit-process-creation.md @@ -2,44 +2,34 @@ title: Audit Process Creation (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Process Creation, which determines whether the operating system generates audit events when a process is created (starts). ms.assetid: 67e39fcd-ded6-45e8-b1b6-d411e4e93019 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Process Creation + **Applies to** - Windows 10 - Windows 10 Mobile + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Process Creation**, which determines whether the operating system generates audit events when a process is created (starts). + These audit events can help you track user activity and understand how a computer is being used. Information includes the name of the program or the user that created the process. + Event volume: Low to medium, depending on system usage + Default: Not configured - ---- - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4688

      A new process has been created.

      4696

      A primary token was assigned to a process.

      + +| Event ID | Event message | +| - | - | +| 4688 | A new process has been created.| +| 4696 | A primary token was assigned to a process.|   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-process-termination.md b/windows/keep-secure/audit-process-termination.md index ed81065dfb..4208a938c3 100644 --- a/windows/keep-secure/audit-process-termination.md +++ b/windows/keep-secure/audit-process-termination.md @@ -2,42 +2,37 @@ title: Audit Process Termination (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Process Termination, which determines whether the operating system generates audit events when an attempt is made to end a process. ms.assetid: 65d88e53-14aa-48a4-812b-557cebbf9e50 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Process Termination + **Applies to** - Windows 10 - Windows 10 Mobile + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Process Termination**, which determines whether the operating system generates audit events when an attempt is made to end a process. + Success audits record successful attempts and Failure audits record unsuccessful attempts. + If you do not configure this policy setting, no audit event is generated when a process ends. + This policy setting can help you track user activity and understand how the computer is used. + Event volume: Varies, depending on how the computer is used + Default: Not configured - ---- - - - - - - - - - - - - -
      Event IDEvent message

      4689

      A process has exited.

      -  + +| Event ID | Event message | +| - | - | +| 4689 | A process has exited. | + ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-registry.md b/windows/keep-secure/audit-registry.md index e7b6bdba50..40ea22bf27 100644 --- a/windows/keep-secure/audit-registry.md +++ b/windows/keep-secure/audit-registry.md @@ -2,45 +2,37 @@ title: Audit Registry (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Registry, which determines whether the operating system generates audit events when users attempt to access registry objects. ms.assetid: 02bcc23b-4823-46ac-b822-67beedf56b32 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Registry + **Applies to** - Windows 10 - Windows 10 Mobile + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Registry**, which determines whether the operating system generates audit events when users attempt to access registry objects. + Audit events are generated only for objects that have configured system access control lists (SACLs) specified, and only if the type of access requested (such as Write, Read, or Modify) and the account making the request match the settings in the SACL. -If success auditing is enabled, an audit entry is generated each time any account successfully accesses a registry object that has a matching SACL. If failure auditing is enabled, an audit entry is generated each time any user unsuccessfully attempts to access a registry object that has a matching SACL. + +If success auditing is enabled, an audit entry is generated each time any account successfully accesses a registry object that has a matching SACL. If failure auditing is enabled, an audit entry is generated each time any user unsuccessfully attempts to access a registry object that has a matching +SACL. + Event volume: Low to medium, depending on how registry SACLs are configured + Default: Not configured - ---- - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4657

      A registry value was modified.

      5039

      A registry key was virtualized.

      + +| Event ID | Event message | +| - | - | +| 4657 | A registry value was modified. | +| 5039 | A registry key was virtualized. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-removable-storage.md b/windows/keep-secure/audit-removable-storage.md index d260df3000..1892857f3e 100644 --- a/windows/keep-secure/audit-removable-storage.md +++ b/windows/keep-secure/audit-removable-storage.md @@ -2,18 +2,24 @@ title: Audit Removable Storage (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Removable Storage, which determines when there is a read or a write to a removable drive. ms.assetid: 1746F7B3-8B41-4661-87D8-12F734AFFB26 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Removable Storage + **Applies to** - Windows 10 + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Removable Storage**, which determines when there is a read or a write to a removable drive. + Event volume: Low + Default: Not configured + @@ -117,6 +123,7 @@ Default: Not configured
        ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-rpc-events.md b/windows/keep-secure/audit-rpc-events.md index 1fca2ed810..dfb512694b 100644 --- a/windows/keep-secure/audit-rpc-events.md +++ b/windows/keep-secure/audit-rpc-events.md @@ -2,39 +2,32 @@ title: Audit RPC Events (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit RPC Events, which determines whether the operating system generates audit events when inbound remote procedure call (RPC) connections are made. ms.assetid: 868aec2d-93b4-4bc8-a150-941f88838ba6 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit RPC Events + **Applies to** - Windows 10 + This topic for the IT professional describes the advanced security audit policy setting, **Audit RPC Events**, which determines whether the operating system generates audit events when inbound remote procedure call (RPC) connections are made. + RPC is a technology for creating distributed client/server programs. RPC is an interprocess communication technique that enables client and server software to communicate. For more information, see [What Is RPC?](http://technet.microsoft.com/library/cc787851.aspx). + Event volume: High on RPC servers + Default: Not configured - ---- - - - - - - - - - - - - -
      Event IDEvent message

      5712

      A Remote Procedure Call (RPC) was attempted.

      + +| Event ID | Event message | +| - | - | +| 5712 | A Remote Procedure Call (RPC) was attempted. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-sam.md b/windows/keep-secure/audit-sam.md index 47d6014e77..c682e87a89 100644 --- a/windows/keep-secure/audit-sam.md +++ b/windows/keep-secure/audit-sam.md @@ -2,66 +2,52 @@ title: Audit SAM (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit SAM, which enables you to audit events that are generated by attempts to access Security Account Manager (SAM) objects. ms.assetid: 1d00f955-383d-4c95-bbd1-fab4a991a46e -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit SAM + **Applies to** - Windows 10 - Windows 10 Mobile + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit SAM**, which enables you to audit events that are generated by attempts to access Security Account Manager (SAM) objects. + The Security Account Manager (SAM) is a database that is present on computers running Windows operating systems that stores user accounts and security descriptors for users on the local computer. + SAM objects include the following: + - SAM\_ALIAS: A local group - SAM\_GROUP: A group that is not a local group - SAM\_USER: A user account - SAM\_DOMAIN: A domain - SAM\_SERVER: A computer account + If you configure this policy setting, an audit event is generated when a SAM object is accessed. Success audits record successful attempts, and failure audits record unsuccessful attempts. -**Note**   -Only the SACL for SAM\_SERVER can be modified. + +> **Note:**  Only the SACL for SAM\_SERVER can be modified.   Changes to user and group objects are tracked by the Account Management audit category. However, user accounts with enough privileges could potentially alter the files in which the account and password information is stored in the system, bypassing any Account Management events. + Event volume: High on domain controllers -**Note**   -For information about reducing the number of events generated in this subcategory, see [KB841001](http://go.microsoft.com/fwlink/p/?LinkId=121698). + +> **Note:**  For information about reducing the number of events generated in this subcategory, see [KB841001](http://go.microsoft.com/fwlink/p/?LinkId=121698).   Default setting: Not configured - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4659

      A handle to an object was requested with intent to delete.

      4660

      An object was deleted.

      4661

      A handle to an object was requested.

      4663

      An attempt was made to access an object.

      + +| Event ID | Event message | +| - | - | +| 4659 | A handle to an object was requested with intent to delete.| +| 4660 | An object was deleted. | +| 4661 | A handle to an object was requested.| +| 4663 | An attempt was made to access an object.|   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-security-group-management.md b/windows/keep-secure/audit-security-group-management.md index e4ca2e798d..65d91ba967 100644 --- a/windows/keep-secure/audit-security-group-management.md +++ b/windows/keep-secure/audit-security-group-management.md @@ -2,103 +2,52 @@ title: Audit Security Group Management (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit Security Group Management, which determines whether the operating system generates audit events when specific security group management tasks are performed. ms.assetid: ac2ee101-557b-4c84-b9fa-4fb23331f1aa -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Security Group Management + **Applies to** - Windows 10 + This topic for the IT professional describes the advanced security audit policy setting, **Audit Security Group Management**, which determines whether the operating system generates audit events when specific security group management tasks are performed. + Tasks for security group management include: + - A security group is created, changed, or deleted. - A member is added to or removed from a security group. - A group's type is changed. Security groups can be used for access control permissions and also as distribution lists. + Event volume: Low + Default: Success - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4727

      A security-enabled global group was created.

      4728

      A member was added to a security-enabled global group.

      4729

      A member was removed from a security-enabled global group.

      4730

      A security-enabled global group was deleted.

      4731

      A security-enabled local group was created.

      4732

      A member was added to a security-enabled local group.

      4733

      A member was removed from a security-enabled local group.

      4734

      A security-enabled local group was deleted.

      4735

      A security-enabled local group was changed.

      4737

      A security-enabled global group was changed.

      4754

      A security-enabled universal group was created.

      4755

      A security-enabled universal group was changed.

      4756

      A member was added to a security-enabled universal group.

      4757

      A member was removed from a security-enabled universal group.

      4758

      A security-enabled universal group was deleted.

      4764

      A group's type was changed.

      -  + +| Event ID | Event message | +| - | - | +| 4727 | A security-enabled global group was created. | +| 4728 | A member was added to a security-enabled global group. | +| 4729 | A member was removed from a security-enabled global group. | +| 4730 | A security-enabled global group was deleted. | +| 4731 | A security-enabled local group was created. | +| 4732 | A member was added to a security-enabled local group.| +| 4733 | A member was removed from a security-enabled local group.| +| 4734 | A security-enabled local group was deleted. | +| 4735 | A security-enabled local group was changed. | +| 4737 | A security-enabled global group was changed. | +| 4754 | A security-enabled universal group was created.| +| 4755 | A security-enabled universal group was changed. | +| 4756 | A member was added to a security-enabled universal group.| +| 4757 | A member was removed from a security-enabled universal group.| +| 4758 | A security-enabled universal group was deleted. | +| 4764 | A group's type was changed. | + ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-security-state-change.md b/windows/keep-secure/audit-security-state-change.md index 916b17b447..efda133f49 100644 --- a/windows/keep-secure/audit-security-state-change.md +++ b/windows/keep-secure/audit-security-state-change.md @@ -2,65 +2,44 @@ title: Audit Security State Change (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Security State Change, which determines whether Windows generates audit events for changes in the security state of a system. ms.assetid: decb3218-a67d-4efa-afc0-337c79a89a2d -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Security State Change + **Applies to** - Windows 10 - Windows 10 Mobile + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Security State Change**, which determines whether Windows generates audit events for changes in the security state of a system. + Changes in the security state of the operating system include: + - System startup and shutdown. - Change of system time. - System recovery from **CrashOnAuditFail**. This event is logged after a system reboots following **CrashOnAuditFail**. - **Important**   - Some auditable activity may not be recorded when a system restarts due to **CrashOnAuditFail**. + + > **Important:**  Some auditable activity may not be recorded when a system restarts due to **CrashOnAuditFail**.   System startup and shutdown events are important for understanding system usage. + Event volume: Low + Default: Success - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent Message SummaryMinimum Requirement

      4608

      Windows is starting up.

      Windows Vista, Windows Server 2008

      4609

      Windows is shutting down.

      Windows Vista, Windows Server 2008

      4616

      The system time was changed.

      Windows Vista, Windows Server 2008

      4621

      Administrator recovered system from CrashOnAuditFail. Users who are not administrators will now be allowed to log on. Some auditable activity might not have been recorded.

      Windows Vista, Windows Server 2008

      + +| Event ID | Event message summary | Minimum requirement | +| - | - | - | +| 4608 | Windows is starting up. | Windows Vista, Windows Server 2008 | +| 4609 | Windows is shutting down. | Windows Vista, Windows Server 2008 | +| 4616 | The system time was changed.| Windows Vista, Windows Server 2008 | +| 4621 | Administrator recovered system from CrashOnAuditFail. Users who are not administrators will now be allowed to log on. Some auditable activity might not have been recorded.| Windows Vista, Windows Server 2008 |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-security-system-extension.md b/windows/keep-secure/audit-security-system-extension.md index 2144df19fb..e605195736 100644 --- a/windows/keep-secure/audit-security-system-extension.md +++ b/windows/keep-secure/audit-security-system-extension.md @@ -2,62 +2,43 @@ title: Audit Security System Extension (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Security System Extension, which determines whether the operating system generates audit events related to security system extensions. ms.assetid: 9f3c6bde-42b2-4a0a-b353-ed3106ebc005 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Security System Extension + **Applies to** - Windows 10 - Windows 10 Mobile + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Security System Extension**, which determines whether the operating system generates audit events related to security system extensions. + Changes to security system extensions in the operating system include the following activities: - A security extension code is loaded (such as an authentication, notification, or security package). A security extension code registers with the Local Security Authority and will be used and trusted to authenticate logon attempts, submit logon requests, and be notified of any account or password changes. Examples of this extension code are Security Support Providers, such as Kerberos and NTLM. - A service is installed. An audit log is generated when a service is registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account. -**Important**   -Attempts to install or load security system extensions or services are critical system events that could indicate a security breach. + +> **Important:**  Attempts to install or load security system extensions or services are critical system events that could indicate a security breach.   Event volume: Low + These events are expected to appear more on a domain controller than on client computers or member servers. + Default: Not configured - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4610

      An authentication package has been loaded by the Local Security Authority.

      4611

      A trusted logon process has been registered with the Local Security Authority.

      4614

      A notification package has been loaded by the Security Account Manager.

      4622

      A security package has been loaded by the Local Security Authority.

      4697

      A service was installed in the system.

      + +| Event ID | Event message | +| - | - | +| 4610 | An authentication package has been loaded by the Local Security Authority. | +| 4611 | A trusted logon process has been registered with the Local Security Authority.| +| 4614 | A notification package has been loaded by the Security Account Manager. | +| 4622 | A security package has been loaded by the Local Security Authority. | +| 4697 | A service was installed in the system. |   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-sensitive-privilege-use.md b/windows/keep-secure/audit-sensitive-privilege-use.md index 5b79f7bf21..2c7cd5a902 100644 --- a/windows/keep-secure/audit-sensitive-privilege-use.md +++ b/windows/keep-secure/audit-sensitive-privilege-use.md @@ -2,63 +2,51 @@ title: Audit Sensitive Privilege Use (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Sensitive Privilege Use, which determines whether the operating system generates audit events when sensitive privileges (user rights) are used. ms.assetid: 915abf50-42d2-45f6-9fd1-e7bd201b193d -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Sensitive Privilege Use + **Applies to** - Windows 10 + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Sensitive Privilege Use**, which determines whether the operating system generates audit events when sensitive privileges (user rights) are used. + Actions that can be audited include: - A privileged service is called. - One of the following privileges is called: - **Act as part of the operating system** - **Back up files and directories** - **Create a token object** - **Debug programs** - **Enable computer and user accounts to be trusted for delegation** - **Generate security audits** - **Impersonate a client after authentication** - **Load and unload device drivers** - **Manage auditing and security log** - **Modify firmware environment values** - **Replace a process-level token** - **Restore files and directories** - **Take ownership of files or other objects** + - **Act as part of the operating system** + - **Back up files and directories** + - **Create a token object** + - **Debug programs** + - **Enable computer and user accounts to be trusted for delegation** + - **Generate security audits** + - **Impersonate a client after authentication** + - **Load and unload device drivers** + - **Manage auditing and security log** + - **Modify firmware environment values** + - **Replace a process-level token** + - **Restore files and directories** + - **Take ownership of files or other objects** + If you configure this policy setting, an audit event is generated when sensitive privilege requests are made. Success audits record successful attempts, and failure audits record unsuccessful attempts. + Event volume: High + Default: Not configured - ---- - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4672

      Special privileges assigned to new logon.

      4673

      A privileged service was called.

      4674

      An operation was attempted on a privileged object.

      + +| Event ID | Event message | +| - | - | +| 4672 | Special privileges assigned to new logon.| +| 4673 | A privileged service was called. | +| 4674 | An operation was attempted on a privileged object.|   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md b/windows/keep-secure/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md index 6d797a0b65..5ce9aeecf7 100644 --- a/windows/keep-secure/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md +++ b/windows/keep-secure/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md @@ -2,18 +2,24 @@ title: Audit Shut down system immediately if unable to log security audits (Windows 10) description: Describes the best practices, location, values, management practices, and security considerations for the Audit Shut down system immediately if unable to log security audits security policy setting. ms.assetid: 2cd23cd9-0e44-4d0b-a1f1-39fc29303826 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit: Shut down system immediately if unable to log security audits + **Applies to** - Windows 10 + Describes the best practices, location, values, management practices, and security considerations for the **Audit: Shut down system immediately if unable to log security audits** security policy setting. + ## Reference + The **Audit: Shut down system immediately if unable to log security audits** policy setting determines whether the system shuts down if it is unable to log security events. This policy setting is a requirement for Trusted Computer System Evaluation Criteria (TCSEC)-C2 and Common Criteria certification to prevent auditable events from occurring if the audit system is unable to log those events. Microsoft has chosen to meet this requirement by halting the system and displaying a Stop message in the case of a failure of the auditing system. Enabling this policy setting stops the system if a security audit cannot be logged for any reason. Typically, an event fails to be logged when the security audit log is full and the value of **Retention method for security log** is **Do not overwrite events (clear log manually)** or **Overwrite events by days**. + With **Audit: Shut down system immediately if unable to log security audits** set to **Enabled**, if the security log is full and an existing entry cannot be overwritten, the following Stop message appears: @@ -28,72 +34,67 @@ With **Audit: Shut down system immediately if unable to log security audits** se
        To recover, you must log on, archive the log (optional), clear the log, and reset this option as desired. + If the computer is unable to record events to the security log, critical evidence or important troubleshooting information might not be available for review after a security incident. + ### Possible values + - Enabled - Disabled - Not defined + ### Best practices + - Depending on your security audit requirements, you can enable the **Audit: Shut down system immediately if unable to log security audits** setting to ensure that security auditing information is captured for review. However, enabling this setting will increase the number of events logged. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Disabled

      DC Effective Default Settings

      Disabled

      Member Server Effective Default Settings

      Disabled

      Client Computer Effective Default Settings

      Disabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined +| Default Domain Controler Policy | Not defined +| Stand-Alone Server Default Settings | Disabled +| DC Effective Default Settings | Disabled +| Member Server Effective Default Settings | Disabled +| Client Computer Effective Default Settings | Disabled   ## Policy management + This section describes features and tools that are available to help you manage this policy. The administrative burden of enabling this policy setting can be very high, especially if you also set the **Retention method for security log** to **Do not overwrite events (clear log manually)**. This setting turns a repudiation threat (a backup operator could deny that they backed up or restored data) into a denial-of-service threat, because a server can be forced to shut down if it is overwhelmed with logon events and other security events that are written to the security log. Additionally, because the shutdown is not graceful, it is possible that irreparable damage to the operating system, applications, or data could result. Although the NTFS file system will guarantee that the file system's integrity will be maintained during a sudden system shutdown, it cannot guarantee that every data file for every application will still be in a usable form when the system is restarted. + ### Restart requirement + None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. + ### Group Policy + Modifying this setting may affect compatibility with clients, services, and applications. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + If the computer is unable to record events to the security event log, critical evidence or important troubleshooting information may not be available for review after a security incident. Also, an attacker could potentially generate a large volume of security event log events to purposely force a shutdown. + ### Countermeasure + Enable the **Audit: Shut down system immediately if unable to log security audits** setting to ensure that security auditing information is captured for review. + ### Potential impact + If you enable this policy setting, the administrative burden can be significant, especially if you also configure the **Retention method for the Security log** to **Do not overwrite events** (clear log manually). This configuration causes a repudiation threat (a backup operator could deny that they backed up or restored data) to become a denial of service (DoS) vulnerability because a server could be forced to shut down if it is overwhelmed with logon events and other security events that are written to the security event log. Also, because the shutdown is abrupt, it is possible that irreparable damage to the operating system, applications, or data could result. Although the NTFS file system maintains its integrity when this type of computer shutdown occurs, there is no guarantee that every data file for every application will still be in a usable form when the device restarts. + ## Related topics -[Security Options](security-options.md) + +- [Security Options](security-options.md)     diff --git a/windows/keep-secure/audit-special-logon.md b/windows/keep-secure/audit-special-logon.md index 5a3e24b4b7..439cf91d3d 100644 --- a/windows/keep-secure/audit-special-logon.md +++ b/windows/keep-secure/audit-special-logon.md @@ -2,43 +2,38 @@ title: Audit Special Logon (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Special Logon, which determines whether the operating system generates audit events under special sign on (or log on) circumstances. ms.assetid: e1501bac-1d09-4593-8ebb-f311231567d3 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit Special Logon + **Applies to** - Windows 10 - Windows 10 Mobile + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit Special Logon**, which determines whether the operating system generates audit events under special sign on (or log on) circumstances. + This security policy setting determines whether the operating system generates audit events when: + - A special logon is used. A special logon is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. - A member of a special group logs on. Special Groups is a Windows feature that enables the administrator to find out when a member of a certain group has logged on. The administrator can set a list of group security identifiers (SIDs) in the registry. If any of these SIDs is added to a token during logon and this auditing subcategory is enabled, a security event is logged. For more information about this feature, see [article 947223](http://go.microsoft.com/fwlink/p/?linkid=120183) in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/p/?linkid=120183). + Users holding special privileges can potentially make changes to the system. We recommend that you track their activity. + Event volume: Low + Default: Success - ---- - - - - - - - - - - - - -
      Event IDEvent message

      4964

      Special groups have been assigned to a new logon.

      + +| Event ID | Event message | +| - | - | +| 4964 | Special groups have been assigned to a new logon.|   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-system-integrity.md b/windows/keep-secure/audit-system-integrity.md index afe5957ade..dfc2666ebf 100644 --- a/windows/keep-secure/audit-system-integrity.md +++ b/windows/keep-secure/audit-system-integrity.md @@ -2,88 +2,51 @@ title: Audit System Integrity (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit System Integrity, which determines whether the operating system audits events that violate the integrity of the security subsystem. ms.assetid: 942a9a7f-fa31-4067-88c7-f73978bf2034 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit System Integrity + **Applies to** - Windows 10 - Windows 10 Mobile + This topic for the IT professional describes the Advanced Security Audit policy setting, **Audit System Integrity**, which determines whether the operating system audits events that violate the integrity of the security subsystem. + Activities that violate the integrity of the security subsystem include the following: + - Audited events are lost due to a failure of the auditing system. - A process uses an invalid local procedure call (LPC) port in an attempt to impersonate a client, reply to a client address space, read to a client address space, or write from a client address space. - A remote procedure call (RPC) integrity violation is detected. - A code integrity violation with an invalid hash value of an executable file is detected. - Cryptographic tasks are performed. -**Important**   -Violations of security subsystem integrity are critical and could indicate a potential security attack. + +> **Important:**  Violations of security subsystem integrity are critical and could indicate a potential security attack.   Event volume: Low + Default: Success and failure - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4612

      Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits.

      4615

      Invalid use of LPC port.

      4618

      A monitored security event pattern has occurred.

      4816

      RPC detected an integrity violation while decrypting an incoming message.

      5038

      Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.

      5056

      A cryptographic self-test was performed.

      5057

      A cryptographic primitive operation failed.

      5060

      Verification operation failed.

      5061

      Cryptographic operation.

      5062

      A kernel-mode cryptographic self-test was performed.

      6281

      Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error.

      + +| Event ID | Event message | +| - | - | +| 4612 | Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits. | +| 4615 | Invalid use of LPC port. | +| 4618 | A monitored security event pattern has occurred.| +| 4816 | RPC detected an integrity violation while decrypting an incoming message.| +| 5038 | Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.| +| 5056 | A cryptographic self-test was performed. | +| 5057 | A cryptographic primitive operation failed.| +| 5060 | Verification operation failed. | +| 5061 | Cryptographic operation. | +| 5062 | A kernel-mode cryptographic self-test was performed.| +| 6281 | Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error.|   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-user-account-management.md b/windows/keep-secure/audit-user-account-management.md index 1a863efc9a..1f05f3085b 100644 --- a/windows/keep-secure/audit-user-account-management.md +++ b/windows/keep-secure/audit-user-account-management.md @@ -2,106 +2,56 @@ title: Audit User Account Management (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit User Account Management, which determines whether the operating system generates audit events when specific user account management tasks are performed. ms.assetid: f7e72998-3858-4197-a443-19586ecc4bfb -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit User Account Management + **Applies to** - Windows 10 + This topic for the IT professional describes the advanced security audit policy setting, **Audit User Account Management**, which determines whether the operating system generates audit events when specific user account management tasks are performed. + Tasks that are audited for user account management include: + - A user account is created, changed, deleted, renamed, disabled, enabled, locked out, or unlocked. - A user account password is set or changed. - Security identifier (SID) history is added to a user account. - The Directory Services Restore Mode password is set. - Permissions are changed on accounts that are members of administrator groups. - Credential Manager credentials are backed up or restored. + This policy setting is essential for tracking events that involve provisioning and managing user accounts. + Event volume: Low + Default: Success - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDEvent message

      4720

      A user account was created.

      4722

      A user account was enabled.

      4723

      An attempt was made to change an account's password.

      4724

      An attempt was made to reset an account's password.

      4725

      A user account was disabled.

      4726

      A user account was deleted.

      4738

      A user account was changed.

      4740

      A user account was locked out.

      4765

      SID History was added to an account.

      4766

      An attempt to add SID History to an account failed.

      4767

      A user account was unlocked.

      4780

      The ACL was set on accounts which are members of administrators groups.

      4781

      The name of an account was changed:

      4794

      An attempt was made to set the Directory Services Restore Mode.

      5376

      Credential Manager credentials were backed up.

      5377

      Credential Manager credentials were restored from a backup.

      + +| Event ID | Event message | +| - | - | +| 4720 | A user account was created. | +| 4722 | A user account was enabled. | +| 4723 | An attempt was made to change an account's password.| +| 4724 | An attempt was made to reset an account's password. | +| 4725 | A user account was disabled. | +| 4726 | A user account was deleted. | +| 4738 | A user account was changed. | +| 4740 | A user account was locked out.| +| 4765 | SID History was added to an account.| +| 4766 | An attempt to add SID History to an account failed.| +| 4767 | A user account was unlocked. | +| 4780 | The ACL was set on accounts which are members of administrators groups.| +| 4781 | The name of an account was changed: | +| 4794 | An attempt was made to set the Directory Services Restore Mode.| +| 5376 | Credential Manager credentials were backed up. | +| 5377 | Credential Manager credentials were restored from a backup.|   ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/audit-user-device-claims.md b/windows/keep-secure/audit-user-device-claims.md index 29bc724e09..254bfb2c7d 100644 --- a/windows/keep-secure/audit-user-device-claims.md +++ b/windows/keep-secure/audit-user-device-claims.md @@ -2,18 +2,24 @@ title: Audit User/Device Claims (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit User/Device Claims, which enables you to audit security events that are generated by user and device claims. ms.assetid: D3D2BFAF-F2C0-462A-9377-673DB49D5486 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Audit User/Device Claims + **Applies to** - Windows 10 + This topic for the IT professional describes the advanced security audit policy setting, **Audit User/Device Claims**, which enables you to audit security events that are generated by user and device claims. + Event volume: + Default: Not configured + @@ -52,6 +58,7 @@ Default: Not configured
        ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)     diff --git a/windows/keep-secure/back-up-files-and-directories.md b/windows/keep-secure/back-up-files-and-directories.md index 6e95c6fea2..2cddb14842 100644 --- a/windows/keep-secure/back-up-files-and-directories.md +++ b/windows/keep-secure/back-up-files-and-directories.md @@ -2,108 +2,109 @@ title: Back up files and directories (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Back up files and directories security policy setting. ms.assetid: 1cd6bdd5-1501-41f4-98b9-acf29ac173ae -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Back up files and directories + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Back up files and directories** security policy setting. + ## Reference + This user right determines which users can bypass file and directory, registry, and other persistent object permissions for the purposes of backing up the system. This user right is effective only when an application attempts access through the NTFS backup application programming interface (API) through a backup tool such as NTBACKUP.EXE. Otherwise, standard file and directory permissions apply. + This user right is similar to granting the following permissions to the user or group you have selected on all files and folders on the system: + - Traverse Folder/Execute File - List Folder/Read Data - Read Attributes - Read Extended Attributes - Read Permissions + Default on workstations and servers: + - Administrators - Backup Operators + Default on domain controllers: + - Administrators - Backup Operators - Server Operators + Constant: SeBackupPrivilege + ### Possible values + - User-defined list of accounts - Not Defined + ### Best practices + 1. Restrict the **Back up files and directories** user right to members of the IT team who must back up organizational data as part of their daily job responsibilities. Because there is no way to be sure that a user is backing up data, stealing data, or copying data to be distributed, only assign this user right to trusted users. 2. If you are using backup software that runs under specific service accounts, only these accounts (and not the IT staff) should have the **Back up files and directories** user right. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default, this right is granted to Administrators and Backup Operators on workstations and servers. On domain controllers, Administrators, Backup Operators, and Server Operators have this right. + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not Defined

      Default Domain Controller Policy

      Administrators

      -

      Backup Operators

      -

      Server Operators

      Stand-Alone Server Default Settings

      Administrators

      -

      Backup Operators

      Domain Controller Effective Default Settings

      Administrators

      -

      Backup Operators

      -

      Server Operators

      Member Server Effective Default Settings

      Administrators

      -

      Backup Operators

      Client Computer Effective Default Settings

      Administrators

      -

      Backup Operators

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not Defined | +| Default Domain Controller Policy | Administrators
      Backup Operators
      Server Operators| +| Stand-Alone Server Default Settings | Administrators
      Backup Operators| +| Domain Controller Effective Default Settings | Administrators
      Backup Operators
      Server Operators| +| Member Server Effective Default Settings | Administrators
      Backup Operators| +| Client Computer Effective Default Settings | Administrators
      Backup Operators|   ## Policy management + A restart of the device is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Users who can back up data from a device could take the backup media to a non-domain computer on which they have administrative privileges, and then restore the data. They could take ownership of the files and view any unencrypted data that is contained within the backup set. + ### Countermeasure + Restrict the **Back up files and directories** user right to members of the IT team who must back up organizational data as part of their daily job responsibilities. If you are using backup software that runs under specific service accounts, only these accounts (and not the IT staff) should have the **Back up files and directories** user right. + ### Potential impact + Changes in the membership of the groups that have the **Back up files and directories** user right could limit the abilities of users who are assigned to specific administrative roles in your environment. You should confirm that authorized backup administrators can still perform backup operations. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) + +- [User Rights Assignment](user-rights-assignment.md)     diff --git a/windows/plan/chromebook-migration-guide.md b/windows/plan/chromebook-migration-guide.md index 4d05da9992..5f6f426691 100644 --- a/windows/plan/chromebook-migration-guide.md +++ b/windows/plan/chromebook-migration-guide.md @@ -2,45 +2,60 @@ title: Chromebook migration guide (Windows 10) description: In this guide you will learn how to migrate a Google Chromebook-based learning environment to a Windows 10-based learning environment. ms.assetid: 7A1FA48A-C44A-4F59-B895-86D4D77F8BEA -ms.pagetype: edu; devices -keywords: ["migrate", "automate", "device"] +keywords: migrate, automate, device ms.prod: W10 ms.mktglfcycl: plan ms.sitesec: library +ms.pagetype: edu; devices author: craigash + --- # Chromebook migration guide + **Applies to** - Windows 10 -In this guide you will learn how to migrate a Google Chromebook-based learning environment to a Windows 10-based learning environment. You will learn how to perform the necessary planning steps, including Windows device deployment, migration of user and device settings, app migration or replacement, and cloud storage migration. You will then learn the best method to perform the migration by using automated deployment and migration tools. -## Plan Chromebook migration -Before you begin to migrate Chromebook devices, plan your migration. As with most projects, there can be an urge to immediately start doing before planning. When you plan your Chromebook migration before you perform the migration, you can save countless hours of frustration and mistakes during the migration process. -In the planning portion of this guide, you will identify all the decisions that you need to make and how to make each decision. At the end of the planning section, you will have a list of information you need to collect and what you need to do with the information. You will be ready to perform your Chromebook migration. -## Plan for app migration or replacement -App migration or replacement is an essential part of your Chromebook migration. In this section you will plan how you will migrate or replace Chromebook (Chrome OS) apps that are currently in use with the same or equivalent Windows apps. At the end of this section, you will have a list of the active Chrome OS apps and the Windows app counterparts. -**Identify the apps currently in use on Chromebook devices** -Before you can do any analysis or make decisions about which apps to migrate or replace, you need to identify which apps are currently in use on the Chromebook devices. You will create a list of apps that are currently in use (also called an app portfolio). -**Note**   -The majority of Chromebook apps are web apps. For these apps you need to first perform Microsoft Edge compatibility testing and then publish the web app URL to the Windows users. For more information, see the [Perform app compatibility testing for web apps](#perform-testing-webapps) section. -<<<<<<< HEAD -  -======= ->>>>>>> master +In this guide you will learn how to migrate a Google Chromebook-based learning environment to a Windows 10-based learning environment. You will learn how to perform the necessary planning steps, including Windows device deployment, migration of user and device settings, app migration or replacement, and cloud storage migration. You will then learn the best method to perform the migration by using automated deployment and migration tools. + +## Plan Chromebook migration + +Before you begin to migrate Chromebook devices, plan your migration. As with most projects, there can be an urge to immediately start doing before planning. When you plan your Chromebook migration before you perform the migration, you can save countless hours of frustration and mistakes during the migration process. + +In the planning portion of this guide, you will identify all the decisions that you need to make and how to make each decision. At the end of the planning section, you will have a list of information you need to collect and what you need to do with the information. You will be ready to perform your Chromebook migration. + +## Plan for app migration or replacement + +App migration or replacement is an essential part of your Chromebook migration. In this section you will plan how you will migrate or replace Chromebook (Chrome OS) apps that are currently in use with the same or equivalent Windows apps. At the end of this section, you will have a list of the active Chrome OS apps and the Windows app counterparts. + +**Identify the apps currently in use on Chromebook devices** + +Before you can do any analysis or make decisions about which apps to migrate or replace, you need to identify which apps are currently in use on the Chromebook devices. You will create a list of apps that are currently in use (also called an app portfolio). + +> **Note**  The majority of Chromebook apps are web apps. For these apps you need to first perform Microsoft Edge compatibility testing and then publish the web app URL to the Windows users. For more information, see the [Perform app compatibility testing for web apps](#perform-testing-webapps) section. + You can divide the apps into the following categories: + - **Apps installed and managed by the institution.** These apps are typically managed in the Apps section in the Google Admin Console. You can record the list of these apps in your app portfolio. - **Apps installed by faculty or students.** Faculty or students might have installed these apps as a part of a classroom curriculum. Obtain the list of these apps from faculty or students. Ensure you only record apps that are legitimately used as a part of classroom curriculum (and not for personal entertainment or use). + Record the following information about each app in your app portfolio: + - App name - App type (such as offline app, online app, web app, and so on) - App publisher or developer - App version currently in use - App priority (how necessary is the app to the day-to-day process of the institution or a classroom? Rank as high, medium, or low) + Throughout the entire app migration or replacement process, focus on the higher priority apps. Focus on lower priority apps only after you have determined what you will do with the higher priority apps. + ### + **Select Google Apps replacements** + Table 1 lists the Windows device app replacements for the common Google Apps on Chromebook devices. If your users rely on any of these Google Apps, use the corresponding app on the Windows device. Use the information in Table 1 to select the Google App replacement on a Windows device. + Table 1. Google App replacements + | If you use this Google app on a Chromebook | Use this app on a Windows device | |--------------------------------------------|--------------------------------------| | Google Docs | Word 2016 or Word Online | @@ -52,25 +67,45 @@ Table 1. Google App replacements | Google Drive | Microsoft OneDrive for Business |   It may be that you will decide to replace Google Apps after you deploy Windows devices. For more information on making this decision, see the [Select cloud services migration strategy](#select-cs-migrationstrat) section of this guide. + **Find the same or similar apps in the Windows Store** + In many instances, software vendors will create a version of their app for multiple platforms. You can search the Windows Store to find the same or similar apps to any apps not identified in the [Select Google Apps replacements](#select-googleapps) section. + In other instances, the offline app does not have a version written for the Windows Store or is not a web app. In these cases, look for an app that provides similar functions. For example, you might have a graphing calculator offline Android app published on the Chrome OS, but the software publisher does not have a version for Windows devices. Search the Windows Store for a graphing calculator app that provides similar features and functionality. Use that Windows Store app as a replacement for the graphing calculator offline Android app published on the Chrome OS. + Record the Windows app that replaces the Chromebook app in your app portfolio. + ### + **Perform app compatibility testing for web apps** + The majority of Chromebook apps are web apps. Because you cannot run native offline Chromebook apps on a Windows device, there is no reason to perform app compatibility testing for offline Chromebook apps. However, you may have a number of web apps that will run on both platforms. + Ensure that you test these web apps in Microsoft Edge. Record the level of compatibility for each web app in Microsoft Edge in your app portfolio. + ## Plan for migration of user and device settings + Some institutions have configured the Chromebook devices to make the devices easier to use by using the Google Chrome Admin Console. You have also probably configured the Chromebook devices to help ensure the user data access and ensure that the devices themselves are secure by using the Google Chrome Admin Console. + However, in addition to your centralized configuration in the Google Admin Console, Chromebook users have probably customized their device. In some instances, users may have changed the web content that is displayed when the Chrome browser starts. Or they may have bookmarked websites for future reference. Or users may have installed apps for use in the classroom. + In this section, you will identify the user and device configuration settings for your Chromebook users and devices. Then you will prioritize these settings to focus on the configuration settings that are essential to your educational institution. -At the end of this section, you should have a list of Chromebook user and device settings that you want to migrate to Windows, as well as a level of priority for each setting. You may discover at the end of this section that you have few or no higher priority settings to be migrated. If this is the case, you can skip the [Perform migration of user and device settings](#migrate-user-device-settings) section of this guide. +At the end of this section, you should have a list of Chromebook user and device settings that you want to migrate to Windows, as well as a level of priority for each setting. You may discover at the end of this section that you have few or no higher priority settings to be migrated. If this is the +case, you can skip the [Perform migration of user and device settings](#migrate-user-device-settings) section of this guide. + **Identify Google Admin Console settings to migrate** + You use the Google Admin Console (as shown in Figure 1) to manage user and device settings. These settings are applied to all the Chromebook devices in your institution that are enrolled in the Google Admin Console. Review the user and device settings in the Google Admin Console and determine which settings are appropriate for your Windows devices. + ![figure 1](images/chromebook-fig1-googleadmin.png) + Figure 1. Google Admin Console + Table 2 lists the settings in the Device Management node in the Google Admin Console. Review the settings and determine which settings you will migrate to Windows. + Table 2. Settings in the Device Management node in the Google Admin Console + @@ -119,7 +154,9 @@ Table 2. Settings in the Device Management node in the Google Admin Console
        Table 3 lists the settings in the Security node in the Google Admin Console. Review the settings and determine which settings you will migrate to Windows. + Table 3. Settings in the Security node in the Google Admin Console + @@ -157,12 +194,17 @@ Table 3. Settings in the Security node in the Google Admin Console
        **Identify locally-configured settings to migrate** + In addition to the settings configured in the Google Admin Console, users may have locally configured their devices based on their own personal preferences (as shown in Figure 2). Table 4 lists the Chromebook user and device settings that you can locally configure. Review the settings and determine which settings you will migrate to Windows. Some of the settings listed in Table 4 can only be seen when you click the **Show advanced settings** link (as shown in Figure 2). + ![figure 2](images/fig2-locallyconfig.png) + Figure 2. Locally-configured settings on Chromebook + Table 4. Locally-configured settings -| Section | Settings | -|------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| + +| Section | Settings | +| - | - | | Internet connections | These settings configure the Internet connection for the devices, such as Wi-Fi and VPN connections. Record the network connection currently in use and configure the Windows device to use the same network connection settings. | | Appearances | These settings affect the appearance of the desktop. Record the wallpaper image file that is used. Migrate the image file to the Windows device and configure as the user’s wallpaper to maintain similar user experience. | | Search | These settings configure which search engine is used to search for content. Record this setting so that you can use as the search engine on the Windows device. | @@ -184,91 +226,149 @@ Table 4. Locally-configured settings   Determine how many users have similar settings and then consider managing those settings centrally. For example, a large number of users may have many of the same Chrome web browser settings. You can centrally manage these settings in Windows after migration. Also, as a part of this planning process, consider settings that may not be currently managed centrally, but should be managed centrally. Record the settings that are currently being locally managed, but you want to manage centrally after the migration. + **Prioritize settings to migrate** + After you have collected all the Chromebook user, app, and device settings that you want to migrate, you need to prioritize each setting. Evaluate each setting and assign a priority to the setting based on the levels of high, medium, and low. Assign the setting-migration priority based on how critical the setting is to the faculty performing their day-to-day tasks and how the setting affects the curriculum in the classrooms. Focus on the migration of higher priority settings and put less effort into the migration of lower priority settings. There may be some settings that are not necessary at all and can be dropped from your list of settings entirely. Record the setting priority in the list of settings you plan to migrate. + ## Plan for email migration + Many of your users may be using Google Apps Gmail to manage their email, calendars, and contacts. You need to create the list of users you will migrate and the best time to perform the migration. Office 365 supports automated migration from Google Apps Gmail to Office 365. For more information, see [Migrate Google Apps mailboxes to Office 365](http://go.microsoft.com/fwlink/p/?LinkId=690252). + **Identify the list of user mailboxes to migrate** + In regards to creating the list of users you will migrate, it might seem that the answer “all the users” might be the best one. However, depending on the time you select for migration, only a subset of the users may need to be migrated. For example, you may not persist student email accounts between semesters or between academic years. In this case you would only need to migrate faculty and staff. + Also, when you perform a migration it is a great time to verify that all user mailboxes are active. In many environments there are a significant number of mailboxes that were provisioned for users that are no longer a part of the institution (such as interns or student assistants). You can eliminate these users from your list of user mailboxes to migrate. + Create your list of user mailboxes to migrate in Excel 2016 based on the format described in step 7 in [Create a list of Gmail mailboxes to migrate](http://go.microsoft.com/fwlink/p/?LinkId=690253). If you follow this format, you can use the Microsoft Excel spreadsheet to perform the actual migration later in the process. + **Identify companion devices that access Google Apps Gmail** + In addition to Chromebook devices, users may have companion devices (smartphones, tablets, desktops, laptops, and so on) that also access the Google Apps Gmail mailbox. You will need to identify those companion devices and identify the proper configuration for those devices to access Office 365 mailboxes. + After you have identified each companion device, verify the settings for the device that are used to access Office 365. You only need to test one type of each companion device. For example, if users use Android phones to access Google Apps Gmail mailboxes, configure the device to access Office 365 and then record those settings. You can publish those settings on a website or to your helpdesk staff so that users will know how to access their Office 365 mailbox. + In most instances, users will only need to provide in their Office 365 email account and password. However, you should verify this on each type of companion device. For more information about how to configure a companion device to work with Office 365, see [Compare how different mobile devices work with Office 365](http://go.microsoft.com/fwlink/p/?LinkId=690254). **Identify the optimal timing for the migration** + Typically, the best time to perform the migration is between academic years or during semester breaks. Select the time of least activity for your institution. And during that time, the optimal time to perform the migration might be during an evening or over a weekend. + Ensure that you communicate the time the migration will occur to your users well in advance. Also, ensure that users know how to access their Office 365 email after the migration is complete. Finally, ensure that your users know how to perform the common tasks they performed in Google Apps Gmail in Office 365 and/or Outlook 2016. + ## Plan for cloud storage migration + Chromebook devices have limited local storage. So, most of your users will store data in cloud storage, such as Google Drive. You will need to plan how to migrate your cloud storage as a part of the Chromebook migration process. + In this section, you will create a list of the existing cloud services, select the Microsoft cloud services that best meet your needs, and then optimize your cloud storage services migration plan. + **Identify cloud storage services currently in use** + Typically, most Chromebook users use Google Drive for cloud storage services because your educational institution purchased other Google cloud services and Google Drive is a part of those services. However, some users may use cloud storage services from other vendors. For each member of your faculty and staff and for each student, create a list of cloud storage services that includes the following: - Name of the cloud storage service - Cloud storage service vendor - Associated licensing costs or fees - Approximate storage currently in use per user + Use this information as the requirements for your cloud storage services after you migrate to Windows devices. If at the end of this discovery you determine there is no essential data being stored in cloud storage services that requires migration, then you can skip to the [Plan for cloud services migration](#plan-cloud-services) section. + **Optimize cloud storage services migration plan** + Now that you know the current cloud storage services configuration, you need to optimize your cloud storage services migration plan for Microsoft OneDrive for Business. Optimization helps ensure that your use only the cloud storage services resources that are necessary for your requirements. + Consider the following to help optimize your cloud storage services migration plan: + - **Eliminate inactive user storage.** Before you perform the cloud storage services migration, identify cloud storage that is currently allocated to inactive users. Remove this storage from your list of cloud storage to migrate. - **Eliminate or archive inactive files.** Review cloud storage to identify files that are inactive (have not been accessed for some period of time). Eliminate or archive these files so that they do not consume cloud storage. - **Consolidate cloud storage services.** If multiple cloud storage services are in use, reduce the number of cloud storage services and standardize on one cloud storage service. This will help reduce management complexity, support time, and typically will reduce cloud storage costs. + Record your optimization changes in your cloud storage services migration plan. + ## Plan for cloud services migration + Many of your users may use cloud services on their Chromebook device, such as Google Apps, Google Drive, or Google Apps Gmail. You have planned for these individual cloud services in the [Plan for app migration or replacement](#plan-app-migrate-replace), [Plan for Google Apps Gmail to Office 365 migration](#plan-email-migrate), and [Plan for cloud storage migration](#plan-cloud-storage-migration) sections. + In this section, you will create a combined list of these cloud services and then select the appropriate strategy to migrate these cloud services. + ### + **Identify cloud services currently in use** + You have already identified the individual cloud services that are currently in use in your educational institution in the [Plan for app migration or replacement](#plan-app-migrate-replace), [Plan for Google Apps Gmail to Office 365 migration](#plan-email-migrate), and [Plan for cloud storage migration](#plan-cloud-storage-migration) sections. Create a unified list of these cloud services and record the following about each service: - Cloud service name - Cloud service provider - Number of users that use the cloud service + **Select cloud services to migrate** + One of the first questions you should ask after you identify the cloud services currently in use is, “Why do we need to migrate from these cloud services?” The answer to this question largely comes down to finances and features. + Here is a list of reasons that describe why you might want to migrate from an existing cloud service to Microsoft cloud services: - **Better integration with Office 365.** If your long-term strategy is to migrate to Office 365 apps (such as Word 2016 or Excel 2016) then a migration to Microsoft cloud services will provide better integration with these apps. The use of existing cloud services may not be as intuitive for users. For example, Office 365 apps will integrate better with OneDrive for Business compared to Google Drive. - **Online apps offer better document compatibility.** Microsoft Office online apps (such as Word Online and Excel Online) provide the highest level of compatibility with Microsoft Office documents. The Office online apps allow you to open and edit documents directly from SharePoint or OneDrive for Business. Users can access the Office online app from any device with Internet connectivity. - **Reduce licensing costs.** If you pay for Office 365 licenses, then Office 365 apps and cloud storage are included in those licenses. Although you could keep existing cloud services, you probably would pay more to keep those services. - **Improve storage capacity and cross-platform features.** Microsoft cloud services provide competitive storage capacity and provide more Windows-centric features than other cloud services providers. While the Microsoft cloud services user experience is highly optimized for Windows devices, Microsoft cloud services are also highly optimized for companion devices (such as iOS or Android devices). Review the list of existing cloud services that you created in the [Identify cloud services currently in use](#identify-cloud-services-inuse) section and identify the cloud services that you want to migrate to Microsoft cloud services. If you determine at the end of this task that there are no cloud services to be migrated, then skip to the [Plan for Windows device deployment](#plan-windevice-deploy) section. Also, skip the [Perform cloud services migration](#perform-cloud-services-migration) section later in this guide. + **Prioritize cloud services** + After you have created your aggregated list of cloud services currently in use by Chromebook users, prioritize each cloud service. Evaluate each cloud service and assign a priority based on the levels of high, medium, and low. Assign the priority based on how critical the cloud service is to the faculty and staff performing their day-to-day tasks and how the cloud service affects the curriculum in the classrooms. Also, make cloud services that are causing pain for the users a higher priority. For example, if users experience outages with a specific cloud service, then make migration of that cloud service a higher priority. + Focus on the migration of higher priority cloud services first and put less effort into the migration of lower priority cloud services. There may be some cloud services that are unnecessary and you can remove them from your list of cloud services to migrate entirely. Record the cloud service migration priority in the list of cloud services you plan to migrate. + ### + **Select cloud services migration strategy** + When you deploy the Windows devices, should you migrate the faculty, staff, and students to the new cloud services? Perhaps. But, in most instances you will want to select a migration strategy that introduces a number of small changes over a period of time. + Consider the following when you create your cloud services migration strategy: + - **Introduce small changes.** The move from Chrome OS to Windows will be simple for most users as most will have exposure to Windows from home, friends, or family. However, users may not be as familiar with the apps or cloud services. Consider the move to Windows first, and then make other changes as time progresses. - **Start off by using existing apps and cloud services.** Immediately after the migration to Windows devices, you may want to consider running the existing apps and cloud services (such Google Apps, Google Apps Gmail, and Google Drive). This gives users a familiar method to perform their day-to-day tasks. - **Resolve pain points.** If some existing apps or cloud services cause problems, you may want to migrate them sooner rather than later. In most instances, users will be happy to go through the learning curve of a new app or cloud service if it is more reliable or intuitive for them to use. - **Migrate classrooms or users with common curriculum.** Migrate to Windows devices for an entire classroom or for multiple classrooms that share common curriculum. You must ensure that the necessary apps and cloud services are available for the curriculum prior to the migration of one or more classrooms. - **Migrate when the fewest number of active users are affected.** Migrate your cloud services at the end of an academic year or end of a semester. This will ensure you have minimal impact on faculty, staff, and students. Also, a migration during this time will minimize the learning curve for users as they are probably dealing with new curriculum for the next semester. Also, you may not need to migrate student apps and data because many educational institutions do not preserve data between semesters or academic years. - **Overlap existing and new cloud services.** For faculty and staff, consider overlapping the existing and new cloud services (having both services available) for one business cycle (end of semester or academic year) after migration. This allows you to easily recover any data that might not have migrated successfully from the existing cloud services. At a minimum, overlap the user of existing and new cloud services until the user can verify the migration. Of course, the tradeoff for using this strategy is the cost of the existing cloud services. However, depending on when license renewal occurs, the cost may be minimal. + ## Plan for Windows device deployment + You need to plan for Windows device deployment to help ensure that the devices are successfully installed and configured to replace the Chromebook devices. Even if the vendor that provides the devices pre-loads Windows 10 on them, you still will need to perform other tasks. + In this section you will select a Windows device deployment strategy; plan for Active Directory Domain Services (AD DS) and Azure AD services; plan for device, user, and app management; and plan for any necessary network infrastructure remediation. + ### + **Select a Windows device deployment strategy** + What decisions need to be made about Windows device deployment? You just put the device on a desk, hook up power, connect to Wi-Fi, and then let the users operate the device, right? That is essentially correct, but depending on the extent of your deployment and other factors, you need to consider different deployment strategies. + For each classroom that has Chromebook devices, select a combination of the following device deployment strategies: + - **Deploy one classroom at a time.** In most cases you will want to perform your deployment in batches of devices and a classroom is an excellent way to batch devices. You can treat each classroom as a unit and check each classroom off your list after you have deployed the devices. - **Deploy based on curriculum.** Deploy the Windows devices after you have confirmed that the curriculum is ready for the Windows devices. If you deploy Windows devices without the curriculum installed and tested, you could significantly reduce the ability for students and teachers to perform effectively in the classroom. Also, deployment based on curriculum has the advantage of letting you move from classroom to classroom quickly if multiple classrooms use the same curriculum. - **Deploy side-by-side.** In some instances you may need to have both the Chromebook and Windows devices in one or more classrooms. You can use this strategy if some of the curriculum only works on Chromebook and other parts of the curriculum works on Windows devices. This is a good method to help prevent delays in Windows device deployment, while ensuring that students and teachers can make optimal use of technology in their curriculum. - **Deploy after apps and cloud services migration.** If you deploy a Windows device without the necessary apps and cloud services to support the curriculum, this provides only a portion of your complete solution. Ensure that the apps and cloud services are tested, provisioned, and ready for use prior to the deployment of Windows devices. - **Deploy after the migration of user and device settings.** Ensure that you have identified the user and device settings that you plan to migrate and that those settings are ready to be applied to the new Windows devices. For example, you would want to create Group Policy Objects (GPOs) to apply the user and device settings to Windows devices. + If you ensure that Windows devices closely mirror the Chromebook device configuration, you will ease user learning curve and create a sense of familiarity. Also, when you have the settings ready to be applied to the devices, it helps ensure you will deploy your new Windows devices in a secure configuration. + Record the combination of Windows device deployment strategies that you selected. + ### + **Plan for AD DS and Azure AD services** + The next decision you will need to make concerns AD DS and Azure AD services. You can run AD DS on-premises, in the cloud by using Azure AD, or a combination of both (hybrid). The decision about which of these options is best is closely tied to how you will manage your users, apps, and devices and if you will use Office 365 and other Azure-based cloud services. + In the hybrid configuration, your on-premises AD DS user and group objects are synchronized with Azure AD (including passwords). The synchronization happens both directions so that changes are made in both your on-premises AD DS and Azure AD. Table 5 is a decision matrix that helps you decide if you can use only on-premises AD DS, only Azure AD, or a combination of both (hybrid). If the requirements you select from the table require on-premises AD DS and Azure AD, then you should select hybrid. For example, if you plan to use Office 365 and use Group Policy for management, then you would select hybrid. However, if you plan to use Office 365 and use Intune for management, then you would select only Azure AD. + Table 5. Select on-premises AD DS, Azure AD, or hybrid + @@ -325,11 +425,15 @@ Table 5. Select on-premises AD DS, Azure AD, or hybrid
        ### + **Plan device, user, and app management** + You may ask the question, “Why plan for device, user, and app management before you deploy the device?” The answer is that you will only deploy the device once, but you will manage the device throughout the remainder of the device's lifecycle. Also, planning management before deployment is essential to being ready to support the devices as you deploy them. You want to have your management processes and technology in place when the first teachers, facility, or students start using their new Windows device. Table 6 is a decision matrix that lists the device, user, and app management products and technologies and the features supported by each product or technology. The primary device, user, and app management products and technologies include Group Policy, System Center Configuration Manager, Intune, and the Microsoft Deployment Toolkit (MDT). Use this decision matrix to help you select the right combination of products and technologies for your plan. + Table 6. Device, user, and app management products and technologies + @@ -437,34 +541,61 @@ Table 6. Device, user, and app management products and technologies
        You can use Configuration Manager and Intune in conjunction with each other to provide features from both products and technologies. In some instances you may need only one of these products or technologies. In other instances, you may need two or more to meet the device, user, and app management needs for your institution. + Record the device, user, and app management products and technologies that you selected. + ### + **Plan network infrastructure remediation** + In addition to AD DS, Azure AD, and management components, there are other network infrastructure services that Windows devices need. In most instances, Windows devices have the same network infrastructure requirements as the existing Chromebook devices. + Examine each of the following network infrastructure technologies and services and determine if any remediation is necessary: + - **Domain Name System (DNS)** provides translation between a device name and its associated IP address. For Chromebook devices, public facing, Internet DNS services are the most important. For Windows devices that only access the Internet, they have the same requirements. + However, if you intend to communicate between Windows devices (peer-to-peer or client/server) then you will need local DNS services. Windows devices will register their name and IP address with the local DNS services so that Windows devices can locate each other. + - **Dynamic Host Configuration Protocol (DHCP)** provides automatic IP configuration for devices. Your existing Chromebook devices probably use DHCP for configuration. If you plan to immediately replace the Chromebook devices with Windows devices, then you only need to release all the DHCP reservations for the Chromebook devices prior to the deployment of Windows devices. + If you plan to run Chromebook and Windows devices side-by-side, then you need to ensure that your DHCP service has adequate IP addresses available for both sets of devices. + - **Wi-Fi.** Chromebook devices are designed to connect to Wi-Fi networks. Windows devices are the same. Your existing Wi-Fi network for the Chromebook devices should be adequate for the same number of Windows devices. + If you plan to significantly increase the number of Windows devices or you plan to run Chromebook and Windows devices side-by-side, then you need to ensure that Wi-Fi network can support the number of devices. + - **Internet bandwidth.** Chromebook devices consume more Internet bandwidth (up to 700 times more) than Windows devices. This means that if your existing Internet bandwidth is adequate for the Chromebook devices, then the bandwidth will be more than adequate for Windows devices. + However, if you plan to significantly increase the number of Windows devices or you plan to run Chromebook and Windows devices side-by-side, then you need to ensure that your Internet connection can support the number of devices. + For more information that compares Internet bandwidth consumption for Chromebook and Windows devices, see the following resources: + - [Chromebook vs. Windows Notebook Network Traffic Analysis](http://go.microsoft.com/fwlink/p/?LinkId=690255) - [Hidden Cost of Chromebook Deployments](http://go.microsoft.com/fwlink/p/?LinkId=690256) - [Microsoft Windows 8.1 Notebook vs. Chromebooks for Education](http://go.microsoft.com/fwlink/p/?LinkId=690257) + - **Power.** Although not specifically a network infrastructure, you need to ensure your classrooms have adequate power. Chromebook and Windows devices should consume similar amounts of power. This means that your existing power outlets should support the same number of Windows devices. + If you plan to significantly increase the number of Windows devices or you plan to run Chromebook and Windows devices side-by-side, you need to ensure that the power outlets, power strips, and other power management components can support the number of devices. + At the end of this process, you may determine that no network infrastructure remediation is necessary. If so, you can skip the [Perform network infrastructure remediation](#network-infra-remediation) section of this guide. + ## Perform Chromebook migration + Thus far, planning has been the primary focus. Believe it or not most of the work is now done. The rest of the Chromebook migration is just the implementation of the plan you have created. + In this section you will perform the necessary steps for the Chromebook device migration. You will perform the migration based on the planning decision that you made in the [Plan Chromebook migration](#plan-migration) section earlier in this guide. + You must perform some of the steps in this section in a specific sequence. Each section has guidance about when to perform a step. You can perform other steps before, during, or after the migration. Again, each section will tell you if the sequence is important. + ## Perform network infrastructure remediation + The first migration task is to perform any network infrastructure remediation. In the [Plan network infrastructure remediation](#plan-network-infra-remediation) section, you determined the network infrastructure remediation (if any) that you needed to perform. + It is important that you perform any network infrastructure remediation first because the remaining migration steps are dependent on the network infrastructure. Table 7 lists the Microsoft network infrastructure products and technologies and deployment resources for each. + Table 7. Network infrastructure products and technologies and deployment resources + @@ -495,10 +626,14 @@ Table 7. Network infrastructure products and technologies and deployment resourc
        If you use network infrastructure products and technologies from other vendors, refer to the vendor documentation on how to perform the necessary remediation. If you determined that no remediation is necessary, you can skip this section. + ## Perform AD DS and Azure AD services deployment or remediation + It is important that you perform AD DS and Azure AD services deployment or remediation right after you finish network infrastructure remediation. Many of the remaining migration steps are dependent on you having your identity system (AD DS or Azure AD) in place and up to necessary expectations. In the [Plan for Active Directory services](#plan-adservices) section, you determined the AD DS and/or Azure AD deployment or remediation (if any) that needed to be performed. Table 8 list AD DS, Azure AD, and the deployment resources for both. Use the resources in this table to deploy or remediate on-premises AD DS, Azure AD, or both. + Table 8. AD DS, Azure AD and deployment resources + @@ -531,9 +666,13 @@ Table 8. AD DS, Azure AD and deployment resources   If you decided not to migrate to AD DS or Azure AD as a part of the migration, or if you determined that no remediation is necessary, you can skip this section. If you use identity products and technologies from another vendor, refer to the vendor documentation on how to perform the necessary steps. ## Prepare device, user, and app management systems + In the [Plan device, user, and app management](#plan-userdevapp-manage) section of this guide, you selected the products and technologies that you will use to manage devices, users, and apps on Windows devices. You need to prepare your management systems prior to Windows 10 device deployment. You will use these management systems to manage the user and device settings that you selected to migrate in the [Plan for migration of user and device settings](#plan-migrate-user-device-settings) section. You need to prepare these systems prior to the migration of user and device settings. + Table 9 lists the Microsoft management systems and the deployment resources for each. Use the resources in this table to prepare (deploy or remediate) these management systems. + Table 9. Management systems and deployment resources +
      @@ -587,10 +726,15 @@ Table 9. Management systems and deployment resources
        If you determined that no new management system or no remediation of existing systems is necessary, you can skip this section. If you use a management system from another vendor, refer to the vendor documentation on how to perform the necessary steps. + ## Perform app migration or replacement + In the [Plan for app migration or replacement](#plan-app-migrate-replace) section, you identified the apps currently in use on Chromebook devices and selected the Windows apps that will replace the Chromebook apps. You also performed app compatibility testing for web apps to ensure that web apps on the Chromebook devices would run on Microsoft Edge and Internet Explorer. + In this step, you need to configure your management system to deploy the apps to the appropriate Windows users and devices. Table 10 lists the Microsoft management systems and the app deployment resources for each. Use the resources in this table to configure these management systems to deploy the apps that you selected in the [Plan for app migration or replacement](#plan-app-migrate-replace) section of this guide. + Table 10. Management systems and app deployment resources + @@ -629,60 +773,81 @@ Table 10. Management systems and app deployment resources
        If you determined that no deployment of apps is necessary, you can skip this section. If you use a management system from another vendor, refer to the vendor documentation on how to perform the necessary steps. + ## Perform migration of user and device settings + In the [Plan for migration of user and device settings](#plan-migrate-user-device-settings) section, you determined the user and device settings that you want to migrate. You selected settings that are configured in the Google Admin Console and locally on the Chromebook device. + Perform the user and device setting migration by using the following steps: + 1. From the list of institution-wide settings that you created in the [Plan for migration of user and device settings](#plan-migrate-user-device-settings) section, configure as many as possible in your management system (such as Group Policy, Configuration Manager, or Intune). 2. From the list of device-specific settings that you created in the [Plan for migration of user and device settings](#plan-migrate-user-device-settings) section, configure device-specific setting for higher priority settings. 3. From the list of user-specific settings that you created in the [Plan for migration of user and device settings](#plan-migrate-user-device-settings) section, configure user-specific setting for higher priority settings. 4. Verify that all higher-priority user and device settings have been configured in your management system. + If you do no want to migrate any user or device settings from the Chromebook devices to the Windows devices, you can skip this section. + ## Perform email migration + In the [Plan for email migration](#plan-email-migrate) section, you identified the user mailboxes to migrate, identified the companion devices that access Google Apps Gmail, and identified the optimal timing for migration. You can perform this migration before or after you deploy the Windows devices. + Office 365 supports automated migration from Google Apps Gmail to Office 365. For more information on how to automate the migration from Google Apps Gmail to Office 365, see [Migrate Google Apps mailboxes to Office 365](http://go.microsoft.com/fwlink/p/?LinkId=690252). + Alternatively, if you want to migrate to Office 365 from: - **On-premises Microsoft Exchange Server.** Use the following resources to migrate to Office 365 from an on-premises Microsoft Exchange Server: - [Cutover Exchange Migration and Single Sign-On](http://go.microsoft.com/fwlink/p/?LinkId=690266) - [Step-By-Step: Migration of Exchange 2003 Server to Office 365](http://go.microsoft.com/fwlink/p/?LinkId=690267) - [Step-By-Step: Migrating from Exchange 2007 to Office 365](http://go.microsoft.com/fwlink/p/?LinkId=690268) - **Another on-premises or cloud-based email service.** Follow the guidance from that vendor. + ## Perform cloud storage migration + In the [Plan for cloud storage migration](#plan-cloud-storage-migration) section, you identified the cloud storage services currently in use, selected the Microsoft cloud storage services that you will use, and optimized your cloud storage services migration plan. You can perform the cloud storage migration before or after you deploy the Windows devices. + Manually migrate the cloud storage migration by using the following steps: + 1. Install both Google Drive app and OneDrive for Business or OneDrive app on a device. 2. Sign in as the user in the Google Drive app. 3. Sign in as the user in the OneDrive for Business or OneDrive app. 4. Copy the data from the Google Drive storage to the OneDrive for Business or OneDrive storage. 5. Optionally uninstall the Google Drive app. + There are also a number of software vendors who provide software that helps automate the migration from Google Drive to OneDrive for Business, Office 365 SharePoint, or OneDrive. For more information about these automated migration tools, contact the vendors. + ## Perform cloud services migration -<<<<<<< HEAD + In the [Plan for cloud services migration](#plan-cloud-services)section, you identified the cloud services currently in use, selected the cloud services that you want to migrate, prioritized the cloud services to migrate, and then selected the cloud services migration strategy. You can perform the cloud services migration before or after you deploy the Windows devices. -======= - -In the [Plan for cloud services migration](#plan-cloud-services) section, you identified the cloud services currently in use, selected the cloud services that you want to migrate, prioritized the cloud services to migrate, and then selected the cloud services migration strategy. You can perform the cloud services migration before or after you deploy the Windows devices. - ->>>>>>> master Migrate the cloud services that you currently use to the Microsoft cloud services that you selected. For example, you could migrate from a collaboration website to Office 365 SharePoint. Perform the cloud services migration based on the existing cloud services and the Microsoft cloud services that you selected. + There are also a number of software vendors who provide software that helps automate the migration from other cloud services to Microsoft cloud services. For more information about these automated migration tools, contact the vendors. + ## Perform Windows device deployment + In the [Select a Windows device deployment strategy](#select-windows-device-deploy) section, you selected how you wanted to deploy Windows 10 devices. The other migration task that you designed in the [Plan for Windows device deployment](#plan-windevice-deploy) section have already been performed. Now it's time to deploy the actual devices. + For example, if you selected to deploy Windows devices by each classroom, start with the first classroom and then proceed through all of the classrooms until you’ve deployed all Windows devices. -In some instances, you may receive the devices with Windows 10 already deployed, and want to use provisioning packages. In other cases, you may have a custom Windows 10 image that you want to deploy to the devices by using Configuration Manager and/or MDT. For information on how to deploy Windows 10 images to the devices, see the following resources: + +In some instances, you may receive the devices with Windows 10 already deployed, and want to use provisioning packages. In other cases, you may have a custom Windows 10 image that you want to deploy to the devices by using Configuration Manager and/or MDT. For information on how to deploy +Windows 10 images to the devices, see the following resources: + - [Windows Imaging and Configuration Designer](http://go.microsoft.com/fwlink/p/?LinkId=733911) - [Build and apply a provisioning package](http://go.microsoft.com/fwlink/p/?LinkId=733918) - [MDT documentation in the Microsoft Deployment Toolkit (MDT) 2013](http://go.microsoft.com/fwlink/p/?LinkId=690324) - [Step-By-Step: Installing Windows 8.1 From A USB Key](http://go.microsoft.com/fwlink/p/?LinkId=690265) - [Operating System Deployment in Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=733916) + In addition to the Windows 10 image deployment, you may need to perform the following tasks as a part of device deployment: + - Enroll the device with your management system. - Ensure that Windows Defender is enabled and configured to receive updates. - Ensure that Windows Update is enabled and configured to receive updates. - Deploy any apps that you want the user to immediately be able to access when they start the device (such as Word 2016 or Excel 2016). + After you complete these steps, your management system should take over the day-to-day maintenance tasks for the Windows 10 devices. Verify that the user and device settings migrated correctly as you deploy each batch of Windows 10 devices. Continue this process until you deploy all Windows 10 devices. + ## Related topics -[Try it out: Windows 10 deployment (for education)](http://go.microsoft.com/fwlink/p/?LinkId=623254) -[Try it out: Windows 10 in the classroom](http://go.microsoft.com/fwlink/p/?LinkId=623255) +- [Try it out: Windows 10 deployment (for education)](http://go.microsoft.com/fwlink/p/?LinkId=623254) +- [Try it out: Windows 10 in the classroom](http://go.microsoft.com/fwlink/p/?LinkId=623255)     From e0269383f5a64c1590f3608845de597f122a52e0 Mon Sep 17 00:00:00 2001 From: Trudy Hakala Date: Thu, 19 May 2016 15:02:49 -0700 Subject: [PATCH 349/439] fixing errors --- devices/surface-hub/TOC.md | 2 +- .../i-am-done-finishing-your-surface-hub-meeting.md | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/devices/surface-hub/TOC.md b/devices/surface-hub/TOC.md index ea7471374a..57c833cdd0 100644 --- a/devices/surface-hub/TOC.md +++ b/devices/surface-hub/TOC.md @@ -20,7 +20,7 @@ #### [Accessibility](accessibility-surface-hub.md) #### [Change the Surface Hub device account](change-surface-hub-device-account.md) #### [Device reset](device-reset-suface-hub.md) -#### [End a Surface Hub meeting with I'm Done](i-am-done-finishing-your -surface-hub-meeting.md) +#### [End a Surface Hub meeting with I'm Done](i-am-done-finishing-your-surface-hub-meeting.md) #### [Install apps on your Surface Hub](install-apps-on-surface-hub.md) #### [Manage settings with a local admin account](manage-settings-with-local-admin-account-surface-hub.md) #### [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md) diff --git a/devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md b/devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md index 4e46440aa0..d724b7651b 100644 --- a/devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md +++ b/devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md @@ -1,6 +1,6 @@ --- title: I'm done - ending a Surface Hub meeting (Surface Hub) -description: To end a Surface Hub meeting, tap I'm Done. Surface Hub cleans up the spplication state, operating system state, and the user interface so that Surface Hub is ready for the next meeting. +description: To end a Surface Hub meeting, tap I'm Done. Surface Hub cleans up the application state, operating system state, and the user interface so that Surface Hub is ready for the next meeting. keywords: ["I"m Done", "end Surface Hub meeting", "finish Surface Hub meeting", "clean up Surface Hub meeting"] author: TrudyHa --- @@ -75,13 +75,13 @@ Accessibility features and apps are returned to default settings when **I'm Done The clipboard is cleared to remove data that was copied to the clipboard during the session. ## Frequently asked questions -**What happens if I forget to tap **I'm Done** at the end of a meeting, and someone else uses the Surface Hub later?**
      +**What happens if I forget to tap I'm Done at the end of a meeting, and someone else uses the Surface Hub later?**
      When you don't tap **I"m Done** at the end of your meeting, Surface Hub enters a Resume state. This is similar to leaving content on a whiteboard in a meeting room, and forgetting to erase the whiteboard. When you return to the meeting room, that content will still be on the whiteboard unless someone erarses it. With Surface Hub, meeting content is still available if an attendee doesn't tap **I'm Done**. However, Surface Hub removes all meeting data during daily maintenance. Any meeting that wasn't ended with **I'm Done** will be cleaned up during maintenance. **Are documents recoverable?**
      Removing files from the hard drive when **I'm Done** is selected is just like any other file deletion from a hard disk drive. 3rd-party software might be able to recover data from the hard disk drive, but file recovery is not a supported feature on Surface Hub. -**Do the clean-up actions from **I'm Done** comply with the US Department of Defense clearing and sanitizing standard: DoD 5220.22-M?**
      +**Do the clean-up actions from I'm Done comply with the US Department of Defense clearing and sanitizing standard: DoD 5220.22-M?**
      No. Currently, the clean-up actions from **I'm Done** do not comply with this standard. \ No newline at end of file From 5e41c41448e98ad6209f7b0b63a66227fa6c79e5 Mon Sep 17 00:00:00 2001 From: Trudy Hakala Date: Thu, 19 May 2016 15:34:22 -0700 Subject: [PATCH 350/439] fixing YAML block --- .../i-am-done-finishing-your-surface-hub-meeting.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md b/devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md index d724b7651b..c12785567d 100644 --- a/devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md +++ b/devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md @@ -1,7 +1,7 @@ --- -title: I'm done - ending a Surface Hub meeting (Surface Hub) -description: To end a Surface Hub meeting, tap I'm Done. Surface Hub cleans up the application state, operating system state, and the user interface so that Surface Hub is ready for the next meeting. -keywords: ["I"m Done", "end Surface Hub meeting", "finish Surface Hub meeting", "clean up Surface Hub meeting"] +title: 'I'm done - ending a Surface Hub meeting (Surface Hub)' +description: 'To end a Surface Hub meeting, tap I'm Done. Surface Hub cleans up the application state, operating system state, and the user interface so that Surface Hub is ready for the next meeting.' +keywords: 'I"m Done, end Surface Hub meeting, finish Surface Hub meeting, clean up Surface Hub meeting' author: TrudyHa --- From 159fb993f4ee60f6b4ef07f575d1597df06feeb1 Mon Sep 17 00:00:00 2001 From: Trudy Hakala Date: Thu, 19 May 2016 16:04:08 -0700 Subject: [PATCH 351/439] fixing YAML block --- .../i-am-done-finishing-your-surface-hub-meeting.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md b/devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md index c12785567d..02819a1963 100644 --- a/devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md +++ b/devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md @@ -1,7 +1,7 @@ --- -title: 'I'm done - ending a Surface Hub meeting (Surface Hub)' -description: 'To end a Surface Hub meeting, tap I'm Done. Surface Hub cleans up the application state, operating system state, and the user interface so that Surface Hub is ready for the next meeting.' -keywords: 'I"m Done, end Surface Hub meeting, finish Surface Hub meeting, clean up Surface Hub meeting' +title: I am done - ending a Surface Hub meeting +description: To end a Surface Hub meeting, tap I am Done. Surface Hub cleans up the application state, operating system state, and the user interface so that Surface Hub is ready for the next meeting. +keywords: I am Done, end Surface Hub meeting, finish Surface Hub meeting, clean up Surface Hub meeting author: TrudyHa --- From 15e9cedb168240e5ed9bbc745d444d37e9ac364c Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 19 May 2016 16:18:36 -0700 Subject: [PATCH 352/439] fixing spacing issues --- ...advanced-security-audit-policy-settings.md | 48 +- ...ackup-tpm-recovery-information-to-ad-ds.md | 90 +- .../basic-audit-account-logon-events.md | 14 +- .../basic-audit-account-management.md | 262 +--- .../basic-audit-directory-service-access.md | 19 +- .../keep-secure/basic-audit-logon-events.md | 41 +- .../keep-secure/basic-audit-object-access.md | 257 +--- .../keep-secure/basic-audit-policy-change.md | 160 +-- .../keep-secure/basic-audit-privilege-use.md | 53 +- .../basic-audit-process-tracking.md | 91 +- .../keep-secure/basic-audit-system-events.md | 84 +- .../basic-security-audit-policies.md | 47 +- .../basic-security-audit-policy-settings.md | 71 +- .../keep-secure/bcd-settings-and-bitlocker.md | 1119 +++-------------- .../keep-secure/bitlocker-basic-deployment.md | 197 ++- 15 files changed, 760 insertions(+), 1793 deletions(-) diff --git a/windows/keep-secure/advanced-security-audit-policy-settings.md b/windows/keep-secure/advanced-security-audit-policy-settings.md index 5f82176445..5b5faf0b14 100644 --- a/windows/keep-secure/advanced-security-audit-policy-settings.md +++ b/windows/keep-secure/advanced-security-audit-policy-settings.md @@ -2,52 +2,74 @@ title: Advanced security audit policy settings (Windows 10) description: This reference for IT professionals provides information about the advanced audit policy settings that are available in Windows and the audit events that they generate. ms.assetid: 93b28b92-796f-4036-a53b-8b9e80f9f171 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Advanced security audit policy settings + **Applies to** - Windows 10 + This reference for IT professionals provides information about the advanced audit policy settings that are available in Windows and the audit events that they generate. + The security audit policy settings under **Security Settings\\Advanced Audit Policy Configuration** can help your organization audit compliance with important business-related and security-related rules by tracking precisely defined activities, such as: + - A group administrator has modified settings or data on servers that contain finance information. - An employee within a defined group has accessed an important file. - The correct system access control list (SACL) is applied to every file and folder or registry key on a computer or file share as a verifiable safeguard against undetected access. + You can access these audit policy settings through the Local Security Policy snap-in (secpol.msc) on the local computer or by using Group Policy. + These advanced audit policy settings allow you to select only the behaviors that you want to monitor. You can exclude audit results for behaviors that are of little or no concern to you, or behaviors that create an excessive number of log entries. In addition, because security audit policies can be applied by using domain Group Policy Objects, audit policy settings can be modified, tested, and deployed to selected users and groups with relative simplicity. Audit policy settings under **Security Settings\\Advanced Audit Policy Configuration** are available in the following categories: + **Account Logon** + Configuring policy settings in this category can help you document attempts to authenticate account data on a domain controller or on a local Security Accounts Manager (SAM). Unlike Logon and Logoff policy settings and events, which track attempts to access a particular computer, settings and events in this category focus on the account database that is used. This category includes the following subcategories: + - [Audit Credential Validation](audit-credential-validation.md) - [Audit Kerberos Authentication Service](audit-kerberos-authentication-service.md) - [Audit Kerberos Service Ticket Operations](audit-kerberos-service-ticket-operations.md) - [Audit Other Logon/Logoff Events](audit-other-logonlogoff-events.md) + **Account Management** + The security audit policy settings in this category can be used to monitor changes to user and computer accounts and groups. This category includes the following subcategories: + - [Audit Application Group Management](audit-application-group-management.md) - [Audit Computer Account Management](audit-computer-account-management.md) - [Audit Distribution Group Management](audit-distribution-group-management.md) - [Audit Other Account Management Events](audit-other-account-management-events.md) - [Audit Security Group Management](audit-security-group-management.md) - [Audit User Account Management](audit-user-account-management.md) + **Detailed Tracking** + Detailed Tracking security policy settings and audit events can be used to monitor the activities of individual applications and users on that computer, and to understand how a computer is being used. This category includes the following subcategories: + - [Audit DPAPI Activity](audit-dpapi-activity.md) - [Audit PNP activity](audit-pnp-activity.md) - [Audit Process Creation](audit-process-creation.md) - [Audit Process Termination](audit-process-termination.md) - [Audit RPC Events](audit-rpc-events.md) + **DS Access** + DS Access security audit policy settings provide a detailed audit trail of attempts to access and modify objects in Active Directory Domain Services (AD DS). These audit events are logged only on domain controllers. This category includes the following subcategories: + - [Audit Detailed Directory Service Replication](audit-detailed-directory-service-replication.md) - [Audit Directory Service Access](audit-directory-service-access.md) - [Audit Directory Service Changes](audit-directory-service-changes.md) - [Audit Directory Service Replication](audit-directory-service-replication.md) + **Logon/Logoff** + Logon/Logoff security policy settings and audit events allow you to track attempts to log on to a computer interactively or over a network. These events are particularly useful for tracking user activity and identifying potential attacks on network resources. This category includes the following subcategories: + - [Audit Account Lockout](audit-account-lockout.md) - [Audit User/Device Claims](audit-user-device-claims.md) - [Audit IPsec Extended Mode](audit-ipsec-extended-mode.md) @@ -59,10 +81,15 @@ Logon/Logoff security policy settings and audit events allow you to track attemp - [Audit Network Policy Server](audit-network-policy-server.md) - [Audit Other Logon/Logoff Events](audit-other-logonlogoff-events.md) - [Audit Special Logon](audit-special-logon.md) + **Object Access** + Object Access policy settings and audit events allow you to track attempts to access specific objects or types of objects on a network or computer. To audit attempts to access a file, directory, registry key, or any other object, you must enable the appropriate object Aaccess auditing subcategory for success and/or failure events. For example, the file system subcategory needs to be enabled to audit file operations, and the Registry subcategory needs to be enabled to audit registry accesses. + Proving that these audit policies are in effect to an external auditor is more difficult. There is no easy way to verify that the proper SACLs are set on all inherited objects. To address this issue, see [Global Object Access Auditing](#bkmk-globalobjectaccess). + This category includes the following subcategories: + - [Audit Application Generated](audit-application-generated.md) - [Audit Certification Services](audit-certification-services.md) - [Audit Detailed File Share](audit-detailed-file-share.md) @@ -77,35 +104,46 @@ This category includes the following subcategories: - [Audit Removable Storage](audit-removable-storage.md) - [Audit SAM](audit-sam.md) - [Audit Central Access Policy Staging](audit-central-access-policy-staging.md) + **Policy Change** + Policy Change audit events allow you to track changes to important security policies on a local system or network. Because policies are typically established by administrators to help secure network resources, monitoring changes or attempts to change these policies can be an important aspect of security management for a network. This category includes the following subcategories: + - [Audit Audit Policy Change](audit-audit-policy-change.md) - [Audit Authentication Policy Change](audit-authentication-policy-change.md) - [Audit Authorization Policy Change](audit-authorization-policy-change.md) - [Audit Filtering Platform Policy Change](audit-filtering-platform-policy-change.md) - [Audit MPSSVC Rule-Level Policy Change](audit-mpssvc-rule-level-policy-change.md) - [Audit Other Policy Change Events](audit-other-policy-change-events.md) + **Privilege Use** + Permissions on a network are granted for users or computers to complete defined tasks. Privilege Use security policy settings and audit events allow you to track the use of certain permissions on one or more systems. This category includes the following subcategories: + - [Audit Non-Sensitive Privilege Use](audit-non-sensitive-privilege-use.md) - [Audit Sensitive Privilege Use](audit-sensitive-privilege-use.md) - [Audit Other Privilege Use Events](audit-other-privilege-use-events.md) + **System** + System security policy settings and audit events allow you to track system-level changes to a computer that are not included in other categories and that have potential security implications. This category includes the following subcategories: + - [Audit IPsec Driver](audit-ipsec-driver.md) - [Audit Other System Events](audit-other-system-events.md) - [Audit Security State Change](audit-security-state-change.md) - [Audit Security System Extension](audit-security-system-extension.md) - [Audit System Integrity](audit-system-integrity.md) + **Global Object Access** + Global Object Access Auditing policy settings allow administrators to define computer system access control lists (SACLs) per object type for the file system or for the registry. The specified SACL is then automatically applied to every object of that type. Auditors will be able to prove that every resource in the system is protected by an audit policy by viewing the contents of the Global Object Access Auditing policy settings. For example, if auditors see a policy setting called "Track all changes made by group administrators," they know that this policy is in effect. + Resource SACLs are also useful for diagnostic scenarios. For example, setting the Global Object Access Auditing policy to log all the activity for a specific user and enabling the policy to track "Access denied" events for the file system or registry can help administrators quickly identify which object in a system is denying a user access. -**Note**   -If a file or folder SACL and a Global Object Access Auditing policy setting (or a single registry setting SACL and a Global Object Access Auditing policy setting) are configured on a computer, the effective SACL is derived from combining the file or folder SACL and the Global Object Access Auditing policy. This means that an audit event is generated if an activity matches the file or folder SACL or the Global Object Access Auditing policy. + +> **Note:**  If a file or folder SACL and a Global Object Access Auditing policy setting (or a single registry setting SACL and a Global Object Access Auditing policy setting) are configured on a computer, the effective SACL is derived from combining the file or folder SACL and the Global Object +Access Auditing policy. This means that an audit event is generated if an activity matches the file or folder SACL or the Global Object Access Auditing policy.   This category includes the following subcategories: - [File System (Global Object Access Auditing)](file-system-global-object-access-auditing.md) - [Registry (Global Object Access Auditing)](registry-global-object-access-auditing.md) -  -  diff --git a/windows/keep-secure/backup-tpm-recovery-information-to-ad-ds.md b/windows/keep-secure/backup-tpm-recovery-information-to-ad-ds.md index dfc256208f..5f46d91a0d 100644 --- a/windows/keep-secure/backup-tpm-recovery-information-to-ad-ds.md +++ b/windows/keep-secure/backup-tpm-recovery-information-to-ad-ds.md @@ -2,90 +2,128 @@ title: Backup the TPM recovery Information to AD DS (Windows 10) description: This topic for the IT professional describes how to back up a computer’s Trusted Platform Module (TPM) information to Active Directory Domain Services (AD DS) so that you can use AD DS to administer the TPM from a remote computer. ms.assetid: 62bcec80-96a1-464e-8b3f-d177a7565ac5 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Backup the TPM recovery Information to AD DS + **Applies to** - Windows 10 + This topic for the IT professional describes how to back up a computer’s Trusted Platform Module (TPM) information to Active Directory Domain Services (AD DS) so that you can use AD DS to administer the TPM from a remote computer. + ## About administering TPM remotely + Backing up the TPM owner information for a computer allows administrators in a domain to remotely configure the TPM security hardware on the local computer. For example, administrators might want to reset the TPM to the manufacturer’s defaults when they decommission or repurpose computers, without having to be present at the computer. + You can use AD DS to store TPM owner information for use in recovery situations where the TPM owner has forgotten the password or where you must take control of the TPM. There is only one TPM owner password per computer; therefore, the hash of the TPM owner password can be stored as an attribute of the computer object in AD DS. The attribute has the common name (CN) of **ms-TPM-OwnerInformation**. -**Note**   -The TPM owner authorization value is stored in AD DS, and it is present in a TPM owner password file as a SHA-1 hash of the TPM owner password, which is base 64–encoded. The actual owner password is not stored. + +> **Note:**  The TPM owner authorization value is stored in AD DS, and it is present in a TPM owner password file as a SHA-1 hash of the TPM owner password, which is base 64–encoded. The actual owner password is not stored.   Domain controllers running Windows Server 2012 R2 or Windows Server 2012 include the required AD DS schema objects by default. However, if your domain controller is running Windows Server 2008 R2, you need to update the schema as described in [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md). + This topic contains procedures, some of which are dependent on Visual Basic scripts, to recover TPM information and decommission TPM on remote computers. Sample scripts are available, which you can customize to meet the requirements of your environment. + In this topic: + 1. [Check status of prerequisites](#bkmk-prereqs) 2. [Set permissions to back up password information](#bkmk-setperms) 3. [Configure Group Policy to back up TPM recovery information in AD DS](#bkmk-configuregp) 4. [Use AD DS to recover TPM information](#bkmk-useit) 5. [Sample scripts](#bkmk-adds-tpm-scripts) + ## Check status of prerequisites + Before you begin your backup, ensure that the following prerequisites are met: + 1. All domain controllers that are accessible by client computers that will be using TPM services are running Windows Server 2012 R2, Windows Server 2012, or Windows Server 2008 R2 with the updated schema. - **Tip**   - For more info about the schema extensions that are required for a TPM backup in Active Directory domains that are running Windows Server 2008 R2, see [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md). + + > **Tip:**  For more info about the schema extensions that are required for a TPM backup in Active Directory domains that are running Windows Server 2008 R2, see [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md).   2. You have domain administrator rights in the target forest, or you are using an account that has been granted appropriate permissions to extend the schema for the target forest. Members of the Enterprise Admins or Schema Admins groups are examples of accounts that have the appropriate permissions. + ## Set permissions to back up password information + This procedure uses the sample script [Add-TPMSelfWriteACE.vbs](#bkmk-add-tpmselfwriteace) to add an access control entry (ACE) so that backing up TPM recovery information is possible. A client computer cannot back up TPM owner information until this ACE is added. + This script is run on the domain controller that you will use to administer the TPM recovery information, and it operates under the following assumptions: + - You have domain administrator credentials to set permissions for the top-level domain object. - Your target domain is the same as the domain for the user account that is running the script. For example, running the script as TESTDOMAIN\\admin will extend permissions for TESTDOMAIN. - **Note**   - You might need to modify the sample script if you want to set permissions for multiple domains, but you do not have domain administrator accounts for each of those domains. Find the variable **strPathToDomain** in the script, and modify it for your target domain, for example: + + > **Note:**  You might need to modify the sample script if you want to set permissions for multiple domains, but you do not have domain administrator accounts for each of those domains. Find the variable **strPathToDomain** in the script, and modify it for your target domain, for example: `LDAP://DC=testdomain,DC=nttest,DC=microsoft,DC=com`   - Your domain is configured so that permissions are inherited from the top-level domain object to targeted computer objects. - Permissions will not take effect if any container in the hierarchy does not allow inherited permissions. By default, permissions inheritance is set in AD DS. If you are not sure whether your configuration differs from this default, you can continue with the setup steps to set the permissions. You can then verify your configuration as described later in this topic. Or you can click the **Effective Permissions** button while viewing the properties of a computer object, then check that **Self** is approved to write the **msTPM-OwnerInformation** attribute. + + Permissions will not take effect if any container in the hierarchy does not allow inherited permissions. By default, permissions inheritance is set in AD DS. If you are not sure whether your configuration differs from this default, you can continue with the setup steps to set the permissions. + You can then verify your configuration as described later in this topic. Or you can click the **Effective Permissions** button while viewing the properties of a computer object, then check that **Self** is approved to write the **msTPM-OwnerInformation** attribute. + **To add an ACE to allow TPM recovery information backup** + 1. Open the sample script **Add-TPMSelfWriteACE.vbs**. + The script contains a permission extension, and you must modify the value of **strPathToDomain** by using your domain name. + 2. Save your modifications to the script. 3. Type the following at a command prompt, and then press ENTER: + **cscript Add-TPMSelfWriteACE.vbs** + This script adds a single ACE to the top-level domain object. The ACE is an inheritable permission that allows the computer (SELF) to write to the **ms-TPM-OwnerInformation** attribute for computer objects in the domain. Complete the following procedure to check that the correct permissions are set and to remove TPM and BitLocker ACEs from the top-level domain, if necessary. + **Manage ACEs configured on TPM schema objects** + 1. Open the sample script **List-ACEs.vbs**. 2. Modify **List-ACEs.vbs**. + You must modify: - Value of **strPathToDomain**: Use your domain name. - Filter options: The script sets a filter to address BitLocker and TPM schema objects, so you must modify **If IsFilterActive ()** if you want to list or remove other schema objects. + 3. Save your modifications to the script. 4. Type the following at a command prompt, and then press ENTER: + **cscript List-ACEs.vbs** + With this script you can optionally remove ACEs from BitLocker and TPM schema objects on the top-level domain. + ## Configure Group Policy to back up TPM recovery information in AD DS + Use these procedures to configure the [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md#bkmk-tpmgp-addsbu) policy setting on a local computer. In a production environment, an efficient way to do this is to create or edit a Group Policy Object (GPO) that can target client computers in the domain. + **To enable local policy setting to back up TPM recovery information to AD DS** + 1. Sign in to a domain-joined computer by using a domain account that is a member of the local Administrators group. 2. Open the Local Group Policy Editor (gpedit.msc), and in the console tree, navigate to **Computer Configuration\\Administrative Templates\\System**. 3. Click **Trusted Platform Module Services**. 4. Double-click **Turn on TPM backup to Active Directory Domain Services**. 5. Click **Enabled**, and then click **OK**. -**Important**   -When this setting is enabled, the TPM owner password cannot be set or changed unless the computer is connected to the domain and AD DS backup of the TPM recovery information succeeds. +> **Important:**  When this setting is enabled, the TPM owner password cannot be set or changed unless the computer is connected to the domain and AD DS backup of the TPM recovery information succeeds.   ## Use AD DS to recover TPM information + When you need to recover the TPM owner information from AD DS and use it to manage the TPM, you need to read the **ms-TPM-OwnerInformation** object from AD DS, and then manually create a TPM owner password backup file that can be supplied when TPM owner credentials are required. + **To obtain TPM owner backup information from AD DS and create a password file** + 1. Sign in to a domain controller by using domain administrator credentials. 2. Copy the sample script file, [Get-TPMOwnerInfo.vbs](#ms-tpm-ownerinformation), to a location on your computer. 3. Open a Command Prompt window, and change the default location to the location of the sample script files you saved in the previous step. 4. At the command prompt, type **cscript Get-TPMOwnerInfo.vbs**. + The expected output is a string that is the hash of the password that you created earlier. - **Note**   - If you receive the error message, "Active Directory: The directory property cannot be found in the cache," verify that you are using a domain administrator account, which is required to read the **ms-TPM-OwnerInformation** attribute. + > **Note:**  If you receive the error message, "Active Directory: The directory property cannot be found in the cache," verify that you are using a domain administrator account, which is required to read the **ms-TPM-OwnerInformation** attribute. + The only exception to this requirement is that if users are the Creator Owner of computer objects that they join to the domain, they can possibly read the TPM owner information for their computer objects.   5. Open Notepad or another text editor, and copy the following code sample into the file, and replace *TpmOwnerPasswordHash* with the string that you recorded in the previous step. + ``` syntax UNNz* zgW*o3C#D+;-pktS+hg0q+atNwhR-q*a{TqEvO}#rVkLvKkFw9c4{e&tDy&wJuDo87 zr;5rEt0hvI*Q8vn6k76y-8G$iJP1=-wy-ikX%^Q4%i_VZ`pBgXbv=pjTgnu8X7pI{ zDCG$9*8MYL2u9Fgm^n301~v?~IgUGab*fwu&TJ&kpei#L%W3Li8giPwng(qXtq(^0 z2z-)E5@iw|Et6_#Sy97)bf_fFV<(`p4po*_){EhbG3EJr?y4Be ztPAn-+QrU>;?0_nyaSarqX7dn*Al{)v6}jCSOBy zBP{dg{;IxCC#zSTb+Y$!Xm?EzmGDe2ry>g4Xh7!?#Z~^IqGhE&D>>W)Mxab zm#kJ_a9&tmgs$a`vFFfaYqB{{^$m$`DeX@SBIG17TW?nQDTpcrnl~PjF&Q((gDV$n znhV{_9tIHZsgv6u7GyWH@LA z${4NqR=C>O+XM#~%{0g6HL^6MZDjGe8ELCH?QFU>U(atscd~X6cD=DunTB*7Jo6@c zZ-a|5OBvDVd6I?X!oGb?{40z?TY?!yas9=eA_m^Gm!Q|2lxdoCI&4W)hnDc$wG^$q z*Uz)~4h~Q9ezrpT{nj5;rEwi{h;r*0JlUA(Zp5~%{5+j3K|kZ;97W1VrH}eUOde6FaXF%jcREy3W*dcQe^V~arfZKc^MC4gKAT{EJsFjil;!Kk__SuQn&0Go zXgslLg=~M>hT^h4BmNP2$lJj?p>y5ha$UE&{{`FvPOs+Cw>@z=;d@V*RTyl~Y)`Lh z)v<29@ak;zHhVb6%jTL`zwPwA!u(j6&*tV|@4WG{f9QX>+r(V=bE0~i7;Rs6r@E-@ zQ0UOV6*?DQ7F`dW7u0@VTe@8Hx9V}vy_sHc4oC z*jP$g9ss;303aX;0G>Yn@nZmRWd?u~0|4Mj1pqAjpZfh000{qww3x7}$I4l{rJ@QL zeei>ci5^;ow^Dw+*+S*M2}Kr1Jhu^E7_o$*;bbW<0FNQU&Dn)|2~=nm?^x~@pSQ_tE=!_%O|A@Or>LL6f{`c*qVdRRpfAXE8d7+*sE-0Ca#Arcgm;nryPneAt=2! zd?m}+qjg3AbdWFrDU8DM89M@sHBHV$(=~@cV^yc+ePnK-z91Ay0~~dF5V5)|tSjIh$-sm*T=?u2 zYs&VfPndM!VKXf67S`J2m;M}FDS4u!=MwjD$|1mb+zO8qf>K9Y{c~W{f3X0mj^b%y z41*vMme{i{R1XM1YNk8@Q*BbSqlC_~x*M7D>-xn)Gs~{*i$$E)$CqyB>pdE4EP5l4zy_?8s>%XK zJAPV^UT4q!?r#ZUQ7n=E9uu;zp{HR7>!I+o9j+U1MSE1@6wuK3InV1VUc7B|3w5cd zSZK{8Fg@qIq2+-X{vcq}0Rg9xUUmTu?wzdrvyI11Q9NHi@k$0W)92L%t6Ri+d zDnd06s|`=s*A?_7G+~{$*#BgUI~BBC91G7*$$FM-ZExpwC_ld6a0vEN9*e-tcwwKP z=PG0WeSO4|H)?(1On;Vx7k9=%T=t=@Dw&nLd48>fH1UuV=h!RBF*w~nyhydQ+&{eB zFFjUQ5jko~me`kc8Uv;dr3J z&?>-#tuGAhs$a)vcQQ`OVjP0qpb#*w>hIV%XWMCjD9M!Uzfk1O_ zDqEMPyJY?(D}xo^t5X6u-NG-=^PjK&)=xoJjNa(KA*jn2owR+y0TA(2zLrwT3W93!s%!joA_l$%e_fc5bt}$^Ax{E0@$F>D%4sJ zWXYQr2dk9jm<2`88b5ml^LhXvMLp(Ok73h!Ywei#)%Hz5EB1`y^1A3m@=*0{y>Z$u z`HsxHxFo7xbZw0|b(b-xAFXV zXJngfTV59>1-I$t_nNVht{t+&S0Afp{r)b*NIz)>OKAL$N#p+55TCb_@Gpj6b(J(c z%8HP2cmnQS@8=dd@J1(1tPvs_R(cmYf9MokXyvJEJLp;0-axo7D7R>ReXF#_y0Dxw zI350cmj1>WP%>@227x96wY5`*mr>*?w<)n3JOOeWqi}2PYCfTxLr28NU!d;!B&Qzi z<%M)BFHrC~9I$ktY|;4y&=lN5_gURI`}*H%+@VrX+?MYb4kyPv^gx zM5`iWBEr5%Dwe)I%8LCN^Y2QQXP-==GETHa%@TbG$rso*eD>7CKhkjH<*B0l zgq&Majgh<_MVH;2?E-H>YUV3NEy0+Wm=Ub8D-I2q2>nBK>E!e}i;i!@%Q+$2OCt9D z-#IdN+K+nsdZ~$7`JxaVY&0RWVBms#1BRy!=vA~5l}lX+$9Od)!@qjt@))&wF84U) zqQFmLu0T31)r=p1Z$Me}Lxu`CYuCg=&!$<{W=$@3rM7;>vf0ayX)C}r%!t!2HepI9 zcunRvMd-sb$vLZ+$xmFInOC$@@ytST(M65L6!jI1=iR?NxA3NJzN3z6JnrBleA^)3tP3L5oQ_8?((X`}N8Q z-<#0HrOC0((=#eQaP@N~vha3Y!};gIhNgWd*L7a;`T%1#Iv_k@VI6zth<}Gh+*6J6J7Nc1Q%NR;Toox^>rVu2$QXKYeWnJxF znMoqk_M30SvK8MbREK4v8r2K%nlGKKHd;$oR(o<8kMw|L#xiwK8Tqx@wpLGt$r{TC z{Hp4@)%Em{gdAPcZvQ@s7Lv_P2t4h`VG-*jPSjty*0d)d%^k6>aT1#%143@q9VUMH zQC|pyUc_skPs&Qh-%0%Z82^&oA2*6v!*K+c(wfv_Kih(nD@AP{TN0M93Lwm(y1tB= zsjR9?e$=s!Y^;n781~4L+~Q-PJnY{cfAIn3?%wZIGeMb3ANDh8)!dkQvE0bq!>zJT zFo0*gq;-i-NFx5~Ypt^_zUy1$bW6fHw65LX->3L0Y>4oz9DaP64fV7ik5B)8@Esih z-&d8DC<0&Wg&W?in(u%2_aL$C!9SgPlh>cOWW|mZARyGnx-81U43Y%;JP5XC^Z8mA ze~8R<#0v!9(saTXR``q3XuJ?YSwwU(d*27dDV#(Bah${5T_+l%D%#(owD$|Tkb;%V z=dX8h3J%TOu(fzx&9K|dK^(#8TFMsQ1Tq<~u!&T}7$9>CasWgpgFm$Jb4 z0di53K;wH6G#X^BLbV<2iw-rdz0!gk;f1I@4LV?x8M1=BWpRoj0WFctalSvTf9CAI zohk%0A_q*EQQ+PMd;+%4d9kK&WVzlxbQ-uOSIca6S}fV+XW7S}xl6w$9eB>_vCDhc zhWpa*96K8Zee|Fj6Re4UEbKy2zK1G5`Uq@Fs(7w7xWvlAYt=QY!4S+|<}x<|QONT# z`R9E)qcm3OS%(s{{s3VM1M4@ zd(SF{Y5}r0TEe!X_2XJ#q7q~1WCHHf_umCr2%jJV4F+UQ%lW%^=dM2iq1v}}g5RJ} zw%ZjO=sOXCi_vi}Kn$K?nc@reC-^{-T$KNh#d+ZW3t0Z+Y_q&|68mun{k;uayBu;G z{*XyqI9|>4&lR9ai-e)UMQ9p{2b&P~E9{egFON(4q7_nNnHv@sUxT~kq|`$(1xbyP zfSOsj88PSwdj?mis-HK_n#%H zZ5ABjyLM4yT2T!HUq0^S&%e2`665V{G;PR27o!haadBdDYz|nK$99`nU#rOT{;hZpy`;wjYUb^>$f<)$c5Ea^8y>=7kr<=Mw;~W~!;J6lqfK}C$qMWXo zM4QPAsGix&yf4h(TP(qI^!Mm}Y5*(7zHAjdkZe=-V(U~|cGhfi({R_Y!04zZ&vFls z?2d?eTfVGaRNa`>t2x?M^_rJ&4v){e)D0}xy zxB5Onml(>g*LvwGdcpM3;QO6&9#`)QK62dD`701Pz72$}K35fWyng!l#@27NJydJM z6Be7P9)Z*rSn_3YY<`-{1QdNPFR4-{n*8_+i{F{A(DsrwmaJGN;k%xVwC4Db0*nVV z%!I$7j7wqKiw2$fZL_zS4wAOcvK-7UNi5jSj6I5&2>sIb+)q(?0aEq}CzU%a_M+kD z^|nd74fG~B?S!R>`|=c32vUXdcO%$)%YS!3g7vc}zs6KG28JY08OL(31vPtwZEQ8J^ce5-+V!t-`q5Vqe_Tx;cph zUeF9XWZKFoeHL3;Y%p>qseLu6XwE>TxaS?_>QBx}lA$^HJyj_NS%SKIU#kNdNEs}K zlxkH(5=zvC63PT~OgNuHp5ub1$X+nY^Z?R$YW{K=ax{?CH}24j5$$rTkp!`PZG=fR z*My0-oa?eA+fB$4#uS%PS{d3C8QERax0AgFBVZ@rYrIpD6BJNKK~X6}E;G|mvtfr5 z4W{lJt|GU|)Yd>BhiuVdj2s6k(w*)(v;r+UNIeHN$9=Pse&ZFt&z6TzeN@!4w(s;!6z zyIwz_MU9V{YrT(4h3*^v=GWmg_%&X~ewcdKh;6Y*gJ-45pv;hgY=10eJ#k-nSWo*4 zQer=;a@ReR4WGj-Il2l}>BAS@JE|^%i&%|a)opQZ$@_#EcBWJmw7tph3I~sBlCpGt z-8-p-J$i@NgWN;M5+H3b!Tdi26{YVRomPAancvsT&9$Ys&DC>4Qr_-FOE2Dn$1RU5 zX}}}6W}P|Hpvu6(Vym}x`b*x+>E^RZTY>!~y5u2mDQPA7ck4|Sv)#j`)T5J=vCLnl zCB&FseGjtUY)$;fTv+@&X@u?7rk76jnZKDAzuCAzqwH`-jvJ%%M4g_lF4=sOvJ2`* zs~&7HS;0q2F?8Xs=%sAJ>|_4i$70|N7~9gsjwc^6Z{Y~(zjQq;xl9zV#=hxfb=9jx zCmKD4N6ruj8Zfg>@);-pK4X}vC|P?wd;D(A63%^W&c=oe3y>3HuV8R!yXPBtw_W_e zc!3{G#=K-?luaaTtbCey$rb8>;6(TYeEQB1+v!*`O)+vK6eDWW7h{ck!V3u=t9+)yG~-F*H7Fal3F?)f*`QE9bN2w{HQj- z&M_R`MkEA2sETj741za>J&y=vtS$!+@0?&CIq~wgV}~4{9huyE5b(<&A)LgUfvM+U zlq_sy^R#dv7(;@CT_F%@Q)?t3zq&Po(Y7HCM7=5%nu*z7x7mjXGN`#Wj_aWHY;?T7 z(gk=^snxWn&-#Lk%VXX9HDp`B`V?YFwC|6#diyL*@fCdVGco-9$cHc{u=!Y5wf0t3 zz2bk$K~|nO`98lm+=%Aw4ddjRJavB51cCQ#cz9b^h*R+r(S=td@T zE{4Z>-&Y_*VGyF^i~b}!svaUtc|Vp~jq?>GaiM?(wXfo7*899%p4&cWiDHTR#W!A{ zBm;>@0dlK@_`2ef6u@v?MD_@aiu#0thFWRW?X>3-xcN?2ujl3be*Y^s>f5;5PmJ5X zw3iRal#$sCQ0A>8r0VyQ{8{TmkS=iDrUlTawxC<+JdTAP$ve|e=gb!X%R8|V*SE#O+rpfd_ zO+w|hwN%0LcTYj`CY((O!6LU<78`neTTlST3&=vbRIgR39;CrPLEk0?xA!mcyCC1> zy)8rN*$G~8#$*ebEHl^-DDeE3oN0|+$Ua^$(0%TZv^d?Vj2cm=}> zECJ!V9C|dTTnPj;E8efQq)b1HZf_J?jJdLLEhgIY>lZuXV9@Bd@i3~YQGy@=nVl}h zyA*UpPiQlY06if;8VI2atjKBa^;orXRY3WnBRJa$aO9}D3M&H}?QeeutccSt17aWm zL7A(y2#qJ8gDgbXjQk{sI<^TpU$OF^rBJK>dwUr0^YFnUjUstkdH?%nuvM^A^=oM7 z4N~OE%JW})TwCh=+8{(!Y*iseV=Pr6bm1Ue1dRftxsq@QQjU!!BT+=$AaE^(Mh&qB zN{}upUYH9i3eAieHgrgu=0ofiZgeZxQy1Rn)HeYE4?gqB8nesA`o$GCXC%o&dHDsX5H^{falgV?+7vC4WK(LP%_@rZoJjiW-{DCNX^_Gd(>HgP;-WnP;V~ zUe3>e;ExAY&OXANzlRPecJ$Ek>9VPbi1W(gu}J@1E>_DZm*G*NTS(6p9#9yJBb(Dg zb0ejslu&o0r=&datn4uvX5j?J70}m}s-W)~p9^%n-LmOf(+#Gl-?ILs7&rdS2;a~z zLlXsDYOb^GrVWQvR^Qz9xNmEWPIjsp_lFy9$z=ufe=(ucYqv>Bf&l;@5g>+$Uw25U zH6Da`{nxn7Sz3_H89+|G7G+;BBwIR{YGov(7$XTIR5iULs2n!0pxI`v8E2a|>w04X z7KSC|+UD3zmX5vY8AxW&NnSq-^|ECv*OlEaQkUEN$i}PkLRGqO&11M2e~j+lJXPCS z4}huBD;@-=3el08yDEiCFC@Q{AZQ<-I=12~Z-PR?VpmLgk($-ZcJQ4W8(jL3{QW=d zen!3t0qG3ucIbu==+0$HkUESh2tu}SsHYzX^)aLg!*lyrh0jeo$|FgsrFcl$m<_>9 z=)488m+#{1l2V*U+6ojh_@lOw#@>s6e$;6`xT*V^R>~Lf4Dp&q&)#t?eksFPuTn z%h+`S^m<;Q-f5mDj;(ihHd*q!vXhq=UqNYv`Zab#=F@TH){}U;#O*~{5K?n+oK+$Q zepd~vLc1E+wyQ&eaq6H`F?nP9h*eE5wFD)?#nmI2)%2TQYk@9U+Ad#aac3l5I3{oU zp|^Oc#h=Dbwbw3xI@`2+Z!< z=Z%F?BM9w-LsGDVQQchSZ=HM{PE*cZ8LqI65Eh1yS0JarO^Puz3_d0

      -V@r)eYU^9L!D$XjhGuxu7`dnTg@@KYD@All+y|#E%NjSs!VGA&wHtZaHlqKgZDG#Yinj z%+Y;)eL26$A4RbmYzgh#XBqI^rfvLSf*SO=%y%e>{`!=gt*1VH#q{I#dCjYnqBtU1 zw|uU-Hr2hw!rW|qCDpv5`~5-%Ikd0cW`?RUaMPqNqZwmcm z!WGxstn7^M`{~9@@yycP?3fd}_eaU-N9rFZbV_(xGaMpy&okTOPg|pGrdUSCpgnS3 z_6*OXh5eRpz8Vt#Lx>U;l4hNE^6r`Gr83f&F8CJzH`0KmC1-&0Yc%4mMd(TJzVp(L)~^p4l&Ze z`dpl8xWC0b#UFPyh$i=0ySfS@NB8F8i0%l)eF&0@gzxk_;hi|{LR~L9;W0Ea6b~>_ zjLB{GPda`%caL)hN#vb11O^fUJAXrN@oOk#1*hAquL3HObbo5i>*E|VV=G3vIWFG< zaLQyrWLuuK{U$i!U25=N*LE>;l>e&Z-*^3fiyD7BD;~h{cY%s{zu_>xW-Q6ZKo$sA zD-Cl1x~??zcM+k)4Qg=0ExGAj%lX#dxpHeC0c7AKy4t38!YCgI(Czkn@!cch{f3H| z!S3L?^8{g&arSG+ax%SpD<>^IPqJRqy!KiH!r|;ZbhE>epWo^#VMAL2*8ZpgPfUxa z4}Z|zhMLduNxl1>NWUv{3f(CYy(bqoi|2I$lGn>Nb(@>1;WSznb+n0G6Mva+qUPaD z0MGQe@R$v`b3%mKD85N+--Ma-R{IoknFIm~cnD3Zsi2EBXnc&B+`co>!n0*KD zoKcq-ulZ%D_jz#m#CvQJG99=mozjBi2i;m#U&|m+P;f)V){ECaNZW-7_$CTB?yPdn zbnic(WVkh-&CKK)7uQTfL(+#P4}Vn-(#yOjs2ZrU`WFh@?O&}#6-SJGPvliNIoWr= z+{>(4+Nf){%(;MOh+28pf&(ZN^UEr?Mr5aq{#-`=Xn|AF)s?qbdAl`aQ4(K^xT~t1 z_x6eq<8Bla6BmO~rkmsC^{9I2)+ii`;XgD#;4{KUl`e7g6xuVjQITf%?Ey$fCIuzM z$QU}pt6IOsdL*MXoM;RTizA7#8^1||H#^N~Et5QpZSq@-*29j3)i_auncSo+$w;-Z zuYQEBQ8H2FyWW2jbA1!buMXuwoo{u|kV^FI4D8@d!~7D>@gYWzHooa{x8n6cG-KTt zaz~uMh0rg?zA~HYi(LE82bHZ;4`ly32yD=e0ngC#2#d(ZH(4qki}ySlm} z$!D67@rTtC7whudF8B4B3$+T%PF(D?EAa7hv^Ub+X!Jcqwp&ASER5&RYq)6-JDR$W zTLe8mR*>eaq`~KpNV1Y1zgguIcY~*8RAN!5$Bnf&EH29h(2q_<#ry;W#P;wy0>c(A zqLqlWx&>pxkk%MI{d|c~vzFWM=c~b{Sg1vDPZP zU1a%?s~ewZa>9IGzkj@x8}G9OB@KS2gx}@A89fQh&fXwO3u13%zs^~+T%CXBicLOT zvooFPRwDZb+2CZ=mUh(DI_sfj@jFk*_HBXHak+ZsGR@|CS%Ld9kM0~ZYvy#Ov0I$Z zu$>dsbn-p_bKfuM#1W0xF%q&}aO}TdB>-s(5rdW&O)sXX1fimCwD7lDdN+ zjq_{O%ecYsN+b)Q+rHaR2g&C79^)k91?lZ`k4cI!gsyFSAmea5)yi#-q)qO5fv6a6;$UIdUpXkP$>|C8h}0pk=bmRqGQM!w`hI|FuT8=sp&E)##Av z@3FpTr#*<1l%w0_cyFN1fTs{il6>PIp=HHt@&2y8>3e|hWYaO!%2Jly(<4L*|M_$N zGdwA&r;_8q-OyvZmY--Od*OjkdUT_-RpbG$fxR;5h8_(irIgt>hniJ zq8#3RC;~l^%FFnN+qDmNA68En=js(FPXO3V({s!~4SCm|dIU2z7KAT|4YxJ)lz2<0 z6o)C1-HJd=&w65DLLM*_RJ`GDP=MuEwec^TQXQrxB}0b%>d2B5e!Ym2OxyHIT9!ad z&~pOWT(+vI=D_38x&lf);*efxL%<7>sSPM|J3Kn`0=9yJ z!QaX5JXrt%O-Hlz;H!D<>SX_}(X!B6Mj+n&6W-;AF8ViNHEspbgyK9kDsZv|=ej$! zoTLY%R)bV$B}l5A9N=Wa1?_I6>kg<>*=Fk18@}#CTuN6ng87D3Z?+%ufElDQ!`(Nk zOeLfIf+vWH$=H6n$)v@RlXROuvS+Ihse8@fw?dxKer@3MMF|u(=xgz#iO-{2tee#M z25yQnq7ZV8mKzT}eH7yTM=z5;jjOwJhViBZ^}+4f`={{=G4pV3pTS{J^?#nlDMffoGi z2O%5RH(_Oo!@OY+1JF45^^@mX%??6NIrzFGNodD(7Y5k+>npE)`g_*v1vs18ym=N- zec7KhuZLXJGXE1a;>5qT9sP1YN>*n6!#RL_0=QYOjXbP?B!(%w+3*gj`kpy@2%wAt z4gs`|7(x_?jfylFGIOZ8BK%iJrZ@p@*D1gV_b)~2biZb<#j-)?;bBO_3mXZ8{F>`j zdH&CoBQHYl*OsLk6y={3m2dHd9Dh6C#Yc^OJPy>6(jAB>=14@BSJj~iNed$dM18)~ z?U%0jM63eAorVL{>77gJrJ)N+GgysWr%^|LuL+f0(`R#^Os>LKFOSU9p5dIbpk_>u*;IHVUdbDM zc{X+1-ua|!rjh>Oto^0>XQou7;i)P=yQD@efmta8bLnAX2bJUu&$q@Ae)2Qp?3xwh z4t=MfF2ltYymj-5{4o{4DB&~XW12~mWn$pd;6&!3b5ph_#O{I-pstZx=_6n>Xb%yQhPJ-z#EsdE;nvy-6}fJ-y^VE5VL3V~Vgn+6M=Z zwGXPQeOwk}gp1j~-~5ru_&8+?tDlrxaVkHu`P-bL2f>UL4p8^w_;!*3E=MHFAWBkH zK+oUx1ZOvbwiRptiS21xfM{}Fm z#jGKzaCSh|2Q^8+=$u3Nq2HE3bi-FmRJ1QdGG6FddeY8ynAfxsqsR@i__qF9K#!f{ zu~-mosUohd#&D4gJ?B0q2UfMHxKKQ$*VMs8xdm28$!sOc-fr(#VXK06QnD`kg#g*Z zHV35)*|jn$k?B0o`AR`+dH1v+>*%y`h?oD;!q%vFF$h+p{Ts;_$c|t9&Rm4DDjV>X z<@*HA%^7SJ#`>!pwlGL)bH=7Z0nbVtJsXes01^@syd`(;?BXo1!GmU6OM@{}`v${Z zT?%sg3D0Bfr~9(r@R1WsU;7kH6*FhQ18>_JxgmZ_^n*vemX(j=$b&vl2A*dPj_*%e}DW z&^ZLI6!qWLq4_R(FautXzy=y|DVKGbkg;=o^!kcVJ z9cs+;)^{bW(Qz(id-LwktwnXI?hQHCumC^stETbX*xDKaQC?en)w%0p(n(pT+c*Db zc~mrJ+}fIM z4hWd`gJGg9EWC;KW2?bE7xsllW>#BWYdHwH)z`1>ltBTV zf&vg8^pciq_@*7J5l1R`%TYaIhQst3|CE~89dXD-wyA|+2stX2hb0Y+dEY_A(G4C> zGp*bmskxYgsYIOtg$D%~;!hH>XI!gH&@HBhaY(P-`*xBt{-DteTp%Q+!;%>*4I8XxAmwO)_EoPh*V4H zV^W%~^>MC};Qbw(s}XsB$6B0Z?B$Q9pL$&!s+uP!?N5BcgJh}cVaDCifvM#yxIoYS zcpYO{S|PyDs6ic6Q=L`yjtDSB7sjD)$TJ;CH>N;vAX-?O8&9zkDK?y_MwjU{SoHtY zOdk7Bru82*!Tt}PhW8reGygZV{+IaACjSR*{-5~2`v0%^Z~lJ`o!)!I@_xX<>c8tk zd`&-xq}S-#zyM)*vf1~umhS;c%MNxPd)i1xBj?bu z7c+a+W*B|2h)-6n=>RYd<|@}zzD*`$X0Bwc%G|P5>WVQOmy@T}m)YE-YtUgc7Os^O ze*hw$I|QD&&BG*aB8l=BPdIq4FC?p<+v}tp+_ON(YhIQ@6)z*-X82wfcHY zjJ0B4rytdTqN;=M)5=k1?|(>yVOtgb$N1L--6!SJUD)UmJOyrHEp=^=|Y=2t^i?V+{>AOB#p1Z&n|zORL7`uY*H0cNX?3;DHnPU~=7OhWO!J zNtMlj1F`DrblE>EYwcNoj(2{U6En|Yv0Ky5SmgcmZ$6Idj)o18D4IE)3j$}p{|<%% zf^kD!W>w|{{}sCZl($Of+|04;5jQPLEJ?lX8lES74q&R_(KC|2)}r`+^kFbfER%#A zFw_%w)Bv=6E>$dpqAy>xYQ>MytKM}e%XStE%QpN9e2vn}n}gMW%%6AoiqDLnuTf64ai*O6`SBBq1-8;x=k200Dzo4&1~)3?ecuRdN+tDE^0N9K&VizkYzrjb8j0!DW+)Q+HZR$d=@*?EkVD{)2f z?9rhD{8*y$OZ<6MQvdKn-a+S^zd#EliN<5&dL6)hT}xa-;6nmPO%UNoAOvDLSht<9 zA#3dxcM6~(kiZsyaMK*H1GcZBL>7husMvSv2P&j`FmP)nB#3`(hij01Aq-_vHOKGH z9yP@#$w3ei3!$vYLnYaQjcO4gTbK&ad-!J_S#A+=D&>#AI}sO@yD?IOb!_?&4L=w4YOFD||jB484*9`>@HVtgIfYpqNbPj_x% zpwQh(g+H9?8rC3M-H2FQ$5!6AS=~WvwSAsKe6RV4g2@>FRedOi$GR-%g`)F1ELM2E ziD_P@jTu`}C4JJ1o&LzXAAihKoXZ&(3|x3(4jWtsxa6S!!F z=vPt@iBU1DkQ33(E%Ca$+Z-)5p6$?PCzXT1n};s}k=6r)gQnkfSw-{a;7^x=P!J~@ za7RB#X-lXa?2N=-RH(~Nq(V{hr;oYT8FPIb{9`2~&D!RlvgByI?_QOjtpRm{bt?ov zLjRisd0?PXYo)pD!Ouiy#<-lbsarR!=`1PQxO#ilp5eCS3TM;DQ9Zw=D>_wyi|lUs zuLaz@<+N#Vw9-`0P`0i*1~_pZeo zJh?A-F68~`o$|W;67|guqSI|O=KR$?p&{F$LB)2E7wW;^95YGFSYw`2=>}>InKR|9 z8XAHN1aN+Ccfkl$5ZG+K8BbwjLj*`vHI&c*0HkrS>dV2z31sgv8^Nck!ch&(0QK^Z zn!u6t`A9m6FDihC!+Blb&%!n;FPNJXHGd+oSTpP0;qw?kRV@*WvB788s5>-&y-M{I$x3PWxTht33zcP{RyudgOk*3p5A+4cA8N>`0Z!5rGn^;L%i9gAh1&IF@K z$?8aC_~sjMk40V4h@I%k`CTGJ#|obA#0Bv(7)kv93jRO;2#b!UD`w~9gl?EB88IB9 zHq{b|itbk~9a~z`&?TAdYNe}xtB9#MqbnsoSI8?797EmT7ry?jZMXBtN(3^cgOj~ zfZ!`zB;37wO>M2F)7?Xtz`{)BY>tmgb8}2>ZLOmQ_Fb)h8H~rc4Bh*e*u<$}+kdld zY_e(I{}w23*p9?k3#gQAP9^Srp3jK}15jWm+=n4*GfvO&5s=B*h7X(m{p(Z*oig$G z($tn)t^%Bp(ITa#q0L`4eT<(TR7F}r3oJkJV%=k;R6vC^y9#>{%*>83f4^2X$-=xO zR`3Ch-XEz1JhZPA0Z#na>xU8$f1k}<_nlasHkzy#FILt`b8|I|Ie_OC9&1qb3IuT6 z?lXJK%wF2OQ7wMeuI8N{0sOMT`KyDt9^|Uq^oFlzZd8Y_E5WaE!cpIi7x2S22)HfN zt!Jf`!+%Z#FOC8oI==O){B4%Lz%rcRUClX?!LRf7y&1JRd@pL2tMK+!(mmZ;Z0Aqc z79T{;Aa*yszka%4EF`&V<}v!XX}LT<`D(`Mi> z7h9E3dkuXjT6U+8->j|qow0`v^Dv@0*OeaB@pN4~>7|_Kj2XP1e}3r^Hi-_7>32Q! zJOcu;kUdkr*a7)FMndO@{5;od1J{XBJhoYkKZw@4t(k-g#sfX$;}3mb)O257ibTFT zYzh7L^v`vhT||wKj}K5aQ(Nl1v(dZXni z3(EE2ZI3nG_b5E`X^&@v@!)vS@f$9}bS7nWx?L#;u5sM}038bpqhzMf>>@&kZ+A+T zqd6&hxO8ZUzc^vdx;Q5$%4W&9_hsNUBOfBblYj_9ymT^`5oJjLc@+f*$Bwt+;RVe_ z->WPbG_t3^VSIkXVc#Gaod3S<7SW^lT22Le_aa0x_k9#y>CK})nKXfS_R4NY*GiLn z_t|WD;koK}Eof`y&KaBIUp>&AIIJ}iJ+-TkEgbgXtCUTNnLx_ohOl&x{Z_^JPKwI) zu@X^5NEkS1xub|ao{0SS_m{t|8C+Ces@_gN*f{ilvX^mKvru?#F2&3aJeqE-j%-J` z`RqEKOw7W>esM#(M0NZa?)$^0)mW9ic+E?dBG{SMTab4RDiq06q!zsTk*Z$&;kotp z#36F~Nvs+&chL$RK3KW%i78R8T8X->4Xwdy|3y$H&tr4^mkM>_<><@%=r(-+OFhlr z+aKCsk;)gfC;#lMqdEA(6L+%@2i`JQL1Zw}Nh58rvM#rBr7|@~8?yP6LzHsfl&YO* zzGt^vmPDaqsefZWvU=sm-^n?jzvk+U(#7hXOffR0ik5fX*^kw#XhexSY-aGs_0%GC z38fq>l?oT5CgVtx7E}qtd+;1#ek&8J<(%g~hiP{X-Lc!5x?=Q-=Bc|7I|oPp{SYKq z9;!#90={%`JA~!%En4D*qw~ScnK09wF8AfvhX`m&T1?mNfVmip z)#Uek_W`HC0hpf5zem4oYkN$<>F}*h@2JhoBTt#!rk4e>oZd1q!bqe*OquC??$UEJ zHM9ow_+e`4>Cmnrbu*;8_aZu5I#heN>nj`_AQ!`iyG$YCrG`GAuKQmFQqhlQzfG`p zvmY$UGLA-IYBk@p5K$RvWFw$5nW?I`>aA*-6ErMZGE?2Vvcat~ z`kOT4QFC37yf(9yE>EsXXEMw&q;~73fw||EN$iGdZXUneW^Y~ra)y7tx=;4tQ`wN} zh`J+T8{>UO`L5fL1e_~|ZrZR%9)eF_b%hR(+qd)ALZ%uEXTWP4Xat7+c#UF4EGLee zHHQnH42}(qzW!JF+Sk7~{t~9))VMX0OwTL-ZuGl0(R^8hB4yA?^LGu5-ioMjgcVCn zn49xHr|?xSh`_nte1P4$wC59p^xfESj>Z-Icd4s&wATMR9wN&AU54s+z0jsS8ZBge zpC8fze{1RuAj@^2-zq1F^N_+|A}MwecAnRlBjzvF0(YUyJMghCp4jSYH?~9R=ELC| zHdonu@6S{QTGHrR{Nq_W^O4_R4!kqnj_bve1>lQ2Aq*^xBvZ8@<+rODjxmQr4Z|t5 zn+I7yh4!KSZfD*)z~@32K-Bg`cjB&ia_mO{@~N&mk5gDW=h|yq=5jB;ilp*6eK(v6 zYv2{R+8|Wt$w5SiuHPrGP@ixZyCVYPcnCK)|Iq}k$>XBhTG07>6ZgmSPpvjCOoinD z^-Pki{!XPxUal@fCS=j0`!_c3o85v?{ToL*K_7O_=^00w5`*OlUfvR%!7d2qX~!z&ES{4_P`*_T?! zeMWz{tHzdT0fA+6jW&mzB&cFX*I}(M41t1|L46IaXn6uaE!(1JF_|+$W|oYpAKTY zT$g-K|ND*oQ5uq@tso5E8B^kD?IzQzsOmg&*8^X$2-{^o2UdTTs7m=e#t^;`<>D>5 zABjkj+|#FJNSUnZZaikrzR>k=^jo9nq2cWXEpz%9{bmkV!q~UeV4oH-n!0l0it29yd{NV`p!Hd9fiS3ey+wri|Tl{a+pVEh(tQ5cU1iIz;gaj2CC)2abw_jEU z8PH~Gc~gHwx%?Z{SZCpXAg#GGbmNm|?ciYHNJp`?v`exx zKH@KzUa)XVWZV`8CMNmjTO!vq zzFL=!pL1I))JR5ieIFHbx3-G#o!VGmO`Te2QHOEfU@KKs$m){0K_}al{4(+1*?^h# z*M={4c2iJH;rN7+s4yK^o9SuX#;7TYVp+ulBL z!16b4+LYjzHgsi1A%Rk+__2fs_ju$6OFQjY9f$)(IXCWTp_9jqQNW!x8Y&=4&zhd` zNa!&kVa&hz{+Uzj6yNE`U=;iv{vQquKTPV{#lYuIM?K2>Y0wR=PCP34$y9sBmFVr{ z?gue3sYOn<3}K6*#RLr6V6jIQOO5ouEat*~9_zGsOz8c}SISU(7U@7eS;rTuZ@aI= zO$iAY(nVi!;yF0zOisS*YUg$<_Ou7+jNGLj)}lbuc&)kpxl^~|1fXfgKk~zX;IJD z7^G46!k7tH+CD3W_pOakgBH|>k%G!vhxBE-%;fxdJL;#kR12aI2yCnu=&f{ykqVg@BJ96ew>*SjHDt`9VhLbN5H+oiRk|;U z<~)x@Iuv{7aH&?59W>8Yrc_8D>gwn!tz(tVBnOO5%A`J#d%PC&rQRCnS69cVV1p;$ zZ@bY4an=!xJy~k}&Ku2%Gh!a=Lf8c_#8rg@$B#R{{f8x{?#fj1a_H|z_oh>Xa}~fh z+Ds8zU~sOl$^nl{mI3b<&q=z@_i2c&J0Up#O>=P2SyBe^of&?5@35FS@Al*Lo@HNe z?_)Kw2&mT}hKzmhmGK%`-93npfuMgsh}oyVbr=oMnpl5-2G5S#KPhe=ZAc(?`>Vq& zV8uTw1I;b?LH~wZIi`RoKC>yK4B>oik%3ZQwa#b=vdeU z{36Yxe-IU7kSYD{^|a-il6%b<35NvUH;*cK0;fo$ebe?t3%4{`{jxWW%9gywaugQP z?T+uF#)zx$o_?N;Z0WN=jb z_mKpjIj9J~>W-MAKh-B zu%n)W&B&q(=^(cpf|(2GqAZZWOG89$PUnj?`fUyyaRP&%IA|(j7DEa%#9sXk>R`i* z{@0{+^8J?%ETjPXPBfIw-LqAWZBSz5q;;q=BNLM}W7M>EcT00~^ASHue+5C#EEMoJ zoOYcNDyR&e=C@n{J%io)>};cX@?M)B!2fdUdVQ{|*ZCm&CBwK*Ex@AkamCd-_u!=V}A0 zX?GX$4`;DiZ*K@af(<7S8B=TE-c*EKHSlWfME&Oo^($OW$D~!u_Fs#q z@%gS;y%i$$T_P9|E<^aaW4YRNrGJD`o|tN1-e>Fy$W6>17Q&WPa@4S3xhNNtU|3d~8?e;>JsdU}J>>y3BUkn*7>NTpC=vbcR|_GdP*`InUogAb zWu?{LCP6b3W{~dMCqQxIP=h(dQRQs#yNy)$`1rUBhpQ9HX7A|eIHOg6erMv5uuARW zj{KrwADO$Ly(jIknOSdN;Kf}|$gSi#8o^|AQ6V!b3xZbxbP!YTmT*iL&hzDC2|%A+N+g{sjj)hu2^suVP1r?zUQvBp?K5jbs^rN zMeWVWd(l|?oIJcBdVMedw)di6a^gZY4{=Ym_MZ%{a(E2WDqNsn!@j6i{-5t^tEwiC zYlg=-bOJ-OJ7`{2C|*RlNim%oS|1-O;q(0acb^twV$Ol4S6khy_`kY}v3vF;{P;&D zcvxz=)g))V6oak@lce6yrPT2&eqZ&8;AtsG>I7uiYe%e)j*R5(GM&zTXF9Iq?x!&F zrCY2?9Gz|UYUJXjJq|Qa6#pwG;d$v~9A`3gVJq?%HzHfQ+uwf-PclxGfa&V2Yq>OP z>_Xqr7KZj=epG)gasBHLAIl%;!oox-$r1V_0C_0?1Nji~GTJAf7;Fp^l%@RB+#pQUo|3Xo@pyQ(Bj9^3E zy43IUI4SXYy1V&VyBt}lI{06oZ%t^R^4s#t)`b!KZ~c=94s=u1X-P7BSejgx z`_+6bG{vBTB4m}k`$5iHKr_z=GAOY`jQ%^>a{xR2fcgXQVf^Fmj^?PlNx<5+%Fk=FyC0eJJDYo}H*>@P=!Xfw{{(7s2jt8Z%Yfx> zUq1ug&Fvr)V9f^<#>Cy2?HP)RB^#)r-j&WykG8N@d&Z9 zfbzGR)opv*;I?MGz&f2}vu`OZCBl+Ed)vAs+ZPvsf*s|ywj99cEA47NuT7;<&}^x! zg@aVn)5Kify4B3xtE+rVI2tK6F=e1I*+>#vuJ_T|1q+-J)exusTt>HS@**b>otzME zowH-9!}2Jm$V$`L;XmY;*H>9@(Xhr+S?B5uNjy4swA^;vt))IL_NWya3ySk}wS|{5 z?K%PPlM5c0{tfvZ7Oqn9XAf9!|I2AE@&;&8d>$?pQ3Pke?S_I)NWyIYf{7aUbHk?e5`&D-nJQh>R?!Qt!@AG&{p$3=2_Kq z4(DwUekLcwVl+JoqV)a;kgQ5ouq8S6tETxb^&}TJk`8%-(;cAdtr9kF^EH8lKn6Oi zNVN8@`SaJ`;O=4L1Za`FHsx`YQ!ICB;})pa(N6376o~>a@P)-pg47d(>9BJ4}`xPWxWeiC<|qs)zi@R zuUpS%Amp`2_`W)GN5T_E~Ag$2YLe;}7cfNS-|W&C5lQ z;pHo#Avv|ZO-9J;unh8Qd5sYVG3{=1I1A6weyR6iiQhE*QD?c#^3%L(<_G~PH=FT@ zlz4vB12i>>_pt(7=qTitc(*oKKi+M6@5?XA**OY?4H zITPzg@Hi73v2Bjushb{*3k$5!=ay~^lg+=5&+!FiJj@&H&5rkmgK_me789ohGnhj6 zuI_(7%X!BF^VRBYA=reAoY2!jlCYmdIy9ycf~?P0>kunByo`*e%q-~+@RS)p^_)1>d!dU>}X^kr=7O5KseqcS9pl=s2{HlC9{nX&!d z68*lNZp)RVxN{nUStH?Aqz+MhQ4o7;6{5udQ`dE4UG2+%|5nU(o8>ho{9qW%&dJWs z?hM%T(Q&^XsULW^{Zld+a1JbP{tVn%kk0k1?;m~()}|);ubb~{>@&@XBh%WwN{@NS zOj(*j4rp($`P2sy=>BrNx90}N0ouRtyT3ZTP9>L+dAhiCCc*={hq!#aynPE$3H6Dcfe+r9ed8?Wcpgo_=Tfq=MO zS8-lW8Y+Z(_W?El-X&j-%)b$PdICXNV)GSFybans<~tE!*5;jxth!g$?CR=zLreqn zdvOq8jR8a$_<0awChbr^OgBDGzc8Fo76(0nG^y=u-C&&ddx`rU(0kz`I<9o=M(!I< z0F#hd2EbMw9atjO)TrJ6x*efiPD+G_=Xp^Ww3p?%hTLDPi2fnQm30J~+ru6y-!xd$me@2f!sS#J#@E$32KtiBa9_WYiZC5s0L>8YHt=~YMdl+)k55)h>l$vm zFnPhcEQ~2?i^MhSqx)x|wPV9DlInDmQgCN^(TjjGaru@ASwyAAfWrG$psv}4sYfjC zfvbjyCGmIY+0-`>es4QfqKq4ED~ic&|kN)nXfo7_-LS5(|al1x}k2gpH>*8L17a&L1s zZ*?fU2{|T(@#?J6+S}7t-8Fw>klKtoiNET)n~>{-W6ix@;$s?{kj?S(0M^I9B3+T+ znXk2SEXj~vjRG{U#mSc3U5SIG_Hxr?;8v9dJ>B%)O~&^WxurM*x7B{D70M*L=yks zIyJ?=^4A1U+9bKJPt2=*pfx2nSOD;^eeLhCoN@E>#=_X#@7XYuWUoJ>#t*P zCg_Dq?*X14$-f=M5ZK$aV~FXYqf&+}FIjQB{)s6#lX$ebuG2o?IF%NY$^B;kU@L|o z%iGEtiy<~r9>y)*OTbJUg5l3{7#Wg4T62gYh7f6p_wI4|P!y7o{d3>Y&_V-4ETUFB z{Wv56p5MX}OALWvb=kY@9)p@Z3i-P??|9a z!bGUAudgha;&q0$dp7fiQ}-CGZ`vftU)}Su&!h41`_Jw&U1g|S=Oz|*JCeZHFdB#C z7VxHcgR*Te!de}EMQiU>9M*i1Tz!KwhZ z4WniZADnJ1q62w;2sQorbnUku1)~fAjL{Zo4R`dR)jDlKdQ~<{^?6izaFE67!=no^ zm3eu+##$pNKmeNc0^swy{B(7_TOFW6I~%`8)_gv-UV%7o81lNp26lpm-yejT;|F(K zc)QWxcR2!2N0Cis6(O3^^@fn3A)_}?gKOV@9NeL zB}FV~F%vcLXt&1%VTj07JI%&DHn?p`rPo01DmO%-i~h#V{;SgoD7HpFAnDb^3{Oz7 zRr4hObe+iCJM{hJkd?T$F8^-7F};MH32*@Al5Kgv&X;-Ltb!LE3=J!$@pU*a4lK5E zELjD=l}QxrM=3nH-K-0be4XFXNaOA=DDM+g(Mc;`*uHct6OgEy`52p~84LxWs$$mn zbs6?{di|3eOUHYb=ej&wkS|>zB#fYkFm;K0NsH2K@q0<7#};@r!))<05VK=H@OwEpSk2xv7`)yKb*U-2_DlH$3r3nHc@qjC?-_#*2ZiAk zdWk!K@$$laU*2UfJFHs1t9@??8RIrb!02ksCQRnr109>spJfqQ^8gW^&5pAyyxP;U z{dz$EMX2M`Sy0t5IV;MJjvPK(n~!{6_IEavB3nvzn;8o5-GW+0RJ|UqNi5;-%{b;n z8xbAU9v3mycTdQpOk5*nKVNTr!xK&Lno2{rP$KQDx)@INurNVpabdNzf>~E5)z#BS z`hcMKj0?^i&G3K&`VWu0ls7${vbjwAcbt}yyxp^#tp-&IPDGhuO^t>&PUfBIphP0{ zY8Ks#ExrJ5Ebh7kCH%RCZ)kzqbH2G+?EYXT=CY-(bE!Q3!bl>U9^Z)&{#M~JY*%-YQ9m;*;d5zT!9jyo<9 z3bh{w*)R~f^l*Wyh4QMj9fVMbyV9kdY%aN;aj@X^Cml$hBIJcn1yYyJb|H3D>#98l zQdW61Whu@RX*3Ew@Ja6Ln_+-Z51Odz`~_^(`C--=>p~d}%=Aa*8|y*z!p9+bh<7;% z;O0UhmTEX|Hn5h96+eMr6+()}lSUvDk}s?_VKVn(KD;bDz<>#ZQ=3o&)< zK~@2PovBSm>0K!!Q^5IVN&+-_i)XBf8Q1S#?Z zA?L+%-~T!LJ)o>#5D|iNLhG@_I`Dq1?tbS3dW60WxkJFrM=p3p;MkX_p9nX zrjO5)zBJ#cCb8z^+&v*QunxD;qo3gl6J}75I3hxZ^8VN>ImbeE9ijHkisIujR7hPJ z3kHERL7d1Z41!D`W@I{KY8RO1;KU>#Wc3TKHy4jNS#-;Fi%hKOUwEzuFfY9+#IczD zrQjv~bA;y9(gydfacCx`99@|wk3BDI67*x>Cfz^5=6gGDXZo3(RmE;)K9otUXOnsC zu1*XWzEHn*y4-D!CiW;~H64N;btkZ6{Z~_qgVshAVoB0u1`c z+WAf2GxqlIe6>$2^ZN3ap01-gR`C{_1FP)t+wFGZcf;EncMlO?N|la&&7%Fn1~24Y zJAJt*f?iT~w{JMM@h*^f*WO)l1;Yr0*;=vr-9>E+ZVlsA2nZUy{7ADm%;j{ys|+3H z&WrRJL#PRZx3mAWr{|H!za1VOudV<;`Izy}ox9NH#50w0#rb*liJN;uYLZ}LfrBGu z-D}HqV|wKTem*d>hO>Ojy>=_6s4~kEA>L@cpgd4CzuqpVmSM>Ee2p8U760LNMpOSb zc0$6BZY4hWBU_N1xX2gHRD?9nJ;R-a>I!e~J|k%VOM=3gSeA(ogb2I1K{lJbzMsED}CH^pbtXig=O^iOSmV-^&zpN0wE05KsRjx350)z4;@`f`i30GNSOEQ zcyVw;tx9vr=AT5fUK-|n9rf3iOd7?LCc>7Qspg1nL@%bD*?+uFDm&U`% z;p8#2kFZL~D^dI&LlSzQq43!I%huf7ToaDjqI;;rVp6XI{2a*3$H&LR!T)t=xU-=3 za_B7GJZ~k8Z{KdC-!k4IAj7dZV8aa(H=Q1xk`^rRjd=Ru)r|0VM<3Nq44@c(m?qN6 zZXc?<_#R%XNh@2p*-Dna$8$xzwAY0BDVX$qOp;iCO@j=0`15NHewIXHhHzB-vydoy z|2!9LZJ+z!{r!RlTI3*uHq$|6+ElC|dDUU+2UZDT@*sf*qnm;d3|$bx6mJ1A`8Mrb zc;O+2kgz-B-w$2!v~i~BpY|>w%$c0frr1>nm*8jmw-A{Hv4XW~=TCqa0Fc8JOB}JG ziVPH}&b6*nhJ?hlbsFTuY|j+`nk9?J5Cid8$$1ik`xaE@8C7kp85)IsKV11rmU%gS z1I-U-uq37RjefW+jNEW!(FfxP?P)89f5`-BZbm$K(<1Q!6a4Y3_WoBC)Ec>O)c&&3|nH!RU_U^|Flkehv<_u5(KYaQ(Ta%$9K26q7 z+b&;#&eK-AP>^b9U@cZnVo^eruzs(yJ z^Svi25zTdWx9ed7DE*Fi=Ja9##gHWHghoSevup$794|v7uV~fX?otdkRBdNkr8sN% zKm$jUaH+Ku(Nz={xjad^g{;GOqf;{SLg#+UPp>vqIUR(Ds?Y??bF)=O$)|=X+crQ1 z?IXOQxa!-#zcp-_$j~h2FZY@{cQ=a9PYVq653H|qi!ii;+sT$`{s!{T&hE_HtDf$D zFR`_TU4_*_$U*hQn`M1uU>BacatNhn>25es2rstq%?ma3NgpR=EKv2|q+LU7k}(=^6l? zH|BJOKG}0A*tL;?%zz&$zdgSkMD%$ywRwXb9L^Sk(P2>Q3&#pRRPw$BTg&T46_yD= z^wZpjPzLtGr89`SG01oFLcddT-0JPQAFT>>!m{QUaKyGg9+dqY_2iyUCqG5y!And; zKfKuLlrc8$vpsQmeFjgWzZS^ocS$C9_L7ij-x6AVn$KHxtge9SQIb{N$~NBO zUaSX!X$!%s>*F4s3iC8i*Za<0tu9eyJeds&G>JN0%L$bpX@JQ;K{fhB3^ZshCe3n< z>GLma{|ZEgtU1!Ew5I8iB>hjm7bZv;$zd$)(-Wc{uP~j5`zc*Ka5$gwC>&fg#Ja3M z2n>n%gLUR(ai1r@)viQdyAS|cx)r7^Xk4~A(Xxc6Le=)r;S5ua^Acjn>4m*q?=xtj zn1lpKfD8izg7lP%F`z}BSV_?Py?`{Fjv>`gTo6s?hn#F^LqmZC#eP&wegZ~s@Arf% zjj=ES7`U^wWdq-zg>|Za{M0hg5SD402o%I945%VQ zLWP7)m!1chW_w#WAw*M06l{>NcdO&GX;ORV-TNtfo3>9NU)pK3J&9|{mRkXA+?9um zOQr|kjjLlXN$d8w?<3i=+%HN^Z5|Mm7b>;hVI=!cx3#82locH)_gU;(4*l$4ahR1xg#>`C~9 z&_M_O-}cOLO<=;du6K2?(Bep)=xEs3oQD%iGk80I&4Xg-^6@FUz#FRTf2yjA_NbV( zl2V)9?`XiM*q9gvKT0SJSL*AT=zC3~q(LyE4gOH;HcCns zXcI3VKj!5hA=>7eZJ3*7o3lNzpV$P2*{`D#KX|gKVcvZlsD|^^)7v|=? zJPuU3ohiR$z+5oCTjzq>sb>BIkZt`4=VqszBT{txVgEH#&d);2- zVsheTXFo6>VxfP&aO^(dnV%LZ2pFn&sPo;G0`LX*Gt$2kk2DcI&JPclbp`VT^;+Nx z2?@<$9zP{?qN8739q-SXHb^IKCa1{cf1>^YhVdH6AyUvDd5|e7U75MG1=9OQ1$<6%y)UEDJ(@_G)%P8s~SJ6?aJ0-0TU zWC3)3PVYw6Cx11?wQS7AgYR+zlR%5M&kgW7An5Wrj{ViwA6ZM3z{?qa+<>!V>2cm=_F2IJ8@qRQ2e7T zXsj7HAV7=UQyk1Bb#cDW69=KtAe*ao4EF!sn6UKKb)u&>FW>L0+U>u*ygZ|!^cGo~ z<=WZVDOwt~nig|%leM{zP<5AhY*Mr zD})7F48-NOin-Vi&(??xgK#U|DF+4zc^vwjt)hLcv`p<3Vnps^0I{!iAz>t2+uY-> z?-ue`f9s*gXeM>o3me`m-vkfC!}I+5F58Q{P4pW*+G~d9w9Nrxn%bi^Us10INU>g8 zASFG(E{}K8+{Mf50Ze6GXOWX0n~fLXrQ4tYU84r^g3vKg!_ZCdrEB#n2Id{ISz6~6 z{My-h&YD0lYCM;-K6dT3USQQ@uUH=(9BhTd3o5QA?r+4ERtgE9B5J1VuK_hJ(vFe| z$HlL4fn1iq*V%5(K&8FW`>g#ev_ge=^Zw`b()>Pve~kZfPz1^~)+_rsJ5vMEV?81} z4YNK%V-6eb{LLBirI2Dqr18VMF2K=S-i}kvYT&TC?Jp-U0n+rrBO15#o(=)hcmNG@pOVPDJggOGZ<5~wp*09hN{TiPYj&(;)j#L z>AwZmc{ZBVpAE0%Y5{*e?`DtdeL{liq!P&d$gIC)w;D_`l9B1_KT8$*mKj^2^9WM0 zavLOAt#$MwtZK{8bzclgNLD*My}o%W)|`39+|1Kn+<>^00tkwj%7P12uu-u^Jk$RxW zR)dy`G)7W0jlpgU0qba0X=ABCzG+aWjg|%qOgin&$AIaoCCImKKrXykxAfWuyZabOY5lcK=>@6L;u()@2 z+$g<(DF_;5v#pL3;Ox`h&{Nd2<#I0ynD(??G96aG8GL1jaK3tWO+&wfyiXQu@)lnw z)nsky$j}Y5w4x;`W)?=e^8DBARZq!Qix^cV$N*17`LLBDaiqf8RuYssNYGtPxvOkxlhg+G|NN1J z$W*_S(UH%pPbOtSj<|-oo!iB@^3(HC^JQZc|949l$-lzr(IZRquDKK+KQnbQRcyWu zE(jV&OLRSPSHR#tec_;($v;4CF*lu?+N+=PWQs^jHO%rY(ZFtNy`Oji70xfZV?|3O z!M*ZeX_lTe%Tv(Qp2Uq;9i5(~@nmBQ=!Q8`R4onNMWtHNge zvs5D8l7&lotH7cqSX}jZKk<+%fVoDJLe*BD7KkO5ijYt+ytfW2j@(j8JZjnPw$%^s zqL(cEtAq=5@^&1{slE9vG-$u1!w+Xq%u+erjeU$13)97eu7Yd+Dp@#lhZ|^ph$;4s zT^AN?DO;j;y_J&1c~O}4L;Mr@o@|ixSJkh|fmaCu!U710)rWT*IoeT}uTK$&C@Wyr zc$v+Nc2vCRVTDWqSw`Hpmw+sXjrp97sJ#%3r0$Kbm;|U^w9dy@KYa|b%*iehqg(@D z1_)e|@i~OW++!#`+vS9$OZs_IG|RC0Eb@wt>~74#d*YXT3c-lnTBbB(e1=4NWJ&ut zS*0Wq$ag_)-Ay(xL}Cc0zO6s&Yt1~l$U{I!_o0)oj#F=)GKRk zFr2P=!;%*t9Zx0}SsY-AMYQ^6t^BI#YJ#wCIo)=`lTr+XQVPgJ7~NaPx_h4x$wLy@ zCbD0i9VtS(dpfQQn*R;IP9cyVmb&>5gBE4=osM|P_r_uBx|4pYcZ6UxPH)!sfhEKc z5{*{UDT&zq$jGT)yB|ucL9QOR7nI~77~U*>igQ_D2+KE#i`i+Wgk20FW9Bz`z{RN> zB;Z7uy2S51h(?B=;aSVh2R-bF6 z7K0J^etZPEC@uqF`?6ULv5LWtyg76d4b70Y?z`0JE+zmcR?#U|+Lc&Q$D{?if^w1& z2o+O;AqIRX?$oyF;NipPk^CvX0TH(gAf$}*gR_}~64aW0KlO`ecA>V9Ipj)WcA$fLWePqggK$~5 zQ{+QG02qikIC8NG$U%-H*z&xZp+zckZjw-fp%P43kZOMv-%nXkazvr`FKA$=9kz*& z{~FdDWao9d)J^S`5F&7>*D~21D?B_QQRBrL+CP&i1mt>o?tZaCAlCyhSb_cukmvgE zp2I~5I_(Mwum+k{MVFR(>g#R6TLs@`Q2_=x)JJEZ!@7>&?Pzd#KnRN-_xdQ^$)+l> zb~k*UO*^F~n&s6#m=XZZN7dM0wILi8{KtMh4=RCyBskj#!da>N&KIkIcC?n)O|2sI z)M0j6dZtea*e$qa1zZL|N|sRLy{-zuC3Ks=qY(JO!WLfY(op%#5|45>h51zH#N zHy;YRJ@{kv_L@sgD}9DL*u0ijGXr=Kp*#MY@m@Nn5P38?!W^pF1<>lyjx`2fuKy+j ziyMbZdd^h5yepIKq7PT<5H=9ImDP&r?qU~!#{F}(Vg?6bL&l47=B`i>L^7F5tDhtm zkWmUC?(G}v&%7!T@o0Z_d%y7cRu%MPH<}i9!l;jfwBI`1yVY<5690#S<(-@CZuf=h zkL&RyR?H;ZbcO2wV{jN&)6IP@3*|IvpNexK5Cq9mMX|R_2{=Rus(~jv|EZr*^PT2R zr0jFgbDQ!fkw24i6qY~;vl0KFsNCxpS7mSdG)99@xY1+o3mS)TAsFtW**c7I zGR%}A23xJSN?MXTuS{PX9&&zQlcQ#6+NU2d3CvK5FU<2+8rG7b^IOzn8~Sx zxg{9U<|kqVn)yr~r8aI?OOO{yJCqQ}z1hBAiJh?sn>6V7{j>fIku8rO8osoqV2Fu% z*6DQnlsSCIi5|*Q+Ik)0tD_kD2W)&BUD)^sE86+mCBhh>CyPKXkw}FbEiYs!nG2bW zJ6VxZ7acCk>;z<{Eapd((NRNRuUz+8ge<2z`_1{4j!M%RF)kwIXhSpv_?d877ALx0 zeTu#~L89pi0+1|~+UK^^b-ZXiIyWMJmzTkT)zGibG3OdTyD_7O>JZ37>`AM&(>Ss;Dvd)H3BPFS`=tFd=GL=t*R;eFlHRTy&)o2p6Qp*kKAM5L-C@Nm+ z8HAV(J}3IMV~J8FfhH;P7!~{zMP_2_ZugVIRJ)aX6V)zRk0;*wQuqgV{s;x$r=kOO z_0GCB-@dtVfOZ0Vmn`=wXJ}a#a2{9D10|JPZyQcH;Q;-#p1rW^KKRAwsK5oq&KgR? zh{PGY^iH6Yzm1EX-DY7~GPfJFM>Mmho~&$PmBfATZT}6MZ?#uLchzngld`C7Qdp|u zx-LdA+d9S9M^4B3u_maVqG&w$E&ZAkm&p>Jpui!0XnJoYme=fC%7VvZvZRob7-i88 zHyEn9;T{6~Z5HRTL^c+0Vq==Yeu0HEm*yWrhesb5{eK*w8DJ&e=$|<0J|5IJ3;+D$ zXbuYWJM* zuF@JOpn$>PwEUXybpWE>&ucBzuJn$Ne;)5DmN(seyh>98K9hHmX`YjgGwQa~1}EQl z=kKfg86=OvB1#9KprE*s^}+S`!uCKzL-Q*~_eU2g`IpwLdY#!au-*A2m0{NNx{R$* zl!QXI2Q|&msSD+F^N+-7RT-hr?VN`N$W=vXkR1*X(@@ckmj~y)@7IGe8B8&x#4&{EoBb1b+OX2L?$J{wS zqksi+_4zsPABm?=pQHEVa|Nahmo2v!tL`XUW33Id04X0y@jItnL4Q9#haS^(BHG_W z_kk^Z$veLfnv`?PNc8LTC*}>AnT99NW*-zQK(hk@MCZlBr}&Sp3cpzGDq>&<|1vP| zvYyWQML&c;izzvvHK-vb+(Iu(`Rcd;7Ml+xcu15->eJY&(h@nTITU=Z$5Z8&Ak+$F$E8J`#U4#rU zM+8f8viZ2*vj!>pUR>ZZ7||C*3Qt?>y_4r8>wGeMMn?{&t$pQ1{iH3J-g4`X8mlgv zI;wz7%=$A~JU?P%#rrW0!pQruTzR~*Tr(EtzY;_<>RG3{A`3{T*&S=Hoo)_c04D?T znLoQ6SFoW>(l<@`;*Rrf$o8e0C!U!4Is>-7^y>=5y`IE^oZ4*&nvwj?$jK#sFVu&y zcB4!86>2!xN$7lt(=ss;LBK@nfb5IYqM*Zs5{0vh9xnVP`~E@(9@%*e^WHGTBA)NOFc@C#ztjY7^-vr>?FCtGOvp`{pFQN~=QmZ%0J)ao%&15%B;@Dn zWi@S)GfQ474jqZDjC3Qek`zJk_Z|?AHd7b47_;8?wb2&$>>##0(&M-)4Nmv*O`usR z2b#3(M_O1ZnI264`R@aBo)El4MJQ%ReJq7cuSvH${wvzC{Cx8Yo;Hqti^E+}`KIJn zIAG&P@DIQHQosxM)l6l27W)3;gN%+HE_O4cpbb-On6Q4|i}|65u6LsInUsgeL=o23 z-xQ=ik63%VnypkVEsfDB_}k{DrWN1&95Hed$R;e73Z=z`g@tOFUQVU4IcNWx>hjL= zOwBC$4`sUL#Gf1^DpeAU?p_y)yQ2@q20mu#N^4%=7!u^o1m#P-H$!Z;Kr{J(Ne@TXyiMDajyXN4 zE&U+Jm*$a=4_tRlDyea-~G)aQ)_ZvTPxJsDQWwW8&8A}j39BedZJ zomIVT)fOu37fafk8yHfh!kFjfz3qq6^R>#nWA3$IOwv^M(;n>ODg8S*K6k!i3>gK1 zwf>0Lvsy|Ne|t$ju#=Cx@3jOHQ;{z0iM57!qsSu}1xpIBf>A}B!21;b8a-?K2F)_IX6RYj}uiK;5!`wZPA3*ZaMM5#2m5^>L<#!GxH2htMvonVX zU(4F@#l_U&D1Xb=KIFr`RVUy5)%`uXll7eSc>i56&C)g-0BSw8m>nPMl2q)qb$nMH zJfk(}6_{+CqYKQsmuBv!dtOTaDW!$s@!WZHssabVHxXxGzP$y+0(2&;tW1D)dYYl}7Sal`x5Sc5JNRA&y#&-hB&O*L>yEHCRQ`Q~ zoBTxq-JEX4OJ}DPfmbD_l-(4@HwT${-8Yvz2a2lo^^tt-RT75o1SNNa(?|0kRK;hK zkIWjQ8kxojVa^4czYR&5&Ghx9M=Gen<-h%3Y`q0k96|FhI*SHRfDjxK2=4BZ;O;IV z1h?Ss79hC$;<~smmf-I0?hxDpyv=vt`QPup`{tZIXU}ZUOiyojbyfYUewC6Pjd3>` zBf9@}pyqQZ-hH&LV6K7*EK>rKoBNu}l-g9->+a9p0i{REQ=kv3Ie$XO{!1OnV69DG z)0Si%c*KB4=X1_;KmeM*i;Ig;dN7B4abes-%Ch@fJtm%6VnVRpeBaY*B(+r*%?9Fu6&k2V-0%G16`sL8$$(_x9a3QT;d!1~M%MaVVLS=xFz zE8G0yoYohUf_An&X;va0m*O129=VrjKTJ;EYPQnmQ$$>Du^}>QHqD-m$Ldni*i*BQ z0LyH99)g2=w!Z;Z1dpz2VTy)ST9m%iwoHZXFfL{&nn;;Cy&9cP0t}|)Q$i)P;g5T~ z*(|8~`G_`_$a3)R))Y^jVTE9=zR*&>vI^N@prCW1_JOmagiekzK2q10L-s*tJ zC=;IRCA^RA1XkAxuAd(Jk*NMISV1?t}Wii z#wL^678z(I!Nq;fiytZfJO(h_);8AHH^*p+%BJOVCiqf^sKXFl5&%Y;FD-=h5gQQ* z={jvwz1i$RBY)W(&3reFG6bN7xXboeIqz!~*(Bdampgm{syX%?l$EQ|*YOM-by^8& z>^SXjBf>iK5@k=NlijPhlbNwhrhwr(%T`W${?|PGt=jh!=r|9?qE9$*J^lT!{B#UT z#`pP9F0d*y1en~SB`WfFuBl%~eR;S#P-jlCXn856|CrapH6;(lB+N-?ska_O1l+jB z;y~<3Gu}#=_tl95W+BJ!AF2h~zdZGdt;E%OT)BzLkeH3YeG#;1ur)1CNT1C^21Yzf zL`qI5HYa}RYm)zBlsT6FGen=lS-c4p7L zQj*6f(V2v>tkVv{q%J^zx5BXb@w}Y6%Uxm3aMjnswJDKQ$;D>Fe@|Pt!k~??Ss`x% zZhTAqiLUtg33kHc`fz4HNFa@BT6l*rT)S;|*2TqH%v!e6LPElh4`%f{n@6;w4Nck} zr+NONl}~u#&($bNeu&QCMq&|pxREGpgmcTxqT{H8tLn5POumhn*3uN-bZUX?OxzmM z;u~bXet~yAm@FWS3^6IolI(lGsBXm_yXoW@%C*K{ViTGz%g45Nv7m39l)2{FcDFp} z&%jt~D9#oNLjzuh;GEMq8>_1CtLmz>pZK^iEb*r;waOHX-yj2HletOi@a%v*gpkv2 z7QwIC#1V~N7jt}SaIrFwq6?gyuI`CtMiEjnz7d|?o)Y~04bDG2;Gev4tC@j6#dGIs7=vIclzUS4v8|Njl+4@HR367>%Q`7CVdBS5$ z;e;xToa{N25LMg?hI;o{!lLQ^6BhSBOYT3$_~NcIgAdEBGoi8AU_GG4MFtR)_k;*; zBVMoHym@oJKeKS=?AVKxIS{tEd2*7ek+Etw{`yRG2;}DJY1fj5^5wEn+^X=3*qP($ z_n`lZH(Y6>aVhg1&o9fOa$&qTZzhOea~+Yrd1L==2L0_=%Dra7d~`hXTGS7>8l@Q2 zzr<&_Z{Dz~Y@&KYXZ&r1!2s^lR3~qY{(&W^n9CrAUhZ_XE|3&B?0UM{Z^e&+oUr zTXogOu9L=zNQ0W|A_wWxHsyuZ?XyPxb-bGNQV$hjwO*1VZn!u&#`;qp)~?AZ9_*5Ih+bTg?pvvo1X`E{4bns{YkbTk;qU3P@+bjAS{Pr48A zmNFRnz#rm_tZxYf+?H_Qu+Nc~ii{vX3#F`>{Ib3j&KiXA;l*{E0s8d9Pr!+#3H5*; zEU9fMs83v_HVHu2nHL@e`N`SP11xrLUz)Tux(NJYzH} zecI5F)+Kc#h#v1w(fVBj=apR%sV-a1N}xc!N*Q8Ifz2{lG|-}m?Fs~2NdO@alp8Jx zPhLx9hDi0fg&63Z-uZx5AGs?QD(bi(_BcSvr-}#6zaYqrPCg8bi zfe1WggaR?QO*U4l((Z76H9`5SC#%V@NQ8AXgDulW#Lc(0K z)|Za%cBIn{@_gFUYM3*|?MJ7x)oV46bD>Rc?)D>4L7}(g$?9<9bS6M&X&spaR~WwD z`p%BJ&ai;oPtlv66Lw@hNI~QAW~59>>mi}P%tIwUVzA@i^>r=-gL+~~!_)GPa_^Aj z!gpO>hF#-k#BX_%=n7q4EUsBjr)^X@wJgH;HGc)2ypz=0U2?u* zgB)C}FSA5nlb#wFIIryeZ26|$&bZf|Nph2AP*}gXibb;1GFhLQtl4%`J63T#JKM%+ zsEYke8Aw{@OL9Vdr}?Cq3D3-wGJap=U5L)e1#_J$`O4q)^ejAaPjTeHFyRNbe}24w zpZ^vc*Xag@FrJgP=@npf2%0OVn7^p2yDH`U=x$+= zy^KDaBJj{G0A|hHS^XzDz*!5&GKy0kJTuacv zdB&2kc6McWJJH>W*X0=5<;&US0J*QX0Wk(q?Q~9`0~*tq6kE+~N5{5SLoUo#;NqIC zUmOd0uqnG&w6+%Gs;%5-gDUiK!p?K@kA~7gM{>o8h(sfLunIjFwU_3HUF*Tf|CY#S ze&#dq7Bldf!ua_Bf}Cq8s7sWI2BZzD3YS~}BJnJOdWAEB^|I_n&NpLSnE;2~QvLew zMcC2}Bz@*(ls`%B+uSw2OO2Q-RlW+5MkT-3a(r=lL}zikF_!c4vc>N~ zcw+%x*|d?%_QU)A`p`F$OSWIfQ&>-qv{wd42m@JdH?7D%1Q#`WyMH-Wy%+qgWBPmi z8H!>o>HQH=Vw)Hf_`PGkL&%v7>im-`^HKL2r+5ZXqEC>Uv8vY_Vgq1g#096+aeY(f z1rC@XfGH0SfKex0L^R_63H$VG3euT_L2Zt)bM)Hv4AR+u{M(7hqb1lnC%exEJ9n95dH=lAc13Z78S~rp;7AE*X3~L^H z`>3L=xHbGlo{aeRJ9pKX6s@=7nj)!SY6HQqpCDq0l-#o}D^ivVVR*C&sy(|`J{`ZO9OwMhbv$WsUYX6jJ!F!-#Scm^-)|D4Zozaq^&|lw5 zBi+FnG{sd-`~~+$9LgEzQ$#?_g<5sXD5;2}`b~9@_+nZ;!eEmg#Hy?GqE|p~>?FRKk1FFft6Qn}@<`v$M2R zZK}7duQ`X=IEBi;FdZf2$)IV)V=1);jgI55bG{3gxi*)QD)V{9>;(ote`0!gc$`D{ z@F}{~vVQ+;;bI^%W!7L-x{+DHbBu(y3Cr&fyCkP`#)GrNClky5W**;{SYXg_wFN(Y zPuS92RHxj>(e<;1O#gjROQXz`t)9o#s_(RtpCF+_-HPk8eDIZ4q5lOZ0;>3bRH*-! zcd*p9|7EOrMKb;H_3pT_5xuY6olbWU<39fexy_m`<+o)Wf(8}RKA%<=CF1$Ec2N(N z%z#td+PvMK?U>f=M|(OthJW~uX}F9q!Z`cYZWxb=8c$10Eo&r0TpSzf8%j@+>a9F9 zJ^6<;$wDrCT0C3Zyf3S8QT#^Y+m3CB+G49}8o41SC*DbtAU9vfwzjsXxQMg;SZVm3 zvV3)zlY%PA`HFb(Jju$5x8JV+|rl;+V zU-F`Tq^-zcF9O0k>!VE13BWYcA>MSALAI^IdWUI6W+)(FRCwSi;A4_ItDB{{*Wpmc z=w~dwtZDXBcbS`&5mnb7kQ6@&%h_h_y94GnNfH1|(>|I>lo*#bRkY*>S63<-do8|ZMT)Zs`#p_CLZ;S6{3Rfd@;W@K5Nl3`la#pf_@T$mI zsd!hmEQY@00rtDdUn}k0XG{$KY@S+eP9JJcq_bHE;JMwb#@3mCdR#ZzEREhnwX-2O z+SpJ=XUJr;KF(No6?O*It!`ede`Md2H^BTdv%_#7A^V87oHT6By4inpU!foy5Qw1= z%{c8-T{9@dU}^aZkjEJl7%HX!z-IBjmt1~7%}nI4K;MZ3ctIj*Y1_6afIiwN;CEH6 zORoxe|HQe(R$1Z#{3>`KIqUi0iDZylo2V5 zg>T9#)ub(9A*-rbV3tVz7$UfLD*WAj_Wf3x$qqot+xNF|HBLInL}%IxR@b)4)u}S* zcaM*k_>O0kjwku*3czAHuGZynN~cfx_U+bKH>=%B3;jgh|R(bC4 ztI#C9f=`EAD#&`50YO(6Y}(q+xfY2A!o+Q^X9n`%>Uee_x&h*c+_rlIH(qR@KE|B* zX|Zbn;Q?c<&5h)`LfS-JJalKHzR9q>{7Q^%h1bXy!UcCqga@ErL(<^Kanxl1Kirf? zQ0H5RwE+-$sy!kQwQ(eXC!!+#*_(n&5fK>hYOIOV1aJv>8}Krg|FQwRyw>_4LAnls zMczMlMa49*GCT&DA{qvzpz>@|K3u{5{RP%QJV;FpJ?8O>o|f_qj@Cy;L>3z3=;zql z#mA!^^bMB6GnG7z<+fuFa|L%;#ihtPImF)XyOoCPvhBA_&_>>9U0n0DNANxFSOlmP z@o4sKJG-Fw7h4PIH-NY}D+oWa+kLko=QPmc)`HLG08fHexfYm@Lp6ciJW(N6ywY#R z2k>`KOECP;h+x$mTg%H4{Az0I&`ENsd1xguG$H07Vo({pPPmwEb3X~ zhP^lp($!o3RQV<+uB%50jK&Thl4;iQkp=VFLOz>}_RD>TvcQSEhz-2Py-`&3pT2Z$ zD?QUsBfFiQOC_!CpAT~Gxxw;hFQvXxQ=SVaCd$|E?l_-_d|kX-ZX;S<{7>!wLHg;5 z5|En4#%%nBi!<5ytP|^#6J3&U0Y%w#n7hU4 zEYZQv%&(Od?}ht>7cVPO&%2-^_FzU_6{15-AUc7s6AV^Qc#rGmHc_{xgl7sKW3 zyErbAMWFnoCe*jOdv@f?@oZe2d!-U8`FOSqj0>!uo}Okg+&5{RF`Wp894+?ewn05R z-o68t7kLL(+PtsbRwkiD%PUJJg8;eZk(lf44bZvU1cfq34HqF(!<50{>6UuZ?%v*B zq4lKJ=@Iu-RgrIJTbrBPmJ9Q?j9b{XKzC11TXHpUf#zV?;g)6)HJM?CGPb5+M?GV$ zWo>;N_k6PxTuE<0P1VjQIWSZ-HVN8KpJf_y$IH$?%KqKk({oTmzjZ&gJ(t+)Api{i z-fjvSUabEKO4z3C?eV>13sY2G8*~~1Qr1@L`^LAk6V*?&3TXGsi4u@6j2tF|{pb4eJ6CW9Xba;SgA zThZ_M6UPy-36xYskldz9GsS=}=Hf=&F5kxM(c}-`g{j=qnczK+V%6;0luKvg&L8trz~#X?US^e5{YOvuRQKE#PP6YKiX%pjA#gvbxqT!oPMV z?J(09TXXpYv@^Q^e%rQZ2D3mf!KyFLZCx}GnMiifP8wl5pci^A82>q1iIB!HS)x4* z<;`#yh&%0$jI@=_YZBG>-4y#ClBc+-E>Z#`JH}kRI^ZjbBqf9<$PNZ`9=gwlRITKvD>tV~MD2}c zrZ*T5jJDlV5W+e0_rKK515)@#5B+ZxazAH_j zEl>Ha^4{pmrdx_7`PIX-FFy@08!r&U7HBG_`x{QAc|6y^9tHHLqOP!_4I`A+6a)wz{I61`#|+U#6K(3WlK~beEnC zKO-V!$KrWk1sjL9LDzZo5PEj4mLb9zd?`v6Hr6gL+Os|{jXw)aB#vb<$&+P(Vw1NF zu(4%(>e4d^U({tVV%t3H_jHyES&iSJn@>WozI)3KbrbQf zjk%!lU_0*Y0ibBnrGa=4r0yOAx98UKo~9mth4z{{+_Y)z;k#cZ2LnsVE{u2=&XRCv z(}Nys5Pq_E?;7{|4^;idJvTQ$Y072rL)eEbw=IEUHS;ePzDK9}j9Mjn7$VE&x^jBU zFs`Rveo?x3P>hB~xxvhR`(i@u+Z0q~?emUIEw?d4Hm~Kvc^t>yAY0w!Sbxn`_ z$G+`u_6AF0Z3cb47*P=sQU@(nMtc@G(9xez=!~i2^cQI8guQ)Np`=Tm{Ev2;#j2Ca zhit-z0urpaTTELExrj)Z>*BC-fQQ$6Hv$iqV+;d<+T~!l;(wyu|0iP@<{I?|y~}>y zH6MeH3Fqv5h5>1_`t7*88|0{HXhZ6MeU2_ayVm-0O0F4+X=%+rUF9~oT(>8Fm}<8t z!TxSL^<%|e{qvNeA-k!emX=le4FLDx9uge9&~!jJRFb)bg~ktcT8w=+{;fGu$K#?% zG<1@s(si$@iX|PB-Ki`ai`avQVR)ezr}Nk#6IO=Ent!DCu}V38Z0zjp@8;({umvnP zCs@Dgvf_}~$;sfw*vN?S*aJwJE-==b=Y2el*guzp-+8Gu@cw%YIeNUmpPAZXBG}*F z-~WDFkKWnjt_wmKCIr?`dt;-b7+r+R)l7x$ot*F+FMX~LovryF?(gdxE3Q{owOU(f z46xT{ZH`jfZKxia=c9yi1sXnot{s)!t0Ncrt9X(hf~w zfO_mhaX*Sak@s)A^~vQTupEqP`fCM`XHys`u$4^n&TIKDAH3zU`~qlOYBr9mk_ ze(d0FE%AU179mSSlX^3iWW0t2Lv&1Ch0dADP?~slWmRx#3%{(d9Mi9)$>~BlNFCRr zQrb^vPsf)HBH!3syHtV{hAInjN@QB;yaE=QF9#b|ypS-`9JjL#l}zqcjDatf2}dm& zR)gq_z;{BeR(I6_hzSzdRM0kuIL-CU>Jro$Cr!_sKm-EjI3C-JD_H#&uTwsJ1nRrz z;rzh<_e*eL;3QVyG9<&y-4yU!+_6IifF6%}4A6A-c#Tsw$&next#a)5#@AYksU?`4_{^Is5=~U0+plLM`i^t7d_s<+*zwt9@bN@%N#Zb z@PVO^qmEOG7HR&X(Wh)HO9<}!y-#c&Dezv><*mqK@DGD)^ek#2q}TS9caNuGgn&D@ z&W%OU<9yIv5x~?laB>e^shcPR*v#UdX+%dY+S!UCst*~j2x(r{W~`=({iH)hM)2$; zCHvYI8bRfjn)~yUT@aghf1r1JBd$(PaxpOyoYx>NE<3fh3g^7Ematvt$oDK2Hl6U} zRm$u@NIfF~;K7;mR{KEkY^nBO+i!z$u2OVLx=+&Cz>}va>&;sKGB$9C#lE(4yuY6U z;}BL`NWand(LFxco@9MqcjcFGEk_Mdvj1Cs{-3DL{}zz{Uj+9bcJx08?tjO4{uj9Wf4Wfq zaWnj15uyLp`ah5TFI?*X+xq_oj>Z4a*8ec&|LMv9PwRhysQ>pX6*EV|D5UCjKD~lb zO=t(8ckMV>z$hjBUiwz``_yBveSw$J6SQQe1Kg%pD&bOPujWbSR~Q@c=T}z3S6b%7 zSBhVKm|Ss&n)&zwv!|B=kAJf;TyGzJPRNdoPKTG-uT$9_$KD?*espMVZD>fMlnx-T zQh{YdyuaFGV`n$^da@(LAX5L&3FLZq zIypPB!v;*V<%pF2)<=LvH$TL(4`L-z`c+t2D!Kcvl`^6PTZRMV`{`_;z$X{stS zFSP|BV0MDi(mDFVQTIYv;TdzA%?XGhm;}S;HiRqyT#|pL2)Q5l(s?B`(q!lhB2-0_ zAw6Aw`Yq(~B_W+P({FKDvdAUdTaz)Nq(eZB{rZH>;_5XrW3^a}$JcXz%@6)!*E^LA z6wvpz8jYOECHoi2l3a#nl1#@t^0D*aVAz1M588Q%ntcb~O(Y2!S0GsPwmo;h=2N0X zBn*~Q(v&aRIec-wWkQI|t7xwEp5fJ=4n`Z&AD~M`0-j^gctv9de}|eeYuBf8jH@0U zH4p{-f-|~-ICB48a*DRJm7o^MdO6-7`YR1(l1H0d!`vNh`%G!?X_zT+mpz*a2c}f5sqC8zL=ym=s)J!l) zPJ-qep$vpP(IN6Dn6={LzHX$9=na?6SXqJnH;7ONEPLTRFJQrl;Uf5zN|VTITDq%+!q5l zkFFR!Wq1+}dwDs8r^@7R#4x*H;5V!ASllKZs6r3SrNWuqeK)H8j4P8}OuzP1Emo~O z?#i)#3sAXpxCZ~AojJM5(mU=+l$n0{OphcU%MsF$^F+zPRIJ$>eFMdXQ)u9M(!`8!$FOYt%#UWIV@w zj-o12X4D6L^lM{6K5(4s8~6T6gn@t<7@s~FiQ8nVNz;9tNxaZ0)u;e@*Mill7vYNE zA}$dUVD9pZoFF_ErP7GPj61DumV6zXkEi#6?%G5}2cyT%*0$YBA;7Z9!=Fg$dMsyCmhq>H}~e0=Z}e$nfa`e;SvC zW;_>O)EG`b{oA;I&aI8adq3>g=&NIkn$O4xN|wP|7>fcc7534On~x3s#3|ECPbm$2eHX^ukEYjMnswE zjzQ)K2Tzzg_XO7m6+|LF!ID;_>-FH!J*{+A9nmlq7nCd)Pv)T&mIZps6f=KYkqH7& z80zIdvw@23N~0A93Q%3qs44W5LJ*KJXjDeF({%Wod5)&NuggOxl@Kuea{Wd*s+^ph zcfE0fq`Y2Wa(CQt*swZVJ78pLYR(8Ja!x;B^c$PGMv{blCNWCt&p$Uec&#lLb(13L zqOdKqTB~(a-@ecM=gU_bWjOQv&8Lg7ty=y*>XkN*N<~Kx8%RKTv*-GqE>a+3{-@ul z=^Tl^j$8A!?xr5ZU>X3`oPjCX`0G1?5A#=t7uQ&p_zaP9u-YLX9Wdk}abZDlad!(k zN|Yrg<1QDJW3udfdbmgFmJ_t708K!Fu~h3?(>}{msiW>04El={g@^4L4S9b%LBTm* zuHTRS5F6_t*9Vr^ufXi-nA*_8!@PSBIg3d2R|b1iWXqMd>DJq6cDeG@zf7(!QUf<7 zsE(;Du5CmRGDl{^FPzQsTvBw5;{)U=q)2ZY}U;D zUP>D&MPmtR@m)I9CTaJ2c2*fZTB)61#lhA0J6?r3ccr^(+2G9v5~5$KnY&k9%ON?{}`Jf3Pti^)5=u8+ES6{+JR*OU2`V6EwW zKv6;y?F)C(HekAdJ2u0E4d|yAJaJ`HQ_~mTJOGI3p+sqsE4kMcTwpgxNH5G$MGgPZ z;cJ8k_-lEWbc}hnSi3B13yJ-g= zMj7z$ONuf~=DZK`Nn{@LkV5@a1ld;<1;(q0^!_zUQQnuE9kO)MDA?TV=ojC2EtpiA zMJo4MmC${Hlk=z&C#Qx8Y)1cJ$}M}>h+N{vxiKc&bC-6U>EJXHmkf8p}gXwVN<{q zc3@2(F?u6X>Slw~J!;=DTfl*kNzU=jVY5|yESwJHH(7O(hj*2+tgTBv3ykx6geyvN zSHcpZkG-P5^Vf@=*Yb!MTUcE%k4QIB-ln$=FZ}G;tqNPCFMKUhqK?WdzE`8=6rd)g zefTG)`KzflR)|*A)8)Tz_%{E96S2(4PE;7L(MD^T?8c4v_+DigQKy{>uSZ6l)}b_O zJJx^F*wq7vAr3?;6iv|hOTi-mF?6&m`6iD8N7vSJw9PUxw_>GhajH(7A5{n0EKc7} zs-!Dvbnrf2jY4ID<+Ts3RK0zPa0Kla@ALCNU;tfo;~n+LfogH#i<`>=Ar<~SFYfkX zvAW;r)$ME2_QdF0)7A4gn#6+}oQl1?|DJ>r^35&s(hPV1K(wrH72w>li2IqpPplc; zPfn7{$86N6n2eL)vZ9L|dZFvVf4gYjePb%KgWLCm!sGg46({FszWvBCJd}&`eUF1o z#;r*HR*|ax(}^T#sB?s3+AvwVbSA|N_DALj|E~0y{R|Q{KCipJx?;q&fO7e=;J?{r zbo1O$OPuYjc+$ba&I$Q&IQ3Hk@`0%DD2KJ4!$h%?Og~nqc>6mKZ*s4lLAB0=lXZ5A z_TLu$Y6{~E1dgFucpbO%NSmdQ$kVg@O#5=8+i^iC7tWqjCJVI)vyuGTvoxYiNFkl` z-a5&V&m>mnvbVJ%d&?CpJ==R})G@H=Hj7L8NG^S1wf#)~;WkZ(di-MMhQK(kR-B_= zg=x<%It@qA*LH7rY!)Lui_vbf_3{fpzts@fC=^V8JHx*2FwP;EoOqu-`i5`v75XAm{#2_en5`2D{F~ZX@yh04 z<=I_aFR4+FL_0PHpA-M!-j+oVjfcr)>R@pPDrhxp2y6?1K_qYEMmL)q$xOS-Xz628 z8eg%OK$v2s)h78$5?DjINxZTX zbk!tSgB?(4VZMa7GKo4m^yP0$rBMOD(XX>q9g5WsBrM|r)aCRgYWrNyw-&i_?s`nQ ztSRV?f8Jmsll5Mi^LUXhwAf@rZxJzFrWt~j{} zMLcScW!#5XGK@F_-E1llpz@v~^k+Lqxvz(lrYfw03{+>qcI1ak5;>j5kE3r6>Yw)* zaZ3`W`?oF0Ujd);UP}dG*BCW8zugxzz4)u}^pY$|x#o-Ca)7RMI;A|Ct^nPEFc%e4VV^*S+ zKe--A`kxp6q=btI&|##;Xe6s&M?4Kd z?NJF!pahxAHE=~2Vsm%n2K3HyflCha9XLgSNJvqSnshf?sgFrr3SFvL38*j$l>8Z4 zg*LfFn>g(gjYceGWWmVHL}9!`iIUtFKAW_^SRs|)2Q2}cEId&l#xl4`BL^-3jIT#Q zMVml7jbW&o48aRa#8>sPqQfwOj2&*7{P1r2w`thHbmx=D-WIS(za(SWjK7F3(+=y2=dKh>&^?y**j&p zW**h_vO$d}C*BpjpRvkqdPnr-l%HL5?f3820W3Tv+@1mEvv#J33-to`A^2AT?|f+A zx&B*D;r{A=&lmix=~lB8yS@G!!($k%+igq|3dzwOD~l7b(Td@yHG?7yohU|+5}%iu z4IMS9i`zUg&wh^cdWf2KTnDgDqctTb02D*XNI2@;Is>C6kqMqP*#~%6dWS3*3+MoVhF_pX{Z`xTqAc7M zUOP(s)bkRc&{?#{l2ng1L; z%`3+g%pcRnhF(*3ONgT{J(TeIs(K1*&h55o3L+LSvyVd!k7qJ+saXw9VIY_MNo${N zD}A8|1%n{Zz{tOQ)R*Y4i8BwXWt)l7iNCeOaz(jx`qvrf1}lQZ zjaI3ZWEGJ4a@45Laj|$v7n}RcXb~qt!EBedM)fcNvy9~wPYZ<9Rh>KLvQ z6C?C=-F-t*%V*ot1ct!0md%-@SbarS=4FAay0ODCM|HE~Bk+pd+N9I?ngXpMJsdE!TFP&S+0lC zU|u0Apj6R)r)76S^9;)>CG_vs@(tI>oi5oK0Wll@`PO!;v$sb^qn4Aa9o9(*Uzzd` ztJ1^nYu*rsrpfjdxyClT27Pm_4*;OuTmW5pHo1bg`) zL@9(8@BoTP-o(7MfH-;3Gr6IHJ1!u;;d{51eZF=EjV8k4z1>g}lc9z$VtrKfN$`DY z3@DS_%6?non|x>YuG-{jxREt8S5x4%FVowiGopRAQ`N^K&m#Q4Tv$3NK+H6r&*0eW zDvV>uND}}c?(IfuwK6A9&RLj;=hR+1aqNhTzih6&(K%z(M1EIczh84GexE$q2rU$o z7g+UN>OpB=bgK}1^>j}7APE9eK+#OAKCgSS|={+b;<8CA?AzpgmJ$wxSY0+5BLQ=GQ`e9^Cl*lw({?M+N;{m~{gahsXH%QNw(E}kkLQk0h#FbDVEcV;=vpQ~u*seL=WeGKTHS zubxcUQ4tXW^B|W5$@fbY2=POVzIE=0n}P(`aUmGIFx~9+!`PU|s{o}LQhb8%a-7~r z745s&1tHI-b4H5+sT*=snFC+h%>j`TTvSeNVY2WK_{3ag&&gT&GC8^U=!7LIB{bxI zU{(UT05!U4%E(`)>@~Z;abp|9_o-^_2TE9`y+jEp?;|-=~A;%VDi?wf|msSoO^oH(5U4P=B>j zRjIE+pZ~FLA9^885+RXS%M)~WorSUr`W36+5`+|V9r<{0f9@aH3mH_~uhC|3ksmCt zJ_*gBo1U3r6cQS*((X$UH*Rq`XxmlU=!<|)!!$HdyRonvE)EnHY-_i-?yef~H1#-e zS@}5i^$qT?*^OQ6lU?j;25khV?x*Q?aSAiQF4WB+{0@moIPAGo3A$}v$o>Bc7?oW!WgkF_la#7XQv{~=5-?T z%HB9t;3-Ck!vg`oSUE7$T0Q(D#RjHl?wbM&Aw8xSdJ>TNG{)4}8OxE9)aQJMpqX-T zRf&RKqbts8ir|THt#{~dBL_lrTsLFrzah+HhoNKz#q@LdDf1!M1gl&g)8U?%HV-3( z5Vr3e^;u1qI(348U%3K!KZZve}1N_++|?ex!^%Q4eYlGlxjCH-p7q&#^L41EUm4b#uC zDfN6n5KL~KaH0A)f2Q&98!oKw!2He6k$#kK<3E&R&u*E{a8oN_Ci+})y(}Les&t?~ zvZ}*3A&kEc20D$%J0A^W0`aRo~-lN{_DLZtoIx>Ep$0?R$okqa}o&u zvSR(ORYm@j%ykBa0!*-P0YJ(0deT3;{aL#zTRW&-s-y1f?uq zFTuB$=!N1k_ETX`9fpSyJ}2<>%#x?p{q5p)PU|XU{%zxQ$4zkwFWa|HTIp#1+tZ#P z!oLy+RTrK4K&ABF;1KM%yg|3MJ>z*!z3@#d*t~Br-6b~IZlDuj@i9X$hr800d=qrt z-$wuQCOX2(-YHi1NpXpciNK}dx_aUG<0lLpfKq#odsxfMpQ9eGxCECED`H82Pc9n- z#ui#+HJLr7gs0YRsV>vjCWWAg!uzGUo~LV``qFN*is=1D)vgw-2*kix3wuC5GYLqm z;ro=XOmCK+N&repy|&pvlh$piP_U`CUizSkDPnV2zMvZM8#9~O90OpU4H74vBAXcb zK+z2JAKsdzDpEQ7tT|lm&YSKfjjd*j5>Al|H{0%Kma#G+ff?G{O;(4|f-xl)H!Z7; z)~6khJe7LFbTunGQaGkw6&d3DHonH8o{mH+#q4w$~s(4}cjw zs*HF4b~!)H%6(GPx0-jpi8@$e-~mJmGYuQQZ<)mUBNE|~b(`Aja$((Y6as#^G+a2_ z*`_Y96j_d&O=k*iN3-n=)oF{8n3g^CP0dH)?vYD&1{u?H1<^qwm*&z_v6{NhSMRi6$(chkk#YX+rscR7Pg(8$vfKRh}z!1WPAtFm?Yy`r?CzHUvg=O zTO%W^^kcG4Ki$a(6JZproF)6iHHnf2v2vuiiM5Zm{48sRFHlc=q|hQ8m=r+*jH6Ga z*vK9Q$aEZ;olkj_oovm3x2O`K%58&~5Ftb3FQZ5%rTuOLg^XQZaz5u-=6!X~(bjkZ zJncN+v2d`^VS3b4-w<+)b>Qmd=FuiqWcZrfw;0vuEG{B>uB?NitgE1J)z>0UOag9w zoygIvytPN^vNx`;QkCkTU=_8XZBvDM4sB^ZP0zbGPZb%GmCe@u`a;(0r_lmtx{P6P zG%l z(I2fyK@B!1`HU8b9%}|X5Z?VJYe;XFI333t4#?B!Nt8=VP5DenkYsaE>w5R-59LR{ z8#j_)terK)qmesav)H%#y*lehm6O6@|7qE&eyF+2s4$zkm4VS@H4sPFdF=pR+j3!= zhQAG$c*+Bj`9{!#m$&KpfsUV>!|ONtK~Cnxrm-XT@cIap3N`Z9dgGQM>Er_o0|lT{7b|-=~pp1ECr}1r?TjHdn<|{ffq<_(DS^d(Y6v zn)mHuRX9-J!pL}*do*~9_7n-)b$Gqk#OyE&asZJ$xU9gUbExE;BVnP2kC$$Nv5}b^ z@;U+G_d`_FnQO;4ABB7{^N~c>dVz8sbYXXDR#w*YU$s}cjabNB{)DtH-~W!S^d!KT zFhS$_;*}c|SnVaNvvp2?z!V=fsDe}P>#tY1X7GHZWR2N~nCCg*-0JK|?Z>r%x5%O5 zZc)!HkDV*s-Q7Kz$9^E({Y70(Z;uOx4*O5dQlAbu>}NEaoeX^T48DHdTlmma`i!%UQWugb&Lz6%s7yIskRnHu9ym ztBO|hp#`*dwQi*Hk)jZl9|RR$vlTA#3vX)gbFR|uZGYUt3o_iRA~sUIAwooC+y~|*ABjp|6$nSDX&5a04U%t zu-aj^Vd^210%vV%KL6G?ShsiPX>j!85DMD~qUoBS@~h63@K90G>si>${ zTe1y4JW_#Sn`vB3$VljklpO5vdfa_T%NjvHI5vH#!F$lJ33poI zzEVdnROnzHDt{YKRz_NKFPEZe)NJeh8RsZezoQk;txM`8Cjdy^$58xDT1l{KoG1eS zUX?rQ2c*ANCE!;K1=$1TS>{ZKu75%axP z_o^UZyq>=|YeZ)d0pBB`-gx21>Cg=Eo{(yhd}i##eDRm%a(!l-qL9pBTheLv(l8W^ zPN(kG&x`4JnEM_&C*!_Poz+j;#GLz>JQ-ZztKDIv6*eoHw4A5$c}78}JK59Zq&0nx z;y%7uq!dh0E#C0;%fm*XP={pIdHqNiw1UFFV(#l4tGJ^I^E|CfPlTwiDy#XkziD$#|0prLrLm&7dALO?ewlLdgMLXuouCW+%-EGypshq14WiX+&%Z6E{- z5E3LfAvnR^Ex5Zw2<|#K10ex|yUXD2?j*t88Qk67Gn);PTfa}JYNPT<%B6Uv_x?e}n}m}FKalpx_qy(gZlPrrQ{vwVA=Xs;vxB~ueu zYyJf_k)LYVP$gk4NLJ}~68S$p<}YXCydni^{pQ~i(`4fNri1}t$^37G{CK%jblBtc zXuz)A_H#y8TuR;DO~GDhon3CP3e;o=M^^3k1ZPzZTOKVA!Pm;-hjYNXY?V4FpoDO zU1lF(v)LtGg9;vGvC|GM)f8l7g=^xinh06uFI&?Y}dCo4mQf4o-AOEgf? zKlEoPKeuU?2zYz@czpYxawN6^O{u)xdj1zx&-;SX$Hg5auUd>Gy_u_x zHfi40RmzK{P)rB|ixWEP1)E7>7p01iDn^lp&d=dFKH0gRtPOPH(Y=d6&MXtB05v*X ze}&(VIA!z+kx5>s3TDb9lez`2`hmgpd^PVBatq5IJK=4@@j0|bjnRnhy6-^LvY*?? zHIDffzn{4-WYFIcV4(R1{RB&VDv{%3?;eRC-MP5)E}%NvX{AwmDppjC3`{F zq%!u^+!-gdZcj12Usf0~=0t<*Yh6I_YS8mM8LSlDPfHzdd(v3Mga4gQDL9M=v)I^+ zA4sf>wpJHUeIDl-+oSZUdygKeRW&FX@Zarr?Oddn%`-NtEQ~z`f!6}P<-7@LSiSF%@rz1!-= zU3q;O70CeJOh=g{ictCq;ql(UPD>*@aWkLx#OXUo_T>aTwIF2Ft;%`{G&-rn0Ypu3 zwMc67T--h8M-Wr#kH$Tox20uY{>`>?^%jKKuXy(b#)Sl8S?310QM=l&4Z)^c+Fap7 zp#}$NKM1xPS0X`1?FZ~R*DL~StL$qQV<&A>&hNaI$v zlWTGbLQbrp#go^Pb>XCCt?k(jW%RIHu)u92FM>^jV7%ZccAf_|sAlSnY9vnRfo2+Z zZu;I_eS3_)#Ia)hW9W(M-B)8-`+pZ&#c5>Ek{hqwqGW17uW{PGxKohlQ|yRkKm?-j zAlhSj?J)vDw$EDn9qVzqtJg`4?f+)p-wX{b5XAv3tX7C4kS}2mT7HS2s@HsA|G__J zQ~OM{EdAEIy~bxYQ?(zR?-lJZA1nPp2JAm{Y?>;5yRWqx zfIa-ryq{Ybl%741NT#Le;!$70uQ5dz6;%|OtTXw(N6sx~@>P)ufb4vX>FZ!rv7mva zv5AILEJ(qj-xQ^@Ota)9gw|2ri{S^X;wi@?g!u`nrZ)tD&&6T7PGoqoZR9XPOkPCb)r<)UCdO zsI^(cMkVVR(C`_{oXJl*;8~vwc^ASX`NFyNSC;4^|R5z>hOs zelU-eXGkSGH=efQxwXWK9`H;wT_hP)8^*7@d^$QI8+)5YKR~m8mGWI6uwt}i1#M~z zsler=>3V%HIsJ7-<4h%*)XMNN7LTV}bqt-({!aUDRjm>3oEN+fhQRgtdM++pOAWz* zN#wWGyWvOS82nyiPnYE9{I$xc6`i>S`%`HYaf1)LLKdA*ffrS`-MJCzJ9I$?`9^=C=VT#dH90g0^BE1K%ZA;3+O8{v+Y zJ9n-4%X{tYX2sr)^55&Bv2D%ejUJ{RFNKby;#a0Ay{Y#Pmja)&3n3DLZ?rs~oDq9m zB8l4g_7*$jLm#< zGh7gAT3N->zOt5?NlRMF8_tDn#_daKo{R^n5K@)35fjhT9(#Tlz515o7FxC!p4h25 z*oIJG0QR(K^bJD8K@Sk$p+4=@&{Ucl#Ch@zo7YqF4OdS*N}X!E=^3Oh01-9cn;C=J zlE*om9-px(<2znyA_b^ee`CR*9O6PxE<2v7`5=c|pEUw+gW?rptJAtfYiafo=HK6~0BWq`trK9?rO zhvv%^`IDsCSr0qON0h%ObDb?6lh0`@ zh0vCd?bj&G1|wVyEd3%rO;@2ll?H3u6{Q}O{kH~=$2}$Ut?Y1v)pb5%9f3B9zs=-h zMmkCuyi=_Y_AD11W@hY2)+lKC8=t&Ge80**1!^Y+x=wpM@Uy(MJkL!hOP>V%`FV-8Fl1ByUhbe7L~^W&%Wk@;k$NaG{W-e02{ zY2E%Hs9mAra&+gNelKILjpX5w7x@ltKy@YI?)B|Hr=00>eTl}z(~_nkv>wIDx>d!) zWtXPS=>RM~9^{l~^hI-J$0!b7`63b-(T$Xm2l!N+F{s zEYPPquLI|1=sevG_H!Q+mXv6FQA>|MCFb$a($;+!5lmy6&TCIk($b4bVOkCF_`r#s z8W7;=!|%#)fCQfTF&6pMRV^LV?rdk8!0+YYAu_m=wJlOLiVj_#BTM4H3l3>++RrS% zsl+-Os=JFN)y#15akkTo`k}s%XFs?Hz>2A}642lPrwl`;+Ow-|Wb1!TcZko6+b)w9 zT{utU!-uoZPX~&G<+clRuHkl?D`oW{HZL@^0GYF^<}nmehUwp$KT4xnDSv#0CBPA6 zM6BASZwaDQ-)#HxzOg1T^tK+1Jm>7TecB=WK%_!7QgquY@9b2=&5$xTksMZhK2Y3) z9uQB+y$hbDmmL?dws~%37cF5Y-?P_UQ+m*W_F<|JGZpe zF%KJuM>IMhv5w@2$R=(a*zS@^hMtSl(GLEb$dmu8Z$&BaU!9Vpluz%hi)&Uw(~k5n zxpi_MOHijwcFe4hZW~eP=urtfsE}(02g1FH!!6{pD;p1G5zTO&>(Ys4V*)GGsADW> z^hsJOE9K_7-a7X_r7$%Ao3gIO9-U*)Md23?Y)_vX>4B0WuA3vbi*3#FXPpV?) z;F+$I_fCH!!eFfzC7es{!LMK`?V-QnF6#dXA5sb87&o6NEM+o`9q?ePthrz|Re^-; z6QEhMsl*NIr#HzZ$dUEE=zZ>IWaPxSw$ss3(HYn3KMx^_?wXjCiTp$6geoH>G*5T0 zWMs8(la(X;DIUKYa`Dx}40UT`4ep(h>(&n4aR2ax6)X>8%vwA^Urf+Zo=YJ~=XUDG z`CZ8Xc28c`)XVip>iOLP>KJc}b zNHdh7R@+V#=e-msZL#RwwFO})aBJ}J54^1XGAhsP?}J|Av(=||peqqL>Wi12&i#`CdogakiWR;LEBD4On zeKODDa|vCd(`BJ*%rSJQ|1^HVXU~AU$h$iTzp~Wwimf2%rV%Us37O4 z+^)}Jqp`YyOMH~9J?fkNxNWabP>%4{x5#s~GRivZi2p-(q`lb}TR~2?zs<9@8>`oA zJD+}(O?0*=G8)|!2nXz0@yck0HB|qD2(v|DiZ%1ORZq4qxw1%Pdq3&^2U3jI!EBs zfd_o8PNk`|`TN^@`lip)v+Xurm%oF+#D^C6iWMyWxVFLQlZf2lDzo3eqpWS`o5s;d zmj;enk7jEfLgAkSKOW6PLXoSL@)kX$Qk}L;8U^2L*pwNt*Ek0yrauwK@jzE-TI>{) zPTl}|#6HJ6hEFApOOow`<io*n5z5RX&%IVc82?#aYLawup7bp0FDZkTKbR+HK z5k(}=wJ+ox3u=J&gnUdSPxu9vfB9W;K}SB!2wlQ>&dstnyS|jPr)or8Pa%%xAa(uV zt#A8)WhLp;>?X;-KGmHi80IFQ5QcKRNqTHf;qJN9Hk_^d(3ZT~W}oOVf5|Cu;(B4D z67NX~b-3*@j!oOLPe6xg8|o)3R*b_NH+;4#L3`_4wm%$MiL^hQ{Mg! z`-h$S2up^*zWggf3xxL{SwD5>XTVMWGcmDU{T!v~OZ!?^H#Ibe<)xoJruycAYVK@l z@n1_DnjZ#dyp;4DG_iJ=o=#m<`<_9=maydS85pCz4WF&_KP*gn{HYryHiVF1rrt4Y@a2bA6Ob5hNY-? zrZ%)y-T~O%nz&8uFje=Bg?fvQXNA0Ku#WiF)mEGBt(~1+1Y_Gb2u?q&2uyB;r7B(Q zsdnRf3w7UX{o}#J$fec7;`H$FbhqW|HCJ{ZhUcdE&JOSSot<5|YZ>p6yIL7Mpz`R{ z>mX~+#nq6Hfwkc)gE!42ubx^Bb}7tBO-(JSdx%=Wc^dLr<<;gr85A(D1eV^b3k4=4r9C+nZnoGmo#d)yiR+Qe~U zOE$8mIKV07>zw!-LSn0exWVTKmR~3l7?CKb(Mo3v*Vc;0tZJs1oC=1HB4*+H|eVq>_D%aatMFasX5LhG2uGzsZhke;Kga zru*=*%o;yEW>^Ulr3*fqH2gFllm~!;3I+6Fxt0e9qqF_25>_1|uNbRNfQ%k<^aEd` zyAq^Yj7yHH{pD@%YvAso3E{QkkWP(r+S$M=##BNgA{q|>cs%^@3?r<`c^E_?Oo8~M z)gS=EcP_#9w}-JzT$Kt#8D6h(DO+#W;r-4>_C?k@Jr_eye4W283^Hh#d+W&~0edC1 zK7kCS=`$uL{_9nEA#9%kpqSC+n6>un!m<%(MZQECdiy=u0?dC);}&XM_`7wHlBRe4 zt!p}0zZn2XF~X6Lqpx@8a~s%Nj?6HcZWxFC0Hv)`e4cL(1KArFcd24ON)q^K?oE&Z zC0Ew$gVVo0Et2j8>(74RG*@hYi2*}uB0+teMzf>&I_m^&gI~;~^|BHZ0ATTkGe|eG zGuJnja8^f;F>!Euy%L`t9vN1%)zGO)w@jo9|Ce8<XeKlB98$G{)=22i?jz+SOV_x?R$I+(zau3D4dSxAgY39G;IsB}{6XmU%rNw2e+ z`#L{tO8>4J5Z0%yJmIwKuQnZA$89l_b3FFdd2Q%s{$eYoEW5?t+wCP}bHRUr!~UpD zDQ!G1L@G}@QXzQ9+>rHYKZJ{KBeH`=4gM|Dbp$@!0YL9GQ*A2CmmiV$-gN;K_*u8! zM%veID2haP1>13UYPu%qCj&JTthfKovS^2&`pp2qP8uYwY;O-udy zT-EXH+KPu?Xuj#*E^u7B4me>rSf5{ibFy7);n$7a=0vB)Vu-v}h{+b?W6ZBZJ+(bN zp5|^09cf7n<}vMugji%TFc5^)iIOjD9W8iOhOwe=b72q}V;!y>ZtPK;s*|!_65TSk z-m{TUa{dmd^>FH_{7l(YZ0hH>(Z?r0@3PJB`qTu^@1*L zIZJ&Db1HRmg+Mu{6#W^wx@?pqnmZY4vY^dZ9NXY2frH3*}#VD=A*d zAQi{8!A^ZKf80m4ztiJBty5yXJ)pI2qN38vfg!0+9hTDZ6op?v?_e|{rNvP+yYpN- z+`18be`m(A+7_0&C&2S(xdh4FLXKk2?@RjP6+bjL>oNTK1HNWSEWvm2FVB+|&>#1{ z{hP}=mRB74rf#DCxPC`FORjjRwers0ibLFdN?`u&L>+VwQ$>b0PFasc-+=a=3^oCk z?!zOtZcEXQNAtXTq()tx73YhJOt_j}iW68^t0cII2{8g@lESWt;ZmH>qD3|M8;51T8rSeK3sk?MxXk)s1-o~C0L5$U9i`&SGAXS zB`1ulM1{?3^w(E3ctBW0MVJ{b7YbFpbR}_rHV%+dDNs3>>?R-X5a2{sqW9b8x$|Dm zI&CV`9d1+Z`NqZGXu(c^F2Zi}l^2}`2Y?eUYVu4t;^nD=1BkqJ7XmPURg%F0Z;sNA z(&JDOrOg9fN!AT~%hu}ctTmqZ#L)ft4{SZd<2!twerKrMq%#?ySG|hrGc9i?Mo4$u zcwzDS5Gy;-rHvErreWf$K-D|ClrZv5BSF)f1SGB!!w}8$`kbN08Lb=AE74E4X~Dxw zu+L(da>?|mwU2d0`j*jvm%zglwlfXCgQ%dam_=NP^<(>xR1{E^R1Zu+|M>mM-olCV zhIM>yODfnoHp;(XX()8GRI_sm4-YS?O2D8oO@<(WKRU4rR_Z)>_E{G@3q__-57K=e zyK!d8sriuCZ3;sF#4oIG05^7cOLhO5H#u5!g1e52PkYtkBs++j=~D8ZW8+GR;OnlI z$7@fI?}^Z}f%fPlD(xl1m^y*1(u?+uNl_kAEUi0vLqUrCmBUyB2xhEZD9ze(yWkE8R;7|LTY(<=m`QrwIq=u0Bw_(lwJr(u7igs)?M*FtQ%!e)6xVN44ys z0lRioF4X6!E@&sPFYvNwAMI7nB z4KOMn&ZCH+J1*sR-&-A_?SXhZ`R>SYTy*p!+z*>0C5?fjI5i7e1;J(*(RK1N4c#Rs@)*3Gb`V82MqE9dTZW-Bn3nHk{3$OPy( zIF;7b9SkL+!UQ262U$jj`G~xAvJ*57(kG{@7M@Wt`YCkw!^TV8gb4mt}_2c!GJ#wCYxMfv*4pS=pe$ zu|f`P5#uqMCbeuO7=lb!H%RQ$GzB8eD-@aR6Mu&YbL_bJ891Y?V&MIOI#DW3xX?}` z*7nvI(Xm|@C0Pm;4wP5nBkK;yF7rF@GFcku=jFy==>3U8_TLuX(a~xpQvMA!YN_%F^e}CLDIAVAaV|oowt8KIU^ZV>Un%({E6K!MG&qgV~UC{ZtTP( z7ea2?)ll=%f?Wp2$H74n-o3``H}#hNbvPOF7>$V&4l_3qZaNtU9r{?Z3&Gg#8_`ek zQtGe@6JE{KUUGJ;m~3_{^sx`<6lU};t5epeHnJPHg32_qNz9 zQqJ5Rj@8I;z!RE z-<)?p9dV;83m!f0s}r6iYIDj0v64$ed}W7=+laj-)vX z)~cU2Jx?$tF6%Ie(5+}1%q1mBzgor>>VyY=gSXOPm5uf0$kOVjR}tbUVv4g7dyU;k zU(W~0*kE9*pA#%z0N;-%T{7hG+%N0cHCzS5{UpQbCu#02e}BFPe#1+xyq(#(n|Xv1 z&t6U9mY%*z?*UiQ{`xvQ4}w&?<}(4pb92GqNySL;yz@bla_S1}Awwe!09|ag%s_a& zb!Wm&dhh`j#o0ZP0DJ%KI)_`3m>t}50vz<)a^ro6dN{Lme;mSdQpY>O3HvkzZShwa zC+;A=wzH&Znp|>fe@XuN?CKgJVan1=deZ=-2Ae^(d_Auu7wr^d;^f=TOa+IE|K~NZ zfAkY~qa^Tz*ZF}`_<10LSTP#-y8n%)Pmb{?>_!Xad{PoJ4o1JNOWZGPVgqDhIZQaN z^Fkb%d#dymfIbz<*R{1yZKpFEP>_fO0GKL5WQcirEZ@KC&c_<#ev4u8Ax@17QOsPm z*`o%opnSLv0fqxh|CJLNA3DZF?CiVn3@d5xdYKiHnT}o3HQ0+Fz_T5^t3Jp#)bmk$ zhrOZS;<_w?11GBisx_bXX>7IHxcm06=ew*XsL~h~Nj_iK>|PpDQ4zN1F*}-i z%Lcs7*PpN6JE#6}J-E@%e*g#L1RE5naTQSUdJ~e4MLS2>u<0hYh|9HN#FxNVxp-ouT0P zb-t{92`3|8w3-|X3|2aZPnOuu&sicLWhiTZQh8jW!ePT0PPS_UGM)d9V!QbCujwsB z3Z&`{Z#W`CMuv`8j+}xcFwl0{?+2F<#2VVw@_QnKGaT1vM`#89iuMwfWsX-G^1#ML ze%j&x{qflWW^T_2vL)Ydo3t-eF#}vEO_$2 zUBJA?V4;*gRDl0y;9qES-m=$mU#y-Z#)A=(F-OvQoVWFgm&kT{f9x1W!G|j3^yhv1 z{soSmH+({h5*0nD*9hnyA2(K0kL&*~QZQ*rhJ`F;o57i`;3rH`j!XBwKXZI9-c%d? zJB*GCSWhkZSKapZUh)C61BUmX!<+$W8FF6UZnrl(;h+e=WtX|O?99dQ_Hkn{%g}q& z+MpP2O}Q2M&1@rJys-SyyGTnKi~TiiTZiq`(0lDyeg>yWOR_y@SL_s_2G{)H=S}nz z>{mbK^tZ0B$?$!QS~~)>!1bo*i$0@U?W!ZkBvY?aRi34vT{{k7A>_*-6YQV=Sr6}3 zS09T0S4{cmzqRmxEqDKmnd0q#nYum#08uCA6MCP_M78Ws(7S+bXDkupSr5c{3+Yhj z>f$|ly+gUV4}DnwVYKiq#Vp}-!Lya)o07eG==fE#vdHrwQ?i6DtIA18kNWZ7EG{K; zHvMJ%Ag0(Epv1Gm=C4;|u;utIr*BRNl7C*_16p^;B_bBD#*gbbPJYCgMg8S|A%1U@ z8{$NR%_8ZTY#P7nr_NU0hNH2(;dw8dcQF+71}CA+>ve{e)-#!v(m^ZH6w)zUJNd6? z5l4Jf3to?T^Rvtk*L7~4_v96pL|}4|ePA%QkK<%)uu!#++!h-_fdlrh-&k&uvTwWM zNXJlU-#OT5y*EqU>YlhaqCw?!0aktW$$8&;>w_D{z3h5l+6EWYn>1Efy|B=rA;(uI>3;vad@73DjiJ!f z@$gW$LZ7w`1P5I9lK8M(U;LF5yS3SeY)oRZ=nabxJYVT3x-WTp7(JY&p z)?{&I>` zy~lBjpL*y?(cKCmtVS^pzyD%&+mHH0h!^ivNYI)d8#07ZbVy$^@P3(PnT02y z$7WA6y)&}*hXe~Qg10Cly;(v>2{l?uWG#pE@<9cKo_^mX#n8$~In)|4-iCJW);_N> zzgVL1e*2rE%mH1A_KJ6g+Ao;6gUNnHfofD!2;^4F&5z&Y)!24TEX85q-{;Zzo$KVhTpz7 z$oDAKArLvq5@;qQ1%#E-^USW(n=M_U@JSS4?-cU-1#zAnm1+_AnGWR-86{q#WQAr= z>)b@ua~$12YB^hC_4{=aLB|Q&lZw)-F-s5&sI%Us9F- zo9x?-4D2xe^3P8Hj}iWF?(csRf&Z`3es=!{y5ssd)cC|M2}_CW%r+vPGHClwoa_dO z(>CSi6@;%fP-oc#uX8Ywi)+&h8CAnpnqu{_+VD06oh0@*=-N+*;22>A z*6_ne-Dazoze5x!kTx1D8cTjv2tc|q>J}RE*9%jSMmi;-&dY%}eb1rLBHo$FwmW>5>lzW5b@_^Xm|e2gkp-8nuzd&=Dze^T&Bvud~0)416a8 zPw3F?tL5E{)b|~X9(4u2qYS|?I64>g$n5E#T>YnzdK8CAgv=OBiQcqt^$|8SHgj@# zWKUg!&yO)-i3q{DV&*20fo=lRuuR*q-|0a39-<` zIy8dT{pT9<(eeuGm2a~nxhg`Ts-fB;eN zVUhadJ_jW-0VSSVLgBPkolaR1=~2?Z4Oy|=Dd?kX{_Ur6Z2so^;?jk4?PCD=%6YeI z26@jy9h!TC+2(`_nIDaX1HMANp3+YD^8^A%f_z6R((D&-9V#{faLo&i_%X3FgqexIplhin3&OKGQC)5_kfY zycpj))~TBsQRD^XxA!a9i|wabAIsd|%-2`DxqcIEj@o7R0ND?AA_QWDseWNd5ghYV zQb#>_+%TZn5nSXL1<99aOrA`^Cw4}^7exVp+C!m%Ea8Uk5twdyZY~tB{>We)`U729 z1;D<#lM#u=_P*<7dXqR;{PJNWrHRd8fPh?fpc>!H{h;Tj9Fjqiq~jU5;_U|ygiKjD zh&>nXMi9TQYiMP)z9WQj;pjl^o#rloJe9ie$=hjqJ3mE3VJuRLz1ueKo7D&R0Sr_H z(28b5bU+DYd-fMe$7dsOwr`nKr|w*V5%DXZyQ|bpd>!?&HQ*;F!0ZMM%2b~u2DR-d zn3bnDl|MHb58SV%PDiV9+3NAoIB$3T5Cwp%I+Ul8JBE~rxn}KAu;5TET0M-g$FFot z438y&6h(TW?r62liDN81$NaiKS&-J?6_DA=n!hr=ila)-kaBahAorfMh59`J2!1AR zmTEnJo+Ez7iR3(y!G;I04Pk8Ie?UutO16u;yFq>%SD8X{_ACaGt(Tp>t-O{`>7St0 z$&u;cCsMkT3Zll-v%XKzdmeb8@Mj+Bq_a33DvSt;p*8G)kZ;PrHBOO|P5`cw_wM0cuH(*v(OIdHk&# z0OHAn3c{?nzRf$_C7QSU8h%t^0m<>F@Hq>O%Ber^gA!tL_vTKQ%B~3U(q7hmq6v2M z%iHC{+u6sbv2(rYuw&RYR67##T~xF(3~8bD)hxCj;5CwN$n&(&UD&{~)MEELit1Z! zqcph6F7>j5xIO6I#jTP3-5jXAnjOiCY{anr!#^{uFL9SQD1Cfk4IL$IN#Jt1m=jdc z8iu(8_=s7gpZ>))?@Kyw{>x7I-woXVunGR#91Sxyf+8hY?`u^_LwkGjuN%6z=JQaerX;-wGTm*+fnU3;EoFfp(Fp=csx1~Hl4)ha8>nR@7kZ^>C%>HJ(H z?Vi5W8Y}Gg5gqAh(@>FWm;&F$>WpNaOV zZviDY&+FN7dN$s8eL1I$gyhyAu+4K=<1TIN0Nzms$!|D-Of{0>7oXUQ%Zol6EKE7t zfPO@x?{aXy%QwDchgd!$Jtu|$T=gQhnGLCiS94d3@Neizr_sU`TU=jGSwJP%3N{J+ zWg9)GUZXP~5CDr9jrv_?OKsfV9ThHn_2m!K-uG{h@C#IED^UzcxBR<$m79EuXf_P5Z z9jtvjI-arHo140CkpS%tA_(bQ^L`pxv6g#`8wj?p@NG(^lu|L{U0Vdz=x06bdo2wG zpKup=P6pg9OT4+_id2mwt;q1LIBamp9Ue_ct!hn|-ql!65j%r5NvOEq9x1=mlQAuj z6}>3fYO>rN(>I5-z7Z)mRmyeJDsQ$X#Ev3)VUBy3k>MSOKj|7{gELr;H1jbS)W_MD+CbR_rPEyb6E` zcIhm&+|E@k1bjR@3(_zWzGEn|p1dfoMbP&^f7!mRKW9*MPt#6J9b~R`o3@_)a_?== zmVU4hA>il$vL>odGFllBF?f0eS&EgUlAYuv8LiolJ9tTHd2-eDHAd^G-dA-M7nNvl z4CfeIQ+r(Pi9u_;+m;CV+$Uk;1ve~PmImTh8Y}{pP0C^{OVl)(+xu;CJ@GhH9Tn%7 zPS#S(zpb&#Q&S#mEBQGJ!f;lN#*~IG(cgR)1V5T^Om~fDu{0Cjc{ZCEdaL>A62YRS zyIfzmZ03y4yA=b9EZy+D7B9v_=OOXFj>DDunChBT53o1*YBr^Shb#YJD&zB4H{%bKatIP_z|FwkhoYvBmIm#A36%YwkTk{uw)b}wI2*z(DaN2vFD?1E*Dwr6T1s5YdngB9vdJd~Rxi>)OI1PH3tyCQPjKl^bUm>Eqctq9@7c-_eN zxVr>LDU{{f4n2yRo*>XbR!&P5~OlBaLCuWtg4_%nqww%<*%z zON&L8f6j<#tY$4JKO3Efgvc%U3X89F=^HQK;$;-)l|g+fMzqk+Pomj~?8&_KX)b6-5Y&F(}eTaUH)v1Y4)= z2p3h9_3w(Z9TV~L%uQ2&dTOuXN(!NR&-{3PP4b2{MeY6gVw3_P94@tdrKC5>HjY4Y z?UP(J^?cFha29XJK;FaMK1*n+K-)bnN}LzA&QqH@@u2EbK$#wqzPFi=00UbnsZ&2t zMI^Z^Hm72Fx|rHSJe;WMKj8xE)En+@I@LB^(_WR{qM9#d7z#GcQd&jC%s!L324+C6 z%qJX;P@xXjY-~++=}lnu?Zn{z>b>QU6*qzwqk4#*nr6u)^9)(R(STQr1|#xmEI0Q7 zf;z**t$jy5cbJlI6m(i$HVzg8>YAP=11b$2yn7>9#xwqKlGMLe37DdCxNf$5c8Skz z)+iiXm96XWk*GRqJS8(9o#lj+BSi9%mcc54W+3sUuw>4S7?*;a#Y7d|wFyH)VqE4+ zXI%>m0;sqI&6;(+%w*X-wZZwltMXnwKTkuh8+9VlT11XB8h(J7%N3RQB>9|S1sI@o zxAl3Y_kPJxMWW#3{rQZAzhN}PgXj2Fw!^=GCE95E-Wvx)^S!)JL&J%e+Es4fehR$r z=_Z}Qhc;cA$x6OgH_Q0!F#Htz@inM7h&$3}X6sK70#e3d1mVh@s^wOeexhn7L8aYF zqbui|Bo`AVd+(qb!cwAeoV~k!S8F>6ss*{deT|*B!>^+BaE+@2)C+0J6Gf*^UCqnR z-(a(G$eV{`aaaU-@CHc>@&6-mEX1#pqhi_j;z%XU*BscRe^(wgQ5Z*e#l)ymr1Z3e zG@A7vim+eZ->S4eNB2#=Jl(Xhk5lS^DkFl_;2I~dyp#Jldgyy?H z;EhrSznH=I$4BE5bIm+0B==dPUC?)smQh$*Q!I>?FXWa~R}>7%>#hFz>XziisD92> zD4_lKLuet0L+Itl>16eq@(+xyGk1O%0ZiGj>En(5dly3(Iq-e?VF#F@sF+m2X0r9B z9-A?;K;Nq@H0LO4atoFsYWlmxv2Vc`+dIj~FEG-RcM&|qgd(EuVJ=s>{5Koq7WR$*be-_`1$1+}2|KZD`%&2Nm*ruXq|Hu8yyI zz;aCX40)fgcCS-dG!?o6bp})v8JA*dra8u=HK+uiu-mwds;MjXr^~CJG-*8FTup69 zH$fZp5}4#0dFlHOL65hTJFiHF4=wBL?RS2b@^Mm5eUZJ|Q%PhT$7jq5Y~YLvT`}Yr z`#;TnXEYpt*!Ca@f>fgO*IPu7E)mg5^b##Z@2f_v7DSXJYSblIHF~en%SJDY)q7oa zEsOPR{_lC)dCv2Ee9wD-oHOUlZ{~N-%stnAl`vHKx_ye!WTp5Kr{&P-E^C_UtdRFG zZ|2u3iM7^xvd&n@BaMX*+nzqur?qk?37BZgZ2p`Wp-eNN*$)V3J?w-wM-!+BF# z(5|Bu+6FUFqBI;G?qnoA0N*3N;~}u3mFyAW`ePdh^uf%CDc;92ilY3I16-+OkWZ}! zzuE8sZZwr%m%EIY$xL@7M0&mu0b@$U!}@fwv(Ng8f#0n+*npH(j@Y(G?qVUt0Q0#o zvhUGm0OXZ89&QfpacTH{bs}bzTW|pYvOZS&K0msOw+*cZ?Sb(wYKjVkmO{izqCV0o&gaHJWPu6^3;wKy*@+0UU(w{ZM5;5YyI7H5=!zVSE?~OwZ#TpPW75c?w^nDr~;o|9C!S5!m;&qLD50! zbcK_mH2i`|L_Qx@%po8{<>6UQ{yIUWX-G|C}5BvtN06 zaU`aXvjpS^!NecXk^=RO&>m?j;O;|9nn|D4fqJMkFld;Z{a}g-47Yp*h6kHCMyDPM z2`h(aeu=8vb78FTN+(AvAu1+RBi|0$fMu=jza@%_<685GO#R0Qa@lHK-r!L5w$#BF z`%_!_p@&$NAmv?=C!vM+V2=Q40MKT;Cu|fw%+Kj0mi#0x5V>Z?e-A(7+#}8gG$WL# zo<}7HE&}_zPaD5Bc+H|yMc$?kv#fm1m&~2Zquu#a)Wwh}O6|UCp*BGf4dL}8oG;61 z-3z?(+p05%`hZFyiMB!zx3@2}XR0!1d^?*;{7-kA zZ;m22KJ+HZD|8`4w%PM_zQ5(B!L3T`V*yvZH717l%We6cvHAA)Oe>rhyKZ{&_=LaN zf+j@7lWae31wJU6^RpJ}yOrirr>$ie8JzsB3%Hy)`jUl(L0kFTP7 zzqY~RX~Ygj5gNw@Be_ZmymVRT$c0c!(!|-?{c9B3S$0{{4-rzE1bjOi-w_sIqs=n< zME-bmDog_~N&{VQI|`RE^7Ewtsm;`IGcIXN*fbuX+bV3pLt8+^l3n%Vo ztybij9su7SNe6z*KXtkH4oV1&MPE`bhJxyz5_8B8#o!(TDc_5~AMvZAefg_pY)V>L zlmj~tz-%~oma{=DEH~$GZgGHUH=_h}^U9dml2XuHbJ1k4kIwtB2qU3d#n)Mb>kLhP z1a-gmZIX`;x1{zzx3+4q%}_EXc^KC?z3(H+dU@a~H?ZE|Ls6bhpev1N-862ve>=m* zIRZ^8Y>6%RFJ2p+A@Er+z=xM_R&QrQ&_;TgQk+r8C)$9`pnIV?cL4dgL^o`ON>esC z=~mFQqY3OKQ_*uoF1nhVksc@ra6i(n@v^?8qEZhUfaiOgVY4_4e?>gm+EONX{iwP5 ztYjkBG#{`cl3!mE*ko9^4>8SKn(-xPm@g*D^!z(>!}diVQ**X4G-*sUIo7vG+?Fk+rMfPd zIgTj({O*qulE9)lO=^B0=rG8|$G~d`F%ke@A%#gKUx3{$GJ~Sn-|8 zPtIgotq*SCOuD*@k&E@$HptDe32gOxulc)7?_Ji%B8?dNwEQL|(TxWt zdWnyy7xb`&k=x^#cFSMAd%l^e7-WZ&EAh=bWj7%ID1Cp2P6XSxIx!(0VKpmBq^@2< zw9|Q}kGuzS#a&~;dyJPI>)gFw}Hby(um=HMP2|DQ!Gxo_ld(EZ%E@F+)sRT|=Yg0it`* zaSQo^5crHNi}bb^7iJL^MNMW7T|q-B-xEAU(oru9+g;-pHsKg$BH=sSW)zxFdCJ;} z`w3c<*Y7zoPKjzMEG=##C-@zJP_37R`58`z$0?X@0l>~$-g1j91-Mq=e5zx+IP>@_8h4WPxMb}j4E?BZp3IlQ8CbU57=-uT3pnKP^6Nk7jklI zz}Y!%7uQ{M6E@@dbKs0fJT|ZqjmNr{YuQ#NjecWos+YGytt=+_`sT0I#F-Kt7H^L~ z@?z~Vw&iT*9{MgGl{Oxq~S1s2PbR~DT;LOwoa7&Y(ys1^{^6_%HRf7?2}Z)SHD<7+=EpXd{K zR(&)%q~J>^zDS)2H3-kFugQMz+;LSAb@1_ipmJcP@W+Miuvl0G`3D$D&5AX6z^)a$ z-~ik7x1x4c)7h?&PwYIJsRDUX+qOVrER^wp+v8s)CY+eZB&F(} zF@sFAohwHf^oz&}UaJ>1fvW-P7sq|AxkZ{dB-n`*Ko$$QufEdwyp8b&jpgQ)=G1kO zqt=1?GC3Hn@J?T9L+`;F`JCTJ)z2hAJ)}X|QP{0BIE!D$*qwGGsm1d z)osxuNzi&JDKXj9Aca5bqWZjj-HsPti-peRJ zRM048v9}zm)k$4##T8siEoAeiOd<-0+~-S?&*l2?E_F|v(M4S&q*4b&ES|KZ?$wKf+< z=-Wqz_n8c;A6vc-a4E3vTv{HUqi$7+w7?5$b~~xQ7r7YS!rOmisJU8GD}H5^n9S(9 zTUE7qO-xgYQYrahdnsn+;m!Dix(m?G&e?w;QSC zt<8+x$PIr@76-qxZ|Q-yG-pVnns+{ot0_*tGW*4~;t;8B(01gYX_dCU#bc&R7B(qF zqyw3su4*o=C{#ts@@q}7{aymi3Jbx@{7g7>@kMMBW=XlDe%&-Un#<_07XB=7%$0{CJ!;>Y>UD>LuJACnK$P~nLbggww ziDC>W_$={Ze|f5Ze5K4R!w=>$y0$#!*;wj&Q?-5JqxHw0Lz3PSVFTm6H?o}&{&T1I zrC_<|#HOdI=hamh8TC*`Jw%~peoT!nXaXqzAwK~*;HHBA7_k+hmrxgLw+;|LCQ%Ho zRonE7q82b~_C1UX}+^M<_H9k;Y?U}NZIuIW0 z43cXuEG*3ye9R}Kzzgc#ZqhWbcU$h*K2b@WXvhwiAN8!BRt?Uwl=TYZwr4VoE&~Od zHH{KPYoq_nU`}^AMRH%|jn;UM!BhkErVMp|u#O43{8S=l=3WxqI_)V?$bUu~{E`&F zi7|qDtnoxNCw!y21RdXTsi+RwpXYOMHvO=&Eu>uYq3l;C4~nHpu67kZI-fbgExyS^ zyoPz*(p;w?KF*@+pTK#Ynj31faVq_yflvA5yxd^lf3mYWCtkDWP=P}@DIxlBxhozO z=`+>Ur-Cjo)(~U{beVmx3-c*-KZK)?M_KedQq(o@<*UlGiipt=k{x*6*4gsIOn-=* zW7-CPdS-gd?BQ(8`4G~oanvfm)@Q2C{pd~SZ-j)>*;^1qtc&SyL}=+hHP^G}P&3T7 zl>#|CgA6nI-t_$7KugN6p+Pk*+FFy1Wf>CLC@W5cgTsUS<8-wBX7o}JD#4~Q{!ICQ zgIA;mB%WDgB7Zhw9<;h&Zd3A9GH-O;%mdlvCMs{qK_bbve8!nT56^OMH z^1PX>g~K)PkaM#b#g3kYzx>*mpHB{0Ozo;ZpDyIic(E|R-9&M6>GOC(0je?L)ade& zI=#{TL)!ao2h!V%{r=);FTxHF^()j_a`IOSa&BUNIG$htQM9k+*`S5Qonne3dj|Pa zr-7ipx-e}3Xml&x# zWU-I|%}~aar-8_VzD}_4Fh9!U5h8C}E;$WMRqN0SMlcSoTwv&2q68-mvxiRqY+^&md}i14l= zu8!L4>G7|_KM0g%GmPq`1wBxuTxvFJvr6CnHvPRwf8C9LmC0aW+SYE15BzD!)ceT) zgzvnT$gY)jszv2=6{v1uI`+KT8&Nz^&Qj{h9MH7GXZH7FJF|OL^`m~7RV#r0{GCbK zHyVd8cC%g^HNC3b$GCxS~VyzU40f^8nTQlV0Lb^~qZnL#DC|GIjNP=0^&P?WGikJie>-%4ys@Ly@b zRz&|_rw{DTVTRFPg8cvG0+QYK29gOHuA&{lz72h^zSoMw5oMt0*Ch zT_4l>z?YznVUD|th&pS8Rtj4TgNQS{Vc7k1 zF=KE~Hbc-#$2%|1a{k@M*ffxHfPL%kF}NbErKSvZ*(4->k$p zl2L=Xcz_~L0%;a#IvP{gomeyZf}Bu9GA%#9b4pNfYCZ0_k+veWXK8EuWJ}JZacTT| zH{{zI?13zrg7n(qXD~Amqzg-6iy(XvtgPXVx?|{&m)f5Ndx_tW+9URKB0E(3Eo(wN zF7h^5)_|Sb{)Z%aaUm|{?v67B&R$(xZH<&lEltHBs%ZD&Lm(!vI3M;C#}d`&5xEsr zN;Rdz?_8TPja)b@4Ib-V{E#i^(|&!DJ!?#P=>Qi+Jomn z!L2eX)MG>O?d=O#5AdzED&H%ANt|R{uP!;p@Vm(I?>sd%yuP?!toZ*(i@R1X$g!BY zo-FI|p5i%Vex-ZtR*%NAvd-`L%*~=BIMwII9maE_bZCG9SXDhu2GvsP-b{- z;3q85%n6)#ZFS-jcBTZ1kGsz*s)l@~-8Wb0C4;!Y+CRht`f(8^u2bHr>Gbr0hv@`3 zcT_4a z&|}B(w|x8~q9JX#xP^Co6+uifC3OQe^mc797^m6915}Z*CljK(6()tY*472x zTpuJC6cEjev9y^L74G}@g+rb?fNIA^rl;%Ov^c9=V2kPIJDY+h1SDCi84vEQJGrzS z*U-zm`-5*-6eto#vyYM6l$f5sH4#(rxxiH57SMGahLz-Su7kQq$B@_mNu6&om2~MB z6vGvVn9tXA4{4Q1sa{w4ADAUp`&r?+U)c1*MR!jvL=^9ngn&$W)2m~}Y^Vw38)izX zBk=e=A{9GxKPW*m3=H3yGl<0IEkRlcx`uE z(e*i3n$;p}R|S^Mc{IS98W!3Kb%9>i?619D6tdhBZ;scPtROg`m5fWYmGLv^+#bzS z4B&Vlrb)ly?l?a=*2sz0&1A`--vu?X1=} zS$eFp6`!xOm(X44Yi7Up>QE>yR4Ut5&m7_NrFIzw9l@xnMoI7z?;-0~N1Gol1Aqwa zuVsU?TR6Q&a4{MCWe&RD1yf%Mo)#y*(FYC%Mi`i_H*YO9o4O>z9dz-P(mk?tAuO)l|xv++Qc3(uKV^ zU1#lRq>X7PyO;e&?Y*|&YPV@lf!;uahNqv`y9&(7M>f%0-NMVF=^Z3l)*dORAVzja z_J6{|zRMaFP^qx*^a$dwtaMJ3A4M}qu8g}IvWu8$HuqsEX z)yQdd^;V2eZGt*SJa=0WsUWOFUMWYPj9pt}_3?9|=M3>s+rDl(%TGANe>}w^T~fVO znz7u?=EoE+G`1o-ww|Lo+s+JHqyzLC}*_a4UD@;sG9FFCi`LLGrM1z!y z6&>R*p1*#YhC7_d4v)?7J1kAN4pE=+)zdCsa}Y(HbUWw@xz8J*v*hD=6tD9>jTKmX zbZ^2)aUt#=?^osYJR;vtJqv*tb0@d6}5E~14J9u^1+SV0t@P|8Xc?*dg+tutw z+Yw9ZHb48Y{OY9N1RC?jg-Fq!{o+gH7w=H;{OnF< z3|>SS-nw|!xXVU5^TzhFU_OYKSB>!(o$R_pFGvaD4w~}v*=<`1zP)t?7PPuDr;J@l zH8wIz0eiZkMF-CyQ6rOd)$Tm|*fD#5h`zpltE`aM2F+x1&VvJ#H$(MunAu24A}b-Q zRF7|A;0T*teKjhyL0pO04NU3?GpSy#{( z9)E21Xudc2&#u6>ar-I`r!Y-%5Oze^@izBm-Ry4wmu?Dy4%NS9=l-@15Ed**d#jxEC5`oC~Cee IePI#u9}3TXfdBvi literal 0 HcmV?d00001 diff --git a/devices/surface/index.md b/devices/surface/index.md index 2cbeff64cf..2a2598a5cd 100644 --- a/devices/surface/index.md +++ b/devices/surface/index.md @@ -62,18 +62,22 @@ For more information on planning for, deploying, and managing Surface devices in

      Explore the available options to manage firmware and driver updates for Surface devices.

      +

      [Manage Surface UEFI settings](manage-surface-uefi-settings.md)

      +

      Use Surface UEFI settings to enable or disable devices, configure security settings, and adjust Surface device boot settings.

      + +

      [Surface Data Eraser](microsoft-surface-data-eraser.md)

      Find out how the Microsoft Surface Data Eraser tool can help you securely wipe data from your Surface devices.

      - +

      [Surface Deployment Accelerator](microsoft-surface-deployment-accelerator.md)

      See how Microsoft Surface Deployment Accelerator provides a quick and simple deployment mechanism for organizations to reimage Surface devices.

      - +

      [Surface Diagnostic Toolkit](surface-diagnostic-toolkit.md)

      Find out how you can use the Microsoft Surface Diagnostic Toolkit to test the hardware of your Surface device.

      - +

      [Surface Dock Updater](surface-dock-updater.md)

      Get a detailed walkthrough of Microsoft Surface Dock Updater.

      diff --git a/devices/surface/manage-surface-uefi-settings.md b/devices/surface/manage-surface-uefi-settings.md new file mode 100644 index 0000000000..e18dfc07a7 --- /dev/null +++ b/devices/surface/manage-surface-uefi-settings.md @@ -0,0 +1,138 @@ +--- +title: Manage Surface UEFI settings (Surface) +description: Use Surface UEFI settings to enable or disable devices or components, configure security settings, and adjust Surface device boot settings. +keywords: firmware, security, features, configure, hardware +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: devices, surface +author: miladCA +--- + +#Manage Surface UEFI settings + +Current and future generations of Surface devices, including Surface Pro 4 and Surface Book, use a unique UEFI firmware engineered by Microsoft specifically for these devices. This firmware allows for significantly greater control of the device’s operation over firmware versions in earlier generation Surface devices, including the support for touch, mouse, and keyboard operation. By using the Surface UEFI settings you can easily enable or disable internal devices or components, configure security to protect UEFI settings from being changed, and adjust the Surface device boot settings. + +>**Note:**  Surface Pro 3, Surface 3, Surface Pro 2, Surface 2, Surface Pro, and Surface devices do not use the Surface UEFI and instead use firmware provided by third-party manufacturers, such as AMI. + +You can enter the Surface UEFI settings on your Surface device by pressing the **Volume Up** button and the **Power** button simultaneously. Hold the **Volume Up** button until the Surface logo is displayed, which indicates that the device has begun to boot. + +##PC information + +On the **PC Information** page, detailed information about your Surface device is provided: + +- **Model** – Your Surface device’s model will be displayed here, such as Surface Book or Surface Pro 4. The exact configuration of your device is not shown, (such as processor, disk size, or memory size). +- **UUID** – This Universally Unique Identification number is specific to your device and is used to identify the device during deployment or management. + +- **Serial Number** – This number is used to identify this specific Surface device for asset tagging and support scenarios. +- **Asset Tag** – The asset tag is assigned to the Surface device with the [Asset Tag Tool](https://www.microsoft.com/en-us/download/details.aspx?id=44076). + +You will also find detailed information about the firmware of your Surface device. Surface devices have several internal components that each run different versions of firmware. The firmware version of each of the following devices is displayed on the **PC Information** page (as shown in Figure 1): + +- System UEFI + +- SAM Controller + +- Intel Management Engine + +- System Embedded Controller + +- Touch Firmware + +*Figure 1. System information and firmware version information* + +![figure 1](images/manage-surface-uefi-figure-1.png) + +You can find up-to-date information about the latest firmware version for your Surface device in the [Surface Update History](https://www.microsoft.com/surface/en-us/support/install-update-activate/surface-update-history) for your device. + +##Security + +On the **Security** page of Surface UEFI settings, you can set a password to protect UEFI settings. This password must be entered when you boot the Surface device to UEFI. The password can contain the following characters (as shown in Figure 2): + +- Uppercase letters: A-Z + +- Lowercase letters: a-z + +- Numbers: 1-0 + +- Special characters: !@#$%^&*()?<>{}[]-_=+|.,;:’`” + +The password must be at least 6 characters and is case sensitive. + +*Figure 2. Add a password to protect Surface UEFI settings* + +![figure 2](images/manage-surface-uefi-fig2.png) + +On the **Security** page you can also change the configuration of Secure Boot on your Surface device. Secure Boot technology prevents unauthorized boot code from booting on your Surface device, which protects against bootkit and rootkit-type malware infections. You can disable Secure Boot to allow your Surface device to boot third-party operating systems or bootable media. You can also configure Secure Boot to work with third-party certificates, as shown in Figure 3. Read more about [Secure Boot](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/secure-boot-overview) in the TechNet Library. + +*Figure 3. Configure Secure Boot* + +![figure 3](images/manage-surface-uefi-fig3.png) + +You can also enable or disable the Trusted Platform Module (TPM) device on the **Security** page, as shown in Figure 4. The TPM is used to authenticate encryption for your device’s data with BitLocker. Read more about [BitLocker](https://technet.microsoft.com/en-us/itpro/windows/keep-secure/bitlocker-overview) in the TechNet Library. + +*Figure 4. Configure Surface UEFI security settings* + +![figure 4](images/manage-surface-uefi-fig4.png) + +##Devices + +On the **Devices** page you can enable or disable specific devices and components of your Surface device. Devices that you can enable or disable on this page include: + +- Docking and USB Ports + +- MicroSD or SD Card Slot + +- Rear Camera + +- Front Camera + +- Infrared (IR) Camera + +- Wi-Fi and Bluetooth + +- Onboard Audio (Speakers and Microphone) + +Each device is listed with a slider that you can set into the **On** (enabled) or **Off** (disabled) position, as shown in Figure 5. + +*Figure 5. Enable and disable specific devices* + +![figure 5](images/manage-surface-uefi-fig5.png) + +##Boot configuration + +On the **Boot Configuration** page, you can change the order of your boot devices and/or enable or disable boot of the following devices: + +- Windows Boot Manager + +- USB Storage + +- PXE Network + +- Internal Storage + +You can boot from a specific device immediately, or you can swipe left on that device’s entry in the list using the touchscreen. You can also boot immediately to a USB device or USB Ethernet adapter when the Surface device is powered off by pressing the **Volume Down** button and the **Power** button simultaneously. + +For the specified boot order to take effect, you must set the **Enable Alternate Boot Sequence** option to **On**, as shown in Figure 6. + +*Figure 6. Configure the boot order for your Surface device* + +![figure 6](images/manage-surface-uefi-fig6.png) + +You can also turn on and off IPv6 support for PXE with the **Enable IPv6 for PXE Network Boot** option, for example when performing a Windows deployment using PXE where the PXE server is configured for IPv4 only. + +##About + +The **About** page displays regulatory information, such as compliance with FCC Rules, as shown in Figure 7. + +*Figure 7. Regulatory information is displayed on the **About** page* + +![figure 7](images/manage-surface-uefi-fig7.png) + +##Exit + +Use the **Restart Now** button on the **Exit** page to exit UEFI settings, as shown in Figure 8. + +*Figure 8. Click **Restart Now** to exit Surface UEFI and restart the device* + +![figure 8](images/manage-surface-uefi-fig8.png) From 6918bf38767bbdca6d9b64185508c5c9c440ed9a Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Thu, 19 May 2016 18:44:49 -0700 Subject: [PATCH 354/439] fix typos --- devices/surface/manage-surface-uefi-settings.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/devices/surface/manage-surface-uefi-settings.md b/devices/surface/manage-surface-uefi-settings.md index e18dfc07a7..20a0aa3322 100644 --- a/devices/surface/manage-surface-uefi-settings.md +++ b/devices/surface/manage-surface-uefi-settings.md @@ -19,7 +19,7 @@ You can enter the Surface UEFI settings on your Surface device by pressing the * ##PC information -On the **PC Information** page, detailed information about your Surface device is provided: +On the **PC information** page, detailed information about your Surface device is provided: - **Model** – Your Surface device’s model will be displayed here, such as Surface Book or Surface Pro 4. The exact configuration of your device is not shown, (such as processor, disk size, or memory size). - **UUID** – This Universally Unique Identification number is specific to your device and is used to identify the device during deployment or management. @@ -27,7 +27,7 @@ On the **PC Information** page, detailed information about your Surface device i - **Serial Number** – This number is used to identify this specific Surface device for asset tagging and support scenarios. - **Asset Tag** – The asset tag is assigned to the Surface device with the [Asset Tag Tool](https://www.microsoft.com/en-us/download/details.aspx?id=44076). -You will also find detailed information about the firmware of your Surface device. Surface devices have several internal components that each run different versions of firmware. The firmware version of each of the following devices is displayed on the **PC Information** page (as shown in Figure 1): +You will also find detailed information about the firmware of your Surface device. Surface devices have several internal components that each run different versions of firmware. The firmware version of each of the following devices is displayed on the **PC information** page (as shown in Figure 1): - System UEFI @@ -93,7 +93,7 @@ On the **Devices** page you can enable or disable specific devices and component - Onboard Audio (Speakers and Microphone) -Each device is listed with a slider that you can set into the **On** (enabled) or **Off** (disabled) position, as shown in Figure 5. +Each device is listed with a slider button that you can move to **On** (enabled) or **Off** (disabled) position, as shown in Figure 5. *Figure 5. Enable and disable specific devices* @@ -123,9 +123,9 @@ You can also turn on and off IPv6 support for PXE with the **Enable IPv6 for PXE ##About -The **About** page displays regulatory information, such as compliance with FCC Rules, as shown in Figure 7. +The **About** page displays regulatory information, such as compliance with FCC rules, as shown in Figure 7. -*Figure 7. Regulatory information is displayed on the **About** page* +*Figure 7. Regulatory information is displayed on the About page* ![figure 7](images/manage-surface-uefi-fig7.png) @@ -133,6 +133,6 @@ The **About** page displays regulatory information, such as compliance with FCC Use the **Restart Now** button on the **Exit** page to exit UEFI settings, as shown in Figure 8. -*Figure 8. Click **Restart Now** to exit Surface UEFI and restart the device* +*Figure 8. Click Restart Now to exit Surface UEFI and restart the device* ![figure 8](images/manage-surface-uefi-fig8.png) From e624b40a6661ca242756b2ee0b242dd8ebb37c41 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 20 May 2016 08:09:47 -0700 Subject: [PATCH 355/439] Tyler feedback --- .../windows/set-up-school-pcs-technical.md | 143 ++++++++++-------- 1 file changed, 78 insertions(+), 65 deletions(-) diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index 93a7b7c1fb..7dff059b00 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -16,7 +16,7 @@ author: jdeckerMS > [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] -The **Set up School PCs** app helps you set up new computers running Windows 10, version 1607. +The **Set up School PCs** app helps you set up new Windows 10 PCs that work great in your school by configuring shared PC mode, available in Windows 10, version 1607. **Set up School PCs** also configures school-specific settings and policies, described in this topic. If your school uses Azure Active Directory (Azure AD) or Office 365, the **Set up School PCs** app will create a setup file that connects the computer to your subscription. You can also use the app to set up school PCs that anyone can use, with or without Internet connectivity. @@ -56,6 +56,7 @@ The PC is also configured to not interrupt the user during normal daytime hours ## Guidance for accounts on shared PCs * We recommend no local admin accounts on the PC to improve the reliability and security of the PC. +* When a PC is set up in shared PC mode, accounts will be cached automatically until disk space is low. Then, accounts will be deleted to reclaim disk space. This account managment happens automatically. Both Azure AD and Active Directory domain accounts are managed in this way. Any accounts created through **Start without an account** will also be deleted automatically at sign out. * On a Windows PC joined to Azure Active Directory: * By default, the account that joined the PC to Azure AD will have an admin account on that PC. Global administrators for the Azure AD domain will also have admin accounts on the PC. * With Azure AD Premium, you can specify which accounts have admin accounts on a PC using the **Additional administrators on Azure AD Joined devices** setting on the Azure portal. @@ -83,8 +84,14 @@ The PC is also configured to not interrupt the user during normal daytime hours The **Set up School PCs** app produces a specialized provisioning package that makes use of the `SharedPC` configuration service provider (CSP). +### Education customizations + +- Saving content locally to the PC is disabled. This prevents data loss by forcing students to save tothe cloud. +- A custom Start layout and sign in background image are set. + ### Uninstalled apps + - 3D Builder (Microsoft.3DBuilder_8wekyb3d8bbwe) - Weather (Microsoft.BingWeather_8wekyb3d8bbwe) - Get Started (Microsoft.Getstarted_8wekyb3d8bbwe) @@ -102,129 +109,135 @@ The **Set up School PCs** app produces a specialized provisioning package that m > **Important**: It is not recommended to set additional policies on PCs configured with the **Set up School PCs** app. The shared PC mode has been optimized to be fast and reliable over time with minimal to no manual maintenance required - + - + - + - + + - + - + - + - + - + - + - + - + - - - + - + - + - + - + - - - + + - + - + - - + - + + + + + + - + - + - + + + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + + +

      Policy name

      Value

      When set

      Policy name

      Value

      Admin Templates > Control Panel > Personalization

      Admin Templates > Control Panel > Personalization

      Prevent enabling lock screen slide show

      Enabled

      Always

      Prevent enabling lock screen slide show

      Enabled

      Do not display the lock screen

      Enabled

      Only on Windows 10 Pro for EDU, Enterprise, Enterprise for EDU

      Always

      Prevent changing lock screen and logon image

      Enabled

      Prevent changing lock screen and logon image

      Enabled

      Always

      Admin Templates > System > Power Management > Button Settings

      Admin Templates > System > Power Management > Button Settings

      Select the Power button action (plugged in)

      Sleep

      Select the Power button action (plugged in)

      Sleep

      SetPowerPolicies=True

      Select the Power button action (on battery)

      Sleep

      Select the Power button action (on battery)

      Sleep

      SetPowerPolicies=True

      Select the Sleep button action (plugged in)

      Sleep

      Select the Sleep button action (plugged in)

      Sleep

      SetPowerPolicies=True

      Select the lid switch action (plugged in)

      Sleep

      Select the lid switch action (plugged in)

      Sleep

      SetPowerPolicies=True

      Select the lid switch action (on battery)

      Sleep

      Select the lid switch action (on battery)

      Sleep

      SetPowerPolicies=True

      Admin Templates > System > Power Management > Sleep Settings

      Admin Templates > System > Power Management > Sleep Settings

      Require a password when a computer wakes (plugged in)

      Enabled

      Require a password when a computer wakes (plugged in)

      Enabled

      SignInOnResume = True

      Require a password when a computer wakes (on battery)

      Enabled

      SignInOnResume = True

      Require a password when a computer wakes (on battery)

      Enabled

      Specify the system sleep timeout (plugged in)

      SleepTimeout

      SetPowerPolicies=True

      Specify the system sleep timeout (plugged in)

      SleepTimeout

      Specify the system sleep timeout (on battery)

      SleepTimeout

      SetPowerPolicies=True

      Specify the system sleep timeout (on battery)

      SleepTimeout

      Turn off hybrid sleep (plugged in)

      Enabled

      SetPowerPolicies=True

      Turn off hybrid sleep (plugged in)

      Enabled

      Turn off hybrid sleep (on battery)

      Enabled

      SetPowerPolicies=True

      Turn off hybrid sleep (on battery)

      Enabled

      Specify the unattended sleep timeout (plugged in)

      SleepTimeout

      SetPowerPolicies=True

      Specify the unattended sleep timeout (on battery)

      SleepTimeout

      SetPowerPolicies=True

      Allow standby states (S1-S3) when sleeping (plugged in)

      Enabled

      SetPowerPolicies=True

      Specify the unattended sleep timeout (plugged in)

      SleepTimeout

      Specify the unattended sleep timeout (on battery)

      SleepTimeout

      SetPowerPolicies=True

      Allow standby states (S1-S3) when sleeping (on battery)

      Enabled

      SetPowerPolicies=True

      Allow standby states (S1-S3) when sleeping (plugged in)

      Enabled

      Specify the system hibernate timeout (plugged in)

      Enabled, 0

      SetPowerPolicies=True

      Allow standby states (S1-S3) when sleeping (on battery)

      Enabled

      Specify the system hibernate timeout (on battery)

      Enabled, 0

      SetPowerPolicies=True

      Admin Templates > System > Power Management > Video and Display Settings

      Turn off the display (plugged in)

      SleepTimeout

      SetPowerPolicies=True

      Turn off the display (on battery

      SleepTimeout

      SetPowerPolicies=True

      Specify the system hibernate timeout (plugged in)

      Enabled, 0

      Admin Templates > System > Logon

      Specify the system hibernate timeout (on battery)

      Enabled, 0

      Admin Templates > System > Power Management > Video and Display Settings

      Turn off the display (plugged in)

      SleepTimeout

      Turn off the display (on battery

      SleepTimeout

      Show first sign-in animation

      Disabled

      Always

      Admin Templates > System > Logon

      Hide entry points for Fast User Switching

      Enabled

      Always

      Turn on convenience PIN sign-in

      Disabled

      Always

      Show first sign-in animation

      Disabled

      Turn off picture password sign-in

      Enabled

      Always

      Hide entry points for Fast User Switching

      Enabled

      Turn on convenience PIN sign-in

      Disabled

      Turn off app notification on the lock screen

      Enabled

      Always

      Turn off picture password sign-in

      Enabled

      Allow users to select when a password is required when resuming from connected standby

      Disabled

      SignInOnResume = True

      Turn off app notification on the lock screen

      Enabled

      Block user from showing account details on sign-in

      Enabled

      Always

      Allow users to select when a password is required when resuming from connected standby

      Disabled

      Admin Templates > System > User Profiles

      Block user from showing account details on sign-in

      Enabled

      Turn off the advertising ID

      Enabled

      SetEduPolicies = True

      Admin Templates > System > User Profiles

      Admin Templates > Windows Components

      Turn off the advertising ID

      Enabled

      Do not show Windows Tips

      Enabled

      SetEduPolicies = True

      Admin Templates > Windows Components

      Turn off Microsoft consumer experiences

      Enabled

      SetEduPolicies = True

      Do not show Windows Tips

      Enabled

      Microsoft Passport for Work

      Disabled

      Always

      Turn off Microsoft consumer experiences

      Enabled

      Prevent the usage of OneDrive for file storage

      Enabled

      Always

      Microsoft Passport for Work

      Disabled

      Admin Templates > Windows Components > Biometrics

      Prevent the usage of OneDrive for file storage

      Enabled

      Allow the use of biometrics

      Disabled

      Always

      Admin Templates > Windows Components > Biometrics

      Allow users to log on using biometrics

      Disabled

      Always

      Allow the use of biometrics

      Disabled

      Allow domain users to log on using biometrics

      Disabled

      Always

      Allow users to log on using biometrics

      Disabled

      Admin Templates > Windows Components > Data Collection and Preview Builds

      Allow domain users to log on using biometrics

      Disabled

      Toggle user control over Insider builds

      Disabled

      Always

      Admin Templates > Windows Components > Data Collection and Preview Builds

      Disable pre-release features or settings

      Disabled

      Always

      Toggle user control over Insider builds

      Disabled

      Do not show feedback notifications

      Enabled

      Always

      Disable pre-release features or settings

      Disabled

      Admin Templates > Windows Components > File Explorer

      Do not show feedback notifications

      Enabled

      Show lock in the user tile menu

      Disabled

      Always

      Admin Templates > Windows Components > File Explorer

      Admin Templates > Windows Components > Maintenance Scheduler

      Show lock in the user tile menu

      Disabled

      Automatic Maintenance Activation Boundary

      MaintenanceStartTime

      Always

      Admin Templates > Windows Components > Maintenance Scheduler

      Automatic Maintenance Random Delay

      Enabled, 2 hours

      Always

      Automatic Maintenance Activation Boundary

      MaintenanceStartTime

      Automatic Maintenance WakeUp Policy

      Enabled

      Always

      Automatic Maintenance Random Delay

      Enabled, 2 hours

      Admin Templates > Windows Components > Microsoft Edge

      Automatic Maintenance WakeUp Policy

      Enabled

      Open a new tab with an empty tab

      Disabled

      SetEduPolicies = True

      Admin Templates > Windows Components > Microsoft Edge

      Configure corporate home pages

      Enabled, about:blank

      SetEduPolicies = True

      Open a new tab with an empty tab

      Disabled

      Admin Templates > Windows Components > Search

      Configure corporate home pages

      Enabled, about:blank

      Allow Cortana

      Disabled

      SetEduPolicies = True

      Admin Templates > Windows Components > Search

      Windows Settings > Security Settings > Local Policies > Security Options

      Allow Cortana

      Disabled

      Interactive logon: Do not display last user name

      - Enabled

      - Disabled when account model is only guest

      Always

      Windows Settings > Security Settings > Local Policies > Security Options

      Interactive logon: Sign-in last interactive user automatically after a system-initiated restart

      Disabled

      Always

      Interactive logon: Do not display last user name

      - Enabled

      - Disabled when account model is only guest

      Shutdown: Allow system to be shut down without having to log on

      Disabled

      Always

      Interactive logon: Sign-in last interactive user automatically after a system-initiated restart

      Disabled

      User Account Control: Behavior of the elevation prompt for standard users

      Auto deny

      Always

      Shutdown: Allow system to be shut down without having to log on

      Disabled

      User Account Control: Behavior of the elevation prompt for standard users

      Auto deny


      From b9ef920801fdd551d63d7eac3a62e64f2a7bd1fc Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 20 May 2016 08:18:45 -0700 Subject: [PATCH 356/439] another Tyler change --- education/windows/set-up-school-pcs-technical.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index 7dff059b00..392c652544 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -60,7 +60,7 @@ The PC is also configured to not interrupt the user during normal daytime hours * On a Windows PC joined to Azure Active Directory: * By default, the account that joined the PC to Azure AD will have an admin account on that PC. Global administrators for the Azure AD domain will also have admin accounts on the PC. * With Azure AD Premium, you can specify which accounts have admin accounts on a PC using the **Additional administrators on Azure AD Joined devices** setting on the Azure portal. -* If shared PC mode with the account manager turned on is set up on a PC that is already in use, existing local accounts will not be deleted. However, all local accounts created after shared PC mode is set up will automatically be deleted at sign-out, including admin accounts. +* Local accounts that already exist on a PC won’t be deleted when turning on shared PC mode. However, any new local accounts created by the **Start without an account** selection on the sign-in screen (if enabled) will automatically be deleted at sign-out. * Ensure the PC is joined to a domain that enables accounts to be signed on as admin, or * Create admin accounts before setting up shared PC mode, or * Create exempt accounts before signing out. From 49f3965048dc388f1c25709b6bbb41124871f076 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 20 May 2016 08:36:44 -0700 Subject: [PATCH 357/439] fix table --- education/windows/set-up-school-pcs-technical.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index 392c652544..6a402c66b7 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -146,7 +146,7 @@ The **Set up School PCs** app produces a specialized provisioning package that m

      Turn off hybrid sleep (on battery)

      Enabled

      Specify the unattended sleep timeout (plugged in)

      SleepTimeout

      -

      Specify the unattended sleep timeout (on battery)

      SleepTimeout

      SetPowerPolicies=True

      +

      Specify the unattended sleep timeout (on battery)

      SleepTimeout

      Allow standby states (S1-S3) when sleeping (plugged in)

      Enabled

      @@ -231,7 +231,7 @@ The **Set up School PCs** app produces a specialized provisioning package that m

      Windows Settings > Security Settings > Local Policies > Security Options

      -

      Interactive logon: Do not display last user name

      - Enabled

      - Disabled when account model is only guest

      +

      Interactive logon: Do not display last user name

      - Enabled

      Interactive logon: Sign-in last interactive user automatically after a system-initiated restart

      Disabled

      From 548b5e37598bfa2c298af414499113817d6e5fb3 Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Fri, 20 May 2016 08:45:49 -0700 Subject: [PATCH 358/439] fix wording --- devices/surface/manage-surface-uefi-settings.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface/manage-surface-uefi-settings.md b/devices/surface/manage-surface-uefi-settings.md index 20a0aa3322..44428903c1 100644 --- a/devices/surface/manage-surface-uefi-settings.md +++ b/devices/surface/manage-surface-uefi-settings.md @@ -13,7 +13,7 @@ author: miladCA Current and future generations of Surface devices, including Surface Pro 4 and Surface Book, use a unique UEFI firmware engineered by Microsoft specifically for these devices. This firmware allows for significantly greater control of the device’s operation over firmware versions in earlier generation Surface devices, including the support for touch, mouse, and keyboard operation. By using the Surface UEFI settings you can easily enable or disable internal devices or components, configure security to protect UEFI settings from being changed, and adjust the Surface device boot settings. ->**Note:**  Surface Pro 3, Surface 3, Surface Pro 2, Surface 2, Surface Pro, and Surface devices do not use the Surface UEFI and instead use firmware provided by third-party manufacturers, such as AMI. +>**Note:**  Surface Pro 3, Surface 3, Surface Pro 2, Surface 2, Surface Pro, and Surface do not use the Surface UEFI and instead use firmware provided by third-party manufacturers, such as AMI. You can enter the Surface UEFI settings on your Surface device by pressing the **Volume Up** button and the **Power** button simultaneously. Hold the **Volume Up** button until the Surface logo is displayed, which indicates that the device has begun to boot. From 0cc22ca5c21a8781f711729bea6878b3fef498ad Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Fri, 20 May 2016 09:04:28 -0700 Subject: [PATCH 359/439] removing offline maps UI step --- ...-devices-to-stop-data-flow-to-microsoft.md | 27 +++++-------------- 1 file changed, 7 insertions(+), 20 deletions(-) diff --git a/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md b/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md index bfc720cc35..8e22953d44 100644 --- a/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md +++ b/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md @@ -285,8 +285,7 @@ When you enable the **Don't search the web or display web results in Search** Gr - For **Remote port**, choose **All ports**. -**Note** -If your organization tests network traffic, you should not use Fiddler to test Windows Firewall settings. You should use a network traffic analyzer, such as WireShark or Message Analyzer. +> **Note:** If your organization tests network traffic, you should not use Fiddler to test Windows Firewall settings. You should use a network traffic analyzer, such as WireShark or Message Analyzer. ### 1.2 Cortana MDM policies @@ -321,8 +320,7 @@ Starting with Windows 10, fonts that are included in Windows but that are not st To turn off font streaming, create a REG\_DWORD registry setting called **DisableFontProviders** in **HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\FontCache\\Parameters**, with a value of 1. -**Note** -This may change in future versions of Windows. +> **Note:** This may change in future versions of Windows. ### 5. Insider Preview builds @@ -408,8 +406,7 @@ Use either Group Policy or MDM policies to manage settings for Microsoft Edge. F Find the Microsoft Edge Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Edge**. -**Note** -The Microsoft Edge Group Policy names were changed in Windows 10, version 1511. The table below reflects those changes. +> **Note:** The Microsoft Edge Group Policy names were changed in Windows 10, version 1511. The table below reflects those changes. | Policy | Description | |------------------------------------------------------|-----------------------------------------------------------------------------------------------------| @@ -453,10 +450,6 @@ You can turn off NCSI through Group Policy: You can turn off the ability to download and update offline maps. -- In the UI: **Settings** > **System** > **Offline maps** > **Automatically update maps** - - -or- - - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Maps** > **Turn off Automatic Download and Update of Map Data** ### 12. OneDrive @@ -617,10 +610,7 @@ Use Settings > Privacy to configure some settings that may be important to yo To turn off **Let apps use my advertising ID for experiences across apps (turning this off will reset your ID)**: -**Note** -When you turn this feature off in the UI, it turns off the advertising ID, not just resets it. - - +> **Note:** When you turn this feature off in the UI, it turns off the advertising ID, not just resets it. - Turn off the feature in the UI. @@ -660,8 +650,7 @@ To turn off **Turn on SmartScreen Filter to check web content (URLs) that Window To turn off **Send Microsoft info about how I write to help us improve typing and writing in the future**: -**Note** -If the telemetry level is set to either **Basic** or **Security**, this is turned off automatically. +> **Note: ** If the telemetry level is set to either **Basic** or **Security**, this is turned off automatically. @@ -793,8 +782,7 @@ To turn off **Choose apps that can use your microphone**: In the **Speech, Inking, & Typing** area, you can let Windows and Cortana better understand your employee's voice and written input by sampling their voice and writing, and by comparing verbal and written input to contact names and calendar entrees. -**Note** -For more info on how to disable Cortana in your enterprise, see [Cortana](#bkmk-cortana) in this article. +> **Note:** For more info on how to disable Cortana in your enterprise, see [Cortana](#bkmk-cortana) in this article. @@ -987,8 +975,7 @@ To change the level of diagnostic and usage data sent when you **Send your devic - To change from **Enhanced**, use the drop-down list in the UI. The other levels are **Basic** and **Full**. - **Note** - You can't use the UI to change the telemetry level to **Security**. + > **Note:** You can't use the UI to change the telemetry level to **Security**. From 4507a7a8d43566f66115545f99e108f8c1d95fe4 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Fri, 20 May 2016 09:11:40 -0700 Subject: [PATCH 360/439] Bug# 7594483 --- ...igure-windows-10-devices-to-stop-data-flow-to-microsoft.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md b/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md index 8e22953d44..7b24cfdfbe 100644 --- a/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md +++ b/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md @@ -1094,6 +1094,10 @@ You can opt of the Microsoft Antimalware Protection Service. -or- - Use the registry to set the REG\_DWORD value **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Spynet\\SpyNetReporting** to 0 (zero). + + -and- + + From an elevated Windows PowerShell prompt, run **set-mppreference -Mapsreporting 0** You can stop sending file samples back to Microsoft. From 118c5e1d076285a97b4e0933f609bcc42e0059c8 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 20 May 2016 09:41:20 -0700 Subject: [PATCH 361/439] resync --- education/windows/images/setup-app-1.PNG | Bin 0 -> 21118 bytes .../windows/use-set-up-school-pcs-app.md | 22 ++++++++++++++---- 2 files changed, 18 insertions(+), 4 deletions(-) create mode 100644 education/windows/images/setup-app-1.PNG diff --git a/education/windows/images/setup-app-1.PNG b/education/windows/images/setup-app-1.PNG new file mode 100644 index 0000000000000000000000000000000000000000..1b88c5ac312624a64e75809c5a14adf734130c7a GIT binary patch literal 21118 zcmd?RS5#A9`2HDDM1u%Q`wG%TQ9wYYDF~sc2uLrX2T)odfYKC5A|OQ(P!y2fTOjlV z2tpJQ6hvwWBs2@1&)ynTxrYH8*p?f@GZ}C+F<_?)Q0~&*r76u^ty# z2n+&&xb*MeF$aOzctD^d87Gbd&p3Sv#Q?vK1eojTfU16;UjQB)^UyZZ27zjmI1gOd zfyXEP@7o4|K&LzY{TxY=JuM6Zne*!3(YAc*M4MoLZsj)FwayB>p{siKEZ#MwGX9lZ za1}1DYMWB)y+goPMZb(VDHZ(uRUX@``&Y7cjd!wk_A~%DHSx=ryD$|MTp*BhP;zo|WnSK=vz-aTf<8Esb?s;1oGNyhJ5%F?W@Rov%l2yrIvYH8UAg zEd1Aa!LFFAA(PMM?h=Z=z>juFmu9&dre3XWZ`a9G^f2}*v*kHEWEaLYtS%=TLc7q`YYPn+FC%^ zn`U5WSg+W3dq|#mutB&HJWy~qc(J^clAt;{U%g&aVl6Cg+2mXMRUml$ao5;s_2p^K z#aPkMZ%)WszX!1lu^c`g@uLSfxCixTKR6?8cyNscZF|1_4knh zX+1PIH~-y(+to8O8&H$|c1c3wvqGsRwudlWX{*>WlWMQQ)0@8{?LhrE zTlZ!&+YZcKgfzG8a3mKjBc>>5X(SlX*4|;n-ow?G&_$i`G`oEF@s|0R$Z# zU*D%mZT$Qo{l-^;t2U;pFp^#1%J`Vdia*zSpb6hTMI1!{gLl36 z>N@gbg9!Kv_|lVpZH~Q?b2w!$!WqeXyWC63hVttob|XQgGoa}ty%}gvsvPv`{PX5~ zI~q=(y|G(2h`nETrl|X4knK|bUd7&FNv3bzL@>2?r+I#gi2lp-R>}F(^Cb!%Asp76 zrDk5{ZykHbDyWS3JVVwpyRhUa|E?N_wKtc`Wc)I=?tKAg3m$V5B)S@?z<>82SQ@^` z%v|cS;En$IqW>cW=RG%+gE1>H%5*nOlgG(5jt>g%+o`hi%bEOnEu`GtXDD1P^d>uG zax9iNp`z_H#>_O~rDpg*1DHq7u3@d(%D%v>#5j8~t=Mhp%TT)1Tvk9LnhW%aP!j3D zQHx23ZW1yWmyNULxt~}`76?05abgf;{Zosl#bpeGKvhQ{r%ZV3IP#tCe0`3$Y}yH0 z)v}^S^&>KU$c`ZiTt`5l0-k)k*r%8j=u;a(qsy2vQ=`_?_$73DZXmbTD@5^*KeU zQTI%Qt3m|-1oO*-mXPrWvRC9Alk31eKMZQCnr(vzR2-K(L}{)Mu^Ni;1~ls3Xna}2 z;HwJERmtn$Z&)Pz47uClkri3Mn$}mhVIYjF>7V6GvwQ58z#d_13{S@OJ-|&+RqJ0D z6^(uXJ?|f_eRz_`bM$gR>gbWx*R`+O&DC8he&Y3FXGgBf_Lc~yjP=7dmcQr+$X!yO zNX@EkbSu5sRkBa(uBf2(E^s0Yw9B{Q8Ez8+H?FEGf9)P$dnW(!pr&#ZgE^}HF+f(( z`G%_n)9>EQ43(iMNWEut!{?oQ`p6B9-m_P0_KIgzyll(uebcuWM#u4f*}|D@An{`- zl;*R~ane3Cw$&pj%8e2n2!z~_`NP$#JMU!sS?dEy^s&fdmBmp*}2}n5~5>I8e? zrICw@^q;S!uFBOlddSydGgWJuYPdKqcF+~AehxO-4_21GU2UvZk;#hIg!x9@s9)MD zhzvI|vF5_sPKWil+%Xto82z5LeWt)yBQl!!5f`&@(o%d0v9l4 z82sb-SK;VaKaB<->O!&J#xdKz10DAiel)&P8|}B#c%n#KmQ$_Mllp-lobvDND7(8i0^E8zzh}hbB>CGKk8>s# z+JDS{JOB=UdGaLQBC~`Zpk2<-j8W8)YF^;GjZgG`GLSA>ZJg~Fl91`**K2d@1Y$&q zD&r0JaW}i`a{}}n6rt8*DGs%y`if+B#SELHBRKUQ+^DFmyJ#54<>{KyY9G;1urk{Q-a;7v<8)`UN0~}%J zTFY25MB0#@zQxJ@xXTo`b1R{2wVOA}FQm?-3Y#3!JyM_)+#91K zcrm8e&ZnAWpCejr)LUOI$Y*17%lx;FX>Bh-;GmSsB*@4yx>=uvSF#Y=kRLLvRsEBraHV69Stm4U(B!~ZntA=TW=m@O1FvI3@X=_3cy8uJ0a~f8rz^ui22KKUCBQZ9bSPGW!c&c_aUD z;hUx^ky8>}`}?H1tF@nrKN>Yf z>}?vGo=euh>Op#%#hQV%ItzxgoRTs|iKR?up%^s*IM9ig%nDi=6UH#Gc)96N}m)+L$V<2G};5_;p z131;adW=U_TWjg-%rT`6ONxeg@lC?_6_FQ%wTgf)jSu33WoGy z8ER8%ZtlDBx0x!y>|Q!=Z)fIK{h&9VE8Z(F=}U$DgYr(-5W&28wj-dPOI-h5nSTteij}f;f*!@PQlU77|TlP-Pl|;#Gy5O zf1Yx2;-13Qn%emItLnGD`@sy%3s$qr6_tUdisIaO8{tRv#a7-uNS6lnf9uVKJ+a)7L&Po=NIbj5-!}5l%(fX4 zbwOET0ORo1$=vE;x%{>H-zMq}PGKQ`EjK&t6$QqYlW!Q-9z)|}eM_wDL~K&Rsy&Pe zw2A!Y;)9ryv!Ky8j}_$(WR!*HCwU1Qe_Wyc_@4%ia+w}`Vdj;xoCZCJ$6m$!me$SU zZ+(o+lPi(d8O4{dnUS}N1%m?bn`W#m_uOA)H9Yc8$$=Y9z(Ak6|94Nd(s>dDLh=5; z)LL1~o?xpeFMrvJu`)Gv9x63~dEG>zH)ne{ldhy*wRO!!?R))QDCq9%Yb>`Y?Q~+^ znrHm$)QKxgnTN>eB<0UUy-Gh|x%TXSFC9E&q&nsjE8-q|{z+W6fBQ*#r?B7djwWMS zv1Ps>zOt-ism$~~VsWt?$BIrK2#$DyrKyrc&PIC^$4-qr)cvt-q-qf-p_UoNdJa z_;CFT>Tqvvv?8XJNvEb}WWZUwU65r!n>E~x7Z}4+eZ4sauEr&pEtM4}*2OEdjS>PE zTrcN_*KvzHd-kktv z@ZDvT#Mb((#23Wf-<+&NG7OFQ`t>W&hz-3Z&E=w3DqM(wFixR7{_^bOKO4vW#|NN+ z_$P(9AqV}FVXGP}-F@%j!>Y$tDViQXvqt-4kSykowXN+!(qBs?Hpr*!`#n-OrR~?3 zSjM97fQr`#&&-BHJ38?4>DcJbBr)RPnc~^Pc4%Nn6|)4X=-LsN0vE89EMgY##o$Cv zo;-Qzci(DENFmGPzTU9RBhriOF73yNVqbz$a!^32Rt1q!r^`*AC*~-xbiCwc29H40 z$n<|Fjhaw`(bVN&OQ~<){^}YC#^_h(qXdOYgw7zXy$2N}$MrDlJhY)C$l++UcN5EP zd9+q`+pT}DfEHJZEOA3`e7}rhDe+YT+ENfywb3g^2wYyrPd6~3a zE}%1|+v{PaRQ=Q=>v2pgW2NP=xh*7$gPTrG%g(07evM~|dbVueD!(UnkjUn(8_6&` z4ft1?qlQYs`@aBV2Ucm{=vylxJH$<-jO|do6<9|rXJ7v_3|w54n`ZNaZLN~xQB8rC zqK6;i!TlB{8YCzY-n?JC(w`p%(cwh%ao?NKVNF3!OH@cP^I&@KTjLKP?Fi%X;X#4bc^lL>U!i=!stFQtt;X) zfB){bU)$=}<=%US_ZljZKVL3x5m6Exz@MXL;4{_MifG%L4W{A9`%J#Yfx=jkz<%xE zK8>AS@_s&9(@LV0ZML0LVM{_vPOeu*Mkf6E)0q@#rCU!b>L8d#*+a?LmC&OS&G`?N zaz>089|7kinBrBsxBlBp%ySfQ2$+XZUJ{zcfO(TJDXXP*+=?KEH0YQx37@Z(23+ zpF-}iS2=S!XrFaJ?af3mBIv6vY*$B73|f@EZ}TPpXuoOHqoX^LLg>z{#249o?8 zDCjsa0sW`JQ=jeZTH0LWmT{46_%4`7F13%O#U^Z60# zzqhEE1sw4wgmv(VU*-_`_?NhUbUsW^@aMrbqgAjK>!UZhDnd4#sX{JAif3p#cno+n zunrj<^3J<`MoTmu{b{fW%Wg;{XxQwtRHo0_gRLQx!}e&WR=h+cd z{C3~=#2M^nml%3EH`d|WiNxC*_gUlYLPXTcl_>~06fk*vP^10%y3CuQCR1jDYX{y5 zb8K4vo4u+G@_r&b9NN#Afwww*SZ7$~Mv3mf{%7j29Hy`_P1EOYGq;9nq1w~!k-2_N zhx><+jc<~Ndl=6>`4{Z+e;Le$$bRq?bQ+z%ti^kLasEoE(Z2Hhl|Wz#*wVvexJ+pg ziCcjkmoS>vR@>}?4%11mN#}m>uN>aD5K*%Fij|ZW!Q}*v*dBU5(92X?93E)GR6A-r zi>L>0>7j*SdcV{%PS35P#+eL^yEUmY@kWqRWky`ge3_|U^NJo->`XA=>_J&ouR6_g zxqG41GD&kpVWR0>+7GpY;WH(0p?e8JZp{7dO}+4fLh>8Dk+KYYC^+IfcMGu8(tfJ1 zZYguZ4c?UIgm#N9cxNiXL>@2BTMv0d7U#$KDQ&a&EG_blgYCL%O7xa6$kGgP(n?b# z=5wD?gk_^wud?UU7iludU~|%8>R=@lm$W%;nEG7 z8A)XZsQO-&O}&i_>JI8Ry*F*EfjNBcA#xQt)f$VDG&I7=0VM& zjk{AK1E?~h!tdB}6&)s5yPX2I5#C@Ke^$k!EcG5Pz|I6|LJBVuI*;UNxQ$JMXEvZ4 z9I$DcA*3f|F>AX{ZQ7-eTn!m@;RpjPrYibuSx!uaVc!!{=IoUr(S-$w)P0{>4DpeoN2NY0e)*4Q=obw#lY?EAZ1t? zh?~LLVIgsjK21iAdX;7$Y`(#N7fIiL6Vj_p?ue<%7*TY9Mk~nGqa+I3ZE_8p9F%9~ zw->K`hyxG5$sw~QUl=JB$OK1UpnU)Z<$X+AL&pXDNS)tkv@(Ed#NzV!H&CNB|EN1jv>4Nv{qXV^muxrn-zp)!7NV9B3V z`Kql8enJzK z{Xysbfh~F3>aG1c=pdtu$fVGDr(%y6QgC35J^cURaM2J zu8_`|B3ic>${df}VG0e4R!TaGFjNf@WU@y-}wPY)~ zm++ldJkv$8*WZNq?63_Z?A0b+iO~oq@`-2rb=M% z70}{0Yb5U?r}v9TM&M7otM@*};HA$)(IFE-P_bj}eOAiqi#r4L9wrcDq|Br3=B2H> z?05KA@^=fFR%TeO`@du>@5Yz*shv6o=3woUi3fB1RfX_6OZ%e74X_50bt()En-2>A zQ5v{xZ(hOm4Q-9W+mb*Vyxj1EWANL6SXVGMch-MLlt~n#b0b2`GKz>^R{!1!n z6<+z3^xN7VF{6HV1Tv(}9%}?MO7--W;$S@q{laP78DA=}5V!b6V`Da@qtG%xb3(_}WR!1rl!_}Tx z{mRqP#%Zc;oK`>I4J)yo%ltXF`f7HzPc!W&oG}ijqCT|G0`?+ z1joza*N$j0^78v2Ig@0<3nPBwJ@$OH_lser?TR^0s(iQGUH04N>#aZ*vBm=%OC0%Y z3|}AyoOEWd%2vG-Y!PSx}_ztYB-CBt^@sCA=bF7W6u6O z(flq6C_kji3~MVaW`lIbb#xNTW~sL(Ga57!-TuN@!ipA)n!lqLN;q2rHdf{>gTt2c z3e6l5CRT@PEjl!MMq^b6`Avx5SepUo%w9gw!GL~1vKtGpQFoq}Pz_yF%$ADI2)C)8)!6KLl zvm?URE#AmQu?YBwjMzKWN@kJfsfvQarQJwt_R7>^Ne5+Y8Fw_j0xYU5IbToSC0aYn zoGjlI_zY!o9lLyOzBexEr&qT>SN_VE&?&<2_s2=)MGL;5}+N@Z!~sw8Zx9hh_Kx zk(2Pf0x^I7n*B4@n-QH>9G$z{C%sSvgWSX-W$x??rCJ4vaJ$%jzN=dgtMNNEojR5_ z71Pk?W|??n{^2&D>F@|g#DhzBId{t_HWK>L5nvr`3s91E5smb;)M7LmY)>h9qw@i5 z!JjO%+`yy=t{W-IRPt^8PIBKK^MqAEfN!pOlomn?f5A}B=_JpM;=G|OyZi^VeYLww zBq(fKZ*u>Xvhn>PPt=<`NPFsmD1(Vn9-z?*nLNCM3EqKnb%aib) znf&57mU4D`0v?*%!dBK^2d^ET($j|aJ}g*G$S~fr?NrV8JV&`lI_^2OfMZM2Bm%kj zO_h-+lrD+@sSTSLnFHVCb0EDhT;MZTe!#HHH{m#jiMDtS_HKU8N;&L(EbKk0f$%4S z-gB*}z~Xz3F4w{Qoxem_fe@~Vj#3GLAE*N|?tofo&jKctYvRY1oXFU!{xY|hRaeR? zxMBjW3>+hERHwlT3+GoSLZ-H%e}=5i20@NEo-|jzvyYppdet5$ugkP&gCYqIbyXks z>>aj^b7;)@Q`DW>^x*O^Cx?Nx{r7}^|L@dibjmIpC%izgy{q*a+5M{hHdmHFn&nuf zjb{^j*EKAleNpFA_hhbvt19y2H;y<#VqYU>F@=1+y6nc2Ye#D6XT)pH^2ZU5)%rSL za&Zw+IA0?9OypL)ylUmrdb~Wxc>zo)Z0Ev>@_w#W-7~O1rYv`x?bS@4!ApsyK>C@x zRM(NDLH|Hhh@KxDu}hWzitV{Y-T{b!eZzy(qPIu=3g_jc34wvSzsc%+kOxco3(z1* zg_l!k!g)FdZW|~)x909}cJhHf&?%~J-Fk7)SPo}T_eOj%UVX&7DYG0=o!U8hy+@&f z&R!R;TsT~!fNh}e<7=0dCSVt8x)+5i5~EL&9`OxVxY*2=C{$yR!~zUuFqyY<+^EoN zsbzEXQt*x-4tI;Bd@^;VGv!sNc3#oP&TbiKPMeHGP5Z{DWL{px^jq51Tjjx_q{{b% zpm%6=+wcm@wcMVZQp!Q~xaM%XNdMgd@N&oiQquU=3?I5LDkkG-!|Sz`c*0%^_>kA+_Q2F- z$)cGBr{je6HzOvhFTh`3gM*Wcq@gVfE0S%GBsLSlfCr%kG6@&%N z&px0?v7aC4&1rxIUhZB~nJUUmwZ-h)&+3S^q<<=DwY{uxv)C|gzl~F7 zJm{h5#IgJNIw41f6CwgPB~LQWmc?i*^ME-Cq&o1AfkHio)QMuK;a4a7j+>k}`{maZcxN~|3EJGKnAH=-21#rXW1JmEK9Ebm;|D_$(_^EdmaUKk<` ztwSV>_(J?q>*~*f-^+eTOSK+*)}qpQSlw4|J*H2mdx=yc-aTTF8S%>`UUi$?m2`T4 zKBCgiI=R=$+{-U(%Euwt&~;fM^6V=+2^+CUB!DD z${u_ayY(>vxv`V5{76vVdcH9~=|}X5iST-i+Gou8;klck=@SEuDMlYXAA0{{8`N(N zm^jE7%jOt~u>ujffxILy(zcOcEym8j`wQ_Zh_ABUgnb)O{l7UUE2;?HNrh4oYd@oY zA<}@xe%b;!tU*SL{|?_ZOHa&*R>;=y1X~bUn|~B60H5qvBGl*Yt9c?9r{0>fV^<=} zTL2Uz)=n&Fbofjgob%3+drM`JP-StM*Zg)3PIfu%Q7dZYE?~J|q460Gmb`gu1#5YG z6;gMp)&6;ubJ#Rrb! zJ=2MGGlrq^X@X*T`>Qf3oqQb$ub|$GCw+Is2wwPYpLcLhaE07=>`;yVT@}RR;%r7I z8^g<`*sZ9kkYTA>Ae*=SSo+lRq(+Zjv-tYV>$6jrb#P~Q!fQJQlh0x;hWOMU?#u>% z`gBWWHYNuBZGQNcaCbcIzu`gvh-$N6oi5SA)Z#_y%B6C zaIrxX|NMK{3I173ju-#}`QiJ`8o*)vB~;%Q#Kf8KQ868~)$4!s39Lyti%o-E;e zdnN5WNCuv_C@3tfD^Ub_1>BpXLFGu_ZR3JV4Ll{_0!LYQa--YJ}dUP7;I*_H?|?*4Yz{W!T6gmLoB zql;sbdJXktlSR+f?6$YceGlrolHeW+=cgupnNRcOdnmmd7 zGT~cm)5s1vN1%MK$rMAz8c5<{(URW;%=KZeD08qv^i{bsxWK*7?J z4E`5L@jxZ4R)4997;J{Mie^!Pbi@Oalel7~=>LUFbyvqmZv&HUYV;iJx(zdxsLbGu zj@&&wSx^{cR7g3+|1-lFcdkH)Yv64wICy|CFM%=ZmvjPI%kl5rXa6i4txQKIq=+$c9Zfg%fFA_XY<7zd~?5wtzjPj+2GOj zm+HRKS|V>+Bz1Y1{l(V%JBDT?y(}j=3&eC;F@10AtSYJ?nx9?YH>_e}uJ&Q+DesJ& z`4NvQ`|7*FKi}~8p#~^L%|VsHpQWe?rC$3)l|Elq;7i<-&7}#=FL-#Gdv&5h0|(J= zwzJAn5JZf+{;;#@sJQqEhX~;&of~vas_a&zS>e4sB9P;8mOMy58+Q4GgZ8=GjOF?W z&aR7SN}EUScL3w)W5|JA%Msofhx6*ECIIkTD9B8-|wFRw)EhmL)pnT)?paL zVM!x=*PnG;>FL_E^L&4P5cL+YFhN?IKxV2iS|JcVT(tT4^zk+S=}*&zNtzp9gspkQ zueV;jawX(zm4&S%??*`U6~L&zhS0yeHucspl6!nfXoq+~^(VRBfccbowdzD$x+CNE z)^cM{WNDkNz>l8lwQ4a|sMj=`c1>kbHxY$?;$mv!#0Vd*{Oyd%>;jM9h&{C7316CJ z3`N#C?+;RFS@x#qPUYJD%}ukk=IBf6zkg>gnEwDZA?>dT|!Mv1@t8ENbw)% zCOp0@SINBnH~VGu=S&ExjoXwnCJB6vh#b1m?06rYPSA}Y`vob*gGD6(HRT4rD1gbI??YF!3D;PkuDFXIB zE&%qLP9rQ;1p~0*-a>qQJk1Zy$V32SIEuh)eDgDaqWY>YRn}J)6cqSoDgM0qWiouz zh_#PiUntF`v`2G3tRBf4nE@=8xK_63ki36`K1yX8t%}^=%EMq}=x~z5=l_a|ipntJ zWmQ#)TwIYqv(*_ctF1du{(z&sJNHh?2s{b6yv~2Wy+xhpY5`3CC}5hf|LIENmNLmX z|1Xo&1{6jlr+kyR|F4Tz6co7k=``W<$gP3TFHZ6vd>kAcj07yU$?AV4K8nR4vNkt| z8Nk96{3a(y^g*^7NkNw-)sXf0Pv;()%a#!6wQS2XJUo01NR|(q4?F$d%_@5K=Z#j_ z#S6&2(x}MB=jG-3X85<|hHt#gRRM5a;_>H@vrJ?2qY%$-hokn}3d%89|nDRa8GRD>v@dapI zTs1E$&khHlnIpG^_!$}*DMQ7nKxB@{^d*%4OUvm%s6oY%oxJt+^#O=`ri*kt zjK1u}A^J4$UqGi4IByC;V|##%mIm1CVe4N7u|SwNs}pzW@@3iQ)IJDnxls@I-#An#RNJ5Cthzh5KoNU-_GX3wR;P_;mIHwNUxv@XO*WjYfeka1xv z&0WMvfQ#>qKF>N2I=p{^XV=KG7tNqGQUTK!{x9;M0G5yuA{yQE?OR+zEnMc#gjtg# znz991VzrdgE5YB7kuc@GcYpIWB=Z8wv5iT$SEn@$EqBXSZ~ZCj z)LEJU8j7jE5@1R7m8L@O(=HxAtjrQ3uZ&+Qy7Jz$6-elXAr8H2!ia{qXnF7@mw@}D z*Ea!YsK$4KU<=H9U?+-mG=-P_H2VoG3-gob$nz=TBW!O0rR;Gl3%D6=c22mXn{$0T zOis&bWlI_?w>@_MOj*Ar>nKTQzPe1yiUk5%{SH#Bwh=#24l~g(c08E;ROS(IE1KKu zNP61HlY#hXxUi-785NB(+dD?5z~YqS%9-DQO%t9#7ShTsyp9uGKh7oeD9z!?OK#Df z$*^i}wRk}VI<;^{`oooFPuqgM3cU88aIDJG#g6FFlfMHQcMG4bUx4lG=JZ{ zEH_59-o1BY6DWbn$F_?cCI$p}{I=!?+UoN&ge}Eo?w7SXu@@&cknk+;;qZJ4d-PHM z;d+lgdNhIUx$*k&+h*`zX^WE4@#X;J3DeIqi#}z>@8LI2NNWMB|M%DvK_&0Mzq`yp z351&b@kX6ZtkC4d;7mW5CFqW>n{PsoRFmPZrbDstd&9N$7Ny2*kjN4Jr4qDib8~as zcU{KAf3>w`SVGYuXLb*84fnM25SBIr1YoWi{BqmsaBT|a45pt3J%@;~ z9UD=fP}d=Q_1m7;6A5}RR-&k`xj!$7_B$D5GhChke;5XoDI_AgsxVJcB2caPXK4Q> zP!q?Ks)v-nECh*g$hRE>Er}jsTgtBT&Rde0H%KIiM#&p*Q@pG9WYrckP7*#PSIw3! zDbHu{fO!cw-&Kj1$3{j~U0Mfh8ishmwfu!3u|&Y;dlFq?%?29b`gcl>Yx+Cy`n{4A zKCbCFD#jSc4wvT>28%LO11)46!?ab?%$xd|7q(6)$P~vbF0`9rBKoc5_?7G$JU`z} z137B|u}rJ^=8KGrfg&dzOKg?FG6z;`OHOoILSGXMj>&${1?cPb>{2(GMqL?E*1V!2;u_Sv;=Zr zl)o4~6%FUHtmi=w$tXKsaqi%@kc(P@N(jM1Fb*j(B^;niq{DqMF*61ny6sm6xe5@~ zgf($4BW{q5>i>iN2TNLc#zscYn}$7d%GWT`@e@2{ z77n&<)kgNty+h`eluIX=o*=DA#`P;th}`OpUha+=k2+!suK&?7w~2s@$V{O5M7JDN zzs`P+;z$zOi87tZnGZQ~!t7{-np*o)H@h6%1H)gjY@fhjS&UCwuo2cII!#O z;NJg@3BA^GBJvYtk%4ph6^ODK-`r0!Ws;q4R!*+@kMFKSGe*2T{{tzh06IBDSy>qu z?cdt2c3za#cv!Qmmk`!;S(ZzXg&J216%G4hG8fBUkwbLqA_{KwOZBJ@yRW5^mGej8L!sVdRJoP4wT*AQgRFy{ zr`x4Vnh*XqJ(Id9WuKoZr7g*paIEz41yN{02N-4e+%#WCU;lfXKR_LAY3Jv+Tm6x_ zeKkvw>J+x6y)+oWyA(3gjQ3f;0DY?3SeuJ4v`tl5 zx3{#!ZWsV9 zuY#V)!|X7GZ`5Hxyhsq89lt(nZ};R$a_ipKJKuA~_^I_$8=Sr9Ikp7$BW&wUr;ni& zVYpQ=eR%6skJrdJW_)1(;M`ES3y~nX`To6SPp0C~v+x+b@-4;SJeeP(O?QBtL4QroZ6SSqBnC85YtNi_WM+)}`91n!8m^4DaC z`E!e@X)}|3-3YkR6VkADD5$>)_=+zhwO!4VmA%I(ny787mgR3zK55K-%B39*-%`iN z37qU>ZPG4Qmdi4z_h~6(kLO^nNBur_3jXMuL=}nzcaB+Gnfa!qTnheuDb23l8d0fR zKT98c*w?gI!f?L8QrqUE`t7v(tZ8uDCJWN`Od z_+dBAW|Be+`+Hq;`A2qrhtWIt`jQ6?J0(9FlAJ<+;wKR%hJAx}A4H~hOx3+uM-jV> zFUSNvcxXv>Fe!-s8_BBmdd8lb^R~9z{}?FYcTW&vna z@%B9FYs^e{1Z8a9ssig5*=h6~uq!S5xi+t%Z0m4v!M?h33{Su58wbAvkm zIl(5-bk60{-PxGr0=5L_v9Vh#%!^@%Rn+AdlbK`sf-tvICuE9Msvu)03_*-qg}kNK z6=ymo@bk~wuWHconq4{0X(Er`;1kY5ITuHx zPm()d?{>rxZ*|FP5Nchn&Opvjqv8Gy^E zbIc@RmK)RW<7a|jbGa3?ndZNVExS^y$O&(?}(yn^SUcPe*BR#_LBbDP+^oMGTil(5`t#zl0M^Ek1y|?{!kbA>#Y69qH%*) zoJ_R^%BkYJcdc!$;ruD?=v#|V)u)@@(e^D&@bRZ9XbuLj}(o0DIFLtt?u$i&YVeFV@@G3g{G`tte3c z)5k)W7b{nkjQKxEpF5}GvGFKuuK6{GD?=!D5$AFFN!CSWkZAwKofRf%7 z9i;;?VkX95KHoPmsB3rY@!1&lL-b?^#<5uo857C57{9xl}=ZJ1I8qJ)dFUw}!#r z7sMXiP*h}=XOMjN#+sY0?aT{0T)k{<+x`^EgNy6cFREWA8@vKDqe~ACtPH0QOFZ0K z7G%Tc9z=6+85)^1Dm9*mj2pog*ka`ai|ZkLXJxu4npSYI(!YGFw|k71*j{Ejc!YZj z4^9xu)9+BL-P}|WzRFgMHMYy8>_VJu$9_v|UHm_GjvUXwUf~~2f8q8uH9d<@xGsw= z8ceQBHuoNDYgNza!>MGe+3RaZAlin0rp|&Xr&s1-Ol}$39_BGF_7hwdE|sQvY_`?1 z4lY&hr!=72)kAlz%3?p~ck>^FntbW*8E4ckxGHX;`HsUe7&zzl=rv`F`F$?bp>Iab zCvvzq-1UzdDjSYr*0smBN9{kk^2XDba6eVl4)x!i=bc3bgibYO{YLlliq(q=oi2w5 zd&64J%_Ndm8E8aTnN6+Lj2r;4l3;VyQS(5TOR68o`A3DEpr4M8iklvdceaedJBn$i@yx30{(vkS`=vGYOnqG0(ZtYj+ObwltG~H zEq>9Z1zLyU30 z6K6m*Z9o~E+--+kB9*)r_GXV4pytGixG==fuW(C*S|n@cL`7v;L-P=-b_`;Izn+Wy ztzd!GGP84Vg`wA~iZ|Kc?0p!fQpykYb>=vHDn2NOh z*FPcTO1&%~HC?IpdxyMMq!jvZVEO*d{><9pjh~<9UfiXN7b$69CL2;k)F|I}rtr}L z?qj98Fnl@0s0OZj*bGDs}(a(lT_YS!h7HkhO z?-1%CxQWv@zY!2^(V12KNl^2mFh7Frv8>NWKudtnu#^B7!pKzkY>I@?8^0bdCyep1i{&YSC(2?YVd8x{Sp>Q5W zc1e{|w^FGX9MQ}wg?JD&9c375&Fh^^9gciuz=@HSleqNtf3S z=A4q4F1i;=ti7=M`3d3SWC>zWsRax$mBK~NsjxN`xKk= z*{{dr_c*`*et-QQ=a2K}_ShfW_m6!(@AvEVe1kLH+4{unz@_xbzZ5F-}*5XKFcXBgjqQiwONvP(cJCNKIz6N zl$W-`JX(e>%}6se70HYAw_|s%`vin!szY8z0e%ObXqxOVLr_P={00W4YVh&Y!u?Wu z!4L?a@omsUPMGBty}J}0>A&EIN9XJ@xwxJT5qh#|z&wHot0-hbElc3g_$UWNh5PO}xbnA|>`D>f*qg!C z=Rb0i|LzC<{r3M{rTY6({k0y|pL7Ggj|ckuuiDvVs;H;{zfE-^=Kh*uM@Pp}Px*m= zF%o|fw?tYkJ@3^=ISw$|x=BRqpZu|6hia<5+NG7N&`wU-v4DdcEU}P*njH~r4Z3qr z*L9yB?I*}cvmbNYh6BdBwJa^~rX~DjJ{}sHIU3%Nj9Axm^%U*}17TI-%1YQ4P~nK} zPs2ma`pST-q({lo>rTX!sxkB7gl_{R^RR+&S~~0(N(p`OjQ3gU&#TDl1WcE#@{Dl8 zZk2ktgi_k7R2=_COZlO;;!Gn?_XMVKym>t2kjY*N2odbw6lCSL$0zEX6;>hfdlkWJ ziM$KIQsfEN`&oGWcCKlB+m-cLuwB&vtNI=ph5AEW#R}qJDqP`{1GUHXfo`c^t0?^< z=w_W4YfUmp)O4YA0T_^%y~{w+j-z&PCYU!pPW~PzihBTPw~xoH9)Gg&k!T+{B5`zl z9%VT6&++>^##25mn438wMA*-{7=FAs{))Lul>`oLe{r098fk1K1y~g@r&n4wX zaD1}duQ@sg4F&bRSsZ?r>f{lrakxIj&dq5HE%eG-9vQ4MNpZS|J?r%}ZG;?jxF8cO z50eU8&>%20+5#L?tPqIPI4t&X4NuKnSajdoxX0{=QvMf^@?uW7P{;xui!+RN1%>hf zQA9#5rnf~@2zMI?lV=J%N|J_a8FKRSTlR+q`k~IA9xlfQuitB|gIow=C)GH6= z$E!<>_^$Cjcv7QsE3DQFDP4@VC5C)zvIlwyHfiBB#j!Rc z7EI$|2@g2bh92Q=ZF_cRGuE#WKd37%u4yGP%VI&fH`8G>MWY#{Z@K@;OV3F*}nECF)J3V2v%Sq zAVQ78k7My+@6?(;U6E-A0Xz|4m;yi3FmTxf3nE5=Xe$m4%rvuwOqj^M@3gNm1PL10 z)4y<+-`-Onl98L~nbeHOX5lgAfvoNo1mPKx)W)QAk@B1;83*OHjPhu&kz-_9n!BTC zl4?)QbDLpSN_SVyqo1s6mm@{=&NTO@Y-`arJooG}*MaU5!)k@UKB@i!)wu+A-Y#JG z$f=`K0$s+owSqsMyVd+aP+1rJ1?@vbNn8#pxsBA7I)ATK{NjrS7XEwOa| zNX&7o7!WjWfXXTp6foH!Nhb*`O~@>eI@AbgP30eqx0jOOI|6-C>`7VEel?j}*td%T z53})@Sv3niwdZuVZJ(yS406(BSvg|};OO^1pNjVG3a7^X?j7y-4jPb~9drdd)}5}P z_r8f;SL{RSAhq1RG@p~}p_t=46gMS!=G%=PNp@GSVhp1<*2=>OOGCZQ295-qMC7c4 zOe?^)y=c)~3dk2n1i2?%T~@Q7O)oZ=WZf8Yjoq6xReb2SYsB!IeE>a)1|R@$lefjK z17(1&p;O7R$MuH2WdPZcE2#l$IUV|(7ppO%omF0{`~vih263N2WAgltmi!M-o@lkF zbh~+$4(MjNJ9^U;o;dl~r5E2wONS&g$ssMow2v#vQ^c9NuB$M$~y9_`&X za&D37tIf@(p2>vM#X_`C^xtXD9?Z99I20fs5<+delTs=iO?h$-839}UYXw8&oBla; z-6Q=Y1>*!=I(d8@F00kTa!&2T@ICr)WkctHF$BKRx<5_Tqq`#?N3qb=FpLg=PRkxF z2Pcqm*QuMgl@z>$i#WFtOZFqhrh)qjh9R%Mf3uLJ{Nr1~FQfDC)H}n9k2UmEzm)b5 z4p=mrSLenhZjJO^mVTyjk^K9ddZ*Pz5)|ckw0@S4hHuUJxg3yZ(o(U$)7Q06=#N;z z6z*4LIPUD0o08sVf4)+=fZ!u1=t|kr|1sfzjyFJ7Kez78!3ml4pe&{MaMoEWFcGPMxS)|aK~VyWA_dqVu}7AQ5YIq9oN!$-+fTx%;h(UyBk`CIGL zb~{qWC-}QYd?`@ceR$b4{|1{Q&UwR2gYUzB+Wb}c-)(xjaxHfigMYBJD*46t>w}bK zOo?Rdo;f~5Det(Qc_6n@yx71lY{O)t6j?H7)-ZdFMtmpD?viY0^%-}OOUS=74q~wV z8dqvdIu`X~M5*C01G^%MjEWHSMt_19C`jbH# **Note**: Don't use **Set up Schools PCs** app for PCs that must connect to enterprise networks or to open wi-fi networks that require the user to accept Terms of Use. * **Apply to new computers**: The setup file that the **Set up School PCs** app creates should be used on new computers that haven't been set up for accounts yet. If you apply the setup file to a computer that has already been set up, existing accounts and data might be lost. > **Warning**: Only use the setup file on computers that you want to configure and lock down for students. After you apply the setup file to a computer, the computer must be reset to remove the settings. * **Turn on student PCs and stay on first screen**: The computer must be on this screen when you insert the USB key. @@ -53,10 +54,23 @@ The Set up School PCs app helps you set up new computers running Windows 10, ver If you have gone past this screen, you may have to reset your PC to start over. To reset your PC after you have completed the first run experience, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**. * **Use more than one USB key**: If you are setting up multiple PCs, you can set them up at the same time. Just run the **Set up School PCs** app again and save the same settings to another key. That way you can run set up on more than one PC at once. Create three keys and you can run it on three PCs at once, etc. * **Start fresh**: If the PC has already been set up and you want to return to the first-run-experience to apply a new package, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**. -* **Keep it clean**: We strongly recommend that IT avoid changes to policies unless absolutely necessary, as any changes can impair performance and sign-in time. +* **Keep it clean**: We strongly recommend that IT avoid changes to policies unless absolutely necessary, as any changes can impair performance and sign-in time. Get more information at [Set up School PCs app technical reference](set-up-school-pcs-technical.md). ## Set up School PCs app step-by-step +What you need: + +- The **Set up School PCs** app, installed on your work computer, connected to your school's network +- A USB drive, 1 GB or larger + +### Create the setup file in the app + + + + + +### Apply the setup file to PCs + The setup file on your USB drive is named SetupSchoolPCs.ppkg, which is a provisioning package. A provisioning package is a method for applying settings to Windows 10. When Windows 10 refers to "package", it means your setup file, and when it refers to "provisioning", it means applying the setup file to the computer. 1. Start with a computer on the first-run setup screen. From 873cdc2254be5e518df1b68f00c904e8a15d31de Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 20 May 2016 09:43:05 -0700 Subject: [PATCH 362/439] table fix? --- education/windows/set-up-school-pcs-technical.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index 6a402c66b7..00f39712a3 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -231,7 +231,7 @@ The **Set up School PCs** app produces a specialized provisioning package that m

      Windows Settings > Security Settings > Local Policies > Security Options

      -

      Interactive logon: Do not display last user name

      - Enabled

      +

      Interactive logon: Do not display last user name

      Enabled

      Interactive logon: Sign-in last interactive user automatically after a system-initiated restart

      Disabled

      From d8c1f4fc485ad4e7e457e9d5ff679a64d0827eb1 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 20 May 2016 09:55:04 -0700 Subject: [PATCH 363/439] found missing tag in table! --- education/windows/set-up-school-pcs-technical.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index 00f39712a3..25735d9755 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -231,7 +231,7 @@ The **Set up School PCs** app produces a specialized provisioning package that m

      Windows Settings > Security Settings > Local Policies > Security Options

      -

      Interactive logon: Do not display last user name

      Enabled

      +

      Interactive logon: Do not display last user name

      Enabled

      Interactive logon: Sign-in last interactive user automatically after a system-initiated restart

      Disabled

      From 7efb09504d17fa683dfd7e245ffe4e1ca37296c1 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 20 May 2016 10:21:17 -0700 Subject: [PATCH 364/439] darn table, what's your problem? --- .../windows/set-up-school-pcs-technical.md | 141 +++++++++--------- 1 file changed, 71 insertions(+), 70 deletions(-) diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index 25735d9755..8b00b6bf00 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -109,137 +109,138 @@ The **Set up School PCs** app produces a specialized provisioning package that m > **Important**: It is not recommended to set additional policies on PCs configured with the **Set up School PCs** app. The shared PC mode has been optimized to be fast and reliable over time with minimal to no manual maintenance required - + - + - + - - + - + - + - + - + - + - + - + - + - + - + - + - + - + - - + - + - + - + - - - - - - + - + - + + + + - - - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + + + + + + + + + - -

      Policy name

      Value

      Policy name

      Value

      Admin Templates > Control Panel > Personalization

      Admin Templates > Control Panel > Personalization

      Prevent enabling lock screen slide show

      Enabled

      Prevent enabling lock screen slide show

      Enabled

      Prevent changing lock screen and logon image

      Enabled

      Prevent changing lock screen and logon image

      Enabled

      Admin Templates > System > Power Management > Button Settings

      Admin Templates > System > Power Management > Button Settings

      Select the Power button action (plugged in)

      Sleep

      Select the Power button action (plugged in)

      Sleep

      Select the Power button action (on battery)

      Sleep

      Select the Power button action (on battery)

      Sleep

      Select the Sleep button action (plugged in)

      Sleep

      Select the Sleep button action (plugged in)

      Sleep

      Select the lid switch action (plugged in)

      Sleep

      Select the lid switch action (plugged in)

      Sleep

      Select the lid switch action (on battery)

      Sleep

      Select the lid switch action (on battery)

      Sleep

      Admin Templates > System > Power Management > Sleep Settings

      Admin Templates > System > Power Management > Sleep Settings

      Require a password when a computer wakes (plugged in)

      Enabled

      Require a password when a computer wakes (plugged in)

      Enabled

      Require a password when a computer wakes (on battery)

      Enabled

      Require a password when a computer wakes (on battery)

      Enabled

      Specify the system sleep timeout (plugged in)

      SleepTimeout

      Specify the system sleep timeout (plugged in)

      SleepTimeout

      Specify the system sleep timeout (on battery)

      SleepTimeout

      Specify the system sleep timeout (on battery)

      SleepTimeout

      Turn off hybrid sleep (plugged in)

      Enabled

      Turn off hybrid sleep (plugged in)

      Enabled

      Turn off hybrid sleep (on battery)

      Enabled

      Turn off hybrid sleep (on battery)

      Enabled

      Specify the unattended sleep timeout (plugged in)

      SleepTimeout

      Specify the unattended sleep timeout (on battery)

      SleepTimeout

      Specify the unattended sleep timeout (plugged in)

      SleepTimeout

      Allow standby states (S1-S3) when sleeping (plugged in)

      Enabled

      Specify the unattended sleep timeout (on battery)

      SleepTimeout

      Allow standby states (S1-S3) when sleeping (on battery)

      Enabled

      Allow standby states (S1-S3) when sleeping (plugged in)

      Enabled

      Specify the system hibernate timeout (plugged in)

      Enabled, 0

      Allow standby states (S1-S3) when sleeping (on battery)

      Enabled

      Specify the system hibernate timeout (on battery)

      Enabled, 0

      Admin Templates > System > Power Management > Video and Display Settings

      Turn off the display (plugged in)

      SleepTimeout

      Turn off the display (on battery

      SleepTimeout

      Specify the system hibernate timeout (plugged in)

      Enabled, 0

      Admin Templates > System > Logon

      Specify the system hibernate timeout (on battery)

      Enabled, 0

      Show first sign-in animation

      Disabled

      Admin Templates > System > Power Management > Video and Display Settings

      Turn off the display (plugged in)

      SleepTimeout

      Turn off the display (on battery

      SleepTimeout

      Hide entry points for Fast User Switching

      Enabled

      Turn on convenience PIN sign-in

      Disabled

      Admin Templates > System > Logon

      Turn off picture password sign-in

      Enabled

      Show first sign-in animation

      Disabled

      Turn off app notification on the lock screen

      Enabled

      Hide entry points for Fast User Switching

      Enabled

      Allow users to select when a password is required when resuming from connected standby

      Disabled

      Turn on convenience PIN sign-in

      Disabled

      Block user from showing account details on sign-in

      Enabled

      Turn off picture password sign-in

      Enabled

      Admin Templates > System > User Profiles

      Turn off app notification on the lock screen

      Enabled

      Turn off the advertising ID

      Enabled

      Allow users to select when a password is required when resuming from connected standby

      Disabled

      Admin Templates > Windows Components

      Block user from showing account details on sign-in

      Enabled

      Do not show Windows Tips

      Enabled

      Admin Templates > System > User Profiles

      Turn off Microsoft consumer experiences

      Enabled

      Turn off the advertising ID

      Enabled

      Microsoft Passport for Work

      Disabled

      Admin Templates > Windows Components

      Prevent the usage of OneDrive for file storage

      Enabled

      Do not show Windows Tips

      Enabled

      Admin Templates > Windows Components > Biometrics

      Turn off Microsoft consumer experiences

      Enabled

      Allow the use of biometrics

      Disabled

      Microsoft Passport for Work

      Disabled

      Allow users to log on using biometrics

      Disabled

      Prevent the usage of OneDrive for file storage

      Enabled

      Allow domain users to log on using biometrics

      Disabled

      Admin Templates > Windows Components > Biometrics

      Admin Templates > Windows Components > Data Collection and Preview Builds

      Allow the use of biometrics

      Disabled

      Toggle user control over Insider builds

      Disabled

      Allow users to log on using biometrics

      Disabled

      Disable pre-release features or settings

      Disabled

      Allow domain users to log on using biometrics

      Disabled

      Do not show feedback notifications

      Enabled

      Admin Templates > Windows Components > Data Collection and Preview Builds

      Admin Templates > Windows Components > File Explorer

      Toggle user control over Insider builds

      Disabled

      Show lock in the user tile menu

      Disabled

      Disable pre-release features or settings

      Disabled

      Admin Templates > Windows Components > Maintenance Scheduler

      Do not show feedback notifications

      Enabled

      Automatic Maintenance Activation Boundary

      MaintenanceStartTime

      Admin Templates > Windows Components > File Explorer

      Automatic Maintenance Random Delay

      Enabled, 2 hours

      Show lock in the user tile menu

      Disabled

      Automatic Maintenance WakeUp Policy

      Enabled

      Admin Templates > Windows Components > Maintenance Scheduler

      Admin Templates > Windows Components > Microsoft Edge

      Automatic Maintenance Activation Boundary

      MaintenanceStartTime

      Open a new tab with an empty tab

      Disabled

      Automatic Maintenance Random Delay

      Enabled, 2 hours

      Configure corporate home pages

      Enabled, about:blank

      Automatic Maintenance WakeUp Policy

      Enabled

      Admin Templates > Windows Components > Search

      Admin Templates > Windows Components > Microsoft Edge

      Allow Cortana

      Disabled

      Open a new tab with an empty tab

      Disabled

      Windows Settings > Security Settings > Local Policies > Security Options

      Configure corporate home pages

      Enabled, about:blank

      Interactive logon: Do not display last user name

      Enabled

      Admin Templates > Windows Components > Search

      Interactive logon: Sign-in last interactive user automatically after a system-initiated restart

      Disabled

      Allow Cortana

      Disabled

      Shutdown: Allow system to be shut down without having to log on

      Disabled

      Windows Settings > Security Settings > Local Policies > Security Options

      Interactive logon: Do not display last user name

      Enabled

      Interactive logon: Sign-in last interactive user automatically after a system-initiated restart

      Disabled

      Shutdown: Allow system to be shut down without having to log on

      Disabled

      User Account Control: Behavior of the elevation prompt for standard users

      Auto deny

      User Account Control: Behavior of the elevation prompt for standard users

      Auto deny


      +

      ## Related topics From 52d4dd9616a4f8e31b7082cbcf9ee925f5be25a6 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 20 May 2016 10:36:01 -0700 Subject: [PATCH 365/439] it shows, why so much whitespace? --- education/windows/set-up-school-pcs-technical.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index 8b00b6bf00..9666f1d1f3 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -106,9 +106,9 @@ The **Set up School PCs** app produces a specialized provisioning package that m ### Local Group Policies -> **Important**: It is not recommended to set additional policies on PCs configured with the **Set up School PCs** app. The shared PC mode has been optimized to be fast and reliable over time with minimal to no manual maintenance required +It is not recommended to set additional policies on PCs configured with the **Set up School PCs** app. The shared PC mode has been optimized to be fast and reliable over time with minimal to no manual maintenance required. - +
      From 8f074a01089e7721fc6154ff01ddc42b12d8b430 Mon Sep 17 00:00:00 2001 From: Trudy Hakala Date: Fri, 20 May 2016 10:53:14 -0700 Subject: [PATCH 366/439] updates for 7616926 LOB and supported markets --- windows/manage/working-with-line-of-business-apps.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/manage/working-with-line-of-business-apps.md b/windows/manage/working-with-line-of-business-apps.md index a8a36b3268..2700a1f83a 100644 --- a/windows/manage/working-with-line-of-business-apps.md +++ b/windows/manage/working-with-line-of-business-apps.md @@ -78,7 +78,8 @@ After an app is published and available in the Store, ISVs publish an updated ve 5. Click **Save** to save your changes and start the app submission process. -For more information, see [Organizational licensing options]( http://go.microsoft.com/fwlink/p/?LinkId=708615) and [Distributing LOB apps to enterprises](http://go.microsoft.com/fwlink/p/?LinkId=627543). +For more information, see [Organizational licensing options]( http://go.microsoft.com/fwlink/p/?LinkId=708615) and [Distributing LOB apps to enterprises](http://go.microsoft.com/fwlink/p/?LinkId=627543).
      +**Note** In order to get the LOB app, the organization must be located in a [supported market](https://technet.microsoft.com/en-us/itpro/windows/whats-new/windows-store-for-business-overview#supported-markets), and you must not have excluded that market when submitting your app. ### Add app to inventory (admin) From 5f83d2ffc77dceaf6301c122f2ede53ba06ee078 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 20 May 2016 10:58:31 -0700 Subject: [PATCH 367/439] sync before weekend --- education/windows/set-up-school-pcs-technical.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index 9666f1d1f3..8c663f19e0 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -106,8 +106,6 @@ The **Set up School PCs** app produces a specialized provisioning package that m ### Local Group Policies -It is not recommended to set additional policies on PCs configured with the **Set up School PCs** app. The shared PC mode has been optimized to be fast and reliable over time with minimal to no manual maintenance required. -

      Policy name

      Value

      From 767de92db7d80b935945dcbd3733b274f0ef3306 Mon Sep 17 00:00:00 2001 From: Trudy Hakala Date: Fri, 20 May 2016 11:58:40 -0700 Subject: [PATCH 368/439] small updates from review --- .../surface-hub/i-am-done-finishing-your-surface-hub-meeting.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md b/devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md index 02819a1963..137667385b 100644 --- a/devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md +++ b/devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md @@ -38,7 +38,7 @@ Meeting attendees have access to a limited set of directories on the Surface Hub - Pictures - Downloads -Surface Hub also clears these directories, since many applications often write to these directories: +Surface Hub also clears these directories, since many applications often write to them: - Desktop - Favorites - Recent From d7f6f57bfe8d3f64037fa57a3ba3dd1eae299f71 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Fri, 20 May 2016 16:50:15 -0700 Subject: [PATCH 369/439] fixing spacing issues --- .../keep-secure/bitlocker-countermeasures.md | 60 ++- .../bitlocker-frequently-asked-questions.md | 202 +++++++- .../bitlocker-group-policy-settings.md | 436 ++++++++++++++---- ...tlocker-how-to-deploy-on-windows-server.md | 53 ++- .../bitlocker-how-to-enable-network-unlock.md | 176 +++++-- windows/keep-secure/bitlocker-overview.md | 111 ++--- .../bitlocker-recovery-guide-plan.md | 176 +++++-- 7 files changed, 943 insertions(+), 271 deletions(-) diff --git a/windows/keep-secure/bitlocker-countermeasures.md b/windows/keep-secure/bitlocker-countermeasures.md index 4f52324123..687bf6047b 100644 --- a/windows/keep-secure/bitlocker-countermeasures.md +++ b/windows/keep-secure/bitlocker-countermeasures.md @@ -2,87 +2,137 @@ title: BitLocker Countermeasures (Windows 10) description: Windows uses technologies including TPM, Secure Boot, Trusted Boot, and Early Launch Antimalware (ELAM) to protect against attacks on the BitLocker encryption key. ms.assetid: ebdb0637-2597-4da1-bb18-8127964686ea -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- # BitLocker Countermeasures + **Applies to** - Windows 10 + Windows uses technologies including TPM, Secure Boot, Trusted Boot, and Early Launch Antimalware (ELAM) to protect against attacks on the BitLocker encryption key. BitLocker is part of a strategic approach to securing mobile data through encryption technology. Data on a lost or stolen computer is vulnerable to unauthorized access, either by running a software attack tool against it or by transferring the computer’s hard disk to a different computer. Today, BitLocker helps mitigate unauthorized data access on lost or stolen computers before the operating system is started by: + - **Encrypting the hard drives on your computer.** For example, you can turn on BitLocker for your operating system drive, a fixed data drive, or a removable data drive (such as a USB flash drive). Turning on BitLocker for your operating system drive encrypts all system files on the operating system drive, including the swap files and hibernation files. - **Ensuring the integrity of early boot components and boot configuration data.** On devices that have a TPM version 1.2 or higher, BitLocker uses the enhanced security capabilities of the TPM to help ensure that your data is accessible only if the computer’s boot components appear unaltered and the encrypted disk is located in the original computer. + The sections that follow provide more detailed information about the different technologies that Windows uses to protect against attacks on the BitLocker encryption key in four different boot phases: before startup, during pre-boot, during startup, and finally after startup. + ### Protection before startup + Before Windows starts, you must rely on security features implemented as part of the device hardware, including TPM andSecure Boot. Fortunately, many modern computers feature TPM. + **Trusted Platform Module** + Software alone isn’t sufficient to protect a system. After an attacker has compromised software, the software might be unable to detect the compromise. Therefore, a single successful software compromise results in an untrusted system that might never be detected. Hardware, however, is much more difficult to modify. + A TPM is a microchip designed to provide basic security-related functions, primarily involving encryption keys. The TPM is usually installed on the motherboard of a computer and communicates with the rest of the system through a hardware bus. Physically, TPMs are designed to be tamper-proof. If an attacker tries to physically retrieve data directly from the chip, they’ll probably destroy the chip in the process. By binding the BitLocker encryption key with the TPM and properly configuring the device, it’s nearly impossible for an attacker to gain access to the BitLocker-encrypted data without obtaining an authorized user’s credentials. Therefore, computers with a TPM can provide a high level of protection against attacks that attempt to directly retrieve the BitLocker encryption key. For more info about TPM, see [Trusted Platform Module](trusted-platform-module-overview.md). + **UEFI and Secure Boot** + No operating system can protect a device when the operating system is offline. For that reason, Microsoft worked closely with hardware vendors to require firmware-level protection against boot and rootkits that might compromise an encryption solution’s encryption keys. + The UEFI is a programmable boot environment introduced as a replacement for BIOS, which has for the most part remained unchanged for the past 30 years. Like BIOS, PCs start UEFI before any other software; it initializes devices, and UEFI then starts the operating system’s bootloader. As part of its introduction into the pre–operating system environment, UEFI serves a number of purposes, but one of the key benefits is to protect newer devices against a sophisticated type of malware called a bootkit through the use of its Secure Boot feature. + Recent implementations of UEFI (starting with version 2.3.1) can verify the digital signatures of the device’s firmware before running it. Because only the PC’s hardware manufacturer has access to the digital certificate required to create a valid firmware signature, UEFI can prevent firmware-based bootkits. Thus, UEFI is the first link in the chain of trust. + Secure Boot is the foundation of platform and firmware security and was created to enhance security in the pre-boot environment regardless of device architecture. Using signatures to validate the integrity of firmware images before they are allowed to execute, Secure Boot helps reduce the risk of bootloader attacks. The purpose of Secure Boot is to block untrusted firmware and bootloaders (signed or unsigned) from being able to start on the system. With the legacy BIOS boot process, the pre–operating system environment is vulnerable to attacks by redirecting bootloader handoff to possible malicious loaders. These loaders could remain undetected to operating system and antimalware software. The diagram in Figure 1 contrasts the BIOS and UEFI startup processes. + ![the bios and uefi startup processes](images/bitlockerprebootprotection-bios-uefi-startup.jpg) + **Figure 1.** The BIOS and UEFI startup processes -With Secure Boot enabled, UEFI, in coordination with the TPM, can examine the bootloader and determine whether it’s trustworthy. To determine whether the bootloader is trustworthy, UEFI examines the bootloader’s digital signature. Using the digital signature, UEFI verifies that the bootloader was signed using a trusted certificate. + +With Secure Boot enabled, UEFI, in coordination with the TPM, can examine the bootloader and determine whether it’s trustworthy. To determine whether the bootloader is trustworthy, UEFI examines the bootloader’s digital signature. +Using the digital signature, UEFI verifies that the bootloader was signed using a trusted certificate. + If the bootloader passes these two tests, UEFI knows that the bootloader isn’t a bootkit and starts it. At this point, Trusted Boot takes over, and the Windows bootloader, using the same cryptographic technologies that UEFI used to verify the bootloader, then verifies that the Windows system files haven’t been changed. + All Windows 8–certified devices must meet several requirements related to UEFI-based Secure Boot: + - They must have Secure Boot enabled by default. - They must trust Microsoft’s certificate (and thus any bootloader Microsoft has signed). - They must allow the user to configure Secure Boot to trust other signed bootloaders. - Except for Windows RT devices, they must allow the user to completely disable Secure Boot. + These requirements help protect you from rootkits while allowing you to run any operating system you want. You have three options for running non-Microsoft operating systems: -- **Use an operating system with a certified bootloader.** Microsoft can analyze and sign non-Microsoft bootloaders so that they can be trusted. The Linux community is using this process to enable Linux to take advantage of Secure Boot on Windows-certified devices. + +- **Use an operating system with a certified bootloader.** Microsoft can analyze and sign non-Microsoft bootloaders so that they can be trusted. The Linux community is using this process to enable Linux to take advantage of +Secure Boot on Windows-certified devices. + - **Configure UEFI to trust your custom bootloader.** Your device can trust a signed, non-certified bootloader that you specify in the UEFI database, allowing you to run any operating system, including homemade operating systems. - **Turn off Secure Boot.** You can turn off Secure Boot. This does not help protect you from bootkits, however. + To prevent malware from abusing these options, the user has to manually configure the UEFI firmware to trust a non-certified bootloader or to turn off Secure Boot. Software cannot change the Secure Boot settings. Any device that doesn’t require Secure Boot or a similar bootloader-verification technology, regardless of the architecture or operating system, is vulnerable to bootkits, which can be used to compromise the encryption solution. UEFI is secure by design, but it’s critical to protect the Secure Boot configuration by using password protection. In addition, although several well-publicized attacks against UEFI have occurred, they were exploiting faulty UEFI implementations. Those attacks are ineffective when UEFI is implemented properly. + For more information about Secure Boot, refer to [Securing the Windows 8.1 Boot Process](http://technet.microsoft.com/windows/dn168167.aspx). + ### Protection during pre-boot: Pre-boot authentication + Pre-boot authentication with BitLocker is a process that requires the use of either a Trusted Platform Module (TPM), user input, such as a PIN, or both, depending on hardware and operating system configuration, to authenticate prior to making the contents of the system drive accessible. In the case of BitLocker, BitLocker encrypts the entire drive, including all system files. BitLocker accesses and stores the encryption key in memory only after a pre-boot authentication is completed using one or more of the following options: Trusted Platform Module (TPM), user provides a specific PIN, USB startup key. + If Windows can’t access the encryption key, the device can’t read or edit the files on the system drive. Even if an attacker takes the disk out of the PC or steals the entire PC, they won’t be able to read or edit the files without the encryption key. The only option for bypassing pre-boot authentication is entering the highly complex, 48-digit recovery key. + The BitLocker pre-boot authentication capability is not specifically designed to prevent the operating system from starting: That’s merely a side effect of how BitLocker protects data confidentiality and system integrity. Pre-boot authentication is designed to prevent the encryption key from being loaded to system memory on devices that are vulnerable to certain types of cold boot attacks. Many modern devices prevent an attacker from easily removing the memory, and Microsoft expects those devices to become even more common in the future. + On computers with a compatible TPM, operating system drives that are BitLocker-protected can be unlocked in four ways: + - **TPM-only.** Using TPM-only validation does not require any interaction with the user to decrypt and provide access to the drive. If the TPM validation succeeds, the user logon experience is the same as a standard logon. If the TPM is missing or changed or if the TPM detects changes to critical operating system startup files, BitLocker enters its recovery mode, and the user must enter a recovery password to regain access to the data. - **TPM with startup key.** In addition to the protection that the TPM provides, part of the encryption key is stored on a USB flash drive, referred to as a startup key. Data on the encrypted volume cannot be accessed without the startup key. - **TPM with PIN.** In addition to the protection that the TPM provides, BitLocker requires that the user enter a PIN. Data on the encrypted volume cannot be accessed without entering the PIN. - **TPM with startup key and PIN.** In addition to the core component protection that the TPM provides, part of the encryption key is stored on a USB flash drive, and a PIN is required to authenticate the user to the TPM. This configuration provides multifactor authentication so that if the USB key is lost or stolen, it cannot be used for access to the drive, because the correct PIN is also required. + For many years, Microsoft has recommended using pre-boot authentication to protect against DMA and memory remanence attacks. Today, Microsoft only recommends using pre-boot authentication on PCs where the mitigations described in this document cannot be implemented. These mitigations may be inherent to the device or may come by way of configurations that IT can provision to devices and Windows itself. + Although effective, pre-boot authentication is inconvenient to users. In addition, if a user forgets their PIN or loses their startup key, they’re denied access to their data until they can contact their organization’s support team to obtain a recovery key. Today, most new PCs running Windows 10, Windows 8.1, or Windows 8 provide sufficient protection against DMA attacks without requiring pre-boot authentication. For example, most modern PCs include USB port options (which are not vulnerable to DMA attacks) but do not include FireWire or Thunderbolt ports (which are vulnerable to DMA attacks). + BitLocker-encrypted devices with DMA ports enabled, including FireWire or Thunderbolt ports, should be configured with pre-boot authentication if they are running Windows 10, Windows 7, Windows 8, or Windows 8.1 and disabling the ports using policy or firmware configuration is not an option. Windows 8.1 and later InstantGo devices do not need pre-boot authentication to defend against DMA-based port attacks, as the ports will not be present on certified devices. A non-InstantGo Windows 8.1 and later device requires pre-boot authentication if DMA ports are enabled on the device and additional mitigations described in this document are not implemented. Many customers find that the DMA ports on their devices are never used, and they choose to eliminate the possibility of an attack by disabling the DMA ports themselves, either at the hardware level or through Group Policy. Many new mobile devices have the system memory soldered to the motherboard, which helps prevent the cold boot–style attack, where the system memory is frozen, removed, and then placed into another device. Those devices, and most PCs, can still be vulnerable when booting to a malicious operating system, however. + You can mitigate the risk of booting to a malicious operating system: + - **Windows 10 (without Secure Boot), Windows 8.1 (without Secure Boot), Windows 8 (without UEFI-based Secure Boot), or Windows 7 (with or without a TPM).** Disable booting from external media, and require a firmware password to prevent the attacker from changing that option. - **Windows 10, Windows 8.1, or Windows 8 (certified or with Secure Boot).** Password protect the firmware, and do not disable Secure Boot. + ### Protection During Startup + During the startup process, Windows 10 uses Trusted Boot and Early Launch Antimalware (ELAM) to examine the integrity of every component. The sections that follow describe these technologies in more detail. + **Trusted Boot** + Trusted Boot takes over where UEFI-based Secure Boot leaves off—during the operating system initialization phase. The bootloader verifies the digital signature of the Windows kernel before loading it. The Windows kernel, in turn, verifies every other component of the Windows startup process, including the boot drivers, startup files, and ELAM driver. If a file has been modified or is not properly signed with a Microsoft signature, Windows detects the problem and refuses to load the corrupted component. Often, Windows can automatically repair the corrupted component, restoring the integrity of Windows and allowing the PC to start normally. + Windows 10 uses Trusted Boot on any hardware platform: It requires neither UEFI nor a TPM. However, without Secure Boot, it’s possible for malware to compromise the startup process prior to Windows starting, at which point Trusted Boot protections could be bypassed or potentially disabled. + **Early Launch Antimalware** + Because UEFI-based Secure Boot has protected the bootloader and Trusted Boot has protected the Windows kernel or other Windows startup components, the next opportunity for malware to start is by infecting a non-Microsoft boot-related driver. Traditional antimalware apps don’t start until after the boot-related drivers have been loaded, giving a rootkit disguised as a driver the opportunity to work. + The purpose of ELAM is to load an antimalware driver before drivers that are flagged as boot-start can be executed. This approach provides the ability for an antimalware driver to register as a trusted boot-critical driver. It is launched during the Trusted Boot process, and with that, Windows ensures that it is loaded before any other non-Microsoft software. + With this solution in place, boot drivers are initialized based on the classification that the ELAM driver returns according to an initialization policy. IT pros have the ability to change this policy through Group Policy. ELAM classifies drivers as follows: + - **Good.** The driver has been signed and has not been tampered with. - **Bad.** The driver has been identified as malware. It is recommended that you not allow known bad drivers to be initialized. - **Bad but required for boot.** The driver has been identified as malware, but the computer cannot successfully boot without loading this driver. - **Unknown.** This driver has not been attested to by your malware-detection application or classified by the ELAM boot-start driver. + While the features listed above protect the Windows boot process from malware threats that could compromise BitLocker security, it is important to note that DMA ports may be enabled during the window of time between when BitLocker unlocks the drive and Windows boots to the point that Windows can set any port related policies that have been configured. This period of time where the encryption key could be exposed to a DMA attack could be less than a minute on recent devices or longer depending on system performance. The use of pre-boot authentication with a PIN can be used to successfully mitigate against an attack. + ### Protection After Startup: eliminate DMA availability + Windows InstantGo–certified devices do not have DMA ports, eliminating the risk of DMA attacks. On other devices, you can disable FireWire, Thunderbolt, or other ports that support DMA. + ## See also - [Types of Attacks for Volume Encryption Keys](types-of-attacks-for-volume-encryption-keys.md) - [Choose the right BitLocker countermeasure](choose-the-right-bitlocker-countermeasure.md) - [Protect BitLocker from pre-boot attacks](protect-bitlocker-from-pre-boot-attacks.md) - [BitLocker overview](bitlocker-overview.md) -  -  diff --git a/windows/keep-secure/bitlocker-frequently-asked-questions.md b/windows/keep-secure/bitlocker-frequently-asked-questions.md index d9dd86cdc9..4d179869fb 100644 --- a/windows/keep-secure/bitlocker-frequently-asked-questions.md +++ b/windows/keep-secure/bitlocker-frequently-asked-questions.md @@ -2,17 +2,22 @@ title: BitLocker frequently asked questions (FAQ) (Windows 10) description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # BitLocker frequently asked questions (FAQ) + **Applies to** - Windows 10 + This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. + BitLocker is a data protection feature that encrypts the hard drives on your computer to provide enhanced protection against data theft or exposure on computers and removable drives that are lost or stolen, and more secure data deletion when BitLocker-protected computers are decommissioned as it is much more difficult to recover deleted data from an encrypted drive than from a non-encrypted drive. + - [Overview and requirements](#bkmk-overview) - [Upgrading](#bkmk-upgrading) - [Deployment and administration](#bkmk-deploy) @@ -22,43 +27,75 @@ BitLocker is a data protection feature that encrypts the hard drives on your com - [Security](#bkmk-security) - [BitLocker Network Unlock](#bkmk-bnusect) - [Other questions](#bkmk-other) + ## Overview and requirements + ### How does BitLocker work? + **How BitLocker works with operating system drives** + You can use BitLocker to mitigate unauthorized data access on lost or stolen computers by encrypting all user files and system files on the operating system drive, including the swap files and hibernation files, and checking the integrity of early boot components and boot configuration data. + **How BitLocker works with fixed and removable data drives** + You can use BitLocker to encrypt the entire contents of a data drive. You can use Group Policy to require that BitLocker be enabled on a drive before the computer can write data to the drive. BitLocker can be configured with a variety of unlock methods for data drives, and a data drive supports multiple unlock methods. + ### Does BitLocker support multifactor authentication? + Yes, BitLocker supports multifactor authentication for operating system drives. If you enable BitLocker on a computer that has a TPM version 1.2 or later, you can use additional forms of authentication with the TPM protection. + ### What are the BitLocker hardware and software requirements? -**Note**   -Dynamic disks are not supported by BitLocker. Dynamic data volumes will not be displayed in the Control Panel. Although the operating system volume will always be displayed in the Control Panel, regardless of whether it is a Dynamic disk, if it is a dynamic disk it is cannot be protected by BitLocker. + +> **Note:**  Dynamic disks are not supported by BitLocker. Dynamic data volumes will not be displayed in the Control Panel. Although the operating system volume will always be displayed in the Control Panel, regardless of whether it is a Dynamic disk, if it is a dynamic disk it is cannot be protected by BitLocker.   ### Why are two partitions required? Why does the system drive have to be so large? + Two partitions are required to run BitLocker because pre-startup authentication and system integrity verification must occur on a separate partition from the encrypted operating system drive. This configuration helps protect the operating system and the information in the encrypted drive. + ### Which Trusted Platform Modules (TPMs) does BitLocker support? + BitLocker supports TPM version 1.2 or higher. + ### How can I tell if a TPM is on my computer? + Open the TPM MMC console (tpm.msc) and look under the **Status** heading. + ### Can I use BitLocker on an operating system drive without a TPM? + Yes, you can enable BitLocker on an operating system drive without a TPM version 1.2 or higher, if the BIOS or UEFI firmware has the ability to read from a USB flash drive in the boot environment. This is because BitLocker will not unlock the protected drive until BitLocker's own volume master key is first released by either the computer's TPM or by a USB flash drive containing the BitLocker startup key for that computer. However, computers without TPMs will not be able to use the system integrity verification that BitLocker can also provide. To help determine whether a computer can read from a USB device during the boot process, use the BitLocker system check as part of the BitLocker setup process. This system check performs tests to confirm that the computer can properly read from the USB devices at the appropriate time and that the computer meets other BitLocker requirements. + ### How do I obtain BIOS support for the TPM on my computer? + Contact the computer manufacturer to request a Trusted Computing Group (TCG)-compliant BIOS or UEFI boot firmware that meets the following requirements: + - It is compliant with the TCG standards for a client computer. - It has a secure update mechanism to help prevent a malicious BIOS or boot firmware from being installed on the computer. + ### What credentials are required to use BitLocker? + To turn on, turn off, or change configurations of BitLocker on operating system and fixed data drives, membership in the local **Administrators** group is required. Standard users can turn on, turn off, or change configurations of BitLocker on removable data drives. + ### What is the recommended boot order for computers that are going to be BitLocker-protected? + You should configure the startup options of your computer to have the hard disk drive first in the boot order, before any other drives such ach as CD/DVD drives or USB drives. If the hard disk is not first and you typically boot from hard disk, then a boot order change may be detected or assumed when removable media is found during boot. The boot order typically affects the system measurement that is verified by BitLocker and a change in boot order will cause you to be prompted for your BitLocker recovery key. For the same reason, if you have a laptop with a docking station, ensure that the hard disk drive is first in the boot order both when docked and undocked.  + ## Upgrading + ### Can I upgrade my Windows 7 or Windows 8 computer to Windows 10 with BitLocker enabled? + Yes. Open the **BitLocker Drive Encryption** Control Panel, click **Manage BitLocker**, and then and click **Suspend**. Suspending protection does not decrypt the drive; it disables the authentication mechanisms used by BitLocker and uses a clear key on the drive to enable access. After the upgrade has completed, open Windows Explorer, right-click the drive, and then click **Resume Protection**. This reapplies the BitLocker authentication methods and deletes the clear key. + ### What is the difference between suspending and decrypting BitLocker? + **Decrypt** completely removes BitLocker protection and fully decrypts the drive. + **Suspend** keeps the data encrypted but encrypts the BitLocker volume master key with a clear key. The clear key is a cryptographic key stored unencrypted and unprotected on the disk drive. By storing this key unencrypted, the **Suspend** option allows for changes or upgrades to the computer without the time and cost of decrypting and re-encrypting the entire drive. After the changes are made and BitLocker is again enabled, BitLocker will reseal the encryption key to the new values of the measured components that changed as a part of the upgrade, the volume master key is changed, the protectors are updated to match and the clear key is erased. + ### Do I have to decrypt my BitLocker-protected drive to download and install system updates and upgrades? + The following table lists what action you need to take before you perform an upgrade or update installation. +

      Policy name

      Value

      @@ -95,142 +132,253 @@ The following table lists what action you need to take before you perform an upg
        -**Note**   -If you have suspended BitLocker, you can resume BitLocker protection after you have installed the upgrade or update. Upon resuming protection, BitLocker will reseal the encryption key to the new values of the measured components that changed as a part of the upgrade or update. If these types of upgrades or updates are applied without suspending BitLocker, your computer will enter recovery mode when restarting and will require a recovery key or password to access the computer. +> **Note:**  If you have suspended BitLocker, you can resume BitLocker protection after you have installed the upgrade or update. Upon resuming protection, BitLocker will reseal the encryption key to the new values of the measured components that changed as a part of the upgrade or update. If these types of upgrades or updates are applied without suspending BitLocker, your computer will enter recovery mode when restarting and will require a recovery key or password to access the computer.   ## Deployment and administration + ### Can BitLocker deployment be automated in an enterprise environment? + Yes, you can automate the deployment and configuration of BitLocker and the TPM using either WMI or Windows PowerShell scripts. How you choose to implement the scripts depends on your environment. You can also use Manage-bde.exe to locally or remotely configure BitLocker. For more info about writing scripts that use the BitLocker WMI providers, see [BitLocker Drive Encryption Provider](http://go.microsoft.com/fwlink/p/?LinkId=80600). For more info about using Windows PowerShell cmdlets with BitLocker Drive Encryption, see [BitLocker Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj649829.aspx). + ### Can BitLocker encrypt more than just the operating system drive? + Yes. + ### Is there a noticeable performance impact when BitLocker is enabled on a computer? + Generally it imposes a single-digit percentage performance overhead. + ### How long will initial encryption take when BitLocker is turned on? + Although BitLocker encryption occurs in the background while you continue to work, and the system remains usable, encryption times vary depending on the type of drive that is being encrypted, the size of the drive, and the speed of the drive. If you are encrypting very large drives, you may want to set encryption to occur during times when you will not be using the drive. + You can also choose whether or not BitLocker should encrypt the entire drive or just the used space on the drive when you turn on BitLocker. On a new hard drive, encrypting just the used spaced can be considerably faster than encrypting the entire drive. When this encryption option is selected, BitLocker automatically encrypts data as it is saved, ensuring that no data is stored unencrypted. + ### What happens if the computer is turned off during encryption or decryption? + If the computer is turned off or goes into hibernation, the BitLocker encryption and decryption process will resume where it stopped the next time Windows starts. This is true even if the power is suddenly unavailable. + ### Does BitLocker encrypt and decrypt the entire drive all at once when reading and writing data? + No, BitLocker does not encrypt and decrypt the entire drive when reading and writing data. The encrypted sectors in the BitLocker-protected drive are decrypted only as they are requested from system read operations. Blocks that are written to the drive are encrypted before the system writes them to the physical disk. No unencrypted data is ever stored on a BitLocker-protected drive. + ### How can I prevent users on a network from storing data on an unencrypted drive? + You can can Group Policy settings to require that data drives be BitLocker-protected before a BitLocker-protected computer can write data to them. For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). When these policy settings are enabled, the BitLocker-protected operating system will mount any data drives that are not protected by BitLocker as read-only. + ### What system changes would cause the integrity check on my operating system drive to fail? + The following types of system changes can cause an integrity check failure and prevent the TPM from releasing the BitLocker key to decrypt the protected operating system drive: + - Moving the BitLocker-protected drive into a new computer. - Installing a new motherboard with a new TPM. - Turning off, disabling, or clearing the TPM. - Changing any boot configuration settings. - Changing the BIOS, UEFI firmware, master boot record, boot sector, boot manager, option ROM, or other early boot components or boot configuration data. + ### What causes BitLocker to start into recovery mode when attempting to start the operating system drive? + Because BitLocker is designed to protect your computer from numerous attacks, there are numerous reasons why BitLocker could start in recovery mode. In BitLocker, recovery consists of decrypting a copy of the volume master key using either a recovery key stored on a USB flash drive or a cryptographic key derived from a recovery password. The TPM is not involved in any recovery scenarios, so recovery is still possible if the TPM fails boot component validation, malfunctions, or is removed. + ### Can I swap hard disks on the same computer if BitLocker is enabled on the operating system drive? + Yes, you can swap multiple hard disks on the same computer if BitLocker is enabled, but only if the hard disks were BitLocker-protected on the same computer. The BitLocker keys are unique to the TPM and operating system drive, so if you want to prepare a backup operating system or data drive for use in case of disk failure, you need to make sure that they were matched with the correct TPM. You can also configure different hard drives for different operating systems and then enable BitLocker on each one with different authentication methods (such as one with TPM-only and one with TPM+PIN) without any conflicts. + ### Can I access my BitLocker-protected drive if I insert the hard disk into a different computer? + Yes, if the drive is a data drive, you can unlock it from the **BitLocker Drive Encryption** Control Panel item just as you would any other data drive by using a password or smart card. If the data drive was configured for automatic unlock only, you will have to unlock it by using the recovery key. The encrypted hard disk can be unlocked by a data recovery agent (if one was configured) or it can be unlocked by using the recovery key. + ### Why is "Turn BitLocker on" not available when I right-click a drive? Some drives cannot be encrypted with BitLocker. Reasons a drive cannot be encrypted include insufficient disk size, an incompatible file system, if the drive is a dynamic disk, or a drive is designated as the system partition. By default, the system drive (or system partition) is hidden from display. However, if it is not created as a hidden drive when the operating system was installed due to a custom installation process, that drive might be displayed but cannot be encrypted. + ### What type of disk configurations are supported by BitLocker? Any number of internal, fixed data drives can be protected with BitLocker. On some versions ATA and SATA-based, direct-attached storage devices are also supported. + ## Key management + ### What is the difference between a TPM owner password, recovery password, recovery key, password, PIN, enhanced PIN, and startup key? + There are multiple keys that can be generated and used by BitLocker. Some keys are required and some are optional protectors you can choose to use depending on the level of security you require. + ### How can the recovery password and recovery key be stored? + The recovery password and recovery key for an operating system drive or a fixed data drive can be saved to a folder, saved to one or more USB devices, saved to your Microsoft Account, or printed. + For removable data drives, the recovery password and recovery key can be saved to a folder, saved to your Microsoft Account, or printed. By default, you cannot store a recovery key for a removable drive on a removable drive. + A domain administrator can additionally configure Group Policy to automatically generate recovery passwords and store them in Active Directory Domain Services (AD DS) for any BitLocker-protected drive. + ### Is it possible to add an additional method of authentication without decrypting the drive if I only have the TPM authentication method enabled? + You can use the Manage-bde.exe command-line tool to replace your TPM-only authentication mode with a multifactor authentication mode. For example, if BitLocker is enabled with TPM authentication only and you want to add PIN authentication, use the following commands from an elevated command prompt, replacing *<4-20 digit numeric PIN>* with the numeric PIN you want to use: -**manage-bde –protectors –delete %systemdrive% -type tpm** -**manage-bde –protectors –add %systemdrive% -tpmandpin** *<4-20 digit numeric PIN>* + +`manage-bde –protectors –delete %systemdrive% -type tpm` + +`manage-bde –protectors –add %systemdrive% -tpmandpin <4-20 digit numeric PIN>` + ### If I lose my recovery information, will the BitLocker-protected data be unrecoverable? + BitLocker is designed to make the encrypted drive unrecoverable without the required authentication. When in recovery mode, the user needs the recovery password or recovery key to unlock the encrypted drive. -**Important**   -Store the recovery information in AD DS, along with your Microsoft Account, or another safe location. + +>**Important:**  Store the recovery information in AD DS, along with your Microsoft Account, or another safe location.   ### Can the USB flash drive that is used as the startup key also be used to store the recovery key? + While this is technically possible, it is not a best practice to use one USB flash drive to store both keys. If the USB flash drive that contains your startup key is lost or stolen, you also lose access to your recovery key. In addition, inserting this key would cause your computer to automatically boot from the recovery key even if TPM-measured files have changed, which circumvents the TPM's system integrity check. + ### Can I save the startup key on multiple USB flash drives? + Yes, you can save a computer's startup key on multiple USB flash drives. Right-clicking a BitLocker-protected drive and selecting **Manage BitLocker** will provide you the options to duplicate the recovery keys as needed. + ### Can I save multiple (different) startup keys on the same USB flash drive? + Yes, you can save BitLocker startup keys for different computers on the same USB flash drive. + ### Can I generate multiple (different) startup keys for the same computer? + You can generate different startup keys for the same computer through scripting. However, for computers that have a TPM, creating different startup keys prevents BitLocker from using the TPM's system integrity check. + ### Can I generate multiple PIN combinations? + You cannot generate multiple PIN combinations. + ### What encryption keys are used in BitLocker? How do they work together? + Raw data is encrypted with the full volume encryption key, which is then encrypted with the volume master key. The volume master key is in turn encrypted by one of several possible methods depending on your authentication (that is, key protectors or TPM) and recovery scenarios. + ### Where are the encryption keys stored? + The full volume encryption key is encrypted by the volume master key and stored in the encrypted drive. The volume master key is encrypted by the appropriate key protector and stored in the encrypted drive. If BitLocker has been suspended, the clear key that is used to encrypt the volume master key is also stored in the encrypted drive, along with the encrypted volume master key. + This storage process ensures that the volume master key is never stored unencrypted and is protected unless you disable BitLocker. The keys are also saved to two additional locations on the drive for redundancy. The keys can be read and processed by the boot manager. + ### Why do I have to use the function keys to enter the PIN or the 48-character recovery password? + The F1 through F10 keys are universally mapped scan codes available in the pre-boot environment on all computers and in all languages. The numeric keys 0 through 9 are not usable in the pre-boot environment on all keyboards. + When using an enhanced PIN, users should run the optional system check during the BitLocker setup process to ensure that the PIN can be entered correctly in the pre-boot environment. + ### How does BitLocker help prevent an attacker from discovering the PIN that unlocks my operating system drive? + It is possible that a personal identification number (PIN) can be discovered by an attacker performing a brute force attack. A brute force attack occurs when an attacker uses an automated tool to try different PIN combinations until the correct one is discovered. For BitLocker-protected computers, this type of attack, also known as a dictionary attack, requires that the attacker have physical access to the computer. + The TPM has the built-in ability to detect and react to these types of attacks. Because different manufacturers' TPMs may support different PIN and attack mitigations, contact your TPM's manufacturer to determine how your computer's TPM mitigates PIN brute force attacks. After you have determined your TPM's manufacturer, contact the manufacturer to gather the TPM's vendor-specific information. Most manufacturers use the PIN authentication failure count to exponentially increase lockout time to the PIN interface. However, each manufacturer has different policies regarding when and how the failure counter is decreased or reset. + ### How can I determine the manufacturer of my TPM? + You can determine your TPM manufacturer in the TPM MMC console (tpm.msc) under the **TPM Manufacturer Information** heading. + ### How can I evaluate a TPM's dictionary attack mitigation mechanism? + The following questions can assist you when asking a TPM manufacturer about the design of a dictionary attack mitigation mechanism: + - How many failed authorization attempts can occur before lockout? - What is the algorithm for determining the duration of a lockout based on the number of failed attempts and any other relevant parameters? - What actions can cause the failure count and lockout duration to be decreased or reset? + ### Can PIN length and complexity be managed with Group Policy? + Yes and No. You can configure the minimum personal identification number (PIN) length by using the **Configure minimum PIN length for startup** Group Policy setting and allow the use of alphanumeric PINs by enabling the **Allow enhanced PINs for startup** Group Policy setting. However, you cannot require PIN complexity by Group Policy. + For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). + ## BitLocker To Go + BitLocker To Go is BitLocker Drive Encryption on removable data drives. This includes the encryption of USB flash drives, SD cards, external hard disk drives, and other drives formatted by using the NTFS, FAT16, FAT32, or exFAT file systems. + ## Active Directory Domain Services (AD DS) + ### What if BitLocker is enabled on a computer before the computer has joined the domain? + If BitLocker is enabled on a drive before Group Policy has been applied to enforce backup, the recovery information will not be automatically backed up to AD DS when the computer joins the domain or when Group Policy is subsequently applied. However, you can use the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed drives can be recovered** and **Choose how BitLocker-protected removable drives can be recovered** Group Policy settings to require that the computer be connected to a domain before BitLocker can be enabled to help ensure that recovery information for BitLocker-protected drives in your organization is backed up to AD DS. + For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). + The BitLocker Windows Management Instrumentation (WMI) interface does allow administrators to write a script to back up or synchronize an online client's existing recovery information; however, BitLocker does not automatically manage this process. The manage-bde command-line tool can also be used to manually back up recovery information to AD DS. For example, to back up all of the recovery information for the C: drive to AD DS, you would use the following command from an elevated command prompt: **manage-bde -protectors -adbackup C:**. -**Important**   -Joining a computer to the domain should be the first step for new computers within an organization. After computers are joined to a domain, storing the BitLocker recovery key to AD DS is automatic (when enabled in Group Policy). + +>**Important:**  Joining a computer to the domain should be the first step for new computers within an organization. After computers are joined to a domain, storing the BitLocker recovery key to AD DS is automatic (when enabled in Group Policy).   ### Is there an event log entry recorded on the client computer to indicate the success or failure of the Active Directory backup? + Yes, an event log entry that indicates the success or failure of an Active Directory backup is recorded on the client computer. However, even if an event log entry says "Success," the information could have been subsequently removed from AD DS, or BitLocker could have been reconfigured in such a way that the Active Directory information can no longer unlock the drive (such as by removing the recovery password key protector). In addition, it is also possible that the log entry could be spoofed. + Ultimately, determining whether a legitimate backup exists in AD DS requires querying AD DS with domain administrator credentials by using the BitLocker password viewer tool. + ### If I change the BitLocker recovery password on my computer and store the new password in AD DS, will AD DS overwrite the old password? + No. By design, BitLocker recovery password entries do not get deleted from AD DS; therefore, you might see multiple passwords for each drive. To identify the latest password, check the date on the object. + ### What happens if the backup initially fails? Will BitLocker retry the backup? + If the backup initially fails, such as when a domain controller is unreachable at the time when the BitLocker setup wizard is run, BitLocker does not try again to back up the recovery information to AD DS. + When an administrator selects the **Require BitLocker backup to AD DS** check box of the **Store BitLocker recovery information in Active Directory Domain Service (Windows 2008 and Windows Vista)** policy setting, or the equivalent **Do not enable BitLocker until recovery information is stored in AD DS for (operating system | fixed data | removable data) drives** check box in any of the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed data drives can be recovered**, **Choose how BitLocker-protected removable data drives can be recovered** policy settings, this prevents users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. With these settings configured if the backup fails, BitLocker cannot be enabled, ensuring that administrators will be able to recover BitLocker-protected drives in the organization. + For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). + When an administrator clears these check boxes, the administrator is allowing a drive to be BitLocker-protected without having the recovery information successfully backed up to AD DS; however, BitLocker will not automatically retry the backup if it fails. Instead, administrators can create a script for the backup, as described earlier in [What if BitLocker is enabled on a computer before the computer has joined the domain?](#bkmk-adretro) to capture the information after connectivity is restored. + ## Security + ### What form of encryption does BitLocker use? Is it configurable? + BitLocker uses Advanced Encryption Standard (AES) as its encryption algorithm with configurable key lengths of 128 or 256 bits. The default encryption setting is AES-128, but the options are configurable by using Group Policy. + ### What is the best practice for using BitLocker on an operating system drive? + The recommended practice for BitLocker configuration on an operating system drive is to implement BitLocker on a computer with a TPM version 1.2 or higher and a Trusted Computing Group (TCG)-compliant BIOS or UEFI firmware implementation, plus a PIN. By requiring a PIN that was set by the user in addition to the TPM validation, a malicious user that has physical access to the computer cannot simply start the computer. + ### What are the implications of using the sleep or hibernate power management options? + BitLocker on operating system drives in its basic configuration (with a TPM but without advanced authentication) provides additional security for the hibernate mode. However, BitLocker provides greater security when it is configured to use an advanced authentication mode (TPM+PIN, TPM+USB, or TPM+PIN+USB) with the hibernate mode. This method is more secure because returning from hibernation requires BitLocker authentication. As a best practice, we recommend that sleep mode be disabled and that you use TPM+PIN for the authentication method. + ### What are the advantages of a TPM? + Most operating systems use a shared memory space and rely on the operating system to manage physical memory. A TPM is a hardware component that uses its own internal firmware and logic circuits for processing instructions, thus shielding it from external software vulnerabilities. Attacking the TPM requires physical access to the computer. Additionally, the tools and skills necessary to attack hardware are often more expensive, and usually are not as available as the ones used to attack software. And because each TPM is unique to the computer that contains it, attacking multiple TPM computers would be difficult and time-consuming. -**Note**   -Configuring BitLocker with an additional factor of authentication provides even more protection against TPM hardware attacks. + +>**Note:**  Configuring BitLocker with an additional factor of authentication provides even more protection against TPM hardware attacks.   ## BitLocker Network Unlock + BitLocker Network Unlock enables easier management for BitLocker-enabled desktops and servers that use the TPM+PIN protection method in a domain environment. When a computer that is connected to a wired corporate network is rebooted, Network Unlock allows the PIN entry prompt to be bypassed. It automatically unlocks BitLocker-protected operating system volumes by using a trusted key that is provided by the Windows Deployment Services server as its secondary authentication method. + To use Network Unlock you must also have a PIN configured for your computer. When your computer is not connected to the network you will need to provide the PIN to unlock it. + BitLocker Network Unlock has software and hardware requirements for both client computers, Windows Deployment services, and domain controllers that must be met before you can use it. -Network Unlock uses two protectors, the TPM protector and the one provided by the network or by your PIN, whereas automatic unlock uses a single protector, the one stored in the TPM. If the computer is joined to a network without the key protector it will prompt you to enter your PIN. If the PIN is not available you will need to use the recovery key to unlock the computer if it can ot be connected to the network. + +Network Unlock uses two protectors, the TPM protector and the one provided by the network or by your PIN, whereas automatic unlock uses a single protector, the one stored in the TPM. If the computer is joined to a network without the key protector it will prompt you to enter your PIN. If the PIN is +not available you will need to use the recovery key to unlock the computer if it can ot be connected to the network. + For more info, see [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md). + ## Other questions + ### Can I run a kernel debugger with BitLocker? + Yes. However, the debugger should be turned on before enabling BitLocker. Turning on the debugger ensures that the correct measurements are calculated when sealing to the TPM, allowing the computer to start properly. If you need to turn debugging on or off when using BitLocker, be sure to suspend BitLocker first to avoid putting your computer into recovery mode. + ### How does BitLocker handle memory dumps? + BitLocker has a storage driver stack that ensures memory dumps are encrypted when BitLocker is enabled. + ### Can BitLocker support smart cards for pre-boot authentication? + BitLocker does not support smart cards for pre-boot authentication. There is no single industry standard for smart card support in the firmware, and most computers either do not implement firmware support for smart cards, or only support specific smart cards and readers. This lack of standardization makes supporting them very difficult. + ### Can I use a non-Microsoft TPM driver? + Microsoft does not support non-Microsoft TPM drivers and strongly recommends against using them with BitLocker. Attempting to use a non-Microsoft TPM driver with BitLocker may cause BitLocker to report that a TPM is not present on the computer and not allow the TPM to be used with BitLocker. + ### Can other tools that manage or modify the master boot record work with BitLocker? + We do not recommend modifying the master boot record on computers whose operating system drives are BitLocker-protected for a number of security, reliability, and product support reasons. Changes to the master boot record (MBR) could change the security environment and prevent the computer from starting normally, as well as complicate any efforts to recover from a corrupted MBR. Changes made to the MBR by anything other than Windows might force the computer into recovery mode or prevent it from booting entirely. + ### Why is the system check failing when I am encrypting my operating system drive? + The system check is designed to ensure your computer's BIOS or UEFI firmware is compatible with BitLocker and that the TPM is working correctly. The system check can fail for several reasons: + - The computer's BIOS or UEFI firmware cannot read USB flash drives. - The computer's BIOS, uEFI firmware, or boot menu does not have reading USB flash drives enabled. - There are multiple USB flash drives inserted into the computer. @@ -238,27 +386,45 @@ The system check is designed to ensure your computer's BIOS or UEFI firmware is - The computer's BIOS or UEFI firmware only supports using the function keys (F1–F10) to enter numerals in the pre-boot environment. - The startup key was removed before the computer finished rebooting. - The TPM has malfunctioned and fails to unseal the keys. + ### What can I do if the recovery key on my USB flash drive cannot be read? + Some computers cannot read USB flash drives in the pre-boot environment. First, check your BIOS or UEFI firmware and boot settings to ensure that the use of USB drives is enabled. If it is not enabled, enable the use of USB drives in the BIOS or UEFI firmware and boot settings and then try to read the recovery key from the USB flash drive again. If it still cannot be read, you will have to mount the hard drive as a data drive on another computer so that there is an operating system to attempt to read the recovery key from the USB flash drive. If the USB flash drive has been corrupted or damaged, you may need to supply a recovery password or use the recovery information that was backed up to AD DS. Also, if you are using the recovery key in the pre-boot environment, ensure that the drive is formatted by using the NTFS, FAT16, or FAT32 file system. + ### Why am I unable to save my recovery key to my USB flash drive? + The **Save to USB** option is not shown by default for removable drives. If the option is unavailable, it means that a system administrator has disallowed the use of recovery keys. + ### Why am I unable to automatically unlock my drive? + Automatic unlocking for fixed data drives requires that the operating system drive also be protected by BitLocker. If you are using a computer that does not have a BitLocker-protected operating system drive, the drive cannot be automatically unlocked. For removable data drives, you can add automatic unlocking by right-clicking the drive in Windows Explorer and clicking **Manage BitLocker**. You will still be able to use the password or smart card credentials you supplied when you turned on BitLocker to unlock the removable drive on other computers. + ### Can I use BitLocker in Safe Mode? + Limited BitLocker functionality is available in Safe Mode. BitLocker-protected drives can be unlocked and decrypted by using the **BitLocker Drive Encryption** Control Panel item. Right-clicking to access BitLocker options from Windows Explorer is not available in Safe Mode. + ### How do I "lock" a data drive? + Both fixed and removable data drives can be locked by using the Manage-bde command-line tool and the –lock command. -**Note**   -Ensure all data is saved to the drive before locking it. Once locked, the drive will become inaccessible. + +>**Note:**  Ensure all data is saved to the drive before locking it. Once locked, the drive will become inaccessible.   The syntax of this command is: -**manage-bde** *<driveletter>* **-lock** + +`manage-bde -lock` + Outside of using this command, data drives will be locked on shutdown and restart of the operating system. A removable data drive will also be locked automatically when the drive is removed from the computer. + ### Can I use BitLocker with the Volume Shadow Copy Service? + Yes. However, shadow copies made prior to enabling BitLocker will be automatically deleted when BitLocker is enabled on software-encrypted drives. If you are using a hardware encrypted drive, the shadow copies are retained. + ### Does BitLocker support virtual hard disks (VHDs)? + BitLocker is not supported on bootable VHDs, but BitLocker is supported on data volume VHDs, such as those used by clusters, if you are running Windows 10, Windows 8.1, Windows 8, Windows Server 2012, or Windows Server 2012 R2. + ## More information + - [Prepare your organization for BitLocker: Planning and Policies](prepare-your-organization-for-bitlocker-planning-and-policies.md) - [BitLocker Group Policy settings](bitlocker-group-policy-settings.md) - [BCD settings and BitLocker](bcd-settings-and-bitlocker.md) @@ -267,5 +433,3 @@ BitLocker is not supported on bootable VHDs, but BitLocker is supported on data - [BitLocker: Use BitLocker Drive Encryption Tools to manage BitLocker](bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md) - [BitLocker: Use BitLocker Recovery Password Viewer](bitlocker-use-bitlocker-recovery-password-viewer.md) - [BitLocker Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/6f49f904-e04d-4b90-afbc-84bc45d4d30d) -  -  diff --git a/windows/keep-secure/bitlocker-group-policy-settings.md b/windows/keep-secure/bitlocker-group-policy-settings.md index 2179049ec9..77412bda71 100644 --- a/windows/keep-secure/bitlocker-group-policy-settings.md +++ b/windows/keep-secure/bitlocker-group-policy-settings.md @@ -2,26 +2,36 @@ title: BitLocker Group Policy settings (Windows 10) description: This topic for IT professionals describes the function, location, and effect of each Group Policy setting that is used to manage BitLocker Drive Encryption. ms.assetid: 4904e336-29fe-4cef-bb6c-3950541864af -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # BitLocker Group Policy settings + **Applies to** - Windows 10 + This topic for IT professionals describes the function, location, and effect of each Group Policy setting that is used to manage BitLocker Drive Encryption. + To control what drive encryption tasks the user can perform from the Windows Control Panel or to modify other configuration options, you can use Group Policy administrative templates or local computer policy settings. How you configure these policy settings depends on how you implement BitLocker and what level of user interaction will be allowed. -**Note**   -A separate set of Group Policy settings supports the use of the Trusted Platform Module (TPM). For details about those settings, see [Trusted Platform Module Group Policy settings](trusted-platform-module-services-group-policy-settings.md). + +>**Note:**  A separate set of Group Policy settings supports the use of the Trusted Platform Module (TPM). For details about those settings, see [Trusted Platform Module Group Policy settings](trusted-platform-module-services-group-policy-settings.md).   BitLocker Group Policy settings can be accessed using the Local Group Policy Editor and the Group Policy Management Console (GPMC) under **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption**. Most of the BitLocker Group Policy settings are applied when BitLocker is initially turned on for a drive. If a computer is not compliant with existing Group Policy settings, BitLocker may not be turned on or modified until the computer is in a compliant state. When a drive is out of compliance with Group Policy settings (for example, if a Group Policy setting was changed after the initial BitLocker deployment in your organization, and then the setting was applied to previously encrypted drives), no change can be made to the BitLocker configuration of that drive except a change that will bring it into compliance. -If multiple changes are necessary to bring the drive into compliance, you must suspend BitLocker protection, make the necessary changes, and then resume protection. This situation could occur, for example, if a removable drive was initially configured to be unlocked with a password and then Group Policy settings are changed to disallow passwords and require smart cards. In this situation, you need to suspend BitLocker protection by using the [Manage-bde](http://technet.microsoft.com/library/ff829849.aspx) command-line tool, delete the password unlock method, and add the smart card method. After this is complete, BitLocker is compliant with the Group Policy setting and BitLocker protection on the drive can be resumed. + +If multiple changes are necessary to bring the drive into compliance, you must suspend BitLocker protection, make the necessary changes, and then resume protection. This situation could occur, for example, if a removable drive was initially configured to be unlocked with a password and then Group +Policy settings are changed to disallow passwords and require smart cards. In this situation, you need to suspend BitLocker protection by using the [Manage-bde](http://technet.microsoft.com/library/ff829849.aspx) command-line tool, delete the password unlock method, and add the smart card method. After this is complete, BitLocker is compliant with the Group Policy setting and BitLocker protection on the drive can be resumed. + ## BitLocker Group Policy settings + The following sections provide a comprehensive list of BitLocker Group Policy settings that are organized by usage. BitLocker Group Policy settings include settings for specific drive types (operating system drives, fixed data drives, and removable data drives) and settings that are applied to all drives. + The following policy settings can be used to determine how a BitLocker-protected drive can be unlocked. + - [Allow network unlock at startup](#bkmk-netunlock) - [Require additional authentication at startup](#bkmk-unlockpol1) - [Allow enhanced PINs for startup](#bkmk-unlockpol2) @@ -35,11 +45,15 @@ The following policy settings can be used to determine how a BitLocker-protected - [Configure use of passwords on removable data drives](#bkmk-unlockpol8) - [Validate smart card certificate usage rule compliance](#bkmk-unlockpol9) - [Enable use of BitLocker authentication requiring preboot keyboard input on slates](#bkmk-slates) + The following policy settings are used to control how users can access drives and how they can use BitLocker on their computers. + - [Deny write access to fixed drives not protected by BitLocker](#bkmk-driveaccess1) - [Deny write access to removable drives not protected by BitLocker](#bkmk-driveaccess2) - [Control use of BitLocker on removable drives](#bkmk-driveaccess3) + The following policy settings determine the encryption methods and encryption types that are used with BitLocker. + - [Choose drive encryption method and cipher strength](#bkmk-encryptmeth) - [Configure use of hardware-based encryption for fixed data drives](#bkmk-hdefxd) - [Configure use of hardware-based encryption for operating system drives](#bkmk-hdeosd) @@ -47,7 +61,9 @@ The following policy settings determine the encryption methods and encryption ty - [Enforce drive encryption type on fixed data drives](#bkmk-detypefdd) - [Enforce drive encryption type on operating system drives](#bkmk-detypeosd) - [Enforce drive encryption type on removable data drives](#bkmk-detyperdd) + The following policy settings define the recovery methods that can be used to restore access to a BitLocker-protected drive if an authentication method fails or is unable to be used. + - [Choose how BitLocker-protected operating system drives can be recovered](#bkmk-rec1) - [Choose how users can recover BitLocker-protected drives (Windows Server 2008 and Windows Vista)](#bkmk-rec2) - [Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista)](#bkmk-rec3) @@ -55,7 +71,9 @@ The following policy settings define the recovery methods that can be used to re - [Choose how BitLocker-protected fixed drives can be recovered](#bkmk-rec6) - [Choose how BitLocker-protected removable drives can be recovered](#bkmk-rec7) - [Configure the pre-boot recovery message and URL](#bkmk-configurepreboot) + The following policies are used to support customized deployment scenarios in your organization. + - [Allow Secure Boot for integrity validation](#bkmk-secboot) - [Provide the unique identifiers for your organization](#bkmk-depopt1) - [Prevent memory overwrite on restart](#bkmk-depopt2) @@ -66,8 +84,11 @@ The following policies are used to support customized deployment scenarios in yo - [Use enhanced Boot Configuration Data validation profile](#bkmk-enbcd) - [Allow access to BitLocker-protected fixed data drives from earlier versions of Windows](#bkmk-depopt4) - [Allow access to BitLocker-protected removable data drives from earlier versions of Windows](#bkmk-depopt5) + ### Allow network unlock at startup + This policy controls a portion of the behavior of the Network Unlock feature in BitLocker. This policy is required to enable BitLocker Network Unlock on a network because it allows clients running BitLocker to create the necessary network key protector during encryption. This policy is used in addition to the BitLocker Drive Encryption Network Unlock Certificate security policy (located in the **Public Key Policies** folder of Local Computer Policy) to allow systems that are connected to a trusted network to properly utilize the Network Unlock feature. + @@ -106,13 +127,17 @@ This policy controls a portion of the behavior of the Network Unlock feature in
        **Reference** + To use a network key protector to unlock the computer, the computer and the server that hosts BitLocker Drive Encryption Network Unlock must be provisioned with a Network Unlock certificate. The Network Unlock certificate is used to create a network key protector and to protect the information exchange with the server to unlock the computer. You can use the Group Policy setting **Computer Configuration\\Windows Settings\\Security Settings\\Public Key Policies\\BitLocker Drive Encryption Network Unlock Certificate** on the domain controller to distribute this certificate to computers in your organization. This unlock method uses the TPM on the computer, so computers that do not have a TPM cannot create network key protectors to automatically unlock by using Network Unlock. -**Note**   -For reliability and security, computers should also have a TPM startup PIN that can be used when the computer is disconnected from the wired network or cannot connect to the domain controller at startup. + +>**Note:**  For reliability and security, computers should also have a TPM startup PIN that can be used when the computer is disconnected from the wired network or cannot connect to the domain controller at startup.   For more information about Network Unlock, see [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md). + ### Require additional authentication at startup + This policy setting is used to control which unlock options are available for operating system drives. + @@ -153,31 +178,43 @@ This policy setting is used to control which unlock options are available for op
        **Reference** + If you want to use BitLocker on a computer without a TPM, select the **Allow BitLocker without a compatible TPM** check box. In this mode, a USB drive is required for startup. Key information that is used to encrypt the drive is stored on the USB drive, which creates a USB key. When the USB key is inserted, access to the drive is authenticated and the drive is accessible. If the USB key is lost or unavailable, you need to use one of the BitLocker recovery options to access the drive. + On a computer with a compatible TPM, four types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use: + - only the TPM for authentication - insertion of a USB flash drive containing the startup key - the entry of a 4-digit to 20-digit personal identification number (PIN) - a combination of the PIN and the USB flash drive + There are four options for TPM-enabled computers or devices: + - Configure TPM startup + - Allow TPM - Require TPM - Do not allow TPM - Configure TPM startup PIN + - Allow startup PIN with TPM - Require startup PIN with TPM - Do not allow startup PIN with TPM - Configure TPM startup key + - Allow startup key with TPM - Require startup key with TPM - Do not allow startup key with TPM - Configure TPM startup key and PIN + - Allow TPM startup key with PIN - Require startup key and PIN with TPM - Do not allow TPM startup key with PIN + ### Allow enhanced PINs for startup + This policy setting permits the use of enhanced PINs when you use an unlock method that includes a PIN. + @@ -215,13 +252,17 @@ This policy setting permits the use of enhanced PINs when you use an unlock meth
        + **Reference** + Enhanced startup PINs permit the use of characters (including uppercase and lowercase letters, symbols, numbers, and spaces). This policy setting is applied when you turn on BitLocker. -**Important**   -Not all computers support enhanced PIN characters in the preboot environment. It is strongly recommended that users perform a system check during the BitLocker setup to verify that enhanced PIN characters can be used. + +>**Important:**  Not all computers support enhanced PIN characters in the preboot environment. It is strongly recommended that users perform a system check during the BitLocker setup to verify that enhanced PIN characters can be used.   ### Configure minimum PIN length for startup + This policy setting is used to set a minimum PIN length when you use an unlock method that includes a PIN. + @@ -260,9 +301,13 @@ This policy setting is used to set a minimum PIN length when you use an unlock m
        **Reference** + This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 4 digits and can have a maximum length of 20 digits. + ### Disallow standard users from changing the PIN or password + This policy setting allows you to configure whether standard users are allowed to change the PIN or password that is used to protect the operating system drive. + @@ -300,10 +345,15 @@ This policy setting allows you to configure whether standard users are allowed t
        + **Reference** + To change the PIN or password, the user must be able to provide the current PIN or password. This policy setting is applied when you turn on BitLocker. + ### Configure use of passwords for operating system drives + This policy controls how non-TPM based systems utilize the password protector. Used in conjunction with the **Password must meet complexity requirements** policy, this policy allows administrators to require password length and complexity for using the password protector. By default, passwords must be eight characters in length. Complexity configuration options determine how important domain connectivity is for the client. For the strongest password security, administrators should choose **Require password complexity** because it requires domain connectivity, and it requires that the BitLocker password meets the same password complexity requirements as domain sign-in passwords. + @@ -348,19 +398,26 @@ This policy controls how non-TPM based systems utilize the password protector. U
        + **Reference** + If non-TPM protectors are allowed on operating system drives, you can provision a password, enforce complexity requirements on the password, and configure a minimum length for the password. For the complexity requirement setting to be effective, the Group Policy setting **Password must meet complexity requirements**, which is located at **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy\\** must be also enabled. -**Note**   -These settings are enforced when turning on BitLocker, not when unlocking a volume. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. + +>**Note:**  These settings are enforced when turning on BitLocker, not when unlocking a volume. BitLocker allows unlocking a drive with any of the protectors that are available on the drive.   When set to **Require complexity**, a connection to a domain controller is necessary when BitLocker is enabled to validate the complexity the password. When set to **Allow complexity**, a connection to a domain controller is attempted to validate that the complexity adheres to the rules set by the policy. If no domain controllers are found, the password will be accepted regardless of actual password complexity, and the drive will be encrypted by using that password as a protector. When set to **Do not allow complexity**, there is no password complexity validation. Passwords must be at least 8 characters. To configure a greater minimum length for the password, enter the desired number of characters in the **Minimum password length** box. + When this policy setting is enabled, you can set the option **Configure password complexity for operating system drives** to: + - Allow password complexity - Do not allow password complexity - Require password complexity + ### Require additional authentication at startup (Windows Server 2008 and Windows Vista) + This policy setting is used to control what unlock options are available for computers running Windows Server 2008 or Windows Vista. + @@ -399,21 +456,32 @@ This policy setting is used to control what unlock options are available for com
        **Reference** + On a computer with a compatible TPM, two authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can require users to insert a USB drive that contains a startup key. It can also require users to enter a 4-digit to 20-digit startup PIN. + A USB drive that contains a startup key is needed on computers without a compatible TPM. Without a TPM, BitLocker-encrypted data is protected solely by the key material that is on this USB drive. + There are two options for TPM-enabled computers or devices: + - Configure TPM startup PIN + - Allow startup PIN with TPM - Require startup PIN with TPM - Do not allow startup PIN with TPM - Configure TPM startup key + - Allow startup key with TPM - Require startup key with TPM - Do not allow startup key with TPM + These options are mutually exclusive. If you require the startup key, you must not allow the startup PIN. If you require the startup PIN, you must not allow the startup key. Otherwise, a policy error will occur. + To hide the advanced page on a TPM-enabled computer or device, set these options to **Do not allow** for the startup key and for the startup PIN. + ### Configure use of smart cards on fixed data drives + This policy setting is used to require, allow, or deny the use of smart cards with fixed data drives. + @@ -456,11 +524,13 @@ This policy setting is used to require, allow, or deny the use of smart cards wi
        **Reference** -**Note**   -These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive by using any of the protectors that are available on the drive. + +>**Note:**  These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive by using any of the protectors that are available on the drive.   ### Configure use of passwords on fixed data drives + This policy setting is used to require, allow, or deny the use of passwords with fixed data drives. + @@ -503,21 +573,28 @@ This policy setting is used to require, allow, or deny the use of passwords with
        **Reference** + When set to **Require complexity**, a connection to a domain controller is necessary to validate the complexity of the password when BitLocker is enabled. + When set to **Allow complexity**, a connection to a domain controller is attempted to validate that the complexity adheres to the rules set by the policy. However, if no domain controllers are found, the password is accepted regardless of the actual password complexity, and the drive is encrypted by using that password as a protector. + When set to **Do not allow complexity**, no password complexity validation is performed. + Passwords must be at least 8 characters. To configure a greater minimum length for the password, enter the desired number of characters in the **Minimum password length** box. -**Note**   -These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. + +>**Note:**  These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive.   For the complexity requirement setting to be effective, the Group Policy setting **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy\\Password must meet complexity requirements** must also be enabled. This policy setting is configured on a per-computer basis. This means that it applies to local user accounts and domain user accounts. Because the password filter that is used to validate password complexity is located on the domain controllers, local user accounts cannot access the password filter because they are not authenticated for domain access. When this policy setting is enabled, if you sign in with a local user account, and you attempt to encrypt a drive or change a password on an existing BitLocker-protected drive, an "Access denied" error message is displayed. In this situation, the password key protector cannot be added to the drive. + Enabling this policy setting requires that connectivity to a domain be established before adding a password key protector to a BitLocker-protected drive. Users who work remotely and have periods of time in which they cannot connect to the domain should be made aware of this requirement so that they can schedule a time when they will be connected to the domain to turn on BitLocker or to change a password on a BitLocker-protected data drive. -**Important**   -Passwords cannot be used if FIPS compliance is enabled. The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting in **Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** specifies whether FIPS compliance is enabled. + +>**Important:**  Passwords cannot be used if FIPS compliance is enabled. The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting in **Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** specifies whether FIPS compliance is enabled.   ### Configure use of smart cards on removable data drives + This policy setting is used to require, allow, or deny the use of smart cards with removable data drives. + @@ -560,11 +637,13 @@ This policy setting is used to require, allow, or deny the use of smart cards wi
        **Reference** -**Note**   -These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. + +>**Note:**  These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive.   ### Configure use of passwords on removable data drives + This policy setting is used to require, allow, or deny the use of passwords with removable data drives. + @@ -607,20 +686,28 @@ This policy setting is used to require, allow, or deny the use of passwords with
        **Reference** -If you choose to allow the use of a password, you can require a password to be used, enforce complexity requirements, and configure a minimum length. For the complexity requirement setting to be effective, the Group Policy setting **Password must meet complexity requirements**, which is located at **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy** must also be enabled. -**Note**   -These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. + +If you choose to allow the use of a password, you can require a password to be used, enforce complexity requirements, and configure a minimum length. For the complexity requirement setting to be effective, the Group Policy setting **Password must meet complexity requirements**, which is located at +**Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy** must also be enabled. + +>**Note:**  These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive.   Passwords must be at least 8 characters. To configure a greater minimum length for the password, enter the desired number of characters in the **Minimum password length** box. + When set to **Require complexity**, a connection to a domain controller is necessary when BitLocker is enabled to validate the complexity the password. + When set to **Allow complexity**, a connection to a domain controller will be attempted to validate that the complexity adheres to the rules set by the policy. However, if no domain controllers are found, the password will still be accepted regardless of actual password complexity and the drive will be encrypted by using that password as a protector. + When set to **Do not allow complexity**, no password complexity validation will be done. -**Note**   -Passwords cannot be used if FIPS compliance is enabled. The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting in **Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** specifies whether FIPS compliance is enabled. + +>**Note:**  Passwords cannot be used if FIPS compliance is enabled. The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting in **Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** specifies whether FIPS compliance is enabled.   For information about this setting, see [System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing](http://technet.microsoft.com/library/jj852211.aspx). + ### Validate smart card certificate usage rule compliance + This policy setting is used to determine what certificate to use with BitLocker. + @@ -659,14 +746,19 @@ This policy setting is used to determine what certificate to use with BitLocker.
        **Reference** + This policy setting is applied when you turn on BitLocker. + The object identifier is specified in the enhanced key usage (EKU) of a certificate. BitLocker can identify which certificates can be used to authenticate a user certificate to a BitLocker-protected drive by matching the object identifier in the certificate with the object identifier that is defined by this policy setting. + The default object identifier is 1.3.6.1.4.1.311.67.1.1. -**Note**   -BitLocker does not require that a certificate have an EKU attribute; however, if one is configured for the certificate, it must be set to an object identifier that matches the object identifier configured for BitLocker. + +>**Note:**  BitLocker does not require that a certificate have an EKU attribute; however, if one is configured for the certificate, it must be set to an object identifier that matches the object identifier configured for BitLocker.   ### Enable use of BitLocker authentication requiring preboot keyboard input on slates + This policy setting allows users to enable authentication options that require user input from the preboot environment even if the platform indicates a lack of preboot input capability. + @@ -705,15 +797,23 @@ This policy setting allows users to enable authentication options that require u
        **Reference** + The Windows touch keyboard (such as used by tablets) is not available in the preboot environment where BitLocker requires additional information, such as a PIN or password. + It is recommended that administrators enable this policy only for devices that are verified to have an alternative means of preboot input, such as attaching a USB keyboard. + When the Windows Recovery Environment is not enabled and this policy is not enabled, you cannot turn on BitLocker on a device that uses the Windows touch keyboard. + If you do not enable this policy setting, the following options in the **Require additional authentication at startup** policy might not be available: + - Configure TPM startup PIN: Required and Allowed - Configure TPM startup key and PIN: Required and Allowed - Configure use of passwords for operating system drives + ### Deny write access to fixed drives not protected by BitLocker + This policy setting is used to require encryption of fixed drives prior to granting Write access. + @@ -752,16 +852,23 @@ This policy setting is used to require encryption of fixed drives prior to grant
        **Reference** + This policy setting is applied when you turn on BitLocker. + Conflict considerations include: + 1. When this policy setting is enabled, users receive "Access denied" error messages when they try to save data to unencrypted fixed data drives. See the Reference section for additional conflicts. 2. If BdeHdCfg.exe is run on a computer when this policy setting is enabled, you could encounter the following issues: + - If you attempted to shrink the drive and create the system drive, the drive size is successfully reduced and a raw partition is created. However, the raw partition is not formatted. The following error message is displayed: "The new active drive cannot be formatted. You may need to manually prepare your drive for BitLocker." - If you attempt to use unallocated space to create the system drive, a raw partition will be created. However, the raw partition will not be formatted. The following error message is displayed: "The new active drive cannot be formatted. You may need to manually prepare your drive for BitLocker." - If you attempt to merge an existing drive into the system drive, the tool fails to copy the required boot file onto the target drive to create the system drive. The following error message is displayed: "BitLocker setup failed to copy boot files. You may need to manually prepare your drive for BitLocker." 3. If this policy setting is enforced, a hard drive cannot be repartitioned because the drive is protected. If you are upgrading computers in your organization from a previous version of Windows, and those computers were configured with a single partition, you should create the required BitLocker system partition before you apply this policy setting to the computers. + ### Deny write access to removable drives not protected by BitLocker + This policy setting is used to require that removable drives are encrypted prior to granting Write access, and to control whether BitLocker-protected removable drives that were configured in another organization can be opened with Write access. + @@ -800,16 +907,21 @@ This policy setting is used to require that removable drives are encrypted prior
        **Reference** + If the **Deny write access to devices configured in another organization** option is selected, only drives with identification fields that match the computer's identification fields are given Write access. When a removable data drive is accessed, it is checked for a valid identification field and allowed identification fields. These fields are defined by the **Provide the unique identifiers for your organization** policy setting. -**Note**   -You can override this policy setting with the policy settings under **User Configuration\\Administrative Templates\\System\\Removable Storage Access**. If the **Removable Disks: Deny write access** policy setting is enabled, this policy setting will be ignored. + +>**Note:**  You can override this policy setting with the policy settings under **User Configuration\\Administrative Templates\\System\\Removable Storage Access**. If the **Removable Disks: Deny write access** policy setting is enabled, this policy setting will be ignored.   Conflict considerations include: + 1. Use of BitLocker with the TPM plus a startup key or with the TPM plus a PIN and startup key must be disallowed if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled. 2. Use of recovery keys must be disallowed if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled. 3. You must enable the **Provide the unique identifiers for your organization** policy setting if you want to deny Write access to drives that were configured in another organization. + ### Control use of BitLocker on removable drives + This policy setting is used to prevent users from turning BitLocker on or off on removable data drives. + @@ -852,13 +964,20 @@ This policy setting is used to prevent users from turning BitLocker on or off on
        **Reference** + This policy setting is applied when you turn on BitLocker. + For information about suspending BitLocker protection, see [BitLocker Basic Deployment](http://technet.microsoft.com/library/dn383581.aspx). + The options for choosing property settings that control how users can configure BitLocker are: + - **Allow users to apply BitLocker protection on removable data drives**   Enables the user to run the BitLocker Setup Wizard on a removable data drive. - **Allow users to suspend and decrypt BitLocker on removable data drives**   Enables the user to remove BitLocker from the drive or to suspend the encryption while performing maintenance. + ### Choose drive encryption method and cipher strength + This policy setting is used to control the encryption method and cipher strength. + @@ -897,14 +1016,18 @@ This policy setting is used to control the encryption method and cipher strength
        **Reference** + By default, BitLocker uses AES 128-bit encryption. Available options are AES-128 and AES-256. The values of this policy determine the strength of the cipher that BitLocker uses for encryption. Enterprises may want to control the encryption level for increased security (AES-256 is stronger than AES-128). Changing the encryption method has no effect if the drive is already encrypted or if encryption is in progress. In these cases, this policy setting is ignored. -**Warning**   -This policy does not apply to encrypted drives. Encrypted drives utilize their own algorithm, which is set by the drive during partitioning. + +>**Warning:**  This policy does not apply to encrypted drives. Encrypted drives utilize their own algorithm, which is set by the drive during partitioning.   When this policy setting is disabled, BitLocker uses AES with the same bit strength (128-bit or 256-bit) as specified in the policy setting **Choose drive encryption method and cipher strength (Windows Vista, Windows Server 2008, Windows 7)**. If neither policy is set, BitLocker uses the default encryption method, AES-128, or the encryption method that is specified in the setup script. + ### Configure use of hardware-based encryption for fixed data drives + This policy controls how BitLocker reacts to systems that are equipped with encrypted drives when they are used as fixed data volumes. Using hardware-based encryption can improve the performance of drive operations that involve frequent reading or writing of data to the drive. + @@ -947,14 +1070,18 @@ This policy controls how BitLocker reacts to systems that are equipped with encr
        **Reference** -**Note**   -The **Choose drive encryption method and cipher strength** policy setting does not apply to hardware-based encryption. + +>**Note:**  The **Choose drive encryption method and cipher strength** policy setting does not apply to hardware-based encryption.   The encryption algorithm that is used by hardware-based encryption is set when the drive is partitioned. By default, BitLocker uses the algorithm that is configured on the drive to encrypt the drive. The **Restrict encryption algorithms and cipher suites allowed for hardware-based encryption** option of this setting enables you to restrict the encryption algorithms that BitLocker can use with hardware encryption. If the algorithm that is set for the drive is not available, BitLocker disables the use of hardware-based encryption. Encryption algorithms are specified by object identifiers (OID), for example: + - Advanced Encryption Standard (AES) 128 in Cipher Block Chaining (CBC) mode OID: 2.16.840.1.101.3.4.1.2 - AES 256 in CBC mode OID: 2.16.840.1.101.3.4.1.42 + ### Configure use of hardware-based encryption for operating system drives + This policy controls how BitLocker reacts when encrypted drives are used as operating system drives. Using hardware-based encryption can improve the performance of drive operations that involve frequent reading or writing of data to the drive. + @@ -997,15 +1124,20 @@ This policy controls how BitLocker reacts when encrypted drives are used as oper
        **Reference** + If hardware-based encryption is not available, BitLocker software-based encryption is used instead. -**Note**   -The **Choose drive encryption method and cipher strength** policy setting does not apply to hardware-based encryption. + +>**Note:**  The **Choose drive encryption method and cipher strength** policy setting does not apply to hardware-based encryption.   The encryption algorithm that is used by hardware-based encryption is set when the drive is partitioned. By default, BitLocker uses the algorithm that is configured on the drive to encrypt the drive. The **Restrict encryption algorithms and cipher suites allowed for hardware-based encryption** option of this setting enables you to restrict the encryption algorithms that BitLocker can use with hardware encryption. If the algorithm that is set for the drive is not available, BitLocker disables the use of hardware-based encryption. Encryption algorithms are specified by object identifiers (OID), for example: + - Advanced Encryption Standard (AES) 128 in Cipher Block Chaining (CBC) mode OID: 2.16.840.1.101.3.4.1.2 - AES 256 in CBC mode OID: 2.16.840.1.101.3.4.1.42 + ### Configure use of hardware-based encryption for removable data drives + This policy controls how BitLocker reacts to encrypted drives when they are used as removable data drives. Using hardware-based encryption can improve the performance of drive operations that involve frequent reading or writing of data to the drive. + @@ -1048,15 +1180,20 @@ This policy controls how BitLocker reacts to encrypted drives when they are used
        **Reference** + If hardware-based encryption is not available, BitLocker software-based encryption is used instead. -**Note**   -The **Choose drive encryption method and cipher strength** policy setting does not apply to hardware-based encryption. + +>**Note:**  The **Choose drive encryption method and cipher strength** policy setting does not apply to hardware-based encryption.   The encryption algorithm that is used by hardware-based encryption is set when the drive is partitioned. By default, BitLocker uses the algorithm that is configured on the drive to encrypt the drive. The **Restrict encryption algorithms and cipher suites allowed for hardware-based encryption** option of this setting enables you to restrict the encryption algorithms that BitLocker can use with hardware encryption. If the algorithm that is set for the drive is not available, BitLocker disables the use of hardware-based encryption. Encryption algorithms are specified by object identifiers (OID), for example: + - Advanced Encryption Standard (AES) 128 in Cipher Block Chaining (CBC) mode OID: 2.16.840.1.101.3.4.1.2 - AES 256 in CBC mode OID: 2.16.840.1.101.3.4.1.42 + ### Enforce drive encryption type on fixed data drives + This policy controls whether fixed data drives utilize Used Space Only encryption or Full encryption. Setting this policy also causes the BitLocker Setup Wizard to skip the encryption options page so no encryption selection displays to the user. + @@ -1095,13 +1232,17 @@ This policy controls whether fixed data drives utilize Used Space Only encryptio
        **Reference** + This policy setting is applied when you turn on BitLocker. Changing the encryption type has no effect if the drive is already encrypted or if encryption is in progress. Choose Full encryption to require that the entire drive be encrypted when BitLocker is turned on. Choose Used Space Only encryption to require that only the portion of the drive that is used to store data is encrypted when BitLocker is turned on. -**Note**   -This policy is ignored when you are shrinking or expanding a volume and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space is not wiped as it would be for a drive that is using Full encryption. The user could wipe the free space on a Used Space Only drive by using the following command: **manage-bde -w**. If the volume is shrunk, no action is taken for the new free space. + +>**Note:**  This policy is ignored when you are shrinking or expanding a volume and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space is not wiped as it would be for a drive that is using Full encryption. The user could wipe the free space on a Used Space Only drive by using the following command: **manage-bde -w**. If the volume is shrunk, no action is taken for the new free space.   For more information about the tool to manage BitLocker, see [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx). + ### Enforce drive encryption type on operating system drives + This policy controls whether operating system drives utilize Full encryption or Used Space Only encryption. Setting this policy also causes the BitLocker Setup Wizard to skip the encryption options page, so no encryption selection displays to the user. + @@ -1140,13 +1281,17 @@ This policy controls whether operating system drives utilize Full encryption or
        **Reference** + This policy setting is applied when you turn on BitLocker. Changing the encryption type has no effect if the drive is already encrypted or if encryption is in progress. Choose Full encryption to require that the entire drive be encrypted when BitLocker is turned on. Choose Used Space Only encryption to require that only the portion of the drive that is used to store data is encrypted when BitLocker is turned on. -**Note**   -This policy is ignored when shrinking or expanding a volume, and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space is not wiped as it would be for a drive that uses Full encryption. The user could wipe the free space on a Used Space Only drive by using the following command: **manage-bde -w**. If the volume is shrunk, no action is taken for the new free space. + +>**Note:**  This policy is ignored when shrinking or expanding a volume, and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space is not wiped as it would be for a drive that uses Full encryption. The user could wipe the free space on a Used Space Only drive by using the following command: **manage-bde -w**. If the volume is shrunk, no action is taken for the new free space.   For more information about the tool to manage BitLocker, see [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx). + ### Enforce drive encryption type on removable data drives + This policy controls whether fixed data drives utilize Full encryption or Used Space Only encryption. Setting this policy also causes the BitLocker Setup Wizard to skip the encryption options page, so no encryption selection displays to the user. + @@ -1185,13 +1330,17 @@ This policy controls whether fixed data drives utilize Full encryption or Used S
        **Reference** + This policy setting is applied when you turn on BitLocker. Changing the encryption type has no effect if the drive is already encrypted or if encryption is in progress. Choose Full encryption to require that the entire drive be encrypted when BitLocker is turned on. Choose Used Space Only encryption to require that only the portion of the drive that is used to store data is encrypted when BitLocker is turned on. -**Note**   -This policy is ignored when shrinking or expanding a volume, and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space is not wiped as it would be for a drive that is using Full Encryption. The user could wipe the free space on a Used Space Only drive by using the following command: **manage-bde -w**. If the volume is shrunk, no action is taken for the new free space. + +>**Note:**  This policy is ignored when shrinking or expanding a volume, and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space is not wiped as it would be for a drive that is using Full Encryption. The user could wipe the free space on a Used Space Only drive by using the following command: **manage-bde -w**. If the volume is shrunk, no action is taken for the new free space.   For more information about the tool to manage BitLocker, see [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx). + ### Choose how BitLocker-protected operating system drives can be recovered + This policy setting is used to configure recovery methods for operating system drives. + @@ -1231,18 +1380,28 @@ This policy setting is used to configure recovery methods for operating system d
        **Reference** + This policy setting is applied when you turn on BitLocker. + The **Allow data recovery agent** check box is used to specify whether a data recovery agent can be used with BitLocker-protected operating system drives. Before a data recovery agent can be used, it must be added from **Public Key Policies**, which is located in the Group Policy Management Console (GPMC) or in the Local Group Policy Editor. + For more information about adding data recovery agents, see [BitLocker basic deployment](bitlocker-basic-deployment.md). + In **Configure user storage of BitLocker recovery information**, select whether users are allowed, required, or not allowed to generate a 48-digit recovery password. -Select **Omit recovery options from the BitLocker setup wizard** to prevent users from specifying recovery options when they enable BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you enable BitLocker. Instead, BitLocker recovery options for the drive are determined by the policy setting. + +Select **Omit recovery options from the BitLocker setup wizard** to prevent users from specifying recovery options when they enable BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you enable BitLocker. Instead, BitLocker recovery options for +the drive are determined by the policy setting. + In **Save BitLocker recovery information to Active Directory Domain Services**, choose which BitLocker recovery information to store in Active Directory Domain Services (AD DS) for operating system drives. If you select **Store recovery password and key packages**, the BitLocker recovery password and the key package are stored in AD DS. Storing the key package supports recovering data from a drive that is physically corrupted. If you select **Store recovery password only**, only the recovery password is stored in AD DS. + Select the **Do not enable BitLocker until recovery information is stored in AD DS for operating system drives** check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. -**Note**   -If the **Do not enable BitLocker until recovery information is stored in AD DS for operating system drives** check box is selected, a recovery password is automatically generated. + +>**Note:**  If the **Do not enable BitLocker until recovery information is stored in AD DS for operating system drives** check box is selected, a recovery password is automatically generated.   ### Choose how users can recover BitLocker-protected drives (Windows Server 2008 and Windows Vista) + This policy setting is used to configure recovery methods for BitLocker-protected drives on computers running Windows Server 2008 or Windows Vista. + @@ -1281,18 +1440,22 @@ This policy setting is used to configure recovery methods for BitLocker-protecte
        **Reference** + This policy is only applicable to computers running Windows Server 2008 or Windows Vista. This policy setting is applied when you turn on BitLocker. + Two recovery options can be used to unlock BitLocker-encrypted data in the absence of the required startup key information. Users can type a 48-digit numerical recovery password, or they can insert a USB drive that contains a 256-bit recovery key. + Saving the recovery password to a USB drive stores the 48-digit recovery password as a text file and the 256-bit recovery key as a hidden file. Saving it to a folder stores the 48-digit recovery password as a text file. Printing it sends the 48-digit recovery password to the default printer. For example, not allowing the 48-digit recovery password prevents users from printing or saving recovery information to a folder. -**Important**   -If TPM initialization is performed during the BitLocker setup, TPM owner information is saved or printed with the BitLocker recovery information. + +>**Important:**  If TPM initialization is performed during the BitLocker setup, TPM owner information is saved or printed with the BitLocker recovery information. The 48-digit recovery password is not available in FIPS-compliance mode.   -**Important**   -To prevent data loss, you must have a way to recover BitLocker encryption keys. If you do not allow both recovery options, you must enable the backup of BitLocker recovery information to AD DS. Otherwise, a policy error occurs. +>**Important:**  To prevent data loss, you must have a way to recover BitLocker encryption keys. If you do not allow both recovery options, you must enable the backup of BitLocker recovery information to AD DS. Otherwise, a policy error occurs.   ### Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista) + This policy setting is used to configure the storage of BitLocker recovery information in AD DS. This provides an administrative method of recovering data that is encrypted by BitLocker to prevent data loss due to lack of key information. + @@ -1331,17 +1494,27 @@ This policy setting is used to configure the storage of BitLocker recovery infor
        **Reference** + This policy is only applicable to computers running Windows Server 2008 or Windows Vista. + This policy setting is applied when you turn on BitLocker. + BitLocker recovery information includes the recovery password and unique identifier data. You can also include a package that contains an encryption key for a BitLocker-protected drive. This key package is secured by one or more recovery passwords, and it can help perform specialized recovery when the disk is damaged or corrupted. + If you select **Require BitLocker backup to AD DS**, BitLocker cannot be turned on unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. This option is selected by default to help ensure that BitLocker recovery is possible. + A recovery password is a 48-digit number that unlocks access to a BitLocker-protected drive. A key package contains a drive’s BitLocker encryption key, which is secured by one or more recovery passwords. Key packages may help perform specialized recovery when the disk is damaged or corrupted. + If the **Require BitLocker backup to AD DS** option is not selected, AD DS backup is attempted, but network or other backup failures do not prevent the BitLocker setup. The Backup process is not automatically retried, and the recovery password might not be stored in AD DS during BitLocker setup. TPM initialization might be needed during the BitLocker setup. Enable the **Turn on TPM backup to Active Directory Domain Services** policy setting in **Computer Configuration\\Administrative Templates\\System\\Trusted Platform Module Services** to ensure that TPM information is also backed up. + For more information about this setting, see [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md). If you are using domain controllers running Windows Server 2003 with Service Pack 1, you must first set up appropriate schema extensions and access control settings on the domain before a backup to AD DS can succeed. For more info, see [Backup the TPM recovery Information to AD DS](backup-tpm-recovery-information-to-ad-ds.md). + ### Choose default folder for recovery password + This policy setting is used to configure the default folder for recovery passwords. + @@ -1380,12 +1553,15 @@ This policy setting is used to configure the default folder for recovery passwor
        **Reference** + This policy setting is applied when you turn on BitLocker. -**Note**   -This policy setting does not prevent the user from saving the recovery password in another folder. + +>**Note:**  This policy setting does not prevent the user from saving the recovery password in another folder.   ### Choose how BitLocker-protected fixed drives can be recovered + This policy setting is used to configure recovery methods for fixed data drives. + @@ -1425,18 +1601,28 @@ This policy setting is used to configure recovery methods for fixed data drives.
        **Reference** + This policy setting is applied when you turn on BitLocker. + The **Allow data recovery agent** check box is used to specify whether a data recovery agent can be used with BitLocker-protected fixed data drives. Before a data recovery agent can be used, it must be added from **Public Key Policies**, which is located in the Group Policy Management Console (GPMC) or in the Local Group Policy Editor. + In **Configure user storage of BitLocker recovery information**, select whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key. + Select **Omit recovery options from the BitLocker setup wizard** to prevent users from specifying recovery options when they enable BitLocker on a drive. This means that you cannot specify which recovery option to use when you enable BitLocker. Instead, BitLocker recovery options for the drive are determined by the policy setting. -In **Save BitLocker recovery information to Active Directory Doman Services**, choose which BitLocker recovery information to store in AD DS for fixed data drives. If you select **Backup recovery password and key package**, the BitLocker recovery password and the key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. To recover this data, you can use the **Repair-bde** command-line tool. If you select **Backup recovery password only**, only the recovery password is stored in AD DS. + +In **Save BitLocker recovery information to Active Directory Doman Services**, choose which BitLocker recovery information to store in AD DS for fixed data drives. If you select **Backup recovery password and key package**, the BitLocker recovery password and the key package are stored in AD DS. +Storing the key package supports recovering data from a drive that has been physically corrupted. To recover this data, you can use the **Repair-bde** command-line tool. If you select **Backup recovery password only**, only the recovery password is stored in AD DS. + For more information about the BitLocker repair tool, see [Repair-bde](http://technet.microsoft.com/library/ff829851.aspx). + Select the **Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives** check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. -**Note**   -If the **Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives** check box is selected, a recovery password is automatically generated. + +>**Note:**  If the **Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives** check box is selected, a recovery password is automatically generated.   ### Choose how BitLocker-protected removable drives can be recovered + This policy setting is used to configure recovery methods for removable data drives. + @@ -1476,17 +1662,25 @@ This policy setting is used to configure recovery methods for removable data dri
        **Reference** + This policy setting is applied when you turn on BitLocker. + The **Allow data recovery agent** check box is used to specify whether a data recovery agent can be used with BitLocker-protected removable data drives. Before a data recovery agent can be used, it must be added from **Public Key Policies** , which is accessed using the GPMC or the Local Group Policy Editor. + In **Configure user storage of BitLocker recovery information**, select whether users are allowed, required, or not allowed to generate a 48-digit recovery password. + Select **Omit recovery options from the BitLocker setup wizard** to prevent users from specifying recovery options when they enable BitLocker on a drive. This means that you cannot specify which recovery option to use when you enable BitLocker. Instead, BitLocker recovery options for the drive are determined by the policy setting. + In **Save BitLocker recovery information to Active Directory Domain Services**, choose which BitLocker recovery information to store in AD DS for removable data drives. If you select **Backup recovery password and key package**, the BitLocker recovery password and the key package are stored in AD DS. If you select **Backup recovery password only**, only the recovery password is stored in AD DS. + Select the **Do not enable BitLocker until recovery information is stored in AD DS for removable data drives** check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. -**Note**   -If the **Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives** check box is selected, a recovery password is automatically generated. + +>**Note:**  If the **Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives** check box is selected, a recovery password is automatically generated.   ### Configure the pre-boot recovery message and URL + This policy setting is used to configure the entire recovery message and to replace the existing URL that is displayed on the pre-boot recovery screen when the operating system drive is locked. + @@ -1525,19 +1719,23 @@ This policy setting is used to configure the entire recovery message and to repl
        **Reference** + Enabling the **Configure the pre-boot recovery message and URL** policy setting allows you to customize the default recovery screen message and URL to assist customers in recovering their key. + Once you enable the setting you have three options: + - If you select the **Use default recovery message and URL** option, the default BitLocker recovery message and URL will be displayed on the pre-boot recovery screen. - If you select the **Use custom recovery message** option, type the custom message in the **Custom recovery message option** text box. The message that you type in the **Custom recovery message option** text box will be displayed on the pre-boot recovery screen. If a recovery URL is available, include it in the message. - If you select the **Use custom recovery URL** option, type the custom message URL in the **Custom recovery URL option** text box. The URL that you type in the **Custom recovery URL option** text box replaces the default URL in the default recovery message, which will be displayed on the pre-boot recovery screen. -**Important**   -Not all characters and languages are supported in the pre-boot environment. We strongly recommended that you verify the correct appearance of the characters that you use for the custom message and URL on the pre-boot recovery screen. + +>**Important:**  Not all characters and languages are supported in the pre-boot environment. We strongly recommended that you verify the correct appearance of the characters that you use for the custom message and URL on the pre-boot recovery screen.   -**Important**   -Because you can alter the BCDEdit commands manually before you have set Group Policy settings, you cannot return the policy setting to the default setting by selecting the **Not Configured** option after you have configured this policy setting. To return to the default pre-boot recovery screen leave the policy setting enabled and select the **Use default message** options from the **Choose an option for the pre-boot recovery message** drop-down list box. +>**Important:**  Because you can alter the BCDEdit commands manually before you have set Group Policy settings, you cannot return the policy setting to the default setting by selecting the **Not Configured** option after you have configured this policy setting. To return to the default pre-boot recovery screen leave the policy setting enabled and select the **Use default message** options from the **Choose an option for the pre-boot recovery message** drop-down list box.   ### Allow Secure Boot for integrity validation + This policy controls how BitLocker-enabled system volumes are handled in conjunction with the Secure Boot feature. Enabling this feature forces Secure Boot validation during the boot process and verifies Boot Configuration Data (BCD) settings according to the Secure Boot policy. + @@ -1577,13 +1775,16 @@ This policy controls how BitLocker-enabled system volumes are handled in conjunc
        **Reference** + Secure Boot ensures that the computer's preboot environment loads only firmware that is digitally signed by authorized software publishers. Secure Boot also provides more flexibility for managing preboot configurations than BitLocker integrity checks prior to Windows Server 2012 and Windows 8. When this policy is enabled and the hardware is capable of using Secure Boot for BitLocker scenarios, the **Use enhanced Boot Configuration Data validation profile** Group Policy setting is ignored, and Secure Boot verifies BCD settings according to the Secure Boot policy setting, which is configured separately from BitLocker. -**Warning**   -Enabling this policy might result in BitLocker recovery when manufacturer-specific firmware is updated. If you disable this policy, suspend BitLocker prior to applying firmware updates. + +>**Warning:**  Enabling this policy might result in BitLocker recovery when manufacturer-specific firmware is updated. If you disable this policy, suspend BitLocker prior to applying firmware updates.   ### Provide the unique identifiers for your organization + This policy setting is used to establish an identifier that is applied to all drives that are encrypted in your organization. + @@ -1622,15 +1823,25 @@ This policy setting is used to establish an identifier that is applied to all dr
        **Reference** + These identifiers are stored as the identification field and the allowed identification field. The identification field allows you to associate a unique organizational identifier to BitLocker-protected drives. This identifier is automatically added to new BitLocker-protected drives, and it can be updated on existing BitLocker-protected drives by using the [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx) command-line tool. + An identification field is required to manage certificate-based data recovery agents on BitLocker-protected drives and for potential updates to the BitLocker To Go Reader. BitLocker manages and updates data recovery agents only when the identification field on the drive matches the value that is configured in the identification field. In a similar manner, BitLocker updates the BitLocker To Go Reader only when the identification field on the drive matches the value that is configured for the identification field. + For more information about the tool to manage BitLocker, see [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx). + The allowed identification field is used in combination with the **Deny write access to removable drives not protected by BitLocker** policy setting to help control the use of removable drives in your organization. It is a comma-separated list of identification fields from your organization or external organizations. + You can configure the identification fields on existing drives by using the [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx) command-line tool. + When a BitLocker-protected drive is mounted on another BitLocker-enabled computer, the identification field and the allowed identification field are used to determine whether the drive is from an outside organization. + Multiple values separated by commas can be entered in the identification and allowed identification fields. The identification field can be any value up to 260 characters. + ### Prevent memory overwrite on restart + This policy setting is used to control whether the computer's memory will be overwritten the next time the computer is restarted. + @@ -1669,9 +1880,13 @@ This policy setting is used to control whether the computer's memory will be ove
        **Reference** + This policy setting is applied when you turn on BitLocker. BitLocker secrets include key material that is used to encrypt data. This policy setting applies only when BitLocker protection is enabled. + ### Configure TPM platform validation profile for BIOS-based firmware configurations + This policy setting determines what values the TPM measures when it validates early boot components before it unlocks an operating system drive on a computer with a BIOS configuration or with UEFI firmware that has the Compatibility Support Module (CSM) enabled. + @@ -1710,11 +1925,13 @@ This policy setting determines what values the TPM measures when it validates ea
        **Reference** + This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker has already been turned on with TPM protection. -**Important**   -This Group Policy setting only applies to computers with BIOS configurations or to computers with UEFI firmware with the CSM enabled. Computers that use a native UEFI firmware configuration store different values in the Platform Configuration Registers (PCRs). Use the **Configure TPM platform validation profile for native UEFI firmware configurations** Group Policy setting to configure the TPM PCR profile for computers that use native UEFI firmware. + +>**Important:**  This Group Policy setting only applies to computers with BIOS configurations or to computers with UEFI firmware with the CSM enabled. Computers that use a native UEFI firmware configuration store different values in the Platform Configuration Registers (PCRs). Use the **Configure TPM platform validation profile for native UEFI firmware configurations** Group Policy setting to configure the TPM PCR profile for computers that use native UEFI firmware.   A platform validation profile consists of a set of PCR indices that range from 0 to 23. The default platform validation profile secures the encryption key against changes to the following: + - Core Root of Trust of Measurement (CRTM), BIOS, and Platform Extensions (PCR 0) - Option ROM Code (PCR 2) - Master Boot Record (MBR) Code (PCR 4) @@ -1722,10 +1939,11 @@ A platform validation profile consists of a set of PCR indices that range from 0 - NTFS Boot Block (PCR 9) - Boot Manager (PCR 10) - BitLocker Access Control (PCR 11) -**Note**   -Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker’s sensitivity to platform modifications (malicious or authorized) is increased or decreased depending on inclusion or exclusion (respectively) of the PCRs. + +>**Note:**  Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker’s sensitivity to platform modifications (malicious or authorized) is increased or decreased depending on inclusion or exclusion (respectively) of the PCRs.   The following list identifies all of the PCRs available: + - PCR 0: Core root-of-trust for measurement, BIOS, and Platform extensions - PCR 1: Platform and motherboard configuration and data. - PCR 2: Option ROM code @@ -1739,8 +1957,11 @@ The following list identifies all of the PCRs available: - PCR 10: Boot manager - PCR 11: BitLocker access control - PCR 12-23: Reserved for future use + ### Configure TPM platform validation profile (Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2) + This policy setting determines what values the TPM measures when it validates early boot components before unlocking a drive on a computer running Windows Vista, Windows Server 2008, or Windows 7. + @@ -1779,8 +2000,11 @@ This policy setting determines what values the TPM measures when it validates ea
        **Reference** + This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker is already turned on with TPM protection. + A platform validation profile consists of a set of PCR indices that range from 0 to 23. The default platform validation profile secures the encryption key against changes to the following: + - Core Root of Trust of Measurement (CRTM), BIOS, and Platform Extensions (PCR 0) - Option ROM Code (PCR 2) - Master Boot Record (MBR) Code (PCR 4) @@ -1788,10 +2012,11 @@ A platform validation profile consists of a set of PCR indices that range from 0 - NTFS Boot Block (PCR 9) - Boot Manager (PCR 10) - BitLocker Access Control (PCR 11) -**Note**   -The default TPM validation profile PCR settings for computers that use an Extensible Firmware Interface (EFI) are the PCRs 0, 2, 4, and 11 only. + +>**Note:**  The default TPM validation profile PCR settings for computers that use an Extensible Firmware Interface (EFI) are the PCRs 0, 2, 4, and 11 only.   The following list identifies all of the PCRs available: + - PCR 0: Core root-of-trust for measurement, EFI boot and run-time services, EFI drivers embedded in system ROM, ACPI static tables, embedded SMM code, and BIOS code - PCR 1: Platform and motherboard configuration and data. Hand-off tables and EFI variables that affect system configuration - PCR 2: Option ROM code @@ -1805,11 +2030,13 @@ The following list identifies all of the PCRs available: - PCR 10: Boot manager - PCR 11: BitLocker access control - PCR 12 - 23: Reserved for future use -**Warning**   -Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker's sensitivity to platform modifications (malicious or authorized) is increased or decreased depending on inclusion or exclusion (respectively) of the PCRs. + +>**Warning:**  Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker's sensitivity to platform modifications (malicious or authorized) is increased or decreased depending on inclusion or exclusion (respectively) of the PCRs.   ### Configure TPM platform validation profile for native UEFI firmware configurations + This policy setting determines what values the TPM measures when it validates early boot components before unlocking an operating system drive on a computer with native UEFI firmware configurations. + @@ -1850,12 +2077,15 @@ This policy setting determines what values the TPM measures when it validates ea
        **Reference** + This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker is already turned on with TPM protection. -**Important**   -This Group Policy setting only applies to computers with a native UEFI firmware configuration. Computers with BIOS or UEFI firmware with a Compatibility Support Module (CSM) enabled store different values in the Platform Configuration Registers (PCRs). Use the **Configure TPM platform validation profile for BIOS-based firmware configurations** Group Policy setting to configure the TPM PCR profile for computers with BIOS configurations or for computers with UEFI firmware with a CSM enabled. + +>**Important:**  This Group Policy setting only applies to computers with a native UEFI firmware configuration. Computers with BIOS or UEFI firmware with a Compatibility Support Module (CSM) enabled store different values in the Platform Configuration Registers (PCRs). Use the **Configure TPM platform validation profile for BIOS-based firmware configurations** Group Policy setting to configure the TPM PCR profile for computers with BIOS configurations or for computers with UEFI firmware with a CSM enabled.   A platform validation profile consists of a set of Platform Configuration Register (PCR) indices ranging from 0 to 23. The default platform validation profile secures the encryption key against changes to the core system firmware executable code (PCR 0), extended or pluggable executable code (PCR 2), boot manager (PCR 4), and the BitLocker access control (PCR 11). + The following list identifies all of the PCRs available: + - PCR 0: Core System Firmware executable code - PCR 1: Core System Firmware data - PCR 2: Extended or pluggable executable code @@ -1864,7 +2094,9 @@ The following list identifies all of the PCRs available: - PCR 5: GPT/Partition Table - PCR 6: Resume from S4 and S5 Power State Events - PCR 7: Secure Boot State + For more information about this PCR, see [Platform Configuration Register (PCR)](#bkmk-pcr) in this topic. + - PCR 8: Initialized to 0 with no Extends (reserved for future use) - PCR 9: Initialized to 0 with no Extends (reserved for future use) - PCR 10: Initialized to 0 with no Extends (reserved for future use) @@ -1873,11 +2105,13 @@ The following list identifies all of the PCRs available: - PCR 13: Boot Module Details - PCR 14: Boot Authorities - PCR 15 – 23: Reserved for future use -**Warning**   -Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker's sensitivity to platform modifications (malicious or authorized) is increased or decreased depending on inclusion or exclusion (respectively) of the PCRs. + +>**Warning:**  Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker's sensitivity to platform modifications (malicious or authorized) is increased or decreased depending on inclusion or exclusion (respectively) of the PCRs.   ### Reset platform validation data after BitLocker recovery + This policy setting determines if you want platform validation data to refresh when Windows is started following a BitLocker recovery. A platform validation data profile consists of the values in a set of Platform Configuration Register (PCR) indices that range from 0 to 23. + @@ -1920,9 +2154,13 @@ This policy setting determines if you want platform validation data to refresh w
        **Reference** + For more information about the recovery process, see the [BitLocker recovery guide](bitlocker-recovery-guide-plan.md). + ### Use enhanced Boot Configuration Data validation profile + This policy setting determines specific Boot Configuration Data (BCD) settings to verify during platform validation. A platform validation uses the data in the platform validation profile, which consists of a set of Platform Configuration Register (PCR) indices that range from 0 to 23. + @@ -1965,11 +2203,13 @@ This policy setting determines specific Boot Configuration Data (BCD) settings t
        **Reference** -**Note**   -The setting that controls boot debugging (0x16000010) is always validated, and it has no effect if it is included in the inclusion or the exclusion list. + +>**Note:**  The setting that controls boot debugging (0x16000010) is always validated, and it has no effect if it is included in the inclusion or the exclusion list.   ### Allow access to BitLocker-protected fixed data drives from earlier versions of Windows + This policy setting is used to control whether access to drives is allowed by using the BitLocker To Go Reader, and if the application is installed on the drive. + @@ -2008,12 +2248,15 @@ This policy setting is used to control whether access to drives is allowed by us
        **Reference** -**Note**   -This policy setting does not apply to drives that are formatted with the NTFS file system. + +>**Note:**  This policy setting does not apply to drives that are formatted with the NTFS file system.   When this policy setting is enabled, select the **Do not install BitLocker To Go Reader on FAT formatted fixed drives** check box to help prevent users from running BitLocker To Go Reader from their fixed drives. If BitLocker To Go Reader (bitlockertogo.exe) is present on a drive that does not have an identification field specified, or if the drive has the same identification field as specified in the **Provide unique identifiers for your organization** policy setting, the user is prompted to update BitLocker, and BitLocker To Go Reader is deleted from the drive. In this situation, for the fixed drive to be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2, BitLocker To Go Reader must be installed on the computer. If this check box is not selected, BitLocker To Go Reader will be installed on the fixed drive to enable users to unlock the drive on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2. + ### Allow access to BitLocker-protected removable data drives from earlier versions of Windows + This policy setting controls access to removable data drives that are using the BitLocker To Go Reader and whether the BitLocker To Go Reader can be installed on the drive. + @@ -2052,12 +2295,15 @@ This policy setting controls access to removable data drives that are using the
        **Reference** -**Note**   -This policy setting does not apply to drives that are formatted with the NTFS file system. + +>**Note:**  This policy setting does not apply to drives that are formatted with the NTFS file system.   When this policy setting is enabled, select the **Do not install BitLocker To Go Reader on FAT formatted removable drives** check box to help prevent users from running BitLocker To Go Reader from their removable drives. If BitLocker To Go Reader (bitlockertogo.exe) is present on a drive that does not have an identification field specified, or if the drive has the same identification field as specified in the **Provide unique identifiers for your organization** policy setting, the user will be prompted to update BitLocker, and BitLocker To Go Reader is deleted from the drive. In this situation, for the removable drive to be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2, BitLocker To Go Reader must be installed on the computer. If this check box is not selected, BitLocker To Go Reader will be installed on the removable drive to enable users to unlock the drive on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2 that do not have BitLocker To Go Reader installed. + ## FIPS setting + You can configure the Federal Information Processing Standard (FIPS) setting for FIPS compliance. As an effect of FIPS compliance, users cannot create or save a BitLocker password for recovery or as a key protector. The use of a recovery key is permitted. + @@ -2096,28 +2342,44 @@ You can configure the Federal Information Processing Standard (FIPS) setting for
        **Reference** + This policy needs to be enabled before any encryption key is generated for BitLocker. Note that when this policy is enabled, BitLocker prevents creating or using recovery passwords, so recovery keys should be used instead. + You can save the optional recovery key to a USB drive. Because recovery passwords cannot be saved to AD DS when FIPS is enabled, an error is caused if AD DS backup is required by Group Policy. + You can edit the FIPS setting by using the Security Policy Editor (Secpol.msc) or by editing the Windows registry. You must be an administrator to perform these procedures. + For more information about setting this policy, see [System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing](http://technet.microsoft.com/library/jj852197.aspx). + ## Power management Group Policy settings: Sleep and Hibernate + PCs default power settings for a computer will cause the computer to enter Sleep mode frequently to conserve power when idle and to help extend the system’s battery life. When a computer transitions to Sleep, open programs and documents are persisted in memory. When a computer resumes from Sleep, users are not required to re-authenticate with a PIN or USB startup key to access encrypted data. This might lead to conditions where data security is compromised. + However, when a computer hibernates the drive is locked, and when it resumes from hibernation the drive is unlocked, which means that users will need to provide a PIN or a startup key if using multifactor authentication with BitLocker. Therefore, organizations that use BitLocker may want to use Hibernate instead of Sleep for improved security. This setting does not have an impact on TPM-only mode, because it provides a transparent user experience at startup and when resuming from the Hibernate states. + You can use disable the following Group Policy settings, which are located in **Computer Configuration\\Administrative Templates\\System\\Power Management** to disable all available sleep states: + - Allow Standby States (S1-S3) When Sleeping (Plugged In) - Allow Standby States (S1-S3) When Sleeping (Battery) + ## About the Platform Configuration Register (PCR) + A platform validation profile consists of a set of PCR indices that range from 0 to 23. The scope of the values can be specific to the version of the operating system. + Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker’s sensitivity to platform modifications (malicious or authorized) is increased or decreased depending on inclusion or exclusion (respectively) of the PCRs. + **About PCR 7** -PCR 7 measures the state of Secure Boot. With PCR 7, BitLocker can leverage Secure Boot for integrity validation. Secure Boot ensures that the computer's preboot environment loads only firmware that is digitally signed by authorized software publishers. PCR 7 measurements indicate whether Secure Boot is on and which keys are trusted on the platform. If Secure Boot is on and the firmware measures PCR 7 correctly per the UEFI specification, BitLocker can bind to this information rather than to PCRs 0, 2, and 4 which have the measurements of the exact firmware and Bootmgr images loaded. This reduces the likelihood of BitLocker starting in recovery mode as a result of firmware and image updates, and it provides you with greater flexibility to manage the preboot configuration. + +PCR 7 measures the state of Secure Boot. With PCR 7, BitLocker can leverage Secure Boot for integrity validation. Secure Boot ensures that the computer's preboot environment loads only firmware that is digitally signed by authorized software publishers. PCR 7 measurements indicate whether Secure Boot is on and which keys are trusted on the platform. If Secure Boot is on and the firmware measures PCR 7 correctly per the UEFI specification, BitLocker can bind to this information rather than to PCRs 0, 2, and 4 which have the measurements of the exact firmware and Bootmgr images loaded. This +reduces the likelihood of BitLocker starting in recovery mode as a result of firmware and image updates, and it provides you with greater flexibility to manage the preboot configuration. + PCR 7 measurements must follow the guidance that is described in [Appendix A Trusted Execution Environment EFI Protocol](http://msdn.microsoft.com/library/windows/hardware/jj923068.aspx). + PCR 7 measurements are a mandatory logo requirement for systems that support InstantGo (also known as Always On, Always Connected PCs), such as the Microsoft Surface RT. On such systems, if the TPM with PCR 7 measurement and Secure Boot are correctly configured, BitLocker binds to PCR 7 and PCR 11 by default. + ## See also -[Trusted Platform Module](trusted-platform-module-overview.md) -[TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md) -[BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md) -[BitLocker overview](bitlocker-overview.md) -[Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md) -  -  +- [Trusted Platform Module](trusted-platform-module-overview.md) +- [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md) +- [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md) +- [BitLocker overview](bitlocker-overview.md) +- [Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md) diff --git a/windows/keep-secure/bitlocker-how-to-deploy-on-windows-server.md b/windows/keep-secure/bitlocker-how-to-deploy-on-windows-server.md index 5c66b70012..e7035aa4e8 100644 --- a/windows/keep-secure/bitlocker-how-to-deploy-on-windows-server.md +++ b/windows/keep-secure/bitlocker-how-to-deploy-on-windows-server.md @@ -2,22 +2,31 @@ title: BitLocker How to deploy on Windows Server 2012 and later (Windows 10) description: This topic for the IT professional explains how to deploy BitLocker and Windows Server 2012 and later. ms.assetid: 91c18e9e-6ab4-4607-8c75-d983bbe2542f -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # BitLocker: How to deploy on Windows Server 2012 and later + **Applies to** - Windows 10 + This topic for the IT professional explains how to deploy BitLocker and Windows Server 2012 and later. + For all Windows Server editions, BitLocker must be installed using Server Manager. However, you can still provision BitLocker before the server operating system is installed as part of your deployment. + ## Installing BitLocker + BitLocker requires administrator privileges on the server to install. You can install BitLocker either by using Server Manager or Windows PowerShell cmdlets. + - To install BitLocker using Server Manager - To install BitLocker using Windows PowerShell + ### To install BitLocker using Server Manager + 1. Open Server Manager by selecting the Server Manager icon or running servermanager.exe. 2. Select **Manage** from the **Server Manager Navigation** bar and select **Add Roles and Features** to start the **Add Roles and Features Wizard.** 3. With the **Add Roles and Features Wizard** open, select **Next** at the **Before you begin** pane (if shown). @@ -25,32 +34,42 @@ BitLocker requires administrator privileges on the server to install. You can in 5. Select the **Select a server from the server pool option** in the **Server Selection** pane and confirm the server for the BitLocker feature install. 6. Server roles and features install using the same wizard in Server Manager. Select **Next** on the **Server Roles** pane of the **Add Roles and Features** wizard to proceed to the **Features** pane. 7. Select the check box next to **BitLocker Drive Encryption** within the **Features** pane of the **Add Roles and Features Wizard**. The wizard will show the additional management features available for BitLocker. If you do not want to install these features, deselect the **Include management tools option** and select **Add Features**. Once optional features selection is complete, select **Next** to proceed in the wizard. - **Note**   - The **Enhanced Storage** feature is a required feature for enabling BitLocker. This feature enables support for Encrypted Hard Drives on capable systems. + + > **Note:**   The **Enhanced Storage** feature is a required feature for enabling BitLocker. This feature enables support for Encrypted Hard Drives on capable systems.   8. Select **Install** on the **Confirmation** pane of the **Add Roles and Features Wizard** to begin BitLocker feature installation. The BitLocker feature requires a restart to complete. Selecting the **Restart the destination server automatically if required** option in the **Confirmation** pane will force a restart of the computer after installation is complete. 9. If the **Restart the destination server automatically if required** check box is not selected, the **Results pane** of the **Add Roles and Features Wizard** will display the success or failure of the BitLocker feature installation. If required, a notification of additional action necessary to complete the feature installation, such as the restart of the computer, will be displayed in the results text. + ### To install BitLocker using Windows PowerShell + Windows PowerShell offers administrators another option for BitLocker feature installation. Windows PowerShell installs features using the `servermanager` or `dism` module; however, the `servermanager` and `dism` modules do not always share feature name parity. Because of this, it is advisable to confirm the feature or role name prior to installation. -**Note**   -You must restart the server to complete the installation of BitLocker. + +>**Note:**  You must restart the server to complete the installation of BitLocker.   ### Using the servermanager module to install BitLocker + The `servermanager` Windows PowerShell module can use either the `Install-WindowsFeature` or `Add-WindowsFeature` to install the BitLocker feature. The `Add-WindowsFeature` cmdlet is merely a stub to the `Install-WindowsFeature`. This example uses the `Install-WindowsFeature` cmdlet. The feature name for BitLocker in the `servermanager` module is `BitLocker`. This can be determined using the `Get-WindowsFeature` cmdlet with a query such as: + ``` syntax Get-WindowsFeature Bit ``` The results of this command displays a table of all of the feature names beginning with “Bit” as their prefix. This allows you to confirm that the feature name is `BitLocker` for the BitLocker feature. + By default, installation of features in Windows PowerShell does not include optional sub-features or management tools as part of the install process. This can be seen using the `-WhatIf` option in Windows PowerShell. + ``` syntax Install-WindowsFeature BitLocker -WhatIf ``` The results of this command show that only the BitLocker Drive Encryption feature installs using this command. + To see what would be installed with the BitLocker feature including all available management tools and sub-features, use the following command: + ``` syntax Install-WindowsFeature BitLocker -IncludeAllSubFeature -IncludeManagementTools -WhatIf | fl ``` + The result of this command displays the following list of all the administration tools for BitLocker that would be installed along with the feature, including tools for use with Active Directory Domain Services (AD DS) and Active Directory Lightweight Directory Services (AD LDS). + - BitLocker Drive Encryption - BitLocker Drive Encryption Tools - BitLocker Drive Encryption Administration Utilities @@ -58,31 +77,39 @@ The result of this command displays the following list of all the administration - AD DS Snap-Ins and Command-Line Tools - AD DS Tools - AD DS and AD LDS Tools + The command to complete a full installation of the BitLocker feature with all available features and then rebooting the server at completion is: + ``` syntax Install-WindowsFeature BitLocker -IncludeAllSubFeature -IncludeManagementTools -Restart ``` -**Important**   -Installing the BitLocker feature using Windows PowerShell does not install the Enhanced Storage feature. Administrators wishing to support Encrypted Hard Drives in their environment will need to install the Enhanced Storage feature separately. + +>**Important:**  Installing the BitLocker feature using Windows PowerShell does not install the Enhanced Storage feature. Administrators wishing to support Encrypted Hard Drives in their environment will need to install the Enhanced Storage feature separately.   ### Using the dism module to install BitLocker + The `dism` Windows PowerShell module uses the `Enable-WindowsOptionalFeature` cmdlet to install features. The BitLocker feature name for BitLocker is `BitLocker`. The `dism` module does not support wildcards when searching for feature names. To list feature names for the `dism` module, use the `Get-WindowsOptionalFeatures` cmdlet. The following command will list all of the optional features in an online (running) operating system. + ``` syntax Get-WindowsOptionalFeature -Online | ft ``` + From this output, we can see that there are three BitLocker related optional feature names: BitLocker, BitLocker-Utilities and BitLocker-NetworkUnlock. To install the BitLocker feature, the BitLocker and BitLocker-Utilities features are the only required items. + To install BitLocker using the `dism` module, use the following command: + ``` syntax Enable-WindowsOptionalFeature -Online -FeatureName BitLocker -All ``` + This command will prompt the user for a reboot. The Enable-WindowsOptionalFeature cmdlet does not offer support for forcing a reboot of the computer. This command does not include installation of the management tools for BitLocker. For a complete installation of BitLocker and all available management tools, use the following command: + ``` syntax Enable-WindowsOptionalFeature -Online -FeatureName BitLocker, BitLocker-Utilities -All ``` ## More information -[BitLocker overview](bitlocker-overview.md) -[BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md) -[Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md) -[BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md) -  -  + +- [BitLocker overview](bitlocker-overview.md) +- [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md) +- [Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md) +- [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md) diff --git a/windows/keep-secure/bitlocker-how-to-enable-network-unlock.md b/windows/keep-secure/bitlocker-how-to-enable-network-unlock.md index c74d7c12a8..37e9e8b02d 100644 --- a/windows/keep-secure/bitlocker-how-to-enable-network-unlock.md +++ b/windows/keep-secure/bitlocker-how-to-enable-network-unlock.md @@ -2,20 +2,27 @@ title: BitLocker How to enable Network Unlock (Windows 10) description: This topic for the IT professional describes how BitLocker Network Unlock works and how to configure it. ms.assetid: be45bc28-47db-4931-bfec-3c348151d2e9 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # BitLocker: How to enable Network Unlock + **Applies to** - Windows 10 + This topic for the IT professional describes how BitLocker Network Unlock works and how to configure it. + Network Unlock was introduced in Windows 8 and Windows Server 2012 as a BitLocker protector option for operating system volumes. Network Unlock enables easier management for BitLocker enabled desktops and servers in a domain environment by providing automatic unlock of operating system volumes at system reboot when connected to a wired corporate network. This feature requires the client hardware to have a DHCP driver implemented in its UEFI firmware. Without Network Unlock, operating system volumes protected by TPM+PIN protectors require a PIN to be entered when a computer reboots or resumes from hibernation (for example, by Wake on LAN). This can make it difficult to enterprises to roll out software patches to unattended desktops and remotely administered servers. + Network Unlock allows BitLocker-enabled systems with TPM+PIN and that meet the hardware requirements to boot into Windows without user intervention. Network Unlock works in a similar fashion to the TPM+StartupKey at boot. Rather than needing to read the StartupKey from USB media, however, the key for Network Unlock is composed from a key stored in the TPM and an encrypted network key that is sent to the server, decrypted and returned to the client in a secure session. + This topic contains: + - [Network Unlock core requirements](#bkmk-nunlockcorereqs) - [Network Unlock sequence](#bkmk-networkunlockseq) - [Configure Network Unlock](#bkmk-configuringnetworkunlock) @@ -24,8 +31,11 @@ This topic contains: - [Update Network Unlock certificates](#bkmk-updatecerts) - [Troubleshoot Network Unlock](#bkmk-troubleshoot) - [Configure Network Unlock on unsupported systems](#bkmk-unsupportedsystems) + ## Network Unlock core requirements + Network Unlock must meet mandatory hardware and software requirements before the feature can automatically unlock domain joined systems. These requirements include: + - You must be running at least Windows 8 or Windows Server 2012. - Any supported operating system with UEFI DHCP drivers can be Network Unlock clients. - A server running the Windows Deployment Services (WDS) role on any supported server operating system. @@ -33,20 +43,31 @@ Network Unlock must meet mandatory hardware and software requirements before the - A DHCP server, separate from the WDS server. - Properly configured public/private key pairing. - Network Unlock Group Policy settings configured. + The network stack must be enabled to use the Network Unlock feature. Equipment manufacturers deliver their products in various states and with different BIOS menus, so you need to confirm that the network stack has been enabled in the BIOS before starting the computer. -**Note**   -To properly support DHCP within UEFI, the UEFI-based system should be in native mode without a compatibility support module (CSM) enabled. + +>**Note:**  To properly support DHCP within UEFI, the UEFI-based system should be in native mode without a compatibility support module (CSM) enabled. + For Network Unlock to work reliably on computers running Windows 8 and later, the first network adapter on the computer, usually the onboard adapter, must be configured to support DHCP and used for Network Unlock. This is especially worth noting when you have multiple adapters, and you wish to configure one without DHCP, such as for a lights-out management protocol. This configuration is necessary because Network Unlock will stop enumerating adapters when it reaches one with a DHCP port failure for any reason. Thus, if the first enumerated adapter does not support DHCP, is not plugged into the network, or fails to report availability of the DHCP port for any reason, then Network Unlock will fail.   The Network Unlock server component installs on supported versions of Windows Server 2012 and later as a Windows feature using Server Manager or Windows PowerShell cmdlets. The feature name is BitLocker Network Unlock in Server Manager and BitLocker-NetworkUnlock in Windows PowerShell. This feature is a core requirement. + Network Unlock requires Windows Deployment Services (WDS) in the environment where the feature will be utilized. Configuration of the WDS installation is not required; however, the WDS service needs to be running on the server. + The network key is stored on the system drive along with an AES 256 session key, and encrypted with the 2048-bit RSA public key of the unlock server's certificate. The network key is decrypted with the help of a provider on a supported version of Windows Server running WDS, and returned encrypted with its corresponding session key. + ## Network Unlock sequence + The unlock sequence starts on the client side, when the Windows boot manager detects the existence of Network Unlock protector. It leverages the DHCP driver in UEFI to obtain an IP address for IPv4 and then broadcasts a vendor-specific DHCP request that contains the network key and a session key for the reply, all encrypted by the server's Network Unlock certificate, as described above. The Network Unlock provider on the supported WDS server recognizes the vendor-specific request, decrypts it with the RSA private key, and returns the network key encrypted with the session key via its own vendor-specific DHCP reply. + On the server side, the WDS server role has an optional plugin component, like a PXE provider, which is what handles the incoming Network Unlock requests. The provider can also be configured with subnet restrictions, which would require that the IP address provided by the client in the Network Unlock request belong to a permitted subnet in order to release the network key to the client. In instances where the Network Unlock provider is unavailable, BitLocker fails over to the next available protector to unlock the drive. In a typical configuration, this means the standard TPM+PIN unlock screen is presented to unlock the drive. + The server side configuration to enable Network Unlock also requires provisioning a 2048-bit RSA public/private key pair in the form of an X.509 certificate, and for the public key certificate to be distributed to the clients. This certificate must be managed and deployed through the Group Policy editor directly on a domain controller with at least a Domain Functional Level of Windows Server 2012. This certificate is the public key that encrypts the intermediate network key (which is one of the two secrets required to unlock the drive; the other secret is stored in the TPM). + ![bitlocker network unlock sequence](images/bitlockernetworkunlocksequence.png) + **Phases in the Network Unlock process** + 1. The Windows boot manager detects that a Network Unlock protector exists in the BitLocker configuration. 2. The client computer uses its DHCP driver in the UEFI to obtain a valid IPv4 IP address. 3. The client computer broadcasts a vendor-specific DHCP request that contains the Network Key (a 256-bit intermediate key) and an AES-256 session key for the reply. Both of these keys are encrypted using the 2048-bit RSA Public Key of the Network Unlock certificate from the WDS server. @@ -56,50 +77,75 @@ The server side configuration to enable Network Unlock also requires provisionin 7. The returned intermediate key is then combined with another local 256-bit intermediate key that can only be decrypted by the TPM. 8. This combined key is used to create an AES-256 key that unlocks the volume. 9. Windows continues the boot sequence. + ## Configure Network Unlock + The following steps allow an administrator to configure Network Unlock in a domain where the Domain Functional Level is at least Windows Server 2012. + ### Step One: Install the WDS Server role + The BitLocker Network Unlock feature will install the WDS role if it is not already installed. If you want to install it separately before you install BitLocker Network Unlock you can use Server Manager or Windows PowerShell. To install the role using Server Manager, select the **Windows Deployment Services** role in Server Manager. + To install the role using Windows PowerShell, use the following command: + ``` syntax Install-WindowsFeature WDS-Deployment ``` + You must configure the WDS server so that it can communicate with DHCP (and optionally Active Directory Doman Services) and the client computer. You can do using the WDS management tool, wdsmgmt.msc, which starts the Windows Deployment Services Configuration Wizard. + ### Step Two: Confirm the WDS Service is running + To confirm the WDS service is running, use the Services Management Console or Windows PowerShell. To confirm the service is running in Services Management Console, open the console using **services.msc** and check the status of the Windows Deployment Services service. + To confirm the service is running using Windows PowerShell, use the following command: + ``` syntax Get-Service WDSServer ``` ### Step Three: Install the Network Unlock feature + To install the Network Unlock feature, use Server Manager or Windows PowerShell. To install the feature using Server Manager, select the **BitLocker Network Unlock** feature in the Server Manager console. + To install the feature using Windows PowerShell, use the following command: + ``` syntax Install-WindowsFeature BitLocker-NetworkUnlock ``` ### Step Four: Create the Network Unlock certificate + Network Unlock can use imported certificates from an existing PKI infrastructure, or you can use a self-signed certificate. + To enroll a certificate from an existing certification authority (CA), do the following: + 1. Open Certificate Manager on the WDS server using **certmgr.msc** 2. Under the Certificates - Current User item, right-click Personal 3. Select All Tasks, then **Request New Certificate** 4. Select **Next** when the Certificate Enrollment wizard opens 5. Select Active Directory Enrollment Policy 6. Choose the certificate template created for Network Unlock on the Domain controller and select **Enroll**. When prompted for more information, add the following attribute to the certificate: + - Select the **Subject Name** pane and provide a friendly name value. It is suggested that this friendly name include information for the domain or organizational unit for the certificate. For example "BitLocker Network Unlock Certificate for Contoso domain" + 7. Create the certificate. Ensure the certificate appears in the Personal folder. 8. Export the public key certificate for Network Unlock + 1. Create a .cer file by right-clicking the previously created certificate, choosing **All Tasks**, then **Export**. 2. Select **No, do not export the private key**. 3. Select **DER encoded binary X.509** and complete exporting the certificate to a file. 4. Give the file a name such as BitLocker-NetworkUnlock.cer. + 9. Export the public key with a private key for Network Unlock + 1. Create a .pfx file by right-clicking the previously created certificate, choosing **All Tasks**, then **Export**. 2. Select **Yes, export the private key**. 3. Complete the wizard to create the .pfx file. + To create a self-signed certificate, do the following: + 1. Create a text file with an .inf extension. For example, notepad.exe BitLocker-NetworkUnlock.inf 2. Add the following contents to the previously created file: + ``` syntax [NewRequest] Subject="CN=BitLocker Network Unlock certificate" @@ -117,46 +163,63 @@ To create a self-signed certificate, do the following: 2.5.29.37 = "{text}" _continue_ = "1.3.6.1.4.1.311.67.1.1" ``` + 3. Open an elevated command prompt and use the certreq tool to create a new certificate using the following command, specifying the full path to the file created previously, along with the file name: + ``` syntax certreq -new BitLocker-NetworkUnlock.inf BitLocker-NetworkUnlock.cer ``` + 4. Verify the previous command properly created the certificate by confirming the .cer file exists 5. Launch the Certificate Manager by running **certmgr.msc** 6. Create a .pfx file by opening the **Certificates – Current User\\Personal\\Certificates** path in the navigation pane, right-clicking the previously imported certificate, selecting **All Tasks**, then **Export**. Follow through the wizard to create the .pfx file. + ### Step Five: Deploy the private key and certificate to the WDS server + With the certificate and key created, deploy them to the infrastructure to properly unlock systems. To deploy the certificates, do the following: + 1. On the WDS server, open a new MMC and add the certificates snap-in. Select the computer account and local computer when given the options. 2. Right-click the Certificates (Local Computer) - BitLocker Drive Encryption Network Unlock item, choose All Tasks, then **Import** 3. In the **File to Import** dialog, choose the .pfx file created previously. 4. Enter the password used to create the .pfx and complete the wizard. + ### Step Six: Configure Group Policy settings for Network Unlock + With certificate and key deployed to the WDS server for Network Unlock, the final step is to use Group Policy settings to deploy the public key certificate to computers that you want to be able to unlock using the Network Unlock key. Group Policy settings for BitLocker can be found under **\\Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption** using the Local Group Policy Editor or the Microsoft Management Console. + The following steps describe how to enable the Group Policy setting that is a requirement for configuring Network Unlock. + 1. Open Group Policy Management Console (gpmc.msc) 2. Enable the policy **Require additional authentication at startup** and select the **Require startup PIN with TPM** option 3. Turn on BitLocker with TPM+PIN protectors on all domain-joined computers + The following steps describe how to deploy the required Group Policy setting: -**Note**   -The Group Policy settings **Allow network unlock at startup** and **Add Network Unlock Certificate** were introduced in Windows Server 2012. + +>**Note:**  The Group Policy settings **Allow network unlock at startup** and **Add Network Unlock Certificate** were introduced in Windows Server 2012.   1. Copy the .cer file created for Network Unlock to the domain controller 2. On the domain controller, launch Group Policy Management Console (gpmc.msc) 3. Create a new Group Policy Object or modify an existing object to enable the **Allow network unlock at startup** setting. 4. Deploy the public certificate to clients + 1. Within Group Policy Management Console, navigate to the following location: **Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Public Key Policies\\BitLocker Drive Encryption Network Unlock Certificate** 2. Right-click the folder and choose **Add Network Unlock Certificate** 3. Follow the wizard steps and import the .cer file that was copied earlier. -**Note**   -Only one network unlock certificate can be available at a time. If a new certificate is required, delete the current certificate before deploying a new one. The Network Unlock certificate is located in the **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\FVE\_NKP** key on the client computer. + +>**Note:**  Only one network unlock certificate can be available at a time. If a new certificate is required, delete the current certificate before deploying a new one. The Network Unlock certificate is located in the **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\FVE\_NKP** key on the client computer.   ### Step Seven: Require TPM+PIN protectors at startup + An additional step is for enterprises to use TPM+PIN protectors for an extra level of security. To require TPM+PIN protectors in an environment, do the following: + 1. Open Group Policy Management Console (gpmc.msc) 2. Enable the policy **Require additional authentication at startup** and select the **Require startup PIN with TPM** option 3. Turn on BitLocker with TPM+PIN protectors on all domain-joined computers + ### Create the certificate template for Network Unlock + The following steps detail how to create a certificate template for use with BitLocker Network Unlock. A properly configured Active Directory Services Certification Authority can use this certificate to create and issue Network Unlock certificates. + 1. Open the Certificates Template snap-in (certtmpl.msc). 2. Locate the User template. Right-click the template name and select **Duplicate Template** 3. On the **Compatibility** tab, change the **Certification Authority** and **Certificate recipient** fields to Windows Server 2012 and Windows 8respectively. Ensure the **Show resulting changes** dialog box is selected. @@ -170,104 +233,129 @@ The following steps detail how to create a certificate template for use with Bit 11. In the **Edit Application Policies Extension** options dialog box, select **Client Authentication**, **Encrypting File System**, **and Secure Email** and choose **Remove**. 12. On the **Edit Application Policies Extension** dialog box, select **Add**. 13. On the **Add Application Policy** dialog box, select **New**. In the **New Application Policy** dialog box enter the following information in the space provided and then click **OK** to create the BitLocker Network Unlock application policy: + - **Name:** **BitLocker Network Unlock** - **Object Identifier:** **1.3.6.1.4.1.311.67.1.1** + 14. Select the newly created **BitLocker Network Unlock** application policy and select **OK** 15. With the **Extensions** tab still open, select the **Edit Key Usage Extension** dialog, select the **Allow key exchange only with key encryption (key encipherment)** option. Select the **Make this extension critical** option. 16. Select the **Security** tab. Confirm that the **Domain Admins** group has been granted **Enroll** permission 17. Select **OK** to complete configuration of the template. + To add the Network Unlock template to the Certification Authority, open the Certification Authority snap-in (certsrv.msc). Right-click the **Certificate Templates** item and choose **New, Certificate Template to issue**. Select the previously created BitLocker Network Unlock certificate. + After adding the Network Unlock template to the Certification Authority, this certificate can be used to configure BitLocker Network Unlock. + ### Subnet policy configuration files on WDS Server (Optional) + By default, all clients with the correct Network Unlock Certificate and valid Network Unlock protectors that have wired access to a Network Unlock-enabled WDS server via DHCP are unlocked by the server. A subnet policy configuration file on the WDS server can be created to limit which subnet(s) Network Unlock clients can use to unlock. + The configuration file, called bde-network-unlock.ini, must be located in the same directory as the Network Unlock provider DLL and it applies to both IPv6 and IPv4 DHCP implementations. If the subnet configuration policy becomes corrupted, the provider will fail and stop responding to requests. + The subnet policy configuration file must use a “\[SUBNETS\]” section to identify the specific subnets. The named subnets may then be used to specify restrictions in certificate subsections. Subnets are defined as simple name-value pairs, in the common INI format, where each subnet has its own line, with the name on the left of the equals sign, and the subnet identified on the right of the equal sign as a Classless Inter-Domain Routing (CIDR) address or range. The key word “ENABLED” is disallowed for subnet names. -``` syntax - [SUBNETS] -SUBNET1=10.185.250.0/24 ; comment about this subrange could be here, after the semi-colon -SUBNET2=10.185.252.200/28 -SUBNET3= 2001:4898:a:2::/64 ; an IPv6 subnet -SUBNET4=2001:4898:a:3::/64; in production, the admin would likely give more useful names, like BUILDING9-EXCEPT-RECEP. -``` -Following the \[SUBNETS\] section, there can be sections for each Network Unlock certificate, identified by the certificate thumbprint formatted without any spaces, which define subnets clients can be unlocked from with that certificate. -**Note**   -When specifying the certificate thumbprint, do not include any spaces. If spaces are included in the thumbprint the subnet configuration will fail because the thumbprint will not be recognized as valid. -  -Subnet restrictions are defined within each certificate section by denoting the allowed list of permitted subnets. If any subnet is listed in a certificate section, then only those subnets listed are permitted for that certificate. If no subnet is listed in a certificate section, then all subnets are permitted for that certificate. If a certificate does not have a section in the subnet policy configuration file, then no subnet restrictions are applied for unlocking with that certificate. This means for restrictions to apply to every certificate, there must be a certificate section for every Network Unlock certificate on the server, and an explicit allowed list set for each certificate section. -Subnet lists are created by putting the name of a subnet from the \[SUBNETS\] section on its own line below the certificate section header. Then, the server will only unlock clients with this certificate on the subnet(s) specified as in the list. For troubleshooting, a subnet can be quickly excluded without deleting it from the section by simply commenting it out with a prepended semi-colon. -``` syntax - [‎2158a767e1c14e88e27a4c0aee111d2de2eafe60] -;Comments could be added here to indicate when the cert was issued, which Group Policy should get it, and so on. -;This list shows this cert is only allowed to unlock clients on SUBNET1 and SUBNET3 subnets. In this example, SUBNET2 is commented out. -SUBNET1 -;SUBNET2 -SUBNET3 -``` + + [SUBNETS] + SUBNET1=10.185.250.0/24 ; comment about this subrange could be here, after the semi-colon + SUBNET2=10.185.252.200/28 + SUBNET3= 2001:4898:a:2::/64 ; an IPv6 subnet + SUBNET4=2001:4898:a:3::/64; in production, the admin would likely give more useful names, like BUILDING9-EXCEPT-RECEP. + ``` + Following the \[SUBNETS\] section, there can be sections for each Network Unlock certificate, identified by the certificate thumbprint formatted without any spaces, which define subnets clients can be unlocked from with that certificate. + + >**Note:**  When specifying the certificate thumbprint, do not include any spaces. If spaces are included in the thumbprint the subnet configuration will fail because the thumbprint will not be recognized as valid. +   + Subnet restrictions are defined within each certificate section by denoting the allowed list of permitted subnets. If any subnet is listed in a certificate section, then only those subnets listed are permitted for that certificate. If no subnet is listed in a certificate section, then all subnets are permitted for that certificate. If a certificate does not have a section in the subnet policy configuration file, then no subnet restrictions are applied for unlocking with that certificate. This means for restrictions to apply to every certificate, there must be a certificate section for every Network Unlock certificate on the server, and an explicit allowed list set for each certificate section. + Subnet lists are created by putting the name of a subnet from the \[SUBNETS\] section on its own line below the certificate section header. Then, the server will only unlock clients with this certificate on the subnet(s) specified as in the list. For troubleshooting, a subnet can be quickly excluded without deleting it from the section by simply commenting it out with a prepended semi-colon. + [‎2158a767e1c14e88e27a4c0aee111d2de2eafe60] + ;Comments could be added here to indicate when the cert was issued, which Group Policy should get it, and so on. + ;This list shows this cert is only allowed to unlock clients on SUBNET1 and SUBNET3 subnets. In this example, SUBNET2 is commented out. + SUBNET1 + ;SUBNET2 + SUBNET3 + To disallow the use of a certificate altogether, its subnet list may contain the line “DISABLED". + ### Turning off Network Unlock + To turn off the unlock server, the PXE provider can be unregistered from the WDS server or uninstalled altogether. However, to stop clients from creating Network Unlock protectors the **Allow Network Unlock at startup** Group Policy setting should be disabled. When this policy setting is updated to disabled on client computers any Network Unlock key protectors on the computer will be deleted. Alternatively, the BitLocker Network Unlock certificate policy can be deleted on the domain controller to accomplish the same task for an entire domain. -**Note**   -Removing the FVENKP certificate store that contains the Network Unlock certificate and key on the WDS server will also effectively disable the server’s ability to respond to unlock requests for that certificate. However, this is seen as an error condition and is not a supported or recommended method for turning off the Network Unlock server. + +>**Note:**  Removing the FVENKP certificate store that contains the Network Unlock certificate and key on the WDS server will also effectively disable the server’s ability to respond to unlock requests for that certificate. However, this is seen as an error condition and is not a supported or recommended method for turning off the Network Unlock server.   ### Update Network Unlock certificates + To update the certificates used by Network Unlock, administrators need to import or generate the new certificate for the server and then update the Network Unlock certificate Group Policy setting on the domain controller. + ## Troubleshoot Network Unlock + Troubleshooting Network Unlock issues begins by verifying the environment. Many times, a small configuration issue will be the root cause of the failure. Items to verify include: + - Verify client hardware is UEFI-based and is on firmware version is 2.3.1 and that the UEFI firmware is in native mode without a Compatibility Support Module (CSM) for BIOS mode enabled. Do this by checking that the firmware does not have an option enabled such as "Legacy mode" or "Compatibility mode" or that the firmware does not appear to be in a BIOS-like mode. - All required roles and services are installed and started - Public and private certificates have been published and are in the proper certificate containers. The presence of the Network Unlock certificate can be verified in the Microsoft Management Console (MMC.exe) on the WDS server with the certificate snap-ins for the local computer enabled. The client certificate can be verified by checking the registry key **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\FVE\_NKP** on the client computer. - Group policy for Network Unlock is enabled and linked to the appropriate domains - Verify group policy is reaching the clients properly. This can be done using the GPRESULT.exe or RSOP.msc utilities. - Verify the **Network (Certificate Based)** protector is listed on the client. This can be done using either manage-bde or Windows PowerShell cmdlets. For example the following command will list the key protectors currently configured on the C: drive of the lcoal computer: + ``` syntax Manage-bde –protectors –get C: ``` -**Note**   -Use the output of manage-bde along with the WDS debug log to determine if the proper certificate thumbprint is being used for Network Unlock +>**Note:**  Use the output of manage-bde along with the WDS debug log to determine if the proper certificate thumbprint is being used for Network Unlock   Files to gather when troubleshooting BitLocker Network Unlock include: + 1. The Windows event logs. Specifically the BitLocker event logs and the Microsoft-Windows-Deployment-Services-Diagnostics-Debug log + Debug logging is turned off by default for the WDS server role, so you will need to enable it first. You can use either of the following two methods to turn on WDS debug logging. + 1. Start an elevated command prompt and run the following command: + ``` syntax wevtutil sl Microsoft-Windows-Deployment-Services-Diagnostics/Debug /e:true ``` 2. Open Event Viewer on the WDS server. + In the left pane, click **Applications and Services Logs**, click **Microsoft**, click **Windows**, click **Deployment-Services-Diagnostics**, and then click **Debug**. + In the right pane, click **Enable Log**. + 2. The DHCP subnet configuration file (if one exists). 3. The output of the BitLocker status on the volume, this can be gathered into a text file using **manage-bde -status** or **Get-BitLockerVolume** in Windows PowerShell 4. Network Monitor capture on the server hosting the WDS role, filtered by client IP address + ## Configure Network Unlock Group Policy settings on earlier versions + Network Unlock and the accompanying Group Policy settings were introduced in Windows Server 2012 but can be deployed using operating systems running Windows Server 2008 R2 and Windows Server 2008. **Requirements** + - The server hosting WDS must be running any of the server operating systems designated in the **Applies To** list at the beginning of this topic. - Client computers must be running any of the client operating systems designated in the **Applies To** list at the beginning of this topic. + The following steps can be used to configure Network Unlock on these older systems. + 1. [Step One: Install the WDS Server role](#bkmk-stepone) 2. [Step Two: Confirm the WDS Service is running](#bkmk-steptwo) 3. [Step Three: Install the Network Unlock feature](#bkmk-stepthree) 4. [Step Four: Create the Network Unlock certificate](#bkmk-stepfour) 5. [Step Five: Deploy the private key and certificate to the WDS server](#bkmk-stepfive) 6. **Step Six: Configure registry settings for Network Unlock** + Apply the registry settings by running the following certutil script on each computer running any of the client operating systems designated in the **Applies To** list at the beginning of this topic. - ``` syntax - certutil -f -grouppolicy -addstore FVE_NKP BitLocker-NetworkUnlock.cer - reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v OSManageNKP /t REG_DWORD /d 1 /f - reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseAdvancedStartup /t REG_DWORD /d 1 /f - reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UsePIN /t REG_DWORD /d 2 /f - reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMPIN /t REG_DWORD /d 2 /f - reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPM /t REG_DWORD /d 2 /f - reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMKey /t REG_DWORD /d 2 /f - reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMKeyPIN /t REG_DWORD /d 2 /f - ``` + certutil -f -grouppolicy -addstore FVE_NKP BitLocker-NetworkUnlock.cer + reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v OSManageNKP /t REG_DWORD /d 1 /f + reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseAdvancedStartup /t REG_DWORD /d 1 /f + reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UsePIN /t REG_DWORD /d 2 /f + reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMPIN /t REG_DWORD /d 2 /f + reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPM /t REG_DWORD /d 2 /f + reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMKey /t REG_DWORD /d 2 /f + reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMKeyPIN /t REG_DWORD /d 2 /f + 7. [Create the Network Unlock certificate](#bkmk-stepfour) 8. [Deploy the private key and certificate to the WDS server](#bkmk-stepfive) 9. [Create the certificate template for Network Unlock](#bkmk-createcerttmpl) 10. [Require TPM+PIN protectors at startup](#bkmk-stepseven) + ## See also + - [BitLocker overview](bitlocker-overview.md) - [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md) - [Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md) -  -  diff --git a/windows/keep-secure/bitlocker-overview.md b/windows/keep-secure/bitlocker-overview.md index 66039b8143..897f3dd747 100644 --- a/windows/keep-secure/bitlocker-overview.md +++ b/windows/keep-secure/bitlocker-overview.md @@ -2,103 +2,78 @@ title: BitLocker (Windows 10) description: This topic provides a high-level overview of BitLocker, including a list of system requirements, practical applications, and deprecated features. ms.assetid: 40526fcc-3e0d-4d75-90e0-c7d0615f33b2 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # BitLocker + **Applies to** - Windows 10 + This topic provides a high-level overview of BitLocker, including a list of system requirements, practical applications, and deprecated features. + ## + BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned computers. -BitLocker provides the most protection when used with a Trusted Platform Module (TPM) version 1.2 or later. The TPM is a hardware component installed in many newer computers by the computer manufacturers. It works with BitLocker to help protect user data and to ensure that a computer has not been tampered with while the system was offline. + +BitLocker provides the most protection when used with a Trusted Platform Module (TPM) version 1.2 or later. The TPM is a hardware component installed in many newer computers by the computer manufacturers. It works with BitLocker to help protect user data and to ensure that a computer has not been +tampered with while the system was offline. + On computers that do not have a TPM version 1.2 or later, you can still use BitLocker to encrypt the Windows operating system drive. However, this implementation will require the user to insert a USB startup key to start the computer or resume from hibernation. Starting with Windows 8, you can use an operating system volume password to protect the operating system volume on a computer without TPM. Both options do not provide the pre-startup system integrity verification offered by BitLocker with a TPM. + In addition to the TPM, BitLocker offers the option to lock the normal startup process until the user supplies a personal identification number (PIN) or inserts a removable device, such as a USB flash drive, that contains a startup key. These additional security measures provide multifactor authentication and assurance that the computer will not start or resume from hibernation until the correct PIN or startup key is presented. + ## Practical applications + Data on a lost or stolen computer is vulnerable to unauthorized access, either by running a software-attack tool against it or by transferring the computer's hard disk to a different computer. BitLocker helps mitigate unauthorized data access by enhancing file and system protections. BitLocker also helps render data inaccessible when BitLocker-protected computers are decommissioned or recycled. + There are two additional tools in the Remote Server Administration Tools, which you can use to manage BitLocker. + - **BitLocker Recovery Password Viewer**. The BitLocker Recovery Password Viewer enables you to locate and view BitLocker Drive Encryption recovery passwords that have been backed up to Active Directory Domain Services (AD DS). You can use this tool to help recover data that is stored on a drive that has been encrypted by using BitLocker. The BitLocker Recovery Password Viewer tool is an extension for the Active Directory Users and Computers Microsoft Management Console (MMC) snap-in. By using this tool, you can examine a computer object's **Properties** dialog box to view the corresponding BitLocker recovery passwords. Additionally, you can right-click a domain container and then search for a BitLocker recovery password across all the domains in the Active Directory forest. To view recovery passwords, you must be a domain administrator, or you must have been delegated permissions by a domain administrator. -- **BitLocker Drive Encryption Tools**. BitLocker Drive Encryption Tools include the command-line tools, manage-bde and repair-bde, and the BitLocker cmdlets for Windows PowerShell. Both manage-bde and the BitLocker cmdlets can be used to perform any task that can be accomplished through the BitLocker control panel, and they are appropriate to use for automated deployments and other scripting scenarios. Repair-bde is provided for disaster recovery scenarios in which a BitLocker protected drive cannot be unlocked normally or by using the recovery console. + +- **BitLocker Drive Encryption Tools**. BitLocker Drive Encryption Tools include the command-line tools, manage-bde and repair-bde, and the BitLocker cmdlets for Windows PowerShell. Both manage-bde and the BitLocker cmdlets can be used to perform any task that can be accomplished through the +BitLocker control panel, and they are appropriate to use for automated deployments and other scripting scenarios. Repair-bde is provided for disaster recovery scenarios in which a BitLocker protected drive cannot be unlocked normally or by using the recovery console. + ## New and changed functionality + To find out what's new in BitLocker for Windows 10, see [What's new in BitLocker?](../whats-new/bitlocker.md)   ## System requirements + BitLocker has the following hardware requirements: + For BitLocker to use the system integrity check provided by a Trusted Platform Module (TPM), the computer must have TPM 1.2 or later. If your computer does not have a TPM, enabling BitLocker requires that you save a startup key on a removable device, such as a USB flash drive. + A computer with a TPM must also have a Trusted Computing Group (TCG)-compliant BIOS or UEFI firmware. The BIOS or UEFI firmware establishes a chain of trust for the pre-operating system startup, and it must include support for TCG-specified Static Root of Trust Measurement. A computer without a TPM does not require TCG-compliant firmware. + The system BIOS or UEFI firmware (for TPM and non-TPM computers) must support the USB mass storage device class, including reading small files on a USB flash drive in the pre-operating system environment. + The hard disk must be partitioned with at least two drives: + - The operating system drive (or boot drive) contains the operating system and its support files. It must be formatted with the NTFS file system. - The system drive contains the files that are needed to load Windows after the firmware has prepared the system hardware. BitLocker is not enabled on this drive. For BitLocker to work, the system drive must not be encrypted, must differ from the operating system drive, and must be formatted with the FAT32 file system on computers that use UEFI-based firmware or with the NTFS file system on computers that use BIOS firmware. We recommend that system drive be approximately 350 MB in size. After BitLocker is turned on it should have approximately 250 MB of free space. + When installed on a new computer, Windows will automatically create the partitions that are required for BitLocker. + When installing the BitLocker optional component on a server you will also need to install the Enhanced Storage feature, which is used to support hardware encrypted drives. + ## In this section - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      TopicDescription

      [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md)

      This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker.

      [Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md)

      This topic for the IT professional explains how can you plan your BitLocker deployment.

      [BitLocker basic deployment](bitlocker-basic-deployment.md)

      This topic for the IT professional explains how BitLocker features can be used to protect your data through drive encryption.

      [BitLocker: How to deploy on Windows Server 2012 and later](bitlocker-how-to-deploy-on-windows-server.md)

      This topic for the IT professional explains how to deploy BitLocker and Windows Server 2012 and later.

      [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md)

      This topic for the IT professional describes how BitLocker Network Unlock works and how to configure it.

      [BitLocker: Use BitLocker Drive Encryption Tools to manage BitLocker](bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md)

      This topic for the IT professional describes how to use tools to manage BitLocker.

      [BitLocker: Use BitLocker Recovery Password Viewer](bitlocker-use-bitlocker-recovery-password-viewer.md)

      This topic for the IT professional describes how to use the BitLocker Recovery Password Viewer.

      [BitLocker Group Policy settings](bitlocker-group-policy-settings.md)

      This topic for IT professionals describes the function, location, and effect of each Group Policy setting that is used to manage BitLocker Drive Encryption.

      [BCD settings and BitLocker](bcd-settings-and-bitlocker.md)

      This topic for IT professionals describes the BCD settings that are used by BitLocker.

      [BitLocker Recovery Guide](bitlocker-recovery-guide-plan.md)

      This topic for IT professionals describes how to recover BitLocker keys from AD DS.

      [Protect BitLocker from pre-boot attacks](protect-bitlocker-from-pre-boot-attacks.md)

      This detailed guide will help you understand the circumstances under which the use of pre-boot authentication is recommended for devices running Windows 10, Windows 8.1, Windows 8, or Windows 7; and when it can be safely omitted from a device’s configuration.

      [Protecting cluster shared volumes and storage area networks with BitLocker](protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md)

      This topic for IT pros describes how to protect CSVs and SANs with BitLocker.

      -  -  -  + +| Topic | Description | +| - | - | +| [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md) | This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker.| +| [Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md)| This topic for the IT professional explains how can you plan your BitLocker deployment. | +| [BitLocker basic deployment](bitlocker-basic-deployment.md) | This topic for the IT professional explains how BitLocker features can be used to protect your data through drive encryption. | +| [BitLocker: How to deploy on Windows Server 2012 and later](bitlocker-how-to-deploy-on-windows-server.md)| This topic for the IT professional explains how to deploy BitLocker and Windows Server 2012 and later.| +| [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md) | This topic for the IT professional describes how BitLocker Network Unlock works and how to configure it. | +| [BitLocker: Use BitLocker Drive Encryption Tools to manage BitLocker](bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md)| This topic for the IT professional describes how to use tools to manage BitLocker.| +| [BitLocker: Use BitLocker Recovery Password Viewer](bitlocker-use-bitlocker-recovery-password-viewer.md) | This topic for the IT professional describes how to use the BitLocker Recovery Password Viewer. | +| [BCD settings and BitLocker](bcd-settings-and-bitlocker.md) | This topic for IT professionals describes the BCD settings that are used by BitLocker.| +| [BitLocker Recovery Guide](bitlocker-recovery-guide-plan.md)| This topic for IT professionals describes how to recover BitLocker keys from AD DS. | +| [Protect BitLocker from pre-boot attacks](protect-bitlocker-from-pre-boot-attacks.md)| This detailed guide will help you understand the circumstances under which the use of pre-boot authentication is recommended for devices running Windows 10, Windows 8.1, Windows 8, or Windows 7; and when it can be safely omitted from a device’s configuration. | +| [Protecting cluster shared volumes and storage area networks with BitLocker](protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md)| This topic for IT pros describes how to protect CSVs and SANs with BitLocker.| diff --git a/windows/keep-secure/bitlocker-recovery-guide-plan.md b/windows/keep-secure/bitlocker-recovery-guide-plan.md index ef750b5769..80df5a2c52 100644 --- a/windows/keep-secure/bitlocker-recovery-guide-plan.md +++ b/windows/keep-secure/bitlocker-recovery-guide-plan.md @@ -2,33 +2,48 @@ title: BitLocker recovery guide (Windows 10) description: This topic for IT professionals describes how to recover BitLocker keys from AD DS. ms.assetid: d0f722e9-1773-40bf-8456-63ee7a95ea14 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft + --- + # BitLocker recovery guide + **Applies to** - Windows 10 + This topic for IT professionals describes how to recover BitLocker keys from AD DS. + Organizations can use BitLocker recovery information saved in Active Directory Domain Services (AD DS) to access BitLocker-protected data. Creating a recovery model for BitLocker while you are planning your BitLocker deployment is recommended. + This article assumes that you understand how to set up AD DS to back up BitLocker recovery information automatically, and what types of recovery information are saved to AD DS. + This article does not detail how to configure AD DS to store the BitLocker recovery information. + This article contains the following topics: + - [What Is BitLocker Recovery?](#bkmk-whatisrecovery) - [Testing Recovery](#bkmk-testingrecovery) - [Planning Your Recovery Process](#bkmk-planningrecovery) - [Using Additional Recovery Information](#bkmk-usingaddrecovery) - [Resetting Recovery Passwords](#bkmk-appendixb) - [Retrieving the BitLocker Key Package](#bkmk-appendixc) + ## What is BitLocker recovery? + BitLocker recovery is the process by which you can restore access to a BitLocker-protected drive in the event that you cannot unlock the drive normally. In a recovery scenario you have the following options to restore access to the drive: + - The user can supply the recovery password. If your organization allows users to print or store recovery passwords, the user can type in the 48-digit recovery password that they printed or stored on a USB drive or with your Microsoft Account online. (Saving a recovery password with your Microsoft Account online is only allowed when BitLocker is used on a PC that is not a member of a domain). - A data recovery agent can use their credentials to unlock the drive. If the drive is an operating system drive, the drive must be mounted as a data drive on another computer for the data recovery agent to unlock it. - A domain administrator can obtain the recovery password from AD DS and use it to unlock the drive. Storing recovery passwords in AD DS is recommended to provide a way for IT professionals to be able to obtain recovery passwords for drives in their organization if needed. This method requires that you have enabled this recovery method in the BitLocker Group Policy setting **Choose how BitLocker-protected operating system drives can be recovered** located at **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption\\Operating System Drives** in the Local Group Policy Editor. For more information, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). + ### What causes BitLocker recovery? + The following list provides examples of specific events that will cause BitLocker to enter recovery mode when attempting to start the operating system drive: + - On PCs that use either BitLocker or Device Encryption when an attack is detected the device will immediately reboot and enter into BitLocker recovery mode. To take advantage of this functionality Administrators can set the **Interactive logon: Machine account lockout threshold** Group Policy setting located in **\\Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** in the Local Group Policy Editor, or use the **MaxFailedPasswordAttempts** policy of [Exchange ActiveSync](http://technet.microsoft.com/library/aa998357.aspx) (also configurable through [Windows Intune](http://technet.microsoft.com/library/jj733621.aspx)), to limit the number of failed password attempts before the device goes into Device Lockout. - Changing the boot order to boot another drive in advance of the hard drive. - Having the CD or DVD drive before the hard drive in the BIOS boot order and then inserting or removing a CD or DVD. @@ -49,8 +64,8 @@ The following list provides examples of specific events that will cause BitLocke - Hiding the TPM from the operating system. Some BIOS or UEFI settings can be used to prevent the enumeration of the TPM to the operating system. When implemented, this option can make the TPM hidden from the operating system. When the TPM is hidden, BIOS and UEFI secure startup are disabled, and the TPM does not respond to commands from any software. - Using a different keyboard that does not correctly enter the PIN or whose keyboard map does not match the keyboard map assumed by the pre-boot environment. This can prevent the entry of enhanced PINs. - Modifying the Platform Configuration Registers (PCRs) used by the TPM validation profile. For example, including **PCR\[1\]** would result in BitLocker measuring most changes to BIOS settings, causing BitLocker to enter recovery mode even when non-boot critical BIOS settings change. - **Note**   - Some computers have BIOS settings that skip measurements to certain PCRs, such as **PCR\[2\]**. Changing this setting in the BIOS would cause BitLocker to enter recovery mode because the PCR measurement will be different. + + >**Note:**  Some computers have BIOS settings that skip measurements to certain PCRs, such as **PCR\[2\]**. Changing this setting in the BIOS would cause BitLocker to enter recovery mode because the PCR measurement will be different.   - Moving the BitLocker-protected drive into a new computer. - Upgrading the motherboard to a new one with a new TPM. @@ -58,169 +73,249 @@ The following list provides examples of specific events that will cause BitLocke - Failing the TPM self-test. - Having a BIOS, UEFI firmware, or an option ROM component that is not compliant with the relevant Trusted Computing Group standards for a client computer. For example, a non-compliant implementation may record volatile data (such as time) in the TPM measurements, causing different measurements on each startup and causing BitLocker to start in recovery mode. - Changing the usage authorization for the storage root key of the TPM to a non-zero value. - **Note**   - The BitLocker TPM initialization process sets the usage authorization value to zero, so another user or process must explicitly have changed this value. + + >**Note:**  The BitLocker TPM initialization process sets the usage authorization value to zero, so another user or process must explicitly have changed this value.   - Disabling the code integrity check or enabling test signing on Windows Boot Manager (Bootmgr). - Pressing the F8 or F10 key during the boot process. - Adding or removing add-in cards (such as video or network cards), or upgrading firmware on add-in cards. - Using a BIOS hot key during the boot process to change the boot order to something other than the hard drive. -**Note**   -Before you begin recovery, we recommend that you determine what caused recovery. This might help prevent the problem from occurring again in the future. For instance, if you determine that an attacker has modified your computer by obtaining physical access, you can create new security policies for tracking who has physical presence. After the recovery password has been used to recover access to the PC, BitLocker will reseal the encryption key to the current values of the measured components. + +>**Note:**  Before you begin recovery, we recommend that you determine what caused recovery. This might help prevent the problem from occurring again in the future. For instance, if you determine that an attacker has modified your computer by obtaining physical access, you can create new security policies for tracking who has physical presence. After the recovery password has been used to recover access to the PC, BitLocker will reseal the encryption key to the current values of the measured components.   For planned scenarios, such as a known hardware or firmware upgrades, you can avoid initiating recovery by temporarily suspending BitLocker protection. Because suspending BitLocker leaves the drive fully encrypted, the administrator can quickly resume BitLocker protection after the planned task has been completed. Using suspend and resume also reseals the encryption key without requiring the entry of the recovery key. -**Note**   -If suspended BitLocker will automatically resume protection when the PC is rebooted, unless a reboot count is specified using the manage-bde command line tool. + +>**Note:**  If suspended BitLocker will automatically resume protection when the PC is rebooted, unless a reboot count is specified using the manage-bde command line tool. + If software maintenance requires the computer be restarted and you are using two-factor authentication, you can enable BitLocker Network Unlock to provide the secondary authentication factor when the computers do not have an on-premise user to provide the additional authentication method.   Recovery has been described within the context of unplanned or undesired behavior, but you can also cause recovery as an intended production scenario, in order to manage access control. For example, when you redeploy desktop or laptop computers to other departments or employees in your enterprise, you can force BitLocker into recovery before the computer is given to a new user. + ## Testing recovery + Before you create a thorough BitLocker recovery process, we recommend that you test how the recovery process works for both end users (people who call your helpdesk for the recovery password) and administrators (people who help the end user get the recovery password). The –forcerecovery command of manage-bde is an easy way for you to step through the recovery process before your users encounter a recovery situation. + **To force a recovery for the local computer** + 1. Click the **Start** button, type **cmd** in the **Start Search** box, right-click **cmd.exe**, and then click **Run as administrator**. 2. At the command prompt, type the following command and then press ENTER: - **manage-bde -forcerecovery** *<Volume>* + `manage-bde -forcerecovery ` + **To force recovery for a remote computer** + 1. On the Start screen, type **cmd.exe**, and then click **Run as administrator**. 2. At the command prompt, type the following command and then press ENTER: - **manage-bde. -ComputerName** *<ComputerName>***-forcerecovery** *<Volume>* -**Note**   -*<ComputerName>* represents the name of the remote computer. *<Volume>* represents the volume on the remote computer that is protected with BitLocker. + `manage-bde. -ComputerName -forcerecovery ` + +> **Note:**  *ComputerName* represents the name of the remote computer. *Volume* represents the volume on the remote computer that is protected with BitLocker.   ## Planning your recovery process + When planning the BitLocker recovery process, first consult your organization's current best practices for recovering sensitive information. For example: How does your enterprise handle lost Windows passwords? How does your organization perform smart card PIN resets? You can use these best practices and related resources (people and tools) to help formulate a BitLocker recovery model. -Organizations that rely on BitLocker Drive Encryption and BitLocker To Go to protect data on a large number of computers and removable drives running the Windows 10, Windows 8, or Windows 7 operating systems and Windows to Go should consider using the Microsoft BitLocker Administration and Monitoring (MBAM) Tool version 2.0, which is included in the Microsoft Desktop Optimization Pack (MDOP) for Microsoft Software Assurance. MBAM makes BitLocker implementations easier to deploy and manage and allows administrators to provision and monitor encryption for operating system and fixed drives. MBAM prompts the user before encrypting fixed drives. MBAM also manages recovery keys for fixed and removable drives, making recovery easier to manage. MBAM can be used as part of a Microsoft System Center deployment or as a stand-alone solution. For more info, see [Microsoft BitLocker Administration and Monitoring](http://technet.microsoft.com/windows/hh826072.aspx). + +Organizations that rely on BitLocker Drive Encryption and BitLocker To Go to protect data on a large number of computers and removable drives running the Windows 10, Windows 8, or Windows 7 operating systems and Windows to Go should consider using the Microsoft BitLocker Administration and Monitoring (MBAM) Tool version 2.0, which is included in the Microsoft Desktop Optimization Pack (MDOP) for Microsoft Software Assurance. MBAM makes BitLocker implementations easier to deploy and manage and allows administrators to provision and monitor encryption for operating system and fixed drives. MBAM prompts the user before encrypting fixed drives. MBAM also manages recovery keys for fixed and removable drives, making recovery easier to manage. MBAM can be used as part of a Microsoft System Center deployment or as a stand-alone solution. For more info, see [Microsoft BitLocker +Administration and Monitoring](http://technet.microsoft.com/windows/hh826072.aspx). + After a BitLocker recovery has been initiated, users can use a recovery password to unlock access to encrypted data. You must consider both self-recovery and recovery password retrieval methods for your organization. + When you determine your recovery process, you should: + - Become familiar with how you can retrieve the recovery password. See: + - [Self-recovery](#bkmk-selfrecovery) - [Recovery password retrieval](#bkmk-recoveryretrieval) + - Determine a series of steps for post-recovery, including analyzing why the recovery occurred and resetting the recovery password. See: + - [Post-recovery analysis](#bkmk-planningpostrecovery) + ### Self-recovery + In some cases, users might have the recovery password in a printout or a USB flash drive and can perform self-recovery. We recommend that your organization create a policy for self-recovery. If self-recovery includes using a password or recovery key stored on a USB flash drive, the users should be warned not to store the USB flash drive in the same place as the PC, especially during travel, for example if both the PC and the recovery items are in the same bag it would be very easy for access to be gained to the PC by an unauthorized user. Another policy to consider is having users contact the Helpdesk before or after performing self-recovery so that the root cause can be identified. + ### Recovery password retrieval + If the user does not have a recovery password in a printout or on a USB flash drive, the user will need to be able to retrieve the recovery password from an online source. If the PC is a member of a domain the recovery password can be backed up to AD DS. However, this does not happen by default, you must have configured the appropriate Group Policy settings before BitLocker was enabled on the PC. BitLocker Group Policy settings can be found in the Local Group Policy Editor or the Group Policy Management Console (GPMC) under **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption**. The following policy settings define the recovery methods that can be used to restore access to a BitLocker-protected drive if an authentication method fails or is unable to be used. + - **Choose how BitLocker-protected operating system drives can be recovered** - **Choose how BitLocker-protected fixed drives can be recovered** - **Choose how BitLocker-protected removable drives can be recovered** -In each of these policies, select **Save BitLocker recovery information to Active Directory Domain Services** and then choose which BitLocker recovery information to store in Active Directory Domain Services (AD DS). Select the **Do not enable BitLocker until recovery information is stored in AD DS** check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information for the drive to AD DS succeeds. -**Note**   -If the PCs are part of a workgroup, users should be advised to save their BitLocker recovery password with their Microsoft Account online. Having an online copy of your BitLocker recovery password is recommended to help ensure that you do not lose access to your data in the event that recovery is required. +In each of these policies, select **Save BitLocker recovery information to Active Directory Domain Services** and then choose which BitLocker recovery information to store in Active Directory Domain Services (AD DS). Select the **Do not enable BitLocker until recovery information is stored in AD +DS** check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information for the drive to AD DS succeeds. + +>**Note:**  If the PCs are part of a workgroup, users should be advised to save their BitLocker recovery password with their Microsoft Account online. Having an online copy of your BitLocker recovery password is recommended to help ensure that you do not lose access to your data in the event that recovery is required.   The BitLocker Recovery Password Viewer for Active Directory Users and Computers tool allows domain administrators to view BitLocker recovery passwords for specific computer objects in Active Directory. + You can use the following list as a template for creating your own recovery process for recovery password retrieval. This sample process uses the BitLocker Recovery Password Viewer for Active Directory Users and Computers tool. + - [Record the name of the user's computer](#bkmk-recordcomputername) - [Verify the user's identity](#bkmk-verifyidentity) - [Locate the recovery password in AD DS](#bkmk-locatepassword) - [Gather information to determine why recovery occurred](#bkmk-gatherinfo) - [Give the user the recovery password](#bkmk-givepassword) + ### Record the name of the user's computer + You can use the name of the user's computer to locate the recovery password in AD DS. If the user does not know the name of the computer, ask the user to read the first word of the **Drive Label** in the **BitLocker Drive Encryption Password Entry** user interface. This is the computer name when BitLocker was enabled and is probably the current name of the computer. + ### Verify the user's identity + You should verify that the person that is asking for the recovery password is truly the authorized user of that computer. You may also wish to verify that the computer with the name the user provided belongs to the user. + ### Locate the recovery password in AD DS + Locate the Computer object with the matching name in AD DS. Because Computer object names are listed in the AD DS global catalog, you should be able to locate the object even if you have a multi-domain forest. + ### Multiple recovery passwords + If multiple recovery passwords are stored under a computer object in AD DS, the name of the BitLocker recovery information object includes the date that the password was created. + If at any time you are unsure what password to provide, or if you think you might be providing the incorrect password, ask the user to read the eight character password ID that is displayed in the recovery console. + Since the password ID is a unique value that is associated with each recovery password stored in AD DS, running a query using this ID will find the correct password to unlock the encrypted volume. + ### Gather information to determine why recovery occurred + Before you give the user the recovery password, you should gather any information that will help determine why the recovery was needed, in order to analyze the root cause during the post-recovery analysis. For more info about post-recovery analysis, see [Post-recovery analysis](#bkmk-planningpostrecovery). + ### Give the user the recovery password + Because the recovery password is 48 digits long the user may need to record the password by writing it down or typing it on a different computer. If you are using MBAM, the recovery password will be regenerated after it is recovered from the MBAM database to avoid the security risks associated with an uncontrolled password. -**Note**   -Because the 48-digit recovery password is long and contains a combination of digits, the user might mishear or mistype the password. The boot-time recovery console uses built-in checksum numbers to detect input errors in each 6-digit block of the 48-digit recovery password, and offers the user the opportunity to correct such errors. + +>**Note:**  Because the 48-digit recovery password is long and contains a combination of digits, the user might mishear or mistype the password. The boot-time recovery console uses built-in checksum numbers to detect input errors in each 6-digit block of the 48-digit recovery password, and offers the user the opportunity to correct such errors.   ### Post-recovery analysis -When a volume is unlocked using a recovery password, an event is written to the event log and the platform validation measurements are reset in the TPM to match the current configuration. Unlocking the volume means that the encryption key has been released and is ready for on-the-fly encryption when data is written to the volume, and on-the-fly decryption when data is read from the volume. After the volume is unlocked, BitLocker behaves the same way, regardless of how the access was granted. + +When a volume is unlocked using a recovery password, an event is written to the event log and the platform validation measurements are reset in the TPM to match the current configuration. Unlocking the volume means that the encryption key has been released and is ready for on-the-fly encryption +when data is written to the volume, and on-the-fly decryption when data is read from the volume. After the volume is unlocked, BitLocker behaves the same way, regardless of how the access was granted. + If you notice that a computer is having repeated recovery password unlocks, you might want to have an administrator can perform post-recovery analysis to determine the root cause of the recovery and refresh BitLocker platform validation so that the user no longer needs to enter a recovery password each time that the computer starts up. See: + - [Determine the root cause of the recovery](#bkmk-determinecause) - [Refresh BitLocker protection](#bkmk-refreshprotection) + ### Determine the root cause of the recovery + If a user needed to recover the drive, it is important to determine the root cause that initiated the recovery as soon as possible. Properly analyzing the state of the computer and detecting tampering may reveal threats that have broader implications for enterprise security. + While an administrator can remotely investigate the cause of recovery in some cases, the end user might need to bring the computer that contains the recovered drive on site to analyze the root cause further. + Review and answer the following questions for your organization: + 1. What BitLocker protection mode is in effect (TPM, TPM + PIN, TPM + startup key, startup key only)? Which PCR profile is in use on the PC? 2. Did the user merely forget the PIN or lose the startup key? If a token was lost, where might the token be? 3. If TPM mode was in effect, was recovery caused by a boot file change? 4. If recovery was caused by a boot file change, is this due to an intended user action (for example, BIOS upgrade), or to malicious software? 5. When was the user last able to start the computer successfully, and what might have happened to the computer since then? 6. Might the user have encountered malicious software or left the computer unattended since the last successful startup? + To help you answer these questions, use the BitLocker command-line tool to view the current configuration and protection mode (for example, **manage-bde -status**). Scan the event log to find events that help indicate why recovery was initiated (for example, if boot file change occurred). Both of these capabilities can be performed remotely. + ### Resolve the root cause + After you have identified what caused recovery, you can reset BitLocker protection and avoid recovery on every startup. + The details of this reset can vary according to the root cause of the recovery. If you cannot determine the root cause, or if malicious software or a rootkit might have infected the computer, Helpdesk should apply best-practice virus policies to react appropriately. -**Note**   -You can perform a BitLocker validation profile reset by suspending and resuming BitLocker. + +>**Note:**  You can perform a BitLocker validation profile reset by suspending and resuming BitLocker.   - [Unknown PIN](#bkmk-unknownpin) - [Lost startup key](#bkmk-loststartup) - [Changes to boot files](#bkmk-changebootknown) ### Unknown PIN + If a user has forgotten the PIN, you must reset the PIN while you are logged on to the computer in order to prevent BitLocker from initiating recovery each time the computer is restarted. + **To prevent continued recovery due to an unknown PIN** + 1. Unlock the computer using the recovery password. -2. Reset the PIN: - 1. - 2. Right-click the drive and then click **Change PIN** - 3. In the BitLocker Drive Encryption dialog, click **Reset a forgotten PIN**. If you are not logged in with an administrator account you must provide administrative credentials at this time. - 4. In the PIN reset dialog, provide and confirm the new PIN to use and then click **Finish**. +2. Reset the PIN: + 1. Right-click the drive and then click **Change PIN** + 2. In the BitLocker Drive Encryption dialog, click **Reset a forgotten PIN**. If you are not logged in with an administrator account you must provide administrative credentials at this time. + 3. In the PIN reset dialog, provide and confirm the new PIN to use and then click **Finish**. 3. You will use the new PIN the next time you unlock the drive. + ### Lost startup key + If you have lost the USB flash drive that contains the startup key, then you must unlock the drive by using the recovery key and then create a new startup key. + **To prevent continued recovery due to a lost startup key** + 1. Log on as an administrator to the computer that has the lost startup key. 2. Open Manage BitLocker. 3. Click **Duplicate start up key**, insert the clean USB drive on which you are going to write the key and then click **Save**. + ### Changes to boot files + This error might occur if you updated the firmware. As a best practice you should suspend BitLocker before making changes the firmware and then resume protection after the update has completed. This prevents the computer from going into recovery mode. However if changes were made when BitLocker protection was on you can simply log on to the computer using the recovery password and the platform validation profile will be updated so that recovery will not occur the next time. + ## Windows RE and BitLocker + Windows Recovery Environment (RE) can be used to recover access to a drive protected by BitLocker or by Device Encryption. If a PC is unable to boot after two failures, Startup Repair will automatically start. When Startup Repair is launched automatically due to boot failures, it will only execute operating system and driver file repairs, provided that the boot logs or any available crash dump point to a specific corrupted file. In Windows 8.1 and later, devices that include firmware to support specific TPM measurements for PCR\[7\] the TPM can validate that Windows RE is a trusted operating environment and will unlock any BitLocker-protected drives if Windows RE has not been modified. If the Windows RE environment has been modified, for example the TPM has been disabled, the drives will stay locked until the BitLocker recovery key is provided. If Startup Repair is not able to be run automatically from the PC and instead Windows RE is manually started from a repair disk, the BitLocker recovery key must be provided to unlock the BitLocker–protected drives. + ## Using additional recovery information + Besides the 48-digit BitLocker recovery password, other types of recovery information are stored in Active Directory. This section describes how this additional information can be used. + ### BitLocker key package + If the recovery methods discussed earlier in this document do not unlock the volume, you can use the BitLocker Repair tool to decrypt the volume at the block level. The tool uses the BitLocker key package to help recover encrypted data from severely damaged drives. You can then use this recovered data to salvage encrypted data, even after the correct recovery password has failed to unlock the damaged volume. We recommend that you still save the recovery password. A key package cannot be used without the corresponding recovery password. -**Note**   -You must use the BitLocker Repair tool **repair-bde** to use the BitLocker key package. + +>**Note:**  You must use the BitLocker Repair tool **repair-bde** to use the BitLocker key package.   The BitLocker key package is not saved by default. To save the package along with the recovery password in AD DS you must select the **Backup recovery password and key package** option in the Group Policy settings that control the recovery method. You can also export the key package from a working volume. For more details on how to export key packages, see [Retrieving the BitLocker Key Package](#bkmk-appendixc). + ## Resetting recovery passwords + You should invalidate a recovery password after it has been provided and used. It should also be done when you intentionally want to invalidate an existing recovery password for any reason. + You can reset the recovery password in two ways: + - **Use manage-bde** You can use manage-bde to remove the old recovery password and add a new recovery password. The procedure identifies the command and the syntax for this method. - **Run a script** You can run a script to reset the password without decrypting the volume. The sample script in the procedure illustrates this functionality. The sample script creates a new recovery password and invalidates all other passwords. + **To reset a recovery password using manage-bde** + 1. Remove the previous recovery password + ``` syntax Manage-bde –protectors –delete C: –type RecoveryPassword ``` + 2. Add the new recovery password + ``` syntax Manage-bde –protectors –add C: -RecoveryPassword + ``` + 3. Get the ID of the new recovery password. From the screen copy the ID of the recovery password. + ``` syntax Manage-bde –protectors –get C: -Type RecoveryPassword + ``` 4. Backup the new recovery password to AD DS + ``` syntax Manage-bde –protectors –adbackup C: -id {EXAMPLE6-5507-4924-AA9E-AFB2EB003692} ``` - **Warning**   - You must include the braces in the ID string. + >**Warning:**  You must include the braces in the ID string.   **To run the sample recovery password script** + 1. Save the following sample script in a VBScript file. For example: ResetPassword.vbs. 2. At the command prompt, type a command similar to the following: + **cscript ResetPassword.vbs** -**Important**   -This sample script is configured to work only for the C volume. You must customize the script to match the volume where you want to test password reset. + +>**Important:**  This sample script is configured to work only for the C volume. You must customize the script to match the volume where you want to test password reset.   -**Note**   -To manage a remote computer, you can specify the remote computer name rather than the local computer name. +> **Note:**  To manage a remote computer, you can specify the remote computer name rather than the local computer name.   You can use the following sample script to create a VBScript file to reset the recovery passwords. + ``` syntax ' Target drive letter strDriveLetter = "c:" @@ -291,16 +386,25 @@ WScript.Echo "A new recovery password has been added. Old passwords have been re 'WScript.Echo "" 'WScript.Echo "Type ""manage-bde -protectors -get " & strDriveLetter & " -type recoverypassword"" to view existing passwords." ``` + ## Retrieving the BitLocker key package + You can use two methods to retrieve the key package, as described in [Using Additional Recovery Information](#bkmk-usingaddrecovery): + - **Export a previously-saved key package from AD DS.** You must have Read access to BitLocker recovery passwords that are stored in AD DS. - **Export a new key package from an unlocked, BitLocker-protected volume.** You must have local administrator access to the working volume, before any damage has occurred. + The following sample script exports all previously-saved key packages from AD DS. + **To run the sample key package retrieval script** + 1. Save the following sample script in a VBScript file. For example: GetBitLockerKeyPackageADDS.vbs. 2. At the command prompt, type a command similar to the following: + **cscript GetBitLockerKeyPackageADDS.vbs -?** + You can use the following sample script to create a VBScript file to retrieve the BitLocker key package from AD DS. + ``` syntax ' -------------------------------------------------------------------------------- ' Usage @@ -615,7 +719,9 @@ Function BinaryToString(Binary) BinaryToString = S End Function ``` + ## See also + - [BitLocker overview](bitlocker-overview.md)     From 6e3119151ae4df4ef13f502bfc71e414314f976e Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 23 May 2016 08:55:16 -0700 Subject: [PATCH 370/439] sync to change branches --- education/windows/set-up-school-pcs-technical.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index 8c663f19e0..a93a867cf2 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -106,8 +106,11 @@ The **Set up School PCs** app produces a specialized provisioning package that m ### Local Group Policies - - +> **Important**: It is not recommended to set additional policies on PCs configured with the **Set up School PCs** app. The shared PC mode has been optimized to be fast and reliable over time with minimal to no manual maintenance required. + +

      Policy name

      Value

      + + From 76148b139eea13d2d4fd9e03c436a2dd537fcdea Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 23 May 2016 09:04:03 -0700 Subject: [PATCH 371/439] remove Mobile from servicing topic --- ...change-history-for-manage-and-update-windows-10.md | 9 ++++++--- .../manage/introduction-to-windows-10-servicing.md | 11 +++++------ 2 files changed, 11 insertions(+), 9 deletions(-) diff --git a/windows/manage/change-history-for-manage-and-update-windows-10.md b/windows/manage/change-history-for-manage-and-update-windows-10.md index 0618ddf346..df398cfd27 100644 --- a/windows/manage/change-history-for-manage-and-update-windows-10.md +++ b/windows/manage/change-history-for-manage-and-update-windows-10.md @@ -16,11 +16,14 @@ This topic lists new and updated topics in the [Manage and update Windows 10](in | New or changed topic | Description | | ---|---| -|[Manage Wi-Fi Sense in your company](manage-wifi-sense-in-enterprise.md) |Removed info about sharing wi-fi network access with contacts, since it's been deprecated. | -| [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) | Corrected script for setting a custom shell using Shell Launcher | +| [Group Policies that apply only to Windows 10 Enterprise and Education Editions](group-policies-for-enterprise-and-education-editions.md) | New | | [Configure Windows 10 devices to stop data flow to Microsoft](configure-windows-10-devices-to-stop-data-flow-to-microsoft.md) | Added section on how to turn off Live Tiles | | [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md) | New telemetry content | -| [Group Policies that apply only to Windows 10 Enterprise and Education Editions](group-policies-for-enterprise-and-education-editions.md) | New | +| [Manage Wi-Fi Sense in your company](manage-wifi-sense-in-enterprise.md) |Removed info about sharing wi-fi network access with contacts, since it's been deprecated. | +| [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) | Corrected script for setting a custom shell using Shell Launcher | +| [Windows 10 servicing options for updates and upgrades](introduction-to-windows-10-servicing.md) | Removed Windows 10 Mobile from **Applies to** | + + ## April 2016 diff --git a/windows/manage/introduction-to-windows-10-servicing.md b/windows/manage/introduction-to-windows-10-servicing.md index cbc3a2f1b1..300b8bf5aa 100644 --- a/windows/manage/introduction-to-windows-10-servicing.md +++ b/windows/manage/introduction-to-windows-10-servicing.md @@ -14,10 +14,9 @@ author: jdeckerMS **Applies to** - Windows 10 -- Windows 10 Mobile - Windows 10 IoT Core (IoT Core) -This article describes the new servicing options available in Windows 10, Windows 10 Mobile, and IoT Core and how they enable enterprises to keep their devices current with the latest feature upgrades. It also covers related topics, such as how enterprises can make better use of Windows Update, and what the new servicing options mean for support lifecycles. +This article describes the new servicing options available in Windows 10 Wand IoT Core and how they enable enterprises to keep their devices current with the latest feature upgrades. It also covers related topics, such as how enterprises can make better use of Windows Update, and what the new servicing options mean for support lifecycles. **Note**   Several of the figures in this article show multiple feature upgrades of Windows being released by Microsoft over time. Be aware that these figures were created with dates that were chosen for illustrative clarity, not for release roadmap accuracy, and should not be used for planning purposes. @@ -35,8 +34,8 @@ Table 1. Windows 10 servicing options | Servicing option | Availability of new feature upgrades for installation | Minimum length of servicing lifetime | Key benefits | Supported editions | |-----------------------------------|-----------------------------------------------------------|--------------------------------------|-------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------| -| Current Branch (CB) | Immediately after first published by Microsoft | Approximately 4 months | Makes new features available to users as soon as possible | Home, Pro, Education, Enterprise, Mobile, IoT Core, Windows 10 IoT Core Pro (IoT Core Pro) | -| Current Branch for Business (CBB) | Approximately 4 months after first published by Microsoft | Approximately 8 months | Provides additional time to test new feature upgrades before deployment | Pro, Education, Enterprise, Mobile Enterprise, IoT Core Pro | +| Current Branch (CB) | Immediately after first published by Microsoft | Approximately 4 months | Makes new features available to users as soon as possible | Home, Pro, Education, Enterprise, IoT Core, Windows 10 IoT Core Pro (IoT Core Pro) | +| Current Branch for Business (CBB) | Approximately 4 months after first published by Microsoft | Approximately 8 months | Provides additional time to test new feature upgrades before deployment | Pro, Education, Enterprise, IoT Core Pro | | Long-Term Servicing Branch (LTSB) | Immediately after published by Microsoft | 10 Years | Enables long-term deployment of selected Windows 10 releases in low-change configurations | Enterprise LTSB |   ## Streamlined product development and release cycles @@ -253,11 +252,11 @@ Table 2. Servicing option summary - From f1d4299bf3ffb0eaf5996adcaf7fd0f92d9b5212 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Mon, 23 May 2016 09:39:17 -0700 Subject: [PATCH 372/439] fixing spacing issues --- .../device-guard-deployment-guide.md | 636 ++++++++++++++---- 1 file changed, 496 insertions(+), 140 deletions(-) diff --git a/windows/keep-secure/device-guard-deployment-guide.md b/windows/keep-secure/device-guard-deployment-guide.md index 0c2654ac5b..3d9a53be0e 100644 --- a/windows/keep-secure/device-guard-deployment-guide.md +++ b/windows/keep-secure/device-guard-deployment-guide.md @@ -2,53 +2,78 @@ title: Device Guard deployment guide (Windows 10) description: Microsoft Device Guard is a feature set that consists of both hardware and software system integrity hardening features that revolutionize the Windows operating system’s security. ms.assetid: 4BA52AA9-64D3-41F3-94B2-B87EC2717486 -ms.pagetype: devices keywords: virtualization, security, malware ms.prod: W10 ms.mktglfcycl: deploy +ms.pagetype: devices author: challum --- + # Device Guard deployment guide + **Applies to** - Windows 10 Microsoft Device Guard is a feature set that consists of both hardware and software system integrity hardening features that revolutionize the Windows operating system’s security. Windows 10 employs Device Guard as well as code integrity and advanced hardware features such as CPU virtualization extensions, Trusted Platform Module, and second-level address translation to offer comprehensive modern security to its users. This guide explores the individual features in Device Guard as well as how to plan for, configure, and deploy them. ## Introduction to Device Guard + Today’s security threat landscape is more aggressive than ever before. Modern malicious attacks are focused on revenue generation, intellectual property theft, and targeted system degradation, which results in financial loss. Many of these modern attackers are sponsored by nation states with unknown motives and large cyber terrorism budgets. These threats can enter a company through something as simple as an email message and can permanently damage its reputation for securing its software assets, as well as having significant financial impact. Windows 10 introduces several new security features that help mitigate a large percentage of today’s known threats. + It is estimated that more than 300,000 new malware variants are discovered daily. Unfortunately, companies currently use an ancient method to discover this infectious software and prevent its use. In fact, current PCs trust everything that runs until malware signatures determine whether a threat exists; then, the antimalware software attempts to clean the PC, often after the malicious software’s effect has already been noticed. This signature-based system focuses on reacting to an infection and ensuring that the particular infection does not happen again. In this model, the system that drives malware detection relies on the discovery of malicious software; only then can a signature be provided to the client to remediate it, which implies that a computer must be infected first. The time between the detection of the malware and a client being issued a signature could mean the difference between losing data and staying safe. + In addition to antimalware solutions, there are some “whitelisting” technologies available, including AppLocker. These technologies perform single instance, or blanket-allow or blanket-deny rules for running applications. Although this is more preventative than signature-based detection, it requires significant ongoing maintenance. In Windows 10, these applications are most effective when they are deployed alongside Microsoft Device Guard. + Device Guard breaks the current model of detection first-block later, and allows only trusted applications to run, period. This methodology is consistent with the successful prevention strategy for mobile phone security. With Device Guard, Microsoft has changed how the Windows operating system handles untrusted applications, which makes its defenses difficult for malware to penetrate. This new prevention versus detection model provides Windows clients with the necessary security for modern threats and, when implemented, makes most of today’s threats completely obsolete from day one. + Device Guard's features revolutionize the Windows operating system’s security by taking advantage of new virtualization-based security (VBS) options and the trust-nothing mobile device operating system model, which makes its defenses much more difficult for malware to penetrate. By using configurable code integrity policies, organizations are able to choose exactly which applications are allowed to run in their environment. Configurable code integrity is not limited to Windows Store applications and can be used with existing unsigned or signed Win32 applications, without the requirement that the application be repackaged. In addition, configurable code integrity can be deployed as an individual feature if organizations don’t possess the required hardware for Device Guard. Along with code integrity, Windows 10 leverages advanced hardware features such as CPU virtualization extensions, input/output memory management units (IOMMUs), Trusted Platform Module (TPM), and second-level address translation (SLAT) to offer comprehensive modern security to its users. Device Guard deployed with configurable code integrity and Credential Guard will be among the most impactful client-side security deployments an organization can implement today. In this guide, you learn about the individual features found within Device Guard as well as how to plan for, configure, and deploy them. Device Guard with configurable code integrity is intended for deployment alongside additional threat-mitigating Windows features such as Credential Guard and AppLocker. ## Device Guard overview Device Guard is a feature set that consists of both hardware and software system integrity hardening features. These features revolutionize the Windows operating system’s security by taking advantage of new virtualization-based security options and the trust-nothing mobile device operating system model. A key feature in this model is called *configurable code integrity*, which allows your organization to choose exactly which software or trusted software publishers are allowed to run code on your client machines—exactly what has made mobile phone security so successful. In addition, Device Guard offers organizations a way to sign existing line-of-business (LOB) applications so that they can trust their own code, without the requirement that the application be repackaged. Also, this same method of signing provides organizations with a way to trust individual third-party applications. Device Guard—with configurable code integrity, Credential Guard, and AppLocker—is the most complete security defense that any Microsoft product has ever been able to offer a Windows client. + Advanced hardware features such as CPU virtualization extensions, IOMMUs, and SLAT, drive these new client security offerings. By integrating these hardware features further into the core operating system, Windows 10 leverages them in new ways. For example, the same type 1 hypervisor technology that is used to run virtual machines in Microsoft Hyper-V is used to isolate core Windows services into a virtualization-based, protected container. This is just one example of how Windows 10 integrates advanced hardware features deeper into the operating system to offer comprehensive modern security to its users. These hardware features are now available in consumer and enterprise PC markets and are discussed in detail in the [Hardware considerations](#hardware-considerations) section. + Along with these new features, some components of Device Guard are existing tools or technologies that have been included in this strategic security offering to provide customers with the most secure Windows operating system possible. Device Guard is intended as a set of client security features to be used in conjunction with the other threat-resistance features available in the Windows operating system, some of which are mentioned in this guide. In addition to an overview of each feature, this guide walks you through the configuration and deployment of them. + **Configurable code integrity** + The Windows operating system consists of two operating modes: user mode and kernel mode. The base of the operating system runs within the kernel mode, which is where the Windows operating system directly interfaces with hardware resources. User mode is primarily responsible for running applications and brokering information to and from the kernel mode for hardware resource requests. For example, when an application that is running in user mode needs additional memory, the user mode process must request the resources from kernel mode, not directly from RAM. + Code integrity is the component of the Windows operating system that verifies that the code Windows is running is trusted and safe. Like the operating system, Windows code integrity also contains two primary components: kernel mode code integrity (KMCI) and user mode code integrity (UMCI). KMCI has been used in recent versions of the Windows operating system to protect the kernel mode from running unsigned drivers. Although effective, drivers are not the only route that malware can take to penetrate the kernel mode space of the operating system. In Windows 10, however, Microsoft has raised the standard for kernel mode code out of the box as well as provided enterprises with a way to set their own UMCI and KMCI standards. Beginning with the Code Integrity service itself and continuing through the policies a Windows client uses to verify that an application should be allowed to run, Microsoft has made Windows 10 more secure than any previous Windows release. Historically, UMCI has been available only in Windows RT and on Windows Phone devices, which has made it difficult for these devices to be infected with viruses and malware. In Windows 10, these same successful UMCI standards are available. + Historically, most malware has been unsigned. By simply deploying code integrity policies, organizations will immediately protect themselves against unsigned malware, which is estimated to be responsible for more than 95 percent of current attacks. By using code integrity policies, an enterprise can select exactly which binaries are allowed to run in both user mode and kernel mode, from the signer to the hash level. When completely enforced, it makes user mode in Windows function like a mobile phone, by allowing only specific applications or specific signatures to be trusted and run. This feature alone fundamentally changes the security in an enterprise. This additional security is not limited to Windows apps and does not require that an application be rewritten to be compatible with your existing, unsigned applications. You can implement configurable code integrity without enabling Device Guard, but it is intended to run in conjunction with Device Guard when supported hardware is available. For more information about how to configure, deploy, and manage code integrity policies, see the [Code integrity policies](#code-integrity-policies) section. + **Hardware security features and virtualization-based security** + The Device Guard core functionality and protection start at the hardware level. Devices that have processors equipped with SLAT technologies and virtualization extensions, such as Intel Virtualization Technology (VT-x) and AMD-V, will be able to take advantage of virtualization-based security (VBS) features that enhance Windows security. Device Guard leverages VBS to isolate core Windows services that are critical to the security and integrity of the operating system. This isolation removes the vulnerability of these services from both the user and kernel modes and acts as an impenetrable barrier for most malware used today. One of these isolated services, called the Windows Code Integrity service, drives the Device Guard kernel mode configurable code integrity feature. This prevents code that has penetrated the kernel mode operations from compromising the code integrity service. Another Windows 10 feature that employs VBS is Credential Guard. Credential Guard provides additional protection to Active Directory domain users by storing domain credentials within the virtualization container that hosts the Windows security services, such as code integrity. By isolating these domain credentials from the active user mode and kernel mode, they have a much lower risk of being stolen. For more information about how Credential Guard complements Device Guard, see the [Device Guard with Credential Guard](#device-guard-with-credential-guard) section. For information about how to enable Credential Guard, see the [Enable Credential Guard](#enable-credential-guard) section. + **Device Guard with AppLocker** + Although AppLocker is not considered a new Device Guard feature, it complements Device Guard functionality when enforced code integrity cannot be fully implemented or its functionality does not cover every desired scenario. There are many scenarios in which code integrity policies would be used alongside AppLocker rules. As a best practice, you should enforce code integrity policies at the most restrictive level possible for your organization, and then you can use AppLocker to fine-tune the restrictions to an even lower level. -**Note**  One example in which Device Guard functionality needs AppLocker supplementation is when your organization would like to limit universal applications. Universal applications have already been validated by Microsoft to be trustworthy to run, but an organization may not want to allow specific universal applications to run in their environment. You can accomplish this enforcement by using an AppLocker rule. + +>**Note:**  One example in which Device Guard functionality needs AppLocker supplementation is when your organization would like to limit universal applications. Universal applications have already been validated by Microsoft to be trustworthy to run, but an organization may not want to allow specific universal applications to run in their environment. You can accomplish this enforcement by using an AppLocker rule. AppLocker and Device Guard should run side-by-side in your organization, which offers the best of both security features at the same time and provides the most comprehensive security to as many devices as possible. In addition to these features, Microsoft recommends that you continue to maintain an enterprise antivirus solution for a well-rounded enterprise security portfolio. + **Device Guard with Credential Guard** + Although Credential Guard is not a feature within Device Guard, many organizations will likely deploy Credential Guard alongside Device Guard for additional protection against credential theft. Similar to virtualization-based protection of kernel mode code integrity, Credential Guard leverages hypervisor technology to protect domain credentials. This mitigation is targeted at resisting the use of pass-the-hash and pass-the-ticket techniques. By employing multifactor authentication with Credential Guard, organizations can gain additional protection against such threats. For information about how to deploy Credential Guard to your Windows 10 Enterprise clients, see the [Enable Credential Guard](#enable-cg) section. In addition to the client-side enablement of Credential Guard, organizations can deploy mitigations at both the CA and domain controller level to help prevent credential theft. Microsoft will be releasing details about these additional mitigations in the future. + **Unified manageability** + You can easily manage Device Guard features by using the familiar enterprise and client-management tools that IT pros use every day. Use the following management tools to enable and manage Device Guard: + - **Group Policy**. Windows 10 provides an administrative template to configure and deploy the configurable code integrity policies for your organization. This template also allows you to specify which hardware-based security features you would like to enable and deploy. You can manage these settings along with your existing Group Policy Objects (GPOs), which makes it simple to implement Device Guard features. In addition to these code integrity and hardware-based security features, you can use Group Policy to help you manage your catalog files. For more information about catalog files, see the [Catalog files](#catalog-files) section. - **Microsoft System Center Configuration Manager**. You can use System Center Configuration Manager to simplify deployment and management of catalog files, code integrity policies, and hardware-based security features, as well as provide version control. For more information about how to deploy catalog files by using System Center Configuration Manager, see the [Deploy catalog files with System Center Configuration Manager](#deploy-cat-sccm) section. - **Microsoft Intune**. In a future release of Microsoft Intune, organizations will be able to leverage Intune for deployment and management of code integrity policies and catalog files. - **Windows PowerShell**. Windows PowerShell is primarily used to create and service code integrity policies. These policies represent the most powerful component of Device Guard. For a step-by-step walkthrough of how to create, audit, service, enforce, and deploy code integrity policies, see the [Code integrity policies](#code-integrity-policies) section. + These options provide the same experience you are used to in order to manage your existing enterprise management solutions. For more information about how to manage and deploy Device Guard hardware and code integrity features in your organization, see the [Device Guard deployment](#dg-deployment) section. ## Plan for Device Guard In this section, you will learn about the following topics: + - [Approach enterprise code integrity deployment](#approach-enterprise-code-integrity-deployment). Device Guard deployment in your organization requires a planned approach. In this section, you get high-level recommendations for how to approach enterprise code integrity deployment in your organization. - [Device Guard deployment scenarios](#device-guard-deployment-scenarios). When you plan for Device Guard deployment, Microsoft recommends that you categorize each device in your organization into a deployment scenario. These scenarios will provide a roadmap for your Device Guard deployment. - [Code signing adoption](#code-signing-adoption). Code signing is important to the security that Device Guard provides. This section outlines the options for code signing and the benefits and disadvantages of each method. @@ -57,47 +82,79 @@ In this section, you will learn about the following topics: ## Approach enterprise code integrity deployment Enterprises that want to consider Device Guard should not expect deployment to their entire organization overnight. Device Guard implementation requires that you plan for both end-user and IT pro impact. In addition, the deployment of Device Guard features to your enterprise requires a planned, phased approach to ensure that end-user systems are fully capable and ready to enforce these new security restrictions. Perform the following high-level tasks to approach the deployment of Device Guard to your enterprise: + 1. **Group devices into similar functions**. Categorize machines into the groups described in the [Device Guard deployment scenarios](#device-guard-deployment-scenarios) section. This begins the roadmap for your Device Guard deployment and provides groups of easier and more difficult implementations. From there, assess the quantity of necessary Device Guard policies. The easiest solution is to lock down your entire enterprise, but it might not fit your individual departments’ needs. + To discover an appropriate number of policies for your organization, try to separate the defined groups into departments or roles. Then ask some questions: What software does each department or role need to do their job? Should they be able to install and run other departments’ software? Do we need to create a base code integrity policy that aligns with our application catalog? Should users be able to install any application or only choose from an “allowed” list? Do we allow users to use their own peripheral devices? These questions will help you discover the number of necessary policies for your organization. Finally, try to focus on which people or departments would require an additional level of privileges. For example, should department x be able to install and run application xyz, even though no other department does? If the answer is yes and justifiable, you will need a secondary code integrity policy for that group. If not, you will likely be able to merge several policies to simplify management. For more information about configurable code integrity policies, see the [Code integrity policies](#code-integrity-policies) section. + 2. **Create code integrity policies from “golden” PCs**. After you create the groups of devices, you can create code integrity policies to align with those groups, similar to the way you would manage corporate images. When you have separated these groups and set up golden PCs that mimic the software and hardware those individual groups require, create code integrity policies from each of them. After you create these, you can merge these code integrity policies to create a master policy, or you can manage and deploy them individually. For step-by-step instructions about how to create code integrity policies, see the [Create code integrity policies from golden PCs](#create-code-integrity-policies-from-golden-pcs) section. + 3. **Audit and merge code integrity policies**. Microsoft recommends that you test code integrity policies in audit mode before you enforce them. Audit mode allows administrators to run the code integrity policy on a system but not actually block anything. Rather than not allowing applications to run, events are logged with each exception to the policy. This way, you can easily highlight any issues that were not discovered during the initial scan. You can create additional code integrity policies by using the audit events and merge them into the existing policy. For more information about how to audit code integrity policies, see the [Audit code integrity policies](#audit-code-integrity-policies) section. + 4. **Assess LOB applications that are currently unsigned, and create a catalog file for them**. Catalog files allow organizations to sign applications that do not currently possess digitally signed binaries or applications that a customer would want to add a secondary signature to. These applications can be in-house applications or from third parties, and the process does not require any repackaging of the application. When you create code integrity policies at a rule level above hash values, you will not discover unsigned applications. To include these applications in your code integrity policies, simply create, sign, and deploy a catalog file. For information about catalog files, see the [Catalog files](#catalog-files) section. + 5. **Enable desired hardware security features**. Each type of device found in the [Device Guard deployment scenarios](#device-guard-deployment-scenarios) section takes advantage of different software and hardware integrity configurations. You should assess hardware-based security features separately from code integrity policies because they provide complementary functionality. For information about how to configure Device Guard hardware-based security features, see the [Configure hardware-based security features](#configure-hardware-based-security-features) section. + 6. **Deploy code integrity policies and catalog files**. After you have created and signed the necessary catalog files and created and audited code integrity policies, you are ready to deploy them in phases. Microsoft strongly recommends that you deploy these components to a test group of users, even after your IT organization has tested and vetted them. This provides a final quality control validation before you deploy the catalog files and policies more broadly. For information about how to deploy catalog files with Group Policy, see the [Deploy catalog files with Group Policy](#deploy-catalog-files-with-group-policy) section. For additional information about how to deploy code integrity policies, see the [Deploy code integrity policies with Group Policy](#deploy-code-integrity-policies-with-group-policy) section. + ## Device Guard deployment scenarios + To help simplify the deployment of Device Guard to your organization, Microsoft recommends that you group devices into the deployment scenarios described in this section. Device Guard is not a feature that organizations will just simply “turn on”; rather, it typically requires a phased implementation approach. To see where these scenarios fit into an overall Device Guard deployment approach, see the [Approach to enterprise code integrity deployment](#approach-to-enterprise-code-integrity-deployment) section. + **Fixed-workload devices** + The lists of approved applications on fixed-workload devices rarely change as they perform the same tasks day after day. Examples of such devices include kiosks, point-of-sale systems, and call center PCs. These devices could easily employ the full capabilities of Device Guard and would require little management or policy modification. Device Guard implementation to these devices is painless and requires little ongoing administration. With Device Guard fully implemented, users are able to run only those applications that the IT department installs, manages, and trusts. Device Guard components that are applicable to fixed-workload devices include: + - KMCI VBS protection - Enforced UMCI policy + **Fully managed devices** + Fully managed devices are those for which the IT department restricts the software that is installed and run on them, but allows users to request installation of additional software or provides a list of approved software in an application catalog. Examples of such devices include locked-down, company-owned desktops and laptops. With these devices, establish an initial baseline code integrity policy and enforce the code integrity policy. The IT department manages the policies and updates the devices when new applications are approved or are provided in the System Center Configuration Manager catalog. Device Guard components that are applicable to fully managed devices include: + - KMCI VBS protection - Enforced UMCI policy + In this scenario, an application list is provided and trusted, and the trust policy is constantly re-evaluated when a user requests a new application. When an application is trusted across all of these devices, new user requests for that application do not require a policy update (alignment with application catalog). In addition, you can couple this with an onboarding process for new applications that you should add to the central application catalog. Initial implementation of Device Guard to fully managed devices is simple but does require more administrative overhead to manage trusted signatures of newly requested and approved applications. + **Lightly managed devices** + Lightly managed devices are company-owned machines over which users have full control, which includes what is installed on them. These devices run the organization’s antivirus solution and client management tools but are not restricted by software request or compliance policies. + Device Guard components that are applicable to lightly managed devices include: + - KMCI VBS protection - UMCI policy in Audit mode + **Bring Your Own Device** + Device Guard is not a good way to manage devices in a Bring Your Own Device (BYOD) model. When employees are allowed to bring their own devices, the management of user-mode applications on them can make it difficult for users to use their own devices when they are not at work. In addition, Device Guard functionality is difficult to maintain from an administrative perspective. For devices in this group, explore alternate hardening and security features with MDM-based conditional access solutions, such as Microsoft Intune. + ## Code signing adoption + Code signing is crucial to the successful implementation of configurable code integrity policies. These policies can trust the signing certificates from both independent software vendors and customers. In Windows 10, all Windows Store applications are signed. Also, you can easily trust any other signed application by adding the signing certificate to the code integrity policy. For unsigned applications, customers have multiple options for signing them so that code integrity policies can trust them. The first option is traditional embedded code signing. Organizations that have in-house development teams can incorporate binary code signing into their application development process, and then simply add the signing certificate to their code integrity policies. The second option for signing unsigned applications is to use catalog files. In Windows 10, customers have the ability to create catalog files as they monitor the installation and initial run of an application. For more information about signing existing unsigned LOB applications or third-party applications, see the [Existing line-of-business applications](#existing-line-of-business-applications) section. + ### Existing line-of-business applications + Until now, existing LOB applications were difficult to trust if they were signed by a source other than the Windows Store or not signed at all. With Windows 10, signing your existing LOB and third-party unsigned applications is simplified. This new signing method does not require that applications be repackaged in any way. With catalog files, administrators can sign these unsigned applications simply by monitoring for an installation and initial startup. By using this monitoring information, an administrator can generate a catalog file. Catalog files are simply Secure Hash Algorithm 2 (SHA2) hash lists of discovered binaries. These binaries’ hash values are updated every time an application is updated and therefore require an updated catalog file. For simplified administration, consider incorporating embedded code signing into your application development process. For more information about how to generate catalog files, see the [Catalog files](#catalog-files) section. -**Note**   -Catalog files are lists of individual binaries’ hash values. If the scanned application is updated, you will need to create a new catalog file. That said, binary signing is still highly recommended for any future applications so that no catalog files are needed. + +>**Note:**  Catalog files are lists of individual binaries’ hash values. If the scanned application is updated, you will need to create a new catalog file. That said, binary signing is still highly recommended for any future applications so that no catalog files are needed.   When you create a catalog file, you must sign it by using enterprise public key infrastructure (PKI), or a purchased code signing certificate. When signed, code integrity policies can trust the signer or signing certificate of those files. For information about catalog file signing, see the [Catalog files](#catalog-files) section. + **Application development** + Although in-house applications can be signed after packaging by using catalog files, Microsoft strongly recommends that embedded code signing be incorporated into your application development process. When signing applications, simply add the code signing certificate used to sign your applications to your code integrity policy. This ensures that your code integrity policy will trust any future application that is signed with that certificate. Embedding code signing into any in-house application development process is beneficial to your IT organization as you implement code integrity policies. + ## Hardware considerations + Careful consideration about which hardware vendor and specific models to purchase during your next hardware refresh is vitally important to the success of your organization’s Device Guard implementation efforts. In alignment with your current hardware life cycle, consider the process that is discussed in the [Approach enterprise code integrity deployment](#approach-enterprise-code-integrity-deployment) section when you determine the appropriate order of hardware replacement in your organization. Device Guard should be deployed in phases; therefore, you have time to methodically plan for its implementation. + Different hardware features are required to implement the various features of Device Guard. There will likely be some individual features that you will be able to enable with your current hardware and some that you will not. However, for organizations that want to implement Device Guard in its entirety, several advanced hardware features will be required. For additional details about the hardware features that are required for Device Guard components, see the following table. +

      Policy path

      Policy name

      Value

      Admin Templates > Control Panel > Personalization

      Supported editionsWindows 10 Home, Windows 10 Pro, Windows 10 Education, Windows 10 Enterprise, Windows 10 Mobile, +Windows 10 Home, Windows 10 Pro, Windows 10 Education, Windows 10 Enterprise, IoT Core, IoT Core Pro Windows 10 Pro, Windows 10 Education, -Windows 10 Enterprise, Windows 10 Mobile Enterprise, +Windows 10 Enterprise, IoT Core Pro Windows 10 Enterprise LTSB
      @@ -156,122 +213,200 @@ Different hardware features are required to implement the various features of De
      + ## Device Guard deployment + In this section, you learn about the following topics: + - [Configure hardware-based security features](#configure-hardware-based-security-features). This section explains how to enable the hardware-based security features in Device Guard. Also, you verify that the features are enabled by using both Windows Management Infrastructure (WMI) and Msinfo32.exe. - [Catalog files](#catalog-files). In this section, you create, sign, and deploy catalog files. You deploy the catalog files by using both Group Policy and System Center Configuration Manager. Also, you use System Center Configuration Manager to inventory the deployed catalog files for reporting purposes. - [Code integrity policies](#code-integrity-policies). This section provides information on how to create, audit, service, merge, deploy, and remove signed and unsigned configurable code integrity policies. + ## Configure hardware-based security features + Hardware-based security features make up a large part of Device Guard security offerings. VBS reinforces the most important feature of Device Guard: configurable code integrity. There are three steps to configure hardware-based security features in Device Guard: + 1. **Verify that hardware requirements are met and enabled**. Verify that your client machines possess the necessary hardware to run these features. A list of hardware requirements for the hardware-based security features is available in the [Hardware considerations](#hardware-considerations) section. 2. **Enable the necessary Windows features**. There are several ways to enable the Windows features required for hardware-based security. For details on which Windows features are needed, see the [Windows feature requirements for virtualization-based security](#windows-feature-requirements-for-virtualization-based-security) section. 3. **Enable desired features**. When the necessary hardware and Windows features have been enabled, you are ready to enable the desired hardware-based security features. For UEFI Secure Boot, see the [Enable UEFI Secure Boot](#enable-unified-extensible-interface-secure-boot) section. For information about how to enable VBS protection of the KMCI service, see the [Enable virtualization-based protection of kernel mode code integrity](#enable-virtualbased) section. Finally, for information about how to enable Credential Guard, see the [Enable Credential Guard](#enable-credential-guard) section. + ### Windows feature requirements for virtualization-based security + In addition to the hardware requirements found in the [Hardware considerations](#hardware-considerations) section, you must enable certain operating system features before you can enable VBS: Microsoft Hyper-V and isolated user mode (shown in Figure 1). -**Note**   -You can configure these features manually by using Windows PowerShell or Deployment Image Servicing and Management. For specific information about these methods, refer to the [Credential Guard documentation](http://go.microsoft.com/fwlink/p/?LinkId=624529). + +>**Note:**  You can configure these features manually by using Windows PowerShell or Deployment Image Servicing and Management. For specific information about these methods, refer to the [Credential Guard documentation](http://go.microsoft.com/fwlink/p/?LinkId=624529).   ![figure 1](images/dg-fig1-enableos.png) + Figure 1. Enable operating system features for VBS + After you enable these features, you can configure any hardware-based security features you want. For information about how to enable virtualization-based protection of kernel-mode code integrity, see the [Enable virtualization-based protection of kernel-mode code integrity](#enable-virtualization-based-protection-of-kernel-mode-code-integrity) section. For information about how to enable UEFI Secure Boot, see the [Enable UEFI Secure Boot](#enable-unified-extensible-interface-secure-boot) section. Finally, for additional information about how to enable Credential Guard, see the [Enable Credential Guard](#enable-credential-guard) section. + ### Enable Unified Extensible Firmware Interface Secure Boot + Before you begin this process, verify that the target device meets the hardware requirements for UEFI Secure Boot that are laid out in the [Hardware considerations](#hardware-considerations) section. There are two options to configure UEFI Secure Boot: manual configuration of the appropriate registry keys and Group Policy deployment. Complete the following steps to manually configure UEFI Secure Boot on a computer running Windows 10: -**Note**   -There are two platform security levels for Secure Boot: stand-alone Secure Boot and Secure Boot with DMA protection. DMA protection provides additional memory protection but will be enabled only on systems whose processors include DMA protection (IOMMU) technologies. Without the presence of IOMMUs and with DMA protection disabled, customers will lose protection from driver-based attacks. + +>**Note:**  There are two platform security levels for Secure Boot: stand-alone Secure Boot and Secure Boot with DMA protection. DMA protection provides additional memory protection but will be enabled only on systems whose processors include DMA protection (IOMMU) technologies. Without the presence of IOMMUs and with DMA protection disabled, customers will lose protection from driver-based attacks. + 1. Navigate to the **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard** registry subkey. 2. Set the **EnableVirtualizationBasedSecurity DWORD** value to **1**. 3. Set the **RequirePlatformSecurityFeatures DWORD** value as appropriate: + - Set this value to **1** to enable the **Secure Boot** option. - Set this value to **2** to enable the **Secure Boot with DMA Protection** option. + 4. Restart the client machine. + Unfortunately, it would be time consuming to perform these steps manually on every protected machine in your enterprise. Group Policy offers a much simpler way to deploy UEFI Secure Boot to your organization. This example creates a test organizational unit (OU) called *DG Enabled PCs*. If you prefer to link the policy to an existing OU, and then scope the GPO by using appropriately named computer security groups, you can certainly do so. -**Note**   -Microsoft recommends that you test-enable this feature on a group of test machines before you deploy it to machines that are currently deployed to users. + +>**Note:**  Microsoft recommends that you test-enable this feature on a group of test machines before you deploy it to machines that are currently deployed to users. + **Use Group Policy to deploy Secure Boot** + + 1. To create a new GPO, right-click the OU to which you want to link the GPO, and then click **Create a GPO in this domain, and Link it here**. + ![figure 2](images/dg-fig2-createou.png) + Figure 2. Create a new OU-linked GPO + 2. Name the new GPO **Contoso Secure Boot GPO Test**. This example uses *Contoso Secure Boot GPO Test* as the name of the GPO. You can choose any name for this example. Ideally, the name would align with your existing GPO naming convention. + 3. To open the Group Policy Management Editor, right-click the new GPO, and then click **Edit**. + 4. Within the selected GPO, navigate to Computer Configuration\\Administrative Templates\\System\\Device Guard. Then, right-click **Turn On Virtualization Based Security**, and then click **Edit**. + ![figure 3](images/dg-fig3-enablevbs.png) + Figure 3. Enable VBS + 5. Select the **Enabled** option, and then select **Secure Boot and DMA Protection** from the **Select Platform Security Level** list. + ![figure 4](images/device-guard-gp.png) + Figure 4. Enable Secure Boot - **Note**   - Device Guard Secure Boot is maximized when combined with DMA protection. If your hardware contains the IOMMUs required for DMA protection, be sure to select the **Secure Boot and DMA Protection** platform security level. If your hardware does not contain IOMMU, there are several mitigations provided by leveraging Secure Boot without DMA Protection. + + >**Note:**  Device Guard Secure Boot is maximized when combined with DMA protection. If your hardware contains the IOMMUs required for DMA protection, be sure to select the **Secure Boot and DMA Protection** platform security level. If your hardware does not contain IOMMU, there are several mitigations provided by leveraging Secure Boot without DMA Protection.   6. Close the Group Policy Management Editor, and then restart the Windows 10 test computer. After you configure this setting, UEFI Secure Boot will be enabled upon restart. + 7. Check the test computer’s event log for Device Guard GPOs. + Processed Device Guard policies are logged in event viewer at Application and Services Logs\\Microsoft\\Windows\\DeviceGuard-GPEXT\\Operational. When the **Turn On Virtualization Based Security** policy is successfully processed, event ID 7000 is logged, which contains the selected settings within the policy. + ### Enable virtualization-based security of kernel-mode code integrity + Before you begin this process, verify that the desired computer meets the hardware requirements for VBS found in the [Hardware considerations](#hardware-considerations) section, and enable the Windows features discussed in the [Virtualization-based security Windows feature requirements](#virtualization-based-security-windows-featurerrequirements) section. When validated, you can enable virtualization-based protection of KMCI in one of two ways: manual configuration of the appropriate registry subkeys and Group Policy deployment. -**Note**   -All drivers on the system must be compatible with virtualization-based protection of code integrity; otherwise, your system may fail. Microsoft recommends that you enable this feature on a group of test machines before you enable it on deployed machines. + +>**Note:**  All drivers on the system must be compatible with virtualization-based protection of code integrity; otherwise, your system may fail. Microsoft recommends that you enable this feature on a group of test machines before you enable it on deployed machines. + To configure virtualization-based protection of KMCI manually: + 1. Navigate to the **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard** registry subkey. 2. Set the **HypervisorEnforcedCodeIntegrity DWORD** value to **1**. 3. Restart the client computer. + It would be time consuming to perform these steps manually on every protected machine in your enterprise. Instead, use Group Policy to deploy virtualization-based protection of KMCI. This example creates a test OU called *DG Enabled PCs*, which you will use to link the GPO. If you prefer to link the policy to an existing OU rather than create a test OU and scope the policy by using appropriately named computer security groups, that is another option. -**Note**   -Microsoft recommends that you test-enable this feature on a group of test computers before you deploy it to machines that are currently deployed to users. If untested, there is a possibility that this feature can cause system instability and ultimately cause the client operating system to fail. + +>**Note:**  Microsoft recommends that you test-enable this feature on a group of test computers before you deploy it to machines that are currently deployed to users. If untested, there is a possibility that this feature can cause system instability and ultimately cause the client operating system to fail. + To use Group Policy to configure VBS of KMCI: + 1. Create a new GPO: Right-click the OU to which you want to link the GPO, and then click **Create a GPO in this domain, and Link it here**. + ![figure 5](images/dg-fig5-createnewou.png) + Figure 5. Create a new OU-linked GPO + 2. Name the new GPO **Contoso VBS CI Protection GPO Test**. + This example uses *Contoso VBS CI Protection GPO Test* as the name of the GPO. You can choose any name you prefer for this example. Ideally, this name would align with your existing GPO naming convention. + 3. Open the Group Policy Management Editor: Right-click the new GPO, and then click **Edit**. + 4. Within the selected GPO, navigate to Computer Configuration\\Administrative Templates\\System\\Device Guard. Then, right-click **Turn On Virtualization Based Security**, and then click **Edit**. + ![figure 6](images/dg-fig6-enablevbs.png) + Figure 6. Enable VBS + 5. Select the **Enabled** option, and then select the **Enable Virtualization Based Protection of Code Integrity** check box. + ![figure 7](images/dg-fig7-enablevbsofkmci.png) + Figure 7. Enable VBS of KMCI + 6. Close the Group Policy Management Editor, and then restart the Windows 10 test computer. With this setting configured, the VBS of the KMCI will take effect upon restart. + 7. Check the test client event log for Device Guard GPOs. + Processed Device Guard policies are logged in event viewer under Application and Services Logs\\Microsoft\\Windows\\DeviceGuard-GPEXT\\Operational. When the **Turn On Virtualization Based Security** policy has been successfully processed, event ID 7000 is logged, which contains the selected settings within the policy. + ### Enable Credential Guard + Credential Guard provides an additional layer of credential protection specifically for domain users by storing the credentials within the virtualized container, away from both the kernel and user mode operating system. This makes it difficult for even a compromised system to obtain access to the credentials. In addition to the client-side enablement of Credential Guard, you can deploy additional mitigations at both the Certification Authority and domain controller level to prevent credential theft. Microsoft will be releasing details about these additional mitigations in the future. + Before you begin this process, verify that the desired system meets the hardware requirements for VBS found in the [Hardware considerations](#hardware) section, and that you have enabled the Windows features laid out in the [Virtualization-based security Windows feature requirements](#virtualization-based-security-windows-feature-requirements) section. When validated, you can enable Credential Guard manually, by configuring the appropriate registry subkeys, or through Group Policy deployment. + To configure VBS of Credential Guard manually: + 1. Navigate to the **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa** registry subkey. 2. Set the **LsaCfgFlags DWORD** value to **1**. 3. Restart the client computer. + To avoid spending an unnecessary amount of time in manual deployments, use Group Policy to deploy Credential Guard to your organization. This example creates a test OU called *DG Enabled PCs*. To enable Credential Guard, you can link to any OU, and then scope the GPO’s application by using security groups. -**Note**   -Microsoft recommends that you enable Credential Guard before you join a machine to the domain to ensure that all credentials are properly protected. Setting the appropriate registry subkeys during your imaging process would be ideal to achieve this protection. + +>**Note:**  Microsoft recommends that you enable Credential Guard before you join a machine to the domain to ensure that all credentials are properly protected. Setting the appropriate registry subkeys during your imaging process would be ideal to achieve this protection. + To use Group Policy to enable Credential Guard: + 1. Create a new GPO: right-click the OU to which you want to link the GPO, and then click **Create a GPO in this domain, and Link it here** . + ![figure 8](images/dg-fig8-createoulinked.png) + Figure 8. Create a new OU-linked GPO + 2. Name the new GPO **Contoso Credential Guard GPO Test**. + This example uses *Contoso Credential Guard GPO Test* as the name of the GPO. You can choose any name you prefer for this example. Ideally, this name would align with your existing GPO naming convention. + 3. Open the Group Policy Management Editor: right-click the new GPO, and then click **Edit**. + 4. Within the selected GPO, navigate to Computer Configuration\\Administrative Templates\\System\\Device Guard. Right-click **Turn On Virtualization Based Security**, and then click **Edit**. + ![figure 9](images/dg-fig9-enablevbs.png) + Figure 9. Enable VBS + 5. Select the **Enabled** option, and then select the **Enable Credential Guard** check box. + ![figure 10](images/dg-fig10-enablecredentialguard.png) + Figure 10. Enable Credential Guard + 6. Close Group Policy Management Editor, and then restart the Windows 10 test computer. - **Note**   - The default platform security level is **Secure Boot**. If IOMMUs are available within the protected machines, it is recommended that you select **Secure Boot and DMA Protection** to maximize the mitigations that are available through Credential Guard. + + >**Note:**  The default platform security level is **Secure Boot**. If IOMMUs are available within the protected machines, it is recommended that you select **Secure Boot and DMA Protection** to maximize the mitigations that are available through Credential Guard. + 7. Check the test client event log for Device Guard GPOs. -**Note**   -All processed Device Guard policies are logged in event viewer under Application and Services Logs\\Microsoft\\Windows\\DeviceGuard-GPEXT\\Operational. + +>**Note**  All processed Device Guard policies are logged in event viewer under Application and Services Logs\\Microsoft\\Windows\\DeviceGuard-GPEXT\\Operational.   For additional information about how Credential Guard works as well as additional configuration options, please refer to the [Credential Guard documentation](http://go.microsoft.com/fwlink/p/?LinkId=624529). + **Validate enabled Device Guard hardware-based security features** + Windows 10 and Windows Server 2016 and later have a WMI class for Device Guard–related properties and features: *Win32\_DeviceGuard*. This class can be queried from an elevated Windows PowerShell session by using the following command: + `Get-CimInstance –ClassName Win32_DeviceGuard –Namespace root\Microsoft\Windows\DeviceGuard` -**Note**   -The *Win32\_DeviceGuard* WMI class is only available on the Enterprise edition of Windows 10. + +>**Note:**  The *Win32\_DeviceGuard* WMI class is only available on the Enterprise edition of Windows 10. + The output of this command provides details of the available hardware-based security features as well as those features that are currently enabled. For detailed information about what each property means, refer to Table 1.   Table 1. Win32\_DeviceGuard properties + @@ -350,119 +485,181 @@ Table 1. Win32\_DeviceGuard properties
      -Another method to determine the available and enabled Device Guard features is to run msinfo32.exe from an elevated PowerShell session. When you run this program, the Device Guard properties are displayed at the bottom of the **System Summary** section, as shown in Figure 11. + +Another method to determine the available and enabled Device Guard features is to run msinfo32.exe from an elevated PowerShell session. When you run this program, the Device Guard properties are displayed at the bottom of the +**System Summary** section, as shown in Figure 11. + ![figure 11](images/dg-fig11-dgproperties.png) + Figure 11. Device Guard properties in the System Summary + ## Catalog files + Enforcement of Device Guard on a system requires that every trusted application have a signature or its binary hashes added to the code integrity policy. For many organizations, this can be an issue when considering unsigned LOB applications. To avoid the requirement that organizations repackage and sign these applications, Windows 10 includes a tool called Package Inspector that monitors an installation process for any deployed and executed binary files. If the tool discovers such files, it itemizes them in a catalog file. These catalog files offer you a way to trust your existing unsigned applications, whether developed in house or by a third party, as well as trust signed applications for which you do not want to trust the signer but rather the specific application. When created, these files can be signed, the signing certificates added to your existing code integrity policies, and the catalog files themselves distributed to the clients. -**Note**   -The Enterprise edition of Windows 10 or Windows Server 2016 is required to create and use catalog files. + +>**Note:**  The Enterprise edition of Windows 10 or Windows Server 2016 is required to create and use catalog files. + ### Create catalog files + The creation of catalog files is the first step to add an unsigned application to a code integrity policy. To create a catalog file, copy each of the following commands into an elevated Windows PowerShell session, and then complete the steps: -**Note**   -When you establish a naming convention it makes it easier to detect deployed catalog files in the future. In this guide, you will use *\*-Contoso.cat* as the naming convention. For more information about why this practice is helpful to inventory or detect catalog files, see the [Inventory catalog files with System Center Configuration Manager](#inventory-catalog-files-with-system-center-configuration-manager) section. + +>**Note:**  When you establish a naming convention it makes it easier to detect deployed catalog files in the future. In this guide, you will use *\*-Contoso.cat* as the naming convention. For more information about why this practice is helpful to inventory or detect catalog files, see the [Inventory catalog files with System Center Configuration Manager](#inventory-catalog-files-with-system-center-configuration-manager) section.   1. Be sure that a code integrity policy is currently running in audit mode. + Package Inspector does not always detect installation files that have been removed from the machine during the installation process. To ensure that these binaries are also trusted, the code integrity policy that you created and audited in the [Create code integrity policies from golden PCs](#create-code-integrity-policies-from-golden-pcs) and [Audit code integrity policies](#audit-code-integrity-policies) sections should be deployed, in audit mode, to the system on which you are running Package Inspector. + **Note**   This process should **not** be performed on a system running an enforced Device Guard policy, only with a policy running in audit mode. If a policy is currently being enforced, you will not be able to install and run the application. + 2. Start Package Inspector, and then scan drive C: + `PackageInspector.exe Start C:` - **Note**   - Package inspector can monitor installations on any local drive. In this example, we install the application on drive C, but any other drive can be used. + + >**Note:**  Package inspector can monitor installations on any local drive. In this example, we install the application on drive C, but any other drive can be used.   3. Copy the installation media to drive C. + By copying the installation media to drive C, you ensure that Package Inspector detects and catalogs the actual installer. If you skip this step, the future code integrity policy may trust the application to run but not be installed. + 4. Install and launch the application. - Install the application to drive C. When the installation is finished, launch the application and ensure that any product updates are installed and any downloadable content caught during the scan. When finished, close and reopen the application once again to ensure that the scan has captured all binaries. - **Note**   - Every binary that is run while Package Inspector is running will be captured in the catalog. Therefore, be sure not to run additional installations or updates during the scan to minimize the risk of trusting the incorrect binaries. Alternatively, if you want to add multiple applications to a single catalog file, simply repeat the installation and run process while the current scan is running. + + Install the application to drive C. When the installation is finished, launch the application and ensure that any product updates are installed and any downloadable content caught during the scan. When finished, close and + reopen the application once again to ensure that the scan has captured all binaries. + + >**Note:**   Every binary that is run while Package Inspector is running will be captured in the catalog. Therefore, be sure not to run additional installations or updates during the scan to minimize the risk of trusting the incorrect binaries. Alternatively, if you want to add multiple applications to a single catalog file, simply repeat the installation and run process while the current scan is running.   5. Stop the scan, and then generate definition and catalog files. When application installation and initial setup are finished, stop the Package Inspector scan and generate the catalog and definition files on your desktop by using the following commands: + `$ExamplePath=$env:userprofile+"\Desktop"` `$CatFileName=$ExamplePath+"\LOBApp-Contoso.cat"` `$CatDefName=$ExamplePath+"\LOBApp.cdf"` `PackageInspector.exe Stop C: -Name $CatFileName -cdfpath $CatDefName` -**Note**   -This scan catalogs the hash values for each discovered binary file. If the applications that were scanned are updated, complete this process again to trust the new binaries’ hash values. + +>**Note:**  This scan catalogs the hash values for each discovered binary file. If the applications that were scanned are updated, complete this process again to trust the new binaries’ hash values. When finished, the files will be saved to your desktop. To trust this catalog file within a code integrity policy, the catalog must first be signed. Then, the signing certificate can be included in the code integrity policy, and the catalog file can be distributed to the individual client machines. Catalog files can be signed by using a certificate and SignTool.exe, a free tool available in the Windows SDK. For more information about signing catalog files with SignTool.exe, see the [Catalog signing with SignTool.exe](#catalog-signing-with-signtool.exe) section. + ### Catalog signing with SignTool.exe + Device Guard makes it easy for organizations to sign and trust existing unsigned LOB applications. In this section, you sign a catalog file you generated in a previous section by using PackageInspector.exe. For information about how to create catalog files, see the [Create catalog files](#create-catalog-files) section. In this example, you need the following: + - SignTool.exe, found in the Windows software development kit (SDK—Windows 7 or later) - The catalog file that you generated in the [Create catalog files](#create-catalog-files) section, or another catalog file that you have created - Internal certification authority (CA) code signing certificate or purchased code signing certificate + If you do not have a code signing certificate, please see the [Create a Device Guard code signing certificate](#create-a-device-guard-code-signing-certificate) section for a walkthrough of how to create one. In addition to using the certificate you create in the Create a Device Guard code signing certificate section, this example signs the catalog file that you created in the [Create catalog files](#create-catalog-files) section. If you are using an alternate certificate or catalog file, update the following steps with the appropriate variables and certificate. To sign the existing catalog file, copy each of the following commands into an elevated Windows PowerShell session: + 1. Initialize the variables that will be used: + '$ExamplePath=$env:userprofile+"\Desktop"' '$CatFileName=$ExamplePath+"\LOBApp-Contoso.cat"' - **Note**   - In this example, you use the catalog file you created in the [Create catalog files](#create-catalog-files) section. If you are signing another catalog file, be sure to update the *$ExamplePath* and *$CatFileName* variables with the correct information. + + >**Note:**   In this example, you use the catalog file you created in the [Create catalog files](#create-catalog-files) section. If you are signing another catalog file, be sure to update the *$ExamplePath* and *$CatFileName* variables with the correct information. + 2. Import the code signing certificate. Import the code signing certificate that will be used to sign the catalog file to the signing user’s personal store. In this example, you use the certificate that you created in the [Create a Device Guard code signing certificate](#create-a-device-guard-code-signing-certificate) section. + 3. Sign the catalog file with Signtool.exe: + ` sign /n "ContosoDGSigningCert" /fd sha256 /v $CatFileName` - **Note**   - The *<Path to signtool.exe>* variable should be the full path to the Signtool.exe utility. *ContosoDGSigningCert* is the subject name of the certificate that you will use to sign the catalog file. This certificate should be imported to your personal certificate store on the machine on which you are attempting to sign the catalog file. - **Note**   - For additional information about Signtool.exe and all additional switches, visit [MSDN Sign Tool page](http://go.microsoft.com/fwlink/p/?LinkId=624163). + + >**Note:**  The *<Path to signtool.exe>* variable should be the full path to the Signtool.exe utility. *ContosoDGSigningCert* is the subject name of the certificate that you will use to sign the catalog file. This certificate should be imported to your personal certificate store on the machine on which you are attempting to sign the catalog file. + + >**Note:**  For additional information about Signtool.exe and all additional switches, visit [MSDN Sign Tool page](http://go.microsoft.com/fwlink/p/?LinkId=624163).   4. Verify the catalog file digital signature. Right-click the catalog file, and then click **Properties**. On the **Digital Signatures** tab, verify that your signing certificate exists with a **sha256** algorithm, as shown in Figure 12. + ![figure 12](images/dg-fig12-verifysigning.png) + Figure 12. Verify that the signing certificate exists + 5. Copy the catalog file to C:\\Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}. + For testing purposes, you can manually copy signed catalog files to their intended folder. For large-scale implementations, Microsoft recommends that you use Group Policy File Preferences to copy the appropriate catalog files to all desired machines or an enterprise systems management product such as System Center Configuration Manager. Doing this simplifies the management of catalog versions, as well. + ### Deploy catalog files with Group Policy + To simplify the management of catalog files, you can use Group Policy preferences to deploy catalog files to the appropriate PCs in your organization. The following process walks you through the deployment of a signed catalog file called LOBApp-Contoso.cat to a test OU called DG Enabled PCs with a GPO called **Contoso DG Catalog File GPO Test**. -**Note**   -This walkthrough requires that you have previously created a signed catalog file and have a Windows 10 client PC on which to test a Group Policy deployment. For more information about how to create and sign a catalog file, see the [Catalog files](#catalog-files) section. + +>**Note:**  This walkthrough requires that you have previously created a signed catalog file and have a Windows 10 client PC on which to test a Group Policy deployment. For more information about how to create and sign a catalog file, see the [Catalog files](#catalog-files) section. + To deploy a catalog file with Group Policy: + 1. From either a domain controller or a client PC that has Remote Server Administration Tools (RSAT) installed, open the Group Policy Management Console (GPMC) by running **GPMC.MSC** or by searching for Group Policy Management. 2. Create a new GPO: right-click the DG Enabled PCs OU, and then click **Create a GPO in this domain, and Link it here**, as shown in Figure 13. - **Note**   - The DG Enabled PCs OU is just an example of where to link the test GPO that you created in this section. You can use any OU name. Also, security group filtering is an option when you consider policy partitioning options based on the strategy discussed in the [Approach enterprise code integrity deployment](#approach-enterprise-code-integrity-deployment) section. + + >**Note:**  The DG Enabled PCs OU is just an example of where to link the test GPO that you created in this section. You can use any OU name. Also, security group filtering is an option when you consider policy partitioning options based on the strategy discussed in the [Approach enterprise code integrity deployment](#approach-enterprise-code-integrity-deployment) section. + ![figure 13](images/dg-fig13-createnewgpo.png) + Figure 13. Create a new GPO + 3. Name the new GPO **Contoso DG Catalog File GPO Test**. + This example uses *Contoso DG Catalog File GPO Test* as the name of the GPO. You can choose any name you prefer for this example. + 4. Open the Group Policy Management Editor: right-click the new GPO, and then click **Edit**. + 5. Within the selected GPO, navigate to Computer Configuration\\Preferences\\Windows Settings\\Files. Right-click **Files**, point to **New**, and then click **File**, as shown in Figure 14. + ![figure 14](images/dg-fig14-createnewfile.png) + Figure 14. Create a new file + 6. Configure the catalog file share. + To use this setting to provide consistent deployment of LOBApp-Contoso.cat, the source file should be on a share that is accessible to the computer account of every deployed machine. This example uses a share on a Windows 10 client machine called \\\\Contoso-Win10\\Share. The catalog file being deployed is copied to this share. + 7. To keep versions consistent, in the **New File Properties** dialog box (Figure 15), select **Replace** from the **Action** list so that the newest version is always used. + ![figure 15](images/dg-fig15-setnewfileprops.png) + Figure 15. Set the new file properties + 8. In the **Source file(s)** box, type the name of your accessible share, with the catalog file name included (for example, \\\\Contoso-Win10\\share\\LOBApp-Contoso.cat). + 9. In the **Destination File** box, type **C:\\Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\LOBApp-Contoso.cat**. - **Note**   - LOBApp-Contoso.cat is not a required catalog name: This name was used in the [Create catalog files](#create-catalog-files) section, and so it was used here, as well. + + >**Note:**  LOBApp-Contoso.cat is not a required catalog name: This name was used in the [Create catalog files](#create-catalog-files) section, and so it was used here, as well.   10. On the **Common** tab of the **New File Properties** dialog box, select the **Remove this item when it is no longer applied** option. Doing this ensures that the catalog file is removed from every system, in case you ever need to stop trusting this application. + 11. Click **OK** to complete file creation. + 12. Close the Group Policy Management Editor, and then update the policy on the test Windows 10 machine by running GPUpdate.exe. When the policy has been updated, verify that the catalog file exists in C:\\Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE} on the Windows 10 machine. + ### Deploy catalog files with System Center Configuration Manager + As an alternative to Group Policy, you can use System Center Configuration Manager to deploy catalog files to the managed machines in your environment. This approach can simplify the deployment and management of multiple catalog files as well as provide reporting around which catalog each client or collection has deployed. In addition to the deployment of these files, System Center Configuration Manager can also be used to inventory the currently deployed catalog files for reporting and compliance purposes. Complete the following steps to create a new deployment package for catalog files: -**Note**   -The following example uses a network share named \\\\Shares\\CatalogShare as a source for the catalog files. If you have collection specific catalog files, or prefer to deploy them individually, use whichever folder structure works best for your organization. + +>**Note:**  The following example uses a network share named \\\\Shares\\CatalogShare as a source for the catalog files. If you have collection specific catalog files, or prefer to deploy them individually, use whichever folder structure works best for your organization. + 1. Open the Configuration Manager console, and select the Software Library workspace. 2. Navigate to Overview\\Application Management, right-click **Packages**, and then click **Create Package**. 3. Name the package, set your organization as the manufacturer, and select an appropriate version number (Figure 16). + ![figure 16](images/dg-fig16-specifyinfo.png) + Figure 16. Specify information about the new package + 4. Click **Next**, and then select **Standard program** as the program type. 5. On the **Standard Program** page, select a name, and then set the **Command Line** property to **XCopy \\\\Shares\\CatalogShare C:\\Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE} /H /K /E /Y**. 6. On the **Standard Program** page, select the following options (Figure 17): + - In **Name**, type **Contoso Catalog File Copy Program**. - In **Command line**, browse to the program location. - In **Startup folder**, type **C:\\Windows\\System32**. - From the **Run** list, select **Hidden**. - From the **Program can run** list, select **Whether or not a user is logged on**. - From the **Drive mode** list, select **Runs with UNC name**. + ![figure 17](images/dg-fig17-specifyinfo.png) + Figure 17. Specify information about the standard program + 7. Accept the defaults for the rest of the wizard, and then close the wizard. After you create the deployment package, deploy it to a collection so that the clients will receive the catalog files. In this example, you deploy the package you just created to a test collection: + 1. In the Software Library workspace, navigate to Overview\\Application Management\\Packages, right-click the catalog file package, and then click **Deploy**. 2. On the **General** page, select the test collection to which the catalog files will be deployed, and then click **Next**. 3. On the **Content** page, click **Add** to select the distribution point that will serve content to the selected collection, and then click **Next**. @@ -471,60 +668,92 @@ After you create the deployment package, deploy it to a collection so that the c 6. In the **Assignment Schedule** dialog box, select **Assign immediately after this event**, set the value to **As soon as possible**, and then click **OK**. 7. On the **Scheduling** page, click **Next**. 8. On the **User Experience** page (Figure 18), set the following options, and then click **Next**: + - Select the **Software installation** check box. - Select the **Commit changes at deadline or during a maintenance window (requires restarts)** check box. + ![figure 18](images/dg-fig18-specifyux.png) + Figure 18. Specify the user experience + 9. On the **Distribution Points** page, in the **Deployment options** box, select **Run program from distribution point**, and then click **Next**. 10. On the **Summary** page, review the selections, and then click **Next**. 11. Close the wizard. + ### Inventory catalog files with System Center Configuration Manager + When catalog files have been deployed to the machines within your environment, whether by using Group Policy or System Center Configuration Manager, you can inventory them with the software inventory feature of System Center Configuration Manager. The following process walks you through the enablement of software inventory to discover catalog files on your managed systems through the creation and deployment of a new client settings policy. -**Note**   -A standard naming convention for your catalog files will significantly simplify the catalog file software inventory process. In this example, *-Contoso* has been added to all catalog file names. + +>**Note:**  A standard naming convention for your catalog files will significantly simplify the catalog file software inventory process. In this example, *-Contoso* has been added to all catalog file names. + 1. Open the Configuration Manager console, and select the Administration workspace. 2. Navigate to **Overview\\Client Settings**, right-click **Client Settings**, and then click **Create Custom Client Device Settings**. 3. Name the new policy, and select the **Software Inventory** check box from the **Select and then configure the custom settings for client devices** list, as shown in Figure 19. + ![figure 19](images/dg-fig19-customsettings.png) + Figure 19. Select custom settings + 4. In the navigation pane, click **Software Inventory**, and then click **Set Types**, as shown in Figure 20. + ![figure 20](images/dg-fig20-setsoftwareinv.png) + Figure 20. Set the software inventory + 5. In the **Configure Client Setting** dialog box, click the **Start** button to open the **Inventories File Properties** dialog box. + 6. In the **Name** box, type **\*Contoso.cat**, and then click **Set**. - **Note**   - **\*Contoso.cat** is the naming convention used in this example. This should mimic the naming convention you use for your catalog files. + + >**Note:**  **\*Contoso.cat** is the naming convention used in this example. This should mimic the naming convention you use for your catalog files.   7. In the **Path Properties** dialog box, select **Variable or path name**, and then type **C:\\Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}** in the box, as shown in Figure 21. + ![figure 21](images/dg-fig21-pathproperties.png) + Figure 21. Set the path properties + 8. Click **OK**. + 9. Now that you have created the client settings policy, right-click the new policy, click **Deploy**, and then choose the collection on which you would like to inventory the catalog files. At the time of the next software inventory cycle, when the targeted clients receive the new client settings policy, you will be able to view the inventoried files in the built-in System Center Configuration Manager reports or Resource Explorer. To view the inventoried files on a client within Resource Explorer, complete the following steps: + 1. Open the Configuration Manager console, and select the Assets and Compliance workspace. 2. Navigate to Overview\\Devices, and search for the device on which you want to view the inventoried files. 3. Right-click the computer, point to **Start**, and then click **Resource Explorer**. 4. In Resource Explorer, navigate to Software\\File Details to view the inventoried catalog files. -**Note**   -If nothing is displayed in this view, navigate to Software\\Last Software Scan in Resource Explorer to verify that the client has recently completed a software inventory scan. + +>**Note:**  If nothing is displayed in this view, navigate to Software\\Last Software Scan in Resource Explorer to verify that the client has recently completed a software inventory scan.   ## Code integrity policies + Code integrity policies maintain the standards by which a computer running Windows 10 determines whether an application is trustworthy and can be run. For an overview of code integrity, see the [Configurable code integrity](#configurable-code-integrity) section. + A common system imaging practice in today’s IT organization is to establish a “golden” image as a reference for what an ideal system should look like, and then use that image to clone additional company assets. Code integrity policies follow a similar methodology, that begins with the establishment of a golden PC. Like when imaging, you can have multiple golden PCs based on model, department, application set, and so on. Although the thought process around the creation of code integrity policies is similar to imaging, these policies should be maintained independently. Assess the necessity of additional code integrity policies based on what should be allowed to be installed and run and for whom. -**Note**   -Each machine can have only **one** code integrity policy at a time. Whichever way you deploy this policy, it is renamed to SIPolicy.p7b and copied to C:\\Windows\\System32\\CodeIntegrity. Keep this in mind when you create your code integrity policies. + +>**Note:**  Each machine can have only **one** code integrity policy at a time. Whichever way you deploy this policy, it is renamed to SIPolicy.p7b and copied to C:\\Windows\\System32\\CodeIntegrity. Keep this in mind when you create your code integrity policies. + Optionally, code integrity policies can align with your software catalog as well as any IT department–approved applications. One simple method to implement code integrity policies is to use existing images to create one master code integrity policy. You do so by creating a code integrity policy from each image, and then by merging the policies. This way, what is installed on all of those images will be allowed to run, should the applications be installed on a computer based on a different image. Alternatively, you may choose to create a base applications policy and add policies based on the computer’s role or department. Organizations have a choice of how their policies are created, merged or serviced, and managed. -**Note**   -The following section assumes that you will deploy code integrity policies as part of your Device Guard deployment. Alternatively, configurable code integrity is available without the enablement of Device Guard. + +>**Note:**  The following section assumes that you will deploy code integrity policies as part of your Device Guard deployment. Alternatively, configurable code integrity is available without the enablement of Device Guard. + ### Code integrity policy rules + Code integrity policies consist of several components. The two major components, which are configurable, are called *policy rules* and *file rules*, respectively. Code integrity policy rules are options that the code integrity policy creator can specify on the policy. These options include the enablement of audit mode, UMCI, and so on. You can modify these options in a new or existing code integrity policy. File rules are the level to which the code integrity policy scan ties each binary trust. For example, the hash level is going to itemize each discovered hash on the system within the generated code integrity policy. This way, when a binary prepares to run, the code integrity service will validate its hash value against the trusted hashes found in the code integrity policy. Based on that result, the binary will or will not be allowed to run. + To modify the policy rule options of an existing code integrity policy, use the **Set-RuleOption** Windows PowerShell cmdlet. Note the following examples of how to use this cmdlet to add and remove a rule option on an existing code integrity policy: + - To enable UMCI, add rule option 0 to an existing policy by running the following command: + `Set-RuleOption -Option 0 -FilePath ` + - To disable UMCI on an existing code integrity policy, remove rule option 0 by running the following command: + ` Set-RuleOption -Option 0 -FilePath -Delete` + You can set several rule options within a code integrity policy. Table 2 lists each rule and its high-level meaning. + Table 2. Code integrity policy - policy rule options + | Rule option | Description | |------------ | ----------- | | **0 Enabled:UMCI** | Code integrity policies restrict both kernel-mode and user-mode binaries. By default, only kernel-mode binaries are restricted. Enabling this rule option validates user mode executables and scripts. | @@ -539,7 +768,9 @@ Table 2. Code integrity policy - policy rule options | **9 Enabled:Advanced Boot Options Menu** | The F8 preboot menu is disabled by default for all code integrity policies. Setting this rule option allows the F8 menu to appear to physically present users. | | **10 Enabled:Boot Audit on Failure** | Used when the code integrity policy is in enforcement mode. When a driver fails during startup, the code integrity policy will be placed in audit mode so that Windows will load. Administrators can validate the reason for the failure in the CodeIntegrity event log. | File rule levels allow administrators to specify the level at which they want to trust their applications. This level of trust could be as low as the hash of each binary and as high as a PCA certificate. File rule levels are specified both when you create a new code integrity policy from a scan and when you create a policy from audit events. In addition, to combine rule levels found in multiple policies, you can merge the policies. When merged, code integrity policies combine their file rules. Each file rule level has its benefit and disadvantage. Use Table 3 to select the appropriate protection level for your available administrative resources and Device Guard deployment scenario. + Table 3. Code integrity policy - file rule levels + | Rule level | Description | |----------- | ----------- | | **Hash** | Specifies individual hash values for each discovered binary. Although this level is specific, it can cause additional administrative overhead to maintain the current product versions’ hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. | @@ -553,258 +784,383 @@ Table 3. Code integrity policy - file rule levels | **WHQL** | Trusts binaries if they have been validated and signed by WHQL. This is primarily for kernel binaries. | | **WHQLPublisher** | This is a combination of the WHQL and the CN on the leaf certificate and is primarily for kernel binaries. | | **WHQLFilePublisher** | Specifies that the binaries are validated and signed by WHQL, with a specific publisher (WHQLPublisher), and that the binary is the specified version or newer. This is primarily for kernel binaries. | -**Note**   -When you create code integrity policies with the **New-CIPolicy** cmdlet, you can specify a primary file rule level by including the **–Level** parameter. For discovered binaries that cannot be trusted based on the primary file rule criteria, use the **–Fallback** parameter. For example, if the primary file rule level is PCACertificate but you would like to trust the unsigned applications as well, using the Hash rule level as a fallback adds the hash values of binaries that did not have a signing certificate. + +>**Note:**  When you create code integrity policies with the **New-CIPolicy** cmdlet, you can specify a primary file rule level by including the **–Level** parameter. For discovered binaries that cannot be trusted based on the primary file rule criteria, use the **–Fallback** parameter. For example, if the primary file rule level is PCACertificate but you would like to trust the unsigned applications as well, using the Hash rule level as a fallback adds the hash values of binaries that did not have a signing certificate. + ### Create code integrity policies from golden PCs + The process to create a golden code integrity policy from a reference system is straightforward. This section outlines the process that is required to successfully create a code integrity policy with Windows PowerShell. First, for this example, you must initiate variables to be used during the creation process. Rather than using variables, you can simply use the full file paths in the command. Next, you create the code integrity policy by scanning the system for installed applications. When created, the policy file is converted to binary format so that Windows can consume its contents. -**Note**   -Before you begin this procedure, ensure that the reference PC is clean of viruses or malware. Each piece of installed software should be validated as trustworthy before you create this policy. Also, be sure that any software that you would like to be scanned is installed on the system before you create the code integrity policy. + +>**Note:**  Before you begin this procedure, ensure that the reference PC is clean of viruses or malware. Each piece of installed software should be validated as trustworthy before you create this policy. Also, be sure that any software that you would like to be scanned is installed on the system before you create the code integrity policy. + To create a code integrity policy, copy each of the following commands into an elevated Windows PowerShell session, in order: + 1. Initialize variables that you will use: + `$CIPolicyPath=$env:userprofile+"\Desktop\"` `$InitialCIPolicy=$CIPolicyPath+"InitialScan.xml"` `$CIPolicyBin=$CIPolicyPath+"DeviceGuardPolicy.bin"` + 2. Create a new code integrity policy by scanning the system for installed applications: + `New-CIPolicy -Level PcaCertificate -FilePath $InitialCIPolicy –UserPEs 3> CIPolicyLog.txt ` - **Note**   - By specifying the *–UserPEs* parameter, rule option **0 Enabled:UMCI** is automatically added to the code integrity policy. If you do not specify this parameter, use the following command to enable UMCI: + + >**Note:**  By specifying the *–UserPEs* parameter, rule option **0 Enabled:UMCI** is automatically added to the code integrity policy. If you do not specify this parameter, use the following command to enable UMCI: + `Set-RuleOption -Option 0 -FilePath $InitialCIPolicy` - **Note**   - You can add the *–Fallback* parameter to catch any applications not discovered using the primary file rule level specified by the *–Level* parameter. For more information about file rule level options, see the [Code integrity policy rules](#code-integrity-policy-rules) section. - **Note**   - If you would like to specify the code integrity policy scan to look only at a specific drive, you can do so by using the *–ScanPath* parameter. Without this parameter, as shown in the example, the entire system is scanned. + + >**Note:**  You can add the *–Fallback* parameter to catch any applications not discovered using the primary file rule level specified by the *–Level* parameter. For more information about file rule level options, see the [Code integrity policy rules](#code-integrity-policy-rules) section. + + >**Note:**  If you would like to specify the code integrity policy scan to look only at a specific drive, you can do so by using the *–ScanPath* parameter. Without this parameter, as shown in the example, the entire system is scanned. + 3. Convert the code integrity policy to a binary format: + `ConvertFrom-CIPolicy $InitialCIPolicy $CIPolicyBin` + After you complete these steps, the Device Guard binary file (DeviceGuardPolicy.bin) and original .xml file (IntialScan.xml) will be available on your desktop. You can use the binary version as a code integrity policy or sign it for additional security. -**Note**   -Microsoft recommends that you keep the original .xml file of the policy for use when you need to merge the code integrity policy with another policy or update its rule options. Alternatively, you would have to create a new policy from a new scan for servicing. For more information about how to merge code integrity policies, see the [Merge code integrity policies](#merge-code-integrity-policies) section. + +>**Note:**  Microsoft recommends that you keep the original .xml file of the policy for use when you need to merge the code integrity policy with another policy or update its rule options. Alternatively, you would have to create a new policy from a new scan for servicing. For more information about how to merge code integrity policies, see the [Merge code integrity policies](#merge-code-integrity-policies) section. + Microsoft recommends that every code integrity policy be run in audit mode before being enforced. Doing so allows administrators to discover any issues with the policy without receiving error message dialog boxes. For information about how to audit a code integrity policy, see the [Audit code integrity policies](#audit-code-integrity-policies) section. + ### Audit code integrity policies + When code integrity policies are run in audit mode, it allows administrators to discover any applications that were missed during an initial policy scan and to identify any new applications that have been installed and run since the original policy was created. While a code integrity policy is running in audit mode, any binary that runs and would have been denied had the policy been enforced is logged in the Applications and Services Logs\\Microsoft\\CodeIntegrity\\Operational event log. When these logged binaries have been validated, they can easily be added to a new code integrity policy. When the new exception policy is created, you can merge it with your existing code integrity policies. -**Note**   -Before you begin this process, you need to create a code integrity policy binary file. If you have not already done so, see the [Create a code integrity policy](#create-a-code-integrity-policy) section for a step-by-step walkthrough of the process to create a code integrity policy and convert it to binary format. + +>**Note:**  Before you begin this process, you need to create a code integrity policy binary file. If you have not already done so, see the [Create an audit code integrity policy](#create-an-audit-code-integrity-policy) section for a step-by-step walkthrough of the process to create a code integrity policy and convert it to binary format. + To audit a code integrity policy with local policy: + 1. Copy the DeviceGuardPolicy.bin file that you created in the [Create code integrity policies from golden PCs](#create-code-integrity-policies-from-golden-pcs) section to C:\\Windows\\System32\\CodeIntegrity. 2. On the system you want to run in audit mode, open the Local Group Policy Editor by running **GPEdit.msc**. 3. Navigate to Computer Configuration\\Administrative Templates\\System\\Device Guard, and then select **Deploy Code Integrity Policy**. Enable this setting by using the file path C:\\Windows\\System32\\CodeIntegrity\\DeviceGuardPolicy.bin, as shown in Figure 22. - **Note**   - *DeviceGuardPolicy.bin* is not a required policy name. This name was simply used in the [Create code integrity policies from golden PCs](#create-code-golden) section and so was used here. Also, this policy file does not need to be copied to every system. Alternatively, you can copy the code integrity policies to a file share to which all computer accounts have access. - **Note**   - Any policy you select here is converted to SIPolicy.p7b when it is deployed to the individual computers. + + >**Note:**  *DeviceGuardPolicy.bin* is not a required policy name. This name was simply used in the [Create code integrity policies from golden PCs](#create-code-golden) section and so was used here. Also, this policy file does not need to be copied to every system. Alternatively, you can copy the code integrity policies to a file share to which all computer accounts have access. + + >**Note:**  Any policy you select here is converted to SIPolicy.p7b when it is deployed to the individual computers. + ![figure 22](images/dg-fig22-deploycode.png) + Figure 22. Deploy your code integrity policy - **Note**   - You may have noticed that the GPO setting references a .p7b file and this policy uses a .bin file. Regardless of the type of policy you deploy (.bin, .p7b, or .p7), they are all converted to SIPolicy.p7b when dropped on the Windows 10 computers. Microsoft recommends that you make your code integrity policies friendly and allow the system to convert the policy names for you. By doing this, it ensures that the policies are easily distinguishable when viewed in a share or any other central repository. + + >**Note:**   You may have noticed that the GPO setting references a .p7b file and this policy uses a .bin file. Regardless of the type of policy you deploy (.bin, .p7b, or .p7), they are all converted to SIPolicy.p7b when dropped on the Windows 10 computers. Microsoft recommends that you make your code integrity policies friendly and allow the system to convert the policy names for you. By doing this, it ensures that the policies are easily distinguishable when viewed in a share or any other central repository. + 4. Restart reference system for the code integrity policy to take effect. -5. Monitor the CodeIntegrity event log. While in audit mode, any exception to the deployed code integrity policy will be logged in the Applications and Services Logs\\Microsoft\\CodeIntegrity\\Operational event log, as shown in Figure 23. +5. Monitor the CodeIntegrity event log. While in audit mode, any exception to the deployed code integrity policy will be logged in the Applications and Services Logs\\Microsoft\\CodeIntegrity\\Operational event log, as shown in +Figure 23. + ![figure 23](images/dg-fig23-exceptionstocode.png) + Figure 23. Exceptions to the deployed code integrity policy + 6. Validate any code integrity policy exceptions. + After you run a code integrity policy in audit mode, Microsoft recommends that each logged exception be researched and validated. In addition to discovering which application is causing the exception and ensuring that it should be added to the code integrity policy, be sure to check which file level should be used to trust each application. Although the Hash file rule level will catch all of these exceptions, it may not be the best way to trust all of the exceptions. For information about file rule levels and their purpose, see the [Code integrity policy rules](#code-integrity-policy-rules) section. + 7. Create code integrity policy from audit events. + For information about how to create code integrity policies from audit events, see the [Create code integrity policies from golden PCs](#create-code-golden) section. -**Note**   -An alternative method to test a policy is to rename the test file to SIPolicy.p7b and drop it into C:\\Windows\\System32\\CodeIntegrity, rather than deploy it with the local machine policy. + +>**Note:**  An alternative method to test a policy is to rename the test file to SIPolicy.p7b and drop it into C:\\Windows\\System32\\CodeIntegrity, rather than deploy it with the local machine policy. + ### Create an audit code integrity policy + When you run code integrity policies in audit mode, validate any exceptions and determine whether you will need to add them to the code integrity policy you want to audit. Use the system as you normally would to ensure that any use exceptions are logged. When you are ready to create a code integrity policy from the auditing events, complete the following steps in an elevated Windows PowerShell session: + 1. Initialize the variables that will be used: + `$CIPolicyPath=$env:userprofile+"\Desktop\"` `$CIAuditPolicy=$CIPolicyPath+"DeviceGuardAuditPolicy.xml"` + 2. Analyze audit results. + Before you create a code integrity policy from audit events, Microsoft recommends that each exception be analyzed, as discussed in steps 5 and 6 of the [Audit code integrity policies](#audit-code-integrity-policies) section. + 3. Generate a new code integrity policy from logged audit events: + `New-CIPolicy -Audit -Level Hash -FilePath $CIAuditPolicy –UserPEs 3> CIPolicylog.txt` -**Note**   -When you create policies from audit events, you should carefully consider the file rule level that you select to trust. In this example, you use the Hash rule level, which should be used as a last resort. + +>**Note:**  When you create policies from audit events, you should carefully consider the file rule level that you select to trust. In this example, you use the Hash rule level, which should be used as a last resort. After you complete these steps, the Device Guard audit policy .xml file (DeviceGuardAuditPolicy.xml) will be available on your desktop. You can now use this file to update the existing code integrity policy that you ran in audit mode by merging the two policies. For instructions on how to merge this audit policy with the existing code integrity policy, see the [Merge code integrity policies](#merge-code-integrity-policies) section. -**Note**   -You may have noticed that you did not generate a binary version of this policy as you did in the [Create code integrity policies from golden PCs](#create-code-integrity-policies-from-golden-pcs) section. This is because code integrity policies created from an audit log are not intended to run as stand-alone policies but rather to update existing code integrity policies. + +>**Note:**  You may have noticed that you did not generate a binary version of this policy as you did in the [Create code integrity policies from golden PCs](#create-code-integrity-policies-from-golden-pcs) section. This is because code integrity policies created from an audit log are not intended to run as stand-alone policies but rather to update existing code integrity policies. + ### Merge code integrity policies + When you develop code integrity policies, you will occasionally need to merge two policies. A common example is when a code integrity policy is initially created and audited. Another example is when you create a single master policy by using multiple code integrity policies previously created from golden PCs. Because each Windows 10 machine can have only one code integrity policy, it is important to properly maintain these policies. In this example, audit events have been saved into a secondary code integrity policy that you then merge with the initial code integrity policy. -**Note**   -The following example uses the code integrity policy .xml files that you created in the [Create code integrity policies from golden PCs](#create-code-integrity-policies-from-golden-pcs) and [Audit code integrity policies](#audit-code-integrity-policies) sections. You can follow this process, however, with any two code integrity policies you would like to combine. + +>**Note:**  The following example uses the code integrity policy .xml files that you created in the [Create code integrity policies from golden PCs](#create-code-integrity-policies-from-golden-pcs) and [Audit code integrity policies](#audit-code-integrity-policies) sections. You can follow this process, however, with any two code integrity policies you would like to combine. + To merge two code integrity policies, complete the following steps in an elevated Windows PowerShell session: + 1. Initialize the variables that will be used: + ` $CIPolicyPath=$env:userprofile+"\Desktop\"` `$InitialCIPolicy=$CIPolicyPath+"InitialScan.xml"` `$AuditCIPolicy=$CIPolicyPath+"DeviceGuardAuditPolicy.xml"` `$MergedCIPolicy=$CIPolicyPath+"MergedPolicy.xml"` ` $CIPolicyBin=$CIPolicyPath+"NewDeviceGuardPolicy.bin"` - **Note**   - The variables in this section specifically expect to find an initial policy on your desktop called InitialScan.xml and an audit code integrity policy called DeviceGuardAuditPolicy.xml. If you want to merge other code integrity policies, update the variables accordingly. + + >**Note:**  The variables in this section specifically expect to find an initial policy on your desktop called InitialScan.xml and an audit code integrity policy called DeviceGuardAuditPolicy.xml. If you want to merge other code integrity policies, update the variables accordingly.   2. Merge two policies to create a new code integrity policy: + `Merge-CIPolicy -PolicyPaths $InitialCIPolicy,$AuditCIPolicy -OutputFilePath $MergedCIPolicy` -3. Convert the merged code integrity policy to binary format: +3. +Convert the merged code integrity policy to binary format: + ` ConvertFrom-CIPolicy $MergedCIPolicy $CIPolicyBin ` + Now that you have created a new code integrity policy called NewDeviceGuardPolicy.bin, you can deploy the policy to systems manually or by using Group Policy or Microsoft client management solutions. For information about how to deploy this new policy with Group Policy, see the [Deploy and manage code integrity policies with Group Policy](#deploy-manage-code-gp) section. + **Enforce code integrity policies** + Every code integrity policy is created with audit mode enabled. After you have successfully deployed and tested a code integrity policy in audit mode and are ready to test the policy in enforced mode, complete the following steps in an elevated Windows PowerShell session: -**Note**   -Every code integrity policy should be tested in audit mode first. For information about how to audit code integrity policies, see the [Audit code integrity policies](#audit-code-integrity) section. + +>**Note:**  Every code integrity policy should be tested in audit mode first. For information about how to audit code integrity policies, see the [Audit code integrity policies](#audit-code-integrity) section. + 1. Initialize the variables that will be used: + `$CIPolicyPath=$env:userprofile+"\Desktop\"` `$InitialCIPolicy=$CIPolicyPath+"InitialScan.xml" ` `$EnforcedCIPolicy=$CIPolicyPath+"EnforcedPolicy.xml"` `$CIPolicyBin=$CIPolicyPath+"EnforcedDeviceGuardPolicy.bin"` - **Note**   - The initial code integrity policy that this section referenced was created in the [Create code integrity polices from golden PCs](#create-code-golden) section. If you are using a different code integrity policy, update the **CIPolicyPath** and **InitialCIPolicy** variables. + + >**Note:**  The initial code integrity policy that this section referenced was created in the [Create code integrity polices from golden PCs](#create-code-golden) section. If you are using a different code integrity policy, update the **CIPolicyPath** and **InitialCIPolicy** variables.   2. Copy the initial file to maintain an original copy: + `cp $InitialCIPolicy $EnforcedCIPolicy` + 3. Remove the audit mode rule option: + `Set-RuleOption -Option 3 -FilePath $EnforcedCIPolicy -Delete` - **Note**   - Rather than adding an **Enforced** option, code integrity policies are implicitly enforced if no **Audit Mode Enabled** option is present. + + >**Note:**  Rather than adding an **Enforced** option, code integrity policies are implicitly enforced if no **Audit Mode Enabled** option is present.   4. Convert the new code integrity policy to binary format: + `ConvertFrom-CIPolicy $EnforcedCIPolicy $CIPolicyBin` - **Note**   - Microsoft strongly recommends that you enable rule options 9 and 10 before you run any enforced policy for the first time. If already present in the policy, do not remove it. Doing so allows Windows to start if the code integrity policy blocks a kernel-mode driver from running and provides administrators with a pre-boot command prompt. When ready for enterprise deployment, you can remove these options. + >**Note:**  Microsoft strongly recommends that you enable rule options 9 and 10 before you run any enforced policy for the first time. If already present in the policy, do not remove it. Doing so allows Windows to start if the code integrity policy blocks a kernel-mode driver from running and provides administrators with a pre-boot command prompt. When ready for enterprise deployment, you can remove these options.   Now that this policy has been enforced, you can deploy it to your test machines. Rename the policy to SIPolicy.p7b and copy it to C:\\Windows\\System32\\CodeIntegrity for testing, or deploy the policy through Group Policy by following the instructions in the [Deploy and manage code integrity policies with Group Policy](#deploy-and-manage-code-integrity-policies-with-group-policy) section, or through client management software by following the instructions in the section “Deploying and managing code integrity policies by using Microsoft client management solutions.” + **Signing code integrity policies with SignTool.exe** + Signed code integrity policies give organizations the highest level of malware protection available in Windows 10. In addition to their enforced policy rules, signed policies cannot be modified or deleted by a user or administrator on the machine. These policies are designed to prevent administrative tampering and kernel mode exploit access. With this in mind, it is much more difficult to remove signed code integrity policies than unsigned ones. Before you sign and deploy a signed code integrity policy, Microsoft recommends that you audit the policy to discover any blocked applications that should be allowed to run. For more information about how to audit code integrity policies, see the [Audit code integrity policies](#audit-code-integrity-policies) section. + Signing code integrity policies by using an on-premises CA-generated certificate or a purchased code signing certificate is straightforward. If you do not currently have a code signing certificate exported in .pfx format (containing private keys, extensions, and root certificates), see [Create a Device Guard code signing certificate](#create-a-device-guard-code-signing-certificate) to create one with your on-premises CA. Before signing code integrity policies for the first time, be sure to enable rule options 9 and 10 to leave troubleshooting options available to test administrators. When validated and ready for enterprise deployment, you can remove these options. For information about how to add rule options, see the [Code integrity policy rules](#code-integrity-policy-rules) section. -**Note**   -Signing code integrity policies is the last step in a code integrity deployment. It is much more difficult to remove a signed code integrity policy than an unsigned one. Before you deploy a signed code integrity policy to deployed client computers, be sure to test its effect on a subset of machines. + +>**Note:**  Signing code integrity policies is the last step in a code integrity deployment. It is much more difficult to remove a signed code integrity policy than an unsigned one. Before you deploy a signed code integrity policy to deployed client computers, be sure to test its effect on a subset of machines. + To sign a code integrity policy with SignTool.exe, you need the following components: + - SignTool.exe, found in the Windows SDK (Windows 7 or later) - The binary format of the code integrity policy that you generated in the [Create code integrity policies from golden PCs](#create-code-golden) section or another code integrity policy that you have created - An internal CA code signing certificate or a purchased code signing certificate -If you do not have a code signing certificate, see the [Create a Device Guard code signing certificate](#create-dg-code) section for instructions on how to create one. If you use an alternate certificate or code integrity policy, be sure to update the following steps with the appropriate variables and certificate so that the commands will function properly. To sign the existing code integrity policy, copy each of the following commands into an elevated Windows PowerShell session: + +If you do not have a code signing certificate, see the [Create a Device Guard code signing certificate](#create-dg-code) section for instructions on how to create one. If you use an alternate certificate or code integrity policy, be sure to update the following steps with the appropriate variables and certificate so that the commands will function properly. To sign the existing code integrity policy, copy each of the following commands into an elevated +Windows PowerShell session: + 1. Initialize the variables that will be used: + `$CIPolicyPath=$env:userprofile+"\Desktop\" $InitialCIPolicy=$CIPolicyPath+"InitialScan.xml" $CIPolicyBin=$CIPolicyPath+"DeviceGuardPolicy.bin"` - **Note**   - This example uses the code integrity policy that you created in the [Create code integrity policies from golden PCs](#create-code-golden) section. If you are signing another policy, be sure to update the **$CIPolicyPath** and **$CIPolicyBin** variables with the correct information. + + >**Note:**  This example uses the code integrity policy that you created in the [Create code integrity policies from golden PCs](#create-code-golden) section. If you are signing another policy, be sure to update the **$CIPolicyPath** and **$CIPolicyBin** variables with the correct information. + 2. Import the .pfx code signing certificate. Import the code signing certificate that you will use to sign the code integrity policy into the signing user’s personal store on the machine that will be doing the signing. In this example, you use the certificate that was created in the [Create a Device Guard code signing certificate](#create-dg-code) section. + 3. Export the .cer code signing certificate. After the code signing certificate has been imported, export the .cer version to your desktop. This version will be added to the policy so that it can be updated later. + 4. Navigate to your desktop as the working directory: + `cd $env:USERPROFILE\Desktop ` + 5. Add an update signer certificate to the code integrity policy: + `Add-SignerRule -FilePath $InitialCIPolicy -CertificatePath -Kernel -User –Update` - **Note**   - *<Path to exported .cer certificate>* should be the full path to the certificate that you exported in step 3. + + >**Note:**  *<Path to exported .cer certificate>* should be the full path to the certificate that you exported in step 3. - **Note**   - Adding update signers is crucial to being able to modify or disable this policy in the future. For more information about how to disable signed code integrity policies, see the [Disable signed code integrity policies within Windows](#disable-signed-code) section. + >**Note:**  Adding update signers is crucial to being able to modify or disable this policy in the future. For more information about how to disable signed code integrity policies, see the [Disable signed code integrity policies within Windows](#disable-signed-code) section. + 6. Remove the unsigned policy rule option: + `Set-RuleOption -Option 6 -FilePath $InitialCIPolicy -Delete` + 7. Convert the policy to binary format: + `ConvertFrom-CIPolicy $InitialCIPolicy $CIPolicyBin` + 8. Sign the code integrity policy by using SignTool.exe: + ` sign -v /n "ContosoDGSigningCert" -p7 . -p7co 1.3.6.1.4.1.311.79.1 -fd sha256 $CIPolicyBin` - **Note**   - The *<Path to signtool.exe>* variable should be the full path to the SignTool.exe utility. **ContosoDGSigningCert** is the subject name of the certificate that will be used to sign the code integrity policy. You should import this certificate to your personal certificate store on the machine you use to sign the policy. + >**Note:**  The *<Path to signtool.exe>* variable should be the full path to the SignTool.exe utility. **ContosoDGSigningCert** is the subject name of the certificate that will be used to sign the code integrity policy. You should import this certificate to your personal certificate store on the machine you use to sign the policy. + 9. Validate the signed file. When complete, the commands should output a signed policy file called DeviceGuardPolicy.bin.p7 to your desktop. You can deploy this file the same way you deploy an enforced or non-enforced policy. For information about how to deploy code integrity policies, see the [Deploy and manage code integrity policies with Group Policy](#deploy-and-manage-code-integrity-policies-with-group-policy) section. + ### Disable unsigned code integrity policies + There may come a time when an administrator wants to disable a code integrity policy. For unsigned code integrity policies, this process is simple. Depending on how the code integrity policy was deployed, unsigned policies can be disabled in one of two ways. If a code integrity policy was manually enabled and copied to the code integrity folder location, simply delete the file and restart the machine. The following locations can contain executing code integrity policies: + - <EFI System Partition>\\Microsoft\\Boot\\ - <OS Volume>\\Windows\\System32\\CodeIntegrity\\ + If the code integrity policy was deployed by using Group Policy, the GPO that is currently enabling and deploying the policy must be set to disabled. Then, the code integrity policy will be disabled on the next computer restart. + ### Disable signed code integrity policies within Windows + Signed policies protect Windows from administrative manipulation as well as malware that has gained administrative-level access to the system. For this reason, signed code integrity policies are intentionally more difficult to remove than unsigned policies. They inherently protect themselves from modification or removal and therefore are difficult even for administrators to remove successfully. If the signed code integrity policy is manually enabled and copied to the CodeIntegrity folder, to remove the policy, you must complete the following steps: -**Note**   -For reference, signed code integrity policies should be replaced and removed from the following locations: + +>**Note:**  For reference, signed code integrity policies should be replaced and removed from the following locations: + - <EFI System Partition>\\Microsoft\\Boot\\ - <OS Volume>\\Windows\\System32\\CodeIntegrity\\ + 1. Replace the existing policy with another signed policy that has the **6 Enabled: Unsigned System Integrity Policy** rule option enabled. - **Note**   - To take effect, this policy must be signed with a certificate previously added to the **UpdatePolicySigners** section of the original signed policy you want to replace. + + >**Note:**  To take effect, this policy must be signed with a certificate previously added to the **UpdatePolicySigners** section of the original signed policy you want to replace. + 2. Restart the client computer. + 3. Verify that the new signed policy exists on the client. - **Note**   - If the signed policy that contains rule option 6 has not been processed on the client, the addition of an unsigned policy may cause boot failures. + + >**Note:**  If the signed policy that contains rule option 6 has not been processed on the client, the addition of an unsigned policy may cause boot failures. + 4. Delete the new policy. + 5. Restart the client computer. + If the signed code integrity policy has been deployed using by using Group Policy, you must complete the following steps: + 1. Replace the existing policy in the GPO with another signed policy that has the **6 Enabled: Unsigned System Integrity Policy** rule option enabled. - **Note**   - To take effect, this policy must be signed with a certificate previously added to the **UpdatePolicySigners** section of the original signed policy you want to replace. + >**Note:**  To take effect, this policy must be signed with a certificate previously added to the **UpdatePolicySigners** section of the original signed policy you want to replace.   2. Restart the client computer. + 3. Verify that the new signed policy exists on the client. - **Note**   - If the signed policy that contains rule option 6 has not been processed on the client, the addition of an unsigned policy may cause boot failures. + + >**Note:**  If the signed policy that contains rule option 6 has not been processed on the client, the addition of an unsigned policy may cause boot failures. + 4. Set the GPO to disabled. 5. Delete the new policy. 6. Restart the client computer. + ### Disable signed code integrity policies within the BIOS + There may be a time when signed code integrity policies cause a boot failure. Because code integrity policies enforce kernel mode drivers, it is important that they be thoroughly tested on each software and hardware configuration before being enforced and signed. Signed code integrity policies are validated in the pre-boot sequence by using Secure Boot. When you disable the Secure Boot feature in the BIOS, and then delete the file from the following locations on the operating system disk, it allows the system to boot into Windows: + - <EFI System Partition>\\Microsoft\\Boot\\ - <OS Volume>\\Windows\\System32\\CodeIntegrity\\ + ### + **Deploy and manage code integrity policies with Group Policy** + Code integrity policies can easily be deployed and managed with Group Policy. A Device Guard administrative template will be available in Windows Server 2016 that allows you to simplify deployment of Device Guard hardware-based security features and code integrity policies. The following procedure walks you through how to deploy a code integrity policy called **DeviceGuardPolicy.bin** to a test OU called *DG Enabled PCs* by using a GPO called **Contoso GPO Test**. -**Note**   -This walkthrough requires that you have previously created a code integrity policy and have a Windows 10 client PC on which to test a Group Policy deployment. For more information about how to create a code integrity policy, see the [Create code integrity polices from golden PCs](#create-code-integrity-polices-from-golden-pcs) section. -**Note**   -Signed code integrity policies can cause boot failures when deployed. Microsoft recommends that signed code integrity policies be thoroughly tested on each hardware platform before enterprise deployment. + +>**Note:**  This walkthrough requires that you have previously created a code integrity policy and have a Windows 10 client PC on which to test a Group Policy deployment. For more information about how to create a code integrity policy, see the [Create code integrity polices from golden PCs](#create-code-integrity-polices-from-golden-pcs) section. + +>**Note:**  Signed code integrity policies can cause boot failures when deployed. Microsoft recommends that signed code integrity policies be thoroughly tested on each hardware platform before enterprise deployment. To deploy and manage a code integrity policy with Group Policy: + 1. On a domain controller on a client computer on which RSAT is installed, open the GPMC by running **GPMC.MSC** or searching for “Group Policy Management” in Windows Search. + 2. Create a new GPO: right-click the DG Enabled PCs OU, and then click **Create a GPO in this domain, and Link it here**, as shown in Figure 24. - **Note**   - The DG Enabled PCs OU is just an example of where to link the test GPO created in this section. Any OU name can be used. Also, security group filtering is an option when considering policy partitioning options based on the strategy discussed in the [Approach enterprise code integrity deployment](#approach-enterprise) section. + + >**Note:**  The DG Enabled PCs OU is just an example of where to link the test GPO created in this section. Any OU name can be used. Also, security group filtering is an option when considering policy partitioning options based on the strategy discussed in the [Approach enterprise code integrity deployment](#approach-enterprise) section. + ![figure 24](images/dg-fig24-creategpo.png) + Figure 24. Create a GPO + 3. Name new GPO **Contoso GPO Test**. This example uses Contoso GPO Test as the name of the GPO. You can choose any name that you prefer for this example. + 4. Open the Group Policy Management Editor: right-click the new GPO, and then click **Edit**. + 5. In the selected GPO, navigate to Computer Configuration\\Administrative Templates\\System\\Device Guard. Then, right-click **Deploy Code Integrity Policy**, and then click **Edit**. + ![figure 25](images/dg-fig25-editcode.png) + Figure 25. Edit the code integration policy + 6. In the **Display Code Integrity Policy** dialog box, select the **Enabled** option, and then specify the code integrity policy deployment path. In this policy setting, you specify either the local path in which the policy will exist on the client computer or a Universal Naming Convention (UNC) path that the client computers will look to retrieve the latest version of the policy. This example copied the DeviceGuardPolicy.bin file onto the test machine and will enable this setting and use the file path C:\\Windows\\System32\\CodeIntegrity\\DeviceGuardPolicy.bin, as shown in Figure 26. - **Note**   - *DeviceGuardPolicy.bin* is not a required policy name: It was simply used in the [Create code integrity policies from golden PCs](#create-code-golden) section and so is used here, as well. Also, this policy file does not need to be copied to every computer. Alternatively, you can copy the code integrity policies to a file share to which the computer accounts have access. Any policy selected here is converted to SIPolicy.p7b when it is deployed to the individual client computers. + + >**Note:**  *DeviceGuardPolicy.bin* is not a required policy name: It was simply used in the [Create code integrity policies from golden PCs](#create-code-golden) section and so is used here, as well. Also, this policy file does not need to be copied to every computer. Alternatively, you can copy the code integrity policies to a file share to which the computer accounts have access. Any policy selected here is converted to SIPolicy.p7b when it is deployed to the individual client computers. + ![figure 26](images/dg-fig26-enablecode.png) + Figure 26. Enable the code integrity policy - **Note**   - You may have noticed that the GPO setting references a .p7b file and this example uses a .bin file for the policy. Regardless of the type of policy you deploy (.bin, .p7b, or .p7), they are all converted to SIPolicy.p7b when dropped on the Windows 10 client computers. Make your code integrity policies friendly and allow the system to convert the policy names for you to ensure that the policies are easily distinguishable when viewed in a share or any other central repository. + + >**Note:**  You may have noticed that the GPO setting references a .p7b file and this example uses a .bin file for the policy. Regardless of the type of policy you deploy (.bin, .p7b, or .p7), they are all converted to SIPolicy.p7b when dropped on the Windows 10 client computers. Make your code integrity policies friendly and allow the system to convert the policy names for you to ensure that the policies are easily distinguishable when viewed in a share or any other central repository. + 7. Close the Group Policy Management Editor, and then restart the Windows 10 test machine. Restarting the client computer updates the code integrity policy. For information about how to audit code integrity policies, see the [Audit code integrity policies](#audit-code-integrity-policies)section. + ## Create a Device Guard code signing certificate + To sign catalog files or code integrity policies internally, you will either need a publicly issued code signing certificate or an internal CA. If you have purchased a code signing certificate, you can skip these steps and proceed to the sections that outline the steps to sign catalog files and code integrity policies. If you have not purchased a certificate but have an internal CA, complete these steps to create a code signing certificate: + 1. Open the Certification Authority Microsoft Management Console (MMC) snap-in, and then select your issuing CA. 2. When connected, right-click **Certificate Templates**, and then click **Manage** to open the Certification Templates Console. + ![figure 27](images/dg-fig27-managecerttemp.png) + Figure 27. Manage the certificate templates + 3. In the navigation pane, right-click the Code Signing certificate, and then click **Duplicate Template**. + 4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** from the **Certification Authority** list, and then select **Windows 8 / Windows Server 2012** from the **Certificate recipient** list. 5. On the **General** tab, specify the **Template display name** and **Template name**. This example uses **DG Catalog Signing Certificate**. 6. On the **Request Handling** tab, select the **Allow private key to be exported** check box. 7. On the **Extensions** tab, select the **Basic Constraints** check box, and then click **Edit**. 8. In the **Edit Basic Constraints Extension** dialog box, select the **Enable the extension** check box, as shown in Figure 28. + ![figure 28](images/dg-fig29-enableconstraints.png) + Figure 28. Enable constraints on the new template -9. If a certificate manager is required to approve any issued certificates, on the **Issuance Requirements** tab, select **CA certificate manager approval**. +9. +If a certificate manager is required to approve any issued certificates, on the **Issuance Requirements** tab, select **CA certificate manager approval**. 10. On the **Subject Name** tab, select **Supply in the request**. 11. On the **Security** tab, verify that whatever account will be used to request the certificate has the right to enroll the certificate. 12. Click **OK** to create the template, and then close the Certificate Template Console. When this certificate template has been created, you must publish it to the CA published template store. To do so, complete the following steps: 1. In the Certification Authority MMC snap-in, right-click **Certification Templates**, point to **New**, and then click **Certificate Template to Issue**, as shown in Figure 29. + A list of available templates to issue appears, including the template you just created. + ![figure 29](images/dg-fig30-selectnewcert.png) + Figure 29. Select the new certificate template to issue + 2. Select the DG Catalog signing certificate, and then click **OK**. Now that the template is available to be issued, you must request one from the Windows 10 computer that you use to create and sign catalog files. To begin, open the MMC, and then complete the following steps: 1. In MMC, from the **File** menu, click **Add/Remove Snap-in**. Double-click **Certificates**, and then select **My user account**. 2. In the Certificates snap-in, right-click the Personal store folder, point to **All Tasks**, and then click **Request New Certificate**. 3. Click **Next** twice to get to the certificate selection list. 4. In the **Request Certificate** list, select your newly created code signing certificate, and then select the blue text that requests additional information, as shown in Figure 30. + ![figure 30](images/dg-fig31-getmoreinfo.png) + Figure 30. Get more information for your code signing certificate -5. In the **Certificate Properties** dialog box, for **Type**, select **Common name**. For **Value**, select **ContosoDGSigningCert**, and then click **Add**. When added, click **OK.** +5. +In the **Certificate Properties** dialog box, for **Type**, select **Common name**. For **Value**, select **ContosoDGSigningCert**, and then click **Add**. When added, click **OK.** 6. Enroll and finish. -**Note**   -If a certificate manager is required to approve any issued certificates and you selected to require management approval on the template, the request will need to be approved in the CA before it will be issued to the client. + +>**Note:**  If a certificate manager is required to approve any issued certificates and you selected to require management approval on the template, the request will need to be approved in the CA before it will be issued to the client. + This certificate must be installed in the user’s personal store on the computer that will be signing the catalog files and code integrity policies. If the signing is going to be taking place on the machine on which you just requested the certificate, exporting the certificate to a .pfx file will not be required because it already exists in your personal store. If you are signing on another computer, you will need to export the .pfx certificate with the necessary keys and properties. To do so, complete the following steps: + 1. Right-click the certificate, point to **All Tasks**, and then click **Export**. 2. Click **Next**, and then select **Yes, export the private key**. 3. Choose the default settings, and then select **Export all extended properties**. 4. Set a password, select an export path, and then select **DGCatSigningCert.pfx** as the file name. When the certificate has been exported, import it into the personal store for the user who will be signing the catalog files or code integrity policies on the specific computer that will be signing them. + ## Related topics -[AppLocker overview](applocker-overview.md) -[Code integrity](http://go.microsoft.com/fwlink/p/?LinkId=624173) -[Credential guard](credential-guard.md) -[Driver compatibility with Device Guard in Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=624843) -[Dropping the Hammer Down on Malware Threats with Windows 10’s Device Guard](http://go.microsoft.com/fwlink/p/?LinkId=624844) + +- [AppLocker overview](applocker-overview.md) +- [Code integrity](http://go.microsoft.com/fwlink/p/?LinkId=624173) +- [Credential guard](credential-guard.md) +- [Driver compatibility with Device Guard in Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=624843) +- [Dropping the Hammer Down on Malware Threats with Windows 10’s Device Guard](http://go.microsoft.com/fwlink/p/?LinkId=624844) From f627ce3ddf9333fa0b0d991888f2de5694b2065e Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 23 May 2016 10:10:04 -0700 Subject: [PATCH 373/439] fix typo --- windows/manage/introduction-to-windows-10-servicing.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/manage/introduction-to-windows-10-servicing.md b/windows/manage/introduction-to-windows-10-servicing.md index 300b8bf5aa..23290ae499 100644 --- a/windows/manage/introduction-to-windows-10-servicing.md +++ b/windows/manage/introduction-to-windows-10-servicing.md @@ -16,7 +16,7 @@ author: jdeckerMS - Windows 10 - Windows 10 IoT Core (IoT Core) -This article describes the new servicing options available in Windows 10 Wand IoT Core and how they enable enterprises to keep their devices current with the latest feature upgrades. It also covers related topics, such as how enterprises can make better use of Windows Update, and what the new servicing options mean for support lifecycles. +This article describes the new servicing options available in Windows 10 and IoT Core and how they enable enterprises to keep their devices current with the latest feature upgrades. It also covers related topics, such as how enterprises can make better use of Windows Update, and what the new servicing options mean for support lifecycles. **Note**   Several of the figures in this article show multiple feature upgrades of Windows being released by Microsoft over time. Be aware that these figures were created with dates that were chosen for illustrative clarity, not for release roadmap accuracy, and should not be used for planning purposes. From 5061fa22aee8ec623b340ec55411546e67e851c6 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Mon, 23 May 2016 11:03:44 -0700 Subject: [PATCH 374/439] fixing spacing issues --- ...ve-encryption-tools-to-manage-bitlocker.md | 107 +++++++++++++----- ...-use-bitlocker-recovery-password-viewer.md | 28 ++++- .../keep-secure/bypass-traverse-checking.md | 107 +++++++----------- windows/keep-secure/change-the-system-time.md | 97 ++++++++-------- windows/keep-secure/change-the-time-zone.md | 88 +++++++------- .../change-the-tpm-owner-password.md | 35 ++++-- ...oose-the-right-bitlocker-countermeasure.md | 26 ++++- ...gure-an-applocker-policy-for-audit-only.md | 15 ++- ...e-an-applocker-policy-for-enforce-rules.md | 15 ++- ...figure-exceptions-for-an-applocker-rule.md | 10 +- windows/keep-secure/configure-s-mime.md | 35 +++++- ...onfigure-the-appLocker-reference-device.md | 22 +++- ...figure-the-application-identity-service.md | 6 +- ...onfigure-windows-defender-in-windows-10.md | 57 ++++++++-- ...t-policy-settings-for-an-event-category.md | 17 ++- windows/keep-secure/create-a-pagefile.md | 85 +++++++------- .../create-a-rule-for-packaged-apps.md | 14 ++- ...-a-rule-that-uses-a-file-hash-condition.md | 19 +++- ...reate-a-rule-that-uses-a-path-condition.md | 19 ++-- ...-a-rule-that-uses-a-publisher-condition.md | 15 ++- windows/keep-secure/create-a-token-object.md | 88 +++++++------- .../create-applocker-default-rules.md | 14 ++- windows/keep-secure/create-global-objects.md | 103 +++++++---------- ...cations-deployed-to-each-business-group.md | 33 +++++- .../create-permanent-shared-objects.md | 85 +++++++------- windows/keep-secure/create-symbolic-links.md | 90 ++++++++------- ...create-your-applocker-planning-document.md | 26 ++++- .../create-your-applocker-policies.md | 33 +++++- .../create-your-applocker-rules.md | 31 ++++- 29 files changed, 809 insertions(+), 511 deletions(-) diff --git a/windows/keep-secure/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md b/windows/keep-secure/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md index ab1c7f7bb2..a20d25ff66 100644 --- a/windows/keep-secure/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md +++ b/windows/keep-secure/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md @@ -2,79 +2,113 @@ title: BitLocker Use BitLocker Drive Encryption Tools to manage BitLocker (Windows 10) description: This topic for the IT professional describes how to use tools to manage BitLocker. ms.assetid: e869db9c-e906-437b-8c70-741dd61b5ea6 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # BitLocker: Use BitLocker Drive Encryption Tools to manage BitLocker + **Applies to** - Windows 10 + This topic for the IT professional describes how to use tools to manage BitLocker. + BitLocker Drive Encryption Tools include the command line tools manage-bde and repair-bde and the BitLocker cmdlets for Windows PowerShell. + Both manage-bde and the BitLocker cmdlets can be used to perform any task that can be accomplished through the BitLocker control panel and are appropriate to use for automated deployments and other scripting scenarios. + Repair-bde is a special circumstance tool that is provided for disaster recovery scenarios in which a BitLocker protected drive cannot be unlocked normally or using the recovery console. + 1. [Manage-bde](#bkmk-managebde) 2. [Repair-bde](#bkmk-repairbde) 3. [BitLocker cmdlets for Windows PowerShell](#bkmk-blcmdlets) + ## Manage-bde + Manage-bde is a command-line tool that can be used for scripting BitLocker operations. Manage-bde offers additional options not displayed in the BitLocker control panel. For a complete list of the manage-bde options, see the [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx) command-line reference. + Manage-bde includes less default settings and requires greater customization for configuring BitLocker. For example, using just the `manage-bde -on` command on a data volume will fully encrypt the volume without any authenticating protectors. A volume encrypted in this manner still requires user interaction to turn on BitLocker protection, even though the command successfully completed because an authentication method needs to be added to the volume for it to be fully protected. The following sections provide examples of common usage scenarios for manage-bde. + ### Using manage-bde with operating system volumes + Listed below are examples of basic valid commands for operating system volumes. In general, using only the `manage-bde -on ` command will encrypt the operating system volume with a TPM-only protector and no recovery key. However, many environments require more secure protectors such as passwords or PIN and expect to be able to recover information with a recovery key. It is recommended that at least one primary protector and a recovery protector be added to an operating system volume. + A good practice when using manage-bde is to determine the volume status on the target system. Use the following command to determine volume status: + ``` syntax manage-bde -status ``` This command returns the volumes on the target, current encryption status and volume type (operating system or data) for each volume. + The following example illustrates enabling BitLocker on a computer without a TPM chip. Before beginning the encryption process you must create the startup key needed for BitLocker and save it to the USB drive. When BitLocker is enabled for the operating system volume, the BitLocker will need to access the USB flash drive to obtain the encryption key (in this example, the drive letter E represents the USB drive). You will be prompted to reboot to complete the encryption process. + ``` syntax manage-bde –protectors -add C: -startupkey E: manage-bde -on C: ``` -**Note**   -After the encryption is completed, the USB startup key must be inserted before the operating system can be started. + +>**Note:**  After the encryption is completed, the USB startup key must be inserted before the operating system can be started.   An alternative to the startup key protector on non-TPM hardware is to use a password and an **ADaccountorgroup** protector to protect the operating system volume. In this scenario, you would add the protectors first. This is done with the command: + ``` syntax manage-bde -protectors -add C: -pw -sid ``` + This command will require you to enter and then confirm the password protector before adding them to the volume. With the protectors enabled on the volume, you can then turn BitLocker on. + On computers with a TPM it is possible to encrypt the operating system volume without any defined protectors using manage-bde. The command to do this is: + ``` syntax manage-bde -on C: ``` + This will encrypt the drive using the TPM as the default protector. If you are not sure if a TPM protector is available, to list the protectors available for a volume, run the following command: + ``` syntax manage-bde -protectors -get ``` ### Using manage-bde with data volumes + Data volumes use the same syntax for encryption as operating system volumes but they do not require protectors for the operation to complete. Encrypting data volumes can be done using the base command: `manage-bde -on ` or you can choose to add additional protectors to the volume first. It is recommended that at least one primary protector and a recovery protector be added to a data volume. + A common protector for a data volume is the password protector. In the example below, we add a password protector to the volume and turn BitLocker on. + ``` syntax manage-bde -protectors -add -pw C: manage-bde -on C: ``` + ## Repair-bde + You may experience a problem that damages an area of a hard disk on which BitLocker stores critical information. This kind of problem may be caused by a hard disk failure or if Windows exits unexpectedly. + The BitLocker Repair Tool (Repair-bde) can be used to access encrypted data on a severely damaged hard disk if the drive was encrypted by using BitLocker. Repair-bde can reconstruct critical parts of the drive and salvage recoverable data as long as a valid recovery password or recovery key is used to decrypt the data. If the BitLocker metadata data on the drive has become corrupt, you must be able to supply a backup key package in addition to the recovery password or recovery key. This key package is backed up in Active Directory Domain Services (AD DS) if you used the default setting for AD DS backup. With this key package and either the recovery password or recovery key, you can decrypt portions of a BitLocker-protected drive if the disk is corrupted. Each key package will work only for a drive that has the corresponding drive identifier. You can use the BitLocker Recovery Password Viewer to obtain this key package from AD DS. -**Tip**   -If you are not backing up recovery information to AD DS or if you want to save key packages alternatively, you can use the command `manage-bde -KeyPackage` to generate a key package for a volume. + +>**Tip:**  If you are not backing up recovery information to AD DS or if you want to save key packages alternatively, you can use the command `manage-bde -KeyPackage` to generate a key package for a volume.   The Repair-bde command-line tool is intended for use when the operating system does not start or when you cannot start the BitLocker Recovery Console. You should use Repair-bde if the following conditions are true: + 1. You have encrypted the drive by using BitLocker Drive Encryption. 2. Windows does not start, or you cannot start the BitLocker recovery console. 3. You do not have a copy of the data that is contained on the encrypted drive. -**Note**   -Damage to the drive may not be related to BitLocker. Therefore, we recommend that you try other tools to help diagnose and resolve the problem with the drive before you use the BitLocker Repair Tool. The Windows Recovery Environment (Windows RE) provides additional options to repair computers. + +>**Note:**  Damage to the drive may not be related to BitLocker. Therefore, we recommend that you try other tools to help diagnose and resolve the problem with the drive before you use the BitLocker Repair Tool. The Windows Recovery Environment (Windows RE) provides additional options to repair computers.   The following limitations exist for Repair-bde: + - The Repair-bde command-line tool cannot repair a drive that failed during the encryption or decryption process. - The Repair-bde command-line tool assumes that if the drive has any encryption, then the drive has been fully encrypted. -For more information about using repair-bde see [Repair-bde](http://technet.microsoft.com/library/ff829851.aspx) + +For more information about using repair-bde, see [Repair-bde](http://technet.microsoft.com/library/ff829851.aspx). + ## BitLocker cmdlets for Windows PowerShell + Windows PowerShell cmdlets provide a new way for administrators to use when working with BitLocker. Using Windows PowerShell's scripting capabilities, administrators can integrate BitLocker options into existing scripts with ease. The list below displays the available BitLocker cmdlets. + @@ -205,72 +239,89 @@ Windows PowerShell cmdlets provide a new way for administrators to use when work Similar to manage-bde, the Windows PowerShell cmdlets allow configuration beyond the options offered in the control panel. As with manage-bde, users need to consider the specific needs of the volume they are encrypting prior to running Windows PowerShell cmdlets. A good initial step is to determine the current state of the volume(s) on the computer. You can do this using the `Get-BitLockerVolume` cmdlet. The `Get-BitLockerVolume` cmdlet output gives information on the volume type, protectors, protection status and other details. -**Tip**   -Occasionally, all protectors may not be shown when using `Get-BitLockerVolume` due to lack of space in the output display. If you do not see all of the protectors for a volume, you can use the Windows PowerShell pipe command (|) to format a full listing of the protectors. + +>**Tip:**  Occasionally, all protectors may not be shown when using `Get-BitLockerVolume` due to lack of space in the output display. If you do not see all of the protectors for a volume, you can use the Windows PowerShell pipe command (|) to format a full listing of the protectors. `Get-BitLockerVolume C: | fl`   If you want to remove the existing protectors prior to provisioning BitLocker on the volume, you could use the `Remove-BitLockerKeyProtector` cmdlet. Accomplishing this requires the GUID associated with the protector to be removed. + A simple script can pipe the values of each Get-BitLockerVolume return out to another variable as seen below: + ``` syntax $vol = Get-BitLockerVolume $keyprotectors = $vol.KeyProtector ``` + Using this, you can display the information in the $keyprotectors variable to determine the GUID for each protector. + Using this information, you can then remove the key protector for a specific volume using the command: + ``` syntax Remove-BitLockerKeyProtector : -KeyProtectorID "{GUID}" ``` -**Note**   -The BitLocker cmdlet requires the key protector GUID enclosed in quotation marks to execute. Ensure the entire GUID, with braces, is included in the command. + +>**Note:**  The BitLocker cmdlet requires the key protector GUID enclosed in quotation marks to execute. Ensure the entire GUID, with braces, is included in the command.   ### Using the BitLocker Windows PowerShell cmdlets with operating system volumes + Using the BitLocker Windows PowerShell cmdlets is similar to working with the manage-bde tool for encrypting operating system volumes. Windows PowerShell offers users a lot of flexibility. For example, users can add the desired protector as part command for encrypting the volume. Below are examples of common user scenarios and steps to accomplish them in BitLocker Windows PowerShell. + The following example shows how to enable BitLocker on an operating system drive using only the TPM protector: + ``` syntax Enable-BitLocker C: + ``` In the example below, adds one additional protector, the StartupKey protector and chooses to skip the BitLocker hardware test. In this example, encryption starts immediately without the need for a reboot. + ``` syntax Enable-BitLocker C: -StartupKeyProtector -StartupKeyPath -SkipHardwareTest ``` + ### Using the BitLocker Windows PowerShell cmdlets with data volumes -Data volume encryption using Windows PowerShell is the same as for operating system volumes. You should add the desired protectors prior to encrypting the volume. The following example adds a password protector to the E: volume using the variable $pw as the password. The $pw variable is held as a SecureString value to store the user defined password. + +Data volume encryption using Windows PowerShell is the same as for operating system volumes. You should add the desired protectors prior to encrypting the volume. The following example adds a password protector to the E: volume using the variable $pw as the password. The $pw variable is held as a +SecureString value to store the user defined password. + ``` syntax $pw = Read-Host -AsSecureString Enable-BitLockerKeyProtector E: -PasswordProtector -Password $pw ``` ### Using an AD Account or Group protector in Windows PowerShell + The **ADAccountOrGroup** protector, introduced in Windows 8 and Windows Server 2012, is an Active Directory SID-based protector. This protector can be added to both operating system and data volumes, although it does not unlock operating system volumes in the pre-boot environment. The protector requires the SID for the domain account or group to link with the protector. BitLocker can protect a cluster-aware disk by adding a SID-based protector for the Cluster Name Object (CNO) that lets the disk properly failover to and be unlocked by any member computer of the cluster. -**Warning**   -The **ADAccountOrGroup** protector requires the use of an additional protector for use (such as TPM, PIN, or recovery key) when used on operating system volumes + +>**Warning:**  The **ADAccountOrGroup** protector requires the use of an additional protector for use (such as TPM, PIN, or recovery key) when used on operating system volumes   To add an **ADAccountOrGroup** protector to a volume requires either the actual domain SID or the group name preceded by the domain and a backslash. In the example below, the CONTOSO\\Administrator account is added as a protector to the data volume G. + ``` syntax Enable-BitLocker G: -AdAccountOrGroupProtector -AdAccountOrGroup CONTOSO\Administrator ``` + For users who wish to use the SID for the account or group, the first step is to determine the SID associated with the account. To get the specific SID for a user account in Windows PowerShell, use the following command: -**Note**   -Use of this command requires the RSAT-AD-PowerShell feature. + +>**Note:**  Use of this command requires the RSAT-AD-PowerShell feature.   ``` syntax get-aduser -filter {samaccountname -eq "administrator"} ``` -**Tip**   -In addition to the PowerShell command above, information about the locally logged on user and group membership can be found using: WHOAMI /ALL. This does not require the use of additional features. + +>**Tip:**  In addition to the PowerShell command above, information about the locally logged on user and group membership can be found using: WHOAMI /ALL. This does not require the use of additional features.   The following example adds an **ADAccountOrGroup** protector to the previously encrypted operating system volume using the SID of the account: + ``` syntax Add-BitLockerKeyProtector C: -ADAccountOrGroupProtector -ADAccountOrGroup S-1-5-21-3651336348-8937238915-291003330-500 ``` -**Note**   -Active Directory-based protectors are normally used to unlock Failover Cluster enabled volumes. + +>**Note:**  Active Directory-based protectors are normally used to unlock Failover Cluster enabled volumes.   ## More information -[BitLocker overview](bitlocker-overview.md) -[BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md) -[Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md) -[BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md) -[BitLocker: How to deploy on Windows Server 2012](bitlocker-how-to-deploy-on-windows-server.md) -  -  + +- [BitLocker overview](bitlocker-overview.md) +- [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md) +- [Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md) +- [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md) +- [BitLocker: How to deploy on Windows Server 2012](bitlocker-how-to-deploy-on-windows-server.md) diff --git a/windows/keep-secure/bitlocker-use-bitlocker-recovery-password-viewer.md b/windows/keep-secure/bitlocker-use-bitlocker-recovery-password-viewer.md index de1b0e8a2c..61521699b2 100644 --- a/windows/keep-secure/bitlocker-use-bitlocker-recovery-password-viewer.md +++ b/windows/keep-secure/bitlocker-use-bitlocker-recovery-password-viewer.md @@ -2,40 +2,56 @@ title: BitLocker Use BitLocker Recovery Password Viewer (Windows 10) description: This topic for the IT professional describes how to use the BitLocker Recovery Password Viewer. ms.assetid: 04c93ac5-5dac-415e-b636-de81435753a2 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # BitLocker: Use BitLocker Recovery Password Viewer + **Applies to** - Windows 10 + This topic for the IT professional describes how to use the BitLocker Recovery Password Viewer. + The BitLocker Recovery Password Viewer tool is an optional tool included with the Remote Server Administration Tools (RSAT). It lets you locate and view BitLocker recovery passwords that are stored in Active Directory Domain Services (AD DS). You can use this tool to help recover data that is stored on a drive that has been encrypted by using BitLocker. The BitLocker Active Directory Recovery Password Viewer tool is an extension for the Active Directory Users and Computers Microsoft Management Console (MMC) snap-in. Using this tool, you can examine a computer object's **Properties** dialog box to view the corresponding BitLocker recovery passwords. Additionally, you can right-click a domain container and then search for a BitLocker recovery password across all the domains in the Active Directory forest. You can also search for a password by password identifier (ID). + ## Before you start + To complete the procedures in this scenario: + - You must have domain administrator credentials. - Your test computers must be joined to the domain. - On the test computers, BitLocker must have been turned on after joining the domain. + The following procedures describe the most common tasks performed by using the BitLocker Recovery Password Viewer. + **To view the recovery passwords for a computer** + 1. In **Active Directory Users and Computers**, locate and then click the container in which the computer is located. 2. Right-click the computer object, and then click **Properties**. 3. In the **Properties** dialog box, click the **BitLocker Recovery** tab to view the BitLocker recovery passwords that are associated with the computer. + **To copy the recovery passwords for a computer** + 1. Follow the steps in the previous procedure to view the BitLocker recovery passwords. 2. On the **BitLocker Recovery** tab of the **Properties** dialog box, right-click the BitLocker recovery password that you want to copy, and then click **Copy Details**. 3. Press CTRL+V to paste the copied text to a destination location, such as a text file or spreadsheet. + **To locate a recovery password by using a password ID** + 1. In Active Directory Users and Computers, right-click the domain container, and then click **Find BitLocker Recovery Password**. 2. In the **Find BitLocker Recovery Password** dialog box, type the first eight characters of the recovery password in the **Password ID (first 8 characters)** box, and then click **Search**. By completing the procedures in this scenario, you have viewed and copied the recovery passwords for a computer and used a password ID to locate a recovery password. + ## More information -[BitLocker Overview](bitlocker-overview.md) -[BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md) -[Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md) -[BitLocker: How to deploy on Windows Server 2012](bitlocker-how-to-deploy-on-windows-server.md) -[BitLocker: Use BitLocker Drive Encryption Tools to manage BitLocker](bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md) + +- [BitLocker Overview](bitlocker-overview.md) +- [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md) +- [Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md) +- [BitLocker: How to deploy on Windows Server 2012](bitlocker-how-to-deploy-on-windows-server.md) +- [BitLocker: Use BitLocker Drive Encryption Tools to manage BitLocker](bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md)     diff --git a/windows/keep-secure/bypass-traverse-checking.md b/windows/keep-secure/bypass-traverse-checking.md index 17fb337e5a..d07fea0ff5 100644 --- a/windows/keep-secure/bypass-traverse-checking.md +++ b/windows/keep-secure/bypass-traverse-checking.md @@ -2,113 +2,90 @@ title: Bypass traverse checking (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Bypass traverse checking security policy setting. ms.assetid: 1c828655-68d3-4140-aa0f-caa903a7087e -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Bypass traverse checking + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Bypass traverse checking** security policy setting. + ## Reference + This policy setting determines which users (or a process that acts on behalf of the user’s account) have permission to navigate an object path in the NTFS file system or in the registry without being checked for the Traverse Folder special access permission. This user right does not allow the user to list the contents of a folder. It only allows the user to traverse folders to access permitted files or subfolders. + Constant: SeChangeNotifyPrivilege + ### Possible values + - User-defined list of accounts - Not Defined + ### Best practices + 1. Use access–based enumeration when you want to prevent users from seeing any folder or file to which they do not have access. 2. Use the default settings of this policy in most cases. If you change the settings, verify your intent through testing. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. -
      ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not Defined

      Default Domain Controller Policy

      Administrators

      -

      Authenticated Users

      -

      Everyone

      -

      Local Service

      -

      Network Service

      -

      Pre-Windows 2000 Compatible Access

      Stand-Alone Server Default Settings

      Administrators

      -

      Backup Operators

      -

      Users

      -

      Everyone

      -

      Local Service

      -

      Network Service

      Domain Controller Effective Default Settings

      Administrators

      -

      Authenticated Users

      -

      Everyone

      -

      Local Service

      -

      Network Service

      -

      Pre-Windows 2000 Compatible Access

      Member Server Effective Default Settings

      Administrators

      -

      Backup Operators

      -

      Users

      -

      Everyone

      -

      Local Service

      -

      Network Service

      Client Computer Effective Default Settings

      Administrators

      -

      Backup Operators

      -

      Users

      -

      Everyone

      -

      Local Service

      -

      Network Service

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not Defined | +| Default Domain Controller Policy | Administrators
      Authenticated Users
      Everyone
      Local Service
      Network Service
      Pre-Windows 2000 Compatible Access| +| Stand-Alone Server Default Settings | Administrators
      Backup Operators
      Users
      Everyone
      Local Service
      Network Service| +| Domain Controller Effective Default Settings | Administrators
      Authenticated Users
      Everyone
      Local Service
      Network Service
      Pre-Windows 2000 Compatible Access| +| Member Server Effective Default Settings | Administrators
      Backup Operators
      Users
      Everyone
      Local Service
      Network Service| +| Client Computer Effective Default Settings | Administrators
      Backup Operators
      Users
      Everyone
      Local Service
      Network Service|   ## Policy management + Permissions to files and folders are controlled though the appropriate configuration of file system access control lists (ACLs).The ability to traverse the folder does not provide any Read or Write permissions to the user. + A restart of the computer is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + The default configuration for the **Bypass traverse checking** setting is to allow all users to bypass traverse checking. Permissions to files and folders are controlled though the appropriate configuration of file system access control lists (ACLs) because the ability to traverse the folder does not provide any Read or Write permissions to the user. The only scenario in which the default configuration could lead to a mishap would be if the administrator who configures permissions does not understand how this policy setting works. For example, the administrator might expect that users who are unable to access a folder are unable to access the contents of any child folders. Such a situation is unlikely, and, therefore, this vulnerability presents little risk. + ### Countermeasure + Organizations that are extremely concerned about security may want to remove the Everyone group, and perhaps the Users group, from the list of groups that have the **Bypass traverse checking** user right. Taking explicit control over traversal assignments can be an effective way to limit access to sensitive information. Access–based enumeration can also be used. If you use access–based enumeration, users cannot see any folder or file to which they do not have access. For more info about this feature, see [Access-based Enumeration](http://go.microsoft.com/fwlink/p/?LinkId=100745). + ### Potential impact + The Windows operating systems and many applications were designed with the expectation that anyone who can legitimately access the computer will have this user right. Therefore, we recommend that you thoroughly test any changes to assignments of the **Bypass traverse checking** user right before you make such changes to production systems. In particular, IIS requires this user right to be assigned to the Network Service, Local Service, IIS\_WPG, IUSR\_*<ComputerName>*, and IWAM\_*<ComputerName>* accounts. (It must also be assigned to the ASPNET account through its membership in the Users group.) We recommend that you leave this policy setting at its default configuration. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) + +- [User Rights Assignment](user-rights-assignment.md)     diff --git a/windows/keep-secure/change-the-system-time.md b/windows/keep-secure/change-the-system-time.md index f34f347c76..4ac7356093 100644 --- a/windows/keep-secure/change-the-system-time.md +++ b/windows/keep-secure/change-the-system-time.md @@ -2,106 +2,105 @@ title: Change the system time (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Change the system time security policy setting. ms.assetid: f2f6637d-acbc-4352-8ca3-ec563f918e65 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Change the system time + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Change the system time** security policy setting. + ## Reference + This policy setting determines which users can adjust the time on the device's internal clock. This right allows the computer user to change the date and time associated with records in the event logs, database transactions, and the file system. This right is also required by the process that performs time synchronization. This setting does not impact the user’s ability to change the time zone or other display characteristics of the system time. For info about assigning the right to change the time zone, see [Change the time zone](change-the-time-zone.md). + Constant: SeSystemtimePrivilege + ### Possible values + - User-defined list of accounts - Not Defined + ### Best practices + - Restrict the **Change the system time** user right to users with a legitimate need to change the system time. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default, members of the Administrators and Local Service groups have this right on workstations and servers. Members of the Administrators, Server Operators, and Local Service groups have this right on domain controllers. + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not Defined

      Default Domain Controller Policy

      Administrators

      -

      Server Operators

      -

      Local Service

      Stand-Alone Server Default Settings

      Administrators

      -

      Local Service

      DC Effective Default Settings

      Administrators

      -

      Server Operators

      -

      Local Service

      Member Server Effective Default Settings

      Administrators

      -

      Local Service

      Client Computer Effective Default Settings

      Administrators

      -

      Local Service

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not Defined | +| Default Domain Controller Policy | Administrators
      Server Operators
      Local Service| +| Stand-Alone Server Default Settings | Administrators
      Local Service| +| DC Effective Default Settings | Administrators
      Server Operators
      Local Service| +| Member Server Effective Default Settings | Administrators
      Local Service| +| Client Computer Effective Default Settings | Administrators
      Local Service|   ## Policy management + This section describes features, tools and guidance to help you manage this policy. + A restart of the device is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Users who can change the time on a computer could cause several problems. For example: + - Time stamps on event log entries could be made inaccurate - Time stamps on files and folders that are created or modified could be incorrect - Computers that belong to a domain might not be able to authenticate themselves - Users who try to log on to the domain from devices with inaccurate time might not be able to authenticate. + Also, because the Kerberos authentication protocol requires that the requester and authenticator have their clocks synchronized within an administrator-defined skew period, an attacker who changes a device's time may cause that computer to be unable to obtain or grant Kerberos protocol tickets. + The risk from these types of events is mitigated on most domain controllers, member servers, and end-user computers because the Windows Time Service automatically synchronizes time with domain controllers in the following ways: + - All desktop client devices and member servers use the authenticating domain controller as their inbound time partner. - All domain controllers in a domain nominate the primary domain controller (PDC) emulator operations master as their inbound time partner. - All PDC emulator operations masters follow the hierarchy of domains in the selection of their inbound time partner. - The PDC emulator operations master at the root of the domain is authoritative for the organization. Therefore, we recommend that you configure this computer to synchronize with a reliable external time server. + This vulnerability becomes much more serious if an attacker is able to change the system time and then stop the Windows Time Service or reconfigure it to synchronize with a time server that is not accurate. + ### Countermeasure + Restrict the **Change the system time** user right to users with a legitimate need to change the system time, such as members of the IT team. + ### Potential impact + There should be no impact because time synchronization for most organizations should be fully automated for all computers that belong to the domain. Computers that do not belong to the domain should be configured to synchronize with an external source, such as a web service. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/change-the-time-zone.md b/windows/keep-secure/change-the-time-zone.md index fafb6d6293..1b27d5afe9 100644 --- a/windows/keep-secure/change-the-time-zone.md +++ b/windows/keep-secure/change-the-time-zone.md @@ -2,91 +2,85 @@ title: Change the time zone (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Change the time zone security policy setting. ms.assetid: 3b1afae4-68bb-472f-a43e-49e300d73e50 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Change the time zone + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Change the time zone** security policy setting. + ## Reference + This policy setting determines which users can adjust the time zone that is used by the device for displaying the local time, which includes the device's system time plus the time zone offset. + Constant: SeTimeZonePrivilege + ### Possible values + - User-defined list of accounts - Not Defined + ### Best practices + None. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not Defined

      Default Domain Controller Policy

      Administrators

      -

      Users

      Stand-Alone Server Default Settings

      Administrators

      -

      Users

      Domain Controller Effective Default Settings

      Administrators

      -

      Users

      Member Server Effective Default Settings

      Administrators

      -

      Users

      Client Computer Effective Default Settings

      Administrators

      -

      Users

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not Defined| +| Default Domain Controller Policy | Administrators
      Users| +| Stand-Alone Server Default Settings | Administrators
      Users| +| Domain Controller Effective Default Settings | Administrators
      Users| +| Member Server Effective Default Settings | Administrators
      Users| +| Client Computer Effective Default Settings | Administrators
      Users|   ## Policy management + A restart of the device is not required for this policy setting to be effective. + Any change to the account for this user right assignment becomes effective the next time the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Changing the time zone represents little vulnerability because the system time is not affected. This setting merely enables users to display their preferred time zone while being synchronized with domain controllers in different time zones. + ### Countermeasure + Countermeasures are not required because system time is not affected by this setting. + ### Potential impact + None. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/change-the-tpm-owner-password.md b/windows/keep-secure/change-the-tpm-owner-password.md index e76c48aac1..7241d40deb 100644 --- a/windows/keep-secure/change-the-tpm-owner-password.md +++ b/windows/keep-secure/change-the-tpm-owner-password.md @@ -2,49 +2,66 @@ title: Change the TPM owner password (Windows 10) description: This topic for the IT professional describes how to change the password or PIN for the owner of the Trusted Platform Module (TPM) that is installed on your system. ms.assetid: e43dcff3-acb4-4a92-8816-d6b64b7f2f45 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Change the TPM owner password + **Applies to** - Windows 10 + This topic for the IT professional describes how to change the password or PIN for the owner of the Trusted Platform Module (TPM) that is installed on your system. -## About the TPM owner password + +## About the TPM owner password The owner of the TPM is the user who possesses the owner password and is able to set it and change it. Only one owner password exists per TPM. The owner of the TPM can make full use of TPM capabilities. When an owner is set, no other user or software can claim ownership of the TPM. Only the TPM owner can enable, disable, or clear the TPM without having physical access to the computer, for example, by using the command-line tools remotely. Taking ownership of the TPM can be performed as part of the initialization process. Ownership can change when you share the password or clear your ownership of the TPM so someone else can initialize it. + Applications, including BitLocker Drive Encryption, can automatically start the initialization process. If you enable BitLocker without manually initializing the TPM, the TPM owner password is automatically created and saved in the same location as the BitLocker recovery password. The TPM owner password can be saved as a file on a removable storage device, or on another computer. The password can also be printed. The TPM MMC gives the TPM owner the sole ability to choose the appropriate option to type the password or to use the saved password. As with any password, you should change your TPM owner password if you suspect that it has become compromised and is no longer a secret. + **Other TPM management options** + Instead of changing your owner password, you can also use the following options to manage your TPM: + - **Clear the TPM**   If you want to invalidate all of the existing keys that have been created since you took ownership of the TPM, you can clear it. For more info, see [Initialize and Configure Ownership of the TPM](initialize-and-configure-ownership-of-the-tpm.md#bkmk-clear1). - **Important**   - Clearing the TPM can result in the loss of data. To avoid data loss, make sure you have a backup or recovery method for any data protected or encrypted by the TPM. + + >**Important:**  Clearing the TPM can result in the loss of data. To avoid data loss, make sure you have a backup or recovery method for any data protected or encrypted by the TPM.   - **Turn off the TPM**   If you want to keep all existing keys and data intact, and you want to disable the services that are provided by the TPM, you can turn it off. For more info, see [Initialize and Configure Ownership of the TPM](initialize-and-configure-ownership-of-the-tpm.md#bkmk-onoff). + ## Change the TPM owner password + The following procedure provides the steps that are necessary to change the TPM owner password. + **To change the TPM owner password** + 1. Open the TPM MMC (tpm.msc). If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. 2. In the **Actions** pane, click **Change Owner Password**. 3. In the **Manage the TPM security hardware** dialog box, select a method to enter your current TPM owner password. + - If you saved your TPM owner password on a removable storage device, insert it, and then click **I have the owner password file**. In the **Select backup file with the TPM owner password** dialog box, use **Browse** to navigate to the .tpm file that is saved on your removable storage device. Click **Open**, and then click **Create New Password**. - If you do not have the removable storage device with your saved password, click **I want to enter the owner password**. In the **Type your TPM owner password** dialog box, enter your password (including hyphens), and click **Create New Password**. 4. On the **Create the TPM owner password** page, select a method for creating a new TPM owner password. + 1. Click **Automatically create the password** to have a new owner password generated for you. 2. Click **Manually create the password** if you want to specify a password. - **Note**   - The TPM owner password must have a minimum of eight characters. + >**Note:**  The TPM owner password must have a minimum of eight characters.   5. After the new password is created, you can choose **Save the password** to save the password in a password backup file on a removable storage device or **Print the password** to print a copy of the password for later reference. + 6. Click **Change password** to apply the new owner password to the TPM. -## Use the TPM cmdlets + +## Use the TPM cmdlets + If you are using Windows PowerShell to manage your computers, you can also manage the TPM by using Windows PowerShell. To install the TPM cmdlets, type the following command: **dism /online /enable-feature /FeatureName:tpm-psh-cmdlets** + For details about the individual cmdlets, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx). + ## Additional resources + For more info about TPM, see [Trusted Platform Module technology overview](trusted-platform-module-overview.md#bkmk-additionalresources). -  -  diff --git a/windows/keep-secure/choose-the-right-bitlocker-countermeasure.md b/windows/keep-secure/choose-the-right-bitlocker-countermeasure.md index 374b255db6..3e84e8f209 100644 --- a/windows/keep-secure/choose-the-right-bitlocker-countermeasure.md +++ b/windows/keep-secure/choose-the-right-bitlocker-countermeasure.md @@ -2,28 +2,46 @@ title: Choose the right BitLocker countermeasure (Windows 10) description: This section outlines the best countermeasures you can use to protect your organization from bootkits and rootkits, brute force sign-in, Direct Memory Access (DMA) attacks, Hyberfil.sys attacks, and memory remanence attacks. ms.assetid: b0b09508-7885-4030-8c61-d91458afdb14 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Choose the right BitLocker countermeasure + **Applies to** - Windows 10 + This section outlines the best countermeasures you can use to protect your organization from bootkits and rootkits, brute force sign-in, Direct Memory Access (DMA) attacks, Hyberfil.sys attacks, and memory remanence attacks. You can use BitLocker to protect your Windows 10 PCs. Whichever operating system you’re using, Microsoft and Windows-certified devices provide countermeasures to address attacks and improve your data security. In most cases, this protection can be implemented without the need for pre-boot authentication. -Figures 2, 3, and 4 summarize the recommended mitigations for different types of attacks against PCs running recent versions of Windows. The orange blocks indicate that the system requires additional configuration from the default settings. + +Figures 2, 3, and 4 summarize the recommended mitigations for different types of attacks against PCs running recent versions of Windows. The orange blocks indicate that the system requires additional configuration from the default +settings. + ![how to choose best countermeasures for windows 7](images/bitlockerprebootprotection-counterwin7.jpg) + **Figure 2.** How to choose the best countermeasures for Windows 7 + ![how to choose countermeasures for windows 8](images/bitlockerprebootprotection-counterwin8.jpg) + **Figure 3.** How to choose the best countermeasures for Windows 8 + ![how to choose countermeasures for windows 8.1](images/bitlockerprebootprotection-counterwin81.jpg) + **Figure 4.** How to choose the best countermeasures for Windows 8.1 -The latest InstantGo devices, primarily tablets, are designed to be secure by default against all attacks that might compromise the BitLocker encryption key. Other Windows devices can be, too. DMA port–based attacks, which represent the attack vector of choice, are not possible on InstantGo devices, because these port types are prohibited. The inclusion of DMA ports on even non-InstantGo devices is extremely rare on recent devices, particularly on mobile ones. This could change if Thunderbolt is broadly adopted, so IT should consider this when purchasing new devices. In any case DMA ports can be disabled entirely, which is an increasingly popular option because the use of DMA ports is infrequent in the non-developer space. + +The latest InstantGo devices, primarily tablets, are designed to be secure by default against all attacks that might compromise the BitLocker encryption key. Other Windows devices can be, too. DMA port–based attacks, which represent the attack vector of choice, are not possible on InstantGo devices, because these port types are prohibited. The inclusion of DMA ports on even non-InstantGo devices is extremely rare on recent devices, particularly on mobile ones. This could change if Thunderbolt is broadly adopted, so IT should consider this when purchasing new devices. In any case DMA ports can be disabled entirely, which is an increasingly popular option because the use of +DMA ports is infrequent in the non-developer space. + Memory remanence attacks can be mitigated with proper configuration; in cases where the system memory is fixed and non-removable, they are not possible using published techniques. Even in cases where system memory can be removed and loaded into another device, attackers will find the attack vector extremely unreliable, as has been shown in the DRDC Valcartier group’s analysis (see [An In-depth Analysis of the Cold Boot Attack](http://www.dtic.mil/cgi-bin/GetTRDoc?AD=ADA545078)). + Windows 7 PCs share the same security risks as newer devices but are far more vulnerable to DMA and memory remanence attacks, because Windows 7 devices are more likely to include DMA ports, lack support for UEFI-based Secure Boot, and rarely have fixed memory. To eliminate the need for pre-boot authentication on Windows 7 devices, disable the ability to boot to external media, password-protect the BIOS configuration, and disable the DMA ports. If you believe that your devices may be a target of a memory remanence attack, where the system memory may be removed and put into another computer to gain access to its contents, consider testing your devices to determine whether they are susceptible to this type of attack. -In the end, many customers will find that pre-boot authentication improves security only for a shrinking subset of devices within their organization. Microsoft recommends a careful examination of the attack vectors and mitigations outlined in this document along with an evaluation of your devices before choosing to implement pre-boot authentication, which may not enhance the security of your devices and instead will only compromise the user experience and add to support costs. + +In the end, many customers will find that pre-boot authentication improves security only for a shrinking subset of devices within their organization. Microsoft recommends a careful examination of the attack vectors and mitigations +outlined in this document along with an evaluation of your devices before choosing to implement pre-boot authentication, which may not enhance the security of your devices and instead will only compromise the user experience and add to support costs. + ## See also - [Types of attacks for volume encryption keys](types-of-attacks-for-volume-encryption-keys.md) - [BitLocker Countermeasures](bitlocker-countermeasures.md) diff --git a/windows/keep-secure/configure-an-applocker-policy-for-audit-only.md b/windows/keep-secure/configure-an-applocker-policy-for-audit-only.md index 5de6e0fbde..58ba26536b 100644 --- a/windows/keep-secure/configure-an-applocker-policy-for-audit-only.md +++ b/windows/keep-secure/configure-an-applocker-policy-for-audit-only.md @@ -2,26 +2,31 @@ title: Configure an AppLocker policy for audit only (Windows 10) description: This topic for IT professionals describes how to set AppLocker policies to Audit only within your IT environment by using AppLocker. ms.assetid: 10bc87d5-cc7f-4500-b7b3-9006e50afa50 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Configure an AppLocker policy for audit only + **Applies to** - Windows 10 + This topic for IT professionals describes how to set AppLocker policies to **Audit only** within your IT environment by using AppLocker. + After AppLocker rules are created within the rule collection, you can configure the enforcement setting to **Enforce rules** or **Audit only**. + When AppLocker policy enforcement is set to **Enforce rules**, rules are enforced for the rule collection and all events are audited. When AppLocker policy enforcement is set to **Audit only**, rules are only evaluated but all events generated from that evaluation are written to the AppLocker log. -**Note**   -There is no audit mode for the DLL rule collection. DLL rules affect specific apps. Therefore, test the impact of these rules first before deploying them to production. To enable the DLL rule collection, see [Enable the DLL rule collection](enable-the-dll-rule-collection.md). + +>**Note:**  There is no audit mode for the DLL rule collection. DLL rules affect specific apps. Therefore, test the impact of these rules first before deploying them to production. To enable the DLL rule collection, see [Enable the DLL rule collection](enable-the-dll-rule-collection.md).   You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). + **To audit rule collections** + 1. From the AppLocker console, right-click **AppLocker**, and then click **Properties**. 2. On the **Enforcement** tab, select the **Configured** check box for the rule collection that you want to enforce, and then verify that **Audit only** is selected in the list for that rule collection. 3. Repeat the above step to configure the enforcement setting to **Audit only** for additional rule collections. 4. Click **OK**. -  -  diff --git a/windows/keep-secure/configure-an-applocker-policy-for-enforce-rules.md b/windows/keep-secure/configure-an-applocker-policy-for-enforce-rules.md index cd7c80e04b..3d6aa8a2c7 100644 --- a/windows/keep-secure/configure-an-applocker-policy-for-enforce-rules.md +++ b/windows/keep-secure/configure-an-applocker-policy-for-enforce-rules.md @@ -2,25 +2,30 @@ title: Configure an AppLocker policy for enforce rules (Windows 10) description: This topic for IT professionals describes the steps to enable the AppLocker policy enforcement setting. ms.assetid: 5dbbb290-a5ae-4f88-82b3-21e95972e66c -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Configure an AppLocker policy for enforce rules + **Applies to** - Windows 10 + This topic for IT professionals describes the steps to enable the AppLocker policy enforcement setting. -**Note**   -When AppLocker policy enforcement is set to **Enforce rules**, rules are enforced for the rule collection and all events are audited. + +>**Note:**  When AppLocker policy enforcement is set to **Enforce rules**, rules are enforced for the rule collection and all events are audited.   For info about how AppLocker policies are applied within a GPO structure, see [Understand AppLocker rules and enforcement setting inheritance in Group Policy](understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md). + You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). + **To enable the Enforce rules enforcement setting** + 1. From the AppLocker console, right-click **AppLocker**, and then click **Properties**. 2. On the **Enforcement** tab of the **AppLocker Properties** dialog box, select the **Configured** check box for the rule collection that you are editing, and then verify that **Enforce rules** is selected. 3. Click **OK**. + For info about viewing the events generated from rules enforcement, see [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md). -  -  diff --git a/windows/keep-secure/configure-exceptions-for-an-applocker-rule.md b/windows/keep-secure/configure-exceptions-for-an-applocker-rule.md index 34f5707623..0d4e3eefd6 100644 --- a/windows/keep-secure/configure-exceptions-for-an-applocker-rule.md +++ b/windows/keep-secure/configure-exceptions-for-an-applocker-rule.md @@ -2,23 +2,31 @@ title: Add exceptions for an AppLocker rule (Windows 10) description: This topic for IT professionals describes the steps to specify which apps can or cannot run as exceptions to an AppLocker rule. ms.assetid: d15c9d84-c14b-488d-9f48-bf31ff7ff0c5 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Add exceptions for an AppLocker rule + **Applies to** - Windows 10 + This topic for IT professionals describes the steps to specify which apps can or cannot run as exceptions to an AppLocker rule. + Rule exceptions allow you to specify files or folders to exclude from the rule. For more information about exceptions, see [Understanding AppLocker rule exceptions](understanding-applocker-rule-exceptions.md). + You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). + **To configure exceptions for a rule** + 1. Open the AppLocker console. 2. Expand the rule collection, right-click the rule that you want to configure exceptions for, and then click **Properties**. 3. Click the **Exceptions** tab. 4. In the **Add exception** box, select the rule type that you want to create, and then click **Add**. + - For a publisher exception, click **Browse**, select the file that contains the publisher to exclude, and then click **OK**. - For a path exception, choose the file or folder path to exclude, and then click **OK**. - For a file hash exception, edit the file hash rule, and click **Remove**. diff --git a/windows/keep-secure/configure-s-mime.md b/windows/keep-secure/configure-s-mime.md index 0f76c34cac..1d5a83822d 100644 --- a/windows/keep-secure/configure-s-mime.md +++ b/windows/keep-secure/configure-s-mime.md @@ -2,55 +2,84 @@ title: Configure S/MIME for Windows 10 and Windows 10 Mobile (Windows 10) description: In Windows 10, S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients who have a digital identification (ID), also known as a certificate, can read them. ms.assetid: 7F9C2A99-42EB-4BCC-BB53-41C04FBBBF05 -ms.pagetype: security -keywords: ["encrypt", "digital signature"] +keywords: encrypt, digital signature ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: jdeckerMS --- + + # Configure S/MIME for Windows 10 and Windows 10 Mobile + **Applies to** - Windows 10 - Windows 10 Mobile + S/MIME stands for Secure/Multipurpose Internet Mail Extensions, and provides an added layer of security for email sent to and from an Exchange ActiveSync (EAS) account. In Windows 10, S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients who have a digital identification (ID), also known as a certificate, can read them. Users can digitally sign a message, which provides the recipients with a way to verify the identity of the sender and that the message hasn't been tampered with. + ## About message encryption + Users can send encrypted message to people in their organization and people outside their organization if they have their encryption certificates. However, users using Windows 10 Mail app can only read encrypted messages if the message is received on their Exchange account and they have corresponding decryption keys. + Encrypted messages can be read only by recipients who have a certificate. If you try to send an encrypted message to recipient(s) whose encryption certificate are not available, the app will prompt you to remove these recipients before sending the email. + ## About digital signatures + A digitally signed message reassures the recipient that the message hasn't been tampered with and verifies the identity of the sender. Recipients can only verify the digital signature if they’re using an email client that supports S/MIME. + ## Prerequisites + - [S/MIME is enabled for Exchange accounts](http://go.microsoft.com/fwlink/p/?LinkId=718217) (on-premises and Office 365). Users can’t use S/MIME signing and encryption with a personal account such as Outlook.com. - Valid Personal Information Exchange (PFX) certificates are installed on the device. + - [How to Create PFX Certificate Profiles in Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkID=718215) - [Enable access to company resources using certificate profiles with Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkId=718216) - [Install digital certificates on Windows 10 Mobile](installing-digital-certificates-on-windows-10-mobile.md) + ## Choose S/MIME settings + On the device, perform the following steps: (add select certificate) 1. Open the Mail app. (In Windows 10 Mobile, the app is Outlook Mail.) 2. Open **Settings** by tapping the gear icon on a PC, or the ellipsis (...) and then the gear icon on a phone. + ![settings icon in mail app](images/mailsettings.png) + 3. Tap **Email security**. + ![email security settings](images/emailsecurity.png) + 4. In **Select an account**, select the account for which you want to configure S/MIME options. 5. Make a certificate selection for digital signature and encryption. + - Select **Automatically** to let the app choose the certificate. - Select **Manually** to specify the certificate yourself from the list of valid certificates on the device. 6. (Optional) Select **Always sign with S/MIME**, **Always encrypt with S/MIME**, or both, to automatically digitally sign or encrypt all outgoing messages. - **Note**  The option to sign or encrypt can be changed for individual messages, unless EAS policies prevent it. + + >**Note:**  The option to sign or encrypt can be changed for individual messages, unless EAS policies prevent it.   7. Tap the back arrow. + ## Encrypt or sign individual messages 1. While composing a message, choose **Options** from the ribbon. On phone, **Options** can be accessed by tapping the the ellipsis (...). + 2. Use **Sign** and **Encrypt** icons to turn on digital signature and encryption for this message. + ![sign or encrypt message](images/signencrypt.png) + ## Read signed or encrypted messages + When you receive an encrypted message, the mail app will check whether there is a certificate available on your computer. If there is a certificate available, the message will be decrypted when you open it. If your certificate is stored on a smartcard, you will be prompted to insert the smartcard to read the message. Your smartcard may also require a PIN to access the certificate. + ## Install certificates from a received message + When you receive a signed email, the app provide feature to install corresponding encryption certificate on your device if the certificate is available. This certificate can then be used to send encrypted email to this person. + 1. Open a signed email. 2. Tap or click the digital signature icon in the reading pane. 3. Tap **Install.** + ![message security information](images/installcert.png)     diff --git a/windows/keep-secure/configure-the-appLocker-reference-device.md b/windows/keep-secure/configure-the-appLocker-reference-device.md index d3dd0de7e5..59e6e81b2d 100644 --- a/windows/keep-secure/configure-the-appLocker-reference-device.md +++ b/windows/keep-secure/configure-the-appLocker-reference-device.md @@ -2,35 +2,47 @@ title: Configure the AppLocker reference device (Windows 10) description: This topic for the IT professional describes the steps to create an AppLocker policy platform structure on a reference computer. ms.assetid: 034bd367-146d-4956-873c-e1e09e6fefee -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Configure the AppLocker reference device + **Applies to** - Windows 10 + This topic for the IT professional describes the steps to create an AppLocker policy platform structure on a reference computer. + An AppLocker reference device that is used for the development and deployment of AppLocker policies should mimic the directory structure and corresponding applications in the organizational unit (OU) or business group for the production environment. On a reference device, you can: + - Maintain an application list for each business group. - Develop AppLocker policies by creating individual rules or by creating a policy by automatically generating rules. - Create the default rules to allow the Windows system files to run properly. - Run tests and analyze the event logs to determine the affect of the policies that you intend to deploy. + The reference device does not need to be joined to a domain, but it must be able to import and export AppLocker policies in XML format. The reference computer must be running one of the supported editions of Windows as listed in [Requirements to use AppLocker](requirements-to-use-applocker.md). -**Warning**   -Do not use operating system snapshots when creating AppLocker rules. If you take a snapshot of the operating system, install an app, create AppLocker rules, and then revert to a clean snapshot and repeat the process for another app, there is a chance that duplicate rule GUIDs can be created. If duplicate GUIDs are present, AppLocker policies will not work as expected. + +>**Warning:**  Do not use operating system snapshots when creating AppLocker rules. If you take a snapshot of the operating system, install an app, create AppLocker rules, and then revert to a clean snapshot and repeat the process for another app, there is a chance that duplicate rule GUIDs can be created. If duplicate GUIDs are present, AppLocker policies will not work as expected.   **To configure a reference device** + 1. If the operating system is not already installed, install one of the supported editions of Windows on the device. - **Note**   - If you have the Group Policy Management Console (GPMC) installed on another device to test your implementation of AppLocker policies, you can export the policies to that device + + >**Note:**  If you have the Group Policy Management Console (GPMC) installed on another device to test your implementation of AppLocker policies, you can export the policies to that device   2. Configure the administrator account. + To update local policies, you must be a member of the local Administrators group. To update domain policies, you must be a member of the Domain Admins group or have been delegated privileges to use Group Policy to update a Group Policy Object (GPO). + 3. Install all apps that run in the targeted business group or OU by using the same directory structure. + The reference device should be configured to mimic the structure of your production environment. It depends on having the same apps in the same directories to accurately create the rules. + ### See also + - After you configure the reference computer, you can create the AppLocker rule collections. You can build, import, or automatically generate the rules. For procedures to do this, see [Working with AppLocker rules](working-with-applocker-rules.md). - [Use a reference device to create and maintain AppLocker policies](use-a-reference-computer-to-create-and-maintain-applocker-policies.md)   diff --git a/windows/keep-secure/configure-the-application-identity-service.md b/windows/keep-secure/configure-the-application-identity-service.md index 2f0505366e..0714a613da 100644 --- a/windows/keep-secure/configure-the-application-identity-service.md +++ b/windows/keep-secure/configure-the-application-identity-service.md @@ -15,12 +15,13 @@ author: brianlic-msft - Windows 10 This topic for IT professionals shows how to configure the Application Identity service to start automatically or manually. + The Application Identity service determines and verifies the identity of an app. Stopping this service will prevent AppLocker policies from being enforced. -**Important**   -When using Group Policy, you must configure it to start automatically in at least one Group Policy Object (GPO) that applies AppLocker rules. This is because AppLocker uses this service to verify the attributes of a file. +>**Important:**  When using Group Policy, you must configure it to start automatically in at least one Group Policy Object (GPO) that applies AppLocker rules. This is because AppLocker uses this service to verify the attributes of a file.   **To start the Application Identity service automatically using Group Policy** + 1. On the **Start** screen, type **gpmc.msc** to open the Group Policy Management Console (GPMC). 2. Locate the GPO to edit, right-click the GPO, and then click **Edit**. 3. In the console tree under **Computer Configuration\\Windows Settings\\Security Settings**, click **System Services**. @@ -30,6 +31,7 @@ When using Group Policy, you must configure it to start automatically in at leas Membership in the local **Administrators** group, or equivalent, is the minimum required to complete this procedure. **To start the Application Identity service manually** + 1. Right-click the taskbar, and click **Task Manager**. 2. Click the **Services** tab, right-click **AppIDSvc**, and then click **Start Service**. 3. Verify that the status for the Application Identity service is **Running**. diff --git a/windows/keep-secure/configure-windows-defender-in-windows-10.md b/windows/keep-secure/configure-windows-defender-in-windows-10.md index b4f9e3572b..72c2a16a9b 100644 --- a/windows/keep-secure/configure-windows-defender-in-windows-10.md +++ b/windows/keep-secure/configure-windows-defender-in-windows-10.md @@ -2,33 +2,48 @@ title: Configure Windows Defender in Windows 10 (Windows 10) description: IT professionals can configure definition updates and cloud-based protection in Windows Defender in Windows 10 through Microsoft Active Directory and Windows Server Update Services (WSUS). ms.assetid: 22649663-AC7A-40D8-B1F7-5CAD9E49653D -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library +ms.pagetype: security author: jasesso --- + # Configure Windows Defender in Windows 10 + **Applies to** - Windows 10 + IT professionals can configure definition updates and cloud-based protection in Windows Defender in Windows 10 through Microsoft Active Directory and Windows Server Update Services (WSUS). + ## Configure definition updates + It is important to update definitions regularly to ensure that your endpoints are protected. Definition updates can be configured to suit the requirements of your organization. + Windows Defender supports the same updating options (such as using multiple definition sources) as other Microsoft endpoint protection products; for more information, see [Configuring Definition Updates](https://technet.microsoft.com/library/gg412502.aspx). + When you configure multiple definition sources in Windows Defender, you can configure the fallback order using the following values through *Group Policy* settings: + - InternalDefinitionUpdateServer - WSUS - MicrosoftUpdateServer - Microsoft Update - MMPC - [Microsoft Malware Protection Center definitions page](http://www.microsoft.com/security/portal/definitions/adl.aspx) - FileShares - file share + Read about deploying administrative template files for Windows Defender in the article [Description of the Windows Defender Group Policy administrative template settings](https://support.microsoft.com/kb/927367). + You can also manage your Windows Defender update configuration settings through System Center Configuration Manager. See [How to Configure Definition Updates for Endpoint Protection in Configuration Manager](https://technet.microsoft.com/library/jj822983.aspx) for details. + ## Definition update logic + You can update Windows Defender definitions in four ways depending on your business requirements: + - WSUS, the managed server. You can manage the distribution of updates that are released through Microsoft Update to computers in your enterprise environment; read more on the [Windows Server Update Services](https://technet.microsoft.com/windowsserver/bb332157.aspx) website. - Microsoft Update, the unmanaged server. You can use this method to get regular updates from Microsoft Update. - The [Microsoft Malware Protection Center definitions page](http://www.microsoft.com/security/portal/definitions/adl.aspx), as an alternate download location. You can use this method if you want to download the latest definitions. - File share, where the definition package is downloaded. You can retrieve definition updates from a file share. The file share must be provisioned on a regular basis with the update files. + ## Update Windows Defender definitions through Active Directory and WSUS + This section details how to update Windows Defender definitions for Windows 10 endpoints through Active Directory and WSUS. @@ -109,50 +124,78 @@ This section details how to update Windows Defender definitions for Windows 10
        ## Manage cloud-based protection + Windows Defender offers improved cloud-based protection and threat intelligence for endpoint protection clients using the Microsoft Active Protection Service. Read more about the Microsoft Active Protection Service community in [Join the Microsoft Active Protection Service community](http://windows.microsoft.com/windows-8/join-maps-community). + You can enable or disable the Microsoft Active Protection Service using *Group Policy* settings and administrative template files. + More information on deploying administrative template files for Windows Defender is available in the article [Description of the Windows Defender Group Policy administrative template settings](https://support.microsoft.com/kb/927367). + The Microsoft Active Protection Service can be configured with the following *Group Policy* settings: + 1. Open the **Group Policy Editor**. 2. In the **Local Computer Policy** tree, expand **Computer Configuration**, then **Administrative Templates**, then **Windows Components**, then **Windows Defender**. 3. Click on **MAPS**. 4. Double-click on **Join Microsoft MAPS**. 5. Select your configuration option from the **Join Microsoft MAPS** list. - **Note**  Any settings modified on an endpoint will be overridden by the administrator's policy setting. + + >**Note:**  Any settings modified on an endpoint will be overridden by the administrator's policy setting.   Use the Windowsdefender.adm *Group Policy* template file to control the policy settings for Windows Defender in Windows 10: + Policy setting: **Configure Microsoft SpyNet Reporting** + Registry key name: **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\SpyNet\\SpyNetReporting** + Policy description: **Adjusts membership in Microsoft Active Protection Service** + You can also configure preferences using the following PowerShell parameters: + - Turn Microsoft Active Protection Service off: *Set-MpPreference -MAPSReporting 0* - Turn Microsoft Active Protection Service on: *Set-MpPreference -MAPSReporting 2* + Read more about this in: + - [Scripting with Windows PowerShell](https://technet.microsoft.com/library/bb978526.aspx) - [Defender Cmdlets](https://technet.microsoft.com/library/dn433280.aspx) -**Note**  Any information that Windows Defender collects is encrypted in transit to our servers, and then stored in secure facilities. Microsoft takes several steps to avoid collecting any information that directly identifies you, such as your name, email address, or account ID. + +>**Note:**  Any information that Windows Defender collects is encrypted in transit to our servers, and then stored in secure facilities. Microsoft takes several steps to avoid collecting any information that directly identifies you, such as your name, email address, or account ID.   Read more about how to manage your privacy settings in [Setting your preferences for Windows 10 services](http://windows.microsoft.com/windows-10/services-setting-preferences). + ## Opt-in to Microsoft Update + You can use Microsoft Update to keep definitions on mobile computers running Windows Defender in Windows 10 up to date when they are not connected to the corporate network. If the mobile computer doesn't have a [Windows Server Update Service](https://technet.microsoft.com/windowsserver/bb332157.aspx) (WSUS) connection, the signatures will still come from Microsoft Update. This means that signatures can be pushed down (via Microsoft Update) even if WSUS overrides Windows Update. + You need to opt-in to Microsoft Update on the mobile computer before it can retrieve the definition updates from Microsoft Update. + There are two ways you can opt-in to Microsoft Update in Windows Defender for Windows 10: + 1. Use a VBScript to create a script, then run it on each computer in your network. 2. Manually opt-in every computer on your network through the **Settings** menu. + You can create a VBScript and run it on each computer on your network; this is an efficient way to opt-in to Microsoft Update. + **Use a VBScript to opt in to Microsoft Update** + 1. Use the instructions in the MSDN article [Opt-In to Microsoft Update](https://msdn.microsoft.com/library/windows/desktop/aa826676.aspx) to create the VBScript. 2. Run the VBScript you created on each computer in your network. + You can manually opt-in each individual computer on your network to receive Microsoft Update. + **Manually opt-in to Microsoft Update** + 1. Open **Windows Update** in **Update & security** settings on the computer you want to opt-in. 2. Click **Advanced** options. 3. Select the checkbox for **Give me updates for other Microsoft products when I update Windows**. + ## Schedule updates for Microsoft Update + Opting-in to Microsoft Update means that your system administrator can schedule updates to your mobile computer, so that it keeps up-to-date with the latest software versions and security definitions, even when you’re on the road. + For more information on scheduling updates, see [Configure definition updates](https://technet.microsoft.com/library/mt622088.aspx#configure-definition-updates). + ## Related topics -[Update and manage Windows Defender in Windows 10](get-started-with-windows-defender-for-windows-10.md) -[Troubleshoot Windows Defender in Windows 10](troubleshoot-windows-defender-in-windows-10.md) -  -  + +- [Update and manage Windows Defender in Windows 10](get-started-with-windows-defender-for-windows-10.md) +- [Troubleshoot Windows Defender in Windows 10](troubleshoot-windows-defender-in-windows-10.md) diff --git a/windows/keep-secure/create-a-basic-audit-policy-settings-for-an-event-category.md b/windows/keep-secure/create-a-basic-audit-policy-settings-for-an-event-category.md index 08b1dfb88d..cdd372d271 100644 --- a/windows/keep-secure/create-a-basic-audit-policy-settings-for-an-event-category.md +++ b/windows/keep-secure/create-a-basic-audit-policy-settings-for-an-event-category.md @@ -2,26 +2,36 @@ title: Create a basic audit policy for an event category (Windows 10) description: By defining auditing settings for specific event categories, you can create an auditing policy that suits the security needs of your organization. ms.assetid: C9F52751-B40D-482E-BE9D-2C61098249D3 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Create a basic audit policy for an event category + **Applies to** - Windows 10 + By defining auditing settings for specific event categories, you can create an auditing policy that suits the security needs of your organization. On devices that are joined to a domain, auditing settings for the event categories are undefined by default. On domain controllers, auditing is turned on by default. + To complete this procedure, you must be logged on as a member of the built-in Administrators group. + **To define or modify auditing policy settings for an event category for your local computer** + 1. Open the Local Security Policy snap-in (secpol.msc), and then click **Local Policies**. 2. Click **Audit Policy**. 3. In the results pane, double-click an event category that you want to change the auditing policy settings for. 4. Do one or both of the following, and then click **OK.** + - To audit successful attempts, select the **Success** check box. - To audit unsuccessful attempts, select the **Failure** check box. + To complete this procedure, you must be logged on as a member of the Domain Admins group. + **To define or modify auditing policy settings for an event category for a domain or organizational unit, when you are on a member server or on a workstation that is joined to a domain** + 1. Open the Group Policy Management Console (GPMC). 2. In the console tree, double-click **Group Policy objects** in the forest and domain containing the **Default Domain Policy** Group Policy object (GPO) that you want to edit. 3. Right-click the **Default Domain Policy** GPO, and then click **Edit**. @@ -29,11 +39,12 @@ To complete this procedure, you must be logged on as a member of the Domain Admi 5. In the results pane, double-click an event category that you want to change the auditing policy settings for. 6. If you are defining auditing policy settings for this event category for the first time, select the **Define these policy settings** check box. 7. Do one or both of the following, and then click **OK.** + - To audit successful attempts, select the **Success** check box. - To audit unsuccessful attempts, select the **Failure** check box. + ## Additional considerations + - To audit object access, enable auditing of the object access event category by following the steps above. Then, enable auditing on the specific object. - After your audit policy is configured, events will be recorded in the Security log. Open the Security log to view these events. - The default auditing policy setting for domain controllers is **No Auditing**. This means that even if auditing is enabled in the domain, the domain controllers do not inherit auditing policy locally. If you want domain auditing policy to apply to domain controllers, you must modify this policy setting. -  -  diff --git a/windows/keep-secure/create-a-pagefile.md b/windows/keep-secure/create-a-pagefile.md index 31839c324f..c914d790aa 100644 --- a/windows/keep-secure/create-a-pagefile.md +++ b/windows/keep-secure/create-a-pagefile.md @@ -2,88 +2,89 @@ title: Create a pagefile (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Create a pagefile security policy setting. ms.assetid: dc087897-459d-414b-abe0-cd86c8dccdea -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Create a pagefile + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Create a pagefile** security policy setting. + ## Reference + Windows designates a section of the hard drive as virtual memory known as the page file, or more specifically, as pagefile.sys. It is used to supplement the computer’s Random Access Memory (RAM) to improve performance for programs and data that are used frequently. Although the file is hidden from browsing, you can manage it using the system settings. + This policy setting determines which users can create and change the size of a page file. It determines whether users can specify a page file size for a particular drive in the **Performance Options** box located on the **Advanced** tab of the **System Properties** dialog box or through using internal application interfaces (APIs). + Constant: SeCreatePagefilePrivilege + ### Possible values + - User-defined list of accounts - Administrators + ### Best practices + - Restrict the **Create a pagefile** user right to Administrators, which is the default. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default, members of the Administrators group have this right. + The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Administrators

      Default Domain Controller Policy

      Administrators

      Stand-Alone Server Default Settings

      Administrators

      Domain Controller Effective Default Settings

      Administrators

      Member Server Effective Default Settings

      Administrators

      Client Computer Effective Default Settings

      Administrators

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Administrators | +| Default Domain Controller Policy | Administrators | +| Stand-Alone Server Default Settings | Administrators | +| Domain Controller Effective Default Settings | Administrators | +| Member Server Effective Default Settings | Administrators | +| Client Computer Effective Default Settings | Administrators |   ## Policy management + A restart of the device is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Users who can change the page file size could make it extremely small or move the file to a highly fragmented storage volume, which could cause reduced device performance. + ### Countermeasure + Restrict the **Create a pagefile** user right to members of the Administrators group. + ### Potential impact + None. Restricting this right to members of the Administrators group is the default configuration. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/create-a-rule-for-packaged-apps.md b/windows/keep-secure/create-a-rule-for-packaged-apps.md index 2474296f59..3909260775 100644 --- a/windows/keep-secure/create-a-rule-for-packaged-apps.md +++ b/windows/keep-secure/create-a-rule-for-packaged-apps.md @@ -2,24 +2,34 @@ title: Create a rule for packaged apps (Windows 10) description: This topic for IT professionals shows how to create an AppLocker rule for packaged apps with a publisher condition. ms.assetid: e4ffd400-7860-47b3-9118-0e6853c3dfa0 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Create a rule for packaged apps + **Applies to** - Windows 10 + This topic for IT professionals shows how to create an AppLocker rule for packaged apps with a publisher condition. + Packaged apps, also known as Universal Windows apps, are based on an app model that ensures that all the files within an app package share the same identity. Therefore, it is possible to control the entire app using a single AppLocker rule as opposed to the non-packaged apps where each file within the app could have a unique identity. Windows does not support unsigned packaged apps which implies all packaged apps must be signed. AppLocker supports only publisher rules for packaged apps. A publisher rule for a packaged app is based on the following information: + - Publisher of the package - Package name - Package version + All the files within a package as well as the package installer share these attributes. Therefore, an AppLocker rule for a packaged app controls both the installation as well as the running of the app. Otherwise, the publisher rules for packaged apps are no different than the rest of the rule collections; they support exceptions, can be increased or decreased in scope, and can be assigned to users and groups. + For info about the publisher condition, see [Understanding the publisher rule condition in AppLocker](understanding-the-publisher-rule-condition-in-applocker.md). + You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). + **To create a packaged app rule** + 1. Open the AppLocker console. 2. On the **Action** menu, or by right-clicking on **Packaged app Rules**, click **Create New Rule**. 3. On the **Before You Begin** page, click **Next**. @@ -99,5 +109,3 @@ You can perform this task by using the Group Policy Management Console for an Ap 6. Click **Next**. 7. (Optional) On the **Exceptions** page, specify conditions by which to exclude files from being affected by the rule. This allows you to add exceptions based on the same rule reference and rule scope as you set before. Click **Next**. 8. On the **Name** page, either accept the automatically generated rule name or type a new rule name, and then click **Create**. -  -  diff --git a/windows/keep-secure/create-a-rule-that-uses-a-file-hash-condition.md b/windows/keep-secure/create-a-rule-that-uses-a-file-hash-condition.md index f5a2a1ed28..261eea052b 100644 --- a/windows/keep-secure/create-a-rule-that-uses-a-file-hash-condition.md +++ b/windows/keep-secure/create-a-rule-that-uses-a-file-hash-condition.md @@ -2,30 +2,37 @@ title: Create a rule that uses a file hash condition (Windows 10) description: This topic for IT professionals shows how to create an AppLocker rule with a file hash condition. ms.assetid: eb3b3524-1b3b-4979-ba5a-0a0b1280c5c7 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Create a rule that uses a file hash condition + **Applies to** - Windows 10 + This topic for IT professionals shows how to create an AppLocker rule with a file hash condition. + File hash rules use a system-computed cryptographic hash of the identified file. + For info about the file hash condition, see [Understanding the File Hash Rule Condition in AppLocker](understanding-the-file-hash-rule-condition-in-applocker.md). -You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). + +You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer +AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). + **To create a new rule with a file hash condition** + 1. Open the AppLocker console, and then click the rule collection that you want to create the rule for. 2. On the **Action** menu, click **Create New Rule**. 3. On the **Before You Begin** page, click **Next**. 4. On the **Permissions** page, select the action (allow or deny) and the user or group that the rule should apply to, and then click **Next**. 5. On the **Conditions** page, select the **File hash** rule condition, and then click **Next**. 6. **Browse Files** to locate the targeted application file. - **Note**   - You can also click **Browse Folders** which calculates the hash for all the appropriate files relative to the rule collection. To remove hashes individually, click the **Remove** button. + + >**Note:**  You can also click **Browse Folders** which calculates the hash for all the appropriate files relative to the rule collection. To remove hashes individually, click the **Remove** button.   7. Click **Next**. 8. On the **Name** page, either accept the automatically generated rule name or type a new rule name, and then click **Create**. -  -  diff --git a/windows/keep-secure/create-a-rule-that-uses-a-path-condition.md b/windows/keep-secure/create-a-rule-that-uses-a-path-condition.md index 3130eeb9a7..8553577fac 100644 --- a/windows/keep-secure/create-a-rule-that-uses-a-path-condition.md +++ b/windows/keep-secure/create-a-rule-that-uses-a-path-condition.md @@ -2,34 +2,39 @@ title: Create a rule that uses a path condition (Windows 10) description: This topic for IT professionals shows how to create an AppLocker rule with a path condition. ms.assetid: 9b2093f5-5976-45fa-90c3-da1e0e845d95 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Create a rule that uses a path condition + **Applies to** - Windows 10 + This topic for IT professionals shows how to create an AppLocker rule with a path condition. + The path condition identifies an app by its location in the file system of the computer or on the network. -**Important**   -When creating a rule that uses a deny action, path conditions are less secure for preventing access to a file because a user could easily copy the file to a different location than what is specified in the rule. Because path rules correspond to locations within the file system, you should ensure that there are no subdirectories that are writable by non-administrators. For example, if you create a path rule for C:\\ with the allow action, any file within C:\\ will be allowed to run, including users' profiles. + +>**Important:**  When creating a rule that uses a deny action, path conditions are less secure for preventing access to a file because a user could easily copy the file to a different location than what is specified in the rule. Because path rules correspond to locations within the file system, you should ensure that there are no subdirectories that are writable by non-administrators. For example, if you create a path rule for C:\\ with the allow action, any file within C:\\ will be allowed to run, including users' profiles.   For info about the path condition, see [Understanding the path rule condition in AppLocker](understanding-the-path-rule-condition-in-applocker.md). + You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For information how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). + **To create a new rule with a path condition** + 1. Open the AppLocker console, and then click the rule collection that you want to create the rule for. 2. On the **Action** menu, click **Create New Rule**. 3. On the **Before You Begin** page, click **Next**. 4. On the **Permissions** page, select the action (allow or deny) and the user or group that the rule should apply to, and then click **Next**. 5. On the **Conditions** page, select the **Path** rule condition, and then click **Next**. 6. Click **Browse Files** to locate the targeted folder for the app. - **Note**   - When you browse to a file or folder location, the wizard automatically converts absolute file paths to use AppLocker path variables. You may edit the path after browsing to specify an absolute path, or you may type the path directly into the **Path** box. To learn more about AppLocker path variables, see [Understanding the path rule condition in AppLocker](understanding-the-path-rule-condition-in-applocker.md). + + >**Note:**  When you browse to a file or folder location, the wizard automatically converts absolute file paths to use AppLocker path variables. You may edit the path after browsing to specify an absolute path, or you may type the path directly into the **Path** box. To learn more about AppLocker path variables, see [Understanding the path rule condition in AppLocker](understanding-the-path-rule-condition-in-applocker.md).   7. Click **Next**. 8. (Optional) On the **Exceptions** page, specify conditions by which to exclude files from being affected by the rule. Click **Next**. 9. On the **Name** page, either accept the automatically generated rule name or type a new rule name, and then click **Create**. -  -  diff --git a/windows/keep-secure/create-a-rule-that-uses-a-publisher-condition.md b/windows/keep-secure/create-a-rule-that-uses-a-publisher-condition.md index 11baddf574..11ceca1e52 100644 --- a/windows/keep-secure/create-a-rule-that-uses-a-publisher-condition.md +++ b/windows/keep-secure/create-a-rule-that-uses-a-publisher-condition.md @@ -2,21 +2,30 @@ title: Create a rule that uses a publisher condition (Windows 10) description: This topic for IT professionals shows how to create an AppLocker rule with a publisher condition. ms.assetid: 345ad45f-2bc1-4c4c-946f-17804e29f55b -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Create a rule that uses a publisher condition + **Applies to** - Windows 10 + This topic for IT professionals shows how to create an AppLocker rule with a publisher condition. + You can use publisher conditions only for files that are digitally signed; the publisher condition identifies an app based on its digital signature and extended attributes. The digital signature contains information about the company that created the app (the publisher). The extended attributes, which are obtained from the binary resource, contain the name of the product that the file is part of and the version number of the application. The publisher may be a software development company, such as Microsoft, or the information technology department of your organization. Packaged app rules are by definition rules that use publisher conditions. For info about creating a packaged app rule, see [Create a rule for packaged apps](create-a-rule-for-packaged-apps.md). + For info about the publisher condition, see [Understanding the publisher rule condition in AppLocker](understanding-the-publisher-rule-condition-in-applocker.md). -You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). + +You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer +AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). + **To create a new rule with a publisher condition** + 1. Open the AppLocker console, and then click the rule collection that you want to create the rule for. 2. On the **Action** menu, click **Create New Rule**. 3. On the **Before You Begin** page, click **Next**. @@ -26,5 +35,3 @@ You can perform this task by using the Group Policy Management Console for an Ap 7. Click **Next**. 8. (Optional) On the **Exceptions** page, specify conditions by which to exclude files from being affected by the rule. Click **Next**. 9. On the **Name** page, either accept the automatically generated rule name or type a new rule name, and then click **Create**. -  -  diff --git a/windows/keep-secure/create-a-token-object.md b/windows/keep-secure/create-a-token-object.md index 1c972b491b..99055b694f 100644 --- a/windows/keep-secure/create-a-token-object.md +++ b/windows/keep-secure/create-a-token-object.md @@ -2,91 +2,91 @@ title: Create a token object (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Create a token object security policy setting. ms.assetid: bfbf52fc-6ba4-442a-9df7-bd277e55729c -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Create a token object + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Create a token object** security policy setting. + ## Reference + This policy setting determines which accounts a process can use to create a token, and which accounts it can then use to gain access to local resources when the process uses NtCreateToken() or other token-creation APIs. + When a user logs on to the local device or connects to a remote device through a network, Windows builds the user’s access token. Then the system examines the token to determine the level of the user's privileges. When you revoke a privilege, the change is immediately recorded, but the change is not reflected in the user's access token until the next time the user logs on or connects. + Constant: SeCreateTokenPrivilege + ### Possible values + - User-defined list of accounts - Not Defined + ### Best practices + - This user right is used internally by the operating system. Unless it is necessary, do not assign this user right to a user, group, or process other than Local System. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + This user right is used internally by the operating system. By default, it is not assigned to any user groups. + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not Defined

      Default Domain Controller Policy

      Not Defined

      Stand-Alone Server Default Settings

      Not Defined

      Domain Controller Effective Default Settings

      Local System

      Member Server Effective Default Settings

      Local System

      Client Computer Effective Default Settings

      Local System

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not Defined | +| Default Domain Controller Policy | Not Defined | +| Stand-Alone Server Default Settings | Not Defined | +| Domain Controller Effective Default Settings | Local System | +| Member Server Effective Default Settings | Local System | +| Client Computer Effective Default Settings | Local System |   ## Policy management + A restart of the device is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability -**Caution**   -A user account that is given this user right has complete control over the system, and it can lead to the system being compromised. We highly recommend that you do not assign this right to any user accounts. + +>**Caution:**  A user account that is given this user right has complete control over the system, and it can lead to the system being compromised. We highly recommend that you do not assign this right to any user accounts.   Windows examines a user's access token to determine the level of the user's privileges. Access tokens are built when users log on to the local device or connect to a remote device over a network. When you revoke a privilege, the change is immediately recorded, but the change is not reflected in the user's access token until the next time the user logs on or connects. Users with the ability to create or modify tokens can change the level of access for any account on a computer if they are currently logged on. They could escalate their privileges or create a DoS condition. + ### Countermeasure + Do not assign the **Create a token object** user right to any users. Processes that require this user right should use the Local System account, which already includes it, instead of a separate user account that has this user right assigned. + ### Potential impact + None. Not Defined is the default configuration. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/create-applocker-default-rules.md b/windows/keep-secure/create-applocker-default-rules.md index 15c82719f5..eb37fb2112 100644 --- a/windows/keep-secure/create-applocker-default-rules.md +++ b/windows/keep-secure/create-applocker-default-rules.md @@ -2,24 +2,28 @@ title: Create AppLocker default rules (Windows 10) description: This topic for IT professionals describes the steps to create a standard set of AppLocker rules that will allow Windows system files to run. ms.assetid: 21e9dc68-a6f4-4ebe-ac28-4c66a7ab6e18 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Create AppLocker default rules + **Applies to** - Windows 10 + This topic for IT professionals describes the steps to create a standard set of AppLocker rules that will allow Windows system files to run. + AppLocker includes default rules for each rule collection. These rules are intended to help ensure that the files that are required for Windows to operate properly are allowed to run. -**Important**   -You can use the default rules as a template when creating your own rules to allow files within the Windows folders to run. However, these rules are only meant to function as a starter policy when you are first testing AppLocker rules. The default rules can be modified in the same way as other AppLocker rule types. + +>**Important:**  You can use the default rules as a template when creating your own rules to allow files within the Windows folders to run. However, these rules are only meant to function as a starter policy when you are first testing AppLocker rules. The default rules can be modified in the same way as other AppLocker rule types.   You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For information how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). + **To create default rules** + 1. Open the AppLocker console. 2. Right-click the appropriate rule type for which you want to automatically generate default rules. You can automatically generate rules for executable, Windows Installer, script rules and Packaged app rules. 3. Click **Create Default Rules**. -  -  diff --git a/windows/keep-secure/create-global-objects.md b/windows/keep-secure/create-global-objects.md index 7e51c7a813..1f047ee451 100644 --- a/windows/keep-secure/create-global-objects.md +++ b/windows/keep-secure/create-global-objects.md @@ -2,106 +2,91 @@ title: Create global objects (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Create global objects security policy setting. ms.assetid: 9cb6247b-44fc-4815-86f2-cb59b6f0221e -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Create global objects + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Create global objects** security policy setting. + ## Reference + This policy setting determines which users can create global objects that are available to all sessions. Users can still create objects that are specific to their own session if they do not have this user right. + A global object is an object that is created to be used by any number of processes or threads, even those not started within the user’s session. Remote Desktop Services uses global objects in its processes to facilitate connections and access. + Constant: SeCreateGlobalPrivilege + ### Possible values + - User-defined list of accounts - Default accounts listed below + ### Best practices + - Do not assign any user accounts this right. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default, members of the Administrators group have this right, as do Local Service and Network Service accounts on the supported versions of Windows. Service is included for backwards compatibility with earlier versions of Windows. + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not Defined

      Default Domain Controller Policy

      Administrators

      -

      Local Service

      -

      Network Service

      -

      Service

      Stand-Alone Server Default Settings

      Administrators

      -

      Local Service

      -

      Network Service

      -

      Service

      Domain Controller Effective Default Settings

      Administrators

      -

      Local Service

      -

      Network Service

      -

      Service

      Member Server Effective Default Settings

      Administrators

      -

      Local Service

      -

      Network Service

      -

      Service

      Client Computer Effective Default Settings

      Administrators

      -

      Local Service

      -

      Network Service

      -

      Service

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not Defined | +| Default Domain Controller Policy | Administrators
      Local Service
      Network Service
      Service| +| Stand-Alone Server Default Settings | Administrators
      Local Service
      Network Service
      Service| +| Domain Controller Effective Default Settings | Administrators
      Local Service
      Network Service
      Service| +| Member Server Effective Default Settings | Administrators
      Local Service
      Network Service
      Service| +| Client Computer Effective Default Settings | Administrators
      Local Service
      Network Service
      Service|   ## Policy management + A restart of the device is not required for this policy setting to take effect. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability -**Caution**   -A user account that is given this user right has complete control over the system, and it can lead to the system being compromised. We highly recommend that you do not assign this right to any user accounts. + +>**Caution:**  A user account that is given this user right has complete control over the system, and it can lead to the system being compromised. We highly recommend that you do not assign this right to any user accounts.   Windows examines a user's access token to determine the level of the user's privileges. Access tokens are built when users log on to the local device or connect to a remote device over a network. When you revoke a privilege, the change is immediately recorded, but the change is not reflected in the user's access token until the next time the user logs on or connects. Users with the ability to create or modify tokens can change the level of access for any currently logged on account. They could escalate their privileges or create a denial-of-service (DoS) condition. + ### Countermeasure + Do not assign the **Create a token object** user right to any users. Processes that require this user right should use the Local System account, which already includes it, instead of a separate user account with this user right assigned. + ### Potential impact + None. Not Defined is the default domain policy configuration. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/create-list-of-applications-deployed-to-each-business-group.md b/windows/keep-secure/create-list-of-applications-deployed-to-each-business-group.md index 6afbbb8eb8..074fababfc 100644 --- a/windows/keep-secure/create-list-of-applications-deployed-to-each-business-group.md +++ b/windows/keep-secure/create-list-of-applications-deployed-to-each-business-group.md @@ -2,46 +2,69 @@ title: Create a list of apps deployed to each business group (Windows 10) description: This topic describes the process of gathering app usage requirements from each business group in order to implement application control policies by using AppLocker. ms.assetid: d713aa07-d732-4bdc-8656-ba616d779321 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Create a list of apps deployed to each business group + **Applies to** - Windows 10 + This topic describes the process of gathering app usage requirements from each business group in order to implement application control policies by using AppLocker. + ## Determining app usage + For each business group, determine the following: + - The complete list of apps used, including different versions of an app - The full installation path of the app - The publisher and signed status of each app - The type of requirement the business groups set for each app, such as business critical, business productivity, optional, or personal. It might also be helpful during this effort to identify which apps are supported or unsupported by your IT department, or supported by others outside your control. - A list of files or apps that require administrative credentials to install or run. If the file requires administrative credentials to install or run, users who cannot provide administrative credentials will be prevented from running the file even if the file is explicitly allowed by an AppLocker policy. Even with AppLocker policies enforced, only members of the Administrators group can install or run files that require administrative credentials. + ### How to perform the app usage assessment -Although you might already have a method in place to understand app usage for each business group, you will need to use this information to help create your AppLocker rule collection. AppLocker includes the Automatically Generate Rules wizard and the **Audit only** enforcement configuration to assist you with planning and creating your rule collection. + +Although you might already have a method in place to understand app usage for each business group, you will need to use this information to help create your AppLocker rule collection. AppLocker includes the Automatically Generate +Rules wizard and the **Audit only** enforcement configuration to assist you with planning and creating your rule collection. + **Application inventory methods** + Using the Automatically Generate Rules wizard quickly creates rules for the applications you specify. The wizard is designed specifically to build a rule collection. You can use the Local Security Policy snap-in to view and edit the rules. This method is very useful when creating rules from a reference computer, and when creating and evaluating AppLocker policies in a testing environment. However, it does require that the files be accessible on the reference computer or through a network drive. This might mean additional work in setting up the reference computer and determining a maintenance policy for that computer. -Using the **Audit only** enforcement method permits you to view the logs because it collects information about every process on the computers receiving the Group Policy Object (GPO). Therefore, you can see what the enforcement will be on the computers in a business group. AppLocker includes Windows PowerShell cmdlets that you can use to analyze the events from the event log and cmdlets to create rules. However, when you use Group Policy to deploy to several computers, a means to collect events in a central location is very important for manageability. Because AppLocker logs information about files that users or other processes start on a computer, you could miss creating some rules initially. Therefore, you should continue your evaluation until you can verify that all required applications that are allowed to run are accessed successfully. -**Tip**   -If you run Application Verifier against a custom application with any AppLocker policies enabled, it might prevent the application from running. You should either disable Application Verifier or AppLocker. + +Using the **Audit only** enforcement method permits you to view the logs because it collects information about every process on the computers receiving the Group Policy Object (GPO). Therefore, you can see what the enforcement will be on the computers in a business group. AppLocker includes Windows PowerShell cmdlets that you can use to analyze the events from the event log and cmdlets to create rules. However, when you use Group Policy to deploy to several computers, a means to collect events in a central location is very important for manageability. Because AppLocker logs information about files that users or other processes start on a computer, you could miss creating some rules +initially. Therefore, you should continue your evaluation until you can verify that all required applications that are allowed to run are accessed successfully. + +>**Tip:**  If you run Application Verifier against a custom application with any AppLocker policies enabled, it might prevent the application from running. You should either disable Application Verifier or AppLocker. You can create an inventory of Universal Windows apps on a device by using two methods: the **Get-AppxPackage** Windows PowerShell cmdlet or the AppLocker console.   The following topics in the [AppLocker Step-by-Step Guide](http://go.microsoft.com/fwlink/p/?LinkId=160261) describe how to perform each method: + - [Automatically generating executable rules from a reference computer](http://go.microsoft.com/fwlink/p/?LinkId=160264) - [Using auditing to track which apps are used](http://go.microsoft.com/fwlink/p/?LinkId=160281) + ### Prerequisites to completing the inventory + Identify the business group and each organizational unit (OU) within that group to which you will apply application control policies. In addition, you should have identified whether or not AppLocker is the most appropriate solution for these policies. For info about these steps, see the following topics: + - [Understand AppLocker policy design decisions](understand-applocker-policy-design-decisions.md) - [Determine your application control objectives](determine-your-application-control-objectives.md) + ## Next steps + Identify and develop the list of apps. Record the name of the app, whether it is signed or not as indicated by the publisher's name, and whether or not it is a mission critical, business productivity, optional, or personal application. Record the installation path of the apps. For info about how to do this, see [Document your app list](document-your-application-list.md). + After you have created the list of apps, the next step is to identify the rule collections, which will become the policies. This information can be added to the table under columns labeled: + - Use default rule or define new rule condition - Allow or deny - GPO name + To do this, see the following topics: + - [Select the types of rules to create](select-types-of-rules-to-create.md) - [Determine the Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md)   diff --git a/windows/keep-secure/create-permanent-shared-objects.md b/windows/keep-secure/create-permanent-shared-objects.md index ee6979dbe5..33ab226516 100644 --- a/windows/keep-secure/create-permanent-shared-objects.md +++ b/windows/keep-secure/create-permanent-shared-objects.md @@ -2,88 +2,89 @@ title: Create permanent shared objects (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Create permanent shared objects security policy setting. ms.assetid: 6a58438d-65ca-4c4a-a584-450eed976649 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Create permanent shared objects + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Create permanent shared objects** security policy setting. + ## Reference + This user right determines which accounts can be used by processes to create a directory object by using the object manager. Directory objects include Active Directory objects, files and folders, printers, registry keys, processes, and threads. Users who have this capability can create permanent shared objects, including devices, semaphores, and mutexes. This user right is useful to kernel-mode components that extend the object namespace. Because components that are running in kernel-mode inherently have this user right assigned to them, it is not necessary to specifically assign it. + Constant: SeCreatePermanentPrivilege + ### Possible values + - User-defined list of accounts - Not Defined + ### Best practices + - Users who have the **Create permanent shared objects** user right could create new shared objects and expose sensitive data to the network. Therefore, do not assign this right to any users. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default, **LocalSystem** is the only account that has this right. + The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not Defined

      Default Domain Controller Policy

      Not Defined

      Stand-Alone Server Default Settings

      Not Defined

      Domain Controller Effective Default Settings

      LocalSystem

      Member Server Effective Default Settings

      LocalSystem

      Client Computer Effective Default Settings

      LocalSystem

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not Defined| +| Default Domain Controller Policy | Not Defined | +| Stand-Alone Server Default Settings | Not Defined| +| Domain Controller Effective Default Settings | **LocalSystem**| +| Member Server Effective Default Settings | **LocalSystem**| +| Client Computer Effective Default Settings | **LocalSystem**|   ## Policy management + This section describes different features and tools available to help you manage this policy. + A restart of the device is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Users who have the **Create permanent shared objects** user right could create new shared objects and expose sensitive data to the network. + ### Countermeasure + Do not assign the **Create permanent shared objects** user right to any users. Processes that require this user right should use the System account, which already includes this user right, instead of a separate user account. + ### Potential impact + None. Not Defined is the default configuration. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/create-symbolic-links.md b/windows/keep-secure/create-symbolic-links.md index 618cd6c90a..857a5a7ca9 100644 --- a/windows/keep-secure/create-symbolic-links.md +++ b/windows/keep-secure/create-symbolic-links.md @@ -2,92 +2,96 @@ title: Create symbolic links (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Create symbolic links security policy setting. ms.assetid: 882922b9-0ff8-4ee9-8afc-4475515ee3fd -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Create symbolic links + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Create symbolic links** security policy setting. + ## Reference + This user right determines if users can create a symbolic link from the device they are logged on to. + A symbolic link is a file-system object that points to another file-system object. The object that is pointed to is called the target. Symbolic links are transparent to users. The links appear as normal files or directories, and they can be acted upon by the user or application in exactly the same manner. Symbolic links are designed to aid in migration and application compatibility with UNIX operating systems. Microsoft has implemented symbolic links to function just like UNIX links. -**Warning**   This privilege should only be given to trusted users. Symbolic links can expose security vulnerabilities in applications that aren't designed to handle them. + +>**Warning:**   This privilege should only be given to trusted users. Symbolic links can expose security vulnerabilities in applications that aren't designed to handle them. Constant: SeCreateSymbolicLinkPrivilege + ### Possible values + - User-defined list of accounts - Not Defined + ### Best practices + - This user right should only be given to trusted users. Symbolic links can expose security vulnerabilities in applications that are not designed to handle them. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default, members of the Administrators group have this right. + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not Defined

      Default Domain Controller Policy

      Not Defined

      Stand-Alone Server Default Settings

      Not Defined

      Domain Controller Effective Default Settings

      Administrators

      Member Server Effective Default Settings

      Administrators

      Client Computer Effective Default Settings

      Administrators

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not Defined| +| Default Domain Controller Policy | Not Defined| +| Stand-Alone Server Default Settings | Not Defined| +| Domain Controller Effective Default Settings | Administrators| +| Member Server Effective Default Settings | Administrators| +| Client Computer Effective Default Settings | Administrators|   ## Policy management + This section describes different features and tools available to help you manage this policy. + A restart of the device is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ### Command-line tools + This setting can be used in conjunction with a symbolic link file system setting that can be manipulated with the command-line tool to control the kinds of symlinks that are allowed on the device. For more info, type **fsutil behavior set symlinkevalution /?** at the command prompt. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Users who have the **Create symbolic links** user right could inadvertently or maliciously expose your system to symbolic link attacks. Symbolic link attacks can be used to change the permissions on a file, to corrupt data, to destroy data, or as a DoS attack. + ### Countermeasure + Do not assign the **Create symbolic links** user right to standard users. Restrict this right to trusted administrators. You can use the **fsutil** command to establish a symbolic link file system setting that controls the kind of symbolic links that can be created on a computer. + ### Potential impact + None. Not defined is the default configuration. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/create-your-applocker-planning-document.md b/windows/keep-secure/create-your-applocker-planning-document.md index 990887b439..263be36d5e 100644 --- a/windows/keep-secure/create-your-applocker-planning-document.md +++ b/windows/keep-secure/create-your-applocker-planning-document.md @@ -2,26 +2,37 @@ title: Create your AppLocker planning document (Windows 10) description: This planning topic for the IT professional summarizes the information you need to research and include in your AppLocker planning document. ms.assetid: 41e49644-baf4-4514-b089-88adae2d624e -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Create your AppLocker planning document + **Applies to** + - Windows 10 + This planning topic for the IT professional summarizes the information you need to research and include in your AppLocker planning document. + ## The AppLocker deployment design + The design process and the planning document help you investigate application usage in your organization and record your findings so you can effectively deploy and maintain application control policies by using AppLocker. + You should have completed these steps in the design and planning process: + 1. [Determine your application control objectives](determine-your-application-control-objectives.md) 2. [Create a list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md) 3. [Select types of rules to create](select-types-of-rules-to-create.md) 4. [Determine Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md) 5. [Plan for AppLocker policy management](plan-for-applocker-policy-management.md) + ### AppLocker planning document contents + Your planning document should contain: + - A list of business groups that will participate in the application control policy project, their requirements, a description of their business processes, and contact information. - Application control policy project target dates, both for planning and deployment. - A complete list of apps used by each business group (or organizational unit), including version information and installation paths. @@ -29,10 +40,15 @@ Your planning document should contain: - A strategy for using Group Policy to deploy the AppLocker policies. - A strategy in processing the application usage events generated by AppLocker. - A strategy to maintain and manage AppLocker polices after deployment. + ### Sample template for an AppLocker planning document + You can use the following form to construct your own AppLocker planning document. + **Business group**: + **Operating system environment**: (Windows and non-Windows) + @@ -69,6 +85,7 @@ You can use the following form to construct your own AppLocker planning document
        **Rules** + @@ -110,6 +127,7 @@ You can use the following form to construct your own AppLocker planning document
        **Event processing** + @@ -139,6 +157,7 @@ You can use the following form to construct your own AppLocker planning document
        **Policy maintenance** + @@ -169,7 +188,9 @@ You can use the following form to construct your own AppLocker planning document
        ### Example of an AppLocker planning document + **Rules** + @@ -268,6 +289,7 @@ You can use the following form to construct your own AppLocker planning document
        **Event processing** + @@ -304,6 +326,7 @@ You can use the following form to construct your own AppLocker planning document
        **Policy maintenance** + @@ -348,6 +371,7 @@ You can use the following form to construct your own AppLocker planning document
        ### Additional resources + - The AppLocker Policies Design Guide is the predecessor to the AppLocker Policies Deployment Guide. When planning is complete, see the [AppLocker policies deployment guide](applocker-policies-deployment-guide.md). - For more general info, see [AppLocker](applocker-overview.md).   diff --git a/windows/keep-secure/create-your-applocker-policies.md b/windows/keep-secure/create-your-applocker-policies.md index cc275dc563..b7a23cc02d 100644 --- a/windows/keep-secure/create-your-applocker-policies.md +++ b/windows/keep-secure/create-your-applocker-policies.md @@ -2,19 +2,26 @@ title: Create Your AppLocker policies (Windows 10) description: This overview topic for the IT professional describes the steps to create an AppLocker policy and prepare it for deployment. ms.assetid: d339dee2-4da2-4d4a-b46e-f1dfb7cb4bf0 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Create Your AppLocker policies + **Applies to** - Windows 10 + This overview topic for the IT professional describes the steps to create an AppLocker policy and prepare it for deployment. + Creating effective application control policies with AppLocker starts by creating the rules for each app. Rules are grouped into one of five rule collections. The rule collection can be configured to be enforced or to run in **Audit only** mode. An AppLocker policy includes the rules in the five rule collections and the enforcement settings for each rule collection. + ## Step 1: Use your plan + You can develop an application control policy plan to guide you in making successful deployment decisions. For more info about how to do this and what you should consider, see the [AppLocker Design Guide](applocker-policies-design-guide.md). This guide is intended for security architects, security administrators, and system administrators. It contains the following topics to help you create an AppLocker policy deployment plan for your organization that will address your specific application control requirements by department, organizational unit, or business group: + 1. [Understand the AppLocker policy deployment process](understand-the-applocker-policy-deployment-process.md) 2. [Understand AppLocker policy design decisions](understand-applocker-policy-design-decisions.md) 3. [Determine your application control objectives](determine-your-application-control-objectives.md) @@ -23,24 +30,40 @@ You can develop an application control policy plan to guide you in making succes 6. [Determine the Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md) 7. [Plan for AppLocker policy management](plan-for-applocker-policy-management.md) 8. [Create your AppLocker planning document](create-your-applocker-planning-document.md) + ## Step 2: Create your rules and rule collections + Each rule applies to one or more apps, and it imposes a specific rule condition on them. Rules can be created individually or they can be generated by the Automatically Generate Rules Wizard. For the steps to create the rules, see [Create Your AppLocker rules](create-your-applocker-rules.md). + ## Step 3: Configure the enforcement setting -An AppLocker policy is a set of rule collections that are configured with a rule enforcement setting. The enforcement setting can be **Enforce rules**, **Audit only**, or **Not configured**. If an AppLocker policy has at least one rule, and it is set to **Not configured**, all the rules in that policy will be enforced. For info about configuring the rule enforcement setting, see [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md) and [Configure an AppLocker policy for enforce rules](configure-an-applocker-policy-for-enforce-rules.md). + +An AppLocker policy is a set of rule collections that are configured with a rule enforcement setting. The enforcement setting can be **Enforce rules**, **Audit only**, or **Not configured**. If an AppLocker policy has at least one rule, and it is set to **Not configured**, all the rules in that +policy will be enforced. For info about configuring the rule enforcement setting, see [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md) and [Configure an AppLocker policy for enforce rules](configure-an-applocker-policy-for-enforce-rules.md). + ## Step 4: Update the GPO + AppLocker policies can be defined locally on a device or applied through Group Policy. To use Group Policy to apply AppLocker policies, you must create a new Group Policy Object (GPO) or you must update an existing GPO. You can create or modify AppLocker policies by using the Group Policy Management Console (GPMC), or you can import an AppLocker policy into a GPO. For the procedure to do this, see [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md). + ## Step 5: Test the effect of the policy + In a test environment or with the enforcement setting set at **Audit only**, verify that the results of the policy are what you intended. For info about testing a policy, see [Test and update an AppLocker policy](test-and-update-an-applocker-policy.md). + ## Step 6: Implement the policy + Depending on your deployment method, import the AppLocker policy to the GPO in your production environment, or if the policy is already deployed, change the enforcement setting to your production environment value—**Enforce rules** or **Audit only**. + ## Step 7: Test the effect of the policy and adjust Validate the effect of the policy by analyzing the AppLocker logs for application usage, and then modify the policy as necessary. To do this, see [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md). + ## Next steps + Follow the steps described in the following topics to continue the deployment process: + 1. [Create Your AppLocker rules](create-your-applocker-rules.md) 2. [Test and update an AppLocker policy](test-and-update-an-applocker-policy.md) 3. [Deploy the AppLocker policy into production](deploy-the-applocker-policy-into-production.md) + ## See also -[AppLocker deployment guide](applocker-policies-deployment-guide.md) -  -  + +- [AppLocker deployment guide](applocker-policies-deployment-guide.md) + diff --git a/windows/keep-secure/create-your-applocker-rules.md b/windows/keep-secure/create-your-applocker-rules.md index 15de4246f0..ee0590e89b 100644 --- a/windows/keep-secure/create-your-applocker-rules.md +++ b/windows/keep-secure/create-your-applocker-rules.md @@ -2,54 +2,73 @@ title: Create Your AppLocker rules (Windows 10) description: This topic for the IT professional describes what you need to know about AppLocker rules and the methods that you can to create rules. ms.assetid: b684a3a5-929c-4f70-8742-04088022f232 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Create Your AppLocker rules + **Applies to** - Windows 10 + This topic for the IT professional describes what you need to know about AppLocker rules and the methods that you can to create rules. + ## Creating AppLocker rules + AppLocker rules apply to the targeted app, and they are the components that make up the AppLocker policy. Depending on your IT environment and the business group that requires application control policies, setting these access rules for each application can be time-consuming and prone to error. With AppLocker, you can generate rules automatically or create rules individually. Creating rules that are derived from your planning document can help you avoid unintended results. For info about this planning document and other planning activities, see [AppLocker Design Guide](applocker-policies-design-guide.md). + ### Automatically generate your rules + You can use a reference device to automatically create a set of default rules for each of the installed apps, test and modify each rule as necessary, and deploy the policies. Creating most of the rules for all the installed apps gives you a starting point to build and test your policies. For info about performing this task, see the following topics: + - [Configure the AppLocker reference device](configure-the-appLocker-reference-device.md) - [Run the Automatically Generate Rules wizard](run-the-automatically-generate-rules-wizard.md) - [Create AppLocker default rules](create-applocker-default-rules.md) - [Edit AppLocker rules](edit-applocker-rules.md) - [Add exceptions for an AppLocker rule](configure-exceptions-for-an-applocker-rule.md) + ### Create your rules individually + You can create rules and set the mode to **Audit only** for each installed app, test and update each rule as necessary, and then deploy the policies. Creating rules individually might be best when you are targeting a small number of applications within a business group. -**Note**   -AppLocker includes default rules for each rule collection. These rules are intended to help ensure that the files that are required for Windows to operate properly are allowed in an AppLocker rule collection. You can also edit the default rules. For information about creating the default rules for the Windows operating system, see [Create AppLocker default rules](create-applocker-default-rules.md). + +>**Note:**  AppLocker includes default rules for each rule collection. These rules are intended to help ensure that the files that are required for Windows to operate properly are allowed in an AppLocker rule collection. You can also edit the default rules. For information about creating the default rules for the Windows operating system, see [Create AppLocker default rules](create-applocker-default-rules.md).   For information about performing this task, see: + 1. [Create a rule that uses a publisher condition](create-a-rule-that-uses-a-publisher-condition.md) 2. [Create a rule that uses a path condition](create-a-rule-that-uses-a-path-condition.md) 3. [Create a rule that uses a file hash condition](create-a-rule-that-uses-a-file-hash-condition.md) 4. [Edit AppLocker rules](edit-applocker-rules.md) 5. [Enforce AppLocker rules](enforce-applocker-rules.md) 6. [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md) + ## About selecting rules + AppLocker policies are composed of distinct rules for specific apps. These rules are grouped by collection, and they are implemented through an AppLocker policy definition. AppLocker policies are managed by using Group Policy or by using the Local Security Policy snap-in for a single computer. + When you determine what types of rules to create for each of your business groups or organizational units (OUs), you should also determine what enforcement setting to use for each group. Certain rule types are more applicable for some apps, depending on how the apps are deployed in a specific business group. + For info about how to determine and document your AppLocker rules, see [AppLocker Design Guide](applocker-policies-design-guide.md). + For info about AppLocker rules and AppLocker policies, see the following topics: + - [Understanding AppLocker rule behavior](understanding-applocker-rule-behavior.md) - [Understanding AppLocker rule exceptions](understanding-applocker-rule-exceptions.md) - [Understanding AppLocker rule collections](understanding-applocker-rule-collections.md) - [Understanding AppLocker allow and deny actions on rules](understanding-applocker-allow-and-deny-actions-on-rules.md) - [Understanding AppLocker rule condition types](understanding-applocker-rule-condition-types.md) - [Understanding AppLocker default rules](understanding-applocker-default-rules.md) + ## Next steps + 1. [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md) 2. [Import an AppLocker policy from another computer](import-an-applocker-policy-from-another-computer.md) 3. [Test and update an AppLocker policy](test-and-update-an-applocker-policy.md) 4. [Deploy the AppLocker policy into production](deploy-the-applocker-policy-into-production.md) + ## Related topics -[Create Your AppLocker policies](create-your-applocker-policies.md) -  -  + +- [Create Your AppLocker policies](create-your-applocker-policies.md) From f4b91664a6f453c5d49bb1748fbd3291e5bc22f3 Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Mon, 23 May 2016 11:59:47 -0700 Subject: [PATCH 375/439] fix tagging make W10 lower case (w10) and add pagetype where missing --- windows/whats-new/applocker.md | 2 +- windows/whats-new/credential-guard.md | 2 +- windows/whats-new/device-guard-overview.md | 2 +- windows/whats-new/device-management.md | 3 ++- windows/whats-new/edge-ie11-whats-new-overview.md | 2 +- windows/whats-new/edp-whats-new-overview.md | 2 +- windows/whats-new/index.md | 2 +- windows/whats-new/lockdown-features-windows-10.md | 2 +- windows/whats-new/microsoft-passport.md | 2 +- windows/whats-new/new-provisioning-packages.md | 2 +- windows/whats-new/security-auditing.md | 2 +- windows/whats-new/security.md | 2 +- windows/whats-new/trusted-platform-module.md | 2 +- windows/whats-new/user-account-control.md | 2 +- windows/whats-new/windows-spotlight.md | 2 +- windows/whats-new/windows-store-for-business-overview.md | 3 ++- windows/whats-new/windows-update-for-business.md | 2 +- 17 files changed, 19 insertions(+), 17 deletions(-) diff --git a/windows/whats-new/applocker.md b/windows/whats-new/applocker.md index cd25de1dee..355d16bacc 100644 --- a/windows/whats-new/applocker.md +++ b/windows/whats-new/applocker.md @@ -3,7 +3,7 @@ title: What's new in AppLocker (Windows 10) description: AppLocker helps you control which apps and files users can run. These include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers. ms.assetid: 6F836FF6-7794-4E7B-89AA-1EABA1BF183F ms.pagetype: security -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library author: brianlic-msft diff --git a/windows/whats-new/credential-guard.md b/windows/whats-new/credential-guard.md index 148a76ff4e..5bd63a42af 100644 --- a/windows/whats-new/credential-guard.md +++ b/windows/whats-new/credential-guard.md @@ -3,7 +3,7 @@ title: What's new in Credential Guard (Windows 10) description: Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. ms.assetid: 59C206F7-2832-4555-97B4-3070D93CC3C5 ms.pagetype: security -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library author: brianlic-msft diff --git a/windows/whats-new/device-guard-overview.md b/windows/whats-new/device-guard-overview.md index bdb9a878db..669cdadb48 100644 --- a/windows/whats-new/device-guard-overview.md +++ b/windows/whats-new/device-guard-overview.md @@ -4,7 +4,7 @@ description: Device Guard is a combination of enterprise-related hardware and so ms.assetid: FFE244EE-5804-4CE8-A2A9-48F49DC3AEF2 ms.pagetype: security keywords: Device Guard -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library author: brianlic-msft diff --git a/windows/whats-new/device-management.md b/windows/whats-new/device-management.md index acf0982f94..4ea023327b 100644 --- a/windows/whats-new/device-management.md +++ b/windows/whats-new/device-management.md @@ -2,7 +2,8 @@ title: Enterprise management for Windows 10 devices (Windows 10) description: Windows 10 provides mobile device management (MDM) capabilities that enable enterprise-level management of devices. ms.assetid: 36DA67A1-25F1-45AD-A36B-AEEAC30C9BC4 -ms.prod: W10 +ms.prod: w10 +ms.pagetype: devices, mobile ms.mktglfcycl: explore ms.sitesec: library author: jdeckerMS diff --git a/windows/whats-new/edge-ie11-whats-new-overview.md b/windows/whats-new/edge-ie11-whats-new-overview.md index 7a70709259..ab7d69d78f 100644 --- a/windows/whats-new/edge-ie11-whats-new-overview.md +++ b/windows/whats-new/edge-ie11-whats-new-overview.md @@ -2,7 +2,7 @@ title: Browser Microsoft Edge and Internet Explorer 11 (Windows 10) description: Resources to help you explore the Windows 10 browsing options for your enterprise. ms.assetid: e986f903-69ad-4145-9d24-0c6d04b3e489 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library author: eross-msft diff --git a/windows/whats-new/edp-whats-new-overview.md b/windows/whats-new/edp-whats-new-overview.md index 26e5b09d9b..696556b54d 100644 --- a/windows/whats-new/edp-whats-new-overview.md +++ b/windows/whats-new/edp-whats-new-overview.md @@ -3,7 +3,7 @@ title: Enterprise data protection (EDP) overview (Windows 10) description: With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data disclosure through apps and services that are outside of the enterprise’s control like email, social media, and the public cloud. ms.assetid: 428A3135-CB5E-478B-B1FF-B6EB76F0DF14 keywords: EDP Overview, EDP -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/whats-new/index.md b/windows/whats-new/index.md index 28468ba5d2..91bd262819 100644 --- a/windows/whats-new/index.md +++ b/windows/whats-new/index.md @@ -3,7 +3,7 @@ title: What's new in Windows 10 (Windows 10) description: Learn about new features in Windows 10 for IT professionals, such as Enterprise Data Protection, Microsoft Passport, Device Guard, and more. ms.assetid: F1867017-76A1-4761-A200-7450B96AEF44 keywords: ["What's new in Windows 10", "Windows 10"] -ms.prod: W10 +ms.prod: w10 author: TrudyHa --- diff --git a/windows/whats-new/lockdown-features-windows-10.md b/windows/whats-new/lockdown-features-windows-10.md index 265ddba22a..7df7446f4e 100644 --- a/windows/whats-new/lockdown-features-windows-10.md +++ b/windows/whats-new/lockdown-features-windows-10.md @@ -3,7 +3,7 @@ title: Lockdown features from Windows Embedded 8.1 Industry (Windows 10) description: Many of the lockdown features available in Windows Embedded 8.1 Industry have been modified in some form for Windows 10. ms.assetid: 3C006B00-535C-4BA4-9421-B8F952D47A14 keywords: lockdown, embedded -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/whats-new/microsoft-passport.md b/windows/whats-new/microsoft-passport.md index 6ee13afe28..2c49406384 100644 --- a/windows/whats-new/microsoft-passport.md +++ b/windows/whats-new/microsoft-passport.md @@ -3,7 +3,7 @@ title: Microsoft Passport overview (Windows 10) description: In Windows 10, Microsoft Passport replaces passwords with strong two-factor authentication. ms.assetid: 292F3BE9-3651-4B20-B83F-85560631EF5B keywords: password, hello, fingerprint, iris, biometric -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/whats-new/new-provisioning-packages.md b/windows/whats-new/new-provisioning-packages.md index b389c0b3c6..9a0d03ddeb 100644 --- a/windows/whats-new/new-provisioning-packages.md +++ b/windows/whats-new/new-provisioning-packages.md @@ -2,7 +2,7 @@ title: Provisioning packages (Windows 10) description: With Windows 10, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. ms.assetid: 287706E5-063F-4AB5-902C-A0DF6D0730BC -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library author: jdeckerMS diff --git a/windows/whats-new/security-auditing.md b/windows/whats-new/security-auditing.md index 92e3548a8c..26276b5e0a 100644 --- a/windows/whats-new/security-auditing.md +++ b/windows/whats-new/security-auditing.md @@ -2,7 +2,7 @@ title: What's new in security auditing (Windows 10) description: Security auditing is one of the most powerful tools that you can use to maintain the integrity of your system. ms.assetid: CB35A02E-5C66-449D-8C90-7B73C636F67B -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library author: brianlic-msft diff --git a/windows/whats-new/security.md b/windows/whats-new/security.md index d8784f6c41..ae44b5893e 100644 --- a/windows/whats-new/security.md +++ b/windows/whats-new/security.md @@ -3,7 +3,7 @@ title: What's new in Windows 10 security (Windows 10) description: There are several key client security improvements Microsoft has made in Windows 10. ms.assetid: 6B8A5F7A-ABD3-416C-87B0-85F68B214C81 keywords: secure, data loss prevention, multifactor authentication -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/whats-new/trusted-platform-module.md b/windows/whats-new/trusted-platform-module.md index 34233ef3a4..bbf7d88d6b 100644 --- a/windows/whats-new/trusted-platform-module.md +++ b/windows/whats-new/trusted-platform-module.md @@ -2,7 +2,7 @@ title: What's new in Trusted Platform Module (Windows 10) description: This topic for the IT professional describes new features for the Trusted Platform Module (TPM) in Windows 10. ms.assetid: CE8BBC2A-EE2D-4DFA-958E-2A178F2E6C44 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/whats-new/user-account-control.md b/windows/whats-new/user-account-control.md index 0b655fc120..fad8ee0ff5 100644 --- a/windows/whats-new/user-account-control.md +++ b/windows/whats-new/user-account-control.md @@ -2,7 +2,7 @@ title: What's new in User Account Control (Windows 10) description: User Account Control (UAC) helps prevent malware from damaging a computer and helps organizations deploy a better-managed desktop environment. ms.assetid: 9281870C-0819-4694-B4F1-260255BB8D07 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/whats-new/windows-spotlight.md b/windows/whats-new/windows-spotlight.md index 1c0d39092e..d4fb43b2ec 100644 --- a/windows/whats-new/windows-spotlight.md +++ b/windows/whats-new/windows-spotlight.md @@ -3,7 +3,7 @@ title: Windows spotlight on the lock screen (Windows 10) description: Windows spotlight is an option for the lock screen background that displays different background images on the lock screen. ms.assetid: 1AEA51FA-A647-4665-AD78-2F3FB27AD46A keywords: ["lockscreen"] -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library author: jdeckerMS diff --git a/windows/whats-new/windows-store-for-business-overview.md b/windows/whats-new/windows-store-for-business-overview.md index f2eea69ec7..ca022e0b5d 100644 --- a/windows/whats-new/windows-store-for-business-overview.md +++ b/windows/whats-new/windows-store-for-business-overview.md @@ -2,7 +2,8 @@ title: Windows Store for Business overview (Windows 10) description: With the new Windows Store for Business, organizations can make volume purchases of Windows apps. ms.assetid: 9DA71F6B-654D-4121-9A40-D473CC654A1C -ms.prod: W10 +ms.prod: w10 +ms.pagetype: store ms.mktglfcycl: manage ms.sitesec: library author: TrudyHa diff --git a/windows/whats-new/windows-update-for-business.md b/windows/whats-new/windows-update-for-business.md index 0d2dfd165d..24ae371549 100644 --- a/windows/whats-new/windows-update-for-business.md +++ b/windows/whats-new/windows-update-for-business.md @@ -2,7 +2,7 @@ title: What's new in Windows Update for Business (Windows 10) description: Windows Update for Business enables information technology administrators to keep the Windows 10-based devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Microsoft’s Windows Update service. ms.assetid: 9271FC9A-6AF1-4BBD-A272-909BF54363F4 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library author: TrudyHa From fe4719a90d801f8b3357437dfbbee730b15d00dd Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Mon, 23 May 2016 12:01:55 -0700 Subject: [PATCH 376/439] fix tagging --- windows/whats-new/bitlocker.md | 2 +- .../whats-new/change-history-for-what-s-new-in-windows-10.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/whats-new/bitlocker.md b/windows/whats-new/bitlocker.md index d0b31ecfc5..99353d9d7b 100644 --- a/windows/whats-new/bitlocker.md +++ b/windows/whats-new/bitlocker.md @@ -2,7 +2,7 @@ title: What's new in BitLocker (Windows 10) description: BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned computers. ms.assetid: 3F2DE365-68A1-4CDB-AB5F-C65574684C7B -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/whats-new/change-history-for-what-s-new-in-windows-10.md b/windows/whats-new/change-history-for-what-s-new-in-windows-10.md index 077f30c7a7..14362dd08c 100644 --- a/windows/whats-new/change-history-for-what-s-new-in-windows-10.md +++ b/windows/whats-new/change-history-for-what-s-new-in-windows-10.md @@ -2,7 +2,7 @@ title: Change history for What's new in Windows 10 (Windows 10) description: This topic lists new and updated topics in the What's new in Windows 10 documentation for Windows 10 and Windows 10 Mobile. ms.assetid: 75F285B0-09BE-4821-9B42-37B9BE54CEC6 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: TrudyHa From ae8220499efdd2bafe460fcae530d62dc13a2634 Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Mon, 23 May 2016 13:11:20 -0700 Subject: [PATCH 377/439] update tagging change W10 to lower case (w10) change Operate to Plan add appcompat tag --- windows/plan/act-community-ratings-and-process.md | 5 +++-- windows/plan/act-database-configuration.md | 5 +++-- windows/plan/act-database-migration.md | 5 +++-- windows/plan/act-deployment-options.md | 5 +++-- windows/plan/act-glossary.md | 5 +++-- windows/plan/act-lps-share-permissions.md | 5 +++-- windows/plan/act-operatingsystem-application-report.md | 5 +++-- windows/plan/act-operatingsystem-computer-report.md | 5 +++-- windows/plan/act-operatingsystem-device-report.md | 5 +++-- windows/plan/act-product-and-documentation-resources.md | 5 +++-- windows/plan/act-settings-dialog-box-preferences-tab.md | 5 +++-- windows/plan/act-settings-dialog-box-settings-tab.md | 5 +++-- windows/plan/act-technical-reference.md | 5 +++-- windows/plan/act-toolbar-icons-in-acm.md | 5 +++-- windows/plan/act-tools-packages-and-services.md | 5 +++-- windows/plan/act-user-interface-reference.md | 5 +++-- windows/plan/activating-and-closing-windows-in-acm.md | 5 +++-- windows/plan/adding-or-editing-a-solution.md | 5 +++-- windows/plan/adding-or-editing-an-issue.md | 5 +++-- windows/plan/analyzing-your-compatibility-data.md | 5 +++-- windows/plan/application-dialog-box.md | 5 +++-- windows/plan/applying-filters-to-data-in-the-sua-tool.md | 5 +++-- ...a-types-and-operators-in-compatibility-administrator.md | 5 +++-- .../best-practice-recommendations-for-windows-to-go.md | 5 +++-- windows/plan/categorizing-your-compatibility-data.md | 5 +++-- .../change-history-for-plan-for-windows-10-deployment.md | 4 ++-- windows/plan/chromebook-migration-guide.md | 2 +- windows/plan/common-compatibility-issues.md | 5 +++-- windows/plan/compatibility-administrator-users-guide.md | 5 +++-- ...ty-fix-database-management-strategies-and-deployment.md | 5 +++-- ...lity-fixes-for-windows-8-windows-7-and-windows-vista.md | 5 +++-- windows/plan/compatibility-monitor-users-guide.md | 5 +++-- windows/plan/computer-dialog-box.md | 5 +++-- windows/plan/configuring-act.md | 5 +++-- ...tom-compatibility-fix-in-compatibility-administrator.md | 5 +++-- ...om-compatibility-mode-in-compatibility-administrator.md | 5 +++-- windows/plan/creating-a-runtime-analysis-package.md | 5 +++-- ...ng-an-apphelp-message-in-compatibility-administrator.md | 5 +++-- ...-an-enterprise-environment-for-compatibility-testing.md | 5 +++-- windows/plan/creating-an-inventory-collector-package.md | 5 +++-- windows/plan/creating-and-editing-issues-and-solutions.md | 5 +++-- windows/plan/customizing-your-report-views.md | 5 +++-- ...ta-sent-through-the-microsoft-compatibility-exchange.md | 5 +++-- ...whether-to-fix-an-application-or-deploy-a-workaround.md | 5 +++-- windows/plan/deciding-which-applications-to-test.md | 5 +++-- windows/plan/deleting-a-data-collection-package.md | 5 +++-- windows/plan/deploying-a-runtime-analysis-package.md | 5 +++-- windows/plan/deploying-an-inventory-collector-package.md | 4 ++-- .../plan/deployment-considerations-for-windows-to-go.md | 5 +++-- windows/plan/device-dialog-box.md | 5 +++-- ...g-compatibility-fixes-in-compatibility-administrator.md | 5 +++-- windows/plan/example-filter-queries.md | 5 +++-- windows/plan/exporting-a-data-collection-package.md | 5 +++-- windows/plan/filtering-your-compatibility-data.md | 5 +++-- windows/plan/fixing-applications-by-using-the-sua-tool.md | 5 +++-- windows/plan/fixing-compatibility-issues.md | 5 +++-- .../plan/identifying-computers-for-inventory-collection.md | 4 ++-- windows/plan/index.md | 4 ++-- ...mpatibility-databases-in-compatibility-administrator.md | 5 +++-- windows/plan/integration-with-management-solutions-.md | 2 +- windows/plan/internet-explorer-web-site-report.md | 5 +++-- windows/plan/labeling-data-in-acm.md | 5 +++-- .../log-file-locations-for-data-collection-packages.md | 5 +++-- ...ication-compatibility-fixes-and-custom-fix-databases.md | 5 +++-- windows/plan/managing-your-data-collection-packages.md | 5 +++-- windows/plan/organizational-tasks-for-each-report-type.md | 5 +++-- windows/plan/organizing-your-compatibility-data.md | 5 +++-- .../plan/prepare-your-organization-for-windows-to-go.md | 5 +++-- windows/plan/prioritizing-your-compatibility-data.md | 5 +++-- windows/plan/ratings-icons-in-acm.md | 5 +++-- windows/plan/resolving-an-issue.md | 5 +++-- windows/plan/saving-opening-and-exporting-reports.md | 5 +++-- ...or-fixed-applications-in-compatibility-administrator.md | 5 +++-- ...s-with-the-query-tool-in-compatibility-administrator.md | 5 +++-- ...and-data-protection-considerations-for-windows-to-go.md | 7 ++++--- ...cting-the-send-and-receive-status-for-an-application.md | 5 +++-- windows/plan/selecting-your-compatibility-rating.md | 5 +++-- windows/plan/selecting-your-deployment-status.md | 5 +++-- windows/plan/sending-and-receiving-compatibility-data.md | 5 +++-- windows/plan/settings-for-acm.md | 5 +++-- windows/plan/setup-and-deployment.md | 2 +- windows/plan/showing-messages-generated-by-the-sua-tool.md | 5 +++-- windows/plan/software-requirements-for-act.md | 5 +++-- windows/plan/software-requirements-for-rap.md | 5 +++-- windows/plan/sua-users-guide.md | 5 +++-- windows/plan/tabs-on-the-sua-tool-interface.md | 5 +++-- windows/plan/taking-inventory-of-your-organization.md | 5 +++-- .../plan/testing-compatibility-on-the-target-platform.md | 5 +++-- .../plan/testing-your-application-mitigation-packages.md | 5 +++-- windows/plan/troubleshooting-act-database-issues.md | 5 +++-- windows/plan/troubleshooting-act.md | 5 +++-- .../plan/troubleshooting-the-act-configuration-wizard.md | 5 +++-- .../plan/troubleshooting-the-act-log-processing-service.md | 5 +++-- .../plan/understanding-and-using-compatibility-fixes.md | 5 +++-- windows/plan/using-act.md | 5 +++-- .../plan/using-compatibility-monitor-to-send-feedback.md | 5 +++-- windows/plan/using-the-compatibility-administrator-tool.md | 5 +++-- windows/plan/using-the-sdbinstexe-command-line-tool.md | 5 +++-- windows/plan/using-the-sua-tool.md | 5 +++-- windows/plan/using-the-sua-wizard.md | 5 +++-- ...ing-the-events-screen-in-compatibility-administrator.md | 5 +++-- windows/plan/viewing-your-compatibility-reports.md | 5 +++-- windows/plan/websiteurl-dialog-box.md | 5 +++-- windows/plan/welcome-to-act.md | 5 +++-- windows/plan/whats-new-in-act-60.md | 5 +++-- windows/plan/windows-10-compatibility.md | 5 +++-- windows/plan/windows-10-deployment-considerations.md | 4 ++-- .../plan/windows-10-guidance-for-education-environments.md | 4 ++-- windows/plan/windows-10-infrastructure-requirements.md | 4 ++-- windows/plan/windows-10-servicing-options.md | 5 +++-- windows/plan/windows-to-go-frequently-asked-questions.md | 5 +++-- windows/plan/windows-to-go-overview.md | 3 ++- windows/plan/windows-update-for-business.md | 2 +- 113 files changed, 324 insertions(+), 222 deletions(-) diff --git a/windows/plan/act-community-ratings-and-process.md b/windows/plan/act-community-ratings-and-process.md index 90c94ca481..6d28ac6493 100644 --- a/windows/plan/act-community-ratings-and-process.md +++ b/windows/plan/act-community-ratings-and-process.md @@ -2,9 +2,10 @@ title: ACT Community Ratings and Process (Windows 10) description: The Application Compatibility Toolkit (ACT) Community uses the Microsoft® Compatibility Exchange to share compatibility ratings between all registered ACT Community members. ms.assetid: be6c8c71-785b-4adf-a375-64ca7d24e26c -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan ms.sitesec: library +ms.pagetype: appcompat author: TrudyHa --- diff --git a/windows/plan/act-database-configuration.md b/windows/plan/act-database-configuration.md index 528cd9a8e2..dc8103e03e 100644 --- a/windows/plan/act-database-configuration.md +++ b/windows/plan/act-database-configuration.md @@ -2,8 +2,9 @@ title: ACT Database Configuration (Windows 10) description: The Application Compatibility Toolkit (ACT) uses a Microsoft® SQL Server® database for storing and sharing compatibility issue data. ms.assetid: 032bbfe0-86fa-48ff-b638-b9d6a908c45e -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/act-database-migration.md b/windows/plan/act-database-migration.md index 38d1886347..4b4009c05e 100644 --- a/windows/plan/act-database-migration.md +++ b/windows/plan/act-database-migration.md @@ -2,8 +2,9 @@ title: ACT Database Migration (Windows 10) description: The schema for an ACT database can change when ACT is updated or when a new version of ACT is released. ms.assetid: b13369b4-1fb7-4889-b0b8-6d0ab61aac3d -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/act-deployment-options.md b/windows/plan/act-deployment-options.md index bf817c11b1..32bb1e10f0 100644 --- a/windows/plan/act-deployment-options.md +++ b/windows/plan/act-deployment-options.md @@ -2,8 +2,9 @@ title: ACT Deployment Options (Windows 10) description: While planning your deployment of the Application Compatibility Toolkit (ACT), consider which computers you want running the various tools, packages, and services for ACT. ms.assetid: 90d56dd8-8d57-44e8-bf7a-29aabede45ba -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/act-glossary.md b/windows/plan/act-glossary.md index ed5fb09904..87b42aab6e 100644 --- a/windows/plan/act-glossary.md +++ b/windows/plan/act-glossary.md @@ -2,8 +2,9 @@ title: ACT Glossary (Windows 10) description: The following table lists terms and definitions used by the Application Compatibility Toolkit (ACT). ms.assetid: 984d1cce-c1ac-4aa8-839a-a23e15da6f32 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/act-lps-share-permissions.md b/windows/plan/act-lps-share-permissions.md index f9299c2fed..f2496dc915 100644 --- a/windows/plan/act-lps-share-permissions.md +++ b/windows/plan/act-lps-share-permissions.md @@ -2,8 +2,9 @@ title: ACT LPS Share Permissions (Windows 10) description: To upload log files to the ACT Log Processing Service (LPS) share, certain permissions must be set at the share level and folder level. ms.assetid: 51f6ddf7-f424-4abe-a0e0-71fe616f9e84 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/act-operatingsystem-application-report.md b/windows/plan/act-operatingsystem-application-report.md index ef3cee87c4..3c0f49d348 100644 --- a/windows/plan/act-operatingsystem-application-report.md +++ b/windows/plan/act-operatingsystem-application-report.md @@ -2,8 +2,9 @@ title: OperatingSystem - Application Report (Windows 10) description: This section describes the compatibility reports in Application Compatibility Manager (ACM) and how you can work with the reports. ms.assetid: 9721485b-6092-4974-8cfe-c84472237a57 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/act-operatingsystem-computer-report.md b/windows/plan/act-operatingsystem-computer-report.md index 4a49ff56db..3547b28c17 100644 --- a/windows/plan/act-operatingsystem-computer-report.md +++ b/windows/plan/act-operatingsystem-computer-report.md @@ -2,8 +2,9 @@ title: OperatingSystem - Computer Report (Windows 10) ms.assetid: ed0a56fc-9f2a-4df0-8cef-3a09d6616de8 description: -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/act-operatingsystem-device-report.md b/windows/plan/act-operatingsystem-device-report.md index e4be3521b9..67e74536c6 100644 --- a/windows/plan/act-operatingsystem-device-report.md +++ b/windows/plan/act-operatingsystem-device-report.md @@ -2,8 +2,9 @@ title: OperatingSystem - Device Report (Windows 10) ms.assetid: 8b5a936f-a92e-46a7-ac44-6edace262355 description: -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/act-product-and-documentation-resources.md b/windows/plan/act-product-and-documentation-resources.md index 54cb4635de..02677af71d 100644 --- a/windows/plan/act-product-and-documentation-resources.md +++ b/windows/plan/act-product-and-documentation-resources.md @@ -2,8 +2,9 @@ title: ACT Product and Documentation Resources (Windows 10) description: The following sections provide links to resources and reference material for the Application Compatibility Toolkit (ACT). ms.assetid: c7954b5a-164d-4548-af58-cd3a1de5cc43 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/act-settings-dialog-box-preferences-tab.md b/windows/plan/act-settings-dialog-box-preferences-tab.md index bfaea35f75..6af88e476e 100644 --- a/windows/plan/act-settings-dialog-box-preferences-tab.md +++ b/windows/plan/act-settings-dialog-box-preferences-tab.md @@ -2,8 +2,9 @@ title: Settings Dialog Box - Preferences Tab (Windows 10) description: To display the Settings dialog box, in Application Compatibility Manager (ACM), on the Tools menu, click Settings. ms.assetid: deae2100-4110-4d72-b5ee-7c167f80bfa4 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/act-settings-dialog-box-settings-tab.md b/windows/plan/act-settings-dialog-box-settings-tab.md index 411450f21f..0f1b179b3c 100644 --- a/windows/plan/act-settings-dialog-box-settings-tab.md +++ b/windows/plan/act-settings-dialog-box-settings-tab.md @@ -2,8 +2,9 @@ title: Settings Dialog Box - Settings Tab (Windows 10) description: To display the Settings dialog box, in Application Compatibility Manager (ACM), on the Tools menu, click Settings. ms.assetid: aeec1647-cf91-4f8b-9f6d-dbf4b898d901 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/act-technical-reference.md b/windows/plan/act-technical-reference.md index 6544f9dc8e..c05f03fc92 100644 --- a/windows/plan/act-technical-reference.md +++ b/windows/plan/act-technical-reference.md @@ -2,8 +2,9 @@ title: Application Compatibility Toolkit (ACT) Technical Reference (Windows 10) description: The Microsoft® Application Compatibility Toolkit (ACT) helps you determine whether the applications, devices, and computers in your organization are compatible with versions of the Windows® operating system. ms.assetid: d90d38b2-2718-4481-90eb-4480719627ba -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/act-toolbar-icons-in-acm.md b/windows/plan/act-toolbar-icons-in-acm.md index 1620557d16..9a0d2b3e79 100644 --- a/windows/plan/act-toolbar-icons-in-acm.md +++ b/windows/plan/act-toolbar-icons-in-acm.md @@ -2,8 +2,9 @@ title: Toolbar Icons in ACM (Windows 10) description: The following table shows icons that appear on toolbars and navigational elements in Application Compatibility Manager (ACM). ms.assetid: 44872da1-c7ad-41b9-8323-d3c3f49b2706 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/act-tools-packages-and-services.md b/windows/plan/act-tools-packages-and-services.md index 5d3ef9ba47..bf9c2bf728 100644 --- a/windows/plan/act-tools-packages-and-services.md +++ b/windows/plan/act-tools-packages-and-services.md @@ -2,8 +2,9 @@ title: ACT Tools, Packages, and Services (Windows 10) description: The Application Compatibility Toolkit is included with the Windows ADK. Download the Windows ADK. ms.assetid: f5a16548-7d7b-4be9-835e-c06158dd0b89 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/act-user-interface-reference.md b/windows/plan/act-user-interface-reference.md index 80687eea7c..ff28470715 100644 --- a/windows/plan/act-user-interface-reference.md +++ b/windows/plan/act-user-interface-reference.md @@ -2,8 +2,9 @@ title: ACT User Interface Reference (Windows 10) description: This section contains information about the user interface for Application Compatibility Manager (ACM), which is a tool in the Application Compatibility Toolkit (ACT). ms.assetid: 303d3dd7-2cc1-4f5f-b032-b7e288b04893 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/activating-and-closing-windows-in-acm.md b/windows/plan/activating-and-closing-windows-in-acm.md index 3e7eaaef87..dfa085659e 100644 --- a/windows/plan/activating-and-closing-windows-in-acm.md +++ b/windows/plan/activating-and-closing-windows-in-acm.md @@ -2,8 +2,9 @@ title: Activating and Closing Windows in ACM (Windows 10) description: The Windows dialog box shows the windows that are open in Application Compatibility Manager (ACM). ms.assetid: 747bf356-d861-4ce7-933e-fa4ecfac7be5 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/adding-or-editing-a-solution.md b/windows/plan/adding-or-editing-a-solution.md index a3ebf8c8ff..f16e5237b2 100644 --- a/windows/plan/adding-or-editing-a-solution.md +++ b/windows/plan/adding-or-editing-a-solution.md @@ -2,8 +2,9 @@ title: Adding or Editing a Solution (Windows 10) description: If you find your own solutions to compatibility issues, you can enter the solutions in Application Compatibility Manager (ACM). You can use the Microsoft Compatibility Exchange to upload solutions to Microsoft Corporation. ms.assetid: 86cb8804-d577-4af6-b96f-5e0409784a23 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/adding-or-editing-an-issue.md b/windows/plan/adding-or-editing-an-issue.md index 51a8522a05..75e4e67390 100644 --- a/windows/plan/adding-or-editing-an-issue.md +++ b/windows/plan/adding-or-editing-an-issue.md @@ -2,8 +2,9 @@ title: Adding or Editing an Issue (Windows 10) description: In Application Compatibility Manager (ACM), you can enter information about the compatibility issues that you discover. ms.assetid: 8a9fff79-9f88-4ce2-a4e6-b9382f28143d -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/analyzing-your-compatibility-data.md b/windows/plan/analyzing-your-compatibility-data.md index 4b145ad92f..30f6a43c24 100644 --- a/windows/plan/analyzing-your-compatibility-data.md +++ b/windows/plan/analyzing-your-compatibility-data.md @@ -2,8 +2,9 @@ title: Analyzing Your Compatibility Data (Windows 10) description: This section provides information about viewing and working with your compatibility data in Application Compatibility Manager (ACM). ms.assetid: b98f3d74-fe22-41a2-afe8-2eb2799933a1 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/application-dialog-box.md b/windows/plan/application-dialog-box.md index 1700305f86..c8d9515fa6 100644 --- a/windows/plan/application-dialog-box.md +++ b/windows/plan/application-dialog-box.md @@ -2,8 +2,9 @@ title: Application Dialog Box (Windows 10) description: In Application Compatibility Manager (ACM), the Application dialog box shows information about the selected application. ms.assetid: a43e85a6-3cd4-4235-bc4d-01e4d097db7e -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/applying-filters-to-data-in-the-sua-tool.md b/windows/plan/applying-filters-to-data-in-the-sua-tool.md index 7f960b8cf6..7b716d119a 100644 --- a/windows/plan/applying-filters-to-data-in-the-sua-tool.md +++ b/windows/plan/applying-filters-to-data-in-the-sua-tool.md @@ -2,8 +2,9 @@ title: Applying Filters to Data in the SUA Tool (Windows 10) description: On the user interface for the Standard User Analyzer (SUA) tool, you can apply filters to the issues that the tool has found so that you can view only the information that interests you. ms.assetid: 48c39919-3501-405d-bcf5-d2784cbb011f -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/available-data-types-and-operators-in-compatibility-administrator.md b/windows/plan/available-data-types-and-operators-in-compatibility-administrator.md index bc5e40d571..8076d0787c 100644 --- a/windows/plan/available-data-types-and-operators-in-compatibility-administrator.md +++ b/windows/plan/available-data-types-and-operators-in-compatibility-administrator.md @@ -2,8 +2,9 @@ title: Available Data Types and Operators in Compatibility Administrator (Windows 10) description: The Compatibility Administrator tool provides a way to query your custom-compatibility databases. ms.assetid: 67d9c03e-ab9d-4fda-8a55-8c5b90266d3b -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/best-practice-recommendations-for-windows-to-go.md b/windows/plan/best-practice-recommendations-for-windows-to-go.md index 4ef9e9177e..c9cc2ac741 100644 --- a/windows/plan/best-practice-recommendations-for-windows-to-go.md +++ b/windows/plan/best-practice-recommendations-for-windows-to-go.md @@ -2,9 +2,10 @@ title: Best practice recommendations for Windows To Go (Windows 10) description: Best practice recommendations for Windows To Go ms.assetid: 05e6e0ab-94ed-4c0c-a195-0abd006f0a86 -keywords: ["best practices, USB, device, boot"] +keywords: best practices, USB, device, boot ms.prod: w10 -ms.mktglfcycl: deploy +ms.mktglfcycl: plan +pagetype: mobility ms.sitesec: library author: mtniehaus --- diff --git a/windows/plan/categorizing-your-compatibility-data.md b/windows/plan/categorizing-your-compatibility-data.md index 637af36069..f00d576eee 100644 --- a/windows/plan/categorizing-your-compatibility-data.md +++ b/windows/plan/categorizing-your-compatibility-data.md @@ -2,8 +2,9 @@ title: Categorizing Your Compatibility Data (Windows 10) ms.assetid: 6420f012-316f-4ef0-bfbb-14baaa664e6e description: -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/change-history-for-plan-for-windows-10-deployment.md b/windows/plan/change-history-for-plan-for-windows-10-deployment.md index 7d8965c6d6..4f0b96a684 100644 --- a/windows/plan/change-history-for-plan-for-windows-10-deployment.md +++ b/windows/plan/change-history-for-plan-for-windows-10-deployment.md @@ -2,8 +2,8 @@ title: Change history for Plan for Windows 10 deployment (Windows 10) description: This topic lists new and updated topics in the Plan for Windows 10 deployment documentation for Windows 10 and Windows 10 Mobile. ms.assetid: 70D9F4F8-F2A4-4FB4-9459-5B2BE7BCAC66 -ms.prod: W10 -ms.mktglfcycl: deploy +ms.prod: w10 +ms.mktglfcycl: plan ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/chromebook-migration-guide.md b/windows/plan/chromebook-migration-guide.md index 5f6f426691..9504345b46 100644 --- a/windows/plan/chromebook-migration-guide.md +++ b/windows/plan/chromebook-migration-guide.md @@ -3,7 +3,7 @@ title: Chromebook migration guide (Windows 10) description: In this guide you will learn how to migrate a Google Chromebook-based learning environment to a Windows 10-based learning environment. ms.assetid: 7A1FA48A-C44A-4F59-B895-86D4D77F8BEA keywords: migrate, automate, device -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: edu; devices diff --git a/windows/plan/common-compatibility-issues.md b/windows/plan/common-compatibility-issues.md index e9feba9487..4e96594b85 100644 --- a/windows/plan/common-compatibility-issues.md +++ b/windows/plan/common-compatibility-issues.md @@ -2,8 +2,9 @@ title: Common Compatibility Issues (Windows 10) ms.assetid: f5ad621d-bda2-45b5-ae85-bc92970f602f description: -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/compatibility-administrator-users-guide.md b/windows/plan/compatibility-administrator-users-guide.md index 06246f50b6..8625f9e210 100644 --- a/windows/plan/compatibility-administrator-users-guide.md +++ b/windows/plan/compatibility-administrator-users-guide.md @@ -2,8 +2,9 @@ title: Compatibility Administrator User's Guide (Windows 10) ms.assetid: 0ce05f66-9009-4739-a789-60f3ce380e76 description: -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/compatibility-fix-database-management-strategies-and-deployment.md b/windows/plan/compatibility-fix-database-management-strategies-and-deployment.md index 9abe28e94d..f608310bd6 100644 --- a/windows/plan/compatibility-fix-database-management-strategies-and-deployment.md +++ b/windows/plan/compatibility-fix-database-management-strategies-and-deployment.md @@ -2,8 +2,9 @@ title: Compatibility Fix Database Management Strategies and Deployment (Windows 10) ms.assetid: fdfbf02f-c4c4-4739-a400-782204fd3c6c description: -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md b/windows/plan/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md index 1efec32cb1..688cf0a0d5 100644 --- a/windows/plan/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md +++ b/windows/plan/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md @@ -2,8 +2,9 @@ title: Compatibility Fixes for Windows 10, Windows 8, Windows 7, and Windows Vista (Windows 10) description: You can fix some compatibility issues that are due to the changes made between Windows operating system versions. These issues can include User Account Control (UAC) restrictions. ms.assetid: cd51c824-557f-462a-83bb-54b0771b7dff -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/compatibility-monitor-users-guide.md b/windows/plan/compatibility-monitor-users-guide.md index f5b56c4858..9a72ed30d3 100644 --- a/windows/plan/compatibility-monitor-users-guide.md +++ b/windows/plan/compatibility-monitor-users-guide.md @@ -2,8 +2,9 @@ title: Compatibility Monitor User's Guide (Windows 10) description: Compatibility Monitor is a tool in the runtime analysis package that you can use to monitor applications for compatibility issues. You can also use the Compatibility Monitor tool to submit compatibility feedback. ms.assetid: 67d6eff0-1576-44bd-99b4-a3ffa5e205ac -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/computer-dialog-box.md b/windows/plan/computer-dialog-box.md index 498f20d93c..b191d79a79 100644 --- a/windows/plan/computer-dialog-box.md +++ b/windows/plan/computer-dialog-box.md @@ -2,8 +2,9 @@ title: Computer Dialog Box (Windows 10) description: In Application Compatibility Manager (ACM), the Computer dialog box shows information about the selected computer. ms.assetid: f89cbb28-adcd-41cd-9a54-402bc4aaffd9 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/configuring-act.md b/windows/plan/configuring-act.md index ef72f68d43..f5803ddd81 100644 --- a/windows/plan/configuring-act.md +++ b/windows/plan/configuring-act.md @@ -2,8 +2,9 @@ title: Configuring ACT (Windows 10) description: This section provides information about setting up the Application Compatibility Toolkit (ACT) in your organization. ms.assetid: aacbe35e-ea40-47ac-bebf-ed2660c8fd86 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/creating-a-custom-compatibility-fix-in-compatibility-administrator.md b/windows/plan/creating-a-custom-compatibility-fix-in-compatibility-administrator.md index 26d4a51ca0..a88189a7a2 100644 --- a/windows/plan/creating-a-custom-compatibility-fix-in-compatibility-administrator.md +++ b/windows/plan/creating-a-custom-compatibility-fix-in-compatibility-administrator.md @@ -2,8 +2,9 @@ title: Creating a Custom Compatibility Fix in Compatibility Administrator (Windows 10) description: The Compatibility Administrator tool uses the term fix to describe the combination of compatibility information added to a customized database for a specific application. ms.assetid: e4f2853a-0e46-49c5-afd7-0ed12f1fe0c2 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/creating-a-custom-compatibility-mode-in-compatibility-administrator.md b/windows/plan/creating-a-custom-compatibility-mode-in-compatibility-administrator.md index 75f3706089..ac5091d0bb 100644 --- a/windows/plan/creating-a-custom-compatibility-mode-in-compatibility-administrator.md +++ b/windows/plan/creating-a-custom-compatibility-mode-in-compatibility-administrator.md @@ -2,8 +2,9 @@ title: Creating a Custom Compatibility Mode in Compatibility Administrator (Windows 10) description: Windows® provides several compatibility modes, groups of compatibility fixes found to resolve many common application-compatibility issues. ms.assetid: 661a1c0d-267f-4a79-8445-62a9a98d09b0 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/creating-a-runtime-analysis-package.md b/windows/plan/creating-a-runtime-analysis-package.md index 8246a9de4a..04411a5fa7 100644 --- a/windows/plan/creating-a-runtime-analysis-package.md +++ b/windows/plan/creating-a-runtime-analysis-package.md @@ -2,8 +2,9 @@ title: Creating a Runtime-Analysis Package (Windows 10) description: In Application Compatibility Manager (ACM), you can create runtime-analysis packages, which you can then deploy to computers for compatibility testing in your test environment. ms.assetid: 3c703ebe-46b3-4dcd-b355-b28344bc159b -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/creating-an-apphelp-message-in-compatibility-administrator.md b/windows/plan/creating-an-apphelp-message-in-compatibility-administrator.md index 4fc5707012..5b48ebdbb8 100644 --- a/windows/plan/creating-an-apphelp-message-in-compatibility-administrator.md +++ b/windows/plan/creating-an-apphelp-message-in-compatibility-administrator.md @@ -2,8 +2,9 @@ title: Creating an AppHelp Message in Compatibility Administrator (Windows 10) description: The Compatibility Administrator tool enables you to create an AppHelp text message. This is a blocking or non-blocking message that appears when a user starts an application that you know has major functionality issues on the Windows® operating system. ms.assetid: 5c6e89f5-1942-4aa4-8439-ccf0ecd02848 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/creating-an-enterprise-environment-for-compatibility-testing.md b/windows/plan/creating-an-enterprise-environment-for-compatibility-testing.md index 339ef48aaf..840fa87695 100644 --- a/windows/plan/creating-an-enterprise-environment-for-compatibility-testing.md +++ b/windows/plan/creating-an-enterprise-environment-for-compatibility-testing.md @@ -2,8 +2,9 @@ title: Creating an Enterprise Environment for Compatibility Testing (Windows 10) description: The goal of the test environment is to model the operating system that you want to deploy and assess compatibility before deploying the operating system to your production environment. ms.assetid: cbf6d8b6-7ebc-4faa-bbbd-e02653ed4adb -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/creating-an-inventory-collector-package.md b/windows/plan/creating-an-inventory-collector-package.md index 01d9dcf89c..c174e746e0 100644 --- a/windows/plan/creating-an-inventory-collector-package.md +++ b/windows/plan/creating-an-inventory-collector-package.md @@ -2,8 +2,9 @@ title: Creating an Inventory-Collector Package (Windows 10) description: You can use Application Compatibility Manager (ACM) to create an inventory-collector package. ms.assetid: 61d041d6-e308-47b3-921b-709d72926d6d -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/creating-and-editing-issues-and-solutions.md b/windows/plan/creating-and-editing-issues-and-solutions.md index d4e183c235..0ce76a3f2f 100644 --- a/windows/plan/creating-and-editing-issues-and-solutions.md +++ b/windows/plan/creating-and-editing-issues-and-solutions.md @@ -2,8 +2,9 @@ title: Creating and Editing Issues and Solutions (Windows 10) description: This section provides step-by-step instructions for adding and editing application compatibility issues and solutions. Your issue and solution data can be uploaded to Microsoft through the Microsoft® Compatibility Exchange. ms.assetid: b64fe4e0-24bd-4bbd-9645-80ae5644e774 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/customizing-your-report-views.md b/windows/plan/customizing-your-report-views.md index 97566482eb..a68961a2e6 100644 --- a/windows/plan/customizing-your-report-views.md +++ b/windows/plan/customizing-your-report-views.md @@ -2,8 +2,9 @@ title: Customizing Your Report Views (Windows 10) description: You can customize how you view your report data in Application Compatibility Manager (ACM). ms.assetid: ba8da888-6749-43b4-8efb-4f26c7954721 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/data-sent-through-the-microsoft-compatibility-exchange.md b/windows/plan/data-sent-through-the-microsoft-compatibility-exchange.md index 4f5456aa5d..8bb30d37a8 100644 --- a/windows/plan/data-sent-through-the-microsoft-compatibility-exchange.md +++ b/windows/plan/data-sent-through-the-microsoft-compatibility-exchange.md @@ -2,8 +2,9 @@ title: Data Sent Through the Microsoft Compatibility Exchange (Windows 10) description: The Microsoft Compatibility Exchange propagates data of various types between Microsoft Corporation, independent software vendors (ISVs) and the Application Compatibility Toolkit (ACT) Community. ms.assetid: 3ec61e33-9db8-4367-99d5-e05c2f50e144 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/deciding-whether-to-fix-an-application-or-deploy-a-workaround.md b/windows/plan/deciding-whether-to-fix-an-application-or-deploy-a-workaround.md index ed48afa8a9..0bf24136b1 100644 --- a/windows/plan/deciding-whether-to-fix-an-application-or-deploy-a-workaround.md +++ b/windows/plan/deciding-whether-to-fix-an-application-or-deploy-a-workaround.md @@ -2,8 +2,9 @@ title: Deciding Whether to Fix an Application or Deploy a Workaround (Windows 10) description: You can fix a compatibility issue by changing the code for the application or by deploying a workaround. ms.assetid: e495d0c8-bfba-4537-bccd-64c4b52206f1 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/deciding-which-applications-to-test.md b/windows/plan/deciding-which-applications-to-test.md index f5719dbdb7..a0d4d06986 100644 --- a/windows/plan/deciding-which-applications-to-test.md +++ b/windows/plan/deciding-which-applications-to-test.md @@ -2,8 +2,9 @@ title: Deciding Which Applications to Test (Windows 10) description: Before starting your compatibility testing on the version of Windows that you want to deploy, you can use the Application Compatibility Toolkit (ACT) to identify which applications should be the focus of your testing. ms.assetid: d7c1c28f-b7b4-43ac-bf87-2910a2b603bf -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/deleting-a-data-collection-package.md b/windows/plan/deleting-a-data-collection-package.md index ade04833e1..002a431377 100644 --- a/windows/plan/deleting-a-data-collection-package.md +++ b/windows/plan/deleting-a-data-collection-package.md @@ -2,8 +2,9 @@ title: Deleting a Data-Collection Package (Windows 10) description: In Application Compatibility Manager (ACM), you can delete any of your existing data-collection packages from the database. ms.assetid: 1b397d7a-7216-4078-93d9-47c7becbf73e -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/deploying-a-runtime-analysis-package.md b/windows/plan/deploying-a-runtime-analysis-package.md index 09c49b1cc9..bf01c5258c 100644 --- a/windows/plan/deploying-a-runtime-analysis-package.md +++ b/windows/plan/deploying-a-runtime-analysis-package.md @@ -2,8 +2,9 @@ title: Deploying a Runtime-Analysis Package (Windows 10) description: When you deploy a runtime-analysis package, you are deploying it to your test environment for compatibility testing. ms.assetid: 304bf0be-0e7c-4c5f-baac-bed7f8bef509 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/deploying-an-inventory-collector-package.md b/windows/plan/deploying-an-inventory-collector-package.md index a3d471a410..406a2823fd 100644 --- a/windows/plan/deploying-an-inventory-collector-package.md +++ b/windows/plan/deploying-an-inventory-collector-package.md @@ -2,8 +2,8 @@ title: Deploying an Inventory-Collector Package (Windows 10) ms.assetid: 8726ff71-0d17-4449-bdb7-66957ae51c62 description: -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/deployment-considerations-for-windows-to-go.md b/windows/plan/deployment-considerations-for-windows-to-go.md index 8d512f6395..da2f4412e7 100644 --- a/windows/plan/deployment-considerations-for-windows-to-go.md +++ b/windows/plan/deployment-considerations-for-windows-to-go.md @@ -2,9 +2,10 @@ title: Deployment considerations for Windows To Go (Windows 10) description: Deployment considerations for Windows To Go ms.assetid: dcfc5d96-b96b-44cd-ab65-416b5611c65e -keywords: ["deploy, mobile, device, USB, boot, image, workspace, driver"] +keywords: deploy, mobile, device, USB, boot, image, workspace, driver ms.prod: W10 -ms.mktglfcycl: deploy +ms.mktglfcycl: plan +ms.pagetype: mobility ms.sitesec: library author: mtniehaus --- diff --git a/windows/plan/device-dialog-box.md b/windows/plan/device-dialog-box.md index ae65f7330b..7cd1c0d3ec 100644 --- a/windows/plan/device-dialog-box.md +++ b/windows/plan/device-dialog-box.md @@ -2,8 +2,9 @@ title: Device Dialog Box (Windows 10) description: In Application Compatibility Manager (ACM), the Device dialog box shows information about the selected device. ms.assetid: 5bd7cfda-31ea-4967-8b64-6c0425092f4e -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md b/windows/plan/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md index 0f3ad7aa3d..85c5e0ba27 100644 --- a/windows/plan/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md +++ b/windows/plan/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md @@ -2,8 +2,9 @@ title: Enabling and Disabling Compatibility Fixes in Compatibility Administrator (Windows 10) description: You can disable and enable individual compatibility fixes in your customized databases for testing and troubleshooting purposes. ms.assetid: 6bd4a7c5-0ed9-4a35-948c-c438aa4d6cb6 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/example-filter-queries.md b/windows/plan/example-filter-queries.md index a128516e95..7b7732863d 100644 --- a/windows/plan/example-filter-queries.md +++ b/windows/plan/example-filter-queries.md @@ -2,8 +2,9 @@ title: Example Filter Queries (Windows 10) description: You can filter your compatibility-issue data or reports by selecting specific restriction criteria. ms.assetid: eae59380-56cc-4d57-bd2c-11a0e3c689c9 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/exporting-a-data-collection-package.md b/windows/plan/exporting-a-data-collection-package.md index c1eef9d0ad..5baee693f6 100644 --- a/windows/plan/exporting-a-data-collection-package.md +++ b/windows/plan/exporting-a-data-collection-package.md @@ -2,8 +2,9 @@ title: Exporting a Data-Collection Package (Windows 10) description: In Application Compatibility Manager (ACM), you can export a data-collection package as a Windows installer (.msi) file. You can then use the .msi file to install the data-collection package on the computers from which you want to gather data. ms.assetid: 98fe19e4-9533-4ffc-a275-8b3776ee93ed -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/filtering-your-compatibility-data.md b/windows/plan/filtering-your-compatibility-data.md index 36776e764a..fcc724c2d5 100644 --- a/windows/plan/filtering-your-compatibility-data.md +++ b/windows/plan/filtering-your-compatibility-data.md @@ -2,8 +2,9 @@ title: Filtering Your Compatibility Data (Windows 10) description: You can use Query Builder to filter your compatibility-issue data or reports by selecting specific restriction criteria. ms.assetid: b64267b5-83c0-4b4d-a075-0975d3a359c8 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/fixing-applications-by-using-the-sua-tool.md b/windows/plan/fixing-applications-by-using-the-sua-tool.md index 99bd4deb6e..bdfe9b9c63 100644 --- a/windows/plan/fixing-applications-by-using-the-sua-tool.md +++ b/windows/plan/fixing-applications-by-using-the-sua-tool.md @@ -2,8 +2,9 @@ title: Fixing Applications by Using the SUA Tool (Windows 10) description: On the user interface for the Standard User Analyzer (SUA) tool, you can apply fixes to an application. ms.assetid: 7f5947b1-977b-4d7e-bb52-fbe8e76f6b8b -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/fixing-compatibility-issues.md b/windows/plan/fixing-compatibility-issues.md index dc3e884415..b7f338d5ac 100644 --- a/windows/plan/fixing-compatibility-issues.md +++ b/windows/plan/fixing-compatibility-issues.md @@ -2,8 +2,9 @@ title: Fixing Compatibility Issues (Windows 10) description: This section provides step-by-step instructions and describes development tools that you can use to help fix your compatibility issues. ms.assetid: 30ba8d14-a41a-41b3-9019-e8658d6974de -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/identifying-computers-for-inventory-collection.md b/windows/plan/identifying-computers-for-inventory-collection.md index 638addad76..a7378b9820 100644 --- a/windows/plan/identifying-computers-for-inventory-collection.md +++ b/windows/plan/identifying-computers-for-inventory-collection.md @@ -2,8 +2,8 @@ title: Identifying Computers for Inventory Collection (Windows 10) ms.assetid: f5bf2d89-fff2-4960-a153-dc1146b442fb description: -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/index.md b/windows/plan/index.md index 3c830e97d4..a82ad27fb5 100644 --- a/windows/plan/index.md +++ b/windows/plan/index.md @@ -2,8 +2,8 @@ title: Plan for Windows 10 deployment (Windows 10) description: Windows 10 provides new deployment capabilities, scenarios, and tools by building on technologies introduced in Windows 7, and Windows 8.1, while at the same time introducing new Windows as a service concepts to keep the operating system up to date. ms.assetid: 002F9B79-B50F-40C5-A7A5-0B4770E6EC15 -keywords: ["deploy", "upgrade", "update", "configure"] -ms.prod: W10 +keywords: deploy, upgrade, update, configure +ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library author: TrudyHa diff --git a/windows/plan/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md b/windows/plan/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md index 2d040ed0be..c55deebb84 100644 --- a/windows/plan/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md +++ b/windows/plan/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md @@ -2,8 +2,9 @@ title: Installing and Uninstalling Custom Compatibility Databases in Compatibility Administrator (Windows 10) description: The Compatibility Administrator tool enables the creation and the use of custom-compatibility and standard-compatibility databases. ms.assetid: 659c9d62-5f32-433d-94aa-12141c01368f -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/integration-with-management-solutions-.md b/windows/plan/integration-with-management-solutions-.md index 788d1ad4e8..83dcaee001 100644 --- a/windows/plan/integration-with-management-solutions-.md +++ b/windows/plan/integration-with-management-solutions-.md @@ -6,7 +6,7 @@ keywords: update, upgrade, deployment, manage, tools ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library -ms.pagetype: servicing; devices +ms.pagetype: servicing, devices author: TrudyHa --- diff --git a/windows/plan/internet-explorer-web-site-report.md b/windows/plan/internet-explorer-web-site-report.md index fdcd6ef921..da0098b6c3 100644 --- a/windows/plan/internet-explorer-web-site-report.md +++ b/windows/plan/internet-explorer-web-site-report.md @@ -2,8 +2,9 @@ title: Internet Explorer - Web Site Report (Windows 10) ms.assetid: f072033d-9d42-47ed-8fb0-dbdc28442910 description: -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/labeling-data-in-acm.md b/windows/plan/labeling-data-in-acm.md index d9fe6d9da7..1e0ae71639 100644 --- a/windows/plan/labeling-data-in-acm.md +++ b/windows/plan/labeling-data-in-acm.md @@ -2,8 +2,9 @@ title: Labeling Data in ACM (Windows 10) description: Application data and its associated compatibility issues can vary within an organization. ms.assetid: d099c747-e68a-4cad-a639-9f33efab35b3 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/log-file-locations-for-data-collection-packages.md b/windows/plan/log-file-locations-for-data-collection-packages.md index 6483bf1b49..99ea5bc63f 100644 --- a/windows/plan/log-file-locations-for-data-collection-packages.md +++ b/windows/plan/log-file-locations-for-data-collection-packages.md @@ -2,8 +2,9 @@ title: Log File Locations for Data-Collection Packages (Windows 10) ms.assetid: dcc395e7-2d9c-4935-abab-33c5934ce24a description: -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/managing-application-compatibility-fixes-and-custom-fix-databases.md b/windows/plan/managing-application-compatibility-fixes-and-custom-fix-databases.md index d85029f97f..7c8a961d1d 100644 --- a/windows/plan/managing-application-compatibility-fixes-and-custom-fix-databases.md +++ b/windows/plan/managing-application-compatibility-fixes-and-custom-fix-databases.md @@ -2,8 +2,9 @@ title: Managing Application-Compatibility Fixes and Custom Fix Databases (Windows 10) description: This section provides information about managing your application-compatibility fixes and custom-compatibility fix databases. This section explains the reasons for using compatibility fixes and how to deploy custom-compatibility fix databases. ms.assetid: 9c2e9396-908e-4a36-ad67-2e40452ce017 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/managing-your-data-collection-packages.md b/windows/plan/managing-your-data-collection-packages.md index eb9af845ad..46eaa26130 100644 --- a/windows/plan/managing-your-data-collection-packages.md +++ b/windows/plan/managing-your-data-collection-packages.md @@ -2,8 +2,9 @@ title: Managing Your Data-Collection Packages (Windows 10) description: This section provides information about using Application Compatibility Manager (ACM) to manage your data-collection packages. ms.assetid: 369ae82f-c8ca-42ec-85df-1b760a74e70a -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/organizational-tasks-for-each-report-type.md b/windows/plan/organizational-tasks-for-each-report-type.md index e49ccba8f8..e572f3b042 100644 --- a/windows/plan/organizational-tasks-for-each-report-type.md +++ b/windows/plan/organizational-tasks-for-each-report-type.md @@ -2,8 +2,9 @@ title: Organizational Tasks for Each Report Type (Windows 10) description: The following table shows which tasks can be performed for each report type. ms.assetid: 7463fab1-ba6e-4a9a-9112-0b69a18fe353 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/organizing-your-compatibility-data.md b/windows/plan/organizing-your-compatibility-data.md index 15d1d152b6..54bc38d151 100644 --- a/windows/plan/organizing-your-compatibility-data.md +++ b/windows/plan/organizing-your-compatibility-data.md @@ -2,8 +2,9 @@ title: Organizing Your Compatibility Data (Windows 10) description: This section provides step-by-step instructions for organizing your compatibility data in Application Compatibility Manager (ACM). ms.assetid: e91ae444-5d85-4b5f-b655-a765ecc78b1e -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/prepare-your-organization-for-windows-to-go.md b/windows/plan/prepare-your-organization-for-windows-to-go.md index f66acaff2b..fabf25bc73 100644 --- a/windows/plan/prepare-your-organization-for-windows-to-go.md +++ b/windows/plan/prepare-your-organization-for-windows-to-go.md @@ -3,8 +3,9 @@ title: Prepare your organization for Windows To Go (Windows 10) description: Prepare your organization for Windows To Go ms.assetid: f3f3c160-90ad-40a8-aeba-2aedee18f7ff keywords: ["mobile, device, USB, deploy"] -ms.prod: W10 -ms.mktglfcycl: deploy +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: mobility ms.sitesec: library author: mtniehaus --- diff --git a/windows/plan/prioritizing-your-compatibility-data.md b/windows/plan/prioritizing-your-compatibility-data.md index b597b63fc8..3d55e9d1f3 100644 --- a/windows/plan/prioritizing-your-compatibility-data.md +++ b/windows/plan/prioritizing-your-compatibility-data.md @@ -2,8 +2,9 @@ title: Prioritizing Your Compatibility Data (Windows 10) ms.assetid: 103e125a-bd2b-4019-9d6a-2e1d50c380b1 description: -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/ratings-icons-in-acm.md b/windows/plan/ratings-icons-in-acm.md index ab8a3a47ec..e8f095c0ac 100644 --- a/windows/plan/ratings-icons-in-acm.md +++ b/windows/plan/ratings-icons-in-acm.md @@ -2,8 +2,9 @@ title: Ratings Icons in ACM (Windows 10) description: Compatibility ratings can originate from Microsoft, the application vendor, your organization, and from the Application Compatibility Toolkit (ACT) community. ms.assetid: 0165499e-cb47-4d76-98a6-b871d23e4e83 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/resolving-an-issue.md b/windows/plan/resolving-an-issue.md index 74ffe1f620..4d5557c944 100644 --- a/windows/plan/resolving-an-issue.md +++ b/windows/plan/resolving-an-issue.md @@ -2,8 +2,9 @@ title: Resolving an Issue (Windows 10) description: You can use Application Compatibility Manager (ACM) to flag issues as resolved. Resolving an issue changes the status of the issue from a red x to a green check mark on your report and report detail screens. ms.assetid: 96195122-185d-4f6a-8e84-79c3d069e933 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/saving-opening-and-exporting-reports.md b/windows/plan/saving-opening-and-exporting-reports.md index 2f947a935e..67d940bd0d 100644 --- a/windows/plan/saving-opening-and-exporting-reports.md +++ b/windows/plan/saving-opening-and-exporting-reports.md @@ -2,8 +2,9 @@ title: Saving, Opening, and Exporting Reports (Windows 10) description: You can perform several common reporting tasks from the Analyze screen, including saving a compatibility report, opening a saved compatibility report (.adq) file, and exporting your report data to a spreadsheet (.xls) file. ms.assetid: 8be72a6c-63ab-4451-ad79-815e2ac18aa2 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/searching-for-fixed-applications-in-compatibility-administrator.md b/windows/plan/searching-for-fixed-applications-in-compatibility-administrator.md index 6c83a990ee..99b2f4a61f 100644 --- a/windows/plan/searching-for-fixed-applications-in-compatibility-administrator.md +++ b/windows/plan/searching-for-fixed-applications-in-compatibility-administrator.md @@ -2,8 +2,9 @@ title: Searching for Fixed Applications in Compatibility Administrator (Windows 10) description: With the search functionality in Compatibility Administrator, you can locate specific executable (.exe) files with previously applied compatibility fixes, compatibility modes, or AppHelp messages. ms.assetid: 1051a2dc-0362-43a4-8ae8-07dae39b1cb8 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md b/windows/plan/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md index bdc0043f6b..25906a1746 100644 --- a/windows/plan/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md +++ b/windows/plan/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md @@ -2,8 +2,9 @@ title: Searching for Installed Compatibility Fixes with the Query Tool in Compatibility Administrator (Windows 10) description: You can access the Query tool from within Compatibility Administrator. The Query tool provides the same functionality as using the Search feature. ms.assetid: dd213b55-c71c-407a-ad49-33db54f82f22 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/security-and-data-protection-considerations-for-windows-to-go.md b/windows/plan/security-and-data-protection-considerations-for-windows-to-go.md index 7343863528..999d2e6956 100644 --- a/windows/plan/security-and-data-protection-considerations-for-windows-to-go.md +++ b/windows/plan/security-and-data-protection-considerations-for-windows-to-go.md @@ -2,9 +2,10 @@ title: Security and data protection considerations for Windows To Go (Windows 10) description: One of the most important requirements to consider when you plan your Windows To Go deployment is to ensure that the data, content, and resources you work with in the Windows To Go workspace is protected and secure. ms.assetid: 5f27339f-6761-44f4-8c29-9a25cf8e75fe -keywords: ["mobile, device, USB, secure, BitLocker"] -ms.prod: W10 -ms.mktglfcycl: deploy +keywords: mobile, device, USB, secure, BitLocker +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: mobility, security ms.sitesec: library author: mtniehaus --- diff --git a/windows/plan/selecting-the-send-and-receive-status-for-an-application.md b/windows/plan/selecting-the-send-and-receive-status-for-an-application.md index 0a8f1c3450..782d3c1651 100644 --- a/windows/plan/selecting-the-send-and-receive-status-for-an-application.md +++ b/windows/plan/selecting-the-send-and-receive-status-for-an-application.md @@ -2,8 +2,9 @@ title: Selecting the Send and Receive Status for an Application (Windows 10) description: For each application listed in Application Compatibility Manager (ACM), you can select whether to send and receive specific application data through the Microsoft Compatibility Exchange. ms.assetid: ae139093-27cf-4ad8-882d-e0509e78d33a -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/selecting-your-compatibility-rating.md b/windows/plan/selecting-your-compatibility-rating.md index 3b64974c1d..b7042d456d 100644 --- a/windows/plan/selecting-your-compatibility-rating.md +++ b/windows/plan/selecting-your-compatibility-rating.md @@ -2,8 +2,9 @@ title: Selecting Your Compatibility Rating (Windows 10) description: You can rate the compatibility of your applications, installation packages, or websites, based on whether they run successfully on a 32-bit or 64-bit operating system. ms.assetid: 959da499-8fd6-4f32-8771-a0580dd8e0d3 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/selecting-your-deployment-status.md b/windows/plan/selecting-your-deployment-status.md index 4d47ec35fb..8cc4a070bc 100644 --- a/windows/plan/selecting-your-deployment-status.md +++ b/windows/plan/selecting-your-deployment-status.md @@ -2,8 +2,9 @@ title: Selecting Your Deployment Status (Windows 10) description: In Application Compatibility Manager (ACM), you can track the deployment status of your applications and websites. ms.assetid: 7735d256-77eb-4498-93aa-c838ee6e00fc -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/sending-and-receiving-compatibility-data.md b/windows/plan/sending-and-receiving-compatibility-data.md index e2165cb7e6..5a694085b2 100644 --- a/windows/plan/sending-and-receiving-compatibility-data.md +++ b/windows/plan/sending-and-receiving-compatibility-data.md @@ -2,8 +2,9 @@ title: Sending and Receiving Compatibility Data (Windows 10) description: The Microsoft® Compatibility Exchange is a web service that propagates application compatibility issues between various data sources, for example Microsoft Corporation, independent software vendors (ISVs) and the ACT Community. ms.assetid: b86d2431-1caa-4f95-baf9-52ff6af546cd -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/settings-for-acm.md b/windows/plan/settings-for-acm.md index b548b8f403..6abb406ec3 100644 --- a/windows/plan/settings-for-acm.md +++ b/windows/plan/settings-for-acm.md @@ -2,8 +2,9 @@ title: Settings for ACM (Windows 10) description: This section provides information about settings that you can configure in Application Compatibility Manager (ACM). ms.assetid: e0126284-4348-4708-8976-a1e404f35971 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/setup-and-deployment.md b/windows/plan/setup-and-deployment.md index 590be310dd..618c4b80a0 100644 --- a/windows/plan/setup-and-deployment.md +++ b/windows/plan/setup-and-deployment.md @@ -6,7 +6,7 @@ keywords: update, upgrade, deployment ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library -ms.pagetype: servicing; devices +ms.pagetype: servicing, devices author: TrudyHa --- diff --git a/windows/plan/showing-messages-generated-by-the-sua-tool.md b/windows/plan/showing-messages-generated-by-the-sua-tool.md index 1b34533117..03651875c5 100644 --- a/windows/plan/showing-messages-generated-by-the-sua-tool.md +++ b/windows/plan/showing-messages-generated-by-the-sua-tool.md @@ -2,8 +2,9 @@ title: Showing Messages Generated by the SUA Tool (Windows 10) description: On the user interface for the Standard User Analyzer (SUA) tool, you can show the messages that the tool has generated. ms.assetid: 767eb7f2-d6c4-414c-a7b3-a997337d904a -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/software-requirements-for-act.md b/windows/plan/software-requirements-for-act.md index 5b3047ffaf..3564e2d753 100644 --- a/windows/plan/software-requirements-for-act.md +++ b/windows/plan/software-requirements-for-act.md @@ -2,8 +2,9 @@ title: Software Requirements for ACT (Windows 10) description: The Application Compatibility Toolkit (ACT) has the following software requirements. ms.assetid: 9bbc21d4-f2ac-4a91-8add-017b1eacdeee -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/software-requirements-for-rap.md b/windows/plan/software-requirements-for-rap.md index 18462f9bd7..07311438e4 100644 --- a/windows/plan/software-requirements-for-rap.md +++ b/windows/plan/software-requirements-for-rap.md @@ -2,8 +2,9 @@ title: Software Requirements for RAP (Windows 10) description: The runtime-analysis package (RAP) has the following software requirements. ms.assetid: 0163ce70-f5ba-400c-bdd5-a25511aac91f -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/sua-users-guide.md b/windows/plan/sua-users-guide.md index d907f4229d..e0f2921b80 100644 --- a/windows/plan/sua-users-guide.md +++ b/windows/plan/sua-users-guide.md @@ -2,8 +2,9 @@ title: SUA User's Guide (Windows 10) description: You can use Standard User Analyzer (SUA) to test your applications and monitor API calls to detect compatibility issues related to the User Account Control (UAC) feature in Windows. ms.assetid: ea525c25-b557-4ed4-b042-3e4d0e543e10 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/tabs-on-the-sua-tool-interface.md b/windows/plan/tabs-on-the-sua-tool-interface.md index 70a9ac7535..721e32bca7 100644 --- a/windows/plan/tabs-on-the-sua-tool-interface.md +++ b/windows/plan/tabs-on-the-sua-tool-interface.md @@ -2,8 +2,9 @@ title: Tabs on the SUA Tool Interface (Windows 10) description: The tabs in the Standard User Analyzer (SUA) tool show the User Account Control (UAC) issues for the applications that you analyze. ms.assetid: 0d705321-1d85-4217-bf2c-0ca231ca303b -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/taking-inventory-of-your-organization.md b/windows/plan/taking-inventory-of-your-organization.md index d42fc430b2..07b40d240a 100644 --- a/windows/plan/taking-inventory-of-your-organization.md +++ b/windows/plan/taking-inventory-of-your-organization.md @@ -2,8 +2,9 @@ title: Taking Inventory of Your Organization (Windows 10) description: This section provides information about how to use the Application Compatibility Toolkit (ACT) to identify applications and devices that are installed in your organization. ms.assetid: d52f138d-c6b2-4ab1-bb38-5b036311a51d -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/testing-compatibility-on-the-target-platform.md b/windows/plan/testing-compatibility-on-the-target-platform.md index 10111af439..621a8bfeb2 100644 --- a/windows/plan/testing-compatibility-on-the-target-platform.md +++ b/windows/plan/testing-compatibility-on-the-target-platform.md @@ -2,8 +2,9 @@ title: Testing Compatibility on the Target Platform (Windows 10) description: This section provides information about setting up a test environment for compatibility testing, and about creating and deploying runtime-analysis packages to the test environment. ms.assetid: 8f3e9d58-37c2-41ea-a216-32712baf6cf4 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/testing-your-application-mitigation-packages.md b/windows/plan/testing-your-application-mitigation-packages.md index df727951fd..669904c1e6 100644 --- a/windows/plan/testing-your-application-mitigation-packages.md +++ b/windows/plan/testing-your-application-mitigation-packages.md @@ -2,8 +2,9 @@ title: Testing Your Application Mitigation Packages (Windows 10) description: This topic provides details about testing your application-mitigation packages, including recommendations about how to report your information and how to resolve any outstanding issues. ms.assetid: ae946f27-d377-4db9-b179-e8875d454ccf -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/troubleshooting-act-database-issues.md b/windows/plan/troubleshooting-act-database-issues.md index 758df1a050..ba1e7c4f7a 100644 --- a/windows/plan/troubleshooting-act-database-issues.md +++ b/windows/plan/troubleshooting-act-database-issues.md @@ -2,8 +2,9 @@ title: Troubleshooting ACT Database Issues (Windows 10) description: The following solutions may help you resolve issues that are related to your Microsoft® SQL Server® database for the Application Compatibility Toolkit (ACT). ms.assetid: c36ab5d8-cc82-4681-808d-3d491551b75e -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/troubleshooting-act.md b/windows/plan/troubleshooting-act.md index 1dbfeee130..3de62348a2 100644 --- a/windows/plan/troubleshooting-act.md +++ b/windows/plan/troubleshooting-act.md @@ -2,8 +2,9 @@ title: Troubleshooting ACT (Windows 10) description: This section provides troubleshooting information for the Application Compatibility Toolkit (ACT). ms.assetid: 5696b0c0-5db5-4111-a1e1-825129e683d8 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/troubleshooting-the-act-configuration-wizard.md b/windows/plan/troubleshooting-the-act-configuration-wizard.md index 058b39db72..709b60fb6d 100644 --- a/windows/plan/troubleshooting-the-act-configuration-wizard.md +++ b/windows/plan/troubleshooting-the-act-configuration-wizard.md @@ -2,8 +2,9 @@ title: Troubleshooting the ACT Configuration Wizard (Windows 10) description: When you start Application Compatibility Manager (ACM) for the first time, the Application Compatibility Toolkit (ACT) Configuration Wizard appears. ms.assetid: f4f489c7-50b7-4b07-8b03-79777e1aaefd -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/troubleshooting-the-act-log-processing-service.md b/windows/plan/troubleshooting-the-act-log-processing-service.md index 8fef3bc4b5..0fff19e588 100644 --- a/windows/plan/troubleshooting-the-act-log-processing-service.md +++ b/windows/plan/troubleshooting-the-act-log-processing-service.md @@ -2,8 +2,9 @@ title: Troubleshooting the ACT Log Processing Service (Windows 10) description: The following solutions may help you resolve issues that are related to the Application Compatibility Toolkit (ACT) Log Processing Service. ms.assetid: cb6f90c2-9f7d-4a34-a91e-8ed55b8c256d -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/understanding-and-using-compatibility-fixes.md b/windows/plan/understanding-and-using-compatibility-fixes.md index bde6db5bc2..6c73a5645b 100644 --- a/windows/plan/understanding-and-using-compatibility-fixes.md +++ b/windows/plan/understanding-and-using-compatibility-fixes.md @@ -2,8 +2,9 @@ title: Understanding and Using Compatibility Fixes (Windows 10) description: As the Windows operating system evolves to support new technology and functionality, the implementations of some functions may change. ms.assetid: 84bf663d-3e0b-4168-99d6-a26e054821b7 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/using-act.md b/windows/plan/using-act.md index a091159a76..3793af0dd1 100644 --- a/windows/plan/using-act.md +++ b/windows/plan/using-act.md @@ -2,8 +2,9 @@ title: Using ACT (Windows 10) description: This section describes how to use the Application Compatibility Toolkit (ACT) in your organization. ms.assetid: e6a68f44-7503-450d-a000-a04fbb93a146 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/using-compatibility-monitor-to-send-feedback.md b/windows/plan/using-compatibility-monitor-to-send-feedback.md index 4bf3abf7e8..9a86a64d25 100644 --- a/windows/plan/using-compatibility-monitor-to-send-feedback.md +++ b/windows/plan/using-compatibility-monitor-to-send-feedback.md @@ -2,8 +2,9 @@ title: Using Compatibility Monitor to Send Feedback (Windows 10) description: The Microsoft Compatibility Monitor tool is installed as part of the runtime-analysis package. ms.assetid: dc59193e-7ff4-4950-8c20-e90c246e469d -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/using-the-compatibility-administrator-tool.md b/windows/plan/using-the-compatibility-administrator-tool.md index 09f3b30d05..26bd9c4a90 100644 --- a/windows/plan/using-the-compatibility-administrator-tool.md +++ b/windows/plan/using-the-compatibility-administrator-tool.md @@ -2,8 +2,9 @@ title: Using the Compatibility Administrator Tool (Windows 10) description: This section provides information about using the Compatibility Administrator tool. ms.assetid: 57271e47-b9b9-4018-a0b5-7115a533166d -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/using-the-sdbinstexe-command-line-tool.md b/windows/plan/using-the-sdbinstexe-command-line-tool.md index 26fdc888d1..fdd93bf2f3 100644 --- a/windows/plan/using-the-sdbinstexe-command-line-tool.md +++ b/windows/plan/using-the-sdbinstexe-command-line-tool.md @@ -2,8 +2,9 @@ title: Using the Sdbinst.exe Command-Line Tool (Windows 10) description: You must deploy your customized database (.sdb) files to other computers in your organization before your compatibility fixes, compatibility modes, and AppHelp messages are applied. ms.assetid: c1945425-3f8d-4de8-9d2d-59f801f07034 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/using-the-sua-tool.md b/windows/plan/using-the-sua-tool.md index 978389cd95..c758d2f32d 100644 --- a/windows/plan/using-the-sua-tool.md +++ b/windows/plan/using-the-sua-tool.md @@ -2,8 +2,9 @@ title: Using the SUA Tool (Windows 10) description: By using the Standard User Analyzer (SUA) tool, you can test your applications and monitor API calls to detect compatibility issues with the User Account Control (UAC) feature. ms.assetid: ebe52061-3816-47f7-a865-07bc5f405f03 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/using-the-sua-wizard.md b/windows/plan/using-the-sua-wizard.md index 7571be582c..a8f3b3ce03 100644 --- a/windows/plan/using-the-sua-wizard.md +++ b/windows/plan/using-the-sua-wizard.md @@ -2,8 +2,9 @@ title: Using the SUA Wizard (Windows 10) description: The Standard User Analyzer (SUA) Wizard works much like the SUA tool to evaluate User Account Control (UAC) issues. However, the SUA Wizard does not offer detailed analysis, and it cannot disable virtualization or elevate your permissions. ms.assetid: 29d07074-3de7-4ace-9a54-678af7255d6c -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/viewing-the-events-screen-in-compatibility-administrator.md b/windows/plan/viewing-the-events-screen-in-compatibility-administrator.md index 29d76d517d..8c89db2a64 100644 --- a/windows/plan/viewing-the-events-screen-in-compatibility-administrator.md +++ b/windows/plan/viewing-the-events-screen-in-compatibility-administrator.md @@ -2,8 +2,9 @@ title: Viewing the Events Screen in Compatibility Administrator (Windows 10) description: The Events screen enables you to record and to view your activities in the Compatibility Administrator tool, provided that the screen is open while you perform the activities. ms.assetid: f2b2ada4-1b7b-4558-989d-5b52b40454b3 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/viewing-your-compatibility-reports.md b/windows/plan/viewing-your-compatibility-reports.md index b1a40653dc..c0f5ffaae9 100644 --- a/windows/plan/viewing-your-compatibility-reports.md +++ b/windows/plan/viewing-your-compatibility-reports.md @@ -2,8 +2,9 @@ title: Viewing Your Compatibility Reports (Windows 10) description: This section describes the compatibility reports in Application Compatibility Manager (ACM) and how you can work with the reports. ms.assetid: a28bbfbe-5f05-4a1e-9397-0a3ceb585871 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/websiteurl-dialog-box.md b/windows/plan/websiteurl-dialog-box.md index 10f108276b..f9f44433db 100644 --- a/windows/plan/websiteurl-dialog-box.md +++ b/windows/plan/websiteurl-dialog-box.md @@ -2,8 +2,9 @@ title: WebsiteURL Dialog Box (Windows 10) description: In Application Compatibility Manager (ACM), the websiteURL dialog box shows information about the selected website. ms.assetid: 0dad26e1-4bba-4fef-b160-3fa1f4325da8 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/welcome-to-act.md b/windows/plan/welcome-to-act.md index fdbbc6ad7d..c6755be21e 100644 --- a/windows/plan/welcome-to-act.md +++ b/windows/plan/welcome-to-act.md @@ -2,8 +2,9 @@ title: Welcome to ACT (Windows 10) description: The Application Compatibility Toolkit (ACT) helps you determine whether the applications, devices, and computers in your organization are compatible with versions of the Windows® operating system. ms.assetid: 3963db88-83d2-4b9a-872e-31c275d1a321 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/whats-new-in-act-60.md b/windows/plan/whats-new-in-act-60.md index c765ca62eb..b516ef3eae 100644 --- a/windows/plan/whats-new-in-act-60.md +++ b/windows/plan/whats-new-in-act-60.md @@ -2,8 +2,9 @@ title: What's New in ACT 6.1 (Windows 10) description: Two major updates have been released since ACT 6.1. ms.assetid: f12e137d-0b55-4f7d-88e0-149302655d9b -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: TrudyHa --- diff --git a/windows/plan/windows-10-compatibility.md b/windows/plan/windows-10-compatibility.md index 7823fc3961..7466117367 100644 --- a/windows/plan/windows-10-compatibility.md +++ b/windows/plan/windows-10-compatibility.md @@ -2,9 +2,10 @@ title: Windows 10 compatibility (Windows 10) description: Windows 10 will be compatible with most existing PC hardware; most devices running Windows 7, Windows 8, or Windows 8.1 will meet the requirements for Windows 10. ms.assetid: 829BE5B5-330A-4702-807A-8908B4FC94E8 -keywords: ["deploy", "upgrade", "update", "appcompat"] -ms.prod: W10 +keywords: deploy, upgrade, update, appcompat +ms.prod: w10 ms.mktglfcycl: plan +ms.pagetype: appcompat ms.sitesec: library author: mtniehaus --- diff --git a/windows/plan/windows-10-deployment-considerations.md b/windows/plan/windows-10-deployment-considerations.md index 51d122fa2b..cefe2e8c90 100644 --- a/windows/plan/windows-10-deployment-considerations.md +++ b/windows/plan/windows-10-deployment-considerations.md @@ -2,8 +2,8 @@ title: Windows 10 deployment considerations (Windows 10) description: There are new deployment options in Windows 10 that help you simplify the deployment process and automate migration of existing settings and applications. ms.assetid: A8DD6B37-1E11-4CD6-B588-92C2404219FE -keywords: ["deploy", "upgrade", "update", "in-place"] -ms.prod: W10 +keywords: deploy, upgrade, update, in-place +ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library author: mtniehaus diff --git a/windows/plan/windows-10-guidance-for-education-environments.md b/windows/plan/windows-10-guidance-for-education-environments.md index c40e7da07e..599ac55e24 100644 --- a/windows/plan/windows-10-guidance-for-education-environments.md +++ b/windows/plan/windows-10-guidance-for-education-environments.md @@ -2,10 +2,10 @@ title: Guidance for education environments (Windows 10) description: Find resources to help you plan your deployment of Windows 10 to desktops, laptops, tablets, and other devices in educational institutions. ms.assetid: 225C9D6F-9329-4DDF-B447-6CE7804E314E -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library -ms.pagetype: security +ms.pagetype: edu, security author: craigash --- diff --git a/windows/plan/windows-10-infrastructure-requirements.md b/windows/plan/windows-10-infrastructure-requirements.md index bfa40b1eca..f8a5b10095 100644 --- a/windows/plan/windows-10-infrastructure-requirements.md +++ b/windows/plan/windows-10-infrastructure-requirements.md @@ -2,8 +2,8 @@ title: Windows 10 infrastructure requirements (Windows 10) description: There are specific infrastructure requirements to deploy and manage Windows 10 that should be in place prior to significant Windows 10 deployments within your organization. ms.assetid: B0FA27D9-A206-4E35-9AE6-74E70748BE64 -keywords: ["deploy", "upgrade", "update", "hardware"] -ms.prod: W10 +keywords: deploy, upgrade, update, hardware +ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library author: mtniehaus diff --git a/windows/plan/windows-10-servicing-options.md b/windows/plan/windows-10-servicing-options.md index 0cf0cd63eb..2e67c97c04 100644 --- a/windows/plan/windows-10-servicing-options.md +++ b/windows/plan/windows-10-servicing-options.md @@ -2,9 +2,10 @@ title: Windows 10 servicing options (Windows 10) description: Windows 10 provides a new model for organizations to deploy and upgrade Windows by providing updates to features and capabilities through a continual process. ms.assetid: 6EF0792C-B587-497D-8489-4A7F5848D92A -keywords: ["deploy", "upgrade", "update", "servicing"] -ms.prod: W10 +keywords: deploy, upgrade, update, servicing +ms.prod: w10 ms.mktglfcycl: plan +ms.pagetype: servicing ms.sitesec: library author: mtniehaus --- diff --git a/windows/plan/windows-to-go-frequently-asked-questions.md b/windows/plan/windows-to-go-frequently-asked-questions.md index 0eaa4178e6..a9f0dfee6c 100644 --- a/windows/plan/windows-to-go-frequently-asked-questions.md +++ b/windows/plan/windows-to-go-frequently-asked-questions.md @@ -2,9 +2,10 @@ title: Windows To Go frequently asked questions (Windows 10) description: Windows To Go frequently asked questions ms.assetid: bfdfb824-4a19-4401-b369-22c5e6ca9d6e -keywords: ["FAQ, mobile, device, USB"] -ms.prod: W10 +keywords: FAQ, mobile, device, USB +ms.prod: w10 ms.mktglfcycl: deploy +ms.pagetype: mobility ms.sitesec: library author: mtniehaus --- diff --git a/windows/plan/windows-to-go-overview.md b/windows/plan/windows-to-go-overview.md index c473ab949b..f00dfb55ea 100644 --- a/windows/plan/windows-to-go-overview.md +++ b/windows/plan/windows-to-go-overview.md @@ -2,9 +2,10 @@ title: Windows To Go feature overview (Windows 10) description: Windows To Go is a feature in Windows 10 Enterprise and Windows 10 Education that enables the creation of a Windows To Go workspace that can be booted from a USB-connected external drive on PCs. ms.assetid: 9df82b03-acba-442c-801d-56db241f8d42 -keywords: ["workspace, mobile, installation, image, USB, device, image"] +keywords: workspace, mobile, installation, image, USB, device, image, edu ms.prod: w10 ms.mktglfcycl: deploy +ms.pagetype: mobility, edu ms.sitesec: library author: mtniehaus --- diff --git a/windows/plan/windows-update-for-business.md b/windows/plan/windows-update-for-business.md index 7371c01825..67c4200203 100644 --- a/windows/plan/windows-update-for-business.md +++ b/windows/plan/windows-update-for-business.md @@ -2,7 +2,7 @@ title: Windows Update for Business (Windows 10) description: Get an overview of how you can implement and deploy a Windows Update for Business solution and how to maintain enrolled systems. ms.assetid: DF61F8C9-A8A6-4E83-973C-8ABE090DB8C6 -keywords: [update, upgrade, deployment, WSUS +keywords: update, upgrade, deployment, WSUS ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library From 7d106ca8032da375f4fcccd6fd00647be1567ebb Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Mon, 23 May 2016 13:54:34 -0700 Subject: [PATCH 378/439] fixing spacing issues --- windows/manage/windows-10-mobile-and-mdm.md | 270 +++++++++++++++----- 1 file changed, 213 insertions(+), 57 deletions(-) diff --git a/windows/manage/windows-10-mobile-and-mdm.md b/windows/manage/windows-10-mobile-and-mdm.md index 076e220c88..a818238913 100644 --- a/windows/manage/windows-10-mobile-and-mdm.md +++ b/windows/manage/windows-10-mobile-and-mdm.md @@ -2,48 +2,74 @@ title: Windows 10 Mobile and mobile device management (Windows 10) description: This guide provides an overview of the mobile device and app management technologies in the Windows 10 Mobile operating system. ms.assetid: 6CAA1004-CB65-4FEC-9B84-61AAD2125E5E -ms.pagetype: mobile; devices -keywords: ["telemetry", "BYOD", "MDM"] +keywords: telemetry, BYOD, MDM ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library +ms.pagetype: mobile; devices author: AMeeus --- + # Windows 10 Mobile and mobile device management + **Applies to** - Windows 10 Mobile + This guide provides an overview of the mobile device and app management technologies in the Windows 10 Mobile operating system. It describes how mobile device management (MDM) systems use the built-in device management client to deploy, configure, maintain, and support phones and small tablets running Windows 10 Mobile. + Bring Your Own Device (BYOD—that is, personal devices) and corporate devices are key scenarios that Windows 10 Mobile MDM capabilities support. The operating system offers a flexible approach to registering devices with directory services and MDM systems, and IT organizations can provision comprehensive device-configuration profiles based on their company’s need to control and secure mobile business data. Windows 10 Mobile not only delivers more comprehensive, restrictive configuration settings than Windows Phone 8.1 did but also provides capabilities to deploy and manage apps built on the Universal Windows Platform (UWP). Companies can distribute apps directly from Windows Store or by using their MDM system. They can control and distribute custom line-of-business (LOB) apps the same way. + ## Overview + Organizations’ users increasingly depend on their mobile devices, but phones and tablets bring new and unfamiliar challenges for IT departments. IT must be able to deploy and manage mobile devices and apps quickly to support the business while balancing the growing need to protect corporate data because of evolving laws, regulations, and cybercrime. IT must ensure that the apps and data on those mobile devices are safe, especially on personal devices. Windows 10 Mobile helps organizations address these challenges by providing a robust, flexible, built-in MDM client. IT departments can use the MDM system of their choice to manage this client. + ### Built-in MDM client + The built-in MDM client is common to all editions of the Windows 10 operating system, including desktop, mobile, and Internet of Things (IoT). The client provides a single interface through which you can manage any device that runs Windows 10. The client has two important roles: device enrollment in an MDM system and device management. + - **Device enrollment.** Users can enroll in the MDM system. On Windows 10, a user can register a device with Microsoft Azure Active Directory (Azure AD) and enroll in an MDM system at the same time so that the system can manage the device, the apps running on it, and the confidential data it holds. Enrollment establishes the management authority for the device. Only one management authority (or MDM enrollment) is possible at a time, which helps prevent unauthorized access to devices and ensures their stability and reliability. - **Device management.** The MDM client allows the MDM system to configure policy settings; deploy apps and updates; and perform other management tasks, such as remotely wiping the device. The MDM system sends configuration requests and collects inventory through the MDM client. The client uses [configuration service providers (CSPs)](http://go.microsoft.com/fwlink/p/?LinkId=734049) to configure and inventory settings. A CSP is an interface to read, set, modify, or delete configuration settings on the device. These settings map to registry keys or files. (The security architecture of Windows 10 Mobile prevents direct access to registry settings and operating system files. For more information, see the [Windows 10 Mobile security guide](../keep-secure/windows-10-mobile-security-guide.md).) + The MDM client is an integral part of Windows 10 Mobile. As a result, there is no need for an additional, custom MDM app to enroll the device or to allow an MDM system to manage it. All MDM systems have equal access to Windows 10 Mobile MDM application programming interfaces (APIs), so you can choose Microsoft Intune or a third-party MDM product to manage Windows 10 Mobile devices. For more information about Windows 10 Mobile device management APIs, see [Mobile device management](http://go.microsoft.com/fwlink/p/?LinkId=734050). + ### Windows 10 Mobile editions + Every device that runs Windows 10 Mobile includes all the enterprise mobile device security and management capabilities the MDM client provides. Microsoft also offers an Enterprise edition of Windows 10 Mobile, which includes three additional capabilities. To enable these capabilities, you can provision a license file without reinstalling the operating system: + - **Ability to postpone software updates.**Windows 10 Mobile gets software updates directly from Windows Update, and you cannot curate updates prior to deployment. Windows 10 Mobile Enterprise, however, allows you to curate and validate updates prior to deploying them. - **No limit on the number of self-signed LOB apps that you can deploy to a single device.** To use an MDM system to deploy LOB apps directly to devices, you must cryptographically sign the software packages with a code signing certificate that your organization’s certificate authority (CA) generates. You can deploy a maximum of 20 self-signed LOB apps to a Windows 10 Mobile device, more than 20 if your organization’s devices run Windows 10 Mobile Enterprise. - **Set telemetry to security level.** The telemetry security level configures the operating system to gather only the telemetry information required to keep devices secured. -**Note**   -Your organization can opt to purchase a code signing certificate from Verisign to sign LOB apps or use [Windows Store for Business](windows-store-for-business.md) to obtain apps. With either method, you can distribute more than 20 apps to a single device without activating Windows 10 Mobile Enterprise on that device by using your MDM system. + +>**Note:**  Your organization can opt to purchase a code signing certificate from Verisign to sign LOB apps or use [Windows Store for Business](windows-store-for-business.md) to obtain apps. With either method, you can distribute more than 20 apps to a single device without activating Windows 10 Mobile Enterprise on that device by using your MDM system.   To activate Windows 10 Mobile Enterprise on any Windows 10 Mobile device, use your company’s MDM system or a provisioning package to inject a license onto the device. You can download a Windows 10 Mobile Enterprise license from the Business Support Portal. + ### Lifecycle management + Windows 10 Mobile supports end-to-end lifecycle device management to give companies control of their devices, data, and apps. Comprehensive MDM systems use the built-in MDM client to manage devices throughout their lifecycle, as Figure 1 illustrates. The remainder of this guide describes the operating system’s mobile device and app management capabilities through each phase of the lifecycle, showing how MDM systems use specific features. + ![figure 1](images/win10-mobile-mdm-fig1.png) + Figure 1. Device management lifecycle + ## Device deployment + Device deployment includes the initial registration and configuration of the device, including its enrollment with an MDM system. Sometimes, companies preinstall apps. The major factors in how you deploy devices and which controls you put in place are device ownership and how the user will use the device. This guide covers two scenarios: + 1. Companies allow users to personalize their devices because the users own the devices or because company policy doesn’t require tight controls (defined as *personal devices* in this guide). 2. Companies don’t allow users to personalize their devices or they limit personalization, usually because the organization owns the devices and security considerations are high (defined as *corporate devices* in this guide). + Often, employees can choose devices from a list of supported models, or companies provide devices that they preconfigure, or bootstrap, with a baseline configuration. + Microsoft recommends Azure AD Join and MDM enrollment and management for corporate devices and Azure AD Registration and MDM enrollment and management for personal devices. + ### Deployment scenarios + Most organizations support both personal and corporate device scenarios. The infrastructure for these scenarios is similar, but the deployment process and configuration policies differ. Table 1 describes characteristics of the personal and corporate device scenarios. Activation of a device with an organizational identity is unique to Windows 10 Mobile. + Table 1. Characteristics of personal and corporate device scenarios + @@ -75,10 +101,14 @@ Table 1. Characteristics of personal and corporate device scenarios
        ### Identity management + People can use only one account to activate a device, so it’s imperative that your organization control which account you enable first. The account you choose will determine who controls the device and influence your management capabilities. The following list describes the impact that users’ identities have on management (Table 2 summarizes these considerations): + - **Personal identity.** In this scenario, employees use their Microsoft account to activate the device. Then, they use their Azure AD account (organizational identity) to register the device in Azure AD and enroll it with the company’s MDM solution. You can apply policies to help protect and contain corporate apps and data on the devices, designed to prevent intellectual property leaks, but users keep full control over personal activities, such as downloading and installing apps and games. - **Organizational identity.** In this scenario, employees use their Azure AD account to register the device to Azure AD and automatically enroll it with the organization’s MDM solution. In this case, companies can block personal use of devices. Using organizational Identities to initialize devices gives organizations complete control over devices and allows them to prevent personalization. + Table 2. Personal vs. organizational identity + @@ -127,33 +157,45 @@ Table 2. Personal vs. organizational identity
        ### Infrastructure requirements + For both device scenarios, the essential infrastructure and tools required to deploy and manage Windows 10 Mobile devices include an Azure AD subscription and an MDM system. + Azure AD is a cloud-based directory service that provides identity and access management. You can integrate it with existing on-premises directories to create a hybrid solution. Azure AD has three editions: Free, Basic, and Premium (see [Azure Active Directory editions](http://go.microsoft.com/fwlink/p/?LinkId=723980)). All editions support Azure AD device registration, but the Premium edition is required to enable MDM auto-enrollment and conditional access based on device state. Organizations that use Microsoft Office 365 or Intune are already using Azure AD. -**Note**   -Most industry-leading MDM vendors already support integration with Azure AD or are working on integration. You can find the MDM vendors that support Azure AD in [Azure Marketplace](http://go.microsoft.com/fwlink/p/?LinkId=723981). + +>**Note:**  Most industry-leading MDM vendors already support integration with Azure AD or are working on integration. You can find the MDM vendors that support Azure AD in [Azure Marketplace](http://go.microsoft.com/fwlink/p/?LinkId=723981).   Users can enroll Windows 10 Mobile devices in third-party MDM systems without using an Azure AD organizational account. (By default, Intune uses Azure AD and includes a license). If your organization doesn’t use Azure AD, you must use a personal identity to activate devices and enable common scenarios, such as downloading apps from Windows Store. + Multiple MDM systems that support Windows 10 Mobile are available. Most support personal and corporate device deployment scenarios. Microsoft offers [Intune](http://go.microsoft.com/fwlink/p/?LinkId=723983), which is part of the [Enterprise Mobility Suite](http://go.microsoft.com/fwlink/p/?LinkId=723984) and a cloud-based MDM system that manages devices off premises. Like Office 365, Intune uses Azure AD for identity management, so employees use the same credentials to enroll devices in Intune or sign in to Office 365. Intune supports devices that run other operating systems, as well, such as iOS and Android, to provide a complete MDM solution. + You can also integrate Intune with System Center Configuration Manager to gain a single console in which to manage all devices—in the cloud and on premises. For more information, see [Manage Mobile Devices with Configuration Manager and Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkId=734051). For guidance on choosing between a stand-alone Intune installation and Intune integrated with Configuration Manager, see [Choose between Intune by itself or integrating Intune with System Center Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=723985). In addition to Intune, other MDM providers support Windows 10 Mobile. Currently, the following MDM systems claim to support Windows 10 and Windows 10 Mobile: [AirWatch](http://go.microsoft.com/fwlink/p/?LinkId=723986), [Citrix](http://go.microsoft.com/fwlink/p/?LinkId=723987), [Lightspeed Systems](http://go.microsoft.com/fwlink/p/?LinkId=723988), [Matrix42](http://go.microsoft.com/fwlink/p/?LinkId=723989), [MobileIron](http://go.microsoft.com/fwlink/p/?LinkId=723990), [SAP](http://go.microsoft.com/fwlink/p/?LinkId=723991), [SOTI](http://go.microsoft.com/fwlink/p/?LinkId=723992), and [Symantec](http://go.microsoft.com/fwlink/p/?LinkId=723993). + All MDM vendors have equal access to the [Windows 10 MDM APIs](http://go.microsoft.com/fwlink/p/?LinkId=734050). The extent to which they implement these APIs depends on the vendor. Contact your preferred MDM vendor to determine its level of support. -**Note**   -Although not covered in this guide, you can use Exchange ActiveSync (EAS) to manage mobile devices instead of using a full-featured MDM system. EAS is available in Microsoft Exchange Server 2010 or later and Office 365. + +>**Note:**  Although not covered in this guide, you can use Exchange ActiveSync (EAS) to manage mobile devices instead of using a full-featured MDM system. EAS is available in Microsoft Exchange Server 2010 or later and Office 365. In addition, Microsoft recently added MDM capabilities powered by Intune to Office 365. MDM for Office 365 supports mobile devices only, such as those running Windows 10 Mobile, iOS, and Android. MDM for Office 365 offers a subset of the management capabilities found in Intune, including the ability to remotely wipe a device, block a device from accessing Exchange Server email, and configure device policies (for example, passcode requirements). For more information about MDM for Office 365 capabilities, see [Overview of Mobile Device Management for Office 365](http://go.microsoft.com/fwlink/p/?LinkId=734052).   ### Provisioning + Provisioning is new to Windows 10 and uses the MDM client in Windows 10 Mobile. You can create a runtime provisioning package to apply settings, profiles, and file assets to a device running Windows 10. To assist users with MDM system enrollment, use a provisioning package. To do so, use the [Windows Imaging and Configuration Designer](http://go.microsoft.com/fwlink/p/?LinkId=733911) to create a provisioning package, and then install that package on the device. Users can perform self-service MDM enrollment based on the following deployment scenarios: + - **Corporate device.** During the out-of-the-box experience (OOBE), you can instruct the user to select **This device is owned by my organization** and join the device to Azure AD and the MDM system. - **Personal device.** The user activates the device with a Microsoft account, but you can instruct him or her to register the device with Azure AD and enroll in Intune. To do so in Windows 10 Mobile, the user clicks, **Settings**, clicks **Accounts**, and then clicks **Work access**. To automate MDM enrollment, use provisioning packages as follows: - **Corporate device.** You can create a provisioning package and apply it to a corporate device before delivery to the user, or instruct the user to apply the package during OOBE. After application of the provisioning package, the OOBE process automatically chooses the enterprise path and requires the user to register the device with Azure AD and enroll it in the MDM system. - **Personal device.** You can create a provisioning package and make it available to users who want to enroll their personal device in the enterprise. The user enrolls the device in the corporate MDM for further configuration by applying the provisioning package. To do so in Windows 10 Mobile, the user clicks **Settings**, clicks **Accounts**, and then clicks **Provisioning**). + Distribute provisioning packages to devices by publishing them in an easily accessible location (e.g., an email attachment or a web page). You can cryptographically sign or encrypt provisioning packages and require that the user enter a password to apply them. + See [Build and apply a provisioning package](http://go.microsoft.com/fwlink/p/?LinkId=734054) for more information on creating provisioning packages. + ## Device configuration + The following sections describe the device configuration capabilities of the built-in Windows 10 Mobile MDM client. This client exposes the capabilities to any MDM system compatible with Windows 10. Configurable settings include: + - [Email accounts](#email) - [Account restrictions](#restrictions) - [Device lock restrictions](#device-lock) @@ -165,13 +207,17 @@ The following sections describe the device configuration capabilities of the bui - [Access point name (APN) profiles](#apn) - [Data leak prevention](#data) - [Storage management](#storage) -**Note**   -Although all the MDM settings this section describes are available in Windows 10 Mobile, not all MDM systems may show them in their user interface. In addition, naming may vary among MDM systems. Consult your MDM system’s documentation for more information. + +>**Note:**  Although all the MDM settings this section describes are available in Windows 10 Mobile, not all MDM systems may show them in their user interface. In addition, naming may vary among MDM systems. Consult your MDM system’s documentation for more information.   ### Email accounts + You can use your corporate MDM system to manage corporate email accounts. Define email account profiles in the MDM system, and then deploy them to devices. You would usually deploy these settings immediately after enrollment, regardless of scenario. + This capability extends to email systems that use EAS. Table 3 lists settings that you can configure in EAS email profiles. + Table 3. Windows 10 Mobile settings for EAS email profiles + | Setting | Description | |----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Email Address | The email address associated with the EAS account | @@ -191,7 +237,9 @@ Table 3. Windows 10 Mobile settings for EAS email profiles | Content Types | The content type that is synchronized (e.g., email, contacts, calendar, task items) |   Table 4 lists settings that you can configure in other email profiles. + Table 4. Windows 10 Mobile settings for other email profiles + | Setting | Description | |-------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------| | User logon name | The user logon name for the email account | @@ -224,21 +272,26 @@ Table 4. Windows 10 Mobile settings for other email profiles | Incoming and outgoing servers require SSL | A group of properties that specify whether the incoming and outgoing email servers use SSL |   ### Account restrictions + On a corporate device registered with Azure AD and enrolled in the MDM system, you can control whether users can use a Microsoft account or add other consumer email accounts. Table 5 lists the settings that you can use to manage accounts on Windows 10 Mobile devices. + Table 5. Windows 10 Mobile account management settings -| Setting | Description | -|-------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Allow Microsoft Account | Specifies whether users are allowed to add a Microsoft account to the device after MDM enrollment and use this account for connection authentication and services, such as purchasing apps in Windows Store, or cloud-based consumer services, such as Xbox or Groove. If a device was activated with a Microsoft account, the MDM system would not be able to block that account from being used. | -| Allow Adding Non Microsoft Accounts | Specifies whether users are allowed to add email accounts other than Microsoft accounts after MDM enrollment. If **Allow Microsoft Account** is applied, user can also not use a Microsoft account. | -| Allow “Your Account” | Specifies whether users are able to change account configuration in the **Your Email and Accounts** panel in Settings. | +| Setting | Description | +| - | -| +| Allow Microsoft Account | Specifies whether users are allowed to add a Microsoft account to the device after MDM enrollment and use this account for connection authentication and services, such as purchasing apps in Windows Store, or cloud-based consumer services, such as Xbox or Groove. If a device was activated with a Microsoft account, the MDM system would not be able to block that account from being used. | +| Allow Adding Non Microsoft Accounts | Specifies whether users are allowed to add email accounts other than Microsoft accounts after MDM enrollment. If **Allow Microsoft Account** is applied, user can also not use a Microsoft account. | +| Allow “Your Account” | Specifies whether users are able to change account configuration in the **Your Email and Accounts** panel in Settings.|   ### Device lock restrictions + It’s common sense to lock a device when it is not in use. Microsoft recommends that you secure Windows 10 Mobile devices and implement a device lock policy. A device password or PIN lock is a best practice for securing apps and data on devices. [Windows Hello](http://go.microsoft.com/fwlink/p/?LinkId=723994) is the name given to the new biometric sign-in option that allows users to use their face, iris, or fingerprints to unlock their compatible device, all of which Windows 10 supports. -**Note**   -In addition to the device lock restrictions discussed in this section, Windows 10 supports Microsoft Passport for Work, which lets you access apps and services without a password. + +>**Note:**  In addition to the device lock restrictions discussed in this section, Windows 10 supports Microsoft Passport for Work, which lets you access apps and services without a password.   Table 6 lists the MDM settings in Windows 10 Mobile that you can use to configure device lock restrictions. + Table 6. Windows 10 Mobile device lock restrictions + @@ -314,9 +367,10 @@ Table 6. Windows 10 Mobile device lock restrictions
        ### Hardware restrictions + Windows 10 Mobile devices use state-of-the-art technology that includes popular hardware features such as cameras, global positioning system (GPS) sensors, microphones, speakers, near-field communication (NFC) radios, storage card slots, USB interfaces, Bluetooth interfaces, cellular radios, and Wi-Fi. You can also use hardware restrictions to control the availability of these features. Table 7 lists the MDM settings that Windows 10 Mobile supports to configure hardware restrictions. -**Note**   -Some of these hardware restrictions provide connectivity and assist in data protection. Enterprise data protection is currently being tested in select customer evaluation programs. + +>**Note:**  Some of these hardware restrictions provide connectivity and assist in data protection. Enterprise data protection is currently being tested in select customer evaluation programs.   Table 7. Windows 10 Mobile hardware restrictions | Setting | Description | @@ -338,8 +392,11 @@ Table 7. Windows 10 Mobile hardware restrictions | Allow Location | Whether the device can use the GPS sensor or other methods to determine location so applications can use location information |   ### Certificate management + Managing certificates can be difficult for users, but certificates are pervasive for a variety of uses, including, account authentication, Wi-Fi authentication, VPN encryption, and SSL encryption of web content. Although users could manage certificates on devices manually, it’s a best practice to use your MDM system to manage those certificates for their entire life cycle, from enrollment through renewal to revocation. You can use the Simple Certificate Enrollment Protocol (SCEP) and Personal Information Exchange (PFX) certificates files to install certificates on Windows 10 Mobile. Certificate management through SCEP and MDM systems is fully transparent to users and requires no user intervention, so it helps improve user productivity and reduce support calls. Your MDM system can automatically deploy these certificates to the devices’ certificate stores after you enroll the device. Table 8 lists the SCEP settings that the MDM client in Windows 10 Mobile provides. + Table 8. Windows 10 Mobile SCEP certificate enrollment settings + | Setting | Description | |------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Certificate enrollment server URLs | The certificate enrollment servers (to specify multiple server URLs, separate the URLs with semicolons \[;\]) | @@ -361,7 +418,9 @@ Table 8. Windows 10 Mobile SCEP certificate enrollment settings | Thumbprint | The current certificate thumbprint, if certificate enrollment succeeds |   In addition to SCEP certificate management, Windows 10 Mobile supports deployment of PFX certificates. Table 9 lists the Windows 10 Mobile PFX certificate deployment settings. + Table 9. Windows 10 Mobile PFX certificate deployment settings + | Setting | Description | |-----------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Private key storage | Where to store the private key (in other words, the TPM, a software KSP, or the Microsoft Passport KSP) | @@ -373,8 +432,9 @@ Table 9. Windows 10 Mobile PFX certificate deployment settings | Thumbprint | The thumbprint of the installed PFX certificate |   Use the **Allow Manual Root Certificate Installation** setting to prevent users from manually installing root and intermediate CA certificates intentionally or accidently. -**Note**   -To diagnose certificate-related issues on Windows 10 Mobile devices, use the free [Certificates app](http://go.microsoft.com/fwlink/p/?LinkId=723996) in Windows Store. This Windows 10 Mobile app can help you: + +>**Note:**  To diagnose certificate-related issues on Windows 10 Mobile devices, use the free [Certificates app](http://go.microsoft.com/fwlink/p/?LinkId=723996) in Windows Store. This Windows 10 Mobile app can help you: + - View a summary of all personal certificates. - View the details of individual certificates. - View the certificates used for VPN, Wi-Fi, and email authentication. @@ -383,9 +443,13 @@ To diagnose certificate-related issues on Windows 10 Mobile devices, use the fr - View the certificate keys stored in the device TPM.   ### Wi-Fi + People use Wi-Fi on their mobile devices as much as or more than cellular data. Most corporate Wi-Fi networks require certificates and other complex information to restrict and secure user access. This advanced Wi-Fi information is difficult for typical users to configure, but you can use your MDM system to fully configure Wi-Fi settings without user intervention. + Table 10 lists the Windows 10 Mobile Wi-Fi connection profile settings. Use the information in this table to help you create Wi-Fi connection profiles in your MDM system. + Table 10. Windows 10 Mobile Wi-Fi connection profile settings + @@ -456,7 +520,9 @@ Table 10. Windows 10 Mobile Wi-Fi connection profile settings
        Table 11 lists the Windows 10 Mobile settings for managing Wi-Fi connectivity. + Table 11. Windows 10 Mobile Wi-Fi connectivity settings + | Setting | Configuration | |--------------------------------------------|----------------------------------------------------------------------------| | Allow Auto Connect To Wi-Fi Sense Hotspots | Whether the device will automatically detect and connect to Wi-Fi networks | @@ -465,12 +531,15 @@ Table 11. Windows 10 Mobile Wi-Fi connectivity settings | WLAN Scan Mode | How actively the device scans for Wi-Fi networks |   ### Proxy + Apps running on Windows 10 Mobile (for example, Microsoft Edge) can use proxy connections to access Internet content, but Wi-Fi connections on the corporate intranet most typically use proxy connections, instead. You can define multiple proxies in Windows 10 Mobile. -**Note**   -Windows 10 Mobile also supports proxy auto-configuration (PAC) files, which can automatically configure proxy settings. The Web Proxy Auto-Discovery Protocol (WPAD) lets apps use Dynamic Host Configuration Protocol and Domain Name System (DNS) lookups to locate the PAC file. + +>**Note:**  Windows 10 Mobile also supports proxy auto-configuration (PAC) files, which can automatically configure proxy settings. The Web Proxy Auto-Discovery Protocol (WPAD) lets apps use Dynamic Host Configuration Protocol and Domain Name System (DNS) lookups to locate the PAC file.   Table 12 lists the Windows 10 Mobile settings for proxy connections. + Table 12. Windows 10 Mobile proxy connection settings + @@ -538,14 +607,21 @@ Table 12. Windows 10 Mobile proxy connection settings
        ### VPN -In addition to Wi-Fi, users often use a VPN to securely access apps and resources on their company’s intranet behind a firewall. Windows 10 Mobile supports several VPN vendors in addition to native Microsoft VPNs (such as Point to Point Tunneling Protocol \[PPTP\], Layer 2 Tunneling Protocol \[L2TP\], and Internet Key Exchange Protocol version 2 \[IKEv2\]), including: + +In addition to Wi-Fi, users often use a VPN to securely access apps and resources on their company’s intranet behind a firewall. Windows 10 Mobile supports several VPN vendors in addition to native Microsoft VPNs (such as Point to Point Tunneling Protocol \[PPTP\], Layer 2 Tunneling Protocol \ +[L2TP\], and Internet Key Exchange Protocol version 2 \[IKEv2\]), including: + - IKEv2 - IP security - SSL VPN connections (which require a downloadable plug-in from the VPN server vendor) + You can configure Windows 10 Mobile to use auto-triggered VPN connections, as well. You define a VPN connection for each app that requires intranet connectivity. When users switch between apps, the operating system automatically establishes the VPN connection for that app. In the event the device drops the VPN connection, Windows 10 Mobile automatically reconnects to the VPN without user intervention. + With always-on VPN, Windows 10 Mobile can automatically start a VPN connection when a user signs-in, as well. The VPN stays connected until the user manually disconnects it. MDM support for VPN connections in Windows 10 Mobile includes provisioning and updating VPN connection profiles and associating VPN connections with apps. You can create and provision VPN connection profiles, and then deploy them to managed devices that run Windows 10 Mobile. Table 13 lists the Windows 10 Mobile fields for VPN connection profiles. + Table 13. Windows 10 Mobile VPN connection profile settings + @@ -680,7 +756,9 @@ Table 13. Windows 10 Mobile VPN connection profile settings
        Table 14 lists the Windows 10 Mobile settings for managing VPN connections. These settings help you manage VPNs over cellular data connections, which in turn help reduce costs associated with roaming or data plan charges. + Table 14. Windows 10 Mobile VPN management settings + | Setting | Description | |--------------------------------------|---------------------------------------------------------------------------------| | Allow VPN | Whether users can change VPN settings | @@ -688,10 +766,15 @@ Table 14. Windows 10 Mobile VPN management settings | Allow VPN Over Cellular when Roaming | Whether users can establish VPN connections over cellular networks when roaming |   ### APN profiles + An APN defines network paths for cellular data connectivity. Typically, you define just one APN for a device in collaboration with a mobile operator, but you can define multiple APNs if your company uses multiple mobile operators. + An APN provides a private connection to the corporate network that is unavailable to other companies on the mobile operator network. Corporations in Europe and the Asia-Pacific use APNs, but they are not common in the United States. + You can define and deploy APN profiles in MDM systems that configure cellular data connectivity for Windows 10 Mobile. Devices running Windows 10 Mobile can have only one APN profile. Table 15 lists the MDM settings that Windows 10 Mobile supports for APN profiles. + Table 15. Windows 10 Mobile APN profile settings + @@ -753,8 +836,12 @@ Table 15. Windows 10 Mobile APN profile settings
        ### Data leak protection -Some user experiences can risk corporate data stored on corporate devices. For example, allowing users to copy and paste information out of the organization’s LOB app can put data at risk. To mitigate the risk, you can restrict the Windows 10 Mobile user experience to help protect corporate data and prevent data leaks. For example, you can prevent settings synchronization, copy-and-paste operations, and screen captures. Table 16 lists the MDM settings in Windows 10 Mobile that you can use to help prevent data leaks. + +Some user experiences can risk corporate data stored on corporate devices. For example, allowing users to copy and paste information out of the organization’s LOB app can put data at risk. To mitigate the risk, you can restrict the Windows 10 Mobile user experience to help protect corporate data +and prevent data leaks. For example, you can prevent settings synchronization, copy-and-paste operations, and screen captures. Table 16 lists the MDM settings in Windows 10 Mobile that you can use to help prevent data leaks. + Table 16. Windows 10 Mobile data leak protection settings + | Setting | Description | |----------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Allow copy and paste | Whether users can copy and paste content | @@ -769,13 +856,19 @@ Table 16. Windows 10 Mobile data leak protection settings | Allow voice recording | Whether users are allowed to perform voice recordings. |   ### Storage management + Protecting the apps and data stored on a device is critical to device security. One method for helping protect your apps and data is to encrypt internal device storage by using the device encryption in Windows 10 Mobile. This encryption helps protect corporate data against unauthorized access, even when an unauthorized user has physical possession of the device. + A feature in Windows 10 Mobile is the ability to install apps on a secure digital (SD) card. The operating system stores apps on a partition specifically designated for that purpose. This feature is always on, so you don’t need to set a policy explicitly to enable it. The SD card is uniquely paired with a device. No other devices can see the apps or data on the encrypted partition, but they can access the data stored on the unencrypted partition of the SD card, such as music or photos. You can disable the **Allow Storage Card** setting to prevent users from using SD cards altogether, but the primary advantage of the SD card app partition–encryption feature is that organizations can give users the flexibility to use an SD card while still protecting the confidential apps and data on it. + If you don’t encrypt storage, you can help protect your corporate apps and data by using the **Restrict app data to the system volume** and **Restrict apps to the system volume** settings. They help ensure that users cannot copy your apps and data to SD cards. + Table 17 lists the MDM storage-management settings that Windows 10 Mobile provides. + Table 17. Windows 10 Mobile storage management settings + @@ -826,33 +919,52 @@ Table 17. Windows 10 Mobile storage management settings
        ## App management + Apps help improve user productivity on mobile devices. New to Windows 10 is the ability for organizations purchase apps from Windows Store for their employees and deploy those apps from Windows Store or an MDM system. App management is becoming a key capability of MDM systems, helping reduce the effort required to perform common app-related tasks, such as distributing apps, and protecting data through app policies. This section describes the app management features in Windows 10 Mobile and includes the following topics: + - [Universal Windows Platform (UWP)](#uwp) - [Sourcing the right app](#sourcing) - [Windows Store for Business](#store) - [Mobile application management (MAM) policies](#mam) - [Microsoft Edge](#edge) + ### Universal Windows Platform + Windows 10 introduces UWP, converging the application platform for all devices running some edition of Windows 10. UWP apps run without modification on all editions of Windows 10, and Windows Store now has apps that you can license and purchased for all your Windows 10 devices. Windows Phone 8.1 and Windows 8.1 apps still run on Windows 10 devices, but the MAM improvements in Windows 10 work only with UWP apps. See the [Guide to Universal Windows Platform (UWP) apps](http://go.microsoft.com/fwlink/p/?LinkId=734056) for additional information. + ### Sourcing the right app + The first step in app management is to obtain the apps your users need, and you can now acquire apps from Windows Store. Developers can also create apps specific to an organization, known as *line-of-business (LOB) apps* (the developers of these apps are *LOB publishers*). An LOB developer (internal or external) can now publish these apps to Windows Store at your request, or you can obtain the app packages offline and distribute them through your MDM system. + To install Windows Store or LOB apps, use the Windows Store cloud service or your MDM system to distribute the app packages. Your MDM system can deploy apps online by redirecting the user to a licensed app in Windows Store or offline by distributing a package that you downloaded from Windows Store (also called *sideloading*) on Windows 10 Mobile devices. You can fully automate the app deployment process so that no user intervention is required. + IT administrators can obtain apps through Store for Business. Most apps can be distributed online, meaning that the user must be logged in to the device with an Azure AD account and have Internet access at the time of installation. To distribute an app offline, the developer must opt in. If the app developer doesn’t allow download of the app from Windows Store, then you must obtain the files directly from the developer or use the online method. See [Windows Store for Business](windows-store-for-business.md) for additional information about apps obtained through Store for Business. Windows Store apps are automatically trusted. For custom LOB apps developed internally or by a trusted software vendor, ensure that the device trusts the app signing certificate. There are two ways to establish this trust: use a signing certificate from a trusted source, or generate your own signing certificate and add your chain of trust to the trusted certificates on the device. You can install up to 20 self-signed apps on a Windows 10 Mobile device. When you purchase a signing certificate from a public CA, you can install more than 20 apps on a device, although you can install more than 20 self-signed apps per device with [Windows 10 Mobile Enterprise](#mobile-edition). + Users can install apps from Windows Store that the organization purchases through the Store app on their device. If you allow your users to log in with a Microsoft account, the Store app on the device provides a unified method for installing personal and corporate apps. + ### Store for Business + [Windows Store for Business](http://go.microsoft.com/fwlink/p/?LinkId=722910) is a web portal that IT pros and purchasers use to find, acquire, manage, and distribute apps to Windows 10 devices. This online portal gives Azure AD authenticated managers access to Store for Business functionality and settings. Store managers can create a private section of Windows Store in which organizations can manage apps specific and private to them. Store for Business allows organizations to make apps available to their users and purchase app licenses for them. They can also integrate their Store for Business subscriptions with their MDM systems, so the MDM system can deploy apps from their free Store for Business subscription. + The process for using Store for Business is as follows: + 1. Create a Store for Business subscription for your organization. 2. In the Store for Business portal, acquire apps from Windows Store (only free apps are available at this time). 3. In Store for Business, distribute apps to users, and manage the app licenses for the apps acquired in the previous step. 4. Integrate your MDM system with your organization’s Store for Business subscription. 5. Use your MDM system to deploy the apps. + For more information about Store for Business, see [Windows Store for Business](windows-store-for-business.md). + ### Mobile application management (MAM) policies + With MDM, you can manage Device Guard on Windows 10 Mobile and create an allow (whitelist) or deny (blacklist) list of apps. This capability extends to built-in apps, as well, such as phone, text messaging, email, and calendar. The ability to allow or deny apps helps to ensure that people use their mobile devices for their intended purposes. + You can also control users’ access to Windows Store and whether the Store service updates apps automatically. You can manage all these capabilities through your MDM system. Table 18 lists the Windows 10 Mobile app management settings. + Table 18. Windows 10 Mobile app management settings + | Setting | Description | |------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Allow All Trusted Apps | Whether users can sideload apps on the device | @@ -868,9 +980,13 @@ Table 18. Windows 10 Mobile app management settings | Start screen layout | An XML blob used to configure the Start screen (See [Start layout for Windows 10 Mobile editions](http://go.microsoft.com/fwlink/p/?LinkId=734057) for more information.) |   One potential security issue is that users can register as Windows 10 Mobile app developers and turn on developer features on their device, potentially installing apps from unknown sources and opening the device to malware threats. To prevent users from turning on developer features on their devices, set the **Disable development unlock (side loading)** policy, which you can configure through your MDM system. + ### Microsoft Edge + MDM systems give you the ability to manage Microsoft Edge on mobile devices. Table 19 lists the Microsoft Edge settings for Windows 10 Mobile. + Table 19. Microsoft Edge settings for Windows 10 Mobile + | Setting | Description | |-------------------------------------------------|-------------------------------------------------------------------------------------------------------| | Allow Active Scripting | Whether active scripting is allowed | @@ -886,16 +1002,24 @@ Table 19. Microsoft Edge settings for Windows 10 Mobile | Prevent Smart Screen Prompt Override For Files | Whether users can override the SmartScreen Filter warnings about downloading unverified files |   ## Device operations + In this section, you learn how MDM settings in Windows 10 Mobile enable the following scenarios: + - [Device update](#device-update) - [Device compliance monitoring](#device-comp) - [Device inventory](#data-inv) - [Remote assistance](#remote-assist) - [Cloud services](#cloud-serv) + ### Device update + To help protect mobile devices and their data, you must keep those devices updated. Windows Update automatically installs updates and upgrades when they become available. -The device update features described in this section are available only in [Windows 10 Mobile Enterprise](#mobile-edition). You can use your MDM system to postpone system upgrades when you activate an Enterprise license on managed Windows 10 Mobile devices and control how updates and upgrades are applied. For example, you can disable updates altogether, defer updates and upgrades, and schedule the day and time to install updates, as you would with Windows Server Update Services (WSUS) on Windows 10 desktops running the [Current Branch for Business](introduction-to-windows-10-servicing.md). Table 20 lists the Windows 10 Mobile Enterprise settings that you can use to configure updates and upgrades. + +The device update features described in this section are available only in [Windows 10 Mobile Enterprise](#mobile-edition). You can use your MDM system to postpone system upgrades when you activate an Enterprise license on managed Windows 10 Mobile devices and control how updates and upgrades are applied. For example, you can disable updates altogether, defer updates and upgrades, and schedule the day and time to install updates, as you would with Windows Server Update Services (WSUS) on Windows 10 desktops running the [Current Branch for Business](introduction-to-windows-10-servicing.md). +Table 20 lists the Windows 10 Mobile Enterprise settings that you can use to configure updates and upgrades. + Table 20. Windows 10 Mobile Enterprise update management settings + @@ -968,7 +1092,9 @@ Table 20. Windows 10 Mobile Enterprise update management settings
        In addition to configuring how Windows 10 Mobile Enterprise obtains updates, you can manage individual Windows 10 Mobile updates. Table 21 provides information about approved updates to help you control the rollout of new updates to Windows 10 Mobile Enterprise devices. + Table 21. Windows 10 Mobile Enterprise approved update information + @@ -1025,25 +1151,36 @@ Table 21. Windows 10 Mobile Enterprise approved update information
        + ### Device compliance monitoring + You can use your MDM system to monitor compliance. Windows 10 Mobile provides audit information to track issues or perform remedial actions. This information helps you ensure that devices are configured to comply with organizational standards. + You can also assess the health of devices that run Windows 10 Mobile and take enterprise policy actions. The process that the health attestation feature in Windows 10 Mobile uses is as follows: + 1. The health attestation client collects data used to verify device health. 2. The client forwards the data to the Health Attestation Service (HAS). 3. The HAS generates a Health Attestation Certificate. 4. The client forwards the Health Attestation Certificate and related information to the MDM system for verification. + For more information about health attestation in Windows 10 Mobile, see the [Windows 10 Mobile security guide](../keep-secure/windows-10-mobile-security-guide.md). + Depending on the results of the health state validation, an MDM system can take one of the following actions: + - Allow the device to access resources. - Allow the device to access resources but identify the device for further investigation. - Prevent the device from accessing resources. + Table 21 lists data points that the HAS collects and evaluates from devices that run Windows 10 Mobile to determine the action to perform. For most of these data points, the MDM system can take one of the following actions: + - Disallow all access. - Disallow access to high-business-impact assets. - Allow conditional access based on other data points that are present at evaluation time—for example, other attributes on the health certificate or a device’s past activities and trust history. - Take one of the previous actions, and also place the device on a watch list to monitor it more closely for potential risks. - Take corrective action, such as informing IT administrators to contact the owner and investigate the issue. + Table 21. Windows 10 Mobile HAS data points + | Data point | Description | |----------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Attestation Identity Key (AIK) present | Indicates that an AIK is present (in other words, the device can be trusted more than a device without an AIK). | @@ -1062,38 +1199,46 @@ Table 21. Windows 10 Mobile HAS data points | Boot cycle whitelist | The view of the host platform between boot cycles as defined by the manufacturer compared to a published whitelist. A device that complies with the whitelist is more trustworthy (secure) than a device that is noncompliant. |   ### Device inventory + Device inventory helps organizations better manage devices because it provides in-depth information about those devices. MDM systems collect inventory information remotely, and you can use the system’s reporting capabilities to analyze device resources and information. With this information, you can determine the current hardware and software resources of the device (for example, installed updates). + Table 22 lists examples of the Windows 10 Mobile software and hardware information that a device inventory provides. In addition to this information, the MDM system can read any of the configuration settings described in this guide. + Table 22. Windows 10 Mobile software and hardware inventory examples -| Setting | Description | -|----------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Installed enterprise apps | List of the enterprise apps installed on the device | -| Device name | The device name configured for the device | -| Firmware version | Version of firmware installed on the device | -| Operating system version | Version of the operating system installed on the device | -| Device local time | Local time on the device | -| Processor type | Processor type for the device | -| Device model | Model of the device as defined by the manufacturer | -| Device manufacturer | Manufacturer of the device | -| Device processor architecture | Processor architecture for the device | -| Device language | Language in use on the device | -| Phone number | Phone number assigned to the device | -| Roaming status | Indicates whether the device has a roaming cellular connection | -| International mobile equipment identity (IMEI) and international mobile subscriber identity (IMSI) | Unique identifiers for the cellular connection for the phone; Global System for Mobile Communications networks identify valid devices by using the IMEI, and all cellular networks use the IMSI to identify the device and user | -| Wi-Fi IP address | IPv4 and IPv6 addresses currently assigned to the Wi-Fi adapter in the device | -| Wi-Fi media access control (MAC) address | MAC address assigned to the Wi-Fi adapter in the device | -| Wi-Fi DNS suffix and subnet mask | DNS suffix and IP subnet mask assigned to the Wi-Fi adapter in the device | -| Secure Boot state | Indicates whether Secure Boot is enabled | -| Enterprise encryption policy compliance | Indicates whether the device is encrypted | + +| Setting | Description | +| - | - | +| Installed enterprise apps | List of the enterprise apps installed on the device | +| Device name | The device name configured for the device | +| Firmware version | Version of firmware installed on the device | +| Operating system version | Version of the operating system installed on the device | +| Device local time | Local time on the device | +| Processor type | Processor type for the device | +| Device model | Model of the device as defined by the manufacturer | +| Device manufacturer | Manufacturer of the device | +| Device processor architecture | Processor architecture for the device | +| Device language | Language in use on the device | +| Phone number | Phone number assigned to the device | +| Roaming status | Indicates whether the device has a roaming cellular connection | +| International mobile equipment identity (IMEI) and international mobile subscriber identity (IMSI) | Unique identifiers for the cellular connection for the phone; Global System for Mobile Communications networks identify valid devices by using the IMEI, and all cellular networks use the IMSI to identify the device and user | | IPv4 and IPv6 addresses currently assigned to the Wi-Fi adapter in the device | +| Wi-Fi media access control (MAC) address | MAC address assigned to the Wi-Fi adapter in the device | +| Wi-Fi DNS suffix and subnet mask | DNS suffix and IP subnet mask assigned to the Wi-Fi adapter in the device | +| Secure Boot state | Indicates whether Secure Boot is enabled | +| Enterprise encryption policy compliance | Indicates whether the device is encrypted |   ### Remote assistance + The remote assistance features in Windows 10 Mobile help resolve issues that users might encounter even when the help desk does not have physical access to the device. These features include: + - **Remote lock.** Support personnel can remotely lock a device. This ability can help when a user loses his or her mobile device and can retrieve it but not immediately (for example, leaving the device at a customer site). - **Remote PIN reset.** Support personnel can remotely reset the PIN, which helps when users forget their PIN and are unable to access their device. No corporate or user data is lost, and users are able to gain access to their devices quickly. - **Remote ring.** Support personnel can remotely make devices ring. This ability can help users locate misplaced devices and, in conjunction with the Remote Lock feature, help ensure that unauthorized users are unable to access the device if they find it. - **Remote find.** Support personnel can remotely locate a device on a map, which helps identify the geographic location of the device. To configure Windows 10 Mobile remote find, use the settings in Table 23. The remote find feature returns the most current latitude, longitude, and altitude of the device. + These remote management features help organizations reduce the IT effort required to manage devices. They also help users quickly regain use of their device should they misplace it or forget the device password. + Table 23. Windows 10 Mobile remote find settings + | Setting | Description | |---------------------------|---------------------------------------------------------------------------------------------------------------------------------| | Desired location accuracy | The desired accuracy as a radius value in meters; has a value between 1 and 1,000 meters | @@ -1101,37 +1246,49 @@ Table 23. Windows 10 Mobile remote find settings | Remote find timeout | The number of seconds devices should wait for a remote find to finish; has a value between 0 and 1,800 seconds |   ### Cloud services + On mobile devices that run Windows 10 Mobile, users can easily connect to apps and data. As a result, they frequently connect to cloud services that provide user notifications and collect telemetry (usage data). Windows 10 Mobile enables organizations to manage how devices consume these cloud services. + **Manage push notifications** + The Windows Push Notification Services enable software developers to send toast, tile, badge, and raw updates from their cloud services. It provides a mechanism to deliver updates to users in a power-efficient and dependable way. Push notifications can affect battery life, however, so the battery saver in Windows 10 Mobile limits background activity on the devices to extend battery life. Users can configure battery saver to turn on automatically when the battery drops below a set threshold. When battery saver is on, Windows 10 Mobile disables the receipt of push notifications to save energy. + There is an exception to this behavior, however. In Windows 10 Mobile, the **Always allowed** battery saver settings (found in the Settings app) allow apps to receive push notifications even when battery saver is on. Users can manually configure this list, or you can use the MDM system to configure it—that is, you can use the battery saver settings URI scheme in Windows 10 Mobile (**ms-settings:batterysaver-settings**) to configure these settings. For more information about push notifications, see [Windows Push Notification Services (WNS) overview](http://go.microsoft.com/fwlink/p/?LinkId=734060). + **Manage telemetry** + As people use Windows 10 Mobile, it can collect performance and usage telemetry that helps Microsoft identify and troubleshoot problems as well as improve its products and services. Microsoft recommends that you select **Full** for this setting. Microsoft employees, contractors, vendors, and partners might have access to relevant portions of the information that Windows 10 Mobile collects, but they are permitted to use the information only to repair or improve Microsoft products and services or third-party software and hardware designed for use with Microsoft products and services. + You can control the level of data that MDM systems collect. Table 24 lists the data levels that Windows 10 Mobile collects and provides a brief description of each. To configure devices, specify one of these levels in the **Allow Telemetry** setting. Table 24. Windows 10 Mobile data collection levels -| Level of data | Description | -|---------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Security | Collects only the information required to keep Windows 10 Mobile enterprise-grade secure, including information about telemetry client settings, the Malicious Software Removal Tool, and Windows Defender. This level is available only on Windows 10 Enterprise, Windows 10 Education, and Windows 10 IoT Core. For Windows 10 Mobile, this setting disables Windows 10 Mobile telemetry. | +| Level of data | Description | +|- | - | +| Security | Collects only the information required to keep Windows 10 Mobile enterprise-grade secure, including information about telemetry client settings, the Malicious Software Removal Tool, and Windows Defender. This level is available only on Windows 10 Enterprise, Windows 10 Education, and Windows 10 IoT Core. For Windows 10 Mobile, this setting disables Windows 10 Mobile telemetry. | | Basic | Provides only the data vital to the operation of Windows 10 Mobile. This data level helps keep Windows 10 Mobile and apps running properly by letting Microsoft know the device’s capabilities, what’s installed, and whether Windows is operating correctly. This option also turns on basic error reporting back to Microsoft. By selecting this option, you allow Microsoft to provide updates through Windows Update, including malicious software protection through the Malicious Software Removal Tool. | | Enhanced | Includes all Basic data plus data about how users use Windows 10 Mobile, such as how frequently or how long they use certain features or apps and which apps they use most often. This option also lets operating system collect enhanced diagnostic information, such as the memory state of a device when a system or app crash occurs, and measure reliability of devices, the operating system, and apps. | | Full | Includes all Basic and Enhanced data and also turns on advanced diagnostic features that collect additional data from devices, such as system files or memory snapshots, which may unintentionally include parts of documents user are working on when a problem occurred. This information helps Microsoft further troubleshoot and fix problems. If an error report contains personal data, Microsoft does not use that information to identify, contact, or target advertising to users. |   ## Device retirement + Device retirement (unenrollment) is the last phase of the device life cycle. Historically, mobile device retirement has been a complex and difficult process for organizations. When the organization no longer needs devices, it must remove (wipe) corporate data from them. BYOD scenarios make retirement even more complex because users expect their personal apps and data to remain untouched. Therefore, organizations must remove their data without affecting users’ data. + You can remotely remove all corporate data from devices that run Windows 10 Mobile without affecting existing user data (partial or enterprise wipe). The help desk or the devices’ users can initiate device retirement. When retirement is complete, Windows 10 Mobile returns the devices to a consumer state, as they were before enrollment. The following list summarizes the corporate data removed from a device when it’s retired: + - Email accounts - Enterprise-issued certificates - Network profiles - Enterprise-deployed apps - Any data associated with the enterprise-deployed apps -**Note**   -All these features are in addition to the device’s software and hardware factory reset features, which users can use to restore devices to their factory configuration. + +>**Note:**  All these features are in addition to the device’s software and hardware factory reset features, which users can use to restore devices to their factory configuration.   To specify whether users can delete the workplace account in Control Panel and unenroll from the MDM system, enable the **Allow Manual MDM Unenrollment** setting. Table 25 lists additional Windows 10 remote wipe settings that you can use the MDM system to configure. + Table 25. Windows 10 Mobile remote wipe settings + | Setting | Description | |-------------------------------|----------------------------------------------------------------------------------------------------------------------| | Wipe | Specifies that a remote wipe of the device should be performed | @@ -1139,9 +1296,8 @@ Table 25. Windows 10 Mobile remote wipe settings | Allow user to reset phone | Whether users are allowed to use Control Panel or hardware key combinations to return the device to factory defaults |   ## Related topics -[Mobile device management](http://go.microsoft.com/fwlink/p/?LinkId=734050) -[Enterprise Mobility Suite](http://go.microsoft.com/fwlink/p/?LinkId=723984) -[Overview of Mobile Device Management for Office 365](http://go.microsoft.com/fwlink/p/?LinkId=734052) -[Windows Store for Business](http://go.microsoft.com/fwlink/p/?LinkId=722910) -  -  + +- [Mobile device management](http://go.microsoft.com/fwlink/p/?LinkId=734050) +- [Enterprise Mobility Suite](http://go.microsoft.com/fwlink/p/?LinkId=723984) +- [Overview of Mobile Device Management for Office 365](http://go.microsoft.com/fwlink/p/?LinkId=734052) +- [Windows Store for Business](http://go.microsoft.com/fwlink/p/?LinkId=722910) From ebaf07c2e006a2ac8644c324353a9b08a413590e Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 23 May 2016 14:20:20 -0700 Subject: [PATCH 379/439] moved topic, added Start policy --- windows/manage/TOC.md | 2 +- .../group-policies-for-enterprise-and-education-editions.md | 3 ++- windows/manage/lock-down-windows-10.md | 5 +---- windows/manage/manage-corporate-devices.md | 2 ++ 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/manage/TOC.md b/windows/manage/TOC.md index 64b224d198..621ce3f5ca 100644 --- a/windows/manage/TOC.md +++ b/windows/manage/TOC.md @@ -4,6 +4,7 @@ ## [Cortana integration in your business or enterprise](manage-cortana-in-enterprise.md) ## [Manage corporate devices](manage-corporate-devices.md) ### [New policies for Windows 10](new-policies-for-windows-10.md) +### [Group Policies that apply only to Windows 10 Enterprise and Windows 10 Education](group-policies-for-enterprise-and-education-editions.md) ### [Changes to Group Policy settings for Windows 10 Start](changes-to-start-policies-in-windows-10.md) ### [Windows 10 Mobile and MDM](windows-10-mobile-and-mdm.md) ### [Introduction to configuration service providers (CSPs)](how-it-pros-can-use-configuration-service-providers.md) @@ -25,7 +26,6 @@ #### [Settings and quick actions that can be locked down in Windows 10 Mobile](settings-that-can-be-locked-down.md) #### [Product IDs in Windows 10 Mobile](product-ids-in-windows-10-mobile.md) ### [Reset a Windows 10 Mobile device](reset-a-windows-10-mobile-device.md) -### [Group Policies that apply only to Windows 10 Enterprise and Windows 10 Education](group-policies-for-enterprise-and-education-editions.md) ## [Join Windows 10 Mobile to Azure Active Directory](join-windows-10-mobile-to-azure-active-directory.md) ## [Configure devices without MDM](configure-devices-without-mdm.md) ## [Windows 10 servicing options for updates and upgrades](introduction-to-windows-10-servicing.md) diff --git a/windows/manage/group-policies-for-enterprise-and-education-editions.md b/windows/manage/group-policies-for-enterprise-and-education-editions.md index ee2fd20508..b448b368bd 100644 --- a/windows/manage/group-policies-for-enterprise-and-education-editions.md +++ b/windows/manage/group-policies-for-enterprise-and-education-editions.md @@ -16,4 +16,5 @@ In Windows 10, version 1511, the following Group Policies apply only to Windows | Policy name | Policy path | Comments | | - | - | - | -| Turn off the Store application | Computer Configuration > Administrative Templates > Windows Components > Store > Turn off the Store application

      User Configuration > Administrative Templates > Windows Components > Store > Turn off the Store | For more info, see [Knowledge Base article# 3135657](https://support.microsoft.com/en-us/kb/3135657). \ No newline at end of file +| Turn off the Store application | Computer Configuration > Administrative Templates > Windows Components > Store > Turn off the Store application

      User Configuration > Administrative Templates > Windows Components > Store > Turn off the Store | For more info, see [Knowledge Base article# 3135657](https://support.microsoft.com/en-us/kb/3135657). | +| Start layout | User Configuration\Administrative Templates\Start Menu and Taskbar | For more info, see [Manage Windows 10 Start layout options and policies](windows-10-start-layout-options-and-policies.md) | \ No newline at end of file diff --git a/windows/manage/lock-down-windows-10.md b/windows/manage/lock-down-windows-10.md index f0782128f5..142d9f3824 100644 --- a/windows/manage/lock-down-windows-10.md +++ b/windows/manage/lock-down-windows-10.md @@ -67,10 +67,7 @@ Enterprises often need to manage how people use corporate devices. Windows 10 p

      [Reset a Windows 10 Mobile device](reset-a-windows-10-mobile-device.md)

      There are two methods for resetting a Windows 10 Mobile device: factory reset and "wipe and persist" reset.

      - -

      [Group Policies that apply only to Windows 10 Enterprise and Windows 10 Education](group-policies-for-enterprise-and-education-editions.md)

      -

      New

      - + diff --git a/windows/manage/manage-corporate-devices.md b/windows/manage/manage-corporate-devices.md index 227070a768..bbfa571b02 100644 --- a/windows/manage/manage-corporate-devices.md +++ b/windows/manage/manage-corporate-devices.md @@ -117,6 +117,8 @@ Microsoft Virtual Academy course: [System Center 2012 R2 Configuration Manager & [New policies for Windows 10](new-policies-for-windows-10.md) +[Group Policies that apply only to Windows 10 Enterprise and Windows 10 Education](group-policies-for-enterprise-and-education-editions.md) + [Changes to Group Policy settings for Start in Windows 10](changes-to-start-policies-in-windows-10.md) [Windows 10 Mobile and MDM](windows-10-mobile-and-mdm.md) From fc04d08d94b7d3a85a02645d160245893c82d52a Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 23 May 2016 14:52:19 -0700 Subject: [PATCH 380/439] add lockscreen (spotlight) policy --- .../group-policies-for-enterprise-and-education-editions.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/manage/group-policies-for-enterprise-and-education-editions.md b/windows/manage/group-policies-for-enterprise-and-education-editions.md index b448b368bd..5d5f71e9f1 100644 --- a/windows/manage/group-policies-for-enterprise-and-education-editions.md +++ b/windows/manage/group-policies-for-enterprise-and-education-editions.md @@ -17,4 +17,6 @@ In Windows 10, version 1511, the following Group Policies apply only to Windows | Policy name | Policy path | Comments | | - | - | - | | Turn off the Store application | Computer Configuration > Administrative Templates > Windows Components > Store > Turn off the Store application

      User Configuration > Administrative Templates > Windows Components > Store > Turn off the Store | For more info, see [Knowledge Base article# 3135657](https://support.microsoft.com/en-us/kb/3135657). | -| Start layout | User Configuration\Administrative Templates\Start Menu and Taskbar | For more info, see [Manage Windows 10 Start layout options and policies](windows-10-start-layout-options-and-policies.md) | \ No newline at end of file +| Start layout | User Configuration\Administrative Templates\Start Menu and Taskbar | For more info, see [Manage Windows 10 Start layout options and policies](windows-10-start-layout-options-and-policies.md) | +| Force a specific default lock screen image | Computer Configuration > Administrative Templates > Control Panel > Personalization | For more info, see [Windows spotlight on the lock screen](https://technet.microsoft.com/en-us/itpro/windows/whats-new/windows-spotlight) | + \ No newline at end of file From 4842f352e2fb22931965a0763c083f3eba5fbdd5 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Mon, 23 May 2016 15:46:23 -0700 Subject: [PATCH 381/439] fixing spacing issues --- ...criptor-definition-language-sddl-syntax.md | 87 +++++++++-------- ...criptor-definition-language-sddl-syntax.md | 90 +++++++++--------- windows/keep-secure/debug-programs.md | 91 +++++++++--------- .../keep-secure/delete-an-applocker-rule.md | 21 +++-- ...ccess-to-this-computer-from-the-network.md | 89 +++++++++--------- .../keep-secure/deny-log-on-as-a-batch-job.md | 94 ++++++++++--------- .../keep-secure/deny-log-on-as-a-service.md | 90 +++++++++--------- windows/keep-secure/deny-log-on-locally.md | 86 ++++++++--------- ...-log-on-through-remote-desktop-services.md | 86 ++++++++--------- ...oy-the-applocker-policy-into-production.md | 24 ++++- ...p-policy-structure-and-rule-enforcement.md | 46 +++------ ...igitally-signed-on-a-reference-computer.md | 15 ++- ...ine-your-application-control-objectives.md | 11 ++- windows/keep-secure/manage-tpm-lockout.md | 37 ++++++-- 14 files changed, 471 insertions(+), 396 deletions(-) diff --git a/windows/keep-secure/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md b/windows/keep-secure/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md index 5d4da312b6..6fe17f05af 100644 --- a/windows/keep-secure/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md +++ b/windows/keep-secure/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md @@ -2,86 +2,91 @@ title: DCOM Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax (Windows 10) description: Describes the best practices, location, values, and security considerations for the DCOM Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax policy setting. ms.assetid: 0fe3521a-5252-44df-8a47-8d92cf936e7c -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax** policy setting. + ## Reference + This policy setting allows you to define additional computer-wide controls that govern access to all Distributed Component Object Model (DCOM)–based applications on a device. These controls restrict call, activation, or launch requests on the device. A simple way to think about these access controls is as an additional access check that is performed against a device-wide access control list (ACL) on each call, activation, or launch of any COM-based server. If the access check fails, the call, activation, or launch request is denied. (This check is in addition to any access check that is run against the server-specific ACLs.) In effect, it provides a minimum authorization standard that must be passed to access any COM-based server. This policy setting controls access permissions to cover call rights. + These device-wide ACLs provide a way to override weak security settings that are specified by an application through the CoInitializeSecurity function or application-specific security settings. They provide a minimum security standard that must be passed, regardless of the settings of the specific server. + These ACLs also provide a centralized location for an administrator to set a general authorization policy that applies to all COM-based servers on the device. + This policy setting allows you to specify an ACL in two different ways. You can type the security descriptor in SDDL, or you can grant or deny Local Access and Remote Access permissions to users and groups. We recommend that you use the built-in user interface to specify the ACL contents that you want to apply with this setting. The default ACL settings vary, depending on the version of Windows you are running. + ### Possible values + - *User-defined input* of the SDDL representation of the groups and privileges + When you specify the users or groups that are to be given permissions, the security descriptor field is populated with the Security Descriptor Definition Language representation of those groups and privileges. Users and groups can be given explicit Allow or Deny privileges for local access and remote access. + - Blank + This represents how the local security policy deletes the policy enforcement key. This value deletes the policy and then sets it as Not defined. The Blank value is set by using the ACL editor to empty the list, and then pressing OK. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Blank

      Default Domain Controller Policy

      Blank

      Stand-Alone Server Default Settings

      Blank

      DC Effective Default Settings

      Not defined

      Member Server Effective Default Settings

      Not defined

      Client Computer Effective Default Settings

      Not defined

      + +| Server type or GPO | Default value +| - | - | +| Default Domain Policy | Blank | +| Default Domain Controller Policy | Blank | +| Stand-Alone Server Default Settings | Blank | +| DC Effective Default Settings | Not defined | +| Member Server Effective Default Settings | Not defined | +| Client Computer Effective Default Settings | Not defined |   ## Policy management + This section describes features and tools that are available to help you manage this policy. ### Restart requirement + None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. + ### Group Policy + The registry settings that are created as a result of enabling the **DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax** policy setting take precedence over the previous registry settings when this policy setting was configured. The Remote Procedure Call (RPC) service checks the new registry keys in the Policies section for the computer restrictions, and these registry entries take precedence over the existing registry keys under OLE. This means that previously existing registry settings are no longer effective, and if you make changes to the existing settings, device access permissions for users are not changed. Use care in configuring the list of users and groups. -If the administrator is denied permission to access DCOM applications due to the changes made to DCOM in the Windows operating system, the administrator can use the **DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax** policy setting to manage DCOM access to the computer. The administrator can use this setting to specify which users and groups can access the DCOM application on the computer locally and remotely. This will restore control of the DCOM application to the administrator and users. To do this, open the **DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax** setting, and click **Edit Security**. Specify the users or groups you want to include and the computer access permissions for those users or groups. This defines the setting and sets the appropriate SDDL value. + +If the administrator is denied permission to access DCOM applications due to the changes made to DCOM in the Windows operating system, the administrator can use the **DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax** policy setting to manage DCOM access to the computer. The administrator can use this setting to specify which users and groups can access the DCOM application on the computer locally and remotely. This will restore control of the DCOM application to the administrator and users. To do this, open the **DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax** setting, and click +**Edit Security**. Specify the users or groups you want to include and the computer access permissions for those users or groups. This defines the setting and sets the appropriate SDDL value. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Many COM applications include some security-specific code (for example, to call CoInitializeSecurity), but they use weak settings that allow unauthenticated access to the process. Administrators cannot override these settings to force stronger security in earlier versions of Windows without modifying the application. An attacker could attempt to exploit weak security in an individual application by attacking it through COM calls. + Also, the COM infrastructure includes the Remote Procedure Call Services (RPCSS), a system service that runs during and after computer startup. This service manages activation of COM objects and the running object table and provides helper services to DCOM remoting. It exposes RPC interfaces that can be called remotely. Because some COM-based servers allow unauthenticated remote access, these interfaces can be called by anyone, including unauthenticated users. As a result, RPCSS can be attacked by malicious users who use remote, unauthenticated computers. + ### Countermeasure + To protect individual COM-based applications or services, set the **DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax** setting to an appropriate device-wide ACL. + ### Potential impact + Windows implements default COM ACLs when they are installed. Modifying these ACLs from the default may cause some applications or components that communicate by using DCOM to fail. If you implement a COM-based server and you override the default security settings, confirm that the application-specific call permissions that ACL assigns are the correct permissions for appropriate users. If it does not, you must change your application-specific permission ACL to provide appropriate users with activation rights so that applications and Windows components that use DCOM do not fail. + ## Related topics -[Security Options](security-options.md) + +- [Security Options](security-options.md)     diff --git a/windows/keep-secure/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md b/windows/keep-secure/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md index ec95e60bb9..d4c42764a5 100644 --- a/windows/keep-secure/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md +++ b/windows/keep-secure/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md @@ -2,86 +2,90 @@ title: DCOM Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax (Windows 10) description: Describes the best practices, location, values, and security considerations for the DCOM Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax security policy setting. ms.assetid: 4b95d45f-dd62-4c34-ba32-43954528dabe -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft + --- + # DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax** security policy setting. + ## Reference + This policy setting is similar to the [DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax](dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md) setting in that it allows you to define additional computer-wide controls that govern access to all DCOM–based applications on a device. However, the ACLs that are specified in this policy setting control local and remote COM launch requests (not access requests) on the device. A simple way to think about this access control is as an additional access check that is performed against a device-wide ACL on each launch of any COM-based server. If the access check fails, the call, activation, or launch request is denied. (This check is in addition to any access check that is run against the server-specific ACLs.) In effect, it provides a minimum authorization standard that must be passed to launch any COM-based server. The DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax policy setting differs in that it provides a minimum access check that is applied to attempts to access an already launched COM-based server. + These device-wide ACLs provide a way to override weak security settings that are specified by an application through CoInitializeSecurity or application-specific security settings. They provide a minimum security standard that must be passed, regardless of the settings of the specific COM-based server. These ACLs provide a centralized location for an administrator to set a general authorization policy that applies to all COM-based servers. -The **DCOM: Machine Launch Restrictions in the Security Descriptor Definition Language (SDDL) syntax** setting allows you to specify an ACL in two ways. You can type the security descriptor in SDDL, or you can grant or deny Local Access and Remote Access permissions to users and groups. We recommend that you use the built-in user interface to specify the ACL contents that you want to apply with this setting. The default ACL settings vary, depending on the version of Windows you are running. +The **DCOM: Machine Launch Restrictions in the Security Descriptor Definition Language (SDDL) syntax** setting allows you to specify an ACL in two ways. You can type the security descriptor in SDDL, or you can grant or deny Local +Access and Remote Access permissions to users and groups. We recommend that you use the built-in user interface to specify the ACL contents that you want to apply with this setting. The default ACL settings vary, depending on the version of Windows you are running. + ### Possible values + - Blank + This represents how the local security policy deletes the policy enforcement key. This value deletes the policy and then sets it to Not defined. The Blank value is set by using the ACL editor to empty the list, and then pressing OK. + - *User-defined input* of the SDDL representation of the groups and privileges + When you specify the users or groups that are to be given permission, the security descriptor field is populated with the Security Descriptor Definition Language representation of those groups and privileges. Users and groups can be given explicit Allow or Deny privileges on both local access and remote access. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Blank

      Default Domain Controller Policy

      Blank

      Stand-Alone Server Default Settings

      Blank

      DC Effective Default Settings

      Not defined

      Member Server Effective Default Settings

      Not defined

      Client Computer Effective Default Settings

      Not defined

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Blank | +| Default Domain Controller Policy | Blank| +| Stand-Alone Server Default Settings |Blank | +| DC Effective Default Settings | Not defined| +| Member Server Effective Default Settings | Not defined | +| Client Computer Effective Default Settings | Not defined|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. + ### Group Policy + The registry settings that are created as a result of this policy take precedence over the previous registry settings in this area. The Remote Procedure Call (RPC) service (RpcSs) checks the new registry keys in the Policies section for the computer restrictions; these entries take precedence over the existing registry keys under OLE. + If you are denied access to activate and launch DCOM applications due to the changes made to DCOM in the Windows operating system, this policy setting can be used to control the DCOM activation and launch to the device. + You can specify which users and groups can launch and activate DCOM applications on the device locally and remotely by using the **DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax** policy setting. This restores control of the DCOM application to the administrator and specified users. To do this, open the **DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax** setting, and click **Edit Security**. Specify the groups that you want to include and the device launch permissions for those groups. This defines the setting and sets the appropriate SDDL value. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Many COM applications include some security-specific code (for example, to call CoInitializeSecurity), but they use weak settings that allow unauthenticated access to the process. You cannot override these settings to force stronger security in earlier versions of Windows without modifying the application. An attacker could attempt to exploit weak security in an individual application by attacking it through COM calls. + Also, the COM infrastructure includes the Remote Procedure Call Service (RPCSS), a system service that runs during computer startup and always runs after that. This service manages activation of COM objects and the running object table and provides helper services to DCOM remoting. It exposes RPC interfaces that can be called remotely. Because some COM-based servers allow unauthenticated remote component activation, these interfaces can be called by anyone, including unauthenticated users. As a result, RPCSS can be attacked by malicious users using remote, unauthenticated computers. + ### Countermeasure + To protect individual COM-based applications or services, set this policy setting to an appropriate computer-wide ACL. + ### Potential impact + Windows implements default COM ACLs when they are installed. Modifying these ACLs from the default may cause some applications or components that communicate by using DCOM to fail. If you implement a COM-based server and you override the default security settings, confirm that the application-specific launch permissions ACL assigns include activation permissions to appropriate users. If it does not, you must change your application-specific launch permission ACL to provide appropriate users with activation rights so that applications and Windows components that use DCOM do not fail. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/debug-programs.md b/windows/keep-secure/debug-programs.md index cfcafef2b9..4b133fd251 100644 --- a/windows/keep-secure/debug-programs.md +++ b/windows/keep-secure/debug-programs.md @@ -2,88 +2,91 @@ title: Debug programs (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Debug programs security policy setting. ms.assetid: 594d9f2c-8ffc-444b-9522-75615ec87786 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Debug programs + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Debug programs** security policy setting. + ## Reference + This policy setting determines which users can attach to or open any process, even those they do not own. Developers who are debugging their own applications do not need to be assigned this user right. Developers who are debugging new system components need this user right. This user right provides access to sensitive and critical operating-system components. + Constant: SeDebugPrivilege + ### Possible values + - User-defined list of accounts - Not defined + ### Best practices + - Assign this user right only to trusted users to reduce security vulnerabilities. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default, members of the Administrators group have this right. + The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Administrators

      Stand-Alone Server Default Settings

      Administrators

      Domain Controller Effective Default Settings

      Administrators

      Member Server Effective Default Settings

      Administrators

      Client Computer Effective Default Settings

      Administrators

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Administrators | +| Stand-Alone Server Default Settings | Administrators | +| Domain Controller Effective Default Settings | Administrators | +| Member Server Effective Default Settings | Administrators | +| Client Computer Effective Default Settings | Administrators |   ## Policy management + This section describes features and tools that are available to help you manage this policy. + A restart of the device is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability -The **Debug programs** user right can be exploited to capture sensitive device information from system memory or to access and modify kernel or application structures. Some attack tools exploit this user right to extract hashed passwords and other private security information or to insert malware. By default, the **Debug programs** user right is assigned only to administrators, which helps mitigate risk from this vulnerability. + +The **Debug programs** user right can be exploited to capture sensitive device information from system memory or to access and modify kernel or application structures. Some attack tools exploit this user right to extract hashed passwords and other private security information or to insert malware. +By default, the **Debug programs** user right is assigned only to administrators, which helps mitigate risk from this vulnerability. + ### Countermeasure + Remove the accounts of all users and groups that do not require the **Debug programs** user right. + ### Potential impact -If you revoke this user right, no one can debug programs. However, typical circumstances rarely require this capability on production devices. If an issue arises that requires an application to be debugged on a production server, you can move the server to a different organizational unit (OU) temporarily and assign the **Debug programs** user right to a separate Group Policy for that OU. + +If you revoke this user right, no one can debug programs. However, typical circumstances rarely require this capability on production devices. If an issue arises that requires an application to be debugged on a production server, you can move the server to a different organizational unit (OU) +temporarily and assign the **Debug programs** user right to a separate Group Policy for that OU. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/delete-an-applocker-rule.md b/windows/keep-secure/delete-an-applocker-rule.md index 7b34477fad..ad342ee6cf 100644 --- a/windows/keep-secure/delete-an-applocker-rule.md +++ b/windows/keep-secure/delete-an-applocker-rule.md @@ -2,26 +2,33 @@ title: Delete an AppLocker rule (Windows 10) description: This topic for IT professionals describes the steps to delete an AppLocker rule. ms.assetid: 382b4be3-0df9-4308-89b2-dcf9df351eb5 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Delete an AppLocker rule + **Applies to** - Windows 10 + This topic for IT professionals describes the steps to delete an AppLocker rule. + As older apps are retired and new apps are deployed in your organization, it will be necessary to modify the application control policies. If an app becomes unsupported by the IT department or is no longer allowed due to the organization's security policy, then deleting the rule or rules associated with that app will prevent the app from running. + For info about testing an AppLocker policy to see what rules affect which files or applications, see [Test an AppLocker policy by Using Test-AppLockerPolicy](test-an-applocker-policy-by-using-test-applockerpolicy.md). -You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). + +You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer +AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). + **To delete a rule in an AppLocker policy** + 1. Open the AppLocker console. 2. Click the appropriate rule collection for which you want to delete the rule. 3. In the details pane, right-click the rule to delete, click **Delete**, and then click **Yes**. -**Note**   -When using Group Policy, for the rule deletion to take effect on computers within the domain, the GPO must be distributed or refreshed. + +>**Note:**  When using Group Policy, for the rule deletion to take effect on computers within the domain, the GPO must be distributed or refreshed. + When this procedure is performed on the local device, the AppLocker policy takes effect immediately. -  -  -  diff --git a/windows/keep-secure/deny-access-to-this-computer-from-the-network.md b/windows/keep-secure/deny-access-to-this-computer-from-the-network.md index 07247e4be1..df4e48dc46 100644 --- a/windows/keep-secure/deny-access-to-this-computer-from-the-network.md +++ b/windows/keep-secure/deny-access-to-this-computer-from-the-network.md @@ -2,94 +2,99 @@ title: Deny access to this computer from the network (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Deny access to this computer from the network security policy setting. ms.assetid: 935e9f89-951b-4163-b186-fc325682bb0b -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Deny access to this computer from the network + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Deny access to this computer from the network** security policy setting. + ## Reference + This security setting determines which users are prevented from accessing a device over the network. + Constant: SeDenyNetworkLogonRight + ### Possible values + - User-defined list of accounts - Guest + ### Best practices + - Because all Active Directory Domain Services programs use a network logon for access, use caution when you assign this user right on domain controllers. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default, this setting is Guest on domain controllers and on stand-alone servers. + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Guest

      Stand-Alone Server Default Settings

      Guest

      Domain Controller Effective Default Settings

      Guest

      Member Server Effective Default Settings

      Guest

      Client Computer Effective Default Settings

      Guest

      + + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined | +| Default Domain Controller Policy | Guest | +| Stand-Alone Server Default Settings | Guest | +| Domain Controller Effective Default Settings | Guest | +| Member Server Effective Default Settings | Guest | +| Client Computer Effective Default Settings | Guest |   ## Policy management + This section describes features and tools available to help you manage this policy. + A restart of the device is not required for this policy setting to be effective. + This policy setting supersedes the **Access this computer from the network** policy setting if a user account is subject to both policies. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Users who can log on to the device over the network can enumerate lists of account names, group names, and shared resources. Users with permission to access shared folders and files can connect over the network and possibly view or modify data. + ### Countermeasure + Assign the **Deny access to this computer from the network** user right to the following accounts: + - Anonymous logon - Built-in local Administrator account - Local Guest account - All service accounts + An important exception to this list is any service accounts that are used to start services that must connect to the device over the network. For example, let’s say you have configured a shared folder for web servers to access, and you present content within that folder through a website. You may need to allow the account that runs IIS to log on to the server with the shared folder from the network. This user right is particularly effective when you must configure servers and workstations on which sensitive information is handled because of regulatory compliance concerns. + ### Potential impact + If you configure the **Deny access to this computer from the network** user right for other accounts, you could limit the abilities of users who are assigned to specific administrative roles in your environment. You should verify that delegated tasks are not negatively affected. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/deny-log-on-as-a-batch-job.md b/windows/keep-secure/deny-log-on-as-a-batch-job.md index 11dbb9313f..d3abeeb6d5 100644 --- a/windows/keep-secure/deny-log-on-as-a-batch-job.md +++ b/windows/keep-secure/deny-log-on-as-a-batch-job.md @@ -2,92 +2,98 @@ title: Deny log on as a batch job (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Deny log on as a batch job security policy setting. ms.assetid: 0ac36ebd-5e28-4b6a-9b4e-8924c6ecf44b -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Deny log on as a batch job + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Deny log on as a batch job** security policy setting. + ## Reference -This policy setting determines which accounts are prevented from logging on by using a batch-queue tool to schedule and start jobs automatically in the future. The ability to log on by using a batch-queue tool is needed for any account that is used to start scheduled jobs by means of the Task Scheduler. + +This policy setting determines which accounts are prevented from logging on by using a batch-queue tool to schedule and start jobs automatically in the future. The ability to log on by using a batch-queue tool is needed for any account that is used to start scheduled jobs by means of the Task +Scheduler. + Constant: SeDenyBatchLogonRight + ### Possible values + - User-defined list of accounts - Not defined + ### Best practices + 1. When you assign this user right, thoroughly test that the effect is what you intended. 2. Within a domain, modify this setting on the applicable Group Policy Object (GPO). 3. **Deny log on as a batch job** prevents administrators or operators from using their personal accounts to schedule tasks, which helps with business continuity when that person transitions to other positions or responsibilities. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Not defined

      Domain Controller Effective Default Settings

      Not defined

      Member Server Effective Default Settings

      Not defined

      Client Computer Effective Default Settings

      Not defined

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Not defined | +| Stand-Alone Server Default Settings | Not defined | +| Domain Controller Effective Default Settings | Not defined | +| Member Server Effective Default Settings | Not defined | +| Client Computer Effective Default Settings | Not defined |   ## Policy management + This section describes features and tools available to help you manage this policy. + A restart of the device is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + This policy setting might conflict with and negate the **Log on as a batch job** setting. + ### Group Policy + On a domain-joined device, including the domain controller, this policy can be overwritten by a domain policy, which will prevent you from modifying the local policy setting. -For example, if you are trying to configure Task Scheduler on your domain controller, check the Settings tab of your two domain controller policy and domain policy GPOs in the Group Policy Management Console (GPMC). Verify the targeted account is not present in the **Deny log on as a batch job** User Rights Assignment and also correctly configured in the **Log on as a batch job** setting. + +For example, if you are trying to configure Task Scheduler on your domain controller, check the Settings tab of your two domain controller policy and domain policy GPOs in the Group Policy Management Console (GPMC). Verify the targeted account is not present in the **Deny log on as a batch job** + +User Rights Assignment and also correctly configured in the **Log on as a batch job** setting. + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Accounts that have the **Deny log on as a batch job** user right could be used to schedule jobs that could consume excessive computer resources and cause a denial-of-service condition. + ### Countermeasure + Assign the **Deny log on as a batch job** user right to the local Guest account. + ### Potential impact + If you assign the **Deny log on as a batch job** user right to other accounts, you could deny the ability to perform required job activities to users who are assigned specific administrative roles. You should confirm that delegated tasks are not affected adversely. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/deny-log-on-as-a-service.md b/windows/keep-secure/deny-log-on-as-a-service.md index af4556d1b8..8fa66ee734 100644 --- a/windows/keep-secure/deny-log-on-as-a-service.md +++ b/windows/keep-secure/deny-log-on-as-a-service.md @@ -2,91 +2,95 @@ title: Deny log on as a service (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Deny log on as a service security policy setting. ms.assetid: f1114964-df86-4278-9b11-e35c66949794 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Deny log on as a service + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Deny log on as a service** security policy setting. + ## Reference + This policy setting determines which users are prevented from logging on to the service applications on a device. + A service is an application type that runs in the system background without a user interface. It provides core operating system features, such as web serving, event logging, file serving, printing, cryptography, and error reporting. + Constant: SeDenyServiceLogonRight + ### Possible values + - User-defined list of accounts - Not defined + ### Best practices + 1. When you assign this user right, thoroughly test that the effect is what you intended. 2. Within a domain, modify this setting on the applicable Group Policy Object (GPO). + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Not defined

      Domain Controller Effective Default Settings

      Not defined

      Member Server Effective Default Settings

      Not defined

      Client Computer Effective Default Settings

      Not defined

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Not defined | +| Domain Controller Effective Default Settings | Not defined | +| Member Server Effective Default Settings | Not defined | +| Client Computer Effective Default Settings | Not defined |   ## Policy management + This section describes features and tools available to help you manage this policy. + A restart of the computer is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + On a domain-joined device, including the domain controller, this policy can be overwritten by a domain policy, which will prevent you from modifying the local policy setting. + This policy setting might conflict with and negate the **Log on as a service** setting. + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability -Accounts that can log on to a service application could be used to configure and start new unauthorized services, such as a keylogger or other malware. The benefit of the specified countermeasure is somewhat reduced by the fact that only users with administrative rights can install and configure services, and an attacker who has already attained that level of access could configure the service to run by using the System account. + +Accounts that can log on to a service application could be used to configure and start new unauthorized services, such as a keylogger or other malware. The benefit of the specified countermeasure is somewhat reduced by the fact that only users with administrative rights can install and configure +services, and an attacker who has already attained that level of access could configure the service to run by using the System account. + ### Countermeasure + We recommend that you not assign the **Deny log on as a service** user right to any accounts. This is the default configuration. Organizations that are extremely concerned about security might assign this user right to groups and accounts when they are certain that they will never need to log on to a service application. + ### Potential impact + If you assign the **Deny log on as a service** user right to specific accounts, services may not start and a denial-of-service condition could result. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/deny-log-on-locally.md b/windows/keep-secure/deny-log-on-locally.md index e8bc095116..916d358f89 100644 --- a/windows/keep-secure/deny-log-on-locally.md +++ b/windows/keep-secure/deny-log-on-locally.md @@ -2,90 +2,92 @@ title: Deny log on locally (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Deny log on locally security policy setting. ms.assetid: 00150e88-ec9c-43e1-a70d-33bfe10434db -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Deny log on locally + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Deny log on locally** security policy setting. + ## Reference + This policy setting determines which users are prevented from logging on directly at the device's console. + Constant: SeDenyInteractiveLogonRight + ### Possible values + - User-defined list of accounts - Not defined + ### Best practices + 1. Assign the **Deny log on locally** user right to the local guest account to restrict access by potentially unauthorized users. 2. Test your modifications to this policy setting in conjunction with the **Allow log on locally** policy setting to determine if the user account is subject to both policies. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Not defined

      Domain Controller Effective Default Settings

      Not defined

      Member Server Effective Default Settings

      Not defined

      Client Computer Effective Default Settings

      Not defined

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined | +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Not defined| +| Domain Controller Effective Default Settings | Not defined| +| Member Server Effective Default Settings | Not defined| +| Client Computer Effective Default Settings | Not defined|   ## Policy management + This section describes features, tools, and guidance to help you manage this policy. + A restart of the device is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + If you apply this policy setting to the Everyone group, no one will be able to log on locally. + ### Group Policy + This policy setting supersedes the **Allow log on locally** policy setting if a user account is subject to both policies. + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Any account with the ability to log on locally could be used to log on at the console of the device. If this user right is not restricted to legitimate users who must log on to the console of the device, unauthorized users might download and run malicious software that elevates their user rights. + ### Countermeasure + Assign the **Deny log on locally** user right to the local Guest account. If you have installed optional components such as ASP.NET, you may want to assign this user right to additional accounts that are required by those components. + ### Potential impact + If you assign the **Deny log on locally** user right to additional accounts, you could limit the abilities of users who are assigned to specific roles in your environment. However, this user right should explicitly be assigned to the ASPNET account on device that are configured with the Web Server role. You should confirm that delegated activities are not adversely affected. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/deny-log-on-through-remote-desktop-services.md b/windows/keep-secure/deny-log-on-through-remote-desktop-services.md index 85f6651839..6877912bae 100644 --- a/windows/keep-secure/deny-log-on-through-remote-desktop-services.md +++ b/windows/keep-secure/deny-log-on-through-remote-desktop-services.md @@ -2,89 +2,91 @@ title: Deny log on through Remote Desktop Services (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Deny log on through Remote Desktop Services security policy setting. ms.assetid: 84bbb807-287c-4acc-a094-cf0ffdcbca67 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Deny log on through Remote Desktop Services + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Deny log on through Remote Desktop Services** security policy setting. + ## Reference + This policy setting determines which users are prevented from logging on to the device through a Remote Desktop connection through Remote Desktop Services. It is possible for a user to establish a Remote Desktop connection to a particular server, but not be able to log on to the console of that server. + Constant: SeDenyRemoteInteractiveLogonRight + ### Possible values + - User-defined list of accounts - Not defined + ### Best practices + - To control who can open a Remote Desktop connection and log on to the device, add the user account to or remove user accounts from the Remote Desktop Users group. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Not defined

      Domain Controller Effective Default Settings

      Not defined

      Member Server Effective Default Settings

      Not defined

      Client Computer Effective Default Settings

      Not defined

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined | +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Not defined| +| Domain Controller Effective Default Settings | Not defined| +| Member Server Effective Default Settings | Not defined| +| Client Computer Effective Default Settings | Not defined|   ## Policy management + This section describes features, tools, and guidance to help you manage this policy. + A restart of the computer is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + The **Remote System** property controls settings for Remote Desktop Services (**Allow or prevent remote connections to the computer**) and for Remote Assistance (**Allow Remote Assistance connections to this computer**). + ### Group Policy + This policy setting supersedes the [Allow log on through Remote Desktop Services](allow-log-on-through-remote-desktop-services.md) policy setting if a user account is subject to both policies. + Group Policy settings are applied in the following order. They overwrite settings on the local device at the next Group Policy update. + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. Organizational unit policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Any account with the right to log on through Remote Desktop Services could be used to log on to the remote console of the device. If this user right is not restricted to legitimate users who need to log on to the console of the computer, malicious users might download and run software that elevates their user rights. + ### Countermeasure + Assign the **Deny log on through Remote Desktop Services** user right to the built-in local guest account and all service accounts. If you have installed optional components, such as ASP.NET, you may want to assign this user right to additional accounts that are required by those components. + ### Potential impact + If you assign the **Deny log on through Remote Desktop Services** user right to other groups, you could limit the abilities of users who are assigned to specific administrative roles in your environment. Accounts that have this user right cannot connect to the device through Remote Desktop Services or Remote Assistance. You should confirm that delegated tasks are not negatively affected. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/deploy-the-applocker-policy-into-production.md b/windows/keep-secure/deploy-the-applocker-policy-into-production.md index 1fbb0a2cc3..32e3cd0d65 100644 --- a/windows/keep-secure/deploy-the-applocker-policy-into-production.md +++ b/windows/keep-secure/deploy-the-applocker-policy-into-production.md @@ -2,31 +2,45 @@ title: Deploy the AppLocker policy into production (Windows 10) description: This topic for the IT professional describes the tasks that should be completed before you deploy AppLocker application control settings. ms.assetid: ebbb1907-92dc-499e-8cee-8e637483c9ae -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Deploy the AppLocker policy into production + **Applies to** - Windows 10 + This topic for the IT professional describes the tasks that should be completed before you deploy AppLocker application control settings. + After successfully testing and modifying the AppLocker policy for each Group Policy Object (GPO), you are ready to deploy the enforcement settings into production. For most organizations, this means switching the AppLocker enforcement setting from **Audit only** to **Enforce rules**. However, it is important to follow the deployment plan that you created earlier. For more info, see the [AppLocker Design Guide](applocker-policies-design-guide.md). Depending on the needs of different business groups in your organization, you might deploy different enforcement settings for linked GPOs. + ### Understand your design decisions + Before you deploy an AppLocker policy, you should determine: + - For each business group, which applications will be controlled and in what manner. For more info, see [Create a list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md). - How to handle requests for application access. For info about what to consider when developing your support policies, see [Plan for AppLocker policy management](plan-for-applocker-policy-management.md). - How to manage events, including forwarding events. For info about event management in AppLocker, see [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md). - Your GPO structure, including how to include policies generated by Software Restriction Policies and AppLocker policies. For more info, see [Determine the Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md). + For info about how AppLocker deployment is dependent on design decisions, see [Understand AppLocker policy design decisions](understand-applocker-policy-design-decisions.md). + ### AppLocker deployment methods -If you have configured a reference device, you can create and update your AppLocker policies on this device, test the policies, and then export the policies to the appropriate GPO for distribution. Another method is to create the policies and set the enforcement setting on **Audit only**, then observe the events that are generated. + +If you have configured a reference device, you can create and update your AppLocker policies on this device, test the policies, and then export the policies to the appropriate GPO for distribution. Another method is to create the policies and set the enforcement setting on **Audit only**, then +observe the events that are generated. - [Use a reference device to create and maintain AppLocker policies](use-a-reference-computer-to-create-and-maintain-applocker-policies.md) + This topic describes the steps to use an AppLocker reference computer to prepare application control policies for deployment by using Group Policy or other means. + - [Deploy AppLocker policies by using the enforce rules setting](deploy-applocker-policies-by-using-the-enforce-rules-setting.md) + This topic describes the steps to deploy the AppLocker policy by changing the enforcement setting to **Audit only** or to **Enforce rules**. + ## See also -[AppLocker deployment guide](applocker-policies-deployment-guide.md) -  -  + +- [AppLocker deployment guide](applocker-policies-deployment-guide.md) diff --git a/windows/keep-secure/determine-group-policy-structure-and-rule-enforcement.md b/windows/keep-secure/determine-group-policy-structure-and-rule-enforcement.md index 68200b376d..5733fd532e 100644 --- a/windows/keep-secure/determine-group-policy-structure-and-rule-enforcement.md +++ b/windows/keep-secure/determine-group-policy-structure-and-rule-enforcement.md @@ -2,51 +2,33 @@ title: Determine the Group Policy structure and rule enforcement (Windows 10) description: This overview topic describes the process to follow when you are planning to deploy AppLocker rules. ms.assetid: f435fcbe-c7ac-4ef0-9702-729aab64163f -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Determine the Group Policy structure and rule enforcement + **Applies to** - Windows 10 + This overview topic describes the process to follow when you are planning to deploy AppLocker rules. + ## In this section - ---- - - - - - - - - - - - - - - - - - - - - -
      TopicDescription

      [Understand AppLocker enforcement settings](understand-applocker-enforcement-settings.md)

      This topic describes the AppLocker enforcement settings for rule collections.

      [Understand AppLocker rules and enforcement setting inheritance in Group Policy](understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md)

      This topic for the IT professional describes how application control policies configured in AppLocker are applied through Group Policy.

      [Document the Group Policy structure and AppLocker rule enforcement](document-group-policy-structure-and-applocker-rule-enforcement.md)

      This planning topic describes what you need to investigate, determine, and record in your application control policies plan when you use AppLocker.

      + +| Topic | Description | +| - | - | +| [Understand AppLocker enforcement settings](understand-applocker-enforcement-settings.md) | This topic describes the AppLocker enforcement settings for rule collections. | +| [Understand AppLocker rules and enforcement setting inheritance in Group Policy](understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md) | This topic for the IT professional describes how application control policies configured in AppLocker are applied through Group Policy.| +| [Document the Group Policy structure and AppLocker rule enforcement](document-group-policy-structure-and-applocker-rule-enforcement.md) | This planning topic describes what you need to investigate, determine, and record in your application control policies plan when you use AppLocker. |   When you are determining how many Group Policy Objects (GPOs) to create when you apply an AppLocker policy in your organization, you should consider the following: + - Whether you are creating new GPOs or using existing GPOs - Whether you are implementing Software Restriction Policies (SRP) policies and AppLocker policies in the same GPO - GPO naming conventions - GPO size limits -**Note**   -There is no default limit on the number of AppLocker rules that you can create. However, in Windows Server 2008 R2, GPOs have a 2 MB size limit for performance. In subsequent versions, that limit is raised to 100 MB. -  -  -  + +>**Note:**  There is no default limit on the number of AppLocker rules that you can create. However, in Windows Server 2008 R2, GPOs have a 2 MB size limit for performance. In subsequent versions, that limit is raised to 100 MB. diff --git a/windows/keep-secure/determine-which-applications-are-digitally-signed-on-a-reference-computer.md b/windows/keep-secure/determine-which-applications-are-digitally-signed-on-a-reference-computer.md index ad2925ee0a..a02d55ecc7 100644 --- a/windows/keep-secure/determine-which-applications-are-digitally-signed-on-a-reference-computer.md +++ b/windows/keep-secure/determine-which-applications-are-digitally-signed-on-a-reference-computer.md @@ -2,24 +2,35 @@ title: Determine which apps are digitally signed on a reference device (Windows 10) description: This topic for the IT professional describes how to use AppLocker logs and tools to determine which applications are digitally signed. ms.assetid: 24609a6b-fdcb-4083-b234-73e23ff8bcb8 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Determine which apps are digitally signed on a reference device + **Applies to** - Windows 10 + This topic for the IT professional describes how to use AppLocker logs and tools to determine which applications are digitally signed. + The Windows PowerShell cmdlet **Get-AppLockerFileInformation** can be used to determine which apps installed on your reference devices are digitally signed. Perform the following steps on each reference computer that you used to define the AppLocker policy. The device does not need to be joined to the domain. + Membership in the local **Administrators** group, or equivalent, is the minimum required to complete this procedure. + **To determine which apps are digitally signed on a reference device** 1. Run **Get-AppLockerFileInformation** with the appropriate parameters. + The **Get-AppLockerFileInformation** cmdlet retrieves the AppLocker file information from a list of files or from an event log. File information that is retrieved can include publisher information, file hash information, and file path information. File information from an event log may not contain all of these fields. Files that are not signed do not have any publisher information. + 2. Analyze the publisher's name and digital signature status from the output of the command. + For command parameters, syntax, and examples, see [Get-AppLockerFileInformation](http://technet.microsoft.com/library/ee460961.aspx). + ## Related topics -[Use a reference device to create and maintain AppLocker policies](use-a-reference-computer-to-create-and-maintain-applocker-policies.md) + +- [Use a reference device to create and maintain AppLocker policies](use-a-reference-computer-to-create-and-maintain-applocker-policies.md)     diff --git a/windows/keep-secure/determine-your-application-control-objectives.md b/windows/keep-secure/determine-your-application-control-objectives.md index 55e77bdb3b..65098f5d72 100644 --- a/windows/keep-secure/determine-your-application-control-objectives.md +++ b/windows/keep-secure/determine-your-application-control-objectives.md @@ -2,19 +2,26 @@ title: Determine your application control objectives (Windows 10) description: This topic helps you with the decisions you need to make to determine what applications to control and how to control them by comparing Software Restriction Policies (SRP) and AppLocker. ms.assetid: 0e84003e-6095-46fb-8c4e-2065869bb53b -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Determine your application control objectives + **Applies to** - Windows 10 + This topic helps you with the decisions you need to make to determine what applications to control and how to control them by comparing Software Restriction Policies (SRP) and AppLocker. + AppLocker is very effective for organizations with app restriction requirements whose environments have a simple topography and the application control policy goals are straightforward. For example, AppLocker can benefit an environment where non-employees have access to computers connected to the organizational network, such as a school or library. Large organizations also benefit from AppLocker policy deployment when the goal is to achieve a detailed level of control on the PCs that they manage for a relatively small number of apps. + There are management and maintenance costs associated with a list of allowed apps. In addition, the purpose of application control policies is to allow or prevent employees from using apps that might actually be productivity tools. Keeping employees or users productive while implementing the policies can cost time and effort. Lastly, creating user support processes and network support processes to keep the organization productive are also concerns. + Use the following table to develop your own objectives and determine which application control feature best addresses those objectives. + @@ -149,5 +156,3 @@ Use the following table to develop your own objectives and determine which appli
        For more general info, see [AppLocker](applocker-overview.md). -  -  diff --git a/windows/keep-secure/manage-tpm-lockout.md b/windows/keep-secure/manage-tpm-lockout.md index efe696a11e..7c75700ed0 100644 --- a/windows/keep-secure/manage-tpm-lockout.md +++ b/windows/keep-secure/manage-tpm-lockout.md @@ -2,48 +2,73 @@ title: Manage TPM lockout (Windows 10) description: This topic for the IT professional describes how to manage the lockout feature for the Trusted Platform Module (TPM) in Windows. ms.assetid: bf27adbe-404c-4691-a644-29ec722a3f7b -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- # Manage TPM lockout + **Applies to** - Windows 10 + This topic for the IT professional describes how to manage the lockout feature for the Trusted Platform Module (TPM) in Windows. + ## About TPM lockout + The TPM will lock itself to prevent tampering or malicious attacks. TPM lockout often lasts for a variable amount of time or until the computer is turned off. While the TPM is in lockout mode, it generally returns an error message when it receives commands that require an authorization value. One exception is that the TPM always allows the owner at least one attempt to reset the TPM lockout when it is in lockout mode. + TPM ownership is commonly taken the first time BitLocker Drive Encryption is turned on for the computer. In this case, the TPM owner authorization password is saved with the BitLocker recovery key. When the BitLocker recovery key is saved to a file, BitLocker also saves a TPM owner password file (.tpm) with the TPM owner password hash value. When the BitLocker recovery key is printed, the TPM owner password is printed at the same time. You can also save your TPM owner password hash value to Active Directory Domain Services (AD DS) if your organization's Group Policy settings are configured to do so. + In some cases, encryption keys are protected by a TPM by requiring a valid authorization value to access the key. A common example is configuring BitLocker Drive Encryption to use the TPM plus PIN key protector. In this scenario, the user must type the correct PIN during the boot process to access the volume encryption key protected by the TPM. To prevent malicious users or software from discovering authorization values, TPMs implement protection logic. The protection logic is designed to slow or stop responses from the TPM if it detects that an entity might be trying to guess authorization values. + The industry standards from the Trusted Computing Group (TCG) specify that TPM manufacturers must implement some form of protection logic in TPM 1.2 and TPM 2.0 chips. TPM manufacturers implement different protection mechanisms and behavior. The general guidance is for the TPM chip to take exponentially longer to respond if incorrect authorization values are sent to the TPM. Some TPM chips may not store failed attempts over time. Other TPM chips may store every failed attempt indefinitely. Therefore, some users may experience increasingly longer delays when they mistype an authorization value that is sent to the TPM. This can prevent them from using the TPM for a period of time. + If your TPM has entered lockout mode or is responding slowly to commands, you can reset the lockout value by using the following procedures. Resetting the TPM lockout requires the TPM owner’s authorization. + ## Reset the TPM lockout by using the TPM MMC + The following procedure explains the steps to reset the TPM lockout by using the TPM MMC. + **To reset the TPM lockout** + 1. Open the TPM MMC (tpm.msc). 2. In the **Action** pane, click **Reset TPM Lockout** to start the Reset TPM Lockout Wizard. 3. Choose one of the following methods to enter the TPM owner password: - If you saved your TPM owner password to a .tpm file, click **I have the owner password file**, and then type the path to the file, or click **Browse** to navigate to the file location. - If you want to manually enter your TPM owner password, click **I want to enter the owner password**, and then type the password in the text box provided. - **Note**   - If you enabled BitLocker and your TPM at the same time, and you printed your BitLocker recovery password when you turned on BitLocker, your TPM owner password may have printed with it. + + >**Note:**  If you enabled BitLocker and your TPM at the same time, and you printed your BitLocker recovery password when you turned on BitLocker, your TPM owner password may have printed with it.   ## Use Group Policy to manage TPM lockout settings + The TPM Group Policy settings in the following list are located at: + **Computer Configuration\\Administrative Templates\\System\\Trusted Platform Module Services\\** + - [Standard User Lockout Duration](trusted-platform-module-services-group-policy-settings.md#bkmk-individual) + This policy setting allows you to manage the duration in minutes for counting standard user authorization failures for TPM commands that require authorization. An authorization failure occurs each time a user sends a command to the TPM and receives an error message that indicates an authorization failure occurred. Authorization failures that are older than the duration you set are ignored. If the number of TPM commands with an authorization failure within the lockout duration equals a threshold, the user is prevented from sending commands to the TPM that require authorization. + - [Standard User Individual Lockout Threshold](trusted-platform-module-services-group-policy-settings.md#bkmk-tpmgp-suld) + This policy setting allows you to manage the maximum number of authorization failures for the TPM for each user. This value is the maximum number of authorization failures that each user can have before the user is not allowed to send commands to the TPM that require authorization. If the number of authorization failures equals the duration that is set for the policy setting, the user is prevented from sending commands to the TPM that require authorization. + - [Standard User Total Lockout Threshold](trusted-platform-module-services-group-policy-settings.md#bkmk-total) + This policy setting allows you to manage the maximum number of authorization failures for the TPM for all standard users. If the total number of authorization failures for all users equals the duration that is set for the policy, all users are prevented from sending commands to the TPM that require authorization. + For information about mitigating dictionary attacks that use the lockout settings, see [TPM fundamentals](tpm-fundamentals.md#bkmk-howtpmmitigates). + ## Use the TPM cmdlets + If you are using Windows PowerShell to manage your computers, you can also manage the TPM by using Windows PowerShell. To install the TPM cmdlets, type the following command: + **dism /online /enable-feature /FeatureName:tpm-psh-cmdlets** + For details about the individual cmdlets, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx). + ## Additional resources -For more info about TPM, see [TPM technology overview](trusted-platform-module-overview.md#bkmk-additionalresources). -  -  + +For more info about TPM, see [TPM technology overview](trusted-platform-module-overview.md#bkmk-additionalresources). \ No newline at end of file From 7535ffb5ab884c5d1eec7e433a0e2cdbd5c93451 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Mon, 23 May 2016 15:57:29 -0700 Subject: [PATCH 382/439] fixing spacing issues --- ...s-allow-undock-without-having-to-log-on.md | 82 +++++++++--------- ...wed-to-format-and-eject-removable-media.md | 83 +++++++++--------- ...t-users-from-installing-printer-drivers.md | 84 +++++++++---------- ...m-access-to-locally-logged-on-user-only.md | 83 +++++++++--------- 4 files changed, 159 insertions(+), 173 deletions(-) diff --git a/windows/keep-secure/devices-allow-undock-without-having-to-log-on.md b/windows/keep-secure/devices-allow-undock-without-having-to-log-on.md index 1283cb2181..0d237c5cd4 100644 --- a/windows/keep-secure/devices-allow-undock-without-having-to-log-on.md +++ b/windows/keep-secure/devices-allow-undock-without-having-to-log-on.md @@ -2,84 +2,78 @@ title: Devices Allow undock without having to log on (Windows 10) description: Describes the best practices, location, values, and security considerations for the Devices Allow undock without having to log on security policy setting. ms.assetid: 1d403f5d-ad41-4bb4-9f4a-0779c1c14b8c -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Devices: Allow undock without having to log on + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Devices: Allow undock without having to log on** security policy setting. + ## Reference + This policy setting enables or disables the ability of a user to remove a portable device from a docking station without logging on. If you enable this policy setting, users can press a docked portable device's physical eject button to safely undock the device. If you disable this policy setting, the user must log on to receive permission to undock the device. Only users who have the **Remove Computer from Docking Station** privilege can obtain this permission. -**Note**   -Disabling this policy setting only reduces theft risk for portable devices that cannot be mechanically undocked. Devices that can be mechanically undocked can be physically removed by the user whether or not they use the Windows undocking functionality. + +>**Note:**  Disabling this policy setting only reduces theft risk for portable devices that cannot be mechanically undocked. Devices that can be mechanically undocked can be physically removed by the user whether or not they use the Windows undocking functionality.   Enabling this policy setting means that anyone with physical access to a device that has been placed in its docking station can remove the computer and possibly tamper with it. For devices that do not have docking stations, this policy setting has no impact. However, for users with a mobile computer that is normally docked while they are in the office, this policy setting will help lower the risk of equipment theft or a malicious user gaining physical access to these devices + ### Possible values + - Enabled - Disabled - Not defined + ### Best practices + It is advisable to disable the **Devices: Allow undock without having to log on** policy setting. Users who have docked their devices will have to log on to the local console before they can undock their systems. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Enabled

      DC Effective Default Settings

      Enabled

      Member Server Effective Default Settings

      Enabled

      Client Computer Effective Default Settings

      Enabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Not defined | +| Stand-Alone Server Default Settings | Enabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings | Enabled| +| Client Computer Effective Default Settings| Enabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + If this policy setting is enabled, anyone with physical access to portable computers in docking stations could remove them and possibly tamper with them. + ### Countermeasure + Disable the **Devices: Allow undock without having to log on** setting. ### Potential impact + Users who have docked their device must log on to the local console before they can undock their computers. For devices that do not have docking stations, this policy setting has no impact. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/devices-allowed-to-format-and-eject-removable-media.md b/windows/keep-secure/devices-allowed-to-format-and-eject-removable-media.md index 146ef13dde..9c9a232738 100644 --- a/windows/keep-secure/devices-allowed-to-format-and-eject-removable-media.md +++ b/windows/keep-secure/devices-allowed-to-format-and-eject-removable-media.md @@ -2,82 +2,79 @@ title: Devices Allowed to format and eject removable media (Windows 10) description: Describes the best practices, location, values, and security considerations for the Devices Allowed to format and eject removable media security policy setting. ms.assetid: d1b42425-7244-4ab1-9d46-d68de823459c -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Devices: Allowed to format and eject removable media + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Devices: Allowed to format and eject removable media** security policy setting. + ## Reference + This policy setting determines who is allowed to format and eject removable media. + Users can move removable disks to a different device where they have administrative user rights and then take ownership of any file, assign themselves full control, and view or modify any file. The advantage of configuring this policy setting is diminished by the fact that most removable storage devices will eject media with the press of a button. + ### Possible values + - Administrators - Administrators and Power Users - Administrators and Interactive Users (not applicable to Windows Server 2008 R2 or Windows 7 and later) - Not defined + ### Best practices + - It is advisable to set **Allowed to format and eject removable media** to **Administrators**. Only administrators will be able to eject NTFS-formatted removable media. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Administrators

      DC Effective Default Settings

      Administrators

      Member Server Effective Default Settings

      Administrators

      Client Computer Effective Default Settings

      Not defined

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Administrators| +| DC Effective Default Settings | Administrators| +| Member Server Effective Default Settings | Administrators| +| Client Computer Effective Default Settings | Not defined|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability -Users could move data on removable disks to a different computer where they have administrative privileges. The user could then take ownership of any file, grant themselves full control, and view or modify any file. The fact that most removable storage devices eject media when a mechanical button is pressed diminishes the advantage of this policy setting. + +Users could move data on removable disks to a different computer where they have administrative privileges. The user could then take ownership of any file, grant themselves full control, and view or modify any file. The fact that most removable storage devices eject media when a mechanical button +is pressed diminishes the advantage of this policy setting. + ### Countermeasure + Configure the **Devices: Allowed to format and eject removable media** setting to **Administrators**. + ### Potential impact + Only administrators can format and eject removable media. If users are in the habit of using removable media for file transfers and storage, they must be informed of the change in policy. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/devices-prevent-users-from-installing-printer-drivers.md b/windows/keep-secure/devices-prevent-users-from-installing-printer-drivers.md index 9a31968fed..c71b4b04d5 100644 --- a/windows/keep-secure/devices-prevent-users-from-installing-printer-drivers.md +++ b/windows/keep-secure/devices-prevent-users-from-installing-printer-drivers.md @@ -2,82 +2,80 @@ title: Devices Prevent users from installing printer drivers (Windows 10) description: Describes the best practices, location, values, and security considerations for the Devices Prevent users from installing printer drivers security policy setting. ms.assetid: ab70a122-f7f9-47e0-ad8c-541f30a27ec3 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Devices: Prevent users from installing printer drivers + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Devices: Prevent users from installing printer drivers** security policy setting. + ## Reference + For a device to print to a network printer, the driver for that network printer must be installed locally. The **Devices: Prevent users from installing printer drivers** policy setting determines who can install a printer driver as part of adding a network printer. When you set the value to **Enabled**, only Administrators and Power Users can install a printer driver as part of adding a network printer. Setting the value to **Disabled** allows any user to install a printer driver as part of adding a network printer. This setting prevents unprivileged users from downloading and installing an untrusted printer driver. + This setting has no impact if you have configured a trusted path for downloading drivers. When using trusted paths, the print subsystem attempts to use the trusted path to download the driver. If the trusted path download succeeds, the driver is installed on behalf of any user. If the trusted path download fails, the driver is not installed and the network printer is not added. + Although it might be appropriate in some organizations to allow users to install printer drivers on their own workstations, this is not suitable for servers. Installing a printer driver on a server can cause the system to become less stable. Only administrators should have this user right on servers. A malicious user might deliberately try to damage the system by installing inappropriate printer drivers. + ### Possible values + - Enabled - Disabled - Not defined + ### Best practices + - It is advisable to set **Devices: Prevent users from installing printer drivers** to Enabled. Only users in the Administrative, Power User, or Server Operator groups will be able to install printers on servers. If this policy setting is enabled, but the driver for a network printer already exists on the local computer, users can still add the network printer. This policy setting does not affect a user's ability to add a local printer. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Enabled

      DC Effective Default Settings

      Enabled

      Member Server Effective Default Settings

      Enabled

      Client Computer Effective Default Settings

      Disabled

      + +Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Enabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings | Enabled| +| Client Computer Effective Default Settings | Disabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability -It may be appropriate in some organizations to allow users to install printer drivers on their own workstations. However, you should allow only administrators, not users, to do so on servers because printer driver installation on a server may unintentionally cause the computer to become less stable. A malicious user could install inappropriate printer drivers in a deliberate attempt to damage the computer, or a user might accidentally install malicious software that masquerades as a printer driver. + +It may be appropriate in some organizations to allow users to install printer drivers on their own workstations. However, you should allow only administrators, not users, to do so on servers because printer driver installation on a server may unintentionally cause the computer to become less +stable. A malicious user could install inappropriate printer drivers in a deliberate attempt to damage the computer, or a user might accidentally install malicious software that masquerades as a printer driver. + ### Countermeasure + Enable the **Devices: Prevent users from installing printer drivers** setting. + ### Potential impact + Only members of the Administrator, Power Users, or Server Operator groups can install printers on the servers. If this policy setting is enabled but the driver for a network printer already exists on the local computer, users can still add the network printer. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md b/windows/keep-secure/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md index d4a806d762..e42ea9042c 100644 --- a/windows/keep-secure/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md +++ b/windows/keep-secure/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md @@ -2,82 +2,79 @@ title: Devices Restrict CD-ROM access to locally logged-on user only (Windows 10) description: Describes the best practices, location, values, and security considerations for the Devices Restrict CD-ROM access to locally logged-on user only security policy setting. ms.assetid: 8b8f44bb-84ce-4f18-af30-ab89910e234d -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Devices: Restrict CD-ROM access to locally logged-on user only + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Devices: Restrict CD-ROM access to locally logged-on user only** security policy setting. + ## Reference + This policy setting determines whether a CD is accessible to local and remote users simultaneously. If you enable this policy setting, only the interactively logged-on user is allowed to access removable CDs. If this policy setting is enabled and no one is logged on interactively, the CD can be accessed over the network. + The security benefit of enabling this policy setting is small because it only prevents network users from accessing the drive when someone is logged on to the local console of the system at the same time. Additionally, CD drives are not automatically made available as network shared drives; you must deliberately choose to share the drive. This is important when administrators are installing software or copying data from a CD-ROM, and they do not want network users to be able to execute the applications or view the data. + If this policy setting is enabled, users who connect to the server over the network will not be able to use any CD drives that are installed on the server when anyone is logged on to the local console of the server. Enabling this policy setting is not suitable for a system that serves as a CD jukebox for network users. + ### Possible values + - Enabled - Disabled - Not defined + ### Best practices + - Best practices are dependent on your security and user accessibility requirements for CD drives. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Disabled

      DC Effective Default Settings

      Disabled

      Member Server Effective Default Settings

      Disabled

      Client Computer Effective Default Settings

      Disabled

      + + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined | +| Default Domain Controller Policy | Not defined | +| Stand-Alone Server Default Settings | Disabled | +| DC Effective Default Settings | Disabled | +| Member Server Effective Default Settings | Disabled | +| Client Computer Effective Default Settings | Disabled |   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability -A remote user could potentially access a mounted CD that contains sensitive information. This risk is small because CD drives are not automatically made available as shared drives; you must deliberately choose to share the drive. However, you can deny network users the ability to view data or run applications from removable media on the server. + +A remote user could potentially access a mounted CD that contains sensitive information. This risk is small because CD drives are not automatically made available as shared drives; you must deliberately choose to share the drive. However, you can deny network users the ability to view data or run +applications from removable media on the server. + ### Countermeasure Enable the **Devices: Restrict CD-ROM drive access to locally logged-on user only** setting. + ### Potential impact Users who connect to the server over the network cannot use any CD drives that are installed on the server when anyone is logged on to the local console of the server. System tools that require access to the CD drive will fail. For example, the Volume Shadow Copy service attempts to access all CD and floppy disk drives that are present on the computer when it initializes, and if the service cannot access one of these drives, it fails. This condition causes the Windows Backup tool to fail if volume shadow copies were specified for the backup job. Any non-Microsoft backup products that use volume shadow copies also fail. This policy setting would not be suitable for a computer that serves as a CD jukebox for network users. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) From a75ee08f729bc0de06c6d5e60d004b9f203e7595 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Mon, 23 May 2016 16:37:43 -0700 Subject: [PATCH 383/439] fixing spacing issues --- ...y-access-to-locally-logged-on-user-only.md | 81 +++++++------- ...-users-try-to-run-a-blocked-application.md | 9 +- windows/keep-secure/dll-rules-in-applocker.md | 64 ++++------- ...tructure-and-applocker-rule-enforcement.md | 11 +- ...pplication-control-management-processes.md | 24 +++- .../document-your-application-list.md | 26 ++++- .../document-your-applocker-rules.md | 16 ++- ...llow-server-operators-to-schedule-tasks.md | 86 +++++++------- ...roller-ldap-server-signing-requirements.md | 85 +++++++------- ...refuse-machine-account-password-changes.md | 84 +++++++------- ...rypt-or-sign-secure-channel-data-always.md | 105 ++++++++++-------- ...crypt-secure-channel-data-when-possible.md | 98 ++++++++-------- ...-sign-secure-channel-data-when-possible.md | 95 ++++++++-------- ...isable-machine-account-password-changes.md | 83 +++++++------- ...er-maximum-machine-account-password-age.md | 82 +++++++------- ...trong-windows-2000-or-later-session-key.md | 91 ++++++++------- 16 files changed, 545 insertions(+), 495 deletions(-) diff --git a/windows/keep-secure/devices-restrict-floppy-access-to-locally-logged-on-user-only.md b/windows/keep-secure/devices-restrict-floppy-access-to-locally-logged-on-user-only.md index c031c438a6..3246e36da5 100644 --- a/windows/keep-secure/devices-restrict-floppy-access-to-locally-logged-on-user-only.md +++ b/windows/keep-secure/devices-restrict-floppy-access-to-locally-logged-on-user-only.md @@ -2,82 +2,79 @@ title: Devices Restrict floppy access to locally logged-on user only (Windows 10) description: Describes the best practices, location, values, and security considerations for the Devices Restrict floppy access to locally logged-on user only security policy setting. ms.assetid: 92997910-da95-4c03-ae6f-832915423898 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Devices: Restrict floppy access to locally logged-on user only + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Devices: Restrict floppy access to locally logged-on user only** security policy setting. + ## Reference + This policy setting determines whether removable floppy disks are accessible to local and remote users simultaneously. Enabling this policy setting allows only the interactively logged-on user to access removable floppy disks. If this policy setting is enabled and no one is logged on interactively, the floppy disk can be accessed over the network. + The security benefit of enabling this policy setting is small because it only prevents network users from accessing the floppy disk drive when someone is logged on to the local console of the system at the same time. Additionally, floppy disk drives are not automatically made available as network shared drives; you must deliberately choose to share the drive. This becomes important when you are installing software or copying data from a floppy disk and they do not want network users to be able to execute the applications or view the data. + If this policy setting is enabled, users who connect to the server over the network will not be able to use any floppy disk drives that are installed on the server when anyone is logged on to the local console of the server. + ### Possible values + - Enabled - Disabled - Not defined + ### Best practices + - Best practices are dependent on your security and user accessibility requirements for CD drives. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Disabled

      DC Effective Default Settings

      Disabled

      Member Server Effective Default Settings

      Disabled

      Client Computer Effective Default Settings

      Disabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + A remote user could potentially access a mounted floppy disk that contains sensitive information. This risk is small because floppy disk drives are not automatically shared; administrators must deliberately choose to share the drive. However, you can deny network users the ability to view data or run applications from removable media on the server. + ### Countermeasure + Enable the **Devices: Restrict floppy access to locally logged-on user only** setting. + ### Potential impact + Users who connect to the server over the network cannot use any floppy disk drives that are installed on the device when anyone is logged on to the local console of the server. System tools that require access to floppy disk drives fail. For example, the Volume Shadow Copy service attempts to access all CD-ROM and floppy disk drives that are present on the computer when it initializes, and if the service cannot access one of these drives, it fails. This condition causes the Windows Backup tool to fail if volume shadow copies were specified for the backup job. Any non-Microsoft backup products that use volume shadow copies also fail. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md b/windows/keep-secure/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md index ea5e8e17a8..267ba483ac 100644 --- a/windows/keep-secure/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md +++ b/windows/keep-secure/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md @@ -8,13 +8,20 @@ ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft --- + # Display a custom URL message when users try to run a blocked app + **Applies to** - Windows 10 + This topic for IT professionals describes the steps for displaying a customized message to users when an AppLocker policy denies access to an app. + Using Group Policy, AppLocker can be configured to display a message with a custom URL. You can use this URL to redirect users to a support site that contains info about why the user received the error and which apps are allowed. If you do not display a custom message when an apps is blocked, the default access denied message is displayed. + To complete this procedure, you must have the **Edit Setting** permission to edit a GPO. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. + **To display a custom URL message when users try to run a blocked app** + 1. On the **Start** screen, type **gpmc.msc** to open the Group Policy Management Console (GPMC). 2. Navigate to the Group Policy Object (GPO) that you want to edit. 3. Right-click the GPO, and then click **Edit**. @@ -22,5 +29,3 @@ To complete this procedure, you must have the **Edit Setting** permission to ed 5. In the details pane, double-click **Set a support web page link**. 6. Click **Enabled**, and then type the URL of the custom Web page in the **Support Web page URL** box. 7. Click **OK** to apply the setting. -  -  diff --git a/windows/keep-secure/dll-rules-in-applocker.md b/windows/keep-secure/dll-rules-in-applocker.md index 545d8c5359..4f99109b04 100644 --- a/windows/keep-secure/dll-rules-in-applocker.md +++ b/windows/keep-secure/dll-rules-in-applocker.md @@ -2,64 +2,40 @@ title: DLL rules in AppLocker (Windows 10) description: This topic describes the file formats and available default rules for the DLL rule collection. ms.assetid: a083fd08-c07e-4534-b0e7-1e15d932ce8f -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # DLL rules in AppLocker + **Applies to** - Windows 10 + This topic describes the file formats and available default rules for the DLL rule collection. + AppLocker defines DLL rules to include only the following file formats: + - .dll - .ocx + The following table lists the default rules that are available for the DLL rule collection. - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      PurposeNameUserRule condition type

      Allows members of the local Administrators group to run all DLLs

      (Default Rule) All DLLs

      BUILTIN\Administrators

      Path: *

      Allow all users to run DLLs in the Windows folder

      (Default Rule) Microsoft Windows DLLs

      Everyone

      Path: %windir%\*

      Allow all users to run DLLs in the Program Files folder

      (Default Rule) All DLLs located in the Program Files folder

      Everyone

      Path: %programfiles%\*

      + +| Purpose | Name | User | Rule condition type | +| - | - | - | - | +| Allows members of the local Administrators group to run all DLLs | (Default Rule) All DLLs| +| BUILTIN\Administrators | Path: *| +| Allow all users to run DLLs in the Windows folder| (Default Rule) Microsoft Windows DLLs | +| Everyone | Path: %windir%\*| +| Allow all users to run DLLs in the Program Files folder | (Default Rule) All DLLs located in the Program Files folder| +| Everyone | Path: %programfiles%\*|   -**Important**   -If you use DLL rules, a DLL allow rule has to be created for each DLL that is used by all of the allowed apps +>**Important:**  If you use DLL rules, a DLL allow rule has to be created for each DLL that is used by all of the allowed apps   -**Caution**   -When DLL rules are used, AppLocker must check each DLL that an app loads. Therefore, users may experience a reduction in performance if DLL rules are used. +>**Caution:**  When DLL rules are used, AppLocker must check each DLL that an app loads. Therefore, users may experience a reduction in performance if DLL rules are used.   ## Related topics -[Understanding AppLocker default rules](understanding-applocker-default-rules.md) -  -  + +- [Understanding AppLocker default rules](understanding-applocker-default-rules.md) \ No newline at end of file diff --git a/windows/keep-secure/document-group-policy-structure-and-applocker-rule-enforcement.md b/windows/keep-secure/document-group-policy-structure-and-applocker-rule-enforcement.md index e97b186290..f583b63513 100644 --- a/windows/keep-secure/document-group-policy-structure-and-applocker-rule-enforcement.md +++ b/windows/keep-secure/document-group-policy-structure-and-applocker-rule-enforcement.md @@ -2,23 +2,31 @@ title: Document the Group Policy structure and AppLocker rule enforcement (Windows 10) description: This planning topic describes what you need to investigate, determine, and record in your application control policies plan when you use AppLocker. ms.assetid: 389ffa8e-11fc-49ff-b0b1-89553e6fb6e5 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft +ms.pagetype: security --- + # Document the Group Policy structure and AppLocker rule enforcement + **Applies to** - Windows 10 + This planning topic describes what you need to investigate, determine, and record in your application control policies plan when you use AppLocker. + ## Record your findings + To complete this AppLocker planning document, you should first complete the following steps: + 1. [Determine your application control objectives](determine-your-application-control-objectives.md) 2. [Create a list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md) 3. [Select the types of rules to create](select-types-of-rules-to-create.md) 4. [Determine the Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md) + After you determine how to structure your Group Policy Objects (GPOs) so that you can apply AppLocker policies, you should record your findings. You can use the following table to determine how many GPOs to create (or edit) and which objects they are linked to. If you decided to create custom rules to allow system files to run, note the high-level rule configuration in the **Use default rule or define new rule condition** column. + The following table includes the sample data that was collected when you determined your enforcement settings and the GPO structure for your AppLocker policies. @@ -111,6 +119,7 @@ The following table includes the sample data that was collected when you determi
        ## Next steps + After you have determined the Group Policy structure and rule enforcement strategy for each business group's apps, the following tasks remain: - [Plan for AppLocker policy management](plan-for-applocker-policy-management.md) - [Create your AppLocker planning document](create-your-applocker-planning-document.md) diff --git a/windows/keep-secure/document-your-application-control-management-processes.md b/windows/keep-secure/document-your-application-control-management-processes.md index b5a9cd95a7..e0ef522601 100644 --- a/windows/keep-secure/document-your-application-control-management-processes.md +++ b/windows/keep-secure/document-your-application-control-management-processes.md @@ -2,31 +2,46 @@ title: Document your application control management processes (Windows 10) description: This planning topic describes the AppLocker policy maintenance information to record for your design document. ms.assetid: 6397f789-0e36-4933-9f86-f3f6489cf1fb -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Document your application control management processes + **Applies to** - Windows 10 + This planning topic describes the AppLocker policy maintenance information to record for your design document. + ## Record your findings + To complete this AppLocker planning document, you should first complete the following steps: + 1. [Determine your application control objectives](determine-your-application-control-objectives.md) 2. [Create a list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md) 3. [Select the types of rules to create](select-types-of-rules-to-create.md) 4. [Determine the Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md) 5. [Plan for AppLocker policy management](plan-for-applocker-policy-management.md) + The three key areas to determine for AppLocker policy management are: + 1. Support policy + Document the process that you will use for handling calls from users who have attempted to run a blocked app, and ensure that support personnel know recommended troubleshooting steps and escalation points for your policy. + 2. Event processing + Document whether events will be collected in a central location, how that store will be archived, and whether the events will be processed for analysis. + 3. Policy maintenance + Detail how rules will be added to the policy, in which Group Policy Object (GPO) the rules should be defined, and how to modify rules when apps are retired, updated, or added. + The following table contains the added sample data that was collected when determining how to maintain and manage AppLocker policies. + @@ -125,9 +140,13 @@ The following table contains the added sample data that was collected when deter
        The following two tables illustrate examples of documenting considerations to maintain and manage AppLocker policies. + **Event processing policy** + One discovery method for app usage is to set the AppLocker enforcement mode to **Audit only**. This will write events to the AppLocker logs, which can be managed and analyzed like other Windows logs. After apps have been identified, you can begin to develop policies regarding the processing and access to AppLocker events. + The following table is an example of what to consider and record. + @@ -210,7 +229,6 @@ The following table is an example of what to consider and record.
        ## Next steps + After you have determined your application control management strategy for each of the business group's applications, the following task remains: - [Create your AppLocker planning document](create-your-applocker-planning-document.md) -  -  diff --git a/windows/keep-secure/document-your-application-list.md b/windows/keep-secure/document-your-application-list.md index 1b7c7906fa..c20e6831ad 100644 --- a/windows/keep-secure/document-your-application-list.md +++ b/windows/keep-secure/document-your-application-list.md @@ -2,21 +2,30 @@ title: Document your app list (Windows 10) description: This planning topic describes the app information that you should document when you create a list of apps for AppLocker policies. ms.assetid: b155284b-f75d-4405-aecf-b74221622dc0 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Document your app list + **Applies to** - Windows 10 + This planning topic describes the app information that you should document when you create a list of apps for AppLocker policies. + ## Record your findings + **Apps** + Record the name of the app, whether it is signed as indicated by the publisher's name, and whether it is a mission critical, business productivity, optional, or personal app. Later, as you manage your rules, AppLocker displays this information in the format shown in the following example: *MICROSOFT OFFICE INFOPATH signed by O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US*. + **Installation path** + Record the installation path of the apps. For example, Microsoft Office 2016 installs files to *%programfiles%\\Microsoft Office\\Office16\\*, which is *C:\\Program Files\\Microsoft Office\\Office16\\* on most devices. + The following table provides an example of how to list applications for each business group at the early stage of designing your application control policies. Eventually, as more planning information is added to the list, the information can be used to build AppLocker rules. @@ -81,29 +90,36 @@ The following table provides an example of how to list applications for each bus
        -**Note**   -AppLocker only supports publisher rules for Universal Windows apps. Therefore, collecting the installation path information for Universal Windows apps is not necessary. +>**Note:**  AppLocker only supports publisher rules for Universal Windows apps. Therefore, collecting the installation path information for Universal Windows apps is not necessary.   **Event processing** + As you create your list of apps, you need to consider how to manage the events that are generated by user access, or you need to deny running those apps to make your users as productive as possible. The following list is an example of what to consider and what to record: + - Will event forwarding be implemented for AppLocker events? - What is the location of the AppLocker event collection? - Should an event archival policy be implemented? - Will the events be analyzed and how often? - Should a security policy be in place for event collection? + **Policy maintenance** + As you create your list of apps, you need to consider how to manage and maintain the policies that you will eventually create. The following list is an example of what to consider and what to record: + - How will rules be updated for emergency app access and permanent access? - How will apps be removed? - How many older versions of the same app will be maintained? - How will new apps be introduced? + ## Next steps + After you have created the list of applications, the next step is to identify the rule collections, which will become the application control policies. This information can be added to the table under the following columns: + - Use default rule or define new rule condition - Allow or deny - GPO name + To identify the rule collections, see the following topics: + - [Select the types of rules to create](select-types-of-rules-to-create.md) - [Determine Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md) -  -  diff --git a/windows/keep-secure/document-your-applocker-rules.md b/windows/keep-secure/document-your-applocker-rules.md index 97bd6545ef..5603fcefdc 100644 --- a/windows/keep-secure/document-your-applocker-rules.md +++ b/windows/keep-secure/document-your-applocker-rules.md @@ -2,25 +2,35 @@ title: Document your AppLocker rules (Windows 10) description: This topic describes what rule conditions to associate with each file, how to associate the rule conditions with each file, the source of the rule, and whether the file should be included or excluded. ms.assetid: 91a198ce-104a-45ff-b49b-487fb40cd2dd -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Document your AppLocker rules + **Applies to** - Windows 10 + This topic describes what rule conditions to associate with each file, how to associate the rule conditions with each file, the source of the rule, and whether the file should be included or excluded. + ## Record your findings + To complete this AppLocker planning document, you should first complete the following steps: + 1. [Determine your application control objectives](determine-your-application-control-objectives.md) 2. [Create a list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md) 3. [Select the types of rules to create](select-types-of-rules-to-create.md) + Document the following items for each business group or organizational unit: + - Whether your organization will use the built-in default AppLocker rules to allow system files to run. - The types of rule conditions that you will use to create rules, stated in order of preference. + The following table details sample data for documenting rule type and rule condition findings. In addition, you should now consider whether to allow an app to run or deny permission for it to run. For info about these settings, see [Understanding AppLocker allow and deny actions on rules](understanding-applocker-allow-and-deny-actions-on-rules.md). + @@ -101,9 +111,9 @@ The following table details sample data for documenting rule type and rule condi
        ## Next steps + For each rule, determine whether to use the allow or deny option. Then, three tasks remain: + - [Determine Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md) - [Plan for AppLocker policy management](plan-for-applocker-policy-management.md) - [Create your AppLocker planning document](create-your-applocker-planning-document.md) -  -  diff --git a/windows/keep-secure/domain-controller-allow-server-operators-to-schedule-tasks.md b/windows/keep-secure/domain-controller-allow-server-operators-to-schedule-tasks.md index 9830087bd1..73dd753654 100644 --- a/windows/keep-secure/domain-controller-allow-server-operators-to-schedule-tasks.md +++ b/windows/keep-secure/domain-controller-allow-server-operators-to-schedule-tasks.md @@ -2,87 +2,85 @@ title: Domain controller Allow server operators to schedule tasks (Windows 10) description: Describes the best practices, location, values, and security considerations for the Domain controller Allow server operators to schedule tasks security policy setting. ms.assetid: 198b12a4-8a5d-48e8-a752-2073b8a2cb0d -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Domain controller: Allow server operators to schedule tasks + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Domain controller: Allow server operators to schedule tasks** security policy setting. + ## Reference + This policy setting determines whether server operators can use the**at** command to submit jobs. If you enable this policy setting, jobs that are created by server operators by means of the **at** command run in the context of the account that runs the Task Scheduler service. By default, that is the Local System account. -**Note**   -This security option setting affects only the scheduler tool for the **at** command. It does not affect the Task Scheduler tool. + +>**Note:**  This security option setting affects only the scheduler tool for the **at** command. It does not affect the Task Scheduler tool.   Enabling this policy setting means jobs that are created by server operators through the **at** command will be executed in the context of the account that is running that service—by default, that is the Local System account. This means that server operators can perform tasks that the Local System account is able to do, but server operators would normally not be able to do, such as add their account to the local Administrators group. + The impact of enabling this policy setting should be small for most organizations. Users, including those in the Server Operators group, will still be able to create jobs by using the Task Scheduler Wizard, but those jobs will run in the context of the account that the user authenticates with when setting up the job. + ### Possible values + - Enabled - Disabled - Not defined + ### Best practices + - Best practices for this policy are dependent on your security and operational requirements for task scheduling. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Not defined

      DC Effective Default Settings

      Not defined

      Member Server Effective Default Settings

      Not defined

      Client Computer Effective Default Settings

      Not defined

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Not defined | +| Stand-Alone Server Default Settings | Not defined| +| DC Effective Default Settings | Not defined| +| Member Server Effective Default Settings | Not defined| +| Client Computer Effective Default Settings | Not defined|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Command-line tools + The **at** command schedules commands and programs to run on a computer at a specified time and date. The Schedule service must be running to use the **at** command. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Tasks that run under the context of the Local System account can affect resources that are at a higher privilege level than the user account that scheduled the task. + ### Countermeasure + Disable the **Domain controller: Allow server operators to schedule tasks** setting. + ### Potential impact + The impact should be small for most organizations. Users (including those in the Server Operators group) can still create jobs by means of the Task Scheduler snap-in. However, those jobs run in the context of the account that the user authenticates with when setting up the job. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/domain-controller-ldap-server-signing-requirements.md b/windows/keep-secure/domain-controller-ldap-server-signing-requirements.md index 50f94a37d3..8f75f7faa7 100644 --- a/windows/keep-secure/domain-controller-ldap-server-signing-requirements.md +++ b/windows/keep-secure/domain-controller-ldap-server-signing-requirements.md @@ -2,86 +2,83 @@ title: Domain controller LDAP server signing requirements (Windows 10) description: Describes the best practices, location, values, and security considerations for the Domain controller LDAP server signing requirements security policy setting. ms.assetid: fe122179-7571-465b-98d0-b8ce0f224390 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Domain controller: LDAP server signing requirements + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Domain controller: LDAP server signing requirements** security policy setting. + ## Reference + This policy setting determines whether the Lightweight Directory Access Protocol (LDAP) server requires LDAP clients to negotiate data signing. + Unsigned network traffic is susceptible to man-in-the-middle attacks, where an intruder captures packets between the server and the client device and modifies them before forwarding them to the client device. In the case of an LDAP server, this means that a malicious user can cause a client device to make decisions based on false records from the LDAP directory. You can lower the risk of a malicious user accomplishing this in a corporate network by implementing strong physical security measures to protect the network infrastructure. Furthermore, implementing Internet Protocol security (IPsec) Authentication Header mode, which provides mutual authentication and packet integrity for IP traffic, can make all types of man-in-the-middle attacks extremely difficult. + This setting does not have any impact on LDAP simple bind or LDAP simple bind through SSL. + If signing is required, then LDAP simple bind and LDAP simple bind through SSL requests are rejected. -**Caution**   -If you set the server to Require signature, you must also set the client device. Not setting the client device results in loss of connection with the server. + +>**Caution:**  If you set the server to Require signature, you must also set the client device. Not setting the client device results in loss of connection with the server.   ### Possible values + - None. Data signatures are not required to bind with the server. If the client computer requests data signing, the server supports it. - Require signature. The LDAP data-signing option must be negotiated unless Transport Layer Security/Secure Sockets Layer (TLS/SSL) is in use. - Not defined. + ### Best practices + - It is advisable to set **Domain controller: LDAP server signing requirements** to **Require signature**. Clients that do not support LDAP signing will be unable to execute LDAP queries against the domain controllers. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Not defined

      DC Effective Default Settings

      None

      Member Server Effective Default Settings

      None

      Client Computer Effective Default Settings

      None

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Not defined| +| DC Effective Default Settings | None| +| Member Server Effective Default Settings | None| +| Client Computer Effective Default Settings | None|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Unsigned network traffic is susceptible to man-in-the-middle attacks. In such attacks, an intruder captures packets between the server and the client device, modifies them, and then forwards them to the client device. Where LDAP servers are concerned, an attacker could cause a client device to make decisions that are based on false records from the LDAP directory. To lower the risk of such an intrusion in an organization's network, you can implement strong physical security measures to protect the network infrastructure. You could also implement Internet Protocol security (IPsec) Authentication Header mode, which performs mutual authentication and packet integrity for IP traffic to make all types of man-in-the-middle attacks extremely difficult. + ### Countermeasure + Configure the **Domain controller: LDAP server signing requirements** setting to **Require signature**. + ### Potential impact + Client device that do not support LDAP signing cannot run LDAP queries against the domain controllers. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/domain-controller-refuse-machine-account-password-changes.md b/windows/keep-secure/domain-controller-refuse-machine-account-password-changes.md index acab069b02..3d0dc98ace 100644 --- a/windows/keep-secure/domain-controller-refuse-machine-account-password-changes.md +++ b/windows/keep-secure/domain-controller-refuse-machine-account-password-changes.md @@ -2,83 +2,83 @@ title: Domain controller Refuse machine account password changes (Windows 10) description: Describes the best practices, location, values, and security considerations for the Domain controller Refuse machine account password changes security policy setting. ms.assetid: 5a7fa2e2-e1a8-4833-90f7-aa83e3b456a9 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Domain controller: Refuse machine account password changes + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Domain controller: Refuse machine account password changes** security policy setting. + ## Reference + This policy setting enables or disables blocking a domain controller from accepting password change requests for machine accounts. By default, devices joined to the domain change their machine account passwords every 30 days. If enabled, the domain controller will refuse machine account password change requests. + ### Possible values + - Enabled + When enabled, this setting does not allow a domain controller to accept any changes to a machine account's password. + - Disabled + When disabled, this setting allows a domain controller to accept any changes to a machine account's password. + - Not defined + Same as Disabled. + ### Best practices + - Enabling this policy setting on all domain controllers in a domain prevents domain members from changing their machine account passwords. This, in turn, leaves those passwords susceptible to attack. Make sure that this conforms to your overall security policy for the domain. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Not defined

      DC Effective Default Settings

      Disabled

      Member Server Effective Default Settings

      Disabled

      Client Computer Effective Default Settings

      Not applicable

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Not defined| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Not applicable|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + If you enable this policy setting on all domain controllers in a domain, domain members cannot change their machine account passwords, and those passwords are more susceptible to attack. + ### Countermeasure + Disable the **Domain controller: Refuse machine account password changes** setting. + ### Potential impact + None. This is the default configuration. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md b/windows/keep-secure/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md index b6ebe0166a..dde52ba0d7 100644 --- a/windows/keep-secure/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md +++ b/windows/keep-secure/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md @@ -2,103 +2,114 @@ title: Domain member Digitally encrypt or sign secure channel data (always) (Windows 10) description: Describes the best practices, location, values, and security considerations for the Domain member Digitally encrypt or sign secure channel data (always) security policy setting. ms.assetid: 4480c7cb-adca-4f29-b4b8-06eb68d272bf -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Domain member: Digitally encrypt or sign secure channel data (always) + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Domain member: Digitally encrypt or sign secure channel data (always)** security policy setting. + ## Reference -This setting determines whether all secure channel traffic that is initiated by the domain member meets minimum security requirements. Specifically, it determines whether all secure channel traffic that is initiated by the domain member must be signed or encrypted. Logon information that is transmitted over the secure channel is always encrypted regardless of whether the encryption of all other secure channel traffic is negotiated. + +This setting determines whether all secure channel traffic that is initiated by the domain member meets minimum security requirements. Specifically, it determines whether all secure channel traffic that is initiated by the domain member must be signed or encrypted. Logon information that is +transmitted over the secure channel is always encrypted regardless of whether the encryption of all other secure channel traffic is negotiated. + The following policy settings determine whether a secure channel can be established with a domain controller that is not capable of signing or encrypting secure channel traffic: + - Domain member: Digitally encrypt or sign secure channel data (always) - [Domain member: Digitally encrypt secure channel data (when possible)](domain-member-digitally-encrypt-secure-channel-data-when-possible.md) - [Domain member: Digitally sign secure channel data (when possible)](domain-member-digitally-sign-secure-channel-data-when-possible.md) + Setting **Domain member: Digitally encrypt or sign secure channel data (always)** to **Enabled** prevents establishing a secure channel with any domain controller that cannot sign or encrypt all secure channel data. + To protect authentication traffic from man-in-the-middle, replay, and other types of network attacks, Windows-based computers create a communication channel through NetLogon called secure channels. These channels authenticate machine accounts. They also authenticate user accounts when a remote user connects to a network resource and the user account exists in a trusted domain. This is called pass-through authentication, and it allows a device running Windows othat has joined a domain to have access to the user account database in its domain and in any trusted domains. + To enable the **Domain member: Digitally encrypt or sign secure channel data (always)** policy setting on a member workstation or server, all domain controllers in the domain that the member belongs to must be capable of signing or encrypting all secure-channel data. + Enabling the **Domain member: Digitally encrypt or sign secure channel data (always)** policy setting automatically enables the [Domain member: Digitally sign secure channel data (when possible)](domain-member-digitally-sign-secure-channel-data-when-possible.md) policy setting. + When a device joins a domain, a machine account is created. After joining the domain, the device uses the password for that account to create a secure channel with the domain controller for its domain every time it restarts. This secure channel is used to perform operations such as NTLM pass-through authentication and LSA SID/name Lookup. Requests that are sent on the secure channel are authenticated—and sensitive information such as passwords are encrypted—but the integrity of the channel is not checked, and not all information is encrypted. If a system is set to always encrypt or sign secure channel data, a secure channel cannot be established with a domain controller that is not capable of signing or encrypting all secure channel traffic. If the computer is configured to encrypt or sign secure channel data when possible, a secure channel can be established, but the level of encryption and signing is negotiated. + ### Possible values + - Enabled - The policy [Domain member: Digitally sign secure channel data (when possible)](domain-member-digitally-sign-secure-channel-data-when-possible.md) is assumed to be enabled regardless of its current setting. This ensures that the domain member attempts to negotiate at least signing of the secure channel traffic. + + The policy [Domain member: Digitally sign secure channel data (when possible)](domain-member-digitally-sign-secure-channel-data-when-possible.md) is assumed to be enabled regardless of its current setting. This ensures that the domain member attempts to negotiate at least signing of the secure + channel traffic. + - Disabled + The encryption and signing of all secure channel traffic is negotiated with the domain controller, in which case the level of signing and encryption depends on the version of the domain controller and the settings of the following policies: + 1. [Domain member: Digitally encrypt secure channel data (when possible)](domain-member-digitally-encrypt-secure-channel-data-when-possible.md) 2. [Domain member: Digitally sign secure channel data (when possible)](domain-member-digitally-sign-secure-channel-data-when-possible.md) + - Not defined ### Best practices + - Set **Domain member: Digitally encrypt or sign secure channel data (always)** to **Enabled**. - Set [Domain member: Digitally encrypt secure channel data (when possible)](domain-member-digitally-encrypt-secure-channel-data-when-possible.md) to **Enabled**. - Set [Domain member: Digitally sign secure channel data (when possible)](domain-member-digitally-sign-secure-channel-data-when-possible.md) to **Enabled**. -**Note**   -You can enable the policy settings [Domain member: Digitally encrypt secure channel data (when possible)](domain-member-digitally-encrypt-secure-channel-data-when-possible.md) and [Domain member: Digitally sign secure channel data (when possible)](domain-member-digitally-sign-secure-channel-data-when-possible.md) on all devices in the domain that support these policy settings without affecting earlier-version clients and applications. + +>**Note:**  You can enable the policy settings [Domain member: Digitally encrypt secure channel data (when possible)](domain-member-digitally-encrypt-secure-channel-data-when-possible.md) and [Domain member: Digitally sign secure channel data (when possible)](domain-member-digitally-sign-secure-channel-data-when-possible.md) on all devices in the domain that support these policy settings without affecting earlier-version clients and applications.   ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Enabled

      Stand-Alone Server Default Settings

      Enabled

      DC Effective Default Settings

      Enabled

      Member Server Effective Default Settings

      Enabled

      Client Computer Effective Default Settings

      Enabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Enabled | +| Stand-Alone Server Default Settings | Enabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings | Enabled| +| Client Computer Effective Default Settings | Enabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Group Policy + Distribution of this policy through Group Policy overrides the Local Security Policy setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability -When a device joins a domain, a machine account is created. After it joins the domain, the device uses the password for that account to create a secure channel with the domain controller for its domain every time it restarts. Requests that are sent on the secure channel are authenticated—and sensitive information such as passwords are encrypted—but the channel is not integrity-checked, and not all information is encrypted. If a device is configured to always encrypt or sign secure channel data but the domain controller cannot sign or encrypt any portion of the secure channel data, the computer and domain controller cannot establish a secure channel. If the device is configured to encrypt or sign secure channel data, when possible, a secure channel can be established, but the level of encryption and signing is negotiated. + +When a device joins a domain, a machine account is created. After it joins the domain, the device uses the password for that account to create a secure channel with the domain controller for its domain every time it restarts. Requests that are sent on the secure channel are authenticated—and +sensitive information such as passwords are encrypted—but the channel is not integrity-checked, and not all information is encrypted. If a device is configured to always encrypt or sign secure channel data but the domain controller cannot sign or encrypt any portion of the secure channel data, the computer and domain controller cannot establish a secure channel. If the device is configured to encrypt or sign secure channel data, when possible, a secure channel can be established, but the level of encryption and signing is negotiated. + ### Countermeasure + Select one of the following settings as appropriate for your environment to configure the computers in your domain to encrypt or sign secure channel data. + - **Domain member: Digitally encrypt or sign secure channel data (always)** - [Domain member: Digitally encrypt secure channel data (when possible)](domain-member-digitally-encrypt-secure-channel-data-when-possible.md) - [Domain member: Digitally sign secure channel data (when possible)](domain-member-digitally-sign-secure-channel-data-when-possible.md) + ### Potential impact + Digital encryption and signing of the secure channel is a good idea because the secure channel protects domain credentials as they are sent to the domain controller. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/domain-member-digitally-encrypt-secure-channel-data-when-possible.md b/windows/keep-secure/domain-member-digitally-encrypt-secure-channel-data-when-possible.md index 693a34601d..9412bf6ae7 100644 --- a/windows/keep-secure/domain-member-digitally-encrypt-secure-channel-data-when-possible.md +++ b/windows/keep-secure/domain-member-digitally-encrypt-secure-channel-data-when-possible.md @@ -2,99 +2,107 @@ title: Domain member Digitally encrypt secure channel data (when possible) (Windows 10) description: Describes the best practices, location, values, and security considerations for the Domain member Digitally encrypt secure channel data (when possible) security policy setting. ms.assetid: 73e6023e-0af3-4531-8238-82f0f0e4965b -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Domain member: Digitally encrypt secure channel data (when possible) + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Domain member: Digitally encrypt secure channel data (when possible)** security policy setting. + ## Reference -This setting determines whether all secure channel traffic that is initiated by the domain member meets minimum security requirements. Specifically, it determines whether all secure channel traffic that is initiated by the domain member must be encrypted. Logon information that is transmitted over the secure channel is always encrypted regardless of whether the encryption of all other secure channel traffic is negotiated. + +This setting determines whether all secure channel traffic that is initiated by the domain member meets minimum security requirements. Specifically, it determines whether all secure channel traffic that is initiated by the domain member must be encrypted. Logon information that is transmitted over +the secure channel is always encrypted regardless of whether the encryption of all other secure channel traffic is negotiated. + In addition to this policy setting, the following policy settings determine whether a secure channel can be established with a domain controller that is not capable of signing or encrypting secure channel traffic: + - [Domain member: Digitally encrypt or sign secure channel data (always)](domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md) - [Domain member: Digitally sign secure channel data (when possible)](domain-member-digitally-sign-secure-channel-data-when-possible.md) + Setting **Domain member: Digitally encrypt or sign secure channel data (always)** to **Enabled** prevents establishing a secure channel with any domain controller that cannot sign or encrypt all secure channel data. + To protect authentication traffic from man-in-the-middle, replay, and other types of network attacks, Windows-based computers create a communication channel through NetLogon called secure channels. These channels authenticate machine accounts. They also authenticate user accounts when a remote user connects to a network resource and the user account exists in a trusted domain. This is called pass-through authentication, and it allows a computer running the Windows operating system that has joined a domain to have access to the user account database in its domain and in any trusted domains. + Enabling the [Domain member: Digitally encrypt or sign secure channel data (always)](domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md) policy setting automatically enables the **Domain member: Digitally sign secure channel data (when possible)** policy setting. + When a device joins a domain, a machine account is created. After joining the domain, the device uses the password for that account to create a secure channel with the domain controller for its domain every time it restarts. This secure channel is used to perform operations such as NTLM pass through authentication and LSA SID/name Lookup. Requests that are sent on the secure channel are authenticated—and sensitive information such as passwords are encrypted—but the integrity of the channel is not checked, and not all information is encrypted. If a system is set to always encrypt or sign secure channel data, a secure channel cannot be established with a domain controller that is not capable of signing or encrypting all secure channel traffic. If the computer is configured to encrypt or sign secure channel data when possible, a secure channel can be established, but the level of encryption and signing is negotiated. + ### Possible values + - Enabled + The domain member will request encryption of all secure channel traffic. If the domain controller supports encryption of all secure channel traffic, then all secure channel traffic will be encrypted. Otherwise, only logon information that is transmitted over the secure channel will be encrypted. + - Disabled + The domain member will not attempt to negotiate secure channel encryption. - **Note**   - If the security policy setting [Domain member: Digitally encrypt or sign secure channel data (always)](domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md) is enabled, this setting will be overwritten. + + >**Note:**  If the security policy setting [Domain member: Digitally encrypt or sign secure channel data (always)](domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md) is enabled, this setting will be overwritten.   - Not defined + ### Best practices + - Set [Domain member: Digitally encrypt or sign secure channel data (always)](domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md) to **Enabled**. - Set **Domain member: Digitally encrypt secure channel data (when possible)** to **Enabled**. - Set [Domain member: Digitally sign secure channel data (when possible)](domain-member-digitally-sign-secure-channel-data-when-possible.md) to **Enabled**. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Enabled

      Stand-Alone Server Default Settings

      Enabled

      DC Effective Default Settings

      Enabled

      Member Server Effective Default Settings

      Enabled

      Client Computer Effective Default Settings

      Enabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Enabled| +| Stand-Alone Server Default Settings | Enabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings| Enabled| +| Client Computer Effective Default Settings | Enabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Group Policy + Distribution of this policy through Group Policy does not override the Local Security Policy setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + When a device joins a domain, a machine account is created. After it joins the domain, the device uses the password for that account to create a secure channel with the domain controller for its domain every time it restarts. Requests that are sent on the secure channel are authenticated—and sensitive information such as passwords are encrypted—but the channel is not integrity-checked, and not all information is encrypted. If a device is configured to always encrypt or sign secure channel data but the domain controller cannot sign or encrypt any portion of the secure channel data, the computer and domain controller cannot establish a secure channel. If the computer is configured to encrypt or sign secure channel data when possible, a secure channel can be established, but the level of encryption and signing is negotiated. + ### Countermeasure + Select one of the following settings as appropriate for your environment to configure the computers in your domain to encrypt or sign secure channel data: + - [Domain member: Digitally encrypt or sign secure channel data (always)](domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md) - **Domain member: Digitally encrypt secure channel data (when possible)** - [Domain member: Digitally sign secure channel data (when possible)](domain-member-digitally-sign-secure-channel-data-when-possible.md) + ### Potential impact + Digital signing of the secure channel is a good idea because it protects domain credentials as they are sent to the domain controller. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/domain-member-digitally-sign-secure-channel-data-when-possible.md b/windows/keep-secure/domain-member-digitally-sign-secure-channel-data-when-possible.md index 670f0b9024..6f0cdd5ea0 100644 --- a/windows/keep-secure/domain-member-digitally-sign-secure-channel-data-when-possible.md +++ b/windows/keep-secure/domain-member-digitally-sign-secure-channel-data-when-possible.md @@ -2,100 +2,105 @@ title: Domain member Digitally sign secure channel data (when possible) (Windows 10) description: Describes the best practices, location, values, and security considerations for the Domain member Digitally sign secure channel data (when possible) security policy setting. ms.assetid: a643e491-4f45-40ea-b12c-4dbe47e54f34 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Domain member: Digitally sign secure channel data (when possible) + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Domain member: Digitally sign secure channel data (when possible)** security policy setting. + ## Reference -This setting determines whether all secure channel traffic that is initiated by the domain member meets minimum security requirements. Specifically, it determines whether all secure channel traffic that is initiated by the domain member must be signed. Logon information that is transmitted over the secure channel is always encrypted regardless of whether the encryption of all other secure channel traffic is negotiated. + +This setting determines whether all secure channel traffic that is initiated by the domain member meets minimum security requirements. Specifically, it determines whether all secure channel traffic that is initiated by the domain member must be signed. Logon information that is transmitted over the +secure channel is always encrypted regardless of whether the encryption of all other secure channel traffic is negotiated. + The following policy settings determine whether a secure channel can be established with a domain controller that is not capable of signing or encrypting secure channel traffic: - [Domain member: Digitally encrypt or sign secure channel data (always)](domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md) - [Domain member: Digitally encrypt secure channel data (when possible)](domain-member-digitally-encrypt-secure-channel-data-when-possible.md) - Domain member: Digitally sign secure channel data (when possible) + Setting [Domain member: Digitally encrypt or sign secure channel data (always)](domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md) to **Enabled** prevents establishing a secure channel with any domain controller that cannot sign or encrypt all secure channel data. + To protect authentication traffic from man-in-the-middle, replay, and other types of network attacks, Windows-based computers create a communication channel through NetLogon called secure channels. These channels authenticate computer accounts. They also authenticate user accounts when a remote user connects to a network resource and the user account exists in a trusted domain. This is called pass-through authentication, and it allows a computer running the Windows operating system that has joined a domain to have access to the user account database in its domain and in any trusted domains. + Enabling the [Domain member: Digitally encrypt or sign secure channel data (always)](domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md) policy setting automatically enables the **Domain member: Digitally sign secure channel data (when possible)** policy setting. When a device joins a domain, a machine account is created. After joining the domain, the device uses the password for that account to create a secure channel with the domain controller for its domain every time it restarts. This secure channel is used to perform operations such as NTLM pass through authentication and LSA SID/name Lookup. Requests that are sent on the secure channel are authenticated—and sensitive information such as passwords are encrypted—but the integrity of the channel is not checked, and not all information is encrypted. If a system is set to always encrypt or sign secure channel data, a secure channel cannot be established with a domain controller that is not capable of signing or encrypting all secure channel traffic. If the computer is configured to encrypt or sign secure channel data when possible, a secure channel can be established, but the level of encryption and signing is negotiated. + ### Possible values + - Enabled + The domain member will request signing of all secure channel traffic. If the domain controller supports signing of all secure channel traffic, then all secure channel traffic will be signed which ensures that it cannot be tampered with in transit. + - Disabled + Signing will not be negotiated unless the policy [Domain member: Digitally encrypt or sign secure channel data (always)](domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md) is enabled. + - Not defined + ### Best practices + - Set [Domain member: Digitally encrypt or sign secure channel data (always)](domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md) to **Enabled**. - Set [Domain member: Digitally encrypt secure channel data (when possible)](domain-member-digitally-encrypt-secure-channel-data-when-possible.md) to **Enabled**. - Set **Domain member: Digitally sign secure channel data (when possible)** to **Enabled**. -**Note**   -You can enable the other two policy settings, Domain member: [Domain member: Digitally encrypt secure channel data (when possible)](domain-member-digitally-encrypt-secure-channel-data-when-possible.md) and **Domain member: Digitally sign secure channel data (when possible)**, on all devices joined to the domain that support these policy settings without affecting earlier-version clients and applications. +>**Note:**  You can enable the other two policy settings, Domain member: [Domain member: Digitally encrypt secure channel data (when possible)](domain-member-digitally-encrypt-secure-channel-data-when-possible.md) and **Domain member: Digitally sign secure channel data (when possible)**, on all devices joined to the domain that support these policy settings without affecting earlier-version clients and applications.   ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Enabled

      Stand-Alone Server Default Settings

      Enabled

      DC Effective Default Settings

      Enabled

      Member Server Effective Default Settings

      Enabled

      Client Computer Effective Default Settings

      Enabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Enabled | +| Stand-Alone Server Default Settings | Enabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings| Enabled| +| Client Computer Effective Default Settings | Enabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Group Policy + Distribution of this policy through Group Policy does not override the Local Security Policy setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + When a device joins a domain, a machine account is created. After it joins the domain, the device uses the password for that account to create a secure channel with the domain controller for its domain every time it restarts. Requests that are sent on the secure channel are authenticated—and sensitive information such as passwords are encrypted—but the channel is not integrity-checked, and not all information is encrypted. If a device is configured to always encrypt or sign secure channel data but the domain controller cannot sign or encrypt any portion of the secure channel data, the computer and domain controller cannot establish a secure channel. If the computer is configured to encrypt or sign secure channel data when possible, a secure channel can be established, but the level of encryption and signing is negotiated. + ### Countermeasure + Because these policies are closely related and useful depending on your environment, select one of the following settings as appropriate to configure the devices in your domain to encrypt or sign secure channel data when possible. + - [Domain member: Digitally encrypt or sign secure channel data (always)](domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md) - [Domain member: Digitally encrypt secure channel data (when possible)](domain-member-digitally-encrypt-secure-channel-data-when-possible.md) - **Domain member: Digitally sign secure channel data (when possible)** + ### Potential impact + Digital signing of the secure channel is a good idea because the secure channel protects domain credentials as they are sent to the domain controller. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/domain-member-disable-machine-account-password-changes.md b/windows/keep-secure/domain-member-disable-machine-account-password-changes.md index 39fdae996b..a7e862cea4 100644 --- a/windows/keep-secure/domain-member-disable-machine-account-password-changes.md +++ b/windows/keep-secure/domain-member-disable-machine-account-password-changes.md @@ -2,82 +2,79 @@ title: Domain member Disable machine account password changes (Windows 10) description: Describes the best practices, location, values, and security considerations for the Domain member Disable machine account password changes security policy setting. ms.assetid: 1f660300-a07a-4243-a09f-140aa1ab8867 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Domain member: Disable machine account password changes + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Domain member: Disable machine account password changes** security policy setting. + ## Reference + The **Domain member: Disable machine account password changes** policy setting determines whether a domain member periodically changes its machine account password. Setting its value to **Enabled** prevents the domain member from changing the machine account password. Setting it to **Disabled** allows the domain member to change the machine account password as specified by the value of the [Domain member: Maximum machine account password age](domain-member-maximum-machine-account-password-age.md) policy setting, which is every 30 days by default. + By default, devices that belong to a domain are automatically required to change the passwords for their accounts every 30 days. Devices that are no longer able to automatically change their machine password are at risk of a malicious user determining the password for the system's domain account. Verify that the **Domain member: Disable machine account password changes** option is set to **Disabled**. + ### Possible values + - Enabled - Disabled + ### Best practices + 1. Do not enable this policy setting. Machine account passwords are used to establish secure channel communications between members and domain controllers and between the domain controllers within the domain. After it is established, the secure channel transmits sensitive information that is necessary for making authentication and authorization decisions. 2. Do not use this policy setting in an attempt to support dual-boot scenarios that use the same machine account. If you want to dual-boot installations that are joined to the same domain, give the two installations different computer names. This policy setting was added to the Windows operating system to make it easier for organizations that stockpile pre-built computers that are put into production months later; those devices do not have to be rejoined to the domain. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Disabled

      Default Domain Controller Policy

      Disabled

      Stand-Alone Server Default Settings

      Disabled

      DC Effective Default Settings

      Disabled

      Member Server Effective Default Settings

      Disabled

      Client Computer Effective Default Settings

      Disabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Disabled | +| Default Domain Controller Policy | Disabled| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability -By default, devices running Windows Server that belong to a domain automatically change their passwords for their accounts every certain number of days, typically 30. If you disable this policy setting, devices that run Windows Server retain the same passwords as their machine accounts. Devices that cannot automatically change their account password are at risk from an attacker who could determine the password for the machine's domain account. + +By default, devices running Windows Server that belong to a domain automatically change their passwords for their accounts every certain number of days, typically 30. If you disable this policy setting, devices that run Windows Server retain the same passwords as their machine accounts. Devices +that cannot automatically change their account password are at risk from an attacker who could determine the password for the machine's domain account. + ### Countermeasure + Verify that the **Domain member: Disable machine account password changes** setting is configured to **Disabled**. + ### Potential impact + None. This is the default configuration. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/domain-member-maximum-machine-account-password-age.md b/windows/keep-secure/domain-member-maximum-machine-account-password-age.md index 9deffaa2c2..b97cf3f485 100644 --- a/windows/keep-secure/domain-member-maximum-machine-account-password-age.md +++ b/windows/keep-secure/domain-member-maximum-machine-account-password-age.md @@ -2,81 +2,77 @@ title: Domain member Maximum machine account password age (Windows 10) description: Describes the best practices, location, values, and security considerations for the Domain member Maximum machine account password age security policy setting. ms.assetid: 0ec6f7c1-4d82-4339-94c0-debb2d1ac109 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Domain member: Maximum machine account password age + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Domain member: Maximum machine account password age** security policy setting. + ## Reference + The **Domain member: Maximum machine account password age** policy setting determines the maximum allowable age for a machine account password. + In Active Directory–based domains, each device has an account and password, just like every user. By default, the domain members automatically change their domain password every 30 days. Increasing this interval significantly, or setting it to **0** so that the device no longer change their passwords, gives a malicious user more time to undertake a brute-force password-guessing attack against one of the machine accounts. + ### Possible values + - User-defined number of days between 0 and 999 - Not defined. + ### Best practices + 1. It is often advisable to set **Domain member: Maximum machine account password age** to about 30 days. 2. Some organizations pre-build devices and then store them for later use or ship them to remote locations. If the machine's account has expired, it will no longer be able to authenticate with the domain. Devices that cannot authenticate with the domain must be removed from the domain and rejoined to it. For this reason, some organizations might want to create a special organizational unit (OU) for computers that are prebuilt, and configure the value for this policy setting to a larger number of days. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      30 days

      DC Effective Default Settings

      30 days

      Member Server Effective Default Settings

      30 days

      Client Computer Effective Default Settings

      30 days

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined | +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | 30 days| +| DC Effective Default Settings | 30 days| +| Member Server Effective Default Settings|30 days| +| Client Computer Effective Default Settings | 30 days|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability -In Active Directory–based domains, each device has an account and password, just as every user does. By default, the domain members automatically change their domain password every 30 days. If you increase this interval significantly, or set it to 0 so that the computers no longer change their passwords, an attacker has more time to undertake a brute-force attack to guess the password of one or more computer accounts. + +In Active Directory–based domains, each device has an account and password, just as every user does. By default, the domain members automatically change their domain password every 30 days. If you increase this interval significantly, or set it to 0 so that the computers no longer change their +passwords, an attacker has more time to undertake a brute-force attack to guess the password of one or more computer accounts. + ### Countermeasure + Configure the **Domain member: Maximum machine account password age** setting to 30 days. + ### Potential impact + None. This is the default configuration. ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/domain-member-require-strong-windows-2000-or-later-session-key.md b/windows/keep-secure/domain-member-require-strong-windows-2000-or-later-session-key.md index 2a95144b2d..320d44e467 100644 --- a/windows/keep-secure/domain-member-require-strong-windows-2000-or-later-session-key.md +++ b/windows/keep-secure/domain-member-require-strong-windows-2000-or-later-session-key.md @@ -2,88 +2,95 @@ title: Domain member Require strong (Windows 2000 or later) session key (Windows 10) description: Describes the best practices, location, values, and security considerations for the Domain member Require strong (Windows 2000 or later) session key security policy setting. ms.assetid: 5ab8993c-5086-4f09-bc88-1b27454526bd -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Domain member: Require strong (Windows 2000 or later) session key + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Domain member: Require strong (Windows 2000 or later) session key** security policy setting. + ## Reference + The **Domain member: Require strong (Windows 2000 or later) session key** policy setting determines whether a secure channel can be established with a domain controller that is not capable of encrypting secure channel traffic with a strong, 128-bit session key. Enabling this policy setting prevents establishing a secure channel with any domain controller that cannot encrypt secure channel data with a strong key. Disabling this policy setting allows 64-bit session keys. + Whenever possible, you should take advantage of these stronger session keys to help protect secure channel communications from eavesdropping and session-hijacking network attacks. Eavesdropping is a form of hacking in which network data is read or altered in transit. The data can be modified to hide or change the name of the sender, or it can be redirected. + ### Possible values + - Enabled + When enabled on a member workstation or server, all domain controllers in the domain that the member belongs to must be capable of encrypting secure channel data with a strong, 128-bit key. This means that all such domain controllers must be running at least Windows 2000 Server. + - Disabled + Allows 64-bit session keys to be used. + - Not defined. + ### Best practices + - It is advisable to set **Domain member: Require strong (Windows 2000 or later) session key** to Enabled. Enabling this policy setting ensures that all outgoing secure channel traffic will require a strong encryption key. Disabling this policy setting requires that key strength be negotiated. Only enable this option if the domain controllers in all trusted domains support strong keys. By default, this value is disabled. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Disabled

      DC Effective Default Settings

      Disabled

      Member Server Effective Default Settings

      Disabled

      Client Computer Effective Default Settings

      Disabled

      + +| Server type or GPO +| Default value +| - | - | +| Default Domain Policy | Not defined | +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled|   ## Policy management + + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Group Policy + Misuse of this policy setting is a common error that can cause data loss or problems with data access or security. + You will you be able to join devices that do not support this policy setting to domains where the domain controllers have this policy setting enabled. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Session keys that are used to establish secure channel communications between domain controllers and member computers are much stronger starting with Windows 2000. + Whenever possible, you should take advantage of these stronger session keys to help protect secure channel communications from attacks that attempt to hijack network sessions and eavesdrop. (Eavesdropping is a form of hacking in which network data is read or altered in transit. The data can be modified to hide or change the sender, or be redirected.) + ### Countermeasure + Enable the **Domain member: Require strong (Windows 2000 or later) session key** setting. + If you enable this policy setting, all outgoing secure channel traffic requires a strong encryption key. If you disable this policy setting, the key strength is negotiated. You should enable this policy setting only if the domain controllers in all trusted domains support strong keys. By default, this policy setting is disabled. + ### Potential impact + Devices that do not support this policy setting cannot join domains in which the domain controllers have this policy setting enabled. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) From 089af5044ecf90419b60c66cb91fed5c88dbe31a Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 24 May 2016 15:30:44 +1000 Subject: [PATCH 384/439] new topic file created, added in TOC --- windows/keep-secure/TOC.md | 1 + ...md-scan-windows-defender-for-windows-10.md | 60 +++++++++++++++++++ 2 files changed, 61 insertions(+) create mode 100644 windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 56f8c27db1..b169a67beb 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -428,6 +428,7 @@ ### [Windows Defender in Windows 10](windows-defender-in-windows-10.md) #### [Update and manage Windows Defender in Windows 10](get-started-with-windows-defender-for-windows-10.md) #### [Configure Windows Defender in Windows 10](configure-windows-defender-in-windows-10.md) +#### [Run a Windows Defender scan from the command line] (run-cmd-scan-windows-defender-for-windows-10.md) #### [Troubleshoot Windows Defender in Windows 10](troubleshoot-windows-defender-in-windows-10.md) ## [Enterprise security guides](windows-10-enterprise-security-guides.md) ### [Control the health of Windows 10-based devices](protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md) diff --git a/windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md b/windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md new file mode 100644 index 0000000000..aac8e0f470 --- /dev/null +++ b/windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md @@ -0,0 +1,60 @@ +--- +title: Run a scan from the command line in Windows Defender in Windows 10 (Windows 10) +description: IT professionals can run a scan using the command line in Windows Defender in Windows 10. +keywords: scan, command line, mpcmdrun, defender +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: W10 +ms.mktglfcycl: manage +ms.sitesec: library +author: mjcaparas +--- + +# Run a Windows Defender scan from the command line + +**Applies to:** + +- Windows 10 + +IT professionals can use a command-line utility to run a Windows Defender scan. + +The utility is available in _%Program Files%\Windows Defender\MpCmdRun.exe + +This utility can be handy when you want to automate the use of Windows Defender. + +## Before you start + +To complete the procedures in this scenario: +- You must have administrator credentials +[CHECK WITH RAM IS THIS IS ACCURATE] + + +**To run a full system scan from the command line** + +1. Click **Start**, type **cmd**, and press **Enter**. +2. Navigate to _%ProgramFiles%\Windows Defender_ and enter the following command, and press **Enter**: + +``` +C:\Program Files\Windows Defender\mpcmdrun.exe -scan -scantype 2 +``` +The full scan start. When the scan completes, you'll see a message indicating that the scan is finished. + + +The utility also provides other commands that you can run: + +``` +MpCmdRun.exe \[command] [-options] +``` + +Command | Description +:---|:--- +\- ? / -h | Displays all available options for the tool +\-Scan [-ScanType #] [-File [-DisableRemediation] [-BootSectorScan]][-Timeout ] | Scans for malicious softare +\-Trace [-Grouping #] [-Level #]| Starts diagnostic tracing +\-GetFiles | Collects support information +\-RemoveDefinitions [-All] | Restores the installed signature definitions to a previous backup copy or to the original default set of signatures +\-AddDynamicSignature [-Path] | Loads a dyanmic signature +\-ListAllDynamicSignature [-Path] | Lists the loaded dynamic signatures +\-RemoveDynamicSignature [-SignatureSetID] | Removes a dynamic signature +\-EnableIntegrityServices | Enables integrity services +\-SubmitSamples | Submit all sample requests \ No newline at end of file From ba84f42c2b2f7440d1233c0074d8c7fd5bd5d546 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 24 May 2016 15:52:59 +1000 Subject: [PATCH 385/439] remove space from TOC --- windows/keep-secure/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index b169a67beb..df60443abe 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -428,7 +428,7 @@ ### [Windows Defender in Windows 10](windows-defender-in-windows-10.md) #### [Update and manage Windows Defender in Windows 10](get-started-with-windows-defender-for-windows-10.md) #### [Configure Windows Defender in Windows 10](configure-windows-defender-in-windows-10.md) -#### [Run a Windows Defender scan from the command line] (run-cmd-scan-windows-defender-for-windows-10.md) +#### [Run a Windows Defender scan from the command line](run-cmd-scan-windows-defender-for-windows-10.md) #### [Troubleshoot Windows Defender in Windows 10](troubleshoot-windows-defender-in-windows-10.md) ## [Enterprise security guides](windows-10-enterprise-security-guides.md) ### [Control the health of Windows 10-based devices](protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md) From 9c85b83432cd449151a65b68d1ce20a582bff9ba Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 24 May 2016 15:58:31 +1000 Subject: [PATCH 386/439] minor edits --- .../run-cmd-scan-windows-defender-for-windows-10.md | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) diff --git a/windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md b/windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md index aac8e0f470..c9e4438386 100644 --- a/windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md +++ b/windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md @@ -18,17 +18,10 @@ author: mjcaparas IT professionals can use a command-line utility to run a Windows Defender scan. -The utility is available in _%Program Files%\Windows Defender\MpCmdRun.exe +The utility is available in _%Program Files%\Windows Defender\MpCmdRun.exe_ This utility can be handy when you want to automate the use of Windows Defender. -## Before you start - -To complete the procedures in this scenario: -- You must have administrator credentials -[CHECK WITH RAM IS THIS IS ACCURATE] - - **To run a full system scan from the command line** 1. Click **Start**, type **cmd**, and press **Enter**. @@ -37,7 +30,7 @@ To complete the procedures in this scenario: ``` C:\Program Files\Windows Defender\mpcmdrun.exe -scan -scantype 2 ``` -The full scan start. When the scan completes, you'll see a message indicating that the scan is finished. +The full scan will start. When the scan completes, you'll see a message indicating that the scan is finished. The utility also provides other commands that you can run: From bb360441b3dfc8d8abbe01e5112cff79cf775e1e Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 24 May 2016 15:59:00 +1000 Subject: [PATCH 387/439] remove wrong character in command --- .../keep-secure/run-cmd-scan-windows-defender-for-windows-10.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md b/windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md index c9e4438386..9eb59d5dc1 100644 --- a/windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md +++ b/windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md @@ -36,7 +36,7 @@ The full scan will start. When the scan completes, you'll see a message indicati The utility also provides other commands that you can run: ``` -MpCmdRun.exe \[command] [-options] +MpCmdRun.exe [command] [-options] ``` Command | Description From 1eb2e56e63e4895d7d5202e1ae39cea6bdf4cd0c Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 24 May 2016 16:12:46 +1000 Subject: [PATCH 388/439] remove topic to fix link --- windows/keep-secure/TOC.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index df60443abe..56f8c27db1 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -428,7 +428,6 @@ ### [Windows Defender in Windows 10](windows-defender-in-windows-10.md) #### [Update and manage Windows Defender in Windows 10](get-started-with-windows-defender-for-windows-10.md) #### [Configure Windows Defender in Windows 10](configure-windows-defender-in-windows-10.md) -#### [Run a Windows Defender scan from the command line](run-cmd-scan-windows-defender-for-windows-10.md) #### [Troubleshoot Windows Defender in Windows 10](troubleshoot-windows-defender-in-windows-10.md) ## [Enterprise security guides](windows-10-enterprise-security-guides.md) ### [Control the health of Windows 10-based devices](protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md) From 3088b2740d14378d1cb944e746ea917f04fb7c70 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 24 May 2016 16:17:21 +1000 Subject: [PATCH 389/439] put link to new topic --- windows/keep-secure/TOC.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 56f8c27db1..df60443abe 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -428,6 +428,7 @@ ### [Windows Defender in Windows 10](windows-defender-in-windows-10.md) #### [Update and manage Windows Defender in Windows 10](get-started-with-windows-defender-for-windows-10.md) #### [Configure Windows Defender in Windows 10](configure-windows-defender-in-windows-10.md) +#### [Run a Windows Defender scan from the command line](run-cmd-scan-windows-defender-for-windows-10.md) #### [Troubleshoot Windows Defender in Windows 10](troubleshoot-windows-defender-in-windows-10.md) ## [Enterprise security guides](windows-10-enterprise-security-guides.md) ### [Control the health of Windows 10-based devices](protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md) From 677ad59c0de5f2f846b5252cd8dfe60659963cd1 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 24 May 2016 16:57:33 +1000 Subject: [PATCH 390/439] Update based on Omri feedback --- ...dpoints-windows-defender-advanced-threat-protection.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md index 8ac1ba2c6b..78366779a6 100644 --- a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md @@ -25,7 +25,7 @@ Using the GP configuration package ensures your endpoints will be correctly conf > **Note**  To use GP updates to deploy the package, you must be on Windows Server 2008 R2 or later. The endpoints must be running Windows 10 Insider Preview Build 14332 or later. -1. Open the GP configuration package .zip file (*WindowsATPOnboardingPackage_GroupPolicy.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): +1. Open the GP configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip *) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): a. Click **Client onboarding** on the **Navigation pane**. @@ -52,13 +52,13 @@ For additional settings, see the [Additional configuration settings section](add ## Configure with System Center Configuration Manager -1. Open the SCCM configuration package .zip file (*WindowsATPOnboardingPackage_ConfigurationManager.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): +1. Open the SCCM configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): a. Click **Client onboarding** on the **Navigation pane**. b. Select **System Center Configuration Manager**, click **Download package**, and save the .zip file. -2. Copy the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. +2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a folder called *WindowsDefenderATPOnboardingPackage* and the file *WindowsDefenderATPOnboardingScript.cmd*. 3. Import the configuration package by following the steps in the [How to Create Packages and Programs in Configuration Manager](https://technet.microsoft.com/en-us/library/gg682112.aspx#BKMK_Import) topic. @@ -76,7 +76,7 @@ You can also manually onboard individual endpoints to Windows Defender ATP. You a. Click **Client onboarding** on the **Navigation pane**. - b. Select **Manually on-board local machine**, click **Download package** and save the .zip file. + b. Select **Local Script**, click **Download package** and save the .zip file. 2. Extract the contents of the configuration package to a location on the endpoint you want to onboard (for example, the Desktop). You should have a file called *WindowsDefenderATPOnboardingScript.cmd*. From 3fe0c958429d056169b7cf3b0b0f83f990c54bd3 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 24 May 2016 17:15:06 +1000 Subject: [PATCH 391/439] remove extra space, edit a sentence --- ...e-endpoints-windows-defender-advanced-threat-protection.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md index 78366779a6..5ba1e38a0b 100644 --- a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md @@ -25,7 +25,7 @@ Using the GP configuration package ensures your endpoints will be correctly conf > **Note**  To use GP updates to deploy the package, you must be on Windows Server 2008 R2 or later. The endpoints must be running Windows 10 Insider Preview Build 14332 or later. -1. Open the GP configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip *) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): +1. Open the GP configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): a. Click **Client onboarding** on the **Navigation pane**. @@ -58,7 +58,7 @@ For additional settings, see the [Additional configuration settings section](add b. Select **System Center Configuration Manager**, click **Download package**, and save the .zip file. -2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a folder called *WindowsDefenderATPOnboardingPackage* and the file *WindowsDefenderATPOnboardingScript.cmd*. +2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file called *WindowsDefenderATPOnboardingScript.cmd*. 3. Import the configuration package by following the steps in the [How to Create Packages and Programs in Configuration Manager](https://technet.microsoft.com/en-us/library/gg682112.aspx#BKMK_Import) topic. From 0f940dccdbc495287a6d77e75cd25294daabe243 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 24 May 2016 17:17:18 +1000 Subject: [PATCH 392/439] add full stop --- ...ot-onboarding-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index 09251bb1f6..9199881438 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -38,7 +38,7 @@ If the endpoints aren't reporting correctly, you might need to check that the Wi **Check the onboarding state in Registry**: -1. Click **Start**, type **Run**, and press **Enter** +1. Click **Start**, type **Run**, and press **Enter**. 2. From the **Run** dialog box, type **regedit** and press **Enter**. From cd59cf836b1b5f0007976b3baea4dd15adbbf416 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Tue, 24 May 2016 17:41:15 +1000 Subject: [PATCH 393/439] Update TOC.md Remove topic from TOC --- windows/keep-secure/TOC.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index df60443abe..56f8c27db1 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -428,7 +428,6 @@ ### [Windows Defender in Windows 10](windows-defender-in-windows-10.md) #### [Update and manage Windows Defender in Windows 10](get-started-with-windows-defender-for-windows-10.md) #### [Configure Windows Defender in Windows 10](configure-windows-defender-in-windows-10.md) -#### [Run a Windows Defender scan from the command line](run-cmd-scan-windows-defender-for-windows-10.md) #### [Troubleshoot Windows Defender in Windows 10](troubleshoot-windows-defender-in-windows-10.md) ## [Enterprise security guides](windows-10-enterprise-security-guides.md) ### [Control the health of Windows 10-based devices](protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md) From b236db120a21002682f8f5f89a95678b3892c3e6 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 24 May 2016 17:47:42 +1000 Subject: [PATCH 394/439] fix numbering --- ...endpoints-windows-defender-advanced-threat-protection.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md index 5ba1e38a0b..79f9ff560f 100644 --- a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md @@ -81,7 +81,7 @@ You can also manually onboard individual endpoints to Windows Defender ATP. You 2. Extract the contents of the configuration package to a location on the endpoint you want to onboard (for example, the Desktop). You should have a file called *WindowsDefenderATPOnboardingScript.cmd*. -2. Open an elevated command-line prompt on the endpoint and run the script: +3. Open an elevated command-line prompt on the endpoint and run the script: a. Click **Start** and type **cmd**. @@ -89,9 +89,9 @@ You can also manually onboard individual endpoints to Windows Defender ATP. You ![Window Start menu pointing to Run as administrator](images/run-as-admin.png) -3. Type the location of the script file. If you copied the file to the desktop, type: *`%userprofile%\Desktop\WindowsDefenderATPOnboardingScript.cmd`* +4. Type the location of the script file. If you copied the file to the desktop, type: *`%userprofile%\Desktop\WindowsDefenderATPOnboardingScript.cmd`* -4. Press the **Enter** key or click **OK**. +5. Press the **Enter** key or click **OK**. See the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) topic for details on how you can manually validate that the endpoint is compliant and correctly reports telemetry. From e125a551b19cf80c3f753068accb2aeba22143f0 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 24 May 2016 08:09:16 -0700 Subject: [PATCH 395/439] add how-to steps for setup app --- .../windows/images/setup-app-1-access.png | Bin 0 -> 30326 bytes education/windows/images/setup-app-1-usb.png | Bin 0 -> 23731 bytes .../images/setup-app-1-wifi-manual.png | Bin 0 -> 16389 bytes education/windows/images/setup-app-1-wifi.png | Bin 0 -> 20635 bytes .../windows/images/setup-app-2-directions.png | Bin 0 -> 18590 bytes .../windows/images/setup-app-3-directions.png | Bin 0 -> 20938 bytes .../windows/images/setup-app-all-done.png | Bin 0 -> 23020 bytes .../windows/use-set-up-school-pcs-app.md | 26 ++++++++++++++++-- 8 files changed, 23 insertions(+), 3 deletions(-) create mode 100644 education/windows/images/setup-app-1-access.png create mode 100644 education/windows/images/setup-app-1-usb.png create mode 100644 education/windows/images/setup-app-1-wifi-manual.png create mode 100644 education/windows/images/setup-app-1-wifi.png create mode 100644 education/windows/images/setup-app-2-directions.png create mode 100644 education/windows/images/setup-app-3-directions.png create mode 100644 education/windows/images/setup-app-all-done.png diff --git a/education/windows/images/setup-app-1-access.png b/education/windows/images/setup-app-1-access.png new file mode 100644 index 0000000000000000000000000000000000000000..1de1081d1da4f18ca0df46aa40da9942bf1e459f GIT binary patch literal 30326 zcmZU)byQSQ|Hca<0z(QzH;4?~UDDl1*N~FZ9TG!JNOyxsm(nqGcPRoxN=S+{-oyL8 zcdh$d_Yamb=N!&Hv-keS=Xp-FhMGJ!hzx{;goLfAAfttZgzO0X$fCahJ{cBWk_Y}l zcGr@ZLaLdh*av=jZY!xOiG)<2fO!u^1%AhHQ7~{vLc-~P`aw=*!68RN^1@V_Aih5y}jfqtjWZ#+w^n1{;#6?MuX*Bl19 zWf@;=f!uEbPIht;}g7I5AhF|nzd1NhZZGk_aRw`>k=fTPi>VLYbBMMIR zwz}`q*jfZQ&*lry;`d0sr~d}c!{aXy{Xr+4SMb6}Dl#=eMEKEY(N-9)`1E_q;QOgXvT&{d@7%f5SOF+p@^+`5q2y}VcvE_c&eT$X}sWO zl*{AIo~<6mkSh^2gZPn~;qul{0&aPZo6@rXNoODMtU>sI8s_8qo?$}hOc&)k) zX>|Hs)&a*OCUZs7NvVKIkd85^6qUXc(hR2{nEK}D3!j+Yxy&U&RjJ;fMQ!jo@j~(yzKw_^o-@PNHfdZ}? z-Rc0!_@8Z_m@L&zTFaIRV(>`npwCODK{wW_G%35e-fI;xWU}|aiW9!1I+_q z4i(FN1nHRtHdCz!-Tj8H2VT8JwXf>BJ^12ylV;EeERohWX6LS(-P8Mvsl(>{pj#&6 z;D<}ZpE>oV(dW)Bh!$RFPd|aia0I#YXK0m6T^%*4C~thGph?{D`Pp`|x?H_RF=WFBSg?bGAIXPy(u~-> zet+kSp^HDPX?OP8W945q54*mYk~plFc^!ivx0fFrbU!5VSh#e1c}OgKv+p{ptu9u2 zLM0yHBf68Ky(xCJn*5+8wKthttUuw`aX!j2q?r7AU_sZ2O)cLPKVKS0=v7QJr8=;q zAgM8?TSiN!{!S?|G{@cl9{nbk?JKJ-=E_tpA8s#;ApxCU_h&;xAt-1EuA^)ICzK40 z4Lrc^K`YAGLZc2y%$*Wn3v9A}yScJ`U)khlrd>xvFbXk} zMs}|MaVr9ttfklJ?BTWDkA^0cY=%wf$&BiYcc9(}WbJabx5~O*)WROW3YO|DWJeCT zG6rs!x*y+WQ|LDYjIBWxtThkLHw0E`cvGud`*~WR*Sa6c7}%*N$K1>mq#UY8uJ!|- zS2)5uuhuGuB6P6q4X8b)B@3Z_5%v!v@r^!jBEgoDca20ZUWgY=kutOqo{ zJM5%`?1f(s|1n`b&iQzR$dMzbw0=K0DIzDhd-VpYY`TJXPz)2#%FFU`vGl#~(IpZ)(H z8GIT3eDip>{x8C2A`9ksc~GIAfpFCy=!m>RG^+XjU9nxTQ0pFOuixGm+@^#C2Ng$b zWvD4^7{FU+8ab9$A^>P!*0Tl$AZNm|KI0K zM={$?b847l9NisW&xGT*QqaJ_c=E-5eC96pJX{pEaCGg3)T7{vYE(PCuBcqOOd@)DWfndD$jVtDVK52n_Q4Eb> ze5rGdW-Uw#e7Z{L{~lrh{fLZy%7T8Y|2?;+4oJ#wQl4^=E%HDTEI;2O`U+g8<^uaI z7@thw!S*trA4tX8HzVM${`J7Q%pyQ!)^mS4ti9q&{hyORQ~eBnIvukgUbAcS^bwAW z$$zdlh64F>`?=oJ69`ELF0cLm_4LOyF@H=r0(oduJ-X(vFAs1qmFmCe&>AWKCl?>J z+KjzY z=vL1q8dS}uB3q~;&6=+uZR4*YKNvgP?16L2!8!Rcq|@a*rNa#0($`Yj+7-z_mtMj; zJ@rnueb#j@|&hN@{4I_rW9us9PR+LWZ@bYYna6Iw~ z2k?0{Jcs_BphX|`xaqVk7KR@FWs~|z#-|kY*&MyECx0-UV@Qn^JB%R=RwylvAstCn zxJCyG+Y%&9U_QbqsuLJ)g$Jpy9+>3ap*w+bjEbd~g9pAsi>Kf59(If5|$ zQE?lmT#cXR|6asu_jXEtFyso52y*i|9-4uEk0WVoeh1cd)Oyb!8pRi%ok0JYB>-aKtClb#kyFnkjHoDT`S-nkvu{Ii zvZzoAawI8{fYC|i%h>c1Rmi;38M-B-Nql}h>{@sgD-EyHB!F*;R1^TIx`=^n?3xf{q2!lh^YN9uL7O6TFM!v%5=@3^A1GvTdy%j39K zWAJX>g&m4F@GzTT39mgLkIyv>XRm3ZET7e85T^7O``bNT=-YQX$$mKT)}T+gnk*96 z+eD&@=HKys|3COVDNmyrQT$NkM|9Q0d8~F1J3c*YY_`J%oOUlK%J1{Fgn1LiUffuT zIeFOqF?G~7LRTO1`&=WLv&o6bexw^E_))C=04QG>mWcR^C8_=eSuHm>WYzf#EF>kE_WR9fo%-RX z%?4qoVg1lgMl12!6(h~?AoqT1=r%P$AE|@aXwCQ}W4AiG$+0ir{Z%n^C3Qu}rui>) za9*OXv1pno9{{KM+}&Nl^6aM&kN6*^b27EbjmvG`Ai9Pxu0o;P_tpKEV6b`4YVG|@;LO~ zW0^Erc8-hAa^=?DaH++#Zo5#n)6kDv`asJt7AC?oiM91FC&>gu*xBC{THpyiT~p+- zN!u4$mw~^reMea#8q+#vv`|S|q(ipVujLJd%uf!O{-Yi<;u#UvAM*Vo)r#u&zSooV z^~-1$Vx8O^ES+u$bQ3?)nw{fwhN9>msg)pBH@euLpIC; z_jpV`yKEW3k1&e~%9numydw@fxzKBj6dg1Um|y#ZB>g5Dy@rMY!W6B^T)X{j}Mj;lZ{MbDX%Ca z=SDw+2OosQR{!2i6-xKD0fEPzSsBbG+~HL;yyQ5e0iQ1Yb#+6JrP9G=KhhW;5-mOO zYpqCgxyw@7Nm1->D~B?Nr^01B*z*+|CD1vgu-0a23ky^cONF%|>Y?-vEEj0W#xg%( zso9fcVa6t47bnf2>%7>9GxA2Xk8;iS;Sqce;U}-h-6~V)bT3TI?kN@>*FKM{%}_I{ zCcRfGO&agWS?A=O=tv5OX6Wz2HcWf5!<0)3!<+Td927~U-lgdn18Gd$?Ki$bw`cNn zjccciP$Th}`LixWw02|TO6&d{wKSWiRYkLKcheU=7TzT908ziR?EY)3aT(7aaT(lf z_uki^Pgik^_eie9{#-@#;!8#P#{JAAX9J>w>fs`Ynh>K8m!K>H4G8F>T#i=P0Z09H zsxMiBe^DnlB`wqsLx_Q#gv*B`eEPw?e8G|8`!{E@gXrc=#yVctuD^FKKJRAh)PAj$ zDgGT}<;N=xf)BDp-dco|tum#Zq`nU%oHP!;saueOI94Gb|H!%hEIu2SQD0j{dFD!+)b*;Z; z{_1JSH-o{$WR{RyV%f6fw6Y8&NgX#gCurZuPZ1dV7%vWE?0I0@@Tq8uAEu@uQ|$xy zYl_E%y+Y41ImEqZ+87Y5s>o-*N>-o#9d?CYUmMiCTqO$VuF)aFwqKZ5>PxwN4{T|@ zpaB2fVaYrNi8pmYynKC1G0XU1Q%WShYy(;7vjBI%Ikqps}9cHih=_ z{J7LO{9CIYj8}90+3^Z}A=Gcjm@8kUV>Og#5t-C-kypu@uLiD-tNd4A@sz?ECZw7;DTWLJbo?(< zC0#9Y|3W(#M0Wg|#dSyT4jZXq>cM0LZB2F*@kX7}%cbs>(-oSXr(69@!aq(%6N1sr z?$70a(WG5&P%eErMNN3El3i2G8I&W)*Hoh?Qbnu#-u5P__&Z-;zl7~CM>s7I@w!#A zn014H*J+m%6}qB&|542l7ZbheJGrgaJ^#p;l^!0VHl!FXIUCA(&kD7QUNLEF!usgo zYg@dv9by3T=hIxqKCi6%$RcqozIwL9f#A_p`o1#!oWPh4`yk@2jPIpEm#UycbzO?d;(@A^6aBw)z)^+cuY z%$Ik*1M;!jfYxu|P6P)rKp3}&IGT%|C(dkn?rWrR4n+QxV>KNV*qSn-;4Iv|VhWB> zoU;ud!Ov@3s2uyIe811y)+9)SRb|F4gdzQt6$=a3gM!gaNAW*(AE72stShEC(^C=a zMi0v7>R8EqDiZBp!q~nxXFs8t)Vxo5jNhJ$OJ=bHeAoY6cEhCkpGvk=-h{5E;pvbB zgE&wIQk2hb{kNq3UjfTt6n-Q4R39oO=r7k)181JU`I=gpK=4Fqj#94cOw69JjGqql zZd3i~X4KRSn@{Cx8Z%7H>3fsQQ#Xa^vvr#HKN}#9>kd_k7z0U=>N9U#!aP+Pc}xpE}n6({Xp) zUih|B7twywHC6+*U9N*7{{DE6%VRS>T%)6!2T-Ev8k6=Xf?}(eb5p3qL|C=){B-;Fv6 zr}-Pf?L=w#2xC5l7r-5k;tf^s$U)~NPlzw zDHYckG4+H(5I|QmHmUSPcSh;B+ggNv6@tsKBI)dqhT#FTZ}budMt1^+$wdywL0Wli+`t>SC8V z*8pH>5D7D!Zt2pP1%__%AI|0V!-@EbQn?IKdjE2djcr~uWWk~k`?yrzWae6 zX!@yFRz5|7;uiNd%`YYdaNl=c>b{#TQS=(fr2Y~IFT1(xLBajZ*NliDj{qQ%_}zd3 z{`{A>%GHB0Hlry_E1DQ4Z5|l8BHlPpXwHiv+{9}|*2L_``|d!mQa8!inyMxP{A#f- zMdhA~d!0;UKLCKhm+LLx8l1Ep)*yf;9+O@!Za9cdLf>`C*j-iMsd-`kO21q!ce>G5 zy&5YH1xN4=+f9nP#Dh-tn@3f|6S!$;6!HadSKsSw$0DVtz7yaPIEW;9s*#}F0Tb_^ zgp2x?*iN$o&Z~lsO*3)_beujB4%glo7q^GC)Z&lVTSrTu{;ZgXVJii;8acOGUju8Z z(M+0z&t7L4=$ZSt$5@NIFFpbQKsC5nDEM+gFA`|p)!68>j%{;XBOZ0pPYO@X+(sA> zz=D{+N_t__`v5SH12|1rc(d=tE)-~pv49~htnU%8iMVd|KjAmAZlH&UH;l0x&8uo* z%{p~nF3x$_O&3Tm`)qw|G~2bBQx(W94&Ltm_fR`{Ql1|)TJv00uLe<0Ddbi{mCUZ6 z=Jew$w!o^3bPF*5yvG4|OJ>0fp!fj#iA1*9e2@M;arfQvqX~wMzx4kS3D3W%X7eKe zewJ4~>v!C`_op3Jvh*~&sjgOuL>M>q6Z}8I0bsO$0{e5Yp!|~&Hhmy;+Jn;A`04tB z>O7Cv#5(oud^&E+=WCpObH4{9LE5r9cpZk zkv7JVu$#QnGx1!QgE+btS753WI66+HC?tXcQfvZ` zmTJww$k6~#{I*6v%Ar(tSns-%s<&AZceNfI?8Pt$L?wA9pA`ew$G_jY2f7096Hj1+UW-Y$RHY1Ap3Gs(0R2*(C^PL2r9=T5I=73*uJgemu~Ez6ul}! z_e+r?>ApJ_d3XRg#K)rkO@L>7IeS@3iYxYKdb!iz`+?GH85#*8s)&%TTD}HAqr6?) z;rk+Ei@U$Sx1O+KxoS3%#J_v@z`a$$hd*;$Uw=4P4wcZK{#45q9(Y1@K@XQpt_SlK zu0R0OWbT2WzEXl!UJ-`*m%^j8q5)c*7^5>6;S;8_2*4-x`7PfwV3hKjK3UHF$|-Vo zRK(KEVJ(xwhgP->iNV`4Yyw%fMdvLUd{p8~%9OhkNMFgtBb}T}fFqG`1^E z-2_5o)s=#ElEN=GC0MblSdPC8D zvr8_<@qFjw#)PW*fRcu_i9);A?;?FcKNSW^Ssg5p832kK8qd!Fkgm-VlA;q$+^`wL zB3B;@#GgVMWlZV5(9LZijQ*W-S$CfjTQT8^AtVG+9q`>9D^xN(;a!nz0f?L(G=`A(y^4(5aF~H#H{PSs)6T}AdsR3B-mmcID{cBbY zXyLS}?+&3DM*^ImAE1cWK*SdjVaYy+ID#q9u7RL)*^$@)_JVeB1++M8*gfoU1dmMG zNane$cYyzHk0du1<9|j;*EaVfKH~NCDmSjiip{ZhMvwh$?5fo z7S5857ca|Z-=B%s>)RYQDHTd9SD85-6K(-ZWd5~4-zJF`LyXbCYaCT&CWv1?WSJ(- z&Iic-%@Q=SDb4()1G7t4sc4%rWF#$F{r0#Piq?8I@~n9-fFfjLJ3!m9{qi^*AmnP< z7rfP1z%D$BFDS+ZJ*-+wqLDbGuToU_SFpa5!Uy@L_tigmoHQqD>K_H24*YSiz>D1s+gn)YtV@r zLEmA5bwz_KGlT(-?il(jce$)A?G}!6L`AA+DG3LC_R7m=X0Ot^GfM zde3)9hc-V8*O;i5&xMbBYv>Hnh`-Ut*aK>d@?af)h;P8-2l$}(kOH|J|HcK+X??Nd z&6d6)_62JcY$JhzwZxT6!7OEOwWoZi?~-|%2ALuC5X3hIq8^naqUSQ1*Dxr zJe6B5PVjCz+{Zm0iwyz^sGn|jD+`8+(<;nmHwz9N1!&4>f zwZT1;A}3X-pWJL;v(dS25iH&T{jq{9KfW$9~LCOJ% zAqKDTd0m5wd4=d;0(I@sz=n5gDDgoq>VzLq0c}*>5F~#Z(PsB)95Qc#w>n3A;u_GH%^V|@9*>QNN=K8 zJwz1ou@E5p!GS`O`tk9qJ3XxrR#^2uJ@WD4E;5$AP2nTnYsQ~I*=Nq6ky@S17Y;n)>jT48?D$ovq zU+H2k&XlH`eu3vo-6DwIKnc7K_c>misIf?_DeuUvfkWSh4VW!rE!>2R#$$-IFpnN~ zAu?{C42y=C#!FtQ zzcYDOOn&|1Oi>aCbkW&?=%ti_<-s8&T@GyJf5cK=uF|)lR`VI=#T1hKy9)kS9-&H0 zqI~fTriw|jMCZ(lMPeuw7hy1c%F5(cU02UvM+8)Ke~w0vXgDLO{C+t$wtyUTCV!Jj z!_ox$oR8X=(UDuHe%SFd(BISB{1W8j2Sx zaA7G>uOcy3#32)kKAJEa8jEZT5E>dN@dV~IG3F1yPr*s0Ba+Z%y|H5#yhrG;ZzF)Z zt~vs9Z~&+ucq2a*1&0$6+x47Sx3;?oX&EG|VHs?j-j5E)btWHP|50>5_XcXn1CGZ- zvwvT@iOXdDLfoiOg5M8)q-w{?siEF~gCQkk} zpRE?48%PrpWroqp#EEW*#o<6pUeK$NsHM;mea3M}wkgE1w0xI=O^9Nr`m2t8tqTyY#3Bcbm#=@{ieSb`X7P3->a>Sk8T)`2RWC3)v1uLC>hU|E7N=E(%s+#SPS@aR>yu3 zM%3WjlDBdP-g;14#KyVe7P~n16DU|0ORJFDp=zy+zoatPw?}w#z0z?mb<;LTCCbEs z?uc`#HMGaj$B4&RS6{{S7OWFmi~ab;1Rt30mTF;-fIj8s2zZ`xci^vjt)b}-$$=>q zcL2boZ2Tx|wsRi&qLNAibmWt>7{^4bp_tsvj0sPzefex3I^(Ug*69P!Ysz48%3fuZ zC;h47&ot8*I)j|f%$X7zAHm=+8k=MIZ0H?uXaqIRe+U&0VPv%*Y%iy8N_+7?Mala~ z#rl7RrQZK(LI2gP{*UI=OX$U50}sb&n^Q%6N{ioO&253#^mAVF|AY^_=9H4_EvIGx zO7|g^uOsFTfDrs)6GeZro!cso>w5iAj%xKBhwzBz_PU`M zItGnKAiv1Qs>2g*|8`2b$kpbX8;=|L z$q*BcWv#dq&9l0X_$SYG8R@Hza?YO|2UMv?Z3w|hEtNd)9Aqy}rtn;Y{?WxPKu(s^ zENcACngqw8uB`3y16ya9WD;n8Z9`F}wRkvaFLj%~P-bs^6+>7v!~_^A>{cye*%}%@ znaI4_|Bw7`!h`^vBXL@aK#>o%6?kcfVFj3546;T#VH00W@NrFgF%L5yj_aD7B&7Mv ztu2kJ_AKf&S?*2&+!6#x2hd=-zZI7M2Bntg-UFtEh0fo*Xn&6_PkQE6pB*`595YXf zd-hk0l9vd_YhPBx|4aGVb^*!`ZFtRIgSR-+dA%9?7CHNq^gg1N9TQ9^?sPvpKodAV zWQ67Wgu;bqm&usc54LY-(z8aA5*u;4q5Tc~NAi7Rg7tb`w z%#EiMv5!Rj^j^<3$wYM~{<``tiMHCXIm?oq-dtxm6ymfgWoucl^t4hE4lc=g(J4hd zwUl|^KRHV5t+&3}Y`@@nMoK1NJ({Am^sJbFS?aT1t*L$BR>C7N2+#fj#{7UH%bY2Z zlMa_ZGxCuDkm9%pnls^;aDP(DXWlnEvg&P!qM`8dfDUCjG z-5uw&EMswalCI;`D}j(Vg7IGkJ(T5%SLST|ACCFoLsF?4%R?0IaW!^;59zlHP}tk( z?NJly3j?jPXMI^r_`v7eKl{Z-QT1XZEa*gVI?eu&=8@@YcP&%At$U>K}i9dYhU2 zo?&`2y5Qo9Ul&j{QtwB-r2o^>;0nN^Lks7(A6Hq90HcuRl~|6bZ^JQfSW#&AJ%FPt z%JXKo&O_n0zB+5oG!#HV%sdUNQ{#t1WqZ%Ih9dLC{3pK}a5$K9bl;!fn!vk(oO!sG zgozT9-#lsHmv-4@u%F=Bc_ThH#m?Ffqx9B)^wgBnUpZYi7y1FLbukeZY90NmadaKS z{h)mJuo0`H*G+ieD=F~*kL@M>4pvXQ|86omrTmy)q16V1{+Ohb$Usj=!lt8yD z&F}zVM_bzqv~2fAV|QO60GIVyr<jKiF2?#@KGLEz5JgK)}>4d?a30jFd==S4H@vpyAA0 z9xEFW^`}y>#;dOU;wufoVQU65#>;bw_YOyBH7%U1l{okqb6#O|Fj+L|(|!u@hpMyXT%aa6V> zP^vdh3M)^I@OY)~Q4YT-aox>G8wU!JLUL1*Bdz|cInwTJ^7A)c4fpIfSv=iq6nT9IK6MTkIYl9p(C+hX-vTA+oaHRJ5Z!Tr zB~ZlqiNQDaiXQ${ z_wSKl*>z~zr>PCQbA`n)#4$~6WBdA!Fr>euPz+{vsInPD*-jKBt@2F}HT7J0>z6kw zWF6m9(hxYow-i1ley7s+aTawOZWZ4o`4@u+N>{77%cL%P7QTz(u%;c)HF@25Lddg0 z6al2tuc*?krOiwtlN!>_fNK$&tja$F&o~x*93+1q4m3lDTrp^p@-$Co$0r+~No3Zu z&{Kr&n~;V0)xh#{ zTL%`Cj((o+Zsw6ahCUudy~pp>{i27wf=j0cGVRd-*n_q|`;?{yg7X~jsUmnQ+SAR; z*NQuqi%sqYL|qfy98h@269Qk@={u>yP&00wbUtl?X>?RpHN=!rl1tYG2_?#dUBE&o zL*KVMx2ctqPwHaDl&pSD7v5s6)2M*4n5}7!o7xlv{_by^=pvUFG>vF$(+u|k>03CP z@1vBIL1Qaw%}ele7Se3cp6K)Ngb-{BSsn6g#DkkRrOLL3sEr3 zZfG$q^6n^{KuseyD}W^embyrEJ}QE-1PCG(`xeInvoBDia*&CF4R4Tr)kK-RtCZCT zdj1AG(n*nhA`185a|3M8pwZrJ_lPowvpZ^yXsyhbtYCIf-;pxv~bZqum$ zrO?J*N$kjKp8s(L+gmHYShlazfhJ~t`wW4LG;AXRf1ck&RcSs(liNuOXN~Ki`>yj* z%0T!1W~!iU7^O=kobsA(e)oW(PWGj~Sj2yr>jyv9%rE~!(WStM1g&KGk$H#`UCbMK z&0$TD4A>e^wqAzmxhA+qoL&l#qh;fn7!fp@F3K;5uGzzJsm27X%%~I+OSh_-@&=5m z;gRl{2%-mU&u_MXj`!TueS+^Y`SARA}VsN0^V^z;h1sXRQDs_4%4aAWHxyS;wsr($UQ2xnC6=(ts7Jo z_^A_2fZ56GT(nW7fA7bdY6F)2GBnuYy0!VGvc`}sc#{sM?R}6ACy`yT_oFwfY81EV zNAJWPmN=JT&NxyUxfrg{k0)cV!1AbeH(v_UWcACD5{`w>+DaO_ls3e6M8jt-@wRA{ z4(UX)2c9xksqE*W@YYkRMX&TUeZXF8bq~b;x2@a;TiF&12lXVVWa9OweBIiPSHat+ zSh+rZ*aGivR)7fqr%fm0_I->_16fxJ5XZP;;PaMi(!TW`X)#7id1%|8>d3SV9KI(2 z`3iWadZ@?$8z4+U zst1ln;Yt3OHkJm#g@T5HGOBU`0Ehe;Ot)R^^Q;EjV@-dTj5RQWncUW>`_qj-S>_G zsb^JaSqr>p3b=KgX^}vitiy)EN|5DiGmz+I*O>0H)mehFJ`}o(tNbZ<1ABIXHHg*n z7>(&wX*Qi@r~U<*L-K=AeNdg(g!-s^I4#V!ju+!S2vK05#1di>QP(z-Ert1GP2TJo z5pf!sDs-C>=7TTipLcRTbitdt-y_41&Z7&qGfxcGUp_Jp--&#yYMjVnj1rFP%Xx*| zo%w?v#(8S%+tcl(BDhR6RWP6xr^9Z?Q1ZYCm~`-b)q7#ERVc=m8ke$gDk_bWPq~ic zN-93Eb;N$}^_a*W#@?68%8cRaz2)lWt>!#OUa2QyKz#M!GGI+38YZNieepom|M8yj zqk{XIIw@Ch;|@pN1^9ei;JU0e{zCvfFnqw#EffA=cUu+)>i;#nn4{COk_szUf;fh) z1=oB1$xz|%=E_t|9f8}342`|v=)>C$tGMVm zsN@2uG1L(A7Uyd@E|-Dn@RHUzkwQE$vbafjxJ`~e^7leHqm5d*qzx3g8)Q4H zQKH`B3Z+}T_m2vUv!wadsPjFYGKi+TxIdzu?A75kY_EQk7nmEYC6$%2V&(NwTKYOA zrbE!Os$0IeXqTea;?)PtbHw}zQ#+6v)-yIwTiT{|rJLO5>9X7o#V)w{#(84LzNI%{ zE$yD=om2zyz2CXEyTMLmiFF6rsTO|YJgqI|=`M{)<5f>hOG-nBgZk|G zHm)>$mXzTgcev}D0f*DT?T93UI4eYUN$X`Yl3nH~&H5&8X8rqTgv5j*sYo~a3eek4 zL!QseH%5tKCb3BlFx60cyz7!P)MAfu#?jpl52RUFm|2WUPuoCw_|)hd#SPnH9yD4> zT3YmuJ>W$Mt$fnO7qIaZAyRYHsAun*8G}SY!G<&+{3k5fo=aW>e(BO6{>=}egU<@^ zpv{Qd0gys9on?OD-glm5L$`M1tU*qqItn z5O~j0nF&2m&pPS_e;vToaJiO0L($IA)YV@S9dZ$b$HANfS^flWurNNTe*N$s(Z_%_ zOq=@L_1Si)n$TvfS#}JFl>NDH!9|ky+-*T)!lW>>;5is36Uzo$#6N>`+ni`s@A;Hw^DczH61M#2?Fc3!8n_0dcm95YyF8RJO`|B(TEGl;fHcF1E~?q0_+v zUX&;z1E=jRdWZbW48j>zmf(sR_J>CsYY%dLdY7sxuE;}kKO7;MM@v0S5y;&1JQ3Fr zWtjR#fx#F(0y%d-9F;y{G@%7gPB<+Z^Q;Elo+4m6WKXSjL9oeb<<)#;F2}>ijah>? zJZOjbbzVrcrB{?8Qoh>7mLIhg-kodXxljUHIF%o^wd}>mc+!aFnGS~HVRY{N!Y~gj zy4{JVg!V`OOZ-rjitra%3$-cT?Sg1%dk zXEyRZEy@cRxk1lDe|L+V#+w#YjTimNhY&KjoOQzHz@_Y3IT01*dkCxcatZa-1&;9t zh+jv zwy&hPh5@Ng$*@N@zmtwlqV_RYF;Wx<2zRA8HA*D9Wg1l4!0-=)U|*#riEx*QhJb{5 zo1g(e9Vh$YduH%x&B&kvR!#m2V6c+jhsJ{Yaf&*w`cip%TP7Y8)U4bSrInH zji20P@{+oAObKQAgee)9-c$Qk&2#a-=VU5>yyDLPUo-drnA>MJQ1%Em)+JNUMK=v6II2*A5Yfe zvq>rCB!~&QR%tOmU~4?hFn0&u8afEadyQ9eO1^H{Bd*xT z`Pu-hv`w6wN+lPJ*BT#}+ty9WlqV$I`%~FCl1&c3LkOp5-W3li=#a{Q)+Fg>F^#lr$BmWE5#i3N3u7ggH%`CO9)3Mden~8DpwLx6*?sXSH1>BQOe2lP2Q~ z6`c`=kpYT(X30-E8o%P#GtOZ%Uf7{Yp;FEkeuSuwFtt+-==g<2~M zaAT)&b@4M$mPWZ**ii8_U-K({cxDAlGKe2fv=9~?{gi3L1aSw^pbir;OWkN~D590Q z7$I8>k~VH;z*SLu&kNpIN5GL@n-;u-m{){KM)Qz{8RVC+!CvmbRpe%oO5f0`d;cjg zC*Uw&q#=BHQaWo+MCIFaJ2?K@T9*Md2bVETM1x>6BON1yDH_4i4uuV6=cRB2Wq(4z z3uY)hN_68X{qZ+M0R*-xf74#|7x#~f3K$b$YUx#em z!#bDrJTiu>`WlHrPXEJtCbH7?b-L&qU38RG8eiP-$V}L(wCpFT$3*I3n(j09^8}@y z#Yh{Fa4KUeMsP>IQmjF957;S>LDgj;=^Mn+<`uUpwQu>kh1Sb`#g;@pIPSiR%6aZ+ znB6gn_;5~R)NrG+3@fq;ohED2ky4z6SVg5IE4m5XBhpbw9xt}iLrA;cSSj7?;Qmk(SSPEJ&Wk!D0L*6}n)sJhFfsBd4f$om9wCB(jFg6rH zG{n-R2mx;PWr!xmB%O|J8+dgssyxrn-izpxl!?=C{Jgwq`cfa1#vaQws+f*V2rE6t zs25dEhl6+YZyjTro)tl80?lF|D_ZI3W5Z<#0#qW|8QF?A9tPU`X{d|O7irSMTT$we>OR!3V%Y~T zawBEcunJmj4E6}KU{*CXq2N2jl(~Xbp{x>F+aLJCWMg*{n)T6ZP>d8JugY1f5#qgm z?BTnj!7tAGg`cg35aQ~Gw-D$rqgP^9E@oZ6s79SF!K;E)sS^Dvw0=WC>eJ2U((kXu z5^K38&sf~5h~zNW)qBzsh)xhYbP>dAJBy_Jz2{3)heCH|sC8WPSQ|a>fNa{O@FLHl zXUWE3FG#geQJrPzP1*-hgo)j19dC$WBhCxxvsJd&DBFq#l$C!)@rd&nCtEr}#3q{* z%9*yKSp!j}>MYTVFWHG$tsO$@Tu7=FjCk|CXFkzPxMmxm@wwIqAdH%_SWR0(>;8r~ zR2Vmy6FK;w#tp=J6ueco<*y+y^c6>OpGovjM@LP9MQd<>)nNz?f3xXe8A2H*r6$Rz z@+M@fDUpc&trrY5Rsu$Fi|L`xI_oZG}O>Y>ePGL4%rMz}< zwLRq^Bp7AKmjA-(JJ^*O8d?A!U{s}GQ*B9)5rKIdG1zM`O&FE5^ZN#9@L&aDUJo=<_M(i|gEOi^K#Hl$OF_qx;pbr(h7dH&Gz+8?reGI-vYFn5_T~EVXKcpF!+vPZVdF8?8~PxR3&+QRB(5V z=QE2P3)H$cVoCvY{#;HE&dfv$L`fR?R7o0(OD)@2^c(jC&7+{6bfrk*E}I^C)pB6j z?z`)2>nrJhfY{y0;J;oI*|~ zHk>zOXgk`=-wWP`OyylxReY|lMM8y55u$#4pV2&6FKB0tr*_{o99BJQliO0IZ_6@; z@Gs}V$t;`-A;Q0rHcVQ3Ep69Q?-EVSMvmDoSzdt6(=19CthueT?U*Y|qQE0uVK;J? z%d4vOE4znr@=Bj*IpE~_V&!#QOxFE|ztw3ZU3pEEm12KLnxp1=(8Ou4xvRf81jx(Ic6>oSmSvr z*ECq+d30!BLjo^q2t4vfsI3;B##-+K?}N%2-S$3r;R_g^WEoF1U|#~~RsS3F{#8)4 z5?u=ajLl5QObklDyw>)4r%TkP_3qPbUjnyGuM2gqr#>%5vHmXwsh1lz1q9%M0UPx2 z)RPOGM@Y(FN6?iy(+pJpcEjx%vkWUAi0h=ByC_o?I@lmRlUUXds~=>wRUBejr}=sP zang*HQ&^95rS}rvLG$ld6d!DGwhRK!dVG-^1u+Y<%n=~OWFs>sD!~M0fM7APGZG$U z_4kbX6W*>rre{>jX^SaahP;9c=>}4zzeCXzy|z*IWp45L9~nAbB@3+-jZz3xDZ8@| zv9CXZl1l@U7-!R!Pz_2qrO#%Ww;sY@vUF>#X(dt`8$&d}bO`zf1>DVvi(#B<<;^Jw zts&i4B7srD8-_{!_5Lthbb;#UaQSjhyO zf5DHNvkmaAXSy0sG)WY-@f`5*vf(1(lKq~Bwkxn)WOad(>`BBsmH2*ee~(mG#wuvA zs7Q&mc2o(fa&F#$A~hENEIcC90_>Nz($q|(uZ52}{rVNB~8|VmU<}>TDYpoP~0+S5R-V#ciWKEJx*`aWJn_;e`57966sZ{3VXfiu`<}JWr zyccEmJlLzO%J3;G@aDj{TUhTl&1`Ej7#~|Ry3GB)Z!eqz>(=!4i8uOi1ZGnTy(SgW1-H6 zU`unCB5eR$|Sau zHzor21T|<{XwRERhDaB(pi7s-J5T*&BlvuVqsLx*Cem$y%S5j zV0u^p)LvGi6%Hd2OImJxzXlo%_APRLc`^LgAvLZ#H0&lhwHh}nm&+7|LKdBFy=Eob zHHm1##;erv-!tEBnD&rjKWv!+hy0;i@Jh9BIhZp|nsL2}_cS$KkUU#;ZLl!?b zLHSs=i2p2UP#S(S=axfe{uC?nvN3fw(?a5NUR@r|(@Eh8G$wdAFP|SHZ}hc!w6?3x zJ(V{-%=&3)1Csxs#4Rf=ujy%0GqN(O(#f!kA)*iY;_1qL>Nsb4WT#b<=v4_#Xo6IO zI9luFHMQd{7}}su7|*2J@-fWCaA|!okBX2x^FkM2=N|rdwqZJs8TgmY>=Mg zuAWF@_9~KOG1jkQqEvb-hqd@v2h(&Svxc~ZU;1Rxx_b;}9@O8?R@~Gsu-k2YJVJcb zv|fO(+ZBcgoe1lR)&G7DJ&XcFkBe^jmwBBQIh#aF#Xz;;*VeuTxh9N%StV>KFZ{G%Y2hnDshT?&aZZ5lQ>Q>I_7)y?cF8S7q<|N zzk>uUUg)(Pf`J*HTRLg(UWhq^0{w8C1S={|hK+2K*3$>b7*5_T%M9k{*$Vj(y=+SZ z(Qr8XD2~;)6Wz}Mhi(S!R^tJg5W;WxWAx2|bp=+)yIxSCs@)rFR z_K)MXJKidH75;nx9_?72fp$2U8qjvSqgWU{9$$F97eQCl?~&%3*gDnPr%_Rlf9-}R z&b;~ENsYgEDE9ECq^$+b5O^ePHW5)XnWtF5z|SzmY^!R4*m{F+WNj>+jG{#Lct)07 zqL@$eIiJpgSH2|5std6}*QZVA43)XOmWPY4`lWxJb8Kt8Tm&hC?W=xf-1>twtZ=hi z{)60#N%V_J%Gv4ba|vuc=QCj7Yv@8`=<2)w%6pAIkb>O0pul z#j&ep)$O=cX&<-1bNr?TfARY)$!m`Cyb!^xvDKVykA;fI9E_F*|ioMU(LL>4Rix62Ex>(9GLB9j$b+DAHEc88S=*{UfM zPG}{{S?k`pnSb+s-6(OfW{A=$a2?L8r3 zElBon7YsJzdRmP{9&yUz=AT|iVvN1B__dj+D3%wfTgd3$V_G~k5VeFZ3-3FJ+iu?oU-q-l=G1=A3`zJPuU?lp8@Wy+uoO|6LLv!xoB zr_^jsAdkuRgONcsAhg;7a0ThPZIAc_3N-reQ8mG5XRhEwb}kn*f}%)0ai6sL9pZpv zSGHPZXVlB9FfIN%%U_{mO>{|bRZkm62EFZoC`)2$pjYuiQI$PUswCv`{&F%d*9w+( zVbAgGlFy-x>4e%JW;Zy8tOaL3#CRjG9@lx9VKs>~b*?fa2S%9>JUs zv-WecyYwQGk62GcrXp;@hTf%Q)Y6%Xk^gmdEMXdoHn5z{JS=!bn@yW^VqTAh8y*XA z7YK+mjq7siXFXi0_n|%_kSr!{g5WZenn;>nHU2i;IOJh!}(jFdjZaY0_xozITW1@qd%m%R}|jESebU zp{#`hdpb0;-L6K3xI^A6-uvn={Ujj}_G9fU2PxL+T8(IJP5iAX*@sLJddezR4S_Ez z*VrT3)cp9R4QTP&y&KW>l$yLaE4a@{5Ml4(aDgi%)5|a@<~7W-Eyj@CJvX>5NlcQD zKhu=7T4zk!ovJx66n|7{b209x;hh|54c#n+*6+M*n5%dL^e`bPS7eO6)#Mzk*YOuz zcQrzEO*d-}lN~w=*?KpW-#U2m5vyN%;Pk%YjMqKxM*Po=!+WPLK7xbD@*i`I`m3)OIVJ5$q~?2_~Y;6Tp%}stT}xzq$dTFXum&pb0a%ss4u3D zo$&hDjZ)h^E$ep16%A*98PYTVLvC*;p}#)_4(N6@B+^5Ls$eJeT)`$0GwNgf+vPnq z8I2F;DTNp7bQswSIQ;l6y$#&ua(5UZDV}s@vA(`=!KA_jqnbK9ol%NQA`lV}y$_W5 z_`HVq0x~^SWfv$hIW;jpQKSiJ76ZPGb@?V*E_O^g8JkK_N~8E`SefaMh`EcR6&juv zB!u&5O;MWCY~d6#oiQ<}yJ8V7Pb|z9N~-10$~QiA1!_lLmJlDNXIVKd6*X%}TXdBY zLQ}|XsBdNQF6;&BKJCTt_oQb%k*qTAVl36O7ll?l{V|!-GHj18<5m za7EwqfR(&CiA<|T6x-E3MxMBj5OAHU$n zE)YdmCFttg3RpE-ZNa3n#Bd6)X~3yjLUXkcvL<|c%%Px~gSlSWCv8QruAa+i9@-Zl z^QMsk<~PeRj2}B!AiHNKzzc)H?N{|Fbw@>8)8TFd&&s{(OZ;M44AueLq`T|66B3th7S0Y zgdL7?=yo9{B|7Ihc%C=0d4oYn8~fU*d+S}()fxW4E!o}Fu*r`c{UXWcp+$V##B)n$zBLJYf} zwZEZpGN;^^?2vgnO?xCkWU!Jw%9?s`fc>!0D~BUlhZT=Ao6SL$n=Q*Em!c{&5?m`f zEf1{hzzDNZ#u3&;CO+<OO*smTXg(!)@Xs>qx$wKXWj^u;($ic@9bx%P?nW87bHrx1q_Fth1qZ`$+f6s1C-X|Z)k#EbBeLW2?x$ogN z7QiliBkiES%U1+ve>0G$(2xF$gmXpYiRT>Irkn5pjwdrWnv_`+EdWOidSCuAF za}{Yq+!_&abbn>H2M#Muu%uL<<=+*(prm``<)VVgr=f;PL*xIK-DddDvXGZ2}QiA+4GpB&nFX0kAV7x>cO*Xb{YPSgAY zyXncmX%$$1!A5z_RfL^|?t=;Q`nyTG7~nL89g^nXE?Mdi8bY5S{F92KBeEcr2F5l? zZgTXyE`#@}Q%n^}Jhx?iQq!p6v>GK5URNeEY1os{MKo>exSf)j0rzvBpI>e8$HxC? zICS0NmZY0aHB>QStg!~QVgbF+OLxd4d4aSv@h!@RR-Pp+|H#U_H)p=}R zCeht_Qd-{AEVE}IAu_Tr?W1{W=(nNUE9jsSl<#0sf*3m_#cHHZ$_-GOXSLH4!plY` zZG?FYq#de8zG?sRktJR87%ML%pUrC*;VXseq%$t>JnLkoWxa%I^xqG3XiK_$LC@2j zb>yAh z`*)LfCG?(plFC2F#UR2bb>NQ0`|TLapiJpzdY1)K~W$eRoZxxETnxnDh@+6oH(mzcNo|lN{1hvyb9$u zVx=6x8bP7E(@*K+m_2KFXN&C0CNbJRb=9RIdctHq*Q6W)uj07xFTj_a+#kT4QW`WQRp{)pW3lp zVb2XaiM-_=81hb=iq2hg96Ui+nFMbzZ0IcGR#19BZli%ruEa#Eo7590_>x_uKzhTZ z!PGhbC`SI0nfVHw#;-8VGJY#E(pno5FO@i!R|jgyO6LoxSz%7Qgda2746pr?VZUG) zp{wZ#teF$lCEbFjQcdDEId_fM(<}%-OQOGCO{VsN8rv1Wh0;0{H*T##5oS**>IW?H zT)TH$tmvL@iQrW3L3uOtt>h4JZ>L9cx{v~?O2aPj;6&MJglXt76T~IsdD#Sw4Cd~` zk(k15LBngS0TZdbAO!ss+6=RF63mY^Fb5qvBnPLmT)_Q;FHs_6;sz=y~m0l+M)YXTywazSjpE zS{KEmL5S}98s%1pRc#bqQc4dGAoTnvs`8xcB~aUMseHz+jxD+}>Vd&+;_TiLrlWb{ zF(+~KO)AWR?pv{u!RElpi`b$nQ>JwLIVD|aw-lem!&ESQX3@PxdOUIXl(#9R?Sb#?zq2mqvj&8BP!vhCki)Lt6fawGSiF9wYS_edTqT^BxQO20=P|sc>h+bPO$*o4 z@}6+MndXRO5C2fRt5q-|U}{z6Du~e8S^4;2M@^ zgPac?nvFt<#m!F*%dZ5jU9y;vq4evVF{SDedOlrt5&2+fZlQ$KPXId3@{j>;vv6g= zV%yF>CP|{hz^4T&MMnvrdtontU5+=-P#O57duHi<(86mB0k}cp4_Tx!n$-a1T)&GC zD>9|r7_=AdDh=jqI1maX{HCdE^B(KK>mj{=y&7s1!!SBnvR!U8oT^nPeD#)UGhn(C z0L|B|5rZQM_1$`;lxH2c<|yjB$Hu)CoDMi{OtD6x1VmTFc7IQ4)R?eP?U}3vp_8>z znH%lKPY6$fOD!O@<1~MjcrcyJ>@0}BJAZz3F+zn=o9|%1=WkOG`h1c%ztu3;%WN)= zNG6_$nmVK#+Y=3?XOp7ww(u{jNXSzw;Xd$)vrv z0p6lU#>14b#E!I}*(6@wI6RJtnUL91&m?!6kEKW{%wS2~_Gw`UurA7nvB# zWIhQsiwQ#_U`V)1r&jIv=cP#^TPUcA-)c;J?$uGwmi{*dbV3kM^6W)q}qSDQ8S zq}dsggsi>$+hG2^9_6+goYMS~k+&dg0uOWaZQc#8O-JWAi3hq@9wAV3DRG6F*Etgt z3i%GYzng7UDY(3_T-E0ze<-z@LMHln|FeUKc8Tek!G-BahGv>W-e!2$2qZhS>`HoS z&k1h$(@a23{rgdnY=dFY4T}e(7#H0Z*B?jD&!eU~g<0Q*hdkVm!a&PltnI(chB4WK zLs69h)e)i&P%ww;2cCU@Cg>a#vkFqGVP>uPunOB@Z!dnoxmoP~Ofd1`-OiO8#y?H% zD=g|QQlG3w`GqTr*4Dp%Jgum25%H7rj=@IjvS+!^Q>Zrl_j0E>{&Cvg1)UaMMDV9R zs##4)RDqGk?TMzU{H~>i0KzxJ3$ykGPn_k6iHq~1YL1;ob!(*5e1AyLA)`v^*HzG= zqij9E)zE8EYikyE7|y*z^f8G8Ds{+)sLFi<4=9+Xmi|i1NbB_Y0$*nn*(t7xfk$2C z!%$klJGxHZP36SPdA(!kb_=81hhqMQx)tZ>*sD>aRYdV&wVQJ@#AZp75u3#kHK*5+dTo=IF*^B zgwq6eb@Axw+5xuM8$}TB^RJ%tf2Os@vJFgSu5@9z0020R6rD`$3l2v&{Ny;7u6RK+Wh7)=6tjBxo3%?sTS)Jlq`#t+$A{2xf~V*%h&4@hcEhj6;Wm%rNXhZUkSyl;(oTn% zf2uFnMk9{qQ$qhvTc>icwU@Jx12xx^#`2do6yLd$$LY%{J_wunFBsF_@=3@{b!$a^ zuf2E#Dd)kzeGHloj*2eo`o3VOz^iso}kQ_hsKL<+ZDU<*}RS(;V*fCzkNUf zSqIF=B>3T=PZ;>BXlKQHwdYvt#c%K{=JQww5+n5c;DG#e04Ny7JB0OfuXWSQ93{R0 z3ff5W0Z8~NKa&gU1Sdg2>ur!q1AcZ*+VoYBujG0JNRBU`zQh2y>A@1$C10qGW5_W0 zkDgy|{7@jD^~!Ap4u~g2vB~C0=Fc}EMc1_W>2)*P+40NRPnU@5wiXayv_bZ4K9d~C z*qLghN8ldB+&+hBF3&u>wTByKbx3M7El&p4lePmhOe&oE-W&`4)h{?A$n6*JN^#z1 zpBQeCWPmgt0F38zwD-dbkn@Pjgrs1;5%1uRT9^GHfuf3C4GEjdt2ES?MqfAEG7zm7 z=S1KSIqz+j0vtD>7aB7zl&w;`w{r|4_^@Z3T3_FE41&xQvmyX;!n#S0?-0?W1NoOK z7k;fq2dS`5CJHnOKs}gdzCo8@3sGaplqi<+C(k*FRGfqe2e9HLRQXw z9liw)>^Yenw$OgI#2(#M8zhQyYR}r%$=bsQWarKUrKT^r8m&?mY)}T z4Bl4=xOkNp(QXoRBR6~hfb{04ORHhTFi(2n=P~k`CqvJ2zfVX#GkM(L|8%!e+%HK! z>{*WVmNLuF*uN*&pZ@|@)5m8oq^Sf+BIh4DT{V@U5h5nBU;iX~tl>yPX>ynM z)=J24(+#>GDY>GKYhe8ThdmevGU|J7P&0QheAJs(CweM|nqmVg!8IslQDtEj$S&&n zczSx>yfMsTtJC6JOYIKz6Tk%PAmE53yV$>Lf6v&8?L0YDshB=?0f*YltBq*g)G0{( zM8d-=91)Q0y9^w17cny*Wm9o_i1!EzQK=^@H$qMc2T@LCP9a~GS`Y;m+yF&)-s}ZR zm2vjtr=K3c&_)1VCb<0>A%@L9)YjL+E~&B(q+8JJ9#FD5Rv*Pf2}`XW#;Qf0&d}k8 zQT_z(bLTnh_gLaH!Sjn==QaPfsalwus>tdr-NGh7UoIO7q**Zj=r&bc)_JU5Eajvi zrLqWuJ70V=EG};VtOz*Qd=?+u>ew6j^$=ZUdKT}0+Jh*{CisgzUQ`5!d>6>3?S>(e z5Cxqhw?Jew>MIDeW?D4uh5!jiVVWNz`s?dkB@7wNRK4kom7;|XhxbbC*|C>uapUa* zE$k=`2w|V)$11Jrm#xEM^bku?J-g z_3)-!Wd0L(N@Q1SE2PAWP{s3J@Wclq?Y5t8GnK%}S`B(2OoQ;=AG5|$a29K#l>U>z z_m`mWb0r>TSE%1aM}&m7@5QA6{ z{f#Z$0`&?N;Cj5TUxCYsRHK}rnMlS7kSA64bkIBB9d;$IE|`xROrVO%{^7B&KcOqm zA8;Fa761}*n&RB5tRDA6av&BCYRJKMOim`$-W(Z+eAd4dyAr5kd^uG;QgdbhEf;cf zVYjT)jKKDpo3NOrTjNuqDL(TL-EERfg`6EyLf^s&zUo=$on`Dc(Jac*M-bj5xV5wR zq)M04-!vH1Sc;I2t-o;SJ0mVrOf6{=^QNA5p^sfa+-uAFO|83CF*_LN3nFGOH=%Gh zd?!%wshZv!ekx{Y`b$Wuq7IM=hHzz1L$Gc=al(x(PVH(O=|Jt9XVuzZ=?_WQx= z2&TMFm}3DIrT}7y)d~ntZ)i9W#x_!PWshG#r%xo4r8mdn)IndNYy=%S)#g){rwF6R zXMLvfkhG~`J)9rCJ5q&nAV^-LHGC|@217wvSuV2puRD^9hvBm6;fx;sCymhfA2_4*P?PU7)tf&7 zoM_>ecFTU-9=S~3XE*G#zp79%)^q#9EaA;jntWuyenwd8p#!JcH0@(a2q0AshF#YY zG6vX4O)#&aciU_J_ckRObDf=%Dn{wyYo^fNYumZ_U@h#7Yjw=NUoAC4g_;f@7gq5* z8ljjWC#%l4Zzj$Jr7>FCnC=^rRlSCOi94YK^}~Wn5v!JwBi7}6bjt^^6{{lHB@KZR zLDAa>krwP}Rd&8G_7OZ6bjY=k&j$XoA-1U%f2DS|L-r@k*4{yE>jEq9nc+sVI`hOd zTm*Xs?gx>(&FmRD`}92rJ{Dk-pDw}euIL}cUO4wXyL9(a6FbrNe>97M$(HZkwfx z^sM}*&d`G%jgm3;vO8$4@`MIYN;;f|_rjbC)s^qwpX7GR@y3?T$P{u&LYfMAB!M#_ zF~=*sK&&V%vpSzt$o`Q;x2@b;tvi45Zo6EpNR+24fC?4Q>iT~+*eUQrDm8C*D|86KRa*I1I_|A-w7 z(_Yqm@hX=(DSdqETb+jvXNdy|rSU|noEE!svXvC+aT_abtEq~GFkMom$_J;e7WhM- z0rQa@az`&KNGR4qDwW}7&aL*LvDm}H=pb;lot4vR$mIV1?Z>lv%d)#k%Pagth2z|R z$U{loswHn6uIzfxr0MC`UUUifFuQ2kE~MqV`o(B@W>)~MPMnTFK!rizLE|1Rk6KRD={nN1bsW=}m zrhVxTRO?T?`ZqjK%;?&^OOQUXqUvynCd!`Cc~uy#@Qk?*YWBQpTEk%TvN|Kxs`io& zlg~LW1Jpun{O3~+bO_HS--3~11;f3%xl;8+83)JN6T05YMyBAYL%3-We(KUUbs!tm zwcl;Mj!6;C)Go`WdbzLm83#}LaY=bwb;}D9(x!54@I}}oyR-T|O)5Cgaq)*-@~pYj zt!Nc(HM=g$Zi-be)JEjDYum&8cSO8)_jMt_g|jEa{aMWNca4BhjO*!9@!c^+h0vRWIVxMs14>y7RF^W%-T7Qym@ zy{)HnEpYRh3v0__!V0w^R00TS`}?KT6KBD?|=Q6PgGP7TNp!|*3y*}~a< zW=J%sBOYLvHGTpbk%4&E4al&dF3{BYK>$fW$m<8zv;bFdi1@vGuk9Y-GY)kNmy(L# z%_uFq=LZA$G8xpkp0-|Ihg&b!C*@z#Wvd*fe!K6y;GFHhl72(leP^LFzy}}8I&O-qCl`p<@*h&O!L8=(dpneKSdQn0j5wTSTRb=@f*zCgwcJZ+MKHB5s zRPe5rx^TK9b7N}^M-*twF8L(`GB#RqVg*Pef&k6uRSI-0kwIyBgIz-59;*sLtB!@A zz`aGTQz@wL%kDRC&l*dgC)&f8!CPx>r~Y%^616du_UVJ3^7q>X$KdXT2cX5gK+wd> zgngR-A_<-(vJfW_cv4Pl;1jf!DVKcbsliuXJc51*ial{4mNtW8_bO^XfO4~yo^7Z& z(*e|1cR=0z@~-Mn=V@Dj2h9Lz^f@>n?$v_V82GmHq5UMtBA9_!NbC+gz!HN}PGV*t zeSrt8W1SIua3nV<*Z%=Uh{SBxo-?Qn{~?vBKtJk;4{VZ&0-L+0Yxx%;(eJ_*&#OlL zptf}k(FNb~{f75i@AK)T3a&2IecSKS?cT2hiFHNI%@5O8W+^DAgWN_kXu$jbloyzn zdqy1e4gBFASIz;^_+2oFTzT3~>$MqqZ zGObDUW@qezW2%6?xv>O%j=`*}-|n}G*@E)+U%zS-^93)Wkk>4y25Mz14z^8D>%X4X zERY=Cj%VTz)p&D}ORqTQ=-sVP=dOd0*=wHfprlU*es9z8RA|H*nD(`U0`2p>iT3Eb zcrG`hq6>V_PWxAYvI&m>H*?nil0<+fI(0V~3!|9uf*htDLfbptB*pWRvD-!PA_ zm(2>R$Hj>1%md8-8=v`aT$=yCzGVLOr|r4X7eC*o@JfWyO>xanO4&-eX8isD)^>q2 zZI`dBM>#$5)9Vjw&eLf8890{lKuO^7UBFhX-#na}ES1-8wt0vL+R*(E#0^{kHV%ut z$x1Wk0AhiIps!NoB&ObNz65R{9M~28OW63ma%I2~Hv=v+GaY`ms(-GA#l@qQjr$nfT))W8<0nLcnvCvjf#b?=j6&kzd) zWC~Ga3Lg&H$$rz}mtx=H>)|EL->eqp2{!pe(`b{HTn=$v3R`p<6mQ1X#-4m>y9S)7 zNivCmf=k*d02-_h{@Sq^MS63G%l#v;T4?vc`m9BtASAtN028n~Qezxn%!rj9{&Gi)&28)5^lM6WsJF7Ld_R9a;> zyZW_V2F!$8q?dn)D7L2RX#?Yz<|HHwci{iN$JI1uQGd*Wh=9tjRywoWGd8W_d@fKp$3n|_m2 zw_My|>pVFTWVf|jzZeit!v3tMbe|;-mgE>sSWg*bv30C5x@!~H7OHty zNWXnDC%qlN!+v}MKDx9YJ3q%0Kb7?oe)h$HHGsZx-~qJQUkNNOq1OwrSFc#hAHQyO z0iGR2HC)uBgz@g3-@CzJLtirR>%_i*_KG+m7{KaH{juPpgaU0WU)`J13yMd3Kzd&X z1quz=cSa8y1I_@H(MI0>`T8|xU>xQ97c@?=MrCGGYPWxT#}6LLetxUr^PLM_=m|IC ztNKk`+Ep0e7J2}7za;~qpFdgFtoVpZF(T zDGABK(`_oCCHfXk3^o>m#Yz(Qr)Mc!6Y+YTGSK_;xeVBCk0LughwFr=vSc{|bm!ff z?Kba-M}0fz{$ksE0Gu*38YL}yUla>s*VlejuDC7IocjR1d}3y8vtYIiwZx9;ieKdxl0FTQj%~yW z+&(vYYC|x)clz(m7ys$QC8r!Ah;2bta%EZOzPFU*7RG;MFIMtG#P!HVd1~sVZTTXr zGBbiJFhfwqw!?mC=R|qi{rj_nzrmd__t8ILeX4)Wp8dB#=6@(YXtfBjGkvRWHXk=$mpQesGz8@v&G7vsEv_q^zS00qZz3g zX;xRiUW~b3kGpvLeVS}<-Mu}lYdTqJ;dvHvwK`Uj@AQ8(vU&>M%*1>9@L>f~9u6iR z2#_BL3|fbL-Ld`soj|$2QlG6{r}{czz9dkjNq(;4TB0)(iv715OdNi;p2%g^C7|~1 zLmH(OVM<|nUgcWdU(-2Fl>*gj%wEnX9`3sv$_+yN3i=4%a+)yo?HGPCpb4QkmB)1< z{l@80>t4>-Oci?W_JPWA10IZCP8Ze;5{Ee5BbzZ!jNYNz66Mfvxi3M)FElojc z>MYMSee`Iz6`zy#I;*kNhVStdB047CI|R=UwzL~l3X~~g*9$VA=d0S)a%YQF$%aQq zziFun$$g$Jsa-n-25HB^edo72F*d&N-aw$5r7*?;)|&zD4Ij2lGp0vG#)xdR2zo1Q zJx)$AcYCp`97D)f;CZrEx0~(r?&;z7iny=#%hds7+-2-LpXKpNi)M)iHHo-y^EVDt zlY_a+^1+@+9NO*87>?8+L=<_$x^!_r$ivwnW!;RLh*JBPtAbB6MbqWF92r8cMMoX? z$C}MfU@?c&jqcCh0(J`;zf;-Dmj_}=@^^JhHRVnuY$mC^pKf;x6%yV+D6vFOB^&Bk zbSg?lI65Ed+8(c$nGfboeC*w{31f&jQj=&E$`Vf?hgF(2X5BUkVB+PN>W;g2Yu>vQ zW1gjnD3rdZ-8T03uJ`|%MkqX2a4IX2D#-;LGRb|8YNt}|L&Tls2a5Ov`9Dp|9?VyB z*e^GxnEKz!HTgYW&67$+THPG4ekj4&^j!DTt=xtqJoxo#rY_BTBAYEi^gNQi^Rx$j zy2H2HY}(Y z3>vZ1FmEzrj@i5L)CSv((X2G!6MBMe?d;_zj6c1vAGE)93_gowpi1$(S=H@r9_#M$ zFMehea2#fKlyxAb^oQkM5SCpa9ID7_sRG1e6*ylsWW9U(uA0fLQ19jxGs;^&wWsu0 z0H3e8PJBvl*~L*H&&^Y&?sG>76?)?!c)Oi^1;N)2MWMcFK=K9}?>9Vj*-lchx*x}+ zZ3@PbU4DOn9kK(wv#9vrKYl8&Lfn&Gc76}Dw;tizuU^~aZ>@|*PrD>6k=eV2s*B&s zBH@mBHLZHg*aLH4uaYgQUujHwV8hv`&^{r4Z-Gwoc72dCfYtK%wj2QBTXd|NXugb!hUyds4x(+AZDU zGj2&l#>3K7QQzxDYtn4ox9|2`H&KegL8pZm&Sc@W|GKGKFQ=6)tJ|-m8!N)v#2we# zZ2qkWsS(Zga9v7^EG4Upmj*QP32()sdDN@o9oY|G&6{$#AIwh4O9B=|6~4RUYR+(e z{{vx(MsDym@qN?JG`$EcidjgJ7ILP~af^YIUBVi3hA>liz-6KN;ap`s+l%Q@4O-$| z57HQ^(k|7!PB@{p8v9N_adpxqK-O#!qKDYNRx&)Z<7jx1W3cdI8H?)mMYwtYu?{__m_mo{HZ4dT{LSiM{?o@DleXc=g$IJwjy3mj}u z9G*18Mfu;3xc%*Xx#`tf&p0Q~%SG_%I{zO}H~Y`kpxFrfv6le|Q8v_!jRH3e-CBHV z@Dnfx9<{~w->y&T(EwM-s|~KqzqC)C%uYjsC9-@M{n9s!ys5i79iTU{nKA#J0?z+- z;D5&bKYjLz0xkwxxu2c_x657ofJH}wX0mrcr=F((#lf$nbe{>PUn$@I-md3;` z^2J%29H;z~a$3xfR=w}@<&2JRre!~;GLmOC*k?4@75a)gr=sy8=+B~?KgD9`w^+ro z8aK%QWjAHwiy=zwElWw(^nboK%kCVE*s>nEv>Yi^$wkl{9h7<+Z2+4E?0gK{R-{C} zCJRrhANmvgFEhC{;0;F;=7XvSqn5O=Ksl3rSz7YJ+h|#Z$k@}5t3E3#`wx%AI2>lx z4GyfubBjz%t@beYahiPr_v~+%(rpSYUp2>w(461PGY)bX(1%#Fe&ZvdLD6NVy=rS{ zWg`(!;~Y(+x#hN;IM)X=QsC{}hJw%5&$mXA>U`sp=Td(E9$z~U09JWoInq58inp_* z9*`nK_9127knd|9nUhcKY4F_LmZ?QiQ%|RarRk#WpypI|rTHxIp3XuSHH$6Y3$=aL zXKI6Q8q6ao-w8S6vAm8>arrogrdhbqSbP0!R3j^X3NF#Ch~%j8NTeY{?VbKm?n~T8 z(BT$FZkV4rdkN*optVl4C8G$)Y|yBB^eV}0Hgvx|8d~LNoSSU6drjhb;ICON&9r!5 zd1BFjz&Dl6W*tPdb~8BkHGEA|tjg*ZGn(%kW4gLpd26!vmGtA^93G35YHB;Skq6hd z$9dLL!?KcJmB!$ZkC<{7yJ;RB;qU7$aQ3g}RrEVBH-QylFH=Qu#MAkt`tDf!-SKL@ z+Aqs3{IMLS=jGNacGLS+;>T9LjbKL8g1{r=Tnpfj78VvmCQq;)an^N}A4K-6E_bRK z43=oSH{gXfQbfL3T%>d5=Tg^vHoy|imzeD~`Y+J#vL#Kq5)NC&m6cg$#H%xmC(%1% z$Is2VsKlMunKn>t({@s>pQm!K8_v(9v8RO>MtdK2nEi5R6MIf)UJb}$u8z;BdfF09 zX%91QwRoRVZHl&FneJq`nKTRyeNz>k9;A73N0>aWmBo{``m7sx<}5 zz#=Hn|IXRfu@>!MTAf#6P%kf@$;q+=NnIUD{nl@C$-rSkXwQYQ)k$Z2T5M$Xv3%$j zp+uT=#3PQ#1#(HDQM~yjhphJ7PPs+yGZHa-u(7i|`X6i1 zs6N{oF_k|&KF5avFa0^*XusE_E{NIJNn5MW5t;@JL*pX=Wv?)_XgVkWDiPyPwxjp!7G7y_`5J<*=x7 z&{Rb)yE-X8RQtI9eD=d4qXR<`wNkdqB7jL*4)X$vP0Dfj(frjHSg)6Jx_i|u;S`8H1LaA91Ttf9bosb9nhSuca~ zbED4)e9CWG!=~6I*EGc(rTU%3-Z6)&8ai5H8wAUyk zwESkrMjXEcoSs;-Cc@ABRbDpODGc}fXG1K6;2yONiC@V6@qO;w=ahFNDeF(UTV8f( z2^c>Z9Uu5V#5?MFm-myBrmz(`q)=M1O`6dE=y7x<8sU7l)qw2j#PDrAS3#>~IKD~{ z*%=TM{{d0@u4;yJ;+mlxdlupQqO}QrCL<+)y{=GiwMey~u|8 zA6HNySIu;!xAOMmS^ahcG+FlCdgyKITw<}oY{K}8$K=hAHPX%r)3V1ZvNSgKKgxuu zo3|Ik!8_${1>!wD&Z@st5<{3%udVHugTL9{WO3_uBCzeDgL*XbEpQ0_hOy`lhlT}= zoO;JJtn)qAV^?K%{Kx?lKU1`r)F7_Pt52;_ntHK#AXNofj>x^kPdYD*c{lRTa(m@2 zWm|(|dpUWXh&AcVgt(aX){wBmh)wx1L43Us{qIb8`|GfQp;D)m=1#v2@P-mZX&1U8=wd6SJR1wkb;=dN;N$JEgZ1DOv*w#< zKHJ&vY>636NIX2h(APV|v3qeTk?Gm>O2I>uPMo{p2-@>Nvo|M9xM4r|9Sr(N~F zcyMtReu9Ai2Hy7Kt~W~k+sq4mw?ApTc=^Ic;9smtcg~CZNUQ(ihW>9q@4v2E_p29Y zkviS%|JzyoA202H+`RufhyV9YJONL>i$LsbF;}5KmAbu^nLNVYs$$}QyJHgrCRSol zN4*B(Jvv%i8TR(eX~14o7&N@=cz*KHZ*j5w_12oxd;miqzze?`{Xx4DPcT}8k>Fhl zzR%xOe(B;mDhw_kU699Fe%N3&EVdSCn< zPLOyawjaBVB@Njkzzw&bAuNx>I_uP_W;yc0QcP94m+InoEF+0K8z( zOO8r-Jt6U20fxRgL_Y!AE`o08p#=#h)2n_RPG+#}mNe2Zj0(9A^CIQ8hy)^LR={?W z@_pWhN%wQQ2$O^$Uwe*3>m(IjmGAu4pQ(l%Fz+unRbxX^tYvpF(xLXm z?sygp0gH}y?ly;ZnYL2A$gyAsw`DY|F+{t+#-QQzbgQSM_uYPRp=qc8fwa^%mdFvO z_fCrLrD!^jb-WP}<1#Pw#}Mh}N}sYfZy>Zl!^!AOJAA*8SA7>bZkBnM%F3ji%KH9H z{&dafM9iL57Vd?uF`0I>@j9#sR${}B>L=!Ukl@AsrkiV5ICk7x3El1G?+no<%u>>{ z*-X(8fcqYoY^zg5PTE{4h&1l6|21eVd@9bmBrQ}0&+*>pYUiG4EcYTb=C#1oin1S6gf!F%c{D>*b%NmmBTf?}2?* z1dR~)yA$M?9XDKpVD07vblCnWOZg!Y&{5^%?D=o0Va6KO$nWaUcuc*|Mi7eIb59t$ zdn=Jy)AQ4PE3n@8A=P1m98bqTL$Ic=Bxj0Ljhh@+U$9MMs1e)3N#}D1T51z(KHIo4 zu!WiXB5kO$%zVn{+)viT3`RDAmFxi!FQ>JG_(qGVJUR6FQY{AKr|V@$V}R_;wfJuU z0LmGYj9>fgh1o5GBPdpYWlZ|-kzq~R-Ld^j2iWJ~SQOvc7Mz!UecFl#IH-+18=GOH z8vyK@*nMI|{XBleaM)k_?7?J#-AxYs!iIr zE9%F;N{6Az8Oj>NuPyy?@FmMr$>3f*PLc#zg~cF+=Qn_S$QjmcG;dt&KsqERvl&Wf zt4&RPN;mksihZW!h=!pNlR0AWlSfrN0N6weJBr{uk+2JZ9<6f@!;B{igQn&=^JwMTb{xg+dKccg zG?;Da4y+rre{nAb-u093AEO)S{2FNg6*5?*Da&5!=b3sjp6y0k^ZJ5e%Xtqv$B>q~ zSYcj^*c}t?QfVKOIBX`0?BV+1R1VMjW<4OlBe!3u@LkIEj-;SK=3v5BZwssi5w<(S zClB~Y``ZTHMN{QY(4Of^LjiAK1UtDAZ>HC26GZb;|Mg-^RABlolafN`Zfeoz_<|`y zvEl_cQSCv6*2t;<09Hl$Z}@J3j{S5Q5rV1dx>2rJadevRj6aewFeq8}RvjCE{O!vA zc-*|~o}6?D!2J!?fH(-{jhCdF$Uk29s7&Deb@|OyyqAzoId9||=O6#{uW4Og!BM0c zrCn7V;GQ-k28?ujY*N(;+BFY`jdrE&>InFZKc+psZSMpqy*7fl0hIHLo#xAoT_kWe zn)<}|^^*V8jRst=R3oMZ-&=)%tt)rx{8kdET!LX+4E>!V*h10=?HYV5%+mx&ktuZv&8eXFn1>2J=!>Q@Xe~{ z#M8#xJ-NfmLfth2r4(W58f-ccUUhHIhy0JcX-r;w!TtK5FJ zdLSF{Ij#UWaF_?+@602Dsj>Lb?i??iar0hq_935*21EPBsIHCk^Pr+IO`}wB;Z5dab=^rDuxfEG!hj=xzV2X@6Qw`46vC;*eRzoe04Sp z1RG?aa2I#gw1A}}#)8hqN%m}&!KXE|@PiwbO>5JhU7U>%V$Tm3`C@tIfcb}Q35#QS z2R)Mg`1QiU2-$R0%05(Qms=r%3k1W}Ejek!buAlR=}RqL^pM|u96itmz_2(4?`JKq zirkBRhVxCm$w_DCVjSpaH;jH(D&i1&Tp`S+R@#sygmH?xqGm-7YQ zXFl69^0Bfg!U>c6bm%kg09!F=(a0|1M;N_ODWfQAj$WX(vDG&*Zd3#k%33Vq zuw&q0o`-){7v856O8_g)Ocf~MwIkPmE1m|9?fs>Oa(13p;rfaQ3_0pvjlxmIkhiT| zPPYBU2!M&baJ!U{v><+uoz9iDo9EHR^Qu{3rnJ^^@~0H@cd)Fq{J!}?wO}kN>~=Tj zFfs(+L=s*e96S`BYnE{x%d|+`o;Zc!JuWyaZzDl1I{MJT)OIm0Lb?X0LwklaE8dI^ z#YUnCM@?qZ@Isua4}(cgro-nf5jC*Tr$_egg@(pW5w`Ht6631J3M;mqKlP?VS0Wz4 z3kFtg*m$B&tFQus0*cMD&wl_SQQKMSqa&dF(Ko$(L$i^N+q*yW$*_1aAmS`)`OO7uA{Uh$W(6tPh68N^tGe!u{ym66_yZkko`hUZaiMRoN~~3ViSI#)X&!fhmn`S znOEvOCT@f`IwWHRw@W+Q_Xjw?ip{fofy0#cCA&9(z8?+t#j)Lt+Zry$XD#jPjn%+o z&koD=nUT7)6f{0oujCf^Q*nWi5jhsKYI;uMR*97Oqr0x_0Fjkug^tdIn^b}-gtL

      _O=8i^{&8By9gl(QVC{-bGyNy@b&H3roM^zED3F2%4g3o@lq)`&|ABrYK80Ppngl2-QlmD20GyYWTG}J3D#C_a3lK&$f$0a{95?cc<>ke?T+OkD*4jN;i z;@n^pS~QEFh_^k1I@~z>$?Km%0o{cJMAqXwEy0SkiC~En-nDViO|PrO8bPw`FWY%F zV_l;V1gdOyCa>TaE5H4~;1svM22}I(u}Eu6mw300>-@i6p``e!R$zvhQ5w0JcZJa@ z=d&^BB!Qg|((>p5!$*2hZTl@PV|z4DxSLN`EmQHidYhjZllZ zth*thdlQDB=kOva*OWOUz0ZGF`3L%CQ-~AQi~U;5Ni9?GJ-RsUZt{LxSA|KkNIxk~ zmu9@7mqjWSmIa#cJe_Zaoown>DFW@Q(Yov^UAQPQZD%14n1WE6CF#NSs;4P|Y?Vw( z*1%8gp_*nI>3oto+`JGtgn60}_&?69%&c5JnOF~JsJNT4s4f$nmGfdZEBSNePkR1( z538-7^M2ho6sW6&wI5%TRRw8F#pTH4_PSExH%p+>I^gt-J9kfzMIa#Mu+3SmbSCT} zdEz;biYOsb(^oO7*uWuuk)yI3eB)DL5U-b%i$mgx_hhg_*US>k65$i(nTFQkosD#u zf`9;JV0U($DjD(iTy;;oyFGi)BNE`H=6i>4*5+fRTtMU>s2plrhaJFgkDkbG9Dev7 zkDBfMeYDJyavGsi6V#!bZ=m&WODWqK`*HIY7F(Y;{hAbz!{_r0zkYE#%8OBHlg*q5 z$XadwRlm=dzn;&kpmn3O!j3EPa#mEu+S zVZj~2aH5`7E>~2|^j>HKCT|4}G9(nbPM?V{j>@Iu&AdXXj6npS7j@P55Z4XaB603C zYvG!wBcyQ>`wZ9p9HX&iLbak-)JJ<0b3d~+2scOeQNC^CEA@&f^7FJ{_$JT^I{_)PH+>&o zjF2e9L>xA0Oe(LeFK#vOL!DR~QO~$YufUj3{#iOF{CqkPqz^Fc2iq1ar{TZDm+qrJ ziS&Q&v!%+uo|ZD`vBzH{a{yJz<&L}JSWOe2q`vW1x0M`nxpRPpSr{OzGb17~X?L(pgmih4xM zPRssb-sS{NB8ZYrq|3Tgn(>Uw68pv1W|0`j;r!l2{KtSPKX1<4rA^G7Qrgu>gi+U5 zLEnND8qAf;)P{pMjV4oofCmqVP*8-+DDqFaqRk*lI9gy{>2Rr4kc#!d!oo8_?C4+u z4xE6jpo22>4*EuAvwJ9Fe?#nnY^&SpnKOam)GjLPQ$($72RZlLn10*zq5d%xI2_!? zLz;nTc!_|`;9C-Ol{$iaGnLJdkOFE1#Nn%+q+)Y-pCh#HI@qmNT0uY45+MozZ|ApJpzaA^j3Ic%iM8M-{;plL_(s2F}&{|C; z>4PZ6Wn^u~Dcon@j~jk<*d9tc2Gk4gK+xJ5-fieHg>yKauYm0dI8e5FfX)e;%5HoB za2ozyHbc)v%QQI!%kK6zPRQNW;h|XI=?Z`Ys#JgQSGga~LH^|@h))Y{2>>FNRl-5T zg(~N*fvNAVYoxQT?Ov_S9{}|JJPc@sa-o~)Ev~!rhV`(WG*cr$ot4K|JRz+I@D^F) zo3PIwqK$To(_jTaa$9d@;VC-b`bgZYi0$YJ5?i-4Ys;Bz>7aP2dqxD^H{s)>)SZL0y5K9r`=4~ z_|~0NLnA=5c4<5?!+WOY6^W8fOVLp?52KPma2~zD3kTvbwWix(lbJ(6iBfojb+!lu z0dduo0T1uzgD!`B%-v!hm}oM3UoL}<=v3jJ-4HU z_h~^xbehE~8Job2v>ibMAfouSv$op;v>JcO| za+30R@QTrV7C-GmWUiBh;%EQSy)k}aU_u11P`XhQ_nBVda2}JP6#`NCrz~r1Dr5_z zJpj38&j6ItSOU0h6_Bh{jNn%R8xF#bO(Cp}gsuq7s5#=FKZ`ZEZIMV_|vj`4Bh zvcuGOt@q70Yd#;e9h;%yHir-m7^QO`4n&1|fJ4owrX{{<+&#mMXbm%r+L>Gu-%CQ0 z_(f$kBC4(zU;nWm&2vKRM%GqMF3#MwG+dlU`cb_`>8Wa%bp&mY{He*w?;IqZnZecW0Cc<`s_FkI)X77*en zIWB!|;az_L0xT%QCHAx6eR}3RgD*vT_F2~14woe%Ptu0DrIUYSgwqBZc;Ju|^8>k+ z1QbQ3>JUBYsD<1Q`45RaY5+NXhNTXnZ}pn+pJC*5otWmH$8Nu~rgPTA7>SMBs0c~D z-7gqj2@-f->{Uqz5?5iljRJ6Z#GLwYh*u%%L!_pmAyQ8nh&bs~K}_Am+mz{@UrGD} zt}+WmTY~~tC`a3Ru3kbyzd6`_TyOoUiC08u%=(=fJqdla*&J!v zmI@u**-hW<$37hB+lpT}UP*uaLWNZDDI%J$kaEU@`)1wS45we?ac?w&r4h^^g2yAF zgw0bu-&{xId$);K1h6hVxntrvR@_#JmJSlE&r#QicsP)p+WQ|nLn+f+c~>8bo4=u& z3wzy+;=gKElfK6t8C~dA5o)gRk`To^`SF_JRDlN(glEnvgSU%AIeOQ7+6onhKi5fb zdF|AjcoWo!X5~d=$`$tJQ()V0t9gcCY;Wx-qpV=hrO&8U-#4G_A0U$rU#pJ@R`N9Q zL7uo)Q-iAVUv{$h5UNNWoA)~0w)ahF+MKLRz}MJTf(*2$G@90H8%VVL78tntW_}sV zM4^k~qEFn2?}q5serpGiYVlL&p^|c>>Q7|Ercxq=P&u2lQO7JQHhVDJp+jl9Lo-wn zDo}D!6Pa+3`f$7HGkNQ{`gKq#lMyarEmmNzgV2`EGf?&q&O-j4Bn>}z9w5uJ6`}#^ z>~r^$&rTa1c-#s@pwht)CXeYt0x4`Js!Yu4j?&~Tl??eYD&o`tQM1K_;jkV1*+8iv z?;IEQ+YX1dvGC@nyF+(+a&FFD9JRWi;4{i{;x2#vDr6Jb!lIMk^-s# zvXU2JUz}(cuWKKlGg6xtS{QJGen4mM8LLpo-+r)Bk)8E!a@Oqa659$VydMfNO4wia zVkp2|^GpYcoGzFre4?HZF@x}JzyMqFDYsj+in?t@pum2UAzN)x0V3}>bRU}It7w1` zt|WZ^%M39iL+G`VogQT*hAS!e>W4rjOD3dG+8+(*WpQd$`019;I_c1Gac5${k1nRT zh|5ZD_@sKNDobRzuLpsQSTSUDWXFG>^{yH9jyVJClrq8{tw``vPm<9~&ET?@Zs;c} zr|Tn5JSQa`c>8Iessc=7(B<-0)Z+X_t7%wIUn-}fB}cyL-0!0pCjtbpgnxPI%#)ml zM?+cI@gu1k2t&Uz)q*O#|8VqP4ktndOM3jbt8RpoBhbd8uXz zB+dp%GaO==siJkD#(P1Kqsrv{R)U1QPaW%l7xq_JYjn)VK%f2`krcOGt(h+F!a2z; zM?uQ+^bBZ@&#{o7?luzI+i_Yf!-mg=Nd9f72t9#RgRgHeK?;$ad}z~H`#GehpZ#gs zG-x-Q$FoEZzq$3{5c1!3KfxMgmST$!;chIxNKWH>=Ul!c-kj+wtULZOB1cu0+ecrI z!oomM!3lZpZymWh_@i9zB}+A50!Rftu22q>N97Q5Z)Anx^T^(N3AHi4GirR_Ph0DX zStd@0jD~JRy%IyD{^2#e^|Vp^AVPr%A%JKit%2wX%xyT{4p{GBzvba&qEy2zx#y@l z;437#=~9VbQ;fuUK5boh=jrlbZI8H~X|gCX5e9YntGX^%ur4Qfz1sY43N7V6zq3qkJ71 zsc|1##E2!MvdQnerX9qtCPEAW+bfa*hJb(9Z2iH%C6_3Oa=Ye;n|8qFKX# zB_-EG-lg&GNwuh^&I0lJr3%L6{N0m<_P7T zFe=1fnteiO_qmz#>Ng&8-Gb0$4RlM=_^kmz{=0-Ado!WT_bo9kADRwMt`B}Ig-->1t&Kk}@X=oQ0R4k8{Ity{4Pi&ZSTWA_@LgCG>aYcfW$QDM%_s^)( z3Vmmq)2ce}qz6@l2%~@r{4l3g7sacqC^Syp$o7uU-;DCcP}c$f9VrDy(}qzUG2xB-8`$Rn%wk45TCmp2FaXBu*Oq2RY&> z7H$kAVrRl^B9<)J04^p;m`WGlCK7H`whwMvXqfFF^@URor-&c3QL@U2i0owxQ5b@A zTdpmQ8@>rDNh%R|@LxD%=vEX_m9pr0tlnZ5e}(W*E8K^v(nJqMme8yl)$ecD6d9o2 zJ+C^Og_;HSQ_Q_{M9Gp#>m{(xem5}nWwfPlNq4J22U|B5U(-Uvy#$pwGAG0~sZ4&w zIjN&93l@-#?=IrJ?@=YCW^I!|BcI0aAw0(oj^rF@-TmqqiMJWl6Xm5I<~b+^ay;it z73>6gwlN$l5SQd8O_b#J@xk|4jQ6ofqlc#bQZng|>~f;<6_qJjbirEc_6t0%Nw@(` zlhsHVi@)C9XX>djs_lq$B4v%WN6Em?F|i>A5*CNUGvapQiCw|(b`y9Tu|88k&GCUG zCMN%DATb39axdCnw6$M@|Bu8)i%!k{!;{V>l40Pni?0F3Wqn~Qv9ZrykBlxS#9^v1 zs-y2xx9|u4sxv<_#a*widZ|;^q@}fOZVtO&xd0I)V~Q`vL4WxN43y{Av?W$>jh`Ds zV)|`0;Q0~IK1l0wL8zzKmpB^*fQD{=zV)r9{Fy`d7`OjCeDfU1^;om-s=99SDz2m4 zLi$eryx(-b$~eD%9{W*R>z*E^S&ew!+!jhp*5R>iwC6geAb6HQ*hu7-fFaX<9`xE7 z?>QKIZ*W9`7XvBLZLdj1!elxcZ0C5Msr+gxkJcY{htb1Og38}{xi@}$>I(w}ab!b0Ppa-=iow;nj35{(*ApM9DFmrJc2v#!IWDd>b_l8b+u=t(#4u@C z;wzX-(k_&RM;u`T5l*~-TE&+b6v4#-vx)TcH5u7GK-CCLi0)Ak^F12~d`CXA+fwSb zKP`vydy_>~yrFP}j*oaV#8O-m&3T0DKi>C61L@}YAWkSx3Qz~4x|L=QlZ3BX5^>w3 zdWp=gBN*YURJ*0xT-LARq*U2r4mC?a;axA$%GqE9E&f;P@!Ow~2^6rdU<42>FqnhZ zdvKOKlBna?RtH88K}QKsti4n=o?S=VX1xomJ*&ejwm=a4mQrHIEi_y)Ea_;kHLjV* z>J=VpsFVruW4!w{^>l1+AVK)g>sWaqT66O-8pcSLV|?)sJ0@U@2DgomsQD4pde9jk zG=k5Vfr=OVoHrXsr?`N*<^e}-%rDs6RT;M$U$-)g1uS6up()4npkqY0e$deVVcP_ zN3WN^xX)h}0jkk9TJeb8j#!B#1D@PO+NWkL=mrIdelyy(HqJ6MvzjpIR}T+uk8k)Y z5K9yIb`Td%%5Re(BF>ZD6jE)>IP@;)YzuYM&ma;KO9v@({luaojKs;npRzj5hW!)- z^)biB1SOCvb3~G7@E`xM%o>f|Aqg*~!!u8zCiU%zE&+3GnXV^t;G-u~I<0DSoeHqx zS!H87LwUePd>D{WL8PFB-bR=pGwft5Z&-LEnZfErd{W zOc0^F;(8n8lszCyWU9c8^9+$Wv42?2bza!Ma|s0Kz8|8TXulaHPn}3-Y6KQy=@0vu zKfIonBsRdO{=4d0y|KBO9ZEn<8S2^By2-MrVTd}>bAc;Ct%Bd-90H{8QjJ&^EIMYn zkZLYB%@Gsd<0w}sh`-uvx5&3xIQOt5D&}FRo@5B!Xq#i}RCO4ap=PvIP~~1Kqx}ux?kvQ<_o5GA$_b(y zIaiF$^mr$UsyI-1v(&>@81h+gGfffiD0jH@!Aeprd`N$EYa})JQ`*m;A+RpPl@LLC zc2pkrD7ej$_AL-rm6B>qcT`O{liT7O%9ZE~ul24Ctiq$KJo;|`M1o9^LM75j%6A2FjBmF@d}Z_bfW``#ui) zb@VcG12oNxL5%Z`igwYN9h$#NBMw=A$qDhnO`{`HO?gO>L%E}3T&bR7StDRwH0rv& zT(M)+^Jx5kjJc`*=#d7O{GI+8z7w__6ot5;=1%fnMsfI?g)FO3_=!bHzZ<3w?<^Ng zV!j~gbuHE$J!VX#6&yNFIl<6gY-OAXJSbqmL|(9&@}@s{%K(<5MSXz+9=IFK3L&7# z2_)*|3nQ2lrjZMwO=W;~UG=UD>XkbylQd!Ox)}RTqf$-ua=4?a`_ks^Lc$m_V++{s<9p1xM<_@0Zp96{+4 z=ag5b&0ssGmM^S0+?qpl7Qz(_RESWKzZ|K|gbq%&lNZ4%q-6^*vzZ`A+?W`!#_&)i z(_nH^ZKh00CNk3;4iPtR7~+RBvj&8AB~xEwF1t98BE!Teb$XwGuZ=WGrfjtP46C+Tg#R#; zV7eG?^O0ulVK1rAXRx8Z!yq1PhsF=n!V2C0ou1D*suigR-6{mfvpb-gm_$eieV6pL z`U!_8yCMJj0?7eOZ*bP-)W_UiD}-iTYtV&1_Bq&hH+v@cq730};l~zD%>uKkt3*1q zP+<%=tjnMQzK{d~6^$SBx$+@Mu|JpyDhw$AXQjFU^u(8dFj25GKjy)20Eku zhjXiZeyP9t|A}+||8o<7sGk9x3&1bDER_bm+K<%CR{I4#G{aoj+@TXOF-80JB=g9 zZymtGf=d_b=^vg#@zf&c8nb1v#dz<9a=sjt9&w(U8G;bp z@;12#`2{HxY)f|d-qP{#99{uZGvhU{Elf6YP!BvJ@}5ULn0sBw^{ zpx>NY`rCVS@&Zm*fRan$ea9SezXD*Mrq%*_TA2Vz(yzuVjr8QkKu;5h+oxL~ueuG` zlUZK(llGf~j+YwIrAGU58gXBk6M>dh@%kHlRy~d9BIOY8Ea2>Z5oOB9k;>W90BWj$ zUvw@2SpNJmazf>eb$>L0K@V*rzzL0heXsyjF3evu0oCAq*{N9ypujUw6TjWwV|*WT zSdgst^-sC3Z8&WG`6(?6)v;xVupK#rx5jRfdknU6ayg@((C8q{V>PO0eSHe6uhOrl zH^2p?MvKCPTA42z2Wzsm-U|yzlk`S>)HF{NiUsRk`fcCSYrbUM_mXKAC>ZLBx zp?LDA*{1$6`nuo_+E}}wrm_IJUseNak32v#^zv^+NEFH0D=k0@>CF} zW>3$0jHHd9^m!H83sl*DGAQcWp`b1sJ$f^(6Zl9W?3M_W-G06U!u}7x7+55ZfEWIy z62QVtKmkPo!Dkn}vw~tW$F}$AI8@_+zR|x0kn0ox8HDfb(hnL#8W%JxrAS;zIN%rQ z*kz0NI7k8z8P|-zn{ZcheW@9C*v&#fM#%)${!8Jo@f)s>p`=(3krxp6!-H#4#QLHD zA&ZJ1^E5E0Oh0a@11Lu?q7<5f z)IrDf6XLFT^eRp!ZuyntFJ$5Q&41D-N|4Oxrll+*A>(VEsEet8$k=Zx4#lTL97zuA zh)@MS&oUZ!{QYjb0_eqxN1V%atE<4MAT^E$$PrJ`GJx~1^nKkmn}V9cvnJ@ioB(Nr zwcA+YfBI>JYzECh&FUWagtTA;21(u_tIyQb4lwsKw<>?zx|(~jL`HARS{+URh42L* zsqtSRCp5VOWM7v4qnjfijENp#@=9`B`{=n=_vh+`qKHKI-fwk?*B{&g?G^|4fy)Ad ztnbf9II=h}R)AMbY42VI2r|dfTQ86be1PPN+Yb(lE5G8Ni_)tLULvdU7!MC}AFfd~qLrK*q7BlH$tllmbYTJ8xeB08spIL+ww?d%<$nZN49a!Q z8@P3H(DDAO_XQMd2jZqRw%Ih4r{->n|uHi5;>>Gd4N->yy@4panww4Pk!k!}&;7 z6J1slueNMEQsLmhCqUh6RpOSY#Gsa0GJ;B#A+*6JO(5+k^f_H|a_!D#&A@eSDK6eX zS-4wGwPFp|W9@wM73P|Ydk5sO?L)=9RcjNzyJ?qUf7QqS=qUrjwWTq3JrLb7k_D9` zd>NINnfHiNlTZ0V`|aN!%yyC0)!sHM)UVbyXU#Wj;!Q~~E~w389TUj~Bx z)cN%jh68uUKfTU2@8%7An7?=N;1nsdxAYl**)JsZES*PK!;|j!cYFlWXFi(FxtwQ& z`NvzU)Qx@EoA7G~?rYo=gm#W$2Vy~--iO+0L7uV1NNsQbMH8|ecr02H#W|wsSH&sz z3q73n)*~eZM|$3ji=31=5whrvdb8-?c#oL&4!e6jpY?qAl4A5zoy_w7o3VJWxSkm@ z)zxZALK`0Z{TDgfrl3^li-ufvq%`rbVk>-)LA{l#F}<2h5Hda%zF^1ormyO|86;D5hl1Z7U8Fxc4IVBJI@1Vj7ADa=X2RB!LGWc)>3WYD07B%r!77;g*L z=|kQVbuvXnwM6`z>!Adoa(#G<6ZqC=oBam;aUtqF&6=nI2NyVmEAa3+&b;Cb>e&^4 zj8a>$|Ewxd`tb@gi)k#iH zLdd~n7>cIOy0JugHcaR%YQM0ZG6fhf+oAMbe?WkaAMJj>VLz$b zv|b=T>KgTNt=lIe0o0T2rgeXYCLd+xn|JI|-ODPz4?LdL37t}2QhH>KyuI?Ay;T^HBBQ|(t}(7;6CR<)1Nn{Z<$afO?+Zo&b= zKa`P`M)4&~mS%;^XdJ`kdh%v2cv3IumUG5%tCm*b{7!{kD|>I3T?m2MM}sB_iJZsI zIx&0x>5GcrqP!{Qu#ld9>sEPeJA$D9>FB@w;v4mNy+xbcM7)*~gSFJDo01M^Lnb|$ z?V>L@sCTefj4~$?5B9BB)%c0Yk9bCJ4xaozU>Kl4$KsHzjhmlgV;|q?B}e|rmeF#! zmBSsbxVBQMx{|Oox^ZD1O;;efA4LyQjkZu~K5o8{m{bMIiG%1h+5P&C;??u&H%^18 zV#$(X+(hs+WjflYXAoA3MYHq)UGypocf@n3ZZ{7?{?LW1_oZO`sbbWDj?vy;Pidn&ph?tH; zsd&=nPIUPp)$hm_J4`ENh_a-3`w1WrmW4w2n0=~_!qjvJ`btF12H+O73MHwG|5Pa% zT31u#;Ss8Jth+f*dwN(PN*5J=Sy(07_5K5e`kiR;gE`07kLT@PcoLMHNGZ<{fc~`O zGu_ec$4j1P_EDV>UeB5gKzpn3lPqilHTx5UN;Zf^o|qVaOr7SK8{OuJbCzE^DXh-f zBho-#)9b6rEIbD#!G>&KaO2W{}fRo3W%f`?n!d} z6~7<3aZ2J6BxVavuZTbQ0~XA4%s0H)#$O7SQv5#F#QkTV1;w9X#-gRXvi_C4lJUvi zdZsAG2sfYW)>xth5j9Rjj&o}~!b(cEqS})w<1d?if1zs0orpRYPTU&M4x$Pftk;ZW zY)y2r?586uglxscNu=3@V9yUn$BPfi5Xn%qXZ#lAvtjvGpf<{VO}2@;Yd_bYQs>Yr zYi9ox@r;pzb9a|R7Wa#3W~a_mcinj$vt}^*omj1bimJi8V6Ixedvp)GYRD*BJjO|H zW?mAvAk0^&`uQ>*gFk~e7Nx=07@09CGyQ1MFJ{Ksn)VU}OZ#wYI4xi5#N7PS zKfPJ#DA|34T9>6CHQdjxHOj0k6(B}#*(oMZ4n1ks(2ty9vgspSs=ybU(JG`9#}q4G zO^OMQZ7x3@Q_4Ids#kZbIqx{WDcIA@Q@J4)Ge@gadaf*zw%w1gshCY{vYf817Vn|F zn&iAn`}`>;J7GzuoO0En)P(JLXKJiYIZ-s=09n5?(kI?$RQ{_%LY(~vsGi6dz2IV0}7<8vjbj z;Y2TJWv1*V$Zu}HOdgK*H4Iz0R665OdN=3C#~|>oxDuBbU~J69FBC};Bw`(cJvNjk z|3pNfnVD8in3(8d7X*hd4|@dV7`g5?_@eNZsu-GdzGwBWMXNtqkz1);*vMEoT|_{W zVfv?>PUCu4T~M=s@|BDSPvj!r@q~v8)62;w_r-o*i8M1jZJhW76`zwOF1y6~uks1$ z;=d|}e={!s2jutfa$WzEe)qqSAluXB^68LFOHEDPaT|J79D; z#8JGm+~U4HFR$g~uK3M++IkD3P`6&YtAIM>5t51s%7VaC8;qYhe_v!=Q-q<`at2gD z=k|7Y@|E`rpd(&{MAo@)wV^L_l(!+Y&BiUz16gau*@C-ym7)etKfc zp6v}Kjof9aKuGerRq3M4;|mFqh@Y}D);zH zr_Nii;}5wawa<_`;GSFv0cdxCV{Tg1cJ}sfZ763(0I5WmUh#tNlvJ}eYV|-nnQQid z^0Lv)`=THXtzF1QrX^K9zY0=fpt zaZ}~BVe|e6SgYx3`%~Aue=1o+`4`mjK_~}5H`#K>9|>9o19X*Hm23lgGT&hP4`~A3 zX}xnY*GEU7>-X54RLl;X=CH{IOI3T0>boN{E-7U#3$!_N2-&a|b*2kI%6CxL`n~b^ zN+N&t|Mq#R4iOot0vMZdvxd^V+!otzfls+FVxejEIyqp4%RphAW@C5jkKYDto)3xl zxl+Ek{h0cBH)Fyt;$-rKCV~p_+h%@;ve=k$6B>zhqzBp{G{nj7`orHQG)*A*W4HnN zW2DEQxM`+!=O{Lg`$h(d6_U!wA?tJ>qOy8jfq;yCF1gm7cXO9wErvaK5E|?P0JjFo zsIiQ9d%IS57A}>oElvm{KBC|vXiy#&wh zOBV^A6&)F}7J`OZe7#N`X@N`ZZQHbo)o&8fRoCJfiB(jEa6W&E)j8`{9`#g(frrE} ztryH*X1@W6_@kEZZ0wI9rKlp*yV5GLDfs4JsOqiW2&d6whmkay@-*bu9sv7c_&&9P zI`?dV7uHj}DRYX7mcb>mPR?$APIBaq=j7`6pgLd5fwDiPo>&>+YieEG4$-U9q)u(l zjwvwEOz;^%x$&7>!-0aRjwHWrR2EzL&05*Ttc&I%o--`u$X~YwPn)-(;DF@Q0IzHn z$JZTMRcEF@+Kpl7?i<%7az<6yj~^2sVD#IQ*|U1-v~=?ny$gjd3nM$yg}nhU*yl&! znX2A~SsY0@-kjn&SB`kz#awk-j#D?>U(Mv$-|r!^*R^>7Dsh`f)%GT9{bL2MJZm6G zhX@G+NCS%uSTGXV;h<8wi%cq_zlxMs=c((5%!_7rNxmhMo*#`CNHWZDBrKkc=!wM1 zdyL@97vQ9w2hcW8`C`lxi{seEVvc*F7mfQTJ(En;TEg|Q6Y$Er12&}fGV3=l4I-2m%7eEEwNJ6yf9c zs(-dX?lUpGZ{_huv&6JGPrW6KVPDMc*czJ~gPN{i@WoVm)coOIUDhDJ^X|K#eRcBW z7wMS`_PihIPquto4}|Q3?rcxt%kr!PK~8;THdaW4ZH{Oa5kOCiA*YbPzMYe*IZsb_ zj3@5eNTRwBX5#S{n|YZo9|j({Qw4v+fvpH`0yD7(=kE(^T0z)5?HO(GhqOZPAGvhx zOI<1gU+sSUEG0Hr)`*!FrI5Q?TTQzyfe-JnxN~QX8J({D~yqV`W_0lq`P~ z(INc{QIS5>xanmj#nl1FD`Rz$Bql}<79YGZ4L6H;$P{iTeg*~xc-sB6H2oTv(SKl; zWCY$VDHzZ_Ji64xW>|z%r#BSF)%J;<;PUJ>GU6>esE%N}j)aJP{D*b{P%G)jT9jpy z8F>eoIAuOrQqE^nI0z*}W;VAHWqtazU4&RVF>2nb5xT-uoYcMYi@0x$ki-o18k z!&a%Gv_;WWq7{Prk6OR!K4_QaF2C>8`M4ebP})p^T@(i){$d7}mIeP6PNA91P$%EQ zq-ae19=qiGyh2Jz+xIP&M-{ybEK6nD_-@fNubtIFf16g(!ws(|q4^ouV(8@Q2!D`< zk6m+Kax!e}4Ha${_s%_kJk7^TeysOtZpv?ZFA9r&{d{^5TYPD`cknb3`@?{ac*SL# zv1QDs1smzIh%f&1Rjf}TK!w~Ada{VcgS1JxHnmHXAhh;&gM1Kkc_PyJu(XrjYv#;` z_=Z@8F_or^6zm6QKDD05h3)P57h9CuzUqfZKG2eo3lcw92fhpwLH$$=#=Ny;R%EKM zth}w`q4cp-+tM#w>GH~QH?F- za0T5fH&T1vcS_@P7_1TYIOo1RpxQOvE)>|YV{?OhnDzgyn)+`V9saM2y?^?6DUvSs z;Z^@Q$?2*?nM><%%jO9*4y@vBYb=rLSM%1v?iD0i4B2@>4h{~I$Khet9;^GpW(6>4 z>`vF`myFthm+CE_k5VZWHn=z5g})HpBpxSe!vlvJ91S=r=~7l#_h3l37oyZR7N_#D zkF_q*Y=K0g=bhj{^D0HXM^8b*L9C@|e{nbV;)^Dl;Q=w;fl9aj^uIW{9FuO+UpC@D zv}R*W?;ty9BRDi(hK<4?m45#a zOqD-C@!%-J_%6`&`{oh9T1xSUTK8xI-Wee0iddhDEHy0>CI- zE#3s{Ev1#fD)61qc;GI?{GHbvm}hRfQMNC1u-na$xZYt!!}t~Fccbl@IixgtjqIV0 zo1>Sznqr5WxsF4npEJpn2iJwJu2tl|8wVn3>|h2z2v^7yTrdxyy2T+xT*40cD@+%5 zA(FpLoN9m2j=as0B4iaaeOStz<@zpSM}2_4M#E02{fZ7u8W7y?ahnk1<9FzcE8krA z5?iZlc*Z+!J2EU~IeG~s4?R!RsP&IPnG}43&(M;As`ENXPNhOOeKB6E3-uSQKOtp- zs%ywLEV@dElR8^yPSL5MayQRC3t|lzd~xN<_WDB4>uXk+>ncZ&<@^5ZI|tD+>;?i@ z14ZY$FDrC)@DT?CM!4W1ZG8*I8@wWO&IGtQt42bWIv1fp)P+7`3Qkq;T({RAs6>p~ z=^TXaj;FyzehZ0t9}WDD=8&+D7=eEp2KV`8!|497_iXH}9)vL}xbhsvT z0gV7r`Da%XeLFUxs`ne--dHm0cm|RQoB9E3J%SHQ{BLk^oB%}RF0y|z0GJo!6$UlN zVTmvqN}*W(d}~^I?vbpUtJ$I4Q1ILOZ6KxC7Wu8A zW{%q>KOX}^_J8yWU9EG)fX_s}jedoD-^ z77R-PsIko%^CVX)8 zL5+*C!Dqv-q1~0Qq&q#y&TEp!fnL@XuQ4r8de2kRq%{iU%W4YnURU0JjA+Q_9D@-_ z(bYv5I(@O^97bQYzJU=oHR6x)J*R(%C%vlT%HI#y&t{;Yrk#Kw8G=DHoa*W=L-m%m zP^5nDx=p_aeVp(-?u?B2Dy(Ga?p=jO>qhgKWoDcL-5$T0iAKi$SXu5MD&C1-lVLbb zoX)|+up``7MLtc0uXZphZwG1#H_l_F1a9i+Sa0j=+X^Vp7D-NS50+%=9)}SL2|1qj zP(>P6S*Cd0yX}dD)AZuzZEAGf1z~O^%1aAjAk!s*&(8}gIL)D|>*f6u)*o{vcugRl zbA#`$GEfse;NHM^<8#?<1CZ{q@C&P%-Rnt)dLHU#C{l&!+flP=2)A&j2Ai zjq&6oH0WpJsVL1Jk*hCY{YB#Dk9pN5rA0r(VHFEcFNIsWmsf=j?m)^#oe|hY_3A}n zkR7iZHE2YR7S+0soPZTxPiU!SrLo&#z5`zrAI64qeS_6sr!UYdcP;fmdO&cJ*bMUt z6}`rJ=cB^pek{ejnmM>+Y^2xQD@M+u^M(9(7cK9kS?)o+8<*GK2J{j(eXkW<^& zOcB}}eWtgjdo%OMFk{b=Z@5oWUdZ1OEv6s7*7={bnE#8j7!BUV@Fs%6dBcM5rXU)p NIHzf#QKoJm^)L2_Pn!S$ literal 0 HcmV?d00001 diff --git a/education/windows/images/setup-app-1-wifi-manual.png b/education/windows/images/setup-app-1-wifi-manual.png new file mode 100644 index 0000000000000000000000000000000000000000..92de4f784c66d95e82cf949feec13d63c8817af0 GIT binary patch literal 16389 zcmch8bySpZyeHi;bT^1}2-1y&ASL3^ARrxrfOK~^BBg+UbV*2ecXvuR(%?SxyZ4^G zd(Yn8d(PgofA~5K%*;FQ`#j(8r@mooD)QJE2Xn6QHBdN)^NJx06$b@(ldl8}Qs*n7M?rLs+H7x4%d+?xiWwG9g z5ja~k;ArqI=;T-x{{QeJ3zs|)a><3IhDIj?{7WD$(THiVgL$uu14O=Lh`(y zwhQ4cEiIz=CmkBio;M%QWzgufgH{$>e(S_}cjcOOu*OSlw&M=p-yOG%H+i^zmhfq& zO2A?tD=2tMG`-Oiqg3^N$nPvp0@G zqs7|`9Rp+hA(>PEN3!cs8h@Tqn?HH2^S+i?^T*wB_s16z#CEz^hD;O1JH zr94%a?f~bNLgRC<{^B7o#h~))<&!5*(8_DUZ3~z9d;j{o^5<`V zhAAf7{yrT0Tn}I%;Jfc4F;vJ` z$*Zxe=t|YZ}<1{;jE82tJml6ouRFAD_9sm_Q7|k z5WU^WAs28x(sMSK%+B(<)Yh(gAGO(+AYbd|?}0~6UAi_q3&qaiX;=%U;2S2`+~~lS zNVIRhk-K6FG!--HiB76C8+iH4 z6DIy*6xkbj3Kpntw{%S;oUWMrMR|LBd-2O8R&63St?EdKE;hyU>MK$Cjqa!tL{uD$ zS-nUz*->)QPvui(h7wT}0(R+UovIy~_h$oKX_uK|9>wBbw@`v7%H_3;ubVyH2B1Ua zr3Ot6&U=$A`wjc0RrvVvW!t;?SwACdY{6+=`F)PE9E=7?`Edk4C&bpAN$x`IwAK&he zhx2bbz!_Da{T{OJ>gm~ce{XWdGJLF)i>wC+S2C9^6|fnAD?ZAJriZrh)AsdS`LEJJ zn-{wi4Os#XKE8Ezf;FZ?H+jmRdC5`PrbCN^{Y)x;T29FQqAWN4z{!k_IswhC6D`NK zgM3U%Kf;gpqd?j2Phy+f3ixxeNb+0Gx+v`2 zI*o{t(dPZyxWCyP*4yGy1N1*Td+i zZ;X(P4|+ZP+Ro<8v*tXul(Usgx+CM-gD{m!bZQP}2jx+zVs2AnbtyC(cCr~#`K^;N z7}+-(ocFC3!6h?WY4)-@e3y-b7<{5GU^&kCqIdLcD3wPBgYYSBTU*;6LHC6qv`YbX zx6S;pudL`;lHUxQ>w17hKN=(7ZtJ|<)m2;OwAK1C5+GYK)I z3P`~rh3jglWy1BoI}{jFwXi5KV7^}^g-Sk-pM4;Z=A|JuU21Sn0DFEcS_pOTw!)<6 zpr#1%iGDT-j?4&|JO$6Yz{eq*i->2evjV2d<qjc zp3VkB*75I8BN+^fL2sO+(fQ|ze|cK7d=0-|?%5q0U7#uC-~S>W`OAbX8Xe<;3?}GU zdI-p{qrb%akWmI$JNsYWqJ&70!Jpb^8a}(!2Qw@{VzT7%X`>seeQn`eKF4%)R#`1E_sS9 z?Kn5qJTgs?ZyKSElNFuP$*A;l8#~_dtCU8Sq=83F@wTj|KW9DxewV4#+3!B4uk}uf ze%Ydz)Y_`mLVr)K(@~`rx)q2IMCHo&H?i85-^(_P#Fw0H`SL3R@q4$Ev4S>P?&EZu${Epg?zM@qu);GnK0!4*R%%Y7(%!?;3%9k>-@3r|LSZ% z_~A@%qyJ31YVR_c4K)g(v%&qbaeNbD+Inyf>9fyCpp7Uo19o_z;(7dM=G1{#)W7L) zzoU*-Tci?VVU*YAK6y^3PE4x4;&7ih$&s#V$EH2HER9yLwYhh1x-E73Xsq%5lQ;Tv zePhGTyTg#YtE~N8nT$%_rZ-e9@7U)rdhKPaUnk)^_Cix~v5BY^)C^G>|cLMx`o=Q>&==wLQtVvz4!xo-+(bTYvQbeDsz56@Zppocw7ott0ZkUvh(uGe3t=di}<-sP>n zkT;*!_oMJ~6V8|=9&^TVKFZn@@s$z>`p4p8USjrSG3Jqi7yF7|#)F)n^l?@lzLcb1 z&3cp=lG&rVhc0Ssli`&#A2N^z{`uzoSvn2%0v}*joUAN=G4~Dc`etQgu)HRt6^F`w zTn7**{>E_$(3G1DtCy*zE~+&bC@;E?M%Rlzr;eDi3}BKTcD1$<_wI+bByaMzbmEHO zD0P0G^w;KoTAPTAom?_j;WD^YaZ}eP(@e{fDMyWy6+RX3_1tM4pImFZ%8)_Z+IJ5(Wzc zWix6$pJX5}hzWgURlz{riu2Xm&dM>4bFkFpQ??@N&2QdsV%|95=rcl5VqvIUPCjPZ zrh9IH@mUlpFAfz;av935XSF%PHg>vA6S2#XCyg*A4Z5X>=U=*>*(za+6k^;r>`$tW zez3&{t~FJ&gqn=x5|8~YnPcdfK8nMg&|cQ5pICnOc>-NA9`(sbawAr%>nms^BPm<0 zvW1#sAgW*e!Fw(0FlT+t-`8X$^m2%0#l(oLr1p~o=%$$Vm+?`&tT$c3BAv5wv?cuq>! z&A$X?Z?O@CkN}6a9{**n;znoT-&V#p*s1>ijbD@ouOwigs0o^`mSa7I}?*h$vzt?pyHF{3vFaJIb*TrCUC|<&&J1&{C?fL#YuD>fUIb~sE;*W<}q0o23 z2Ml3|D^nopn7xjuo=cW!jw-hBH3eSh$Chy8HVqCR1Ftp0_l|-#g2Xw=wh!%J-`?jk zWER`JKPwlwj4TcnH12tV>z+JFQLtS`PVKl1$D#LJSEci1hV;$&MHzu~DRq73-lChD z=aCwV{-7((tCqq~-gBN$48(OBUqn9%TU2AzG-OC4?%5cA*OR6}^y@I{i1I03e!5(GVL4`+EAyHO)rP8qZ(Kixf;Zh)zmjv6ARD zzy8V({@ne=klT^9Z#v!JbsJy6;yS7Fc9fH>jz6*{MqqV~=eP+JztLRm{RJV^_f@Nw zJwm9_eGLVqHSW4eoQ(CnY`Ag`V;hnIpyYCrv><TbjyY?M^kMm{$*qc2I#reWiG&_wxp9Ewol*oo^2gtDS`{ODe;Whj|45My z+~+&Vi=O$`uk<1=@(0Eq_~9MYYbhJC)boU({p`38=rKKABdFxKtrjo$=Nf8#n=ySS zUWqY?CS=O)F^Htd>(=_#0E29RCMMR91Lun4GeEl<2(>Zhbm>tHGZ!F640H{R7#20QQ5)7xMb_ zi8d?70Dzv|Y-bHzt@zmY=#eQZD)M^We!SVqi7`E1ZgM%8g5SOaM5MDlf3ec{;qJ=% zwyt}SmXlKju$ZSIxHLaa#<#(1Q+yt8dJGs+5c|7|wW~~LO7&eLj}s0$E{%^G_Brd% zheft77wlEF$)DS#+WKr-PJHk4c|6Y=z%K;YxPM4sh5gz4!C1g{7AoF$SB;3XJ>33D z2*M(h;`skeqTGvnLf;dtR|X6+iQ zB&r1Qvc|LUNJ^n`a7HrH(*BLt>k(%&hCXvV%`qdG&vjPUyCMcSY8UBWeR)2W2Xq2_ z2*l_(j)yk;Ddj&hL}hRi+uMHE6)*ELeR3Eb0CI=n3mW3nB!oCQgU5#}!<*9{nmnlh zl*{Bn0HM6uR8J^^f`Y<)h`lPra&|WaKJ%LOzu-94t9J~`$}$Y@*8)T%Ffee|`Uv4_ z4e&2edR!NcWt5df&6tCNhxETYFSIeI^u=O9WTK+2b#WNk2kRdKD zW%)d6M^lNs?=i&=K*dcaU{XJv~Z*mLAjqcu3fAqm3O1x%#R0RoX?_sm-E68;Xp7 zFk2x*?Rg?aL`=B;7kpdtV_(0g*W-XBvF0hIB*PS`u4Lk8=EKTn4-AK_Z+;YvJcKc4 zj&jnTodI1Y|Kpg??JjdoZ>`V<3D@*upKWEy#%?J%B}>k|Q58uRHNXR8%k1 zeUBw9ENsk)Uey8Hcj=ew047%>ZC5za1mFHl85htR$82$c4woz!MQ-_M-*_rFw6Zr< zbXc-|ebRx;Bq#`7;yRqKnXv9?LUrKD{`Jdt;ko5Xb5m)@y3cXb)yH4V7J8$vM!pD? z8EiZo5p^2tMsbtA-I;gY8I_ul?>Gfo%e)8UGnWHs{o&7rgBnwO0)nX*!Ds$w6BQ=% zbJdow)7E3)SAmpddE={#UP_}^<;sO&0&$pGBUg(Szg`W{d~`1E*b2(T?S2<47f1i1 z+EYI=gxXzU+4KAr$2OqnQ+J*Ze`fM`|LWJ;Wh6UIBHkZGdtkfOA2;7!WM&9C$<@-~ z?o_M`+-)YPew0AHNGttyB>Z4YX_T=s55zG0o>0%5trQ)(SY}dLu9o}CbaAiwe)aM()8j};thR76nPo5;&v_s;%dA-2 z8r;kVRUKJ*d0m-ctP16zYI+8S5+F2LHx>>i7ebQpo;H>B;vS(7pZ2qr?TD{}ZBwHx zW3uGFUy_U`+VmU9x3jt` zq!!b;g8!~w&Z=2p^jWTxcfDv|?*7kJyK`;`o(k-g$21+pt|kj#^LuS}83VZ`8IRCo zs4^0&D|b*Va#YvB8x_0!cCiR7$NdU9q(d=|BG=>PWXsuNAP0^KyBwsNkv|_m`)<}b zzc-N|)0C3e!s2~}#~`=!z#a8#Sz_X3-UFI!S#TlnyxWi8?aZ`ERj%_-y5OU<=t(PL zvL%#*;X2upvL^itihRtAS@;%$qk25crc$7G?g_yJ#-(WM)?m>7-$7j zd9s$Hs+wYy8BBup5AVlPBaI{Oe0V3BOB;&gadk9hk|Dhd=O^_-8X4i~B!pu^Y1G-b z-M;v9qV)+UdpC&Av#o zXMEVXTZ%w?D*0m9&}UFpjh|zDh7!d|K5!wK9U2Hrl#y4MJotZr-Q$7}&(@egDLC88`;8=sJ?*s-oaM|w%_TMwvzj5KHT-=wS=xYz63iWhH*<`w$1Ddu zsHv9HQJ84c#DJ;MDmCZb&|dc;hda1MwvQh`eKgQ-fe41UF2n1oe2<$vDrZjJ4e--W zM_f7t&BHQ-)Rr%pN&?H?V@%E*0n`CaUEs2^2AB%b-Jl@D%i=Kvyv;^}%EQaUiS z(i|^7`#7-X;ychwP^YFGkPt7fXWNUpe)46V+`+q!Vl|l?yXh$8foGvmHVnVv$Vm3; z8{*G80hoY2Gi*%mCG_beJD3L%f+Hq9`Cf@dz2#Ohe;!to*g_=$VdTxs z9XrbfSV=saPu9rx6}(Kzw%$EMRI{M_eu7C}BuQejYn4~5Sr~s5AdT8Wj&ZT&D=PSC zg_=+6aVI4vwY=)15`jsTLal)NsB{f&l6q8gqpWCeuETxnpOAb$({?`p!G09#aR*v6cIkg-2D4?B8-fTe5Fyp41nnoYGpR?EbEE~0sRe7!os46k~ zZLczt!(qvql#f(V8XMuvtP1^okaqh;N+LpRhTI0*idZn9;symX29AGl{=1tyT5x-<>p*@-kVG#w+>nvverbXA+tQ1i;h-b-nypd z2nHGn90uhgQm8zW3o&6`gtnMAwjO`MQ%ip6PD49J6JdWMOU}|qQLRJlhE2%ez=yll z=5Ox|_8!_l?9{Zrbjswsc*Gu0tNFl0`)V*cRoM9ll@kv1q7FyC+L%cuZ~~ucaN6Mv zMM?y8vW6!PxQ%6NR!I!`0{%DmnQkY;^6o7pdeJ*$UZ-6o!c~2rFGIFzSIOHRq&|Oa zjU;Kjq~$RB+VLXL=~MVm0Si+gq34e%82!W;-Wb?KYg-0Q`1XrBq{8Sn@tGM{PPXG$ zk&vEdzl|#yct0APiFqRyDay5k&IFH{G+_Vz_=}f}Tg(V$?_D`r>)2YbZy6fhm|h0; zQ7)^15;!``GJ4P433pztRvbiV8(aEy<9I7WjSA9Fa{R0H@G}L8$gapSWeI0OUPj6h z&V*eBnLbYq4`s1QRY5frB32fn;IoLeb3KbH{0O0hCgI`XrEx*aNV(d0qF2At0qZMY zrAf8}u?TMfv^P3f|M_8{q~#xs`&v8>7uw&;b;RsBllhv33NMJqx4X9xv(7G3AluU@ zEeG-Ys<9OVyH#jI2QWJFXTn&%Je8qkWqk>}(;pjbO&(X%f_xAXge&}Rg6~o7{g-BA z!+8GKZT>4*h|18_g!7-VEII)1a+_wKGlSJ zFru55hFuHm$2&N#rjQSk?zNIADn(Xw4mA?;J z$;?>S-%vv;)oQHXETNjAT|ruYF{?B>wZxI|(E}c$S+q=Y+ELv+L6?_jP*bVFZ9grp z?!w`F{Wa*)CQlvj6bJp|AGk}Yx5Eo7sam3}&oBg05=1d+*401I#*;c+ETX8tpi{9f zAEwyEMkc*M>=hXQLoKSzM!mmV4g|SX7CPzzlF3v zJMxQNiZrg&sVr9fvh8>ay%Tl8!BA}AY3q%{;qpw-r_EF8EzI5ZTGf5e-7b^1ny-;= zzdPVtB!;6xLSlmvkNjNSy7<4YDUQ6@N>n`vINQbELps|zTn1-+)BVsY*-{1+B|zDm zrK26fAkv{+l5H^C~fC@pzsFe@F=MJxUWuT~$cgRJ=c zZMxVQ>o6D)1;ytHpkO~|DrtaQo(K?ZFH8wA^m(Y^e4Vc{bys0FK)kdKmSsF(=Tv<<=@Q=Z^<>22r&*nQf&58Ta7zyrtS zcz~o+MsSxs*4Y%`D*=dsMu8gL5av$;X-<{s6Jr@k@yBbE!}**qM?)}yr_~qU@$x{M zOv1Yni{iO*7o|T6CRLBm)spMkvd8i6V>zwvPa76>b#>NFV9+)kNmxxjT|(`VDyDYZ z#8Z6vG9LJwmWy>2ncJOV1gz!tj$7l^nclaSH^BVYn5K%wk%ip-1;s2)0&cCxxwEr# z=SKYgL?$Z4;~NlN(z3vL_eTjV7i=&5axDwrINj)RmI&oqB&nNDF>qI;ptdjPVmBHE z(Ey@D{a-G-4KhGf$OVtw?KzQ3R}vQNegPxZ0YCuj$5;|+1r#WZ%l3r-!(|6Zc!-Og z!B^2m#i1;Z{9`%wiG9MOJTj3k|G8>;OhR-(MK{N5P4)@6Ii9{%Z~EoX1}YP62D!*` zAfb61%)%7EX@I8F9jUquB=ynrK-iNhvz(tNeT zbON?fk&hUMk@Ga5{vF1~#%bcME2a9stf<#aaH>YO4Ah+Xb#jyr5_q@~l!!5KM=6+o9^oEt6%S~1+Z(toh55bL ztSU2ok4pqM#`r5 zuq24%{ecgzdw$xBYW1hDpv>f|q05=CTs9~Z@7R6F07B``3)*09{h(s7;&r9}=YhU# zB40HH0U5(W^ki{mV#wENLzo*5?Q5_ua!-fqBiL7S9!vrIz6JCn%bq7~sO~Gu_FbUL z6_qu={7~`;6j1t z*+Dh#ZlxfWM~b82gDWrP8CXwH6(9SgT8EHjJwsx*Hh5U;mBP%owkEPs;m`UCe&Z1fkL zV9ErP_AkT-^?HrxDSDQKQQBotmgVRh?ESyQGZ&Ic)b%e0=Zq$^UMHPqY^ig*$EqmBv#|Ula}-PLIg~ z4)m~B8Ssc|ndx^ywt_Un$VKEc5%9YCwcJ1~an8#YkU^^#^!DM>G3wglV5?zEN%VKq z{-D6S^XlSo;VlqgEP6~iF-bTzX+(?9tG^TDOAq%P9|xV6OwgI-+D(lU+QcJ#Cupx( zt25-Kz(O!#(Wx$=0`E!sxOdFAq>FP8Q9bch(+cDF9m#t4syA;f#?ru~<^H9=zlKDe z6z~Z=)(lJage+%{48mfrhNR@B(N2l(17xIgO~c|@UiZS%9jf;wxr~a+-=GB23NFk& zqG`Yeupf3J=XU=P#Db0SlaAT5)eo}n{Vze5|F>gs z0<-Eo9SGSptCeHJDxnO>p?G~YqJSxbA|MAdM*_1(>H;b0X5E~&D`f&>iy3_+sYPTf z{V7lJ4E~PNvJg|!hAG~A;(;_|OIB9r6UP2NhB5rHa}}0Bd*S!O;#{-X`J4%oK0aTy z2;%=---V@zs>TLgEz_=5|9nOTt}yJT3GOHWcg7C}1^?TQbnf8+ znR)a*C>gw_y$}|y;#5BCY2}y6?1c+Pct8zToi5d9^Yim#{k;m{6R*#sXH-l?L;^4e z`T<(Y1EI|ZD&pJA!-YH$mZ~%#p$-cTjRoNDhtb{Lof2>}OaXM_^}Kcf2y60VPEHOC z%EU9Pp1l=J=FoitplA|sF7ze5@9R8ock?UX50SGNHa7z4S|4Lzmc@Lur2$d{` zW&z+Q`fxG9>X;4OCtk-*g&Tln2@`@(ZO!?nNKa$*y3<~{ct za6!yKh;T1lyT!YS-JlT)vTaW!9xf873CPG;0JO-$DC+<)&9oyJ+i|rOUc1sXERsgT z;CyYg#`-Og;SD!|;G6{Ro`LuE8me}~$3pPta*sFLG)v~U7rT3Bez8CV&L}05_Qdw2 zKZqe(C@Dy-lI!qH0O3ApxA0Hax1}~@>eGS@@25ekvA}q=*4}U*ochm5s7@3)f29cr z8w*PxZ*qxQv8hORWu$`+XraG?qqueC8u_uPKdr)B?@bnxAI(%tvp!l1~@RUFX!r=^4|bxiyc7DZ?$7M(F*;JH_pwC9pnuBHH$j4f#h3~RJnej zeaAM*fy?aJnQan;K?L&_&p-&a;0v4zkXxFC7FU z&UG3<>as1%LpcfuB*3x`99W2t0oL6DyLYUd*}<bAsyBBXcTmH4%*u%!AIJgaj0;|7DdCpauIWN^y*QtU}4gl8U{V!lzRL;l}bLcR> z`Jt%}A4qBkSipvHpWRZ!n@X+ZY|q&WE$6{0KxsgHLP7RHQ*= zz_47I`Lt;a3^(#8f!8RYT0y#D9vnznmsSY_&_)k}nHsh5?_(shc_K`J39+YA0LW1I zCSY5v0KD;fT-v-seI_^m)3%5{@(|*s1|WOl90MGpe|auE3U&yPSdvBRHljs7Uc#JR z8vQGjT^ccWO_+es`}Q7Ck+%YhVfaiR#X$Djys`C1aI1+2NFjfuAWt95k>BTM$f|oT z9eTVPBGvOhWdl2rG*e_Yt>V!TSK4ASWNZZX$J;;q`@%?MuhDoSf*|o#z3Soz*2s$_ zF#d^y(Eeit4QS-*Ef;_}exaX+vux{s61XX9Vf>G?9`t`Iylva&VXKNV$}#7jn_nRD z&Z{iCqK#d`DL2=RMjPt3gy|Q{S5jzwq9@HRll+ZUsAWd9pCd*vFF~L?7eG&tSqOhl zr!8NqSAUUb^2y$#%%Dj_d{~MX7Zm@-0mL!}+wt5mP>1_iPr_G#wN()Gs%_X4YzPJe zzn5rz?$DV^;$eKc|BEh=i$LS((rlPUeC@#B?Dw)%oX|#Ef%W9!wP*S*Sk9Fu!+u<6 zF%$wSfLK`f#1^3gw?7_3)ZlUO*~re!El@q*ifH{)RX?oDk_kFw2L=bvS8Q5I14SZN z5wIjiUS16#4iwqN&Q+Q33&{1=1b}{}m;%1y?wyqQ-+L#beNb9GFzbn7@lFz?Zx6uP zS28lnrjjWo0%y~Uyyj6-g$o{`eL(-ujzZGqr<=rdjQg5HO$vgMt(_ zG~z)??z7>3-~y!d@_2=dtMLS(Wj7TW+zB7x1l;nQds|1x7NdTnqM_l!6}y1YRQDkO zi2znZz(gI=KMnoA?FhStUtGbqI2%{uQXI(?GXomKW%5BE=t8ETPF|AJ1*Ugw zBZ~+N>oni)u@&moS1!73XRs~<^CPo~|E|LQj}@7ido?J6blWFxZQUf?;lv!Qu1n4- z)pkod-O*HR2~S>)+roqokb)Qh3}3@5?mdVeRGRkT&w+srDu&9ByBbjytW-IhEhHkKA7G?GC{><8iwA5IVb!=L>b zYe7Cf%?)s=2(tdJEB`AV;QhFxR;W|+BisorThs1HvT@Ldh^)};B8WLQ0nv^HF0u;j z=CkNGREL9^fWPcq&DY;#Wn}?TmCps_^_C==JCJ5~szmoK@F!UEUM9ug9sN>;+0#PK zdx?#g^VS*w#nzmi>MQ0($bEZ1l;$|`N{ywI&u!qUO?GO#cUT(xo@XAa#59$f69zUf4SNZanS{S+BoNo15-!?Agw%g+x0fxc&Qnz_y+9eL;4rt z3ZNU9f%Ra8j!VWXdj-qQOs;ciSLTX>b9yH$vK7z_X!F>{>U`>R+qCcIvU*Ewp{VA= z>2UyMSd+q(k=nW1}{Mpg3*4t5vG3e5Layuq^QC=xh)}W zFD&zKvWkC-q%W8(PprhtHJ29MT{_h*W-dCsvvn-kh zJ`c{=CRTLhA>hjGuQCwJC*q-I)pqyYg z(?2j9NUVRFs6UybV&Ky;TKhteLDU77m;wm{uq`1Tn0@S^UI7i%%}a`)SrBvuof9Ue z##WooP&~o|c3OEs*R|ISU|{EyGk2e`Ai4a1BV+i__y=GTE}5ck2M{_&HgJin|FtZ0 zy!nwx$Yqe8#YNAEd3tq~lA21Y4I(Bm-48ZPV^8-v2(&>kKXYL{d|%2yr;RInH~9J4 zI8e2`0|hWawF6?epaF z1scUB7{Hq%X}JR1<)__J8ZYy;qhwwlc$ z@|phBR8%FH?w(Ls56sjPCOoh~Vnu7nO4W=(03RSVS7V(bdNC@)y8P)A8d08Mi}x9r zf$IfXmG3LXflL=5|72y>`nE`2oA%lvsM>zTfF_{J^%4b(lolrP0aDoqY?0z!i*P6kgon|@RVzfG(n%3w^&cVS# ztt!VU7>E=C*_>pKM3dq&otl>$(KHgJ@4Nxo6G3(?R4cE-gDkx33h!$RKs5t?%h_rG z?vGFt7$O5RXYzo`6sjtKYyAp9gCb&VRt&wTE%#>;03Q_+MfDW3X%=MbYoi^4*dxCv zuxiM7O+&-Q#{;LLOepusk{|(@q;L;l>TatrKXbg%6A;IFNNhTCKQ$KW#pEb~6B5N1 z5`y>jiSZ#3=z1D3ISwJ(F@*QyW-s1@zi=jPm&xqbKuQWIzY3s|@?$&hf>TC^Ot8HE zt^i2QR*-%yB38hqHQ75C@0bpmM+W1sN|6TmK1>oW~i*-C*&M2d^ zIjGkFaaex_VamMAaR_c)@IWch3#S!79xu%@e@ z5x~($0~N5C9;#r$4OB;0gOt=wEVU!66E60eLn5@oqHVwJTG#HSS_?{oX)S+rO~`54mjR@~GNTYBnJ2vi;xYW)u1_CyFX zpYj{!SNI-7QbLG9A`{<{Lx5x_&q*l!i^R8yeK65r!#FUzm>!D(sV8nAz&``qmp|fa zy`5fa7Cs3%=od&C>Yy7T3)n3}QQ^J_*q1ij)TzVLfJ-g_dld3x(YX{mX_DJ?JOVB? z_VR7xrw=u$F#Dy%DD^Jt!r0Q}WCxbDM1d3U1s22)Ym`Sv=#dKYlV)skk5G1ZJ2b>Z zJW{NkAY+PdvDII}Mylz8JZ85vdJJo8YkPOyzD!{GVTs#ZoN+%&bK*7|@PC2xlVxg+ z#8ov)YMuW>c_NeNu)Kg}9GrycAi7?`6-ac2ff(-Kl|8;jS>Ovt{H)jkRg;@C<`X5V zHTiZMf&)%I-pLCip|d|f3Z;Z3Z=Bpe!F_ltUuUR77T~Z^Hj&f81J^@Gz16RX*z-<; z6iFC~!=RLWJdx381sLJJRp4)xQB1Y% z_?M^fCY(zFl42 zFa1DKd$U;jtvSaW5~-{tjf{Yg009AkEGr|S3IPFW2mDCFy$8M-5SWt&enGmbN{d01 zg9s0R573sPilPt@Rk4WA#xTHVcqbVhR|p7{9`FxjGCc|b1cWk+tc0k#m%&LEtPxf( zcG#zP&@!agtD=0tG8)RI+A39^y)mtxRf0DUAF86X(T;OTJu)~{;^;Jd&RV}hz%OvG z4LUUFy@Q5}L*DDQ^{`wzJ{}Ra1dV|Dknq@gqDBd5viBk}o;6ysw2-@5qPwL=DmMas zA`AY=F4m217TBjwpDeAcabP)($tV6jIo(S!T?RdKB6YK%pt5#{y==(F(_P+u^IFI} z4Cfopc$-Wmmsq@BWI@`hL}z!~XL0n`Gv{rUm86YhjwP|f4Kv>6Fu8flrWvHQ5F!9R znVG~Na5(xtW*Fm!#hXTcznIK4d9n>N#+8bZ)F*diU_;Owr*nv*ov2=wzAdV$t0GDU(=!O!J_eQ)%PVXr2qb6>qhr(*)^7=nx4e(JSaau z|K9eguPYRBC!8eUd~WjLu%u$Uy!kYt`K;}8q2iC-@WQD^SIfqex~1*Lz3eM-@D&mr z2pu!%&J%DuB*BvSDVH~FA{46?#UR*N=(&z^R{K8%eHYl!y;}=xHz;vfY0_0O>yu}0 zrL?wwnzQBey|sHdt{Gc?Ig|M^XBeoT!DUa!X)`@vtZFk?p4HRWH)NiwPpwg+xnl1J zJ{UHu_9Cx4bud?tKE+0 zRl-n7PQ&wS>=xM4Sxv)|7(Z*;%>1GHPQaaF(CRbz4U2wz-ZVD(9Sp*LK%Ufh)!}B~ zYtovMGJs%Y14Arj%l;pm4 zK%w6I7SvczQKz$+e?#yFc16j=1X?q}?d#kGZdmGStFLWiR2bVm@Ejg(VRMRd0(7(e zZ*>CgVXbzS8(nvvug31gt6^KW($Y%ZdARK6m4VyFm}=lttdPbc+Wj7txD@`YmB-nt zekeZK=~Pjy?jWT0Z~0WFQEh`-n`F0xNy${<$9;;%$HNj05h#2PtDh#rweM_i*8<-( zv?S-s^$P;uUh(U^E=;_S%Idc#q)BFmpjW;3i1Y)mM!9!}=qsix$;88c^Fsx-?WBC( z&Ix>t_j|ZJsFRV2BA5KO@1m-jz@&!9X+0^?O-@E!(R!QVchQT}RAGz@n-eSis!gX= z&Tz6+pXxd$$h{>!OkBV73wjIvlL$vYNnlGK>r!Xesi0d%Js0f^UcAm0@a1)8=pirU z?P=2y6EiF8M2SjXm{zNg`xt!HT&WIw;26}7gUJkdJTREZm2ADg_Zow53tIuM zWc8l;eeL*I`(qT6J{d5@w6Bs{=>_^)>AECzd}1M z)!8>?uiV>z)Bk~;9)t+-doKlr%I)0Tb)5U&=n$ z|Dif6XHKTmm}Du{rm1d13hMO%@$OkALdmDt!tB90B};}4huAlWTG7FbQpI#4ch_ES z%X&Ukw(;ME%3GCjHVS3MuG0}b0E@_-w?hNTMrX~b8(H$x^P;kfo~t0Qni6#Kgo8fu1w(derpl$VKa)^#*!lV zr3drVz~jx)3xy<8`?HH+om!C+URE-k)moeXPTSLIA|%xN0q?!6qKz+K4Bclmd<^*B zIfqupG>52AG#H{8`|SpeV+w0EN7iKA=mBp_bJ)g`&{j12_RHPc9FOa04Tw)(GF2|( z3L0&1z^j`oRWEn1AeUSSuF;lp060lTkZx+tm=J%rrvq*yRy65jOl}}9!&&QHcKcjB zeAD$tIEma~0@cobUhJ)S4atd{9_D8yB?n#8imaIPql)%FA|`kwt|P4YTn@`TI)AO= zb(`I$CyXOv9~-t}hSAt;+JKd=0~7*k7({IK9G32_%5S`=d)<~qgO2Slh1jm!wLIJ@ z0z~1NP#2a2oP@(}V(-vpXtMI$oHkASE0p%kA&7pKN`Jl_uP_w;{%NBt z^hW3+WU5N!neED%AT0jHC~n2MpJ*~y5>eO;HtD9;cJ9$O{QZ0VafJSH#K(!%fG7Kx zA1nJfmg<#1%oHnY5`oIC9m99{@dTO!XbA{#w`!jRYo~r!f0-Xlhso>VbKCzp z%NfG9-bdg#{cX!AS~GGc7K5;mo9L6^%{0>R0t*ra{dmT%Ae!#N&T#73{Y5~}P%`~X zD++Q;O;8CZnyt|^0i$==vpIM8OcxhWm#aZS?tJ(_s|iQNv;!Js9NI8{3|G}3phJQB z8UFdkDA*o13>`zg(m9f_Fy0^Bys%jjmw-c2rWpZE?(0{#&N^dqaJwR|sRSCBSTKAY zu#rrJxm$#{1aJ@+Aq!*hhS2{y#821Ad0X~>+M8kJXcVyb_^C*ZvKZD*;EV&l?3voNda0l()Oh9V>IsH zsP26U{Zc6HlhX;fYzgZM3mSPo#IZ4&|iiol!*S1P5CFU zYCGFAkaDtQt~TVcupdB^L{HbB!f;%-BP-1EBfZ)p5y_xhQ&pevTNBT=r}My8KN&5R z;;f_m3=apb`}w93ZeP$Av~NT`Z6J(wd=#|r$*g*#S%(B3hkX@Cg^p%6Z(S3iVO<0Q zHEB{}W<=}bnBRe*bI|l}ZM^{gBV67;GA#~cD0L2>63OIe2YP0HiGp= z$;-H74P}(kvRT_FL>o4$4AE?-*3hNInZQ(6Y|ig)ve+%?;_ZP91*?9Re84COZU%vz zWsTmbErYmZPCTJ+=;if zNl`--;K%)IR*QM0=#o&AO~79TY7Qrk(mCQD{vv6cnbtpWQ#)+=8F*L&LX$JJI9QPMe65u{?QTVPx`6@t&qG}r1UtuTuNUH|(d}BLsqmQYRhS!44tR1 z1l}u|90ShOO1CS`0|AGa%yo(T4BegQ@z$v>_{HzYB?Dg;hG*D>(40b}4XQ+Kc+tzX zO5;eHJms*X6Z=3IInA^>yN(LC;&-TeL=>rxaT$^ba(SCNvEmo+9`a=mBy<|Aqed2- zjGTc*|1_9=8;G*8)JQ+g;#cgAENrIbKy+InAmEbHUKcVKQ$dx$9ebS>?%wz|vQjBI zsYjW?JIseKW$l(zCDHWBkURvtBK`x-Y5ZRXHHnwuD=vo%@!MGMA9a7MxEXbN%1-ns zm_1CQ34ZrS7qAW0Lg!km(5WD7e@|{CsDC5_u=WR+WTSQ=>tBD%^~7|O7Bm{FNSiwhEfJsYh#B@lnF|txvKwn3A8hXp2q6 zzmuMOV1DKKRkzI`{20d0Emv<`=djs;Lh7*Lil(n1w&UYIgLN3Olo~^z!9r%jZs|2q z{}$@nXF}B}j~H>kwt0oAUtU2xM2v||D~S#BxPv*eG`8@Yafh2uq@1b7xC=_<7{`B; zP7(sSw<2PlHMg*&lP7jo29<*`b)EM*3edkC<*s$jOggIUw&(0txS1TB9e2=;)}#gm z8RC>D@ZgLM!Na`75smYvVUV?T;2sM0ZtOjjTuY`w#H{J>^)!{yPTJnOJXmkY@s^m# z7V9;9X*Y+BPWtuk{CaBy{7g*3Pzg4vb}BxO5~#z!RJKhDhRaT=MqUo<^xu;;V_bOz zHvTbyc{omb3>ZKme(_Cd5pc-PU-9|VbG$c@&TPq;DE4qE(@acbV^+hO3G#i6x3i_1+#ldM zv(j@7eB1ue=)!G+jF?y_SN!e)#VP^kdGAP{kjrlAH2nCB);6Re7nYcX!Qq2L4#vY4 z6mO0 z+9Zi#R*bnKd5ROc=gnsCpFmmUkV>*wF&U2^Jr`5@k=sr_IsGUh-)18i_Igt;EBB&& za*-M_!GkD+dr|{`rI0bxwX@O~Kj#@Uk>*0no0BBk$tbs@boAz|d zDj9PnYOZ-u5MZFxIm-X&%Sj72gF!4njm9-r*$MV0aq1_lr_WYdG2W6I}o0y67W zEgWT12#!(`yB?|^GwNwb-kR0<-z_!EiN74cLSPz<>elO&m+32gJL?vp6|`iSk<0hL zQDr)9H2w3gdw}t`JTyNYj+aDI>gVYXgE?BDH~ZYurKXb4^fJTK2}J?TQlloT<_7DS)@T zS!r>^g%jRIJsTDeO={+W|q;+K2%);_W%PLIUPN#fng1#WHC>HZwzQl*O2O5fwtu z;NVWw!7!iUm=2Tc-T5wg&8@$nZDX{Hv(^5lvM0&vI0w?!_%EjTQ5ZV8L?4ZOFD9o* zXcn%A<2CAmCi9~Lr5RNh*A;}x$$Gvw?IzK-AI)N63i_1r1sDZK@U=UK84DD%@ueQK zho7!AhcCCwREw1%iT3oV$y(V_Nv`y0_SNR7iyP|betdNQX3?%(zLY}lzgM1sRSu&f zB&3A@ftj*k<;E*70kqIq&X(Tfkr*>31nT{@DjES^iQ-L0IBvoE+@A1UEdB?+YS{8; z-t=afm`h&jzc1AtwM_SJ zULMM`!FhLMgrfXGd{;j<&B=uFqiz6$W>SG!Uc0KnPj$LCh?||Dk>|Xw2#lp@=EYk_ zFR=1uvzBS*AzL2m*?1)rRO^RtIX->kiKp9yP8f_q!Gbe$vB_wQ>x$xauBv)8U5yck znOi-cTzBg0WQl(1hreZ^ncs1(1>?-^_iR#;|KKzNTg3kk1Sc&wMi?u20W7<1k{N1m z0|u?{pC9J!G9$p)k7gy@-Ukddw^Taoybr-Vix8I_z`p!X6#H**`fphIZ`AiMAj<*< zrf~4mrA8IHwQ@21r#w2%9%UpZ+th_hS#&o?b9ZyM->KwN1|Ifum;v0K3d~6Nzrw?U zpkU>I`S7K7x%2tqs=$0Wh0S?WLbzw%(51krsGvah?sTQVd8-ctvs-IpDp2E(dc15R z^??vAEiIeNwv4Qz;*2|m?|g%EUa59fmm$9&B^6b%)fs&h4s(iW46hV0`BDeI+@wyI zeV$uOc!^Uwnya{*o7AbX_#TbN-e<^v?esEJqV;6E&^=rB*?ju9N;N=P2vhpXDk-HD z$frKq`ckW+-uL$R58KzTP=BtoySSTAe|>oxPPfda^}gI5^AR8k8oX9FveX&8 zKu<#eH&tNN8GPCP_VS7T9+^)_)KQ`AvG@8uxRfo&`P5&%05N*a4m=`Lz2r zPdYYbFWXlM0gG(iO}{`jwq@n(9s`1Ek|+bv^M0xqBwa740)P)}_SCf+=AoZTjgT8w3vVZWSjbeneu z!vySu*2RkkM}^oeM&ba<<>~X}LZxwtLHN;V7XKXT3V#$fqpIzfBU8pxyYD+eku&KEdFNxFe$Wy*hF{h* z`G&WXumH&j~W>M7Cx#?t*s5GCFW30uiA7MH!G52%PlwJcXXj zxIZ7MKE#Hb403fHYk(Pa6j0k7W;f%1cz4mKi1APg1&2B*gpmzz9{FTgXP2&9o31mL z&wC*A94YN4*~v+3c`S`zX}Epk74tQbIYQXFBlc+tb7G9-D93O;n|w?V%y%p~wp$DL zt&$3>O(bUL6FBo)MdJ!h6YzM{)%&P@Yj$YheYu`$?I-pfFij*npmr_3(t4|jF4x+UxjOsLFH1i~q0RuR;r33ZA4}xy8-4jX zu=om`ofT;X_XO{jw;D(G&w%ndBB1rzmnO?C!Snf|-xuH@Z}p_E>V2{?ZIEpNg44kh zJ7_P%_;q%r+dY$NJTubI$W^|?f?emk?erOc6P*fBNWGNAu?hQ;k#CQfPbrITuS-OHm}Nr|N1ER+VnX< z-+bQE2iVb-)2~LUM+r>8;=9WveIny`3Y}?weLQMCoGI~rxZ1k|-pMU}fFI1pgj#v+ zgeCF%j?a0iC$Bj5Wv{X-G{l~E2rdd$#&t}87JDM53~`2uDdugtG@M>&}Qc6t1{g(eg7*F)-Go{JvLo0e^K z8c+s_d@|h*Kr}0ExdBY44@mi<$>ZdYH_PMWSAKc-A}1Ob;Hc!tjj)$8LGNHV3}H+4 z8da|d4h94hQ1&uiV}$M?CeK%W&u&gzu9O%(%WF&byf-6h+?q>pTiC}0)N=UE(_4ml zDRN{v$}i6WX7;$^q(dV?muaIQ)nKy05@yr)VJFpgbw}tUX3w2bdYvdiE8@aO^NqTUl7e#!iD&sb0WhEd6Fg zIu3Ffms+|q7gNH2KQ^FK$`8*4L+m_HAV336<3+q)Y9xp=CV=K^Dd`PxwST|S=e`%< zw~V*`MWxRhUK8#9*}^GHWIW_~vfk0KHO1D$mKX*kNlbYHg_Z>rY%dVqta~;d7DGRu z{O4}Akn3ik4!v-Wxz3vPxkH5H0aRoYVNc|@pl@`l3csXdiET)sHw5@Emw*aX{(vr% z2qqV|u&m+8oQU{6rY~W7g09yaVU=ZJr8MG-LVVrIl=NZgj!F?2lFj~#hQ-Il#jRI( z>%zyy*1WTpEWpZ#OpdU{JGks5)q>|jWgF=5rKn`cv;E9~)>ZWm5`7!eq7Uekg_@K| zxGW;Q^y~v>)5l*p#R_Bo{-)@h^f~W@eW@i<=JCLZ6%3NBE<%!cFJ7sCHG?WkBSV5f z*mA!aWpf}E^3w$Jz4H3U>v%o42}wE;$YlzcT&s!P0GTFbNzEj^A44?wr=bXOawtL% z+n6id_z31`G4tc(LkMtOvj(J;B2gPtpM-DbJi_D{t!U9`%4H1(5cICx!pialG=&F1;n3UZ?)wz>#!BDdi$i08^m03_8!0iNMsOPGdn&*rvWST}A zAZ&?#=)wUy)NH2=0J!37A%0uE*Q=bjV>W1%cB%jtKP%5Q|N7U=FGu@`eo5s{_r4Y= zLgIdF<#B_iv4Vwdo||R05bXuJUt-+WQ&Y?1?7iZOsHR$-D$!RZ`t-Z#&nrC-jjMK>H^8t$3h?+@{ zOZ2ly($^s28J$6&wQ{P$qlpHK%17fM%dJuaBK-uc22H0dh}lNZupg3QxOrOdyb7;p z&XI!mI$POdd_7-K*T2f>9m(E}j=W_qTrCl7+n=uJ%rEldATN1abT%F=8LiYpux|zc zT=rqCe=wVwwBg} zHAzP&HLxtVEDw$c=sv{kqeSe7f9fN3HGgk{?p7E_i{3Z_C&4wJDmGPXt93H%G+T@! zinJ~Ohm=Ls8S9*bq+vFIwd4t#XOg*702Ac)Qw=fqj1~XX)A2xLnO4N?mej!Pa(DDc zlx@N(*Y}_L%^te(sx0@;1~Jk<^uOk#OA}!)`VMl(2vC~mo={BIxA{V~JHr$+EAgQ^r zh)V=6Uv8(%I!vwCs-tu9EY(O*RP<<;e7&@J(LC1EzvDedNEiSnh(bML?NrL*81+NP z%J;gT+h4@(0k6vJ*s301j7fjU&TgOFFVcNcYk;a*m-y2hTN(i}@BOOR7BW#0GWV)io^GV} zLNdLUW(n-?%1S3T0z6SZRmk^@qywc8YV*aFxc(vqA_8}?ld-lZ4%cWY0b*jo?R6zQ zC-9TjpRmqX0aO@L*G8TLVwy&$`SEMmHFjahd6dpblwDgh9Udb zCWLxl_`_k+f}G{c8}Rt&cC2pIU8flMk4kHvYu(VqCFq-eo}flRh4Qnb_u8Xka z#6Lxh7ZHG(gT*!|RxQ{L#W9$tJ^f%&dWR}>-+{Uy3TSx+3h8Va4mzP^KI$K$%T~00 z{|2`ocNNL*ICeT|y3&`RciB3+<}eK1S_a;|hD(qK?aeJDf3L~CZ)UXE_4vLtyl1R| zD3uAjhjIA*1;@}&r56ibg5?wc3CHNsgfcZb{Q`YOi|QKb$Ver*;vLpzOS5t86BHBU zkf3#D`Vw3)$L=b{2D0sPLUYMFYTEMj0h}8)n`*a?RCbMAE1&|+J^_tRfF^j67Z7GE zqhFR!&ZfmtknSi1sxgCOaA|z_q9b4MntI|I0j0{fC?*YRzO;ITZfG2f>yiIrPdJy1!hRsjM!Cu5&f19n%5D=%d^rGOu8Y^qXTSSE zIL5-yhllro4o@M}ptSuFW8Ev8totu8mi{4%E64gpA^ZA#^(l~f%onIS9=tR>CHi9o zB73w)n$!)^&NvP>9KmIz^lx8T zTfS0g$CD~WyDKUvOgj%WV~R>4IO!ws8q2@hm%>y zn`(Q)ww_)4sIBA0f&^JO=x_})0Q5Ea^qpz@gF{!|mQ1+$NSYwUj!>YC_+ZjfRCNGHlc!5A z4RA+((Obnv#SwYZRipx6VJWn$-{m3whQ=d@i)JwvaOQ|W+VZ0yQw*8ligqJi-98c& z4gJ#D!3yWZ63vFu_smWn`YWLvYdzeDPC>v^B2vy3C@=VLB9&0Mv=XmHJ;>WKvg{c;Ii26s=6$qLV$e8EWC9>|A%V$ zf8bjNYJ*3S+@IL_30R`=F(27m$<=tiDsOcx3oZ7nYM$pY=3b>XQYWxyA|$TEw&nki8&^ID4BEDEMV2eT;kPN573I ziQ{GJTyb>1^PF+F&zDRenR4(S^02-fHN@C@#oM4x8SFv-y$pQ?&7R6;f;YlGs>PEQ z!u=C~@0WlJ;Ak%=tpuM8vCV6fSN<#NdnY?mr%vdDk=pO1Y|>5;)&qnMe$K)0XX(Cp zl`a%-0I-@RAgV7SZjUg%D8`N0h{g+Flv_R9F~U`qNk45S|OZ#y3DJF(sm z9j|^~K`+?>kJeet0$;EZ%Mi0+4EM;sKS*evKm1+^LT)sFib2KaU{2m=7;ziE1XQm4 zj_`K*-NTX-^Y?60aP%(Wvh@Cx6EsfS7T`B<;!qvY}*FE>(tO}~| zm-|8o*oITiu4s9Vu2UF=)TT75wH1O|%2q~a4ViC!j;_0_OC8gpH{bcUC{sACFqxJ! zT?sSICy}=zgjPGpYZLwjj!Dh4Nlvl*UYk`dXw-?f`*U&2>RX??e#wLk2UnKgUS`=IoAi=S~QMV-#kb* z%a$^P{P*#MV{eG@d8eLMh_v2*T*rQNoX~DC`l# zB<-?yZoQgEF?F?+tN6Laj|Az`fiOX+_u%H#G0$;oFZy)-bgS@}ntS8ivAIDcvA8>L z!qwBumLR)DOzL08nUcp|lGSK;+0`8=8t=PknVi_C5*>L?J3zS7I?r3<9D(DmDrXtk zN!8zF__e&Tw)teEo#Os`Gx9XI3Dmdy}3(JLRuY<^6*u5efbdro>n0R+;51grX*$1nU5&Pl2|X#aJs#56zE&Mqz2=d{ zDE{D@IWvAIWYz{7nS&q5J|q(y+orEvLa4{1<~v_e6zhV_Ls^|Yiu zKM?-+?;5W&>$q2yHNbl@tZCUQBw$mh3o5D09~wi{lr3%UqpJ_x3&fV$Xb^Cb>cyxY z)H$Gv!bynwlRRNMR;;edm49r5MN?2XSeSIp+`g{HM3Q5eEl`(Ho@4N<;Z@OP@37wL zdwxR-r1Oj2E}Ks4VyrE7!@f+WEu>4E+7M3SYB|+}<*8g_sgzE!4yA!6rDLLcs%5Y* zN0+>vpIESZxhmDv7;Gpyf#6u4jCp36zvw0k(5LeEqEi)HSQ(a3ig&ZBvt*F9(f#~M$G zrtq1h-~A@vnm~T_#*|J244TJ!`b7MI<&cw(@&iON;#>!3w`J?S-Quax_pp2E$M3~5 zzX@ev+qwt5@AGjSF!_vwj$rTl?r0teF)pZ(Wj&uy{Sc5?`$IeL@F_Ngg3k_NNc3Rn zK77r-awT5ZrW4kqjJIy#cM1gSQIC22TxCr50Sa%rk5V+jMVbsusT#}_IO>d4f%@a> zeA9FlOXQ-_P*X6Sr6W9GAi-`yw}GJpJ|}uL^W>CfFQJtGA=R zJGT?*i@{v>3}MrNCcI7!<2>|WfAtnXs&j#~H8% zxL|dTy3-H%(oDzG2jo!FH2Lo7Ehlciv34OEj!%pIAQ0KFjH5jVkCtcMtxu=TcmW!1 zqW#ilRXh(r8B@sLfm#2OtoR6iC&g37 zlFC4c;Y=KPl3$doJ*mDZU$dSN_*5Ii0llY0gHU_yFLgs8seaWpR0Iwqp)P_tPrP^R zby0BVBC4)PK6{(prkHtu>ed~!XTot0-m1O6v=oye%^JULjclaEgJ&7P)`0}?AiP7e z7z|}Q=FAA3Dg~KiDZ^UzsLn1-fnuY{WWJeku}c2W(xnVK4MdzIDkTXuy=UJM?LY5` z;-h_HNCPE;MO=|8lV8YDrgp@$kVsS;L;ryU7*3uq}jfO4nI{a%wrlXi(0 zI|{4*-K@|?&p~lf_M~ZECw?D{OBXyp16@zlub}8_h-|#Q-UJYm1k>a2__DMGxzcio zlK8qd-^WH+U6KZ4r!8e`Xrh9A$WxS3n~s7`XTp%1Xnq$nuu zETxco`$8k@GXBSnJax0=WU-7E#HNH=VOScMx&O84gc)6ptD$_2NQHIG|`Zu zC*YK@e7A>$v*&y{c>Vj=FQzs<%sY7Jb%D&Y-Ho?HL5ww%zSge4Y_o!WF8wk!I{ z3_u8no;$c-5!Psv@eK#1K337;ElTk)K{BX8!^HQKZ}WV`LTm#pmWN!OhdCUy{?{Tm zhcoOim)v`zf6wRMx9M+w{Q-%N#PHd#B@<^ODr|y6`({}hBKUiSP-PbsnxbD%CZdzE z6Dl01Q#+*grHCJzd0&xQ=XtFc9onNfX++?*a=&QEd+Vc6H~3P=$q-i2JuB)e5<#GD`8qwu#e<9k;rYlhV?xLwPC} zVtgYG)tEO3@DByruh(w9_{8-tc?hPz{JaaSi@R)kl`h6Y3IdY&QS*3qd08E`$ya*2 zy=*1eBBUWwu5bkn|77a5HRyH{#@5E}Gbt_7A?xXVu^P`~cK(s=h)=H)$U6d3R z>-t13Tb6rKO=)f4UX@$~=+d+=r)HXQ!i6?~p~30s5_ymoFBIa0zHg_hjS%VklKF)7AKf%}Dq5 zwD!hv49KlX?~(CkfSJAkki%2~K?RTBqx1uvx(uDhA4+5bt|S0|$^y3hZGf7dFnxX4 zBe7nnE=Xd~QDtgaf42armtoyN;NZFe;3MVAbZhf1$FlL2^v(cVIzU)`b3ojzG#|zW zOUv6yYDyC??*KK4PD|fC*>0(B6qOZe%g8j?A1yL6QpH)n&9AWqaF+*I@##0Y#RCq2 zeN;dRqd04SYx}lM;MfvR_7$+~1G-J&08NfxZa-K8Pz5~iSPHjU9M%bXfKB}JwE1jE z$1;nmqW!gr5HK!J=F4Ip%$EJITl_1Ffq`K*{!`Sajnj5^AXhSK8&I4Qz|0*G?cgi> z2nh5PTm7+f2qCWRfYR);n{N4M{!_Mq4mdur0f~siloW|c^9bZk2r;CPNDh$+`IkPo z()O}f<5<@EfQD`|y#VL@jkuuW%pVPW%{(dOGjKR0^P>-74!8yDkO1_inauW8cwH>7 zJOPH*>77Q`Js)Rh=T!iF*4h*d`#;^@Wb)W9uLI5LIy1R^`1lG4N$k6H zRGSaCWN_O0fK=}=Ffj#brtw#c)o9KDU;j;=!^)o{;N1L1x`YM*f4qD+3XxgwH!QIC z0hxfu>1TdHL2(oX6_q3cHp6eGXhh}~<@ZRqKcCECK#&cLMqOXw@jZI6wDx^EPU_dn zHTfK3=jX4bK`tUTHh=23o@|L#6PX;%aqTX*&^vLob?#9^H$zwi?>N4fk=! zTwk3hi5Ek1HU?*2E-#0fZRY_AmjdupCo#cx9WWSr152pDeyMJ=)IMD}uq|xs4@CLc z+5J}R+|5YG&1R`V83Z{PE`4A&(5vX>y+0~-arb@R6Ml=ACia%Nqt|PwYyo&Eyt&8Q zCC3{*^>^hisfK|s8vdu^VMr?6QGoRt8}nG9Lu>iB%0F=qcOuce8izptI>6153fyLO zNeqD9T&j1hNU^2-B=nGv!1=ldsB${pXmZ*uURBWq+)6&z`@fFTMf?vw z+YzAjTd4DCzvKiw7Ox)F&KZ>SuUE8PPs*F$9xt$2jNq0DfSWlns13+H48hZ6{>btb zY|Y<#jnx8xq|WAfs;7@CfzIl%+)y=Ls-rf?4wVXn&D$^C#ko{#TeL^cq&?Ohjyi|1 z4QQ@2{t<{+@Owp)A_ehjX=&*FKR17dxGYqgPXcMBnrh@NG}GXdkSC})>7&^)jZBAz zjrT;0bw-`<{>eT_Nd9&7a&#hQnCR&DTe7b=*Iu%dmy=UXg+B#n2tI=Z@AP=jTCTQ% zOhXc&duhiS=d7Sdd?ZIgngR={)1#fr!hV}TEm8Xg7$#!fNjAHkmp`vNKz5;7hP^ik zc-XEA%%$N zL)^h`C4lEmchnE`nhKKV(`uh)PIMsUvALm7k^4+i=``fVoF5O0j&2(oc&q^q2k`G` z^(#2eSBjQ7>7gL4LB;epp#V_WDF8Za!?On!P=#nx^*z#w!?o9Zj>-=CE%DH-H#=Fn zWIA{C?n@f6+w7pT8tQCjkrV<*e;Lnva^kQB< zc1oi}yY^KV7RT-&8v0#?wtaA!l%=umCvN z7jx8fg`r{D7+@r^L>gvC>gFLNoCqF0+Mtk%9qS56w%CU1p2c+? zVc}X`2XOS6+a{$*OW@N9x4$?#u7135V1Pd0!vYRmg?$UiK)HETXtw)+n*e18idy|} zrMVvE#&n*jdkYu6v%&mdJEfl=QRt7N?r`Gk`wTdh9-2VsLVaTF?gzm6()vGMPyF(4 z@iV~#l-7?H&+ZnT=7z2GH*=GnFTukw+^}7Q_ciG<@LI5r8k>(DZ2jiJ zA~nqAm~~M7(jX`x{1zVs{-?+!G(!VdR4*U{#bz*K?1o?%47pk^k(urlNrKHC;7IKu zmWh6BWFa82%EyGfHP8+HMB0s`mll&$PlZPn+@6ts=@iK#z6N;Mwo^VkOjL}p%>H1p zK=E4-g1w$H@Z%)k1Om)e+#Kv4EbUV8l6< zK494hyhM4|bL=5Ae;Vsc3ur11@x7NOU@ZoH=rTO7||sN;o1#HS9nSOSn_>f8Ev z?$tQ3JnxS}$fFESy8^zaIfT+rIYRiBn07s5VtuSs6ST+&>p!7!@tZoC*L>fUF z=O_yRVEtp6YE^ z2yIgU#Cw*^@lpBb7vei0{%NhN0YqqX=4>lksq0rfek9RrDaFzt3q7BUw`yf`gX6Y~ zbh*`nfU#PTBX{*#XS3%N&1A7$`L6p0B20AoN6T=DFgYdYX!-huG-{ycaKM6aI~w z%Da z#Ui`{HbUya=Zo-D%t0VpS~OPdb+PFJL{M!cvEi{t?CgdtGO;lS= z)n+?es$vU%<`rN#qdBf1SpyZ{|O*ngO@UZy{Wh_jun5A3;fplAa-Y>1=CI$VIzB4?`? z6BfPZ^j|N)z2qJU8hru$xXn!<*9<=QKbkJ;5(0sj;Gv)-87|I~8Sq@Jgg=p@h_;FC z_ebN^s7cxqQvc^b$(w#Nn1;W3`)Ho6ZlBW3Yfkk|+ zS9q71eB3BjXw3Mz4hRP44QGy-gHyPBY|VQKi>@ZcOPS{Tja|pQQ95&3$-9m3_ErGo zlTELTzgwy}7Af6VjrmdEL$i604o-hJQ>{>8V&_Y?ps$S=WqI;CV5A;&)l4GU^agvg z!MXM^EQggfEE8nUcW1m+lRE&enRnI9*ei9?ZwE#)K}+-_wtgP@QP57d8^Bg+!U;s;iZ;2hsoCRN2AjOB&RGf#Ml3vB(B)pKGhJ$ckMGt@MLBpn`jsi(Tr4ZZyuOgawt1vw{~@)1Q)U_Wq$m#1a%Z!NIw^}t_vCD{z=b?*GR`y$Jkx6%iY;iLae1SyQ=(M zjNq+yI=iJ(7*=QrRAsbtID{s)qLJT-$TIm^__cF#v~G#Ezjn2Di~Hg9#hnab=;8~S zX^)3C?)1O90}tKiR+IUWO+UPt;>RmQyR5hIaltf3q z2>-c-SMn4_;Glf>ZY;9_;sCo9)mj`8v4n^lq^4&lj_ zh?K}_@O*g?vFFF%zTiE4k!Noy<-b-c_M8)o-5G^2;aD*+qc{36Wf#4Im?GNieVcqi zCCG3&fLEbODHuD|`JS~iCOBB4vryJ=N|8IVMvOBvSd_Yt@nT#Y)q3g!NkNSm8v-k7 z%mlP?&|B;-b8bWj86`)^1=*(9uk};-az#u+5~|ZQtKUewpsb^cf{+H~eP?Ir%IHd1 zEYZJTpqeR>V*w1zoCsh?_l!roPVi`Q3B}K^5!!vmUSG!tQ2+% zfwS2jmA7YWhV=fHjU_oNI>m?Ia5=2vG_Qk(88Nc`%`$`iLdTm@!U{QqM+70q7^+Q# zpN?y0di!|K1E)NL_^EzFG#1I+VT4J=tu^Ef2z0Pv2|OTcDJkunaVk`@|8yEJ#?jXQ z0P0w@AV?wAL={qC_zVpt9~q1f$Myu>uLkiE>8pxUr7A6iw&4f67*V~0ogz#`dgNhV zo;jdJvx7n_VTbQMFQ~{9?y2)cpJ_|AZ9ce!LA%)d)c{HHRtI6gzWWy#--elM)v(@e zP$D;Qq2ZJh+2xJDhe>rc1Z>bYysJRzU95`Gh}4L>QNrB}WyY6BVQM~R!>X34wBiME zw$@UlfHc3tBc^QukU;W;@;mf!{7{&!@XfRuTfp;u^mXJ{gt&WGVLhlo_Ta%6aZ*h< zy|`1zWrAe5fPEYTFHuIT($SypJ>I;+$t+Lnd3~v%myNT+UI}To2N*;40Dn3jItWmd zD4MK=wPK5Ri~vwU7XL9b-bF{eBii0px!g>mRpS^vs4SS=&Vb|DR6<1IiHYZf;}LSW zr6GZw`}V>7k`D`psQGW(z5-Q+a=I$-rQUb(*zXt@WSAz5D)aj~(%Wb-2)yIV=IXFa za0n2Zl!BLV$aonl2p=pMXnTULj3sNBb9)SXet>8Z5NAL3Pj!ZRxiEGWBkgZ*`1FJZ zV>BXZTYm7-g-F*)0lPZ6itx}yM5R0M{KXPe-wh8y@TFTxLFKW3?CHUwk3K@CSMO8`Y#06)r3XS%BU|Nc95>s4;u_s;o#_k157?`W7B zIGMYktHh;^N9axttY7AGN#_$~!;avMMT*mJttK_%6np*eq2zLwFos|E-1f(h+;F&3 zhfdvXB11^qmagn(plj2?t)$)zxn;4iCV2RiRe?Qv<4gVV`#(<=k9D=kRGWs9vyKPn zcCXdrjNlBEca$*G5^+Uj_33Q%rKrN-u9Mn+mZiC!4)-ncwXWXw875TY4=E4eO4s_x zcV*Mohq{&zovpl>w?N8?$9n5H);Kur^c(LB^j6j^^j_s1%ipBl=&~r=iwkum)E}!) zzrDg(e!!wI=S_Jw{qJkv~rnuP=?VH0uU6SOZPNknj z6fDNJ zxTf>gj$w5kknJHIWV$m|7UvcAp9Lr>GAEMJ;?y-51a79-gY*i-doGH(_-|Le;U6Zg z|5tYW8SB$uPx@B0{m<@Uwgk+3np(G9FmK$yFH=waYg!Z$5zob7jqYzryi16AzIzX} z#``NkcO$gZ-95We!#S3mbeYb(0Ho-#O1pa1Y6+aEtg(1nN_HCA%`MYB?71sY;ON9h zh5Cqj>r~El=epBN)wQ(^Y|jR7{q4Hp>CRl}#V#iA_#B>@`bl2l1*A@l_6JuKK?8O^ zL}NiN6`_&mpoRiPH>OnLeeXsLk^674M(nd<%WdQ5f+gE&nNcYEGf4I6;oVc)AAQ>V z@SqRojBSXDIF|_7Ee3;#Hd_KtYJha|i{N##p`A_KL}wqFjRTB&Cp(063vG45 z?$~?;-Yg)!d~MvyGN zHyoLr!7Lx;35f-VTRuBOSc@Jq0Om_ZiX!#|SPjGd9j92w{UX~pd{LKx+!3GBE6;05 zTzJ%7MH#KiAok3fMM#0L(K_V)FXav8??W)M`c^lD3kXgq6%-#xvL2~fGa_PV-i2<$ zpbs6#P({Tb&#Y+vDdefn_4|<2WE|ex_@dd#J}7Ziaa7 z5{^oE3ChgZX8cZVt=gZDemVn(w*z*pjz$Gh{=BUUrE2W!UCi1!C+YWU@UFjLqUwhw z9DNnj+YVCd(vS3e(+@QwrAwbK?^QAn?Eeu+jlmtdolrBbl;{$5rcG#?LZBkP zMA^;~o7}By!LdaM!n4|)9T8yr;Za?wN|Clh(g(A+;q-mu@Q9Vlib!2pn7)2&|%b z_hu_Kp>`)*db(C$$6ZEHqU^j(Yxv+u0^N!3>Wu?C*XtVUK>|MS!@DkrCKnE&KK^7g z*=ofK&Cy$f^E{O|9HxcMfR;pFEN~UH_QhS98^ws8M{5Nv&15|mv!?=TN~3$I?{5a- zw6KSzUzcL=Ll1_NASP-Q==#ejmXXjC?^(w^%ew0+vWc5Cg6t!jwov^GFwkm1JYmL9 z=Qa?0&@Z2oa&0e+IdF4GSz7D!bL(0^XF0N`@{8*RSZP|r(Y8HRu1OnqS%h>u2+YW$ z%SO!fh*DniS;iQO8+1-hEh~K#rJ#83E>JOFG&dD|to52HNO0Eyi$jI*dQ9B#^00Qg z>Yr}K?bJ6v$dsyVU-VSm57g{MKmu41no`U@o}XogK8ufjvb8s4d5Q|KvYGcK`~#d( zqAG(FM+wXo^+Yo9A`)&@Q(K?&J^7Y!xdm{Xbm6{cgjc(s)_K2BD_FzdSTQ81Epm}& z@sj)I8m#5y^2x0yb6vS^+*s1K#Z9XG<|pVaH021}AxRcDpBBAo_)BFsOG!bCVa7Zz z@7Zcq9>EcmytP?O370E!I3(BcwASYpen#fAX~>X_znIixC}N^5lhd%8LX>c|M~gxy zpC`#!&C;bLNV?`4ph^$HH(hzdf??n9f9SQ%%Q&n0F2(iRXhOj#orB4I9I3M=| zvyAhQpW@+iVq#|FyB3T(pF^As!u79wh+;mIWd|L(m}70Jj1^lB@))8K`xEP^sC-;iMD~fr2QilgExmG9&e0gy?4F literal 0 HcmV?d00001 diff --git a/education/windows/images/setup-app-2-directions.png b/education/windows/images/setup-app-2-directions.png new file mode 100644 index 0000000000000000000000000000000000000000..f245aafb2b3c3e0b0bf166978088c65443d8225d GIT binary patch literal 18590 zcmcG$WmuF^_cw}^q;$s+(y64RG)k*CwRg0z$%-3;9&4Kj3hch}kT{NHoE zb>8coFXscd&K+~t-fOL2tcg@rmczy%$3Q?pzuv&LDG<*Qrm;gVmT?!(SmQ_Ln$ zh=`Dp33JfKY^>f~h%ffpdwO{hNIpM0NLjq>_%=W7=V57S8E`tlQ^}(p{1oR|MWIG5 z4cY*~{W-FY0|sr#l&u*y)rFU8?J-OP$~qj>j@Zw|>==OA^y#TYCJ`~TtJtzG_?j&Q z*W~mopX-)o;Kb}-*@2}TmFhLEHZNTf`yr9TQg(M1?uR* zp}3Mc6w?onG-d0B=3-S*X)$`v~1Z)1`s% z<($iYg04Nf6u7x@wY3h;?9e8&KKzE2&un`+@yZn!`?Ee0N-~EFO~t>KV$VgEbpmc@ z7w@Xwr;MK(s^+Z32p^QSx1UreKir)TU$kR#L2nJ?5guRA9XR51 z6_u6yAq2{0{B|?nNg=c$`OFol0YZX5QzrghEV}6yX6W98^N8Oa1?zh*hw{5_jd16n zv5$J4Zg?5%Lme~Ew?;b*0`A>r?P}+XK28)okajv17T2827CAJX!}tRpd<)gG!=kB0 zXUGNYZD;Kpip7b$zmS=3rg@}eQ}DB6v6#S$wE2zOk!@f_N#IM|VRbH+KIapfb{Bio zuv`U_{=UBB9zU>R;bg(7hpJd27*))6r8Dy3l0&!VY!V{o3l%-?B!HC~inl;6<~#JNPHW&NxocHOz) zxr+U`z|bM=IV^e^qDwR!EwErEu;}XotwybKK3VH?UyG9qqosHn(4(zwZsWK&k{N8* za)04|cic1UvFNwiA$EWEKI3)7M&+>BZYVje|LLGW(+|qPP$8F%ftB+*m(7{`%f-XV z4F4Nz;q~wD8$ZeJHJ%O`*w$&74aPvk7aCZpefC~Z@LGMvNqJ!!CVDm^IWSBd7p=>splkf z1O{V>&u6Rg-%3kG7A*_Sez!DSTwGJud1*m+cUiZuc8e+zE$yBr8hBeTVGu#OtEoMg z0$YiY+y3OG?{v^T6I}ZA%m4mH!rtC~33)LbKE2v{AOU-m1h2Mp;t?;)+Bs-Df48E$ zaDV)l?`UJEXD6gL>-y^je8?F>1nl)x3pI+3CJNO3eM|{pEU;po97GZX)#Q2CaV7W5 zd5>FGG|rGW@r+)YavfpVcGoBC4^T75fY!f1*qRu2OB{-Is!xoy%9YLTg`|mhGsCHO z3MsWJ^w@;tLfF_p>r?M_U`wjA6mT9>%yH`#zWqU$h%?Jj$E7EE`!0TW{0gn4to#WQ z>eV@#Cbwt*%@>}bvYBcdpIt+=a_iSp@6;A9io_AAAR|0N@_JtDKQ6jR40DQ_9I*cW z{znTHvO<3T4oYG5UHGUKX&;R4^XRzRMgIl|Tj{dWh65qpDl4@sg-QYykk3ha({_6l!t>7?2}6g_cD(1RKyp4RMWqH{wPJ#5L=a zDwFT)hQuFzAz==;zk;7tfTugxlVn5fd(>v&$`T@|g6yRHMS#*{&gr3%@I&WQT90ZJ zpX>F+LG4}lUfOWN+o90j58Odk!fy?@wI1#d1H$Fhl}B>((!KwZ^L;b}*P=jLe|#Jr zb6S})>pwqJTsw+~`iyc51-~EqK2KR}Z`PrudV4(2$0jjMh#c!!?XYe$y-QNI@3Q6b zez<1J1hY`P^7keBxahOOpQnyuzOcx~$A{Ym6XizY&F*h`%U@k+9`>?BOw(lLmufp* zN}DcDCPSFhd1J;}BV(yrgrXDict2I7+4gljh4?P5f^$*@WL&jbYti`s@tu>5h{i#k zMj_ENYB+56A+11NI7h)G4$)0P71CG5>=}ug8Kw5WGJf!3gkxt2P}Ul8pnNi;ly=l@wY8m;0_D~jHR;7WeS z`>zckA5v4Y_uAXvy4qRl=6H$kIbkMDyNC}~MMj<4-c_ zh`G1D^Xcwd&I|S8ciYC8o$tzg-y!6_<33pIUadqBj>2|o*WPYkW2D~9p`YfUq zBekGL|6Z>!!Q_h(t+a*e^C|UIBab(RZPbEpC29PgMT1U3cItRJMST90sP@k7ZWfcp z`xy-mrqRx<7Wjb@;~TS1kVm7aG*!*gG}H3}&FURx%EYzJ*%hK|i>O51Lwns>KOcL` z=#LtTlon9QosR8O+e`vmjPM=x3O|92yY^NMV#1jfbre{xn%(Y#EoR~N_#3piH#yZt zrS5dDyZJ2c{YS?Z6NRB^xKb5!-tEjj5$>lq)qB_Chi119+Prf+-83yDUCXm9?x#zT zV(al6SnYcX;oo+qHrj<&s)ZBwkNI^9`=OCM`<{p7&uUR%Q$(m~X)-NtX_STg7|~XbjYNgED_QIOCKo1!n%M zN~)HJohjF=!aCmaFezPuiqW0}W4AdcDnp9$7gFi4}}IgG(Zy}G}aTYR|gr-NOiz$%oL`i*6iSf}~jMqf4@hFdQW zow%GZnHE`B-nc(f+jRFEKt@1jNkurm`8k0_vf2Ay#?3F z{NvyLN@c9Vi6Y}X`&o7@?T)Y7QF}G>Gt+19y{EznET-45rsJU{E)=)E8;G~o#@Ckb zGs^uZl%1 zc7|vld@u89b~wlJNpr_%+5PR z6W*7mY-pTD$DY;TNp?cce#x(mMKGY*eLAYgW`besPdrq2)N7gQ5$w4jPUkBt-JX>V z!2(te-TO7;Q-joXZ^csOi{Ji~xGvygnw~iHHBD@}wfnn%^B7ZAx>Md46il zJ6Kwp&#vCuI#^aOj#Xq_O}T$m?MHpcji=$Zh`9Q>^K_9y?Ata!q z+51=WP^D)o<^9IYm{r!SZtZ{iTrG(Q=+5myQ`&w%4dx2i_UC*Zc%~%;N7PzQSLzULm+C zF?%$Fcavo{ zqs!|1`%0pBr(at3#illuICzd!dAY|D?B(GcCci6M9%QL3Hon)hIeEG=BA6#+?|m!k z;6_>zmgL1Y-<%cn=X1m350-(gK7|C``5pE1iELc5AfNckv68}GmLa+-WW$o>47VWH zwvpqDfvd&61&DvO0OO$EYNaw`ORErX{_gGbL=s4NE?eD4#_=#4<-|KG}FGtWv3ovft(MrPF9Vc4GD>SEXgZ&EO^BpN(&M za+PcL0fEs@Jxjr*d9juuy=ZXENXcF@)_(DpJ`ru?>5aI!vZ3zxa=K&m%IM%%KeQT5 z3pDyFGUZ&WMN<-*4xL$*ot#LIIzISpZt3rr!J<1x&Ru$24{ev$rumCD?P1y1kf@HY zNtm|(<`~?~Qo3v0(kh}JX*6$tmI)5W*w1$Atd-1jsG;GhjMbD3^sp-JOzJdPqR}aN zw0!GKF7ap6ob3{>z3DK)#&KO-*qIovHh{!dzlll=&&)j?K4hGIZF!zPnRyN&wpl{@ zc~de%E@B#Z_^40ZoY64V&1JChk*t~lCTWIi%{JwW`mon53?;2+zA>QBj3v(GY^$hQ zFSNacMei+$_CJ`LSo042vEVvvspK%IX|Hd5_#t{a?y#KxkMgDC_j4+dAtC$eR_gsx zF|2#jfBEma0=}hhVw4Cl4VNEdCWQIC!<)Jt-9qBvQS^>E!2Q8?T`w!JJZQSi6q~ro+J+8Swx$}#Ds}XK=otd)~^tP}$ z1{l=XuHpBoMvX%yM=CR{EN&>-&+@OHkN4RJhwF?(_FXytZ(2;>HZeHJUs`e*?qhya z9`d#~VC!)%w3wYED%_jQ?YBD<5hKJXlFAmU@u>8+7nNya42j?{C`%MgdIq* zF5L1sfvS{oc>9toyY!@BLZet&2_*Zl(i_8h>%!<2RF-JrmW-7yud4wR3*VS#lWOhx zWLTMf$)oB9IZ1f*GAawUSmUybi+3b@Ki5%4{y0I7eKjjAL?X{II7F%igZ5<M%@4EIiFCRK4^g%mDQJhuA%iBf~Xnu5x0PsI+V^_+eQLky)$oCB`8!%L|P zg?G~>GC+->5ND+65;Xtf9z_=*Se~<5Tu|&GjnyPZ;7UeR_x;|KAx7f3<|KtP89yAW znzOKJLvXjFkip(2LB9V(W%yt9p)VI6e7j0qXtAsuZHT;2qme>sC@$T79L|4^_^;zo z1MoqKNrU-6tRmQZ-6Sn7TlsNf=R+zCH3r8Co#JgZdgQgpPC$% z`LM{TBJ_t>PHt$^e$DI*Kq8d(#r^0^sYYo+ZWy(lzn98;s4I(#imDR;F*4i?7Do}) z5gSC;Wn>c+;IekXlQfL*xbHXBz}Rb4v#@#+mdvj_kYR&1Ij zSW;tAVb~Nm?Hna=TyQb2A|9%nBo}AYkjRpjZ_re)UaWI+7ox@7L*=0dW#C7NSa>G9 zXGAX-Q^nPCHzxLY=dueB{{6N}Km}Lx6`e>yL`J~FwEL``fX_kQCV*0$m3Z{BQ<{c; z>zK<49J=<-Lgx|$v+#>PVqJk*zsq?$z)4g+ zrS@!{bbq)W4hWMYDnD$#)dAE`6Ewqn=T8kd%KORY6ooysEt$`Tm^x{CZGCfioh@= zm;vg0eZpO3Cis~8%B8)S?|HcCo55th{!*9dQu#p|Gyx>d~7lL?&cn+k#8h1zx?}{S1yw#fV3%hw9zkVzS(Kj z_FC4!O$9@=t?emfFQ9VLzy}2mbyX`Z2A2S5hY_pQ0Z1T-Alr*6ugx?h%`TjJ_kD7x zBK3jNpdp~igNkcrSgjVD{f?HyAz^aG z{QzDLr4SbB)xE^hmg-O72rewC|6AICMFl4fBoaCG??m1Ard~{W?-mCG)O;A|V|@Q& zq|#C)gRzg&?`+g2G#)jzR3$?!u+sb9{f!79oZ1$A4yo*mmoH`=a4r@D0$L8FS@Qu~ zxYXI^P#SyK@+c+! zI8+WL(C6Ck>MO0(T@3;CqcD?&zi>NxpV0Eq+h=-%G*mZ>icRa z=cU_z^<gPS=+qjrV{)4fhFdCHnj@m*IDz zeU#X8*JW4=ST`|4EOK6Ekpi@IJTJ?J{TfVgiEHDN6VDJeQ_xe(ajAcJb-pWmJdO=O zeoE!43MINy)NAr~iIXCVI$GPNMTxtux=NAEdaa+x-J%ume393K)x5W#h!pU*9KoZxX@Lx`f zA6jk8yNC@&z-_L_rige|h;zP*WpJ4?4o8{P_t1x`yFNDRs)(L{kBzUqio*Omnk^SD zR}5LGhDSsS&Q3f}$g9}OnS1_gQC7!rY>JIj+U@tJW5+IKdyNT#)StK}P|H{RGaG|MO*+vsEZ@!J zY)TEhMRJmK#Y;!S`ndY8)+uzHq}Gv5qY~o#+5iX+D(zqC zJT-C@te<1@I|;6S;Q`THRk#V{kM`mdDWT@;jTC>Xw(cwWs`@7{e*eZNYW+uhOn+*?I9{mq1J4!F)+7`DA z7+sP$v9yEPLKi!w+ZVrvc>l;Q}HdE1Oc zWfnp2Os+m3OO4&{f;@e`O(LNqtWfX|brntLH0{$*0ty$HPhI`oE86o-CoTuT#*xdU zA%yF$cW56q2l7qaS6PoU=BkL}tt4KN$V=T#mXu*hea<&*X+9Limzeoxc-VBgu+sQ; zwWP4?x)JaC$E&c-4EcCQCEt3%7hq2s!xLYA^~=-+FBK6kq%!N9fUDw zH!r0#1P?3NLfVVzwqC$~Nd%if8rkyq0ULj@+xH#Tz)qkwzNPh@xIFY}8Wz`wvkIB^ z=&7&PS)l`xla*_V-{ilmeS33GM?VwEWrb{<>$d)Jwx$?l{=XiHNS4?)24unq(CkG< z`h+u|k~fsuJ|Ptmj4cvd{fOHQAbnhycq5@=9Z4#!n$WpUOL^+^@nNx0AXBU)CFDX`Sjh;VWCXDG#|)`zIc=@Fc=Su2n) zI`?zfxarfUM>=vQd|1w1Z~OMTDxO8*hH>@dpjhlU&HZ1t(kW2L_)zfBVTl zC-)oE}jq>b4pqBn=GG z4OPM{)n?8gnMD+e`X7|hwz;TMKe1cS(O&9zSr(jvDR_O8zrP_xn=ujug%rr;_BM_lL5GPKt@V#%h} zxFgKVi4}WJ2+Fr5*5%y#?1MoG$yU! zKi`?C=k*Izo1jyiBIL*G<1d}+S~I+Lyg^|}~d_K8+?llOTAs21qVb>jH9 zkuT*J=!O$IL9$pnbu^)UyPx1QJ<`5e*759gQX$MT$fr_dn~LNv&6w%?{7`|X{Lykp zxR2q4@L}U>B0TAn)lbVDLeb~oTl6I2=}mg~@RU$YP9+(Z3UxdKw={#b4lRlwcxg52k>WV8dc zqQWT7`d&tr^u5&}-6!G#h(zk~bz-5?ptNZ^qz>4UcuHla3qq~VgzgyQ51O2y)xXZR z4etAUV62}_7)X;|qCdRt{2H6)eX+M~_#xzY$~5-;c3L){#S;oyviZwa0&SmUe@j>4 zc-U|#cF4Fy7PpYYqv5|+5y`&U`>n&!x0}pz>J3wx8N~M}P$e5Aq8?pe+9wrdt?($b(R_CMVOZHJz+a}>kD?LQIIq2JBs<(AJZnQ)fEH$<0a?z%W+mLY0m zJZrC*41;esug2uX4Bu?3VC5mK*8R}BSVVdB&i`F@#W=!B z4=;C+TQ6zdU`2;8bsfl_Sww~pd$WQT>sEte>Kll6*hmn>E&go?XUN%`JcWe*xn>V6 zebQ}X0*L^-`qm#Pnl#ADMjgfHQmLK>XI3lZ!j-Uu1!5-&Ip$cwl;{*S3ZgP z-4xaO5N~E_KKp73eb)40t2iD_^xeg@WyVqzS2LQ_=U>9BK+fK7XdP7uFY!5(Q8^H8 zcXH*+e&lU(Phi(xx%C?l_w&O|{H>I7bGw%0Xzwj67>6Fq9CQ#AGETu9l%l9604vUdF^yOa9Hdp?Cw z!~uuI5T5!w(UXBIMt+?(IQeCr|Ow?gG+3hn4M zua?=zCkrSj*kubg{+X}}PwKfum(GvI%Y0y$8A|_bBmC!kPJv_s(MwUz*uPkI2)rY| zcS;gDmsWnM;>iq09h*vbts>9rDI%hNYmM!Ctubj8%T}m`w#ayUvd$SH(iy(;sPe0-#4JDlO5pY zN@PQ<4b+a}@L}}PvA#yGOMy>s9&XO0<-_}MrPt|qD>J2n*XuZn6nw7B9+|(4$PVM) z&^e%0Igg*HTuL;5Cp1U0xlD0rK91KH=7!u@wZJC%fe_!8HY5T)X|_WT zjrJuLdJV2*XGj)HJAYBMA{uR{MXUDII~%YEl1%pb9~;9uV@j-UB9>uKAa|A15?+^$ ztCnu}4`{V+^M1wj^N*LiFimNTh6$YI<4WGCH5zFyl{K%2#SLC%eaU<|9tyAN4glP6 zEJTwfHtQWzq#jd4i=)md{>zPkn}M1)t{E_%r($^cH5sUBYB^~}s~E<6h8qHAjjNFa zOx`vrEZ=C7Q(h#kIkLM9b;;YK1@PJtEkm`Zdc4R|)7$P9kTlVbjTO;jWT15h$j6<3 zE#5Mfba^S{bUJpMSftJY#T(^zzcvHX^V6v??dtjn1Q%LC zP~rv8do0e!@(p+nz`Z1ocC2B~sCHJ{1e<~Ih%V&5x3#*}IU74aTkmEQpxljo04q*` z+$K5wNGl7qWH$MiujVhlx$+>0v#OXFM!+oYB2a0|lW+{g{hb~S3ttP1SmjQ12S=E; zCCdJ6?WJ|M*4!7a0q8uQ9F^NYp-QI~IR3lW3nU0bZUg!G?rLn5bnMHU0j-gNgr?OP z;hX7JuKF#y791$QG2DJ~XSOO}pG9B=PYL%AK8lg8bdD8jmi}^BY!+k3Ct_qdG z0Lsv3lj6WYa{q!GxKOy(9s$SV8yM6IQkajy)X%D4&r{v@hgF`m=Ah3Z^#f&nxr0TK z4)+79_v3b6#@&m##k>sv9i|t*UI&6={+H*-BU(tj3tk2qYOdu=gcWqfpx4H)g-+Nl z27WGQsC*!GTqM+rCg(e`?sv*n!V2U*^}*0y*(o|Py1P1-_-{a-RfP2@_>`dbbXa^b z4`q@uEvb<?$c!F`# z@%10g6q*v<09|{vTnr^y7~wI9UOva4r3*a{7rIO`dfg`VH!Y)CBIV2CEfoR*ZP7C< zh7^p7eM0QSii$T<+$!?Xk{{gLi@-R%Cp(H7WtD6MhnC|6U97Cjr;bAjxOR4~%0qqodlk3&R78 zCrd^Ay8x#Fe@%N54kup8YSFP{p_yO|1KwRriIKLY1!33*vUlteg(Z>q;x61fW7%xs zl+Xmx;Y%)jNtBvVo>)6=kpjxKFMB<6-&>#Or3rh0n*45^E8w`)NR-!uS-*?o-594&c+EMN`dSt-9esd?tnT-2sx-W?a0q%$q7xn>f z+mE)xF_#cA)dv_)E_=9z1)~FepA&Ya$;wGnE?d0QrJ>sW_h)rdAy~UYAvyKa?V3pB zZDhd990%=_K-?s0AQnUXXdffc5~aOXrH9c&@ORGui^E|6s&h_p1#fFd$e)rZE0cL7 z6hz5n4CGiB>B@pbP&_{LE5=wddaa-gm<(Z^Yt2}uxh3EP%Qq%9v%ffCA5e~wm*b1w zaXgV#B`u;Sg?@(5wK9W#Is zTkb^x0vig46Po@jy3%()O=FIYUk9FmLy2)#GSKwN1ir(W;g6Fgc5pHoC`lkBUiS1@>KR0AZg{2%5U)DJ>7w`kzAf;nPf`zjEAxX0aR-ZI=f78`ls;b%=6$erP}k@TSb zjq{AFRsKH-FlS}geEU#Av8QV zcs{$k3a1M%rKFf)V$naYdRamuJ*0uP>K#9K0wJd~W4uglGpI<4PcMr3WVFa7JIuhV zZK|FF9!a3>tC79gm6a<;Ww)c1UY8Bx2*G_J5tOzuQYOoV$5)0<`+Um!S#&5b-QNI? zkgrC0ug>O{-k*GHHX)S!K>c5$$Ny$X{NXAX7&n70QwAne-DEBMh2X(f%|^OUbXj@34X zI-q_x`F#Rxp5ZpO*~C@*0Yce8L8ZOx}O12^zHW=%ep$mY5>=RU3G;ZEoxDg010=e&8>6wbNzfMc`x!&Np!GxcnfnvS^&%5RMc3Aif{sQDtQ zO!+27T3)If!lY07Kq4Oy*5tRHn|Q}v-5I4uxSSm;cH(skPj`_w3~CoBN%hTH((5LLnH*`Y^RW8(DEc8aXWqi zjl};R=t!plZRSI*O`d^1%lGVyc#0MMYo!DH)Jop{SStrzC%ci2AejUbq&pT`Icqbf zgaUw0{~xO-M8wl^DWtn}IEkl6g&Ol97ai1Kf`O-%u?=PyPEQ$Q*6;ebz4ig)yD>Q* zMOg(nr(ypCL)l}$SsPF~q6}kK@R!;B zAF)2&J^=<%z;NtLCQXZqi;HhfS6VK0_NpXf!KcMi$WW;vob(4d*`sC1Wtj}2g?1hQ zHYNx6to4pJ<6BqKKeeXNjiE%y%3toUe>UBNBKQ2dm&n4u=9amn89XQ3V4edUXyUH5=SddM9)#TQ6I=NstIf`K1l*<0{fv1B?)*FLztn zu{UQ7u~5m5;m+YxS3Zf1XO0_5mc-&Dny*oZwvKk`nmd1w;`Q$aKBYc_(T#t6QNz2+ zvdYzEVqxTW!J|(^Kz+6|QRulK$xe!T>#<@6!g+eeeh9kbwcm*%XX_;Jgv}f2%Ml=O z8^7k|7l4VGO3F?4pah=F?za+Qz(6(bK((wKsmE?>+Q-oG>mG=FsfHe*!L`njDL%3b zE2dbsA1U=RY@T;iN4k7qGd_80k@KXxF{bEMkte&zN4nGuGSgJmD?hxx62h@yA3Dx2 zp;SuAuXT8o1vtO=o+wcUi`0d6UQNWAM~A*`K;S{s2UNA#7fa%Kq*Z$YoFdm5f-Lke z({e&GVr~|Y73~v6FIl~eMJM*J2O^JVSw5ea1mOCEN7RvGEihb)qfo$vAMDu84|v|n z`DgeB;8nG7vmjl6pLu5LixmId^d2dJYrD@ct~SYvE?IgyvRZ}dgulgn!0{k_<|~ij z-3!IR?wnplWr@@*>!o}r>G1|Nn(tfm)WalqocRvJ8nwJbl!^o90dlQ4muk z4+M21i)F_5-$u!n(pg_{iEy#2yT9b+V$A9|6okY>o_9DkD&iF}-IQhfp`lMoM|cMQ ziCJlp86jXokR{EEM5ViYO9$1@+HRo3^*IQJK39JC=@)K-qH`)iK#!>0igfm`%Dp?q zy*UCD?1_76{NZ@C<(vTIczGIoC|-V;Q~^}R7s$-bU(I|8E#jD{@=KUHDx+3DH3Zt= z8$P_e#deZa#Pc~p42XQnbFhSOEbRRL>p~=UFJ9lajQ?j0iZSNoh$olCDCl0HA_PRR zyP6!=tWTX(au4+L+0f@C_=-Ozp2+BB*&tmGi=CjLJiU(cksFD`xeV?P-HlI-eD5m0 z_Sk#w1VZz5J5eomcW8t-aBeidj^t^ju`>Jc5&}cxLh*m+TdX+Qwa1~wamR>{?Hi`$ z-}s5LzrS5f)BKW)wt1(Qq(SUmQ>vC>qiQN9g!VyI8b6BV*b|m*_rR!Y(U~MD3!^Z) ze_4s$Q*wBT7ioeJ*%ArE;~_ps6Er=h$2DhotJ_*&+D-Y9H-bTf0R`jo8`flxN3;X^ zqgdt4QZ4l>XS3tu$jz9QDEXCJ#%QmD&J@YGyVnls%y-}4DkG%ds%Cn0z9L@XX7c3|sSu#U1 zy6W=*m7y3a8VXey#y%!t<7m_K1*GLQhm#2))vef|{cB`KlNNcS+a{a3{Z4k`9;WMX zp78RNWo4%IJdkv}EF!c`LGnDlyACM!gqR3iN0u3W8$3KFPk57GB+~S}7hRw0TXHvk z)|am{cuhdDiHpMis-Pq_7*%3JcdhYLmsB)O&}w#=q(Q=(EbA{d!rG@Rj&Nswq%)52 z9(Mpcm)+Uznu{FG0dLT;&&uDZB<7G&zCS25_BpiMMB3evN4K4vL3;7K1nFABuU|tQ zO5Oy@7bEOa?UEVG($L9EZA3~>S)X;Pw;hL!&IVQeW*z2>U^BrI5kPHe=a5ciG0WdL zwe?cgg6U=Wv`>Uw;q}NvzpYZX@tSGf5uT~tNGGt&=0Gl$q?pIcX+0x6T(R^;lcM5z z71@6=`{H?Hp#TFGxu|f71Su!)Mul1ZD`_IO6yMLYp{P9%_qVqqpNv*xXrrMXbGC|4 zdi=%(V^EX=Bd?H-Y0|QNHp%}5S$)kVmgWfEo^p(e^nABIz;iSA-LSZX&*1~`8md6< zyMrS1u&>n4KK6fRU}!O@{;Uy!p?ANe65g9B8g>@(c{LY#-9VHz3x?9K~PgC zI!?-9@gFWHlJALRp;w}u2t$L5()ksu=}(4a+PV$d4g7oft^c~=$rp)^5s$8m;b-b7 zDTNtuwBEaL7U_(M*FUqCZhKpdsMh+f=S12FSC4(H*L%}IOHQ?JINvdQ6UAxGLoF7E zcue@D&O{wwE{4`Fn`|Dha_hlUS!9>FDS~2>?$9Vs&M9VTp$@g@YmHWwErHxnj}Rv| zMpkd~ZzDzyD^nT{!7#spj6SbVEuD!$LCIL5=uWiMT0{S^-f)d2y7{Yc1X~W(MNXP0 z>T9H4`pO(h-V?g;cwO>ON2So_%~OS%mZ7jNZrB zGWtJ(^E-!Y+EwDFN8H{mi(^*@7=w~*$zLmrEFMXD(y|*M*QR3-kxpYyWG!)6%`fjs=`ZYo)kEk;uB8i1iB`T4k;NkM|zB&AxS@ONo81@>;vm zvpjaVNV{^3)qw8wt5KBJYn7NzYAV;RY@G8A)I#sB&qU3W=%E-+gjrc&^VHXr6dTZ_ za+(!wgPb`x$F5zGbG1sbk_hDS13Z&eaG~Xypy5gbxJy>J2=Mv`uYZ_)uu}bGWIS1- zFFZ#t-9-a-$x==e>avd;v@>5#U}0uH3Y7(-(mkED3?0~rSYD!ATSD@tNQeB6|0&w} zSgwMfuNFQgJ}oN-dQAis5Gq;i=dwo~T+Rlxs;uH3DYPf~KK?tJmHhA=-xg1pF5rbp zU&SAvFVdn?W%+et#4Wffh~Pj5UNQR;YWhA=DKq^jrBLupzUBAGcmCdak(Ews;sQUl zxyu=;+AwbUt2l70L0a@P5u3la{%bS*&Me+v{AY6=*sN9g$NNjZWrY0G=TmeSwx6l# zcgX0*o`Ca+63v@}Q%l!_J0+8Fj>XfX&&5Oc)()X+fqI8UxV{eJc!}6a-cM4Cau9bO ztuS~T*F}l$_r{TvIOaY4U>zlbpA$9Otr^d%uJ;uTI<%I z;iV90PtlpSo)n{%qh6QD2!V6KeQ^IDmcMW;JB5y{FMH$Y?Uvg^n;**~xO^4=6{xe# zg8AQ$i)ZfZFI$rkjN5tDt3X%Vg$2=lpY!C0HdZIdNc*_vvN ze0}5EoWHXZ^`5w>f-8@`ddK#I^Yf{saOY}ffx@&OO$9V%6V??)e-jm?&G^Bnv%l+M z9_`_=F2g0Mlaywp|8HmHJ+f1WK-_Pj(jz`zSWaIBH%qr@iq z|B6)zD{1F%{0);G;!EZ@=VqW-k9@-qH{Do;iSHS(@YW^fZ(f2_nl<;~J9eX)j4_lk zL>|nuze+Oao+XSOIuYM{8R)>1NbJobLb>Qw9Z0` zlPJFddbGN1xAL|l+-0h;>1ObE#bc0#Pe*iV|6)f6o!i*o$(V3Re>}55qm@?tY6SX= z|JP-CQr}RPrQ$X5AfH~{$SSc3PmtEIzJ^tBfVOpqzkanu|JS}k+r3oZNOvF~>qHDH z()vwf4q{*gVe14rx=N{e{f}QelDGYz0ith9d1RV6i4!gNyd|U!``p@lgBDXaVh}5< zq2QOV!W$EgmjwTF>ih5W^&B6s>-i=ApV4cpLbo;Xe+tikn@!kTVIIu&2d!g*k5V9$ znZWS(f_w|depRd6P4pF)V#MM)(G}{%6qBDe2l$7E1|kb1!FR()p}@6^*Xp5Qn$gyt z)=*WYX&XX-M-Q_$;-p|?VIKHSxO>3Z`?ib+7rEi>4_1ED?l0WZop|8wZU8>I8l8ag zKfYSrxHp8v#5y1m0&}RhaYO_KzU{I^Q2ZmIP>rD9sFLJB}*Vj=Tczo`E5Lj;1qUdn~uc>`hld zTwgUg==8$X@h+m>i+a-Jt3b=` zE+$>vLNCL+zTW2oXpT5&ZovC;XgT1g{;&O7dt)%g5(r$+OmQ8cTo~!V_osajM@rLH zA}wu?E6qgENnVCqmv?vPyJ#NWLR9C7-6>R%X@)rJ2Q0i38$)TklQQ0P;5uo?=V&5n za#Df|)OmLO;(VUp1FJcr#Zc<@JWZ0BHdDo`0~Uh2$v+WyXS~uoQN3qUL21iJf3D$d zFfh>=N8siL8VeK}bSZek9CB>FTEX-Ic7S5IBRK+h*AnEz3qZ(e@6S|s z;Kn_ZFXKrC_)M$C|DIhyK!ARp)?_u9DR}J|g1ml07O8>8GA_fyu%~>by>~BcX6t@~_J7vpS9&T(NHG?=DWSzhrA| zr(dGi(8>{_ow7neTjY8_iIdi4-V94jCoHQ2?y#tfzy4edeXoKE{iCo3YJ4v9KDuulX)y- z=7I0D#%h!%6x}3by*|8fWDXQ zxA-4d3)~YA?`ypWo z3;}=O5LuB-ZzM$L?Z3M|wF5s=V9+_;^HeS}sM+(_q(ybr)R-|qO$-PP$XsX>Dnb+S zZ9p|NdjDIo9K7^}C;w>&0z2`O9{Hy#);bKMUd0|I~Psp@V_Pv>WRdXi|F*w}-XB z%{&8i3GF+z$b1o1N00rP2~7TWDl(MU2ANAthl&|u^SUdbjI0Em%U6vuVirC?=@+vF z)6QTZ0O-RNp_?~xVQrAJ_cp2PB1(Zb5$IyR3WHR&t z)m#}*^-Bg0Mlw?_(R4DZZvLr=p;~?5`Vl_;krpBC`?(DhVgLG zMyKIxnrzQZn@;n3f^K65 z86NculMoV5b{cXvxQ|}^*8tEqwC+qCIsL;0JG~ZD*+}|PAWe<>h<&T{C`jWUMpcf@<nY}^4{uvZ2;lj6_LAG-S& z8a!BfDCyYSL*8Y;5$&jcIomxGl6h@`yL+x}%Z<+04g9Jq6V7q%B5?Ts?fJ%p?o+N) z_)ofvJos~TfkVYfZ;^L990dxc(2{*9Hv?gVhpe8qL1e?>aqU$BbJ z9%66KRmo_n)~l= z4SA_JQ(p&#O3oJ_Cvt>wUdu~rme+SR$umCGGnM(zyn;U02v2P(k;2*!mkN2~91bKM zkc!;C~L783F^4>uHR+$g!xl^$YJI~C)}5WPdP4-_s`ALs*d?j zU%{u)627|Ag%W~OB`+%S$7B`xYrJxVRBG zcl2*^)`P_=Rkv4M3=Cm0vAPsHUEk5X6O9b*)vH&S?-XS}ym|%a0KDW-kbvL(0nI7^ zZ*cA(6r^8OjZ*9Z9}sM$RHa_Ms!2qDFhc}Bqq->Sxxada)%)^-OJ~C(fAvbk)ms-|$W>wZrQh>e>15T`TBbXa&^=XEXN!)G|LtdS&|b@=Y?{ z{`h-t?#qR&vF&Mow%Mq!GrzWD}~d$+-USV-_?&Lr^mo5=Yv--sNs5kaID1wNyS%WU&W zH+oN!Dk-mJv|fXgQKPPC;O!Ri`F?qIq#tU2z?Gi+)9p?!I%i|2|MTOunQdsxar@%K zk#i8A(6WyO$(wMTbcG`9mT;o0UsglI-!hFqCWyg=r<&Ytn7;oI-YZE}F2d(L6 z8oI@_%y=z2?y!E=f&%Z1k{u4krF_=I-0BjyC2h}`s4go3*V)T$ez{nbq7GUtm?Yet zme$re76~H#b&iYm<2NX@vU15h))!f(QvEvC$6rLV?*w84UAGUaI|O&Wc;}M}IT@0q zyi)d9>yA(ZXR_;=-(4R&8~dNi)t--v<$j$0*<^t;An3Tz7$DJLKRe2;qx&` z=k1YPn@?AVc0YBiVF~1tfvvTzEgpO3WP%R6-KDCz+kq=Twb{HM6D98cfbMpSw_}*{ zT~>NvEyu8mLtx*QF*^A;Zm!moQ2fh|=f~qU4b%)S6Q}maD+8v@rDjh)5fPC!A?fJP z>yOtfLR@VZDQw<@?~#t152{?M*KY?TpUj*Z*CJh<;cd5uv-w8Mq9}5Yb!(667judeB^FfjgeM~6sl*o;aEe46=D3;up_~qJbsSb$ViWB{o7~YQxWJH3 zsNZoL?A#(z+*%EED$7)uPw6$+6~i%mHgkwA`LNo|N)>ox28`ozBg7==aT;{98n*qH zt=c0U_2InW+2bA?bP_D`bhBYJm&IdY=#BI`U`Ed-`&}wy_Tiz!wGqK&k#XB6*!gEd zHmD72G4OK}gt>Pk-w(#4F8Np|rh}q!3IcX7^*or_KIy?0ilT5+?2;eKcN+SOu#ub} zZ0R*`MNB;4hKzpyt!4!|R=1)--g1yc;G>o)$G=WA7Z>13MFw`p6!qA}sdHYDfJjpu z)=jCcC6n(?m8o;vj8a_BFRPf!aW|g!lZTa8HUEvkq?Q0d)^{Wne2;$5LYsnsL#$3J zb7AKDpADYmA^=YvX2tZOgf|Q-0&a4%f;?U=A|K2$!FJ;KMo}t$QyO|q$c0pD8IsI4 zKR?~W8{i@^75M)`KR*PfiPYoWWmt}YJ(A9e(Od+vF-hz7vLDPnZ6iU96N1eK#h2DX z(#Z-##b*rnBeyV^S}XetA1`u$Si7`y-0>{&UAtTd;&r6oV6q(U_*pfV=tm*?tM4O7 z*i;U%)^oL4gsx@`t84ETfJEJ; zBe?yeEZ?m_yx!a;ot4W-6&fmh+l!P z7lGN^ZVJJJqZDx~X}VdD9RbG99!vbgdp08Y9}nsilxvlqIfc?tpFM z-I#*PrMTZYOHHF9I~2t7D_2kV$Ieu~o4CX_Rlchs$f6V9@YX?8>lE=q7!<uyBk1{lWlh6?ad&e3tBmSKfBXor zl#xVcNIH$XYFNA1+8kr`VTpDF%flW5-cY08HH`DHytW zHEr>>-{a-1Y8VoxN<5i>VF5SH72KB>bv|K3xmDS)>_+5%p`S;toF5`H8gg?^DL_#` z8jcXC47$HO*r`I5$j3{E6h1mE?R%RKrT(VqY1sK*1#TkZnvuZochr z5J{&=l34EK`&HcznLOb|It2e}_c>j6sdnq!3)K;h%%@iH+x;2^T{-Ko6y88+(H%r+ z0X03G4XF+!P%hCF;z*|N{#;i)=1%^e;cy;TOU1-mkl1F|v<;m3<9qdpDX zW!7vbjZoH4Q?AEt*PM_%AZF2z=WL7P=+ATL*D=reNSZ%A+^%V)!yh}0Pw)4UoqQ^0 zNE|Zp)%-?O55%Pu&7V>VwBb0~Q3wVowC2)`$HE`YwShnuWN8M(CzT}Am#s^vYNjHg z?-dZ?m}!4OB5>X?D*m^%jHBdZ1m{gd4`*t_>~Ly{ZQAuuqDTd;s&37nc+dA*zm@96 zQ`8zg>Thp4=H&J)2nu4lv03+5Fyj+*@+CfVm(gIU_6X;V+p)P@wv?vhMO71X@I5~{ zCERW{Fj%L=%T(@*SPw)BQi=))4R}ER@>hflqtLSEgVC-K*#6B1JQe#s-p}`Mf_b_{ zlH(I@{O`w_L8%&ii-wEEZKTkaFONSTD2Z|R4JYl@i}0Ac$41emDPb5s0u1Q9+!kc;m_&zmG2jBh#32aV_U4-L@XD#xA)q-xINwQl+)9Z zxyJHr)Tkc6=(W44#;ikv%B;7W0$OsKDGb!&as*Z=o?x?#V`%3bEzZsf4MdMKzklXd zK+M5bY#0cSpU14TTvx_;{5R zV9y~J{zG^u+qY`AN(kAY%YP8fT1^C;mFh^*EOCB{RNfx$I@htGV_iZxd_(C|C+Yj2PLCS(!NMKP$Ycvb~7(abM^7tciygg7bJl-G+Qa8(E9lM zM~1IS@qc1hL<5 z?)&Q47W_(=AKJbg(OdkDAtS`SS{YNiZBeY+-?1#fH4MEFZGb_$p2&qKh^2cI-$P`9^st8iy{a9`f__myX0*m}V zcJ$Gtqi>RVoY;-ua12+8FO(e>Zm19GU93ovktT7*XZV#Y+y1Be-U^C31(IJOPjnsJ=epGbnhEm^ z7{INI!1L(W5r+$)oe0!rn|a=CiT6D^F-Bdhm(GenY`exPl{+%5U1Te8W}l(;sPxG& zu)kblaUVXP3RG@t136Zair7o}c+A-m#D|GL3k2=iE{k^SyfUNUJ-W=VceQowYhD>D z$Q20ptHIKfxmNu1*L=gYL2*|84c09qaltXcD&~iP-Fxf5lZ4x0aN<4V@q@nzhxQdk zQE1m?`sZqj!x;29rWU&MYu)1QE;o@G-`ec1LyD&BbgHsFHcf_iMU;n6kAp0L>05p~ zuir%+_sHoQ_uE70_3>v%{Vd{ZjzzqS^9s*J2LxBhFVg<6t|Nx$)5&7FryX1Z3I@uz zw*g-K=M|TqMoGw#*^aDjfgRX^<1A8US?C(p{-w!wV8(2>6w2e8 z(KM+)-!&bCDTDXk>@x6{Z%SBbAdXXZJOXDgRy!@OPN>%2#)bhp+v@qT&u5vsT;*A} z!=u`COx#tM?=dlbI}|%mkz>ZR@8h-gWzUyM%_052V(X{4F+HJHb+)H zpQpF;T+JvxTzcY15m_b5j8w2s{dh-df9ovjBkH*KH`JwKS4+jD`LBP6PsDt=To|`3 z3NF*6Q8}e&ZFx3)gHzrvUB5DXMer!N4odMbBkR64pgH`FTJ?7bxP!$hW@Qs`JMKt7 z9PV3LMkPO%-4}`|6+ZhxH23jb{1HS!EaCwEJ|rUis8QhDRc*^PlsVZvlEXYJ;I;T) z{*RyB^Hsw{d-}762GseuC|9^1tl<;=pJN9NS|=YWmCOIT7~cK_O8kf9>Fx{V4Nlyf z3H^To3V}}B94570pX3nsidMPIey}UI8?-FvEfrVZ>OS|rGS|!g?U24_!?7=Nbu90C za>~qzW#eV9$sG*V$)YRSi7l8{wgQ*8ceELPv=`034m7g8^1Z@$|5$xxJx68K{hn4f zPtgpmlz)kqb!c5x;T zqLpRuqF3>u?hT%5a5Nj0cR6W4$?!BgS!xDpHdt5XDwJ4NLQi5P2Yvvf3A1EN_|W^+ zI-cVEEO04rE(5vDVXE73vaHxQQtvLG#Ga88OchwmBIJKry!Y@=!MgA6(upcraEkz$ zR(30u$Lny;R8PmfRyoHzM%LH=FNOOCG2e(f`m-Xq9^=gSfC%?nL6d&z{5L)L^E;^} zm4H%H4x9We(E*Gnx6*6@Nq=o|ZHkJ^l?Gq<>o@Af`yw&Nf0Ne)v2+6jdxo=HdN20= zK@Vqte%&)Oz*nBF;sX*1@4btGB0}r3dexC~WG{h{k7?@P7yxaL7iu(u=5>98A~>FT zpG8@uyI)pt= zhK?M$_x!|5)sTYKT*7Irnr%k-`Cun7&xVl;l0NXJWy?DEuvuUvSTKI+HIjmU*VR-N z8tuBWG^DoD)H^oQ)X#_9#VD}-oTvXwe8lUIrk=WQhEHpBTydnexN90(TDhkibQod@ zv?3JE+E}pwJ;^9&{6-q3=38n^tfGAI7o+foFd#`|WttkP_<70wc$HC!kJ{I|#d>}M`{n~Edt!1AXX_)`{5 z*UQ!vQ7kDFU=+Qt^yYF=iH$sxoAyd`yW2Q20V>hw0fWxRQHlv-yrYJ-T^qloqElaG zqPS(FCzEjw(G1-opc^2+Us{NB$j;7&ITy>v55r@FaHwjmcpMk_Yb^&;T)4WrBhZCV z+0>m{js$Cau*Aasa^1GGZE}{p7CE5GCu>pEIY!<~(=h~N>|$bz6fT``)?J~9u=^jH zWjRnNG}LBjrqR{n{JP_LiQUBbM(IQ@IWyBH@afj3)_Np|yTqk&`5n_20+=>?BIqo- z3D$ft%vRlM4$y@@Zml$=0)=0{enD57Jr8o|5`?>lzlaHe%q`>-DD1B0EU+~@0t383 zx7bTQKtkS4x2|CRX_`N(*J->k1Q1T@!xwu~BXOjB!|r3^HdW30tnSxK-cbsUq%^Vv zl-_yS!mj2dDZwhkIvW3~j22_;%>I?@j`0IZ9;zHIuaO(X8H>T>F5iI&i9_>D+5P3a>e{HDeqK&wm7Bc2F4LM z;EaJY=H2B1F)TfyAn=amyJnf%2>>R-Y4_k<0X@^wEv`XSp@GwSIb*Q4jO2hw*?JFa z0geZC9iZ$2*b^~$NDO1%KU$UAD=@JAKk${g$`y1Qd%KY+Is8+*9N<3xO8CW0KJ77B zpu3Rdm@c>aj;_N$ng0lSI2~}J-qrB|fI(a(hGAviXRD!%Y;1{}&Q^e>RmF(ejOLw? zTj*39J63=jeHdhPJIS3}abXNJRlTX_4|fOEX0{(4`m7?csbN)Sd{y^LH>Vp*-pjwj zuUCRr`lyGBAXRV`M(gVSyJ{@z4()DxD(AKI^pd)h`1U{PUD#(1YR4oFCYiLAdnB>X zUSA&?Fx5};Nj}{a->ZnS8@J8{By{u9i5I(WistQ1>zXXl2Ql#ZT{&D=?5<~Xn}x=* z-6rtgtvo;NB;0Q2IvYxqM69imx>MX{#XIF&wm+OH&)PU+5_vBJQ?qF`FxW@p`Qd!~ zsA0uxfS_-8qF8eo{Wj_%cAIW8&pl<}28&Gy%_`bYjZs^;gUPYu>CWC;0#?TCutgQP z@T#&SolUoSENz6Xs=1js-bK*Cn^LjOT^O#(bk(bdKQwY^#$^k@$mleiZy z-vxLDT2OW;n!|sbCgAP@H9_Le*2eQg?h0_zVSWbVp^=#6qOts>?5kBqEs=gwE?eok zNR(n;7zv=WKc-IReXEYN{qIQTqmrH32JYji-!qg6F+=d4E4CAj1|q9MId zCN=R(E#fj}raYI>7UaN{j-cm4F;axEx+*r0w!`E;?13q$PE)-@vZI9^`b;>wp=tal8XH3<@b@Y1Z{Sv^B_odaMX zbZ61ILp)0|DA1HG!*ugcveeG#moUeMCBc_925`>9ZLGU6Pv3$Sy7=~Te;Pgi znl2H9=W#GI60l4W6K|UOt|A>TlAcPC^z`|$0A(<5cIGbi-BhAY+@$av_`oa zqF^?anH1N1fMh~q?d$NQlWJ>gd)oe07`4n;IiOjk0SnSfUxCsvpG7~0?p%cc0dRUf zn=f18j0>0{II?UhT4_2EUx{#Bre^z!E&RY*I0SN6dG<;64%!CnnMtgVGZmy@bbgF?m}4QO%>()=uv>T4#ctQz7<;<7Xdyxw{=^AH zc``jVQ4CbWZ&C}lAjD|urKr4FZ&a5+j9foh)4)+#s2_dM!puitxdb36`U@w!&W1$; zp)Q_PW?dz4K=@>9s$OD=PZ5~9_fb@zY)|fwJ6ibTmfd+T4`x?N%I!~9yQC`he|NWa zlClyT`?uMNnr7 zh?zUA9}w1n#mwu?rU6!jRNqDfJzBsV*l=JSMzgt$n-J39qISY!ep30f~EmCY1iR~!O_I>L`!CMPL_ssfs-E+GO{ zeqqSo9YDyj1H!SA@2rtG=CvSVF~Zj}e;;nF?*tvd>e-MeV3f6ceK^lYBI@z|-cY|w zjcBc#rp=b65UwucrgcPck$}YFE&5PHp`e1`g;}bH9oplpDPm94-gtGiSeD~nCT%dl?`Gt}0sG8+ERs~I7^KE<`Zx8Uh7D3yoC8dEXzg;0)#(ui<;k`IooDERx z*LkxI1PAo%xbp-O9&_178^dQPPX@4CGc*qs-X6JAn1M=t)98p zv+Ro(+O?pm+@B^sxY;efy^ZQ2lSK!wfYH87YN8$AWC|u4)xCm}#2I~w?e$o$pLG88kNV%;YTXl0n_g20k?kRVA`zAzxPm%h*@| zV}RlYz)KglSe}O~^b zM=`}wHmWAK+e+qVW&GYpGM0{0^G&Bbg`IE7vB&fi)^KB95A>MROwP2APDddRT>&wq z{4IOPIYSt;CQWLL_1SKxF>fB9=$xD(%L58tcNosbBvM|KJ+9FDo)Fq5#H=Uox7L#D zHwNv80ILnD;qQhI0x|F~??lNbpX9)qBv2zkL|wxSxUqpHnwM}P;CjiXKaLbXlF>An z11%yMP8kUiJ?vsThoMh@X|1fgX67e(D?9>;E9e^Pz9cag=lv==cg)1$@%~y!CKAK- zjj{e8gZgiTFospp!LU*)SoX2_gM=?m!j2Kx=c3_<@KN2=Fo4miV5IKAGbvKsE%S+( zNN803?rq($?CFXEty)C-56i|NR>j2}cfuVYv%dwwvnHr_{@$%0r zJMVr{o5oD%`b8%(Z$rCx3B+8!t9mJD`WgNv8XiXr(;j=1eWb!5y2%jYB2e_@!|i!b zTYMM#z|M2`nKkPe3-e&@DZO7fgN#IJ`q?nwSU7Diu^Qyvatf2)r?*`@BcdxD($-Qq z&h59>4b&0c>a?6}5;CVcgiasY{TTlKo;5xY#Li$>bqL3>2|}wcQ_U3|(YnP#Bl;Fe@KIe z90VBp+%&y38ID9E&e(?24yl}TK(3A^e?>ZNGtNnhL`iCv7^;ghAaC-aYh+0O+{uH? z83~$1qGD;vM~W0kf?~DGNQyKNEe5a9n{LmY)c;n=mAi596<(O|au^&j8%%(-`>~L& z6{wuSnrDJ%^A@r?E=}sh|lN`pOrnu|p5txj2MBf;ZvV zsE&0m2Hv7hl)Ljc|0Fe^P#lv{@`!-RR{A+2^JJ%L4HukMsNrmVuhCO?F-GR__b4zF z5-QH#6L0JWCM5PRw; zUGecCf`BL*wETBK+S@o}ar01iCMjQ$dQM~&juzn~?|U_GqkIVS0%ST73oH#kj^>Q| zn5X2^lM5h!#j2S=iVo$2q+l&ks>RQ4`J(j#M3DrT>*SZ~ELeZJwhH`c6O%Xr-TPhn zzA+`lw7O#A@5Mq@ydAjwVnmU)cN;MuT;FHs&_@v&?Lj+rX_^`MpoCIG+CA)T;(r=Z zGZR4aW-=xmC_dHOl6V-`*(Q@S58NXP=_dyg_yC}z-ta_1s>D^Y4R}6#-UEINe_ z$WLqZsoL5*NW|QSF3i+x3Lkg8Os(Yn-t9h8TG_s?gSFNNx*9d-|3M*m%HeC~oZ&cc zDr<=9|LFrH_pN!o#4T`e*@e{Io(y9#aL5ko!Gc%3~^iuy9FUlLpH-%Ym*(IF7d>39fHj;t@A3Tp7qz8nY%M>e%?a(7OY^< zO-1dfTP*I)Mz&Ih$a){rCIeo`ZD6dsy?Fv6`)N0$TQwTFE{nV4d*AEeCWtS26`;V(6bJQM zeOwoQEB++Y=dX+YE<1$JKJ__#b~bf~OC516cg8T5h$An^8&H+Q>AJ>y+rf#Wdn3}Q z6~Vm}M=$z77_)F#7oy+LK6=QjJj1PZZ{V&rd}$JZDX>V}F6qfrt0AJ^bk z{VAx8c7tz{>cd@^0KPISkS$(9xKq*+$;dTulDnH?T7qg;vIxvH@Xx`mCeESwHsIo& zJkzw2nB)_wj5c|KU2uZdyWHa>$P2jqL7E(#?@97v?cJSLIAotzjcck*{Eh?~w!c3o z*bu8)V6P1t8H4b+61&`wuL>A5^Cfsy(uZm#Dl*KK&!=(=OJ%EsGwEYMy(*h_|B>Lyt!N#0L{N-xS-LDE(kD+aTdSE?@0B{ z>Rj##-wW4x-i*6g$%O#i={i~K3G+O_8w;5RN2}K*xl#6pr#lIkbx@ruxPVp5 zgm1+6Hq02PdTD$kQY;nK87mry^hr{pv174m@~L#PzMe&&1wCH}Iay^e6MWEt`QGi7 zp~JFY51XU)4(R7`vJ+~B*Z-iLv#wLNr+NBqKZ^ypi$ogK{RgpU$T)=~(L#k&nLzBp zT|cEugvQ|h5YPPeEck(;#}nPU(_uqMGHPKUEzaXB;ja!?UF7AK$^C&U1j}Hv66J0kou`am9?r zhc4`xTUJeEi=Y9!glDY3dRdDAMKE2409J5tqf{Wr7;V6hDLc_C577*Xi2imc6%9E_ z>ALIVea-8nqmyx;H#~1sV07rFJ{YRHJ+NTX?(Yi-Pqf#unQ>#@S~wA?tU5M7wOznu zpVL)AmRFnKvV!eRrOY0Q6@Hm&qBIp0A>g6mA8P3kt!cQLA*OC_4S~%fwF5uYOsR=A zF?>OTADT8O*Z2;_$u9acILKlv=Q5^6Hpqr1*F|Qzm1zl)sBXJj08}?P{hRAXKY(Uw z=IS_gD)k8?(+nYcp5J`Ww_)zQ74>14FsUp}JxB$~##9zz8aGKR+=dkR2T8y(W7{9L zK5f|BK4lRLIWm2{5<2A~T-aBJ2%arAN)1pAxkpKLLWGOn+*Kd3iN~Y!l?2qgk$hf% z380w4Imb~YEAcT-A0`0B^#OZfPI?>G0POG&t5V(0M&s%0x7v zW9H1eO4VT}&pqM%?@7QJl@6DBKauVAY?+MRNylZ7GCX{S&ujV~8rw6Uw{FngMUG*s z*y-umedqp-U=K67G}}*l<)fF0wZ6Mi3}aw8Pk1oK)kFbS9}vV>~ng(;hIGyZc1he4_TvX9M;OTTW#))6SILgRgsPJOrgo^ppE z4zf;E!%Xesb&~TQJ`-jkzi)&Ei3fehFVm~9QB?c=R*m&hXI$a2 zQXvYwUSm!&PZ6n5dZI0V7%e1%uucoHkly8KQ|0jbQ3RI&DT~CR2(ma6f{u((1+2`R z7JNmc)|Ffql?>HPjS{+Cl**+JYnedAXCp>EP%Uw`B zkxWK*NfhX4eP~$zbRZA=0>$2=`qt>jjy4(h_W^K_dP&UJM{KR*B97s*657{9(H04t z)6PZnv6;nDh)n7s^+aO2XTMTr*EVBCLu1zQWo7+z>sL_;xa7w41Y5;{77+d z(vHZf9@s@8WNE2X5 z+?X=$HpZ;o#}f|$9NC=8XBBStFKxU(*$hxS@ntVL+hxJ_A3~FA-p;Xyo?p+1(@Szq zGN&uzspVe|Xig9k?R?*z+_#{ni)tlMEeCQOAuIbz`ZWFmLS4Zh|E?D7xtR8gEPJIP zgB9S6wojL6GI(($JVpPAn5y$N%RBD&%K;gM)~U?Zre!_B7N;dWSMO-xz8=Fw)QJDV z$ES&&FhZMC1BV99x{j@o-{p8KU_}FBnVQ?y=(gm4J_6`B7q$`xHvr{E(B?`nOfY09 z;rM?t(_m8P3l^ga-7P>ZQeO}UELu*Ie+z0jX+@mCx2sExB9co26Awdtg?Oi&UipAI zY}B*(mIyV2MLy1Z>)aG&m1y4}2}Lln({t8n=c;%WNnbyj&%l>V&_fgOs{OsSja`q4 zFrA8c+b;pQcMT;;G6ZMfjObB98nQm1!qZqw7=4A$=#P_4c2Jgp|G0=HjwnRWPTM7TpX>LNd zZ)%rx*{$#WQA10+k$<@^(HRn@G~Q8vVf7bb3E*zO&@A^ETh>NNm>8>N`zxkYiiA$n zQ=llfGa5x)p5a%Pn7ShsvLymK?Zq#(7)aRu%vQzhrk45QdKIYN!=vL$Dt)ooqMu8g zU1U#s%IBOsVhTY`tJ<#gufM3vz;bP*ya`WfD{;F3!q>D~sgZBS-v%1o%Nh>Dme_5k zP*m5C@Gn&-heNy@@s;01m7Tdiv%qwJjx)hI2Ff}UF=QQ=w+T*|ux~-nPq2}<{(tPG zC|rASVfVIHQp?*B1kJN2#XD4_3TDtgO)%9qseI2~J>9adk!SkB^4DD6>2u_u(e>T= z+A`$>fNJ(E&B|blZ#KgXqLc7$;^NYB8oy~IUn33fV5Wn{9WJVn&2?`Z=5&5eIHytU zx7OcLAVmIN03ll}QvgbEs&F-y%Ky6vCZRwp`3>!QRU_mY z+qK7$J6!=|nSAEG3oKw`AQ4*zeg}T^91!RfUl!?>-$T_25_)E{K@M!BJF1~$0(KOL zv(liSCx2E+Q;{n?sRPLyZLBb}R9gl9px3W2{z;8+QzWs=$xAFs>K{DDB|y#>0CBAk zx)-uy@kahX67K(g3#@JI>R@gJ3DaJNCHHduS$I_c@{s150+*j{H){7rNW0xCsrxkvbkz`x;q$2R-oFG zaIWGOGjVn2;r>Xk z0%Tyf^05eMNY;FtPel+PZr>So=DuEVpcIZ|@%n#-!tj{ZtoN}oc`39BD#F@xZ^ksT zaM-4$>9-K4t~2UEJR-!kV!Tr}+IZ+)%OA@tp$;F1EqBb|f;a7$m0yz%scR0Zm<9@R zqglvtVRiCn4o4a3KYZlh>I=L-ve_OhIF{feH~dMcA;^?vUHAR=cL*tV_HSpPvaV)m z;=4sC6idT>EXcRSbMQv9=q%t}X)R;r=D@;1t0Z@)(woVek zD>YB^H0%@2%w^IJ)h1xafs?|?;u`}^u^TpyZ?ReDs1ONSe<=CI>hQaac^Lh;jH(JH zD>)g6Bk*>eI&($j>2eOuvfzb3#5AQ|^zb#Gkr2NF_;7T=T1k}`+tiNxv3Ms*2Fo?u z4p6P^SyA)U1_UpR6~B@%NeAB12juPk?K$juN3NEk{`LPP7?;I-|_9z8^%PU~v(d=?J z;|{GRvzkFsWN z*s)aN+wZE)(p05Vbjjw*Y?@|fBDv%oNGq}bJ>Xp2ujo7ba>u8>a9h3l(LVTZw9{5 z2C6SvT;yGAq7(-DSz&&FQ32yxrR&TEL??O4cJ4bxrk4L{MweYH`YnSZh&fSWSVqJm zM!+;jzcgnFC_@@9$JYPSgNEI2eWI#xA02AD-!ppWzTLdD+(dP{`qbim3|p6b7@T_G zY(~Sr4PkNcHLe)fTuyh)j-GncS^*j1Pu6K&Qd+7XZ}~w|8QpZOhm$eg6T(8{DCJcU zGCi*M1B5n}#2df>LGwIYFHeb17(wefsmV!sto3f zbc>^Tr9Vd&(|pP8CbtnDy`gZUV~w%|>xv7%RuSw}4I%B(e6e~ECF~5cS(*SyQ4`TD zT#(abXccu~2i4Hvc0j}NnnbJBFb{ik=W$G#dO=a=>yoXg>9}cm<3hp^?YIb)ycVD# z1oG#V@^W&6uq20+zEVZE%uvXRDdoc7%0jld^V7V&glK8y&kvmfAs#2?i?4h$GG5!F@73xK-JA`A$@P;RHCT^LQZy$iT7je_4F!RIf=wT>1f3Ff(1WXw>}v#} zg>aH+t=g9~{>s=x#6&4>T7aIaD6GD!JLB80v@->*%KgWeKA>K>j z)osMIlcKl%ZFBm^;J=0R@Nw)W3Zml-GLl?7U#T-dpKVhjCqRl&--L%qVcJcPMU7h? z9hv2531ta)_S3i&!_yOS*Q=yu6awkbe^Mj|J1SmTa*UmPM<{vcCbHHHf-hLPq2jSD zOy*zDJ{4OZ{VV9PHh$TCtJx)cRt$=H%XeBL#49(e1Djqgvqr4)>O(ywbE+S%QjMbe!q$C9k8Z~cAp!CpSB zG{O%VJ5n8QDoOK^iRe4Z+@h;^sgF|C68z47M`Mr0?d%!62_8UP#~ZQ9qib48_m^I? z8HPXoCaq8hzKc^rm^g8L^_;!aSt$BOU2aUi4~_!=QT3Qpb+p+3T=b ziIops^w)!vWy(W)Wd(s~GI8YeWyh3j^3387`EGv#aLa5#O-xnUXbBra?8yBlRRd>E za=79`1%n+V@O3w~@$Y$fM}xC0G*Z@ce+Y=WB6Nbo1MHVLU&PB4}{}v@hi48udHP`t5%6}@o<7wfo+1o-KS~TPV z^K7#%Jhd(b5QO!Q=|tmXF9Rk-CmI_u=A18Bkqn2a0=^fe{Iid_2IQykoBfUOxe5KZ z5FBsbT540v6(Qspa@S7#(7La_>UZ>9C7-iuc|l_+W?NLk4a7+K@j;AW{=t!ez_9=` zIXWByJe`M9Qq@^v_;e`oDNO>#9BmaCj3HZtNd=ngnB%Av_S6=xn~$e+ zzUoDR53WLUrto1t#5kNJM2x0%h3kzuke^E8mvd1ExY+FPp7S;6OJFUc9!Y&j*hq~? zvgvK|&G&J2F|7O6UAxtshRp6gi9eL=NwX)d6gfkGo3J5_Jr)C#pn0|+c`tIx{zm~s zR~57S0d9Pfp0c=7hGu!$)bw!>AXZJh%0qFjxDkF=TNyUQZPb(DHgAo4_N_Lq>w=vD zpD5G6-sGKka@~at9j8V#Z$-}ynU(XRKyu5p1u2;%C!3%&rZb^~Sho(X&zr~?_3 z3038AS{SkiA%(#hwpMx)HU{>^}$)G^_N$FA|wI56t6OQbEAI%z(D zub};7kP|NsDHbFFA{~;G+0HdOSTn&$m_!O0#-U&({^%xu9kRl+uNKL~nHR=b>^-q= z{D&W`$S*Ru3(lrmmmy0cZ9>u^%RuOk)K-?4xoD(1r5S+)v$#;mEWBD*BhzGNMkyhV zh!-|nGBdHp8OQVsEzb<-Di!?a?VLjhR5DLFT zE8(G?gayU#9=Yy~_?+RtcCWC9JWw9SPm@=-*{oro&QJ5`|Lo1XNf?M+B9;#tq|pLN z2C0JsHnGnL2@yKVsMCB-Fy>kXMrt;xCy8V8?8o)rB;IgRHyikB$5$4x0vB(IWL zxNB7q4p@t3**g#~`!fb!`a#p?+g^h0JD!QEA8;{+pP_$m8}KFx7TR1Er_;$3P&39a28 zP!Uwybe&8Eb&I=KKP1?v=rZeS(S#>U{wYY4oDBZ^>(@k1!i%}teD=lNY`~h$@B2ve z(nx*5keWP}>(o5|xxQHjsMviOv`pHXvq<2vpK);U!vz|$11)DNw1?`PrmXS3X@PdO zJw#_&hxJre;LDGHWGiOF)wTicIGL$p{MN^RE=c8apImGM9q>zY@%oBi03EG-_Ol@QvmgPWV1;a`j1B%8)6z4WXKy)dI} zF>fc5H|t7(L->b5L)E-<$K&v7SC}f`KJRvxm80zp^+Rzu-6G+i55;tHd?aO z8shQw^|c0kk=EVesHK6AcWVtrZ<2uPDF$kqqpU-9@?d!{Rn7BGHu?n~#2RD1Q|;QP z9j^Gnzg~o=|9)ty0yMRUPF4=^+o$&f9unJ`Y7=KfF>cc7gKVVCc)nXUqR5rc!pX@7 z0~J0;^0i*wv5a(OrTB*|nx%>mHWJkO@BD&zhtTHIr@rHyx1p5Ed8Qq{xq4!Igs5H& zZzTT@4`g!2CUVH&ka~w|^iSDPj!CRuQ8v0BOB<`KkJ)>*TXQ#xb#mHoxNtS>(*7x1 z4*mr3J!I*W>JE{aDc+6mjs7ULb4obm7PAV20u%Wu<+HALF+|Fxrr{-3rb z3@`2~J$ z{B~q9=lJ=uv+@a64ChEXXD*I*OtY-)H;qY7+}`HE_>YVY`tl3$8;|V{OGIn+x)l3( zKgj6kfHC}GT5VL|eD}NDqQ0uYv2uYM@_7(K)+WKl&E?-Vr!}V2qZMi-z`PSvXW91q zmmYVpNX?Wv`oXgH~+A8-gTjVf&4tR`E4ugOO%ygk>;HGMaA&4P?07_v! z2QgDS=Rj?zX{ylq)3Sj=HkxdLAi7zxjq5}<;~CHT^Y z@k6IF=Lg`c{^kT!`@Dhx>%CpR&w32Ed^)_*8

      AI=Q|2T0D4%{83IZz}G~&s#FdZ zdIa_&zpm48Drc~>co+a}{Wom?tCKSihjQ)XxP&G{jLeWIOGTDZWTb^K$lhcUS+Zm) zOfe#5-(rxIH5^N*7<+}WWKCI*sBnbr(kq87gY^EMbFOo}=X$T}{PDj3&dl}9^W1aa zzu!Ig_xt%mu!LxX5w*s~^kB0Xm~v$;UUtaB0hAkAyx?N7SHQsZ$(1l(EC9^$f|q@4 z{?(nT+})9Uv`N;iB(r|q2~d7vSl`z?sMJmfKj;8}yt8$GfUAdxN8|N29*$E>GS0ij zi(pniQ#UBh2kWt+si|p@vaU}9^Oml|d&c6(2YQlo)S7rj-7%-0Y%NDnj`0F&Gi4fT z%j!Est`yZQ>V3S-{l4I$cW^EI2LvQVNLe&eM;EN=L#xlEo>`1MxZva1e6-M@J5j0e z{$g%#x`|=$VB1^(N7eELWQC>J1jYqvH#5Y|7!12Z7<2nVSFte~JkUHU+cqt}U{b$_m#_`x?+l$B@ zJ!^>C{*9MFpIcnv3mQ~O$+PXGdyE|TAl`)xlx_X*YvZxXpavDIj73ODyN;4jrAJ|u z#cxIRSoFD8E)|-UHqtFBy8gA4KJ3Y#Z5LIl zaz9(rE6g#w;Elg-9R2Rhex(nd=_hUu1#^VC)s*2wpB_KZe|4ALThu8Wp6a#WW$Qrk zylJDpRHYS#%cD+r9j?GzF_OXXc()Wc%jUw7baVG?*wFerVQZ!;SYbLK6<|*|nHw@y zj(n>2=2>mizB;r{WS$9A^Itjf&_r)qaC+@wobCGaHp1Nb8c*qpIw(^jyD5y>Ly7?4 ztil(nI|N-;(vJt9^Ib~J2Fw7z&9Pxvh~xK?LFxSSx5;n#xY3B!{s)==b| zX4CyV*y_+Kb*C32%UW8D;JsK_Wl*7QPKYywI+PGD`!!#zB3j=2oy>za29%HsA+oMw z1nLK~9=UeYWV5Jz&A-uIe$*YV|M2aTkhtaKTS z>v4Ke^QB{08@f7<>@in4mQRA5@z$VIC1;%+!aXHis@^OB1=sm451gezo1XoqSjh7m^;mLfF?k>2k7pyqdIDwnpY& zw&I{pEqc}6w*IkU2jXT`ECQ;zW&4tnBBZV}CHy{(Tud3cSUp3# zh=f%wg*mo4-QTSGKkF?j?_7h$VRjnStG%aLYa58b-2@a`n>Adl9mkC z(y83!P7*yUpI9y}9Z3tnlZ_3sx&Gq4sqIrKZdhZEGtz>pzLmo^{JD0JMdJuQ00ofn zcr=N+ut!oTw`<{~f@AOzKv;LhH28U#Qy}yxfo}%=*C#wC^{72s0x7V=dfSLQ7)-&i zZGbz1fKWM_T7O(c^VKrwbl1S5GQpWmwBX<2*AIa!N>I`iz(Iok^HXZT-S&_r$tF0K1JD zlRGMO%$YYlKDr;Z0z5zwQ<@mo5T5}fK#dx0gba?k#JNG?={4L19vQT)=&`Hs4sadb zQ;PX2U$@ryBf%z$#?ml9_@cm~RM@%aXh9lGa5j|J-CZIE2zGG)LDrDee<78BExPnW zCHLj_aUxyJ!pqBR&2YfBK3e@4cUojwJxf47d*WMTq0M3;@`GL$&KB72b;1d{V^Q7u zH7av5DHUXY>>67VJLh{aJ$E7kXCmH8x(Aobs_xj?1rF80!h7G?g+2}lES?IG6fOK+X1aO>pUu%}S5OqOO?Z@|r8@tq3_lnj*5D{fbBh59=$u0!%>gX5H`g^JD;il=^%@YgI+QHR*1P{Mh#H5%dbEQnQQq5u#%FY{}aYSO1Jx zTZ#)Qr&_-GuYKMznX4AWcG6I^={iKzI3`(n9Yq)_B>1Kip@39;FD$N``|%3P?dS|z zsEfNB_PHDyXFfkvRo=eWB+uaR(}}nG)|mr1xl30-zfzVQ^KC`zkko$y_BW&*73&7N z72Yy_-%c+f^=({>LggEsPD2@=agU2iJS0K;6 zaB5O0MKZD|RVy*%Jfpaw$hvmWlG>@{2=JBT*Z$I}vUWUmy2<@#FdBa&k*Co}?6Lk7 za9c_sbpFxjAipZD3gUq{t)(#*yU0T@$R5ElH|{)Uc_TyKoJfaqa8f^wJw-s?`s*T& znfwE?gDOi7g8pi4D=DOJ?zM_>l*M;J<@=7FMDTeqpRxk-VUlp#3z z(gGiTd!xBD)u}k*yA*RLB>rOwc+y=SDPN~Re%5T4m|iT*hcgBUZQ0AX=~Dh1rCOyR z2e8Vn#w?b;;>#m`c`kNq3!foXi%^6P!=wH00G*Hw+DK2Wogd_qrRw9Wn$6#zF-aWf z;1V1q3KTp6*T}s0F{i`6uKPF-hGEpz5VWGIbj|OfnXAut@C+h(X6#l@XB>>tH~OBE zz+nP8MMVkP$HfhktNxdz0%*bY%$Ie(XxRAb9JNSajVcNuOSIu-gy7^>rc6) z$Yvd$)#u*K*KJUGUj+n6PMB#TwAs~>y4vzY=XE}#i>MDh*o&5*yMk<@DVo<`5*Zin`bQ4dma=@Rccf&m z%)7lDc#UPHkE;5uS8l5Zm+Gfwhu)Ynm_XIv5XX!Yw?y;si6_4T`&1Wzltc!n!V7=#`ZuXuvLej&PV?= z69`yG_ixch>?c`XNv7FjOyAMAX)#o#JS{_5QDz-xpZ9SJ!W$#DhEx&4s8AhWzi@*` z-}n5znsC_2#O>qNRu!-H-KSZ}oU`!U=l<|6!f|JAb*iXSIdZ4q+t{MZ}ykIUjP6A literal 0 HcmV?d00001 diff --git a/education/windows/images/setup-app-all-done.png b/education/windows/images/setup-app-all-done.png new file mode 100644 index 0000000000000000000000000000000000000000..af7343f0e56056596e5ff6ee835721476144ebfd GIT binary patch literal 23020 zcmZsCRX|i-xHiooHGp&uNJ)2hON+uF4N}tG-O`|hgfu7!Lw9#7A>G{_L&@2E=f5}? z{{;iX%;(b>0=AN(>{|o`L|foT9fSt_$GZ3u0{lXBd8;6e zP(DVn2RuQslv0&KK&Xtzd@w-;o?|#F>bf8x;PgEIAbw@RAxA*a4N{Vodgp0)l!YEh z_;)V+H<55KD36BevtlJ`uRUw!&8*EkR!y_RrI!cPPd(w9PtbfO_i?L3LRnt-&frSp z-r&HAFa!607rs8fok@=0dMu?c-HZ>9Wr=K!FrVCx30SrY7kK(|aQkdn6N|S{Cu7rZ6Kc-A16%4VsuVsLxBS%cx@$6Z-F=aszS@*Nx zqr&;31Es1kFzxUc?wJphrNCeJX<=Ec;RN@w0?UpH)P6N0x0}hBHv94Q%ihCdZWBt3 zgwrFxffsjQzkdBlorKgDLyR)fNRG4%-?W(0X>TM5DB?NiAFRgCwSDuzzPrER~ z`2HG4sbva|hhFtl2e@W9v^A0oyOu0Cc4HfOc{SRF2$ok3y}r)cdaq;fSM?k3V6D}7 zSL?-?i2dzWsz)AJM*)9R2{qf%8V0v^+!g*8CqZ?bG zp)&-1;RLpoqWA6VQlT=jUfbjK!qVf-ibJ0Nymc{Q-A{}88tdcMn`It|k;jso!Nv9{ zW;+P7AH9?9GbVQ0fjoUY@du5g`LL?1{%)t`V$6kD-%)C9LI2N?y2RtuQDr|>7@u2+ zfs@i;-jbufWtN-%$#UzG|NYUuEF|Eo$S&{ofzvwvQJh`nw$T^s zqGRM&D{_BW{fj5arlNJa?dkC(zyqDqHQ^UIzinD04|sRw-*vtHREcJ}Zned=9+ua5 zo1c$fwzyvt+a&3)_J4PE?BTBZPQ8T3Vh4v2Hj-*T~)duOw6|F6B4#&Q1cJM9zplt)mJGt%VXKxgX8b z14X2wt!G!;gXvV&iAMgiE_1k#+#%EV@oJ{-kb~ijHcj7iEo@L|C)4b}zWJ!GC;B^E zzv%e@o%x^^WbM``5Rw_1Pbrn+&XsHlKTSvFnhD@M3dV=4`$mhk-dWCB+Ku9 z(+qNg1_#M;0tUf=1!bUB~ab0BORjiy#5PVpE2leQ5jGM3UGLz-M;J;{(R=2Pca zVe`W5^KArCZwD&ErNz$ofVSq#31vG_Fy`7uyad0FLVq0P(nvawT{CZkgzy+Fc9R9|np+~&IL{LXpw{|$< zq_&a6S6;7T@V4<5)K=}}vFH@RhVI*MoN|SyK(RJoXJ<3r4xBV1HgjLn^6w91Y4E^o zE~)hxo-s#Y?Qk9+_c4H3y)i)0K^H(&dU=dyKV;YbczwL+^1C)8G2nLC=+J^L_%TA_ zp;I+mv=LV9f==NWcyzxb@zl6&L63CzM+Uc1OHHU(47daKH%lJ%SAl`lzNek;`t~U6 zFV;kkaV%n2{iQI9UEF$4 z*CO5gQ1~pw#VqKO@WKfbvQLFo1ysSZUCp?B7@te-uP0!+3UiRaRcSJQ8JA0ZoNwSV z%6DB~UMVn^W?a#36>N~2>9w7151ey-MxZpPl8I(E;BNB!cKUmw-NnZ0QIh*c&aXVC2a>-N;Q=Vm3q zXm)=m$dcc&7OfJ^qLnMja>&SFGKZ)RXjpQVmG;6fAfZ-*uV#TRNASk0Pc!KKbDJ9I zB9e~Gr0INq)Zq4=g>6Pmu-ivp`844OrO|h3MLDRX?YE_KE%;t#ZqIZTp3o z(4eHPE!Q9m1!Jq$;x5$Ru=1=1=`3zg``Kt0u-s77oc;gNnvs3i0_Cg*{$f>K<>MFo@{XCA^}2 zEAhSo+1tbIsai^1V10qQGz=TFTDP%zt9$=Oksaer2$)v+qc)83ce$gHdX^@eFrtH4 z(;EkCH1Ln1*Yy`<28)z>6?@m-pK6-Drgr`cZ03~pv<9!#cTluH*7I02Vn~d#-;qkV z)MfPWHX_CH0k_E4bn?!hRd4*!x%Dp(->;J+j7j|`5&4nU!EL!u!}i0CZ#dNGB)+fe zUpVV|D6V{6jBP(W;P=|)ySbi`cvoTRQg_qw1#Gy ztu@t7>vFO`z?*e)s4lGU8&D?v(cwdjg$RP8yLWf45b1v>Fb+mo;lr&do;-4Ulx`v+pgr)n*JDQ z*Ye)0ciV5VZ@H=r^M8xJ#kih{!;S8mWYwFkJ?7Tb;A=e@UOvqSlk`18Xa3%--icYrjSpU?^b;F!# zRaLIHj90r*i6~Wn{xTWkV6nfL*F{2jw!oV8^W8nnrqO{u6ih3k2m=-^#wmVg6##no z4LsC{LqfrSznshJD+OmA5&s9&-(DCEbI^u@(-nf*Lcu~(;=n-$F!2A+Bfs)9a=#u= zj(c7VRbb@RhU)3uz3<<>d)fA$$7NgPev1C<*RSsEkkAqivQ}K5ukW>;0Pv=~rpFgS zpp9El(hOJbiwo_FACuZxvxOST{*clVti0P_Fo&2H2IMa0167;Z8@8Iygso;I7 zb|c|os-gFwUF+3!n1gg=SyJ<=Ist=<<8x~ej!%|-Q%cshG_b8VWGoHTNpiXqX)B${{wvh2#gmws+n8_VD)<_OG?URtS)e6 zr@>j97AXUnLN2zu{|=0v=Cl0o_Kx%8#hohvpt+_4jOya%P*)p(_Y5iwTW#UXd2*OD z%^nUOC#^R`{*PWc$;R>nS2IQq0cTIrx^uxR5kg+)A8$r@e$QfSUHie;B9;IU`X26P z2y>_Q-i2JubORm8VP)zqXOzRS%{CaN7;Bj;aN1s|FdOh-Wv4IoesvepoCvI1K`){LK~s?ost{Oq-qa z`u0aQW;QleDgZeZR8>{M>b@n?DKJn9yDF*)ZGGwb_NhoEJ;^gjwWWkn%==PNK9=k~ zyzm=n)aPbN#D0Sd+Ia)81j%2()bGhzn+>6Dc z=tcS_U{YVlOZ>Ac59-F1Xn|R<`<%4a--aAuQVB_%v|Nm!Y8o0ELPa=4(=M7<9>+%0 zxbk5|WZ5v$)j(t-xa25+(Lc@fs!ox_xt(^RH`m!M5KWI@vJ?2uO%|!LlsO&Gn#I?q z^X#FAA^9BDrrJyv#gdErdYZ(7Y1IL=(5Tywg;#V@XhNCi4sbxi=_xkgTjMeWo$^Li zbiu$?7e)CPPZTH}|J5;ai=cFeny4PpjEwlNks(VwUMBylzz)r}`}y#O-19% z)4!WAv7aW|Z_=chLI>Dg{)R4Sl7{}UM)@Qi>B;&CELYh(GOKydq;?VGYHhfPr-Qz# zffb;&*B+W>bHD^%DTB}Z{*Fe<$11ZEj~kIhOp zCzTagbw2sd>Rv`J0xXzPw8GGy4A`X4uiGl#*))BRJknu78>eqjH_#Mq-j7ZOR?RnY?N2T;nNoPC0qHcRQAMTp}q$m)7%@h3!TU~Qq z?Y1$SgixB5)DV_#tpQJgwEerYxiI?fI-wNChl!RtNab_L_1)M^vncH4*&EE0;0}%v zY>`D;o3hIA`z?+DYw2cyb$)vyKJWzSunSPy1}5>1;N}ccR$yUIZq(sl@pZXhWuF6d znZ>7v-%leqp2Gh;i`Lngf~ndoRYeKGyC{OSoUbjo-DBJ zX_nm%jP2X=b~znY4Iur7CVSnqopinLy9aN3?kU>)Ul)09yei z`u#7J`G16FG$?DlLmg25w%6Hgf7F7dH-q-A{Jt?hpB)MT66M1}Nt1Wu? zxrgSeq@skT{VD0~N%qiTuO8vHzdx$4kMwbpm6W}U4|vG$MP|IC&NcFabmhSS)vGa< ze|}(jY7(0JZ*$M@tE};>m-YsgPyg;Y#`PkJ(Dtx6hDr{2i9=@3L-n@BibFLG7jNom zucxjov%QL77K1>O<5(=MX!|tWlJ;?!t-h?@V~~ihI(Ss%g}TTQuTPZJ>TZ5~9k}oc z+d+g;_F%oshe8Bc=;3vqr{{sdy_)T+D_WClYX>Hl>K`v;T*@Izk42OAGwEPp4O#AL z21@+k`gj;vXqWu;z^-6*v8yllfEZ-cZ(o+_)JHl!aE^4cP{vkpoCM=_bC!Cz{T)#5 zrG(~iP%#Xg_Xa^4e|tEHAwt`@K$r~iXzJ~&o$H+Em@2m3!a_}*r)u|@-KKt*197Wnn=b}yJ_rB0ijBF ze$Z$FO&_;^$IX5dGlgUiLL}(0p@f@17cbny6;eW={y5YAueKE)D7`h(aJl(fHDNh>(_~~6sr@;H{hgW&V|9N-z-J0JQHEt#; z;~R0=&P7*0UYXkMfZ#7ueF4QW%t5KD>jldzK!;Tphp&e8U;_HQ>98S+?JayGUcJ0& z|Fs^Kn78XXc_7<8QoU<1$6`Ui)4!++3U{@YAG3G7{!D3}XH34z_#D?Mz*<4D((%G( zCrtENiL)MVbDCR8Q%YtSb%|YS_E2xhdD%uERbdt7@M;hcyUe_HB7(wm#>Izi_mb;8uJnp*f3Pnnw1L{TD)A{(+RZ+vC;XulnUr!~U`f za6I{QK%e><|5=f zvoc3y-C=L@_IwFJ<|H}uV4TRY)xm=m|5={(Fc(muby>(vm@BvRZPk@0o3$rt_$!U{ zZ9KJZ%g{FuCFAE`Y7zt-m%VoApAjva529L&lj#v#`N1ZxS2#|=0nc7^?sAwfodLi? zlzscHSAL*pA`6ZIY{vE$SeTT(ulCJ{m6eOwY&$%9ZQ4C$FlGF_-M!)0M+*xlP~!&iLhhap+E5haINS28D zrBitlRuC(aw|ANBN~A40D{~n+E9Y`bNNGsBHEc?dsN&@Xk^>RCS7nY)xcpqjd5yFbESnaoG>vm=Ds+E?BJI9rKteyxO3AGI=2=_EIFW}p4aEw~>%hvGefCkcx%}YhlB7YZa2@qqO1B{IZxR}mRA_N8f%#S_iH4iEq0RcRUY*MjYc z)*n5+0GJQWFLnyuh~Pa>MKYYtvM5iV2?IO}yD>fM(=Ft4&^aVH;uCpV{?GIwTM}CC`jvw{rWZSZ>@I>G_h<2JcyP z6RcPY0nGL_97#@TM#_81#v(`7&=~GbZ!oRC2v@^lgP}g6ZU4PYLVGw}HMAJU|Mj{eu?KH|Ng+i&(p6d69R^fRa*KeV<2HNwiV3q`D_$_lN& z{8b&j<~^9)z-C4hR);#J+Cvny1qboos{HG{cVcr|DvDjV=u++UYIHBpxJxhp-LN;& zV{I%{?m!_DDP%4qQi!wYdog<9cCI|MNR(`{izfqFZU1cPxaxz64KlJhO?_*7&3>JbO!M8l7V-Up%|qs@Q2Sq5|k|5*H_~WV9;wb zJ1+(CM2`_}6C;#_1DaNNT+pKuwY5~4XR&!;OHmRBNH_!F73Bs|w4} zzszGF_bOVG<_1)f93#KGiV#ipvbp)zZe zlcv3p*H~MQt&aN332~_5a(#aiUnrWb37{}%qI2a$^d@!8cjBYG;C{#OBHJckil=6s zgOFLw*VLy@Sw?uzu|Y`Yj&wfBVv+l~liS3myG(LgadJU*O+FCK+yQ`e!G4PCvM0|x z9LIVMiusL5;E*LP0+avNQR(zgj{;nx(&;UOh7U0Cl!!Z0@VxG+Vs`1Pf+4y--b z1PkIfLLXubq$^zEeR*{AmhBcC(5 zGVxm3qr5dz`|DSC4uY$9?8-r|Ttfr8Z_szehkB2X)TH`8mZ zR{F5Gud-6fXx9o@un&Ujj&raWrb^1awb`@UKQyywnx^DrFDMbJ^=26)$%Jqh2ty9A zW;%qxPYM2#Ws|fr-b#9lP(ie>@hc?UNW+`VSu$LJzD8c!V=cjW?`T&L;ftN1&8is6 zrjJWWV;*i!$hyT_5G%TR!)dy<*c;bv^{UO#cb`JU4;v0`G!zbTj4g;)&z#w$pHcYd ze!SRd@scn{JVCuu4?#0ml-aDzY$)}J$>_Q`F7(`#++yQ2>n=PYOjy=%je5K3Q;1m= zb%OgC`H-8`RqO?f!+NJlG2rflAjg%27=E5=B7YpYJYlY1;Q>oN=GdrsO(H^Ggh?2j zIOJ~7NyPooYDO|W$>jjeh?C@et@JXW7xOtm2n= zKa6_M)D=7O!Ow|PMW=T38)RkqJEeP3=_<>8U}U6qJRcoYOtGQa z&}uif=?<$+^?*CAwT1P>h&$H*G|^zz|09t%64)LGM?~$rA$pWIX0V2Wbs0T^N6m6j z?0>L?W07*N&;c=k-)B2lPYn}x*Cfffz}X~NxLBML??B@u?kMPO9R$3 zRX%makN;ZqxX|zsY?|%8>DyseQxM|1PGGq%wj-B=@vn#c^=x<=x@~u5_oRX7hu@ic z6H+lT;F^d>ua=Z6Q8&3o6Nv02!(?zQ$c&FCSFA_AL%4TeR^LnID+!e(1zMRd3PB=W zIa-h#0^TbyK|9_?@Ji%PM}92@CJRMFuGh4#{n6}|WDj>}X3lNTcM#%%5~h?Nf^xRPr*6PkC{ijy zy{`y(ER7`lW?lp%=r%Wb(d<=e)bs+2#6ve?M6DiZNy9UU(RSF4F>4>f< z`dWc5e=tChZ|ne15B;J5#Z&FURel*Qh@uNg!?i^t6y z@!zYVnMY}*{g4LE+e_5#l>g$S4xUJAm~0@1MdDd4LIQ^a9g`YJL0>}d5p#Q9TQnOl z(SEM&%{SM}3r3WVE~S->2r{RVnSIwKh`$nafgcs8@flw2WV4#GW{xUJ7K|GIUUkH} zt}`~|gbY@Op*fi021+Db=IG~3Iz|}Z+>HUDeD{}$0OwgJ>{u-(g(AMxb{^Ukd6MdrK<_V-BaK^uRfixOJaE&f4!0kfko(yAykRV12 zK7==f*DDgZ;|UrbzV7tyqsDa=hlqiE8gR;!Pct$j#u)V(cd)pEgw%xJm4Nfkk`KIQ zM;;_w95Xm6^u!lLducB78mu=+sD6E$J+(2|#M-s73?#R_00TgFkWSuRhHr6FU1CWb zGbHD|=+{O;4M-H9bjy*TAxK^N+?8=0`TqLIW~)~#2T{7=93;W@RvT)9>M_Jz{L){S zbHr%JdgLxRZPj-l$+S*`xS zhA346=otzj_iQ+#jY^sL!5{DrL?p5B%2R1H z&H7?0iOEAf=Xr_p$eyYE^*J(?6Qha^1wkQyWFUO6_&ZVCUojwYR`0iuB>V%=q=%n< zmuH)*iW9{eq%3Jm6dagHyg5_-TU-zBHlAZU=~n(jW|cdeAr2Bhz#{x0@wlf>)Oikw z8!%3AtItgxR5H{&hh2-P#~s(nnFs~RNbjEZQf86;8*O1vw;*8ZEtTocQGCKzcohz% zMtqHqm<)E3&N6kAxcnnSL@pv3CIrOM?9$)J`QnJz>RLfx^qfGaaDtAan)tPo)C zUKrBt{*R0Fsrse|rc?kapJ{ZlRQ3Ro-va~u0fC8?l$F3VY6@+^?|ROX2p#nRorOP6 zH<(YxGNP8WC)*cfJow$Q3!^U1`9x4bAj( zVCVjn79@{>X!t^k3>kXIYt?XAHGKF>TF`!#y`hz2M!@%wD`(KB%;dgzN0~ZLCB3yP> z93+Tq&`_f7BRN}Y({?T5S$4IHJp520ln?oA8t5fvHT__}BpPc7yBe9W@z^LI0grgk zPVUkK75u1|*r?{DrWCN?Y^cm4Td*lzny8S><+4@96BFvbOL#%bq_hd}kymeh+^bC2BjPZ+puCG&d{f-(okfmOrcbI%Iny z!dCp&7y$LWh0O@?x&}=mC@qHDI+Cm>i{`3+?`{IIKsDbG)d%q0bWnw86!GV-`cExk z2{9yGT`594fWhK0%=Mf=bY2T1o(DwFicEOlr{Ps{$MvwO6hFGE%fho*0bL-5_+lmL z<7!9HAYdt44Fmp8z^HQ!Ab%J!KfeGF$jKMQ^bICpIqX_ns|4Y(-GE_cW4 z4#}y++}A~3-1`FwP2yJn6)pyUE1Tg>JV%O^9NRe^_{WV{fx0cgo#Z~FH67+Mgb^6s zVgkp7pRNr85kT`{LsxsM`^3paoYzA_|!3OIc9rN8PvtcT?Q*5J?>ZaU@)zVb!_ zL?#KH%Cnz}@nVzq;76!ni;?pu=URv>Ce;IKvy80D}NAl+&1JT6B(=Zw|=LZj$Q zqC-oRLqpw|M+e_+0N^;!b1x*=Uta~=wF3!aQeLYBwi6(inPPF;m2_A$sa8j^fy#VF z8O!$FecqbSd>eIceh9Fzzrt}w_lr(EZAB#ZVZJCsd}<>7r&(!iTIdboyfwKC_RYUe zf03=+PL*BIk&7^xtG6NTo%Ow2$0jPR0A93H^)|JtZ!@bj=eUa!_=qpzU3D_WQZDcZ zh^n$!u9)bGV0m)YwJ+FKkBVOX@c`Znak#ni;3K1scDe66Bi437!6i68_rpb z)!Kc~;#o_=jPHO{oLRCHl?-1NmtgDl04~vA6Bu8PBxl8B!ZbuhwW9 zrDb0r(x!t5jeAaLu<4&spF@;m+Tks85$-Q%WR_>%Ec%{jCcXz6A{&vPorZ#RD;=Bf4q4^AL(7>wX8g!5 zJ|>k|?pVU_&O5`G)Q=Ny-yn{j6DuQCqmfFZjpszlsBWyuHA+o63TWiW?&nWvXm;rR za(79>+I;-{63M|+2*|Lq;_wCK0e-RdLN6z8KCD&F{wqz(0T;GcFPH~w9GQ1IfuBr+ z3rgLCP$IjRw$Lm2Kysdh-U14e|J`;r>}%Fw5q=FPRC1^sV>~Xw(-zJ_kP%x%-Ag5& zWWsyh)sgh{?j0H8Fz+jI$V$m!?>?ayct@RenYFkb-2)d}!gazLq!TR|y5VgzyvP+= zVD2+LiHPc$MN`7-IYHsUx@i|E8oA_%xJX8kY!(lM49W=wbg=9Z_AwU52apTs^pR(X z7tuO6?*ZdSAS6hbVumnBKcu9`K8A+9hIC)6g?b0XjyHiXtdL{4=1zlKa?ubc?YWB3 zA9I7aucmLb>*?4DG2F@W$S#biIZL7M!Iu!Q;|;$|;@@`)jN|Bxlz)JnN5c3t5v<_m?QSuI+UIK%vkK`aoZ1Nk?IehCx*FNl{U;j;M z?`=*N(3FH$(gD?gqIZ%Z*nb`;M<&D@R}NW)L;Tk=ss;WU&v9UpL8ku-ACzg)G4Zm# z#?V&6A|$M|5INq|`cX+Xnb7u!hNRHg9G%2(HJOpaG;&8Zzo2UZT=}W89Q^7$RQ*&Z z89g_smxdRrzDD_V1nothBJ$diG@|`aw9?3f-hN6lSFD|W;`kM=aNqnEn&TW;$8pPr zS}CT!mQ~3n2Bm2S?%c1*c#MA8L%jF$6jK$K*xLSd5(6QEqXl$Cg&MexYC~~%BN4oX z2UflmDUa46T5*YOtTo4mtx1G(0y14x^NcxFh`=)jjaWRl7V zZ@dl=1{&B6$*EXe;#6)o1%2?al8PK6xo)ydKVXABSiJTHs=f`jNTo zh+n@!s3<#tHfNW@N|=%HJF-N#%*;!QxK z8kyPO4`_c65VX0l>2t^|U)CbA6TKG8C$^}CiBTdECctX3QaAdL3&?F=aP>FkaM7s5 zuzP0UZ1rNxh6bAPye!)29>vp3hswE@feiHBUAal{pgdowwe?9boG3S0OoO(*plO=u z**kM%6~&OCYW7zK@AV+L8tY@4hniEIi%pTAhpV9;q}KE&^cO_?g@{CY2i}JtFvO0u z<(U=Xx!5^1CdC;?IGY|^o}kesKk(AZ%y7H*COx1R+Mnv}9$I?ifcH->^ukcvKjRTtALAnd&?`E=D-Ip^}nT?H_Rl zz4X#X5p#7wiOiP(Me2JkG{iO+oSgD??~SloNnJD4{wuI%|EgpG*D4dT{0ww4rskyi zM0`O&(lDPug|a7yPJJA4pRf#?=N7+0uDt82%XOT*r$vjT&Wr0PjEaw-PjvSQMZ*uDp@`pj+b|*y z(s23_TEL@*{AcyFy9&1-cXFVl%epq=87ys}$15|FE6BsJ34;~E+`3*P3eH?|j51!H^3 zaA$jLVK^ixZ17f5#?d5n9Pi#G%ewTX2SL^=uOxfS7$}pnY$gIB-4u-vcj=is~yvD1(myi7gagXM=BcT(e>p&-z=A_$u z-`cL)cptyFn!p9v}Zqd>Y=nVOfZgC>BK^3{ki%9UwXuRnd>JQ8>`I& zV3oaz#=vGMwS@ok2!y72#3C5+k!!;YHzBx1r!OHDMkuzz1Fcn5qTh7CtL2PH z7n&LQZt+4#rn5$D8%Y3V@uk6RO;=&q?b4oOQ8e;Vpu%*c7kQC2(&Vdj(#}i%qS>=m zWe^?02qhyKmCNV!brK{?HVhRvvo@DBBkFG8AROoo+U2^enJSq4F7#d?+Kz`w&wo~d zN|*2W{eO!*X9puN$dIULq-rKP1%!EhWdps|_ZUz8)jVmx7ORj4J3d}vxIAq1?-CPl z^YYwe3(bmx2tyQkBr+N&MMb+p>r$$*D4<@okde9zk-K9bEbp(02phl_nHCM2n8NHc;uA!7Xeq9^On*? z7)UVKQQ~r(hRy*Nr?EO)WdMv911?>Lkey=s-4u5LL0d-90klJAEQV{uS)YazIe0C3 zH=DhJ{JhV{FOZSl%apBvS+qur98$xy5Yg{f>Ff!j@9|JX4_cQ(FOMc6T0_hx$xhj5 z;N?6ILdO8JwpANFoFd{<(16Pr?J@rtM?Fb1_S`lWojSh3x{bY3n3vI@r}Cz0_tXe3 zUJEQ%@~TQeP&^|jkeoZW62?_RP|rJui)u{w3^D`=QmN+L57}JQ7sX zcSk{@ePL?I1);*W#tr&r3aS7L`>ZD-tE)^{?9r^_ z(d}*Q=}8uN-KC+cl@N#;40)AA2RX)4WZ)E$h#o24n;NnDNQ&(052k9Ycygzn{?tdu zB`^V3aojr{lT0U8psWwQ9O?Goj#cL-HTsAu+|&A3i8*(74j|(@qsvu=1@jW6bSFl++!vc&IWdTw||k8F}v& z_Tav^Yvdmjy%_0w>$V(7?KP6@zf$=(lwu1G5w%s!IAJ>S83B|L9fG=~4OrHR;E~9! zJe89eusaV1PH~*lRM7Q&Kdof}35b*U2ltx5_)_iA6GdIM;4y(!wlOOSQeVNFuR6hE zeQEb?#wcK^%M-urr9BYw+ywTe)SGi`@_8Y#lsA};@}ai;nJJj`Ai4+*#14J9q%~i` zKs*!?)4R^oCpad)yE!pRJ~`w8GC_LRl&Y$raRc``dSK6%i)~|GUYB&M_XcEduDbXa z^7U1g37{6$AWkQHtfJO4P#gmu^7q5K1$%&Rg$d6ATN!PJ#-amiDHzFQ(WfJ zR_8fRPkl_$cU#a zc*u037BPHEiwHE!Ab*t!{BG~y2{VIadwC>iYzz)S9~l?I6TZdZ!<=Dxr#$#K2nRep zDWGXe$0JdBOehv~+sVHGLWH_z7{!JJ1s6~c^A&tgMCmpoP(5HvsSR)spw?gLuEI5ygilF~uP)&HomGJiYz^2<#MiiP z1cDxLH7_$K3OVKVz}{WzXr!(KZ2Kn z2*@6<995YDGs_H|ALiEJ3_5)oQak28g?k<)tRhB>+bA!uYx1(QG7^S9rNp`mRznI9 zv!@*j(L@dEDe*6WL0AiQqqgFow}qoSU0IJ!Oh>sy#fw@N4}J3e*B8?3V{=VK@W zoGN&wAXkcRgjc>N(nLhScYr4ad6Rla+B3TF7c@UsDHY>ZGNgDMQiFoi^(ZNmTMY@A zW7uSqd2&rhM1+Bv<0yksG#MgE*$LNW2zFlp`gpjcqTWC?wB?q~b-$x>!xs@HC=TSb z-hI7?leAIrI2=hf6A9|w0a0@F+`b{zhy&@_%}9x(D%uGD-hIW%iewv);IwGkk8&Ps z2bR?T=o;R@I>0f+Y!`~)wfpOn4Kjs*-$|f%oCtp9W?I9$&yCDUSyQ zz0G8jfdO8H#h9*lSqK>jVJu635qxdjMYCpP>E@-#A4Jrxsqman{ zfuEPryF>4Z4UrdO*S3M7V7z{LGX|xG4)T({M#2uyrm~?W+D?Oe3o!;uHZ`V@NL!iO zttu3r(@n3XNwEfPoMqw3R@U^=5*Qn>%Iya z0cBG$go6egVI$v-N(5qMMr<$yb6s8rhY}L}W)78!WsF#cNr%LQ)s~ zGz0x~p|2u)L*6rU8^KG8G!zFSjy5wQwDDjnlw}zcvwk<)SfT*8*f@^^Jl%+Mh(w5- zvLwCl;hqmi%r_=nEG%Iy6avk-+~jVgelqjTpmFItB@RjwH!*B;Vk7E;$&ogacZ)iC z?3(CS>U&2ZP}tw!tyJ)M+a0*sYI zBug4a(6C7H1ude=H7U{r#z4JrGp=(wI}mswTn(M6-L>)04;tf0Li6rXBl{u9mo@la zO)@bBiyaE0^vD$r^r5#(?qPsupU(}2j&898*LccU@=wqoH6aI>6*I2=wnNRZu;LvmT=f*g;hw(Zk3mut4SXsCFPC9NKT@noC@tsDz_dkIh_RXx&JA`g&&Nu0= z($80+PUN;$+|&;kH>fGpt)AdqV^WPq(mpN3Q{qYJS$udf$bW(4HPXVwF8D(kMVxY> z!s>0Dqoz`zPRw{@6r;*kA--mswG|5VO+m!Q1hgw5`cH9Y2wGpI463xoZYa#NL7o+3 zVysP{E=4#?1vb&eH=#J;Z*2TU(tn&efhv6D9lx|?_!hO%PI|XmwyBbFE?19= zURXh@jTr+%yGu&~`eFC=S*^4Ed1{UGlC64izk4S6c#a85gQ2i`Ii&|;_W^=eAa0Vc z8C>l)!4PRQ!lj4C7EUQdY~Fjzj9aE4j2C{QkL#7)rba_K;x1(iEJ3fBOl9ww1wucc z$60EJKF-A-n0^UzqaMNmqs6J-1$y_2H;9wmYJ^YifyH9bpDb9JJ=vMe zo;`c!_k9aP<5iw7JWd(Z-&;Cv$kdhg;u3vH{0ns}axzP#xwHrNkN95JicI=}Y{Aat zINgM#;8Z$Eq{E{)h#<@Ncs2w!yLJCHaDGu{#0abbF31xvM*ejZ?16G*H!O4nsn12k zThZt+_NRZw#`Pe>1*=Y;vi>EI33I>{h#`%-XSjKM{MzCN`7x0?pl`Z;3@(-pp7Zlp?270S6Kqf?ax zF3T9kyi90xK5fk$u`S=`^p3?w&K!ET(u3vsYyCC-0K&`s94-yRI-`}pXGvlu%h*vj zIT4RWMPif0TScc}OkWve1>0_?Dy0@D3^T(P9}Alp@reI&Q44wln99?1Q5*nUe&~^v z2=D;HKiReZ{vUV7tK z9=FOsTtSw7i2ur1jU1LM6d5gZKVYqm=K~0}4g=(W)WX8T02jy_ZSUYfjRg37Euh%Q zrPbd&;~bIW;OT$&&f?o5XkT`|E@z6TKQ-qewJESCfZ1zmg^PL6YR|_N&D7#ti5a+1(0y5 z>L$xp`l=nVF)h%-oX8W&66{%5`WaKTdw_6X#hf_xgNFq*`Eww7 zUh|7Tz_X_%d*8jEfcc8NPds6(c)HKIb;n$;uduPiPsq49D9`j=kmFA8NKyv6d*|x* zmP!RBg?Ya7>qR8JS=ArL$6M75o?~W9n71={evEP*C2t7n5K#e`xf>Gbb^vv&qO11@ zY{%bM>XASjO5PhrZ69rOm7zi`@<|vaeQeB`v4E-RxC3*!MNYRH29@z?~KSQ<}+~E zsCKjrT*=*MmVf?@0&OeymTkQs^O(uA>?=4uH>l#1RjXPqjZCpptq!Vs6mz8M2r#FKr@&Gkzanp(2={apD(gKh~&4#ycJ zH&mTzps&Pj^mK_@rm|_TG_&`7T!Yt#i%iuWtQ_9`KeYXB+P&$n@**T!hG-8B{}}Rq zv}vE1M+-iR<0p;Lgvo4KB{^p_@FR0!>(*Is_J%^LLDEu#H^H_c_^r=5q$Sj3$878z zEWayLN#xSLhVBgO1NPrcwQfCE$!hjF1Pk?and&av#6A6JnP;rpcZYviQAzgw z$?E~GWhFeTTw@sosz9gx#B3LZ-ah9;h|E>H*F9t0qPCz-p3tgXE?MUo?qLb;o$a(Q z2WLcl?^@>KHNpR}zceRBv;-=2!dSm{WxCYk=xVVZ>5)^i-Svg9!IrKTa|oRwDG9O5 ztfp?&)VaNFhf$f~Hy?2}imqGZ7+)2j))@v!?oFjx^%}AxBKY&rTAU-FU~5>0t8HzD zx}w6;pXU|j-`w7>1@jTD87Auy z(cAL)LgS6=HO&`$$m>2`3LDn_MVAL@^ddx?xCtlhXEGdiaw|60elwaq04FYcR!+vh z^jSt-=B&i&y<*j*Jw1f?1tIHgXQ}bWZ3S&FdmbBi<+R-qEQ*c83JZl4>PX(}5MUG) zF%Kp47b>66>rSe258CmRL>_7J^89j+w~q+NEhp#7g~t|~LLJBKf|P$rko%ma=S_#A zJZhJ6;EGN9w;mG_`0-s_Tlim;gnIdg?CVqQFTQ^GS&AlLh8|GmdZSh|JRT(Ho5^e(3Nr=KFR&3T!66=1?T*c}Y>Qu|XD1+A!)GWG(S3-ZADvsbJtkG3dQ@<3lWG)JA|Cb}&X<-) z2KYuQ4Q2-3vlC5awgz8!&0H^I>Fe9LF&t*;^`3WMY1P-+MC$i#RZ=+_9{cHR&@ zCXH&w$;xyDGA`bzUoPeU{n_}X)Gm&X>pf1duy82(Y{lxcj11|`gq+k^|5@`+DN~dT zTmW2SXS6GqrUxIQdhX=!&9Z$CFHFESjQAF;0U3xWgK$%~N&evESN8+9=5EJ2n1fk+ z!dH%!_9TD;r*O8``GB6ZcFu=_KFqA*%Xe;PuDD5B9Ozsj*VK>UO)>TL^)N9|&$N?_ zg8J*I8fEmZ@@&~ai9fp+t4AhAZlbg2-LIv?EG4y?AwzEXS@82+G_lACq-6R~)i8LI zgDBV6I|D45+&j*0ucwXI585xva`x|lrg`MwH=bR=sS+|E{X2UF@nYvmj=i<((yrpR z=;8YOAX$p@7U6f~?6_wSd;wvqy?cf(g2Po$=^z@8J(A&DlLr3LC(~K+|o&SVFF^J@Fd9#g}#C%ejMd0eT+UCC`4n z&QVxkxq01Ew&{y12l(yqPP7Fw0Y)B#B&9334M13TU$(*NO>0Nz`a+$vdLk0D4a`Zk zb3Hjcq{Q~)(U&}j&J343Ha5c_Nr4iAkq2v+w?Rh9l33K|9ivYKu)p0{wU4Xw{2#_k zoJvN(#T5Z!RHWi#{iGuQ2yjEE%zS=A0WtFBcXwj1&oDDp%LB}Du{}+|E0wpa&dO!D z$UnTZvy=SF;EA`m#CqHb+gd>NG(og~bqbv%TqUR@T|w*}$dNSSEJ57#i{!~vWh+vu zHkLpy-LZExLunL3Vmi~$20WNyqy%|4PtxxK)s;8lLZVW^#!Ah^H(VoPYNt!OB4w#B zUzZw}<~0RZ3t9dVwzX_+b^iVR6CaYI`Cj3zNz=p!HKq}cr$mYAM2Kan%Do-!KFG8Q z<~BIXzhDI9GvU-8w&RH>15;qv%HB3;a&d7f)4ji76v0Y`^$31Oa4bveYw*SDf8(80 z!(jm|xN`3Nd1IrcjTY6NzBT_Z?KA~o9)uQ?1BGS5fFOcngn7+bt8n8_IytxWdaMO} zX?Joac3gVwBR*mryD(Vvp%<}_HM?I`Y|HMW&z`Fm8~^|^2!_okRgSh&-{dEg@WaPaFPd#nwot#8WT~%r zhymq9E{m5QREv(^wj&DEAnl#n{yyQKk-xfY|I>W&pJqP)dwEUF&mxdbB0#<+B`*>d zr=M6S_VIyVZZHWC)I9|VgW;OJxm!HTKr2uSCTk_flEUuM54|zw107a#zidx(@kvlb ziSG;t?7w6~|5OhB`)e5h%Dm=5k8sZeN(@p)mfYcTj%BIMD8;=VS+k%cz_{rN;rTMQ z)zSyo8!G_{I`?r%yWj5$Zi%;buXZ}E!UF-B0LDO~iVV)S;>KX7d+|*>|2Xy8baOJe zM8v-tvyMA_v6}!%!okhu(ZSOCt#6h!I}ODJ#<^$DpSN9B$#?O4etSF=ovK9gs}I`@ zh}s{UF#41=V})8UOB=qRm;#(?1c29mgVa-ywICP@H9{f+COM&V;XohZvrj6u&FOF< z^wC%esp!PMAiMx!tjv9)=8-d-gaOA`{GoeCzQUvmi9!2TL^8LGXXa?8>7O+nhr6A6*v2AKu+-N8}&9p0XNp#D*@e16jmW zUC7F!TF{S4u)|=q4G`aNzONp+n3cESb?V-F<$p=2>$qL*l8cO5JEOjycyIouvKN@^ zd#>6jmH+N8DK3Uq*mIK%U1H-mz<$982=6V$H8cNh=mXx6`@lD`Ne1mU?GUkPaT}zQ zvwxuL7T!=F8_N2tko{tSt1u-(2oYYZWF#GAcUI$9(^1fIAjqpMEozrDey#;TZ9nCLf#hE#bz+tpf}fnw#y&L z7lOe7h5KNvB!iaoXx;~92>`h2G0sC!wvNR@QRo1$xsfK|0{jt{58gIHLmZ?Y^bz3J z+>LCaX` zB)W`;@km-NMP8dDz;@#A*MS7)2gjrJEJ@N0RDAYwAovD3Z923%FJY(S>lLw(O0bn5 z-xgLR0zuSh5OoQGz#(f*^EXERy&4-SOc&;V1IV-#?{`uyF6N|Khk)OwW28yFt$dU2 z=cl}^&KLFXrtJGDtZsK50#WJs&5@LHB z=+ttAHx5B0r)HY2SSsphBaZ^Mz!n|uOwn=rsU1seD;!Bg1QX1QOwd4t;Rkdr{!s_h zLNfOJoJ*(88iD!IxEP{PfuC?VTSPmT*zt+Nk!LQ=%M@}+>opV|^w}|pBL+Bx&Sn^2 z0hSU+FGa9-Rfqw$I0~=~df{a)Z9F6@qLs;hx)pB4KXw{M)8h5SKB1;+fVMGbHb%mj z_O(a@VA{9T>mzv62Ar%f$4I=PKi&YI3~gy!FLI71sKs0p^-MpXD~D!Y{DX91*0|na znBjy*t^S|wkUR2QjqfV-OdGaM^$AWip)st5HkR^TR84^iuif}wzm`38r|hBAsow?R z%2HXEyH0J>=21XXva-4wxvj2Ff^cTk1HL%LRnSlW#`o0@Ab=eTHZE$2^+B=K#Y!th z@sVIwuJrp!Bj3M#diUwRwy=j5;~8#+30R0UUwq+2)bD!8*5l1bK3jW*w{E}+wlUc- zxwC8-Gxg{5Wc}s1Kj8S&Bi^17=n1O@` zj5j;NyQSk4>{Kv}hlTjY<-zu}dP~HK%(}o4=LG98+3X7GIg z3HPZ14xM4LJL|rSPb!~EncJBpr8Hci16+P=GHrJ%K?wVZM)!L7Q&!z_06=@a0{r4= zOu#Ez;>uku^YQSaW%eH7r?sC4Ht)GcCQsc7q6zn_hqBa?L*eqgxEJ{5>BEuCJ>o9= zP3c>)s;^Qf;1&jeQ5=C}uB_*mSMYTd(+nTxk4-%lW#D zFC#;t#r{Wb6 zev8bZ^h1VjML&7`i9XR>k-*t%!_dU$-3rfB4qgF__WKAh#9EdRc?DlFh{gI8*Bqo_ z=#~U)dcf#8uMAS8&-h-2ia{d`Q;2}>u>oOrZ|S@~ryavW=MZ`okK&h#NUR;4!;)SF z9i5S)834Ast9GlcZdgg}ob-@aq=(Cbd5lF()@7^h?x)K=43Ci42nNOs zjbM{9bVq4PX32!3f0aX>;0|doHW7E(&jEhNWn2q_{%bz)t#HHQ(W z%c59uL((2}Bgo0K2f{KShk;A|cU@-;;7ek@V2!xr;or;4VBH1Ml>J{{37-hR8Js;* V8D+;TG=ZU+#z4;mS*GI@{SPE!&I$kk literal 0 HcmV?d00001 diff --git a/education/windows/use-set-up-school-pcs-app.md b/education/windows/use-set-up-school-pcs-app.md index 512add4af6..855a3279f6 100644 --- a/education/windows/use-set-up-school-pcs-app.md +++ b/education/windows/use-set-up-school-pcs-app.md @@ -25,7 +25,7 @@ Teachers and IT administrators can use the **Set up School PCs** app to quickly The Set up School PCs app helps you set up new computers running Windows 10, version 1607. Some benefits of using this app to set up your students' PCs: * A computer set up this way is tailored to provide students with the tools they need for learning while removing apps and features that they don't need. * Places tiles for OneNote, Office 365 web apps, Sway, and Microsoft Classroom on the Start menu - * Installs OneDrive for cloud-based documents and places it on the Start menu and task bar + * Installs OneDrive for cloud-based documents and places it on the Start menu and taskbar * Sets Microsoft Edge as the default browser * Uninstalls apps not specific to education, such as Solitaire and Sports * Turns off Offers and tips @@ -65,19 +65,39 @@ What you need: ### Create the setup file in the app +The **Set up School PCs** app guides you through the configuration choices for the student PCs. +1. Open the **Set up School PCs** app and select **Start**. + + ![select start](images/app1.jpg) + +2. Choose **No** to require students to sign in with an account, or choose **Yes** to allow students to use the PC without an account, and then select **Next**. + + ![account required?](images/setup-app-1-access.png) + +3. Choose a Wi-Fi network from the list and then select **Next**, or choose **Manually connect to a wireless network** to enter the network information yourself. + + ![choose network](images/setup-app-1-wifi.png) + + - For a manual network connection, enter the network name, security type, and password (if required), and then select **Next**. + + ![enter network information](images/setup-app-1-wifi-manual.png) + +4. Insert a USB drive, select it in the app, and then select **Save**. + + ![select usb drive](images/setup-app-1-usb.png) ### Apply the setup file to PCs -The setup file on your USB drive is named SetupSchoolPCs.ppkg, which is a provisioning package. A provisioning package is a method for applying settings to Windows 10. When Windows 10 refers to "package", it means your setup file, and when it refers to "provisioning", it means applying the setup file to the computer. +The setup file on your USB drive is named SetupSchoolPCs.ppkg, which is a provisioning package. A provisioning package is a method for applying settings to Windows 10. When Windows 10 refers to *package*, it means your setup file, and when it refers to *provisioning*, it means applying the setup file to the computer. 1. Start with a computer on the first-run setup screen. ![The first screen to set up a new PC](images/oobe.jpg) -2. Insert the USB drive. Windows Setup will recognize the drive and ask you if you want to set up the device. Select Set up. +2. Insert the USB drive. Windows Setup will recognize the drive and ask you if you want to set up the device. Select **Set up**. ![Set up device?](images/setupmsg.jpg) From a7221a902d73f4921a8d8e193c6b846044cb8419 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 24 May 2016 08:19:45 -0700 Subject: [PATCH 396/439] add link to CSP --- education/windows/set-up-school-pcs-technical.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index a93a867cf2..dc9d74d077 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -82,7 +82,7 @@ The PC is also configured to not interrupt the user during normal daytime hours ## Provisioning package details -The **Set up School PCs** app produces a specialized provisioning package that makes use of the `SharedPC` configuration service provider (CSP). +The **Set up School PCs** app produces a specialized provisioning package that makes use of the [SharedPC configuration service provider (CSP)](https://msdn.microsoft.com/en-us/library/windows/hardware/mt723294%28v=vs.85%29.aspx). ### Education customizations From 6848136f4c6b620547075114bcedd26c7541a2ba Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 24 May 2016 08:39:24 -0700 Subject: [PATCH 397/439] remove uncaptioned video --- education/windows/set-up-students-pcs-to-join-domain.md | 4 ---- 1 file changed, 4 deletions(-) diff --git a/education/windows/set-up-students-pcs-to-join-domain.md b/education/windows/set-up-students-pcs-to-join-domain.md index e0634038e4..32b42572f0 100644 --- a/education/windows/set-up-students-pcs-to-join-domain.md +++ b/education/windows/set-up-students-pcs-to-join-domain.md @@ -18,11 +18,7 @@ author: jdeckerMS If your school uses Active Directory, use the Windows Imaging and Configuration Designer (ICD) tool included in the Windows Assessment and Deployment Kit (ADK) for Windows 10 to create a runtime provisioning package that will configure the PC for student use that is joined to the Active Directory domain. [Install the ADK.](http://go.microsoft.com/fwlink/p/?LinkId=526740) -Watch this video to see a demonstration of using Windows ICD. - - -
      ##Create the provisioning package From c9127db0867bed177ed7c05fbfb22ee88ae84b4a Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Tue, 24 May 2016 08:47:55 -0700 Subject: [PATCH 398/439] fixed typo --- ...nfigure-windows-10-devices-to-stop-data-flow-to-microsoft.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md b/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md index 7b24cfdfbe..6383bcab54 100644 --- a/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md +++ b/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md @@ -1083,7 +1083,7 @@ When turned off, the Wi-Fi Sense settings still appear on the Wi-Fi Settings scr ###
      19. Windows Defender -You can opt of the Microsoft Antimalware Protection Service. +You can opt out of the Microsoft Antimalware Protection Service. - Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender** > **MAPS** > **Join Microsoft MAPS** From 4126ec8b61e7042e937394edcdb8f78f09a63e4f Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Tue, 24 May 2016 10:19:18 -0700 Subject: [PATCH 399/439] changing lsacfgflags registry value --- windows/keep-secure/credential-guard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index cd7d9d5707..45c0237c18 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -169,7 +169,7 @@ If you don't use Group Policy, you can enable Credential Guard by using the regi 2. Enable virtualization-based security: - Go to HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\DeviceGuard. - Add a new DWORD value named **EnableVirtualizationBasedSecurity**. Set the value of this registry setting to 1 to enable virtualization-based security and set it to 0 to disable it. - - Add a new DWORD value named **RequirePlatformSecurityFeatures**. Set the value of this registry setting to 1 to use **Secure Boot** only or set it to 2 to use **Secure Boot and DMA protection**. + - Add a new DWORD value named **RequirePlatformSecurityFeatures**. Set the value of this registry setting to 1 to use **Secure Boot** only or set it to 3 to use **Secure Boot and DMA protection**. 3. Enable Credential Guard: - Go to HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\LSA. - Add a new DWORD value named **LsaCfgFlags**. Set the value of this registry setting to 1 to enable Credential Guard with UEFI lock, set it to 2 to enable Credential Guard without lock, and set it to 0 to disable it. From fe3a71b6eb10bc93ed6d52ed44bbf51e94060e20 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Tue, 24 May 2016 11:31:22 -0700 Subject: [PATCH 400/439] fixing spacing issues --- .../keep-secure/edit-an-applocker-policy.md | 53 +++- windows/keep-secure/edit-applocker-rules.md | 19 +- ...r-accounts-to-be-trusted-for-delegation.md | 94 +++--- .../enable-the-dll-rule-collection.md | 19 +- windows/keep-secure/encrypted-hard-drive.md | 43 ++- .../keep-secure/enforce-applocker-rules.md | 13 +- .../keep-secure/enforce-password-history.md | 85 +++--- .../enforce-user-logon-restrictions.md | 86 +++--- ...port-an-applocker-policy-to-an-xml-file.md | 11 +- ...le-system-global-object-access-auditing.md | 13 +- .../force-shutdown-from-a-remote-system.md | 89 +++--- .../keep-secure/generate-security-audits.md | 91 +++--- .../how-applocker-works-techref.md | 16 +- ...w-to-configure-security-policy-settings.md | 36 ++- .../how-user-account-control-works.md | 284 ++++++++++++++---- ...personate-a-client-after-authentication.md | 104 +++---- ...-applocker-policy-from-another-computer.md | 14 +- .../import-an-applocker-policy-into-a-gpo.md | 13 +- .../increase-a-process-working-set.md | 83 +++-- .../increase-scheduling-priority.md | 86 +++--- ...lize-and-configure-ownership-of-the-tpm.md | 126 ++++---- 21 files changed, 840 insertions(+), 538 deletions(-) diff --git a/windows/keep-secure/edit-an-applocker-policy.md b/windows/keep-secure/edit-an-applocker-policy.md index 725e1f5ac0..2faffd200f 100644 --- a/windows/keep-secure/edit-an-applocker-policy.md +++ b/windows/keep-secure/edit-an-applocker-policy.md @@ -2,70 +2,99 @@ title: Edit an AppLocker policy (Windows 10) description: This topic for IT professionals describes the steps required to modify an AppLocker policy. ms.assetid: dbc72d1f-3fe0-46c2-aeeb-96621fce7637 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Edit an AppLocker policy + **Applies to** - Windows 10 + This topic for IT professionals describes the steps required to modify an AppLocker policy. + You can edit an AppLocker policy by adding, changing, or removing rules. However, you cannot create a new version of the policy by importing additional rules. To modify an AppLocker policy that is in production, you should use Group Policy management software that allows you to version Group Policy Objects (GPOs). If you have created multiple AppLocker policies and need to merge them to create one AppLocker policy, you can either manually merge the policies or use the Windows PowerShell cmdlets for AppLocker. You cannot automatically merge policies by using the AppLocker snap-in. You must create one rule collection from two or more policies. The AppLocker policy is saved in XML format, and the exported policy can be edited with any text or XML editor. For info about merging policies, see [Merge AppLocker policies manually](merge-applocker-policies-manually.md) or [Merge AppLocker policies by using Set-ApplockerPolicy](merge-applocker-policies-by-using-set-applockerpolicy.md). + There are two methods you can use to edit an AppLocker policy: + - [Editing an AppLocker policy by using Group Policy](#bkmk-editapppolingpo) - [Editing an AppLocker policy by using the Local Security Policy snap-in](#bkmk-editapplolnotingpo) + ## Editing an AppLocker policy by using Group Policy + The steps to edit an AppLocker policy distributed by Group Policy include the following: + ### Step 1: Use Group Policy management software to export the AppLocker policy from the GPO -AppLocker provides a feature to export and import AppLocker policies as an XML file. This allows you to modify an AppLocker policy outside your production environment. Because updating an AppLocker policy in a deployed GPO could have unintended consequences, you should first export the AppLocker policy to an XML file. For the procedure to do this, see [Export an AppLocker policy from a GPO](export-an-applocker-policy-from-a-gpo.md). + +AppLocker provides a feature to export and import AppLocker policies as an XML file. This allows you to modify an AppLocker policy outside your production environment. Because updating an AppLocker policy in a deployed GPO could have unintended consequences, you should first export the AppLocker +policy to an XML file. For the procedure to do this, see [Export an AppLocker policy from a GPO](export-an-applocker-policy-from-a-gpo.md). + ### Step 2: Import the AppLocker policy into the AppLocker reference PC or the PC you use for policy maintenance + After exporting the AppLocker policy to an XML file, you should import the XML file onto a reference PC so that you can edit the policy. For the procedure to import an AppLocker policy, see [Import an AppLocker policy from another computer](import-an-applocker-policy-from-another-computer.md). -**Caution**   -Importing a policy onto another PC will overwrite the existing policy on that PC. + +>**Caution:**  Importing a policy onto another PC will overwrite the existing policy on that PC.   ### Step 3: Use AppLocker to modify and test the rule + AppLocker provides ways to modify, delete, or add rules to a policy by modifying the rules within the collection. + - For the procedure to modify a rule, see [Edit AppLocker rules](edit-applocker-rules.md). - For the procedure to delete a rule, see [Delete an AppLocker rule](delete-an-applocker-rule.md). - For procedures to create rules, see: + - [Create a rule that uses a publisher condition](create-a-rule-that-uses-a-publisher-condition.md) - [Create a rule that uses a path condition](create-a-rule-that-uses-a-path-condition.md) - [Create a rule that uses a file hash condition](create-a-rule-that-uses-a-file-hash-condition.md) - [Enable the DLL rule collection](enable-the-dll-rule-collection.md) + - For steps to test an AppLocker policy, see [Test and update an AppLocker policy](test-and-update-an-applocker-policy.md). - For procedures to export the updated policy from the reference computer back into the GPO, see [Export an AppLocker policy to an XML file](export-an-applocker-policy-to-an-xml-file.md) and [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md). + ### Step 4: Use AppLocker and Group Policy to import the AppLocker policy back into the GPO + For procedures to export the updated policy from the reference computer back into the GPO, see [Export an AppLocker policy to an XML file](export-an-applocker-policy-to-an-xml-file.md) and [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md). -**Caution**   -You should never edit an AppLocker rule collection while it is being enforced in Group Policy. Because AppLocker controls what files are allowed run, making changes to a live policy can create unexpected behavior. For info about testing policies, see [Test and update an AppLocker policy](test-and-update-an-applocker-policy.md). + +>**Caution:**  You should never edit an AppLocker rule collection while it is being enforced in Group Policy. Because AppLocker controls what files are allowed run, making changes to a live policy can create unexpected behavior. For info about testing policies, see [Test and update an AppLocker policy](test-and-update-an-applocker-policy.md).   -**Note**   -If you are performing these steps by using Microsoft Advanced Group Policy Management (AGPM), check out the GPO before exporting the policy. +>**Note:**  If you are performing these steps by using Microsoft Advanced Group Policy Management (AGPM), check out the GPO before exporting the policy.   ## Editing an AppLocker policy by using the Local Security Policy snap-in + The steps to edit an AppLocker policy distributed by using the Local Security Policy snap-in (secpol.msc) include the following tasks. + ### Step 1: Import the AppLocker policy + On the PC where you maintain policies, open the AppLocker snap-in from the Local Security Policy snap-in (secpol.msc). If you exported the AppLocker policy from another PC, use AppLocker to import it onto the PC. + After exporting the AppLocker policy to an XML file, you should import the XML file onto a reference PC so that you can edit the policy. For the procedure to import an AppLocker policy, see [Import an AppLocker policy from another computer](import-an-applocker-policy-from-another-computer.md). -**Caution**   -Importing a policy onto another PC will overwrite the existing policy on that PC. + +>**Caution:**  Importing a policy onto another PC will overwrite the existing policy on that PC.   ### Step 2: Identify and modify the rule to change, delete, or add + AppLocker provides ways to modify, delete, or add rules to a policy by modifying the rules within the collection. + - For the procedure to modify a rule, see [Edit AppLocker rules](edit-applocker-rules.md). - For the procedure to delete a rule, see [Delete an AppLocker rule](delete-an-applocker-rule.md). - For procedures to create rules, see: + - [Create a rule that uses a publisher condition](create-a-rule-that-uses-a-publisher-condition.md) - [Create a rule that uses a path condition](create-a-rule-that-uses-a-path-condition.md) - [Create a rule that uses a file hash condition](create-a-rule-that-uses-a-file-hash-condition.md) - [Enable the DLL rule collection](enable-the-dll-rule-collection.md) + ### Step 3: Test the effect of the policy + For steps to test an AppLocker policy, see [Test and update an AppLocker policy](test-and-update-an-applocker-policy.md). + ### Step 4: Export the policy to an XML file and propagate it to all targeted computers + For procedures to export the updated policy from the reference computer to targeted computers, see [Export an AppLocker policy to an XML file](export-an-applocker-policy-to-an-xml-file.md) and [Import an AppLocker policy from another computer](import-an-applocker-policy-from-another-computer.md). + ## Additional resources + - For steps to perform other AppLocker policy tasks, see [Administer AppLocker](administer-applocker.md). -  -  diff --git a/windows/keep-secure/edit-applocker-rules.md b/windows/keep-secure/edit-applocker-rules.md index 69c9a61c3a..2f47922cd0 100644 --- a/windows/keep-secure/edit-applocker-rules.md +++ b/windows/keep-secure/edit-applocker-rules.md @@ -2,42 +2,55 @@ title: Edit AppLocker rules (Windows 10) description: This topic for IT professionals describes the steps to edit a publisher rule, path rule, and file hash rule in AppLocker. ms.assetid: 80016cda-b915-46a0-83c6-5e6b0b958e32 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Edit AppLocker rules + **Applies to** - Windows 10 + This topic for IT professionals describes the steps to edit a publisher rule, path rule, and file hash rule in AppLocker. + For more info about these rule types, see [Understanding AppLocker rule condition types](understanding-applocker-rule-condition-types.md). + You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). + **To edit a publisher rule** + 1. Open the AppLocker console, and then click the appropriate rule collection. 2. In the **Action** pane, right-click the publisher rule, and then click **Properties**. 3. Click the appropriate tab to edit the rule properties. + - Click the **General** tab to change the rule name, add a rule description, configure whether the rule is used to allow or deny applications, and set the security group for which this rule should apply. - Click the **Publisher** tab to configure the certificate's common name, the product name, the file name, or file version of the publisher. - Click the **Exceptions** tab to create or edit exceptions. - When you finish updating the rule, click **OK**. + **To edit a file hash rule** + 1. Open the AppLocker console, and then click the appropriate rule collection. 2. Choose the appropriate rule collection. 3. In the **Action** pane, right-click the file hash rule, and then click **Properties**. 4. Click the appropriate tab to edit the rule properties. + - Click the **General** tab to change the rule name, add a rule description, configure whether the rule is used to allow or deny applications, and set the security group in which this rule should apply. - Click the **File Hash** tab to configure the files that should be used to enforce the rule. You can click **Browse Files** to add a specific file or click **Browse Folders** to add all files in a specified folder. To remove hashes individually, click **Remove**. - When you finish updating the rule, click **OK**. + **To edit a path rule** + 1. Open the AppLocker console, and then click the appropriate rule collection. 2. Choose the appropriate rule collection. 3. In the **Action** pane, right-click the path rule, and then click **Properties**. 4. Click the appropriate tab to edit the rule properties. + - Click the **General** tab to change the rule name, add a rule description, configure whether the rule is used to allow or deny applications, and set the security group in which this rule should apply. - Click the **Path** tab to configure the path on the computer in which the rule should be enforced. - Click the **Exceptions** tab to create exceptions for specific files in a folder. - When you finish updating the rule, click **OK**. -  -  + \ No newline at end of file diff --git a/windows/keep-secure/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md b/windows/keep-secure/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md index af9eb0fbc6..b3dcd0cd1a 100644 --- a/windows/keep-secure/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md +++ b/windows/keep-secure/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md @@ -2,95 +2,99 @@ title: Enable computer and user accounts to be trusted for delegation (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Enable computer and user accounts to be trusted for delegation security policy setting. ms.assetid: 524062d4-1595-41f3-8ce1-9c85fd21497b -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Enable computer and user accounts to be trusted for delegation + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Enable computer and user accounts to be trusted for delegation** security policy setting. + ## Reference + This policy setting determines which users can set the **Trusted for Delegation** setting on a user or computer object. Security account delegation provides the ability to connect to multiple servers, and each server change retains the authentication credentials of the original client. Delegation of authentication is a capability that client and server applications use when they have multiple tiers. It allows a public-facing service to use client credentials to authenticate to an application or database service. For this configuration to be possible, the client and the server must run under accounts that are trusted for delegation. + Only administrators who have the **Enable computer and user accounts to be trusted for delegation** credential can set up delegation. Domain admins and Enterprise admins have this credential. The procedure to allow a user to be trusted for delegation depends on the functionality level of the domain. + The user or machine object that is granted this right must have write access to the account control flags. A server process running on a device (or under a user context) that is trusted for delegation can access resources on another computer by using the delegated credentials of a client. However, the client account must have Write access to the account control flags on the object. + Constant: SeEnableDelegationPrivilege + ### Possible values + - User-defined list of accounts - Not defined + ### Best practices + - There is no reason to assign this user right to anyone on member servers and workstations that belong to a domain because it has no meaning in those contexts. It is only relevant on domain controllers and stand-alone devices. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Not defined

      Domain Controller Effective Default Settings

      Administrators

      Member Server Effective Default Settings

      Administrators

      Client Computer Effective Default Settings

      Administrators

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Not defined| +| Domain Controller Effective Default Settings | Administrators| +| Member Server Effective Default Settings | Administrators| +| Client Computer Effective Default Settings | Administrators|   ## Policy management + This section describes features, tools and guidance to help you manage this policy. + Modifying this setting might affect compatibility with clients, services, and applications. + A restart of the device is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + This user right is defined in the Default Domain Controller Group Policy Object (GPO) and in the local security policy of workstations and servers. + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability -Misuse of the **Enable computer and user accounts to be trusted for delegation** user right could allow unauthorized users to impersonate other users on the network. An attacker could exploit this privilege to gain access to network resources and make it difficult to determine what has happened after a security incident. + +Misuse of the **Enable computer and user accounts to be trusted for delegation** user right could allow unauthorized users to impersonate other users on the network. An attacker could exploit this privilege to gain access to network resources and make it difficult to determine what has happened +after a security incident. + ### Countermeasure + The **Enable computer and user accounts to be trusted for delegation** user right should be assigned only if there is a clear need for its functionality. When you assign this right, you should investigate the use of constrained delegation to control what the delegated accounts can do. On domain controllers, this right is assigned to the Administrators group by default. -**Note**   -There is no reason to assign this user right to anyone on member servers and workstations that belong to a domain because it has no meaning in those contexts. It is only relevant on domain controllers and stand-alone computers. + +>**Note:**  There is no reason to assign this user right to anyone on member servers and workstations that belong to a domain because it has no meaning in those contexts. It is only relevant on domain controllers and stand-alone computers.   ### Potential impact + None. Not defined is the default configuration. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/enable-the-dll-rule-collection.md b/windows/keep-secure/enable-the-dll-rule-collection.md index bf0a849440..1dd233aee5 100644 --- a/windows/keep-secure/enable-the-dll-rule-collection.md +++ b/windows/keep-secure/enable-the-dll-rule-collection.md @@ -2,24 +2,29 @@ title: Enable the DLL rule collection (Windows 10) description: This topic for IT professionals describes the steps to enable the DLL rule collection feature for AppLocker. ms.assetid: 88ef9561-6eb2-491a-803a-b8cdbfebae27 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Enable the DLL rule collection + **Applies to** - Windows 10 + This topic for IT professionals describes the steps to enable the DLL rule collection feature for AppLocker. + The DLL rule collection includes the .dll and .ocx file formats. + For info about these rules, see [DLL rules in AppLocker](dll-rules-in-applocker.md). -You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). + +You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer +AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). + **To enable the DLL rule collection** 1. From the AppLocker console, right-click **AppLocker**, and then click **Properties.** 2. Click the **Advanced** tab, select the **Enable the DLL rule collection** check box, and then click **OK**. - **Important**   - Before you enforce DLL rules, make sure that there are allow rules for each DLL that is used by any of the allowed apps. -   -  -  + + >**Important:**  Before you enforce DLL rules, make sure that there are allow rules for each DLL that is used by any of the allowed apps. diff --git a/windows/keep-secure/encrypted-hard-drive.md b/windows/keep-secure/encrypted-hard-drive.md index a47495f67c..884275ee7e 100644 --- a/windows/keep-secure/encrypted-hard-drive.md +++ b/windows/keep-secure/encrypted-hard-drive.md @@ -2,66 +2,93 @@ title: Encrypted Hard Drive (Windows 10) description: Encrypted Hard Drive uses the rapid encryption that is provided by BitLocker Drive Encryption to enhance data security and management. ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Encrypted Hard Drive + **Applies to** - Windows 10 + Encrypted Hard Drive uses the rapid encryption that is provided by BitLocker Drive Encryption to enhance data security and management. + By offloading the cryptographic operations to hardware, Encrypted Hard Drives increase BitLocker performance and reduce CPU usage and power consumption. Because Encrypted Hard Drives encrypt data quickly, enterprise devices can expand BitLocker deployment with minimal impact on productivity. + Encrypted Hard Drives are a new class of hard drives that are self-encrypting at a hardware level and allow for full disk hardware encryption. In Windows 8, Windows Server 2012, and later you can install to these devices without additional modification. + Some of the benefits of Encrypted Hard Drives include: + - **Better performance**: Encryption hardware, integrated into the drive controller, allows the drive to operate at full data rate with no performance degradation. - **Strong security based in hardware**: Encryption is always "on" and the keys for encryption never leave the hard drive. User authentication is performed by the drive before it will unlock, independently of the operating system - **Ease of use**: Encryption is transparent to the user because it is on by default. There is no user interaction needed to enable encryption. Encrypted Hard Drives are easily erased using on-board encryption key; there is no need to re-encrypt data on the drive. - **Lower cost of ownership**: There is no need for new infrastructure to manage encryption keys, since BitLocker leverages your Active Directory Domain Services infrastructure to store recovery information. Your device operates more efficiently because processor cycles do not need to be used for the encryption process. + Encrypted Hard Drives are supported natively in the operating system through the following mechanisms: + - **Identification**: The operating system can identify that the drive is an Encrypted Hard Drive device type - **Activation**: The operating system disk management utility can activate, create and map volumes to ranges/bands as appropriate - **Configuration**: The operating system can create and map volumes to ranges/bands as appropriate - **API**: API support for applications to manage Encrypted Hard Drives independently of BitLocker Drive Encryption (BDE) - **BitLocker support**: Integration with the BitLocker Control Panel provides a seamless BitLocker end user experience. -**Warning**   -Self-Encrypting Hard Drives and Encrypted Hard Drives for Windows are not the same type of device. Encrypted Hard Drives for Windows require compliance for specific TCG protocols as well as IEEE 1667 compliance; Self-Encrypting Hard Drives do not have these requirements. It is important to confirm the device type is an Encrypted Hard Drive for Windows when planning for deployment. + +>**Warning:**  Self-Encrypting Hard Drives and Encrypted Hard Drives for Windows are not the same type of device. Encrypted Hard Drives for Windows require compliance for specific TCG protocols as well as IEEE 1667 compliance; Self-Encrypting Hard Drives do not have these requirements. It is important to confirm the device type is an Encrypted Hard Drive for Windows when planning for deployment.   If you are a storage device vendor who is looking for more info on how to implement Encrypted Hard Drive, see the [Encrypted Hard Drive Device Guide](http://msdn.microsoft.com/library/windows/hardware/dn653989.aspx). + ## System Requirements + To use Encrypted Hard Drive, the following system requirements apply: + For Encrypted Hard Drives used as **data drives**: + - The drive must be in an uninitialized state. - The drive must be in a security inactive state. + For Encrypted Hard Drives used as **startup drives**: + - The drive must be in an uninitialized state. - The drive must be in a security inactive state. - The computer must be UEFI 2.3.1 based and have the EFI\_STORAGE\_SECURITY\_COMMAND\_PROTOCOL defined. (This protocol is used to allow programs running in the EFI boot services environment to send security protocol commands to the drive). - The computer must have the Compatibility Support Module (CSM) disabled in UEFI. - The computer must always boot natively from UEFI. -**Warning**   -All Encrypted Hard Drives must be attached to non-RAID controllers to function properly. + +>**Warning:**  All Encrypted Hard Drives must be attached to non-RAID controllers to function properly.   ## Technical overview + Rapid encryption in BitLocker directly addresses the security needs of enterprises while offering significantly improved performance. In versions of Windows earlier than Windows Server 2012, BitLocker required a two-step process to complete read/write requests. In Windows Server 2012, Windows 8, or later, Encrypted Hard Drives offload the cryptographic operations to the drive controller for much greater efficiency. When the operating system an Encrypted Hard Drive, it activates the security mode. This activation lets the drive controller generate a media key for every volume that the host computer creates. This media key, which is never exposed outside the disk, is used to rapidly encrypt or decrypt every byte of data that is sent or received from the disk. + ## Configuring Encrypted Hard Drives as Startup drives + Configuration of Encrypted Hard Drives as startup drives is done using the same methods as standard hard drives. These methods include: + - **Deploy from media**: Configuration of Encrypted Hard Drives happens automatically through the installation process. - **Deploy from network**: This deployment method involves booting a Windows PE environment and using imaging tools to apply a Windows image from a network share. Using this method, the Enhanced Storage optional component needs to be included in the Windows PE image. You can enable this component using Server Manager, Windows PowerShell, or the DISM command line tool. If this component is not present, configuration of Encrypted Hard Drives will not work. - **Deploy from server**: This deployment method involves PXE booting a client with Encrypted Hard Drives present. Configuration of Encrypted Hard Drives happens automatically in this environment when the Enhanced Storage component is added to the PXE boot image. During deployment, the [TCGSecurityActivationDisabled](http://msdn.microsoft.com/library/windows/hardware/dn923247.aspx) setting in unattend.xml controls the encryption behavior of Encrypted Hard Drives. - **Disk Duplication**: This deployment method involves use of a previously configured device and disk duplication tools to apply a Windows image to an Encrypted Hard Drive. Disks must be partitioned using at least Windows 8 or Windows Server 2012 for this configuration to work. Images made using disk duplicators will not work. + ### Encrypted Hard Drive Architecture + Encrypted Hard Drives utilize two encryption keys on the device to control the locking and unlocking of data on the drive. These are the Data Encryption Key (DEK) and the Authentication Key (AK). + The Data Encryption Key is the key used to encrypt all of the data on the drive. The drive generates the DEK and it never leaves the device. It is stored in an encrypted format at a random location on the drive. If the DEK is changed or erased, data encrypted using the DEK is irrecoverable. + The Authentication Key is the key used to unlock data on the drive. A hash of the key is stored on drive and requires confirmation to decrypt the DEK. -When a computer with an Encrypted Hard Drive is in a powered off state, the drive locks automatically. As a computer powers on, the device remains in a locked state and is only unlocked after the Authentication Key decrypts the Data Encryption Key. Once the Authentication Key decrypts the Data Encryption Key, read-write operations can take place on the device. + +When a computer with an Encrypted Hard Drive is in a powered off state, the drive locks automatically. As a computer powers on, the device remains in a locked state and is only unlocked after the Authentication Key decrypts the Data Encryption Key. Once the Authentication Key decrypts the Data +Encryption Key, read-write operations can take place on the device. + When writing data to the drive, it passes through an encryption engine before the write operation completes. Likewise, reading data from the drive requires the encryption engine to decrypt the data before passing that data back to the user. In the event that the DEK needs to be changed or erased, the data on the drive does not need to be re-encrypted. A new Authentication Key needs to be created and it will re-encrypt the DEK. Once completed, the DEK can now be unlocked using the new AK and read-writes to the volume can continue. + ## Re-configuring Encrypted Hard Drives + Many Encrypted Hard Drive devices come pre-configured for use. If reconfiguration of the drive is required, use the following procedure after removing all available volumes and reverting the drive to an uninitialized state: + 1. Open Disk Management (diskmgmt.msc) 2. Initialize the disk and select the appropriate partition style (MBR or GPT) 3. Create one or more volumes on the disk. 4. Use the BitLocker setup wizard to enable BitLocker on the volume. -  -  diff --git a/windows/keep-secure/enforce-applocker-rules.md b/windows/keep-secure/enforce-applocker-rules.md index e71f69a725..0f83a7ff57 100644 --- a/windows/keep-secure/enforce-applocker-rules.md +++ b/windows/keep-secure/enforce-applocker-rules.md @@ -2,22 +2,29 @@ title: Enforce AppLocker rules (Windows 10) description: This topic for IT professionals describes how to enforce application control rules by using AppLocker. ms.assetid: e1528b7b-77f2-4419-8e27-c9cc3721d96d -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Enforce AppLocker rules + **Applies to** - Windows 10 + This topic for IT professionals describes how to enforce application control rules by using AppLocker. + After AppLocker rules are created within the rule collection, you can configure the enforcement setting to **Enforce rules** or **Audit only** on the rule collection. + When AppLocker policy enforcement is set to **Enforce rules**, rules are enforced for the rule collection and all events are audited. When AppLocker policy enforcement is set to **Audit only**, rules are only evaluated but all events generated from that evaluation are written to the AppLocker log. + There is no audit mode for the DLL rule collection. DLL rules affect specific apps. Therefore, test the impact of these rules first before deploying them to production. + To enforce AppLocker rules by configuring an AppLocker policy to **Enforce rules**, see [Configure an AppLocker policy for enforce rules](configure-an-applocker-policy-for-enforce-rules.md). -**Caution**   -AppLocker rules will be enforced immediately on the local device or when the Group Policy object (GPO) is updated by performing this procedure. If you want to see the effect of applying an AppLocker policy before setting the enforcement setting to **Enforce rules**, configure the policy to **Audit only**. For info about how to do this, see [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md)or [Test an AppLocker policy by Using Test-AppLockerPolicy](test-an-applocker-policy-by-using-test-applockerpolicy.md). + +>**Caution:**  AppLocker rules will be enforced immediately on the local device or when the Group Policy object (GPO) is updated by performing this procedure. If you want to see the effect of applying an AppLocker policy before setting the enforcement setting to **Enforce rules**, configure the policy to **Audit only**. For info about how to do this, see [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md)or [Test an AppLocker policy by Using Test-AppLockerPolicy](test-an-applocker-policy-by-using-test-applockerpolicy.md).       diff --git a/windows/keep-secure/enforce-password-history.md b/windows/keep-secure/enforce-password-history.md index aaf1fdefe7..b78ac67236 100644 --- a/windows/keep-secure/enforce-password-history.md +++ b/windows/keep-secure/enforce-password-history.md @@ -2,88 +2,85 @@ title: Enforce password history (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Enforce password history security policy setting. ms.assetid: 8b2ab871-3e52-4dd1-9776-68bb1e935442 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Enforce password history + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Enforce password history** security policy setting. + ## Reference + The **Enforce password history** policy setting determines the number of unique new passwords that must be associated with a user account before an old password can be reused. Password reuse is an important concern in any organization. Many users want to reuse the same password for their account over a long period of time. The longer the same password is used for a particular account, the greater the chance that an attacker will be able to determine the password through brute force attacks. If users are required to change their password, but they can reuse an old password, the effectiveness of a good password policy is greatly reduced. + Specifying a low number for **Enforce password history** allows users to continually use the same small number of passwords repeatedly. If you do not also set [Minimum password age](minimum-password-age.md), users can change their password as many times in a row as necessary to reuse their original password. + ### Possible values + - User-specified number from 0 through 24 - Not defined + ### Best practices + - Set **Enforce password history** to 24. This will help mitigate vulnerabilities that are caused by password reuse. - Set [Maximum password age](maximum-password-age.md) to expire passwords between 60 and 90 days. Try to expire the passwords between major business cycles to prevent work loss. - Configure [Minimum password age](minimum-password-age.md) so that you do not allow passwords to be changed immediately. + ### Location + **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy** + ### Default values + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default domain policy

      24 passwords remembered

      Default domain controller policy

      Not defined

      Stand-alone server default settings

      0 passwords remembered

      Domain controller effective default settings

      24 passwords remembered

      Member server effective default settings

      24 passwords remembered

      Effective GPO default settings on client computers

      24 passwords remembered

      + +| Server type or GPO | Default value | +| - | - | +| Default domain policy | 24 passwords remembered| +| Default domain controller policy | Not defined| +| Stand-alone server default settings | 0 passwords remembered| +| Domain controller effective default settings | 24 passwords remembered| +| Member server effective default settings | 24 passwords remembered| +| Effective GPO default settings on client computers | 24 passwords remembered|   ## Policy management + This section describes features, tools, and guidance to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + The longer a user uses the same password, the greater the chance that an attacker can determine the password through brute force attacks. Also, any accounts that may have been compromised remain exploitable for as long as the password is left unchanged. If password changes are required but password reuse is not prevented, or if users continually reuse a small number of passwords, the effectiveness of a good password policy is greatly reduced. + If you specify a low number for this policy setting, users can use the same small number of passwords repeatedly. If you do not also configure the [Minimum password age](minimum-password-age.md) policy setting, users might repeatedly change their passwords until they can reuse their original password. -**Note**   -After an account has been compromised, a simple password reset might not be enough to restrict a malicious user because the malicious user might have modified the user's environment so that the password is changed back to a known value automatically at a certain time. If an account has been compromised, it is best to delete the account and assign the user a new account after all affected systems have been restored to normal operations and verified that they are no longer compromised. + +>**Note:**  After an account has been compromised, a simple password reset might not be enough to restrict a malicious user because the malicious user might have modified the user's environment so that the password is changed back to a known value automatically at a certain time. If an account has been compromised, it is best to delete the account and assign the user a new account after all affected systems have been restored to normal operations and verified that they are no longer compromised.   ### Countermeasure + Configure the **Enforce password history** policy setting to 24 (the maximum setting) to help minimize the number of vulnerabilities that are caused by password reuse. + For this policy setting to be effective, you should also configure effective values for the [Minimum password age](minimum-password-age.md) and [Maximum password age](maximum-password-age.md) policy settings. + ### Potential impact + The major impact of configuring the **Enforce password history** setting to 24 is that users must create a new password every time they are required to change their old one. If users are required to change their passwords to new unique values, there is an increased risk of users who write their passwords somewhere so that they do not forget them. Another risk is that users may create passwords that change incrementally (for example, password01, password02, and so on) to facilitate memorization, but this makes them easier for an attacker to guess. Also, an excessively low value for the [Maximum password age](maximum-password-age.md) policy setting is likely to increase administrative overhead because users who forget their passwords might ask the Help Desk to reset them frequently. + ## Related topics -[Password Policy](password-policy.md) -  -  + +- [Password Policy](password-policy.md) diff --git a/windows/keep-secure/enforce-user-logon-restrictions.md b/windows/keep-secure/enforce-user-logon-restrictions.md index ed3f79446b..40eef86d2b 100644 --- a/windows/keep-secure/enforce-user-logon-restrictions.md +++ b/windows/keep-secure/enforce-user-logon-restrictions.md @@ -2,88 +2,88 @@ title: Enforce user logon restrictions (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Enforce user logon restrictions security policy setting. ms.assetid: 5891cb73-f1ec-48b9-b703-39249e48a29f -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Enforce user logon restrictions + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Enforce user logon restrictions** security policy setting. + ## Reference + The **Enforce user logon restrictions** policy setting determines whether the Kerberos V5 Key Distribution Center (KDC) validates every request for a session ticket against the user rights policy of the user account. Validating each request for a session ticket is optional because the extra step takes time, and that can slow network access to services. + The possible values for this Group Policy setting are: + - Enabled - Disabled - Not defined + ### Best practices + - If this policy setting is disabled, users might be granted session tickets for services that they do not have the right to use. - It is advisable to set **Enforce user logon restrictions** to Enabled. + + We recommend to set **Enforce user logon restrictions** to Enabled. + ### Location + **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Kerberos Policy** + ### Default Values + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server Type or GPODefault Value

      Default Domain Policy

      Enabled

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Not applicable

      DC Effective Default Settings

      Enabled

      Member Server Effective Default Settings

      Not applicable

      Client Computer Effective Default Settings

      Not applicable

      + +| Server Type or GPO | Default Value | +| - | - | +| Default Domain Policy | Enabled| +| Default Domain Controller Policy | Not defined | +| Stand-Alone Server Default Settings| Not applicable | +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings| Not applicable| +| Client Computer Effective Default Settings | Not applicable|   ## Policy management + This section describes features, tools, and guidance to help you manage this policy. + A restart of the device is not required for this policy setting to be effective. + ### Group Policy + Client devices will get the new setting during the next scheduled and successful Group Policy refresh. But for domain controllers to assign these new settings immediately, a gpupdate.exe /force is required. On the local device, the Security Configuration Engine will refresh this setting in about five minutes. + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + If you disable this policy setting, users could receive session tickets for services that they no longer have the right to use because the right was removed after they logged on. + ### Countermeasure + Enable the **Enforce user logon restrictions** setting. + ### Potential impact + None. This is the default configuration. + ## Related topics -[Kerberos Policy](kerberos-policy.md) -  -  + +- [Kerberos Policy](kerberos-policy.md) diff --git a/windows/keep-secure/export-an-applocker-policy-to-an-xml-file.md b/windows/keep-secure/export-an-applocker-policy-to-an-xml-file.md index 5812fda7ae..a5ebd52102 100644 --- a/windows/keep-secure/export-an-applocker-policy-to-an-xml-file.md +++ b/windows/keep-secure/export-an-applocker-policy-to-an-xml-file.md @@ -2,20 +2,23 @@ title: Export an AppLocker policy to an XML file (Windows 10) description: This topic for IT professionals describes the steps to export an AppLocker policy to an XML file for review or testing. ms.assetid: 979bd23f-6815-478b-a6a4-a25239cb1080 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Export an AppLocker policy to an XML file + **Applies to** - Windows 10 + This topic for IT professionals describes the steps to export an AppLocker policy to an XML file for review or testing. Membership in the local **Administrators** group, or equivalent, is the minimum required to complete this procedure. + **To export an AppLocker policy to an XML file** + 1. From the AppLocker console, right-click **AppLocker**, and then click **Export Policy**. 2. Browse to the location where you want to save the XML file. -3. In the **File name** box, type a file name for the XML file, and then click **Save**. -  -  +3. In the **File name** box, type a file name for the XML file, and then click **Save**. \ No newline at end of file diff --git a/windows/keep-secure/file-system-global-object-access-auditing.md b/windows/keep-secure/file-system-global-object-access-auditing.md index 8d1bf75dc2..5853de4758 100644 --- a/windows/keep-secure/file-system-global-object-access-auditing.md +++ b/windows/keep-secure/file-system-global-object-access-auditing.md @@ -2,20 +2,25 @@ title: File System (Global Object Access Auditing) (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, File System (Global Object Access Auditing), which enables you to configure a global system access control list (SACL) on the file system for an entire computer. ms.assetid: 4f215d61-0e23-46e4-9e58-08511105d25b -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # File System (Global Object Access Auditing) + **Applies to** - Windows 10 + This topic for the IT professional describes the Advanced Security Audit policy setting, **File System (Global Object Access Auditing)**, which enables you to configure a global system access control list (SACL) on the file system for an entire computer. + If you select the **Configure security** check box on the policy’s property page, you can add a user or group to the global SACL. This enables you to define computer system access control lists (SACLs) per object type for the file system. The specified SACL is then automatically applied to every file system object type. + If both a file or folder SACL and a global SACL are configured on a computer, the effective SACL is derived by combining the file or folder SACL and the global SACL. This means that an audit event is generated if an activity matches either the file or folder SACL or the global SACL. This policy setting must be used in combination with the **File System** security policy setting under Object Access. For more information, see [Audit File System](audit-file-system.md). + ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -  -  + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) diff --git a/windows/keep-secure/force-shutdown-from-a-remote-system.md b/windows/keep-secure/force-shutdown-from-a-remote-system.md index 4f4d1d9ed6..c9f51b7ed0 100644 --- a/windows/keep-secure/force-shutdown-from-a-remote-system.md +++ b/windows/keep-secure/force-shutdown-from-a-remote-system.md @@ -2,92 +2,93 @@ title: Force shutdown from a remote system (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Force shutdown from a remote system security policy setting. ms.assetid: 63129243-31ea-42a4-a598-c7064f48a3df -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Force shutdown from a remote system + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Force shutdown from a remote system** security policy setting. + ## Reference + This security setting determines which users are allowed to shut down a device from a remote location on the network. This allows members of the Administrators group or specific users to manage computers (for tasks such as a restart) from a remote location. + Constant: SeRemoteShutdownPrivilege + ### Possible values + - User-defined list of accounts - Administrators + ### Best practices + - Explicitly restrict this user right to members of the Administrators group or other specifically assigned roles that require this capability, such as non-administrative operations staff. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default this setting is Administrators and Server Operators on domain controllers and Administrators on stand-alone servers. + The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Administrators

      -

      Server Operators

      Stand-Alone Server Default Settings

      Administrators

      Domain Controller Effective Default Settings

      Administrators

      -

      Server Operators

      Member Server Effective Default Settings

      Administrators

      Client Computer Effective Default Settings

      Administrators

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Administrators
      Server Operators| +| Stand-Alone Server Default Settings | Administrators| +| Domain Controller Effective Default Settings | Administrators
      Server Operators| +| Member Server Effective Default Settings | Administrators| +| Client Computer Effective Default Settings | Administrators|   ## Policy management + This section describes features, tools, and guidance to help you manage this policy. + A restart of the computer is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + This policy setting must be applied on the computer that is being accessed remotely. + ### Group Policy + This user right is defined in the Default Domain Controller Group Policy Object (GPO) and in the local security policy of workstations and servers. + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Any user who can shut down a device could cause a denial-of-service condition to occur. Therefore, this user right should be tightly restricted. + ### Countermeasure + Restrict the **Force shutdown from a remote system** user right to members of the Administrators group or other specifically assigned roles that require this capability, such as non-administrative operations staff. + ### Potential impact + On a domain controller, if you remove the **Force shutdown from a remote system** user right from the Server Operator group, you could limit the abilities of users who are assigned to specific administrative roles in your environment. You should confirm that delegated activities are not adversely affected. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/generate-security-audits.md b/windows/keep-secure/generate-security-audits.md index 71e55bf774..78b578d1e3 100644 --- a/windows/keep-secure/generate-security-audits.md +++ b/windows/keep-secure/generate-security-audits.md @@ -2,95 +2,92 @@ title: Generate security audits (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Generate security audits security policy setting. ms.assetid: c0e1cd80-840e-4c74-917c-5c2349de885f -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Generate security audits + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Generate security audits** security policy setting. + ## Reference + This policy setting determines which accounts can be used by a process to generate audit records in the security event log. The Local Security Authority Subsystem Service (LSASS) writes events to the log. You can use the information in the security event log to trace unauthorized device access. + Constant: SeAuditPrivilege + ### Possible values + - User-defined list of accounts - Local Service - Network Service + ### Best practices + - Because the audit log can potentially be an attack vector if an account is compromised, ensure that only the Local Service and Network Service accounts have the **Generate security audits** user right assigned to them. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default, this setting is Local Service and Network Service on domain controllers and stand-alone servers. + The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Local Service

      -

      Network Service

      Stand-Alone Server Default Settings

      Local Service

      -

      Network Service

      Domain Controller Effective Default Settings

      Local Service

      -

      Network Service

      Member Server Effective Default Settings

      Local Service

      -

      Network Service

      Client Computer Effective Default Settings

      Local Service

      -

      Network Service

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Local Service
      Network Service| +| Stand-Alone Server Default Settings | Local Service
      Network Service| +| Domain Controller Effective Default Settings | Local Service
      Network Service| +| Member Server Effective Default Settings | Local Service
      Network Service| +| Client Computer Effective Default Settings | Local Service
      Network Service|   ## Policy management + This section describes features, tools, and guidance to help you manage this policy. + A restart of the computer is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + Misuse of this user right can result in the generation of many auditing events, potentially hiding evidence of an attack or causing a denial-of-service (DoS) if the [Audit: Shut down system immediately if unable to log security audits](audit-shut-down-system-immediately-if-unable-to-log-security-audits.md) security policy setting is enabled. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + A malicious user could use accounts that can write to the Security log to fill that log with meaningless events. If the computer is configured to overwrite events as needed, malicious users could use this method to remove evidence of their unauthorized activities. If the computer is configured to shut down when it is unable to write to the Security log, and it is not configured to automatically back up the log files, this method could be used to create a DoS condition. + ### Countermeasure + Ensure that only the Local Service and Network Service accounts have the **Generate security audits** user right assigned to them. + ### Potential impact + None. Restricting the **Generate security audits** user right to the Local Service and Network Service accounts is the default configuration. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/how-applocker-works-techref.md b/windows/keep-secure/how-applocker-works-techref.md index c482e1a4bc..ad2bc595e0 100644 --- a/windows/keep-secure/how-applocker-works-techref.md +++ b/windows/keep-secure/how-applocker-works-techref.md @@ -2,37 +2,47 @@ title: How AppLocker works (Windows 10) description: This topic for the IT professional provides links to topics about AppLocker architecture and components, processes and interactions, rules and policies. ms.assetid: 24bb1d73-0ff5-4af7-8b8a-2fa44d4ddbcd -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # How AppLocker works + **Applies to** - Windows 10 + This topic for the IT professional provides links to topics about AppLocker architecture and components, processes and interactions, rules and policies. + The following topics explain how AppLocker policies for each of the rule condition types are evaluated: + - [AppLocker architecture and components](applocker-architecture-and-components.md) - [AppLocker processes and interactions](applocker-processes-and-interactions.md) + The following topics explain how AppLocker rules and policies work: + - [Understanding AppLocker rule behavior](understanding-applocker-rule-behavior.md) - [Understanding AppLocker rule exceptions](understanding-applocker-rule-exceptions.md) - [Understanding AppLocker rule collections](understanding-applocker-rule-collections.md) - [Understanding AppLocker allow and deny actions on rules](understanding-applocker-allow-and-deny-actions-on-rules.md) - [Understanding AppLocker rule condition types](understanding-applocker-rule-condition-types.md) + - [Understanding the publisher rule condition in AppLocker](understanding-the-publisher-rule-condition-in-applocker.md) - [Understanding the path rule condition in AppLocker](understanding-the-path-rule-condition-in-applocker.md) - [Understanding the file hash rule condition in AppLocker](understanding-the-file-hash-rule-condition-in-applocker.md) + - [Understanding AppLocker default rules](understanding-applocker-default-rules.md) + - [Executable rules in AppLocker](executable-rules-in-applocker.md) - [Windows Installer rules in AppLocker](windows-installer-rules-in-applocker.md) - [Script rules in AppLocker](script-rules-in-applocker.md) - [DLL rules in AppLocker](dll-rules-in-applocker.md) - [Packaged apps and packaged app installer rules in AppLocker](packaged-apps-and-packaged-app-installer-rules-in-applocker.md) + ## Additional resources + - [AppLocker Design Guide](applocker-policies-design-guide.md) - [AppLocker deployment guide](applocker-policies-deployment-guide.md) - [Administer AppLocker](administer-applocker.md) -  -  diff --git a/windows/keep-secure/how-to-configure-security-policy-settings.md b/windows/keep-secure/how-to-configure-security-policy-settings.md index 9ba376ff63..275dfdaccb 100644 --- a/windows/keep-secure/how-to-configure-security-policy-settings.md +++ b/windows/keep-secure/how-to-configure-security-policy-settings.md @@ -2,59 +2,77 @@ title: Configure security policy settings (Windows 10) description: Describes steps to configure a security policy setting on the local device, on a domain-joined device, and on a domain controller. ms.assetid: 63b0967b-a9fe-4d92-90af-67469ee20320 -ms.pagetype: security + ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- # Configure security policy settings + **Applies to** - Windows 10 + Describes steps to configure a security policy setting on the local device, on a domain-joined device, and on a domain controller. + You must have Administrators rights on the local device, or you must have the appropriate permissions to update a Group Policy Object (GPO) on the domain controller to perform these procedures. + When a local setting is inaccessible, it indicates that a GPO currently controls that setting. + ## To configure a setting using the Local Security Policy console + 1. To open Local Security Policy, on the **Start** screen, type **secpol.msc**, and then press ENTER. 2. Under **Security Settings** of the console tree, do one of the following: + - Click **Account Policies** to edit the **Password Policy** or **Account Lockout Policy**. - Click **Local Policies** to edit an **Audit Policy**, a **User Rights Assignment**, or **Security Options**. + 3. When you find the policy setting in the details pane, double-click the security policy that you want to modify. 4. Modify the security policy setting, and then click **OK**. + **Note**   - Some security policy settings require that the device be restarted before the setting takes effect. - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on.   ## To configure a security policy setting using the Local Group Policy Editor console + You must have the appropriate permissions to install and use the Microsoft Management Console (MMC), and to update a Group Policy Object (GPO) on the domain controller to perform these procedures. + 1. Open the Local Group Policy Editor (gpedit.msc). 2. In the console tree, click **Computer Configuration**, click **Windows Settings**, and then click **Security Settings**. 3. Do one of the following: + - Click **Account Policies** to edit the **Password Policy** or **Account Lockout Policy**. - Click **Local Policies** to edit an **Audit Policy**, a **User Rights Assignment**, or **Security Options**. + 4. In the details pane, double-click the security policy setting that you want to modify. - **Note**   -    If this security policy has not yet been defined, select the **Define these policy settings** check box. + + >**Note:**  If this security policy has not yet been defined, select the **Define these policy settings** check box.   5. Modify the security policy setting, and then click **OK**. -**Note**  If you want to configure security settings for many devices on your network, you can use the Group Policy Management Console. + +>**Note:**  If you want to configure security settings for many devices on your network, you can use the Group Policy Management Console.   ## To configure a setting for a domain controller + The following procedure describes how to configure a security policy setting for only a domain controller (from the domain controller). + 1. To open the domain controller security policy, in the console tree, locate *GroupPolicyObject \[ComputerName\]* Policy, click **Computer Configuration**, click **Windows Settings**, and then click **Security Settings**. 2. Do one of the following: + - Double-click **Account Policies** to edit the **Password Policy**, **Account Lockout Policy**, or **Kerberos Policy**. - Click **Local Policies** to edit the **Audit Policy**, a **User Rights Assignment**, or **Security Options**. + 3. In the details pane, double-click the security policy that you want to modify. - **Note**   - If this security policy has not yet been defined, select the **Define these policy settings** check box. + >**Note**  If this security policy has not yet been defined, select the **Define these policy settings** check box.   4. Modify the security policy setting, and then click **OK**. + **Important**   - Always test a newly created policy in a test organizational unit before you apply it to your network. - When you change a security setting through a GPO and click **OK**, that setting will take effect the next time you refresh the settings.   ## Related topics -[Security policy settings reference](security-policy-settings-reference.md) -  -  + +- [Security policy settings reference](security-policy-settings-reference.md) diff --git a/windows/keep-secure/how-user-account-control-works.md b/windows/keep-secure/how-user-account-control-works.md index 488f2bf4e5..ca5e6eef25 100644 --- a/windows/keep-secure/how-user-account-control-works.md +++ b/windows/keep-secure/how-user-account-control-works.md @@ -2,143 +2,311 @@ title: How User Account Control works (Windows 10) description: User Account Control (UAC) is a fundamental component of Microsoft's overall security vision. UAC helps mitigate the impact of malware. ms.assetid: 9f921779-0fd3-4206-b0e4-05a19883ee59 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: operate ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # How User Account Control works + **Applies to** - Windows 10 + User Account Control (UAC) is a fundamental component of Microsoft's overall security vision. UAC helps mitigate the impact of malware. + ## UAC process and interactions + Each app that requires the administrator access token must prompt for consent. The one exception is the relationship that exists between parent and child processes. Child processes inherit the user's access token from the parent process. Both the parent and child processes, however, must have the same integrity level. Windows 10 protects processes by marking their integrity levels. Integrity levels are measurements of trust. A "high" integrity application is one that performs tasks that modify system data, such as a disk partitioning application, while a "low" integrity application is one that performs tasks that could potentially compromise the operating system, such as a Web browser. Apps with lower integrity levels cannot modify data in applications with higher integrity levels. When a standard user attempts to run an app that requires an administrator access token, UAC requires that the user provide valid administrator credentials. + In order to better understand how this process happens, let's look at the Windows logon process. + ### Logon process + The following shows how the logon process for an administrator differs from the logon process for a standard user. + ![uac windows logon process](images/uacwindowslogonprocess.gif) + By default, standard users and administrators access resources and run apps in the security context of standard users. When a user logs on to a computer, the system creates an access token for that user. The access token contains information about the level of access that the user is granted, including specific security identifiers (SIDs) and Windows privileges. + When an administrator logs on, two separate access tokens are created for the user: a standard user access token and an administrator access token. The standard user access token contains the same user-specific information as the administrator access token, but the administrative Windows privileges and SIDs are removed. The standard user access token is used to start apps that do not perform administrative tasks (standard user apps). The standard user access token is then used to display the desktop (explorer.exe). Explorer.exe is the parent process from which all other user-initiated processes inherit their access token. As a result, all apps run as a standard user unless a user provides consent or credentials to approve an app to use a full administrative access token. + A user that is a member of the Administrators group can log on, browse the Web, and read e-mail while using a standard user access token. When the administrator needs to perform a task that requires the administrator access token, Windows 10 automatically prompts the user for approval. This prompt is called an elevation prompt, and its behavior can be configured by using the Local Security Policy snap-in (Secpol.msc) or Group Policy. For more info, see [User Account Control security policy settings](user-account-control-security-policy-settings.md). + ### The UAC User Experience + When UAC is enabled, the user experience for standard users is different from that of administrators in Admin Approval Mode. The recommended and more secure method of running Windows 10 is to make your primary user account a standard user account. Running as a standard user helps to maximize security for a managed environment. With the built-in UAC elevation component, standard users can easily perform an administrative task by entering valid credentials for a local administrator account. The default, built-in UAC elevation component for standard users is the credential prompt. + The alternative to running as a standard user is to run as an administrator in Admin Approval Mode. With the built-in UAC elevation component, members of the local Administrators group can easily perform an administrative task by providing approval. The default, built-in UAC elevation component for an administrator account in Admin Approval Mode is called the consent prompt. + **The consent and credential prompts** + With UAC enabled, Windows 10 prompts for consent or prompts for credentials of a valid local administrator account before starting a program or task that requires a full administrator access token. This prompt ensures that no malicious software can be silently installed. + **The consent prompt** + The consent prompt is presented when a user attempts to perform a task that requires a user's administrative access token. The following is an example of the UAC consent prompt. + ![uac consent prompt](images/uacconsentprompt.gif) + **The credential prompt** + The credential prompt is presented when a standard user attempts to perform a task that requires a user's administrative access token. Administrators can also be required to provide their credentials by setting the **User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode** policy setting value to **Prompt for credentials**. + The following is an example of the UAC credential prompt. + ![uac credential prompt](images/uaccredentialprompt.gif) + **UAC elevation prompts** + The UAC elevation prompts are color-coded to be app-specific, enabling for immediate identification of an application's potential security risk. When an app attempts to run with an administrator's full access token, Windows 10 first analyzes the executable file to determine its publisher. Apps are first separated into three categories based on the file's publisher: Windows 10, publisher verified (signed), and publisher not verified (unsigned). The following diagram illustrates how Windows 10 determines which color elevation prompt to present to the user. + The elevation prompt color-coding is as follows: + - Red background with a red shield icon: The app is blocked by Group Policy or is from a publisher that is blocked. - Blue background with a blue and gold shield icon: The application is a Windows 10 administrative app, such as a Control Panel item. - Blue background with a blue shield icon: The application is signed by using Authenticode and is trusted by the local computer. - Yellow background with a yellow shield icon: The application is unsigned or signed but is not yet trusted by the local computer. + **Shield icon** + Some Control Panel items, such as **Date and Time Properties**, contain a combination of administrator and standard user operations. Standard users can view the clock and change the time zone, but a full administrator access token is required to change the local system time. The following is a screen shot of the **Date and Time Properties** Control Panel item. + ![uac shield icon](images/uacshieldicon.png) + The shield icon on the **Change date and time** button indicates that the process requires a full administrator access token and will display a UAC elevation prompt. + **Securing the elevation prompt** + The elevation process is further secured by directing the prompt to the secure desktop. The consent and credential prompts are displayed on the secure desktop by default in Windows 10. Only Windows processes can access the secure desktop. For higher levels of security, we recommend keeping the **User Account Control: Switch to the secure desktop when prompting for elevation** policy setting enabled. + When an executable file requests elevation, the interactive desktop, also called the user desktop, is switched to the secure desktop. The secure desktop dims the user desktop and displays an elevation prompt that must be responded to before continuing. When the user clicks **Yes** or **No**, the desktop switches back to the user desktop. + Malware can present an imitation of the secure desktop, but when the **User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode** policy setting is set to **Prompt for consent**, the malware does not gain elevation if the user clicks **Yes** on the imitation. If the policy setting is set to **Prompt for credentials**, malware imitating the credential prompt may be able to gather the credentials from the user. However, the malware does not gain elevated privilege and the system has other protections that mitigate malware from taking control of the user interface even with a harvested password. + While malware could present an imitation of the secure desktop, this issue cannot occur unless a user previously installed the malware on the PC. Because processes requiring an administrator access token cannot silently install when UAC is enabled, the user must explicitly provide consent by clicking **Yes** or by providing administrator credentials. The specific behavior of the UAC elevation prompt is dependent upon Group Policy. + ## UAC Architecture + The following diagram details the UAC architecture. + ![uac architecture](images/uacarchitecture.gif) + To better understand each component, review the table below: -Component -Description -**User** -User performs operation requiring privilege -If the operation changes the file system or registry, Virtualization is called. All other operations call ShellExecute. -ShellExecute -ShellExecute calls CreateProcess. ShellExecute looks for the ERROR\_ELEVATION\_REQUIRED error from CreateProcess. If it receives the error, ShellExecute calls the Application Information service to attempt to perform the requested task with the elevated prompt. -CreateProcess -If the application requires elevation, CreateProcess rejects the call with ERROR\_ELEVATION\_REQUIRED. -**System** -Application Information service -A system service that helps start apps that require one or more elevated privileges or user rights to run, such as local administrative tasks, and apps that require higher integrity levels. The Application Information service helps start such apps by creating a new process for the application with an administrative user's full access token when elevation is required and (depending on Group Policy) consent is given by the user to do so. -Elevating an ActiveX install -If ActiveX is not installed, the system checks the UAC slider level. If ActiveX is installed, the **User Account Control: Switch to the secure desktop when prompting for elevation** Group Policy setting is checked. -Check UAC slider level -UAC has four levels of notification to choose from and a slider to use to select the notification level: -- High - If the slider is set to **Always notify**, the system checks whether the secure desktop is enabled. -- Medium - If the slider is set to **Notify me only when programs try to make changes to my computer**, the **User Account Control: Only elevate executable files that are signed and validated** policy setting is checked: - - If the policy setting is enabled, the public key infrastructure (PKI) certification path validation is enforced for a given file before it is permitted to run. - - If the policy setting is not enabled (default), the PKI certification path validation is not enforced before a given file is permitted to run. The **User Account Control: Switch to the secure desktop when prompting for elevation** Group Policy setting is checked. -- Low - If the slider is set to **Notify me only when apps try to make changes to my computer (do not dim by desktop)**, the CreateProcess is called. -- Never Notify - If the slider is set to **Never notify me when**, UAC prompt will never notify when an app is trying to install or trying to make any change on the computer. - **Important**   - This setting is not recommended. This setting is the same as setting the **User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode** policy setting to **Elevate without prompting**. -   -Secure desktop enabled -The **User Account Control: Switch to the secure desktop when prompting for elevation** policy setting is checked: -- If the secure desktop is enabled, all elevation requests go to the secure desktop regardless of prompt behavior policy settings for administrators and standard users. -- If the secure desktop is not enabled, all elevation requests go to the interactive user's desktop, and the per-user settings for administrators and standard users are used. -CreateProcess -CreateProcess calls AppCompat, Fusion, and Installer detection to assess if the app requires elevation. The file is then inspected to determine its requested execution level, which is stored in the application manifest for the file. CreateProcess fails if the requested execution level specified in the manifest does not match the access token and returns an error (ERROR\_ELEVATION\_REQUIRED) to ShellExecute. -AppCompat -The AppCompat database stores information in the application compatibility fix entries for an application. -Fusion -The Fusion database stores information from application manifests that describe the applications. The manifest schema is updated to add a new requested execution level field. -Installer detection -Installer detection detects setup files, which helps prevent installations from being run without the user's knowledge and consent. -**Kernel** -Virtualization -Virtualization technology ensures that non-compliant apps do not silently fail to run or fail in a way that the cause cannot be determined. UAC also provides file and registry virtualization and logging for applications that write to protected areas. -File system and registry -The per-user file and registry virtualization redirects per-computer registry and file write requests to equivalent per-user locations. Read requests are redirected to the virtualized per-user location first and to the per-computer location second. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      ComponentDescription
      +

      User

      +
      +

      User performs operation requiring privilege

      +
      +

      If the operation changes the file system or registry, Virtualization is called. All other operations call ShellExecute.

      +
      +

      ShellExecute

      +
      +

      ShellExecute calls CreateProcess. ShellExecute looks for the ERROR_ELEVATION_REQUIRED error from CreateProcess. If it receives the error, ShellExecute calls the Application Information service to attempt to perform the requested task with the elevated prompt.

      +
      +

      CreateProcess

      +
      +

      If the application requires elevation, CreateProcess rejects the call with ERROR_ELEVATION_REQUIRED.

      +
      +

      System

      +
      +

      Application Information service

      +
      +

      A system service that helps start apps that require one or more elevated privileges or user rights to run, such as local administrative tasks, and apps that require higher integrity levels. The Application Information service helps start such apps by creating a new process for the application with an administrative user's full access token when elevation is required and (depending on Group Policy) consent is given by the user to do so.

      +
      +

      Elevating an ActiveX install

      +
      +

      If ActiveX is not installed, the system checks the UAC slider level. If ActiveX is installed, the User Account Control: Switch to the secure desktop when prompting for elevation Group Policy setting is checked.

      +
      +

      Check UAC slider level

      +
      +

      UAC has four levels of notification to choose from and a slider to use to select the notification level:

      +
        +
      • +

        High

        +

        If the slider is set to Always notify, the system checks whether the secure desktop is enabled.

        +
      • +
      • +

        Medium

        +

        If the slider is set to Notify me only when programs try to make changes to my computer, the User Account Control: Only elevate executable files that are signed and validated policy setting is checked:

        +
          +
        • +

          If the policy setting is enabled, the public key infrastructure (PKI) certification path validation is enforced for a given file before it is permitted to run.

          +
        • +
        • +

          If the policy setting is not enabled (default), the PKI certification path validation is not enforced before a given file is permitted to run. The User Account Control: Switch to the secure desktop when prompting for elevation Group Policy setting is checked.

          +
        • +
        +
      • +
      • +

        Low

        +

        If the slider is set to Notify me only when apps try to make changes to my computer (do not dim by desktop), the CreateProcess is called.

        +
      • +
      • +

        Never Notify

        +

        If the slider is set to Never notify me when, UAC prompt will never notify when an app is trying to install or trying to make any change on the computer.

        +
        Important  

        This setting is not recommended. This setting is the same as setting the User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode policy setting to Elevate without prompting.

        +
        +
         
        +
      • +
      +
      +

      Secure desktop enabled

      +
      +

      The User Account Control: Switch to the secure desktop when prompting for elevation policy setting is checked:

      +
        +
      • +

        If the secure desktop is enabled, all elevation requests go to the secure desktop regardless of prompt behavior policy settings for administrators and standard users.

        +
      • +
      • +

        If the secure desktop is not enabled, all elevation requests go to the interactive user's desktop, and the per-user settings for administrators and standard users are used.

        +
      • +
      +
      +

      CreateProcess

      +
      +

      CreateProcess calls AppCompat, Fusion, and Installer detection to assess if the app requires elevation. The file is then inspected to determine its requested execution level, which is stored in the application manifest for the file. CreateProcess fails if the requested execution level specified in the manifest does not match the access token and returns an error (ERROR_ELEVATION_REQUIRED) to ShellExecute.

      +
      +

      AppCompat

      +
      +

      The AppCompat database stores information in the application compatibility fix entries for an application.

      +
      +

      Fusion

      +
      +

      The Fusion database stores information from application manifests that describe the applications. The manifest schema is updated to add a new requested execution level field.

      +
      +

      Installer detection

      +
      +

      Installer detection detects setup files, which helps prevent installations from being run without the user's knowledge and consent.

      +
      +

      Kernel

      +
      +

      Virtualization

      +
      +

      Virtualization technology ensures that non-compliant apps do not silently fail to run or fail in a way that the cause cannot be determined. UAC also provides file and registry virtualization and logging for applications that write to protected areas.

      +
      +

      File system and registry

      +
      +

      The per-user file and registry virtualization redirects per-computer registry and file write requests to equivalent per-user locations. Read requests are redirected to the virtualized per-user location first and to the per-computer location second.

      +
        The slider will never turn UAC completely off. If you set it to **Never notify**, it will: + - Keep the UAC service running. - Cause all elevation request initiated by administrators to be auto-approved without showing a UAC prompt. - Automatically deny all elevation requests for standard users. -**Important**   -In order to fully disable UAC you must disable the policy **User Account Control: Run all administrators in Admin Approval Mode**. + +>**Important:**  In order to fully disable UAC you must disable the policy **User Account Control: Run all administrators in Admin Approval Mode**.   -**Warning**   -Universal Windows apps will not work when UAC is disabled. +>**Warning:**  Universal Windows apps will not work when UAC is disabled.   ### Virtualization + Because system administrators in enterprise environments attempt to secure systems, many line-of-business (LOB) applications are designed to use only a standard user access token. As a result, you do not need to replace the majority of apps when UAC is turned on. + Windows 10 includes file and registry virtualization technology for apps that are not UAC-compliant and that require an administrator's access token to run correctly. When an administrative apps that is not UAC-compliant attempts to write to a protected folder, such as Program Files, UAC gives the app its own virtualized view of the resource it is attempting to change. The virtualized copy is maintained in the user's profile. This strategy creates a separate copy of the virtualized file for each user that runs the non-compliant app. + Most app tasks operate properly by using virtualization features. Although virtualization allows a majority of applications to run, it is a short-term fix and not a long-term solution. App developers should modify their apps to be compliant as soon as possible, rather than relying on file, folder, and registry virtualization. + Virtualization is not an option in the following scenarios: + - Virtualization does not apply to apps that are elevated and run with a full administrative access token. - Virtualization supports only 32-bit apps. Non-elevated 64-bit apps simply receive an access denied message when they attempt to acquire a handle (a unique identifier) to a Windows object. Native Windows 64-bit apps are required to be compatible with UAC and to write data into the correct locations. - Virtualization is disabled if the app includes an app manifest with a requested execution level attribute. + ### Request execution levels + An app manifest is an XML file that describes and identifies the shared and private side-by-side assemblies that an app should bind to at run time. The app manifest includes entries for UAC app compatibility purposes. Administrative apps that include an entry in the app manifest prompt the user for permission to access the user's access token. Although they lack an entry in the app manifest, most administrative app can run without modification by using app compatibility fixes. App compatibility fixes are database entries that enable applications that are not UAC-compliant to work properly. + All UAC-compliant apps should have a requested execution level added to the application manifest. If the application requires administrative access to the system, then marking the app with a requested execution level of "require administrator" ensures that the system identifies this program as an administrative app and performs the necessary elevation steps. Requested execution levels specify the privileges required for an app. + ### Installer detection technology + Installation programs are apps designed to deploy software. Most installation programs write to system directories and registry keys. These protected system locations are typically writeable only by an administrator in Installer detection technology, which means that standard users do not have sufficient access to install programs. Windows 10 heuristically detects installation programs and requests administrator credentials or approval from the administrator user in order to run with access privileges. Windows 10 also heuristically detects updates and programs that uninstall applications. One of the design goals of UAC is to prevent installations from being run without the user's knowledge and consent because installation programs write to protected areas of the file system and registry. + Installer detection only applies to: + - 32-bit executable files. - Applications without a requested execution level attribute. - Interactive processes running as a standard user with UAC enabled. + Before a 32-bit process is created, the following attributes are checked to determine whether it is an installer: + - The file name includes keywords such as "install," "setup," or "update." - Versioning Resource fields contain the following keywords: Vendor, Company Name, Product Name, File Description, Original Filename, Internal Name, and Export Name. - Keywords in the side-by-side manifest are embedded in the executable file. - Keywords in specific StringTable entries are linked in the executable file. - Key attributes in the resource script data are linked in the executable file. - There are targeted sequences of bytes within the executable file. -**Note**   -The keywords and sequences of bytes were derived from common characteristics observed from various installer technologies. -  -**Note**   -The User Account Control: Detect application installations and prompt for elevation policy setting must be enabled for installer detection to detect installation programs. For more info, see [User Account Control security policy settings](user-account-control-security-policy-settings.md). -  -  + +>**Note:**  The keywords and sequences of bytes were derived from common characteristics observed from various installer technologies.   +>**Note:**  The User Account Control: Detect application installations and prompt for elevation policy setting must be enabled for installer detection to detect installation programs. For more info, see [User Account Control security policy settings](user-account-control-security-policy-settings.md). diff --git a/windows/keep-secure/impersonate-a-client-after-authentication.md b/windows/keep-secure/impersonate-a-client-after-authentication.md index 45f008dc87..6735e29692 100644 --- a/windows/keep-secure/impersonate-a-client-after-authentication.md +++ b/windows/keep-secure/impersonate-a-client-after-authentication.md @@ -2,111 +2,101 @@ title: Impersonate a client after authentication (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Impersonate a client after authentication security policy setting. ms.assetid: 4cd241e2-c680-4b43-8ed0-3b391925cec5 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Impersonate a client after authentication + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Impersonate a client after authentication** security policy setting. + ## Reference + This policy setting determines which programs are allowed to impersonate a user or another specified account and act on behalf of the user. If this user right is required for this type of impersonation, an unauthorized user cannot cause a client to connect (for example, by remote procedure call (RPC) or named pipes) to a service that they have created to impersonate that client. (Such an action could elevate the unauthorized user's permissions to administrative or system levels.) + Impersonation is the ability of a thread to run in a security context that is different from the context of the process that owns the thread. Impersonation is designed to meet the security requirements of client/server applications. When running in a client's security context, a service "is" the client, to some degree. One of the service's threads uses an access token representing the client's credentials to obtain access to the objects to which the client has access. The primary reason for impersonation is to cause access checks to be performed against the client's identity. Using the client's identity for access checks can cause access to be either restricted or expanded, depending on what the client has permission to do. + Services that are started by the Service Control Manager have the built-in Service group added by default to their access tokens. COM servers that are started by the COM infrastructure and configured to run under a specific account also have the Service group added to their access tokens. As a result, these processes are assigned this user right when they are started. + Constant: SeImpersonatePrivilege + ### Possible values + - User-defined list of accounts - Default values - Not defined + ### Best practices + - A user can impersonate an access token if any of the following conditions exist: + - The access token that is being impersonated is for this user. - The user in this session logged on to the network with explicit credentials to create the access token. - The requested level is less than Impersonate, such as Anonymous or Identify. + Because of these factors, users do not usually need to have this user right assigned. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default, this setting is Administrators, Local Service, Network Service, and Service on domain controllers and stand-alone servers. + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not eefined

      Default Domain Controller Policy

      Administrators

      -

      Local Service

      -

      Network Service

      -

      Service

      Stand-Alone Server Default Settings

      Administrators

      -

      Local Service

      -

      Network Service

      -

      Service

      Domain Controller Effective Default Settings

      Administrators

      -

      Local Service

      -

      Network Service

      -

      Service

      Member Server Effective Default Settings

      Administrators

      -

      Local Service

      -

      Network Service

      -

      Service

      Client Computer Effective Default Settings

      Administrators

      -

      Local Service

      -

      Network Service

      -

      Service

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined | +| Default Domain Controller Policy| Administrators
      Local Service
      Network Service
      Service| +| Stand-Alone Server Default Settings | Administrators
      Local Service
      Network Service
      Service| +| Domain Controller Effective Default Settings | Administrators
      Local Service
      Network Service
      Service| +| Member Server Effective Default Settings | Administrators
      Local Service
      Network Service
      Service| +| Client Computer Effective Default Settings | Administrators
      Local Service
      Network Service
      Service|   ## Policy management + This section describes features, tools, and guidance to help you manage this policy. + A restart of the computer is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + An attacker with the **Impersonate a client after authentication** user right could create a service, mislead a client into connecting to the service, and then impersonate that computer to elevate the attacker's level of access to that of the device. + ### Countermeasure + On member servers, ensure that only the Administrators and Service groups (Local Service, Network Service, and Service) have the **Impersonate a client after authentication** user right assigned to them. + ### Potential impact + In most cases, this configuration has no impact. If you have installed optional components such as ASP.NET or IIS, you may need to assign the **Impersonate a client after authentication** user right to additional accounts that are required by those components, such as IUSR\_*<ComputerName>*, IIS\_WPG, ASP.NET, or IWAM\_*<ComputerName>*. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/import-an-applocker-policy-from-another-computer.md b/windows/keep-secure/import-an-applocker-policy-from-another-computer.md index 02cf23e310..199d82deae 100644 --- a/windows/keep-secure/import-an-applocker-policy-from-another-computer.md +++ b/windows/keep-secure/import-an-applocker-policy-from-another-computer.md @@ -2,25 +2,29 @@ title: Import an AppLocker policy from another computer (Windows 10) description: This topic for IT professionals describes how to import an AppLocker policy. ms.assetid: b48cb2b2-8ef8-4cc0-89bd-309d0b1832f6 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Import an AppLocker policy from another computer + **Applies to** - Windows 10 + This topic for IT professionals describes how to import an AppLocker policy. + Before completing this procedure, you should have exported an AppLocker policy. For more information, see [Export an AppLocker policy to an XML file](export-an-applocker-policy-to-an-xml-file.md). + Membership in the local **Administrators** group, or equivalent, is the minimum required to complete this procedure. -**Caution**   -Importing a policy will overwrite the existing policy on that computer. + +>**Caution:**  Importing a policy will overwrite the existing policy on that computer.   **To import an AppLocker policy** + 1. From the AppLocker console, right-click **AppLocker**, and then click **Import Policy**. 2. In the **Import Policy** dialog box, locate the file that you exported, and then click **Open**. 3. The **Import Policy** dialog box will warn you that importing a policy will overwrite the existing rules and enforcement settings. If acceptable, click **OK** to import and overwrite the policy. 4. The **AppLocker** dialog box will notify you of how many rules were overwritten and imported. Click **OK**. -  -  diff --git a/windows/keep-secure/import-an-applocker-policy-into-a-gpo.md b/windows/keep-secure/import-an-applocker-policy-into-a-gpo.md index 94411b2263..a5dfd645ac 100644 --- a/windows/keep-secure/import-an-applocker-policy-into-a-gpo.md +++ b/windows/keep-secure/import-an-applocker-policy-into-a-gpo.md @@ -2,26 +2,29 @@ title: Import an AppLocker policy into a GPO (Windows 10) description: This topic for IT professionals describes the steps to import an AppLocker policy into a Group Policy Object (GPO). ms.assetid: 0629ce44-f5e2-48a8-ba47-06544c73261f -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Import an AppLocker policy into a GPO + **Applies to** - Windows 10 + This topic for IT professionals describes the steps to import an AppLocker policy into a Group Policy Object (GPO). AppLocker policies can be created as local security policies and modified like any other local security policy, or they can be created as part of a GPO and managed by using Group Policy. You can create AppLocker policies on any supported computer. For info about which Windows editions are supported, see [Requirements to Use AppLocker](requirements-to-use-applocker.md). -**Important**   -Follow your organization's standard procedures for updating GPOs. For info about specific steps to follow for AppLocker policies, see [Maintain AppLocker policies](maintain-applocker-policies.md). + +>**Important:**  Follow your organization's standard procedures for updating GPOs. For info about specific steps to follow for AppLocker policies, see [Maintain AppLocker policies](maintain-applocker-policies.md).   To complete this procedure, you must have the **Edit Setting** permission to edit a GPO. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. + **To import an AppLocker policy into a GPO** + 1. In the Group Policy Management Console (GPMC), open the GPO that you want to edit. 2. In the console tree under **Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Application Control Policies**, click **AppLocker**. 3. Right-click **AppLocker**, and then click **Import Policy**. 4. In the **Import Policy** dialog box, locate the XML policy file, and click **Open**. 5. The **AppLocker** dialog box will notify you of how many rules were imported. Click **OK**. -  -  diff --git a/windows/keep-secure/increase-a-process-working-set.md b/windows/keep-secure/increase-a-process-working-set.md index 8b8320a5d9..da0458fb81 100644 --- a/windows/keep-secure/increase-a-process-working-set.md +++ b/windows/keep-secure/increase-a-process-working-set.md @@ -2,88 +2,87 @@ title: Increase a process working set (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Increase a process working set security policy setting. ms.assetid: b742ad96-37f3-4686-b8f7-f2b48367105b -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Increase a process working set + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Increase a process working set** security policy setting. + ## Reference + This policy setting determines which users can increase or decrease the size of the working set of a process. The working set of a process is the set of memory pages currently visible to the process in physical RAM. These pages are resident, and they are available for an application to use without triggering a page fault. The minimum and maximum working set sizes affect the virtual memory paging behavior of a process. + Constant: SeIncreaseWorkingSetPrivilege + ### Possible values + - User-defined list of accounts - Not Defined + ### Best practices + - You should make users aware that adverse performance issues may occur if they modify this security setting. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default, standard users have this right. + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not Defined

      Default Domain Controller Policy

      Users

      Stand-Alone Server Default Settings

      Users

      Domain Controller Effective Default Settings

      Users

      Member Server Effective Default Settings

      Users

      Client Computer Effective Default Settings

      Users

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not Defined| +| Default Domain Controller Policy | Users| +| Stand-Alone Server Default Settings| Users| +| Domain Controller Effective Default Settings| Users| +| Member Server Effective Default Settings | Users| +| Client Computer Effective Default Settings | Users|   ## Policy management + This section describes features, tools, and guidance to help you manage this policy. + A restart of the computer is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Increasing the working set size for a process decreases the amount of physical memory that is available to the rest of the system. + ### Countermeasure + Increase user’s awareness about the impact of increasing the working set of a process and how to recognize that their system is adversely affected if they change this setting. + ### Potential impact None. Allowing standard users to increase the working set of a process is the default configuration. ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/increase-scheduling-priority.md b/windows/keep-secure/increase-scheduling-priority.md index 187e8ef3a7..a7d5d1646b 100644 --- a/windows/keep-secure/increase-scheduling-priority.md +++ b/windows/keep-secure/increase-scheduling-priority.md @@ -2,90 +2,92 @@ title: Increase scheduling priority (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Increase scheduling priority security policy setting. ms.assetid: fbec5973-d35e-4797-9626-d0d56061527f -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Increase scheduling priority + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Increase scheduling priority** security policy setting. + ## Reference + This policy setting determines which user accounts can increase the base priority class of a process. It is not a privileged operation to increase relative priority within a priority class. This user right is not required by administrative tools that are supplied with the operating system, but it might be required by software development tools. + Specifically, this security setting determines which accounts can use a process with Write Property access to another process to increase the run priority that is assigned to the other process. A user with this privilege can change the scheduling priority of a process through the Task Manager user interface. + Constant: SeIncreaseBasePriorityPrivilege + ### Possible values + - User-defined list of accounts - Not defined - Administrators + ### Best practices + - Allow the default value, Administrators, as the only account responsible for controlling process scheduling priorities. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default this setting is Administrators on domain controllers and on stand-alone servers. + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Administrators

      Stand-Alone Server Default Settings

      Administrators

      Domain Controller Effective Default Settings

      Administrators

      Member Server Effective Default Settings

      Administrators

      Client Computer Effective Default Settings

      Administrators

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy| Administrators| +| Stand-Alone Server Default Settings | Administrators| +| Domain Controller Effective Default Settings | Administrators| +| Member Server Effective Default Settings | Administrators| +| Client Computer Effective Default Settings | Administrators|   ## Policy management + This section describes features, tools, and guidance to help you manage this policy. + A restart of the computer is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + A user who is assigned this user right could increase the scheduling priority of a process to Real-Time, which would leave little processing time for all other processes and could lead to a denial-of-service condition. + ### Countermeasure + Verify that only Administrators have the **Increase scheduling priority** user right assigned to them. + ### Potential impact + None. Restricting the **Increase scheduling priority** user right to members of the Administrators group is the default configuration. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md b/windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md index 4325b85cc9..2b407e7511 100644 --- a/windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md +++ b/windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md @@ -2,156 +2,176 @@ title: Initialize and configure ownership of the TPM (Windows 10) description: This topic for the IT professional describes how to initialize and set the ownership the Trusted Platform Module (TPM), turn the TPM on and off, and clear TPM keys. ms.assetid: 1166efaf-7aa3-4420-9279-435d9c6ac6f8 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Initialize and configure ownership of the TPM + **Applies to** - Windows 10 + This topic for the IT professional describes how to initialize and set the ownership the Trusted Platform Module (TPM), turn the TPM on and off, and clear TPM keys. It also explains how to troubleshoot issues that you might encounter as a result of using these procedures. + ## About TPM initialization and ownership + The TPM must be initialized and ownership must be taken before it can be used to help secure your computer. The owner of the TPM is the user who possesses the owner password and is able to set it and change it. Only one owner password exists per TPM. The owner of the TPM can make full use of TPM capabilities. Taking ownership of the TPM can be done as part of the initialization process. + When you start the TPM Initialization Wizard, which is accessed through the TPM Microsoft Management Console (MMC), you can determine whether the computer's TPM has been initialized. You can also view the TPM properties. + This topic contains procedures for the following tasks: + - [Initialize the TPM and set ownership](#bkmk-initializetpm) - [Troubleshoot TPM initialization](#bkmk-troubleshootinit) - [Turn on or turn off the TPM](#bkmk-onoff) - [Clear all the keys from the TPM](#bkmk-clear1) - [Use the TPM cmdlets](#bkmk-tpmcmdlets) + ## Initialize the TPM and set ownership + Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. In addition, the computer must be equipped with a Trusted Computing Group-compliant BIOS. + **To start the TPM Initialization Wizard** + 1. Open the TPM Management console (tpm.msc). If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. 2. On the **Action** menu, click **Initialize TPM** to start the TPM Initialization Wizard. 3. If the TPM has never been initialized or is turned off, the TPM Initialization Wizard displays the **Turn on the TPM security hardware** dialog box. This dialog box provides guidance for initializing or turning on the TPM. Follow the instructions in the wizard. - **Note**   - If the TPM is already turned on, the TPM Initialization Wizard displays the **Create the TPM owner password** dialog box. Skip the remainder of this procedure and continue with the [To set ownership of the TPM](#bkmk-setownership) procedure. + + >**Note:** If the TPM is already turned on, the TPM Initialization Wizard displays the **Create the TPM owner password** dialog box. Skip the remainder of this procedure and continue with the [To set ownership of the TPM](#bkmk-setownership) procedure.   - **Note**   - If the TPM Initialization Wizard detects that you do not have a compatible BIOS, you cannot continue with the TPM Initialization Wizard, and you are alerted to consult the computer manufacturer's documentation for instructions to initialize the TPM. + >**Note:**  If the TPM Initialization Wizard detects that you do not have a compatible BIOS, you cannot continue with the TPM Initialization Wizard, and you are alerted to consult the computer manufacturer's documentation for instructions to initialize the TPM.   4. Click **Restart**. 5. Follow the BIOS screen prompts. An acceptance prompt is displayed to ensure that a user has physical access to the computer and that no malicious software is attempting to turn on the TPM. - **Note**   - BIOS screen prompts and the required keystrokes vary by computer manufacturer. + + >**Note:**  BIOS screen prompts and the required keystrokes vary by computer manufacturer.   6. After the computer restarts, sign in to the computer with the same administrative credentials that you used to start this procedure. 7. The TPM Initialization Wizard automatically restarts. If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. 8. Continue with the next procedure to take ownership of the TPM. + To finish initializing the TPM for use, you must set an owner for the TPM. The process of taking ownership includes creating an owner password for the TPM. + **To set ownership of the TPM** + 1. If you are not continuing immediately from the last procedure, start the TPM Initialization Wizard. If you need to review the steps to do so, see the previous procedure [To start the TPM Initialization Wizard](#bkmk-starttpminitwizard). 2. In the **Create the TPM owner password** dialog box, click **Automatically create the password (recommended)**. 3. In the **Save your TPM owner password** dialog box, click **Save the password**. 4. In the **Save As** dialog box, select a location to save the password, and then click **Save**. The password file is saved as *computer\_name.tpm*. - **Important**   - We highly recommend saving the TPM owner password to a removable storage device and storing it in a safe location. + + >**Important:**  We highly recommend saving the TPM owner password to a removable storage device and storing it in a safe location.   5. Click **Print the password** if you want to print a copy of your password. - **Important**   - We highly recommend printing a copy of your TPM owner password and storing it in a safe location. + >**Important:**  We highly recommend printing a copy of your TPM owner password and storing it in a safe location.   6. Click **Initialize**. - **Note**   - The process of initializing the TPM might take a few minutes to complete. + >**Note:**  The process of initializing the TPM might take a few minutes to complete.   7. Click **Close**. - **Caution**   - Do not lose your password. If you do, you will be unable to make administrative changes unless you clear the TPM, which can result in data loss. + >**Caution:**  Do not lose your password. If you do, you will be unable to make administrative changes unless you clear the TPM, which can result in data loss.   ## Troubleshoot TPM initialization + Managing the Trusted Platform Module (TPM) is usually a straightforward procedure. If are unable to complete the initialization procedure, review the following information: + - If the TPM is not detected by Windows, verify that your computer hardware contains a Trusted Computing Group-compliant BIOS. Ensure that no BIOS settings have been used to hide the TPM from the operating system. - If you are attempting to initialize the TPM as part of the BitLocker setup, check which TPM driver is installed on the computer. We recommend always using one of the TPM drivers that is provided by Microsoft and is protected with BitLocker. If a non-Microsoft TPM driver is installed, it may prevent the default TPM driver from loading and cause BitLocker to report that a TPM is not present on the computer. If you have a non-Microsoft driver installed, remove it and then try to initialize the TPM. The following table lists the three standard TPM drivers that are provided by Microsoft. - - - - - - - - - - - - - - - - - - - - - - - - - -
      Driver nameManufacturer

      Trusted Platform Module 1.2

      (Standard)

      Broadcom Trusted Platform Module (A1), v1.2

      Broadcom

      Broadcom Trusted Platform Module (A2), v1.2

      Broadcom

      + +| Driver name | Manufacturer | +| - | - | +| Trusted Platform Module 1.2 | (Standard)| +| Broadcom Trusted Platform Module (A1), v1.2 | Broadcom| +| Broadcom Trusted Platform Module (A2), v1.2 | Broadcom|   - If the TPM has been previously initialized and you do not have the owner password, you may have to clear or reset the TPM to the factory default values. For more information, see [Clear all the keys from the TPM](#bkmk-clear1). - **Caution**   - Clearing the TPM can result in data loss. To avoid data loss, make sure that you have a backup or recovery method for any data that is protected or encrypted by the TPM. + > **Caution:**  Clearing the TPM can result in data loss. To avoid data loss, make sure that you have a backup or recovery method for any data that is protected or encrypted by the TPM.   Because your TPM security hardware is a physical part of your computer, you may want to read the manuals or instructions that came with your computer, or search the manufacturer's website. + **Network connection** + You cannot complete the initialization of the Trusted Platform Module (TPM) when your computer is disconnected from your organization's network if either of the following conditions exist: + - An administrator has configured your computer to require that TPM recovery information be saved in Active Directory Domain Services (AD DS). This requirement can be configured through Group Policy. - A domain controller cannot be reached. This can occur on a computer that is currently disconnected from the network, separated from the domain by a firewall, or experiencing a network component failure (such as an unplugged cable or a faulty network adapter). + In either case, an error message appears, and you cannot complete the initialization process. To avoid this issue, initialize the TPM while you are connected to the corporate network and you can contact a domain controller. + **Systems with multiple TPMs** + Some systems may have multiple TPMs and the active TPM may be toggled in the BIOS. Windows 10 does not support this behavior. If you switch TPMs, functionality that depends on the TPM will not work with the new TPM unless it is cleared and put through provisioning. Performing this clear may cause data loss, in particular of keys and certificates associated with the previous TPM. For example, toggling TPMs will cause Bitlocker to enter recovery mode. It is strongly recommended that, on systems with two TPMs, one TPM is selected to be used and the selection is not changed. + ## Turn on or turn off the TPM + Normally, the TPM is turned on as part of the TPM initialization process. You do not normally need to turn the TPM on or off. However, if necessary you can do so by using the TPM MMC. + ### Turn on the TPM + If the TPM has been initialized but has never been used, or if you want to use the TPM after you have turned it off, you can use the following procedure to turn on the TPM. + **To turn on the TPM** + 1. Open the TPM MMC (tpm.msc). 2. In the **Action** pane, click **Turn TPM On** to display the **Turn on the TPM Security Hardware** page. Read the instructions on this page. 3. Click **Shutdown** (or **Restart**), and then follow the BIOS screen prompts. + After the computer restarts, but before you sign in to Windows, you will be prompted to accept the reconfiguration of the TPM. This ensures that the user has physical access to the computer and that malicious software is not attempting to make changes to the TPM. + ### Turn off the TPM -If you want to stop using the services that are provided by the TPM, you can use the TPM MMC to turn off the TPM. If you have the TPM owner password, physical access to the computer is not required to turn off the TPM. If you do not have the TPM owner password, you must have physical access to the computer to turn off the TPM. + +If you want to stop using the services that are provided by the TPM, you can use the TPM MMC to turn off the TPM. If you have the TPM owner password, physical access to the computer is not required to turn off the TPM. If you do not have the TPM owner password, you must have physical access to the +computer to turn off the TPM. + **To turn off the TPM** + 1. Open the TPM MMC (tpm.msc). 2. In the **Action** pane, click **Turn TPM Off** to display the **Turn off the TPM security hardware** page. 3. In the **Turn off the TPM security hardware** dialog box, select a method to enter your owner password and turning off the TPM: + - If you saved your TPM owner password on a removable storage device, insert it, and then click **I have the owner password file**. In the **Select backup file with the TPM owner password** dialog box, click **Browse** to locate the .tpm file that is saved on your removable storage device, click **Open**, and then click **Turn TPM Off**. - If you do not have the removable storage device with your saved TPM owner password, click **I want to enter the password**. In the **Type your TPM owner password** dialog box, type your password (including hyphens), and then click **Turn TPM Off**. - If you do not know your TPM owner password, click **I do not have the TPM owner password**, and follow the instructions that are provided in the dialog box and subsequent BIOS screens to turn off the TPM without entering the password. + ## Clear all the keys from the TPM + Clearing the TPM resets it to an unowned state. After clearing the TPM, you need to complete the TPM initialization process before using software that relies on the TPM, such as BitLocker Drive Encryption. By default, the TPM is initialized automatically. -**Important**   -Clearing the TPM can result in data loss. To avoid data loss, make sure that you have a backup or recovery method for any data that is protected or encrypted by the TPM. + +>**Important:**  Clearing the TPM can result in data loss. To avoid data loss, make sure that you have a backup or recovery method for any data that is protected or encrypted by the TPM.   After the TPM is cleared, it is also turned off. + To temporarily suspend TPM operations, turn off the TPM instead of clearing it. + Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. + **To clear the TPM** + 1. Open the TPM MMC (tpm.msc). 2. If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. 3. Under **Actions**, click **Clear TPM**. - **Warning**   - If the TPM is off, reinitialize it before clearing it. + >**Warning:**  If the TPM is off, reinitialize it before clearing it. + Clearing the TPM resets it to factory defaults and turns it off. You will lose all created keys and data that is protected by those keys.   4. In the **Clear the TPM security hardware** dialog box, select one of the following methods to enter your password and clear the TPM: - If you have the removable storage device with your saved TPM owner password, insert it, and click **I have the owner password file**. In the **Select backup file with the TPM owner password** dialog box, use **Browse** to navigate to the .tpm file that is saved on your removable storage device. Click **Open**, and then click **Clear TPM**. - If you do not have the removable storage device with your saved password, click **I want to enter the owner password**. In the **Type your TPM owner password** dialog box, type your password (including hyphens), and click **Clear TPM**. - If you do not know your TPM owner password, click **I don't have the TPM owner password**, and follow the instructions that are provided to clear the TPM without entering the password. - **Note**   - If you have physical access to the computer, you can clear the TPM and perform a limited number of management tasks without entering the TPM owner password. + >**Note:**  If you have physical access to the computer, you can clear the TPM and perform a limited number of management tasks without entering the TPM owner password.   The status of your TPM is displayed under **Status** in TPM MMC. + ## Use the TPM cmdlets + If you are using Windows PowerShell to manage your computers, you can also manage the TPM by using Windows PowerShell. To install the TPM cmdlets, type the following command: -**dism /online /enable-feature /FeatureName:tpm-psh-cmdlets** + +`dism /online /enable-feature /FeatureName:tpm-psh-cmdlets` + For details about the individual cmdlets, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx). + ## Additional resources + For more info about TPM, see [Trusted Platform Module Technology Overview](trusted-platform-module-overview.md#bkmk-additionalresources). -  -  From 171964c58b5b45495f3df91fc9affba2f2f4e2b8 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Tue, 24 May 2016 11:53:45 -0700 Subject: [PATCH 401/439] fixing spacing issues --- ...-information-when-the-session-is-locked.md | 91 +++++++++-------- ...ive-logon-do-not-display-last-user-name.md | 85 ++++++++-------- ...ctive-logon-do-not-require-ctrl-alt-del.md | 87 +++++++++-------- ...logon-machine-account-lockout-threshold.md | 87 +++++++++-------- ...eractive-logon-machine-inactivity-limit.md | 82 ++++++++-------- ...age-text-for-users-attempting-to-log-on.md | 94 +++++++++--------- ...ge-title-for-users-attempting-to-log-on.md | 92 +++++++++--------- ...case-domain-controller-is-not-available.md | 97 ++++++++++--------- ...er-to-change-password-before-expiration.md | 83 ++++++++-------- ...er-authentication-to-unlock-workstation.md | 86 ++++++++-------- .../interactive-logon-require-smart-card.md | 87 +++++++++-------- ...ctive-logon-smart-card-removal-behavior.md | 93 ++++++++++-------- 12 files changed, 549 insertions(+), 515 deletions(-) diff --git a/windows/keep-secure/interactive-logon-display-user-information-when-the-session-is-locked.md b/windows/keep-secure/interactive-logon-display-user-information-when-the-session-is-locked.md index 094e59fedf..998c7d3a6d 100644 --- a/windows/keep-secure/interactive-logon-display-user-information-when-the-session-is-locked.md +++ b/windows/keep-secure/interactive-logon-display-user-information-when-the-session-is-locked.md @@ -2,91 +2,98 @@ title: Interactive logon Display user information when the session is locked (Windows 10) description: Describes the best practices, location, values, and security considerations for the Interactive logon Display user information when the session is locked security policy setting. ms.assetid: 9146aa3d-9b2f-47ba-ac03-ff43efb10530 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Interactive logon: Display user information when the session is locked + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Interactive logon: Display user information when the session is locked** security policy setting. + ## Reference When a session is locked in a Windows operating system (meaning the user at the computer pressed CTRL+ALT+DEL and the Secure Desktop is displayed), user information is displayed. By default, this information is in the form of **<user name> is logged on**. The displayed user name is the user’s full name as set on the Properties page for that user. These settings do not apply to the logon tiles, which are displayed on the desktop after using the **Switch User** feature. The information that is displayed can be changed to meet your security requirements using the following possible values. + ### Possible values + - **User display name, domain and user names** + If this is a local logon, the user’s full name is displayed on the Secure Desktop. If it is a domain logon, the user’s domain and user’s account name is displayed. + - **User display name only** + The name of the user who locked the session is displayed on the Secure Desktop as the user’s full name. + - **Do not display user information** + No names are displayed on the Secure Desktop, but user’s full names will be displayed on the **Switch user** desktop. + - Blank. + Default setting. This translates to “Not defined,” but it will display the user’s full name in the same manner as the **User display name, domain and user names** option. When an option is set, you cannot reset this policy to blank, or not defined. + ### Best practices + Your implementation of this policy depends on your security requirements for displayed logon information. If you have devices that store sensitive data, with monitors displayed in unsecured locations, or if you have computers with sensitive data that are remotely accessed, revealing logged on user’s full names or domain account names might contradict your overall security policy. + Depending on your security policy, you might also want to enable the [Interactive logon: Do not display last user name](interactive-logon-do-not-display-last-user-name.md) policy, which will prevent the Windows operating system from displaying the logon name and logon tile of the last user to logon. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or Group Policy object (GPO)Default value

      Default domain policy

      Not defined

      Default domain controller policy

      Not defined

      Stand-alone server default settings

      Not defined

      Domain controller effective default settings

      User display name, domain and user names

      Member server effective default settings

      User display name, domain and user names

      Effective GPO default settings on client computers

      User display name, domain and user names

      + +| Server type or Group Policy object (GPO) | Default value | +| - | - | +| Default domain policy| Not defined| +| Default domain controller policy | Not defined| +| Stand-alone server default settings | Not defined| +| Domain controller effective default settings | **User display name, domain and user names**| +| Member server effective default settings | **User display name, domain and user names**| +| Effective GPO default settings on client computers | **User display name, domain and user names**|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Policy conflict considerations + None + ### Group Policy + This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local computer by using the Local Security Policy snap-in. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + When a computer displays the Secure Desktop in an unsecured area, certain user information can be readily available to anyone looking at the monitor, either physically or through a remote connection. The displayed user information could include the domain user account name or the full name of the user who locked the session or who had logged on last. + ### Countermeasure + Enabling this policy setting allows the operating system to hide certain user information from being displayed on the Secure Desktop (after the device has been booted or when the session has been locked by using CTRL+ALT+DEL). However, user information is displayed if the **Switch user** feature is used so that the logon tiles are displayed for each logged on user. + You might also want to enable the [Interactive logon: Do not display last user name](interactive-logon-do-not-display-last-user-name.md) policy, which will prevent the Windows operating system from displaying the logon name and logon tile of the last user to logon. + ### Potential impact + If you do not enable this policy, the effect will be the same as enabling the policy and selecting the **User display name, domain and user names** option. + If the policy is enabled and set to **Do not display user information**, an observer cannot see who is logged onto the Secure Desktop, but the logon tile is still present if the [Interactive logon: Do not display last user name](interactive-logon-do-not-display-last-user-name.md) policy is not enabled. Depending on how the logon tiles are configured, they could provide visual clues as to who is logged on. In addition, if the Interactive logon: Do not display last user name policy is not enabled, then the **Switch user** feature will show user information. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/interactive-logon-do-not-display-last-user-name.md b/windows/keep-secure/interactive-logon-do-not-display-last-user-name.md index 65a5067ae3..945989b859 100644 --- a/windows/keep-secure/interactive-logon-do-not-display-last-user-name.md +++ b/windows/keep-secure/interactive-logon-do-not-display-last-user-name.md @@ -2,86 +2,87 @@ title: Interactive logon Do not display last user name (Windows 10) description: Describes the best practices, location, values, and security considerations for the Interactive logon Do not display last user name security policy setting. ms.assetid: 98b24b03-95fe-4edc-8e97-cbdaa8e314fd -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Interactive logon: Do not display last user name + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Interactive logon: Do not display last user name** security policy setting. + ## Reference + This security policy setting determines whether the name of the last user to log on to the device is displayed on the Secure Desktop. + If this policy is enabled, the full name of the last user to successfully log on is not displayed on the Secure Desktop, nor is the user’s logon tile displayed. Additionally, if the **Switch user** feature is used, the full name and logon tile are not displayed. The logon screen requests a qualified domain account name (or local user name) and password. + If this policy is disabled, the full name of the last user to log on is displayed, and the user’s logon tile is displayed. This behavior is the same when the **Switch user** feature is used. + ### Possible values + - Enabled - Disabled - Not defined + ### Best practices + Your implementation of this policy depends on your security requirements for displayed logon information. If you have devices that store sensitive data, with monitors displayed in unsecured locations, or if you have devices with sensitive data that are remotely accessed, revealing logged on user’s full names or domain account names might contradict your overall security policy. + Depending on your security policy, you might also want to enable the [Interactive logon: Display user information when the session is locked](interactive-logon-display-user-information-when-the-session-is-locked.md) policy, which will prevent the Windows operating system from displaying the logon name when the session is locked or started. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or Group Policy object (GPO)Default value

      Default domain policy

      Disabled

      Default domain controller policy

      Disabled

      Stand-alone server default settings

      Disabled

      Domain controller effective default settings

      Disabled

      Member server effective default settings

      Disabled

      Effective GPO default settings on client computers

      Disabled

      + +| Server type or Group Policy object (GPO) | Default value| +| - | - | +| Default domain policy| Disabled| +| Default domain controller policy| Disabled| +| Stand-alone server default settings | Disabled| +| Domain controller effective default settings | Disabled| +| Member server effective default settings | Disabled| +| Effective GPO default settings on client computers | Disabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Policy conflict considerations + None. + ### Group Policy + This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local computer by using the Local Security Policy snap-in. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + An attacker with access to the console (for example, someone with physical access or someone who can connect to the device through Remote Desktop Session Host) could view the name of the last user who logged on. The attacker could then try to guess the password, use a dictionary, or use a brute-force attack to try to log on. + ### Countermeasure + Enable the **Interactive logon: Do not display last user name** setting. + ### Potential impact + Users must always type their user names and passwords when they log on locally or to the domain. The logon tiles of all logged on users are not displayed. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/interactive-logon-do-not-require-ctrl-alt-del.md b/windows/keep-secure/interactive-logon-do-not-require-ctrl-alt-del.md index 19bd4de7a1..34a748af68 100644 --- a/windows/keep-secure/interactive-logon-do-not-require-ctrl-alt-del.md +++ b/windows/keep-secure/interactive-logon-do-not-require-ctrl-alt-del.md @@ -2,89 +2,92 @@ title: Interactive logon Do not require CTRL+ALT+DEL (Windows 10) description: Describes the best practices, location, values, and security considerations for the Interactive logon Do not require CTRL+ALT+DEL security policy setting. ms.assetid: 04e2c000-2eb2-4d4b-8179-1e2cb4793e18 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- # Interactive logon: Do not require CTRL+ALT+DEL + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Interactive logon: Do not require CTRL+ALT+DEL** security policy setting. + ## Reference + This security setting determines whether pressing CTRL+ALT+DEL is required before a user can log on. + If this policy setting is enabled on a device, a user is not required to press CTRL+ALT+DEL to log on. Not having to press CTRL+ALT+DEL leaves users susceptible to attacks that attempt to intercept the users' passwords. Requiring CTRL+ALT+DEL before users log on ensures that users are communicating by means of a trusted path when entering their passwords. + If this policy is disabled, any user is required to press CTRL+ALT+DEL before logging on to the Windows operating system (unless they are using a smart card for logon). + Microsoft developed this feature to make it easier for users with certain types of physical impairments to log on to device running the Windows operating system; however, not having to press the CTRL+ALT+DELETE key combination leaves users susceptible to attacks that attempt to intercept their passwords. Requiring CTRL+ALT+DELETE before users log on ensures that users are communicating by means of a trusted path when entering their passwords. + A malicious user might install malware that looks like the standard logon dialog box for the Windows operating system, and capture a user's password. The attacker can then log on to the compromised account with whatever level of user rights that user has. + ### Possible values + - Enabled - Disabled - Not defined + ### Best practices + - It is advisable to set **Disable CTRL+ALT+DEL requirement for logon** to **Disabled**. Unless they are using a smart card to log on, users will have to simultaneously press three keys before the logon dialog box appears. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Disabled

      DC Effective Default Settings

      Disabled

      Member Server Effective Default Settings

      Disabled

      Client Computer Effective Default Settings

      Disabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Policy conflict considerations + Beginning with Windows Server 2008 and Windows Vista, the CTRL+ALT+DELETE key combination is required to authenticate if this policy is disabled. + ### Group Policy + This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local computer by using the Local Security Policy snap-in. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + This setting makes it easier for users with certain types of physical impairments to log on to devices that run the Windows operating system. However, if users are not required to press CTRL+ALT+DEL, they are susceptible to attacks that attempt to intercept their passwords. If CTRL+ALT+DEL is required before logon, user passwords are communicated by means of a trusted path. + If this setting is enabled, an attacker could install malware that looks like the standard logon dialog box in the Windows operating system, and capture the user's password. The attacker would then be able to log on to the compromised account with whatever level of privilege that user has. + ### Countermeasure + Disable the **Interactive logon: Do not require CTRL+ALT+DEL** setting. + ### Potential impact + Unless they use a smart card to log on, users must simultaneously press the three keys before the logon dialog box is displayed. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/interactive-logon-machine-account-lockout-threshold.md b/windows/keep-secure/interactive-logon-machine-account-lockout-threshold.md index baa13fc5c0..3e7824eedb 100644 --- a/windows/keep-secure/interactive-logon-machine-account-lockout-threshold.md +++ b/windows/keep-secure/interactive-logon-machine-account-lockout-threshold.md @@ -2,84 +2,85 @@ title: Interactive logon Machine account lockout threshold (Windows 10) description: Describes the best practices, location, values, management, and security considerations for the Interactive logon Machine account lockout threshold security policy setting. ms.assetid: ebbd8e22-2611-4ebe-9db9-d49344e631e4 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Interactive logon: Machine account lockout threshold + **Applies to** - Windows 10 + Describes the best practices, location, values, management, and security considerations for the **Interactive logon: Machine account lockout threshold** security policy setting. + ## Reference + Beginning with Windows Server 2012 and Windows 8, the **Interactive logon: Machine account threshold** security policy setting enforces the lockout policy on those computers that have BitLocker enabled to protect operating system volumes. + The security setting allows you to set a threshold for the number of failed logon attempts that causes the device to be locked by using BitLocker. This means, if the specified maximum number of failed logon attempts is exceeded, the device will invalidate the Trusted Platform Module (TPM) protector and any other protector except the 48-digit recovery password, and then reboot. During Device Lockout mode, the computer or device only boots into the touch-enabled Windows Recovery Environment (WinRE) until an authorized user enters the recovery password to restore full access. + Failed password attempts on workstations or member servers that have been locked by using either Ctrl+Alt+Delete or password-protected screen savers count as failed logon attempts. + ### Possible values + You can set the **invalid logon attempts** value between 1 and 999. Values from 1 to 3 are interpreted as 4. If you set the value to 0, or leave blank, the computer or device will never be locked as a result of this policy setting. -### Best practices + +### Best practices + Use this policy setting in conjunction with your other failed account logon attempts policy. For example, if the [Account lockout threshold](account-lockout-threshold.md) policy setting is set at 4, then setting **Interactive logon: Machine account lockout threshold** at 6 allows the user to restore access to resources without having to restore access to the device resulting from a BitLocker lock out. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Disabled

      DC Effective Default Settings

      Disabled

      Member Server Effective Default Settings

      Disabled

      Client Computer Effective Default Settings

      Disabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined | +| Stand-Alone Server Default Settings| Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled | +| Client Computer Effective Default Settings | Disabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + A restart is required for changes to this policy to become effective when they are saved locally or distributed through Group Policy. + ### Group Policy + Because this policy setting was introduced in Windows Server 2012 and Windows 8, it can only be set locally on those devices that contain this policy setting, but it can be set and distributed through Group Policy to any computer running the Windows operating system that supports Group Policy and is BitLocker-enabled. + When setting this policy, consider the [Account lockout threshold](account-lockout-threshold.md) policy setting, which determines the number of failed logon attempts that will cause a user account to be locked out. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + This policy setting helps protect a BitLocker-encrypted device from attackers attempting to brute-force guess the Windows sign-in password. If not set, then attackers can attempt innumerable passwords, if no other account protection mechanisms are in place. + ### Countermeasure + Use this policy setting in conjunction with your other failed account logon attempts policy. For example, if the [Account lockout threshold](account-lockout-threshold.md) policy setting is set at 4, then setting **Interactive logon: Machine account lockout threshold** at 6 allows the user to restore access to resources without having to restore access to the device resulting from a BitLocker lock out. + ### Potential impact + If not set, the device could be compromised by an attacker using brute-force password cracking software. + If set too low, productivity might be hindered because users who become locked out will be unable to access the device without providing the 48-digit BitLocker recovery password. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/interactive-logon-machine-inactivity-limit.md b/windows/keep-secure/interactive-logon-machine-inactivity-limit.md index 969511b2b4..9fb56662fb 100644 --- a/windows/keep-secure/interactive-logon-machine-inactivity-limit.md +++ b/windows/keep-secure/interactive-logon-machine-inactivity-limit.md @@ -2,81 +2,79 @@ title: Interactive logon Machine inactivity limit (Windows 10) description: Describes the best practices, location, values, management, and security considerations for the Interactive logon Machine inactivity limit security policy setting. ms.assetid: 7065b4a9-0d52-41d5-afc4-5aedfc4162b5 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Interactive logon: Machine inactivity limit + **Applies to** - Windows 10 + Describes the best practices, location, values, management, and security considerations for the **Interactive logon: Machine inactivity limit** security policy setting. + ## Reference + Beginning with Windows Server 2012 and Windows 8, Windows detects user-input inactivity of a sign-in (logon) session by using the security policy setting **Interactive logon: Machine inactivity limit**. If the amount of inactive time exceeds the inactivity limit set by this policy, then the user’s session locks by invoking the screen saver. This policy setting allows you to control the locking time by using Group Policy. + ### Possible values + The automatic lock of the device is set in elapsed seconds of inactivity, which can range from zero (0) to 599,940 seconds (166.65 hours). + If no value (blank) or zero (0) is present in the **Machine will be locked after** input field, then the policy setting is disabled and no action is taken on user-input inactivity for the session. + ### Best practices + Set the time for elapsed user-input inactivity based on the device’s usage and location requirements. For example, if the device or device is in a public area, you might want to have the device automatically lock after a short period of inactivity to prevent unauthorized access. However, if the device is used by an individual or group of trusted individuals, such as in a restricted manufacturing area, automatically locking the device might hinder productivity. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Disabled

      DC Effective Default Settings

      Disabled

      Member Server Effective Default Settings

      Disabled

      Client Computer Effective Default Settings

      Disabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + Restart is required for changes to this policy to become effective when they are saved locally or distributed through Group Policy. + ### Group Policy + Because this policy setting was introduced in Windows Server 2012 and Windows 8, it can only be set locally on those computers that contain this policy setting, but it can be set and distributed through Group Policy to any computer running the Windows operating system that supports Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + This policy setting helps you prevent unauthorized access to devices under your control when the currently signed-in user leaves without deliberately locking the desktop. In versions earlier than Windows Server 2012 and Windows 8, the desktop-locking mechanism was set on individual computers in Personalization in Control Panel. + ### Countermeasure + Set the time for elapsed user-input inactivity time by using the security policy setting **Interactive logon: Machine inactivity limit** based on the device’s usage and location requirements. + ### Potential impact + This security policy setting can limit unauthorized access to unsecured computers; however, that requirement must be balanced with the productivity requirements of the intended user. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/interactive-logon-message-text-for-users-attempting-to-log-on.md b/windows/keep-secure/interactive-logon-message-text-for-users-attempting-to-log-on.md index b8962d626a..2277884c62 100644 --- a/windows/keep-secure/interactive-logon-message-text-for-users-attempting-to-log-on.md +++ b/windows/keep-secure/interactive-logon-message-text-for-users-attempting-to-log-on.md @@ -2,94 +2,94 @@ title: Interactive logon Message text for users attempting to log on (Windows 10) description: Describes the best practices, location, values, management, and security considerations for the Interactive logon Message text for users attempting to log on security policy setting. ms.assetid: fcfe8a6d-ca65-4403-b9e6-2fa017a31c2e -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Interactive logon: Message text for users attempting to log on + **Applies to** - Windows 10 + Describes the best practices, location, values, management, and security considerations for the **Interactive logon: Message text for users attempting to log on** security policy setting. + ## Reference -The **Interactive logon: Message text for users attempting to log on** and [Interactive logon: Message title for users attempting to log on](interactive-logon-message-title-for-users-attempting-to-log-on.md) policy settings are closely related. **Interactive logon: Message text for users attempting to log on** specifies a text message to be displayed to users when they log on. Interactive logon: Message title for users attempting to log on specifies a title to appear in the title bar of the window that contains the text message. This text is often used for legal reasons—for example, to warn users about the ramifications of misusing company information, or to warn them that their actions might be audited. + +The **Interactive logon: Message text for users attempting to log on** and [Interactive logon: Message title for users attempting to log on](interactive-logon-message-title-for-users-attempting-to-log-on.md) policy settings are closely related. **Interactive logon: Message text for users attempting to log on** specifies a text message to be displayed to users when they log on. Interactive logon: Message title for users attempting to log on specifies a title to appear in the title bar of the window that contains the text message. This text is often used for legal reasons—for example, to warn +users about the ramifications of misusing company information, or to warn them that their actions might be audited. + Not using this warning-message policy setting leaves your organization legally vulnerable to trespassers who unlawfully penetrate your network. Legal precedents have established that organizations that display warnings to users who connect to their servers over a network have a higher rate of successfully prosecuting trespassers. + When these policy settings are configured, users will see a dialog box before they can log on to the server console. + ### Possible values + The possible values for this setting are: + - User-defined text - Not defined + ### Best practices + - It is advisable to set **Interactive logon: Message text for users attempting to log on** to a value similar to one of the following: + 1. IT IS AN OFFENSE TO CONTINUE WITHOUT PROPER AUTHORIZATION. 2. This system is restricted to authorized users. Individuals who attempt unauthorized access will be prosecuted. If you are unauthorized, terminate access now. Click OK to indicate your acceptance of this information. -**Important**   -Any warning that you display in the title or text should be approved by representatives from your organization's legal and human resources departments. +>**Important:**  Any warning that you display in the title or text should be approved by representatives from your organization's legal and human resources departments.   ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Not defined

      DC Effective Default Settings

      Not defined

      Member Server Effective Default Settings

      Not defined

      Client Computer Effective Default Settings

      Not defined

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Not defined| +| DC Effective Default Settings | Not defined| +| Member Server Effective Default Settings | Not defined| +| Client Computer Effective Default Settings | Not defined|   ## Policy management + This section describes different requirements to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + There are two policy settings that relate to logon displays: + - **Interactive logon: Message text for users attempting to log on** - [Interactive logon: Message title for users attempting to log on](interactive-logon-message-title-for-users-attempting-to-log-on.md) + The first policy setting specifies a text message that displays to users when they log on, and the second policy setting specifies a title for the title bar of the text message window. Many organizations use this text for legal purposes; for example, to warn users about the ramifications of misuse of company information, or to warn them that their actions may be audited. + ### Vulnerability + Users often do not understand the importance of security practices. However, the display of a warning message before logon may help prevent an attack by warning malicious or uninformed users about the consequences of their misconduct before it happens. It may also help reinforce corporate policies by notifying employees of appropriate policies during the logon process. + ### Countermeasure + Configure the **Interactive logon: Message text for users attempting to log on** and [Interactive logon: Message title for users attempting to log on](interactive-logon-message-title-for-users-attempting-to-log-on.md) settings to an appropriate value for your organization. -**Note**   -Any warning message that displays should be approved by your organization's legal and human resources representatives. + +>**Note:**  Any warning message that displays should be approved by your organization's legal and human resources representatives.   ### Potential impact + Users see a message in a dialog box before they can log on to the server console. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md)  diff --git a/windows/keep-secure/interactive-logon-message-title-for-users-attempting-to-log-on.md b/windows/keep-secure/interactive-logon-message-title-for-users-attempting-to-log-on.md index dcc618ac81..7e5719c49b 100644 --- a/windows/keep-secure/interactive-logon-message-title-for-users-attempting-to-log-on.md +++ b/windows/keep-secure/interactive-logon-message-title-for-users-attempting-to-log-on.md @@ -2,93 +2,97 @@ title: Interactive logon Message title for users attempting to log on (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Interactive logon Message title for users attempting to log on security policy setting. ms.assetid: f2596470-4cc0-4ef1-849c-bef9dc3533c6 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Interactive logon: Message title for users attempting to log on + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **Interactive logon: Message title for users attempting to log on** security policy setting. + ## Reference + This security setting allows you to specify a title that appears in the title bar of the window that contains the **Interactive logon: Message title for users attempting to log on**. This text is often used for legal reasons—for example, to warn users about the ramifications of misusing company information, or to warn them that their actions might be audited. + The **Interactive logon: Message title for users attempting to log on** and [Interactive logon: Message text for users attempting to log on](interactive-logon-message-text-for-users-attempting-to-log-on.md) policy settings are closely related. **Interactive logon: Message title for users attempting to log on** specifies a message title to be displayed to users when they log on. + Not using this warning-message policy setting leaves your organization legally vulnerable to trespassers who unlawfully penetrate your network. Legal precedents have established that organizations that display warnings to users who connect to their servers over a network have a higher rate of successfully prosecuting trespassers. + When these policy settings are configured, users will see a dialog box before they can log on to the server console. + ### Possible values + - *User-defined title* - Not defined + ### Best practices + 1. It is advisable to set **Interactive logon: Message title for users attempting to log on** to a value similar to one the following: + - RESTRICTED SYSTEM + or + - WARNING: This system is restricted to authorized users. + 2. Set the policy [Interactive logon: Message text for users attempting to log on](interactive-logon-message-text-for-users-attempting-to-log-on.md) to reinforce the meaning of the message’s title. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Not defined

      DC Effective Default Settings

      Not defined

      Member Server Effective Default Settings

      Not defined

      Client Computer Effective Default Settings

      Not defined

      + +|Server type or GPO | Default value| +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Not defined| +| DC Effective Default Settings | Not defined| +| Member Server Effective Default Settings | Not defined| +| Client Computer Effective Default Settings | Not defined|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + There are two policy settings that relate to logon displays: + - [Interactive logon: Message text for users attempting to log on](interactive-logon-message-text-for-users-attempting-to-log-on.md) - **Interactive logon: Message title for users attempting to log on** + The first policy setting specifies a text message that displays to users when they log on, and the second policy setting specifies a title for the title bar of the text message window. Many organizations use this text for legal purposes; for example, to warn users about the ramifications of misuse of company information, or to warn them that their actions may be audited. + ### Vulnerability + Users often do not understand the importance of security practices. However, the display of a warning message with an appropriate title before logon may help prevent an attack by warning malicious or uninformed users about the consequences of their misconduct before it happens. It may also help reinforce corporate policies by notifying employees of appropriate policies during the logon process. + ### Countermeasure + Configure the [Interactive logon: Message text for users attempting to log on](interactive-logon-message-text-for-users-attempting-to-log-on.md) and **Interactive logon: Message title for users attempting to log on** settings to an appropriate value for your organization. -**Note**   -Any warning message that displays should be approved by your organization's legal and human resources representatives. + +>**Note:**  Any warning message that displays should be approved by your organization's legal and human resources representatives.   ### Potential impact + Users see a message in a dialog box before they can log on to the server console. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md b/windows/keep-secure/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md index 14605564d2..651f08183b 100644 --- a/windows/keep-secure/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md +++ b/windows/keep-secure/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md @@ -2,91 +2,100 @@ title: Interactive logon Number of previous logons to cache (in case domain controller is not available) (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Interactive logon Number of previous logons to cache (in case domain controller is not available) security policy setting. ms.assetid: 660e925e-cc3e-4098-a41e-eb8db8062d8d -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Interactive logon: Number of previous logons to cache (in case domain controller is not available) + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **Interactive logon: Number of previous logons to cache (in case domain controller is not available)** security policy setting. + ## Reference + The **Interactive logon: Number of previous logons to cache (in case domain controller is not available**) policy setting determines whether a user can log on to a Windows domain by using cached account information. Logon information for domain accounts can be cached locally so that, if a domain controller cannot be contacted on subsequent logons, a user can still log on. This policy setting determines the number of unique users whose logon information is cached locally. + If a domain controller is unavailable and a user's logon information is cached, the user is prompted with the following message: + A domain controller for your domain could not be contacted. You have been logged on using cached account information. Changes to your profile since you last logged on might not be available. + If a domain controller is unavailable and a user's logon information is not cached, the user is prompted with this message: + The system cannot log you on now because the domain *DOMAIN NAME* is not available. + The value of this policy setting indicates the number of users whose logon information the server caches locally. If the value is 10, the server caches logon information for 10 users. When an eleventh user logs on to the device, the server overwrites the oldest cached logon session. -Users who access the server console will have their logon credentials cached on that server. A malicious user who is able to access the file system of the server can locate this cached information and use a brute-force attack to determine user passwords. Windows mitigates this type of attack by encrypting the information and keeping the cached credentials in the system's registries, which are spread across numerous physical locations. + +Users who access the server console will have their logon credentials cached on that server. A malicious user who is able to access the file system of the server can locate this cached information and use a brute-force attack to determine user passwords. Windows mitigates this type of attack by +encrypting the information and keeping the cached credentials in the system's registries, which are spread across numerous physical locations. + ### Possible values + - A user-defined number from 0 through 50 - Not defined + ### Best practices + It is advisable to set **Interactive logon: Number of previous logons to cache (in case domain controller is not available)** to 0. Setting this value to 0 disables the local caching of logon information. Additional countermeasures include enforcing strong password policies and physically securing the computers. If the value is set to 0, users will be unable to log on to any computers if there is no domain controller available to authenticate them. Organizations might want to set **Interactive logon: Number of previous logons to cache (in case domain controller is not available)** to 2 for end-user systems, especially for mobile users. Setting this value to 2 means that the user's logon information will still be in the cache even if a member of the IT department has recently logged on to their device to perform system maintenance. This way, those users will be able to log on to their devices when they are not connected to the corporate network. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      10 logons

      DC Effective Default Settings

      10 logons

      Member Server Effective Default Settings

      10 logons

      Client Computer Effective Default Settings

      10 logons

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | 10 logons| +| DC Effective Default Settings | 10 logons| +| Member Server Effective Default Settings | 10 logons| +| Client Computer Effective Default Settings| 10 logons|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. + ### Policy conflict considerations + None + ### Group Policy + This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local computer by using the Local Security Policy snap-in. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + The number that is assigned to this policy setting indicates the number of users whose logon information is cache locally by the servers. If the number is set to 10, the server caches logon information for 10 users. When an eleventh user logs on to the device, the server overwrites the oldest cached logon session. + Users who access the server console have their logon credentials cached on that server. An attacker who is able to access the file system of the server could locate this cached information and use a brute force attack to attempt to determine user passwords. + To mitigate this type of attack, Windows encrypts the information and obscures its physical location. + ### Countermeasure + Configure the **Interactive logon: Number of previous logons to cache (in case domain controller is not available)** setting to 0, which disables the local caching of logon information. Additional countermeasures include enforcement of strong password policies and physically secure locations for the computers. + ### Potential impact -Users cannot log on to any devices if there is no domain controller available to authenticate them. Organizations can configure this value to 2 for end-user computers, especially for mobile users. A configuration value of 2 means that the user's logon information is still in the cache, even if a member of the IT department has recently logged on to the device to perform system maintenance. This method allows users to log on to their computers when they are not connected to the organization's network. + +Users cannot log on to any devices if there is no domain controller available to authenticate them. Organizations can configure this value to 2 for end-user computers, especially for mobile users. A configuration value of 2 means that the user's logon information is still in the cache, even if a +member of the IT department has recently logged on to the device to perform system maintenance. This method allows users to log on to their computers when they are not connected to the organization's network. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/interactive-logon-prompt-user-to-change-password-before-expiration.md b/windows/keep-secure/interactive-logon-prompt-user-to-change-password-before-expiration.md index f499d1b051..6e08f688d8 100644 --- a/windows/keep-secure/interactive-logon-prompt-user-to-change-password-before-expiration.md +++ b/windows/keep-secure/interactive-logon-prompt-user-to-change-password-before-expiration.md @@ -2,85 +2,84 @@ title: Interactive logon Prompt user to change password before expiration (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Interactive logon Prompt user to change password before expiration security policy setting. ms.assetid: 8fe94781-40f7-4fbe-8cfd-5e116e6833e9 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Interactive logon: Prompt user to change password before expiration + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **Interactive logon: Prompt user to change password before expiration** security policy setting. + ## Reference + The **Interactive logon: Prompt user to change password before expiration** policy setting determines how many days in advance users are warned that their passwords are about to expire. With this advance warning, the user has time to construct a password that is sufficiently strong. + ### Possible values + - A user-defined number of days from 0 through 999. - Not defined. + ### Best practices + 1. Configure user passwords to expire periodically. Users will need warning that their passwords are going to expire, or they might inadvertently get locked out of the system. This could lead to confusion for users who access the network locally, or make it impossible for users who access the network through dial-up or virtual private network (VPN) connections to log on. 2. Set **Interactive logon: Prompt user to change password before expiration** to 5 days. When their password expiration date is 5 or fewer days away, users will see a dialog box each time they log on to the domain. 3. Do not set the value to 0, which results in displaying the password expiration warning every time the user logs on. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      14 days *

      DC Effective Default Settings

      14 days *

      Member Server Effective Default Settings

      14 days *

      Client Computer Effective Default Settings

      14 days *

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | 14 days| +| DC Effective Default Settings | 14 days | +| Member Server Effective Default Settings| 14 days | +| Client Computer Effective Default Settings | 14 days|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Policy conflict considerations + None. + ### Group Policy + This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local computer by using the Local Security Policy snap-in. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + If user passwords are configured to expire periodically in your organization, users need to be warned when this is about to happen, or they may be locked out of the device inadvertently when their passwords expire. This condition could lead to confusion for users who access the network locally, or make it impossible for users to access your organization's network through dial-up or virtual private network (VPN) connections. + ### Countermeasure + Configure the **Interactive logon: Prompt user to change password before expiration** setting to 14 days. + ### Potential impact + Users see a dialog-box prompt to change their password each time that they log on to the domain when their password is configured to expire in 14 or fewer days. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md b/windows/keep-secure/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md index 97aa85187c..9660b5770a 100644 --- a/windows/keep-secure/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md +++ b/windows/keep-secure/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md @@ -2,87 +2,89 @@ title: Interactive logon Require Domain Controller authentication to unlock workstation (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Interactive logon Require Domain Controller authentication to unlock workstation security policy setting. ms.assetid: 97618ed3-e946-47db-a212-b5e7a4fc6ffc -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Interactive logon: Require Domain Controller authentication to unlock workstation + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Interactive logon: Require Domain Controller authentication to unlock workstation** security policy setting. + ## Reference + Unlocking a locked device requires logon information. For domain accounts, the **Interactive logon: Require Domain Controller authentication to unlock workstation** policy setting determines whether it is necessary to contact a domain controller to unlock a device. Enabling this policy setting requires a domain controller to authenticate the domain account that is being used to unlock the device. Disabling this policy setting allows a user to unlock the device without the computer verifying the logon information with a domain controller. However, if [Interactive logon: Number of previous logons to cache (in case domain controller is not available)](interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md) is set to a value greater than zero, the user's cached credentials will be used to unlock the system. + The device caches (locally in memory) the credentials of any users who have been authenticated. The device uses these cached credentials to authenticate anyone who attempts to unlock the console. + When cached credentials are used, any changes that have recently been made to the account (such as user rights assignments, account lockout, or the account being disabled) are not considered or applied after this authentication process. This means not only that user rights are not updated, but more importantly that disabled accounts are still able to unlock the console of the system. + It is advisable to set **Interactive logon: Require Domain Controller authentication to unlock workstation** to Enabled and set [Interactive logon: Number of previous logons to cache (in case domain controller is not available)](interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md) to 0. When the console of a device is locked by a user or automatically by a screen saver time-out, the console can only be unlocked if the user is able to re-authenticate to the domain controller. If no domain controller is available, users cannot unlock their devices. + ### Possible values + - Enabled - Disabled - Not defined + ### Best practices + - Set **Interactive logon: Require Domain Controller authentication to unlock workstation** to Enabled and set [Interactive logon: Number of previous logons to cache (in case domain controller is not available)](interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md) to 0. When the console of a device is locked by a user or automatically by a screen saver time-out, the console can only be unlocked if the user is able to re-authenticate to the domain controller. If no domain controller is available, users cannot unlock their devices. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Disabled

      DC Effective Default Settings

      Disabled

      Member Server Effective Default Settings

      Disabled

      Client Computer Effective Default Settings

      Disabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Policy conflict considerations + None + ### Group Policy + This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local computer by using the Local Security Policy snap-in. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + By default, the device caches locally in memory the credentials of any users who are authenticated. The device uses these cached credentials to authenticate anyone who attempts to unlock the console. When cached credentials are used, any changes that have recently been made to the account—such as user rights assignments, account lockout, or the account being disabled—are not considered or applied after the account is authenticated. User privileges are not updated, and disabled accounts are still able to unlock the console of the device + ### Countermeasure + Configure the **Interactive logon: Require Domain Controller authentication to unlock workstation** setting to Enabled and configure the [Interactive logon: Number of previous logons to cache (in case domain controller is not available)](interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md) setting to 0. + ### Potential impact + When the console on a device is locked by a user or automatically by a screen-saver timeout, the console can be unlocked only if the user can re-authenticate to the domain controller. If no domain controller is available, users cannot unlock their workstations. If you configure the [Interactive logon: Number of previous logons to cache (in case domain controller is not available)](interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md) setting to 0, users whose domain controllers are unavailable (such as mobile or remote users) cannot log on. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/interactive-logon-require-smart-card.md b/windows/keep-secure/interactive-logon-require-smart-card.md index 417a99a5a3..faf1834204 100644 --- a/windows/keep-secure/interactive-logon-require-smart-card.md +++ b/windows/keep-secure/interactive-logon-require-smart-card.md @@ -2,85 +2,86 @@ title: Interactive logon Require smart card (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Interactive logon Require smart card security policy setting. ms.assetid: c6a8c040-cbc7-472d-8bc5-579ddf3cbd6c -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Interactive logon: Require smart card + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **Interactive logon: Require smart card** security policy setting. + ## Reference + The **Interactive logon: Require smart card** policy setting requires users to log on to a device by using a smart card. + Requiring users to use long, complex passwords for authentication enhances network security, especially if the users must change their passwords regularly. This reduces the chance that a malicious user will be able to guess a user's password through a brute-force attack. Using smart cards rather than passwords for authentication dramatically increases security because, with today's technology, it is nearly impossible for a malicious user to impersonate another user. Smart cards that require personal identification numbers (PINs) provide two-factor authentication: the user who attempts to log on must possess the smart card and know its PIN. A malicious user who captures the authentication traffic between the user's device and the domain controller will find it extremely difficult to decrypt the traffic: even if they do, the next time the user logs on to the network, a new session key will be generated for encrypting traffic between the user and the domain controller. + ### Possible values + - Enabled - Disabled - Not defined + ### Best practices + - Set **Interactive logon: Require smart card** to Enabled. All users will have to use smart cards to log on to the network. This means that the organization must have a reliable public key infrastructure (PKI) in place, and provide smart cards and smart card readers for all users. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Disabled

      DC Effective Default Settings

      Disabled

      Member Server Effective Default Settings

      Disabled

      Client Computer Effective Default Settings

      Disabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Policy conflict considerations + None. + ### Group Policy + This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local computer by using the Local Security Policy snap-in. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + It can be difficult to make users choose strong passwords, and even strong passwords are vulnerable to brute-force attacks if an attacker has sufficient time and computing resources. + ### Countermeasure + For users with access to computers that contain sensitive data, issue smart cards to users and configure the **Interactive logon: Require smart card** setting to Enabled. + ### Potential impact -All users of a device with this setting enabled must use smart cards to log on locally. This means that the organization must have a reliable public key infrastructure (PKI) as well as smart cards and smart card readers for these users. These requirements are significant challenges because expertise and resources are required to plan for and deploy these technologies. Active Directory Certificate Services (AD CS) can be used to implement and manage certificates. You can use automatic user and device enrollment and renewal on the client. + +All users of a device with this setting enabled must use smart cards to log on locally. This means that the organization must have a reliable public key infrastructure (PKI) as well as smart cards and smart card readers for these users. These requirements are significant challenges because +expertise and resources are required to plan for and deploy these technologies. Active Directory Certificate Services (AD CS) can be used to implement and manage certificates. You can use automatic user and device enrollment and renewal on the client. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/interactive-logon-smart-card-removal-behavior.md b/windows/keep-secure/interactive-logon-smart-card-removal-behavior.md index e7daf35333..29eba6fd2b 100644 --- a/windows/keep-secure/interactive-logon-smart-card-removal-behavior.md +++ b/windows/keep-secure/interactive-logon-smart-card-removal-behavior.md @@ -2,93 +2,102 @@ title: Interactive logon Smart card removal behavior (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Interactive logon Smart card removal behavior security policy setting. ms.assetid: 61487820-9d49-4979-b15d-c7e735999460 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Interactive logon: Smart card removal behavior + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **Interactive logon: Smart card removal behavior** security policy setting. + ## Reference + This policy setting determines what happens when the smart card for a logged-on user is removed from the smart card reader. + If smart cards are used for authentication, the device should automatically lock itself when the card is removed—that way, if users forget to manually lock their devices when they are away from them, malicious users cannot gain access. + If you select **Force Logoff** in the property sheet for this policy setting, the user is automatically logged off when the smart card is removed. Users will have to reinsert their smart cards and reenter their PINs when they return to their workstations. + ### Possible values + - No Action - Lock Workstation + If you select this, the workstation is locked when the smart card is removed, allowing users to leave the area, take their smart card with them, and still maintain a protected session. + - Force Logoff + If you select this, the user is automatically logged off when the smart card is removed. + - Disconnect if a remote Remote Desktop Services session + If you select this, removal of the smart card disconnects the session without logging the user off. This allows the user to insert the smart card and resume the session later, or at another smart card reader-equipped computer, without having to log on again. If the session is local, this policy functions identically to Lock Workstation. + - Not Defined + ### Best practices + - Set **Interactive logon: Smart card removal behavior** to **Lock Workstation**. If you select **Lock Workstation** in the property sheet for this policy setting, the workstation is locked when the smart card is removed. This allows users to leave the area, take their smart card with them, and still maintain a protected session. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      No Action

      DC Effective Default Settings

      No Action

      Member Server Effective Default Settings

      No Action

      Client Computer Effective Default Settings

      No Action

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | No Action| +| DC Effective Default Settings | No Action| +| Member Server Effective Default Settings | No Action| +| Client Computer Effective Default Settings | No Action|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Policy conflict considerations + None + ### Group Policy + This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local computer by using the Local Security Policy snap-in. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Users sometimes forget to lock their workstations when they are away from them, allowing the possibility for malicious users to access their devices. If smart cards are used for authentication, the device should automatically lock itself when the card is removed to ensure that only the user with the smart card is accessing resources by using those credentials. + ### Countermeasure + Configure the **Interactive logon: Smart card removal behavior** setting to **Lock Workstation**. + If you select **Lock Workstation** for this policy setting, the device locks when the smart card is removed. Users can leave the area, take their smart card with them, and still maintain a protected session. This behavior is similar to the setting that requires users to log on when resuming work on the device after the screen saver has started. + If you select **Force Logoff** for this policy setting, the user is automatically logged off when the smart card is removed. This setting is useful when a device is deployed as a public access point, such as a kiosk or other type of shared device + ### Potential impact + If you select **Force Logoff**, users must insert their smart cards and enter their PINs when they return to their workstations. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) From e0ff338ac3bc09347b73a07638f389c423dedced Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Tue, 24 May 2016 12:06:23 -0700 Subject: [PATCH 402/439] content cleanup Fix headings in Diagnostic Toolkit article; add ms.pagetype tag --- ...nced-uefi-security-features-for-surface.md | 5 +- ...tomize-the-oobe-for-surface-deployments.md | 5 +- ...irmware-and-drivers-for-surface-devices.md | 5 +- ...-fast-and-cisco-leap-on-surface-devices.md | 3 +- ...-adapters-and-surface-device-deployment.md | 5 +- devices/surface/index.md | 3 +- .../manage-surface-dock-firmware-updates.md | 4 +- .../manage-surface-pro-3-firmware-updates.md | 5 +- .../surface/microsoft-surface-data-eraser.md | 5 +- ...icrosoft-surface-deployment-accelerator.md | 5 +- ...-by-step-surface-deployment-accelerator.md | 5 +- devices/surface/surface-diagnostic-toolkit.md | 195 +++++++----------- devices/surface/surface-dock-updater.md | 4 +- 13 files changed, 114 insertions(+), 135 deletions(-) diff --git a/devices/surface/advanced-uefi-security-features-for-surface.md b/devices/surface/advanced-uefi-security-features-for-surface.md index 9eb6cc703e..ca850266d6 100644 --- a/devices/surface/advanced-uefi-security-features-for-surface.md +++ b/devices/surface/advanced-uefi-security-features-for-surface.md @@ -2,9 +2,10 @@ title: Advanced UEFI security features for Surface (Surface) description: This article describes how to install and configure the v3.11.760.0 UEFI update to enable additional security options for Surface Pro 3 devices. ms.assetid: 90F790C0-E5FC-4482-AD71-60589E3C9C93 -keywords: ["Surface, Surface Pro 3, security, features, configure, hardware, device, custom, script, update"] -ms.prod: W10 +keywords: security, features, configure, hardware, device, custom, script, update +ms.prod: w10 ms.mktglfcycl: manage +ms.pagetype: surface, devices, security ms.sitesec: library author: miladCA --- diff --git a/devices/surface/customize-the-oobe-for-surface-deployments.md b/devices/surface/customize-the-oobe-for-surface-deployments.md index 1985b76438..3c18712be2 100644 --- a/devices/surface/customize-the-oobe-for-surface-deployments.md +++ b/devices/surface/customize-the-oobe-for-surface-deployments.md @@ -2,9 +2,10 @@ title: Customize the OOBE for Surface deployments (Surface) description: This article will walk you through the process of customizing the Surface out-of-box experience for end users in your organization. ms.assetid: F6910315-9FA9-4297-8FA8-2C284A4B1D87 -keywords: ["deploy, customize, automate, deployment, network, Pen, pair, boot"] -ms.prod: W10 +keywords: deploy, customize, automate, network, Pen, pair, boot +ms.prod: w10 ms.mktglfcycl: deploy +ms.pagetype: surface, devices ms.sitesec: library author: jobotto --- diff --git a/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md b/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md index 61d56fa1b9..b2a06e1583 100644 --- a/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md +++ b/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md @@ -2,9 +2,10 @@ title: Download the latest firmware and drivers for Surface devices (Surface) description: This article provides a list of the available downloads for Surface devices and links to download the drivers and firmware for your device. ms.assetid: 7662BF68-8BF7-43F7-81F5-3580A770294A -keywords: ["update Surface, newest, latest, download, firmware, driver, tablet, hardware, device"] -ms.prod: W10 +keywords: update Surface, newest, latest, download, firmware, driver, tablet, hardware, device +ms.prod: w10 ms.mktglfcycl: deploy +ms.pagetype: surface, devices ms.sitesec: library author: jobotto --- diff --git a/devices/surface/enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md b/devices/surface/enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md index df0f2600d3..e562f5599b 100644 --- a/devices/surface/enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md +++ b/devices/surface/enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md @@ -2,9 +2,10 @@ title: Enable PEAP, EAP-FAST, and Cisco LEAP on Surface devices (Surface) description: Find out how to enable support for PEAP, EAP-FAST, or Cisco LEAP protocols on your Surface device. ms.assetid: A281EFA3-1552-467D-8A21-EB151E58856D -keywords: ["network", "wireless", "device", "deploy", "authenticaion", "protocol"] +keywords: network, wireless, device, deploy, authentication, protocol ms.prod: w10 ms.mktglfcycl: deploy +ms.pagetype: surface, devices ms.sitesec: library author: miladCA --- diff --git a/devices/surface/ethernet-adapters-and-surface-device-deployment.md b/devices/surface/ethernet-adapters-and-surface-device-deployment.md index fb580c032f..0addf8e26a 100644 --- a/devices/surface/ethernet-adapters-and-surface-device-deployment.md +++ b/devices/surface/ethernet-adapters-and-surface-device-deployment.md @@ -2,9 +2,10 @@ title: Ethernet adapters and Surface deployment (Surface) description: This article provides guidance and answers to help you perform a network deployment to Surface devices. ms.assetid: 5273C59E-6039-4E50-96B3-426BB38A64C0 -keywords: ["ethernet, deploy, removable, network, connectivity, boot, firmware, device, adapter, PXE boot, USB"] -ms.prod: W10 +keywords: ethernet, deploy, removable, network, connectivity, boot, firmware, device, adapter, PXE boot, USB +ms.prod: w10 ms.mktglfcycl: deploy +ms.pagetype: surface, devices ms.sitesec: library author: jobotto --- diff --git a/devices/surface/index.md b/devices/surface/index.md index 2a2598a5cd..d0bb077b72 100644 --- a/devices/surface/index.md +++ b/devices/surface/index.md @@ -2,8 +2,9 @@ title: Surface (Surface) description: . ms.assetid: 2a6aec85-b8e2-4784-8dc1-194ed5126a04 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: manage +ms.pagetype: surface, devices ms.sitesec: library author: heatherpoulsen --- diff --git a/devices/surface/manage-surface-dock-firmware-updates.md b/devices/surface/manage-surface-dock-firmware-updates.md index 758f8027ea..9428200756 100644 --- a/devices/surface/manage-surface-dock-firmware-updates.md +++ b/devices/surface/manage-surface-dock-firmware-updates.md @@ -2,8 +2,10 @@ title: Manage Surface Dock firmware updates (Surface) description: Read about the different methods you can use to manage the process of Surface Dock firmware updates. ms.assetid: 86DFC0C0-C842-4CD1-A2D7-4425471FFE3F -ms.prod: W10 +keywords: firmware, update, install, drivers +ms.prod: w10 ms.mktglfcycl: manage +ms.pagetype: surface, devices ms.sitesec: library author: jobotto --- diff --git a/devices/surface/manage-surface-pro-3-firmware-updates.md b/devices/surface/manage-surface-pro-3-firmware-updates.md index fac455f9ac..8e757fdaca 100644 --- a/devices/surface/manage-surface-pro-3-firmware-updates.md +++ b/devices/surface/manage-surface-pro-3-firmware-updates.md @@ -2,9 +2,10 @@ title: Manage Surface driver and firmware updates (Surface) description: This article describes the available options to manage firmware and driver updates for Surface devices. ms.assetid: CD1219BA-8EDE-4BC8-BEEF-99B50C211D73 -keywords: ["Surface, Surface Pro 3, firmware, update, device, manage, deploy, driver, USB"] -ms.prod: W10 +keywords: Surface, Surface Pro 3, firmware, update, device, manage, deploy, driver, USB +ms.prod: w10 ms.mktglfcycl: manage +ms.pagetype: surface, devices ms.sitesec: library author: jobotto --- diff --git a/devices/surface/microsoft-surface-data-eraser.md b/devices/surface/microsoft-surface-data-eraser.md index e35e41bbf8..6f76da2a15 100644 --- a/devices/surface/microsoft-surface-data-eraser.md +++ b/devices/surface/microsoft-surface-data-eraser.md @@ -2,9 +2,10 @@ title: Microsoft Surface Data Eraser (Surface) description: Find out how the Microsoft Surface Data Eraser tool can help you securely wipe data from your Surface devices. ms.assetid: 8DD3F9FE-5458-4467-BE26-E9200341CF10 -keywords: ["tool", "USB", "data", "erase"] -ms.prod: W10 +keywords: tool, USB, data, erase +ms.prod: w10 ms.mktglfcycl: manage +ms.pagetype: surface, devices, security ms.sitesec: library author: miladCA --- diff --git a/devices/surface/microsoft-surface-deployment-accelerator.md b/devices/surface/microsoft-surface-deployment-accelerator.md index e38d23d94b..8b9b17335c 100644 --- a/devices/surface/microsoft-surface-deployment-accelerator.md +++ b/devices/surface/microsoft-surface-deployment-accelerator.md @@ -2,9 +2,10 @@ title: Microsoft Surface Deployment Accelerator (Surface) description: Microsoft Surface Deployment Accelerator provides a quick and simple deployment mechanism for organizations to reimage Surface devices. ms.assetid: E7991E90-4AAE-44B6-8822-58BFDE3EADE4 -keywords: ["deploy", "install", "tool"] -ms.prod: W10 +keywords: deploy, install, tool +ms.prod: w10 ms.mktglfcycl: deploy +ms.pagetype: surface, devices ms.sitesec: library author: miladCA --- diff --git a/devices/surface/step-by-step-surface-deployment-accelerator.md b/devices/surface/step-by-step-surface-deployment-accelerator.md index b04c37e9b5..07c32b693b 100644 --- a/devices/surface/step-by-step-surface-deployment-accelerator.md +++ b/devices/surface/step-by-step-surface-deployment-accelerator.md @@ -2,9 +2,10 @@ title: Step by step Surface Deployment Accelerator (Surface) description: This article shows you how to install Microsoft Surface Deployment Accelerator (SDA), configure a deployment share for the deployment of Windows to Surface devices, and perform a deployment to Surface devices. ms.assetid: A944FB9C-4D81-4868-AFF6-B9D1F5CF1032 -keywords: ["deploy, configure"] -ms.prod: W10 +keywords: deploy, configure +ms.prod: w10 ms.mktglfcycl: deploy +ms.pagetype: surface, devices ms.sitesec: library author: miladCA --- diff --git a/devices/surface/surface-diagnostic-toolkit.md b/devices/surface/surface-diagnostic-toolkit.md index 61e867468f..a20e52b118 100644 --- a/devices/surface/surface-diagnostic-toolkit.md +++ b/devices/surface/surface-diagnostic-toolkit.md @@ -2,9 +2,10 @@ title: Microsoft Surface Diagnostic Toolkit (Surface) description: Find out how you can use the Microsoft Surface Diagnostic Toolkit to test the hardware of your Surface device. ms.assetid: FC4C3E76-3613-4A84-A384-85FE8809BEF1 -keywords: ["hardware, device, tool, test, component"] -ms.prod: W8 +keywords: hardware, device, tool, test, component +ms.prod: w10 ms.mktglfcycl: manage +ms.pagetype: surface, devices ms.sitesec: library author: miladCA --- @@ -18,19 +19,19 @@ The [Microsoft Surface Diagnostic Toolkit](http://go.microsoft.com/fwlink/p/?Lin >**Note:**  A Surface device must boot into Windows to run the Microsoft Surface Diagnostic Toolkit. The Microsoft Surface Diagnostic Toolkit will run only on the following Surface devices: -- Surface Book +- Surface Book -- Surface Pro 4 +- Surface Pro 4 -- Surface 3 LTE +- Surface 3 LTE -- Surface 3 +- Surface 3 -- Surface Pro 3 +- Surface Pro 3 -- Surface Pro 2 +- Surface Pro 2 -- Surface Pro +- Surface Pro >**Note:**  Security software and built-in security measures in many email applications and services will block executable files that are transferred through email. To email the Surface Diagnostic Toolkit, attach the .zip archive file as downloaded from the Surface Tools for IT page without extracting it first. You can also create a custom .zip archive that contains the .exe file. (For example, if you want to localize the text as described in the [Localization](#localization) section of this article.) @@ -38,299 +39,263 @@ Running the Microsoft Surface Diagnostic Toolkit is a hands-on activity. The tes To run a full set of tests with the Microsoft Surface Diagnostic Toolkit, you should be prepared with the following items: -- An external display with the appropriate HDMI or DisplayPort connection +- An external display with the appropriate HDMI or DisplayPort connection -- A Bluetooth device that can be put into pairing mode +- A Bluetooth device that can be put into pairing mode -- A MicroSD or SD card that is compatible with your Surface device +- A MicroSD or SD card that is compatible with your Surface device -- A Surface Pen +- A Surface Pen -- Room to move the Surface device around +- Room to move the Surface device around -- External speakers or headphones +- External speakers or headphones >**Note:**  The Microsoft Surface Diagnostic Toolkit tests verify only the hardware of a Surface device and do not test or resolve issues with the operating system or software.   -## The tests +## The tests The Microsoft Surface Diagnostic Toolkit runs several individual tests on a Surface device. Not all tests are applicable to every device. For example, the Home button test is not applicable to Surface Pro 4 where there is no Home button. You can specify which tests to run, or you can choose to run all tests. For tests that require external devices (such as testing output to an external display) but you do not have the required external device at the time of the test, you are given the option to skip the test. If a test fails, you are prompted to continue or stop testing at that time. -### Windows Update +#### Windows Update This test checks for any outstanding Windows updates and will prompt you to install those updates before you proceed to other tests. It is important to keep a Surface device up to date with the latest Windows updates, including drivers and firmware for the Surface device. The success of some of the tests that are performed later in the task sequence depend on these updated drivers and firmware. You will be prompted to restart the device if required by Windows Update. If you must restart the device, you will need to start the Microsoft Surface Diagnostic Toolkit again. -### Device information +#### Device information This test reads the Device ID and serial number in addition to basic system information such as device model, operating system version, processor, memory, and storage. The Device ID is recorded in the name of the log file and can be used to identify a log file for a specific device. Several system log files are also collected, including update and rollback logs, and output from several Windows built-in tools, such as [DirectX Diagnostics](http://go.microsoft.com/fwlink/p/?LinkId=746476) and [System Information](http://go.microsoft.com/fwlink/p/?LinkId=746477), power configuration, disk health, and event logs. See the following list for a full set of collected log files: -- Output of **Get-WindowsUpdateLog** if the operating system is Windows 10 +- Output of **Get-WindowsUpdateLog** if the operating system is Windows 10 -- **%windir%\\Logs** +- **%windir%\\Logs** -- **%windir%\\Panther** +- **%windir%\\Panther** -- **%windir%\\System32\\sysprep\\Panther** +- **%windir%\\System32\\sysprep\\Panther** -- **%windir%\\System32\\WinEvt\\Logs** +- **%windir%\\System32\\WinEvt\\Logs** -- **$windows.~bt\\Sources\\Panther** +- **$windows.~bt\\Sources\\Panther** -- **$windows.~bt\\Sources\\Rollback** +- **$windows.~bt\\Sources\\Rollback** -- **%windir%\\System32\\WinEvt\\Logs** +- **%windir%\\System32\\WinEvt\\Logs** -- Output of **dxdiag.exe /t** +- Output of **dxdiag.exe /t** -- Output of **msinfo32.exe /report** +- Output of **msinfo32.exe /report** -- Output of **powercfg.exe /batteryreport** +- Output of **powercfg.exe /batteryreport** -- Output of **powercfg.exe /sleepstudy** +- Output of **powercfg.exe /sleepstudy** -- Output of **wevtutil.exe epl System** +- Output of **wevtutil.exe epl System** -- Events from: +- Events from: - - **Chkdsk** + - **Chkdsk** - - **Microsoft-Windows-Ntfs** + - **Microsoft-Windows-Ntfs** - - **Microsoft-Windows-WER-SystemErrorReporting** + - **Microsoft-Windows-WER-SystemErrorReporting** - - **Microsoft-Windows-Startuprepair** + - **Microsoft-Windows-Startuprepair** - - **Microsoft-Windows-kernel-Power** + - **Microsoft-Windows-kernel-Power** -- Output of **powercfg.exe /q** +- Output of **powercfg.exe /q** -- Output of **powercfg.exe /qh** +- Output of **powercfg.exe /qh** -- **%windir%\\Inf\\SetupApi\*.log** +- **%windir%\\Inf\\SetupApi\*.log** These files and logs are stored in a .zip file saved by the Microsoft Surface Diagnostic Toolkit when all selected tests have completed alongside the Microsoft Surface Diagnostic Toolkit log file. -### Type Cover test +#### Type Cover test >**Note:**  A Surface Type Cover is required for this test. -  If a Surface Type Cover is not detected, the test prompts you to connect the Type Cover. When a Type Cover is detected the test prompts you to use the keyboard and touchpad. The cursor should move while you swipe the touchpad, and the keyboard Windows key should bring up the Start menu or Start screen to successfully pass this test. You can skip this test if a Type Cover is not used with the Surface device. -### Integrated keyboard test +#### Integrated keyboard test >**Note:**  This test is only applicable to Surface Book and requires that the Surface Book be docked to the keyboard. -  - This test is essentially the same as the Type Cover test, except the integrated keyboard in the Surface Book base is tested rather than the Type Cover. Move the cursor and use the Windows key to bring up the Start menu to confirm that the touchpad and keyboard are operating successfully. This test will display the status of cursor movement and keyboard input for you to verify. Press **ESC** to complete the test. -### Canvas mode battery test +#### Canvas mode battery test >**Note:**  This test is only applicable to Surface Book. -  - Depending on which mode Surface Book is in, different batteries are used to power the device. When Surface Book is in clipboard mode (detached form the keyboard) it uses an internal battery, and when it is connected in either laptop mode or canvas mode it uses different connections to the battery in the keyboard. In canvas mode, the screen is connected to the keyboard so that when the device is closed, the screen remains face-up and visible. Connect the Surface Book to the keyboard in this manner for the test to automatically proceed. -### Clipboard mode battery test +#### Clipboard mode battery test >**Note:**  This test is only applicable to Surface Book. -  - Disconnect the Surface Book from the keyboard to work in clipboard mode. In clipboard mode the Surface Book operates from an internal battery that is tested when the Surface Book is disconnected from the keyboard. Disconnecting the Surface Book from the keyboard will also disconnect the Surface Book from power and will automatically begin this test. -### Laptop mode battery test +#### Laptop mode battery test >**Note:**  This test is only applicable to Surface Book. -  - Connect the Surface Book to the keyboard in the opposite fashion to canvas mode in laptop mode. In laptop mode the screen will face you when the device is open and the device can be used in the same way as any other laptop. Disconnect AC Power from the laptop base when prompted for this test to check the battery status. -### Battery test +#### Battery test In this test the battery is discharged for a few seconds and tested for health and estimated runtime. You are prompted to disconnect the power adapter and then to reconnect the power adapter when the test is complete. -### Discrete graphics (dGPU) test +#### Discrete graphics (dGPU) test >**Note:**  This test is only applicable to Surface Book models with a discrete graphics processor. -  - This test will query the device information of current hardware to check for the presence of both the Intel integrated graphics processor in the Surface Book and the NVIDIA discrete graphics processor in the Surface Book keyboard. The keyboard must be attached for this test to function. -### Discrete graphics (dGPU) fan test +#### Discrete graphics (dGPU) fan test >**Note:**  This test is only applicable to Surface Book models with a discrete graphics processor. -  - The discrete graphics processor in the Surface Book includes a separate cooling fan. The fan is turned on automatically by the test for 5 seconds. Listen for the sound of the fan in the keyboard and report if the fan is working correctly when prompted. -### Muscle wire test +#### Muscle wire test >**Note:**  This test is only applicable to Surface Book. -  - To disconnect the Surface Book from the keyboard, software must instruct the muscle wire latch mechanism to open. This is typically accomplished by pressing and holding the undock key on the keyboard. This test sends the same signal to the latch, which unlocks the Surface Book from the Surface Book keyboard. Remove the Surface Book from the keyboard when you are prompted to do so. -### Dead pixel and display artifacts tests +#### Dead pixel and display artifacts tests >**Note:**  Before you run this test, be sure to clean the screen of dust or smudges. -  - This test prompts you to view the display in search of malfunctioning pixels. The test displays full-screen, single-color images including black, white, red, green, and blue. Pixels that remain bright or dark when the screen displays an image of a different color indicate a failed test. You should also look for distortion or variance in the color of the screen. -### Digitizer edges +#### Digitizer edges The touchscreen of a Surface device should detect when a user swipes in from the left or right side of the screen. This test prompts you to swipe in from the edges of the screen to bring up the Action Center and Task View. Both Action Center and Task View should launch to pass this test. -### Digitizer pinch +#### Digitizer pinch The pinch gesture (when you bring two fingers closer together or farther apart) is used to manipulate zoom and to position content through the touchscreen. This test displays an image in Windows Picture Viewer and prompts you to zoom in, move, and zoom out of the picture. The picture should zoom in, move, and zoom out as the gestures are performed. -### Digitizer touch +#### Digitizer touch The Surface touchscreen should detect input across the entire screen of the device equally. To perform this test a series of lines are displayed on the screen for you to trace with a finger in search of unresponsive areas. The lines traced across the screen should appear continuous for the length of the line as drawn with your finger. -### Digitizer pen test +#### Digitizer pen test >**Note:**  A Microsoft Surface Pen is required for this test. -  - This test displays the same lines as those that are displayed during the Digitizer Touch test, but your input is performed with a Surface Pen instead of your finger. The lines should remain unbroken for as long as the Pen is pressed to the screen. Trace all of the lines in the image to look for unresponsive areas across the entire screen of the Surface device. -### Digitizer multi touch +#### Digitizer multi touch The Surface touchscreen is capable of detecting 10 fingers simultaneously. Place all of your fingers on the screen simultaneously to perform this test. The screen will show the number of points detected, which should match the number of fingers you have on the screen. -### Home button test +#### Home button test The Home button or Windows button on your Surface device is used to bring up the Start screen or Start menu. This test is successful if the Start screen or Start menu is displayed when the Windows button is pressed. This test is not displayed on Surface Pro 4 because no Windows button exists. -### Volume rocker test +#### Volume rocker test This test prompts you to use the volume rocker to turn the volume all the way up, all the way down, and then all the way up again. To pass this test, the volume slider should move up and down as the rocker is pressed. -### Micro SD or SD slot test +#### Micro SD or SD slot test >**Note:**  This test requires a micro SD or SD card that is compatible with the slot in your Surface device. -  - Insert a micro SD or SD card when you are prompted. When the SD card is detected, the test prompts you to remove the SD card to ensure that the card is not left in the device. During this test a small file is written to the SD card and then verified. Detection and verification of the SD card automatically passes this test without additional input. -### Microphone test +#### Microphone test This test displays the **Recording** tab of the Sound item in Control Panel. The test prompts you to monitor the meter that is displayed next to the **Microphone Array** recording device. A recommended test is to speak and watch for your speech to be detected in the meter. If the meter moves when you speak, the microphone is working correctly. For Surface Book you will be prompted to tap locations near the microphones. This tapping should produce noticeable spikes in the audio meter. -### Video out test +#### Video out test >**Note:**  This test requires an external display with the applicable connection for your Surface device. -  - Surface devices provide a Mini DisplayPort connection for connecting to an external display. Connect your display through the Mini DisplayPort on the device when prompted. The display should be detected automatically and an image should appear on the external display. -### Bluetooth test +#### Bluetooth test >**Note:**  This test requires a Bluetooth device. The device must be set to pairing mode or made discoverable to perform this test. -  - After you receive a prompt to put the device in pairing mode, the test opens the **Add a device** window and begins to search for discoverable Bluetooth devices. Watch the **Add a device** window to verify that your Bluetooth device is detected. Select your Bluetooth device from the list and connect to the device to complete the test. -### Camera test +#### Camera test Use this test to verify that the cameras on your Surface device are operating properly. Images will be displayed from both the front and rear cameras, and the infrared camera on a Surface Pro 4. Continuous autofocus can be enabled on the rear camera. Move the device closer and farther away from an object to verify the operation of continuous autofocus. -### Speaker test +#### Speaker test >**Note:**  Headphones or external speakers are required to test the headphone jack in this test. -  - This test plays audio over left and right channels respectively, both for the internal speakers and for speakers or headphones connected to the headphone jack. Mark each channel as a pass or fail as you hear the audio play. -### Network test +#### Network test >**Note:**  Connect the Surface device to a Wi-Fi network before you run this test. Connections that are made during the test are removed when the test is completed. -  - This test uses the Windows Network Diagnostics built in troubleshooter to diagnose potential issues with network connectivity, including proxy configuration, DNS problems, and IP address conflicts. An event log is saved by this test in Windows logs and is visible in the Windows Event Viewer. The Event ID is 6100. -### Power test +#### Power test Settings such as display brightness, the elapsed time until the screen sleeps, and the elapsed time until device sleeps, are checked against default values with the Power built-in troubleshooter. The troubleshooter will automatically correct settings that may prevent the device from conserving power or entering sleep mode. -### Mobile broadband test +#### Mobile broadband test This test prompts you to enable mobile broadband and attempts to browse to http://www.bing.com. This test is only applicable to Surface devices that come equipped with mobile broadband, such as Surface 3 LTE. -### Accelerometer test +#### Accelerometer test The accelerometer detects lateral, longitudinal, and vertical movements of the Surface device. This test prompts you to pick up and move the Surface device forward and backward, to the left and to the right, and up and down, to test the sensor for directional movement. The test automatically passes when movement is detected. -### Gyrometer test +#### Gyrometer test The gyrometer detects pitch, roll, and yaw movements. This test prompts you to pick up and rotate the Surface device to test the sensors for angular movement. The test automatically passes when movement is detected. -### Compass test +#### Compass test The compass detects which direction the Surface device is facing relative to north, south, east, and west. Turn the Surface device to face in different directions to test the sensor. The test automatically passes when a change in direction is detected. -### Ambient light test +#### Ambient light test The ambient light sensor is used to automatically adjust screen brightness relative to the ambient lighting in the environment. Turn the device toward or away from a light source to cause the screen to dim or brighten in response increased or decreased light. The test automatically passes when the screen brightness automatically changes. -### Device orientation test +#### Device orientation test >**Note:**  Before you run this test, disable rotation lock from the Action Center if enabled. -  - The device orientation sensor determines what the angle of the Surface device is, relative to the ground. Rotate the display 90 degrees or 180 degrees to cause the screen orientation to switch between portrait and landscape mode. The test automatically passes when the screen orientation switches. -### Brightness test +#### Brightness test This test cycles the screen through brightness levels from 0 percent to 100 percent, and then a message is displayed to confirm if the brightness level changed accordingly. You are then prompted to disconnect the power adapter. The screen should automatically dim when power is disconnected. -### System assessment +#### System assessment >**Note:**  The Surface device must be connected to AC power before you can run this test. -  - The Windows System Assessment Tool (WinSAT) runs a series of benchmarks against the processor, memory, video adapter, and storage devices. The results include the processing speed of various algorithms, read and write performance of memory and storage, and performance in several Direct3D graphical tests. -### Performance Monitor test +#### Performance Monitor test Performance and diagnostic trace logs are recorded from Performance Monitor for 30 seconds and collected in the .zip file output of the Microsoft Surface Diagnostic Toolkit by this test. You can analyze these trace logs with the [Windows Performance Analyzer](http://go.microsoft.com/fwlink/p/?LinkId=746486) to identify causes of application crashes, performance issues, or other undesirable behavior in Windows. -### Crash dump collection +#### Crash dump collection If your Surface device has encountered an error that caused the device to fail or produce a blue screen error, this stage of the Microsoft Surface Diagnostic Toolkit records the information from the automatically recorded crash dump files in the diagnostic log. You can use these crash dump files to identify a faulty driver, hardware component, or application through analysis. Use the [Windows Debugging Tool](http://go.microsoft.com/fwlink/p/?LinkId=746488) to analyze these files. If you are not familiar with the analysis of crash dump files, you can describe your issue and post a link to your crash dump files (uploaded to OneDrive or another file sharing service) in the [Windows TechNet Forums](http://go.microsoft.com/fwlink/p/?LinkId=746489). -## Command line - +## Command line You can run the Microsoft Surface Diagnostic Toolkit from the command line or as part of a script. The tool supports the following arguments: >**Note:**  Many of the tests performed by the Microsoft Surface Diagnostic Toolkit require technician interaction. The Microsoft Surface Diagnostic Toolkit cannot run unattended. -  - -### exclude +#### exclude Use this argument to exclude specific tests. @@ -424,7 +389,7 @@ See the following list for test names: - WindowsUpdateCheckTest -### forceplatformsupport +#### forceplatformsupport Use this argument to force tests to run when the make and model of the device is not properly detected by Windows. Surface Diagnostic Toolkit is intended to run only on Surface devices. @@ -434,7 +399,7 @@ Example: Surface_Diagnostic_Toolkit_1.0.60.0.exe forceplatformsupport ``` -### include +#### include Use this argument to include tests when you run Microsoft Surface Diagnostic Toolkit from the command line. Tests specified by the **Include** command will be run even if the test is not supported on the model of Surface device. In the following example, the Surface Book specific tests for the latch mechanism and discrete graphics will be run, even if the command is run on a Surface Pro 4 or other Surface model. diff --git a/devices/surface/surface-dock-updater.md b/devices/surface/surface-dock-updater.md index 38115ae721..ea56c4cc95 100644 --- a/devices/surface/surface-dock-updater.md +++ b/devices/surface/surface-dock-updater.md @@ -2,8 +2,10 @@ title: Microsoft Surface Dock Updater (Surface) description: This article provides a detailed walkthrough of Microsoft Surface Dock Updater. ms.assetid: 1FEFF277-F7D1-4CB4-8898-FDFE8CBE1D5C -ms.prod: W10 +keywords: install, update, firmware +ms.prod: w10 ms.mktglfcycl: manage +ms.pagetype: surface, devices ms.sitesec: library author: jobotto --- From d137ce0a03ed89198a8d7028e53809772c0a5811 Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Tue, 24 May 2016 12:19:08 -0700 Subject: [PATCH 403/439] fixed heading --- devices/surface/surface-diagnostic-toolkit.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface/surface-diagnostic-toolkit.md b/devices/surface/surface-diagnostic-toolkit.md index a20e52b118..4fa7514559 100644 --- a/devices/surface/surface-diagnostic-toolkit.md +++ b/devices/surface/surface-diagnostic-toolkit.md @@ -409,7 +409,7 @@ Example: Surface_Diagnostic_Toolkit_1.0.60.0.exe “include=DualGraphicsTest,FanTest,MuscleWireTest” ``` -### logpath +#### logpath Use this argument to specify the path for the log file. From 3411ddec3cd926039e6fd262e92197f13aea7eb5 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 24 May 2016 12:48:00 -0700 Subject: [PATCH 404/439] change author --- .../manage/application-development-for-windows-as-a-service.md | 2 +- windows/manage/introduction-to-windows-10-servicing.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/manage/application-development-for-windows-as-a-service.md b/windows/manage/application-development-for-windows-as-a-service.md index 69df22ff69..cffbdd7092 100644 --- a/windows/manage/application-development-for-windows-as-a-service.md +++ b/windows/manage/application-development-for-windows-as-a-service.md @@ -6,7 +6,7 @@ ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security -author: jdeckerMS +author: greg-lindsay --- # Application development for Windows as a service diff --git a/windows/manage/introduction-to-windows-10-servicing.md b/windows/manage/introduction-to-windows-10-servicing.md index 23290ae499..0c6c2ab9a6 100644 --- a/windows/manage/introduction-to-windows-10-servicing.md +++ b/windows/manage/introduction-to-windows-10-servicing.md @@ -7,7 +7,7 @@ ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security -author: jdeckerMS +author: greg-lindsay --- # Windows 10 servicing options for updates and upgrades From 4f7cf536c2468e33fd61dc39728d43d0160d03be Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Tue, 24 May 2016 14:20:34 -0700 Subject: [PATCH 405/439] fixing spacing issues --- windows/keep-secure/kerberos-policy.md | 59 ++++-------- .../load-and-unload-device-drivers.md | 91 +++++++++--------- windows/keep-secure/lock-pages-in-memory.md | 89 ++++++++--------- windows/keep-secure/log-on-as-a-batch-job.md | 94 +++++++++--------- windows/keep-secure/log-on-as-a-service.md | 91 +++++++++--------- .../maintain-applocker-policies.md | 48 ++++++++-- .../manage-auditing-and-security-log.md | 92 +++++++++--------- .../manage-packaged-apps-with-applocker.md | 44 +++++++-- windows/keep-secure/manage-tpm-commands.md | 37 +++++-- .../maximum-lifetime-for-service-ticket.md | 86 +++++++++-------- ...aximum-lifetime-for-user-ticket-renewal.md | 85 ++++++++-------- .../maximum-lifetime-for-user-ticket.md | 85 ++++++++-------- windows/keep-secure/maximum-password-age.md | 82 ++++++++-------- ...ance-for-computer-clock-synchronization.md | 88 ++++++++--------- ...r-policies-by-using-set-applockerpolicy.md | 17 +++- .../merge-applocker-policies-manually.md | 86 +++++------------ ...nt-digitally-sign-communications-always.md | 96 ++++++++++--------- 17 files changed, 653 insertions(+), 617 deletions(-) diff --git a/windows/keep-secure/kerberos-policy.md b/windows/keep-secure/kerberos-policy.md index 7fc388203f..fa68f49ac1 100644 --- a/windows/keep-secure/kerberos-policy.md +++ b/windows/keep-secure/kerberos-policy.md @@ -2,56 +2,37 @@ title: Kerberos Policy (Windows 10) description: Describes the Kerberos Policy settings and provides links to policy setting descriptions. ms.assetid: 94017dd9-b1a3-4624-af9f-b29161b4bf38 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Kerberos Policy + **Applies to** - Windows 10 + Describes the Kerberos Policy settings and provides links to policy setting descriptions. + The Kerberos version 5 authentication protocol provides the default mechanism for authentication services and the authorization data necessary for a user to access a resource and perform a task on that resource. By reducing the lifetime of Kerberos tickets, you reduce the risk of a legitimate user's credentials being stolen and successfully used by an attacker. However, this also increases the authorization overhead. In most environments, these settings should not need to be changed. + These policy settings are located in **\\Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Kerberos Policy**. -The following topics provide a discussion of implementation and best practices considerations, policy location, default values for the server type or GPO, relevant differences in operating system versions, security considerations (including the possible settings vulnerabilities of each setting), countermeasures you can take, and the potential impact for each setting. + +The following topics provide a discussion of implementation and best practices considerations, policy location, default values for the server type or GPO, relevant differences in operating system versions, security considerations (including the possible settings vulnerabilities of each setting), +countermeasures you can take, and the potential impact for each setting. + ## In this section - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      TopicDescription

      [Enforce user logon restrictions](enforce-user-logon-restrictions.md)

      Describes the best practices, location, values, policy management, and security considerations for the Enforce user logon restrictions security policy setting.

      [Maximum lifetime for service ticket](maximum-lifetime-for-service-ticket.md)

      Describes the best practices, location, values, policy management, and security considerations for the Maximum lifetime for service ticket security policy setting.

      [Maximum lifetime for user ticket](maximum-lifetime-for-user-ticket.md)

      Describes the best practices, location, values, policy management, and security considerations for the Maximum lifetime for user ticket policy setting.

      [Maximum lifetime for user ticket renewal](maximum-lifetime-for-user-ticket-renewal.md)

      Describes the best practices, location, values, policy management, and security considerations for the Maximum lifetime for user ticket renewal security policy setting.

      [Maximum tolerance for computer clock synchronization](maximum-tolerance-for-computer-clock-synchronization.md)

      Describes the best practices, location, values, policy management, and security considerations for the Maximum tolerance for computer clock synchronization security policy setting.

      + +| Topic | Description | +| - | - | +| [Enforce user logon restrictions](enforce-user-logon-restrictions.md) | Describes the best practices, location, values, policy management, and security considerations for the **Enforce user logon restrictions** security policy setting.| +| [Maximum lifetime for service ticket](maximum-lifetime-for-service-ticket.md) | Describes the best practices, location, values, policy management, and security considerations for the **Maximum lifetime for service ticket** security policy setting.| +| [Maximum lifetime for user ticket](maximum-lifetime-for-user-ticket.md) | Describes the best practices, location, values, policy management, and security considerations for the **Maximum lifetime for user ticket** policy setting.| +| [Maximum lifetime for user ticket renewal](maximum-lifetime-for-user-ticket-renewal.md) | Describes the best practices, location, values, policy management, and security considerations for the **Maximum lifetime for user ticket renewal** security policy setting.| +| [Maximum tolerance for computer clock synchronization](maximum-tolerance-for-computer-clock-synchronization.md) | Describes the best practices, location, values, policy management, and security considerations for the **Maximum tolerance for computer clock synchronization** security| policy setting.   ## Related topics -[Configure security policy settings](how-to-configure-security-policy-settings.md) -  -  + +- [Configure security policy settings](how-to-configure-security-policy-settings.md) diff --git a/windows/keep-secure/load-and-unload-device-drivers.md b/windows/keep-secure/load-and-unload-device-drivers.md index fb07375002..0ef993463c 100644 --- a/windows/keep-secure/load-and-unload-device-drivers.md +++ b/windows/keep-secure/load-and-unload-device-drivers.md @@ -2,96 +2,95 @@ title: Load and unload device drivers (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Load and unload device drivers security policy setting. ms.assetid: 66262532-c610-470c-9792-35ff4389430f -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Load and unload device drivers + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Load and unload device drivers** security policy setting. + ## Reference + This policy setting determines which users can dynamically load and unload device drivers. This user right is not required if a signed driver for the new hardware already exists in the driver.cab file on the device. Device drivers run as highly privileged code. Windows supports the Plug and Play specifications that define how a computer can detect and configure newly added hardware, and then automatically install the device driver. Prior to Plug and Play, users needed to manually configure devices before attaching them to the device. This model allows a user to plug in the hardware, then Windows searches for an appropriate device driver package and automatically configures it to work without interfering with other devices. + Because device driver software runs as if it is a part of the operating system with unrestricted access to the entire computer, it is critical that only known and authorized device drivers be permitted. + Constant: SeLoadDriverPrivilege + ### Possible values + - User-defined list of accounts - Default values - Not Defined + ### Best practices + - Because of the potential security risk, do not assign this user right to any user, group, or process that you do not want to take over the system. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default this setting is Administrators and Print Operators on domain controllers and Administrators on stand-alone servers. + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Administrators

      -

      Print Operators

      Stand-Alone Server Default Settings

      Administrators

      Domain Controller Effective Default Settings

      Administrators

      -

      Print Operators

      Member Server Effective Default Settings

      Administrators

      Client Computer Effective Default Settings

      Administrators

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Administrators
      Print Operators| +| Stand-Alone Server Default Settings | Administrators| +| Domain Controller Effective Default Settings | Administrators
      Print Operators | +| Member Server Effective Default Settings | Administrators| +| Client Computer Effective Default Settings | Administrators|   ## Policy management + This section describes features, tools, and guidance to help you manage this policy. + A restart of the device is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Device drivers run as highly privileged code. A user who has the **Load and unload device drivers** user right could unintentionally install malware that masquerades as a device driver. Administrators should exercise care and install only drivers with verified digital signatures. -**Note**   -You must have this user right or be a member of the local Administrators group to install a new driver for a local printer or to manage a local printer and configure defaults for options such as duplex printing. + +>**Note:**  You must have this user right or be a member of the local Administrators group to install a new driver for a local printer or to manage a local printer and configure defaults for options such as duplex printing.   ### Countermeasure + Do not assign the **Load and unload device drivers** user right to any user or group other than Administrators on member servers. On domain controllers, do not assign this user right to any user or group other than Domain Admins. + ### Potential impact + If you remove the **Load and unload device drivers** user right from the Print Operators group or other accounts, you could limit the abilities of users who are assigned to specific administrative roles in your environment. You should ensure that delegated tasks are not negatively affected. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/lock-pages-in-memory.md b/windows/keep-secure/lock-pages-in-memory.md index 3bf58d8f5e..c2d3f4a39d 100644 --- a/windows/keep-secure/lock-pages-in-memory.md +++ b/windows/keep-secure/lock-pages-in-memory.md @@ -2,92 +2,93 @@ title: Lock pages in memory (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Lock pages in memory security policy setting. ms.assetid: cc724979-aec0-496d-be4e-7009aef660a3 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Lock pages in memory + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Lock pages in memory** security policy setting. + ## Reference + This policy setting determines which accounts can use a process to keep data in physical memory, which prevents the computer from paging the data to virtual memory on a disk. + Normally, an application running on Windows can negotiate for more physical memory, and in response to the request, the application begins to move the data from RAM (such as the data cache) to a disk. When the pageable memory is moved to a disk, more RAM is free for the operating system to use. + Enabling this policy setting for a specific account (a user account or a process account for an application) prevents paging of the data. Thereby, the amount of memory that Windows can reclaim under pressure is limited. This could lead to performance degradation. -**Note**   -By configuring this policy setting, the performance of the Windows operating system will differ depending on if applications are running on 32-bit or 64-bit systems, and if they are virtualized images. Performance will also differ between earlier and later versions of the Windows operating system. + +>**Note:**  By configuring this policy setting, the performance of the Windows operating system will differ depending on if applications are running on 32-bit or 64-bit systems, and if they are virtualized images. Performance will also differ between earlier and later versions of the Windows operating system.   Constant: SeLockMemoryPrivilege + ### Possible values + - User-defined list of accounts - Not defined + ### Best practices + Best practices are dependent on the platform architecture and the applications running on those platforms. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Not defined

      Domain Controller Effective Default Settings

      Not defined

      Member Server Effective Default Settings

      Not defined

      Client Computer Effective Default Settings

      Not defined

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Not defined| +| Domain Controller Effective Default Settings | Not defined| +| Member Server Effective Default Settings | Not defined| +| Client Computer Effective Default Settings | Not defined|   ## Policy management + This section describes features, tools, and guidance to help you manage this policy. + A restart of the computer is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Users with the **Lock pages in memory** user right could assign physical memory to several processes, which could leave little or no RAM for other processes and result in a denial-of-service condition. + ### Countermeasure + Do not assign the **Lock pages in memory** user right to any accounts. + ### Potential impact + None. Not defined is the default configuration. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/log-on-as-a-batch-job.md b/windows/keep-secure/log-on-as-a-batch-job.md index 1d61c2f659..6ffcaa330e 100644 --- a/windows/keep-secure/log-on-as-a-batch-job.md +++ b/windows/keep-secure/log-on-as-a-batch-job.md @@ -2,98 +2,92 @@ title: Log on as a batch job (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Log on as a batch job security policy setting. ms.assetid: 4eaddb51-0a18-470e-9d3d-5e7cd7970b41 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Log on as a batch job + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Log on as a batch job** security policy setting. + ## Reference + This policy setting determines which accounts can log on by using a batch-queue tool such as the Task Scheduler service. When you use the Add Scheduled Task Wizard to schedule a task to run under a particular user name and password, that user is automatically assigned the **Log on as a batch job** user right. When the scheduled time arrives, the Task Scheduler service logs on the user as a batch job instead of as an interactive user, and the task runs in the user's security context. + Constant: SeBatchLogonRight + ### Possible values + - User-defined list of accounts - Default values - Not Defined + ### Best practices + - Use discretion when assigning this right to specific users for security reasons. The default settings are sufficient in most cases. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default, this setting is for Administrators, Backup Operators, and Performance Log Users on domain controllers and on stand-alone servers. + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Administrators

      -

      Backup Operators

      -

      Performance Log Users

      Stand-Alone Server Default Settings

      Administrators

      -

      Backup Operators

      -

      Performance Log Users

      Domain Controller Effective Default Settings

      Administrators

      -

      Backup Operators

      -

      Performance Log Users

      Member Server Effective Default Settings

      Administrators

      -

      Backup Operators

      -

      Performance Log Users

      Client Computer Effective Default Settings

      Administrators

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Administrators
      Backup Operators
      Performance Log Users| +| Stand-Alone Server Default Settings | Administrators
      Backup Operators
      Performance Log Users| +| Domain Controller Effective Default Settings | Administrators
      Backup Operators
      Performance Log Users| +| Member Server Effective Default Settings | Administrators
      Backup Operators
      Performance Log Users| +| Client Computer Effective Default Settings | Administrators|   ## Policy management + This section describes features, tools, and guidance to help you manage this policy. + A restart of the computer is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Task Scheduler automatically grants this right when a user schedules a task. To override this behavior use the [Deny log on as a batch job](deny-log-on-as-a-batch-job.md) User Rights Assignment setting. + Group Policy settings are applied in the following order, which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + The **Log on as a batch job** user right presents a low-risk vulnerability. For most organizations, the default settings are sufficient. Members of the local Administrators group have this right by default. + ### Countermeasure + You should allow the computer to manage this user right automatically if you want to allow scheduled tasks to run for specific user accounts. If you do not want to use the Task Scheduler in this manner, configure the **Log on as a batch job** user right for only the Local Service account. + For IIS servers, you should configure this policy locally instead of through domain–based Group Policy settings so that you can ensure the local IUSR\_*<ComputerName>* and IWAM\_*<ComputerName>* accounts have this user right. + ### Potential impact + If you configure the **Log on as a batch job** setting by using domain-based Group Policy settings, the computer cannot assign the user right to accounts that are used for scheduled jobs in the Task Scheduler. If you install optional components such as ASP.NET or IIS, you may need to assign this user right to additional accounts that are required by those components. For example, IIS requires assignment of this user right to the IIS\_WPG group and the IUSR\_*<ComputerName>*, ASPNET, and IWAM\_*<ComputerName>* accounts. If this user right is not assigned to this group and these accounts, IIS cannot run some COM objects that are necessary for proper functionality. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/log-on-as-a-service.md b/windows/keep-secure/log-on-as-a-service.md index ac574fb9c8..04d7784d74 100644 --- a/windows/keep-secure/log-on-as-a-service.md +++ b/windows/keep-secure/log-on-as-a-service.md @@ -2,88 +2,91 @@ title: Log on as a service (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Log on as a service security policy setting. ms.assetid: acc9a9e0-fd88-4cda-ab54-503120ba1f42 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Log on as a service + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Log on as a service** security policy setting. + ## Reference + This policy setting determines which service accounts can register a process as a service. Running a process under a service account circumvents the need for human intervention. + Constant: SeServiceLogonRight + ### Possible values + - User-defined list of accounts - Not Defined + ### Best practices + - Minimize the number of accounts that are granted this user right. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default this setting is Network Service on domain controllers and Network Service on stand-alone servers. + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Not defined

      Domain Controller Effective Default Settings

      Network Service

      Member Server Effective Default Settings

      Network Service

      Client Computer Effective Default Settings

      Network Service

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Not defined| +| Domain Controller Effective Default Settings | Network Service| +| Member Server Effective Default Settings| Network Service| +| Client Computer Effective Default Settings | Network Service|   ## Policy management + This section describes features, tools, and guidance to help you manage this policy. + A restart of the computer is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + The policy setting **Deny logon as a service** supersedes this policy setting if a user account is subject to both policies. + Group Policy settings are applied in the following order, which will overwrite settings on the local device at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability -The **Log on as a service** user right allows accounts to start network services or services that run continuously on a computer, even when no one is logged on to the console. The risk is reduced by the fact that only users with administrative privileges can install and configure services. An attacker who has already attained that level of access could configure the service to run with the Local System account. + +The **Log on as a service** user right allows accounts to start network services or services that run continuously on a computer, even when no one is logged on to the console. The risk is reduced by the fact that only users with administrative privileges can install and configure services. An +attacker who has already attained that level of access could configure the service to run with the Local System account. + ### Countermeasure + By definition, the Network Service account has the **Log on as a service** user right. This right is not granted through the Group Policy setting. You should minimize the number of other accounts that are granted this user right. + ### Potential impact -On most computers, restricting the **Log on as a service** user right to the Local System, Local Service, and Network Service built-in accounts is the default configuration, and there is no negative impact. However, if you have installed optional components such as ASP.NET or IIS, you may need to assign the **Log on as a service** user right to additional accounts that are required by those components. IIS requires that this user right be explicitly granted to the ASPNET user account. + +On most computers, restricting the **Log on as a service** user right to the Local System, Local Service, and Network Service built-in accounts is the default configuration, and there is no negative impact. However, if you have installed optional components such as ASP.NET or IIS, you may need to +assign the **Log on as a service** user right to additional accounts that are required by those components. IIS requires that this user right be explicitly granted to the ASPNET user account. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/maintain-applocker-policies.md b/windows/keep-secure/maintain-applocker-policies.md index d028b6c454..bc85d3af36 100644 --- a/windows/keep-secure/maintain-applocker-policies.md +++ b/windows/keep-secure/maintain-applocker-policies.md @@ -2,64 +2,100 @@ title: Maintain AppLocker policies (Windows 10) description: This topic describes how to maintain rules within AppLocker policies. ms.assetid: b4fbfdfe-ef3d-49e0-a390-f2dfe74602bc -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Maintain AppLocker policies + **Applies to** - Windows 10 + This topic describes how to maintain rules within AppLocker policies. + Common AppLocker maintenance scenarios include: + - A new app is deployed, and you need to update an AppLocker policy. - A new version of an app is deployed, and you need to either update an AppLocker policy or create a new rule to update the policy. - An app is no longer supported by your organization, so you need to prevent it from being used. - An app appears to be blocked but should be allowed. - An app appears to be allowed but should be blocked. - A single user or small subset of users needs to use a specific app that is blocked. + There are two methods you can use to maintain AppLocker policies: + - [Maintaining AppLocker policies by using Group Policy](#bkmk-applkr-use-gp) - [Maintaining AppLocker policies on the local computer](#bkmk-applkr-use-locsnapin) + As new apps are deployed or existing apps are removed by your organization or updated by the software publisher, you might need to make revisions to your rules and update the Group Policy Object (GPO) to ensure that your policy is current. -You can edit an AppLocker policy by adding, changing, or removing rules. However, you cannot specify a version for the AppLocker policy by importing additional rules. To ensure version control when modifying an AppLocker policy, use Group Policy management software that allows you to create versions of GPOs. -**Caution**   -You should not edit an AppLocker rule collection while it is being enforced in Group Policy. Because AppLocker controls what files are allowed to run, making changes to a live policy can create unexpected behavior. + +You can edit an AppLocker policy by adding, changing, or removing rules. However, you cannot specify a version for the AppLocker policy by importing additional rules. To ensure version control when modifying an AppLocker policy, use Group Policy management software that allows you to create +versions of GPOs. + +>**Caution:**  You should not edit an AppLocker rule collection while it is being enforced in Group Policy. Because AppLocker controls what files are allowed to run, making changes to a live policy can create unexpected behavior.   ## Maintaining AppLocker policies by using Group Policy + For every scenario, the steps to maintain an AppLocker policy distributed by Group Policy include the following tasks. + ### Step 1: Understand the current behavior of the policy + Before modifying a policy, evaluate how the policy is currently implemented. For example, if a new version of the application is deployed, you can use **Test-AppLockerPolicy** to verify the effectiveness of your current policy for that app. + ### Step 2: Export the AppLocker policy from the GPO + Updating an AppLocker policy that is currently enforced in your production environment can have unintended results. Therefore, export the policy from the GPO and update the rule or rules by using AppLocker on your AppLocker reference or test computer. To prepare an AppLocker policy for modification, see [Export an AppLocker policy from a GPO](export-an-applocker-policy-from-a-gpo.md) + ### Step 3: Update the AppLocker policy by editing the appropriate AppLocker rule + After the AppLocker policy has been exported from the GPO into the AppLocker reference or test computer, or has been accessed on the local computer, the specific rules can be modified as required. + To modify AppLocker rules, see the following: + - [Edit AppLocker rules](edit-applocker-rules.md) - [Merge AppLocker policies by using Set-ApplockerPolicy](merge-applocker-policies-by-using-set-applockerpolicy.md) or [Merge AppLocker policies manually](merge-applocker-policies-manually.md) - [Delete an AppLocker rule](delete-an-applocker-rule.md) - [Enforce AppLocker rules](enforce-applocker-rules.md) + ### Step 4: Test the AppLocker policy + You should test each collection of rules to ensure that the rules perform as intended. (Because AppLocker rules are inherited from linked GPOs, you should deploy all rules for simultaneous testing in all test GPOs.) For steps to perform this testing, see [Test and update an AppLocker policy](test-and-update-an-applocker-policy.md). + ### Step 5: Import the AppLocker policy into the GPO + After testing, import the AppLocker policy back into the GPO for implementation. To update the GPO with a modified AppLocker policy, see [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md). + ### Step 6: Monitor the resulting policy behavior After deploying a policy, evaluate the policy's effectiveness. + ## Maintaining AppLocker policies by using the Local Security Policy snap-in For every scenario, the steps to maintain an AppLocker policy by using the Local Group Policy Editor or the Local Security Policy snap-in include the following tasks. + ### Step 1: Understand the current behavior of the policy + Before modifying a policy, evaluate how the policy is currently implemented. + ### Step 2: Update the AppLocker policy by modifying the appropriate AppLocker rule + Rules are grouped into a collection, which can have the policy enforcement setting applied to it. By default, AppLocker rules do not allow users to open or run any files that are not specifically allowed. + To modify AppLocker rules, see the appropriate topic listed on [Administer AppLocker](administer-applocker.md). + ### Step 3: Test the AppLocker policy + You should test each collection of rules to ensure that the rules perform as intended. For steps to perform this testing, see [Test and update an AppLocker policy](test-and-update-an-applocker-policy.md). + ### Step 4: Deploy the policy with the modified rule + You can export and then import AppLocker policies to deploy the policy to other computers running Windows 8 or later. To perform this task, see [Export an AppLocker policy to an XML file](export-an-applocker-policy-to-an-xml-file.md) and [Import an AppLocker policy from another computer](import-an-applocker-policy-from-another-computer.md). + ### Step 5: Monitor the resulting policy behavior + After deploying a policy, evaluate the policy's effectiveness. + ## Additional resources + - For steps to perform other AppLocker policy tasks, see [Administer AppLocker](administer-applocker.md). -  -  diff --git a/windows/keep-secure/manage-auditing-and-security-log.md b/windows/keep-secure/manage-auditing-and-security-log.md index f6bfc0e575..48c840cc7b 100644 --- a/windows/keep-secure/manage-auditing-and-security-log.md +++ b/windows/keep-secure/manage-auditing-and-security-log.md @@ -2,95 +2,97 @@ title: Manage auditing and security log (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Manage auditing and security log security policy setting. ms.assetid: 4b946c0d-f904-43db-b2d5-7f0917575347 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Manage auditing and security log + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Manage auditing and security log** security policy setting. + ## Reference -This policy setting determines which users can specify object access audit options for individual resources such as files, Active Directory objects, and registry keys. These objects specify their system access control lists (SACL). A user who is assigned this user right can also view and clear the Security log in Event Viewer. For more info about the Object Access audit policy, see [Audit object access](basic-audit-object-access.md). + +This policy setting determines which users can specify object access audit options for individual resources such as files, Active Directory objects, and registry keys. These objects specify their system access control lists (SACL). A user who is assigned this user right can also view and clear the +Security log in Event Viewer. For more info about the Object Access audit policy, see [Audit object access](basic-audit-object-access.md). + Constant: SeSecurityPrivilege + ### Possible values - User-defined list of accounts - Administrators - Not Defined + ### Best practices + 1. Before removing this right from a group, investigate whether applications are dependent on this right. 2. Generally, assigning this user right to groups other than Administrators is not necessary. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default this setting is Administrators on domain controllers and on stand-alone servers. + The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Administrators

      Stand-Alone Server Default Settings

      Administrators

      Domain Controller Effective Default Settings

      Administrators

      Member Server Effective Default Settings

      Administrators

      Client Computer Effective Default Settings

      Administrators

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Administrators| +| Stand-Alone Server Default Settings | Administrators| +| Domain Controller Effective Default Settings | Administrators| +| Member Server Effective Default Settings | Administrators| +| Client Computer Effective Default Settings| Administrators|   ## Policy management + This section describes features, tools, and guidance to help you manage this policy. + A restart of the computer is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + Audits for object access are not performed unless you enable them by using the Local Group Policy Editor, the Group Policy Management Console (GPMC), or the Auditpol command-line tool. + For more information about the Object Access audit policy, see [Audit object access](basic-audit-object-access.md). + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Anyone with the **Manage auditing and security log** user right can clear the Security log to erase important evidence of unauthorized activity. + ### Countermeasure + Ensure that only the local Administrators group has the **Manage auditing and security log** user right. + ### Potential impact + Restricting the **Manage auditing and security log** user right to the local Administrators group is the default configuration. -**Warning**   -If groups other than the local Administrators group have been assigned this user right, removing this user right might cause performance issues with other applications. Before removing this right from a group, investigate whether applications are dependent on this right. + +>**Warning:**  If groups other than the local Administrators group have been assigned this user right, removing this user right might cause performance issues with other applications. Before removing this right from a group, investigate whether applications are dependent on this right.   ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/manage-packaged-apps-with-applocker.md b/windows/keep-secure/manage-packaged-apps-with-applocker.md index 33641e9491..dcad549bfa 100644 --- a/windows/keep-secure/manage-packaged-apps-with-applocker.md +++ b/windows/keep-secure/manage-packaged-apps-with-applocker.md @@ -2,47 +2,71 @@ title: Manage packaged apps with AppLocker (Windows 10) description: This topic for IT professionals describes concepts and lists procedures to help you manage Packaged apps with AppLocker as part of your overall application control strategy. ms.assetid: 6d0c99e7-0284-4547-a30a-0685a9916650 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Manage packaged apps with AppLocker + **Applies to** - Windows 10 + This topic for IT professionals describes concepts and lists procedures to help you manage Packaged apps with AppLocker as part of your overall application control strategy. + ## Understanding Packaged apps and Packaged app installers for AppLocker -Packaged apps, also known as Universal Windows apps, are based on a model that ensures all the files within an app package share the same identity. With classic Windows apps, each file within the app could have a unique identity. With packaged apps, it is possible to control the entire app by using a single AppLocker rule. -**Note**   -AppLocker supports only publisher rules for packaged apps. All packaged apps must be signed by the software publisher because Windows does not support unsigned packaged apps. + +Packaged apps, also known as Universal Windows apps, are based on a model that ensures all the files within an app package share the same identity. With classic Windows apps, each file within the app could have a unique identity. +With packaged apps, it is possible to control the entire app by using a single AppLocker rule. + +>**Note:**  AppLocker supports only publisher rules for packaged apps. All packaged apps must be signed by the software publisher because Windows does not support unsigned packaged apps.   Typically, an app consists of multiple components: the installer that is used to install the app, and one or more exes, dlls, or scripts. With classic Windows apps, not all these components always share common attributes such as the software’s publisher name, product name, and product version. Therefore, AppLocker controls each of these components separately through different rule collections, such as exe, dll, script, and Windows Installer rules. In contrast, all the components of a packaged app share the same publisher name, package name, and package version attributes. Therefore, you can control an entire app with a single rule. + ### Comparing classic Windows apps and packaged apps -AppLocker policies for packaged apps can only be applied to apps installed on computers running at least Windows Server 2012 or Windows 8, but classic Windows apps can be controlled on devices running at least Windows Server 2008 R2 or Windows 7. The rules for classic Windows apps and packaged apps can be enforced in tandem. The differences between packaged apps and classic Windows apps that you should consider include: + +AppLocker policies for packaged apps can only be applied to apps installed on computers running at least Windows Server 2012 or Windows 8, but classic Windows apps can be controlled on devices running at least Windows Server +2008 R2 or Windows 7. The rules for classic Windows apps and packaged apps can be enforced in tandem. The differences between packaged apps and classic Windows apps that you should consider include: + - **Installing the apps**   All packaged apps can be installed by a standard user, whereas a number of classic Windows apps require administrative privileges to install. In an environment where most of the users are standard users, you might not have numerous exe rules (because classic Windows apps require administrative privileges to install), but you might want to have more explicit policies for packaged apps. - **Changing the system state**   Classic Windows apps can be written to change the system state if they are run with administrative privileges. Most packaged apps cannot change the system state because they run with limited privileges. When you design your AppLocker policies, it is important to understand whether an app that you are allowing can make system-wide changes. - **Acquiring the apps**   Packaged apps can be acquired through the Store, or by loading using Windows PowerShell cmdlets (which requires a special enterprise license). Classic Windows apps can be acquired through traditional means. + AppLocker uses different rule collections to control packaged apps and classic Windows apps. You have the choice to control one type, the other type, or both. + For info about controlling classic Windows apps, see [Administer AppLocker](administer-applocker.md). + For more info about packaged apps, see [Packaged apps and packaged app installer rules in AppLocker](packaged-apps-and-packaged-app-installer-rules-in-applocker.md). + ## Design and deployment decisions + You can use two methods to create an inventory of packaged apps on a computer: the AppLocker console or the **Get-AppxPackage** Windows PowerShell cmdlet. -**Note**   -Not all packaged apps are listed in AppLocker’s application inventory wizard. Certain app packages are framework packages that are leveraged by other apps. By themselves, these packages cannot do anything, but blocking such packages can inadvertently cause failure for apps that you want to allow. Instead, you can create Allow or Deny rules for the packaged apps that use these framework packages. The AppLocker user interface deliberately filters out all the packages that are registered as framework packages. For info about how to create an inventory list, see [Create list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md). + +>**Note:**  Not all packaged apps are listed in AppLocker’s application inventory wizard. Certain app packages are framework packages that are leveraged by other apps. By themselves, these packages cannot do anything, but blocking such packages can inadvertently cause failure for apps that you want to allow. Instead, you can create Allow or Deny rules for the packaged apps that use these framework packages. The AppLocker user interface deliberately filters out all the packages that are registered as framework packages. For info about how to create an inventory list, see [Create list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md).   For info about how to use the **Get-AppxPackage** Windows PowerShell cmdlet, see the [AppLocker PowerShell Command Reference](http://technet.microsoft.com/library/hh847210.aspx). + For info about creating rules for Packaged apps, see [Create a rule for packaged apps](create-a-rule-for-packaged-apps.md). + Consider the following info when you are designing and deploying apps: + - Because AppLocker supports only publisher rules for packaged apps, collecting the installation path information for packaged apps is not necessary. - You cannot create hash- or path-based rules for packaged apps because all packaged apps and packaged app installers are signed by the software publisher of the package. Classic Windows apps were not always consistently signed; therefore, AppLocker has to support hash- or path-based rules. -- By default, if there are no rules in a particular rule collection, AppLocker allows every file that is included in that rule collection. For example, if there are no Windows Installer rules, AppLocker allows all .msi, .msp, and .mst files to run. An existing AppLocker policy that was targeted at computers running Windows Server 2008 R2 and Windows 7 would not have rules for Packaged apps. Therefore, when a computer running at least Windows Server 2012 or Windows 8 joins a domain where an AppLocker policy is already configured, users would be allowed to run any packaged app. This might be contrary to your design. +- By default, if there are no rules in a particular rule collection, AppLocker allows every file that is included in that rule collection. For example, if there are no Windows Installer rules, AppLocker allows all .msi, .msp, and .mst files to run. An existing AppLocker policy that was targeted at computers running Windows Server 2008 R2 and Windows 7 would not have rules for Packaged apps. Therefore, when a computer running at least Windows Server 2012 or +Windows 8 joins a domain where an AppLocker policy is already configured, users would be allowed to run any packaged app. This might be contrary to your design. + To prevent all packaged apps from running on a newly domain-joined computer, by default AppLocker blocks all packaged apps on a computer running at least Windows Server 2012 or Windows 8 if the existing domain policy has rules configured in the exe rule collection. You must take explicit action to allow packaged apps in your enterprise. You can allow only a select set of packaged apps. Or if you want to allow all packaged apps, you can create a default rule for the packaged apps collection. + ## Using AppLocker to manage packaged apps + Just as there are differences in managing each rule collection, you need to manage the packaged apps with the following strategy: + 1. Gather information about which Packaged apps are running in your environment. For information about how to do this, see [Create list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md). + 2. Create AppLocker rules for specific packaged apps based on your policy strategies. For more information, see [Create a rule for packaged apps](create-a-rule-for-packaged-apps.md) and [Packaged Apps Default Rules in AppLocker](http://technet.microsoft.com/library/ee460941(WS.10).aspx). + 3. Continue to update the AppLocker policies as new package apps are introduced into your environment. To do this, see [Add rules for packaged apps to existing AppLocker rule-set](add-rules-for-packaged-apps-to-existing-applocker-rule-set.md). + 4. Continue to monitor your environment to verify the effectiveness of the rules that are deployed in AppLocker policies. To do this, see [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md). -  -  diff --git a/windows/keep-secure/manage-tpm-commands.md b/windows/keep-secure/manage-tpm-commands.md index 0683127abc..1aa0ca5061 100644 --- a/windows/keep-secure/manage-tpm-commands.md +++ b/windows/keep-secure/manage-tpm-commands.md @@ -2,54 +2,75 @@ title: Manage TPM commands (Windows 10) description: This topic for the IT professional describes how to manage which Trusted Platform Module (TPM) commands are available to domain users and to local users. ms.assetid: a78e751a-2806-43ae-9c20-2e7ca466b765 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Manage TPM commands + **Applies to** - Windows 10 + This topic for the IT professional describes how to manage which Trusted Platform Module (TPM) commands are available to domain users and to local users. + ## + After a computer user takes ownership of the TPM, the TPM owner can limit which TPM commands can be run by creating a list of blocked TPM commands. The list can be created and applied to all computers in a domain by using Group Policy, or a list can be created for individual computers by using the TPM MMC. Because some hardware vendors might provide additional commands or the Trusted Computing Group may decide to add commands in the future, the TPM MMC also supports the ability to block new commands. + Domain administrators can configure a list of blocked TPM commands by using Group Policy. Local administrators cannot allow TPM commands that are blocked through Group Policy. For more information about this Group Policy setting, see [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md#bkmk-tpmgp-clbtc). + Local administrators can block commands by using the TPM MMC, and commands on the default block list are also blocked unless the Group Policy settings are changed from the default settings. + Two policy settings control the enforcement which allows TPM commands to run. For more information about these policy settings, see [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md#bkmk-tpmgp-idlb). + The following procedures describe how to manage the TPM command lists. You must be a member of the local Administrators group. + **To block TPM commands by using the Local Group Policy Editor** + 1. Open the Local Group Policy Editor (gpedit.msc). If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. - **Note**   - Administrators with appropriate rights in a domain can configure a Group Policy Object (GPO) that can be applied through Active Directory Domain Services (AD DS). + + >**Note:**  Administrators with appropriate rights in a domain can configure a Group Policy Object (GPO) that can be applied through Active Directory Domain Services (AD DS).   2. In the console tree, under **Computer Configuration**, expand **Administrative Templates**, and then expand **System**. 3. Under **System**, click **Trusted Platform Module Services**. 4. In the details pane, double-click **Configure the list of blocked TPM commands**. 5. Click **Enabled**, and then click **Show**. 6. For each command that you want to block, click **Add**, enter the command number, and then click **OK**. - **Note**   - For a list of commands, see the [Trusted Platform Module (TPM) Specifications](http://go.microsoft.com/fwlink/p/?linkid=139770). + + >**Note:**  For a list of commands, see the [Trusted Platform Module (TPM) Specifications](http://go.microsoft.com/fwlink/p/?linkid=139770).   7. After you have added numbers for each command that you want to block, click **OK** twice. 8. Close the Local Group Policy Editor. + **To block or allow TPM commands by using the TPM MMC** + 1. Open the TPM MMC (tpm.msc) 2. If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. 3. In the console tree, click **Command Management**. A list of TPM commands is displayed. 4. In the list, select a command that you want to block or allow. 5. Under **Actions**, click **Block Selected Command** or **Allow Selected Command** as needed. If **Allow Selected Command** is unavailable, that command is currently blocked by Group Policy. + **To block new commands** + 1. Open the TPM MMC (tpm.msc). + If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. + 2. In the console tree, click **Command Management**. A list of TPM commands is displayed. 3. In the **Action** pane, click **Block New Command**. The **Block New Command** dialog box is displayed. 4. In the **Command Number** text box, type the number of the new command that you want to block, and then click **OK**. The command number you entered is added to the blocked list. + ## Use the TPM cmdlets + If you are using Windows PowerShell to manage your computers, you can also manage the TPM by using Windows PowerShell. To install the TPM cmdlets, type the following command: -**dism /online /enable-feature /FeatureName:tpm-psh-cmdlets** + +`dism /online /enable-feature /FeatureName:tpm-psh-cmdlets` + For details about the individual cmdlets, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx) + ## Additional resources + For more info about TPM, see [Trusted Platform Module technology overview](trusted-platform-module-overview.md#bkmk-additionalresources). -  -  diff --git a/windows/keep-secure/maximum-lifetime-for-service-ticket.md b/windows/keep-secure/maximum-lifetime-for-service-ticket.md index 35118cc805..3a0a6fff86 100644 --- a/windows/keep-secure/maximum-lifetime-for-service-ticket.md +++ b/windows/keep-secure/maximum-lifetime-for-service-ticket.md @@ -2,89 +2,91 @@ title: Maximum lifetime for service ticket (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Maximum lifetime for service ticket security policy setting. ms.assetid: 484bf05a-3858-47fc-bc02-6599ca860247 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Maximum lifetime for service ticket + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Maximum lifetime for service ticket** security policy setting. + ## Reference + The **Maximum lifetime for service ticket** policy setting determines the maximum number of minutes that a granted session ticket can be used to access a particular service. The value must be 10 minutes or greater, and it must be less than or equal to the value of the **Maximum lifetime for service ticket** policy setting. + The possible values for this Group Policy setting are: + - A user-defined number of minutes from 10 through 99,999, or 0 (in which case service tickets do not expire). - Not defined. + If a client presents an expired session ticket when it requests a connection to a server, the server returns an error message. The client must request a new session ticket from the Kerberos V5 KDC. After a connection is authenticated, however, it no longer matters whether the session ticket remains valid. Session tickets are used only to authenticate new connections with servers. Ongoing operations are not interrupted if the session ticket that authenticated the connection expires during the connection. + If the value for this policy setting is too high, users might be able to access network resources outside of their logon hours. In addition, users whose accounts have been disabled might be able to continue accessing network services by using valid service tickets that were issued before their account was disabled. If the value is set to 0, service tickets never expire. + ### Best practices + - It is advisable to set **Maximum lifetime for service ticket** to **600** minutes. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Kerberos Policy + ### Default values + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server Type or GPODefault Value

      Default Domain Policy

      600 minutes

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Not applicable

      DC Effective Default Settings

      600 minutes

      Member Server Effective Default Settings

      Not applicable

      Client Computer Effective Default Settings

      Not applicable

      + +| Server Type or GPO | Default Value | +| - | - | +| Default Domain Policy| 600 minutes| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Not applicable| +| DC Effective Default Settings | 600 minutes| +| Member Server Effective Default Settings | Not applicable| +| Client Computer Effective Default Settings | Not applicable|   ## Policy management + This section describes features, tools, and guidance to help you manage this policy. + A restart of the device is not required for this policy setting to be effective. + This policy setting is configured on the domain controller. + ### Group Policy + Client computers will get the new setting during the next scheduled and successful Group Policy refresh. But for domain controllers to assign these new settings immediately, a gpupdate.exe /force is required. On the local device, the Security Configuration Engine will refresh this setting in about five minutes. + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + If you configure the value for the **Maximum lifetime for service ticket** setting too high, users might be able to access network resources outside of their logon hours. Also, users whose accounts were disabled might continue to have access to network services with valid service tickets that were issued before their accounts were disabled. + ### Countermeasure + Configure the **Maximum lifetime for service ticket** setting to 600 minutes. + ### Potential impact + None. This is the default configuration. + ## Related topics -[Kerberos Policy](kerberos-policy.md) -  -  + +- [Kerberos Policy](kerberos-policy.md) diff --git a/windows/keep-secure/maximum-lifetime-for-user-ticket-renewal.md b/windows/keep-secure/maximum-lifetime-for-user-ticket-renewal.md index bcb1a344e6..c1f175c55b 100644 --- a/windows/keep-secure/maximum-lifetime-for-user-ticket-renewal.md +++ b/windows/keep-secure/maximum-lifetime-for-user-ticket-renewal.md @@ -2,88 +2,89 @@ title: Maximum lifetime for user ticket renewal (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Maximum lifetime for user ticket renewal security policy setting. ms.assetid: f88cd819-3dd1-4e38-b560-13fe6881b609 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Maximum lifetime for user ticket renewal + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Maximum lifetime for user ticket renewal** security policy setting. + ## Reference + The **Maximum lifetime for user ticket renewal** policy setting determines the period of time (in days) during which a user’s ticket-granting ticket can be renewed. + The possible values for this Group Policy setting are: + - A user-defined number of days from 0 through 99,999 - Not defined + ### Best practices + - If the value for this policy setting is too high, users may be able to renew very old user ticket-granting tickets. If the value is 0, ticket-granting tickets never expire. + It is advisable to set **Maximum lifetime for user ticket renewal** to **7** days. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Kerberos Policy + ### Default values + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      7 days

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Not applicable

      Domain Controller Effective Default Settings

      7 days

      Member Server Effective Default Settings

      Not applicable

      Client Computer Effective Default Settings

      Not applicable

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| 7 days| +| Default Domain Controller Policy| Not defined| +| Stand-Alone Server Default Settings | Not applicable| +| Domain Controller Effective Default Settings | 7 days| +| Member Server Effective Default Settings | Not applicable| +| Client Computer Effective Default Settings | Not applicable|   ### Policy management + This section describes features, tools, and guidance to help you manage this policy. + A restart of the device is not required for this policy setting to be effective. + This policy setting is configured on the domain controller. + ### Group Policy + Client devices will get the new setting during the next scheduled and successful Group Policy refresh. But for domain controllers to assign these new settings immediately, a gpupdate.exe /force is required. On the local device, the Security Configuration Engine will refresh this setting in about five minutes. + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + If the value for the **Maximum lifetime for user ticket renewal** setting is too high, users might be able to renew very old user tickets. + ### Countermeasure + Configure the **Maximum lifetime for user ticket renewal** setting to 7 days. + ### Potential impact + None. This is the default configuration. + ## Related topics -[Kerberos Policy](kerberos-policy.md) -  -  + +- [Kerberos Policy](kerberos-policy.md) diff --git a/windows/keep-secure/maximum-lifetime-for-user-ticket.md b/windows/keep-secure/maximum-lifetime-for-user-ticket.md index 4d15d5cbd8..e1a9089dd7 100644 --- a/windows/keep-secure/maximum-lifetime-for-user-ticket.md +++ b/windows/keep-secure/maximum-lifetime-for-user-ticket.md @@ -2,88 +2,89 @@ title: Maximum lifetime for user ticket (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Maximum lifetime for user ticket policy setting. ms.assetid: bcb4ff59-334d-4c2f-99af-eca2b64011dc -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Maximum lifetime for user ticket + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Maximum lifetime for user ticket** policy setting. + ## Reference + The **Maximum lifetime for user ticket** policy setting determines the maximum amount of time (in hours) that a user’s ticket-granting ticket can be used. When a user’s ticket-granting ticket expires, a new one must be requested or the existing one must be renewed. + The possible values for this Group Policy setting are: + - A user-defined number of hours from 0 through 99,999 - Not defined + If the value for this policy setting is too high, users might be able to access network resources outside of their logon hours, or users whose accounts have been disabled might be able to continue to access network services by using valid service tickets that were issued before their account was disabled. If the value is set to 0, ticket-granting tickets never expire. + ### Best practices + - It is advisable to set **Maximum lifetime for user ticket** to 10 hours. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Kerberos Policy + ### Default Values + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server Type or GPODefault Value

      Default Domain Policy

      10 hours

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Not applicable

      Domain Controller Effective Default Settings

      10 hours

      Member Server Effective Default Settings

      Not applicable

      Client Computer Effective Default Settings

      Not applicable

      + +| Server Type or GPO | Default Value | +| - | - | +| Default Domain Policy| 10 hours| +| Default Domain Controller Policy| Not defined| +| Stand-Alone Server Default Settings | Not applicable| +| Domain Controller Effective Default Settings | 10 hours| +| Member Server Effective Default Settings | Not applicable| +| Client Computer Effective Default Settings | Not applicable|   ## Policy management + This section describes features, tools, and guidance to help you manage this policy. + A restart of the computer is not required for this policy setting to be effective. + This policy setting is configured on the domain controller. + ### Group Policy + Client devices will get the new setting during the next scheduled and successful Group Policy refresh. But for domain controllers to assign these new settings immediately, a gpupdate.exe /force is required. On the local computer, the Security Configuration Engine will refresh this setting in about five minutes. + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + If you configure the value for the **Maximum lifetime for user ticket** setting too high, users might be able to access network resources outside of their logon hours. Also, users whose accounts were disabled might continue to have access to network services with valid user tickets that were issued before their accounts were disabled. If you configure this value too low, ticket requests to the KDC may affect the performance of your KDC and present an opportunity for a DoS attack. + ### Countermeasure + Configure the **Maximum lifetime for user ticket** setting with a value between 4 and 10 hours. + ### Potential impact + Reducing this setting from the default value reduces the likelihood that the ticket-granting ticket will be used to access resources that the user does not have rights to. However, it requires more frequent requests to the KDC for ticket-granting tickets on behalf of users. Most KDCs can support a value of four hours without too much additional burden. + ## Related topics -[Kerberos Policy](kerberos-policy.md) -  -  + +- [Kerberos Policy](kerberos-policy.md) diff --git a/windows/keep-secure/maximum-password-age.md b/windows/keep-secure/maximum-password-age.md index 2c384dcf41..30fb8319a2 100644 --- a/windows/keep-secure/maximum-password-age.md +++ b/windows/keep-secure/maximum-password-age.md @@ -2,82 +2,76 @@ title: Maximum password age (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Maximum password age security policy setting. ms.assetid: 2d6e70e7-c8b0-44fb-8113-870c6120871d -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Maximum password age + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Maximum password age** security policy setting. + ## Reference + The **Maximum password age** policy setting determines the period of time (in days) that a password can be used before the system requires the user to change it. You can set passwords to expire after a number of days between 1 and 999, or you can specify that passwords never expire by setting the number of days to 0. If **Maximum password age** is between 1 and 999 days, the minimum password age must be less than the maximum password age. If **Maximum password age** is set to 0, [Minimum password age](minimum-password-age.md) can be any value between 0 and 998 days. -**Note**   -Setting **Maximum password age** to -1 is equivalent to 0, which means it never expires. Setting it to any other negative number is equivalent to setting it to **Not Defined**. + +>**Note:**  Setting **Maximum password age** to -1 is equivalent to 0, which means it never expires. Setting it to any other negative number is equivalent to setting it to **Not Defined**.   ### Possible values + - User-specified number of days between 0 and 999 - Not defined + ### Best practices + Set **Maximum password age** to a value between 30 and 90 days, depending on your environment. This way, an attacker has a limited amount of time in which to compromise a user's password and have access to your network resources. + ### Location + **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy** + ### Default values + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or Group Policy Object (GPO)Default value

      Default domain policy

      42 days

      Default domain controller policy

      Not defined

      Stand-alone server default settings

      42 days

      Domain controller effective default settings

      42 days

      Member server effective default settings

      42 days

      Effective GPO default settings on client computers

      42 days

      + +| Server type or Group Policy Object (GPO) | Default value | +| - | - | +| Default domain policy| 42 days| +| Default domain controller policy| Not defined| +| Stand-alone server default settings | 42 days| +| Domain controller effective default settings | 42 days| +| Member server effective default settings | 42 days| +| Effective GPO default settings on client computers| 42 days|   ## Policy management + This section describes features, tools, and guidance to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + The longer a password exists, the higher the likelihood that it will be compromised by a brute force attack, by an attacker gaining general knowledge about the user, or by the user sharing the password. Configuring the **Maximum password age** policy setting to 0 so that users are never required to change their passwords is a major security risk because that allows a compromised password to be used by the malicious user for as long as the valid user is authorized access. + ### Countermeasure + Configure the **Maximum password age** policy setting to a value that is suitable for your organization's business requirements. + ### Potential impact + If the **Maximum password age** policy setting is too low, users are required to change their passwords very often. Such a configuration can reduce security in the organization because users might keep their passwords in an unsecured location or lose them. If the value for this policy setting is too high, the level of security within an organization is reduced because it allows potential attackers more time in which to discover user passwords or to use compromised accounts. + ## Related topics -[Password Policy](password-policy.md) -  -  + +- [Password Policy](password-policy.md) diff --git a/windows/keep-secure/maximum-tolerance-for-computer-clock-synchronization.md b/windows/keep-secure/maximum-tolerance-for-computer-clock-synchronization.md index 5923108470..f5f976b55a 100644 --- a/windows/keep-secure/maximum-tolerance-for-computer-clock-synchronization.md +++ b/windows/keep-secure/maximum-tolerance-for-computer-clock-synchronization.md @@ -2,88 +2,90 @@ title: Maximum tolerance for computer clock synchronization (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Maximum tolerance for computer clock synchronization security policy setting. ms.assetid: ba2cf59e-d69d-469e-95e3-8e6a0ba643af -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Maximum tolerance for computer clock synchronization + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Maximum tolerance for computer clock synchronization** security policy setting. + ## Reference + This security setting determines the maximum time difference (in minutes) that Kerberos V5 tolerates between the time on the client clock and the time on the domain controller that provides Kerberos authentication. -To prevent "replay attacks," the Kerberos v5 protocol uses time stamps as part of its protocol definition. For time stamps to work properly, the clocks of the client and the domain controller need to be in sync as much as possible. In other words, both devices must be set to the same time and date. Because the clocks of two computers are often out of sync, you can use this policy setting to establish the maximum acceptable difference to the Kerberos protocol between a client clock and domain controller clock. If the difference between a client computer clock and the domain controller clock is less than the maximum time difference that is specified in this policy, any time stamp that is used in a session between the two devices is considered to be authentic. + +To prevent "replay attacks," the Kerberos v5 protocol uses time stamps as part of its protocol definition. For time stamps to work properly, the clocks of the client and the domain controller need to be in sync as much as possible. In other words, both devices must be set to the same time and date. +Because the clocks of two computers are often out of sync, you can use this policy setting to establish the maximum acceptable difference to the Kerberos protocol between a client clock and domain controller clock. If the difference between a client computer clock and the domain controller clock is less than the maximum time difference that is specified in this policy, any time stamp that is used in a session between the two devices is considered to be authentic. + The possible values for this Group Policy setting are: + - A user-defined number of minutes from 1 through 99,999 - Not defined + ### Best practices + - It is advisable to set **Maximum tolerance for computer clock synchronization** to a value of 5 minutes. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Kerberos Policy + ### Default values + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      5 minutes

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Not applicable

      Domain Controller Effective Default Settings

      5 minutes

      Member Server Effective Default Settings

      Not applicable

      Client Computer Effective Default Settings

      Not applicable

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| 5 minutes| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Not applicable| +| Domain Controller Effective Default Settings| 5 minutes| +| Member Server Effective Default Settings | Not applicable| +| Client Computer Effective Default Settings | Not applicable|   ## Policy management + This section describes features, tools, and guidance to help you manage this policy. + A restart of the device is not required for this policy setting to be effective. + This policy setting is configured on the domain controller. + ### Group Policy + Client devices will get the new setting during the next scheduled and successful Group Policy refresh. But for domain controllers to assign these new settings immediately, a gpupdate.exe /force is required. On the local device, the Security Configuration Engine will refresh this setting in about five minutes. + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + To prevent "replay attacks" (which are attacks in which an authentication credential is resubmitted by a malicious user or program to gain access to a protected resource), the Kerberos protocol uses time stamps as part of its definition. For time stamps to work properly, the clocks of the client computer and the domain controller need to be closely synchronized. Because the clocks of two computers are often not synchronized, administrators can use this policy to establish the maximum acceptable difference to the Kerberos protocol between a client computer clock and a domain controller clock. If the difference between the client computer clock and the domain controller clock is less than the maximum time difference specified in this setting, any time stamp that is used in a session between the two computers is considered to be authentic. + ### Countermeasure + Configure the **Maximum tolerance for computer clock synchronization** setting to 5 minutes. + ### Potential impact + None. This is the default configuration. + ## Related topics -[Kerberos Policy](kerberos-policy.md) -  -  + +- [Kerberos Policy](kerberos-policy.md) diff --git a/windows/keep-secure/merge-applocker-policies-by-using-set-applockerpolicy.md b/windows/keep-secure/merge-applocker-policies-by-using-set-applockerpolicy.md index 3b95f2b434..42b8495ede 100644 --- a/windows/keep-secure/merge-applocker-policies-by-using-set-applockerpolicy.md +++ b/windows/keep-secure/merge-applocker-policies-by-using-set-applockerpolicy.md @@ -2,27 +2,36 @@ title: Merge AppLocker policies by using Set-ApplockerPolicy (Windows 10) description: This topic for IT professionals describes the steps to merge AppLocker policies by using Windows PowerShell. ms.assetid: f1c7d5c0-463e-4fe2-a410-844a404f18d0 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Merge AppLocker policies by using Set-ApplockerPolicy + **Applies to** - Windows 10 + This topic for IT professionals describes the steps to merge AppLocker policies by using Windows PowerShell. + The **Set-AppLockerPolicy** cmdlet sets the specified Group Policy Object (GPO) to contain the specified AppLocker policy. If no Lightweight Directory Access Protocol (LDAP) is specified, the local GPO is the default. When the Merge parameter is used, rules in the specified AppLocker policy will be merged with the AppLocker rules in the target GPO specified in the LDAP path. The merging of policies will remove rules with duplicate rule IDs, and the enforcement setting specified by the AppLocker policy in the target GPO will be preserved. If the Merge parameter is not specified, then the new policy will overwrite the existing policy. + For info about using **Set-AppLockerPolicy**, including syntax descriptions and parameters, see [Set-AppLockerPolicy](http://technet.microsoft.com/library/hh847212.aspx). + For info about using Windows PowerShell for AppLocker, including how to import the AppLocker cmdlets into Windows PowerShell, see [Use the AppLocker Windows PowerShell cmdlets](use-the-applocker-windows-powershell-cmdlets.md). + You can also manually merge AppLocker policies. For the procedure to do this, see [Merge AppLocker policies manually](merge-applocker-policies-manually.md). + **To merge a local AppLocker policy with another AppLocker policy by using LDAP paths** 1. Open the PowerShell command window. For info about performing Windows PowerShell commands for AppLocker, see [Use the AppLocker Windows PowerShell cmdlets](use-the-applocker-windows-powershell-cmdlets.md). 2. At the command prompt, type **C:\\PS>Get-AppLockerPolicy -Local | Set-AppLockerPolicy -LDAP "LDAP: //***<string>***"** **-Merge** where *<string>* specifies the LDAP path of the unique GPO. + ## Example + Gets the local AppLocker policy, and then merges the policy with the existing AppLocker policy in the GPO specified in the LDAP path. + ``` syntax C:\PS>Get-AppLockerPolicy -Local | Set-AppLockerPolicy -LDAP "LDAP://DC13.Contoso.com/CN={31B2F340-016D-11D2-945F-00C044FB984F9},CN=Policies,CN=System,DC=Contoso,DC=com" -Merge -``` -  -  +``` \ No newline at end of file diff --git a/windows/keep-secure/merge-applocker-policies-manually.md b/windows/keep-secure/merge-applocker-policies-manually.md index 160ae52209..c511afb3cd 100644 --- a/windows/keep-secure/merge-applocker-policies-manually.md +++ b/windows/keep-secure/merge-applocker-policies-manually.md @@ -2,84 +2,46 @@ title: Merge AppLocker policies manually (Windows 10) description: This topic for IT professionals describes the steps to manually merge AppLocker policies to update the Group Policy Object (GPO). ms.assetid: 3605f293-e5f2-481d-8efd-775f9f23c30f -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Merge AppLocker policies manually + **Applies to** - Windows 10 + This topic for IT professionals describes the steps to manually merge AppLocker policies to update the Group Policy Object (GPO). + If you have created multiple AppLocker policies and need to merge them to create one AppLocker policy, you can either manually merge the policies or use the Windows PowerShell cmdlets for AppLocker. You cannot automatically merge policies by using the AppLocker console. You must create one rule collection from two or more policies. For info about merging policies by using the cmdlet, see [Merge AppLocker policies by using Set-ApplockerPolicy](merge-applocker-policies-by-using-set-applockerpolicy.md). + The AppLocker policy is saved in XML format, and the exported policy can be edited with any text or XML editor. Rule collections are specified within the **RuleCollection Type** element. The XML schema includes five attributes for the different rule collections, as shown in the following table: - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Rule collectionRuleCollection Type element

      Executable rules

      Exe

      Windows Installer rules

      Msi

      Script rules

      Script

      DLL rules

      Dll

      Packaged apps and packaged app installers

      Appx

      + +| Rule collection | RuleCollection Type element | +| - | - | +| Executable rules| Exe| +| Windows Installer rules| Msi| +| Script rules | Script| +| DLL rules | Dll| +| Packaged apps and packaged app installers|Appx|   Rule enforcement is specified with the **EnforcementMode** element. The three enforcement modes in the XML correspond to the three enforcement modes in the AppLocker console, as shown in the following table: - ---- - - - - - - - - - - - - - - - - - - - - -
      XML enforcement modeEnforcement mode in Group Policy

      NotConfigured

      Not configured (rules are enforced)

      AuditOnly

      Audit only

      Enabled

      Enforce rules

      + +| XML enforcement mode |Enforcement mode in Group Policy | +| - | - | +| NotConfigured | Not configured (rules are enforced)| +| AuditOnly | Audit only| +| Enabled | Enforce rules|   Each of the three condition types use specific elements. For XML examples of the different rule types, see Merge AppLocker policies manually. + Membership in the local **Administrators** group, or equivalent, is the minimum required to complete this procedure. + **To merge two or more AppLocker policies** + 1. Open an XML policy file in a text editor or XML editor, such as Notepad. 2. Select the rule collection where you want to copy rules from. 3. Select the rules that you want to add to another policy file, and then copy the text. @@ -87,5 +49,3 @@ Membership in the local **Administrators** group, or equivalent, is the minimum 5. Select and expand the rule collection where you want to add the rules. 6. At the bottom of the rule list for the collection, after the closing element, paste the rules that you copied from the first policy file. Verify that the opening and closing elements are intact, and then save the policy. 7. Upload the policy to a reference computer to ensure that it is functioning properly within the GPO. -  -  diff --git a/windows/keep-secure/microsoft-network-client-digitally-sign-communications-always.md b/windows/keep-secure/microsoft-network-client-digitally-sign-communications-always.md index ae89b2c502..597e001a91 100644 --- a/windows/keep-secure/microsoft-network-client-digitally-sign-communications-always.md +++ b/windows/keep-secure/microsoft-network-client-digitally-sign-communications-always.md @@ -2,103 +2,109 @@ title: Microsoft network client Digitally sign communications (always) (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Microsoft network client Digitally sign communications (always) security policy setting. ms.assetid: 4b7b0298-b130-40f8-960d-60418ba85f76 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Microsoft network client: Digitally sign communications (always) + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **Microsoft network client: Digitally sign communications (always)** security policy setting. + ## Reference -The Server Message Block (SMB) protocol provides the basis for file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with the Server service is permitted. + +The Server Message Block (SMB) protocol provides the basis for file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. +This policy setting determines whether SMB packet signing must be negotiated before further communication with the Server service is permitted. + Implementation of digital signatures in high-security networks helps prevent the impersonation of client computers and servers, which is known as "session hijacking." But misuse of these policy settings is a common error that can cause data loss or problems with data access or security. + If server-side SMB signing is required, a client device will not be able to establish a session with that server, unless it has client-side SMB signing enabled. By default, client-side SMB signing is enabled on workstations, servers, and domain controllers. Similarly, if client-side SMB signing is required, that client device will not be able to establish a session with servers that do not have packet signing enabled. By default, server-side SMB signing is enabled only on domain controllers. + If server-side SMB signing is enabled, SMB packet signing will be negotiated with client computers that have SMB signing enabled. + Using SMB packet signing can impose up to a 15 percent performance degradation on file service transactions. + There are three other policy settings that relate to packet-signing requirements for Server Message Block (SMB) communications: - [Microsoft network server: Digitally sign communications (always)](microsoft-network-server-digitally-sign-communications-always.md) - [Microsoft network client: Digitally sign communications (if server agrees)](microsoft-network-client-digitally-sign-communications-if-server-agrees.md) - [Microsoft network server: Digitally sign communications (if client agrees)](microsoft-network-server-digitally-sign-communications-if-client-agrees.md) + ### Possible values + - Enabled - Disabled - Not defined + ### Best practices + 1. Configure the following security policy settings as follows: + - Disable **Microsoft network client: Digitally sign communications (always)**. - Disable [Microsoft network server: Digitally sign communications (always)](microsoft-network-server-digitally-sign-communications-always.md). - Enable [Microsoft network client: Digitally sign communications (if server agrees)](microsoft-network-client-digitally-sign-communications-if-server-agrees.md). - Enable [Microsoft network server: Digitally sign communications (if client agrees)](microsoft-network-server-digitally-sign-communications-if-client-agrees.md). + 2. Alternately, you can set all of these policy settings to Enabled, but enabling them can cause slower performance on client devices and prevent them from communicating with legacy SMB applications and operating systems. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Disabled

      DC Effective Default Settings

      Disabled

      Member Server Effective Default Settings

      Disabled

      Client Computer Effective Default Settings

      Disabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Session hijacking uses tools that allow attackers who have access to the same network as the client device or server to interrupt, end, or steal a session in progress. Attackers can potentially intercept and modify unsigned Server Message Block (SMB) packets and then modify the traffic and forward it so that the server might perform objectionable actions. Alternatively, the attacker could pose as the server or client computer after legitimate authentication, and gain unauthorized access to data. + SMB is the resource-sharing protocol that is supported by many Windows operating systems. It is the basis of NetBIOS and many other protocols. SMB signatures authenticate users and the servers that host the data. If either side fails the authentication process, data transmission does not take place. + ### Countermeasure + Configure the settings as follows: + - Disable **Microsoft network client: Digitally sign communications (always)**. - Disable [Microsoft network server: Digitally sign communications (always)](microsoft-network-server-digitally-sign-communications-always.md). - Enable [Microsoft network client: Digitally sign communications (if server agrees)](microsoft-network-client-digitally-sign-communications-if-server-agrees.md). - Enable [Microsoft network server: Digitally sign communications (if client agrees)](microsoft-network-server-digitally-sign-communications-if-client-agrees.md). + In highly secure environments, we recommend that you configure all of these settings to Enabled. However, that configuration may cause slower performance on client devices and prevent communications with earlier SMB applications and operating systems. -**Note**   -An alternative countermeasure that could protect all network traffic is to implement digital signatures with IPsec. There are hardware-based accelerators for IPsec encryption and signing that could be used to minimize the performance impact on the servers' CPUs. No such accelerators are available for SMB signing. + +>**Note:**  An alternative countermeasure that could protect all network traffic is to implement digital signatures with IPsec. There are hardware-based accelerators for IPsec encryption and signing that could be used to minimize the performance impact on the servers' CPUs. No such accelerators are available for SMB signing.   ### Potential impact + Implementations of the SMB file and print-sharing protocol support mutual authentication. This prevents session hijacking attacks and supports message authentication to prevent man-in-the-middle attacks. SMB signing provides this authentication by placing a digital signature into each SMB, which is then verified by the client and the server. + Implementation of SMB signing may negatively affect performance because each packet must be signed and verified. If these settings are enabled on a server that is performing multiple roles, such as a small business server that is serving as a domain controller, file server, print server, and application server, performance may be substantially slowed. Additionally, if you configure devices to ignore all unsigned SMB communications, older applications and operating systems cannot connect. However, if you completely disable all SMB signing, computers are vulnerable to session-hijacking attacks. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) From 8dcfaa850a1e0943430e0bc541441758e8b7a87b Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Tue, 24 May 2016 15:34:51 -0700 Subject: [PATCH 406/439] fixing spacing issues --- ...ly-sign-communications-if-server-agrees.md | 100 ++++++++++-------- ...ted-password-to-third-party-smb-servers.md | 84 +++++++-------- ...time-required-before-suspending-session.md | 82 +++++++------- ...pt-s4u2self-to-obtain-claim-information.md | 95 +++++++++-------- ...er-digitally-sign-communications-always.md | 98 +++++++++-------- ...ly-sign-communications-if-client-agrees.md | 97 +++++++++-------- ...connect-clients-when-logon-hours-expire.md | 85 +++++++-------- ...server-spn-target-name-validation-level.md | 95 +++++++++-------- windows/keep-secure/minimum-password-age.md | 81 +++++++------- .../keep-secure/minimum-password-length.md | 85 +++++++-------- windows/keep-secure/modify-an-object-label.md | 94 ++++++++-------- .../modify-firmware-environment-values.md | 90 ++++++++-------- ...onitor-application-usage-with-applocker.md | 46 ++++++-- ...tral-access-policy-and-rule-definitions.md | 20 ++-- windows/keep-secure/monitor-claim-types.md | 27 +++-- .../monitor-resource-attribute-definitions.md | 21 ++-- ...icies-associated-with-files-and-folders.md | 32 ++++-- ...ss-policies-that-apply-on-a-file-server.md | 25 +++-- ...esource-attributes-on-files-and-folders.md | 24 +++-- ...or-the-use-of-removable-storage-devices.md | 29 +++-- ...r-user-and-device-claims-during-sign-in.md | 26 +++-- 21 files changed, 748 insertions(+), 588 deletions(-) diff --git a/windows/keep-secure/microsoft-network-client-digitally-sign-communications-if-server-agrees.md b/windows/keep-secure/microsoft-network-client-digitally-sign-communications-if-server-agrees.md index 287afc0542..3f25ac2921 100644 --- a/windows/keep-secure/microsoft-network-client-digitally-sign-communications-if-server-agrees.md +++ b/windows/keep-secure/microsoft-network-client-digitally-sign-communications-if-server-agrees.md @@ -2,103 +2,111 @@ title: Microsoft network client Digitally sign communications (if server agrees) (Windows 10) description: Describes the best practices, location, values, and security considerations for the Microsoft network client Digitally sign communications (if server agrees) security policy setting. ms.assetid: e553f700-aae5-425c-8650-f251c90ba5dd -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft + --- # Microsoft network client: Digitally sign communications (if server agrees) + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Microsoft network client: Digitally sign communications (if server agrees)** security policy setting. + ## Reference + The Server Message Block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with the Server service is permitted. + Implementation of digital signatures in high-security networks helps to prevent the impersonation of client computers and servers, which is known as "session hijacking." But misuse of these policy settings is a common error that can cause data loss or problems with data access or security. + If server-side SMB signing is required, a client computer will not be able to establish a session with that server, unless it has client-side SMB signing enabled. By default, client-side SMB signing is enabled on workstations, servers, and domain controllers. Similarly, if client-side SMB signing is required, that client device will not be able to establish a session with servers that do not have packet signing enabled. By default, server-side SMB signing is enabled only on domain controllers. + If server-side SMB signing is enabled, SMB packet signing will be negotiated with client computers that have SMB signing enabled. + Using SMB packet signing can impose up to a 15 percent performance degradation on file service transactions. + There are three other policy settings that relate to packet-signing requirements for Server Message Block (SMB) communications: + - [Microsoft network server: Digitally sign communications (always)](microsoft-network-server-digitally-sign-communications-always.md) - [Microsoft network client: Digitally sign communications (always)](microsoft-network-client-digitally-sign-communications-always.md) - [Microsoft network server: Digitally sign communications (if client agrees)](microsoft-network-server-digitally-sign-communications-if-client-agrees.md) + ### Possible values + - Enabled - Disabled - Not defined + ### Best practices + 1. Configure the following security policy settings as follows: + - Disable [Microsoft network client: Digitally sign communications (always)](microsoft-network-client-digitally-sign-communications-always.md). - Disable [Microsoft network server: Digitally sign communications (always)](microsoft-network-server-digitally-sign-communications-always.md). - Enable **Microsoft Network Client: Digitally Sign Communications (If Server Agrees)**. - Enable [Microsoft network server: Digitally sign communications (if client agrees)](microsoft-network-server-digitally-sign-communications-if-client-agrees.md). + 2. Alternately, you can set all of these policy settings to Enabled, but enabling them can cause slower performance on client devices and prevent them from communicating with legacy SMB applications and operating systems. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Enabled

      DC Effective Default Settings

      Enabled

      Member Server Effective Default Settings

      Enabled

      Client Computer Effective Default Settings

      Enabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Enabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings| Enabled| +| Client Computer Effective Default Settings | Enabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability -Session hijacking uses tools that allow attackers who have access to the same network as the client or server to interrupt, end, or steal a session in progress. Attackers can potentially intercept and modify unsigned Server Message Block (SMB) packets and then modify the traffic and forward it so that the server might perform objectionable actions. Alternatively, the attacker could pose as the server or client device after legitimate authentication and gain unauthorized access to data. + +Session hijacking uses tools that allow attackers who have access to the same network as the client or server to interrupt, end, or steal a session in progress. Attackers can potentially intercept and modify unsigned Server Message Block (SMB) packets and then modify the traffic and forward it so +that the server might perform objectionable actions. Alternatively, the attacker could pose as the server or client device after legitimate authentication and gain unauthorized access to data. + SMB is the resource-sharing protocol that is supported by many Windows operating systems. It is the basis of NetBIOS and many other protocols. SMB signatures authenticate users and the servers that host the data. If either side fails the authentication process, data transmission does not take place. + ### Countermeasure + Configure the settings as follows: + - Disable [Microsoft network client: Digitally sign communications (always)](microsoft-network-client-digitally-sign-communications-always.md). - Disable [Microsoft network server: Digitally sign communications (always)](microsoft-network-server-digitally-sign-communications-always.md). - Enable **Microsoft network client: Digitally sign communications (if server agrees)**. - Enable [Microsoft network server: Digitally sign communications (if client agrees)](microsoft-network-server-digitally-sign-communications-if-client-agrees.md). + In highly secure environments we recommend that you configure all of these settings to Enabled. However, that configuration may cause slower performance on client devices and prevent communications with earlier SMB applications and operating systems. -**Note**   -An alternative countermeasure that could protect all network traffic is to implement digital signatures with IPsec. There are hardware-based accelerators for IPsec encryption and signing that could be used to minimize the performance impact on the servers' CPUs. No such accelerators are available for SMB signing. + +>**Note:**  An alternative countermeasure that could protect all network traffic is to implement digital signatures with IPsec. There are hardware-based accelerators for IPsec encryption and signing that could be used to minimize the performance impact on the servers' CPUs. No such accelerators are available for SMB signing.   ### Potential impact + Implementations of the SMB file and print-sharing protocol support mutual authentication. This prevents session hijacking attacks and supports message authentication to prevent man-in-the-middle attacks. SMB signing provides this authentication by placing a digital signature into each SMB, which is then verified by the client and the server. -Implementation of SMB signing may negatively affect performance because each packet must be signed and verified. If these settings are enabled on a server that is performing multiple roles, such as a small business server that is serving as a domain controller, file server, print server, and application server, performance may be substantially slowed. Additionally, if you configure devices to ignore all unsigned SMB communications, older applications and operating systems cannot connect. However, if you completely disable all SMB signing, devices are vulnerable to session-hijacking attacks. + +Implementation of SMB signing may negatively affect performance because each packet must be signed and verified. If these settings are enabled on a server that is performing multiple roles, such as a small business server that is serving as a domain controller, file server, print server, and application server, performance may be substantially slowed. Additionally, if you configure devices to ignore all unsigned SMB communications, older applications and operating systems cannot connect. However, if you completely disable all SMB signing, devices are vulnerable to session-hijacking +attacks. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md b/windows/keep-secure/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md index c14351f372..56635e06cc 100644 --- a/windows/keep-secure/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md +++ b/windows/keep-secure/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md @@ -2,82 +2,82 @@ title: Microsoft network client Send unencrypted password to third-party SMB servers (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Microsoft network client Send unencrypted password to third-party SMB servers security policy setting. ms.assetid: 97a76b93-afa7-4dd9-bb52-7c9e289b6017 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + + # Microsoft network client: Send unencrypted password to third-party SMB servers + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **Microsoft network client: Send unencrypted password to third-party SMB servers** security policy setting. + ## Reference + The Server Message Block (SMB) protocol provides the basis for file and print sharing and many other networking operations, such as remote Windows administration. This policy setting allows or prevents the SMB redirector to send plaintext passwords to a non-Microsoft server service that does not support password encryption during authentication. + ### Possible values + - Enabled + The Server Message Block (SMB) redirector is allowed to send plaintext passwords to a non-Microsoft server service that does not support password encryption during authentication. + - Disabled + The Server Message Block (SMB) redirector only sends encrypted passwords to non-Microsoft SMB server services. If those server services do not support password encryption, the authentication request will fail. + - Not defined + ### Best practices + - It is advisable to set **Microsoft network client: Send unencrypted password to connect to third-party SMB servers** to Disabled. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Disabled

      DC Effective Default Settings

      Disabled

      Member Server Effective Default Settings

      Disabled

      Client Computer Effective Default Settings

      Disabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings| Disabled| +| Client Computer Effective Default Settings | Disabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + If you enable this policy setting, the server can transmit plaintext passwords across the network to other computers that offer SMB services. These other devices might not use any of the SMB security mechanisms that are included with Windows Server 2003 or later. + ### Countermeasure + Disable the **Microsoft network client: Send unencrypted password to connect to third-party SMB servers** setting. + ### Potential impact + Some older applications may not be able to communicate with the servers in your organization by means of the SMB protocol. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md b/windows/keep-secure/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md index 754051399a..76e38d84c1 100644 --- a/windows/keep-secure/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md +++ b/windows/keep-secure/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md @@ -2,81 +2,79 @@ title: Microsoft network server Amount of idle time required before suspending session (Windows 10) description: Describes the best practices, location, values, and security considerations for the Microsoft network server Amount of idle time required before suspending session security policy setting. ms.assetid: 8227842a-569d-480f-b43c-43450bbaa722 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Microsoft network server: Amount of idle time required before suspending session + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Microsoft network server: Amount of idle time required before suspending session** security policy setting. + ## Reference + Each Server Message Block (SMB) session consumes server resources. Establishing numerous null sessions will cause the server to slow down or possibly fail. A malicious user might repeatedly establish SMB sessions until the server stops responding; at this point, SMB services will become slow or unresponsive. + The **Microsoft network server: Amount of idle time required before suspending session** policy setting determines the amount of continuous idle time that must pass in an SMB session before the session is suspended due to inactivity. You can use this policy setting to control when a device suspends an inactive SMB session. The session is automatically reestablished when client device activity resumes. + ### Possible values + - A user-defined number of minutes from 0 through 99,999 + For this policy setting, a value of 0 means to disconnect an idle session as quickly as is reasonably possible. The maximum value is 99999, which is 208 days. In effect, this value disables the policy. + - Not defined + ### Best practices + - It is advisable to set this policy to 15 minutes. There will be little impact because SMB sessions will be reestablished automatically if the client resumes activity. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      15 minutes

      DC Effective Default Settings

      15 minutes

      Member Server Effective Default Settings

      15 minutes

      Client Computer Effective Default Settings

      15 minutes

      + +| Server type or GPO Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined | +| Stand-Alone Server Default Settings | 15 minutes| +| DC Effective Default Settings | 15 minutes| +| Member Server Effective Default Settings | 15 minutes| +| Client Computer Effective Default Settings | 15 minutes|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Each SMB session consumes server resources, and numerous null sessions slow the server or possibly cause it to fail. An attacker could repeatedly establish SMB sessions until the server's SMB services become slow or unresponsive. + ### Countermeasure + The default behavior on a server mitigates this threat by design. + ### Potential impact + There is little impact because SMB sessions are reestablished automatically if the client computer resumes activity. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md b/windows/keep-secure/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md index 5a59300d6c..ea1b074c71 100644 --- a/windows/keep-secure/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md +++ b/windows/keep-secure/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md @@ -2,88 +2,95 @@ title: Microsoft network server Attempt S4U2Self to obtain claim information (Windows 10) description: Describes the best practices, location, values, management, and security considerations for the Microsoft network server Attempt S4U2Self to obtain claim information security policy setting. ms.assetid: e4508387-35ed-4a3f-a47c-27f8396adbba -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Microsoft network server: Attempt S4U2Self to obtain claim information + **Applies to** - Windows 10 + Describes the best practices, location, values, management, and security considerations for the **Microsoft network server: Attempt S4U2Self to obtain claim information** security policy setting. + ## Reference -This security setting supports client devices running a version of Windows prior to Windows 8 that are trying to access a file share that requires user claims. This setting determines whether the local file server will attempt to use Kerberos Service-for-User-to-Self (S4U2Self) functionality to obtain a network client principal’s claims from the client’s account domain. This setting should only be enabled if the file server is using user claims to control access to files, and if the file server will support client principals whose accounts might be in a domain that has client computers and domain controllers running a version of Windows prior to Windows 8 or Windows Server 2012. + +This security setting supports client devices running a version of Windows prior to Windows 8 that are trying to access a file share that requires user claims. This setting determines whether the local file server will attempt to use Kerberos Service-for-User-to-Self (S4U2Self) functionality to obtain a network client principal’s claims from the client’s account domain. This setting should only be enabled if the file server is using user claims to control access to files, and if the file server will support client principals whose accounts might be in a domain that has client computers +and domain controllers running a version of Windows prior to Windows 8 or Windows Server 2012. + When enabled, this security setting causes the Windows file server to examine the access token of an authenticated network client principal and determines if claim information is present. If claims are not present, the file server will then use the Kerberos S4U2Self feature to attempt to contact a Windows Server 2012 domain controller in the client’s account domain and obtain a claims-enabled access token for the client principal. A claims-enabled token might be needed to access files or folders that have claim-based access control policy applied. + If this setting is disabled, the Windows file server will not attempt to obtain a claim-enabled access token for the client principal. + ### Possible values + - **Default** + The Windows file server will examine the access token of an authenticated network client principal and determine if claim information is present. + - **Enabled** + Same as **Default**. + - **Disabled** + - **Not defined** + Same as **Disabled**. + ### Best practices + This setting should be set to **Default** so that the file server can automatically evaluate whether claims are needed for the user. You should explicitly configure this setting to **Enabled** only if there are local file access policies that include user claims. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Not defined

      DC Effective Default Settings

      Disabled

      Member Server Effective Default Settings

      Disabled

      Client Computer Effective Default Settings

      Disabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Not defined| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings| Disabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Group Policy + This setting should only be enabled if the file server is using user claims to control access to files, and if the file server will support client principals whose accounts might be in a domain that has client computers and domain controllers running a version of Windows prior to Windows 8 or Windows Server 2012. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability -None. Enabling this policy setting allows you take advantage of features in Windows Server 2012 and Windows 8 for specific scenarios to use claims-enabled tokens to access files or folders that have claim-based access control policy applied on Windows operating systems prior to Windows Server 2012 and Windows 8. + +None. Enabling this policy setting allows you take advantage of features in Windows Server 2012 and Windows 8 and later for specific scenarios to use claims-enabled tokens to access files or folders that have claim-based access control policy applied on Windows operating systems prior to Windows Server 2012 +and Windows 8. + ### Countermeasure + Not applicable. + ### Potential impact + None. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/microsoft-network-server-digitally-sign-communications-always.md b/windows/keep-secure/microsoft-network-server-digitally-sign-communications-always.md index 224f74984a..23d423e6d9 100644 --- a/windows/keep-secure/microsoft-network-server-digitally-sign-communications-always.md +++ b/windows/keep-secure/microsoft-network-server-digitally-sign-communications-always.md @@ -2,104 +2,112 @@ title: Microsoft network server Digitally sign communications (always) (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Microsoft network server Digitally sign communications (always) security policy setting. ms.assetid: 2007b622-7bc2-44e8-9cf1-d34b62117ea8 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Microsoft network server: Digitally sign communications (always) + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **Microsoft network server: Digitally sign communications (always)** security policy setting. + ## Reference -The Server Message Block (SMB) protocol provides the basis for file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with the Server service is permitted. + +The Server Message Block (SMB) protocol provides the basis for file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. +This policy setting determines whether SMB packet signing must be negotiated before further communication with the Server service is permitted. + Implementation of digital signatures in high-security networks helps to prevent the impersonation of client computers and servers, which is known as "session hijacking." But misuse of these policy settings is a common error that can cause data loss or problems with data access or security. + For this policy to take effect on computers running Windows 2000, client-side packet signing must also be enabled. To enable client-side SMB packet signing, set [Microsoft network client: Digitally sign communications (if server agrees)](microsoft-network-client-digitally-sign-communications-if-server-agrees.md). Devices that have this policy set will not be able to communicate with devices that do not have server-side packet signing enabled. By default, server-side packet signing is enabled only on domain controllers. Server-side packet signing can be enabled on devices by setting [Microsoft network server: Digitally sign communications (if client agrees)](microsoft-network-server-digitally-sign-communications-if-client-agrees.md). + If server-side SMB signing is required, a client device will not be able to establish a session with that server, unless it has client-side SMB signing enabled. By default, client-side SMB signing is enabled on workstations, servers, and domain controllers. Similarly, if client-side SMB signing is required, that client device will not be able to establish a session with servers that do not have packet signing enabled. By default, server-side SMB signing is enabled only on domain controllers. + If server-side SMB signing is enabled, SMB packet signing will be negotiated with client devices that have SMB signing enabled. + Using SMB packet signing can impose up to a 15 percent performance degradation on file service transactions. + There are three other policy settings that relate to packet-signing requirements for Server Message Block (SMB) communications: + - [Microsoft network client: Digitally sign communications (always)](microsoft-network-client-digitally-sign-communications-always.md) - [Microsoft network client: Digitally sign communications (if server agrees)](microsoft-network-client-digitally-sign-communications-if-server-agrees.md) - [Microsoft network server: Digitally sign communications (if client agrees)](microsoft-network-server-digitally-sign-communications-if-client-agrees.md) + ### Possible values + - Enabled - Disabled - Not defined + ### Best practices + 1. Configure the following security policy settings as follows: + - Disable [Microsoft network client: Digitally sign communications (always)](microsoft-network-client-digitally-sign-communications-always.md). - Disable **Microsoft network server: Digitally sign communications (always)**. - Enable [Microsoft network client: Digitally sign communications (if server agrees)](microsoft-network-client-digitally-sign-communications-if-server-agrees.md). - Enable [Microsoft network server: Digitally sign communications (if client agrees)](microsoft-network-server-digitally-sign-communications-if-client-agrees.md). + 2. Alternately, you can set all of these policy settings to Enabled, but enabling them can cause slower performance on client devices and prevent them from communicating with legacy SMB applications and operating systems. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Enabled

      Stand-Alone Server Default Settings

      Not defined

      DC Effective Default Settings

      Enabled

      Member Server Effective Default Settings

      Not defined

      Client Computer Effective Default Settings

      Disabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Enabled| +| Stand-Alone Server Default Settings | Not defined| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings| Not defined| +| Client Computer Effective Default Settings | Disabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Session hijacking uses tools that allow attackers who have access to the same network as the client device or server to interrupt, end, or steal a session in progress. Attackers can potentially intercept and modify unsigned Server Message Block (SMB) packets and then modify the traffic and forward it so that the server might perform objectionable actions. Alternatively, the attacker could pose as the server or client device after legitimate authentication and gain unauthorized access to data. + SMB is the resource-sharing protocol that is supported by many Windows operating systems. It is the basis of NetBIOS and many other protocols. SMB signatures authenticate users and the servers that host the data. If either side fails the authentication process, data transmission does not take place. + ### Countermeasure + Configure the settings as follows: + - Disable [Microsoft network client: Digitally sign communications (always)](microsoft-network-client-digitally-sign-communications-always.md). - Disable **Microsoft network server: Digitally sign communications (always)**. - Enable [Microsoft network client: Digitally sign communications (if server agrees)](microsoft-network-client-digitally-sign-communications-if-server-agrees.md). - Enable [Microsoft network server: Digitally sign communications (if client agrees)](microsoft-network-server-digitally-sign-communications-if-client-agrees.md). + In highly secure environments we recommend that you configure all of these settings to Enabled. However, that configuration may cause slower performance on client devices and prevent communications with earlier SMB applications and operating systems. -**Note**   -An alternative countermeasure that could protect all network traffic is to implement digital signatures with IPsec. There are hardware-based accelerators for IPsec encryption and signing that could be used to minimize the performance impact on the servers' CPUs. No such accelerators are available for SMB signing. + +>**Note:**  An alternative countermeasure that could protect all network traffic is to implement digital signatures with IPsec. There are hardware-based accelerators for IPsec encryption and signing that could be used to minimize the performance impact on the servers' CPUs. No such accelerators are available for SMB signing.   ### Potential impact + Implementations of the SMB file and print-sharing protocol support mutual authentication. This prevents session hijacking attacks and supports message authentication to prevent man-in-the-middle attacks. SMB signing provides this authentication by placing a digital signature into each SMB, which is then verified by the client and the server. + Implementation of SMB signing may negatively affect performance because each packet must be signed and verified. If these settings are enabled on a server that is performing multiple roles, such as a small business server that is serving as a domain controller, file server, print server, and application server, performance may be substantially slowed. Additionally, if you configure computers to ignore all unsigned SMB communications, older applications and operating systems cannot connect. However, if you completely disable all SMB signing, devices are vulnerable to session-hijacking attacks. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/microsoft-network-server-digitally-sign-communications-if-client-agrees.md b/windows/keep-secure/microsoft-network-server-digitally-sign-communications-if-client-agrees.md index d63b5a83c1..2f327071cb 100644 --- a/windows/keep-secure/microsoft-network-server-digitally-sign-communications-if-client-agrees.md +++ b/windows/keep-secure/microsoft-network-server-digitally-sign-communications-if-client-agrees.md @@ -2,103 +2,110 @@ title: Microsoft network server Digitally sign communications (if client agrees) (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Microsoft network server Digitally sign communications (if client agrees) security policy setting. ms.assetid: c92b2e3d-1dbf-4337-a145-b17a585f4fc1 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Microsoft network server: Digitally sign communications (if client agrees) + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **Microsoft network server: Digitally sign communications (if client agrees)** security policy setting. + ## Reference -The Server Message Block (SMB) protocol provides the basis for file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with the Server service is permitted. + +The Server Message Block (SMB) protocol provides the basis for file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. +This policy setting determines whether SMB packet signing must be negotiated before further communication with the Server service is permitted. + Implementation of digital signatures in high-security networks helps to prevent the impersonation of client computers and servers, which is known as "session hijacking." But misuse of these policy settings is a common error that can cause data loss or problems with data access or security. + If server-side SMB signing is required, a client device will not be able to establish a session with that server, unless it has client-side SMB signing enabled. By default, client-side SMB signing is enabled on workstations, servers, and domain controllers. Similarly, if client-side SMB signing is required, that client device will not be able to establish a session with servers that do not have packet signing enabled. By default, server-side SMB signing is enabled only on domain controllers. + If server-side SMB signing is enabled, SMB packet signing will be negotiated with client computers that have SMB signing enabled. + Using SMB packet signing can impose up to a 15 percent performance degradation on file service transactions. + There are three other policy settings that relate to packet-signing requirements for Server Message Block (SMB) communications: + - [Microsoft network server: Digitally sign communications (always)](microsoft-network-server-digitally-sign-communications-always.md) - [Microsoft network client: Digitally sign communications (if server agrees)](microsoft-network-client-digitally-sign-communications-if-server-agrees.md) - [Microsoft network client: Digitally sign communications (always)](microsoft-network-client-digitally-sign-communications-always.md) + ### Possible values + - Enabled - Disabled - Not defined + ### Best practices + 1. Configure the following security policy settings as follows: + - Disable [Microsoft network client: Digitally sign communications (always)](microsoft-network-client-digitally-sign-communications-always.md). - Disable [Microsoft network server: Digitally sign communications (always)](microsoft-network-server-digitally-sign-communications-always.md). - Enable [Microsoft network server: Digitally sign communications (always)](microsoft-network-server-digitally-sign-communications-always.md). - Enable **Microsoft Network Server: Digitally Sign Communications (If Client Agrees)**. + 2. Alternately, you can set all of these policy settings to Enabled, but enabling them can cause slower performance on client devices and prevent them from communicating with legacy SMB applications and operating systems. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Enabled

      Stand-Alone Server Default Settings

      Not defined

      DC Effective Default Settings

      Enabled

      Member Server Effective Default Settings

      Not defined

      Client Computer Effective Default Settings

      Disabled

      + +| Server type or GPO Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy| Enabled| +| Stand-Alone Server Default Settings | Not defined| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings|Not defined| +| Client Computer Effective Default Settings | Disabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Session hijacking uses tools that allow attackers who have access to the same network as the client device or server to interrupt, end, or steal a session in progress. Attackers can potentially intercept and modify unsigned Server Message Block (SMB) packets and then modify the traffic and forward it so that the server might perform objectionable actions. Alternatively, the attacker could pose as the server or client computer after legitimate authentication and gain unauthorized access to data. + SMB is the resource-sharing protocol that is supported by many Windows operating systems. It is the basis of NetBIOS and many other protocols. SMB signatures authenticate users and the servers that host the data. If either side fails the authentication process, data transmission does not take place. + ### Countermeasure + Configure the settings as follows: + - Disable [Microsoft network client: Digitally sign communications (always)](microsoft-network-client-digitally-sign-communications-always.md). - Disable [Microsoft network server: Digitally sign communications (always)](microsoft-network-server-digitally-sign-communications-always.md). - Enable [Microsoft network client: Digitally sign communications (if server agrees)](microsoft-network-client-digitally-sign-communications-if-server-agrees.md). - Enable **Microsoft network server: Digitally sign communications (if client agrees)**. + In highly secure environments we recommend that you configure all of these settings to Enabled. However, that configuration may cause slower performance on client devices and prevent communications with earlier SMB applications and operating systems. -**Note**   -An alternative countermeasure that could protect all network traffic is to implement digital signatures with IPsec. There are hardware-based accelerators for IPsec encryption and signing that could be used to minimize the performance impact on the servers' CPUs. No such accelerators are available for SMB signing. + +>**Note:**  An alternative countermeasure that could protect all network traffic is to implement digital signatures with IPsec. There are hardware-based accelerators for IPsec encryption and signing that could be used to minimize the performance impact on the servers' CPUs. No such accelerators are available for SMB signing.   ### Potential impact + SMB file and print-sharing protocol support mutual authentication. This prevents session hijacking attacks and supports message authentication to prevent man-in-the-middle attacks. SMB signing provides this authentication by placing a digital signature into each SMB, which is then verified by the client and the server. + Implementation of SMB signing may negatively affect performance because each packet must be signed and verified. If these settings are enabled on a server that is performing multiple roles, such as a small business server that is serving as a domain controller, file server, print server, and application server, performance may be substantially slowed. Additionally, if you configure computers to ignore all unsigned SMB communications, older applications and operating systems cannot connect. However, if you completely disable all SMB signing, computers are vulnerable to session-hijacking attacks. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md b/windows/keep-secure/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md index 054c5a3be3..b2737896f1 100644 --- a/windows/keep-secure/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md +++ b/windows/keep-secure/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md @@ -2,84 +2,85 @@ title: Microsoft network server Disconnect clients when logon hours expire (Windows 10) description: Describes the best practices, location, values, and security considerations for the Microsoft network server Disconnect clients when logon hours expire security policy setting. ms.assetid: 48b5c424-9ba8-416d-be7d-ccaabb3f49af -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Microsoft network server: Disconnect clients when logon hours expire + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Microsoft network server: Disconnect clients when logon hours expire** security policy setting. + ## Reference + This policy setting enables or disables the forced disconnection of users who are connected to the local device outside their user account's valid logon hours. It affects the SMB component. If you enable this policy setting, client computer sessions with the SMB service are forcibly disconnected when the client's logon hours expire. If you disable this policy setting, established client device sessions are maintained after the client device's logon hours expire. + ### Possible values + - Enabled + Client device sessions with the SMB service are forcibly disconnected when the client device's logon hours expire. If logon hours are not used in your organization, enabling this policy setting will have no impact. + - Disabled + The system maintains an established client device session after the client device's logon hours have expired. + - Not defined + ### Best practices + - If you enable this policy setting, you should also enable [Network security: Force logoff when logon hours expire](network-security-force-logoff-when-logon-hours-expire.md). + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Enabled

      DC Effective Default Settings

      Enabled

      Member Server Effective Default Settings

      Enabled

      Client Computer Effective Default Settings

      Enabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Enabled| +| DC Effective Default Settings| Enabled | +| Member Server Effective Default Settings| Enabled| +| Client Computer Effective Default Settings | Enabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Group Policy + This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local computer by using the Local Security Policy snap-in. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + If your organization configures logon hours for users, it makes sense to enable this policy setting. Otherwise, users who should not have access to network resources outside of their logon hours can continue to use those resources with sessions that were established during allowed hours. + ### Countermeasure + Enable the **Microsoft network server: Disconnect clients when logon hours expire** setting. + ### Potential impact + If logon hours are not used in your organization, this policy setting has no impact. If logon hours are used, existing user sessions are forcibly terminated when their logon hours expire. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/microsoft-network-server-server-spn-target-name-validation-level.md b/windows/keep-secure/microsoft-network-server-server-spn-target-name-validation-level.md index 1cd20cf6fd..b5d71aae14 100644 --- a/windows/keep-secure/microsoft-network-server-server-spn-target-name-validation-level.md +++ b/windows/keep-secure/microsoft-network-server-server-spn-target-name-validation-level.md @@ -2,94 +2,101 @@ title: Microsoft network server Server SPN target name validation level (Windows 10) description: Describes the best practices, location, and values, policy management and security considerations for the Microsoft network server Server SPN target name validation level security policy setting. ms.assetid: 18337f78-eb45-42fd-bdbd-f8cd02c3e154 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Microsoft network server: Server SPN target name validation level + **Applies to** - Windows 10 + Describes the best practices, location, and values, policy management and security considerations for the **Microsoft network server: Server SPN target name validation level** security policy setting. + ## Reference + This policy setting controls the level of validation that a server with shared folders or printers performs on the service principal name (SPN) that is provided by the client device when the client device establishes a session by using the Server Message Block (SMB) protocol. The level of validation can help prevent a class of attacks against SMB services (referred to as SMB relay attacks). This setting affects both SMB1 and SMB2. + Servers that use SMB provide availability to their file systems and other resources, such as printers, to networked client devices. Most servers that use SMB validate user access to resources by using NT Domain authentication (NTLMv1 and NTLMv2) and the Kerberos protocol. + ### Possible values + The options for validation levels are: + - **Off** + The SPN from a SMB client is not required or validated by the SMB server. + - **Accept if provided by client** + The SMB server will accept and validate the SPN provided by the SMB client and allow a session to be established if it matches the SMB server’s list of SPN’s. If the SPN does not match, the session request for that SMB client will be denied. + - **Required from client** + The SMB client must send a SPN name in session setup, and the SPN name provided must match the SMB server that is being requested to establish a connection. If no SPN is provided by the client device, or the SPN provided does not match, the session is denied. + The default setting is Off. + ### Best practices + This setting affects the server SMB behavior, and its implementation should be carefully evaluated and tested to prevent disruptions to file and print serving capabilities. -**Note**   -All Windows operating systems support a client-side SMB component and a server-side SMB component. + +>**Note:**  All Windows operating systems support a client-side SMB component and a server-side SMB component.   ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or Group Policy object (GPO)Default value

      Default domain policy

      Off

      Default domain controller policy

      Off

      Stand-alone server default settings

      Off

      Domain controller effective default settings

      Validation level check not implemented

      Member server effective default settings

      Validation level check not implemented

      Effective GPO default settings on client computers

      Validation level check not implemented

      + +| Server type or Group Policy object (GPO) | Default value | +| - | - | +| Default domain policy | Off | +| Default domain controller policy| Off| +| Stand-alone server default settings | Off| +| Domain controller effective default settings| Validation level check not implemented| +| Member server effective default settings | Validation level check not implemented| +| Effective GPO default settings on client computers | Validation level check not implemented|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Policy conflict considerations + None. + ### Group Policy + This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local computer by using the Local Security Policy snap-in. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + This policy setting controls the level of validation that a server with shared folders or printers performs on the service principal name (SPN) that is provided by the client device when the client device establishes a session by using the SMB protocol. The level of validation can help prevent a class of attacks against SMB servers (referred to as SMB relay attacks). This setting will affect both SMB1 and SMB2. + ### Countermeasure + For countermeasures that are appropriate to your environment, see **Possible values** above. + ### Potential impact + All Windows operating systems support a client-side SMB component and a server-side SMB component. This setting affects the server SMB behavior, and its implementation should be carefully evaluated and tested to prevent disruptions to file and print serving capabilities. + Because the SMB protocol is widely deployed, setting the options to **Accept if provided by client** or **Required from client** will prevent some clients from successfully authenticating to some servers in your environment. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/minimum-password-age.md b/windows/keep-secure/minimum-password-age.md index e132b39e0f..a975b21ff4 100644 --- a/windows/keep-secure/minimum-password-age.md +++ b/windows/keep-secure/minimum-password-age.md @@ -2,81 +2,78 @@ title: Minimum password age (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Minimum password age security policy setting. ms.assetid: 91915cb2-1b3f-4fb7-afa0-d03df95e8161 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Minimum password age + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Minimum password age** security policy setting. + ## Reference + The **Minimum password age** policy setting determines the period of time (in days) that a password can be used before the system requires the user to change it. You can set passwords to expire after a number of days between 1 and 999, or you can specify that passwords never expire by setting the number of days to 0. If [Maximum password age](maximum-password-age.md) is between 1 and 999 days, the minimum password age must be less than the maximum password age. If Maximum password age is set to 0, **Minimum password age** can be any value between 0 and 998 days. + ### Possible values + - User-specified number of days between 0 and 998 - Not defined + ### Best practices + Set **Minimum password age** to a value of 2 days. Setting the number of days to 0 allows immediate password changes, which is not recommended. + If you set a password for a user and you want that user to change the administrator-defined password, you must select the **User must change password at next logon** check box. Otherwise, the user will not be able to change the password until the number of days specified by **Minimum password age**. + ### Location + **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy** + ### Default values + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or Group Policy Object (GPO)Default value

      Default domain policy

      1 day

      Default domain controller policy

      Not defined

      Stand-alone server default settings

      0 days

      Domain controller effective default settings

      1 day

      Member server effective default settings

      1 day

      Effective GPO default settings on client computers

      1 day

      + +| Server type or Group Policy Object (GPO) | Default value | +| - | - | +| Default domain policy| 1 day| +| Default domain controller policy| Not defined| +| Stand-alone server default settings | 0 days| +| Domain controller effective default settings | 1 day| +| Member server effective default settings | 1 day| +| Effective GPO default settings on client computers| 1 day|   ## Policy management + This section describes features, tools, and guidance to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Users may have favorite passwords that they like to use because they are easy to remember and they believe that their password choice is secure from compromise. Unfortunately, passwords can be compromised and if an attacker is targeting a specific individual user account, with knowledge of data about that user, reuse of old passwords can cause a security breach. + To address password reuse, you must use a combination of security settings. Using this policy setting with the [Enforce password history](enforce-password-history.md) policy setting prevents the easy reuse of old passwords. For example, if you configure the Enforce password history policy setting to ensure that users cannot reuse any of their last 12 passwords, but you do not configure the **Minimum password age** policy setting to a number that is greater than 0, users could change their password 13 times in a few minutes and reuse their original password. You must configure this policy setting to a number that is greater than 0 for the Enforce password history policy setting to be effective. + ### Countermeasure + Configure the **Minimum password age** policy setting to a value of at least 2 days. Users should know about this limitation and contact the Help Desk if they need to change their password during that two-day period. If you configure the number of days to 0, immediate password changes would be allowed, which we do not recommend. + ### Potential impact + If you set a password for a user but wants that user to change the password when the user first logs on, the administrator must select the **User must change password at next logon** check box, or the user cannot change the password until the next day. + ## Related topics -[Password Policy](password-policy.md) -  -  + +- [Password Policy](password-policy.md) diff --git a/windows/keep-secure/minimum-password-length.md b/windows/keep-secure/minimum-password-length.md index 30bd818de2..79281f850c 100644 --- a/windows/keep-secure/minimum-password-length.md +++ b/windows/keep-secure/minimum-password-length.md @@ -2,85 +2,82 @@ title: Minimum password length (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Minimum password length security policy setting. ms.assetid: 3d22eb9a-859a-4b6f-82f5-c270c427e17e -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Minimum password length + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Minimum password length** security policy setting. + ## Reference + The **Minimum password length** policy setting determines the least number of characters that can make up a password for a user account. You can set a value of between 1 and 14 characters, or you can establish that no password is required by setting the number of characters to 0. + ### Possible values + - User-specified number of characters between 0 and 14 - Not defined + ### Best practices + Set Minimum password length to at least a value of 8. If the number of characters is set to 0, no password is required. In most environments, an eight-character password is recommended because it is long enough to provide adequate security and still short enough for users to easily remember. This value will help provide adequate defense against a brute force attack. Adding complexity requirements will help reduce the possibility of a dictionary attack. For more info, see [Password must meet complexity requirements](password-must-meet-complexity-requirements.md). + Permitting short passwords reduces security because short passwords can be easily broken with tools that perform dictionary or brute force attacks against the passwords. Requiring very long passwords can result in mistyped passwords that might cause an account lockout and subsequently increase the volume of Help Desk calls. + In addition, requiring extremely long passwords can actually decrease the security of an organization because users might be more likely to write down their passwords to avoid forgetting them. However, if users are taught that they can use passphrases (sentences such as "I want to drink a $5 milkshake"), they should be much more likely to remember. + ### Location + **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy** + ### Default values + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or Group Policy Object (GPO)Default value

      Default domain policy

      7 characters

      Default domain controller policy

      Not defined

      Stand-alone server default settings

      0 characters

      Domain controller effective default settings

      7 characters

      Member server effective default settings

      7 characters

      Effective GPO default settings on client computers

      0 characters

      + +| Server type or Group Policy Object (GPO) | Default value | +| - | - | +| Default domain policy| 7 characters| +| Default domain controller policy | Not defined| +| Stand-alone server default settings | 0 characters| +| Domain controller effective default settings | 7 characters| +| Member server effective default settings | 7 characters| +| Effective GPO default settings on client computers | 0 characters|   ## Policy management + This section describes features, tools, and guidance to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Types of password attacks include dictionary attacks (which attempt to use common words and phrases) and brute force attacks (which try every possible combination of characters). Also, attackers sometimes try to obtain the account database so they can use tools to discover the accounts and passwords. + ### Countermeasure + Configure the **** policy setting to a value of 8 or more. If the number of characters is set to 0, no password will be required. + In most environments, we recommend an eight-character password because it is long enough to provide adequate security, but not too difficult for users to easily remember. This configuration provides adequate defense against a brute force attack. Using the [Password must meet complexity requirements](password-must-meet-complexity-requirements.md) policy setting in addition to the **Minimum password length** setting helps reduce the possibility of a dictionary attack. -**Note**   -Some jurisdictions have established legal requirements for password length as part of establishing security regulations. + +>**Note:**  Some jurisdictions have established legal requirements for password length as part of establishing security regulations.   ### Potential impact + Requirements for extremely long passwords can actually decrease the security of an organization because users might leave the information in an unsecured location or lose it. If very long passwords are required, mistyped passwords could cause account lockouts and increase the volume of Help Desk calls. If your organization has issues with forgotten passwords due to password length requirements, consider teaching your users about passphrases, which are often easier to remember and, due to the larger number of character combinations, much harder to discover. + ## Related topics -[Password Policy](password-policy.md) -  -  + +- [Password Policy](password-policy.md) diff --git a/windows/keep-secure/modify-an-object-label.md b/windows/keep-secure/modify-an-object-label.md index 4f06c8a9e8..a984a42a33 100644 --- a/windows/keep-secure/modify-an-object-label.md +++ b/windows/keep-secure/modify-an-object-label.md @@ -2,96 +2,102 @@ title: Modify an object label (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Modify an object label security policy setting. ms.assetid: 3e5a97dd-d363-43a8-ae80-452e866ebfd5 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Modify an object label + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Modify an object label** security policy setting. + ## Reference + This privilege determines which user accounts can modify the integrity label of objects, such as files, registry keys, or processes owned by other users. Processes running under a user account can modify the label of an object owned by that user to a lower level without this privilege. -The integrity label is used by the Windows Integrity Controls (WIC) feature, which was introduced in Windows Server 2008 and Windows Vista. WIC keeps lower integrity processes from modifying higher integrity processes by assigning one of six possible labels to objects on the system. Although similar to NTFS file and folder permissions, which are discretionary controls on objects, the WIC integrity levels are mandatory controls that are put in place and enforced by the operating system. The following list describes the integrity levels from lowest to highest: + +The integrity label is used by the Windows Integrity Controls (WIC) feature, which was introduced in Windows Server 2008 and Windows Vista. WIC keeps lower integrity processes from modifying higher integrity processes by assigning one of six possible labels to objects on the system. Although +similar to NTFS file and folder permissions, which are discretionary controls on objects, the WIC integrity levels are mandatory controls that are put in place and enforced by the operating system. The following list describes the integrity levels from lowest to highest: + - **Untrusted**   Default assignment for processes that are logged on anonymously. - **Low**   Default assignment for processes that interact with the Internet. - **Medium**   Default assignment for standard user accounts and any object that is not explicitly designated with a lower or higher integrity level. - **High**  Default assignment for administrator accounts and processes that request to run using administrative rights. - **System**   Default assignment for Windows kernel and core services. - **Installer**   Used by setup programs to install software. It is important that only trusted software is installed on computers because objects that are assigned the Installer integrity level can install, modify, and uninstall all other objects. + Constant: SeRelabelPrivilege + ### Possible values + - User-defined list of accounts - Not Defined + ### Best practices + - Do not give any group this user right. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default this setting is Not defined on domain controllers and on stand-alone servers. + The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Not defined

      Domain Controller Effective Default Settings

      Not defined

      Member Server Effective Default Settings

      Not defined

      Client Computer Effective Default Settings

      Not defined

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Not defined| +| Domain Controller Effective Default Settings | Not defined| +| Member Server Effective Default Settings | Not defined| +| Client Computer Effective Default Settings | Not defined|   ## Policy management + This section describes features, tools, and guidance to help you manage this policy. + A restart of the computer is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability -Anyone with the **Modify an object label** user right can change the integrity level of a file or process so that it becomes elevated or decreased to a point where it can be deleted by lower integrity processes. Either of these states effectively circumvents the protection that is offered by Windows Integrity Controls and makes your system vulnerable to attacks by malicious software. + +Anyone with the **Modify an object label** user right can change the integrity level of a file or process so that it becomes elevated or decreased to a point where it can be deleted by lower integrity processes. Either of these states effectively circumvents the protection that is offered by +Windows Integrity Controls and makes your system vulnerable to attacks by malicious software. + If malicious software is set with an elevated integrity level such as Trusted Installer or System, administrator accounts do not have sufficient integrity levels to delete the program from the system. In that case, use of the **Modify an object label** right is mandated so that the object can be re-labeled. However, the re-labeling must occur by using a process that is at the same or a higher level of integrity than the object that you are attempting to re-label. + ### Countermeasure + Do not give any group this right. If necessary, implement it for a constrained period of time to a trusted individual to respond to a specific organizational need. + ### Potential impact + None. Not defined is the default configuration. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/modify-firmware-environment-values.md b/windows/keep-secure/modify-firmware-environment-values.md index 8662f8166e..2dcc1d8dfc 100644 --- a/windows/keep-secure/modify-firmware-environment-values.md +++ b/windows/keep-secure/modify-firmware-environment-values.md @@ -2,94 +2,100 @@ title: Modify firmware environment values (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Modify firmware environment values security policy setting. ms.assetid: 80bad5c4-d9eb-4e3a-a5dc-dcb742b83fca -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Modify firmware environment values + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Modify firmware environment values** security policy setting. + ## Reference + This security setting determines who can modify firmware environment values. Firmware environment values are settings that are stored in the nonvolatile RAM of non-x86-based computers. The effect of the setting depends on the processor. + On x86-based computers, the only firmware environment value that can be modified by assigning this user right is the **Last Known Good Configuration** setting, which should only be modified by the system. + On Itanium-based computers, boot information is stored in nonvolatile RAM. Users must be assigned this user right to run bootcfg.exe and to change the **Default Operating System** setting using the **Startup and Recovery** feature on the **Advanced** tab of **System Properties**. + The exact setting for firmware environment values is determined by the boot firmware. The location of these values is also specified by the firmware. For example, on a UEFI-based system, NVRAM contains firmware environment values that specify system boot settings. + On all computers, this user right is required to install or upgrade Windows. + Constant: SeSystemEnvironmentPrivilege + ### Possible values + - User-defined list of accounts - Administrators - Not Defined + ### Best practices + - Ensure that only the local Administrators group is assigned the **Modify firmware environment values** user right. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default this setting is Administrators on domain controllers and on stand-alone servers. + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Adminstrators

      Stand-Alone Server Default Settings

      Adminstrators

      Domain Controller Effective Default Settings

      Adminstrators

      Member Server Effective Default Settings

      Adminstrators

      Client Computer Effective Default Settings

      Adminstrators

      + +| Server type or GPO |Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Adminstrators| +| Stand-Alone Server Default Settings | Adminstrators| +| Domain Controller Effective Default Settings | Adminstrators| +| Member Server Effective Default Settings | Adminstrators| +| Client Computer Effective Default Settings | Adminstrators|   ## Policy management + This section describes features, tools, and guidance to help you manage this policy. + A restart of the device is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + This security setting does not affect who can modify the system environment values and user environment values that are displayed on the **Advanced** tab of **System Properties**. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Anyone who is assigned the **Modify firmware environment values** user right could configure the settings of a hardware component to cause it to fail, which could lead to data corruption or a denial-of-service condition. + ### Countermeasure + Ensure that only the local Administrators group is assigned the **Modify firmware environment values** user right. + ### Potential impact + None. Restricting the **Modify firmware environment values** user right to the members of the local Administrators group is the default configuration. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/monitor-application-usage-with-applocker.md b/windows/keep-secure/monitor-application-usage-with-applocker.md index 4a0e489d50..14b94f4745 100644 --- a/windows/keep-secure/monitor-application-usage-with-applocker.md +++ b/windows/keep-secure/monitor-application-usage-with-applocker.md @@ -2,51 +2,83 @@ title: Monitor app usage with AppLocker (Windows 10) description: This topic for IT professionals describes how to monitor app usage when AppLocker policies are applied. ms.assetid: 0516da6e-ebe4-45b4-a97b-31daba96d1cf -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Monitor app usage with AppLocker + **Applies to** - Windows 10 + This topic for IT professionals describes how to monitor app usage when AppLocker policies are applied. + Once you set rules and deploy the AppLocker policies, it is good practice to determine if the policy implementation is what you expected. + ### Discover the effect of an AppLocker policy + You can evaluate how the AppLocker policy is currently implemented for documentation or audit purposes, or before you modify the policy. Updating your AppLocker Policy Deployment Planning document will help you track your findings. For information about creating this document, see [Create your AppLocker planning document](create-your-applocker-planning-document.md). You can perform one or more of the following steps to understand what application controls are currently enforced through AppLocker rules. + - **Analyze the AppLocker logs in Event Viewer** + When AppLocker policy enforcement is set to **Enforce rules**, rules are enforced for the rule collection and all events are audited. When AppLocker policy enforcement is set to **Audit only**, rules are not enforced but are still evaluated to generate audit event data that is written to the AppLocker logs. + For the procedure to access the log, see [View the AppLocker Log in Event Viewer](#bkmk-applkr-view-log). + - **Enable the Audit only AppLocker enforcement setting** + By using the **Audit only** enforcement setting, you can ensure that the AppLocker rules are properly configured for your organization. When AppLocker policy enforcement is set to **Audit only**, rules are only evaluated but all events generated from that evaluation are written to the AppLocker log. + For the procedure to do this, see [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md). + - **Review AppLocker events with Get-AppLockerFileInformation** + For both event subscriptions and local events, you can use the **Get-AppLockerFileInformation** Windows PowerShell cmdlet to determine which files have been blocked or would have been blocked (if you are using the audit-only enforcement mode) and how many times the event has occurred for each file. + For the procedure to do this, see [Review AppLocker Events with Get-AppLockerFileInformation](#bkmk-applkr-review-events). + - **Review AppLocker events with Test-AppLockerPolicy** + You can use the **Test-AppLockerPolicy** Windows PowerShell cmdlet to determine whether any of the rules in your rule collections will be blocked on your reference device or the device on which you maintain policies. + For the procedure to do this, see [Test an AppLocker policy by using Test-AppLockerPolicy](test-an-applocker-policy-by-using-test-applockerpolicy.md). + ### Review AppLocker events with Get-AppLockerFileInformation + For both event subscriptions and local events, you can use the **Get-AppLockerFileInformation** Windows PowerShell cmdlet to determine which files have been blocked or would have been blocked (if the **Audit only** enforcement setting is applied) and how many times the event has occurred for each file. + Membership in the local **Administrators** group, or equivalent, is the minimum required to complete this procedure. -**Note**   -If the AppLocker logs are not on your local device, you will need permission to view the logs. If the output is saved to a file, you will need permission to read that file. + +>**Note:**  If the AppLocker logs are not on your local device, you will need permission to view the logs. If the output is saved to a file, you will need permission to read that file.   **To review AppLocker events with Get-AppLockerFileInformation** + 1. At the command prompt, type **PowerShell**, and then press ENTER. 2. Run the following command to review how many times a file would have been blocked from running if rules were enforced: + `Get-AppLockerFileInformation –EventLog –EventType Audited –Statistics` + 3. Run the following command to review how many times a file has been allowed to run or prevented from running: + `Get-AppLockerFileInformation –EventLog –EventType Allowed –Statistics` + ### View the AppLocker Log in Event Viewer + When AppLocker policy enforcement is set to **Enforce rules**, rules are enforced for the rule collection and all events are audited. When AppLocker policy enforcement is set to **Audit only**, rules are only evaluated but all events generated from that evaluation are written to the AppLocker log. + Membership in the local **Administrators** group, or equivalent, is the minimum required to complete this procedure. + **To view events in the AppLocker log by using Event Viewer** + 1. Open Event Viewer. To do this, click **Start**, type **eventvwr.msc**, and then press ENTER. 2. In the console tree under **Application and Services Logs\\Microsoft\\Windows**, double-click **AppLocker**. -AppLocker events are listed in either the **EXE and DLL** log, the **MSI and Script** log, or the **Packaged app-Deployment** or **Packaged app-Execution** log. Event information includes the enforcement setting, file name, date and time, and user name. The logs can be exported to other file formats for further analysis. + +AppLocker events are listed in either the **EXE and DLL** log, the **MSI and Script** log, or the **Packaged app-Deployment** or **Packaged app-Execution** log. Event information includes the enforcement setting, file name, date and time, and user name. The logs can be exported to other file +formats for further analysis. + ## Related topics -[AppLocker](applocker-overview.md) -  -  + +- [AppLocker](applocker-overview.md) diff --git a/windows/keep-secure/monitor-central-access-policy-and-rule-definitions.md b/windows/keep-secure/monitor-central-access-policy-and-rule-definitions.md index 228daa4fa2..11e4efc2be 100644 --- a/windows/keep-secure/monitor-central-access-policy-and-rule-definitions.md +++ b/windows/keep-secure/monitor-central-access-policy-and-rule-definitions.md @@ -2,22 +2,27 @@ title: Monitor central access policy and rule definitions (Windows 10) description: This topic for the IT professional describes how to monitor changes to central access policy and central access rule definitions when you use advanced security auditing options to monitor dynamic access control objects. ms.assetid: 553f98a6-7606-4518-a3c5-347a33105130 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Monitor central access policy and rule definitions + **Applies to** - Windows 10 + This topic for the IT professional describes how to monitor changes to central access policy and central access rule definitions when you use advanced security auditing options to monitor dynamic access control objects. Central access policies and rules determine access permissions for multiple files on multiple file servers. Therefore, it is important to monitor changes to them. Like user claim and device claim definitions, central access policy and rule definitions reside in Active Directory Domain Services (AD DS), and they can be monitored just like any other object in Active Directory. Central access policies and rules are critical elements in a Dynamic Access Control deployment. These policies and rules are stored in AD DS, so they should be less likely to be tampered with than other network objects. However, it is important to monitor these objects for potential changes in security auditing and to verify that policies are being enforced. + Use the following procedures to configure settings to monitor changes to central access policy and central access rule definitions and to verify the changes. These procedures assume that you have configured and deployed Dynamic Access Control, including central access policies, claims, and other components, in your network. If you have not yet deployed Dynamic Access Control in your network, see [Deploy a Central Access Policy (Demonstration Steps)](http://technet.microsoft.com/library/hh846167.aspx). -**Note**   -Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. + +>**Note:**  Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings.   **To configure settings to monitor changes to central access policy and rule definitions** + 1. Sign in to your domain controller by using domain administrator credentials. 2. In Server Manager, point to **Tools**, and then click **Group Policy Management**. 3. In the console tree, right-click the default domain controller Group Policy Object, and then click **Edit**. @@ -28,8 +33,11 @@ Your server might function differently based on the version and edition of the o 8. Under Dynamic Access Control, right-click **Central Access Policies**, and then select **Properties**. 9. Click the **Security** tab, click **Advanced** to open the **Advanced Security Settings** dialog box, and then click the **Auditing** tab. 10. Click **Add**, add a security auditing setting for the container, and then close all Security properties dialog boxes. + After you configure settings to monitor changes to central access policy and central access rule definitions, verify that the changes are being monitored. + **To verify that changes to central access policy and rule definitions are monitored** + 1. Sign in to your domain controller by using domain administrator credentials. 2. Open the Active Directory Administrative Center. 3. Under **Dynamic Access Control**, right-click **Central Access Policies**, and then click **Properties**. @@ -39,7 +47,7 @@ After you configure settings to monitor changes to central access policy and cen 7. Click **OK**, and then close the Active Directory Administrative Center. 8. In Server Manager, click **Tools**, and then click **Event Viewer**. 9. Expand **Windows Logs**, and then click **Security**. Verify that event 4819 appears in the security log. + ### Related resource -[Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md) -  -  + +- [Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md) diff --git a/windows/keep-secure/monitor-claim-types.md b/windows/keep-secure/monitor-claim-types.md index 88650d8745..9220126e6c 100644 --- a/windows/keep-secure/monitor-claim-types.md +++ b/windows/keep-secure/monitor-claim-types.md @@ -2,39 +2,52 @@ title: Monitor claim types (Windows 10) description: This topic for the IT professional describes how to monitor changes to claim types that are associated with dynamic access control when you are using advanced security auditing options. ms.assetid: 426084da-4eef-44af-aeec-e7ab4d4e2439 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Monitor claim types + **Applies to** - Windows 10 + This topic for the IT professional describes how to monitor changes to claim types that are associated with dynamic access control when you are using advanced security auditing options. + Claim types are one of the basic building blocks of Dynamic Access Control. Claim types can include attributes such as the departments in an organization or the levels of security clearance that apply to classes of users. You can use security auditing to track whether claims are added, modified, enabled, disabled, or deleted. -Use the following procedures to configure settings to monitor changes to claim types in AD DS. These procedures assume that you have configured and deployed Dynamic Access Control, including central access policies, claims, and other components, in your network. If you have not yet deployed Dynamic Access Control in your network, see [Deploy a Central Access Policy (Demonstration Steps)](http://technet.microsoft.com/library/hh846167.aspx). -**Note**   -Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. + +Use the following procedures to configure settings to monitor changes to claim types in AD DS. These procedures assume that you have configured and deployed Dynamic Access Control, including central access policies, claims, and other components, in your network. If you have not yet deployed Dynamic +Access Control in your network, see [Deploy a Central Access Policy (Demonstration Steps)](http://technet.microsoft.com/library/hh846167.aspx). + +>**Note:**  Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings.   **To configure settings to monitor changes to claim types** + 1. Sign in to your domain controller by using domain administrator credential. 2. In Server Manager, point to **Tools**, and then click **Group Policy Management**. 3. In the console tree, right-click the default domain controller Group Policy Object, and then click **Edit**. 4. Double-click **Computer Configuration**, click **Security Settings**, expand **Advanced Audit Policy Configuration**, expand **System Audit Policies**, click **DS Access**, and then double-click **Audit directory service changes**. 5. Select the **Configure the following audit events** check box, select the **Success** check box (andthe **Failure** check box, if desired), and then click **OK**. + After you configure settings to monitor changes to claim types in AD DS, verify that the changes are being monitored. + **To verify that changes to claim types are monitored** + 1. Sign in to your domain controller by using domain administrator credentials. 2. Open the Active Directory Administrative Center. 3. Under **Dynamic Access Control**, right-click **Claim Types**, and then click **Properties**. 4. Click the **Security** tab, click **Advanced** to open the **Advanced Security Settings** dialog box, and then click the **Auditing** tab. 5. Click **Add**, add a security auditing setting for the container, and then close all the Security properties dialog boxes. 6. In the **Claim Types** container, add a new claim type or select an existing claim type. In the **Tasks** pane, click **Properties**, and then change one or more attributes. + Click **OK**, and then close the Active Directory Administrative Center. + 7. Open Event Viewer on this domain controller, expand **Windows Logs**, and select the **Security** log. + Look for event 5137. Key information to look for includes the name of the new attribute that was added, the type of claim that was created, and the user who created the claim. + ### Related resource -[Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md) -  -  + +- [Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md) diff --git a/windows/keep-secure/monitor-resource-attribute-definitions.md b/windows/keep-secure/monitor-resource-attribute-definitions.md index 71c872ac0f..42bd9b783e 100644 --- a/windows/keep-secure/monitor-resource-attribute-definitions.md +++ b/windows/keep-secure/monitor-resource-attribute-definitions.md @@ -2,23 +2,29 @@ title: Monitor resource attribute definitions (Windows 10) description: This topic for the IT professional describes how to monitor changes to resource attribute definitions when you are using advanced security auditing options to monitor dynamic access control objects. ms.assetid: aace34b0-123a-4b83-9e09-f269220e79de -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Monitor resource attribute definitions + **Applies to** - Windows 10 + This topic for the IT professional describes how to monitor changes to resource attribute definitions when you are using advanced security auditing options to monitor dynamic access control objects. Resource attribute definitions define the basic properties of resource attributes, such as what it means for a resource to be defined as “high business value.” Resource attribute definitions are stored in AD DS under the Resource Properties container. Changes to these definitions could significantly change the protections that govern a resource, even if the resource attributes that apply to the resource remain unchanged. Changes can be monitored like any other AD DS object. + For information about monitoring changes to the resource attributes that apply to files, see [Monitor the resource attributes on files and folders](monitor-the-resource-attributes-on-files-and-folders.md). + Use the following procedures to configure settings to monitor changes to resource attribute definitions in AD DS and to verify the changes. These procedures assume that you have configured and deployed Dynamic Access Control, including central access policies, claims, and other components, in your network. If you have not yet deployed Dynamic Access Control in your network, see [Deploy a Central Access Policy (Demonstration Steps)](http://technet.microsoft.com/library/hh846167.aspx). -**Note**   -Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. + +>**Note:**  Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings.   **To configure settings to monitor changes to resource attributes** + 1. Sign in to your domain controller by using domain administrator credentials. 2. In Server Manager, point to **Tools**, and then click **Group Policy Management**. 3. In the console tree, right-click the Group Policy Object for the default domain controller, and then click **Edit**. @@ -29,8 +35,11 @@ Your server might function differently based on the version and edition of the o 8. Under **Dynamic Access Control**, right-click **Resource Properties**, and then click **Properties**. 9. Click the **Security** tab, click **Advanced** to open the **Advanced Security Settings** dialog box, and then click the **Auditing** tab. 10. Click **Add**, add a security auditing setting for the container, and then close all Security properties dialog boxes. + After you configure settings to monitor changes to resource attributes in AD DS, verify that the changes are being monitored. + **To verify that changes to resource definitions are monitored** + 1. Sign in to your domain controller by using domain administrator credentials. 2. Open the Active Directory Administrative Center. 3. Under **Dynamic Access Control**, click **Resource Properties**, and then double-click a resource attribute. @@ -38,7 +47,7 @@ After you configure settings to monitor changes to resource attributes in AD DS 5. Click **OK**, and then close the Active Directory Administrative Center. 6. In Server Manager, click **Tools**, and then click **Event Viewer**. 7. Expand **Windows Logs**, and then click **Security**. Verify that event 5137 appears in the security log. + ### Related resource -[Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md) -  -  + +- [Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md) diff --git a/windows/keep-secure/monitor-the-central-access-policies-associated-with-files-and-folders.md b/windows/keep-secure/monitor-the-central-access-policies-associated-with-files-and-folders.md index 3aff0a5708..db6155e24b 100644 --- a/windows/keep-secure/monitor-the-central-access-policies-associated-with-files-and-folders.md +++ b/windows/keep-secure/monitor-the-central-access-policies-associated-with-files-and-folders.md @@ -2,53 +2,67 @@ title: Monitor the central access policies associated with files and folders (Windows 10) description: This topic for the IT professional describes how to monitor changes to the central access policies that are associated with files and folders when you are using advanced security auditing options to monitor dynamic access control objects. ms.assetid: 2ea8fc23-b3ac-432f-87b0-6a16506e8eed -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Monitor the central access policies associated with files and folders + **Applies to** - Windows 10 + This topic for the IT professional describes how to monitor changes to the central access policies that are associated with files and folders when you are using advanced security auditing options to monitor dynamic access control objects. + This security audit policy and the event that it records are generated when the central access policy that is associated with a file or folder is changed. This security audit policy is useful when an administrator wants to monitor potential changes on some, but not all, files and folders on a file server. + For info about monitoring potential central access policy changes for an entire file server, see [Monitor the central access policies that apply on a file server](monitor-the-central-access-policies-that-apply-on-a-file-server.md). + Use the following procedures to configure settings to monitor central access policies that are associated with files. These procedures assume that you have configured and deployed Dynamic Access Control in your network. For more information about how to configure and deploy Dynamic Access Control, see [Dynamic Access Control: Scenario Overview](http://technet.microsoft.com/library/hh831717.aspx). -**Note**   -Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. + +>**Note:**  Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings.   **To configure settings to monitor central access policies associated with files or folders** + 1. Sign in to your domain controller by using domain administrator credentials. 2. In Server Manager, point to **Tools**, and then click **Group Policy Management**. 3. In the console tree, right-click the flexible access Group Policy Object, and then click **Edit**. 4. Double-click **Computer Configuration**, double-click **Security Settings**, double-click **Advanced Audit Policy Configuration**, double-click **Policy Change**, and then double-click **Audit Authorization Policy Change**. 5. Select the **Configure the following audit events** check box, select the **Success** check box (and the **Failure** check box, if desired), and then click **OK**. 6. Enable auditing for a file or folder as described in the following procedure. + **To enable auditing for a file or folder** + 1. Sign in as a member of the local administrators group on the computer that contains the files or folders that you want to audit. 2. Right-click the file or folder, click **Properties**, and then click the **Security** tab. 3. Click **Advanced**, click the **Auditing** tab, and then click **Continue**. + If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. + 4. Click **Add**, click **Select a principal**, type a user name or group name in the format **contoso\\user1**, and then click **OK**. 5. In the **Auditing Entry for** dialog box, select the permissions that you want to audit, such as **Full Control** or **Delete**. 6. Click **OK** four times to complete the configuration of the object SACL. 7. Open a File Explorer window and select or create a file or folder to audit. 8. Open an elevated command prompt, and run the following command: - **gpupdate /force** + + `gpupdate /force` + After you configure settings to monitor changes to the central access policies that are associated with files and folders, verify that the changes are being monitored. + **To verify that changes to central access policies associated with files and folders are monitored** + 1. Sign in as a member of the local administrators group on the computer that contains the files or folders that you want to audit. 2. Open a File Explorer window and select the file or folder that you configured for auditing in the previous procedure. 3. Right-click the file or folder, click **Properties**, click the **Security** tab, and then click **Advanced**. 4. Click the **Central Policy** tab, click **Change**, and select a different central access policy (if one is available) or select **No Central Access Policy**, and then click **OK** twice. - **Note**   - You must select a setting that is different than your original setting to generate the audit event. + >**Note:**  You must select a setting that is different than your original setting to generate the audit event.   5. In Server Manager, click **Tools**, and then click **Event Viewer**. 6. Expand **Windows Logs**, and then click **Security**. 7. Look for event 4913, which is generated when the central access policy that is associated with a file or folder is changed. This event includes the security identifiers (SIDs) of the old and new central access policies. + ### Related resource -[Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md) -  -  + +- [Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md) diff --git a/windows/keep-secure/monitor-the-central-access-policies-that-apply-on-a-file-server.md b/windows/keep-secure/monitor-the-central-access-policies-that-apply-on-a-file-server.md index 54838b32b6..aeee1c4b35 100644 --- a/windows/keep-secure/monitor-the-central-access-policies-that-apply-on-a-file-server.md +++ b/windows/keep-secure/monitor-the-central-access-policies-that-apply-on-a-file-server.md @@ -2,28 +2,37 @@ title: Monitor the central access policies that apply on a file server (Windows 10) description: This topic for the IT professional describes how to monitor changes to the central access policies that apply to a file server when using advanced security auditing options to monitor dynamic access control objects. ms.assetid: 126b051e-c20d-41f1-b42f-6cff24dcf20c -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Monitor the central access policies that apply on a file server + **Applies to** - Windows 10 + This topic for the IT professional describes how to monitor changes to the central access policies that apply to a file server when using advanced security auditing options to monitor dynamic access control objects. Central access policies are created on a domain controller and then applied to file servers through Group Policy management. + Use the following procedures to configure and verify security auditing settings that are used to monitor changes to the set of central access policies on a file server. The following procedures assume that you have configured and deployed dynamic access control, including central access policies, and claims in your network. If you have not yet deployed dynamic access control in your network, see [Deploy a Central Access Policy (Demonstration Steps)](http://technet.microsoft.com/library/hh846167.aspx). + **To configure settings to monitor changes to central access policies** + 1. Sign in to your domain controller by using domain administrator credentials. 2. In Server Manager, point to **Tools**, and then click **Group Policy Management**. 3. In the console tree, right-click the flexible access Group Policy Object, and then click **Edit**. 4. Double-click **Computer Configuration**, double-click **Security Settings**, double-click **Advanced Audit Policy Configuration**, double-click **Policy Change**, and then double-click **Other Policy Change Events**. - **Note**   - This policy setting monitors policy changes that might not be captured otherwise, such as central access policy changes or trusted platform module configuration changes. + + >**Note:**  This policy setting monitors policy changes that might not be captured otherwise, such as central access policy changes or trusted platform module configuration changes.   5. Select the **Configure the following audit events** check box, select the **Success** check box (and the **Failure** check box, if desired), and then click **OK**. + After you modify the central access policies on the domain controller, verify that the changes have been applied to the file server and that the proper events are logged. + **To verify changes to the central access policies** + 1. Sign in to your domain controller by using domain administrator credentials. 2. Open the Group Policy Management Console. 3. Right-click **Default domain policy**, and then click **Edit**. @@ -32,13 +41,13 @@ After you modify the central access policies on the domain controller, verify th 6. In the wizard that appears, follow the instructions to add a new central access policy (CAP), and then click **OK**. 7. Use local administrator credentials to sign in to the server that hosts resources that are subject to the central access policies you changed. 8. Press the Windows key + R, then type **cmd** to open a Command Prompt window. - **Note**   - If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. + + >**Note:**  If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click **Yes**.   9. Type **gpupdate /force**, and press ENTER. 10. In Server Manager, click **Tools**, and then click **Event Viewer**. 11. Expand **Windows Logs**, and then click **Security**. Verify that event 4819 appears in the security log. + ## Related resource -[Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md) -  -  + +- [Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md) diff --git a/windows/keep-secure/monitor-the-resource-attributes-on-files-and-folders.md b/windows/keep-secure/monitor-the-resource-attributes-on-files-and-folders.md index 8c4c23bf12..fd2edb8b75 100644 --- a/windows/keep-secure/monitor-the-resource-attributes-on-files-and-folders.md +++ b/windows/keep-secure/monitor-the-resource-attributes-on-files-and-folders.md @@ -2,42 +2,54 @@ title: Monitor the resource attributes on files and folders (Windows 10) description: This topic for the IT professional describes how to monitor attempts to change settings to the resource attributes on files when you are using advanced security auditing options to monitor dynamic access control objects. ms.assetid: 4944097b-320f-44c7-88ed-bf55946a358b -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Monitor the resource attributes on files and folders + **Applies to** - Windows 10 + This topic for the IT professional describes how to monitor attempts to change settings to the resource attributes on files when you are using advanced security auditing options to monitor dynamic access control objects. + If your organization has a carefully thought out authorization configuration for resources, changes to these resource attributes can create potential security risks. Examples include: + - Changing files that have been marked as high business value to low business value. - Changing the Retention attribute of files that have been marked for retention. - Changing the Department attribute of files that are marked as belonging to a particular department. + Use the following procedures to configure settings to monitor changes to resource attributes on files and folders. These procedures assume that have configured and deployed central access policies in your network. For more information about how to configure and deploy central access policies, see [Dynamic Access Control: Scenario Overview](http://technet.microsoft.com/library/hh831717.aspx) . -**Note**   -Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. + +>**Note:**  Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings.   **To monitor changes to resource attributes on files** + 1. Sign in to your domain controller by using domain administrator credentials. 2. In Server Manager, point to **Tools**, and then click **Group Policy Management**. 3. In the console tree, right-click the flexible access Group Policy Object, and then click **Edit**. 4. Double-click **Computer Configuration**, double-click **Security Settings**, double-click **Advanced Audit Policy Configuration**, double-click **Policy Change**, and then double-click **Audit Authorization Policy Change**. 5. Select the **Configure the following audit events** check box, select the **Success** and **Failure** check boxes, and then click **OK**. + After you configure settings to monitor resource attributes on files, verify that the changes are being monitored. + **To verify that changes to resource attributes on files are monitored** + 1. Use administrator credentials to sign in to the server that hosts the resource you want to monitor. 2. From an elevated command prompt, type **gpupdate /force**, and then press ENTER. 3. Attempt to change resource properties on one or more files and folders. 4. In Server Manager, click **Tools**, and then click **Event Viewer**. 5. Expand **Windows Logs**, and then click **Security**. 6. Depending on which resource attributes you attempted to change, you should look for the following events: + - Event 4911, which tracks changes to file attributes - Event 4913, which tracks changes to central access policies + Key information to look for includes the name and account domain of the principal attempting to change the resource attribute, the object that the principal is attempting to modify, and information about the changes that are being attempted. + ### Related resource -[Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md) -  -  + +- [Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md) diff --git a/windows/keep-secure/monitor-the-use-of-removable-storage-devices.md b/windows/keep-secure/monitor-the-use-of-removable-storage-devices.md index b465dfccb6..c850719ed9 100644 --- a/windows/keep-secure/monitor-the-use-of-removable-storage-devices.md +++ b/windows/keep-secure/monitor-the-use-of-removable-storage-devices.md @@ -2,22 +2,28 @@ title: Monitor the use of removable storage devices (Windows 10) description: This topic for the IT professional describes how to monitor attempts to use removable storage devices to access network resources. It describes how to use advanced security auditing options to monitor dynamic access control objects. ms.assetid: b0a9e4a5-b7ff-41c6-96ff-0228d4ba5da8 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Monitor the use of removable storage devices + **Applies to** - Windows 10 + This topic for the IT professional describes how to monitor attempts to use removable storage devices to access network resources. It describes how to use advanced security auditing options to monitor dynamic access control objects. + If you configure this policy setting, an audit event is generated each time a user attempts to copy, move, or save a resource to a removable storage device. + Use the following procedures to monitor the use of removable storage devices and to verify that the devices are being monitored. -**Note**   -Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. + +>**Note:**  Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings.   **To configure settings to monitor removable storage devices** + 1. Sign in to your domain controller by using domain administrator credentials. 2. In Server Manager, point to **Tools**, and then click **Group Policy Management**. 3. In the console tree, right-click the flexible access Group Policy Object on the domain controller, and then click **Edit**. @@ -25,22 +31,25 @@ Your server might function differently based on the version and edition of the o 5. Select the **Configure the following audit events** check box, select the **Success** check box (and the **Failure** check box, if desired), and then click **OK**. 6. If you selected the **Failure** check box, double-click **Audit Handle Manipulation**, select the **Configure the following audit events check box**, and then select **Failure**. 7. Click **OK**, and then close the Group Policy Management Editor. + After you configure the settings to monitor removable storage devices, use the following procedure to verify that the settings are active. + **To verify that removable storage devices are monitored** + 1. Sign in to the computer that hosts the resources that you want to monitor. Press the Windows key + R, and then type **cmd** to open a Command Prompt window. - **Note**   - If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. + + >**Note:**  If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click **Yes**.   2. Type **gpupdate /force**, and press ENTER. 3. Connect a removable storage device to the targeted computer and attempt to copy a file that is protected with the Removable Storage Audit policy. 4. In Server Manager, click **Tools**, and then click **Event Viewer**. 5. Expand **Windows Logs**, and then click **Security**. 6. Look for event 4663, which logs successful attempts to write to or read from a removable storage device. Failures will log event 4656. Both events include **Task Category = Removable Storage device**. + Key information to look for includes the name and account domain of the user who attempted to access the file, the object that the user is attempting to access, resource attributes of the resource, and the type of access that was attempted. - **Note**   - We do not recommend that you enable this category on a file server that hosts file shares on a removable storage device. When Removable Storage Auditing is configured, any attempt to access the removable storage device will generate an audit event. + + >**Note:**  We do not recommend that you enable this category on a file server that hosts file shares on a removable storage device. When Removable Storage Auditing is configured, any attempt to access the removable storage device will generate an audit event.   ### Related resource -[Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md) -  -  + +- [Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md) diff --git a/windows/keep-secure/monitor-user-and-device-claims-during-sign-in.md b/windows/keep-secure/monitor-user-and-device-claims-during-sign-in.md index 43db7d7f40..8e767cf028 100644 --- a/windows/keep-secure/monitor-user-and-device-claims-during-sign-in.md +++ b/windows/keep-secure/monitor-user-and-device-claims-during-sign-in.md @@ -2,36 +2,48 @@ title: Monitor user and device claims during sign-in (Windows 10) description: This topic for the IT professional describes how to monitor user and device claims that are associated with a user’s security token when you are using advanced security auditing options to monitor dynamic access control objects. ms.assetid: 71796ea9-5fe4-4183-8475-805c3c1f319f -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft + --- + # Monitor user and device claims during sign-in + **Applies to** - Windows 10 + This topic for the IT professional describes how to monitor user and device claims that are associated with a user’s security token when you are using advanced security auditing options to monitor dynamic access control objects. + Device claims are associated with the system that is used to access resources that are protected with Dynamic Access Control. User claims are attributes that are associated with a user. User claims and device claims are included in the user’s security token used at sign-on. For example, information about Department, Company, Project, or Security clearances might be included in the token. + Use the following procedures to monitor changes to user claims and device claims in the user’s sign-on token and to verify the changes. These procedures assume that you have configured and deployed Dynamic Access Control, including central access policies, claims, and other components, in your network. If you have not yet deployed Dynamic Access Control in your network, see [Deploy a Central Access Policy (Demonstration Steps)](http://technet.microsoft.com/library/hh846167.aspx). -**Note**   -Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. + +>**Note:**  Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings.   **To monitor user and device claims in user logon token** + 1. Sign in to your domain controller by using domain administrator credentials. 2. In Server Manager, point to **Tools**, and then click **Group Policy Management**. 3. In the console tree, right-click the flexible access Group Policy Object, and then click **Edit**. 4. Double-click **Computer Configuration**, click **Security Settings**, expand **Advanced Audit Policy Configuration**, expand **System Audit Policies**, click **Logon/Logoff**, and then double-click **Audit User/Device claims**. 5. Select the **Configure the following audit events** check box, select the **Success** check box (and the **Failure** check box, if desired), and then click **OK**. 6. Close the Group Policy Management Editor. + After you configure settings to monitor user and device claims, verify that the changes are being monitored. + **To verify that user and device claims in user logon token are monitored** + 1. With local administrator credentials, sign in to a file server that is subject to the flexible access Group Policy Object. 2. Open an elevated command prompt, and run the following command: - **gpupdate force** + + `gpupdate force` + 3. From a client computer, connect to a file share on the file server as a user who has access permissions to the file server. 4. On the file server, open Event Viewer, expand **Windows Logs**, and select the **Security** log. Look for event 4626, and confirm that it contains information about user claims and device claims. + ### Related resource -[Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md) -  -  + +- [Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md) From 07bf40944a154f3003ae44b85ea10ff0deb5ffda Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Tue, 24 May 2016 16:37:12 -0700 Subject: [PATCH 407/439] fixing spacing issues --- ...ess-allow-anonymous-sidname-translation.md | 90 +++++------ ...-enumeration-of-sam-accounts-and-shares.md | 85 +++++------ ...w-anonymous-enumeration-of-sam-accounts.md | 87 +++++------ ...-credentials-for-network-authentication.md | 92 ++++++------ ...ne-permissions-apply-to-anonymous-users.md | 84 +++++------ ...-pipes-that-can-be-accessed-anonymously.md | 138 +++++++---------- ...-accessible-registry-paths-and-subpaths.md | 89 ++++++----- ...cess-remotely-accessible-registry-paths.md | 86 ++++++----- ...nymous-access-to-named-pipes-and-shares.md | 83 +++++------ ...shares-that-can-be-accessed-anonymously.md | 79 +++++----- ...g-and-security-model-for-local-accounts.md | 85 +++++------ .../network-list-manager-policies.md | 33 +++- ...ystem-to-use-computer-identity-for-ntlm.md | 118 ++++++--------- ...allow-localsystem-null-session-fallback.md | 85 +++++------ ...-this-computer-to-use-online-identities.md | 84 +++++------ ...e-encryption-types-allowed-for-kerberos.md | 133 ++++++----------- ...ager-hash-value-on-next-password-change.md | 80 +++++----- ...ty-force-logoff-when-logon-hours-expire.md | 84 +++++------ ...curity-lan-manager-authentication-level.md | 141 +++++++----------- ...curity-ldap-client-signing-requirements.md | 83 +++++------ ...-ssp-based-including-secure-rpc-clients.md | 84 +++++------ ...-ssp-based-including-secure-rpc-servers.md | 82 +++++----- ...rver-exceptions-for-ntlm-authentication.md | 98 ++++++------ ...lm-add-server-exceptions-in-this-domain.md | 100 +++++++------ ...strict-ntlm-audit-incoming-ntlm-traffic.md | 97 ++++++------ ...udit-ntlm-authentication-in-this-domain.md | 95 ++++++------ ...ity-restrict-ntlm-incoming-ntlm-traffic.md | 95 ++++++------ ...ntlm-ntlm-authentication-in-this-domain.md | 99 ++++++------ ...outgoing-ntlm-traffic-to-remote-servers.md | 97 ++++++------ 29 files changed, 1312 insertions(+), 1374 deletions(-) diff --git a/windows/keep-secure/network-access-allow-anonymous-sidname-translation.md b/windows/keep-secure/network-access-allow-anonymous-sidname-translation.md index ce3d50eac0..6c14b5a06f 100644 --- a/windows/keep-secure/network-access-allow-anonymous-sidname-translation.md +++ b/windows/keep-secure/network-access-allow-anonymous-sidname-translation.md @@ -2,90 +2,96 @@ title: Network access Allow anonymous SID/Name translation (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network access Allow anonymous SID/Name translation security policy setting. ms.assetid: 0144477f-22a6-4d06-b70a-9c9c2196e99e -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Network access: Allow anonymous SID/Name translation + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **Network access: Allow anonymous SID/Name translation** security policy setting. + ## Reference + This policy setting enables or disables the ability of an anonymous user to request security identifier (SID) attributes for another user. + If this policy setting is enabled, a user might use the well-known Administrators SID to get the real name of the built-in Administrator account, even if the account has been renamed. That person might then use the account name to initiate a brute-force password-guessing attack. + Misuse of this policy setting is a common error that can cause data loss or problems with data access or security. + ### Possible values + - Enabled + An anonymous user can request the SID attribute for another user. An anonymous user with knowledge of an administrator's SID could contact a computer that has this policy enabled and use the SID to get the administrator's name. This setting affects the SID-to-name translation as well as the name-to-SID translation + - Disabled + Prevents an anonymous user from requesting the SID attribute for another user. + - Not defined + ### Best practices + - Set this policy to Disabled. This is the default value on member computers; therefore, it will have no impact on them. The default value for domain controllers is Enabled. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Note defined

      Stand-Alone Server Default Settings

      Disabled

      DC Effective Default Settings

      Enabled

      Member Server Effective Default Settings

      Disabled

      Client Computer Effective Default Settings

      Disabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Note defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings| Disabled| +| Client Computer Effective Default Settings | Disabled|   ### Operating system version differences + The default value of this setting has changed between operating systems as follows: + - The default on domain controllers running Windows Server 2003 R2 or earlier was set to Enabled. - The default on domain controllers running Windows Server 2008 and later is set to Disabled. + ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Group Policy + Modifying this setting may affect compatibility with client computers, services, and applications. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + If this policy setting is enabled, a user with local access could use the well-known Administrator's SID to learn the real name of the built-in Administrator account, even if it has been renamed. That person could then use the account name to initiate a password-guessing attack. + ### Countermeasure + Disable the **Network access: Allow anonymous SID/Name translation** setting. + ### Potential impact + Disabled is the default configuration for this policy setting on member devices; therefore, it has no impact on them. The default configuration for domain controllers is Enabled. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md b/windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md index 95f97f704f..52eb452b76 100644 --- a/windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md +++ b/windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md @@ -2,85 +2,86 @@ title: Network access Do not allow anonymous enumeration of SAM accounts and shares (Windows 10) description: Describes the best practices, location, values, and security considerations for the Network access Do not allow anonymous enumeration of SAM accounts and shares security policy setting. ms.assetid: 3686788d-4cc7-4222-9163-cbc7c3362d73 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Network access: Do not allow anonymous enumeration of SAM accounts and shares + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Network access: Do not allow anonymous enumeration of SAM accounts and shares** security policy setting. + ## Reference + This policy setting determines which additional permissions will be assigned for anonymous connections to the device. Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares. This is convenient, for example, when an administrator wants to give access to users in a trusted domain that does not maintain a reciprocal trust. However, even with this policy setting enabled, anonymous users will have access to resources with permissions that explicitly include the built-in group, ANONYMOUS LOGON. + This policy setting has no impact on domain controllers. Misuse of this policy setting is a common error that can cause data loss or problems with data access or security. + ### Possible values + - Enabled + - Disabled + No additional permissions can be assigned by the administrator for anonymous connections to the device. Anonymous connections will rely on default permissions. However, an unauthorized user could anonymously list account names and use the information to attempt to guess passwords or perform social-engineering attacks. + - Not defined + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Disabled

      DC Effective Default Settings

      Disabled

      Member Server Effective Default Settings

      Disabled

      Client Computer Effective Default Settings

      Disabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Policy conflicts + Even with this policy setting enabled, anonymous users will have access to resources with permissions that explicitly include the built-in group, ANONYMOUS LOGON (on systems earlier than Windows Server 2008 and Windows Vista). + ### Group Policy + This policy has no impact on domain controllers. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + An unauthorized user could anonymously list account names and shared resources and use the information to attempt to guess passwords or perform social-engineering attacks. + ### Countermeasure + Enable the **Network access: Do not allow anonymous enumeration of SAM accounts and shares** setting. + ### Potential impact + It is impossible to grant access to users of another domain across a one-way trust because administrators in the trusting domain are unable to enumerate lists of accounts in the other domain. Users who access file and print servers anonymously are unable to list the shared network resources on those servers; the users must be authenticated before they can view the lists of shared folders and printers. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md b/windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md index 2324359e3a..20f6455173 100644 --- a/windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md +++ b/windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md @@ -2,85 +2,88 @@ title: Network access Do not allow anonymous enumeration of SAM accounts (Windows 10) description: Describes the best practices, location, values, and security considerations for the Network access Do not allow anonymous enumeration of SAM accounts security policy setting. ms.assetid: 6ee25b33-ad43-4097-b031-7be680f64c7c -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft + --- + # Network access: Do not allow anonymous enumeration of SAM accounts + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Network access: Do not allow anonymous enumeration of SAM accounts** security policy setting. + ## Reference + This policy setting determines which additional permissions will be assigned for anonymous connections to the device. Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares. This is convenient, for example, when an administrator wants to give access to users in a trusted domain that does not maintain a reciprocal trust. + This policy setting has no impact on domain controllers. + Misuse of this policy setting is a common error that can cause data loss or problems with data access or security. + ### Possible values + - Enabled + - Disabled + No additional permissions can be assigned by the administrator for anonymous connections to the device. Anonymous connections will rely on default permissions. + - Not defined + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Enabled

      DC Effective Default Settings

      Enabled

      Member Server Effective Default Settings

      Enabled

      Client Computer Effective Default Settings

      Enabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Enabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings| Enabled| +| Client Computer Effective Default Settings | Enabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Policy conflicts + Even with this policy setting enabled, anonymous users will have access to resources with permissions that explicitly include the built-in group, ANONYMOUS LOGON (on systems earlier than Windows Server 2008 and Windows Vista). + ### Group Policy + This policy has no impact on domain controllers. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + An unauthorized user could anonymously list account names and use the information to perform social engineering attacks or attempt to guess passwords. Social engineering attackers try to deceive users in some way to obtain passwords or some form of security information. + ### Countermeasure + Enable the **Network access: Do not allow anonymous enumeration of SAM accounts** setting. + ### Potential impact + It is impossible to grant access to users of another domain across a one-way trust because administrators in the trusting domain are unable to enumerate lists of accounts in the other domain. Users who access file and print servers anonymously are unable to list the shared network resources on those servers; the users must be authenticated before they can view the lists of shared folders and printers. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md b/windows/keep-secure/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md index 16fa1842da..ec12a8c647 100644 --- a/windows/keep-secure/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md +++ b/windows/keep-secure/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md @@ -2,91 +2,95 @@ title: Network access Do not allow storage of passwords and credentials for network authentication (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network access Do not allow storage of passwords and credentials for network authentication security policy setting. ms.assetid: b9b64360-36ea-40fa-b795-2d6558c46563 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Network access: Do not allow storage of passwords and credentials for network authentication + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **Network access: Do not allow storage of passwords and credentials for network authentication** security policy setting. + ## Reference + This security setting determines whether Credential Manager saves passwords and credentials for later use when it gains domain authentication. + ### Possible values + - Enabled + Credential Manager does not store passwords and credentials on the device + - Disabled + Credential Manager will store passwords and credentials on this computer for later use for domain authentication. + - Not defined + ### Best practices + It is a recommended practice to disable the ability of the Windows operating system to cache credentials on any device where credentials are not needed. Evaluate your servers and workstations to determine the requirements. Cached credentials are designed primarily to be used on laptops that require domain credentials when disconnected from the domain. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or Group Policy Object (GPO)Default value

      Default domain policy

      Disabled

      Default domain controller policy

      Disabled

      Stand-alone server default settings

      Disabled

      Domain controller effective default settings

      Not defined

      Member server effective default settings

      Not defined

      Effective GPO default settings on client computers

      Not defined

      + +| Server type or Group Policy Object (GPO) | Default value | +| - | - | +| Default domain policy| Disabled| +| Default domain controller policy| Disabled| +| Stand-alone server default settings | Disabled| +| Domain controller effective default settings| Not defined| +| Member server effective default settings | Not defined| +| Effective GPO default settings on client computers | Not defined|   ### Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + A restart of the device is required before this policy will be effective when changes to this policy are saved locally or distributed through Group Policy. + ### Group Policy + This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local computer by using the Local Security Policy snap-in. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Passwords that are cached can be accessed by the user when logged on to the device. Although this information may sound obvious, a problem can arise if the user unknowingly runs malicious software that reads the passwords and forwards them to another, unauthorized user. -**Note**   -The chances of success for this exploit and others that involve malicious software are reduced significantly for organizations that effectively implement and manage an enterprise antivirus solution combined with sensible software restriction policies. + +>**Note:**  The chances of success for this exploit and others that involve malicious software are reduced significantly for organizations that effectively implement and manage an enterprise antivirus solution combined with sensible software restriction policies.   Regardless of what encryption algorithm is used to encrypt the password verifier, a password verifier can be overwritten so that an attacker can authenticate as the user to whom the verifier belongs. Therefore, the administrator's password may be overwritten. This procedure requires physical access to the device. Utilities exist that can help overwrite the cached verifier. By using one of these utilities, an attacker can authenticate by using the overwritten value. + Overwriting the administrator's password does not help the attacker access data that is encrypted by using that password. Also, overwriting the password does not help the attacker access any Encrypting File System (EFS) data that belongs to other users on that device. Overwriting the password does not help an attacker replace the verifier, because the base keying material is incorrect. Therefore, data that is encrypted by using Encrypting File System or by using the Data Protection API (DPAPI) will not decrypt. + ### Countermeasure + Enable the **Network access: Do not allow storage of passwords and credentials for network authentication** setting. + To limit the number of changed domain credentials that are stored on the computer, set the **cachedlogonscount** registry entry. By default, the operating system caches the verifier for each unique user's ten most recent valid logons. This value can be set to any value between 0 and 50. By default, all versions of the Windows operating system remember 10 cached logons, except Windows Server 2008 and later, which are set at 25. + When you try to log on to a domain from a Windows-based client device, and a domain controller is unavailable, you do not receive an error message. Therefore, you may not notice that you logged on with cached domain credentials. You can set a notification of logon that uses cached domain credentials with the ReportDC registry entry. + ### Potential impact + Users are forced to type passwords whenever they log on to their Microsoft Account or other network resources that are not accessible to their domain account. This policy setting should have no impact on users who access network resources that are configured to allow access with their Active Directory–based domain account. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/network-access-let-everyone-permissions-apply-to-anonymous-users.md b/windows/keep-secure/network-access-let-everyone-permissions-apply-to-anonymous-users.md index 84c96fe8a5..eedd57751a 100644 --- a/windows/keep-secure/network-access-let-everyone-permissions-apply-to-anonymous-users.md +++ b/windows/keep-secure/network-access-let-everyone-permissions-apply-to-anonymous-users.md @@ -2,83 +2,83 @@ title: Network access Let Everyone permissions apply to anonymous users (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network access Let Everyone permissions apply to anonymous users security policy setting. ms.assetid: cdbc5159-9173-497e-b46b-7325f4256353 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Network access: Let Everyone permissions apply to anonymous users + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **Network access: Let Everyone permissions apply to anonymous users** security policy setting. + ## Reference + This policy setting determines what additional permissions are granted for anonymous connections to the device. If you enable this policy setting, anonymous users can enumerate the names of domain accounts and shared folders and perform certain other activities. This capability is convenient, for example, when an administrator wants to grant access to users in a trusted domain that does not maintain a reciprocal trust. + By default, the token that is created for anonymous connections does not include the Everyone SID. Therefore, permissions that are assigned to the Everyone group do not apply to anonymous users. + ### Possible values + - Enabled + The Everyone SID is added to the token that is created for anonymous connections, and anonymous users can access any resource for which the Everyone group has been assigned permissions. + - Disabled + The Everyone SID is removed from the token that is created for anonymous connections. + - Not defined + ### Best practices + - Set this policy to **Disabled**. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Polices\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Disabled

      DC Effective Default Settings

      Disabled

      Member Server Effective Default Settings

      Disabled

      Client Computer Effective Default Settings

      Disabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + An unauthorized user could anonymously list account names and shared resources and use the information to attempt to guess passwords, perform social engineering attacks, or launch DoS attacks. + ### Countermeasure + Disable the **Network access: Let Everyone permissions apply to anonymous users** setting. + ### Potential impact + None. This is the default configuration. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/network-access-named-pipes-that-can-be-accessed-anonymously.md b/windows/keep-secure/network-access-named-pipes-that-can-be-accessed-anonymously.md index 3046386e99..ab8eff2298 100644 --- a/windows/keep-secure/network-access-named-pipes-that-can-be-accessed-anonymously.md +++ b/windows/keep-secure/network-access-named-pipes-that-can-be-accessed-anonymously.md @@ -2,129 +2,91 @@ title: Network access Named Pipes that can be accessed anonymously (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network access Named Pipes that can be accessed anonymously security policy setting. ms.assetid: 8897d2a4-813e-4d2b-8518-fcee71e1cf2c -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Network access: Named Pipes that can be accessed anonymously + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **Network access: Named Pipes that can be accessed anonymously** security policy setting. + ## Reference + This policy setting determines which communication sessions, or pipes, have attributes and permissions that allow anonymous access. + Restricting access over named pipes such as COMNAP and LOCATOR helps prevent unauthorized access to the network. + ### Possible values + - User-defined list of shared folders - Not defined + ### Best practices + - Set this policy to a null value; that is, enable the policy setting, but do not enter named pipes in the text box. This will disable null session access over named pipes, and applications that rely on this feature or on unauthenticated access to named pipes will no longer function. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Netlogon, samr, lsarpc

      Stand-Alone Server Default Settings

      Null

      DC Effective Default Settings

      Netlogon, samr, lsarpc

      Member Server Effective Default Settings

      Not defined

      Client Computer Effective Default Settings

      Not defined

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined | +| Default Domain Controller Policy | Netlogon, samr, lsarpc| +| Stand-Alone Server Default Settings | Null| +| DC Effective Default Settings | Netlogon, samr, lsarpc| +| Member Server Effective Default Settings | Not defined| +| Client Computer Effective Default Settings | Not defined|   ## Policy management + This section describes different features and tools available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Group Policy + For this policy setting to take effect, you must also enable the [Network access: Restrict anonymous access to Named Pipes and Shares](network-access-restrict-anonymous-access-to-named-pipes-and-shares.md) setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + You can restrict access over named pipes such as COMNAP and LOCATOR to help prevent unauthorized access to the network. The following list describes available named pipes and their purpose. These pipes were granted anonymous access in earlier versions of Windows and some legacy applications may still use them. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Named pipePurpose

      COMNAP

      SNABase named pipe. Systems network Architecture (SNA) is a collection of network protocols that were originally developed for IBM mainframe computers.

      COMNODE

      SNA Server named pipe.

      SQL\QUERY

      Default named pipe for SQL Server.

      SPOOLSS

      Named pipe for the Print Spooler service.

      EPMAPPER

      End Point Mapper named pipe.

      LOCATOR

      Remote Procedure Call Locator service named pipe.

      TrlWks

      Distributed Link Tracking Client named pipe.

      TrkSvr

      Distributed Link Tracking Server named pipe.

      + +| Named pipe | Purpose | +| - | - | +| COMNAP | SNABase named pipe. Systems network Architecture (SNA) is a collection of network protocols that were originally developed for IBM mainframe computers.| +| COMNODE| SNA Server named pipe.| +| SQL\QUERY | Default named pipe for SQL Server.| +| SPOOLSS | Named pipe for the Print Spooler service.| +| EPMAPPER | End Point Mapper named pipe.| +| LOCATOR | Remote Procedure Call Locator service named pipe.| +| TrlWks | Distributed Link Tracking Client named pipe.| +| TrkSvr | Distributed Link Tracking Server named pipe.|   ### Countermeasure + Configure the **Network access: Named Pipes that can be accessed anonymously** setting to a null value (enable the setting but do not specify named pipes in the text box). + ### Potential impact + This configuration disables null-session access over named pipes, and applications that rely on this feature or on unauthenticated access to named pipes no longer function. This may break trust between Windows Server 2003 domains in a mixed mode environment. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/network-access-remotely-accessible-registry-paths-and-subpaths.md b/windows/keep-secure/network-access-remotely-accessible-registry-paths-and-subpaths.md index c4154f266c..d7a01b9e6e 100644 --- a/windows/keep-secure/network-access-remotely-accessible-registry-paths-and-subpaths.md +++ b/windows/keep-secure/network-access-remotely-accessible-registry-paths-and-subpaths.md @@ -2,69 +2,57 @@ title: Network access Remotely accessible registry paths and subpaths (Windows 10) description: Describes the best practices, location, values, and security considerations for the Network access Remotely accessible registry paths and subpaths security policy setting. ms.assetid: 3fcbbf70-a002-4f85-8e86-8dabad21928e -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Network access: Remotely accessible registry paths and subpaths + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Network access: Remotely accessible registry paths and subpaths** security policy setting. + ## Reference + This policy setting determines which registry paths and subpaths are accessible when an application or process references the WinReg key to determine access permissions. -The registry is a database for device configuration information, much of which is sensitive. A malicious user can use it to facilitate unauthorized activities. The chance of this happening is reduced by the fact that the default ACLs that are assigned throughout the registry are fairly restrictive, and they help protect it from access by unauthorized users. + +The registry is a database for device configuration information, much of which is sensitive. A malicious user can use it to facilitate unauthorized activities. The chance of this happening is reduced by the fact that the default ACLs that are assigned throughout the registry are fairly restrictive, +and they help protect it from access by unauthorized users. + To allow remote access, you must also enable the Remote Registry service. + ### Possible values + - User-defined list of paths - Not Defined + ### Best practices + - Set this policy to a null value; that is, enable the policy setting, but do not enter any paths in the text box. Remote management tools, such as the Microsoft Baseline Security Analyzer and Configuration Manager, require remote access to the registry. Removing the default registry paths from the list of accessible paths might cause these and other management tools to fail. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      See the following registry key combination

      DC Effective Default Settings

      See the following registry key combination

      Member Server Effective Default Settings

      See the following registry key combination

      Client Computer Effective Default Settings

      See the following registry key combination

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | See the following registry key combination| +| DC Effective Default Settings | See the following registry key combination| +| Member Server Effective Default Settings | See the following registry key combination| +| Client Computer Effective Default Settings | See the following registry key combination|   The combination of all the following registry keys apply to the previous settings: + 1. System\\CurrentControlSet\\Control\\Print\\Printers 2. System\\CurrentControlSet\\Services\\Eventlog 3. Software\\Microsoft\\OLAP Server @@ -76,22 +64,33 @@ The combination of all the following registry keys apply to the previous setting 9. System\\CurrentControlSet\\Control\\Terminal Server\\DefaultUserConfiguration 10. Software\\Microsoft\\Windows NT\\CurrentVersion\\Perflib 11. System\\CurrentControlSet\\Services\\SysmonLog + ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + The registry contains sensitive device configuration information that could be used by an attacker to facilitate unauthorized activities. The fact that the default ACLs that are assigned throughout the registry are fairly restrictive and help to protect the registry from access by unauthorized users reduces the risk of such an attack. + ### Countermeasure + Configure the **Network access: Remotely accessible registry paths and sub-paths** setting to a null value (enable the setting but do not enter any paths in the text box). + ### Potential impact + Remote management tools such as MBSA and Configuration Manager require remote access to the registry to properly monitor and manage those computers. If you remove the default registry paths from the list of accessible ones, such remote management tools could fail. -**Note**   -If you want to allow remote access, you must also enable the Remote Registry service. + +>**Note:**  If you want to allow remote access, you must also enable the Remote Registry service.   ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/network-access-remotely-accessible-registry-paths.md b/windows/keep-secure/network-access-remotely-accessible-registry-paths.md index 33f15de3de..86fd1783e9 100644 --- a/windows/keep-secure/network-access-remotely-accessible-registry-paths.md +++ b/windows/keep-secure/network-access-remotely-accessible-registry-paths.md @@ -2,88 +2,86 @@ title: Network access Remotely accessible registry paths (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network access Remotely accessible registry paths security policy setting. ms.assetid: 977f86ea-864f-4f1b-9756-22220efce0bd -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Network access: Remotely accessible registry paths + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **Network access: Remotely accessible registry paths** security policy setting. + ## Reference + This policy setting determines which registry paths are accessible when an application or process references the WinReg key to determine access permissions. + The registry is a database for device configuration information, much of which is sensitive. A malicious user can use the registry to facilitate unauthorized activities. To reduce the risk of this happening, suitable access control lists (ACLs) are assigned throughout the registry to help protect it from access by unauthorized users. + To allow remote access, you must also enable the Remote Registry service. + ### Possible values + - User-defined list of paths - Not Defined + ### Best practices + - Set this policy to a null value; that is, enable the policy setting but do not enter any paths in the text box. Remote management tools, such as the Microsoft Baseline Security Analyzer and Configuration Manager, require remote access to the registry. Removing the default registry paths from the list of accessible paths might cause these and other management tools to fail. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      See the following registry key combination

      DC Effective Default Settings

      See the following registry key combination

      Member Server Effective Default Settings

      See the following registry key combination

      Client Computer Effective Default Settings

      See the following registry key combination

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | See the following registry key combination| +| DC Effective Default Settings | See the following registry key combination| +| Member Server Effective Default Settings | See the following registry key combination| +| Client Computer Effective Default Settings | See the following registry key combination|   The combination of all the following registry keys apply to the previous settings: + 1. System\\CurrentControlSet\\Control\\ProductOptions 2. System\\CurrentControlSet\\Control\\Server Applications 3. Software\\Microsoft\\Windows NT\\CurrentVersion + ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + An attacker could use information in the registry to facilitate unauthorized activities. To reduce the risk of such an attack, suitable ACLs are assigned throughout the registry to help protect it from access by unauthorized users. + ### Countermeasure + Configure the **Network access: Remotely accessible registry paths** setting to a null value (enable the setting, but do not enter any paths in the text box). + ### Potential impact + Remote management tools such as the Microsoft Baseline Security Analyzer (MBSA) and Configuration Manager require remote access to the registry to properly monitor and manage those computers. If you remove the default registry paths from the list of accessible ones, such remote management tools could fail. -**Note**   -If you want to allow remote access, you must also enable the Remote Registry service. + +>**Note:**  If you want to allow remote access, you must also enable the Remote Registry service.   ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md b/windows/keep-secure/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md index ab84cb8711..84be70c08b 100644 --- a/windows/keep-secure/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md +++ b/windows/keep-secure/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md @@ -2,81 +2,78 @@ title: Network access Restrict anonymous access to Named Pipes and Shares (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network access Restrict anonymous access to Named Pipes and Shares security policy setting. ms.assetid: e66cd708-7322-4d49-9b57-1bf8ec7a4c10 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Network access: Restrict anonymous access to Named Pipes and Shares + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **Network access: Restrict anonymous access to Named Pipes and Shares** security policy setting. + ## Reference -This policy setting enables or disables the restriction of anonymous access to only those shared folders and pipes that are named in the **Network access: Named pipes that can be accessed anonymously** and [Network access: Shares that can be accessed anonymously](network-access-shares-that-can-be-accessed-anonymously.md) settings. The setting controls null session access to shared folders on your computers by adding RestrictNullSessAccess with the value 1 in the registry key **HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\LanManServer\\Parameters**. This registry value toggles null session shared folders on or off to control whether the Server service restricts unauthenticated clients' access to named resources. + +This policy setting enables or disables the restriction of anonymous access to only those shared folders and pipes that are named in the **Network access: Named pipes that can be accessed anonymously** and [Network access: Shares that can be accessed anonymously](network-access-shares-that-can-be-accessed-anonymously.md) settings. The setting controls null session access to shared folders on your computers by adding RestrictNullSessAccess with the value 1 in the registry key +**HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\LanManServer\\Parameters**. This registry value toggles null session shared folders on or off to control whether the Server service restricts unauthenticated clients' access to named resources. + Null sessions are a weakness that can be exploited through the various shared folders on the devices in your environment. + ### Possible values + - Enabled - Disabled - Not defined + ### Best practices + - Set this policy to Enabled. Enabling this policy setting restricts null session access to unauthenticated users to all server pipes and shared folders except those listed in the **NullSessionPipes** and **NullSessionShares** registry entries. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Enabled

      DC Effective Default Settings

      Enabled

      Member Server Effective Default Settings

      Enabled

      Client Computer Effective Default Settings

      Enabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Enabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings | Enabled| +| Client Computer Effective Default Settings| Enabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Null sessions are a weakness that can be exploited through shared folders (including the default shared folders) on devices in your environment. + ### Countermeasure + Enable the **Network access: Restrict anonymous access to Named Pipes and Shares** setting. + ### Potential impact + You can enable this policy setting to restrict null-session access for unauthenticated users to all server pipes and shared folders except those that are listed in the NullSessionPipes and NullSessionShares entries. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/network-access-shares-that-can-be-accessed-anonymously.md b/windows/keep-secure/network-access-shares-that-can-be-accessed-anonymously.md index 604898a019..b4505320e4 100644 --- a/windows/keep-secure/network-access-shares-that-can-be-accessed-anonymously.md +++ b/windows/keep-secure/network-access-shares-that-can-be-accessed-anonymously.md @@ -2,79 +2,74 @@ title: Network access Shares that can be accessed anonymously (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network access Shares that can be accessed anonymously security policy setting. ms.assetid: f3e4b919-8279-4972-b415-5f815e2f0a1a -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Network access: Shares that can be accessed anonymously + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **Network access: Shares that can be accessed anonymously** security policy setting. + ## Reference + This policy setting determines which shared folders can be accessed by anonymous users. + ### Possible values + - User-defined list of shared folders - Not Defined + ### Best practices + - Set this policy to a null value. There should be little impact because this is the default value. All users will have to be authenticated before they can access shared resources on the server. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Not defined

      DC Effective Default Settings

      Not defined

      Member Server Effective Default Settings

      Not defined

      Client Computer Effective Default Settings

      Not defined

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Not defined| +| DC Effective Default Settings | Not defined| +| Member Server Effective Default Settings | Not defined| +| Client Computer Effective Default Settings | Not defined|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Any shared folders that are listed can be accessed by any network user, which could lead to the exposure or corruption of sensitive data. + ### Countermeasure + Configure the **Network access: Shares that can be accessed anonymously** setting to a null value. + ### Potential impact + There should be little impact because this is the default configuration. Only authenticated users have access to shared resources on the server. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/network-access-sharing-and-security-model-for-local-accounts.md b/windows/keep-secure/network-access-sharing-and-security-model-for-local-accounts.md index c1f32eb9c3..fee079071d 100644 --- a/windows/keep-secure/network-access-sharing-and-security-model-for-local-accounts.md +++ b/windows/keep-secure/network-access-sharing-and-security-model-for-local-accounts.md @@ -2,88 +2,85 @@ title: Network access Sharing and security model for local accounts (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network access Sharing and security model for local accounts security policy setting. ms.assetid: 0b3d703c-ea27-488f-8f59-b345af75b994 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Network access: Sharing and security model for local accounts + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **Network access: Sharing and security model for local accounts** security policy setting. + ## Reference + This policy setting determines how network logons that use local accounts are authenticated. If you configure this policy setting to Classic, network logons that use local account credentials authenticate with those credentials. If you configure this policy setting to Guest only, network logons that use local accounts are automatically mapped to the Guest account. The Classic model provides precise control over access to resources, and it enables you to grant different types of access to different users for the same resource. Conversely, the Guest only model treats all users equally, and they all receive the same level of access to a given resource, which can be either Read Only or Modify. -**Note**   -This policy setting does not affect network logons that use domain accounts. Nor does this policy setting affect interactive logons that are performed remotely through services such as Telnet or Remote Desktop Services. + +>**Note:**  This policy setting does not affect network logons that use domain accounts. Nor does this policy setting affect interactive logons that are performed remotely through services such as Telnet or Remote Desktop Services. When the device is not joined to a domain, this policy setting also tailors the **Sharing** and **Security** tabs in Windows Explorer to correspond to the sharing and security model that is being used.   When the value of this policy setting is **Guest only - local users authenticate as Guest**, any user who can access your device over the network does so with Guest user rights. This means that they will probably be unable to write to shared folders. Although this does increase security, it makes it impossible for authorized users to access shared resources on those systems. When the value is **Classic - local users authenticate as themselves**, local accounts must be password-protected; otherwise, anyone can use those user accounts to access shared system resources. + ### Possible values + - Classic - Local users authenticate as themselves - Guest only - Local users authenticate as Guest - Not defined + ### Best practices + 1. For network servers, set this policy to **Classic - local users authenticate as themselves**. 2. On end-user systems, set this policy to **Guest only - local users authenticate as Guest**. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Classic (local users authenticate as themselves)

      DC Effective Default Settings

      Classic (local users authenticate as themselves)

      Member Server Effective Default Settings

      Classic (local users authenticate as themselves)

      Client Computer Effective Default Settings

      Classic (local users authenticate as themselves)

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Classic (local users authenticate as themselves)| +| DC Effective Default Settings | Classic (local users authenticate as themselves)| +| Member Server Effective Default Settings | Classic (local users authenticate as themselves)| +| Client Computer Effective Default Settings | Classic (local users authenticate as themselves)|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Group Policy + This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local computer by using the Local Security Policy snap-in. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + With the Guest only model, any user who can authenticate to your device over the network does so with Guest privileges, which probably means that they do not have Write access to shared resources on that device. Although this restriction does increase security, it makes it more difficult for authorized users to access shared resources on those computers because ACLs on those resources must include access control entries (ACEs) for the Guest account. With the Classic model, local accounts should be password protected. Otherwise, if Guest access is enabled, anyone can use those user accounts to access shared system resources. + ### Countermeasure + For network servers, configure the **Network access: Sharing and security model for local accounts setting** to **Classic – local users authenticate as themselves**. On end-user computers, configure this policy setting to **Guest only – local users authenticate as guest**. + ### Potential impact + None. This is the default configuration. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/network-list-manager-policies.md b/windows/keep-secure/network-list-manager-policies.md index 931739dc93..11de5e4da7 100644 --- a/windows/keep-secure/network-list-manager-policies.md +++ b/windows/keep-secure/network-list-manager-policies.md @@ -2,50 +2,75 @@ title: Network List Manager policies (Windows 10) description: Network List Manager policies are security settings that you can use to configure different aspects of how networks are listed and displayed on one device or on many devices. ms.assetid: bd8109d4-b07c-4beb-a9a6-affae2ba2fda -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Network List Manager policies + **Applies to** - Windows 10 + Network List Manager policies are security settings that you can use to configure different aspects of how networks are listed and displayed on one device or on many devices. + To configure Network List Manager Policies for one device, you can use the Microsoft Management Console (MMC) with the Group Policy Object Editor snap-in, and edit the local computer policy. The Network List Manager Policies are located at the following path in Group Policy Object Editor: **Computer Configuration | Windows Settings | Security Settings | Network List Manager Policies** + To configure Network List Manager Policies for many computers, such as for all of the Domain Computers in an Active Directory domain, follow Group Policy documentation to learn how to edit the policies for the object that you require. The path to the Network List Manager Policies is the same as the path listed above. + ### Policy settings for Network List Manager Policies + The following policy settings are provided for Network List Manager Policies. These policy settings are located in the details pane of the Group Policy Object Editor, in **Network Name**. + ### Unidentified Networks -This policy setting allows you to configure the **Network Location**, including the location type and the user permissions, for networks that Windows cannot identify due to a network issue or a lack of identifiable characters in the network information received by the operating system from the network. A network location identifies the type of network that a computer is connected to and automatically sets the appropriate firewall settings for that location. You can configure the following items for this policy setting: + +This policy setting allows you to configure the **Network Location**, including the location type and the user permissions, for networks that Windows cannot identify due to a network issue or a lack of identifiable characters in the network information received by the operating system from the +network. A network location identifies the type of network that a computer is connected to and automatically sets the appropriate firewall settings for that location. You can configure the following items for this policy setting: + - **Location type**. For this item, the following options are available: + - **Not configured**. If you select this option, this policy setting does not apply a location type to unidentified network connections. - **Private**. If you select this option, this policy setting applies a location type of Private to unidentified network connections. A private network, such as a home or work network, is a location type that assumes that you trust the other computers on the network. Do not select this item if there is a possibility that an active, unidentified network is in a public place. + - **Public**. If you select this option, this policy setting applies a location type of Public to unidentified network connections. A public network, such as a wireless network at an airport or coffee shop, is a location type that assumes that you do not trust the other computers on the network. + - **User permissions**. For this item, the following options are available: + - **Not configured**. If you select this option, this policy setting does not specify whether users can change the location for unidentified network connections. - **User can change location**. If you select this option, this policy setting allows users to change an unidentified network connection location from Private to Public or from Public to Private. - **User cannot change location**. If you select this option, this policy setting does not allow users to change the location of an unidentified network connection. + ### Identifying Networks + This policy setting allows you to configure the **Network Location** for networks that are in a temporary state while Windows works to identify the network and location type. A network location identifies the type of network that a computer is connected to and automatically sets the appropriate firewall settings for that location. You can configure the following items for this policy setting: + - **Location type**. For this item, the following options are available: + - **Not configured**. If you select this option, this policy setting does not apply a location type to network connections that are in the process of being identified by Windows. - **Private**. If you select this option, this policy setting applies a location type of Private to network connections that are in the process of being identified. A private network, such as a home or work network, is a location type that assumes that you trust the other devices on the network. Do not select this item if there is a possibility that an active, unidentified network is in a public place. - **Public**. If you select this option, this policy setting applies a location type of Public to network connections that are in the process of being identified by Windows. A public network, such as a wireless network at an airport or coffee shop, is a location type that assumes that you do not trust the other devices on the network. + ### All Networks + This policy setting allows you to specify the **User Permissions** that control whether users can change the network name, location, or icon, for all networks to which the user connects. You can configure the following items for this policy setting: + - **Network name**. For this item, the following options are available: + - **Not configured**. If you select this option, this policy setting does not specify whether users can change the network name for all network connections. - **User can change name**. If you select this option, users can change the network name for all networks to which they connect. - **User cannot change name**. If you select this option, users cannot change the network name for any networks to which they connect. + - **Network location**. For this item, the following options are available: + - **Not configured**. If you select this option, this policy setting does not specify whether users can change the location for all network connections. - **User can change location**. If you select this option, this policy setting allows users to change all network locations from Private to Public or from Public to Private. - **User cannot change location**. If you select this option, this policy setting does not allow users to change the location for any networks to which they connect. + - **Network icon**. For this item, the following options are available: + - **Not configured**. If you select this option, this policy setting does not specify whether users can change the network icon for all network connections. - **User can change icon**. If you select this option, this policy setting allows users to change the network icon for all networks to which the user connects. - **User cannot change icon**. If you select this option, this policy setting does not allow users to change the network icon for any networks to which the user connects. -  -  diff --git a/windows/keep-secure/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md b/windows/keep-secure/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md index 532768f78b..929606cb16 100644 --- a/windows/keep-secure/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md +++ b/windows/keep-secure/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md @@ -2,115 +2,87 @@ title: Network security Allow Local System to use computer identity for NTLM (Windows 10) description: Describes the location, values, policy management, and security considerations for the Network security Allow Local System to use computer identity for NTLM security policy setting. ms.assetid: c46a658d-b7a4-4139-b7ea-b9268c240053 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Network security: Allow Local System to use computer identity for NTLM + **Applies to** - Windows 10 + Describes the location, values, policy management, and security considerations for the **Network security: Allow Local System to use computer identity for NTLM** security policy setting. + ## Reference + When services connect to devices that are running versions of the Windows operating system earlier than Windows Vista or Windows Server 2008, services that run as Local System and use SPNEGO (Negotiate) that revert to NTLM will authenticate anonymously. In Windows Server 2008 R2 and Windows 7 and later, if a service connects to a computer running Windows Server 2008 or Windows Vista, the system service uses the computer identity. + When a service connects with the device identity, signing and encryption are supported to provide data protection. (When a service connects anonymously, a system-generated session key is created, which provides no protection, but it allows applications to sign and encrypt data without errors. Anonymous authentication uses a NULL session, which is a session with a server in which no user authentication is performed; and therefore, anonymous access is allowed.) + ### Possible values - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
      SettingWindows Server 2008 and Windows VistaAt least Windows Server 2008 R2 and Windows 7

      Enabled

      Services running as Local System that use Negotiate will use the computer identity. This might cause some authentication requests between Windows operating systems to fail and log an error.

      Services running as Local System that use Negotiate will use the computer identity. This is the default behavior.

      Disabled

      Services running as Local System that use Negotiate when reverting to NTLM authentication will authenticate anonymously. This is the default behavior.

      Services running as Local System that use Negotiate when reverting to NTLM authentication will authenticate anonymously.

      Neither

      Services running as Local System that use Negotiate when reverting to NTLM authentication will authenticate anonymously.

      Services running as Local System that use Negotiate will use the computer identity. This might cause some authentication requests between Windows operating systems to fail and log an error.

      + +| Setting | Windows Server 2008 and Windows Vista | At least Windows Server 2008 R2 and Windows 7 | +| - | - | +| Enabled | Services running as Local System that use Negotiate will use the computer identity. This might cause some authentication requests between Windows operating systems to fail and log an error.| Services running as Local System that use Negotiate will use the computer identity. This is the default behavior. | +| Disabled| Services running as Local System that use Negotiate when reverting to NTLM authentication will authenticate anonymously. This is the default behavior.| Services running as Local System that use Negotiate when reverting to NTLM authentication will authenticate anonymously.| +|Neither|Services running as Local System that use Negotiate when reverting to NTLM authentication will authenticate anonymously. | Services running as Local System that use Negotiate will use the computer identity. This might cause some authentication requests between Windows operating systems to fail and log an error.|   ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or Group Policy object (GPO)Default value

      Default domain policy

      Not defined

      Default domain controller policy

      Not defined

      Stand-alone server default settings

      Not defined

      Domain controller effective default settings

      Not applicable

      Member server effective default settings

      Not applicable

      Effective GPO default settings on client computers

      Not defined

      + +| Server type or Group Policy object (GPO) | Default value | +| - | - | +| Default domain policy| Not defined| +| Default domain controller policy | Not defined| +| Stand-alone server default settings | Not defined| +| Domain controller effective default settings | Not applicable| +| Member server effective default settings | Not applicable| +| Effective GPO default settings on client computers | Not defined|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Policy conflict considerations + The policy [Network security: Allow LocalSystem NULL session fallback](network-security-allow-localsystem-null-session-fallback.md), if enabled, will allow NTLM or Kerberos authentication to be used when a system service attempts authentication. This will increase the success of interoperability at the expense of security. + The anonymous authentication behavior is different for Windows Server 2008 and Windows Vista than later versions of Windows. Configuring and applying this policy setting on those systems might not produce the same results. + ### Group Policy + This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local computer by using the Local Security Policy snap-in. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + When a service connects to computers running versions of Windows earlier than Windows Vista or Windows Server 2008, services that run as Local System and use SPNEGO (Negotiate) that revert to NTLM will use NULL session. In Windows Server 2008 R2 and Windows 7 and later, if a service connects to a computer running Windows Server 2008 or Windows Vista, the system service uses the computer identity. + When a service connects with the computer identity, signing and encryption are supported to provide data protection. When a service connects with a NULL session, a system-generated session key is created, which provides no protection, but it allows applications to sign and encrypt data without errors. + ### Countermeasure + You can configure the **Network security: Allow Local System to use computer identity for NTLM** security policy setting to allow Local System services that use Negotiate to use the computer identity when reverting to NTLM authentication. + ### Potential impact + If you do not configure this policy setting on Windows Server 2008 and Windows Vista, services running as Local System that use the default credentials will use the NULL session and revert to NTLM authentication for Windows operating systems earlier than Windows Vista or Windows Server 2008. Beginning with Windows Server 2008 R2 and Windows 7, the system allows Local System services that use Negotiate to use the computer identity when reverting to NTLM authentication. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/network-security-allow-localsystem-null-session-fallback.md b/windows/keep-secure/network-security-allow-localsystem-null-session-fallback.md index 393c0a9382..34b487bba3 100644 --- a/windows/keep-secure/network-security-allow-localsystem-null-session-fallback.md +++ b/windows/keep-secure/network-security-allow-localsystem-null-session-fallback.md @@ -2,78 +2,75 @@ title: Network security Allow LocalSystem NULL session fallback (Windows 10) description: Describes the best practices, location, values, and security considerations for the Network security Allow LocalSystem NULL session fallback security policy setting. ms.assetid: 5b72edaa-bec7-4572-b6f0-648fc38f5395 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Network security: Allow LocalSystem NULL session fallback + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Network security: Allow LocalSystem NULL session fallback** security policy setting. + ## Reference -This policy affects session security during the authentication process between devices running Windows Server 2008 R2 and Windows 7 and later and those devices running earlier versions of the Windows operating system. For computers running Windows Server 2008 R2 and Windows 7 and later, services running as Local System require a service principal name (SPN) to generate the session key. However, if [Network security: Allow Local System to use computer identity for NTLM](network-security-allow-local-system-to-use-computer-identity-for-ntlm.md) is set to disabled, services running as Local System will fall back to using NULL session authentication when they transmit data to servers running versions of Windows earlier than Windows Vista or Windows Server 2008. NULL session does not establish a unique session key for each authentication; and thus, it cannot provide integrity or confidentiality protection. The setting **Network security: Allow LocalSystem NULL session fallback** determines whether services that request the use of session security are allowed to perform signature or encryption functions with a well-known key for application compatibility. + +This policy affects session security during the authentication process between devices running Windows Server 2008 R2 and Windows 7 and later and those devices running earlier versions of the Windows operating system. For computers running Windows Server 2008 R2 and Windows 7 and later, services running as Local System require a service principal name (SPN) to generate the session key. However, if [Network security: Allow Local System to use computer identity for NTLM](network-security-allow-local-system-to-use-computer-identity-for-ntlm.md) is set to disabled, services running as Local +System will fall back to using NULL session authentication when they transmit data to servers running versions of Windows earlier than Windows Vista or Windows Server 2008. NULL session does not establish a unique session key for each authentication; and thus, it cannot provide integrity or confidentiality protection. The setting **Network security: Allow LocalSystem NULL session fallback** determines whether services that request the use of session security are allowed to perform signature or encryption functions with a well-known key for application compatibility. + ### Possible values + - **Enabled** + When a service running as Local System connects with a NULL session, a system-generated session key is created, which provides no protection but allows applications to sign and encrypt data without errors. This increases application compatibility, but it degrades the level of security. + - **Disabled** - When a service running as Local System connects with a NULL session, session security will be unavailable. Calls seeking encryption or signing will fail. This setting is more secure, but at the risk of degrading application incompatibility. Calls that are using the device identity instead of a NULL session will still have full use of session security. + + When a service running as Local System connects with a NULL session, session security will be unavailable. Calls seeking encryption or signing will fail. This setting is more secure, but at the risk of degrading application incompatibility. Calls that are using the device identity instead of a + NULL session will still have full use of session security. + - Not defined. When this policy is not defined, the default takes effect. This is Enabled for versions of the Windows operating system earlier than Windows Server 2008 R2 and Windows 7, and it is Disabled otherwise. + ### Best practices + When services connect with the device identity, signing and encryption are supported to provide data protection. When services connect with a NULL session, this level of data protection is not provided. However, you will need to evaluate your environment to determine the Windows operating system versions that you support. If this policy is enabled, some services may not be able to authenticate. + This policy applies to Windows Server 2008 and Windows Vista (SP1 and later). When your environment no longer requires support for Windows NT 4, this policy should be disabled. By default, it is disabled in Windows 7 and Windows Server 2008 R2 and later. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or Group Policy Object (GPO)Default value

      Default domain policy

      Not defined

      Default domain controller policy

      Not defined

      Stand-alone server default settings

      Not defined

      Domain controller effective default settings

      Not applicable

      Member server effective default settings

      Not applicable

      Effective GPO default settings on client computers

      Not applicable

      + +| Server type or Group Policy Object (GPO) | Default value | +| - | - | +| Default domain policy| Not defined| +| Default domain controller policy | Not defined| +| Stand-alone server default settings | Not defined| +| Domain controller effective default settings | Not applicable| +| Member server effective default settings | Not applicable | +| Effective GPO default settings on client computers | Not applicable|   ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + If this setting is Enabled, when a service connects with a NULL session, a system-generated session key is created, which provides no protection but allows applications to sign and encrypt data without errors. Data that is intended to be protected might be exposed. + ### Countermeasure + You can configure the computer to use the computer identity for Local System with the policy **Network security: Allow Local System to use computer identity for NTLM**. If that is not possible, this policy can be used to prevent data from being exposed in transit if it was protected with a well-known key. + ### Potential impact + If you enable this policy, services that use NULL session with Local System could fail to authenticate because they will be prohibited from using signing and encryption. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md b/windows/keep-secure/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md index a5ffb6243d..a381d1388c 100644 --- a/windows/keep-secure/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md +++ b/windows/keep-secure/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md @@ -2,83 +2,79 @@ title: Network security Allow PKU2U authentication requests to this computer to use online identities (Windows 10) description: Describes the best practices, location, and values for the Network Security Allow PKU2U authentication requests to this computer to use online identities security policy setting. ms.assetid: e04a854e-d94d-4306-9fb3-56e9bd7bb926 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Network security: Allow PKU2U authentication requests to this computer to use online identities + **Applies to** - Windows 10 + Describes the best practices, location, and values for the **Network Security: Allow PKU2U authentication requests to this computer to use online identities** security policy setting. + ## Reference + Starting with Windows Server 2008 R2 and Windows 7, the Negotiate Security Support Provider (SSP) supports an extension SSP, Negoexts.dll. This extension SSP is treated as an authentication protocol by the Windows operating system, and it supports SSPs from Microsoft, including PKU2U. You can also develop or add other SSPs. + When devices are configured to accept authentication requests by using online IDs, Negoexts.dll calls the PKU2U SSP on the computer that is used to log on. The PKU2U SSP obtains a local certificate and exchanges the policy between the peer computers. When validated on the peer computer, the certificate within the metadata is sent to the logon peer for validation. It associates the user's certificate to a security token, and then the logon process completes. -**Note**   -The ability to link online IDs can be performed by anyone with an account that has standard user’s credentials through **Credential Manager**. + +>**Note:**  The ability to link online IDs can be performed by anyone with an account that has standard user’s credentials through **Credential Manager**.   This policy is not configured by default on domain-joined devices. This would disallow the online identities to be able to authenticate to the domain-joined computers in Windows 7 and later. + ### Possible values + - **Enabled** + This will allow authentication to successfully complete between the two (or more) computers that have established a peer relationship through the use on online IDs. The PKU2U SSP obtains a local certificate and exchanges the policy between the peer devices. When validated on the peer computer, the certificate within the metadata is sent to the logon peer for validation. It associates the user's certificate to a security token, and then the logon process completes. + - **Disabled** + This will prevent online IDs from being used to authenticate the user to another computer in a peer-to-peer relationship. + - Not set. Not configuring this policy prevents online IDs from being used to authenticate the user. This is the default on domain-joined devices + ### Best practices + Within a domain, domain accounts should be used for authentication. Set this policy to **Disabled** or do not configure this policy to exclude online identities from being used to authenticate. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or Group Policy Object (GPO)Default value

      Default domain policy

      Not defined

      Default domain controller policy

      Not defined

      Stand-alone server default settings

      Not defined

      Domain controller effective default settings

      Disabled

      Member server effective default settings

      Disabled

      Effective GPO default settings on client computers

      Disabled

      + +| Server type or Group Policy Object (GPO) | Default value | +| - | - | +| Default domain policy| Not defined| +| Default domain controller policy | Not defined| +| Stand-alone server default settings | Not defined| +| Domain controller effective default settings | Disabled| +| Member server effective default settings | Disabled| +| Effective GPO default settings on client computers | Disabled|   ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Enabling this policy setting allows a user’s account on one computer to be associated with an online identity, such as Microsoft Account, so that account can log on to a peer device (if the peer device is likewise configured) without the use of a Windows logon account (domain or local). Although this is beneficial for workgroups or home groups, using this feature in a domain-joined environment might circumvent your established security policies. + ### Countermeasure + Set this policy to Disabled or do not configure this security policy for domain-joined devices. + ### Potential impact + If you do not set or disable this policy, the PKU2U protocol will not be used to authenticate between peer devices, which forces users to follow domain defined access control policies. If you enable this policy, you will allow your users to authenticate by using local certificates between systems that are not part of a domain that uses PKU2U. This will allow users to share resources between devices + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/network-security-configure-encryption-types-allowed-for-kerberos.md b/windows/keep-secure/network-security-configure-encryption-types-allowed-for-kerberos.md index 6fa8240e2e..7ca22f98c0 100644 --- a/windows/keep-secure/network-security-configure-encryption-types-allowed-for-kerberos.md +++ b/windows/keep-secure/network-security-configure-encryption-types-allowed-for-kerberos.md @@ -2,128 +2,89 @@ title: Network security Configure encryption types allowed for Kerberos Win7 only (Windows 10) description: Describes the best practices, location, values and security considerations for the Network security Configure encryption types allowed for Kerberos Win7 only security policy setting. ms.assetid: 303d32cc-415b-44ba-96c0-133934046ece -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Network security: Configure encryption types allowed for Kerberos Win7 only + **Applies to** - Windows 10 + Describes the best practices, location, values and security considerations for the **Network security: Configure encryption types allowed for Kerberos Win7 only** security policy setting. + ## Reference + This policy setting allows you to set the encryption types that the Kerberos protocol is allowed to use. If it is not selected, the encryption type will not be allowed. This setting might affect compatibility with client computers or services and applications. Multiple selections are permitted. + For more information, see [article 977321](http://support.microsoft.com/kb/977321) in the Microsoft Knowledge Base. + The following table lists and explains the allowed encryption types. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Encryption typeDescription and version support

      DES_CBC_CRC

      Data Encryption Standard with Cipher Block Chaining using the Cyclic Redundancy Check function

      -

      Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008. The Windows 7 and Windows Server 2008 R2 operating systems do not support DES by default.

      DES_CBC_MD5

      Data Encryption Standard with Cipher Block Chaining using the Message-Digest algorithm 5 checksum function

      -

      Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008. The Windows 7 and Windows Server 2008 R2 operating systems do not support DES by default.

      RC4_HMAC_MD5

      Rivest Cipher 4 with Hashed Message Authentication Code using the Message-Digest algorithm 5 checksum function

      -

      Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.

      AES128_HMAC_SHA1

      Advanced Encryption Standard in 128 bit cipher block with Hashed Message Authentication Code using the Secure Hash Algorithm (1).

      -

      Not supported in Windows 2000 Server, Windows XP, or Windows Server 2003. Supported in Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.

      AES256_HMAC_SHA1

      Advanced Encryption Standard in 256 bit cipher block with Hashed Message Authentication Code using the Secure Hash Algorithm (1).

      -

      Not supported in Windows 2000 Server, Windows XP, or Windows Server 2003. Supported in Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.

      Future encryption types

      Reserved by Microsoft for additional encryption types that might be implemented.

      + +| Encryption type | Description and version support | +| - | - | +| DES_CBC_CRC | Data Encryption Standard with Cipher Block Chaining using the Cyclic Redundancy Check function
      Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008. The Windows 7 and Windows Server 2008 R2 operating systems do not support DES| by default. +| DES_CBC_MD5| Data Encryption Standard with Cipher Block Chaining using the Message-Digest algorithm 5 checksum function
      Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008. The Windows 7 and Windows Server 2008 R2 operating systems do not support DES by default. | +| RC4_HMAC_MD5| Rivest Cipher 4 with Hashed Message Authentication Code using the Message-Digest algorithm 5 checksum function
      Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.| +| AES128_HMAC_SHA1| Advanced Encryption Standard in 128 bit cipher block with Hashed Message Authentication Code using the Secure Hash Algorithm (1).
      Not supported in Windows 2000 Server, Windows XP, or Windows Server 2003. Supported in Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2. | +| AES256_HMAC_SHA1| Advanced Encryption Standard in 256 bit cipher block with Hashed Message Authentication Code using the Secure Hash Algorithm (1).
      Not supported in Windows 2000 Server, Windows XP, or Windows Server 2003. Supported in Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2. | +| Future encryption types| Reserved by Microsoft for additional encryption types that might be implemented.|   ### Possible values + + The encryption type options include: + - DES\_CBC\_CRC - DES\_CBC\_MD5 - RC4\_HMAC\_MD5 - AES128\_HMAC\_SHA1 - AES256\_HMAC\_SHA1 - Future encryption types + As of the release of Windows 7 and Windows Server 2008 R2, this is reserved by Microsoft for additional encryption types that might be implemented. + ### Best practices + You must analyze your environment to determine which encryption types will be supported and then select those that meet that evaluation. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or Group Policy Object (GPO)Default value

      Default domain policy

      Not defined

      Default domain controller policy

      Not defined

      Stand-alone server default settings

      Not defined

      Domain controller effective default settings

      None of these encryption types that are available in this policy are allowed.

      Member server effective default settings

      None of these encryption types that are available in this policy are allowed.

      Effective GPO default settings on client computers

      None of these encryption types that are available in this policy are allowed.

      +| Server type or Group Policy Object (GPO) | Default value | +| - | - | +| Default domain policy| Not defined| +| Default domain controller policy| Not defined| +| Stand-alone server default settings | Not defined| +| Domain controller effective default settings | None of these encryption types that are available in this policy are allowed.| +| Member server effective default settings | None of these encryption types that are available in this policy are allowed.| +| Effective GPO default settings on client computers | None of these encryption types that are available in this policy are allowed.|   ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability -Windows Server 2008 R2 and Windows 7 do not support the DES cryptographic suites because stronger ones are available. To enable Kerberos interoperability with non-Windows versions of the Kerberos protocol, these suites can be enabled. However, doing so might open attack vectors on computers running Windows Server 2008 R2 and Windows 7. You can also disable DES for your computers running Windows Vista and Windows Server 2008. + +Windows Server 2008 R2 and Windows 7 do not support the DES cryptographic suites because stronger ones are available. To enable Kerberos interoperability with non-Windows versions of the Kerberos protocol, these suites can be enabled. However, doing so might open attack vectors on computers running +Windows Server 2008 R2 and Windows 7. You can also disable DES for your computers running Windows Vista and Windows Server 2008. + ### Countermeasure + Do not configure this policy. This will force the computers running Windows Server 2008 R2 and Windows 7 to use the AES or RC4 cryptographic suites. + ### Potential impact + If you do not select any of the encryption types, computers running Windows Server 2008 R2 and Windows 7 might have Kerberos authentication failures when connecting with computers running non-Windows versions of the Kerberos protocol. + If you do select any encryption type, you will lower the effectiveness of encryption for Kerberos authentication but you will improve interoperability with computers running older versions of Windows. Contemporary non-Windows implementations of the Kerberos protocol support RC4 and AES 128-bit and AES 256-bit encryption. Most implementations, including the MIT Kerberos protocol and the Windows Kerberos protocol, are deprecating DES encryption. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md b/windows/keep-secure/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md index 97a0897fcf..95b335005c 100644 --- a/windows/keep-secure/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md +++ b/windows/keep-secure/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md @@ -2,82 +2,78 @@ title: Network security Do not store LAN Manager hash value on next password change (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network security Do not store LAN Manager hash value on next password change security policy setting. ms.assetid: 6452b268-e5ba-4889-9d38-db28f919af51 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Network security: Do not store LAN Manager hash value on next password change + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **Network security: Do not store LAN Manager hash value on next password change** security policy setting. + ## Reference + This policy setting determines whether LAN Manager is prevented from storing hash values for the new password the next time the password is changed. Hash values are a representation of the password after the encryption algorithm is applied that corresponds to the format that is specified by the algorithm. To decrypt the hash value, the encryption algorithm must be determined and then reversed. The LAN Manager hash is relatively weak and prone to attack compared to the cryptographically stronger NTLM hash. Because the LM hash is stored on the local device in the security database, the passwords can be compromised if the security database, Security Accounts Manager (SAM), is attacked. + By attacking the SAM file, attackers can potentially gain access to user names and password hashes. Attackers can use a password-cracking tool to determine what the password is. After they have access to this information, they can use it to gain access to resources on your network by impersonating users. Enabling this policy setting will not prevent these types of attacks, but it will make them much more difficult. + ### Possible values + - Enabled - Disabled - Not defined + ### Best practices + 1. Set **Network security: Do not store LAN Manager hash value on next password change** to **Enabled**. 2. Require all users to set new passwords the next time they log on to the domain so that LAN Manager hashes are removed. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Enabled

      DC Effective Default Settings

      Enabled

      Member Server Effective Default Settings

      Enabled

      Client Computer Effective Default Settings

      Enabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Enabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings|Enabled| +| Client Computer Effective Default Settings | Enabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + The SAM file can be targeted by attackers who seek access to user names and password hashes. Such attacks use special tools to discover passwords, which can then be used to impersonate users and gain access to resources on your network. These types of attacks are not prevented by enabling this policy setting because LAN Manager hashes are much weaker than NTLM hashes, but it is much more difficult for these attacks to succeed. + ### Countermeasure + Enable the **Network security: Do not store LAN Manager hash value on next password change** setting. Require all users to set new passwords the next time they log on to the domain so that LAN Manager hashes are removed. + ### Potential impact + Some non-Microsoft applications might not be able to connect to the system. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/network-security-force-logoff-when-logon-hours-expire.md b/windows/keep-secure/network-security-force-logoff-when-logon-hours-expire.md index 410ead1171..f6dd03a829 100644 --- a/windows/keep-secure/network-security-force-logoff-when-logon-hours-expire.md +++ b/windows/keep-secure/network-security-force-logoff-when-logon-hours-expire.md @@ -2,83 +2,83 @@ title: Network security Force logoff when logon hours expire (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network security Force logoff when logon hours expire security policy setting. ms.assetid: 64d5dde4-58e4-4217-b2c4-73bd554ec926 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Network security: Force logoff when logon hours expire + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **Network security: Force logoff when logon hours expire** security policy setting. + ## Reference + This security setting determines whether to disconnect users who are connected to the local device outside their user account's valid logon hours. This setting affects the Server Message Block (SMB) component. + This policy setting does not apply to administrator accounts, but it behaves as an account policy. For domain accounts, there can be only one account policy. The account policy must be defined in the Default Domain Policy, and it is enforced by the domain controllers that make up the domain. A domain controller always pulls the account policy from the Default Domain Policy Group Policy Object (GPO), even if there is a different account policy that is applied to the organizational unit that contains the domain controller. By default, workstations and servers that are joined to a domain (for example, member devices) also receive the same account policy for their local accounts. However, local account policies for member devices can be different from the domain account policy by defining an account policy for the organizational unit that contains the member devices. Kerberos settings are not applied to member devices. + ### Possible values + - Enabled + When enabled, this policy causes client sessions with the SMB server to be forcibly disconnected when the client's logon hours expire. + - Disabled + When disabled, this policy allows for the continuation of an established client session after the client's logon hours have expired. + - Not defined + ### Best practices + - Set **Network security: Force logoff when logon hours expire** to Enabled. SMB sessions will be terminated on member servers when a user's logon time expires, and the user will be unable to log on to the system until their next scheduled access time begins. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Disabled

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Disabled

      DC Effective Default Settings

      Disabled

      Member Server Effective Default Settings

      Disabled

      Client Computer Effective Default Settings

      Disabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Disabled| +| Default Domain Controller Policy| Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + If you disable this policy setting, users can remain connected to the computer outside of their allotted logon hours. + ### Countermeasure + Enable the **Network security: Force logoff when logon hours expire** setting. This policy setting does not apply to administrator accounts. + ### Potential impact + When a user's logon time expires, SMB sessions terminate. The user cannot log on to the device until the next scheduled access time commences. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/network-security-lan-manager-authentication-level.md b/windows/keep-secure/network-security-lan-manager-authentication-level.md index 1b3103d943..5d8a5343aa 100644 --- a/windows/keep-secure/network-security-lan-manager-authentication-level.md +++ b/windows/keep-secure/network-security-lan-manager-authentication-level.md @@ -2,25 +2,34 @@ title: Network security LAN Manager authentication level (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network security LAN Manager authentication level security policy setting. ms.assetid: bbe1a98c-420a-41e7-9d3c-3a2fe0f1843e -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Network security: LAN Manager authentication level + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **Network security: LAN Manager authentication level** security policy setting. + ## Reference + This policy setting determines which challenge or response authentication protocol is used for network logons. LAN Manager (LM) includes client computer and server software from Microsoft that allows users to link personal devices together on a single network. Network capabilities include transparent file and print sharing, user security features, and network administration tools. In Active Directory domains, the Kerberos protocol is the default authentication protocol. However, if the Kerberos protocol is not negotiated for some reason, Active Directory uses LM, NTLM, or NTLM version 2 (NTLMv2). + LAN Manager authentication includes the LM, NTLM, and NTLMv2 variants, and it is the protocol that is used to authenticate all client devices running the Windows operating system when they perform the following operations: + - Join a domain - Authenticate between Active Directory forests - Authenticate to domains based on earlier versions of the Windows operating system - Authenticate to computers that do not run Windows operating systems, beginning with Windows 2000 - Authenticate to computers that are not in the domain + ### Possible values + - Send LM & NTLM responses - Send LM & NTLM - use NTLMv2 session security if negotiated - Send NTLM responses only @@ -28,114 +37,68 @@ LAN Manager authentication includes the LM, NTLM, and NTLMv2 variants, and it is - Send NTLMv2 responses only. Refuse LM - Send NTLMv2 responses only. Refuse LM & NTLM - Not Defined -The **Network security: LAN Manager authentication level** setting determines which challenge/response authentication protocol is used for network logons. This choice affects the authentication protocol level that clients use, the session security level that the computers negotiate, and the authentication level that servers accept. The following table identifies the policy settings, describes the setting, and identifies the security level used in the corresponding registry setting if you choose to use the registry to control this setting instead of the policy setting. - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      SettingDescriptionRegistry security level

      Send LM & NTLM responses

      Client devices use LM and NTLM authentication, and they never use NTLMv2 session security. Domain controllers accept LM, NTLM, and NTLMv2 authentication.

      0

      Send LM & NTLM – use NTLMv2 session security if negotiated

      Client devices use LM and NTLM authentication, and they use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM, and NTLMv2 authentication.

      1

      Send NTLM response only

      Client devices use NTLMv1 authentication, and they use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM, and NTLMv2 authentication.

      2

      Send NTLMv2 response only

      Client devices use NTLMv2 authentication, and they use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM, and NTLMv2 authentication.

      3

      Send NTLMv2 response only. Refuse LM

      Client devices use NTLMv2 authentication, and they use NTLMv2 session security if the server supports it. Domain controllers refuse to accept LM authentication, and they will accept only NTLM and NTLMv2 authentication.

      4

      Send NTLMv2 response only. Refuse LM & NTLM

      Client devices use NTLMv2 authentication, and they use NTLMv2 session security if the server supports it. Domain controllers refuse to accept LM and NTLM authentication, and they will accept only NTLMv2 authentication.

      5

      + +The **Network security: LAN Manager authentication level** setting determines which challenge/response authentication protocol is used for network logons. This choice affects the authentication protocol level that clients use, the session security level that the computers negotiate, and the +authentication level that servers accept. The following table identifies the policy settings, describes the setting, and identifies the security level used in the corresponding registry setting if you choose to use the registry to control this setting instead of the policy setting. + +| Setting | Description | Registry security level | +| - | - | - | +| Send LM & NTLM responses | Client devices use LM and NTLM authentication, and they never use NTLMv2 session security. Domain controllers accept LM, NTLM, and NTLMv2 authentication.| 0| +| Send LM & NTLM – use NTLMv2 session security if negotiated | Client devices use LM and NTLM authentication, and they use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM, and NTLMv2 authentication.| 1| +| Send NTLM response only| Client devices use NTLMv1 authentication, and they use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM, and NTLMv2 authentication.| 2| +| Send NTLMv2 response only | Client devices use NTLMv2 authentication, and they use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM, and NTLMv2 authentication.| 3| +| Send NTLMv2 response only. Refuse LM | Client devices use NTLMv2 authentication, and they use NTLMv2 session security if the server supports it. Domain controllers refuse to accept LM authentication, and they will accept only NTLM and NTLMv2 authentication.| 4| +| Send NTLMv2 response only. Refuse LM & NTLM | Client devices use NTLMv2 authentication, and they use NTLMv2 session security if the server supports it. Domain controllers refuse to accept LM and NTLM authentication, and they will accept only NTLMv2 authentication.| 5|   ### Best practices + - Best practices are dependent on your specific security and authentication requirements. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Send NTLMv2 response only

      DC Effective Default Settings

      Send NTLMv2 response only

      Member Server Effective Default Settings

      Send NTLMv2 response only

      Client Computer Effective Default Settings

      Not defined

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Send NTLMv2 response only| +| DC Effective Default Settings | Send NTLMv2 response only| +| Member Server Effective Default Settings | Send NTLMv2 response only| +| Client Computer Effective Default Settings | Not defined|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Group Policy + Modifying this setting may affect compatibility with client devices, services, and applications. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + In Windows 7 and Windows Vista, this setting is undefined. In Windows Server 2008 R2 and later, this setting is configured to **Send NTLMv2 responses only**. + ### Countermeasure + Configure the **Network security: LAN Manager Authentication Level** setting to **Send NTLMv2 responses only**. Microsoft and a number of independent organizations strongly recommend this level of authentication when all client computers support NTLMv2. + ### Potential impact + Client devices that do not support NTLMv2 authentication cannot authenticate in the domain and access domain resources by using LM and NTLM. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/network-security-ldap-client-signing-requirements.md b/windows/keep-secure/network-security-ldap-client-signing-requirements.md index 533858f613..5207e6e65f 100644 --- a/windows/keep-secure/network-security-ldap-client-signing-requirements.md +++ b/windows/keep-secure/network-security-ldap-client-signing-requirements.md @@ -2,87 +2,86 @@ title: Network security LDAP client signing requirements (Windows 10) description: This security policy reference topic for the IT professional describes the best practices, location, values, policy management and security considerations for this policy setting. ms.assetid: 38b35489-eb5b-4035-bc87-df63de50509c -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Network security: LDAP client signing requirements + **Applies to** - Windows 10 + This security policy reference topic for the IT professional describes the best practices, location, values, policy management and security considerations for this policy setting. This information applies to computers running at least the Windows Server 2008 operating system. + ## Reference + This policy setting determines the level of data signing that is requested on behalf of client devices that issue LDAP BIND requests. The levels of data signing are described in the following list: + - **None**. The LDAP BIND request is issued with the caller-specified options. - **Negotiate signing**. If Transport Layer Security/Secure Sockets Layer (TLS/SSL) has not been started, the LDAP BIND request is initiated with the LDAP data signing option set in addition to the caller-specified options. If TLS/SSL has been started, the LDAP BIND request is initiated with the caller-specified options. - **Require signing**. This level is the same as **Negotiate signing**. However, if the LDAP server's intermediate saslBindInProgress response does not indicate that LDAP traffic signing is required, the caller is returned a message that the LDAP BIND command request failed. + Misuse of this policy setting is a common error that can cause data loss or problems with data access or security. + ### Possible values + - None - Negotiate signing - Require signature - Not Defined + ### Best practices + - Set **Domain controller: LDAP server signing requirements** to **Require signature**. If you set the server to require LDAP signatures, you must also set the client devices to do so. Not setting the client devices will prevent client computers from communicating with the server. This can cause many features to fail, including user authentication, Group Policy, and logon scripts. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Negotiate signing

      DC Effective Default Settings

      Negotiate signing

      Member Server Effective Default Settings

      Negotiate signing

      Client Computer Effective Default Settings

      Negotiate signing

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Negotiate signing| +| DC Effective Default Settings | Negotiate signing| +| Member Server Effective Default Settings | Negotiate signing| +| Client Computer Effective Default Settings | Negotiate signing|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Group Policy + Modifying this setting may affect compatibility with client devices, services, and applications. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Unsigned network traffic is susceptible to man-in-the-middle attacks in which an intruder captures the packets between the client computer and server, modifies them, and then forwards them to the server. For an LDAP server, this susceptibility means that an attacker could cause a server to make decisions that are based on false or altered data from the LDAP queries. To lower this risk in your network, you can implement strong physical security measures to protect the network infrastructure. Also, you can make all types of man-in-the-middle attacks extremely difficult if you require digital signatures on all network packets by means of IPsec authentication headers. + ### Countermeasure + Configure the **Network security: LDAP server signing requirements** setting to **Require signature**. + ### Potential impact + If you configure the server to require LDAP signatures, you must also configure the client computers. If you do not configure the client devices, they cannot communicate with the server, which could cause many features to fail, including user authentication, Group Policy, and logon scripts. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md b/windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md index 1fcbb6bbc4..ba6527767f 100644 --- a/windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md +++ b/windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md @@ -2,83 +2,83 @@ title: Network security Minimum session security for NTLM SSP based (including secure RPC) clients (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network security Minimum session security for NTLM SSP based (including secure RPC) clients security policy setting. ms.assetid: 89903de8-23d0-4e0f-9bef-c00cb7aebf00 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Network security: Minimum session security for NTLM SSP based (including secure RPC) clients + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **Network security: Minimum session security for NTLM SSP based (including secure RPC) clients** security policy setting. + ## Reference + This policy setting allows a client device to require the negotiation of 128-bit encryption or NTLMv2 session security. These values are dependent on the **Network security: LAN Manager Authentication Level policy** setting value. + ### Possible values + - Require NTLMv2 session security + The connection fails if strong encryption (128-bit) is not negotiated. + - Require 128-bit encryption + The connection fails if the NTLMv2 protocol is not negotiated. + ### Best practices + Practices in setting this policy are dependent on your security requirements. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Require 128-bit encryption

      DC Effective Default Settings

      Require 128-bit encryption

      Member Server Effective Default Settings

      Require 128-bit encryption

      Client Computer Effective Default Settings

      Require 128-bit encryption

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined| +| Default Domain Controller Policy| Not defined| +| Stand-Alone Server Default Settings | Require 128-bit encryption| +| DC Effective Default Settings | Require 128-bit encryption| +| Member Server Effective Default Settings | Require 128-bit encryption| +| Client Computer Effective Default Settings | Require 128-bit encryption|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Policy conflicts + The settings for this security policy are dependent on the **Network security: LAN Manager Authentication Level policy** setting value. For info about this policy, see [Network security: LAN Manager authentication level](network-security-lan-manager-authentication-level.md). + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Network traffic that uses the NTLM Security Support Provider (NTLM SSP) could be exposed such that an attacker who has gained access to the network can create man-in-the-middle attacks. + ### Countermeasure + Enable all options that are available for the **Network security: Minimum session security for NTLM SSP based (including secure RPC) clients policy** setting. + ### Potential impact + Client devices that enforce these settings cannot communicate with older servers that do not support them. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md b/windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md index 581c58aa2d..6bd65a6591 100644 --- a/windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md +++ b/windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md @@ -2,83 +2,81 @@ title: Network security Minimum session security for NTLM SSP based (including secure RPC) servers (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network security Minimum session security for NTLM SSP based (including secure RPC) servers security policy setting. ms.assetid: c6a60c1b-bc8d-4d02-9481-f847a411b4fc -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Network security: Minimum session security for NTLM SSP based (including secure RPC) servers + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **Network security: Minimum session security for NTLM SSP based (including secure RPC) servers** security policy setting. + ## Reference + This policy setting allows a client device to require the negotiation of 128-bit encryption or NTLMv2 session security. These values are dependent on the [Network security: LAN Manager authentication level](network-security-lan-manager-authentication-level.md) policy setting value. + Setting all of these values for this policy setting will help protect network traffic that uses the NTLM Security Support Provider (NTLM SSP) from being exposed or tampered with by a malicious user who has gained access to the same network. That is, these settings help protect against man-in-the-middle attacks. + ### Possible values + - Require 128-bit encryption. The connection fails if strong encryption (128-bit) is not negotiated. - Require NTLMv2 session security. The connection fails if the NTLMv2 protocol is not negotiated. - Not Defined. + ### Best practices + - Enable all values that are available for this security policy. Legacy client devices that do not support these policy settings will be unable to communicate with the server. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Require 128-bit encryption

      DC Effective Default Settings

      Require 128-bit encryption

      Member Server Effective Default Settings

      Require 128-bit encryption

      Client Computer Effective Default Settings

      Require 128-bit encryption

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined| +| Default Domain Controller Policy| Not defined| +| Stand-Alone Server Default Settings | Require 128-bit encryption| +| DC Effective Default Settings | Require 128-bit encryption| +| Member Server Effective Default Settings | Require 128-bit encryption| +| Client Computer Effective Default Settings | Require 128-bit encryption|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Policy dependencies + The settings for this security policy are dependent on the [Network security: LAN Manager authentication level](network-security-lan-manager-authentication-level.md) setting value. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Network traffic that uses the NTLM Security Support Provider (NTLM SSP) could be exposed such that an attacker who has gained access to the network can create man-in-the-middle attacks. + ### Countermeasure + Enable all options that are available for the **Network security: Minimum session security for NTLM SSP based (including secure RPC) servers** policy setting. + ### Potential impact + Older client devices that do not support these security settings cannot communicate with the computer on which this policy is set. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md b/windows/keep-secure/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md index 64151c9c05..ca5c6d20da 100644 --- a/windows/keep-secure/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md +++ b/windows/keep-secure/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md @@ -2,91 +2,101 @@ title: Network security Restrict NTLM Add remote server exceptions for NTLM authentication (Windows 10) description: Describes the best practices, location, values, management aspects, and security considerations for the Network security Restrict NTLM Add remote server exceptions for NTLM authentication security policy setting. ms.assetid: 9b017399-0a54-4580-bfae-614c2beda3a1 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication + **Applies to** - Windows 10 + Describes the best practices, location, values, management aspects, and security considerations for the **Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication** security policy setting. + ## Reference + The **Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication** policy setting allows you to create an exception list of remote servers to which client devices are allowed to use NTLM authentication if the [Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers](network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md) policy setting is configured. + If you configure this policy setting, you can define a list of remote servers to which client devices are allowed to use NTLM authentication. + If you do not configure this policy setting, no exceptions will be applied, and if [Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers](network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md) is enabled, NTLM authentication attempts from the client devices will fail. + List the NetBIOS server names that are used by the applications as the naming format, one per line. To ensure exceptions, the names that are used by all applications need to be in the list. A single asterisk (\*) can be used anywhere in the string as a wildcard character. + ### Possible values + - User-defined list of remote servers + When you enter a list of remote servers to which clients are allowed to use NTLM authentication, the policy is defined and enabled. + - Not defined + If you do not configure this policy setting by defining a list of servers, the policy is undefined and no exceptions will be applied. + ### Best practices + 1. First enforce the [Network Security: Restrict NTLM: Audit incoming NTLM traffic](network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md) or [Network Security: Restrict NTLM: Audit NTLM authentication in this domain](network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md) policy setting and then review the operational event log to understand which servers are involved in these authentication attempts so you can decide which servers to exempt. + 2. After you have set the server exception list, enforce the [Network Security: Restrict NTLM: Audit incoming NTLM traffic](network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md) or [Network Security: Restrict NTLM: Audit NTLM authentication in this domain](network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md) policy setting and then review the operational event log again before setting the policies to block NTLM traffic. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default domain policy

      Not defined

      Default domain controller policy

      Not defined

      Stand-alone server default settings

      Not defined

      Domain controller effective default settings

      Not defined

      Member server effective default settings

      Not defined

      Client computer effective default settings

      Not defined

      + +| Server type or GPO | Default value | +| - | - | +| Default domain policy| Not defined| +| Default domain controller policy | Not defined| +| Stand-alone server default settings | Not defined| +| Domain controller effective default settings | Not defined| +| Member server effective default settings | Not defined| +| Client computer effective default settings| Not defined|   ## Policy management + This section describes the features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Group Policy + Setting and deploying this policy through Group Policy takes precedence over the setting on the local device. If the Group Policy setting is set to **Not Configured**, local settings will apply. + ### Auditing + View the operational event log to see if your server exception list is functioning as intended. Audit and block events are recorded on this device in the operational event log located in **Applications and Services Log\\Microsoft\\Windows\\NTLM**. + There are no security audit policies that can be configured to view output from this policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability -When it has been determined that the NTLM authentication protocol should not be used from a client device to any remote servers because you are required to use a more secure protocol such as Kerberos, there might be some client applications that still use NTLM. If so, and you set [Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers](network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md) to any of the deny options, those applications will fail because the outbound NTLM authentication traffic from the client computer will be blocked. + +When it has been determined that the NTLM authentication protocol should not be used from a client device to any remote servers because you are required to use a more secure protocol such as Kerberos, there might be some client applications that still use NTLM. If so, and you set [Network Security: +Restrict NTLM: Outgoing NTLM traffic to remote servers](network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md) to any of the deny options, those applications will fail because the outbound NTLM authentication traffic from the client computer will be blocked. + If you define an exception list of servers to which client devices are allowed to use NTLM authentication, then NTLM authentication traffic will continue to flow between those client applications and servers. The servers then are vulnerable to any malicious attack that takes advantage of security weaknesses in NTLM. + ### Countermeasure -When you use [Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers](network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md) in audit-only mode, you can determine by reviewing which client applications are making NTLM authentication requests to the remote servers in your environment. When assessed, you will have to determine on a case-by-case basis if NTLM authentication still minimally meets your security requirements. If not, the client application has to be upgraded to use something other than NTLM authentication. + +When you use [Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers](network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md) in audit-only mode, you can determine by reviewing which client applications are making NTLM authentication requests to the remote +servers in your environment. When assessed, you will have to determine on a case-by-case basis if NTLM authentication still minimally meets your security requirements. If not, the client application has to be upgraded to use something other than NTLM authentication. + ### Potential impact + Defining a list of servers for this policy setting will enable NTLM authentication traffic from the client application that uses those servers, and this might result in a security vulnerability. + If this list is not defined and [Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers](network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md) is enabled, then client applications that use NTLM will fail to authenticate to those servers that they have previously used. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md b/windows/keep-secure/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md index a9dd8ee023..8a29a1cbad 100644 --- a/windows/keep-secure/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md +++ b/windows/keep-secure/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md @@ -2,91 +2,101 @@ title: Network security Restrict NTLM Add server exceptions in this domain (Windows 10) description: Describes the best practices, location, values, management aspects, and security considerations for the Network security Restrict NTLM Add server exceptions in this domain security policy setting. ms.assetid: 2f981b68-6aa7-4dd9-b53d-d88551277cc0 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Network security: Restrict NTLM: Add server exceptions in this domain + **Applies to** - Windows 10 + Describes the best practices, location, values, management aspects, and security considerations for the **Network security: Restrict NTLM: Add server exceptions in this domain** security policy setting. + ## Reference + The **Network security: Restrict NTLM: Add server exceptions in this domain** policy setting allows you to create an exception list of servers in this domain to which client device are allowed to use NTLM pass-through authentication if any of the deny options are set in the [Network Security: Restrict NTLM: NTLM authentication in this domain](network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md) policy setting. + If you configure this policy setting, you can define a list of servers in this domain to which client devices are allowed to use NTLM authentication. + If you do not configure this policy setting, no exceptions will be applied, and if **Network Security: Restrict NTLM: NTLM authentication in this domain** is enabled, all NTLM authentication attempts in the domain will fail. + List the NetBIOS server names as the naming format, one per line. A single asterisk (\*) can be used anywhere in the string as a wildcard character. + ### Possible values + - User-defined list of servers + When you enter a list of servers in this domain to which clients are allowed to use NTLM authentication, the policy is defined and enabled. + - Not defined + If you do not configure this policy setting by defining a list of servers, the policy is undefined and no exceptions will be applied. + ### Best practices + 1. First enforce the **Network Security: Restrict NTLM: Audit NTLM authentication in this domain** policy setting, and then review the operational event log to understand what domain controllers are involved in these authentication attempts so you can decide which servers to exempt. 2. After you have set the server exception list, enforce the **Network Security: Restrict NTLM: Audit NTLM authentication in this domain** policy setting, and then review the operational event log again before setting the policies to block NTLM traffic. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default domain policy

      Not defined

      Default domain controller policy

      Not defined

      Stand-alone server default settings

      Not defined

      Domain controller effective default settings

      Not defined

      Member server effective default settings

      Not defined

      Client computer effective default settings

      Not defined

      + +| Server type or GPO | Default value | +| - | - | +| Default domain policy| Not defined | +| Default domain controller policy | Not defined| +| Stand-alone server default settings | Not defined| +| Domain controller effective default settings | Not defined| +| Member server effective default settings | Not defined| +| Client computer effective default settings | Not defined|   ## Policy management + This section describes different features and tools available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a restart when saved locally or distributed through Group Policy. + ### Group Policy + Setting and deploying this policy via Group Policy takes precedence over the setting on the local device. If the Group Policy is set to **Not Configured**, local settings will apply. + ### Auditing + View the operational event log to see if your server exception list is functioning as intended. Audit and block events are recorded on this computer in the operational event log located in **Applications and Services Log\\Microsoft\\Windows\\NTLM**. + There are no security audit policies that can be configured to view output from this policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability -When it has been determined that the NTLM authentication protocol should not be used within a domain because you are required to use a more secure protocol such as Kerberos, there might be some NTLM authentication traffic that is still present in the domain. If so, and you set Network Security: [Network Security: Restrict NTLM: NTLM authentication in this domain](network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md) to any of the deny options, any NTLM authentication request will fail because the pass-through member server will block the NTLM request. -If you define an exception list of servers in this domain to which client computers are allowed to use NTLM pass-through authentication, then NTLM authentication traffic will continue to flow between those servers, which make them vulnerable to any malicious attack that takes advantage of security weaknesses in NTLM. + +When it has been determined that the NTLM authentication protocol should not be used within a domain because you are required to use a more secure protocol such as Kerberos, there might be some NTLM authentication traffic that is still present in the domain. If so, and you set Network Security: +[Network Security: Restrict NTLM: NTLM authentication in this domain](network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md) to any of the deny options, any NTLM authentication request will fail because the pass-through member server will block the NTLM request. + +If you define an exception list of servers in this domain to which client computers are allowed to use NTLM pass-through authentication, then NTLM authentication traffic will continue to flow between those servers, which make them vulnerable to any malicious attack that takes advantage of security +weaknesses in NTLM. + ### Countermeasure -When you use **Network Security: Restrict NTLM: NTLM authentication in this domain** in audit-only mode, you can determine by reviewing which client applications are making NTLM authentication requests to the pass-through authentication servers. When assessed, you will have to determine on a case-by-case basis if NTLM authentication still minimally meets your security requirements. + +When you use **Network Security: Restrict NTLM: NTLM authentication in this domain** in audit-only mode, you can determine by reviewing which client applications are making NTLM authentication requests to the pass-through authentication servers. When assessed, you will have to determine on a +case-by-case basis if NTLM authentication still minimally meets your security requirements. + ### Potential impact + Defining a list of servers for this policy setting will enable NTLM authentication traffic between those servers might result in a security vulnerability. + If this list is not defined and **Network Security: Restrict NTLM: NTLM authentication in this domain** is enabled, then NTLM authentication will fail on those pass-through servers in the domain that they have previously used + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md b/windows/keep-secure/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md index 1f01809e6d..30716f504d 100644 --- a/windows/keep-secure/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md +++ b/windows/keep-secure/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md @@ -2,93 +2,104 @@ title: Network security Restrict NTLM Audit incoming NTLM traffic (Windows 10) description: Describes the best practices, location, values, management aspects, and security considerations for the Network Security Restrict NTLM Audit incoming NTLM traffic security policy setting. ms.assetid: 37e380c2-22e1-44cd-9993-e12815b845cf -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Network security: Restrict NTLM: Audit incoming NTLM traffic + **Applies to** - Windows 10 + Describes the best practices, location, values, management aspects, and security considerations for the **Network Security: Restrict NTLM: Audit incoming NTLM traffic** security policy setting. + ## Reference + The **Network Security: Restrict NTLM: Audit incoming NTLM traffic** policy setting allows you to audit incoming NTLM traffic. + When this audit policy is enabled within Group Policy, it is enforced on any server where that Group Policy is distributed. The events will be recorded in the operational event log located in **Applications and Services Log\\Microsoft\\Windows\\NTLM**. Using an audit event collection system can help you collect the events for analysis more efficiently. + When you enable this policy on a server, only authentication traffic to that server will be logged. -When you enable this audit policy, it functions in the same way as the [Network Security: Restrict NTLM: Incoming NTLM traffic](network-security-restrict-ntlm-incoming-ntlm-traffic.md) policy, but it does not actually block any traffic. Therefore, you can use it effectively to understand the authentication traffic in your environment, and when you are ready to block that traffic, you can enable the Network Security: Restrict NTLM: Incoming NTLM traffic policy setting and select **Deny all accounts** or **Deny all domain accounts**. + +When you enable this audit policy, it functions in the same way as the [Network Security: Restrict NTLM: Incoming NTLM traffic](network-security-restrict-ntlm-incoming-ntlm-traffic.md) policy, but it does not actually block any traffic. Therefore, you can use it effectively to understand the +authentication traffic in your environment, and when you are ready to block that traffic, you can enable the Network Security: Restrict NTLM: Incoming NTLM traffic policy setting and select **Deny all accounts** or **Deny all domain accounts**. + ### Possible values + - Disable + The server on which this policy is set will not log events for incoming NTLM traffic. + - Enable auditing for domain accounts + The server on which this policy is set will log events for NTLM pass-through authentication requests only for accounts in the domain that would be blocked when the [Network Security: Restrict NTLM: Incoming NTLM traffic](network-security-restrict-ntlm-incoming-ntlm-traffic.md) policy setting is set to **Deny all domain accounts**. + - Enable auditing for all accounts + The server on which this policy is set will log events for all NTLM authentication requests that would be blocked when the [Network Security: Restrict NTLM: Incoming NTLM traffic](network-security-restrict-ntlm-incoming-ntlm-traffic.md) policy setting is set to **Deny all accounts**. + - Not defined + This is the same as **Disable**, and it results in no auditing of NTLM traffic. + ### Best practices + Depending on your environment and the duration of your testing, monitor the log size regularly. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default domain policy

      Not defined

      Default domain controller policy

      Not defined

      Stand-alone server default settings

      Not defined

      Domain controller effective default settings

      Not defined

      Member server effective default settings

      Not defined

      Client computer effective default settings

      Not defined

      + +| Server type or GPO | Default value | +| - | - | +| Default domain policy| Not defined| +| Default domain controller policy | Not defined| +| Stand-alone server default settings | Not defined| +| Domain controller effective default settings | Not defined| +| Member server effective default settings | Not defined| +| Client computer effective default settings | Not defined|   ## Policy management + This section describes different features and tools available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a restart when saved locally or distributed through Group Policy. + ### Group Policy + Setting and deploying this policy using Group Policy takes precedence over the setting on the local device. If the Group Policy is set to **Not Configured**, local settings will apply. + ### Auditing + View the operational event log to see if this policy is functioning as intended. Audit and block events are recorded on this computer in the operational event log located in **Applications and Services Log\\Microsoft\\Windows\\NTLM**. Using an audit event collection system can help you collect the events for analysis more efficiently. + There are no security audit event policies that can be configured to view output from this policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + NTLM and NTLMv2 authentication is vulnerable to a variety of malicious attacks, including SMB relay, man-in-the-middle attacks, and brute force attacks. Reducing and eliminating NTLM authentication from your environment forces the Windows operating system to use more secure protocols, such as the Kerberos version 5 protocol, or different authentication mechanisms, such as smart cards. + ### Vulnerability + Enabling this policy setting will reveal through logging which servers and client computers within your network or domain handle NTLM traffic. The identity of these devices can be used in malicious ways if NTLM authentication traffic is compromised. The policy setting does not prevent or mitigate any vulnerability because it is for audit purposes only. + ### Countermeasure + Restrict access to the log files when this policy setting is enabled in your production environment. + ### Potential impact + If you do not enable or configure this policy setting, no NTLM authentication traffic information will be logged. If you do enable this policy setting, only auditing functions will occur; no security enhancements will be implemented. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md b/windows/keep-secure/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md index 6f7df9f011..4bda1da37a 100644 --- a/windows/keep-secure/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md +++ b/windows/keep-secure/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md @@ -2,92 +2,101 @@ title: Network security Restrict NTLM Audit NTLM authentication in this domain (Windows 10) description: Describes the best practices, location, values, management aspects, and security considerations for the Network Security Restrict NTLM Audit NTLM authentication in this domain security policy setting. ms.assetid: 33183ef9-53b5-4258-8605-73dc46335e6e -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Network security: Restrict NTLM: Audit NTLM authentication in this domain + **Applies to** - Windows 10 + Describes the best practices, location, values, management aspects, and security considerations for the **Network Security: Restrict NTLM: Audit NTLM authentication in this domain** security policy setting. + ## Reference + The **Network Security: Restrict NTLM: Audit NTLM authentication in this domain** policy setting allows you to audit on the domain controller NTLM authentication in that domain. + When you enable this policy setting on the domain controller, only authentication traffic to that domain controller will be logged. + When you enable this audit policy, it functions in the same way as the **Network Security: Restrict NTLM: NTLM authentication in this domain** policy setting, but it does not actually block any traffic. Therefore, you can use it effectively to understand the authentication traffic to your domain controllers and when you are ready to block that traffic, you can enable the **Network Security: Restrict NTLM: NTLM authentication in this domain** policy setting and select **Deny for domain accounts to domain servers**, **Deny for domain servers**, or **Deny for domain accounts**. + ### Possible values + - **Disable** + The domain controller on which this policy is set will not log events for incoming NTLM traffic. + - **Enable for domain accounts to domain servers** + The domain controller on which this policy is set will log events for NTLM authentication logon attempts for accounts in the domain to domain servers when NTLM authentication would be denied because the **Network security: Restrict NTLM: NTLM authentication in this domain** policy setting is set to **Deny for domain accounts to domain servers**. + - **Enable for domain accounts** + The domain controller will log events for NTLM authentication logon attempts that use domain accounts when NTLM authentication would be denied because the **Network security: Restrict NTLM: NTLM authentication in this domain** policy setting is set to **Deny for domain accounts**. + - Not defined + This is the same as **Disable** and results in no auditing of NTLM traffic. + ### Best practices + Depending on your environment and the duration of your testing, monitor the operational event log size regularly. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default domain policy

      Not defined

      Default domain controller policy

      Not defined

      Stand-alone server default settings

      Not defined

      Domain controller effective default settings

      Not defined

      Member server effective default settings

      Not defined

      Client computer effective default settings

      Not defined

      + +| Server type or GPO | Default value | +| - | - | +| Default domain policy| Not defined| +| Default domain controller policy | Not defined| +| Stand-alone server default settings | Not defined| +| Domain controller effective default settings | Not defined| +| Member server effective default settings | Not defined| +| Client computer effective default settings | Not defined|   ## Policy management + This section describes different features and tools available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a restart when saved locally or distributed through Group Policy. + ### Group Policy + Setting and deploying this policy using Group Policy takes precedence over the setting on the local device. If the Group Policy is set to **Not Configured**, local settings will apply. + ### Auditing + View the operational event log to see if this policy is functioning as intended. Audit and block events are recorded on this computer in the operational event log located in **Applications and Services Log\\Microsoft\\Windows\\NTLM**. Using an audit event collection system can help you collect the events for analysis more efficiently. + There are no security audit event policies that can be configured to view output from this policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. -NTLM and NTLMv2 authentication is vulnerable to a variety of malicious attacks, including SMB replay, man-in-the-middle attacks, and brute force attacks. Reducing and eliminating NTLM authentication from your environment forces the Windows operating system to use more secure protocols, such as the Kerberos version 5 protocol, or different authentication mechanisms, such as smart cards. + +NTLM and NTLMv2 authentication is vulnerable to a variety of malicious attacks, including SMB replay, man-in-the-middle attacks, and brute force attacks. Reducing and eliminating NTLM authentication from your environment forces the Windows operating system to use more secure protocols, such as the +Kerberos version 5 protocol, or different authentication mechanisms, such as smart cards. + ### Vulnerability + Enabling this policy setting will reveal through logging which devices within your network or domain handle NTLM traffic. The identity of these devices can be used in malicious ways if NTLM authentication traffic is compromised. The policy setting does not prevent or mitigate any vulnerability because it is for audit purposes only. ### Countermeasure + Restrict access to the log files when this policy setting is enabled in your production environment. + ### Potential impact + If you do not enable or configure this policy setting, no NTLM authentication traffic information will be logged. If you do enable this policy setting, only auditing functions will occur; no security enhancements will be implemented. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/network-security-restrict-ntlm-incoming-ntlm-traffic.md b/windows/keep-secure/network-security-restrict-ntlm-incoming-ntlm-traffic.md index 500af92295..270051f5d3 100644 --- a/windows/keep-secure/network-security-restrict-ntlm-incoming-ntlm-traffic.md +++ b/windows/keep-secure/network-security-restrict-ntlm-incoming-ntlm-traffic.md @@ -2,90 +2,99 @@ title: Network security Restrict NTLM Incoming NTLM traffic (Windows 10) description: Describes the best practices, location, values, management aspects, and security considerations for the Network Security Restrict NTLM Incoming NTLM traffic security policy setting. ms.assetid: c0eff7d3-ed59-4004-908a-2205295fefb8 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Network security: Restrict NTLM: Incoming NTLM traffic + **Applies to** - Windows 10 + Describes the best practices, location, values, management aspects, and security considerations for the **Network Security: Restrict NTLM: Incoming NTLM traffic** security policy setting. + ## Reference + The **Network Security: Restrict NTLM: Incoming NTLM traffic** policy setting allows you to deny or allow incoming NTLM traffic from client computers, other member servers, or a domain controller. + ### Possible values + - **Allow all** + The server will allow all NTLM authentication requests. + - **Deny all domain accounts** + The server will deny NTLM authentication requests for domain logon, return an NTLM blocked error message to the client device, and log the error, but the server will allow local account logon. + + - **Deny all accounts** + The server will deny NTLM authentication requests from all incoming traffic (whether domain account logon or local account logon), return an NTLM blocked error message to the client device, and log the error. + - Not defined + This is the same as **Allow all**, and the server will allow all NTLM authentication requests. + ### Best practices + If you select **Deny all domain accounts** or **Deny all accounts**, incoming NTLM traffic to the member server will be restricted. It is better to set the **Network Security: Restrict NTLM: Audit Incoming NTLM traffic** policy setting and then review the Operational log to understand what authentication attempts are made to the member servers, and subsequently what client applications are using NTLM. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default domain policy

      Not defined

      Default domain controller policy

      Not defined

      Stand-alone server default settings

      Not defined

      Domain controller effective default settings

      Not defined

      Member server effective default settings

      Not defined

      Client computer effective default settings

      Not defined

      + +| Server type or GPO | Default value | +| - | - | +| Default domain policy| Not defined| +| Default domain controller policy | Not defined | +| Stand-alone server default settings | Not defined| +| Domain controller effective default settings | Not defined| +| Member server effective default settings | Not defined| +| Client computer effective default settings | Not defined|   ## Policy management + This section describes different features and tools available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a restart when saved locally or distributed through Group Policy. + ### Group Policy + Setting and deploying this policy using Group Policy takes precedence over the setting on the local device. If the Group Policy is set to **Not Configured**, local settings will apply. + ### Auditing + View the operational event log to see if this policy is functioning as intended. Audit and block events are recorded on this computer in the operational event log located in **Applications and Services Log\\Microsoft\\Windows\\NTLM**. + There are no Security Audit Event policies that can be configured to view event output from this policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + NTLM and NTLMv2 authentication is vulnerable to a variety of malicious attacks, including SMB replay, man-in-the-middle attacks, and brute force attacks. Reducing and eliminating NTLM authentication from your environment forces the Windows operating system to use more secure protocols, such as the Kerberos version 5 protocol, or different authentication mechanisms, such as smart cards. + ### Vulnerability + Malicious attacks on NTLM authentication traffic that result in a compromised server can occur only if the server handles NTLM requests. If those requests are denied, brute force attacks on NTLM are eliminated. + ### Countermeasure + When it has been determined that the NTLM authentication protocol should not be used within a network because you are required to use a more secure protocol such as Kerberos, you can select one of several options that this security policy setting offers to restrict NTLM usage. + ### Potential impact -If you configure this policy setting, numerous NTLM authentication requests could fail within your network, which could degrade productivity. Before implementing this change through this policy setting, set **Network security: Restrict NTLM: Audit Incoming NTLM traffic** to the same option so that you can review the log for the potential impact, perform an analysis of servers, and create an exception list of servers to exclude from this policy setting [Network security: Restrict NTLM: Add server exceptions in this domain](network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md). + +If you configure this policy setting, numerous NTLM authentication requests could fail within your network, which could degrade productivity. Before implementing this change through this policy setting, set **Network security: Restrict NTLM: Audit Incoming NTLM traffic** to the same option so that +you can review the log for the potential impact, perform an analysis of servers, and create an exception list of servers to exclude from this policy setting [Network security: Restrict NTLM: Add server exceptions in this domain](network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md). + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md b/windows/keep-secure/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md index 27500c1d95..8389b3ad72 100644 --- a/windows/keep-secure/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md +++ b/windows/keep-secure/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md @@ -2,95 +2,108 @@ title: Network security Restrict NTLM NTLM authentication in this domain (Windows 10) description: Describes the best practices, location, values, management aspects, and security considerations for the Network Security Restrict NTLM NTLM authentication in this domain security policy setting. ms.assetid: 4c7884e9-cc11-4402-96b6-89c77dc908f8 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Network security: Restrict NTLM: NTLM authentication in this domain + **Applies to** - Windows 10 + Describes the best practices, location, values, management aspects, and security considerations for the **Network Security: Restrict NTLM: NTLM authentication in this domain** security policy setting. + ## Reference + The **Network Security: Restrict NTLM: NTLM authentication in this domain** policy setting allows you to deny or allow NTLM authentication within a domain from this domain controller. This policy setting does not affect interactive logon to this domain controller. + ### Possible values + - **Disable** + The domain controller will allow all NTLM pass-through authentication requests within the domain. + - **Deny for domain accounts to domain servers** + The domain controller will deny all NTLM authentication logon attempts using accounts from this domain to all servers in the domain. The NTLM authentication attempts will be blocked and will return an NTLM blocked error unless the server name is on the exception list in the **Network security: Restrict NTLM: Add server exceptions in this domain** policy setting. + NTLM can be used if the users are connecting to other domains. This depends on if any Restrict NTLM policies have been set on those domains. + - **Deny for domain accounts** + Only the domain controller will deny all NTLM authentication logon attempts from domain accounts and will return an NTLM blocked error unless the server name is on the exception list in the **Network security: Restrict NTLM: Add server exceptions in this domain** policy setting. + - **Deny for domain servers** + The domain controller will deny NTLM authentication requests to all servers in the domain and will return an NTLM blocked error unless the server name is on the exception list in the **Network security: Restrict NTLM: Add server exceptions in this domain** policy setting. Servers that are not joined to the domain will not be affected if this policy setting is configured. + - **Deny all** + The domain controller will deny all NTLM pass-through authentication requests from its servers and for its accounts and return an NTLM blocked error unless the server name is on the exception list in the **Network security: Restrict NTLM: Add server exceptions in this domain** policy setting. + - Not defined + The domain controller will allow all NTLM authentication requests in the domain where the policy is deployed. + ### Best practices + If you select any of the deny options, incoming NTLM traffic to the domain will be restricted. First, set the **Network Security: Restrict NTLM: Audit NTLM authentication in this domain** policy setting, and then review the Operational log to understand what authentication attempts are made to the member servers. You can then add those member server names to a server exception list by using the [Network security: Restrict NTLM: Add server exceptions in this domain](network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md) policy setting. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default domain policy

      Not configured

      Default domain controller policy

      Not configured

      Stand-alone server default settings

      Not configured

      Domain controller effective default settings

      Not configured

      Member server effective default settings

      Not configured

      Client computer effective default settings

      Not configured

      + +| Server type or GPO | Default value | +| - | - | +| Default domain policy| Not configured| +| Default domain controller policy | Not configured| +| Stand-alone server default settings | Not configured| +| Domain controller effective default settings | Not configured| +| Member server effective default settings | Not configured | +| Client computer effective default settings | Not configured|   ## Policy management + This section describes different features and tools available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a restart when saved locally or distributed through Group Policy. + ### Group Policy + Setting and deploying this policy using Group Policy takes precedence over the setting on the local device. If the Group Policy is set to **Not Configured**, local settings will apply. + ### Auditing + View the operational event log to see if this policy is functioning as intended. Audit and block events are recorded on this computer in the operational event log located in **Applications and Services Log\\Microsoft\\Windows\\NTLM**. + There are no security audit event policies that can be configured to view output from this policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + NTLM and NTLMv2 authentication is vulnerable to a variety of malicious attacks, including SMB replay, man-in-the-middle attacks, and brute force attacks. Reducing and eliminating NTLM authentication from your environment forces the Windows operating system to use more secure protocols, such as the Kerberos version 5 protocol, or different authentication mechanisms, such as smart cards. + ### Vulnerability + Malicious attacks on NTLM authentication traffic resulting in a compromised server or domain controller can occur only if the server or domain controller handles NTLM requests. If those requests are denied, this attack vector is eliminated. + ### Countermeasure -When it has been determined that the NTLM authentication protocol should not be used within a network because you are required to use a more secure protocol such as the Kerberos protocol, then you can select one of several options that this security policy setting offers to restrict NTLM usage within the domain. + +When it has been determined that the NTLM authentication protocol should not be used within a network because you are required to use a more secure protocol such as the Kerberos protocol, then you can select one of several options that this security policy setting offers to restrict NTLM usage +within the domain. + ### Potential impact + If you configure this policy setting, numerous NTLM authentication requests could fail within the domain, which could degrade productivity. Before implementing this change through this policy setting, set **Network security: Restrict NTLM: Audit NTLM authentication in this domain** to the same option so that you can review the log for the potential impact, perform an analysis of servers, and create an exception list of servers to exclude from this policy setting by using [Network security: Restrict NTLM: Add server exceptions in this domain](network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md). + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md b/windows/keep-secure/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md index b73aff9db6..439657d395 100644 --- a/windows/keep-secure/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md +++ b/windows/keep-secure/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md @@ -2,93 +2,100 @@ title: Network security Restrict NTLM Outgoing NTLM traffic to remote servers (Windows 10) description: Describes the best practices, location, values, management aspects, and security considerations for the Network Security Restrict NTLM Outgoing NTLM traffic to remote servers security policy setting. ms.assetid: 63437a90-764b-4f06-aed8-a4a26cf81bd1 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers + **Applies to** - Windows 10 + Describes the best practices, location, values, management aspects, and security considerations for the **Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers** security policy setting. + ## Reference + The **Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers** policy setting allows you to deny or audit outgoing NTLM traffic from a computer running Windows 7, Windows Server 2008, or later to any remote server running the Windows operating system. -**Warning**   -Modifying this policy setting may affect compatibility with client computers, services, and applications. + +>**Warning:**  Modifying this policy setting may affect compatibility with client computers, services, and applications.   ### Possible values + - **Allow all** + The device can authenticate identities to a remote server by using NTLM authentication because no restrictions exist. + - **Audit all** + The device that sends the NTLM authentication request to a remote server logs an event for each request. This allows you to identify those servers that receive NTLM authentication requests from the client device + - **Deny all** + The device cannot authenticate any identities to a remote server by using NTLM authentication. You can use the [Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication](network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md) policy setting to define a list of remote servers to which client devices are allowed to use NTLM authentication while denying others. This setting will also log an event on the device that is making the authentication request. + - Not defined + This is the same as **Allow all**, and the device will allow all NTLM authentication requests when the policy is deployed. + ### Best practices + If you select **Deny all**, the client device cannot authenticate identities to a remote server by using NTLM authentication. First, select **Audit all** and then review the operational event log to understand which servers are involved in these authentication attempts. You can then add those server names to a server exception list by using the [Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication](network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md) policy setting. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default domain policy

      Not defined

      Default domain controller policy

      Not defined

      Stand-alone server default settings

      Not defined

      Domain controller effective default settings

      Not defined

      Member server effective default settings

      Not defined

      Client computer effective default settings

      Not defined

      + +| Server type or GPO | Default value | +| - | - | +| Default domain policy| Not defined| +| Default domain controller policy | Not defined| +| Stand-alone server default settings | Not defined| +| Domain controller effective default settings | Not defined| +| Member server effective default settings | Not defined| +| Client computer effective default settings | Not defined|   ## Policy management + This section describes different features and tools available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a restart when saved locally or distributed through Group Policy. + ### Group Policy + Setting and deploying this policy using Group Policy takes precedence over the setting on the local device. If the Group Policy is set to **Not Configured**, local settings will apply. + ### Auditing + View the operational event log to see if this policy is functioning as intended. Audit and block events are recorded on this computer in the operational event log located in **Applications and Services Log\\Microsoft\\Windows\\NTLM**. + There are no security audit event policies that can be configured to view event output from this policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + NTLM and NTLMv2 authentication is vulnerable to a variety of malicious attacks, including SMB replay, man-in-the-middle attacks, and brute force attacks. Reducing and eliminating NTLM authentication from your environment forces the Windows operating system to use more secure protocols, such as the Kerberos version 5 protocol, or different authentication mechanisms, such as smart cards. + ### Vulnerability + Malicious attacks on NTLM authentication traffic that result in a compromised server or domain controller can occur only if the server or domain controller handles NTLM requests. If those requests are denied, this attack vector is eliminated. + ### Countermeasure + When it has been determined that the NTLM authentication protocol should not be used within a network because you are required to use a more secure protocol such as Kerberos, then you can select from several options to restrict NTLM usage to servers. + ### Potential impact -If you configure this policy setting to deny all requests, numerous NTLM authentication requests to remote servers could fail, which could degrade productivity. Before implementing this restriction through this policy setting, select **Audit all** so that you can review the log for the potential impact, perform an analysis of servers, and create an exception list of servers to exclude from this policy setting by using [Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication](network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md). + +If you configure this policy setting to deny all requests, numerous NTLM authentication requests to remote servers could fail, which could degrade productivity. Before implementing this restriction through this policy setting, select **Audit all** so that you can review the log for the potential impact, perform an analysis of servers, and create an exception list of servers to exclude from this policy setting by using [Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication](network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md) +. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) From 06948bf968acffc5406a8c2335d4cd819d853bdb Mon Sep 17 00:00:00 2001 From: Tyler Donahue Date: Tue, 24 May 2016 17:01:40 -0700 Subject: [PATCH 408/439] add section for custom images, additional edu settings, and other fixes - typo on line 89 - replace variables in group policy (sleeptimeout) with absolute values since they are not customizable via set up school pcs - added note about custom images - clarified bullets about admin accounts - added some more customizations made specifically by the set up school pcs app --- .../windows/set-up-school-pcs-technical.md | 32 ++++++++++++------- 1 file changed, 21 insertions(+), 11 deletions(-) diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index dc9d74d077..32de82d832 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -60,7 +60,8 @@ The PC is also configured to not interrupt the user during normal daytime hours * On a Windows PC joined to Azure Active Directory: * By default, the account that joined the PC to Azure AD will have an admin account on that PC. Global administrators for the Azure AD domain will also have admin accounts on the PC. * With Azure AD Premium, you can specify which accounts have admin accounts on a PC using the **Additional administrators on Azure AD Joined devices** setting on the Azure portal. -* Local accounts that already exist on a PC won’t be deleted when turning on shared PC mode. However, any new local accounts created by the **Start without an account** selection on the sign-in screen (if enabled) will automatically be deleted at sign-out. +* Local accounts that already exist on a PC won’t be deleted when turning on shared PC mode. However, any new local accounts created by the **Start without an account** selection on the sign-in screen (if enabled) will automatically be deleted at sign-out. +* If admin accounts are necessary on the PC * Ensure the PC is joined to a domain that enables accounts to be signed on as admin, or * Create admin accounts before setting up shared PC mode, or * Create exempt accounts before signing out. @@ -78,7 +79,8 @@ The PC is also configured to not interrupt the user during normal daytime hours ``` - +## Custom images +Shared PC mode is fully compatible with custom images that may be created by IT departments. Create a custom image and then use sysprep with the /oobe flag to create an image that teachers can use the **Set up School PCs** app to finish provisioning themselves. [More information about sysprep](https://technet.microsoft.com/en-us/library/cc721940(v=ws.10).aspx). ## Provisioning package details @@ -86,8 +88,16 @@ The **Set up School PCs** app produces a specialized provisioning package that m ### Education customizations -- Saving content locally to the PC is disabled. This prevents data loss by forcing students to save tothe cloud. -- A custom Start layout and sign in background image are set. +- Saving content locally to the PC is disabled. This prevents data loss by forcing students to save to the cloud. +- A custom Start layout and sign in background image are set. +- Prohibits Microsoft Accounts (MSAs) from being created +- Prohibits unlocking the PC to developer mode +- Prohibits untrusted Windows Store apps from being installed +- Prohibits users removing MDM +- Prohibits users from adding new provisioning packages +- Prohibits users from removing existing provisioning packages (including the one set by **Set up School PCs** +- Sets Active hours from 6am to 6pm +- Sets Windows Update to update nightly ### Uninstalled apps @@ -137,17 +147,17 @@ The **Set up School PCs** app produces a specialized provisioning package that m

      Require a password when a computer wakes (on battery)

      Enabled

      -

      Specify the system sleep timeout (plugged in)

      SleepTimeout

      +

      Specify the system sleep timeout (plugged in)

      1 hour

      -

      Specify the system sleep timeout (on battery)

      SleepTimeout

      +

      Specify the system sleep timeout (on battery)

      1 hour

      Turn off hybrid sleep (plugged in)

      Enabled

      Turn off hybrid sleep (on battery)

      Enabled

      -

      Specify the unattended sleep timeout (plugged in)

      SleepTimeout

      +

      Specify the unattended sleep timeout (plugged in)

      1 hour

      -

      Specify the unattended sleep timeout (on battery)

      SleepTimeout

      +

      Specify the unattended sleep timeout (on battery)

      1 hour

      Allow standby states (S1-S3) when sleeping (plugged in)

      Enabled

      @@ -158,9 +168,9 @@ The **Set up School PCs** app produces a specialized provisioning package that m

      Specify the system hibernate timeout (on battery)

      Enabled, 0

      Admin Templates > System > Power Management > Video and Display Settings

      -

      Turn off the display (plugged in)

      SleepTimeout

      +

      Turn off the display (plugged in)

      1 hour

      -

      Turn off the display (on battery

      SleepTimeout

      +

      Turn off the display (on battery

      1 hour

      Admin Templates > System > Logon

      @@ -214,7 +224,7 @@ The **Set up School PCs** app produces a specialized provisioning package that m

      Admin Templates > Windows Components > Maintenance Scheduler

      -

      Automatic Maintenance Activation Boundary

      MaintenanceStartTime

      +

      Automatic Maintenance Activation Boundary

      12am

      Automatic Maintenance Random Delay

      Enabled, 2 hours

      From 8f0b93bcff2f8cd544de0b95061537dd22e39889 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 25 May 2016 08:50:13 -0700 Subject: [PATCH 409/439] add change history --- education/windows/TOC.md | 1 + education/windows/change-history-edu.md | 20 ++++++++++++++++++++ 2 files changed, 21 insertions(+) create mode 100644 education/windows/change-history-edu.md diff --git a/education/windows/TOC.md b/education/windows/TOC.md index 6708148826..4ba71e288a 100644 --- a/education/windows/TOC.md +++ b/education/windows/TOC.md @@ -1,4 +1,5 @@ # [Windows 10 for education](index.md) +## [Change history for Windows 10 for Education](change-history-edu.md) ## [Use the Set up School PCs app](use-set-up-school-pcs-app.md) ## [Set up School PCs app technical reference](set-up-school-pcs-technical.md) ## [Set up students' PCs to join domain](set-up-students-pcs-to-join-domain.md) diff --git a/education/windows/change-history-edu.md b/education/windows/change-history-edu.md new file mode 100644 index 0000000000..7926bc8c25 --- /dev/null +++ b/education/windows/change-history-edu.md @@ -0,0 +1,20 @@ +--- +title: Change history for Windows 10 for Education (Windows 10) +description: New and changed topics in Windows 10 for Education +ms.prod: W10 +ms.mktglfcycl: deploy +ms.sitesec: library +author: jdeckerMS +--- + +# Change history for Windows 10 for Education + +This topic lists new and updated topics in the [Windows 10 for Education](index.md) documentation. + +## May 2016 + +| New or changed topic | Description | +|----------------------|-------------| +| [Take tests in Windows 10](take-tests-in-windows-10.md)
      [Set up Take a Test on a single PC](take-a-test-single-pc.md)
      [Set up Take a Test on multiple PCs](take-a-test-multiple-pcs.md)
      [Take a Test app technical reference](take-a-test-app-technical.md) | New | +| [Chromebook migration guide](chromebook-migration-guide.md) | Moved from [Windows 10 and Windows 10 Mobile](https://technet.microsoft.com/en-us/itpro/windows/plan/index) library, originally published in November 2015 | +| [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) | Moved from [Windows 10 and Windows 10 Mobile](https://technet.microsoft.com/en-us/itpro/windows/plan/index) library, originally published in May 2016 | \ No newline at end of file From 9da8801d84d7ded52e4c1d35fd1690b6c10b29ee Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 25 May 2016 09:00:32 -0700 Subject: [PATCH 410/439] tweaks to techref --- .../windows/set-up-school-pcs-technical.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index 32de82d832..742103f585 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -80,7 +80,7 @@ The PC is also configured to not interrupt the user during normal daytime hours ## Custom images -Shared PC mode is fully compatible with custom images that may be created by IT departments. Create a custom image and then use sysprep with the /oobe flag to create an image that teachers can use the **Set up School PCs** app to finish provisioning themselves. [More information about sysprep](https://technet.microsoft.com/en-us/library/cc721940(v=ws.10).aspx). +Shared PC mode is fully compatible with custom images that may be created by IT departments. Create a custom image and then use sysprep with the `/oobe` flag to create an image that teachers can then apply the **Set up School PCs** provisioning package to. [Learn more about sysprep](https://technet.microsoft.com/en-us/library/cc721940(v=ws.10).aspx). ## Provisioning package details @@ -90,14 +90,14 @@ The **Set up School PCs** app produces a specialized provisioning package that m - Saving content locally to the PC is disabled. This prevents data loss by forcing students to save to the cloud. - A custom Start layout and sign in background image are set. -- Prohibits Microsoft Accounts (MSAs) from being created -- Prohibits unlocking the PC to developer mode -- Prohibits untrusted Windows Store apps from being installed -- Prohibits users removing MDM -- Prohibits users from adding new provisioning packages -- Prohibits users from removing existing provisioning packages (including the one set by **Set up School PCs** -- Sets Active hours from 6am to 6pm -- Sets Windows Update to update nightly +- Prohibits Microsoft Accounts (MSAs) from being created. +- Prohibits unlocking the PC to developer mode. +- Prohibits untrusted Windows Store apps from being installed. +- Prohibits students from removing MDM. +- Prohibits students from adding new provisioning packages. +- Prohibits student from removing existing provisioning packages (including the one set by **Set up School PCs**). +- Sets active hours from 6 AM to 6 PM. +- Sets Windows Update to update nightly. ### Uninstalled apps From a0f6d4e8b7d9318fa92262f00157895fb111f0c2 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 25 May 2016 09:06:59 -0700 Subject: [PATCH 411/439] prep for initial publication --- education/windows/TOC.md | 6 - .../windows/get-minecraft-for-education.md | 44 --- education/windows/index.md | 4 - education/windows/school-get-minecraft.md | 72 ----- .../windows/set-up-school-pcs-technical.md | 262 ------------------ .../set-up-students-pcs-to-join-domain.md | 69 ----- education/windows/teacher-get-minecraft.md | 60 ---- .../windows/use-set-up-school-pcs-app.md | 117 -------- 8 files changed, 634 deletions(-) delete mode 100644 education/windows/get-minecraft-for-education.md delete mode 100644 education/windows/school-get-minecraft.md delete mode 100644 education/windows/set-up-school-pcs-technical.md delete mode 100644 education/windows/set-up-students-pcs-to-join-domain.md delete mode 100644 education/windows/teacher-get-minecraft.md delete mode 100644 education/windows/use-set-up-school-pcs-app.md diff --git a/education/windows/TOC.md b/education/windows/TOC.md index 4ba71e288a..4bc5d61f86 100644 --- a/education/windows/TOC.md +++ b/education/windows/TOC.md @@ -1,11 +1,5 @@ # [Windows 10 for education](index.md) ## [Change history for Windows 10 for Education](change-history-edu.md) -## [Use the Set up School PCs app](use-set-up-school-pcs-app.md) -## [Set up School PCs app technical reference](set-up-school-pcs-technical.md) -## [Set up students' PCs to join domain](set-up-students-pcs-to-join-domain.md) -## [Get Minecraft Education Edition](get-minecraft-for-education.md) -### [For teachers: get Minecraft Education Edition](teacher-get-minecraft.md) -### [For IT admins: get Minecraft Education Edition](school-get-minecraft.md) ## [Take tests in Windows 10](take-tests-in-windows-10.md) ### [Set up Take a Test on a single PC](take-a-test-single-pc.md) ### [Set up Take a Test on multiple PCs](take-a-test-multiple-pcs.md) diff --git a/education/windows/get-minecraft-for-education.md b/education/windows/get-minecraft-for-education.md deleted file mode 100644 index 21bd8a182f..0000000000 --- a/education/windows/get-minecraft-for-education.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: Get Minecraft Education Edition -description: Learn how to get and distribute Minecraft Education Edition. -keywords: school -ms.prod: W10 -ms.mktglfcycl: plan -ms.sitesec: library -author: jdeckerMS ---- - -# Get Minecraft Education Edition - -**Applies to:** - -- Windows 10 - - -> [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] - -[Minecraft: Education Edition](http://education.minecraft.net/) is built for learning. Watch this video to learn more about Minecraft. - - - -Teachers and IT administrators can now get early access to **Minecraft Education Edition** and add it their Microsoft Store for Business for distribution. - -![education.minecraft.net](images/minecraft.png) - -## Prerequisites - -- **Minecraft Education Edition** requires Windows 10. -- Early access to **Minecraft Education Edition** is offered to education tenants that are managed by Azure Active Directory (Azure AD). - - If your school doesn't have an Azure AD tenant, the [IT administrator can set one up](school-get-minecraft.md) as part of the process of getting **Minecraft Education Edition**. - * Office 365, which includes online versions of Office apps plus 1 TB online storage and [Microsoft Classroom](https://classroom.microsoft.com/), is free for teachers and students. [Sign up your school for Office 365 Education.](https://products.office.com/en-us/academic/office-365-education-plan) - * If your school has an Office 365 Education subscription, it includes a free Azure AD subscription. [Register your free Azure AD subscription.](https://msdn.microsoft.com/en-us/library/windows/hardware/mt703369%28v=vs.85%29.aspx) - -![teacher](images/teacher.png) - -[Learn how teachers can get and distribute **Minecraft Education Edition**](teacher-get-minecraft.md) - - -![IT administrator](images/school.png) - -[Learn how IT administrators can get and distribute **Minecraft Education Edition**](school-get-minecraft.md), and how to manage permissions for Minecraft. - diff --git a/education/windows/index.md b/education/windows/index.md index f7f9f123f0..5ab182367a 100644 --- a/education/windows/index.md +++ b/education/windows/index.md @@ -16,10 +16,6 @@ author: jdeckerMS |Topic |Description | |------|------------| -|[Use Set up School PCs app](use-set-up-school-pcs-app.md) | Learn how to use the **Set up School PCs** app to quickly configure new Windows 10 PCs for students. | -| [Set up School PCs app technical reference](set-up-school-pcs-technical.md) | This topic provides prerequisites and provisioning details for using the **Set up School PCs** app. | -| [Set up students' PCs to join domain](set-up-students-pcs-to-join-domain.md) | Learn how to create provisioning packages to easily configure student's PCs to join your Active Directory domain. | -| [Get Minecraft: Education Edition](get-minecraft-for-education.md) | Learn how to get free early access to **Minecraft: Education Edition** and distribute it to your students. | | [Take tests in Windows 10](take-tests-in-windows-10.md) | Learn how to configure and use the **Take a Test** app in Windows 10 | | [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) | Learn how to deploy Windows 10 in classrooms; integrate the school environment with Microsoft Office 365, Active Directory Domain Services (AD DS), and Microsoft Azure Active Directory (Azure AD); and deploy Windows 10 and your apps to new devices or upgrade existing devices to Windows 10. | | [Chromebook migration guide](chromebook-migration-guide.md) | Learn how to migrate a Google Chromebook-based learning environment to a Windows 10-based learning environment. | diff --git a/education/windows/school-get-minecraft.md b/education/windows/school-get-minecraft.md deleted file mode 100644 index 684fb0e0c2..0000000000 --- a/education/windows/school-get-minecraft.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: For IT administrators get Minecraft Education Edition -description: Learn how IT admins can get and distribute Minecraft in their schools. -keywords: ["school"] -ms.prod: W10 -ms.mktglfcycl: plan -ms.sitesec: library -author: jdeckerMS ---- - -# For IT administrators: get Minecraft Education Edition - -**Applies to:** - -- Windows 10 - - -> [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] - -When you sign up for early access to [Minecraft Education Edition](http://education.minecraft.net), Minecraft will be added to the inventory in your Windows Store for Business, a private version of Windows Store associated with your Azure Active Directory (Azure AD) tenant. Your Store for Business is only displayed to members of your organization. - -> **Note**: If you don't have an Azure AD or Office 365 tenant, you can set up a free Office 365 subscription when you request Minecraft Education Edition. - -## Add Minecraft to your Windows Store for Business - -1. Go to [http://education.minecraft.net/](http://education.minecraft.net/) and select **Get the app**. - - ![Click Get the app](images/it-get-app.png) - -2. Enter your email address. - - ![Enter school email address](images/enter-email.png) - - - If your email address isn't associated to an Azure AD or Office 365 tenant, you'll be asked to fill in a form. The information will be used to create an Office 365 subscription for your school. - -3. Select **Get the app**. This will take you to the Windows Store for Business to download the app. You will also receive an email with instructions and a link to the Store. - - ![You can get the app now](images/get-the-app.png) - -4. Sign in to Windows Store for Business with your email address. - -5. Read and accept the Windows Store for Business Service Agreement, and then select **Next**. - -6. **Minecraft Education Edition** opens in the Windows Store for Business. Select **Get the app**. This places **Minecraft Education Edition** in your Store inventory. - - ![Get Minecraft app in Store](images/get-app-store.png) - -## Distribute Minecraft - -After Minecraft Education Edition is added to your Windows Store for Business, you have three options: - -- You can install the app on your PC. -- You can assign the app to others. Enter email addresses for your students, and each student will get an email with a link to install the app. This option is best for older, more-tech savvy students who always use the same PC at school. -- You can download the app to distribute. This downloads a provisioning package (.ppkg) file. You save the file on a USB drive, and install the app on PCs from the UBb drive. This option is best for younger students and for shared computers. - -![App distribution options](images/app-distribution-options.png) - -## Manage permissions for Minecraft Education Edition - -![assign roles to manage Minecraft permissions](images/minecraft-perms.png) - -## Learn more - -[Roles and permissions in Windows Store for Business](https://technet.microsoft.com/itpro/windows/manage/roles-and-permissions-windows-store-for-business) - -[Troubleshoot Windows Store for Business](https://technet.microsoft.com/itpro/windows/manage/troubleshoot-windows-store-for-business) - -## Related topics - -[Get Minecraft Education Edition](get-minecraft-for-education.md) - -[For teachers get Minecraft Education Edition](teacher-get-minecraft.md) diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md deleted file mode 100644 index 742103f585..0000000000 --- a/education/windows/set-up-school-pcs-technical.md +++ /dev/null @@ -1,262 +0,0 @@ ---- -title: Set up School PCs app technical reference -description: Describes the changes that the app makes to a PC. -keywords: ["shared cart", "shared PC", "school"] -ms.prod: W10 -ms.mktglfcycl: plan -ms.sitesec: library -author: jdeckerMS ---- - -# Technical reference for the Set up School PCs app -**Applies to:** - -- Windows 10 Insider Preview - - -> [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] - -The **Set up School PCs** app helps you set up new Windows 10 PCs that work great in your school by configuring shared PC mode, available in Windows 10, version 1607. **Set up School PCs** also configures school-specific settings and policies, described in this topic. - -If your school uses Azure Active Directory (Azure AD) or Office 365, the **Set up School PCs** app will create a setup file that connects the computer to your subscription. You can also use the app to set up school PCs that anyone can use, with or without Internet connectivity. - -The following table tells you what you get using the **Set up School PCs** app in your school. - -| Feature | No Internet | Azure AD | Office 365 | Azure AD Premium | -| --- | :---: | :---: | :---: | :---: | -| **Fast sign-in**
      Each student can sign in and start using the computer in less than a minute, even on their first sign-in. | X | X | X | X | -| **Custom Start experience**\*
      The apps students need are pinned to Start, and unnecessary apps are removed. | X | X | X | X | -| **Temporary access, no sign-in required**
      This option sets up computers for common use. Anyone can use the computer without an account. | X | X | X | X | -| **School policies**\*
      Settings specific to education create a useful learning environment and the best computer performance. | X | X | X | X | -| **Azure AD Join**
      The computers are joined to your Azure AD or Office 365 subscription for centralized management. | | X | X | X | -| **Single sign-on to Office 365**
      By signing on with student IDs, students have fast access to Office 365 web apps. | | | X | X | -| **[Settings roaming](https://azure.microsoft.com/en-us/documentation/articles/active-directory-windows-enterprise-state-roaming-overview/) via Azure AD**
      Student user and application settings data can be synchronized across devices for a personalized experience. | | | | X | -| | | | | | -\* Feature applies to Windows 10 Pro, Windows 10 Pro for Education, Windows 10 Enterprise, and Windows 10 Enterprise for EDU - -> **Note**: If your school uses Active Directory, [use Windows Imaging and Configuration Designer](set-up-students-pcs-to-join-domain.md) to configure your PCs to join the domain. You can only use the **Set up School PCs** app to set up PCs that are not connected to your traditional domain. - -## Prerequisites for IT - -* If your school uses Azure AD, [configure your directory to allow devices to join](https://azure.microsoft.com/en-us/documentation/articles/active-directory-azureadjoin-setup/). If the teacher is going to set up a lot of devices, give the teacher appropriate privileges for joining devices or make a special account. -* Office 365, which includes online versions of Office apps plus 1 TB online storage and [Microsoft Classroom](https://classroom.microsoft.com/), is free for teachers and students. [Sign up your school for Office 365 Education.](https://products.office.com/en-us/academic/office-365-education-plan) -* If your school has an Office 365 Education subscription, it includes a free Azure AD subscription. [Register your free Azure AD subscription.](https://msdn.microsoft.com/en-us/library/windows/hardware/mt703369%28v=vs.85%29.aspx) -* After you set up your Office 365 Education tenant, use [Microsoft School Data Sync Preview](https://sis.microsoft.com/) to sync user profiles and class rosters from your Student Information System (SIS). - - -## Information about Windows Update - -Shared PC mode helps ensure that computers are always up-to-date. If a PC is configured using the **Set up School PCs** app, shared PC mode sets the power states and Windows Update to: -* Wake nightly -* Check and install updates -* Forcibly reboot if necessary to finish applying updates - -The PC is also configured to not interrupt the user during normal daytime hours with updates or reboots. - -## Guidance for accounts on shared PCs - -* We recommend no local admin accounts on the PC to improve the reliability and security of the PC. -* When a PC is set up in shared PC mode, accounts will be cached automatically until disk space is low. Then, accounts will be deleted to reclaim disk space. This account managment happens automatically. Both Azure AD and Active Directory domain accounts are managed in this way. Any accounts created through **Start without an account** will also be deleted automatically at sign out. -* On a Windows PC joined to Azure Active Directory: - * By default, the account that joined the PC to Azure AD will have an admin account on that PC. Global administrators for the Azure AD domain will also have admin accounts on the PC. - * With Azure AD Premium, you can specify which accounts have admin accounts on a PC using the **Additional administrators on Azure AD Joined devices** setting on the Azure portal. -* Local accounts that already exist on a PC won’t be deleted when turning on shared PC mode. However, any new local accounts created by the **Start without an account** selection on the sign-in screen (if enabled) will automatically be deleted at sign-out. -* If admin accounts are necessary on the PC - * Ensure the PC is joined to a domain that enables accounts to be signed on as admin, or - * Create admin accounts before setting up shared PC mode, or - * Create exempt accounts before signing out. -* The account management service supports accounts that are exempt from deletion. - * An account can be marked exempt from deletion by adding the account SID to the `HKEY_LOCAL_MACHINE\SOFTARE\Microsoft\Windows\CurrentVersion\SharedPC\Exemptions\` registry key. - * To add the account SID to the registry key using PowerShell: - ``` - $adminName = "LocalAdmin" - $adminPass = 'Pa$$word123' - iex "net user /add $adminName $adminPass" - $user = New-Object System.Security.Principal.NTAccount($adminName) - $sid = $user.Translate([System.Security.Principal.SecurityIdentifier]) - $sid = $sid.Value; - New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\SharedPC\Exemptions\$sid" -Force - ``` - - -## Custom images -Shared PC mode is fully compatible with custom images that may be created by IT departments. Create a custom image and then use sysprep with the `/oobe` flag to create an image that teachers can then apply the **Set up School PCs** provisioning package to. [Learn more about sysprep](https://technet.microsoft.com/en-us/library/cc721940(v=ws.10).aspx). - -## Provisioning package details - -The **Set up School PCs** app produces a specialized provisioning package that makes use of the [SharedPC configuration service provider (CSP)](https://msdn.microsoft.com/en-us/library/windows/hardware/mt723294%28v=vs.85%29.aspx). - -### Education customizations - -- Saving content locally to the PC is disabled. This prevents data loss by forcing students to save to the cloud. -- A custom Start layout and sign in background image are set. -- Prohibits Microsoft Accounts (MSAs) from being created. -- Prohibits unlocking the PC to developer mode. -- Prohibits untrusted Windows Store apps from being installed. -- Prohibits students from removing MDM. -- Prohibits students from adding new provisioning packages. -- Prohibits student from removing existing provisioning packages (including the one set by **Set up School PCs**). -- Sets active hours from 6 AM to 6 PM. -- Sets Windows Update to update nightly. - - -### Uninstalled apps - -- 3D Builder (Microsoft.3DBuilder_8wekyb3d8bbwe) -- Weather (Microsoft.BingWeather_8wekyb3d8bbwe) -- Get Started (Microsoft.Getstarted_8wekyb3d8bbwe) -- Get Office (Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe) -- Microsoft Solitaire Collection (Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe) -- Paid Wi-Fi & Cellular (Microsoft.OneConnect_8wekyb3d8bbwe) -- Feedback Hub (Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe) -- Xbox (Microsoft.XboxApp_8wekyb3d8bbwe) -- Groove Music (Microsoft.ZuneMusic_8wekyb3d8bbwe) -- Movies & TV (Microsoft.ZuneVideo_8wekyb3d8bbwe) -- Mail/Calendar (microsoft.windowscommunicationsapps_8wekyb3d8bbwe) - -### Local Group Policies - -> **Important**: It is not recommended to set additional policies on PCs configured with the **Set up School PCs** app. The shared PC mode has been optimized to be fast and reliable over time with minimal to no manual maintenance required. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

      Policy path

      Policy name

      Value

      Admin Templates > Control Panel > Personalization

      Prevent enabling lock screen slide show

      Enabled

      Prevent changing lock screen and logon image

      Enabled

      Admin Templates > System > Power Management > Button Settings

      Select the Power button action (plugged in)

      Sleep

      Select the Power button action (on battery)

      Sleep

      Select the Sleep button action (plugged in)

      Sleep

      Select the lid switch action (plugged in)

      Sleep

      Select the lid switch action (on battery)

      Sleep

      Admin Templates > System > Power Management > Sleep Settings

      Require a password when a computer wakes (plugged in)

      Enabled

      Require a password when a computer wakes (on battery)

      Enabled

      Specify the system sleep timeout (plugged in)

      1 hour

      Specify the system sleep timeout (on battery)

      1 hour

      Turn off hybrid sleep (plugged in)

      Enabled

      Turn off hybrid sleep (on battery)

      Enabled

      Specify the unattended sleep timeout (plugged in)

      1 hour

      Specify the unattended sleep timeout (on battery)

      1 hour

      Allow standby states (S1-S3) when sleeping (plugged in)

      Enabled

      Allow standby states (S1-S3) when sleeping (on battery)

      Enabled

      Specify the system hibernate timeout (plugged in)

      Enabled, 0

      Specify the system hibernate timeout (on battery)

      Enabled, 0

      Admin Templates > System > Power Management > Video and Display Settings

      Turn off the display (plugged in)

      1 hour

      Turn off the display (on battery

      1 hour

      Admin Templates > System > Logon

      Show first sign-in animation

      Disabled

      Hide entry points for Fast User Switching

      Enabled

      Turn on convenience PIN sign-in

      Disabled

      Turn off picture password sign-in

      Enabled

      Turn off app notification on the lock screen

      Enabled

      Allow users to select when a password is required when resuming from connected standby

      Disabled

      Block user from showing account details on sign-in

      Enabled

      Admin Templates > System > User Profiles

      Turn off the advertising ID

      Enabled

      Admin Templates > Windows Components

      Do not show Windows Tips

      Enabled

      Turn off Microsoft consumer experiences

      Enabled

      Microsoft Passport for Work

      Disabled

      Prevent the usage of OneDrive for file storage

      Enabled

      Admin Templates > Windows Components > Biometrics

      Allow the use of biometrics

      Disabled

      Allow users to log on using biometrics

      Disabled

      Allow domain users to log on using biometrics

      Disabled

      Admin Templates > Windows Components > Data Collection and Preview Builds

      Toggle user control over Insider builds

      Disabled

      Disable pre-release features or settings

      Disabled

      Do not show feedback notifications

      Enabled

      Admin Templates > Windows Components > File Explorer

      Show lock in the user tile menu

      Disabled

      Admin Templates > Windows Components > Maintenance Scheduler

      Automatic Maintenance Activation Boundary

      12am

      Automatic Maintenance Random Delay

      Enabled, 2 hours

      Automatic Maintenance WakeUp Policy

      Enabled

      Admin Templates > Windows Components > Microsoft Edge

      Open a new tab with an empty tab

      Disabled

      Configure corporate home pages

      Enabled, about:blank

      Admin Templates > Windows Components > Search

      Allow Cortana

      Disabled

      Windows Settings > Security Settings > Local Policies > Security Options

      Interactive logon: Do not display last user name

      Enabled

      Interactive logon: Sign-in last interactive user automatically after a system-initiated restart

      Disabled

      Shutdown: Allow system to be shut down without having to log on

      Disabled

      User Account Control: Behavior of the elevation prompt for standard users

      Auto deny



      - -## Related topics - -[Use Set up School PCs app](use-set-up-school-pcs-app.md) - - - - diff --git a/education/windows/set-up-students-pcs-to-join-domain.md b/education/windows/set-up-students-pcs-to-join-domain.md deleted file mode 100644 index 32b42572f0..0000000000 --- a/education/windows/set-up-students-pcs-to-join-domain.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: Set up student PCs to join domain -description: Learn how to use Configuration Designer to easily provision student devices to join Active Directory. -keywords: ["shared cart", "shared PC", "school"] -ms.prod: W10 -ms.mktglfcycl: plan -ms.sitesec: library -author: jdeckerMS ---- - -# Set up student PCs to join domain -**Applies to:** - -- Windows 10 - - -> [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] - -If your school uses Active Directory, use the Windows Imaging and Configuration Designer (ICD) tool included in the Windows Assessment and Deployment Kit (ADK) for Windows 10 to create a runtime provisioning package that will configure the PC for student use that is joined to the Active Directory domain. [Install the ADK.](http://go.microsoft.com/fwlink/p/?LinkId=526740) - - - -##Create the provisioning package - -1. Open Windows ICD (by default, %windir%\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe). - -2. Click **Simple provisioning**. - -3. Name your project and click **Finish**. - -4. In the **Set up device** step, enter a unique 15-character name for the device. For help generating a unique name, you can use %SERIAL%, which includes a hardware-specific serial number, or you can use %RAND:x%, which generates random characters of x length. - -5. (Optional) You can upgrade the following editions of Windows 10 by providing a product key for the edition to upgrade to. - - Home to Education - - Pro to Education - - Pro to Enterprise - - Enterprise to Education - - Mobile to Mobile Enterprise - - -6. Click **Set up network**. - -7. Toggle **On** or **Off** for wireless network connectivity. If you select **On**, enter the SSID, type, and (if required) password for the wireless network. - -8. Click **Enroll into Active Directory**. - -9. Toggle **Yes** or **No** for Active Directory enrollment. If you select **Yes**, enter the credentials for an account with permissions to enroll the device. (Optional) Enter a user name and password to create a local administrator account. - - > **Warning**: If you don't create a local administrator account and the device fails to enroll in Active Directory for any reason, you will have to reimage the device and start over. As a best practice, we recommend: - - Use a least-privileged domain account to join the device to the domain. - - Create a temporary administrator account to use for debugging or reprovisioning if the device fails to enroll successfully. - - [Use Group Policy to delete the temporary administrator account](https://blogs.technet.microsoft.com/canitpro/2014/12/10/group-policy-creating-a-standard-local-admin-account/) after the device is enrolled in Active Directory. - - -10. Click **Finish**. - -11. Review your settings in the summary. You can return to previous pages to change your selections. Then, under Protect your package, toggle **Yes** or **No** to encrypt the provisioning package. If you select **Yes**, enter a password. This password must be entered to apply the encrypted provisioning package. - -12. Click **Create**. - -> **Important** When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. - -## Apply package - - -Go to **Settings** > **Accounts** > **Work access** > **Add or remove a management package** > **Add a package**, and select the package to install. - -![add a package option](images/package.png) - diff --git a/education/windows/teacher-get-minecraft.md b/education/windows/teacher-get-minecraft.md deleted file mode 100644 index ab019d66fb..0000000000 --- a/education/windows/teacher-get-minecraft.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: For teachers get Minecraft Education Edition -description: Learn how teachers can get and distribute Minecraft. -keywords: ["school"] -ms.prod: W10 -ms.mktglfcycl: plan -ms.sitesec: library -author: jdeckerMS ---- - -# For teachers: get Minecraft Education Edition - -**Applies to:** - -- Windows 10 - - -> [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] - -(intro text) - -## Add Minecraft to your Windows Store for Business - -1. Go to [http://education.minecraft.net/](http://education.minecraft.net/) and select **Get the app**. - - ![Click Get the app](images/teacher-get-app.png) - -2. Enter your email address. - - ![Enter school email address](images/enter-email.png) - -3. Select **Get the app**. This will take you to the Windows Store for Business to download the app. You will also receive an email with instructions and a link to the Store. - - ![You can get the app now](images/get-the-app.png) - -4. Sign in to Windows Store for Business with your email address. - -5. Read and accept the Windows Store for Business Service Agreement, and then select **Next**. - -6. **Minecraft Education Edition** opens in the Windows Store for Business. Select **Get the app**. This places **Minecraft Education Edition** in your Store inventory. - - ![Get Minecraft app in Store](images/get-app-store.png) - -## Distribute Minecraft - -After Minecraft Education Edition is added to your Windows Store for Business, you have three options: - -- You can install the app on your PC. -- You can assign the app to others. Enter email addresses for your students, and each student will get an email with a link to install the app. This option is best for older, more-tech savvy students who always use the same PC at school. -- You can download the app to distribute. This downloads a provisioning package (.ppkg) file. You save the file on a USB drive, and install the app on PCs from the UBb drive. This option is best for younger students and for shared computers. - -![App distribution options](images/app-distribution-options.png) - -## Related topics - -[Get Minecraft Education Edition](get-minecraft-for-education.md) - -[For IT admins: get Minecraft Education Edition](school-get-minecraft.md) - - diff --git a/education/windows/use-set-up-school-pcs-app.md b/education/windows/use-set-up-school-pcs-app.md deleted file mode 100644 index 855a3279f6..0000000000 --- a/education/windows/use-set-up-school-pcs-app.md +++ /dev/null @@ -1,117 +0,0 @@ ---- -title: Use Set up School PCs app -description: Learn how the Set up School PCs app works and how to use it. -keywords: ["shared cart", "shared PC", "school"] -ms.prod: W10 -ms.mktglfcycl: plan -ms.sitesec: library -author: jdeckerMS ---- - -# Use the Set up School PCs app -**Applies to:** - -- Windows 10 Insider Preview - - -> [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] - -Teachers and IT administrators can use the **Set up School PCs** app to quickly set up computers for students. A computer set up using the app is tailored to provide students with the tools they need for learning while removing apps and features that they don't need. - -![Run app, turn on PC, insert USB key](images/app1.jpg) - -## What does this app do? - -The Set up School PCs app helps you set up new computers running Windows 10, version 1607. Some benefits of using this app to set up your students' PCs: -* A computer set up this way is tailored to provide students with the tools they need for learning while removing apps and features that they don't need. - * Places tiles for OneNote, Office 365 web apps, Sway, and Microsoft Classroom on the Start menu - * Installs OneDrive for cloud-based documents and places it on the Start menu and taskbar - * Sets Microsoft Edge as the default browser - * Uninstalls apps not specific to education, such as Solitaire and Sports - * Turns off Offers and tips - * Prevents students from adding personal Microsoft accounts to the computer -* Significantly improves how fast students sign-in. -* The app connects the PCs to your school’s cloud so IT can manage them (optional). -* Windows 10 automatically manages accounts no matter how many students use the PC. -* Keeps computers up-to-date without interfering with class time using Windows Update and maintenance hours (by default, 12 AM). -* Customizes the sign-in screen to support students with IDs and temporary users. -* Locks down the computer to prevent mischievous activity: - * Prevents students from installing apps - * Prevents students from removing the computer from the school's device management system - * Prevents students from removing the Set up School PCs settings - - -## Tips for success - -* **Run the app at work**: For the best results, run the **Set up School PCs** app on your work device connected to your school's network. That way the app can gather accurate information about your wireless networks and cloud subscriptions. - > **Note**: Don't use **Set up Schools PCs** app for PCs that must connect to enterprise networks or to open wi-fi networks that require the user to accept Terms of Use. -* **Apply to new computers**: The setup file that the **Set up School PCs** app creates should be used on new computers that haven't been set up for accounts yet. If you apply the setup file to a computer that has already been set up, existing accounts and data might be lost. -> **Warning**: Only use the setup file on computers that you want to configure and lock down for students. After you apply the setup file to a computer, the computer must be reset to remove the settings. -* **Turn on student PCs and stay on first screen**: The computer must be on this screen when you insert the USB key. - -![The first screen to set up a new PC](images/oobe.jpg) - -If you have gone past this screen, you may have to reset your PC to start over. To reset your PC after you have completed the first run experience, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**. -* **Use more than one USB key**: If you are setting up multiple PCs, you can set them up at the same time. Just run the **Set up School PCs** app again and save the same settings to another key. That way you can run set up on more than one PC at once. Create three keys and you can run it on three PCs at once, etc. -* **Start fresh**: If the PC has already been set up and you want to return to the first-run-experience to apply a new package, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**. -* **Keep it clean**: We strongly recommend that IT avoid changes to policies unless absolutely necessary, as any changes can impair performance and sign-in time. Get more information at [Set up School PCs app technical reference](set-up-school-pcs-technical.md). - -## Set up School PCs app step-by-step - -What you need: - -- The **Set up School PCs** app, installed on your work computer, connected to your school's network -- A USB drive, 1 GB or larger - -### Create the setup file in the app - -The **Set up School PCs** app guides you through the configuration choices for the student PCs. - -1. Open the **Set up School PCs** app and select **Start**. - - ![select start](images/app1.jpg) - -2. Choose **No** to require students to sign in with an account, or choose **Yes** to allow students to use the PC without an account, and then select **Next**. - - ![account required?](images/setup-app-1-access.png) - -3. Choose a Wi-Fi network from the list and then select **Next**, or choose **Manually connect to a wireless network** to enter the network information yourself. - - ![choose network](images/setup-app-1-wifi.png) - - - For a manual network connection, enter the network name, security type, and password (if required), and then select **Next**. - - ![enter network information](images/setup-app-1-wifi-manual.png) - -4. Insert a USB drive, select it in the app, and then select **Save**. - - ![select usb drive](images/setup-app-1-usb.png) - - - -### Apply the setup file to PCs - -The setup file on your USB drive is named SetupSchoolPCs.ppkg, which is a provisioning package. A provisioning package is a method for applying settings to Windows 10. When Windows 10 refers to *package*, it means your setup file, and when it refers to *provisioning*, it means applying the setup file to the computer. - -1. Start with a computer on the first-run setup screen. - - ![The first screen to set up a new PC](images/oobe.jpg) - -2. Insert the USB drive. Windows Setup will recognize the drive and ask you if you want to set up the device. Select **Set up**. - - ![Set up device?](images/setupmsg.jpg) - -3. The next screen asks you to select a provisioning source. Select **Removable Media** and tap **Next**. - - ![Provision this device](images/prov.jpg) - -4. Read and accept the Microsoft Software License Terms. Your last step is to sign in. Use your Azure AD or Office 365 account and password. - - ![Sign in](images/signinprov.jpg) - -That's it! The computer is now ready for students. - -## Learn more - -See [The Set up School PCs app technical reference](set-up-school-pcs-technical.md) for prerequisites and provisioning details. - From 3de247f4c1ccc0cf93f92722235ec49a0f19afb5 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 25 May 2016 09:27:24 -0700 Subject: [PATCH 412/439] add link to Heather's page --- education/windows/index.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/education/windows/index.md b/education/windows/index.md index 5ab182367a..cc96968ca3 100644 --- a/education/windows/index.md +++ b/education/windows/index.md @@ -21,4 +21,6 @@ author: jdeckerMS | [Chromebook migration guide](chromebook-migration-guide.md) | Learn how to migrate a Google Chromebook-based learning environment to a Windows 10-based learning environment. | ## Related topics -- [Windows 10 and Windows 10 Mobile](https://technet.microsoft.com/itpro/windows/index) \ No newline at end of file + +- [Windows 10 and Windows 10 Mobile](https://technet.microsoft.com/itpro/windows/index) +- [Try it out: virtual labs for Windows 10 Education](https://technet.microsoft.com/en-us/windows/dn610356) From 23a0ade7efd7fa9c7a50e429cb91bb47bf32c09a Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 25 May 2016 10:02:43 -0700 Subject: [PATCH 413/439] fixing spacing issues --- ...protect-bitlocker-from-pre-boot-attacks.md | 18 +++++- ...s-of-attacks-for-volume-encryption-keys.md | 56 +++++++++++++++++-- 2 files changed, 67 insertions(+), 7 deletions(-) diff --git a/windows/keep-secure/protect-bitlocker-from-pre-boot-attacks.md b/windows/keep-secure/protect-bitlocker-from-pre-boot-attacks.md index 8edf687f07..1b1c4370f3 100644 --- a/windows/keep-secure/protect-bitlocker-from-pre-boot-attacks.md +++ b/windows/keep-secure/protect-bitlocker-from-pre-boot-attacks.md @@ -2,27 +2,41 @@ title: Protect BitLocker from pre-boot attacks (Windows 10) description: This detailed guide will help you understand the circumstances under which the use of pre-boot authentication is recommended for devices running Windows 10, Windows 8.1, Windows 8, or Windows 7; and when it can be safely omitted from a device’s configuration. ms.assetid: 24d19988-fc79-4c45-b392-b39cba4ec86b -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- # Protect BitLocker from pre-boot attacks + + **Applies to** - Windows 10 + This detailed guide will help you understand the circumstances under which the use of pre-boot authentication is recommended for devices running Windows 10, Windows 8.1, Windows 8, or Windows 7; and when it can be safely omitted from a device’s configuration. -BitLocker uses encryption to protect the data on your drive, but BitLocker security is only effective when the encryption key is protected. Many users have relied on pre-boot authentication to protect the operating system’s integrity, disk encryption solution (for example, encryption keys), and the PC’s data from offline attacks. With pre-boot authentication, users must provide some form of credential before unlocking encrypted volumes and starting Windows. Typically, they authenticate themselves using a PIN or a USB flash drive as a key. + +BitLocker uses encryption to protect the data on your drive, but BitLocker security is only effective when the encryption key is protected. Many users have relied on pre-boot authentication to protect the operating system’s integrity, disk encryption solution (for example, encryption keys), and the PC’s data from offline attacks. With pre-boot authentication, users must provide some form of credential before unlocking encrypted volumes and starting +Windows. Typically, they authenticate themselves using a PIN or a USB flash drive as a key. + Full-volume encryption using BitLocker Drive Encryption is vital for protecting data and system integrity on devices running the Windows 10, Windows 8.1, Windows 8, or Windows 7 operating system. It is equally important to protect the BitLocker encryption key. On Windows 7 devices, sufficiently protecting that key often required pre-boot authentication, which many users find inconvenient and complicates device management. + Pre-boot authentication provides excellent startup security, but it inconveniences users and increases IT management costs. Every time the PC is unattended, the device must be set to hibernate (in other words, shut down and powered off); when the computer restarts, users must authenticate before the encrypted volumes are unlocked. This requirement increases restart times and prevents users from accessing remote PCs until they can physically access the computer to authenticate, making pre-boot authentication unacceptable in the modern IT world, where users expect their devices to turn on instantly and IT requires PCs to be constantly connected to the network. + If users lose their USB key or forget their PIN, they can’t access their PC without a recovery key. With a properly configured infrastructure, the organization’s support will be able to provide the recovery key, but doing so increases support costs, and users might lose hours of productive work time. + Starting with Windows 8, Secure Boot and Windows Trusted Boot startup process ensures operating system integrity, allowing Windows to start automatically while minimizing the risk of malicious startup tools and rootkits. In addition, many modern devices are fundamentally physically resistant to sophisticated attacks against the computer’s memory, and now Windows authenticates the user before making devices that may represent a threat to the device and encryption keys available for use. + ## In this topic + The sections that follow help you understand which PCs still need pre-boot authentication and which can meet your security requirements without the inconvenience of it. + - [Types of attacks for volume encryption keys](types-of-attacks-for-volume-encryption-keys.md) - [BitLocker countermeasures](bitlocker-countermeasures.md) - [Choose the right BitLocker countermeasure](choose-the-right-bitlocker-countermeasure.md) + ## See also + - [BitLocker overview](bitlocker-overview.md)     diff --git a/windows/keep-secure/types-of-attacks-for-volume-encryption-keys.md b/windows/keep-secure/types-of-attacks-for-volume-encryption-keys.md index 057ed8dad2..4f38eca5a6 100644 --- a/windows/keep-secure/types-of-attacks-for-volume-encryption-keys.md +++ b/windows/keep-secure/types-of-attacks-for-volume-encryption-keys.md @@ -2,43 +2,69 @@ title: Types of attacks for volume encryption keys (Windows 10) description: There are many ways Windows helps protect your organization from attacks, including Unified Extensible Firmware Interface (UEFI) secure boot, Trusted Platform Module (TPM), Group Policy, complex passwords, and account lockouts. ms.assetid: 405060a9-2009-44fc-9f84-66edad32c6bc -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Types of attacks for volume encryption keys + **Applies to** - Windows 10 + There are many ways Windows helps protect your organization from attacks, including Unified Extensible Firmware Interface (UEFI) secure boot, Trusted Platform Module (TPM), Group Policy, complex passwords, and account lockouts. + The next few sections describe each type of attack that could be used to compromise a volume encryption key, whether for BitLocker or a non-Microsoft encryption solution. After an attacker has compromised a volume encryption key, the attacker can read data from your system drive or even install malware while Windows is offline. Each section begins with a graphical overview of the attack’s strengths and weaknesses as well as suggested mitigations. + ### Bootkit and rootkit attacks + Rootkits are a sophisticated and dangerous type of malware that runs in kernel mode, using the same privileges as the operating system. Because rootkits have the same or possibly even more rights than the operating system, they can completely hide themselves from Windows and even an antimalware solution. Often, rootkits are part of an entire suite of malware that can bypass local logins, record passwords, transfer private files, and capture cryptography keys. + Different types of bootkits and rootkits load at different software levels: + - **Kernel level.** Rootkits running at the kernel level have the highest privilege in the operating system. They may be able to inject malicious code or replace portions of the core operating system, including both the kernel and device drivers. - **Application level.** These rootkits are aimed to replace application binaries with malicious code, such as a Trojan, and can even modify the behavior of existing applications. - **Library level.** The purpose of library-level rootkits is to hook, patch, or replace system calls with malicious code that can hide the malware’s presence. - **Hypervisor level.** Hypervisor rootkits target the boot sequence. Their primary purpose is to modify the boot sequence to load themselves as a hypervisor. - **Firmware level.** These rootkits overwrite the PC’s BIOS firmware, giving the malware low-level access and potentially the ability to install or hide malware, even if it’s cleaned or removed from the hard disk. + Regardless of the operating system or encryption method, rootkits have access to confidential data once installed. Application-level rootkits can read any files the user can access, bypassing volume-level encryption. Kernel-, library-, hypervisor-, and firmware-level rootkits have direct access to system files on encrypted volumes and can also retrieve an encryption key from memory. + Windows offers substantial protection from bootkits and rootkits, but it is possible to bypass operating system security when an attacker has physical access to the device and can install the malware to the device while Windows is offline. For example, an attacker might boot a PC from a USB flash drive containing malware that starts before Windows. The malware can replace system files or the PC’s firmware or simply start Windows under its control. + To sufficiently protect a PC from boot and rootkits, devices must use pre-boot authentication or Secure Boot, or the encryption solution must use the device’s Trusted Platform Module (TPM) as a means of monitoring the integrity of the end-to-end boot process. Pre-boot authentication is available for any device, regardless of the hardware, but because it is inconvenient to users, it should be used only to mitigate threats that are applicable to the device. On devices with Secure Boot enabled, you do not need to use pre-boot authentication to protect against boot and rootkit attacks. + Although password protection of the UEFI configuration is important for protecting a device’s configuration and preventing an attacker from disabling Secure Boot, use of a TPM and its Platform Configuration Register (PCR) measurements (PCR7) to ensure that the system’s bootloader (whether a Windows or non-Microsoft encryption solution) is tamper free and the first code to start on the device is critical. An encryption solution that doesn’t use a device’s TPM to protect its components from tampering may be unable to protect itself from bootkit-level infections that could log a user’s password or acquire encryption keys. + For this reason, when BitLocker is configured on devices that include a TPM, the TPM and its PCRs are always used to secure and confirm the integrity of the pre–operating system environment before making encrypted volumes accessible. + Any changes to the UEFI configuration invalidates the PCR7 and require the user to enter the BitLocker recovery key. Because of this feature, it’s not critical to password-protect your UEFI configuration. If an attacker successfully turns off Secure Boot or otherwise changes the UEFI configuration, they will need to enter the BitLocker recovery key, but UEFI password protection is a best practice and is still required for systems not using a TPM (such as non-Microsoft alternatives). + ### Brute-force Sign-in Attacks + Attackers can find any password if you allow them to guess enough times. The process of trying millions of different passwords until you find the right one is known as a *brute-force sign-in attack*. In theory, an attacker could obtain any password by using this method. + Three opportunities for brute-force attacks exist: + - **Against the pre-boot authenticator.** An attacker could attack the device directly by attempting to guess the user’s BitLocker PIN or an equivalent authenticator. The TPM mitigates this approach by invoking an anti-hammering lockout capability that requires the user to wait until the lockout period ends or enter the BitLocker recovery key. - **Against the recovery key.** An attacker could attempt to guess the 48-digit BitLocker recovery key. Even without a lockout period, the key is long enough to make brute-force attacks impractical. Specifically, the BitLocker recovery key has 128 bits of entropy; thus, the average brute-force attack would succeed after 18,446,744,073,709,551,616 guesses. If an attacker could guess 1 million passwords per second, the average brute-force attack would require more than 580,000 years to be successful. - **Against the operating system sign-in authenticator.** An attacker can attempt to guess a valid user name and password. Windows implements a delay between password guesses, slowing down brute-force attacks. In addition, all recent versions of Windows allow administrators to require complex passwords and password lockouts. Similarly, administrators can use Microsoft Exchange ActiveSync policy or Group Policy to configure Windows 8.1 and Windows 8 to automatically restart and require the user to enter the BitLocker 48-digit recovery key after a specified number of invalid password attempts. When these settings are enabled and users follow best practices for complex passwords, brute-force attacks against the operating system sign-in are impractical. + In general, brute-force sign-in attacks are not practical against Windows when administrators enforce complex passwords and account lockouts. + ### Direct Memory Access Attacks + Direct memory access (DMA) allows certain types of hardware devices to communicate directly with a device’s system memory. For example, if you use Thunderbolt to connect another device to your computer, the second device automatically has Read and Write access to the target computer’s memory. + Unfortunately, DMA ports don’t use authentication and access control to protect the contents of the computer’s memory. Whereas Windows can often prevent system components and apps from reading and writing to protected parts of memory, a device can use DMA to read any location in memory, including the location of any encryption keys. -DMA attacks are relatively easy to execute and require little technical skills. Anyone can download a tool from the Internet, such as those made by [Passware](http://www.lostpassword.com/), [ElcomSoft](http://elcomsoft.com/), and others, and then use a DMA attack to read confidential data from a PC’s memory. Because encryption solutions store their encryption keys in memory, they can be accessed by a DMA attack. + +DMA attacks are relatively easy to execute and require little technical skills. Anyone can download a tool from the Internet, such as those made by [Passware](http://www.lostpassword.com/), [ElcomSoft](http://elcomsoft.com/), and +others, and then use a DMA attack to read confidential data from a PC’s memory. Because encryption solutions store their encryption keys in memory, they can be accessed by a DMA attack. + Not all port types are vulnerable to DMA attacks. USB in particular does not allow DMA, but devices that have any of the following port types are vulnerable: + - FireWire - Thunderbolt - ExpressCard @@ -46,37 +72,57 @@ Not all port types are vulnerable to DMA attacks. USB in particular does not all - PCI - PCI-X - PCI Express -To perform a DMA attack, attackers typically connect a second PC that is running a memory-scanning tool (for example, Passware, ElcomSoft) to the FireWire or Thunderbolt port of the target computer. When connected, the software scans the system memory of the target and locates the encryption key. Once acquired, the key can be used to decrypt the drive and read or modify its contents. + +To perform a DMA attack, attackers typically connect a second PC that is running a memory-scanning tool (for example, Passware, ElcomSoft) to the FireWire or Thunderbolt port of the target computer. When connected, the software +scans the system memory of the target and locates the encryption key. Once acquired, the key can be used to decrypt the drive and read or modify its contents. + A much more efficient form of this attack exists in theory: An attacker crafts a custom FireWire or Thunderbolt device that has the DMA attack logic programmed on it. Now, the attacker simply needs to physically connect the device. If the attacker does not have physical access, they could disguise it as a free USB flash drive and distribute it to employees of a target organization. When connected, the attacking device could use a DMA attack to scan the PC’s memory for the encryption key. It could then transmit the key (or any data in the PC’s memory) using the PC’s Internet connection or its own wireless connection. This type of attack would require an extremely high level of sophistication, because it requires that the attacker create a custom device (devices of these types are not readily available in the marketplace at this time). + Today, one of the most common uses for DMA ports on Windows devices is for developer debugging, a task that some developers need to perform and one that few consumers will ever perform. Because USB; DisplayPort; and other, more secure port types satisfy consumers, most new mobile PCs do not include DMA ports. Microsoft’s view is that because of the inherent security risks of DMA ports, they do not belong on mobile devices, and Microsoft has prohibited their inclusion on any InstantGo-certified devices. InstantGo devices offer mobile phone–like power management and instant-on capabilities; at the time of writing, they are primarily found in Windows tablets. + DMA-based expansion slots are another avenue of attack, but these slots generally appear only on desktop PCs that are designed for expansion. Organizations can use physical security to prevent outside attacks against their desktop PCs. In addition, a DMA attack on the expansion slot would require a custom device; as a result, an attacker would most likely insert an interface with a traditional DMA port (for example, FireWire) into the slot to attack the PC. + To mitigate a port-based DMA attack an administrator can configure policy settings to disable FireWire and other device types that have DMA. Also, many PCs allow those devices to be disabled by using firmware settings. Although the need for pre-boot authentication can be eliminated at the device level or through Windows configuration, the BitLocker pre-boot authentication feature is still available when needed. When used, it successfully mitigates all types of DMA port and expansion slot attacks on any type of device. + ### Hyberfil.sys Attacks + The hyberfil.sys file is the Windows hibernation file. It contains a snapshot of system memory that is generated when a device goes into hibernation and includes the encryption key for BitLocker and other encryption technologies. Attackers have claimed that they have successfully extracted encryption keys from the hyberfil.sys file. + Like the DMA port attack discussed in the previous section, tools are available that can scan the hyberfile.sys file and locate the encryption key, including a tool made by [Passware](http://www.lostpassword.com/). Microsoft does not consider Windows to be vulnerable to this type of attack, because Windows stores the hyberfil.sys file within the encrypted system volume. As a result, the file would be accessible only if the attacker had both physical and sign-in access to the PC. When an attacker has sign-in access to the PC, there are few reasons for the attacker to decrypt the drive, because they would already have full access to the data within it. + In practice, the only reason an attack on hyberfil.sys would grant an attacker additional access is if an administrator had changed the default Windows configuration and stored the hyberfil.sys file on an unencrypted drive. By default, Windows 10 is designed to be secure against this type of attack. + ### Memory Remanence Attacks + A memory remanence attack is a side-channel attack that reads the encryption key from memory after restarting a PC. Although a PC’s memory is often considered to be cleared when the PC is restarted, memory chips don’t immediately lose their memory when you disconnect power. Therefore, an attacker who has physical access to the PC’s memory might be able to read data directly from the memory—including the encryption key. + When performing this type of cold boot attack, the attacker accesses the PC’s physical memory and recovers the encryption key within a few seconds or minutes of disconnecting power. This type of attack was demonstrated by researchers at [Princeton University](http://www.youtube.com/watch?v=JDaicPIgn9U). With the encryption key, the attacker would be able to decrypt the drive and access its files. + To acquire the keys, attackers follow this process: + 1. Freeze the PC’s memory. For example, an attacker can freeze the memory to −50°C by spraying it with aerosol air duster spray. 2. Restart the PC. 3. Instead of restarting Windows, boot to another operating system. Typically, this is done by connecting a bootable flash drive or loading a bootable DVD. 4. The bootable media loads the memory remanence attack tools, which the attacker uses to scan the system memory and locate the encryption keys. 5. The attacker uses the encryption keys to access the drive’s data. + If the attacker is unable to boot the device to another operating system (for example, if bootable flash drives have been disabled or Secure Boot is enabled), the attacker can attempt to physically remove the frozen memory from the device and attach it to a different, possibly identical device. Fortunately, this process has proven extremely unreliable, as evidenced by the Defence Research and Development Canada (DRDC) Valcartier group’s analysis (see [An In-depth Analysis of the Cold Boot Attack](http://www.dtic.mil/cgi-bin/GetTRDoc?AD=ADA545078)). On an increasing portion of modern devices, this type of attack is not even possible, because memory is soldered directly to the motherboard. + Although Princeton’s research proved that this type of attack was possible on devices that have removable memory, device hardware has changed since the research was published in 2008: + - Secure Boot prevents the malicious tools that the Princeton attack depends on from running on the target device. - Windows systems with BIOS or UEFI can be locked down with a password, and booting to a USB drive can be prevented. - If booting to USB is required on the device, it can be limited to starting trusted operating systems by using Secure Boot. - The discharge rates of memory are highly variable among devices, and many devices have memory that is completely immune to memory remanence attacks. - Increased density of memory diminishes their remanence properties and reduces the likelihood that the attack can be successfully executed, even when memory is physically removed and placed in an identical system where the system’s configuration may enable booting to the malicious tools. + Because of these factors, this type of attack is rarely possible on modern devices. Even in cases where the risk factors exist on legacy devices, attackers will find the attack unreliable. For detailed info about the practical uses for forensic memory acquisition and the factors that make a computer vulnerable or resistant to memory remanence attacks, read [An In-depth Analysis of the Cold Boot Attack](http://www.dtic.mil/cgi-bin/GetTRDoc?AD=ADA545078). + The BitLocker pre-boot authentication feature can successfully mitigate memory remanence attacks on most devices, but you can also mitigate such attacks by protecting the system UEFI or BIOS and prevent the PC from booting from external media (such as a USB flash drive or DVD). The latter option is often a better choice, because it provides sufficient protection without inconveniencing users with pre-boot authentication. + ## See also + - [BitLocker countermeasures](bitlocker-countermeasures.md) - [Choose the right BitLocker countermeasure](choose-the-right-bitlocker-countermeasure.md) - [Protect BitLocker from pre-boot attacks](protect-bitlocker-from-pre-boot-attacks.md) - [BitLocker overview](bitlocker-overview.md) -  -  From d62a1c230be6f144dae7af79dc4bd68f79877b9c Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 25 May 2016 11:13:23 -0700 Subject: [PATCH 414/439] EDU changes, to go live tomorrow --- windows/plan/TOC.md | 3 --- windows/plan/chromebook-migration-guide.md | 1 + windows/plan/deploy-windows-10-in-a-school.md | 1 + windows/plan/index.md | 1 - windows/plan/windows-10-guidance-for-education-environments.md | 1 + 5 files changed, 3 insertions(+), 4 deletions(-) diff --git a/windows/plan/TOC.md b/windows/plan/TOC.md index a188d6d0a1..d6212238a6 100644 --- a/windows/plan/TOC.md +++ b/windows/plan/TOC.md @@ -7,9 +7,6 @@ ## [Windows Update for Business](windows-update-for-business.md) ### [Setup and deployment](setup-and-deployment.md) ### [Integration with management solutions](integration-with-management-solutions-.md) -## [Guidance for education environments](windows-10-guidance-for-education-environments.md) -### [Chromebook migration guide](chromebook-migration-guide.md) -### [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) ## [Windows To Go: feature overview](windows-to-go-overview.md) ### [Best practice recommendations for Windows To Go](best-practice-recommendations-for-windows-to-go.md) ### [Deployment considerations for Windows To Go](deployment-considerations-for-windows-to-go.md) diff --git a/windows/plan/chromebook-migration-guide.md b/windows/plan/chromebook-migration-guide.md index 9504345b46..12773fdd7e 100644 --- a/windows/plan/chromebook-migration-guide.md +++ b/windows/plan/chromebook-migration-guide.md @@ -1,6 +1,7 @@ --- title: Chromebook migration guide (Windows 10) description: In this guide you will learn how to migrate a Google Chromebook-based learning environment to a Windows 10-based learning environment. +redirect_url: https://technet.microsoft.com/edu/windows/chromebook-migration-guide ms.assetid: 7A1FA48A-C44A-4F59-B895-86D4D77F8BEA keywords: migrate, automate, device ms.prod: w10 diff --git a/windows/plan/deploy-windows-10-in-a-school.md b/windows/plan/deploy-windows-10-in-a-school.md index f1ba01d1a5..dd53f66282 100644 --- a/windows/plan/deploy-windows-10-in-a-school.md +++ b/windows/plan/deploy-windows-10-in-a-school.md @@ -1,6 +1,7 @@ --- title: Deploy Windows 10 in a school (Windows 10) description: Learn how to integrate your school environment with Microsoft Office 365, Active Directory Domain Services (AD DS), and Microsoft Azure Active Directory (Azure AD). Deploy Windows 10 and apps to new devices or upgrade existing devices to Windows 10. Manage faculty, students, and devices by using Microsoft Intune and Group Policy. +redirect_url: https://technet.microsoft.com/edu/windows/deploy-windows-10-in-a-school keywords: configure, tools, device, school ms.prod: w10 ms.mktglfcycl: plan diff --git a/windows/plan/index.md b/windows/plan/index.md index a82ad27fb5..e57a04c1cb 100644 --- a/windows/plan/index.md +++ b/windows/plan/index.md @@ -21,7 +21,6 @@ Windows 10 provides new deployment capabilities, scenarios, and tools by buildi |[Windows 10 compatibility](windows-10-compatibility.md) |Windows 10 will be compatible with most existing PC hardware; most devices running Windows 7, Windows 8, or Windows 8.1 will meet the requirements for Windows 10. | |[Windows 10 infrastructure requirements](windows-10-infrastructure-requirements.md) |There are specific infrastructure requirements to deploy and manage Windows 10 that should be in place prior to significant Windows 10 deployments within your organization. | |[Windows Update for Business](windows-update-for-business.md) |Get an overview of how you can implement and deploy a Windows Update for Business solution and how to maintain enrolled systems. | -|[Guidance for education environments](windows-10-guidance-for-education-environments.md) |Find resources to help you plan your deployment of Windows 10 to desktops, laptops, tablets, and other devices in educational institutions. | |[Windows To Go: feature overview](windows-to-go-overview.md) |Windows To Go is a feature in Windows 10 Enterprise and Windows 10 Education that enables the creation of a Windows To Go workspace that can be booted from a USB-connected external drive on PCs. | |[Application Compatibility Toolkit (ACT) Technical Reference](act-technical-reference.md) |The Microsoft® Application Compatibility Toolkit (ACT) helps you determine whether the applications, devices, and computers in your organization are compatible with versions of the Windows® operating system. | diff --git a/windows/plan/windows-10-guidance-for-education-environments.md b/windows/plan/windows-10-guidance-for-education-environments.md index 599ac55e24..f4ce0e1a32 100644 --- a/windows/plan/windows-10-guidance-for-education-environments.md +++ b/windows/plan/windows-10-guidance-for-education-environments.md @@ -1,6 +1,7 @@ --- title: Guidance for education environments (Windows 10) description: Find resources to help you plan your deployment of Windows 10 to desktops, laptops, tablets, and other devices in educational institutions. +redirect_url: https://technet.microsoft.com/edu/windows/index ms.assetid: 225C9D6F-9329-4DDF-B447-6CE7804E314E ms.prod: w10 ms.mktglfcycl: plan From 72b52b9606614eccff417a7b2e1113d875a3b00a Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 25 May 2016 11:56:28 -0700 Subject: [PATCH 415/439] fixing spacing issues --- .../optimize-applocker-performance.md | 17 +- ...ckaged-app-installer-rules-in-applocker.md | 12 +- windows/keep-secure/passport-event-300.md | 26 +- ...sword-must-meet-complexity-requirements.md | 88 +-- windows/keep-secure/password-policy.md | 65 +-- .../perform-volume-maintenance-tasks.md | 86 +-- .../plan-for-applocker-policy-management.md | 53 +- ...loying-advanced-security-audit-policies.md | 295 +++++----- ...ion-for-bitlocker-planning-and-policies.md | 286 +++++----- windows/keep-secure/profile-single-process.md | 85 +-- .../keep-secure/profile-system-performance.md | 86 +-- ...-the-health-of-windows-10-based-devices.md | 446 +++++++++++---- ...nd-storage-area-networks-with-bitlocker.md | 84 ++- ...le-allow-automatic-administrative-logon.md | 89 +-- ...py-and-access-to-all-drives-and-folders.md | 88 +-- .../refresh-an-applocker-policy.md | 28 +- .../registry-global-object-access-auditing.md | 13 +- .../remove-computer-from-docking-station.md | 87 +-- .../replace-a-process-level-token.md | 92 ++-- ...ements-for-deploying-applocker-policies.md | 22 +- .../requirements-to-use-applocker.md | 225 ++------ .../reset-account-lockout-counter-after.md | 76 ++- .../restore-files-and-directories.md | 97 ++-- ...the-automatically-generate-rules-wizard.md | 21 +- .../keep-secure/script-rules-in-applocker.md | 54 +- ...advanced-security-audit-policy-settings.md | 12 +- .../keep-secure/security-auditing-overview.md | 35 +- .../security-considerations-for-applocker.md | 30 +- windows/keep-secure/security-options.md | 508 ++++-------------- .../security-policy-settings-reference.md | 51 +- .../keep-secure/security-policy-settings.md | 218 ++++++-- windows/keep-secure/security-technologies.md | 55 +- .../select-types-of-rules-to-create.md | 62 +-- windows/keep-secure/shut-down-the-system.md | 100 ++-- ...o-be-shut-down-without-having-to-log-on.md | 89 +-- .../shutdown-clear-virtual-memory-pagefile.md | 85 ++- ...e-passwords-using-reversible-encryption.md | 81 ++- .../switch-pcr-banks-on-tpm-2-0-devices.md | 1 + .../synchronize-directory-service-data.md | 85 +-- ...on-for-user-keys-stored-on-the-computer.md | 80 ++- ...thms-for-encryption-hashing-and-signing.md | 137 +++-- ...nsensitivity-for-non-windows-subsystems.md | 84 +-- ...-permissions-of-internal-system-objects.md | 79 ++- .../system-settings-optional-subsystems.md | 81 ++- ...ables-for-software-restriction-policies.md | 82 ++- 45 files changed, 2207 insertions(+), 2269 deletions(-) diff --git a/windows/keep-secure/optimize-applocker-performance.md b/windows/keep-secure/optimize-applocker-performance.md index f8eb1d4d8e..cdd61ef5e2 100644 --- a/windows/keep-secure/optimize-applocker-performance.md +++ b/windows/keep-secure/optimize-applocker-performance.md @@ -2,22 +2,31 @@ title: Optimize AppLocker performance (Windows 10) description: This topic for IT professionals describes how to optimize AppLocker policy enforcement. ms.assetid: a20efa20-bc98-40fe-bd81-28ec4905e0f6 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Optimize AppLocker performance + **Applies to** - Windows 10 + This topic for IT professionals describes how to optimize AppLocker policy enforcement. + ## Optimization of Group Policy + AppLocker policies can be implemented by organization unit (OU) using Group Policy. If so, your Group Policy infrastructure should be optimized and retested for performance when AppLocker policies are added to existing Group Policy Objects (GPOs) or new GPOs are created, as you do with adding any policies to your GPOs. + For more info, see the [Optimizing Group Policy Performance](http://go.microsoft.com/fwlink/p/?LinkId=163238) article in TechNet Magazine. + ### AppLocker rule limitations -The more rules per GPO, the longer AppLocker requires for evaluation. There is no set limitation on the number of rules per GPO, but the number of rules that can fit into a 100 MB GPO varies based on the complexity of the rule, such as the number of file hashes included in a single file hash condition. + +The more rules per GPO, the longer AppLocker requires for evaluation. There is no set limitation on the number of rules per GPO, but the number of rules that can fit into a 100 MB GPO varies based on the complexity of the rule, such as the number of file hashes included in a single file hash +condition. + ### Using the DLL rule collection + When the DLL rule collection is enabled, AppLocker must check each DLL that an application loads. The more DLLs, the longer AppLocker requires to complete the evaluation. -  -  diff --git a/windows/keep-secure/packaged-apps-and-packaged-app-installer-rules-in-applocker.md b/windows/keep-secure/packaged-apps-and-packaged-app-installer-rules-in-applocker.md index 64303436c2..db85e986ec 100644 --- a/windows/keep-secure/packaged-apps-and-packaged-app-installer-rules-in-applocker.md +++ b/windows/keep-secure/packaged-apps-and-packaged-app-installer-rules-in-applocker.md @@ -2,26 +2,32 @@ title: Packaged apps and packaged app installer rules in AppLocker (Windows 10) description: This topic explains the AppLocker rule collection for packaged app installers and packaged apps. ms.assetid: 8fd44d08-a0c2-4c5b-a91f-5cb9989f971d -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Packaged apps and packaged app installer rules in AppLocker + **Applies to** - Windows 10 + This topic explains the AppLocker rule collection for packaged app installers and packaged apps. + Universal Windows apps can be installed through the Windows Store or can be sideloaded using the Windows PowerShell cmdlets. Universal Windows apps can be installed by a standard user unlike some Classic Windows applications that sometimes require administrative privileges for installation. Typically, an app consists of multiple components – the installer used to install the app and one or more exes, dlls or scripts. With Classic Windows applications, not all those components always share common attributes such as the publisher name, product name and product version. Therefore, AppLocker has to control each of these components separately through different rule collections – exe, dll, script and Windows Installers. In contrast, all the components of a Universal Windows app share the same attributes: Publisher name, Package name and Package version. It is therefore possible to control an entire app with a single rule. + AppLocker enforces rules for Universal Windows apps separately from Classic Windows applications. A single AppLocker rule for a Universal Windows app can control both the installation and the running of an app. Because all Universal Windows apps are signed, AppLocker supports only publisher rules for Universal Windows apps. A publisher rule for a Universal Windows app is based on the following attributes of the app: + - Publisher name - Package name - Package version + In summary, including AppLocker rules for Universal Windows apps in your policy design provides: + - The ability to control the installation and running of the app - The ability to control all the components of the app with a single rule rather than controlling individual binaries within the app - The ability to create application control policies that survive app updates - Management of Universal Windows apps through Group Policy. -  -  diff --git a/windows/keep-secure/passport-event-300.md b/windows/keep-secure/passport-event-300.md index dfcc826405..1d055b34c7 100644 --- a/windows/keep-secure/passport-event-300.md +++ b/windows/keep-secure/passport-event-300.md @@ -2,18 +2,22 @@ title: Event ID 300 - Passport successfully created (Windows 10) description: This event is created when a Microsoft Passport for Enterprise is successfully created and registered with Azure Active Directory (Azure AD). ms.assetid: 0DD59E75-1C5F-4CC6-BB0E-71C83884FF04 -ms.pagetype: security keywords: ["ngc"] ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: jdeckerMS --- + # Event ID 300 - Passport successfully created + **Applies to** - Windows 10 - Windows 10 Mobile + This event is created when a Microsoft Passport for Enterprise is successfully created and registered with Azure Active Directory (Azure AD). Applications or services can trigger actions on this event. For example, a certificate provisioning service can listen to this event and trigger a certificate request. + ## Event details | | | |--------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| @@ -21,16 +25,18 @@ This event is created when a Microsoft Passport for Enterprise is successfully c | **ID:** | 300 | | **Source:** | Microsoft Azure Device Registration Service | | **Version:** | 10 | -| **Message:** | The NGC key was successfully registered. Key ID: {4476694e-8e3b-4ef8-8487-be21f95e6f07}. UPN:test@contoso.com. Attestation: ATT\_SOFT. Client request ID: . Server request ID: db2da6bd-3d70-4b9b-b26b-444f669902da. Server response: {"kid":"4476694e-8e3b-4ef8-8487-be21f95e6f07","upn":"test@contoso.com"} | +| **Message:** | The NGC key was successfully registered. Key ID: {4476694e-8e3b-4ef8-8487-be21f95e6f07}. UPN:test@contoso.com. Attestation: ATT\_SOFT. Client request ID: . Server request ID: db2da6bd-3d70-4b9b-b26b-444f669902da. +Server response: {"kid":"4476694e-8e3b-4ef8-8487-be21f95e6f07","upn":"test@contoso.com"} |   ## Resolve + This is a normal condition. No further action is required. + ## Related topics -[Manage identity verification using Microsoft Passport](manage-identity-verification-using-microsoft-passport.md) -[Implement Microsoft Passport in your organization](implement-microsoft-passport-in-your-organization.md) -[Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) -[Prepare people to use Microsoft Passport](prepare-people-to-use-microsoft-passport.md) -[Microsoft Passport and password changes](microsoft-passport-and-password-changes.md) -[Microsoft Passport errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) -  -  + +- [Manage identity verification using Microsoft Passport](manage-identity-verification-using-microsoft-passport.md) +- [Implement Microsoft Passport in your organization](implement-microsoft-passport-in-your-organization.md) +- [Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) +- [Prepare people to use Microsoft Passport](prepare-people-to-use-microsoft-passport.md) +- [Microsoft Passport and password changes](microsoft-passport-and-password-changes.md) +- [Microsoft Passport errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) diff --git a/windows/keep-secure/password-must-meet-complexity-requirements.md b/windows/keep-secure/password-must-meet-complexity-requirements.md index fba24e4fb4..c8b513828e 100644 --- a/windows/keep-secure/password-must-meet-complexity-requirements.md +++ b/windows/keep-secure/password-must-meet-complexity-requirements.md @@ -2,94 +2,98 @@ title: Password must meet complexity requirements (Windows 10) description: Describes the best practices, location, values, and security considerations for the Password must meet complexity requirements security policy setting. ms.assetid: 94482ae3-9dda-42df-9782-2f66196e6afe -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Password must meet complexity requirements + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Password must meet complexity requirements** security policy setting. + ## Reference + The **Passwords must meet complexity requirements** policy setting determines whether passwords must meet a series of guidelines that are considered important for a strong password. Enabling this policy setting requires passwords to meet the following requirements: + 1. Passwords may not contain the user's samAccountName (Account Name) value or entire displayName (Full Name value). Both checks are not case sensitive. + The samAccountName is checked in its entirety only to determine whether it is part of the password. If the samAccountName is less than three characters long, this check is skipped. The displayName is parsed for delimiters: commas, periods, dashes or hyphens, underscores, spaces, pound signs, and tabs. If any of these delimiters are found, the displayName is split and all parsed sections (tokens) are confirmed to not be included in the password. Tokens that are less than three characters are ignored, and substrings of the tokens are not checked. For example, the name "Erin M. Hagens" is split into three tokens: "Erin", "M", and "Hagens". Because the second token is only one character long, it is ignored. Therefore, this user could not have a password that included either "erin" or "hagens" as a substring anywhere in the password. + 2. The password contains characters from three of the following categories: + - Uppercase letters of European languages (A through Z, with diacritic marks, Greek and Cyrillic characters) - Lowercase letters of European languages (a through z, sharp-s, with diacritic marks, Greek and Cyrillic characters) - Base 10 digits (0 through 9) - Non-alphanumeric characters (special characters) (for example, !, $, \#, %) - Any Unicode character that is categorized as an alphabetic character but is not uppercase or lowercase. This includes Unicode characters from Asian languages. + Complexity requirements are enforced when passwords are changed or created. + The rules that are included in the Windows Server password complexity requirements are part of Passfilt.dll, and they cannot be directly modified. + Enabling the default Passfilt.dll may cause some additional Help Desk calls for locked-out accounts because users might not be used to having passwords that contain characters other than those found in the alphabet. However, this policy setting is liberal enough that all users should be able to abide by the requirements with a minor learning curve. + Additional settings that can be included in a custom Passfilt.dll are the use of non–upper-row characters. Upper-row characters are those that are typed by holding down the SHIFT key and typing any of the digits from 1 through 10. + ### Possible values + - Enabled - Disabled - Not defined + ### Best practices + Set **Passwords must meet complexity requirements** to Enabled. This policy setting, combined with a minimum password length of 8, ensures that there are at least 218,340,105,584,896 different possibilities for a single password. This makes a brute force attack difficult, but still not impossible. + The use of ALT key character combinations can greatly enhance the complexity of a password. However, requiring all users in an organization to adhere to such stringent password requirements can result in unhappy users and an extremely busy Help Desk. Consider implementing a requirement in your organization to use ALT characters in the range from 0128 through 0159 as part of all administrator passwords. (ALT characters outside of this range can represent standard alphanumeric characters that do not add additional complexity to the password.) + Passwords that contain only alphanumeric characters are easy to compromise by using publicly available tools. To prevent this, passwords should contain additional characters and meet complexity requirements. + ### Location + **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy** + ### Default values + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or Group Policy Object (GPO)Default value

      Default domain policy

      Enabled

      Default domain controller policy

      Enabled

      Stand-alone server default settings

      Disabled

      Domain controller effective default settings

      Enabled

      Member server effective default settings

      Enabled

      Effective GPO default settings on client computers

      Disabled

      + +| Server type or Group Policy Object (GPO) | Default value | +| - | - | +| Default domain policy| Enabled| +| Default domain controller policy| Enabled| +| Stand-alone server default settings | Disabled| +| Domain controller effective default settings | Enabled| +| Member server effective default settings | Enabled| +| Effective GPO default settings on client computers | Disabled|   ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Passwords that contain only alphanumeric characters are extremely easy to discover with several publicly available tools. + ### Countermeasure + Configure the **Passwords must meet complexity requirements** policy setting to Enabled and advise users to use a variety of characters in their passwords. + When combined with a [Minimum password length](minimum-password-length.md) of 8, this policy setting ensures that the number of different possibilities for a single password is so great that it is difficult (but not impossible) for a brute force attack to succeed. (If the Minimum password length policy setting is increased, the average amount of time necessary for a successful attack also increases.) + ### Potential impact + If the default password complexity configuration is retained, additional Help Desk calls for locked-out accounts could occur because users might not be accustomed to passwords that contain non-alphabetical characters, or they might have problems entering passwords that contain accented characters or symbols on keyboards with different layouts. However, all users should be able to comply with the complexity requirement with minimal difficulty. + If your organization has more stringent security requirements, you can create a custom version of the Passfilt.dll file that allows the use of arbitrarily complex password strength rules. For example, a custom password filter might require the use of non-upper-row symbols. (Upper-row symbols are those that require you to press and hold the SHIFT key and then press any of the digits between 1 and 0.) A custom password filter might also perform a dictionary check to verify that the proposed password does not contain common dictionary words or fragments. + The use of ALT key character combinations can greatly enhance the complexity of a password. However, such stringent password requirements can result in additional Help Desk requests. Alternatively, your organization could consider a requirement for all administrator passwords to use ALT characters in the 0128–0159 range. (ALT characters outside of this range can represent standard alphanumeric characters that would not add additional complexity to the password.) + ## Related topics -[Password Policy](password-policy.md) -  -  + +- [Password Policy](password-policy.md) diff --git a/windows/keep-secure/password-policy.md b/windows/keep-secure/password-policy.md index 4d1c366110..fd3d56e268 100644 --- a/windows/keep-secure/password-policy.md +++ b/windows/keep-secure/password-policy.md @@ -2,66 +2,51 @@ title: Password Policy (Windows 10) description: An overview of password policies for Windows and links to information for each policy setting. ms.assetid: aec1220d-a875-4575-9050-f02f9c54a3b6 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Password Policy + **Applies to** - Windows 10 + An overview of password policies for Windows and links to information for each policy setting. + In many operating systems, the most common method to authenticate a user's identity is to use a secret passphrase or password. A secure network environment requires all users to use strong passwords, which have at least eight characters and include a combination of letters, numbers, and symbols. These passwords help prevent the compromise of user accounts and administrative accounts by unauthorized users who use manual methods or automated tools to guess weak passwords. Strong passwords that are changed regularly reduce the likelihood of a successful password attack. + Introduced in Windows Server 2008 R2 and Windows Server 2008, Windows supports fine-grained password policies. This feature provides organizations with a way to define different password and account lockout policies for different sets of users in a domain. Fine-grained password policies apply only to user objects (or inetOrgPerson objects if they are used instead of user objects) and global security groups. + To apply a fine-grained password policy to users of an OU, you can use a shadow group. A shadow group is a global security group that is logically mapped to an OU to enforce a fine-grained password policy. You add users of the OU as members of the newly created shadow group and then apply the fine-grained password policy to this shadow group. You can create additional shadow groups for other OUs as needed. If you move a user from one OU to another, you must update the membership of the corresponding shadow groups. + Fine-grained password policies include attributes for all the settings that can be defined in the default domain policy (except Kerberos settings) in addition to account lockout settings. When you specify a fine-grained password policy, you must specify all of these settings. By default, only members of the Domain Admins group can set fine-grained password policies. However, you can also delegate the ability to set these policies to other users. The domain must be running at least Windows Server 2008 R2 or Windows Server 2008 to use fine-grained password policies. Fine-grained password policies cannot be applied to an organizational unit (OU) directly. + You can enforce the use of strong passwords through an appropriate password policy. There are password policy settings that control the complexity and lifetime of passwords, such as the **Passwords must meet complexity requirements** policy setting. + You can configure the password policy settings in the following location by using the Group Policy Management Console: + **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy** + If individual groups require distinct password policies, these groups should be separated into another domain or forest, based on additional requirements. + The following topics provide a discussion of password policy implementation and best practices considerations, policy location, default values for the server type or GPO, relevant differences in operating system versions, security considerations (including the possible vulnerabilities of each setting), countermeasures that you can take, and the potential impact for each setting. + ## In this section - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      TopicDescription

      [Enforce password history](enforce-password-history.md)

      Describes the best practices, location, values, policy management, and security considerations for the Enforce password history security policy setting.

      [Maximum password age](maximum-password-age.md)

      Describes the best practices, location, values, policy management, and security considerations for the Maximum password age security policy setting.

      [Minimum password age](minimum-password-age.md)

      Describes the best practices, location, values, policy management, and security considerations for the Minimum password age security policy setting.

      [Minimum password length](minimum-password-length.md)

      Describes the best practices, location, values, policy management, and security considerations for the Minimum password length security policy setting.

      [Password must meet complexity requirements](password-must-meet-complexity-requirements.md)

      Describes the best practices, location, values, and security considerations for the Password must meet complexity requirements security policy setting.

      [Store passwords using reversible encryption](store-passwords-using-reversible-encryption.md)

      Describes the best practices, location, values, and security considerations for the Store passwords using reversible encryption security policy setting.

      + +| Topic | Description | +| - | - | +| [Enforce password history](enforce-password-history.md)| Describes the best practices, location, values, policy management, and security considerations for the **Enforce password history** security policy setting.| +| [Maximum password age](maximum-password-age.md) | Describes the best practices, location, values, policy management, and security considerations for the **Maximum password age** security policy setting.| +| [Minimum password age](minimum-password-age.md) | Describes the best practices, location, values, policy management, and security considerations for the **Minimum password age** security policy setting.| +| [Minimum password length](minimum-password-length.md) | Describes the best practices, location, values, policy management, and security considerations for the **Minimum password length** security policy setting.| +| [Password must meet complexity requirements](password-must-meet-complexity-requirements.md) | Describes the best practices, location, values, and security considerations for the **Password must meet complexity requirements** security policy setting.| +| [Store passwords using reversible encryption](store-passwords-using-reversible-encryption.md) | Describes the best practices, location, values, and security considerations for the **Store passwords using reversible encryption** security policy setting.|   ## Related topics -[Configure security policy settings](how-to-configure-security-policy-settings.md) + +- [Configure security policy settings](how-to-configure-security-policy-settings.md)     diff --git a/windows/keep-secure/perform-volume-maintenance-tasks.md b/windows/keep-secure/perform-volume-maintenance-tasks.md index 8080674711..4a7f305290 100644 --- a/windows/keep-secure/perform-volume-maintenance-tasks.md +++ b/windows/keep-secure/perform-volume-maintenance-tasks.md @@ -2,89 +2,91 @@ title: Perform volume maintenance tasks (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Perform volume maintenance tasks security policy setting. ms.assetid: b6990813-3898-43e2-8221-c9c06d893244 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Perform volume maintenance tasks + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Perform volume maintenance tasks** security policy setting. + ## Reference + This policy setting determines which users can perform volume or disk management tasks, such as defragmenting an existing volume, creating or removing volumes, and running the Disk Cleanup tool. + Use caution when assigning this user right. Users with this user right can explore disks and extend files in to memory that contains other data. When the extended files are opened, the user might be able to read and modify the acquired data. + Constant: SeManageVolumePrivilege + ### Possible values + - User-defined list of accounts - Not Defined + ### Best practices + - Ensure that only the local Administrators group is assigned the **Perform volume maintenance tasks** user right. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default this setting is Administrators on domain controllers and on stand-alone servers. + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Administrators

      Stand-Alone Server Default Settings

      Administrators

      DC Effective Default Settings

      Administrators

      Member Server Effective Default Settings

      Administrators

      Client Computer Effective Default Settings

      Administrators

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Administrators| +| Stand-Alone Server Default Settings | Administrators| +| DC Effective Default Settings | Administrators| +| Member Server Effective Default Settings | Administrators| +| Client Computer Effective Default Settings | Administrators|   ## Policy management + This section describes features, tools, and guidance to help you manage this policy. + A restart of the device is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + A user who is assigned the **Perform volume maintenance tasks** user right could delete a volume, which could result in the loss of data or a denial-of- service condition. Also, disk maintenance tasks can be used to modify data on the disk, such as user rights assignments that might lead to escalation of privileges. + ### Countermeasure + Ensure that only the local Administrators group is assigned the **Perform volume maintenance tasks** user right. + ### Potential impact + None. Restricting the **Perform volume maintenance tasks** user right to the local Administrators group is the default configuration. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/plan-for-applocker-policy-management.md b/windows/keep-secure/plan-for-applocker-policy-management.md index d7b423cdb3..0fa131561e 100644 --- a/windows/keep-secure/plan-for-applocker-policy-management.md +++ b/windows/keep-secure/plan-for-applocker-policy-management.md @@ -2,71 +2,112 @@ title: Plan for AppLocker policy management (Windows 10) description: This topic for describes the decisions you need to make to establish the processes for managing and maintaining AppLocker policies. ms.assetid: dccc196f-6ae0-4ae4-853a-a3312b18751b -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Plan for AppLocker policy management + **Applies to** - Windows 10 + This topic for describes the decisions you need to make to establish the processes for managing and maintaining AppLocker policies. + ## Policy management + Before you begin the deployment process, consider how the AppLocker rules will be managed. Developing a process for managing AppLocker rules helps assure that AppLocker continues to effectively control how applications are allowed to run in your organization. + ### Application and user support policy + Developing a process for managing AppLocker rules helps assure that AppLocker continues to effectively control how applications are allowed to run in your organization. Considerations include: + - What type of end-user support is provided for blocked applications? - How are new rules added to the policy? - How are existing rules updated? - Are events forwarded for review? + **Help desk support** + If your organization has an established help desk support department in place, consider the following when deploying AppLocker policies: + - What documentation does your support department require for new policy deployments? - What are the critical processes in each business group both in work flow and timing that will be affected by application control policies and how could they affect your support department's workload? - Who are the contacts in the support department? - How will the support department resolve application control issues between the end user and those who maintain the AppLocker rules? + **End-user support** + Because AppLocker is preventing unapproved apps from running, it is important that your organization carefully plan how to provide end-user support. Considerations include: + - Do you want to use an intranet site as a first line of support for users who have tried to run a blocked app? - How do you want to support exceptions to the policy? Will you allow users to run a script to temporarily allow access to a blocked app? + **Using an intranet site** + AppLocker can be configured to display the default message but with a custom URL. You can use this URL to redirect users to a support site that contains information about why the user received the error and which applications are allowed. If you do not display a custom URL for the message when an app is blocked, the default URL is used. + The following image shows an example of the error message for a blocked app. You can use the **Set a support web link** policy setting to customize the **More information** link. + ![applocker blocked application error message](images/blockedappmsg.gif) + For steps to display a custom URL for the message, see [Display a custom URL message when users try to run a blocked app](display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md). + **AppLocker event management** -Each time that a process requests permission to run, AppLocker creates an event in the AppLocker event log. The event details which file tried to run, the attributes of that file, the user that initiated the request, and the rule GUID that was used to make the AppLocker execution decision. The AppLocker event log is located in the following path: **Applications and Services Logs\\Microsoft\\Windows\\AppLocker**. The AppLocker log includes three logs: + +Each time that a process requests permission to run, AppLocker creates an event in the AppLocker event log. The event details which file tried to run, the attributes of that file, the user that initiated the request, and the rule GUID that was used to make the AppLocker execution decision. The +AppLocker event log is located in the following path: **Applications and Services Logs\\Microsoft\\Windows\\AppLocker**. The AppLocker log includes three logs: + 1. **EXE and DLL**. Contains events for all files affected by the executable and DLL rule collections (.exe, .com, .dll, and .ocx). 2. **MSI and Script**. Contains events for all files affected by the Windows Installer and script rule collections (.msi, .msp, .ps1, .bat, .cmd, .vbs, and .js). 3. **Packaged app-Deployment** or **Packaged app-Execution**, contains events for all Universal Windows apps affected by the packaged app and packed app installer rule collection (.appx). + Collecting these events in a central location can help you maintain your AppLocker policy and troubleshoot rule configuration problems. Event collection technologies such as those available in Windows allow administrators to subscribe to specific event channels and have the events from source computers aggregated into a forwarded event log on a Windows Server operating system collector. For more info about setting up an event subscription, see [Configure Computers to Collect and Forward Events](http://go.microsoft.com/fwlink/p/?LinkId=145012). + ### Policy maintenance + As new apps are deployed or existing apps are updated by the software publisher, you will need to make revisions to your rule collections to ensure that the policy is current. + You can edit an AppLocker policy by adding, changing, or removing rules. However, you cannot specify a version for the policy by importing additional rules. To ensure version control when modifying an AppLocker policy, use Group Policy management software that allows you to create versions of Group Policy Objects (GPOs). An example of this type of software is the Advanced Group Policy Management feature from the Microsoft Desktop Optimization Pack. For more info about Advanced Group Policy Management, see [Advanced Group Policy Management Overview](http://go.microsoft.com/fwlink/p/?LinkId=145013) (http://go.microsoft.com/fwlink/p/?LinkId=145013). -**Caution**   -You should not edit an AppLocker rule collection while it is being enforced in Group Policy. Because AppLocker controls what files are allowed to run, making changes to a live policy can create unexpected behavior. + +>**Caution:**  You should not edit an AppLocker rule collection while it is being enforced in Group Policy. Because AppLocker controls what files are allowed to run, making changes to a live policy can create unexpected behavior.   **New version of a supported app** + When a new version of an app is deployed in the organization, you need to determine whether to continue to support the previous version of that app. To add the new version, you might only need to create a new rule for each file that is associated with the app. If you are using publisher conditions and the version is not specified, then the existing rule or rules might be sufficient to allow the updated file to run. You must ensure, however, that the updated app has not altered the file names or added files to support new functionality. If so, then you must modify the existing rules or create new rules. To continue to reuse a publisher-based rule without a specific file version, you must also ensure that the file's digital signature is still identical to the previous version—the publisher, product name, and file name (if configured in your rule) must all match for the rule to be correctly applied. + To determine whether a file has been modified during an app update, review the publisher's release details provided with the update package. You can also review the publisher's web page to retrieve this information. Each file can also be inspected to determine the version. + For files that are allowed or denied with file hash conditions, you must retrieve the new file hash. To add support for a new version and maintain support for the older version, you can either create a new file hash rule for the new version or edit the existing rule and add the new file hash to the list of conditions. + For files with path conditions, you should verify that the installation path has not changed from what is stated in the rule. If the path has changed, you need to update the rule before installing the new version of the app + **Recently deployed app** + To support a new app, you must add one or more rules to the existing AppLocker policy. + **App is no longer supported** + If your organization has determined that it will no longer support an application that has AppLocker rules associated with it, the easiest way to prevent users from running the app is to delete these rules. + **App is blocked but should be allowed** + A file could be blocked for three reasons: + - The most common reason is that no rule exists to allow the app to run. - There may be an existing rule that was created for the file that is too restrictive. - A deny rule, which cannot be overridden, is explicitly blocking the file. + Before editing the rule collection, first determine what rule is preventing the file from running. You can troubleshoot the problem by using the **Test-AppLockerPolicy** Windows PowerShell cmdlet. For more info about troubleshooting an AppLocker policy, see [Testing and Updating an AppLocker Policy](http://go.microsoft.com/fwlink/p/?LinkId=160269) (http://go.microsoft.com/fwlink/p/?LinkId=160269). + ## Next steps + After deciding how your organization will manage your AppLocker policy, record your findings. + - **End-user support policy.** Document the process that you will use for handling calls from users who have attempted to run a blocked app, and ensure that support personnel have clear escalation steps so that the administrator can update the AppLocker policy, if necessary. - **Event processing.** Document whether events will be collected in a central location called a store, how that store will be archived, and whether the events will be processed for analysis. - **Policy maintenance.** Detail how rules will be added to the policy and in which GPO the rules are defined. + For information and steps how to document your processes, see [Document your application control management processes](document-your-application-control-management-processes.md). -  -  diff --git a/windows/keep-secure/planning-and-deploying-advanced-security-audit-policies.md b/windows/keep-secure/planning-and-deploying-advanced-security-audit-policies.md index 8a2a90eb1f..c9a1917ba3 100644 --- a/windows/keep-secure/planning-and-deploying-advanced-security-audit-policies.md +++ b/windows/keep-secure/planning-and-deploying-advanced-security-audit-policies.md @@ -2,290 +2,283 @@ title: Planning and deploying advanced security audit policies (Windows 10) description: This topic for the IT professional explains the options that security policy planners must consider and the tasks they must complete to deploy an effective security audit policy in a network that includes advanced security audit policies. ms.assetid: 7428e1db-aba8-407b-a39e-509671e5a442 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Planning and deploying advanced security audit policies + **Applies to** - Windows 10 -This topic for the IT professional explains the options that security policy planners must consider and the tasks they must complete to deploy an effective security audit policy in a network that includes advanced security audit policies. + +This topic for the IT professional explains the options that security policy planners must consider and the tasks they must complete to deploy an effective security audit policy in a network that includes advanced security audit +policies. + Organizations invest a large portion of their information technology budgets on security applications and services, such as antimalware software, firewalls, and encryption. But no matter how much security hardware or software you deploy, how tightly you control the rights of users, or how carefully you configure security permissions on your data, you should not consider the job complete unless you have a well-defined, timely auditing strategy to track the effectiveness of your defenses and identify attempts to circumvent them. + To be well defined and timely, an auditing strategy must provide useful tracking data for an organization's most important resources, critical behaviors, and potential risks. In a growing number of organizations, it must also provide absolute proof that IT operations comply with corporate and regulatory requirements. + Unfortunately, no organization has unlimited resources to monitor every resource and activity on a network. If you do not plan well, you will likely have gaps in your auditing strategy. However, if you try to audit every resource and activity, you may find yourself with far too much monitoring data, including thousands of benign audit entries that an analyst needs to sift through to identify the narrow set of entries that warrant closer examination. This could cause delays or even prevent auditors from identifying suspicious activity. Thus, too much monitoring can leave an organization as vulnerable as not enough monitoring. + Here are some features that can help you focus your effort: + - **Advanced audit policy settings**. You can apply and manage detailed audit policy settings through Group Policy. - **"Reason for access" auditing**. You can specify and identify the permissions that were used to generate a particular object access security event. - **Global object access auditing**. You can define system access control lists (SACLs) for an entire computer file system or registry. + To deploy these features and plan an effective security auditing strategy, you need to: + - Identify your most critical resources and the most important activities that need to be tracked. - Identify the audit settings that can be used to track these activities. - Assess the advantages and potential costs associated with each. - Test these settings to validate your choices. - Develop plans for deploying and managing your audit policy. + ## About this guide + This document will guide you through the steps needed to plan a security auditing policy that uses Windows auditing features. This policy must identify and address vital business needs, including: + - Network reliability - Regulatory requirements - Protection of the organization's data and intellectual property - Users, including employees, contractors, partners, and customers - Client computers and applications - Servers and the applications and services running on those servers + The audit policy also must identify processes for managing audit data after it has been logged, including: + - Collecting, evaluating, and reviewing audit data - Storing and (if required) disposing of audit data + By carefully planning, designing, testing, and deploying a solution based on your organization's business requirements, you can provide the standardized functionality, security, and management control that your organization needs. + ## Understanding the security audit policy design process + The process of designing and deploying a Windows security audit policy involves the following tasks, which are described in greater detail throughout this document: + - [Identifying your Windows security audit policy deployment goals](#bkmk-1) + This section helps define the business objectives that will guide your Windows security audit policy. It also helps you define the resources, users, and computers that will be the focus of your security auditing. + - [Mapping the security audit policy to groups of users, computers, and resources in your organization](#bkmk-2) + This section explains how to integrate security audit policy settings with domain Group Policy settings for different groups of users, computers, and resources. In addition, if your network includes multiple versions of Windows client and server operating systems, it also explains when to use basic audit policy settings and when to use advanced security audit policy settings. + - [Mapping your security auditing goals to a security audit policy configuration](#bkmk-3) + This section explains the categories of Windows security auditing settings that are available. It also identifies individual Windows security auditing policy settings that can be of particular value to address auditing scenarios. + - [Planning for security audit monitoring and management](#bkmk-4) + This section helps you plan to collect, analyze, and store Windows audit data. Depending on the number of computers and types of activity that you want to audit, Windows event logs can fill up quickly. In addition, this section explains how auditors can access and aggregate event data from multiple servers and desktop computers. It also explains how to address storage requirements, including how much audit data to store and how it must be stored. + - [Deploying the security audit policy](#bkmk-5) + This section provides recommendations and guidelines for the effective deployment of a Windows security audit policy. Configuring and deploying Windows audit policy settings in a test lab environment can help you confirm that the settings you have selected will produce the type of audit data you need. However, only a carefully staged pilot and incremental deployments based on your domain and organizational unit (OU) structure will enable you to confirm that the audit data you generate can be monitored and that it meets your organization's audit needs. + ## Identifying your Windows security audit policy deployment goals + A security audit policy must support and be a critical and integrated aspect of an organization's overall security design and framework. + Every organization has a unique set of data and network assets (such as customer and financial data and trade secrets), physical resources (such as desktop computers, portable computers, and servers), and users (which can include various internal groups such as finance and marketing, and external groups such as partners, customers, and anonymous users on the website). Not all of these assets, resources, and users justify the cost of an audit. Your task is to identify which assets, resources, and users provide the strongest justification for the focus of a security audit. + To create your Windows security audit plan, begin by identifying: + - The overall network environment, including the domains, OUs, and security groups. - The resources on the network, the users of those resources, and how those resources are being used. - Regulatory requirements. + ### Network environment + An organization's domain and OU structure provide a fundamental starting point for thinking about how to apply a security audit policy because it likely provides a foundation of Group Policy Objects (GPOs) and logical grouping of resources and activities that you can use to apply the audit settings that you choose. It is also likely that certain portions of your domain and OU structure already provide logical groups of users, resources, and activities that justify the time and resources needed to audit them. For information about how to integrate a security audit policy with your domain and OU structure, see [Mapping security audit policy to groups of users, computers, and resources in your organization](#bkmk-2) later in this document. + In addition to your domain model, you should also find out whether your organization creates and maintains a systematic threat model. A good threat model can help you identify threats to key components in your infrastructure, so you can define and apply audit settings that enhance the organization's ability to identify and counter those threats. -**Important**   -Including auditing within your organization's security plan also makes it possible to budget your resources on the areas where auditing can achieve the most positive results. + +>**Important:**  Including auditing within your organization's security plan also makes it possible to budget your resources on the areas where auditing can achieve the most positive results.   For additional details about how to complete each of these steps and how to prepare a detailed threat model, download the [IT Infrastructure Threat Modeling Guide](http://go.microsoft.com/fwlink/p/?LinkId=163432). + ### Data and resources + For data and resource auditing, you need to identify the most important types of data and resources (such as patient records, accounting data, or marketing plans) that can benefit from the closer monitoring that Windows auditing can provide. Some of these data resources might already be monitored through auditing features in products such as Microsoft SQL Server and Exchange Server. If so, you may want to consider how Windows auditing features can enhance the existing audit strategy. As with the domain and OU structure discussed previously, security auditing should focus on your most critical resources. You also must consider how much audit data you will be able to manage. + You can record if these resources have high business impact, medium business impact, or low business impact, the cost to the organization if these data resources are accessed by unauthorized users, and the risk that this access can pose to the organization. The type of access by users (such as Read, Modify, or Copy) can also pose different levels of risk to an organization. + Increasingly, data access and use is governed by regulations, and a breach can result in severe penalties and a loss in credibility for the organization. If regulatory compliance plays a role in how you manage your data, be sure to also document this information. + The following table provides an example of a resource analysis for an organization. - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Resource classWhere storedOrganizational unitBusiness impactSecurity or regulatory requirements

      Payroll data

      Corp-Finance-1

      Accounting: Read/Write on Corp-Finance-1

      -

      Departmental Payroll Managers: Write only on Corp-Finance-1

      High

      Financial integrity and employee privacy

      Patient medical records

      MedRec-2

      Doctors and Nurses: Read/Write on Med/Rec-2

      -

      Lab Assistants: Write only on MedRec-2

      -

      Accounting: Read only on MedRec-2

      High

      Strict legal and regulatory standards

      Consumer health information

      Web-Ext-1

      Public Relations Web Content Creators: Read/Write on Web-Ext-1

      -

      Public: Read only on Web-Ext-1

      Low

      Public education and corporate image

      + +| Resource class | Where stored | Organizational unit | Business impact | Security or regulatory requirements | +| - | - | - | - | - | +| Payroll data| Corp-Finance-1| Accounting: Read/Write on Corp-Finance-1
      Departmental Payroll Managers: Write only on Corp-Finance-1| High| Financial integrity and employee privacy| +| Patient medical records| MedRec-2| Doctors and Nurses: Read/Write on Med/Rec-2
      Lab Assistants: Write only on MedRec-2
      Accounting: Read only on MedRec-2| High| Strict legal and regulatory standards| +| Consumer health information| Web-Ext-1| Public Relations Web Content Creators: Read/Write on Web-Ext-1
      Public: Read only on Web-Ext-1| Low| Public education and corporate image|   ### Users + Many organizations find it useful to classify the types of users they have and base permissions on this classification. This same classification can help you identify which user activities should be the subject of security auditing and the amount of audit data they will generate. + Organizations can create distinctions based on the type of rights and permissions needed by users to perform their jobs. For example, under the classification Administrators, larger organizations might assign local administrator responsibilities for a single computer, for specific applications such as Exchange Server or SQL Server, or for an entire domain. Under Users, permissions and Group Policy settings can apply to as many as all users in an organization or as few as a subset of the employees in a given department. + Also, if your organization is subject to regulatory requirements, user activities such as accessing medical records or financial data may need to be audited to verify that you are complying with these requirements. + To effectively audit user activity, begin by listing the different types of users in your organization and the types of data they need access to—in addition to the data they should not have access to. + Also, if external users can access any of your organization's data, be sure to identify them, including if they belong to a business partner, customer, or general user, the data they have access to, and the permissions they have to access that data. + The following table illustrates an analysis of users on a network. Although our example contains a single column titled "Possible auditing considerations," you may want to create additional columns to differentiate between different types of network activity, such as logon hours and permission use. - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
      GroupsDataPossible auditing considerations

      Account administrators

      User accounts and security groups

      Account administrators have full privileges to create new user accounts, reset passwords, and modify security group memberships. We need a mechanism to monitor these changes.

      Members of the Finance OU

      Financial records

      Users in Finance have Read/Write access to critical financial records, but no ability to change permissions on these resources. These financial records are subject to government regulatory compliance requirements.

      External partners

      Project Z

      Employees of partner organizations have Read/Write access to certain project data and servers relating to Project Z, but not to other servers or data on the network.

      + +| Groups | Data | Possible auditing considerations | +| - | - | - | +| Account administrators| User accounts and security groups| Account administrators have full privileges to create new user accounts, reset passwords, and modify security group memberships. We need a mechanism to monitor these changes. | +| Members of the Finance OU| Financial records| Users in Finance have Read/Write access to critical financial records, but no ability to change permissions on these resources. These financial records are subject to government regulatory compliance requirements. | +| External partners | Project Z| Employees of partner organizations have Read/Write access to certain project data and servers relating to Project Z, but not to other servers or data on the network.|   ### Computers + Security and auditing requirements and audit event volume can vary considerably for different types of computers in an organization. These requirements can be based on: + - If the computers are servers, desktop computers, or portable computers. - The important applications the computers run, such as Exchange Server, SQL Server, or Forefront Identity Manager. - **Note**   - If the server applications (including Exchange Server and SQL Server) have audit settings. For more information about auditing in Exchange Server, see the [Exchange 2010 Security Guide](http://go.microsoft.com/fwlink/p/?linkid=128052). For more information about auditing in SQL Server 2008, see [Auditing (Database Engine)](http://go.microsoft.com/fwlink/p/?LinkId=163434). For SQL Server 2012, see [SQL Server Audit (Database Engine)](http://technet.microsoft.com/library/cc280386.aspx). + + >**Note:**  If the server applications (including Exchange Server and SQL Server) have audit settings. For more information about auditing in Exchange Server, see the [Exchange 2010 Security Guide](http://go.microsoft.com/fwlink/p/?linkid=128052). For more information about auditing in SQL Server 2008, see [Auditing (Database Engine)](http://go.microsoft.com/fwlink/p/?LinkId=163434). For SQL Server 2012, see [SQL Server Audit (Database Engine)](http://technet.microsoft.com/library/cc280386.aspx).   - The operating system versions. - **Note**   - The operating system version determines which auditing options are available and the volume of audit event data. + + >**Note:**  The operating system version determines which auditing options are available and the volume of audit event data.   - The business value of the data. + For example, a web server that is accessed by external users requires different audit settings than a root certification authority (CA) that is never exposed to the public Internet or even to regular users on the organization's network. + The following table illustrates an analysis of computers in an organization. - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Type of computer and applicationsOperating system versionWhere located

      Servers hosting Exchange Server

      Windows Server 2008 R2

      ExchangeSrv OU

      File servers

      Windows Server 2012

      Separate resource OUs by department and (in some cases) by location

      Portable computers

      Windows Vista and Windows 7

      Separate portable computer OUs by department and (in some cases) by location

      Web servers

      Windows Server 2008 R2

      WebSrv OU

      + +| Type of computer and applications | Operating system version | Where located | +| - | - | - | +| Servers hosting Exchange Server| Windows Server 2008 R2| ExchangeSrv OU| +| File servers | Windows Server 2012| Separate resource OUs by department and (in some cases) by location| +| Portable computers | Windows Vista and Windows 7| Separate portable computer OUs by department and (in some cases) by location| +| Web servers | Windows Server 2008 R2 | WebSrv OU|   ### Regulatory requirements + Many industries and locales have strict and specific requirements for network operations and how resources are protected. In the health care and financial industries, for example, there are strict guidelines for who has access to records and how they are used. Many countries have strict privacy rules. To identify regulatory requirements, work with your organization's legal department and other departments responsible for these requirements. Then consider the security configuration and auditing options that can be used to comply with and verify compliance with these regulations. + For more info, see the [System Center Process Pack for IT GRC](http://technet.microsoft.com/library/dd206732.aspx). + ## Mapping the security audit policy to groups of users, computers, and resources in your organization -By using Group Policy, you can apply your security audit policy to defined groups of users, computers, and resources. To map a security auditing policy to these defined groups in your organization, you should understand the following considerations for using Group Policy to apply security audit policy settings: + +By using Group Policy, you can apply your security audit policy to defined groups of users, computers, and resources. To map a security auditing policy to these defined groups in your organization, you should understand the +following considerations for using Group Policy to apply security audit policy settings: + - The policy settings you identify can be applied by using one or more GPOs. To create and edit a GPO, use the Group Policy Management Console (GPMC). By using the GPMC to link a GPO to selected Active Directory sites, domains, and OUs, you apply the policy settings in the GPO to the users and computers in those Active Directory objects. An OU is the lowest-level Active Directory container to which you can assign Group Policy settings. - For every policy setting that you select, you need to decide whether it should be enforced across the organization, or whether it should apply only to selected users or computers. You can then combine these audit policy settings into GPOs and link them to the appropriate Active Directory containers. - By default, options set in GPOs that are linked to higher levels of Active Directory sites, domains, and OUs are inherited by all OUs at lower levels. However, a GPO that is linked at a lower level can overwrite inherited policies. + For example, you might use a domain GPO to assign an organization-wide group of audit settings, but want a certain OU to get a defined group of additional settings. To accomplish this, you can link a second GPO to that specific lower-level OU. Therefore, a logon audit setting that is applied at the OU level will override a conflicting logon audit setting that is applied at the domain level (unless you have taken special steps to apply Group Policy loopback processing). + - Audit policies are computer policies. Therefore, they must be applied through GPOs that are applied to computer OUs, not to user OUs. However, in most cases you can apply audit settings for only specified resources and groups of users by configuring SACLs on the relevant objects. This enables auditing for a security group that contains only the users you specify. + For example, you could configure a SACL for a folder called Payroll Data on Accounting Server 1. This can audit attempts by members of the Payroll Processors OU to delete objects from this folder. The **Object Access\\Audit File System** audit policy setting applies to Accounting Server 1, but because it requires a corresponding resource SACL, only actions by members of the Payroll Processors OU on the Payroll Data folder generates audit events. + - Advanced security audit policy settings were introduced in Windows Server 2008 R2 or Windows 7 and can be applied to those operating systems and later. These advanced audit polices can only be applied by using Group Policy. - **Important**   - Whether you apply advanced audit policies by using Group Policy or by using logon scripts, do not use both the basic audit policy settings under **Local Policies\\Audit Policy** and the advanced settings under **Security Settings\\Advanced Audit Policy Configuration**. Using both basic and advanced audit policy settings can cause unexpected results in audit reporting. + + >**Important:**  Whether you apply advanced audit policies by using Group Policy or by using logon scripts, do not use both the basic audit policy settings under **Local Policies\\Audit Policy** and the advanced settings under **Security Settings\\Advanced Audit Policy Configuration**. Using both basic and advanced audit policy settings can cause unexpected results in audit reporting. + If you use **Advanced Audit Policy Configuration** settings or use logon scripts to apply advanced audit policies, be sure to enable the **Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings** policy setting under **Local Policies\\Security Options**. This will prevent conflicts between similar settings by forcing basic security auditing to be ignored.   + The following are examples of how audit policies can be applied to an organization's OU structure: + - Apply data activity settings to an OU that contains file servers. If your organization has servers that contain particularly sensitive data, consider putting them in a separate OU so that you can configure and apply a more precise audit policy to these servers. - Apply user activity audit policies to an OU that contains all computers in the organization. If your organization places users in OUs based on the department they work in, consider configuring and applying more detailed security permissions on critical resources that are accessed by employees who work in more sensitive areas, such as network administrators or the legal department. - Apply network and system activity audit policies to OUs that contain the organization's most critical servers, such as domain controllers, CAs, email servers, or database servers. + ## Mapping your security auditing goals to a security audit policy configuration + After you identify your security auditing goals, you can begin to map them to a security audit policy configuration. This audit policy configuration must address your most critical security auditing goals, but it also must address your organization's constraints, such as the number of computers that need to be monitored, the number of activities that you want to audit, the number of audit events that your desired audit configuration will generate, and the number of administrators available to analyze and act upon audit data. + To create your audit policy configuration, you need to: + 1. Explore all of the audit policy settings that can be used to address your needs. 2. Choose the audit settings that will most effectively address the audit requirements identified in the previous section. 3. Confirm that the settings you choose are compatible with the operating systems running on the computers that you want to monitor. 4. Decide which configuration options (Success, Failure, or both Success and Failure) you want to use for the audit settings. 5. Deploy the audit settings in a lab or test environment to verify that they meet your desired results in terms of volume, supportability, and comprehensiveness. Then deploy the audit settings in a pilot production environment to ensure that your estimates of how much audit data your audit plan will generate are realistic and that you can manage this data. + ### Exploring audit policy options + Security audit policy settings in the supported versions of Windows can be viewed and configured in the following locations: + - **Security Settings\\Local Policies\\Audit Policy**. - **Security Settings\\Local Policies\\Security Options**. - **Security Settings\\Advanced Audit Policy Configuration**. For more information, see [Advanced security audit policy settings](advanced-security-audit-policy-settings.md). + ### Choosing audit settings to use + Depending on your goals, different sets of audit settings may be of particular value to you. For example, some settings under **Security Settings\\Advanced Audit Policy Configuration** can be used to monitor the following types of activity: + - Data and resources - Users - Network -**Important**   -Settings that are described in the Reference might also provide valuable information about activity audited by another setting. For example, the settings used to monitor user activity and network activity have obvious relevance to protecting your data resources. Likewise, attempts to compromise data resources have huge implications for overall network status, and potentially for how well you are managing the activities of users on the network. + +>**Important:**  Settings that are described in the Reference might also provide valuable information about activity audited by another setting. For example, the settings used to monitor user activity and network activity have obvious relevance to protecting your data resources. Likewise, attempts to compromise data resources have huge implications for overall network status, and potentially for how well you are managing the activities of users on the network.   ### Data and resource activity -For many organizations, compromising the organization's data resources can cause tremendous financial losses, in addition to lost prestige and legal liability. If your organization has critical data resources that need to be protected against any breach, the following settings can provide extremely valuable monitoring and forensic data: + +For many organizations, compromising the organization's data resources can cause tremendous financial losses, in addition to lost prestige and legal liability. If your organization has critical data resources that need to be +protected against any breach, the following settings can provide extremely valuable monitoring and forensic data: + - Object Access\\[Audit File Share](audit-file-share.md). This policy setting allows you to track what content was accessed, the source (IP address and port) of the request, and the user account that was used for the access. The volume of event data generated by this setting will vary depending on the number of client computers that attempt to access the file share. On a file server or domain controller, volume may be high due to SYSVOL access by client computers for policy processing. If you do not need to record routine access by client computers that have permissions on the file share, you may want to log audit events only for failed attempts to access the file share. - Object Access\\[Audit File System](audit-file-system.md). This policy setting determines whether the operating system audits user attempts to access file system objects. Audit events are only generated for objects (such as files and folders) that have configured SACLs, and only if the type of access requested (such as Write, Read, or Modify) and the account that is making the request match the settings in the SACL. + If success auditing is enabled, an audit entry is generated each time any account successfully accesses a file system object that has a matching SACL. If failure auditing is enabled, an audit entry is generated each time any user unsuccessfully attempts to access a file system object that has a matching SACL. The amount of audit data generated by the **Audit File System** policy setting can vary considerably, depending on the number of objects that have been configured to be monitored. - **Note**   - To audit user attempts to access all file system objects on a computer, use the Global Object Access Auditing settings [Registry (Global Object Access Auditing)](registry-global-object-access-auditing.md) or [File System (Global Object Access Auditing)](file-system-global-object-access-auditing.md). + + >**Note:**  To audit user attempts to access all file system objects on a computer, use the Global Object Access Auditing settings [Registry (Global Object Access Auditing)](registry-global-object-access-auditing.md) or [File System (Global Object Access Auditing)](file-system-global-object-access-auditing.md).   - Object Access\\[Audit Handle Manipulation](audit-handle-manipulation.md). This policy setting determines whether the operating system generates audit events when a handle to an object is opened or closed. Only objects with configured SACLs generate these events, and only if the attempted handle operation matches the SACL. + Event volume can be high, depending on how SACLs are configured. When used together with the **Audit File System** or **Audit Registry** policy settings, the **Audit Handle Manipulation** policy setting can provide an administrator with useful "reason for access" audit data that details the precise permissions on which the audit event is based. For example, if a file is configured as a Read-only resource but a user attempts to save changes to the file, the audit event will log not only the event, but also the permissions that were used (or attempted to be used) to save the file changes. + - **Global Object Access Auditing**. A growing number of organizations are using security auditing to comply with regulatory requirements that govern data security and privacy. But demonstrating that strict controls are being enforced can be extremely difficult. To address this issue, the supported versions of Windows include two **Global Object Access Auditing** policy settings, one for the registry and one for the file system. When you configure these settings, they apply a global system access control SACL on all objects of that class on a system, which cannot be overridden or circumvented. - **Important**   - The **Global Object Access Auditing** policy settings must be configured and applied in conjunction with the **Audit File System** and **Audit Registry** audit policy settings in the **Object Access** category. + >**Important:**  The **Global Object Access Auditing** policy settings must be configured and applied in conjunction with the **Audit File System** and **Audit Registry** audit policy settings in the **Object Access** category.   ### User activity + The settings in the previous section relate to activity involving the files, folders, and network shares that are stored on a network, and the settings in this section focus on the users, including employees, partners, and customers, who may try to access those resources. + In the majority of cases, these attempts will be legitimate and a network needs to make vital data readily available to legitimate users. However in other cases, employees, partners, and others may attempt to access resources that they have no legitimate reason to access. Security auditing can be used to track a wide variety of user activities on a particular computer to diagnose and resolve problems for legitimate users and identify and address illegitimate activities. The following are a few important settings that you should evaluate to track user activity on your network: + - Account Logon\\[Audit Credential Validation](audit-credential-validation.md). This is an extremely important policy setting because it enables you to track every successful and unsuccessful attempt to present credentials for a user logon. In particular, a pattern of unsuccessful attempts may indicate that a user or application is using credentials that are no longer valid, or attempting to use a variety of credentials in succession in hope that one of these attempts will eventually be successful. These events occur on the computer that is authoritative for the credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. - Detailed Tracking\\[Audit Process Creation](audit-process-creation.md) and Detailed Tracking\\[Audit Process Termination](audit-process-termination.md). These policy settings can enable you to monitor the applications that a user opens and closes on a computer. - DS Access\\[Audit Directory Service Access](audit-directory-service-access.md) and DS Access\\[Audit Directory Service Changes](audit-directory-service-changes.md). These policy settings provide a detailed audit trail of attempts to access create, modify, delete, move, or undelete objects in Active Directory Domain Services (AD DS). Only domain administrators have permissions to modify AD DS objects, so it is extremely important to identify malicious attempts to modify these objects. In addition, although domain administrators should be among an organization's most trusted employees, the use of **Audit Directory Service Access** and **Audit Directory Service Changes** settings allow you to monitor and verify that only approved changes are made to AD DS. These audit events are logged only on domain controllers. - Logon/Logoff\\[Audit Account Lockout](audit-account-lockout.md). Another common security scenario occurs when a user attempts to log on with an account that has been locked out. It is important to identify these events and to determine whether the attempt to use an account that has been locked out is malicious. - Logon/Logoff\\[Audit Logoff](audit-logoff.md) and Logon/Logoff\\[Audit Logon](audit-logon.md). Logon and logoff events are essential to tracking user activity and detecting potential attacks. Logon events are related to the creation of logon sessions, and they occur on the computer that was accessed. For an interactive logon, events are generated on the computer that was logged on to. For network logon, such as accessing a shared resource, events are generated on the computer that hosts the resource that was accessed. Logoff events are generated when logon sessions are terminated. - **Note**   - There is no failure event for logoff activity because failed logoffs (such as when a system abruptly shuts down) do not generate an audit record. Logoff events are not 100 percent reliable. For example, the computer can be turned off without a proper logoff and shutdown, and a logoff event is not generated. + + >**Note:**  There is no failure event for logoff activity because failed logoffs (such as when a system abruptly shuts down) do not generate an audit record. Logoff events are not 100 percent reliable. For example, the computer can be turned off without a proper logoff and shutdown, and a logoff event is not generated.   - Logon/Logoff\\[Audit Special Logon](audit-special-logon.md). A special logon has administrator-equivalent rights and can be used to elevate a process to a higher level. It is recommended to track these types of logons. For more information about this feature, see [article 947223](http://go.microsoft.com/fwlink/p/?linkid=120183) in the Microsoft Knowledge Base. - Object Access\\[Audit Certification Services](audit-certification-services.md). This policy setting allows you to track and monitor a wide variety of activities on a computer that hosts Active Directory Certificate Services (AD CS) role services to ensure that only authorized users are performing or attempting to perform these tasks, and that only authorized or desired tasks are being performed. - Object Access\\[Audit File System](audit-file-system.md) and Object Access\\[Audit File Share](audit-file-share.md). These policy settings are described in the previous section. - Object Access\\[Audit Handle Manipulation](audit-handle-manipulation.md). This policy setting and its role in providing "reason for access" audit data is described in the previous section. - Object Access\\[Audit Registry](audit-registry.md). Monitoring for changes to the registry is one of the most critical means that an administrator has to ensure malicious users do not make changes to essential computer settings. Audit events are only generated for objects that have configured SACLs, and only if the type of access that is requested (such as Write, Read, or Modify) and the account making the request match the settings in the SACL. - **Important**   - On critical systems where all attempts to change registry settings need to be tracked, you can combine the **Audit Registry** policy setting with the **Global Object Access Auditing** policy settings to ensure that all attempts to modify registry settings on a computer are tracked. + + >**Important:**  On critical systems where all attempts to change registry settings need to be tracked, you can combine the **Audit Registry** policy setting with the **Global Object Access Auditing** policy settings to ensure that all attempts to modify registry settings on a computer are tracked.   - Object Access\\[Audit SAM](audit-sam.md). The Security Accounts Manager (SAM) is a database that is present on computers running Windows that stores user accounts and security descriptors for users on the local computer. Changes to user and group objects are tracked by the **Account Management** audit category. However, user accounts with the proper user rights could potentially alter the files where the account and password information is stored in the system, bypassing any **Account Management** events. - Privilege Use\\[Audit Sensitive Privilege Use](audit-sensitive-privilege-use.md). **Privilege Use** policy settings and audit events allow you to track the use of certain rights on one or more systems. If you configure this policy setting, an audit event is generated when sensitive rights requests are made. + ### Network activity + The following network activity policy settings allow you to monitor security-related issues that are not necessarily covered in the data or user activity categories, but that can be equally important for network status and protection. + - **Account Management**. The policy settings in this category can be used to track attempts to create, delete, or modify user or computer accounts, security groups, or distribution groups. Monitoring these activities complements the monitoring strategies you select in the user activity and data activity sections. - Account Logon\\[Audit Kerberos Authentication Service](audit-kerberos-authentication-service.md) and Account Logon\\[Audit Kerberos Service Ticket Operations](audit-kerberos-service-ticket-operations.md). Audit policy settings in the **Account Logon** category monitor activities that relate to the use of domain account credentials. These policy settings complement the policy settings in the **Logon/Logoff** category. The **Audit Kerberos Authentication Service** policy setting allows you to monitor the status of and potential threats to the Kerberos service. The Audit **Kerberos Service Ticket Operations** policy setting allows you to monitor the use of Kerberos service tickets. - **Note**   - **Account Logon** policy settings apply only to specific domain account activities, regardless of the computer that is accessed, whereas **Logon/Logoff** policy settings apply to the computer that hosts the resources being accessed. + + >**Note:**  **Account Logon** policy settings apply only to specific domain account activities, regardless of the computer that is accessed, whereas **Logon/Logoff** policy settings apply to the computer that hosts the resources being accessed.   - Account Logon\\[Audit Other Account Logon Events](audit-other-account-logon-events.md). This policy setting can be used to track a number of different network activities, including attempts to create Remote Desktop connections, wired network connections, and wireless connections. - **DS Access**. Policy settings in this category allow you to monitor the AD DS role services, which provide account data, validate logons, maintain network access permissions, and provide other services that are critical to the secure and proper functioning of a network. Therefore, auditing the rights to access and modify the configuration of a domain controller can help an organization maintain a secure and reliable network. In addition, one of the key tasks performed by AD DS is the replication of data between domain controllers. @@ -295,41 +288,65 @@ The following network activity policy settings allow you to monitor security-rel - Policy Change\\[Audit Audit Policy Change](audit-audit-policy-change.md). This policy setting allows you to monitor changes to the audit policy. If malicious users obtain domain administrator credentials, they can temporarily disable essential security audit policy settings so that their other activities on the network cannot be detected. - Policy Change\\[Audit Filtering Platform Policy Change](audit-filtering-platform-policy-change.md). This policy setting can be used to monitor a large variety of changes to an organization's IPsec policies. - Policy Change\\[Audit MPSSVC Rule-Level Policy Change](audit-mpssvc-rule-level-policy-change.md). This policy setting determines if the operating system generates audit events when changes are made to policy rules for the Microsoft Protection Service (MPSSVC.exe), which is used by Windows Firewall. Changes to firewall rules are important for understanding the security state of the computer and how well it is protected against network attacks. + ### Confirm operating system version compatibility + Not all versions of Windows support advanced audit policy settings or the use of Group Policy to apply and manage these settings. For more info, see [Which editions of Windows support advanced audit policy configuration](which-editions-of-windows-support-advanced-audit-policy-configuration.md). + The audit policy settings under **Local Policies\\Audit Policy** overlap with audit policy settings under **Security Settings\\Advanced Audit Policy Configuration**. However, the advanced audit policy categories and subcategories make it possible to focus your auditing efforts on the most critical activities while reducing the amount of audit data that is less important to your organization. + For example, **Local Policies\\Audit Policy** contains a single setting called [Audit account logon events](http://technet.microsoft.com/library/cc787176.aspx). When this setting is configured, it generates at least 10 types of audit events. + In comparison, the Account Logon category under **Security Settings\\Advanced Audit Policy Configuration** provides the following advanced settings, which allow you to focus your auditing: + - Credential Validation - Kerberos Authentication Service - Kerberos Service Ticket Operations - Other Account Logon Events + These settings allow you to exercise much tighter control over which activities or events generate event data. Some activities and events will be more important to your organization, so define the scope of your security audit policy as narrowly as possible. + ### Success, failure, or both + Whichever event settings you include in your plan, you also have to decide whether you want to log an event when the activity fails, when an activity succeeds, or both successes and failures. This is an important question, and the answer will be based on the criticality of the event and the implications of the decision on event volume. + For example, on a file server that is accessed frequently by legitimate users, you may be interested in logging an event only when an unsuccessful attempt to access data takes place, because this could be evidence of an unauthorized or malicious user. And in this instance, logging successful attempts to access the server would quickly fill the event log with benign events. + On the other hand, if the file share has extremely sensitive and valuable information, such as trade secrets, you may want to log every access attempt, whether successful or unsuccessful, so that you have an audit trail of every user who accessed the resource. + ## Planning for security audit monitoring and management + Networks can contain hundreds of servers running critical services or storing critical data, all of which need to be monitored. The number of client computers on the network can easily range into the tens or even hundreds of thousands. This may not be an issue if the ratio of servers or client computers per administrator is low. Even if an administrator who is responsible for auditing security and performance issues has relatively few computers to monitor, you need to decide how an administrator will obtain event data to review. Following are some options for obtaining the event data. + - Will you keep event data on a local computer until an administrator logs on to review this data? If so, then the administrator needs to have physical or remote access to the Event Viewer on each client computer or server, and the remote access and firewall settings on each client computer or server need to be configured to enable this access. In addition, you need to decide how often an administrator can visit each computer, and adjust the size of the audit log so that critical information is not deleted if the log reaches its maximum capacity. - Will you collect event data so that it can be reviewed from a central console? If so, there are a number of computer management products, such as the Audit Collection Services in Operations Manager 2007 and 2012, which can be used to collect and filter event data. Presumably this solution enables a single administrator to review larger amounts of data than using the local storage option. But in some cases, this can make it more difficult to detect clusters of related events that can occur on a single computer. + In addition, whether you choose to leave audit data on an individual computer or consolidate it at a central location, you need to decide how large the log file should be and what should happen when the log reaches its maximum size. To configure these options, open Event Viewer, expand **Windows Logs**, right-click **Security**, and click **Properties**. You can configure the following properties: + - **Overwrite events as needed (oldest events first)**. This is the default option, which is an acceptable solution in most situations. - **Archive the log when full, do not overwrite events**. This option can be used when all log data needs to be saved, but it also suggests that you may not be reviewing audit data frequently enough. - **Do not overwrite events (Clear logs manually)**. This option stops the collection of audit data when the log file reaches its maximum size. Older data is retained at the expense of the most recent audit events. Use this option only if you do not want to lose any audit data, do not want to create an archive of the event log, and are committed to reviewing data before the maximum log size is reached. -You can also configure the audit log size and other key management options by using Group Policy settings. You can configure the event log settings in the following locations within the GPMC: **Computer Configuration\\Administrative Templates\\Windows Components\\Event Log Service\\Security**. These options include: + +You can also configure the audit log size and other key management options by using Group Policy settings. You can configure the event log settings in the following locations within the GPMC: **Computer +Configuration\\Administrative Templates\\Windows Components\\Event Log Service\\Security**. These options include: + - **Maximum Log Size (KB)**. This policy setting specifies the maximum size of the log files. The user interfaces in the Local Group Policy Editor and Event Viewer allow you to enter values as large as 2 TB. If this setting is not configured, event logs have a default maximum size of 20 megabytes. + - **Log Access**. This policy setting determines which user accounts have access to log files and what usage rights are granted. - **Retain old events**. This policy setting controls event log behavior when the log file reaches its maximum size. When this policy setting is enabled and a log file reaches its maximum size, new events are not written to the log and are lost. When this policy setting is disabled and a log file reaches its maximum size, new events overwrite old events. - **Backup log automatically when full**. This policy setting controls event log behavior when the log file reaches its maximum size and takes effect only if the **Retain old events** policy setting is enabled. If you enable these policy settings, the event log file is automatically closed and renamed when it is full. A new file is then started. If you disable or do not configure this policy setting and the **Retain old events** policy setting is enabled, new events are discarded and the old events are retained. + In addition, a growing number of organizations are being required to store archived log files for a number of years. You should consult with regulatory compliance officers in your organization to determine whether such guidelines apply to your organization. For more information, see the [IT Compliance Management Guide](http://go.microsoft.com/fwlink/p/?LinkId=163435). + ## Deploying the security audit policy + Before deploying the audit policy in a production environment, it is critical that you determine the effects of the policy settings that you have configured. The first step in assessing your audit policy deployment is to create a test environment in a lab and use it to simulate the various use scenarios that you have identified to confirm that the audit settings you have selected are configured correctly and generate the type of results you intend. + However, unless you are able to run fairly realistic simulations of network usage patterns, a lab setup cannot provide you with accurate information about the volume of audit data that the audit policy settings you selected will generate and how effective your plan for monitoring audit data will be. To provide this type of information, you need to conduct one or more pilot deployments. These pilot deployments could involve: + - A single OU that contains critical data servers or an OU that contains all desktop computers in a specified location. - A limited set of security audit policy settings, such as **Logon/Logoff** and **Account Logon**. - A combination of limited OUs and audit policy settings—for example, targeting servers in only the Accounting OU with **Object Access** policy settings. + After you have successfully completed one or more limited deployments, you should confirm that the audit data that is collected is manageable with your management tools and administrators. When you have confirmed that the pilot deployment is effective, you need to confirm that you have the necessary tools and staff to expand the deployment to include additional OUs and sets of audit policy settings until the production deployment is complete. -  -  diff --git a/windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies.md b/windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies.md index 56db3e6526..3c5e402383 100644 --- a/windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies.md +++ b/windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies.md @@ -2,17 +2,22 @@ title: Prepare your organization for BitLocker Planning and policies (Windows 10) description: This topic for the IT professional explains how can you plan your BitLocker deployment. ms.assetid: 6e3593b5-4e8a-40ac-808a-3fdbc948059d -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Prepare your organization for BitLocker: Planning and policies + **Applies to** - Windows 10 + This topic for the IT professional explains how can you plan your BitLocker deployment. + When you design your BitLocker deployment strategy, define the appropriate policies and configuration requirements based on the business requirements of your organization. The following topics will help you collect information that you can use to frame your decision-making process about deploying and managing BitLocker systems. + - [Audit your environment](#bkmk-audit) - [Encryption keys and authentication](#bkk-encrypt) - [TPM hardware configurations](#bkmk-tpmconfigurations) @@ -23,244 +28,203 @@ When you design your BitLocker deployment strategy, define the appropriate polic - [Active Directory Domain Services considerations](#bkmk-addscons) - [FIPS support for recovery password protector](#bkmk-fipssupport) - [BitLocker Group Policy settings](bitlocker-group-policy-settings.md) + ## Audit your environment + To plan your enterprise deployment of BitLocker, you must first understand your current environment. Conduct an informal audit to define your current policies, procedures, and hardware environment. Begin by reviewing your existing corporate security policies as they relate to disk encryption software. If your organization is not currently using disk encryption software, none of these policies will exist. If you are using disk encryption software, then you might need to modify your organization's policies to address the capabilities of BitLocker. + Use the following questions to help you document your organization's current disk encryption security policies: + 1. Are there policies to address which computers will use BitLocker and which computers will not use BitLocker? 2. What policies exist to control recovery password and recovery key storage? 3. What are the policies for validating the identity of users that need to perform BitLocker recovery? 4. What policies exist to control who in the organization has access to recovery data? 5. What policies exist to control computer decommissioning or retirement? + ## Encryption keys and authentication + BitLocker helps prevent unauthorized access to data on lost or stolen computers by: + - Encrypting the entire Windows operating system volume on the hard disk. - Verifying the boot process integrity. + The trusted platform module (TPM)is a hardware component installed in many newer computers by the computer manufacturers. It works with BitLocker to help protect user data and to ensure that a computer has not been tampered with while the system was offline. + In addition, BitLocker offers the option to lock the normal startup process until the user supplies a personal identification number (PIN) or inserts a removable USB device, such as a flash drive, that contains a startup key. These additional security measures provide multifactor authentication and assurance that the computer will not start or resume from hibernation until the correct PIN or startup key is presented. + On computers that do not have a TPM version 1.2 or higher, you can still use BitLocker to encrypt the Windows operating system volume. However, this implementation will require the user to insert a USB startup key to start the computer or resume from hibernation, and does not provide the pre-startup system integrity verification offered by BitLocker working with a TPM. + **BitLocker key protectors** - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Key protectorDescription

      TPM

      A hardware device used to help establish a secure root-of-trust. BitLocker only supports TPM version 1.2 or higher.

      PIN

      A user-entered numeric key protector that can only be used in addition to the TPM.

      Enhanced PIN

      A user-entered alphanumeric key protector that can only be used in addition to the TPM.

      Startup key

      An encryption key that can be stored on most removable media. This key protector can be used alone on non-TPM computers, or in conjunction with a TPM for added security.

      Recovery password

      A 48-digit number used to unlock a volume when it is in recovery mode. Numbers can often be typed on a regular keyboard, if the numbers on the normal keyboard are not responding you can always use the function keys (F1-F10) to input the numbers.

      Recovery key

      An encryption key stored on removable media that can be used for recovering data encrypted on a BitLocker volume.

      + +| Key protector | Description | +| - | - | +| TPM | A hardware device used to help establish a secure root-of-trust. BitLocker only supports TPM version 1.2 or higher.| +| PIN | A user-entered numeric key protector that can only be used in addition to the TPM.| +| Enhanced PIN | A user-entered alphanumeric key protector that can only be used in addition to the TPM.| +| Startup key | An encryption key that can be stored on most removable media. This key protector can be used alone on non-TPM computers, or in conjunction with a TPM for added security.| +| Recovery password | A 48-digit number used to unlock a volume when it is in recovery mode. Numbers can often be typed on a regular keyboard, if the numbers on the normal keyboard are not responding you can always use the function keys (F1-F10) to input the numbers.| +| Recovery key| An encryption key stored on removable media that can be used for recovering data encrypted on a BitLocker volume.|   **BitLocker authentication methods** - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Authentication methodRequires user interactionDescription

      TPM only

      No

      TPM validates early boot components.

      TPM + PIN

      Yes

      TPM validates early boot components. The user must enter the correct PIN before the start-up process can continue, and before the drive can be unlocked. The TPM will enter lockout if the incorrect PIN is entered repeatedly to protect the PIN from brute force attacks. The number of repeated attempts that will trigger a lockout is variable.

      TPM + Network key

      No

      The TPM successfully validates early boot components, and a valid encrypted network key has been provided from the WDS server. This authentication method provides automatic unlock of operating system volumes at system reboot while still maintaining multifactor authentication.

      TPM + startup key

      Yes

      The TPM successfully validates early boot components, and a USB flash drive containing the startup key has been inserted.

      Startup key only

      Yes

      The user is prompted to insert the USB flash drive that holds the recovery key and/or startup key and reboot the computer.

      + +| Authentication method | Requires user interaction | Description | +| - | - | - | +| TPM only| No| TPM validates early boot components.| +| TPM + PIN | Yes| TPM validates early boot components. The user must enter the correct PIN before the start-up process can continue, and before the drive can be unlocked. The TPM will enter lockout if the incorrect PIN is entered repeatedly to protect the PIN from brute force attacks. The number of repeated attempts that will trigger a lockout is variable.| +| TPM + Network key | No | The TPM successfully validates early boot components, and a valid encrypted network key has been provided from the WDS server. This authentication method provides automatic unlock of operating system volumes at system reboot while still maintaining multifactor authentication. | +| TPM + startup key| Yes| The TPM successfully validates early boot components, and a USB flash drive containing the startup key has been inserted.| +| Startup key only | Yes| The user is prompted to insert the USB flash drive that holds the recovery key and/or startup key and reboot the computer.|   **Will you support computers without TPM version 1.2 or higher?** + Determine whether you will support computers that do not have a TPM version 1.2 or higher in your environment. If you choose to support BitLocker on this type of computer, a user must use a USB startup key to boot the system. This requires additional support processes similar to multifactor authentication. + **What areas of your organization need a baseline level of data protection?** + The TPM-only authentication method will provide the most transparent user experience for organizations that need a baseline level of data protection to meet security policies. It has the lowest total cost of ownership. TPM-only might also be more appropriate for computers that are unattended or that must reboot unattended. + However, TPM-only authentication method offers the lowest level of data protection. This authentication method protects against attacks that modify early boot components, but the level of protection can be affected by potential weaknesses in hardware or in the early boot components. BitLocker’s multifactor authentication methods significantly increase the overall level of data protection. + **What areas of your organization need a more secure level of data protection?** + If there are areas of your organization where data residing on user computers is considered highly-sensitive, consider the best practice of deploying BitLocker with multifactor authentication on those systems. Requiring the user to input a PIN significantly increases the level of protection for the system. You can also use BitLocker Network Unlock to allow these computers to automatically unlock when connected to a trusted wired network that can provide the Network Unlock key. + **What multifactor authentication method does your organization prefer?** + The protection differences provided by multifactor authentication methods cannot be easily quantified. Consider each authentication method's impact on Helpdesk support, user education, user productivity, and automated systems management processes. + ## TPM hardware configurations + In your deployment plan, identify what TPM-based hardware platforms will be supported. Document the hardware models from an OEM of your choice, so that their configurations can be tested and supported. TPM hardware requires special consideration during all aspects of planning and deployment. + ### TPM states of existence + For each of the TPM states of existence, the TPM can transition into another state (for example, moving from disabled to enabled). The states are not exclusive. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      StateDescription

      Enabled

      Most features of the TPM are available.

      -

      The TPM may be enabled and disabled multiple times within a boot period, if ownership is taken.

      Disabled

      The TPM restricts most operations. Exceptions include the ability to report TPM capabilities, extend and reset Platform Configuration Register (PCR) functions, and to perform hashing and basic initialization.

      -

      The TPM may be enabled and disabled multiple times within a boot period.

      Activated

      Most features of the TPM are available. The TPM may be activated and deactivated only through physical presence which requires a reboot.

      Deactivated

      Similar to disabled, with the exception that ownership can be taken while deactivated and enabled. The TPM may be activated and deactivated only through physical presence which requires a reboot.

      Owned

      Most features of the TPM are available. The TPM has an endorsement key and storage root key, and the owner knows information about owner authorization data.

      Un-owned

      The TPM does not have a storage root key and may or may not have an endorsement key.

      + +| State | Description | +| - | - | +| Enabled| Most features of the TPM are available.
      The TPM may be enabled and disabled multiple times within a boot period, if ownership is taken.| +| Disabled | The TPM restricts most operations. Exceptions include the ability to report TPM capabilities, extend and reset Platform Configuration Register (PCR) functions, and to perform hashing and basic initialization.
      The TPM may be enabled and disabled multiple times within a boot period.| +| Activated| Most features of the TPM are available. The TPM may be activated and deactivated only through physical presence which requires a reboot.| +| Deactivated| Similar to disabled, with the exception that ownership can be taken while deactivated and enabled. The TPM may be activated and deactivated only through physical presence which requires a reboot.| +| Owned| Most features of the TPM are available. The TPM has an endorsement key and storage root key, and the owner knows information about owner authorization data.| +| Un-owned| The TPM does not have a storage root key and may or may not have an endorsement key.|   -**Important**   -BitLocker cannot use the TPM until it is in the following state: enabled, activated, and owned. When the TPM is in this state and only when it is in this state, all operations are available. +>**Important:**  BitLocker cannot use the TPM until it is in the following state: enabled, activated, and owned. When the TPM is in this state and only when it is in this state, all operations are available.   The state of the TPM exists independent of the computer’s operating system. Once the TPM is enabled, activated, and owned, the state of the TPM is preserved if the operating system is reinstalled. + ### Endorsement keys + For a TPM to be usable by BitLocker, it must contain an endorsement key, which is an RSA key pair. The private half of the key pair is held inside the TPM and is never revealed or accessible outside the TPM. If the TPM does not contain an endorsement key, BitLocker will force the TPM to generate one automatically as part of BitLocker setup. + An endorsement key can be created at various points in the TPM’s lifecycle, but needs to be created only once for the lifetime of the TPM. If an endorsement key does not exist for the TPM, it must be created before TPM ownership can be taken. + For more information about the TPM and the TCG, see the Trusted Computing Group: Trusted Platform Module (TPM) Specifications (). + ## Non-TPM hardware configurations + Devices that do not include a TPM can still be protected by drive encryption. Windows To Go workspaces can be BitLocker protected using a startup password and PCs without a TPM can use a startup key. + Use the following questions to identify issues that might affect your deployment in a non-TPM configuration: + - Are password complexity rules in place? - Do you have budget for USB flash drives for each of these computers? - Do your existing non-TPM devices support USB devices at boot time? + Test your individual hardware platforms with the BitLocker system check option while you are enabling BitLocker. The system check will ensure that BitLocker can read the recovery information from a USB device and encryption keys correctly before it encrypts the volume. CD and DVD drives cannot act as a block storage device and cannot be used to store the BitLocker recovery material. + ## Disk configuration considerations + To function correctly, BitLocker requires a specific disk configuration. BitLocker requires two partitions that meet the following requirements: + - The operating system partition contains the operating system and its support files; it must be formatted with the NTFS file system - The system partition (or boot partition) contains the files that are needed to load Windows after the BIOS or UEFI firware has prepared the system hardware. BitLocker is not enabled on this partition. For BitLocker to work, the system partition must not be encrypted and must be on a different partition than the operating system. On UEFI platforms the system partition must be formatted with the FAT 32 file system. On BIOS platforms the system partition must be formatted with the NTFS file system. It should be at least 350 MB in size + Windows setup will automatically configure the disk drives of your computer to support BitLocker encryption. + Windows Recovery Environment (Windows RE) is an extensible recovery platform that is based on Windows Pre-installation Environment (Windows PE). When the computer fails to start, Windows automatically transitions into this environment, and the Startup Repair tool in Windows RE automates the diagnosis and repair of an unbootable Windows installation. Windows RE also contains the drivers and tools that are needed to unlock a volume protected by BitLocker by providing a recovery key or recovery password. To use Windows RE in conjunction with BitLocker, the Windows RE boot image must reside on a volume that is not protected by BitLocker. + Windows RE can also be used from boot media other than the local hard disk. If you choose not to install Windows RE on the local hard disk of BitLocker-enabled computers, you can use alternate boot methods, such as Windows Deployment Services, CD-ROM, or USB flash drive, for recovery. + ## BitLocker provisioning + In Windows Vista and Windows 7, BitLocker was provisioned post installation for system and data volumes through either the manage-bde command line interface or the Control Panel user interface. With newer operating systems, BitLocker can be easily provisioned before the operating system is installed. Preprovisioning requires that the computer have a TPM. + To check the BitLocker status of a particular volume, administrators can look at the status of the drive in the BitLocker control panel applet or Windows Explorer. A status of "Waiting For Activation" with a yellow exclamation icon means that the drive was preprovisioned for BitLocker. This status means that there was only a clear protector used when encrypting the volume. In this case, the volume is not protected and needs to have a secure key added to the volume before the drive is considered fully protected. Administrators can use the control panel options, manage-bde tool or WMI APIs to add an appropriate key protector and the volume status will be updated. + When using the control panel options, administrators can choose to **Turn on BitLocker** and follow the steps in the wizard to add a protector, such as a PIN for an operating system volume (or a password if no TPM exists), or a password or smart card protector to a data volume. Then the drive security window is presented prior to changing the volume status. + Administrators can enable BitLocker prior to operating system deployment from the Windows Pre-installation Environment (WinPE). This is done with a randomly generated clear key protector applied to the formatted volume and encrypting the volume prior to running the Windows setup process. If the encryption uses the Used Disk Space Only option this step takes only a few seconds and so incorporates well into regular deployment processes. + ## Used Disk Space Only encryption + The BitLocker Setup wizard provides administrators the ability to choose the Used Disk Space Only or Full encryption method when enabling BitLocker for a volume. Administrators can use the new BitLocker Group Policy setting to enforce either Used Disk Space Only or Full disk encryption. + Launching the BitLocker Setup wizard prompts for the authentication method to be used (password and smart card are available for data volumes). Once the method is chosen and the recovery key is saved, you are asked to choose the drive encryption type, either Used Disk Space Only or Full drive encryption. + Used Disk Space Only means that only the portion of the drive that contains data will be encrypted, unused space will remain unencrypted. This causes the encryption process to be much faster, especially for new PCs and data drives. When BitLocker is enabled with this method as data is added to the drive the portion of the drive used will be encrypted, so there is never unencrypted data stored on the drive. + Full drive encryption means that the entire drive will be encrypted, regardless of whether data is stored on it or not. This is useful for drives that have been repurposed and may contain data remnants from their previous use. + ## Active Directory Domain Services considerations + BitLocker integrates with Active Directory Domain Services (AD DS) to provide centralized key management. By default, no recovery information is backed up to Active Directory. Administrators can configure Group Policy settings to enable backup of BitLocker or TPM recovery information. Before configuring these settings verify that access permissions have been granted to perform the backup. + By default, domain administrators are the only users that will have access to BitLocker recovery information. When you plan your support process, define what parts of your organization need access to BitLocker recovery information. Use this information to define how the appropriate rights will be delegated in your AD DS environment. + It is a best practice to require backup of recovery information for both the TPM and BitLocker to AD DS. You can implement this practice by configuring the Group Policy settings below for your BitLocker-protected computers. - ---- - - - - - - - - - - - - - - - - -
      BitLocker Group Policy settingConfiguration

      BitLocker Drive Encryption: Turn on BitLocker backup to Active Directory Domain Services

      Require BitLocker backup to AD DS (Passwords and key packages)

      Trusted Platform Module Services: Turn on TPM backup to Active Directory Domain Services

      Require TPM backup to AD DS

      + +| BitLocker Group Policy setting | Configuration | +| - | - | +| BitLocker Drive Encryption: Turn on BitLocker backup to Active Directory Domain Services| Require BitLocker backup to AD DS (Passwords and key packages)| +| Trusted Platform Module Services: Turn on TPM backup to Active Directory Domain Services | Require TPM backup to AD DS|   The following recovery data will be saved for each computer object: + - **Recovery password** + A 48-digit recovery password used to recover a BitLocker-protected volume. Users enter this password to unlock a volume when BitLocker enters recovery mode. + - **Key package data** + With this key package and the recovery password, you will be able decrypt portions of a BitLocker-protected volume if the disk is severely damaged. Each key package will only work with the volume it was created on, which can be identified by the corresponding volume ID. + - **TPM owner authorization password hash** + When ownership of the TPM is taken a hash of the ownership password can be taken and stored in AD DS. This information can then be used to reset ownership of the TPM. + Starting in Windows 8, a change to how the TPM owner authorization value is stored in AD DS was implemented in the AD DS schema. The TPM owner authorization value is now stored in a separate object which is linked to the Computer object. This value was stored as a property in the Computer object itself for the default Windows Server 2008 R2 and later schemas. + To take advantage of this integration, you must upgrade your domain controllers to Windows Server 2012 or extend the Active Directory schema and configure BitLocker-specific Group Policy objects. -**Note**   -The account that you use to update the Active Directory schema must be a member of the Schema Admins group. + +>**Note:**  The account that you use to update the Active Directory schema must be a member of the Schema Admins group.   Windows Server 2012 domain controllers have the default schema to backup TPM owner authorization information in the separate object. If you are not upgrading your domain controller to Windows Server 2012 you need to extend the schema to support this change. + **To support Windows 8 and later computers that are managed by a Windows Server 2003 or Windows 2008 domain controller** + There are two schema extensions that you can copy down and add to your AD DS schema: + - **TpmSchemaExtension.ldf** + This schema extension brings parity with the Windows Server 2012 schema. With this change, the TPM owner authorization information is stored in a separate TPM object linked to the corresponding computer object. Only the Computer object that has created the TPM object can update it. This means that any subsequent updates to the TPM objects will not succeed in dual boot scenarios or scenarios where the computer is reimaged resulting in a new AD computer object being created. To support such scenarios, an update to the schema was created. + - **TpmSchemaExtensionACLChanges.ldf** + This schema update modifies the ACLs on the TPM object to be less restrictive so that any subsequent operating system which takes ownership of the computer object can update the owner authorization value in AD DS. However, this is less secure as any computer in the domain can now update the OwnerAuth of the TPM object (although it cannot read the OwnerAuth) and DOS attacks can be made from within the enterprise. The recommended mitigation in such a scenario is to do regular backup of TPM objects and enable auditing to track changes for these objects. + To download the schema extensions, see [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md). + If you have a Windows Server 2012 domain controller in your environment, the schema extensions are already in place and do not need to be updated. -**Caution**   -To configure Group Policy objects to backup TPM and BitLocker information in AD DS at least one of the domain controllers in your forest must be running at least Windows Server 2008 R2. + +>**Caution:**  To configure Group Policy objects to backup TPM and BitLocker information in AD DS at least one of the domain controllers in your forest must be running at least Windows Server 2008 R2. If Active Directory backup of the TPM owner authorization value is enabled in an environment without the required schema extensions, the TPM provisioning will fail and the TPM will remain in a Not Ready state for computers running Windows 8 and later.   **Setting the correct permissions in AD DS** + To initialize the TPM successfully so that you can turn on BitLocker requires that the correct permissions for the SELF account in be set in AD DS for the **ms-TPMOwnerInformation** attribute. The following steps detail setting these permissions as required by BitLocker: + 1. Open **Active Directory Users and Computers**. 2. Select the organizational unit (OU) which contains the computer accounts that will have BitLocker turned on. 3. Right-click the OU and click **Delegate Control** to open the **Delegation of Control** wizard. @@ -270,26 +234,32 @@ To initialize the TPM successfully so that you can turn on BitLocker requires th 7. On the **Active Directory Object Type** page, choose **Only the following objects in the folder** and then check **Computer Objects** and then click **Next**. 8. On the **Permissions** page, for **Show these permissions**, check **General**, **Property-specific**, and **Creation/deletion of specific child objects**. Scroll down the **Permissions** list and check both **Write msTPM-OwnerInformation** and **Write msTPM-TpmInformationForComputer** then click **Next**. 9. Click **Finish** to apply the permissions settings. + ## FIPS support for recovery password protector + Functionality introduced in Windows Server 2012 R2 and Windows 8.1, allows BitLocker to be fully functional in FIPS mode. -**Note**   -The United States Federal Information Processing Standard (FIPS) defines security and interoperability requirements for computer systems that are used by the U.S. federal government. The FIPS 140 standard defines approved cryptographic algorithms. The FIPS 140 standard also sets forth requirements for key generation and for key management. The National Institute of Standards and Technology (NIST) uses the Cryptographic Module Validation Program (CMVP) to determine whether a particular implementation of a cryptographic algorithm is compliant with the FIPS 140 standard. An implementation of a cryptographic algorithm is considered FIPS 140-compliant only if it has been submitted for and has passed NIST validation. An algorithm that has not been submitted cannot be considered FIPS-compliant even if the implementation produces identical data as a validated implementation of the same algorithm.  + +>**Note:**  The United States Federal Information Processing Standard (FIPS) defines security and interoperability requirements for computer systems that are used by the U.S. federal government. The FIPS 140 standard defines approved cryptographic algorithms. The FIPS 140 standard also sets forth requirements for key generation and for key management. The National Institute of Standards and Technology (NIST) uses the Cryptographic Module Validation Program (CMVP) to determine whether a particular implementation of a cryptographic algorithm is compliant with the FIPS 140 standard. An implementation of a cryptographic algorithm is considered FIPS 140-compliant only if it has been submitted for and has passed NIST validation. An algorithm that has not been submitted cannot be considered FIPS-compliant even if the implementation produces identical data as a validated implementation of the same algorithm.    Prior to these supported versions of Windows, when Windows was in FIPS mode, BitLocker prevented the creation or use of recovery passwords and instead forced the user to use recovery keys. For more information about these issues, see the support article [kb947249](http://support.microsoft.com/kb/947249). + But on computers running these supported systems with BitLocker enabled: + - FIPS-compliant recovery password protectors can be created when Windows is in FIPS mode. These protectors use the FIPS 140 NIST SP800-132 algorithm. - Recovery passwords created in FIPS mode on Windows 8.1 can be distinguished from recovery passwords created on other systems. - Recovery unlock using the FIPS-compliant algorithm based recovery password protector work in all cases that currently work for recovery passwords. - When FIPS-compliant recovery passwords unlock volumes, the volume is unlocked to allow read/write access even while in FIPS mode. - FIPS-compliant recovery password protectors can be exported and stored in AD a while in FIPS mode. + The BitLocker Group Policy settings for recovery passwords work the same for all Windows versions that support BitLocker, whether in FIPs mode or not. + However, you cannot use recovery passwords generated on a system in FIPS mode for systems earlier than Windows Server 2012 R2 and Windows 8.1. Recovery passwords created on Windows Server 2012 R2 and Windows 8.1 are incompatible with BitLocker on operating systems prior to Windows Server 2012 R2 and Windows 8.1; so recovery keys should be used instead. + ## More information -[Trusted Platform Module](trusted-platform-module-overview.md) -[TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md) -[BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md) -[BitLocker](bitlocker-overview.md) -[BitLocker Group Policy settings](bitlocker-group-policy-settings.md) -[BitLocker basic deployment](bitlocker-basic-deployment.md) -  -  + +- [Trusted Platform Module](trusted-platform-module-overview.md) +- [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md) +- [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md) +- [BitLocker](bitlocker-overview.md) +- [BitLocker Group Policy settings](bitlocker-group-policy-settings.md) +- [BitLocker basic deployment](bitlocker-basic-deployment.md) diff --git a/windows/keep-secure/profile-single-process.md b/windows/keep-secure/profile-single-process.md index bcdfcfa6c0..bcb68afa86 100644 --- a/windows/keep-secure/profile-single-process.md +++ b/windows/keep-secure/profile-single-process.md @@ -2,89 +2,90 @@ title: Profile single process (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Profile single process security policy setting. ms.assetid: c0963de4-4f5e-430e-bfcd-dfd68e66a075 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Profile single process + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Profile single process** security policy setting. + ## Reference + This policy setting determines which users can view a sample performance of an application process. Typically, you do not need this user right to use the performance reporting tools included in the operating system. However, you do need this user right if the system’s monitor components are configured to collect data through Windows Management Instrumentation (WMI). + Constant: SeProfileSingleProcessPrivilege + ### Possible values + - User-defined list of accounts - Administrators - Not Defined + ### Best practices + - This right should not be granted to individual users. It should be granted only for trusted applications that monitor other programs. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default this setting is Administrators on domain controllers and on stand-alone servers. + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Administrators

      Stand-Alone Server Default Settings

      Administrators

      Domain Controller Effective Default Settings

      Administrators

      Member Server Effective Default Settings

      Administrators

      Client Computer Effective Default Settings

      Administrators

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Administrators| +| Stand-Alone Server Default Settings | Administrators| +| Domain Controller Effective Default Settings | Administrators| +| Member Server Effective Default Settings | Administrators| +| Client Computer Effective Default Settings| Administrators|   ## Policy management + This section describes features, tools, and guidance to help you manage this policy. + A restart of the device is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + The **Profile single process** user right presents a moderate vulnerability. Attackers with this user right could monitor a computer's performance to help identify critical processes that they might want to attack directly. Attackers may be able to determine what processes run on the computer so that they could identify countermeasures that they may need to avoid, such as anti-virus software or an intrusion-detection system. They could also identify other users who are logged on to a computer. + ### Countermeasure + Ensure that only the local Administrators group is assigned the **Profile single process** user right. + ### Potential impact + If you remove the **Profile single process** user right from the Power Users group or other accounts, you could limit the abilities of users who are assigned to specific administrative roles in your environment. You should ensure that delegated tasks are not negatively affected. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/profile-system-performance.md b/windows/keep-secure/profile-system-performance.md index c35951cd49..5166f4de6f 100644 --- a/windows/keep-secure/profile-system-performance.md +++ b/windows/keep-secure/profile-system-performance.md @@ -2,90 +2,92 @@ title: Profile system performance (Windows 10) description: This security policy reference topic for the IT professional describes the best practices, location, values, policy management, and security considerations for the Profile system performance security policy setting. ms.assetid: ffabc3c5-9206-4105-94ea-84f597a54b2e -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Profile system performance + **Applies to** - Windows 10 + This security policy reference topic for the IT professional describes the best practices, location, values, policy management, and security considerations for the **Profile system performance** security policy setting. + ## Reference + This security setting determines which users can use Windows performance monitoring tools to monitor the performance of system processes. + Constant: SeSystemProfilePrivilege + ### Possible values + - User-defined list of accounts - Administrators - Not defined + ### Best practices + - Ensure that only the local Administrators group is assigned the **Profile system performance** user right. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default this setting is Administrators on domain controllers and on stand-alone servers. + The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Administrators

      Stand-Alone Server Default Settings

      Administrators

      Domain Controller Effective Default Settings

      Administrators

      Member Server Effective Default Settings

      Administrators

      Client Computer Effective Default Settings

      Administrators

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Administrators| +| Stand-Alone Server Default Settings | Administrators| +| Domain Controller Effective Default Settings | Administrators| +| Member Server Effective Default Settings | Administrators| +| Client Computer Effective Default Settings | Administrators|   ## Policy management + This section describes features, tools, and guidance to help you manage this policy. + A restart of the device is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + Depending on your version of Windows and your environment, you might need to add this user right to the Local System account or the Local Service account if you encounter access errors when you use the Administrators account. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + The **Profile system performance** user right poses a moderate vulnerability. Attackers with this user right could monitor a computer's performance to help identify critical processes that they might want to attack directly. Attackers might also be able to determine what processes are active on the computer so that they could identify countermeasures to avoid, such as anti-virus software or an intrusion detection system. + ### Countermeasure + Ensure that only the local Administrators group is assigned the **Profile system performance** user right. + ### Potential impact + None. Restricting the **Profile system performance** user right to the local Administrators group is the default configuration. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md b/windows/keep-secure/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md index bc3658f201..2550941ba3 100644 --- a/windows/keep-secure/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md +++ b/windows/keep-secure/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md @@ -2,232 +2,331 @@ title: Control the health of Windows 10-based devices (Windows 10) description: This article details an end-to-end solution that helps you protect high-value assets by enforcing, controlling, and reporting the health of Windows 10-based devices. ms.assetid: 45DB1C41-C35D-43C9-A274-3AD5F31FE873 -ms.pagetype: security; devices -keywords: ["security", "BYOD", "malware", "device health attestation", "mobile"] +keywords: security, BYOD, malware, device health attestation, mobile ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library +ms.pagetype: security; devices author: arnaudjumelet + --- + # Control the health of Windows 10-based devices + **Applies to** + - Windows 10 + This article details an end-to-end solution that helps you protect high-value assets by enforcing, controlling, and reporting the health of Windows 10-based devices. + ## Introduction + In Bring Your Own Device (BYOD) scenarios, employees bring commercially available devices to access both work-related resources and their personal data. Users want to use the device of their choice to access the organization’s applications, data, and resources not only from the internal network but also from anywhere. This phenomenon is also known as the consumerization of IT. + Users want to have the best productivity experience when accessing corporate applications and working on organization data from their devices. That means they will not tolerate being prompted to enter their work credentials each time they access an application or a file server. From a security perspective, it also means that users will manipulate corporate credentials and corporate data on unmanaged devices. + With the increased use of BYOD, there will be more unmanaged and potentially unhealthy systems accessing corporate services, internal resources, and cloud apps. + Even managed devices can be compromised and become harmful. Organizations need to detect when security has been breached and react as early as possible in order to protect high-value assets. + As Microsoft moves forward, security investments are increasingly focused on security preventive defenses and also on detection and response capabilities. + Windows 10 is an important component of an end-to-end security solution that focuses not only on the implementation of security preventive defenses, but adds device health attestation capabilities to the overall security strategy. + ## Description of a robust end-to-end security solution + Today’s computing threat landscape is increasing at a speed never encountered before. The sophistication of criminal attacks is growing, and there is no doubt that malware now targets both consumers and professionals in all industries. + During recent years, one particular category of threat has become prevalent: advanced persistent threats (APTs). The term APT is commonly used to describe any attack that seems to target individual organizations on an on-going basis. In fact, this type of attack typically involves determined adversaries who may use any methods or techniques necessary. + With the BYOD phenomena, a poorly maintained device represents a target of choice. For an attacker, it’s an easy way to breach the security network perimeter, gain access to, and then steal high-value assets. + The attackers target individuals, not specifically because of who they are, but because of who they work for. An infected device will bring malware into an organization, even if the organization has hardened the perimeter of networks or has invested in its defensive posture. A defensive strategy is not sufficient against these threats. + ### A different approach + Rather than the traditional focus on the prevention of compromise, an effective security strategy assumes that determined adversaries will successfully breach any defenses. It means that it’s necessary to shift focus away from preventative security controls to detection of, and response to, security issues. The implementation of the risk management strategy, therefore, balances investment in prevention, detection, and response. + Because mobile devices are increasingly being used to access corporate information, some way to evaluate device security or health is required. This section describes how to provision device health assessment in such a way that high-value assets can be protected from unhealthy devices. + Devices that are used to access corporate resources must be trusted. An efficient end-to-end security approach is able to evaluate device health and use the current security state when granting access to a high-value asset. + ![figure 1](images/hva-fig1-endtoend1.png) + A robust design needs to establish the user’s identity, strengthen the authentication method if needed, and learn behavior like the network location the user regularly connects from. Also, a modern approach must be able to release sensitive content only if user devices are determined to be healthy and secure. + The following figure shows a solution built to assess device health from the cloud. The device authenticates the user through a connection to an identity provider in the cloud. If the managed asset contains highly confidential information, the conditional access engine of the identity provider may elect to verify the security compliance of the mobile device before access is granted. The user’s device is able to prove its health status that can be sent at any time or when mobile device management (MDM) requests it. + ![figure 2](images/hva-fig2-assessfromcloud2.png) + Windows devices can be protected from low-level rootkits and bootkits by using low-level hardware technologies such as Unified Extensible Firmware Interface (UEFI) Secure Boot. + Secure Boot is a firmware validation process that helps prevent rootkit attacks; it is part of the UEFI specification. The intent of UEFI is to define a standard way for the operating system to communicate with modern hardware, which can perform faster and with more efficient input/output (I/O) functions than older, software interrupt-driven BIOS systems. + A device health attestation module can communicate measured boot data that is protected by a Trusted Platform Module (TPM) to a remote service. After the device successfully boots, boot process measurement data is sent to a trusted cloud service (Health Attestation Service) using a more secure and tamper-resistant communication channel. + Remote health attestation service performs a series of checks on the measurements. It validates security related data points, including boot state (Secure Boot, Debug Mode, and so on), and the state of components that manage security (BitLocker, Device Guard, and so on). It then conveys the health state of the device by sending a health encrypted blob back to the device. + An MDM solution typically applies configuration policies and deploys software to devices. MDM defines the security baseline and knows the level of compliance of the device with regular checks to see what software is installed and what configuration is enforced, as well as determining the health status of the device. + An MDM solution asks the device to send device health information and forward the health encrypted blob to the remote health attestation service. The remote health attestation service verifies device health data, checks that MDM is communicating to the same device, and then issues a device health report back to the MDM solution. + An MDM solution evaluates the health assertions and, depending on the health rules belonging to the organization, can decide if the device is healthy. If the device is healthy and compliant, MDM passes that information to the identity provider so the organization’s access control policy can be invoked to grant access. + Access to content is then authorized to the appropriate level of trust for whatever the health status and other conditional elements indicate. + Depending on the requirements and the sensitivity of the managed asset, device health status can be combined with user identity information when processing an access request. Access to content is then authorized to the appropriate level of trust. The Conditional Access engine may be structured to allow additional verification as needed by the sensitivity of the managed asset. For example, if access to high-value data is requested, additional security authentication may need to be established by querying the user to answer a phone call before access is granted. + ### Microsoft’s security investments in Windows 10 + In Windows 10, there are three pillars of investments: + - **Secure identities.** Microsoft is part of the FIDO Alliance which aims to provide an interoperable method of secure authentication by moving away from the use of passwords for authentication, both on the local system as well as for services like on-premises resources and cloud resources. - **Information protection.** Microsoft is making investments to allow organizations to have better control over who has access to important data and what they can do with that data. With Windows 10, organizations can take advantage of policies that specify which applications are considered to be corporate applications and can be trusted to access secure data. - **Threat resistance.** Microsoft is helping organizations to better secure enterprise assets against the threats of malware and attacks by using security defenses relying on hardware. + ### Protect, control, and report on the security status of Windows 10-based devices + This section is an overview that describes different parts of the end-to-end security solution that helps protect high-value assets and information from attackers and malware. + ![figure 3](images/hva-fig3-endtoendoverview3.png) - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      NumberPart of the solutionDescription

      1

      Windows 10-based device

      The first time a Windows 10-based device is powered on, the out-of-box experience (OOBE) screen is displayed. During setup, the device can be automatically registered into Azure Active Directory (AD) and enrolled in MDM.

      -

      A Windows 10-based device with TPM 2.0 can report health status at any time by using the Health Attestation Service available with all editions of Windows 10.

      2

      Identity provider

      Azure AD contains users, registered devices, and registered application of organization’s tenant. A device always belongs to a user and a user can have multiple devices. A device is represented as an object with different attributes like the compliance status of the device. A trusted MDM can update the compliance status.

      -

      Azure AD is more than a repository. Azure AD is able to authenticate users and devices and can also authorize access to managed resources. Azure AD has a conditional access control engine that leverages the identity of the user, the location of the device and also the compliance status of the device when making a trusted access decision.

      3

      Mobile device management

      Windows 10 has MDM support that enables the device to be managed out-of-box without deploying any agent.

      -

      MDM can be Microsoft Intune or any third-party MDM solution that is compatible with Windows 10.

      4

      Remote health attestation

      The Health Attestation Service is a trusted cloud service operated by Microsoft that performs a series of health checks and reports to MDM what Windows 10 security features are enabled on the device.

      -

      Security verification includes boot state (WinPE, Safe Mode, Debug/test modes) and components that manage security and integrity of runtime operations (BitLocker, Device Guard).

      5

      Enterprise managed asset

      Enterprise managed asset is the resource to protect.

      -

      For example, the asset can be Office 365, other cloud apps, on-premises web resources published by Azure AD, or even VPN access.

      + +| Number | Part of the solution | Description | +| - | - | - | +| **1** | Windows 10-based device | The first time a Windows 10-based device is powered on, the out-of-box experience (OOBE) screen is displayed. During setup, the device can be automatically registered into Azure Active Directory (AD) and enrolled in MDM.
      A Windows 10-based device with TPM 2.0 can report health status at any time by using the Health Attestation Service available with all editions of Windows 10.| +| **2** | Identity provider | Azure AD contains users, registered devices, and registered application of organization’s tenant. A device always belongs to a user and a user can have multiple devices. A device is represented as an object with different attributes like the compliance status of the device. A trusted MDM can update the compliance status.
      Azure AD is more than a repository. Azure AD is able to authenticate users and devices and can also authorize access to managed resources. Azure AD has a conditional access control engine that leverages the identity of the user, the location of the device and also the compliance status of the device when making a trusted access decision.| +| **3**|Mobile device management| Windows 10 has MDM support that enables the device to be managed out-of-box without deploying any agent.
      MDM can be Microsoft Intune or any third-party MDM solution that is compatible with Windows 10.| +| **4** | Remote health attestation | The Health Attestation Service is a trusted cloud service operated by Microsoft that performs a series of health checks and reports to MDM what Windows 10 security features are enabled on the device.
      Security verification includes boot state (WinPE, Safe Mode, Debug/test modes) and components that manage security and integrity of runtime operations (BitLocker, Device Guard).| +| **5** | Enterprise managed asset | Enterprise managed asset is the resource to protect.
      For example, the asset can be Office 365, other cloud apps, on-premises web resources published by Azure AD, or even VPN access.|   The combination of Windows 10-based devices, identity provider, MDM, and remote health attestation creates a robust end-to-end-solution that provides validation of health and compliance of devices that access high-value assets. + ## Protect devices and enterprise credentials against threats + This section describes what Windows 10 offers in terms of security defenses and what control can be measured and reported to. + ### Windows 10 hardware-based security defenses + The most aggressive forms of malware try to insert themselves into the boot process as early as possible so that they can take control of the operating system early and prevent protection mechanisms and antimalware software from working. This type of malicious code is often called a rootkit or bootkit. The best way to avoid having to deal with low-level malware is to secure the boot process so that the device is protected from the very start. Windows 10 supports multiple layers of boot protection. Some of these features are available only if specific types of hardware are installed. For more information, see the [Hardware requirements](#hardware-req) section. + ![figure 4](images/hva-fig4-hardware.png) + Windows 10 supports features to help prevent sophisticated low-level malware like rootkits and bootkits from loading during the startup process: + - **Trusted Platform Module.** A Trusted Platform Module (TPM) is a hardware component that provides unique security features. + Windows 10 leverages security characteristics of a TPM for measuring boot integrity sequence (and based on that, unlocking automatically BitLocker protected drives), for protecting credentials or for health attestation. + A TPM implements controls that meet the specification described by the Trusted Computing Group (TCG). At the time of this writing, there are two versions of TPM specification produced by TCG that are not compatible with each other: + - The first TPM specification, version 1.2, was published in February 2005 by the TCG and standardized under ISO / IEC 11889 standard. - The latest TPM specification, referred to as TPM 2.0, was released in April 2014 and has been approved by the ISO/IEC Joint Technical Committee (JTC) as ISO/IEC 11889:2015. + Windows 10 uses the TPM for cryptographic calculations as part of health attestation and to protect the keys for BitLocker, Microsoft Passport, virtual smart cards, and other public key certificates. For more information, see [TPM requirements in Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=733948). + Windows 10 recognizes versions 1.2 and 2.0 TPM specifications produced by the TCG. For the most recent and modern security features, Windows 10 supports only TPM 2.0. TPM 2.0 is required for device health attestation. + TPM 2.0 provides a major revision to the capabilities over TPM 1.2: + - Update crypto strength to meet modern security needs + - Support for SHA-256 for PCRs - Support for HMAC command + - Cryptographic algorithms flexibility to support government needs + - TPM 1.2 is severely restricted in terms of what algorithms it can support - TPM 2.0 can support arbitrary algorithms with minor updates to the TCG specification documents + - Consistency across implementations + - The TPM 1.2 specification allows vendors wide latitude when choosing implementation details - TPM 2.0 standardizes much of this behavior + - **Secure Boot.** Devices with UEFI firmware can be configured to load only trusted operating system bootloaders. Secure Boot does not require a TPM. + The most basic protection is the Secure Boot feature, which is a standard part of the UEFI 2.2+ architecture. On a PC with conventional BIOS, anyone who can take control of the boot process can boot by using an alternative OS loader, and potentially gain access to system resources. When Secure Boot is enabled, you can boot using only an OS loader that’s signed using a certificate stored in the UEFI Secure Boot DB. Naturally, the Microsoft certificate used to digitally sign the Windows 10 OS loaders are in that store, which allows UEFI to validate the certificate as part of its security policy. Secure Boot must be enabled by default on all computers that are certified for Windows 10 under the Windows Hardware Compatibility Program. + Secure Boot is a UEFI firmware-based feature, which allows for the signing and verification of critical boot files and drivers at boot time. Secure Boot checks signature values of the Windows Boot Manager, BCD store, Windows OS loader file, and other boot critical DLLs at boot time before the system is allowed to fully boot into a usable operating system by using policies that are defined by the OEM at build time. Secure Boot prevents many types of boot-based rootkit, malware, and other security-related attacks against the Windows platform. Secure Boot protects the operating system boot process whether booting from local hard disk, USB, PXE, or DVD, or into full Windows or Windows Recovery Environment (RE). Secure Boot protects the boot environment of a Windows 10 installation by verifying the signatures of the critical boot components to confirm malicious activity did not compromise them. Secure Boot protection ends after the Windows kernel file (ntoskrnl.exe) has been loaded. - **Note**   - Secure Boot protects the platform until the Windows kernel is loaded. Then protections like ELAM take over. + + >**Note:**  Secure Boot protects the platform until the Windows kernel is loaded. Then protections like ELAM take over.   - **Secure Boot configuration policy.** Extends Secure Boot functionality to critical Windows 10 configuration. + Examples of protected configuration information include protecting Disable Execute bit (NX option) or ensuring that the test signing policy (code integrity) cannot be enabled. This ensures that the binaries and configuration of the computer can be trusted after the boot process has completed. Secure Boot configuration policy does this with UEFI policy. These signatures for these policies are signed in the same way that operating system binaries are signed for use with Secure Boot. + The Secure Boot configuration policy must be signed by a private key that corresponds to one of the public keys stored in the Key Exchange Key (KEK) list. The Microsoft Certificate Authority (CA) will be present in the KEK list of all Windows certified Secure Boot systems. By default, a policy signed by the Microsoft KEK shall be work on all Secure Boot systems. BootMgr must verify the signature against the KEK list before applying a signed policy. With Windows 10, the default Secure Boot configuration policy is embedded in bootmgr. + The bootloader verifies the digital signature of the Windows 10 kernel before loading it. The Windows 10 kernel, in turn, verifies every other component of the Windows startup process, including the boot drivers, startup files, and the ELAM component. This step is important and protects the rest of the boot process by verifying that all Windows boot components have integrity and can be trusted. + - **Early Launch Antimalware (ELAM).** ELAM tests all drivers before they load and prevents unapproved drivers from loading. + Traditional antimalware apps don’t start until after the boot drivers have been loaded, which gives a rootkit that is disguised as a driver the opportunity to work. ELAM is a Windows mechanism introduced in a previous version of Windows that allows antimalware software to run very early in the boot sequence. Thus, the antimalware component is the first third-party component to run and control the initialization of other boot drivers until the Windows operating system is operational. When the system is started with a complete runtime environment (network access, storage, and so on), then a full-featured antimalware is loaded. + ELAM can load a Microsoft or non-Microsoft antimalware driver before all non-Microsoft boot drivers and applications, thus continuing the chain of trust established by Secure Boot and Trusted Boot. Because the operating system hasn’t started yet, and because Windows needs to boot as quickly as possible, ELAM has a simple task: Examine every boot driver and determine whether it is on the list of trusted drivers. If it’s not trusted, Windows won’t load it. - **Note**   - Windows Defender, Microsoft's antimalware included by default in Windows 10, supports ELAM; it can be replaced with a third-party antimalware compatible solution. The name of the Windows Defender ELAM driver is WdBoot.sys. Windows Defender in Windows 10 uses its ELAM driver to roll back any malicious changes made to the Windows Defender driver at the next reboot. This prevents kernel mode malware making lasting changes to Windows Defender’s mini-filter driver before shutdown or reboot. + + >**Note:**  Windows Defender, Microsoft's antimalware included by default in Windows 10, supports ELAM; it can be replaced with a third-party antimalware compatible solution. The name of the Windows Defender ELAM driver is WdBoot.sys. Windows Defender in Windows 10 uses its ELAM driver to roll back any malicious changes made to the Windows Defender driver at the next reboot. This prevents kernel mode malware making lasting changes to Windows Defender’s mini-filter driver before shutdown or reboot.   The ELAM signed driver is loaded before any other third-party drivers or applications, which allows the antimalware software to detect and block any attempts to tamper with the boot process by trying to load unsigned or untrusted code. + The ELAM driver is a small driver with a small policy database that has a very narrow scope, focused on drivers that are loaded early at system launch. The policy database is stored in a registry hive that is also measured to the TPM, to record the operational parameters of the ELAM driver. An ELAM driver must be signed by Microsoft and the associated certificate must contain the complementary EKU (1.3.6.1.4.1.311.61.4.1). - **Virtualization-based security (Hyper-V + Secure Kernel).** Virtualization-based security is a completely new enforced security boundary that allows you to protect critical parts of Windows 10. + Virtualization-based security isolates sensitive code like Kernel Mode Code Integrity or sensitive corporate domain credentials from the rest of the Windows operating system. For more information, refer to the [Virtualization-based security](#virtual) section. + - **Hyper-V Code Integrity (HVCI).** Hyper-V Code Integrity is a feature of Device Guard that ensures only drivers, executables, and DLLs that comply with the Device Guard Code Integrity policy are allowed to run. + When enabled and configured, Windows 10 can start the Hyper-V virtualization-based security services, including Hyper-V Code Integrity (HVCI). HVCI helps protect the system core (kernel), privileged drivers, and system defenses, like antimalware solutions, by preventing malware from running early in the boot process, or after startup. + HVCI uses virtualization-based security to isolate Code Integrity, the only way kernel memory can become executable is through a Code Integrity verification. This means that kernel memory pages can never be Writable and Executable (W+X) and executable code cannot be directly modified. - **Note**   - Device Guard devices that run Kernel Mode Code Integrity with virtualization-based security must have compatible drivers. For additional information, please read the [Driver compatibility with Device Guard in Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=691612) blog post. + + >**Note:**  Device Guard devices that run Kernel Mode Code Integrity with virtualization-based security must have compatible drivers. For additional information, please read the [Driver compatibility with Device Guard in Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=691612) blog post.   The Device Guard Code Integrity feature lets organizations control what code is trusted to run into the Windows kernel and what applications are approved to run in user mode. It’s configurable by using a policy. Device Guard Code Integrity policy is a binary file that Microsoft recommends you sign. The signing of the Code Integrity policy aids in the protection against a malicious user with Administrator privileges trying to modify or remove the current Code Integrity policy. + - **Credential Guard.** Credential Guard protects corporate credentials with hardware-based credential isolation. + In Windows 10, Credential Guard aims to protect domain corporate credentials from theft and reuse by malware. With Credential Guard, Windows 10 implemented an architectural change that fundamentally prevents the current forms of the pass-the-hash (PtH) attack. + This is accomplished by leveraging Hyper-V and the new virtualization-based security feature to create a protected container where trusted code and secrets are isolated from the Windows kernel. That means that even if the Windows kernel is compromised an attacker has no way to read and extract the data required to initiate a PtH attack. Credential Guard prevents this because the memory where secrets are stored is no longer accessible from the regular OS, even in kernel mode - the hypervisor controls who can access the memory. + - **Health attestation.** The device’s firmware logs the boot process, and Windows 10 can send it to a trusted server that can check and assess the device’s health. + Windows 10 takes measurements of the UEFI firmware and each of the Windows and antimalware components are made as they load during the boot process. Additionally, they are taken and measured sequentially, not all at once. When these measurements are complete, their values are digitally signed and stored securely in the TPM and cannot be changed unless the system is reset. + For more information, see [Secured Boot and Measured Boot: Hardening Early Boot Components Against Malware](http://go.microsoft.com/fwlink/p/?LinkId=733950). + During each subsequent boot, the same components are measured, which allows comparison of the measurements against an expected baseline. For additional security, the values measured by the TPM can be signed and transmitted to a remote server, which can then perform the comparison. This process, called *remote device health attestation*, allows the server to verify health status of the Windows device. + Health attestation requires the presence of TPM 2.0. On Windows 10, TPM 2.0 also requires UEFI firmware. + Although Secure Boot is a proactive form of protection, health attestation is a reactive form of boot protection. Health attestation ships disabled in Windows and is enabled by an antimalware or an MDM vendor. Unlike Secure Boot, health attestation will not stop the boot process and enter remediation when a measurement does not work. But with conditional access control, health attestation will help to prevent access to high-value assets. + ### Virtualization-based security + Virtualization-based security provides a new trust boundary for Windows 10. leverages Hyper-V hypervisor technology to enhance platform security. Virtualization-based security provides a secure execution environment to run specific Windows trusted code (trustlet) and to protect sensitive data. + Virtualization-based security helps to protect against a compromised kernel or a malicious user with Administrator privileges. Note that virtualization-based security is not trying to protect against a physical attacker. + The following Windows 10 services are protected with virtualization-based security: + - **Credential Guard** (LSA Credential Isolation): prevents pass-the-hash attacks and enterprise credential theft that happens by reading and dumping the content of lsass memory - **Device Guard** (Hyper-V Code Integrity): Device Guard uses the new virtualization-based security in Windows 10 to isolate the Code Integrity service from the Windows kernel itself, which lets the service use signatures defined by your enterprise-controlled policy to help determine what is trustworthy. In effect, the Code Integrity service runs alongside the kernel in a Windows hypervisor-protected container. - **Other isolated services**: for example, on Windows Server Technical Preview 2016, there is the vTPM feature that allows you to have encrypted virtual machines (VMs) on servers. -**Note**   -Virtualization-based security is only available with Windows 10 Enterprise. Virtualization-based security requires devices with UEFI (2.3.1 or higher) with Secure Boot enabled, x64 processor with Virtualization Extensions and SLAT enabled. IOMMU, TPM 2.0. and support for Secure Memory overwritten are optional, but recommended. + +>**Note:**  Virtualization-based security is only available with Windows 10 Enterprise. Virtualization-based security requires devices with UEFI (2.3.1 or higher) with Secure Boot enabled, x64 processor with Virtualization Extensions and SLAT enabled. IOMMU, TPM 2.0. and support for Secure Memory overwritten are optional, but recommended.   + The schema below is a high-level view of Windows 10 with virtualization-based security. + ![figure 5](images/hva-fig5-virtualbasedsecurity.png) + ### Credential Guard -In Windows 10, when Credential Guard is enabled, Local Security Authority Subsystem Service (lsass.exe) runs sensitive code in an Isolated user mode to help protect data from malware that may be running in the normal user mode. This helps ensure that protected data is not stolen and reused on remote machines, which mitigates many PtH-style attacks. + +In Windows 10, when Credential Guard is enabled, Local Security Authority Subsystem Service (lsass.exe) runs sensitive code in an Isolated user mode to help protect data from malware that may be running in the normal user mode. This helps ensure that protected data is not stolen and reused on +remote machines, which mitigates many PtH-style attacks. + Credential Guard helps protect credentials by encrypting them with either a per-boot or persistent key: + - **The per-boot key** is used for any in-memory credentials that do not require persistence. An example of such a credential would be a ticket-granting ticket (TGT) session key. This key is negotiated with a Key Distribution Center (KDC) every time authentication occurs and is protected with a per-boot key. - **The persistent key**, or some derivative, is used to help protect items that are stored and reloaded after a reboot. Such protection is intended for long-term storage, and must be protected with a consistent key. -Credential Guard is activated by a registry key and then enabled by using an UEFI variable. This is done to protect against remote modifications of the configuration. The use of a UEFI variable implies that physical access is required to change the configuration. When lsass.exe detects that credential isolation is enabled, it then spawns LsaIso.exe as an isolated process, which ensures that it runs within isolated user mode. The startup of LsaIso.exe is performed before initialization of a security support provider, which ensures that the secure mode support routines are ready before any authentication begins. +Credential Guard is activated by a registry key and then enabled by using an UEFI variable. This is done to protect against remote modifications of the configuration. The use of a UEFI variable implies that physical access is required to change the configuration. When lsass.exe detects that +credential isolation is enabled, it then spawns LsaIso.exe as an isolated process, which ensures that it runs within isolated user mode. The startup of LsaIso.exe is performed before initialization of a security support provider, which ensures that the secure mode support routines are ready before any authentication begins. + ### Device Guard + Device Guard is a new feature of Windows 10 Enterprise that allows organizations to lock down a device to help protect it from running untrusted software. In this configuration, the only applications allowed to run are those that are trusted by the organization. + The trust decision to execute code is performed by using Hyper-V Code Integrity, which runs in virtualization-based security, a Hyper-V protected container that runs alongside regular Windows. + Hyper-V Code Integrity is a feature that validates the integrity of a driver or system file each time it is loaded into memory. Code integrity detects whether an unsigned driver or system file is being loaded into the kernel, or whether a system file has been modified by malicious software that is being run by a user account with Administrator privileges. On x64-based versions of Windows 10 kernel-mode drivers must be digitally signed. -**Note**   -Independently of activation of Device Guard Policy, [Windows 10 by default raises the bar for what runs in the kernel](http://go.microsoft.com/fwlink/p/?LinkId=691613). Windows 10 drivers must be signed by Microsoft, and more specifically, by the WHQL (Windows Hardware Quality Labs) portal. Additionally, starting in October 2015, the WHQL portal will only accept driver submissions, including both kernel and user mode driver submissions, that have a valid Extended Validation (“EV”) Code Signing Certificate. + +>**Note:**  Independently of activation of Device Guard Policy, [Windows 10 by default raises the bar for what runs in the kernel](http://go.microsoft.com/fwlink/p/?LinkId=691613). Windows 10 drivers must be signed by Microsoft, and more specifically, by the WHQL (Windows Hardware Quality Labs) portal. Additionally, starting in October 2015, the WHQL portal will only accept driver submissions, including both kernel and user mode driver submissions, that have a valid Extended Validation (“EV”) Code Signing Certificate.   With Device Guard in Windows 10, organizations are now able to define their own Code Integrity policy for use on x64 systems running Windows 10 Enterprise. Organizations have the ability to configure the policy that determines what is trusted to run. These include drivers and system files, as well as traditional desktop applications and scripts. The system is then locked down to only run applications that the organization trusts. + Device Guard is a built-in feature of Windows 10 Enterprise that prevents the execution of unwanted code and applications. Device Guard can be configured using two rule actions - allow and deny: + - **Allow** limits execution of applications to an allowed list of code or trusted publisher and blocks everything else. - **Deny** completes the allow trusted publisher approach by blocking the execution of a specific application. + At the time of this writing, and according to Microsoft’s latest research, more than 90 percent of malware is unsigned completely. So implementing a basic Device Guard policy can simply and effectively help block the vast majority of malware. In fact, Device Guard has the potential to go further, and can also help block signed malware. + Device Guard needs to be planned and configured to be truly effective. It is not just a protection that is enabled or disabled. Device Guard is a combination of hardware security features and software security features that, when configured together, can lock down a computer to help ensure the most secure and resistant system possible. + There are three different parts that make up the Device Guard solution in Windows 10: + - The first part is a base **set of hardware security features** introduced with the previous version of Windows. TPM for hardware cryptographic operations and UEFI with modern firmware, along with Secure Boot, allows you to control what the device is running when the systems start. - After the hardware security feature, there is the code integrity engine. In Windows 10, **Code Integrity is now fully configurable** and now resides in Isolated user mode, a part of the memory that is protected by virtualization-based security. - The last part of Device Guard is **manageability**. Code Integrity configuration is exposed through specific Group Policy Objects, PowerShell cmdlets, and MDM configuration service providers (CSPs). + For more information on how to deploy Device Guard in an enterprise, see the [Device Guard deployment guide](device-guard-deployment-guide.md). + ### Device Guard scenarios + As previously described, Device Guard is a powerful way to lock down systems. Device Guard is not intended to be used broadly and it may not always be applicable, but there are some high-interest scenarios. -Device Guard is useful and applicable on fixed workloads systems like cash registers, kiosk machines, Secure Admin Workstations (SAWs), or well managed desktops. Device Guard is highly relevant on systems that have very well-defined software that are expected to run and don’t change too frequently. It could also help protect Information Workers (IWs) beyond just SAWs, as long as what they need to run is known and the set of applications is not going to change on a daily basis. + +Device Guard is useful and applicable on fixed workloads systems like cash registers, kiosk machines, Secure Admin Workstations (SAWs), or well managed desktops. Device Guard is highly relevant on systems that have very well-defined software that are expected to run and don’t change too frequently. +It could also help protect Information Workers (IWs) beyond just SAWs, as long as what they need to run is known and the set of applications is not going to change on a daily basis. + SAWs are computers that are built to help significantly reduce the risk of compromise from malware, phishing attacks, bogus websites, and PtH attacks, among other security risks. Although SAWs can’t be considered a “silver bullet” security solution to these attacks, these types of clients are helpful as part of a layered, defense-in-depth approach to security. + To protect high-value assets, SAWs are used to make secure connections to those assets. + Similarly, on corporate fully-managed workstations, where applications are installed by using a distribution tool like System Center Configuration Manager, Intune, or any third-party device management, then Device Guard is very applicable. In that type of scenario, the organization has a good idea of the software that an average user is running. + It could be challenging to use Device Guard on corporate, lightly-managed workstations where the user is typically allowed to install software on their own. When an organization offers great flexibility, it’s quite difficult to run Device Guard in enforcement mode. Nevertheless, Device Guard can be run in Audit mode, and in that case, the event log will contain a record of any binaries that violated the Device Guard policy. When Device Guard is used in Audit mode, organizations can get rich data about drivers and applications that users install and run. + Before you can benefit from the protection included in Device Guard, Code Integrity policy must be created by using tools provided by Microsoft, but the policy can be deployed with common management tools, like Group Policy. The Code Integrity policy is a binary-encoded XML document that includes configuration settings for both the User and Kernel-modes of Windows 10, along with restrictions on Windows 10 script hosts. Device Guard Code Integrity policy restricts what code can run on a device. -**Note**   -Device Guard policy can be signed in Windows 10, which adds additional protection against administrative users changing or removing this policy. + +>**Note:**  Device Guard policy can be signed in Windows 10, which adds additional protection against administrative users changing or removing this policy.   Signed Device Guard policy offers stronger protection against a malicious local administrator trying to defeat Device Guard. -When the policy is signed, the GUID of the policy is stored in a UEFI pre-OS secure variable which offers tampering protection. The only way to update the Device Guard policy subsequently is to provide a new version of the policy signed by the same signer or from a signer specified as part of the Device Guard policy into the UpdateSigner section. + +When the policy is signed, the GUID of the policy is stored in a UEFI pre-OS secure variable which offers tampering protection. The only way to update the Device Guard policy subsequently is to provide a new version of the policy signed by the same signer or from a signer specified as part of the +Device Guard policy into the UpdateSigner section. + ### The importance of signing applications + On computers with Device Guard, Microsoft proposes to move from a world where unsigned apps can be run without restriction to a world where only signed and trusted code is allowed to run on Windows 10. -With Windows 10, organizations will make line-of-business (LOB) apps available to members of the organization through the Windows Store infrastructure. More specifically, LOB apps will be available in a private store within the public Windows Store. Windows Store signs and distributes Universal Windows apps and Classic Windows apps. All apps downloaded from the Windows Store are signed. + +With Windows 10, organizations will make line-of-business (LOB) apps available to members of the organization through the Windows Store infrastructure. More specifically, LOB apps will be available in a private store within the public Windows Store. Windows Store signs and distributes Universal +Windows apps and Classic Windows apps. All apps downloaded from the Windows Store are signed. + In organizations today, the vast majority of LOB applications are unsigned. Code signing is frequently viewed as a tough problem to solve for a variety of reasons, like the lack of code signing expertise. Even if code signing is a best practice, a lot of internal applications are not signed. + Windows 10 includes tools that allow IT pros to take applications that have been already packaged and run them through a process to create additional signatures that can be distributed along with existing applications. + ### Why are antimalware and device management solutions still necessary? + Although allow-list mechanisms are extremely efficient at ensuring that only trusted applications can be run, they cannot prevent the compromise of a trusted (but vulnerable) application by malicious content designed to exploit a known vulnerability. Device Guard doesn’t protect against user mode malicious code run by exploiting vulnerabilities. + Vulnerabilities are weaknesses in software that could allow an attacker to compromise the integrity, availability, or confidentiality of the device. Some of the worst vulnerabilities allow attackers to exploit the compromised device by causing it to run malicious code without the user’s knowledge. + It’s common to see attackers distributing specially crafted content in an attempt to exploit known vulnerabilities in user mode software like web browsers (and their plug-ins), Java virtual machines, PDF readers, or document editors. As of today, 90 percent of discovered vulnerabilities affect user mode applications compared to the operating system and kernel mode drivers that host them. + To combat these threats, patching is the single most effective control, with antimalware software forming complementary layers of defense. + Most application software has no facility for updating itself, so even if the software vendor publishes an update that fixes the vulnerability, the user may not know that the update is available or how to obtain it, and therefore remains vulnerable to attack. Organizations still need to manage devices and to patch vulnerabilities. + MDM solutions are becoming prevalent as a light-weight device management technology. Windows 10 extends the management capabilities that have become available for MDMs. One key feature Microsoft has added to Windows 10 is the ability for MDMs to acquire a strong statement of device health from managed and registered devices. + ### Device health attestation + Device health attestation leverages the TPM 2.0 to provide cryptographically strong and verifiable measurements of the chain of software used to boot the device. + For Windows 10-based devices, Microsoft introduces a new public API that will allow MDM software to access a remote attestation service called Windows Health Attestation Service. A health attestation result, in addition with other elements, can be used to allow or deny access to networks, apps, or services, based on whether devices prove to be healthy. + For more information on device health attestation, see the [Detect an unhealthy Windows 10-based device](#detect-unhealthy) section. + ### Hardware requirements + The following table details the hardware requirements for both virtualization-based security services and the health attestation feature. For more information, see [Minimum hardware requirements](http://go.microsoft.com/fwlink/p/?LinkId=733951). + @@ -274,33 +373,57 @@ The following table details the hardware requirements for both virtualization-ba
        This section presented information about several closely related controls in Windows 10. The multi-layer defenses and in-depth approach helps to eradicate low-level malware during boot sequence. Virtualization-based security is a fundamental operating system architecture change that adds a new security boundary. Device Guard and Credential Guard respectively help to block untrusted code and protect corporate domain credentials from theft and reuse. This section also briefly discussed the importance of managing devices and patching vulnerabilities. All these technologies can be used to harden and lock down devices while limiting the risk of attackers compromising them. + ## Detect an unhealthy Windows 10-based device + As of today, many organizations only consider devices to be compliant with company policy after they’ve passed a variety of checks that show, for example, that the operating system is in the correct state, properly configured, and has security protection enabled. Unfortunately, with today’s systems, this form of reporting is not entirely reliable because malware can spoof a software statement about system health. A rootkit, or a similar low-level exploit, can report a false healthy state to traditional compliance tools. + The biggest challenge with rootkits is that they can be undetectable to the client. Because they start before antimalware, and they have system-level privileges, they can completely disguise themselves while continuing to access system resources. As a result, traditional computers infected with rootkits appear to be healthy, even with antimalware running. + As previously discussed, the health attestation feature of Windows 10 uses the TPM 2.0 hardware component to securely record a measurement of every boot-related component, including firmware, Windows 10 kernel, and even early boot drivers. Because, health attestation leverages the hardware-based security capabilities of TPM, the log of all boot measured components remains out of the reach of any malware. + By attesting a trusted boot state, devices can prove that they are not running low-level malware that could spoof later compliance checks. TPM-based health attestation provides a reliable anchor of trust for assets that contain high-value data. + ### What is the concept of device health? + To understand the concept of device health, it’s important to know traditional measures that IT pros have taken to prevent the breach of malware. Malware control technologies are highly focused on the prevention of installation and distribution. + However, the use of traditional malware prevention technologies like antimalware or patching solutions brings a new set of issues for IT pros: the ability to monitor and control the compliance of devices accessing organization’s resources. + The definition of device compliance will vary based on an organization’s installed antimalware, device configuration settings, patch management baseline, and other security requirements. But health of the device is part of the overall device compliance policy. + The health of the device is not binary and depends on the organization’s security implementation. The Health Attestation Service provides information back to the MDM on which security features are enabled during the boot of the device by leveraging trustworthy hardware TPM. + But health attestation only provides information, which is why an MDM solution is needed to take and enforce a decision. + ### Remote device health attestation + In Windows 10, health attestation refers to a feature where Measured Boot data generated during the boot process is sent to a remote device health attestation service operated by Microsoft. + This is the most secure approach available for Windows 10-based devices to detect when security defenses are down. During the boot process, the TCG log and PCRs values are sent to a remote Microsoft cloud service. Logs are then checked by the Health Attestation Service to determine what changes have occurred on the device. + A relying party like an MDM can inspect the report generated by the remote health attestation service. -**Note**   -To use the health attestation feature of Windows 10, the device must be equipped with a discrete or firmware TPM 2.0. There is no restriction on any particular edition of Windows 10. + +>**Note:**  To use the health attestation feature of Windows 10, the device must be equipped with a discrete or firmware TPM 2.0. There is no restriction on any particular edition of Windows 10.   Windows 10 supports health attestation scenarios by allowing applications access to the underlying health attestation configuration service provider (CSP) so that applications can request a health attestation token. The measurement of the boot sequence can be checked at any time locally by an antimalware or an MDM agent. + Remote device health attestation combined with an MDM provides a hardware-rooted method for reporting the current security status and detecting any changes, without having to trust the software running on the system. + In the case where malicious code is running on the device, the use of a remote server is required. If a rootkit is present on the device, the antimalware is no longer reliable, and its behavior can be hijacked by a malicious code running early in the startup sequence. That's why it's important to use Secure Boot and Device Guard, to control which code is loaded during the boot sequence. + The antimalware software can search to determine whether the boot sequence contains any signs of malware, such as a rootkit. It can also send the TCG log and the PCRs to a remote health attestation server to provide a separation between the measurement component and the verification component. + Health attestation logs the measurements in various TPM Platform Configuration Registers (PCRs) and TCG logs during the boot process. + ![figure 6](images/hva-fig6-logs.png) + When starting a device equipped with a TPM, a measurement of different components is performed. This includes firmware, UEFI drivers, CPU microcode, and also all the Windows 10 drivers whose type is Boot Start. The raw measurements are stored in the TPM PCR registers while the details of all events (executable path, authority certification, and so on) are available in the TCG log. + ![figure 7](images/hva-fig7-measurement.png) + The health attestation process works as follows: + 1. Hardware boot components are measured. 2. Operating system boot components are measured. 3. If Device Guard is enabled, current Device Guard policy is measured. @@ -309,90 +432,138 @@ The health attestation process works as follows: 6. Boot start drivers are measured. 7. MDM server through the MDM agent issues a health check command by leveraging the Health Attestation CSP. 8. Boot measurements are validated by the Health Attestation Service -**Note**   -By default, the last 100 system boot logs and all associated resume logs are archived in the %SystemRoot%\\logs\\measuredboot folder. + +>**Note:**  By default, the last 100 system boot logs and all associated resume logs are archived in the %SystemRoot%\\logs\\measuredboot folder. The number of retained logs may be set with the registry **REG\_DWORD** value **PlatformLogRetention** under the **HKLM\\SYSTEM\\CurrentControlSet\\Services\\TPM** key. A value of **0** will turn off log archival and a value of **0xffffffff** will keep all logs.   The following process describes how health boot measurements are sent to the health attestation service: + 1. The client (a Windows 10-based device with a TPM 2.0) initiates the request with the remote device health attestation service. Because the health attestation server is expected to be a Microsoft cloud service, the URI is already pre-provisioned in the client. 2. The client then sends the TCG log, the AIK signed data (PCR values, boot counter) and the AIK certificate information. 3. The remote device heath attestation service then: + 1. Verifies that the AIK certificate is issued by a known and trusted CA and the certificate is valid and not revoked. 2. Verifies that the signature on the PCR quotes is correct and consistent with the TCG log value. 3. Parses the properties in the TCG log. 4. Issues the device health token that contains the health information, the AIK information, and the boot counter information. The health token also contains valid issuance time. The device health token is encrypted and signed, that means that the information is protected and only accessible to issuing health attestation service. + 4. The client stores the health encrypted blob in its local store. The device health token contains device health status, a device ID (the Windows AIK), and the boot counter. + ![figure 8](images/hva-fig8a-healthattest8a.png) + ### Device health attestation components + The device health attestation solution involves different components that are TPM, Health Attestation CSP, and the Windows Health Attestation Service. Those components are described in this section. + ### Trusted Platform Module + *It’s all about TPM 2.0 and endorsement certificates.* This section describes how PCRs (that contain system configuration data), endorsement key (EK) (that act as an identity card for TPM), SRK (that protect keys) and AIKs (that can report platform state) are used for health attestation reporting. + In a simplified manner, the TPM is a passive component with limited resources. It can calculate random numbers, RSA keys, decrypt short data, store hashes taken when booting the device. + A TPM incorporates in a single component: + - A RSA 2048-bit key generator - A random number generator - Nonvolatile memory for storing EK, SRK, and AIK keys - A cryptographic engine to encrypt, decrypt, and sign - Volatile memory for storing the PCRs and RSA keys + ### Endorsement key + The TPM has an embedded unique cryptographic key called the endorsement key. The TPM endorsement key is a pair of asymmetric keys (RSA size 2048 bits). + The endorsement key public key is generally used for sending securely sensitive parameters, such as when taking possession of the TPM that contains the defining hash of the owner password. The EK private key is used when creating secondary keys like AIKs. + The endorsement key acts as an identity card for the TPM. For more information, see [Understand the TPM endorsement key](http://go.microsoft.com/fwlink/p/?LinkId=733952). + The endorsement key is often accompanied by one or two digital certificates: + - One certificate is produced by the TPM manufacturer and is called the **endorsement certificate**. The endorsement certificate is used to prove the authenticity of the TPM (for example, that it’s a real TPM manufactured by a specific chip maker) to local processes, applications, or cloud services. The endorsement certificate is created during manufacturing or the first time the TPM is initialized by communicating with an online service. - The other certificate is produced by the platform builder and is called the **platform certificate** to indicate that a specific TPM is integrated with a certain device. For certain devices that use firmware-based TPM produced by Intel or Qualcomm, the endorsement certificate is created when the TPM is initialized during the OOBE of Windows 10. -**Note**   -Secure Boot protects the platform until the Windows kernel is loaded. Then protections like Trusted Boot, Hyper-V Code Integrity and ELAM take over. A device that uses Intel TPM or Qualcomm TPM gets a signed certificate online from the manufacturer that has created the chip and then stores the signed certificate in TPM storage. For the operation to succeed, if you are filtering Internet access from your client devices, you must authorize the following URLs: + +>**Note:**  Secure Boot protects the platform until the Windows kernel is loaded. Then protections like Trusted Boot, Hyper-V Code Integrity and ELAM take over. A device that uses Intel TPM or Qualcomm TPM gets a signed certificate online from the manufacturer that has created the chip and then stores the signed certificate in TPM storage. For the operation to succeed, if you are filtering Internet access from your client devices, you must authorize the following URLs: + - For Intel firmware TPM: **https://ekop.intel.com/ekcertservice** - For Qualcomm firmware TPM: **https://ekcert.spserv.microsoft.com/**   ### Attestation Identity Keys + Because the endorsement certificate is unique for each device and does not change, the usage of it may present privacy concerns because it's theoretically possible to track a specific device. To avoid this privacy problem, Windows 10 issues a derived attestation anchor based on the endorsement certificate. This intermediate key, which can be attested to an endorsement key, is the Attestation Identity Key (AIK) and the corresponding certificate is called the AIK certificate. This AIK certificate is issued by a Microsoft cloud service. -**Note**   -Before the device can report its health using the TPM 2.0 attestation functions, an AIK certificate must be provisioned in conjunction with a third-party service like the Microsoft Cloud CA service. After it is provisioned, the AIK private key can be used to report platform configuration. Windows 10 creates a signature over the platform log state (and a monotonic counter value) at each boot by using the AIK. + +>**Note:**  Before the device can report its health using the TPM 2.0 attestation functions, an AIK certificate must be provisioned in conjunction with a third-party service like the Microsoft Cloud CA service. After it is provisioned, the AIK private key can be used to report platform configuration. Windows 10 creates a signature over the platform log state (and a monotonic counter value) at each boot by using the AIK.   The AIK is an asymmetric (public/private) key pair that is used as a substitute for the EK as an identity for the TPM for privacy purposes. The private portion of an AIK is never revealed or used outside the TPM and can only be used inside the TPM for a limited set of operations. Furthermore, it can only be used for signing, and only for limited, TPM-defined operations. -Windows 10 creates AIKs protected by the TPM, if available, that are 2048-bit RSA signing keys. Microsoft is hosting a cloud service called Microsoft Cloud CA to establish cryptographically that it is communicating with a real TPM and that the TPM possesses the presented AIK. After the Microsoft Cloud CA service has established these facts, it will issue an AIK certificate to the Windows 10-based device. + +Windows 10 creates AIKs protected by the TPM, if available, that are 2048-bit RSA signing keys. Microsoft is hosting a cloud service called Microsoft Cloud CA to establish cryptographically that it is communicating with a real TPM and that the TPM possesses the presented AIK. After the Microsoft +Cloud CA service has established these facts, it will issue an AIK certificate to the Windows 10-based device. + Many existing devices that will upgrade to Windows 10 will not have a TPM, or the TPM will not contain an endorsement certificate. **To accommodate those devices, Windows 10 allows the issuance of AIK certificates without the presence of an endorsement certificate.** Such AIK certificates are not issued by Microsoft Cloud CA. Note that this is not as trustworthy as an endorsement certificate that is burned into the device during manufacturing, but it will provide compatibility for advanced scenarios like Microsoft Passport without TPM. + In the issued AIK certificate, a special OID is added to attest that endorsement certificate was used during the attestation process. This information can be leveraged by a relying party to decide whether to reject devices that are attested using AIK certificates without an endorsement certificate or accept them. Another scenario can be to not allow access to high-value assets from devices that are attested by an AIK certificate that is not backed by an endorsement certificate. + ### Storage root key + The storage root key (SRK) is also an asymmetric key pair (RSA with a minimum of 2048 bits length). The SRK has a major role and is used to protect TPM keys, so that these keys cannot be used without the TPM. The SRK key is created when the ownership of the TPM is taken. + ### Platform Configuration Registers + The TPM contains a set of registers that are designed to provide a cryptographic representation of the software and state of the system that booted. These registers are called Platform Configuration Registers (PCRs). + The measurement of the boot sequence is based on the PCR and TCG log. To establish a static root of trust, when the device is starting, the device must be able to measure the firmware code before execution. In this case, the Core Root of Trust for Measurement (CRTM) is executed from the boot, calculates the hash of the firmware, then stores it by expanding the register PCR\[0\] and transfers execution to the firmware. + PCRs are set to zero when the platform is booted, and it is the job of the firmware that boots the platform to measure components in the boot chain and to record the measurements in the PCRs. Typically, boot components take the hash of the next component that is to be run and record the measurements in the PCRs. The initial component that starts the measurement chain is implicitly trusted. This is the CRTM. Platform manufacturers are required to have a secure update process for the CRTM or not permit updates to it. The PCRs record a cumulative hash of the components that have been measured. + The value of a PCR on its own is hard to interpret (it is just a hash value), but platforms typically keep a log with details of what has been measured, and the PCRs merely ensure that the log has not been tampered with. The logs are referred as a TCG log. Each time a register PCR is extended, an entry is added to the TCG log. Thus, throughout the boot process, a trace of the executable code and configuration data is created in the TCG log. + ### TPM provisioning + For the TPM of a Windows 10-based device to be usable, it must first be provisioned. The process of provisioning differs somewhat based on TPM versions, but, when successful, it results in the TPM being usable and the owner authorization data (ownerAuth) for the TPM being stored locally on the registry. + When the TPM is provisioned, Windows 10 will first attempt to determine the EK and locally stored **ownerAuth** values by looking in the registry at the following location: **HKLM\\SYSTEM\\CurrentControlSet\\Services\\TPM\\WMI\\Endorsement** + During the provisioning process, the device may need to be restarted. + Note that the **Get-TpmEndorsementKeyInfo PowerShell** cmdlet can be used with administrative privilege to get information about the endorsement key and certificates of the TPM. -If the TPM ownership is not known but the EK exists, the client library will provision the TPM and will store the resulting **ownerAuth** value into the registry if the policy allows it will store the SRK public portion at the following location: **HKLM\\SYSTEM\\CurrentControlSet\\Services\\TPM\\WMI\\Admin\\SRKPub** + +If the TPM ownership is not known but the EK exists, the client library will provision the TPM and will store the resulting **ownerAuth** value into the registry if the policy allows it will store the SRK public portion at the following location: +**HKLM\\SYSTEM\\CurrentControlSet\\Services\\TPM\\WMI\\Admin\\SRKPub** + As part of the provisioning process, Windows 10 will create an AIK with the TPM. When this operation is performed, the resulting AIK public portion is stored in the registry at the following location: **HKLM\\SYSTEM\\CurrentControlSet\\Services\\TPM\\WMI\\WindowsAIKPub** -**Note**   -For provisioning AIK certificates and filtering Internet access, you must authorize the following wildcard URL: **https://\*.microsoftaik.azure.net** + +>**Note:**  For provisioning AIK certificates and filtering Internet access, you must authorize the following wildcard URL: **https://\*.microsoftaik.azure.net**   ### Windows 10 Health Attestation CSP + Windows 10 contains a configuration service provider (CSP) specialized for interacting with the health attestation feature. A CSP is a component that plugs into the Windows MDM client and provides a published protocol for how MDM servers can configure settings and manage Windows-based devices. The management protocol is represented as a tree structure that can be specified as URIs with functions to perform on the URIs such as “get”, “set”, “delete”, and so on. + The following is a list of functions performed by the Windows 10 Health Attestation CSP: + - Collects data that is used to verify a device’s health status - Forwards the data to the Health Attestation Service - Provisions the Health Attestation Certificate that it receives from the Health Attestation Service - Upon request, forwards the Health Attestation Certificate (received from the Health Attestation Service) and related runtime information to the MDM server for verification + During a health attestation session, the Health Attestation CSP forwards the TCG logs and PCRs values that are measured during the boot, by using a secure communication channel to the Health Attestation Service. + When an MDM server validates that a device has attested to the Health Attestation Service, it will be given a set of statements and claims about how that device booted, with the assurance that the device did not reboot between the time that it attested its health and the time that the MDM server validated it. + ### Windows Health Attestation Service + The role of Windows Health Attestation Service is essentially to evaluate a set of health data (TCG log and PCR values), make a series of detections (based on available health data) and generate encrypted health blob or produce report to MDM servers. -**Note**   -Both device and MDM servers must have access to **has.spserv.microsoft.com** using the TCP protocol on port 443 (HTTPS). + +>**Note:**  Both device and MDM servers must have access to **has.spserv.microsoft.com** using the TCP protocol on port 443 (HTTPS).   Checking that a TPM attestation and the associated log are valid takes several steps: + 1. First, the server must check that the reports are signed by **trustworthy AIKs**. This might be done by checking that the public part of the AIK is listed in a database of assets, or perhaps that a certificate has been checked. 2. After the key has been checked, the signed attestation (a quote structure) should be checked to see whether it is a **valid signature over PCR values**. 3. Next the logs should be checked to ensure that they match the PCR values reported. 4. Finally, the logs themselves should be examined by an MDM solution to see whether they represent **known or valid security configurations**. For example, a simple check might be to see whether the measured early OS components are known to be good, that the ELAM driver is as expected, and that the ELAM driver policy file is up to date. If all of these checks succeed, an attestation statement can be issued that later can be used to determine whether or not the client should be granted access to a resource. + The Health Attestation Service provides the following information to an MDM solution about the health of the device: + - Secure Boot enablement - Boot and kernel debug enablement - BitLocker enablement @@ -401,8 +572,11 @@ The Health Attestation Service provides the following information to an MDM solu - ELAM loaded - Safe Mode boot, DEP enablement, test signing enablement - Device TPM has been provisioned with a trusted endorsement certificate + For completeness of the measurements, see [Health Attestation CSP](http://go.microsoft.com/fwlink/p/?LinkId=733949). + The following table presents some key items that can be reported back to MDM depending on the type of Windows 10-based device. + @@ -446,90 +620,139 @@ The following table presents some key items that can be reported back to MDM dep
        ### Leverage MDM and the Health Attestation Service + To make device health relevant, the MDM solution evaluates the device health report and is configured to the organization’s device health requirements. + A solution that leverages MDM and the Health Attestation Service consists of three main parts: + 1. A device with health attestation enabled. This will usually be done as a part of enrollment with an MDM provider (health attestation will be disabled by default). 2. After this is enabled, and every boot thereafter, the device will send health measurements to the Health Attestation Service hosted by Microsoft, and it will receive a health attestation blob in return. 3. At any point after this, an MDM server can request the health attestation blob from the device and ask Health Attestation Service to decrypt the content and validate that it’s been attested. + ![figure 9](images/hva-fig8-evaldevicehealth8.png) + Interaction between a Windows 10-based device, the Health Attestation Service, and MDM can be performed as follows: + 1. The client initiates a session with the MDM server. The URI for the MDM server would be part of the client app that initiates the request. The MDM server at this time could request the health attestation data by using the appropriate CSP URI. 2. The MDM server specifies a nonce along with the request. 3. The client then sends the AIK quoted nonce + the boot counter and the health blob information. This health blob is encrypted with a Health Attestation Service public key that only the Health Attestation Service can decrypt. 4. The MDM server: + 1. Verifies that the nonce is as expected. 2. Passes the quoted data, the nonce and the encrypted health blob to the Health Attestation Service server. + 5. The Health Attestation Service: + 1. Decrypts the health blob. 2. Verifies that the boot counter in the quote is correct using the AIK in the health blob and matches the value in the health blob. 3. Verifies that the nonce matches in the quote and the one that is passed from MDM. 4. Because the boot counter and the nonce are quoted with the AIK from the health blob, it also proves that the device is the same one as the one for which the health blob has been generated. 5. Sends data back to the MDM server including health parameters, freshness, and so on. -**Note**   -The MDM server (relying party) never performs the quote or boot counter validation itself. It gets the quoted data and the health blob (which is encrypted) and sends the data to the Health Attestation Service for validation. This way, the AIK is never visible to the MDM, which thereby addresses privacy concerns. + +>**Note:**  The MDM server (relying party) never performs the quote or boot counter validation itself. It gets the quoted data and the health blob (which is encrypted) and sends the data to the Health Attestation Service for validation. This way, the AIK is never visible to the MDM, which thereby addresses privacy concerns.   Setting the requirements for device compliance is the first step to ensure that registered devices that do not meet health and compliance requirements are detected, tracked, and have actions enforced by the MDM solution. -Devices that attempt to connect to resources must have their health evaluated so that unhealthy and noncompliant devices can be detected and reported. To be fully efficient, an end-to-end security solution must impose a consequence for unhealthy devices like refusing access to high-value assets. That is the purpose of conditional access control, which is detailed in the next section. + +Devices that attempt to connect to resources must have their health evaluated so that unhealthy and noncompliant devices can be detected and reported. To be fully efficient, an end-to-end security solution must impose a consequence for unhealthy devices like refusing access to high-value assets. +That is the purpose of conditional access control, which is detailed in the next section. + ## Control the security of a Windows 10-based device before access is granted + Today’s access control technology, in most cases, focuses on ensuring that the right people get access to the right resources. If users can authenticate, they get access to resources using a device that the organization’s IT staff and systems know very little about. Perhaps there is some check such as ensuring that a device is encrypted before giving access to email, but what if the device is infected with malware? + The remote device health attestation process uses measured boot data to verify the health status of the device. The health of the device is then available for an MDM solution like Intune. -**Note**   -For the latest information on Intune and Windows 10 features support, see the [Microsoft Intune blog](http://go.microsoft.com/fwlink/p/?LinkId=691614) and [What's new in Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkId=733956). + +>**Note:**  For the latest information on Intune and Windows 10 features support, see the [Microsoft Intune blog](http://go.microsoft.com/fwlink/p/?LinkId=691614) and [What's new in Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkId=733956).   The figure below shows how the Health Attestation Service is expected to work with Microsoft’s cloud-based Intune MDM service. + ![figure 10](images/hva-fig9-intune.png) -An MDM solution can then leverage health state statements and take them to the next level by coupling with client policies that will enable conditional access to be granted based on the device’s ability to prove that it’s malware free, its antimalware system is functional and up to date, the firewall is running, and the devices patch state is compliant. + +An MDM solution can then leverage health state statements and take them to the next level by coupling with client policies that will enable conditional access to be granted based on the device’s ability to prove that it’s malware free, its antimalware system is functional and up to date, the +firewall is running, and the devices patch state is compliant. + Finally, resources can be protected by denying access to endpoints that are unable to prove they’re healthy. This feature is much needed for BYOD devices that need to access organizational resources. + ### Built-in support of MDM in Windows 10 + Windows 10 has an MDM client that ships as part of the operating system. This enables MDM servers to manage Windows 10-based devices without requiring a separate agent. + ### Third-party MDM server support + Third-party MDM servers can manage Windows 10 by using the MDM protocol. The built-in management client is able to communicate with a compatible server that supports the OMA-DM protocol to perform enterprise management tasks. For additional information, see [Azure Active Directory integration with MDM](http://go.microsoft.com/fwlink/p/?LinkId=733954). -**Note**   -MDM servers do not need to create or download a client to manage Windows 10. For more information, see [Mobile device management](http://go.microsoft.com/fwlink/p/?LinkId=733955). + +>**Note:**  MDM servers do not need to create or download a client to manage Windows 10. For more information, see [Mobile device management](http://go.microsoft.com/fwlink/p/?LinkId=733955).   The third-party MDM server will have the same consistent first-party user experience for enrollment, which also provides simplicity for Windows 10 users. + ### Management of Windows Defender by third-party MDM + This management infrastructure makes it possible for IT pros to use MDM-capable products like Intune, to manage health attestation, Device Guard, or Windows Defender on Windows 10-based devices, including BYODs that aren’t domain joined. IT pros will be able to manage and configure all of the actions and settings they are familiar with customizing by using Intune with Intune Endpoint Protection on down-level operating systems. Admins that currently only manage domain joined devices through Group Policy will find it easy to transition to managing Windows 10-based devices by using MDM because many of the settings and actions are shared across both mechanisms. + For more information on how to manage Windows 10 security and system settings with an MDM solution, see [Custom URI settings for Windows 10 devices](http://go.microsoft.com/fwlink/p/?LinkId=733953). + ### Conditional access control + On most platforms, the Azure Active Directory (Azure AD) device registration happens automatically during enrollment. The device states are written by the MDM solution into Azure AD, and then read by Office 365 (or by any authorized Windows app that interacts with Azure AD) the next time the client tries to access an Office 365 compatible workload. + If the device is not registered, the user will get a message with instructions on how to register (also known as enrolling). If the device is not compliant, the user will get a different message that redirects them to the MDM web portal where they can get more information on the compliance problem and how to resolve it. + **Azure AD** authenticates the user and the device, **MDM** manages the compliance and conditional access policies, and the **Health Attestation Service** reports about the health of the device in an attested way. + ![figure 11](images/hva-fig10-conditionalaccesscontrol.png) + ### Office 365 conditional access control -Azure AD enforces conditional access policies to secure access to Office 365 services. A tenant admin can create a conditional access policy that blocks a user on a non-compliant device from accessing an Office 365 service. The user must conform to the company’s device policies before access can be granted to the service. Alternately, the admin can also create a policy that requires users to just enroll their devices to gain access to an Office 365 service. Policies may be applied to all users of an organization, or limited to a few target groups and enhanced over time to include additional target groups. + +Azure AD enforces conditional access policies to secure access to Office 365 services. A tenant admin can create a conditional access policy that blocks a user on a non-compliant device from accessing an Office 365 service. The user must conform to the company’s device policies before access can be granted to the service. Alternately, the admin can also create a policy that requires users to just enroll their devices to gain access to an Office 365 service. Policies may be applied to all users of an organization, or limited to a few target groups and enhanced over time to include additional +target groups. + When a user requests access to an Office 365 service from a supported device platform, Azure AD authenticates the user and device from which the user launches the request; and grants access to the service only when the user conforms to the policy set for the service. Users that do not have their device enrolled are given remediation instructions on how to enroll and become compliant to access corporate Office 365 services. + When a user enrolls, the device is registered with Azure AD, and enrolled with a compatible MDM solution like Intune. -**Note**   -Microsoft is working with third-party MDM ISVs to support automated MDM enrollment and policy based access checks. Steps to turn on auto-MDM enrollment with Azure AD and Intune are explained in the [Windows 10, Azure AD And Microsoft Intune: Automatic MDM Enrollment Powered By The Cloud!](http://go.microsoft.com/fwlink/p/?LinkId=691615) blog post. + +>**Note**  Microsoft is working with third-party MDM ISVs to support automated MDM enrollment and policy based access checks. Steps to turn on auto-MDM enrollment with Azure AD and Intune are explained in the [Windows 10, Azure AD And Microsoft Intune: Automatic MDM Enrollment Powered By The Cloud!](http://go.microsoft.com/fwlink/p/?LinkId=691615) blog post.   When a user enrolls a device successfully, the device becomes trusted. Azure AD provides single-sign-on to access company applications and enforces conditional access policy to grant access to a service not only the first time the user requests access, but every time the user requests to renew access. + The user will be denied access to services when sign-in credentials are changed, a device is lost/stolen, or the compliance policy is not met at the time of request for renewal. + Depending on the type of email application that employees use to access Exchange online, the path to establish secured access to email can be slightly different. However, the key components: Azure AD, Office 365/Exchange Online, and Intune, are the same. The IT experience and end-user experience also are similar. + ![figure 12](images/hva-fig11-office365.png) + Clients that attempt to access Office 365 will be evaluated for the following properties: + - Is the device managed by an MDM? - Is the device registered with Azure AD? - Is the device compliant? + To get to a compliant state, the Windows 10-based device needs to: + - Enroll with an MDM solution. - Register with Azure AD. - Be compliant with the device policies set by the MDM solution. -**Note**   -At the present time, conditional access policies are selectively enforced on users on iOS and Android devices. For more information, see the [Azure AD, Microsoft Intune and Windows 10 – Using the cloud to modernize enterprise mobility!](http://go.microsoft.com/fwlink/p/?LinkId=691616) blog post. + +>**Note:**  At the present time, conditional access policies are selectively enforced on users on iOS and Android devices. For more information, see the [Azure AD, Microsoft Intune and Windows 10 – Using the cloud to modernize enterprise mobility!](http://go.microsoft.com/fwlink/p/?LinkId=691616) blog post.   ### Cloud and on-premises apps conditional access control + Conditional access control is a powerful policy evaluation engine built into Azure AD. It gives IT pros an easy way to create access rules beyond Office 365 that evaluate the context of a user's logon to make real-time decisions about which applications they should be allowed to access. + IT pros can configure conditional access control policies for cloud SaaS applications secured by Azure AD and even on-premises applications. Access rules in Azure AD leverage the conditional access engine to check device health and compliance state reported by a compatible MDM solution like Intune in order to determine whether to allow access. + For more information about conditional access, see [Azure Conditional Access Preview for SaaS Apps.](http://go.microsoft.com/fwlink/p/?LinkId=524807) -**Note**   -Conditional access control is an Azure AD Premium feature that's also available with EMS. If you don't have an Azure AD Premium subscription, you can get a trial from the [Microsoft Azure](http://go.microsoft.com/fwlink/p/?LinkId=691617) site. + +>**Note:**  Conditional access control is an Azure AD Premium feature that's also available with EMS. If you don't have an Azure AD Premium subscription, you can get a trial from the [Microsoft Azure](http://go.microsoft.com/fwlink/p/?LinkId=691617) site.   For on-premises applications there are two options to enable conditional access control based on a device's compliance state: + - For on-premises applications that are published through the Azure AD Application Proxy, you can configure conditional access control policies as you would for cloud applications. For more details, see the [Azure AD Conditional Access preview updated: Now supports On-Premises and Custom LOB apps](http://go.microsoft.com/fwlink/p/?LinkId=691618) blog post. - Additionally, Azure AD Connect will sync device compliance information from Azure AD to on-premises AD. ADFS on Windows Server Technical Preview 2016 will support conditional access control based on a device's compliance state. IT pros will configure conditional access control policies in ADFS that use the device's compliance state reported by a compatible MDM solution to secure on-premises applications. + ![figure 13](images/hva-fig12-conditionalaccess12.png) + The following process describes how Azure AD conditional access works: + 1. User has already enrolled with MDM through Workplace Access/Azure AD join which registers device with Azure AD. 2. When the device boots or resumes from hibernate, a task “Tpm-HASCertRetr” is triggered to request in background a health attestation blob. Device sends TPM boot measurements to the Health Attestation Service. 3. Health Attestation Service validates device state and issues an encrypted blob to the device based on the health state with details on failed checks (if any). @@ -544,34 +767,59 @@ The following process describes how Azure AD conditional access works: 12. Access gated by compliance claim in Azure AD. 13. If the device is compliant and the user is authorized, an access token is generated. 14. User can access the corporate managed asset. + For more information about Azure AD join, see the [Azure AD & Windows 10: Better Together for Work or School](http://go.microsoft.com/fwlink/p/?LinkId=691619) white paper. + Conditional access control is a topic that many organizations and IT pros may not know as well as they should. The different attributes that describe a user, a device, compliance, and context of access are very powerful when used with a conditional access engine. Conditional access control is an essential step that helps organizations secure their environment. + ## Takeaways and summary + The following list contains high-level key take-aways to improve the security posture of any organization. However, the few take-aways presented in this section should not be interpreted as an exhaustive list of security best practices. + - **Understand that no solution is 100 percent secure** + If determined adversaries with malicious intent gain physical access to the device, they could eventually break through its security layers and control it. + - **Use health attestation with an MDM solution** + Devices that attempt to connect to high-value assets must have their health evaluated so that unhealthy and noncompliant devices can be detected, reported, and eventually blocked. + - **Use Credential Guard** + Credential Guard is a feature that greatly helps protect corporate domain credentials from pass-the-hash attacks. + - **Use Device Guard** + Device Guard is a real advance in security and an effective way to help protect against malware. The new Device Guard feature in Windows 10 blocks untrusted apps (apps not authorized by your organization). + - **Sign Device Guard policy** + Signed Device Guard policy helps protect against a user with administrator privileges trying to defeat the current policy. When a policy is signed, the only way to modify Device Guard subsequently is to provide a new version of the policy signed by the same signer or from a signer specify as part of the Device Guard policy. + - **Use virtualization-based security** + When you have Kernel Mode Code Integrity protected by virtualization-based security, the code integrity rules are still enforced even if a vulnerability allows unauthorized kernel mode memory access. Keep in mind that Device Guard devices that run Kernel Code Integrity with virtualization-based security must have compatible drivers. + - **Start to deploy Device Guard with Audit mode** + Deploy Device Guard policy to targeted computers and devices in Audit mode. Monitor the Code Integrity event log that indicates a program or a driver would have been blocked if Device Guard was configured in Enforcement mode. Adjust Device Guard rules until a high level of confidence has been reached. After the testing phase has been completed, Device Guard policy can be switched to Enforcement mode. + - **Build an isolated reference machine when deploying Device Guard** + Because the corporate network can contain malware, you should start to configure a reference environment that is isolated from your main corporate network. After that, you can create a code integrity policy that includes the trusted applications you want to run on your protected devices. + - **Use AppLocker when it makes sense** + Although AppLocker is not considered a new Device Guard feature, it complements Device Guard functionality for some scenarios like being able to deny a specific Universal Windows apps for a specific user or a group of users. + - **Lock down firmware and configuration** + After Windows 10 is installed, lock down firmware boot options access. This prevents a user with physical access from modifying UEFI settings, disabling Secure Boot, or booting other operating systems. Also, in order to protect against an administrator trying to disable Device Guard, add a rule in the current Device Guard policy that will deny and block execution of the **C:\\Windows\\System32\\SecConfig.efi** tool. + Health attestation is a key feature of Windows 10 that includes client and cloud components to control access to high-value assets based on a user and their device’s identity and compliance with corporate governance policy. Organizations can choose to detect and report unhealthy devices, or to configure health enforcement rules based on their needs. Health attestation provides an end-to-end security model and integration points, which vendors and software developers can use to build and integrate a customized solution. + ## Related topics -[Protect derived domain credentials with Credential Guard](credential-guard.md) -[Device Guard deployment guide](device-guard-deployment-guide.md) -[Trusted Platform Module technology overview](http://go.microsoft.com/fwlink/p/?LinkId=733957) -  -  + +- [Protect derived domain credentials with Credential Guard](credential-guard.md) +- [Device Guard deployment guide](device-guard-deployment-guide.md) +- [Trusted Platform Module technology overview](http://go.microsoft.com/fwlink/p/?LinkId=733957) diff --git a/windows/keep-secure/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md b/windows/keep-secure/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md index a1a5ed3f34..fc092b8a95 100644 --- a/windows/keep-secure/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md +++ b/windows/keep-secure/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md @@ -2,112 +2,163 @@ title: Protecting cluster shared volumes and storage area networks with BitLocker (Windows 10) description: This topic for IT pros describes how to protect CSVs and SANs with BitLocker. ms.assetid: ecd25a10-42c7-4d31-8a7e-ea52c8ebc092 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Protecting cluster shared volumes and storage area networks with BitLocker + **Applies to** - Windows 10 + This topic for IT pros describes how to protect CSVs and SANs with BitLocker. + BitLocker can protect both physical disk resources and cluster shared volumes version 2.0 (CSV2.0). BitLocker on clustered volumes allows for an additional layer of protection for administrators wishing to protect sensitive, highly available data. By adding additional protectors to the clustered volume, administrators can also add an additional barrier of security to resources within an organization by allowing only certain user accounts access to unlock the BitLocker volume. + ## Configuring BitLocker on Cluster Shared Volumes + ### Using BitLocker with Clustered Volumes + BitLocker on volumes within a cluster are managed based on how the cluster service "views" the volume to be protected. The volume can be a physical disk resource such as a logical unit number (LUN) on a storage area network (SAN) or network attached storage (NAS). -**Important**   -SANs used with BitLocker must have obtained Windows Hardware Certification. For more info, see [Windows Hardware Lab Kit](https://msdn.microsoft.com/library/windows/hardware/dn930814.aspx). + +>**Important**  SANs used with BitLocker must have obtained Windows Hardware Certification. For more info, see [Windows Hardware Lab Kit](https://msdn.microsoft.com/library/windows/hardware/dn930814.aspx).   -Alternatively, the volume can be a cluster-shared volume, a shared namespace, within the cluster. Windows Server 2012 expanded the CSV architecture, now known as CSV2.0, to enable support for BitLocker. When using BitLocker with volumes designated for a cluster, the volume will need to turn on BitLocker before its addition to the storage pool within cluster or put the resource into maintenance mode before BitLocker operations will complete. +Alternatively, the volume can be a cluster-shared volume, a shared namespace, within the cluster. Windows Server 2012 expanded the CSV architecture, now known as CSV2.0, to enable support for BitLocker. When using BitLocker with volumes designated for a cluster, the volume will need to turn on +BitLocker before its addition to the storage pool within cluster or put the resource into maintenance mode before BitLocker operations will complete. + Windows PowerShell or the manage-bde command line interface is the preferred method to manage BitLocker on CSV2.0 volumes. This is recommended over the BitLocker Control Panel item because CSV2.0 volumes are mount points. Mount points are an NTFS object that is used to provide an entry point to other volumes. Mount points do not require the use of a drive letter. Volumes that lack drive letters do not appear in the BitLocker Control Panel item. Additionally, the new Active Directory-based protector option required for cluster disk resource or CSV2.0 resources is not available in the Control Panel item. -**Note**   -Mount points can be used to support remote mount points on SMB based network shares. This type of share is not supported for BitLocker encryption. + +>**Note:**  Mount points can be used to support remote mount points on SMB based network shares. This type of share is not supported for BitLocker encryption.   -For thinly provisioned storage, such as a Dynamic Virtual Hard Disk (VHD), BitLocker runs in Used Disk Space Only encryption mode. You cannot use the **manage-bde –WipeFreeSpace** command to transition the volume to full-volume encryption on these types of volumes. This occurs because Full Encryption requires an end marker for the volume and dynamically expanding VHDs do not have a static end of volume marker. +For thinly provisioned storage, such as a Dynamic Virtual Hard Disk (VHD), BitLocker runs in Used Disk Space Only encryption mode. You cannot use the **manage-bde –WipeFreeSpace** command to transition the volume to full-volume encryption on these types of volumes. This occurs because Full +Encryption requires an end marker for the volume and dynamically expanding VHDs do not have a static end of volume marker. + ### Active Directory-based protector + You can also use an Active Directory Domain Services (AD DS) protector for protecting clustered volumes held within your AD DS infrastructure. The **ADAccountOrGroup** protector is a domain security identifier (SID)-based protector that can be bound to a user account, machine account or group. When an unlock request is made for a protected volume, the BitLocker service interrupts the request and uses the BitLocker protect/unprotect APIs to unlock or deny the request. BitLocker will unlock protected volumes without user intervention by attempting protectors in the following order: + 1. Clear key 2. Driver-based auto-unlock key 3. ADAccountOrGroup protector + 1. Service context protector 2. User protector + 4. Registry-based auto-unlock key -**Note**   -A Windows Server 2012 or later domain controller is required for this feature to work properly. + +>**Note:**  A Windows Server 2012 or later domain controller is required for this feature to work properly.   ### Turning on BitLocker before adding disks to a cluster using Windows PowerShell + BitLocker encryption is available for disks before or after addition to a cluster storage pool. The advantage of encrypting volumes prior to adding them to a cluster is that the disk resource does not require suspending the resource to complete the operation. To turn on BitLocker for a disk before adding it to a cluster, do the following: + 1. Install the BitLocker Drive Encryption feature if it is not already installed. 2. Ensure the disk is formatted NTFS and has a drive letter assigned to it. 3. Enable BitLocker on the volume using your choice of protector. A password protector is used in the Windows PowerShell script example below. + ``` syntax Enable-BitLocker E: -PasswordProtector -Password $pw ``` + 4. Identify the name of the cluster with Windows PowerShell. + ``` syntax Get-Cluster + ``` 5. Add an **ADAccountOrGroup**protector to the volume using the cluster name using a command such as: + ``` syntax Add-BitLockerProtector E: -ADAccountOrGroupProtector -ADAccountOrGroup CLUSTER$ ``` - **Warning**   - You must add an **ADAccountOrGroup** protector using the cluster CNO for a BitLocker enabled volume to either be shared in a Cluster Shared Volume or to failover properly in a traditional failover cluster. + + >**Warning:**  You must add an **ADAccountOrGroup** protector using the cluster CNO for a BitLocker enabled volume to either be shared in a Cluster Shared Volume or to failover properly in a traditional failover cluster.   6. Repeat steps 1-6 for each disk in the cluster. 7. Add the volume(s) to the cluster. + ### Turning on BitLocker for a clustered disk using Windows PowerShell + When the cluster service owns a disk resource already, it needs to be set into maintenance mode before BitLocker can be enabled. Use the following steps for turning BitLocker on for a clustered disk: + 1. Install the BitLocker Drive Encryption feature if it is not already installed. 2. Check the status of the cluster disk using Windows PowerShell. + ``` syntax Get-ClusterResource "Cluster Disk 1" ``` + 3. Put the physical disk resource into maintenance mode using Windows PowerShell. + ``` syntax Get-ClusterResource "Cluster Disk 1" | Suspend-ClusterResource ``` + 4. Enable BitLocker on the volume using your choice of protector. A password protector is used in the example below. + ``` syntax Enable-BitLocker E: -PasswordProtector -Password $pw ``` + 5. Identify the name of the cluster with Windows PowerShell + ``` syntax Get-Cluster ``` + 6. Add an **ADAccountOrGroup** protector with the Cluster Name Object (CNO) to the volume using a command such as: + ``` syntax Add-BitLockerProtector E: -ADAccountOrGroupProtector -ADAccountOrGroup CLUSTER$ + ``` - **Warning**   - You must add an **ADAccountOrGroup** protector using the cluster CNO for a BitLocker enabled volume to either be shared in a Cluster Shared Volume or to failover properly in a traditional failover cluster. + >**Warning:**  You must add an **ADAccountOrGroup** protector using the cluster CNO for a BitLocker enabled volume to either be shared in a Cluster Shared Volume or to failover properly in a traditional failover cluster.   7. Repeat steps 1-6 for each disk in the cluster. 8. Add the volume(s) to the cluster + ### Adding BitLocker encrypted volumes to a cluster using manage-bde + You can also use manage-bde to enable BitLocker on clustered volumes. The steps needed to add a physical disk resource or CSV2.0 volume to an existing cluster includes the following: + 1. Verify the BitLocker Drive Encryption feature is installed on the computer. 2. Ensure new storage is formatted as NTFS. 3. Encrypt the volume, add a recovery key and add the cluster administrator as a protector key using the manage-bde command line interface (see example): + - `Manage-bde -on -used -RP -sid domain\CNO$ -sync` + 1. BitLocker will check to see if the disk is already part of a cluster. If it is, administrators will encounter a hard block. Otherwise, the encryption will continue. 2. Using the -sync parameter is optional. Using it ensures the command waits until the encryption for the volume is completed before releasing the volume for use in the cluster storage pool. + 4. Open the Failover Cluster Manager snap-in or cluster PowerShell cmdlets to enable the disk to be clustered + - Once the disk is clustered it can also be enabled for CSV. + 5. During the resource online operation, cluster will check to see if the disk is BitLocker encrypted. + 1. If the volume is not BitLocker enabled, traditional cluster online operations occur. 2. If the volume is BitLocker enabled, the following check occurs: + - If volume is **locked**, BitLocker will impersonate the CNO and unlock the volume using the CNO protector. If this operation fails an event will be logged that the volume could not be unlocked and the online operation will fail. + 6. Once the disk is online in the storage pool, it can be added to a CSV by right clicking on the disk resource and choosing "**Add to cluster shared volumes**". CSVs can include both encrypted and unencrypted volumes. To check the status of a particular volume for BitLocker encryption, administrators can utilize the manage-bde -status command with a path to the volume inside the CSV namespace as seen in the example command line below. + ``` syntax manage-bde -status "C:\ClusterStorage\volume1" ``` + ### Physical Disk Resources + Unlike CSV2.0 volumes, physical disk resources can only be accessed by one cluster node at a time. This means that operations such as encrypting, decrypting, locking or unlocking volumes require context to perform. For example, you cannot unlock or decrypt a physical disk resource if you are not administering the cluster node that owns the disk resource because the disk resource is not available. + ### Restrictions on BitLocker actions with cluster volumes + The following table contains information about both Physical Disk Resources (i.e. traditional failover cluster volumes) and Cluster Shared Volumes (CSV) and the actions that are allowed by BitLocker in each situation. + @@ -211,11 +262,12 @@ The following table contains information about both Physical Disk Resources (i.e
        -**Note**   -Although the manage-bde -pause command is Blocked in clusters, the cluster service will automatically resume a paused encryption or decryption from the MDS node +>**Note:**  Although the manage-bde -pause command is Blocked in clusters, the cluster service will automatically resume a paused encryption or decryption from the MDS node   In the case where a physical disk resource experiences a failover event during conversion, the new owning node will detect the conversion is not complete and will complete the conversion process. + ### Other considerations when using BitLocker on CSV2.0 + Some other considerations to take into account for BitLocker on clustered storage include the following: - BitLocker volumes have to be initialized and beginning encryption before they are available to add to a CSV2.0 volume. - If an administrator needs to decrypt a CSV volume, remove the volume from the cluster or put into disk maintenance mode. You can add the CSV back to the cluster while waiting for decryption to complete. @@ -224,5 +276,3 @@ Some other considerations to take into account for BitLocker on clustered storag - If conversion is paused with encryption in progress and a physical disk resource volume is offline from the cluster, the BitLocker driver will automatically resume conversion when the volume is online to the cluster. - If conversion is paused with encryption in progress, while the CSV volume is in maintenance mode, the cluster thread (health check) will automatically resume conversion when moving the volume back from maintenance. - If conversion is paused with encryption in progress, while the disk resource volume is in maintenance mode, the BitLocker driver will automatically resume conversion when the volume is moved back from maintenance mode. -  -  diff --git a/windows/keep-secure/recovery-console-allow-automatic-administrative-logon.md b/windows/keep-secure/recovery-console-allow-automatic-administrative-logon.md index e1f339479c..394b4421db 100644 --- a/windows/keep-secure/recovery-console-allow-automatic-administrative-logon.md +++ b/windows/keep-secure/recovery-console-allow-automatic-administrative-logon.md @@ -2,88 +2,93 @@ title: Recovery console Allow automatic administrative logon (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Recovery console Allow automatic administrative logon security policy setting. ms.assetid: be2498fc-48f4-43f3-ad09-74664e45e596 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Recovery console: Allow automatic administrative logon + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **Recovery console: Allow automatic administrative logon** security policy setting. + ## Reference + This policy setting determines whether the built-in Administrator account password must be provided before access to the device is granted. If you enable this setting, the built-in Administrator account is automatically logged on to the computer at the Recovery Console; no password is required. + The Recovery Console can be very useful when troubleshooting and repairing systems that cannot be restarted. However, enabling this policy setting so a user can automatically log on to the console is dangerous. Anyone can walk up to the server, shut it down by disconnecting the power, reboot it, select **Recovery Console** from the **Restart** menu, and then assume full control of the server. + ### Possible values + - Enabled + The built-in Administrator account is automatically logged on to the computer at the Recovery Console; no password is required + - Disabled + Automatic administrative logon is not allowed. + - Not defined + Automatic administrative logon is not allowed. + ### Best practices + - Set **Recovery Console: Allow automatic administrative logon** to **Disabled**. This requires a user to enter a user name and password to access the Recovery Console account. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Disabled

      DC Effective Default Settings

      Disabled

      Member Server Effective Default Settings

      Disabled

      Client Computer Effective Default Settings

      Disabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy| Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Group Policy + Setting and deploying this policy using Group Policy takes precedence over the setting on the local device + ### Policy conflicts + None. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + The Recovery Console can be very useful when you must troubleshoot and repair device that do not start. However, allowing automatic logon to the Recovery Console can make it possible for someone to assume full control of the server. + ### Countermeasure + Disable the **Recovery console: Allow automatic administrative logon** setting. + ### Potential impact + Users must enter a user name and password to access the Recovery Console. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md b/windows/keep-secure/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md index 113bafb66c..23aad36087 100644 --- a/windows/keep-secure/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md +++ b/windows/keep-secure/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md @@ -2,95 +2,99 @@ title: Recovery console Allow floppy copy and access to all drives and folders (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Recovery console Allow floppy copy and access to all drives and folders security policy setting. ms.assetid: a5b4ac0c-f33d-42b5-a866-72afa7cbd0bd -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Recovery console: Allow floppy copy and access to all drives and folders + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **Recovery console: Allow floppy copy and access to all drives and folders** security policy setting. + ## Reference + This policy setting enables or disables the Recovery Console SET command, which allows you to set the following Recovery Console environment variables. + - **AllowWildCards**. Enables wildcard support for some commands, such as the DEL command. - **AllowAllPaths**. Allows access to all files and folders on the device. - **AllowRemovableMedia**. Allows files to be copied to removable media, such as a floppy disk. - **NoCopyPrompt**. Suppresses the prompt that typically displays before an existing file is overwritten. + You might forget to remove removable media, such as CD or floppy disk, with sensitive data or applications that a malicious user could then steal. Or you could accidentally leave a startup disk in the computer after using the Recovery Console. If the device is restarted for any reason and the BIOS has been configured to boot from the removable media before the hard disk drive, the server will start from the removable disk. This causes the server's network services to be unavailable. + ### Possible values + - Enabled - Disabled - Not defined + ### Best practices + - Set **Recovery Console: Allow floppy copy and access to drives and folders** to **Disabled**. Users who have started a server by using the Recovery Console and logged in with the built-in Administrator account will not be able to copy files and folders to a floppy disk. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Disabled

      DC Effective Default Settings

      Disabled

      Member Server Effective Default Settings

      Disabled

      Client Computer Effective Default Settings

      Disabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Group Policy + Setting and deploying this policy using Group Policy takes precedence over the setting on the local device. + ### Policy conflicts + None. + ### Command-line tools + Enabling this security option makes the Recovery Console SET command available, which allows you to set the following Recovery Console environment variables: + - AllowWildCards: Enable wildcard support for some commands (such as the DEL command). - AllowAllPaths: Allow access to all files and folders on the device. - AllowRemovableMedia: Allow files to be copied to removable media, such as a floppy disk. - NoCopyPrompt: Do not prompt when overwriting an existing file. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + An attacker who can cause the system to restart into the Recovery Console could steal sensitive data and leave no audit or access trail. + ### Countermeasure + Disable the **Recovery console: Allow floppy copy and access to drives and folders** setting. + ### Potential impact + Users who have started a server through the Recovery Console and logged in with the built-in Administrator account cannot copy files and folders to a floppy disk. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/refresh-an-applocker-policy.md b/windows/keep-secure/refresh-an-applocker-policy.md index b94e1582a1..fd227910c6 100644 --- a/windows/keep-secure/refresh-an-applocker-policy.md +++ b/windows/keep-secure/refresh-an-applocker-policy.md @@ -2,39 +2,55 @@ title: Refresh an AppLocker policy (Windows 10) description: This topic for IT professionals describes the steps to force an update for an AppLocker policy. ms.assetid: 3f24fcbc-3926-46b9-a1a2-dd036edab8a9 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Refresh an AppLocker policy + **Applies to** - Windows 10 + This topic for IT professionals describes the steps to force an update for an AppLocker policy. + If you update the rule collection on a local computer by using the Local Security Policy snap-in, the policy will take effect immediately. If Group Policy is used to distribute the AppLocker policy and you want to immediately implement the policy, you must manually refresh the policy. The Group Policy refresh might take several minutes, depending upon the number of policies within the Group Policy Object (GPO) and the number of target computers. + To use Group Policy to distribute the AppLocker policy change, you need to retrieve the deployed AppLocker policy first. To prepare for the update and subsequent refresh, see [Edit an AppLocker policy](edit-an-applocker-policy.md) + [Edit an AppLocker policy](edit-an-applocker-policy.md) and [Use the AppLocker Windows PowerShell cmdlets](use-the-applocker-windows-powershell-cmdlets.md). + To complete this procedure, you must have Edit Setting permission to edit a GPO. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. + **To manually refresh the AppLocker policy by using Group Policy** + 1. From a command prompt, type **gpupdate /force**, and then press ENTER. 2. When the command finishes, close the command prompt window, and then verify that the intended rule behavior is correct. You can do this by checking the AppLocker event logs for events that include "policy applied." -To change a policy on an individual computer, or to implement that policy on other computers, without using Group Policy, you first need to update the rule within the rule collection. For information about updating existing rules, see [Edit AppLocker rules](edit-applocker-rules.md). For information about creating a new rule for an existing policy, see: + +To change a policy on an individual computer, or to implement that policy on other computers, without using Group Policy, you first need to update the rule within the rule collection. For information about updating existing rules, see [Edit AppLocker rules](edit-applocker-rules.md). For information +about creating a new rule for an existing policy, see: - [Create a rule that uses a publisher condition](create-a-rule-that-uses-a-publisher-condition.md) - [Create a rule that uses a file hash condition](create-a-rule-that-uses-a-file-hash-condition.md) - [Create a rule that uses a path condition](create-a-rule-that-uses-a-path-condition.md) + Membership in the local **Administrators** group, or equivalent, is the minimum required to complete this procedure. + **To refresh the AppLocker policy on the local computer** + - Update the rule collection by using the Local Security Policy console with one of the following procedures: + - [Edit AppLocker rules](edit-applocker-rules.md) - [Delete an AppLocker rule](delete-an-applocker-rule.md) - [Add exceptions for an AppLocker rule](configure-exceptions-for-an-applocker-rule.md) + When finished, the policy is in effect. + To make the same change on another device, you can use any of the following methods: + - From the device that you made the change on, export the AppLocker policy, and then import the policy onto the other device. To do this, use the AppLocker **Export Policy** and **Import Policy** features to copy the rules from the changed computer. - **Caution**   - When importing rules from another computer, all the rules will be applied, not just the one that was updated. Merging policies allows both existing and updated (or new) rules to be applied. + + >**Caution:**  When importing rules from another computer, all the rules will be applied, not just the one that was updated. Merging policies allows both existing and updated (or new) rules to be applied.   - Merge AppLocker policies. For procedures to do this, see [Merge AppLocker policies manually](merge-applocker-policies-manually.md) and [Merge AppLocker policies by using Set-ApplockerPolicy](merge-applocker-policies-by-using-set-applockerpolicy.md). -  -  diff --git a/windows/keep-secure/registry-global-object-access-auditing.md b/windows/keep-secure/registry-global-object-access-auditing.md index cf9eaa2938..087c5f60fc 100644 --- a/windows/keep-secure/registry-global-object-access-auditing.md +++ b/windows/keep-secure/registry-global-object-access-auditing.md @@ -2,19 +2,24 @@ title: Registry (Global Object Access Auditing) (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Registry (Global Object Access Auditing), which enables you to configure a global system access control list (SACL) on the registry of a computer. ms.assetid: 953bb1c1-3f76-43be-ba17-4aed2304f578 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Registry (Global Object Access Auditing) + **Applies to** - Windows 10 + This topic for the IT professional describes the Advanced Security Audit policy setting, **Registry (Global Object Access Auditing)**, which enables you to configure a global system access control list (SACL) on the registry of a computer. + If you select the **Configure security** check box on this policy’s property page, you can add a user or group to the global SACL. This enables you to define computer system access control lists (SACLs) per object type for the registry. The specified SACL is then automatically applied to every registry object type. + This policy setting must be used in combination with the **Registry** security policy setting under Object Access. For more info, see [Audit Registry](audit-registry.md). + ## Related topics -[Advanced security audit policy settings](advanced-security-audit-policy-settings.md) -  -  + +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) diff --git a/windows/keep-secure/remove-computer-from-docking-station.md b/windows/keep-secure/remove-computer-from-docking-station.md index fa16818895..06949c5258 100644 --- a/windows/keep-secure/remove-computer-from-docking-station.md +++ b/windows/keep-secure/remove-computer-from-docking-station.md @@ -2,93 +2,96 @@ title: Remove computer from docking station (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Remove computer from docking station security policy setting. ms.assetid: 229a385a-a862-4973-899a-413b1b5b6c30 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Remove computer from docking station + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Remove computer from docking station** security policy setting. + ## Reference + This security setting determines whether a user can undock a portable device from its docking station without logging on. This policy setting only affects scenarios that involve a portable computer and its docking station. + If this user right is assigned to the user’s account (or if the user is a member of the assigned group), the user must log on before removing the portable device from its docking station. Otherwise, as a security measure, the user will not be able to log on after the device is removed from the docking station. If this policy is not assigned, the user may remove the portable device from its docking station without logging on, and then have the ability to start and log on to the device afterwards in its undocked state. + Constant: SeUndockPrivilege + ### Possible values + - User-defined list of accounts - Not Defined + ### Best practices + - Assign this user right to only those accounts that are permitted to use the portable device. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + Although this portable device scenario does not normally apply to servers, by default this setting is Administrators on domain controllers and on stand-alone servers. + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Administrators

      Stand-Alone Server Default Settings

      Administrators

      Domain Controller Effective Default Settings

      Administrators

      Member Server Effective Default Settings

      Administrators

      Client Computer Effective Default Settings

      Administrators

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Administrators| +| Stand-Alone Server Default Settings | Administrators| +| Domain Controller Effective Default Settings | Administrators| +| Member Server Effective Default Settings | Administrators| +| Client Computer Effective Default Settings | Administrators|   ## Policy management + This section describes features, tools, and guidance to help you manage this policy. + A restart of the device is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Anyone who has the **Remove computer from docking station** user right can log on and then remove a portable device from its docking station. If this setting is not defined, it has the same effect as if everyone was granted this right. However, the value of implementing this countermeasure is reduced by the following factors: + - If attackers can restart the device, they could remove it from the docking station after the BIOS starts but before the operating system starts. - This setting does not affect servers because they typically are not installed in docking stations. - An attacker could steal the device and the docking station together. - Devices that can be mechanically undocked can be physically removed by the user whether or not they use the Windows undocking functionality. + ### Countermeasure + Ensure that only the local Administrators group and the user account to which the device is allocated are assigned the **Remove computer from docking station** user right. + ### Potential impact + By default, only members of the local Administrators group are granted this right. Other user accounts must be explicitly granted this user right as necessary. If your organization's users are not members of the local Administrators groups on their portable devices, they cannot remove their portable devices from their docking stations if they do not first shut down the device. Therefore, you may want to assign the **Remove computer from docking station** privilege to the local Users group for portable devices. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/replace-a-process-level-token.md b/windows/keep-secure/replace-a-process-level-token.md index 237f74debf..0beaf15c90 100644 --- a/windows/keep-secure/replace-a-process-level-token.md +++ b/windows/keep-secure/replace-a-process-level-token.md @@ -2,96 +2,94 @@ title: Replace a process level token (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Replace a process level token security policy setting. ms.assetid: 5add02db-6339-489e-ba21-ccc3ccbe8745 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Replace a process level token + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Replace a process level token** security policy setting. + ## Reference + This policy setting determines which parent processes can replace the access token that is associated with a child process. + Specifically, the **Replace a process level token** setting determines which user accounts can call the CreateProcessAsUser() application programming interface (API) so that one service can start another. An example of a process that uses this user right is Task Scheduler, where the user right is extended to any processes that can be managed by Task Scheduler. + An access token is an object that describes the security context of a process or thread. The information in a token includes the identity and privileges of the user account that is associated with the process or thread. With this user right, every child process that runs on behalf of this user account would have its access token replaced with the process level token. + Constant: SeAssignPrimaryTokenPrivilege + ### Possible values + - User-defined list of accounts - Defaults - Not defined + ### Best practices + - For member servers, ensure that only the Local Service and Network Service accounts have the **Replace a process level token** user right. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default this setting is Network Service and Local Service on domain controllers and on stand-alone servers. + The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Network Service

      -

      Local Service

      Stand-Alone Server Default Settings

      Network Service

      -

      Local Service

      Domain Controller Effective Default Settings

      Network Service

      -

      Local Service

      Member Server Effective Default Settings

      Network Service

      -

      Local Service

      Client Computer Effective Default Settings

      Network Service

      -

      Local Service

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Network Service
      Local Service | +| Stand-Alone Server Default Settings | Network Service
      Local Service| +| Domain Controller Effective Default Settings | Network Service
      Local Service| +| Member Server Effective Default Settings | Network Service
      Local Service| +| Client Computer Effective Default Settings | Network Service
      Local Service|   ## Policy management + This section describes features, tools, and guidance to help you manage this policy. + A restart of the device is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Users with the **Replace a process level token** user right can start processes as another user if they know the user’s credentials. + ### Countermeasure + For member servers, ensure that only the Local Service and Network Service accounts have the **Replace a process level token** user right. + ### Potential impact + On most computers, restricting the **Replace a process level token** user right to the Local Service and the Network Service built-in accounts is the default configuration, and there is no negative impact. However, if you have installed optional components such as ASP.NET or IIS, you may need to assign the **Replace a process level token** user right to additional accounts. For example, IIS requires that the Service, Network Service, and IWAM\_*<ComputerName>* accounts be explicitly granted this user right. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/requirements-for-deploying-applocker-policies.md b/windows/keep-secure/requirements-for-deploying-applocker-policies.md index 996718cd10..f1608ee829 100644 --- a/windows/keep-secure/requirements-for-deploying-applocker-policies.md +++ b/windows/keep-secure/requirements-for-deploying-applocker-policies.md @@ -2,23 +2,30 @@ title: Requirements for deploying AppLocker policies (Windows 10) description: This deployment topic for the IT professional lists the requirements that you need to consider before you deploy AppLocker policies. ms.assetid: 3e55bda2-3cd7-42c7-bad3-c7dfbe193d48 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Requirements for deploying AppLocker policies + **Applies to** - Windows 10 + This deployment topic for the IT professional lists the requirements that you need to consider before you deploy AppLocker policies. + The following requirements must be met or addressed before you deploy your AppLocker policies: - [Deployment plan](#bkmk-reqdepplan) - [Supported operating systems](#bkmk-reqsupportedos) - [Policy distribution mechanism](#bkmk-reqpolicydistmech) - [Event collection and analysis system](#bkmk-reqeventcollectionsystem) + ### Deployment plan + An AppLocker policy deployment plan is the result of investigating which applications are required and necessary in your organization, which apps are optional, and which apps are forbidden. To develop this plan, see [AppLocker Design Guide](applocker-policies-design-guide.md). The following table is an example of the data you need to collect and the decisions you need to make to successfully deploy AppLocker policies on the supported operating systems (as listed in [Requirements to use AppLocker](requirements-to-use-applocker.md). + @@ -116,6 +123,7 @@ An AppLocker policy deployment plan is the result of investigating which applica
        **Event processing policy** + @@ -153,6 +161,7 @@ An AppLocker policy deployment plan is the result of investigating which applica
        **Policy maintenance policy** + @@ -194,15 +203,20 @@ An AppLocker policy deployment plan is the result of investigating which applica
        ### Supported operating systems + AppLocker is supported only on certain operating systems. Some features are not available on all operating systems. For more information, see [Requirements to use AppLocker](requirements-to-use-applocker.md). + ### Policy distribution mechanism + You need a way to distribute the AppLocker policies throughout the targeted business groups. AppLocker uses Group Policy management architecture to effectively distribute application control policies. AppLocker policies can also be configured on individual computers by using the Local Security Policy snap-in. + ### Event collection and analysis system + Event processing is important to understand application usage. You must have a process in place to collect and analyze AppLocker events so that application usage is appropriately restricted and understood. For procedures to monitor AppLocker events, see: - [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md) - [Configure an AppLocker policy for enforce rules](configure-an-applocker-policy-for-enforce-rules.md) - [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md) + ## See also -[AppLocker deployment guide](applocker-policies-deployment-guide.md) -  -  + +- [AppLocker deployment guide](applocker-policies-deployment-guide.md) diff --git a/windows/keep-secure/requirements-to-use-applocker.md b/windows/keep-secure/requirements-to-use-applocker.md index db3259ce0a..f9c5f24fae 100644 --- a/windows/keep-secure/requirements-to-use-applocker.md +++ b/windows/keep-secure/requirements-to-use-applocker.md @@ -2,211 +2,60 @@ title: Requirements to use AppLocker (Windows 10) description: This topic for the IT professional lists software requirements to use AppLocker on the supported Windows operating systems. ms.assetid: dc380535-071e-4794-8f9d-e5d1858156f0 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Requirements to use AppLocker + **Applies to** - Windows 10 + This topic for the IT professional lists software requirements to use AppLocker on the supported Windows operating systems. + ## General requirements + To use AppLocker, you need: + - A device running a supported operating system to create the rules. The computer can be a domain controller. - For Group Policy deployment, at least one device with the Group Policy Management Console (GPMC) or Remote Server Administration Tools (RSAT) installed to host the AppLocker rules. - Devices running a supported operating system to enforce the AppLocker rules that you create. -**Note**   -You can use Software Restriction Policies with AppLocker, but with some limitations. For more info, see [Use AppLocker and Software Restriction Policies in the same domain](use-applocker-and-software-restriction-policies-in-the-same-domain.md). + +>**Note:**  You can use Software Restriction Policies with AppLocker, but with some limitations. For more info, see [Use AppLocker and Software Restriction Policies in the same domain](use-applocker-and-software-restriction-policies-in-the-same-domain.md).   ## Operating system requirements + The following table show the on which operating systems AppLocker features are supported. - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      VersionCan be configuredCan be enforcedAvailable rulesNotes

      Windows 10

      Yes

      Yes

      Packaged apps

      -

      Executable

      -

      Windows Installer

      -

      Script

      -

      DLL

      You can use the [AppLocker CSP](http://msdn.microsoft.com/library/windows/hardware/dn920019.aspx) to configure AppLocker policies on any edition of Windows 10. You can only manage AppLocker with Group Policy on devices running Windows 10 Enterprise and Windows Server 2016 Technical Preview.

      Windows Server 2012 R2

      Yes

      Yes

      Packaged apps

      -

      Executable

      -

      Windows Installer

      -

      Script

      -

      DLL

      Windows 8.1

      Yes

      Yes

      Packaged apps

      -

      Executable

      -

      Windows Installer

      -

      Script

      -

      DLL

      Only the Enterprise edition supports AppLocker

      Windows RT 8.1

      No

      No

      N/A

      Windows Server 2012 Standard

      Yes

      Yes

      Packaged apps

      -

      Executable

      -

      Windows Installer

      -

      Script

      -

      DLL

      Windows Server 2012 Datacenter

      Yes

      Yes

      Packaged apps

      -

      Executable

      -

      Windows Installer

      -

      Script

      -

      DLL

      Windows 8 Pro

      No

      No

      N/A

      Windows 8 Enterprise

      Yes

      Yes

      Packaged apps

      -

      Executable

      -

      Windows Installer

      -

      Script

      -

      DLL

      Windows RT

      No

      No

      N/A

      Windows Server 2008 R2 Standard

      Yes

      Yes

      Executable

      -

      Windows Installer

      -

      Script

      -

      DLL

      Packaged app rules will not be enforced.

      Windows Server 2008 R2 Enterprise

      Yes

      Yes

      Executable

      -

      Windows Installer

      -

      Script

      -

      DLL

      Packaged app rules will not be enforced.

      Windows Server 2008 R2 Datacenter

      Yes

      Yes

      Executable

      -

      Windows Installer

      -

      Script

      -

      DLL

      Packaged app rules will not be enforced.

      Windows Server 2008 R2 for Itanium-Based Systems

      Yes

      Yes

      Executable

      -

      Windows Installer

      -

      Script

      -

      DLL

      Packaged app rules will not be enforced.

      Windows 7 Ultimate

      Yes

      Yes

      Executable

      -

      Windows Installer

      -

      Script

      -

      DLL

      Packaged app rules will not be enforced.

      Windows 7 Enterprise

      Yes

      Yes

      Executable

      -

      Windows Installer

      -

      Script

      -

      DLL

      Packaged app rules will not be enforced.

      Windows 7 Professional

      Yes

      No

      Executable

      -

      Windows Installer

      -

      Script

      -

      DLL

      No AppLocker rules are enforced.

      + +| Version | Can be configured | Can be enforced | Available rules | Notes | +| - | - | - | - | - | +| Windows 10| Yes| Yes| Packaged apps
      Executable
      Windows Installer
      Script
      DLL| You can use the [AppLocker CSP](http://msdn.microsoft.com/library/windows/hardware/dn920019.aspx) to configure AppLocker policies on any edition of Windows 10. You can only manage AppLocker with Group Policy on devices running Windows 10 Enterprise and Windows Server 2016 Technical Preview. | +| Windows Server 2012 R2| Yes| Yes| Packaged apps
      Executable
      Windows Installer
      Script
      DLL| | +| Windows 8.1| Yes| Yes| Packaged apps
      Executable
      Windows Installer
      Script
      DLL| Only the Enterprise edition supports AppLocker| +| Windows RT 8.1| No| No| N/A|| +| Windows Server 2012 Standard| Yes| Yes| Packaged apps
      Executable
      Windows Installer
      Script
      DLL|| +| Windows Server 2012 Datacenter| Yes| Yes| Packaged apps
      Executable
      Windows Installer
      Script
      DLL|| +| Windows 8 Pro| No| No| N/A|| +| Windows 8 Enterprise| Yes| Yes| Packaged apps
      Executable
      Windows Installer
      Script
      DLL|| +| Windows RT| No| No| N/A| | +| Windows Server 2008 R2 Standard| Yes| Yes| Executable
      Windows Installer
      Script
      DLL| Packaged app rules will not be enforced.| +| Windows Server 2008 R2 Enterprise|Yes| Yes| Executable
      Windows Installer
      Script
      DLL| Packaged app rules will not be enforced.| +| Windows Server 2008 R2 Datacenter| Yes| Yes| Executable
      Windows Installer
      Script
      DLL| Packaged app rules will not be enforced.| +| Windows Server 2008 R2 for Itanium-Based Systems| Yes| Yes| Executable
      Windows Installer
      Script
      DLL| Packaged app rules will not be enforced.| +| Windows 7 Ultimate| Yes| Yes| Executable
      Windows Installer
      Script
      DLL| Packaged app rules will not be enforced.| +| Windows 7 Enterprise| Yes| Yes| Executable
      Windows Installer
      Script
      DLL| Packaged app rules will not be enforced.| +| Windows 7 Professional| Yes| No| Executable
      Windows Installer
      Script
      DLL| No AppLocker rules are enforced.|   + AppLocker is not supported on versions of the Windows operating system not listed above. Software Restriction Policies can be used with those versions. However, the SRP Basic User feature is not supported on the above operating systems. + ## See also -[Administer AppLocker](administer-applocker.md) -[Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md) -[Optimize AppLocker performance](optimize-applocker-performance.md) -[Use AppLocker and Software Restriction Policies in the same domain](use-applocker-and-software-restriction-policies-in-the-same-domain.md) -[Manage packaged apps with AppLocker](manage-packaged-apps-with-applocker.md) -[AppLocker Design Guide](applocker-policies-design-guide.md) -  -  +- [Administer AppLocker](administer-applocker.md) +- [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md) +- [Optimize AppLocker performance](optimize-applocker-performance.md) +- [Use AppLocker and Software Restriction Policies in the same domain](use-applocker-and-software-restriction-policies-in-the-same-domain.md) +- [Manage packaged apps with AppLocker](manage-packaged-apps-with-applocker.md) +- [AppLocker Design Guide](applocker-policies-design-guide.md) diff --git a/windows/keep-secure/reset-account-lockout-counter-after.md b/windows/keep-secure/reset-account-lockout-counter-after.md index 04fdcce682..ebefbb2d0c 100644 --- a/windows/keep-secure/reset-account-lockout-counter-after.md +++ b/windows/keep-secure/reset-account-lockout-counter-after.md @@ -2,76 +2,68 @@ title: Reset account lockout counter after (Windows 10) description: Describes the best practices, location, values, and security considerations for the Reset account lockout counter after security policy setting. ms.assetid: d5ccf6dd-5ba7-44a9-8e0b-c478d8b1442c -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Reset account lockout counter after + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Reset account lockout counter after** security policy setting. + ## Reference + The **Reset account lockout counter after** policy setting determines the number of minutes that must elapse from the time a user fails to log on before the failed logon attempt counter is reset to 0. If [Account lockout threshold](account-lockout-threshold.md) is set to a number greater than zero, this reset time must be less than or equal to the value of [Account lockout duration](account-lockout-duration.md). + A disadvantage to setting this too high is that users lock themselves out for an inconveniently long period if they exceed the account lockout threshold through logon errors. Users may make excessive Help Desk calls. + ### Possible values + - A user-defined number of minutes from 1 through 99,999 - Not defined + ### Best practices + - You need to determine the threat level for your organization and balance that against the cost of your Help Desk support for password resets. Each organization will have specific requirements. + ### Location + **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Account Lockout Policy** + ### Default values + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or Group Policy Object (GPO)Default value

      Default domain policy

      Not defined

      Default domain controller policy

      Not defined

      Stand-alone server default settings

      Not applicable

      Domain controller effective default settings

      Not defined

      Member server effective default settings

      Not defined

      Client computer effective default settings

      Not applicable

      + +| Server type or Group Policy Object (GPO) | Default value | +| - | - | +| Default domain policy| Not defined| +| Default domain controller policy | Not defined| +| Stand-alone server default settings | Not applicable| +| Domain controller effective default settings | Not defined| +| Member server effective default settings | Not defined| +| Client computer effective default settings | Not applicable|   ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Users can accidentally lock themselves out of their accounts if they mistype their password multiple times. + ### Countermeasure + Configure the **Reset account lockout counter after** policy setting to 30. + ### Potential impact + If you do not configure this policy setting or if the value is configured to an interval that is too long, an attacker could attempt to log on to each user's account numerous times and lock out their accounts, a denial-of-service (DoS) attack might succeed, or administrators might have to manually unlock all locked-out accounts. If you configure this policy setting to a reasonable value, users can perform new attempts to log on after a failed logon within a reasonable time, without making brute force attacks feasible at high speeds. Be sure that you notify users of the values that are used for this policy setting so that they wait for the lockout timer to expire before they call the Help Desk. + ## Related topics -[Account Lockout Policy](account-lockout-policy.md) -  -  + +- [Account Lockout Policy](account-lockout-policy.md) diff --git a/windows/keep-secure/restore-files-and-directories.md b/windows/keep-secure/restore-files-and-directories.md index dc9f47c01a..b428c37092 100644 --- a/windows/keep-secure/restore-files-and-directories.md +++ b/windows/keep-secure/restore-files-and-directories.md @@ -2,102 +2,97 @@ title: Restore files and directories (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Restore files and directories security policy setting. ms.assetid: c673c0fa-6f49-4edd-8c1f-c5e8513f701d -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Restore files and directories + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Restore files and directories** security policy setting. + ## Reference + This security setting determines which users can bypass file, directory, registry, and other persistent object permissions when they restore backed up files and directories, and it determines which users can set valid security principals as the owner of an object. + Granting this user right to an account is similar to granting the account the following permissions to all files and folders on the system: + - **Traverse folder / execute file** - **Write** + Constant: SeRestorePrivilege + ### Possible values + - User-defined list of accounts - Defaults - Not Defined + ### Best practices + - Users with this user right can overwrite registry settings, hide data, and gain ownership of system objects, so only assign this user right to trusted users. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default, this right is granted to the Administrators, Backup Operators, and Server Operators groups on domain controllers, and to the Administrators and Backup Operators groups on stand-alone servers. + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Default Domain Controller Policy

      Administrators

      -

      Backup Operators

      -

      Server Operators

      Stand-Alone Server Default Settings

      Administrators

      -

      Backup Operators

      Domain Controller Effective Default Settings

      Administrators

      -

      Backup Operators

      -

      Server Operators

      Member Server Effective Default Settings

      Administrators

      -

      Backup Operators

      Client Computer Effective Default Settings

      Administrators

      -

      Backup Operators

      + +| Server type or GPO | Default value | +| - | - | +|Default Domain Policy | | +| Default Domain Controller Policy| Administrators
      Backup Operators
      Server Operators| +| Stand-Alone Server Default Settings | Administrators
      Backup Operators| +| Domain Controller Effective Default Settings | Administrators
      Backup Operators
      Server Operators| +| Member Server Effective Default Settings | Administrators
      Backup Operators| +| Client Computer Effective Default Settings | Administrators
      Backup Operators|   ## Policy management + This section describes features, tools, and guidance to help you manage this policy. + A restart of the computer is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + An attacker with the **Restore files and directories** user right could restore sensitive data to a computer and overwrite data that is more recent, which could lead to loss of important data, data corruption, or a denial-of-service condition. Attackers could overwrite executable files that are used by legitimate administrators or system services with versions that include malicious software to grant themselves elevated privileges, compromise data, or install programs that provide continued access to the device -**Note**   -Even if the following countermeasure is configured, an attacker could restore data to a computer in a domain that is controlled by the attacker. Therefore, it is critical that organizations carefully protect the media that are used to back up data. + +>**Note:**  Even if the following countermeasure is configured, an attacker could restore data to a computer in a domain that is controlled by the attacker. Therefore, it is critical that organizations carefully protect the media that are used to back up data.   ### Countermeasure + Ensure that only the local Administrators group is assigned the **Restore files and directories** user right unless your organization has clearly defined roles for backup and for restore personnel. + ### Potential impact + If you remove the **Restore files and directories** user right from the Backup Operators group and other accounts, users who are not members of the local Administrators group cannot load data backups. If restoring backups is delegated to a subset of IT staff in your organization, you should verify that this change does not negatively affect the ability of your organization's personnel to do their jobs. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/run-the-automatically-generate-rules-wizard.md b/windows/keep-secure/run-the-automatically-generate-rules-wizard.md index 105d076374..12a5620d21 100644 --- a/windows/keep-secure/run-the-automatically-generate-rules-wizard.md +++ b/windows/keep-secure/run-the-automatically-generate-rules-wizard.md @@ -2,19 +2,26 @@ title: Run the Automatically Generate Rules wizard (Windows 10) description: This topic for IT professionals describes steps to run the wizard to create AppLocker rules on a reference device. ms.assetid: 8cad1e14-d5b2-437c-8f88-70cffd7b3d8e -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Run the Automatically Generate Rules wizard + **Applies to** - Windows 10 + This topic for IT professionals describes steps to run the wizard to create AppLocker rules on a reference device. + AppLocker allows you to automatically generate rules for all files within a folder. It will scan the specified folder and create the condition types that you choose for each file in that folder. + You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local device or in a security template. For info how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). + **To automatically generate rules** + 1. Open the AppLocker console. 2. Right-click the appropriate rule type for which you want to automatically generate rules. You can automatically generate rules for executable, Windows Installer, script and packaged app rules. 3. Click **Automatically Generate Rules**. @@ -22,15 +29,13 @@ You can perform this task by using the Group Policy Management Console for an Ap 5. Click **Select** to choose the security group in which the default rules should be applied. By default, this is the **Everyone** group. 6. The wizard provides a name in the **Name to identify this set of rules** box based on the name of the folder that you have selected. Accept the provided name or type a different name, and then click **Next**. 7. On the **Rule Preferences** page, choose the conditions that you want the wizard to use while creating rules, and then click **Next**. For more info about rule conditions, see [Understanding AppLocker rule condition types](understanding-applocker-rule-condition-types.md). - **Note**   - The **Reduce the number of rules created by grouping similar files** check box is selected by default. This helps you organize AppLocker rules and reduce the number of rules that you create by performing the following operations for the rule condition that you select: + + >**Note:**  The **Reduce the number of rules created by grouping similar files** check box is selected by default. This helps you organize AppLocker rules and reduce the number of rules that you create by performing the following operations for the rule condition that you select: + - One publisher condition is created for all files that have the same publisher and product name. - One path condition is created for the folder that you select. For example, if you select *C:\\Program Files\\ProgramName\\* and the files in that folder are not signed, the wizard creates a rule for *%programfiles%\\ProgramName\\\**. - One file hash condition is created that contains all of the file hashes. When rule grouping is disabled, the wizard creates a file hash rule for each file.   8. Review the files that were analyzed and the rules that will be automatically created. To make changes, click **Previous** to return to the page where you can change your selections. After reviewing the rules, click **Create**. -**Note**   -If you are running the wizard to create your first rules for a GPO, you will be prompted to create the default rules, which allow critical system files to run, after completing the wizard. You may edit the default rules at any time. If your organization has decided to edit the default rules or create custom rules to allow the Windows system files to run, ensure that you delete the default rules after replacing them with your custom rules. -  -  -  + +>**Note:**  If you are running the wizard to create your first rules for a GPO, you will be prompted to create the default rules, which allow critical system files to run, after completing the wizard. You may edit the default rules at any time. If your organization has decided to edit the default rules or create custom rules to allow the Windows system files to run, ensure that you delete the default rules after replacing them with your custom rules. diff --git a/windows/keep-secure/script-rules-in-applocker.md b/windows/keep-secure/script-rules-in-applocker.md index 5f1570086a..10efd57b91 100644 --- a/windows/keep-secure/script-rules-in-applocker.md +++ b/windows/keep-secure/script-rules-in-applocker.md @@ -2,61 +2,35 @@ title: Script rules in AppLocker (Windows 10) description: This topic describes the file formats and available default rules for the script rule collection. ms.assetid: fee24ca4-935a-4c5e-8a92-8cf1d134d35f -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Script rules in AppLocker + **Applies to** - Windows 10 + This topic describes the file formats and available default rules for the script rule collection. + AppLocker defines script rules to include only the following file formats: - .ps1 - .bat - .cmd - .vbs - .js + The following table lists the default rules that are available for the script rule collection. - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      PurposeNameUserRule condition type

      Allows members of the local Administrators group to run all scripts

      (Default Rule) All scripts

      BUILTIN\Administrators

      Path: *

      Allow all users to run scripts in the Windows folder

      (Default Rule) All scripts located in the Windows folder

      Everyone

      Path: %windir%\*

      Allow all users to run scripts in the Program Files folder

      (Default Rule) All scripts located in the Program Files folder

      Everyone

      Path: %programfiles%\*

      + +| Purpose | Name | User | Rule condition type | +| - | - | - | - | +| Allows members of the local Administrators group to run all scripts| (Default Rule) All scripts| BUILTIN\Administrators | Path: *| +| Allow all users to run scripts in the Windows folder| (Default Rule) All scripts located in the Windows folder| Everyone | Path: %windir%\*| +| Allow all users to run scripts in the Program Files folder| (Default Rule) All scripts located in the Program Files folder|Everyone | Path: %programfiles%\*|   ## Related topics -[Understanding AppLocker default rules](understanding-applocker-default-rules.md) -  -  + +- [Understanding AppLocker default rules](understanding-applocker-default-rules.md) diff --git a/windows/keep-secure/secpol-advanced-security-audit-policy-settings.md b/windows/keep-secure/secpol-advanced-security-audit-policy-settings.md index 768c9de4a0..a4f7e13245 100644 --- a/windows/keep-secure/secpol-advanced-security-audit-policy-settings.md +++ b/windows/keep-secure/secpol-advanced-security-audit-policy-settings.md @@ -2,22 +2,28 @@ title: Advanced security audit policy settings (Windows 10) description: Provides information about the advanced security audit policy settings that are available in Windows and the audit events that they generate. ms.assetid: 6BF9A642-DBC3-4101-94A3-B2316C553CE3 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Advanced security audit policy settings + **Applies to** - Windows 10 + Provides information about the advanced security audit policy settings that are available in Windows and the audit events that they generate. + The security audit policy settings under **Security Settings\\Advanced Audit Policy Configuration** can help your organization audit compliance with important business-related and security-related rules by tracking precisely defined activities, such as: + - A group administrator has modified settings or data on servers that contain finance information. - An employee within a defined group has accessed an important file. - The correct system access control list (SACL) is applied to every file and folder or registry key on a computer or file share as a verifiable safeguard against undetected access. + You can access these audit policy settings through the Local Security Policy snap-in (secpol.msc) on the local device or by using Group Policy. + These Advanced Audit policy settings allow you to select only the behaviors that you want to monitor. You can exclude audit results for behaviors that are of little or no concern to you, or behaviors that create an excessive number of log entries. In addition, because security audit policies can be applied by using domain Group Policy Objects, audit policy settings can be modified, tested, and deployed to selected users and groups with relative simplicity. + For more info, see [Advanced security audit policies](advanced-security-auditing.md). -  -  diff --git a/windows/keep-secure/security-auditing-overview.md b/windows/keep-secure/security-auditing-overview.md index ee62474c85..135ebc41e5 100644 --- a/windows/keep-secure/security-auditing-overview.md +++ b/windows/keep-secure/security-auditing-overview.md @@ -2,42 +2,31 @@ title: Security auditing (Windows 10) description: Topics in this section are for IT professionals and describes the security auditing features in Windows and how your organization can benefit from using these technologies to enhance the security and manageability of your network. ms.assetid: 2d9b8142-49bd-4a33-b246-3f0c2a5f32d4 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Security auditing + **Applies to** - Windows 10 + Topics in this section are for IT professionals and describes the security auditing features in Windows and how your organization can benefit from using these technologies to enhance the security and manageability of your network. + ## + Security auditing is one of the most powerful tools that you can use to maintain the integrity of your system. As part of your overall security strategy, you should determine the level of auditing that is appropriate for your environment. Auditing should identify attacks (successful or not) that pose a threat to your network, and attacks against resources that you have determined to be valuable in your risk assessment. + For info on the changes that were added in Windows 10, see [Security auditing](../whats-new/security-auditing.md). + ## In this section - ---- - - - - - - - - - - - - - - - - -
      TopicDescription

      [Basic security audit policies](basic-security-audit-policies.md)

      Before you implement auditing, you must decide on an auditing policy. A basic audit policy specifies categories of security-related events that you want to audit. When this version of Windows is first installed, all auditing categories are disabled. By enabling various auditing event categories, you can implement an auditing policy that suits the security needs of your organization.

      [Advanced security audit policies](advanced-security-auditing.md)

      Advanced security audit policy settings are found in Security Settings\Advanced Audit Policy Configuration\System Audit Policies and appear to overlap with basic security audit policies, but they are recorded and applied differently.

      +| Topic | Description | +| - | - | +|[Basic security audit policies](basic-security-audit-policies.md) |Before you implement auditing, you must decide on an auditing policy. A basic audit policy specifies categories of security-related events that you want to audit. When this version of Windows is first installed, all auditing categories are disabled. By enabling various auditing event categories, you can implement an auditing policy that suits the security needs of your organization. | +|[Advanced security audit policies](advanced-security-auditing.md) |Advanced security audit policy settings are found in **Security Settings\Advanced Audit Policy Configuration\System Audit Policies** and appear to overlap with basic security audit policies, but they are recorded and applied differently. |       diff --git a/windows/keep-secure/security-considerations-for-applocker.md b/windows/keep-secure/security-considerations-for-applocker.md index 023305b4f1..560f73ba5a 100644 --- a/windows/keep-secure/security-considerations-for-applocker.md +++ b/windows/keep-secure/security-considerations-for-applocker.md @@ -2,33 +2,45 @@ title: Security considerations for AppLocker (Windows 10) description: This topic for the IT professional describes the security considerations you need to address when implementing AppLocker. ms.assetid: 354a5abb-7b31-4bea-a442-aa9666117625 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Security considerations for AppLocker + **Applies to** - Windows 10 + This topic for the IT professional describes the security considerations you need to address when implementing AppLocker. -The purpose of AppLocker is to restrict the access to software, and therefore, the data accessed by the software, to a specific group of users or within a defined business group. The following are security considerations for AppLocker: + +The purpose of AppLocker is to restrict the access to software, and therefore, the data accessed by the software, to a specific group of users or within a defined business group. The following are security considerations for +AppLocker: + AppLocker is deployed within an enterprise and administered centrally by those in IT with trusted credentials. This makes its policy creation and deployment conform to similar policy deployment processes and security restrictions. + AppLocker policies are distributed through known processes and by known means within the domain through Group Policy. But AppLocker policies can also be set on individual computers if the person has administrator privileges, and those policies might be contrary to the organization's written security policy. The enforcement settings for local policies are overridden by the same AppLocker policies in a Group Policy Object (GPO). However, because AppLocker rules are additive, a local policy that is not in a GPO will still be evaluated for that computer. + Microsoft does not provide a way to develop any extensions to AppLocker. The interfaces are not public. A user with administrator credentials can automate some AppLocker processes by using Windows PowerShell cmdlets. For info about the Windows PowerShell cmdlets for AppLocker, see the [AppLocker Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/ee460962.aspx). + AppLocker runs in the context of Administrator or LocalSystem, which is the highest privilege set. This security context has the potential of misuse. If a user with administrative credentials makes changes to an AppLocker policy on a local device that is joined to a domain, those changes could be overwritten or disallowed by the GPO that contains the AppLocker rule for the same file (or path) that was changed on the local device. However, because AppLocker rules are additive, a local policy that is not in a GPO will still be evaluated for that computer. If the local computer is not joined to a domain and is not administered by Group Policy, a person with administrative credentials can alter the AppLocker policy. + When securing files in a directory with a rule of the path condition type, whether using the allow or deny action on the rule, it is still necessary and good practice to restrict access to those files by setting the access control lists (ACLs) according to your security policy. + AppLocker does not protect against running 16-bit DOS binaries in the Virtual DOS Machine (NTVDM). This technology allows running legacy DOS and 16-bit Windows programs on computers that are using Intel 80386 or later when there is already another operating system running and controlling the hardware. The result is that 16-bit binaries can still run on Windows Server 2008 R2 and Windows 7 when AppLocker is configured to otherwise block binaries and libraries. If it is a requirement to prevent 16-bit applications from running, you must configure the Deny rule in the executable rule collection for NTVDM.exe. + You cannot use AppLocker (or Software Restriction Policies) to prevent code from running outside the Win32 subsystem. In particular, this applies to the (POSIX) subsystem in Windows NT. If it is a requirement to prevent applications from running in the POSIX subsystem, you must disable the subsystem. + AppLocker can only control VBScript, JScript, .bat files, .cmd files, and Windows PowerShell scripts. It does not control all interpreted code that runs within a host process, for example, Perl scripts and macros. Interpreted code is a form of executable code that runs within a host process. For example, Windows batch files (\*.bat) run within the context of the Windows Command Host (cmd.exe). To control interpreted code by using AppLocker, the host process must call AppLocker before it runs the interpreted code, and then enforce the decision returned by AppLocker. Not all host processes call into AppLocker and, therefore, AppLocker cannot control every kind of interpreted code, such as Microsoft Office macros. -**Important**   -You should configure the appropriate security settings of these host processes if you must allow them to run. For example, configure the security settings in Microsoft Office to ensure that only signed and trusted macros are loaded. + +>**Important:**  You should configure the appropriate security settings of these host processes if you must allow them to run. For example, configure the security settings in Microsoft Office to ensure that only signed and trusted macros are loaded.   AppLocker rules either allow or prevent an application from launching. AppLocker does not control the behavior of applications after they are launched. Applications could contain flags passed to functions that signal AppLocker to circumvent the rules and allow another .exe or .dll to be loaded. In practice, an application that is allowed by AppLocker could use these flags to bypass AppLocker rules and launch child processes. You must thoroughly examine each application before allowing them to run by using AppLocker rules. -**Note**   -Two flags that illustrate this condition are `SANDBOX_INERT`, which can be passed to `CreateRestrictedToken`, and `LOAD_IGNORE_CODE_AUTHZ_LEVEL`, which can be passed to `LoadLibraryEx`. Both of these flags signal AppLocker to circumvent the rules and allow a child .exe or .dll to be loaded. + +>**Note:**  Two flags that illustrate this condition are `SANDBOX_INERT`, which can be passed to `CreateRestrictedToken`, and `LOAD_IGNORE_CODE_AUTHZ_LEVEL`, which can be passed to `LoadLibraryEx`. Both of these flags signal AppLocker to circumvent the rules and allow a child .exe or .dll to be loaded.   ## Related topics -[AppLocker technical reference](applocker-technical-reference.md) -  -  + +- [AppLocker technical reference](applocker-technical-reference.md) diff --git a/windows/keep-secure/security-options.md b/windows/keep-secure/security-options.md index 1e083a249a..d8d9dbe293 100644 --- a/windows/keep-secure/security-options.md +++ b/windows/keep-secure/security-options.md @@ -2,417 +2,127 @@ title: Security Options (Windows 10) description: Provides an introduction to the settings under Security Options of the local security policies and links to information about each setting. ms.assetid: 405ea253-8116-4e57-b08e-14a8dcdca92b -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Security Options + **Applies to** - Windows 10 + Provides an introduction to the settings under **Security Options** of the local security policies and links to information about each setting. + The **Security Options** contain the following groupings of security policy settings that allow you to configure the behavior of the local computer. Some of these policies can be included in a Group Policy Object and distributed over your organization. + If you edit policy settings locally on a device, you will affect the settings on only that one device. If you configure the settings in a Group Policy Object (GPO), the settings apply to all devices that are subject to that GPO. + For info about setting security policies, see [Configure security policy settings](how-to-configure-security-policy-settings.md). + ## In this section - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      TopicDescription

      [Accounts: Administrator account status](accounts-administrator-account-status.md)

      Describes the best practices, location, values, and security considerations for the Accounts: Administrator account status security policy setting.

      [Accounts: Block Microsoft accounts](accounts-block-microsoft-accounts.md)

      Describes the best practices, location, values, management, and security considerations for the Accounts: Block Microsoft accounts security policy setting.

      [Accounts: Guest account status](accounts-guest-account-status.md)

      Describes the best practices, location, values, and security considerations for the Accounts: Guest account status security policy setting.

      [Accounts: Limit local account use of blank passwords to console logon only](accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md)

      Describes the best practices, location, values, and security considerations for the Accounts: Limit local account use of blank passwords to console logon only security policy setting.

      [Accounts: Rename administrator account](accounts-rename-administrator-account.md)

      This security policy reference topic for the IT professional describes the best practices, location, values, and security considerations for this policy setting.

      [Accounts: Rename guest account](accounts-rename-guest-account.md)

      Describes the best practices, location, values, and security considerations for the Accounts: Rename guest account security policy setting.

      [Audit: Audit the access of global system objects](audit-audit-the-access-of-global-system-objects.md)

      Describes the best practices, location, values, and security considerations for the Audit: Audit the access of global system objects security policy setting.

      [Audit: Audit the use of Backup and Restore privilege](audit-audit-the-use-of-backup-and-restore-privilege.md)

      Describes the best practices, location, values, and security considerations for the Audit: Audit the use of Backup and Restore privilege security policy setting.

      [Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings](audit-force-audit-policy-subcategory-settings-to-override.md)

      Describes the best practices, location, values, and security considerations for the Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings security policy setting.

      [Audit: Shut down system immediately if unable to log security audits](audit-shut-down-system-immediately-if-unable-to-log-security-audits.md)

      Describes the best practices, location, values, management practices, and security considerations for the Audit: Shut down system immediately if unable to log security audits security policy setting.

      [DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax](dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md)

      Describes the best practices, location, values, and security considerations for the DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax policy setting.

      [DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax](dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md)

      Describes the best practices, location, values, and security considerations for the DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax security policy setting.

      [Devices: Allow undock without having to log on](devices-allow-undock-without-having-to-log-on.md)

      Describes the best practices, location, values, and security considerations for the Devices: Allow undock without having to log on security policy setting.

      [Devices: Allowed to format and eject removable media](devices-allowed-to-format-and-eject-removable-media.md)

      Describes the best practices, location, values, and security considerations for the Devices: Allowed to format and eject removable media security policy setting.

      [Devices: Prevent users from installing printer drivers](devices-prevent-users-from-installing-printer-drivers.md)

      Describes the best practices, location, values, and security considerations for the Devices: Prevent users from installing printer drivers security policy setting.

      [Devices: Restrict CD-ROM access to locally logged-on user only](devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md)

      Describes the best practices, location, values, and security considerations for the Devices: Restrict CD-ROM access to locally logged-on user only security policy setting.

      [Devices: Restrict floppy access to locally logged-on user only](devices-restrict-floppy-access-to-locally-logged-on-user-only.md)

      Describes the best practices, location, values, and security considerations for the Devices: Restrict floppy access to locally logged-on user only security policy setting.

      [Domain controller: Allow server operators to schedule tasks](domain-controller-allow-server-operators-to-schedule-tasks.md)

      Describes the best practices, location, values, and security considerations for the Domain controller: Allow server operators to schedule tasks security policy setting.

      [Domain controller: LDAP server signing requirements](domain-controller-ldap-server-signing-requirements.md)

      Describes the best practices, location, values, and security considerations for the Domain controller: LDAP server signing requirements security policy setting.

      [Domain controller: Refuse machine account password changes](domain-controller-refuse-machine-account-password-changes.md)

      Describes the best practices, location, values, and security considerations for the Domain controller: Refuse machine account password changes security policy setting.

      [Domain member: Digitally encrypt or sign secure channel data (always)](domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md)

      Describes the best practices, location, values, and security considerations for the Domain member: Digitally encrypt or sign secure channel data (always) security policy setting.

      [Domain member: Digitally encrypt secure channel data (when possible)](domain-member-digitally-encrypt-secure-channel-data-when-possible.md)

      Describes the best practices, location, values, and security considerations for the Domain member: Digitally encrypt secure channel data (when possible) security policy setting.

      [Domain member: Digitally sign secure channel data (when possible)](domain-member-digitally-sign-secure-channel-data-when-possible.md)

      Describes the best practices, location, values, and security considerations for the Domain member: Digitally sign secure channel data (when possible) security policy setting.

      [Domain member: Disable machine account password changes](domain-member-disable-machine-account-password-changes.md)

      Describes the best practices, location, values, and security considerations for the Domain member: Disable machine account password changes security policy setting.

      [Domain member: Maximum machine account password age](domain-member-maximum-machine-account-password-age.md)

      Describes the best practices, location, values, and security considerations for the Domain member: Maximum machine account password age security policy setting.

      [Domain member: Require strong (Windows 2000 or later) session key](domain-member-require-strong-windows-2000-or-later-session-key.md)

      Describes the best practices, location, values, and security considerations for the Domain member: Require strong (Windows 2000 or later) session key security policy setting.

      [Interactive logon: Display user information when the session is locked](interactive-logon-display-user-information-when-the-session-is-locked.md)

      Describes the best practices, location, values, and security considerations for the Interactive logon: Display user information when the session is locked security policy setting.

      [Interactive logon: Do not display last user name](interactive-logon-do-not-display-last-user-name.md)

      Describes the best practices, location, values, and security considerations for the Interactive logon: Do not display last user name security policy setting.

      [Interactive logon: Do not require CTRL+ALT+DEL](interactive-logon-do-not-require-ctrl-alt-del.md)

      Describes the best practices, location, values, and security considerations for the Interactive logon: Do not require CTRL+ALT+DEL security policy setting.

      [Interactive logon: Machine account lockout threshold](interactive-logon-machine-account-lockout-threshold.md)

      Describes the best practices, location, values, management, and security considerations for the Interactive logon: Machine account lockout threshold security policy setting.

      [Interactive logon: Machine inactivity limit](interactive-logon-machine-inactivity-limit.md)

      Describes the best practices, location, values, management, and security considerations for the Interactive logon: Machine inactivity limit security policy setting.

      [Interactive logon: Message text for users attempting to log on](interactive-logon-message-text-for-users-attempting-to-log-on.md)

      Describes the best practices, location, values, management, and security considerations for the Interactive logon: Message text for users attempting to log on security policy setting.

      [Interactive logon: Message title for users attempting to log on](interactive-logon-message-title-for-users-attempting-to-log-on.md)

      Describes the best practices, location, values, policy management and security considerations for the Interactive logon: Message title for users attempting to log on security policy setting.

      [Interactive logon: Number of previous logons to cache (in case domain controller is not available)](interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md)

      Describes the best practices, location, values, policy management and security considerations for the Interactive logon: Number of previous logons to cache (in case domain controller is not available) security policy setting.

      [Interactive logon: Prompt user to change password before expiration](interactive-logon-prompt-user-to-change-password-before-expiration.md)

      Describes the best practices, location, values, policy management and security considerations for the Interactive logon: Prompt user to change password before expiration security policy setting.

      [Interactive logon: Require Domain Controller authentication to unlock workstation](interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md)

      Describes the best practices, location, values, policy management, and security considerations for the Interactive logon: Require Domain Controller authentication to unlock workstation security policy setting.

      [Interactive logon: Require smart card](interactive-logon-require-smart-card.md)

      Describes the best practices, location, values, policy management and security considerations for the Interactive logon: Require smart card security policy setting.

      [Interactive logon: Smart card removal behavior](interactive-logon-smart-card-removal-behavior.md)

      Describes the best practices, location, values, policy management and security considerations for the Interactive logon: Smart card removal behavior security policy setting.

      [Microsoft network client: Digitally sign communications (always)](microsoft-network-client-digitally-sign-communications-always.md)

      Describes the best practices, location, values, policy management and security considerations for the Microsoft network client: Digitally sign communications (always) security policy setting.

      [Microsoft network client: Digitally sign communications (if server agrees)](microsoft-network-client-digitally-sign-communications-if-server-agrees.md)

      Describes the best practices, location, values, and security considerations for the Microsoft network client: Digitally sign communications (if server agrees) security policy setting.

      [Microsoft network client: Send unencrypted password to third-party SMB servers](microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md)

      Describes the best practices, location, values, policy management and security considerations for the Microsoft network client: Send unencrypted password to third-party SMB servers security policy setting.

      [Microsoft network server: Amount of idle time required before suspending session](microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md)

      Describes the best practices, location, values, and security considerations for the Microsoft network server: Amount of idle time required before suspending session security policy setting.

      [Microsoft network server: Attempt S4U2Self to obtain claim information](microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md)

      Describes the best practices, location, values, management, and security considerations for the Microsoft network server: Attempt S4U2Self to obtain claim information security policy setting.

      [Microsoft network server: Digitally sign communications (always)](microsoft-network-server-digitally-sign-communications-always.md)

      Describes the best practices, location, values, policy management and security considerations for the Microsoft network server: Digitally sign communications (always) security policy setting.

      [Microsoft network server: Digitally sign communications (if client agrees)](microsoft-network-server-digitally-sign-communications-if-client-agrees.md)

      Describes the best practices, location, values, policy management and security considerations for the Microsoft network server: Digitally sign communications (if client agrees) security policy setting.

      [Microsoft network server: Disconnect clients when logon hours expire](microsoft-network-server-disconnect-clients-when-logon-hours-expire.md)

      Describes the best practices, location, values, and security considerations for the Microsoft network server: Disconnect clients when logon hours expire security policy setting.

      [Microsoft network server: Server SPN target name validation level](microsoft-network-server-server-spn-target-name-validation-level.md)

      Describes the best practices, location, and values, policy management and security considerations for the Microsoft network server: Server SPN target name validation level security policy setting.

      [Network access: Allow anonymous SID/Name translation](network-access-allow-anonymous-sidname-translation.md)

      Describes the best practices, location, values, policy management and security considerations for the Network access: Allow anonymous SID/Name translation security policy setting.

      [Network access: Do not allow anonymous enumeration of SAM accounts](network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md)

      Describes the best practices, location, values, and security considerations for the Network access: Do not allow anonymous enumeration of SAM accounts security policy setting.

      [Network access: Do not allow anonymous enumeration of SAM accounts and shares](network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md)

      Describes the best practices, location, values, and security considerations for the Network access: Do not allow anonymous enumeration of SAM accounts and shares security policy setting.

      [Network access: Do not allow storage of passwords and credentials for network authentication](network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md)

      Describes the best practices, location, values, policy management and security considerations for the Network access: Do not allow storage of passwords and credentials for network authentication security policy setting.

      [Network access: Let Everyone permissions apply to anonymous users](network-access-let-everyone-permissions-apply-to-anonymous-users.md)

      Describes the best practices, location, values, policy management and security considerations for the Network access: Let Everyone permissions apply to anonymous users security policy setting.

      [Network access: Named Pipes that can be accessed anonymously](network-access-named-pipes-that-can-be-accessed-anonymously.md)

      Describes the best practices, location, values, policy management and security considerations for the Network access: Named Pipes that can be accessed anonymously security policy setting.

      [Network access: Remotely accessible registry paths](network-access-remotely-accessible-registry-paths.md)

      Describes the best practices, location, values, policy management and security considerations for the Network access: Remotely accessible registry paths security policy setting.

      [Network access: Remotely accessible registry paths and subpaths](network-access-remotely-accessible-registry-paths-and-subpaths.md)

      Describes the best practices, location, values, and security considerations for the Network access: Remotely accessible registry paths and subpaths security policy setting.

      [Network access: Restrict anonymous access to Named Pipes and Shares](network-access-restrict-anonymous-access-to-named-pipes-and-shares.md)

      Describes the best practices, location, values, policy management and security considerations for the Network access: Restrict anonymous access to Named Pipes and Shares security policy setting.

      [Network access: Shares that can be accessed anonymously](network-access-shares-that-can-be-accessed-anonymously.md)

      Describes the best practices, location, values, policy management and security considerations for the Network access: Shares that can be accessed anonymously security policy setting.

      [Network access: Sharing and security model for local accounts](network-access-sharing-and-security-model-for-local-accounts.md)

      Describes the best practices, location, values, policy management and security considerations for the Network access: Sharing and security model for local accounts security policy setting.

      [Network security: Allow Local System to use computer identity for NTLM](network-security-allow-local-system-to-use-computer-identity-for-ntlm.md)

      Describes the location, values, policy management, and security considerations for the Network security: Allow Local System to use computer identity for NTLM security policy setting.

      [Network security: Allow LocalSystem NULL session fallback](network-security-allow-localsystem-null-session-fallback.md)

      Describes the best practices, location, values, and security considerations for the Network security: Allow LocalSystem NULL session fallback security policy setting.

      [Network security: Allow PKU2U authentication requests to this computer to use online identities](network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md)

      Describes the best practices, location, and values for the Network Security: Allow PKU2U authentication requests to this computer to use online identities security policy setting.

      [Network security: Configure encryption types allowed for Kerberos Win7 only](network-security-configure-encryption-types-allowed-for-kerberos.md)

      Describes the best practices, location, values and security considerations for the Network security: Configure encryption types allowed for Kerberos Win7 only security policy setting.

      [Network security: Do not store LAN Manager hash value on next password change](network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md)

      Describes the best practices, location, values, policy management and security considerations for the Network security: Do not store LAN Manager hash value on next password change security policy setting.

      [Network security: Force logoff when logon hours expire](network-security-force-logoff-when-logon-hours-expire.md)

      Describes the best practices, location, values, policy management and security considerations for the Network security: Force logoff when logon hours expire security policy setting.

      [Network security: LAN Manager authentication level](network-security-lan-manager-authentication-level.md)

      Describes the best practices, location, values, policy management and security considerations for the Network security: LAN Manager authentication level security policy setting.

      [Network security: LDAP client signing requirements](network-security-ldap-client-signing-requirements.md)

      This security policy reference topic for the IT professional describes the best practices, location, values, policy management and security considerations for this policy setting. This information applies to computers running at least the Windows Server 2008 operating system.

      [Network security: Minimum session security for NTLM SSP based (including secure RPC) clients](network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md)

      Describes the best practices, location, values, policy management and security considerations for the Network security: Minimum session security for NTLM SSP based (including secure RPC) clients security policy setting.

      [Network security: Minimum session security for NTLM SSP based (including secure RPC) servers](network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md)

      Describes the best practices, location, values, policy management and security considerations for the Network security: Minimum session security for NTLM SSP based (including secure RPC) servers security policy setting.

      [Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication](network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md)

      Describes the best practices, location, values, management aspects, and security considerations for the Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication security policy setting.

      [Network security: Restrict NTLM: Add server exceptions in this domain](network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md)

      Describes the best practices, location, values, management aspects, and security considerations for the Network security: Restrict NTLM: Add server exceptions in this domain security policy setting.

      [Network security: Restrict NTLM: Audit incoming NTLM traffic](network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md)

      Describes the best practices, location, values, management aspects, and security considerations for the Network Security: Restrict NTLM: Audit incoming NTLM traffic security policy setting.

      [Network security: Restrict NTLM: Audit NTLM authentication in this domain](network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md)

      Describes the best practices, location, values, management aspects, and security considerations for the Network Security: Restrict NTLM: Audit NTLM authentication in this domain security policy setting.

      [Network security: Restrict NTLM: Incoming NTLM traffic](network-security-restrict-ntlm-incoming-ntlm-traffic.md)

      Describes the best practices, location, values, management aspects, and security considerations for the Network Security: Restrict NTLM: Incoming NTLM traffic security policy setting.

      [Network security: Restrict NTLM: NTLM authentication in this domain](network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md)

      Describes the best practices, location, values, management aspects, and security considerations for the Network Security: Restrict NTLM: NTLM authentication in this domain security policy setting.

      [Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers](network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md)

      Describes the best practices, location, values, management aspects, and security considerations for the Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers security policy setting.

      [Recovery console: Allow automatic administrative logon](recovery-console-allow-automatic-administrative-logon.md)

      Describes the best practices, location, values, policy management and security considerations for the Recovery console: Allow automatic administrative logon security policy setting.

      [Recovery console: Allow floppy copy and access to all drives and folders](recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md)

      Describes the best practices, location, values, policy management and security considerations for the Recovery console: Allow floppy copy and access to all drives and folders security policy setting.

      [Shutdown: Allow system to be shut down without having to log on](shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md)

      Describes the best practices, location, values, policy management and security considerations for the Shutdown: Allow system to be shut down without having to log on security policy setting.

      [Shutdown: Clear virtual memory pagefile](shutdown-clear-virtual-memory-pagefile.md)

      Describes the best practices, location, values, policy management and security considerations for the Shutdown: Clear virtual memory pagefile security policy setting.

      [System cryptography: Force strong key protection for user keys stored on the computer](system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md)

      Describes the best practices, location, values, policy management and security considerations for the System cryptography: Force strong key protection for user keys stored on the computer security policy setting.

      [System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing](system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md)

      This security policy reference topic for the IT professional describes the best practices, location, values, policy management and security considerations for this policy setting.

      [System objects: Require case insensitivity for non-Windows subsystems](system-objects-require-case-insensitivity-for-non-windows-subsystems.md)

      Describes the best practices, location, values, policy management and security considerations for the System objects: Require case insensitivity for non-Windows subsystems security policy setting.

      [System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)](system-objects-strengthen-default-permissions-of-internal-system-objects.md)

      Describes the best practices, location, values, policy management and security considerations for the System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links) security policy setting.

      [System settings: Optional subsystems](system-settings-optional-subsystems.md)

      Describes the best practices, location, values, policy management and security considerations for the System settings: Optional subsystems security policy setting.

      [System settings: Use certificate rules on Windows executables for Software Restriction Policies](system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md)

      Describes the best practices, location, values, policy management and security considerations for the System settings: Use certificate rules on Windows executables for Software Restriction Policies security policy setting.

      [User Account Control: Admin Approval Mode for the Built-in Administrator account](user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md)

      Describes the best practices, location, values, policy management and security considerations for the User Account Control: Admin Approval Mode for the Built-in Administrator account security policy setting.

      [User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop](user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md)

      Describes the best practices, location, values, and security considerations for the User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop security policy setting.

      [User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode](user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md)

      Describes the best practices, location, values, policy management and security considerations for the User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode security policy setting.

      [User Account Control: Behavior of the elevation prompt for standard users](user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md)

      Describes the best practices, location, values, policy management and security considerations for the User Account Control: Behavior of the elevation prompt for standard users security policy setting.

      [User Account Control: Detect application installations and prompt for elevation](user-account-control-detect-application-installations-and-prompt-for-elevation.md)

      Describes the best practices, location, values, policy management and security considerations for the User Account Control: Detect application installations and prompt for elevation security policy setting.

      [User Account Control: Only elevate executables that are signed and validated](user-account-control-only-elevate-executables-that-are-signed-and-validated.md)

      Describes the best practices, location, values, policy management and security considerations for the User Account Control: Only elevate executables that are signed and validated security policy setting.

      [User Account Control: Only elevate UIAccess applications that are installed in secure locations](user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md)

      Describes the best practices, location, values, policy management and security considerations for the User Account Control: Only elevate UIAccess applications that are installed in secure locations security policy setting.

      [User Account Control: Run all administrators in Admin Approval Mode](user-account-control-run-all-administrators-in-admin-approval-mode.md)

      Describes the best practices, location, values, policy management and security considerations for the User Account Control: Run all administrators in Admin Approval Mode security policy setting.

      [User Account Control: Switch to the secure desktop when prompting for elevation](user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md)

      Describes the best practices, location, values, policy management and security considerations for the User Account Control: Switch to the secure desktop when prompting for elevation security policy setting.

      [User Account Control: Virtualize file and registry write failures to per-user locations](user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md)

      Describes the best practices, location, values, policy management and security considerations for the User Account Control: Virtualize file and registry write failures to per-user locations security policy setting.

      + +| Topic | Description | +| - | - | +| [Accounts: Administrator account status](accounts-administrator-account-status.md) | Describes the best practices, location, values, and security considerations for the **Accounts: Administrator account status** security policy setting.| +| [Accounts: Block Microsoft accounts](accounts-block-microsoft-accounts.md) | Describes the best practices, location, values, management, and security considerations for the **Accounts: Block Microsoft accounts** security policy setting.| +| [Accounts: Guest account status](accounts-guest-account-status.md) | Describes the best practices, location, values, and security considerations for the **Accounts: Guest account status** security policy setting.| +| [Accounts: Limit local account use of blank passwords to console logon only](accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md) | Describes the best practices, location, values, and security considerations for the **Accounts: Limit local account use of blank passwords to console logon only** security policy setting. | +| [Accounts: Rename administrator account](accounts-rename-administrator-account.md)| This security policy reference topic for the IT professional describes the best practices, location, values, and security considerations for this policy setting.| +| [Accounts: Rename guest account](accounts-rename-guest-account.md) | Describes the best practices, location, values, and security considerations for the **Accounts: Rename guest account** security policy setting.| +| [Audit: Audit the access of global system objects](audit-audit-the-access-of-global-system-objects.md) | Describes the best practices, location, values, and security considerations for the **Audit: Audit the access of global system objects** security policy setting.| +| [Audit: Audit the use of Backup and Restore privilege](audit-audit-the-use-of-backup-and-restore-privilege.md) | Describes the best practices, location, values, and security considerations for the **Audit: Audit the use of Backup and Restore privilege** security policy setting.| +| [Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings](audit-force-audit-policy-subcategory-settings-to-override.md) | Describes the best practices, location, values, and security considerations for the **Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings** security policy setting. | +| [Audit: Shut down system immediately if unable to log security audits](audit-shut-down-system-immediately-if-unable-to-log-security-audits.md)| Describes the best practices, location, values, management practices, and security considerations for the **Audit: Shut down system immediately if unable to log security audits** security policy setting. | +| [DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax](dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md)| Describes the best practices, location, values, and security considerations for the **DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax** policy setting. | +| [DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax](dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md)| Describes the best practices, location, values, and security considerations for the **DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax** security policy setting. | +| [Devices: Allow undock without having to log on](devices-allow-undock-without-having-to-log-on.md)| Describes the best practices, location, values, and security considerations for the **Devices: Allow undock without having to log on** security policy setting.| +| [Devices: Allowed to format and eject removable media](devices-allowed-to-format-and-eject-removable-media.md) | Describes the best practices, location, values, and security considerations for the **Devices: Allowed to format and eject removable media** security policy setting.| +| [Devices: Prevent users from installing printer drivers](devices-prevent-users-from-installing-printer-drivers.md) | Describes the best practices, location, values, and security considerations for the **Devices: Prevent users from installing printer drivers** security policy setting.| +| [Devices: Restrict CD-ROM access to locally logged-on user only](devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md) | Describes the best practices, location, values, and security considerations for the **Devices: Restrict CD-ROM access to locally logged-on user only** security policy setting. | +| [Devices: Restrict floppy access to locally logged-on user only](devices-restrict-floppy-access-to-locally-logged-on-user-only.md)| Describes the best practices, location, values, and security considerations for the **Devices: Restrict floppy access to locally logged-on user only** security policy setting. | +| [Domain controller: Allow server operators to schedule tasks](domain-controller-allow-server-operators-to-schedule-tasks.md)| Describes the best practices, location, values, and security considerations for the **Domain controller: Allow server operators to schedule tasks** security policy setting. | +| [Domain controller: LDAP server signing requirements](domain-controller-ldap-server-signing-requirements.md)| Describes the best practices, location, values, and security considerations for the **Domain controller: LDAP server signing requirements** security policy setting. | +| [Domain controller: Refuse machine account password changes](domain-controller-refuse-machine-account-password-changes.md) | Describes the best practices, location, values, and security considerations for the **Domain controller: Refuse machine account password changes** security policy setting.| +| [Domain member: Digitally encrypt or sign secure channel data (always)](domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md) | Describes the best practices, location, values, and security considerations for the **Domain member: Digitally encrypt or sign secure channel data (always)** security policy setting. | +| [Domain member: Digitally encrypt secure channel data (when possible)](domain-member-digitally-encrypt-secure-channel-data-when-possible.md)| Describes the best practices, location, values, and security considerations for the **Domain member: Digitally encrypt secure channel data (when possible)** security policy setting. | +| [Domain member: Digitally sign secure channel data (when possible)](domain-member-digitally-sign-secure-channel-data-when-possible.md)| Describes the best practices, location, values, and security considerations for the **Domain member: Digitally sign secure channel data (when possible)** security policy setting.| +| [Domain member: Disable machine account password changes](domain-member-disable-machine-account-password-changes.md)| Describes the best practices, location, values, and security considerations for the **Domain member: Disable machine account password changes** security policy setting. +| [Domain member: Maximum machine account password age](domain-member-maximum-machine-account-password-age.md) |Describes the best practices, location, values, and security considerations for the **Domain member: Maximum machine account password age** security policy setting.| +|[Domain member: Require strong (Windows 2000 or later) session key](domain-member-require-strong-windows-2000-or-later-session-key.md)| Describes the best practices, location, values, and security considerations for the **Domain member: Require strong (Windows 2000 or later) session key** security policy setting. | +| [Interactive logon: Display user information when the session is locked](interactive-logon-display-user-information-when-the-session-is-locked.md)| Describes the best practices, location, values, and security considerations for the **Interactive logon: Display user information when the session is locked** security policy setting. | +| [Interactive logon: Do not display last user name](interactive-logon-do-not-display-last-user-name.md)| Describes the best practices, location, values, and security considerations for the **Interactive logon: Do not display last user name** security policy setting.| +| [Interactive logon: Do not require CTRL+ALT+DEL](interactive-logon-do-not-require-ctrl-alt-del.md)| Describes the best practices, location, values, and security considerations for the **Interactive logon: Do not require CTRL+ALT+DEL** security policy setting.| +| [Interactive logon: Machine account lockout threshold](interactive-logon-machine-account-lockout-threshold.md) | Describes the best practices, location, values, management, and security considerations for the **Interactive logon: Machine account lockout threshold** security policy setting.| +| [Interactive logon: Machine inactivity limit](interactive-logon-machine-inactivity-limit.md)| Describes the best practices, location, values, management, and security considerations for the **Interactive logon: Machine inactivity limit** security policy setting.| +| [Interactive logon: Message text for users attempting to log on](interactive-logon-message-text-for-users-attempting-to-log-on.md) | Describes the best practices, location, values, management, and security considerations for the **Interactive logon: Message text for users attempting to log on** security policy setting. | +| [Interactive logon: Message title for users attempting to log on](interactive-logon-message-title-for-users-attempting-to-log-on.md)| Describes the best practices, location, values, policy management and security considerations for the **Interactive logon: Message title for users attempting to log on** security policy setting. | +| [Interactive logon: Number of previous logons to cache (in case domain controller is not available)](interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md)| Describes the best practices, location, values, policy management and security considerations for the **Interactive logon: Number of previous logons to cache (in case domain controller is not available)** security policy setting. | +| [Interactive logon: Prompt user to change password before expiration](interactive-logon-prompt-user-to-change-password-before-expiration.md)| Describes the best practices, location, values, policy management and security considerations for the **Interactive logon: Prompt user to change password before expiration** security policy setting. | +| [Interactive logon: Require Domain Controller authentication to unlock workstation](interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md)| Describes the best practices, location, values, policy management, and security considerations for the **Interactive logon: Require Domain Controller authentication to unlock workstation** security policy setting. | +| [Interactive logon: Require smart card](interactive-logon-require-smart-card.md) | Describes the best practices, location, values, policy management and security considerations for the **Interactive logon: Require smart card** security policy setting.| +| [Interactive logon: Smart card removal behavior](interactive-logon-smart-card-removal-behavior.md) | Describes the best practices, location, values, policy management and security considerations for the **Interactive logon: Smart card removal behavior** security policy setting.| +| [Microsoft network client: Digitally sign communications (always)](microsoft-network-client-digitally-sign-communications-always.md) | Describes the best practices, location, values, policy management and security considerations for the **Microsoft network client: Digitally sign communications (always)** security policy setting. | +| [Microsoft network client: Digitally sign communications (if server agrees)](microsoft-network-client-digitally-sign-communications-if-server-agrees.md)| Describes the best practices, location, values, and security considerations for the **Microsoft network client: Digitally sign communications (if server agrees)** security policy setting. | +| [Microsoft network client: Send unencrypted password to third-party SMB servers](microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md)| Describes the best practices, location, values, policy management and security considerations for the **Microsoft network client: Send unencrypted password to third-party SMB servers** security policy setting. | +| [Microsoft network server: Amount of idle time required before suspending session](microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md)| Describes the best practices, location, values, and security considerations for the **Microsoft network server: Amount of idle time required before suspending session** security policy setting. | +| [Microsoft network server: Attempt S4U2Self to obtain claim information](microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md)| Describes the best practices, location, values, management, and security considerations for the **Microsoft network server: Attempt S4U2Self to obtain claim information** security policy setting. | +| [Microsoft network server: Digitally sign communications (always)](microsoft-network-server-digitally-sign-communications-always.md)| Describes the best practices, location, values, policy management and security considerations for the **Microsoft network server: Digitally sign communications (always)** security policy setting.| +| [Microsoft network server: Digitally sign communications (if client agrees)](microsoft-network-server-digitally-sign-communications-if-client-agrees.md)| Describes the best practices, location, values, policy management and security considerations for the **Microsoft network server: Digitally sign communications (if client agrees)** security policy setting. | +| [Microsoft network server: Disconnect clients when logon hours expire](microsoft-network-server-disconnect-clients-when-logon-hours-expire.md)| Describes the best practices, location, values, and security considerations for the **Microsoft network server: Disconnect clients when logon hours expire** security policy setting. | +| [Microsoft network server: Server SPN target name validation level](microsoft-network-server-server-spn-target-name-validation-level.md)| Describes the best practices, location, and values, policy management and security considerations for the **Microsoft network server: Server SPN target name validation level** security policy setting. | +| [Network access: Allow anonymous SID/Name translation](network-access-allow-anonymous-sidname-translation.md)| Describes the best practices, location, values, policy management and security considerations for the **Network access: Allow anonymous SID/Name translation** security policy setting.| +| [Network access: Do not allow anonymous enumeration of SAM accounts](network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md)| Describes the best practices, location, values, and security considerations for the **Network access: Do not allow anonymous enumeration of SAM accounts** security policy setting. | +| [Network access: Do not allow anonymous enumeration of SAM accounts and shares](network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md)| Describes the best practices, location, values, and security considerations for the **Network access: Do not allow anonymous enumeration of SAM accounts and shares** security policy setting. | +| [Network access: Do not allow storage of passwords and credentials for network authentication](network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md)| Describes the best practices, location, values, policy management and security considerations for the **Network access: Do not allow storage of passwords and credentials for network authentication** security policy setting. | +| [Network access: Let Everyone permissions apply to anonymous users](network-access-let-everyone-permissions-apply-to-anonmous-users.md)| Describes the best practices, location, values, policy management and security considerations for the **Network access: Let Everyone permissions apply to anonymous users** security policy setting. | +| [Network access: Named Pipes that can be accessed anonymously](network-access-named-pipes-that-can-be-accessed-anonymously.md)| Describes the best practices, location, values, policy management and security considerations for the **Network access: Named Pipes that can be accessed anonymously** security policy setting. | +| [Network access: Remotely accessible registry paths](network-access-remotely-accessible-registry-paths.md)| Describes the best practices, location, values, policy management and security considerations for the **Network access: Remotely accessible registry paths** security policy setting.| +| [Network access: Remotely accessible registry paths and subpaths](network-access-remotely-accessible-registry-paths-and-subpaths.md)| Describes the best practices, location, values, and security considerations for the **Network access: Remotely accessible registry paths and subpaths** security policy setting. | +| [Network access: Restrict anonymous access to Named Pipes and Shares](network-access-restrict-anonymous-access-to-named-pipes-and-shares.md)| Describes the best practices, location, values, policy management and security considerations for the **Network access: Restrict anonymous access to Named Pipes and Shares** security policy setting. | +| [Network access: Shares that can be accessed anonymously](network-access-shares-that-can-be-accessed-anonymously.md)| Describes the best practices, location, values, policy management and security considerations for the **Network access: Shares that can be accessed anonymously** security policy setting. | +| [Network access: Sharing and security model for local accounts](network-access-sharing-and-security-model-for-local-accounts.md)| Describes the best practices, location, values, policy management and security considerations for the **Network access: Sharing and security model for local accounts** security policy setting. | +| [Network security: Allow Local System to use computer identity for NTLM](network-security-allow-local-system-to-use-computer-identity-for-ntlm.md)| Describes the location, values, policy management, and security considerations for the **Network security: Allow Local System to use computer identity for NTLM** security policy setting. | +| [Network security: Allow LocalSystem NULL session fallback](network-security-allow-localsystem-null-session-fallback.md)| Describes the best practices, location, values, and security considerations for the **Network security: Allow LocalSystem NULL session fallback** security policy setting.| +| [Network security: Allow PKU2U authentication requests to this computer to use online identities](network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md)| Describes the best practices, location, and values for the **Network Security: Allow PKU2U authentication requests to this computer to use online identities** security policy setting. | +| [Network security: Configure encryption types allowed for Kerberos Win7 only](network-security-configure-encryption-types-allowed-for-kerberos.md)| Describes the best practices, location, values and security considerations for the **Network security: Configure encryption types allowed for Kerberos Win7 only** security policy setting. | +| [Network security: Do not store LAN Manager hash value on next password change](network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md)| Describes the best practices, location, values, policy management and security considerations for the **Network security: Do not store LAN Manager hash value on next password change** security policy setting. | +| [Network security: Force logoff when logon hours expire](network-security-force-logoff-when-logon-hours-expire.md)| Describes the best practices, location, values, policy management and security considerations for the **Network security: Force logoff when logon hours expire** security policy setting. | +| [Network security: LAN Manager authentication level](network-security-lan-manager-authentication-level.md)| Describes the best practices, location, values, policy management and security considerations for the **Network security: LAN Manager authentication level** security policy setting.| +| [Network security: LDAP client signing requirements](network-security-ldap-client-signing-requirements.md) | This security policy reference topic for the IT professional describes the best practices, location, values, policy management and security considerations for this policy setting. This information applies to computers running at least the Windows Server 2008 operating system. | +| [Network security: Minimum session security for NTLM SSP based (including secure RPC) clients](network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md)| Describes the best practices, location, values, policy management and security considerations for the **Network security: Minimum session security for NTLM SSP based (including secure RPC) clients** security policy setting. | +| [Network security: Minimum session security for NTLM SSP based (including secure RPC) servers](network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md)| Describes the best practices, location, values, policy management and security considerations for the **Network security: Minimum session security for NTLM SSP based (including secure RPC) servers** security policy setting. | +| [Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication](network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md)| Describes the best practices, location, values, management aspects, and security considerations for the **Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication** security policy setting. | +| [Network security: Restrict NTLM: Add server exceptions in this domain](network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md)| Describes the best practices, location, values, management aspects, and security considerations for the **Network security: Restrict NTLM: Add server exceptions in this domain** security policy setting. | +| [Network security: Restrict NTLM: Audit incoming NTLM traffic](network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md)| Describes the best practices, location, values, management aspects, and security considerations for the **Network Security: Restrict NTLM: Audit incoming NTLM traffic** security policy setting. | +| [Network security: Restrict NTLM: Audit NTLM authentication in this domain](network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md)| Describes the best practices, location, values, management aspects, and security considerations for the **Network Security: Restrict NTLM: Audit NTLM authentication in this domain** security policy setting. | +| [Network security: Restrict NTLM: Incoming NTLM traffic](network-security-restrict-ntlm-incoming-ntlm-traffic.md)| Describes the best practices, location, values, management aspects, and security considerations for the **Network Security: Restrict NTLM: Incoming NTLM traffic** security policy setting. | +| [Network security: Restrict NTLM: NTLM authentication in this domain](network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md)| Describes the best practices, location, values, management aspects, and security considerations for the **Network Security: Restrict NTLM: NTLM authentication in this domain** security policy setting. | +| [Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers](network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md)| Describes the best practices, location, values, management aspects, and security considerations for the **Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers** security policy setting. | +| [Recovery console: Allow automatic administrative logon](recovery-console-allow-automatic-administrative-logon.md)| Describes the best practices, location, values, policy management and security considerations for the **Recovery console: Allow automatic administrative logon** security policy setting. | +| [Recovery console: Allow floppy copy and access to all drives and folders](recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md)| Describes the best practices, location, values, policy management and security considerations for the **Recovery console: Allow floppy copy and access to all drives and folders** security policy setting. | +| [Shutdown: Allow system to be shut down without having to lg on](shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md)| Describes the best practices, location, values, policy management and security considerations for the **Shutdown: Allow system to be shut down without having to log on** security policy setting. | +| [Shutdown: Clear virtual memory pagefile](shutdown-clear-virtual-memory-pagefile.md)| Describes the best practices, location, values, policy management and security considerations for the **Shutdown: Clear virtual memory pagefile** security policy setting.| +| [System cryptography: Force strong key protection for user keys stored on the computer](system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md)| Describes the best practices, location, values, policy management and security considerations for the **System cryptography: Force strong key protection for user keys stored on the computer** security policy setting. | +| [System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing](system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md)| This security policy reference topic for the IT professional describes the best practices, location, values, policy management and security considerations for this policy setting. | +| [System objects: Require case insensitivity for non-Windows subsystems](system-objects-require-case-insensitivity-for-non-windows-subsystems.md)| Describes the best practices, location, values, policy management and security considerations for the **System objects: Require case insensitivity for non-Windows subsystems** security policy setting. | +| [System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)](system-objects-strengthen-default-permissions-of-internal-system-objects.md)| Describes the best practices, location, values, policy management and security considerations for the **System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)** security policy setting. | +| [System settings: Optional subsystems](system-settings-optional-subsystems.md) | Describes the best practices, location, values, policy management and security considerations for the **System settings: Optional subsystems** security policy setting.| +| [System settings: Use certificate rules on Windows executables for Software Restriction Policies](system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md)| Describes the best practices, location, values, policy management and security considerations for the **System settings: Use certificate rules on Windows executables for Software Restriction Policies** security policy setting. | +| [User Account Control: Admin Approval Mode for the Built-in Administrator account](user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md)| Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Admin Approval Mode for the Built-in Administrator account** security policy setting. | +| [User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop](user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md)| Describes the best practices, location, values, and security considerations for the **User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop** security policy setting. | +| [User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode](user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md)| Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode** security policy setting. | +| [User Account Control: Behavior of the elevation prompt for standard users](user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md)| Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Behavior of the elevation prompt for standard users** security policy setting. | +| [User Account Control: Detect application installations and prompt for elevation](user-account-control-detect-application-installations-and-prompt-for-elevation.md)| Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Detect application installations and prompt for elevation** security policy setting. | +| [User Account Control: Only elevate executables that are signed and validated](user-account-control-only-elevate-executables-that-are-signed-and-validated.md)| Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Only elevate executables that are signed and validated** security policy setting. | +| [User Account Control: Only elevate UIAccess applications that are installed in secure locations](user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md)| Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Only elevate UIAccess applications that are installed in secure locations** security policy setting. | +| [User Account Control: Run all administrators in Admin Approval Mode](user-account-control-run-all-administrators-in-admin-approval-mode.md)| Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Run all administrators in Admin Approval Mode** security policy setting. | +| [User Account Control: Switch to the secure desktop when prompting for elevation](user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md)| Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Switch to the secure desktop when prompting for elevation** security policy setting. | +| [User Account Control: Virtualize file and registry write failures to per-user locations](user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md)| Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Virtualize file and registry write failures to per-user locations** security policy setting. |   ## Related topics -[Security policy settings reference](security-policy-settings-reference.md) -[Security policy settings](security-policy-settings.md) -  -  + +- [Security policy settings reference](security-policy-settings-reference.md) +- [Security policy settings](security-policy-settings.md) diff --git a/windows/keep-secure/security-policy-settings-reference.md b/windows/keep-secure/security-policy-settings-reference.md index 83e2f87051..06c6b96d8d 100644 --- a/windows/keep-secure/security-policy-settings-reference.md +++ b/windows/keep-secure/security-policy-settings-reference.md @@ -2,53 +2,32 @@ title: Security policy settings reference (Windows 10) description: This reference of security settings provides information about how to implement and manage security policies, including setting options and security considerations. ms.assetid: ef5a4579-15a8-4507-9a43-b7ccddcb0ed1 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Security policy settings reference + **Applies to** - Windows 10 + This reference of security settings provides information about how to implement and manage security policies, including setting options and security considerations. + This reference focuses on those settings that are considered security settings. This reference examines only the settings and features in the Windows operating systems that can help organizations secure their enterprises against malicious software threats. Management features and those security features that you cannot configure are not described in this reference. + Each policy setting described contains referential content such as a detailed explanation of the settings, best practices, default settings, differences between operating system versions, policy management considerations, and security considerations that include a discussion of vulnerability, countermeasures, and potential impact of those countermeasures. + ## In this section - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      TopicDescription

      [Account Policies](account-policies.md)

      An overview of account policies in Windows and provides links to policy descriptions.

      [Audit Policy](audit-policy.md)

      Provides information about basic audit policies that are available in Windows and links to information about each setting.

      [Security Options](security-options.md)

      Provides an introduction to the settings under Security Options of the local security policies and links to information about each setting.

      [Advanced security audit policy settings](secpol-advanced-security-audit-policy-settings.md)

      Provides information about the advanced security audit policy settings that are available in Windows and the audit events that they generate.

      [User Rights Assignment](user-rights-assignment.md)

      Provides an overview and links to information about the User Rights Assignment security policy settings user rights that are available in Windows.

      -  + +| Topic | Description | +| - | - | +| [Account Policies](account-policies.md) | An overview of account policies in Windows and provides links to policy descriptions.| +| [Audit Policy](audit-policy.md) | Provides information about basic audit policies that are available in Windows and links to information about each setting.| +| [Security Options](security-options.md) | Provides an introduction to the settings under **Security Options** of the local security policies and links to information about each setting.| +| [Advanced security audit policy settings](secpol-advanced-security-audit-policy-settings.md) | Provides information about the advanced security audit policy settings that are available in Windows and the audit events that they generate.| +| [User Rights Assignment](user-rights-assignment.md) | Provides an overview and links to information about the User Rights Assignment security policy settings user rights that are available in Windows.  |     diff --git a/windows/keep-secure/security-policy-settings.md b/windows/keep-secure/security-policy-settings.md index fb4adf5d9d..1551485d7e 100644 --- a/windows/keep-secure/security-policy-settings.md +++ b/windows/keep-secure/security-policy-settings.md @@ -2,111 +2,191 @@ title: Security policy settings (Windows 10) description: This reference topic describes the common scenarios, architecture, and processes for security settings. ms.assetid: e7ac5204-7f6c-4708-a9f6-6af712ca43b9 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Security policy settings + **Applies to** - Windows 10 + This reference topic describes the common scenarios, architecture, and processes for security settings. + Security policy settings are rules that administrators configure on a computer or multiple devices for the purpose of protecting resources on a device or network. The Security Settings extension of the Local Group Policy Editor snap-in allows you to define security configurations as part of a Group Policy Object (GPO). The GPOs are linked to Active Directory containers such as sites, domains, or organizational units, and they enable you to manage security settings for multiple devices from any device joined to the domain. Security settings policies are used as part of your overall security implementation to help secure domain controllers, servers, clients, and other resources in your organization. + Security settings can control: + - User authentication to a network or device. - The resources that users are permitted to access. - Whether to record a user’s or group’s actions in the event log. - Membership in a group. + To manage security configurations for multiple devices, you can use one of the following options: + - Edit specific security settings in a GPO. - Use the Security Templates snap-in to create a security template that contains the security policies you want to apply, and then import the security template into a Group Policy Object. A security template is a file that represents a security configuration, and it can be imported to a GPO, applied to a local device, or used to analyze security. + For more info about managing security configurations, see [Administer security policy settings](administer-security-policy-settings.md). + The Security Settings extension of the Local Group Policy Editor includes the following types of security policies: + - **Account Policies.** These polices are defined on devices; they affect how user accounts can interact with the computer or domain. Account policies include the following types of policies: + - **Password Policy.** These policies determine settings for passwords, such as enforcement and lifetimes. Password policies are used for domain accounts. - **Account Lockout Policy.** These policies determine the conditions and length of time that an account will be locked out of the system. Account lockout policies are used for domain or local user accounts. - **Kerberos Policy.** These policies are used for domain user accounts; they determine Kerberos-related settings, such as ticket lifetimes and enforcement. + - **Local Policies.** These policies apply to a computer and include the following types of policy settings: + - **Audit Policy.** Specify security settings that control the logging of security events into the Security log on the computer, and specifies what types of security events to log (success, failure, or both). - **Note**   - For devices running Windows 7 and later, we recommend to use the settings under Advanced Audit Policy Configuration rather than the Audit Policy settings under Local Policies. + + >**Note:**  For devices running Windows 7 and later, we recommend to use the settings under Advanced Audit Policy Configuration rather than the Audit Policy settings under Local Policies.   - **User Rights Assignment.** Specify the users or groups that have logon rights or privileges on a device - **Security Options.** Specify security settings for the computer, such as Administrator and Guest Account names; access to floppy disk drives and CD-ROM drives; installation of drivers; logon prompts; and so on. + - **Windows Firewall with Advanced Security.** Specify settings to protect the device on your network by using a stateful firewall that allows you to determine which network traffic is permitted to pass between your device and the network. - **Network List Manager Policies.** Specify settings that you can use to configure different aspects of how networks are listed and displayed on one device or on many devices. - **Public Key Policies.** Specify settings to control Encrypting File System, Data Protection, and BitLocker Drive Encryption in addition to certain certificate paths and services settings. - **Software Restriction Policies.** Specify settings to identify software and to control its ability to run on your local device, organizational unit, domain, or site. - **Application Control Policies.** Specify settings to control which users or groups can run particular applications in your organization based on unique identities of files. - **IP Security Policies on Local Computer.** Specify settings to ensure private, secure communications over IP networks through the use of cryptographic security services. IPsec establishes trust and security from a source IP address to a destination IP address. -- **Advanced Audit Policy Configuration.** Specify settings that control the logging of security events into the security log on the device. The settings under Advanced Audit Policy Configuration provide finer control over which activities to monitor as opposed to the Audit Policy settings under Local Policies. +- **Advanced Audit Policy Configuration.** Specify settings that control the logging of security events into the security log on the device. The settings under Advanced Audit Policy Configuration provide finer control over which activities to monitor as opposed to the Audit Policy settings under +Local Policies. + ## Policy-based security settings management + The Security Settings extension to Group Policy provides an integrated policy-based management infrastructure to help you manage and enforce your security policies. + You can define and apply security settings policies to users, groups, and network servers and clients through Group Policy and Active Directory Domain Services (AD DS). A group of servers with the same functionality can be created (for example, a Microsoft Web (IIS) server), and then Group Policy Objects can be used to apply common security settings to the group. If more servers are added to this group later, many of the common security settings are automatically applied, reducing deployment and administrative labor. + ### Common scenarios for using security settings policies + Security settings policies are used to manage the following aspects of security: accounts policy, local policy, user rights assignment, registry values, file and registry Access Control Lists (ACLs), service startup modes, and more. + As part of your security strategy, you can create GPOs with security settings policies configured specifically for the various roles in your organization, such as domain controllers, file servers, member servers, clients, and so on. + You can create an organizational unit (OU) structure that groups devices according to their roles. Using OUs is the best method for separating specific security requirements for the different roles in your network. This approach also allows you to apply customized security templates to each class of server or computer. After creating the security templates, you create a new GPO for each of the OUs, and then import the security template (.inf file) into the new GPO. -Importing a security template to a GPO ensures that any accounts to which the GPO is applied automatically receive the template’s security settings when the Group Policy settings are refreshed. On a workstation or server, the security settings are refreshed at regular intervals (with a random offset of at most 30 minutes), and, on a domain controller, this process occurs every few minutes if changes have occurred in any of the GPO settings that apply. The settings are also refreshed every 16 hours, whether or not any changes have occurred. -**Note**   -These refresh settings vary between versions of the operating system and can be configured. + +Importing a security template to a GPO ensures that any accounts to which the GPO is applied automatically receive the template’s security settings when the Group Policy settings are refreshed. On a workstation or server, the security settings are refreshed at regular intervals (with a random +offset of at most 30 minutes), and, on a domain controller, this process occurs every few minutes if changes have occurred in any of the GPO settings that apply. The settings are also refreshed every 16 hours, whether or not any changes have occurred. + +>**Note:**  These refresh settings vary between versions of the operating system and can be configured.   By using Group Policy−based security configurations in conjunction with the delegation of administration, you can ensure that specific security settings, rights, and behavior are applied to all servers and computers within an OU. This approach makes it simple to update a number of servers with any additional changes required in the future. + ### Dependencies on other operating system technologies + For devices that are members of a Windows Server 2008 or later domain, security settings policies depend on the following technologies: + - **Active Directory Domain Services (AD DS)** + The Windows-based directory service, AD DS, stores information about objects on a network and makes this information available to administrators and users. By using AD DS, you can view and manage network objects on the network from a single location, and users can access permitted network resources by using a single logon. + - **Group Policy** + The infrastructure within AD DS that enables directory-based configuration management of user and computer settings on devices running Windows Server. By using Group Policy, you can define configurations for groups of users and computers, including policy settings, registry-based policies, software installation, scripts, folder redirection, Remote Installation Services, Internet Explorer maintenance, and security. + - **Domain Name System (DNS)** + A hierarchical naming system used for locating domain names on the Internet and on private TCP/IP networks. DNS provides a service for mapping DNS domain names to IP addresses, and IP addresses to domain names. This allows users, computers, and applications to query DNS to specify remote systems by fully qualified domain names rather than by IP addresses. + - **Winlogon** + A part of the Windows operating system that provides interactive logon support. Winlogon is designed around an interactive logon model that consists of three components: the Winlogon executable, a credential provider, and any number of network providers. + - **Setup** + Security configuration interacts with the operating system setup process during a clean installation or upgrade from earlier versions of Windows Server. + - **Security Accounts Manager (SAM)** + A Windows service used during the logon process. SAM maintains user account information, including groups to which a user belongs. + - **Local Security Authority (LSA)** + A protected subsystem that authenticates and logs users onto the local system. LSA also maintains information about all aspects of local security on a system, collectively known as the Local Security Policy of the system. + - **Windows Management Instrumentation (WMI)** + A feature of the Microsoft Windows operating system, WMI is the Microsoft implementation of Web-Based Enterprise Management (WBEM), which is an industry initiative to develop a standard technology for accessing management information in an enterprise environment. WMI provides access to information about objects in a managed environment. Through WMI and the WMI application programming interface (API), applications can query for and make changes to static information in the Common Information Model (CIM) repository and dynamic information maintained by the various types of providers. + - **Resultant Set of Policy (RSoP)** + An enhanced Group Policy infrastructure that uses WMI in order to make it easier to plan and debug policy settings. RSoP provides public methods that expose what an extension to Group Policy would do in a what-if situation, and what the extension has done in an actual situation. This allows administrators to easily determine the combination of policy settings that apply to, or will apply to, a user or device. + - **Service Control Manager (SCM)** + Used for configuration of service startup modes and security. + - **Registry** + Used for configuration of registry values and security. + - **File system** + Used for configuration of security. + - **File system conversions** + Security is set when an administrator converts a file system from FAT to NTFS. + - **Microsoft Management Console (MMC)** + The user interface for the Security Settings tool is an extension of the Local Group Policy Editor MMC snap-in. + ### Security settings policies and Group Policy + The Security Settings extension of the Local Group Policy Editor is part of the Security Configuration Manager tool set. The following components are associated with Security Settings: a configuration engine; an analysis engine; a template and database interface layer; setup integration logic; and the secedit.exe command-line tool. The security configuration engine is responsible for handling security configuration editor-related security requests for the system on which it runs. The analysis engine analyzes system security for a given configuration and saves the result. The template and database interface layer handles reading and writing requests from and to the template or database (for internal storage). The Security Settings extension of the Local Group Policy Editor handles Group Policy from a domain-based or local device. The security configuration logic integrates with setup and manages system security for a clean installation or upgrade to a more recent Windows operating system. Security information is stored in templates (.inf files) or in the Secedit.sdb database. + The following diagram shows Security Settings and related features. + **Security Settings Policies and Related Features** + ![components related to security policies](images/secpol-components.gif) + - **Scesrv.dll** + Provides the core security engine functionality. + - **Scecli.dll** + Provides the client-side interfaces to the security configuration engine and provides data to Resultant Set of Policy (RSoP). + - **Wsecedit.dll** + The Security Settings extension of Local Group Policy Editor. scecli.dll is loaded into wsecedit.dll to support the Security Settings user interface. + - **Gpedit.dll** + The Local Group Policy Editor MMC snap-in. + ## Security Settings extension architecture + The Security Settings extension of the Local Group Policy Editor is part of the Security Configuration Manager tools, as shown in the following diagram. + **Security Settings Architecture** + ![architecture of security policy settings](images/secpol-architecture.gif) + The security settings configuration and analysis tools include a security configuration engine, which provides local computer (non-domain member) and Group Policy−based configuration and analysis of security settings policies. The security configuration engine also supports the creation of security policy files. The primary features of the security configuration engine are scecli.dll and scesrv.dll. + The following list describes these primary features of the security configuration engine and other Security Settings−related features. + - **scesrv.dll** + This .dll is hosted in services.exe and runs under local system context. scesrv.dll provides core Security Configuration Manager functionality, such as import, configure, analyze, and policy propagation. + Scesrv.dll performs configuration and analysis of various security-related system parameters by calling corresponding system APIs, including LSA, SAM, and the registry. + Scesrv.dll exposes APIs such as import, export, configure, and analyze. It checks that the request is made over LRPC (Windows XP) and fails the call if it is not. + Communication between parts of the Security Settings extension occurs by using the following methods: + - Component Object Model (COM) calls - Local Remote Procedure Call (LRPC) - Lightweight Directory Access Protocol (LDAP) @@ -114,146 +194,204 @@ The following list describes these primary features of the security configuratio - Server Message Block (SMB) - Win32 APIs - Windows Management Instrumentation (WMI) calls + On domain controllers, scesrv.dll receives notifications of changes made to SAM and the LSA that need to be synchronized across domain controllers. Scesrv.dll incorporates those changes into the Default Domain Controller Policy GPO by using in-process scecli.dll template modification APIs. Scesrv.dll also performs configuration and analysis operations. + - **Scecli.dll** + This is the client-side interface or wrapper to scesrv.dll. scecli.dll is loaded into Wsecedit.dll to support MMC snap-ins. It is used by Setup to configure default system security and security of files, registry keys, and services installed by the Setup API .inf files. + The command-line version of the security configuration and analysis user interfaces, secedit.exe, uses scecli.dll. + Scecli.dll implements the client-side extension for Group Policy. + Scesrv.dll uses scecli.dll to download applicable Group Policy files from SYSVOL in order to apply Group Policy security settings to the local device. + Scecli.dll logs application of security policy into WMI (RSoP). + Scesrv.dll policy filter uses scecli.dll to update Default Domain Controller Policy GPO when changes are made to SAM and LSA. + - **Wsecedit.dll** + The Security Settings extension of the Group Policy Object Editor snap-in. You use this tool to configure security settings in a Group Policy Object for a site, domain, or organizational unit. You can also use Security Settings to import security templates to a GPO. + - **Secedit.sdb** + This is a permanent system database used for policy propagation including a table of persistent settings for rollback purposes. + - **User databases** + A user database is any database other than the system database created by administrators for the purposes of configuration or analysis of security. + - **.Inf Templates** - These are text files that contain declarative security settings. They are loaded into a database before configuration or analysis. Group Policy security policies are stored in .inf files on the SYSVOL folder of domain controllers, where they are downloaded (by using file copy) and merged into the system database during policy propagation. + + These are text files that contain declarative security settings. They are loaded into a database before configuration or analysis. Group Policy security policies are stored in .inf files on the SYSVOL folder of domain controllers, where they are downloaded (by using file copy) and merged into + the system database during policy propagation. + ## Security settings policy processes and interactions + For a domain-joined device, where Group Policy is administered, security settings are processed in conjunction with Group Policy. Not all settings are configurable. + ### Group Policy processing + When a computer starts and a user logs on, computer policy and user policy are applied according to the following sequence: + 1. The network starts. Remote Procedure Call System Service (RPCSS) and Multiple Universal Naming Convention Provider (MUP) start. 2. An ordered list of Group Policy Objects is obtained for the device. The list might depend on these factors: + - Whether the device is part of a domain and, therefore, subject to Group Policy through Active Directory. - The location of the device in Active Directory. - Whether the list of Group Policy Objects has changed. If the list of Group Policy Objects has not changed, no processing is done. + 3. Computer policy is applied. These are the settings under Computer Configuration from the gathered list. This is a synchronous process by default and occurs in the following order: local, site, domain, organizational unit, child organizational unit, and so on. No user interface appears while computer policies are processed. 4. Startup scripts run. This is hidden and synchronous by default; each script must complete or time out before the next one starts. The default time-out is 600 seconds. You can use several policy settings to modify this behavior. 5. The user presses CTRL+ALT+DEL to log on. 6. After the user is validated, the user profile loads; it is governed by the policy settings that are in effect. 7. An ordered list of Group Policy Objects is obtained for the user. The list might depend on these factors: + - Whether the user is part of a domain and, therefore, subject to Group Policy through Active Directory. - Whether loopback policy processing is enabled, and if so, the state (Merge or Replace) of the loopback policy setting. - The location of the user in Active Directory. - Whether the list of Group Policy Objects has changed. If the list of Group Policy Objects has not changed, no processing is done. + 8. User policy is applied. These are the settings under User Configuration from the gathered list. This is synchronous by default and in the following order: local, site, domain, organizational unit, child organizational unit, and so on. No user interface appears while user policies are processed. 9. Logon scripts run. Group Policy−based logon scripts are hidden and asynchronous by default. The user object script runs last. 10. The operating system user interface that is prescribed by Group Policy appears. + ### Group Policy Objects storage + A Group Policy Object (GPO) is a virtual object that is identified by a Globally Unique Identifier (GUID) and stored at the domain level. The policy setting information of a GPO is stored in the following two locations: + - **Group Policy containers in Active Directory.** + The Group Policy container is an Active Directory container that contains GPO properties, such as version information, GPO status, plus a list of other component settings. + - **Group Policy templates in a domain’s system volume folder (SYSVOL).** + The Group Policy template is a file system folder that includes policy data specified by .admx files, security settings, script files, and information about applications that are available for installation. The Group Policy template is located in the SYSVOL folder in the domain\\Policies subfolder. + The **GROUP\_POLICY\_OBJECT** structure provides information about a GPO in a GPO list, including the version number of the GPO, a pointer to a string that indicates the Active Directory portion of the GPO, and a pointer to a string that specifies the path to the file system portion of the GPO. + ### Group Policy processing order + Group Policy settings are processed in the following order: + 1. **Local Group Policy Object.** + Each device running a Windows operating system beginning with Windows XP has exactly one Group Policy Object that is stored locally. + 2. **Site.** + Any Group Policy Objects that have been linked to the site are processed next. Processing is synchronous and in an order that you specify. + 3. **Domain.** + Processing of multiple domain-linked Group Policy Objects is synchronous and in an order you speciy. + 4. **Organizational units.** + Group Policy Objects that are linked to the organizational unit that is highest in the Active Directory hierarchy are processed first, then Group Policy Objects that are linked to its child organizational unit, and so on. Finally, the Group Policy Objects that are linked to the organizational unit that contains the user or device are processed. + At the level of each organizational unit in the Active Directory hierarchy, one, many, or no Group Policy Objects can be linked. If several Group Policy Objects are linked to an organizational unit, their processing is synchronous and in an order that you specify. + This order means that the local Group Policy Object is processed first, and Group Policy Objects that are linked to the organizational unit of which the computer or user is a direct member are processed last, which overwrites the earlier Group Policy Objects. + This is the default processing order and administrators can specify exceptions to this order. A Group Policy Object that is linked to a site, domain, or organizational unit (not a local Group Policy Object) can be set to **Enforced** with respect to that site, domain, or organizational unit, so that none of its policy settings can be overridden. At any site, domain, or organizational unit, you can mark Group Policy inheritance selectively as **Block Inheritance**. Group Policy Object links that are set to **Enforced** are always applied, however, and they cannot be blocked. + ### Security settings policy processing + In the context of Group Policy processing, security settings policy is processed in the following order. + 1. During Group Policy processing, the Group Policy engine determines which security settings policies to apply. 2. If security settings policies exist in a GPO, Group Policy invokes the Security Settings client-side extension. 3. The Security Settings extension downloads the policy from the appropriate location such as a specific domain controller. 4. The Security Settings extension merges all security settings policies according to precedence rules. The processing is according to the Group Policy processing order of local, site, domain, and organizational unit (OU), as described earlier in the “Group Policy processing order” section. If multiple GPOs are in effect for a given device and there are no conflicting policies, then the policies are cumulative and are merged. + This example uses the Active Directory structure shown in the following figure. A given computer is a member of OU2, to which the **GroupMembershipPolGPO** GPO is linked. This computer is also subject to the **UserRightsPolGPO** GPO, which is linked to OU1, higher in the hierarchy. In this case, no conflicting policies exist so the device receives all of the policies contained in both the **UserRightsPolGPO** and the **GroupMembershipPolGPO** GPOs. + **Multiple GPOs and Merging of Security Policy** + ![multiple gpos and merging of security policy](images/secpol-multigpomerge.gif) + 5. The resultant security policies are stored in secedit.sdb, the security settings database. The security engine gets the security template files and imports them to secedit.sdb. 6. The security settings policies are applied to devices. The following figure illustrates the security settings policy processing. + **Security Settings Policy Processing** + ![process and interactions of security policy settin](images/secpol-processes.gif) + ### Merging of security policies on domain controllers + Password policies, Kerberos, and some security options are only merged from GPOs that are linked at the root level on the domain. This is done to keep those settings synchronized across all domain controllers in the domain. The following security options are merged: + - Network Security: Force logoff when logon hours expire - Accounts: Administrator account status - Accounts: Guest account status - Accounts: Rename administrator account - Accounts: Rename guest account + Another mechanism exists that allows security policy changes made by administrators by using net accounts to be merged into the Default Domain Policy GPO. User rights changes that are made by using Local Security Authority (LSA) APIs are filtered into the Default Domain Controllers Policy GPO. + ### Special considerations for domain controllers + If an application is installed on a primary domain controller (PDC) with operations master role (also known as flexible single master operations or FSMO) and the application makes changes to user rights or password policy, these changes must be communicated to ensure that synchronization across domain controllers occurs. Scesrv.dll receives a notification of any changes made to the security account manager (SAM) and LSA that need to be synchronized across domain controllers and then incorporates the changes into the Default Domain Controller Policy GPO by using scecli.dll template modification APIs. + ### When security settings are applied + After you have edited the security settings policies, the settings are refreshed on the computers in the organizational unit linked to your Group Policy Object in the following instances: + - When a device is restarted. - Every 90 minutes on a workstation or server and every 5 minutes on a domain controller. This refresh interval is configurable. - By default, Security policy settings delivered by Group Policy are also applied every 16 hours (960 minutes) even if a GPO has not changed. + ### Persistence of security settings policy + Security settings can persist even if a setting is no longer defined in the policy that originally applied it. + Security settings might persist in the following cases: + - The setting has not been previously defined for the device. - The setting is for a registry security object. - The settings are for a file system security object. -All settings applied through local policy or through a Group Policy Object are stored in a local database on your computer. Whenever a security setting is modified, the computer saves the security setting value to the local database, which retains a history of all the settings that have been applied to the computer. If a policy first defines a security setting and then no longer defines that setting, then the setting takes on the previous value in the database. If a previous value does not exist in the database then the setting does not revert to anything and remains defined as is. This behavior is sometimes referred to as “tattooing.” + +All settings applied through local policy or through a Group Policy Object are stored in a local database on your computer. Whenever a security setting is modified, the computer saves the security setting value to the local database, which retains a history of all the settings that have been applied to the computer. If a policy first defines a security setting and then no longer defines that setting, then the setting takes on the previous value in the database. If a previous value does not exist in the database then the setting does not revert to anything and remains defined as is. +This behavior is sometimes referred to as “tattooing.” + Registry and file security settings will maintain the values applied through Group Policy until that setting is set to other values. + ### Permissions required for policy to apply + Both Apply Group Policy and Read permissions are required to have the settings from a Group Policy Object apply to users or groups, and computers. + ### Filtering security policy + By default, all GPOs have Read and Apply Group Policy both Allowed for the Authenticated Users group. The Authenticated Users group includes both users and computers. Security settings policies are computer-based. To specify which client computers will or will not have a Group Policy Object applied to them, you can deny them either the Apply Group Policy or Read permission on that Group Policy Object. Changing these permissions allows you to limit the scope of the GPO to a specific set of computers within a site, domain, or OU. -**Note**   -Do not use security policy filtering on a domain controller as this would prevent security policy from applying to it. + +**Note:**  Do not use security policy filtering on a domain controller as this would prevent security policy from applying to it.   ### Migration of GPOs containing security settings + In some situations, you might want to migrate GPOs from one domain environment to another environment. The two most common scenarios are test-to-production migration, and production-to-production migration. The GPO copying process has implications for some types of security settings. + Data for a single GPO is stored in multiple locations and in various formats; some data is contained in Active Directory and other data is stored on the SYSVOL share on the domain controllers. Certain policy data might be valid in one domain but might be invalid in the domain to which the GPO is being copied. For example, Security Identifiers (SIDs) stored in security policy settings are often domain-specific. So copying GPOs is not as simple as taking a folder and copying it from one device to another. + The following security policies can contain security principals and might require some additional work to successfully move them from one domain to another. + - User rights assignment - Restricted groups - Services - File system - Registry - The GPO DACL, if you choose to preserve it during a copy operation + To ensure that data is copied correctly, you can use Group Policy Management Console (GPMC). When migrating a GPO from one domain to another, GPMC ensures that all relevant data is properly copied. GPMC also offers migration tables, which can be used to update domain-specific data to new values as part of the migration process. GPMC hides much of the complexity involved in the migrating GPO operations, and it provides simple and reliable mechanisms for performing operations such as copy and backup of GPOs. + ## In this section - ---- - - - - - - - - - - - - - - - - - - - - -
      TopicDescription

      [Administer security policy settings](administer-security-policy-settings.md)

      This article discusses different methods to administer security policy settings on a local device or throughout a small- or medium-sized organization.

      [Configure security policy settings](how-to-configure-security-policy-settings.md)

      Describes steps to configure a security policy setting on the local device, on a domain-joined device, and on a domain controller.

      [Security policy settings reference](security-policy-settings-reference.md)

      This reference of security settings provides information about how to implement and manage security policies, including setting options and security considerations.

      -  -  -  + +| Topic | Description | +| - | - | +| [Administer security policy settings](administer-security-policy-settings.md) | This article discusses different methods to administer security policy settings on a local device or throughout a small- or medium-sized organization.| +| [Configure security policy settings](how-to-configure-security-policy-settings.md) | Describes steps to configure a security policy setting on the local device, on a domain-joined device, and on a domain controller.| +| [Security policy settings reference](security-policy-settings-reference.md) | This reference of security settings provides information about how to implement and manage security policies, including setting options and security considerations.| diff --git a/windows/keep-secure/security-technologies.md b/windows/keep-secure/security-technologies.md index b1beb54dd3..7d54d652f2 100644 --- a/windows/keep-secure/security-technologies.md +++ b/windows/keep-secure/security-technologies.md @@ -2,64 +2,14 @@ title: Security technologies (Windows 10) description: Learn more about the different security technologies that are available in Windows 10 and Windows 10 Mobile. ms.assetid: BFE2DE22-B0CE-465B-8CF6-28F64464DF08 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Security technologies -<<<<<<< HEAD -Learn more about the different security technologies that are available in Windows 10 and Windows 10 Mobile. -## In this section - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      TopicDescription

      [AppLocker](applocker-overview.md)

      This topic provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. AppLocker helps you control which apps and files users can run. These include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers.

      [BitLocker](bitlocker-overview.md)

      This topic provides a high-level overview of BitLocker, including a list of system requirements, practical applications, and deprecated features.

      [Encrypted Hard Drive](encrypted-hard-drive.md)

      Encrypted Hard Drive uses the rapid encryption that is provided by BitLocker Drive Encryption to enhance data security and management.

      [Security auditing](security-auditing-overview.md)

      Topics in this section are for IT professionals and describes the security auditing features in Windows and how your organization can benefit from using these technologies to enhance the security and manageability of your network.

      [Security policy settings](security-policy-settings.md)

      This reference topic describes the common scenarios, architecture, and processes for security settings.

      [Trusted Platform Module](trusted-platform-module-overview.md)

      This topic for the IT professional describes the Trusted Platform Module (TPM) and how Windows uses it for access control and authentication. The topic provides links to other resources about the TPM.

      [User Account Control](user-account-control-overview.md)

      User Account Control (UAC) helps prevent malware from damaging a PC and helps organizations deploy a better-managed desktop. With UAC, apps and tasks always run in the security context of a non-administrator account, unless an administrator specifically authorizes administrator-level access to the system. UAC can block the automatic installation of unauthorized apps and prevent inadvertent changes to system settings.

      [Windows Defender in Windows 10](windows-defender-in-windows-10.md)

      This topic provides an overview of Windows Defender, including a list of system requirements and new features.

      -  -======= Learn more about the different security technologies that are available in Windows 10 and Windows 10 Mobile. @@ -75,6 +25,5 @@ Learn more about the different security technologies that are available in Windo | [Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md)| Windows Defender Advanced Threat Protection (Windows Defender ATP) is an out-of-the-box Windows enterprise security service that enables enterprise cybersecurity teams to detect and respond to advanced threats on their networks.| | [Windows Defender in Windows 10](windows-defender-in-windows-10.md)| This topic provides an overview of Windows Defender, including a list of system requirements and new features.| ->>>>>>> master     diff --git a/windows/keep-secure/select-types-of-rules-to-create.md b/windows/keep-secure/select-types-of-rules-to-create.md index 7f3a82de40..6e92663943 100644 --- a/windows/keep-secure/select-types-of-rules-to-create.md +++ b/windows/keep-secure/select-types-of-rules-to-create.md @@ -2,77 +2,71 @@ title: Select the types of rules to create (Windows 10) description: This topic lists resources you can use when selecting your application control policy rules by using AppLocker. ms.assetid: 14751169-0ed1-47cc-822c-8c01a7477784 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Select the types of rules to create + **Applies to** - Windows 10 + This topic lists resources you can use when selecting your application control policy rules by using AppLocker. + When determining what types of rules to create for each of your groups, you should also determine what enforcement setting to use for each group. Different rule types are more applicable for some apps, depending on the way that the applications are deployed in a specific business group. + The following topics provide additional information about AppLocker rules that can help you decide what rules to use for your applications: + - [Understanding AppLocker rule behavior](understanding-applocker-rule-behavior.md) - [Understanding AppLocker rule exceptions](understanding-applocker-rule-exceptions.md) - [Understanding AppLocker rule collections](understanding-applocker-rule-collections.md) - [Understanding AppLocker allow and deny actions on rules](understanding-applocker-allow-and-deny-actions-on-rules.md) - [Understanding AppLocker rule condition types](understanding-applocker-rule-condition-types.md) - [Understanding AppLocker default rules](understanding-applocker-default-rules.md) + ### Select the rule collection + The rules you create will be in one of the following rule collections: + - Executable files: .exe and .com - Windows Installer files: .msi, .msp, and .mst - Scripts: .ps1, .bat, .cmd, .vbs, and .js - Packaged apps and packaged app installers: .appx - DLLs: .dll and .ocx + By default, the rules will allow a file to run based upon user or group privilege. If you use DLL rules, a DLL allow rule has to be created for each DLL that is used by all of the allowed apps. The DLL rule collection is not enabled by default. + In the Woodgrove Bank example, the line-of-business app for the Bank Tellers business group is C:\\Program Files\\Woodgrove\\Teller.exe, and this app needs to be included in a rule. In addition, because this rule is part of a list of allowed applications, all the Windows files under C:\\Windows must be included as well. + ### Determine the rule condition + A rule condition is criteria upon which an AppLocker rule is based and can only be one of the rule conditions in the following table. - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
      Rule conditionUsage scenarioResources

      Publisher

      To use a publisher condition, the files must be digitally signed by the software publisher, or you must do so by using an internal certificate. Rules that are specified to the version level might have to be updated when a new version of the file is released.

      For more info about this rule condition, see [Understanding the publisher rule condition in AppLocker](understanding-the-publisher-rule-condition-in-applocker.md).

      Path

      Any file can be assigned this rule condition; however, because path rules specify locations within the file system, any subdirectory will also be affected by the rule (unless explicitly exempted).

      For more info about this rule condition, see [Understanding the path rule condition in AppLocker](understanding-the-path-rule-condition-in-applocker.md).

      File hash

      Any file can be assigned this rule condition; however, the rule must be updated each time a new version of the file is released because the hash value is based in part upon the version.

      For more info about this rule condition, see [Understanding the file hash rule condition in AppLocker](understanding-the-file-hash-rule-condition-in-applocker.md).

      + +| Rule condition | Usage scenario | Resources | +| - | - | - | +| Publisher | To use a publisher condition, the files must be digitally signed by the software publisher, or you must do so by using an internal certificate. Rules that are specified to the version level might have to be updated when a new version of the file is released.|For more info about this rule condition, see [Understanding the publisher rule condition in AppLocker](understanding-the-publisher-rule-condition-in-applocker.md). +| Path| Any file can be assigned this rule condition; however, because path rules specify locations within the file system, any subdirectory will also be affected by the rule (unless explicitly exempted).| For more info about this rule condition, see [Understanding the path rule condition in AppLocker](understanding-the-path-rule-condition-in-applocker.md). | +| File hash | Any file can be assigned this rule condition; however, the rule must be updated each time a new version of the file is released because the hash value is based in part upon the version.| For more info about this rule condition, see [Understanding the file hash rule condition in AppLocker](understanding-the-file-hash-rule-condition-in-applocker.md). |   In the Woodgrove Bank example, the line-of-business app for the Bank Tellers business group is signed and is located at C:\\Program Files\\Woodgrove\\Teller.exe. Therefore, the rule can be defined with a publisher condition. If the rule is defined to a specific version and above (for example, Teller.exe version 8.0 and above), then this will allow any updates to this app to occur without interruption of access to the users if the app's name and signed attributes stay the same. + ### Determine how to allow system files to run + Because AppLocker rules build a list of allowed apps, a rule or rules must be created to allow all Windows files to run. AppLocker provides a means to ensure system files are properly considered in your rule collection by generating the default rules for each rule collection. You can use the default rules as a template when creating your own rules. However, these rules are only meant to function as a starter policy when you are first testing AppLocker rules so that the system files in the Windows folders will be allowed to run. When a default rule is created, it is denoted with "(Default rule)" in its name as it appears in the rule collection. + You can also create a rule for the system files based on the path condition. In the preceding example, for the Bank Tellers group, all Windows files reside under C:\\Windows and can be defined with the path rule condition type. This will permit access to these files whenever updates are applied and the files change. If you require additional application security, you might need to modify the rules created from the built-in default rule collection. For example, the default rule to allow all users to run .exe files in the Windows folder is based on a path condition that allows all files within the Windows folder to run. The Windows folder contains a Temp subfolder to which the Users group is given the following permissions: + - Traverse Folder/Execute File - Create Files/Write Data - Create Folders/Append Data + These permissions settings are applied to this folder for application compatibility. However, because any user can create files in this location, allowing apps to be run from this location might conflict with your organization's security policy. + ## Next steps + After you have selected the types of rules to create, record your findings as explained in [Document your AppLocker rules](document-your-applocker-rules.md). + After recording your findings for the AppLocker rules to create, you will need to consider how to enforce the rules. For info about how to do this, see [Determine Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md). -  -  diff --git a/windows/keep-secure/shut-down-the-system.md b/windows/keep-secure/shut-down-the-system.md index fc101c8428..e07bf9633a 100644 --- a/windows/keep-secure/shut-down-the-system.md +++ b/windows/keep-secure/shut-down-the-system.md @@ -2,105 +2,101 @@ title: Shut down the system (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Shut down the system security policy setting. ms.assetid: c8e8f890-153a-401e-a957-ba6a130304bf -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Shut down the system + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Shut down the system** security policy setting. + ## Reference + This security setting determines if a user who is logged on locally to a device can shut down Windows. + Shutting down domain controllers makes them unavailable to perform functions such as processing logon requests, processing Group Policy settings, and answering Lightweight Directory Access Protocol (LDAP) queries. Shutting down domain controllers that have been assigned operations master roles (also known as flexible single master operations or FSMO roles) can disable key domain functionality; for example, processing logon requests for new passwords, which is performed by the primary domain controller (PDC) emulator master. + The **Shut down the system** user right is required to enable hibernation support, to set the power management settings, and to cancela shutdown. + Constant: SeShutdownPrivilege + ### Possible values + - A user-defined list of accounts - Defaults - Not defined + ### Best practices + 1. Ensure that only Administrators and Backup Operators have the **Shut down the system** user right on member servers, and that only Administrators have the user right on domain controllers. Removing these default groups might limit the abilities of users who are assigned to specific administrative roles in your environment. Ensure that their delegated tasks will not be negatively affected. 2. The ability to shut down domain controllers should be limited to a very small number of trusted administrators. Even though a system shutdown requires the ability to log on to the server, you should be very careful about the accounts and groups that you allow to shut down a domain controller. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default this setting is Administrators, Backup Operators, Server Operators, and Print Operators on domain controllers, and Administrators and Backup Operators on stand-alone servers. + The following table lists the actual and effective default policy values for the most recent supported versions of Windows. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Administrators

      -

      Backup Operators

      -

      Server Operators

      -

      Print Operators

      Stand-Alone Server Default Settings

      Administrators

      -

      Backup Operators

      Domain Controller Effective Default Settings

      Administrators

      -

      Backup Operators

      -

      Server Operators

      -

      Print Operators

      Member Server Effective Default Settings

      Administrators

      -

      Backup Operators

      Client Computer Effective Default Settings

      Administrators

      -

      Backup Operators

      -

      Users

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Administrators
      Backup Operators
      Server Operators
      Print Operators| +| Stand-Alone Server Default Settings | Administrators
      Backup Operators| +| Domain Controller Effective Default Settings | Administrators
      Backup Operators
      Server Operators
      Print Operators| +| Member Server Effective Default Settings | Administrators
      Backup Operators| +| Client Computer Effective Default Settings | Administrators
      Backup Operators
      Users|   ## Policy management + This section describes features, tools, and guidance to help you manage this policy. + A restart of the computer is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + This user right does not have the same effect as **Force shutdown from a remote system**. For more information, see [Force shutdown from a remote system](force-shutdown-from-a-remote-system.md). + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + The ability to shut down domain controllers should be limited to a very small number of trusted administrators. Although the **Shut down the system** user right requires the ability to log on to the server, you should be very careful about which accounts and groups you allow to shut down a domain controller. + When a domain controller is shut down, it is no longer available to process logon requests, process Group Policy settings, and answer Lightweight Directory Access Protocol (LDAP) queries. If you shut down domain controllers that possess operations master roles, you can disable key domain functionality, such as processing logon requests for new passwords, which is performed by the PDC master. + For other server roles, especially those where non-administrators have rights to log on to the server (such as RD Session Host servers), it is critical that this user right be removed from users that do not have a legitimate reason to restart the servers. + ### Countermeasure + Ensure that only the Administrators and Backup Operators groups are assigned the **Shut down the system** user right on member servers, and ensure that only the Administrators group is assigned the user right on domain controllers. + ### Potential impact + The impact of removing these default groups from the **Shut down the system** user right could limit the delegated abilities of assigned roles in your environment. You should confirm that delegated activities are not adversely affected. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md b/windows/keep-secure/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md index ad159693ce..a480adae03 100644 --- a/windows/keep-secure/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md +++ b/windows/keep-secure/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md @@ -2,87 +2,90 @@ title: Shutdown Allow system to be shut down without having to log on (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Shutdown Allow system to be shut down without having to log on security policy setting. ms.assetid: f3964767-5377-4416-8eb3-e14d553a7315 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Shutdown: Allow system to be shut down without having to log on + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **Shutdown: Allow system to be shut down without having to log on** security policy setting. + ## Reference + This policy setting determines whether a device can be shut down without having to log on to Windows. If you enable this policy setting, the **Shut Down** option is available on the logon screen in Windows. If you disable this policy setting, the **Shut Down** option is removed from the logon screen. This configuration requires that users are able to log on to the device successfully and that they have the **Shut down the system** user right before they can perform a shutdown. -Users who can access the console locally can shut down the system. Attackers or misguided users can connect to the server by using Remote Desktop Services, and then shut it down or restart it without having to identify themselves. A malicious user might also cause a temporary denial-of-service condition by walking up to the local console and restarting the server, or shutting down the server and thus rendering unavailable all its applications and services. + +Users who can access the console locally can shut down the system. Attackers or misguided users can connect to the server by using Remote Desktop Services, and then shut it down or restart it without having to identify themselves. A malicious user might also cause a temporary denial-of-service +condition by walking up to the local console and restarting the server, or shutting down the server and thus rendering unavailable all its applications and services. ### Possible values + - Enabled + The shut down command is available on the logon screen. + - Disabled + The shut down option is removed from the logon screen and users must have the **Shut down the system** user right before they can perform a shutdown. + - Not defined + ### Best practices + 1. On servers, set this policy to **Disabled**. You must log on to servers to shut them down or restart them. 2. On client devices, set this policy to **Enabled** and define the list of those with the right to shut them down or restart them with the User Rights Assignment policy **Shut down the system**. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Disabled

      DC Effective Default Settings

      Disabled

      Member Server Effective Default Settings

      Disabled

      Client Computer Effective Default Settings

      Enabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Enabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. + ### Group Policy + For info about the User Rights Assignment policy, **Shut down the system**, see [Shut down the system](shut-down-the-system.md). + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Users who can access the console locally could shut down the device + Attackers who have access to the local console could restart the server, which would cause a temporary DoS condition. Attackers could also shut down the server and leave all of its applications and services unavailable. + ### Countermeasure + Disable the **Shutdown: Allow system to be shut down without having to log on** setting. + ### Potential impact + You must log on to servers to shut them down or restart them. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/shutdown-clear-virtual-memory-pagefile.md b/windows/keep-secure/shutdown-clear-virtual-memory-pagefile.md index 042254e9c7..1e23676be3 100644 --- a/windows/keep-secure/shutdown-clear-virtual-memory-pagefile.md +++ b/windows/keep-secure/shutdown-clear-virtual-memory-pagefile.md @@ -2,85 +2,82 @@ title: Shutdown Clear virtual memory pagefile (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Shutdown Clear virtual memory pagefile security policy setting. ms.assetid: 31400078-6c56-4891-a6df-6dfb403c4bc9 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Shutdown: Clear virtual memory pagefile + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **Shutdown: Clear virtual memory pagefile** security policy setting. + ## Reference + This policy setting determines whether the virtual memory paging file is cleared when the device is shut down. Virtual memory support uses a system paging file to swap pages of memory to disk when they are not used. On a running device, this paging file is opened exclusively by the operating system, and it is well protected. However, devices that are configured to allow other operating systems to start should verify that the system paging file is cleared as the device shuts down. This confirmation ensures that sensitive information from process memory that might be placed in the paging file is not available to an unauthorized user who manages to directly access the paging file after shutdown. + Important information that is kept in real memory might be written periodically to the paging file. This helps devices handle multitasking functions. A malicious user who has physical access to a server that has been shut down can view the contents of the paging file. The attacker can move the system volume into a different computer and then analyze the contents of the paging file. This is a time-consuming process, but it can expose data that is cached from RAM to the paging file. A malicious user who has physical access to the server can bypass this countermeasure by simply unplugging the server from its power source. + ### Possible values + - Enabled + The system paging file is cleared when the system shuts down normally. Also, this policy setting forces the computer to clear the hibernation file (hiberfil.sys) when hibernation is disabled on a portable device. + - Disabled - Not defined + ### Best practices + - Set this policy to **Enabled**. This causes Windows to clear the paging file when the system is shut down. Depending on the size of the paging file, this process might take several minutes before the system completely shuts down. This delay in shutting down the server is especially noticeable on servers with large paging files. For a server with 2 gigabytes (GB) of RAM and a 2-GB paging file, this setting can add more than 30 minutes to the shutdown process. For some organizations, this downtime violates their internal service level agreements. Use caution when implementing this countermeasure in your environment. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Disabled

      DC Effective Default Settings

      Disabled

      Member Server Effective Default Settings

      Disabled

      Client Computer Effective Default Settings

      Disabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Important information that is kept in real memory may be written periodically to the paging file to help Windows handle multitasking functions. An attacker who has physical access to a server that has been shut down could view the contents of the paging file. The attacker could move the system volume into a different device and then analyze the contents of the paging file. Although this process is time consuming, it could expose data that is cached from random access memory (RAM) to the paging file. -**Caution**   -An attacker who has physical access to the device could bypass this countermeasure by unplugging the computer from its power source. + +>**Caution:**  An attacker who has physical access to the device could bypass this countermeasure by unplugging the computer from its power source.   ### Countermeasure + Enable the **Shutdown: Clear virtual memory page file** setting. This configuration causes the operating system to clear the paging file when the device is shut down. The amount of time that is required to complete this process depends on the size of the page file. Because the process overwrites the storage area that is used by the page file several times, it could be several minutes before the device completely shuts down. + ### Potential impact + It takes longer to shut down and restart the device, especially on devices with large paging files. For a device with 2 gigabytes (GB) of RAM and a 2-GB paging file, this policy setting could increase the shutdown process by more than 30 minutes. For some organizations this downtime violates their internal service level agreements. Therefore, use caution before you implement this countermeasure in your environment. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/store-passwords-using-reversible-encryption.md b/windows/keep-secure/store-passwords-using-reversible-encryption.md index 1d0ae2465b..386e132579 100644 --- a/windows/keep-secure/store-passwords-using-reversible-encryption.md +++ b/windows/keep-secure/store-passwords-using-reversible-encryption.md @@ -2,80 +2,71 @@ title: Store passwords using reversible encryption (Windows 10) description: Describes the best practices, location, values, and security considerations for the Store passwords using reversible encryption security policy setting. ms.assetid: 57f958c2-f1e9-48bf-871b-0a9b3299e238 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Store passwords using reversible encryption + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **Store passwords using reversible encryption** security policy setting. + ## Reference + The **Store password using reversible encryption** policy setting provides support for applications that use protocols that require the user's password for authentication. Storing encrypted passwords in a way that is reversible means that the encrypted passwords can be decrypted. A knowledgeable attacker who is able to break this encryption can then log on to network resources by using the compromised account. For this reason, never enable **Store password using reversible encryption** for all users in the domain unless application requirements outweigh the need to protect password information. -If you use the Challenge Handshake Authentication Protocol (CHAP) through remote access or Internet Authentication Services (IAS), you must enable this policy setting. CHAP is an authentication protocol that is used by remote access and network connections. Digest Authentication in Internet Information Services (IIS) also requires that you enable this policy setting. + +If you use the Challenge Handshake Authentication Protocol (CHAP) through remote access or Internet Authentication Services (IAS), you must enable this policy setting. CHAP is an authentication protocol that is used by remote access and network connections. Digest Authentication in Internet +Information Services (IIS) also requires that you enable this policy setting. + ### Possible values - Enabled - Disabled - Not defined + ### Best practices + Set the value for **Store password using reversible encryption** to Disabled. If you use CHAP through remote access or IAS, or Digest Authentication in IIS, you must set this value to **Enabled**. This presents a security risk when you apply the setting by using Group Policy on a user-by-user basis because it requires opening the appropriate user account object in Active Directory Users and Computers. -**Note**   -Do not enable this policy setting unless business requirements outweigh the need to protect password information. + +>**Note:**  Do not enable this policy setting unless business requirements outweigh the need to protect password information.   ### Location + **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy\\** + ### Default values + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or Group Policy Object (GPO)Default value

      Default domain policy

      Disabled

      Default domain controller policy

      Disabled

      Stand-alone server default settings

      Disabled

      Domain controller effective default settings

      Disabled

      Member server effective default settings

      Disabled

      Effective GPO default settings on client computers

      Disabled

      + +| Server type or Group Policy Object (GPO) | Default value | +| - | - | +| Default domain policy| Disabled| +| Default domain controller policy| Disabled| +| Stand-alone server default settings | Disabled| +| Domain controller effective default settings | Disabled| +| Member server effective default settings | Disabled| +| Effective GPO default settings on client computers | Disabled|   ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Enabling this policy setting allows the operating system to store passwords in a format that can weaken your overall security. + ### Countermeasure + Disable the **Store password using reversible encryption** policy setting. + ### Potential impact + If your organization uses CHAP through remote access or IAS, or Digest Authentication in IIS, you must configure this policy setting to Enabled. This presents a security risk when you apply the setting through Group Policy on a user-by-user basis because it requires the appropriate user account object to be opened in Active Directory Users and Computers. + ## Related topics -[Password Policy](password-policy.md) -  -  + +- [Password Policy](password-policy.md) diff --git a/windows/keep-secure/switch-pcr-banks-on-tpm-2-0-devices.md b/windows/keep-secure/switch-pcr-banks-on-tpm-2-0-devices.md index ea019eb343..dddb84f0a2 100644 --- a/windows/keep-secure/switch-pcr-banks-on-tpm-2-0-devices.md +++ b/windows/keep-secure/switch-pcr-banks-on-tpm-2-0-devices.md @@ -10,6 +10,7 @@ author: brianlic-msft --- # Switch PCR banks on TPM 2.0 devices + **Applies to** - Windows 10 diff --git a/windows/keep-secure/synchronize-directory-service-data.md b/windows/keep-secure/synchronize-directory-service-data.md index 4554452349..853573d001 100644 --- a/windows/keep-secure/synchronize-directory-service-data.md +++ b/windows/keep-secure/synchronize-directory-service-data.md @@ -2,88 +2,89 @@ title: Synchronize directory service data (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Synchronize directory service data security policy setting. ms.assetid: 97b0aaa4-674f-40f4-8974-b4bfb12c232c -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Synchronize directory service data + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Synchronize directory service data** security policy setting. + ## Reference + This policy setting determines which users and groups have authority to synchronize all directory service data, regardless of the protection for objects and properties. This privilege is required to use LDAP directory synchronization (dirsync) services. Domain controllers have this user right inherently because the synchronization process runs in the context of the **System** account on domain controllers. + Constant: SeSyncAgentPrivilege + ### Possible values + - User-defined list of accounts - Not defined + ### Best practices + - Ensure that no accounts are assigned the **Synchronize directory service data** user right. Only domain controllers need this privilege, which they inherently have. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default this setting is not defined on domain controllers and on stand-alone servers. + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Not defined

      Domain Controller Effective Default Settings

      Enabled

      Member Server Effective Default Settings

      Disabled

      Client Computer Effective Default Settings

      Disabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Not defined| +| Domain Controller Effective Default Settings | Enabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled|   ## Policy management + This section describes features, tools, and guidance to help you manage this policy. + A restart of the device is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + The **Synchronize directory service data** user right affects domain controllers (only domain controllers should be able to synchronize directory service data). Domain controllers have this user right inherently because the synchronization process runs in the context of the **System** account on domain controllers. Attackers who have this user right can view all information that is stored within the directory. They could then use some of that information to facilitate additional attacks or expose sensitive data, such as direct telephone numbers or physical addresses. + ### Countermeasure + Ensure that no accounts are assigned the **Synchronize directory service data** user right. + ### Potential impact + None. Not defined is the default configuration. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md b/windows/keep-secure/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md index 811570c873..c72f3b1385 100644 --- a/windows/keep-secure/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md +++ b/windows/keep-secure/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md @@ -2,82 +2,78 @@ title: System cryptography Force strong key protection for user keys stored on the computer (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the System cryptography Force strong key protection for user keys stored on the computer security policy setting. ms.assetid: 8cbff267-881e-4bf6-920d-b583a5ff7de0 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # System cryptography: Force strong key protection for user keys stored on the computer + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **System cryptography: Force strong key protection for user keys stored on the computer** security policy setting. + ## Reference + This policy setting determines whether users can use private keys, such as their Secure/Multipurpose Internet Mail Extensions (S/MIME) key, without a password. + Configuring this policy setting so that users must provide a password every time they use a key (in addition to their domain password) makes it more difficult for a malicious user to access locally-stored user keys, even if the attacker takes control of the user's device and determines their logon password. + ### Possible values + - **User input is not required when new keys are stored and used** - **User is prompted when the key is first used** - **User must enter a password each time they use a key** - Not defined + ### Best practices + - Set this policy to **User must enter a password each time they use a key**. Users must enter their password every time they access a key that is stored on their computer. For example, if users use an S/MIME certificate to digitally sign their email, they will be forced to enter the password for that certificate every time they send a signed email message. For some organizations, the overhead that is caused by using this value might be too high, but they should set the value at a minimum to **User is prompted when the key is first used**. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Not defined

      DC Effective Default Settings

      Not defined

      Member Server Effective Default Settings

      Not defined

      Client Computer Effective Default Settings

      Not defined

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Not defined| +| DC Effective Default Settings | Not defined| +| Member Server Effective Default Settings | Not defined| +| Client Computer Effective Default Settings| Not defined|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + If a user's account is compromised or the user's device is inadvertently left unsecured, the malicious user can use the keys that are stored for the user to access protected resources. + ### Countermeasure + Configure the **System cryptography: Force strong key protection for user keys stored on the computer** setting to **User must enter a password each time they use a key** so that users must provide a password that is distinct from their domain password every time they use a key. This configuration makes it more difficult for an attacker to access locally stored user keys, even if the attacker takes control of the user's computer and determines the logon password. + ### Potential impact + Users must type their password every time they access a key that is stored on their device. For example, if users use an S/MIME certificate to digitally sign their email, they are forced to type the password for that certificate every time they send a signed email message. For some organizations, the overhead that is involved by using this configuration may be too high. At a minimum, this setting should be set to **User is prompted when the key is first used**. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md b/windows/keep-secure/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md index b762727564..f7137a0c09 100644 --- a/windows/keep-secure/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md +++ b/windows/keep-secure/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md @@ -2,125 +2,112 @@ title: System cryptography Use FIPS compliant algorithms for encryption, hashing, and signing (Windows 10) description: This security policy reference topic for the IT professional describes the best practices, location, values, policy management and security considerations for this policy setting. ms.assetid: 83988865-dc0f-45eb-90d1-ee33495eb045 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing + **Applies to** - Windows 10 + This security policy reference topic for the IT professional describes the best practices, location, values, policy management and security considerations for this policy setting. + ## Reference -The Federal Information Processing Standard (FIPS) 140 is a security implementation that is designed for certifying cryptographic software. Windows implements these certified algorithms to meet the requirements and standards for cryptographic modules for use by departments and agencies of the United States federal government. + +The Federal Information Processing Standard (FIPS) 140 is a security implementation that is designed for certifying cryptographic software. Windows implements these certified algorithms to meet the requirements and standards for cryptographic modules for use by departments and agencies of the +United States federal government. + **TLS/SSL** -This policy setting determines whether the TLS/SSL security provider supports only the FIPS-compliant strong cipher suite known as TLS\_RSA\_WITH\_3DES\_EDE\_CBC\_SHA, which means that the provider only supports the TLS protocol as a client computer and as a server, if applicable. It uses only the Triple Data Encryption Standard (3DES) encryption algorithm for the TLS traffic encryption, only the Rivest-Shamir-Adleman (RSA) public key algorithm for the TLS key exchange and authentication, and only the Secure Hash Algorithm version 1 (SHA-1) hashing algorithm for the TLS hashing requirements. + +This policy setting determines whether the TLS/SSL security provider supports only the FIPS-compliant strong cipher suite known as TLS\_RSA\_WITH\_3DES\_EDE\_CBC\_SHA, which means that the provider only supports the TLS protocol as a client computer and as a server, if applicable. It uses only the +Triple Data Encryption Standard (3DES) encryption algorithm for the TLS traffic encryption, only the Rivest-Shamir-Adleman (RSA) public key algorithm for the TLS key exchange and authentication, and only the Secure Hash Algorithm version 1 (SHA-1) hashing algorithm for the TLS hashing requirements. + **Encrypting File System (EFS)** + For the EFS service, this policy setting supports the 3DES and Advanced Encryption Standard (AES) encryption algorithms for encrypting file data supported by the NTFS file system. To encrypt file data, by default EFS uses the Advanced Encryption Standard (AES) algorithm with a 256-bit key in the Windows Server 2003, Windows Vista, and later, and it uses a DESX algorithm in Windows XP. + **Remote Desktop Services (RDS)** + For encrypting Remote Desktop Services network communication, this policy setting supports only the Triple DES encryption algorithm. + **BitLocker** + For BitLocker, this policy setting needs to be enabled before any encryption key is generated. Recovery passwords created on Windows Server 2012 R2 and Windows 8.1 and later when this policy is enabled are incompatible with BitLocker on operating systems prior to Windows Server 2012 R2 and Windows 8.1; BitLocker will prevent the creation or use of recovery passwords on these systems, so recovery keys should be used instead. + ### Possible values + - Enabled - Disabled - Not defined + ### Best practices + - For use with TLS, set this policy to **Enabled**. Client devices with this policy setting enabled will be unable to communicate through digitally encrypted or signed protocols with servers that do not support these algorithms. Client devices that are connected to the network and do not support these algorithms cannot use servers that require the algorithms for network communications. If you enable this policy setting, you must also configure Internet Explorer to use TLS. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Disabled

      DC Effective Default Settings

      Disabled

      Member Server Effective Default Settings

      Disabled

      Client Computer Effective Default Settings

      Disabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled|   ### Operating system version differences + When this setting is enabled, the Encrypting File System (EFS) service supports only the Triple DES encryption algorithm for encrypting file data. By default, the Windows Vista and the Windows Server 2003 implementation of EFS uses the Advanced Encryption Standard (AES) with a 256-bit key. The Windows XP implementation uses DESX. + When this setting is enabled, BitLocker generates recovery password or recovery keys applicable to versions listed in the following: - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
      Operating systemsApplicability

      Windows 10, Windows 8.1, and Windows Server 2012 R2

      When created on these operating systems, the recovery password cannot be used on other systems listed in this table.

      Windows Server 2012 and Windows 8

      When created on these operating systems, the recovery key can be used on other systems listed in this table as well.

      Windows Server 2008 R2 and Windows 7

      When created on these operating systems, the recovery key can be used on other systems listed in this table as well.

      Windows Server 2008 and Windows Vista

      When created on these operating systems, the recovery key can be used on other systems listed in this table as well.

      + +| Operating systems | Applicability | +| - | - | +| Windows 10, Windows 8.1, and Windows Server 2012 R2| When created on these operating systems, the recovery password cannot be used on other systems listed in this table.| +| Windows Server 2012 and Windows 8 | When created on these operating systems, the recovery key can be used on other systems listed in this table as well.| +| Windows Server 2008 R2 and Windows 7 | When created on these operating systems, the recovery key can be used on other systems listed in this table as well.| +| Windows Server 2008 and Windows Vista | When created on these operating systems, the recovery key can be used on other systems listed in this table as well.|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Group Policy + Setting and deploying this policy using Group Policy takes precedence over the setting on the local device. If the Group Policy is set to **Not Configured**, local settings will apply. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + You can enable this policy setting to ensure that the device uses the most powerful algorithms that are available for digital encryption, hashing, and signing. Use of these algorithms minimize the risk of compromise of digitally encrypted or signed data by an unauthorized user. + ### Countermeasure + Enable the **System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing** setting. + ### Potential impact -Client devices that have this policy setting enabled cannot communicate by means of digitally encrypted or signed protocols with servers that do not support these algorithms. Network clients that do not support these algorithms cannot use servers that require them for network communications. For example, many Apache-based Web servers are not configured to support TLS. If you enable this setting, you must also configure Internet Explorer® to use TLS. This policy setting also affects the encryption level that is used for the Remote Desktop Protocol (RDP). The Remote Desktop Connection tool uses the RDP protocol to communicate with servers that run Terminal Services and client computers that are configured for remote control; RDP connections fail if both devices are not configured to use the same encryption algorithms. + +Client devices that have this policy setting enabled cannot communicate by means of digitally encrypted or signed protocols with servers that do not support these algorithms. Network clients that do not support these algorithms cannot use servers that require them for network communications. For example, many Apache-based Web servers are not configured to support TLS. If you enable this setting, you must also configure Internet Explorer® to use TLS. This policy setting also affects the encryption level that is used for the Remote Desktop Protocol (RDP). The Remote Desktop Connection tool +uses the RDP protocol to communicate with servers that run Terminal Services and client computers that are configured for remote control; RDP connections fail if both devices are not configured to use the same encryption algorithms. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/system-objects-require-case-insensitivity-for-non-windows-subsystems.md b/windows/keep-secure/system-objects-require-case-insensitivity-for-non-windows-subsystems.md index ed8f8e7cdb..6f9e3c9d43 100644 --- a/windows/keep-secure/system-objects-require-case-insensitivity-for-non-windows-subsystems.md +++ b/windows/keep-secure/system-objects-require-case-insensitivity-for-non-windows-subsystems.md @@ -2,83 +2,83 @@ title: System objects Require case insensitivity for non-Windows subsystems (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the System objects Require case insensitivity for non-Windows subsystems security policy setting. ms.assetid: 340d6769-8f33-4067-8470-1458978d1522 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # System objects: Require case insensitivity for non-Windows subsystems + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **System objects: Require case insensitivity for non-Windows subsystems** security policy setting. + ## Reference + This policy setting determines whether case insensitivity is enforced for all subsystems. The Microsoft Win32 subsystem is not case sensitive; however, the kernel supports case sensitivity for other subsystems, such as Portable Operating System Interface for UNIX (POSIX). Enabling this policy setting enforces case insensitivity for all directory objects, symbolic links, and input/output (I/O) objects, including file objects. Disabling this policy setting does not allow the Win32 subsystem to become case sensitive. + Because Windows is case insensitive but the POSIX subsystem will support case sensitivity, if this policy setting is not enforced, it is possible for a user of that subsystem to create a file with the same name as another file but with a different mix of capital letters. That might confuse users when they try to access these files by using normal Win32 tools, because only one of the files will be available. + ### Possible values + - Enabled + Case insensitivity is enforced for all directory objects, symbolic links, and IO objects, including file objects. + - Disabled + Will not allow the Win32 subsystem to become case sensitive. + - Not defined + ### Best practices + - Set this policy to **Enabled**. All subsystems will be forced to observe case insensitivity. However, this might confuse users who are familiar with one of the UNIX-based operating systems and are used to a case sensitive operating system. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Enabled

      DC Effective Default Settings

      Enabled

      Member Server Effective Default Settings

      Enabled

      Client Computer Effective Default Settings

      Enabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Enabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings| Enabled| +| Client Computer Effective Default Settings | Enabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Because Windows is case insensitive but the POSIX subsystem supports case sensitivity, failure to enable this policy setting makes it possible for a user of that subsystem to create a file with the same name as another file but with a different mix of uppercase and lowercase letters. Such a situation could potentially confuse users when they try to access such files from normal Win32 tools because only one of the files is available. + ### Countermeasure + Enable the **System objects: Require case insensitivity for non-Windows subsystems** setting. + ### Potential impact + All subsystems are forced to observe case insensitivity. This configuration may confuse users who are familiar with any UNIX-based operating systems that are case sensitive. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/system-objects-strengthen-default-permissions-of-internal-system-objects.md b/windows/keep-secure/system-objects-strengthen-default-permissions-of-internal-system-objects.md index 1aee1c46fa..708cba1b5a 100644 --- a/windows/keep-secure/system-objects-strengthen-default-permissions-of-internal-system-objects.md +++ b/windows/keep-secure/system-objects-strengthen-default-permissions-of-internal-system-objects.md @@ -2,80 +2,75 @@ title: System objects Strengthen default permissions of internal system objects (e.g. Symbolic Links) (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the System objects Strengthen default permissions of internal system objects (e.g. Symbolic Links) security policy setting. ms.assetid: 3a592097-9cf5-4fd0-a504-7cbfab050bb6 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links) + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)** security policy setting. + ## Reference + This policy setting determines the strength of the default discretionary access control list (DACL) for objects. Windows maintains a global list of shared system resources such as MS-DOS device names, mutexes, and semaphores. By using this list, processes can locate and share objects. Each type of object is created with a default DACL that specifies who can access the objects with what permissions. Enabling this policy setting strengthens the default DACL and allows users who are not administrators to read, but not to modify, shared objects that they did not create. + ### Possible values + - Enabled - Disabled - Not defined + ### Best practices + - It is advisable to set this policy to **Enabled**. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\ Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Enabled

      DC Effective Default Settings

      Enabled

      Member Server Effective Default Settings

      Enabled

      Client Computer Effective Default Settings

      Enabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Enabled | +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings| Enabled| +| Client Computer Effective Default Settings | Enabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + This policy setting is enabled by default to protect against a known vulnerability that can be used with hard links or symbolic links. Hard links are actual directory entries in the file system. With hard links, the same data in a file system can be referred to by different file names. Symbolic links are text files that provide a pointer to the file that is interpreted and followed by the operating system as a path to another file or directory. Because symbolic links are a separate file, they can exist independently of the target location. If a symbolic link is deleted, its target location remains unaffected. When this setting is disabled, it is possible for a malicious user to destroy a data file by creating a link that looks like a temporary file that the system automatically creates, such as a sequentially named log file, but it points to the data file that the malicious user wants to eradicate. When the system writes the files with that name, the data is overwritten. Enabling **System objects: Strengthen default permissions of internal system objects (e.g., Symbolic Links)** prevents an attacker from exploiting programs that create files with predictable names by not allowing them to write to objects that they did not create. + ### Countermeasure + Enable the **System objects: Strengthen default permissions of global system objects (for example, Symbolic Links)** setting. + ### Potential impact + None. This is the default configuration. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/system-settings-optional-subsystems.md b/windows/keep-secure/system-settings-optional-subsystems.md index 96633aece6..4e096fea50 100644 --- a/windows/keep-secure/system-settings-optional-subsystems.md +++ b/windows/keep-secure/system-settings-optional-subsystems.md @@ -2,81 +2,78 @@ title: System settings Optional subsystems (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the System settings Optional subsystems security policy setting. ms.assetid: 5cb6519a-4f84-4b45-8072-e2aa8a72fb78 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # System settings: Optional subsystems + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **System settings: Optional subsystems** security policy setting. + ## Reference + This policy setting determines which subsystems support your applications. You can use this security setting to specify as many subsystems as your environment demands. + The subsystem introduces a security risk that is related to processes that can potentially persist across logons. If a user starts a process and then logs out, the next user who logs on to the system might access the process that the previous user started. This is dangerous, because the process started by the first user can retain that user's system user rights; therefore, anything that the second user does using that process is performed with the user rights of the first user. This makes it difficult to trace who creates processes and objects, which is essential for post-security incident forensics. + ### Possible values + - User-defined list of subsystems - Not defined + ### Best practices + - Set this policy setting to a null value. The default value is **POSIX**, so applications that rely on the POSIX subsystem will no longer run. For example, Microsoft Services for UNIX 3.0 installs an updated version of the POSIX subsystem. Reset this policy setting in Group Policy for any servers that use Services for UNIX 3.0. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      POSIX

      DC Effective Default Settings

      POSIX

      Member Server Effective Default Settings

      POSIX

      Client Computer Effective Default Settings

      POSIX

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | POSIX| +| DC Effective Default Settings | POSIX| +| Member Server Effective Default Settings| POSIX| +| Client Computer Effective Default Settings | POSIX|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + The POSIX subsystem is an Institute of Electrical and Electronic Engineers (IEEE) standard that defines a set of operating system services. The POSIX subsystem is required if the server supports applications that use that subsystem. + The POSIX subsystem introduces a security risk that relates to processes that can potentially persist across logons. If a user starts a process and then logs out, there is a potential that the next user who logs on to the computer could access the previous user's process. This would allow the second user to take actions on the process by using the privileges of the first user. + ### Countermeasure + Configure the **System settings: Optional subsystems setting** to a null value. The default value is POSIX. + ### Potential impact + Applications that rely on the POSIX subsystem no longer operate. For example, Microsoft Services for UNIX (SFU) installs an updated version of the POSIX subsystem that is required, so you must reconfigure this setting in Group Policy for any servers that use SFU. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md b/windows/keep-secure/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md index ce05d099f5..85e0a1c7bd 100644 --- a/windows/keep-secure/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md +++ b/windows/keep-secure/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md @@ -2,80 +2,76 @@ title: System settings Use certificate rules on Windows executables for Software Restriction Policies (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the System settings Use certificate rules on Windows executables for Software Restriction Policies security policy setting. ms.assetid: 2380d93b-b553-4e56-a0c0-d1ef740d089c -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # System settings: Use certificate rules on Windows executables for Software Restriction Policies + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **System settings: Use certificate rules on Windows executables for Software Restriction Policies** security policy setting. + ## Reference + This policy setting determines whether digital certificates are processed when software restriction policies are enabled and a user or process attempts to run software with an .exe file name extension. This security setting enables or disables certificate rules (which are a type of software restriction policy). With a software restriction policy, you can create a certificate rule that allows or disallows Microsoft Authenticode®-signed software to run, based on the digital certificate that is associated with the software. For certificate rules to work in software restriction policies, you must enable this security setting. + ### Possible values + - Enabled - Disabled - Not defined + ### Best practices -- Set this policy to **Enabled**. Enabling certificate rules results in software restriction policies checking a certificate revocation list (CRL) to make sure that the software's certificate and signature are valid. When you start signed programs, this setting can decrease system performance. You can disable CRLs by editing the software restriction policies in the desired GPO. In the **Trusted Publishers Properties** dialog box, clear the **Publisher** and **Timestamp** check boxes. + +- Set this policy to **Enabled**. Enabling certificate rules results in software restriction policies checking a certificate revocation list (CRL) to make sure that the software's certificate and signature are valid. When you start signed programs, this setting can decrease system performance. +You can disable CRLs by editing the software restriction policies in the desired GPO. In the **Trusted Publishers Properties** dialog box, clear the **Publisher** and **Timestamp** check boxes. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Disabled

      DC Effective Default Settings

      Disabled

      Member Server Effective Default Settings

      Disabled

      Client Computer Effective Default Settings

      Disabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled | +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Without the use of software restriction policies, users and device might be exposed to unauthorized software that could include malware. + ### Countermeasure + Enable the **System settings: Use certificate rules on Windows executables for Software Restriction Policies** setting. + ### Potential impact + If you enable certificate rules, software restriction policies check a certificate revocation list (CRL) to verify that the software's certificate and signature are valid. This checking process may negatively affect performance when signed programs start. To disable this feature, you can edit the software restriction policies in the appropriate GPO. In the **Trusted Publishers Properties** dialog box, clear the **Publisher** and **Timestamp** check boxes. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) From 92d18aea5eadf76b18f3bfb3485b4126cd38f22e Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 25 May 2016 12:12:29 -0700 Subject: [PATCH 416/439] add it showcase link --- windows/manage/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/manage/index.md b/windows/manage/index.md index e6aff0c940..412bfc3d9b 100644 --- a/windows/manage/index.md +++ b/windows/manage/index.md @@ -74,4 +74,4 @@ Learn about managing and updating Windows 10. ## Related topics [Windows 10 and Windows 10 Mobile](../index.md)   -  + [Learn how Microsoft does IT at the IT Showcase](https://www.microsoft.com/itshowcase) From 657bac8dc6f466ca9171ced7ef66d49ad9a24098 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 25 May 2016 12:15:19 -0700 Subject: [PATCH 417/439] fixing spacing issues --- ...ake-ownership-of-files-or-other-objects.md | 94 +++++---- ...er-policy-by-using-test-applockerpolicy.md | 24 ++- .../test-and-update-an-applocker-policy.md | 26 ++- .../tools-to-use-with-applocker.md | 27 ++- windows/keep-secure/tpm-fundamentals.md | 190 ++++++++++-------- windows/keep-secure/tpm-recommendations.md | 56 +++++- ...bleshoot-windows-defender-in-windows-10.md | 21 +- .../trusted-platform-module-overview.md | 78 ++++--- 8 files changed, 320 insertions(+), 196 deletions(-) diff --git a/windows/keep-secure/take-ownership-of-files-or-other-objects.md b/windows/keep-secure/take-ownership-of-files-or-other-objects.md index 5274e1f278..255f2d4ff3 100644 --- a/windows/keep-secure/take-ownership-of-files-or-other-objects.md +++ b/windows/keep-secure/take-ownership-of-files-or-other-objects.md @@ -2,98 +2,106 @@ title: Take ownership of files or other objects (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Take ownership of files or other objects security policy setting. ms.assetid: cb8595d1-74cc-4176-bb15-d97663eebb2d -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Take ownership of files or other objects + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management, and security considerations for the **Take ownership of files or other objects** security policy setting. + ## Reference + This policy setting determines which users can take ownership of any securable object in the device, including Active Directory objects, NTFS files and folders, printers, registry keys, services, processes, and threads. + Every object has an owner, whether the object resides in an NTFS volume or Active Directory database. The owner controls how permissions are set on the object and to whom permissions are granted. + By default, the owner is the person who or the process which created the object. Owners can always change permissions to objects, even when they are denied all access to the object. + Constant: SeTakeOwnershipPrivilege + ### Possible values + - User-defined list of accounts - Not defined + ### Best practices + - Assigning this user right can be a security risk. Because owners of objects have full control of them, only assign this user right to trusted users. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment + ### Default values + By default this setting is Administrators on domain controllers and on stand-alone servers. + The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Administrators

      Stand-Alone Server Default Settings

      Administrators

      Domain Controller Effective Default Settings

      Administrators

      Member Server Effective Default Settings

      Administrators

      Client Computer Effective Default Settings

      Administrators

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Administrators| +| Stand-Alone Server Default Settings | Administrators| +| Domain Controller Effective Default Settings | Administrators| +| Member Server Effective Default Settings | Administrators| +| Client Computer Effective Default Settings | Administrators|   ## Policy management + This section describes features, tools, and guidance to help you manage this policy. + A restart of the device is not required for this policy setting to be effective. + Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. + Ownership can be taken by: + - An administrator. By default, the Administrators group is given the **Take ownership of files or other objects** user right. - Anyone or any group who has the **Take ownership** user right on the object. - A user who has the **Restore files and directories** user right. + Ownership can be transferred in the following ways: + - The current owner can grant the **Take ownership** user right to another user if that user is a member of a group defined in the current owner's access token. The user must take ownership to complete the transfer. - An administrator can take ownership. - A user who has the **Restore files and directories** user right can double-click **Other users and groups** and choose any user or group to assign ownership to. + ### Group Policy + Settings are applied in the following order through a Group Policy Object (GPO), which will overwrite settings on the local computer at the next Group Policy update: + 1. Local policy settings 2. Site policy settings 3. Domain policy settings 4. OU policy settings + When a local setting is greyed out, it indicates that a GPO currently controls that setting. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability -Any users with the **Take ownership of files or other objects user right** can take control of any object, regardless of the permissions on that object, and then make any changes that they want to make to that object. Such changes could result in exposure of data, corruption of data, or a denial-of-service condition. + +Any users with the **Take ownership of files or other objects user right** can take control of any object, regardless of the permissions on that object, and then make any changes that they want to make to that object. Such changes could result in exposure of data, corruption of data, or a +denial-of-service condition. + ### Countermeasure + Ensure that only the local Administrators group has the **Take ownership of files or other objects** user right. + ### Potential impact + None. Restricting the **Take ownership of files or other objects** user right to the local Administrators group is the default configuration. + ## Related topics -[User Rights Assignment](user-rights-assignment.md) -  -  + +- [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/keep-secure/test-an-applocker-policy-by-using-test-applockerpolicy.md b/windows/keep-secure/test-an-applocker-policy-by-using-test-applockerpolicy.md index 09ccf98b7d..aa27d42260 100644 --- a/windows/keep-secure/test-an-applocker-policy-by-using-test-applockerpolicy.md +++ b/windows/keep-secure/test-an-applocker-policy-by-using-test-applockerpolicy.md @@ -2,28 +2,42 @@ title: Test an AppLocker policy by using Test-AppLockerPolicy (Windows 10) description: This topic for IT professionals describes the steps to test an AppLocker policy prior to importing it into a Group Policy Object (GPO) or another computer. ms.assetid: 048bfa38-6825-4a9a-ab20-776cf79f402a -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Test an AppLocker policy by using Test-AppLockerPolicy + **Applies to** - Windows 10 + This topic for IT professionals describes the steps to test an AppLocker policy prior to importing it into a Group Policy Object (GPO) or another computer. + The **Test-AppLockerPolicy** Windows PowerShell cmdlet can be used to determine whether any of the rules in your rule collections will be blocked on your reference computer or the computer on which you maintain policies. Perform the following steps on any computer where the AppLocker policies are applied. + Any user account can be used to complete this procedure. + **To test an AppLocker policy by using Test-AppLockerPolicy** + 1. Export the effective AppLocker policy. To do this, you must use the **Get-AppLockerPolicy** Windows PowerShell cmdlet. + 1. Open a Windows PowerShell command prompt window as an administrator. 2. Use the **Get-AppLockerPolicy** cmdlet to export the effective AppLocker policy to an XML file: + `Get-AppLockerPolicy –Effective –XML > ` + 2. Use the **Get-ChildItem** cmdlet to specify the directory that you want to test, specify the **Test-AppLockerPolicy** cmdlet with the XML file from the previous step to test the policy, and use the **Export-CSV** cmdlet to export the results to a file to be analyzed: + `Get-ChildItem -Filter -Recurse | Convert-Path | Test-AppLockerPolicy –XMLPolicy -User -Filter | Export-CSV ` + The following shows example input for **Test-AppLockerPolicy**: -`PS C:\ Get-AppLockerPolicy –Effective –XML > C:\Effective.xml` -`PS C:\ Get-ChildItem 'C:\Program Files\Microsoft Office\' –filter *.exe –Recurse | Convert-Path | Test-AppLockerPolicy –XMLPolicy C:\Effective.xml –User contoso\zwie –Filter Denied,DeniedByDefault | Export-CSV C:\BlockedFiles.csv` + +```syntax +PS C:\ Get-AppLockerPolicy –Effective –XML > C:\Effective.xml +PS C:\ Get-ChildItem 'C:\Program Files\Microsoft Office\' –filter *.exe –Recurse | Convert-Path | Test-AppLockerPolicy –XMLPolicy C:\Effective.xml –User contoso\zwie –Filter Denied,DeniedByDefault | Export-CSV C:\BlockedFiles.csv +``` + In the example, the effective AppLocker policy is exported to the file C:\\Effective.xml. The **Get-ChildItem** cmdlet is used to recursively gather path names for the .exe files in C:\\Program Files\\Microsoft Office\\. The XMLPolicy parameter specifies that the C:\\Effective.xml file is an XML AppLocker policy file. By specifying the User parameter, you can test the rules for specific users, and the **Export-CSV** cmdlet allows the results to be exported to a comma-separated file. In the example, `-FilterDenied,DeniedByDefault` displays only those files that will be blocked for the user under the policy. -  -  diff --git a/windows/keep-secure/test-and-update-an-applocker-policy.md b/windows/keep-secure/test-and-update-an-applocker-policy.md index 4ae1a87af2..cf77664f65 100644 --- a/windows/keep-secure/test-and-update-an-applocker-policy.md +++ b/windows/keep-secure/test-and-update-an-applocker-policy.md @@ -2,37 +2,61 @@ title: Test and update an AppLocker policy (Windows 10) description: This topic discusses the steps required to test an AppLocker policy prior to deployment. ms.assetid: 7d53cbef-078c-4d20-8b00-e821e33b6ea1 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Test and update an AppLocker policy + **Applies to** - Windows 10 + This topic discusses the steps required to test an AppLocker policy prior to deployment. + You should test each set of rules to ensure that the rules perform as intended. If you use Group Policy to manage AppLocker policies, complete the following steps for each Group Policy Object (GPO) where you have created AppLocker rules. Because AppLocker rules are inherited from linked GPOs, you should deploy all of the rules for simultaneous testing in all of your test GPOs. + ## Step 1: Enable the Audit only enforcement setting + By using the **Audit only** enforcement setting, you can ensure that the AppLocker rules that you have created are properly configured for your organization. This setting can be enabled on the **Enforcement** tab of the **AppLocker Properties** dialog box. For the procedure to do this, see [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md). + ## Step 2: Configure the Application Identity service to start automatically + Because AppLocker uses the Application Identity service to verify the attributes of a file, you must configure it to start automatically in any one GPO that applies AppLocker rules. For the procedure to do this, see [Configure the Application Identity Service](configure-the-application-identity-service.md). For AppLocker policies that are not managed by a GPO, you must ensure that the service is running on each PC in order for the policies to be applied. + ## Step 3: Test the policy + Test the AppLocker policy to determine if your rule collection needs to be modified. Because you have created AppLocker rules, enabled the Application Identity service, and enabled the **Audit only** enforcement setting, the AppLocker policy should be present on all client PC that are configured to receive your AppLocker policy. + The **Test-AppLockerPolicy** Windows PowerShell cmdlet can be used to determine whether any of the rules in your rule collection will be blocked on your reference PCs. For the procedure to do this, see [Test an AppLocker policy by using Test-AppLockerPolicy](test-an-applocker-policy-by-using-test-applockerpolicy.md). + ## Step 4: Analyze AppLocker events You can either manually analyze AppLocker events or use the **Get-AppLockerFileInformation** Windows PowerShell cmdlet to automate the analysis. + **To manually analyze AppLocker events** + You can view the events either in Event Viewer or a text editor and then sort those events to perform an analysis, such as looking for patterns in application usage events, access frequencies, or access by user groups. If you have not configured an event subscription, then you will have to review the logs on a sampling of computers in your organization. For more information about using Event Viewer, see [Monitor application usage with AppLocker](monitor-application-usage-with-applocker.md). + **To analyze AppLocker events by using Get-AppLockerFileInformation** + You can use the **Get-AppLockerFileInformation** Windows PowerShell cmdlet to analyze AppLocker events from a remote computer. If an app is being blocked and should be allowed, you can use the AppLocker cmdlets to help troubleshoot the problem. + For both event subscriptions and local events, you can use the **Get-AppLockerFileInformation** cmdlet to determine which files have been blocked or would have been blocked (if you are using the **Audit only** enforcement mode) and how many times the event has occurred for each file. For the procedure to do this, see [Monitor Application Usage with AppLocker](monitor-application-usage-with-applocker.md). + After using **Get-AppLockerFileInformation** to determine how many times that a file would have been blocked from running, you should review your rule list to determine whether a new rule should be created for the blocked file or whether an existing rule is too strictly defined. Ensure that you check which GPO is currently preventing the file from running. To determine this, you can use the Group Policy Results Wizard to view rule names. + ## Step 5: Modify the AppLocker policy + After you have identified which rules need to be edited or added to the policy, you can use the Group Policy Management Console to modify the AppLocker rules in the relevant GPOs. For AppLocker policies that are not managed by a GPO, you can use the Local Security Policy snap-in (secpol.msc). For info how to modify an AppLocker policy, see, [Edit an AppLocker policy](edit-an-applocker-policy.md). + ## Step 6: Repeat policy testing, analysis, and policy modification + Repeat the previous steps 3–5 until all the rules perform as intended before applying enforcement. + ## Additional resources + - For steps to perform other AppLocker policy tasks, see [Administer AppLocker](administer-applocker.md).     diff --git a/windows/keep-secure/tools-to-use-with-applocker.md b/windows/keep-secure/tools-to-use-with-applocker.md index ed1080877e..d0ffd99ac7 100644 --- a/windows/keep-secure/tools-to-use-with-applocker.md +++ b/windows/keep-secure/tools-to-use-with-applocker.md @@ -2,33 +2,52 @@ title: Tools to use with AppLocker (Windows 10) description: This topic for the IT professional describes the tools available to create and administer AppLocker policies. ms.assetid: db2b7cb3-7643-4be5-84eb-46ba551e1ad1 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Tools to use with AppLocker + **Applies to** - Windows 10 + This topic for the IT professional describes the tools available to create and administer AppLocker policies. + The following tools can help you administer the application control policies created by using AppLocker on the local device or by using Group Policy. For info about the basic requirements for using AppLocker, see [Requirements to use AppLocker](requirements-to-use-applocker.md). + - **AppLocker Local Security Policy MMC snap-in** + The AppLocker rules can be maintained by using the Local Security Policy snap-in (secpol.msc) of the Microsoft Management Console (MMC). For procedures to create, modify, and delete AppLocker rules, see [Working with AppLocker rules](working-with-applocker-rules.md). + - **Generate Default Rules tool** + AppLocker includes default rules for each rule collection accessed through the Local Security Policy snap-in. These rules are intended to help ensure that the files that are required for Windows to operate properly are allowed in an AppLocker rule collection. For info about how to use this tool, see [Create AppLocker default rules](create-applocker-default-rules.md). + - **Automatically Generate AppLocker Rules wizard** + By using the Local Security Policy snap-in, you can automatically generate rules for all files within a folder. The wizard will scan the specified folder and create the condition types that you choose for each file in that folder. For info about how to use this wizard, see [Run the Automatically Generate Rules wizard](run-the-automatically-generate-rules-wizard.md). + - **Group Policy** + You can edit an AppLocker policy by adding, changing, or removing rules by using the Group Policy Management Console (GPMC). + If you want additional features to manage AppLocker policies, such as version control, use Group Policy management software that allows you to create versions of Group Policy Objects (GPOs). An example of this type of software is the Advanced Group Policy Management feature from the Microsoft Desktop Optimization Pack. + - **Remote Server Administration Tools (RSAT)** + You can use a device with a supported operating system that has the Remote Server Administration Tools (RSAT) installed to create and maintain AppLocker policies. + - **Event Viewer** + The AppLocker log contains information about applications that are affected by AppLocker rules. For info about using Event Viewer to review the AppLocker logs, see [Using Event Viewer with AppLocker](using-event-viewer-with-applocker.md), and [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md). + - **AppLocker PowerShell cmdlets** + The AppLocker Windows PowerShell cmdlets are designed to streamline the administration of AppLocker policy. They can be used to help create, test, maintain, and troubleshoot an AppLocker policy. The cmdlets are intended to be used in conjunction with the AppLocker user interface that is accessed through the Local Security Policy snap-in and the GPMC. For information about the cmdlets, see the [AppLocker PowerShell Command Reference](http://technet.microsoft.com/library/hh847210.aspx). + ## Related topics -[AppLocker technical reference](applocker-technical-reference.md) -  -  + +- [AppLocker technical reference](applocker-technical-reference.md) diff --git a/windows/keep-secure/tpm-fundamentals.md b/windows/keep-secure/tpm-fundamentals.md index 26e6b4403e..c4fb6b2cc3 100644 --- a/windows/keep-secure/tpm-fundamentals.md +++ b/windows/keep-secure/tpm-fundamentals.md @@ -2,23 +2,34 @@ title: TPM fundamentals (Windows 10) description: This topic for the IT professional provides a description of the components of the Trusted Platform Module (TPM 1.2 and TPM 2.0) and explains how they are used to mitigate dictionary attacks. ms.assetid: ac90f5f9-9a15-4e87-b00d-4adcf2ec3000 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # TPM fundamentals + **Applies to** - Windows 10 + This topic for the IT professional provides a description of the components of the Trusted Platform Module (TPM 1.2 and TPM 2.0) and explains how they are used to mitigate dictionary attacks. + A Trusted Platform Module (TPM) is a microchip designed to provide basic security-related functions, primarily involving encryption keys. The TPM is usually installed on the motherboard of a computer, and it communicates with the remainder of the system by using a hardware bus. + Computers that incorporate a TPM can create cryptographic keys and encrypt them so that they can only be decrypted by the TPM. This process, often called wrapping or binding a key, can help protect the key from disclosure. Each TPM has a master wrapping key, called the storage root key, which is stored within the TPM itself. The private portion of a storage root key or endorsement key that is created in a TPM is never exposed to any other component, software, process, or user. + You can specify whether encryption keys that are created by the TPM can be migrated or not. If you specify that they can be migrated, the public and private portions of the key can be exposed to other components, software, processes, or users. If you specify that encryption keys cannot be migrated, the private portion of the key is never exposed outside the TPM. + Computers that incorporate a TPM can also create a key that has not only been wrapped, but is also tied to certain platform measurements. This type of key can be unwrapped only when those platform measurements have the same values that they had when the key was created. This process is referred to as “sealing the key to the TPM.” Decrypting the key is called unsealing. The TPM can also seal and unseal data that is generated outside the TPM. With this sealed key and software, such as BitLocker Drive Encryption, you can lock data until specific hardware or software conditions are met. + With a TPM, private portions of key pairs are kept separate from the memory that is controlled by the operating system. Keys can be sealed to the TPM, and certain assurances about the state of a system (assurances that define the trustworthiness of a system) can be made before the keys are unsealed and released for use. Because the TPM uses its own internal firmware and logic circuits to process instructions, it does not rely on the operating system, and it is not exposed to vulnerabilities that might exist in the operating system or application software. + For info about which versions of Windows support which versions of the TPM, see [Trusted Platform Module technology overview](trusted-platform-module-overview.md). The features that are available in the versions are defined in specifications by the Trusted Computing Group (TCG). For more info, see the Trusted Platform Module page on the Trusted Computing Group website: [Trusted Platform Module](http://www.trustedcomputinggroup.org/developers/trusted_platform_module). + The following sections provide an overview of the technologies that support the TPM: + - [TPM-based Virtual Smart Card](#bkmk-vsc) - [Measured Boot with support for attestation](#bkmk-measuredboot) - [Automated provisioning and management of the TPM](#bkmk-autoprov) @@ -32,156 +43,157 @@ The following sections provide an overview of the technologies that support the - [How the TPM mitigates dictionary attacks](#bkmk-howtpmmitigates) - [How do I check the state of my TPM?](#bkmk-checkstate) - [What can I do if my TPM is in reduced functionality mode?](#bkmk-fixrfm) + The following topic describes the TPM Services that can be controlled centrally by using Group Policy settings: [Trusted Platform Module Services Group Policy Settings](trusted-platform-module-services-group-policy-settings.md) + ## Automated provisioning and management of the TPM + TPM provisioning can be streamlined to make it easier to deploy systems that are ready for BitLocker and other TPM-dependent features. These enhancements include simplifying the TPM state model to report **Ready**, **Ready with reduced functionality**, or **Not ready**. You can also automatically provision TPMs in the **Ready** state, remote provisioning to remove the requirement for the physical presence of a technician for the initial deployment. In addition, the TPM stack is available in the Windows Preinstallation Environment (Windows PE). + A number of management settings have been added for easier management and configuration of the TPM through Group Policy. The primary new settings include Active Directory-based backup of TPM owner authentication, the level of owner authentication that should be stored locally on the TPM, and the software-based TPM lockout settings for standard users. For more info about backing up owner authentication to Windows Server 2008 R2 AD DS domains, see [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md). + ## Measured Boot with support for attestation + The Measured Boot feature provides antimalware software with a trusted (resistant to spoofing and tampering) log of all boot components. Antimalware software can use the log to determine whether components that ran before it are trustworthy versus infected with malware. It can also send the Measured Boot logs to a remote server for evaluation. The remote server can initiate remediation actions by interacting with software on the client or through out-of-band mechanisms, as appropriate. + ## TPM-based Virtual Smart Card -The Virtual Smart Card emulates the functionality of traditional smart cards, but Virtual Smart Cards use the TPM chip that is available on an organization’s computers, rather than requiring the use of a separate physical smart card and reader. This greatly reduces the management and deployment cost of smart cards in an enterprise. To the end user, the Virtual Smart Card is always available on the computer. If a user needs to use more than one computer, a Virtual Smart Card must be issued to the user for each computer. A computer that is shared among multiple users can host multiple Virtual Smart Cards, one for each user. + +The Virtual Smart Card emulates the functionality of traditional smart cards, but Virtual Smart Cards use the TPM chip that is available on an organization’s computers, rather than requiring the use of a separate physical smart card and reader. This greatly reduces the management and deployment cost of smart cards in an enterprise. To the end user, the Virtual Smart Card is always available on the computer. If a user needs to use more than one computer, a +Virtual Smart Card must be issued to the user for each computer. A computer that is shared among multiple users can host multiple Virtual Smart Cards, one for each user. + ## TPM-based certificate storage + The TPM can be used to protect certificates and RSA keys. The TPM key storage provider (KSP) provides easy, convenient use of the TPM as a way of strongly protecting private keys. The TPM KSP can be used to generate keys when an organization enrolls for certificates, and the KSP is managed by templates in the UI. The TPM can also be used to protect certificates that are imported from an outside source. TPM-based certificates can be used exactly as standard certificates with the added functionality that the certificate can never leave the TPM from which the keys were generated. The TPM can now be used for crypto-operations through Cryptography API: Next Generation (CNG). For more info, see [Cryptography API: Next Generation](http://msdn.microsoft.com/library/windows/desktop/aa376210.aspx). + ## TPM Owner Authorization Value -For Windows 8 a change to how the TPM owner authorization value is stored in AD DS was implemented in the AD DS schema. The TPM owner authorization value is now stored in a separate object which is linked to the Computer object. This value was stored as a property in the Computer object itself for the default Windows Server 2008 R2 schemas. Windows Server 2012 domain controllers have the default schema to backup TPM owner authorization information in the separate object. If you are not upgrading your domain controller to Windows Server 2012 you need to extend the schema to support this change. If Active Directory backup of the TPM owner authorization value is enabled in a Windows Server 2008 R2 environment without extending the schema, the TPM provisioning will fail and the TPM will remain in a Not Ready state for computers running Windows 8. + +For Windows 8 a change to how the TPM owner authorization value is stored in AD DS was implemented in the AD DS schema. The TPM owner authorization value is now stored in a separate object which is linked to the Computer object. +This value was stored as a property in the Computer object itself for the default Windows Server 2008 R2 schemas. Windows Server 2012 domain controllers have the default schema to backup TPM owner authorization information in the separate object. If you are not upgrading your domain controller to Windows Server 2012 you need to extend the schema to support this change. If Active Directory backup of the TPM owner authorization value is enabled in a Windows Server 2008 R2 environment without extending the schema, the TPM provisioning will fail and the TPM will remain in a Not Ready state for computers running Windows 8. + If your computer is not being joined to a domain the TPM owner authorization value will be stored in the local computer registry. Using BitLocker to encrypt the operating system drive will protect the owner authorization value from being disclosed when the computer is at rest, but there is a risk that a malicious user could obtain the TPM owner authorization value when the computer is unlocked. Therefore, we recommend that in this situation you configure your computer to automatically lock after 30 seconds of inactivity. If automatic locking is not used, then you should consider removing full owner authorization from the computer registry. + **Registry information** + Registry key: HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\TPM DWORD: OSManagedAuthLevel - ---- - - - - - - - - - - - - - - - - - - - - -
      Value DataSetting

      0

      None

      2

      Delegated

      4

      Full

      + +| Value Data | Setting | +| - | - | +| 0 | None| +| 2 | Delegated| +| 4 | Full|   -**Note**   -If the operating system managed TPM authentication setting is changed from "Full" to "Delegated" the full TPM owner authorization value will be regenerated and any copies of the original TPM owner authorization value will be invalid. If you are backing up the TPM owner authorization value to AD DS, the new owner authorization value will be automatically backed up to AD DS when it is changed. +>**Note:**  If the operating system managed TPM authentication setting is changed from "Full" to "Delegated" the full TPM owner authorization value will be regenerated and any copies of the original TPM owner authorization value will be invalid. If you are backing up the TPM owner authorization value to AD DS, the new owner authorization value will be automatically backed up to AD DS when it is changed.   ## TPM Cmdlets + If you are using PowerShell to script and manage your computers, you can now manage the TPM using Windows PowerShell as well. To install the TPM cmdlets use the following command: -**dism /online /enable-feature /FeatureName:tpm-psh-cmdlets** + +`dism /online /enable-feature /FeatureName:tpm-psh-cmdlets` For details about the individual cmdlets, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx) + ## Physical presence interface -The TCG specifications for TPMs require physical presence to perform some TPM administrative functions, such as turning on and turning off the TPM. Physical presence means a person must physically interact with the system and the TPM interface to confirm or reject changes to TPM status. This typically cannot be automated with scripts or other automation tools unless the individual OEM supplies them. Here are some are examples of TPM administrative tasks that require physical presence: + +The TCG specifications for TPMs require physical presence to perform some TPM administrative functions, such as turning on and turning off the TPM. Physical presence means a person must physically interact with the system and the +TPM interface to confirm or reject changes to TPM status. This typically cannot be automated with scripts or other automation tools unless the individual OEM supplies them. Here are some are examples of TPM administrative tasks that require physical presence: + - Activating the TPM - Clearing the existing owner information from the TPM without the owner’s password - Deactivating the TPM - Disabling the TPM temporarily without the owner’s password + ## States of existence in a TPM + For each of these TPM 1.2 states of existence, the TPM can transition into another state (for example, moving from disabled to enabled). The states are not exclusive. + These states of existence do not apply for Trusted Platform Module 2.0 because it cannot be turned off from within the operating system environment. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      StateDescription

      Enabled

      Most features of the TPM are available.

      -

      The TPM can be enabled and disabled multiple times within a boot period, if ownership is taken.

      Disabled

      The TPM restricts most operations. Exceptions include the ability to report TPM capabilities, extend and reset Platform Configuration Register (PCR) functions, and perform hashing and basic initialization.

      -

      The TPM can be enabled and disabled multiple times within a start-up period.

      Activated

      Most features of the TPM are available. The TPM can be activated and deactivated only through physical presence, which requires a restart.

      Deactivated

      Similar to the disabled state, with the exception that ownership can be taken when the TPM is deactivated and enabled. The TPM can be activated and deactivated only through physical presence, which requires a restart.

      Owned

      Most features of the TPM are available. The TPM has an endorsement key and storage root key, and the owner knows information about owner authorization data.

      Unowned

      The TPM does not have a storage root key, and it may or may not have an endorsement key.

      + +| State | Description | +| - | - | +| Enabled| Most features of the TPM are available.
      The TPM can be enabled and disabled multiple times within a boot period, if ownership is taken.| +| Disabled| The TPM restricts most operations. Exceptions include the ability to report TPM capabilities, extend and reset Platform Configuration Register (PCR) functions, and perform hashing and basic initialization.
      The TPM can be enabled and disabled multiple times within a start-up period. | +| Activated| Most features of the TPM are available. The TPM can be activated and deactivated only through physical presence, which requires a restart.| +| Deactivated| Similar to the disabled state, with the exception that ownership can be taken when the TPM is deactivated and enabled. The TPM can be activated and deactivated only through physical presence, which requires a restart.| +| Owned| Most features of the TPM are available. The TPM has an endorsement key and storage root key, and the owner knows information about owner authorization data.| +| Unowned| The TPM does not have a storage root key, and it may or may not have an endorsement key.|   -**Important**   -Applications cannot use the TPM until the state is enabled, activated, and owned. All operations are available only when the TPM is in this state. +>**Important:**  Applications cannot use the TPM until the state is enabled, activated, and owned. All operations are available only when the TPM is in this state.   The state of the TPM exists independently of the computer’s operating system. When the TPM is enabled, activated, and owned, the state of the TPM is preserved if the operating system is reinstalled. + ## Endorsement keys -For a TPM to be usable by a trusted application, it must contain an endorsement key, which is an RSA key pair. The private half of the key pair is held inside the TPM, and it is never revealed or accessible outside the TPM. If the TPM does not contain an endorsement key, the application might cause the TPM to generate one automatically as part of the setup. + +For a TPM to be usable by a trusted application, it must contain an endorsement key, which is an RSA key pair. The private half of the key pair is held inside the TPM, and it is never revealed or accessible outside the TPM. If the +TPM does not contain an endorsement key, the application might cause the TPM to generate one automatically as part of the setup. An endorsement key can be created at various points in the TPM’s lifecycle, but it needs to be created only once for the lifetime of the TPM. The existence of an endorsement key is a requirement before TPM ownership can be taken. + ## Key attestation + TPM key attestation allows a certification authority to verify that a private key is actually protected by a TPM and that the TPM is one that the certification authority trusts. Endorsement keys which have been proven valid can be used to bind the user identity to a device. Moreover, the user certificate with a TPM attested key provides higher security assurance backed up by the non-exportability, anti-hammering, and isolation of keys provided by a TPM. + ## How the TPM mitigates dictionary attacks + When a TPM processes a command, it does so in a protected environment, for example, a dedicated microcontroller on a discrete chip or a special hardware-protected mode on the main CPU. A TPM can be used to create a cryptographic key that is not disclosed outside the TPM, but is able to be used in the TPM after the correct authorization value is provided. + TPMs have dictionary attack logic that is designed to prevent brute force attacks that attempt to determine authorization values for using a key. The basic approach is for the TPM to allow only a limited number of authorization failures before it prevents more attempts to use keys and locks. Providing a failure count for individual keys is not technically practical, so TPMs have a global lockout when too many authorization failures occur. + Because many entities can use the TPM, a single authorization success cannot reset the TPM’s dictionary attack logic. This prevents an attacker from creating a key with a known authorization value and then using it to reset the TPM’s dictionary attack logic. Generally TPMs are designed to forget about authorization failures after a period of time so the TPM does not enter a lockout state unnecessarily. A TPM owner password can be used to reset the TPM’s lockout logic. + ### TPM 2.0 dictionary attack behavior + TPM 2.0 has well defined dictionary attack logic behavior. This is in contrast to TPM 1.2 for which the dictionary attack logic was set by the manufacturer, and the logic varied widely throughout the industry. -**Warning**   -For the purposes of this topic, Windows 8 Certified Hardware also pertains to Windows 8.1 systems. The following references to “Windows” include these supported Windows versions. + +>**Warning:**  For the purposes of this topic, Windows 8 Certified Hardware also pertains to Windows 8.1 systems. The following references to “Windows” include these supported Windows versions.   For Windows 8 Certified Hardware systems with TPM 2.0, the TPM is configured by Windows to lock after 32 authorization failures and to forget one authorization failure every two hours. This means that a user could quickly attempt to use a key with the wrong authorization value 32 times. For each of the 32 attempts, the TPM records if the authorization value was correct or not. This inadvertently causes the TPM to enter a locked state after 32 failed attempts. + Attempts to use a key with an authorization value for the next two hours would not return success or failure; instead the response indicates that the TPM is locked. After two hours, one authorization failure is forgotten and the number of authorization failures remembered by the TPM drops to 31, so the TPM leaves the locked state and returns to normal operation. With the correct authorization value, keys could be used normally if no authorization failures occur during the next two hours. If a period of 64 hours elapses with no authorization failures, the TPM does not remember any authorization failures, and 32 failed attempts could occur again. + Windows 8 Certification does not require TPM 2.0 systems to forget about authorization failures when the system is fully powered off or when the system has hibernated. Windows does require that authorization failures are forgotten when the system is running normally, in a sleep mode, or in low power states other than off. If a Windows system with TPM 2.0 is locked, the TPM leaves lockout mode if the system is left on for two hours. + The dictionary attack logic for TPM 2.0 can be fully reset immediately by sending a reset lockout command to the TPM and providing the TPM owner password. By default, Windows automatically provisions TPM 2.0 and stores the TPM owner password for use by system administrators. + In some enterprise situations, the TPM owner authorization value is configured to be stored centrally in Active Directory, and it is not stored on the local system. An administrator can launch the TPM MMC and choose to reset the TPM lockout time. If the TPM owner password is stored locally, it is used to reset the lockout time. If the TPM owner password is not available on the local system, the administrator needs to provide it. If an administrator attempts to reset the TPM lockout state with the wrong TPM owner password, the TPM does not allow another attempt to reset the lockout state for 24 hours. + TPM 2.0 allows some keys to be created without an authorization value associated with them. These keys can be used when the TPM is locked. For example, BitLocker with a default TPM-only configuration is able to use a key in the TPM to start Windows, even when the TPM is locked. + ### Rationale behind the Windows 8.1 and Windows 8 defaults + Windows relies on the TPM 2.0 dictionary attack protection for multiple features. The defaults that are selected for Windows 8 balance trade-offs for different scenarios. For example, when BitLocker is used with a TPM plus PIN configuration, it needs the number of PIN guesses to be limited over time. If the computer is lost, someone could make only 32 PIN guesses immediately, and then only one more guess every two hours. This totals about 4415 guesses per year. This makes a good standard for system administrators to determine how many PIN characters to use for BitLocker deployments. + The Windows TPM-based smart card, which is a virtual smart card, can be configured to allow sign in to the system. In contrast with physical smart cards, the sign-in process uses a TPM-based key with an authorization value. The following list shows the advantages of virtual smart cards: + Physical smart cards can enforce lockout for only the physical smart card PIN, and they can reset the lockout after the correct PIN is entered. With a virtual smart card, the TPM’s dictionary attack is not reset after a successful authentication. The allowed number of authorization failures before the TPM enters lockout includes many factors. + Hardware manufacturers and software developers have the option to use the security features of the TPM to meet their requirements. + The intent of selecting 32 failures as the lock-out threshold is so users rarely lock the TPM (even when learning to type new passwords or if they frequently lock and unlock their computers). If users lock the TPM, they must to wait two hours or use some other credential to sign in, such as a user name and password. + ## How do I check the state of my TPM? + You can check the state of the TPM on a PC by running the Trusted Platform Module snap-in (tpm.msc). The **Status** heading tells you the state of your TPM. The TPM can be in one of the following states: **Ready for use**, **Ready for use, with reduced functionality**, and **Not ready for use**. To take advantage of most of the TPM features in Windows 10, the TPM must be **Ready for use**. + ## What can I do if my TPM is in reduced functionality mode? -If your TPM is in reduced functionality mode, some features that rely on the TPM will not function correctly. This is most often caused by doing a clean installation of Windows 10 on a device where Windows 8.1, Windows 8, or Windows 7 had previously been installed on the same hardware. If your TPM is in reduced functionality mode, the Status heading in the Trusted Platform Module snap-in shows **The TPM is ready for use, with reduced functionality**. You can fix this by clearing the TPM. + +If your TPM is in reduced functionality mode, some features that rely on the TPM will not function correctly. This is most often caused by doing a clean installation of Windows 10 on a device where Windows 8.1, Windows 8, or Windows 7 had previously been installed on the same hardware. If your TPM is in reduced functionality mode, the Status heading in the Trusted Platform Module snap-in shows **The TPM is ready for use, with reduced functionality**. +You can fix this by clearing the TPM. + **To clear the TPM** + 1. Open the Trusted Platform Module snap-in (tpm.msc). 2. Click **Clear TPM**, and then click **Restart.** 3. When the PC is restarting, you might be prompted to press a button on the keyboard to clear the TPM. 4. After the PC restarts, your TPM will be automatically prepared for use by Windows 10. -**Note**   -Clearing the TPM causes you to lose all TPM keys and data protected by those keys, such as a virtual smart card. You should not perform this procedure on a device you do not own, such as a work or school PC, without being instructed to do so by your IT administrator. + +>**Note:**  Clearing the TPM causes you to lose all TPM keys and data protected by those keys, such as a virtual smart card. You should not perform this procedure on a device you do not own, such as a work or school PC, without being instructed to do so by your IT administrator.   ## Additional resources -[Trusted Platform Module Technology Overview](trusted-platform-module-overview.md) -[Trusted Platform Module Services Group Policy Settings](trusted-platform-module-services-group-policy-settings.md) -[TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx) -[Schema Extensions for Windows Server 2008 R2 to support AD DS backup of TPM information from Windows 8 clients](ad-ds-schema-extensions-to-support-tpm-backup.md) -[TPM WMI providers](http://go.microsoft.com/fwlink/p/?LinkId=93478) -[Prepare your organization for BitLocker: Planning and Policies - TPM configurations](http://technet.microsoft.com/library/jj592683.aspx) -  -  + +- [Trusted Platform Module Technology Overview](trusted-platform-module-overview.md) +- [Trusted Platform Module Services Group Policy Settings](trusted-platform-module-services-group-policy-settings.md) +- [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx) +- [Schema Extensions for Windows Server 2008 R2 to support AD DS backup of TPM information from Windows 8 clients](ad-ds-schema-extensions-to-support-tpm-backup.md) +- [TPM WMI providers](http://go.microsoft.com/fwlink/p/?LinkId=93478) +- [Prepare your organization for BitLocker: Planning and Policies - TPM configurations](http://technet.microsoft.com/library/jj592683.aspx) diff --git a/windows/keep-secure/tpm-recommendations.md b/windows/keep-secure/tpm-recommendations.md index b9e5bc42f5..9decdf047c 100644 --- a/windows/keep-secure/tpm-recommendations.md +++ b/windows/keep-secure/tpm-recommendations.md @@ -2,76 +2,116 @@ title: TPM recommendations (Windows 10) description: This topic provides recommendations for Trusted Platform Module (TPM) technology for Windows 10. ms.assetid: E85F11F5-4E6A-43E7-8205-672F77706561 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # TPM recommendations + **Applies to** - Windows 10 - Windows 10 Mobile - Windows Server 2016 Technical Preview - Windows 10 IoT Core (IoT Core) + This topic provides recommendations for Trusted Platform Module (TPM) technology for Windows 10. + ## Overview + Trusted Platform Module (TPM) technology is designed to provide hardware-based, security-related functions. It has a security-related crypto-processor that is designed to carry out cryptographic operations in a variety of devices and form factors. It includes multiple physical security mechanisms to help prevent malicious software from tampering with the security functions of the TPM. Some of the key advantages of using TPM technology are that you can: + 1. Generate, store, use, and protected cryptographic keys, 2. Use TPM technology for platform device authentication by using a unique endorsement key (EK), and 3. Help enhance platform integrity by taking and storing security measurements. + The most common TPM functions are used for system integrity measurements and for key creation and use. During the boot process of a system, the boot code that is loaded (including firmware and the operating system components) can be measured and recorded in the TPM. The integrity measurements can be used as evidence for how a system started and to make sure that a TPM-based key was used only when the correct software was used to boot the system. Traditionally, TPMs have been discrete chips soldered to a computer’s motherboard. Such implementations allow the computer’s original equipment manufacturer (OEM) to evaluate and certify the TPM separate from the rest of the system. Although discrete TPM implementations are still common, they can be problematic for integrated devices that are small or have low power consumption. Some newer TPM implementations integrate TPM functionality into the same chipset as other platform components while still providing logical separation similar to discrete TPM chips. + TPMs are passive: they receive commands and return responses. To realize the full benefit of a TPM, the OEM must carefully integrate system hardware and firmware with the TPM to send it commands and react to its responses. TPMs were originally designed to provide security and privacy benefits to a platform’s owner and users, but newer versions can provide security and privacy benefits to the system hardware itself. Before it can be used for advanced scenarios, however, a TPM must be provisioned. Windows 10 automatically provisions a TPM, but if the user reinstalls the operating system, he or she may need to tell the operating system to explicitly provision the TPM again before it can use all the TPM’s features. + The Trusted Computing Group (TCG) is the nonprofit organization that publishes and maintains the TPM specification. The TCG exists to develop, define, and promote vendor-neutral, global industry standards that support a hardware-based root of trust for interoperable trusted computing platforms. The TCG also publishes the TPM specification as the international standard ISO/IEC 11889, using the Publicly Available Specification Submission Process that the Joint Technical Committee 1 defines between the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). + OEMs implement the TPM as a component in a trusted computing platform, such as a PC, tablet, or phone. Trusted computing platforms use the TPM to support privacy and security scenarios that software alone cannot achieve. For example, software alone cannot reliably report whether malware is present during the system startup process. The close integration between TPM and platform increases the transparency of the startup process and supports evaluating device health by enabling reliable measuring and reporting of the software that starts the device. Implementation of a TPM as part of a trusted computing platform provides a hardware root of trust—that is, it behaves in a trusted way. For example, if a key stored in a TPM has properties that disallow exporting the key, that key truly cannot leave the TPM. + The TCG designed the TPM as a low-cost, mass-market security solution that addresses the requirements of different customer segments. There are variations in the security properties of different TPM implementations just as there are variations in customer and regulatory requirements for different sectors. In public-sector procurement, for example, some governments have clearly defined security requirements for TPMs whereas others do not. -**Note**   -Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + +>**Note:**  Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.   ## TPM 1.2 vs. 2.0 comparison + From an industry standard, Microsoft has been an industry leader in moving and standardizing on TPM 2.0, which has many key realized benefits across algorithms, crypto, hierarchy, root keys, authorization and NV RAM. + ## Why TPM 2.0? + TPM 2.0 products and systems have important security advantages over TPM 1.2, including: + - The TPM 1.2 spec only allows for the use of RSA and the SHA-1 hashing algorithm. - For security reasons, some entities are moving away from SHA-1. Notably, NIST has required many federal agencies to move to SHA-256 as of 2014, and technology leaders, including Microsoft and Google have announced they will remove support for SHA-1 based signing or certificates in 2017. - TPM 2.0 **enables greater crypto agility** by being more flexible with respect to cryptographic algorithms. + - TPM 2.0 supports SHA-256 as well as ECC, the latter being critical to drive signing and key generation performance. - TPM 2.0 achieved ISO standardization ([ISO/IEC 11889:2015](http://blogs.microsoft.com/cybertrust/2015/06/29/governments-recognize-the-importance-of-tpm-2-0-through-iso-adoption/)). - Use of TPM 2.0 may help eliminate the need for OEMs to make exception to standard configurations for certain countries and regions. + - TPM 2.0 offers a more **consistent experience** across different implementations. + - TPM 1.2 implementations across both discrete and firmware vary in policy settings. This may result in support issues as lockout policies vary. - TPM 2.0 standardized policy requirement helps establish a consistent lockout experience across devices, as such, Windows can offer a better user experience end to end. + - While TPM 1.2 parts were discrete silicon components typically soldered on the motherboard, TPM 2.0 is available both as a **discrete (dTPM)** silicon component and as a **firmware (fTPM)** based component running in a trusted execution environment (TEE) on the system’s main SoC: + - On Intel chips, it is the Intel Management Engine (ME) or Converged Security Engine (CSE). - For AMD chips, it is the AMD Security Processor - For ARM chips, it is a Trustzone Trusted Application (TA). - In the case of firmware TPM for desktop Windows systems, the chip vendor provides the firmware TPM implementation along with the other chip firmware to OEMs. + ## Discrete or firmware TPM? + Windows uses discrete and firmware TPM in the same way. Windows gains no functional advantage or disadvantage from either option. + From a security standpoint, discrete and firmware share the same characteristics; + - Both use hardware based secure execution. - Both use firmware for portions of the TPM functionality. - Both are equipped with tamper resistance capabilities. - Both have unique security limitations/risks. + For more info, see [fTPM: A Firmware-based TPM 2.0 Implementation](http://research.microsoft.com/apps/pubs/?id=258236). + ## Is there any importance for TPM for consumer? + For end consumers, TPM is behind the scenes but still very relevant for Hello, Passport and in the future, many other key features in Windows 10. It offers the best Passport experience, helps encrypt passwords, secures streaming high quality 4K content and builds on our overall Windows 10 experience story for security as a critical pillar. Using Windows on a system with a TPM enables a deeper and broader level of security coverage. + ## TPM 2.0 Compliance for Windows 10 + ### Windows 10 for desktop editions (Home, Pro, Enterprise, and Education) + - As of July 28, 2016, all new device models, lines or series (or if you are updating the hardware configuration of a existing model, line or series with a major update, such as CPU, graphic cards) must implement and enable by default TPM 2.0 (details in section 3.7, https://msdn.microsoft.com/library/windows/hardware/dn915086(v=vs.85).aspx) ## Two implementation options: -• Discrete TPM chip as a separate discrete component -• Firmware TPM solution using Intel PTT (platform trust technology) or AMD + +- Discrete TPM chip as a separate discrete component +- Firmware TPM solution using Intel PTT (platform trust technology) or AMD + ### Windows 10 Mobile + - All devices shipping with Windows 10 Mobile must implement TPM 2.0 and ship with the TPM 2.0 enabled. + ### IoT Core + - TPM is optional on IoT Core. + ### Windows Server 2016 Technical Preview + - TPM is optional for Windows Server SKUs unless the SKU meets the additional qualification (AQ) criteria for the Host Guardian Services scenario in which case TPM 2.0 is required. + ## TPM and Windows Features + The following table defines which Windows features require TPM support. Some features are not applicable to Windows 7/8/8.1 and are noted accordingly. + @@ -255,9 +295,11 @@ There are a variety of TPM manufacturers for both discrete and firmware.
        ## OEM Feedback and Status on TPM 2.0 system availability + ### Certified TPM parts + Government customers and enterprise customers in regulated industries may have acquisition standards that require use of common certified TPM parts. As a result, OEMs, who provide the devices, may be required to use only certified TPM components on their commercial class systems. Discrete TPM 2.0 vendors have completion certification. + ### Windows 7 32-bit support + Even though Windows 7 shipped before the TPM 2.0 spec or products existed, Microsoft backported TPM 2.0 support to Windows 7 64-bit and released it in summer 2014 as a downloadable Windows hotfix for UEFI based Windows 7 systems. Microsoft is not currently planning to backport support to Windows 7 32-bit support. -  -  diff --git a/windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md b/windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md index 24182d9e16..f9c63208af 100644 --- a/windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md +++ b/windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md @@ -2,30 +2,41 @@ title: Troubleshoot Windows Defender in Windows 10 (Windows 10) description: IT professionals can review information about event IDs in Windows Defender for Windows 10 and see any relevant action they can take. ms.assetid: EE488CC1-E340-4D47-B50B-35BD23CB4D70 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library +ms.pagetype: security author: jasesso --- + # Troubleshoot Windows Defender in Windows 10 + **Applies to** - Windows 10 + IT professionals can review information about event IDs in Windows Defender for Windows 10 and see any relevant action they can take. + ## Windows Defender client event IDs + This section provides the following information about Windows Defender client events: + - The text of the message as it appears in the event - The name of the source of the message - The symbolic name that identifies each message in the programming source code - Additional information about the message + Use the information in this table to help troubleshoot Windows Defender client events; these are located in the **Windows Event Viewer**, under **Windows Logs**. + **To view a Windows Defender client event** + 1. Open **Event Viewer**. 2. In the console tree, expand **Applications and Services Logs**, then **Microsoft**, then **Windows**, then **Windows Defender**. 3. Double-click on **Operational**. 4. In the details pane, view the list of individual events to find your event. 5. Click the event to see specific details about an event in the lower pane, under the **General** and **Details** tabs. + You can find a complete list of the Microsoft antimalware event IDs, the symbol, and the description of each ID in [Windows Server Antimalware Events TechNet](https://technet.microsoft.com/library/dn913615.aspx). + @@ -3257,8 +3268,8 @@ article.

      Event ID: 1000
      + ## Related topics -[Configure Windows Defender in Windows 10](configure-windows-defender-in-windows-10.md) -[Update and manage Windows Defender in Windows 10](get-started-with-windows-defender-for-windows-10.md) -  -  + +- [Configure Windows Defender in Windows 10](configure-windows-defender-in-windows-10.md) +- [Update and manage Windows Defender in Windows 10](get-started-with-windows-defender-for-windows-10.md) diff --git a/windows/keep-secure/trusted-platform-module-overview.md b/windows/keep-secure/trusted-platform-module-overview.md index 02ba8d12dc..03e37a250b 100644 --- a/windows/keep-secure/trusted-platform-module-overview.md +++ b/windows/keep-secure/trusted-platform-module-overview.md @@ -2,81 +2,75 @@ title: Trusted Platform Module Technology Overview (Windows 10) description: This topic for the IT professional describes the Trusted Platform Module (TPM) and how Windows uses it for access control and authentication. The topic provides links to other resources about the TPM. ms.assetid: face8932-b034-4319-86ac-db1163d46538 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Trusted Platform Module Technology Overview + **Applies to** - Windows 10 + This topic for the IT professional describes the Trusted Platform Module (TPM) and how Windows uses it for access control and authentication. The topic provides links to other resources about the TPM. + ## Feature description + Trusted Platform Module (TPM) technology is designed to provide hardware-based, security-related functions. A TPM chip is a secure crypto-processor that is designed to carry out cryptographic operations. The chip includes multiple physical security mechanisms to make it tamper resistant, and malicious software is unable to tamper with the security functions of the TPM. Some of the key advantages of using TPM technology are that you can: + - Generate, store, and limit the use of cryptographic keys. - Use TPM technology for platform device authentication by using the TPM’s unique RSA key, which is burned into itself. - Help ensure platform integrity by taking and storing security measurements. + The most common TPM functions are used for system integrity measurements and for key creation and use. During the boot process of a system, the boot code that is loaded (including firmware and the operating system components) can be measured and recorded in the TPM. The integrity measurements can be used as evidence for how a system started and to make sure that a TPM-based key was used only when the correct software was used to boot the system. + TPM-based keys can be configured in a variety of ways. One option is to make a TPM-based key unavailable outside the TPM. This is good to mitigate phishing attacks because it prevents the key from being copied and used without the TPM. TPM-based keys can also be configured to require an authorization value to use them. If too many incorrect authorization guesses occur, the TPM will activate its dictionary attack logic and prevent further authorization value guesses. + Different versions of the TPM are defined in specifications by the Trusted Computing Group (TCG). For more information, consult the TCG Web site (). + Windows can automatically provision and manage the TPM. Group Policy settings can be configured to control whether the TPM owner authorization value is backed up in Active Directory. Because the TPM state persists across operating system installations, TPM information is stored in a location in Active Directory that is separate from computer objects. Depending on an enterprise’s security goals, Group Policy can be configured to allow or prevent local administrators from resetting the TPM’s dictionary attack logic. Standard users can use the TPM, but Group Policy controls limit how many authorization failures standard users can attempt so that one user is unable to prevent other users or the administrator from using the TPM. TPM technology can also be used as a virtual smart card and for secure certificate storage. With BitLocker Network Unlock, domain-joined computers are not prompted for a BitLocker PIN. + ## Practical applications + Certificates can be installed or created on computers that are using the TPM. After a computer is provisioned, the RSA private key for a certificate is bound to the TPM and cannot be exported. The TPM can also be used as a replacement for smart cards, which reduces the costs associated with creating and disbursing smart cards. + Automated provisioning in the TPM reduces the cost of TPM deployment in an enterprise. New APIs for TPM management can determine if TPM provisioning actions require physical presence of a service technician to approve TPM state change requests during the boot process. + Antimalware software can use the boot measurements of the operating system start state to prove the integrity of a computer running Windows 10, Windows 8.1, Windows 8, Windows Server 2012 R2, or Windows Server 2012. These measurements include the launch of Hyper-V to test that datacenters using virtualization are not running untrusted hypervisors. With BitLocker Network Unlock, IT administrators can push an update without concerns that a computer is waiting for PIN entry. + The TPM has several Group Policy settings that can be used to manage how it is used. These settings can be used to manage the owner authorization value, the blocked TPM commands, the standard user lockout, and the backup of the TPM to AD DS. For more info, see [Trusted Platform Module Services Group Policy Settings](trusted-platform-module-services-group-policy-settings.md). + ## New and changed functionality + For more info on new and changed functionality for Trusted Platform Module in Windows 10, see [What's new in Trusted Platform Module?](../whats-new/trusted-platform-module.md). + ## Device health attestation + Device health attestation enables enterprises to establish trust based on hardware and software components of a managed device. With device heath attestation, you can configure an MDM server to query a health attestation service that will allow or deny a managed device access to a secure resource. + Some things that you can check on the device are: + - Is Data Execution Prevention supported and enabled? - Is BitLocker Drive Encryption supported and enabled? - Is SecureBoot supported and enabled? -**Note**  The device must be running Windows 10 and it must support at least TPM 2.0. + +>**Note:**  The device must be running Windows 10 and it must support at least TPM 2.0.   ## Supported versions - ------- - - - - - - - - - - - - - - - - - - - - - - - - - -
      TPM versionWindows 10Windows Server 2012 R2, Windows 8.1, and Windows RTWindows Server 2012, Windows 8, and Windows RTWindows Server 2008 R2 and Windows 7

      TPM 1.2

      X

      X

      X

      X

      TPM 2.0

      X

      X

      X

      X

      -  + +| TPM version | Windows 10 | Windows Server 2012 R2, Windows 8.1, and Windows RT | Windows Server 2012, Windows 8, and Windows RT | Windows Server 2008 R2 and Windows 7 | +| - | - | - | - | - | +| TPM 1.2| X| X| X| X| +| TPM 2.0| X| X| X| X| + ## Additional Resources -[TPM Fundamentals](tpm-fundamentals.md) -[TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md) -[TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx) -[AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md) -[Prepare your organization for BitLocker: Planning and Policies - TPM configurations](http://technet.microsoft.com/library/jj592683.aspx) + +- [TPM Fundamentals](tpm-fundamentals.md) +- [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md) +- [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx) +- [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md) +- [Prepare your organization for BitLocker: Planning and Policies - TPM configurations](http://technet.microsoft.com/library/jj592683.aspx)     From f83e6d198cd5eefef0e7ac6d95178966da601d4c Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 25 May 2016 15:19:12 -0700 Subject: [PATCH 418/439] fixing spacing issues --- .../executable-rules-in-applocker.md | 53 +-- .../export-an-applocker-policy-from-a-gpo.md | 11 +- ...m-module-services-group-policy-settings.md | 240 +++++------ ...derstand-applocker-enforcement-settings.md | 41 +- ...stand-applocker-policy-design-decisions.md | 408 +++++------------- ...ent-setting-inheritance-in-group-policy.md | 19 +- ...the-applocker-policy-deployment-process.md | 11 +- ...plocker-allow-and-deny-actions-on-rules.md | 50 +-- .../understanding-applocker-default-rules.md | 61 +-- .../understanding-applocker-rule-behavior.md | 17 +- ...nderstanding-applocker-rule-collections.md | 18 +- ...standing-applocker-rule-condition-types.md | 32 +- ...understanding-applocker-rule-exceptions.md | 13 +- ...e-file-hash-rule-condition-in-applocker.md | 34 +- ...ng-the-path-rule-condition-in-applocker.md | 71 +-- ...e-publisher-rule-condition-in-applocker.md | 86 ++-- ...-create-and-maintain-applocker-policies.md | 44 +- ...restriction-policies-in-the-same-domain.md | 12 +- ...he-applocker-windows-powershell-cmdlets.md | 35 +- ...rding-to-assist-in-instrusion-detection.md | 192 ++++++++- ...-for-the-built-in-administrator-account.md | 84 ++-- ...vation-without-using-the-secure-desktop.md | 104 +++-- ...r-administrators-in-admin-approval-mode.md | 95 ++-- ...the-elevation-prompt-for-standard-users.md | 86 ++-- ...-installations-and-prompt-for-elevation.md | 82 ++-- ...ecutables-that-are-signed-and-validated.md | 86 ++-- ...-that-are-installed-in-secure-locations.md | 96 +++-- ...l-administrators-in-admin-approval-mode.md | 87 ++-- ...ccount-control-security-policy-settings.md | 43 +- ...re-desktop-when-prompting-for-elevation.md | 89 ++-- ...ry-write-failures-to-per-user-locations.md | 85 ++-- windows/keep-secure/user-rights-assignment.md | 253 +++-------- ...-monitor-dynamic-access-control-objects.md | 74 +--- .../using-event-viewer-with-applocker.md | 148 ++----- ...riction-policies-and-applocker-policies.md | 76 ++-- .../view-the-security-event-log.md | 9 +- windows/keep-secure/what-is-applocker.md | 18 +- ...ort-advanced-audit-policy-configuration.md | 19 +- .../windows-installer-rules-in-applocker.md | 53 +-- .../working-with-applocker-policies.md | 92 +--- .../working-with-applocker-rules.md | 353 +++++---------- 41 files changed, 1484 insertions(+), 1996 deletions(-) diff --git a/windows/keep-secure/executable-rules-in-applocker.md b/windows/keep-secure/executable-rules-in-applocker.md index b215d8ffe5..b74b7fe29a 100644 --- a/windows/keep-secure/executable-rules-in-applocker.md +++ b/windows/keep-secure/executable-rules-in-applocker.md @@ -2,55 +2,28 @@ title: Executable rules in AppLocker (Windows 10) description: This topic describes the file formats and available default rules for the executable rule collection. ms.assetid: 65e62f90-6caa-48f8-836a-91f8ac9018ee -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Executable rules in AppLocker + **Applies to** - Windows 10 + This topic describes the file formats and available default rules for the executable rule collection. + AppLocker defines executable rules as any files with the .exe and .com extensions that are associated with an app. Because all of the default rules for the executable rule collection are based on folder paths, all files under those paths will be allowed. The following table lists the default rules that are available for the executable rule collection. - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      PurposeNameUserRule condition type

      Allow members of the local Administrators group access to run all executable files

      (Default Rule) All files

      BUILTIN\Administrators

      Path: *

      Allow all users to run executable files in the Windows folder

      (Default Rule) All files located in the Windows folder

      Everyone

      Path: %windir%\*

      Allow all users to run executable files in the Program Files folder

      (Default Rule) All files located in the Program Files folder

      Everyone

      Path: %programfiles%\*

      + +| Purpose | Name | User | Rule condition type | +| - | - | - | - | +| Allow members of the local Administrators group access to run all executable files | (Default Rule) All files| BUILTIN\Administrators | Path: * | +| Allow all users to run executable files in the Windows folder| (Default Rule) All files located in the Windows folder| Everyone| Path: %windir%\*| +| Allow all users to run executable files in the Program Files folder | (Default Rule) All files located in the Program Files folder| Everyone | Path: %programfiles%\*|   ## Related topics -[Understanding AppLocker Default Rules](understanding-applocker-default-rules.md) -  -  + +- [Understanding AppLocker Default Rules](understanding-applocker-default-rules.md) diff --git a/windows/keep-secure/export-an-applocker-policy-from-a-gpo.md b/windows/keep-secure/export-an-applocker-policy-from-a-gpo.md index 565c1d0597..90c10baeee 100644 --- a/windows/keep-secure/export-an-applocker-policy-from-a-gpo.md +++ b/windows/keep-secure/export-an-applocker-policy-from-a-gpo.md @@ -2,23 +2,28 @@ title: Export an AppLocker policy from a GPO (Windows 10) description: This topic for IT professionals describes the steps to export an AppLocker policy from a Group Policy Object (GPO) so that it can be modified. ms.assetid: 7db59719-a8be-418b-bbfd-22cf2176c9c0 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Export an AppLocker policy from a GPO + **Applies to** - Windows 10 + This topic for IT professionals describes the steps to export an AppLocker policy from a Group Policy Object (GPO) so that it can be modified. + Updating an AppLocker policy that is currently enforced in your production environment can have unintended results. Therefore, export the policy from the GPO and update the rule or rules by using AppLocker on your AppLocker reference device + To complete this procedure, you must have the **Edit Setting** permission to edit a GPO. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. + **Export the policy from the GPO** + 1. In the Group Policy Management Console (GPMC), open the GPO that you want to edit. 2. In the console tree under **Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Application Control Policies**, click **AppLocker**. 3. Right-click **AppLocker**, and then click **Export Policy**. 4. In the **Export Policy** dialog box, type a name for the exported policy (for example, the name of the GPO), select a location to save the policy, and then click **Save**. 5. The **AppLocker** dialog box will notify you of how many rules were exported. Click **OK**. -  -  diff --git a/windows/keep-secure/trusted-platform-module-services-group-policy-settings.md b/windows/keep-secure/trusted-platform-module-services-group-policy-settings.md index 4b274eecc5..4ded5c4844 100644 --- a/windows/keep-secure/trusted-platform-module-services-group-policy-settings.md +++ b/windows/keep-secure/trusted-platform-module-services-group-policy-settings.md @@ -2,230 +2,188 @@ title: TPM Group Policy settings (Windows 10) description: This topic for the IT professional describes the Trusted Platform Module (TPM) Services that can be controlled centrally by using Group Policy settings. ms.assetid: 54ff1c1e-a210-4074-a44e-58fee26e4dbd -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # TPM Group Policy settings + **Applies to** - Windows 10 + This topic for the IT professional describes the Trusted Platform Module (TPM) Services that can be controlled centrally by using Group Policy settings. + ## + The TPM Services Group Policy settings are located at: + **Computer Configuration\\Administrative Templates\\System\\Trusted Platform Module Services\\** - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      SettingWindows 10Windows Server 2012 R2, Windows 8.1 and Windows RTWindows Server 2012, Windows 8 and Windows RTWindows Server 2008 R2 and Windows 7Windows Server 2008 and Windows Vista

      [Turn on TPM backup to Active Directory Domain Services](#bkmk-tpmgp-addsbu)

      X

      X

      X

      X

      X

      [Configure the list of blocked TPM commands](#bkmk-tpmgp-clbtc)

      X

      X

      X

      X

      X

      [Ignore the default list of blocked TPM commands](#bkmk-tpmgp-idlb)

      X

      X

      X

      X

      X

      [Ignore the local list of blocked TPM commands](#bkmk-tpmgp-illb)

      X

      X

      X

      X

      X

      [Configure the level of TPM owner authorization information available to the operating system](#bkmk-tpmgp-oauthos)

      X

      X

      X

      [Standard User Lockout Duration](#bkmk-tpmgp-suld)

      X

      X

      X

      [Standard User Individual Lockout Threshold](#bkmk-tpmgp-suilt)

      X

      X

      X

      [Standard User Total Lockout Threshold](#bkmk-tpmgpsutlt)

      X

      X

      X

      + +| Setting | Windows 10 | Windows Server 2012 R2, Windows 8.1 and Windows RT | Windows Server 2012, Windows 8 and Windows RT | Windows Server 2008 R2 and Windows 7 | Windows Server 2008 and Windows Vista | +| - | - | - | - | - | - | +| [Turn on TPM backup to Active Directory Domain Services](#bkmk-tpmgp-addsbu) | X| X| X| X| X| +| [Configure the list of blocked TPM commands](#bkmk-tpmgp-clbtc)| X| X| X| X| X| +| [Ignore the default list of blocked TPM commands](#bkmk-tpmgp-idlb) | X| X| X| X| X| +| [Ignore the local list of blocked TPM commands](#bkmk-tpmgp-illb) | X| X| X| X| X| +| [Configure the level of TPM owner authorization information available to the operating system](#bkmk-tpmgp-oauthos)| X| X| X||| +| [Standard User Lockout Duration](#bkmk-tpmgp-suld)| X| X| X||| +| [Standard User Individual Lockout Threshold](#bkmk-tpmgp-suilt)| X| X| X||| +| [Standard User Total Lockout Threshold](#bkmk-tpmgpsutlt)| X| X| X||||   ### Turn on TPM backup to Active Directory Domain Services + This policy setting allows you to manage the Active Directory Domain Services (AD DS) backup of TPM owner information. -**Note**   -This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). + +>**Note:**  This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table).   TPM owner information includes a cryptographic hash of the TPM owner password. Certain TPM commands can be run only by the TPM owner. This hash authorizes the TPM to run these commands. -**Important**   -To back up TPM owner information from a computer running Windows 10, Windows 8.1, or Windows 8, you might need to first set up appropriate schema extensions and access control settings on the domain so that the AD DS backup can succeed. Windows Server 2012 R2 and Windows Server 2012 include the required schema extensions by default. For more information, see [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md). + +>**Important:**  To back up TPM owner information from a computer running Windows 10, Windows 8.1, or Windows 8, you might need to first set up appropriate schema extensions and access control settings on the domain so that the AD DS backup can succeed. Windows Server 2012 R2 and Windows Server 2012 include the required schema extensions by default. For more information, see [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md).   The TPM cannot be used to provide enhanced security features for BitLocker Drive Encryption and other applications without first setting an owner. To take ownership of the TPM with an owner password, on a local computer at the command prompt, type **tpm.msc** to open the TPM Management Console and select the action to **Initialize TPM**. If the TPM owner information is lost or is not available, limited TPM management is possible by running **tpm.msc**. + If you enable this policy setting, TPM owner information will be automatically and silently backed up to AD DS when you use Windows to set or change a TPM owner password. When this policy setting is enabled, a TPM owner password cannot be set or changed unless the computer is connected to the domain and the AD DS backup succeeds. + If you disable or do not configure this policy setting, TPM owner information will not be backed up to AD DS. + ### Configure the list of blocked TPM commands + This policy setting allows you to manage the Group Policy list of Trusted Platform Module (TPM) commands that are blocked by Windows. -**Note**   -This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). + +>**Note:**  This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table).   If you enable this policy setting, Windows will block the specified commands from being sent to the TPM on the computer. TPM commands are referenced by a command number. For example, command number 129 is **TPM\_OwnerReadInternalPub**, and command number 170 is **TPM\_FieldUpgrade**. To find the command number that is associated with each TPM command, at the command prompt, type **tpm.msc**to open the TPM Management Console and navigate to the **Command Management** section. + If you disable or do not configure this policy setting, only those TPM commands that are specified through the default or local lists can be blocked by Windows. The default list of blocked TPM commands is preconfigured by Windows. + - You can view the default list by typing **tpm.msc** at the command prompt, navigating to the **Command Management** section, and exposing the **On Default Block List** column. - The local list of blocked TPM commands is configured outside of Group Policy by running the TPM Management Console or scripting using the **Win32\_Tpm** interface. + For information how to enforce or ignore the default and local lists of blocked TPM commands, see + - [Ignore the default list of blocked TPM commands](#bkmk-tpmgp-idlb) - [Ignore the local list of blocked TPM commands](#bkmk-tpmgp-illb) ### Ignore the default list of blocked TPM commands + This policy setting allows you to enforce or ignore the computer's default list of blocked Trusted Platform Module (TPM) commands. -**Note**   -This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). + +>**Note:**  This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table).   The default list of blocked TPM commands is preconfigured by Windows. You can view the default list by typing **tpm.msc** at the command prompt to open the TPM Management Console, navigating to the **Command Management** section, and exposing the **On Default Block List** column. Also see the related policy setting, [Configure the list of blocked TPM commands](#bkmk-tpmgp-clbtc). + If you enable this policy setting, the Windows operating system will ignore the computer's default list of blocked TPM commands, and it will block only those TPM commands that are specified by Group Policy or the local list. + If you disable or do not configure this policy setting, Windows will block the TPM commands in the default list, in addition to the commands that are specified by Group Policy and the local list of blocked TPM commands. + ### Ignore the local list of blocked TPM commands + This policy setting allows you to enforce or ignore the computer's local list of blocked Trusted Platform Module (TPM) commands. -**Note**   -This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). + +>**Note:**  This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table).   The local list of blocked TPM commands is configured outside of Group Policy by typing **tpm.msc** at the command prompt to open the TPM Management Console, or scripting using the **Win32\_Tpm** interface. (The default list of blocked TPM commands is preconfigured by Windows.) Also see the related policy setting to **Configure the list of blocked TPM commands**. + If you enable this policy setting, the Windows operating system will ignore the computer's local list of blocked TPM commands, and it will block only those TPM commands that are specified by Group Policy or the default list. + If you disable or do not configure this policy setting, Windows will block the TPM commands in the local list, in addition to the commands that are specified in Group Policy and the default list of blocked TPM commands. + ### Configure the level of TPM owner authorization information available to the operating system + This policy setting configures how much of the TPM owner authorization information is stored in the registry of the local computer. Depending on the amount of TPM owner authorization information that is stored locally, the Windows operating system and TPM-based applications can perform certain actions in the TPM that require TPM owner authorization without requiring the user to enter the TPM owner password. -**Note**   -This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). + +>**Note:**  This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table).   There are three TPM owner authentication settings that are managed by the Windows operating system. You can choose a value of **Full**, **Delegate**, or **None**. + - **Full**   This setting stores the full TPM owner authorization, the TPM administrative delegation blob, and the TPM user delegation blob in the local registry. With this setting, you can use the TPM without requiring remote or external storage of the TPM owner authorization value. This setting is appropriate for scenarios that do not require you to reset the TPM anti-hammering logic or change the TPM owner authorization value. Some TPM-based applications may require that this setting is changed before features that depend on the TPM anti-hammering logic can be used. - **Delegated**   This setting stores only the TPM administrative delegation blob and the TPM user delegation blob in the local registry. This setting is appropriate for use with TPM-based applications that depend on the TPM antihammering logic. When you use this setting, we recommend using external or remote storage for the full TPM owner authorization value—for example, backing up the value in Active Directory Domain Services (AD DS). - **None**   This setting provides compatibility with previous operating systems and applications. You can also use it for scenarios when TPM owner authorization cannot be stored locally. Using this setting might cause issues with some TPM-based applications. -**Note**   -If the operating system managed TPM authentication setting is changed from **Full** to **Delegated**, the full TPM owner authorization value will be regenerated, and any copies of the previously set TPM owner authorization value will be invalid. If you are backing up the TPM owner authorization value to AD DS, the new owner authorization value is automatically backed up to AD DS when it is changed. + +>**Note:**  If the operating system managed TPM authentication setting is changed from **Full** to **Delegated**, the full TPM owner authorization value will be regenerated, and any copies of the previously set TPM owner authorization value will be invalid. If you are backing up the TPM owner authorization value to AD DS, the new owner authorization value is automatically backed up to AD DS when it is changed.   **Registry information** + Registry key: HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\TPM + DWORD: OSManagedAuthLevel + The following table shows the TPM owner authorization values in the registry. - ---- - - - - - - - - - - - - - - - - - - - - -
      Value DataSetting

      0

      None

      2

      Delegated

      4

      Full

      + +| Value Data | Setting | +| - | - | +| 0 | None| +| 2 | Delegated| +| 4 | Full|   If you enable this policy setting, the Windows operating system will store the TPM owner authorization in the registry of the local computer according to the TPM authentication setting you choose. -If you disable or do not configure this policy setting, and the **Turn on TPM backup to Active Directory Domain Services** policy setting is also disabled or not configured, the default setting is to store the full TPM authorization value in the local registry. If this policy is disabled or not configured, and the **Turn on TPM backup to Active Directory Domain Services** policy setting is enabled, only the administrative delegation and the user delegation blobs are stored in the local registry. + +If you disable or do not configure this policy setting, and the **Turn on TPM backup to Active Directory Domain Services** policy setting is also disabled or not configured, the default setting is to store the full TPM authorization value in the local registry. If this policy is disabled or not +configured, and the **Turn on TPM backup to Active Directory Domain Services** policy setting is enabled, only the administrative delegation and the user delegation blobs are stored in the local registry. + ### Standard User Lockout Duration -This policy setting allows you to manage the duration in minutes for counting standard user authorization failures for Trusted Platform Module (TPM) commands requiring authorization. An authorization failure occurs each time a standard user sends a command to the TPM and receives an error response that indicates an authorization failure occurred. Authorization failures that are older than the duration you set are ignored. If the number of TPM commands with an authorization failure within the lockout duration equals a threshold, a standard user is prevented from sending commands that require authorization to the TPM. -**Note**   -This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). + +This policy setting allows you to manage the duration in minutes for counting standard user authorization failures for Trusted Platform Module (TPM) commands requiring authorization. An authorization failure occurs each time a standard user sends a command to the TPM and receives an error response that indicates an authorization failure occurred. Authorization failures that are older than the duration you set are ignored. If the number of TPM commands with an authorization failure within the lockout duration equals a threshold, a standard user is prevented from sending commands that require +authorization to the TPM. + +>**Note:**  This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table).   The TPM is designed to protect itself against password guessing attacks by entering a hardware lockout mode when it receives too many commands with an incorrect authorization value. When the TPM enters a lockout mode, it is global for all users (including administrators) and for Windows features such as BitLocker Drive Encryption. + The number of authorization failures that a TPM allows and how long it stays locked vary by TPM manufacturer. Some TPMs may enter lockout mode for successively longer periods of time, with fewer authorization failures, depending on past failures. Some TPMs may require a system restart to exit the lockout mode. Other TPMs may require that the system is on so enough clock cycles elapse before the TPM exits the lockout mode. + This setting helps administrators prevent the TPM hardware from entering a lockout mode by slowing the speed at which standard users can send commands that require authorization to the TPM. + For each standard user, two thresholds apply. Exceeding either threshold prevents the user from sending a command that requires authorization to the TPM. Use the following policy settings to set the lockout duration: + - [Standard User Individual Lockout Threshold](#bkmk-individual)   This value is the maximum number of authorization failures that each standard user can have before the user is not allowed to send commands that require authorization to the TPM. - [Standard User Total Lockout Threshold](#bkmk-total)   This value is the maximum total number of authorization failures that all standard users can have before all standard users are not allowed to send commands that require authorization to the TPM. + An administrator with the TPM owner password can fully reset the TPM's hardware lockout logic by using the TPM Management Console (tpm.msc). Each time an administrator resets the TPM's hardware lockout logic, all prior standard user TPM authorization failures are ignored. This allows standard users to immediately use the TPM normally. + If you do not configure this policy setting, a default value of 480 minutes (8 hours) is used. + ### Standard User Individual Lockout Threshold + This policy setting allows you to manage the maximum number of authorization failures for each standard user for the Trusted Platform Module (TPM). This value is the maximum number of authorization failures that each standard user can have before the user is not allowed to send commands that require authorization to the TPM. If the number of authorization failures for the user within the duration that is set for the **Standard User Lockout Duration** policy setting equals this value, the standard user is prevented from sending commands that require authorization to the Trusted Platform Module (TPM). -**Note**   -This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). + +>**Note:**  This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table).   This setting helps administrators prevent the TPM hardware from entering a lockout mode by slowing the speed at which standard users can send commands that require authorization to the TPM. + An authorization failure occurs each time a standard user sends a command to the TPM and receives an error response indicating an authorization failure occurred. Authorization failures older than the duration are ignored. + An administrator with the TPM owner password can fully reset the TPM's hardware lockout logic by using the TPM Management Console (tpm.msc). Each time an administrator resets the TPM's hardware lockout logic, all prior standard user TPM authorization failures are ignored. This allows standard users to immediately use the TPM normally. + If you do not configure this policy setting, a default value of 4 is used. A value of zero means that the operating system will not allow standard users to send commands to the TPM, which might cause an authorization failure. + ### Standard User Total Lockout Threshold + This policy setting allows you to manage the maximum number of authorization failures for all standard users for the Trusted Platform Module (TPM). If the total number of authorization failures for all standard users within the duration that is set for the **Standard User Lockout Duration** policy equals this value, all standard users are prevented from sending commands that require authorization to the Trusted Platform Module (TPM). -**Note**   -This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). + +>**Note:**  This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table).   This setting helps administrators prevent the TPM hardware from entering a lockout mode because it slows the speed standard users can send commands requiring authorization to the TPM. + An authorization failure occurs each time a standard user sends a command to the TPM and receives an error response indicating an authorization failure occurred. Authorization failures older than the duration are ignored. + For each standard user two thresholds apply. Exceeding either threshold will prevent the standard user from sending a command to the TPM that requires authorization. + 1. The standard user individual lockout value is the maximum number of authorization failures each standard user may have before the user is not allowed to send commands requiring authorization to the TPM. 2. The standard user total lockout threshold value is the maximum total number of authorization failures all standard users may have before all standard users are not allowed to send commands requiring authorization to the TPM. -The TPM is designed to protect itself against password guessing attacks by entering a hardware lockout mode when it receives too many commands with an incorrect authorization value. When the TPM enters a lockout mode, it is global for all users (including administrators) and for Windows features such as BitLocker Drive Encryption.. +The TPM is designed to protect itself against password guessing attacks by entering a hardware lockout mode when it receives too many commands with an incorrect authorization value. When the TPM enters a lockout mode, it is global for all users (including administrators) and for Windows features +such as BitLocker Drive Encryption.. + The number of authorization failures a TPM allows and how long it stays locked out vary by TPM manufacturer. Some TPMs may enter lockout mode for successively longer periods of time with fewer authorization failures depending on past failures. Some TPMs may require a system restart to exit the lockout mode. Other TPMs may require the system to be on so enough clock cycles elapse before the TPM exits the lockout mode. + An administrator with the TPM owner password can fully reset the TPM's hardware lockout logic by using the TPM Management Console (tpm.msc). Each time an administrator resets the TPM's hardware lockout logic, all prior standard user TPM authorization failures are ignored. This allows standard users to immediately use the TPM normally. + If you do not configure this policy setting, a default value of 9 is used. A value of zero means that the operating system will not allow standard users to send commands to the TPM, which might cause an authorization failure. + ## Additional resources -[Trusted Platform Module Technology Overview](trusted-platform-module-overview.md) -[TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx) -[Prepare your organization for BitLocker: Planning and Policies - TPM configurations](http://technet.microsoft.com/library/jj592683.aspx) -  -  + +- [Trusted Platform Module Technology Overview](trusted-platform-module-overview.md) +- [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx) +- [Prepare your organization for BitLocker: Planning and Policies - TPM configurations](http://technet.microsoft.com/library/jj592683.aspx) diff --git a/windows/keep-secure/understand-applocker-enforcement-settings.md b/windows/keep-secure/understand-applocker-enforcement-settings.md index f62646c2e9..6ac72fe3f1 100644 --- a/windows/keep-secure/understand-applocker-enforcement-settings.md +++ b/windows/keep-secure/understand-applocker-enforcement-settings.md @@ -2,45 +2,28 @@ title: Understand AppLocker enforcement settings (Windows 10) description: This topic describes the AppLocker enforcement settings for rule collections. ms.assetid: 48773007-a343-40bf-8961-b3ff0a450d7e -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Understand AppLocker enforcement settings + **Applies to** - Windows 10 + This topic describes the AppLocker enforcement settings for rule collections. + Rule enforcement is applied only to a collection of rules, not to individual rules. AppLocker divides the rules into four collections: executable files, Windows Installer files, scripts, and DLL files. For more info about rule collections, see [Understanding AppLocker rule collections](understanding-applocker-rule-collections.md). By default, if enforcement is not configured and rules are present in a rule collection, those rules are enforced. The following table details the three AppLocker rule enforcement settings in Group Policy for each rule collection. - ---- - - - - - - - - - - - - - - - - - - - - -
      Enforcement settingDescription

      Not configured

      By default, enforcement is not configured in a rule collection. If rules are present in the corresponding rule collection, they are enforced. If rule enforcement is configured in a higher-level linked Group Policy object (GPO), that enforcement value overrides the Not configured value.

      Enforce rules

      Rules are enforced for the rule collection, and all rule events are audited.

      Audit only

      Rule events are audited only. Use this value when planning and testing AppLocker rules.

      + +| Enforcement setting | Description | +| - | - | +| Not configured | By default, enforcement is not configured in a rule collection. If rules are present in the corresponding rule collection, they are enforced. If rule enforcement is configured in a higher-level linked Group Policy object (GPO), that enforcement value overrides the **Not configured** value.| +| Enforce rules | Rules are enforced for the rule collection, and all rule events are audited.| +| Audit only | Rule events are audited only. Use this value when planning and testing AppLocker rules.|   For the AppLocker policy to be enforced on a device, the Application Identity service must be running. For more info about the Application Identity service, see [Configure the Application Identity service](configure-the-application-identity-service.md). + When AppLocker policies from various GPOs are merged, the enforcement modes are merged by using the standard Group Policy order of inheritance, which is local, domain, site, and organizational unit (OU). The Group Policy setting that was last written or applied by order of inheritance is used for the enforcement mode, and all rules from linked GPOs are applied. -  -  diff --git a/windows/keep-secure/understand-applocker-policy-design-decisions.md b/windows/keep-secure/understand-applocker-policy-design-decisions.md index ea6833ec44..5687229616 100644 --- a/windows/keep-secure/understand-applocker-policy-design-decisions.md +++ b/windows/keep-secure/understand-applocker-policy-design-decisions.md @@ -2,123 +2,86 @@ title: Understand AppLocker policy design decisions (Windows 10) description: This topic for the IT professional lists the design questions, possible answers, and ramifications of the decisions when you plan a deployment of application control policies by using AppLocker within a Windows operating system environment. ms.assetid: 3475def8-949a-4b51-b480-dc88b5c1e6e6 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Understand AppLocker policy design decisions + **Applies to** - Windows 10 + This topic for the IT professional lists the design questions, possible answers, and ramifications of the decisions when you plan a deployment of application control policies by using AppLocker within a Windows operating system environment. + When you begin the design and planning process, you should consider the ramifications of your design choices. The resulting decisions will affect your policy deployment scheme and subsequent application control policy maintenance. + You should consider using AppLocker as part of your organization's application control policies if all the following are true: + - You have deployed or plan to deploy the supported versions of Windows in your organization. For specific operating system version requirements, see [Requirements to Use AppLocker](requirements-to-use-applocker.md). - You need improved control over the access to your organization's applications and the data your users access. - The number of applications in your organization is known and manageable. - You have resources to test policies against the organization's requirements. - You have resources to involve Help Desk or to build a self-help process for end-user application access issues. - The group's requirements for productivity, manageability, and security can be controlled by restrictive policies. + The following questions are not in priority or sequential order. They should be considered when you deploy application control policies (as appropriate for your targeted environment). + ### Which apps do you need to control in your organization? + You might need to control a limited number of apps because they access sensitive data, or you might have to exclude all applications except those that are sanctioned for business purposes. There might be certain business groups that require strict control, and others that promote independent application usage. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Possible answersDesign considerations

      Control all apps

      AppLocker policies control applications by creating an allowed list of applications by file type. Exceptions are also possible. AppLocker policies can only be applied to applications installed on computers running one of the supported versions of Windows. For specific operating system version requirements, see [Requirements to use AppLocker](requirements-to-use-applocker.md).

      Control specific apps

      When you create AppLocker rules, a list of allowed apps are created. All apps on that list will be allowed to run (except those on the exception list). Apps that are not on the list will be prevented from running. AppLocker policies can only be applied to apps installed on computers running any of the supported versions of Windows. For specific operating system version requirements, see [Requirements to use AppLocker](requirements-to-use-applocker.md).

      Control only Classic Windows applications, only Universal Windows apps, or both

      AppLocker policies control apps by creating an allowed list of apps by file type. Because Universal Windows apps are categorized under the Publisher condition, Classic Windows applications and Universal Windows apps can be controlled together. AppLocker policies for Universal Windows apps can be applied only to apps that are installed on PCs that support the Windows Store, but Classic Windows applications can be controlled with AppLocker on all supported versions of Windows. The rules you currently have configured for Classic Windows applications can remain, and you can create new ones for Universal Windows apps.

      -

      For a comparison of Classic Windows applications and Universal Windows apps, see [Comparing Classic Windows applications and Universal Windows apps for AppLocker policy design decisions](#bkmk-compareclassicmetro) in this topic.

      Control apps by business group and user

      AppLocker policies can be applied through a Group Policy Object (GPO) to computer objects within an organizational unit (OU). Individual AppLocker rules can be applied to individual users or to groups of users.

      Control apps by computer, not user

      AppLocker is a computer-based policy implementation. If your domain or site organizational structure is not based on a logical user structure, such as an OU, you might want to set up that structure before you begin your AppLocker planning. Otherwise, you will have to identify users, their computers, and their app access requirements.

      Understand app usage, but there is no need to control any apps yet

      AppLocker policies can be set to audit app usage to help you track which apps are used in your organization. You can then use the AppLocker event log to create AppLocker policies.

      + +| Possible answers | Design considerations| +| - | - | +| Control all apps | AppLocker policies control applications by creating an allowed list of applications by file type. Exceptions are also possible. AppLocker policies can only be applied to applications installed on computers running one of the supported versions of Windows. For specific operating system version requirements, see [Requirements to use AppLocker](requirements-to-use-applocker.md).| +| Control specific apps | When you create AppLocker rules, a list of allowed apps are created. All apps on that list will be allowed to run (except those on the exception list). Apps that are not on the list will be prevented from running. AppLocker policies can only be applied to apps installed on computers running any of the supported versions of Windows. For specific operating system version requirements, see [Requirements to use AppLocker](requirements-to-use-applocker.md).| +|Control only Classic Windows applications, only Universal Windows apps, or both| AppLocker policies control apps by creating an allowed list of apps by file type. Because Universal Windows apps are categorized under the Publisher condition, Classic Windows applications and Universal Windows apps can be controlled together. AppLocker policies for Universal Windows apps can be applied only to apps that are installed on PCs that support the Windows Store, but Classic Windows applications can be controlled with AppLocker on all supported versions of Windows. The rules you currently have configured for Classic Windows applications can remain, and you can create new ones for Universal Windows apps.
      For a comparison of Classic Windows applications and Universal Windows apps, see [Comparing Classic Windows applications and Universal Windows apps for AppLocker policy design decisions](#bkmk-compareclassicmetro) in this topic.| +| Control apps by business group and user | AppLocker policies can be applied through a Group Policy Object (GPO) to computer objects within an organizational unit (OU). Individual AppLocker rules can be applied to individual users or to groups of users.| +| Control apps by computer, not user | AppLocker is a computer-based policy implementation. If your domain or site organizational structure is not based on a logical user structure, such as an OU, you might want to set up that structure before you begin your AppLocker planning. Otherwise, you will have to identify users, their computers, and their app access requirements.| +|Understand app usage, but there is no need to control any apps yet | AppLocker policies can be set to audit app usage to help you track which apps are used in your organization. You can then use the AppLocker event log to create AppLocker policies.|   -**Important**   -The following list contains files or types of files that cannot be managed by AppLocker: +>**Important:**  The following list contains files or types of files that cannot be managed by AppLocker: + - AppLocker does not protect against running 16-bit DOS binaries in a NT Virtual DOS Machine (NTVDM). This technology allows running legacy DOS and 16-bit Windows programs on computers that are using Intel 80386 or higher when there is already another operating system running and controlling the hardware. The result is that 16-bit binaries can still run on Windows Server 2008 R2 and Windows 7 when AppLocker is configured to otherwise block binaries and libraries. If it is a requirement to prevent 16-bit applications from running, you must configure the Deny rule in the Executable rule collection for NTVDM.exe. + - You cannot use AppLocker to prevent code from running outside the Win32 subsystem. In particular, this applies to the (POSIX) subsystem in Windows NT. If it is a requirement to prevent applications from running in the POSIX subsystem, you must disable the subsystem. + - AppLocker can only control VBScript, JScript, .bat files, .cmd files and Windows PowerShell scripts. It does not control all interpreted code that runs within a host process, for example Perl scripts and macros. Interpreted code is a form of executable code that runs within a host process. For example, Windows batch files (\*.bat) run within the context of the Windows Command Host (cmd.exe). To use AppLocker to control interpreted code, the host process must call AppLocker before it runs the interpreted code, and then enforce the decision that is returned by AppLocker. Not all host processes call into AppLocker. Therefore, AppLocker cannot control every kind of interpreted code, for example Microsoft Office macros. - **Important**   - You should configure the appropriate security settings of these host processes if you must allow them to run. For example, configure the security settings in Microsoft Office to ensure that only signed and trusted macros are loaded. + + >**Important:**  You should configure the appropriate security settings of these host processes if you must allow them to run. For example, configure the security settings in Microsoft Office to ensure that only signed and trusted macros are loaded.   - AppLocker rules allow or prevent an app from launching. AppLocker does not control the behavior of apps after they are launched. Applications could contain flags that are passed to functions that signal AppLocker to circumvent the rules and allow another .exe or .dll file to be loaded. In practice, an app that is allowed by AppLocker could use these flags to bypass AppLocker rules and launch child processes. You must follow a process that best suits your needs to thoroughly vet each app before allowing them to run using AppLocker rules. + For more info, see [Security considerations for AppLocker](security-considerations-for-applocker.md).   ### Comparing Classic Windows applications and Universal Windows apps for AppLocker policy design decisions + AppLocker policies for Universal Windows apps can only be applied to apps that are installed on computers running Windows operating systems that support Windows Store apps. However, Classic Windows applications can be controlled in Windows Server 2008 R2 and Windows 7, in addition to those computers that support Universal Windows apps. The rules for Classic Windows applications and Universal Windows apps can be enforced together. The differences you should consider for Universal Windows apps are: + - All Universal Windows apps can be installed by a standard user, whereas a number of Classic Windows applications require administrative credentials to install. So in an environment where most of the users are standard users, you might not need numerous exe rules, but you might want more explicit policies for packaged apps. - Classic Windows applications can be written to change the system state if they run with administrative credentials. Most Universal Windows apps cannot change the system state because they run with limited permissions. When you design your AppLocker policies, it is important to understand whether an app that you are allowing can make system-wide changes. - Universal Windows apps can be acquired through the Store, or they can be side-loaded by using Windows PowerShell cmdlets. If you use Windows PowerShell cmdlets, a special Enterprise license is required to acquire Universal Windows apps. Classic Windows applications can be acquired through traditional means, such as through software vendors or retail distribution. + AppLocker controls Universal Windows apps and Classic Windows applications by using different rule collections. You have the choice to control Universal Windows apps, Classic Windows applications, or both. + For more info, see [Packaged apps and packaged app installer rules in AppLocker](packaged-apps-and-packaged-app-installer-rules-in-applocker.md). + ### How do you currently control app usage in your organization? + Most organizations have evolved app control policies and methods over time. With heightened security concerns and an emphasis on tighter IT control over desktop use, your organization might decide to consolidate app control practices or design a comprehensive application control scheme. AppLocker includes improvements over SRP in the architecture and management of application control policies. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Possible answersDesign considerations

      Security polices (locally set or through Group Policy)

      Using AppLocker requires increased effort in planning to create correct policies, but this results in a simpler distribution method.

      Non-Microsoft app control software

      Using AppLocker requires a complete app control policy evaluation and implementation.

      Managed usage by group or OU

      Using AppLocker requires a complete app control policy evaluation and implementation.

      Authorization Manager or other role-based access technologies

      Using AppLocker requires a complete app control policy evaluation and implementation.

      Other

      Using AppLocker requires a complete app control policy evaluation and implementation.

      + +| Possible answers | Design considerations | +| - | - | +| Security polices (locally set or through Group Policy) | Using AppLocker requires increased effort in planning to create correct policies, but this results in a simpler distribution method.| +| Non-Microsoft app control software | Using AppLocker requires a complete app control policy evaluation and implementation.| +| Managed usage by group or OU | Using AppLocker requires a complete app control policy evaluation and implementation.| +| Authorization Manager or other role-based access technologies | Using AppLocker requires a complete app control policy evaluation and implementation.| +| Other | Using AppLocker requires a complete app control policy evaluation and implementation.|   ### Which Windows desktop and server operating systems are running in your organization? + If your organization supports multiple Windows operating systems, app control policy planning becomes more complex. Your initial design decisions should consider the security and management priorities of applications that are installed on each version of the operating system. @@ -172,259 +135,94 @@ If your organization supports multiple Windows operating systems, app control po
        ### Are there specific groups in your organization that need customized application control policies? + Most business groups or departments have specific security requirements that pertain to data access and the applications used to access that data. You should consider the scope of the project for each group and the group’s priorities before you deploy application control policies for the entire organization. - ---- - - - - - - - - - - - - - - - - -
      Possible answersDesign considerations

      Yes

      -

      For each group, you need to create a list that includes their application control requirements. Although this may increase the planning time, it will most likely result in a more effective deployment.

      -

      If your GPO structure is not currently configured so that you can apply different policies to specific groups, you can alternatively apply AppLocker rules in a GPO to specific user groups.

      No

      AppLocker policies can be applied globally to applications that are installed on PCs running the supported versions of Windows as listed in [Requirements to use AppLocker](requirements-to-use-applocker.md). Depending on the number of apps you need to control, managing all the rules and exceptions might be challenging.

      + +| Possible answers | Design considerations | +| - | - | +| Yes | For each group, you need to create a list that includes their application control requirements. Although this may increase the planning time, it will most likely result in a more effective deployment.
      If your GPO structure is not currently configured so that you can apply different policies to specific groups, you can alternatively apply AppLocker rules in a GPO to specific user groups.| +| No | AppLocker policies can be applied globally to applications that are installed on PCs running the supported versions of Windows as listed in [Requirements to use AppLocker](requirements-to-use-applocker.md). Depending on the number of apps you need to control, managing all the rules and exceptions might be challenging.|   ### Does your IT department have resources to analyze application usage, and to design and manage the policies? + The time and resources that are available to you to perform the research and analysis can affect the detail of your plan and processes for continuing policy management and maintenance. - ---- - - - - - - - - - - - - - - - - -
      Possible answersDesign considerations

      Yes

      Invest the time to analyze your organization's application control requirements, and plan a complete deployment that uses rules that are as simply constructed as possible.

      No

      Consider a focused and phased deployment for specific groups by using a small number of rules. As you apply controls to applications in a specific group, learn from that deployment to plan your next deployment.

      + +| Possible answers | Design considerations | +| - | - | +| Yes | Invest the time to analyze your organization's application control requirements, and plan a complete deployment that uses rules that are as simply constructed as possible.| +| No | Consider a focused and phased deployment for specific groups by using a small number of rules. As you apply controls to applications in a specific group, learn from that deployment to plan your next deployment. |   ### Does your organization have Help Desk support? + Preventing your users from accessing known, deployed, or personal applications will initially cause an increase in end-user support. It will be necessary to address the various support issues in your organization so security policies are followed and business workflow is not hampered. - ---- - - - - - - - - - - - - - - - - -
      Possible answersDesign considerations

      Yes

      Involve the support department early in the planning phase because your users may inadvertently be blocked from using their applications, or they may seek exceptions to use specific applications.

      No

      Invest time in developing online support processes and documentation before deployment.

      + +| Possible answers | Design considerations | +| - | - | +| Yes | Involve the support department early in the planning phase because your users may inadvertently be blocked from using their applications, or they may seek exceptions to use specific applications. | +| No | Invest time in developing online support processes and documentation before deployment. | +   ### Do you know what applications require restrictive policies? Any successful application control policy implementation is based on your knowledge and understanding of app usage within the organization or business group. In addition, the application control design is dependent on the security requirements for data and the apps that access that data. - ---- - - - - - - - - - - - - - - - - -
      Possible answersDesign considerations

      Yes

      You should determine the application control priorities for a business group and then attempt to design the simplest scheme for their application control policies.

      No

      You will have to perform an audit and requirements gathering project to discover the application usage. AppLocker provides the means to deploy policies in Audit only mode, and tools to view the event logs.

      + +| Possible answers | Design considerations | +| - | - | +| Yes | You should determine the application control priorities for a business group and then attempt to design the simplest scheme for their application control policies. | +| No | You will have to perform an audit and requirements gathering project to discover the application usage. AppLocker provides the means to deploy policies in **Audit only** mode, and tools to view the event logs.|   ### How do you deploy or sanction applications (upgraded or new) in your organization? + Implementing a successful application control policy is based on your knowledge and understanding of application usage within the organization or business group. In addition, the application control design is dependent on the security requirements for data and the applications that access that data. Understanding the upgrade and deployment policy will help shape the construction of the application control policies. - ---- - - - - - - - - - - - - - - - - - - - - -
      Possible answersDesign considerations

      Ad hoc

      You need to gather requirements from each group. Some groups might want unrestricted access or installation, while other groups might want strict controls.

      Strict written policy or guidelines to follow

      You need to develop AppLocker rules that reflect those policies, and then test and maintain the rules.

      No process in place

      You need to determine if you have the resources to develop an application control policy, and for which groups.

      + +| Possible answers | Design considerations | +| - | - | +| Ad hoc | You need to gather requirements from each group. Some groups might want unrestricted access or installation, while other groups might want strict controls.| +| Strict written policy or guidelines to follow | You need to develop AppLocker rules that reflect those policies, and then test and maintain the rules. | +| No process in place | You need to determine if you have the resources to develop an application control policy, and for which groups. | +   ### Does your organization already have SRP deployed? + Although SRP and AppLocker have the same goal, AppLocker is a major revision of SRP. - ---- - - - - - - - - - - - - - - - - -
      Possible answersDesign considerations

      Yes

      You cannot use AppLocker to manage SRP settings, but you can use SRP to manage application control policies on computers running on any of the supported operating systems listed in [Requirements to use AppLocker](requirements-to-use-applocker.md). In addition, if AppLocker and SRP settings are configured in the same GPO, only the AppLocker settings will be enforced on computers running those supported operating systems.

      -
      -Note   -

      If you are using the Basic User security level as assigned in SRP, those permissions are not supported on computers running the supported operating systems.

      -
      -
      -  -

      No

      Policies that are configured for AppLocker can only be applied to computers running the supported operating systems, but SRP is also available on those operating systems.

      + +| Possible answers | Design considerations | +| - | - | +| Yes | You cannot use AppLocker to manage SRP settings, but you can use SRP to manage application control policies on computers running on any of the supported operating systems listed in [Requirements to use AppLocker](requirements-to-use-applocker.md). In addition, if AppLocker and SRP settings are configured in the same GPO, only the AppLocker settings will be enforced on computers running those supported operating systems.

      **Note:** If you are using the Basic User security level as assigned in SRP, those permissions are not supported on computers running the supported operating systems.| +| No | Policies that are configured for AppLocker can only be applied to computers running the supported operating systems, but SRP is also available on those operating systems. |   ### What are your organization's priorities when implementing application control policies? + Some organizations will benefit from application control policies as shown by an increase in productivity or conformance, while others will be hindered in performing their duties. Prioritize these aspects for each group to allow you to evaluate the effectiveness of AppLocker. - ---- - - - - - - - - - - - - - - - - - - - - -
      Possible answersDesign considerations

      Productivity: The organization assures that tools work and required applications can be installed.

      To meet innovation and productivity goals, some groups require the ability to install and run a variety of software from different sources, including software that they developed. Therefore, if innovation and productivity is a high priority, managing application control policies through an allowed list might be time consuming and an impediment to progress.

      Management: The organization is aware of and controls the apps it supports.

      In some business groups, application usage can be managed from a central point of control. AppLocker policies can be built into a GPO for that purpose. This shifts the burden of app access to the IT department, but it also has the benefit of controlling the number of apps that can be run and controlling the versions of those apps

      Security: The organization must protect data in part by ensuring that only approved apps are used.

      AppLocker can help protect data by allowing a defined set of users access to apps that access the data. If security is the top priority, the application control policies will be the most restrictive.

      + +| Possible answers | Design considerations | +| - | - | +| Productivity: The organization assures that tools work and required applications can be installed. | To meet innovation and productivity goals, some groups require the ability to install and run a variety of software from different sources, including software that they developed. Therefore, if innovation and productivity is a high priority, managing application control policies through an allowed list might be time consuming and an impediment to progress. | +| Management: The organization is aware of and controls the apps it supports. | In some business groups, application usage can be managed from a central point of control. AppLocker policies can be built into a GPO for that purpose. This shifts the burden of app access to the IT department, but it also has the benefit of controlling the number of apps that can be run and controlling the versions of those apps| +| Security: The organization must protect data in part by ensuring that only approved apps are used. | AppLocker can help protect data by allowing a defined set of users access to apps that access the data. If security is the top priority, the application control policies will be the most restrictive.|   ### How are apps currently accessed in your organization? + AppLocker is very effective for organizations that have application restriction requirements if they have environments with a simple topography and application control policy goals that are straightforward. For example, AppLocker can benefit an environment where non-employees have access to computers that are connected to the organizational network, such as a school or library. Large organizations also benefit from AppLocker policy deployment when the goal is to achieve a detailed level of control on the desktop computers with a relatively small number of applications to manage, or when the applications are manageable with a small number of rules. - ---- - - - - - - - - - - - - - - - - -
      Possible answersDesign considerations

      Users run without administrative rights.

      -

      Apps are installed by using an installation deployment technology.

      AppLocker can help reduce the total cost of ownership for business groups that typically use a finite set of apps, such as human resources and finance departments. At the same time, these departments access highly sensitive information, much of which contains confidential and proprietary information. By using AppLocker to create rules for specific apps that are allowed to run, you can help limit unauthorized applications from accessing this information.

      -
      -Note   -

      AppLocker can also be effective in helping create standardized desktops in organizations where users run as administrators. However, it is important to note that users with administrative credentials can add new rules to the local AppLocker policy.

      -
      -
      -  -

      Users must be able to install applications as needed.

      -

      Users currently have administrator access, and it would be difficult to change this.

      Enforcing AppLocker rules is not suited for business groups that must be able to install apps as needed and without approval from the IT department. If one or more OUs in your organization has this requirement, you can choose not to enforce application rules in those OUs by using AppLocker or to implement the Audit only enforcement setting through AppLocker.

      + +| Possible answers | Design considerations | +| - | - | +| Users run without administrative rights. | Apps are installed by using an installation deployment technology.| +| AppLocker can help reduce the total cost of ownership for business groups that typically use a finite set of apps, such as human resources and finance departments. At the same time, these departments access highly sensitive information, much of which contains confidential and proprietary information. By using AppLocker to create rules for specific apps that are allowed to run, you can help limit unauthorized applications from accessing this information.
      **Note: **AppLocker can also be effective in helping create standardized desktops in organizations where users run as administrators. However, it is important to note that users with administrative credentials can add new rules to the local AppLocker policy.| Users must be able to install applications as needed. +| Users currently have administrator access, and it would be difficult to change this.|Enforcing AppLocker rules is not suited for business groups that must be able to install apps as needed and without approval from the IT department. If one or more OUs in your organization has this requirement, you can choose not to enforce application rules in those OUs by using AppLocker or to implement the **Audit only** enforcement setting through AppLocker.|   ### Is the structure in Active Directory Domain Services based on the organization's hierarchy? -Designing application control policies based on an organizational structure that is already built into Active Directory Domain Services (AD DS) is easier than converting the existing structure to an organizational structure. Because the effectiveness of application control policies is dependent on the ability to update policies, consider what organizational work needs to be accomplished before deployment begins. - ---- - - - - - - - - - - - - - - - - -
      Possible answersDesign considerations

      Yes

      AppLocker rules can be developed and implemented through Group Policy, based on your AD DS structure.

      No

      The IT department must create a scheme to identify how application control policies can be applied to the correct user or computer.

      + +Designing application control policies based on an organizational structure that is already built into Active Directory Domain Services (AD DS) is easier than converting the existing structure to an organizational structure. +Because the effectiveness of application control policies is dependent on the ability to update policies, consider what organizational work needs to be accomplished before deployment begins. + +| Possible answers | Design considerations | +| - | - | +| Yes | AppLocker rules can be developed and implemented through Group Policy, based on your AD DS structure.| +| No | The IT department must create a scheme to identify how application control policies can be applied to the correct user or computer.|   ## Record your findings + The next step in the process is to record and analyze your answers to the preceding questions. If AppLocker is the right solution for your goals, tyou can set your application control policy objectives and plan your AppLocker rules. This process culminates in creating your planning document. + - For info about setting your policy goals, see [Determine your application control objectives](determine-your-application-control-objectives.md). - For info about creating your planning document, see [Create your AppLocker planning document](create-your-applocker-planning-document.md). -  -  diff --git a/windows/keep-secure/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md b/windows/keep-secure/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md index c4438ba57b..066f32d60e 100644 --- a/windows/keep-secure/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md +++ b/windows/keep-secure/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md @@ -2,34 +2,43 @@ title: Understand AppLocker rules and enforcement setting inheritance in Group Policy (Windows 10) description: This topic for the IT professional describes how application control policies configured in AppLocker are applied through Group Policy. ms.assetid: c1c5a3d3-540a-4698-83b5-0dab5d27d871 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Understand AppLocker rules and enforcement setting inheritance in Group Policy + **Applies to** - Windows 10 + This topic for the IT professional describes how application control policies configured in AppLocker are applied through Group Policy. + Rule enforcement is applied only to collections of rules, not individual rules. AppLocker divides the rules into the following collections: executable files, Windows Installer files, scripts, packaged apps and packaged app installers, and DLL files. The options for rule enforcement are **Not configured**, **Enforce rules**, or **Audit only**. Together, all AppLocker rule collections compose the application control policy, or AppLocker policy. + Group Policy merges AppLocker policy in two ways: + - **Rules.** Group Policy does not overwrite or replace rules that are already present in a linked Group Policy Object (GPO). For example, if the current GPO has 12 rules and a linked GPO has 50 rules, 62 rules are applied to all computers that receive the AppLocker policy. - **Important**   - When determining whether a file is permitted to run, AppLocker processes rules in the following order: + >**Important:**  When determining whether a file is permitted to run, AppLocker processes rules in the following order: + 1. **Explicit deny.** An administrator created a rule to deny a file. 2. **Explicit allow.** An administrator created a rule to allow a file. 3. **Implicit deny.** This is also called the default deny because all files that are not affected by an allow rule are automatically blocked.   - **Enforcement settings.** The last write to the policy is applied. For example, if a higher-level GPO has the enforcement setting configured to **Enforce rules** and the closest GPO has the setting configured to **Audit only**, **Audit only** is enforced. If enforcement is not configured on the closest GPO, the setting from the closest linked GPO will be enforced. Because a computer's effective policy includes rules from each linked GPO, duplicate rules or conflicting rules could be enforced on a user's computer. Therefore, you should carefully plan your deployment to ensure that only rules that are necessary are present in a GPO. + The following figure demonstrates how AppLocker rule enforcement is applied through linked GPOs. + ![applocker rule enforcement inheritance chart](images/applocker-plan-inheritance.gif) + In the preceding illustration, note that all GPOs linked to Contoso are applied in order as configured. The rules that are not configured are also applied. For example, the result of the Contoso and Human Resources GPOs is 33 rules enforced, as shown in the client HR-Term1. The Human Resources GPO contains 10 non-configured rules. When the rule collection is configured for **Audit only**, no rules are enforced. + When constructing the Group Policy architecture for applying AppLocker policies, it is important to remember: + - Rule collections that are not configured will be enforced. - Group Policy does not overwrite or replace rules that are already present in a linked GPO. - AppLocker processes the explicit deny rule configuration before the allow rule configuration. - For rule enforcement, the last write to the GPO is applied. -  -  diff --git a/windows/keep-secure/understand-the-applocker-policy-deployment-process.md b/windows/keep-secure/understand-the-applocker-policy-deployment-process.md index 225dc8c0c2..76bbb8d904 100644 --- a/windows/keep-secure/understand-the-applocker-policy-deployment-process.md +++ b/windows/keep-secure/understand-the-applocker-policy-deployment-process.md @@ -2,21 +2,30 @@ title: Understand the AppLocker policy deployment process (Windows 10) description: This planning and deployment topic for the IT professional describes the process for using AppLocker when deploying application control policies. ms.assetid: 4cfd95c1-fbd3-41fa-8efc-d23c1ea6fb16 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Understand the AppLocker policy deployment process + **Applies to** - Windows 10 + This planning and deployment topic for the IT professional describes the process for using AppLocker when deploying application control policies. + To successfully deploy AppLocker policies, you need to identify your application control objectives and construct the policies for those objectives. The key to the process is taking an accurate inventory of your organization's applications, which requires investigation of all the targeted business groups. With an accurate inventory, you can create rules and set enforcement criteria that will allow the organization to use the required applications and allow the IT department to manage a controlled set of applications. + The following diagram shows the main points in the design, planning, and deployment process for AppLocker. + ![applocker quick reference guide](images/applocker-plandeploy-quickreference.gif) + ## Resources to support the deployment process + The following topics contain information about designing, planning, deploying, and maintaining AppLocker policies: + - For info about the AppLocker policy design and planning requirements and process, see [AppLocker Design Guide](applocker-policies-design-guide.md). - For info about the AppLocker policy deployment requirements and process, see [AppLocker deployment guide](applocker-policies-deployment-guide.md). - For info about AppLocker policy maintenance and monitoring, see [Administer AppLocker](administer-applocker.md). diff --git a/windows/keep-secure/understanding-applocker-allow-and-deny-actions-on-rules.md b/windows/keep-secure/understanding-applocker-allow-and-deny-actions-on-rules.md index 30f5de5bcc..b6d8502af0 100644 --- a/windows/keep-secure/understanding-applocker-allow-and-deny-actions-on-rules.md +++ b/windows/keep-secure/understanding-applocker-allow-and-deny-actions-on-rules.md @@ -2,52 +2,38 @@ title: Understanding AppLocker allow and deny actions on rules (Windows 10) description: This topic explains the differences between allow and deny actions on AppLocker rules. ms.assetid: ea0370fa-2086-46b5-a0a4-4a7ead8cbed9 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Understanding AppLocker allow and deny actions on rules + **Applies to** - Windows 10 + This topic explains the differences between allow and deny actions on AppLocker rules. + ## Allow action versus deny action on rules + Unlike Software Restriction Policies (SRP), each AppLocker rule collection functions as an allowed list of files. Only the files that are listed within the rule collection are allowed to run. This configuration makes it easier to determine what will occur when an AppLocker rule is applied. + You can also create rules that use the deny action. When applying rules, AppLocker first checks whether any explicit deny actions are specified in the rule list. If you have denied a file from running in a rule collection, the deny action will take precedence over any allow action, regardless of which Group Policy Object (GPO) the rule was originally applied in. Because AppLocker functions as an allowed list by default, if no rule explicitly allows or denies a file from running, AppLocker's default deny action will block the file. + ### Deny rule considerations + Although you can use AppLocker to create a rule to allow all files to run and then use rules to deny specific files, this configuration is not recommended. The deny action is generally less secure than the allow action because a malicious user could modify the file to invalidate the rule. Deny actions can also be circumvented. For example, if you configure a deny action for a file or folder path, the user can still run the file from any other path. The following table details security concerns for different rule conditions with deny actions. - ---- - - - - - - - - - - - - - - - - - - - - -
      Rule conditionSecurity concern with deny action

      Publisher

      A user could modify the properties of a file (for example, re-signing the file with a different certificate).

      File hash

      A user could modify the hash for a file.

      Path

      A user could move the denied file to a different location and run it from there.

      + +| Rule condition | Security concern with deny action | +| - | - | +| Publisher | A user could modify the properties of a file (for example, re-signing the file with a different certificate).| +| File hash | A user could modify the hash for a file.| +| Path | A user could move the denied file to a different location and run it from there.|   -**Important**   -If you choose to use the deny action on rules, you must ensure that you first create rules that allow the Windows system files to run. AppLocker enforces rules for allowed applications by default, so after one or more rules have been created for a rule collection (affecting the Windows system files), only the apps that are listed as being allowed will be permitted to run. Therefore, creating a single rule in a rule collection to deny a malicious file from running will also deny all other files on the computer from running. +>**Important:**  If you choose to use the deny action on rules, you must ensure that you first create rules that allow the Windows system files to run. AppLocker enforces rules for allowed applications by default, so after one or more rules have been created for a rule collection (affecting the Windows system files), only the apps that are listed as being allowed will be permitted to run. Therefore, creating a single rule in a rule collection to deny a malicious file from running will also deny all other files on the computer from running.   ## Related topics -[How AppLocker works](how-applocker-works-techref.md) -  -  + +- [How AppLocker works](how-applocker-works-techref.md) diff --git a/windows/keep-secure/understanding-applocker-default-rules.md b/windows/keep-secure/understanding-applocker-default-rules.md index cf10480b26..76aa56e251 100644 --- a/windows/keep-secure/understanding-applocker-default-rules.md +++ b/windows/keep-secure/understanding-applocker-default-rules.md @@ -2,62 +2,45 @@ title: Understanding AppLocker default rules (Windows 10) description: This topic for IT professional describes the set of rules that can be used to ensure that required Windows system files are allowed to run when the policy is applied. ms.assetid: bdb03d71-05b7-41fb-96e3-a289ce1866e1 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Understanding AppLocker default rules + **Applies to** - Windows 10 + This topic for IT professional describes the set of rules that can be used to ensure that required Windows system files are allowed to run when the policy is applied. + AppLocker includes default rules for each rule collection. These rules are intended to help ensure that the files that are required for Windows to operate properly are allowed in an AppLocker rule collection. -**Important**   -You can use the default rules as a template when creating your own rules. However, these rules are only meant to function as a starter policy when you are first testing AppLocker rules so that the system files in the Windows folders will be allowed to run. + +>**Important:**  You can use the default rules as a template when creating your own rules. However, these rules are only meant to function as a starter policy when you are first testing AppLocker rules so that the system files in the Windows folders will be allowed to run.   -If you require additional app security, you might need to modify the rules created from the built-in default rule collection. For example, the default rule to allow all users to run .exe files in the Windows folder is based on a path condition that allows all files within the Windows folder to run. The Windows folder contains a Temp subfolder to which the Users group is given the following permissions: +If you require additional app security, you might need to modify the rules created from the built-in default rule collection. For example, the default rule to allow all users to run .exe files in the Windows folder is based on a path condition that allows all files within the Windows folder to run. +The Windows folder contains a Temp subfolder to which the Users group is given the following permissions: + - Traverse Folder/Execute File - Create Files/Write Data - Create Folders/Append Data + These permissions settings are applied to this folder for app compatibility. However, because any user can create files in this location, allowing applications to be run from this location might conflict with your organization's security policy. + ## In this section - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      TopicDescription

      [Executable rules in AppLocker](executable-rules-in-applocker.md)

      This topic describes the file formats and available default rules for the executable rule collection.

      [Windows Installer rules in AppLocker](windows-installer-rules-in-applocker.md)

      This topic describes the file formats and available default rules for the Windows Installer rule collection.

      [Script rules in AppLocker](script-rules-in-applocker.md)

      This topic describes the file formats and available default rules for the script rule collection.

      [DLL rules in AppLocker](dll-rules-in-applocker.md)

      This topic describes the file formats and available default rules for the DLL rule collection.

      [Packaged apps and packaged app installer rules in AppLocker](packaged-apps-and-packaged-app-installer-rules-in-applocker.md)

      This topic explains the AppLocker rule collection for packaged app installers and packaged apps.

      + +| Topic | Description | +| - | - | +| [Executable rules in AppLocker](executable-rules-in-applocker.md) | This topic describes the file formats and available default rules for the executable rule collection. | +| [Windows Installer rules in AppLocker](windows-installer-rules-in-applocker.md) | This topic describes the file formats and available default rules for the Windows Installer rule collection.| +| [Script rules in AppLocker](script-rules-in-applocker.md) | This topic describes the file formats and available default rules for the script rule collection.| +| [DLL rules in AppLocker](dll-rules-in-applocker.md) | This topic describes the file formats and available default rules for the DLL rule collection.| +| [Packaged apps and packaged app installer rules in AppLocker](packaged-apps-and-packaged-app-installer-rules-in-applocker.md) | This topic explains the AppLocker rule collection for packaged app installers and packaged apps.|   ## Related topics -[How AppLocker works](how-applocker-works-techref.md) + +- [How AppLocker works](how-applocker-works-techref.md)     diff --git a/windows/keep-secure/understanding-applocker-rule-behavior.md b/windows/keep-secure/understanding-applocker-rule-behavior.md index b065509210..2e1353c3ed 100644 --- a/windows/keep-secure/understanding-applocker-rule-behavior.md +++ b/windows/keep-secure/understanding-applocker-rule-behavior.md @@ -2,24 +2,29 @@ title: Understanding AppLocker rule behavior (Windows 10) description: This topic describes how AppLocker rules are enforced by using the allow and deny options in AppLocker. ms.assetid: 3e2738a3-8041-4095-8a84-45c1894c97d0 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Understanding AppLocker rule behavior + **Applies to** - Windows 10 + This topic describes how AppLocker rules are enforced by using the allow and deny options in AppLocker. + If no AppLocker rules for a specific rule collection exist, all files with that file format are allowed to run. However, when an AppLocker rule for a specific rule collection is created, only the files explicitly allowed in a rule are permitted to run. For example, if you create an executable rule that allows .exe files in *%SystemDrive%\\FilePath* to run, only executable files located in that path are allowed to run. + A rule can be configured to use either an allow or deny action: + - **Allow**. You can specify which files are allowed to run in your environment and for which users or groups of users. You can also configure exceptions to identify files that are excluded from the rule. - **Deny**. You can specify which files are not allowed to run in your environment and for which users or groups of users. You can also configure exceptions to identify files that are excluded from the rule. -**Important**   -You can use a combination of allow actions and deny actions. However, we recommend using allow actions with exceptions because deny actions override allow actions in all cases. Deny actions can also be circumvented. For example, if you configure a deny action for a file or folder path, the user can still run the file from any other path. + +>**Important:**  You can use a combination of allow actions and deny actions. However, we recommend using allow actions with exceptions because deny actions override allow actions in all cases. Deny actions can also be circumvented. For example, if you configure a deny action for a file or folder path, the user can still run the file from any other path.   ## Related topics -[How AppLocker works](how-applocker-works-techref.md) -  -  + +- [How AppLocker works](how-applocker-works-techref.md) diff --git a/windows/keep-secure/understanding-applocker-rule-collections.md b/windows/keep-secure/understanding-applocker-rule-collections.md index 950a47ebfe..9c569f7f53 100644 --- a/windows/keep-secure/understanding-applocker-rule-collections.md +++ b/windows/keep-secure/understanding-applocker-rule-collections.md @@ -2,28 +2,34 @@ title: Understanding AppLocker rule collections (Windows 10) description: This topic explains the five different types of AppLocker rules used to enforce AppLocker policies. ms.assetid: 03c05466-4fb3-4880-8d3c-0f6f59fc5579 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Understanding AppLocker rule collections + **Applies to** - Windows 10 + This topic explains the five different types of AppLocker rules used to enforce AppLocker policies. + An AppLocker rule collection is a set of rules that apply to one of five types: + - Executable files: .exe and .com - Windows Installer files: .msi, mst, and .msp - Scripts: .ps1, .bat, .cmd, .vbs, and .js - DLLs: .dll and .ocx - Packaged apps and packaged app installers: .appx + If you use DLL rules, a DLL allow rule has to be created for each DLL that is used by all of the allowed apps. -**Important**   -Each app can load several DLLs, and AppLocker must check each DLL before it is allowed to run. Therefore, creating DLL rules might cause performance problems on some computers. Denying some DLLs from running can also create app compatibility problems. As a result, the DLL rule collection is not enabled by default. + +>**Important:**  Each app can load several DLLs, and AppLocker must check each DLL before it is allowed to run. Therefore, creating DLL rules might cause performance problems on some computers. Denying some DLLs from running can also create app compatibility problems. As a result, the DLL rule collection is not enabled by default.   For info about how to enable the DLL rule collection, see [Enable the DLL rule collection](enable-the-dll-rule-collection.md). + ## Related topics -[How AppLocker works](how-applocker-works-techref.md) -  -  + +- [How AppLocker works](how-applocker-works-techref.md) diff --git a/windows/keep-secure/understanding-applocker-rule-condition-types.md b/windows/keep-secure/understanding-applocker-rule-condition-types.md index e6b6e8505a..d4e6ceaf84 100644 --- a/windows/keep-secure/understanding-applocker-rule-condition-types.md +++ b/windows/keep-secure/understanding-applocker-rule-condition-types.md @@ -2,39 +2,55 @@ title: Understanding AppLocker rule condition types (Windows 10) description: This topic for the IT professional describes the three types of AppLocker rule conditions. ms.assetid: c21af67f-60a1-4f7d-952c-a6f769c74729 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Understanding AppLocker rule condition types + **Applies to** - Windows 10 + This topic for the IT professional describes the three types of AppLocker rule conditions. + Rule conditions are criteria that the AppLocker rule is based on. Primary conditions are required to create an AppLocker rule. The three primary rule conditions are publisher, path, and file hash. + **Publisher** + To use a publisher condition, the files must be digitally signed by the software publisher, or you must do so by using an internal certificate. Rules that are specified to the version level might have to be updated when a new version of the file is released. For more info about this rule condition, see [Understanding the publisher rule condition in AppLocker](understanding-the-publisher-rule-condition-in-applocker.md). + **Path** + Any file can be assigned this rule condition; however, because path rules specify locations within the file system, any subdirectory will also be affected by the rule (unless explicitly exempted). For more info about this rule condition, see [Understanding the path rule condition in AppLocker](understanding-the-path-rule-condition-in-applocker.md). + **File hash** + Any file can be assigned this rule condition; however, the rule must be updated each time a new version of the file is released because the hash value is unique to that the version of the file. For more info about this rule condition, see [Understanding the file hash rule condition in AppLocker](understanding-the-file-hash-rule-condition-in-applocker.md). + ### Considerations + Selecting the appropriate condition for each rule depends on the overall application control policy goals of the organization, the AppLocker rule maintenance goals, and the condition of the existing (or planned) application deployment. The following questions can help you decide which rule condition to use. + 1. Is the file digitally signed by a software publisher? + If the file is signed by a software publisher, we recommend that you create rules with publisher conditions. You may still create file hash and path conditions for signed files. However, if the file is not digitally signed by a software publisher, you can: + - Sign the file by using an internal certificate. - Create a rule by using a file hash condition. - Create a rule by using a path condition. - **Note**   - To determine how many applications on a reference computer are digitally signed, you can use the **Get-AppLockerFileInformation** Windows PowerShell cmdlet for a directory of files. For example, `Get-AppLockerFileInformation –Directory C:\Windows\ -FileType EXE -recurse` displays the properties for all .exe and .com files within the Windows directory. + + >**Note:**  To determine how many applications on a reference computer are digitally signed, you can use the **Get-AppLockerFileInformation** Windows PowerShell cmdlet for a directory of files. For example, + `Get-AppLockerFileInformation –Directory C:\Windows\ -FileType EXE -recurse` displays the properties for all .exe and .com files within the Windows directory.   2. What rule condition type does your organization prefer? + If your organization is already using Software Restriction Policies (SRP) to restrict what files users can run, rules using file hash or path conditions are probably already in place. - **Note**   - For a list of supported operating system versions and editions to which SRP and AppLocker rules can be applied, see [Requirements to use AppLocker](requirements-to-use-applocker.md). + + >**Note:**  For a list of supported operating system versions and editions to which SRP and AppLocker rules can be applied, see [Requirements to use AppLocker](requirements-to-use-applocker.md).   ## Related topics -[How AppLocker works](how-applocker-works-techref.md) -  -  + +- [How AppLocker works](how-applocker-works-techref.md) diff --git a/windows/keep-secure/understanding-applocker-rule-exceptions.md b/windows/keep-secure/understanding-applocker-rule-exceptions.md index 0a89f17cc7..a99cb1f8cb 100644 --- a/windows/keep-secure/understanding-applocker-rule-exceptions.md +++ b/windows/keep-secure/understanding-applocker-rule-exceptions.md @@ -2,19 +2,24 @@ title: Understanding AppLocker rule exceptions (Windows 10) description: This topic describes the result of applying AppLocker rule exceptions to rule collections. ms.assetid: e6bb349f-ee60-4c8d-91cd-6442f2d0eb9c -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Understanding AppLocker rule exceptions + **Applies to** - Windows 10 + This topic describes the result of applying AppLocker rule exceptions to rule collections. + You can apply AppLocker rules to individual users or a group of users. If you apply a rule to a group of users, all users in that group are affected by that rule. If you need to allow a subset of a user group to use an app, you can create a special rule for that subset. + For example, the rule "Allow Everyone to run Windows except Registry Editor" allows everyone in the organization to run Windows but does not allow anyone to run Registry Editor. The effect of this rule would prevent users such as help desk personnel from running a program that is necessary for their support tasks. To resolve this problem, create a second rule that applies to the Helpdesk user group: "Allow Helpdesk to run Registry Editor." If you create a deny rule that does not allow any users to run Registry Editor, the deny rule will override the second rule that allows the Helpdesk user group to run Registry Editor. + ## Related topics -[How AppLocker works](how-applocker-works-techref.md) -  -  + +- [How AppLocker works](how-applocker-works-techref.md) diff --git a/windows/keep-secure/understanding-the-file-hash-rule-condition-in-applocker.md b/windows/keep-secure/understanding-the-file-hash-rule-condition-in-applocker.md index 1be8c8cc55..b778f3c76d 100644 --- a/windows/keep-secure/understanding-the-file-hash-rule-condition-in-applocker.md +++ b/windows/keep-secure/understanding-the-file-hash-rule-condition-in-applocker.md @@ -2,38 +2,28 @@ title: Understanding the file hash rule condition in AppLocker (Windows 10) description: This topic explains the AppLocker file hash rule condition, the advantages and disadvantages, and how it is applied. ms.assetid: 4c6d9af4-2b1a-40f4-8758-1a6f9f147756 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Understanding the file hash rule condition in AppLocker + **Applies to** - Windows 10 + This topic explains the AppLocker file hash rule condition, the advantages and disadvantages, and how it is applied. + File hash rules use a system-computed cryptographic hash of the identified file. For files that are not digitally signed, file hash rules are more secure than path rules. The following table describes the advantages and disadvantages of the file hash condition. - ---- - - - - - - - - - - - - -
      File hash condition advantagesFile hash condition disadvantages

      Because each file has a unique hash, a file hash condition applies to only one file.

      Each time that the file is updated (such as a security update or upgrade), the file's hash will change. As a result, you must manually update file hash rules.

      + +| File hash condition advantages | File hash condition disadvantages | +| - | - | +| Because each file has a unique hash, a file hash condition applies to only one file. | Each time that the file is updated (such as a security update or upgrade), the file's hash will change. As a result, you must manually update file hash rules.|   For an overview of the three types of AppLocker rule conditions and explanations of the advantages and disadvantages of each, see [Understanding AppLocker rule condition types](understanding-applocker-rule-condition-types.md). + ## Related topics -[How AppLocker works](how-applocker-works-techref.md) -  -  + +- [How AppLocker works](how-applocker-works-techref.md) diff --git a/windows/keep-secure/understanding-the-path-rule-condition-in-applocker.md b/windows/keep-secure/understanding-the-path-rule-condition-in-applocker.md index 2adb70d6c6..d62cf0c8b6 100644 --- a/windows/keep-secure/understanding-the-path-rule-condition-in-applocker.md +++ b/windows/keep-secure/understanding-the-path-rule-condition-in-applocker.md @@ -2,18 +2,24 @@ title: Understanding the path rule condition in AppLocker (Windows 10) description: This topic explains the AppLocker path rule condition, the advantages and disadvantages, and how it is applied. ms.assetid: 3fa54ded-4466-4f72-bea4-2612031cad43 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Understanding the path rule condition in AppLocker + **Applies to** - Windows 10 + This topic explains the AppLocker path rule condition, the advantages and disadvantages, and how it is applied. + The path condition identifies an application by its location in the file system of the computer or on the network. + When creating a rule that uses a deny action, path conditions are less secure than publisher and file hash conditions for preventing access to a file because a user could easily copy the file to a different location than the location specified in the rule. Because path rules specify locations within the file system, you should ensure that there are no subdirectories that are writable by non-administrators. For example, if you create a path rule for C:\\ with the allow action, any file under that location will be allowed to run, including within users' profiles. The following table describes the advantages and disadvantages of the path condition. + @@ -40,57 +46,22 @@ When creating a rule that uses a deny action, path conditions are less secure th
        AppLocker does not enforce rules that specify paths with short names. You should always specify the full path to a file or folder when creating path rules so that the rule will be properly enforced. + The asterisk (\*) wildcard character can be used within **Path** field. The asterisk (\*) character used by itself represents any path. When combined with any string value, the rule is limited to the path of the file and all the files under that path. For example, %ProgramFiles%\\Internet Explorer\\\* indicates that all files and subfolders within the Internet Explorer folder will be affected by the rule. + AppLocker uses path variables for well-known directories in Windows. Path variables are not environment variables. The AppLocker engine can only interpret AppLocker path variables. The following table details these path variables. - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Windows directory or driveAppLocker path variableWindows environment variable

      Windows

      %WINDIR%

      %SystemRoot%

      System32

      %SYSTEM32%

      %SystemDirectory%

      Windows installation directory

      %OSDRIVE%

      %SystemDrive%

      Program Files

      %PROGRAMFILES%

      %ProgramFiles% and %ProgramFiles(x86)%

      Removable media (for example, CD or DVD)

      %REMOVABLE%

      Removable storage device (for example, USB flash drive)

      %HOT%

      + +| Windows directory or drive | AppLocker path variable | Windows environment variable | +| - | - | - | +| Windows | %WINDIR% | %SystemRoot% | +| System32 | %SYSTEM32%| %SystemDirectory%| +| Windows installation directory | %OSDRIVE%|%SystemDrive%| +| Program Files | %PROGRAMFILES%| %ProgramFiles% and %ProgramFiles(x86)%| +| Removable media (for example, CD or DVD) | %REMOVABLE%| | +| Removable storage device (for example, USB flash drive)| %HOT%|||   For an overview of the three types of AppLocker rule conditions and explanations of the advantages and disadvantages of each, see [Understanding AppLocker rule condition types](understanding-applocker-rule-condition-types.md). + ## Related topics -[How AppLocker works](how-applocker-works-techref.md) -  -  + +- [How AppLocker works](how-applocker-works-techref.md) diff --git a/windows/keep-secure/understanding-the-publisher-rule-condition-in-applocker.md b/windows/keep-secure/understanding-the-publisher-rule-condition-in-applocker.md index 053ee2e59c..34ac6444f3 100644 --- a/windows/keep-secure/understanding-the-publisher-rule-condition-in-applocker.md +++ b/windows/keep-secure/understanding-the-publisher-rule-condition-in-applocker.md @@ -2,18 +2,24 @@ title: Understanding the publisher rule condition in AppLocker (Windows 10) description: This topic explains the AppLocker publisher rule condition, what controls are available, and how it is applied. ms.assetid: df61ed8f-a97e-4644-9d0a-2169f18c1c4f -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Understanding the publisher rule condition in AppLocker + **Applies to** - Windows 10 + This topic explains the AppLocker publisher rule condition, what controls are available, and how it is applied. + Publisher conditions can be made only for files that are digitally signed; this condition identifies an app based on its digital signature and extended attributes. The digital signature contains information about the company that created the app (the publisher). The extended attributes, which are obtained from the binary resource, contain the name of the product that the app is part of and the version number of the app. The publisher may be a software development company, such as Microsoft, or the Information Technology department of your organization. -Publisher conditions are easier to maintain than file hash conditions and are generally more secure than path conditions. Rules that are specified to the version level might have to be updated when a new version of the file is released. The following table describes the advantages and disadvantages of the publisher condition. +Publisher conditions are easier to maintain than file hash conditions and are generally more secure than path conditions. Rules that are specified to the version level might have to be updated when a new version of the file is released. The following table describes the advantages and disadvantages +of the publisher condition. + @@ -42,70 +48,42 @@ Publisher conditions are easier to maintain than file hash conditions and are ge
        Wildcard characters can be used as values in the publisher rule fields according to the following specifications: + - **Publisher** + The asterisk (\*) character used by itself represents any publisher. When combined with any string value, the rule is limited to the publisher with a value in the signed certificate that matches the character string. In other words, the asterisk is not treated as a wildcard character if used with other characters in this field. For example, using the characters "M\*" limits the publisher name to only a publisher with the name "M\*." Using the characters "\*x\*" limits the publisher name only to the name “\*x\*”. A question mark (?) is not a valid wildcard character in this field. + - **Product name** + The asterisk (\*) character used by itself represents any product name. When combined with any string value, the rule is limited to the product of the publisher with a value in the signed certificate that matches the character string. In other words, the asterisk is not treated as a wildcard character if used with other characters in this field. A question mark (?) is not a valid wildcard character in this field. + - **File name** + Either the asterisk (\*) or question mark (?) characters used by themselves represent any and all file names. When combined with any string value, the string is matched with any file name containing that string. + - **File version** + The asterisk (\*) character used by itself represents any file version. If you want to limit the file version to a specific version or as a starting point, you can state the file version and then use the following options to apply limits: + - **Exactly**. The rule applies only to this version of the app - **And above**. The rule applies to this version and all later versions. - **And Below**. The rule applies to this version and all earlier versions. + The following table describes how a publisher condition is applied. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      OptionThe publisher condition allows or denies…

      All signed files

      All files that are signed by a publisher.

      Publisher only

      All files that are signed by the named publisher.

      Publisher and product name

      All files for the specified product that are signed by the named publisher.

      Publisher, product name, and file name

      Any version of the named file for the named product that is signed by the publisher.

      Publisher, product name, file name, and file version

      Exactly

      -

      The specified version of the named file for the named product that is signed by the publisher.

      Publisher, product name, file name, and file version

      And above

      -

      The specified version of the named file and any new releases for the product that are signed by the publisher.

      Publisher, product name, file name, and file version

      And below

      -

      The specified version of the named file and any older versions for the product that are signed by the publisher.

      Custom

      You can edit the Publisher, Product name, File name, and Version fields to create a custom rule.

      + +| Option | The publisher condition allows or denies…| +| - | - | +| **All signed files** | All files that are signed by a publisher.| +| **Publisher only** | All files that are signed by the named publisher.| +| **Publisher and product name** | All files for the specified product that are signed by the named publisher.| +| **Publisher, product name, and file name** | Any version of the named file for the named product that is signed by the publisher.| +| **Publisher, product name, file name, and file version** | **Exactly**
      The specified version of the named file for the named product that is signed by the publisher.| +| **Publisher, product name, file name, and file version** | **And above**
      The specified version of the named file and any new releases for the product that are signed by the publisher.| +| **Publisher, product name, file name, and file version**| **And below**
      The specified version of the named file and any older versions for the product that are signed by the publisher.| +| **Custom** | You can edit the **Publisher**, **Product name**, **File name**, and **Version** fields to create a custom rule.|   For an overview of the three types of AppLocker rule conditions and explanations of the advantages and disadvantages of each, see [Understanding AppLocker rule condition types](understanding-applocker-rule-condition-types.md). + ## Related topics -[How AppLocker works](how-applocker-works-techref.md) -  -  + +- [How AppLocker works](how-applocker-works-techref.md) diff --git a/windows/keep-secure/use-a-reference-computer-to-create-and-maintain-applocker-policies.md b/windows/keep-secure/use-a-reference-computer-to-create-and-maintain-applocker-policies.md index 4b888e3d71..e9c7b0645e 100644 --- a/windows/keep-secure/use-a-reference-computer-to-create-and-maintain-applocker-policies.md +++ b/windows/keep-secure/use-a-reference-computer-to-create-and-maintain-applocker-policies.md @@ -2,35 +2,46 @@ title: Use a reference device to create and maintain AppLocker policies (Windows 10) description: This topic for the IT professional describes the steps to create and maintain AppLocker policies by using a reference computer. ms.assetid: 10c3597f-f44c-4c8e-8fe5-105d4ac016a6 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Use a reference device to create and maintain AppLocker policies + **Applies to** - Windows 10 + This topic for the IT professional describes the steps to create and maintain AppLocker policies by using a reference computer. + ## Background and prerequisites + An AppLocker reference device is a baseline device you can use to configure policies and can subsequently be used to maintain AppLocker policies. For the procedure to configure a reference device, see [Configure the AppLocker reference device](configure-the-appLocker-reference-device.md). + An AppLocker reference device that is used to create and maintain AppLocker policies should contain the corresponding apps for each organizational unit (OU) to mimic your production environment. -**Important**   -The reference device must be running one of the supported editions of Windows. For information about operating system requirements for AppLocker, see [Requirements to use AppLocker](requirements-to-use-applocker.md). + +>**Important:**  The reference device must be running one of the supported editions of Windows. For information about operating system requirements for AppLocker, see [Requirements to use AppLocker](requirements-to-use-applocker.md).   You can perform AppLocker policy testing on the reference device by using the **Audit only** enforcement setting or Windows PowerShell cmdlets. You can also use the reference device as part of a testing configuration that includes policies that are created by using Software Restriction Policies. + ## Step 1: Automatically generate rules on the reference device + With AppLocker, you can automatically generate rules for all files within a folder. AppLocker scans the specified folder and creates the condition types that you choose for each file in that folder. For the procedure to do this, see [Run the Automatically Generate Rules wizard](run-the-automatically-generate-rules-wizard.md). -**Note**   -If you run this wizard to create your first rules for a Group Policy Object (GPO), after you complete the wizard, you will be prompted to create the default rules, which allow critical system files to run. You can edit the default rules at any time. If your organization has decided to edit the default rules or create custom rules to allow the Windows system files to run, ensure that you delete the default rules after you replace them with your custom rules. + +>**Note:**  If you run this wizard to create your first rules for a Group Policy Object (GPO), after you complete the wizard, you will be prompted to create the default rules, which allow critical system files to run. You can edit the default rules at any time. If your organization has decided to edit the default rules or create custom rules to allow the Windows system files to run, ensure that you delete the default rules after you replace them with your custom rules.   ## Step 2: Create the default rules on the reference device + AppLocker includes default rules for each rule collection. These rules are intended to help ensure that the files that are required for Windows to operate properly are allowed in an AppLocker rule collection. You must run the default rules for each rule collection. For info about default rules and considerations for using them, see [Understanding AppLocker default rules](understanding-applocker-default-rules.md). For the procedure to create default rules, see [Create AppLocker default rules](create-applocker-default-rules.md). -**Important**   -You can use the default rules as a template when you create your own rules. This allows files within the Windows directory to run. However, these rules are only meant to function as a starter policy when you are first testing AppLocker rules. + +>**Important:**  You can use the default rules as a template when you create your own rules. This allows files within the Windows directory to run. However, these rules are only meant to function as a starter policy when you are first testing AppLocker rules.   ## Step 3: Modify rules and the rule collection on the reference device + If AppLocker policies are currently running in your production environment, export the policies from the corresponding GPOs and save them to the reference device. For the procedure to do this, see [Export an AppLocker policy from a GPO](export-an-applocker-policy-from-a-gpo.md). If no AppLocker policies have been deployed, create the rules and develop the policies by using the following procedures: + - [Create a rule that uses a publisher condition](create-a-rule-that-uses-a-publisher-condition.md) - [Create a rule that uses a file hash condition](create-a-rule-that-uses-a-file-hash-condition.md) - [Create a rule that uses a path condition](create-a-rule-that-uses-a-path-condition.md) @@ -39,25 +50,34 @@ If AppLocker policies are currently running in your production environment, expo - [Delete an AppLocker rule](delete-an-applocker-rule.md) - [Enable the DLL rule collection](enable-the-dll-rule-collection.md) - [Enforce AppLocker rules](enforce-applocker-rules.md) + ## Step 4: Test and update AppLocker policy on the reference device + You should test each set of rules to ensure that they perform as intended. The **Test-AppLockerPolicy** Windows PowerShell cmdlet can be used to determine whether any of the rules in your rule collection will be blocked on your reference device. Perform the steps on each reference device that you used to define the AppLocker policy. Ensure that the reference device is joined to the domain and that it is receiving the AppLocker policy from the appropriate GPO. Because AppLocker rules are inherited from linked GPOs, you should deploy all of the rules to simultaneously test all of your test GPOs. Use the following procedures to complete this step: + - [Test an AppLocker Policy with Test-AppLockerPolicy](http://technet.microsoft.com/library/ee791772(WS.10).aspx) - [Discover the Effect of an AppLocker Policy](http://technet.microsoft.com/library/ee791823(WS.10).aspx) -**Caution**   -If you have set the enforcement setting on the rule collection to **Enforce rules** or you have not configured the rule collection, the policy will be implemented when the GPO is updated in the next step. If you have set the enforcement setting on the rule collection to **Audit only**, application access events are written to the AppLocker log, and the policy will not take effect. + +>**Caution:**  If you have set the enforcement setting on the rule collection to **Enforce rules** or you have not configured the rule collection, the policy will be implemented when the GPO is updated in the next step. If you have set the enforcement setting on the rule collection to **Audit only**, application access events are written to the AppLocker log, and the policy will not take effect.   ## Step 5: Export and import the policy into production + When the AppLocker policy has been tested successfully, it can be imported into the GPO (or imported into individual computers that are not managed by Group Policy) and checked for its intended effectiveness. To do this, perform the following procedures: + - [Export an AppLocker policy to an XML file](export-an-applocker-policy-to-an-xml-file.md) - [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md) or - [Discover the Effect of an AppLocker Policy](http://technet.microsoft.com/library/ee791823(WS.10).aspx) + If the AppLocker policy enforcement setting is **Audit only** and you are satisfied that the policy is fulfilling your intent, you can change it to **Enforce rules**. For info about how to change the enforcement setting, see [Configure an AppLocker policy for enforce rules](configure-an-applocker-policy-for-enforce-rules.md). + ## Step 6: Monitor the effect of the policy in production + If additional refinements or updates are necessary after a policy is deployed, use the appropriate following procedures to monitor and update the policy: + - [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md) - [Edit an AppLocker policy](edit-an-applocker-policy.md) - [Refresh an AppLocker policy](refresh-an-applocker-policy.md) + ## See also -[Deploy the AppLocker policy into production](deploy-the-applocker-policy-into-production.md) -  -  + +- [Deploy the AppLocker policy into production](deploy-the-applocker-policy-into-production.md) diff --git a/windows/keep-secure/use-applocker-and-software-restriction-policies-in-the-same-domain.md b/windows/keep-secure/use-applocker-and-software-restriction-policies-in-the-same-domain.md index 01e857dfe3..ef970cd8df 100644 --- a/windows/keep-secure/use-applocker-and-software-restriction-policies-in-the-same-domain.md +++ b/windows/keep-secure/use-applocker-and-software-restriction-policies-in-the-same-domain.md @@ -2,18 +2,26 @@ title: Use AppLocker and Software Restriction Policies in the same domain (Windows 10) description: This topic for IT professionals describes concepts and procedures to help you manage your application control strategy using Software Restriction Policies and AppLocker. ms.assetid: 2b7e0cec-df62-49d6-a2b7-6b8e30180943 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Use AppLocker and Software Restriction Policies in the same domain + **Applies to** - Windows 10 + This topic for IT professionals describes concepts and procedures to help you manage your application control strategy using Software Restriction Policies and AppLocker. + ## Using AppLocker and Software Restriction Policies in the same domain -AppLocker is supported on systems running Windows 7 and above. Software Restriction Policies (SRP) is supported on systems running Windows Vista or earlier. You can continue to use SRP for application control on your pre-Windows 7 computers, but use AppLocker for computers running Windows Server 2008 R2, Windows 7 and later. It is recommended that you author AppLocker and SRP rules in separate GPOs and target the GPO with SRP policies to systems running Windows Vista or earlier. When both SRP and AppLocker policies are applied to computers running Windows Server 2008 R2, Windows 7 and later, the SRP policies are ignored. + +AppLocker is supported on systems running Windows 7 and above. Software Restriction Policies (SRP) is supported on systems running Windows Vista or earlier. You can continue to use SRP for application control on your pre-Windows 7 computers, but use AppLocker for computers running +Windows Server 2008 R2, Windows 7 and later. It is recommended that you author AppLocker and SRP rules in separate GPOs and target the GPO with SRP policies to systems running Windows Vista or earlier. When both SRP and AppLocker policies are applied to computers running Windows Server 2008 R2, +Windows 7 and later, the SRP policies are ignored. + The following table compares the features and functions of Software Restriction Policies (SRP) and AppLocker. diff --git a/windows/keep-secure/use-the-applocker-windows-powershell-cmdlets.md b/windows/keep-secure/use-the-applocker-windows-powershell-cmdlets.md index 4ccedff7ca..cf988054c1 100644 --- a/windows/keep-secure/use-the-applocker-windows-powershell-cmdlets.md +++ b/windows/keep-secure/use-the-applocker-windows-powershell-cmdlets.md @@ -2,30 +2,51 @@ title: Use the AppLocker Windows PowerShell cmdlets (Windows 10) description: This topic for IT professionals describes how each AppLocker Windows PowerShell cmdlet can help you administer your AppLocker application control policies. ms.assetid: 374e029c-5c0a-44ab-a57a-2a9dd17dc57d -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Use the AppLocker Windows PowerShell cmdlets + **Applies to** - Windows 10 + This topic for IT professionals describes how each AppLocker Windows PowerShell cmdlet can help you administer your AppLocker application control policies. + ## AppLocker Windows PowerShell cmdlets -The five AppLocker cmdlets are designed to streamline the administration of an AppLocker policy. They can be used to help create, test, maintain, and troubleshoot an AppLocker policy. The cmdlets are intended to be used in conjunction with the AppLocker user interface that is accessed through the Microsoft Management Console (MMC) snap-in extension to the Local Security Policy snap-in and Group Policy Management Console. -To edit or update a Group Policy Object (GPO) by using the AppLocker cmdlets, you must have Edit Setting permission. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. To perform tasks by using the Local Security policy snap-in, you must be a member of the local **Administrators** group, or equivalent, on the computer. + +The five AppLocker cmdlets are designed to streamline the administration of an AppLocker policy. They can be used to help create, test, maintain, and troubleshoot an AppLocker policy. The cmdlets are intended to be used in conjunction with the AppLocker user interface that is accessed through the +Microsoft Management Console (MMC) snap-in extension to the Local Security Policy snap-in and Group Policy Management Console. + +To edit or update a Group Policy Object (GPO) by using the AppLocker cmdlets, you must have Edit Setting permission. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. To perform tasks by using the +Local Security policy snap-in, you must be a member of the local **Administrators** group, or equivalent, on the computer. + ### Retrieve application information -The [Get-AppLockerFileInformation](http://technet.microsoft.com/library/hh847209.aspx) cmdlet retrieves the AppLocker file information from a list of files or from an event log. File information that is retrieved can include publisher information, file hash information, and file path information. File information from an event log may not contain all of these fields. Files that are not signed do not have any publisher information. + +The [Get-AppLockerFileInformation](http://technet.microsoft.com/library/hh847209.aspx) cmdlet retrieves the AppLocker file information from a list of files or from an event log. File information that is retrieved can include publisher information, file hash information, and file path information. + +File information from an event log may not contain all of these fields. Files that are not signed do not have any publisher information. + ### Set AppLocker policy + The [Set-AppLockerPolicy](http://technet.microsoft.com/library/hh847212.aspx) cmdlet sets the specified GPO to contain the specified AppLocker policy. If no Lightweight Directory Access Protocol (LDAP) is specified, the local GPO is the default. + ### Retrieve an AppLocker policy + The [Get-AppLockerPolicy](http://technet.microsoft.com/library/hh847214.aspx) cmdlet gets the AppLocker policy from the local GPO, from a specified GPO, or from the effective AppLocker policy on the device. The output of the AppLocker policy is an AppLockerPolicy object or an XML-formatted string. + ### Generate rules for a given user or group -The [New-AppLockerPolicy](http://technet.microsoft.com/library/hh847211.aspx) cmdlet uses a list of file information to automatically generate rules for a given user or group. It can generate rules based on publisher, hash, or path information. Use **Get-AppLockerFileInformation** to create the list of file information. + +The [New-AppLockerPolicy](http://technet.microsoft.com/library/hh847211.aspx) cmdlet uses a list of file information to automatically generate rules for a given user or group. It can generate rules based on publisher, hash, or path information. Use **Get-AppLockerFileInformation** to create the +list of file information. + ### Test the AppLocker Policy against a file set + The [Test-AppLockerPolicy](http://technet.microsoft.com/library/hh847213.aspx) cmdlet uses the specified AppLocker policy to test whether a specified list of files are allowed to run or not on the local device for a specific user. + ## Additional resources + - For steps to perform other AppLocker policy tasks, see [Administer AppLocker](administer-applocker.md). -  -  diff --git a/windows/keep-secure/use-windows-event-forwarding-to-assist-in-instrusion-detection.md b/windows/keep-secure/use-windows-event-forwarding-to-assist-in-instrusion-detection.md index cc7a0adbb4..060d693df1 100644 --- a/windows/keep-secure/use-windows-event-forwarding-to-assist-in-instrusion-detection.md +++ b/windows/keep-secure/use-windows-event-forwarding-to-assist-in-instrusion-detection.md @@ -2,22 +2,33 @@ title: Use Windows Event Forwarding to help with intrusion detection (Windows 10) description: Learn about an approach to collect events from devices in your organization. This article talks about events in both normal operations and when an intrusion is suspected. ms.assetid: 733263E5-7FD1-45D2-914A-184B9E3E6A3F -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: tedhardyMSFT --- + # Use Windows Event Forwarding to help with intrusion detection + **Applies to** - Windows 10 + Learn about an approach to collect events from devices in your organization. This article talks about events in both normal operations and when an intrusion is suspected. + Windows Event Forwarding (WEF) reads any operational or administrative event log on a device in your organization and forwards the events you choose to a Windows Event Collector (WEC) server. -To accomplish this, there are two different of subscriptions published to client devices - the Baseline subscription and the suspect subscription. The Baseline subscription enrolls all devices in your organization, and a Suspect subscription only includes devices that have been added by you. The Suspect subscription collects additional events to help build context for system activity and can quickly be updated to accommodate new events and/or scenarios as needed without impacting baseline operations. + +To accomplish this, there are two different of subscriptions published to client devices - the Baseline subscription and the suspect subscription. The Baseline subscription enrolls all devices in your organization, and a Suspect subscription only includes devices that have been added by you. The +Suspect subscription collects additional events to help build context for system activity and can quickly be updated to accommodate new events and/or scenarios as needed without impacting baseline operations. + This implementation helps differentiate where events are ultimately stored. Baseline events can be sent to devices with online analytical capability, such as Security Event Manager (SEM), while also sending events to a MapReduce system, such as HDInsight or Hadoop, for long-term storage and deeper analysis. Events from the Suspect subscription are sent directly to a MapReduce system due to volume and lower signal/noise ratio, they are largely used for host forensic analysis. + An SEM’s strength lies in being able to inspect, correlate events, and generate alerts for known patterns manner and alert security staff at machine speed. + A MapReduce system has a longer retention time (years versus months for an SEM), larger ingress ability (hundreds of terabytes per day), and the ability to perform more complex operations on the data like statistical and trend analysis, pattern clustering analysis, or apply Machine Learning algorithms. + Here's an approximate scaling guide for WEF events: + | Events/second range | Data store | |---------------------|----------------------------| | 0 - 5,000 | SQL or SEM | @@ -25,54 +36,91 @@ Here's an approximate scaling guide for WEF events: | 50,000+ | Hadoop/HDInsight/Data Lake |   Event generation on a device must be enabled either separately or as part of the GPO for the baseline WEF implementation, including enabling of disabled event logs and setting channel permissions. For more info, see [Appendix C - Event channel settings (enable and channel access) methods](#bkmk-appendixc). This is because WEF is a passive system with regards to the event log. It cannot change the size of event log files, enable disabled event channels, change channel permissions, or adjust a security audit policy. WEF only queries event channels for existing events. Additionally, having event generation already occurring on a device allows for more complete event collection building a complete history of system activity. Otherwise, you'll be limited to the speed of GPO and WEF subscription refresh cycles to make changes to what is being generated on the device. On modern devices, enabling additional event channels and expanding the size of event log files has not resulted in noticeable performance differences. + For the minimum recommended audit policy and registry system ACL settings, see [Appendix A - Minimum recommended minimum audit policy](#bkmk-appendixa) and [Appendix B - Recommended minimum registry system ACL policy](#bkmk-appendixb). -**Note**   -These are only minimum values need to meet what the WEF subscription selects. + +>**Note:**  These are only minimum values need to meet what the WEF subscription selects.   From a WEF subscription management perspective, the event queries provided should be used in two separate subscriptions for ease of maintenance; only machines meeting specific criteria would be allowed access to the targeted subscription, this access would be determined by an algorithm or an analysts’ direction. All devices should have access to the Baseline subscription. + This means you would create two base subscriptions: + - **Baseline WEF subscription**. Events collected from all hosts, this includes some role-specific events, which will only be emitted by those machines. - **Targeted WEF subscription**. Events collected from a limited set of hosts due to unusual activity and/or heightened awareness for those systems. + Each using the respective event query below. Note that for the Targeted subscription enabling the “read existing events” option should be set to true to allow collection of existing events from systems. By default, WEF subscriptions will only forward events generated after the WEF subscription was received by the client. + In [Appendix E – Annotated Baseline Subscription Event Query](#bkmk-appendixe) and [Appendix F – Annotated Suspect Subscription Event Query](#bkmk-appendixf), the event query XML is included when creating WEF subscriptions. These are annotated for query purpose and clarity. Individual <Query> element can be removed or edited without affecting the rest of the query. + ### Common WEF questions + This section addresses common questions from IT pros and customers. + ### Will the user notice if their machine is enabled for WEF or if WEF encounters an error? + The short answer is: No. + The longer answer is: The **Eventlog-forwardingPlugin/Operational** event channel logs the success, warning, and error events related to WEF subscriptions present on the device. Unless the user opens Event Viewer and navigates to that channel, they will not notice WEF either through resource consumption or Graphical User Interface pop-ups. Even if there is an issue with the WEF subscription, there is no user interaction or performance degradation. All success, warning, and failure events are logged to this operational event channel. + ### Is WEF Push or Pull? + A WEF subscription can be configured to be push or pull, but not both. The simplest, most flexible IT deployment with the greatest scalability can be achieved by using a push, or source initiated, subscription. WEF clients are configured by using a GPO and the built-in forwarding client is activated. For pull, collector initiated, the subscription on the WEC server is pre-configured with the names of the WEF Client devices from which events are to be selected. Those clients also have to be configured ahead of time to allow the credentials used in the subscription to access their event logs remotely (normally by adding the credential to the **Event Log Readers** built-in local security group.) A useful scenario: closely monitoring a specific set of machines. + ### Will WEF work over VPN or RAS? + WEF handles VPN, RAS, and DirectAccess scenarios well and will reconnect and send any accumulated backlog of events when the connection to the WEF Collector is re-established. + ### How is client progress tracked? -The WEC server maintains in its registry the bookmark information and last heartbeat time for each event source for each WEF subscription. When an event source re-connects to a WEC server, the last bookmark position is sent to the device to use as a starting point to resume forwarding events. If a WEF client has no events to send, the WEF client will connect periodically to send a Heartbeat to the WEC server to indicate it is active. This heartbeat value can be individually configured for each subscription. + +The WEC server maintains in its registry the bookmark information and last heartbeat time for each event source for each WEF subscription. When an event source re-connects to a WEC server, the last bookmark position is sent to the device to use as a starting point to resume forwarding events. If a +WEF client has no events to send, the WEF client will connect periodically to send a Heartbeat to the WEC server to indicate it is active. This heartbeat value can be individually configured for each subscription. + ### Will WEF work in an IPv4, IPv6, or mixed IPv4/IPv6 environment? + Yes. WEF is transport agnostic and will work over IPv4 or IPv6. + ### Are WEF events encrypted? I see an HTTP/HTTPS option! + In a domain setting, the connection used to transmit WEF events is encrypted using Kerberos, by default (with NTLM as a fallback option, which can be disabled by using a GPO). Only the WEF collector can decrypt the connection. Additionally, the connection between WEF client and WEC server is mutually authenticated regardless of authentication type (Kerberos or NTLM.) There are GPO options to force Authentication to use Kerberos Only. + This authentication and encryption is performed regardless if HTTP or HTTPS is selected. + The HTTPS option is available if certificate based authentication is used, in cases where the Kerberos based mutual authentication is not an option. The SSL certificate and provisioned client certificates are used to provide mutual authentication. + ### Do WEF Clients have a separate buffer for events? + The WEF client machines local event log is the buffer for WEF for when the connection to the WEC server is lost. To increase the “buffer size”, increase the maximum file size of the specific event log file where events are being selected. For more info, see [Appendix C – Event Channel Settings (enable and Channel Access) methods](#bkmk-appendixc). + When the event log overwrites existing events (resulting in data loss if the device is not connected to the Event Collector), there is no notification sent to the WEF collector that events are lost from the client. Neither is there an indicator that there was a gap encountered in the event stream. + ### What format is used for forwarded events? -WEF has two modes for forwarded events. The default is “Rendered Text” which includes the textual description of the event as you would see it in Event Viewer. This means that the event size is effectively doubled or tripled depending on the size of the rendered description. The alternative mode is “Events” (also sometimes referred to as “Binary” format) – which is just the event XML itself sent in binary XML format (as it would be written to the evtx file.) This is very compact and can more than double the event volume a single WEC server can accommodate. + +WEF has two modes for forwarded events. The default is “Rendered Text” which includes the textual description of the event as you would see it in Event Viewer. This means that the event size is effectively doubled or tripled depending on the size of the rendered description. The alternative mode is +“Events” (also sometimes referred to as “Binary” format) – which is just the event XML itself sent in binary XML format (as it would be written to the evtx file.) This is very compact and can more than double the event volume a single WEC server can accommodate. + A subscription “testSubscription” can be configured to use the Events format through the WECUTIL utility: + ``` syntax @rem required to set the DeliveryMaxItems or DeliveryMaxLatencyTime Wecutil ss “testSubscription” /cf:Events ``` + ### How frequently are WEF events delivered? + Event delivery options are part of the WEF subscription configuration parameters – There are three built-in subscription delivery options: Normal, Minimize Bandwidth, and Minimize Latency. A fourth, catch-all called “Custom” is available but cannot be selected or configured through the WEF UI by using Event Ciewer. The Custom delivery option must be selected and configured using the WECUTIL.EXE command-line application. All subscription options define a maximum event count and maximum event age, if either limit is exceeded then the accumulated events are sent to the event collector. + This table outlines the built-in delivery options: -| Event delivery optimization options | Description | -|-------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Normal | This option ensures reliable delivery of events and does not attempt to conserve bandwidth. It is the appropriate choice unless you need tighter control over bandwidth usage or need forwarded events delivered as quickly as possible. It uses pull delivery mode, batches 5 items at a time and sets a batch timeout of 15 minutes. | -| Minimize bandwidth | This option ensures that the use of network bandwidth for event delivery is strictly controlled. It is an appropriate choice if you want to limit the frequency of network connections made to deliver events. It uses push delivery mode and sets a batch timeout of 6 hours. In addition, it uses a heartbeat interval of 6 hours. | -| Minimize latency | This option ensures that events are delivered with minimal delay. It is an appropriate choice if you are collecting alerts or critical events. It uses push delivery mode and sets a batch timeout of 30 seconds. | + +| Event delivery optimization options | Description | +| - | - | +| Normal | This option ensures reliable delivery of events and does not attempt to conserve bandwidth. It is the appropriate choice unless you need tighter control over bandwidth usage or need forwarded events delivered as quickly as possible. It uses pull delivery mode, batches 5 items at a time and sets a batch timeout of 15 minutes. | +| Minimize bandwidth | This option ensures that the use of network bandwidth for event delivery is strictly controlled. It is an appropriate choice if you want to limit the frequency of network connections made to deliver events. It uses push delivery mode and sets a batch timeout of 6 hours. In addition, it uses a heartbeat interval of 6 hours. | +| Minimize latency | This option ensures that events are delivered with minimal delay. It is an appropriate choice if you are collecting alerts or critical events. It uses push delivery mode and sets a batch timeout of 30 seconds. |   For more info about delivery options, see [Configure Advanced Subscription Settings](http://technet.microsoft.com/library/cc749167.aspx). + The primary difference is in the latency which events are sent from the client. If none of the built-in options meet your requirements you can set Custom event delivery options for a given subscription from an elevated command prompt: + ``` syntax @rem required to set the DeliveryMaxItems or DeliveryMaxLatencyTime Wecutil ss “SubscriptionNameGoesHere” /cm:Custom @@ -82,122 +130,209 @@ Wecutil ss “SubscriptionNameGoesHere” /dmi:1 Wecutil ss “SubscriptionNameGoesHere” /dmlt:10 ``` ### How do I control which devices have access to a WEF Subscription? + For source initiated subscriptions: Each WEF subscription on a WEC server has its own ACL for machine accounts or security groups containing machine accounts (not user accounts) that are explicitly allowed to participate in that subscription or are explicitly denied access. This ACL applies to only a single WEF subscription (since there can be multiple WEF subscriptions on a given WEC server), other WEF Subscriptions have their own separate ACL. + For collector initiated subscriptions: The subscription contains the list of machines from which the WEC server is to collect events. This list is managed at the WEC server, and the credentials used for the subscription must have access to read event logs from the WEF Clients – the credentials can be either the machine account or a domain account. + ### Can a client communicate to multiple WEF Event Collectors? + Yes. If you desire a High-Availability environment, simply configure multiple WEC servers with the same subscription configuration and publish both WEC Server URIs to WEF clients. WEF Clients will forward events simultaneously to the configured subscriptions on the WEC servers, if they have the appropriate access. + ### What are the WEC server’s limitations? + There are three factors that limit the scalability of WEC servers. The general rule for a stable WEC server on commodity hardware is “10k x 10k” – meaning, no more than 10,000 concurrently active WEF Clients per WEC server and no more than 10,000 events/second average event volume. + - **Disk I/O**. The WEC server does not process or validate the received event, but rather buffers the received event and then logs it to a local event log file (EVTX file). The speed of logging to the EVTX file is limited by the disk write speed. Isolating the EVTX file to its own array or using high speed disks can increase the number of events per second that a single WEC server can receive. - **Network Connections**. While a WEF source does not maintain a permanent, persistent connection to the WEC server, it does not immediately disconnect after sending its events. This means that the number of WEF sources that can simultaneously connect to the WEC server is limited to the open TCP ports available on the WEC server. - **Registry size**. For each unique device that connects to a WEF subscription, there is a registry key (corresponding to the FQDN of the WEF Client) created to store bookmark and source heartbeat information. If this is not pruned to remove inactive clients this set of registry keys can grow to an unmanageable size over time. + - When a subscription has >1000 WEF sources connect to it over its operational lifetime, also known as lifetime WEF sources, Event Viewer can become unresponsive for a few minutes when selecting the **Subscriptions** node in the left-navigation, but will function normally afterwards. - At >50,000 lifetime WEF sources, Event Viewer is no longer an option and wecutil.exe (included with Windows) must be used to configure and manage subscriptions. - At >100,000 lifetime WEF sources, the registry will not be readable and the WEC server will likely have to be rebuilt. + ## Subscription information + Below lists all of the items that each subscription collects, the actual subscription XML is available in an Appendix. These are separated out into Baseline and Targeted. The intent is to subscribe all hosts to Baseline, and then enroll (and remove) hosts on an as needed basis to the Targeted subscription. + ### Baseline subscription + While this appears to be the largest subscription, it really is the lowest volume on a per-device basis. (Exceptions should be allowed for unusual devices – a device performing complex developer related tasks can be expected to create an unusually high volume of process create and AppLocker events.) This subscription does not require special configuration on client devices to enable event channels or modify channel permissions. + The subscription is essentially a collection of query statements applied to the Event Log. This means that it is modular in nature and a given query statement can be removed or changed without impacting other query statement in the subscription. Additionally, suppress statements which filter out specific events, only apply within that query statement and are not to the entire subscription. + ### Baseline subscription requirements + To gain the most value out of the baseline subscription we recommend to have the following requirements set on the device to ensure that the clients are already generating the required events to be forwarded off the system. + - Apply a security audit policy that is a super-set of the recommended minimum audit policy. For more info, see [Appendix A – Minimum Recommended minimum Audit Policy](#bkmk-appendixa). This ensures that the security event log is generating the required events. - Apply at least an Audit-Only AppLocker policy to devices. + - If you are already whitelisting or blacklisting events by using AppLocker, then this requirement is met. - AppLocker events contain extremely useful information, such as file hash and digital signature information for executables and scripts. + - Enable disabled event channels and set the minimum size for modern event files. - Currently, there is no GPO template for enabling or setting the maximum size for the modern event files. This must be done by using a GPO. For more info, see [Appendix C – Event Channel Settings (enable and Channel Access) methods](#bkmk-appendixc). + The annotated event query can be found in the following. For more info, see [Appendix F – Annotated Baseline Subscription Event Query](#bkmk-appendixf). + - Anti-malware events from Microsoft Antimalware or Windows Defender. This can be configured for any given anti-malware product easily if it writes to the Windows event log. - Security event log Process Create events. - AppLocker Process Create events (EXE, script, packaged App installation and execution). - Registry modification events. For more info, see [Appendix B – Recommended minimum Registry System ACL Policy](#bkmk-appendixb). - OS startup and shutdown + - Startup event include operating system version, service pack level, QFE version, and boot mode. + - Service install + - Includes what the name of the service, the image path, and who installed the service. + - Certificate Authority audit events + - This is only applicable on systems with the Certificate Authority role installed. - Logs certificate requests and responses. + - User profile events + - Use of a temporary profile or unable to create a user profile may indicate an intruder is interactively logging into a device but not wanting to leave a persistent profile behind. + - Service start failure + - Failure codes are localized, so you have to check the message DLL for values. + - Network share access events + - Filter out IPC$ and /NetLogon file shares, which are expected and noisy. + - System shutdown initiate requests + - Find out what initiated the restart of a device. + - User initiated interactive logoff event - Remote Desktop Services session connect, reconnect, or disconnect. - EMET events, if EMET is installed. - Event forwarding plugin events + - For monitoring WEF subscription operations, particularly Partial Success events. This is useful for diagnosing deployment issues. + - Network share create and delete + - Enables detection of unauthorized share creation. - **Note**  All shares are re-created when the device starts. + >**Note:**  All shares are re-created when the device starts.   - Logon sessions + - Logon success for interactive (local and Remote Interactive/Remote Desktop) - Logon success for services for non-built-in accounts, such as LocalSystem, LocalNetwork, and so on. - Logon success for batch sessions - Logon session close, which are logoff events for non-network sessions. + - Windows Error Reporting (Application crash events only) + - This can help detect early signs of intruder not familiar with enterprise environment using targeted malware. + - Event log service events + - Errors, start events, and stop events for the Windows Event Log service. + - Event log cleared (including the Security Event Log) + - This could indicate an intruder that are covering their tracks. + - Special privileges assigned to new logon + - This indicates that at the time of logon a user is either an Administrator or has the sufficient access to make themselves Administrator. + - Outbound Remote Desktop Services session attempts + - Visibility into potential beachhead for intruder + - System time changed - SMB Client (mapped drive connections) - Account credential validation + - Local accounts or domain accounts on domain controllers + - A user was added or removed from the local Administrators security group. - Crypto API private key accessed + - Associated with signing objects using the locally stored private key. + - Task Scheduler task creation and delete + - Task Scheduler allows intruders to run code at specified times as LocalSystem. + - Logon with explicit credentials + - Detect credential use changes by intruders to access additional resources. + - Smartcard card holder verification events + - This detects when a smartcard is being used. + ### Suspect subscription + This adds some possible intruder-related activity to help analyst further refine their determinations about the state of the device. + - Logon session creation for network sessions + - Enables time-series analysis of network graphs. + - RADIUS and VPN events + - Useful if you use a Microsoft IAS RADIUS/VPN implementation. It shows user-> IP address assignment with remote IP address connecting to the enterprise. + - Crypto API X509 object and build chain events + - Detects known bad certificate, CA, or sub-CA - Detects unusual process use of CAPI + - Groups assigned to local logon + - Gives visibility to groups which enable account wide access - Allows better planning for remediation efforts - Excludes well known, built-in system accounts. + - Logon session exit + - Specific for network logon sessions. + - Client DNS lookup events + - Returns what process performed a DNS query and the results returned from the DNS server. + - Process exit + - Enables checking for processes terminating unexpectedly. + - Local credential validation or logon with explicit credentials + - Generated when the local SAM is authoritative for the account credentials being authenticated. - Noisy on domain controllers - On client devices this is only generated when local accounts log on. + - Registry modification audit events + - Only when a registry value is being created, modified, or deleted. + - Wireless 802.1x authentication + - Detect wireless connection with a peer MAC address + - Windows PowerShell logging + - Covers Windows PowerShell 2.0 and later and includes the Windows PowerShell 5.0 logging improvements for in-memory attacks using Windows PowerShell. - Includes Windows PowerShell remoting logging + - User Mode Driver Framework “Driver Loaded” event + - Can possibly detect a USB device loading multiple device drivers. For example, a USB\_STOR device loading the keyboard or network driver. + ## Appendix A - Minimum recommended minimum audit policy + If your organizational audit policy enables additional auditing to meet its needs, that is fine. The policy below is the minimum audit policy settings needed to enable events collected by both baseline and targeted subscriptions. + | Category | Subcategory | Audit settings | |--------------------|---------------------------------|---------------------| | Account Logon | Credential Validation | Success and Failure | @@ -232,28 +367,46 @@ If your organizational audit policy enables additional auditing to meet its need | System | System Integrity | Success and Failure |   ## Appendix B - Recommended minimum registry system ACL policy + The Run and RunOnce keys are useful for intruders and malware persistence. It allows code to be run (or run only once then removed, respectively) when a user logs into the system. + This can easily be extended to other Auto-Execution Start Points keys in the registry. + Use the following figures to see how you can configure those registry keys. -![default acl for run key](images/runkey.png)![default acl for runonce key](images/runoncekey.png) + +![default acl for run key](images/runkey.png) + +![default acl for runonce key](images/runoncekey.png) + ## Appendix C - Event channel settings (enable and channel access) methods + Some channels are disabled by default and have to be enabled. Others, such as Microsoft-Windows-CAPI2/Operational must have the channel access modified to allow the Event Log Readers built-in security group to read from it. + The recommended and most effective way to do this is to configure the baseline GPO to run a scheduled task to configure the event channels (enable, set maximum size, and adjust channel access.) This will take effect at the next GPO refresh cycle and has minimal impact on the client device. + The following GPO snippet performs the following: + - Enables the **Microsoft-Windows-Capi2/Operational** event channel. - Sets the maximum file size for **Microsoft-Windows-Capi2/Operational** to 100MB. - Sets the maximum file size for **Microsoft-Windows-AppLocker/EXE and DLL** to 100MB. - Sets the maximum channel access for **Microsoft-Windows-Capi2/Operational** to include the built-in Event Log Readers security group. - Enables the **Microsoft-Windows-DriverFrameworks-UserMode/Operational** event channel. - Sets the maximum file size for **Microsoft-Windows-DriverFrameworks-UserMode/Operational** to 50MB. + ![configure event channels](images/capi-gpo.png) + ## Appendix D - Minimum GPO for WEF Client configuration + Here are the minimum steps for WEF to operate: + 1. Configure the collector URI(s). 2. Start the WinRM service. 3. Add the Network Service account to the built-in Event Log Readers security group. This allows reading from secured event channel, such as the security event channel. + ![configure the wef client](images/wef-client-config.png) + ## Appendix E – Annotated baseline subscription event query + ``` syntax @@ -416,8 +569,11 @@ Here are the minimum steps for WEF to operate: ``` + ## Appendix F – Annotated Suspect Subscription Event Query + ``` syntax + @@ -486,10 +642,10 @@ Here are the minimum steps for WEF to operate: ``` ## Appendix G - Online resources + You can get more info with the following links: -- [Event Selection](http://msdn.microsoft.com/library/aa385231(VS.85).aspx) -- [Event Queries and Event XML](http://msdn.microsoft.com/library/bb399427(VS.90).aspx) -- [Event Query Schema](http://msdn.microsoft.com/library/aa385760(VS.85).aspx) + +- [Event Selection](http://msdn.microsoft.com/library/aa385231.aspx) +- [Event Queries and Event XML](http://msdn.microsoft.com/library/bb399427.aspx) +- [Event Query Schema](http://msdn.microsoft.com/library/aa385760.aspx) - [Windows Event Collector](http://msdn.microsoft.com/library/windows/desktop/bb427443.aspx) -  -  diff --git a/windows/keep-secure/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md b/windows/keep-secure/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md index 9f31ef56eb..a4fbc0126b 100644 --- a/windows/keep-secure/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md +++ b/windows/keep-secure/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md @@ -2,87 +2,83 @@ title: User Account Control Admin Approval Mode for the Built-in Administrator account (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Admin Approval Mode for the Built-in Administrator account security policy setting. ms.assetid: d465fc27-1cd2-498b-9cf6-7ad2276e5998 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # User Account Control: Admin Approval Mode for the Built-in Administrator account **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Admin Approval Mode for the Built-in Administrator account** security policy setting. + ## Reference + This policy setting determines the behavior of Admin Approval Mode for the built-in administrator account. When the Admin Approval Mode is enabled, the local administrator account functions like a standard user account, but it has the ability to elevate privileges without logging on by using a different account. In this mode, any operation that requires elevation of privilege displays a prompt that allows the administrator to permit or deny the elevation of privilege. If Admin Approval Mode is not enabled, the built-in Administrator account logs on in Windows XP Mode, and it runs all applications by default with full administrative privileges. By default, this setting is set to **Disabled**. -**Note**   -If a computer is upgraded from a previous version of the Windows operating system, and the administrator account is the only account on the computer, the built-in administrator account remains enabled, and this setting is also enabled. + +>**Note:**  If a computer is upgraded from a previous version of the Windows operating system, and the administrator account is the only account on the computer, the built-in administrator account remains enabled, and this setting is also enabled.   ### Possible values + - Enabled + The built-in administrator account logs on in Admin Approval Mode so that any operation that requires elevation of privilege displays a prompt that provides the administrator the option to permit or deny the elevation of privilege. + - Disabled + The built-in administrator account logs on in Windows XP Mode, and it runs all applications by default with full administrative privileges. + ### Best practices + - Do not enable the built-in administrator account on the client computer, but use the standard user account and User Account Control (UAC). + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. -
      ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Disabled

      DC Effective Default Settings

      Disabled

      Member Server Effective Default Settings

      Disabled

      Client Computer Effective Default Settings

      Disabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + One of the risks of the User Account Control (UAC) feature is that it is intended to mitigate malicious software running under elevated credentials without the user or administrator being aware of its activity. An attack vector for malicious programs is to discover the password of the administrator account because that user account was created for all installations of the Windows. To address this risk, the built-in administrator account is disabled in computers running at least Windows Vista. In computers running at least Windows Server 2008, the administrator account is enabled, and the password must be changed the first time the Administrator logs on. In a default installation of a computer running at least Windows Vista, accounts with administrative control over the computer are initially set up in one of two ways: + - If the computer is not joined to a domain, the first user account you create has the equivalent permissions as a local administrator. - If the computer is joined to a domain, no local administrator accounts are created. The enterprise or domain administrator must log on to the computer and create a local administrator account if one is warranted. + ### Countermeasure + Enable the **User Account Control: Admin Approval Mode for the Built-in Administrator account** setting if you have the built-in Administrator account enabled. + ### Potential impact + Users who log on by using the local administrator account are prompted for consent whenever a program requests an elevation in privilege. ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md b/windows/keep-secure/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md index 3215dba248..cc8ebe93f3 100644 --- a/windows/keep-secure/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md +++ b/windows/keep-secure/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md @@ -2,104 +2,118 @@ title: User Account Control Allow UIAccess applications to prompt for elevation without using the secure desktop (Windows 10) description: Describes the best practices, location, values, and security considerations for the User Account Control Allow UIAccess applications to prompt for elevation without using the secure desktop security policy setting. ms.assetid: fce20472-3c93-449d-b520-13c4c74a9892 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop + **Applies to** - Windows 10 + Describes the best practices, location, values, and security considerations for the **User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop** security policy setting. + ## Reference + This security setting controls whether User Interface Accessibility (UIAccess or UIA) programs can automatically disable the secure desktop for elevation prompts that are used by a standard user. -**Note**   -This setting does not change the behavior of the UAC elevation prompt for administrators. + +>**Note:**  This setting does not change the behavior of the UAC elevation prompt for administrators.   **Background** + User Interface Privilege Isolation (UIPI) implements restrictions in the Windows subsystem that prevent lower-privilege applications from sending messages or installing hooks in higher-privilege processes. Higher-privilege applications are permitted to send messages to lower-privilege processes. UIPI does not interfere with or change the behavior of messages between applications at the same privilege (or integrity) level. + Microsoft UI Automation is the current model to support accessibility requirements in the Windows operating systems. Applications that are designed to support an accessible user experience control the behavior of other Windows applications on behalf of the user. When all applications on the automation client computer and server are running as a standard user (that is, at a medium integrity level), the UIPI restrictions do not interfere with the Microsoft UI automation model. + However, there might be times when an administrative user runs an application with elevated privilege based on UAC in Admin Approval Mode. Microsoft UI Automation cannot drive the UI graphics of elevated applications on the desktop without the ability to bypass the restrictions that UIPI implements. The ability to bypass UIPI restrictions across privilege levels is available for UI automation programs by using UIAccess. -If an application presents a UIAccess attribute when it requests privileges, the application is stating a requirement to bypass UIPI restrictions for sending messages across privilege levels. Devices implement the following policy checks before starting an application with UIAccess privilege. + +If an application presents a UIAccess attribute when it requests privileges, the application is stating a requirement to bypass UIPI restrictions for sending messages across privilege levels. Devices implement the following policy +checks before starting an application with UIAccess privilege. + 1. The application must have a digital signature that can be verified by using a digital certificate that is associated with the Trusted Root Certification Authorities store on the local computer. 2. The application must be installed in a local folder that is writeable only by administrators, such as the Program Files directory. The allowed directories for UI automation applications are: + 1. %ProgramFiles% and its subdirectories. 2. %WinDir% and its subdirectories, except a few subdirectories that are excluded because standard users have write access. + **Resulting behavior** + When this setting is enabled, UIAccess programs (including Windows Remote Assistance) can automatically disable the secure desktop for elevation prompts. Unless you have also disabled elevation prompts, the prompts appear on the interactive user's desktop instead of on the secure desktop. The prompts also appear on the remote administrator's view of the desktop during a Windows Remote Assistance session, and the remote administrator can provide the appropriate credentials for elevation. + If you disable this setting, the secure desktop can only be disabled by the user of the interactive desktop or by disabling the [User Account Control: Switch to the secure desktop when prompting for elevation](user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md) setting, which by default is enabled. + ### Possible values + - Enabled + UIA programs can automatically disable the secure desktop for elevation prompts, and unless you have also disabled elevation prompts, the prompts appear on the interactive user's desktop instead of on the secure desktop. Prompts will also appear on the remote administrator's view of the desktop during a Windows Remote Assistance session, and the remote administrator can provide the appropriate credentials for elevation. + - Disabled + The secure desktop can be disabled only by the user of the interactive desktop or by disabling the **User Account Control: Switch to the secure desktop when prompting for elevation** policy setting. + ### Best practices + - Best practices are dependent on your security policies and your remote operational requirements. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Disabled

      DC Effective Default Settings

      Disabled

      Member Server Effective Default Settings

      Disabled

      Client Computer Effective Default Settings

      Disabled

      + +Server type or GPO| Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. + ### Group Policy + All auditing capabilities are integrated in Group Policy. You can configure, deploy, and manage these settings in the Group Policy Management Console (GPMC) or Local Security Policy snap-in for a domain, site, or organizational unit (OU). + ### Policy interactions + If you plan to enable this setting, you should also review the effect of the [User Account Control: Behavior of the elevation prompt for standard users](user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md) setting. If it is configured as **Automatically deny elevation requests**, elevation requests are not presented to the user. If you disable this setting, the secure desktop can only be disabled by the user of the interactive desktop or by disabling the [User Account Control: Switch to the secure desktop when prompting for elevation](user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md) setting, which by default is enabled. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + UIA programs are designed to interact with Windows and application programs on behalf of a user. This setting allows UIA programs to bypass the secure desktop to increase usability in certain cases, but it allows elevation requests to appear on the regular interactive desktop instead of on the secure desktop. This increases the risk that a malicious program could intercept data that is being transferred between the UI and the application. Because UIA programs must be able to respond to prompts regarding security issues, such as the UAC elevation prompt, UIA programs must be highly trusted. To be considered trusted, a UIA program must be digitally signed. By default, UIA programs can be run only from the following protected paths: + - ..\\Program Files\\ (and subfolders) - ..\\Program Files (x86)\\ (and subfolders, in 64-bit versions of Windows only) - ..\\Windows\\System32\\ + The requirement to be in a protected path can be disabled by the [User Account Control: Only elevate UIAccess applications that are installed in secure locations](user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md) setting. Although this setting applies to any UIA program, it is used primarily in certain Windows Remote Assistance scenarios. + ### Countermeasure + Disable the **User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop** setting. + ### Potential impact + If a user requests remote assistance from an administrator and the remote assistance session is established, elevation prompts appear on the interactive user's secure desktop and the administrator's remote session is paused. To avoid pausing the remote administrator’s session during elevation requests, the user can select the "Allow IT Expert to respond to User Account Control prompts" check box when setting up the remote assistance session. However, selecting this check box requires that the interactive user respond to an elevation prompt on the secure desktop. If the interactive user is a standard user, the user does not have the required credentials to allow elevation. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md b/windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md index 2f01c9ecc5..28718b33ae 100644 --- a/windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md +++ b/windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md @@ -2,94 +2,99 @@ title: User Account Control Behavior of the elevation prompt for administrators in Admin Approval Mode (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Behavior of the elevation prompt for administrators in Admin Approval Mode security policy setting. ms.assetid: 46a3c3a2-1d2e-4a6f-b5e6-29f9592f535d -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode** security policy setting. + ## Reference + This policy setting determines the behavior of the elevation prompt for accounts that have administrative credentials. + ### Possible values + - **Elevate without prompting** + Assumes that the administrator will permit an operation that requires elevation, and additional consent or credentials are not required. - **Note**   - Selecting **Elevate without prompting** minimizes the protection that is provided by UAC. We do not recommend selecting this value unless administrator accounts are tightly controlled and the operating environment is highly secure. + >**Note:**  Selecting **Elevate without prompting** minimizes the protection that is provided by UAC. We do not recommend selecting this value unless administrator accounts are tightly controlled and the operating environment is highly secure.   - **Prompt for credentials on the secure desktop** + When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a privileged user name and password. If the user enters valid credentials, the operation continues with the user's highest available privilege. + - **Prompt for consent on the secure desktop** + When an operation requires elevation of privilege, the user is prompted on the secure desktop to select **Permit** or **Deny**. If the user selects **Permit**, the operation continues with the user's highest available privilege. + - **Prompt for credential**s + An operation that requires elevation of privilege prompts the administrator to type the user name and password. If the administrator enters valid credentials, the operation continues with the applicable privilege. + - **Prompt for consent** + An operation that requires elevation of privilege prompts the administrator to select **Permit** or **Deny**. If the administrator selects **Permit**, the operation continues with the administrator's highest available privilege. + - **Prompt for consent for non-Windows binaries** + This is the default. When an operation for a non-Microsoft application requires elevation of privilege, the user is prompted on the secure desktop to select **Permit** or **Deny**. If the user selects **Permit**, the operation continues with the user's highest available privilege. + ### Best practices + - Selecting the option **Elevate without prompting** minimizes the protection that is provided by UAC. We do not recommend selecting this value unless administrator accounts are tightly controlled and the operating environment is highly secure. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values -The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Prompt for consent for non-Windows binaries

      DC Effective Default Settings

      Prompt for consent for non-Windows binaries

      Member Server Effective Default Settings

      Prompt for consent for non-Windows binaries

      Client Computer Effective Default Settings

      Prompt for consent for non-Windows binaries

      + + +| Server type or GPO Default value | +| - | - | +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Not defined | +| Stand-Alone Server Default Settings | Prompt for consent for non-Windows binaries| +| DC Effective Default Settings | Prompt for consent for non-Windows binaries| +| Member Server Effective Default Settings | Prompt for consent for non-Windows binaries| +| Client Computer Effective Default Settings | Prompt for consent for non-Windows binaries|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. + ### Group Policy + All auditing capabilities are integrated in Group Policy. You can configure, deploy, and manage these settings in the Group Policy Management Console (GPMC) or Local Security Policy snap-in for a domain, site, or organizational unit (OU). + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + One of the risks that the UAC feature tries to mitigate is that of malicious software running under elevated credentials without the user or administrator being aware of its activity. This setting raises awareness to the administrator of elevated privilege operations, and it permits the administrator to prevent a malicious program from elevating its privilege when the program attempts to do so. + ### Countermeasure + Configure the **User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode** setting to **Prompt for consent**. + ### Potential impact + Administrators should be made aware that they will be prompted for consent when all binaries attempt to run. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md b/windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md index 727d8b7ba1..e382611db9 100644 --- a/windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md +++ b/windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md @@ -2,86 +2,88 @@ title: User Account Control Behavior of the elevation prompt for standard users (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Behavior of the elevation prompt for standard users security policy setting. ms.assetid: 1eae7def-8f6c-43b6-9474-23911fdc01ba -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # User Account Control: Behavior of the elevation prompt for standard users + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Behavior of the elevation prompt for standard users** security policy setting. + ## Reference + This policy setting determines the behavior of the elevation prompt for standard users. + ### Possible values + - **Automatically deny elevation requests** + This option returns an “Access denied” error message to standard users when they try to perform an operation that requires elevation of privilege. Most organizations that run desktops as standard users configure this policy to reduce Help Desk calls. + - **Prompt for credentials on the secure desktop** + This is the default. When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a different user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. + - **Prompt for credentials** + An operation that requires elevation of privilege prompts the user to type an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. + ### Best practices + 1. Configure the **User Account Control: Behavior of the elevation prompt for standard users** to **Automatically deny elevation requests**. This setting requires the user to log on with an administrative account to run programs that require elevation of privilege. 2. As a security best practice, standard users should not have knowledge of administrative passwords. However, if your users have both standard and administrator-level accounts, set **Prompt for credentials** so that the users do not choose to always log on with their administrator accounts, and they shift their behavior to use the standard user account. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Prompt for credentials on the secure desktop

      DC Effective Default Settings

      Prompt for credentials on the secure desktop

      Member Server Effective Default Settings

      Prompt for credentials on the secure desktop

      Client Computer Effective Default Settings

      Prompt for credentials on the secure desktop

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Prompt for credentials on the secure desktop| +| DC Effective Default Settings | Prompt for credentials on the secure desktop| +| Member Server Effective Default Settings | Prompt for credentials on the secure desktop| +| Client Computer Effective Default Settings | Prompt for credentials on the secure desktop|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. + ### Group Policy + All auditing capabilities are integrated in Group Policy. You can configure, deploy, and manage these settings in the Group Policy Management Console (GPMC) or Local Security Policy snap-in for a domain, site, or organizational unit (OU). + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + One of the risks that the UAC feature tries to mitigate is that of malicious programs running under elevated credentials without the user or administrator being aware of their activity. This setting raises awareness to the user that a program requires the use of elevated privilege operations, and it requires that the user supply administrative credentials for the program to run. + ### Countermeasure + Configure the **User Account Control: Behavior of the elevation prompt for standard users** to **Automatically deny elevation requests**. This setting requires the user to log on with an administrative account to run programs that require elevation of privilege. As a security best practice, standard users should not have knowledge of administrative passwords. However, if your users have both standard and administrator-level accounts, we recommend setting **Prompt for credentials** so that the users do not choose to always log on with their administrator accounts, and they shift their behavior to use the standard user account. + ### Potential impact + Users must provide administrative passwords to run programs with elevated privileges. This could cause an increased load on IT staff while the programs that are affected are identified and standard operating procedures are modified to support least privilege operations. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/user-account-control-detect-application-installations-and-prompt-for-elevation.md b/windows/keep-secure/user-account-control-detect-application-installations-and-prompt-for-elevation.md index 067ec3619c..178aa242b4 100644 --- a/windows/keep-secure/user-account-control-detect-application-installations-and-prompt-for-elevation.md +++ b/windows/keep-secure/user-account-control-detect-application-installations-and-prompt-for-elevation.md @@ -2,83 +2,81 @@ title: User Account Control Detect application installations and prompt for elevation (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Detect application installations and prompt for elevation security policy setting. ms.assetid: 3f8cb170-ba77-4c9f-abb3-c3ed1ef264fc -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # User Account Control: Detect application installations and prompt for elevation + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Detect application installations and prompt for elevation** security policy setting. + ## Reference + This policy setting determines the behavior of application installation detection for the entire system. Some software might attempt to install itself after being given permission to run. The user may give permission for the program to run because the program is trusted. Then the user is prompted to install an unknown component. This security policy provides another way to identify and stop these attempted software installations before they can do damage. + ### Possible values + - **Enabled** + Application installation packages that require an elevation of privilege to install are detected and the user is prompted for administrative credentials. + - **Disabled** + Application installation packages that require an elevation of privilege to install are not detected and the user is not prompted for administrative credentials. + ### Best practices + 1. Installer detection is unnecessary when enterprises run standard user desktops that capitalize on delegated installation technologies like Group Policy Software Install (GPSI) or Configuration Manager. Therefore you can set this security policy to **Disabled**. 2. Enable the **User Account Control: Detect application installations and prompt for elevation** setting so standard users must provide administrative credentials before software is installed. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Enabled

      DC Effective Default Settings

      Enabled

      Member Server Effective Default Settings

      Enabled

      Client Computer Effective Default Settings

      Enabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Enabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings| Enabled| +| Client Computer Effective Default Settings | Enabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Some malicious software might attempt to install itself after being given permission to run, for example, malicious software with a trusted application shell. The user may give permission for the program to run because the program is trusted. Then the user is prompted to install an unknown component. This policy provides another way to trap the software before it can do damage. + ### Countermeasure + Enable the **User Account Control: Detect application installations and prompt for elevation** setting. + ### Potential impact + Users must provide administrative passwords to install programs. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/user-account-control-only-elevate-executables-that-are-signed-and-validated.md b/windows/keep-secure/user-account-control-only-elevate-executables-that-are-signed-and-validated.md index 7c3f3ccfae..19768449e0 100644 --- a/windows/keep-secure/user-account-control-only-elevate-executables-that-are-signed-and-validated.md +++ b/windows/keep-secure/user-account-control-only-elevate-executables-that-are-signed-and-validated.md @@ -2,87 +2,89 @@ title: User Account Control Only elevate executables that are signed and validated (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Only elevate executables that are signed and validated security policy setting. ms.assetid: 64950a95-6985-4db6-9905-1db18557352d -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # User Account Control: Only elevate executables that are signed and validated + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Only elevate executables that are signed and validated** security policy setting. + ## Reference + This policy setting enforces public key infrastructure (PKI) signature checks on any interactive application that requests elevation of privilege. You can control the apps that are allowed to run through the population of certificates in the local computer's Trusted Publishers store. + A trusted publisher is a certificate issuer that the computer’s user has chosen to trust and that has certificate details that have been added to the store of trusted publishers. + Windows maintains certificates in certificate stores. These stores can be represented by containers in the file system or the registry, or they can be implemented as physical stores such as smart cards. Certificate stores are associated with the computer object or they are owned by a distinct user who has a security context and profile on that computer. In addition, services can have certificate stores. A certificate store will often contain numerous certificates, possibly issued from a number of different certification authorities (CAs). When certificate path discovery is initiated, Windows attempts to locate the issuing CA for the certificates, and it builds a certificate path to the trusted root certificate. Intermediate certificates are included as part of the application protocol or are picked up from Group Policy or through URLs that are specified in the Authority Information Access (AIA) extension. When the path is built, each certificate in the path is verified for validity with respect to various parameters, such as name, time, signature, revocation status, and other constraints. + ### Possible values + - **Enabled** + Enforces the PKI certificate chain validation of a given executable file before it is permitted to run. + - **Disabled** + Does not enforce PKI certificate chain validation before a given executable file is permitted to run. + ### Best practices + - Best practices are dependent on your security and performance goals. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Disabled

      DC Effective Default Settings

      Disabled

      Member Server Effective Default Settings

      Disabled

      Client Computer Effective Default Settings

      Disabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy. + ### Group Policy + All auditing capabilities are integrated in Group Policy. You can configure, deploy, and manage these settings in the Group Policy Management Console (GPMC) or Local Security Policy snap-in for a domain, site, or organizational unit (OU). + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Intellectual property, personally identifiable information, and other confidential data are normally manipulated by applications on the computer, and elevated credentials are required to access the information. Users and administrators inherently trust applications that are used with these information sources, and they provide their credentials. If one of these applications is replaced by a rogue application that appears identical to the trusted application, the confidential data could be compromised and the user's administrative credentials would also be compromised. + ### Countermeasure + Enable the **User Account Control: Only elevate executables that are signed and validated**. + ### Potential impact + Enabling this setting requires that you have a PKI infrastructure and that your enterprise administrators have populated the Trusted Publishers store with the certificates for the allowed applications. Some older applications are not signed, and they cannot be used in an environment that is hardened with this setting. You should carefully test your applications in a preproduction environment before implementing this setting. Control over the applications that are installed on the desktops and the hardware that joins your domain should provide similar protection from the vulnerability that is addressed by this setting. Additionally, the level of protection that is provided by this setting is not an assurance that all rogue applications will be found. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md b/windows/keep-secure/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md index b79b29a94b..890ec0f2ff 100644 --- a/windows/keep-secure/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md +++ b/windows/keep-secure/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md @@ -2,103 +2,111 @@ title: User Account Control Only elevate UIAccess applications that are installed in secure locations (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Only elevate UIAccess applications that are installed in secure locations security policy setting. ms.assetid: 4333409e-a5be-4f2f-8808-618f53abd22c -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # User Account Control: Only elevate UIAccess applications that are installed in secure locations + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Only elevate UIAccess applications that are installed in secure locations** security policy setting. + ## Reference + This policy setting enforces the requirement that apps that request running with a UIAccess integrity level (by means of a marking of UIAccess=true in their app manifest), must reside in a secure location on the file system. Relatively secure locations are limited to the following directories: + - \\Program Files\\ including subdirectories - \\Windows\\system32\\ - \\Program Files (x86)\\ including subdirectories for 64-bit versions of Windows -**Note**   -Windows enforces a PKI signature check on any interactive application that requests running with a UIAccess integrity level, regardless of the state of this security setting. + +>**Note:**  Windows enforces a PKI signature check on any interactive application that requests running with a UIAccess integrity level, regardless of the state of this security setting.   **Background** + User Interface Privilege Isolation (UIPI) implements restrictions in the Windows subsystem that prevent lower-privilege applications from sending messages or installing hooks in higher-privilege processes. Higher-privilege applications are permitted to send messages to lower-privilege processes. UIPI does not interfere with or change the behavior of messages between applications at the same privilege (or integrity) level. + Microsoft UI Automation is the current model to support accessibility requirements in the Windows operating systems. Applications that are designed to support an accessible user experience control the behavior of other Windows applications on behalf of the user. When all applications on the automation client computer and server are running as a standard user (that is, at a medium integrity level), the UIPI restrictions do not interfere with the Microsoft UI automation model. + However, there might be times when an administrative user runs an application with elevated privilege based on UAC in Admin Approval Mode. Microsoft UI Automation cannot drive the UI graphics of elevated applications on the desktop without the ability to bypass the restrictions that UIPI implements. The ability to bypass UIPI restrictions across privilege levels is available for UI automation programs by using UIAccess. + If an application presents a UIAccess attribute when it requests privileges, the application is stating a requirement to bypass UIPI restrictions for sending messages across privilege levels. Devices implement the following policy checks before starting an application with UIAccess privilege. + 1. The application must have a digital signature that can be verified by using a digital certificate that is associated with the Trusted Root Certification Authorities store on the local device 2. The application must be installed in a local folder that is writeable only by administrators, such as the Program Files directory. The allowed directories for UI automation applications are: + 1. %ProgramFiles% and its subdirectories. 2. %WinDir% and its subdirectories, except a few subdirectories that are excluded because standard users have write access. + ### Possible values + - **Enabled** + An application can start with UIAccess integrity only if it resides in a secure location in the file system. + - **Disabled** + An application can start with UIAccess integrity even if it does not reside in a secure location in the file system. + ### Best practices + - Set this policy to **Enabled** to permit applications that are located in one of the designated secure directories to run with UIAccess integrity. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Enabled

      DC Effective Default Settings

      Enabled

      Member Server Effective Default Settings

      Enabled

      Client Computer Effective Default Settings

      Enabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Enabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings| Enabled| +| Client Computer Effective Default Settings | Enabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they aresaved locally or distributed through Group Policy. + ### Group Policy + All auditing capabilities are integrated in Group Policy. You can configure, deploy, and manage these settings in the Group Policy Management Console (GPMC) or Local Security Policy snap-in for a domain, site, or organizational unit (OU). + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + UIAccess integrity allows an application to bypass User Interface Privilege Isolation (UIPI) restrictions when an application is elevated in privilege from a standard user to an administrator. When this setting is enabled, an application that has the UIAccess flag set to true in its manifest can interchange information with applications that are running at a higher privilege level, such as logon prompts and privilege elevation prompts. This ability is required to support accessibility features such as screen readers that are transmitting user interfaces to alternative forms, but it is not required by most applications. A process that is started with UIAccess rights has the following abilities: + - Set the foreground window. - Drive any application window by using the SendInput function. - Use read input for all integrity levels by using low-level hooks, raw input, GetKeyState, GetAsyncKeyState, and GetKeyboardInput. - Set journal hooks. - Use AttachThreadInput to attach a thread to a higher integrity input queue. + ### Countermeasure + Enable the **User Account Control: Only elevate UIAccess applications that are installed in secure locations** setting. + ### Potential impact + If the application that requests UIAccess meets the UIAccess setting requirements, computers running at least the Windows Vista operating system start the application with the ability to bypass most of the UIPI restrictions. If the application does not meet the security restrictions, the application is started without UIAccess rights, and it can interact only with applications at the same or lower privilege level. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/user-account-control-run-all-administrators-in-admin-approval-mode.md b/windows/keep-secure/user-account-control-run-all-administrators-in-admin-approval-mode.md index 0c53ba8b97..63ac1e4a65 100644 --- a/windows/keep-secure/user-account-control-run-all-administrators-in-admin-approval-mode.md +++ b/windows/keep-secure/user-account-control-run-all-administrators-in-admin-approval-mode.md @@ -2,86 +2,85 @@ title: User Account Control Run all administrators in Admin Approval Mode (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Run all administrators in Admin Approval Mode security policy setting. ms.assetid: b838c561-7bfc-41ef-a7a5-55857259c7bf -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # User Account Control: Run all administrators in Admin Approval Mode + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Run all administrators in Admin Approval Mode** security policy setting. + ## Reference + This policy setting determines the behavior of all User Account Control (UAC) policies for the entire system. This is the setting that turns UAC on or off. + ### Possible values + - **Enabled** + Admin Approval Mode and all other UAC policies are dependent on this option being enabled. Changing this setting requires restarting the system. + - **Disabled** + Admin Approval Mode and all related UAC policies are disabled. - **Note**   - If this security setting is configured to **Disabled**, the Security Center notifies the user that the overall security of the operating system has been reduced. + + >**Note:**  If this security setting is configured to **Disabled**, the Security Center notifies the user that the overall security of the operating system has been reduced.   ### Best practices + - Enable this policy to allow all other UAC features and policies to function. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Enabled

      DC Effective Default Settings

      Enabled

      Member Server Effective Default Settings

      Enabled

      Client Computer Effective Default Settings

      Enabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Enabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings| Enabled| +| Client Computer Effective Default Settings | Enabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + A restart of the computer is required before this policy will be effective when changes to this policy are saved locally or distributed through Group Policy. + ### Group Policy + All auditing capabilities are integrated in Group Policy. You can configure, deploy, and manage these settings in the Group Policy Management Console (GPMC) or Local Security Policy snap-in for a domain, site, or organizational unit (OU). + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + This is the setting that turns UAC on or off. If this setting is disabled, UAC is not used, and any security benefits and risk mitigations that are dependent on UAC are not present on the computer. + ### Countermeasure + Enable the **User Account Control: Run all users, including administrators, as standard users** setting. + ### Potential impact + Users and administrators must learn to work with UAC prompts and adjust their work habits to use least privilege operations. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/user-account-control-security-policy-settings.md b/windows/keep-secure/user-account-control-security-policy-settings.md index d1a286bf5e..569bf9892e 100644 --- a/windows/keep-secure/user-account-control-security-policy-settings.md +++ b/windows/keep-secure/user-account-control-security-policy-settings.md @@ -2,66 +2,95 @@ title: User Account Control security policy settings (Windows 10) description: You can use security policies to configure how User Account Control works in your organization. They can be configured locally by using the Local Security Policy snap-in (secpol.msc) or configured for the domain, OU, or specific groups by Group Policy. ms.assetid: 3D75A9AC-69BB-4EF2-ACB3-1769791E1B98 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: operate ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # User Account Control security policy settings + **Applies to** - Windows 10 + You can use security policies to configure how User Account Control works in your organization. They can be configured locally by using the Local Security Policy snap-in (secpol.msc) or configured for the domain, OU, or specific groups by Group Policy. + ## User Account Control: Admin Approval Mode for the Built-in Administrator account + This policy setting controls the behavior of Admin Approval Mode for the built-in Administrator account. + - **Enabled** The built-in Administrator account uses Admin Approval Mode. By default, any operation that requires elevation of privilege will prompt the user to approve the operation. - **Disabled** (Default) The built-in Administrator account runs all applications with full administrative privilege. + ## User Account Control: Allow UIAccess application to prompt for elevation without using the secure desktop + This policy setting controls whether User Interface Accessibility (UIAccess or UIA) programs can automatically disable the secure desktop for elevation prompts used by a standard user. + - **Enabled** UIA programs, including Windows Remote Assistance, automatically disable the secure desktop for elevation prompts. If you do not disable the "User Account Control: Switch to the secure desktop when prompting for elevation" policy setting, the prompts appear on the interactive user's desktop instead of the secure desktop. - **Disabled** (Default) The secure desktop can be disabled only by the user of the interactive desktop or by disabling the "User Account Control: Switch to the secure desktop when prompting for elevation" policy setting. + ## User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode + This policy setting controls the behavior of the elevation prompt for administrators. + - **Elevate without prompting** Allows privileged accounts to perform an operation that requires elevation without requiring consent or credentials. - **Note**  Use this option only in the most constrained environments. + + >**Note:**  Use this option only in the most constrained environments.   - **Prompt for credentials on the secure desktop** When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a privileged user name and password. If the user enters valid credentials, the operation continues with the user's highest available privilege. - **Prompt for consent on the secure desktop** When an operation requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. - **Prompt for credentials** When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. - **Prompt for consent** When an operation requires elevation of privilege, the user is prompted to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. - **Prompt for consent for non-Windows binaries** (Default) When an operation for a non-Microsoft application requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. + ## User Account Control: Behavior of the elevation prompt for standard users + This policy setting controls the behavior of the elevation prompt for standard users. + - **Prompt for credentials** (Default) When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. - **Automatically deny elevation requests** When an operation requires elevation of privilege, a configurable access denied error message is displayed. An enterprise that is running desktops as standard user may choose this setting to reduce help desk calls. - **Prompt for credentials on the secure desktop** When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a different user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. + ## User Account Control: Detect application installations and prompt for elevation + This policy setting controls the behavior of application installation detection for the computer. + - **Enabled** (Default) When an app installation package is detected that requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. - - **Disabled** App installation packages are not detected and prompted for elevation. Enterprises that are running standard user desktops and use delegated installation technologies, such as Group Policy or System Center Configuration Manager should disable this policy setting. In this case, installer detection is unnecessary. + ## User Account Control: Only elevate executable files that are signed and validated + This policy setting enforces public key infrastructure (PKI) signature checks for any interactive applications that request elevation of privilege. Enterprise administrators can control which applications are allowed to run by adding certificates to the Trusted Publishers certificate store on local computers. + - **Enabled** Enforces the certificate certification path validation for a given executable file before it is permitted to run. - **Disabled** (Default) Does not enforce the certificate certification path validation before a given executable file is permitted to run. + ## User Account Control: Only elevate UIAccess applications that are installed in secure locations + This policy setting controls whether applications that request to run with a User Interface Accessibility (UIAccess) integrity level must reside in a secure location in the file system. Secure locations are limited to the following: - …\\Program Files\\, including subfolders - …\\Windows\\system32\\ - …\\Program Files (x86)\\, including subfolders for 64-bit versions of Windows -**Note**   -Windows enforces a digital signature check on any interactive app that requests to run with a UIAccess integrity level regardless of the state of this security setting. + +>**Note:**  Windows enforces a digital signature check on any interactive app that requests to run with a UIAccess integrity level regardless of the state of this security setting.   - **Enabled** (Default) If an app resides in a secure location in the file system, it runs only with UIAccess integrity. - **Disabled** An app runs with UIAccess integrity even if it does not reside in a secure location in the file system. + ## User Account Control: Turn on Admin Approval Mode + This policy setting controls the behavior of all User Account Control (UAC) policy settings for the computer. If you change this policy setting, you must restart your computer. + - **Enabled** (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the Administrators group to run in Admin Approval Mode. - **Disabled** Admin Approval Mode and all related UAC policy settings are disabled. Note: If this policy setting is disabled, the Security Center notifies you that the overall security of the operating system has been reduced. + ## User Account Control: Switch to the secure desktop when prompting for elevation + This policy setting controls whether the elevation request prompt is displayed on the interactive user's desktop or the secure desktop. + - **Enabled** (Default) All elevation requests go to the secure desktop regardless of prompt behavior policy settings for administrators and standard users. - **Disabled** All elevation requests go to the interactive user's desktop. Prompt behavior policy settings for administrators and standard users are used. ## User Account Control: Virtualize file and registry write failures to per-user locations + This policy setting controls whether application write failures are redirected to defined registry and file system locations. This policy setting mitigates applications that run as administrator and write run-time application data to %ProgramFiles%, %Windir%, %Windir%\\system32, or HKLM\\Software. + - **Enabled** (Default) App write failures are redirected at run time to defined user locations for both the file system and registry. - **Disabled** Apps that write data to protected locations fail. -  -  diff --git a/windows/keep-secure/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md b/windows/keep-secure/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md index 9475c83eba..ee510bb52e 100644 --- a/windows/keep-secure/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md +++ b/windows/keep-secure/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md @@ -2,85 +2,88 @@ title: User Account Control Switch to the secure desktop when prompting for elevation (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Switch to the secure desktop when prompting for elevation security policy setting. ms.assetid: 77a067db-c70d-4b02-9861-027503311b8b -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # User Account Control: Switch to the secure desktop when prompting for elevation + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Switch to the secure desktop when prompting for elevation** security policy setting. + ## Reference + This policy setting determines whether the elevation request prompts on the interactive user desktop or on the secure desktop. + The secure desktop presents the logon UI and restricts functionality and access to the system until the logon requirements are satisfied. + The secure desktop’s primary difference from the user desktop is that only trusted processes running as SYSTEM are allowed to run here (that is, nothing is running at the user’s privilege level). The path to get to the secure desktop from the user desktop must also be trusted through the entire chain. + ### Possible values + - **Enabled** + All elevation requests by default go to the secure desktop. + - **Disabled** + All elevation requests go to the interactive user desktop. + ### Best practices -- Enable the **User Account Control: Switch to the secure desktop when prompting for elevation setting**. The secure desktop helps protect against input and output spoofing by presenting the credentials dialog box in a protected section of memory that is accessible only by trusted system processes. + +- Enable the **User Account Control: Switch to the secure desktop when prompting for elevation setting**. The secure desktop helps protect against input and output spoofing by presenting the credentials dialog box in a protected section of memory that is accessible only by trusted system +processes. + ### Location + Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Enabled

      DC Effective Default Settings

      Enabled

      Member Server Effective Default Settings

      Enabled

      Client Computer Effective Default Settings

      Enabled

      + +| Server type or GPO | Default value | +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Enabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings| Enabled| +| Client Computer Effective Default Settings | Enabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Group Policy + All auditing capabilities are integrated in Group Policy. You can configure, deploy, and manage these settings in the Group Policy Management Console (GPMC) or Local Security Policy snap-in for a domain, site, or organizational unit (OU). + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Elevation prompt dialog boxes can be spoofed, causing users to disclose their passwords to malicious software. Mouse cursors can be spoofed by hiding the real cursor and replacing it with an offset so the cursor is actually pointing to the **Allow** button. + ### Countermeasure + Enable the **User Account Control: Switch to the secure desktop when prompting for elevation setting**. The secure desktop helps protect against input and output spoofing by presenting the credentials dialog box in a protected section of memory that is accessible only by trusted system processes. + ### Potential impact + None. This is the default configuration. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md b/windows/keep-secure/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md index ffb892226b..afc3766b73 100644 --- a/windows/keep-secure/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md +++ b/windows/keep-secure/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md @@ -2,85 +2,86 @@ title: User Account Control Virtualize file and registry write failures to per-user locations (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Virtualize file and registry write failures to per-user locations security policy setting. ms.assetid: a7b47420-cc41-4b1c-b03e-f67a05221261 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # User Account Control: Virtualize file and registry write failures to per-user locations + **Applies to** - Windows 10 + Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Virtualize file and registry write failures to per-user locations** security policy setting. + ## Reference + This policy setting enables or disables the redirection of the write failures of earlier applications to defined locations in the registry and the file system. This feature mitigates applications that historically ran as administrator and wrote runtime application data to %ProgramFiles%, %Windir%, %Windir%\\system32, or HKEY\_LOCAL\_MACHINE\\Software\\. + This feature can be disabled for applications on devices running at least Windows Vista because it is unnecessary. + ### Possible values + - **Enabled** + Setting this value facilitates the runtime redirection of application write failures to defined user locations for the file system and the registry. + - **Disabled** + Applications that write data to protected locations fail. + ### Best practices + 1. If you run applications that are not Windows Vista-compliant, enable this security policy to prevent the possibility that these older applications could write data to unsecure locations. 2. If you only run at least Windows Vista–compliant applications, this feature is unnecessary so you can disable this policy. + ### Location + \\Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + ### Default values + The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Server type or GPODefault value

      Default Domain Policy

      Not defined

      Default Domain Controller Policy

      Not defined

      Stand-Alone Server Default Settings

      Enabled

      DC Effective Default Settings

      Enabled

      Member Server Effective Default Settings

      Enabled

      Client Computer Effective Default Settings

      Enabled

      + +| Server type or GPO | Default value| +| - | - | +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Enabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings| Enabled| +| Client Computer Effective Default Settings | Enabled|   ## Policy management + This section describes features and tools that are available to help you manage this policy. + ### Restart requirement + None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + ### Group Policy + All auditing capabilities are integrated in Group Policy. You can configure, deploy, and manage these settings in the Group Policy Management Console (GPMC) or Local Security Policy snap-in for a domain, site, or organizational unit (OU). + ## Security considerations + This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + ### Vulnerability + Earlier applications might not write data to secure locations. + ### Countermeasure + Enable the **User Account Control: Virtualize file and registry write failures to per-user locations** setting. + ### Potential impact + None. This is the default configuration. + ## Related topics -[Security Options](security-options.md) -  -  + +- [Security Options](security-options.md) diff --git a/windows/keep-secure/user-rights-assignment.md b/windows/keep-secure/user-rights-assignment.md index 3e96944b76..401613dde1 100644 --- a/windows/keep-secure/user-rights-assignment.md +++ b/windows/keep-secure/user-rights-assignment.md @@ -2,212 +2,75 @@ title: User Rights Assignment (Windows 10) description: Provides an overview and links to information about the User Rights Assignment security policy settings user rights that are available in Windows. ms.assetid: 99340252-60be-4c79-b0a5-56fbe1a9b0c5 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # User Rights Assignment + **Applies to** - Windows 10 + Provides an overview and links to information about the User Rights Assignment security policy settings user rights that are available in Windows. User rights govern the methods by which a user can log on to a system. User rights are applied at the local device level, and they allow users to perform tasks on a device or in a domain. User rights include logon rights and permissions. Logon rights control who is authorized to log on to a device and how they can log on. User rights permissions control access to computer and domain resources, and they can override permissions that have been set on specific objects. User rights are managed in Group Policy under the **User Rights Assignment** item. -Each user right has a constant name and a Group Policy name associated with it. The constant names are used when referring to the user right in log events. You can configure the user rights assignment settings in the following location within the Group Policy Management Console (GPMC) under **Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment**, or on the local device by using the Local Group Policy Editor (gpedit.msc). + +Each user right has a constant name and a Group Policy name associated with it. The constant names are used when referring to the user right in log events. You can configure the user rights assignment settings in the following location within the Group Policy Management Console (GPMC) under +**Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment**, or on the local device by using the Local Group Policy Editor (gpedit.msc). + For information about setting security policies, see [Configure security policy settings](how-to-configure-security-policy-settings.md). + The following table links to each security policy setting and provides the constant name for each. Setting descriptions contain reference information, best practices for configuring the policy setting, default values, differences between operating system versions, and considerations for policy management and security. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Group Policy SettingConstant Name

      [Access Credential Manager as a trusted caller](access-credential-manager-as-a-trusted-caller.md)

      SeTrustedCredManAccessPrivilege

      [Access this computer from the network](access-this-computer-from-the-network.md)

      SeNetworkLogonRight

      [Act as part of the operating system](act-as-part-of-the-operating-system.md)

      SeTcbPrivilege

      [Add workstations to domain](add-workstations-to-domain.md)

      SeMachineAccountPrivilege

      [Adjust memory quotas for a process](adjust-memory-quotas-for-a-process.md)

      SeIncreaseQuotaPrivilege

      [Allow log on locally](allow-log-on-locally.md)

      SeInteractiveLogonRight

      [Allow log on through Remote Desktop Services](allow-log-on-through-remote-desktop-services.md)

      SeRemoteInteractiveLogonRight

      [Back up files and directories](back-up-files-and-directories.md)

      SeBackupPrivilege

      [Bypass traverse checking](bypass-traverse-checking.md)

      SeChangeNotifyPrivilege

      [Change the system time](change-the-system-time.md)

      SeSystemtimePrivilege

      [Change the time zone](change-the-time-zone.md)

      SeTimeZonePrivilege

      [Create a pagefile](create-a-pagefile.md)

      SeCreatePagefilePrivilege

      [Create a token object](create-a-token-object.md)

      SeCreateTokenPrivilege

      [Create global objects](create-global-objects.md)

      SeCreateGlobalPrivilege

      [Create permanent shared objects](create-permanent-shared-objects.md)

      SeCreatePermanentPrivilege

      [Create symbolic links](create-symbolic-links.md)

      SeCreateSymbolicLinkPrivilege

      [Debug programs](debug-programs.md)

      SeDebugPrivilege

      [Deny access to this computer from the network](deny-access-to-this-computer-from-the-network.md)

      SeDenyNetworkLogonRight

      [Deny log on as a batch job](deny-log-on-as-a-batch-job.md)

      SeDenyBatchLogonRight

      [Deny log on as a service](deny-log-on-as-a-service.md)

      SeDenyServiceLogonRight

      [Deny log on locally](deny-log-on-locally.md)

      SeDenyInteractiveLogonRight

      [Deny log on through Remote Desktop Services](deny-log-on-through-remote-desktop-services.md)

      SeDenyRemoteInteractiveLogonRight

      [Enable computer and user accounts to be trusted for delegation](enable-computer-and-user-accounts-to-be-trusted-for-delegation.md)

      SeEnableDelegationPrivilege

      [Force shutdown from a remote system](force-shutdown-from-a-remote-system.md)

      SeRemoteShutdownPrivilege

      [Generate security audits](generate-security-audits.md)

      SeAuditPrivilege

      [Impersonate a client after authentication](impersonate-a-client-after-authentication.md)

      SeImpersonatePrivilege

      [Increase a process working set](increase-a-process-working-set.md)

      SeIncreaseWorkingSetPrivilege

      [Increase scheduling priority](increase-scheduling-priority.md)

      SeIncreaseBasePriorityPrivilege

      [Load and unload device drivers](load-and-unload-device-drivers.md)

      SeLoadDriverPrivilege

      [Lock pages in memory](lock-pages-in-memory.md)

      SeLockMemoryPrivilege

      [Log on as a batch job](log-on-as-a-batch-job.md)

      SeBatchLogonRight

      [Log on as a service](log-on-as-a-service.md)

      SeServiceLogonRight

      [Manage auditing and security log](manage-auditing-and-security-log.md)

      SeSecurityPrivilege

      [Modify an object label](modify-an-object-label.md)

      SeRelabelPrivilege

      [Modify firmware environment values](modify-firmware-environment-values.md)

      SeSystemEnvironmentPrivilege

      [Perform volume maintenance tasks](perform-volume-maintenance-tasks.md)

      SeManageVolumePrivilege

      [Profile single process](profile-single-process.md)

      SeProfileSingleProcessPrivilege

      [Profile system performance](profile-system-performance.md)

      SeSystemProfilePrivilege

      [Remove computer from docking station](remove-computer-from-docking-station.md)

      SeUndockPrivilege

      [Replace a process level token](replace-a-process-level-token.md)

      SeAssignPrimaryTokenPrivilege

      [Restore files and directories](restore-files-and-directories.md)

      SeRestorePrivilege

      [Shut down the system](shut-down-the-system.md)

      SeShutdownPrivilege

      [Synchronize directory service data](synchronize-directory-service-data.md)

      SeSyncAgentPrivilege

      [Take ownership of files or other objects](take-ownership-of-files-or-other-objects.md)

      SeTakeOwnershipPrivilege

      + +| Group Policy Setting | Constant Name | +| - | - | +| [Access Credential Manager as a trusted caller](access-credential-manager-as-a-trusted-caller.md) | SeTrustedCredManAccessPrivilege| +| [Access this computer from the network](access-this-computer-from-the-network.md) | SeNetworkLogonRight| +| [Act as part of the operating system](act-as-part-of-the-operating-system.md) | SeTcbPrivilege| +| [Add workstations to domain](add-workstations-to-domain.md) | SeMachineAccountPrivilege| +| [Adjust memory quotas for a process](adjust-memory-quotas-for-a-process.md) | SeIncreaseQuotaPrivilege| +| [Allow log on locally](allow-log-on-locally.md) | SeInteractiveLogonRight| +| [Allow log on through Remote Desktop Services](allow-log-on-through-remote-desktop-services.md)| SeRemoteInteractiveLogonRight| +| [Back up files and directories](back-up-files-and-directories.md) | SeBackupPrivilege| +| [Bypass traverse checking](bypass-traverse-checking.md) | SeChangeNotifyPrivilege| +| [Change the system time](change-the-system-time.md) | SeSystemtimePrivilege| +| [Change the time zone](change-the-time-zone.md) | SeTimeZonePrivilege| +| [Create a pagefile](create-a-pagefile.md) | SeCreatePagefilePrivilege| +| [Create a token object](create-a-token-object.md) | SeCreateTokenPrivilege| +| [Create global objects](create-global-objects.md) | SeCreateGlobalPrivilege| +| [Create permanent shared objects](create-permanent-shared-objects.md) | SeCreatePermanentPrivilege| +| [Create symbolic links](create-symbolic-links.md) | SeCreateSymbolicLinkPrivilege| +| [Debug programs](debug-programs.md) | SeDebugPrivilege| +| [Deny access to this computer from the network](deny-access-to-this-computer-from-the-network.md)| SeDenyNetworkLogonRight | +| [Deny log on as a batch job](deny-log-on-as-a-batch-job.md) | SeDenyBatchLogonRight| +| [Deny log on as a service](deny-log-on-as-a-service.md) | SeDenyServiceLogonRight | +| [Deny log on locally](deny-log-on-locally.md) | SeDenyInteractiveLogonRight| +| [Deny log on through Remote Desktop Services](deny-log-on-through-remote-desktop-services.md)| SeDenyRemoteInteractiveLogonRight| +| [Enable computer and user accounts to be trusted for delegation](enable-computer-and-user-accounts-to-be-trusted-for-delegation.md)| SeEnableDelegationPrivilege| +| [Force shutdown from a remote system](force-shutdown-from-a-remote-system.md) | SeRemoteShutdownPrivilege| +| [Generate security audits](generate-security-audits.md) | SeAuditPrivilege| +| [Impersonate a client after authentication](impersonate-a-client-after-authentication.md)| SeImpersonatePrivilege| +| [Increase a process working set](increase-a-process-working-set.md) | SeIncreaseWorkingSetPrivilege| +| [Increase scheduling priority](increase-scheduling-priority.md) | SeIncreaseBasePriorityPrivilege| +| [Load and unload device drivers](load-and-unload-device-drivers.md) | SeLoadDriverPrivilege| +| [Lock pages in memory](lock-pages-in-memory.md) | SeLockMemoryPrivilege| +| [Log on as a batch job](log-on-as-a-batch-job.md) | SeBatchLogonRight| +| [Log on as a service](log-on-as-a-service.md) | SeServiceLogonRight| +| [Manage auditing and security log](manage-auditing-and-security-log.md)| SeSecurityPrivilege| +| [Modify an object label](modify-an-object-label.md) | SeRelabelPrivilege| +| [Modify firmware environment values](modify-firmware-environment-values.md)| SeSystemEnvironmentPrivilege| +| [Perform volume maintenance tasks](perform-volume-maintenance-tasks.md) | SeManageVolumePrivilege| +| [Profile single process](profile-single-process.md) | SeProfileSingleProcessPrivilege| +| [Profile system performance](profile-system-performance.md) | SeSystemProfilePrivilege| +| [Remove computer from docking station](remove-computer-from-docking-station.md) | SeUndockPrivilege| +| [Replace a process level token](replace-a-process-level-token.md) | SeAssignPrimaryTokenPrivilege| +| [Restore files and directories](restore-files-and-directories.md) | SeRestorePrivilege | +| [Shut down the system](shut-down-the-system.md) | SeShutdownPrivilege| +| [Synchronize directory service data](synchronize-directory-service-data.md)| SeSyncAgentPrivilege| +| [Take ownership of files or other objects](take-ownership-of-files-or-other-objects.md) | SeTakeOwnershipPrivilege|   ## Related topics -[Security policy settings reference](security-policy-settings-reference.md) -  -  + +- [Security policy settings reference](security-policy-settings-reference.md) diff --git a/windows/keep-secure/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md b/windows/keep-secure/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md index fe7a396637..13d5fc93e5 100644 --- a/windows/keep-secure/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md +++ b/windows/keep-secure/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md @@ -2,71 +2,41 @@ title: Using advanced security auditing options to monitor dynamic access control objects (Windows 10) description: This guide explains the process of setting up advanced security auditing capabilities that are made possible through settings and events that were introduced in Windows 8 and Windows Server 2012. ms.assetid: 0d2c28ea-bdaf-47fd-bca2-a07dce5fed37 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Using advanced security auditing options to monitor dynamic access control objects + **Applies to** - Windows 10 + This guide explains the process of setting up advanced security auditing capabilities that are made possible through settings and events that were introduced in Windows 8 and Windows Server 2012. + These procedures can be deployed with the advanced security auditing capabilities described in [Deploy Security Auditing with Central Audit Policies (Demonstration Steps)](http://technet.microsoft.com/library/hh831542.aspx). + ## In this guide + Domain administrators can create and deploy expression-based security audit policies by using file classification information (resource attributes), user claims, and device claims to target specific users and resources to monitor potentially significant activities on one or more computers. These policies can be deployed centrally by using Group Policy, or directly on a computer, in a folder, or in individual files. + ## In this section - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      TopicDescription

      [Monitor the central access policies that apply on a file server](monitor-the-central-access-policies-that-apply-on-a-file-server.md)

      This topic for the IT professional describes how to monitor changes to the central access policies that apply to a file server when using advanced security auditing options to monitor dynamic access control objects. Central access policies are created on a domain controller and then applied to file servers through Group Policy management.

      [Monitor the use of removable storage devices](monitor-the-use-of-removable-storage-devices.md)

      This topic for the IT professional describes how to monitor attempts to use removable storage devices to access network resources. It describes how to use advanced security auditing options to monitor dynamic access control objects.

      [Monitor resource attribute definitions](monitor-resource-attribute-definitions.md)

      This topic for the IT professional describes how to monitor changes to resource attribute definitions when you are using advanced security auditing options to monitor dynamic access control objects.

      [Monitor central access policy and rule definitions](monitor-central-access-policy-and-rule-definitions.md)

      This topic for the IT professional describes how to monitor changes to central access policy and central access rule definitions when you use advanced security auditing options to monitor dynamic access control objects.

      [Monitor user and device claims during sign-in](monitor-user-and-device-claims-during-sign-in.md)

      This topic for the IT professional describes how to monitor user and device claims that are associated with a user’s security token when you are using advanced security auditing options to monitor dynamic access control objects.

      [Monitor the resource attributes on files and folders](monitor-the-resource-attributes-on-files-and-folders.md)

      This topic for the IT professional describes how to monitor attempts to change settings to the resource attributes on files when you are using advanced security auditing options to monitor dynamic access control objects.

      [Monitor the central access policies associated with files and folders](monitor-the-central-access-policies-associated-with-files-and-folders.md)

      This topic for the IT professional describes how to monitor changes to the central access policies that are associated with files and folders when you are using advanced security auditing options to monitor dynamic access control objects.

      [Monitor claim types](monitor-claim-types.md)

      This topic for the IT professional describes how to monitor changes to claim types that are associated with dynamic access control when you are using advanced security auditing options.

      + +| Topic | Description | +| - | - | +| [Monitor the central access policies that apply on a file server](monitor-the-central-access-policies-that-apply-on-a-file-server.md) | This topic for the IT professional describes how to monitor changes to the central access policies that apply to a file server when using advanced security auditing options to monitor dynamic access control objects. Central access policies are created on a domain controller and then applied to file servers through Group Policy management. | +| [Monitor the use of removable storage devices](monitor-the-use-of-removable-storage-devices.md) | This topic for the IT professional describes how to monitor attempts to use removable storage devices to access network resources. It describes how to use advanced security auditing options to monitor dynamic access control objects. | +| [Monitor resource attribute definitions](monitor-resource-attribute-definitions.md)| This topic for the IT professional describes how to monitor changes to resource attribute definitions when you are using advanced security auditing options to monitor dynamic access control objects.| +| [Monitor central access policy and rule definitions](monitor-central-access-policy-and-rule-definitions.md) | This topic for the IT professional describes how to monitor changes to central access policy and central access rule definitions when you use advanced security auditing options to monitor dynamic access control objects. | +| [Monitor user and device claims during sign-in](monitor-user-and-device-claims-during-sign-in.md)| This topic for the IT professional describes how to monitor user and device claims that are associated with a user’s security token when you are using advanced security auditing options to monitor dynamic access control objects. | +| [Monitor the resource attributes on files and folders](monitor-the-resource-attributes-on-files-and-folders.md)| This topic for the IT professional describes how to monitor attempts to change settings to the resource attributes on files when you are using advanced security auditing options to monitor dynamic access control objects. | +| [Monitor the central access policies associated with files and folders](monitor-the-central-access-policies-associated-with-files-and-folders.md)| This topic for the IT professional describes how to monitor changes to the central access policies that are associated with files and folders when you are using advanced security auditing options to monitor dynamic access control objects. | +| [Monitor claim types](monitor-claim-types.md) | This topic for the IT professional describes how to monitor changes to claim types that are associated with dynamic access control when you are using advanced security auditing options.|   -**Important**   -This procedure can be configured on computers running any of the supported Windows operating systems. The other monitoring procedures can be configured only as part of a functioning dynamic access control deployment. +>**Important:**  This procedure can be configured on computers running any of the supported Windows operating systems. The other monitoring procedures can be configured only as part of a functioning dynamic access control deployment.   ## Related topics -[Security auditing](security-auditing-overview.md) -  -  + +- [Security auditing](security-auditing-overview.md) diff --git a/windows/keep-secure/using-event-viewer-with-applocker.md b/windows/keep-secure/using-event-viewer-with-applocker.md index 304915e207..dcee6821bc 100644 --- a/windows/keep-secure/using-event-viewer-with-applocker.md +++ b/windows/keep-secure/using-event-viewer-with-applocker.md @@ -2,145 +2,61 @@ title: Using Event Viewer with AppLocker (Windows 10) description: This topic lists AppLocker events and describes how to use Event Viewer with AppLocker. ms.assetid: 109abb10-78b1-4c29-a576-e5a17dfeb916 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Using Event Viewer with AppLocker + **Applies to** - Windows 10 + This topic lists AppLocker events and describes how to use Event Viewer with AppLocker. + The AppLocker log contains information about applications that are affected by AppLocker rules. Each event in the log contains detailed info about: + - Which file is affected and the path of that file - Which packaged app is affected and the package identifier of the app - Whether the file or packaged app is allowed or blocked - The rule type (path, file hash, or publisher) - The rule name - The security identifier (SID) for the user or group identified in the rule + Review the entries in the Event Viewer to determine if any applications are not included in the rules that you automatically generated. For instance, some line-of-business apps are installed to non-standard locations, such as the root of the active drive (for example: %SystemDrive%). + For info about what to look for in the AppLocker event logs, see [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md). + **To review the AppLocker log in Event Viewer** + 1. Open Event Viewer. 2. In the console tree under **Application and Services Logs\\Microsoft\\Windows**, click **AppLocker**. + The following table contains information about the events that you can use to determine which apps are affected by AppLocker rules. - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Event IDLevelEvent messageDescription

      8000

      Error

      Application Identity Policy conversion failed. Status <%1>

      Indicates that the policy was not applied correctly to the computer. The status message is provided for troubleshooting purposes.

      8001

      Information

      The AppLocker policy was applied successfully to this computer.

      Indicates that the AppLocker policy was successfully applied to the computer.

      8002

      Information

      <File name> was allowed to run.

      Specifies that the .exe or .dll file is allowed by an AppLocker rule.

      8003

      Warning

      <File name> was allowed to run but would have been prevented from running if the AppLocker policy were enforced.

      Applied only when the Audit only enforcement mode is enabled. Specifies that the .exe or .dll file would be blocked if the Enforce rules enforcement mode were enabled.

      8004

      Error

      <File name> was not allowed to run.

      Access to <file name> is restricted by the administrator. Applied only when the Enforce rules enforcement mode is set either directly or indirectly through Group Policy inheritance. The .exe or .dll file cannot run.

      8005

      Information

      <File name> was allowed to run.

      Specifies that the script or .msi file is allowed by an AppLocker rule.

      8006

      Warning

      <File name> was allowed to run but would have been prevented from running if the AppLocker policy were enforced.

      Applied only when the Audit only enforcement mode is enabled. Specifies that the script or .msi file would be blocked if the Enforce rules enforcement mode were enabled.

      8007

      Error

      <File name> was not allowed to run.

      Access to <file name> is restricted by the administrator. Applied only when the Enforce rules enforcement mode is set either directly or indirectly through Group Policy inheritance. The script or .msi file cannot run.

      8007

      Error

      AppLocker disabled on the SKU.

      Added in Windows Server 2012 and Windows 8.

      8020

      Information

      Packaged app allowed.

      Added in Windows Server 2012 and Windows 8.

      8021

      Information

      Packaged app audited.

      Added in Windows Server 2012 and Windows 8.

      8022

      Information

      Packaged app disabled.

      Added in Windows Server 2012 and Windows 8.

      8023

      Information

      Packaged app installation allowed.

      Added in Windows Server 2012 and Windows 8.

      8024

      Information

      Packaged app installation audited.

      Added in Windows Server 2012 and Windows 8.

      8025

      Warning

      Packaged app installation disabled.

      Added in Windows Server 2012 and Windows 8.

      8027

      Warning

      No Packaged app rule configured.

      Added in Windows Server 2012 and Windows 8.

      + +| Event ID | Level | Event message | Description | +| - | - | - | - | +| 8000 | Error| Application Identity Policy conversion failed. Status *<%1> *| Indicates that the policy was not applied correctly to the computer. The status message is provided for troubleshooting purposes.| +| 8001 | Information| The AppLocker policy was applied successfully to this computer.| Indicates that the AppLocker policy was successfully applied to the computer.| +| 8002 | Information| *<File name> * was allowed to run.| Specifies that the .exe or .dll file is allowed by an AppLocker rule.| +| 8003 | Warning| *<File name> * was allowed to run but would have been prevented from running if the AppLocker policy were enforced.| Applied only when the **Audit only ** enforcement mode is enabled. Specifies that the .exe or .dll file would be blocked if the **Enforce rules ** enforcement mode were enabled. | +| 8004 | Error| *<File name> * was not allowed to run.| Access to *<file name> * is restricted by the administrator. Applied only when the **Enforce rules ** enforcement mode is set either directly or indirectly through Group Policy inheritance. The .exe or .dll file cannot run.| +| 8005| Information| *<File name> * was allowed to run.| Specifies that the script or .msi file is allowed by an AppLocker rule.| +| 8006 | Warning| *<File name> * was allowed to run but would have been prevented from running if the AppLocker policy were enforced.| Applied only when the **Audit only ** enforcement mode is enabled. Specifies that the script or .msi file would be blocked if the **Enforce rules ** enforcement mode were enabled. | +| 8007 | Error| *<File name> * was not allowed to run.| Access to *<file name> * is restricted by the administrator. Applied only when the **Enforce rules ** enforcement mode is set either directly or indirectly through Group Policy inheritance. The script or .msi file cannot run.| +| 8007| Error| AppLocker disabled on the SKU.| Added in Windows Server 2012 and Windows 8.| +| 8020| Information| Packaged app allowed.| Added in Windows Server 2012 and Windows 8.| +| 8021| Information| Packaged app audited.| Added in Windows Server 2012 and Windows 8.| +| 8022| Information| Packaged app disabled.| Added in Windows Server 2012 and Windows 8.| +| 8023 | Information| Packaged app installation allowed.| Added in Windows Server 2012 and Windows 8.| +| 8024 | Information| Packaged app installation audited.| Added in Windows Server 2012 and Windows 8.| +| 8025 | Warning| Packaged app installation disabled.| Added in Windows Server 2012 and Windows 8.| +| 8027 | Warning| No Packaged app rule configured.| Added in Windows Server 2012 and Windows 8.|   ## Related topics -[Tools to use with AppLocker](tools-to-use-with-applocker.md) + +- [Tools to use with AppLocker](tools-to-use-with-applocker.md)     diff --git a/windows/keep-secure/using-software-restriction-policies-and-applocker-policies.md b/windows/keep-secure/using-software-restriction-policies-and-applocker-policies.md index e07957331b..54b12a4568 100644 --- a/windows/keep-secure/using-software-restriction-policies-and-applocker-policies.md +++ b/windows/keep-secure/using-software-restriction-policies-and-applocker-policies.md @@ -2,76 +2,60 @@ title: Use Software Restriction Policies and AppLocker policies (Windows 10) description: This topic for the IT professional describes how to use Software Restriction Policies (SRP) and AppLocker policies in the same Windows deployment. ms.assetid: c3366be7-e632-4add-bd10-9df088f74c6d -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Use Software Restriction Policies and AppLocker policies + **Applies to** - Windows 10 + This topic for the IT professional describes how to use Software Restriction Policies (SRP) and AppLocker policies in the same Windows deployment. + ## Understand the difference between SRP and AppLocker + You might want to deploy application control policies in Windows operating systems earlier than Windows Server 2008 R2 or Windows 7. You can use AppLocker policies only on the supported versions and editions of Windows as listed in [Requirements to use AppLocker](requirements-to-use-applocker.md). However, you can use SRP on those supported editions of Windows plus Windows Server 2003 and Windows XP. To compare features and functions in SRP and AppLocker so that you can determine when to use each technology to meet your application control objectives, see [Determine your application control objectives](determine-your-application-control-objectives.md). + ## Use SRP and AppLocker in the same domain + SRP and AppLocker use Group Policy for domain management. However, when policies are generated by SRP and AppLocker exist in the same domain, and they are applied through Group Policy, AppLocker policies take precedence over policies generated by SRP on computers that are running an operating system that supports AppLocker. For info about how inheritance in Group Policy applies to AppLocker policies and policies generated by SRP, see [Understand AppLocker rules and enforcement setting inheritance in Group Policy](understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md). -**Important**   -As a best practice, use separate Group Policy Objects to implement your SRP and AppLocker policies. To reduce troubleshooting issues, do not combine them in the same GPO. + +>**Important:**  As a best practice, use separate Group Policy Objects to implement your SRP and AppLocker policies. To reduce troubleshooting issues, do not combine them in the same GPO.   The following scenario provides an example of how each type of policy would affect a bank teller software app, where the app is deployed on different Windows desktop operating systems and managed by the Tellers GPO. - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Operating systemTellers GPO with AppLocker policyTellers GPO with SRPTellers GPO with AppLocker policy and SRP

      Windows 10, Windows 8.1, Windows 8,and Windows 7

      AppLocker policies in the GPO are applied, and they supersede any local AppLocker policies.

      Local AppLocker policies supersede policies generated by SRP that are applied through the GPO.

      AppLocker policies in the GPO are applied, and they supersede the policies generated by SRP in the GPO and local AppLocker policies or policies generated by SRP.

      Windows Vista

      AppLocker policies are not applied.

      Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP.AppLocker policies are not applied.

      Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP. AppLocker policies not applied.

      Windows XP

      AppLocker policies are not applied.

      Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP. AppLocker policies are not applied.

      Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP. AppLocker policies not applied.

      + +| Operating system | Tellers GPO with AppLocker policy | Tellers GPO with SRP | Tellers GPO with AppLocker policy and SRP | +| - | - | - | - | +| Windows 10, Windows 8.1, Windows 8,and Windows 7 | AppLocker policies in the GPO are applied, and they supersede any local AppLocker policies.| Local AppLocker policies supersede policies generated by SRP that are applied through the GPO. | AppLocker policies in the GPO are applied, and they supersede the policies generated by SRP in the GPO and local AppLocker policies or policies generated by SRP.| +| Windows Vista| AppLocker policies are not applied.| Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP.AppLocker policies are not applied.| Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP. AppLocker policies not applied.| +| Windows XP| AppLocker policies are not applied.| Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP. AppLocker policies are not applied.| Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP. AppLocker policies not applied.|   -**Note**   -For info about supported versions and editions of the Windows operating system, see [Requirements to use AppLocker](requirements-to-use-applocker.md). +>**Note:**  For info about supported versions and editions of the Windows operating system, see [Requirements to use AppLocker](requirements-to-use-applocker.md).   ## Test and validate SRPs and AppLocker policies that are deployed in the same environment + Because SRPs and AppLocker policies function differently, they should not be implemented in the same GPO. This makes testing the result of the policy straightforward, which is critical to successfully controlling application usage in the organization. Configuring a testing and policy distribution system can help you understand the result of a policy. The effects of policies generated by SRP and AppLocker policies need to be tested separately and by using different tools. + ### Step 1: Test the effect of SRPs + You can use the Group Policy Management Console (GPMC) or the Resultant Set of Policy (RSoP) snap-in to determine the effect of applying SRPs by using GPOs. + ### Step 2: Test the effect of AppLocker policies + You can test AppLocker policies by using Windows PowerShell cmdlets. For info about investigating the result of a policy, see: + - [Test an AppLocker policy by using Test-AppLockerPolicy](test-an-applocker-policy-by-using-test-applockerpolicy.md) - [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md) + Another method to use when determining the result of a policy is to set the enforcement mode to **Audit only**. When the policy is deployed, events will be written to the AppLocker logs as if the policy was enforced. For info about using the **Audit only** mode, see: -[Understand AppLocker enforcement settings](understand-applocker-enforcement-settings.md) -[Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md) + +- [Understand AppLocker enforcement settings](understand-applocker-enforcement-settings.md) +- [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md) + ## See also -[AppLocker deployment guide](applocker-policies-deployment-guide.md) -  -  + +- [AppLocker deployment guide](applocker-policies-deployment-guide.md) diff --git a/windows/keep-secure/view-the-security-event-log.md b/windows/keep-secure/view-the-security-event-log.md index 3c67e1191b..745195b4f3 100644 --- a/windows/keep-secure/view-the-security-event-log.md +++ b/windows/keep-secure/view-the-security-event-log.md @@ -2,19 +2,22 @@ title: View the security event log (Windows 10) description: The security log records each event as defined by the audit policies you set on each object. ms.assetid: 20DD2ACD-241A-45C5-A92F-4BE0D9F198B9 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # View the security event log + **Applies to** - Windows 10 + The security log records each event as defined by the audit policies you set on each object. + **To view the security log** + 1. Open Event Viewer. 2. In the console tree, expand **Windows Logs**, and then click **Security**. The results pane lists individual security events. 3. If you want to see more details about a specific event, in the results pane, click the event. -  -  diff --git a/windows/keep-secure/what-is-applocker.md b/windows/keep-secure/what-is-applocker.md index cfa573d478..b4d758df7b 100644 --- a/windows/keep-secure/what-is-applocker.md +++ b/windows/keep-secure/what-is-applocker.md @@ -2,18 +2,24 @@ title: What Is AppLocker (Windows 10) description: This topic for the IT professional describes what AppLocker is and how its features differ from Software Restriction Policies. ms.assetid: 44a8a2bb-0f83-4f95-828e-1f364fb65869 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # What Is AppLocker? + **Applies to** - Windows 10 + This topic for the IT professional describes what AppLocker is and how its features differ from Software Restriction Policies. + AppLocker advances the app control features and functionality of Software Restriction Policies. AppLocker contains new capabilities and extensions that allow you to create rules to allow or deny apps from running based on unique identities of files and to specify which users or groups can run those apps. + Using AppLocker, you can: + - Control the following types of apps: executable files (.exe and .com), scripts (.js, .ps1, .vbs, .cmd, and .bat), Windows Installer files (.mst, .msi and .msp), and DLL files (.dll and .ocx), and packaged apps and packaged app installers (appx). - Define rules based on file attributes derived from the digital signature, including the publisher, product name, file name, and file version. For example, you can create rules based on the publisher attribute that is persistent through updates, or you can create rules for a specific version of a file. - Assign a rule to a security group or an individual user. @@ -21,11 +27,17 @@ Using AppLocker, you can: - Use audit-only mode to deploy the policy and understand its impact before enforcing it. - Import and export rules. The import and export affects the entire policy. For example, if you export a policy, all of the rules from all of the rule collections are exported, including the enforcement settings for the rule collections. If you import a policy, all criteria in the existing policy are overwritten. - Streamline creating and managing AppLocker rules by using Windows PowerShell cmdlets. + AppLocker helps reduce administrative overhead and helps reduce the organization's cost of managing computing resources by decreasing the number of help desk calls that result from users running unapproved apps + For information about the application control scenarios that AppLocker addresses, see [AppLocker policy use scenarios](applocker-policy-use-scenarios.md). + ## What features are different between Software Restriction Policies and AppLocker? + **Feature differences** + The following table compares AppLocker to Software Restriction Policies. + @@ -99,6 +111,7 @@ The following table compares AppLocker to Software Restriction Policies.
        **Application control function differences** + The following table compares the application control functions of Software Restriction Policies (SRP) and AppLocker. @@ -167,6 +180,7 @@ The following table compares the application control functions of Software Restr
        ## Related topics -[AppLocker technical reference](applocker-technical-reference.md) + +- [AppLocker technical reference](applocker-technical-reference.md)     diff --git a/windows/keep-secure/which-editions-of-windows-support-advanced-audit-policy-configuration.md b/windows/keep-secure/which-editions-of-windows-support-advanced-audit-policy-configuration.md index 35a67350b8..c60d303826 100644 --- a/windows/keep-secure/which-editions-of-windows-support-advanced-audit-policy-configuration.md +++ b/windows/keep-secure/which-editions-of-windows-support-advanced-audit-policy-configuration.md @@ -2,25 +2,30 @@ title: Which editions of Windows support advanced audit policy configuration (Windows 10) description: This reference topic for the IT professional describes which versions of the Windows operating systems support advanced security auditing policies. ms.assetid: 87c71cc5-522d-4771-ac78-34a2a0825f31 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Which editions of Windows support advanced audit policy configuration + **Applies to** - Windows 10 + This reference topic for the IT professional describes which versions of the Windows operating systems support advanced security auditing policies. + Versions of the Windows operating system that cannot join a domain do not have access to these features. There is no difference in security auditing support between 32-bit and 64-bit versions. + ## Are there any special considerations? + In addition, the following special considerations apply to the various tasks associated with advanced security auditing enhancements: + - **Creating an audit policy.** To create an advanced security auditing policy, you must use a computer running any supported version of Windows. You can use the Group Policy Management Console (GPMC) on a computer running a supported version of the Windows client operating system after installing the Remote Server Administration Tools. - **Applying audit policy settings.** If you are using Group Policy to apply the advanced audit policy settings and global object access settings, client computers must be running any supported version of the Windows server operating system or Windows client operating system. In addition, only computers running any of these supported operating systems can provide "reason for access" reporting data. - **Developing an audit policy model.** To plan advanced security audit settings and global object access settings, you must use the GPMC that targets a domain controller running a supported version of the Windows server operating system. -- **Distributing the audit policy.** After a Group Policy Object (GPO) that includes advanced security auditing settings is developed, it can be distributed by using domain controllers running any Windows Server operating system. However, if you cannot put client computers running a supported version of the Windows client operating system into a separate organizational unit (OU), you should use Windows Management Instrumentation (WMI) filtering to ensure that the advanced security auditing policy settings are applied only to client computers running a supported version of the Windows client operating system. -**Important**   -Using both the basic auditing policy settings under **Local Policies\\Audit Policy** and the advanced auditing policy settings under **Advanced Audit Policy Configuration** can cause unexpected results in audit reporting. Therefore, the two sets of audit policy settings should not be combined. If you use advanced audit policy configuration settings, you should enable the **Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings** policy setting under **Local Policies\\Security Options**. This will prevent conflicts between similar settings by forcing basic security auditing to be ignored.   -  -  -  +- **Distributing the audit policy.** After a Group Policy Object (GPO) that includes advanced security auditing settings is developed, it can be distributed by using domain controllers running any Windows Server operating system. +However, if you cannot put client computers running a supported version of the Windows client operating system into a separate organizational unit (OU), you should use Windows Management Instrumentation (WMI) filtering to ensure that the advanced security auditing policy settings are applied only to client computers running a supported version of the Windows client operating system. + +>**Important:**  Using both the basic auditing policy settings under **Local Policies\\Audit Policy** and the advanced auditing policy settings under **Advanced Audit Policy Configuration** can cause unexpected results in audit reporting. Therefore, the two sets of audit policy settings should not be combined. If you use advanced audit policy configuration settings, you should enable the **Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings** policy setting under **Local Policies\\Security Options**. This will prevent conflicts between similar settings by forcing basic security auditing to be ignored.   diff --git a/windows/keep-secure/windows-installer-rules-in-applocker.md b/windows/keep-secure/windows-installer-rules-in-applocker.md index 05f9214263..b12d94b8ef 100644 --- a/windows/keep-secure/windows-installer-rules-in-applocker.md +++ b/windows/keep-secure/windows-installer-rules-in-applocker.md @@ -2,59 +2,36 @@ title: Windows Installer rules in AppLocker (Windows 10) description: This topic describes the file formats and available default rules for the Windows Installer rule collection. ms.assetid: 3fecde5b-88b3-4040-81fa-a2d36d052ec9 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Windows Installer rules in AppLocker + **Applies to** - Windows 10 + This topic describes the file formats and available default rules for the Windows Installer rule collection. + AppLocker defines Windows Installer rules to include only the following file formats: + - .msi - .msp - .mst + The purpose of this collection is to allow you to control the installation of files on client computers and servers through Group Policy or the Local Security Policy snap-in. The following table lists the default rules that are available for the Windows Installer rule collection. - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      PurposeNameUserRule condition type

      Allow members of the local Administrators group to run all Windows Installer files

      (Default Rule) All Windows Installer files

      BUILTIN\Administrators

      Path: *

      Allow all users to run Windows Installer files that are digitally signed

      (Default Rule) All digitally signed Windows Installer files

      Everyone

      Publisher: * (all signed files)

      Allow all users to run Windows Installer files that are located in the Windows Installer folder

      (Default Rule) All Windows Installer files in %systemdrive%\Windows\Installer

      Everyone

      Path: %windir%\Installer\*

      + +| Purpose | Name | User | Rule condition type | +| - | - | - | - | +| Allow members of the local Administrators group to run all Windows Installer files| (Default Rule) All Windows Installer files| BUILTIN\Administrators| Path: *| +| Allow all users to run Windows Installer files that are digitally signed | (Default Rule) All digitally signed Windows Installer files| Everyone| Publisher: * (all signed files)| +| Allow all users to run Windows Installer files that are located in the Windows Installer folder | (Default Rule) All Windows Installer files in %systemdrive%\Windows\Installer| Everyone| Path: %windir%\Installer\*|   ## Related topics -[Understanding AppLocker default rules](understanding-applocker-default-rules.md) + +- [Understanding AppLocker default rules](understanding-applocker-default-rules.md)     diff --git a/windows/keep-secure/working-with-applocker-policies.md b/windows/keep-secure/working-with-applocker-policies.md index af1edcf35e..8963fa665b 100644 --- a/windows/keep-secure/working-with-applocker-policies.md +++ b/windows/keep-secure/working-with-applocker-policies.md @@ -2,83 +2,35 @@ title: Working with AppLocker policies (Windows 10) description: This topic for IT professionals provides links to procedural topics about creating, maintaining, and testing AppLocker policies. ms.assetid: 7062d2e0-9cbb-4cb8-aa8c-b24945c3771d -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Working with AppLocker policies + **Applies to** - Windows 10 + This topic for IT professionals provides links to procedural topics about creating, maintaining, and testing AppLocker policies. + ## In this section - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      TopicDescription

      [Configure the Application Identity service](configure-the-application-identity-service.md)

      This topic for IT professionals shows how to configure the Application Identity service to start automatically or manually.

      [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md)

      This topic for IT professionals describes how to set AppLocker policies to Audit only within your IT environment by using AppLocker.

      [Configure an AppLocker policy for enforce rules](configure-an-applocker-policy-for-enforce-rules.md)

      This topic for IT professionals describes the steps to enable the AppLocker policy enforcement setting.

      [Display a custom URL message when users try to run a blocked app](display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md)

      This topic for IT professionals describes the steps for displaying a customized message to users when an AppLocker policy denies access to an app.

      [Export an AppLocker policy from a GPO](export-an-applocker-policy-from-a-gpo.md)

      This topic for IT professionals describes the steps to export an AppLocker policy from a Group Policy Object (GPO) so that it can be modified.

      [Export an AppLocker policy to an XML file](export-an-applocker-policy-to-an-xml-file.md)

      This topic for IT professionals describes the steps to export an AppLocker policy to an XML file for review or testing.

      [Import an AppLocker policy from another computer](import-an-applocker-policy-from-another-computer.md)

      This topic for IT professionals describes how to import an AppLocker policy.

      [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md)

      This topic for IT professionals describes the steps to import an AppLocker policy into a Group Policy Object (GPO).

      [Add rules for packaged apps to existing AppLocker rule-set](add-rules-for-packaged-apps-to-existing-applocker-rule-set.md)

      This topic for IT professionals describes how to update your existing AppLocker policies for packaged apps using the Remote Server Administration Toolkit (RSAT).

      [Merge AppLocker policies by using Set-ApplockerPolicy](merge-applocker-policies-by-using-set-applockerpolicy.md)

      This topic for IT professionals describes the steps to merge AppLocker policies by using Windows PowerShell.

      [Merge AppLocker policies manually](merge-applocker-policies-manually.md)

      This topic for IT professionals describes the steps to manually merge AppLocker policies to update the Group Policy Object (GPO).

      [Refresh an AppLocker policy](refresh-an-applocker-policy.md)

      This topic for IT professionals describes the steps to force an update for an AppLocker policy.

      [Test an AppLocker policy by using Test-AppLockerPolicy](test-an-applocker-policy-by-using-test-applockerpolicy.md)

      This topic for IT professionals describes the steps to test an AppLocker policy prior to importing it into a Group Policy Object (GPO) or another computer.

      -  -  -  + +| Topic | Description | +| - | - | +| [Configure the Application Identity service](configure-the-application-identity-service.md) | This topic for IT professionals shows how to configure the Application Identity service to start automatically or manually.| +| [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md) | This topic for IT professionals describes how to set AppLocker policies to **Audit only ** within your IT environment by using AppLocker.| +| [Configure an AppLocker policy for enforce rules](configure-an-applocker-policy-for-enforce-rules.md) | This topic for IT professionals describes the steps to enable the AppLocker policy enforcement setting.| +| [Display a custom URL message when users try to run a blocked app](display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md) | This topic for IT professionals describes the steps for displaying a customized message to users when an AppLocker policy denies access to an app.| +| [Export an AppLocker policy from a GPO](export-an-applocker-policy-from-a-gpo.md) | This topic for IT professionals describes the steps to export an AppLocker policy from a Group Policy Object (GPO) so that it can be modified.| +| [Export an AppLocker policy to an XML file](export-an-applocker-policy-to-an-xml-file.md) | This topic for IT professionals describes the steps to export an AppLocker policy to an XML file for review or testing.| +| [Import an AppLocker policy from another computer](import-an-applocker-policy-from-another-computer.md) | This topic for IT professionals describes how to import an AppLocker policy.| +| [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md) | This topic for IT professionals describes the steps to import an AppLocker policy into a Group Policy Object (GPO).| +| [Add rules for packaged apps to existing AppLocker rule-set](add-rules-for-packaged-apps-to-existing-applocker-rule-set.md) | This topic for IT professionals describes how to update your existing AppLocker policies for packaged apps using the Remote Server Administration Toolkit (RSAT).| +| [Merge AppLocker policies by using Set-ApplockerPolicy](merge-applocker-policies-by-using-set-applockerpolicy.md) | This topic for IT professionals describes the steps to merge AppLocker policies by using Windows PowerShell.| +| [Merge AppLocker policies manually](merge-applocker-policies-manually.md) | This topic for IT professionals describes the steps to manually merge AppLocker policies to update the Group Policy Object (GPO).| +| [Refresh an AppLocker policy](refresh-an-applocker-policy.md) | This topic for IT professionals describes the steps to force an update for an AppLocker policy.| +| [Test an AppLocker policy by using Test-AppLockerPolicy](test-an-applocker-policy-by-using-test-applockerpolicy.md) | This topic for IT professionals describes the steps to test an AppLocker policy prior to importing it into a Group Policy Object (GPO) or another computer.| + diff --git a/windows/keep-secure/working-with-applocker-rules.md b/windows/keep-secure/working-with-applocker-rules.md index 9ee115544d..762d21c78a 100644 --- a/windows/keep-secure/working-with-applocker-rules.md +++ b/windows/keep-secure/working-with-applocker-rules.md @@ -2,338 +2,207 @@ title: Working with AppLocker rules (Windows 10) description: This topic for IT professionals describes AppLocker rule types and how to work with them for your application control policies. ms.assetid: 3966b35b-f2da-4371-8b5f-aec031db6bc9 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Working with AppLocker rules + **Applies to** - Windows 10 + This topic for IT professionals describes AppLocker rule types and how to work with them for your application control policies. + ## In this section - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      TopicDescription

      [Create a rule that uses a file hash condition](create-a-rule-that-uses-a-file-hash-condition.md)

      This topic for IT professionals shows how to create an AppLocker rule with a file hash condition.

      [Create a rule that uses a path condition](create-a-rule-that-uses-a-path-condition.md)

      This topic for IT professionals shows how to create an AppLocker rule with a path condition.

      [Create a rule that uses a publisher condition](create-a-rule-that-uses-a-publisher-condition.md)

      This topic for IT professionals shows how to create an AppLocker rule with a publisher condition.

      [Create AppLocker default rules](create-applocker-default-rules.md)

      This topic for IT professionals describes the steps to create a standard set of AppLocker rules that will allow Windows system files to run.

      [Add exceptions for an AppLocker rule](configure-exceptions-for-an-applocker-rule.md)

      This topic for IT professionals describes the steps to specify which apps can or cannot run as exceptions to an AppLocker rule.

      [Create a rule for packaged apps](create-a-rule-for-packaged-apps.md)

      This topic for IT professionals shows how to create an AppLocker rule for packaged apps with a publisher condition.

      [Delete an AppLocker rule](delete-an-applocker-rule.md)

      This topic for IT professionals describes the steps to delete an AppLocker rule.

      [Edit AppLocker rules](edit-applocker-rules.md)

      This topic for IT professionals describes the steps to edit a publisher rule, path rule, and file hash rule in AppLocker.

      [Enable the DLL rule collection](enable-the-dll-rule-collection.md)

      This topic for IT professionals describes the steps to enable the DLL rule collection feature for AppLocker.

      [Enforce AppLocker rules](enforce-applocker-rules.md)

      This topic for IT professionals describes how to enforce application control rules by using AppLocker.

      [Run the Automatically Generate Rules wizard](run-the-automatically-generate-rules-wizard.md)

      This topic for IT professionals describes steps to run the wizard to create AppLocker rules on a reference device.

      + +| Topic | Description | +| - | - | +| [Create a rule that uses a file hash condition](create-a-rule-that-uses-a-file-hash-condition.md) | This topic for IT professionals shows how to create an AppLocker rule with a file hash condition.| +| [Create a rule that uses a path condition](create-a-rule-that-uses-a-path-condition.md) | This topic for IT professionals shows how to create an AppLocker rule with a path condition.| +| [Create a rule that uses a publisher condition](create-a-rule-that-uses-a-publisher-condition.md) | This topic for IT professionals shows how to create an AppLocker rule with a publisher condition.| +| [Create AppLocker default rules](create-applocker-default-rules.md) | This topic for IT professionals describes the steps to create a standard set of AppLocker rules that will allow Windows system files to run.| +| [Add exceptions for an AppLocker rule](configure-exceptions-for-an-applocker-rule.md) | This topic for IT professionals describes the steps to specify which apps can or cannot run as exceptions to an AppLocker rule.| +| [Create a rule for packaged apps](create-a-rule-for-packaged-apps.md) | This topic for IT professionals shows how to create an AppLocker rule for packaged apps with a publisher condition.| +| [Delete an AppLocker rule](delete-an-applocker-rule.md) | This topic for IT professionals describes the steps to delete an AppLocker rule.| +| [Edit AppLocker rules](edit-applocker-rules.md) | This topic for IT professionals describes the steps to edit a publisher rule, path rule, and file hash rule in AppLocker.| +| [Enable the DLL rule collection](enable-the-dll-rule-collection.md) | This topic for IT professionals describes the steps to enable the DLL rule collection feature for AppLocker.| +| [Enforce AppLocker rules](enforce-applocker-rules.md) | This topic for IT professionals describes how to enforce application control rules by using AppLocker.| +| [Run the Automatically Generate Rules wizard](run-the-automatically-generate-rules-wizard.md) | This topic for IT professionals describes steps to run the wizard to create AppLocker rules on a reference device.|   The three AppLocker enforcement modes are described in the following table. The enforcement mode setting defined here can be overwritten by the setting derived from a linked Group Policy Object (GPO) with a higher precedence. - ---- - - - - - - - - - - - - - - - - - - - - -
      Enforcement modeDescription

      Not configured

      This is the default setting which means that the rules defined here will be enforced unless a linked GPO with a higher precedence has a different value for this setting.

      Enforce rules

      Rules are enforced.

      Audit only

      Rules are audited but not enforced. When a user runs an app that is affected by an AppLocker rule, the app is allowed to run and the info about the app is added to the AppLocker event log. The Audit-only enforcement mode helps you determine which apps will be affected by the policy before the policy is enforced. When the AppLocker policy for a rule collection is set to Audit only, rules for that rule collection are not enforced

      -  + +| Enforcement mode | Description | +| - | - | +| **Not configured** | This is the default setting which means that the rules defined here will be enforced unless a linked GPO with a higher precedence has a different value for this setting.| +| **Enforce rules** | Rules are enforced.| +| **Audit only** | Rules are audited but not enforced. When a user runs an app that is affected by an AppLocker rule, the app is allowed to run and the info about the app is added to the AppLocker event log. The Audit-only enforcement mode helps you determine which apps will be affected by the policy before the policy is enforced. When the AppLocker policy for a rule collection is set to **Audit only**, rules for that rule collection are not enforced| + When AppLocker policies from various GPOs are merged, the rules from all the GPOs are merged and the enforcement mode setting of the winning GPO is applied. ## Rule collections + The AppLocker console is organized into rule collections, which are executable files, scripts, Windows Installer files, packaged apps and packaged app installers, and DLL files. These collections give you an easy way to differentiate the rules for different types of apps. The following table lists the file formats that are included in each rule collection. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Rule collectionAssociated file formats

      Executable files

      .exe

      -

      .com

      Scripts

      .ps1

      -

      .bat

      -

      .cmd

      -

      .vbs

      -

      .js

      Windows Installer files

      .msi

      -

      .msp

      -

      .mst

      Packaged apps and packaged app installers

      .appx

      DLL files

      .dll

      -

      .ocx

      + +| Rule collection | Associated file formats | +| - | - | +| Executable files | .exe
      .com| +| Scripts| .ps1
      .bat
      .cmd
      .vbs
      .js| +| Windows Installer files | .msi
      .msp
      .mst| +| Packaged apps and packaged app installers | .appx| +| DLL files | .dll
      .ocx|   -**Important**   -If you use DLL rules, you need to create an allow rule for each DLL that is used by all of the allowed apps. +>**Important:**  If you use DLL rules, you need to create an allow rule for each DLL that is used by all of the allowed apps. + When DLL rules are used, AppLocker must check each DLL that an application loads. Therefore, users may experience a reduction in performance if DLL rules are used. + The DLL rule collection is not enabled by default. To learn how to enable the DLL rule collection, see [DLL rule collections](#bkmk-dllrulecollections).   ## Rule conditions + Rule conditions are criteria that help AppLocker identify the apps to which the rule applies. The three primary rule conditions are publisher, path, and file hash. + - [Publisher](#bkmk-publisher): Identifies an app based on its digital signature - [Path](#bkmk-path): Identifies an app by its location in the file system of the computer or on the network - [File hash](#bkmk-filehash): Represents the system computed cryptographic hash of the identified file + ### Publisher + This condition identifies an app based on its digital signature and extended attributes when available. The digital signature contains info about the company that created the app (the publisher). Executable files, dlls, Windows installers, packaged apps and packaged app installers also have extended attributes, which are obtained from the binary resource. In case of executable files, dlls and Windows installers, these attributes contain the name of the product that the file is a part of, the original name of the file as supplied by the publisher, and the version number of the file. In case of packaged apps and packaged app installers, these extended attributes contain the name and the version of the app package. -**Note**   -Rules created in the packaged apps and packaged app installers rule collection can only have publisher conditions since Windows does not support unsigned packaged apps and packaged app installers. + +>**Note:**  Rules created in the packaged apps and packaged app installers rule collection can only have publisher conditions since Windows does not support unsigned packaged apps and packaged app installers.   -**Note**   -Use a publisher rule condition when possible because they can survive app updates as well as a change in the location of files. +>**Note:**  Use a publisher rule condition when possible because they can survive app updates as well as a change in the location of files.   When you select a reference file for a publisher condition, the wizard creates a rule that specifies the publisher, product, file name, and version number. You can make the rule more generic by moving the slider up or by using a wildcard character (\*) in the product, file name, or version number fields. -**Note**   -To enter custom values for any of the fields of a publisher rule condition in the Create Rules Wizard, you must select the **Use custom values** check box. When this check box is selected, you cannot use the slider. + +>**Note:**  To enter custom values for any of the fields of a publisher rule condition in the Create Rules Wizard, you must select the **Use custom values** check box. When this check box is selected, you cannot use the slider.   The **File version** and **Package version** control whether a user can run a specific version, earlier versions, or later versions of the app. You can choose a version number and then configure the following options: + - **Exactly.** The rule applies only to this version of the app - **And above.** The rule applies to this version and all later versions. - **And below.** The rule applies to this version and all earlier versions. + The following table describes how a publisher condition is applied. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      OptionThe publisher condition allows or denies…

      All signed files

      All files that are signed by any publisher.

      Publisher only

      All files that are signed by the named publisher.

      Publisher and product name

      All files for the specified product that are signed by the named publisher.

      Publisher and product name, and file name

      Any version of the named file or package for the named product that are signed by the publisher.

      Publisher, product name, file name, and file version

      Exactly

      -

      The specified version of the named file or package for the named product that are signed by the publisher.

      Publisher, product name, file name, and file version

      And above

      -

      The specified version of the named file or package and any new releases for the product that are signed by the publisher.

      Publisher, product name, file name, and file version

      And below

      -

      The specified version of the named file or package and any earlier versions for the product that are signed by the publisher.

      Custom

      You can edit the Publisher, Product name, File name, Version Package name, and Package version fields to create a custom rule.

      -  + + +| Option | The publisher condition allows or denies… | +| **All signed files** | All files that are signed by any publisher.| +| **Publisher only**| All files that are signed by the named publisher.| +| **Publisher and product name**| All files for the specified product that are signed by the named publisher.| +| **Publisher and product name, and file name**| Any version of the named file or package for the named product that are signed by the publisher.| +| **Publisher, product name, file name, and file version**| **Exactly**
      The specified version of the named file or package for the named product that are signed by the publisher.| +| **Publisher, product name, file name, and file version**| **And above**
      The specified version of the named file or package and any new releases for the product that are signed by the publisher.| +| **Publisher, product name, file name, and file version**| **And below**
      The specified version of the named file or package and any earlier versions for the product that are signed by the publisher.| +| **Custom**| You can edit the **Publisher**, **Product name**, **File name**, **Version** **Package name**, and **Package version** fields to create a custom rule.| + ### Path + This rule condition identifies an application by its location in the file system of the computer or on the network. + AppLocker uses custom path variables for well-known paths, such as Program Files and Windows. + The following table details these path variables. - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Windows directory or diskAppLocker path variableWindows environment variable

      Windows

      %WINDIR%

      %SystemRoot%

      System32

      %SYSTEM32%

      %SystemDirectory%

      Windows installation directory

      %OSDRIVE%

      %SystemDrive%

      Program Files

      %PROGRAMFILES%

      %ProgramFiles% and

      -

      %ProgramFiles(x86)%

      Removable media (for example, a CD or DVD)

      %REMOVABLE%

      Removable storage device (for example, a USB flash drive)

      %HOT%

      + +| Windows directory or disk | AppLocker path variable | Windows environment variable | +| - | - | - | +| Windows| %WINDIR%| %SystemRoot%| +| System32| %SYSTEM32%| %SystemDirectory%| +| Windows installation directory| %OSDRIVE%| %SystemDrive%| +| Program Files| %PROGRAMFILES%| %ProgramFiles% and %ProgramFiles(x86)% | +| Removable media (for example, a CD or DVD)| %REMOVABLE%| | +| Removable storage device (for example, a USB flash drive)| %HOT% | |   -**Important**   -Because a path rule condition can be configured to include a large number of folders and files, path conditions should be carefully planned. For example, if an allow rule with a path condition includes a folder location that non-administrators are allowed to write data into, a user can copy unapproved files into that location and run the files. For this reason, it is a best practice to not create path conditions for standard user writable locations, such as a user profile. +>**Important:**  Because a path rule condition can be configured to include a large number of folders and files, path conditions should be carefully planned. For example, if an allow rule with a path condition includes a folder location that non-administrators are allowed to write data into, a user can copy unapproved files into that location and run the files. For this reason, it is a best practice to not create path conditions for standard user writable locations, such as a user profile.   ### File hash + When you choose the file hash rule condition, the system computes a cryptographic hash of the identified file. The advantage of this rule condition is that because each file has a unique hash, a file hash rule condition applies to only one file. The disadvantage is that each time the file is updated (such as a security update or upgrade) the file's hash will change. As a result, you must manually update file hash rules. + ## AppLocker default rules + AppLocker allows you to generate default rules for each rule collection. + Executable default rule types include: + - Allow members of the local **Administrators** group to run all apps. - Allow members of the **Everyone** group to run apps that are located in the Windows folder. - Allow members of the **Everyone** group to run apps that are located in the Program Files folder. + Script default rule types include: + - Allow members of the local **Administrators** group to run all scripts. - Allow members of the **Everyone** group to run scripts that are located in the Program Files folder. - Allow members of the **Everyone** group to run scripts that are located in the Windows folder. + Windows Installer default rule types include: + - Allow members of the local **Administrators** group to run all Windows Installer files. - Allow members of the **Everyone** group to run all digitally signed Windows Installer files. - Allow members of the **Everyone** group to run all Windows Installer files that are located in the Windows\\Installer folder. + DLL default rule types: + - Allow members of the local **Administrators** group to run all DLLs. - Allow members of the **Everyone** group to run DLLs that are located in the Program Files folder. - Allow members of the **Everyone** group to run DLLs that are located in the Windows folder. + Packaged apps default rule types: + - Allow members of the **Everyone** group to install and run all signed packaged apps and packaged app installers. + ## AppLocker rule behavior + If no AppLocker rules for a specific rule collection exist, all files with that file format are allowed to run. However, when an AppLocker rule for a specific rule collection is created, only the files explicitly allowed in a rule are permitted to run. For example, if you create an executable rule that allows .exe files in *%SystemDrive%\\FilePath* to run, only executable files located in that path are allowed to run. + A rule can be configured to use allow or deny actions: + - **Allow.** You can specify which files are allowed to run in your environment, and for which users or groups of users. You can also configure exceptions to identify files that are excluded from the rule. - **Deny.** You can specify which files are *not* allowed to run in your environment, and for which users or groups of users. You can also configure exceptions to identify files that are excluded from the rule. -**Important**   -For a best practice, use allow actions with exceptions. You can use a combination of allow and deny actions but understand that deny actions override allow actions in all cases, and can be circumvented. + +>**Important:**  For a best practice, use allow actions with exceptions. You can use a combination of allow and deny actions but understand that deny actions override allow actions in all cases, and can be circumvented.   -**Important**   -If you join a computer running at least Windows Server 2012 or Windows 8 to a domain that already enforces AppLocker rules for executable files, users will not be able to run any packaged apps unless you also create rules for packaged apps. If you want to allow any packaged apps in your environment while continuing to control executable files, you should create the default rules for packaged apps and set the enforcement mode to Audit-only for the packaged apps rule collection. +>**Important:**  If you join a computer running at least Windows Server 2012 or Windows 8 to a domain that already enforces AppLocker rules for executable files, users will not be able to run any packaged apps unless you also create rules for packaged apps. If you want to allow any packaged apps in your environment while continuing to control executable files, you should create the default rules for packaged apps and set the enforcement mode to Audit-only for the packaged apps rule collection.   ## Rule exceptions + You can apply AppLocker rules to individual users or to a group of users. If you apply a rule to a group of users, all users in that group are affected by that rule. If you need to allow a subset of a user group to use an app, you can create a special rule for that subset. For example, the rule "Allow everyone to run Windows except Registry Editor" allows everyone in the organization to run the Windows operating system, but it does not allow anyone to run Registry Editor. + The effect of this rule would prevent users such as Help Desk personnel from running a program that is necessary for their support tasks. To resolve this problem, create a second rule that applies to the Help Desk user group: "Allow Help Desk to run Registry Editor." If you create a deny rule that does not allow any users to run Registry Editor, the deny rule will override the second rule that allows the Help Desk user group to run Registry Editor. + ## DLL rule collection + Because the DLL rule collection is not enabled by default, you must perform the following procedure before you can create and enforce DLL rules. + Membership in the local **Administrators** group, or equivalent, is the minimum required to complete this procedure. + **To enable the DLL rule collection** + 1. Click **Start**, type **secpol.msc**, and then press ENTER. 2. If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. 3. In the console tree, double-click **Application Control Policies**, right-click **AppLocker**, and then click **Properties**. 4. Click the **Advanced** tab, select the **Enable the DLL rule collection** check box, and then click **OK**. - **Important**   - Before you enforce DLL rules, make sure that there are allow rules for each DLL that is used by any of the allowed apps. + + >**Important:**  Before you enforce DLL rules, make sure that there are allow rules for each DLL that is used by any of the allowed apps.   ## AppLocker wizards + You can create rules by using two AppLocker wizards: + 1. The Create Rules Wizard enables you to create one rule at a time. 2. The Automatically Generate Rules Wizard allows you to create multiple rules at one time. You can either select a folder and let the wizard create rules for the relevant files within that folder or in case of packaged apps let the wizard create rules for all packaged apps installed on the computer. You can also specify the user or group to which to apply the rules. This wizard automatically generates allow rules only. + ## Additional considerations + - By default, AppLocker rules do not allow users to open or run any files that are not specifically allowed. Administrators should maintain an up-to-date list of allowed applications. - There are two types of AppLocker conditions that do not persist following an update of an app: + - **A file hash condition** File hash rule conditions can be used with any app because a cryptographic hash value of the app is generated at the time the rule is created. However, the hash value is specific to that exact version of the app. If there are several versions of the application in use within the organization, you need to create file hash conditions for each version in use and for any new versions that are released. + - **A publisher condition with a specific product version set** If you create a publisher rule condition that uses the **Exactly** version option, the rule cannot persist if a new version of the app is installed. A new publisher condition must be created, or the version must be edited in the rule to be made less specific. + - If an app is not digitally signed, you cannot use a publisher rule condition for that app. - AppLocker rules cannot be used to manage computers running a Windows operating system earlier than Windows Server 2008 R2 or Windows 7. Software Restriction Policies must be used instead. If AppLocker rules are defined in a Group Policy Object (GPO), only those rules are applied. To ensure interoperability between Software Restriction Policies rules and AppLocker rules, define Software Restriction Policies rules and AppLocker rules in different GPOs. - The packaged apps and packaged apps installer rule collection is available on devices running at least Windows Server 2012 and Windows 8. @@ -341,5 +210,3 @@ You can create rules by using two AppLocker wizards: - When an AppLocker rule collection is set to **Audit only**, the rules are not enforced. When a user runs an application that is included in the rule, the app is opened and runs normally, and information about that app is added to the AppLocker event log. - A custom configured URL can be included in the message that is displayed when an app is blocked. - Expect an increase in the number of Help Desk calls initially because of blocked apps until users understand that they cannot run apps that are not allowed. -  -  From eb21dd338dee456b2dfe8eda6f68c5279a07a688 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 25 May 2016 15:28:24 -0700 Subject: [PATCH 419/439] fixing spacing issues --- ...cies-by-using-the-enforce-rules-setting.md | 28 ++++++++++++++++--- .../user-account-control-overview.md | 13 ++++++++- 2 files changed, 36 insertions(+), 5 deletions(-) diff --git a/windows/keep-secure/deploy-applocker-policies-by-using-the-enforce-rules-setting.md b/windows/keep-secure/deploy-applocker-policies-by-using-the-enforce-rules-setting.md index cfd595104f..b7056845e4 100644 --- a/windows/keep-secure/deploy-applocker-policies-by-using-the-enforce-rules-setting.md +++ b/windows/keep-secure/deploy-applocker-policies-by-using-the-enforce-rules-setting.md @@ -2,34 +2,54 @@ title: Deploy AppLocker policies by using the enforce rules setting (Windows 10) description: This topic for IT professionals describes the steps to deploy AppLocker policies by using the enforcement setting method. ms.assetid: fd3a3d25-ff3b-4060-8390-6262a90749ba -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + + # Deploy AppLocker policies by using the enforce rules setting + **Applies to** - Windows 10 + This topic for IT professionals describes the steps to deploy AppLocker policies by using the enforcement setting method. + ## Background and prerequisites + These procedures assume that you have already deployed AppLocker policies with the enforcement set to **Audit only**, and you have been collecting data through the AppLocker event logs and other channels to determine what effect these policies have on your environment and the policy's adherence to your application control design. + For info about the AppLocker policy enforcement setting, see [Understand AppLocker enforcement settings](understand-applocker-enforcement-settings.md). + For info about how to plan an AppLocker policy deployment, see [AppLocker Design Guide](applocker-policies-design-guide.md). + ## Step 1: Retrieve the AppLocker policy + Updating an AppLocker policy that is currently enforced in your production environment can have unintended results. Using Group Policy, you can export the policy from the Group Policy Object (GPO) and then update the rule or rules by using AppLocker on your AppLocker reference or test PC. For the procedure to do this, see [Export an AppLocker policy from a GPO](export-an-applocker-policy-from-a-gpo.md) and [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md). For local AppLocker policies, you can update the rule or rules by using the Local Security policy snap-in (secpol.msc) on your AppLocker reference or test PC. For the procedures to do this, see [Export an AppLocker policy to an XML file](export-an-applocker-policy-to-an-xml-file.md) and [Import an AppLocker policy from another computer](import-an-applocker-policy-from-another-computer.md). + ## Step 2: Alter the enforcement setting + Rule enforcement is applied only to a collection of rules, not to individual rules. AppLocker divides the rules into collections: executable files, Windows Installer files, packaged apps, scripts, and DLL files. By default, if enforcement is not configured and rules are present in a rule collection, those rules are enforced. For information about the enforcement setting, see [Understand AppLocker Enforcement Settings](understand-applocker-enforcement-settings.md). For the procedure to alter the enforcement setting, see [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md). + ## Step 3: Update the policy -You can edit an AppLocker policy by adding, changing, or removing rules. However, you cannot specify a version for the AppLocker policy by importing additional rules. To ensure version control when modifying an AppLocker policy, use Group Policy management software that allows you to create versions of GPOs. An example of this type of software is the [Advanced Group Policy Management](http://go.microsoft.com/fwlink/p/?LinkId=145013) feature from the Microsoft Desktop Optimization Pack. -**Caution**   -You should not edit an AppLocker rule collection while it is being enforced in Group Policy. Because AppLocker controls what files are allowed to run, making changes to a live policy can create unexpected behavior. + +You can edit an AppLocker policy by adding, changing, or removing rules. However, you cannot specify a version for the AppLocker policy by importing additional rules. To ensure version control when modifying an AppLocker policy, use Group Policy management software that allows you to create versions of GPOs. An example of this type of software is the [Advanced Group Policy Management](http://go.microsoft.com/fwlink/p/?LinkId=145013) feature from the +Microsoft Desktop Optimization Pack. + +>**Caution:**  You should not edit an AppLocker rule collection while it is being enforced in Group Policy. Because AppLocker controls what files are allowed to run, making changes to a live policy can create unexpected behavior.   For the procedure to update the GPO, see [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md). + For the procedures to distribute policies for local PCs by using the Local Security Policy snap-in (secpol.msc), see [Export an AppLocker policy to an XML file](export-an-applocker-policy-to-an-xml-file.md) and [Import an AppLocker policy from another computer](import-an-applocker-policy-from-another-computer.md). + ## Step 4: Monitor the effect of the policy + When a policy is deployed, it is important to monitor the actual implementation of that policy. You can do this by monitoring your support organization's app access request activity and reviewing the AppLocker event logs. To monitor the effect of the policy, see [Monitor Application Usage with AppLocker](monitor-application-usage-with-applocker.md). + ## Additional resources + - For steps to perform other AppLocker policy tasks, see [Administer AppLocker](administer-applocker.md).     diff --git a/windows/keep-secure/user-account-control-overview.md b/windows/keep-secure/user-account-control-overview.md index f2eb1a4824..ccabf37ce1 100644 --- a/windows/keep-secure/user-account-control-overview.md +++ b/windows/keep-secure/user-account-control-overview.md @@ -2,24 +2,35 @@ title: User Account Control (Windows 10) description: User Account Control (UAC) helps prevent malware from damaging a PC and helps organizations deploy a better-managed desktop. ms.assetid: 43ac4926-076f-4df2-84af-471ee7d20c38 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: operate ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # User Account Control + **Applies to** - Windows 10 - Windows Server 2016 Technical Preview + User Account Control (UAC) helps prevent malware from damaging a PC and helps organizations deploy a better-managed desktop. With UAC, apps and tasks always run in the security context of a non-administrator account, unless an administrator specifically authorizes administrator-level access to the system. UAC can block the automatic installation of unauthorized apps and prevent inadvertent changes to system settings. + UAC allows all users to log on to their computers using a standard user account. Processes launched using a standard user token may perform tasks using access rights granted to a standard user. For instance, Windows Explorer automatically inherits standard user level permissions. Additionally, any apps that are started using Windows Explorer (for example, by double-clicking a shortcut) also run with the standard set of user permissions. Many apps, including those that are included with the operating system itself, are designed to work properly in this way. + Other apps, especially those that were not specifically designed with security settings in mind, often require additional permissions to run successfully. These types of apps are referred to as legacy apps. Additionally, actions such as installing new software and making configuration changes to the Windows Firewall, require more permissions than what is available to a standard user account. + When an app needs to run with more than standard user rights, UAC can restore additional user groups to the token. This enables the user to have explicit control of apps that are making system level changes to their computer or device. + ## Practical applications + Admin Approval Mode in UAC helps prevent malware from silently installing without an administrator's knowledge. It also helps protect from inadvertent system-wide changes. Lastly, it can be used to enforce a higher level of compliance where administrators must actively consent or provide credentials for each administrative process. + ## New and changed functionality + To find out what's new in UAC for Windows 10, see [User Account Control](../whats-new/user-account-control.md). + ## In this section | Topic | Description | | - | - | From 1d1c430813b634fdb60da727ab434a242f596568 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 25 May 2016 15:31:12 -0700 Subject: [PATCH 420/439] fixed broken link --- windows/keep-secure/security-options.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/security-options.md b/windows/keep-secure/security-options.md index d8d9dbe293..b9ddcb4bf8 100644 --- a/windows/keep-secure/security-options.md +++ b/windows/keep-secure/security-options.md @@ -77,7 +77,7 @@ For info about setting security policies, see [Configure security policy setting | [Network access: Do not allow anonymous enumeration of SAM accounts](network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md)| Describes the best practices, location, values, and security considerations for the **Network access: Do not allow anonymous enumeration of SAM accounts** security policy setting. | | [Network access: Do not allow anonymous enumeration of SAM accounts and shares](network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md)| Describes the best practices, location, values, and security considerations for the **Network access: Do not allow anonymous enumeration of SAM accounts and shares** security policy setting. | | [Network access: Do not allow storage of passwords and credentials for network authentication](network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md)| Describes the best practices, location, values, policy management and security considerations for the **Network access: Do not allow storage of passwords and credentials for network authentication** security policy setting. | -| [Network access: Let Everyone permissions apply to anonymous users](network-access-let-everyone-permissions-apply-to-anonmous-users.md)| Describes the best practices, location, values, policy management and security considerations for the **Network access: Let Everyone permissions apply to anonymous users** security policy setting. | +| [Network access: Let Everyone permissions apply to anonymous users](network-access-let-everyone-permissions-apply-to-anonymous-users.md)| Describes the best practices, location, values, policy management and security considerations for the **Network access: Let Everyone permissions apply to anonymous users** security policy setting. | | [Network access: Named Pipes that can be accessed anonymously](network-access-named-pipes-that-can-be-accessed-anonymously.md)| Describes the best practices, location, values, policy management and security considerations for the **Network access: Named Pipes that can be accessed anonymously** security policy setting. | | [Network access: Remotely accessible registry paths](network-access-remotely-accessible-registry-paths.md)| Describes the best practices, location, values, policy management and security considerations for the **Network access: Remotely accessible registry paths** security policy setting.| | [Network access: Remotely accessible registry paths and subpaths](network-access-remotely-accessible-registry-paths-and-subpaths.md)| Describes the best practices, location, values, and security considerations for the **Network access: Remotely accessible registry paths and subpaths** security policy setting. | From 7963ced4f2d5ae5555c612f6fc8e139b710abc9b Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 26 May 2016 07:33:45 -0700 Subject: [PATCH 421/439] minor text corrections --- education/windows/TOC.md | 8 ++++---- education/windows/take-a-test-app-technical.md | 12 ++++++------ education/windows/take-a-test-multiple-pcs.md | 2 +- education/windows/take-a-test-single-pc.md | 2 +- education/windows/take-tests-in-windows-10.md | 6 +++--- 5 files changed, 15 insertions(+), 15 deletions(-) diff --git a/education/windows/TOC.md b/education/windows/TOC.md index 4bc5d61f86..fe182ab2d6 100644 --- a/education/windows/TOC.md +++ b/education/windows/TOC.md @@ -1,8 +1,8 @@ # [Windows 10 for education](index.md) ## [Change history for Windows 10 for Education](change-history-edu.md) -## [Take tests in Windows 10](take-tests-in-windows-10.md) -### [Set up Take a Test on a single PC](take-a-test-single-pc.md) -### [Set up Take a Test on multiple PCs](take-a-test-multiple-pcs.md) -### [Take a Test app technical reference](take-a-test-app-technical.md) +## [Take tests in Windows 10 (Preview)](take-tests-in-windows-10.md) +### [Set up Take a Test on a single PC (Preview)](take-a-test-single-pc.md) +### [Set up Take a Test on multiple PCs (Preview)](take-a-test-multiple-pcs.md) +### [Take a Test app technical reference (Preview)](take-a-test-app-technical.md) ## [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) ## [Chromebook migration guide](chromebook-migration-guide.md) \ No newline at end of file diff --git a/education/windows/take-a-test-app-technical.md b/education/windows/take-a-test-app-technical.md index 3245416d58..149c29d066 100644 --- a/education/windows/take-a-test-app-technical.md +++ b/education/windows/take-a-test-app-technical.md @@ -8,7 +8,7 @@ ms.sitesec: library author: jdeckerMS --- -# Take a Test app technical reference +# Take a Test app technical reference (Preview) **Applies to:** - Windows 10 Insider Preview @@ -46,11 +46,11 @@ When Take a Test is running, the following MDM policies are applied to lock down | Policy | Description | Value | |---|---|---| | AllowToasts | Disables toast notifications from being shown | 0 | -| AllAppStoreAutoUpdate | Disables automatic updates for Windows Store apps that are installed on the PC | 0 | +| AllowAppStoreAutoUpdate | Disables automatic updates for Windows Store apps that are installed on the PC | 0 | | AllowDeviceDiscovery | Disables UI for screen sharing | 0 | | AllowInput Panel | Disables the onscreen keyboard which will disable auto-fill | 0 | | AllowCortana | Disables Cortana functionality | 0 | -| AllAutoupdate | Disables Windows Update from starting OS updates | 5 | +| AllowAutoupdate | Disables Windows Update from starting OS updates | 5 | ## Allowed functionality @@ -62,20 +62,20 @@ When Take a Test is running, the following functionality is available to student - Magnifier is available through Windows key + "+" key -- Full screen mode is compatible + - Full screen mode is compatible - The student can press Alt+Tab when locked down. This results in the student being able to switch between the following: - Take a Test - Assistive technology that may be running - - Lock Screen + - Lock Screen (not available if student is using a dedicated test account) > **Note** The app will exit if the student signs in to an account from the lock screen. Progress made in the test may be lost or invalidated. - The student can exit the test by pressing one of the following key combinations: - Ctrl+Alt+Del - - Alt+F4 + - Alt+F4 (**Take a Test** will restart if the student is using a dedicated test account) diff --git a/education/windows/take-a-test-multiple-pcs.md b/education/windows/take-a-test-multiple-pcs.md index 116da7017f..742aed682d 100644 --- a/education/windows/take-a-test-multiple-pcs.md +++ b/education/windows/take-a-test-multiple-pcs.md @@ -8,7 +8,7 @@ ms.sitesec: library author: jdeckerMS --- -# Set up Take a Test on multiple PCs +# Set up Take a Test on multiple PCs (Preview) **Applies to:** - Windows 10 Insider Preview diff --git a/education/windows/take-a-test-single-pc.md b/education/windows/take-a-test-single-pc.md index 724aa1066b..f62fa9805b 100644 --- a/education/windows/take-a-test-single-pc.md +++ b/education/windows/take-a-test-single-pc.md @@ -8,7 +8,7 @@ ms.sitesec: library author: jdeckerMS --- -# Set up Take a Test on a single PC +# Set up Take a Test on a single PC (Preview) **Applies to:** - Windows 10 Insider Preview diff --git a/education/windows/take-tests-in-windows-10.md b/education/windows/take-tests-in-windows-10.md index 09ed708476..1360d736f4 100644 --- a/education/windows/take-tests-in-windows-10.md +++ b/education/windows/take-tests-in-windows-10.md @@ -8,7 +8,7 @@ ms.sitesec: library author: jdeckerMS --- -# Take tests in Windows 10 +# Take tests in Windows 10 (Preview) **Applies to:** - Windows 10 Insider Preview @@ -18,7 +18,7 @@ author: jdeckerMS Many schools use online testing for formative and summative assessments. It's critical that students use a secure browser that prevents them from using other computer or Internet resources during the test. The **Take a Test** app in Windows 10, Version 1607, creates the right environment for taking a test: -- A Microsoft Edge browser window opens, showing just the test and nothing else. +- **Take a Test** shows just the test and nothing else. - Students aren’t able to go to other websites. - Students can’t open or access other apps. - Students can't share, print, or record their screens. @@ -33,7 +33,7 @@ Many schools use online testing for formative and summative assessments. It's cr ![Use test account or test url in Take a Test](images/take-a-test-flow.png) -- **Use a test URL and a dedicated testing account** - A user signs in to the account and the **Take a Test** app automatically launches the pre-configured assessment URL in Microsoft Edge in a single-app, kiosk mode. A student will never have access to the desktop in this configuration. We recommend this configuration for high stakes testing. +- **Use a test URL and a dedicated testing account** - A user signs in to the account and the **Take a Test** app automatically launches the pre-configured assessment URL in a single-app, kiosk mode. A student will never have access to the desktop in this configuration. We recommend this configuration for high stakes testing. - **Put a test URL with an included prefix on a web page or OneNote for students to click** - This allows teachers and test administrators an easier way to deploy assessments. We recommend this method for lower stakes assessments. [Learn how to set up Take a Test on a single PC](take-a-test-single-pc.md) From 14c33eb6545a2c151c3027151de48a4992772131 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 26 May 2016 08:22:28 -0700 Subject: [PATCH 422/439] add steps to apply task --- education/windows/TOC.md | 2 + education/windows/change-history-edu.md | 4 +- education/windows/images/choose-package.png | Bin 0 -> 23200 bytes education/windows/images/connect-aad.png | Bin 0 -> 71209 bytes education/windows/images/express-settings.png | Bin 0 -> 110041 bytes education/windows/images/sign-in-prov.png | Bin 0 -> 50574 bytes education/windows/images/signinprov.jpg | Bin 22869 -> 0 bytes education/windows/images/trust-package.png | Bin 0 -> 43329 bytes education/windows/images/who-owns-pc.png | Bin 0 -> 38019 bytes education/windows/index.md | 2 + .../windows/set-up-school-pcs-technical.md | 262 ++++++++++++++++++ education/windows/take-a-test-multiple-pcs.md | 2 +- education/windows/take-a-test-single-pc.md | 2 +- education/windows/take-tests-in-windows-10.md | 2 +- .../windows/use-set-up-school-pcs-app.md | 142 ++++++++++ 15 files changed, 414 insertions(+), 4 deletions(-) create mode 100644 education/windows/images/choose-package.png create mode 100644 education/windows/images/connect-aad.png create mode 100644 education/windows/images/express-settings.png create mode 100644 education/windows/images/sign-in-prov.png delete mode 100644 education/windows/images/signinprov.jpg create mode 100644 education/windows/images/trust-package.png create mode 100644 education/windows/images/who-owns-pc.png create mode 100644 education/windows/set-up-school-pcs-technical.md create mode 100644 education/windows/use-set-up-school-pcs-app.md diff --git a/education/windows/TOC.md b/education/windows/TOC.md index fe182ab2d6..56f2f7ffd2 100644 --- a/education/windows/TOC.md +++ b/education/windows/TOC.md @@ -1,5 +1,7 @@ # [Windows 10 for education](index.md) ## [Change history for Windows 10 for Education](change-history-edu.md) +## [Use the Set up School PCs app (Preview)](use-set-up-school-pcs-app.md) +## [Set up School PCs app technical reference (Preview)](set-up-school-pcs-technical.md) ## [Take tests in Windows 10 (Preview)](take-tests-in-windows-10.md) ### [Set up Take a Test on a single PC (Preview)](take-a-test-single-pc.md) ### [Set up Take a Test on multiple PCs (Preview)](take-a-test-multiple-pcs.md) diff --git a/education/windows/change-history-edu.md b/education/windows/change-history-edu.md index 7926bc8c25..49e7b6303a 100644 --- a/education/windows/change-history-edu.md +++ b/education/windows/change-history-edu.md @@ -15,6 +15,8 @@ This topic lists new and updated topics in the [Windows 10 for Education](index. | New or changed topic | Description | |----------------------|-------------| -| [Take tests in Windows 10](take-tests-in-windows-10.md)
      [Set up Take a Test on a single PC](take-a-test-single-pc.md)
      [Set up Take a Test on multiple PCs](take-a-test-multiple-pcs.md)
      [Take a Test app technical reference](take-a-test-app-technical.md) | New | +| [Use the Set up School PCs app (Preview)](use-set-up-school-pcs-app.md) | New | +| [Set up School PCs app technical reference (Preview)](set-up-school-pcs-technical.md) | New | +| [Take tests in Windows 10 (Preview)](take-tests-in-windows-10.md)
      [Set up Take a Test on a single PC (Preview)](take-a-test-single-pc.md)
      [Set up Take a Test on multiple PCs (Preview)](take-a-test-multiple-pcs.md)
      [Take a Test app technical reference (Preview)](take-a-test-app-technical.md) | New | | [Chromebook migration guide](chromebook-migration-guide.md) | Moved from [Windows 10 and Windows 10 Mobile](https://technet.microsoft.com/en-us/itpro/windows/plan/index) library, originally published in November 2015 | | [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) | Moved from [Windows 10 and Windows 10 Mobile](https://technet.microsoft.com/en-us/itpro/windows/plan/index) library, originally published in May 2016 | \ No newline at end of file diff --git a/education/windows/images/choose-package.png b/education/windows/images/choose-package.png new file mode 100644 index 0000000000000000000000000000000000000000..868407df56b3ae221af81788c9a1abb32b27f598 GIT binary patch literal 23200 zcmeEtb>rIuex8$y|?cBEN)sIoE=Y9Btp48LFOi16<<&DSYx?>87X zHEFRAH50^#?*%w3QAN=YALOjNOoKMCYyH7(s$7l7JtJYF+ zXO2IbL`1MfvDs7rDiYW@VDSARnX0-12Bs<;oWzf_w6itibuW*%Nw>2uwtWhTxcGB~ zMA}WEyNB*c-wn6DFqqjY@-Pgs;dAGf+RqeW7;1<})bBS_*iXqAVu*lXSXo4hundu4 z>i3rv@`>by1(OW!~$+aR2|a|2ZUbqA)*F5O#J~(J@@Z4+IPE z5;nxceteM}!5)TXG{!9a`SYW>HVf0QhP)i)ofy@|QO?2UPly*#iO9#KvM-ooNz_^i zYm7dV2VI4C7?R09lEbm!6&e{OKZ{CEtq-v2a*n|l>i-z>W>)w++}~crR3+?+>#Iz? z+<`!umP4riC%LrKbR}lH?e4}qs1~1Jj78dqOUMs|cV>eXKEcY|H>sB}+O=;hEQ?5g zmP(ASrokqJ>d(K}JNlX1=~vEt{MbO!Kp7AeIKXK$8nrHUZ~pE z0I0>0{z#LZCB5Zu9AWYIUwTgXSZdfK)!tW;el~>l2Sb9AQpSTiI*Nk<&UVjo%(sui zeN{L;%M-nTkSaUI2^ve|1HB&OtJlV$tk_fR|5j-jg!u#ic)sZ&$ z?Vr}4Mbryd1pOl5LJzVXA6s1c)b0wROE~@>t6%%X7rMw4Kla;XPH*v7pXH4wr;DYW{^u`-{kH4Y zB-qtiP4=t2jrSy5e=k#6wm5q5#?na_e@zhf7#i_Zk#;7(KSoXzEjVXJ_SqcX&M%}# zF#6>2j27Kx>?xk}I&2qMgM5UVW!kR|r;k~GvQR8i4EW+!;>Qd`D2VHJ}yM=&fNl+H(jSm01|E@A=E(OK--sd*F&Q<-WfWs zhyM8tO*>_0JQbUzD`DE`s^mS=L!(n zXEE>WsvMS%`e$cVFJG@q2F`o+GAC6vX!l9!-)rI`<*j`M=35rJ=TEN65H40G@F>ZU z!)fKAm8{?*b8P(NW>jJTZ;-E$J`G?g{KocJUQ%!LL8O%rcoKoHj?%a&=?T-l;f!(@ zaL?HHBItb71!K+lptCicSm2%P%cOlaPC&I<=siDkan-P1n3X_n25#D20zIMpqdzpX zS;bQ8qu+p~9~7{Am9ZC04q{0O5cBD{4y&C*!2K74d0GhY>i>Mg zn`65aBlQz@s@xOK(vc?yhLxoWb&D@9>UKCM2k_GC*;c86Q?-#7L?S&&LBXy}ti)*h z^Gb5^QMEvo<=}cojA_*!4x@HaBtEU|`^y2_Ge-wr-?IUm-8v?5g0gf#E_=4Y1WmQO)*Wp0(d1bi zZE)h9q?_@EXb^-QdE?FYXHas=b+{1yGbR63;zRFCh@pgkN3b|j1|us*Q>PM|1tvEph}-OIDPS9>oq zn^QjlakR3ikCITu&r8X-1)Ta@6#+hF?Wi~fXbJI+4PMfalTFy-nRVFqXB}Wr6KeGw)1I53=&Vi=L;dW61{jV?DRG zyukVT^TVp^p&PhfB zW1-6#OYB8Z^`%}XN?xXQ7wQ_7e{H9S!yQd7{LSnm1TC-YUvrVg)_i0qB$~)4D0vjM7E?mx*HuD?l(a{Cz5lDk8R60(&zge0K+!Rn%4Y}HYQF0DE!Sg4TW zhXN4fJAf4leC?T!$t|AAzRn{VL{s&eI!$@^SZPjt3`50kB_yym=lKo6z?T}!wnlG_ z_TsDQ)1L!)0=gqs$n8T~!kZt-ss(~*h4dneW^X%Y+IGFJ*2`EZ8v{=U{ysKMeFUN7F3x(A;o_v zrIwN$gSa7Bvn)}C`g(i}C}b#h!A1f6vCzEgaE*lC%>e&=?k`1+)6OUQ{aK*e@2Hpr zz67k1_%okYm5it6cB5jk0G}CB-&BM__n{8j9VS23T0l#yCvrBb?bs^09i{dwJ-T<~e_? zbmu~{Ph;dXTI5`4%r-YS<|6&Qd9^n=*t|bRa~Gs>wlC!L#`F>@@Vtr9E`0OAN>OAELhz<3^i1zJK-qv6 zDcFBcQtRKs7t?4eW!@O*UP75;!XuX&atr}GD|WWxK-9hs#PS=nTcb@*2M*i?Nu2V$!Dd4-0gm~Aiz~f5xsXomh6U&>^su0oiL~u4 zFpw%eM(6Glx|(Q&94=@5J65IJ{Nhx}U}B9$645D~hL*k2dAq;8pX9egQ)IGR!^5Fr za*H$FJr~9yR)h6=FV7nB%$s7DP@2Wwt?Q=71-8cF1jpcykw{}n@+0S9Q7sDaVY_jW z3qCuDD6V)4^_TFLdNo2nKx8M5T))3UvgAjqW%&jj0?bLcikpaKPWc z#bq-t)bd!n-;y1uA)_A4W;0~tKE-JvbTGHn_@wsK`2_v zoozJzGsu;yeAyFB&;J{Oqmg<6fV^;)>k>}Xkj_YHEy}S5)@$%FQDR%lbo`oum-oyQ z-_P8F{5xc;c**vJ<#>A(G#tsQ1?u69!Tq)zz?h4okDL*OXy8imG3HcAo1O-{$p}%N zy41IDPz(VRj)T`{&n10=CBZI$iGku}xP>akHwFJg_M^*QYgHOz*1r$qT+adZPZE5* zd9RctoCt*B)K~?o+F6?9z|L=BJ6TbYFPqys<9G&&iy$JO`nYsQr?|1dD2evZCZxc8CI zOb~$cF1!gl$E1^Tm<`*=aJFJ>s@5`;pqK<2T9V&DhzNs_e!o(F^~U!I)D!TP#+u!Y z_SMbLjFQPuuQaf)$yd?{V|pkv6vC$RneV-RS~Z)$-&o=*NB0EzFb4Q{AP{PyV867> zg=W!gn5ovT1tW%Q_#hJ9=C#;}Zc*<557mP4H>z1SFj?P90qb@9@!i_OP~4M%7tL!Y z-QIxTTFc_3MmQA+8QOh+U`p#iv4K)3_$0xz=}(L>^yVI8E@V`tYm0zbp~l z6R=m2Po;731arEp$=MfYqO&D$jp&9UN{bFO)e4hKF!#6VbO^;J*wJHW19S9{>B#QF zm$InsJLuDlV-UmfTwsnhRQav!6xKEA_4yq0W4gyhcD+vi7Fb0p3=ThH{YGvuYB%}5 zNk9juLsKA?*>`*D;PCw746=^zEAL>&btYZNM@6n8v2>;w@d-$f;v}H257--w02b*9 z&RYD9kH?@X@V&54Q?D*@`{hTlTW2cMif`|?^;Mz0lcwV5&4BdSUH+t=yaW?&K|lCm z@I)7V$oV{P*K|XTLSI6p*>J)r(^0hZD^A_s11T_28@Z`ggLKSuu;6V~erkI+Jc{6j zq@?zX@=7qGc~{I9B}>ilqI7M#@}#{ zux(TCl3UjI7o6_)q)ujUP|5F)gz$2gY2XUS9fiax9ICAG;WU%wMY|YP53F%U)|ozi zes0-@Grh@CN0`CwRL&D`*?w&g*>lc^WaQ`tJqhU`aJvvLDie@P4~)&W#k3sH&!tyg zUh7m`@S{Ia?%>t1j_XALmwYG5IoZiLr61=dCG2Z(OtswxFa}evnib*OQvrC}z(Raii__Oxsg2Uw zC8rawGEz&0qINpnuXwcTh*v|u+uXA>Jo6*e1(5~6J`g+%CPtCoFt34Qb*@ZVw{=SC zK1~#v=c|>a1Fp+bv{+hp& z?f21Z67};*z?|p{d6g<* zS-cI?M|dAT?EVH;E*NAluxX#e4V#FO^3 zBBX>o`Jp|7`oYHE-+M-MtqGW6%LARYs`Cj{CQf z=z}J=5#muS%!7v8?jF5o-^-=!o>J4Bt}~*_4+}hX(is6iz9=snv!3vHqVc+naKWhk z_6)-@LAr#BsnZMB&*IUqTHp)UwV%#fTgv#imZ>Vm^$_7YCi%!tMsy+?J!QB?DUXM@ zdg?YQHR)&48c2Mgq!gQK=s0a(^OoSyiW=suCXC3?ok?m}k1R&iT`@L7XEJIb6BpLD ziP}k2c5f-xYBO`@yrFs6WLc~g#E5-b8Nff6GfYjj7g#KqL^pNY$DfSP#$KPEW% zvy^UDyDOMJFh;?=ZbA$O_m;Abi0p2#CrfRL7$cMfQnFU03q^}X1nwXB06wnz@jvnq zNT2-J9c{5`C>crXe6V|v8Dj};p`>{y^nDUW{)C7_4#f`t zk0gtMMRZRbWhuxUki^8jIu^Wpz8xPkSjnVCZf&~ek!iqfMV9R+KE=#)OnBYR89ZJC%yv#gyM{6;A zvC+B?=mo_x@r2wv-HdOw-5NNq9gKXWk&+<3brGgNgzX!w&gy!%)p&3*lPDv@{3o%H z-)ws4wX8tOFz}i|+g4$I$wJpz{A%>x)1H;1hV*q&QZ4QvnmxMhCCB1mp6yFd7xxFH zn%faTW(lEMeIGiyeat!Oag@f>Hk;F-Az;w4<)R@MEweJJxC1vpfK1IU-85fIh_ zt4E$u=Xu-UUIX1Id^qUB!&4sfn+UC6=sH!o8=`m;jutUw$M0%cuYRNA1dVenN~c-8ld~M8FWPGgJ!efEEQ!zcL(M1T6|z0 zxs$z5YaTRbuHL9tTnvPm6qD&L!$sDh81V?{ZQ(kfRn2R7SvJc76ghBcp72|(3GF96 z(S7IBoRrN$wbq0|9`uZ?^vO@~Xs&Eap*;-y6w_H)mEt*cWJ9HSZU zdwI;jXxB+;uL4I@=#QHha%tf5*?I+%TIptdQVxFxLpx5!7FI(K_5P|pe7nXg;-DKd>D zCe`)8LGHn96|sP?BEYboZK`SDVq>a?PzZkoHmSE;MrlmC1z#ekT9<417Hup*e+25!A6@Z>tL7hfOyyOzthf4!s#5P2EqPV6qg|i=u8Kw2_tlM{!d$$ZGZXk z>Y$c4%3MnFZCj}?Gias<5F(iY*?FzslMTqJrenTSX>b>T?|x#$J&1%Bqn5-S1!JBv z=5K=~?=6m1SL@36C@4tG5L$b~R*8&XOTM?=?Wh0jHAt;7S~pze~FB$^XsokoYW10FxSBQ!>n83oO) z!sLM#^Be5ef}X*^oLeRQcOy(APEJyWgMCifq07TJA0r|W#qB5IH}|*HYM(+f4xCmf zs}1^&5_!8Z58T-;G+icNV>Rp@eSzMK_Jmg$YN>)#4pvL}OetTWYx~FXvRpk>R0ywI zLTx<`%y18#y{qez_HiiyH+Sf5%F@?CX{N37f$88qy|4-$1p@b4Ez(y*mO+a&Vp>4v z$i2_DYSEFG6z6!KV`7wN<)FrNxg{O!K*q6t;v9+$uaensp~^WKq|(v|JtiCTU&d>5 zMX(IvzVi4aw~Y`5xv!Sh!Xe*}{14&M#-a;9-dIcib+T8-WG?70?#?OtT(#uSKtRU2 zW+7nLRVuEyJ)@j<-mD1QuD=%kso}+(CmmTVZ}8`InQPr#WeUX+E!H>a7VA?|&1N(6 z3a(Ts4YEU)rc|pB=FFx`(w>`GGH@Cz0J~Nn=+Wzk_+SSpiW`zu`nS!`o?l5c_6m^BnpTr%SpGJHtA?S1YoK|LhT+XpKM z@HjNIUp%ilS_d}Y6jRb$^n5>?KeB+0kCx&4_~@QIa6kN#^wA0f3oAIMb|cP{^)<|> zReq?K;z!KR;_BkiJ%jSknO8LjCD$kUdvj#mbH3nHekIxVB9`$pRk0dzxik?5TjF`^ zN)teC<5FT}ysFDISx*2)zB9T`twt|)zXd}AntPk#Hk0iS66=nm5nEE?!wQ$#>p5p! z+|~kX{F|>H^x0OZwdeDPd39{!v$O7;Mllhp#dCP0<6$zhs-g?-#5aZMHX9r{eekbx z(?EAbwX3Zt<>O_OY|g}(Gb1J9pM9{)56r7~HqHJVn+f;vK1ug17JoSnr2TF2nF|w` ztnmvscJxhLnBsCfllf+R#n#(n=W~P_=lB-gN%r65{B5)ajoMgrMUrcqd?1{~$v-u`HbX@Ax$AF^S^cp^h%qK2I?b z3;mJ_rrsfZ2XEg5CCE2HJyfKJgs7z~P9JZD7v0wjuxzt~EICJwj|`YqOa1a+!chI= zcLU`;O-CVuGO`M#JYQVn^F@;1zEUPnIaL~-Lk|9AJY+fnQ(6eB!UI|o2wFPXyxdx% z4NIkqsTGMqtnq#F1dkJ&u)Et9NigjzwxM8cPm4Ox#!CQ`7!WN<%%F_eS?8nog?7~nZBizz6KREbyoQz$ zVp?O3jQzfgNWtRcDz~1qIZH(U^EfLGY%;=H?Q#Q1pj1l2^^O~y(Zq}2R;D6Hw3eP& z?frW};HNswGC}-&Tc7j4y6V$exV+?qxwjvox4M|T;fMBbH^Grp-ek&`(M0wy2G!Tx zqT360^J>As0ZRD#I#qQiiT+Fi9!?0MVY>T`_Q^(~BYy(#6mY)KIUDPvEumF#*y1w} zgqaCDlhqfr4;E)|AKZJfUYh|#rQ6M@AyXgsboNCIR`0riYrUsH_|VbzKAxG`fh41w zuqLLC+QnntX|n`7kJT^~d9-gN9(wmaL-j={AU`WRKLHS@GuOE0ZS4HegTOGrfIlHt zn_1fnL+Nz$Pw;j$rJt)pKR;yZxVZ+2>gh#KYI~oyv#)$oz0D&48Bo|W0Ck&ra8Ak# zN?TR6O1SVb%2w*_9`RSL)~DyCHQYZmCk8g6cg#hzO(ebtj3FI8v2b0B9DzPPyqCZ2 zn6oZB?|0kMhFm6Xcob)oxF~jnL*Ehm6eAmeq`+We-a&+l5%)Feo#5d5JfVN4mdN_5 zut>@+C);gF$HlF4?_m*>0IwOAsWRA1WfK14>chs9Nu&v}-eSDS6JarQX69iQLXXHDJLcIoa`70FCErA%D-#(&?!iS73EN$DD7GQ+D2b; z22S%daiCK8L_%qcXTaFUw`2Q-f?1VsNxo?~#<7-FG}uSql*j25J2Z(~f=Y-}`nvZs zH)nK+^0}7;w*FMTi$&a#4l?h<1ErWqq^-r2^D}XFG~RC)kNN>tsfWc&+IpZB$Cp6_eDUmwZ>f=Q6Un~Ck20LQ@_1{o~)X7IM)@t?-iF%d~j0SCNOl(q^H*u=4}8O1PGW`6X^$>j*Y z^8HfBs!$ka2DAPxxWAjO>LCv%b#voqDY6;2$0k+$_=)_w5|Ci-bVvyrr)rO1nR+y% zDFZx2LjS9jUjtG*FXi>b1h7pS#b-V-_3`iEAl1HcIOB#c-Ch0~RwL|cH)#pffc3gEvIBimqJLpp`%R415A^)u?8O+z zG=;tX?12b|485raGx+Sro-{~XYc2*ws%P(~#6=UsiT|g=d4AvattmbKB)UP5sZ^ul zf^11vgNx-C2g#r>Q_^v!+qNe6Jwu%^^g7n`Ave1pPuVOUNd4*`$qi3d5qrDOB47j( ziHy#0WYQ`6|wtnmbcESP-yRXO5mVDHKWNz z^-Zvw4X`edU4di+_Ty_S%A|iM&WoOU-w=8WJGjWZ*%{;_&8}eNq5?Lh%9PEu5?-3d zcuwCt`(xF=`rBYut|Yg}r`ZIj45ja(~sMk*eiY3X!15JVvBj z0~7yz_b2+-f;$b|8AGLf^}U!)G5B|M6!s)+Xa*Ok2Y1(Rbi4IA+UUW20LJg)ibW#g z(M+QBNNT9aBwP*HQtLh}aX|WH`f+8EKEBk^!BpVtWS$MlX?+<5t7kJfG3|WFynL1D z=qLAz-4M82Mt)MV$1Cl(r}=QW0G8ORM@*}T-1*y7v;?Tr4{t$uk>rXi2eUstR+W3< z9rX0tdYVUYz6Mg3yf)y$7?L91+~H=W(s~+zrxOU>Z;v{SVn&Dl#yteZr-Ao^GLUK z1L!iS`ru&@HtZee#*KQ@O=0GC3B z42Ia63K2s)qg1whu=FL}Cvtfr7Ye(<-QP!|6vqck%;?JqNrS3pqod^OqpmVTsh&*Z z6J(xre*^6obm8RpEv9_ORJj@8xHlIt$|*@@=|5#$oQXjP)sjlZcWy7srSpE7{X`2X zVt(6=UWk7%<-C3MB=iC`A~G|iOU^PtX!s)L2SP)E4NBF9l0Q1Rt16|p2YRdHug9Xb z?iCUvfG?5NQ7N~IKR^#Y-UXKJ#?(?+OuM$`#Cow{gUy62Q z^)quYxA#rGsySFp1aum`vFl6eTZde*@#=i0gCmSplS3ohj1Z9#=iDH zd)`M=+apET{gpV27&^FCsnGA}18E7t_}@ulo?gp|F6M`CfyG8t)02J@3-J<%C(3bMQglieptax)oKk5@dDWjqudds@%#P_c?_mF zJG%^AOR^FSTFGC6XB%XFRwdww(VAirN9mbki}o2wGi$9_B3f!0Hr)9AfXa;b?Yw5W z_>WgGNJ+Fehd7YfH^DW6ylCl{iTo04Rc4V2^&=g~yw8jzyHT-}4%J_`u472QNp&4i zfm`9tL)cTMbkG2F4ZR*g;~_9|}TaImE?PZ$6FvVzni*xskJ^2q=ZXJpuTj_~z! zfmA>|0>9Q!>JuM1{Vc4@4pgR*>3kxkjdN)h5)8TMY@h-U@SY=g2^5NnTTaVaP`NrFh;E}U7h*#N5`i+Qa zDc9hO*eljj0Ca!=pkV8#*5D2|kE(e%PitO8#qf8?a_+L44(}v>CLq8EkU(2RE&{@- zFLGre+ky!wp|nYIiyuWWxcH!9J;My#ulb4(9nrn+2!t2X36N>p6~n2h<5BTtZn?NK z-!oq5C#lmBNWw+``{xJxVy|+XrM_zk6T!hkUGn%brp4Tr_&m#cg0gbsPifSq)OlI; z-qqRSvMWzgtImwFbW?jrI;4vD$k)&qr;zCjk5XZd9#=H8 z?u|H6#Y%G8RuMQRbg!NsByIsNB7>p7l5Z}XW>>kh`=6!{RB#FoxV0nE(xB&4O63?%_yA2Leck0w@iIzgrh zKI%s(1X6Y5Aj5vuQrdzw+9!WG2 zjdk4lqa41oF78zXAwG%)6csU;>&Gy~>gEHU7O_yIyP>i(PDwp`DTOY|NJKixJJcPu z`Pq9g@jrbA%V>lYDoAQd7A>hMQVFU9e3W%+3}RnY!o0nSgnIfZpGm58q&25g%DFwu z;JoJwO5|@%Q4RqdeufOgFVfGwJWMaAD7Rg_BBNg^X)N&PnF)m*g{{DW8)GRnj5Jt{ z3&exZ(+2<4zhbP&9;|f`KDw8gU}cM0>oTBZM#QF+b-FWvo&~21z;m1*A&bn&u6ZCD$tkk5%^I)xc? z10$ty;-6sXm#uX<;iSK-{Yd{Ai`DQ3jnW)sx4k(sBwYTi!8rP2a?bO~+CZM4huG2x zo%cts!wKKf;=%^rW#tp;N`KO$UduVP;gOLMBqiY2S{YTR1QAKJe)QGxzGK9$2=Ujz z&H+Tcf5!>vxd#c#7OE!2GG8vwO&o(`uuKs=GA@UgQS>Gao2dr+QW{qOPxgR#6guwk`Ge{_y3oTEYevb%?*sRx1aq|e<4p6=y z4vLlesbKP4>j{Qy{!{NtzM;Lv>=IEK6WPg~`gT54v^NasAa(c!QVNsF0I7 zf_8dBh{x_W9nns>E~LFzH;8L8Fj2vUt=jE8^d`&1xrJ}*4-AxC@^9KnTz`XA$M!D5 z3em%x@v@Q1FZYXE z=_H=k%Av2f4Q_ir3GIf;#Ndg#Y7;H}$(5hWUf42@^Z=u=`olX<{*^iA&W;of{E>Y_ zR2^LeH5I8Ct(?HfBk9U^_+~lZfB0|P0`yyFBtGS7@iF^gA8G91Z?VF(@6$XS0jS4p z-L~NC<;=WveOk&&n?p{yX@7)-yC)7d=X#b90LncbQ$+IYIq$9d3!uN$s! zN5VJ0Q9XR|55-KB_IxIvm(}0{qs0Myup#d$u7qoB4~J$nb?4@|7$NrAm%c;B%#y^8 z6I(DcMGmb0p50tw+Vlk>4QL_9=ljuKY+Fv?rt(-d^tfA)NGj*ROR0R z4^_{5yOmi*)!QrKcO(Zd`LX6BBIln9$7w(jE<0M&0@ft9Yr0c<59K#vTp7 zFVO$d3V5y@>t?4PR%6xbvK1Q+#C=yR1ky4j^QqUwek5_-o1&+9^S)=K**TZUGdp6d z@QFmwJr8E$%uW@g(?-tM!O-1EEzb0%X zb^Gwv&HGEDnlaYy)fNXDjZvTFh)2S)+pZ7JMZtlKVC^E#L}G~*xb$$;d;L9mYyFt8 z-LY`}E**Jxz&1ix3uj>_=Wvkyg4zVdT6d?(fGu`Az4GNU@En02m}fS4 z@gRLG&_%x#HI0S5HnO8NN&Ex=)7h&LA|b|QnA53a2S(Iu_0d^dDf%Y%tnb1#5OSAx zBIW1D@NX}MUsp>ig~8;@1P*d*Zr>f_Z6D(jk@)JO$ojBIw(LmXJ|o)JpAm_XM2Ul< zBqU1vX1i3Ww-Ox8o#TX}I6n|qAW`!6%oNDb``XD6X0u8--|=p6^E(P@c1U_S z$Wy3qBTO&OoQewl^Lt6b52SyYl1l&JQa_;hJ}H@ykd>~X)z(-%h)c7LHjem;dfz)= zz5nra2u7Io&-#4J@Iz+@nEWf{hjE6VlEpKx2kUgO?`iCd@n@2Q#b%an-zqBGpJ<}X z#>&@NE)`ns*xk6SO@^m*OgJ0z(bS={c--l352c7p@+X zd6v7=MYcA6EvCYbj=BWfPjk}e5jYro=kXI?oZj|upwDsDh{$)nRgtTOR-tk{NvZEd zNa;d_e7rpe;ph;*LsTBPjCbh}XW>0sJ?@9!uepPJduAhCs!Sm%h>`QUL6O3G(JNjG z{e$A4t-lMRT-<=gyKE`h3qJ(6g5oR0OU(M#a@xv8vDf6%`|=a!G0x6|^G%HMr(cYI z@7oC%dhe=mRO+GuR4wA$^0L}-Ne2Il&RXI9i%8Re8V?;E+>El~KkmT_@c1(yNx{Y3 z(LcDMG+OTeOX)o|=SJ`D7m{3m>Jb@|?a3Fvab8;$gqP*pVfef3ij4{%7$;p)%YDnw zRm%{fi&i~Q=y1D6jN<1{Dkb;q)lw64@!@Xnxo}PVmsfuI^;h=Gl zvMpxc^D8ehqbBhO(7MTp*B9xU4`(pl?_MU-iF?dNnfp&a&d_8rk%^;|7RgVs(0bQ% z0`r|6{CzA*&?Rye{!%yJ*T7bSA*_bFqla7`zEhUAj@>a+qP=H(b0YJ<#KG?ySVY%T z$Q4QWJoQ3U)Nsk4@>3d?tVj@Ez^~S69*vbv^aoFhoUXH`qC+Gt5(ZqPownG<)3tZH zxaeTq7O>mN>_j-rBsF}4>U{$W{`Uu}x-B<#^}KZ!IDaPlZ*?PmOl>H$`3R((r?(Vu zSS*UO7-)Il$vacK1&-$Q?S?huqrr*kh{bge#>5R*%w>eQQ6K@#uh8dgn*71WV`~A( zWJ&%Jl~LiMoxJ4sTAjH)cab%5Ul&=mWIKWtrRB9(*(=!VJxQBHuDDa=iVLz)|&`6aM&zk5i>KYSn{;eBy6 z7vCclHJS^uBh)f2#j`Yz84nd@L06*CfM!5nrc7rl(<8|k4BRESnFOSq&Pv3oU*=WI zc(ENnLjYU9YudWJ%;FAl%oI@8n;*ynmR*R8#X%R_W$)~2MTh6jd`qc&R;|;4Rx{u2 z>9ZS*tmJ57C{iITY&|U(D!q<3&`#ugQ>`iziCubs8<82t0lnA(z9|mt&A24L3dI~= zp76rQkG^2zPdAe=9s3G44aG_vDEaC%EEzo>-Cpy$RkD5xpga(~} z&qfL~=_{-qs;o)+XGza?`wEje>4#>})Rxf)nB05gdg3=r#+3!e(7Yjckso=ix(RuS z*WYDj8qFcauQzorVyxO%SJOM;?NP!%qx5K5r95*#xk-8S(cZO$m6mcd@y#v-BmRr~ z)U!2kewT05DD!Sv_$A=l^P_WWel%QYF&U)`EL!j!V$`PvG3e=?F)5o z0be_+9V!G|f6kqd*Z;Om1ok=lCprc?-uA&tf(ZVSgSwJdpwlvMiy4ez%eIXU-mQnL zd_;CD`T$|AS=7InF-!hZXnBV1Y1tniSwFsKn=pF!HAJezLv|H^bhWF(g5pUUPV}Qg zJ{2dmO_RCWXP&-ePM_-S7ip3JjY*YRuajep`m^JLEp-LK-3%dNkGO$%nPPhhcHsY1 zExy9X++i@jd%;U?(f=1^jJ=;fmgt;J?Yle10}ZsHjiaPG5C4X7*D1R_C$A1a%Tae3+z!)#*+pN=PWzHT{&_ zsQtgGCdH|ozg6u8g&@bCy?w`4ie)=`1=Da4!uXVqEi0H#1>^QsFs<2tei9aAk{cCWS4@Tj zL8IlpMd(fP7p!@ROSQWemsylZrA9A)URUV>wW^Y`dRbA$>+W(W8xU34Z6sQBh7WGf#yT{jwqba`JWBLA(} zPe0x-z+2io%h~{0uwiGrou#;bcPmCjjYU`U8ZfhTld)I+<#za%+e@N%SrSg=2)wxZ ziR^|sR$O`Ivh#ZlKlv(Vup<{{*8=v0k#6n_`TJ~l>2Jc8ZzSNqM6SRUdV8Z^zd^7G zyZo`&h4`ZLZi_!Y;)$sjeH)-F-CIdJ@q-dy4HQDbalsZ6GND1{ytx)VQWFGGs=__B zxg}KgnN=Qo+t@A%h|c}&B%#p97;28xrq$<7m$(dnB5sdDF@5cGlHMwNi^O{GS8p>OXy8T8@ zNL~x=Hc%{q0)BKql#%jyeMQEnl1r+IHPjY!W9i$snW;(NtOt|n*?B;X7q;3)ML3Ix zgoMNzd@ED<-?xE$k9drx%B{%1UdR6;B1Cy!T^)+LNJ5q2HP|9FNdm`QSLu;kPGkl~ z1u!u)2s^?d(d$xW=2W z>YyGW9O>js)y5{YR-Zy&R5Fx2tXQu=q1gCH_Bzu*!tV9tC??Edy{y&CEXD`ES2dC> za=ss@jZSmDrQ(Gbk3pAerGO>A8oo?*3|4(U0yomKkkd)cfjXt)q-ReDusnfd4Uy@w zHV?*DCCOoYA?y5~+#a5Au$gfh@ zv#3y+u`dqZUGTY}Vpx!$fkSRIke5hGQ*y|f_4?_ESV%i7ik>?%Uq}4|>92HiiF#vY zc&We9DHrV*ckY1P%|o`r+N!R#>@5npZF;#Q8dVlzb+qpbCB{$~WO#09KUU7@7SNP5 z?PPKg@1vYqBK|`VIrksMOBzG9#?0Rtg5<>I5Xr7K4j4VGu`(u7(b`Sy$^ zCd_I^psDt@@rVg`yw8!3=3bKPk>P^ONbqx@tu0{p}Arfn|COw}7!fm18NA z7Xr?Y14op(6-j~Evh(W9@}aJ|W%xTG{hycH^x)VyiL~A3C?8TAY`sbBFx|(`H{5vJ zpoQA9YLp9np81nsx`IU^{+dY6L-#c0Wm*fUvybU8umYGnyCHm(*WyPAkX;McD*quh+RxNCz9ev>MebPl0#uBU1 z1IOs^N0}IPvf?#88ojE1&Bixqa!l#ITW*Sow)D(Gp*@BD}-& z2FkJRvN{d+BVJCSE3jbyhh|lEu~P5fgLqivlu$5fC0)NKgG=f_W2n>+HF9l+-$RFK z;lKXlS*$7Q2T;-b&++=lq#qhVgXg3J@|!~i{l~r-C#OhWm?Js$?f4hV08kq>X*6XV zV3)dw63i*K4scY3l?wDBE-WP*P=0co5?molQWZMDIgKnvXk>d{4+VPeeHIWB{%rA_ zJyj@+_$^jIx>@E?k#da`0DgPu#H~yHC8&kL_9CNsg})~GK{{x-THoy z;?Hqn>(Xey&cV}zD(Kr2oz&k1@l$7RaH@-Vjl?e#dXY&R>5I#3GwZ7j!1g1N9kAE5 zjFYX!i$Ef>BY#Yq7A3Jsd0j;u5#cXSJokRCXrmVz{-REKLfDTU#7}C1w9w}kQpF*M zyj*aOsWs!LPGi?vHLhBjD5Ps}{@@n=d<#nVdQQAY={K;rJAh$Q11vX0l|z!7Y?59* z%uUdeT`vw&3gp&izjP6x(F&75iz%~+CKT-XheFun1}A(n22LgFR{_jmJt)=iq@^aV zX=7TF$;yDf4$LoqM%ZmDIX*sQ;@b@qP@K#)4*@&rv*upx&GKGAF%n1DWx?YNAuMvG zqz&1d-kRzvh)@q+RtTCptDa=L$qcGR-H|c;N)M~4MLk5qHFqu&nG%*d0BRop=*Fa$ z*xwT`e$0@o?Gfnxx2F?yx}3ia%IVr~NMa@VSRK0?$sTX^kesWurijbRu@#o8H9^An z9_sZS8ta!DpCq>a69Ki=f3Z@}XH=rurxGs+ZH-OUAlfNdc|T5T{k>uS5wVrlEVMl% zOMbX~Z|XtGMLH&Rb=e)!tF?EoDA}rYSFpYMG`;^Ke(&N&`7B_skzPFcLJd;7P*;lw zUP`*#2l6!4(XxZQZO8!#7Nb7-iWW}U|D&C&jEb`D)&dd&(%l0BqJV^S3JzT&-RYnr zFyzok4U$8Hv~-trGjt>E(A_Y=D9xGo#9HUyx7K(5p8xmS&$^$z_TKlt_O-91i^wVQ zSOv+NyO#HSewM9k`9SPOHkr96y1m9{+%K1NGy*2SNw{Co=6pIk3GU3)v4P=bYgmzj z_svGhxl;8=nNTDdS`B4|>OVJq`orr%m7L_~&mKCGDbR#uXj%=4fL{y*#94Kv)XbkC z?g0t}-(QWbH+`g0S3Ku9$hIK%VUc6L*mRJrV_`Zfg=EW5Io)j1a^-$_Q)E1go0((w zV^fS~j=krUNDv4Ry6IwFCY}5m5Vo4Z*c(r!&E2#k!NRyK17Iq|W%`u6hsFD&WGm2w zWSvJsyTZxQI92VM6aCOFY#hTTJ0**;?vfXRp&S?)Qg!ILD$!-gRD)S5O-eYjt~9E)#jZRnB*z>G}AzVx&cO_DLj8h6JN zh|_W$@4AfsY9Lx6?k;6SX?te^-bt+OsD9IFx-%6BF}jYX{MxUjLjmu#`Hhs`Wfm+ zn#Kh*TJJ&Dc5GgUJN19_IIu=F8qrJvNTwQWR+EK5q}5nkN z8oYPyg+oV`W&2-9SGAiG;Bxk{AW`B9w8suiL zDi+cMsFT<&?GY@J5P7jhk()5E&(c8n#x zkkY!D9tOw8dH_vWjy)!=_d!}{6dF}22Jb~B7GFZFCCjXAK=!Is@T0&*Ok|BoSxOrl z!TFy&mRF;JQ|pO)+|%+%v6OaRjQ+SYn7&rPMsd?6xV43^zx8E( zB;Llo%L3$sGV3g(h7bjBC!DcRyOuOLiER$Fwif~dzW~tFu6ve8@yI%uVWelABM)*I zxaZ?vAe*d?klgm7nOu7kfQjMW`4tEU!O9m^xeDF=ZZ2Yw;MwVN$y+r;fLT^0f$)ij z0{$W_F+M`a5M4|=u>>_~$DjDVWpSf%?@OX+RP`})&@k|OPTtY`fznz3OG)jPlelnZ zJ&W>CR!VBb%G=iUNX7g z65Tut+?d($GMgOa>#LQP;*4;A{MvMB_I1=L@DB=w(@&Gj=I9O<42?&nlV&kYa(vKMAs86$+&=c2$?)~3DEZ<1wM`g!=UzZ;;gzwV~X>hHt{6+Mjn1j+<)53TMFO9cwEoaTcF`umS zbJvJD_%Y7TxHAp;Ow-T5BvKLYD^>8B|9F|MW7Yq@m78c%V7-BPs_``sRP@CQt)20~ z^?{geq|YVmjlyr|a^C0-B8DA?k9(-_Tp|ie9w`t<^w5=f{CTwa6hvqxy3wtCjqz%- zH&Z7iQy=_#*4bo=T&`D@JC`w|8_|Ao*FTQFMe^@WF!(AVDcb!g~=DTJzFvYat+86pK(*LzQQn1y- zcj(Ll0cp%h&1e8xOzCVK<_K)!^GIhfb~ZnMK8xvjHVkkApUZ_P<7y2dwD#X^X$obuKXK-g zWlJu%wy`{G^u7ki+wZUm^ib=n;&u)%&G@CGU5Xk*0bu+5A9lKzrWnf)-dfF)o5l*B zn;C$Xv7Xt4Dg18j!)!yNqIje#?Xq<8B^q{GxrFVIY%D!V1fy?SLVr^pAveMW=ai%} z7JZ6KZjgE)UGfsrvX;@s1EgWAUb7%;ZvXlCh=W_UL7xgkn&}V0Kkg?;u>bmV^M^vn zuOgk_#KivfIPk*CH&cb}UF)Mz@Tv_N_d=64*4&)60s0pD3WK`1z7@NNflH2y!IjMW z!SZ0PON%k#PTlasW6Z`uXQA~XL36hs#AwT8>VuR6gal^IrFGR!4iAQTw%;0dk9gVL zG1G0D=-x75`AAJR>xr=l_WQv|fUy!QH*cIdr*9j z3%3A3k@GaniD+M&AZvLAXG?Lc2Pw!Ue4-7UPFc0?&>I|9OdPN{Oqs?N%Dlws*Wh?$ z#@ZZwJGHB%FnF^?#a!_-Hv?4d2=m9D>k#hGv%$B~BMSXn7V{S>48M&koN&2i=v+DY zEAlfu>$uQ%<4;B1=~mE@)}MP?QSz6V#e&8tQ|128%+YjYYdprnB!%~mkK(kQwYHFs zu#`AJ6icAWfJ{i3bx{ZLt)$e|r(Ycb5%W=vKM8GYA}&o;p6N1_x)mth8yATlo1Z1W ztwDd^OSnMt7dD%?POo}=^6HH)l%*o?E-yokV3~0lgV?pyLB{Fp+WR?+>k?nlQ!oFw zArVz(n1%Gq7#9SR!ME?jWRuSRCQ377pRLGZ3kVCDj*M(Q7N9R$UaIGKkgUk;T*j_P z>Hha^v$WdugxaS z#3p71QF@PCpxQ;tmYF#b)&H!%M7;>1n`^(?aNz#!cN-($5PX{v_T0<65iZY+4fAK< zB<)2rw4Kk+Uh%-NJ!S1E4PCTXIs$8NrPqmvuJ?~z1}|6=^9Yg8@}bn*{>T`NUC@^E z+37Dv9=`1)@x~4Rm#16ZM@|GtV8xiu=uq|3+7H`wm65y8va~7X!0!99YM1U3eZEbz z9MQnuWLO8eb(pS{Qp~v~#()g8Hq2^~(i^rU+H>ugBVX!Gea}u@V>4zoTD9t*D-Lfy zdlH=Z1V(?sDkVxO>_IIl^;zmR)Fms z?AS&YD%Vo&+gFRuMafPWZaf52~g&%LwJJaoD#V3#3I zh5MmD?9CvB5@mI(Ph?sfeBS4{{u+;a%X=#;Y>K`&4(b)f%3r1H$sn2bH3ZSa=0?~? zCP!!=$ZDr^sg$sInv}tDKW_ZESfRc=!7ykZu40 zr$w=~^-6}v@>sGOI%8`;K>;iEsW#R$^*4^)XOKtMrW1J|9>Y>WH%TS%+-dWi3qMq; zxPt=|%}fi^c2qk$b2=1Bc?q|hx+M5hMZh9pY32dXuB0;5Yb*v5W>T6j9vSI8h4ZMh z=F7ZT&W2DA(uygmHLxfrao?3Myc-wff(Jg9;+!i|+Bd44$+9hAAD`E&j5Co?5GJlt zSE1;C^};ODZp~+Guw}{iyxc)`-l61eL^Z5sfaY|t6C}a zYNfSnsVS9icc9ZXgmv|q2o_ZDNz?Odw^SWfqJmco&?fpA+Ke%L%Vk!3?4oyL%*=$2 zAwX;KjZ!Eg$NC5_FFd=zcKe5$8W(z6WX$bT!iFAUw*jJwE{F*U?MOq+``myn-}AZR z=EB$pv3GT+s6B-6>z+2CF>YCKh3tKs@#MSsYLd zH(KjKG+-e28gp%J?IB2oR?%z>BOQXSP`2WthYLxc+D}HHiWn^6_~wx_?3P-xOFO}^X`5*2hbQRim}HcFq!QJ~%2 zujPINb;wvOhk%q^z$#_)uCJLY#HZ44Z9g2T^^Y)qOj%a^%_Vhm%U3TRtzlM?vLJ&Q zwEyi96L)9SSzZjDDob+%l7|9r^P(Ny?vZ+Ld|7MAz!6R#;(b@5 zeRd*BDI&j;emZ!o?zDf!dwu69)^6s3$w^ilIVT*KFVccCz%SsDiF76&m7QA4vPip4 z$v0L5KikCDvMe>~Bc4t5Sle56L*CWL4-AY7Nkjjlz6b51`mB7a&mJp`n#2gaF*_vz z_&PeN8l0U?-lj57*mko*h_5g$F|K_L5xHecua+a*K);+;ekLl7j|lc8-MR@lpYiYa zi&}e+ZA>cF&r@ha8-}l&Rzp86Lmc)D)esQ6wsy&{`}ro50z>rWW)k)$4fkEoFN%+1 zgr}^47CaD89Zv;+gr>!8b8S6wQ36Rt3~y?9`h8=o)FX4v5u`+Q?C1XwhL@U#QK6-|&WIfmTN7cOz)0pknn+~p<(J}jA zPYiD>m#SmC8bByr*7^bO0okm^98{J{Aw>J32AcKLIiTSv#jjLI_76}}?0q6kCPq3) zZKQq`?%BczJ|?MRCoGnF=lPDK%+VM-r5%MwQO5mlV@H%)ux_|cWDwH`kEfB zW{&Hz2=gN#LYp^kg?#SY3XO*6V2?DF&`0|-2Fa+3@j;zW>H~q^xLv+AIZ=A2+;o(Lc%+*@8_A4 zWBw%GY03PejrWi0FBkrc;i;Dwk&>Z2ESS`I z;bXJ)+iX%SITd7r#kfvY9h~KhOsM~rTHIcPwg?#z^3tfB;Wv`1xOt!iw<=5oJpv(-W(phl({Ora&ZZ<=jq*AF}kNiM}`tOw=iDJlq2`YDj{tx2G1I&-^nQzk`w+C;|>Y)XsA1MPh-d4z2 G1pWtt-=N3< literal 0 HcmV?d00001 diff --git a/education/windows/images/connect-aad.png b/education/windows/images/connect-aad.png new file mode 100644 index 0000000000000000000000000000000000000000..8583866165fa3065700b9a0a1a946dfa3e043ce7 GIT binary patch literal 71209 zcmcfn^;4Wr(+3JCAwVEVfZ*;HY_Y|IJ0!Tf`{IkcyKM*-Jh&|G?(Xi3yE`Y}`}qUj zdaF*IAFi62uIe7?zIuAPKjA+VBvFwGkl(#~hbk>4ru6RJ2mE*M-s^ut_($2kS~LIG zymwNP6nR%ZMs)CR@X=gYUijU+s@TuZhVcK!NDfk(PVe5Kb^Z6f$EK6<`$xoc7T0iA zwl{NjGjue4=U`}Q=ge$p>P*JL%*xDT!|tQ-?%kWew3x7pyWVjIyn#ypT)%H~T6D80 zrc}Vk&!?w9=-_3v^Jf13;LFKSn%Qv|JTjdW2NXe z_^&J4Y9JQ!j{^@S#G^9|<^Sx^s$-C z@u#R!6ZhO=1|RFB3?9L{``9Kyefj~&QE~34SyRbvNNb!TqVOSZc;;D?kwpR@q9^{_ z4AwbfBuXL55MU!ETy%sn(LVT6`xZNCKIo?oMJ^I|=32bZBn2P}>xDXoK_p?T z(bL8p0YT;kPhag#B^+ZnGGjLqm9IBb^~cA4rzgt{yp(-vTZ*UjsV{5UI$jdmcK>&V z3In9H0O#+_Sd$wt(eccT`_0i3(5nOL80qSA?d6lzt$^S!yX;Jtpb&;gnW5+oAhT-u zBj|_Sv&KvAhi>k;(6ukiFO|4SVFHnw%|Rh_8vtxPJ28u-B;hIyyc^ltnFjLF>d=l#%bDW6D{*^+FYRN<>6nKLq^O=CjsgZ&@gS3ex4}K)Wq(-IC8otn zxG6gNR>J-ZN3#u0x1P?3aaP6N=o$A#h>iWI-Z`Bhh2%kTFq2KRiMf2kTk zh)XJkms_18mH5FI5GB=UH>i+)F*>i{qKPk_tO^k2fNR)13j$VFGdwEV4YXz5R&wU+h=pKu`Eue!PP>$- zrDEVAbPFY{b4MJaI`p=syXc~Sh=B6EG~NL4!hW4s6YGoZ3zkrUMf|fbl7;o8M^p5X z^F4H*)e-PoWAv!@cIGp4wf&#VC$bObe-u*0h)w@Z(*wc6r=3>alS zMba)dwBDX8`{AQ5v!G8uR#<9$k$0w)G zd9SeH)~nEK>G!3WsJq+Id*p8br*anJQcG)H(s8rc(eezwZHApy z+e1NhAw`q*M_~C{Qkex&u*=l+EznM2K3i$L!ZW7XR>3*pSV%9e=_%}J_X1M}R=-=U zVLMK|JAXX#&oh)&vV!_5P>I`P(7r_{YCH{mFW&PK-ZP&jAJFqW=l($h*T1m|WU=p1 zb!#8EitK8*zujD!Vg6#DmKZT5)AnYFukKabZbsdsWj^DEIs^C%?sr(7$&^z-ChO7; zVaBgV{(K2OJ%Mkj2H*ym7G~}Vsv-)6qSP!VJLAn~(JDq$u8qeGP^f#Paod=TToHEY zk3mZ`ih0T;MpPy)XUJOwtKWlO)hYSM`Wt0c zts&a=vW>oqTVX%NjK_HX{Sn2Z{-wAy`@_zl9C~%b+(&R&8E3u0Y2Q=N};1^7pvHW*&MLd=~Ufn#tBKCGC zI05y?$}Z`N$>SxYEStg9R&Gi@^DtC;*~VmHxaO;+hA#;E*YKWjRAo(FYFEZr+s9W5 zn*_@rngp}x9}>4`U!5&Zdtc!+chsbiwX%}8wlE*Jy*R>~_3o3Nc4Zb%9DOQxt|o;! zbnci=viPY~9pqADLzg6q7FuSrru*(-oozprP!+zZ;!IUffe#`%TdMSI=0uOwx~#mV zTG2CS()c{Y67i^>dQoJDWPWkFQBMo5P@bGJKE!)jJ@lMN{_3X)#0RHDAH)oBf%WRZR;X>DLZ4DZiIc=Od?o z-Nn9m9s##BFenab)-%uAW7`Q z5sWOyoiJO`PjOr>YFfYqa1fuqo|wW@j2Dm@NzpPSq*GAE1Q#TBIKF%;Jy&O1<7v^~ zzMT5cmo8@;-$+xy$>nD#FZE0dBP1hc%EkL1necj#euvGLQZlwR`$=l^rq)_8y7|@x zW;vBKSPXqiM|bXqo<@YADP2}99vD0L@W+HEoaCMIbinD`Z}y7Q+mxJd=0A=*6ct^N-r?sH)|;%&t3z)iQr!1;E_Tz)_^(&F%t#pu#ov5@?O9#P7l2Pkk(Jl{ zx~P9|x3h68OpZ*Wi=?Do@^AWn6ERQ_UL6KsY@tv^@xA(e6ifqirZL;dP5KA6aClP2 zK70Kd8W7uUaVIB5LwTz(Ge#>6?3g>zeC`GFPmPV0X4N~+mkN9vy4-k_RiM7QwfnfQ zOjk~Ax_Av8lBh>2+)NHWQtLf`CoOxA~97rV9=#F|gV<1K_ zTFh3#8YChsAX4iIvDvFy|>S;$@-T3r88Q+ z<^8Z7D>h7PYPnp&LY z_vZL#H+iGUM(KnKExrm{&tmU}=Tmx$E{`wzDg7g0?Z&sXRvQO|iym9^I4AXL*>Cd; zk$=3UZJ^!wMrouOy)T2ArK>fN1ARNwzM*avagLps>E(oa`ry#Er5@$a%2LVGDPyb5 z7j`hiqQF92llf1K|6-{6y&ZLc^TfBi1pH&XH4^Oz(;ah8=roodG7nl)0-FWh7~}7s z32EJsVQ$bZl+YyQ8(jOyA37&Yb|bRo3cJCPr!|8^5Bxv;)IJwKnQq#s-T>P%0wi3`Aw5&n+=;?zGo_pIDeml})A+6qS45x=3&sjdZBlu~9%qh>y)ILm- z$;n}^85)=0)%hVWa{ZEA3ESJ$H)f_Q4cT5E3Lnct+WYFhoary+*QGJVS=;~aFeX_y zXjfhNH5L&&|J8RuCS=CY5_^)k$>F>_=G(&~twc+6+LV%;=1v3EDF%L6SwoOxm1z5d z*@&+VSvaBk%*BO109ZR4qmd36&m9NLy~qsh zXq6@K^YR1Fn%Lc~D-lJ{m*P9I)0Hi$+t$C| zt|awDnG0@A!A}V}*Gkz`yo3ptHveTC7kc8H9})UqyHs!sr=I5V1#eGQSfVPZEGSPb zMTjkd6Sr*;8=so9&NT7-G@0YSUt$-yw!xjVodYy~!}Fz!>x7w@`;=>9?3@96YSg(S zb1#zpWqKkifRP61Xyfahxb&=MDmh{A@OfOwkSm?8z)a^0l?m*EOETrNl4FVI9@4#v zL^44vp}1vR&)lwG=9>wXy{S=oZmJoi+`9e(-ytg6#MO#QBBM>SG9+kB5-(eCA5J%7D22D6T)n z6Ndt7$?!A@Y{bV5Tf5|?!Nk1?91))(ozj7>Ssm~OtFg~R1>GP*9NxdJ^TS7k``l!EH*k!s(J~vEN zr5kC6seU38nbJ-XbEE|iH9ztgBIM4`ukXn}DUhcxM> z3xu*GaAdT^(&vqY;BLP&h`Ezfas zIaVr8)!Dmf{qZX*dzezDVkm|!megfRTy5bjM{uw$A2;BJkL@qnVA`$dXqp?R{kZP9 zOh7|PeNDw0i!#%#p=DPT+vdox3wD;Wfj|d0{i(XDD&JSHQ%FHNYb9K?_`9OG+J4E4 z=cK+ouN!Q2?<|pj7P)(7k+wuP5I-0SnTb8Vy1o7mODlvt>v!*)eGKV5kKNo64?&aN z`eDP1HO=jo`3+}O1be(}tqa42!UeKCd!f1uz5PL+9WQVBC(y-(IvxYA0a)`(c`Z@1 zwcLZKS*!x8mdaVC)sU8ouU4RoL&+|U@h+cjgaE6rS~KmzBykMIbmOtN=(1ZGq3Zfu zrVo2!K`!smFM4n#a4`Yafl1H_9t6Z$>73?+N87D;ncHQV_}zplJaO%ISAzlDv;GZY zQ}pGlCN$E!1SCtR1{Na53A4mA5>6D~YVn^P)*O+)CDb>W&N{P4EY#-4b%&VAxK(BO9I=K zatohWvok-|)>JK6D7Fs6e8Yn+*#^y?)s}KQR~>|6I|7fo(YV)^J0m*9?>Z~FJ>#jp``RtXLV; zmPN+*u|hxQJ*wadYp`we1@rN!ZbcmxY+KzioNB50DYmdo{!FM}qN!|JDocnJ)Tcz# zv)Q%a8!EiLNHS782`fVfjhL!x`|8Rxo~Hrc2}k1hmXM`T`M#g=D0#*d z_pC}g!TH_GFgIiceDjW^@h^8Q33S!>=F3>vMF%r4p;j;@0G#5RsfBiKa}{ zDqT7lJu#2JjxsIPbD*=%1?G&e*=&`=J<;cuLrd)i@exa(^!;VH)C;y<>EL!}E7C08 z|6U|oCRjGyu{$E=2f@jY)6E0dO$*R{Q6ze<(fk;qN5e96a!vG7E!@@Yp+DNZ?BzBihN`aoW8 z=95T+tDG-M`r}#M>p2V#+~WBsZ#%NSA_@buB{gDL{wYrbbFd1`j)(Ggc3-=BDnuDm zKv(u%OhR-^;jwj|lTyBRc$vh0rfSHf)U4eaFL|++Q%RzvTB&$uFvB4);ib+oRYmp7 zm#-2*ypwoBsW2Y;inuEU=ieliD#|-_c|Rn!-V=;b9H{1jPFAxVFOD(GQ&+Mm*~fMt z*tW25*ret$TX)9j1B>n_4c^{))J0{RD~Wm#L2qR3jGraf@7T6S{3@1N-`g}mlw-|<~DgV~@S9FKtQ4|Z*n*uh(+bYRY22$kdZ0&Rf zTCP(E2soJ#SkoH}wtX!PFO!}~Egs3llIZJ*|5j&T+G=uLG5|WWA$cfBU>3#vgcd)f z6tAWhb2nhpBCGshm>-7S8Y+G$IB-gvg@*Q4nD*SWc{-MS%w4k$D?Itp{3dix82BQ{ zfuRUGo@@h5LwFx!Ps$W2!j-T$y){@+UkQ{>DLuNYfUgCkROAnbecKDz0Zl~B5nB?+ z1ELl3MCkwS#)+*=xdF+j2pN5QEza2dd5}%3dWnSd4bw&_ER-jX)-?V~J4D#0yxT>! zLgG6iO32&zGi`-~ku!}clabyM$>ljLT-hW<+2gXi?y0)NR}7J+m8O*2*OEkGhryY( zv~Ck-nA<=Gkt24NE$%Uumf_XP{K7MCiP646pI>YgE>WR5t?3RTVK?&%GTm9$siuG+ z;i7auj5c1!q_n8Wd{0e1>L!5hRhSLH&L;OB(PNu$+Apxid~D%78S}<`tUo{FZiC8q z#fPjX7jt&s-1mLZKfBta4>?X-A1ZNcb3w}d*b0L%HqNM;4C!!tQyedHFwg6&ZB%iZ zk<7Gw!~gLAMqCbtI(NIKKwd+tE%5n|ZPMHQGTJWqzcR+Cvz)nez)F;JG+(Z8+D51N zEjp|iN*H&hBkG@~X2Rp@&~8%3uVolyc61>7#YL4^O_rz>XgBq0Z_>Go6J`@!KQZn| zBXWScjVX@v&;0KR=s)h~qhL&Vx=D)|h4>OA=oBqzto0E`HE!uX>biMppYfd-hX_^r zVTa~1i3c6FmP-bY*#G_fFMJ!{y^F2_B=S^~2a?`MRD)VA|Hjh1(uSUU#%tR4CJ=p! zB9mg7CTi6Iq40i2`CO0+tX^qB;ZaQAC|5BNRDga@RXCXb+TV?xk%1781TfpHYCJV1 z!{&MgG^5e&MVq(NJXeFCN-v8}giT7Axx#N1oH_&i~whUzJtms>VHbZhgyZEJQaPO}JQt29`Zi#TB}T z64RF^9onqZ|6~B9*r9IhftO9WymROsbZ0QM=;X#XSLGdE!Bv2=GP1vJD6OKKWh_)A z-rhAK(3C1(A#Jg2+CajHFFe9djV5A^-0IYwrz(izFvs%zgy$h69y8h*Z~Sa#EoviP zB({VRr0o|t`ieXU`;@#zzrV)%fLnWasq+k?p2(_KBYUg$egSb;H3ZggS`6hiL8I-r zNlM;iAGW(iO+V7gkXq9l{j^`=&&)U~@b0|1{`3ukwm;7i#V~(3<6Hcn9u)WP8hKor z!1Qt+ZbClM+E;7)1wW|R^;$W8&hs=+dY79Y`Sx!ZK@)u);I)x9H(ddKjccYL8?Q_4 z0=aDYF8or3^TZYcP4Z}7#zDi-)VNER99cwdMDnaiG5*Z0U>gL_?# z-pvoC7_t8HIpM2KbQ-H%>~ch-xjK(LF9#KyLf3xU=cAklmBI?{gIS0ZG%``IE?P$< zHG#}@LRR!mO>Xh$CfQI0IaZHk>z%F7C^a%uq1W-iQa|9ifeS4J4b}AZ5~Vs4Mx=XC zS?DxhXXHV}wOy+AN(F?1EfSC4$`ll~>BeBqoXtJMZrQd)8OmB*o%I%!EXVP@PW_b7 zHMq2h1?Is_7c<5x=;d#(d2wGz1Q38t^qISe3ePS1ibA7b~@NbK!4FKI`!B79#a`N%P6Ch$7H zhT4;?iFnWY%L!>e&ZsVWZ39mJ4s?w9p9;}MBzD#VoqhEci+8mNet17J)ahsFz;AUih_pxfWBl`1RU_*! z{hqNd`8GF7<+Aab?MIlwHkX=U*4RbHVLYd`ALU4+dx5K47b+SDVQ03c<4=6_a#nr0 zSXz~C7l2EFW6sQt`ahtsHSK11A=!u)@WBCBIy=yhn`Dg&y2cx$lwmeRqu?u)oSCbz zIml+n>7rksQ7Z`d`+R#kgI=fJf6t8gujWrsS*0oT&pYO(>QEp%28BmvU0_}4EQHaH zQ0B9=gjGT2EziZ3vdR#l{7WLXwAcgNAp5g z)6F&aH=#}K@u?%Oba^X9<5hrR)a|&@Mqp^qE!CJ17P?|Fy3aTq;t4-b+2<1@>g`7@ z$1>y5!n){giO5|h{AKx>bYu^7TE@AG?f4fQJx?bT`5TY8n9t>}**9eCj5bq+USfOm ze>}TDo33qYX#N(bL_Cs4tLB$aS0xtO7C|WG z5?Es8DorSCUzCoI<>f#OMI$w|m!i~bYQQSLyORUd$6ceC( zz8_Kcx#6iv8Cg5#bSYwer1r^g&lH93}WFI?LU@9r%9!bA0u$WRecm?PU+W-91U39thVQ1V z$wrEBqwGAD1Q*?QCW~8OtjZtYC1tbnK$QFr47xnIpeO$$jOEq;l_U8Pf3BI6WpyFc z4zYgfrRZj#FD7QKrikKC4a)d0DdxlZUo8TN;N4u?yk#m|Y)lV+?pR^-+T7f%V2GaP zXp2|T2G**aJHL)%-A-kprqk*1WV%FAGmr5c^ChEc`x@W2h@b$|PU(`QxX1^$^tJF? z3|IaZuROv0RswNAxguj`V>S0nY3KpFH?ww$H7V*W@UmJ{3$HUHHvxa5Ln40_>ulpY zFE#gO2&1B*$eNm-5RnA;_$oiJzOo=AR{f(l6&F?JfoNB1yA@;PZTRpsp?ym?&{K-y zy=AjIIQ4I;F)4dl}*kOXe!F$CswA>uz#npvkgAwO93VNb*xG6p#V|Q zEtwEg*2Ci33THm8dEb)}`gz~swrtCFksdK-!^JbXPMXe0ji=d#eED2^9{I~4^VW9X zG(lw8awmF`_?wkFHyWazd}3p*H;?`3YOlXY6@&p%IwRrN!boH)J9oAA(*ny6zAMvn zKb)F7V8^yob>4U+xlA=9H*CsNik5_6ChpRT@V&oaP$>K))L6MM_He8pw`S}7@aEb5 zdyoH`kdj7EdKu3({z6QlLU^z8$6^SCI~!GGpTfAOk+R9ry8gRhR(+NdlD_Vtuw$B< z&cu8uOp>UF({|*q8JF7WD-$=tzu2+;_xfGE?BSM2XmIjG7^_6qS|Wa6?(3@WF78E- zxvaa%t0BOps73_gSXpvA9dmd!R-nIi*xU5H81+cP%vSjnm^H7BJ-uJ5C_M?$rhl|U zOXJRHrn#CjB|h*P(RCype~u{<%8xIpIGbyS-*hGOXcVa?_<}v!s-DqRE8VWb3D4&S z*vaQCOKAMCG58`HXa&a*BXa6)DTqEYPfNjpDlN9{ruE5UA}G}j z%^*px&q$VLTmaGQsV8vvC}XH6H_#sZ%gm^XT7WueT}_UlM#iLb4A zP2=;ga3T)>Vlm|{#U=;OJz`(X*XaVXRu|$6IBAJYcSpcF57T;=5md)jXiCe}jf5~a zH>2(JMQ8Bt9~BK-fkx(^NltUy>gPYV3=^0iGBX~k&)PBYBg&bBu6rJ=5Zj*InG3xe z5*b?aTx>WV-Alqk^G=D~_i|jFQA=0Pasm_u^~YABZdFW@!`g*J3hThdaN#l9MsH9!09h zhG9vB?Hf;UMl3MXsP zSyMfNGX*^{t%UVPi`}i3`qodDvU^h-h8Q#L`D3UE-TFiSunk}5Z&dK(oGsUGZU>iM z>}HCJDSw6@XI34e275#=y#YUTM>C`IQMG6rH2e%LpD(xp4K+dZomr>rm5Qe)HJxmg zBtfV#2|~IBg12o*t%btojxNFBIAY?_ufa;K@e{53+jHDsn&3kS)t@o-AiGB)^Q@0F zqOJayLP#jwO+h*oAb1i+))lGONUD+c+1R`imo2TP6t98#+=fHRE2alvJa9s2OqDLJ zz6X3vnlp8Y{Z&?b`1Q}yY~WjpqvdqnR?At8*<~3iyAz}boHP5*jqeB++{BG@gzP_8 zIQMp8R?EOKgX5B_o2Cgpu!9qje3OC@WFY_5XAD4&{vfSwZ#Sdv$+$J43qd^oXMiBr zB_ZcQ{b8kg`Ri92Z|#EekjAT=o6%Ey~{O3=igw+1Qa@yftULP`7o<~gVKsFQ? zyVN_ya1}?P|HIP6?tN6249sr(B41KMWxJKSG}4E@UO_f5YE~{`@DI_`{l@nX&-2W) zUtO6~?>?93;_0)bubhqWvXwx$>1_O~4WO(;a- zv|YG4F1*gY=@B42GWwztBUp41S%~((^}ZpoM{_*$H0br7B5uBN#!An%ar^@={7aMg zvi*MxTKaz-1@-?!pikBSU76od@e-*>t=GJ_>ev!-$Q!aGbrMe=iM6l#Fa%IE9>IHa zfTql>9q#pJ|2OH}BXe`SbCq;x71aY1n13=%9iwE){qpMhH{m%+N++fr^fm)flOl;6 z_O-l22;3wc9E?Q4=Vt*HqMO$vLxg`Iun_+^$(GBcdLkHdqvTMKt3}BXub#aTpdhi4 zPfQi$jR&G*z^OV;kaUE_w>FeQiRRy{!%Nu6p5i4A?6-}&-$szsyp{a}U`aG{t?>V0 z)4QSPAey=r-y-99dmFa!J&!avd_ku$rp0N%L5XdpGOp@!kVVc6NV6z5+v@!hfa{l8B2Bz}xAq z-Hc}6viPG=Rg=(A7Y#m&`h;V$@5c}rfR=#0HE|8qLi|iDw$qH}@TmM&sBqvOAcnXk z!!z&QX8kU~`%xQ_pdQP~3i#m7!SvvrzOS=qt>tp1?6z(nuH1bjC?I*Y8`CeI(cok2 z8;p{ase6C1Mp9D+nWJy^!nt?61F!BAoT(;eZM+-HoJhf?buHDb{To+iu3g|3x!tj= zvZh;|73k`MhdGxGo^u>fs~4RkHxn-A)OmbHAe_DHF!?p*L9y`ueAz)gf`0uh(v_ST>H8p>9{BE}lvF zHh0bM%5w|&luZC$-+9TfGTLX`RKS%`mgSh{(J6f<>@j+XjD4VLS1F} zw5igc_~#ojCC1A_Nhj#O!=6QlQmqzi{1J6kojsu*)k4i;ylKI4m8@Dpd{V=Z7!BK8 zLmS}FTO-FERyAU=U? zZiyc(j;+BTXi2;mt^Y^JmU@hil=eWJ8eq0)u>wTlZ`n`BlMu;6r+$DX{dFp<{IbTH zP%bZ;*P^G?2DoVC-O%_HjaH~V{X=>_)CgU%iNmtjwh#ey?jVSmUykguQLO<=$)7Sc zQDopIHrhPppZtiVLlZzTG#+`@w(#AmFTJM#j)a zUX}}YUd%w&EY=$umhk7tBel5HL(AVNtC5FScz)={AGy*JBzpqU`o2yov8PQsrW~?$ z2`J6xJufodmv$+sPrA9S1B~C2s}>UHF8rC-r;ABP zh_neFKt-DEUK8_hCb1AUR{He5Nq;eSwYcBp57i}Yv+tKBR7^gG`{$c{9k4gYCc!YI zLiCKw)C-Hvn{C&`i_ZCgRQEL@h0^xmOg4>%90-V@o8`Ji%M&f-Uc`rqaV1o~lJwAs zO)V((ZHidJ)iOe$e`)?0eihhR38M2&&xh^csvBM17OF;(zTfPuvEG*zRwK!OPkwEQ zFFnm_&%p0ZrSLgbN$nZ#V3|Q_4E<}fg9A{OD6;~ci2%{C>^xi4T3UaJhb7<7u}ZkP z9??`BUgarxs#Uxp9rt_S51}oJmqBU9K1N`AIa8O^*C%LFq{Fz&RGl(qIsPJnxvQXM zu+r{_N#YdDYUJ8+_b-WLuHQ~@NH=AF+Ewk3Tk*p^TVS2YX8W?fU&Z238lu(I)fe-q~swA$K*FUc7?i*qFS6N6ie$v*_4>!y0aoo3iOhx8FjUWHSIfQ zFr`zB?+`BAhH}~wEeF43&mp?GXDOiwDT@J~T)xTnrZ8fobnK~h0n;31t=*1(+Mv4V zlf1p;?d$72Q=Ly>_}(e~vKm`_N?XPo3=3+?c8zQQoo-VP2ILQx>oaK-RR_rUX*rm= zVOUSYm}%#isQIdJpYe_CZMFIb@UX;e8fXumkddtL6owsu35>3#uGHH~d!H1QoJyo^ z2;>o~f`5?_((~jTrG*;C`)H`BS%>}$Snz0B0M086MHK8cBfadbR z)w#jFX(2!vK}WVy2!eVvurKzReb3ZstS8)yk2%n@Z7`*i&QG#1YjF0p1Z*39?Uj*y zgwjPBwz(H$*a?)Xh%)R8GF!R2@fpkF&`7s?7hV<5?_wp}rri{s(9xO4zZ!^Cg;V-- zlHVCb>otF3=+6t#9^H_sO_q2;gx(edQ-3@HYVBoji3Fwe((1gNUCo=^)uwaAtw{)0 z{oK@#yA97I51m?5X9fb8_!FL3PG!zRR!2sw&M&X9z&Z8-DD7O#cq?foT1glG&;nh? z&FpU}G(ql9tZn9!eKb738mTfWLv%H7e&7b=+fX)B$9=(+I11^!j_Z`aa&xdHXm&2h zh4ai0UKvnZ!FLEMoQK7K1D_@*$Vl7Jr3A{RYR8SNVr^^QPU4oHa76`j*KQ~8-8uA* zZaadpwDeM6Qi5TgE>>Zy0!)(kzzh^6BxhhvYNPSFsde zJ)IJZEgi{fz~~RSNIT*W!o4211j{{4D9+Lu#waGR#?$3+h%qt#93(*uNhe~n#%)E1 z4HyTRwi}F1KC3aUh+B#wx(czyIbrha1kl$uq?eo#jc3du6OCducsRP9T4{|2W}Q$x zEU|elb|^?kQkm&Y1Yir58Y;>$rU(MluW|{$P>emT$$Cr*ynH#cKZli>_dCXWqh^_L z?oPc2QT!IoN59@(BXP}qW|ZGvx*RxXHG54Tn;n>&{)uw6GuMhP|i~eG(dXJr) zx#ITIzS#BDJopo#4Kt;Gi$Ov9ax8?Fqet^V7;^EFN)p$ZhG-i_IuW3phr)%IM_%hS#bMr)Q@xR28z$#&;GTK@Ye*Fd55ZVF#MpRsFryx34~4=kmzY z%xA;FtJ|M$Zns7zTk%O<<6^ny!_dDapi6QP>fsMgk>!M>vj|4{?loAIHtS?qruTh(yVrMMeeptwkyKHP$8Ow4w<K`OcMUh9G25=bid7O?Fe#J!xrdpX_X>eXyS`BXg| z9dnxw8?C8xcdc0C>j5VX#|J3QiLk*xj*QF?Z2nvDH;*9I@A)%`E}D;HH&76s zqsbMmzU?0FXZ>ir|9EG={`0`Or9J@GmgU}sIhGnuu5u`El;qG~Skkc7#v}K%Hnek! zk-(i%G(Zj_zySd((r5i7^|FRxilf=v-s|T##jJwOrEo<;UIUhjV|y*MZF^3biK>T$|nOoJLeAXj^o#K3#9dSSPseC5r1f z4nwYeJn%7ec_)MxB9AI;yVdnyMv^4=0N1Zs?)Tg9I&ZfafUD`omqoDGQRZetp9^g- zA$!=t>~}NCiS|PDtP1_{?kD0cl;5J$2EVmsAH1T8)4~FWwvZX}<9hSAP=+1xE;rES z8jRQoMVB4aqLN<&Jul+k&;sl;hUFE#y5XBYBgFw!#AP4K%jk~ex}eoX9^ed1vNhdW=M}xEp~v!T2Hi_m+X_JJ{zT|S_x#~^Jo`|Nz%sE))|ni5;+vv ztpY&HsGQy~B-XCr?kX5QC~|^|wx=9?8cMOXQ%3f#L-zm=YvL`51btA-0D8KTxO5fi z=5NMJSK47V+yQB}!_skFX}1Gz{FPjxMy)Cvrh5bCLKy7cIQ2SjoUwN3Tf2Hn2&wW% z6eFGT(1!b}vrnE!WZh#HlwAb@Iz^dV#SDNtJJ@epGpE%O#81^Yph2kYKtWW!(EV@W z={DGkWSgOj28wQ4XQVxg8OV+&*1P5xuJ1sPs8-{j$`95C%4UiYJCmtbJu!QL=RVl6 zJL`)95rr6kCwg^CB?sZU0j#^ zkyls!{hF?AOFL8oZ?i0=mNmAr*p=99_mXa%mD>GlUTwh!f?%Ymy5z=_3LB#h632v>8ceCC4;#N*STEmD{(^)-gMhWHJ8KG;z+7ccl&w zAZue!5n$xeA=^V(92j6o^21(et}#Cfolkrke2|NcmtvT$*QEa@ZRo9)xzn#8EWwFt zYUW;J;;8p)+yLSJ#CX$n@P{9FGBx0mmOIZ|_5D@K;CBoPr@msPloyTfv3i;Ak;X$T zLL(s@sow6MN^xr9Dun3s4LkJ4M}<$9rW}_)?i32#=n_prrUcg_4g)sj4B z6JG;rzUn-*+AeLei7vICW@tW1&9Pwbx78ogp$PsOnad;o68_h`g-nHyyP&xdM}&Sc zC!g`}DR!Ep?89j6p=v;%wxkl#|BkD>&p&i)2q9r$B5f}O)PZ5SGp3Kj17kB z6cf?FAG`%4Gmc;ERbk=7y4oeWWAXYdl2?5Chq z%>xFt$;$W;q1(;QMeMq^#RiJP;AkGOyOJ7?A%(+1Y|JXX2UY7pNWi(+fKf^`GBU4AO(k z%z}dfSzb-U8%cosO&a1@8W&8Xup$o7h~DhiueezF zYbuAkxSTgEdF%HnyB7l(ZugiJUE-S!-Lh+GlJ3(56p@JN(ybq5y(8q?6O|-HOeH2~y$@ZW3F%QI_ zU2GSiuEck$VsXdVgRF1-DaQ-n>WnszLo50k&k?4^?Y^r8qb`RKw^Y_9uoY5ca1`;F zS4GO=m{dBvC^CNV6Mj`3BgS=-4yI6Lm%+rM0MIa zvCB)-P+JTw)^=%3RLEOKpr~TWlHPw*~p^Zdoyf*k*I`z&(#8M`HZoEz)pqS1E zbvw*&%mgh-i6Sscl&G1pw8zw%E`Xx8e(*t!X?ikE)up9m(SGup>dfOw z6qKBJbovlAFv)@;XowIk(LPL>e?U>pPbFA{E1+)wB~iY;2}jFnn=c~8(4KnuPL0h& zjFJHjx0*%!@;MjSH#geYp!kt+FU;U#>e@GalzB|6L=?e{zG_FkLLFDOHE763`ma)u zl3!VY%;%m|RgDWPvUV!cML)!~qYl26Hmz?m-25MtR^BE1}4TVQntr(DfOhgAYkJ@v`esL z>xy=)Az@Xbz&{846r&QiQb=tKr_^xsgZ?2o^po8x|q@2SuQW?We33BRtgqy90-OTc21AG!{TYMesewqw;@LU8s zE)IHiWc_(c8Cw?0=g=snraDVSrTzDr!{{3q;lx!$@u}GYF@=h?SI2eVhG0Zz+r9K} zGmz%odH*@tA>E%l8z*NBU|7i97JuG1|LBIJx>t7%DA>-P>`XoegEmo7!-ykssc&=h zoQz@yF0{5r!o6WKzU}x^iJLi_g$`Bd9jqFvf?&SvisSh(#XmJz8Pwv)lNB;`?C$*gbU zySI5`=2=Ztbae-?kw;wfJec5;m>7#tE-hX)dbYCcDG+s3hP*F*Gr(toxr0QVisE?P z#4+YZ z;iO5I12#+Dhg2tND0ovrSA5IjCNiF3#0%6ekapD?VqII~_~(IfhIm3-ta}foPsSC$ zhu?eu$ordg$?rS3h%pC|@oH7re5Nbe=L{E9xI?)p2waQ(p#-zC)^E-bsV7E{j%)hX z(XRZpzShNY?b#}zWrtsSI$AZop*-X{V9Co$Xtr95x@Ec0njljWK9TIi-Cdp}@~Z3M zvRVU3XFE|vh+bcFdGqviev2JXQ+KA&Nweqiv_OCF!|mxs>Aqjh6*h#exE>i=A@8b7 z10ts|edxDL>aE+k_~{=x{WeWeOZJ!Me9ZMNux7WRfCVDn*th6=KH(!Y#n zw3e-q86|c&lsEiE@2m=Ld0e7!h36()JRF=>%;@Lz&dGaz6F&c!m{%-fFHWZd0FzB& z)t3f>Xv8}vDojExX}9&yQad#lUq>6$A99B+fiS*wa=mX)27L45jOJ%umZd<>Uw05v zBkQ(uKMRwoi&@c94T=5Ll7{EklEEw|G;Wv5xc`T_w~C5$3)(PGLJ|@*xI=Jvf=hw~ z3+~cDaCg@b+?~cPK;!NjoThPicbBH2(IMyjGi%nGi_wd@?bYA@q_(_OyXx7#_VfrH zP=o6Tjq1m0#nmjISTPPUd-c6qL$_BFXwo{SEDIhB@pul(wjis7Tcp~i%f-r+m0fHZ z-=>TOU_a(z>X;8+TlbU$fI4PQ`Bqya%NvTIr=>-;WkAm8wx_Zlj^%h&Yq^Q-dNvZ* zCHanzK(!R|QiaNspse$j%AY8n?83mo4XLv^c{<%I zP9N}93ml`{P9B+UrrVYI;){^r5XPIO#*gV%XPY3_zzzG5=5`2)aRkW`u10MH_=>KK zq;<$7b(?85XlmurKqfUTfK5f(4W-dtp@n>P4~O&XG4neMG)VHQ_zov{`C`MD+azgo z?`XS5dh8rfn}z-8&fKT(x}MsawFgd$e`|-F-k}9fZbxit`ZAQN(sgJ9AAZ_JJTEnt zRU%+*a~JMglQV|SE(CTkld70bvGi&IZNNLDJm?q0R(lt)w@Tiy@q3i#+>DGM9!1_~ z=N1;P5L;G_(5qr2Pl`i2z`#|W*zD-yP@2zXhPRBzQlgi5?1pm>+pDSIO;LI0oX-FX1?qLAELRq8 z-dZs9xO$J~$WKylTDvr>QtBT%WRZgtW{OR{|VpIlYJ@Z)D?iK>AAUYYJGw=vW6gO zWCNkfwVJeWSoH~LWZ#5JpDps2T_yE%`I`pc+Kz9Tj2s`js?!GJWbqw$sF3z_B}eH5 zNEDt!cQzBNajPvAI-m(HF!J=!<|GBC-`{)nS0Q2&-X`alEhoyXA?`=W4&%FoYO0`}VhPoQ6hqd{#d7)ZIa>pp;LwQ&$JAjigBv2C z%H5qsnb)z^=|WmiXX_Jc@Us%r_l%25i+!*%16q?de?>M5rY$rRt)Rx@Sp6We!*TfY z&#=6?^nPd4qD(ae_i(rIR80Uhcr<=-AqMR`$L)~`*4$*hgu!R@r zzgl+?`{;R4Xq(uwTz-}|u7;)I3)NkygrxFg&3&EMxgr-R<+9;(<&qz%%-CWcfJTLR z0yO(#g+(gu)}W<;4&gg)i7?r*8MYSVlhsQ2tn+pUAyMQe;8s_e>Pp^ znCn$0xn(}QOk%3O9UE)koqDDN}lPgz+QrFl^+eI&28FzITRWG{1meLK;- zddaa$XjPKf;?vLRhMBPpa2((#FC~47%EKZvlfJ;Dsi<>yEkna`CC;sgRnC12Xqxh z;sz+y=Bd!nnx+UV23S6+{quJ4!Vz9>GAr18EHybJYa*PcnR%Y(vT|mrA63fYn3W75 zv$+PgwOZ?MPJ0z`rOEIWCLl4lHbij8H%Q8hnLe>a=QVb0OrEJ&-DN>e>oKV_W&>b; zKE-Jbxr?bUI&+ZhFRCO#6w%$U@H=5Ir`flft5&yzOZl+lqzOR(apxNhe3JY6y&if% z81B~%>{lM^D}B&=TdZbz2jWw$stv!71Pl;C-Xmy7n;>~y8#A)`n@F zm&X0r>p7(})x3s|l{7v*G5Bv3o-$!RkG)*~^vdLv?l_pYb%$N$FU z*{ICoB>b1abL$uW|2388|0Eyf|32pDf7c)~mKm>A=kpD3sa5CSq@V04i6^k>OO8-O zM%$pG|Bsubv4lCg7ub)za#2%JNuXs22I0G&wUn3q4mF&QQ*y$k+kbxv*ih)T40s4o zOr!su;?0AP;wSr(CSyL{Y)bPNW#mW0z=VYMRV(@B)AX$2zvLDDA6Q1+`ivaVLM6%1 zs!v1eHm5f)SG}~FJ*e-d5R8OU8g(m0CVD*TH-(7{SI9P4NLT;vFV>+mLbClXAQ#t3 z;cv0#Ix8kYe167ip2}-kR@*O9C#zc*Pm<|;X12mJtGh$dT?R#cFYKfZvadp3wis9g zt#9&lnv)uSd}Z;!_ye#qcYfyACSIBS=y3IwV@Gpt|BEO@Vvv{>ZDrVt|3BO6D92E| zK#VfEo8q zuM`866{pzlRld*@ge?kPcVz;ZcYV`Cah%3p9=5|&ZfENloRjA>Xa~6JrW{ztN;ZHZLIOfZsEk+z0?|gg)YTi5!YBecm^D1 zKQ?05S>x0!7+2NL6_&>wnQK8EedN~5p-+E+k`-seqep3uu8inWPmN(HQIg{QK@=Rpt>WKKI`s3Y@2%0)&xSX9 z%KI(>zE&-2F5SfU9O!*Gz$6$T&HjG9e>t`2VwU)>5id#&%pRqnA+)@2w^E5=;eNw+ zS~DkfcvZDR1e>(0gQA&Q>1W?%iD>vrwMgyz5W ztC!LCr9A?r{Y#CF5w{&Pgfdr+%jxtW>?$nTIsCGJiD9&M@LOrGpWo{OCl$ZfkX{0Q z=D-lot9^ivz3`-eI{$68jTr733kLb8BGX&B&?y%B$~@i9Qlm;(j+inVg7({~%4QL6 zK(oEN5|za+cEtOdMRQ`jFTY}VGPMz>c<4iUTeI9EYc<%{Px|s_cLZywfj^9la>R+- zLxTcuKfSYfU`9BYr24u2o;B}Rn+4gH8YLGMS(nl)E@Yf8RomZM86qQ;-upA$Deh5A z44VZWYzWlRFpR9{j+RYKiq++L@}GA4LXkqvAyq|f+fF12U(5TLJq-SF{{ZG^k@^%cHJ$E;-dTE zV#NVU@v8%rzo<_>b#&B|9F0nEFQVnv)$umlI%39T;6mo3H@xiu96<4i@o@;bt$6-C z5uB5&A^bo9c2(R1rBpTd*uAMY%K-@=WACWb=)?frfqUj{vP z>4=PRC|(E;$lGS&+E;4cDCq|fzj_DXsd4D&D)mA^*)>egXE-c~ zW!{e~wk+xr8AV&eO^)7CX(G&Utqxr>EGX-i}1I=`@ZibqVxt zWxFK<+)fL`$c-6<>a}-UlZcm{49J-jM3Y&#vZws6elZb=6ZXC9!Wc3?xUmo!tg zY2-CUo3mDnP|w$LeCG~&H=sFMioEbvbf>E2cdxQy6Tq_+w9IM#Tl!CA=&28O+T?jO zQr)3!_KQCI%c2yHYmd3#+fkG=-=)HH>g6coBOC07jw8BLU8iW^ z2VpU@?wJpB0L3C#)!N4|$%zxe<#O*QqD1G<9rbJ0&LH<pn{<2{fY|s)D5~@a*GOw&^ubt#cUc zkAenf$xxLRwa;8$AaNNKxBN#RdF_Kyws5^wOSo_7Rz;cDn6VblhSpq2H6H*#EK*4}sd~cX%7*Di`~@oNS=Kw30+Cly8!{DpXkcWu*t{dc4g1ezT7A^yN?s$%Q(F` z+Yaq$GLuDeh&kDcWb{lBar#v1$ycRYJK>T_AygY$PeAd$Z01;o-lWz1)f|$H$=gyi z?6^WdSG`)*6DqdZ^uQ9)3hhq^Z^8^N6Xc%CAAX3m682Z;bfP1^e$aZhB)c?&Zu~hZ zx2Sg)!U85;j$(-w3690YMTF01vmSWx&(rO!>NCZa)`02r?!~+a_zQ&Ip218uw0xO_ zGJ>W`k|;{@`F}N5W;g<3mUw9Jd@J>GX2M4{b|bQ|PYLH}xHfBB_JR zUchl!GckQk;Ag^rQJB}m+0gzmp*pXte`Y%BW#4ongKbk01LSSSGS;B|3NO(dNgwIt z7#6u{&p8=zw(v%7(bjC+L9Q}$jQ1Q7<#iK?*BBsIJb8`@jA`E`Aq-#rqeOE*-9;v+ ze+g1>+o#MM5bnwaih5I7YZYWL4lrFV(PXQKDXuXWmXhdUc0LFYDy#?|HlNmAyH{_| zh+UNsRQ6>mC@fUYxmqf?(Np4l-Q@_|ct+Tb%6>_N{^f~Bz(>I$Iz)UtRBXS3s5n59 zMI~QS!W{VScKi>SEoR)sd}a6x(DVEm?LRr!xwiLANSahO%3@-5N=D6wjm%w|kkO3^ z+s1Qx37<^hy-ap5fWVWYfh3dy8B-$3xuc_3N_ekGFMp`M2uYD3E%1wc$C$4DixUm@ z{PUmUebi%N|Es89{t)qh)jxRXV58E&5#br@4&FwkY^Y*fkB^+dtl>Xp##bD3N{N~NO zk9au|O!BL~cDQ?faY(NJt1zd%zzao@W|`|MqNlt)9{x7Z=+u0_ay_gE>@I1CJI;rf zI}rCI5ZOO&v!I{^z7=6H`BO_YlI`;1 zL2s+ue_w1uA?$s;e&S!-^b@e8?C$166IY(*WD4TV80DDV&zUOJ} zQyHxBnoNJ5pahBUYN8VEtV3`c(WH2hQ;OZ<;r`_(-e|ym(?j*bLn1m5;K<+O&9KuZ z@_hK>+59!cbC!sbaVT$*Gv*?FWL9;RPamQ13KjT%LEip@I1KLIvnsY+O$X>eWH>>A*<*IhAeK)Wbi9^+WwJP;1v}su!xtwG%?@r#QTGa9{I-M zmCJ#eVhPa4(r*@V2eUJ|YoGn!P8{^m%t)}Q1u2o)o)UFNaDa98eKAY+dWe(G-hCxugPLW)vz}*YfYsF}Gy({G1BrMwju?sn_jF;}-$dyWtBqqc;BQ@O6HvZ}JYyhAas zl>*^FNWwbN7f`eVR4$rkR3!t-8W_xbtjwz25E|!hctCmKu0GVE{~nbOG$>!Yi;6#= zixCzjNY7B3^W9aY9QfJ$V6r2Qk*qylv>H#XsaM?DnwNR=m&KIwq%DT@PYs-ns62vk z^59vej=YdMlyxFfX)->yFZb`b&|ry9ncLFD%@Rr2iK-a%7hF*v@};kWQ7nn%wm!0A z5dCMJ+$XrxT0(B=N6B#Mu*j_pm=cwz+2zwAF}Tkmi*16ySNb#a=sqMOpc|~)o<>iW zzj;1`=QtA#FQ2Y3{!W}FwWwjGwN5r@u@|!mS#?DcL}=PQK7~3ZpMxhwZCh<#SGqxV zHnQ72j;g2J8*ET8TxreZPa&ui1%l0N?YqJledHA6xp?WeD4=|fcrTipe3yw=9n16# zLt@wI`8vmPAW{TPUo#4L5b1Zq`Pi2-i4-0$90-G9lf$JwDcO(QNrK))*?SJCB7e5E z)Lz8^==>=~%G(-uloup2#s6-y^{Y|5A<@MUoLRHQ8Qm*9QP)?%h#^!MX*jd}#v5!je?>%h4NSfB zV`TI7pK`gT&b5*3AXfa|>gBsxh_@T-4gPkQwG>o6fn$u9l%SKxh>I33vu^P8deqw) zZH06>P@~cK4tN+Y$*hh+^p?ontB=Vx?TMa5WC@Z=8UICtAaTgjdW4A0NSl(hV@Ib@ zh$m!1;gq_5^4IUYU#2~a7yCakH!C0fEm((5*5!x@1nVhR3>oRL{p)SvwuOQ)p-0Op0b#%(Z}ud=}X%%2<`mg~GG9}n^#+7$(t44f(A%ft7aH;Z6-TINQVjg@-_sl&Sg z-sDyyI#)s#T>3q)DL1DtI&wXmo6Kiq$tqn+x8)QV>KR0c_iu*#oh(xXZ2M3>K_3Ie4C(o*^2^<5G{m>73f|)L-WHI^L zGo_OXN2P9US>!hAscLYzJ(8p0L^wSP2`in&oi}Wr7!AZQ5J!tz&l-fONJJ20(UPqL zq9_#{T_dBbTlI}9$S_sUdYp6R7dazAq$$0{BFw!U>mR!H*S@9J%O}a`zKyn=+_plN zlO6j26qLe`81ye2QWh*J$U(z-Tf-;%p*~qrOOIlJIbM=a@;S`53d~39$ysu&xUpXJ z@ztc&NBxY|&^Q%6%HwG~c;UEC1l-Pj-WbHlBBxQ43yk@92`Vy+-iklOaDnyptP z=E`xxdCe6Zpe!P1cg%1)oUZk{IF%YwiZlniXWTb4KAkDNu$~aeyeabDOkAEknl_(} zp_8`9;zfhTc~>46p)0{~5D7B01qHxL`h9c5*>_brI;Ig3wn%Hil-95fzE2h37LdC=jY+S6v+WgWLn}az(wzF&Z{)eZyfWXXTI$LT5qo8bpy;!%~ z!Kjv`eS)XI^9RJbaRV=ByfhO0JUCnQpD87oHcjTrX-=a}G8~RnFZXl@O1f|~N1q72 z1*H|n3~fq6(PgPyVLMgrQtd6ODkd1EFypx0*t5gmpGl8=M}1vB#BH&F9s!hTcR)nH;6RBBMPfda9Q!@uT2) zY{X8yd5653kkSh$odYbm~pl{$_(ehF-TZ|u* zK=&Ct5-}6~=@x|`NGgx>LG8A|az`6RiTrCn009H7x8U_$5$-rYNe z>-EDX7o0AI&60?$QlK{%Gb>*OP!f7pBgL_Ag5Ex%s`M4((*b=S1zQ>BA4zVX>3Z?e ziH9R3nXn9_MhF}e7(6xbvmV8BSf^W6`j!D4vHROrkO3OL-3UB(6CpQxnE~I430>^H zz~_;*guS6)z6_j5N_yVw}`=c_uh?mxbc+F|2|j}EpM&37a?ku7}pr~b9zMteY# zR6p?F@dXbg#eQ+QmGx+0d!w+8*zB%!WZ0~3+O6D6Np;|LeU;Uf{OS@wTGi2QG!i%N z!paW$^Iv0hodcDhDSDJ7>>WP>jD8%=jtoQ2c`tF+A8Hx%=Dv(u42OMvGA;NO%{gwIgK{X_MMITmRwxQwIOm6;@Jv0=_y5_CSyFnr z!@<`gzoMhLE>sG(!w$*KPKoToc`f;7ZyTIrxu#}q!@r-dXD!*&w?#a!qUIwp=J#52 zA}?;Uc%#M#;EmCA0U?98`3l27j^XohTEBW8^XUKcVf+}M0wp!o%tLv{8Hw(q!xM1v zZK+s%$_s=$Ug)6zJ+aQy8`g5eKk8SPpfzSTY;X-=ljFrJ`m5MGKliKr8@)34e{x#G z|85)Sf5bW4^#7~lAO3&aV0SOU=nK$B!Q*Wrzop-MVPVYL2bRirehP5gVxe<96>YSc zywZo`dI8Jg*ax7ro=@9GikP2ZynOCxan)rxITpPnrE|3^KQWpy)YqmtiSDQ&`=G(# z`U9i2Q7Y3zim%Jl=Q6B( z%P@5ws4_a`aA8*!d46A$^LB_i5Vk@GzjJgHX%3uZW!;;|lHfWX4`z-*ue6{;z0pvl zw%AJ^{KI%4J3uPv%N9{_Mu(7%A4^1n?**ed>$ysqRYL4teDtH*ncVl7^w)h&nG&Pd zmJ$SX{geZBqoR4;Gi&l@Cp){3z$Tv(TkYeT^Ls=yKwpJ`jue3l_Pt;DqKXn9rfW6MO1K_oYmt3?JaGtrG~StTa2BZ%?u=|xU@3qefg{K8 zUP#Beuf?o=#!>eaA6HD;#%KM_erx*ro*|)i3I@Anb%d7VeePDK{-IDPi;Ls1bCOVe zYghukq8FTy*;I0?&{NNmP>W1g^b`bChJu5ZX8?C! z+tus0L7J0v@omL_%ol>;tkEX!{?L=P0Hnwox(>e|#8^wxepCLB#<31X*Ka{ed`48D zAaK*Ci6^6vv>D5_%pslai4YRyClN>8vB908*3lmL4ECul9=(kQI?nIczrP}o`rQip zwo!ev&L3^c#p13`!eRZsemHwL)#7;D6VcSVdUB0_i6oW5`+C4l1@5YeHJI3jot?uX zZUE)07g)*`h&pEigBn8WlxnNZs!kV^#XY6q@{`}6rR067#gMn{?eF+{ZjbBUp`6{k z7I6=&v004)zRN$~&ee3)Tfm0U+s)B&l>EbwAIQG0$LH4 z#7A1pid(cd)4qPlDsiT6%lC8sW~MSjYcc(8%aNu-PV;>BV{+CLW+RS<{q9JDd!qx* zD)2#*)5&E(p9VFN)!{AT;P*;ydAXsI0h9Y6Lm&bUX8&h_gvXL5m(pY>24j_l-K+zP zW?2(^BHlN9CQ4kycQld|K7Fyh^z$aTSXAj*dzglv;Tc;6@c6Txc)t~pOFjiy%$2m% z5<;CN2$sy5wUP}NIqN@|YX_sJQ)6LZHZn%`{`PRlWV|rXR0BI?hFJhKEGd2o__`RE z?4De%h>e!UuW73*@KtPlZo&oh9CfsqYxCdIk=CE&qRAbp1gJ}UYp=!=ezZiF6_LeC>x5S8Xntv(x69@4QY-TE1(>$J z9wC%!EckY=PNATefaN5wNxjvwgS4I#r_?f`MLTClMQ8T*^O0m6RCXr?0JBnSJ^qTc zSuC>M+8PzJSQj`$klRq6EN3GjOb7Hy3x?oQWt4Mcl!wR&OtJ8V3Ld3&qSmeT#o>wWXS&gCzn^Mw$+s*8%7W;2JDUfPTO;bHwre(kyV zj>Tq(@Zq)!>=SGo%)B=KorMLO{AT3HKtLyYW+`?}|!&*8i z(0fN$^6j3mGX^D(H~4mr!+4kOfY^>&>?)^LR!##_eqFIJk!q53I{g?=cB8posC=0} zDitulodU{8x7#WqqIL9J*Lbt?$%J$jn5U!TwDD&TPM6~fE9W$kn3_q=Q9YS>JoTKg z1ftK)=buz?>kv!s&h<3kOx(EJcFbo16D5~423ST)XMab(T~xP>S(M}=C1G{`Zl5H# z$(ZC@nntU7C<@8(=K?T?EXH^xiPL^LeL7gJY$$qEafne^1Obc+`}Na9TFeOm*K`9b zM&-LV`}i~__E8|r%3zgrXYzaJ&oWmhhX|hEM<E*MTjn{$9CP^l?&YY4D1ld6l*N z_#}t2@W9uejiZB>>|`a^6VxF61xvkyBV{C}y+6?;K3M zdLsp*7aVMaT!q<@3>1vCdDL=5f+V?3-1E@aDn=8(%l4UiID)C$Qx|#Ss#lEY7n;-C z`;>Dy4!q?A&WHKR`P#j(7DKeO>hu^IwfUuQSlT>2k-xbqd}?wQA%a0Vn%-mycT$4f zWb=&-Xpr5cDGzeWP-#a!kF{3#Iz2w2Qa;dQ@>!zV{mH39+I`Et*|i~OeyZOWKf;%1 zi`C@e&B=gHvd&h$?5JlpdX(_zk2|Bt@n9)^CE>5=Z$a{lE(*I@4&{91I+XDxj+&l1 zZ(@QmbcO5an|)C|Hiy+Ck8$Ph@_dY`xz>ZLPY5t~sZ^x!F#ZU^NkPHG6q;U3wDEQtf;5wM^Q6 zTJ~>;b=CFpNdmQ0qxOYz*3w#f+>(wYZ^VNg7h?OZSAi0`ozan@G20nmnJuu64dA2% z<^XxcLxIkeWQ3OU+j;fK{j@LfCm&@SBf7XP2S0;oFmb0-?j=7PcfooRy{InE3vBpg zC!^y0YgFRVm(aF1NU#S^_FQ+5^}_0q>#JOh_^AW!X9AOZ#S!gc<7gQ(G%1N?){|3= z`y$O`K7uj}__$;Ddv!+kd;KVuc(R?dKd?b(wB^!7dg=4YahX`=M=pWcwQVVE9gGQS zcT=B+6dpVX2pleSmxMAtFL4wla%8xUD%uj_v$`gSQacd|L`%W*Hk&=%jW!V|o7RVo z-*H`TtatPn3*;xXykjdqnxretoYS?wXQPL2R{k<y(ZgA*rkdS2rWEW(isVu01>y%*MXQ}ihD|=bN0Ht9 zUHpX7bjiuBCcXGoSk-2=3#ew}zN;#tr_gvlScF^m0aGUeiK@iKsh>7zlZ-&hUFvOf z`I3Fh^jsR00z;=umm@bF+C_sR1vOa8rQF5~c7PNJQDuigLoZCbN+@|>umlnP;v>Tu&+a7blywlHQPHk|M9A1rx# z{E<8sI9Yq$lE2S&B7AVb)8EFFtTJ3){DC*L||bG)g^M~w^ui2pIB zC(Inuyh0%z_mq*WC-XqhG5dyB)2k_#p|x_DG5#P82uU`i|F*`m?4pecYCxwH5DE}u zXLdJNq&k|#8TS&G4CZzm&$V-_IGuVwc8StJoD5}O(7qJGhWW#iu#U^}1%zZz`lCWhVu6PA?5(-}a zxPyd(XIX$Va=B?=788SwUL@&E7H(8tv$v)!!E;+m=i5<{Mr0r?3{)IB0*MJ#um>p$tzLJWv^f!#fjw`%Mza~ zULM{Wf4i2-G5NwyBumj$W5>nZQoq?f+hM)bmfePX;^E`SLD@n*&N$S){MoP)mjFSh zVPhr?oI$e%z*@pcK1-G^*PsGsucXS}QHKM>YfP@mtJ@U|BTokRgI90Ag-9)bFsz)Q zdI!ha)$bn)c$=qT1<5OF0`v7Utf>nMQ>6e+ZF0cdwR~&M{*X0!3{+L=!C1XEwibfl zy?Uah;qz6p-cq{Arvw<%hyKnr635?otVgI<1T|{~fU6+a-)@F)65iF*fCWO-?q@(P zSb}_(%okK25ph?lsT+1$wc=TD4h|oF>0Mnb)vL-`NQns_s`Wn}mEa3?h{T{JzIz!{ zsEwIm1QLk*#yzv3iOp~fdPet0GKVITmIO~XyazYio#HcY&fQJ&HcpPOs!oWrx|xwi zSDsl?HiOfnhD;Mt?g#!qdWV;W5RPOBe4Y-L)AKV`-XWA@DV59e6gqsFJ_|PSN@bKU z`)-Q=Vffu!&xBo)mERC(OA#7&pY*Ed8 zs+^W-t?1F@WX@s*9JS{q~;XXsprz?}YIR`2%yG1BX?4fu%D2GSEd(tE5mYgMwo?*Up>DdX9;#v z10H%c^TirdmlHma>#1H7i65#_gmc?$%>;QhJ@qRs&k21S!vC|f#UGY{K}+L;hl$aB zLUH=~WQGc5f5=P2)%c`B?4e0Vuo!ZiuNPj1Ldq9duF<#+KI6XFv=wmE6G=_ykN6tG zZE%+=f6S=KM%G<@X zeA#06#twRu?YPgYZu`xWN_|&*+8&$5ovnI&C^5-b0K3qr1CJJU?$t-{;6dCD(c(p^$(PGKbvPBTy5$Y`WZl4gIq; z{vJTE0c=a%6|CB!|2;+gghN=v?@G>AqHk7gJAdZD&fnKsk1e~d2!GKN@2al?Gu+WJ zwf^Cg6AziOz6DMxH(Bgs0Sa$B=N$K}R$ju=sX&5&^-dey32BF-4zrJ4nD0^b9is91 zpFN^|!4g)5m?)rQGo&cgs6k4rFWAP&XkRsD=yQaLTP;m*GLACe!}lTIwv1_wZ{yMuObqo?U08KOna%Dm2LV`3)%8hxoomAbNzzPd!m%uIj=rVb zg1)v2h9`Y(9SkS>uf5-KO6q$ z9b9%55f-6VjM`2qliP7yK_7V)dNI4)+QU&8fo>X`*zii})j{!E7y@!I8(A5Fqqk z3V#r|_lC`FhQ{G3ieUWPoqa8pEx}aepf?d^u=8d?>D>gAnGm`=*Y0mCuc;*kaRXHz z*X6~uaJi%AJ!FN|CaaG=gm0Xdt|{>i0jv$GT~)Tq*&M~UoBhJai>cjiUQYYKjGx(F zpOrL3?{19XxBbW10$z)q>~sA?yq`9m;3SU=G_c!oa$24hp|souw9Ry`or~gtRMn~| zGq*oYoUKl>SReFN<2 z4{tVffEH$~9G^sscO2(>HWWyD zvMOL^Uv0#S?3f|w0X-9E$eQgpWyL#Sh#sF7T)z9Zgx*w-R-C7EP$qyf}M=1 z-EJybZ7Q$FdxhwTgs?Bj9UaBAxvjGo^Q#7`A~I7`SfTi~kKfN$lMBJx67U$Im5=6IgxU~lzQ^!_l$d~Rx4{c9Euu#@S)p-9%)qXg^)EH`f}r; z9mm*cB9M};ON1cff`qyivgVX&So;JNTODdeBKv5JK*vC%s@h!o6bECOs-!~mc zsQMHGggkCX`vqaK!>j6~hCLxp&D%@PH1d|Lwbe3nhlgSs-aWHE7Q;=ZBmys9e1Fbs zW!Lc6NnE=XLXovq@iGpp&2M+Onp!?5^jsczJvz>wjBK|Gn4TLMB6`*#{m!e2Z%ayd zcj@Q%)qCb+HGVtAN7ME#sud$wsjOIAX1!W1+6YUQSZ=ENrNuFI>k6A&<`amTu|i|Je4_j=#Q0jIlHpSPmBuuGBLkc%*}nni zC?atMyqd`)d5KtPC5|%4;^nP(r-U+qc>j8F} z2JwdHqPtSqLU2dDtP#>1K^%85F6DwXk3}I(7|cr->Vnp#hf6A;I8t<*c4-*~YHv?a zz$4wALY&<)Ck^{PO&=F}Ei5K0&n?2dFqT%OuA8nZ)mgnZXx)-nyf?OOl`3>!He?EL zVB2a*PN2O`qz)J?oI&KvP@?e62@mgfB=(7SU!TUW;J-4OJp-F=>2Nl!+Z)liSf|H!SM$4+-Sv(P~F#^Wxx8*245{ zv1jvMK{>zBh1v*DWtvRBAjRl-r3UeU4IdLwrL$$3z%LD=t{Hk9Yysit;M z#DJG`7$;F%o3FF%G{-B@=RPxUg`vlMJT}|u2

      iuj3<8Q*DB1GVIBdhFlFC(Fu+v zMBh9{cIqk1UgrCVQ)O~$Y_8n1f3rg~1E*7lUSF-JU1j%iY!irrSf~tcir9PPIe-$%m(z> zG3_E?ygtHXG20Iz!sj=pIu;o0ha!bLP0qJ{)=BFNma^3IJ;2(vUHJluiD4^Iz#{y7 z1f~RuU!5kDUL^Pm-5;nfM#>sW85SH_{<&Z47#kqslzyoos8AbDbAH^}DsgkYfdA@g zYcQZ!z#5_b(P12s!ic$ddYHL6Jp^H-PYz4YZoKt(q>V1a)Jx$@2oX*KCsv>g^6tcT ztClje%=gMEpS7N5jL19KN>_7NG}Q^s=%`;Uzp{I6!+6_7l^h0$mqu}lZ7)sp2}vH` z-3+3z_b!4}U{5f=z6zMph4w2W#pvx$4k2~x_cvTqyyjVjBZ=XKIKcn-_Ey4E&+>(R zW=RaSJlUq~&dED9uUu06&q#LH6|6jL)!4U8Oy#xS#9T-2M4)$4ly`p%tIfdd{K(Q_ zPgh##H{^4KR=e@ojN)y|(a{2vbL*w*43s`SN#97m%5J;If@lEenpVmiw)5UmlGqc@# zWvd5O%xmj;i%6H6yVmB2VeBdUV;d%+GvX$hOHJCmrS!|Nsi`YzG2>3DWSnR&zMN8T=htz>hu1<*@)92f3D*yde(ag1R_`m9f=Kkwh?R_21M_Xx;AGtIi2%aKiHZU=^LlYLs()kuN#QHshwsc+Cg&s^%e6EwQ&~q3+P6 zg?I`6Zxtx^Z#`|6dazpQF1bDRyQ;5`^9sw<*?C)!_^Vpcwp*E_2JkdE|M2|m2cc0I z?6K^Y*F)aSgZ)XgJ}WG`OABdT6+>ZvXwW(;0DLAtD`tr1t!Id(lYG>aT~F4-iLb63 z#><)#-RitOZ6+m66A3t`F0SLYIAWE%p4yeaNrM7H!^%@J!#aoejsJO{=#!?arA1F! zf#37Mc<%tnHjNCcQr7gk(vT>Ro#el{tll8|7#K1i)XJhu_BGd=y_%VG?LJGw(=Uj( z-HA1Gu*52j&BK66+LuDAu9$j_8z?tDolpp%_OK?8{#-{96Z4u{-}C!rhbpnBlO3Fy zwEbt+p}|c)j-S6)3i9!!J)qiEyao9m`A&BR zZdJ4$C)Q`bLs!QDPB(D`bQevK{Vll(uk0TLPfQ)?$LpzxH0R19)jri1HF@7jeI-pZ zqXM+9`_*N(5Du1A<)I1TG4Fq6jAU@r#_axZcyn-VE`i2_j7gi23K47<(6bqsN>}qh zDws=D>j$1ucKRX3dM|p|w;z(PUf3@S`b84+)3q zXI37y)CNqlfkM%V9)s&Qx_z0OEsY7#+ggLJlSnJ3!Y60+3XUtTRy2D-YJ)7*679>% z7QY2sUlX|K0#3}OEZj3uyylPdNp%09MhL?9b89_ryV2^bKOwZWp1c9mzcukNw2S8v zQFve?b-(4IR;P#vwdz$1NO$U^CmGCajc)d8yu3}17(C+oMWT?|6*U=6ZQ-E{J9U+B zHRigvJr-+J=P+$<519pJxQz^nW_jBS)}EcnMoRR`A)x;<+DcvQe5;YQ7@Fvk?(Un= ziSjnyygKv~bGqLLh04)S6#V}AG(VuWs-x{9o_Q->CUYIQp1~TIL8F4YM!AdeNw~`B zVPPCB=<=H-r%`k|HPK|Xkfyy86Ju&;gPWe;%?H!s2a)xnDi~h%kixB6E8U3;h>~>L z>JsHi7E@G5$0wCTsgo}>@|Ud{KM50(cUbALb zFoz!?sbfIP_|y0+?voKrtT^b(;2RKwVCcR(`YdZ)or&mri~itR&x~!7$=iyh4fA!0 zFLep^A`o`{50pMxCqdYf?pPY_35@zH-`7fMs}8GG@H35Zkddgi{$OB~P0CyDZ8ADK zmfwD!j+A~*Lh-bGPLez7E4*>r50r;^F=^xTW!3n87TDf{oI&PGfQ(osjyoF$S2EQ` zBMH;#bF+qmSjH$x9~LKsnX}~yjFv@gUW(_bhZx$k^D8KCNv4Y@o-vCv>d5d6PA1d- zD6+rvQ5F?wUzGyIMACQe=X~}MX5!SBl;UN7i>a3>r9@wDY{2S5nk#DR8-;k?v|5a=Oq`8{=(zA2 z&nqg{;S6@oxSSQK94xho(AD;=!d4MMgqO_FYLnJ`&3;jZ^1Yi)rq%91oQrLA2Ru&Z@FrFCH_Z^ zT2T>+{1n`gS)(IdcH_#V2+aJ|iz#o}lIR${VO9Hx)OA)NgD&oc@2(8i?XM6UuG={O zjz#Lgalk@YtS6xXl2=_#kZp(f7OD$*26ZWq~YA<)*I6t@>^!l ztlh|c+sa64FQREdK1aNK>DW~Aqn8(|Jn@h^tkj#Si)1{|e2OiFixcn^LpYj4`LZkD ziAR_p?eysnSGY2|hRUF>_UEc|sr#e#F1Sv%uvCiQQ~Q-G{}ot+?1WU8vsaFJ$$3?E zZ~7JVUcIA8eAaA>>p?P|onQ0l94>oY+ThLgWM+A|7LU}|*sQ7mFC$5iLP zBLTc|uy(^94!3Q=d*`%Z&9jr#%YARp)$+1Y7GO4UW>0=ox#`UDV<&;WajcZZsk0qVT)&W$e zNIEM^D6q??>+x3^dz%E{C-J+6GdWeOT|WLWjw#ZAf%L?Tb^96id=^_?y@=~uH=t+h zD7s9X#DYs3QlNM2*KzoE5hWpko>YCapIhd8vGu*aw2u#`-Tjv``M4hnF}s5i~!qS z@lp>-&wV$xR#RmOnS~xqzA%o+NPm1p4f@x~lRlW>{yJYB&Zo5zkC+MdqvV& zW?16u|20l&!{wE6`~8QweR^MpcZ;R{#DP3FD1=+4tra8b~{Z3Q|@1b&=_lpSW->f({P;qCS7oNwf}RAl`l;o%J#8rDGTJ#Oq>M!H4Mg z?heLJ9>asfqv_Hqp095T=iGNvD3lKJd4`?m`*vkW`xqX)w2~2IFg%1(0<$)*7mk?^DFapDlc;maV{EGW`^ItzXL~yHoSOYLt3}) z!OFA!s1m_rA&t$&0dyYToaWufv8StDW+9rARnE7HDb=KEmA3MeHq@%{(#fXPfp^Sl zqznk)#jRUt*0C{tJ4ij36q4rKn2QsdGIe?~QySFDl=5OSiftkw8xbAq>k^ip0bY3g zyq#NSO$Jsww=%R_;BOt zW9Xd}&8%me5G*rdC-d5b-gIl%lm~7bNuMR{qxmEmA*79RzP##FewNc;@*_IlWU1y?XU$#bf;ePMp@Q0ap$i!}y}b+?$b2*6hPHIjbX+M>XN>9wWFtT!gv^pw^Qw%elMI%P}@0L_@yt>{P9?Q^Z5q_=2PW6#}b$p7{LyH^FVb`TGGzpKUl_Yc6TENFY z|42&Lv-qe_BFP;Z@y`3_aE{FSD|IHIPpc@pG*i8mE!h-za*wYe<)~2QX_&6CS)~J#8oU;?9fO(6M(i&)$CqT^lrH;Rly;Q9=me z9fPoCOC`ATSc^^VR#%Q(Kjc$vL#)HKYVi1V>uGdaSMEEnIqkc*A5Fs!DdT(;35*Nxf;+x*KaJ`Qq!;iIgNSUDNm2G5&XQ@=up&HoU4hxNS3U z$_#33zj)fp%(!Q8Hn%;onM`T0s_X*h>5{xufZnr`axjynnMYVQ=P-^Y4H=#kNpG?^ zZ~8*EY0uifkH-(&7$LK69Y7a-yM)K*q`Fo%{2Mi4Xv;`^Q};9OWzn|fh0NNKPh8Uk zdWmC;J$!(Rz8A@^#iY ztTGXLg)Cg2!p2fx&gv3FYo96}d|?p_b!Eb3#1f~yn)H1K`6=Ct30)h|Js3WEegSWa z#reiWa%HzDp8hh6Q@b_9J2Q>*o?lI&I575Sv$M)Z`}X1NJ(Rd0=H~WWqW}*o}(R9W@DB-7HrNY zyWA#|#bTE3kO8ku46>%*$*070#74`u&1jvnh-qtesaKctcJWGqKciYTptCr@cRpOm zCu?)$n2k*<({MBmrAO0nR{pSr&$gAYVQ-FW(wM$CmF3x`t~}KsdGV}b-=-9n6nSt- z_gFfIIe7PtADD4Kmpd&YmJ9fKOFHSgG?=xImv-10*s2lT;w$;!XDi781-!d_2XE}O z(zj_O{aX}r`-l74k)FwBNvqtalEs^kkWwIOTReMVQ63Ao0RiV ztonH$nNbmpX%$6}paQ1J403*BY{;CC7yMs)X8~B%kv;rh+}(kAf_rdxC|0ycTd2FcZ@YC}>RaEsZc9sP zi`pyFnnM8N z`$jM#u$udyUdhS|N0K+^QXJ;R)Q;f{=vdDSuYb??rFF!2Y0tO>f68|6;KDDZo#><4 zmZ(+#WOSQ)fR|GnxMEl|y<>xkD#>BeAJ(wnCe~J}U7f+o0%>RI<Sc7jKP87; z8GSW0**KM&&Ca44KHru`sMNu@1YfGtPV&`}Ts~PO-HAy|9 z>EM*cRd1(|U8~rrg;^vee0LUCb-xs&lJj{h>V4PaNm@JU7NhO9$RD6m}ovPfMi@dHAqM%ADv} z%}q~;eX1|TuR}OvxU4G&r}60tXU267VNkR;C$=2olO1VfdiqNnXvc`48XkUjB}=7j zmaT3p)TUSCK#URnixvf?< z%J(VxREs0D=ST(N?S1L*S1oB3(QrJMm1(6^o^B7#h>t*RRV~|-bI8<@v8&j`9m%Y8 z7TY6jvVW{NYkyh8vi%}3k4ipBZlZsT55qe;@ywt1v9_#~9VaWLu3b5LB$It&BbuKa z{O|dh-uNjQx8FNfDXFk@dPfVZZlPANP7A3)w!GCw@v@~-t(05B+m)d8`!IBrtTPXd z5>}@t^{_e*r{k34E%)tzaJ)5|uFh^)!+pt*)`opHL#K<>Yu1j~dTv<0>#Ao>U*l14 z_eYg!#i64+D~~O4H8tYhvlGepjN+R4FY}o$Y|{$Tk(%WY$Td2Rs+VY-I{l?{f#P}U z6Ci)Py(HJDEEJWgS~$&<&dX~LucNTm`LW(NA?LIqI!YY+?g{-amz<_dM$R#@q&+u{ z*Kc~8`*hKV{T7g>VJ*0jJgR&&KblGVyDd~!c16>3dK*adZOQV-NZQs^c}sj+PEE&p zzFp4Q7o+K7K7BEn)?H;dTX!tt;M=RX;IA@rb(V0}Oq5(Nms@FBQ{oa<*SY9-)dj1r zB!Jef)}P)|IIVwzRd;e+)7E;@GFbPHRW@?Y(pUMdVf5y?S|@AxBHwjNR#`Ewc#XMcx*>aND4a!{SN?l4M!Kr=_d8TkE1FujZc?r}g5; zWfAn4P7~`XZHrcYOIVHX@5=ro^hqgu`_OXO-xXuo4E?Qn`!N#OYX2$+38V7X`qb#H zvdKrwpy{b@oYudVy3_jBy4Tyhny!^UNmtvEmQnA$w=TP);Z+wktm>S`uX58g^tajt zEvw4f>ZCOSiR<(`VdS@#MQw~6wx&xoKIx>Ir^z%w^4qTKt!<$-x^D@uZOoFBTql1l z+n~Wz?kZ!A%8uF^Esvt@NoOkb+SWQ`Kdy4qplWmM`efIAEvL2x4RhMA%X!NdYCQ5o z^P^!jZo7T7+ZEM~f2Id26OBgW&^)Uhu-BOuPS4xdn%L#2@u^N*c2VN9@-Khw?OJuf zYD2BkvihY~$E|ebuhlQfIc>kzJ9Xr*rf0XOmd$8MU+YH~@5&+TI(z)B!|44vm8q^j z(m1t!sJ^J&G`w9$f9kl#p|(e{*Pq6xX`Z%KKSIl;?ZK-5mi%bksvCB>tDIEN^tiSI zyRB7cPy1#)r)5xG`$-%BpYiiJ8UMc{it3pd%?B6t;hFoEv$|F)++NYYCRH^Izj_Ye zkMQR9hgR^&E`1?Vi}L;&sDsgYB<1&aqESZHx|sFl*FWI;r80U6kdckSU@#c|r!Y>& z&xLx#I?C|U>E+*mgJH-19(-MytsefbjXD~wUwN)K0oCI-7z_r({~V4je+~aFIu)gl zqW+c~3`G~u`Fs2}91KNYtLyLiw~ui!3K47a@UX4W1wXp=wl3Dv@0urFeDrgnn~UjQ8~-#) zNw;3Y=_Ya3a`pcLEsM1f@Ar%dOP_yly)*F7hR9mmi&ZD0gVsAMe#ZJX{NLz8zH*Vf z%Kvwd=#wr+)ki4Re*9KZJ7n2fu?=O?w*DO(VYiV#)lPH~=D$^!5>E4?3*B`=@BgR# zzMKp-n8QX;{lPh0)k`Y-U$)DlI5iSpUjSCufPc@9Z29y`-stBbzuUU8sDlx}M=xH? zx=a4a_U__fxX+%<_N$VJ`LUy+E7!GCwyzTZPteBGXk+xv^Z4tSC`;*If8rd@NecQm zJ058)nwK9JLmE^6%VtsY;zT9}{3Az0@*oaIP}pcvzr32l$9n(gj)oY5p4ZLe>oXJa z{aG9hEm!3)pbxDPAytO)_`Mf!k}HkMMp#IP{8~tEIX$&> z946~qtpCrtl=G!dOqw>Hvd=H${Y8oYo}-~pij=5B^Ba`$zsY~^WT>ZJCEi+Pi}$EP z(aKVfS09Jb7YbRAnTpU`hqJ;qM`1lms>k(Xf0>p(24#h7Ij2glkClD@9Uf=C!E?K$ zqV*l@_Uo)Ll7==4`!$-jDnofA<0sF-_F_jXPbE7KGidS>&fg*D^flz_q1y9iJ;JDY zkaJcUTAll;4oGK3evnTols>#|k4yKN@G0i33tnL4b32>&70}04^}H2c!e|3%Xu=^l zkbdpFu&F0)os;AG2$aa=gU_z!`XRyMC`md$M)P3LqxHCy9Mi`Qe^4)StjR`TR4~2$ z-7L9uPw=OmHW+=xNgq|Shu3s1oRy@+FWyi7otE+h?xXuNtXw*y~&dJP}whIuV-^s`X;YyMg{ zcGXuapYpM%p>L_Rhq2OV6^A}XW`A7p2T0kya=7{Sm+5rZR*_+gEcAMNoc2c;TkELm zOQ|Ds&bpZLJ7c9okb2Qzt*_I^@1$ORef;Pf>nrCS2#pS*hrZ6=dZeut+Ggx+@N^wW z7)?{_P>*Svt&5;W&^o92k+N!>KZv6xoF21>)8i@!d$`kjCTKgg%Tnu0%dL-S+jZ9p zqje#_HLce2XdRCoZNqlGvgFuuT-%$yOs%iA9;21xT34;}pjdfpN$daWth60jX*S2< z?CL_lgkan>e(kt5Uc3BTw_CgJ>h+ord*1EkRqVQGEPdlP#?FK}% zd{HRAbDn3xt0`D-7dtI0d)ehW>n)-!X=yyQHH39Zp#1YWgy`E_HLT|Iv<=bUE%kM} z|7nR+%VoEfR(#D@{6H@?+%L#~@iHz!8*ErGH!m2#`NQHE-_eb=M+!tvZVVjRgK=R& zoHM%{iMATH@2TOU%Z6E7TMr9$CA3>4KIK`Y=hxG7+7KQ*Ba!L-V{t7_;ZPQIAJUC; zdidbos|WXtizUXRo-N765FXE+b7RRbs%PSq0bDyKjtPAt8PPkMUV#;CKIzJ=Gn2S} zLITse2eLIapQ^Z?JUcszxFByr1H8$WPJHZ)B!W|NIH3w35zS+Zl9)X>mgyb6Shgcu zD$9q7<9abBsE!d+26MsSX#8uAvoA+9OrHf;q=Nmr#dH0z2qHRlNR;o`xZ+clJEe=nkatN8AaG=BU0GE})@qxj?eBo<11gF|arn_7g; z%a2>m8ES2=;>F8*WdwM-`AfIDVMW2 zbq7zCQtKcM)+>YyX7;3A&Pk3|NuKIzm@#t*Q4aYWJLJG6mksAKNn_@q4pgS3a$LmL zV|Wi1cXDHsZt5k*aqyJ>3~;X@IY*oUyY5)1L2zaC#J)_4tz~<*8)u!_onAE_%s#I# z^OD-b$uy1@i&5wh!($7Rm@9Rh+_yZPzTOj&gKUKhq;yNPb z+KUH;&}DEp&hO;Gk(2op*K1ujkl3dqmx;V02KMLj#45fzSWM)Eq5MheXiBdzinCKm z&x0|OlbF)Uk0HZ)u}JDJBR`w?p;F&d<4AC6A~~fgDo*=E2G zE}p4nvlGZMW>7|@-Y#w8HtQpdK#`67=PZa6E7n6LoOpW2%lz5FhSyN zHsbxca&$byBVq5ULMm&V=sR_=wGI4)E`Fq?9izN^A6`BqhEBn5B((FSHb(N36ik%p zn76+ZSv784BerSn-U7Py=*d|LHoA}M#}(2BdU_SG{-oF=?R?wC@WeSu%oE$_q)WL)uJDRuRWbr0i-7)uD6<;g1*eCn?m8PVIxS6{T?4 zA(A`KO=8i|cm@PY*^h}GukmEaklx%rtFyGd2r5=c$Nsa+6MP*~7ExUr@wzt1@tJHp!MXP2v(U%4Bxn-6fNl5>UjG%l0$u{PDab1~*nb z)`mJ8e%)il8EN3J>l=9L`f*I`>&>d2$4RLYhvRTMpIXY%(oyNCATo@PADzOuh4{+b7~@?((w-% z*@qXzsq9S#Pv%DQ=FLMG-m!=k+j1xoqqlY6G5&hAgt_-G-FCds&~^mA^_^0(^9T5J$RA?m~QNF;DNwr`P#svUaQwy1CiI zkIv%C;$oJpN~1Qo6U7gYgkl?m`Xuq-cnPC3E7HNwoRnmBk~<_{$HZ10-IvPp6QxwE zGoVE)fip(*5`!Ns20`k+up>{O+l81S4=%Z5E)Vvp;rVY4@+YTgR^5LFgFVaWHn0cx zj}=RN{=qb)rL*RE9c8)Me6k~*K5@PrcGk=xKP$F-OW10IICvCs#jKGGiw}}8jdYG2 z%H0EvtCl2a^Md4%h(oXk9N)KA|AQpeOOhI@yHvi$Siyc872SBr<@FLq_n zm?U1hY$#oAxjeh-2-n;&jfaM|gR(H5oHvxWMg_2T;~|pEda?DsLAZJ}am{VBSm0XA z>(VyDhjyp8j;eo*+7h2QUU_g5(_QxQamqPuq~g2xno%~TJ*KvgXtH};Dd4H zJihz{UL6v7a_&I-l~#&#--#V}j%3dldw3+vkvs1_lPM+A8L5709lQ82ckvV+jV|QL z4Y~NncOcfI9FKF)L|@Et zcQygy(BCt!yR-!ddL(w|xf^G4PDL^wmpX9oH8WVCqv!S=c=ooJT<3J~>c(NE2%vkT*Hn#IyS4ZOJ~nZ5O{eDma)bgpZ{KO&evoXpR7+XoYTd_PaD^y2ApepG55iL-u%*!kJtdVxL zqkTAM>dU6OwBv@Z@ZM_ah?{!z&E=v8P7PE`8yJ0FPh1a*ejTf3?zMCHbCNUFE$z2f z@)O>r58qxJ$LAZ8StIT3!=IaH4v$Kg4V>{_~qrwgO_@|F>Fatz_ITPHHG zem9RUZ)E038NB@D%xc^4pF0_1a62wImq{nLan-V&>^+#wC7*1dBw--Kni{E)GF0yP zlxMe|BuhH-`)7u7@vM(IbTW^>+_;9F(rMcCEn^2)-Gzl|X; z9Hz;smIFmch)d`!4nrPWPv};{g?zt1ho)-XO|eNjI}augn9Qu>Uo&}I8p+8Ane@kf z#0>Ao6dBEzNqrvKw2rI4%;vr8cd^eaf+_u_U}8_~=tf<&GCI5Xq1~h{`JS(focMav z8eUwT$@rIYNbDF&xOAAh?RRl$9qq2^!NP!C24B0C!)e*fx#A!>E-jmFsb_gInft%k z%$n_+n3m?wbDaaoJ(xk7bnJ(Y=ddSL94!rJjn*8QGI%n>HmqjIcSkt%{T622xr5qE zCNd;5jYpr_#GV7E_~WZzkeM)&PQG3;$Zu)XEi~%%P=pUuAhsJBB6tlD|KXaxuvJ4j(10Yz!ZDtLC=PzT}I8IlQ*?du~7F&u6h-mUCet zWvx$5W8s5q*%vH+nWwAfv2Goldr}S$;#EjuMmeNw2YS>gXwsWQp^n<Mx zyG;5I8bU{%>b#~GetY-wZFmP>8t+c;3%+MhS^@j-`7|Of8p(s?sX}kXN$04()i%2NMr(gq-9N7+8?h#CVRXxkUIKb0iW^(_PhbV0<;*M|E^7W35Oiy-TL9leVljd`w(=l#) zTdtQ*?ZL0UV!2ySu5znl#`Z=Y>>Mh3(8z#u+Vhupk5YU7D29o?ez8e60)c0bIq~#> z_V}uEq2<*#U)H8F>Z%o_ie2I3EUG)Vqjz+Z46++Z+jN*eynKLN`_h^7Q4QCf8G?sb zBUMyz?#H`WwmE}mH-F7`-|k%H=ZUkY7pLkgIC4ClORxTjZ*&LYA0Ua=I&kLHZd}l? zk&buga5QZ{9WP%>kgq%5BD0Hb+s3giyZOVXd+0T4l3Y{3eJ?L#S#lX=#r13|abbp! zo3%Z>v#pFykDuW9w}*J;-5h!h76&vum=DI<=zQ-Hk`JeH&qsS%C+(=304^9llJ?uz z@r{cM9y?C4Ip3fAu9G}gw^Y8^*=QdpvX4N{(fwR{&nmVa?ZNRg16jIn8_90&6mDLJ z*TBIXVkmTYZ)S#NWpXP{k=S26s~6lvzt(W*{~P51Zf%c=oY zjCf-Q8~11P!c+Ts?vyvrOm?EArb&X;bM8YY*_~QUsSIRskov9-;K|to@!s_%vp&ot z<=_gUSCkN>Z?BZRR!V!QmO8h22M| z2)R1r{TK&7+R2~SRdCh<89YlF)ZRCUGc@VC{v7-|je_z9v58e|4GHJ7 z_BuEcq3Fy^Qx)5F7QMEbFZX27HGBy7yB_8qN#Cb1oo^49bMASAWmI#33m%j@sBq+P z*-0w=M33F8Sf5-VcB+Oo`!gslc4)q9ZNGgdeOFaYy>-_^+aa|jEPf=7T}S-*O7gjT z(+XC&dE&TZ1;^Xz6`n;y**m<`U7sk)tx2s+J7v zYf#H<-HM%%l2b0BLZ9u>zMx1Yrai{m+OLO8zS zsi_X@4tLen6*TIa0S|Y4L>Jv%#iLh4qUdXHYisE*Bb_T5DT*Xl94t-V!tx7HEwhZoxHV$r)ANp!v-P0qjiu@)S#mRB)$4d%x zn_pz*rJIjA<0%8$AKwpjlnzOEW7MshUBqx#mCEqf!v${-M@tE$I2PLNbd>TJWoJ^a zTU*O_^?pxRf{Z*HOPi>+wzhV`PrUpJRU&66Yx2U{vRglPBwfGZ?i@I%8L|Xq-PfNO z;K088a?;fpTCeGKj;1bJ3H`ijDlRAY zq{Qnf@$1Cai8>;BOT3oQqyicn@d@b47f(#(o*6xvn-ooultP^)-FiMJN8+nf9ciFI zIsuOb zZj>(H%~3BO`t}Lqt>Iz3{rY-r0iIBtL8cbW(rFKlR5VCAeNWF)+i6fm`j?QhNK~ac zs+jV{-BD!bMtop4e|&BOwyD!N`TR7l7^HhOYhJYqL{^$uXb_8TU&!Y3JF{p|J32|W z?0w8XMk?Pah~n}B8uW<)eI>D1oj6JLctl8~(m6F&mrC`?_g3vjv37Hp5dXaI0>xCOR}kQEiJ}x=Q;?DUZeM9?;W68ziA7$F^ewR{r4wj0rP*P0r3 z>wYaFUoUM(wIXXT52ju+Wn-iFaT)t_~fj zE=iYGF4t<@l6OhP+8@R#+?jw5Fl06RL-YQEoA-eLkOvHA~>oi-!GZQRpYxbt4BM$q_0pXLhVXMx}+ohiSAgP zQCn_3m}R9YNxF!0(@Vxdaosv_{@5;DKfs?utM>6%8JModtTp+%dlzeleDfGCyiCtrTs#* z&icQHT-lK6L}aXZ&mJONU5MiANIOxyeIg`FzcqIGYg%vbZPUjfL;Ldn*?}y1aTOT_60e6F^DY}s z{%2db^1kI<{pkU68YL$Zja5*+=Vz^owxSS&BCa~c-UAY9=qt^5773yu}r>XW^nU;UvcGA ztGW75YkBqC{p^#56&2J@lvwhr3;lG_kQC5K1X!mQTcvY zm$UDaP`L*XuPuh*AuxEz<$t4sL`5hcKQ%%4jto*qxEd7k_bd!Z#u27-}2b%T#>y9PU9Axx$Nwrw5$A{p*Mcb^$#AU z)bnq{@T#HA zPLRL_l`W32omv_5R1y;-J)+(+P@S|tp&`*05te&XY@MgJ)jp`HR`op^c z+Mo(g@azjK8GOTP(jxlu+SwkAJbyS1t9Enoz00`lgFR$OUtupwy{4~qSmjO!Pk(F` z8IqQkRnCd?y;n}1`erv*KeB==maOLbr`GUBvM9t4D!LibaQU|kr?NsWeCAuOd{WxS zldHJrgCk5hcOqvTKEmjGKIf{xY-dNMqZNe}i*z=%I>;=lr&70**9D?l#&B2s#mUqG zl7*FNy+{nXh;`t7tm5d39Zb3VL&mQw=dr6M6J92c_Am7GifZA1 zhA6_358q*X$AP>)J&9i3y71>&gQ;2jAsfVl^K)|&Z(Is4!eC<-OTKI3t+z+eIXZ&J zp6f!i3P=pl&Xin&BYQJ5A(jW<=tZJ>e|niqtF3>9=55&}yN=FysA9WE@YX{k2tKl# zzchq1YH$p_+Iw*5WH}@I2hjhFp4@WPNWy)awJlFZ69FB2Gp0{_9Hql`lcM`OSF?P} zH|*#)nXd=M(zRj3+-(m3KJX{&SI8YgLxE;8b1KJ0*}3_a{& z9CYhpDZl=7mxBS~X=klC$+ylie05uUI(AHA=cN&%IFd)z5h=5yl-asm6vstIkltEm zaa;4sUAVY+JcHxK@@dDSie+nH?Yo~*GI|2fjqFIz5d-<;?j)RFTEX7f9z1&EAbNL? z;+_kq;qu*Tjuckm>FJ2K_C9jGz5(4+M_WtQursCy&)q+Y-hE=YXYn~)J1?A@p4>~9 zDWiGj+z1Bth~(pYrr=an!l^oECQOMUA;=R)Z3K4ot*0_-RYTw=f3@t*s9f}vrYmxk zk%gzbh zHd^~2HA!QSnLC&TQ@Su_Mh~8x6T}sdmr$7TIj?#5Wz)nYx^;=?=_~pYdvGI9)YY>8 z*b#ht&*qBm5nOg-M=p$RX#~=dXGrHYW@vu^}wZ^pK*vkzmr4qo(zKf^pbWFM#2r}aCw--q4S+RCSv<)5fgsk zXgJ8g*`>Lyh-|d4_t4Hmk+$G1nXByDhp%23#i;(ibPNfQ}(Y6Xw#Q!~lgytJX5 z&*um7#b@71=ju(R=r%W_`W)ymPpEsBb)xM$oVKaJJ5_=hE*}#5U`e@FDzZ%vi?th~VZ+XA!Y|4I54s^U=Fk zac810{%#SX?>U^P?#z~z*YHY|-O-SUT`PHR%{IP>mN?Ikpi@E*4n8}XqN;kaW9k$) z%g|Y82c$7Hlpdo%oTupSU70&|1TS=V*G-%_wjniwk|&jO^K4upSEYGy|H75^>wSr9<+dWhelglx4-k@A}+LM2*k$f!rp)o{`kZkZapiAC>>ch z>a6Y&Ixa2dnaied>BLCJPw&I~500Uuw>VnGWyJJt&)MVk-hDkKrS*)N6-l>_fq2LrrUpt10(x*(lZ~zYsf(1{M;^ZUxD`oaLe5lat~J^($uGpDfV!`4CJUSH#C$(>-MvL zbv_wE-i%CYN8Y9sJ~~;zj>CmyH#m`ezE6 zj}tjXyt}WM-os-V5${Lt;XN#VTf9~o`P7S*PClN+u3Rav82)Y@TELmAa#JdPaCWq;~1-q~G6?`{c<>Imq)c^J@u_P)xn+rP*Wpc7aMvsm)Y&?`tPQ5#OHXhNi z|6v`;q2dG{JI3ZlAL8QMGqx;^dF%4XKbpyr?(tmfp3NnzGR0tu4zD{P!U zD4eQ-T$UcpV54-jC&g@56cw>9rBnvcHcqByu~Q#|Rtu%_6(u{l`#Af&BbePioc6YA z&i(UdN@b+4+v=CfwQG-*h)dHFz6Eu`^0Er~Uh3M~e!t zwNj5x98S$yH#u(&QvIqKQn=kwemneIae%zf&aRq%FHt9^#@mQz)+$ zkIO~35)nN)NLupFnu zEBEo&jAAw($fM8be#GUS)QYcEwg00^BM|;9!_bF)vp|hd{OT_D5nv-1Lafmm+uP(@fe+Mei;!YY_y-BC!LwiTJV~ zg2$EM;}Bg+GecE+?KzulB_9g%twHE;?<_1{$?^*!28QY258v8=JOIb{W6p77{!qa-2r@OM-)MpykT zC*8OXqr`I}{FR3D6XBBv-Z;>wo|Dtq^6KhUWabP z3&U>Oid$pPN-Y4(9vmH1f%Nlc!*% zVo;fD4AJ)@O4U@#*S)2?4|EN&?t$Ra=6(!0Z5zofW)Bjp$ry_9uh_eKmvGQ$ITQAI zAbfXLXZG*eK|9}i-q8k>hliX}xC!*JU;%o3+%M{py&j{3mR2$0Uf!9|Zj3k@%ktIU z8lT9X2_3L9!ED>ZK%IP?1j{-q&0K~QH4IEd8g7Onn zrNEZ_iu~^!T)O_-TCk^S3F6n!u~dT_p5k5dMia0&))sKgVU>w;+#MgN?Ko^NuUBK@ zO|K#6?@^{d#^UJEci}Ln&CTy{8y7=|Xr3zHqbJvvzR#DODex031>2^b8MGYcZMp9* zK1pOH^XRH^rcwB>v$B*CA>+TCrv-+FB{|Lv&R>+2cx^PRUhYP5zs<5NcY0lVJyY-A zWO8e`J#goFQl*rXR1tp=y%+0DFm3XUBT;qECb{HJ(X%D`+w$jn{=8GJnL-@56fH5r zqGp$R_mrr&q8Jq`FwLD3IRgX$YV9RXLRFIO*PYs*KYq5NV2IK#f zcS0u|@6M(dcJ2m13a6PNBvsafd69awJKMELVi(oH+>YOaC5IAA(3EicS z2EE?OhuY{G11=rmjjZ!O-ZcIC4xa||=&4I?r|*mb)}+@($LJazpMOGzUw)a(o{a*Gkp7gbSICqIpHkKgdXi6wLpI(;8DJzM{x#U0B zN$#Q20+BU$WC4A#!nv*!)P8YCS$&R+Q|U&?m5B7U(vX`)rLw`lS@zk3U{v& zV$k(xOs^U@>V;A{HtMo~HXyxXhpBP4u;tQ#yg|CQnmb@wS>=?gj^Pu#Ve8^V??Ps@ zAJ0!qlZ0KTVdAi|YRTX9T+%v zI{Lhx-=pb#?PCIGZMGekuH6|D|Kg;8^!y=w-eKQRYfHP-`&Kqk@7(PC^@*Vq#twIU zn@N#(;lA{kXug<^pLWCSY3@C2_g70x0i3;wjr!V~ylB7QOU$v%$A@ZCz`!AokxHeg z#^Fg)?fTkL7!P_Pv;Ph4uW_!q5Ep#i@4>7mU`VGeJZs7NsMfmTo2zZVa)K8fhO}*{ zjk$mkarY;w+>K8nB-~OqJe}qCDDf-E3-A0;ku?4hl`2^=5U$|GF3yj%dbsj}%=yzVv z44L^J(-OC)&M%I!-Ne@4q}l5cj07pQuA((j7I(Z&b|pJ8z`Kf|F&%5B!>!)o8MUnp zA-TeA5)Ps2WRvK|=GV;@RhA@mwm9hS0CpwDMrjO?Ju0 z3FGkjT`dcU+!hk|-eKR=;v08bm-mpM@h$`2!l1#FMa24vHcT@veMgsfhWm0BC2EG- z??I1|u`ZcgYT2trgL>jDxGuieC;M#WEn=xjpX%C#UkQK-9}yQ%-WO8~(xUVv1v7Mu z$CJ|t@9GeNbH3@G{Y58MC5VRN67ApdNBXfXrf0g7`u$XnYU!~8*oA?(w6Q)@b4@ne%wIH5 zO|FdRQAB|dGn9$vo^W5jVw18}K2`U?Gd=Vf--seNl)mTd?Vded<=_KYoXGCjN~!gX zTLgPJs4J(fM6}?$!9O>CmHTaBzc?l8w(&z9N&|t{=3?H{F3Kb(Hk95D=#ro3^WNMe zHCYvYVj*EvvAVbPh2i3Xd6kvF*BX!1MVzDB+*|j*?s-)u>Y|q(Ud0c{pJrW8s;@^^ zpyj+c+TXRi%_PoQ^8x3p^UTG9nX%k!Kb<<#26QWwNW>4$xhDR*4Z7R>WoaOoXE`2= z6|Z0ixMeXiW}dB0_diYRJuFlcKG+#ZhWLF)N9r~>$pD2EMDtGR!Pd==2WO7dpYzxI zdq<;}Dwc*V>)cdN{7?ap>!GyWUdPA zHnL9a_wj8!yF8M+P@r-6TxD5kpCr=DMO7{Lt!?yHg)i=|p{;=g$XH#) zVwqEvua1NlOLlB3BQDBj zlQ=gp=Vh83k(IN_SxE|jw83ZJW*5I|6J#m!-vyn-it&9JanoQy${k@eVG1#6q z#)Bl|u9bi&@As`!J!EeY#iW8%zAQfz_1CfbhPzGEBN{=NDF0CZ2fOpVSXk&$-tH&y ze&CxK+)5DM!IPQ0RqB^kM5xr~C!z;juu1d8`2^kHnRsS;@JGn|c7C=(VtHPE@2(1S z%}{foKhPHb{J#DwawHou)Y&GdW*2c2mIdT)MNll@k$kZVkdx9ULdc%2#>^p0O6n*? zq~GZ$b$~n+g%vxmIyr*$g+2zeRB*B{tM}yF+$V3Ebk$PE*p#rnXF9W#&U{xplr{C#AKLXlS@IZgys@C+K)k1=*5lm zQj&D7lhTG~JgJo*l{jk}$tZfb+Mhepe)(@W8WKGj>mXk?)Ac~JbuSi;r+;*VPqQblgC>Pw!?CH_^p?V_hxH-p3mhR z@!w5XyvHUjtr4(^%~7OEp$<+7iE-r$EQ)p&m2o@Vl{6C7DvP2yz2&QP(72@c;i0ch zE9pH`iHlNBUP>Q<{>pyBR3nqa+_0TSwXJ$w>~)E+=Z~$I>20D?c_SC3dq=maJ~dWP z^kth29ZvRbW(^;23ml0VhYJ}2I;JKFLLs;-i!WP}7TDrChO~H2D7Sf9Ni+$9wkMkC zb=8#rMA%_0L=)m`}Y_;mq}UAAMB+t$WQu_S?y3D&*#su$a%^in~u-d^-f4aeL!4Uh`j z{a2^D+ed~$mp_**Y4As4Yj}5X$m78C*X_G0rj!D)`FA8Miq2o&FH8*PPbEsq$bh%> zjmeN>u%lNJwy^G=&@yh*yZ;W-5||xC2|@xjpz?;md+0l`i5P~jOqrRd>&CN_6Lctg z`j^BIy1)1bz?qeE%~|zjX}gILZvZKY!dyr-WMejr(k|0ub?@0(IJVit)snREx8J`f zVFqRRX(=;NVJ)BgM2+O3Kvn~PcT7qo8L$#7D+ojHW1dKrPsr~^dc=>@9+%sEQp~y{ ztMdn!G4qP3>-I(Pgy{$Xzw@kpHM{JIzrV^=2Euv6bP0U*TE(I?Q4VDb zkXSCf1pK8kUJ5AE&VlcNjW-oR84CmubmvHjEJ3_SXkMGJ{PG;VzDH?x`eB!s>+R_x+;iZ9sftzi zZG_Q;#)ys8`PN!Q=9LG86|{NdvZJEeu(U>a8IZ=-YQoZTj9&so2)iX{h^31 z_~EtL>igg-^nhNa$HC?=_h-#Mm#=QTtWL%@3CPy9D!&bK*P{ErR26bfDjfbbPQ0*? z&nBIm|A1n`S?hU4UDz4oycf1qZwWwkPqCb}nGvK%M!mDjNE_TbH}i!@$CbUak^ng- zAtUewvF0z8QNP%N$0aGD(Rdr0<`5jqpL1Yor`lzqpDlwIC(Ru2Q<0{D6@9t<)hFgP z&bRVZtb}hcK1ae!wevjVrWa|#674DHf6Fie>P5ryv)q-_W}=laknKpAt5aIH5;vph zg$nMo2lW??+9y{nr(~P@{Zi=%blwj_3EOcEt)I{!8H=iwW`;l=%Jo%0cevL9gQHp; z+HmxNd6%@l>9}2LZ6_Jj;SW$?gQ{v-Sf2RV62&vl`Ic|IFbrK!>)mpZvSuCig$<2_ zdJ2dMKo5YGI%hK4UTJV)o-m&eyYiYqXy}M&O*wCx7p>9bw*DfSm(dwh@;>T?|Kqx+ zS!F7za3&W7I?gegLuJ_|Vr4*Z3T(_2Q5K^ex#RG|(7V{@=Gk+|t0iu`hFyQ`52;B% zTtja|*^+)Gpt;BLFOZ%WyXwk9 z@J^6G-tkz4nR?VyddzQGTW~~BhGBjP#C(TC>NT)2m1+D=$f;bU!G~uqe&*BCG3?Gg zfV2Bp%*&z~E1Dgt6l}#jctHB5A*UF~3jJmbU}JdTg1}cy6)^P4$b8Goe%ku=$LFeR zbX9V6YYAvo=*)K-96!%2g?HY(PV;TzPIjuY^So~-8+vmVcNePcFWn+!_ORbnb(70! zk4)?!=^gOA-aJP22~E)Z=J(}=_a+?B`X7)|QGU2#!o5Jb#(MfVe#E+>oVKp%>oC;y>tBZr7peO%{)cnf!BiG|6C3)l2ZHFsad~MWV!oJ1hJcj7w2=2gcwmJ6Y)}B)1 z(Q#^lP?ONfd8>>#-t##b^}!!Wcu@O z7p6@w%bU#XDg;GO&?t59@ zV(N4*Te)D)#b$w^rqVr?>DqmxTUp|!%XHLJ~1E^U--(eSje&XOw_1ahI#^D8a~8 zSBwYM%b|Jw0b`g?x$Bx^cqSHihmKmv*LOIa%B!s~_j*Mu5Z#EObK>gVoD+41nj_Q3 z_SX?VGZvP2y!9-#f$`~p?#_ke(Pd`K)j4%H?6}DLqTtESUzhH7+aKh7c`IlA2a+r9 zrFBZ~3CU~{rh%ukMI@-Z1J)1C)v)L2{Qv@0KvA=i2fQ%1HuF1&i0k$;SK6)j*2F4Q zlTs+HGo9-?aK8c|Y}II#gO8Dg<6# z>USM(Y5(deJ`)E^abP#!x+XzEu)eU?F_}MXWcqkFJck{bs#b7Anj)yqu6yTfU$|xM zMLX!|iCDmETK&+*w&yfKXlu(r&#@j9 zH}UbqTBuE1FJ;0`_Wpqmp(l5Pj0i~%$U1H$_pyaJd@qYLTbe81zp*wDJm$; za3a}!ZL#61<=nTKKNW9TVH0|oqL*3s%~s2^1Rv{<3FX+=I-D%GQx>S@vlQ5+Cy%{IyJC_){vFSTl z6E!jy2mIA{UMk_a`o}}%qJ818Yj0x6TXA=4A?t?|ZvK+Bn9}t|bAp5h zx_vIf?t?o@lw|=~%kBt@={XMSwr2*LE-~ZDcK3qUi;%-7GtAxX$J+~Ov2pX84qfLp zZ8y*VFbnUXhRNPHy6hx5Mye`rJy_=Tjgi>he`%J8D)j-MTkQ&K3cFm=j8KuuE&tmz zoG%$eFd^pMH@=k_9T?Pv$WoIX&s!GCCmTr%76aH2$k(oKGkDfQw{!2Nbun(&V>C9u z*F{U00?JSaJqcxMUr=kk^*?cq7I>4amc*r*+Ag%d<;c%5`upA2M=ENvQ63#**O8wt zYdBO=wtS=PYA?>qmEYA`$QN^(=M-P;qwf}Hf1I#SFiQLBB;z-@so{}wwV-oO5G_Q* z{|o5Ka9rOIqhZ3;n^N4Q*o`Vq(BD@XG*GU%daeqvC(PB3F=6dJ7tk&dl0yA;OBhV0 zq%2@&`3xzjH7O|BS38^1Zd*79?SGHEOwoNZ!tP$%2l(=wHpwgG;A-c<&zehq;382C zk2}}R+(OVn@0V*V?o9K}Kvlsh*X#N|2%5ZQ)sitKv+EaZ&aao$5s==O3?7-(M~8P| zhQYucALtol!r}p7lUQx>OgwRo2k)^3@w|-(K_i*Xn?h^qu_w=r%Nut?FEtXSYJPXe zpW%+$IZP3%3auRXeH+#}ye3PME;Uh&h2Ac1KK^;k^Mg4pBE2rx^{VW+SjhmUuO@)0+9F>L6ZGJ6uXsLyrYWiD~tG3nd2d~`OSdN=MeE(O5IHMR!d{<_7Z zE=cjPOXUqAR?8OT4>UMM(@eA#Rmh~{ii9n@qeSVj`0_B zyU8T3duKpz7pJzJC|v-AMKh`BbSLb&pUfj(c=mFULtMPbL|fBz;-uOyyb9FE+4VNJ zeT%0S$=bn&(Zi%Ir=Kljv~Pl{|yGKkcrQY4X} znA-3nNPMNN{!$4!2=gj6^0&lk0q|UFdeHN$TzkH(H7de>J1Diiz4pmCc~aA%Mw-b+ zuQw?4RHJv_$=xpchA;N8r;uLM`%z;aS)P)_O0;t0p_X`!(MHLtAT>^KQc$A=`%QP4HG$y@Z2*NDkN|&2wLERsrUP%64cgNu81a7Rwd`|2JwWH}BfZACth3U{pY;v5!J(j{PAcR$71R);$ z%cnK>^d98e+sm>(Dd>cJESrFPAZoUGsRi%Am#}xxnk4OAT}(RM3&SLd4uz8n?MW8M z+OtyMZHm$>nB#p*xNa?Gg}plAp!nVQ>r4Ocjb+_6>lyv)H4CmfIuOF}(Xm3|k+4Rv z#Mv#M2szNpDf#D|Ta!6KZ zD^8G0^+A{lTaff;x;4)u9nTxZM+^FR#I5rInHU*2ZA=qaM5mK%%aDPrwJ8nloUL$*;~y~DV&Kr zI~=lnm9XMEiYk2vKHHm!I4>JAPjalx>d`EbS9nRyKG)mqlgFbdTXjzoiHeAL?{!yb z%rHdSC${C0dHJt&(Y@bP{Bez#`vljs|I``BatjteLj@}*;h}_84 zhVK3C3Eq^g1N1P+L`>EH2gZ{rU?r>pnIxQzf$fwcnVsjsGaj~`KUCv|ewfH#j0nH7 zwRuC&nXE9Q`W5cJ_K9-`Wj}lp*OoYN-|tW8E1I$-HqU!i8KDQ!|LMkeH2gO8^}$la z%RFcmqa39yS#o2O$ja8H>cv=2^X5e2FzjZ$M#*Za-jVh7PWq9wx5!exIk7ox-gUKk zr@2b#8Nuk^i{Wk~qT@?wFu9o;8S!qYuFuB!9-V;j?a^mxkq=A2pQ$h-2DbS*p;bnA z)-^>k-^P`73^qrvjuX2?fg(`z7RQ^?daj4uvV%GVD=X3X}qYk%8T`6 zNWM)FEJs=60rJC~?imVo54$-xrOIQVy^k77%cVcBgtHL(9V&_u{<7h}cAZpI`j(wDhGy|6MTU7*ylbGL&D_CY=lezL z*eAMcvRrTMHnHN4;LOoY@uxLwQh(xyqLL-Mfj3vqAhP#4u7~KYzPzH#s#SS1Lte#x zag)D2Cm)Ezkb&qb9U*t zk~+1sHzF}|+hjl9@ROH)JYy1^MSxbbUn<|;ZlR(8b$=-`{Jg5dXJ(b!PwKO^)a@Z`2Tpx1! zlb4L|XIV#jECIF++wq-R+ZU7J2M>t_3wblVjk-8N1X2pfa@c~nij*kVE`WTN@mi5H z4tH0svmBG`8ZcRMFlgyEuGfxxZGxs4{K?sllM$M_Br5Yw9pk zlc};bEUMPiEB8-gI{i*1}ymttFbZodlr8e<|;%p0%KHDsm+FNcai2c9Bvd} zW@C)`eR~5v9e<}Q3$Yu;4-43;&y)_!3$_KbV{ZOz;4Y>O(cvcNKk1?q$9%%o~7;bwLvO8({G zw8bh6zwbBn>(2(_lf?nCb*-=;rB9iUK`+<&w=PKIv3An;i;W|2By5^-`+RwoxEv@T}Tl{VSmv?!m)_?8=h8) zIJs~4c!NImgu(6+-}J1wbo{EIOfzv`mDpCkz~~WJ(gfh$R}d$dr-sZWc}Ih{5sjU0 z9{!R9^kB}$=>7qhM|#T#x-Zk#;p?&9^s&~C<}jf77vAN%QrSTl2}Lx)tbQFBucP4( zpQPCd&AiV>st!8x3U|ea?96i>+zJ3$8}HXDAf)n^Fj@mvlI^t+(;ukKA?>A>!t?ZXpE`hUk z&XC#?@s2t(A0;HY{!=wntx@rs0~+0alzsv_Fs4h~oy=856oRXRMFQQIbw_s2^7&I> zu8kYT7d60^f@OEl1EckjznNc#ov`jpPZYtiT`*? zBsiS^&;4bhYLp=wV;!zaqB}(Z-qE+mTmBp(_a>XZmLi|zMV8(o3_dH z#Xk<0>Z~1fb&1$$c&;6C_xB;IPgLi8V?CqElPpiUZ0clQZmJ~O4o+@#>L~aj9`*f& z+|jU|tMkK}Pvn9w?K$0ywI{;AW*M`*H)}iGM@33aewY^%hg%=fJ)WrrP92j+Nw245=HMxw zJ1x+28J12{WfvIH|AJtb;?oeUOj~N5glGzVMOpI&MGhB z&ZEIhgp<8!x{*Y<+wvs^c5fELmTl8s`%)jxLyDXNq>l}bLr~0-YGhZDlspE zx7QFc=^ah`vl>F6m_e(Lc9F2JSF}$mus$V`H@C{aRukm_Z;h*q=|L^pXNI2uZ~gY0 zQmDQzL(kNysBtVrG6)jE_Zvv+FW784~-wY#%7t* za}%h8ssAy!*jUqF&)N@z(aVq6Z?n$NxL(}Ll!u8vI3&w&rfMae)RhcoT-#Y&kF2%P zEkC{ro2do_wI5OB?jvycclm3+aHOXIxtk?;Ld_VAJLlg~?*^G0k_}FK<(D{#Pcs8P zA$%X+**2pY>{H$GOJZDRlnmytYjPD%whm-I`(l}W_5)w(Ze)2)H!pM+WofWgI@yLT z$A;W_xH8dxcuv9;5@4b##`K64{BmuFZsq~@r|s4JkEW|}+C4d*G2n#Dy`HkcjKPDf zoNwTh5Mp(nJ))L1WD^fE-z_uFIIgz)`P}5>qKYm#@#N~496rVFab2STDNgV*z607q z-fDA?to_O+tA3@J+lbHZ6|$qHd%KpWe*BqtZFHvY?SJrn#LB1w%&k^MGBQ;-Az~|f z1FnEPF3A7!Pv{#CIuflWOg^qJjQR7Um!4Ynql2NG6fneF4S1oH2@$bUSV&8tEOX7< zst+^bZQw<8+<~>MRv$YCiZJ{_&X~lzs=WC2H>DoAF}Bw;kI{$DvZ{MZkuWwfpzP`a zyX{c`k$R#1#T;x0kcn^~tN=yG_Djv09vBI|DkE>2U~VL)Y>(XO++NYK3>(eNpsM@l zF$AB*yChE)QdB<+bxAyR(91h_e{oLMS>hVPTaF+B++5@ZDF0m+nSJC?8TlzKJJ!;o zyO7ZPKPl=`^Nan?PhS6JXe*_-^KWFbKfJ}1bpLtI))Vvg%?{3P3bTG&ike_<--@A? zhyhN8e_32KsXd!fgKyz_ok!-px=syc6;xNseXuylja949siO=OzqtAkAWq)Az<1`Vn2$Ae?R{@n|3tb?P~&)h74`h_Ot`t(Xvj$Lc3(v% z%4x=i>MU!yh;dZsgxpC99`DlP@q(W``sV~%aRWYLswMPpxrj^bIb(Bz)YzDFO=K_z z@@lWfNw0!Y`$kFLurQ{0BAC`+Y zjI;+K@nJyV#f=7589%u$x^eOaIYZ6mJe~Lw0_pm11hF!3>r|4_#r<6$dz8WJnzP49BBcvO{+w0K*-)KsCV|RA zMH+&+(cDWd!4+Jp>Gc&T+Q=SVM2yQY*%I?~h93C%F}_663?)k>+l-yZO$o!iv+*Ui zI`584TJUE=^0?$t4OmO7`Q$r_0mMjN#3JOOBb?r>E5{Wqzc-?S-NU1Gv$7`Varzfa zpS=Q%U#jE{n$|q>#|DgrB>&(uv0%ww-1@9UiZ10WG3aVks zH6HKKr&kI%65=UicS*tXr`QCK1{$+gP@nVEUF*%msZ|-Le6PAm_TG^7m`imQxPUX) zuS^aC+~1psF}a*4gRg`p!JeI%X(0NUH?#;$my7S-X?|8Bt71K_o3k%~345qU#?X3*J(5kvDOMQ29V#dVWYr|rxo;P^1MVrCxjKOuG zZt?u#85rmG=pP1sD07+R@|gE$QC_c=Yo~$}mnxw3=)rwMjvW?HCSdleD~~~mdKa(| zR@EE*$IzMOa`8eK$)z{6-LtXy2o|Q_RJD+N{I7Y}zWHTq$!3^azY^6UZ=dZTF^^Uvm!!S< z!MmT{1bDhK@*dVhU#m`OMWhkkV7gwFah;AqZRtkplTMq*XDR;0Q#F*GZqEqxq>F?! zp#Fsj@g4o62-q<7(>-X)C6Pq=WbZ#J55U!|`X3#FK0BAPY!u*4m!p4H^CS9so{klP z6_N^0mGNY)omc-DW3GNHlGVpgFwj>5iX_aBF+eLcS?wu3zB&#-SysidCNpl7Jt{g-)(#nybp<5~=-RmR{UO@b$kfmo0z0XWDua-yRPg z?6P1idW+ich6t&Foj&w(B-r==z;_pd+LcX3R3E?er;)X0=e~jP^sG4gp zcmCU7paHMF6h4d%soy*`@P_Ph;!5%3TITqkuZq9}CS;Ag8OLh;{yQxtA6a5D*}N+P zt=;dD-(^=lWQ6SfEJA~)sV=O}@`b=3+2pqc;|k%L>)Il#%o`;oCArm^m}Lj_q!b!| z-RmRf2~uw#>?3tx9d8~9$Ts7I$bmB+Wr=V53~USg66?f+aIY~Pt}#E zb#pgAS`1hO#_CqC1m`te?Krqm@{^^D4K~=Skl7{r^@>5nhm}Hh_0M+%MK4u?E!5q{ zr)k_5(<2&*UFW8voiCySXpwU8Rc^%fO}wtY+eU;vIKs;L^DBPTe}K6fsGXC~uev(z zckky^1~yceO9edk=cW9OIV_3rQ~1IwYLz(~j`cSsTH(gpv_@_oqKC`J3?%T|H!SKf z(#0Y%*V~YjzPCz3TeX5wK~DwoJY1meW7J!oSoC;mB2_a~*Ku2IKDbPNw2VZ=P)^pS z6o+3dyC^2IuMb(v^vePyLD%SRs#;GUFqfdDEyH1D+?u3I)%Lr;-92uGZ>#_jnGd0k zQ+NK)BFDu{m%mr+xq|aC!v}%LP9|GE+5OJ03NXDBS~l(4^d&UO#AcTYbj2uKoH4NJwon@{Y_3P`Fp+KXp)81 zLHxI|f;a5FNoi?)qY&zV(@UL668!snEEb;d!RCRa^%t6#EOJ8Oa7c+6#D(~^SXPPt zW#FPFVS}QVaksEKeBDQuD1@!!U^3*t|A^lzNK0xhhCNH&B^!ryNLF8bHF#dyAxfRo%ke%pV_&@tIvzmj^e^02;is1lo=8EeMll1+uib^f^gE^)=f&8^T(C0wYeU1gn;IrB3- zGJyczGuMrn+^0ASeNB{?iJb*hvU)^thY;}kk-O{2gsV@ML3u@v9h5Fz% zIO{1BgC0pAP`;%>(J1Z2c=yXLLBCX0r4k^)5tV%C=Xnri*kEd3zu{SpeY_r6L~`7r znON!hhr$?%bj~kgs>*)x+_!HjUNNe)YG)xNEUKYcNF%CAdTxDBHYD^_?Ex{<#9-9? zxEncz)HWe%m`KpLC!#EUc#jzmWjxprUVGPyq$tKWRfA!XajJ}m zt0ztATc{?`I&7FH9ELk22_#^;z7=#+M@dfSc)KJ=9$-U@b2=D*VsoWSPJ<*?QK_J< zAh(JQ7ljrW7Jxo0BbUHesymc=bHiN*&MOi4Dv>?b)j&4VySKGJwfq&xcAQt<=Ul~v z(`mG8X}>#P3Ez-@8pqNQtf8l4yPgf1AzmgA%Ay$v20hE9)+QQQH8mq?+q8YK#UnHXK98M0ICO|4C z@E7)eC6FQ4b-BXm8p96%_Dy7Zz1jf{{Smn^$vc4Te{^j?CKT{REF+>JONbCkC&%U> z5{s3>Gn?caK34S&UprmO*5GZCAkjy^MMA}K$QM0hS}%LQD2$O^xV#A^xjo-Nff=}# zfc||(CXR3HHeg;pt0XquTh057*eXML{ctMY8bYRGwQsiZPHrTHvbzG#!7j4X(@ZvI zk(;2w@k_LRQ-(9;TsK^n!^~gT7?0+qlQoTF*XNM~c+XU#Scm1|rg{-kaRWY?u>ScM zHFKDdU`|;;M`m{YW=tS4YrP49`;uTCmYkT&?s*~tj0RL zI00JV`Ul)%SXAI1rDHw%C1>05%MpV+hC_QIE6ZU}a=?E290AKU^_cnz$MyfNUOxN8 z3v`c-y>#NjyK5FJR!8Xhh=qrQr1F<*!i|telkb`%*a~h>!l2PKjQS#r-X{|gJ3=-u zwm7MJvoCm15ZABgkfzt$62TNCQL7!@@3%h$b$OF*2zN#0t#*NVA~wEj^HgltP$?$~ zBCts!EswjgllS6B>Uwje`UaRp{)mx`Y%4jKa6`ce;oHKhq#3qX5RwMYvJ^hw28)9) zqNmWxi3+S}6Vae<5*72Yy(J+bkrhtdAbtv(;3Z>O#B|o56J#e6L+z4oxB!0=b{_9YQDB+Cl)Qn932>A8JY#+#HeO$9@>9Sr>{304SKyX6KkPhsh}G7v ziyQ0_>nk84Ms>hBd`$vJE*>AdSsgYG3!PIAMp;E~EnXv>V{oSi*9bwrwaNajqgw-B zSq&?wR`{JQRl7}TeWz&3a!s&XD#xb(az!`>@*)i9^ zsLTsJSx~aVBOjQHOX;lt{b6Y-h6~U*(5KP?T-ikh*VVCkvDLw-mg3P|X?^joqo$_K zeVy7PMOhmL?LF~DV5%qj?l5&fs%UGie#b{(OP0s2hYa-*Y96YDE9bCLtXG#L6UwL@cq2I}(<}Xjj0k zu2WXVs41r?gbucaI;e*S0Kc3XDF2288Kgm8hPz5l*{zP~?z z*Y&%e`?{a|exB#|e7?_f7hZL5)RRqA#>-+Jvt)|4$|yzdL`!N;ZVN7R;51?R>ib<` zO|Zm-N%FDt;7&#Rg;azb1bY{D{ra&B&CUG=Y+_k@E481}GiR?i4uc<&LM$zz7Zk6B zRg&YarJs1Oe6)>~)1)t}`ESMXjGIP}UXtz~y5M;W$A`*74M-NM1TTeGpIcdEbN5Av z>q%tPv<6^n_gE*VFP3MT+?V~+&8w(jM;ZVMi;|Z+QzAp?vyo9WEM3Lr=e#wU`z)L- zadyK?LaILTYu7_Wvt~|?Q{#x z-M?lPz6;Iur)!(wSt@t58K-A))Hl5~F>zuv9eV;XzZKsxOZ3L0CcAwM?`>s9n!J(P)q(*YTm4oB$Ykx#Eiyw_^1_1=gM5 ziJTX>KC?JBZWQP?NA_xy)Jr$qu8dEY!}(g7itE?3w8=NBEAxo9w#eltESzNR6~1sV zP?zet>2dCKb}l5QI3SV$U%OPJv+`a816UWTOh%h|`~MIo`SK z9v3%jAAI4v>2&WyuST#LQ%0p-DWMp;c|Kvxz`|S%|Lu4Y^?8YCr1|J8I|F}n0G^qR zYOZu91W0qbaF+?U$$!esxv&IXIWz=6LMHR>dHvoBCH7}QfP{+eC zLO;CKN%!lY>G_eKeo+V3N8DB8mct}zKdsrem?$Cn-hwsFUJm~4u2QeevpividhhLf z#(UdCy61O|Y3eQv;4S0tBMKf*LHUp=G?74=_4QUB`4vv?3v{s#7(wezaDw|va;>-Wcq{I_~ zisp+xwEsPH_1%|Rz=go{H3Ary^lV|}cmG6DpTV+1)x9C8;>|0}jZ)-PHTdS9qSRXT z-78yptdeKAxp{RTUH2awH!Z6J#xhs^km$pSOxHVbHNDw4?0$Cesov)|ZQ`NQWPr>zo(myd zp}_Z>RWExW0xVRryov)vln5EFsbOF?xZr_Ym!GN_;?L)YY$f7Kv!}|in2&V7^B%WL z7(`(Hady6|&-^}Tmr(g3XW6CYlw>&vwBw_76_|UXjsFvVK^YIcqn*Yrr8`B}Nx)+E zVhWr#YaNbm1lWa}aW=*Ih=JBzXSmAfNNHAO$N)%hNpPD(#!n0`D@s8fG?7|*nn*fe zKTS*QE9{8jN@uumH6hBuvf|mJZA|t_p)}}r5u^BTzxllQ{k!OE!e^x%^;|&=)5H=F zHR_2YGBoZR7Clde-EI}}^Rkp)OcRoy$*jwYd_RB5S>w2~&->e$zw|eg>8|}Py#2+?}alvcjv}r1g7KsXta9g`ean|O7_Tf6amkwYq{8(_Mitm zPX#n}MtGc0=*56=9=A(_4e(iRM*9%2nL3}I!OriyFI=b2oVB!s=mTgOg(8gX6 zM|~|iuvoCF4$BDG?s9l2X)eW;vf6KMFDeVptH6$y3)34+BEM1JbS-;5`p4+M+`Y;g z#>I8p*2hbX#IT>9mR=GY9uXFxjJ!x`vL^+WX{1olyo=+kUvCW3)~22K*8NKR%Rsx< z4;{@MR!W@ru_C9I5rf==|MkOumyRy>Q{{9YQYFx6`If1p?7Yjs5B;5ZT^UN;Td{b z{|3sb+Op#fiVD3ve{~3trgS*;(JjKD6VjNb3A^c73i!<@@Q6&XN*p>Ex#<)0WRHg* zM7`fqJcVyz0Etvo-M}X=YsOzq9Xmf7JHLEIuDi0rFCqk^d;XJ6?f0{;4?MQ=#Qk%T z?EH@IE*@%Yad&h+ZkW`hy$i8wGsY{GqP_TL8m`rmTfSR#Fnqa}6lq|f>|}LBpL58f zw_w$$_1W@2@_Y};CCWd0i0QeN8kz-Zy)3FZEe8sPp6;N_&$@|j6?`X?-2Zgg9upZX;dXnwgDGRZX!P@(tSJAg6QlDdPdzeJ>Mj%xa}illC8}J%9l|Vh`Q=We#Tc2|5KHr>L+*1obYtZ0(;BOA7%Hqb4q%)WA+M-2e$T zU;uH>`mDDy(hx99)Zyb37}R;=I<8nzQQ1{yDlj<6F=S92B=!%W%%NZg$&ewZ8S$g`m}X*fI2RtV=U6KbAtFbDOAs>S4Mj#5w=MyWM#@8#HMVvm+?^o=)DP&$|O$VXl8{Y`-)rJ%ccF#riPyx_FOIG`N#53Ro zCm(=mP)>KrcNnQdGK(=D8;+G@O9%yEb03E`wn6Egjgskmd_9|%=dPw(0GrqTrp}I6 z^PKyRR%i1;j+|^#Y9T0-`8hK`zA&-~T;9Y=Qv)eBsP8lhOhg`pi=(n;)BB`fq{Sm0 z{XS;*h_x1YxrO|oeSudJ-faGHqzv;zkRDcXs9|75j$Nu<1Br+8t7bAMpoIchk!0u4 z=!EY|(tm@nN(I-Ht)GAgcfz9iR?!hHF(|F>Ia@_SaxPIAc7r=zho~=MJCYY zu$LqB)}Dn|g>-j!S)X%M`c+<-sJ3$Xi~LYal5DwMp5#%N?;o#+Q}Uyra$J6s>)Z=+ zg%@k@VbAy`PfMBXci$`}AMf@SfEQLk$O%@z!{=5)&+ca)t9gSylpZv>MccXYTY3Y5 z*yWWR9JEM7v@`OO!_4tQ)Dlm{tEQ~ftXx(55Nz2!-9=o*)9$N^`KFHJ#(^aHFLOb6yX90~D8InaM<9O9K$_y~t_cHze=A#;DEOyUuU#MPSuJillH6wOH6;cxG6>yG z60Op0GQyrw4LtJI(o5Q?gWxt(;hfcSVoZnSthm`;;hAfPo7M*los+8z_#l#b| literal 0 HcmV?d00001 diff --git a/education/windows/images/express-settings.png b/education/windows/images/express-settings.png new file mode 100644 index 0000000000000000000000000000000000000000..99e9c4825a4f7fb29f0ea2930894c78a63105991 GIT binary patch literal 110041 zcmbrlQD2VTt+VTs;?=N6`c`+fNswupa z?+q{$!9RlEyP{#=^}xTkp>4#~?16v~`u_6)MyLGk^WBK$AfoD^U~TN+tY>EgWTR(h z8j%KD}D|xMorPaN+sLI}E0f z%qkp=fY0S{Jd?Wz<6nAH{qKhGFgkeV{&(yD?5+|&CKdblI9m}R3eNvIK{z;y8ii|g z_Mc-MG-GEZqW;@gSb((Me>(lo=_;fSarysVrsc;?HZdnTEdu@*HVYf@qN9Kjt?ZU5 zPw9Ve@NR?(G>jTM!1Xgb>d+W8cf=$;?QA9XC{77>h42G~RL(`2l{1Jkk9G_nX<8Syp|jt-VvAe8sO zQQ#T`Z2?1X)|r2gHIe)mZB3;AE+}KMiG`G#EvRmcnt1)Q^_k{BpTyM><5^*&H$gA4ubp$Fm{bDdMBvtYvqRNC z1NbiZUYm#)m$alkwbEwFgAxyG`>~!L>&Svz!)7oV5mV>3cj`lY)60>m6_&7p($lw* z^0FlW0?@|h^YXyc@7J9DjH(`SJq2P;`q&Z>2A!CsMcOtGPnh`8voz+iLofOVpRe7W z;W3lC2X-74*xdpY8QJp-yQFG3pSgWINbq7-Z!>tL+%jkCVG-|t=GDz~|3URW3rnd6 z4nGewMmmC#{=Pza44Jzvh!zmN*!Oc8g839uEnWU0?%iR%!vGW6E!x1Ks)qROny`q~ zRZfO0KeZ3SmK0=P$6lOaG=9Ot`SV%rHd*V3x1{(wX=Fj=_Uw$Q>06=UJkjm=L!5a6 zvv)oky`v;&B<QA2 zIAc@xQ^vicEl7wV+mC#PW*xA#%~#GeBQinQPg>$PWg2lSL+jwCH6rh@pL#pG;kD2^ zA=Z0=*8(aT6QvAD;3%0*y_d%*gb|E99T@;wO_gZ6Sw6~g3!zwmG20us7rAd+9)h6Y zB~~m_gmkR7ja{wSS}9%tq)SFRQhyM-(+o+On3v&5gTsh#7$vzU6obmG(%f}KbyNz^Jr ziYrzs^pIm1egSNo*Tlq9QRA6c_bZm=8^F>kmFEFcPQNtSiB z91C0>!{p`Mx(b*PDiPfP!dItjVZ8Auxa*!!`vfKN7*U2qFZ0>lNPY-sgaW<|Jqzpb zigy^7wiP` z#veA2Y{F8u_L7u9IUX-#tTBLE;$;PCY=oyQG4+YB}&fFdjnfoS*uZv-6Bwt6B}U7<$3 x&dumo*zf_?u zu%!GT9ssv2>IQ#qFImJG9wPU6nsB){y9j+pDY9nrjc>#TSWep9wY%R8-D>%iXa0c5 zcW>%zeuDEGjZuMrVD`RqzGK)vA-wLZs5%y~i&s;G)e)0alo!*we1@U0gONxO{|qRJ z$@t4riMyGBA00Qwm9Wf0+%t;1f3QG>3^kmz1=&Io^a5FcUyZ!Cmeav7sIvdTKQI4La+FhqI7Xl_TiN1VVs7U)`VJ z2Yr_Kj%~i!DY-H&TSQkeCJ24p#To}sKh&^XkB&%<5E2TJ-E}e}exju0%6LYfPU!c; z$XW8f!e9BoBi2?FFX{DHkv3wQ3V1MdbvrXuh<51_ak4&`YCC?14eFZXb`qBdUKC*8 zP-s3EeU{J+LXYB3*cFXZ4e{m3%Yf!XC$Z{a6}@$tVPI3M5lr+=OCN z=z8aQR}u^64BqM>1o-R7pZ0vBe=wl2j2iEq1Doqv=MGH1T#Z_G+O%7WyjgauJ)`$S zxSS2Y#0fvVB>&B*pB63Wyqs%)e`t({k3C(MO=kAiq&7Q zEx-Ai>hzbvfL^RiHkYxm-&WKeyX>H~%wyIK>f(0ypj5c2TR7qjUuyWQ2}m`? zn8O*&c7CFb5TqkfrN8dJgwnr<1cYt^h%sK!gCL>C_|nU8Hr@`r;KJb<&W+3fY)gIKji(KsyqNj9 z(D7}-L?qofqZD=CUKS$CQa{UUPmWzxHPQs#Q?~Z@46bjYSXh4lMWD^vA#vnb-%gEw z?3-GH^IVf7SZ(mIT^uqQp?N-x(d!Ol;HO#}0x?mzTj}6>=3J+?W278Y!LYpEJM|9( z)1s6bfj#4PDMEU%!@W*kdy+f?r^%PTWxI>{Gf=ot{yvatNU8G(&RCv0Vs7aRPf^Ff z!w2St{|<*}NxG`==D3iBFN~j7*4Vw~`foJN4j8B4oDAw&CJpetxd)+wW5H`i9Ox?^&T%h+1W5dzn2ZeA zX%?_jVhoWv!|_FjWP&Rfpe4?WBMm9}ZLU;BrSJE*#?)xHkX>rL?6+0z>+zv(A=EN` zt`tGg%5Aa%$kH;+TXX?aT+E0pd&VSLYF!Q(rghrk!y$Rr7weBZix@X?EdP(cH|LR_ zwI_oTlwS@AY29tWC)F|{f@+b17!(>EkE7Z&YThuZ;l&1{!u{Kary~%G*bXKC$RJI@ z7M{3%Rn6spnj~ANq@PEzcfBzZPLPp!itjc^+0c3{uT~ySMJe! ze1qybVQ%46*D+=G^)8npJ0-}PH5L&hJ1PN9s+yyc$^$vAG(=mSaZS|0%LcVH!D=BN1e)C5kX18Ap zzFB*pVjjnED>M@QwedkX5(#GqOX}`0n!@%jhcYLERMfqaAWp9t_h%0ZYB|m(XAn|YU zfV+Jw9@R64=Lmif;=ZrZ;i)ClVYel_vZjXn=&ZPijSz>8NH6x>zJ}vRBOxu}h>zjv zh*Yh!j;c5sBymmbPzLc~Q??w={gu#Gbq%dl4?tek%S5?W$ zx0MzlnzEBmF@!Ug@TWzHGUaK(mFO*o^ zSJ7Ni4T%?4aV6SvX6D||2B8codZFf}tc1*i-|H{zO*$4lY(=~*sc)xH60Uuzn!Y7Xaapg`S$gMxn}=Ki(d@ywazLM+tigpUzf-( z7pGR&PEEs4!SZt2TGf69k%i!|O*g-k^U2AO5&_e5YYNLVstrOk!)Z z0PuNdm>crh(!poUB@)_Vsmd9Sb=4mxt27VscQA22Pi&-mA6@pOtjeOq>NyQKvvS%i zFAJ)qCdmfNt2~a$RAbZ7tAR=-=BA?5h+_AxH=zB~gA&FdAAf5;P8jzM99Nu}AS3@w zUfVPf>s|M;x69j%`w;^1n~30uKEMq-KfzhuF!YGBcsrA3llk~I`|TQRbZbX80R*1VOM_OB~-;Rjn8s!;M*?Cvsw3B)_MCL zr*o-3TtnggrtRy$x?*@Q$gVE++}tl(U0GSjkL zSEhukso`f(5X8db(vG1zb@DGt8 z4B&5y%NJC}+D{7FfH7}%6m9YC=v9Xb=Y;n80V_IU9{hgamMikmhfF#%wuwetnLvB8 z-%1a%YH=&s9fDG_h%iQ6AWW_Pc&@mx-F`Hbo3%`_@l~nU_^WE1SVlgHmxtCUS!>Kr zL+sW(=7YxWY)pCTuFZB()XMV%_9V`tZgeH=NTaL!w-xkg?jqSMRryf;-K(y+5EPg8 z9q{%GEHx*{AHpBW$Aa_mfSgzjkF_F;*}}*3ES#m{(TcU1JTD1~gAr}YMZJKz+~a{1 z@wICU#GecQPNJY^d-16)a3Pw23MgCC)-riDSREY`!%kLEL3U4H2Unarr1)-}+c2<~ z#S|nycv94+CFPZu4Hu8h6km$X^@=Q$|5BxA15;$nuN~8bC$m(8sTrqh$6EiyP-vP_ zii($JOKN(6mj_yuVFK}oVUZr|akZ!jyz!$&q%!bjO|E8A!g!eX!3!thUuK{x=_MD( z7wI1Dt*5+yc?x!mowD7&Q)(b58xIGH@8yztKR{Tx-fblt5qcntxwU1dGINBU?(4-e zs~aW|-Q{8FGi8AnqU5dQLz4nDw3*Qw$yN;23%B6FEZ8Bzx!< zm-#^zXkOp67JaW0Pyb(jH<;K+Ax1>aB}A#-^gG1=(Wm!|yg`Mcr1-qi=X^Gn0{QG+ z^xuRtZ*y=yI!n}T7pDU=lF*&M|F!*c%f z!~OrGf4TAh?P(Yt`u`(feE%S#-~6l`rWg2M0NIVna+}w=^16)Rdh$Szlu3O>yZ>J} z>CKjwrfX~*lmbMdxXgY#P`IT}d$n0*0T4C!;ylF>H=%RGZkD$De2lrA)sg$>aX*7+ zR=^}B?WH0Sf0;Sr_ivN!67}b&Qpsws``{Pf$*Qdnpz_N+4O^*<-pU%$T9h#2C88A+ zZQ8sm%_P4~#mBVaL^yt~nyRsJBP1@6VP6pX?N{e%pQ>&Witvt?F(fGs zeq!udK$l9s?qx&Gwl)+W=CL*Y!nc%K(-Cz~?oRe=(5d=R<~8NAFq65}0<oPo1n-}Yh@ZHKC_YO{a_z%jpjx>Jt!5QjT=R9uz zJjl_hD2y)Od(gpI{J*@)7R@1pS*&ST%fNu4RtBtt2T#|`AaFJlr1nW1LRZg9O3IiF zK{6v1PpF|`dW{&VsHhOt)EoS#RygWVgE5Z>K0sDmIdTSworjZzfFHnn_vP43qcHBZ zlX24#6h03{8u_^VJR6Yxab77aLMBP^PGcGF0CTIx&0?BOmd)XCQNM451gq;l_S<}> zI-cJOe;xWP+Bi=lBw8{5AhCPR1fF)j zG`hJQ6hm_!fBv<32x#r)N#8=*_)7=zZFG1P0#RC~Cv^d2N+5z%r2J}^tybF|R-r{z zBW4-~c;{hARMj4jmyg8vC@nTI4N-?)Oz8^IeV&eGPbd}Sp>q(rH28p1F6qhoBA6JO zIE6I_9>Ewbw2 zB(IBxGQGJHeQdlO8GR=b(yV=5<}gPaDw{^c;)QPMAn=Z7!TAC#_kI>gMnh6{j?N;0 zXOv^+Tp=pyVASM0ZoEJB)S3>}t_>|q#A2gHjfNwB=4%S^8ps&iq96I;bzuIjYU@bE zvxRebev-QKLp*vEGS()888_Dx%!O#Y8;)t>1ETJzDI*CG&*ZS_RY!FS>BD^;#=YkE>3qtOh!hTp;SuX64glE>R95pdgNTWo4 z7tW{H`A+koglmLSLo2-Yrg!N>iMF5k;oYWQgo?di|1;dXkTyi0LmEZUdoY*^QZM_=7wieHAjL7PDV)S!uJ0p0b}`uZniJrmb-IWKgO|hv;WwIPvd*%tXO%VTwgk7r=t7TC`U6QmFO0le7inkJ zZ^=Jr5p(NeIoRosOt|lNe=d)$6XX;wEy7nC+;&}CJK#yOM%*(sM&!Q)L6&@!JrLwl#&=D8lPRWeG$RrI`b%^+v&{dfkaz7_ zR~=D|TIvKROg$=76Xl3YqTGSb=(;)roRfk}&Z)=l7h9>=D$jK2*y32GoQj>+0sB}^ zV)5F*bed+IOua3Y%G~0etPys1_#cHJcXEe55@vTGk;HFK9o1}w4J3(j_;X2a$n8wx zU9r_1?z(z`*3pz{%z5#vqiFPp_d)x8=7^lSfAkezz*(^KzGGIhMcL#~cOL90$?MFy z)OVKpGS%G7!s7}gB2+2pVub!npdF~i9S7tN0nSwd{siA&g5{0(oB9_Z1(Lj@f#9XJ z(B-WOION`OXmmn9!pof2_#Uoz1NlNuRXtj{3!&w!{^R+w{KI8uRu5}-laT5K-Nw15 zPoSug4Bh?d&`ZiBI=ZQNdlu0dB;&=ee(v3|x&QAJh>lIr+iTn2%Ih@)jiw{o-mc&E zsSL%<8u$9Fvo0(<3N*l5P_Wc)MFsxM2Xfen zl;3oKS%kAoiYXx(@jrq8imIR|RS98hb ztEkJShH2Q*`l{z#J9eQRyiW4W<^nhUW^M5=V@@ZgfjDZFn?1=~*jdc&7+Qq87ryaR zq(DnMYMa&<-S!C>rkDjWf;+#=z}*(!P}k8=PpIJ6{)_yCS{=HpkO1vUF5J)P zS{ZT&SP@Rpsf=Xyywx$dtqtaw+HtVzcN;is&n8HP;oiaeDvAZ!>)$0r5 zjjxSppL{Y$fInqimh;g=AY$mrt|P_u=QmUUjIzLWJlNxztUuCYA==LySFEImifMmA zLu>V4U&42;!l71dX8VSchI>`9xwu|PY;?JhteZekxVvY#TB2NjkRo5vZuvLigV@{` zhB9D3;y^rw_3WW?_h-9)-&yc}1B!>+k$@4dMU?U0Av+teG9Do*>W*NQs{NO21I`!5 z2!;;>eF1&CFLc7z;v#T#ghlYGWbd+m zjeO^1G;@Y;1k`9Xe%Rqgq_$v32^<1G4U??vg&_V7UB{E6J7iyQp{RC9)S2E6*+ z1!rC6C|}1yh3BiEiifk7B!goKR12;#H5=sRZ48K)KGQk2PYE!3PNmIx{!$+aiHRtxQph;s7kRgL!yb)xW@-+|E;svqFUXSpM;-6;Wz_fU3S;McOVofJ znRlOMFOE=)pazj*8${BLRw2$cvSmm11Q`TVee>V?i4iNo-NFh6poa*dz4cr8@}xUU zh)%drQ8XXvY1;s4@K?S@oM}&IG{ng0z}8Aux4OiXEAeD(09Iul7);*sJu+>0Dxs9U=v@4Kce4)M8G{9X zG8dz`XA^`!1lu#dOr{I_YjkbHF zyGXq~C0~gr0(k0!4e>Q2BYHL9M$1oC{q4WGeCV9rnX}nj#HOGbWi-;UKNsZF#>g~AvAungjaYpk;&A6i$ z{mPQp|H{Qv=QpzU`)5j>if@q)E9eenlPX`SulM@3={fN%*84dZ=|O_Q=%iSaZn<>(4|o@vuU-bCzIFfvpPrn+U_0xsEeC1PpGo9hoI2jsO@}xBc{X( zC(q3!Fb``fs=8b=uM1su4Gv;F5)Wf3^X>TQ?8Q{|Om!wdf!-D`M-}Mdd=*7^9dxgD zm5ZA>4Fz&&i!W+86L$D6;57aEC-mz#TseLnF-J>W-eZlb_PaG7;C<&kd_>Hbx$Zq8 zO<0%4+&(4KsJRt@px{(;IjsK`=b-_2g$DFJ)!+`W#HXo;d9yDEzjYdMf`Q3JXMZh! zBUZD`9FnL;NM5AOF#(8%h5dj%NZpM%f<$BL?Vl@4F5lf-2#=Zvye^KIz{=?8A7<4< z&zS7Qaq&$@hmQkxYpY?M*hKEiuk+urfgksqIv>Boa%$`i;FCK!jGZO{XW}4Qa3v(R zPwC&iaods>f?+tUb%dQki0EO0mZfK+^PHy!^KpkG91S?X*}ks0E-?E>jKdt}OlUqX|b&Oqzm5nRr?w8@M16lE4| zV-2Y)D}(O%N452V=J8xw&{c~>lM~hR{O&InI&M&)!X9>jqzxS-dQGz;Fmb$eb6Xei z5i_h@zkrfKhf&=0c8%dYHh?D~EThi6vS&HdzmW@H()kgG7lHQXEHf{zFt#3 zO)Yo*yem(Ck!g&8nv&45Ak++6l)M|K!@z2y&f|VB#B9{n9xtsyI(yWCp5RLBjeknP zouQel-WXg<{-NrbdnmqsxcFeKwx(W_2CbN!ycwFSyh@ zXMPM{5QZA9tzqdcUbv|3H2cjj*-T1edq%Y&KQy9CAK=oy4UE#(Pr7ktX0QxrD(0mW zy_ZV1A}EhKmfD5A-u_ewjkU6gXhvpuaXv2f32)c8;TG9mv}rr^jSP)kH8R z@VY)Pj)RA-X~~ei|ITq?ww%i2NZ49hi+q?R4cAtcGFy+{)#2`=K6pOQ2317kJZs`! z8(c@QYLAde>iL51I5I}Vu$Bp(hTdx~+S%5rY~5l+mE)mvDc-x-xxT%q)~Tzm?mt_b zi`Bn6Wfc{j4@mc?9S%06n2>_!b@)+<204vZwyr$w)r!bSY-Nr(F>VbA@Q-JW<3v`g zz2r!$<_Rn4FptB4R2s1VwnXvW+12$9(Dkl7?7G|*i$01lZszhDb1xGNw;8mu z=%7CSVe1n=N6E&Ebdbhdz)B1i7YwXZA^r_dTCB$>oih1IsOAlKRl(y!^_RrfPUolc zyUVZ2nUinsk&P%k@Z9+=O<(s?NA@aSNgyUd1lS#5ZUh`O_#G{V)Q$5Ilxv8gOU=v& zXyXlL%M&q0Y1G5x%0wZ&6}V_n(R&7b)9QKbxgJm*B6=O9E8PP1ZfmfH&|nWX;_b&d z+J6flL3R&MUS0GeLdw%kxL7_f#{;No66(!wN>NDhD)bC8LRph$a%by#9~Y6Q@Kkm# zr=Rq6Ze2CI9k{h$cQ_vTnUnZxQU`LtK(n>O8N=CjCm$pX#WFr-Q=4I*`X>GJ7_WHa zni_t*0#JvDQ4g5&-?em&$KAv$K(J=I+8XHzG-E@Sk8O-3VWrYir_h${EFzgDMlA;S zI6x~nj@!i=hv5mWKsN#!7(wUR*w}kR>)xKZm_yP_1xRkDGJ5-Bk17E)oQ$l2m6@z~ zM$?e>=!^nM%8NT)2aq!dv4q#xx1QpBIu#CzYD(ii3Q*q8aRgIV*>7(A#NsMD66Db+9-qN?#+Jo!9Z}QXeD!O^;Uz-D+p%MF#)hS5lx2} zHujC*63?cq1!Va?0tF)|iZph3E*!4FcMKZFW>8@ZueZl!X(y`|f41B{CctUqUGGO5 z&nu|ai!Qy%9h~gIfJ$>7;r!nhxxBf2;EMFGwK=DXa~iWaau!ZlRe6fMyNy03#pNY^ zuF(2FHIQvV?z-cnQbo-Eg)yvaMKKzJ-<}`c{kt>UH!=5wsI?dF?U54znA>WuyTz%v zp|LtFGxPoBCXAqTlgr!i-cM`O7TmEi98>0Eq^FtR8~2w4ct3pY4f$CUlwwiYcJ4CG zLOe~;jp3oRb|rx!8$cm22VML`I53eTsbUtw;^YvVpxDvDXE(H8L}_Y8!$#p+y? zvZ18GREfv`@T7)UMOXe>hBDb;%cp*$!sI6y6~b)VYioAeDgQfq&hP(`9{WxF7q&JyN7gdUwF_$9NA}4;I-AT-CZ+Ne-Sl3njeXewI!V&&z+@v6-v?)P;EE zX-x9mj$*eu56?GqRh9gKLQTzib>1h&kMEycPwS^yp(iM>s-#j)F6`wc%}^MjueY`{ z@Y%fU!gTaP{uo-(A$@}FtGi~R84`X=Qi?5d{IaiZh?!`xHE$qpSE7I&bMF4aE5rev zfj&-8G}~&R3aM%z@gxJ)AGD_iWp)snl_@b4Nv-z{Zl6tr`xdVtGet=J&6mZL^&F%q zrRlPQKBl9GwG>c}mvOd*{73|6(gcT71r4TsSvb};cIRI{bgeBQs3EM0g`C(bva%$T zlKeaHZsrf;Ir^}7LzBr3Of`MV%DQTO1-X$`=0~&L^x(9!u!}*`ebG{Eil&eCzjyV{z8r^w3o;f84H)rDBdgdNh`+=il2_k>GFEb8y; zLkZ5t^NI=w1--6uJS@9`0N;$zZm^<-3giqfy&K ztwYxLcND_P&LVN(_zd5qmbn$lRkDcarW82@kwT7*Q5e@-g_K}&=&ynP^->40fNf!1 zYZjNMfwnhkH#=&2Hn#utV^+VfaH>m`9Y1R+$y5gm@U(QK(yy7>O_(Xt=XmWkKW@c-%LlXwNUG(Vlend%-2{dd3b5DCG-jL3eM84)Jxl^b~YkK;J;}vH`%4pJ_8a za9wQpTf*k?>)z0M-pqsg%gvkmT_G0j%+jMW{$PVD#)#~FTXxR>!w?&Rhz)fvLoW>y zx0&W^PpBC8_-iiNgIxhk6av;UQvrPE*s~vu>yq&AkXuIQ#l1h7#ZZXLr zXYxNy3c{Uihwmp3?fgA+CuUl~x40w>DYSRr?rB9SkP{2V&~Cy;f1HX#V2c7q3!(4(-zpSKfAHHQg?y&{ufYV zs%^bEOhbG|2T|H#d$ERUZmw9kw)oV*)Yl_(b%RV0E+R43o?qKDw2MbB+iXTYLnHB1(N(X>8nr z$c0SM(Yy&C$&~3Z-`3czGcx`+nOD*KKGneAO@Y4y@E>GH+YJ8Cbe-1y#mSwNcSq6W;fn!EwWP?03@>vyA zjluygMeSCWj|ZPHo#eP!6G47xpJSPH*HKVwBHwCRvL=~2002-)79ts)P9^+K`q0Z; z-VMX)@cd$MxOWsi|C8N6HYHOowTfJ0NC;I{g^}o4(x8d`6=h4na(>MZj7bt zYS%d*4z5k&XSS)InRn;yB>%OeKc=kFo>n}RY_BDI?0@tL}kj5E*rFFDu zQN-aa-jQEcUn(X0Xmq$u#YdkXBIMuX$9kJO)ElG5l_lqgOx9gN!A#C?l=Ngta7daFVDsn!-gp4f1^lXu^} zM0cS+?yzP;t2O?PS&VAB6LcC*=?rh|7#hUi)i&f3*#C@FSKlOlagdX=-IEu(r84!qbY6vGfQ9SjP0if9)%1jcv%il=*~y z@rKz=Ij;~09GC3t0aQ?Wk;OGgea1xbU4tfdL^ukxSGn_1GjxKFB>dIHBV-2MS8!7D31Y^ zbJQJq^XcbvLztlWJ5-C9gW%9kqbZ=|;Q8wyl#18?|E?a|LYkapU}hC7-<(HYse&~B z8Rk30_3J(ZZ0pf~R*`~VPVT9K{{Jxmd?uM%0emvs`FZ@-^J&;N;+i;Ff{G zRe6a20-LZK{b8XNP&T)T{9q#Z8U<01C3&xsm-InqtncAlP?ufC)$fmdfGvc%w|oD? z9v`u`d29VhKDmSOi(ikv3_n3BYxPzo67+$A=P{pWPqY&*p6i91XHN{EJXAdLki8Ii z+>yq$ti67n9pn~Myx<)BF+y_GcolcZ|KLGi*_p9gW)iAp-T}4W7GaI8;2o&_{U4C= zF^*Wn@n9`R{{g~t+;&FKSOG`>`U$Y+!gx>UXCyY5b{P#B#|3uKC+?EQ`pXScAJiFclH54Vui^4uO2E@N@R;lsQCA(Kl`)7ad5o@=Q`52_9EIQSfx=Z)M= z@lm+{nQY%p27e>Tm6PSki;s-FZw!Uk4L0kpmgwv9iPK;{;zFW!_}mo>0a>}DGw=o8 zsxB1wzQiWi^}R+W;H6E|G@8?haG4v%mjEFMhZ_M_0W-o3u|-pQ_>YYnQIvZMPST4fd@vO?e0E-y;0KUYtYsPT3m~^{H?H! zp0DzhL9kjH__uYw+pnJKOs)mPwhSk&h^=^S$?;d=m2P2_KDcTx`6E}&vJ!6EL0+fGu_uWHqTSC&Y?U^UsH8zWq6sa1gWFB(NFS-&+b&Ga(cJH(H?pkqxH$QuSRg zq!%RHmAOh+jpig+#Hq~Pyrxj{dpMryKInJ;tZRp`Rs0EmH)=s_xIOlyp3kGsnFnqw zAm6k=|588)T@@#KJI-n#ptL-IEzZ?SZdAf{8-ou1LN{1;Hc`B0QlWv@;E|jNN+mOA zeu0@v8a0eVpK*%o`^HM0_Q}p-ImLrC;qM|8*>XL zUtOdzTYjvy_*aVXZv+=KP#WARLs85zf(a&WEI!4*8-by2?oP^!;jq+u!bX zzi$Q#RC)Nwrvy--TI1EJ=`Af8mZ)3{XgH4pvNO(Fp9vI&%`-EFY5EN_^w;A7Z9kg>;rY3!^3kWrQixrq?jdj1+ z7hbrZ;Qgy%q4Vzj3uf2oyc-+d`H1E)`S}>oRN@n;*Y({28GxAQ39Jcxlt{a#dUb#Z z+@H@d8u_3FS|gQE-rJ5kIRmXUo;=*j=zX_wzW9z?-fp;J?UaEcHhohMsLRfxWWlJU zwp@h%?-zYLlb}e40E?Mshp?5vxyV{+FYmXm-tVPt`FIsFbH_6`?7vVyLZ03GXB}qs zII2Ci=zHKUM0t(h-`53i8447j5Hjfp$LT*p$eqQ${TL)S00M%HG#`Y@4%x9@#h3(t z_o~YvCp`jld)X&8KCC4&G(qhtj-dumE(inpE1QAFN7e%V_+a~hRirJX-)SsH=GPk`H_xWT<4%n{@z0yBucX&>xx`zSf&V7CFwAewy)^;4jQ~p%i>O%Wony3} zKx7{0pZQpct_N5fBw+b%jY1v;(QeR&=%7!usCzTT@%$jXnKtK&2o(Sto8c7cW7IuJ zdv0zK(Kh*PWrrfrl}~(%Dcn~9jUZ#(JpYZF`!<3a-M`XPPEfZ_1F6idAyD@{5nh(E z$|}LB@9VjV6t9EN22Z1!9BOI(!Bf{#w&;flmgUM$1@uvc=(%D0WfYElO=4JWqAz*8 zqY4P~iQ(}Jr-hpGPrRty`LGW=h9;5w1)34Z=)Ir!Lm_m%P9eji116omNsfX zX}gN*W+gr&n8BI508O!Wnj`_>ukWv@JNcVFpt2L4APXnDM8LU;6^Qe|kunLpx?|4I zG9>c8?`A?CE&^UuvtT8hpQp6Gz#uh6%Kc=P4v2T{l{oDMQ6ZS*JNi$}p>Z~Z0&5BB z4&PEZ!47YDA(t5GuGq6kKD2gxcu03Itz;{Qn1O1Pe@;-AD)(AX>lNv3w+7nxh@3y_2lv!g~L zya<-4D0lQB337nynJ2syRczsYQ1`Qm$_)M6zlz{}f3h8X@iwm~!8>id{^|fHVCX~L z*NJBv=Y|&W+^R1nM2S#aiSmA#f*0O-bUT~u7;%9-#fTYFDaN!jt;-R~)^MeY(P8?w z=iXe@nKc}l&y~aMXl`LK`pQXA0?E!T>B6nHCuPiNwfiul%MNFdeVDYIU(x{M9C0?m zco`I{C7im3R(jriN z^f!r{sP627>ViU?C58P=XqUO&71X`?m30jj@vwDLTy{FNJ-a-D%KB?DPMrc9G zGRwXl)CT$sCpIG|(%Q47B|;07>0DW>+_|TqxRh!A7f&wu$>A-SJ`E1wER-u?XA15%SvNI=bq~`0iO9x$6RRIdzi<1!n*>Luwd&Q?rTI^@UE1qy96L(FSI5`oMYA@XB)Xz8e z2fcSDVJ=VrQ)qvm*-Z&M z0Wq!|$l+n)Y&*#s^6a)QH%#FoGPDA2xjTH+*Ea7nyMOFmZ z{;KR6=iCXsQ#HM&T=#FogE>U3gx|hxm!yLReWG?tMH9gDA<#RZ()OaqGy)$l5{s*b zbqjxJp-Rsb_i(B~3;F0OA|c_&3df4^>S=r?-&Fb1% zPTIjPdx{Xso!XuzWfdI0^&lgFoe~6H!m~uJ1mct_#O@GHX>Y^VVS}9xfsUmn9oxgo z*hcDyp69or=qCpc8x=w4{~_(Hg5vtZARmGUcL*Nb-Q6K*Ab4W+>=8$c$ggb$!GDC z)+V4@?(i2Op&rPj8vg1}EUdXHyQv7jtY#7@@ox*Y2X!_+3bH;<1^4s}) zzf#}j;be*dgiRhsU|4$DPdzNvoh%QZEd@un&n1N;dDa9!S{zxsGgt&!S$?rTzQ}=# zt7C#OP5UF-vJ7n~grd6jGo zO{qaBj(49pBMip~Wo1b?_tO8(*Z&jsmcyy<<}Qj6ZePP(vHs?&RbwF7YugoO4iP}8 zsqbZ_YZp|12A$AOy^26O;*ok@PrmIQ*gPA-nOxy4VpOO@F8;LTi|%4^c$&HQJ6V-9 zr0`PmfkrO~|(jaPaH3trW%u1GYJNId?qE)OB zgpFWSkZ4tYYDRugLabadSZe;uH`2@Xh(y*lE`~93UE+ou5M0@cYcTPEl{{y!{5yn{ zJieaE)Nm2C^LZA2X$DpT;4Cot!CHW<+f$8m#)BrkZOoV%WQYbY!AwQGOr8M#rbWE; z0PYX>fsJi~0$S5t1OKvJy#S6+^-S2~Cn3_{xi+DYVjuQj9x_AeiAW1jG<6YS%2bT9 zMIbc)Ba@etIXcc5fR(%9-7WSqidKQ#)lQ)=q9Zhpj`LRw7WX)ODk>R=pz~4dR|gOB z5*cq}0V4cOq9Rx#aSID*-z6vPe!ge@>$eT}i{@_Jm0sA)nX!|N@iF6PLF z!y|p1IR_;+&hlP*YW*)-lP|;>b68;6Agpk9`3P%2oa=%pEXDRbkaSu%?7>ydg3a-# zeH=1tdc$a%fVROw2L85eXve-dvfyfVlzR6Pq?wsjBfPVSS{eQB&nRnAMzi@HIj7@2 z>?*$KU2BY8;oMFy zJ7{&NQNnNHUx_oq{uv{x9s@yWd>urq&mSqo9Yn_&S)uI)8?&o^6xeyezdGcw8Qnrb zk6hWiaxvsm$r(-iCcGPGJKu}}duOH{x;k~Sz0G*%o)XHN{;ihXbNEBG7oTINrc+B!|LnTP!U%KCmh(|aqe~o?7 z)872|Wi6^jXep+}HOI)_=HQI)i-4BL?%*Qlc7|%G17(HA`bPWKzi7V`JnEZK%d3eN z*eksA19JFZsVRiCmiX6w=@?6L+V9>{=k*CEu2R8$!ya6so_NA&Io?o0jDyop_1*>NX4O#rNd7hB)Rx_=btkfZNk#ge>p0ld;Q!g+iegrI%WTn~mPG`zS23rnCD=w+>08*kZJ zMwHl|7KF|C;mUQ-??ukmU|U5HSv@b_c1+u7v%zgI;-AL_?3XF~cwM$=-TliH??sQ^#af72JcV>>@BlA~5GyFobX>ERj zc{vxiBwJb&pziuti)1QJpZkM z)1*uWu4y!(rV}{P4#prX7k2X(?W_70(SP!EQ{_}9Q666x1zV6moP|LUkz7R^11@D< zNX|3$AaWt<1oe^CQG^l9U*-qm6Hziqz0KJZj;m$XYkc(>YD6aX`piwn%nbnjvA>u@ zHxX==*22X7y4I+rzZYq%5u}$a~rN@S%M>H zWVTJEk{P`UGT$_rqF37rYiS}$OC!2qy`8`7mO`IQb-@W+%3sEI=5jHTcVopq`U*S+ z&IR)y$J({}gr?C^Lu2sp8eQ8#q$Di4sdYX&lHL9in?#b^?b=gCMkH#)!{Sf>)VC9B zQFY(-gn1#mDwRQ1SWXBC90qpe+s!QpunSgF8BLg8B#8=eY`#i!YcUU^235Xto&HYV1s4R$(+zz(VH*Cy~;t!j$|Ut2Q;YgK>HH)(YQnO@}~Y&e^8 zI^jrkC{SyfePt6`df5?fZvpi*AqiDXStV5#RwJ!%avXbg0<(8;;#>5++(6xqa0ZLX zCW3n~w*sb1CsyC5yZtimaOxW9xB1+3ocSb%q4$j#{=(>ToKUa3eS*TQ{F|B zh7PipRsvPCTapiL9@iLsbuYGk0%X>uHNkvB-Hvitpfgz{M^Qp9B(vv(LZ$~}YccFY z)_5-=8^+YiYWPGenk*4v3=q8Qkh&x?#C>K>J&tN2=8K)kOe@|?$%|)O4y1vWHs24H zDj729jefT$Y5RhYu42#Fg8I0zg3}@&CQ%q`p!$!)qnJS4*5ec$$;Xy!g* zMS9F(xuA{xWKfLz^MuHMN`7a@2l)j7ZuBZKzCTwEZg6iu-&QxuBgx^oMXHw(llL3Q znR}Y0`{A9X(#IJyJ98SVt39N`eJ^(ykFb(kfVW{faMkF~B%BMKw6jwGR<^2c_;cVY z3G*DnrsDy3Yk|;+LbCL5>)hY6b?xos5qNh)Ln``p03sC*J^%+s1_1+xDOvGdV=DaH zvh1Fmsx4usxQ?K`4GKDJvWV>SNnU)tvHldw7bYO3TVvOXU+`s{47zkNM88IcN z=7xh!)68+&-hetnme+ROBaCyYf>*zW1fU~dytzglzr$PeP#3f-{bEQczRS(T%j{BC zVt7qyikk04BZ|{K0=hPQHvLb69;!eE2(xxsE{g5`;9Yy*nXSD;lNo`9gViJ){8|jT zZA4<-`i&Lc^5pLcVc*@{=2SNqx4W>bA1pOPRN4xL6S=ObE-qYABxrT|*?oPqP~3c5 z8@~uK9WdcU5`4@q$1h_;tB;W{g>mRVwo#V>kj(^>5}KM63Zok&24!cloZXD>mc8yz zO24dPjJJ=L{|voR(rd93#jdl#u~|&2ow-qI7ax8q*Bt%GG0{lpGT6QsxL#^is7%2b zl>DuiPP@(rYE9_Q?c%=TcIHJ$cn#VPvGO#OGxPgB>{te~a&sNQ%ie&8A6q<)EO$Lv z-EcJBixWE*)?W`BVzfMD^yE28^P7WxYkL)TyIAJ>%DL9mFCmP%Cl1O4LvolWUTQcq zvQ~js^K0i)oi#e5eM?_M!tV7IVW4X6MjIdevh|`%S0A&V0+Ta>Q=Uf}X;UpC`x|SB74T4L-Bi;J7^`lf+;%pLyI#U}GO9I59YlY&UTp&IcSI$#Y8mac0u?E4=J1+p4knL@(ZUaJ>{+kzFzBA+b^2)G@VD&z{lW6U zDp)vKAAxpe5o-l2zI{RC;2swGBXEZCgZSteY+q~c*TFEF*Ui5vr}eJaN4#jSBE}Zv z*Sc^hsIDhcl#kiREfx&AI-PQW-nroF>aZ<3y%9-6)#EZwgh%&S8ibhfOi5{yt8;aO5J#5}SNG(rrps}zX&&f8x&rhGPV>wyU9x>*9$h4qHBg2A%^&k#(AP1g@UI97noWc6;qYwNWP!E z8^~a`C0?R5&WoX`s3j9EqQHCdvc@Whj~;D8t_75FtdA(SC+A7=S4_T?y*h~nPHU*g zx`eW#i37dQtOW%(;(~Suv7~>J(fk~jD&mI5(odh3CLEsRFzLTR$hjP(Mvn{VvpiEA z1(rEIyZh~0fXNH`0;9K0Ex#Z89$83;`I4d&@FZ&Y+c4-Km!8qzT7|H%@06p-nNMZD zvy~o_jd%=K+6tQ*w5>4HX0%`|Z_IVFo@9vxwXgV5;xs!iNoiK|WPK>1594%8i_-`_ z#v&QSRrOv+iB<~5#Uy!6=7|oI-8+VukY|mGeREM))FCwMA(W*VXzwbs#Lm?H6Wp9f z#4VqNbb%UHv`NU$uO0eM{VMop#9GsRw#rz1fg;c&J;Mwy338%~ z4B;j@aRO3jJx+7WL?^e!zgV6=?6D!W(Yj^j24mPfEMtK@2ixBG#9*hgj?7`a3?3_< zvAABSc?Y_)F~ydZGiP#!_KgHi9H*>FeTUHo_f7F_p5^R?u7jht-22pgFY-#v{gqjp_~-o_T| z2a&uLYp(##E$LMu;3carg`=&}DnDLjY{S?iSElH^m?jaa~TdC)j6iS3j6zZn2z@W=USp{%OqP9@0OSlgeN;53!K>J=_Vp)~M%A zxNY=?&R}E&c)CeE_$yg^gth6~E6&GKR$ESvX+WKClC*C=*{JI4WCVC41hT7LFG`eu zdBi-I8(JLNgnsjldPoGh5>XuU^pDIws2mzd>HU@>zC)TNED?-}XI8DRjFw`Z z`mKtBk3KbM6+^q)koR&{YS-2r&@Qt#P+b=AE^%`w06c|R34;%RhF|&T0CJ`5`RZ|3 zA>Vj<-WZCRoJESiqUnnzqX7f-#qB@_sPp%9KX~9fUUBy;(lihjvH(aC0kvz!@)8i+mM=1*8)>{ROie1Gu^8 zIhGMf^p%uC#{x_qNJV9|(4mub1xNoT)bFvG$y>sb;}?LiOZva`mnE%uTci@owz7+Y zlHZ0jn|~^rk;?Yy+PXenf8-5Uln!1=spl!&{CxkB!I=@?2nao%CtZZD2mCOJ$jq06 z$SV9vb{;ob>2}QUKIfYfifzXUg+4;%sJEtDroER!6z2p`5R~mGqPMw>AOLh1Bb&bQ zRZBrFoXZ-#8GGbojF6w3O&w$71Tfj+{f&Lh9P}A&uKP1Fc1axIL{9S9)f|3fAHr}i ztu2AwHcoOQ`>c#|e>teRC17NJF(=zydI}V@}7TRCOjdl z`6J;@gkzP|589B4UiUt-ec}a5xnzcBR>lL}eXqeG>8B1(ShaCM#~+O4CiZ$m66Ev= zEn5tF@W2sbBH5Ddc@eh3{uBKH0=}MBmgHr@`loT+ESM3sFHv#09W#lt^S>)_n#d_WPsy>=shB)650g!j!w(k_ZrrMqa>_9I zanRVXS(RNOB8}_~?NxiD>K#qXojCG%iZpM$eBc~u=v~_!Q#-c6s9C(&E#3-uoLKIC zRU(B&WAnE{mBwy#Vk&v^<>xe?uxbu`R3EFC-!D6`@{eHsSTJ7pj?n_jP*zz|b``)& z(ew06^Eu%Z>^#dN>8~w@*_?G({3m;=X) z+-7zmO{Gf9Cg#A)y7Vbmiqw7**t^~6{NV>PAo9%vRf=k&oWgxP0C^J-)1Yh{UHU~1 z@AuR`Y0Meduu&fjw}v(gOnPnr+k|JE1jW4!2`cQH8}zq`ol*~PdN56vu6G2RW$hY2> zp`=LgX_1J1G4h_)kkmN(Ll<9>BHWP!}F z7FBDonV#QF+kz`iU~TRSb5tJ*`9+oC$MU2Xbfk(V^6^{%C6(*E9tGI3g!Fi_LnVMX zughk80!JDjN`7J6+{+A!8L@#zOX(!iKLf#c;Hm0~t-W_mRjTr8Kc8%Q$+nt3bB|spsE4#MACIW0Y0u@_*gbVb4tt<9 z3_wXbt0mh~WS;YoYZ&8v#3*sl9G#67jh(EAF9JF4h%PZH=Sg#K4rX*Bqi-k?6YR=K zX0!9BSMISw?g*``cU#fFBxrP;K?<`uhgIR7 zRfyj>!aXjU`8XDlC$JU6SP5x2Qc7WN!Vwc#JDUvR*6?72`vfVj^#`oYonrVlG3-R` zbEaa8r>Y%{iFGsvR8)5Vk#jC2ZP)3}Y?m(`_t-Gmm=eROFS=~>cWkmvcZ zUjNh`p3#)SvI+DV;B*eV+TzLXk;d}FmsY~^C~F}ie4Ap7;-v5W6oM~`HEl$GP`WgK zR)HV1gSO$~9U$!Dg%a-iUev05pB7pH8A2IUE=B!j(3aT6MaDiQ@s56`2g1;1$c>Kd zKIW2>8)q(dqYDCcOgQI*2}LoZ|NfUjhn)x8Og9~l?VcZrH#b6Sp!r&CCt&*M`!+NJ zjOTM&^~w_!@=rCoJ=B|jjS;DE5P-CLSNSTz+PCCG^3s;E8a2BUu<{hbff9Xi53|NX z0Ul0-d}JO;6WOTIip$-Et0a+7?wjw)nwDv`eJ9=Gcn*I91!K&sI2v_j)tz70UBzj3 z4_BK$GTeZA9kbR5uAd9Y{KxtbOw!WX`^S6Hu>mb6p7GIzQ>*J}eAxuBLO9y&!zZcy zAvy_C8RxWyvr&q~_(t4RBEq(0I@FP&lzaw*?Q7Om!%glAcl3+{F5X- zewpX5RenVik>Ru8#0_^{eIiru!*L>#D}INb0}!4FFWm!>aOR`kPkTjXJ137xKe~XJaq7Yjm=5QHT}B#wYXR zvy;FOp=kc;X}azz-fTW`UVql802O}+UKWp!VYT`!alhh{UN4$r*M&zM*<_Ys#?o`f zxdQyce8T_PP#iv{HYD?&?y5r3$%W^%kuAn3@8?2c`x-{+Sy-J}n*`X$N9#zM-+w0M_aDaLH{1>>ds%}}=!^p$h7 z>Se<5^aRcV<$*L^^*;=@_J3=AP};5~yUi@;X!~IE%5&0i{CKgmWtOPGbXii$Hle}? zik>~x^az)Gwyk%_s3CtfU{uS{eprCpvCr)qP zsxSQ*0rQ~0onpi5z28QH=Ud%=dmXs-1?F6syqNysp#FAU<+HVK9O=|n6mdJ^#N*j~ z+aJlc6EB-pjIG+cI{kguvq{w2%C40ew`iD2Ra|(%%+3G?2j)oSP}bpni}UKidFZdg z2Q>vm>I@Y+VV{6KV+Agw0&?mK8|H_u0`7O>s7}@gO--x=#0be0PQluyCP^&?8e4q) zg6>7;S}ay~xf26-U{W0DRI*VF-DM-16(#urx?>lvW~8H^9QE-MH|mh41gcPB+4S1dYDE;JdUsUF;=`MRoGexFes>>vCsJ}T;)(&PcEKH2eyrr0_+6y z4BpLs>s%f}Z%94-*DLp=`HnO7I`I%cZ+3`WXQWpB#RGN#N=MlCcC#LdI1I- z{*Gl1s+&|$F&jTyTLtT2UuOwNsC((u-TFyZfLv6Q{S#vZ5?D#YlV!r26TP?u#6h-l zEssheo(%o&E9S5EiUUp8YLiPefO(WQ9Z7Vw{lkdq$`btZ_Uf2swV&$^J;thr!iQgm zbhC|!!!By@2&&X1UL~H4mXlS66XAn&0e3)hKs80l|n_%m2>6CPp z{7K>StW{9aQx7yONeu%8Sh~%)d7E#3yX<8#iT$k+5i;C!_LN~*fo>zIPU32B zdXz|QDR>!ajSOt^l-6@D<-?YfC84tThXSjDc5v{Qj9z;f=pwfIBjkasUtISWvyHy? zN=1vOpC-xd2pQoV0}ClOe>LIK_iYHGBcQ_%6qKGtR+ zzFgRYKb?%$Dk@jh33|ktVL#u$5MXHe2ZFPkvQWQT%LN#pef<~=)g!b`wRb0(0)f4w zZxpl7r_53y1&$*XFhC}@HQ_A~j+hD*r}E{K!OT8;w(*rewx&)yENg508=Z%-`?E+W zg3MWJsIT$7WzWr;%W-qt@`x1D6v=RrF@-men0ZsEXy%1a-&H5H;?DDfs{^w}Z!;ri z4YG(rHB*DLH>$U>v>rkgaY~+5R;9NNxxgsE9wjhkZRc3Ngg?jF6!g!vHA|t5pF&Td zso5=-8qo$Ptlvx7feaaykh?Br@m{{4&mJKDhVRpe}YJe)*+yon$;3pT_B^01kH zBJeuJzWC)?2Xb4sUR4bJacr#G9DmO;RiHtB-#Wos2xQT~i~An(_Hem)`@vNYULRyvdOP4eHw zn;aVPycUsZSsdN%P9zG1(p2#ce=8c0Hrnc9zhw(H=Co8_7Tqv)w!`LoRHfe2n`}B$ z_Ga;Nf9v1vQ;OFKu<+3`+KA&c$2tjq1-cFS+nBL%fMAXAtW(yQzkFCHkio`5eje1? zfk3B9BClTVhF>LJki<5FP{;6zqQ8M~4t4{i%-lrcO2{@k!t3KO2LJ^0>GMg%(Y;wF zP5B=u()l21a)d1yNggTfg_9r&qwzq)aQQvU2MzH0zz@StPhs(>sw-bLe6g? zt`5GHw&jWviP4Vy0H5_aS<9T<==mZXr_RAVCMt$q3k*fM%aFb^L%{L(-^suGV+LN= zS7Aw}HVJdq1X1PLS+rMn5@tL4(v5CSk_93;bu_es)er8(QSS@XA_@uLI-=h9Plp}k z)NgyMAoXQ<_K!DjtSm@>EYHQ`xIFyZbJwWd9JNeeift-2e!rQ!HeC_1w$fA0p|Bar zJb&I=__%ts&;9TsizBbAuKo6?a8&rx&|QjtN<`>S-Q1#*OE(G3kM5zfC0>RYB=5cv zq;BE`*OC0U3KNZxo*kvSIZBeFkl+jP!??ws2U+QE!m0Cm)BM)`o;JR`Tv|=~EqEcfUWaEJ) zDs6x9%#Nl9R$Mux*qAF-NSd=I29IxxPP&+H6tb!i0a6N9Z0sH$<^nf+C6l74+z82! zC^iBqk;D2_#xuQ?AI@J}kfQqrE=1fj_AJF=^_=tBRK@*09$2cbB8m6A*vJ_MRgv7? z<_-8ikBRObrQKk%rMj1*Ihf@8qHKHZom&ReciT?PZ28(D(3~9A)VD-qk7S zcdL-7YVU5lPIOeV#Qt25OgKsJSa+nmK-+V^Jk5-|e};lb+g|9N;wnUK3?eh`M}Guq zEx%u#FR)$Rx%|tU^X6~3VaEP+Cy3-C=>7YoFZP#WZ(ZC2@#&^3{l5F|Ue~*w4-3nB zwS@R`$Z;ZnHMqTuq@C)RU(Lr0j?1qTb{$f{;F9_hMEkEl=Tc1V7c_dGfWx8o>XqQ@ zk@Zi!V&~X_mQdEI<#m_@L&&S%80SW#t<+5>f=FWAh%%i(=5m$4+phje(9M~{qK>u{ zoY}*YD!$N0dTiO6E~s37^*FjQ*kO@Y!4^7!b#c8{*T)X28v;;j6RtDC=EglR$~7t> zP5rmTXQHMG@a21pOXWI9XX=3SFX}<9s|FiXURUE_Tmw@RCMTy_>Us^~hQ6Lp8wGr% zh1)Y?y2^`qo*zCFeYYK|W{NHH-va2;WsW`74{s&4N5{4dh4=L6;qYqhg zU;%nxt%2QlK`_qzadxQWF+z>WTOeCC97Sj&IM%JCcXb)!;s(>!faa_w313nF=`W{- zyAyHiaz=$iyoBg$-z(qM&4KZQi2yG!xUYYMD7O2JO!tomlo=~sp00^Oken8X7XSJ! z0@A#=EBb6JxCjM#&}Ns{&@;!r)7eFD?cqbgyX%=9yQ?eE^AT9x;GyxcFUWtl@2ion zK{h;zWz)505Bd5idvZtu-wi%oq6ze}Jh1=|UUqq;;ansj!p%v~59}R@W+Kb4@4J7` z#cAeH#a~DQGIf+g)diPDG-H1}d&9R6K$qi~cQ-w7cjwCEB+mWNk`7v`WDkT=+E~8( zHY;>LFSwMh{V#h!b!-lRQP9-5ZxzzqOV)tFJ#_AHH|CM3%CQ5xvWRk%uMEgUX{M-n zjL%9Ab*>hSfVQ(MVLYFT$H>ae_vCLjW^2wI@$XbWvuWP%k2X`1&gzoN;(yZo0pxE#o+)Lz!vLO?Xh6tFg zp$|hTyUQDq(VNWXJAP1F=1FXnk;Qs&aj}Iay+ufM@<3MaF;J8pbM0Yyzx5liU$(*` zUBqMxaF$WfT!Sgx#UbjW%sokK-)rlFsybC4nYlr?x z4@POl4o*fH_$m`a)2$DDK?Hx_-q}N7Z3yQFV6xJ3XlRT+O*0_a>uCrqPun9t)@adlSSV&MDp}v3LbFfbwpTS(bx)pVf%rIJG-Cdm9C3o?Yc|_&rpG z{@joK3<3mgv^w+sfayj|Kvv8LR*gbtqsxAy#D+jxH63Ai0HQ{N5&qp?~-)$$Kk@liL)+b-gKA*U8b!CFfy@zn`oG}po*D6HJ$*RnQT=iB|3c!oDkVy+Y>*W z*)tC{T25MW;tcIAA-X_pO-3BPS|KAWB=olDB=ZH`Q;*zokji zQ=S6yJK4DLbGLBOSIXIwRDEIU^1&+C3>hmuJsws(NZh%%^4v;4*5NL=>z&C_D198{ z2F-eD3V$_Jthp`PiM(v-x3we!*+}X#$bjC6%j)t~%#?tPS5}evG`I z@=3mnOGeG7**5jK$S)#Qe*+=09T zadG@20(Qt*E!Lb#VO+&aC?q<O{RVZj*hw6TiELJDov(lAn2K(*hK$Z&h{w)}CYW8Ap8e#$YH{D{5f2<% zLC3?Bkd_NYO1lwJC|81piu$3hlIZfqgBT7($HHON+p-KJ^D);2JJ*gLpf2 z2(S0+HN*73tPk-?nk|c;F;Qc2V$jlA_Au@1O72 zHBKJtWjJj6Sl6eM`OvuT9b3kZH5@wp=zwEdV}nB|rX-n?CHiAd0HBxJ2;H|XVKwT{ zllwEjCth~0$;j`w!rEo3`qfI}043>jD%~Cml^uR)d^OnkD1$o4SdmAJ^-$#eK!RFmV zo@NGnru(JCn+LVw)EJ0vaNF6TnnD^xJJdFY zo|*52uvN+5Qi{H+uumefA?wtg$Tlfi$&(7>$LptA<>CG;=%P&%hrAdnBDP`Xa$_yn zOtt?nTwydx+;F>GYz2Omb1%GLM9)5i1mQm2bb5lE-D`5oh>f%*f{YAzq~g zAF_t~!aG@iJ7K2}xmM|WJXiL|KT zI{EdYEJd^GlkEsHo$y94!vy6Fd||va`$jVFa4p2q z=YUM_%h=R2%`Ottl6(Jcu2R;x3)ohk44;mMPmM3ikQh zySfVhsl`~Zk(YG!;Lz1_`kj=b@J=+sNUCQIM#Rmc3a6112tMpXB>r9~!;0!3;dv5d zfz~|xGzLsHSO>@sJyxJvQ z`CHKBd3r~?0JgH{rRqJzxyM1J-*k3vv8TD5fh|+nYQ-mnW~b=0wK?_G%PC*2K%VLQ z3K#R(lhuMjHmeE0Bs|F=`nm|0dXOw{?=3)HTYm)myb0n&`fAf2+V`cgdE<^u>du1c zQ1SrArzHcwHI$1XtyiNq&|2M=)%Kj;vU3SjegT7TVrU+MJ&AFFs}?JDoq=*{w-5V? zyYw~|lgED^RA5$G0Z{WC1|zY+U(#8|N*7skVrW1kPh?>DQi~j>v3%&wCTB63;JPce zY9?l9=L0Tixn-H)^(H`O`WMN_Q<;;5M)xivtGVnAK+g}oR)yXR1$Za}(5jem3DA?~WUvVuc6S0{}M>Sv6lUIEnN=tO$(<#S7zBDIF`sza?ucHX$n2zcI#W zK>n-YFEOypBognfcPBY%DU0p_SdEW-?TZO{**bNz)id1>at>d$xaN ztVOysdVx@~;q_mQrd085#MNlT;DQQSV6g5lzLR2pH|7xCOLo3dKLK<)>fXp^DR(a@ z@Bnl3brDD`isag=i&8kHHGh<>@dDb}(+X|l#b&;V>srW;D$F}m92WftsOp2j7D0pvBk_Yj*%V`H(bsN8%c{vtLMn@GB80SS6h7=-doym*s`-#O@bn?$|{Vf-#=3jIi^~-!x zoC~~5rK<$C$ZDBoTopMCT(YQ%B(FVC@CW?-nbsqtW5e*@<1=*MZgG-7N=P0CKTQa;4{&ZK0$sIBq8<`f^b%HF!ryStO>ty*5xf zZ($CTh@@*;`qbwn8i7AI6p^FV&%1;Sz3W9(0{^9yGWe4@+N2B9|E8sz{ue$UDWnZn zZB18-q3te)5W~f`41d9%>Nmy~s_Gz4T}E+Y$5W}}(Do-fxEL64b;3bSrOJN-sn-9| z2=V_=N&Ej(O7VZU-VW?1WQIugUwi#p{KEeIc0?Pn-|>bu?BSu^nEA?JBJ1hVyXS`y zE&u6*_Yoc^sQ$i~|M>|wpu1-h=T}HS^6CYO^Zl%Hr9DpfHG5_t_4uUMk-=+96vGeg z!MPu!a;*^oC2&QLKGPB2p9P-q_LK4^`X=>!BG1?uGBLa=3PuXB>lDhCiN)vz9_gLT z8$UC+mWqt7)}w$MDJa3b6e~NhwhsZGYgw2FBxGTo?T=6Nu($4Ic_%dqYc_2+{DoXx z>?cY-IDiS22A-eW+S$j^1IPLh!6fCKQ$#zQ4n5+aPE!K|WH)tfG0jgTB^X&*wpL!1 zkj-7=j|=_J{K6BVQz*^mq$HlqOzRI}fxB#IEJRF~D}7?H=E|CBi^uLumkJykfYK>= zM^w;^(Sx*^2y8Z^Vd{S4c-E|LD&he~G=0<8S$*jh*VUjY+;0gm8AiQv-qnb2*Mb3U zej6b(if?B%dAI5Bky_^@A<>OoVw*oo~$d)gwTHim&r_ATja*C4bO|*d zW+Q)4FCDthY5p$dLtlBR9VfDPs+W*!4fX%~fi6CGKp9wr-X>v}&zp^Kvln^4o~zzo;K%B0_t|mZALEr{E0M6AdP~X$}e$N z3dMkaaA1_|&x)(-ruFNKwQiVDvN#CZz{-fwG4vy)*P&qjjU}+lwT)EXfpB zbn+BkJj1~kjAA<>_-c%`9lb12w-aLk=iDTfT0%C;GLc?5MvG24jy8N2Y7!H34_wA6 zh6L+g!aAw*rJ6<89m0F@PG4zc2>`SyCgsZxk^WQ``<;JqV8MXv*J|S}w|J2ma6g9l zAxWi&KAedmPkKKpPt)CxP{8t&&dH*w-HrM@&`Hb3vDBGg3!SR0rD$x1=sqhnSz+El zjx2|RCsBpNH`$TgXS5!ykha}?cVE#q_(){5M?IYa*_J6*(Z{PM8PUt0BseQ43s>|M zovm>A_817`dwVJtvt7pxE(vEnsYuk zJk&8-#4LO&yNB2oam}(Wr*OL?5l-UGv*`{UM8+7VXtDHg>sTi$;7f$T3v2f1=Et#ac_Tx_Lxq|_lK1fv)2s10 z1s8RO8wPRyhPHF?*Y}rT$eWe`!ztk5cif-)bD(Z2oZq#T=o~jCJ>H#)UQSdSzp`U^jMTjS0R4^0=MMY9p(MuR^RnffhTOkx`)i;V?4y`wIKOYsdGQrbaT0*rmYC z1kR}vt@JeTBNB37iFXd8r>&YBWXFk}j|7J27R91JGakin?$^vwO}#YdW7p`;L%Jc` znNh2NDI}=>yFLb)_irzum=Xx$=6%BW-@?zTm8cj5QSVkNYi^ZcP|ZN!@;Y;sHr<;u zH{tV6qPy>59y>p)0EAtY5InIW)tX=@!?y^lTH9L-`t(hFC*9SkhyZlQ?4Pan$;8Ab z;kIbmaF33Xj=Fg18YSFG7tS-jf-zTa4g)h-UT6wbe63wVE3obP&CO`d&LQi4K5?1J zu?m?@yiUS6#>x7IkIaeJp6Vc;xQ4o)G5ucwoC>>1kViv~A+-c{W_+0=41r{~(U!!2 zsr|rvGi?EYYM;n@P^L>S5m+nYDkIQqH76<+GAS*T{w7@b03Z4TMO)*3 zBUZ4-~VRj7g+ zCvAWE)>3NH=D!)nvQ)N+(diBCNmg#SC_s1qUJ=JhUiG&*r>*#sNSfk9?HC=4BuReH zR7jZtC37RAZ% z->WnKjix~T;e*M#F^%-_|@;gM=7W=f-&~Ro3;ziUl;l4r%sc>D_NR?^9A^liT%8gT|TlN#3a@G){sJlAp_EpQ$i!&op!-r z8gBF$9y}DOD`Zjc#}IC?R)zM6t-Q+yU}iT|gCd4T$*_*5Zm{c|d|aqNeVJQoo$blL zOej~!8s<*+283?GxER!x@}3I9`lamVURyZl29@IyiXal&e-hCNM2&ULh#%M67odgF zay;iE2J})oOXfN&Two!rw|R=0W=ugAQphZFaMa!Q6L+eXeyQGB(6iJ-#6Zew!u4H3 zMctz{vjm*`Stz;J3HrGf7H90vU0cr>4m*hqa=}ysI(cZZ;d5u zKf`3@5Ep^aezB>$z9d&?#|a66=Am;lT?j9abM==%UZ~vco1_^*FY)KTWe~wgS@1AT z)$ezq4!58i*?U$sa}12K9`}`^O74TH7}XxD-Jp+=Bzhm^6y^a|MGqT{2-)%@+4n@I z6KS0l4b2~P4XDY<$*D6GPzK!!M*}SO>;-YV>^Qkhvw6Fl0b-bUY$`iPOh;5Fc(3!c zPZG7ckb(fs2%C|+K=Lb`3j(}eg9q4LtRZ3k%osb&EWB@{EJC3u>(xzEW;}OacJ505<-u>8A3VMe0rQ9<+qmB* ziEzI%Ez||=4+VL}6Sx~~XX?V;I+E92NhZ)knzIq{`nw|H#@oi&=XDa-UzqB89X3Ox zvUEa<;+E=lwK4S_4G^bc$1WZ`gplzaUsrhPiyxw{@#jO@en+he$Q&*KC25l({b@;PyWNo@gB8*eAX(jmV#x0kZaPwpCsRty?#c|FL_2}9z; zV8b>Kp@V;DdOUn(C4#W0)9u;L4@>VI4AW*4e9SiWVW4uOjePas2$+$aJUBTH&)?V^ z!S>d8@ut4$$v#vog&Js=P9z6EE}Fm~VU71_ZzFm}pbgV4xp{yZY;Ur!hWBiRRwSfB zw1avE-D=8zKZDCe%0||JhiCRwL3=z&*5lXqWPe+sZ?qqp8d(>E%lhXhz?phoa!Wr< z=of|73<}F`8Kh?V%V-yIinzMtv-=056Um*LX$z>UW?8YJtt_CejEfJ2i;E4uynh&+ z-5ogILUHHhc!ZEVbmO=P_jgma;cjh-m*@5;d9_7NO(X2A&EQW0zx4JYXh%Ix>K~1J zY3ok57FcjiFO2Km2AydSUp_hl(adw#lsL>E7Q?Z_;3}a0t<6o*CfXYwZua>8@!_!b zaKybN9tk8_cT9-o*b7Dn*6r`_0xR}SU41?4wZOGwI$`dJj&Qdz$HTL_(0)P?5$K68 z9vFs5l8WbMcg4-aJE|3v+sAiCub5zEds@9>iyqWxB_}D?^neeHja9PCiqcgBqj9UO z8q>Buxo-&KTY18lj`7<^hocAO8b|#s;Fu-rHH<0t{j{NNap#0MxLKLuz8MLa(4!Rs zeckaD$4Ofs7u-1}26v5R`7#MII=coEjKQ4(F!h@5=uG+h#0KKiy9dLUeY=k1Gpv<2 zNnk5HJSBmX9&>zs?@$DjC=QSICkb;zqY!B$EX~d6o+?m4;x(~DAm|wJ;e%uF_QrE) zV7upYoZdu#0FwAy#&*KMxKM+yGQy62(S#ELupc%Z$zmUx!kle+;hNsC;F#~##vk|6 zCaxbHgLx#LWHngz&AX@u4V-By)9~pzz9D5F~woKmzy+~MWS^mN~ecQ9fv=DJedPdHBnergDN^?nOUqod>(Hs-h$XttV|<@hcwxgCe6c(c;LKP>TsoT%ww}gy!`gDz#hId(Pb!{yXD8lVcY-r9KgD64A1jW4f5GM(<^cz;|wHU<;BhvMo1t?|;eeelqid+_q|eOU0}ZlscAh)0ni ztZp~Z=@pdLC`a?)h;|s?GYoS`Ou9w5qf2WaOor8JO3l>rY?_XmEnyw$51CL zNw!v4yX!3SO6uWD#~#7zereQJrY8;8jr~#3PWFKtboTRohytC;vPNWsGebsOv3GjEd#*MU@g)HkZXR_nF zMuWx8(olPo`oyso4i>nUfp7(cgf?bC`31OT~ zSYzsQ>+mq;*t78jtW6AUC@8CD9HgFDcWy}q@)$_F#|7h=Pj=(^&-dZ=HAi40t9&Gb zg_SIy#3h-8=*88CaQ}NdQCLxpK3#&<{;v5iugCqL?Z%Gee8o*QnD9U8J1+*K0j&ct zYsqFTdUYdqoXo?6V>)9>&qyr#VjrITazCD0z86OiXP}-szHVeRTKhZTNLCTYVhKLp zb`~4=r>gN)LECtW1oQ(Q^i)gUgy3++PPa3A%&d)+a7&3-#ZAF$_WHXa(?8Dm~p zhnGLzgD=)6VH*3gie&m2`|c&$d$-3|VRH9i*!a04*wqE!Z%?9cF}f%coLbuAQucKg z>)N;V4Dw4V$!`oR4aMd4$SZ6$2BN84wt=f13HDQKaK{&kNaqC5TxJkPm{M+#lrPmEg$S}>(Eo_TvKd^yH^yM)7;6UraH*@sff-C$)wqSy)DpIC`|Kiq}g9Pf{e zj>d?%09-x19R{@VKy-i`$4Lv4!*O!ra3;2;D48<7*NGd47`LmCmw$C_Yw25HFRbYuxeyR#6Z^AWJ(1H80X-P$xdXB99EpC~&Oq?|rKGp`S4mBp1TyNQh!8Q7;e%jaO$ zn_DsC!IiKf86`Wu&iAa|GTrT@0XzM~sWh|LfpT#6Bu(e=O z&6M9Lmjdf&+neMb9s_tC^O{qRCJGfy;yLxEPcY`0HK_ezK6(ymtHd$mbs_6Yuar&n zCo8&Amu!Nr7sICB($40gsooUx$8;dcOT($u0+^Eos0IsIj@+hIc1d|<;$$kfo+@jV z{!N5*QfX?uTAHej?M>nqI0VcsEMPAEWh_f%7I{?LY3o8f%~_Ti^DBA8COJ+U<-V%O zV1xzh-hDC`E5ALAqX*MqCClT4v_pua^rx&|iE`~oBFe=E2y@D-Z>w^g?Nf%Gb>Q#Lk;#5>j4^$+7+@X$<_Pl!)+PCsS%-~lP@s!Qj^|F^o)Z}D?GTN~<^-y0= z8D-3|?b6rcH+AUvt3k`Y4A97l{#_L$N=(0B>$R zfwq1QSjpL>0|%<7y(P}HUGB~_JJcIP0B9oZiD-8K;I+Xdj!>0PjR^&y<(jGrz~wRv(}2-_y|QwDa> zdtdFvkdA%~XpJa3n~RrM@5hD*Mq*$)AG|ZG3$`WYAtfmbR?d!?KRq7LaHcG)6SARK zZnsGrT0)lF-5srwl3#(oZM-pea5Qe46c2k6*e5>Uq4q${7~2`MX;Tx2wr9{bMJL+L z4cGVLtdM0<*K#*U_OS%H+bbKX;t5X1@z}I@j2RPy9+BSoV%tghy4k7yPZF?XZ%;kR z%Y9e%LMuNP!-@{|EWurLEVmI{8FWN$69ztCR~ww9-Fetr<5reCr+X^|#)ZL}ICkV-z zC2(e+-7&K(=Jk(60>@2VoiVTwqC0c$57#lKtG1v+X-R+<~KM1=L+E zrgsU!4HG&ev#1_noMBHK(+(YjTwu!frQ}v%Sd72ggJMIuty$)CD-Yr0xqUILe``E8 zxeFfsVlM*S9AGc2n}h^vCn2U6&`g`QHe6?!p0o>Frm^F9S(&`|j)7=Jva^C?QdS=; zsv3|G;;vRj-`sc%pWoIWqk2YQaL+Kjx#ox(Q_^lBq(X$AU40M_v(MM=N>eK+U)(>~ z!0u&?QipkLf0(BO;%NV$C#GN=^*e%NXk3qQMfQXkO5e$5XwjLC9YyA6As!x1B*i2j zWHKn@#OBqXj^N8%`(s4+aEu=iNqG*lEoN{Od1&(De>@yybGC7Cv%ONb><>_@zbsQo ziUY}@^r@$djVfR24REu^j^pPMML#flN*6pls5PRzofY{}g%d)u+{Cw(RAG10d6F{f zkaCHAI?H*Ig*SgVi5EDwzTA{#uv6hwltb!^^moLhgkan_t}`a|ZH-5l@5Ne@k_zi) z+~U$CUqjd)DHFZw?7oTaYJV!$ zksyzm7>nC(HQYx1^e(yOEWgBKKhR#&3#wsNUWFU(7z8VlDj_hkU&vbQnYs$`w86nM zx%7iYxPMMh+}Jw;*Y%5FHyHJ(L&sl;%iDO&!C5ARgtH(I4|@)BYb^fhBuuJn)Xytr z#bWole4HT3akaNVt+_c)(K#s-XWm*4)~w88ytVNZ>ggzCHYgiaS00ijcFs;YgFi^8 zon2gow473$%qv&7(o=Fvv3BoSMY7t`aj!j)hMgy}vFCI)PGprLI@lG~bWksTcL-b?0nk2c5xB z$1;(_S#VKd1&(Bws(^Z)<*weB22%#0Hmq;w(JcIQFde5!jwFc5Y(+NWg)rzAv;J>) zCgXTsB?fg2L=9&_mTd0_8&Bde^UWF29&3(dAjHKE-!Uj`-kXY0&f*fnJa8tb9IvlE zhB|TnJfz%`f^zI&ur24z^-yv?A_JV^O7d_ttq@z8zl?ed3v`7AXOxbPw)pN)Dn8hD z2ED`GkyKcTJtRk4NJO@>&Io541bW)z0KaGClprC>2fmzGjDK2au6f%y`j&!|4Uc zl}*hR)kvZ(-8nWE@6ZM-<@Or;PF8!0spFkz^HEV!jiW59lD1mInesuF{T=(K7wyJ@ zf$liVJeQV_L$s%p=L%rUHnj^_UkV%d0WSPd%5r)){N*i4&`_H{&S zl8J{t--~Sa%g&TMc#xEb1-KxCZCkZ36>Z#XV9T;T+;oQaRDyjBJRQ6pki)^W?^G6& zsQdNQqbCDc8_K!nU@BH@KCS9cA=yo#?KhHKq*2bpIb~{$2x@3&iR|NS&f=>m|IXxG z)sHd(aVJUWLi^p$K3#Vx3%R8Xh>i6m%cgki+k+1GFYc&72*&H zn2;Jf5{3Sp6y5X2M)c_$g_{Sr$4l>T1DS`io94QDG*>sM6{&CcoI?|32xXZEX)9~! z4^nAoB}L`fOIc)fshD=ZlYJySJxBD%fZxnIC0Os-p9Vi?YlPBPeq>(R7;Z`(N_!8| z7c|O*g??!t`&w3Lr2ZPV_Ym8DPB!FnEH^YX;%sIS4rZ0mPjFH}zs1pl5?=rDa5{FL zI**}kypYH~+CV?CpJPGBh-wS}lvCcFJXc&^ho9*Gk~0gHpE;Xdgwtp8VM1SZ3nyGN zU*0IoK8CTwqpF6UvZhY?UpxATXQ|thvPqiPR#C5mIPnZ10sVsGrlh(al@&GEaq>Lv zCkM@xyP~X0-6s5W*I9J-bx|ux>GY4U(&vQJHw1I+pUt4Jp?)8qoPei3+Nma_pf6uf zViZq5pCaw0AKS(LFJ(Ipq!yx-`lu$c-NkmVV|%)A64Ahk&gYxYBJpgV+E}hujdbYv zcM!rrzx_uy9-Cn5GAZi!L;ZY{!&xe2C8Y6yEX~RQ78@qRSH>*A2B49v>zaTPFlC8U zW<%m|WJyz&U1i27WvOL;<3NxRFN0g%j$+xew}C-kc?dcoRVD|hDo<`x3AFk|7D>yQ ziz-LT<%~o9+*@u{2t-bqWs7Dcy)4r!Ir&)}n8zoh(hlZPc{TkA zG@aS8tKXQ zCB#blL-Zlv86o5sO;fst;MS2H;C0=HhIWc(W#`Dx}He#bk!k4e@Y#ijzvzdG`%9J)ry&{X!AM2OTa!%^fbSmfN zoRoK|^5ti?{5-2yBz&E$)E=d3mUHL3I~n&`pV*)#o7lQ$%Tlh$A+m`r%B^GhD}5m2 zNOT~wN*z+Clp*=VUii@w0+9f*Gbgqp-fus{TB(Kyh{V(kh-AkLb^zvEy zN8}-SQFV%*)!1b@+I8u3sgIb@Jq(Y{h{v*@&fw*bc3||Nwy-7f{_KZ?29l#eY+BkV zb|SK?0trnfkx#oVs_9JYJF$P!i9oW+?N&)Ak2GM=RjkyY|YdbuU8%3xZt8)>7QsISKW z63tew4p__y3`l+yL_SF)ZPLb^lrQCJK0)f$>XAC6d>PXsi+t9hMogGHcAUyVy#(cd`X)jxn29s~ zqx$(Xz_FrivSBH+j3OdR82SH|VGTW0Gxi*WF*`ur`wLJG{ zL4u>2O|xv7b^aO9NP)~2<g~=1#M#+wBU6mLfZ9feg9h__8_Yl za=SxTm;N2Wk^00$+9E(cPE5N+uz4XQmXuVr(zbc#Ilnq2=+Kx|fQObEK@w541c zLdMxAZP{?3&G8N4?OU$bI{oI`uQqwqYJHk^9z~V`O=Sy-API@II$kK2nu9f^NY zKWD$V9MPZbArgK58YG=ObnxG$V_(_WTA&s6BR_-x85z}~L&v}1@=1=&rewx-;j?ij zBOBhtIcbhl``*$isTmXpv;398EuSU5q>;2*dbuW_<*z_nzLi;woR?Xc2CW=*o`2=L z98!N-6_(EFg@@$ns4d?!q{%JcC7+~~Hc1`wU7f4L$UdzR?Bk+-ayz$Q6zpULMyrc? zeC@3jF*xa%g=ZdehET)uEHWD@xy+r5wCGIzL=q-YA^^8S+`K$$9zS5>k$qU&@l}@>kVo{H$G zdE{uR&!S4iGQb~yagyO0Pm4`W?cEC5OQ$2;*V#}GkC;~8sQTb4^&rmJFn0`elq|6*!v0qJ&NS}x9;xl?h@T>+?}`(LV#cag1hVCE`xsUw0J1&RjHxDK|($igCU0wCMXTItF7%FS6svA*7M|5Rcu=-@Ud|^|*qajnT>NEVouE^uarMaaAy+b|JPf=}nenh;F%CDU1 ztLSux$NAt)SuNTaAO}RcBfGK@G48hL?C*jE2GXP1rR|SW*zpEMdLlW%3C>pL>H}yZ z=P2eEQ zz2T&qx^^-*!D~16LEj)}tUQo|YU)VzBkK#($CS z7t3`zukpzN)SUwgs~S;L(}3_LxvbUYjQ|%L*0V}|uV_rXAL1x`S#1-l zNLo?@T#)SJgm^zEc-vXxY-Xuid#F#O2jac#)v_J380E|%ad_taP3psP*=*~y2rnec z>;v^9A95>U@ESsWr3T8V)P#JFZAREznj$^OU9GLuOvfvFleN3VMkXfvA>6}W{VcY+ zxEjL~eNjYPlb`ku2&a9J2>Lr%qfdxCf<5eTDzB3EL7mW9hq>9If3zn8oosNvv=055 zzKF85(TVpC^FSH(*)xbb^R%ZvoEY<)Q9+q(IdUEm=Zz%R`4nwhzKxP5I$+wY;wog) zu1*!#LcS?8F3A@WyuYNXLH$&CF!K#&8>IL-;ym@=M7bT; zg)(_W#z5=q<%mJ-tM7cX8-c8E|0oZ&97rw8FIT^m0wyHUUMYus_eef9G>UyBnr)Iz znSP9?eH7?MZAjjJg#c6iJ)=@b><&XllZ?KorgP)1l*c15NC=_zC%? zksLb9FYg|JS~Cmm+jAaIUY8DgI=bn-!x6{e}&5`wACR~w(1BY`kHa!9lOiHEmYrx>n zLHKs-S=@R>Czfx44eL%~Tuf23#PrUTQ z0n8c}j~PSbRIvK;-a)8nHp04HvSfoP`rM=%M3o1-;W9?erfb^ms62Ik$| z8!s+7q)42vi!CPiiG&RYaEte5;r1~p7)cT-->SKdMC=F&SXN$zY9jfF;^8+Y!QR0Z zwshz>jZ4ATn@-^RVM*xA;4WXSy>&t-e6i#Jw!Jk8adgyMvnnumc3))E@uejCVdtqr ze0*Df_49Ej>gM*bDfsxugIMs$NDS>3jO>yse0KLhJp27YjOY@G7`D5Aup6%6D09iq zbC^9k3D17A1xsI>O43^ocRJMwXKTE1M}O?kEJtjJCx&(nKpUO&GzRTMBulcGrX|V3 z{QHM0(sS%|5q^AP6pH9@Zyy#1N8X=Ghdd-L9N+zP5GOvp2Fv$mA|tl~N9J6Gk2jve z4FjWa=lEo`0OYn4`AQ$6*LQCnh{BV3=-)E}wv;7>#P>#~-FLPG&t8*`W&5+S_my#| zY-mG_uRU%Xn~e8KBIKifp?2o*CkYwPdylfLZ7+;LBS*C-*}1-bY8002&A}5>yTFLS zFE!8wT@nHr6zj3^xlza@p__Xq90L;CkAGT*#;{J)LIFVh3RtBc|_YFl!Wi81}BuMcvccpx3yq)C4Flfp`i!e6D z`h6LwqoY}H_Xyrwj>X$fV|dSS+%hs5i}z=!e2nRYTsT;0H8sbo$A_YjM5K}Z?b^YK zh$oqHakjxNqf@c*bOAoNsSoO_>k!C5eE57RUbw0|b>aeF>h`8F$yi3aAC($_NCtNK zKx8Kp7;BOb`Mytv5Ixo@kOXf42Nxf0K8>HA8;fQJ?JnV7m^3H>pZ~B2Pq7`R_lr_r zZ?N7MX=Yg-H*N_{rMnXys|6ONmxvI-#ydQuzbf^ zJT$&D9-rO=N9mJhk4Z%a?>*JASgEWA|1tZ#4{b4w#A!rY7)js}gp(xpWdG_B>IpAd zAC5LKyhku9Ngj5dD#C>RF|eXvnLH#>4GK?Xm8gM7G<7(Mwv}62jokby+&if=Qkb_{ zYYU#az7Kw)Z5GQnlbE&(?Qrgc!}0z89PE2(EQ;z|F{xVst{fDjCR(l@9)nhyVKO(y zs;95OZuYf_odS@a8i<8U*=Ihx8h#{IyI7au?5o#MU$T77UGyP~_hn+?gF~_XNS-2f zr{BL4pKLjgd&j4uv9t=~2E@R@)*8DHWc>YqVX5PP)fv z(&#=0=_lXcjEVnP4wJT41T$dDXkPv7nu1r;DKxM%%4))|%-@9vKiJs*^HLIp76#^r zKHq}rBjVJk*@cAQ;W3Hm_slXp`R+!nK9~c4S6kfi`DXM>@PiwPR4X0Gs@2Ev_~=-q zb3{3i=O%U!gdLsMhNDH8_4azax^OSHo-D%qYfd63vy5doLDnJaK}Tj~Z;J}m;X~gs2?ZIO&{DhXKHpEAGU~K0Q-1+_{y!P$}yhY+BA1S-IA$|tA&QVz7 zxdK?K4{))WIBGo2fW2&gE`A_^IJN5>X7mcjn3q@Kp|{pz{+i<$pB~*lolJ;9)YP_N z;+rdR$1AIG_IxpkRuUc_6_2OyA1N}Ahn^Ml{R z!O9HLK5n@3AIosZv&%qDBb}rC^99v-|HlJ(p68C|R8wam_>?mEd)lH0M}eUXQnpTZ zY6LHJkx_pY+iuRBbvRs9j}-^<@$r}2arfW|^o(#rf0DeBiQY&Gp?%P@Wwqo@2Q$$< z#usgLtR}3#4CG~n^E;ngfh*rx4_i|+gvR@m=(cba-#*QrSK6Q!7L^&NcUK*!jqGlJ zakHrv-8p(59OsT7Rok4@@?`##x-0+v-;(~Mc~uEF#-Hz1Ou ze+l4^jE+Z_7$5YE^TD+AVAPVZE!vxnX|yZ(sGfW<(t{)2iCz8BJJ}a$3BH&$Fp@;m z0`*kFL(eY3L*MK}f0?yP3PhZ%1ExK>3=^JRuGUq1Zb~XT#dxDnq7NoAST&oOsdd1f z`(!g-d~aR*x1BVQ_{c2h><`xC+byR^w#K1vdK5a5Pz;D+{YZj`(Uz|n7OOsbxB6fn zUVZupe7F7-k|VruJIUmdt!MD~ORMlO37oZjzs3L-yl4Hfd{j3yA}q)a(}yHr-?>5@ z%qUhfk`kD+OR90hpjfOTF~6OCWZTOp97^S1Xl;*pQG;`xR9*;f)!!nXN(%V|9K z+%l{r(d-rHOFI(*8gWHRAcDP}antk5am#1hvH5r&oH(#pzvLjQDQJ4UH-^UhV(E@k z*q2d(mzM0uITGwo*Pp;}`oexOZt&y4LOlv%UzblaoXV@lQ{V4HIc?dId0qMLdOY&+ zR(!hUB&K$eM`5&cI(b>jBe%2`^^{K*$$aSL<#_7reQ>q5#v`=d$3EYIZuD`DMkdHC zuE*Q&tih01Rw3EX70x8q*=4kG)^+KIlX!&Wtsm?62-|7r;XK^XKb8Z9lNiB1G9t+j zOAqA2$-)TN^$0?L5~cp}K6r?IM?D_Xq2q6WOP+63>(R(s4fQfD->Q}|7&7fWJhosT z>i0a1>qaE07vy@4e;+;X`3^??Ud5)pS?#|ZVMl#q`9a({ED5Q>p7?ynIkn>T8JUGp zAD?SMO2kw?;Z}^&Fg|$EWTXjwQR!w7*9r<+E)01ipMmU5HP{~NCSY_G3fFq;yIufqz;tJG|1SH)!5B=|20HfY7!MsMM;Ehmk z%>13L)LK@KPL?>g^me$r*rS95MP4433@d9J;c9C^^3u|=c9A72SgxzHHP$Y;9zSMO zW9Y0eVQgj!TPq8a$aYx-G7|<8+E4H9i=j_16&3~u8*6lVWEuL+rr!I%f_WmFz>|)_?U#sk>s{mUb+^rZuMk6>P2$uSC$WGCwF2f5;tVMCGN<3G6JUe zb+f^33`PU*S%{#?A0l?fCqPjpP8L@o(A@?nv&z^`#>|U1%KHZlJQej6h3&ZMcnQ*I z!->~?3ZwKF5lZr{9wE^_EGVzEpCi+4K2?Q5w|bieyMBwsgA^^-l@Pa|;pr#SS`5wOlR z)ce8}N8s51C4Bk7U<^tN#;AX+z<_%fB5=Y7xZ>t7V8ObSi!I47me__Crlzo?ym{p! zyD4p=k+K`uBBA;m>;J{-<9KXhXFNSN0mJV33Vtr^PgIRc&41+4oa$TB29!(ASBNdr zCLJ8DRRC6Gp0d`mA6Sw!MRtFR!~r;a=usp``KX0>)q6FjtdG=>iW2!`c2m|ElQLv! z4Q2Zs(7K9{|FcE(7h*3wQ(RFCPcJ9R#`Fc{s($jm%9+Kp)Z?Gw5Bz|t+GZGAo2ti+ zCaOP6!^j_FwsoT-4>Ds`K>e7Rn{!ZTtQO#ejTtSAZAH6QeSz)fNb+1J^%Z-eytTB) z!jc-)t-BkC&ljQZqd%gusRxYxCjz!NqzQH>yPpZe(N^#7>h%yP` z6#rt$yk*U+W+{vNGSIUySlCmbxe(Ss&8*8kGSC!#G%&q6kL88x8d*<^{k4q+mDJYL zwX{-v+1g-Eza?t{Hp;tlEW5P40b!mFnD^;+ghhF)RqgNkYzqS19r4@`M=|97?_oLc zHTX{dxc$R~I&}OEp!&#v4R)TRd6nvYo8g@Tam%0>j@E1N_#-1xb|xQh{&bi=#spuk zKaCe&7>m9!UbySZ?rMD#1rnL99GzK^JPc0u!=kMx)gy;TCL|-BY44lR1+MPSIKL+Y zThA2Z&54~bd0Z#h@;+HW&yjy+%^-0O?Pycyx1K4$h&WF?JifCU_^sHVkNLBDV_4^4 zjN>TIlFp`8-oa=!!sN6-yz|o`)Y7?_8aLtDtGi=RuW(Ges=IQ!u69<6$VtGo zoR|7at`Hs@jtsB8V<28zunm><#&BW~k~lN)}vnvXOO+Oq5fS_gs3#df}QeDQZ+dDk7&j^reqQ!iwC)6g z=-_1SGAYE3IW`a7C81B}5L`*3 z>uh6+hrir|*RJcy0B;I6doxTP5QQhMh{u_tYW4Wf+{y?~UD*XA2FGG7ZBZ6;6kC>c zii}x5F9!8B)fGbrMPustRK%qOqFuY#Oon=eoP{4to}(L zq(2D(@OHDq#vNx6;%SR5v=?a)S!+w|(}ubgdtG%f3s?7yz}Rj<7(E~c&Llyy=8^=< zJty)>PRwxUpm>ZM7=tJ;M{Le6!=$^1VDa*O*ppjH+p1P$q-!U2!j$eIi1KqpPGJSf zu?d`noKkNUb*<y_OQ<73m#E&1PoXkVDnChgd#gdjQ5Uhcah5rY%F@#N$# zSiJ5K+<48=mOhK+$}cFbrEiHzbAQR<9QFgY4ez-%Jsgv}1dy+_qLhQaHV!E6X8Xta zxzc~MBA=vbLe~&Psr&#eVhZ&;$&Q z^Tr*ti|=HBNZm@GGba(1HMGQMsFlpczIe^OW6&ogQPvZyqn$?i+Mw^K6udAp5t*g6 zsL3gZuQUB8`%fcD>c-Rj?}KRg=kS;f?)6%-7gv^IqF)z`82BQo3Z^wA%=DfgcV04FMhudxg23E zCei5=>CO>g3-;4_u4kI2`g-;LMy~w4R9=2#XWw$V073Q^@D6ar4_nUSXl@zitT>4D zPdrueRWOk{Vmfyt@nfTUP zruTET!V$`xn_rH7EPFtx8@k8%;AP6W<#-;9=%n^!l&VkhY^I!r)%6Vg&D<}*Y7)2z zIxSa@_NyuH76$C&@+_Wm3tBjeJ-|F=Wb8@j6F`00SXtn`rM0vo2qq$Gk9Hq{3l)n2%Gte;bJ@U!%dWtNL)kcxQH(MY-;F2P=FC5bj=s300<9eB$Ax>LiYH%LatP6G z)`(;ftEy_mZnh!g13??fuRwT+D{QPS@yVjSsOI_2Ckrqp$q%NqkJpzTL_UM!*3*UR z1zuU~a>ubetUj8j9s!*v>Btb>$!MKh8ArPZ&y*l7#a}H7x|gH-7*BgV_RSugr>*!q z*&vfLj_n+#UPQHHka*(TT_|B5JI@p$CD;woBzdwfP!WToypSw5rY1rd$bQ3~XKH#cCf%_>!dE{l!k4J5`7Z_J_nMFF5eN zT_h(3m9;oWJ3qj7Z)2a8#bpT}^vfvk_U@<2A$?a#)TP66tr z`_=ohv03D-uB8oFA+xf9HdLwBPLp@HlKh>3pBjpK#Y?2{STpIL@n)+Z&<4c{{?U zp_2Y-&-oIy2Gu6oR~t!eVQDpXu#H-nB$xG))*PG|fHP+cVC!guC%@Z+Y7!PBV^eH6 zp3ebVBNoy(^$K%WKiU6e&2hCBUn@z}v8-bC)$POdOY%OH^q+Xzs3!^L63U`h%$L5U zL&xt0G2q|eot#Vm;xRk+&z{T5%!;u4c0Z{eIjA{R`9_3{HYkWX$B~Hq5~wdns^8x~ z2wpdTfqZdbbSUa4#;k~fj9O$Wnn6*mt-@fco?lBxmlrgIAgG~G2PB=`FOc%(y4)jE z$|8qMZHSDLr##vaS!I+aX=SQhI;|W?xpJ?hQFY*HnX(qSv^uIhcuqu>GGv4&$C6%t z;UVcH50RU}SDw$OlDG(oxOYrvB;7wB)gqV3uRUs!a)k}Zz8ak|Z@JE3`%mz?JW7#! zrA*POtXCvyM7qGk$stIl6H|iRa(|Z?z5wgZN_`G@>m)9 zg5}k{!tmI*&PaH0AqwPY^ir1AZX%x?i*7_dIWNUZdq{nRX$s`Jq!mc}OIcEXfs`+8 zs_cXt364jA8}i?u3Zr3fwzq}IqqVK9(HE)xs)&U7yXNj zQa`D)=w0rY>yn=wi`~loQjTgn9!ohQo3yXWNA^Weye{QR9wMVGGa%=sPGVP@zmWXp ze(_7nrkJOamuW?2{;&Qax%pXt7QHK*;We#Iq&`~y0=X`EitJK`$SaWRBCE(Hr$k1v z3w4esB%M|#eLv z)Uo*8PQmWjak`-WoEF6X>Y$F~r^RU;^=H#jpFBhPt?9UbZ;(hBlXN9<@|$__ORo)0sAs)}iC?44JKxHS_*2_*fm6A0%Y{scTnhQ{k5anN?7a0y;XM z~kXDEoITT)sgfk0oULqo#R9$1+v^cOy80i|yl&f~GT_;OMv%+`AINlA4{Iw6__*1U{4uco zob|D-v~rK+CodDK7wbCC8A7iA?3$!EC`-HFpzI4W)-)h7 z*cCSoh=Q#=M$%-IO=fsxGd#YyEG-`$I&|pJp+m=C4wpu97~5s-q1s07)Hfl_*#;wG zy)Yu$lLUYSh3DLD%rTtDL!vxkXKI3IS6lVd&h!8m^``#tL_fSeqbuS=Tyfxh3BFmn z9}V@5aI`SRXr>zx?FCmW3q>dryqwUT_l=72Mv(lHK*~^Zu>6)bb!~LKH=^Y`E7c8% z_q11Q;&kz6Sv*egbija6ck~JKKw5xPJ3(n|LT~1`<3JX^`0)^`NY-S1q$^mDp)A{l z`}U^BYHgZ9ksfNjEs?udu$wv;IY=i`Vt%3RahhP%cj!>FbnL%N2++shG+Bz7-e z+e3XN+0oM(`%e|9Z&K**aOlvXLx&C>zaeD);LlsTiZ`;bf{GeEF+Ck?_hjMD7gwVD zBR}GS;Yk>t5{Tv|VDbw;VfNeWux|HRe7gDs0%V0}4_meR^E{H5f{Ipr@ZNgVRgAr5 zS6tz?t(yc3!6Ct2LvRT0TDS)<+}+*Xp$c~h7Tn#vaCZytZoyBjb@#sQd^~?(N}Kbw zF?xUc{Eo9OTqQ0p5)GS^&dt;V?!&2LaNFu1G{o#NhCaH@^In*DjgP!mNU*GE>;$tj zk@}px&T+ThNP1_3R+9`pY;2yn3W;r6ZbPf{UlN{&{(imjeTpJ-Kg(*+aBcn|n$Pd> z>p-!AQAX1hk5#6Wx!sA`nxVpBoI+6lX|ya}Nj0Rzf-D@-1rS`tPYkZ=5A`DFhQL+% z`JvnSRA(22MNT2c{?7nP>8DB{3@ESr`qw&27W32NvW<%g%v>#!D>fwA#b(azP&*!b zJD}nnH|BZYy8mW079^Y6y-;ctga4LvSCTHJ5y*EM&mi*>rD|jIy{aOt0`8{5PFYVW z2@Uv7jq^>#TpP*z{#Br0?UpLmhna}Y_B;f8-)Ys0z`l?7#Ng+PT>Hzi8W*odSqMMI z-^k|!n}J__m{VoiAF@5&h{_2orbfKH2`h%-M^`j+BUr4*qURS?iaY8thus+cPYSr* zo!(GkW4zD~I@{sjo6QuT!%$HK!~gvEUxsRhM*l*mhm04Fb=aP3&6mejhdyW^tkms* z_G0nYD8o?At2wdfpu2(LB(w9y*YJNDdZ&|>61jCKruV3Ug(0-8GRFo+aIm3Xy_p_x zt*bi?AzoALgG4a!gZhKr8uj(~TdMzs^+57uRi`U!C&1nxRTUS*17Hld4s3%4tmH{q z`U#Mla{9`rhb`x~ylC74BI<|;rMivfh#zaumfIc0p1FEg#xQB5MvUi8+`zde2zAVz zQGzpGfD)HVdg}@n$`J&Mby1c=8PaXTj_EEpN<-yOSC?Vh2DZkL#Z_kmtu)}%_^JO8 z{{B0Bm7D9`9APE8mw)41FF9hO3`*dNu~O_B-4j?Ts;>L5UGv<=-h@^quw!402w54y zcse8Y&H&T6z`)4Y=ej9l!{E#BcBfqG(buIsr=-(M&aJpAUZK6?!(ZHdYKW-B=c~!3 zmfb2p7dFUM*Z&;Y-+BB4(o<}xCm&nIph&aRlp!E~cg1nd84GIb_|^(C=GN5QdXAyd zH!&z$&>E?z1URYCMbaH#o;A)w=*v~>IL6>d8?$?eM_95-AL|8n+6?pV6VJlIy`>R@lo;83K;8z6fIbQ zm>#Y(`5M7!I>Vl#pIWGosPwp*9xbeDzI*U2D$snS*5aZ7V@m*kvH_M0N8hT$S`ZMHpH+`2P108W#rV=m(12F-I^o$^Z#U^gdOx;Z)pOsahF;{iswUCmFJS6_h?4(#gdL_Z z85(ZCFOp*a`#?OtaBrrR|GRqT?JNq@{5S9o`n0j5m^{P(vkExtBu`2G&kT{bQyVPr z_`erOp>hU8*qZ_UFfbNK(?!$DKz|K%3_g$bFB9Jz%JuT`N@ zaqJLUmx|ZR+OWBXmc7XeJ1c;8IDIWJT1^)V@7-LdIwN*x6z;d(^wB$7)pRN}ny?l{#HJBpto@2Cp+$?W_{7w?2a&lJ(IRLq9{p-DAn7q|%f)Bf2`QHIytIOCOR>XyL|<<7fB#99Jlmt#pw`^Ax0ninGB zqoI}FJ2rPX<4o}&srRbz8qQ%tcTYe37A^3gEqsTupm`dRkri{8GUQjt1B?e{?7u@@ zuu=cn+Bnfg%S9{kx$(4TTCWo6`ocMGWWy?O4&CRH5#>f4v|O0mL=Z8_iPh)-dS;iZ zvcVDMWqPpusKJxys>_p@+(hWKnJ(O}a6lTbR`13m#k6QLOZp)BG)TRqk^0-t5?!{? zPTDiz#iZkFJ?m~&=IjXA=qz)^OzW)O{~NZ(FmsPY`@ARpGw9XW+) zR}R;>0!LMH&*x_x+B8UT4uGrSXl8eVhv#|CJ{q4Y&#`(=WGNPRiFGgVwiMO?2^o+dy5Qq>7R4a}L#a zbg5E{U8|Z`Pf*C67cXObrUs^>POi=_M+-@Ou`+_Ad5ie_ZxI#ND9t zh*B(VkA0qRiFJ>qVYp{*sIztJ6cpMcC`L1RaVG3CKGEi z>zudTwwt#{k)akANtYYj3!BcryAoxA*~%tQoX zpq~lMEnfZ-b`y)sH8D0m zfhlJQadtF7Rg*-s56ozxwM+|j%gyUV+-SrO|E(f>R}TP}0lnhqg#dU5#zB$*D`&In z>ju+<{lm2gRQio&_^b{hRdmE^b^xay!1-?1L7ZXc6R_qmy9bx#JdY;<22sPUh4HBD zIFT=)G5N>j=aKoaBOGvWG@?T>n$1P9Eul^5a#I4c3~0QOk%y4J`i zI(3rM4Y`{i#&8LnUN4i^B=^2V&+FD0IN&?5|H+~$4>ftDs9l4@eDwE$eEp93ao@%m zCWA6c3Cvkf;B{~$zmnhB$AGy!jI*(bTIo&}+c~T|6Ip^|@n=lUn1bh3&dRF z0nMW1jV%*zZ{4O67%+_(@e32dI{j>yM+-)ItX)Vfpe z;e8i%{n}5;}|>r(D@2;lwuV(HiI6b{FLg7l+}}gL-);Rd*2`oe}WT|T8`D%mnJGr z2QT%#3U7#~6A}+5JtY(wOUe!dl2j)9H%t*zt=^h$ErY#Q> z+_NZHt56R8TC%e6rE%ur55f`C_U5Trj7W6ZQ3GZ;CGr2}8?{tlA-;yl=qz)Rr||8^NI@XvNgQ)ik1Hpiz48n(sx zv57USP>F7%!{!6_Id|Ca-LzK$#*A`E(!X{P)dLQ>RIivg|o)oiCJx$lR3!=0vpo!sbdpG^821_6+ zg=;k!%D^%>f$*Tj2pd9!0uMR-PduswH|c!17=F5?rD33*g!Jk<~MOr^^qbmNBd92 z4A(4STMPDNJ{Ej9Dwk$kNkY%ymfv=Zq+e@&&1z-1133m#(2#|79T>C@H)A{a;S{_( z2uL=$(Zvbx6ppZBKi25tq94TdYY3L-GPE=2BN3iTIxoX7qJ;MqTg8?NQ3-FRxM=*F zVuocEiaCbneLS;XEuVfoBtDO@l@)B&#>K9l&|Blg?ZAAA&)y9Kt@k=Gb`j2cO2jW| zl0wz3{Fs5v?EGIND1Fs$k)at3KTh2(K4qr9-)?M$BRc~S5ijRo^Yx|8ynj}G!lPoB z4i)pm;d2*f{RFIVcu%zbXMcuB@8kIM$pw|1rMl-VfoG?Ky?S6~Q-D{Z)7S!$QKB;IekQk(3dl4rzl1R80(@_74Q+X6IVPKmo z{i>Znc*+Bw-N3p2QFD+bb@-J8+I|MCNosF+)uLA-i%mw$4fw;7z*eK4ED-ml#KrYO z#Ppma5PP*b>t5A~`>Ojt=tx~BLvp#opESLgkz$An43%>v%RL=ottFd_kR!qv-ZBgkwgB1Jv55XW@!)78T!d!W$!|<>O>k)4or-bcH|cZCYH4X3JU7mM z*Rh8gTXrMKUFYRmGFac=`7m5a6ET@3YBV1`9T08k4wCKUsKXIivtjlz|HK+)Y0p?J zyBv$?Gk%0t)w4EEy*DMBQwes~ zwVwZExyfJlKi*O=BSx}P~wq7-T(B-a~Z8Yekahnln;0&2p{f>`_p zBQg7yd1`IXRs8klFuyg}BUh!IDIy(DV8t{2&4gMP=m9&apwLHA&(7rK^t51`+Vltu zPYL(OE4aFgr%g~AU%Mvg4EbIP4(}3F&fsg#<^4h!FSL1$b;jbi74zB9ODv>y%eJvE za{z(aN1w3hE>=H-+sHgck$%++HE!nMF7{eza#zS5WNhjv^!O?&x}{*qNxGb~RspAH z$0zlQ)M7ahdO$;3*A73Vuxrq>L!tCbBji#Mt=tQGw3;1k_A@kVEW>N8dyD^Aj!FdO zyr-leRq?b;SFOfZHT6ouW8w5fzdh@_!f|9(lIN3IbbUvxxWN?un0_>dK=t_BuUP0- z4yiC7^eOsst^OyhV|~2(ynlhd*R9MK5eB?=j4Y*JK(_q~{zz>u5xlz*$FVH_Y9q>S zKb`^)?>G51=XY|bwWvFuIPXt|RZp?A*y2t0a?tOq>6L`$tE0WonXlhEn;SUyD|sV) z@b*%ldL6}{+6+7=^}nhv=EoDAhlK(DX0uR2jRN{JSTf8YO4H>9CocESPn;bMsC%c) z`u1sE=eR3e=?>vHAtb|tizf=(Tf-%(uSc#r@4Kwg9xiZMX7u=nlG2iQ+K;g#EaPX^LtI$tM9OUif-R(x<*g*JREF50F1QBT~I1%Q7f%2}8t_MGMGhm1%kv z!ypd=I{fnFDz(%G;h%}Gs~f$ied6P$j)3XrP-XkR!N!Hz=$uTIG~VoWjxF11BanF} zE5%H~V~T|DfFdOO&y67P0^bv)kpGFo8iwNW1Ayy^xRd@}pYYcgszU7{A7zbzg2vUI78;qyMuBR_&8p6_ zSq&_caM}t6+Z~%d%L|yBc7jnLg{p2LOdG`ac}hHSJiFA7^?T5U~ zD1;+UpO{jpbJLVL;Jk7Wl#hjRXd6=}o`jpc8-(|2c(sT2>_FNSommIx!~Hpx+^4t| z5sO$S7|^*Mo3BBt9Nt#lC7dYg@Xf<34^gx$s`*t0sjU3 z>6%cpZ)obbg#Y@F>$m5-hlWO4@5(&t0%3qAgn~wplYS#Ppje%-XAX^n>@Il{V;D44 zA{+bfu;5s_)L;@+3rk6t=9t_~tqp|PcU1Kr`eRJ#__HBBzxJ~o0==dm@@IRckE@Vy z`QW>FeOh6Oa}cV`57OQ;9~v(tY6IV~wixLV`iek)z^3xWj%H$jumDZfCwb@OYg;dNm)|xzF{E|fD-pqqid@V)I(SE|CZ*xCE&QJ-$@K6T@=H>SB z4p)Mn=<7`^YEqwN(Y+qPqlzwdn zwqc+5oFU!!-nC9nNo4(+N=uR1DBqnfR|cCj@{Gp6w2D7XgTO+XY~gAPEL>br@?4g? zcab1aaTwP;`U|F>5!t*LEnwn}7`3`czMMh!uc2K?f(N_%+fbi-=JAL(`T7r}Sh0n!bfRCRvm4W-?U< zhD9;_ko;b1LLE@MuM!rTAI-56`Gwp02_>?*zNfwuiiF)5iemHpTgOSA4@g8?Ao8F&V-Nw5YoJ}K^3+{gZ~%WgFpraJd4DO zZ8Dx}i&KJ`!07Elwdb-OOiRL;G;yq}brOyB+;O8P1d=NRs-)wzWyQ+n=%+iOB(BEW zzV~^6W!uh0ZxKw>z&>lbBhkHqdGmOIQSabWUgr30#_s@Emb)F}AX8LELP;?jh7vnn zE0c6=Og>ICgqP~5e0T6={#brdo-lteeKFBuMp|AZWw-pwI`~zYSO#p*qezV8flNW+ z*SMMOB<>%?K7pgwJKod&+QIYj-O@qj$*7^7V1Rm@v7~3ZmsMlhmLRP-RSBhP@0(H; zVItv3NhtRjBv^LOSm5NqI!5TeXOR~I1eaL{_0#$4D zq~_I_C0oxGc2iX$CbfBo5OXg52%$3T-Udh?GvDE&z|_jU60z}3YOu3OUmg~$n?R6)4;8TsWZK^ z?`iG{_opl`QM+d4@Wq@Ae=6s}m`6<5m?{3Ltf3(coa4x^ZeCo|Ebh;|JI^*lEVlN@ zy|}4^C{X}JsSr>a24=_UDu2E;qib_o{t5svlm`mfrUbZJN&4-#A10s2uIW&2GDuyX z^;59>%J&KLVIkXzzxv|EN3t}HUh32vt!B6)?t}z;F+!M}obYoM0LQ=Qh7n37!ki^wB{LYe{10lie)kV z=lf{j9OoR6#wEz3%@Pw4Az*JX(CZDH8q6g*wF!Z$tHMvQW4CC@G#ax$raBIfO|{1$ zIBb3^`F!croBNSPqxPB0W|)K)@uOtyjc{TyOe7sXuFSaPzB$8O-QiN84Y0dA4f|N! za1ohi#k3fz7@JLVQ@9jISzU{SagbtaZ7^F+z4mn&sUg0n9G&Bz4abW;{~C;971x`@ zVbC*OQBz=sm(0rEe`0%&Tzhb%1O!HuRh>qj`%d7dV3W#;C_c)%UFsluek#LD zt^cf0UmHy<_11h|BW{1=I(YqRhC#9$E~!A{uAJPD9_Olk3MtC&w{$eK>xXO20|ay4 zXVL3t@zt0NaYtV|h|^D+5srvBr_zMp$MpWWWp?LE-?lb@JNXrL3+uPUHZ=(PJp3IP z6#dUj%#(C@6~hfRQo_U}!IMNbyeWR+48S@?+l#U;rICpTQC@mOYRc?m2--mx!DNp1 z84mK%O5BqCohnQo|MwvB#4`j+iN2LW0vOoB8F~Yyo*3qtUNRxuUD|FR=!gjs)$tD# zg7THL#KH14gt&jl#jogBB|gWH{XwvUcV-)Lq%Ve@ls|=Kx?jEOptzjP*7?~)2YjU9 zU5WpPYn5z9LzHkJCO}6#%Bvl_Kpol6%c_AUbrn|Eg_KQz6QdxqAGbjQ$Ocky%&QHoA)vV|v^!-v# z_0EIiG;A!5R-em{5L#!eB7mB+#Wp}EWRtYcM8-a_~SD006cI8~q7bHGoh6&J(D zqo*1US0cM}uj=nX?aNa%_?6B=A5ZOxaPycHA)) zgpV!F%Vb@$62`xl-_CW`}#fY*q+-!h&z9pA)h+9ZJIaP1QZj1h8%YjkRyf6#+w-W=obQ zZK8N2T};te`Yf;+J2FVUJA)BT{*igRW!+4sI{l7HPz8O4jAGIS;It)9-t;IY5Gie0 zb85~Zp-2NvcvTvA%+6?niFMv^T#Z~m*pdY#_3#iIzUlza?78xBxmokYhwOwA%q&ey ziFY7gOlsJJk*6)n#Y2wL4gy_YV8AcOALLpRl+35lic;r1`6m)eSI>TxY)aS6s; zc?wOW&B}HNtkUz6_Iss$T(XY#dr<7^8FpZqu6EE1)OjyTB!5mEEhNa9oFrGPDgEdJ z8gyc%xLZ*GOw)_X@svsM7-=6norhu_V+6IeQFN}lMp8WETMKAMUmzhmw~nB=R!VvA3gON*{0Ihk#u90>cd8#Dej=auyAf~aIT#Gvyd`kV zz}uDCKc+UHSMXcy^^3`Snn-Lg9W&)TTJhnjpq|$!_4_ZP%H^EaxRlVyf)J?k-Ebur zFDUYxjXf68;}O`iV91NKtO#+ro@onr2+uy0S%2t{o3M2Cxnd>x&GW?9yx{(E;L3sX z$IcZ`VmIWtkg_HiRwS#d*&cdhZ1w2~HryJ8Owz0NMm<b_2+=?(V2I)*qizW2j!B*n7zX#2?hvj2$Z+Rq=vA(U$+$PzP^f;IvnDyI}|lCsxn z?^|P-@G&}s1rwoeXu(+(?3ge7mrr1rCAl`@L7|Np*DayI#w6Dz`qPx2?|}to-x1>@ zg5Y$dbT3}5=@{~20v10JnDbu8>ikk+lek3|rAf|G=c)nj@TF{OI7Ks)LXRx7yj%v09unjD+X7#wrM-NO z-%wR&sQK1xY9f6_pK5TPpTHfOr{5Bj1cY^M&n7ypCdcqvHj;ITB~bM;hM;RUIlkIC^(djDLl z(yk>ztU*k!kz+HrT11U75VS9TuP9t26oTi;<9yX%^m#A^pTE|3aENO}tLhz%I*OzT zBnX(WMC8UH__&k{A{f@Q4~AK7XhumKk+42Z|A)c$df4PnGxRw@FtPm23*uZ54}%Ak ztWM~);_|Fc#9*l!U43`dbxirmDmVPWes?tEYQ8o97zc+iuxyAC=Ugx=u8|0h{JiqQ zJ~iN%1Qa-O#t#<@QEg$Rq9c;Ir?T^~Cae8yT+d)4)dH5_XwjunDVnKq7rst3qE*+O z$u|NYZO$pWjdkRac$@k}Qqzi7j?PuV5+R~f65xzrno%FXk{6fK#fekX>g|GQomv1R z@jTyKsEB4Ek}Bcf0LFwx4JR_^Df&#$%CU3eq?F3ns&y!``PT=XFG-GY(z?@#RWh%0 zr>T(f7x5;r{BCj=pBTYA$m;qnXl%%eUaoTV^>~qBOjH7ReF;1krcm*)xVAEp5nz>L z@C3JxwR7sul#h}flv#%g zvoTOgMBv!Ti(X-Zm!!Qaun^fqTQ+|gRElaiWS(xl5=Gphe;Qm{YINkK91=@}mQFaKu z)o%FgyeO(|`bQwgU*p=qN0fr)j3cVtO+>)m&4Qr_t-4g}nO6!>+V`_zS zsw1UGDbIjJs<@COT@U(Kabt9X`rLI%-A}^`)^ZINAYW{&P}$1NG!_Tx=ylyHt&Z%PA0sy%HXoH`yOP>cfN2>>2aBAfw^9 zl(~*{1(nuakLk9h;;*z8uq)h;Wq14_h2x%ebSU`9p_`no>mf#d(1ygeKPw+>KN^;y zNbx3TI;fBEI%tiuM?h3skA5DopviS=o4(EF0?1WqYP>RNfVJc-u} zqE0B7J}zLf99Af6(n+b`#%*Y)^y4lTP5`zQ-7eHrO~??hCC0jsE9!yO%DR%fT&r|a ztdx_ftCHhRNBNKOO_=Ax4A!a8`mR-5V_PM&>Yor*@f=@qu0e9ftg`vXmiB@a%EUp3 zy0J@EA?1?#uOWOfc)=3jwP26cvXoyW>2)6~9OaPuwKi~8%20k$veDd>*-LEXft+!S zkN%a-E44vK`*TBk{aazy^S~`w50JH&?mAH|2-GXZ%TMPnv@E=l+pS&-mmoZv&%mPkf0it#9pP9+$(SM@{Tdbg%vc4Wc$ zQPcN@Zjt?QK)%6eSb?{Agl*|3_ij~@XoXI8!cdZh60!Z(hqF4Dq3Q!w47CgXID9e= zEv;q7-Qiky9kJiFH`ZkMX}f_yDNm{V;ga){c)6?t7lxQ*C_#@S0782Qx|t#Q*90y& zkaWe1#hzN|-;@#1@`Q?iiGokxOW3$mKGEv5E^jyoPGo4u z2aW-b)@udhd;DJ?pS|Ee2m@9#!iiqMFt2)KkMAq4$`s1BpF9@DOhtVwB$ZLK+VMkP z$~-0UYY03Jgy%D!S*24P#U@9J+++OYD1}~W)~!5-+c3bJ?_cKc6U8^y|1n%YSCBoS zx2aw%C<=IViN!L_OB6<~Jkxgpe0Z;aCJ(8;N7+EXbVuPhQ)p%a-my#t%pFaahKl0Z zq})@~@jH=+Woyb=l{o>=o5IeFBx=lZ?-(q1jt-nQ-Zu*-+Aq6R&h*Rue;a(3VOKoP z(uM8|^Ua~*G9zIy>H>VwTGCArs&0C)(4$o4zByEB^@?AAgR^_sY@4ck&s5NMNGxTSDj$?L z_5%pe3UJL4l5x7Kan0HC^X_uCyLQataJp=11=e*4^~D5&K*9Cc50 zbb+kEsi{_gv2lJ6?Ug(gt1Qmw>Ljnx4Xt$;8DkP>#FrmCZ?#(EALCC`42Jnw;>W93 z`qs8zgYw*O_BVutsXhTuLC@39uH}fIz znW0%EgUJ&lQ{-ZS}$=C1&I*!mI0q%JY+cOsZWcqPl!s zGsCMTmW?b!2`uo&L{BR~HKmC$#;ai+XOa)dH}Tpa-myf|vtnc4?!3HH9NC5NJZeF- zeyUy8GArp>$hp+mRt2}W&J!q^U*^qwMP$v>VhTjft5O_Bq5>9 z$lHN9fSgMlUBFj#Wy&p2Sdsx=8h|2O0y5ILERHF}ZpF8$tgwckcxx9x1SdFO{$dC~CwJ_%R1E{ofz zvg8UH(`M)gbUgDcE5=kXC$$prFpQj=T1Hat7p|mxMqm_=-m@2u)ndn&o9xJV%R zATT^yWuW=~h{{qEP65fO0X2Q8u&^G^g}f0H!2eY9s&i(ua+Z3hw5Nn1aIKNw_^~rl zbfJv3kl}fh$y&0u;G(rwNBchO>#^ulDfyG()G5NC1ohWZ*u1&2rI=m11JR1HB-GtL zZ;mmQ6;`zdyE?7e;V={0RfFYPc<@py(*?`^>-1d0(w~Z3#HTRxgUo2 z*)JN|+@oOE7(*XTp3(DaK^3gT`0)0oV=idVT~JXgNa}Ul;ecj!4z0|XHum$QESybW zss}8js^kw%%_egR#oq1LHcF*0SQ#exCaW)c@Y>f70~#xtHEVsH-^7+FJmjslj1xPV zd?1l`tlJ&Gt!nTHO#d>)C8l;A3Oxl7n0zC+cc|-Y{}pDxC_^{DL!sy76nrC4l2drg z4z{q`$mwpU@K_Iehh>JLskK=aDA^X>)A_}Z36oXxR)Z0K=d9|( z8tfS5D~@_6!=9u^$5*gkh|=#XE@;h!q4(2FuRn-vh2{g>`WX67HN=yu)?XPc^r}@B8Ss#rhP)g;pOAzM+tKr z1&x9>Y1~k{!(mBoC6N_LmY?0v9K?6~G5AItb#sS`O#~-K=!M@a$(9^Qu`+biqt_xW-934BLP1xD1lys|SDQbWCOCv8 zJX*qrW>g(~DYd^>{fO$r3^Pm1@{~b0-Fqo#SB0DpDX7JE-ptq z4_=h-Qq;o*NrcxB%@07=i7X4g6vyt4WtGk*0oF|5{AARuq0iidtZru>)Bf0Mqyc}g z{d)l;m%3`qA~!fXudl<g1#+%LZ0vnrO%Lsn)XBI#>7(d4dLA~N>v3{ zWFB9W=_L2pkx9)XzK$cV&FyfeGYTq|ii zJvCYLfbGUpfw1DrvyhtM&gKBhZAo1?a?$nb?W<|YONVX=_`4ty**>UY{&F`7$ig*D zLb2mxAV+huXBz~i7^-wVxhEG;6t@!t6_4L&Z9#K2N!q!^D+1|jsD|wR6T+ltQ=MDLceDJAn1dm(?20|>CH@!E z!fL$8sXuh0Qtj@C&GBx8+>YCBi~qIat#Z{7KWCj2mZCKzR}V_meIdH)H(O=y@T1Q* zUEdB|@>@b{Qluf7JP)HNjzq^k476d29bkj{!_3@JLem;(P2(g*HYo*fWxw>h5y;oS zgF}PeovZATk(|Hhy7P@ zAJCrRH4N@qTtMn}|A2aX9ap8?+n&;^!rW1VmcrHwm3HOlII6IfQM22YH5wCKslD2L%r$5=;(u%=n!Mcf_Ll5`6qB-es@fV@MQ2e5U?&y zMw&ldY|J3gw!2aKM3(!x>RPcu4{2DzXz%b{mEfxxD&dg_=jy?+I1c?wAd@$SP)jW!Y$>DR$4(h?~r2Fw_E1Fi@t$ z`Wtc9)_38=o{_GG-49u6#B1DvM-#E%t;~lf&1m=@DT=x}P~FfJx<7!+O~GkB5A^*( zdKbSQN)M)pmecT?42I9^QXOwnAZDZumTV%&F*ot2lQmz161;aWSF`Yz+&W?HrX!M) z=ex7>(--Y7;t;DChT5X;cWPJ=%}s!@rYT02i=@#e=-}l)wY6H-g1|s7o=*gJfW{IG z$HRghk#&}T5d*l+?+;MDGN4J)?rZXJoeQ2$Q(kEiD2DNbykR>-uK4ORkwubsQ&1=~ zb1zIMV>0e7#1PrbnuQOqA8lW~8w!NGrzD*IIHA$R3lkS37vQa?Cy*pax`LAbB=I{q z_ORu`btj4Yq}uqvf_}{z`Mn=%~B-7SO3QwZV?@;8H` z6qU3>0Z-|{e|a&x{ph&^<2u&@7JYd_o79Mh24iS0?-)89LLWx}AM6NlrTjJn>yY2_bM#{4 zQi!c-RDy4j9!az6Qwq9bIeh0cPOhG!opWoGY0d3UA@8{z)PQD?HNw`n`?NhkEpxgs zw20~Uvn>3m;EZ7Do`KMs(`bM7gawL)`b;tWIs96r2};3l+p!vRcVcMyMOVHIs3O6x zdKxKM*4xQAJ7BRg|Kys@7>oyFq#Vy1`6GQk>}Q`3VU4*NHMI*;KMWLyIFcVVhn(Pu zZ|(Z{`$GDD#p_V-!-t9vDKTNyS%N>SZfb-*T#Yr}!dxjnhOn!3GVxII&|&e~9m*5m z9fd7EZcNrQtD=&6Ts$)ql-$^N87$Q7#k19&Mhb{2(QVROxL}2-QNAH~^;}-!7Q{4pyOmuaoVRUvi|!N%*6HW2Svq zW|{GU^Uh&XYo9y5^W?2%^=hqdRB^mhu}^@Ghdvk8&P4k@^NwoJ6{Y*~qr;_3qgW1< zp!UnITr~TITpC}vmBeR>eO=U`=S5=bL4es0E!}-1()c}z3ZW)MOz%nmf>F5HXTpnn@`Z;?>T7mWAZ^bcS7K|`+q;I-|u(t)^V6|dRm z2S=OnaL%P2O^fCmmx4pm51Ht358SPiiKla&TEKiEV&-57-jnhy35M<*kr~r=Avke+ z7JU{x)`+){-x|z+-`KE$2R@&CV4{gd9s{-9eH9Yb^Q**dOdjNF-uVgO|A@QD_LUQo z{v9ZSv2{`2`N8VvwT<`VKS}TBQ*$0Xqi_8KQjkDT6XcibrtYgXR!UaE#|3d>#Gsc? zRCU3^f!BZB+;&BsXCex2YCWH`@dB_2$(SgnF?x-~?9>>o1Rb2UMy6|vJ5a{PqwOh+ zRriv#bq9p4>PmAyz2jbWsnjmSgdjRn&TIEkWhwQ3nn>^to;$PvOe z_Dn8+;_qFrb~w@G;?*W=EBKgW#~0)Qa71@}=KSaBC-Lk?k@~K%I?+8ji>IJ)9x#M+ zDi$BbP#Z~kiBTR_-gw%lUr5NB_1oK^6|^_1ZfOFVD+gQNNs9Um1-hh|khsoleJ7eS zxDW)6j3yJBBNpQ`<~L2K$ZP&K!Rc>PMrDavSQ}8PwOTv+5nmj{<8hsBXS>Sh{tc=&ruP zuG2@AW72m>@oXVUmKG>%DirO_&VmanRh>=VAw)Dc`jh@tGQ5x#VaD>Xn0OpBg0Bvg zFJAytcGX$0xVgK)O7M>rIuq&}JEq|H?E?Dib64#mgA@*q-eAWjULRXzS%mvcQFYW0 zrpVz#S4NLZ_CHC`P!&R9_IMpz{i)5#S)@R-e2;6Nq>{W_T1#sXv$!DfOcbNYrf@DQ zTI;Yf`xayHJQD(>C%-EM)IKn=v6Zj;!p}Ydpoygjw$IjVp$Yw!1|C$8CWqb^|6hQS{^ma2RJexL)*?{O}tlUX@>plbsw}FGyQ2_g*yLX z-OF8+3HG2rMFEj)NxSm+Sj+O@WFPwks@Un3F z!=t1vPs&GK(kCxfbDpFAxBLbTNKfNOeF?y+*yN1)o?TPFKJ<>oaI-X5e&hrn{n$2a z$0JeLx7W@f+6WK2!QKxn4Er)g)sN*R+26SV3W>YG4{itlpeLh6O?{+|^|t?Z-qL|~ zT;Tom#ptO3Y>C&ch>b6Wbw?!L>)~&#VBH?td93J4yLV*2C`&D)0_CqO36wl{-d_i66-rQvk`fomK7iTe|USR?#jZhUAI!PRk3Z`6(#u&c)o+EOyEvtWw}nPoTV$Q;ecZ zCg-BN5d*bmgfwpg|LI6U|6{>jHaj_3E};u{@_B?-bhuZ*26H^w%_GxuQ(xrE%G#>_ zSueg=o3{O5`m-M9>`^`#1hhKLxW+=*TbWa4X2EX;RgW!A>fG zhwk~J;h&4N3_}b_9};p-wmH#j(7ACZsYFW&c{&}LmCH16y>C|3m`%I?Zsg3jU1sLk z%sM~%yVp|Dod3Owo9ISpFI76cN(xC#s{tz>Jd?$rSJ0*Do2yqHq0q)6QPRT$xAPAF zqtWtS?rtqLIT&obtCkd{u`WK{OCB>@1Tgm5ZIT2cRv&WaM7k#7p@v*hDh^ z>Q-LurqoOCNkY^SemxWphth4h=yy96tqCYZi(_rfR$ zSv{wxVHNjV zL@JGj=%M zaHb9_r9B@b`HDY=&NGmNnga#6=e2WY^v7Y%Ma`VRrbt(&`+Yc&oF3S{?pBArpCGEF zryJABH@){ySZO2~(lBi(+xWh1-|}AeHlP>~(zQZVKqPyLivVv6Eqja~7@q!kr8cs! zYfyj3N!W9y{^W=FHnMnPU}nuK4E|92sKF^g?g@O_^~#)}>Fw+{yuMgUIG$%io9+bN z0y>+)<~^awiW|P~ulhPlD+~N?AFG2XS}28;mGbg*hU;6b7Ya!W;uv}e9S~siD0`|z zAZ3; z3?cUWe#{VUD?6vn%gX9LD>=PB(_P1xCNXg!d>E>3{;J7R>_dsHSjfGc$njt`cihY+ z$t)hqSqOKsz`{1_J|A>m`he^o)|{#8q3Z);2zzE8{zW1hu&Od|YkGp(h>NpbeF>h) zW4LwSfnC`zhwVUi+3fmg^5x$zSP#l=PK2jczAmtR0y?o1UJEOH7XjeoeL8Yj+ z?C^Rv_yO>t~Bj2PJog7apu$W>Yq}_t|l9(HbWPR#KT`=sie`4#p4>M0hSKY7MzrS+~ zV&6bj2a$_qJ2^;}j-%gJWK79q8c|ACI^%mspW*a+2{5}(N~3ksvyZ?x{i%93{D5s# zo6Hl{OkJY;Za(@6^JHHn&xR`7%0*b1eVj@!w%l4y|Jj0zMs-+3QJtR>3g96{2Qrumsh_e8~y(dO^Zhaig z)wcz^PbXXH*B46e?LY?4$YDEce}R~=u4FEf`S$ojZQo0nXNVP) ze5Lg2*yXm#mGzE)m&V3bWxjK51oCKFh%sJ}K=fvjZS<{CX3|irKo}E*H4A{pR0cu% zY`8-iC0{)Dcp7=r!;X|6ZpN-bosOYyUvLK`EQDYj+L`>^_<2ih$x+E0Te)Q&@0`}e z`jOU$yTQy2$0*-KT~RTdau#iXWt=V+&sN~cEctclwwsYjE>=u*lQfe>Up0e%A^Pk$=)PXZ7+lrJ+QK^Rd|hyUikTQDCt^BAABbZ?LCI z{OpvdG&ftYaz2>wilIJ$jlZuD_}dThcrFiX)1m)MZ~ zBbeywNC$Iyt8#<^`ew~B`HL-ofAVT1ND4}#E+&{FE-f#7OW;WDO3{>C>rLKwr;gR+ zBq@;vnp&2cWP6CY-?iZpzF0v2`elhia2}bnLPTdKnQ@GMNo;VHg622Pnb|jVQLMjb z22W+<$VDg#Cha1YO7*XbS7J^-!j!VOCyTXHcyshTJ{Cme%-GtB)=Dlb(1%g)ORt z#?pb$1Jv^S(TO@-d>#OTcGD`<8q#9HJ!5y>199o8#Coix|MbLmnDzZUNI*HTWiZxl zh2=}a^qKH{I&(ur()3X5bE9FxYecJ^*%Apeu(nuD&0QBSV&w8?s46-s;lMe~5Hn5gZ~aKU~lS7x0Ky)nb@0gGBzId z458IPL-!*Q6EbolcLnk6G`oe$u~@kS5br#Y_KkK&iBc(cK}I528H+~ck#Fqx$pKX< zX~+TDLo5zuE2BqjL*1w>GTxDht||z`LwR&iT@c5g*5TR$t(P%N@Z=534j-om{vCDl z@bpI-;c@35x<73gVT@4_^P$m(iB8t38vP*c&P4x^_Fiz0i#RI$oa1!p9wB#-`8Y_i z1Th3rHl+zks~b{eJ&oa6^y=!SXwsoIWE49M3iKzSvhQL1 z^zmnicPpPu;CG4T4X^u+CzZ{A-XeZj z?u-fL>8!U(G#@5kh+mphr=6X^FRnluajaQY>aCaJeMy^vl2*uX43MRIKpAo8p*lH8 z97{M1jT-q-E~3mVz#xE6%zUSNje9@TxLjP5Z3LSh6}WYieZbkG8&@?uGE!6h9P=)V zCU^?9QjP{?3kn+f6r?`$0F?@Kx{d%VK$Ubm8=orSm-_3R3A(r%2o9NV#OQ&-Q^;ib z7Tkuec_=8Z{H%WPgU1M9Ra%?>6^@|H6{kHn0+4e}XBZIx32^fpYrQZuZdIB_faXFc zlEH_ioTgi(2?eU|_6d)1yfR-&KpM#^8KO8Zv7GpnpC{#HOtTrsDi6p-s97Uj2f0R9 z)Y|Qmx5^$EIX!o>wgX;Vrt@Es4A8LlgD0 z{ju6ES0|tYf?yQ@^OIZ_c31Bh?KJuc>%tu1^Yd?#xmymDsC&cvC$KHrns|F2>btVmMdohj*J=7Y$3ReBXv7uj`y5Z>ynT*= zPp~^ILOc!jzrtux7|p?Mwi6d&{?m6ynuLd(no}*grO6jU$9hspbvg1SL!Pv}rY(!# z?CI0@;n;7t6;M$P=2P0WCV+JXhy=7P*Wka<4P#B+5Cv$1c7&Rr=cT7|VB<83tQ%*8 zBeRXjOL^C}E67HVf62wEm|2cLDlHwt;n0jxYwL}CylG~EsxN$_f70*%&(LWX@hPwO znkWQcDc5*$ncb#R7_4Li5`vHaM&!u23GgL(LbusMe`#8rK5QvmkPC96x&o#6IKerxYkCt$a)FobSbzX&pM}ppEb+R2T z$wjlD#_C<&u|yviDcP@G{Ss*oN9s)|WF*u62LuM9dv*W#kQXvfRu0-Iuq~13@)Z_j~N!;4z<3>t*G#%JoEU>qr z5J{ms{C{X|fbS_%4%pAq#P}^(=BBwzj%a-(mgM5=H1jZdM|`v3=Ru#Wh;QNn%80 zSd|+VI??Ox>rr3v1#^vgpJyT4kq;ZCaptkKtTrM67caHZ%Y?K%U&J zNEtbb`u||}oOIS)9dI)ie@zfg5c=)1WQQtT_y3s}ciU~-!X~^5gZ&_lRaXw^k`~r@ zI;U>o1$m*$+YBx~>19ud!m3#G?3^10!@)I6%FV@=L78L1Y(ITh?H?%%B#b?fOgi)6 zo1(h*+YRjREqDC1v}X$nsKz%#!darb2BuL!V^wZ@a;${lA+nxDB=_5k5JallhkTrs z@w&YJ&6|sW{y5BCBu7a)*)xKOBNHdp?ICj(&LK;#2azu+WLX^i5Zd^B%J?GND}qpA z7Qvbuhaq#c!a)U{KYB`pEuK152Puoh8|ye+NKyV|hgS(Z0YAnV0r^R`Q6pR~3w)ga zeZXWwCUD-NwntkVLMQt2Ib8msMtq24RL50?Vl@YB8&7C>R-wAD!g6l+(kKFXDSNQ1&Vs-80EM!<11)(-VuZF* zwHu*?golL!zP2%m0!dc?On+7Ij3mZQ3hBIZV#mlDi7LK0e#``aj1Jmg_hvA;-ma0% z{n+hLT=34;+CaqL0ZK`)$?nD_IG_@?DSIk}exA6*)=J`MET2WXoKnph0x|q7hH7u- zArUtK!i}$QY!uCMi4go<*N(ScY!Z#(`GokA5@#&cmq5Agxqp20dv&D|E|FxW{-@l5 zriq|@jRDUiX?H}_t4(skJDkYYW@*_nk>>w?_NxCZ}^T$!^@P0^U4ZYpW-X8pClq6!S%Ln6Pj7bX{#@Y$!I zhW~m3uEWmRwn9KFFsS+dkCF_X4Q^UsU)eAAqm=%swLEWozA@W@b9~L}1!|@V>^Ou6 zNYf7rqyLRnR2Zh{N|+B^P_*UeV}T?I>w0$Br|I~*V080X-w)okKgPU@VAC{?b*_tw zimGuq(u9C&&#%jcwS3GDY3?R_Eq(?*^y0IFLO)WN4zw2by4!X}>dpGS$@8g8OmN_H zqH!v}gF?Djq8}T*r7|_VTDs|6G8y{TE{bEZFQU{ji2~a*2&}9pYCLQy4f{H4-lUMW zKzl&dx>>=A*b2Al5)b{A74g3seWr&Zl@X#JhWrR~?V4(P>fs;%GR+I{wzA=S;om&o z20Y&mcY;taeyAq~p|Ey?a*mw&!3VUI0|e{x2V~VHxGtBR$Aez{Is`L(YtVpdp(2x@ zA9(Zs3pMKW{uIj-`#(_jx4l~a_&9*XXkZY(L%jD3oeb^B8U>sz*$KI;ySjMSAF?-A zGO~Jte*}GIBIB;63-`z|#@j2{5=E3|2>>-%^O@TuO|(&&DQTazSGDgirOg#Fq_-o0 z#wEnN1W5e@K}}EbF-6NkX26SDOjEXe#z-&Fy;gE`vzEzyB%QU6F`@vq^)OSy=%9RD zIXRKxNoGsA=)cU$XqkY(1)+(PI}QYCRHiI_#ThkQl(aV#lD6Zp zkX3O;F8D6{NzG7 z#mbrIyhv}Vo^y(YK&Cx!?Rr{TWF`xpsRPs*T<>u?p z(~|Nq$3(jt=OrL~GL-RC*Y}en_Kofsi?Pt_KY#e=sO#=Hd|o|MDwzs*d-@J*dfxAl zS!lz#SR(sQ%3?9A`kQt)>))6*GNe@&4`S#axZ(4vlRPpZMhDNEyE-^jVsV{td8of(H z9i8+HX$H9c-N8qYb=xZtzK>7V)e3=W2$Tr(I5z(|2VY*!fx%@)K}_sywvI>3DbPc* zZyNyu*`m4M(cN5R1)%Jng%_AH9sY>Qz-DK!>-SdSwZ?*nukf%U_gG_#jWzpQ1dD_( z&@Qc*I7>O7aou6;jh=ZtqqNz>pT4_BzkG84vK(oyv!-Q0=02ZR{K`kRKPgRn5wd;J z54@@nPe1{WC&c=fduwhL3=7(7Cy=2@nOYv(K0oZIVqAjCcBVh}leBJ}N98lgsYtoF&7|eJtu-^jPdJ3>w*59U zjCc55!xuW+G5P&hxjhx^x<8&r<8*Ww!UWygAmR2VAA~uApaoQT#>hVH(}EJzOZgwL zO|>LphXK|}jp#6)BgzZIjS0|L+0llyn&QEjmfUYy%r(B)8VEmOY$9w_Wyv(2=B#Ed zPLO`1x9IYYXJH+^$rLS_SML4hoJ_S$pB6HQHLrbLop_;dfJ9_^s^e6O&D8sDT~H|= zqiiBdCMzbN-CRr`O`3B2Yc1I$*{O-3joq;8AIHV*s+4=YJhA(oRtmH0C0>8DJ2neI zypKAc;eqji9rJq+XXXsgkLrnIFe(xY{w7lo)7n3jr_pUJxjKdloOx8MzctC9W%s4< zB%KK+A}4FU2JP)EcQ{U<6BX9Ba!3*`3VURj}lVvDe`8)JW*9Zz#~Rh z-Me~G@$MxmY}w}8MS?!hl5DjTl?#crg((-TpSbF&k4Yq`9r>KZXb83z^P_ zb@DqS0Bi0RASW)`6MCRe>|Fcy(Am+LEHQ*v$$GplGA*Yr1u0FO>0ifoS=>=%B+A}J zbn+S{HVa5nC_YwHQRc<71Os8*U`RNpAotsSB4c>2_&48mHRPSkQCHkb=t$)s2dVW4 z{C~>J@Q%gz+#bMfGpX|FCmsa0NdClt#|bDq26p*&{#mme_;E` z%zX#QeEgHXur6L?GLDJ9b`-(<&G;&BVunk1bj*&1tP+Dz`p=sH5*h(a!1QUbWYF3|I-3X_Zp^J38hfdYR-d}HrW?f<5*Ec3J>3T=6l0xo3n{UheTL-1h zHZ~(P7ePLOiR|5oUR`fv?exgR)-#EV8PL%|3$YA7{T+W32z~v`@p&Ws9dj z?l<%;4*MeDsrm#79thlcc_7?iVFxRB$r(Iz-{GVp$i23ZJ0=1><2|={Af;WT^s_s(*yNoRRGqoM^6z4qt z`^L;!TH(k9!!RA2Cuvk$t$od)vmC;f~2anrhh5+_50}M!wq;F^)(PAkC zVde@K{?4_3arTy5)&&LvIrQ1A;I()gVimZ;^{uoY?dzR-{t73OLauppg57#I!Q$)| z#F@07bThp%;QxeN&wv<89JtGPgYM6H5SVO}HO1TFVZmT#k(84oh-fIv<^&_p6ZyR) zXb-7lT{*L~7MeiO*m8TA1fwrVw7p7X^5d*{|7FFy2x5C<3oq>jgB!5s=V+|jaubBH za)0`RzgC~h#WYbLXFT(HjFz9TmCkUZV#dtm&#L1RS#<}JCm_`i{iRUDl{n#pA1POT zs&~k>Xs_o*8GnMdFVzje9eXSYGRD8xoNya+1ebSWWM?fA)G|&)40m2VLm^K{^`9Gz za(l7jA%D7IyMint)%iTEw0O)xpHRt8gygisAhXKrk|1;8`xQt%Zo5)_R2S3AoHO>1 zGt$?GCoe$fdMQf4Ky zq3$eMkdL8ttR4*FYN<9rr`F1XDwlT_{S;Aefv#>IxHuo1$lm)w z+(?vd(~2bmU1P#UuR^*dPg|Z?xM#6+Rs0QX4g3|B2qaV5yZTe7K2z`dLCS|Wf`6ME z+EG~3ay~t{y0%lIR?d$4);9^&pAbY(H@8V0ZbMouHSk5Gek{;Kjm}SW#f>mk ziGMfNsXt}Lr=MI~&&=0R`L`@3pvyyz*&cnEcQ$~0J-P<8Gm6DuVMDX;Wjtno0iW>l zBsg7>H{rz8c)iE=syoFN)b##wrLzh7N7&~0$MG*s!G5Yl=OxebTBdeffh%pl0V7|X z*-_+rp|$UL@jcMR1-plM9=qj;R4i_5R2mKY?5)_aq46OcY=v8dgkhx!sWiYNV!mPs zWSvED<3&U>1HPyhQxYh_XMwHMEy#K7YtRRHKs3jCxb)nCpS6+BiW(re?(-bk`fR^% zE=z>}RIk)b0KTg&L?H4$2_RmWM?yl-h`2f(|JM1vw89f8N>+uP9T-+!-N#q1U^w)# zy^~g|Tl1;NXlUvc{J}R}j+1=%qKeJpNSLkNf|awqg7uLAE@fdA=hcsO>^|M>cJ)g5 z>~V)~Y7sbcRf|Cm2( zpJB4oyP*>RAOa9?NZ;HlQtze9vDjSp-jRP_orG+DXX0WbvHR(;+s;1dXmw~SDj9YR zO~cud(DXiSge)|R-)v=vYa>C0T!#sA7^3HNa{?5Q>^IvcK3bILszQ5^ z2Px$eG$&gC6D^PVn} z!-h4zJ>NW1_)U)@5@~k&20=9=ub`uvu~(?& zn_NZPFxB~8OXMl*t9y)c$ZHt3Fd)7)Daho2@w>7JHO7+(GwXt+H*Kg+a%L88=U zrXOn__f5i-E-+7eZcd3?BfUSHjN6enfsE&{Bsm2Q=V#Z37h!2H;eo6*cbp0oouvx> zRz?tiTAoR4nSRgC3_6ou8eEPP({INCT0_1y%^qbFZ5^xM*HxBQ!laVtwpILasTqGe ziU^}r5#63nw_u9zrYkFobMkZuqRXPb(lXNjl6UJweM&w?_y?uoxY+WP!o25fI8^IdUd2^oMJI_V;@wLS zIJ7s)Mv?^z*EQYAk_5QJ8=LicM9a2Ac+#MOLw!j8yBe7Fr_D@tWw6qer#mc3=$Ym$ zEs~Go>3eXt??ZxeXj#+WpXG1T#6$ZasPz&${Hr&<%1Ol&@9Nqp3G{}4#8BP00-{rP zw<5j89PFeSL&tGE;UfG(EZ{c@mt9ff>dgCK@qN==sh8U#q4BtF*F8o*3@ChKqsicD z%Axm1h0XnbXm4K^1Q{?Zcir>~>-M0U;%Ls6KB+B(CXV?>} z_%%QCWhMUSrO*&6>?mHEkRavF72z%t9C&}D0PL4G{7(BYldxMbZ>eEXmTpKu<8@EPYN4$&1);Dc5Sj+HN z_A}r4Ou5+MGVdInNcOdfCG}w%KDC&vmLN}_o!vOtntVc}BX!nlwFbo$s$(j0U(+Se zms%?~*3Dy67gG=yBO1e1~B$L>b@blt2^z&Nqd z|ATfve%8(<+j~zTz6m`DrSlV>aqNSZN*BaZ0qBGUxgz)6Zt~dK*PALb53fKpyI_r@ zTF`wt=H=TM_C(z}NI3aLz~QTK|I&6P2X{d@U&5rsU%`ocOPyP0H5!Rc{6pJmO7CEy z#c~y4&CJ1NsD+L}ZiK1VX)26G@kBUQ+9x1txG2yiLfdh%duSA_(7iV5XdPL9@si>A z+iXnVQrwiP_i_EA_@-X~{Q7w>zz+jF?5D(sQ!J=3DJ``p5>n5ktsE-(4Z!AOnPK^Y z@#U-F(fR3PC|^9;0b}{eVf=!b2*@mTQ=pk1+xYQv$Pnt#+#64Xq<y{L(Pv0zndf(ptt%k%@);ch0-`*;WJr-I96Q_>L-)%j;aW;AZsK0T2C$+-N11 zGZVR&E8mPiJNk^5gv%I0H(JXm$g0(ZaaECxa-a~DAK0d-#uI1c2^xZKUm&nbb;wG`TCH5>k+CH+6)b|1 ztWzRh1(l_~z@@>Bkssb|P~~T!ZqX1jUrYi*TFGNQrvV}T`|K0v9`zZ2lVl6&v?wn$ z4PNRT0|MZJAC^+|%MA^=ww{=)g=OVZKt1oEiG-vvAK&xQi1eiCrNvf+^p;ansa(6SLM?qZ2L#uVkXVmxsS5Ud zpeHOKOh-qVCJJOk5NZG%;i!F8H#v$Xy8n@5vi4J&GH7m_G_ALWTVO9Y8lKdVtw?+) zZeusrlxN*nQ;l&RhP&QcJaIFg;^k&v*liN7)sS~zlM)-6b0NPT4s0!5O(iXAP67?( z|5jf2R!(M56F_Wq^>ZFwe_~I(3O)ND z>(Pg~u>lz#NWUm$GL|{|`G%my3pqmVnh$^W;o9d;nH3`BFot%C2Mpt2Br$8Zkcl(Cn6dEHZJM<8+e|_NpvC@3U zKBu`v0(HNC6h6}}3BgG?rYuZeTm&1Ua6~q+Ee@GG+_f6ETy^rNYSafi5!-K(Z`xpd z6|KWwmlw*89H6-#THTy^cq~Mi6qzc?_6tWA+p_Eo<@6#{d#GrylIW>Fe(I|&x3;Ct zm3vFa=Dir`x42(zmW4>#^;@8#(-Kao!}R>m~eZhwY{frb_gF3xojy_biiF9bCA z{$`S7?UxPuMF(iHM0&7O{35d z|4v-*cI$TWCV=yNoGf_U|Hx4A9@ABe>n%m6DgVEiMe|mrsEX-*w@&< z&l3B}NLOBHBNZy0nPSBorhyhf$+@2HJ&{4KNyy}+a6dTr(R%8gBTo+StRJs2JJRIm zt!0C9MienOCewSi2uTOSk>d+Pd=PnpaoynLMa3Z3W%6mqBa>=s3*;sV>tzWgdpntC zkaRI7;8juwz6S2D3C_0M?K6yUr-IR8@on(3!Y(e%gEyqnEc5~aS3y)^yZ3sz8lxWY zt{8oBKlc3VgOa#^r9~Sh_bp9{OtLes+9Pq0+j7N(4#J#@oqG)qp_f=#_i}iX>YG~! z2{bSn{0>@-ax)Y$C0FEBk1wBIc>)a?m9~wXDry z9{P|@ofw^;mSooe&BTH3Jcbx=k>wGHlts`$NpUiHEH#p$X|U=9_Gf!LL+k!WfDa5b z^%Kn60`*e4WC2t5&Nneaw#U%B0m%k2VB5TkT*xFV92h`B3f!P&vyc=6b z(>+Q!?Wt5*2~vC=ojE|4?=8Qf3Q^`MGX(vjHQn1D3*;@c7!Z4$-V*S)6YbXUBCRj) z+cXoZHzS&!>B8lqPOHCV7TmD={uCqE7fVP2vP(w3oCCEL{_S7V#WPn}67v&S-ORlM~*+5)Y>-uon64^lmEBtC5#bF32CU)ZHIPGoJm*Kmw>Kpm)v#Yq*h95 z|DTV27D-oKD^3D$Ywuz&l-zwx_q}{H&i+&HIh+-*ZlTv`ki9N6M|CAF1(FHE&Da$ zjhc9fUHjcSie6Hp3qh~(mR^r`j)hF0Zc6d?2Pg3nw)nwp7(}Fm`@*1CWomZ^&>{C$ zOLGEn*&PPP%R7L`)zyiK=%9B>7OTWYP+A#4Q9k^BfQtI1wVqzSdgc+0hV!sKFP$CV zy}?wcLmi&u^#RFS}5xJVzhRlmuLv9fG<#JAu%~Y>@uLV5hr~xx&R;3 zLi9zeWX8i-dqT1 zKk6we@;g@7pW;e4;&44?_ktp1HG`aiP35q0obavcfN3|?lfpp=nKu;X45RXLIJ)xtr~ikc9TE(X=+9m^^CF=JhS#AU}L{Y{h3k5tL ze=1?4T}3qe@`ncCh$E;G1PX(2ULK|IVlJZqR&sJ7p6Vpi7N#ehv4X;sj)q&%n3{Yn z4o%BLPTe0cmqWg6ghK6Y2b_Df#2TeL!VcXR5wP3$qh@E3!c1J+Z*|w!zp#h_5eNEa z*M7Tw+tTt->>SR6)JVGOrq!;B@N&=%XI<#-sqy-gI|;*{HR3+TUZf5YX>oeJ+2m;0 zOYm~rHkR=vB^cj4*0c|rO8-5qyeD2JuPwNUmHvC$-|ZlGI3K4*EWO}8QCx;pPw6~d z>*%i0&R6fJOw=?VZ7xM|k=Q({%b z?h|1oG6jOn{c3MIxPzI#>BjU#bP2U8!ZjpB)(bQe+Uo3p9rw-Uj(ETT>rD0KtM7)&HZoWF-54?Xmp7 z4#xk#s4`oz>$nedAS=&>RDyjYy8UcE;hx8vrmK6e$lG(}KP!EBt3H&|;X(Q0rjI`} zV_(g;0JzT`k9WTJf6nu{`_)ljQ3p~XG}T~mbnDIj;Q&3jUvnHBUz`LLg&5S8CO!-V zR0za$W`JKjl@s-O$+z`Lh;sZlcq1>{B1Sd_S>a_qcmn3J9kgeDv^HOsU5ki6ah$(o zVqMHXgE(IlP&U8T-U`mW)>2orV4n(QOI57*g{&2uws8$XK)w|hmi1yKs{?hB*N~N^ zZY@mNbJg?5X8+^;l-J;&^QwZ*FWnve&bn0lOzgcXvA_w>AOw0T|O?AyXDG;*nZ*^QlJopJu!s18?BY zU*afll|P|@Mi#+`)4H>a-Q4lp-z(OwE7luD_jxnjhhM%h7avj=sJ`1y;jUcLBMK9w zr{VUisWE>kM9-mA-FcJ4Rd3ATd2VHdTieR@;Wa-7K#nKsr~cRtlCzZ^ z`o~3OxGA&02EJ$uxz@^YX3SWgH{X=PF95gunT>$CaOf-I&On&H1dc3wx=R#T(c3Nq1@hGnRRJ6sSOm z4QDDd|L9-@d?ec9L$L&;^*AurvBl?U4^tX^zbICzK-NoJj5u0x2S>)=#jn?Ato!3sI0W zJ0#fUNsQLVzqUS%(qUt64yB^9_S}8P*I{C9-RpGj`o;L45G@HPQHBa$Z8@+JB9Utv zh^K6u8RFy0FmSXk52ohi#i|8VWQ|v%mt^LYpw#$0rXIkVPs5A$H+K2+QWDMd#yXa` zqcrx0O}r4QP$lDzP)A)IVD3y{D6(N-(1$eYC=oBu*=l1IerG!)J!;nd=ZU2Tdz4!1 zdnC8azrwk39vlWZ?17C6dgffoA2uNIpw*U-7SB4oIrp0CL#*7Wh^Dc`9|#3&(&ore znY1nD>#&KAZK=86b_pGU*vWPPqgdWw-m04#gwu`o11Z@*<0+2V0n`Ix2PvKf?RnaW3?lH$97qq3;d%;NMHBe6-+$?-FR3S*f74+9w=VUO4!x`raLGUnwEn)#E~lB z_i$TcONJm@8<&H4EtUnw3k7X138M#Hk*QFrfvXeh2}(|6hf;5$ga?^WOYNQwL_V2| z=p(e&wq$zUie0$QE`ARusAnO_T-ifC?O3EVa|Hb$cjn<$;9?B&Ffhlu|I6}<_gg+~ z+og0}#-`kr07;;p$W^DSut!2PsTvCWqra}O5`+?pSS;gTYX9$~Fms+E-)IV+w!R#x zG`qb*eZr%Nj*iJ}w=+DBraF(NGQ8J!yACzniQ%q^!IB-sC|4`gUk!pzO*yYr%`zgJ zQOHgrA|sOc={o6q`aJo7zs^p37MANFUTF(=+jq2%36%HmoeOTd+<&HAd_P$xgSC(P)k|Q8zc*+}Pp57)=1FQxqcWs;FRlhw5T%@RFOAg7^iZ== zXTKx-68z$6xPDJ)Tpo`RhP00MV<&9i7U5?lw7TI=Ibh!qZM+^Rx(KK1-b(6NDl=6m zOVaR5!7cGDO~wGWul%()8bTG;59n!|ae964H0%d0$Y7a4y3kSlsv5eM)PZ`i4`(Xr zxqxWwTgYGDpK`BE^ z`J|hpIlm(>&7nnWNdHiD4HS-5)sDB_$!sMF&Zu2f0H( z5Bl0F?|#oo`It*OAZ1GJ^&5RA)!2|UEb){d&{`j~u85xm9HdN>3Z=2#Y9i4n7?~{Q z=A0gJ%<`OZ)OxCgx)n}OsPr{)z`^^mNr%VhG*&7@8DB#MERryk-?E(KZJg$ z_IX{;>RR)JUEI7(JH}Y5K#{rq}G=tT&8yDB|w+ za{Vk{6cKqMeF>+T&A;RQWRv@0i$InrFhqh=a&L?ewcQELgBh-_c$WLU7vlZ;Qi{B~ z6Azqsxv$OCR`j6G-b_(6ufQR{r_PfdzQ0g`a<505Y({cKMnbTvss(SmlLun7{A%E* zM3dBXzd%67?kyF1&BLOP)OcPmO27Igc{z8+&BugrOPdoZ<>pdsaP_ylV&}oZp#0i@ zrCrSNid}q#R88Fi2&P-z;N>|Ng^}Kk#Omj1Y&wUIer{$HX#gAW!%P@7ABs&hF8U9X=0;;{L1M{fFXJ-OA@gfox{P zs2FM1U3BrA;Rs$v?S&nA`1{87=Nh8=_K9^l*hIp96h~?RVZd&c*<{=a1Qz z+ffaAW4yt?+p}c&#e!Y%RNF*B^+YknDtTlm1e1&)lU*Zog(fp0(JBPu>yoIGAt&J# zfaoQIu;;w=Tw8>TmM zCvm$bc3)sK+TrH#n@wkj`~7+f1|sl<#+|e3G6I7M(J$v-6hGe|QMPb!Bv%x^AfJyY zA^L)Enl{hg^b4wGfXCi`76L+LTf(V40^Cs&xIFzcH5g9dNNdF(O zGj4)~0abv4*QzwX^C6fLdRe>n! z(8S+nd=Rm7+U3SK0SM5O&hc*ubx>q?B^;!jxOT80U`at4%TjowPxU864DbFpdbBwm z-;r-*F0&-a)PF-(IeO~i`ra5MHG49hF$b=m965Ls1e~o@GG0-_N*35cucf0jTnqi@ z_SIzrY6V@Hl<7FZtM$8*$g_4k=P#`&H70( zK>APM`cnfRsNK}XA~xCmbE;CeUUG;2tSjZVgVyLLjXkQxbK9=UsWpXqef-yQHS!*Z zdL&S2%2Cgk%aZy%i{8ysnMx;<5C4s)y8oRUONu_)n;Ggz2sfznPC~J{y(Xp=d%GD- zewrW*9zSEPA&1rtP4Q}t3qcs|%`VcR6eMyYkB>Xu75)WaV*AMYz|ECxPj9LAbf#}D zM%3ag4S$2;7{pmyOn@IEks3)up@&L&LN*WYO&mY3WnigLL3DH60_5qoz20zpz3RKJ z(Ck%)MGs8|;gRvMvxBFr4i@#RyJd&0C3V^XK%0eLdH)YnUl~8V*=RlD}4T;t1PHud85x|xSz z^E3hH;9o*OGQT` zWZTqO6w52Y8u0k*6O)Ip7D_hf5*qKTdvoyk*<6tHZew4Iw~+Ovy9TAayE}{*dz_}2 z?l$X~rQXUcXVdRovTBQgM`~%MXLFtK-QXEj)NnN_ob6W*8(-{(2GRYcVR#jz7Yq>= z^Z{12!cJ-Or6ZpW<;qSow3$An{J<)$&-)uV6OPl5~NvXx0 zPb9GH4wJ04m}jTBee6&<3UAZ8K4t;27SzUZ)#UL5&c1J0cDUs1G_1ZB$B)Zd+JZTc zlT5{q(i0+DE9g;x_dAU?j&j6k{{)s@-xs@?xYVQT)~-!#Z|8~frC&)u{2b1c0HQ>} zmUK+0j=KYg@jTWL^Jjac+g%?&mk9s$&eElT3rXmuwk*p}l;PZlw`cgU6MsoR=qF5z_An*Nqh!BK3#~MQ>q8UB6hOvnb*E zCZoe^Y(D-vYC6D~!cVlewQkr`DJhCSr6D@thr6|kK4R4&y(OD1s0R2m5cEZr!e)9r zDe-Pi?$@$!ZXAStMGTTz6;q&yV!zvclP^mD&JT8uPM#mJj(WCB-5mD;%uZr(YaF|@ zZ*HWhneL3CPHky*za^f>mmOi@E=~hNL)b;V6bS!$bVs(%iE7W&CT}?WHLWh%$&Vi5 za?xbkKSua*??CODBo(kf&I3Q^8Sn2wCt2bf0mL!Pqdj!`gW8fR+0>J1jriAP(sc z`5i0dDo3>P{heC&l2_p0b9sYyp6D;~wjX4hD*?=`-MvpuEMFob7Gy5=F^i`>c+sNk z)3vI$9TLx7vfT4WyjZnX>G+Z`;}C^$C|{BxjA&r{JOAp|JF>6FKq=TSgPcc9?$mYI zfbmTq*uI?2u=T?ord)lDv9vivN)uG&%2^w_&kMd^j)-CBdR(~}7hV>48aDiq{ETZ= zBWi%`kh^vZk3P>c(gyQSM_E`ZTJQvuStgeS&NP|yN!)c*Lp$!6!$o}YP0nVM$(Y2Y zM#1md+ID6(G>43VO4DQ$&#tK#y^>!Q6|Q^NzOGTOmk0X>PcQKAFCC)#>_)iZPl7ik zhN8Qg_NIW)5c&`_&W;4i@BkD|G}hWIiQjx=-jtNA39R+;QsCb6@dlkSAR!K+)12DHwQ2tfDW#Vf+`SzeMB}5Xv zk{%iER}AUNSd8)`FF89O>4B@JUJT3-SX|AVbUsBWAGbU-VwYLe(c8f9A6))4_BnvN7Ry#b8q2On zxI=&18w#s?(D|tE7RySj5a9OU-VIKEjq{?>sXQrtt-Gs!X!;h}#qF<;h3eol?6!pC zCLh(XwyP{x$m>C;b3Bq)d3eMn8ZT<%C8LqL^r5P$swA8DlUh;ipO3rpVwPC9-dS?} z2Fk#LQ-{e8%NE*MaKIa%*p!6~A6 z9>L*y6`aG9{i$@&bysj3{D>4cZ@Geu_eIQ-*!L;V!NZg5G2Q%C;+{aK2=6M5Q7l1~ zOQ1n5(gt8<(_z9-jDnOJ<0mSjub~CqvJdW$hn``lS`ht?Uh*&vWMT~u=&h(?YrCLq zoVEa-%K&HYo@E_1>0SLZ#gIh_Q(T;5iQ-;)$VJtcpcE+>e-?j&gzS8HmMkL|JlvWi zyczA%y`6UpZ`$_cn6jNLZ3E=c*!vTTpV)!EsOr$+t!)nB-x$tnIIt#18CXbM2yHG8^e{1u;yDl!c3_d&=3i)L;GXf-r+eJ-YL7JwXEZ zTdMO|+S`_>|24Tot+sW(E~Gh6Nk1j}CnN;C#I@bEwv#!E|C%pa20D`}|&gs693uLU(-nXg8e z)w3V|g&tbb)JQ48+HIff=Wk~3$3gvk$?Y-^l3uy6*~XsLm@&{Wwr@HV!8O^nET^s} ziV@G%VUkXDO9Bq+itYl3qQ9DQ0@>Rcs7$BYE%XcYW7ZezQh2{ z7#Gf3qgtMv(~f@F25F(E;OXPOheg?_UAyK!)(O`XgZC4Kqrp&={ymhiR@nNd!sCNG zqQiD{gWsyZn(^b0t4Jd;Qq+kC9&659Kmld-SkH{nQiPN7%hD*dr3xzq(d2rFc+`?h zwtUZY2|C~12!$C|^47#}=cb*gA6E5T=+CrxcLkLuZ-^2_Ml#JO6`Vwb&Jl=gHN(TL z_9mYQb+BT)px-6m0XmKKJRIqJQGX>}t0Io;y9NXjP>Ha3tZ`wl4^8&Ytk}%e#Rw-C zVO@gK_k&+rrzTP>9jR-so*ML`d|kj}a$*MhL^F*!qyH$lfN9WghH@?viGGi+O|-!^ zOW*0IuOMbfmYD3qHvVJTZ{?Rcf90P&KUkN|ERC}l`O|HNn`;Ve4#7b+7WK>qyEAbK zL{`f)&v(sluAyhs1A(jSej!j|Y;G2pW__*PUq#dx>G!%+HsNM}niJoeewY{g3g3uJpw?>CfND9AAO=SA*<>}XN>vfs| zh{h*cRwbKAvUMfhUUp3KXngtBL=>)8&MEsSw$u089;P%;rsN)_Bd0y_WDkui*Z^C6 z2p{UNT=H@NA6`$O-lai565Ph~_YZdV7s7jnI?aqvJLE07ODzZ)Juoh(!({1pZR2kV z#^;L4PdVLRLS|y50?$v9bekCdM_fF7)QY9T=>}5qKNHkQTwL;KMcRJ6=!-*5h*2uL zp4YhaF?WbdKD=LRu@})Gt;z86?#|jNls=SVBxZR% zweb9fJq#!1NvcP?pQoN8P#&r_ft+os+zw3|^GdUY*J|GWu|Zy|)BcFsnu<|K;^P?p@-?CK>b`^(AX9cUyQ0W2N^+pdTmn>% z0kdTj)Ps;maL@YQJ5Q9LOdhF-nivIGLmjDvYxvqY(?Q3b$~`xaIbq^jsp)BR-6TKZ ztzr(?1FnwHfV~^TBBU0fqtfna42Hx~AQ5bsV5GoewF8G-A75GCcKdx{ua%glCS1jeB*(grKlUNKJ!&r~xniSiYtKcrC zS#290DN1U@Amoc=u|8E9(R5uUDYEgfOyy;`NM9k6Q~l=)doR{}L5Yrf45%Vm5*Q^~ zVY)*Vl{Qi`lQdTI(iA8ScL46$Eqyg2tUMb=q>8%%f7 zl%|PfKA(7S%Xw+o?jfPiJTfAD7Gv$;^AaIz{rWkm|(Ux-Nv%v{lOvET?rO5D&aulHlsMgk@=@+W;r~j zyY-r>DAqEHJS)^zz< z+kH!ak_f?IzDbC)f!(>W614Cqpyu%0*zIM4Xy=SO1qL64k(rDV?I(AmErpwcF5=9yY4gA zR*qo4ju)arX0D^K!2J=9A1e=?e>E7yk;a+JZl3-FI$?w{=QuE(@xJdNU)k*`v9rcv z>Ux6qeX7>u8;i8Ug>DNt|0&cqWK*f)Esa#N{J*(Aa@|SeU8m044EM`(9ZeKHb5ZPX z{2gcC5bgCgz5hnOdKJt2rW`71bQG@y*t9@uZS-8{tKdda*05!c=kS40X z;dkb^hiTloBM3yzWDsTMZdwrduwh!6L{g;HWF(2F+lXKkqHMI1k`ae{-X@|r_R~FZ z^FzMlUK7%n?}q!_GaDUHptF3JW8}O+B@cGfu}_}Xg|YY*?uKB1ShOp%WtM8L)%tS} zaO=Xn`%8twwuWA$Gkfmme18Kzl)S{#jR9%6&~F#*RSd3IbGtYj)MUOJkSu*OoI{*P zC%&b#Revzm)bU7JBq;`frw%qw9^4H1pBR}2VABZIwCHAq*zX;UGL>E;?%l-vMj+LFpRZ>Y45xJfU794DY807L2=3Qt69h|woJ9`&b5n>|83ixI%vKSL9mT%! z`ibu2_=0i95Bfri4e`3;GZnshu{tsw}J{@cj1PUQK~clw+jsefaAXdLF9T zn^Kp=C&Rq-TT&w7VnRZU^3WdNR#__Wa*RXTnR-xHgCYV4W|ZAx)Nv<`QZuTBt`ly_puST%9^a}f zp;jnb6~(JFd)_Co9RKh;kDlNH{q&cP)2}TzYIm8>Wfxb}Uz8(EGJ}b2W=zYp?RucD z5m>)F%5JYSb%;ruJWdv%&)d43)Hsb8;jp@2HJ*%C?#kA<1hqbzw=vJOtb4z4AB#CTlVKLl zEQIRNt#%i3qRI)7uPT9`m>Qr(N}*k-N-0McOTL$LWLoFNTB;ZGanllFKEUKx=(XPqWYVG;vwFY<~Eh74&Ggj z%1KjW^k)BbZh_hOv!jHl4p;R+&6catR&71FVsU6ldzdls231Ac35-aQQap`=e*(`$m?XOqn|M>Bu)qiQ22p`La>>T0l4C7(X;6=2?_}hRW}OH65;*~CbLA!fK)tx zn19iY-p1D5IyTn4a%7R=OGfk#OcP!t2$18EcN}c}%%!j2k}=_kdPssiY>#b*!>5Dd zn<)m9)+fo)>QEiG^?gvjOgh=Aid@k5_6qu^^WS1pM=ztzu*g^tXC<0t5X+g zpv(34G77MyaJj20H&>A2i|@P4;+?Dlvow<`@fSQG%WUzmHVWRf7r z=ti2*W;GtG{1e^hOgCQUo`X7l7q4% zH4n-kBY&*ZckBzKtZ^1RRhsVg^cg4Z&SM*^>)J@`kU{LNjDKJ&toEzd(7fxKWUJuJ zx}=xCm!9e@gGlaW$ke?Z6{K(yNYP3a z6I3Tec@~8abp${p$`Jr7A6br6**KDCpUUwv+YSa`q1SPD!(_(bFIGTy4^4Rlhb$~| zz|VI&EAm*cBAj|=D}&4gWu+9wiGMq~ zK7P#1(~vVty+V>!Ti@#+C(ZRvs-);8-Z{z}byA#T;9RM#Yo714{(*-qTX&3IRP)tt zDrj!f7TulvK7V#V%Wy_i6Uc`Q@kvL^#t^=z-$3H+Q z4>SvG#D^%z&b($4iV)Gf7(_!OQhKLdon^UJ_LL|!F>a1i0Nw(f;(nrW{w6S6R(a4&5_I~6 zsWYzi%FplkYVb9m+k`bX&H{DA)B(jG^gubNjW!;)bTaSV{dURiA%lW2)2gS}b|M2l zpQ|rbxekFX%n719q^dT{yZlV0ihXsOo^Vob60Vie#gffRnY`UVcI=p#B9`wr7G#t} z^uJzrdpyaQ$}ISoq}9m!WkvtT{%aIfoia>$9?r6WLrFFU&&?=g90{z+7|ZCG=zw|7 z_!oKIKpXeh?1}@B-4%#YY?Kq%Y+roCi>~{KZgVifE&&t~g|DKZj525UW7y(ZB0dgF zn>isBM1GyICq3M&YpP?k7C=<%`$~Q0=I~9#Y`5HNRs4S@-!+WI^VJg>XV-pxqO<-^{yq{z!L=t# zq$tB0xRXv;j;0^+i$Q3Nv9^J+UHk~2RhLE^gZY-&C;qqBRwWy*3`Ne>;X+uR5U!rk z<3zf#^+1JxVGr~1nTFp!KW>@r){WQr8(KX&-3oh&Ovb)S%NN^KTJQVP_>pqLiIjq( zkCYn5nqo93a&Oq0yDWDhdwvDII7NiP!`33xjgU0v|54JYOIu5i9d zmCJ!!XAwsiLV?sx(z1g<{Z~?>I?kQAw}pg(Z$zAEDd!#Eg50*IG$prw*Y&v;@7UkT zz#=jb1~zn{-Z$+cyfT7cU}nWgiAne{(`Y`1bi9phu7l<9Wu2dIT^xr2H_CG#iLEXF z%ihYbLp2`*Jb>>L4aD0TE_|(ZS#*bJ;WqkkYThnCeAyY;hgSAr$7zKm zKVg5f$e*qG)MGR7`pfziGDZ+g-U<7?5f^pzs{Zd69**a^Tf0X^@82F+dM5cSBRlFt zpd}TY9sSa{TX81h)|MVmcR5DQ;NP6e`ldI|g^~!RtL%0xQ0igRQA zuQr~#=Fu4-T`S}x|Fn~geqZJgI2<;z5d#9zi*$I&M*eBxiBlTB9IL^HjzsAl!-`Ks zh#XEihLzs_m=Z}2`EMH(1k=uc8rpE93$CeCd#2%niS#%F7`~^xGXaFOxdGTvcz{u) z)nQ%dafy5I^dUy_M7(4w7PW``Ksm)5Qo#~83Koo7Y3-9#pZ(kYCwRRiLnexN|4tO~ zF(&~Ef@_hCkxfUM?yHI)STKqT#>^85LKv7>WTI84spkLLvvP-BSppGKGw|rQN;ign zai2Z;iAupLEB@5Yw0Iyw96#^=s|&huLWkqz%jle=;>5nvzHG*gwMtCepy-XXH^wc< z&{~)6f9#`?$^!R)tr?STc=~@FxP?4dI_5u*Ob;XP_@CQ zUSA9unK|pLixOJK*G6?(j>W(ZOh)o%h)qdMvhJk^3t3JN^8Y*Dckbxy-Y~vmrGnL0 zlG#1qb+SHzZ;*&SHI0e$SwJ+B|F>3wq?Def0%R!kUZdOFK82VW(jw}FeslLKe+usZ zOwCDMAvg{2t#$$d4gcTOX2AdV9QB*W_9zOMSR6+FL>TZ2Ib5J)DcXgx$ za3akXk~Otl%<34wgvxy3B78#yq*;=?&US$zUNMPBdqmV)gBv^x%lj|19-oRLE2OuI z2NUD4@ttFjf;^ID0!5&;T@n`&fzhl~=F%UfiWiZD;d&}*5(gDgpVf`RXCgeaZ~jPf09R3V|M(2eS?UIGu^F?sUf zF`n?wR^pw?h5|x~ODQPB6d~FKtr#1eymg->ut-aVxK@O(*N611j+RCpU6rT~!vPg8 z#dm~E$&P(0vo%26r?$u^;ms5-PqFcB9N8Fb9@!_*rc$A}=Jy(G9t(VBml%kUABEdz zYc;4{-uo_I4{~;F<@=#L>KzVtn=j@Q7ao5!-ri&%t2-a8pU9qltyc_XUC-~WXLSU1 ztF@)=#I-f#?1I^2W%@*qje<`X`|dCFJ>@63IS^=Gw{nG}N2HEF|4oi;g=TrJt=9|W zU@s>jwts7GE{n)!4gIU~_w6JYk7OB;?!VRXf|{jZU7-fHu))*F zqsM-CxT%n(XiOqs)Or|F^~jS&jxG`_OOPB%bp)`Ckbp^Vwa#T`1wN&rcQhP9XRSC9 zvPw1%6)-gVg+bg|;XvgN5VoZK0My|#+kZzzjhsg8Tv6+ty>%g0UcsMyb->|rXF!bY zc%?V8qqDYPTSe;=)vyBSBtA&3R@WJdloZ$wces$CFf_Taxon#sn^L(0BX?RNIX1UU_TGhTNC1 zqe@WsVsgf5Qit{ST$A79LCOX~#EyxREC%5=vgnif?pm501=%by6_?!_4Hc$z$NdiB zXZu}uhBLAP)P{NL);{H4g^b4?j3`xJAmjD|MM%0t7L8+Z%>tk4aJ8>6#r#_DW-nrG zS;ES7AX(Ibh25xVXj183 zGD{(WN)E{2#Owpy4lzXhPIK^vW;C9MHLZF_D?&B#begXKDDqJ#*Gj=dR;T&WE08Vg z7uw1Hr!E3l5|U&_<2|nJNJt$3?Byx+mKjRZSiv7)ara$blw@|D7ha-%uMFW7SPrCx zuBsubkX<1zhot#o+(`;&{p=W~V6RYK+u463E)ZdVoinCdej8m3zo)kcc#m@dJ^e5v z1bN4+K4&q|)Ajnfuy2_cl(xnxEf`8O*v1+g-~iD_#7E+i;lH4>n#WlUnQ=|hKygI? zs8-~dadv>EvqAHqE6NF9khMqou`u>V^CY<;LE%nj!kmt3woI7N5^ds{;yk5mv?U@+ zY=Z?TZc$(ppB~lRP`l$6`CHYu+wI=P%YlI~_KU=Qm%5ed_F<}tUD{cvXL#J-YKh{( z{G*eAxxf@*ui$XIf6V{sO$nXQumhU8qHm%qKsv?IoFRJqvOjyT2iVW^FWnpB;Pkm*ThxA3UN1yNeJ#EQRh4|^ADoqWe zJfHjZdx_U*omi{HH;K<=H>u8F&i2Elrk1^g^*+RO+Ve&2zR{tUvOD0*_nfyb1QgsN z6q**Yfm^V&e0{?#@9UK{u8mv4o;+lZ@9R?QJn}eMI$c#-{HDlFot&tL3kv`26}*_) z@GKApJZE2tA8tLFJ9uG)OrSF6VEzrLC)%4lL(IA4?&g}}`Ram;`EcM!rYQ8xCbk

      +w?kQ#3n`~p!qyyJ;(D}ZY?Hwi9u@JPwuDFROdN%T*)Ka?vSKE3rFG-FTF zxZ5x!HkQFO6P>PwQhCB&UIaSWD|MI6=o!9*ufC`OU3&=RMXwodJ?qZfv7!cJiJ}Lu z2>)F7-gW&7*xcx#LG3Fw@J-=N0~P;yBHfEs zhUBKP{T29`U?lK`n!_c>rNZ4akS`-9<-yUM>^FU{x?OsG$63O&K~W6Y!#Rr$pKo%=_@xH3dh%foAB=#rI!zA~G=7Qqj*^q~--A%2JgsN-JOhfdyi$aeWRD= ziV*kM#{!?V==aE>JPAL%Yzvkg;2I7yZ_&=PvV1&6khqy54tv>2=;c8SwG+Pc66?k9 z*o^tNsmKXthuQb1m-E~!)}^fnM0R_(WBnzbLqs`(S;So^j(=#PnL85;#%U~77(-qx zxEha|5Ej?7om2G~*=91BCmIj`9&d;K#Yt!HrFD5JdOBNUgwXgffR>pNQkRMqlCht}HM<9)`4FQBn)yIKak68s9py2mZD@sg-;{hWwLf7>LXnvyTfyGOB(XhyT z$23JbBZHXXw;_+-G~J7(<0Nmdtn2wR`M-ZFSn7~{gYM=DcS>5G`4bu^I}G6g1HXPRg;>Gu39aLkym1NIJDRPI$z7VL$|A0@`RH~Y6w+IFLo)C! zV|0|U**ZM)t6tcQCrnwY^}9I$rc+8SnKb)7c&y;jJ~FU{cq#O=*l~Y3+ZWW#B7_+Jdp8K%XK11YzeFHD?c@IbaASQ`^BFMAzxq&9>Ev=I#T znY8Io+PF8e;4t}=^`5?*mrwf~fU)s%f;iE97-R*ml*%z z9Y5oP<4Us+nHGr)1t+LQiM@lDG`FLCn$dE#MGvxj&=X5-6JDy>#}@cFz|S#s`ZkLB z`HeD?0DRE|;t?2|b5E1sF6QXWFaW@>uHf_g6KbmDJ2Q0U+WeOWL1>k7VfX48qM`gE z`fmnUTCYG?uaoQ}Jsqk)=F8VhwJ!Cc$l#4SR@NGbvlLle0ERd-0 z^tM^~fiAG%Byis|ZuEQCvpu{=W4Xlg600Y(*Kx;Tlx^@cUaaX%$2sWnu%B2`S%5d-t1rDjP6Ux|yZFL|oxksT%t>U21LN{BjH$yJr8fG*B?l<-|HupG zq?+huo^TOm2P087^dlYaqRhAwI$}$AG39Zu(M#~?<2vH5AtOnCwcb0mAXq9569jIq zMMd*+eUPe2fM_pH{Y0Z4Xc6AN(RK^QVldu`I*U+MV9xP^wsLyMrG4an;MXEMaS-&y zVR4XB)FYo0eZVuq{}S2E@|VfS+@4x?^9xcj+fx{Fr(-6dC)67F#!FByB{q&9T6@mz zVv4mh%8!z^)W!3%u>fJZ5=2t-sAoe=jiIl~!hvglSfLG1995^3pGIhGGzC?r)J8fG|%gtWC z6IqX1se9(IqekaNaBlCp*k&n|u+b19Sa&PykhM4LZ@RSm%vif+mEgs*{gO*)k4z?F zu~bn8jSz)^8{)RJil#Yz@qwZC3yVGFp<|=cpU6O`mIw?D%k(&3e_KxbNr|(Y#|=i9 z3~MX>17X{M_S>nH*2d=vn}{6{4oOjRjlT`yyB>j(AP9s0QYXMPHG#Ro2?7308;MLu zO&Iy`^ISeay(eG8go+aUP=3+_4Eyfji-m1ewSfe|c=UM{5Vcp)0`XH<_hC8mqY(l; zBV=np9h&)N{j%o1li>s6!H}0=(#s_|^oDyQ-7kSUH>gSZko5_{@E z?`4rebEWk6!3VyDa*hK#{z+tZpvwhi1~un7;)AUsM;2#7=)*RUX9BWW_3Ls!q8b z@p-*TapH4%Vjv9C=cd;N5)HM9-_l^uR>7_abRm{%KR?|Z`(Vqqw{9D;(R^`sxMqJcsubPVt&`;@<%LvVvxq#1WyB8>iLfU z{1@7Gker_qDCWPQ4%>XfI2;AcgoJCFd5*L6s&z*Cew3y6w(h{kfz zU^D?jLkXE_!KQ~hQ=Q(nPfm`V*8|LJ%grPVMSG#K(l>*6$@*LFzKixN<`~`$L8!o@`uIX=~6B)aeF{5LTG|m_0X>M^~Z~-n~4&c zga&(jT2AB!LZCed4dm_OS#hq+z;y{*gPjh}pW}`L?>gw5DupMnA@>AQvg`rnr`Oh8 zu;DeZgtlpLJQ5aW49^Mj9%6+os-K>$IIURq)8tVmvefyEkK#tBwX{zsohWz0!C$dy zG`(b%(b(2t3py}HKQ%$h#Jt0%=3EQ@O{jAT z;Mxr(Ly72UAH&P7!nU}= zKHv;=T(LWGydZ*FOfSPNor}mm>{oH_rFQ8~rDaCMjWCFyZl5El!Yb;WWRl7b;;*uz z$2G)sUg(h7$0oi%Ty_W9jO@bipG~|uSS@oANjqZ1hds@aI+twAJEjGmLo+&c5L`bL zk(EfBn2bJm82cvabS6V)(tX@oPQEPR#RtKx|0;EN(jolBDUl2s8v0~+n?;^%fD|v}!bl81iwx)bLk)Q!SZa~9tpX)CZN(kd zk>)pA%ZU>+7uMA2Dj2g`8!yR4~T`J^K!kC+nI7|e&FpVsM%Ah~1FD}EZ zfM-QHt7IIcU<3H8fvKussMxR`1F)x`@QupS3vpnrDx|t*BB;~)Cm`7dUw|N z6?anbV@-*gr9|Rajx70M5)MM4ClLj{zAUh#%iRvy*4x*;(e_e=%fl>*@NAzynYo7Z zeoGYZ8$T;dC?||T_;B19{1K$QD)#CDMV&b*CCH$`{ z_YEJ`GGa7wI#4AP*+x#DUC0?5dlJ*r`$|R-ADlsTcL21dqNEVRiagt8#;}ZI%PK(O zzcIE`j+~y%NZ)>0q8c)1iDc~KQVWorfF$ysfDb1W63%7YpL@0T(-|H=`|SAXSWO%e z_5HRco@0i%Qr{c-)J0zy4|m=K@gsf78UD8}WEa39SgzZ72!}3b21ihDucej{ZB_qQ z?yl5?|M0S$p+*E7?(JR2_c8O&9PJwDTTbA&_n3s#2DO*3hF^2^)t-S3%xQqJYiA1z zBU72~s|};M&8(HwW@a-uBi%-zJ3vt+!YrATn;ftGr~%lTPah*Ob3Fh^Ols-P4ALT0 ze9~|f6_yr&QK0@+j}I`LeOjfm0Q^H0)xori*rJ*VK;_CfQ#WJuNErA0XC4_0!Tisq zE^YhVQW)j6Fe0u4Kfg{jMKW71Mpm-fg&kSS@%KpT+wX~P?%pMY(ws(2q?BaHc%qqdx>?y=?tByb^eD(od@d!hCQ13WfqS*a zs}JP`DMdUTb{ord$v`XA&L^xYAd& zpWcC&ll?PVHQh51MYV~(Pu+a^sn7JHr)T|+IC3~zMd0RSm=YOfU!+t}(?lsGlTYFn zL1!8ywVFB^pNZ#w2q4xNJR#VCwG}62ii`=?L$qDl{Dd)Ve zbj-=>W&#)Q-=fs|Is&V_OXoMq4g8>LM15hBKQmP4sN4zP`W*x|Kc|sOaP}gMPW)*S zYm_ukAnNtuGlJH!>gmi)#afqR#S$hp2O9$LUYTzT#NC4E>{)rX9$p_E+RhPu8Gq0+>7QE%VK+7|}j`DwlUgOC%b{?Qgi(MzPr z>QZw&(F`AjP`;Rs#-`R}1ue&%v#VBP{^pGgesmEf1?8pK4K_s#!`WP^z5$ z@f18aI4w^^>iDTyGWVA@AmjePIX6L-(-&qR^U^h-fHV|s(dtez%+nV@n6ri{n{yh7 zHQ3ZQSJ*z)ZH}GeU57QJsUQ+aZM`+}qdx^L|4chW?jNdxqwWM5u7ZLdGao8sKg*47 zJtOMsVN}m4l5_uR>|H+`aF)=|xPB7)hzX7+!jv4dOFl5NI9 zqa#Z-m)|>Zn$lXY{d5q9Nslv`%h(CM8)!*43Br9C zz5KbYkxbkonK~vM^d7_%;dATN@no$4-KI%E`NPkVBn7UI1En*IppToLqO@BxySp=u z%y?tEi=u1%=>}9n?;5le!FfE_+RBI|Sgk?1grebW8q*C!s4g&E^oi4Yt#t-b(Qp_8z?z2Xz#P{zkOnHlJd(<$;X^p=a7doeq7!^-L zur4iw5hrc?nrNLe# zsQYcjDUZi#J}qwQ{24qRXEX+{J3l(45j8qE@eRkY{WvPi9Hg|0KJjq3h&qmQoCCA}hb3$3)7YI-K*Zx2wXUY#Xy1_R&bagiGLy*Rb?aaPg zFdgz?`2oM$!_`fnL2SVhpV zn&3P>1D+zzO28WFnLwf+(wC?p&%~q`u8_kF%L2z6tvjqar276g`v;llRvQy`y1Sxh zmH|HutHxVcA%Js;amZ+tm+a~zpZ{vFg#%PrVJpKmIM;p5|1bWFc4A5Pudpua-bI+H z9a69CTqtB#acLNjk0KRTvD*e0%!33Z?`HUj<|2) zAPNf-N_gx`!#e0odCR~>?$07c8*o=`e`VA0Cf4q_{;z;3&!T+9?Y{8CQe{3Bs@uje zSLK^4<(-cO?Si9%Ja9qWRxgI4b=l>P<<}Fh$%H9?O{VEe#cyJR&T{?@&pOIt6Ka7~ z*JnYom>U`L=_HQj>i|$(_Kp@7a|^T4bj)m;Km$rn#+>l5kOs(gGy-MF?)gyi2xwMO z(D)T9#;8C^a5PEG5j-LDb&4X-{ACr%cq}?LJ))bQuihH;4c5EkAVaE((lCn+I{J7B zRF=uz$MJNF!%L`#v)^%JJL}Znmaap|%&DyVq9|d31u4_AX>uI{MiQgj!qXwC#>YhK zuY{o9nz)?FAzQWGne18Et4~BT4a4#&tNw``&V~Wa85QchR>f#6&^4A9Aybc#0cEge z?K{U$k=Pi|PB-LNdW7|C@V8>9FmX0#^2M|CM(KnA?7A_=SR9C*ALL~UMxF>!3LWl* zqg2B}&?ulL!`6&4jRIWF`y#N$-dHTOVT_TydFLiW9A+0berB|)sJs)1)-9I&T2kD< zL1XxAe`_6#fG$8qB}AIJ%*XvzRgnZPqZl@W#y5RzdYm~^|G>kY?fq@P6|jpkA`1pU zPsj}{l0AlxA6zY46sb0D+Rt3VU;A4sjvRSps>atfC7m+iQAgIAj{}8sdULt?ZZUgS zJ8J}CkX9cKpueVkgH0upgggCG9Jq_HgCn6lxhG4pJy2f? z>q-xd{i9$ORYkL4OdjT~J|DkJ_RhnOlJL#yHt0~Zzs2~n5%en}>aGm1hz9T>kGvI| z%)~j9SZ=m=F8o50`Ro}O&}y%(uC5)7xiNVv`P8l*OyZsAujXp02tbM^VHV{@Si%5|N<=h! zuDFqDFB;EFid_r|$dA5eF)p4Xa`8D@}vRAQYHTtMdP zj6oL$km9%l8a8`mvFLRrsoSd9-x2V8?nn`~WWjPMK`z2k*jM z2mFHs!zJLE!PkAK!A#r?wHFLAi5n6ET4g*;3H*7@EaK3S7s;tg^vi7CZw^$Hy`@xa z0z|y|#x}>KM)oxLAte%DaJQ)%c2*XHxF~8<(G=7w{ANfN*NH9+Xx?IgeC5p4!cf9c zNXufZYs---Ck~Oe@rtF0rYER6GJ&R0j#oc&FIn(zQk%r@l9hA$j1PXV+h`?DR-m`j z2iJo{y_rJAn1tV)D-K29k`CNi&O#dM9HC}yO1ZQ4qzO%s0l&|pm}(Re{1#&diQfqL zzkz4T>BY(6Uo-qdIsN(~;8~*W+-8Oyv>jJw!6>eP2aDGiipM|NP_J)9ip6%I#L%tS zPdcO3pYl=esJ4$|qZdB5HcZL@v_)`f+;DX#32gX2cMQ=h|JzlX6Jqr_%u=Ft$$iS20vi;MAmJGS zz;s=|`T_3zQr!K|AtGX4@%hZT6~!BEvy8S4R9@=QS1(bx50gAAJ-;oO?S46zqrr@} zPHG=KQ4wT!B^Z$mY3yC%4aqUtV!Wuu(u-=0QqsH8E_E3}$oJLA&OvC?JW8zdRa?KO$!b0q9!W7gO`6=YW$y#sMyb7sq4Dd>V1pxv5V`$C z3&_z~RSK@$5}RWw-n6$K?P#idLd;5arOnSkV_UZfulqU4%ci1(G_K55u^Ir+d^JGp z^SXUt@g=0vyVj@keg--JykU(><-HhbYczRNufzNUrIPj_R6a#|JrflD^}(u>*G~=? zar2^UT1-ymCA?uo?{+XzIzC3sKG0TU0Ug4Ns{_ZX0;Hb94AW zG;FM?F+{6AH$t^tfVx(PuX)*x6oWYT5~=ukv|R@I5Qw;AT>a~NPS@nSX#;W%CDt8% zaz%3ObiF)e_L+(q<-ksshuWXunlsaGxa*vxlKmm!aEVVg#UIn*sBt#i(`Mhm!N4Yp z^4k)cIKEt9%82Z(T@x>04Qn@SE?qIZ1UD_+Z;LKj`_S(5I@1Uk=#ntEmOnhaHr*Zl z(9*2-Zu2Tw%q$r;Qc)?9u3s4wZrr;rl=U-+8!~nMgu)Slk(=`(e%4mr8hWjRmh(+e zPPlYLZ|IU&P*HhCd0jnhS3Qh|{&)tT@!H_$jXOHE7P0)wu4sfJNKuh0ZRAU2s2g@6 zkDYA!PLcw^V&KE$%UV?vl1-&tWujrzDI@25fr6A12Fo)RNA``CZYIv<^JmhG(?KML zQ3AtjQJ%L&ooi6#BSAqo)OmVQtVW>?Wuo16a|99hNGW5(M3M3bS|J#_a&o-(R#*f`m|1pqHg0@P*HpQV(FjNV4ozX>FW)y9tZf6_=S4g+AMON zgXaG(^cwTARjxgcXSB%~YywW+H90sq8K|{8@oY|gN%JpDh%gl+f2|I%G1AtzE`rI~ zWNBtEz_RJ%?Z$(xW$ z{{<8aPlpkWa)syWfiGEbT!5aHM}0-*{{6px;*RfQY|Pz>TWwbLinKa#Rp?&^S7tNX zA#OE3Ry(c;G`BqnE>qN)kT>?00;r*X68EVx9#1Ciq&DGKf5=O|y$tymjEo$j{f?7D z6&EI1Uyr4Aw%(NFqXj(H(dcSff2{HPv9lPT*>sBPEhUbhmF1WDvx7(YAmPnPX5#5; zYx-9MUc-kxE#cz`jE;h`{7QuJ$&>@nTDfPJy~STP@rh)_llq1y?N(*=!(nfbE<@Xs zN^9@1o^VpWf`cxEnitmzSfmk$@7-u-V_I66eL2N8~FhDcfUEz zX>|d*n4$6D${QLE6&+7n-xfq7tiaG$ANL#<10)28|0O=J4c?iZv+~v>im%(I{wbSa z|CuX<&|pqadMW#{hBUg^eq&u8ae=&U=s}+qg693LD$8&{t>&P)NOBf-p!aTE#tp+`|Ku0FsiNEeEzb|G72w)SiRMQAkPP{85JH<7XBd z7)fgNAJcc&qtAj{>4?@lvaM{{bf{f;XN3&H&L-QnNAK~$>lSY+d5xc! z`{}Lce%nREo6j{Kfn94FPvAS^6Z3pOw+F7E8l{TAe{Fh1yEG*`@e;@B`|u178w-S; zhklVgT+Q+&oq{8#OWbva&2#3?jL9BAS7uZd5;4?%y8%Q@uk6=p_Wj+j3_zy*kpP&( z0IF#V>4M*Bv*IbfpC@4aOY;T^9pJBCwZYHUa0!y-n>aU3O*y8ur+@!(cv~!{rwO)W zw%H--v#OP=v}^iN;7_KW-xhvZ-KSOV|H@gQ!15Qzm z2e**@3q3oet`8Z8sNK-sn3&2CXcLEt3(23IK*{FHiDNVAW+z{4x>e$dh!knX)0Hrn z^^Ze<2^Y@4`)=48zZ&2qumm)55N_`$oYW%a#H;o$ta5+2QAYl98o0Gb@1R%C;e9L~ zBX8OJ9Q*R!&X5;=c51?qkjxM8JCsH@P3o|Ap|IR3&F1O9+;idEm6K@&$8R{()Ahl# zstYL=2V#I{o;%gUOHC$Im9C5j4@b|{b5+6zt%kO)i4LScyp$Up6bTe2C}*_NG&RMt zzJaP(YGF>u4Xyt!6d0L+_8&d4&dpT40p$;*ew1yf@_poH=a!?woJelSSU-YAyWUN1 zg!wtw!5gZ%5>XZEc>Xg|QZkD&3wylE*f>3vd}X`jK}1AU>=ez*qSlFXloqC`YaAL9 zCRU{G<=(`*;L;e?1$o}k^~^3sa?DOZRidSin~~Yu+q*VXP1RxJNxn>|H;rlgdtKaf zxaY9vu_P+3xyArXN#EiWGDbiEm4w$z*S!c!*w>@4`W+l9Q-43acbn4x%#QX14cEB9 zxj8}*LY{!60Ei@LcmD~yEaa{DRs zVQracprfeN%e^&w)`l4qBZ--igewjrBcN|9$GvfpY~f}ViA92R#VYuT5s;DLR22tr zjkF0#pOM{UvDxG@!*O`kJpO))9KpbKbb8rMV}i38zZ*$^yP)yj6hYi?Zog5& z)T~gO;Vs%oBsYJ--SHG}o?>n(^)v;2Xv`|^j%FRdw=16=`P%mI$;|(yOyl!nPNCM2Zk_fXgW2%mfl+b~b za|`H5pSvnimw>0Q?dh2sqr(NZ$t>J?damzI=Rs8Ke10-6B8!G9UB-cbG-pVUtHiNd zSA2^R;n~gdhiE{%Nbk(zGr2)#D9|DGEwCwMfQ4CrQi|mR+$8+gcj|z|aq$6L z7!l#xa+2;n7ct@NGbhWtrZ3K|CZuubMI)Htq}}w85C6V0IS1h`){5P#clCDi#Nt4L zC`Nre^z^hV*J9>Kjc(yRXL4lZ(BxatCgNFl(6^HDVEK1@o_3WHUdvxw5K(y(dv z%?Oq=z@EvxR8rTqg7PNixD==#!xi)?p4ey9Tp?rHG zzd3^;USzFC%T&6o?9P==X_Q3UL{RIxY+G-w2498JfF3Q%p!A zCCG8ITqRp6q$uNEi))??3}IcnBf-!Z?re2}-$6R+~q03tmhFCqB<|RI7GhzoO!Z zFJ63(ILpodnIgG%rb}qd^d4Pa3|BTw_&Ro;|OsItvZ2C z3q$-cb2F%JBIG*F!dro+oqh_|Rk=$vS&g4TM=kgv+0<=l5hovotPcCBKLqpNoDQxU zzOL?CD$Z7eGqRP8!Tk)k=s#x=(<%v6`?!ip1zfac!biA!%$qTdyIo95^m~}{NAzk& zKeO}3^&XBEQ&?Su9lp#@FQ0}=-f-F~b^V-t%BfOWcd`%T9n$Z!rvAKGXocGL<-=*+ z-XHVfHXwej`CgJR)^1%ONvOpZvg$m?068mdMPw#x5yVJ>L{n0rUf-<4z!-TP#X!onx71 z>{Pzy+QZrCo^wl|YuVUr&{=zOEm%4VHo~ChFPy%%{E~g~#;|!G+rn}f&8Ezbznh}a z?D?sO_6spRrO12Jv0By?SG~m-<1#B#f(z7XzOAAZwO8Z4Cnp~Zf-gF-5TW~#B6^WP z+_|o$f1gtQyXy)TYP-p+R=-!d9_&sSZH1O!F+v^UY`hrqV=AxP3j&#at~-pN;50P% zb*Oii!?0uLQ@+fSo4s?~B<*2n36Ls$rG=u~r&|7azPUH-bLIBVz(NC=*#t|tuNcUM zsJI?1@Fm=@FDjv1j@Vt|b?Y;+xxzEn14VQvjP|0yXpGMHs*0uVU-vePU`D^zaJo|q zQ|Agm7@z*&0lm>XPZyO`uRZXb(Ax_?*lNt4_`KDFt~k_&q%3|ND%KCCRFyZmg#^j} z+$i6AFB=KRsh7DN0Pm2V3ZR^qJ=!(m)X^<0j>IuLYz$BKlIYU=ad{pvy<*}URNZ%K zj+hbHvGBZl*;&s_q83X18{&K^SL#4u5t$7Mj+C;Sy$~+84Mv;OBY$IS5FmIiRO}ax z;$o=I{FB*B(4OMkOoZ64*|nk?BkblA{^dfU$*l%s*(CL(*#!WJ;Aukv_2}sbCY5n+ zIc_}0rC0A=H5!b2{R)~`^Y#uRC{`~s7Zz~buTJGhq3R37Suv5vX0o~fDW@A{e?nta zsQGQ6QS!#g?3r*OGg!#Vq_V9+qPYuqG|hYV#6pZ-KZx&dwn-TU^wNJebY2nGgaNi# z?o|v9EB01uXgIn=AN%ryMCUHD-=VSp;epa(v#`>^bP%Jm+~-}7zTT^% zfihl%FeQ=|J#w?x%xkL24e4l4oBG&YGL8^@)gRql=%7DGd3E(Q;-^q2U#Fg}>K{WK z=S#Dp4M_D5@CRmDCL0UDypwOB2P3u%P3SLD!jtph$XHDrSMtb;$C?FihV+`Krw4Vk zWa3U>&dNSiy$kh6xftOCe@MN3ZgF-yBSX`36OHozMMyA&TcYk>lVWM!qjw0C{=`$D zFnkLmAgj*7_mzYxcIN6L=`sT#Ig>?$-34FuA?wE&nmCV5|F}z7m9|M0IVG_7;@7&H z@bBE-w+qC2;gVNT1@DDO5yT%bBjCnjqFa!QQi~jXc^QeLq+?u1y-NG1e9yllpZ0Qy z*h*89RAOTX7nOuv!(WG(o~_r?!nw zMo+FT@#7J?#PTmZ&PltCc(cIg9>U*yvr0G?fE-M3Pno3G9}^4%6!2H?=~0GhD`Gno zBl{HXR;?(7sU~GIoDvoQKDGpw0?T`GJWVTg2ZkIB`Bf8b)`@%FxYtLfEVJ4}7eksu z3ehfm%>2YUH-l@5()PmIuTH#W5)p7Pne@__($zk0ph^NeaMQW7XREQD$bS-W zAmWROF*#f~(KV`dH=&_vJ7zUYeHqgJH2tO6@Pbj?jw5Kb98u++8U#112vg#@zKp#Z zZV7D|q*4EPpukgZ(Z9|%Pzvjvvy$Ce3d~$66w5RGfbW|3D_k^t^2cL(QDl!e&AtiV z=FU^Fd%_@__Q?}@{d68ED{%lQBa$5-TT8y{GQCR#E`z<2i!rWFR2qHjThIY*crZoI zGx9`j5Kdpbve&29HqmR3!YCY8Su5ClVa~`Ph4PsaoiTU7aVu~1&&A&Bim{8k;#Uqo zeVlmJYY~-=p#ldusB??!$hg)#?X@jLD$@n{hvW$SJY#ACeO$?#3p+2O_WoCGyY>EZ z>nJI=W?xE0eeByY>7<04eQUmsjMuTsv9rb9PI>4btJlBk8>3EpC(jUo3WQQB3*R!c z3i`1kSHBx?E$<>73L=PLG-%LU+RYy>8jQ22>v*$ww>(o$vcB2Bn*qnBTeszv7f_L^fO1@@qPfOgUSAvlcVsY?53WSL>#I_vw$^NqsMFm$H& zw;J}0U8OP3D>s2gTn%TOJA45KSRkXGxC3j3X7jN@0rO$T@+9Qz%A!oby(p8y5?OwX zq&s#W2A)sp+;7DZKqfI0XQ{l&%Go2XFWv)E@&`wx#UNQL^r8*^R~0@Y-T9)1d@VPE zG#cZ-SSpQeRn`AV^})z$z$uHUme;wFIz4C$pZKv=LUQ=SMS#ec~(XV5L&~ z9!ZF1=*^Xn%809?q-w!)=3IYj*ec&-Fi|wr$hhDqfu_i#yR6j(iI^DN{%%^Mk<8wy zsIBFsBadbCq~nD9Ep0KO-7(JkgPfsH1=2%0v-O|yWM5w|Y$?g~kZQuPA4L^}$axZ+ zOR=1Zk$t^W+LsGsBeS&YUK^JFb^7kUZwAGYb?FMz64P#75Nr(9Nbu9N5ThZ)%J4;U!V-N}#_MjM*>pWUMtKPzQH0f{6pH1H$$CxaB%^VFM? zWiQ>%y@!4^bfY^6o{;k1I3a3-4tf&hgNBG_3&AY(zV^xi=h%1ymos$;*W|&rR^3*y ztl#^4(N&=`1UVuuLEWsYWXs6bV)_OF9yJ5yo5^W+Nx-? z5&~bz0V=UC)4s%j^ABQge41sChYGLZhD14vs5b8LNz^yqpsJxvhka@o#c*%3x`}>2 z%^qPwnWdS?M|Rw+`p3plQv&4zN8+F|zCsXKVG-%^SAoK0NkjgfH9w8(e&k|G-^tDU zLJ{)(DDZ@x<>PzHXjby&k36J$pU1A@EqGGW`|5}`1qfw852En^5Af#3QqZUD6DW8$f){CK!_k)<)(77NQr ze{dn4_;`NzY>E2a5!V(wdX9bd9pzV7-JS?0$rO9)V@q&&j@0$Vsou+Xfcgt7T(NnN ze#*7-f}r=Tx@YxrqjV^MSooZ>eTLHnSx^8{(c?D>cfBKSZPCz5u1Ou1asQRp3a8VWNx5Y-==@8AU9T%hAOy&qh3pk10U?OhMQb&R1p!w97{er zXgH55gvhnAL5@F+ixh*gTZ}5+Kw3JawbAtAVpp3|{Gcl-_%mtBDP-czgD(po=4P3i z8}b$ALUBaJb$yA<=v{2QD?*u4s4w;i6@JnS05DZo@qF@>AXx;?+UnH8q&$UQ#eS`Fh3j%Kl@9Za^A#=r{{nV z>!vRgox}oh2u*?rX-ec7W>&>`kI%(H;t}L!Ayo|YoxeAqQ|poz9@YtL8`YF~>f53H zkgJ}mq9W%|=L5On{X2#)H`!XtDea~d7`{K(NXcD#_feRg_Q(ZHxC5zwU_bG!E$1Q9d_)`B@pYHTz`?uR8XloC zE#Ru~TinckA!?|u&CGD=SzBuIdgG%Nk8mz@Aae<~Ruh=$uHN@8(?$IaOZzIB^0u_4 z#zg+rvR=`y?#kCR9|m?tJe=|xZD;`vc1238MH*ZP-bj^WD*P-`n^N$TgAf45m$B+l zRd{-gj$^XuZeXOT%as@m1wWxBjSt6=-|SIp*T>AQTD-txO}X{=qzHQ@uFoT@qED^* zaR6d;6Du*|6y9mAKvh;bX!hB2#HCRu!2faY5{mb+%x;TL^lUz`14@V{C)bmW^c*Wr zWj2ufW;^qHuZ?D<;I1gz-V~^+`vo}xKXZT@>{;YUKg1<5wMyc`;azt;vvo$zs-Hge zUcTwAXkK@3@)jgHCksyjs;7@^Lz@sc7`<|DMI_Kgt&#@LH;KtuNdatC?oKlzd_J6C zPxq{yFYCcka(mFVus~E7$kL9X5x7SB`mmRvCHua9hOvk%ep|1^7+*>_4ogB}sEb=N zf2MBlh#(v_oJmV^Seg6HoN=CrG&kzF-TS`BO~+u)(Z*UJRXV$d94yDW2CAi@;VW|T zMM4X=A4ir=QxZMvP(2sfIB5TWo7g2vSKA<yEq2ti1(PT?=Iyp7u%*LFBV&wbY(WEFGhwKr12aJXM;4(V-g2UK-zpc=ohZ11 zaZhY^I_x<=VEu4A_z;XIn~P+y!e>u9F~qt#P-+9K+r;Vb{84PiW=8Wz}>o1jsg&&-M)6$7PnVX-wgkD8pEwxKk>Vh--opdEg(Qd<_E{go zq=9Ouuv^SdI31_tA04rvmCTGs{p6$f?{D6-^L+^~-IVP}2m}KCm|4f>4;)pyY~5q6HDos$N#HWdf)aD& z=SR#z#EBn!xO)&C#QO_2_K-oF(3IOD?Hi$ZK;u)4&<*#p~t&Xvh!Ih8)Nxz1zIS z2b`(AElU6O6p5c>?jNd|X%bk3xgq^Rn~+{Cl9E*f`M)e#lRZv{d7e9&;+}&-^Kp?n#a00zgxr_RH!UEO={uGOo%RM5Nao=|GhSlZKYME5fBXfx_t4Xb5UoR1QwJHIgU z(st(M%kmc+TcmGlor9GgH6iMRNUY&RX7es0y zy;t6Rl{EzIRYJI8AGB5`C`d(IR1lSIgDi~<8R844LI!rFUN{tjcb0mWriu;JzmVy_ zd7I1l$xiFr^b+afS31E`SgF6GW{JEdmAD{1se@R{N$OQTPFRj%VcdO*>0Sq&v5T>F zxUG9?-(#w41( zZu~>yrAut^G7dTE(aNA4FlJT8%GC8q)>(frA3I`t(G>0BVzr?nOHIxcpOfzy6>lTK z!-F-U%D(7c#oT?-YHLf7{5$l)F->1jULrlRxJX*C%%$AQFw^6p041@LG(WHfJm~X= z;UamuDy_YfQhu4aqN=R@T%CI3g@jE^jf9N8yo~aQjq|bxKkCodw|;oQ!MX(+b>l^X z#g>bQ7PJx5lQm?+9vP0TQe61FF{$>_b{@Qbqw zi9f5d%Drh`@YtXU)t;|+z_ZgXmOl!SFr);Zp7ZV1Y3LUDD%Iaur zB%jg3^0uBU$`OT~O}3k_{7N6vn>;~R(WuX$Q} zHpjc3JeEmOUq5sUVnm#$eu#zvj0gFCkbb|=2!h{pW7n+27oxQy00TxEu=)~n;z{YM z#cK06@Pt^}2Num^=bZ-PBNe$1TR18_-I=wA5M4K23?3}`uYRt>Ag2}8RsH`kiIPxh zl<@$AKW|&1U(JM9mL2NZ%Q5w8w6`jgC=E59z~|>XwIH?)1jbCqG8DJ#Nh9~w+j8^i z46G|fT>Qn%OBg!XBq*`)2ie*cTef}LdczU=+n#1pj$xcWwEQ*hLkNlRwhNp&{|70A z4W}05kAA9lEr&qUI3p8!IO=Zva6_8cpegmwPFk;R=oC+DOUqJLE*p*CyG7Vk3olYS zG3VE(Pl1jSf;t+;s#d)diF6$7ce%uuIP?mc+o@Q(=k0xXLrmfpqOT z@*6rT*=q{_0rRy(tvGhm%@p1?scbZHg*iQtJfx`7J{$iGRZY{#C^lH^)&jgw5vHm5 z#yhUp{XHov&B)g64P8?NIPYY~U+&~cs+98P^HLH#eN6RqrR;6U(iB`#uNn57$1lLt$XNt(G!%XNHlQ!@(1kCz zA#~9+DddhWz*vO9@$J5>=LzK!$l|!PfNboKwW33HE8ND&< zAXE69#}RkBfp#-F0=?sRr54MHCi_l36v3EjH!ncb+OEIdD)@XreuNfzxs0GTvSFpf zo@XdZav2CJIoPr9YPdk(qp6Ycd$<|R7s3&W(GZ_eUGg};nPK$%vg}U%tC8_Rj`Vrl z`6t}f<*&SgK+923NtL$6p9?~!7M0XgzOk=*s`ALdH`^fg>(Uykm#BceNX-@zSwTsRcSmW@|TR>G#n1C zu7um`AWTsI*4$fbG%g&OqSc8_LvNl5!dExNe{L`a(~9dR%8il(lQ_7%W4}yOUOfc? zlpTLNLRdC`2g-avmh`vfR{$<0?(7TF$L85)D<%CwtpD;`SNMFL_tWzZtG^tRB&D(< z?U-w~8)1wV*Lzbh5-lGmMKB+gMWa?w%80+bBI8P4YQ~O<*%Ebe$HHgGVi!q@_&UZ2 z=`Wcx_0+HZ(hw)5^HMWs1fX9%;PlgFtkFkW29^oM?|A<4JJa@0B@H|6ZP28y#29G+>$7 zYjk-EY{2hPKdp7q61bizl6217N_-GCE$&z4QXA|9F5CH^Ssn}hv%pRsNg%tY+ufqS z3UQ?I+1FS`J;YMXCCCVCSH~XA^j0MB+%(Ml$u=N|#A8W(yx49&BWnh|9N>Js0M}Li z>i?!#JD@@<64(B~LL4YsYmp;(Fuu_N}4Q{4;&o@)5D3P-yxn8id&SZ zmLz=z6hhkp*Meh-v*+S&Si{|XsN2iH(+@D|3RhD_#y-y(k&u1xwv}waB5=u1pISjR zC;2RMU*MO>P0$%~P4Svz9@Kz<2Hk_`A~f6(T`N z$oby7BUxD{b{4zbq@|a&(ai_TveW6fp>4OwHND@Y%yM?dW5-zU7~NUmcL-SsYr!Tg za1wybJ|1q`cdZ{lrY+-EmiXveY`orX3aLHKpzaceIk~0z1O5uW`wr{kGqlw-+Y-S5 zk(Gm81%~w0*n%ZAIfW9}#sbS!{$@=y8je%L(&Xm4W*8#0_5)h;+lwV-$T}l!_QHl1sSDLDd*ItSxl-R4ZX$_IkU~xIOeBaD(TQpEt)% zGz)Z_R%f#pS|n9l-iue<6+WN4P!xkq5fms}iR8RIgaZxPh#h5h#`$-i?E)GrL2Z+2 zO79B6yzyxs$d~-hzVUp`Cf-wLNHC|+UEKG;xgq#BAOMN?w^9UIDtngd<#u0)_)`YO zKSrW=#f)E6afa3Y#Wv55xUU*)550&U;F$(2k%Hfm*X3zhLOD$NA%rP{afybISj9z-U z=n0JRE|}A=ofr0!)fl~BNVy87B#q&<)|zp_XxKrRjVKcj+7bQ>d^x)zlxI3)f6t7* zI8FI-({yA$J1uipeS7rT*q)w?wXZlIrMb>!%7PTR`wbWFZ6BWNsk{PhOR7ZIuyeBp zghhXwC=pi(?N0gy&@%lde(NUqsNqdNoFQ}YH*_@a$YRFQyiJLzsv0&LXlvI{?xw=O z=d-YVlzMArBzYp#WA?YckP@f)V<=R<AM&6=3aSq|lwCcdu|E906fP3Wah*cWeW|;| zb+BL`&RLuOO4%RQ#?d9r`r&{GopQ*!Pv0MvTk}wY)OXIdBi|lk5Bbl~Z_@QQ%jEf6 zN^yZb|3E?@TC06)aB&gh8F2EXXTLY=NB=BX!u&(GjsCcP&*A z=aJn_T8=e}IE6+Zh4b}A;Cos^1ZjQQ`?&?hYE-{qE;1|MZLNOKDoB=wN(mVm0ZHaRZpoUhwx$e6 z3VA=w`?0Nho4B7j$J5y>MkTW7*kJL~FplE0ehA_C%=1{a+3u}#QPu<{9tRNac;dah zXuxogj%$AM?Bz|+=qF?5II$(2U<3bz?os0-L(;d`T8;_9YDX!#TKzjq=2wm+@sb>& z-PfwgGMjt-qhdL!A}o#-0xyt8Td$$CQb&TjD^wjJmEmIB5sL?+?&%Cb1XRD`*)3eV zztFp6QZ!Gm%B?7%q9P$VRdaYw!Blp80BQQR%QyXwV;$RoHbPP`%f&2Uda4m(5sz;IPfW}GKsq> z>hFI!lCQ?03cI-D`=YiD*=TY^u<`tPVO{3# z+-$GV_GC%5+T5=TvJa}mxjC3xpKxkXrS8=RqoRsJk2X{63%+ZTPtzlG;uZ8?91}L) z&P_#WQq) zn*#enMp>cb@~NG@{m#{ilwI{N$fg=NY}O}BiJVrOQAfWdDsY@r=Fimn504l=62BPi zIO9%c4&6T*vm&vVHf*J(>J^RDkl8Uhub(}W&W8Mr{_Jg0bZ1qO&-6_ME5*W}ncLp$ zC`M&iPpl*P1aY!NtR58BWl2h4`rrt9`F!oSFLPb))=3#KG+#aBQ!XqbdAv_zs#a1| zRl!;Dr#HMV3{>fEH==gcdx3LsW|De8Mf@woiuXoM^-Wa;4cX}5PY`iYhid@wp5I%@ zq~5;>4PC#Do=4dJf%_lVktT~0|G-IKKPUUvi=eoKf~0c6bPOf?No^$Nxa}z);J|C_ zXx{?^s|)q53M%GS#K&h&9K3W9K*+ni<%It!Po4!&19H%c&0vZ=@v+FolDRF z;jz}3CNJ<6_xDVy)I&LvYy^pS7x8rD3-E^^nepP4@Xy7(RHa1F8I#sq8s~h~(3#8H zO2jlDn+ih>-_=bf^WPsfcxNm!Y=I;F7~T79f2Kh|y+RE8Ij$sQ{%c@36_+tXCbuPy z0k*YG78ZKh*+t%I(I?TZ)K~rcQliZ*M0tG@?Ia`O+XZEc*5_88(ghtQ zex0bGCPn<_0Jaw)sM5n4Cx9lv>pIGLR#I6uVz{^kh(oIm_n%pUJ-}=s{5#O$`(ppE zIUU#P3k45_FmehdIvj662zzUM{Xn;03=xaCUZ_naxX8-H}^{20X_7%?P}ecA6$*CHlqcQ)--nU{K* zvG*t!+(NN}5Q?pgr5F`HlV`HY@z^PJ&Xl_EWIS;xe$>lw8bBs@mu7yhUVfq8?2%)L zi8mL1_Dla;=2Ij03o0gyX7kD4VJh}N)7vo(*`)H``zo7{+waG;VN7fe>Yo6cc(ZrE z*)pvB_r&efULeVl+{`~MFfb}F935MdS4Qu?+Ag+fW9M9^=CL|&br{?Ug>AVMHp1UI zb0)T3w!n<}cTm1N4HL;5u5GrGd{@UF8W!lRKOhEpwq{7q>vdfX($2Li59H84Hs6YP zZx?*f?Sz(5=vx$XqP+v`ziUJI#!l1{$TL|5-d?vPC@O+acs-s9Kb~(b+1N>&JeMN_ zhrTA&ZYB}*n(kFa0+w}_%l}kzPIL%Gpe%-9>WAirhs_CQ2NO{^8oTa`Lkn7JG)vZ7 zBw+3xTAA&O?sitg@jTK`4BmIUk%AkMMB zGY_{QF`!ZNtB>k~mu)xwR_-=ky%)$A`BGr3N*N0$OxlA(q(FCps_r13!c4reOBD?p z$@1j=NUxT9FqV*6ZUnIqm5oF%u~^NVLU|v%vsO{nF9i0gF4&;AJvpt?L`kfe@wzcS z>2b1J4V3$7<&9sluE1$_3!;=w2K#u{P3D!if!R)EpkisE{#W3=IvSUQww4ytX;}~X zQ3xequd^tlH66Poqhi+=&V_8oY`2UVORE%1=KZ4}i+yd)c4z>X zG91I7*9S4sdl0)0vFmQuo_Jof$2x5J_7%32QJm6#i_mdhS+uvfx{|{jZ;LPKglzZs zWD9VSZ?w!2fhc9J6e8*7q*t zYnr%+%HF#?%#LU;*y4O ztU-UDT!e7h_05kp>>u6F4(yIMzl8(T#Wud$B@H2Zd-2kKY=R`}D!L^B)V#2(>Cj)O zpJU7#69?CB(I8_Qic@zLA}O4=90SARgw$#!-qLloG_Ze3Ht4Q#kTB8?{e`XdNdM7y zwyrbuPVZNq8{qfT&*UmOdEeU;hvxNJlhzHKO z3hc3&3~FHO!8HV{_=kN-ZBhoQwrvH&{|FsQE^jwPl2y1jas?2z8K^85fMXvf(e%yP zUkoPC^s)}evL0n+xX*q-$hF&%svKMMy3wB4;oc(Es00|(ekT)>R(Z<5&dC_5<#RIUGhd33TdWryz~QVl(1J%pO&uHOYET=ZZ=>BCM??(#XUOu2?}`~ zZK4*ee~qY6=r9Pn=P&C9QD3&unEQ*+@)g|UzijL(I~VzXTSH_4oFz1#ZAc%fD;*e5 z66jovuHK%7InSr611HyAqKqR4^RRONlj9 z0ll+|PQY&YsDC}of&}*oClb@+Tn?w&JC)U1#4rfhrZ^bkid|MiF**O}H&!>1vJrf5 zH9xMI?RTOGPY?C~3OM9%4ZF*z&3@S9O)~OsgouO>&&|thzBtUOH<|wp_JobQH)`0~ zp-97R-P2Hj36|2jA$>yxUXuLHTj!I1E}%n4SsuOVgsiPkPm(hA(2$|0wv>d!oB z0s3oR``lftMT9FbDe#z-?orfHACPTRS;Ot8?uyd&*1gzJKBUng=x(M>i zzT>&a=Ese;3!>)z@R1}O#M98-bWz)hf~X6kKAo})V36$8 z=R9Z8hXLsn^fl7w28y1RzDbhvf#}}V-Zj0I5CMf0_!^7yUGt>BTkp9uLQl@DAMQJU z4a3^R3-QSGjyFKD$6Vy#7;uOpx6RrM{f49h;^d^xQJWAV)-YVS5DO|e0H9A zuS+~s@_F{TT|-oDTl}W{J`4J+MiP=avdsJLSpV~j8m;bIuWUh7qkt+NuM6tOQK`gF zE4S76W);9*vVEBoec`r{zh`qWD+FPE_+<8s*D zX@5HicJPAbu>nsxQJ2PI2t4cJ1abv;qr{+dVcQphC+2_PY%I0s<<`P{BqzvHpI>B` zmMZw5r!e4B_W|<6w+x|MMLtN^7m?P@*P;9!gO1gwSx@d-hx2fJkNJ+f*>4N;M<|{3 z9D3=|XSI+t-QSW)>1o*tKa{w4VZj33DFF}TdvTZS6Umois{oI1_&%0cR+BsRLj>L9 z_G?DA=N%YY8_||37UX@EUohh%`DR@G`LZVz0oYl`WvKJT>Y$2}5Z+sKbf@LPF<&|p z^A#q`t!EOU*h=dPhvjV=9l!jm2X(g7M-)tH1HmlP`ol4jcNo4cWG+2LVzsFVz`#J& zfnBH9q;{xq=m7J589Ihi3;SuWE4j-p$Drqtr<-^$rmaJbo9C^ZaXs2FwrgVe#uv~n zgxT-e4JG8Vb1zhY>9qf213C3C*={4@jb1_8++O3P9#6G_y{>{)ok~UmfFS0LyMp-3 z2|e}us{UuNA$hVw)O~x2*{xu9Iy3?hYLHL_05XKTLQzxc(6dk&&R>WsusC-5AMUox z;!Vzt7tN%SC!LJikc2|K@dG~^aKdAao|UT{rnkeX8p^Z>B7?=gKPJ@zXg<*N5{34& zG~}W`7Uor>4d0xE*}fg7pCCA965A#}eR1NFlrokJ?$6qnUwgG3`;3S$Qjzk&sHlQ$ zpJ!+eV)SJO^!?#+i&();&(gW9c2MVsyB48ZJpal^z5ZPWoA(#uf{$LJlYX{M?PhRQ zgxyLX0^e7H0Pd^E+6I4V%qB-RgO_jDSUR}c{!Hz+z8LQ`zA^<=<9Z<<>&mb(kP`=^ zTYGa=Y9z^WJy%0d-@cLxqVWIUM=JRLPHkuhA)47D9&&_@H@G$+wh-HRpyKZj-!UHh zD7%(b=!Hglr|q3#PFZg7xpd1VrQ^R>zjLE|#D;PuLccIF_Ekw|N#>u= z3Ap3HYEt<3F(uB#QenfJB1uBbT(5wOaKZz~uUyZV%$L{Ea9MHV=c0q4qbF#}dh8Tz zza1d5eOXR85j&C5n=k2zcz!NGDoK zpev;pVCrzFO$UJ5SCaj27Om&Lm(Mf7SuVw%D;8kWm8Y(=Hrn|CR2T8L50^J3+_3 zlD7PbSNw#HbLU23h{PZp%v#F@l@%}4jmk**;l%CNP9F}=)y{DPjG4ifYAUP)%V9NG z@@th36*%J+oWG}g;%fO}^OFGrkB>ChNf$9~361pbKCmkt zs6Yv?tVBhLLA?NFRLmU%IGJI(XKYC6=?ICd1;tRGY%sl`83q+?BkAKR+*+^FQs@RB%5>CN?n`{XM@?8GLRF+`e+$EWA|X>j|-qxi><0+1AKEM_6e0^cQ0ivI|-$!6TtYTb*dLX{Ro4K9V+j zmy&y)Q3sVc#&~nxC@khU9E)eB)=6$glkq86*eYEm_4{2n(1SRzN4f3OG&%rPzp17z zy||9^fCx0V)FiN_>jKM>?nQHp4+JUp!T4vTMM%-)e(P-pHohZCxiOG&PT-h4CRrnZ zG^8DSz!nhcn@gJgqJeh>t1pUSJ2W&);z{M`6EXrfcz>4qRs*Ma+LS=9pYG2(WnY7h z9qB`SdJU}|*73IumP>t(X++KEC6H-k7K5zIe8JbuAy%>eVOW8lSStu1`K;B`Mb+T0Eop*ZJHFVr)1-!_r`xb}zVX2=6ds|R+U#H&ohyx%-`w%4g&(7_dMe- zf6DkywA0*cnuzk?=%Wxea6Lvh58DQgcAc^!AQ0EGJS1hSQp)^eH(-Ni6E)zXXS|oE zvjV}2#x!u73Z(ucc`3fytq&T0)TxNTk-<|i7(6~Ugx>DYS^OF(-Sm%wR2yX!ZFJ#E zYxl}L25&+eEU`@6^9LmYr9?MxL=XY@7+7=k@E~QvYcmNuI}PJSjrt*L1)5;3wqhWF zj_Jk)n7Vb81sy>&zhC;k^fK-t-kycrEsiH7{!Ak|S;xE`Atv*>IPlJPKg7DS=-#EI zn(9AAF3Z?yNI3%g* zFWnT8si{K6$H}IftSvj-__W;bc}7@H{m$nh`iwyTZN;vp8pf19J1- zhmnRC9Ta6eAovjJ%Q<>{ID25%w;@RP>c>1|R^GtPs1!+|S7t^EhVO=t1e@tW6qN6a z5>ARN+g%UehDb^T*u&bIxbSP9Bhn_}=u+f7#odx`7djPtr9+XSTyqKwBa|B`mK~cA z!4TBQjP;g{yFCky(CS*aE94z-lY@r;Au>?H7^l~qj0v9MyAD4TAIN&BglN`?(Oq8V zYCeBd|EckV#D-&qkGf^KXnbZYk%PSVOGtMo_>W^97kSLqGgg1!q7=qm-DChy4 ze}>D5c3Ibfu_RQEMXAY7=Z{nt%mbtLRu$juEr-^)FfD$IB}Fd_oC_Xqeb$WD>Pa>i z+WtiU`C}f+ZTl;M@x0BGK*Eo7HNblBONky;OkHQY#o`1nab^x|Z z2qFF#$@N>THHmcu&jEHfmv9AT*YNx^AtDD}@@6$x&C-~TEB@~b4%|K3o_=>4O_Uf+ zQV+UH1q3_E?6*@N%}q?Ml!F~AOxG|daWDd`oVBKVIItMYLgJs#P6tV|46L6!g)GPZ zWU4&A3qM{F6(p2pt~A7{`97m*I(A~mwxp$n2MVMMGx10{vIzrPt}35A&L9K@M^Xai z>K5r@xQ23%xigL)sq&dpS2}Ic9{Jy4=I({y6&MMbqYd$Ch{!AFVxz|u-oTC`=6p%M zJMc2i*%8Rm^zX9W9cGnJrnA^vS$_BbJ+{2vvxH#w2z{Czkjd+T1NdBN|nW^Qw53xdOIRGk_T z)TUg5(;Y-kqmL1%dQtnnWPKcOG1#ByY4lB($*L77(|Vf_6dP5!)4BhBT+64dnEqOC zpU4CIr+V(NNt){t$E?ZNZ{cmpQQc~}A&QlwdJr#E>yk*JExLWmuYdfxJy%x+*3Rnd9t9I|8R-#!!68dzI zBorf{{}!!Hv2;$h#5l@=e@;!{x;Nz}^;|YeGCW(n2T3$=y3c^>GxDqJ2;Ll)C-#ew z=#v;S=%^;X^S@ha-_+GGXyyc>JpMfi9Yfz zy#D3QU46yMRw1wOS>pYUbYr&Ox6G1kacH_pAopWF5&G#mm8-AiSpf==VaWkD5x5Dh zo%hb>ZbSkeP{rwbhR7YY+g7OgSQj*GSu@YqH57VG5*y*qx01Aqi;-tUuybz%0S)C> zOsJBrm{>lE(R|yMcyB1b|oB2wMl@6SLTxSvQcxdZBDM=?L z3@8EbkrFD`Ce5C4+n$W0*kj5dEz$%Aop4*PfPcvTk3QDlPM2;S=0bcMBm(fV0`~rOX;kPH_andRrg(TxpQ9; z+V1fFfcBd{$6~?ZwzBuupG{?;4qC{4%8`!ZuA5{KdtWkiHdd?7L3uwY)OcU1t{6n} zP3kP8zF=tCm)dM323a?3wI7e-q9%#5$3Yslbnd>tctw5v)7tjvHvtHc_l2?oyQCy3 zAmL9IyuBvqA+p=u_mC{HDQLSygM!Yxdd$0>upaWR~Q-8`If&S3JhV zz=a-4@)-M4b#y|0VJfKMAJrQ4${Pp$1%VI&^JuqMH~pTGh&17^{;}@43C}f6Y}iW4 zE5qH5!ehFixNRw96KK#H^kX~s72M&pkhUwoMbF~PT66R`3x)Um*ZUvpdzY2h*9ig% z_h9^|k@EtN-x&X6)uX>iFr0_JK@lS}Us&gJf04a~nECcbwJ17LD{|6b2tsPqZ~LH2 zB>yqEo&gWgPv-@P{tfY})6b;ptQtnbEo#%pAxA}J=& zONlYPDxd%VPL;eE!n2yYtkP(m2gBri6}MdP-226^RMm$gn5DM;d}tAiEw{inO3tL; zpX#XtaRDD{MGzaLQJF(Rh6Aki5LjBd22P2X;}R2P78d3W+Wn6uj~DL&HCou1~fO`RoCXbNug~YmG;kI8cytz-FvTi!37L35|hmo9|I4H|FP7 zjDDuFx=Vj?W^S50lsJNrXv=b9sIef0QJj<9P}CIUDB|;(0sr5Z;gnL92Kz}<>MCA_ zcYk9)(ebIBiXvt-(B_hH^iLp?q+24UHFcM^>dJrj-!aO2Ee>V0PAH`Q}80THjJ z(kQxJ+GqehSSR}~f;q{j_zdk`CvNH*oG$69e;0P;ptvQOS&2pZUuHo^A(5G`5%>k91Z!m>{$w=&1cw%wcsJ&P!7jlxW?tRD)%qi3z9c%1VeA8b5TGL}=G(cE4ZY1{Ves3XZadY%M`7wJe;na#JIN$qZZ%k03eSZ!sNL?kMIgRD`v(Z1C z;UkAj9X=-iM~N{0vBq!z=)GLCk^)E)a4EHh>ww_k+Z&_)4XO^^MJXr1{}3a)$7yZ< zG%YTIsaw5geofFQqqK!r`$(PI-HBvT$y2coLT{oCK|gYUPL1_qo^{=mP_TTW_&ymz zbQa`6F8MJ&&VzlBrS7l%JAj8VtA%Gtz&;h6dw`51Jso1!fm~O|?jU?H2#j4U$i`7o z@*ErjLH@e;>}tdholW+C%q4>oS(*!9Fwz=%X~YA2gHeF(p0r*y>03E%1TP_1v|YiY zNHvxw_0K2!?myMyUjtZlkI}{+h-R+5eJ(e$9=YFNGc1T&PvMbgy|{JsLdBs0j?K!> z@zu3J^rMSi^GfYNWctdp7Q2EO?8p(bL|hjKFTe~1O#rsEVIp1L-x}HVhHGJupUg9} zIgE{;8MGvvg?l)NhE}u8Q!Axvk8@M>oJB4Fg6Nk5*<{_D zY&$z^}Hzw!p*r$jAMRT?(sO(4y+{6=pIqwMqnKJfTts1J9rtl$ z)O4JHJU!{uS!d}-=44G-kPNqnml?n7!kdg*`*1#>1W%7`Ape;^M_G*1@CIRm0_;kG zZNc#&DAg|D+Y;i1#1<%iIrTm6N|iXlGR1K7NYGXwk((Q?yg#`H9qOr&~*S zX5hLPrlhkK!kQJ_VO=D!W_=(@qvMmC?n|wbs&lNxqPpBc@yV8@t`CW*I&~Z=MkRT` zHXSipb6+!rX6n~E{+bX7Rf;B^3hC9vh6=nI+y_urMpiJotHib7_ZkrydY_$wE4gac zwixs%!!uOb52Q;X`tN+xsE|uGenn>)F;Q}k<$grg)o|pm*W0&HoX~rp{lMG<58`ai zTBM`fz}qctKX)N09n^EXj4}EV{b&k4#gf8vWhT$dcngppBAr|KzBL8G$(Fih4}vZ0 zFV!f2_)0Yowuy~-$&MY5s#5l~TNV(^AACl##eZdIrE*Fa`HG5brt(n;9vk10^yKiN znFTkYlRO7+Rc{MMF^c=J&~8vAgp5-aqmUJCP`Yv=6{NRDCVwfA!v*&#~MHONV=$p2=1k^UtdhN2@2RK(0hf5s!EYJ>OH{|!DUyuSP_R{x09X9Y_*ei|6%MTfH*>k?Fl+# z(6u~kosAWQENM=?wF+@JK@Q1#wCW<7E4azsd|SHSkZSQ8JM({*V(33hQJl~>yuDlD zaT_k3mAZmSlkP&D=zP`_ak4zb%E>v@cqSEPKT0kiH@+9JYr!z=(ge0_6doMJtsX+m z_>H{ylNNpcec$7?qNdKb#O_?*Ejb^Q2vHn`sUKYR*1n|5m`x3Pxiw0Os+!nniObl3 zmJ9BiwR_%{4dN20m?e5nClmT`Ao z-UMCbuM^nT$?Jv)vSFn_@?Cw4>Jws<4rQ;KL_=?~R!m&)gyS>6Wu&dwWXmdR$t z=hy#>6cN_YivV{?7&JAY7tx3!p#(PA?eh?4?O5IV7L){h@Y78t54ZqXU=yz z=8e%7zY@#&+mF(JIa?>`Z;;+$X+mGwqQZ|t@D*YjlHVE~E?uhMrgJcUnrby+xN^X2 zcBD<}t|l{IpTGt&-Sou)VPmDPxkK1wFB%tp?X^DHMuQcED- zSjlRUSmub|aQT4uYHD`p3I4@}8vXVt!SQ;->*+?Tgze}D&eME&OE2FELO;mO-tDK0b#Fm@|j`m@U~%8$8L&{aU<{~A7QX)HtddN?gcG{@ux|k+ylHw zcSPg(&R#^&c|E!DoEFp&nlPilj?u*{Qhy(;{EdIThYZ}SgbvQtE6%i zr{D97h5OFOtJ0&BA?bJLIYzjNc)Ax9s~@B)agi7zQ|*}8 zNyD);P4$0jJIzmv7QzevH${3f%`MdrPD1z1{J+FsZ9+@^*pc@K3semg)>n{}Me&*o zq9FB`#^>aGf6Q6MilD`qkIw%bs7L<}JX?K!1y<)|mgO&SYO2{zjvg^fX&Vfbv3IYIDhZkH z*4e?Y{+Mo-dgq5XAId%d;|GW02A+v>*qHL6U*at!_F;j)jLMV2RUh~ozKj&bNJY@2 zgUuqxQE@1yeN~US{?o&|i=4dwa1#Ijr^eXhA4bf9XSd`iv2CyNxTEGE(_t0!ht z#s3z{V|#|skI=WKntfQ6Hg&`$H|(>o8dyUA?SQJRjBB@WD(2&hxqIp$DE?`BLHo6e z_I2uBpl0L^mskbc56U3gOES(u#3f}r%UM9TpEb*1mtpVBtHVr^kBtHK;YMWwp z=Im!45$F%rQrD<5#H|PzW`=5X-DQd<5FpvBWr#YHSiYjWE4K7`CMzaUdf?wrK)I{z_N_{ z)J1pg_NsTn4DWxVvO=qDFbV!bt;2WUQv+7Sk9El5t+ zXYH17RtT&_+o#P{3k|oy`lg+TM4Law3>V6uNv{*oC>7Ug6^+!>gDN}m{2@Ma^1k3G zpDP*;p3C7{bpAQ|>R-6-kui`~{?Jm+d^Ega*^->1u0})@W*4Os33Q?B^C8%=;~SbG^UmC8EL-`U7PNnBVJ zZv~?E8($6mW-r+}HRE(I&@oL`5x4VKHsv(vh3pG_I3DFM#>^ z8D#TSXv5E2;07QXAp)@7(#fYWyvuj}Z!;1?XFBCv+xly7WeO%}c-rye&vO8<^BJeU z3h9fja6jwg4{K9gI49!2`&ncQ9nL1>&8+>n&Is_wAi^vm&T;;;`@x((%bjjD= z;#brR{NP}Le22zQO}rc3bVqi?l;EbDBEuNAJgyy8^yI?f{d0kkZ+b@noLLE&bL=jf zt|;O$a?d+kKH^9BnD6fv1fbpNiN6@&Q84Lj$Bg|~n-69NznU_(7SzKInV{zZ!mj6j znZKLr(9^1zSYNVF_Lcpk(G-eV?vt zNKjXoAX&a5jtp82$`9|)Q^>=G&cATWed~tPssg<1rjxo}cy;o5=vT`kdKXB>Wc^9m z*D7tV4i96DPy-FkZ*^Z#UeSWx$Ub zTKXxJ)uhim(Yb1R&Q`J<2fNG-C>ixvI_=D9NbYG-FJ+fYQ6_0*$CM+f6L^=MysC%oRxc=bnGeB^6cY?dSTOhc*ySuwP z1PBCocOBdULvVMW;5xYT^83HFTeVg1uvB#2zYHIA|bPRNYH3fXc=*iu?_B)Hux<_t_ z1zULT2YAF5m$MFM76hQQ&$~cHfc@^M5kP(yv9$vk8#?{OJ~p%{<@@rtuZlgtPKsS> zl5^Vf7;z%=>p=CsV=_3(yQ*UEEAeFd_xip+ODrKQ8||qskVK~H4#)3DBIO^5qM)_p z^X2dy7&kVkaP+LYo3#*#cIAk+N|mlBf^=?IjIGmfxwzB026od9!m9*l2e8Zgk;-7<$zQlrC>IjQYKdni6&PDgOKa ziC(TcEp5G+iw^d}p|B(k+-J{nx?IFT3WRpD$q@X1uHe~!3JOzaH|dmCS#Urz|9OP+ zyO?@Vgn|6XIrPQE9pwL`i=VoV@t>})ol`m>{(!x3{+! zlW4GR=A7}>`!$`yiH5Scm!u)N0v>tK5mh|9#oF6i^53UWWFdUUC+D6=`a-O(#x&tR z)@g5%&KUZw=(*BJ{bWW$vGlek`y$-Ht=`4PMz;Q0zJ#VrxWfR&AZ`+;DgWae9-oskyU*pd z*naAyLoO zZ@s`D9-nw@uv`9b7Xp__2bmgCJId z>sqXB@$9KDMz&FXsO=e%!={D40G`{Bc0`NH&}@c`@qoh6U(dirSunte)7Sf&jU%R2 zdN~<&aeF9YZQ@OI$i4(bpNlT0&dh~gp*57d_xR#7Bs*xRArBJQ`R{#FfI`+q37P=E z)klOYnYl~(R^t(E1$`Z^*|Wtlz|6Wkiebp|qvRchg?llgk8Wd<^CPxdVEvTlfva*-mG9;bpcSVOn&}D9(_fq= zY->Ql%f*V_HRGq`XFyz!FZ4c~GFfT%MID>)5Y^}D77;?W!@ZPD$V*GT27i|wWZ*%S zQC6qrABHip{y>4NtsJZ~>ky6G^7gmqpo*l~S%V->4)Eo1wexp5FG)GdC5q0o`3_f6 zH)7bubCJ!Cv?(DtQ=~)#NY5Eqf!8W;*7=4V_^gChcXu zTj@Qgm18m|`7i^qj2eEtD1kr4d5>?$xuj&t{yG_w@TViM`&MK7HJB#P zDAwcG!4aqlBB_TLcfLgY?}(?f>$@#plmwHdl}J8BsB3hud({MGHa(cb%V@6ZEm zbAi(`w2MyH)y%xn?&|VqGAzdKAIo)=Dh~Z<2Y3s{Zv_^Et>h#O7Lk6mA3$S01EW_>EW<|2MKS$Qzr;Vx3;q$ zpK&YopKX>aq?m58Vu}=UjazPt+4;~?nYb@rTGy|34Pa|w3<}IN`HeL>j<$UAR(6?E^P|Xd##Y&hQiVo4e8IM^4W9ZsO@SIiWyCRJvLZyRBS}As zKNb6zFHp#?3xVLe!NI>iyKy~TZ~rjj&+qz`n{%k%umVlHG**kK>$wxIQA01t7X!#y zA?~jya}q0hP98*F;-=s4xYau3#F%vfRW-Er@PmH@9L1w*CINxZdk(2=y?%^3xYbwvlli-ELnMHpgS#Wl5~-zGj3YC(876i(9~x9+gEHbU z-*!>BYnM@T@!Zu&-D(}1rt73%YvOOCLcmtFREQy?2^_*PCM?_XfI!cF2~@4vz(Qv9 z&+^&3kG_5gO`-aHndyKaERF+moVkzC{UKoI1R{pYHT|DUq?vv@T8)v9Hu!cCOXhoh z<;chcMoIZYXi{C8Bs&5K##_vZ`cmJGXk4+wSikR=XaL_~A_TE`!=-WSwE?IstUNb7 zS@70KY}NHGr=mi!?}&Rjw^LqW%YRtRp8lb~M2sofkBroF*!l4rF(KhyuOVKxJtV>z z+{N$ct5DF2(IsRMs_{);z`r+Ofzv53U=YDfouPzErr37TRj_X;^jC^B)%}H3o)5`= zKqEq&+oJV09UgB=*c&%0lA}&i&KP9QYX=(nd3GvK5QYaf_1UUX_gopOlyLTF91w(`A8H>T!6p@1U1&yDi=y>yg+;MO#l@Vy*Hg=H!FKHx z;HlJ)LExpk%+wx6+RqmU=SH(_E2AAk4*~!C4Tnr2JHZpL`afQJ(_e5n?rVhOSE^+| z`=?#X0|}B_V}{&5Z8?2wiM~~8OnuG37fnp!YMSy4LEiwOHv4+AX+cyw6jI7r!NUPg z_OE9?!xeU3$ijhc^oFPAzzNj0)JCzq=cYG2VF!NUyj9eZH3SS>%!y9l_zp)#;lNYR zjbF}0PE(r^#Z|0=H&?`uJH^LGzuIx8nI_9!6;1AXF)|tCT&}6GwSUJGuRU^c;TRzLjAH*w&!!Dbz@5wQfDcHl9Y~c=r_DI7mXHyH{-9`|=pwSPr+e8KJuIib% zl|Sl@XWnm=H!P|K+G7EfiF%247_(3R_>PT0^bKms>~82I5AWaWR$Nd= zefv{1QUBrc%FixppZI#VfXkIOwNpX4jZ$&w%Pj|-#=koC$>~ekbLn#vyy)V;APQYK zFPupC${|j~LUM)PaGl(OoMM!i=f#b0?5&G+iAZi z`FK&zaF3=DBR=Y#+md)JNOIIz{>$*a{_jo%*)+d<`9A^N@WI0sYyFDvOYG{&0N}7(UOyc zU6|r|bF`olm&K&s#whBz$yz-GpJgEYlr(s5%PG4ps=bj)u7swpKCl;r!!kr7m0vo! z5G6zVP$Eh-D$3}J7UchH>Xcy4dtO|mv=GPjcaia2bB`6og1 zlAbuPw+m7Df-uCBSPlHQ)?jwJxpzRXeQsn>l{mJe-5vM>wYOtRF`Wnhh8Y#W<`XS7Cic!k%b~@TS_;8uaEil;%nhabpE?onpGNC#dpD zrzzW7ft^N{56*iL|9%?W$McE0^0bFM_;HzNGkH3CWRsS`(aTZCk@IP4uv{n!TecNR zU2Z*IEiJ)0e}mX(O$5r-y8stKemnDjXE~*7UK9OWNHS%2^EdEbvQ z{`+cH86qof2O-sZ{8&=Qi|Cj7i%7l)qydIaib6a8JDL9u#^BR`K3#YWRQa~E7e&V7 zg#iaugh`Pmkta55ZAU}S!zmH8mfynyyFO;a#`M`Kqu5 zW-RX}G~$n1X-IZ9#Fly;Y{s}r+Qtlk2!|prmq@1v<3P$pSEg6lZs*t}IIGu{zt#{{ ziDxP*yEdvz1u9(y)hQM<<^gi`C2k7 z0i8T8lj+sP^Se8!4CsE7G|_}$`mG8z(Aa$-oLezKJ^a6q4)DK`2s@P?8=C8#*cZs} zWIaen%LB-W+**S>mvMEqvhKcL=TtcEE%T&_jeM6oL3uVH<##ZZ`cyAUeVHGW)Yi)T z{a5?UWJnDa;=`{6L{uf!i5aX zPIb|Kz4lI1%{gg@p&(x&O%mQfVXC-2LZRcmSLN|eZKF4}EcJ!`V?1!GK9vn}{&{jc z@8LoPz{xy%Y%noPe)vl@_CfI3CyP2RbSRiLmCek0mSCOlO=h|9c6cC@WQuz#Uqv%k?KH8AT5UUk6N{E+ zynr2Ye5(frznv;&06TbfT0g1jppbf|c^gfBpN6DZl|9SBB?Z2wQE8C~r@|S_R`M@}kFL`Sd+ExQe+DCoww^Jg8 zmRYa}yldB2)N8nE7iTSEcU{AY)|EhS#GF8G@KBT& z)zJB&fpx$*QH!q^54|4M?q;DOZH@WzQY^v!&+oTYw$}M4cGM4TO<75+S3{ULXwN6; z>RnMLny6ePL9T@NDqZYt#G-4IddefS+7pl5lG~g}H_X6rphyI;h4iX_+F}eF{i5i4 zPQPS2GfF0Du~-I3)slobBGBFzVYwYhwf&BrCDa75cEEJyn`Ikk`gF=iS;24I+6&D&%46@4^;)bQj0ch+88jiAl;M_|k5+&gybZ zm-#do@t@)k=I?zPZbmrFjm9^f^wxTR2I~FX0Kf9YJeMpPYn07IW%V|QcjLM-X&Rd3 z5VZoW$8{4e7?KJeovF9RAzynqo!!Xc$%WW|*UFxd#E|(xZ{;_mzp%$O`hC!0;n*23 z*eScPBRXA-4j(_Qj+X5uz$nQbp?OPrSMRKMQhN6IK`Fj7{Jx*8P>V4A5oes)jIy(Y zt;3tA5uG3qi-x^Ov`Z`YaGA7wbZm+skO1ky4x^ft9W>RSmm0Cs1?I$2Bi3t03>~(S zrG0iR-^+oNdoC&S+~42HeS6|GGSg0FKb5rm;B+;5L24d0-TO0K|W<`C+lWzh7Fe%-X zkn4QatK96fVP?g>0;5-mq9Rw=`>hvD>+ko4T6OiRys>K8M7{kUuvHHe({3+r!ewz? z4NL!DyM7|e*{tjoKiD21)EJ~kCl_mX^;*W?azYw8P#eF}X4dY?x2?m* zgh&D3=4RuBMpFks7=Cre_j!`W6-x6v^A}l07aQJJ;U8`w3!K${R<)9eI*r_0Hxbk3 z@}ny<;)^C2Q>txB=G7~lC7>m#%%@b!PAA>wCXH5aIYjOtFf#%j(K(5TDky z`s2y@{QHV6U9JvtZr!dhkCs>^?vRHaqjnnV<(e$oDW8Z{Kx^9lt>&ZQ4RKjee$1~h zzn!B1hhW>dqG#s89OcisoS!)YEkVMMZ~pz zy(AqAg*T?jd|OAtz6JVeyXX>79&Deq_gPwar7GhIYfNdlw*@F$gstsB4Y z_Xerj==;-|GW^7WDV9nVevcZfuesIhi!Q00ETqzR4Sm?EcwK{FRD@u$Vm*_C2KCp| zHOEX0sae_6X(^kL)iz$X!VUHBp+t!?G%Y|To^~-OrzV;onqNKThvm(nu2wgOwBHn#VKHgGvTvTH0x>{@k zQ1*}Ac;kaCHC-!u`aW#KuX?$R+>vVR67MsiET)F#N1X-0QNlF8{78Ta@{BnD4GRDGq$2$3itghxY2#EievS+zYWug{3@97&tN?10p-w zhYuH&xqB|?5xAlMWF$i*$IQA-lT{gD z9O&mqcP?6uHkbRV^sP+(b5J9`GY{{1oM2~cdIUXX`$O3-De8b%ZXGkLc+C9Z6X1a!ZbO+VJ;@J-BKn||uxgU+#OJqlwtwUE z)~mHlfxhNn3@=F&2-6`)_0$OHG&EJWXpsU%&DP!lBm^VAZi@D6}GN2uz1c zxo=Uzj-RLnbSQSd@T(FQq(wFw;!)Y!u*%{2s6sOOWhD{5UR>s^R8@{im_G1kUfwXW zyV3so-hEB@wWT_qB?9b#z!cz0Iu|vELc*Y^EAR58b&F^9;{D?UFip1+wEFPR0?|)ZpNEX2U1wOO? zoLds6bKM%}0N{=rt1O37S&hWI&~{z9^~a4i<#!@OiCu1fgZPaUtm^rQMNX}WRkCVu+^mPCXk^*L@0{e$pK-KtKY zp5x>6MBor%y1Gvp<;VXR=B!0nNbl#^iE+43iQe@*i+ zF-8kz;Ms4UKr#=y{im?bMo%$#Z}W|nI(RU!ewCWv(S4}rA!*Q8m&NYnRJrvZf3bFDNz2 zaS~?Qq72psszl$A=LGKhqf#LWma;#}^!b7Ox2M6V)UJf@5-EqB&`~?bGC)v|SXR)l z(Pn^JhGM`K{VT690m;e7E^iY$4pyQTX%A%erGkvrbf4ls4ZM$m;bV_Dc!=HelqY|L zI=?_Z9Fof6gs^#I!6s4`V&;hUID&n5_LWtH!pJI@ISbctsW%H z3~T@E%R<>#OYXV8V(0-`7mqYWkTsOiCa>PI^e#f;bI3^*$a#%twl@-_VsLsaKqIuy za+?cccyhsmb~fUR2!D}RFd3sccN1aN9h+VaOkC$xDn&_nR);Squ7fS!?F5U3;^LL> z&hx%9y2sDcsnC-46i=Jlz7~u>MZ`{pfPcqvGEpez`xo_&nPsLGoTehq+QMh zN>mEW0)nOwjo&IW>{C4PuVf3N|$4e@DCwSns>;?DFbUFN?`%kIhQgb!8=jwddRjM!}$k~dQC7e1cl+Jca#j&c~)1qG}BU)Hg^_w~s~oGnSBBC*!->ZDI4h5}GuhfjYPs9C?`C z@3aA<9;KIppX2w{wDG6aRK>hw8x5kT$6@&-moZ)WM!~f*?wOoEkiy3Rf|Fx>yXzU#{h0qfq`I(&5-5sbtgtuDf@=Vx;wFH z*wQs^;C$(H$8m?`$qr1OGpk)sYWPYZZV0~GHdARh|e|OVf>+> zRSxYT&3-A-;j^nri(BtgZ4Gw#oF~HJ`+?gK{&rpD>^PjzFG3(&5cI&ZRk7Jx^5 zXCv62)}a8ztIJ;_M)V#!tNy&NC0l;g=l$J8y$>bxUn_GE-^xT>3nnOY9xj5 zi^V1}oIQN;R4E0ICBdQ%i{bXRm%;bw6*u=I;Vp3P(aysuuLPNCQe(5U1j$z`&MjV* zQqmE`xpPH@?7llyi77{DhY7Kvwph(TAlOFL_O2IiYYI_nc)z028hw=?rAO!ouf8^_ zNR!~pFa*A|$nD)1IsIJo~*ltBWh z=5UTA^GK9gPlcUJk*}QuEq3cfhOn;6$pm4-@PRWKIAmRsd#PG`c^FZZ#|v#=gO218 zoU?|~+f+gIpa-%s9>WyrX$~A~6zziZIAzQ!cUuf_0%KQW9(_UY+j&wpZdG z%wW7sg7AA2=9R$CQ0ioe^EIjd>7xXOF3AFiXoz)=A9(Dn&~I7LWZDMt#Sv-0XzYz? z9ghj)?!jVk%UGZ*d<2oM;JF6^T=ySIz@xSSYl%AsK?7+w@q`tCb;*-1n#3DtgAdtY z>o;C~QSjlTCtGWt@!NR`b1br0TO z3L{ud1&0Z)xZ#wkROh`GvOO zBIR~l`aW4v0d(m?*YZLZyJ!;xc*u$35=>v`2&U=UkgJ!$rAtg^-M?D5Y<3{j8f{0Z zV$j(cLg3if{<%Gt*y*_=OB|sA?TSHE@TtW57qjqt{^*x=B1B2oFyol47lW^(B?lG7 z3MxBDLQ;Dn%2;KoZP{Wb=F>+}vk|nr7e7fKW-Dp1CC;Pe7|2_z2=zR0_D+}gpQxt2 zbnF;GrCvQo`OVmx^7!XC!=&&ymVg_JVv!`Fw@eulH<;c6) zu)3BJ(g`|>gaW$tQ{>1_0{MA>invErCGy~-iObQfAY7xPC(&qgfyX#&xH75b=>}Vc z0xP|Bjbnk&BK;gOkV8%dh$0uk@O*ChTcR|P7{)RvddNZ!C5Oe&F z+rHigxzOnYa#wf8;aPv zwO3l2Mqy0_j=^)=2wasC;aqU4-?fTeD_OS`5w%CGsBRI1I9huhqaI z$qqeul~c?{;6(k}{0tx&TEJXG(=-s(B>2%*MLpJytUGtVp&AY^uyldQcpi&iUcFmM zkzts)yQAqeGfBdL_rtGZ?_==3hv#p}Pue^L-o(%DCkd@yR4Rfe)`{cU1Hm+o$6-_G z|Dn4j1xdqHsp=AngjJ;hn zrd21(SwG{Y9z0~4F)+BG#|oy1mlIDCR)?&2&E?ydkdqWn6OQ4zOKy)sFP)-`Qx&4{ z-&A)Gt0IiN`G0K?Kp8RRRy0;>yZYIkU^1-5pGMs!-HV53ptSNU{m5G(waX`rhTv=z zxRo6~@$>6f)`fatW&%rVp{A*KneH_}JlX?7M*5-Vt!{z6F9JpV7m0MsC?hB3(!1cc z)+=f;!z*>87Ai{E!W8d!Fgc!rp=hHKr!XK0E%Is3`z924mHCYt6xJwATe~y^zluLz zp2DS3Hk?c%)Nr<{0uX3HF|5S^pQl2l$VK8~P+U#kNU()G*M1sW9C|MWTgM5s%H_-W zE+CDb#rEVg9cY>ob|EFBkc9P@8rq%2-i?H zJW|JOEqDW2&~sUIgXjXjwqAfq5_~1EFg*CTwy-ErtQjXW$WBCm^XH$6QSACpAZoFV z*olBA*?|I*6jRK1kEr_BznD^{&BOA+v9G&%ipdq}>44Aa6K#PlD*rCq%prt5kBdvz~MC zxB!P|&3E*B14igCnwYu(V_z*XKVVU;)-GZAp;d~*s0tOk_En8gam(E){-&&v4&l!@ zhaYID5Nr;wRrpll_~`W^d3(AD9Y-yr*5xoJZuSj(Vcw^p=y~O6qtDfurlqECD1qmG zz={$>RyG$i{F)~U6#Iqim%}QmcLz6IDZ}JjD)4F{(H4m`AC4hGghxrqFcs0q*4MT! zcCRDFSleuUcfCuX2(g|nkg4$0)C=ul^#3EZ98$aP2YDU55!6*ffif7_?Be|(_r-Uylgo)xDrlZ3_?WF^Qg zxCWKS%s7>BK)a8pM@AE6cid#o7 z(|6sudsPI*(Grs)RKRSLl6dE$TxHFvxK&odqIpW^I~k<)xo_KV;*0OInIDg$xBv9Q zRR$jS3dLk;SQ1fLCEP|jL3UbL%3Qn5YW;{1YB@NNb^M%s!4w-{q`njA+SX7;;a>J z$%@(e_^`Bwp$pzBE*|~ODK;vFd+HT|vRRkNR|LnANjEr(dFrkf$j_g9 zA6qbo>nmlB9tX4q$Wa0b*xUBj3Y>}%h%4$y6JjKEzSZV~e0RnR8?U01hC}^)$=jMp zRC-cf%1IM0b>y=AYZWzT zxJs`YDKS^01?EnY2d|bC}nkw4ye zD^R;f^w^B8-@NNrkU8FZY|!H*ojkvWsalJ%ku`M*^y=%!AY4bESVJ)Lx?!)IX=GnC(kLE*>W_P7Ll}^BWa^SXQ&Ur#qZDs z%!#`{uOtDUvNtmyugTNC@c3>&{#1`Vn?u7=|X8%4^;M0;Uh^}pwV?zbA9+p~0I-=Z3`8~S@RNix!-p9XcYa@@?k$yeDPwIz^300s z3~&!k5qk%2S=MZ-mE20Hj9_eV2Jtw0-+f7xmNsLAmsp%8OupXZ_HXqi%-izCFyo(x z{DC?1BcS`N)Z+0uZV}+Ii+&qlE%6f74myTyGqG@>8Y#DCE6}6)!SoK_lR-MPF&+5l z)XG|=hdpbpr~+yd`Xsw1*ZS_t(!bY|JB}a^kEi|fSJ~7O^J0ww-D(0*w z9(e1DVfZ4rJHPQARQ%0Jsrz~nodSB1AN+NqPs?HE2OXvGSCtgQfYOLM(CMe$;uWGG zO{F*!`~YT%#V>cM zbtF+XE)ON$h+6rBD!LrpuPulojO$6OGS$lRhVS#+B(~n8wNvpw2?*=*m(V-U)VM6LxhHb<-z0}$Mf`1G2H*@eB^5mI z07Jgu0wQ5|p6S5e`-RX)O{}P(%lzO|8{#p&K14?z|5!E_r(vF9HrfwkID96~_l1Yp z8Nwbm$34*&y*?zhgUex>Z6>k)4GKYy&#jzycVo@Ie(at*2P|G@I&8?agh*6J*0Zoq zUT#CMPJv;EK`TkHhs=L6*02O|?1q4GC=}&oIQfj*5y&zc&V_E`8bJh`TbnVsmJUNS zt6~7Z8V29iix}bG*)H=WO<2U+D~U=xpYulIW~Z5n^sNN< zd+ZawCszJV#<0HAm4ApqAoLT1Bnozn-1Y+pPu(c%UX5kK*{(1K?mGP>mOg`o(U;|9 zm9j#Q*v_8`+5}p**qXwvSVnIR1Yy5&B$H6wNm`Nqtb>q_UiQQ$44R?NGyWMrC%YqE zd5A^Z(OK57gz4q!CjM^WmQJBD^nHcPGXfA|mQ4(IU9`Y4D8K)kyth3FIZMFLY&Pc7 z6>7i2?`n&N(^imXm9U$ur^I!iw4hNOICZ&8m@aqj9d~mm?#@m#rfOc*{`G zs$lmuEolCmQ#Tg=ww*6-j*HrYw}}8;A{xSd$^+00!oKy$UwN32Fj6hZEw&Qy`>40H z&F)F=yA_1|@p6HlG+bL=pQH*z#<|m>Wy*IZAW+xp)sj3!*=85%$*+~{QFTIu&!V4z zet(B)AyaxSFPAn2shz8&x*&Abnh)nqrql>m!FowS{ew;!c398=HGAlRo8`6A{Mpdk z+reeBnl1NQW@o`D+Bg4X?F+s~O)zFw^z!FoM?EYLIF`j8RXX0LwB{=c00Zos6{4sx zY;Z5p82tkj!Q^hIpkN_8rE>OT&$_21Z6?m)Ks`y>b^1&;C}4_3~}^w zX$lKL66TX6lC*Yc|B`nZy>|GtW+1kDyev zTp;10I%d0hPrXX;lzJh_s}TMb!)4AJp^-D7+9qm{PSco%$vfI*^7^B+bp^QWeAjq% zWHJ1%Mnibeo_E-;fWO>4li1pZqjX+11Vt_lpuU&RpBs9#sV6abJ73B8{kKfyu8+7p zR;eEcZPQt*QibGfmdh27pa4XFPejz^-bshs>`s8#Mxqm;bh=h>QEkUs1=XrW9Ly=g z#P4wuoS%mmf{c0>N{A0gZ&BpR5#~%m?(lZ@qcauHGLc(1KGS|h=GOK{TM}EO)yyud@4ZDA3GY)lHRckfzO1^9H(N!?WLqPKut3`k z5#tDxrkUy@cZg*~KA(zSvJv-9;=6(cV0Odax+21U?f@^_x__xwhWJf-z>(mqG=RLx zfIyS(P>;Xc)va+@e5+)Sl{GEOkGpL06)r0!e-GJ#V#=Q*jk*tB7Ztm$uMv&#X*Iz@ z0Q_vYa{&uVi-NP0EoB&+-r2X%YcwJa4FU(KMM`Zc#2GiG1in_rUYB{!zy5hgP=5iC zrzfsI=?l8V?}0n^w96m!JlvEj5ab%~KX<#nwr3^(wvrK`+#fhayvvX;zSqht5?olI zNrPR7^&~|WG!sHgTfkr-DR;ZBys*~H4)fr8=OkKCDYY`z;HrU5z`^5RUaX*{8?+%L zzTqseG(bnNL0;g>lL^l~Rm2?HbcUJl6AIncGK#82eGu!DmGkmEgOjsr&~3r6nv-9w8jlPpm750UTLWJ3uO`n7M!(xC zjLgIRP(Tb$$Zu6G=sZQd8fZcub#jAt6~;>xo1~o}iNGPz{ei!UDKf7eB(rt@4)qjW z#3d`QX2;d%B6eu+;t4Ix;sLA{^9|>empPvT(H1r?UFo+f3kkGK`b)9h&(3}IGW@7C zA#Yhy5!v>iMym-hP@ufa7!gQPIaS zZb?Nq95FE!JgVd(-9;JMz2!q_z45f++(>!oOg!kl!H1fKItDGGRi#-=Oc={xZFssX z=TY)2hiN3n499@#u~NJ38B#E~qnh>lgKnT3iF zwWm|!=$tE7P6Z8wx}55cp#A5%pxg(w3Sk(lfFl7T-&bV!6-9>1bR~7*ZnMudY&lC~ zzqELp+Y`@`kOK<;HXG^NHfQ9vZP(T8+o z`;PB(EV&5P=VY+ zmfrPZyfjf*@r|MT)T5d0{#2rZ3^e>*LN`_(?1QenHt@OLZq%&=bJ^XW=2`Lm=h`)w z@1`*BLxB9?zwXY$oBjp-FgBAL#c-8(1L2MDBgZUpagnts-#D1VI%@}Gv-Al!LMv4^ zk``c9TJYY+Bpkx$mScg&;sFIH9_~fbNGFNy&)PHgC-%2JzI2|dK6U!}7TL4lHWoG) zGod^mb6VeJ4U@MVsUtoM5@?j5(66NTu~;qDRLMOKz0K;q?P1wyh_kt?#fEUjDg$fi7EfEm}pljz~! zrF_(Zg(+MurQ4wcp$^)528oyi92KF`{iv`BdO-E7aScmBjXkf#mJhN>umnu8KrSu` z)pPe%Uc~cInp%{tu5s;IMAs~&3}SjB@KP4#BJ+t)x2FvkRE|0fRZ0JES+~*pFU)P; z^|#Iq#hXJTk)7P0h_TQT(a@$K6S`1cF5mQ`vBjb<32L)XWG-!Og6}@~kF4YI5V@+OS;eVgz_e}Cm{?%gxqhQFGkn`kNEzaw zo!qz4fr#>Ukvl@BG5siU%$j|Aa|fMpVKu_3cH#EPfq90%p(;~6kz=4k8>9t<0H(mK zcI0fd2>eB^(eb*nj?cl=K}N@gsD0>;1t3=bX=VSZ*wEoBYASK7g>Cq-G7(8oAR2=# zERUGPZsqn|`vzixGGMFY;{%V-(TC5ATx%?~U+*f)I*Q}b z9lFb|aO?O95s-JMp6>0^o{g|hPLl=CNU%_D8L7!=V#M$>;cfj( zP~28a@`G)cj$*~880rMIYBSXyA}4S(0gp3@&MN7YXt*7*1D1~${x!_w+OpzvThU+w zy~y)ZYd4!`C^EfT5D2*%y*XnAf7e=M_H@BjhGm2P3^1NmE+t1zY{`U0nHNW}asKRn z`^qjiO2(ETe_^f9Ha={3W1$F7)7#I3A5uH|{0SKSgA zQ(PaND2+O6dGV_aJt^<23r?!`+X((fK0{vsDWty*hRUk6ZIUX~38H79e$HJX=B6w* z=ggj__zl}gDaO$Z28VQeczp^aZ*LyA4C!@%2yURbmYBj@ZA4NpLjEOh@T(=%)tIPl zTsZ@b5E}_gOG!lf6mqFCM$(=j@~bIgu;rx7WrO?CUzdNviz-k4r6mw2X1Ye3DzV70 z59B6);7Zg2W_zIWj*n%=2`1y*cI0o5kBQkTq0jL;&D2;Bx3+sRfsf=uwTNqJw#n?( zg#4XrD!Q17N%}=; z$zqz3mxzNi0{y{#(h28MN4;5}ly1uT1dy%{@o~<=iA9y3ubJ#85 zcf&$FWjm*QR>qZ0W`>nG&3>@`-xdfZsBc3u2$_VZE>uRwLtp2u&}MrmL*Ke*dfeDA zqA5|Q%OsXhWp4c91sPBbkc!8Ab=ARfCde+R-c z1?3Dee2m75mQftBUDN++@2i3;3AQbphQ_67+}+(B8h3YhcXxM(hQ{69orAl(J2dWc zaCzs>{7uZyo0!j6e-%*~QIT1dd*@zjujSw!1SMCsS)G-6(cH;>6dnmd$;kKz@GAr0 z;)iW<^~LP^tV1q;WWzCwfkdn_+=p$8X_I#ZpluJ6yQCae%SuiWG;wjzEe^l?C z+ZlWRZpY4_Z|L>9-o}!8I3wj4~5a9{c1xg^D`@jm$%3k-tv zo%KwEi${N~=p+VgbW-fE#~D7KMlX4o2-CyounO``)EoIz$yIHKFXfMUIJ;1Di=-Ma zQK@4(voKxD&=q{&toNI-{HK;-=-@7zyc|{AYD$AL;;1&TFamz|ZbQqh8ov9DAuBI% zTU85=%~JyzpSo(>3D#4}mlEtrRukb&(xkeS<@PR6iMw9+Czi#~QziSpLOa;{H+zx4 zXoh=p%qk`Xp=9-FR~IOuzUT7&|BeGMz2y&7%3-)UNc!QaeOmb@ZkL6Gv!$djILm?k z(gP?8$_@||vN@DoZojPWEC&(jBW@cF&$nqWbi6S)bo(8yo2wm^uTjeoZH7?1D?K2c z%pS`7BN5OTM_%^=Z*7s2+`sFaE$xlwAFSFU^;RBi?50cyu6{1VZhBUshK8EtSrFgs zmzl_%V~0$Vz1@DyIkknp_Wd?$VQqzF&qn-oX-GBC>5szIYLBIlxKlTt>B#nYl0fSK zk@dvq0d)tz5fQU#`}c+aLKB0Ny3bJARIm>WZDhNY{@S@FpHo(T8*t_H*+qT4nCKrd z<>qw|rI5K=zzwcwWb(rIP<-$OfrQ8i`n z7Wlo59V;zSM$sUTJ5pep{@lGCjD9TF#x)p}xq=~>s~<5WK66>~+ydhBa*>DAGvExLs!;&H82kBn*T=gtP_pe(2-0%gm z9~$~1b|v=>wEkJ;f-)PVMSpEa+PGL5y5P(B+X(Kh3vb^wGDvg_>d!lK9pCO27X5JK z@W#aq!XG_~)JgAhGM~(;02JB)PHplYbt`xY= z9)Qp{?EC4SBV!s$eVIooT@?w#4d2t-+1td!cgykpR=v(*oDMBlYGiQB^51p%5({bv z<2&yXt^rV!-)*UTrK4G9oixOGxyraoT;PZ6*Cyt^l(~a_C8nypLc*;b9puR$)fD-+ zb0TVK29VyO4IXbqq*ttH*D~WbW#4XFh`{V)rG}FE1y?&vG1Ta}BUIV#c|DZ9H&{oE|>2fimCIW*UDL!HKn>&Vlz)KMdorKZ~IH5K?UaBtSSVeUg5Ke}%b6J}|=minlR!B&LB9L_3+$0mNZGRDP+Lc+T=?H1Jr2{Q5@BUm# z&1i2v#{e`LWx6F4o=wXQ-5<2`@Rfmxt67Vo%ANBe33k72;C{eG1Em42LeqD-bwMcs z2&{;oCO-kpC1iGT-|adQr@ZN=!)?)d%t zzK0R^xiR8U6vkc|==OZ=KeTmh+nhAKc^N5@9ost@pD(*O(J^DqYwW`_A%7SHF>(*| zX)N&D9J|V=57|8+#CJm-%hR&tOPPJULPHNdi8|Hw*PTsY5$MH_*T~vb({7AdhGr7uQ$( z?D(NLnVT7#21W$}1D!W#Nq*|jyy532zwEujT#hQnhOeZ%N_YqFJmh;h;jNvNv|q|Y z3hw38+SIi4jm#h{-_g=?ia?e`LuzB#g|$0#JlzjA&iDr*J+;qb@5ZS-Vbg9W zMrU!ey<5`FOys%p*Fth*xI=WP7{7G?Qqi*bnM2YlT-2;B)A9AKZHv z!QI)YDGaU2LU;G`Vgpbh&R9od;D5wnOJvW~9#h(}umv#K-*$QXX^n7Ey_6W?x&Cny zi0pr+`f2Xd?K7OJ@PdC@JBcff?Z*~!Ux1?hLPqI^XNmFtk7Y-|H6QPAzRfuIz^S7V zn9u5SntZ@Eol7STI)yShdvp2I4ef=7^f+f*%;}1 zB{6Dgk#e=O$j4n*p?DG@D0qbO=y{$}yNu~YG*QU2{~JlAeAdDp=#diDWQV3gn=~HL z!_g-)N^Td-r4N4-vc&&!4XG=Lbqz7gJg6AdbgAuFAI8UaEhOcuaHM?=kJ&$K3Bpm%Rs2@2vcL zJKH>-b~I~EIc9F1!5TL1y+5Qyod&w+sBe~L)hc`7%-Gx2GE=n4i2F>(A0M?}8e*3o zeyZnS<+a?@-qv?cSg*8G-p9{7HVog-w;wt3wCPg6PS@hFPba~f-rWC;oj8>4=cVVh zryOIrZ$rk-ZBQ8BH31ymbd20wquzA6gy|Y~1N%+67Z}IE9dvrWtgrdM6_s7{1^BmK zZ(jkY@f_T7vx5uW1Ezh?@^^C+JIa3)DRX8hvyJkSUt}%=7N1qO zAe`OjpH(bp7wA=fsx5lg4wrjYK5g&p^C@q1ry$7L>M8Me^Js4zjh#2m6vwCoqvF*! zY=G`HEl65Wf{81Ym$6nl_-{A~%vRb}{LXX&(P#I0ae<6uoXxUos`Dk)k5}VPWrvGr zbhWAruR?6bK$Q)G^eQ(2>ZfMg9EE#Tb1#*9#YI+AwGsXWtM0Q+G`jPWmeRYMXU}H4 zUVprJq#qnQfn9}JWl0=kxHkuh$6rtapDI>Wp8;`S-+tkd_#?#9^S(#lGdX61iHwJb%Ci21A${Hu4byD~M>L(itWgx$pFhBQhzfmb&?wt3s>CZa^S1{U z))outX?35y?XfUz9xV2m@N1$k8LN1=J%a{Z?>@kJ5EB!>`dhzDeM3e@J{38K1aK>e z=n^ydDF&u2_TitY$en!)PI=P)J1LJxS}+}iCUB08j68=`2K=tqzm;+_D1V(EB@S7M z;@brM^7|VX-rdb)@B!00&TqXLBf!V=OPd6q?Wz?K!@VV=(clS@#^d?D<4PIsC173O zJ?J|zalwM(`40d@^OD(6a^Fjv?G^MXRV98yNCm88B??MO%up4-=n0uIk}XdFjsGp! zb_{_|(KMjgPb%*NLTJ1)_pPi^sXUk1Lg0|QCZ;8vaGBA9OYc%pVX^uZCPqz7uhwsW z4=Hae57EQj3yl69DD-~T_0#XYG2O#7VsUR(lrbVAVj8}>BU{O@UCB~-EC8(k+yz+wwm{jDw&^VS^h1tQdN_5$9@#B(~yeWF21!x5_v zZ`*I`(}CxCH%tLi0`pe){Of?LG>wc{(&mxCh=>#TxsIJaoEQla1Us#j2pY2|$TKn< za6eKcoPd}p?kfA3UdllG(^Y&pJG^Kmw5wmU44+oiM`;MqCK!8tlI0Te)I;7+a=q7` zrj~~r=q-Kc0_h=&>?A>RGVc%TkscO8Q6YYadfn!iwf zuuBuwgs}e2C-vRar}4RijB?DzQxu)sGiu(q*Efr=RM<_XdV!7-a$^anpBz1n_yS%x zbTZlvD5nPuyrHwuG{JFK4wF;Mg{oSPY%=mcBlzRjt~!c6P>LMe1z-L3rbU_3CEX(p+7T_GLWjRHA(Vm=SoVtiMy zbpPz}1ki#{I!OJQIIBAtSP>B3$SHnyaN}R@?!uL&pTMAJC@))}ej|-=hV7q%8ZN)T zd?i`$dx8vJ&!%5O65Xq0C#?LPqkb%-W;#D5ftabVMw$xDIVb;x@q=e_dF4BqoAKk!Mymjj~fF_b4qQ;__;}6u^NEzfPua zJD-HOn7W4~&dk`m6u@-NYRPAo$!ngd!6xCr1CP$h3)BEOpoQtMU>#RPUtlEf-fF(A zv!P$86+X0(1$D(fAHUHs?v6{QWf99lNF)3CJ97AR+#s}3JPau(Nf~asL)+VcMe%4W z-fwHKu2ggQu@-5JcR1|r=3_eiL*Ye%?zjB&B88Vx+lsS9U%ZwdE^N&zlgS3d7N0Yf zKtWuRbog#K3U_|EA>8o0S@ypcv_}!B zhAKf?4ee0qv-&2g0B4Xs@n92lOX{0pq}R>sI?0qeC1~&Ej%~g>G$NU$$19^>DP>mr zNa3@x>E6_3rR{R`tfKEK^Xshfo2a2DDf3#OV{k6h-IkXXzZxkmY@#is_phkwMe7kM z))I2{9Q1g3E@qQw)zghq&^=O|Qt#9$S`^l;P|(eh$J@f_(IEzH+mY+S5M_OPBCU3!5-bzi zC3NwyX1zIS!EWtxn2W*osu)zb>?CZh2zN@|cIiD)05Lstx1s{yPLs6Qofbq2Nlwah z3AQk!cr=)&D#W3atn7y=VSdtcF3N=$`o-hPliwRb><(p7jQ=9b{x<9Nf_w|W@7{7k zxmYN6mn(-23=FlL70P3G>IKJNl4i{p8Iw&$KT?RkLY?$k1|=~cxx6{OTARm)wT?_1 zjBd*ID5oTnM}9%n$ixV^Q?6%Tj!sI24cI)NSz5-c1{1=dFyMr5kNx^ajTz7IWgFg> z5+C1V-$KYigYZ}erdb@!RKO{GhAgxZXKpA-zEm6CqJ%`lpR$~S00WMEu9eXxxsNHUcir2G2P?0)sy^<&xBwMR)FLlcD|bf;kPzN% zmpu$O#mIO5?%SAaShXfd;VQ>Gx2}rVx<^1p*rpYZHW8Rg(!!6_WOQk)^p?H|WDqO% zoqtTL7iWRlK`oV4^X8( zxiWZ;UK{TvM?+9)4OpqlQ68w@x@5-n)^%>T&}BpKX@x(`A#?(@zXte}_sB3%o-bV@ zNGVcLOuUAgu9Q@kpj9gSXvRen?>-Hb_Un4{v-`7I)F!T2UrSy9^*dA-qNSRJZ={S# zx;dxr?G>-!&K0gI9j!XfeylqUkC!{rt;qXqTY25yt$QiWlxt%xdRL@q%IbH?@e9Na zB4X-ffOiUZv8xd@Vs)m_4^eE;m?V2;Q`6KcF4({5Rccr3%`1$aM;T@}8qVd|E7q81 zFR{karB0r&b||+BvU)$gIHGRSuZv7`?1H0==Uo0y^3znMD_TMS1kY@v^32SFlO z1{P(*;@XvSo&Ue0yM)YT3ZR&B$}4Pv)5ukTvDDbVU+{5>t278*QEI(`!VL@Oyej8!D~aG zyQzNTB1_{l{$&<-7STa;62fD;J}Cx%pG2DrHchHOs^Fz zxs)BW708W?_I4j~#XuZ>lvmr6SPg4A){QbJcOOZ+4<|Mrkh_??j`22^9T*bkF|>*I z@p)g9lL5SNZ?Y7Sh{@oF_R=_&FyUp)1E8na7_4S8jmDFbMZ&2 zJ~Jx#W#{eO(a%?1Cn7)QVh-|$$-d*1@0$YT7@qB#Ckx~;NbH%8`Bk}G#ykhOFIArE z_CsL)P@8X!_YQiNR7Y}Wu|qWKc~ohk(&qXBYsONurEPeyN(CA%E+kgPhA_cZ?!*OZ z^Im)&jX%UWd_oW;2C|(Q210|^$Hi8loLBbJ(pxcBra#z@rr&VE%^wD?QnyF6--JDY z#i?}$LxQ~p{Zh@yK^6~ENZN@x{z)Uzc@GL*^ElE10DSk)6D%FzyjK>B8DYbcw93es zL6ATLoR~VjlN0UKX*>>h5$ClvWb0eoe zI{Y$iwg>!ASp3Ltn7`3c_E&7D{uXSw47Y*QP+Dbp@7pj>n*W!-@loxv;qzZ`D~1cP+!-v0)H^$B|>EuOkYFuM9$R#0kqQ*Os5KqKO=4lpU-!Bb#qI!>&Ca-y(IT z=g5ZQKn)GxI6FhK%%5?oD|zeiRj(V?Y3}#ejOKI5GAG8V(+)OzBcsOF%-bHXqPE?w zw2sE(buM|z_M3`r1Qqs&8J@v)w(CFR==iU?Ry_ObNk=l zwgb%v86RYnys3O{hR^W+aEx9i=`{e%1q)e4&;fy&ey{2m)+Bs(8)m#WZyy@1=5#e* z2c1etYqcUf{aPXTrum_4#|4ICo$>o@YrPzni}V=Rc%LUwW_HyyhdYxR=k~9eWx$BF-!9c9CbYA_wxoIYkD%Q_XUJ3u^s+5AR2F((1GaZY)~HH; zxx@_BS#{sAF#A8QjsjAOAm7SXLtk46aGnf>EZqK2@}&(9s|Aixe?ypru5eQ?D&(r| z>#(KdAo_IlDy<$k32BJ&I3w%ArtiPzXSdA;`w>j%73IDo;`MeUz`dw3j2CE9)*}dY zz7}feB}Glg3645>?P_*lK2@7Y&Tb?j8VGQYLj;fQM~3Xpw9_M*G**; zJ|!i(JP>A>@RhL{)@hhB#n!D?1x!^{FE<2-D^PST8k{g%Z6T&LZFdq&qprsGE2i$h z9NYD07sHf2jlajC{B@$jLbTZ=p0KG01NzyNv*#rZguRn;s9karo~zM4`7Qpv6fWAJ z1Uzg`focsnm>-6=0(}@`BjY{bngjIxa5FP~!NEFZPTF%sJb2n_c92R*foCLTk7$H5 zDsg`^t($>bU5)Tm>0=r%eQKJyO2eH<1XpkcO`R!+>#YbCEy$K3miAo$^ZYO^o0>!l zc(V)s{b1>3`Je&PcDt|%`f~|y^>~up*phXx7vD`h2I{ehfFsR*cq^}tWp?kT~{o@eLZZX>}#SZvR)M3%;0{Q>Q4?+@Q- z?~kcI<%!t2DR*hm`g@{qCsaRZ)<`-brzfQHK}Q+y*LFj3yhzOGSPFl$x)KP4xfBYo zlPvB@S*8Bxv)W*b(IJN)`Pn_7;arE9TUFUR>WE@kz7_6!h%k@%yrQPjHCPo|1Q9Wg z2%&J!mZyDelb0{~y@JonO!MdM%N$`KbDgi2jStR)17y9mE>}uwCzF*FkyR^wf59*% zxh(bXk7c|vCM<=IaRR27tJXwrSK{Fk9#b$C-NS0=_WCOa>=JmJ@c5nTzP(r0nCl%Z z=@i?<-M={&F?}XNB9~?gJ1}rb5ZRK{cz<6jZg_@|g?p^+2e}Rj3|`rKhGx{+hy^ce z_`z~lVy;5xC)Cb)=fV)F#4hfCAUBg0TH~Aoz4@5=@xU26AUMoz2UOJsqP)>BLPrc< z@4_XHHf)Dw+uA-+bew_4&wKOSbk`Z*Azi4(?Df=ZL^Npi(tb70)+=l;KqA?2okFwy zP+-;=UzEm@=6^j-uQyf~@uor1ndgMTPDuU(Fa93kt7+F*rF_|4CEhFsUqOWmGf>!_ zYi|eZ6De5D0_0ZKz(#}|^GV+>=-GYuoH5oeZDee0ss=pW`EZgVbVF~t`T>BCJ51)E z2Wec#hMRX2NORVYmzbKj9aS3?w-blJI?RHbQ6HYe_J1tY=S(CpLzeRnJdS7)5posF zaL*FZk+xojSFTA83(d+78>ZQc^?p!pJ{`X**Rx{9uRDG^AL+$Z&RkOA3>L1^f^nJN zLBOA8EN%L-NP6J$MqM7cJ)d4!KKHeEDP|eXp%W6%ls;U?pMz2Z;iQheM%PNyfhyaN zOsKVp)TN~YXAbajj#|-0OK}rlJmPHS1P#SFtz1o^ep)_|?LdlKxadY>Wm=URX?xJ> z%bXFbYgW)((Wf)LHA9ydPF7!`#?88xONSA*T^bV>()KLO1V)vJt`W30wGXDknb75< z@M>cr7@k*$gU5;+VGmACr(BBbt3w;LyK(Jnq#hue0!-C=F#d6x5i#?|10KPE{jd+dt!#_#%XhR1omUSAjmNUj;M{nJymR>S&ihQEU3??NLYH#nH zVt*TFdSLYe{Q3ONG|gk}upv1fCuKVQpemHcjC$4t8@EnYcshr-N5YIbZ~=gUf-{N4#(Cj-h#2Q0 zK9OZISp~2tmaUKIoFOYQK2kj=+>;|KT5rzDrouL))`+Gm`*lAh+RJEao=pOa{m0Xe z8<<_YC3e^YU2jVDlEf+7w?E9>*_qEiF>5{${Zdo>&Tbx{?^U=T|@2Z6U;# z{ng7(`8OZPLeVixJ_K3&=a9h!P#7Lh1Nis zW1k{2#1u8w#k1o5^?MymLkSATBRE;s6g3m1a2Npe4#hHn(L_|sFMOnGMh{|}W zdC35}g-H8G4667ySA>Q*(oLnJN}ZjPNYjjW1`A=a4Ux8@@bz67q7!?eLiKI9YEx2I zP#X5jsW6|3w(HcSN%2~kGvaQX+ftpaRzTbeyCF*qB4e|x43?OS;z#*1WyU))1TR7v z(rQ8m=3nk-lkW8p(9zp_i=K*ohf&Cn4M{T}X3Qcro$wxdPr{VX=T|S)8kR&0_Fj3d zxM?-5yAtgB1h*29)1?hva7ltiD5~@8qh3287dsF}t&$+Znc!PFq5@jg&WwWS_>j5o zxNgg4$^gh$UK~Pn0`Z`)DGvntC=%5It3uaTCG9nBJDYQ{%HP!&J)KC;PRLil$4f&7M{aDIKH6Xf+jpip+{& zbV#d?+m7-?C-GQyfu%pCakAPpD4B9TK0e#Gr{$&~1IYH;tHBjP0Db+KC5qy`ntbIc zrIxOoi@q%5rPMv` z@zcS%%uB_K)qO;)`ng!7ygpxTiK7ozHGaLLRg+g0f|Gu1G(&tvC3bC@rNu<$R_UV>qpI(P>LK(xE@zhJ^VB?po? z4&@QAYLWdj-L4SaQwB!Fa_foYD6c#sj^O9YSm}EBPNj~J{RawU%r_Yiu79IQ4e8`7 z=CNz{#WssOkG>aAAzW98y)<>bD}vCzkkS>jM~PEeDcq*Xuh1=@Bs@6eat);y4b626 zWyr6YFV?-387@C=zP;1qiS7gOGixCQKl0+ zEh8?Zvl_)rjzMtg3eV!EJbG}#`F6z`s2p$XI)6sF5V1nxN5-T|q$-wacW+Vc^Uih_ zWue6cUZUqoG`|(@SSN)o$ooN$jO;63jd3%_crg}wlA;@%%XjxnPv3U1cmb-=YDF+a zX(2KDPe|OFoQem6M6v^0sVU)_Mm%|LNG{ipP*3{P2aqGsCc0>Qd7Vg5nSJthO>(pO zQDKoVdBZQf1`#<@t{@O&G=K~&^s)iD!ajr*qo^vT(Y(-n1-EHJHl%et3V*=Mz`~m( zP6ZSJxkIXgd|WIu<5a{^|28Y4rn-!*`f1K%TJ~NsbM!x&xLhWOyJ;%rzDhy(NRD16 z#F?nWb~MS0kE+KSXn8--NQe*WgSV<6gOSWfuNM^gLh6t+RGbGpn3!q-F*Jp5gMz!w|e7B=dv?oam@ZNE4ab28aVz_{70 z2X<8Px19zl{lnywI0IQlFW_;OsxyDKI}yZ)ZaJDr?cAF)l;er3EH?@=$zYBQg1_ zz_BMDi9AQiJPd@8vAc*Ku(;tx6NAg@jtopzcr5|X3U0fEac#xZ>-gV5XtRCk(i50? zA@XxDf7+ig!{35r71&lkZy;`F$lz|~`=@?WhA1?_RPytEQ`W=CqXG+-TB!3{gT2`3 zMvw1#N7wVR#Y!1_ZZg5~LcD_f8jimi>7gCS&GpCg*Kmi93*jZ)|GlzFe4*EZCH~#2 zrwtyNhP%1ZXsY!3z+X=77oO>=YhML!%JJu#Q>%|5Js5JaThX_WB+t*3PyUhGZf=dwZj{u#ToL$ti4QZ}@~3Ie`>eu5 zy)M+E7ys^ou&^(rYU~?wn7O;lbB77xuhW}>9@FpLN2cu{A>trJI0VV-nNzB2hsYY2gH5ros|56@{on=)is}E)pO^9g$w~R z+kQB$n|BaLJ0GYyUgj8C?9NqLw4HNRU2>m&Htf9=hseppKR`I3`(g!{eKMgl=Y@nD zR}qJ;y7;#;)DTs#t9ilYG+Ojk6?-i^B-_>S#RpcK>Ko~A-t{iBT=ZS8kU7sw&6r1j z@VmC+WbFZgv7Y7!OXA0SPwK#sYCR*T0W;k3OR)RT%d$HyV`-``D|hipZwvYyZ#VQB z*^ThjmX`lR619SgAq<|tvVM}(-UHzM(<%-j&zql(fPEO4pmLz&vv=6YQ-uYnPE=? zUfdr>1af?Scz@KO-zyOjEXDy={PvF$PAhWzJx#Mc<9)#1U#2NvID| zih{sY!&j-3#Gs3^gTy?2gBEv4TlG5_VzGiZ*@sFhUr%9}w*q7qC|l=~#1(Q<{p%{< z_{)Q3^s$BNa4R`MOV>Kz0p_nXW)vbbdOeGBthbI*!?8V3cs`yfoCM+zc#G+S5is>$ zNeSw8fW5h^6Bj+cRqFA920q2aJ%ULm;1u4pSJr#mqx~o4=w5MoB&&t>gmGi}U$;9R zs2Km<6y*OMB+eEDBLI8n&s(N(FRXV2#Vi-%QukhQ(#2py!k-X6=rLU0%;Vb~zZM3V zbBI9T^TS`cnE>^^tHkY&p*X})O-z+P(Sr)8^yUD?b4@z; z>NE`!h6Ut4)MQ#0&wxLKp(~AZ7lTn0_v{ks)5hije5Fak)n5tnVZG`-7<5^XU<{2& zA$vC35ft<^y$dsbL2P0e@8Z_Tss!jsTF@^y9@U)w;~WSc=_Ohf_I2Mu%po+`LUTo& zRXQ`XaY++)ta{+A;$l0QMz>Wa4&ryu;sBb;_EbrV@G*FmD+sH{QE#HBp5gKx(OS2! zwCXfwTj&y`lMwA_+MB;CBvz5(Z>`1seDEGZclihUe2F=sq%uPDjf-|%Sy_V1_79m& zdBhD{s)7W24)bAk51UI~pJ8&oz2QL;wkvQmaSlWcj#%{XgK(Th?w{G-JHIYs`EKXz zp$MmFX^2OcNkMtrSJrF56O6VM!&9B9KU7rqUT{Q>^UX&SuyhL zuKJX_<(x#`iub=4bm3wsTew#PV0N)Y{n)uG7bw18Cn~?=0U+#S!TkO1wRFzbBDV!} zVqC>11Gw;Ss5c8wJo_YQa}vVy=E62jP%5Z5|E#&Tz0M)kmGQzbd{_}rw?OT#q>u*v zo{ft0L`?gqxK*ap7dlr>2<6tO$@4Ev4zY1A0uSwPnf)KRrJgrL z{#FPFvr)55yo#h@%5t@4@gUotO@YfEkj;;@GkVou1dZpJfwHRP5&h?HW4@hWIC>fp zl^oAa4(iOz!EH~PFi!}*!cXxdnkD2ao*+D9IK0k^+X5g6S7pWhpNx*Av`_H?Y&TCk zXcMuhJXdp2thES{8amCfPd4dxMbT~YeQoD<^BA9S2+~qbN?H${sG!?BRq*o9)5B2C zVc}1$d#u+_FL3PO`8cNBS9_9(6M+-fv%c_tB33UU=n-xdvr3pqW=w=I`?)UY!ezV^ z*?hFP+Uu<5jD;2`0)d;E+PG$`Zn)-BHSW*^xg0nBw{ecgP51onZQxj59Ne26l8Ld z+gew>Ngwce&J$BwMg!lR{U@PAO#efDI#H?HYbSzw+myd&y|v^kC~DlZW`LF z8A1^f(7uhs;jm9W0N}2Jj?&Kn^;hZ#dy74K;cP6H5*Lvz`;Pp*m92VXv0qh3lzvY7 zFpoM}u%)oc*XyrI4m0+-5x{u&0b|QQ9Ok>V4RVfmlF^h-m`n6fVMr5VVkure1%D|I zRIO?Mjan5cEai6(-# z-B8pP9>nuQk^}o0pi1&2g@{rAYI17y8`%L~S-u*j!5 zurGBsGk>xhE)#86kD&%m{#XPF82l~`dVF3(^S#Zid^Io|VO{khdM2GsYFuzQF7~}m zi|KKtZQrp14FetZED<=F!pnX-j8z9W)O2UZmQVq1S zMYPlve_^9nq~%oXB|A<@b;D$XG20Ltuyg zL%bB_ApD=f$`v!9y%~E&e-1}T?Q1^!?L^Dur(*vY} zm{*B*ePt;k!A*Tpfh%5}V1WAd-Wxo&g1Voc(*Ux0zEJS?50 zRSCX7&1^ z7LifxVY&vJM{X{Nu!)|;8uIwqw)F7#15=~pix?mN_Uk)B z+t<)v4L45sR*1e*WH@pO@`p4Z^oCUX0X(=TgM|)okKIsPjZ=0>0FJ}<3!j7a40#rh zKNjM63!{-quYcrvG|l<#0g`+F^MxXOTNPXZl54NasY>MqGz5tSe3+q>UHr~JR>Rkk zLyeA3m>&H$0vv33Mx25v{c`W~Sz|?THGqDw_zI@u=g-K&XE1MKVxk>Vroz{3!@rWq z0#W*Ig%|hSyp4nLpIt>Du#8hT`!zsa+*B;c!@G}}7kH}1+e8x)@{WqRWNN&`lc#nT z37Pw_n6xlEbU2_dpcUIgs}V(DpLjbz530<_iY3A1kL$MW9^2;);1L)kRw8^dcm4L- zA>U+t!+pQKFp4?-6G;C^c}Dg#td+x1S(ya;5`C49ob%F5gVg04j~52I(U!onLG=SZ z9{iL4jHRHQr$c~`!*Sv=AtKp)soCICNV);1wrR{N){5!@Ht6j^+Q7bE#)gH9@q;jr^56|$f+I&~7-*-+`YGa>D8pwDqIWz|cTSx%S~xuUG&@A zf(76>7UYJsrC^eS7w`x(nq%!rr7S**??#Cw6eA`@R4b#c(;=Nk`G~fSSgO<82!2TI zgX9_^017m+rj27kud3QNXNVk8-oTKr?3c3lkC!%cCvnm@Vu{i5J~s8(p}i-2u?2sG z5m8G+z{?9dEia*c!!m8sUi5ix#7U7dj-R;^F(kUV;qy&R8cR9KGW~X7i2>i)h2;r5 zA;CQq;t&A0(M4o(_3lB7Gt6z6?HJu~H$dq9xq<$Kj!&3^cJ-zYR_9g>E=AxmlnI+?DkOhv6Bq5zQ7sweTqu#IZT`W zb!zZ1)S^DKs^J}V+`hPRNSn&)A@L2qlMO07vT`-tRS(qM6mR4@@A}(39BDPxfg}SV zEhUIf>P?F%%$_@37K%)6P5I^xaDN4Er4gV(ykd`;)MUz{v;tDbNVX00L^eJ+V@B%>9t}w5nJ+wSMe(eHkyVzx>;EZ8 zoZmv31Z_|QG&IS8@x^Ugzv4M!(B60{Q`H203z2d!o=AQ&5mFvL;oXkEq4TPJ7O{+) zZz;n)pJiVA$1d#3xKZRiCOw-LlW`{Io{CfqL zKPvfMM2hrF=h83w6B&I1{eexfn^0Dd&0?p?zT854IeNS`cNujU|Cgr)19<`F0TkK!_U-r($$w`hz^OEmL~Au|<1X|ea0xSBMJ zRK1Qx-}AFV&Zkf*)*>m+oC;myFMVJImuJP)Uy5%a_>Yp;M zX4%moBJc^RqPJ)EuaL<4JsHHO>wy1*{5ywL`65C#MM1OYa2Iy;<%_4PL45d(;rxt* zSPy(dxFzHv=4J^cp`4TrpR$>cD=tVHFk#*Ot%|p~9pD1fL##tgMA(JtP?V(ywRRfI zJz8`1b5>){=gXRLH}Yh%SXVD2vo1*vh}&~zZc6xv?m`)h&&+CB7tzsEb`|39ws b)weGwI33bTie=#XH_#<1DkoASWDxXUfR>%* literal 0 HcmV?d00001 diff --git a/education/windows/images/signinprov.jpg b/education/windows/images/signinprov.jpg deleted file mode 100644 index dccd7e98e2f123b8a1e4c17b2944cb9624e22799..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 22869 zcmeFZ2Ut_jx;Gl6sep*|uJqnJNCc&cfb z1VRg;B{%M~_da{?bME(@^Z$SMxzBy>S!BXwtywek&U(wt`~GHOW-u#&yHAzXlmR$6 zIDi+}KL7>>U{UgMv;zP%GypsR0N^I}+C2a+Hiv`#`^$lu2RsJcz`^G zyTpI*!2AG^-NfO*8N|h50o)+N!6n1NbOM;MeZ|L8^qZ)^9ym8}@$d<-UAj$#El_h8 z+kITz8`#d`*jZ$Y6!6y3hP4KPT zRMa%IbnG0QT--cj;u4Zl(lU>qC@HI`sy)@!(>E|QGB&Zcv9+^zaCCC_@bvQb@%0ON z9~u@O5gC=3^f5Ul^;24UPHtX)L19sG$@gkVO)a#pzM;LNv#YzOx37O}d}4BHdS-SG zwz{^yvAOkYd*|@z_~aCMhC09aO&1OT_ut6+J7xbu7a5kW8`x)nNBEmAoEzTQgiD5p z|3H}Fo`N=^l^Z#W$h(^qiV4|OZMRrObr6&<-;Ca-ViSY0AO0roFO>b)2n+s0l>MEs zf2V5>K#YrneR#NJ03hIed2Oqwl4(1ONzNApS{tD^H8n*g>4ec(P4BP8(M;_>FDhYc zF9HAv01R$X>lgqmCy2!j1E41A$wFycfDikD4j~u-E$JZ~pb z(%Iw91v3N~hKZmxUY#&>n?78)wLj zB{>EIfJ_8xkzxSyYiIW_kgVt+^#gk>9VBFj?N*6qLmM(VD6 z<(nh0a-MiOJM$md`acMcSrB%-MA73qe?~z6-%}0$)AD~)5f@+oDQ&3!UlL2se=xaBo}dL0^mnv08u zYhCdkDa2s_zQsEjfKW~psmYF1d(>VFyN_~5M+*SuALvM=;#ui%ytq{Va>=GN(EX+q znt{zhNNP131xBcJT9QMyDRnUml4{s^BxW4wZ}D`xxoHn>yXiYbS-i$fxa>pP znJQ!Ol|N|G8B$f#7_~!1oc*z^N|g0R9@DL>n=DW{5(H~!>s=50Nj?zdGEhRzw4a3MSg%8&eMm9bSmZRC47xnb4az@E6UL@=Hu*GbqjO88x>7;|5p+1hi14 zcFcuBBjg7KErvIqkm9$dZl>i6Jc<*_61KmO)7Rx;L4Tbjr(YUifN%}n&#ej#aP&!; zGD)t;cJ{UV#r`BMQU9az!QEG%&cda&<3HJRuQ@1K=$KjtWu$lDT7ZcykTb`0ykAji zh!H)M)~YY0+(gRyi#p9!W08yG*EiXbk&6nlTK$?T8^%j)i0))#2sm zk(SKO(7H&wFol?_O8QdLvr>nt_la))J2AG(ZXoe0#i)G`tyySy`f`MvLcx~@9_Im^ zZpeprAmt+>dUKIAKD>Jxyd}5P3~+GxyfUTO?42aZ+ zVf({k-u|C#6?Ke)ySLtml75K$8Z|6c!au7PxS6F}mMR(z%^nyv6ssg%c21#7p8Qgl zH2({kb96f41|rg+xS@;`8M^1Tq@e4g(r%I(clDScId4vU<8%rhLBms0#5X+H$-`2_ zXB?pqNK|s#QL;DyUB%>TYUHJCf+!b_uEd)Wg0U`;Mbi$XJa+;_y>TXI{IqBzjDqS& zs)^jRn&3!6EKEe%>+Yk~Qj{PPd}tVVB}!0kYi~^wyC&zQW9eitrBN)ySW&wxTKuUr zpzsAylF_Fu2&(QiX5t*U4?5*(WILGap;z)s2kvdJeR1zj4-W@j373LF+jk$k7a8{k zbAF4`k4;pA-euMJo_lYBOZpYSO=Xq34GxCAPq#|Z%QWMQDQMIg*L)x;dHLt6u#&eWexx+Zmv4w(%zFs=&ds^AX{ zfGmK2?A0lW!BV$|{DpT-)P9FHwB@blThaCrqB^x3ALdO73FV^J8w@6P6>~O28jgfY zl|7dECO>H_QD$SmC;)#T;mib$G9S4C@3!taOoC5poz^a)Q;no^tY}TnRqE?lx=M7) zkQvzPVp@RkdM*oPxE?p?eL19Mcpgd+b*p_^yEoqE5Ico#rSw@|*=qMMCv9)xoPvYD zx#WsEUMO`fScMgOC-c(@joe?8u1H)~x1{8qjdYCW;4xi z+5ieofok4vLTDcLu6+K+mq(s{WdE+1t4Nxk-Z==mH01p-!j1yQ$(C8n2~`JqTrw+K z82MzZ3PuERJ4iC!%1}DwkM9@)s?{PkKDwJN-7FV8>DK2OJXYiRk@1P)ds)Cc$h*yD zT$V$sj0&GD^=gDf;hHmVtaRCxQjUVF+g5plxnf&nsEMkDYy_+W{=gLH9bVK5pFqKw zz*=2RinDPxXmkKCOqx|b`(rQ=S983^w4CEqfN$TWY+v^Q2Q)1^L18ychZJa1_rlDI zi`UuZ!gMPr-T4h?oX%%^-bKm4S}?EQiOfN~CCOe8b$|kTaD2Gf74$H<`LJs828oKQ zuP(pio4Y*cqX~Vt-xurX8zozetb*IMC<4q8mL0LW?Lo{_O}g1Cu*N_d5}tnbuJOvX zL|u2h9HA$gW5TIhKWsk;^$yFu*hp(ZZnA$$n#fcG>JE8ZlI9?2e;Vy(@}WXum&H(( zqB(~-KI#M~GGh2GUW><&m6b?qPrSo~E}4@Z#k+~1etE-|tf}nqa!pT8s&ZQ2xw&QN zN+8K9|7~Yd3RFiM)Q==SUd~*yqw=N_RTfjeD5D~;tPj)v(vqn+sa$jf1Is!B)C zMJ>4Jh#iD1x1>Z#_m+y{Em~5aBhxdO3e8Z!nm^brXlI(5+^mnmnZ_|+pua?@%yta^787-@v5GX&UQ*pZ8#|NY%z#at;EN@bD0SPuy4L|{P_FCm2Q#4 z1-jgSl~?_y#nF*$X>F8JOClS|gE%E!=8RxmWxWroi`Y2{qIv7R7#P<_)GYjxv&*lm zFe<2{aQPdwt_C}~(m3LOkZejomA)da|C;oG0zqTHIZvXvrq-&SVH&x&pNq$bJc8(O z$=#(@m12$ei(1L(TlY=NPxKb#?e!Kb^X2P2>daJosK)W}`?mPrL}KhdWC{(PKQ_U0 z=PHELxo8;g7G|a_pFS*wRko2*`7p1jbjMm+{1kU3HSK}<%W|zvzS^kH+)_$WGB4@+7vL)Nejni@8mkdL%kC^!w+vHycJ%1#%o$%RB+jMcj+M8kOSi@D! zo|{cm`{zZlkP?WP53c*AU}GJgqu!bjQ>AylvR&{oVDi*^&mS3%Xy||~caF$ve4F;5 zIwb5kAlo7TMb}4C^eYi;XCct@Ks#Mh|DN)2#0LE)A$;}_Dp6;a*f^g5^XIJ!P3L+9AMnmdxHWp|P^%Lpp#Gk>WLri#9wa973BNXCpKf31 zZN<-L-_*YC|FANv5vp;hF}NB5Wn6hRPAlxW+Ov41nNDdO|$q{jUq} z&ORG3q+ay_zqM>asVsEJqpW^X zbthjur@6&t>t}jq=xSvsRgh={6m^R;e823(Tt#c5CT(kytvZ;f$Ye>)KrR1>eQ`5{ z79T3n{d|T}Wo`P$GEKk>)T-QLmyR5KEg-xxf1O}` zlxJuw{OQgcp`H%=i3$M^6v(c=A$|B~5*{h9*z=@`lBCcbzdH``+I1Qt&f<0T>aqo- z;@{HVi+t-Q;_#}XVfdg0nA9EEy5+7=;VeG6UFf}WMy4xLDBdS_?iv(r?$2NIkQzA> zr3!RDh!P%R84*F1Y8$f~F0fm@K7ZlARpEbHsfM`Tm`W6zk2dCn)>*za>}QMl_@YvL zRr28@p21e-$_%@-{4aAVzBbk=_Uvi##hk^vQ(utv6oLl@7=Xb`nh%Jqh21kX&bZGf z<@u?{+Myh1iqysIWQI0H$d2hM7@_qD5ww1tbmf0<|A@MCjtGzWwPZpG@mj%az}mM; z*IBB#4@RHE-oX~PozqxwzSQYgQK|0hhOAG zaRL57!u|GNUHVm+kzUpS5tV(6pAOE_Gb@j8%Zw^{GFZjXkv`?hX?x8n=A9D-5I(kx z@z+*%U=}5yg-6{SqIgbi74uWsAtyN`Efmi#ifco`3-I|l0SSdJ(Kkl$ZD2TaRx^e6 zi_I5GgqfRBTz9S0H6W1Zvfpwkw3R|%{{f2raTNXxbp-Uj_<w6)v4J>D%7ZIl~>=_3sIca?+LN3}I=zUE4(R~b5_Xc_{AEHCmR0fC z6$7}rW*p6%ZA&^Ymm%HNRbG|^KW49udQtJMngZW2KH2Tqne?;bRSnCf<>~j6pz;&> zM5CA-M~ly?{@{*_%DSBvR&?id3(obI@+*(@sZ_9Q;m$=tZ23Zm7rkcO=90S4N^MP& zgJa=`KDVRzR8ZqLSwl|N_T?(c*e2WTU*1%LuyaB2UOvH>Ho3M?e+(eOy4~_SFyhMnP^D{$a_kgHytwGY zGUYsEu}|NVK6#H@hdbbVLK+7bJZvWPk-;lCeQ5>C`SPZPPtLLhbXrae)=X_tjficH zEcZZ8C|^?5HIC;%)vvmr@bXE*ekhvV{rYaKsRIV>X(bEbL`Ax-4$*1w`9%2+%~_f| z{xny!e{Cajj_{2ND1LlIEA*&$yX)05dWH!&2{Lx6iI$Bn_V@%*&o~<|AG*HI(={ET z@TR7h>#Kd3UuW>!!uv3*-wX`Iiu9~qk$aT8V{4uF1UzBDUy|wd;(<)N2|d#hvM|<)_xP>e!X1Vk~W=Z0-@z#7uLRp=VpkYIgZeWaG(5 zAx>w8(^_E0JmKZJjQM!TqKfNl>cL=cy8(#XHyyQKxA5hxE^V$94kyEEoCC{^qg}~N z%;t6yOdY3?eMK2*@O=RncCxP|?tCe=d&kV5&tKT%MUBjE!t=QmrwyUbn7+uT z(xSdb&x6XW?5Y*Z8Oc@Z&aAL>>S(bdv0^cEuWLTskvCIt>jv4#C&vema&Q>S_H2}2 zNH83^=|Nm)4mvZrqSZj0Mu?zN&dAfpc_=>`anVhmC?$s!HU5yCO`5sqwCgiCYJlPX z_zqz0R%az4%2jpjWSQ)-t7}eREGXkresR+QP6gv%Nl^^V4`pqviy!##k(-yBhNIX7 zJj%Y63DOF4k;#>HO6BA;;7$G2UQnyGwE&ToC=I4^3_`OTyQ(8R7%!$55ZS z3)kA(mJIk&tB&;de9F8^Td=txC=iTW5Q4-z?9MGj**_n5mE$dSSQ0v1Tcq@kqFs*rPU@Q2+_}bXjquSE^4r^BsI+Fa{(cYII-f-3L zUc2f@pV|2B4S@1<@sqOjkfB9}dq@1pH8#efzjGPkMPK>4a$-BCu%EZp zx49M`Iub__^0j`!vE!$(d+YwF3~N{be>DAPKGBK}B-YQL6p0GO0IZcuF@XGPL*~Vn znt^v1fL9@!@|?Ar5q+#XiMCQ$aj_tw@X)G!x?}n|0*x(iBZ%T?{gD;H{2kg6=x&6v zf3mz0Dfv{UEQ(VWZpp=V*rmPFaX3&tYXH739n?bklxt1pE?Zq+evk$&y3gs&n}}Q z1>a);2jdvPq5cVh!w~cQdDb-^_P!q*XsiF}%KyPpNfHCQZh}w9buj?k)bsF*))eqh zap2Vr;JOdtAAC6A|0SR3Fr(O2_V$6BSZ+gL7ht~Dn&A*z znATj|257jJpGe zQRw1a-tlPvS<8LkM`5z3d5Qb&*g5mF8&OKk zPJXR}+`#CpjJS^w7Ft_qy6+ zXCU#ML}c;3Q0F_cH_wwopNqJgfDzYObN1-)Qt%a}Dfp1`C^b^$y&UVR#$&bC!#oD#S6(`4D!eHE+_%I5&* zzeUA3>8XJOF@Utw=_{Z;5-YOVJIh$NyutF767#<{DtN_aK>$2{Xo>->q+o?OG8cW1 z85jKX6gwFWHXT886waKulpwqB-`JZ|#){6Lm`uEO@`OAf%1F^jNgB1hlji19RsAFUyng9bByx2lB zS6@EE>YBfFqtq465|0WRfs0}Qk0)Evx64~mQRmeE($RR7Y5>W<6}aUJM5RB>RKP+N zuV3FLam8V*nAk|DnkiB@Ezw_>bj(EA*cZ zPQ3jG@JI<5g$F*r`#%l*&k#lAGb7Bi=A5B%<*kf7zuBrX0SJ45kh~@}z^X@fEIww{ zku;*|whU@#IS#x|rr#K6XJivw%=rI6MtyR+4Q_{#F$;kkP zQq}KH>5~(wsfj$H_nvOK*An8gCG}7ym@skwR0;D;ftW^AS_^f!F&yTy3@}u&6?xU( zlr^(qI?b}w(9E-^-k-?I_5JcFw8PhR(Sb9{GsJ0CHp6=Uo;%u zAb3p4C_e~qia_4uzE<*3w@%6Ge3Nxo?53RVrTOj!X!_F>bcwqmOkZWLOQXYv;6D7~ zgWD9OhIuw(7Xxr=K%nyrJMfd!7Z&Hum!jjp_f_R30wGVrIA)?~l7dA<7pB6yT;Ewp zHKMjwLGCK!lerlt4NcYcaThZ#25C`s17~=irzP_DP*#WTKTPzd=;U-~j2EhWAH-e! zEauCmi5+xH1~6FPC!XFID>T&95Ca;=KJ|98bw$}M8tsVAb2NYL{kfpxLW|#b&o}Fh z!ev>6(F$MT`peh1ifXiGwagLA;Wm>sU$m4)_g>UQ9r<$lerk`4dYY`-#}~`y@Z%2c zHI8^Scx5@3F19J5cUn>Uk-^cytJMbz26MDVlx8J~U*D?s5v0qJ9%k1(@UWd=t23;7 zV>3~1V<7syY1ZIPo-9w|O;#Q$nqs66*4Lb7F;03dN@#MOE>23K6mW)SK`iF^IjKGD z46R@zdlZ*YhBAtrIbgF=Svs!=+)$A`3~#4e0-*9M9BSXF^H*fJuXi3XRL7RMeJlO8j*Ck&zE)sO|c}+OewlYubuXhfxSiRH$Pwd1|9IN6PiZj#zecRw*e)}If0BR^GFXXIggkmvyxoBGN9?KJ4 z%d0!JzoBoZ$5)Tjyrlp^5Zs=_|7~B?ErFfVsqSwHcOL;w{$T+k z6wS8jGC6 z(r0MO6aM8rYy14Ur9SbVm_l?{GE0Kh_{+sr<`Zt0G{|y>2rI>-{OXSjGo0%dmdN)g z_UtPb#GO=$^cI$ei7fs4nuf-vSk^GMyQV{oO-1!b`yZZZkNeW+rWV~umec2!H$p4$ zF&dQ)9Lq&?6Cw^DJ@OAq-q#5llBce%icu@~DTEJZ+!>H{zuhnP$y53M!Gf+$EDg=@ z3cXaXlq3dFJ(>CCFsnnJEXgF%_K*@b?~RAkZq)aH3VJi|?GWF6b?AMo3HxT9&T%l} z2ckx&b;sADix9f;$Px*DdO_5lRaKK3gKMVZy~@whzokLmMOEySU}0h=T~FqV_-ei0 z&;O|u5QQ5%EY!FXjno=5*iKikq%s#g@5O?zxk2&r$q6Eq(%PD#fJP0(t~K*Fbrz^&b_kSkH=m$P#EmUr_g@(M@{aZ z79edEEWoSh{K%DmQ>{MLO17Ri26SN^<58#%c9UUgo*ay32zpA8obeLuVS{K{p>B19zQtO%}R1KaJCTmhUtA zE&-rnl?%>wWL{j$e>HHZVv@1S2#u24^_(nQVg=PMQW4ok;<-IZz^SoToz#C$49Kb9 zd+sZC&a$}2G^Vbe0<3YRb7YrHwNv|`e6ZEBr5$s_J&}L_XXW`t*Lse|bZYEo=ly`; zo&f6{CSUDeJ|%1M?QtKuzIw7Re6Se4jYfl$6M7CviF2JYn;)$(b-a70&VO<=I3{*1 zmZ-{Z?|943ZM1KMPvo`VkrNNs#*^dk>ZSFS1&*BQ#(A$2kEFe%*)p{rssUqFlqjD- z|7@`19|IqM%m0}G2yHO0@CsL-{6`&`^AOjwFw(JxIMtm~Nl)f53%1c^9n*4LBPfVz zb7}Z;5aM~scD&w3et6XMNmgN_s@n-<2_uaXBc*bbp+tui&+MA4@yr;TDO#uhf(!v} z7osy*3orXsoGz+iXIB)|KN|SsLts;4aHj*Wc#`E9;OH6H(Ye87wjyffU@+lpmBwDr z26fU3!}Svc> z?G{*Mq~PZ1=6ZWSk>;y`@0V~}B?C4jV9NN*4HtpNK(*DD?~v=ND{`3sBGp;P@eZ9v zTow#utuAu|Wis-LuDmODohWGfeoCG3MqO-_YMyev4vi9%djQ#`=9TbIFv#406>ko7 zni=j}F#9k@qJgqn(G!qj2@;vz*E`y@Y5o!Wkt$gYhc>0bI{js(ywjaNb6*JD6>EMt z+y{8u{Y%6r=heU z)-czB)6naHk%YnCuNxDf-K4Sn#5vV+SXyp^Ro%kNgb$&qjvb(fcSs2tNdg0N(NkGB z(ex@Zza-A+@~6`R*$knXB-M|Cw>nd(VRFSx`sZS(3M;(pDNt!BXtFD4)Dp5B8pQ3R z`@>H@+|$iD8ztJ6-qk6?xc`o}8anPG&g}xC0R{9HyX=yi-V^OzctoPFF5Wqu6a96< z)URdA4?e9_`G&_<%0c%Ha=T@qB{Qh-Z5u3BajR|ICrnm)`7yL5UOn+#`GtBhYogwJ zs0N%tM~JaqGT;7uyQ$)Ip;_6N@{FMP(kFnQ+R$L&PJXfD1$LdrSHthO1SX!Vd7rYK z?^HY11Wgsek}=cAZ9)TYGz)A(KFWbJcIW;sJaY*s1M=NFBJ;4z&a%Y z(x^jEZ(TibTg9vX0#TQpfy^ERqc?fetP@pN?S9cF(i)Mf&W}|r1c)7ylpzoMa&|0i zH$Sx84}C)1ts(uP7i!IX)cKXawLrSEB!KnOD&PTPBz*5gvTCw|4?f<}qCfBRhQQQ+ zo|Jfp?p1n{N!n9&7E7}ZDP=nWT!~dZg7qfdOB0m6F$yAHUnw4|0EB4)-`O{Ucz9JB zCpAKT*dA#k^E6mpdZlsV2Qsg2s8tK z&j8u{Cw+FH zISS~6os#6(yhun%bh{IX;E9 zIib)W02}^i0L4E6KqTBi_U5Foz4@Nd_`3UHGjIMmL)F64L<^lyyvpdFYo*6SlkNfC zVD(bj=nR7}-nv{sW49^JTjIiv5j?WbQSJVpj)pb``+d(#f0?_kxppiXDpXC#DTwz( zHyLxpKMdXI^pl-w;{(2oqj`{Kp{(l>OQYa^gKI`o*shH!;Zix^+0P&n)SFFY7eu;A zqnx8&F#JJkyNsTQgT$CdE;aNOZRLe()LYb@)C zvydMck6kkY`>NRU-#Ek8I8zM>l7(#y7DgroU47*zI%8?fN`P)#HpmWZ!xma zf9Cd#c`Yq%ul+75Nwa0t<)o2_zBJnS1$2_dac|wTeWANTI}O-`%PXMbW~mMXx$Pyuo-IEFe4ITLz(FLyt6RsAwvwiU?PE>~hMcx*oW&Gn&=BMhji%K^}r( zp$DO^0-#fra(Gd9>JV&(f1`dfZ!&hMc}#v;0{@8a8Bem_vGMKC>FqREdWEjmwuP0Z zC)?IJ#$J@VjpdcFu|>a3W?R_&wPOFyD!ptm{~kzw`SmXCJV{-Gl}OU{i14K39Z3n9 zN&cM$7xS56Q8aku=>@0yb!9H%tZj&HZe0IZP9X<%=eUDPB9)1$Hl3cRb`tKAlj>ir zrq@Q+_CZ)By1>+}`BFLP=ko0U5F*54^okzV4Af|7o)Qq?UjtEs)?@mDripwhN`PMY zwewbY;3Z}KtlczvZZpZc31eO^(=E|MOPvFP9scq@Q-)8G&Xu;s$I=OkNBzQmavoT} zZ|iXC(4&q`vxH17*W;y@SOl<#G^~Lj7H0ak_S^3BmiN%@Kv-xd5owiU!I_RJC z4+6@p%s;Ax)Y}!<8p|q&_{C)!D^&V@SLrL2p=$r0DMh=hl9{1*9v#LIu-xDB0Re`q ztSlO8jGrvi8nw93=hUfo#}7Yz1q*JZg3{p#qjKE>6df&=7_< z3!?F&6)guS&c2|RYY$R4w?~$k`#<)6P3CKI@B0PJ4-^-KOCzSWQQE5xSX-9gw>omy zvG$D z#AQIgky?gLQvS(@os@$IQC7j$Nm|Ei4$EGf{fOI>UxNikY44b=a*HqWUsYjRgr7YdFrcZaItu5i&?}`9;Zf5x7rGq9uEO3W8 z*a-K=AAJ{+;t6b9Z7IUSI*fhrRC1k6#vjA5f@i!uH&o%IMO$6D$US@6dQuo@!k{i|}18AxL+$9csd6ipL_1Tk_zn@m6DCQBuqRk|Rm z^Dc!u@sk?u7~ifA^VTkMDDTGHIUIzbI2fA%^0TJv_e;g!~^+9>KLhrhgeKW?VW z(9i(rt9j=Rsa82w--ldTW1l6NPxu;Vv^a_U@LC7*;$tTJ&&}pI@pSXYa1kPPQD#0J z&w73q!G8QY&d~A$GW5?Zq5!pmZKTelDx*cy#d(t+>i7J)No{UgIcBpob9yf>!dwfY zwtPVy{Q}sHNdz^bbXBQ5dCUF}AzD?R-}LK5CzYf+pH5#~j(kcE!9j}!>y0d#tw{~} zA#)Fjel%3VsaN@*@J+RlPI(ZOvrMfx{2H;9Yml5}t-s`Yfuo+a#8_TO{EfY?(geG` z75)(6t$v6&SJb*BK`VPO0N=Ytqg8S zjlCHKqL}hV2ONf4oQj>M7bniyM845j9eebE^Nqfbxp?y0r7tZxzmHRjIJb6pc`=yF zsHrHt_B|cR-6H5iYH(e23Rl-1gU|n9dQgQPZZahi)=}Jcy`|op4Qerq_jP5ce4A#> zPXFjl&Gr%z*03<6bbFYXry$KTK;k8h()rznyxJhfVBG>Uvw4d)Fy4dkAy=}*iSFo_ zSk!Gjy{SQAGWC?`Mzw?LJ$;5&5^i~?KDN2zQ+e%)6VoADK9ij#Q>$VV{_E@nuj`z} zXrBI-qNh@LZb#`q!Qo5~qTAe12@pox09mn|o2S64KBO^2)$^QZAhvHjLcaIoa+uA_sGb!al%g`UwQf8>v|!fA90RaY!0XVB*3EQIYeMAc$Clgjls4KAL0_?RV(c4)y zldqMgGj*Wh2_IKK+kUy03S-o?bS_BWK0bx+_;gnyqC4kEnop+F`LE0TYzl}9l5a$? zk?{?NXEm|fz9dj377cbY`agn1Y_(C*` zUq74gt4+E{;rr56+H3vmjb~5NhNZ)VdG&HDlg9l$Ek!m`R+b>Ujun^ip!oHG0p^ez zUpaQk2x|2SdPQhG)tj9g1QJ!x^n_ybx+h=Wl;Ui5-fqQhax7gknV&zcl*4sN%USW)l8tV6q~o4q9at z`jglDrm;e!VXRTZoyfY$052X9CkjYo^@;k(#g$se21-roX} z@+($RvyX~O4K8{M7{DTZnjt5{H^!ZBX`1r3=M67TD_yQXx7_!UY;Q%RjFcLMj~bec z)u@bd%!;L6m`TQOn!MdB6@8Gnq)X1A`ry@Pn^?hEAOss7%L<>XP0by$FY`&#`95AI zE=VT$zFaH|-o^kO(_&GKM#luym#wfXHnrLktM-=X$CksJKRVVzrkz2pSHRs@29_!_ zmnzzvGYBab=h8Yj%phgePA^W3K2wa-o*FI{~g<#2dvqOvW8^s)@V6;ej8&_(0B3x)Vd7aA0wE`4~MWPj=`PvRVox zn%Nd!+AS?GeR##h6g67;Ahyz`PKrw|Ro=7gNoQ#@C@Be24e~KX<{}8bz~XNR)Dt-) zP%g|Q^8>leMDxDi`mDVvrlFRvycUK0J^VdGpN3~CF0k#iFqVjCo*maArZt6Kq|*J??hbK4kkfipyC8q;dtT>Cja zdO_Xo8oES_=-P~CTw65hf(wa8sf%R46dT^lop;$2%JE2?^qiEIi)5eO3&0NaGRNM~TW z;DzP%5^%3cK61)(vb8ed=w~twx1nz1yAjKLrZ=F)X0JQtnS^VWIzAo9B$R7K&l>*S zZS60Q91FN#U2#QoG>Q>3rU$m^^N%bha&_KW73bOVH+<-M*xJT>`4S5=F~wiM=OAi) zGryq$vEwT-&7|3l-Ei~B`qo<(Usf-g^T{I(M=haBw)wot_5rj1A{wd^*n*Gb8D!y)N(#HqW>tg-)e=Ln zgNM1^qD4=!kKe6Ib{6$if2a+US*A}Sg%6ZcU!x?ds#s1l{8AAmaMqCyI*Wk#95iW^ zIZPv&I6cN6=%qVAE=&D6!<|Z4N7y?xSWDvh;R)x(aaIwItuLoXPO7x{J2+BnpCOde z=<^aX-8$~HB(s-k_`5R*m1>B6=Tl>_c5kd|FTyRo_XxMXvfRUUt`HWKx+X|z;Uw(1 z#PWUOe#j*OZx+7k+~a&BHYh1a#Ax@O)g8oxIvO@*l}}$c>v)&rm#D{r*sn+r36kIZ z99i*?=C1MCJCTBeUctiry}0iQiD(GldOd9ZMO}o#mao5pHjG7Q1Ih1j+LB>8JpgJq zcA?`|n=%(@IB-E8pU43_WyGi7pEeFj>V%fn5Zxj+y!-T#kC~^zRxnS-)2iz&?QUQ3 zla{1QLmz*m34Vj4qmjoGY-27nKJS_sZG+~5$^}Z@fOAX>Uyq?iVy|!DknO|X5b4oD z;g&0loSIW3@5LA;6%!9n2b$$+uY|3nA$94SqbHmAV@ff~35$25o+@pE=)-uZtRib6 z=GTD%QRt!eW_?>%EfnXl^xCeHCo}z(LN=;;jX6pjNIX{_AAU-r>HkH37Sz?yMpV0! z!@ep6Y>;BWd1uz_ce1`gF;~6kQ}Z&HlVTqm!!!Q9A@Wc77FZEL6BAK$f$KX)`+<=w zma{#uma0SDA2K!F@lH$h(aK|D<^C%ETly2?r9<*dM(o2_PmRrh+_;bqKth!C<6Tlx z(!JE2B_GkY^rXkDBsyA@9P!TL!?BbQi6Dk!7=)i6anm?m_x1d(*}5lccCU)gr-uUP zp(0R*klr5LEUU54sUpg>29C*W03kyjde_C?5tpSerJcrhECPpR7lI=r z_C_-0BwA&RYWX{9i1;#zlT32#RvhbiZpyW;!4b#>B~&+nQkh>;71f2GoRogP-W*+Ws)#Ty$UU&*nL%6{MxZy!yKppMCWp85u%d=&K8M?UgqA zu~>h40WZfttKPfWLK+}+s1+VSmu~s?v^2W+;EFnbslg&!ImGB&rfFp1QLdrgan!2H zOa0ELjfTR|zD!<3&2&gjG2eb}npI3HQ~&x70~I^j>&?Q_D=ZeU zA~%LBmmuaRjuPW9F@UzR&(}YMZuuQ*`>&=y71JhHV$|?tuy@bC!cGR?=e8y7m<0BG zo=PDFyUX?mPt98Uyf0d@Q?fDS#MitkHVZMf5JWk9!*1@grEK=4O!j0@Asx%tM8wot zVO}4MX{=~7>MfM)Dq}n&3~-prir6+D@q-lL zKKbWlq@4DE81#;lcXM2{0gAck7Y6XEE=haLdK|>@MSh;QzvQrsRheyuRWQuv6(BDr zpzTfGkzYlId}N8a(W1)6qR}AonB(y)kC$a4QY*ny<@}PX%FTI@A%e;x-e=#r-Cu8f zsMpymlqQ~6R$Y&Y>arK;%5WEDNYqq&c;u8lf{fXb65s!t6UF=ZZqC26{NGsr|J46K z6WSwXiQ+9ie_CRI84J zWVwVB`Q&)E3(|T3vr;tCwLfGpX{2+kyFnAQ*shl<2*Nz9zNLRI;i(WkPCZF-$m3x<#$wrfSZq z=;1_%eI~}z%br+cUH;fEJz2PpSMc5=yd*5Zti~m#v1Qb~H9lkL72+nt);G4mTlsym zF7kes1E?=utv`Au%gSB&YSh63Fn;~m{+qP}0zX$sy3+LOZvSBHBn$0!7(?Tek|{By zyENOsE|A(t8h$(P>v%uO>U@SkHYe~0!&@BsdfZU;+1!|t0g+O`?eP0|?>yR_IX=xH z>MPGPh*Pt+{iWZ_T3I-Ow#%x{a`RUO3$A)zWVL4mGAm37cqpkTfB4HS;bbL9G41nY`|hepF;{D-5mp0M3;jRD zW54;!=Q>CJfgiYCyX4>A3bV$R<%cAlKl?ESCTV?z4SmgNW=@mXH54@wcoSdlTgB~Y zKEh?P8F?2+K=@EAz7qGa0=w1U$%uJm8aX%_ejnlsV={=`y z2YW0G@k!`!Q}9OXsPS1IL9ghJ- z<<38DAT6EP8>Hj)xe_=80FOwL(C8lQ<_`leC~W?KWQf6g3hv4l-K_Tw)FHK}K~_w) zmnM=cRSMC`fruRtE$>XVcs4hxk+Bgh5VGz#xuO(2UC)nQFX7^{3UP=`wJ_CbYQ*8tN4BDDQ>XHbxmcG7dzp)4A~WHP5Vm+@({|!#IJ^&`iqF}nfu@#mL=1N+UtCT9hTB5 z=h-6~GqFf>d^zlfn-f$524HCb#%`&qB&hVoV$L(ceHQ_$7(ity5DQf^3^9!SfQ5%Q zVjYqeSl3`)?#u`_aB3fc1>dzwP~H99LLv>%Lz@Q>lU|a&MDGG=x~;H+LRwl;xe?m6=scg+RTsb8%l??lgf`_o!QW2 zooE{({UDn2BU46}UqgtQSYht_xWDdkf8G7}{^R|4|M7Xe-;c-p{r6%u0<8^*6rd!EmoW& zK>=df8%1FMi_-Rk>MqN(c^<+1YxaKnf4WiT3}nM_z53k~4+^1@S;wo{e&SghZW+H4 z=XuSd`#|kT5@zd=Lb~&4jZ-SYJT_@t{n*mmZE}qk2W|JUz(I zWM7y?KFotZCCiI!{UjnwIdb&du`Ak*8aDb~hYOXfQAN$?L(1Dmop zHx1TfU!T=qckvNSU884r-_Fi?zqPd4`soMrPn{vkukr`IjucBc3={1%RByBImeNsg z7r}!X#-O{gf75?$hyLxiL6``P(7KS5bI6s?1H?mhj*SK&O30fI0vTBxjiE5=i~WR^ zGr(d8n3!{_3ANy>9-R5@nSQ3+bz;&}J-iAj1k*!-S`J_O0S}b3w4dO^K`!Ow#B z<+Z^Vs9Z*+Y)AZsw4VvC;g|y1vG-Q_N!vG+M*!9PGOAg|HWJE^<@Vq--MfTt-=;1r zG5)3*%={)n|Bpm#w%_J^^#Mc(%j&gq>u61%YKe7Bju%R2G(c|Cy9e-IaN8i{kf;kp z7}BZdw1e(>Oh2ph#&C-1=5{{554;9H=_Q!VsCXxG6d47k&U{TAHEcHBKSRi>Hr%tL z1-a*<4t|e_17Dv1`+Y+43C{6-g{15C$*Q*4>}Ea$8h^ZlP^_9N?l62>ws?s|PQ$0Jz(L>Kz0ZwnUi*b)NvAaqxb3ePm zRJDJj=n}!gS0Qx`1x#V$4SyJH9z9AQZz%VEAu#JE%uu=>1|oZ7{Cdp0$jjfGE&i(P zsZvFgqQmhxD@l8A_VYB3laq(N=o$Q09tB#*hg?|`MfJIkZnLM#?1 zxBmL^x;I(cCaxH)ow~L1`MTC^O*mJ^mtkA392oU-o@jVdp^Z0_A#NR^T@95rm^s)b zcnsDmbm&>w&JR|!%I+$5*}018{*-Wwj8-Qjkf`EotE*!QrGdSV`9H_N|7+{vJ9PKT8k{V7BoXtOMbD$S56A*IXUyGLf(3D1f$K&p%ZOQta8OO0BK8ty2mP*E>)Arqr PVGKCvwli9htG#~#-VA*# diff --git a/education/windows/images/trust-package.png b/education/windows/images/trust-package.png new file mode 100644 index 0000000000000000000000000000000000000000..8a293ea4da1bbf90bb90e33e5761c201e435da42 GIT binary patch literal 43329 zcmc$lRa6{Z)TWd01qd2~dw`I}-5MGQ4#5J!A-KD{yENK34Fq@hV8Oa^cX!vuee%z& zHFtA87ghD1I{RGITD7Y7e)n@Ceke#`qLHAzdGiKSMp|6?&6~H6|MU|o^1rkFJ?84a z%UdU9DbY8TqhtsF2LG9f$cwyrQxl8+Wbppq_=CN)rqi1@Sl$0~yv3*c?*H#5k+Xz` z^G`cdXEy^!lQ;GT7PihTwkFP>xmeg(fYzM83UA&N*UE^CsJQDMXTFExt3Ja0mR45Y zx1ysn)j0F!em0?se2W$txl*ro-&l*=c`fzB;bz&R@EUf{ zs({l26xg{3OA0`aiL#-w~eaY`Y~RY zi@iVk0h50?Thk%@_XPJTldguWkQQrsKP4TBep*Z%3$bbXk36ok8uliNOs!sjBj5_i zAunC%{02Q@Js-*UAI|W+(Vov)UZg!N$aFHTUwx?Q`zkEIy}GlO`?=#GbSYyAOe3iywm36ae4a1K_gRs@^so^?!?otevcj}`gu4pJ5*Tz zT9`kD?y9EC7WK-NVh1Q6)tkQv1xjZ9!uw83 zGgb^6qt9lGzZelN_DSkO&)tQxt%U_?YHdE^1FJ1;OE$)E_O~=s>S`Kp7Q$8Tf;+vl z|3Fm)haShQ<;L2&hy&UE9hcLkbB&0EP0)d-9nw})42>S?eRh1|wgG)O9;CEX@))RP zTDxt6>#Ldt$zLIfFiLE7d78aPL;Pa8-ST*niR1By2d zF*KArsr6H51y&Kjn3O0%hNDA+v3u2LK!$TjKFv^KvI);*Vy9od{B~-v>b+(#Z+Bzm z5hZCl2$L1?H3vcvocuE+d>Nkg9Zlj72a!)Eq6@uMvqW{Nr6Q&?3+5?92err90q>LL0y-5oNfxk!9N@|VnIc?s?B=J z&?-`kOq$HUp#=1XH0K06kj@MY8G(RC1)!Ho)N7Z(lng;j4VWizKs!Y$4mb7j(fM5M zfNPqYT4*@)f>sZ}$3LH|VoQYgr6br(%NImIz8+~m3mhN9u^nxsW2iK;;snRX23Obw zV#mU(V?ObuUg$ur5B}rIiBR(a9l86S>4P46l%{2f-_Pdo4sGon_98G!7`bN0r zC*|Yxz2rE@Vls21qsS(XQ@`E!09Kq9UZGKj0*d;=u2)Xoi+Kh1ZZ7)l+CP}*E(Gp> zhx@H8uw;q};`H*+8NYHzy@i9?feQS!-pYg)xF{B8Tl|GJ41YgxmgF_1XO~%#PB2f( zhNxecaIB>c)b@sWRI|#Nq%UFBRA{E-m_k2-E>gwZC(>eJu@Em>2ITKqHXha+5 z!2e%MiNo31L2-JWGOYcxN8PY31=jxOtzZvny=JH3lxeQt1tNzQ|8YlmqQST`)py$# zl1F2B_6as}$o`VFP$fO`SFb#$Rf6YY$gmw>qiaW1l2yg6&$A&^7nLWETM58<{)<5Vn z+TMHBF-&)O!m285zwwQQNH6f4BGf^HUn2wecsJiV%^Lh>U=O1K&ck2A}5Y83Yp%YB}4-s#h&xV3bky=#SxzdFL@J(5FiLVIh%ft}qG&9d0G}+7Hjz9z8of!sJ z&tu)63?vzzS@(w`yyd%5+lFc1cTj8FtYw^7#nb$+u>=GogOLE@EwHC2Zt@x9-%0HU zn&}m+s!BPy(VlZ?UIp~OLR^Cvz~lLHLS7*x6nE4p#kGf-CT~0=`EqvqlRt9T(}a?{ zDalmR`fA8P^O;kYiX*O$6`y8v4RnVU+;@C?oBJ~k-IfU7M96#-IBWLu=p_fBReUOW z?l~Xq`?X$n2yo#^vKxJDy*R{%zuBUAr=Wl&aK9Nego`sU@HZiX)ut=AK{K`Y=JBCa z_q^Gaeklrxm-Te4R`j$$hPa} zl83$nREC*;(SJ#e`5`jWCWd6Aqb_V*gM9wFc?Ez|J4MUes)?CTqEnv z%cgv@{Q{n?rmPY!qsbCVIbnj-4K7V%sgGNEJeLKT-|v!vI;ru+4BN*Ar^O^>@5U^T z6CbliVh$^pOghR>VhE4T+{O)#IGcGJ>y zU)&T3Hp3GYgy1{9gpK-B0o3;A#nqjGJ`~>#JY7A_=Pi%Td|1Ks(t!K#iHMdj~79w zMITgux4_=Kew}$|Y{L()X<3#tQpu(CZR?=4efdhP=sWPDUu5TFP4`X^dNI(bv&5z|nG{WOl{MZ@K%o^!JiZA>i`&N|=#9U&(Sc|X-^xE!Tj<7^dk zKvo}YV4FUVqi7E*A=_^Ixu9V%+uC}uyGe8RG#ZdPJ%fVHA{6Qc=p7U}9-xEY5jIh6 z)okovuWMNg58jLI;s=EG_4Rb0v%qH-s!slPyAYRV$vCXuS-UEVPxNz||K6|^K4Dz; z(d1ngo-kLWkAUiq@ZC0K-dT#>u~rWZ+_8g0Dj&s; z_|zNh>$)rOQp-Z63^y5?_z5E9m@ z2+PbS=aByc^%lxp!-hweRqJ~&WW<|(n(}ZlRR_o12CZES=YmgYao1+Hj4n1qGA~Hp zBSc6f<(V>KGsp?_lJeWyXz|iNjM<3fF>%iFZWgtM85x(ONGj#uOwoJ_JIaZuN#*`R zMt-IlLUXVKIFTYmD?w_{OEGos)BNSl4mP4Ls;8j6%C|(6jU(<=ctp@w*Ajx3gqE-s z(T1sJS=qbE1_Q^C;1j9;GWGmWhs~8T;%>VoeM|nR3Z`M@ke&#{y`olsR#rMPb|LoKC#pT zzu``op~|?}>9;exlaptQ+XbWXEvp~WG~%aykw(jul_ybRcn!VUeufl{_C>c^H%}UJ zy49F#)`R>a$0&e1{p%4V`|Bc<>UDwSi078=(-$I~qoUx7S0mCNf9o^c)6FN=MxzFn9gyL)LQ4so^CwM-y{6zKK)Z-8F{457nn#i$kf*dh3u{34s zn;N=MM^)`u1d(}1EuzW#XIL`>-ZTDm07P@DXVGjfQ0l#p=gAMaU2e;2PWIsf8#yPX zrwmI%Brgep1J-lMKk##(f6c(X2(6`bMYwCxt!e@c9hGwk`PPs23n&K4c0HEMVQx6W zMZ0Q@7d5*MX&;08Th)#Ba;Ue@xA_v4BQu2a)Ws?b_E;c8RqJiI$1<_$Ou4ArKkPX) z3z@^B{IvJAH}>_hUxC7(wfibWJZ%xxVM% zWK{aby0PijRKitBL6VDsla@HUyi6#-@qJ=vmU6^GjV8!1<)pvoEsj!DfuUw#riUr` z(*wX)x+~M}m`C38Q)u$5$Cz#J$yGWhU8?3X$3et!9wF0Zu-3D_U-Kj1rU%;dztYQo zXDTDU%XP%`@dT(Gd7eSfw0#E^eVeJsDitjB6q8-!?S!@Thu|JV*sDv8jJ~)Jea}^u zk*+iFS*0(cIrU&@2Q>|@Ow5{r+we!%a@6>;=9A6?3~O74(p0TDo6@G!>N5`oqhv~J z3Qd>|w2wIjF8nJi@bW++bAt9`01n_Kv9`Jvnb*5ksvujo#`A1Qte>g83qPpmAk#(y zt?w61m%e>=f~(YXyg%~Fl}El35ae@t5Q@>O(~5yY%o}Yolqb??Z1iGyr(nSj^7FE<^okk-PvB{mQ z6U%ptlGceKHPJDL=eL;72N^nzOLJCr=iQ~wZ9;jZWI&jos^5X}&A`stspx;0HQz2~ z`@S1#emO7C$vJ+MWLnThtzN}eI7MwKjpMVTx+zF5bCeeF5fjUO#U*8{(?cC4CM&@h z?F=S~lBe5g`F<2uq>CO?E0hLRpVlze3wK}=6+UbkneS?$XRbmc1}0gHZ5iJorG{-0 z9(Qt$(ko}Rg{VmhbS?( zMy*dw4KP=!&Rso(w$d9s;)7Y{=7MEM!?|f$0O`H2NTRIEt>?f0;Qc=Qe9;@VF7xNq zK0?dK9@~Xi-hR{LqBnZ`)`@RmqyXS8lg*YCn#UZ=9uo$^6tqNHewi^y?t>=hTjVqP zG4s`BP_DMr3kdD~XOA9&xmtKM29M{MfPCLy51~gAV>fdI*^&_EVO>XDDBB3PsK*^1 zoB4uz@1WplPw7k&tvGFi2TiEXw|Jg2irt9vPb8l+_FJSg1`!p*B~e94uNqrBGsB8%X8Agj8TL=s1?RK1 zF}&ad`#_P~g;|hF|MN%5)|Pn#G0*o9b5Z0zz3Z^!qN3zvy}V6nNcJbyuU7Mp;OG-_ zuq<4B^RSMe8cJJTL*dtiG?)FNl zaNOM&*tyhZY1pSRd$zpokM_vmzSfjO4|UnRkzoqmK#Jhk#+Ob}7}*})Jq@F-Yi&A> zM;bi$;^(*z*YJ9;YrGLb=nZ8znYZNH$N$7V(ii39Y5)NLZ3Bg$J7&}BLbBSmew9Q7 zF&;FzY?3URgQe)v)XZ1ujlndhTz@}olWMgnzPjTnW=#&~KafbJ=qH@00g}u8Hs5wOLj>^3h#|`S6^^^3D4b{xI>rysh0|U@)iy zy#>~&&7^_Td+j3y1=*#ftgHWR1JHKoaY>~ zXH_US9$TfJ5;uy-pJR$@f9lz_FDUMN52WcG`hX$~4K`wp7VIGR^m@l~NSe88{F3B9#Bj)6+;P zN07|h7nyK=XxwcSGKruSyxFR_5*o^)45FR8R!d2u0JhRR^tu1NP=QfRrKqM|t}aKg zXST<`%+s|wxagVoBO>3hS$Gu3Ej!<|m)mC^gMQzU4>L>L+N(F;3uGML>V0-$$>AHK zg>2b$-yDu~EN1D3>UiD*$eoUZa2!_ak*uo^8ejMjhj&{(zIP25cQ1>p45?5vK!}B@ zsoMGy`F(R-Zc&!AOpk$c_GcIOowp<(%cEK$79l4?C%d$kvR^D36%9<7LtQuTTpFM2 ze)dsHV)&Onc)E^65I;*YD`G_#U9ejB?f<8@EhO}5Y~&QnEsOH-LsqByTZ%>_LDqf3 z$TJJ$=VtaO!0+X=f0i(Fk<{^y+=lB`M(c)O56721wasJ)@^Qqq%GJp*MB~33#jL*9 z85#4>4aTlhl)qwA1^gs!e9#GW;`|Y}MW5$mbt`r9UdVfak1o5+UljxJ#`7F5UBpKM zFQDT#6OZu?)#*31<)e?E0;W17kpMrZmY3e~N=*$s!G|$Ex3=N*Z25d#n^^iHDY;a$ z{EOec%qmKr%Q^Q{>qD7Lc3H(M4e5RyFC`(mfKftnBd_@Sm;QVJ?jLu1$IR!WOihh? zfxWv%V?CBEJqHYIUq93qL#F51?N@>DIlnd$P4TeVcdw*eQQU?TI2@Wyr-VJ)k5%kV zN7_!F>k}544%bp%1}^t*)#(rKm&aa_=ll%+=v-w;Yih(w9M$Q&Y|PzRTk)7)VT%uG zd8+Cz6}3&nGK;Turv1izDC>?OUg~~r1ojjuOj2ygI<9F1vWqoR!j6-_;gG- zXRLEABMO_>Y<-5C9^_`8pK1M+di3%FbG~+&ZONQz2eB%g1e@U1Gx?QRxidcRtxIqvwQi`!L{l;55+7?L%$ez3v(DLrb`s$B;i$z<|Oqf zVkrizE24FjmX$l3a}@;$^YpwB8#g+*eG`!pgbB7`tx#&nv!+se>AqXuVLAON$6xfG zJ~o9W#zZxDti6nFdq5uV7h@YoUIx^rQ=6h?;`>NtGJqw7vv*3O!jW=0DeOqfQ4|nF zx#nN-cp$!No~N~xk!B%4p>h2Fa2ypD++*Uc;j6MgJg7jjI* zjd*htuB%CsG}Q>oBGHY+=cUt0k&Why%OH0%88o-SW`}q0ez8-p)@wO_&!5`MBL}HzkY_Me!l}BfRQaZOG)BCw!Odgb;FzMYdf*H+Dlr& z^ST+ay9V}oKcBucCYUo6FDLZQ6C9`N$EO^O4pCNvL1f9gr?XzZ_Dp@EC%CuB_Kgn9R<1h(d&@t;=<89;+4@2Vve^YlTV zHPBX9fu`hRtm4ssfEF^R(v}c;O*oIwQ<%}6tyCpPDp&ec*8!=fW3(<$8ln09>0(xF z%4}hdS+GF&cKU@K*w4iSf}|@Lp(sA^v9U8yJjFzwK2}bJhexB10n;i5FIPL2G|)RA zR5ZHvFo9DzAj3nCJB2`V?wZzpJD;IC=)-)@`-)e=ADhbvsF3@Fr_fL?Gkq2eEE&u^ z>Bbk^?jl|W;Qm%pr#C7~3QcTd&^bR;JB%hz)?1TeUXk^kY+UKqIRJ6>X!)Lg7RdJo z35~RQm+sOhn=HJA1UNhrvoqleI?@QEHKGH)U=y|&%{v1+QAd4AuncrZ?IZFWem}$= z41EiFUcNUWBAJwA!Xz$Jk@7 zBK=E~fYdkHjN*w!+4g`E=PRLrv5AV|;*hqg(|ZT+>1q}|>#;7?o;;OytvSvdsgEG2 zO`MuaNv{}~+at8s1Zh4ydbfJlVV)*IR9vBe7Oiovjxjb@yEwyhyB@(44KgW@n1D6< z*m^|%5%4oFkF_wZK6W}dTsv|i7FecuJShId@;Y5V%5dlP&t6Fo+DbtJ;?Kux#yswr z*@hfD4Lzt&8{~rILh)2*YMv_=z|58n8-L;r4t?XdOuqW$$q6q#(I}=S*3gu_KTIP@ zfSrje71_Gr?#80=wu2AdJ4W`Ik^Q|nCgb?~>&WxRGEd@CbVnUL<;Y1Gg|(BMX5^yt z4W>0e>3cPtpTUP>HX7`(7=vUQ@+7BVsiuvMg_R$8<@WtsjPhm_|A;<8*N1SoYkfsD z;&p;)98X@1A;@ks>fD<}?f0k`jv}b-#2(FIPhS*2>|}pCZA`-5F8~U%8)bpvW5FL;oROoi&_TF`M#Dqtm|K**#5}|9q?NYRU2O_IZ+#%3y z;gJ#4fM>&PGqU_icM3U>28t?)&Dxva6JBBU3jF(TW3R+<4D<+^M#pryE8JO%@@@@2 z*sc8ZXSuBq6^$dk5f((Vt;7>oAhW9+%rDe1GJXAc$BF5|7QgMWr!j@;S*iuq)~55M1XS ze`U`r#P&`Mw~v!k{*NDV+Om27mA5&jB+SdGj~prX_UFe-K|2+^)y_5)-Cs$OQ0J&M zttM{ka%zP|FAm0Yn&{H;A8s>q0dFgdy&RY#cVJyVyJVhnyKvn114pd^yfYoXA}og& zVr<~Hn|MA|Ie5f+$)cwRsE`Ucn$4uR z6lAIro?>Ds?V4MvyBH`x<+BqHMx${F|KJKQ1NpI#5?5e!{p_x}+|128jCqPe3Eu46 zIrwUj6d-+3nS0@Nx%arfbLc<98Z9B3-#RGPI6y;vaiS`CJ~>u$r|dg8_y8zM+DMv7 zBf{AWa~h3Q+EN?s3IoE-Zg^Mj9$M|2nO1)WvUBM?PMTw&+pA&2?njQyxsJC}n8#QY z#j4m?b?jZs2j|w{#BTB@!AGG|rTX6?9$8ruNY~F+k5q|U;t!L;)A(ktm_H0U;`emI z{W(X1Lb#iq?TP-lU8`?wQ;8aW)|d+SjNE#JONC~DpM~|?%(-5fZFsCar*f0vc_eeP zL;K83&DH3Wl#~I(@X$Q}cS)+sVP$JeJs-eo)xhNs{R=&xd>RC?TXrzPyzitaC}ING zR|g-ijVXj2&HNa*v3xx?v%;7P(r^M2Eq-`df~ZLOa60`od5zgehT&l}XC+D+KJ`Sm zETCQx@vd9>fws_^VqOo{f+AR);ONU(3zlP@YUe`b$Jijqa&CpDyZeQK4v_EDy__DR z`5qjDQKwr#wWEH%t=Gm#$+@-=ed&2e^EeP+8m&zCM^P?XDy!{Nav!@b@=u$=hZ6yn zKqW;xNq|C!z$r!W8?=GK#7}Lt4CHnr$DwTiDXOrgCj*@3n=L_x%GPCrav{F;P4%XY zC32v>_r7NUlD~2 zZC7MQwhi(xvv(jZS)`Jf-7ChzniWNWDZyxP)(uP zPQ<6N`_8Osqi1B{?rBiB90J~opTEc!*(W$I%~Jn--TAcAey8t5Ae6T9GbEm$%)^`x z*85m$hL>uq3w)n|-*;4J({gy!BmAX|pEAtI@O~H6u!ys{7ukM`rD_8msP%R+QEY4D zz~_z3p{*_kROe{lCh)bdZ&Gt}@^V1L*XWLkWNT@J)N-J0$$b6SWLA~6;_Zir=+*@} zqTM(oB(5F6{`>PcEw@_AH;e^0;LGs2qaY}Yq6nlY%)M4mM)nPxuD9pyqj}C8dnKo0 zBikt?dqAdP$ADMLJz=o6RLc-V%oKLflBjw`lIg^ipb@ESWO#pFgG)eL7+ zOks25ek-%UDQg)A=Q*G_%A?3ipqEXd=J}Kikw-nkTi-2qjmU$ls|7)oBL%18vn~2i zS`1~s(|3Ni43?DT^#nLV)<%aNRoLaVQM8@&n>GhKYmd`3m7~0E1&I`V-=#5DjU?V| zf((0V;k6Yy!!87hJQBV~&xabvgC(%wy~bS4WEx_fuhdd#Qc`||4Hyg(#fC3omu2H$ zWaF3Jl)ro)qKXZ;cCG27@c0~yffeBQIMwrgv_dqVNG2IlUN2*W`_y}snBBteLmvqe z110Ik^V_0wlgd)0Wb}FNNjB>*eCZ%y>5Pvp<*9z-<2dGw9#?{ z5;GkV)rT$^skW(@yoljbD-<=>Q6mU(Zlfp7?q(jQFtEUVMLTMx4oQ59_)h*f!Y2;~3~GFrMeK(L!UB_H)$J33?TI_03X=IdXdv zBZ?(SpX99oQp9F-+3nD8(mpaRsjxk)a_DuLkF6cu>LrOF)=iI_j$>z~Q-5BU(3V08 zHo%_Wt7i?OYe|U=OtPQ27k^)S%#-Bl!iNA3Eixp?ooHg)%?ue5&5$mk3xu=i1!o@H zK>_)l+UY2-S_%{UqB0LsoB z`lmt{N@zJo#a6bZwFQ^o+n915QRI@HZ%HCdYbFsR^WYB$w?6=p5;|M|S!IR=I1F?6 z;Adyx+#2u1`@CX0BD7#BAO$sofhHHC1v5>dF1lO00{R_@PqK$bpF|r^UuF$f-H=}PxHd2cQAXli|E-F&&Vcshqw0MD zxHBGh;qLcYF$pWSVb}N`P4bs-)l(-!5YW#^@5q@s-l*vCr>sJMP=?YNB!qi#mA~9O z*%`yQ)4EetGQvspe)vEGQO33lQc$(Sk+}cmVInBhk_&K@J*uWJ=*PP?me%T2eT7W? zTgH3%s_noO|HO3k#=OCfMvuE73kuG zYKoRXaKrqCRD2(3OfV`NSkX>Cy1yN5B`oMqxb5-m*sdE3h~D+X8j%^X>z4Vx%kI(G z+LmywCuq^K*z*X>uI6aL5bP0TZ;?Vp?!7alY4^xJO4*EH#rpTPe)8b6MRq+G2@Yef zywj)Djl0MX(apPu{}y~)6Pwnx-GoFOHQ8=IHhrFR+6nz!0=fD#+*6xK=K?VikKP?K zWZD`^O}G??CH}+t;J^EH|A$aaca3q~`yVhd&tlKKX6_%z7+si|_kZUIy#CEhm@fjg zj=BF|L8Aw_ULGUP7_ZpjM6S6KGKgxb#^niA(v_pV6TZ3Nn{k zh2FUR&N6xB-JxaOiu)szF<_SWn$N1pn@|+LX4laAne{4u@1dy=mzoI<&9~TQ)jo2d zxhH|=3o7tbzA$k6RaX_*DR8rFr-Hu8#IY&s5}zT?Gp0iFneVka_;$1ZmcS;@sB8dx zJqOlJoq<A)@-w{L-zLd}J@ ztdKLkkb^c)lTUx7yt3Rm*s4|?I_{1iIywow)6RFccY}Af4*bu~h@OrH0^yv5;GV<| zks`fd&9J7utH0ZwG_16z*Yh|1_E(V?ZxE#uhy&xq4kv;`VZO)dXFxY~RrzyWwQX02 zg87T_r_$Bz@Etd7{`)WTUG2^qcrQ-AW{|s=Bw*^6{trUGHsM&K%4TFYg&2v`qb(%_ z&(Y(?g1t)kQs}@4<8=BE|fmItPnf96BI9$EJTr5b82BlCiiN`AM7W= z%okwb7<)Y;i^@;od;!Jm1{0QJCfPHyFw3RhzkIGpRrD#u4jMu;7Axvax2OIOPy9K4 zV>tG~{V>k{xXlao0aW{zVyZI~el5HSCw<&}k^Pfa{v+*Mk{b*n72F=P27GnrU!r24 zUU8O_-`)pIUyN}vHPrW!?RBzDN+Z9*9vk8 zQZSy9_YbrqBQ(ykaJcZmpx%!kbxv?R7u@bFjT#RoeoG4GgC*16-!r*DMx=ZAsAkxm zfV3SZK;vBA?n|dRef7Jj^ZqZ)9?~EYA<_*dfW1*?qPh^N1?hFli7_rxpXZj5*g4`* z#d=9QIN7eK>oBtKyv?2J*vuQfSs=B$K_SeqiU>C%@jZ>jXO*-;)_W4^1u(~u9?-Tv z&D->zY~eO7HrAi}(y`@S8|gZ#8#7M=Q%t7 zmodctX|K<_HN<|nhD@+$q|=z;A&YCdt2C7B8|IdEo}uiEN{cexB@a9~Y1yp4 zP5|AGYR0xU;#J3|YK1+)nzwVE4N`qx*5A#pJdMdmJIuHbkBAfonM@#0%u5w6y0rs) zTPBUDtc)%dhm3o&>Wu~MZN#HQWuNpWlRGCVlP%C3hx>?8x~zwmHi>pbGv%ERsF;=iWxEkNEV4Z zlhjgHED6dt%eMh5uI}%|+jSGJ>8=r&p1<6y?wyvtDH>7=_UsGzN~*B{d=+#s$;!uk{qXek zX3(q7w-01v&EEhKLD-8Ifww z3v#qIgDwD2G0CP@M3>JOW8rdkwOcat^ozJn;AoNHCfwx%6M}KN)Olu9uR%-uv2DID zk{*ULrf8rR11+=T!3uFC!482Uw>~*fBOiWG1N@^2Lns^c*%Sjqq&XXRh&agNS+qLa zMp;L>=ffO{lcapJD;W+a3XN& zFtY8Q+=IT27CeEFn(yS z{I>;3bOD>0&#{<@S0TdWm3srSQ}Skt@8utjCpoI%>iP5t|1O>VPpZWr~ni~xLs zAL#Um(zDWswGX3bxZpSHD12T(BRk6y5`bWC`*i7F-7H>1<8U+ggK^aI zwe)DJ^0N~&ID!mAl6Xm&x$fOW*J(A!h z2E6Ip&Pfdf^3ie?r#7$cdGA=g+=bjJZB?b}zj#&DQSuT0mKrVo|Cw-s?f_fW4ZO zl)Q9BOW>;Q?()Y0A@tu!HH?r;d1hQfbg5Cdm@U#Va2Hb{ceqb&^aP^tg}@|K71l7lrYta+0lCJ1NcU5$9VCS<+%v{;}f`a=1RjQuG9kJ_%Qk_{8UZ?A7MJr|cuz^<5DMt; zuP~f)UU;d(Aqy}8u@_%gzEkb9vn&gOK9s%VrWtA> z^pE&{!Gx7_3eW}ZW<@wK95NF+cl|bZW70?qJxi^G0?;TDr*{6mtQuTZ*q6gSqgNbH z-j{FE@Y%~Dyvy#6LYGEpdr(u5Bi4|j;%{Nh6e+sz*~W;~Y%c0|(bkgM3L>x_2nfn#rbwc-CE*_QGEDt}HoK^eQsUgP zm=?w@SH#y&mH|w|Q<>dp$K(ptxOk)|2$kABGZ>4g&9iI*a-9mb*79Q6*ZL*<+&;Vb zj8`eXp?ExG8{OUJbudmW4MX_Pr{3Tpg0Qjras}_*{lo}(l%`4Dj};n^VuqDxX|d0A zlZ!#*!oq}P&333f1u2^a*;DqqRi8nQ>`Nh{4v+Vl8lhP39wz*7Ifk1xf&a3)Y#Eqk zNeYnqXpFMM!_u|1Vh02*RN881jDzi=WMQx!#kt$iXd850?aTmfj@{_nE6$aCX+^R& zJ33|A(tn8o-Y^A8^bkzEduV|mHhb!QEObTb8Up>gwgwcR5uw}RJ544EhXdfXRZbIS zUY~`sGQ)3qO>=`iIz(|&m#6gP``1njmHvLvX-IkdXvwqGV)UDnpth>c;*IZ6$0AhJ zAQ^Gdc410Pk%5QqCE#n8u8tWciV_naPGnc!oP&+I4a#B!y5D!RghyS7f5BY8Cv$52 zlzqYpr4~rp8+WK$1VeH0k8iCcrE+m491c1}Js)i~+=kwi3#tV^FYMe|Dq!;g7pQ{` zo3Br)=KF<`Uef0UiLjxh*m^hj&t?)mk(ZK0eK)GJbMbqn%ptE|Z(763rw3%la>-2A zgg9tpy5+^vwvIwB1sJ#F53eZEiXjlpqNuM~llIg2DgT+>#+4UWKT>U%31i z%kq6g!bL`pf<5NvPFd_A@7)c!(~&F5-$x+KZD{$2N|2(vu39*+?WrX@N%G2c*!9)l zBP)(`%%wl6lAG$hvJ25(Kv}Ng_wFK(r3#z@28F*xT7l*g6gj-BVrF-h-kTgGf ztRBq1d}^!ClPcLH>C*b$UaPALXsBT{?^?T^rP#?V7t-;+^hEwanoiF) z%O`#2XXlD9d5xw*OP2I8ypCc?I`)uoYoj%K!957KJSZ9y#hdtHQtT4TzKfHvccU$( z$&i!zzEyW^v_5L)3DjUlN1^A6Hv|lLu4ci#Ws=+NHC8hY2(a9LCLb*mxAkDgI%fVx zi-`#=F=NXVgZ3A-cc4#shLu8c5&*hJPIX$!3e072SA~31H~iv=>FP*YA8oY9e=M{? zU$S-E-3(P$>VkWM?#1BsQ|mENnc)begXEbeb7SMgAG>NlG)iwRfRetEQ4=NYFUh?A zWvIlu0tpEfFO!s#3}%OBN(kJK55tY2Pt=n^%n<40d>8H<2Bv5g%Ix}^A*YL;qXV3o zoKRfEFEi)fqq5iu`i3qlt!E%t+iBK9U%fM+dMLLITFsD@Me&Hrq<(IKjJzpc0Z%1UGt~_>?#^O_PSK$g@-vYG^Uui%^d^udB(J z7qTk{M$Y}S>?st!r?fSp?A_#=b8&TB&Kl}S^;GWG)oswHV9+Ta{p-^o39p2)0xe{` zj2$)|3&ZLd>oBsJgaXfiGF5y(0x#)wQm(Q4j;vF7I|RWi<$ik$Yg0jo{{MO2&&5WE zoQ16EqYSk`d>+aAb_hHrXJEYw`NBp>I`JRRg0N5bV}ssf&ckayZP>(q^85z)*BMmz zG`MHl`&vk!wd8P?USHiIOitHZMrP%e5aqB+s_lR~q%_Low#}#5d~Zf3$JhrBy8|jb`_65%l6Ap@m~R} z`T0aoaf>fwt25m2ie|_m(UA6;VQr-13T zE}QIc?Q`GY8*==!u+|QtaBL6VQ$A(zgkmL}JI}CY>IiF0=qf!QIf|KikT^CQsAfS9U-t zu0m6E5?qI>FaubKTosb0sq|)1t7EiY{@Izp7Bhn{nx9;|nFw;LU29Y8a#N zVo2UGd`Ng9Dn9ew$Mp3m^hf0N7`ucG#WA1BvL*YayU{~3rE2V<%d*6p&zGt=@L$YB z&Guf%LeDRB{Kzezr{^%uR%@UqT7hn}rsLAq-ToSS{3^^)x5;yu`hdo;)3t^#(DwEC zjjv%UoUlm$9j2{Dje?|<)gq=1;|$E2DApq;{fJ zEwmZ^pn?BqeQYeNnLt}Tf(~%T2HwXJXKd8aEP#ikW%-0jWA9|@^0VQYxnA#i*zu?8 zs>CX@^BB{EMK#upOLI|2<8?g2)W*x%>NCBU)6(M@igFh^*2dHu#@0if1>AB`o9{hE z=|KzR*4yH2@7-#e`UKZ#^Ku&BW}K4vM~KmBIS%XKFeaC@{lS`Lwno>yG3l7W6BGtm z@lBQK_&Di#N^KA+4*g;PY)nOwTI^Tb^j2@=Gr1%y$DAI=wh~YX*{DGIy;{;WW*dT8P(;u(Q~1u5LFmgt*p0cz8%6xJX2M zS0)Qdrx;ZzWhu!E-$a;|iHD!?ASzW;uO?lO|9E{YZzJE>+6ZI?vIj!4EU|B5iKI!> zs;(mPsa!DfQOwNDqF61yl+@EQ0X8@yRXSr<`xy+g7%+Ef?kBwx&XXZpG<`MN#R8T3 zD~>~?Y}XqzZvZwa23d0h=Yw{KM09Y*F3jPNJaJsOWgR8 zgba+1DsbC0CWcXzGXP%IRA#8-{3L#`9*_oNH*V9UY;JEGhwZ{78*{)^p(ZQaUUl{K zk1~roYCQ^}SAkbmU^A2hv*bNKGQHYv7XgWSvs6H1esbxKwg6X6ED+hajia;8a@VHM zJHps#+xULrTZg*ilebV2;8f4MpGz&RioB_T+Mhc8n6t%rnR%JKi;E>msTi^Om3p;1 zD5L>zmINc_vakM&-?Cy}qj2=SIf>yAc2aIKayD#JI2|#dCXyCywF3<)VCO=U0$J>V1T^JNFetPx zFNhp;Ts~d8!repTFyQ}j*-1@m`KC`u6}DAPHd)o^xLOTz9JQ0%0(J?>u7ffXv`tCQ zIP7ZcdfznVY)uS%1fC`jDxPYW?(iv>aa;RoT3{w*Fv`94&9=Vv%D-wH#TpT4Nx#!^a@2Gi-=b^~mT`=SL5g*FpWN&2J?lT$VW8|W z|J%mW7xQk|%aP_ZZ+-S3EE|;7NZv;7(LEsE)7eGQXxX`qBX%YuKhGV#PqAHoRlrUC z#gM4K*EmaYCW5wK#sF9~c+24_HP=y#Xe&yIT zCiVS-3lP}X8fD*yOX?sX=*#T^p-UE?h5$;$6B@T{fryDh43M9QIwVe&r})D<)h_Tg zZN%O2Kxro++=a3WqAD)STs4`8j$m8aHXTt(2Bhe()@87}b@42pPpTcu?F4_uP5H~9 zHp83C3NUbK5g%kUS^v+&U5_gHc&x|cD$Yd4nY(@W-(CUbgJC}d^aT3vl~AVb+Q{A! zrjig`0JF<2M@0~--riOqs}1Q_*zf$26L6LYT{5kPs-A)<-hKh&q(-u5WHDfn;b^=- zFT6C$65EO2l|v*gUMOLu;Tms$RirdiRiltmc9(KO7W2}moxvEyfxXLJmRSEI|@-nsPUKkIB-ugi;4rsu(Yrh~ykkN`=_6&kz_TTd?~py_`R_m9za zzF+t++BQ~W8*P#XD=W6mCTVQjUQuJ)jcqozZQHhuz54zA_jz^38Rx|wW4}$FWF^n7 zdChsv&kc}z{$^7jFv~KWX&`&O`%VgO09Ec{PA*JEpGm|=+{1~`^0rZN(o$+&GEvUk z4kgV#oLoX?K{OB%TAcrb-gXPOGP^c5G;4)%zyR8h*bY&j-9hfMd)l5hz?tE|A?JM3 zEnl_hCP4IZjHd3 zp6=g?f?d#6gKG5q&jdNOxt35E8V4mR`A`@Zzjzwk030%-CCCn{f{^Ho3!d172k3X8 z4_Cj-y`UGzn$rk+Qdh?ow=GM+)Ob78ikUd5gK~@arIv)?q{yJ9#l9oY4{Xy7vk=?3@~X7{xUa-W~l> z)?J>K>ufw@e?eQc3v*CzW~`9h}7|oG$wb4_x}kS71nP>y6AAIBy`6_6#A^5-}%)dKFuZ3@$yJSkM*CD9U&= zO=}X3;!9F;aNVaR8M6Gio{_%xyv1>nt}a03-^j*B0k`n6EH2p*8A7^%|o zMTfmioc>1T&K{Va&KMc$3V0%7BZJ(p{u8Hd1LC~W^4QwbFC8`}f%c2n0(-E-uhP+g=fA(`0fdmbDx@5awjk;>*^Kb)Tu)fN%X zp`H7UMCu(ycmn^#%|(y5OTG$!!kR|tcuhYub$gS3^lv6@Dw17GTWnGxvBq8aEYCYW zxTfMi;j+7v`qUPKvKJC{jw@&|AW$yZ-p&ejF?Q-J94L3ZALR##P>h?lTYM+BnHZS- zdMj&|HpWE`A2oIw`fkU2IK=Kr=6T7DR3-P%d5gfwlunW$dp#l@I_zwY;m544!t{0=mO^a95|R z&h0V&sB^9S7v^-Qb-NdSX*{$*JvgsR1Y7yII@rHHOnmOsQXoAeJY!_UF4{=0rWE^w z5reDgYm8aLUz^3mU$ZZJBo4c-Z*`l3oUeOmFie{ew`qy~=JmASMWmYxf^he zj9D=LzTI#0wWf96wyL3fUMz?#v45`MU_f`T>q~r9yVvd4hka!|NT_YFX)L<8_Tu%J zfw!Fu6`~ntlm324#1o=e{`6P+pW!Z|M$6S*U9oxo z&J=N^o^H@5L+ly$oX0a+nqCf1GBZc4>Wckg@xZbm&3^om8_%nE1?D|vT^nP}FFXX* zE*7ZWfsaA9Cf z(+)6{^sjoz=N4P5&9H;v$R->tRv=Gnk8U1Osp!L;=3Gw{ zjf&IT?$)%+tHKIfxPh##HRm8w3^k{=mBs0fvl!b#^JpQ5S>Y(I-1+_W#<>@ln-qCp zNq_2G@N}3;48G44so@ACcJULNlflaQsQqb{l9xx0p<3kh$^DIk^4|IwV?O4bE>jyD z9C_(GqmLBm4zcB&fs!Z#VTQ`X4kH_%kL&lBK$RoA4$PHpkI>f!j7?bq>)U55;Le#= zQ5Izbpc1}~jGG~ta)%KVxp6+cL!lH>o_0xNIvQT6>j-Zze?}o?3*$gj9iyKnD<`+z z+V}&Lur-|_F|NyG#lGrC6V8h16yRV(l@B}I=#4Koi8FfJbL9XgdcraBab)}(k5D!CHe$QbdpU(Nu-bCQt_J~ZFoiHrsM52F@!XzQ#-3WwG6 z{30vk)QmMA6q`x@!Gg_npx1^GqEMm z3H$fA_HimdzL@a?YQ@6Y?q^1{YGMv>L|Buoni=z@Bg~#~Pa_Dp?8{qH0{bK*U7G%G zgh5YQ5b&M2X`dRo6Y_ZnuNt-hS~Si3qwB=TWU~FTpHUeGhwonpy>-dbK{QEU}(4a^jyt1u3d#`#tk#KhsIPh z`E&fW!PdjjZdIg;IIerGD#oc2%TH=KZqLm~Ch*vVgRO_-!=sTEJ;;6LZVEp~(q1iG z$IxV2kmn-FVIiap>xB3f#QAY39UvQ zc>pQ_<78#@AVK;c@Y_6+u04~{%zG`nvx^ZnU|e_TbpBC0m<6N~L~1L1jyR3p-1*ah&cOx4&%9P_jyhUAxp-MC)qufh`` zp4Kf(F75|Jw<<2;uHHhK75~^vKZ`BT!ve%p@!cBE*_P<;5*x48B1e*A94XQ~uqoQ( z$C63DdG;vAcqKW`SC?p6iFTY^<9} zDlUg!J@>iqjL6rhILFvadgiC0skBS+M7-{{NN>}6yRz}+@vx%NFVJ@7Dsp9~ z^>1h~Gb*WtgW%Crjw#(jsU%i#&ZxyTY;{KPO-k^|l{9x6ds&uW{Jjo%kKEzDZy7Ni z(~56MX^wcs6acsJy^T7+*r4~=YxQ}dVJf|FTT#Bc{zLo_nj=Y$e65J8*hsstQn>j% zzj$BiGb4EG%1V6*;y9($(Nw~JgivnKttfWm9u%A=)ly{W=}P=0w_2j4@vqU@7I&8* z7-@w}38LWffj+o$21av^(1+M875Eytg?lMj_1OCM0i2af zj?iED5Ma)pAcU@_%7_|w&j?*FC_{Z$AFplvC?iSBRcty0%$%9^xMZ%B@n6PZ+X4reT8Uk1yrZy&n`yGOO>P!YXyt91 z=h+=XVyAe}2!0gb81^J9l+0z3zA0NLRdsZdlLlFFwQC6p{puA4x3_7$yXgah6MoD$ zswM`CyxRzu8UBU2Yk*CS$=q@ZQ|3~v{V1CJARHX-*_b2xurMSDBcTCI=OFiHp+zZF zguJ81Bszwl)S+qmKULO)sZ==dlsAbiV9wfhCiVZIYNpHKtlEWh|2#{gH*!M%FX7bw zzaZYs+^Z|iAcv1-SAU%NfRSpU-g2S=Pmdb{PCXk*N&k`IK0bl-_|&&@If3yq^pNV1cd*Nd`ZiNL$sf4(5!m{lW9uns zvR?nfFbscv1L44-y;mmlObqN5SRH?Xf3tqUUCMU?pUTW`^EGpr3%6moY zB=Z6LvvPr9xmB61bq7l06nmqmpqTU#diZE4=Pt(lWfrD2&c^2?@Ijm9N_;w4#$Olg zpafCyHL^2e$AF>T1ZCd-db&-kB%}wd%$xgTmy-e?tgaEsw(09I4f`0*F`gUj>+89Zr|R^&rN)DLW)PL6l5YU) zQx(<}@aqiB1mL5EAT`_$xZ^Wclh$F-SRWTcdMZqOnq_6)PRUf*+|>O5qq#bMcRm219rqz%i#cMG&%7>W@+zNErJ8f|3RM*9&a{I~DbyXTd z_q^&ScM~lX94Wo4r!ku&ob%^XtE%()_Y$Hg;P}H$>?byuGR|MU<-LYf|64N1TQ=zK z8t}TfZD-&nix8opFuNu97a%Y2CtaAzJZo-K6RzHRB)fuUnAL47TgYOVv3iQXqVoJ2 zVL9*-tiBghHz;=e>Tq36ywKX!{)Dp48+QAw-%h>4hlkw!R{4#P!3p?!(B6t!>awS| z$6KJH6eWs>`H(h;s)C3lHgMu4Z01Hd4`xBk*_>ugt{8NcAch~JK}Jy_YqG@ZS!??E zndK*6Z9)?a77KHnRBd+CtJ-HpkGCW+65SgoY+V%-+HH!%Ip-&uRsQE?{GfVgRjMg4 z#a3pSiL?2Xb`~A00tJIl#Gpgu;#}3|1YRClVTALmQ^W=@L0>S8cb=O}z2Mqh-SI_p zOpwGhFc#)|hSu?T<+W8EH25?{<-DYQGn>n-O$;L5mYl?sjJyJs9v~(`wmB$K;SW6t z#OF*Qj5BhQm;ELS_kFj#U5(KiJm{B(L{0fhRrZVnPIW>`GHs0fcuSVqL|>D6*bx^H zqk7v<%{`iUkZW0MC;t&4_lXBKN~Fz|wBJmwZ^t+*qc8eWFdJ{1%3Zeym|IzMPwa&F zQO3Z3zfk__Pm^{D!1M?v47|nF=`Cby6DRsj#;Si17P0Xn7BgD|$@<1;Z45J~xQwUo z&BuYp9<9_6I^#!HjNeW9x!I{dBe)!F;q`YMypT&yjwFly4nk1hE#MB(kdM+OW>fmA zQEF_-t>ABwvF^`-P`_1>)Sx%hg@$?Yh~)9l`#JS0#BQZ;BX{Louwcb6hEKo!^e4vR zGSZ%j*v_d|)JO{*?2_h!zJvDA!LtUT?n2hz zq>9GbC{f=ylfRb|YJ2V|M0$iMKPdESt6$Ty)dXdm9BjXZ5JEZCD^#W;QUxKp$OaF% z#cfaKh7q&!Fnu9fk37UU4(t_2rhEMN-#m#;-Mj3hn&qUX%4>$D>FF7~}bIf^tn7DX}hw2OivSs+s#tY;3lT7jkIn$mAG2qDy+3xAoR0#5V)oraxYGN}e_Vgu>++Aw32 z>w|q)TS}%8$Li(zUWzeUi;u%e>SM@sK?RqJ=G91Ax`sDQ*|M{8|^W4|$3cTwe zH)_9^KT~H*7ItYWhmacqy$mX?MJNAlH~X1g;J~KdU*F2aB*J7|uJh%DvHECm=}PKei+e&dpqnuD2Yv zl)hczBmQSfermX6D>lX_Av=+-e7hWEFQ0RzA3{b=eQiuENO{ z&ZVsre0TEilXp=`ae^PmrxYGtt{+TYNi~TxRpw#!`I9!TrWEHH%U2!fuh0&-cz;l~ zcY?_$A_W^@|F=kP_#F~A(7wZLj}R%*PS&_ZNS4J znZb#YO)vb;jMRt(2}CNC=;=Y1B|v6`=eCtb>cfc6llFu`zgL&fK-r_(J^nV?i)C_$ z(X;cb^}t)AIHwavT>;i&GuP%Igdb3^%lTA-&V+y{?lCrE7ohjeO+o|3&Zu=KXYdjJ ziC*tphF`fE@rqbJr4i${hQ1o0I4oZ2+L?JEsnK3@I?m%8kB=UYM|#yw2I-;O#gBN5 zxlhdM;hfZYr_G^{L$5!tbIx8H;&ghb!Feoh{8{8gRf1fj_@yuK zyQ9V$KU#XIeiR9sM$=dmpd+#MYc$djBQzL)kP(rAXgA`poqg~FzH>CdgBx`_`!3G= z-h29R)@fjwUIMbp3Q!w7JW+Z$UH?kgKbp#5_07O%zmFf{Z$*SIgMKki+`S;oUf*dk zp`mVBRWhH0sfG$n<+dldQ(zZoSFGpLqoq-^1T2#9YFWA6TQU_m&=Ap9BV0G)3O_*$ zK4_OxCNmX6P2-_Ltfb|E#|DVCx_bFee?+Nff(srD-oKc!&PMxO+~KdT9)j$a^4M>q z?(^!^xA?+hVIx{5G$*qg$In=+uYI3quUq(D zl%Hv%`)3X`94^=HHUB#}ZYUX=46LB~hIx9S)V|#<_QDa#8r#fDLx`|YPow8HKktBj zU?|v|p<&R0KMJkY6-b;7mxqrHoP%a`?CW5+hU&d3!0En5*RU^0yqt9sE6@x=MKrPby3 zFtaAh4`^_Yy>vz;N$A*Fs#_b%@ln~f=U=9%FDt$;x3oSR* zn>qB4hu1{l#?G%R)3`QT^9WR>eMrm%&4En@?&`R_t7!q)OY?e`*c$g?>6J_c_Xzze zT=v!H;=mo3fUph(tg~Se(h-ukWC?>kP-q=kym)w|RUg%VUhJ`#+>krm4$`0;CniPS2rUnon-=ihdl-m7G@>l*wryRw8fp}asQAejCqX7CaPj*qGJrQ6 z6Qg#8m+LqF;TX&d2l?sbp3xSeaqtT+2;#oMJ%v?WB~M2d&YH`d?a?3|xq$6R+O&+;5L*qNBcj}B+u_aE zYA{F7fus_C4{09u-m&{fVpF(htED%oLYVo_g-&M^uEi{Xwf>U9nF3pH-Q>lN zD}oKEPq4%XbgAe^O>}t2ewkv5J(DCK2uz4?*QjHKC{FbJr&#}dgx06?PzPIZEWI=- zbkaf&^V825PZ?NZ0Or@B>oC~GV6c2Lwv`mO<6%5Gc;4FOGbAa5xfP|3rThJI>Fx@l zGU}y+wjPX?bBY_)%ZY+r6CD2LGCVR~*nxe$7C)1(al9Af{A#8-HJ|T!(>4GY2>ahi zfr0wQnij@tzFL-c?3wHBw8czFY$h7N=H|jOa{BtA+j`dQ`l4;6FVOwv8WdDVj<2Tr znMa9me2#j^ZAnV~Gn@%ayU-Y8TXK2Y*Oe@=rXd7mGaPn<6}Ifr2xmBRc7OLGxQXJb}JOE!AX(Tpi% z=g81+d)T~D{G~<~jW-}LzT6GBwYi=s%ZL0;*T%vRO)Xy+r|O(;{`G{eKam4aEGC4W z(MIwa{BihqN)eZrjz3GW7osBjMcxEe*~FmDjMWPm*{e>ciF_&0Pq%`H|EMbxjWT5# z72D`H;p7D$ag5x#&o}+@g3{}IOSo&iyLme#I1PomdC78zxrmFT{!ef4rYWtU$X;^X zj+3>W0mZqUZ?u*M*vJHR=Rf7!k)do)Y4fo{vw1q9EOb;sjeNx@`sN`}E8F@DBIXbp zzApH8#Oj{lEhHn!>y#f7)WK%3Mwn49u#g&6S@H`bq zYKsAosYvpdnw9W%Rfey@U>TD|=JLT-J}4C*FP=*0?bLYG(+vOI-30lETBVAL5$W^- z+`$7}A13jsJek?#wqPSTs8tm5 zu)+RP{rQms(?>!Wc%_z$k&51(1Lwe89Ljy>|3c{jGmUC&Zh}qFnw+Y`$R|y{Z$uE=o(y?^ ziN_1sXzT$*X|7qmJSNUfdKEeKK7v|N2ywm)dX9({_^2XuSQ8oJg>7ecdT0>*-3N*D zlP8wlgkV$VZ((olPLI_y+@cCpFz~rAkqcUPanttp=sZeJHIjswlADbSRf4cBp+Q}g zl)Hld_IrmmC>~@QkW_gQAsdsy{Sexb4MDx(kd>?NtR`qN@b~&W~ZZOt^M2 zRHh{Ax{Fi+PCF!+zv#r=*_ZT(<}KrAS+{OdU$W)O*r1*7ML13l4Oe_kDoz73)?V#4 zMy(rdh4UnWp%N(@iUNI2Ba-$Xgg)4b`|sqBA9^yrygu&Q_KJcw3-O_I5(9rHB#~>k zwF8=KWRYa(;-zV3F&9WWT0h5uAdA6R&_}A04EzXspf#CbRruDzg@azAbz4M84BBy+HVKdqar}sL<+zKJuI;YBB zXnhxlGpG8MsxVSCGG@Acnl1)#gXpug0zrL$K>Vfu#0~YrFZ(U@aBTSQxEygq+(s!J zs;Qvk#*`ZCf~L2M9dMf+)O4gu{i=0#)gMTkH^a4_tmJbO`vpkSkKf=O7hbk)-V4*D z$1U=sbM143cd9f@9GQhGDl^IYBL`GmobMFhG6J#naDQwY)Nw&o`AcYY&$IL))^Afj zlh!J3q!hQgAItPa8}Z74ZMc{PAf_fyS{G407T&c#e%f0^IE!8Q)!_~PdvCgm-@%MI zef9wE${eB#%TY$RjvW1(tD7JV96&dc5a%<=@4%Vy)gP@Nitx~skAK^F8z0XIsR|D| zJXLs`h28%~cqTmX9=x>;lgiQ+_boBopHi(8d${1JMbIVB)1ah((PVfomMO@$C5m%i z9d*VGEAa{JzQ1KOobtoIsm$10bgdPBTT55^3ZQh)!(7m(5NWn3;$o9)eV73n{v|M( zvW;;kUDwPEfUu0>4jd^q?PO16^Xm^=jc%a)`$fbu&gLGo=+bZTyUxXEpTLJRUzWlK#HG@F(66EmKFovRS0pAtH2!dp3Y zJ0)oxGq!%0PB6!RZgD}9c{llr%WX)iTcZ71<(TvdzDBOX2SL;Z(toGrBjb+E+{JM~vqiXvm$prL_+tu!J9(d01~Lp?vNK z)yZ`w-PhH0C$Zf^!IxC+#Y{CCz`yKwpn5b}w0GZT}hUt3!$kr)jvLBJ3mwhnyA;P(`(!5l~#j9RLkFEED-Y zGoe(Y`Uytj^NGbV8##3jN==(ah;Zyu>S_tCZc_1GFoHY%C2$P`1n-A*$UUFbQey&l zZPZu|j0C%-aCVa8=fpQqBt}?cGTZ7zuNk++*#)NKCeYT|zaPQY$g$?i%kGdzg8VlIwl_B(*P5#=rfz{g71ZoZ*sRb4THkVB!wr`d?AjE3Nm{`d<^|n z_&5yzC}hlA8OF;G+r(cOdj8Yke^_(Rh)c+Snie3#_LTTN9TM(E(s5u8j#esXb4#9Qite-M!bp4zC-PZLQ1ThR20glQY|g_G+HG|*IEL5`5W#B^ zBK?*M^v@B?gQ>v54cO9pt)gr}OR!h-{lc1Hw(g-U)*H~AqY;lCN|lozFc*yI+y`;s zs9=SDS zg8}W9bAei4*FK~G9!^Sq*|-Vi?@8McPPoalJd3+)SBvBaPJ$ESa;=XJ zKb}RONW!~G)(rvhZ^s(Yn`2<4R+37{k`VbUxdVhg_tg<5&(;1iqDLc8k;hIB7wHSs zLe~(M#syBWerQ=MCkq$>IH8@Kb=_=f3;7?QcP%zI!_sAyzo=;7?7$`aGGJ>@$;>rr z`@3AtjcvhU25N*{z2QutY1aw1Q}!aOfp{5P$qD||^zbjl{evyL^nNhowkR3$o=&I&$)%kI{TC)A^%wauOy zpM!u3`_jsG-Q1C?i@zX%?;CR#>g{luwQHbgRI8T?5fhhx&gqG96n65t6WGn<1z>~m zU?`>h`7^?;r~B%>OndN0d6$OeM}UL7u5M1p&`~Q zp#Gqfd{8Fj{$Rzv8ki4BJfZ*Ok!FgLqOJ3?G*7TQ3EQkE9S&+v@902a-C*VC36Oi% zmDK-at^1bWM4X8ggk9*;oy$icLNMd$2E7uW^ZtHHaXMC_P+7SK5KW$9`oaoacmk+qL{hi;ZsMN?iidU!gF02bt6)};v9|V+UC0Z|lx1$Q?-BYIP1p=} zGCW#kCT@oE#Yid>Ff9*Lu$0(JRH_o?i=q&OgyOCPJ64r`!>q4F5DxVr77c6D7dc8Pof2kro2B}gBxnYT+D(g0-8I+avsO?wQQ&G zxvHH_c!}J+k=yedM;vwroZ+%`u}BMZzPdBfL}#c(!c3g`+`Z5{VH$`{*%#>ivL zrU<%u@kSGf$SQ4cmcsuk-E(da!GZ=a09@QzCd{0_!c5kWMm?Ab!Rq=x3k7z2rMX_Hf`bEJ7E0Aa_=(d#fJH{F;0ES?Y zo+Uwm$jQP)=qkqLY+m*;h!+mW~9Ngl)V*wgMrk4z) zLrPt!kmyd%+tjH@MR@g?%VYOo=Dxrp^Qp5;@v|+I_?vg z<__v>jA7jZ(pXqPx^a~@*W;MW?ZyUll%i{Er$aT4oOr5fCvJpUz20K-{L6RJpJV$n z$hmo1g&iaB+|~7mS>%y^!EGPjzN>R%Ha=d$Qs~dQ#!DQUt;DRU(H&sm_8KvPiN-k& z1WOJ9{o16X_AmbejWn!L_{G3qb32ht`d3&y^)`nHwC@J3~DCTx^~p96rj%71rE<;~yZyvPa^e4H}EoNsi7r46%$ISyU`I<^VR4=#RZI zy9$gd6%)sP1R4c~i;xJ{!xsY#E_f`6;AGrN$NapK4jI~{%v29~BR(!}X_La6c&)r=-u`)VHKEM0WfA^9#k0NKBr`#&D|3#r4K#6akhax+Wu3LOaljA5UL&2v6-x=4Ra%cUA#o}% zwdq{adL2EgIy=Fiq8vuh>fr{y}|A7b%1xNp7fhsP9vXM#ItUCeC&Bfky&- zQH?4K0}t7m!EW)gWX{y(a(l-o6`mH{Ap25N46p{SUAX#B1J5MZmM$=~%4o9Ex`kWU5D95H!x@T6HZ`IR|?Kb?Tt5q-N(N&D-4^{ki ziSo+)NKg1*dkcErMfKoZK)B#Uq&Chv9Y0)3Yv`OT^`FBS%z$<12wGu!9&mdt5e_H! zmywE#E`#qv-2v+*uDhbHE_l#J7>g63+}#MY@8QJ-nu)tty#3Ftb(y1jFE zYD!!`BkUa4Kbl{Ko0`I=H$pQ ztfhm~KReyyYBDY3*r}ICzb!^hJq#9^D~*E$LnSh_>$kW|eosIGk}cSqIZN~z_QB2{ zVr6=29S=Y&)zyP;V2gY5y|S{+?iVvrehg(LdE#q0eKc!qzB?H5vdVauw6HMTa`7)~ z;qYv_(sD&z1;OcR0Bl=m6JZ%H#k8ZNE)qp;>(70C*-NxU%q0mAf9M45v%k z6CWw+yl=(RTx3foGYm5EmX@y+)AA~U1UI)0n8GW7>{zgV3gaQNrD>q^49V3W=uiPYe?(Td`bBL{pks%e(O>VO6Vn2{U-DaZoQJ&TsXx&&K^)y<9BRIV2Ci zu_-c?nx|ILH^G*EP11KXA-+@W1m~4>&tlLBhKqB=Sqx^X8NXeQNq6}BwsYho;zuQP zPs|ClZ9k~Wv$U?IU3NzeL}#i**gWiQy{>m1D>ZDK)Bju;(g4?Ho;n$N6(27&9ASgh zpy!;w%&ZOHr_3|KqOOm-nqKMM9cw)~bp^Zfwbpz`ntAcpeXE9Fz1w%LbM(H7wpGg1 zm7@e55hdSrS)b~14J&{kl-wO8sqsuz!591pNl4IXuSJL4B!im?ThwblES;e3%~aDx zgtBA%2e|NSW@Q|&pO-b^+h2XjBJN^Oo?6uE1@BK9UJ!slAb;ERgTwtm%PF5mXj@s1 zr7WGvza7WwhgFNY2``!If`dC0HN+8Ey;2!2KbJfI8$*!k3-%Vyf;Lh$WAui`$}q1n zrPM(UB7i>g71Ks>RV{?(yfus4*xH^){XWcs+L!J~9ln9Y&Ja%Boa`#R)yPewz2W{G zY1d^PO)TrM=<@nm6Aths@h3J>la=B4o7>3uZi<1uO8+E=?d<8npGh#iox17hMgGIZmW5;in#LI6(nyZ+8wK(F(SHR8_6*Boq7D^5{Wxt zFfF8we5a0vt12$*4;~4XW%cP;&l0}y8YU||8TjJV+o0Q+(*>gs_3>vBl@%n4hOy6zk0rd`lCzx-FaqcFmd12*hsS;XWKled828M z1?T1zD{t@D+w!O9zduh~rVYFgPhF)wED1LStJ$)$ulg~0stmn9w=X8IIlKMy2JGvE zVZGFgLh4wDGjTiFsrKzyTTCc%dtQyx1+4QcV^Q$Y-GVR`BS~UKySNUh=(}J4mebSD8z|zptYQOcHwwU8xsX z&Tq%%Tj%+7M=aC5z;*{6YJRzSTY)pjvw4B(F(gIQeq-XVvP}i#lW@zAgko8ITBJgh zx#X>W!#y~73G7)Ky3YhW>W9B!?(!nKJ@j16#aY!{9NFQ-Zr+SkQvG`i7~m@Ufq#XL zodx}0@SyhtsY_$pJ+Nq3^6qxE)`I2RzR1g4AiYcx>t74u&*s{3J-2jdjl*bU;Fw9uEh~28pOIOS+I^FGvP`KsHNdX` z*+Mo8gGvf%Gd>{&XA%>Ky08}L&)s{>yupgDuY$zfI@P_JO=_F$q>s&Y)v$&XhiSbd z>Z32vRH{zdmUffnwMXug-V*g7hZMV2>l=2{RRR*_C?T%Xyy0kG!W${^-4h4C@f4t= zZTiN#d}nMGQKK6%n+*t*n}(pdx{Qac$6OJao(9Wh#Vj4W7dfv!IuU*096lm2c!B|$ zOStbjO9O_uY$GL10&LY|X!!CHmDoKuf*O^!f_w0QEPxqsr)r(>I^I3I{$*uwX-qqS zBT28>zr|p!T7i9eWm7M4Z}mM}Jp8`**}%xOpiz^73S*7BiYX}2Kwp6&5@Rl_C=32# z;w->ahtd(wsfTEv6nVGlV^y}%)Rw)Ko3JX*Ebx(YhU;O#KMzHdl^JpCeSER|y%FR{ zQBWmg@U*tF0;Ta4^Uv|%HD@E&Hqedd+|%N-9A#D!o{i1|3_1uZyMG+spc!&IA9LWR zj%FBwnDAz^9WZ&83n%{$NnFY#Q&q> zozKRRp#qgSE~9%Jz_qt(-Z~5yxp1XQ=z2YMn8gA#%0K-Zf0>$f?K5>xH*x4`iu#ub z6oCTt1Z-0!bSLV6Vw9Al@C$qOe^Kf{R(T_1*R%~=T+M?cz!1As)%soOuxiTwPY-P# zW@H8TNTN(P(&OcZd;>W)@swnygF{SFaSvF!>q~@lI0-74BRhqA0g`BH(oqhvukzhD z`&CBE|8@biWv{@jo(OA*wM^JOnp z8F_biPb{KzEM&Hx9c)!uK0K6E8{%-nBO_NEA*{qx8eygtkA*detu4bSD4H1@qQ}SK z^Kjh&d{MEjwh{E|ZCzAG$>YnZQ=;Etgy71m7;8kP9P0r|OBq(B;%KZ|0c9d#Pp|bm zjtuZYAD_Ot8QWvk^6FdP(dSUt@rgF#7JLIy52^a)g|4OJh_eTRA<&-1J&^{Jb z#|spAw>VHaIPXN!i6v9C`@m%8-wOPTKOl>jp^@R6z=qWMvp-?s*}AEXkE}KAGO#sH zPmG?-BkeMiX-Roo=`RwR;2JPfH0Abf4qQGR+@%M*Fv)Smg=o*VwqQ;0d9L43!MEjN zHxIZK!+g-TRj?6h*ds>SYj`U1v7CROc~l?dj6WvvOP9vE{@syGj0)HT;{CauBHksxvQC>9vsSq?N;embn-H~AE^g6Lj3|7 zp9I5z&Af_jr2<`fc^`?VbUrQQFUyyY;P_*ojh#-vQpavZw6f92E$rxR#2`@dh^~VD zm%ly8o^c7`dNN}w{q?7Uk{>N-sqfaffqJ>}0%a1_|A1F7`4=5X}0brsV%8Aa%v-ayC zG{JuIYP`a4e-srD)>1Cs<;2|nEM^yDI~L=pFa^; zG?67K!tR=j@}-MY?`?ZmGMlD0k)enj!^|zLy3buGl4JinB50fpZ5rzpU#wbo0>JjB zocVHG%qwCE(6F!wHH7$sC*vthD4Y+{qVofK7iYpcA$)K$BD)!Xq-Afx-Z^*gNXY;? zIDV;?T02BPj*ZD&IvL_Kwe}{sTodawRq;naZ0j2MB?PI_tEESCHZG=|yBlDbb%^5e z_LKiUGn?e#TGj(ykl^WIsHwQE0d}f96r`n|6!(DSdxOy~Y*pT^9M-dRkk^U)^+I}X zB-csmk3>-KG_d5#3{zGQngB@|rsKPy$0bEl~h%}cDQkUZTimbo-+ z@$DE~?nQWR(N-d}_S23`jn--wTA9{XWHg5hFHd<8nn3y3i8p=FYVaPP9;{YLnQO~Fwg z!&!md+_bdaL{DoWo59x;mz7ekXuH~YPgBNrMCm&w?-)VJB~wdU^%Nf_c5TDG+CcIYucZTXX4P;gSymMIX7lMOfmGxthU`Pw^N7{~;7RS+#H zC4w`aYu=u~y`Kd1oaE3#oG+x=er(E?V?sqONZM`LnV|BsJ-_ZMoceaam!qlc#$bPX;qb3cN*a1^OOX`z&@zzQMX{ zgC--Kl_i+;oK|VJVz{y!Hh1_bKZe$9`qlVkspf?m>UKWyc-#Y};vby?@+mv!e~ z+-?JU!?f&9&JqJFF=_I$i7IAnEjOWKL zdz|>pB}%3GvsAQs$#qIhjr$Bvo7om=D>pf+;&`Zl+`P>WQ_p9B*c|;dF*KU?F%@$+ zG`4LS{6@76*9ZW)tZdFat|l3B{^4W|>JV)|B$fU+^jzz$`ZT-iaB2)$jA>-)gAQkb z3wDL+$K`l|?~Z|^uu7!-eODEvj_Xhf%*`qGnNO>IXj|SI=syE1)H7zo$F0gL+Ats3 zs7K1tA&HBW8kvw4lVe9x_(e@E;nC3~qnT7;*=ubIjh3&I`CAT}J5Bu5%bUFmeSssg z@P#xBEn)X#mnNwo^_rPZl{!p=qz{gaEfF7*T7@7rKA z<12j!=(DS9+KS-SiuWEJZFuQ(`5(gWd(rs_d*0K`|6LN=wTqUgJiEnRzwsLfFbcB4 zW<8_%!cBNZ7QyS*R&ko7V^?O};hCu!K4rHajBG#PjYZfGtlyB0tb>NX-=9@b0=S)7 ze~TEDp)PR$#;!0+Vut*aIhCvDf~mQvs{-Kd|ahEMa*yJtw!kCu{+l)-BQUjccB{Ot-CaOedr0-ID1uP9j8po zGiY!Ivt5HK$5b!0J8;u{Xrj}s%L2pskyn3D!EV$5RGsU%$LY-2B+hZq>m^v5c!BBq z%K{_J?wB*3n`w4LS4TqDpQcI#T~vO(NsPnnv8))hE0W!VKn{wnJU+S;+M}ZC{x>w) zZAtbJ$~&fE@~!;U{>C_F$Pj?h&w-~kQ)IlI0b>YHNVqpksT21buEeV7@zwo5%}(`F%MXn)}ExeVTIiBPZNEY5GA zy^T&yy&`H8aB%cz|CN9*vijP~QM;13Mv&yR98Vlux0U}Zq45PPXVr@)>hC?5fwf-! zznAkb<7oO$q8{*1e*VvNoOBX$O@Xnr8{*PGru+e!N85i<{Q)QLwrk95u=KGJuGt-( zI%{ZwkS8;XZu9TQZd6R&s|%yw9T!M;+kixv7qXrEVu2~bosFeW-f#hP;F_!&AhPe0 zzR;DYOb=x+eZm{+|7z~7qS}hqaP5{BXmOWfEo@u@r4)xkAwY2`QY5$(mtw(+yK9l) zF2M;9ym%pKad-Cs#ZKD2Z~vSB=A2w5Vs@uJBg)ID)jn^H2UO%p^zIu8LxN&;|Z( z?ykJQlozSnU_puskVK!!s$M?luZ6JyVkKGJj3TZFECjj4b%}Fg*K5MG2gPn)#s}I) zotCPGv9F?s0d7sz#U0n&1V<|JVPtP=+xrkL&Wh91Q6|7wL~SML?6efYVXXlQx#fda zgup@TFfabIgtHexQ~kc)Xc(^Nyp(vrS(ZxrlU-lZ{QM<=HS;aVqdj*tW0^kN)S=S*M>xr&-4^f#?2wu*kcrYpUH#jHtMYZ_ngYg zGyy8t)I;#c+K~CrB&U~W)1gIkNxK7XH#Yg~HzzGE2{d47*ttLqYA{4?DNi7wu+0tc zLzpFpxOQZB4_`mjsw2qT|75p8B=YzO-=5zye_N}wcLakMBd7$kYGy{;ggPebU@u0H zfx+n5GUEPhPAR-+=IANx{6HILe=Wq@V~T}*HF22{`>ZSJ$0Con;fr`7_qFY3J)g9T zaHG3$*YkK#=BozY%z;+4QNb?a^FEgk($2iVs|y)(k7sD!)I9kKbQmaSXByAg3;b_A zTiuMQyli@+=c0psFa3PDwA&k>XhlZ#PUYo|F^)fLK{Xng=^1;s+hh=4PO-8^&xC)Jp?et(D(cgAA6`ifGH}M<=`; zKFO4e=tZKs=iPiH&;b*MlV{zes#T1L`jCi3iPw(#(b#UAImM-fboL_>nsT^9Yk~3@ zfh+qof`f5B2XL;^s6TGF9Tz^G?mp6`e}*5!RR z2V*G!BJQr332u6t5!*#>s>f)kXqhAJ1}FiY%`fw79gQ|M@FI$h(3fmd;BE-k`gY-_ z4lO&RJ&Kmc2x0Hu&5@(oEooV4+AMMRH0LjGEfCkFVUyHxq(Nm4kY{ZAaiO#c+>gi5 z-KTDtx*|0j6n2!vVLA8R+(MniwHO%bBH&kGg#IWx;{|dVW=4Qzy?@$|FXJ$LLJ?UI zr^adYZ^}#&)I@O=X!luTQu)xWRb$v~^WB&ctSK_F zgSX4=e^^Pc07BtEx!q>QB1rHxmQLHEb9EWzyMndky;#Uxi-ATFibm_9Q!dl6N`9S0qw7nOgdNcf`uz`R`4^YgFPM!Yd^bx8>Xs!H?;< zpXz{0r+gCuDH5SavY?Bj(whaP>p5h28r}|rd&TX(3CyfiULjYDyl?h?>>G?~|Hz>5 zcM4AG+p#m8jpn97U$3hYJA+)m4PPA>y(um(wMZ)Gj`&)hd+po6M=WQgbaLU^5mMW{ z;u&6DH^v2C`k1#!_yM5*vUP_&;x(ci0f2S~(|Gg`S9UB$;G1k^%YOG4J6;&ku4Bdw zIWHZvnJS0awu3)14N`(Y*1FON15mndhC$Sqd&$$D296ot)+9_UM{HcO?GNM|n(tR> z8xW9tbl7fL04&A(ToBhE>T23OT!Jok_FIHC27RxGpXBB!?!n#FBOLrPh5}nFCj2M5 z{XtidcOFGCWxyYFBVQ$4ky*R$b-h!vsP`Un<531j-3;nNwO;@HMTMMyZ+zc1fAbm6 z5L2ys-oO3!^76YcyzwoXjnwPmuGhXeAt*mcEpr|YXHDI{X#^R&^-uIB`qnC-N2fgW zI3m5sMGdm$$nu)sr-=@7*K#!SKp~CL9$!w-54fN&WEg7OlF9w8X2{FxbLK#`j?Ur_ zr+uFnSXmc})gy-!w}rtzGpAElH@WX}+t3DUL zSsQ$_D!|Z*e_W1GLo923m2p!KXzd?AEK*}m)G&70J>9KZha3$2^nRKpmF zt$W%ZPXhNc(jqNM$RdVkuoBfg=itwE%(BcY=%?xrhgFbv%g&&r*#dJpg>p;s%Fry# zOhD#&ak-R>-vePnG;>=2uO zbJ&sA62MLV=2`-jU`3)VhCLoU^?3qwM`MUx1?uya{m9#%f3KjNNW1IwxFOSn;;bKx z0&Vn7Y`du69+_oiRUTs+XjxMij7A6mmQ#Zy@GDghIRRAhXY!y@ul(#9JU6d|$R-;^ znZZIh`ZBF%3Q?k}F;}`F7i1UENNjB;x%50WPBS>;OlYCs^+$`L@D}&5{j@n-z}5&9 z-^4iPbs$*K3O>m&jOy0eWXXvGY&>*4-9CncpE7bdtG*^8E?W3Jz@|4m7J zQMq|p+8yt|DiNcfT;seu)>g|(HDrGn)46!ZlV1y1u_*&#mchT#)3a?Rh%hR8JX?%H zF|7OZUwiQsVRHG})1|TRRRd~?P>i%UIeFwcS=NeCCcKc-TogzrW8TqNTmm zvca}cHkJtlOL<3uw?6^Rkr9?P*&P@wJtdEiE2r;h)e5?22M^c!sc~c!D^IKZkQ!~j zb=m0v?$uHb?;e`I46bl*8Mj=pLB*twMYWD)LSRxU{5b>XSM9o4LD#RfysA0r3Ys)_ zsP?0T5y~GBEXtq9wTqL<7h{9}fb|xb2_S7sGjTeBZsx8ZV^HOnEf}rx$E0dlYgxdd z<1?v0(wDe#N%&e@1)A0zvFqbYb!nrcqoG%{6onu{&&v&gU+EnUIn(We1r%;d>b6id?w@U&^M3dQtXQU2}9S_Wf$c z`bguM?_^d)#Fx_Iu< zperZ$hNuO)nQ0VHciYLaeqxx7XH`3Ub=f4U8Iq9Z(p8zTpj25X>d&GA7oFa{AhOE*j_YKWT?k&HH?(al7 zy?TPrDG~`YB#)Fo(dt_QWtHFrfE&((^B4=wJhwc`v(q*!RG}9YhBWVMGn{@%Q3|N> zJEzu-zk*luV7D?XPO*RMsRDz)gzqh5y`pM*rvSO(A+0xlQf=oX-ctXQlQWU zzw-tk`ks=|X#usQjk_rLRbwEAoos~jAJOjhly(0=9;E#2X3Hu%l`Z|@>szxQ25WMZ zQD|_^G)7h4CJT2w0o}On6V^<@apJbCGmWTL0S886O_oE~6#+=*Q^t*6tnqLRu8p&g_HHtYrMWeKqNUJvSX!cTm6AS_uyS z9QTiWkL?DID58&h?xSlCKS9hFP04(vBfPE5ziZu_$7m1S%SYCl$pug#D3;Nwi8|-M z`<-NWkN>j>KhQaVdqA{5tZ$yAi3e~f4(TEy)8{rih0bn{CGFlP7C1J2QSg~FU-TO+SVG|MT?gkEl zW^9DGJcbaH`59;WD&jxZ-M;j24>D~gzKhCQe5uB@&I|^&{uN*32@Yo@hwO#EP@*FU z*1$X;6CR||bz+PCpU~9kCZG*BVfb)Mm9}+Z$`i!_N)ScN|!G@r!~e z7%~RYt`{YLuhft#%z=ftcX%#p?9H8>E{>OoC*liFYzdZw9YRE^uIKT{>|R+=&$9y(Mm zOBY>A%!&cfzSlmk+o#g|ypHoh`qi4W#obkHVoL6t<5C&3yaa6!SC$g{&Ka@JnUv0& zF$!3iS%S!2D|NMKL1M22Hp)lR!L#r)O@n3^wLUz6-nZ!s2A2TC` zBrs{9z}-Y2gUJP76VxOEylgn7IqimvxtnPSsbQB@??ZC-bledy+{&9u==AgtPkzO) z!m{01jzq-qTzWsc?8xDVA`7btO5y9bg)X_yHc@>kv>&N^9>Q~0_q_M|=%` zs`Wnd`&f(!FbI3Bug|uQ@^nxtqogy#CS5#N2LhLDOVa1Jh7RQb5a>sAz09Yot*wW> zN>>kIh(E@!fOqt$v@)7Jk*f0}33p@>$yQQS7Cvd7aw0PqB}Jis8+TqAxcZl~h?r0( z{(1}M=o6GjncTILS=afLXPqRRFxU4P6g4fSwfjxbBXcgyD^kyvF5YtdPYX)7m9xag z3{_F|vZQgP<@gzJeAJ1YB+?V(q(wQdW>VCnbwP{K_ZNZd$GTzGz~1!a?%_%GlTE^k zHlLAqOlZ}pD(Vd9q4kFu%thh(LWa$l0zPTEflU zb{qdV=`Tg5VjL+U_dJl!A;Ed-u~eWtLE;-y7k67lp|;GFKpBACbJLfoJ+Xg(9?IWd z3SMvoaxCej`=PjRt4*XOsBwy6M?+o!H^mJ1(%@uNU4m=QewX!i;}F!AGO7nsNYl9# zX6^SNUwlv{6+KVjaEUNd(bS087h8%c11*GmEI{txe&MVazghK(^swSJN8_$SzBM=xJsHS1~h9y`D)S#s19<^ z)cNlRcvpr)X%h4`Bj&}HW12Wp;9SW1cP|8YOYGR*&y zm&)@(f>pE99gk7M-cuFA2G#y7Z7{|56<%JSwR|58UHEZ=ZgCBMy5`bKxOo_gOI4dx z9KE{{!p_{AD~|~%hc)oi>Uqg}+;DA?uk?GaZ6*~371Yn97zD&r?)c@?`ney3Oa01R zAVf*#PdW~0Ly>%~M2+=oLuP@h`gf=O8ML7h7auMoOiqz$IHq(gT}u~4j;`N0C=C_mHwZ)qm-OnaE zr9~>qB%kxLD+zl@x(G>H@!xM6%9h9cA)TAlYRH2uop!j39{|ezvl3{6dv8`2aeug5 zd?{_FGLQmKR1>`$8$z&@boxbNd9^Upp%}6h2`drdb4>7NHX51p(kXUFOqYwU#uluT zrSU`qP#8P^j?1~p3`Rc5 zYb%n#xb{vU(!H-X{ZPztr_w5}R-9VQkUSLeyi~i9W|x$uxV*3J!pW;yl)SY|l)JPR z@TrvQ+@BX8B!!fk!)CpRXD=};L z(rO>rc63aRYPmA2SU#I7{`I&@nHl#1aChMOBjiPeo;5!xoqe~zrukIZa~ANmAC=+D zxGO&gOp9-HJcryJfx2FqB`iAW74+P{;;Ee1Njy7By54ME)- zg9UWxAypztN`WfR&%dek!F%?}o}%_tP(9_xm$t{VSyJfOyz^B z-}>HQPgYgve$!>QnStQhOpE*dD=u&Bvquq>#8Ie*|2wNran_^g2H5HOGp4u)_P;fu zi52zb@Sn$4TQh6hpt@Yt!a-zH`DNSxKFU(oJx1O~KZlrwe{_CpQ+fAvSaJA?^q#W1 zT0}CUD7D=ZX{M1q6eT{E=EQw`v;HsfGwl&0{61$Jm{&7^*J?L|37bvDw^W&qtOZ^h zjuos{HLrP26hyx#xV?IBYP2O<_C(9`-0#uC;TO&Ii46)~me)5tR6m2NM2EljaUi39 zBV}RR1U(N3{g1XODhC#LCqIR^gX&6Vd{Jebde%&T!^0yRvR>BXEA=PqSC4fw`z@#c zD#icr08&Byer3d~G(V;XzN6^){h6qRE4TY(g|p;4okvamwycBHYJ;R%M;PaS4{i5*LQ6m<-yatTiSI?Natlo!Li5>fiM%5EHcIU)>I?qx zgE5AMFZY`Fu$AI=&CpY~57R2lKK#cC!-H6kPw{p-Osv`|p4F288IIZsSv^g#Gcs*P zIme0RXy8pAoy!wrpZg{>__4fUS-j2C9vve!_m7zWJ-ri8`QCO6<55*c|NP@Y^F16R zyM|C%@x{+A>)e&C57pv}&c5Enc2ty+hv#_&fHh7?MTa=O7~ODaNA%4Y^MPAKZC7xa zan(hQEMu&rgc8itEA-}im+R!KKcqejO02m&PSt> z2Mq=lAj60Erx0lzOM;B5W0b3L)yWyAW;eCfH#lhJm;dG#M#_ypyZHL6I$VSL$ezVo zO2UjdytFCikz}%UZ_Zpw#Px+7fL3*LpLFf}ZC^E7yfV%CUE`Ze*Q#CwKT>AFQq>0SE+h6zN~;bY7aB}XJUW2T%y={~)Wav&O%x{xNhu0i4<3lS zc4!_bv-jX6)T)VO240h^Oow_h_cEZ|31e>ekxBDTvFe{Ay1$SLBv6mVZfZcBLDbUc2bJG*YJjT10#vkDMf#}mwPa}=?}RdqBt%*#c=o4Sb;UaP<#ZLx|nAuek}H~C*HcBSwZSpH_g$K zQY!x>d4TZ&&(%KKh0hzBHZG=W)}p=#WRpZyJvvicdJwkQpmcWn6jXC-%3s1Z!U>f1 zz)FQ*$)b5HED{&o*pOT*bU*J<-v}hd%~>%0-P5!58M8i2!aNH9y*d3_H0jQHzs^OJ zQ{Q!^A4_p|ijr$#a!%i~{VM(zlz$*Bai7}V!kk}f!lC)1RaD@%paK;K_p~x=hLFL; zo4^-g^$li13heVRaZ=;9+5~p^KKb7mU$cn_Au}tDsmXspCcg~?&*cU{ahaF|jF&Hs zVEHL!LLiIZLEFqXd0NH1WOjKlh{8dW{rU*KyRh#1`tB;ME~X5uqMt?J`JW)6RYM5| z(3kj#3eQg`r$;&{y@M&G$A>`PCF6&P-{h+ihm6`ONZ-RnY#VhAYK#;6a{YPRL)y`| zTdB_$+!ex{iQ@uUh*OzfJm*^{G>~{2Mu4smdFn?L)hiV#fu_3t>TX~G70rOWwmws<)R4QW$l!iM7FH13Q$3x-6f$#pP}`T!5tIgyu4~dHiu+E-j7pmiXI(^h4#iK8 zm7Gja@)kefOBU!PS{FX%&`Ig+eU*C#Cc9f^Z@jIGdEG}z(N8+1Oo(?gf%-aCLd8(a zfhuPoToKCH-?W*xv`rz7W5MW@8YbWUq_dH?U}MUT}AsUp|w#I;<*4H zJ#K2!BCC_hxy8azF(a=05TE2%aT>?~gLvUO%)R|||N0ki7%FO(-B9VCaY-$w8)?Q1 zH%M16SOs-;#Z+M>cd#g-szriI)hA2KP^lr`#k64aiS~Vn0%mk(iF8FBmp&OCQ`E`p z_IBb4EjsD?M#_)s)D#(Uq0+=)69+48d+@+MN27+$$#zxs29A^3Ge3HdfcS6>9Hcfk z<8nZppq#r1U?ih zQ&(4}#Bcn^qK{i>BG?Zv4I29ICJX}(Z}yRCQA?&~%yD>^T6b{b*4X@(^-^q6wbv!al= zIGfJGzVRwc1uQ(xn^*`74?(gVSqVSvKy`b+Q2Qpn~+4G#}9x-#^pdm$j(vePz|w-m}6zf#rp75_ke;%&

      h1(nVaF~#ewf&_~#u~DPB<>H1_ll^C~ z#<7kN$r&=KXu)HfJv|hv!gZZ~dI^7e0<(d+ zs8;7!@d-%my!3%4PJ3Lcw170XV^@A3J%D#JA&=8r84X;QKdYC1%1mo86JLnJON!>R zx9gG`7V6eE*_p#><%ioPJH@Qafj<)#E+A1(^z*m%;?;#d~p&o z!fa&U(5SRE-M6yjl^soQPe`6Pt{k$*7rTrO zElwZJPEKxoDUPd&JN%qdDKVwZn(>2fLeA<6Y^r^FWmB<_QDp@C3nyKgmd@c;ZS=(E zesjG4#Jm1W{Q%%IIq`kCkn#>G7Px>kWTko7os(DxQQ+TJHgTvN8>`@22VXNyFRxLQ z>oh{0B)8{}WPfJs4$QM&P~#Q2u>{#hP*E}2rCdAPT$MeHjfB_%}|O>+?%I!8YvaeN@i?zDaQ zG-L5v#8t-n#6-_W+3V609O629YpN?q>+{umE^@Bdb(^2a9cDRG z+Y2eSj4w_g54M|^t4+5UY1Z@5OZ^IdQ=!kBJ-5rWIC^hqfd9T>T({!w4nPrL(2|jj z|58*l87)P+fnkRfb!mmNbXD_<5fZ8fn#>Rr5=sl8rk4MIFQlG5JY~tz!huos?ma<0 N0e>`)WP);FmSN$8LzTxJ( zTibRwktsm!HsSa0H!9aASPC0n0vjHpl6Q8G_n#zjuMr;pKV9zU{|^co8C1PiNGp~O ztwLJJe(VPR%ZN)Eq+JLS*uifyAW?wC2P%$cq*n(I%u{J|?%-^)$7?_F)0Bq#lAaEFmxmw?EQ((&09SX!ny1b^AG!5lg&J7z z?CWVa{{3+u!%JCZId_v6uCJWGJ-;1>kj{1L7q7cw9;482YrnrSY-~q31#Ci=2*z2q zeK)Z{?wkO*jC{2}xWITGYjJ0tY>ty$S-xJ4-up}!{Kidig_K~K0|wEbq6v{uQGh6R zohxo#P438>P4cYy)Yi$Zj{PKWEVWFJxJxap`Hm;i_(LTF5v2JY{n}yAjO;YG-|i&4 z{90l4&w&xs4xzX0BntA)RviN<71`v2N`wKKn_sI=+$@C`P5W%&;!l*rk`kRNWR1c6 zWWLWwQhn;ptbEsUKiNZSK0keghwT1aib8I{51Bu%@qd0c!+nn3{*LU(vGL-aAa2wa zC!YtFa|G5`jT1C|R~7zZc5h;fmZRZfg9{?jWY-c2jXQ}c3q>UDhLJTldtWaIuFu$>vwd^E6^cC%t_@Os2#@VEjTdvavwe(^LptkZB%z+&Co;~1LA z>phZQsSeP&ynfJeR7U0XX+v<@)XVSh8MS%zoeUIC%lj4&kdsUeadKx7^>anELuDBH zdS2P{5%27iUgc9cOs*-C@%eL)yt-~u-n)zO>#CXjBOY?)-_66+B=%3Y7bQ^HPZH-j z^rA=;)cRskB(Bg{3SOzN(Q(%ObaaI__0*cJN+z4%GXX_NdcOwud+xxJA zNkgL|_ZL@!(DPWboYjif#NqPmii4w+%NkC^Vpeu!gmM?f#Vb{JHc7RGz7zwmj~m^X zSoy&HVpGr2=bJY#sAV?1rMo|Y^|8`iXfX)OitB5^dKM4bWbjiF58>@LUAOjPP0UJe z)J*t!0Qot2OvD+LbJso6E`pkn=Fh^@aaLr}7bR|k%F;xgJ6kj{K7Y!tfZmJu(1`^Fi#&n{>t%{8^ir38s-Zv*1pjnAk%7mWbOx1I+H{LP z@|b%v7>ktW)12e(5=Wxp2JmgNNY+hYbtE2!1<8WR+=0tx-NWI8@O{xk3u^QyMB=WY z7NSb{K+d06R(S=>V_6kGZ`6{<4s zNPt|Qgq2h0?+Okza9Q#Uw7=(&6s0lh?vUh6ej-r?u70MmPg%86A?GG@G-Zb$|3l~i zs=)nV2Wt*KOg4q%i2?7L>@yW~=D`X)|IcJat_A$`&^YNys;~tW#GlHtrP0}v$l7p`su;AUZaI1W8yuu@IUZlQUz|sy8hsD)r9Nd@|3dJL!%UefGH>%2yoOQRIaqQ znA=ci6Z^0gws&&iOo|Td#l6pUa@Yu-S~Nt_!(vDx=KVkaQ<6GMPtCo4(Pi-Tq1*UH zhBY_a*hfkwL`~g-D#c*e3_(BfHO0rA5-m742)&6@?)O-4|0^+lE9TNe7t$~#icbpq z#fz_RlpTT-o0yWxo*98O^pllE_5R2&l*Fw|pIv4n( z(*|Z;{(Nx2Vs_jq-!6r&@~V%|#Q|69R_dWik`b4B80NtCKD*2^k|w6TQTX0nw4}5C zvB@HfYKH5|;&#Yrr4aGzhFwzwv?2<69P@(Ri+OGNU;ztQ#A+cojM%O!+$ud2Ux-Ix zxc|mGBAOB7GYRUi21)iRJLn#>LeGS-%ZxgZ2hP=&+r1bU#>r#9ixl*^ox4{H#IMkk z{t#`(POXu=TjG|%$8U%9#DaJCb(8EKCAU%K1q zzLpZ8_r(lQvnOm)=h+RM{!b`I_D@dNLd<%4>Mxe&Y6sBe{`gzJGTJBWQF~%^mE`d*bKk=C?Afy zbZ4URs(2jJO&&{=trc(bZo&BCQpA1tsY6Hobnt;dMfOxfcdB~!ik})Eo7aLIlt9f~q8@bXd*gC_ss6hRhfRRta)y8}qo7R%j z=SrF^?Iiob>T4sJF!fN|Fxd5KzaComx-QIBzLP%cC|6SxHD+~L%>K_Wj7uiJ&nZq! zjuoLSd*``TcP36jXdee;+@a}T-EF4Xgj@c=cnN0YIhF>IoIej)-&Sq|x;bO>wYU=?1O1oQHG_efd_M&0;|H_^+ zRbnlyr$x|4;csUt*S~hfXuqe0@Q&Wn@cDPWjb=P^3W!uK+V@?V2traWpX`ufJ6VdQ zxX}OL+^QC3hSwOrMslfv1+hu8B3SCTmvMj{4nt>$_9aqu5djEy7`<3k-f{6|UELVu zw%yD|cHJjJVlpSDPks8?!;8sk4Z<(&j;IJMw!S_i`@VFe z%5D$01lGmZU<6i^VJ|TJ3_2b?N_l8r#ga7UZ6(e5?X#m`JO2$o4+~=FH4m>KY#-ck zx*J~D_H*4#JSLjfDU%g>kGg=4JYh&|R&-IjD}~c765-v!xAxaly0yDr?E{BCtR+;x zu`UX<0Hz5n+Hbc5wtVPvI1vGV1jx64YA%5_SQd^Fm6rLxA6YrB?Kwpsx) z*b`s;vp`rfERuCn=G=I)p*DQ9rZ#-4A;chEtXN`bF)1=Li8W#kHF)KnaQ9}+(r+fk z5@~{2US#X%`{L>C=0si`^QOgOhhrxk=b&o;b2f%h6xHodE1c-PQaqC zB<9}D&+I7U>9(m)Hjq8{DkxTZ$0hDmwc_>>w_3oC(Fv0N76%3-e5vrWLoI`-$Cxr(P@B2SOp z83X@2s~cOmk~?#(UQlqm>ir))pl&L~qI}=kMALHumvcf<6stklC_Y}#p0Z?rD*MlT zTAi>JS}{{1g!G?jFn*xaN&B$Doe*83;-wmr#EoU7w$O|avC|=f_J@mC!K5nvpd_r) zsUIWQ25B-fPE+ZmD2^<$eq$ZR$lK|q4hv!n-h|Q*6 zTaRirk;OIj4O_Dv-CGwll}SWc6I`sXhVtY@alKW{Q#gQV$_@n(Ly?4K`h1LuX}*7` zEX$@eX3370cGfU5a)Zggm$I6+1TFZ4ogK9M`zvu#HiK_6TAP;6aWf4_t_ajz-Tv!d zuK9l=j)t>GV@@#s)UN>JH>Dk(7fzE|XzsVAanQ<5xq*>=P63b}G@}w<%k-*3lqT<1 z)Z^b)KE`soNRKc#X3c)KjL+(=kTGN&fLyv#&gJ4Q%7@!jC{)m&A#F~g5z5Xe1vIX~X?xg+X10X8? zaspmq-Vc->Wt=A^%1KyEId62J_jIcZc1T6Kc&SfwE5*S0x>%Lw=bJ`G+PuI1V1J*c zYA`$RtRV0rcQCl%^9nYfh`vK@WKbjg_5*BpX)*>wp~NaBL9yC?Spb|{XL~jYszCAt zC~kKC_XRsp{1(JTK~=mCdq<8Jci7V{a%XGn1`RWU4r<(VGNl>mEA$Q#Xgn2Y?EBSw z_yiVBBhl=X_K4~f00Z*X%aD#Vn2D|#+7}dj{ls$q|6ps*XPapBZ!pw!ilSb zpT_6$v`A*J2q_5-9`0FzrrKDoDX)4UGHd-4fJnY)xQ6LND5MQFcKV8_eYi5OVE5T+ z6()<7pODpOx~;|*OTZ$N{gbEqiX5|fDYYD>z|*b{`e$0s=?5Q1gGN6c@n(}6SZa%C zf75{q@SD5O)8+9v*w2x!^18COg|9PgKaxSUXf)K zG-j}Si_DTVl>G*Ek{uTqV2zz0hU4L4fvM$JW`PKY8dd$6;dLFS;REPqwZ5>Y#TZCR z;_!`!#jB*a)TxXP%wtbpIIjK;$WZjX_Ma6_~n zDNfQUW(o9Yy>;*GxJC1uMaw{xmQcubE_dmV%xmvA_nT;0WA0_!dE@Wj(LW8-Zt9E2 z#=Z*XPm_tLFzp%9I~$7oiq_hH4Za(Xa6fCb;)h;x8%zhyK!yZgbI}z2$Un+SeK?l~ zssu!CHAN}~SR}7Cr1|XA^Sgz>y)|2ZC^h^Q(NtIzk4y=@ciMkWuG&k_e89=(jK$ZJq zDB4+CU>lb0dGLWPOY0xJ-z>qD?Bh;qP)h2`be;kEROg<&&fglSQoG@1=cXEDTr?@J zP&RE<36I``+X-N}q7@ZAri4BXO?ty#BQhN#SiSwZe<>@~C-}S@-tR&Qn*mdcRFrFW z>Ph$!_F^*$>GX3WcWM%3h1f9g=#spqofWT2#G8_35>u`^y?>$x8)v9jxAp^MR;dx+ z`?fbsHS>Y8a@BH>F*WPM9pC;|63oiK7MEMBoY|jgyG0h4H(VoU&{VQ8OUZEJJC zU%=w{`Z$z`70k|mGU?G-h?ZF;j$ew~b|H%j1ibTYUQlATOTumyO77p)_McJW(}Ki} zFls{|cDk`1NcYc0NSS>2<{-&FH{lUcl6Q0R*D6z{UT0^wpx3Uz8P$f|wP6A+_#Hfq zmY4iTI7j&u%M4P~UEK=H=L%i4m6X-*QUIS*zG&IBuA5J^>7>+8UU12nIu9tJBvpnX zd(1!lyE)L0lsz&?(7Foso?Al@LV#yl#wL|$`_U-y&pu!+qpcgG=u@*tV)GYHh7Y96 zB$B)hcsqIeo3d+HZ6+tvNJbz`Dwpda(kq9s5O||9z}9Epbm&T*5ry5vozD5k5Vy*+ zAWNS4{RHk;C%K-0Z~<>9oql z#6y7!VWXyJM$B^;%&%3plC#O_loQN-*@cO*OnF5_f zII+LzOpUpfJg0ssT#}wp`YTq@_pR3`=ra2XIv|=eN#U55C1mA`bbDUO=CL3KyQ#aw zsNKmGd@i`09apElioMPX!>E>&YRX2%V5)~!geF9vlWpi~za(j64SEr8V_q5p`AkA0Y)E_YJuvKEIo|ywfEh zTF=HP-KY6aRE@5D8~=pJ7$V<*u1Wf?J4aPzoEN=y7sFHjx6CgO6Y#`FapKvw&lEYG zOB_}7iVJpwL1=$Xt}?0Rf>ac8kS%=Uqoxc6?vDzc%?2eRQg?Rsbp=3Q7|480KH&gw zcXF#56B&+%6CDW@I4hTr`gLa!cg_Mly`Qamy6j(O`Jq45h#E^xF9ybmiVgHaJ3>-i zFJ{b!Bdprv@uW~=?6tSTbZaV})1cz4RDl7lM@M25n!|`++WOF^j#hWJpB)9rKFf;- zONUVCC`$&8&S+@cu{!q3+swC2&Gj}q2aBaZqvM+3M#-N@wCy=eHfo*Lh5 zY0$?Fd`Z#X3cISSVeX;m`WBQuld#iXx%zr|p0eueZxP4*?{xR;*>hIY{W)Yhzl0=v zmSIh33T>5_JEt~9aQTh@i+Ca7?+X@zFZPZbA`%;qG$+Tcr zx9Fa|qCY0ilRD@pnW3L8&2m+})8R8Q_JKlE@S!Z$Nt$cv)j zPA(I7esVTKYfNh9tPDepiX2rN5_;ns=vfSbr`hWBD%zPHMcS^dVI=%T6og{x1f6MD zO9L$U>x(kwdAsml%E#OO7W8iK0@U~*L2fnFIT?gVwX-(R*6+Vk4xuJ~+~07-cirIq zzz3S>Pcw8N-2JUr~>Lc2BAre1#Z`sex)-xFZn{yI4ITz^vB6bPZh1lWG#18Uy)lFFOtHUYzck- zZ|mjwU#S8+vQpvD8k?B97BrK4#(KBqC*m`#H&i~3EXFlXPo2eUki89lmLuiy-tvLs zN54r=67(UszdTK&2s;^Dc8jQZ$0V@tQ)ZIvBQ<42-e4*9T&~h@71Yht*!AG_Z#KZU zo%mhz3Zvrw8E7JZ^=}SKp%nXsU~j-h_L)2*@a8UdXf^d(X7`np&~rWY{!@0wF{H?x zTaY`|{!3+9_rI?kE?H)({o0Hvi`BC=ru&VbM(%Sr)C<(8lMr_SBNerz%ve%oH+hP; zfmoZ6UWcFZf_LjwN?9}H_7frqqvZUgVw)W31W0qHN9{8Ajj^($VRTOL44gq|qZ>~s zDx}b!ohIeM)~7*;k%noG_C{E)1pEL1k}u?`sVCC@x3U|gr>t_LLK`Qpvg~yXJrql& z;H#j|>Tsk5`{zdK)tuqo@!Gzz^+}^?JG;s!tXRKu zXtn^h`L12U-Ru_J?lRAz7rIjrh4{_Rh+X)4ue{I zXKA7#@&px$f996=#ra3>;+!Gcg)x8iT}70(p!kE{%qi84GwmkH6cQoF_Vpy+B z`OYkrx0gL~#T7D&FAGl>Thc5vZNO!~O}kq1S*r0B*2@=HF?|))=&GCd5^h?sw!E7T zdc&pokf0oftcp5(8pA#|moQFa^Ii*j)xJNL4u0o*DUjbZoXPUh-i7z0*+g3UKULrq z?f)(zX)I((ae^t)lL?V1FkkFPR z$rpJNF94(-wnl12?A^rgG_`=*4;WK~DZS;_7vy*P6CmQBgjPcE-xM|oq-ou)sZ5o3 zR7@qwR{p=r>HoueX$C(4;s|GsG$k9=Hv6^kdHu}B$X=|`E&G*I@T4}oJIt(w!ImpI zV25yTv*&_TYl0rN((SX{!z;$vd)A2EIuQW??8;wv3K|HoepLCI7VaAq#<%}I4Cn-fY>UaXwBO~&hBMNvg*9H4=knz*Qn&NQ3b;MJ^0szGR5Bo*N z;dS}ZDtIgu&Ojv*R#HBTCm7I3**s?bt1^7-`!@|O;y0n{O_%N;FB;fNnMP?g$w|&Y zsj!gSuISq>S?BOm;;u9SnB)Rl6^7A605h|U?`*X#+k=k^TSDybO zARGn>u@IM+Uh`07sXRMFVif{U@@{l-J+I;tu#?2qcJ4IckXP9oRczH1U5U0&m~yf6 z)&@xTci`fHt%bkD6=>+FkjRaMS*$`XG?tc{VT8Hq@J;zoAk~%^!FRi}rdWP={eRJR z82w_S`kWg>`aXsAF9VRIvh_Of@04SDXJ336tHdXuSxZ7)LOw;+a;+jc zaNX{59gTM%;yPmQt>4qsf7L+VARhh-rgNkeBey~QaCo%R{R4I>G7QGH>GQPEN)9r~mmI7|b&vi> zs{{or=_fT`p^-Ti02W?Rz&6cOsJiHrv|10iHN&p~HCBr`bhCxXgnZ#cO+cCe4IWYb zx%kNEKUg7<9%)Eeb)rceZeFL%((BBB6(HHy^G5zHI>0){z_a ze7LtrBXBF7SX&#TTL_{wl1LG4!CG(OBq|rcFx+mZQDmz(Yr1 z{Mpdcv?QhgBP)>k{4j=`O}>Az>3T4oQFNEvrTMOQV@ZmarIQzpxKdu+z#mr@M?5w9 zJk+Rad{8#>JgfwQ4Az0H3c;qI9R|hlec#^KuTukCxET{i^~ zxSkZ6CWt1hbQn5*{nC4uyCi8gWLM?W)Xo!2DxsKijOBM?)`zEUw;*7LrZveX-D_4{*FQNB8Z3eL*bT zx+Szv(>cLL6J_jAK0hC-Wg4Lsb6m^qJBYTto@$^vOTh?l_o1%bn2nx__|+`-Ii$t@ zOngivJ^r-{Cy8i2$<5f!?jzzx1EL11|LcnsfGB6ciC}=5w+a~a&sO{-zYSWVO<^cD zDn7C7uU!4(iK{@9Z@SlQEDF1@xX73Flk>VF`#Xu3eh z#nwiFak#+Cl0!941frssjDa7i{dyh}pyr8wbth?M!n$Ga$XF*s>*Y%I+IZ^Dxf#m1 zgTuiZ*{`5Rc{rFmf;CsU~j#tMG2fWMCJp zqtI=@Jw{O3F@Nu>52rW0O0f7-$I-EYpV6E3_wbJ0+V>Cg^h*ihTs{G*Zu8%yf-ouy zDs-C1QKS?pyj>IyWDX7Mi%WDuP5?_1{ z`DHWLn`PgBrLV+)^Ai9TONa>ge%JFW90c|HYFrmon_J&YhZE$=w^&rG`(MU^!VjU6 zEL+UE9+FH7>o@Kx0Whq2!Tcy2mSCh-zhnsIeKxHFBt$^mJ5?A|Yskf>MUg1?H>5G` zO>x01jMK<=#eH64bCQ`P;a7-A-!`o;{{VR+&?%@hGl-0eOJ=Czalrf}U{#<2vL5Q} zS-0laC^0WVV}kqCPQszuX_LO^Geu14RrIxfl_ZSO4~Ywb_1EyiDi^#$pQ(z#I|%LP zK+Crj#b{4sX12G+53u=()o116Hk4O$lu3E9uDd_D-PLB)6U2(-<%8WXc+I{NM_>E7 z+2aUlr7+vUhpFo7uyt0H@gL`*CgQCw!`!I$H@{|hrfOg9%lA|^-vT~q~@VhAtr z!tNKUh?V8jvC8h54>w1=*gMY4OK|9m+bh0XG#%j}_kLA&dK$nZn;Zru2KW6|EVk$Kh zpfqwfXO8G^tq8M|Ic0tA-dopPKQC^_@Yb9q=nNH+I$x*J>sk=cn@XV9F6$1&16L;lR)i{h4`WUE z_e67wy3C1GWEs5WD@JfalGS@D+y-17#JtM1Uo>a^u_EiMD|mXPJxJqih9vVbHc#qv zy_(rSq%+l|oLtbsb{F{wJA(3y>G^uSWVb5xXSdjX^pJ5`bi*_qsUqagI@V~o3;j}4 z-YdNv&`4D0V2kK%%EtJgJwAYZFXeGy{HmrX7_LrKdwLWcO>*_wrLtSG%yM@VCcdWY5Es&9n4Woiszigb}*wJ`0?3jan zGJtq8d@$Y}=y_!Yi;r^adB3jhKX41PCM*EEu3yFp>9N((``eaYQ&stqRk&7ETAp9k zqQ-bC+>W7H7^R{N4g1avcjY#P;&dK03E^p{^8zwF*9^(KT+*D6oY7K@lTI053hh-N z2}?yJ7i&PQTU_D%=8k7~Ryk;DZ`T)HAd4eFXYhOg68>7+6Z4*BJHKfexW4ImFXaRb zS`T?Lg^k=={d8@Ur@$*`kc{I~goMX+ubWcmKPn(`f?(_mSDzA%Sfu4y29N;GKq}rbJxBp9J_ZAM8KPc2K8PXqQ(a8SfBD+ z`9U8;F-hwL~^>a(~V84fe&wgdg^9Y;gBO61RjsZMLE$1VqKy_%IIwwpBr9&P)A8 z&ffeOm{O~HC6b!g>9Z~x{J5-!@2gb&nP&v~qSC(fh_Bwa4Ivg72%eZW+bQ__AFDF@ zp$XB#y%Z$-mPu8o3!J{&RAc2v|_jM zuSosd`#)IoU&b0$pb4eK1yrNtJ`aH$SQzR5AJ7cmnIy*s;BB9yt2lVUQhIh9(SMNq zZ{k(kT;zYCBZ27K=)2p6~pS`(=oB9dzNw zhU-hA!_2Cg+)ExX5*^1pN?!3N7V51;rec8Shen!Mas3y|XeTV~!ru45z~WxQsr?jd z^^G9sTK74=0T(toD0AlDYs%=jWOn8z)^!)m{@<(8z%HCyIW0x~3pvtb%&@*{c1Yuj z2ShZ2e0%708=6Y@O2qGLcRm7#&L~Q2s5fcW`+7|1^i3Mx<)8f~7xp6NR;rkq?4ke2 z0d9($2sW;hC?ka;5*W;3 ziGlvOFY7v&kXd$_m#RJr!Ixf_osoqc9VfW;R_+7t`R?mZ7s z*jvtTEyd2ihn|S}TtQ;fSX4(S&<%l2h`K3xlW_+ZqiJ63xcZ*4XsxCOj@N5v5bX() zILqzV4RCTdTI2Deu>M!1+Ui&9FCYTCyAxFN#f+gvT-_iEX+%oQRTG-p--ZQua-n8p z%&BKOpG;m@p*OpnVV4VP-yxldp_8rEtLhmn4xt{MQz6lszIpfqSm`gXEA&Ga=qDDp{8l$xQGIy8AQwXm*wEc*G-ZwKb%{A=e6tf8LTI}SZV** zqg!ZYK%Wjt^In!(b(bJ|vId5V^0yo=8>u5s@08FdLadwo zzxDg?}&r zt3Z;*9St4Z!tP{Mr-#n`tnX=ruTxmRtNW#6JrOSEe$6O#=u*qo&L5A=PqlVfrN#|Z zG)zdb7G62TUBhb?l1druol(gUa^6n5PJ(2s!Y*5yl%Hr|sPi5Kw#7a3uzofx%^{*IUWRt1^m@%03%l(8MOy_| zSAa7zXZE~X=bH~p)b5+fBY5z^VciZc!TZgEsrvi8Innr*`upA<(h)@&f>owMnE&3Y z-y2|qucmAQCe8Yc+bIFX^!sBFkvQN!f2?NF_a-`4)WW8)o+#2N-4J-e%Gw}C5+RX| zxJ{3poQx-pZ zs!AVw7@7O72ZartV+QGsGm}`bDz8>i~ zor#&=!lm;|?c7+Kp?|jjI{U^r7V#79eSy&vewlJSVABf)v^hiB*rcE#qdA#PNGOz| zgh>Y&JYBH?vj+xoVM(Mu`!_bDls?Qp^g^u#z<7YtOX=4z2|y?Ete`^9{WsNU*pqT-%H0`PKaX{pgV3~21c5GF*I^{z9-A@|LiN+tmEWF~3g7S1eX(MCC~zjyk= zHk(OuD3-2HNrFBxF(NxXd6|Am_y~tMWRkb?P6Nh_K8EJSH33GWirevoR-;0Rtvs^{ zg*h34iJoB;^VYqO)<@4TKH%wo8UrzIbZS$7(qvo9hFQ?sk~-DJzg@6%+#D6{1d>-H zF+fNdNQt23OiU1P^@z~Z)*rm?&Cysg97`z7!3iw7Llw7;0GMg&1uNL!st>)4<+YB{3{N8O zy5?U?*bC{{qe~ms4H-n(dZdKa$+QS&8za9eqJ{Ln<`NQNl(Sofe5vUBRYXV8G9T?T zzAGO1%;9A~1B{F=rYX`lTnxOqVN)U}jaslxzAuP4vW!M0FE1Vl;Kj)xbs0i3rP{lh zR!HD4@WTEEhkj7$NR=9r*TgrGnG~KL8j`@Ersl(IdQx)OToOjE9(WUu0ye!69SOSZ z#ETp)@4Gj-Xf~CEFH{w1(yY%7CgpJ9=MVj%1o$WIvc=p!PNMZw+~K1@;Aj+0R$`;2nVU zjj6g@+eme4>EkEFF=1gLd2aFex&T3M2{UAJdjlWDhCPYgw6wF33bP7Jv$qi!#l3== zhwW)691h_zw7j;f#4q^jSK4Tbr_sM8qhUqYjS~H4$TEq z?R-S3&_PH$H{ZgX75FTeq5lyPlBzf#Av(XQ5*`}~UUat}nk%o`n$|~8bD8be zzcpzor1C)oxRKEk?ngffci|I6Bt+#gxO4b0?3%Q6wlFUTP81x%mo@_fd0Ay=Yeah5 zKI)fh5()?c++uPsbKGrsY#D6osVQc#7BMj-U?S@D9}lLF^82p&Nev%c@szC~?qEgX zUZsYmb@7-BXfA2Puj+aZ;ZL-&E0P?MV(yfl0LkTn{y3_hiHO-F{}6V$&NHrwejnQJ_q68ss=>eWgUu3{ENzG1J}Nb`{WU`K)< ztMIFnAq zV&THA8ye#W$sk74Z=8&vxSGC_O?o46PCd$DzB-iRX5T@OfcIm9(UhuA2PWTyeBa)# z(;&SEWmP+hG9Ay)F#4@)e!npioRCfl*Yah^;5%jquMUHi6s`ub5Gue8I)Aa|16H0&z}eN^;NF4zR-J z^yM{ad|N-^2wnZCzVt^lEm6y3LT5f#k@)_Vi0rxMBi7hitdmzuwXqZK(Qtz8-?ARb zBWKJM?2@$uN)-2Id+aq$0kn}5%Szim0%D-r5Gj?^$kZkuOdKdewpNUw6YT;;!aYeE zA;TK|h&Zn4>?F2+{);=)WCWVUZQraELrjqMZ%i^TY{N9dh(#@}?NxJ(tmalEoScE( z!w#rY2EwGRO(-QVp-2z|%lV+yB5{qsbYevRbe^)yaK2%;iJIxkUQO{=?J%GVg=iOT zGJG(a&m*1j@)%5ed;N!WTS1l<(HI*I6KIb6TI!xMsXyXk_OED}d;@n=TR0pqI>-~3 z5A>6OLE8$_dfv67=;}D_G~P*we%q7ja+TS=A$d&IBuJdlW*7*Fn`8$CtbFfpdg!?a z+kJSHo$)n{Sn`%bKN>l{uysJAi@TN)-&bQb8!^7>4cZ^b)hFB=&+FN`=3ZM3$_SxD z)<2sFZf*ILkcNj5F0MB3srgZsfQEOX10(S`W2P7c3FWb|p-d-Jo`2k1?y#Q<8 zlQ>kNpQL>ZjHF_E^4^O1tl{8;*TrBMV-oj^M}Is?WI7@&x%$`hy2qV#=8~@(ZK$6y29DA{O*J;)vwsodjFd&+;C?i8 zb5l8prfaXOLm?vSfnLUS$MF?X*XN*Pz3dLQfA-uup(qEl2QOMO-&5NKLnF48wq?5$VKc=N`YMx|q zUe+8OJJcy#6f)kVzvV{=Rxir4I+ZBi85ne&CGPRiNpD-MxHa85Pu zu6&i)31?2Hp$+h0PJjYI^wu!$i4Ul8w`?|g;*=cPO5#LmE~k$eYNtz5YkuAq^zJGn zGa^_uw%fbi^v8+wH%5{-^O6bt*!EjqSk2=a_}gE_UNJ!1klHau^xl6&=kqsON*>^6 z^AHnAp(0C(6Qu6Pr{P=P=jJv9R($5pKaVSN-)^Rf)bKV!sr3TGb@EIr#Ul z-IZ!fu>BmwoS?bDvC)=N4y>42M7lFt z$87>e>!|lRF!J2l7iR=2NVB&IB8<8%K=N^f&e|L42i?m6t6Z2>V~PRio#wlZ(p#x= zh~Jh=tc9yrqfKVLwy#Kl5x;#Lh%ta#`|~?HILwtT_4J^tc?ud9cr4`z@f-r4&rF5+ zQnm`2;Xj^=FKFf+6s%c9`J+}oN5x1>3mdj^popv~yIZ+n*rjF0$UQ!2h~fGdP09}l z!TDSq4>Ilk+Nr)Mbhj+Y?y>?IWmGh5SIp0c|BaBoO~Bco=EnGQHp&5+HnN7G$Mnb5 zNiit%$lgW{bX6WkLFO?1R3EmM1(pf*@3 z(>Ikm$$@WoQy{rb;@PhI3Q`j8AlM*Z3PtiQ4WJgr5voMiII`i1kkinC&vX9=RoN

      }lnXWI6d?qYc<9mZxqs?kn6IPdZ3HrKZzVA)$rJck?JTlEyRCf1b&R%(^qrd8zxgW90COIWLpol{Dt4N?JCVsZk5LEOQoDAcc^Hw$0O? z({pX(;dV`Q%aWlEeQxAgo}J(7B4m@OGRKwX+^Y2L7Jed*KbrgU;RR>FD+a=FasRBT zQ|9?itUvASXO2_&t&_!q)rQRe$nO3caGa8u8JRV#-#FCjsW(OXuh`b{`F6WC2H${( zuA@WhOHTN;a@ut_X1!V-!jpc&@o7{^y%GFj){#12X;c|_-N{2oec~Jd`D&SMj*CyQ zVv;*y=V6!l4XbOs?d1J;Dl<3Iv$ui|#J!RZ^e*2MC*%6uHs`K>kw3RC1_my12%nwP zC9AkH&DNZzti2k-@t#{tR1ic6I}x)CY8hM|fxNqd@EE&>f+>rv@&JPmRVO|8K!BdB zR#0eYIEDlB1G}zaq#J?OR{E*XMF}T7BO?16w-~0(=TYb|UxQ9#C1BCVJRnAe(>>>T zZaxWOr0mfPGxJ4PeoZZ4UyONxSMj)&9c?Rp9WLNIQrsWbEX;_E z+`mWG*$&zpkt>X^)RM5QOx|3~Bxrt2lr<}X1Nu=8|LBNUG(ql2{l*fAjQ5eAOC+u~ zn_pv05_i-z?D{bi(`C72ZPrvsf9?D45hcGA@ShH#a;weT+1P}zach<&T}}R#hWro$ z@Bc%zdCSF4+^CcuoYw{0GxS!Fr+m9f(Hrv=z)GA@>GuzPX|B_WGPV^kEV~+*m%>dD zmzhzQb=oN4)kcSqlGY-8sU zLZwe?_f<9g<_XC0mg-%O89CJO-1vo!-EIg(tfjX4!-@Z5G>eX#yLs!hK<01k*R;B3 zglu8GK-Nc!3>QTTG9Xc0EA4}h)XjNA>4ygi%4Xl+sLB-}>pMKkd4#4jd$E-e)(6=+ zC=X8L!M}cVdClpAdGo$XK0cFs9Oew}-)y-rw~6w_d4R5nqq#Y&-^-G{gA;X`1r^1G zylq|eupuGJI(iWQ`R@ZWq~n%H*iwo>Yq)FYDc<=@w*lHb2P;^zCH0t8tt5!k{T8aV zX+E36VAe;BVxHETmbuWFo`8G7-T?AjHGz1aQ3Ypj{iV?7czJ`;8%b+t;mZTn1J2(W zvKa()mcJd;Op$M6z*`wrXcsjGea>p#os4Ba#QrS$rw?N4x@zd`HxSNYkJMRVDJ6*$1-&(0 zQO^iN^R?^=B*5Hy(lW~6oWkP6P>?uyjA{PKWOlwS!fz3T0V~IUwp`@b_MJYQw+#xsw5ANTMl+9c{;4qxzY*@cigehZtGJns7x&B+hxO+~A#%0*Q3 zZKMz}pPd#N$#q>wx&8iNru|Xrr4#xG1Hpo=p61iVK*4kLVM214My5g;L8!1;#H|Es z)7m@c_VXIPT&wShM$gr#<_zI9jI4xHh>6`cyuDNNkp$1bIA1emD<7Sy3|CAQuoge? zZW0}|o;WS}WiOcggXTO+P`WzQ`%|n(H0srwf91iICyN)FL?*jp167dLc4-9nKxPgp z&U;E&4!xao4v~MDVbXb9bVZBJA8FqE|R`+34jV1BmygSl7C&6&H6$#>J%`s?Daudj;1A|C3w^2es0vk<9mnj5}`pHBQEK1MbJ7 zpoY;Fc$(k;e2bAXbu9;&Y_gV`>3Qp&TJT;2*Q1)rSkXoc-SOc_`q zKS%>s6WScF=q-^rFqc!uRiZkN5@Cq1Z(QLzXh6FW;=}vy!o$gx0X*~Rnn!4viESRU z*C8tc+NYBc6vuMY9V|*phaj6EL)>MLDvmU#G$&rX zjJit5qzw6@Wh}7&U~+$~x<(vAgJ@ zCBVUUpr5HALkx3xjc$R8;V@>lyFyf~`@N!eFZSP|#h8v*+`M`y1n7#7u}$*ciO3mk#&E(k}Q2C|_qH?I$D>W{RPKYs#bH^QbXyIsl>k_PSq^qVRiTTt* zFvan~e?dC`EkIy0ugePh;A;2PIBrLH^iq#Wu39V)Z|I+! zTO0?xrRu<`?;~a^!`iA*J;d9|TsBAgn;iFc_t{)IH4COSY?~Sw_JYqChso|W+0o1) z2)DWY`3Ot)vIH^Q`pHoUU$l=Q<3v!m?QLt9Y-a(Hct}A$z?o91MBdbjjw??M-YA+) z4knQT-9H!U*|_%`$kSpuQ^$2RBc|8PT3uISU_{W?_|(d4E8#QOFRdQUzw<~N3yTHN zhEA1Cb#4*vhUwm!Od5E$9yN776h#UvVtHeqd!ZiZX6?s-PYT2oz*ZbKPet3tWqXC- zp`bcJr$Ns$XnEz3b==ti!9_|z7->U^{=>Bi!3?`ABlVJ$bYH67!3obuoiJ?^r|Vew zXF}fD7bi6en|>LtyCem>4NK_=#o%NuEg^B?W7aZ^NAeF8l}F$1X~sOnWBAWR&AuZm zWiupU^+;^$e*RTXsI|=gf7KpiCATk+y!Axsg zA#*fNliVM-PsKY5s6WVmu+yTRR3hrjzeTw`W0Y|uh`G~Ro)Z%7UC1r|)5tt5^(=he z1CS=DsP^bplx{VdGFrcy>P(Z_cOEx*uJy^uLXytv!&Nd6eIF@lIq*z%U``jKKqM@E z`Bu~$Sqk}9Iq%f>T`qJ%RX74;`$O(%0RHh26N^8#`+`L_YFKaFuC4L-ZyBLI;oN?L zwNgPWR*vCy|MOnH`Qi1OCnF!dJvy9TxTDq`ex=)=%F<>~&f}cbRrLo?A+*jH(9*V~ z-KfiK>j;W*XLbkyg_vQt1>1`P_HV16icHnw(g!cKu+WH&Z$rB|rI-7evidSZPTqoj zSxoG+O}EJ9Tn7_kt#`LR`)R&eq(5^QxB=w;!@5JNmm!HL{vR7qOFC-tJi3~ws8WR2 zt}8UHsL8zdJe1|6%{k;$?SM>r+hL4XM>-4{}utobI1bGCj!coJU0) ztv*g-6r@RJ^7-Zcs~aDy;@ zKn?8_?<^Cx^*+sN||QSOW8BR!IaIXgW+oo(z` z3;#*KtQ2| z$o{JoUv^T1=OZki!E$AFdhA1anw!&b9XVWtNM7u*vbMH}cqM8|h7cOtM{v2-C4pZArYON0<_p-Q^%oza9gJh2`jz5 z{sl??IfXQi?U|6Fe1m&NSg`|juI#e;@xko8qbp5fkjRNtz{e14e#YcrE1uRxKQHRC zcV0?rTGM+WUhV4EmGI_B-qa_9?P0IV`A=&DAPj&Zw`F9#d@Jc#j?OH@%p-BmdGzkK zs9tL|PdkcC?IOyXLsb^YDI}${@52d>Ox<}cUj8AK@IjD=jaW^5o`Pv_zV+2b?BR2! zlKRtB#wqIU%=Su+ZM+yWQcE`Oj|kty%OiEnQC77O3Xm|}A>psS+T3=E90x|YoQ{p> zRrWL_I?=Q`?VHzlQ_KV3i@Oe<IL$+Bby9=-{9nCKshj4r`R&Y zm$M%q^q?`<2cm@0d$ypXPNKQ>dA9M(0_MygpjPF>7==)b*wL_>P1Ye27j7;l2I5zS zlI`*I1n^m&nQW};5Ur)033vA}J$I zqKrfyE~53_V(<7vQC#9u49FOb5O#DFO(wwjhuy@TH+Xx5x-HMr*QnCEdw_7r=Z2r1 z|MJZe$sB@?!1Z$=A_Gm=$$4JJ<(i*-k*U7_lOPKjqAsw&APo>9C7|?3V^xBHSw))Z zV!?@P-T~b`*9oz3AI3X+6TE)H$Rq;NXqO2P_>^WrzhM>7f8Unx1}re+Pj3b+*>olh z9UzQK9kqUC=7D>^vM1C1s+jx&9rMG;%8F=UkezW#`0>5vfSN`t7>MisI{-U#kp%-a zkKLzv^GDAO@eNIH?bLd-2)Z`0s8ZC__2`^P1(#I;)>d{-*c>+kr>zCAgA#ZCQXGGX zX8-l=EaOh#%(RtY&swNFq5a_P0vAXk6{$O0L+|o0qaneN2LZ@nr`DnJ#R8cW_3 zMq^`5w%ra?xIXk`@qE!_$-4lgEWs=%r!WmvAxk;0%e7Qx7CL%g`CAx1urZ>dN9oLW zq*h_w+v^?DH+u6kItB~J(mmzMZJGX(gRt)=thZIylT$$GU(w2%Cdjp=ys1$=oRpE& zJd%Db2Rn{7Rdinws}V6j?A-CzJByfi1-*lH9ORGSJ7lB%>DtN97dCf^a-Tu$S= zb?yd%e10Mm&8FlU#o}f)U*y~5#TT9RCpR)e(KXC3Vn<+cHuQGKsFImq=p;_!KWyy= zn4s7@nYemCK(GeKM1R`Q6zdPootm+kg5LJAi)qIJl3jE z|0t>Yvzb@}ok)IeI%oTo0 zyx5#vzQn0m-8Sv=kfz5)UdnV75sW{aN5_I6YHb)Ddu^_^V-_$Oc^*u`L2zWv0(t5E zQ0d2&Y|9{+_ay9nSuIFgNC*E*ZP%aJ55YU}wW+`&r?<4jn!Z%yyL5uOZ1k`?tMACDIvLW8*vFTufc1 z>x%(C%s+Ns*_Ovz5@%+<(Q-Alm6EIh(&{=^V$d5D<3C#0g5^*b=LM6jTYfq-x9Ep+ z|JE~@4)Ur%SfJAjD?u{jP4=JpX|~=`5E|PYTm1{GuepOXDRk~G8?JOyJq&<0v8-gx zE7HiwWK4%Mw8)=N$S zfw*;^p!QNgdJgH)$U@KehV24-dW@1->u;F?q|N}7yIK0|9w{j~o~8`RPb!P%YuThP z@s0y22vt_<`IHDGs>-d5z%uB*-iwzstCY<;lv(WE3h&duFKr^hJDTn4i}TSwy3~^@ z*FZ%LHoplzGlUqkld%{*b;tnXo-6VroN{TFV|h(~_}T{Xh6r|W|LyYcb}U=86Q~iB z+w5iUq5K(7aR=HpA+g3qk?uL?SmEx@0-C=X<5-e&oM>9Z~|CP zg^X5qHdlS-RDQOs{!Mx&){E74&O{PxB^x_n-A(QxHz?LO`$HM0nM!CDQUSXiixm(q zj$2Gj#Ftk<82cx7bi|Q3XR^*t$J8i}=E@a?WLI6U!h+D{$xoZp!X_~nX>83eq2A3I z8hSPZ*+8OG(qpp7QkACi2L}Va3>7_X2dNBsQ63+QUJ2rs;$`S@ijH#!sg`>C`bY^m zBNY~|sK~v5Ir74UhZYAbOv%G|-pRa_t*iyvVhrw4tXdSZlD*HNl z#pQ@BEcPIEADsqFvO{9ca|Nw-r`(~C+jhnYeTK{re7t1C=#=iiQ3Ow6u#uZTIriiCT9SoAJfPqyc zRvYx5FB`mIKPj%Rm5JBSj1HNF{Y#IS3Lo-F)xQMV`j<;5$_48O3jo!Pxdb-@pEox{ zG2!Z3c_yNx{L90m z$?|KF6NDY@%_L%T2weOt0HY%9*5fra-s>0E$KqcI^J@IdkiwbWu319-6->d@D_-i5 zrv?B^t!@>}md?=MocE53P{fqRSWgn7;(&acl;fs-=6=;=1Jv~HY}DwirLHLZ zxYb-jK*p3)1=D7*Z2*|;=?%LYarg;0<@BR7i35)ZMW8kW6``uu>M!oWh~sz7`LpF= zWvf5-iwFgU!ynlmz^_^DJTTWO(({mccp@6D*SqA&4>J1&l8P(`j-%>Da5(ETP+k`0 zl3+wt(}(r+;m_g+t{}3iJtkdtdmWRpn=kTGlJkO6peai%uFC}j$|r&bFWNQ3m`hkaVhe33-ic}((@3%5S+SP7 zp|M~go6S@K=M`vDwPoS>^NTm}2G&~tod)Mes!Rb&ac7~+7mkZ9r|NT)muNGDs=c#J zWUQ%9@|uGk=w9e`&k-d)I|X?6M0+ z_8X&-*od(QoCSvI7JyE!*Px3=?t+aH!&8^enTA-6?LPsNfP;m(FcJrsto{a)4uJoa z*Jd0{r}vi0LHT;=emtFY`)@|vI?K`+YuMA2ENPD8X7uDHYajqw?b%Xf8CWEKC~(n# zNojkh7-b&2SVihXKM1KF;*smRV&8-3LocU!K5Zv$gIBNL`kp z&Q}>{H}eS$|6tlo4&*qlr!%2y*QEHAE@+Za$@ur)X67~F9q7R5iB&^=_KB_#5)*rK z+<4&GzIa%i_NIk1wIx{CNUhoI&%r(?^I1|e%d}s%dDw*J)fNteF-GCM+OYfEq&o<# zqf^KL_#3t4QfP-j1)%iCUmM95@2tC+*C~{!&p`?@ETw=3OuL-HAB5WHLht`j#qv}{ z%^VbcChbe?v?EH5;~}{7N8IiR7uXqxj|_)N*Qr($;-q3Db(}KNU8VSqWSM5gt&8Cb z%uGbGn|nceYHMO?97c*;ZS0MP95;z45!a)pLTnB-;VsAxJWAcNrZ8n#&nrzT^2LR< z+WNVW?~@=ny0-tX^XJ&$Sg^>FfQ+eEju6V)5ZTQAxv1U8z={wdt7}t`k6}2a2*8@5 zBWt(#EYqXtVz z`KI;dEJmH-V3ENX|#7<@S=%b?1SP>VuW%0lNQ# zGpGwx!sElWLFFeWI5_3lxYr1V)SqGuSItWeU!``t8^TNsf{U5NI8s<5+}vm^2OctU z*xK#8;zqRr&{;^YH?Ze*(!{V&^#Nq5bQcmTXErECa)`4nJr6a~bCDy*bsJVx&|8k6 z{QJ!xfQy}IanrM-Z2qq`9<-V_`_cT~pupreN8an$cePDGmvAQcp?OcD$K5bnS=OfT zFue3dXvG1h{Od&*O(vo&BcZrBb}|R1%ymV-21plawu0^K8QL}%@UG)&8#~R2BrHW& z-sE6Eup6)BKP$Y)!N3m`=Wj+vFU*dPhYvL5?xkb)hNl`@UVZ@^fVFuix+&&ao@$+)AR2fWd;f1TjT%=*;wez@2U} z=|f8PWG%v9mQo?M<|%W4G0MmZ_;Nj^aNSSVRLBo&JT~Xeq>?CcnHC#K_Z1Ncxcg;xidzX)EZrd0s{YVCT4r zorc6Br+fhY{cPxnHhdoLP2DyTlzW~~>dA`!1aO9Uub{nO{}tuPCQbo>2umCNU$5zP zEmLX~QgL8wWgKBfC6b|lDBAAMg5H-^r1meN4o8qyZzWa>XhlqwyB#yX>0){rikn_- zcQ&xeiy|yed7zMxhd;wG&Cl!C74s_BCDJL2wQParoSzhBM8b3?_{Bw!a|gcZkfcD) z$yJd4S*WgH48EloeHS=LT~>to-NyJ2#ow5gRPBCzieOvXiHC#VNW85IZXmu# z3!*q=1|V|{x_g>EBO|}Gm>_}Ur^ue9Om(`GQ$6ElpeM$_t!95bWoiE(CsaW(?YP-7 zFXHx(+Y2)v#%u??=??4IYcO|*hG~R^i9MpRLMxg`p06-lZzI1Mt_t8=-e5}3{1Tr3 zNz(Z=w2j}1s8(rX*Bz%9cxuzQGtcuIQjKFOm}NIDplj}t&QY967#>ycg9E9NZygIv ze%U4vcS|6T5GV;Luq-5us1q+;UWwf7FQ{vo4RiqlO>CMaNU_w@^|Z!V`Z#_xn@_-r z?BJP0x1+5xlPP53`@=;2UMroY04pZ9{cf7Uwbm*^{B51;zZ`qDd4iyi!aS6}+0c=@ zHbc;tG6Jb_rRWR^9R-*Hd7out{`=7HgP#w&_bYl({r1b4sqr1}n|F^W*c3#YMEodD zRR~Ey>_YuPJNiE9OOf&%Ct=Z?n555xJGYtGhbpR8FK%E9XF<~Gu(|5PI1!lg?VyC) z?jkj)W>~g=iD#omC$Fp$XG@?}-FP9gMFIa)CUJP1*lX^7LZfQb=q?@zm`3zaX5Sq# zfwcuER=3|Lc{*9scZ`b(EGEgNm_ztT1T3)g{Fwc9Gm^pLzOPBp^eT1fbkrp}&i z>S{B|#RX9OKuWOXphWX4B+B{jK)k_^|dZNq>OZJW>vOMiqOKo%= z-u4+i%f2x&;J&a-Vz4oy+_b+=2Hx1Xn;+h)!(|@_5%Nv~zS}JU~N}D z->1uwWV#Ux-1`=?y_pT96I}^dpCx>`o{U*eAdS5SRwNA*lf$FuiEDtjld#v_H+1Y+ ztOsLj1h&_In*5<8MpZWAA!V%b9K0Q=DvoBM3Bujg4JUH#5cbi0e-PTwdp#&7UbVnHGWA@$EJkUx6l&_ro_g2jxmN@^tl4yb6&_7j|Lg z%U871+e;wWmW=-w;|AW+>i>**J*X#(k8IzobkKbscI3pmf2Vwc*rIf}wLUzNvr4d0 zrv80zp370?US{f=WER0jys_Yw=@kYy?!n)awTI|v#aZvjTTMwAfqKL)`YMBfr6;Uv z$w@~iXyaFhYK#YhvcB7Or|PJLwB$*i>wU92D~0H~Ug6dMHv;tKZ zN`8p?(p3Sdsnnj^Ml@XBUaZ<%YRH6h+`S*%cE)T|R#;cRQ*}ofRLCUt64?_hoLxGR z`dOUXeqgvbKyPuLP+%B&Ly6@0W6{g-;>zoXMxVU(8z}Pm@p9OwJaG454k^?BNi+At zNQ>}=U-V6@Z#e+oZ#6v?=s8M!ke*}r2eh(ca17d~q5W$(OEhj#Vge!^yl87KMDXjp z3ityu_8FppcPvW89Hn{tPY9<{Wk%spz*x?9RGTVDzkA zg`T8(&)9C#cjU$ltl^nqZ;twHZk;vmHgViD*4X*mVG>B9Brh~evxZX^gd@qc4W`)d zMJYTI>a)xE;rtv%`k&EuCnN%;>Gv*QB}HtMvF8}Ar?~;%uNRCFO58}E@Y^B0OW`Xn z@?uO52S&N|k99xRzed)qj+_bKoBpL_+Z6YIH#vzl^hI;$a`0o>kK@yI6u+}-j+km~ zIv^T9zv*(J!XFZf01}>hr$GPbGEB^sT{XxuMohD>g>0LJdZ5nnNy1eWNnFkxx-J&9 zzlioXB=4vvX^MqwH*%)6CWFe$g3fFUk$Jto5?`l@u(y$_drdAPaOa+{vHSCiMI#Lp z56S@m5EA%lA+d(9R+9Qzr>bJOpy@;DZ?^ZHxGzo{1+O^G4H$9k$U(k*S{BGLHaVWl zI-!peE!!2k&eI|@fX*rMA8|pypf7RzW0gTvB-?e6E!gN5T}9SJM*fhA)}vgP=UZ{5 z|J`bYoS=hItaCLqE$!3GgM!)(){GQIQE0`Y=dv4rV;nGw+Rs;nV{Es4RHurfz)?J) zfqi5MMv6DFDwlWys125%>|oYtDwzc4!fZ9LFP0Ya!f& zWZCo1-s$ugx0uRh<9xRuSl?4OSo@?`w-xzo7Afi4b^z~oxwR8@ftUC|SBvQC5h0vJ znZJpeT1eUx)85bpp}1Qg-XK?JRGwtz_wV(wIi#B?!cO$HrKLR95h6?X>)~xl^?a1c% zs9AxK9-=KR)6SVdeujO4?qo+!p~A`kCSg1b!25sAHSh-pn2+D(#}MIfGD_N#bsy_z zL>E*}mP=~QHHwiBHCMt3DJQSne1@(oktY!?)8r4b?I|Btu(IvRv;8%BmDb6%+V}&P zJeK=Ch`~lI>q5*^E;NT1@r_uX1l%j`P`)Po>>Ar#iG4oU!HGa@V$AmpA!o`umrNzW z&A4qJFQc!MM~oNoxoTL$&x}s4Verg=nd661O@NYNV~|<{*zWMtf%7&xoyc0x<3T!{ zYB&ceq|x&qZKvuhbz{u+iD%Un1ZMmj?vUu`_ZrI_pGoxiZ_r=#Qi0)8I|eoX=luRB zySc;kKXBQl^#6s;ef|G+vGX9xKx0AeJLWpPfvU(QoicER`swi-u3Iazu8KMx;8 zjY4sO(W+C$?tbCGwub*r(-N$du{6|ayR`rNqtrvr!Qs{ac7^XD0@yhJyGJ_p|I3A- z6HVVf{Hk3*qWC`>^2yl7{c|1It4JL(!*t5=0n^Wq+pFW@yFs9wZXE^K?_t@U6y-3; zJO~$$A9>ma>CesA|Mi8$A5>f%2k`T=$>!0QR+{x^3Cs5|>#-&Ja_`zvV#~Gg+c|Y_ z@75Ra@}Ypg$D9WYC>AGi*2v+g+vhPbK7Cgh{Y{iljEqQ553XB5)O9Ho{BNDJ$4Y{? z61L2xMv>nS$(jTu#9I|jHTNUF&-n`~$0ooFlM*Z7$~AcZ^VPc3Af|QRYESk=fw~n! zwjJIjMvH@ri#AQmCxlz3;T19O%^TKUd%s8!&!b^$EeH@Ks}*K59^a3 z%5RTDYB-7_xdk;hfrKa*!BiY-&&L*({%Qu*{+brGzTe@+ zH23LTBhF9^nQ-n}5p3~VqVhL4@lE1yJx#mZIPw*mFh@p%%Pe-){z}YU?*Dm%tnSnw zpx@gBq>)55r%0?{(YhS=tBo2H;JZ>89@m zx^03sfX0o4H(hUEzjZeg(96&`P|5BT&Si{d@gtKSHq;fP{sa4qxeEudRixx?b-U*+ zSMLi%{@3F{P?4823mO_9TrM31(FYa2Pq3h#FNUGXgOV)+CamJ>0i^G@i{AWN1)E7+ z+=*ve*3{Q=C;**KfUagM?9u`&_bM4>dop)IKH4eF_rvPzg|t}m6AgG4WO^QgXF9pb z$w*8nI5_`nsr{u>_PwWLMulAZ$3r4TqpeS>VtTOfv$4iS;!ZHNmpWM(bQ)QcE8bKohd%(s}-{2|X#xcth%MBn*c zvOcEs>^#`JGhH^ARG)3IzdS&rY;8`EHI=yu&FiV~YoJAs>{Frf9re24N0J02Ts--- zrvJvmdx$!WnXNE zOOeAmr}Em`nBuFtaKv}J>1-C{%NcP1vKah0vi(7zT?MtaWDvX#dNYwhZA<#j?OxJA zRR6c3VjJ2>ayqWaYtZ#@yHgK#hzmD7IoMsgAY-R@>VD!cJt8@AiWKXZP|ZN~b$+!Jrhu%Hy*!YKyjmno8sHo(3B%CMWa1 zg4WLVnI(H~Q$OvR9DGDTbgx+5nK6t?AsZABDiwvJCgFtoHzv*&)-oY>pd$F>v4OK{ zB~Z#--h3_C_gyDx-dNC5&Pf!1R*k4ZQLT0zk;;1*1fyT}8aB}|gW4V>enb7xfHz%DnN5I)}lsw_c zk&(DXXWf*)ghs8k#)|SgbqP|i3rwO8=rlQl#1TNN08=}Vkn3t5quCC_h zfGJaol4yMTc3bU&(YDxs|F^G9>^Vo-4IHm`@g%ofYV30HVhvbEG8q0n+3d#7GW92V zHe0akE+;Z8`)U7+RJHuajaaZ=Yem!Y>qe7cO=?&y=2R@Ka_kQbuH-qtcz9cq%JQM! z0d0UWH@_G}3;R-6i?%Za`F7+wvJ9_Pj0VP$MlqLNVl4RG z)r^7t2FkwKs1@!yFf|heQDHMA(6OA;>JvYbz&<3Mt!htUm(C5rg?2Q58T zuQsn2Tb$y+T%u+?&T(jVS)g8f9XXo~n#|+XZPXy!9IpE3nSc}>I! z>qiohk@|AldLc=#^*OzMOcyNhrz_W?ko=e`lZa|QMIIr-;8sv;WTpHG7}ku6$hS8y z>S$T?dm7_UFWJ0>Dph=lpgk==!DkXrqouJvCQdlr?439Swl@%wwi#@R>76s=+1 zwcM3YTx=u;ojN)?B={z2riU_HT3J#UPV;eqYG!jnFJ0~XC`Y_G91eEKb@6?FjQMA- zybM6IW+x1~<4@0lL6RK&IL8eFb_=%JWGJlv!WIEhuK@1=k>M=`nC(|Kfp0=!7YmL| zApZ@zyXoU1DK$4vi>g|1dk6Vguc9Fcks`jYTmV^x7aS@9v*;fQN@ z#Gtv%x3r(6L9Ov7A%e`07%aKvd zOL_h_gfY&n#0wnn*pl7!G*4qzS~3Ggez$BV)U@=ku%Js!=5e}dgHQTnmW$>nuNR z5NBo0OCUo>2_x6NIeY_y6K?hB6WCNA&~fL&-evz8 z60t^43y1Wn3(TFZXx-;h!ECA!D?i0~+~YZ4TKq4vZv+QxfMnzG7Xk}B5@7IE2*+wv zc_6MPGwj1A-@^f*ZCTVxu-R}8xl0vqGGh^$hsSzvyx>zXWrO97j72=srq!;!X$O!UodV0S-soH5(M&nDAv*L9t+ zVkjKlLt3nn0qNH~vBYnxb8KW7LrPD zC_WQ+oG_3wgRGmCji!7K6VP_#x{KuAe}IFzR({^>wLWJDt!MmHH;RwC@UU@G>Q->Q zP+8-kikhj;0=rNM?KKor|I4?+ci0S$Yth>2eVhZCw@8+DAVX5y>PEIYDYnj{`)=~Y z>E3yn?knTPn{S2^b!}m86yoUl$YJ?JF+;WUNQ#H(eOjuCw;b7e{TdK#T>vH;lo7^i z-ZVG~33xG4jOI1}^aK7@LiAjLykHB4hJWD7HYQ5r>ak%;8wr_$GQ);p(p*JfioIe**uxO_3e#xpt#~ z5*0przdQFam5_dEf`$GeMQ1LO z&AIOV!Qef8+X##&6Ani5`pU9CMA-5C*wXr1WKVoGK#gI=IMiv|gmNt$V5{T{1?R{% zI#kFaxRra~B~!QjB*&ZL1V6dr;?f_BWU$!ORrbMY`ttZ~e#VNzEf$N93JIC{8xUO5 zi5lJ?p_A?4(Vm=cHTSp1={8pB^!1Lxu%#YOSLIhON|Jl2?qaIxtjbodN|h8`jDm}A zFjq26a6Omz`(5MdklX!hIgKad*o^J%y|A1fSv+7tD7ntH7Wh)ts>}p}!5+TWrMKFL-Fw&w_E2 z$vzsi?EHNuGIzo&S{n6CV-scB!~vYy6@%@PEIa)OSiIJ4TH z<6%$Tx!CeQqGergM^2QOlrgK34UxYeKuEpmJGk$R^|3{iWZHX(5En)Yx9$mVZopzH)!?EHf>ddE(r#v0p`!&&yp0R0Yrc0 z%!XbDAHK^7W&64ioWC8t6L0^BK-GPZN%>Gu7`4bcR5Z1)6XO!r*LElgC==g|MvlMEoo(bnEGOn%$ z?``Wx;-0GMImQ}7{nCB#J_1FldFBVjICDH$pOahdemKk!eZBlu&-fyy=TdB1WHnaJ zfBr)}Qky=^_4gU@hjb0^dXDsRTE1N!Uy1UDbIVzFUSDhJY)IR9VYfNMV%Exuk^A>i zf+W@)3oph}_AI7u=C2r>$FZY@SMQ&LMuEt2Fwf_$!#Gys!?^t4y?h zsrpusvFnS9s~5TFw?&2kx);|C;(QvCZ)6yz4nUH41hFgE96gayvrePi#DzcM*fU6? z#J_~WZqazVOK&}Elnpsl0E4eC&SEUPnEG?|jIA1wc9d$6d|qt1!k$QLyUQ^g{7FX} zdc7#hD{Y8jqQk>~VkN8E%tWj}0bVRzbbhifKXU^9d(x0!{wf0m{X3BUr3zPR?+`Es z-FX-FaPzVRD&mxCKa5KCJ~~zv50SZCLm(3E=B&nuVQrr7W(R%)8cHGYH=z@TCXd51 zVx1Q5FLCTJzZ|ijgU-1LwSw(%%{teS)o!Wa7gVgA_%>G;f7ni{%1xa|OxJ7%#*mgj zPr3n*`_IQ@IsAFXBFPkd<5j%sV+JB4`&QPXYp*Nzn?B$#MwjEF$utN4aTSSCMXyzG2C;W3hLyCvJC&M%2xh*EMv!vHxG&d*plZd_l_oLCwUI??HQ~%O61`7~71>71k^O27&N(cU7 zf4W~3i{iXbH+H&p>E7P-Xf_W|5N?$)6GKl~)baT@Y35oobK(v0y*w|(Ag)qPW2pcg zyh@m04SJu=DMPPT(T;hWrZqfl4$v`HXx-1PMDp^%UwL<$p}cRs3H7A>xbsN+(0zBaS=p$Z z-(u+RbusYGky`xY9($(85iy1$O74j8&VtQMtu>xbSlIUD$xn^cZlVnR+vS6LT6$h` zX4;}r_n+^6+(Kp>&1zN@J@?!i_3RWlt^Tpmm5wZXN}ot>#!j@}PXajiVwBeXCO{ZU z^p-n9O_EY~`mL336l$V_{dXn@^y|J`x<9%k07S-uq^WmJEK7*)VZjt3JI(@aGvDS+ z)ji169MwBRKP>3Fjih5NlPjbp1&eSS%$)t=a5_M+tu0#cg*yL`(dZu@{xRiWCbde^ zfB83_QM4;8geImLut0A!<|t+@h#*a)$Ou~XnW0I>DcFIB0Q2U{j?iJm$8Z^0!WK{kZ4uv-ogOGw+Ffqh00R|A(l~ zi+kLDEO)p-_dBEju>!P@AOX4KP@XBD)o4o1S0O@+8A?5c(N9aOR%}f?;z1GTwJ~ds zie#(D3kqio2}HP6DU@(f2iLssRfs?bRG&*awnbiv_n%j@Q^w37CJ8^8Vq^KM^Qri& z9UZ)@TtQb=3t1=fu*7&>^172(bBg@Y}0}$?zP)s)!OIB}sw+O>ZwngHcV8v1Qy&ZN5iKnH~(C zb%S+{l&@FOdig4rQQIlc;dB2$z4vVx68YG0c~~|Nx3;PdPxXnI>s`7AK1WW<;UOKL zkubMLRWxap3XtwTuJ>`*EcYNbN92n$ze+J7t6Qkq%=RY?v5yq@hFNHQM-+0jdS4aN z_z_$h@~2%E@qGl1!cQC~5MP!velpA~$LqSk`}L#iFl7PZnu9Xrs7t@`G1TlF&(i$O zGw(-1LOI|T;+E+fM>Sgtv9js4Y^S|6u|P3;G!eme=ovz8HnCSwdx3(CZxo|?J_5d? zT+}R@Dm#$9HC4eis9nUsyv94xo7RUXH3dlo6TX^6WJ%dVc=<1*%V&J#o3v-(84*!CKzK=aCtaZ4GJNqoU=^Zv45i!K5;F68M6a)^83{lV+Xt zbP}ZxIV?LCVIB?EN0-3m^~!?NYr>Axc`&VIp+a{VhwCKl;tg7|8PO=`;{`3z&bDK( zEPwQ3Wn|VJQ zR3hRy5q^L|$f!9@$*XLN8r?Uw>8PVr$=e%Sa2SZg4I^YoqLc7%e3Z}>K z={+_bCyax-Vri9F@&3;2{zHvp4teELr(M>x+)ov*yu{7M2bZvJ4Oaf`W}5ziu#0p~YY zdR+H&S&h&5^hmAH{dQ%jD$H&#YS5>sPOgGTUuo@TdN-}Wo1|@~VML+>W4Y(izT5R0 zqG9L@U=Y`fNJixSrJYIE`#j4jA9r%CRJI}W!x^9gJLJutJyTFS?T%)ffwpX1LrZyRs#!sQ9nfKSK>xc1iKIq zzOeCNo7yFOzncWVuHZAToKRG%cF)y8Ot^Yu(8|4uu-I(n=qwkeC-u~DMP$v(1Udff zA<%L`I+E-vp;WH0`k9EyL_+jVM!7Pyv4HY?4d4Vw9t7{VW`{biik2 zyx0X_m2)$2);{ku6f|C(xMhO<(5&_5^X!m{P*ZuJ{zT0W?s?F zb1hx=XTEN7!i(R(`gI{;Wk;1cF1F9!)h`fHpT_{rx33l$ow?-HPRDyLc$p$>E7P?k zhGRL`9$fz7T~L#6Xpgh4VK#6yzw7GZA6RJL+lH^>tAc4W*yTD~f_r#Q8LvlkdF2_I z=Ivhp@r1tpbTYB*9Wq;o)7EauWlawiW$a zpv9g-A*>Snfye=hS~+6lbF1~Ir*J2$A}G&2Owz=O+9mZ_PxyacFV(+0F$TouJVYv_!&nW;d0b5mJ> zd+UIJd{7_q_qV+w74z9bJVIhclaSi9%P<~O=o{>oAm?6D@l?%JJX?lBWFXV);+bTSK&b> z0gKb{`AUKob>P;J{rX71Zb(ZjZ;VR2k6v8Tgx2lLCCr<4HK=X0lDqL8PnG)++@!Ty zqK3;h?Vsaqo*}<@b6Zv5)xYm43(vwsk5R-dP5qD=hF}bd?E;;McofL z2(S}{A}7C0{I%rdVQbpSy+vE}J(@i6NEZ@iV{V@^l7w8r#q0%3zf&(E_DkP`onHvA$dt0*H6$@qC%oMSDWBST2&*pn35-zg+^>n14t719E$<&>f`d99m<@x^&z5jC%B6z{$ zObbEvE=1CQW%4?m2q3tD9v1(*20a;9iG6y{KlZDx;wAxeq6F`!?|8$b`{@QPSU{k!l_h70>v)l|!)e0~Phb7?gl4Qr+2+%K zBRh9!0K9(I1O$uH7bn%Sx*85y3LyN??^6(gPRb4YVci`=yEi;MGbCNerRMZ{Z>wkcClqt|62?Qx^3(u_y zTv3~p-lwrET{+x}F-F_oh>s@{vLCxf?UHR}I}ESl#@-O0`h)`d;CpJy5{O3HkTEHY zUo&+Q#{nHOM#t^Y)5xNMQ^x}vAu{4yw+H|`ctuFLn6k$gNm1=W%(W(a6@3ia8-MLs zbYvJe@C$`UH$N6vX~`nB;jSWWxk}dj==7v8%WcX(oy$r=^eRxlHlw=@@H%^An$0V! zwZsZzqa&_CRSXSx)ovaI)866qG(!BV@*vbhyOhZ)(LL+XCyTVJx0SXMKRgysz&oUlyV857GErobW{Ptb^fk!F@$8#iTcS~ zYC5aJC$i#s$AAjDhv>6i5v1&}Abr{LVA`mp1=84dA;3e^#ZlZOK8b0rlTY=fTxQ4< z4T4mZIl`X41B!@p?heY65i60A@YawB`U(}-5m$~B%NziPMyPq6KQ-6zljFDy*-?AJncR}^6Juj1S-HrcrxI^o5;Fs5>HQGe3J!&~ zJZ+*8gg;;6Xc@c07nD+7-*RJ?I|2b!C3m^CJhxZ#kZ*4Sj{XB|__FDKQ&67x+eT8E zb*pnRF|Y!t5M$F5*pgXDWG>={9td}NKMiOYVXmWXjb&12^0@5XKS z-NLG&&on9kN+6;! z7wGCCqxsGJ52#gICzrkz?C=AQiS&8j2xlDr7_xxOnMUaCJrFgvImEPUSzoSIdIfoX z|6>alNoxA-Cf(LaBSr-KObW#jlh2W;TIyufWGBN;L(yS4%Yb&*whPPKOqxo$PZ$%u%i@KBYZ!Z<*{j6oi zQp2Mei^7UlmdsWc$fw>G@r~u0Y35}MC89jaV7%b?PgLWUzMEg}&2vE|_X{|#6dv}> z%bxV)%gx;F{_db7mom*>ufHrTH1EMo0(s>LW4G!`{F#udi)&YgcB)zl zvw5g|O$8RT%8oi1Y#%LF*A?eR1Z62Z-R<@mM)jT@-0Ryx%~dOY-FeO$x`^#3V3Jj< zcX}$nMN9_RG+ zgxy!8GFx3k&70Ob3$0T_qqO+%NGa>G4|ItV`pO}c?`oPIwd?0pp%=tcH$X9|MV#H* zJFI~N1y?@U$_d8YCvVOEcp)`DKpVB-My5zr^~O zUwd`kJ+^k*Hf?JLtzF@vV#!odgl<9)?@cqMtqsCt9JbE-TKBU@-$uQPJod31!lJ^& ztg4FHs-z}X0vwU%wj*t&hq3+6p~5D!A~*r$lco@zZ@671r+_3zE~UJyQ`V~}w`AZN z|Ffe$FYp{u%JiM#%jKd+75$?Lb(RLo!sj|9ZwIScYzOx84{xR$kkPrZ{h z+K#gl$j03x3JrZn8~MF1^daF4461;WNvDs9srvH!8&Zuxs9oC-XeA3?=?fb;v`0wk zyGhXc7R?)1&eqw!E~3_{_&bi{vln~$zT=~fj1QS@}v20jYR_Fs^(~6`?K<2W)nlUG$ zpv?0(Dcf_8d^4B2Mn2H(j{BW2HoHN+_x(@q?vLk7zaid1VOJBedgn(fLyMM@L|6sZ z+%>%<+|2?`(*rQ(tbwx0yYEO`&U)RJTczWid+i1Oq^z7&Ji1V$AQ!~?1_BI?f*c2GbcNuqD2s=(5nTM7VZEqZYQB>Um$SM!C52fvaz%W~|te*Bd*005r5 zjzI;*Qf|nCC9BO&Hltj#c*4 Pb_1@%jSUK5PEr2>a_ga8 literal 0 HcmV?d00001 diff --git a/education/windows/index.md b/education/windows/index.md index cc96968ca3..ee04b99e62 100644 --- a/education/windows/index.md +++ b/education/windows/index.md @@ -16,6 +16,8 @@ author: jdeckerMS |Topic |Description | |------|------------| +| [Use the Set up School PCs app (Preview)](use-set-up-school-pcs-app.md) | Learn how the Set up School PCs app works and how to use it. | +| [Set up School PCs app technical reference (Preview)](set-up-school-pcs-technical.md) | See the changes that the Set up School PCs app makes to a PC. | | [Take tests in Windows 10](take-tests-in-windows-10.md) | Learn how to configure and use the **Take a Test** app in Windows 10 | | [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) | Learn how to deploy Windows 10 in classrooms; integrate the school environment with Microsoft Office 365, Active Directory Domain Services (AD DS), and Microsoft Azure Active Directory (Azure AD); and deploy Windows 10 and your apps to new devices or upgrade existing devices to Windows 10. | | [Chromebook migration guide](chromebook-migration-guide.md) | Learn how to migrate a Google Chromebook-based learning environment to a Windows 10-based learning environment. | diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md new file mode 100644 index 0000000000..f4966f227c --- /dev/null +++ b/education/windows/set-up-school-pcs-technical.md @@ -0,0 +1,262 @@ +--- +title: Set up School PCs app technical reference +description: Describes the changes that the Set up School PCs app makes to a PC. +keywords: ["shared cart", "shared PC", "school"] +ms.prod: W10 +ms.mktglfcycl: plan +ms.sitesec: library +author: jdeckerMS +--- + +# Technical reference for the Set up School PCs app +**Applies to:** + +- Windows 10 Insider Preview + + +> [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] + +The **Set up School PCs** app helps you set up new Windows 10 PCs that work great in your school by configuring shared PC mode, available in Windows 10, version 1607. **Set up School PCs** also configures school-specific settings and policies, described in this topic. + +If your school uses Azure Active Directory (Azure AD) or Office 365, the **Set up School PCs** app will create a setup file that connects the computer to your subscription. You can also use the app to set up school PCs that anyone can use, with or without Internet connectivity. + +The following table tells you what you get using the **Set up School PCs** app in your school. + +| Feature | No Internet | Azure AD | Office 365 | Azure AD Premium | +| --- | :---: | :---: | :---: | :---: | +| **Fast sign-in**
      Each student can sign in and start using the computer in less than a minute, even on their first sign-in. | X | X | X | X | +| **Custom Start experience**\*
      The apps students need are pinned to Start, and unnecessary apps are removed. | X | X | X | X | +| **Temporary access, no sign-in required**
      This option sets up computers for common use. Anyone can use the computer without an account. | X | X | X | X | +| **School policies**\*
      Settings specific to education create a useful learning environment and the best computer performance. | X | X | X | X | +| **Azure AD Join**
      The computers are joined to your Azure AD or Office 365 subscription for centralized management. | | X | X | X | +| **Single sign-on to Office 365**
      By signing on with student IDs, students have fast access to Office 365 web apps. | | | X | X | +| **[Settings roaming](https://azure.microsoft.com/en-us/documentation/articles/active-directory-windows-enterprise-state-roaming-overview/) via Azure AD**
      Student user and application settings data can be synchronized across devices for a personalized experience. | | | | X | +| | | | | | +\* Feature applies to Windows 10 Pro, Windows 10 Pro for Education, Windows 10 Enterprise, and Windows 10 Enterprise for EDU + +> **Note**: If your school uses Active Directory, [use Windows Imaging and Configuration Designer](set-up-students-pcs-to-join-domain.md) to configure your PCs to join the domain. You can only use the **Set up School PCs** app to set up PCs that are not connected to your traditional domain. + +## Prerequisites for IT + +* If your school uses Azure AD, [configure your directory to allow devices to join](https://azure.microsoft.com/en-us/documentation/articles/active-directory-azureadjoin-setup/). If the teacher is going to set up a lot of devices, give the teacher appropriate privileges for joining devices or make a special account. +* Office 365, which includes online versions of Office apps plus 1 TB online storage and [Microsoft Classroom](https://classroom.microsoft.com/), is free for teachers and students. [Sign up your school for Office 365 Education.](https://products.office.com/en-us/academic/office-365-education-plan) +* If your school has an Office 365 Education subscription, it includes a free Azure AD subscription. [Register your free Azure AD subscription.](https://msdn.microsoft.com/en-us/library/windows/hardware/mt703369%28v=vs.85%29.aspx) +* After you set up your Office 365 Education tenant, use [Microsoft School Data Sync Preview](https://sis.microsoft.com/) to sync user profiles and class rosters from your Student Information System (SIS). + + +## Information about Windows Update + +Shared PC mode helps ensure that computers are always up-to-date. If a PC is configured using the **Set up School PCs** app, shared PC mode sets the power states and Windows Update to: +* Wake nightly +* Check and install updates +* Forcibly reboot if necessary to finish applying updates + +The PC is also configured to not interrupt the user during normal daytime hours with updates or reboots. + +## Guidance for accounts on shared PCs + +* We recommend no local admin accounts on the PC to improve the reliability and security of the PC. +* When a PC is set up in shared PC mode, accounts will be cached automatically until disk space is low. Then, accounts will be deleted to reclaim disk space. This account managment happens automatically. Both Azure AD and Active Directory domain accounts are managed in this way. Any accounts created through **Start without an account** will also be deleted automatically at sign out. +* On a Windows PC joined to Azure Active Directory: + * By default, the account that joined the PC to Azure AD will have an admin account on that PC. Global administrators for the Azure AD domain will also have admin accounts on the PC. + * With Azure AD Premium, you can specify which accounts have admin accounts on a PC using the **Additional administrators on Azure AD Joined devices** setting on the Azure portal. +* Local accounts that already exist on a PC won’t be deleted when turning on shared PC mode. However, any new local accounts created by the **Start without an account** selection on the sign-in screen (if enabled) will automatically be deleted at sign-out. +* If admin accounts are necessary on the PC + * Ensure the PC is joined to a domain that enables accounts to be signed on as admin, or + * Create admin accounts before setting up shared PC mode, or + * Create exempt accounts before signing out. +* The account management service supports accounts that are exempt from deletion. + * An account can be marked exempt from deletion by adding the account SID to the `HKEY_LOCAL_MACHINE\SOFTARE\Microsoft\Windows\CurrentVersion\SharedPC\Exemptions\` registry key. + * To add the account SID to the registry key using PowerShell: + ``` + $adminName = "LocalAdmin" + $adminPass = 'Pa$$word123' + iex "net user /add $adminName $adminPass" + $user = New-Object System.Security.Principal.NTAccount($adminName) + $sid = $user.Translate([System.Security.Principal.SecurityIdentifier]) + $sid = $sid.Value; + New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\SharedPC\Exemptions\$sid" -Force + ``` + + +## Custom images +Shared PC mode is fully compatible with custom images that may be created by IT departments. Create a custom image and then use sysprep with the `/oobe` flag to create an image that teachers can then apply the **Set up School PCs** provisioning package to. [Learn more about sysprep](https://technet.microsoft.com/en-us/library/cc721940(v=ws.10).aspx). + +## Provisioning package details + +The **Set up School PCs** app produces a specialized provisioning package that makes use of the [SharedPC configuration service provider (CSP)](https://msdn.microsoft.com/en-us/library/windows/hardware/mt723294%28v=vs.85%29.aspx). + +### Education customizations + +- Saving content locally to the PC is disabled. This prevents data loss by forcing students to save to the cloud. +- A custom Start layout and sign in background image are set. +- Prohibits Microsoft Accounts (MSAs) from being created. +- Prohibits unlocking the PC to developer mode. +- Prohibits untrusted Windows Store apps from being installed. +- Prohibits students from removing MDM. +- Prohibits students from adding new provisioning packages. +- Prohibits student from removing existing provisioning packages (including the one set by **Set up School PCs**). +- Sets active hours from 6 AM to 6 PM. +- Sets Windows Update to update nightly. + + +### Uninstalled apps + +- 3D Builder (Microsoft.3DBuilder_8wekyb3d8bbwe) +- Weather (Microsoft.BingWeather_8wekyb3d8bbwe) +- Get Started (Microsoft.Getstarted_8wekyb3d8bbwe) +- Get Office (Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe) +- Microsoft Solitaire Collection (Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe) +- Paid Wi-Fi & Cellular (Microsoft.OneConnect_8wekyb3d8bbwe) +- Feedback Hub (Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe) +- Xbox (Microsoft.XboxApp_8wekyb3d8bbwe) +- Groove Music (Microsoft.ZuneMusic_8wekyb3d8bbwe) +- Movies & TV (Microsoft.ZuneVideo_8wekyb3d8bbwe) +- Mail/Calendar (microsoft.windowscommunicationsapps_8wekyb3d8bbwe) + +### Local Group Policies + +> **Important**: It is not recommended to set additional policies on PCs configured with the **Set up School PCs** app. The shared PC mode has been optimized to be fast and reliable over time with minimal to no manual maintenance required. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

      Policy path

      Policy name

      Value

      Admin Templates > Control Panel > Personalization

      Prevent enabling lock screen slide show

      Enabled

      Prevent changing lock screen and logon image

      Enabled

      Admin Templates > System > Power Management > Button Settings

      Select the Power button action (plugged in)

      Sleep

      Select the Power button action (on battery)

      Sleep

      Select the Sleep button action (plugged in)

      Sleep

      Select the lid switch action (plugged in)

      Sleep

      Select the lid switch action (on battery)

      Sleep

      Admin Templates > System > Power Management > Sleep Settings

      Require a password when a computer wakes (plugged in)

      Enabled

      Require a password when a computer wakes (on battery)

      Enabled

      Specify the system sleep timeout (plugged in)

      1 hour

      Specify the system sleep timeout (on battery)

      1 hour

      Turn off hybrid sleep (plugged in)

      Enabled

      Turn off hybrid sleep (on battery)

      Enabled

      Specify the unattended sleep timeout (plugged in)

      1 hour

      Specify the unattended sleep timeout (on battery)

      1 hour

      Allow standby states (S1-S3) when sleeping (plugged in)

      Enabled

      Allow standby states (S1-S3) when sleeping (on battery)

      Enabled

      Specify the system hibernate timeout (plugged in)

      Enabled, 0

      Specify the system hibernate timeout (on battery)

      Enabled, 0

      Admin Templates > System > Power Management > Video and Display Settings

      Turn off the display (plugged in)

      1 hour

      Turn off the display (on battery

      1 hour

      Admin Templates > System > Logon

      Show first sign-in animation

      Disabled

      Hide entry points for Fast User Switching

      Enabled

      Turn on convenience PIN sign-in

      Disabled

      Turn off picture password sign-in

      Enabled

      Turn off app notification on the lock screen

      Enabled

      Allow users to select when a password is required when resuming from connected standby

      Disabled

      Block user from showing account details on sign-in

      Enabled

      Admin Templates > System > User Profiles

      Turn off the advertising ID

      Enabled

      Admin Templates > Windows Components

      Do not show Windows Tips

      Enabled

      Turn off Microsoft consumer experiences

      Enabled

      Microsoft Passport for Work

      Disabled

      Prevent the usage of OneDrive for file storage

      Enabled

      Admin Templates > Windows Components > Biometrics

      Allow the use of biometrics

      Disabled

      Allow users to log on using biometrics

      Disabled

      Allow domain users to log on using biometrics

      Disabled

      Admin Templates > Windows Components > Data Collection and Preview Builds

      Toggle user control over Insider builds

      Disabled

      Disable pre-release features or settings

      Disabled

      Do not show feedback notifications

      Enabled

      Admin Templates > Windows Components > File Explorer

      Show lock in the user tile menu

      Disabled

      Admin Templates > Windows Components > Maintenance Scheduler

      Automatic Maintenance Activation Boundary

      12am

      Automatic Maintenance Random Delay

      Enabled, 2 hours

      Automatic Maintenance WakeUp Policy

      Enabled

      Admin Templates > Windows Components > Microsoft Edge

      Open a new tab with an empty tab

      Disabled

      Configure corporate home pages

      Enabled, about:blank

      Admin Templates > Windows Components > Search

      Allow Cortana

      Disabled

      Windows Settings > Security Settings > Local Policies > Security Options

      Interactive logon: Do not display last user name

      Enabled

      Interactive logon: Sign-in last interactive user automatically after a system-initiated restart

      Disabled

      Shutdown: Allow system to be shut down without having to log on

      Disabled

      User Account Control: Behavior of the elevation prompt for standard users

      Auto deny



      + +## Related topics + +[Use Set up School PCs app](use-set-up-school-pcs-app.md) + + + + diff --git a/education/windows/take-a-test-multiple-pcs.md b/education/windows/take-a-test-multiple-pcs.md index 742aed682d..64dde75a76 100644 --- a/education/windows/take-a-test-multiple-pcs.md +++ b/education/windows/take-a-test-multiple-pcs.md @@ -11,7 +11,7 @@ author: jdeckerMS # Set up Take a Test on multiple PCs (Preview) **Applies to:** -- Windows 10 Insider Preview +- Windows 10 Insider Preview > [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] diff --git a/education/windows/take-a-test-single-pc.md b/education/windows/take-a-test-single-pc.md index f62fa9805b..e1c6bb189c 100644 --- a/education/windows/take-a-test-single-pc.md +++ b/education/windows/take-a-test-single-pc.md @@ -11,7 +11,7 @@ author: jdeckerMS # Set up Take a Test on a single PC (Preview) **Applies to:** -- Windows 10 Insider Preview +- Windows 10 Insider Preview > [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] diff --git a/education/windows/take-tests-in-windows-10.md b/education/windows/take-tests-in-windows-10.md index 1360d736f4..7d15a79d72 100644 --- a/education/windows/take-tests-in-windows-10.md +++ b/education/windows/take-tests-in-windows-10.md @@ -11,7 +11,7 @@ author: jdeckerMS # Take tests in Windows 10 (Preview) **Applies to:** -- Windows 10 Insider Preview +- Windows 10 Insider Preview > [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] diff --git a/education/windows/use-set-up-school-pcs-app.md b/education/windows/use-set-up-school-pcs-app.md new file mode 100644 index 0000000000..2e0fd6199b --- /dev/null +++ b/education/windows/use-set-up-school-pcs-app.md @@ -0,0 +1,142 @@ +--- +title: Use Set up School PCs app +description: Learn how the Set up School PCs app works and how to use it. +keywords: ["shared cart", "shared PC", "school"] +ms.prod: W10 +ms.mktglfcycl: plan +ms.sitesec: library +author: jdeckerMS +--- + +# Use the Set up School PCs app +**Applies to:** + +- Windows 10 Insider Preview + + +> [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] + +Teachers and IT administrators can use the **Set up School PCs** app to quickly set up computers for students. A computer set up using the app is tailored to provide students with the tools they need for learning while removing apps and features that they don't need. + +![Run app, turn on PC, insert USB key](images/app1.jpg) + +## What does this app do? + +The Set up School PCs app helps you set up new computers running Windows 10, version 1607. Some benefits of using this app to set up your students' PCs: +* A computer set up this way is tailored to provide students with the tools they need for learning while removing apps and features that they don't need. + * Places tiles for OneNote, Office 365 web apps, Sway, and Microsoft Classroom on the Start menu + * Installs OneDrive for cloud-based documents and places it on the Start menu and taskbar + * Sets Microsoft Edge as the default browser + * Uninstalls apps not specific to education, such as Solitaire and Sports + * Turns off Offers and tips + * Prevents students from adding personal Microsoft accounts to the computer +* Significantly improves how fast students sign-in. +* The app connects the PCs to your school’s cloud so IT can manage them (optional). +* Windows 10 automatically manages accounts no matter how many students use the PC. +* Keeps computers up-to-date without interfering with class time using Windows Update and maintenance hours (by default, 12 AM). +* Customizes the sign-in screen to support students with IDs and temporary users. +* Locks down the computer to prevent mischievous activity: + * Prevents students from installing apps + * Prevents students from removing the computer from the school's device management system + * Prevents students from removing the Set up School PCs settings + + +## Tips for success + +* **Run the app at work**: For the best results, run the **Set up School PCs** app on your work device connected to your school's network. That way the app can gather accurate information about your wireless networks and cloud subscriptions. + > **Note**: Don't use **Set up Schools PCs** app for PCs that must connect to enterprise networks or to open wi-fi networks that require the user to accept Terms of Use. +* **Apply to new computers**: The setup file that the **Set up School PCs** app creates should be used on new computers that haven't been set up for accounts yet. If you apply the setup file to a computer that has already been set up, existing accounts and data might be lost. +> **Warning**: Only use the setup file on computers that you want to configure and lock down for students. After you apply the setup file to a computer, the computer must be reset to remove the settings. +* **Turn on student PCs and stay on first screen**: The computer must be on this screen when you insert the USB key. + +![The first screen to set up a new PC](images/oobe.jpg) + +If you have gone past this screen, you may have to reset your PC to start over. To reset your PC after you have completed the first run experience, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**. +* **Use more than one USB key**: If you are setting up multiple PCs, you can set them up at the same time. Just run the **Set up School PCs** app again and save the same settings to another key. That way you can run set up on more than one PC at once. Create three keys and you can run it on three PCs at once, etc. +* **Start fresh**: If the PC has already been set up and you want to return to the first-run-experience to apply a new package, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**. +* **Keep it clean**: We strongly recommend that IT avoid changes to policies unless absolutely necessary, as any changes can impair performance and sign-in time. Get more information at [Set up School PCs app technical reference](set-up-school-pcs-technical.md). + +## Set up School PCs app step-by-step + +What you need: + +- The **Set up School PCs** app, installed on your work computer, connected to your school's network +- A USB drive, 1 GB or larger + +### Create the setup file in the app + +The **Set up School PCs** app guides you through the configuration choices for the student PCs. + +1. Open the **Set up School PCs** app and select **Start**. + + ![select start](images/app1.jpg) + +2. Choose **No** to require students to sign in with an account, or choose **Yes** to allow students to use the PC without an account, and then select **Next**. + + ![account required?](images/setup-app-1-access.png) + +3. Choose a Wi-Fi network from the list and then select **Next**, or choose **Manually connect to a wireless network** to enter the network information yourself. + + ![choose network](images/setup-app-1-wifi.png) + + - For a manual network connection, enter the network name, security type, and password (if required), and then select **Next**. + + ![enter network information](images/setup-app-1-wifi-manual.png) + +4. Insert a USB drive, select it in the app, and then select **Save**. + + ![select usb drive](images/setup-app-1-usb.png) + + + +### Apply the setup file to PCs + +The setup file on your USB drive is named SetupSchoolPCs.ppkg, which is a provisioning package. A provisioning package is a method for applying settings to Windows 10. When Windows 10 refers to *package*, it means your setup file, and when it refers to *provisioning*, it means applying the setup file to the computer. + +1. Start with a computer on the first-run setup screen. + + ![The first screen to set up a new PC](images/oobe.jpg) + +2. Insert the USB drive. Windows Setup will recognize the drive and ask you if you want to set up the device. Select **Set up**. + + ![Set up device?](images/setupmsg.jpg) + +3. The next screen asks you to select a provisioning source. Select **Removable Media** and tap **Next**. + + ![Provision this device](images/prov.jpg) + +4. Select `SetupSchoolPCs.ppkg` and tap **Next**. + + ![Choose a package](images/choose-package.png) + +5. Select **Yes, add it**. + + ![Do you trust this package?](images/trust-package.png) + +6. Read and accept the Microsoft Software License Terms. Your last step is to sign in. Use your Azure AD or Office 365 account and password. + + ![Sign in](images/signinprov.jpg) + +7. Select **Use Express settings**. + + ![Get going fast](images/express-settings.png) + +8. If the PC doesn't use a volume license, you'll see the **Who owns this PC?** screen. Select **My work or school owns it** and tap **Next**. + + ![Who owns this PC?](images/who-owns-pc.png) + +9. On the **Choose how you'll connect** screen, select **Join Azure AD** and tap **Next**. + + ![Connect to Azure AD](images/connect-aad.png) + +10. Your last step is to sign in. Use your Azure AD or Office 365 account and password. When you see the progress ring, you can remove the USB drive. + + ![Sign in](images/sign-in-prov.png) + + +That's it! The computer is now ready for students. + +## Learn more + +See [The Set up School PCs app technical reference](set-up-school-pcs-technical.md) for prerequisites and provisioning details. + From 6bebf4c3a5aa88dca328bbac824c9fe28dcb9933 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 26 May 2016 08:46:34 -0700 Subject: [PATCH 423/439] fix link, art --- education/windows/images/license-terms.png | Bin 0 -> 184465 bytes .../windows/set-up-school-pcs-technical.md | 2 +- education/windows/use-set-up-school-pcs-app.md | 4 ++-- 3 files changed, 3 insertions(+), 3 deletions(-) create mode 100644 education/windows/images/license-terms.png diff --git a/education/windows/images/license-terms.png b/education/windows/images/license-terms.png new file mode 100644 index 0000000000000000000000000000000000000000..8dd34b0a18da1dcba98834674bed57d26c3f3b79 GIT binary patch literal 184465 zcmcG$V|XS_|1BC#Y}>XcwryJz8+Sb69oxo46JsW}t%+^xj=kr3-uJ)H*aOalwSH?=N2(}EBf;atgMon|$;wEmfq_9Vf`NhS!9xGd5!{C^|9b#;Q{ zOE70s8%K9$M@x57PG(kSUVDxJB`~nhAXy1f4S>;kCrl3J;G)o*!sfQO zp2j^`5X}U%rAE3XBGg~ye`yb&vy%d|Q(sT{b2a}~zUve{PQl10C7ieCv6@Z}xogoV zf6Unu>GsnjT$Hfc+$JGQ^ly`?b!Lmh=^rrx;^N-gp#Yg?#u0Txjwt$dFgjJo}q-3 zl|>Wi!pj!M2j*Rzf*}v7|NCA8<=?#f$T=9K8@5+&Icu(RAT(T|e94XhO~_xdJG~IN z1HB0pnE5t7D>&K=U}YPY>yN8vukF2aev}-8zUfJPYepbr{(w$OvZcXaj2cRayGOH~ zxy@mD3qn`s*M0oOQIYEUVV;W)jHIx62LbPfOej5`3D>a|BgZuX4B;p>iYt4c{34d?a zU-uS9CZfA=m6OwdB9*!UzVsR0z_vC=&(Fx6l*%wLEmzOPO_TFEzrsPrASyNC?@Fq- z5KDvi7Tw52nMk3(D6#Pb`=|Aczk|!1Deu)xFc=YEA*&T>-pDv&SlB46L|^&)#GxO7 z)_>kFi@^szw%Ez-r$l#cs}5!0sxZY~{H}o0>)2aN6ewZQ-M)9utSKChHX*INxb(F$NB^NHm!m9ALO?qE1^LWr->| zDh~1pQ-?5}(Z8R8f%lVq=mAUr$z2T-ul_(a*a-bi_!lupu7gxx>2+R#{4qeo$b#@V zS#u_cp`+Pn>e|5b*pGZ`rLBw)G%|N=eR2c8)Tj@UeNK50IWghBlmO6yt`M z!jK@Kc3XjQkDOuS61{CUR#>dDZ>6GrCh3?AX8~TGqPZKnDf#C!kX@X@rUdbW-SWCQ z*s>!-Mz>iN*Mwzu-s+oQ_L66io!<|?sOqRr*OI&+F@c)eiQ4!DWoEvW&B%@N35xs( zQzPWMpWdov5jF!-;161)p;CR8WYxzSeV)CpD~M9(0^0DvKVQ!1nL1%h7L+vTxxZzW z2nhVQos8e6VdcNqs&5mJeXdPJ@euR5HEw<%yo#54UIm)!3S;qicVP5FZ**g)uummy z(q+7lIfsU4)}MyJUEAkJJ(k^-g@DG&MPXh~<{?!YUeI`&l?GRpokaKW6Dj%Jdy-J3 z*AuNEAATJ6QCUR9oj#a4s5ZT+E^`ZqH$9`6gEDG1?`d#07q?wTg^$9DER816nYuvlrjqF$Br;havg@^vBg+ zg?sdy(;D5QZgza?^(X;fwH-rvGKLNZLi+i4){92#oV*Dux|RAy?DXe^nu59&K;pg& z+%P-I6_BZZ)!C)nGs<3thPhDdo|@uS`7Q*Jn7OSQIO7(-`B-gDR}l(l<^hd-ZHYsIsC2-R(rbpC4&eQT&`C zt9x}h0_@um9?deoaALV+iF1nY>(D7N8d zhpN9l;N=cCVpB3q2n_+k_WJn+{+E(x`?y!T2LBlgnnR(#26zW8bwOEB1~5wNy02M) zrg>aQAz2AJn%n1R(|ym*(ysfQWB#@K1?y$>T1m3`N_YDKM!5;MU%Ec z?|K7N?Ci~Xyj6ouZM1>Qb(I}*oimTLK3t*U2Z-$WvljcqA{Vsi zh$@$;oN};3H1hGJoy)R`%bbJp$6ZkGuA z%hX|de$1QhzA}JQIP7(6YUspG=i$a6Bbm*3j|u#VKpNCU!eEO!U_186sDESSteTQp zyvoLCGg)0)QxQut^Wdr9(ZL?GOrxsn`e!;88{C3Um)421=x=nwx2oZdTYq!K4UK^k zf#S_|L_Ar+g_*+IJ3L{)qQS(o@5%ET+6F3?-Q@5H@i|a=h7pbP>QP_xF0e3a zb%JXtbt1D&tN@R?mtlRFMWo4;kdXb@v4QOJ&bMdd-U`!nQ^0Pg%|NV|rkcn~;!K3- ztzI}h(;ES|ONq1Lz+O>4hfr1;np>oF8mR#nm#r(rchqnCI+3M{7%q1q^)pTWU&_%g zsYu=1_JCe}US6KPM|R4)c_=#A1aLrsO9u~=LEmDN@7UVPSzl%{7b#TvZhL8)a`{MJ zsRAkX5@#f5R7vuL;O7s|2b-fG)$+Fkm-fW^Kp(aRt8v;ikHg2z_p=8l-n0q~*L-*M zFh0pm)q$R1=$Fsn&npK}8_3=K_-FA)W^?+K{AS`SxXo_EK00g;V6J0C*4$B{B}$yX z7Pqs0|Eha8K^{AJNRM=7^1Qp$B9Sjek}4Yx=&e6D3msc6i2sB%CDXMvpn)E?iBD6< z*}0BW-vn^eOvonIjWAV!=%I$CdtNr6nz9?fUOh`7Oq)VPfhbpJkjYZ{Qadr2Fvn&x7LQ?c504UKY=!!L6o6@U}Prj4m zF%N|7AGL4A73->T+Wv{TsaZjlITVuq)|k+7tgGP?p{h_8Y8+YxOBq9Pr{V}ti88y? z3|JB=)3&W1YQObVhmw_aFGoD_HUeIK%@vP7j1)1;aDCkw9__3LDDypB37k!8gTB2r zys`Ur-(wo#uN<;Fs;g|V6XX%jAx^*5A%&e#GO$hX$GpsnI_bE;K8G!|G%A~0Zj6v7 zWgY%1lF>T8>({{!{HQlwcA-Qtb`TIvej2NtO(JQ%S&QQY!4iziXF@CvdYg;o85CSuFei;#Dhm_=HmL=em#RNxd#BTf5Nno&x zH{ggRQDm!W3vf4HB2xYkZOHhVbCA}iF&gy`s(!0>@$PJinTcH6)Q=SP@(&3>@teK? z-s*pjZkeM7b{Fq)jGssIkaR*X{i+CISt0>WU5JqrAsDtb49=?Jxyh*-Ra1=?nw$C& z5p864xLRPl+%Zy^CyI8>R+uuz?Wc(9TS%Hk^fH8;4kXg1XzL{!83bKc+tL;Le%WQ^ zh4@TutMd1NU2U$0G{l-7)x+r>9FZgS3s4U_e~r6$50y+sPSH@M%iKVXh@<2@Q^I7G zk%m!#5P!~9+hx5dGmI#uQ2cR$nOmWS=}_l+#QP`CvIAjh)&O3MKg)PQWknFcjKk*M zrxqYdt>^&Dz3nW;b~=rMOydf#p<=>ZuQV zG@YjT>TSt-VKlZ5+SH+x4DG2xC3IpBOPHyM2e^H~cHjpd%tM=<`F<^ODu%kM8p_XQ zYJvTsAawb_!n%bTvXsM2CoqkZOjr%DB7F$p0QW7gG(LjlpxIrMu1Tfw)rCwNs=Xum zPFZX@sblFi${}8NRk?<#OYZi!;=O&A$0G4Y0PevTo7qBGl*JtlrTSV3W)-bs&4`6( z=T$NBBsaq)=;hDnNu8T>u=V*$AwHTgGSM>0)c(C_pP(Fh(V{Szy~QPMvx6y(iR?L) zabw~rRiZPxfwSoZ&eU)J62vHxH>y5YVjMoK{Pe^xzu=EsLY=IC5&PBclR^tL!}c5L zh3|l`MWmom``EdF;{J95(nIH=1QpbU8~Q!nPO)jpsI9 zZj=wuzC`=uMH^_jQ|?NzH;oF89`CnxKGX8JXm*ScJw1-GQfypEq&rmBy*7qRNlHmI zJNBwbIT&_uN9(6pK|==QhH*Sy!yPX(0s@7$f;W}lqw<<=zgOI{feuP&YhC-Uoe(dC zMXWqBKCf}oijMvmyPO-a9V)aFqioI$wbQOD%dkL@wb*~@D&7(&^Zu77?|ync<)fv2 zg4OP&X?wS*aLmT+(YV#0DSTWt{}DLn&kcdkyjQUzc)RA6!CSpGFs(q6MJwcKJb;=% zFeIfxX;(fd(7-l@mxT-EnHn)69H$+cC#mgs;Naew%;qary;u&c_G-m_`&hXmWtlfd zK!Y{g%v1NKw1IZQ`@{&2)oFijYRFbs3GyHQFg&bD<{e4# zsyTKaVXhcZ+)$U1I{%~(5s`r(m3HuM&D&?#PcSuaTNq|QKsKEPy^k<9_$(n)g;T^> z%EZBi?YU+K?^E34VFY8emH_tm?ptm)764a^j^*h|+f*@KX2!HDCoXg>m-7*b!V*ii zILRZYw7cvJs{f&TPH(m7*wwqJf=_@;rI_P&T!+;^57lg@EfYB-)v%q|Y_hXsA5@(x z<#6-qBqEcvfB!fy>cbS;HtaTKrP6X!qgZwaB#HW<~-5IQrU=9$(Dvo$-aXyx0{`e^=`Z> zbZyd~@B>2s=~5)I-4Z$-5(8e&Xx3bMTY8wpP$%^?)v#Agt05P)8{b8>xg-(d)(L1N z3izd08%es6uQr!Q&oW@qs#BYSSWi?Fje=#3o%-9pz3g-m@Bu6bqzknBq5J@WPJZsb zETK@;#T=Zt_fID`0mpMZXo?xe$@r=O7X@E?zPu2~6Gz4V3zdsc6ApPL7+cs?OGlw zZ8nPfot&*GFPss>qXG;Hf9K|dqrh2d8=iDqNJ>ni(_z!0{jOsf-bop1{RR1fvORt? zC%wP4W>PiJacr7NQZ|)nkB_D}V3PLEA?L@4L0(ooL{e34*`0V}R-*M7`-8PE0Yg4< z)t_jAjUUT8prcx?yPFjw(ssGmSM7xV#Kp4rrZKQxkh`SCQ`;faU7-=ZoZXq6LNo<{ z_LRue)2m^x-7CSc-38`_`lbW=_hEQg&yrnoVEjL+Vd|?cln3U`V3Sj9V5X#;b7~`vn!% z!eE~k@F;uB$sUQummN}2R6=o(TmVa0PK+79Izk`k)PUdXS3}OQf;nql8H1O{Fvr8 zx6dD1zMj(Q@Rnvdu=KTDcl7h6ig9Gp>K1~QHztfBA-;#pY(Tz)>tPX%af8Ud8K^_kbG+Gn&{7JF5F(_9Q4@;wj4UHhF35G9OCtJJVo=v582I1N<`M&zT$ zAx81g4QXMi`X|?<#dTuO=*=lq@{UYV{&W;s9^`tMqgj;UHh5b61EGxaTscXt-Esfr zD%gL?DU_H%sENTCTm| zc)-2qOy#2}y~piruu|?t+0ChJke6RANP5 zU0y{~a}}HZ@!qCnTk)fXQGRd10;(Z&+66Fw`z`$+nc+z|SWf4oBEf^O0ruBKX_da} zqWcIw%ClKh2e`HnVfj?mf1qbK-2Wk8Y@+;c!QG#(NSh4`-=^gD}Z5WA{0FQ;|Rkp68vfV`Fr##kQz0^M6F zfTIL~#U*c)Ky0L?d!g366yPYl)LNT?utK+lmZiB!DtZXuCE?~S2iv#VgucwV8a;xz z4E6DDOOVCo0Q_1TE2XCd=Q;{3xREX*W`?;dmFNH{!^AkG#}H&eneY52%yXk?Gldio z?%1iJs?g%#uH1zDv!~a9OspxIm(UB*F&^fnw7@?K{LB*ztm%2M zVCp|wS5zSLPojtlbsQ9A+i*TI_ZDPy2qq$HQ#$A03HtR;7SnF2SUq^*xeVYSIW)a? zJf&_wu2q{+bo$oFZcqLo!cwL>pGXS?E@mD zn4QVcpEK4%b%9mH)8N{x%Sb+-wBeM{)cm;Nr9HiZz^F{`#vDpk<#i5J(v)OMe3@;FwZbL*&#IX7E-fDV*H~PfcmA9c%b7oo2Xc1Mw$O*%jk^M$tT9Jy31>uz>_TH$7B zCN8@r-a}%t!5TH%r2473L=5Dk&@)nv|1*@@>Y~^%E)qGvr--ml!ino#3^CxRz4dwx zh0zs$jBkEE@XRqYl0cXbQDSx~{ri6v-9ce|q2|ligTP$K_V{l*%^@p1TIKzF$*-gp zsxV0jhjpa~=9jDU%ehA34rTj75s=x)2L&_qjR@qTAyDSHSyI_4`ckT!j8Foc%Z+^4$!a|hP+6g@LbN3rrB`eJL?*f9L${LlXDh3sXYV z@hMQ5b)2l>kWsb|zVoV;Qt{-AqOjXuve{4#{6ji{mllHoRPM(jtQvU7q1Be(AY``Z z&54#(+(TP!!)UVx-K;*?X2kOG`66InO$_}Ed7c?w>|3SrDd-r9)2dfJ78hf)^GD9h z2tW~PqlXf%;S1TLq{eS1Xv624nb{uN@k22Re8=Xjrj*AZz~`bJXNIOdTY-TtU{buk zju9_kO0pPL4W>vHoyi;fWOKmuAKH z63qC3W`fo*)U#Lp9me?cOLjCOESE}6&hI%PGN~~y4*F^g?6{dMtAs;uQMLpR zfpEEwmk+VKY;WveHK)P#qYC!v$)Cvo^%g{Z8k6#|W45vK%|eep-5gqt2>GG^)$Xu? z$ZVH#0xz?!?s;7pu{E|pC+VePbuO?&);nud>7y}g&>vLO>lPD7Jp?i&^O@pEXy$Yn zV%-defiivg)h0PH+IX$YNeQe@`{_298DwQ}sy=M=aGc@a(n~)HJCbe1$@@9=4l(2& z3gAS`!Xrm2$$80Fhg(^Fr**4V^ML9{RWTTGUAeYJPQy9}e%r1nu@fIEKtULe`uVi) zuLP$uEpw=a97zJpDve%W*O&RwZ;>quXB3M_ZBol()@Sf_T1=Q+M@8EfD!GCc(lj^o$H+Wn~y z-G4i(6LYBn>HDpAkW3NxFwl=c=+sc1E>o5z&M*TAO^puLVpxZbW#aU6{Wo17=v{K= z3tj=oiHeVim1S`Ke%@xwFYLV}5hw)qU<#VC3C^Q=-M#Vu3wjuq+(iRceC0I&Oz*AMt1Bvn#sN5mQ>|gK;3zRhYe5(m6 z1NiH-DPF)4KD12PdJZ1)2%*g=+gLO{bYi#8N|gsI41t$@Z2(OOadQVeY!PBQbRinG zMw({733t-<@{Y4DDxRf;jVab$O0ip;ilGe^T!dIkZ)5{IK`Rj2bXIhxeS`Lw>aFc5 zI%W)OF$|U#PG3I~ZEXQLUjv&rL`1hL8Fb2sueyR%#=WDC4mZXDjGX~3Q+Y5m86k8u z5_c?ep+-r=SjaVOh^y~7RU=5UqzZ`+zjJz=ZB(Aw8<&% z*eV^ZiBMCjN^-R5e;q}C(Qj+&UZ715K){j--fKS(el!MDIYG!8mxBXj%qFB|aogjS zr3jVWPN!)$rHqK<>j;234=4gR3h*cH;vZy1hd<~TNogTB9+lolN2g{#=tw~3bxL0& zLsZu)VPEfkA~&7|@)se5U=Xb0U^xF@3|jx2ue7}343B1?zR~TUFnNc{_d$X70*l7G zYXx=(A-xlGg=cW?_@A~&X;nbi!}o(YIiGVFfvL`p-O&ufAFNcnB>g1DsI=1C!Z;aa zP%m51$0!d#h8KW1rh(k%Ro`=Ehlfg^-%+Z`Rz1YQz?Y*Ix?yzE?Rqm~5{Tew@xBk* zt{nc_?5iigjISf@d+9E4Ps*?JP^fmbf1v<_N(tp0!5|r-E%sl(-YjzRGf`*LKC6bV}y@^-@58}It zy(jAjlHJjP!tncC{f6&Q)tX{wx=!IxKcookW1@6E*ZavCp)(Jo=XaZd!D-tw z&eG}A5%dB!J7DRe{Q^T0v5aUh=4)FQ* zF(kAl_Q|=@Wq)>v^!X(i2G+Tf%1R)9rOO%~CBhgV0t;+;#M*#56PINHs`1Qjd7b)g zjMe@#e!hvjc!v&BY{9VZ4E0{Hw&~)=oePB9AgBc`JFm0VVL@}o4*d*UV`Wf|ZoWGG zeig79t_YMz%TvRMM{x*ysE6jEAG<#3qma3rA=LgGo~aWJ`58>^*Km%ySeDKa54-N+ z#*g?D2f1@9w&d1pXKyl7M1wFdV}@AJE|fmN=j4>=X**rPop>HPxt&YoM{g`>T|mLd z3nL1{cDLS?X|_HM&#D;t;SGYYINs5Kf_O@f!N46bYud}x;DJJ{pH%4nFv^6#HyZE@ zjl_(!_S)oesvodZ<_7r4C9_uQv;0BGQ+adQOiJmGh@66mWqKt# zM3Z`~h?imgc%zoe@hl}mMsO6%zT3-eVmXapZ>j+f>cO4q5T9`xk~+>BxWiO*ecYrwqUac&?&KI<&CqQ6Fa`0)W(77L**df> z4r2XoR!gHzQO4SUWE!a)7^+g-cjl^;JD7}s(vO`IgL35*DYH6Ah#qq%$nU)L#>nTH zRN+cs1n%hVaD_F z`%Ubmz+%6iR@{l3SF!%5V+;LeaQoJBsDUDD4Z$)#iaV!ik74DkpNYP}dN;T&E*Gt( zzQ4mJxPiYRj(e?*81DUuoM3diuJAVokMbqzFC=j`L8l;kjUv`P}aUUtheOqGsWg{2B#`?9`*{ z&fM7!9eKjjHVAfCeR`Jxv_$%iCzqBMV`%Q~285TFD`07jCp;SXK}T1YvEeR-Ej5M? zcTq5DR}4~RN=P>s`+2aHpaSJ)YFwhLp7u&5v*$>1%obW{=oWU)8qZ?Wkkyu7ZieT) z?#P3y)*a5u!gpmHaX$?azPd+9pWbl#byH#aj&oWsG-21AsbZM2|G@4m;wmy;8p6#z zE_%bzaqYl;R)U}Q*zSs~W-C`@FO9Q_GQmr16mo1SWHCC%3qxvGHuEpRW7-v;E!AWn z@`xH(I#V*c>>~W3on%ih?k*UPcol+E6V+F`QC3$-j*CPwam-nOuqeC?$2FbTJ7fS^ zy1s(bIK&-HVI0k7m^`~|F${vlTXt>&Yge{3U5I4AyG#@#;9+wcx2d9^e&?mXmDO$ z@^K&8x-1=U0^%>mcaVDrJV&oFadxB+8((r3^uLKUIv^uDsAIenNcsqGOTOa8La#5E zGV3)EjcJQ?``U0CU7*Dl1LMq1m7pB0@#2`P3Cv}Zuy32o%yu>vFi-kj#FsD;PuB6L zy^tWse$F(h8X9ahK;x+pZhCLi8xU9xcEn1%kpBd)sWlx)AdYoTttTX@;g97ii&8x# zbDObI(b9^P^a9Y#&Hlb3hzayVk+*L*K*OWfdbQMLzFVR8MkWp+CO zE~;>=v3Rj)vyv?b2V4N(2h$GFR6M}8^NT7qlhOrm)EAPPUSFU?xs4TYt3c4muB0EB z&or2uUp@R|_;3e`|IBx|NpcC3k92qY#_j1Tl@|c;B;NF?!Xa$^HtPy9@OzqMzsoTE zZX~$6Q_8Khui2L9a*ccF-vLg-BoOz-PI>33mfMT~i{FDAqxQWHqnntvR6OZbj+kek zV`(5>*r`XqvAGDg5I2D^OfCF^7XY0lEx;L8I zPT^j46aNlv>09#ia*|&7xf$OpboGr6;q^*z@<@#J_u)0Dd7HnY4T(~bdH-ed3Bcj> z5nyY|Y?r2KS8w8LE3}xXQj+=vix5Jwhr6X3>t8l^b85b2HinH;8fOoj$<3a5h^+>g zzp(qskn{Q(eEk#AT$JKdz3vG`5?Bw%flW9(#s$2-?11E%V8lA=^q9BKodZNFAA9$%qh*+%PEt+zG!N1-w>L@E8{M61>~0;?U$YrT@?o z2*lWY^P%zN`R=nLD%Z)g(|1y3b}l#B|Dryjad}0{v?Pu&4pb|-?ATmYT;ssOOxGfF zyhe>7JMq0ACV%p>b%uwHIQSr<>Rl)6ycl>LUtW<D$p=4J$6bzOFG zMycP`e`B0Qsw^6{ej~s7F2ywLY4;#>S6ZJA`!!pRCV%l9!jjdi2LHQSf&{K)t=r(( zom!(LuQwnX?dl;)a!-$|?hwH2x;#vwP2asR*lsVaSVtMr9c+Fu zc{E&(DC}aY1wY$(4*YV81Ba6x+3+GHA!#oDR=Ik-#Ef2sY(=)_C@GOkjcZs85xrE~ zE0_&GYXk88v)F1<_Fg^VGN#^avgW%~EV^p5-gOPtr}N0Y*ym5tZvK87a^rq01A?uu z78%KVeC)d?U{2~uX8<`tK(xXc&<}NY&Vt@ z!OiCXg2%|>u@gr;dYq9IQ+20sPX9o<2xYGm2tGppY6AKmDtNvv*ka! z`xDGA3mP_)^cAr$^X5iU{0_#enS!Bb(JP1PH{gjE!JL<^hhBn8eQP03ATvh2n2Z_;DB)_~?{DaSgjDSg@JPMaNB4((e72>PK2>vb_(a`1E`a5 zP3QNiSGuai5144Y!dCGad_NUHctJT6akcK*N6TenT@~@)Wi520q-RtLBP13|g~1u! z&*b>Rld1m&@*XLSD88c+EK*!}Fl5bo*rcK&P;{hrITk6bV_tu>fv0^=4nnGLhBK40 zD&e9c*rQM34jNL)emTs?{9D1O7ozh;PE zj#<$-&HAj*4_&yMl(-A{g4~n3acz*o{jpn@->GsO9+IwSB>4U=Tsoui4|=L^ytxe` z2MMGVj|H25(Yy||uD1xRagA0U(TF+G9a7qwnsjsdIo}@!2@g+0k<;|Y6 zI}mA|>1=PI{z8Qz^dK#4{2#N{4a(q`yrXGRSowstNZvE0Bn`@f3Jw&QX)V$S|BAo@ zhF}Wv2_0@P9Ms(JPFFVZXxd+U9L#HbL#?PS{}=@9(h>)_ASo@Cht(1vBc3nES>COn z#Gb`ShyNZL0M>~4j%EI$$0`Os40VcU_f4WTw)}ZIWfx$5L?pK>*=`56nQ!+@J$c$A z@gNiTp$rqrAaWGF?aOw&omh4Jx*>Gs1Pw%kj{M7y#8?y9Sbcl76ka`rJ@-}7l8JZ2 zr+(xOD%Mu_*3ZyZ0b2Q0G{WKefY*Am$DW4j>obi)!SHHqfH`~jfNLB-X*CRb3Ol~` zvTlROZ%f#_^}t%GdF!vB{lZjMju%gx2!fYpsat#>4UPHPP$`q`1x2=oK#rzLEJOlX zd26Jxt1Zls)di_ZDUVquRbb2>Rry*M_7wKGU^(mhq5$&J#xe;DqKt@77;M=d(&CKE z{7Sgw_Rq>}Q-fM)nYdCRC6{HNb@w%q4guE0o6bgv@Feny%~as^l;QPM1~#sX`d5Kj z3Tzs!b5YMoVpVt0+C$#J{FePtWo3g&`j^_>iLkN=uzH%&lL~VhSscaVxy6XRZ{w<6 zmzZI|g03!n-|2(I6so<>n!DLSt?yUG$tQLOPXU<%aymLTzD3VNSbHl@ z@FVeM2;BRb>G|>5wY4+`yi6Rr?U1=f{t)hJC%A3m^azoFn>DNRHfo-3R`@b4nPii4 z=L_KVLkKs+UQ8D&674>goHw~_(DrM2Y~>4Ae*!XBs^r$Dbn+W&vGZ-RnWQmO&DkPu z|0}oDd)v-FHK&OtUS2>TRhNKTSb82w1gtU@DECj+4~Neze`j2Z*>Rn4LrOnUN(OB7 zhRPSOL54j&@(~+p-V*4>Y8bkbE}i~=7K23vLNn*rjRZ?mBcMF=c(M|?mVJoWa?_73 zcQ#JPlyV?&`;agop&&>OZW38@_zNpkukNN-gxu_Sz|r!l*9g!VP;f(x@J8E^5Q&@# z39|Yc5Fru@qqrfEv%T+}T`$aJ0WKGK0j8qVaxy+b8Glg5^De>@D85~fDElUK0lo|c z2118G-}fa|7^3=vaK%X0!2A_>Vkj|PToFVrAAxha3?JgrsL-wML$}IM48&oK452>J zQw^ICsxg$!(Z?#sne5r^`=@{@j! zkO>HT2?soz;a%z&h5|_lV~nY}`%lC8XLpmuVPlb0BP6VU;I-lE^`BD(%$%X^x%ZPd zFG7JZHUCPzswUG6gCAmP6;C{IH!W}OLUFl2B{qD0$Rbk?J2UN^-$UG3A2yAzhtN>k zzE(yWDR!QPsU=PDbh+YeZfX5>OE?WNO>`veU;w=ai-v1^%P_JV2q~?^z+}28AGs&9 z>pot0DuK`iowHvG9l}*kv%C;x?NO-ckgg|F3ZG8WUU-_*=VX*9)YVvhPw$^B)tnHk z9lkT_!lg^~p5`}N2&d&H>5ENt^u$>i>YMFUinG3-0^T_NnK$_**=2)On&n}te18iE zbX0Jy0_SMQ_Ew<|vO_34<0$h|OPg47#hQ$}0>J|Oi-hw!N}0(O@OffQ%l|Uh`FscQ zJT64(0Nk)NZ*1Hc=nMqcx&*0}fI6t*M%li5Vu=PLCQr!A_KL3$egT5`*r|J$e@*P} zT(_;X82?zC{^|OkgD#E@=zNsN;>XJ;9dl7Z5zfeGE4o(B9XOKcow8E`NOI zTa2I*M^lqJF7JoqYhfLWJksjz0A*@ZTCP?^hy6xHlWLokNR!O@EwYcr{;9@S-Nu$M zT$niAgg<1?If$L4GKP+$DE-ZHg;u-IB1$eI?Z?eHPIhDsC4sffJEg){#*_~$d@H(Z z&usTTL0`kD4-y}HiaajG_yuddHtm@_h|#LetW=mJ-*Ud8%609B!n&Yna4>G3n|io_ zBk>7^Yf`g_*7rjdCD{Hwe{N4Uh1HO_I3d~d-jOmHn-E%QM>gGMW4pLro$;DTjx?@-U z*?$Piy^p`@Llx+c0yqLIF$KEi%w0YHRt-$u4C3cUKlKdl=+2q^%I$)o%$KJv`lO zC_Jz-|NaZ$Q{$-=of%_J^o4)4X9}eD3UN}9IvIHWdQWk!^8mT`;!=nx%#6+aiZg^^ zz}QKG6MMDxc3q~;z4Az8j2N^d=XZ74J@-Wd7BShxvi&+kpA@1Wau1#v8#^L8H~C#Y z%oq^|;j_63hxj$%J;6M1IqYT%=yqi01IO%nndI^|++aw_h$=_;*DARCiiV4g`o?d7 z8z9tm75WA>bTbZ**u5|0^>*_w>HUOxvisjZCn((gB>VqQF8hBw2#1XUT*AfU+NK9w zkDxZdfw((jy3-QuzRr{^saNV!YJ1C7JcZM7%AKoH+`)l1`8-OufpAKTYo6(cz}wCH z^V99!8AU>iTvu0@>D*v$2!Lwj0gZNn_h+ zY|q%)S!?a1eY$_ZI2z--zH7YC{oL=vk9QoZox*71z#~clpf6aDFYn#io?`6^-8VGF zKCu1+9ThTzAo0>3TNxZ~UgGk2@w?%)?b~+rBfGPCF%l~YK)xJhwvj(R?QhrbN7L&; z9f_B|Lfwv^bvKL*yIcG0amLsNt+q#JflqpG-!cME-mlj+{zs`U=ZlS#PQN~UvL7Sd zpI_UAW^TLk?KrmOFXJn-i$iDi%lGVwR;|X6#G@ioCFZ97jWbKMyU$VaPF6fvLrxSIp7zCa(`J|Jb#mqsg#7+OCEo8NAMnC4`^5d zkM^C2kE7otfIxSvEL4C>LX{TLR!jaVhD{KHM@1-_0gxS5VMGErF}yXgIjEu}2D!l) zr!P_wSKj`$WFcW%$v;My?qbBmTv#1(K0#H;5l;;yJ10Wi6+?iTw?Q>u=qG=0RI1@& zD}y!G4PBcj%qI+p&w2&R)MmkLP4A6J3c(>+b6$};++T+5}tt~Q)ZLGtcnI})C)5= zr;f#KoS_k-9B!EV_#0&a;sjOZU6huaEW&NawYPeie70EQCVJniax(BY2{~HZm66}N zp8~(yX@c9SvlOrI3k*$vJ|~TxxKL~|21C0I=JU@bx))zT<8sMjV;%6I5!33Q4A7%; z9D9H$p&Jo-F6c^8JX#HL7vYGV$f_-pQ!FFXoCbvhQx><#k}302#3QecoQu8@chkbI zL8QdoLVxD1y_D&jbl1i@UzYjHA5Ffsl4R?;Fz~FTsSj)}m4yWC^TTXgC~IpB;^7yJ z%10tzoa>1)+W!HtcYC77vyAFil`E~-QspjU6}R*wr!|UqmRg4Po{MD!uAj9TgiQVp zO^2EE*Pa0vb%}-V3fS>lu#g2dUc4|CZ|+5&eq|CH)k=pHwCesz+bkbdpTEn z&Q?G+j)tF30<12`NZ7x#)5)$68^E1Z|DjmAA-%o*GZ)}sMpV_ujSXD1!r}2_k3q~d zdS(}NwCttZ09~-gcsqkpg&yu*636XrM*d?hRHl$lffoMggi>S}4@!zt7sAl2bYkpu z*I>S@{30tPc+GtqQ0JFTi>_kdL9;;Zu^$_9&@cVm@YjdR=$pA4@PcTuFeUSA?MA}- zTdIK?!_8t{G~{=9+;d2|10lpn+qxM%lZFCp1=LiJa(~Ba({^*sRwGW=h$^Yve#DgF zN&K`A34tm~ASHg0)&YVp&On=z^uTfsB1wbuAVD3Z-2#UPvgy*^@GJQrPdkFG7fCse zl7l;;{4YDrHK>mB)PMp4JF3sG*SGk!7cW8~IGNsw zN)u^aDKII2`_3zq;td|C_!gwTsw?iDQA~@#0iI5ONyUv7IIgBawvw0VdHX`$p3 zj-3RbT9F)=VUV;mMC!je7$!a!a>BRvk~0=3ectX&A&jnmftjQMjGXbI`7Qgts6v>x zCr{+YXn267CJNnyon#&|GP&YcSYn>U=xTIVe0J@9B-JYQr_r6ix%yvZRsc^hzQbv7 z#qttGKWo-XmszeH8wq_qg!YI7z)(JL zJ}cb{T0B@$k!vP1c>AC8;uCX*(E#e0W{fVKW+EogjR$Noe6L%-u6!LxrM-w?4xJN| z3o4+Ir3V;KN{KH=B^$9?Qv(V`L>Yv#HgL=7!bfcZSu2_l9l8;*@e(Etga&@CDBzny zVc)yfcZMSgQSG9J%BGP@OgN0z&~LBLGo1xIx4sFiGk-x}M0eI{A)ac5?$KPw7=$7C z+QVWdu!A$Xpcxyz;{ZK=ff-uZc==bbBH@*IwXBItur0C;2*VTL@adM3(jkDe%bP7mkHTT4~%(hQ9GvBVm#@^1bldv@4h8gcR z2>#A&C!(YVvqmXSN+$&$D};ksG=alkE@*E}TrvU1X^#?=tVzDn?$`-BH!OL}^ZUTJ z_j0Gr)zXPtfk6W=$X=q$m(}Q;ZGd{1)CmlnuIaCFhF+?bm$-e9pDp%>s3Bg&MI@JH z6{d$_-uy>oin9-eA^39`u6W5@-0m0y+qR+17PI5W3z;crWff|{huUt~2(EJR_)5Z`Vjh}F>B?6qwVZaUD z|8Lh;o@kx#gQhuS2yo?J`A=@tdr@1@{R2u($ECn5`_p)P3j4z+oJKYbld)u8oacSE zs)>a{>3=i>%kV|r6w1!{l9iHasjx6>&5-X7??@g~0)e7o_z0}60hWRbh{%J#*7-eq zqzG}Np@;AP{!nGA$>hLiW*!$Ol{P*zk1W^o#CoTm?3=v07+kvNXEo4)o{q6X0@~5H z2>wsy5CHkrmWkn0GsQGnSLSc$hK1A~EMg31XRn+k=fbm8kDmI2)1at%tU6#-H($Ev z?9#(S4j&3jtI1u;>g>Yk$g)A1Rb`Oh@Go0GD!4M$_z4VNyD4@sUu2TC)D6O1Kp1)} zd#oRu*nSWsvz@!y)aRH0)0QQ3~tQ2*VV+MR4v9s7?5;GTi%Slos*#hn*5MC=gAI~qf^y4>WwN|E`gw6@)JgM*L9Vhe(G6N`0ZnNB)#uCoz?V#CokcPvP}C=A+}MLgSGOJMws zf&D%FpLAdEB$Mf1aOlYVu1+-BmYm*01bS7lRe=LnmN;Ip>KePaZjEILiO{T3OX@8< z*1(na>>F~Lo~`oKauJmax)!nmJCnP`l-&xg;Sp|YV^P_)#<5t#wtLLHU-q;B-@5|< z0gnn2wpr$`F{`r@JckvYVu8Ew!}#|*TLa?dIzN#cwf_QYpP0HtMhVCE@LVN_WcAWw z8*|N+1YWD2Zd1ICHh6*5fFjxrp(`)-pJ-#AZpF zM#I(ujTI+YftwU0aZpxD4dvkGY4M6oDl4Pr&eqDBC|IPG8-7dga6X_mcL zlhu(zuW5~rU*b)YdfVr1zGHJD^PqVK`L_a*URi!CRODkl*uF%(B2!ZCr)~3nV4ya zS3R$4HE=Yhjxdq6T$$|@U&?-9#(3*C>lzlh(1vQaSpji|IS^t4Ehrq&BDy)N*4gX` z?Vh9~S6E*#Lg4c*=6S>ck^tf?{lZ53CckA}?a?6cdbbz>3F7Ld7*3bc6~m z0wA1;jaB~720@Q<^?X#oqsFa3Kr5oJ#*j;-ja|Y2xC`z5Q^S~E&f2=q0e{+wLU#B7 z{~}s4bu<+S1Flf39gjR^c|Fle6j5rTen|ksL&h}8d@!RO{%S7+1xNp7(@7AudbyAJ zK9w-AP#$PgC{Hs&^J6oEjDXLoKLplpHoy3rft_&R`!mtTY!5gArNq-iI=a)4uUzY% z3rBV*q1B<3fRmVu_;EUEj+AuW1XQ|{d?g7P#o<8A zEY{O;beT6tBUZ9hXuQO>M`9o1Nb)1&XDjU7)-L?pMw9U=mzAGj1bP8DUZF(kWUfyK zS(wNC+b+KC%V9QQjYHLdackz zin&s>TQ1{w)v2Q zA%~*zm*=e z1Zl_AB|!WVWR=6-NeT*)G>hZ9Dk2=p*P!K@7~ z!^0dIm0I}3R`X7V7?-#>E{YsV-ymeri9rFHk z8>WMzZ5-bi16mF{Ij@_713{bF;5j8WfT zbdhZDn7bMY@OX<*S4}k<%#axnSE}g`YO$#4eGRWhSwM9N49QY70|HSfif9ia4e~mQZ3a z{a^Rx*ZoXoM0%`g2U)VhY=d%Be{JZEX*fE(OWrmz!52OlF7v$sD}$HdqIBLU?D%)8 zM%cx(yQgTda)vvUho4{SMC-S^S)$ouncP7O!eTy!`0amtvg+zA_Qcklg&jwG5UEus_NI21*ZX2f6A_b|D zd*|DLb#@4NNhk%ni28=m%})ev^}xWcEECZV%WOVZgm_{Kau}{_ftJN^<d4@0B?2LIIQ&)YK@yIEYj&}$sVD}nW5}x9b$tBtqP=rRNV(${2TT$ zBW#QD)(qU|5ju||w`fy@b0uufN&9RbjR@OQy8@FfJ?+4&e(JiI4Ev-QGW&0`UY8LObod$P2`xp!du}Xca=+1G8?4!Zl`aservn5&7uFo zZxSq`hOX^LkJo9SMDVDcW$i|4OnGCp_suc4bpe!QLH|6Dirk()TrvG~g-}R`8yw45 zg6-|j@(r@IEpaNuPFLBo#~uw$uQ2XxH1OR-1y=n3ptKE1A(-U2J1F5ZBSa3bf`7r_ zw}emoY5$%+{$Z}zE*3$aT`<6EElQRI1e>k#s>nDZ9xWd=dH@4Q8=-oM>B2#C* z={PPz)MVwv?3oN`)xxR%1?GMS(Y`#FEr`w@}K{m#}Ljfz~%}D&-Y1(rB#D zfKs1Q66kD09rYY}OJ9_2>>aZrr8V#)LxB0p4z*2G$e0%ox!B@H*OAF=oKBgK;vhGE z0xm_#q0IziymLR49?Xkat{~JF5c1`yVY}go8Hu;>rwWS}9MC#z!%a6p82{6m6bcwS zXk$4f?!AT^t1#3=I2gyn%2=f-u2G&akj;Th_hJ~wAe-k)&KqjnNyZeTW~Ru`4|$#; z0t3HSFxCBZjmWB>EARP@$V+X;rmUFphsLxOCDihigb$NNQ7eS5fv-@OC4f?|xr)>{ zo90j&b%gmD7K;~qjsU4cZy3uU77zi>050frg(LUiszBeS0F!6cu)e5-s+h!KUI#H5IR;s zgLBV2!U1)z*t^C~%&C`sEWLxfkYv|S!h@Jn=>Z)mX?z}ad&207juovze}U0CX}ARO z_$6%oq(pDRqbN`D2i%SwIRA-Mo*$XrH;J)430nX2c;D@ZNd{=%dZ(OBE5UfI&>-c% zmW06o%z&J)emls5RPp$@?R`F{b;Dm}tfC(CzfhIK|Lb%9@88(}zurLiBg_7PQp=t@ zfb&;wmTw@BQqZR$2HG$s^TKX-XSi70!Q#WsqOg~|gdyK&bo2gR2pSdWVDW5hIo3|RRI>IK&Lr4*PR@P z57VyV$&M)EI-At%@5M}|wNhGzR_mFa-q_xsU*egQFBHk0_nTgk4tKbf@(JG$P$AZ4 zc8Ya}l+Q6>415EGqI`!yy7}?MX^G5AV*|HnlFvUV0}fW=g%jPn5xRlDOph+8ua9=Z z4N6yZ*P01r)vOe;mpcAB2#<{@8gvG6MEuZxdGI@{CFHbuyUWVy&3gC0J+g<@3zn|v1H?R|!PxhB< zleR8p1a&Ed6hANV9*?SZ4TPS|Ao>gpK8nfcfz>$<4T%mv1Oh*^g=>VXiT(dU%Dft8 z{~!dvhqYY?`|1phU2okdG^QD=UcTP*GKWLoES>zwUfzPHB#uN!ao2|~eQaT#l_(rN z(*CI42)u|sVzPxMnBpHLnrE2bMV`8IY1(^oJ`@q}kOHM)&6PSty8w$>i zRh9pa3+I!_2>xAsyRDXj&sZooLRUv(@SGe2es64&U)fx^P$3}-jJvNWD7DX~Z7R?` zO_G4)!kuAIi+>Nrf`EiB2-FIXDU?a3Ajn<#fo&aNI;2SNu!mo-Y+IVA#V;YO^;joX%%KkQ47BS(-*DFrAHwo-F%)f|@g44z$X=p_YRUjH^aVSqxFA{T3 z|6b7f%T*gWir!X=xdLFS%X3=it3V6S9|z8R;D~<*gN$g-Gp=qZfibSKe%yOPM$gdL zxMV3l??~=EUa3TpLwVK>h{d6(f48JD5nflCEN3}B|H-3sC|We21OeKeXK@H03@R#- zLl^C`oJw9X)ZPeHmG}u9t-Q)n;E0G0D*c02R$YbP!>+{VglrAm+}-DwtrFAVw9`_8 z^z($t48u#%vX_X|{Zz?A%QJr%^Pq3npv^&ZPj6W}V<3=^9Z+jSdzTiYAnoDa4!^QvW2U0!z5GCMb#HVA7^cPjQf6%a~4JgU%cP z)_-Q|r0&ng16esWH!^WsR1 zK`j{TAUgfrqo|DxYw9xss_&>}5F)M74-f=}0kBn80XiY4K=zIhyQo;{n|!^ys*a%q z(wUCzF^jyIbCW+64q=nQP(}cK3(WFeH}nDj0#5iw@&>dz2Ax9X@l(UsJ@?X9goB${ zng?RkiCU_`vbo&FMhk)00#8Lwq%>aT=x6b>Y@TFQ*m&jm{NE^z2p~h^b$Lfin9Qt= zl_@rkXynj9J7%Rk*Q~7NvOr&HSydZLdU`l5_Q~?1fNXUo?Z6l|q7YSV$c>|W6mH#|W+aY&JAp&Lt9W~dVlx(k>n1PS;D zdZxqN=?{)A`B&g%YesG0vJTTl(#7>D*}DN;tt$ALBGVbzX{K388Y~=Ok0v$xJvq*< z{fqxm3mdoSNhAwSFoc+z<1#j%t#g;7DO`mHN-8g`rg zX|{WSj8Ybn_HWo~rq4h$evwJ{I9Rr#MJR@f3YcgnE49E4JgcpNlSDYp5)X@4w)ubv z19Y9Srj*fU>bx&n#BGCYCHUf5T^z``h&;cercO(@DlCKVfG6D}v7TzRnkI>}(o;`t z{vuNeS$4bfJWD+&E}kE^6y|3e42w!yWx(j3$Ef_`ofPT!{p?7o8>T-Q8A&o^ zp?YQ7Sd7YV;aTX$A!?kO0STGN-w>yCnNeb8lAh(h(ucLWK>r!3Fago&37j3cT?HS8 zH@fn?`9s{C2r%|U*?Lmo^u?YE@Wp+g9mK8~E(Pbza7~SrUj4mm(J($ORJ-$XW$^D9 z3oiBe{I$0PBXB?G*{Q~k-aae4ir1eUPxXMq`7H}TZM?7AW2_J5Qu2P);{YQh#UwUY zwmRa|fo$&IL(t;qLlB`5W;TVW$!kI03@F~N{@@&7?p0F$WyH+T+t(nlYgu~qi)qEv z!eoJn6TLbNxo^(N4Y9b&OE+K(7%a5p|}w{B|=bGXQNp;jeYhln7yg-nqI zGzi{$`e!Mfw*vj^a5bt-r)?R;EvFtCogR7YHZAqqivK{VO_(;X?n8&4D$I^m7AnX7 zS<9ueMHE79@PTW9y%_TTkBEbvnb`>?i%aD}gk&NF-+}0t7Wcxy6RX2+*+}ZwJGrOP zsRQ%dnjVH`Hi%vCSWxSJ_Ap&0-FVqFKZmV|j$y7D?n@IID84^WuRV$Dq~yPG(=J`}{cS@h3NiRYdpa^gJQOS5<>)F6;XN7PNo2qRSu5F395?9AII zl$*1&cx7w0I$?)(wZofGBlar#$wlBlz}x#CaQV(q;t)?hAtnU~#)S~&IGSr?r#dhR zX(~so6Q9RYhc}CZXQBcN?)A2IBGWEKS1#RfZrrh^sylE;&-FdqL{)!BpOw7_Vd72z zMO?BoH?e77;N<*`nS}U8+sQLl+D}E2Yd2!fg!sk5Rm*kb7Z3+Uo*uIBon#RUpgI-k z$FDbZg!csX;FAT{zk3M0!*}yh5r>!_i5f?Q0C?^{nvxA7CG)bQJrty(soMUmxHnYrWsBV z@pnIgur`#}_w9mzQXbzg7~75+ZvNy#=sDnf6DUQMCgA5oO9h9H+xru)VKU%?eytL# zd*|oQ8)vZ&0(A~M-De0M->fOiwZ7AJ@|QQa3i8BViCvF}Cw%mK+CCYh+HVmD%@gZ` zPp+yV__{+r=mcFK+Uz+w9K(kE^T3G~YWp5s5xu>ifZqDtrHA7+jUs17ToYoa-wen7 zX+7BDfDE{jV*LXp+mjwC0&lfW!tW~W=6DkAYUH57r| zLb{ADXHh-_JO3py|)x-cez9l7}5ajvt zU9QxGryGvFjbTuXPf)d4`t^q5ifRi!lDu`K!lQ4bUa0Mn#NXr-?%i1Toj&P;rWBL? z1{c<=2tvJAkD)~9HPUuA?8ufWKrVYoaB`-n&)8yX9TBw6K(<5L?){(k6(2Oz$?Y%n;?FE__$n+T3()7C_`$op5 z(m1+CoL%9CnsG0f>$PfO6BydBhNC*zioWVV8_h;&TGo6LpkbYfQ{=*f3W>RA9gV|pl52FqxU}=N@Jl8e$ivEv#Dn*XpIfNi zsouPX;WG4=E5A2Pfg+^d`+5A)tcq_joAIAfu@a48tKTHO@u(QaCI5xp&(=DaAY7^A zLu*v^U*1sI`n5q9&LbC16AEun-D3&7Xa>mHqQizGNbuCp*4Kv+WTY!M1w?6VXC?gV zEl~>r8=5~k-sCx@5%NUhrzw=J%#7gF{smw>9=Om1QiA6y>9k*^x`%0@PAFs+Rm8XrtoIqxLnBzG&X@f#+*g>IxQT$EmS!Mn1P8n%>~s8 z>&3VuPxb>>k2(!7mw2w{Gs#IH`xiirGetiM8|M#pa^vInx{m-x&S@|LpAWhmZ5Eun z{LKStEzM#K{MJ_GfQ%`Op$mLO80p!>S!kyT-owaMoVyFy#^YI{$EJvT{lx`Qz)%7K zrLBHFl-{LY;F$JkYqf(|98tNfGFFYxwWL5-={K?3)2Jy59;`ZIerx25BSN=h7AsMH z4mPi3WX*73hxH4m1z%!I<`WreR!10@U4iVpjk$r{6l5o@C)4{CS<48^( z)U*f(dn>s8R+cIYL9^0cExVy6!6Zy-W^xJ;vO6y4NaL?sZw!_#mbexAcmmPjQFxGx zGK{__5Wnh6iV5`?02oAhI)Zm{AIeIEPK_98>Mz^PHgSU>ie53F-O#_ z7;#nT{T=Jl#q{y(1l>8aVYMuNaSb2Vz%Lnbq*n-!DgN-K>MYU(!K%hM6uLjCW;wQx z=MJ_6@>%N~{rD90l|rvjZdaNi)as^=j#ZGfL38RQV_q5gfMBR}HlWbBW_67A#aJ>| zTjy#>e{>r8&WqygW9X#R@wy%Ae;aUU4+_8FmWDdrBf)hN)2eaF_x^zv);{e!HntNt-J zgHCohr7>3#j&__9tXQ>})y4D5LX!Pb)4d};0RzQ@3*i(-$LubwH#v4AwR5zl2bYpU zlEDcEyU&yvFmS1);+Ryzx8#|ft+?&UroNxz!V4aCcB6KX;ZS=HS0Pvj7OcB*iZh4R z?_Wek*gExepCJ64r8PG|@DV<2&M1eby7XV7lkljFSsgk!|FW3fLlW-JV`i8MY>Ef2Mvf2;ZVJ~UQpHc9|)6FA3Giku_fBi#Uc8)D!>h0mOS z@Nm9XzcAM!!72t)RRZf?mU{A5*4-ht8>QXo#K*O{s=MT>_R8nL3V0DB90P z(b$KNna;_QO24gadOP&s*;1&SxSKdNMr-S;fAlwxz&bn5nfm3h&iI_u?y-nK+gKD= zb~*cCLzG z0NZKWVIjp$>AT=S4W1fMOmRISQoza5sQ2#K*lwvIF@){-4HYk_z-}+0&K>%4Ln+Qa z)~3h`=3*8IuFbyWBW&BRxM1;EC-!8hhssMaKe*7x&m8wxaoSx{eh_P;N@0WN52;Li z?ohOF-ax^wtHA4q5eXNO-Kpf?A-QpvXh+XI>8kadSh$QoD(UFaWJq`gnzx5E0?XuZ z(*bwzao8H<=|sB%*y#Mqei;El{~+B(THQ^BITjCgyNKhJBR0-Wb=SnkEb`-5>o309 zF;3JHIg?QE@iihSqu2NxS?Kx?nFSXs6IWQ8qLqFt=P_?1I3#>TtAxk!lNw4Yd zLf4re?yYoeBQdn46w6r(H&hsB0!w2-qm@OV_eKSleYTCV=tg#GH&lMwhr1K1Q>zmO znTId$yM*k<8a1v2g%_HL+~JJ}k8N_{bgu6SrtXR#9kC?aIB%GfNcr_VGV*Y(gI@e) zQ@^FKRldUcG{aEjq7TdYJo^t_FnddBYK38HN1)~l-#zQc3xJ2kfpSxDyLYvb;oSU_ zJapBEkGO+&OWR&zV$rUkc4YWMmf%(@e z56wy}e{VAkA)kD7w%o~gNZ9d4x&zW*o zeIcmxL>=E{H+!HE1#Jn1+=_cr=+>L~F~b$sF}vGZiWBuPphfPmJvMwfmwZ_XmWSq{ zC?@^*7etkIr0-r18Thzle?0O$WZ04yIzZaBFgBok^|wPE>VL&ep5BR-x4k&MIjE?X~i2)cSb%rdot#xVO<6097tQOV;FR?LgmTXLn>HiY`-#b;I{G2Zrq&if)0H*X25Ql! z8(v145<^Of{d{``18@THffwst7+8T=%Wi+84jd_9dV4#wJwe*poiIFq zn3-Eh@-CVcd?^?RB&fJ;VAnIsu8ru~C9AiLJh<@FHgwgmnFT}CMwA?1sF8bJuBC0e znZj}Ja{$$q@+V)N`T1||HNQG%u;!5_zFI4S(Q!1SgM#aRN7`phW5o1!u zhx7S6XjkQ_5^C7C`fvPzxX-p3M5;MF1MaK=gC^HxL+ zM8?H!`F(nm_9+H?Z}Ksqa-ZJg=i7`EhC%AjkltEb35l(4O&&gi5-e)bNxsII<)RIh zu>Nxn6p`@KstaX|VuCtwLcUK$Urz#o%3+c=GVHG0wW#DuenU?a_QUG6ATN9s)aCN; zL#|c5n<9KDqE_(rUdZpj^*;%&_ng<~oy3pDD=eVy1DGV8Xs}3ndDT=9}(L(41*9DHZbp&{RE0=mVVKp%SU=|L?9+62cj58u# z!7y$>$Vv-MKjY&T5EkD8DD8K8!4GNXO`WP;HT};ZXDb%Ao^ctg&&(~ ze((1X4dNT_A_L;sLPZf}NR?YUuho||*cKAfe=+J*5Mj=8dDMdjrkE=?(ASunt4F(|TihgABpBqJ#>GZ&mIR z?)k|eY3OSHp1jeCd&7YS_E(?W47m7WPoa;7Msa2~JZdRW8e>x^j{kgr-=_6JtFCtj zLA>S=R6c4akv+>7Oq8}~OHI?OF12de9$0RickySL$N7882`bvK)Sma@iv3sYOqQ}Olmr@>;}|zXI(h`-u182h zJ26tU9O*j1B+irWnv$FXS}1IDTQDn*rbrmsVA0#1f6y+2AB^B77-mcsC|PySL7$qL zD=OsHDjM`AKa>a><6qaeA5A4!x15c)nKq z%=QH4KEKq;1$kvQx+CB;z_@wZ+2LwH|ExFv!OGNY(@PV)V8}Seu*pTfTsddzcMU`k zS);ql0b-&%T!p6b1Fi*N@m|TuJF0`SRg!Uveh;3_Hu%vAusi(F!)=t!_#FDp_iS^W zvi>*vr#&p9mp4(ng4Qo^Kn79LZ43%gsGyEJ%{i!SPeP`jMqms{fB|kfL2la>byu6K z@0&h%xPrxwEu;^918yBzr&@3rD&Y7J4przXu^G*vuGK6LFX=k z{{-t!LV-N$IM>UWg12N6s&|IWxIm;1lwVZjbanr#3>SpElKvB1zkwO^z_0RpgqW8b zgv`g&So$4^THzhZCGNb=g@NsfjPmI}C0FGaAMHrTDR=u4BQxrA)ahdZS=Qg%2ddWcbMW)62n4c{V73emnH42VJRjPY&nCumr&thI9ZG( zv&O_|^Vk1JY1TcC-%mCzDbkBdk%o5C%>)?$UD(D4B4D!%W_aJcr_qbA&Tm*sP3P-_ zMGU)0;s8^mD@D)EPE@SeBjf8W3QR^4ROuk9GR_>L|c@ zV#ATshy~4Cp3YfCbg}KGOD0zDWO>I@7Gm;%96j58~@^_x{!5V@RKq79w=8Ske6zIY!IXD&qJwLX+cm5%k zo~D65?HWl@pnTXsVIeUPdL15xo}_!3^MVM7c||>YJWSe)QZ@bjt^A{R$McS_ncM;w ztF(Ss!pjdvrEtU3{zk)+)vSZf>BM7_^D?iys>4U9FhM;Q+zM1o+~@Dfl>! z$95(Lplew_;v-Rp)&`m#>Ni0N}|e5>YdW~9(x0~a9oin^Dl8FI8N zV?eT84h8j6_b=rO+sqYXC97M)E$Xx^ApqF%N|)Q24{{cEZD(nUZ1An zzE>pTkIdjx3FYxxHDo3P@3D#RGk*@vIHS2o{%|q>>XsI7`O)9LvzksP3_o5PiBr-} zA08NPk6N)w9u%`JrQaqJqVeXfbfsubVbcTbI#o2)z+N)Kdx^ENE!ZenCTt^$Z!F_o zT!>^m1Is|R2g2!rhrL0^5rM`n8X~qqloqx>aEU)x3(SizR^s9nctB5L!FBiJuqzL0 z^lI6>kq++W+XLJ_$~Ex)Z`{Kss}@C0K7xpw7?RBJ*S?sT6!4Z4PEU8Ms4Gu{lj&}X zCO8ZNl72BNMGE-p_S2$|P-+vIVOrtGJG^Y_>axq$fhm>510Pp_ofj?-<*(%!qyr~5?i z$8l#kV1Oc(!nh!zaD|FDN%)3}Bn)gy4Brmj(EEIR0bss#-9$1^#Uhd&1yqu6Mu<;cf-4oHd{lJ%G^$slodqvtO z=~)98GiDensbm|S3w{a z-Y6~#@)v0Cf)jISg_9KShQ$}c4_EAvEGmx5QM@o;5qu>&Pj^GlJyobSL(1KEy?m^6 z8bOWKs*N37%lH!C{$*j%ZH2Z`RLfUrjr1Rjdk?P%p6T*FYL<1|3^LdluAuqr@Zjp? zoxo}lefVWU`=k;KWL#%z-Ym&i4X@9nh_M)3X zewZSKbK>?6_WB1wy9}o!9JtI1t9JpBfrySRzx&sQuFgWz_Vd8s_Su}_QpSiLRRy=S z|K(uV@ki1x1A`va{{v4zu)oWHz8yoT*7vJU!RgST2KAH?JPLDh>*w1M5-$CL2|+Al zm^}F*D{y@C_I`b&TNC|E((e&JeQ-CnEV&PF+|q)&viyb!{Pg;GZ2Dvj?rCDg3vaK* z;R+T)%E96OeUFaEp`UKW>lo5Juw|Hg>ZxpDKub1?P& z)wtukQ#_x5>Ak6w)lL5=0y%P*JgJ{a7FQBqy>}5#> z;P`BJF`oZ;JYE?=;#1}&Em~fKkzpEWtQKrLn1SPkY}b)SRy$8J!s1uQVB1&Y@zU7V zh@!&}Z_*T-XWfTAzl=k-Td&1aF~ItjTX`+5#J$ff#~zm+eY>~BJ>z;{<4^Zv!&B|h znN_tjHHXcCIvdTH_X%yb?0$SUfUQ>u7-2FRmG)b7_6+X-cnfSPjdA?Rjxbco`4D_M zZ4@>xz7Ib<)df9zwnbDyCT@Fs6`p%%1zua4joPhRqDSLk$fS3V?ya%mlUs1|?Q0S2 zEWndr?1xnrgGrHmFv}ung>riBr_AK(%&5<{1-7x;a_dPsFHKX6jvR<>`}IDo|6(+5 zNMHhm@v^^?fpLvGSoZBC{Pu2FwwH1&J5qt@P$>=jUG|ZoivMJPO20Pi`{nrdtfVy| zL}p&3gEz+F{b?hxg8j!!t#tTc-d=1uUV)@2BSNI_X1pl5p2De5RXLvgdIRGaacZmEEYY~19!9y@!quvDDU4DIUO|Vx~;H!CC@Ww`t#AV^B4=!F%ZigLb%WNnm+dgZ|rVb%5woGPQ|7Q)2*cTuh9hPFo8*~8d+qy#@~O+&dMm}PZf$?E;M z>-!_L2OVmN5jhz-*ebIg+cObVF9!PRYV15o=^T-}dC?k;dTc$AjktgDTkAdHuL0Z{K5+&IEszZZNZD5tiWeGIRc8-;Na3!Sn7qr z3cU7lf=K+j%S-du3i$ z87cBlMpS9}Sa-4j2Tm2B*kD3(B1h_bOHj@FT7IYi4tAWmS$SA}x&)QBDr}|GHECEk zv~5Oi7Cv8<17}<)s!0})Q>U-D>>^WpUiG46KpIiWO4I zy4LBHkxY821qF5&3JNVKEHA^?D-Pr51C*avj{PN+PlvIcWnH@HAoh@S8I4+w>nid7 zoC7#Rn&e>Fa;()PFHY<_l7S=g3^EV*o}PZsgDWA-o0nBtI!S;3DT-P=WwFhjnwoCl=4D6b?_YP zoo&bHK}K;EN_ahFaMV0!XFAN$!R&V(*tq2oo}76Ahd7vSmK=hDN(&Y)-Hu0==D-ok z&X)ShEm9AO=;l4CSbeq%5pf}KXk6HN;1ni(ybbw!dVd+gvKw zJ9nSK?!qc~QcI9Zf{?~*c;329^m}?VZZxD~?AOO(kq$Y)J}yHDVyesV%f2k?sDq2w zPKd{fMZ8u@*?wJYvx%Bw%-fj*7yFgcQmG$1ida9J4)WTP1tz@CY{dmw$M$Nf5d;UX z<1c?+gXybtl-qY6l9Qu{(y%Vy3dfl;oF+-hJC%jSM+#7(2||2Hq0&a=dT^1s$2v-> zPqy+{wcK`c+HFXybfC;;$HB9C*q&X1a90&hRk~1KQi_*n$hFClvp5>Lv{^6G%wwZ< zD6Oi%FLO5Hxh<6>RtC6fvlwRu=IqUY)f9rJHA0bl`Y2xg^$bo{Sa2Y_95xONY?T%4 z|E$W|g;-Yw=FvWtvX+VVk@BTg*imYC;OOBD{CKJYP2)`@lNNma-D-TW$Ae{$cSG*h zefagHTq8PG7Y9#Fd;D}ZcI4V3Eu#@GhmdA}P4&>!l z^15>%H?I)W7ahiilO;HlRf6MoBQzZNEId*ObEt{7s>brQ`!H?J2~^T?hoc&&N~%%L z!P4FnS=cS>LD=uP<<^G5gSCe;aW<_4I|`jhY#4>3TQZPF;+az*uVQc`E4>tUy&Wso z9mQu`GjKY;61#FL5ghEnk#x4N3Jw7C%aKb$k$XA~S3kD`M=EK2aY}y3^`~R|vJ_)3 z`ze_zmA+0_QG&$>a#2NMDh~w&TMDsYUjaO34T?&v$f>fk@2H}W$V84TAz~aieW1o> z#TnYYnsxKc2P?7kxE0#4aKu?k6!{+Z6At!SOOKbp#<+)Be_>`TmTXVMIkpGA&dvc= zH7vBrx8E$o3(GS((x47O;ix*Dfu$$dzjIJsekKQt&z5uCDvx$MU~m@W*WKC3%Fe^5 zyq+Q=LSQ4|J#{u0Z!X=3{p=Hz5%1raxcs#j$5patlt&Swc;T_)l$T6#boo27;)k6^ zDrX}MBSZB$4P~KY1#4LD1qjm>LLwtyF{G99%6VQ!XL8>$TslZ^G6hzqlLbb~!d&SM zC11v85F(g|baFQ4SHX=Jv65cahDd%gt0C~~D~?zoGG&Au$@J`WlvTFj+!w-NqjQmW zfk-FAMxsF0UF4Rb=ba<)c_$b8KD&mU0ON>WGP)NAElgO%m$E#vm`u{kggqT3hljpn zLhjX<(Vk)K;I)(?q)3*wD?_&nAT}v3XFQ*LB?@&B{n=3}29#++S!*HCP_}q6sWWys z9Ljp_Eb--;e6hR8DCMz-JIXPC<@SRt&)5hr_Rr9~QBb)FB}<&5Wn$Lmj2Q z{8RrjT_G>rk@oOe3SFT4Xi#!f0Z7H1brJYNBv7?N<#U6C%z7^RFV|t0B zEHag2o)>v`9+xwnH7qhn%%GQj#$}d@F3}A0$CGkPJgI9bcOGpJ!m=qd zJ#6nqVp|7-J9Wg)N$v6ctKVZ@mXx3I1L40$#r{Hss+ga&`6#&s%{-Lz{EcB<{O($p z_R2JY|Qbs_7mBn`7v49%QY(3pIoC-pVEGm_&lb= zh1^P)h4ga!(yx!yg>Nm25~ooL&P-~J$*(TJQj4@1#uYor^~u4OqKhOKNcrW~QDFIG zfvK#Y6NsHfrrZXUzE!y%xG(*m=pbwML?^1CJZ&X5RqF5(_K|)<>=_YCy?89;mp&_s z2hy(ndPutzTZl|~dQXCt>yKeFGcR`Z-tz6U8~gw1Kp7Stl1wTT8u)eH8r|U;00>fxn+s`V+ zZ^Bn6{{{&c{E=pVCeDTUD`^Cm(zAr*!Oq4I$4*2ViQrOk|F`i+W&6L<>5uT=)aj4P zekojTnhWFqne>-i#y^sIsdJZ`M<6aH^Fn!lq|=4?tGbA@va!RJCx)WJ*}-4Lp^dm%`Owak{`w>_s370e?Q}Xi9 zwkVKz+@x&&e3URzlKV;-eaC*g1nMU7C0xRMLFe<}pBFqK@+FO&6I}&DUkF2GGB;5n~MGX^`yx0?ke!-_d8jV55xWGm3yeZFcBl^CGLf`6Px3|CC z0?9)X1w>OId7amR`w}g%t;qTZ!Jo0SKP)hh3(M?>VmJOu+6&Vtw&$kk?1NwSdHV!} z`O{v^=1Q3)UO?F8*vH=n{C%RLn=ecv2ey@q*~D+l^JU_`^mn4Gq`A<8u|Q-7 z_Q!J0-yRej`qGMA$=e^*uaCc7_;r*BN`3)0kTjCF?E9iCkTjCyLVHS+_+4HMka*|8 z_>#u2n^OM)VFC$K^yZEt%NH&P>@NcANZ^-uv2aP_Zx4#@zAZ4Wv>iF;udBf8UXJ~C z^4m_5@$ldB3bd`jua}Ddh`&ZyghaTss2^#9i7oF$kp*s9MCjI{VU!65sXSJK)>ehX z@;1*16Y7K*Ay3ZAlQ>m2J5uF79pj`#hrw29L8;DwdLeo^94`6;?{|sv%d2297?Et0 z_jPz*I&~txwL(n@ayf9ig!<|Hx&f88YGhDeGSAEV%H-QMB~{hPly?|N=O!JhJnCoAE8kWr zw^Z>Q%R)QLO8drU9Wu&TKDpJ*&Y@vsFe)rog%vGi|QCKSSaxouvV-q75jvP(OK+Mmk5U1L3rbdx-#i6*nJ8^gS`LA`7@VNbM?``|;egFG?Zx&4E%sKn)z4r38&pvy* zcsSu*U&AqDj+W|(6P-QnjLFuXP7b(8r}UNcqKYbGq0k89&8tSaPb(4~(RpJ!*F z@W^V|iDJ>IG+l5^>DUY+XHF{DA{&PbDv0*=z*%^z>kR1{O1iMvMd5$B29+u#hGQ_% zLgdL^WcGNT$hgo$WhFx7-&y*nucB6qo}I0<(#FdytdVn~lNHjRq*@1Bc{ms=5$NmE zsUp9|qKS46wDEHhiMLWwBl0Ko^wNp9hU2osMQC-gxRjz&(X&ujg7QzS39v~b)43@Zw^kh4|1lYw8D@t#5Q&m z8=N7sm0Mkhx2Ff;VpEQ28%i@FU5wZ>v%xd5g{FEATr4)`RhXU3v=iHKw6L67F`Qna zqhZcM7omMxX(jbicZgYa){X{|vC{=rG*~Re`8bhYSZ1t|;vjaoz1Y;#VjF|qorDh! z#)Nizp{IlJ2xVrMN`W%%>Z_%mXrXb8L@_RnNgi>9;Sjw11?pld{s|YxV zjAi7NkS~7AS!A+>vxA{mx-L&nc{$l74Fvg#t(P_$8tR3<)s&VA9i3ch=cD_GSvjAk zw#X5aw9{Jbr0Qw5=!(6_MWp;TiG4VyenZN73T+~Vcc(<&TKI@hY@$JSQHl6ExhAw$ ztd&g}LQj1fs&87_;2* z7US+)%JPOl);=?ip@DYd=NqUkDdv&aHuCzxLe4Fj!_IHlu+%Y@?#wflMDPB5*xl8b|D>-6zw-HN9$t|m`Ygia+aBw}fl!da$S2pa`cO909-qh81KdUK z8;za{#TQ?#VToHTKaCfI*yk%jGnBh;7{VjH{ER^V#NH!Z`}#HxmxqwQWIX1yBt|{H zj;$wix&M;~xsy}$cybFD#mS2%NSzK09o&@_H?)&u6ZP4d^nYU~k3VoFL2Fjf@uL*M zO$@RIb`qC8bpN$H-PM_`pD(4~H>u#_&XW&K;1Tyzm~Pn)EkarR*myc->?P*@bG-Y? zDCQ>m8}mJnZQIN2btQcN#9&&=Z-wuETF=aH&rqWiO4TY=+cRtCKt8=9ibK2h(f`Gr z61X_fbLud5%!+2o((TMzxQ}9=FmgVd$g+=r;r_Fp9DSw_K@N>8!WQM`@!2<9xO-i; z@KF^<#G<%{9{oD;%Jn_y<=1EwZhqiH9LG)Le%Fh{KfRqoon)yXPGZ3H@%%a^j03w5 zG2xYM;`B|#w@YB*{H}Blkf1~0!>8ZnZEH`K-PM5zaXMlixch+*c;%$jqmENwt#yVY<=Kg~Y8Ie!qhbqg@~R=#~R@3iR8{ox{0*2cxMOkxzLzqyg& zSB;=|>Mmj)JwQ~KwtTdpFN4Be~K!r7R%Z-ySeuLJ>)w1arWD( z99z1P3Gbbh;Gltaefx6c?gSovelbsfm&#k~=5woa4p%&~jAaG>RDXU2KYZ{r*M4^n z68d9(tsAxJ$&7qr9UF4$aQE}z$j8%o^@SyvhK=Nn$U-{a@DoRJ>ly#>RDSMhWy-s! zxqDt865R|E@%@jRc|X^kpXYVPO&o~51TBXSpWv!DcXLiRGSuFS^ZNRYnG8F#1^-vG zS^d^{h6mR$Z1!iY%XeVLyfJ(}$^%pP_tk4jbXQMsKset$H-dip?zm9?)8{|n^QbG> zbajx#h`NW7iCJ@=$$xIhKKRm{bQLLsjdJPeYc4jA0MRa;J&PVAd#x$NAaEg3v_J5YOx1?hjxd~6*-3y>!N|K-)4qRao){Ntyl_oX76Eg|oygjY2ZK!5q!I_4}ZFg&?SI~UorNv}-=)t?gLya909P6rhyVS9){9f_M1n zP!+9bP382}W+uLRnEP%ULN|9&UkQ$Mvqe+VIfCBJB<;n%5*X;(+IDRIb`cY{2eIby zUUcs7tM*bH_kz2o@=6~!j{LBSjvt;kCZ66ie-tkc3^LvxHd||1 z@yiazzI23JpP#{7y*!Qehtv{Hobx@m1l67z7irsc>S&`xFg^KE#Hw~@3}70`$qYB{ke}= z7de7oriN23cv%FmRC2l2_R9kG+>+#=ED&p)oE{gvO6=i$xtUXkKEM3A&fiE5Ys zyoGMFK4wFMiIc}pGW`A@cy3)f5&o_eq$hFJ&7br5!D{ZBIfPNVQCN{3!^g$y-PAk# z(J#tZA{r;wEn3BZM^~~uL(E3Q ziQM%i3KtETHKbR~udl`1HJEE9SgDlcv+q?MCCimeN$S#(9pfz;@xz*3YF1*dt-+~F zC*~#k@yy#l)A^2{cxZQtkqxPfzWLejX+8N99$1z_P4hYel98C)y|}Vt2q{U`By?&` z58cLD*S(hPNMZaH35_Ta8Nu4J&YSPZoa z;usuSMziC-UU(-RVbJ_982r)!QgsUiaVEMpg^}qi68dHVUOX@)h?1NdI>(38B}7^( zsb>7_-gGB}nYVsK;`4hsXz$IO*_{YDw~u}^K4$ED2T86GsyB~FN!uNwThJ@gLZy&u z;*<_jPnj4IGcVmgT7ngK?s(=~y5F~vw@;Sw`V-%A3D3 z!@}j_e7ys>I#zk-$((L}B%exRcSpQE z9piX1wrTwy1;NkBqOW5LUZO|3@hB!&-jX0kN5zaix738|aI`uCkf|)nH zA-oU+ncaYoiv*Hcsa!knBjT_5f)(X~+&gc$1S{^`{_0}-+_Q{_)?VP{4_DFo{*~m5 zF6>ylgMPOy<>2`eYdEM>%U;^H|Lo=WdP3)4yIH`#sqxg+jCnF zkZXjjbVrzLpSm0K?d)fFA?5IJ;dsO9>* zeq`1MyQz?>9{YGbeIH%R9vz<2tXu0Ao76i#5?^B!!$b-@BJ` z_lgU=DFH>-`9G5;+}^oqFMa1NVs%LnFG{eo{Ks{~-TWQb{g{MB-w;%&6P}5^u#>F3 zGBpoUN~o%rL`@kh_UGeAN6;z%DD7|fng=%&a{WzXnGssS!ebEa=Zvoqeqx6pqpDVs z5|FwCGECyjO}o;BHqv)xztBp>b>p&aB;NcZPwubco%=^}qu7^PL-y^dk+OrX>O&X1 zR0hxagpsdoWplRfYAv*=&YV9#3zhszEoawDSIQ-w`!wAyXD*G3U1abgfTg`Yj*QRqV;>Dv`ft7K^=f z7kfFamz$yc9VUtHmo~lys0&$AmrdInzT$yj^B6O>KYh%0)LSf+rlc@_&PTML{uRGg zi5@!$4I4!7#7@agJoNZCjQ{i`?K-z-L7b&z-R6?%5KoWFH}T z>ZeS5e;=DNU4#eYnA^6J>+b%BzV95N->?pRHa$*)p(+$@L&fAzeO3Y6&lKSt)l&Rb zJr3^P^l9VD#wEuo^>W2rU&#IUd`0W2pYg&GE1{lpb7=Rmhs&fk2cR1D9GQFgAEt`==5+GGLo%w|>^wG~%ppr3NtBmx37N;<_|-(TcFau%O$I?ma=y2g>-=3qtth_bnNk0UZ8hXp^M5~C8yxK^Uk zl~$2UDW}4zW#y|u6inZ~vol^3H1X&)iDaF+z_RZTNyh1DWJvc+AH-Kr4rfS92|k*a z)UK;1G~Ac268{Z-VTU*l53Y(616I@cNK6gPf#h;Nm?@5|rqyLfU)w;(zFh^ADxUjr8^4|@W#f)LtT7JL z`q?q_wH=&u^A&{^9E28i!YTqgKIL#&d6rng+eOizSPVD z_MXfpr%HFB7WRwdw)AdGPp4WQSh$~+Cvy1i$6c&1fzdsJ#kgt@>e+iCpZ8{WH3AGV zkHU+lo{7_|61hAgKA?Lm2|zme;~@xMOsb=chX?L4;xOv6Sa?CA(NI6`=bvbyEIX6DK%Cr1nAM-EaXR1a?@PBYY3f(LOX>yJ@b?_j9atV#X&=GoDVZSO<5 zt`Q`6uh?{oL+7fDKzh5r)nQo4Mo=E;rhO`x4q}{-?mCKp_a3}5AV_pZgM_Aj7+|77 zSCqAPWyaV9POjO+C)+CV(hdKDf_U)GD_HY(f2xZ-7}3**9gBDH&bm~#pG#xu)>CXc zoyU>0xyGBl8M%dQJtjd~bz?AADF!^OYYanz;i*SAuqh><74PlgNHI(r5QUxa)}cC| z&(79JfH@IQw>t7G8!+|?Q!oPSS~j0aXXoi^TJ&hc=1m7#DRTSwGEQR=ECC}sJ)X+u z^Pf8fj&BGrjx0G-o0Az;i5f!S5V6|U9#Q2UUCy-M=eesI>&)kC)szR zK)9uN)Ua>g8FsBY#)*^)%=+lg+h2nDF|2!UFs5Qx`t=Ork3@%#;lR#3V*LDY5BE3T zZhq;o6l|WSBA}E?%_-vK>5Dve=Q=~jdv^$LT46%Be2}15UpMxN;iZ|aSpC*oem&H* zd1Xl<=hvR)Shm;$cZ(s%TBBjRRGxHxhxDUHg02%M)7hGCSQn07$YS?7vHMNsCQKX3 z%J;_7-NVgz%b36jrVNc{-=a0VA`aZx#$KVU0`J6DbjizQ!H*{-P6=gNoFFQ;+-SSB zkPGY2bGlGDSIh;izgB{r@F1SPZ#;{i?@fKOK2mSwz0rI_H5-3DC-zxA4ID4m@h?60 z2J8Hlbd0ajoXT1BH#dO-qtC_om^jes2U}Wevs}hMK`{ z6}z)$2lVd3Sqrh&Mhv2kS2r2+KM}^bI>P2Rj+Yp-Shj>>W-chP++>p<>sL`;K*@)hC zKN_>Hs40S1Sy@Nhgw9ygAK{r8Ck9Ucf@A4*bQ+k*IDb1{_+&M|o=C;NZ!fNiP=-sF zyiQve=rh% zF*9Y)Dfg|*AYu4GtOp*ZzfUpOKkz*->@H)@b>p#~x{U;HsYmx&sjb1) zza{sL4Pn!sgZ%W<0qLF#H;!$ObFhQ466oe*5^XpL&6}V1ip)5RQ`3PhW3^GW#Les$ zI@#%Z58}>>bdH6tMNm^gssxweK5mlOOWEow9(;W}-#N!}_@Oow7D{oWgW6F?>gx*m z=|BoTt>bugXeaVgj&a-K3ykX@EJ0uZ=^IZ{QEkuA5uJ&bre6DcHLDM2&|z42#)LYF zVQZwey$WPTF0UW1rC&lUH;sys{xq=Q>kD{#SqvXmru;3eF!rI*;JQM1o4)laPQ2EW zPd-}7J6kgT&*$7t%+Q7Hvi2OO(+8<6xO)h*TWdM#vtCy{FiUp*ZH7Bjcb`h>0CE!cTacUnm{Y3%o?px-(wAW>WEL7kc3 zvYdC8CsC*SV>R*ecR_UBN%^mbIvQi}zlkVSr9`wG#EqfloI16KnF~|!?b?+EZQLmn zdCRS`if-H`GWalCZfr+`F%o3qlh5zNdhB67?dwjmuI(c3vaqyL=u=KWfSGtt2{ezD ziN2^D%10YF?3ZH`eFSN-ClqbN^w=SeYT#Hk={^b?CvOSlZW>27g|1AuTcQ=CId|la3*T)fUJe*O5#nTN>CyT+t z#{Nlr?xLsbPjggE(}Sa9=-8<(rN_>(KfO%ssY*lx#UejxLW5fIX@+c~tEw2jrlYIxp50P_ z)!vVgHcr%(%XzV3UoBeC%t@c}%uyKH$rtsFDir#3HJw5R9 zw&%rr7Sd||R&u1yb=P&IE+>oo=YBx! zU~H6wWW-t0oU|#%)uk+(rxzWkL$BWSaIe2qr6COUCbG{KQx@#Y^uAu4Sape-;owBqR*lcOzj|i@Z;aQuSQZ9!_NPI2NH(qrO)WJn-Eo1)_+V}rs+*b| zq{!@PjP$t3<)_|W!i0&R@a?K(EUp&8x}NKwUCH-Jwe)H2he_x7Xs~)YH2qX{2?#Nh zvU~?iiha4dd$^p{U_`z&6Lxf^L!1i>Zdyp2n}6lFB%-Uvwe4E~NHkEta%xqIMYmWrgB#^#zD70@F`aT*uWON{LO%5h;5&1XZKD6a4` zbMbhZ$h8vGk!~HUnf3H>f@5Ro9p*^Q-(-_=TxHMrL2b!Ckip($kt=nw#o`6>B+^&s z_&3JX5!9&UHjtou^We(skIrJ(3_UiHkQgF-sgqd1#G0>`)8XEqnY}&* ztFfGY1Fyfml&%l`%v~od2@@QwscBqy=cn`?^chF%?2IkUW{+!43$u9CloA}>-0@bQ zCSL3k3OX@Assmk*tfb?R&v`2bRqfEN%8?L!;4U5k=;3dIM za(0Da;l$MbBD3f62o4RUU!(&|cBDW~jW}|llkNj_?mQP7N;z5J&%m}pTs)gjk*K5* zy*GijR9U3^W=UVBv^O3JpGnF!9*ZdGL|Rwp2Htw`1AL}zk~4Np>Jve=(z+sp*xSFS z!~CCkerK+jDZR%`n6I1kyV{swuEB1l;l2Nh{>Ha{42NFJ8!vs!u)!bl)yZ-qLoGbN z;A7e>*haow{pD)i4@qpHKEjUhqnnVYL$5^ky*81Kf~;?7AYuMaBKC?;8r>e*LUN@u zgIbIImxfIC4rH88V$6*nGHAjgN+c0!Y+Pdkr9(A$zws+O#g=w#D>QS}N!@b3Hisb# zzGU1r-?FK|Ov{FB?wVEKR`VU&j;ZiFeI{Yiad|t9x zG;d#~juyF0%_Cda^~w=m8Tw*_zX$&%*?$CT>u?PV=0 zPB^)W@aS9`9idT!*Q7k|#!}1@G34d(>Nm#;?3BRnx2Cb}tt*)mRLkApNfcFUZ#>3w z)71&jpQ7Iz$8hl!hbD&1NFG!H8|wL1cLgw_8Y=fH*IsS<EC!u=m?;r0*qaIwK%GBbDjTswtRUrp!h>)H|^+vCGNko|o70@`t~0+xIzi?%A4At~p%&!C9huByjwVsjPZy3VW`R z`-^If3{pqU+>Ff9ikR=2e0)Y0QCSh$af{@pk*TLN>i^iM%1 z_b%LtP*gyq*|6R6r`pPxsbkpl{q?N6A&z({`rV-v>AN$Q=onT?u)AgT?L6q4!^0n+ z6#a;2=j&7X_07qAHLC;u`Z!gz+gJXYwJ(NVS&hegUViS>2%fhu&tmXZW7zh=wH$bD zFfP@F-1NmUe01YZp|h8#4@uj%^VC)iJ;A5B9@TX<5Z>P0ljta!Yz|2hyii&~?<*#8 z@PR(`^O8bZM#?wt{Ux?W6A<}rcC<4_-<*x?S}PRLl|I8-@na7s&K^9%O)qcY(U(^6 zZ90tW9!1v>dkK|=ELqtc-J8bwoGM&2tCBwEq-3#gPZ|Z{k32d9~~;=x?9Gx>^-qj4|K;l{Q~!G(G6pA zSaqg~08e}N9TG=cQpNGSGNb=TkEZG{lhCt?24b%?1eW^JuQI?fQ@4S*_ zpUvc#k-n^1d4yeAqBo8v%=$JTI>$}dqI}M&Y2rkz=6P z|Cwz4ZaTM5>%`qRO=SPq*YfmLnt<1kv41a<7oMZjz&;#*_gc2RK7s^GJ@a1OB5}2= zkuTnH%|O*!M+u&+Aj&7;NYzDqFjSn_{t2??RhMm7)Y+} z5f>c8y4R+#>(win8dl4#pX}yhT^mllKau+rMIM@05VpbJz@OVosIDG=QLuP%;;$?| z#EN6toX#xabV)5?64)+1oQr#anQcc>IeapQHJSCqg?VxzO$@v^mhAFs<8j8?&4;=D zhf`FT#L)WraO}`U_DWWvQHsSUl$7Ha*ql@%qHDrIjBr*`Cc9Gd*t<6amoQ%?=1P3xpt0|GpF<-t5YQ&fvI>tjw&vG)qoRo9S;v zp{}fgY*BpO`zEWbl2aE`c<9ID#vUifB?Zl>b;QF|$%i}gh>LcSHY!=Rd>eNy&cMUR z1z#V*v964l-&xIvM}>Jh#9(z}WTH1q)*RxMP05_jEoEOyDIo#Q98bv=hjD~;6}mB_ zMeJK8U#&X9uKYTz!e0+@0$Y!zaw@+Dt3Fbcfb6hjoSRb%`E}oU$x2Q5N^p>T{yei@ z-O8bYdK{!4Z)+J#4`z^6UBk}PC4_{)#$8DqR3ohckkF#uFdmXEWuwk2a?h9vMsJ121zM}94xgXu7fWtR-U6;A47^w zHaWPGbuyVXN#$51Biwf~jqN!icX_2;thC3WESvB5Wax7~G2(TkO6Jx<t{)1_=zEeLXmG=z{30 zI4RXv|1gq{USONh`M{%*&pVymZFiznYU(63Dwb<78LGszd3LK-O?7wS)#2 ztFeF9PM!Clbk>Qxk_5C2v9Nr@362(vQ8(4$5gI}ppDI=#&LU4A!AkO?`|SACRjHoxbX&}ZX$R%KS>?qM6Q781V`1*3}@Ok#?at>+5m=l6=&}9$OQn^_I*>gHuQ=fYa|LnxJT|AS@ z`U^r2soT!MQG$hZHl598#kPy2Iye#PX2<>`XPEoeZX`}I`ma;?d_*@N-FVJ;1-Y=H z0c&k3@BMO;)F!-*1|%pl2fK1Mv&@)Vb9&EVhCI823TF#;;>?3hWqiLgg$hX&0z+M> zH`TCk(I#HqkSTW914juQ7oRE=C)^km;~_2pzt6x2URks5WJ<)x1 zTG&mg}Byq=avAcDZ#zRDUP+LIZaJCe;=i!)I{&Z3LCWZKnJqOUGX5PW$5MGlnJ6X4@aenlZK zeZHNaju((Fa=yOQ9)CY4YKn50`}`W#XVl{8ZpN{}p4^fON<{uL@`~7UMsO-Dpw>fl z{oonC+9$H9k9hP^s(lS9qTA~4j-E(nW474dh8psv?ShF|i|U!a+u?tZEJ9q9YW`pmFO zEQn@E3e9_!=!7;+V{}~=HNxsB^CZB~xh0wb*h$@bT{2Lke1kACUsTU{)+g5#2UR9L z)@QEzyjf@U>u=p#L6uDR&rux3sTwl|{RB6?F2ZW;MWTXj;45v^OZ~cTMe}|(YqxMbby66ny=HI%$hy*hRt@OQll>yyBQrt9qx8ZgezMWyR2M`EBfTBWQyh49{S3V+DmQolD(928qn%(ioe<<)fe6GNM+8DQ@N&p zyqaks4Qe0NC#Zhw<1FQkuKD6Dj zbY(%iZ6oN|wmY`f=@=a+J2pDDt&Xu{+qP}n&fc+Y+?;#)$dAB6;se0Y&JDXa36W@+reA4txy-<22d!Tvk zc=?dheLwE#I_ujC5LDdXg8U#zeN}ku;CSDB>I$3s$YOhS>G25`_#kk9rTzOPe)*c` zW%f@nV9Dm>z0T^5^^x}Ot;55+O77#Zy_d-Bp~?7Tyn~||A}I*`@jZL|3BYuyJFx2m z&EV4*-354mn0!lV{rK@Z!{eh__|z%resQt!0obnEd=Wo?D&u;i-LASnnd-i1xO$lU z&{^?;^4ZJ$aD2R&KIjsT{+R5Txcuw^nK47KpyvJcwNGQkXGB3~m&??}!d3L-$7aJ; zug%zdiiedg%)9A#OuXf8D2{4B1WUbut}l(g1OK`Cj`ungK(ANxUk|?jSIozi9-P{L zt~siEeE62X{ol5iL`eTHO<$jUMUz^Vw5^>^&iA7k&?<@e-)X~l4q2vJ*{*F|a^GBh z8}nSv1>aeQJ6gY=>z-X~eJ|+ofvz&~gilXB{wq+_K2uQj!F%_iz~s6jgU4U59$c|Ag89Q z2ZpnvL?IXfMr;gkDt*4sFK(Y6N|`cJjW-~mmwfN=%!&~FrlIwXmNPts>&PbPwn+or z`GGi!E0c^bd1>FXq%3aTFui^475S+GOE8iF;V4GsD?142c+>l; zI7}PhUpSF_Jm7a!V;zyqco0t8!yZ$$)tuPpV7R*p8oZuZvpAvDd)kY{Q!=y7!|P0t zCcw2sAE`;CFEeW|Oq)L1H%sjS47=obrg|AfHXe*K+Q^tbyu>B1kzl{r^HV*tFI5>k z847L$jxXPq!UUU4Parr*6IX=2=RrBhKl64oAUK+CnV+TmT92z_JHhHqq}iMO%6*`z zOyX#nbC~^?IhJtEkkfv(?0SB2O6fYry>TkbxvaSEI44jc&WSbW?qtYQkYgQTvaKbq z)pU;k;mR|FDQhZKoj0#8db{m+`eMsNm5C$ksmI00$Ce1q>%nHdS>QDl=j`ObRRMS@ z$JSV~3R|>Y`*gcu37Jm!p z17hT0UXFiX5nRaWyx#$3<97F^GAVBp_#N2u+R7j49^P+^h&d>S)BCo;FUgZN2#ptI z%d-|GZbQ&}x8XlLLQl+I5^)~D!`h)lOaS^G>R5ab2&IdNim@Ayyivw#^T%2|q>T(R zN>*!bC946tHkqr0_AW)8{KPts9dX_HP2Tzl?_UX1niAG-y6Z!~4uR|6-yY8p%QZXI z5Kf?jwfl&J0cwInqP@|bc~nvZt(Dq4zJwX8l(k8WqQx0LHm=y$Q^%eP{Fmgvn{AEX zy%{Paj<6(!of)Y2P`T$9z$obb5dxcR@oRCZ-kI!F7R@%!HqWk0zzpr)Hate;*})92 zwkZdumh|Sz8a`(ys@BKVxKQ4uhiFnJ(wNYSvz68+-x|QZUe6&{E00RGnNJ}EHfCje zEvrjpRDnk`+7OaX_BwrX)4`pA{qHZPlZA1bJKYX&gUl@rWWo0tM(QolTa$7|25Y~< z=IWMB??64B?{r$V(RrvzxV%rR|4EgX(A!gxbUcAJ4T?Y|nO~mhtUQnQA4R-BsV#|V zNWw}8zGKhTVT7LbCKH}aN()jlfAr+s-rAe!Evb%2G=hV4ahGo`1q&U+vz0uV0F;3> z7IKt!{Dvi)4l#kjL#zWeu}hdlWO+U06AP>l|MbW0XbvK+o=!cj& z)tVXS{?$_nQpeRM61dqYLI`?xq&?0AxY>FBWbA4QHfLnzYH>K&odjhQTwT{2zT}t_ zwtlKt-oX|aJ0jl<#rL^_)*>47-{5vN4q;lddA z6{|I;g|ZN>JUe@81Fc4^v{`s#t}r5bn!yeS{fV9*7OmC`V#{1s5CeV^mcdBTZ;vR;(1G3({ z!zoeVO#M+!>SpK`6in4YR^8KsHz!kdugdgnj?QF$M_FP18^TxQCQT&61F#evQSr~J z!ntzlahDR%bJJo?mBc7Fk32x3hgUG2xYp(iuup6okT?=vM3chxGs5`7Cs_A|)73y1 zLoO1&XQXq}l}$li#niK&z|gxWj||0ZLWn-Vb$QY5Sj~EYQjmLp+xaq;m zm8wepD4ap8mB$4jM`3y7u3Y&FMD>lp#{J{Lh^8MJjr=lfO%rsl>IJ_DfuLqr<6`)- z^4+x&ZhI%K71Vg~4WV6Vh!AA3SEbSZZG*fl4`?z zSP&3?REr$3|9>5RtPT&A?@pJty1I`b0^cwM7L%|Bn8 z7fFfnx9dtJ%-X!$pQpUwUZ8ic-f3drj5CzRHwoMVQ- zeT&8r$Aact7)eT0z+Ve~Ya$1UU|_-aZ!F9!P$ACK_yvZS;iThTlvLCi)Uqlh#tRpA zpb=;uWB;2kM_ifd?*x}vmcbkKMe3if*awn{A~X-5Rc2ZvgUQsp_=9+W%D`$)6nv0h zRh#ofX=M${DaGF_X54Xf9O43<+v7-)fI*X-?O7Ta)6KLOz{0 z1UibR_2_%C7zN>E7Y7N~)bVZYzWTeVlX#0Tf7e5;YM z#&L7mcJzF6sdZlv3u^O5vv@rquU7t{^PT3~b(HV2g~7a0RF`qEZ?DV-f6;}j6x&w% z(*lth*ev~v}A4S#UyQ_ZpQ}nIE z_?ycOF!$?~tNU7l{RYy3ddoe;jy4)sr!5pw#I^p;F&dlWSuZbI?hi*+B~|5LQj!P) zsM~?f+#oZ|=O-?GAo1kf*e5l!+C~?4D8Iu{SN0$P28jDz-#S8+&ANL<{W~NKNUHAf zPAvt0;rgw{k?)nS8tvJgD`ketP#=>vJdubp-vJu2i$7B3;h}e`c>%)*VfH%Q^&yE( zOb)-hv#N+y5I6IEkB*G$VP_{Z=aF{}n58-VQ1);w85@d_HKF%`_GU*j3@(}Ac6GBL z&a+}CZMu-*Cunur4Yx47!dP|wyCeL7*{hk6Zu!4A9iJNwA_z1kLF?;7pKqlWmk3A( z5`l1n=dy)5Ak?nQFVAAF)z&X&>%U2lPz;Pm8sXg$tRqeJx!qKGzh#uF*%kZGczxq? z=1SRx(yf%T)qmNs^wj(Z0>lqitq{tbUkt2}spAhbByCIJYg)6r2nq%yxwGpn9XOPy zR`4bt5fX{zw}s9}d~;48TRI?cyub+sXtN&`sA@nZtJP3LmbGyic&!c3gi~vGtay+H z+@vTr1@n@%27)CC#2HQOK%O`|XQXBasuTBU>hXta0f+`{65GlfzwlZTk+&tJG`^bV zzw1bdX&+@x`+o`MVW2dw0UY;__${lF^g~KyD=YRg2D92B zAR7FQz`9>_pVW~6OEiY&@c$kWNRVk=$?D8Opxa6ka!tctRg+S0;*EroL;6NRoNOm5 zsDpn#(afDy*RF=lwg3i!`?41|Ew`LddApcegV*Z30W9|wn#|*Qu_{GlM{&p^Gc86r z7W5Ts|KurEi#!+PcEJ#tWvbt%c$huZv4I+7w*VhEF!|UCPSRw1Z3$ zo@;)hqsL$bDuSGt3!0W85b@rC!s-ZjMsRLb`>_+WM?3xf>ANRK#qPW2g?F&aq|{rb zVl;y+rC*$C&K~YboWrN&kZ%;h!WfYY_tv^Ff=0bnc>0_vU+Nw}(#@;h02AL4RWfM4 zq${Id_s;|Mp~bw0>Y7u0t$T&oC&>xHOGUGk<+y=kp#-u%ecNVTv%+|HO~>29$0-9H zykKRe`9c$%pg2f(W^SwzRF}R42!=GxdW2x$+rpBgH?`W%LrS#oJC@1mnilTK{;;{6 zc_|BeNAQaz_R3f?d3xS~@74Paq z(kdfE$$-527`Zue-Ty%k-gSdNUhUingrtxjySH&VXYN4474AD zU!7WCJ?CO?KT4+CryvrrYK9 z>SWBa>KU{*b(_go_r~ z1^n<5c~OlBy+QQ@cD|)J9UdQtgdye#hm`%WMbpmLhK_@&s~kQ#l&QM!aZN7R@SzM= z1lYzfZfHR3&30r!EFr?shu+m;Pi~E@$V@qtK!`yxmjKkjI&xjXW!u|-?ef#6d;4^7 z-(5z)HbTaIpwU46GaUSj$PR4XI?&^VrOpfG$HrL!$xO#|G3G5I+B=*Z{Il}XHU`1K zLg>4__TjT;D)l6y$skfVnN~&jRvgd=f>dy`!Vnvq7=yQ!rB)Z61kqmSVdr@Z{RW9U9H-$72`3;q4L(sut^q4}*Tv&`|Mgqz;W2oFOr+fh>_G1XH8( z!^q6JxZH=$9uloNUbR?XjaJ9#TNLWSJC~C9CBu#G8l0^CMq0Ko8=4{~YV9%q72b|h_ZT@D^#n51D^1)UN@{6IT{Z| zyP7zwbx{)EsBBW7^}H5ibJlgQFa=YIp{U~|b|*O&62S7jN(T@)SQk znI)gVZ{g2@imHla144q+LXQ1Y#iX{e`ioLweNrpBPeI43+*#haW0jX`YB7JiCxomm z%c-wlmZwDqE;8F%?*6^-C+)u%gl_~4xB_d)oVu01 zG*fH*;e;NBSq!uq{dbWz*d0fah2pYMXfY4Ps?qXU)w9s!+?~1I^wH(5Wuzx;&sKPs z3URl*CFKM3A#>>S^yN_Ey^hBqjT$1FYbd+4v$R$Cf-drvB-c#ZEXrD(=1@e4peDU{ z-=B1Ys*Hcmw4%B|<&R|q%~}^UWmlo$hBKGQ5|}>a&KoiMXL4wN?$S4NTbC@e7B;cp z6|aC>rJNdtD;J@11cKT8XnFhvozlba49j!g>)<~_KJfXInKeE5TVDQhoSCLmBj~WN znzq^&oQY>#av~QZo$V!@bEsZiwp@|8p`-iJfAqArIQZBb_)~%z?KzrIrDfQ*#!vdn zbAa<&5_=KST+t6OCcF8Y>tqjvf?0n|OsD}9ghS$>>TjA5vjsW6SR5wI<)-M|MYDgI z+Xa#88)vstZ2>yeA%+$7SE`| z&Kf?w9&3V{q2!I$6ZW37if5`?eZmg5O`_4Od}(YpRl5aVr^EnsZB;MA(`}CN|?396JTU|x?9*- z;}ePpDq(0on9dpNeG{TK9eD`f&t$G>c2|S0JR$7w>@XG4B}lQKAl}Sc%)B@7d?1j; z(6$2w6j9m=Z!sCXu5&vuL{?x8$V+FVtX9%zZB1ubfV~D75){DOzYk=Ad_0X6KTH^c zW5bx5tj6}+o>@CBzL<@)_e4sbB9!a{OwKcyc>-R@nZ?4v2rv9;0b^HMMkVP+r=4PnE`QB@DRai+LTC?*nHW#^bF(X+PO%@rMwB>L>r8Id@ zO+*6~9JW9!md(`R=yap?X`Hik{l&3X#l04%@lQtCli_uSbI;a$($=xZd0LOlYxJ2d zXYYDPH1|D?7AG03{Rj)u<_78$Xo&bI53v<6>`UxJHSTF>2hzkM!EK_ z@5$2>KVXQ0MQ}1Rqk-hr(S?Yog}e5|6;}n-cEf#%Tqk8d@qV9X@pKZL+R~RYw-|?4 zbtF1g4~PFFY9}pipmM;i7GT6jtqWhz)lr=+0cs~WWF-aix<;#Hc%XxL3vNd@?D&XM_Mr%25_m+0~=M)Yi1eSbSAc_F`HABGChigC&aE7`A zanfVIs@76Z+L>vX+m0U$s(ihHd_JpmR3S29N_S+(_$gPiG^lt}Yfo$PT*fYn<~wTo zM6)ycg%;javYOl?kxWmIU}{m7*;M{ltL8EvWI-zd>B!-g3Z>`Eeied4Y|w8}SrX~! zec!x}%Q+E8U(PE6@(^wpe|oG^n77( z>@As}%OA~jR`LNB)W_Ws+LTz+HrqQ_=V4nmZJ?_`VoITwyGY*Hf!9GWmwYuN5ET-= zLYXBqquaJvvBJ_tqy#MrmIqAcfJGxZY6Tzet%M$I;TAFN#xFpWjU`Af_m?JpJu;yM z7DtOsXf_k5FU;laW|GwDjCD-HmhTg!a~bQ$#f}IE8EGCYK902a*1W+5N}2-gmC$i( zt~GaBn9RVO`1}H3g65DRlH6_$N(Bzl$)KG0tgRi)Udl-;Qw{+BAtK6XBXKUilz~>l zfWx}?m%Yoyb`sgsbRz=ZIevFTK(1|_YKD4XhwUCP!CBf#i)K%|IkwIsvJUCc#g&gs~d~n{SNi#vY+TPjl`! z{kI}KCEi3MJrtzrE;iWR@n3i9Z|wJ{YmDxV;W`LDuCPZ1JD)v>qvlR6p&BQ<{4=;tJbEGwpY}zQVd=OGp_oF$3e}h+iX0}I4 zPg%P1WPdUp>0!oN#*}oxWz&1gl@IaUWc`GyStp)*QmM5V*p~6rJS+h~L?HECwU+XD zZM_E-9Qu+a zb?&220e8bcAn!~(1)9M3Y6ltYyThn~UN@?dtc2Q|aOn`J@s@#mBc~)^dp+Uuc!KO7 zC19cjc+&kpfwe~vVy{TbVCc>R41Bg#^)w*&sPPjg+bit(RQOF%)%y$Y0)M|3fV9Nw zY{wwT&(j|=nL(<-w8|Yl!g$)<;sA|FE@4~qieGRrdGmUG#s&7FdU zYgxqAlh^&xzX|ZgA-H}!E*em~0T7q{7D_N5w4-8r#QI=5$U<~7yhOJyqrjPrZ1i0t^@T3Mw%n?7U{`6 zEKxTe_pBcw>gZkcIyEd}P4{RsdHiI38^ds6 zdNRfQUu)=7cp3wy=lxXmb-03usy$OV11{7?v5LlQ*}}^u3%Aiw&F0^ZEl%9_Gs)*>=8L@`DBBcFv&1K}nf?Q=nZRbr1iCCLN=-cO%S7zW!jmux5RO^68+gfO*K7R_q7iuKGZi?<2Kv)64E3X2 zee8@EAj^zfX@r=J$*<4)&ZhIzUYkh^7$^ zke}2)@@%?{lB{&_eH#=S{osjIm(;nNH(8c$agOkBynj%t_TWEoZgu$-NRifN*fNmf z3gH1%at?QQx|bOae2jNDg&ka179cvl$92WT6w(w&?Yj{#13ydJEq@lO zVX}lyCC4N83&U|%(`nmgOiNWlUfw1M@wsj_t+&B#rlfYug*RQ_ZKCVEUqP%0(KnYA zKsM2j0=sn8mKe$a1VsIeEpN*dh>LV{G!5=_dKxk zvj@BmJmYGyBN`jyPi71y+)E{Avt?UKfeGjxaQ@K&&Mk?f^LWiLH1jzB0uX3Q8Snm^ z3G6PK>`5ZD61kwU_+f@2>*AyDt3S01K9#s`se|t_WL`7>){(Qc5KD_w3I+k_hl0jtTZcxTqT5J{}>}ja_j;UDHiY6bD90 ztgg+mlf)*HR%McjU8(+N00^`s*hFC&UhEGcfXN=u^Ulbj2Wt1ti3Yct{HZuFuB)eK zd*~B&P2BA_I%pqN(`zKZg~(N1gRhbRtX{^6=*$lI4$(a#TI)m-a|INo{DZXA=wK&-;8!l9y*x?kJx^1Xg@y zu6Hlrxdt17jVOIcxWkDv4Bf*>p!VnwSN-%^v2 zf+}EKDf<0a)rHjZP zcDWO2Umuy;$BnADUBnL1J4YfYl7{v^&my09D6Y1LEF$ats27W<(s=N|v}OPJJWzsb zy3oOb=XvRBR8AZ@4CmEsH*TGwM>SAutIOa!r%kE;23dy)W0~ZL)IsA~m(i^^%SR_#|?iqX1@rv5E11qVl(KGK!=`ez|k53fW+ZuB0_ zcG61=q>K#~xli|0!f*Xz4d%4k6H!E1V~9sZ-5pnnMeurimxUdZcC*=_zGml*(NR%d zP$WC!;Z9L+J_MA?CdDXh{#sl9A=Xg5542&B&-BVvFN3{AH`OPm!Ql<{Y8jzU5%-oQ z>0(NQw6JffXhI5Ff%I&@gEx(ZTZz^A6D@%^IHCim9+uAQ$ zy|aXdk6~h^Wfx0he5pDGBEzj_Lsc zN=%zHsfyy;$r|tyBnRrI4rNH!rL4^b+oKHHBP8da)rJjr;>xQE@s8M+IujThyTiEQ zMP1e{giE5B&?qXkIJu#62er^`rHc+F8W`mh@|NVa=4Q@xK`dtgBIByQ`gtH#F7j~N{pG+B)0)1|(mGo!7;7NpR4}#w8SMyP z!$-ltl1a?z-t?f#bR`im)kweg^zMn_tj$x?-Qe4nq(d%9m9%t^X{Y3YrTXEHc(GW4 zjU_)YY0&$NZ0*mX@%|qk_OvI()K!J5f3>v$azO%w-0l(4*8?PxFuTj8H~6;*`4%78 z{%|ZSO|+2{`UEA~4g?SP4+BCX{XIQ?XJwo~EfO4$t)KrSrtQ7o==nG(B@E!omL)$) z#{S0{`17GcF35el^edSIE1?6@P4XEkwDww3Yl+ru67otafH5E#2R@lA1czSw=_ucX zSqxG!=upv$-&p<0h#TTE@0MS8ciSM+72vh5Z!_rriqF~ZgH?19M#UtL8owpbwP$6PW-ahea~Bof(Kz zrAV0{bOG1sN8xiP3qSNvuCuq3od6iNmw*h(^v=nrcurl7`BA@+bU9w_d83_O(4dcg zrw#wQw-gxp3QVaeHHD-CnAJG{qcD z-p)K7|G;PPl~y7;D>hm{dM}9c4ZLp6L8>7yT}p+cX#tCp<_IjZ$ z)!-)4R9Q)^FL7OaIuS?FOoIgzaCXS}Kq`4-H5?H|hxFh+LfUew z&PAuEhOu)0J_MJqZGg2*1)HdYIc;O=_JAhzkJdW=iUWuZ4#~Lo)CeadZ@v;nF-mqm zi?4g}ACr6iLv}-S0s>^FCwq6OBqJedS5ErDQo*#~qLNW@s-j_3T7vzNQV^vq?D6oZ zXs505P1B9*ahQB=#%W1xxBWsTYq>z&RMJa0_UuU7v>v1PhW9@uNQ~ENYeDYRM$WMq z~&MS!@(_K9ebgpDde>#v5@KP@^cDu4V2;vTFcb~4vE;wd)n%A!yIec24;0SR&~j$n`X0H^~NX6kJ~OQH?|QW&bTM!%#4ljr9eaT zP?h0!#Cgr>2%1r`x+bw|3!}Xk&M{fqy>qmTsK+M~w=tW|q1tM6uj6YTu{I9$GG@jk zFIuQm=aL1=j@%vfelMHNnKv#j{l_GHaoM$6j&xn+ik6j!zRP2tSwB>@NJ8H_cz@cK z?ypcBkSE^_R_3I#drZ|Gdm?68O%=-V$_c5R{ev|mw(1DuO4AT}jDc7s?CL%!f*s)j z_8v$&txpg7jr-esZ@B-6Y`|kHF*~mHPSZ}8)aeS>#**T?Tp*bgg`O)Z6e)Gye!IBP zyIAFvE(kLVgw3#trQgxXfLpplFnlY)w^KF7*KO0TjXHqAzl9Qr&LAQ0{w?B5 zYyDi#v7AL1wSZ4oN^x>&*9+AlqxP|M_}XtBmB1AWL~$gqb3zwVP_IC~hs9cXI`_vIX z&9jx7X%8GqDfHPTYl*GKh9o=7|M_xk7TO;dpGg(&(h*q*^RwsP0=+9Er%qq_uU!7> zT>!~vwJ6ANcZZt7T?~ovdv>>_1bEenA0^j7^(8dm19aZajOEZ9EX90XxB1pb)IACW zjQLpPok7u_A@$LAPcIIazZ>ZHaWrkLH1;2Klg%zEW|p9VsKn3 zP*H6*w}2{$2mNe2ByX~Jyzw9ot7z_G+gz*7b2zEwt~q>emb@q>5fQ{pFd)<>xwuO# zRywXR5`g3*t=wDZ8l^srrO9g7_&_P3hKw>a%`^SIZg#|X(8dY%j)%IjaPmh;dtheN zH8Y%`MTJWKnV`tYqy|F6o@ zmx?>5mR$RTsxtQB+vbSmb>#Kss zad{aCd4qkDAf9<8tDoQ8Ork>i8d#Fz|0$ZtdIY`1k*<7-UIM@utt&n(VG<=1|?ZsswAvh$+-)1VmCuHBr>7@Bl8B6D8@_&!~S zkt$&fz{d{oonE-y!eva5`~%<1SR?gBb988H(QxXjzyqe8R6IL4ui~9k{zR--@OJ~y zz;J09G@ip<5XiiyOm##tA2FxtS}~<;P82^Ke}vcB_c2r#mBS7Sx)K)sojr2C_)Cb+ z=aKPsuY+KCZG#-OZ^h0$55+p8=uo!1Hz}{SZ>%Eg?JLOw`Vh%~^b%eo)ieZq#oJ01 zXOHRok6t6cQB%1ms;G@_zzO83fWloPJ(4&l-O;v5pDVaDPJ@D+=dp^I@4^7;dyCO? zj1PIWq)Av?x_?frr*^ns$tpjXRnp_4+!N<2&xku)dLt*bGmTEev^=#$OttCyA0?R* zbR&fInCRC4U|3nWt+gJBz-d1@0#rPl>>iZ0Ok?ge) z2Ws|cUfM6ZE+~BC?3of0mnsNq5 zDs|M6xbfuY)}~q*{1=*wm4vc=Kr(Pj-c7%E8r9K%hw8z-&AxsvNK?B>I-fp%aw8@D@b;SxfUDu&cfW#?RMCQRV8A~E#ykz@X8{qpQ3Hv zsvSt?&_mH$C--nd^;-J+{kyVkP}jxj$X-iXFzQ^)M9v&eZuI%Bwb{RNDGjJ*1>&9@ z$;aLD9)p~OM4)vto7uE`X~Ffd&}l1Ke80dH)9>0_nuM<{`@}4##AmI;MLIkeyOaXm z+Q;IQJR!HuWR++Tp7(omlo3NBMcn&xgNG z<1;d*NB&l4-umOVN`m~S#Yl<2Q7AaU)|(zzAGncl#%d!W=Fm086stwD3|M8cuQR)CvIj?p>!|$d0P)q8Z>@Kc{W+?hYKiL>j4- zm)2JG&voK_6~d%O?G}AZp`K*yq3s1+#_*h+h1fM6IM%3aR3-C2DcSVOd7kgx7j`xx zPGK4dN(Dj9D9R}iLhAFY+u7j91@nu}hZpVDvkn;8tjaz5UrMqr^H8XLdsnt@exNmI z4K0^_kD_{5m}Z#$u3KZLyoQE*xY@twgGhtogL~S~EnqkItJA~eTNxqIzpEQW#Z+x{BZ}J_gleZJE+?M|b-UL@V5lI# z1j03(wPI=yD4OEgU`r{;&mF-XQlJZwhO}4j5}GA;(8jPVkI+G?sj|Av+Gidve6bx+_ZOSDM-&WPWeQnIZ3_v z=iA+7c7Qm26&+8n)0B+<1Xi8eJqUyRai97A&Y}GM+`ZG?6`K_`;7XAPM^^5|bkD#X z2WefvU!C9I7L5u-DmFV~P^eN&1-XV)-Cu?goVYn&C|Be#_DPrZr3|n}S17OCwuLJ_vMKx;yYMR}iG>!vaO{&`1~|6CuMkJE#dQvD;S1#|d@{5!Ptz zye|Lmw9&A|*KmhpH!a790$vX=I{EWTx<1^Nb_b*`r=6k+>kcT;tCXeXY)#4YYD8wS zog)PcjOTjQMy7Q$e)syifFCP>69Bd9Ctw{JjmA9Jdn)GW>9P6tC?y8LU47UslgV!XCrImNc(Azl7IBe+lr>d8(98mge&)OKeW~2r;;{>%wCLy7bM4s1e>Q= zYs@>+sR`A(L)seWcnEKC_I>%iWI2to61fU_H!$!vB>6XJ%FiCpz--IR1>2Oa$Q}t7wMGEK7WR{(1 zIai2q>mzDJfwYRrcbSM%@bGcnP3xmDQDcmHr)po;Y`gHz~~g<|;k%9XO*anB{t(KoW}rGxKC0_bo_=Gc2{9ByZ7_Fn^e}pS^8&-<$*sg z8yMO#FT{t$h@{cRUTt!M^ZW;QG?kO`>d+VS(VVUL6c9r^v^1x(I~4j{VOnB#Ht?h! zJMQKVA_=X;gulKco-g<(uA?y&LRD0Eycg=p$qdCAjs_IyWwi6$daDjM4AoYDStaM- zpGisw7cIx*4X$LFUjFhBzemTc@fs1kA96Mh9)5mag0_E6deiDo`QpO)Z9vv+Q6WQN zv^?bvd*SnMeFFCol&U3PzkcwK#&)hyiYcugP6xD-6$f9_Yksc#MP=1?me^r`cu6sf z5SVKgf3=|NFmoux!_gO;KZYITur}6Hq&M3F_Z}j3qGv;EhCf%GV%VQ3S0P$ptO$zB z=}qL!32X%U{EE&`LxT^Cj>kvLO*?%&$uk1zegousskciHny#mL9n?r%-?)0Rl0?MT zH~2%)1xq)_)nEU{cmA2rujPTYCDs1c=ISHmOt?J)Zz|jFML(vCBic4AgGm9HqnVD= z1GMBU1E~n{uXOLlXl6K>It(o5P} zXy*uY9m!0}->bd*#nQCS9+a@P-d%bSyrU2^nair;Nqv8I@&e7;8PJ8Y`+>s5dd2@BS+&is!EtW_L&trG_?$O^SjSBG|TC_&GRMiYH&L1RiZ^zx0o zm7xkXZ_jve0K1#+%E^8izoh3DF zL1RaDeQX3S?YXQ8bI=`nnD4WO<8pnJXK0iY_Pl~Sh^)y3u(U%8f77@K)LHSZsz=Et zgKbzyPk`Sn-L0-eK2jTk49(~7*LVF9H^-K;5TfapnQ+|U(evfY$E~D@kaD<7m7gc? zd~YCDlLEEV;rLae4g<(H2=P-H5>9|87L^ilYoSLx2hFMsi1_v1Um7=ITC->C=X62Fw@P0 zOemp4ohyu%<_$3gp5e~s3bX|osr)HC%2Dx^Xej#18)sLi23$KTMGkWUeu$cXVIP~> z?lUKqT^+{QWRnP%?sr?#I1^Eo*^O6Gvbd1oEvXYy{3s98fMw&ifpvBqY)PtHVR|ef zg>z@<9Z@(g&G~((kHYu5D^MU8Q}!J)p}K#bZ{a_KdcxU#L-u5e6aBrrF;NM<7M>vl@18uS@b7oy60= z$%43{I4t)Wiq76A@RRj!vu7y;sX{tsO$x^V8g~dpM4Ua4$Pu=4s_^qk9=3=wvSPRI zEWo}C=ONR5MnBr2W6*RZsnsT3k#68h{srt~15d>8c&<~ZHHM&6lJ!xE#X6%rOU7XlOQ$L*UPeoc<6hTBAt$QYvw_|k&vSUEFepd~ z1!NYzLy5l~0Km|8MW8S+?h8!zYd(QT&eP2A88evE(%t6r#VAZr`*lG?*R0y17eiON z6p(;%$GG}(i-u1QWu;^q$OSp#8nB@yx``)2i-j)&U0Xm9e!Hf0439G(@WR8*`Vx?V z+Ruw~h9|scZWBm#?+*YD+ZWE8nc7iq3OlMX6os89z)opO-TNpQ&HXW&Q91q9co-9W z7|&oKudE{+LN2{&P=CDpa1?9qSrFNpN)t8!)qtKMH^&(-LTHdLh|}v4stsArCE4~q z3r%&DBzfqrb6ko=$OG$@7sUD7?nsWEbo5c8>$|9mT%t0FhO0GvVx+WuNY~XWf#=3? z8Ssq0!{99Qs7&%zBX*naw`loc5@N_MU`b-DA~1YIx}uy}EWCI3cWftn;be{)Dy3cT z2+>{cTKUC@GujYiJKUU};%LGMzvT0N`u6F;Zs2~{0O@yj(yGWt1p!hy64W1VB^jmV ztbb!^aSURnnWQa!MJ-FZwlgU?_$7`XP;h=GisWcqPATC4z>IH~s4oSc444F0XdN^d zZMyU<_!KNoLeG0AmN{a(Ey|Zy5B99bjA%R|J`^IJVyUYbyIj%VDo*PKH3L z^$9po@|Luses!8zoXS)q{51uliZw`OUSiGq{{CO&FxneCdvXXyS`0lKy*z$HmVH*o z@-X%lfF?+VG(eIF%VJ0ScF5#2|F{I&{H{}%ZT9t$r?Q-{jl5Mxa{JZ_py4|`oxbkzr`8FzQcEqB*zO9sK*#S#09~z8 zp?yW?E>U+Dk{bH_3^uUUcd=?Pza?Ye;y5HQ#EPe3zjD%h{r$TP-ieqzo&A$!fCf|l575E!m1w9&d-(iK{Y~G^pyl$rr!{+5pjszJZz z`!2Pu$MP}S(c(?z^~c}T(R8gDn)_nZBfp#P(c|X2^}2%ozWiPVrM*^q2@m-+%huoE zrNxYsP3Pp;z*RoYb^f+JJ+J5V2BQyhte<9nD_m-$>Dr}pzd7IBmcr%d^cFpCZr5l} zK#Lmn$$=j0`Q|c45&6?p)PUx;n`K|Wy}aq;Ue2~;QFe=12?OL}Gk+EIOFvCyG}^dS zS5sS;>uPhqn#=0(<$YIZ#=$rxf13NG@He!R&*lA6xYU37ZPcOn%eR4_92;^gA3gq? z_M6J+IX(U@&dv4feUfAZM+C88e1Zf|6ALu$csXjf0mceBhj|8B-ffB*Kl86?o_(J30cf;@Jl zmHpQ>{WkE|dnDcT@T8Ah1zS@tvp3E4UBX@Ok?-H)+k8&HFZq||GIFvRx8^d<_vp2M z0)H)F`J>R(F^dE#)e-?WGUwk25~aDiyBeb{_SA7US+WRycG^gl|9?SnbM|n@r=fy$ z$uf<{ApZeq+2H>Y&^b*y@+7itgUdi1goC4Gs2m!5U1s=w#a6T{-q%HUPn6|>uZe>rT-ZEs!x`n1)Vde0sZfR;IB_3{?qKuzc*k} zFrqK{=*Y_d1ZZGnv?&6j4{!gI6j5P&41avZ@S)xZB#`-IY zsK&2Ka8i_X-3#N{@V^KYH;rm9$4gh+)czZhZ#9i8GHO)wPr$%a%4=};XF%`Mm0g<+ z{J$G6r|18TpybszK8#79e*kKvoc8yRg7UgX$~Ql1_(!0ti2f^e<+q@?=-YfM^UcjD zUVnvub#?z*-Dw7ud8P5?ph1f2ynd8ne}?{l50nmnL~vtQuy}=EWZmPq}BCAwGJmC$Sgwp2L=4!394ig5qF3WC)A-9OGr4Adxv1xytMqk z8YEch*1rQ?L!87&)Y7^`8|I9R#7*BU_(!043ihxn z`ddx3YaK#Mcj1Rl^7}my!|vBAhCTtJvi}YPZ#bbU68m*za?eoQm01$3=qr-lJA~t| zuOR+W5Xa`^=g+i35!jWB!~0j+Y@tC+$5;ln@i1)1|52~-$HmKyZfydw*JbJdig*jZ z_4QexTJU)!#(!9O~Zo*@?D$sghOzXAj)k+aaKFy>8bhmYDOV}uEM4Tz_+m!lyc zg3+I_3j$h4O#=f4b>xc9e%RI9(YtpX zJ=d%(s`$EhioV;fD+C(*1j%_Fy~wCw;)uT7+(ytyE0X)gxG9K28V{m%?*ZMPL!aLp zdo9R0RZwleK-$skIzzk}G~3Zx$*K&-u|)5xh`Jzw;+iLQC_cK6fzH@g(ETWM-v9YK zuOz{tIWv*$ra||G&^=3>g8B5icGPFfJ(oc4YsTH!E28N>buQAxld}d9Ym#f(LWkyk zZnQ3alS9kszBI;&inOhD6jaGiD-D_*Nl|0p3*9G0uQk)-5^d$9{Zhx7&M9 z`_bIa<$;x+*UVjcp~t#%r^=GS3;F0QK-LwLEPI3(@A_C>E5@+J3Zf11lHZd#S@ zO{BjKUNzC(04du{f1`e>PuG~J2xH})@i+>v)op8?-cC+Da&=dNDy5w6Q>C(R&_~;l zdJNr^W5vB0Cy}K($;#_Re)KH>gSG~J<$gnEq0Zbwy3#EK!+^>;8vNpvB>Dv`ZfJVJw*-Yue$FRE9U z)43U%>8JH7|0@MAuQq%$HIj8&xNc+wDVO*E88VIXy=^9pY-P_BP8;7=+#7lW|8Gbgf!QX*D zzn72-sFx3q&+5bc(d`-B%7Nt@(unWhi96!mxoTQpt_*Qx-{~w$^_?ft$g4*r5NKD$ z#S?Wr`bb|a$4_wHrwwoQb7Nh#CnF@jwm)`t!u}-rP5(6D@L6*;eSv z^?l>GZAK@8O7b~X@4*{44`Tj=c9iTp#_0-ar=b?R7Lj~%MFdMXUxcVuESeI^kDD@? zHghn~O>EE2gM#^F`Dvm%v}I;H7Y?1v#V@iQclCB>+p&DCIz%clT<>;aTsU}=>=tbq zRFjUWV?4304V;(q2_yP3J*bo&mEL@LOJ8G;6;oCY$8y9l=<{HukB1kJ2>y4CZO^dQ zPAuJ;N=(=G+|ePF*;C@kJDEv}zFsJbKdg5wS?M_pp4gW=x_EQu&_#Yp7G>7gN-G1|^5foz5j?@kZbB930Pa?7o~ zjislZy0qi{IX#%3;KkbgsdQ@}%GtwN44u-K*)g76KdlEXYfIR1F%LWcAl|%XDD%fg zW1p15;an3Ft{KF;GZSbdyx4%y@V0*3&^wUivzerp)?w%4!(-#xa`a3(W^)Ukm>kaW z184E-)sNdls>yWqrcWDx=1%I0`Rq9kWmXd0u`Qp>?ZM=}Eyz85fzrq}+}k;vS<~Xl zIGRR4=MH=@yDOu+1aM;S1@iU1@ybeijOfF}fLeAR&L(_NKb~w|%IaKKUc9M4w~lJh zfS_7dY%bu6iCyVdm(P)07&52>Eh{RB9-PR1oq`yY5WwN%*_4T~_i%INmWkaNofyGG zS0~Vrkw(HE~XXoRT(22*pcyh&6y_piwz?##!)Y_T3VTQ=p zWZ|_(0pDjkGr$*iY-$I3M_D*<@I3aNyRqT6ZVYSd#i=vdSlmYG||wl-D) zF0uG>^WZ4blM3lOx(}buXeYW}!G#7-Mmd+TA=AQblRI;DVmS9qP9$T;K`xe9Y2Q16 z4`+8{e78_8>^?!JO9b!T*_*lj#9>~{z&@@$3+HrWP%CE+9!jG`_d}_yqDzks1f-tj z7-76G<>&Noi8VEY~-&oT%rK8wc~~ggE;6HL(0pA&=iRfd>b*prd^;i}x2Yea1jux+a0qJ~b@f zk%db{5YNu;&z&P8aj>}2kaB@#=Ovi9{A~&e9-KS0XX7nBm?SusloWI3WGT}m$(YsF zgE>=r(zY;z&7$kx5n;SMw;y+2*`BIHCpb|ec0?C4(O}Tt!b3NY;J#69nH%TC=bO?Q zII%a+3=PLMGn=>fW;H$vlb~f{LQD2vOykDu$MNLwmL%F0@qMlbUoPm+b>00rFZ!A; zXc~(G`bF^hExovYXe^<2qWd{!UbuZA!=;Z~FH|vhbSFkfxNuWcC*B5eMmza*^Ag zUCWX1L|z#kg4HdEho;4H-&^a+X&uKk?foQk5F;WPgHK2h6C<4^5b@*w0qqzZ=}mas zmb4H>K^$(Vk3Elld6>aB^v6{Me$ME&q;J{D$Q#$u?S`@Rm*jKGRSBHiyq_OW)-!KX zEIU43%Fw$G^UCw%2+>s+MZX);tPC903a^qHMhxkI)0s5F$Mogu;0o@3el2%h^yARI z9V9Ptr&qKm4z<;|`2;bzy)UNA9>ZwDVwDV0x6hvx?TnL?4`XB8B~x(ZhKX?$W!3Z8 zmC?NU_6qL)ESV7#x)W#C%v0!7@5s%QI^$W8&YjP%V|PG1-WnG{y^}xpPmbc554Lc) zOxn`-;w5YDJE$`W<}$wCoXnB)8N4h8sd2eMLB!dSvZk7Rw#S(#)m zPC?#`a4li>2M3Ajo51*JHv%HUNeEQq4n2EC5$)#1%svsU{B8>m>@2|5)lB~$vG|KI z?Aos*L;cHn@aMA(6$9m!YtQYs_Tj`AKQsLKQ`|bcClRgMa$RI8b6(uWmh5`wOzTO( zrXAe8ESX|OMCmSxVUKQ6^s%qNBo5`i5v>TSw=iN2fkvDpJ;n|}vpA4`v_4!SFzPm`AWjmIRaHj7yU-NUi zD>n{oiIZmQQiq*a5T9HZ$KoINaQ7F-=`f_1=%;sos)ov*Gj(NT0a z>D)!8FFeEin}^UT$c6T8f{n+K_6{y2w(=(?p(BsAuVuue>-jOG7T?HlCU^1@Ido)- z1a9T$PcUUGe0gUV@C;{OM>CH;{4KApsbT*0{dsI&XOh4Fl{*)or^r8yyZZ<5!kepk z>1sNMF2(yOt!8p{qk0qYV0`0$ER`)sqkI?ahuKw{YDT zrx`aPk#=&u=cob9iY(*i*LL$$vN%W&J2r0E!PDW9!(*UY?&V`c4rlL{gTaH z*LKB2$ltYp99_IBnDb*Qci+_qvK_g8Tx<4xxtyU3_Vd&;SJ0wHgGH$`yM}9T96|e{ zGt7Nr9lwTj=KTpl{JP-`tB+;!%xX!@nip>r(HPnyA%=u6tF zZOmUOL7$^Q@h$BG%y zIg;2ASECJ+wq%_$B-WFdHLZhNnUmpU8~Dz5#d0_@l$-bBb|me zu{<^`ju&5;LE3kNs4sUU*jEHyGF@_y^UQu%?wZh&86G8Ev#XW|#T+s zmVb0TTb}DnKi4XJ-Q@-`RBoXG^zw6I>Bh5Mpp>8AJ&J!~C~aJ=Y+ARKGnrOObt0A; z4*676TB*~a+Oj(88)`*)#lvcrp=CvuQu)VL5@Imx-^VN-htEQKZ9vg8zn zk~zJ3xR|RWEXFRPmHLQ9XkRM9O?h!C`Bo3^pV9`?(KBRJ>(bM;h)Km-S;w2p_Hf}; zF}ansxJuUhT8AL+ef(O|KNw1fU@siWm0Zd-*Y=`QX&T3}C3sS2 zQjpK0Q#EvL8N}4i_I$V~9pACNc-%jY=MPDHIhm|Jm`v`bB#MFqxkj?+Vcj~g{M(yZ z^Kd7E#S(f;(0X9wHcn-j=+--)`6Cio^V99Dy`hCMkHXDK`sC!osr|b+TpvRB@o`Mf zJje&uSjM{5^37UtT=s>$^6nYh^a;UST}83d!6eR0`dcN2)?Nb2FIMd!x6DLs(?oC$ z71r)b=G((ritf03tlrcxvhzFHi8Op|Wp7R$o!g1= z?d8L}?;RwqB$F?96ya;OQm(1yOy;p?aX02xHu{7e_wWmv58_sUNgSRKQqMc_o7V&L5GS{+O`I0_AGjHgTu68M(YTFE^p4zWci zew^sZ*&P?jtFcn1kK`QfIB_bKl?PJDUwICf_TfzF7tK@&mRBsgjpYxv#YyVecPxwh zo}Nz2q7!V{pGA?qA3xs_N6Om6oYlRJ6d%!->Z&?wt14N)r?Gr=;W4%*iQ{V;+)${g zs=}vtCx+#v@uCD@S*O!@|70aoBM^wFg1c zMrLUh73EbNtu!&`iUj6eGk^=f%-~u-dpae0;vxN7yC;pDvP(Ct)qia3v&8e-Yjs1Tn#F$CVtK`SEhbY-Ccv)QN-Mb~X_HWBe&(9)l(J<`F z>4v}doeLA)5)hXjJxBbMNu>NRp0R-vc$gX}FA+N^Hm|Cr zO60zQTB)b3ybi0#UG=5M*xHtqmHO*Uc2r!%+enO$x3S~ ztFd>r;O8QWl3sy(n*i(z$|!5F7auC;%uV~ehyoa3F>(6Hd8&eG_HS{II zy1q!816rb>h2Khwzkp(+?dde9$X|^m&<<_ibfs zu^3ec6Z-7lP8?gHF7=;LflIV64q{k}>g=%UD{k7?%Rp7sP*XJo3dXE*`BX`k)p|Jl zZVMry*Ru@&>>O3P#eOr0^R>EIXzwNXNsQAW#Dx>$L_H+yancEgVl>0ub&2e1-h5;s z6PGt|Z1Ehz>MJO3vJ1K=h1qzc%0bXF;apcik~rSj!7mcp?FB5?EarSk89hgTNKvPe zTwKtJ74LjQ)We5)>BZ}~F;0TgDyht+mQPoorN{K4bj!HF3&+!$*tad2n~oZrKAJ^t zbbk>YF>!^jJBd!j@)j}&RLS3+z zz(c!jXUyEcoCj73c%ATQ5F$Fc(Z$z})A{vM&V+{!%L|PRS&))OcBwKhGGQ;gbhOrx zBR-==px`F=ICwfxZ3L9^5&k&(c+t{HoIe&iN@l+Dj00bNF$edbe!c}@D~TZvoXf4p$JLRNvI=VKoe1-B!lf#Mp+lZymDd3Fy*&)?+Nw+Q=uJW^ z2Mugp#WAYm6aIhq?G{>ef0n?$uW|J!hgtRg2E51q#5=Fw%bWepESUE`y%(9OSU;Bp zYlV^BD=4kZUS^Ii`31L8Kl1u3ck|u=Z;ZJ$g1phBv{zYLiY3rnx-0#X|509!oGY%S zvZjvEAh8F!9I~mBanr8lHa~H?J>TG|BgME2p1OCCz0SQ5XI)%U%H4N=NmSzVxDS7W zM~-{aKHLRQd%bQ)&lVn3X<#OD9^x!*E1q@@zwzCCuCeY$+t~P{fr7$n9)El;y;64&*6(AsWS3(R`ssc=4NddV(hAENKkaQ= zCcc2%n78;b-JaX8f0Or1Vn};!q~KCTxQ8Rz8XR3Rf;O zA8umt7jyY+YNR+#bqWGzXRS(eYa@~rPs|zpQJe03rpTJbV zD!$Y`YEI=b{@T&Jc;6sKyQ|~!X8yBNd3tD|WHiZCI5`NNU2qkz6ck{OpP;0p0inS@ z#Fn1rfo;_sUUM5urC(poj>bJYkpu6KVz_%5pQRQs`o38#xh0m&GZ~!JiN|U*&C-Dj z83eTsz%MPG3wb7n#=7#O4*9y83Gs0i=dU=MY3c64*=leI5`Zb;)S%UJEGY{wyGnjYt*0S7g^!Py^3=oQ zS@it1yxymdS682A>DD}^&HDe?dkergj%0oOTdioN6*IHNXxWl1Gsetz3}I$w2FGD$ zX0{V2aS~(fnAtMOAZDf&tX3=de>K|iDZbo$m%QBl?!CXtTJKCxcXf4j;Y{!JbbN6C zM9d9xR$hng?PWvfP82E+31$YXK7PJ<<>smQ_VxMbK5_&A4uNSGC*Vt-EGn&5JV; z-PM4#wJkW9*MueW#$d&xQ{d^$0Hc?<$R9Ul*G&sy3|N}XcDVo6DOmI5Jd6$Mz}q`& z;pXFtP$vyeRMw!zIRxK*cpk1u_kq8C7oL1?7c#Dyj2|DJjdw3jLhhPhQ8;cK)_!&o zetmlh&P{jcVCh7(RycO>BtGkK!dDN@#_E-`G1<$2H+I(2i8{f@M`W;{3;_-2Bbko! z<(tmI>em)>eox`E6Lk!1?eWIF^YPwAX-KkT)97@3_2EK{v8Myhtw4{f9+9Fu%;p2U z?4VaNdwXS{u-!i&fK^sJe&zgr_r@|@Ho_m5UN{5aKb(fbyi)A4^~8g+x6v3+>^M+> zGK({nAkf2I2WM*?&cAdv>kmaSGyFZWxYQD5>6k2p_`0Ge_c-o8)rXuHmSNQs(=o2E z5#LfjzWV+U##}xdYdBv&E(pi|l6<(wCE&#u=i%BUcO`)mM?8GYP<(lQ7+&~jKjzG=`;_Dlk6a|3Ss^aO5R zu@qmfT#P;E>2cM2C#X}h_YUP#jVwiOsE2`G&Tx{~~-;c@ZD& zwsM`c1-R?sqO-z*q6%bZ569!r&BACO57^LFS2mh4chMN!Gf9uTK0J=+KfD@WzIO=@ zugr$lH3(n5v;db3vBUcOYT~kmm$N;pWC5_u@gNMse*u4LFCn?D973b)!U*2f(T-Cs z-E{8Ea+%7M8Z~gSvw=e&4YoKLNd+jxdTN9Zjb8z?3^xZGW~aTV?dpLmgAltOGisQr z2fEs!wYdW=8ZE+IbV?hOu@k4-8L-fjRLN~f_HRWeGK5NGN8HV=9VnsSRQi!$urTX+ z;Qsk2_~u7^Tu4Jk@8s#^hyb0I*?kudFjJMf?m9aqvah9a(oo4OB})<<3>bW9^xE04 zkpWOJ$0Yj~iQ$z5<+SW{D~hGHMw|-+0@Bjd(Sb6dL7caRKfx{zbaHY>%7~LKUGxPy z`1W<9Sfy2R*3P`!JgSwv)ocPYmw|>2P+!8Lk&i_(-DQ*@fzzE%CCmxj)O!13=RVv z?a|rMiH066f*6EWcXYu_qbhsC7?{lq?r0|)$?(fsjcBH0SNK-f4DZxbJU`JJH@&?bHOlUm8fMTs@* zGGb5fD|?{Gqa8cSnuhb*APkgd%(lI0WS>};fpyemPM6t?7STk~srB~3x93LV+0PH4mP2V^rdr+63kTVc zrJGqR`v~TEWerKOp%*%h8I^5jc)IBk!pvPBah`7MfVG1jNiJGWO&>}qAI<&Z(I2=_ zp5xpozvNvV`Cp~Tr8T1U8k}mC;JaT2HPqbz@=ZtH%f@#_bS%x(5gP`8QLgsNBU5<< zR@b9JgrX1ZtG*Sjw)Ti1eFdajHic~J?1Hh+8ZnMqoNVfVgQK0Y-;Uf9DVJXm+1V@m zr*v_wC)+9aZgi4%)cLv=)X2V0LJ#HNRc8+^^}NT<4#85N@^(^wZKcpFv4R!n!U~m? zPuZ^|!P61e)P-sTc__NWV?XMYkL=OJwkIeXQ4APud%KmrrCN!*g)$ZFOnG8(e4H}x z=g#?+yStRj0}UO@BfCiQU(cXa_Bm>YBi^|x18;mT>%7>nylY7o-_scnb+;qgl>g=qicXsbJ!uvt+qifC85 zIR_Ce>!r>VF?b5~W&+4SxwoqmM_cFvkxzD`s)s?5Y8wY( z5Pk>#+?#I2nJRYz2y)v{b=2a?#ULuzEafVw^?y^>a%{QvsI1RWvWBzp%QXe1dVJP( z!9xR~_43BYmrh_7bP&tlXC`9L)Q<*Ksc)$+8Ri-MQYQFRS_G83{7?}UgP~qi`?Rcm z_+1)Q_`PfD`M`PtG-hYUELHvy9)aKVW4WeYReM{K@-Uz7m z)pHfUoGRBW*A-x)GJlo=1-Io`#VvCob%cjR-d>Ht4%Yvb*UZssm!ln><^zxj8ju3BBL z3l0G(Q}IZV^r7~t9;@x7SdP_i0ky8c!11X4ow?2vAx}MLz%zVo8hVc(#r|eqU=TS7 zgYaL$zy8(y|1J2F3V48^rd=qabFdlDo_u<}=mjNnu< zXd?Y*gB2B&Ku3RnhV5C&lo24N5e;r}EI1}uXx2!k*PgD?n# z@E;F@0m~o^!XOO7APmAF{Kvy!z%mGfFbIP%2!k*P|M4&wunfW=48kA`!XOO7e>@BZ zEQ2rzgD?n#FbIS29}j;%V3D6(4*u+N5C&lo24N5eVG#Ze@W%rd+3>E;090E(^=&{q z%UVtN%|7|v-MrS$gTDUr|BWCo@KWA9`VT-}%iSV7$@2Su0>Z0i@=9J7)<%4?chP?u zNO0Op8e1)UDV+^xcwsqLLE)k0_^$#J<*l9aHW07cPag^BF#h{_*iF8)bn<{i7}$R& z=TtzIAK4kXiRJ%WgZvJT&3G11h0g|#>+CTJFT@`F2a54u4g+mOkI2ATa`}%y-nC<( z?KH~UjCn3LKsEprTyieF?I1p}2eQA|e+NeP+eW?kcgvT^b$x5UysLcpSAy`#Kv@*o zlCidvPyY;m{!1XTHsa~}69OxCPi&FNqVFmw_JHO8llkak`^Nu?%@`n?vd`YXLOxXa z7rcr+_}9wd9}8Hz%;H0w~)$5#UU^dpTNNDYJK^rc+PGwFz~v1 zu9hkN%C$atNSVAnmtSW<%H*}_W-DB~BoqF!sj0lxbRZ1^zelHXZmA<5@>J{WiaW0! zgZS=Fq)r)ub0h8gjg{I?K#qS8*TDYddmwH(R)uz8UFDj5t8FZ0YCZW@K(6szt{d8s zHhnA}o*qcSCv9q7g)Z`uQztmUj zSjqdJg2VDXkRJISc&-A^MaH$_T|1bTPG4TQ*dR5JEF&r!0nTQVI|H+=u`2W!Oe5dg@1fBZkj;d zY#mTfK63nbV^qs5*VVDgu?hprRl3hUXOQF(5r)_ApN1LX&d`g)@8X=R_*Fj2v4YR? zJ&-o3qg)$+_xI=#kj*dMU2*M#^nPE{)Q+(1blf_@pK{4@|AsybPPLCS#}-igl=>zu zW==`Ns30xJWRdUwN`IqO#VOa+kJ26(ofVC-(e4U;O1WYWe5f1o3^*tk3P>9Z9(8O3 z=~d48QL6HrfuKG#3UAz!2`BNP18Gs~%J-RLOFI>Z6wnttN*Q_M9T|=L&hcepOnTJ% z0t0C{8>Fr1@7aB+^_8}L&`Y_Y1Hsu@cyVb2G)mBJsi(G6Xy^C;5dK)eVy#7UV-p^J zXA^SGj)*ch;j%Y(;b5yhmZx|_Z*L8qY#vAAdfQv^)TakgW=|m?t$I6K=y|9NQs|aJ zP^q0AY@nAmT^8qKGQ-Z!2F^A-R+*&?Tmu&!3wd40c4s@S>^dvg`E9M$!b7gh*6e~u zu31~dMfOdn{RV&%{~Q>?B45W z4{KvP-uo#R$D2Elo)V4G-o#;T1D%!h#ZOQFIGu@0cKB6zKpJ$UL3V`h=PAqiv6alt zB1~F&^REPuL#0uS)8~s@rnXTKrHq7Ax<0Clbv~$a|=!@){xz%j~~dz>j&z{ zewI`CoXIN(4QZ3{_SjzogmD&KmX_mMMl%=G6)g;gd(=odwYxUoX<4 z0+GN;k@gDTMSeIoJ6mhG+EEBqxe<`|B6}JuWv=XGY;w+W;kP4E^!Lqj;?meqUSP?|55P^6l5k}JgBJsJX>>G_?M*nf?<77vT#H_jTZ?_N6Ff3UqGK9s z^1Kf|LB3cL=h1K9*ssXGB41(;Syhn}nYS~tCcECVP-vuHxs&%=UQ+m=@|QEwI4tbRKN-Mno#B7Y9jaBT4;86NvUFm~|w$hHtjL5z#9Yo(xdo6?neV|(&WOMQ1!e3%6%K_l%2ui)f&+K>PY z4{#z4!h6bz;BME@G?i5-b zNE2oFjK3mZ{-*a9T7*7+%Z}g5x!mEgcgIKfPe&GWH)kI|Tog+?4Dl<{PWlvj`)ROI z9v$o1 z3Qo2W+u$s=RMGW64_YM7deCzG-vb4_kCSPtZbC?0Bz!vR@a4u5^ticVYFZ#deOYjM!*j8`Z4V%6R{Oq(_oS51n*vM@@T$ zo|b^@tVqmoF=E{b6K+^M4D*wGFlFQrjP}J=UgD1-olAeND!F1F?Ay~N}0za)gfp)DO7S9}x3)2HIGAjhlIfdws zO~5NN!;vsN9QL^d$di5MX?Rv#IT4jdPNPoafw!+p!loTXm@zXOS7ZiYc4ibD+Z%AC z%?Wp%6M_?kRj_ss#P#C?QC_RT4ReNJafTaOYYix>r{Qev#ktET;%9-oGE zLjevpS>w`0Be9G@YUc1rO!jlY##2q0G&Tl_PBxe_HX8n&Ey!~X#;fPXBB-weo9Z>V zbXqdz4);fxeGiToH^VFe6-99Ij1jnGcmQsk6^V`OPQo=J5|1p1#n506Ts|WfrTb5y zLgS2wFCT}A;jYL^41`rfJ-$C)OLx=SOh}K!IF~kTs5If~IU}$j*#~pd z!qC}Vj{>6$p15Er#zuKy$>>mMnwoL4tQ8ksFcBB0`XD+c2$S7ScxZJ27EMcpEdzF! zVM(}stPjeH>d+PtipzXW*mSHB2_uv6@QfIwLw=|pq`5_v=;-yvD>n|uP#-5;H!m5d_MSvl7x`c^!YO+! z-Wg)R>Ro2sbir7}S=HiDZ8vo~6W{I(!VZ$ZKSvW8;D= zr^P_qP=)daCp>>!I&!vGW8oai)97#vbLz#m!e%U-B@$PXGuACkLFTD;Ij*moRNi~Ywda-2MFf7jw!GaM1IJT!4jnq>{OlU1P z;qsZGcysG%Ov{W!lcyghYRd6et~G9*Mcw)M0Q{$nL}qgtY6Ii&+&ScLQYbDM?uYzi zMX2r6;iWsLVMLG(H67Sj(~a9N8H;(8 z|7oc~XsWA4nR^J{TpR;qbv;fyc;KeVQE)bQAu2uqo|L}Rw8IbGGZ~TPr*P0F1n*CB z#3qL4?|CmI)FgXUv34xds<%D1N*J1p*qcFL(82c*i zaLxHc;Zjh8LM4G?f*Tl&*XG9}jebkt&;px4KTHUALVR*4rUvVlf4Z%c*=x}uN(unVbAiQxh<}D$I@gseE-%~-18HI8@5$|*->Lf2`+x{d))s` zDMn>Qz^={(E3S*jFJElNBR>@>4#bgZXH1AMe0mLd>HS?b`0xf^!iu4{jS>$HiO8qkY#GQzNb-%-4_wiYv{kWssLV&V6lc>m&PXuLzQ(AS8^ zpIn1CKd8WYOEVBl1Aak@J05&}8%nI{@Ivgc4T`j(5ek zpZ$ubH&!Bok+s33!)4>c@$0&6xb3Okun!2qObXcj$-o8ouESfKs}VkaJf4Yb#PzT5 z#@m|}MFU{@L2NtR&jQL-5~8nSnO&O<D5DRKE_q_Q5v%aH0dVGDDTeGd^B=*A$ zz+(GGT(|O9tU6_YSxIF{GmYcAUk~Ay`&VK1P6vFpIEbR*j49DBSo6&ed|B&(MJYiT zHzggZji+$m2m5if!U#_ndj^mcJZ93}%`N!pXce~a%fpxZ>k;asM@wxzR=%5q1kOXE zqX#a_^u`;XZp1?`Z;){DT;KkUbkCB2vs?hA*YL|hYZ!lUo)#O9MtbfnCYNK#6aA7X5KaCBP< z3>DRQcU>MF-Mug+l&May53ZdSh;3_j;nBCYLz|w3d0|e73k$>$Z9AU+ z$0_T<-dnpDcRa8f&zE@Nu}mLylmGMGOt5kC!?aiz)RnX<){j;UNui$ble?r{whV@S zksJ|(NiJr*@Z2wWes?{FC&n_!t-*cweU0~yJ20@1gtohj8LS=h4xhrR;o15*iB+4Cnk0=avX~Z4(tj05^oblRR|NgrmlC(9I(UJQggYp^UXN~8d z*#-MC@dyg=fJ0Y3PBykNaSKMOvlaAi9=K$fn_`~|t=uun#~Y)W0L2{Ng?l;Y^{qXy zu_JG+0&vw7PyD!=xTeyGbT(=!bK6}Yp)lkWjI3b8G%`z&A9RY z4fv|e*nexNs~5vYBw~uG8aF<<4Il1n#jJUm7;Y%UUGMC{+Tw0pGLb>~seF8Nycs(W zmSX?TLgX=#eQR|N%DSDge26mudO(H0;Om5Ci6O`g@q|}c0OD-A(AUy{=ilClE1%qr z#OwsPQ|^Y6w(i<$y!=TSF1l<4j6ZF}ZP%@Xej=TzUmG)Y&W#GBZ(~k1{G$Ew0_Xjy zFZTmpfw*TvAl7fo!HSO$q0uK8i=w^Y6X1@? z_3C~lLGg0c!Q9-0SH3u4Ohu_G>@N?1;TXYE5 z-Saa}H@PrL@j~e6Fa$Eu8JZZ5AhQuob}pC^>;QNM;@Vg(o_+2IJpW!X#!VYapXiFq zgNfh68JCY4f?!)mL?%Td%xqwv?2vxs^q!O0Qq+uZDVueMZlseZFTVRLj+&h@+S?t$ z6EiTW`T(xIel7NCLU8|Z9mhp_J9^-s9FKean{e@s-(vM4;5^z1Zx44Yj&s0$ukMCb zJd-=x{9kq!VOwq~zS&s{pU_Z@_0qsj=Zxtwdc61fUNrXxVM(eLo_XXeT(Pb{a z4kOFt7E`A!f_!xN_1n9V_v9#KIGABdPC|A|F+SPbjGl@Le0;bD4#aJ2Z^6$wh0JPb zP-n*D_Dg4=Y{%ue(z6St{vMb;E)lOkycE?tE<{38EoyD7QIlVRon>t(C~Lv);szWn zZ9>!W2H4W64o?oo@<}7G^P8Kn=ZRF5p00wG-X7m=*n_^N9u(DfA%y{p+`j7T;YS{$ z$nDckBfQdM;LIRqU4aoj`FU8KZ-8^8A4X>-;O+a*Mb+0!F+Zpm1$z(U?Y0m!zBPuz zV};A7`r^eWPodGKn>5v-x!V?bIY*IS-Gw$zypaM;xkpcz8M}Anp|h(4KfQY#<`iai zS<$$2)=1>6yA7K!^+ic;9-jTN8ZW+iDK3faMj-NA1}hybSCovOj&>t9 z@5`k|TET2Kqm8LyT9O}5>?z0b=5FL1K8YWT+m**tEj9I6b+i00#4ks1I4KJ!?_==T+G)9~-tTm0os)vo99!;1{%GjYkmtSFe30@~*N*+Cnh?x@ zWqFz--u$wdfxj7>4j1EeORuoCpGekkHTBSFa7;9ArWOO%=a!+RtQn=9T1*@7k4$F5 zn_j#GMeol*vbGI%mRqTIUQTqbuK0N)v*wm23Au2mp5QTu7O#&3uz{;_B4z;H{j#W1l%=07^{9dfj+%6VwMesW^)cIp~r@; zd(hk1g9_?LVz>kPx=freEf!7*$B7?Hu%*(Bs>%{n81*PWorhypZ8%!kZx7;J*oVdz z&9$Z2%WOR{BNli1cVf|jCQKU{fxWv*QPpk2)(u54P)FlwKk66&NRZY^o#@~kTOQs} z)~!*MUydW??Z_`{!rsD094cu-BLfF#PYH6&n6Y#c44ZGl`!hLFnij11suVZRi$zeJ zKY9-5VsATzht5X$X(SK3Ec`T4#`6#5!EJ18!W`1Zz6V zM;={<>W>y6Bg_#FW(^t|>haT|LbSWNxb3#3sN8V@hIX}}LU<*{LL9$B8< zJUnsI7SpXx;FDcugk=RGjC1}oZADv43pVYmNAwU!*!0l;$a*?j)(+7@C3ui|H{;W< z4kPN;rTA*D9c^4M+70da_Fz7$8#~d=;5uYpDlWBY#_QW^(Aw0D4|5DyoMcOxq%6u^ z8V1g79bNJyN`X$=(G&*er`PA9ih<_7!zE~KrejtTGXZ%FYlBUjcQHqD#reZRuzc}U zRBpW%k52VMd&L1vc)uH;+`$CP!wNh0m(kg4&_cTwl^Bc}*+cQ`S2y733)yfiFT-ow zs*sZCh9KV%e6h6v{=>qtG7Y%$M8t*oWSR9vm<4KuDZB z6R;@Enmq-@yRX8%=}xE;<0*ELvNnEr1V#=U#%nj@^GhPo(bfhVCS*Tv+yhjbki*1d zCUb)d%1oD8d}I%0wOd)@W<&klcl{3WI0;lgBQO>(hCjv;r^NM*3zh(sod~G z?%k6xedHZ*x#kx}<+ji;x^(pNMyRu7AkG*X=Bzk!YcfDD&ot?*O3PdE*vc;v6u%Pw z7k+@Xr>$Y&1fF~OTkws45*ZJz$AJbNJgHE2wp!)6re2=c3zO`umFMqGt!>z}X%_-V zJO=Nvuj8(@B{Yb3aMv?PvD`UQ9_LZO>?Pxn>`)PQEzBJTc=>t2RTh`(eK8_T4^vYs z1+ENBuXzi8X-^>Wu3wSYr^RzOK94b9+u(;gN29i)6*FYfQz;FWtxl3yCTLVXM*UV) zA{+8bxM^)?hapiO4D>n?wjc&h%s{JZ8}aT}n-DzwQTWdI7_aAbp?v!e_)Po+3vW0V zE8-dP%VIH|9m-GCz$PjR=LK2gU@`kDuZAzP3v^O>7$Ijn^)Pq=g54d^-qZ=bmj}Wr zh~i&m4*Pc)mPzdgYx2&4nWU7-8V73{Ruhd(dJG+1ODnW~LCk(_VG^Uts9w*&#hy4= zP5C%D*gzu+Zq<$}<~)f9%3`qTmf`SFB8yH8i5-fE(yS1a`~Zf2Qh^Y8&`G(H=e4%v zy^c7o%qBVnYs^Sz)>hRH|6pGPIct?iZ=xz|>4TGl z$cL76QN}rEbq$gYd9lwfIQV(O$(`592W#?4Q4Q90l4tb>6UB$R!TD|}u0^lEC!*cR zoa$bT%Tt#@O`5VuA1Zu6t|JjUg)Yb!c4jBUu&jiGN7f8CeOrp zNLJ?Bfi;KBxGFOcxp~K!X!ziz@h*21MwME2pv;xDWa?OH_mFoD*su>7kIXX#j{!t4vSy9JC7Mz=4|xbT zY;Hk-1Tni#;z(o?-pg{r7YD1Ax&kt67e_m2<*o;_)o7gqblOfle(jscUh9U!M@ONv zu@rB7wjLqF9zno@Pw?^{ItB7w5pdxF<*i$sHhH3_4(Z5Op{I||wKKm6tG?QT@L{wy zGv36byJ$<~8NYO_>%+d{DojX8gkwuR+8tW){jok=k`ac|2KFJmw$k>mSD-)%opK^J zP0K7bmx|n*Dp}U|Gbb{~v%@5Rn)1Ma(GIy%;T z2j9sbVo!q^4%BgLSrs}?nw-}aTRv9dm}B<4X&cwmg$Fs2Klwk zD6gX*(OaX5L7?7`b4PK3p%-xxE@-KxUR&8AOctT_StH!nseg@*$PoLoYb?RY5l^Ee zX%60%C+yjeh)OeqsiTLEAYjbn@EZ9FF8lfvO7>TyV@LvSO6b8G3_ATnBaztK zjKi{KM)k}5cH~%l+fB-n6(?1GD6iI>r(#0~K7Z>Qgho9I|7Gvvi9I5~Y|G%Q#?Xf2 zyZ0b8`~i5+d=q#6P)(8N*u@4?F2%;nGCRRVtDvk=6nh}DcROr%H>lXV*T2 zk9rIqqh7^bo9ajd?cAS?JpNoWGQ!NrtwXGkFo#0WE>20-xJWcBlgMHv@^@$q&jwX zIe77%EjSTB4BxMuiFcPL!rO}3DWg*9PZn{tOBO*I+bM8iNzr)q$)(sjp$C_|eHX5hf zS8VL|!FLbO!`BaG;w$oRcWDE*R%`LjeY0`P2ye7C7}2Bcqn@ersm!t>+?^)LO!|+z zD51TyR6ndcgqnaM`1YxVSUJj*F<2L!hX(De+b0uG84!68-k&OI$MwszFmqfw=XDNd zxOd^Rt*2pN@CU6eD(dpFwZ#?d-Z~dI$2z0DgY8H_hs*^XcP}GH+n!cD_vSuCES!K3 zA3O)k5?oQks0^n|@ z?>v0|^kPJo?ZbNqniPF8ixVUNI~iP7X?*a-i;MB{csKmI{U}bznhC8IogGbBf6R!x zZ=Z?#riP-px&u~B6lxl}vG}s_`0l}}NHbSr)xJVpd*2VpVix&1$MM1l8$7-$mzgo0 zC}pjWyzT4jL8~xI=3EG{(;>g0SXm!kncsljZPplLuEyFjS$HYgQ-56(4Vv6Ml{*q< zj(7k1UD##ok5v!N!N<3ZL}+h28sul?#M#Gx?Ubut=|jMV0n33>=-sr~y1PJejvxJa z0Di-V;_Js2;;9Kvc=d-PIB=*0J6t01(c|Y}jGqq8ZF0AzAB700=u01Qau}4m?tc6n zPdjyY|H&eh=mW6!qh%QBV~slDolO;P*wBeow|cB85Kk-ifI)9(3)UZP#dTLt#RChY zQC?<%Ls$f!d2$Z!r0%}8?kK+Bco^oyp;-Oih4^sAbc_n3ZBQdHvl*4mJy>}uGhY`i z8auib2i8kEy2;Oy&D&5KmVzHYyabz{pM_{<&x-dDU{GDjjI)UHQdZuCK07BA9z2TD zMxIw1lz><6YIaI>+Cuqpp6H>-w4MpT1NUykn7fwXllv!PLa-y6dacoV@(^A*4!nN< zJbe1ZOqdVu!IvCwPDKl5MO)*AADFo_;qawS{dl4kp0q1_UY>=e_RVt{W zb>+QCwQt0p6DF9N=}4P6N3;nW51v5sgls(a@HlwV?wL7nX6ls$($E_4(3^X)?9q$x z#d{ZE%ZD+PmxhaUZmCh8d5g7bSmm-4<-kJ-GasT!j+<(P6_~PNI$h2w12gfV$ z-TQ};bk%IUaMdulYv`Ah;DMhmD`bty!e_5chig?SK08*U*cruU5N}tX73}H@vH0Cn zc;=yV@#({pF|4ZwuN5@Y{ujV6BMU2U8-bus6AYxkm-?XPT$X&Z1zWrm@#7P-aPR0q zbjV#dMJ@%ehH(IOh>5)134ikStq8whEVV@#$HZ73aeIvJ0)EX<<{$ynf z9RnxH(TU@=LsP2}rw!fk)>)xaw4OrbL#JCydL;|@WH;_^j_7SR;21LoNeygm?U3Nb z=-k|eqqXgDa?&Hx)fP?lEy$B+I1=@fHdJ=uru*hXcVGt|+tWIQIqxUA#)=EM1C7&uK(-cQ8*(3Qazm(`>0NBC+!jT!aeK!Lw`DreL zEnn+igwXihmEnN%U)%;;X9x0`85W(juQ*YT$BOb0?`h8fqYFMRIwqA}I8xP)Zd=NM zC>Dbt7bhngISuwyo8WHKjoNN4zkz!Bbr%)UOWT90<}SFCztPO7Dx2C-OYxE5Q=FEP zHE|4qo=$KheWy78wv?AP&WX3)4jmmv<%eG3%nZGm0+ctmqny_iIh0#zlwof-JtCZ~ zQPI$fQiGY!!sevV3hm62vQ zW;JFS@;1t9Y@&Xqi^mLQdeGs=gwFnu~wT#Hs_g7S-&-tKM~$Y=SbgE-+p zcPDt+^rC5ISBQ`rq|2>jIxR@R8wX&c6Lbia)eb6=eMSlJg{ca(r*uZ?U;SaBLgv_)D7r@ zu=&0e-1^i8925h~F}OH8BHGm+216@Oa;_;H&^p*-xQ7jjspIVo5Dc6$HE8kS9MqG) zJ(OcF8rWviYi3_zw$yKq)7QfZk@Nw3DvfaA80wGJBKygkaBsz0OkLFgPn8`;`zH*y5pS<26zrrBBF}_Zm$3E;UZA2F{ zW9cuLHnCJ}AKM2|mMY{?u$2vxXv=I(9oSbV*Ek;{4h)Xt+#O-v(}^S1w9J%k8)rR+ zd)m=1cHor!JeK2d(b=Jo<1&bSBd&BmI;pxA22avQA1df19him754f5bn2D{9@pguW zV``)>)RP7ok0htVt**y#oy%P)oenIM)cfsZwk zeD$#B9G5htyL8F1lnGvGD{wZw1N&0jQ9(C-awR%;@50QN4#_hoUOT(3g*Is` z^eJPIkCgEvxCVl>9bhQrr@j6WA^7r^Nl4cBG8?SHyeq%KDY?}teW|=qx?>}`GsVB( z@KvQj0inZEU+TyOxu%?3+FR~C^v`>LmEX`UaArIf-0DYg3y;)(!)eJ@xXf0p*lCpDgRSsp#PHcpW0q6r(;lpLluYAQ;!vTrH+)#1q&$c`H^AC zBU2wgtX&?Bt6$xY0=csx^s3`icqaH*CU|}`4!Oo}wXVQFx-R2X=;xQvrx40-g=Wij zwOr{(4lQ-$Sa8q?2FFEW$NdxV;7e=p&Q@mhG_*fs3cr-j zEytF&1M#UKeakg zTBelqMDBzQ>`OVe)K$kK^s2`KN`F$9$LgK5fjCvY6p%7Gl}pk_<$-#xw6Vazc@q#m zsD1q&KL?Icj@3DpbNLL!cQ$Snq+FrTQm)jM0?YAlXy8Y!Cm?N=x-3)X)N(9yqVh|s zE4m{G>UaO)nd?$lrSEL{|AX-71D1aU2*WCw{m89P5l~P4nP<&|@K1mU1%p1h8vu8H z&KBOk3MBfLw{nWDlxUgR+`p`^LHO^1nU3;SO*aOOVi5k5L3uMOlMojM4SLD^E#?18 z5C_;KzcwLnn5F*4C=bFQ48s2!_|FPh1P0oY|18S>cYyHk-@&)Rc^ZU23;!+|JsbXC z^*acIFbIDM{O6@(Vo=o2p9SSs+CM-bOPgC{y@A}K`forCTuVFTndg5C?aUnI=g&&E z`%mKkSHS;-Zv#R2XJ97$kH#*=>gP`b8~>wu5|I5-l%KX*&gEP74v}>rW|lW_Zq#f4 zO8Bqj>8}E{4|xnDvLugo{!38nTTcHs!GA@w$_IH&Ci17Og#3#@PzirUr)3?Ma=ZL5 z#Q#@-ynR&OD*0EM53zY7Q=%-*ZT)uYY>=15DYnjX{@;PBi?ZfzAgJ^AuLiLV9sew` z|7H-mk~x&eb)CX{S(Eiofc)&LmUAGB`&Cf*Dc{7|Onn$|>A!`4*IfJ?;m-vu!US>1 z>hrI&%jB7roU6~k2A-?e`y2hOOvR(L8Bliib@@Kihvi(3&y?}g-3vQ8Kik<-aovM_ zaL)x!xxo8B2$m`nw zOZ@T~fJXrytM%oYQY2;ksAcLo|N4(vJ`l&i{?1&JV}9gNz6atHP;m}yOQkt~;YdU~ zNpN7P`*&>y)E{`PUYB#VO#KWjBYzyFohY`P55z%(6Fm^;dMn>u=b2P|OUqEdqALY0YcI?MWS%j-1BAi`MEgMMR?~a|{ z%DL2$DpJQ%rnXa$1?2qi@LI~x)KlvWs3#!jYW;!7@=cjgc-?45_Pp^};LG_vdw-X+ z`&2>BmA?5cm(HA9>Wb0t>cjMfWAN6c$#5keyGnc?K-hUJrE;3B`lRo6-k#4pEZ_&T6WIhSje`sy(Qd%r+GoIfrS z+Qw!qygfq3NnAJH?guHe+#;M~da2+~`@Co%}jMukwuNavYm18}K)ZR>zdToQhMY$CGd z=lo)8q>iEwoU1k)Tyfz@gj-wYN2TFxI#m!`!ZJmdls@ekl%`{Bq0DFY)>R#wp4u#AzZwXJ0@71jB7Nk2Bqis$}Gl|HB>%1Uis z?=WNNh-5soFa-fN{nyTbwHA$a&3I?aDHKTtE0b!ag`@mZ$ zDIW#~TH%MfcZEU|%QS z<$=pld_ z#3>OA4OLQdG-iiUp=;~$#MejB=xD>X-Q-*UK1Is7iA&y-B6|ZV*`@R?vO;lpR%J~Y z6YFp;ly?Ux^)&r^9f=T%ya|Y*areht*N?>rHxepyz-uD^dU+Xz@K50};3SK~mEaD_ z`(x~cSDn4&8~GybL>`n?`j-8O)cN4J;>V4^r_16w?*6@yQvK~=N4e_XpQInBo_#8^ zYGlUNXOES4&c;$725-t-kXFIPAl;t$72Q?x_ZzQ{I{6By|2pw#a+YX*x<- z?j+qR_1TZ|9uI{NM#N@i;?v7gluhGO8MsYyV%ABSQDtADO=ArYAw;1=5Xl#D5w{cj zR(LBsVRkF;)NoZ~knPFmpqK>Qo$ZD%e>#fhkW3WbokTr1_b@ntoV+5NnI+ z^n^#0RoUakO61hggXt6Fk*;Ha*vVj6kv)-ve!bGF{1;ufl0Bcg;U6;uiz6t1lFSLv z>5gAM4=;}QCJy2xFNFV!&PjWrn;#qEmLicm`PG_Uctg7_{zKV!O?XJY$o_C*%an2P z?+lQJkjM}$lsEQLhaIK8B7gngBL9jXQp!jh$0_zx*@s8;ld}J}ec4z?DIr+;QTEfK z&WKM@^hj(m&*fc7{r1e#m)eHM@-7}1vD>mni#joDXea{h0B=8U%!wyIL>|@pVtX|G z_S9Z(nMfP057ym30-HYGi5;?Gq6lP12Zqg?h4*LpF`xt%jgLdHbr*e(g`YwLaVdN6 z$$Sc4wGX2iOvqE4)|ymdqpj z($Y7GtyKJp!Y6*H1B%a3{f){O9*U2)61n7`y8~^i@KEaf58;pPB_u?$-;7~#xORL5 z85j+ZhFTn?0%S}YirYtqK=#);H`O2YC#w)RaU>oe>V^>#hS31g>@ zzzt(UF?pCD+VjfM>^TI_FONlfgtxLs!cTikFk}8`T%70*>y9S;a*{Jm$Eg4(%E#Xu z3*$Ypr^tkRE*^<#;m(*lDgy4N4&)TnVZ_vI+&wlN6XShxte^n#BeHO6a}E+F4n40pn;(UI^r z8*wPF4m0MC!L`|eh>H)!U1R+4$(AD0N9_`4rgO(L%ZFh?N&x1v-OmRrkUlCC_f87H z@U$>o8|#2?3r)CrW+L*B7o*)Z2=6Zs!;iZv&?CWz)(LlCoQ*}pec{}|EM!tDGHZ)) zxK4-b&Pzkz;X?RK8I4CqdLcM86c5W@MQe}4HaHLuEl5Fnq$lQP3}KLB#NJcQm^v;2 z`*$8hvDO7w%^ZqZ!-6m|)(tra%P?$QD()N`gw(`fOe3#`_<3U4jAUe>4ZobIM{sI1 z9-I_|%#093b+_VRvlAX$o`g|Dys?~e(pFiAo`gg^KQ$PgO)c2gVuwd&$757VC>F-K zVgHdbbca&L92)S-z9wn_y@9b4vFUN}sVKnOZZABW<%BhRD&dn7iASaBHs|UAT1KP%KLJ#*9&si0o~{o_Z~AT$GLl>3#^+nX$L99amj2 z8VeJBks0HTic?i+pt6Z6OUsPM?GwWgYuklSa;h+8LOL#|Oimviin4wAaE*+?qYL9P zhVxTarp0~d4aKk+UtBia8{H0`xN>?t<^F@})gO<|k4Gqj@?#bC zsA;48ba%l!Iv$VDio%qv2#l~dV^dBwJmMqp$g~8E7#5GQy@l9haK?Re(=Z`D0^>Z) z*jV0%3uk3vX^JnVr-VU6y*XXqi`$lu#yrv?+gwEZx*N_3TC9$Yjj-)8dz-<>>Pc#8c-F z<6MVhszV#rA2CoiXuz4}yQU@Ms|DeR4RuF-UKz}Bad>M+EQTfoV649#Hl1p~oOvU$ zB*X?eMJ;fo9lK_z9(nC{SUTJvhmMxO!7Tr;<*mo%3x}d=&oPuT_`G~UHWt%1rY8r&*VKkp2g_lkGZtqV7#4zCX2fH1 zS_CHg_F;Wa3l`1E#HHz87(F~3Lmkbi_Xxq=$vUjtQ;Xz`7%Yi*!Qp~N`jlRHcza-& zk1f90dI}4dPJq?%(+J5Lin~YpA~h+LbL@&=_f#PBoT145`4{x1jl@IaJ@CWcI^1^k zM9iR0OpSEFulq}38x({m&(Fm0C=ZNcVBLJ`1imZa+|mAM{rqXahGM*XFMd8zi4OAV z#f3>2k?eacn=7b``+YKXV6R)T2R_-f8saGIg zUl511)FAk^G~q}s`%o8@Gf?&!bxbTth) zQP+u?Q!{YY$S_P#4#43Pc^Exu46exV!}T+xu<@sp2un)9;%F`Q=T;*ijeL#h#&IiO zyfH5dap_^uu}wozBvwp~M#gaZIIW5Hf^sK89i4V;LKJSAJOr~xu)b9rb`*DDVrl^P z9V>>>*%Rq5z4-1(4e6KqOj!LrmA%WdWBipp)N=A`U>y~K$0mg!?|2RNHnyUZ0i3nB zH|}4Wf!V%2`0Q9Sk~1TatkYoZm{`Qxn6dk0CE~KuanCtX7*E^m(bR||RT3~Ui1G8o zeGAes(Z>o$ifYl|=7SY8Xd{OQA&&I#tF^_QOGe<_6eq@;)>x1cjVZ~#m@%3*+uH_V z5s_GVQ3{U#l!Hp|Agq`ZkBJjvkXluW?X|Qu@^);k1MXUyjXCu93*tPnHMbN#5y^P! z+&Byivc|5%^;mYnI4n)|!`viy?Ac%4zgN-!V9~op0{&TGM~q7I@`~}qi$7ucn?-o^ z0%k)xFABdKRRxL`uK1HM{)2nAlDxX@RJZM*a69E$P99(fUxq&*g3RH=7zL^d5WdaSW@ zd?X6?9>>>5+c6=IQLH8$&n*wY>Th=9>7Vma+{SEx(Yx8CK|-`IVw^bs9u1;HJ>hKB zT1;2-a|J(^tC_a#jFAuk2TwDMHlQ7&p-4!2wvJIc+ z7%(*}M9CHukV&M`fAf=HaQ#y|VCx@%3^zN)A!K;;;mP-N;4>i+iOqfR^>f1zhhBuy z0S#$x=|>^iZtO5z;ZcLjANv(+PPQSE4kk%QuWQyKE!H1CJ!XW;-Xu=Fc>B|>c>I(r z)?6LS%)u5jX_U5aKZ4iRmr^j(kQiXgWU?2gE)7N`M8c`12zTB64R#?EmyPg5d{h8J z`dabqr^gYM5CgBya@_VwK9Z$K;un-^y)lzPO9vzNzY}fpNq*Z87gx-Sm0Q~k z(&i_j{@77G_0ewpSWD+aXI+$Y2zTA~BTOm7aZ!u|CZvU;DZc=3ZmC7)&Fq6 zi`zE$;)x|g5ajKSWDgDA`Z$M%#|I-BoP6}j9vpE^!4ruMxc<#!h-b#-s&m8bi-us^ z+gtF+k432AFvN)U$zDjus z8()=LVabG4_@f4|eYywl9B4*%LOjO%bmGm=cH;xeJ#gXlyicwjRbudpmK< z^dM~eVK+W2w8q7g!pIwITsAEUYk%gPeN}=f=cHm1T@`w=Rl6@j)7MiaYB-0k1si62fQuiG0h zo)?L)zTSq1zdVW95wV!8x5mz$1=v$ok1ad$v2|}POr>S`bbTd8P(HG)Tj4!!7%ok4 zfveFCOJ;|{x~37kj-19lE5F0cue$Kv6+@Uv+GBpIJHA-8A2sd1I4|1)Z$0%5u7AH4 zE3eLku2bL-)2iyz+e^Vv>izzL|JO z$v#CU#KnZcy}Of%@_>w%ie%=sVJQ&^v+hA;SRf|&Yw+Yp`(g44M`nl%np)Zs9v6uR zXN6$(rzbJ|ya|Zgw*@!dwgF8Z5jZbMk8_uffbHS^Sn5GTprDs;--j540HX{m7w7qi}DD3(r7h5a4aKnrke6xBNzB{GG^^?8v z%eOo5afK5upAd#6Oh9_~9L0TaAHuKoa>rqSt74ZT8{r=I_;B?ee4X2gYo`u@b)PSj zIafUY_&2!w`)1rcI}(oiP+T>EvhnRstXyA!R*f~b?99QP53j+(-8y`}C>Zv(PDl%M zq%H1(lcyJkFsZ$7VGOo>x*aP&%0Vve(JiCA@b2fo;IY?^BQ`Su6TF3?B!qfWURHr; z-`I%Do;`$_vxmXOhIUh(KQdlSdp~eKdTem+$XHl6Rp8~1w&U}9XFN7161Ce(kk`|S z)$32AS>DuXYlH5pDtvjMo{ql|CHXA~@Nz_DK^Z>WUPC__3Y#WR1`IxUgX6vFt7=@g zAes1$Q`0+4)VY0B0 z0r!q=hwY;spH1W?_Eoaa?!PPuQmo#sjifk!;QLKY%|Nu+T8jfq6y- zVQ<@oGKy~wX}3vKm=o#=7)#x!QZw_Z92l|NsJ zd!xH?n34K*k$!mW$;(jv*#eAn?Ls5RQd8B-OsE!BB~93yUxtH4&DdW@r))66ZB`~0 z42{FSRo7tqb#dsVlj}2gW8>ih94T$W=8`VVVwO?UYJ$;dMu{xSlG{*nD^h@xBN<1B z7&sdEVov@Sxm7q&)d^o+4~ASm3ho;Z;ip^!@+)aXX>8>Vnm{M}QTC9a(6zR9qA4H{ z7X@|Vp>HbD+1$(sx>9)~Y#;H<-XtQ(rA4Lq@^}>vRvO`>??osx3fr7~>^$9u;@lz> zQ3#bNT|iKi=6N?RLhG03;eu>GIBWXQ-qDG52Tr27v>AI_9B__*Ed{Iv5)iAT2hY^`p%eW2BcXjSpV9^$a{M#;xz5(AU}>BJb^gDQymCs*+ z%2&>TlRPep@WBvm4_0ldL49*I4mDaMGsznpHWZ_{sTp~d9mpCLi=rI`$ZauU*MSn$ z_ANAQ8_{FOB!Gcd^}(a4DC$5BlY_lY-SBgCgs-n7 zzW?ejR6H^a?jEd1+D;W!V9Uu0v>d2LWUL4FAIXIe^(Sy~8piD1g|8YYzj8-{f3+N! ziM;M<>xK&*+}9iT!d%vYCK|esNfCHF#SeErcp+-GoD28HW*B6xn7lQ)y9rl3djzXD z-;O!nZ7>f@z?g&zGVoS#ryPWa4`22b{wgKEwlFS6g$?*4Ty8<}O4B+MuP!3QycM9~+}zkCA{P@sDK0%U1sHuVN+8pkQ|A{ z(P3Ei=2a+qX$s@6lPd9Et2 zRHo56XVT+%zbOo#T#`W9)gnL)ipCa^etH_`J_g^`hzj!rs*LcSI|Tat1~hbAA%eHu@HRnb6WIltjPwqxxn>E~Iy$N|Cc;)fF7&%7=YqU3X;rvUc;f{uV&XF+-!`vb-|Oky)X*vZc0Ui(SVm<_!9o{9OLpY@y;OzETa4Z z9HXPXR^mx$N=vY1(@unsTnUeHui&1I_2h${vc^Gz4{OrZKVSXwevI&wG97FG;EmFMyzLmf7F=gw(3`s7>iU$6>I@)pqMR`lt07~)Afnkf%X4077d zh!4?|U)|79K3W@^5Fg{g>us?1aD_MJysSmmirK=E{E|I;WL=7UOA;bu6ocp!5ezGH zGvMQiOwT^-E_cQL`zPVbiFYI5mhGg8eX^?Pj_j{P1j?8?^JtxCVO@zqWKDx4aZd6mkp0@QtsNcP4nqePo&P+1;-5n5y=!r-&53+xLoa8Tx2}W3 zvh}$1qB)rF&<>-&2fXY!X}vbc_P53Eie6=JBiZ9jw)~K_F|wY55h+&F`A%Mzji`Mm z@m5_ct{fhPty_-4Aw3PRO!dKt(GMc*@mvJEa?Ut@S?6ZwsDq}W0=xDdMC62(a3Ap^ zZu+5&+AVh;sHoZ@`2M^Iqz=0WaZevn-pZ?Czw&%v;fL~8*&bzs#rSY%^1m6{fMCQh z&@(H}nI9`V+_G>aPJgooK3Q*KM;q;($eFAy5*)M<);zc8FhAH|jyo4kKu|{oc30DD zl5Yb2Hc$2{>)+=}Ml80$Stl|^-m*;gev@?{UwpS4lP(#D5SQ+Pg{&ne+sFvY)}w$M&JCL#w=z z)qye~JQTSQd64xv!V{SnnIAg`d)U_$AalfXXdONm@6QT_mzyJeBoMT8CtvAtL8QZg zz(7wrNwPBF8)G1&n$*moiPCA`?uo zC9jnqpES0jF25L)mb|RkuTn;|_yl@^~xMl>RoULG>^AV#Uk5aTWBC@Nl zI6b-RVv@ja{~o+v?}wkCnumv{g|nur>?Fpv4?FiCLq}Kwo_S_EQoQXUdxprKB%Km$ z5s!)Z`lz%;M=PM?n09Z>MV}o7RAiuwj>|U*#~I~Mbu==gD8#3)9LAVi=Hcl}QsF{= zNdZp^YNwl;^ifHXkHZK#cpNi zW*LW!N%qvRZfn85R!6*YO*$%16{5s59B;g}0O@}A%H0F4>~&+ATg7-&v1E5?@xvO8 z;NaXHMshk>G*0T9hH*-uW!o3?8|20v$rn57uTj!kz_||@{VYT0)`F~Y$6lz z-m7yl+p8Drf6c*TZ*521Mf36D8%yx%-Q$t&BXTQ!vkzwSC%g4nb>{?>?%shNw&D2h z-HWm6rTG{eZl~-fY_iZPvMTd0%idg#hAHtBJRH>3k>;~vQ^>5U(0dcWmECx%2~K9z>L>_IE19}*;w`HY&<&J z6JP(h6Xm`U_~OCYcxOoze%X2yC2f6>{lfZW{FGDK4@h{?Ck|EuB-*ors%|{?@B(bP zI|GG#PUCoE6<*n2kLOn`#Qlro&>{==I0m`n*dx&g1F{Y#HxAaVc;iqrBJG;->Tzb{ zvRF}o4!EYM8rI=axOGu9%+zh8%rOI!cC!XvntI&z@?kvo&UN_c_4Dx6WwaUclTnF& z%{p9n{ak!@NjMJWmSX$P{kVEl6IMO603Y8!4jyGic&p4vr$AdPL82U-%0u~(RNTER z0qtdFaB$aS_udlJwf7;$suk}arOp^D@KbRgK7D2(?wAmOG8$_w$I(e1SnG5sKDr-2 zw0Pi$cP_;zuPni$1c&}0R73oI#rV8bgD;<7gh$5)piLGWbEqA3KFT&9q+9lv*|Z@C z&7pBvwQ@f09pQzdCMFJYUFNUPjO{0ikv3rjRy;igIyxT{<)y1zc1PxQ>YrlIXa-Jg zIthJ}C-!YP2{Y}bVi)-7WiTi*DT~@ol+|v|qx4HMl=gDBrJMap!u93q9eDjjAKtiW zBv!xrJ%-+Y1wMUaDc0RP4t|c!xbu}`Sbit<Ryj?zpumYPp`sfvZvbY2+m_KZ2$s*hnqlM~jydM@rva6vWo>rhS!dIDnb{R?w3wz~tz+HJ7p z{E7JTfh^P?$i>^+PvV0-BVK*%TzpP@_Qd>X>K5rG&w9*8tUpnSWy>ewzT2~4;@ru; zRm`KNEXW-k%Ct;ki z3U}tz_UkKyr;>uB$fYfO_W9X3CrnQn>tFb-{AkR+7azRx6HE)|Z|wJR&_{hV##6%d45FHOVy&wYn&8Yj5)bfCV6 z1LS15F?&mLwMGLo@DnuFJ$kK)W zL-s$B73ygL&Tyc?K3La=PAgk@(jnE7OOA}pUAj%EH1;9D-GPSD7I$4d3NO9328UXS zKq6mGiU*_k+KwLh>#b2u{PIf(KRX6Gt+HPb@dvrWh5^8V>UOv|JHXW0L7FrO33P_9 zbvI5_l6G6!lDr$S;hu0~^j_FvftNtq80oBBTpSVSu0tnrA8IhdMQ6{L zvK!45baxtm6PLECcp)rHX4-F8&GDlLXe{s$~Z2WPfwd(RC2x@ z9rcKH)!-nrjSw#vcylfb8ao-RF<9YThuHL>M4o%f7+EHF>~v-`>SztZIA=w~A$OM| zeO(Zw*WgG=BO1Ci%Dzq!l*i^q1GDfRcr%-5q72F=YrggxG}CcLc{{;@p8jyTtOM$y z!*auLPqtw|Bm2d4$)g6j>%lRKY^C$s*5YQ0pe<7ToSEiugIXFK9}gD{pZu9a4Q9VeT+0a?eRZ0C`r$EL*Z* zAJQp%2FaaBkM2&?1x2B3u@{Cslf&T73i~VC89=gsTL+8_(BXKk5e`;8D5k;lrXEO; z*x6@|NCx)#IhBY$e?C4KQj5%|asV%STLt=cAdq};rcRZ1G3)H2{pe=@q(%03X`wy^ z2YMltvQ$&oj8jH7BfllW^P-H#yV#(x)__v^xhu&@4D*C5UHg%016p{lW!C6LxvAw? zdTE%0{oLUy`&-qw!<)L^(rSc>2typSC}kZ6Q29lKFJOR00d)Mwd8tycm8 z%1M%+Gv~bz2bj^fNs=Z(c9#kEj;_e^w8GK)PFPc4syXMr%;v?G^)N{aqhT*(-sS}B9F*GwN}CoISvVOkTm)px@~_FuCE>xvwc?a8#yHO;N4ZtOyQ zgeTltr?8=2+4m>V$%c9_d)8PZSa{51$>QBbXXJ5=tt~t_am|$D6mLfu8=G)MAB2x) z`r)Aub|as(Nk4L@&yB3`lecWQwVXEO z4Xw%}Ud1NS=4)x+lfCt{jqTJC>Md=F8*QS2cDI+l#hvp|t0ZfzFLs)Ng6Ll~^{=s^ z8M%U=^BLr9gX-o^n3cPJ1cje{NT5E;{!P7{#}@i16Tkf#G}LlFyJ>S1g52On9-pKg zsN;G6T#z}OTe;TN(u&iZi-D$A_77Z<8 zbV-YVFk0$MQ#FH@f`K^B;FrEF^oZkUf?@!pwphq&xGwr0FAXD*4nbIdeMjE!z0PJ~uHa`3CM?Cyv>2DVmOQtEt zL#5r~Y?X6q-($$2?T%;DJh?DxYWg$72OpPsT6Rm9epsA|rC%Z$K3gItPwTXb@ad zPwJ~>(ud#~I4*SzYJK@n$W_}Z*Dc3V=L{|>8-Pp7)OrF6z0#KD{8Anh$R(*GZB;td zcIwzwKB@A{KjoSnP!8>4;!t;iFPyLViC%+FL#6BQ`scTDE_is24(;+wrs0iL1}1m@ zj0z?KO3@lgh1XLbLnOa9c?9Ul~vRtKGJ(g>N zLutcf<*p*H^HjOUzcce7Wg>r4roup*cc#AJA`+1!d6cWl{=hz^o_q^Px%450(zle$ zIFx$)w6t_nKc$^qQ$gjqQkUm)%pwJsoDb|njuk%eTj~fNb(|^{0PW(!6(;cobvrYfWPL|{2~CdSBKmSl0kbgL>=fz|6hSRVP_kW z|5qS_Eqnbia8Vqc?3JVjEB`FWuYu}X!L$!>vHxS^5@D%t2Gc$UD-7V&nWqC%=1vx) z{wMHh5dQN)-lHSIwq&?skp5W^ofKOk8LB7c@Q=#>ApAXu&bD^+zrEMPnYLH#-Txs) zRssTk4|JA;@c&ErYxfdTb>y$Z_YR|_rMrTq=9&4f2u#qXLauWT_6rqGW|}@{ar~es{#luaUWBKXw+1)5I#j%JDl69iL z@k>i!1jz%qWTGz*;RN6Pt496B=vv)dXo$0sAj zhwK;Q{&#pRWlB3sTeXgWQf{fI_NSf;47?^F*9YPyoi-G3EBQ5poDXboX`+Axr=;0l zl%cT?v(FueQL@*F$x^Ag6^kxB2N$Kd_Zx{bI0hg&yKlAZZ2HxYT2DPz#~|=~X$_JIbJ5 zWJGv%rhkGQt2C(R3JsQWwXS@tb>*6@!E$oJ&9mcK)`PiAvT%8<7il1$2i8;Ds^^v> zb?)>+kJ|Tdc-~*6fV3ZoOF5SB0rh`#&2lWCfnaFI=sDxDe26WLDCNAz4mV#i0#SCX zr_!PF{lCMdT(`7QugkG|uFipc&Xf%RrM=~vz}dJ4_T6DZa&`(l${xC|Ft@8m&5Agrj#7`GmL5!;o`orajG{#M1;;#Wz{{mp*7yZ28fseJW)GuKxxGv{mu{ zKY~Aaheg8QUToQ&hqZ-G{m&F>SZ(dBVXN$$(xdE~qLHXi46clg23GcyQ1-162Pp&Q zHTm6l|K1C1CuPE5;9i2E8{v zxOD=?y3YONF%~0SNr2R+;L4sW%3c*JJ;ZHeV-0s{rv?F1m;K28A6g|#?||1i)9}-|!Bi|O z<;|;cZse7WL3pL~*T46PvJZ>!!y+WI%3of!a%NntFXML++!B^6f@;~zMsaAeyv3$} z{|}20%X=S`Jw22=V|KXb>It|an#v$XiTLE5FYfYQh)#>amVTJsC5{`1FVBmD{G4F& z_ynZeGvkmoK{7Y?c38h92j9tSs#)KTJW%$Fk+JYk!6Ctsln>lzNa(k+>fhHw8GApC za@}4h`xWtA0szXDgS-M-+DR6~U|IGWQud6Jc7mVn90ZR97c6!jxYq|AhPCu9;}%}X z{PSDhiKCN6VMY^l9v*n;s>zt{OW6@#DGFRElzq4?H1L4! zg?D|*+H|FyNr+2e5N=BMB(J;h(~gtaRNmUZ$dG)KJ%W_IkPJPTIw2X^PISt&mCF03 zEPNJSwo+u2eXxJoPtCs1jG)*^oEzbw)K_TL*x>Tz6L9Bn30_%78JGRXT;v@k${Y)Q z{qkTfUbOXKTy`QRda*ufRNkFK`!7DqS$vm8ClnBz z%KTXN!K0nkknjDzM|jP;GS3{J6e+*rY1QEBWf|xzC_`XuC}u@i0#mt8nRN*b#m#9< z2AkXP@%mgGl%!C`&G}XQ7005{=rDVDIO6pzmtV>X|AY>)Z(T;b`rQ$nlskH&AC!7! zY+_sb9Ps4bb8xPgyb^)eC`a~eE7#A+p$a@!-rFO#Ks~IfRC} z9>p$!_7k3!-Qaz=hdK`27S!< zbY(xFafxAwb?m_ILK7BF&A@e|{SoA^M`nB!rcp@?ODa$okcii2hG6<=_E}qlBXxGT z<$^5C4A*1fqTz5lnTOKgNZd0c8i}?&Sbegle{M{j@J`Fb8#DbeA~_7ceQh{&umdX} znS$}|c33bq5#Aib!Ln9NJtqTKjSfY8LLjne8$R5bhbH-XSVspY%pQkZGkxLMWxx+P zby$4C1Y8;Cg?XdHp=oTwi82F{GU9OO)Ho!?cw<&d1bS*pQDoHNMrOscsQ5!e^eCz8 z#`&{{;(`cUY%ghrQ-BXf2RR}wEezS7TI@Jp3AdPNJTor=S;>CNej+&)c6jmTv6xI= z80y+kBH0HcVttSw?wgu`F~f%-+pY;!j-hyXUM#XA?XYEE6E0nxg*n56abA)WzWJpb zal>PA!=xz89XSMn#wP6Rb;8{X(=dXNcj-XOAZq|OnS zFBwIet?^@S1H6)=Fh<{v_)$q1>)MN74wPf=qH)j{o<>t>EMA!vj)e43IOY}Ow2}N{ z5bGQmjQeKAV_JF$W(3$^?fwdQM+f1~=_wc)>xqdOF^DoYqR2524^521xS_5n$Zx{1 zQOUR>GYA=(q3AkMfKu}F>hnfoKKYpu?T-BY1qhfh4zG=NMRaNuW<;grXA%PW0lX`^O{8(*a8-Mx(8u1U4x{@#v%w1Y33BhunJF zKN?1VZ`?9J4P*Uu*jrqOfbc-1_&H$QlvE6Bug0%s8eBLd8M8U23q}T`B)=MnjmC;8 zk?3h@MQ)vezJdJfXh-y@(RgaIKjw^%LQh#WPB!)8nq{LgKh_ng@k6jI(H=i+E5)dZ zDU|;ZB$GGirTe3}q7F4?J1k4~z#BV@mDhP2nj2AP(%}3V!>}kT7>m+8v2j}&BC`^4 z`{YPW9u|P&{ijjiOK0Wegjv(lsh5s8T2PM@Jv!XKI0KVnyf7od2c>mQsFg*tG)@sw z!MHRt00)nj!6Q5j*JgPlr?wlnQI5`G{pksQD6FhPlVdbiPSIiG-g*qB<6Z93haIJs zJyis(ZO~FyjHuLMXe@8S!#57clMj4}Y~QjfV?&jJb7*iHtsA% zU|b|Fi}%3s;zpQg@Ff6n4hzB)GZK-J6o@bwP^9z2le43d9v6mDeoUHnHsY%5$6;x( z4iiSjBE_K_yNg=TC!Vym7gIS`H)jVUKEe)1PaARB+@UyUSTM!~+M=@E1{YA@j~p+9 zJ}?lMXZym*%>zSqoj6!*K=zn4Tst-l6URiM<76pP#tcJnM>PtHU9kG05jeQ*FkBK- zacKmw<1_;k4IM>L5Egp0;g#J@SU4pfJp~o;9h;5EhB+Z^L_FpNS>eaMwHPra5ye~g z!g_c%9vJJ2@Aq*Wv=cL_uNNgcV%3Hc_#}tp?&(R$O7cZ!hz~jn^RXtMK_7#6_s}3* zKPMRzJT=%z+IsyWu!1&YlzV54Vz+=~DVP1j@%1$@oat7X0X)9-Ehr`=RkC`K) zC|?06&96e0-Vd)`kb*4EvChznQ}POYIy+}~SIkTchP#&@^D?60*VBY@&j>u0=768~ z)*vx`2$m$e;z(hm@(vf@AYa@yCkewMJZX2L5N2bl#bQ|$5CLk!TIyD zuq@RFnZqJ5&X+P>T8|FPPk86f$iU@k-mq(Lz_xZ5oR{i`(5OIMM`!=#jw0xT{cy|F zWQ6h1sZ9vLZN7~^S$O^54{J|-TmhYz7H zEE&(w4a6@;J8{d>G|XfYGbhLvKOCm+i~M(VVfm7=xRQJyK^lhzQNJVoaS`o|v!M}3 zT5NIMf}zUZWnm6|IB~iLU7jI$Vv-(LzpxkEY~1nnXm`B2wH%Cc6xwuQ;aKF*h?h@v z0c&?wqEDhCXII>j z9e@p|4Y+7#|6Xe6WJe&XuLF4wUU*<$Ji@fyv~e|XO^L^oW5SS{7>bFs(_2o~DL43Ms+JR3BZ1LKKF$^R;am6{F*zo;cJo4p9Oqrd9 zM7=#mrv<{gx(e@pcM8XfYVgDEB5coZgQ2k!cRl?hF8H__&z~oIlK@kOhrp1RkDEVl z!jspfqL~aVWt&$vsWBu|oWE ztN}irj_7Kv$9q2&Avz%fVRk-v@Z3;%0_OQ`=;O4QOc?(8y3^>e}!q$DKGl5eepUWp9}P z#N+dq*5ICxPSemu!G&_RU|1Lm_MO1DB^q2iJ_g6P9mU#{^;oroN+<@<+6rwoO*lw{ zvgVf)I96&xh_@3ei^}o9r=_^|iVWp>^2XiA@yL@u;N6pUxN}l4s`i$mv85g_|9A?G z^2kgw9A@t2rG>cd@$Yf|nr1w^B$o2qg$b!)=&G&6bMNnfU8)#cXM}_VU`C(~p8tF= zcDLwo&lGw?CJ23!Q8Bw29_>fo^&mPr0Wq2i-1fka_|_DHm#6t)Y)UAO{k#tkuRe_y z1`Sfb+t7@)2kOvSRD#u;8*s_&R0K7aVC5$Vk<;mbD>5QrCz%+t?S^)1WJYaqcJ703-5oi2cP8_7%V0r$iW$78KlS^3>Q}yWCgjwPR1$*veyOo z%uhyp@oBuY`WQA>8eudvV8uIIu=344a7;`>nzJp&Wk$oTp#raOEJH?mG=h{{9vl<- zpURANm{SK{_#z*pMlgdeKaIQZ`vDccu~-!4il`7T_-WeV9hHE1TO%Aid@w55j#;@M z7H8`49`*2s&l+(5#pww0cEMBz97u~-HgSv6yJJ*x0D@@vm0v|#Kr!FseMU?mLbQGG z4G+Z(zivGI;Za0VCS&D&DMmA5Qp0h_SYLej`3a1k%3!E67kAvT4!I%exRn9yJO&kp zf;>F)=@D4FIQ8Gjkz~=@8jWR4+Hz~~?cO|`+6z2*Z9LY$z6Q6xavIARUg7N74yHNxuj2YsEi8C|cbMO%EdH)FZH<&mSr6Yb@ z!QaIWJ9eMIyIU(Tb4m)rdh9S|T%dB7CN?IV380BSn!J_($Jqr7nPlzUbsTSRu3)g3 zhAi^(#ECrI{KPtZyw8BiDQp`v6xaGS;M%8mVnbd%_8hE2M|l-K`?VOp{(hJe>PUP# zCO3g7*-!o2(}%m~4na_01ZD=C@xkZ2urc3+McH9+ka-p`cVk~pDYhJ~z~|d4;q9h_ z4zz_|9)nY69I`d`IEP78Y0e?sd*?c6hmXLOkrJ$spA6PLe06AVY(|^B=ud0J6R&T; zjjtR+T5<&Z^)@gVJK-A@fQM#A;0w`h81ccUzv8;*_8~GO0dYFczjC*#2a_phnz9nS zwyqjWCdHuQ_;Gy1BzeY&FeX(oIN!Y$H$1ZgKjgP6FKP=Lor?BDCt;A_sh|-~OnBA1 zfoDK;!pN-%*Bq?sfFg(lT?Qz6sbf=q)eByT8<7baot*%u4JjX~ybx$IxKqgGXq4zh0Mv=hoyxGb9!l#JQ3d z$@~RO_~hpUc;L}Bc*hWo$0sxDleIPf58!Xw_D@5f^5#l;3#&$JL*su6rs8%SZ)wBE z&E;q}w4kus1ih0Dtg3woIGIiRwl z7N1h^I?0G83Sn!T5iKoNi1gOslaFpi>52@v`}7;gyrK$hJyn4wI#aI*Ke*T#DOhGy zHFuIePPTGO-4eC}!1K8SYWa@?P#Lsh*2b)CKFki}&*s9h}vtU6SJ{OS(0(`ZLe zWfm3_fi>@3ffLV6K)hoo%rqQFPZi?(Q?*nR0u@Xj;En`Od#u}BhRVh|94qKVZIQ#nJLGZ&(M-F$TA)u3H@H#+&)(}PMnuTIO)p5^h!S6dIEwyYhUT5H7nTPe3uHJwd( z^@mcdeB}}>3vEYU1C_-}41#QF;E3DqUW}Ue=Oa792`&ygl=|@V}fl)ES5wBYtG0epTBkjVm(lV?)QI0JI?MPLe zZ@aROPpLs*}%hWH}5+I1e5k3ND`!87TSgT6}a~7;I$C zQ)?H@G!nJ);wME0$pgw@bdWQ?|MCu$+?xttd1Tq!hy3DdY&lqg_O^Pw|5FWuBJ?n~ zn(+SC(+slP@ZEt5#c9~m?kHxNM$1Tp*woyP^hLvQ*P<~f`Qb{uJ>HdBYZJCJgL>|s z3CQp;qtd{>C9v)3hM9BI+tChqQXZN4efUEG8jKzIW^WaOd~Dz?bkhkoSC-&tn-yZb zeQj zWX>9f=dYNGigj1x)@Uo7F3HEihCU?t`QpL}zF5047oEKft{I5BPtL@3SqWJ4@%3n2 znT!I?`}TuHXmm}$tJmpp(bY#0cR?2BIveoPUh-BPmSy-Nw- zwxZHxjf`Lo%=S*W^OEuS;*GV~TGWB%3zBf>h3BAj7-;a)Bf#DU+YVHrwXO~? z?J9>o178J{+x%wENe^X`nOk}yt`G6Yi!WS(ns+9`vDJVsX4c0G%dq)mjS?^y7Sv;X zUL%fIHR0ENB{0>t;&4qnTRBXWElclV$ zfxhJszNqoX{A^#O`dH!TedUxL5i|nFy!BwAa(5~xuN-@eI^p4H5BD%1u;A0 z8!7v{b|W`D1M6>&Lp^1=yG8Esao!DG9F}FTHjeSw>2my&)9yi<@$9FMl zsxx8#!4vqY)CfCEa3!kN+|h~l4ioaJgLde_)|@<46g6Udl?IDOIwNCj8s5BpE-E)% zj2XIi)JRY)!0v)voSB!kia^1ty$zQ>b`@IQn~lloZm=P3-8wyPy=*eJe)==k?5~B+ z*%`Oqz5vx9F2wjqXE+GW@(6{p-`+^wI$DXsDg$;OE5rV>W*jW5he>OPh6Bg3J7O44 z-5rT)`hp%N0Z&eL$GzX?_rDLTsueptT#+dFEJHg3eZ6R7@F1^5X>0Ak#$CBEWG} z-vPtcIx3gE_(?~@Cu>dQ&V~)oW$A&uzCAiVNXbZp(){7h^On<9a0&N>i#07vuRWF6 z9w(~0l>KO&lyxLlu(xL>Z>EzpxM0hDQ}DpNhY)zpR>+nLBGAg37`Y8crIR%reHtz7 z9jwtsp;aQ%Ucv2y(nqFa`M5jba@9r@m}Ji&Hc{HL9|k2_4xoz$-N(lb&Q=TwoV+nK zz@Em2#0wCWyctt@j>|wJ_f#WB$d0Jh6!1__B=;I|h;|{=j~TL~7;Yyligtprxr0uy z1&==V5dxA{BIKgg_~KYQ9GKzT3w?BkvhRXk1dAEHydAZtt_iL6Wr!O8IDAJwi_}N= zql+{>j2p|@%2gOj@rb>(mS*VLA_;K?UfBP8_+c+GtUA6EP0 zgNxJf;)8D^aPb;6F;kMgLv)P7wRD2UMg#Wc7Gl)=7vP!r6sA7E9l7nybmWl`LH4+j zU8rSIt?Waj=iCU*vLBN?B9?tJ>^vM%ylpGICVhf)Z(fe4Qb?QZy2yS zGx0rat?q)3L58cFBO+vPn>Jv)WEFJo$`}MUhiYhP#s^<+MsVf|_)L8lFMVHx%1#qr zeCBibCq9P2lgIm`xrCXz zofSreyD{+TL{ubs!XS=*Pnj#3eBrl^4Ku#tI=ub*T7;xO4(}PS;hCer(T$tna_Me- z@Ze%hb*B!fuS+LgHnPsFvQc@X>G)VDFlt6%fD<}8`WPgzp5UiZTStSnZ1O~8S{2h^ z)p2UHn2_Ksuk3}tzcV_Fbi_;+{A7n-8oCfq7dVSS^YlQR8^^EejNC@Zep z>h3~oZ3_}&I5tB&w64zZ)zN@50SKZT$Qm>ky$b?$Hngv#hqlGo*oIz5I}G(EUU6zV zPkegaI2?NUJvfZ{2-}*hmGu?2oO9XZN#9(K92Cq zR^js_X6z_#!t5!NFi~58?@k)wKw5>rsIJ7Wy$296ZYA8aUc@awl_Q7F&ow>@iyK<- zep4wDeIlT5CQro~2%iZezv@0PGFNgac2dz7%B8Yj4~>5xlbto&PT_*(8St>_Ms86H zR;>5}!O2g+d(oTt?6f^XeeEe999KIt<9H8>rG>Ww?8lb0Dn$&^8_ZQ0HscBS40{e~ zkL_eW=cuf&u(voZ37W)K%K9?dBSz+1_D-{*9yqp^B4*5+=uQ}qS7(P&ZY0|4SA!w6 zZ~7j}rJnN}sz+C24?f;khT9iSLb$0yc}uM5T7UgMLk6)^!?R9Hvg^lkA7 zNxK`75A8#(*$&Pj)|fisalCH`!*`b?krs-*tT}7%Qurr(BFR6|Cxw1l`$M@hnKeim zLfJL6!OGhYah|mG118&=W0bW~olII~eM!Gfpw1FU7j10~1Gr0X`Vjspk0biVHTb5C ze6ZsLvFjQpo8F$3%?>L(|J3>LeD@u=jQbGl@;lf)<%&G{VQVhVSuh+Cwq`6}J`>J6 zeunS(cd@RDazm%$@9PFzs>T1u-d6y|bscMe%M4;>X4$eWGczS|5(n&X8s>(fNs}gN zsNtr;h8Z1>?U~FO@PBiq_1pN*`(M+hef{6lSl4^uoH=vm%*>g&a7ON~ zS%hx3E$^6^XyZlyWK~|9wiDN$_9*T+o`khGjzrj~T*TMx2K}%B8H)15?CJ*W^9IY@ z{zIntD-$l|M{@s|WQ{YnW8}47&V7B9*;m%r;ki2}K__1|4Gbee>J5yM$hL(vNnj`` zJNjsg%nTg0boNT=s6?jt!M}&Lqg#W-1Sc9QUBt~csrO4ypN4aKis4B7J#O68fpF#J zqW>Nk=*=$yc0#;i$z!3Wpeo6)$V?BtQMb70#Mn)b)6HwW9PHruSUhmw>G*7p15bQ$ z3@ycb@OFs_uiUW^FW)x<4O_P2^RjNrem|9s^*MR%DQ?E(=_9aYiVhF0ufn}7d(Ziq z135rwnPeGwg_$hd$_Yi=)`l(32E2I9c=+o{52Gch>u~?}8a#Uc>3H>`Y#3eiL^*ga z3b6c&#&<%8hJ8EmX`Melcz6-+KRX=-61jNU!gB2`?PxXm;i-#;Vb6!(9a)JiV&-{@X%1c zwE7t4oIV-v{eC`f%C$0z^e8!eB-(rD;|+*fGzag#uoRmgodu7(3Ev#7!IkIF#O*hX zf~&PlNv5@?upL+ZW;$l+s_@dbRy^^i^YGUf&ck!3$0)bymG&s$4M!^xoR@_&XGL?; zau3`+Ak9ifYAU1Ti)!sL(Bd~_svi#lWirLXhV_uJ8yl8yJ+hu0rI4X3B~s?yhd-BP)>!$?YOfbc8%NmC;gr6z6?fg|+Woh1bc?`_4#aIZo2@ zk~bAyMQ=s&70H)w4LwFYdVU^dXAl7$-pz%rIP;tdSe$90f7(4DZ|ss}?Jg;=!sZqu zK7RIWEY0;FNC)52gtsd6`1tnmh>@h3y)3M)!IS%%@zfs{;i1!$2cjKb>Sx4t_M&_| z|IpbO*R&TeY;B|g=|_5cJpORseB736##>v86a&>MFJ!T8k$JP#gcV<|g=*X+eDvZ{ ztbA+^0_}QSeAxngba^^9t=)(HT|y@}9Vg0z1!&6~jmzga@xXh#kTGu(Ub%Y~Zluh- zv+)?3C1ewV41L(R_BfIkMB;~+HnFY;4}Q24X>%vC{A}Dj+=}tx zVP1#{)eUXPn>!gdkMkF$CoTcrVpR3+=lX?M7(|Xe7w9Qje+(d>?$NpVqh^Di+;+3`N zH`ytF9`tb5so%F9-*pD#^H(myUpc<#lD0AS>H~5?W(E7 z>+33T=6Tcc<{i@!XY4_f*jS=bptlEw*YajJXhKRPhhml5eXAjb*Ou-kAjEAne3M-D(vJK%Shm!PbEl%8b z?F@W)=}46A-bZ=&pm2Qw^y&WCz3MQ!CCT0(O>$?^?DWSy*RcF$qfoQ|5Oy6a#>+dq z@bVL9;t%uX-L6)&hUH-Q%X2Z?)PXPdRny@r!;zpQ+_^LZdWC=e%F}$|pOR~d_PvMm z%G%|7(HxzM_a8U~_fHB_(w0bKK?T^i`kGc~qN4Er`57o_>QvruRpueegr~I?A8#ne z8J8`@o3w9|Tg)iYwAc+!`o)FK(1ipb(&om?-yB5xtZ{hg{;7zR%-Rx|(^h`>?Kb>z zp9e4Bc`AC3ZbM-1NZiLV(e!)TwI*DA`WQ@$Goi&r8D_&O;+Nb=!gqO@y^VpiB{36k zKDQ9_9B#a}x&jwX4#LZy6#~KZbUOMGKP(7qx0K5pl)GP8s zk!y~lWaICrzNmY;@cP?p@Kl2zR@^on$$C01if&5|E@}wrkep;9tt!zK?rZ3rEI-hS z`)-(p^x9*1sIV7*zLENN+YDs6%kbKkI>r7=;JS$cZLK{5AG~rlrUt1|CzH(}`~TJO z%NC9k*PDNV^zgdfoTxbACz$$itl0y*!vvGN3pJcI{K#~7Z9QTyz6dWjeut&IbO`8e z$9BnTrFf7U42yCgP}7f91vQGH2)62!MP{N3XE+H~v0?01<3XWE-aDWHiwSiik=F{#8c{=^ z*-9s(K@3~B2Tn$@IYB1$GkREC*#VuI{R_3Cna)=;X{aUdB$tQ07*0`Drykruf2=%K?|Lc z7>W>0FN(;|<88f&2{53%sf&uPLoA&m$pK}vS}=^`w6&_8vcrB4(w$5Gv`OwB(%H+w zYxii7;IG56+71K;I+5$A!7kx1?v=9GuRI!1KIzE zRvZ%i5^>99)cD@z73s6-bn?UEFX6IWdy_svr*zN_kEyW}5?fjBrahhVrPi zQ*TC~svG6vISQ^p8xh4ZsHOo|f;~=}2D6zH>_D!fEtPCf%F=P06l+ISLpvI&pAF>u zz~oB#p?)Mp_#xV)LIGu}qFaZNkq&6OJFvT+ZE@mv+DvF`??8u2hX}KlINWfFbtfKw z@=NV;qh7pN%2SZPUC9m8*3yQZjkH5_YGVS;sH<&7r`$QDJX(pfnlhuJYz&WZz>hk$ zrL3MZrB*WA$}{~YP5>cR108mceDpKW54NY_SVe1lQQY23S>#wzMpf*yjr3MiZo(*^ z?d>i_M*8WrH}~i;D&C1b$Eu+B3q)S90e#e?wUWn)jzcnaPV%^{sdB?Xyfxz0i%!xx z(D3^3FdHhG+fdoyMtVXp!Z@)MRyQf~6>ig_P99N`yeOLym9lP@R?mQ;A0?dZt>lf4 zve~ZEV?v}A^&J1b4J;#fm^hP5#@zr$^1=QVIMI!*<*jhDEm%`g_0lk;T=WTAZG*Xr zsBAcD zj7kbd7wvPCs|S^|yEZ%Zj5e>qO*BxhL+ZCA16V4{3W4kkNgUfbP;deRfkIj5nKw%01TdOA6mXpkT8kAjMN#a7EB z5Xp&E!hVEMADgLjV(ciXXh3C$8Y2_@lpJOS_e64yD~@oYvGr#bSnl)xpgbV%07Pw6-kLSM2NYI=2ncn>Nj|{ zW*J6*LV!1c4THP8&EW2CmoN9bZ{EK***{KlvL`tw>+H;4 zYwhQ;Q5`|nuRp)->OA#4#3F&zF}hx8j*NCW2$Ua{NJ8b}uR(ec?KkU30<9c3-AcC> zn31sH?mzmWdSg&KSU2lN8WhjaQgGWm$#d(Q*)}$@U#N$CprF5by)iDr-*G?( z;fWs6Nv@y8HPcRWf z_jx>7VP9|;v6kw`DI4fSA&asR$Z_=)zE2}8B(_0E#|{bP`FlN+KT9Ot^y_LCm^yBb zDu=PYG48goMbjU^O->HSH*Y%Y-<8ChkhFe%FSh%_a!Swb_$(l7khv>ZL&#zw?AEXD zdpm&t@HcvY=gvL?SyNvSA!_&8X;w3~p1+mhG-vBtd>z})Yc{Ych~ zGC(Kg%`p$2kBW|Pb5jI$QtVlP%s`uGs;g%*^?g{tzL&U_{Mq1_OVFjTa-?;bbY`*7-vYFQ;wP0SysYpZv0fng4CB{ru?1|Ms{8vZSiT0L-sUf`hJGvj zb(5S1x~HcVy)gC$xkC(4=MM}w*VH-hYlq3Tr){=+zKgn^Hexx9UUh1L$wmXU>T7%} z@k|CQvG87A^GxquPk(Ph9(Gv&o*P zo-p{{c?lqk-S|VEC~^H5FWp<+YBIj0Q4|8NhR7lJ!TwN@e2iYSJAP3Cn!i>x>)Zaw z>Rr7<3+g{CcL2I^q@u!c4jm#W{9k>5Q(7p%0J!%YPRKueN$00-BL9!(rsivH^MyX{ z4{-HZiWwvvW=W-Na*Bs$wf^H}kQd6772qKUoKB*1Z-3rMX$aMdp3S zn!zlQ(=IMH2VD>BE@64fb8FjaP9#7CMV`xc1leum(NN+V0|ofM<3)ZeebX2-!dwfb z9_FCda(-$ULVxuqNnvZflbz^ah=A==sve<5T=qTvc@6`1r|nh8cM_~KCIJy)k?+nT zLwqL?M~s9@^o%SvMCpv>dmk`(3xrl81`NM0cL5}wa^s!`n;>N~Ye`SrwnY-7?tnu+)(#(QD~2-zLh!jftU)_|{0 zrq~?oYe4|{xfa_E_7@8s{wJap$Knp$3-sP+d<$@q15%q_nEY>36fIWdH-tOS&yubZps?P zhtxG)G4_)%DZhgOo>EK_-v|}EX$$UbIGu!{UgV}&H!d8Jn4T~N9?fwx*u$ezVyyR2 zi=bdYJK3bx>lL$-)gHm@@WI09VGadl){UH>1CLKZSt=k7t#m>;w6zm^ww}sJQfwy4 zl%1F0VO9ts@t+ZY@5(=Z2OTWI1k!#k0BPX-W_WIsKdcgA6mhWbMUT+x#l{&gb58o_ zxnn0_`Q^yWFqbSXr1yn9e;EB*Rw&=vBbiWgV&p%u+70dB3M!oLnVpG6UHzuAI3Mot z?v40*7=)-=adEn0XK6ic@{nSdV#gnz^N&=ky8;K5k;@i$u(oJ2bg2)VeIpOHRxuv) zD*FC>>h9ZGKvb&7Puxvh(F^rpI(=g+>~pSN_H;&K)~YjQKbPNFizr4?CL2@9M8R~y zqqzlf5ORDcbgJe12ac2M%y3fT#dAy9Y8CPO#l6%?-CO~R!_`GEe6*zExc?$zyr@S zqc@#00T1!JBWuA46#HrBOEZ?z`PxN0Xe#t++01B0r^G(&@4bXW2W+5qrX$B^LXeXu zh@z)5OoeKca<+TsuMy`jjU0HHGmkc(Emr~z^X+*h)V)%K=?W)fWo^Da1w`19)lXu` z(5O0|+;*N0rb5-3*`bgtKhNVxm;eKe=$ZvQ5E*eKH`n1W50n3Vl%WGNEz1 z!xeYqxr-!BP%PFd9g<}#nC(1b=Ib|U2}@SqxB5JKad{@F=Qc{{d0Fmq2~HI_aPeUB zGJNvG$LAslf`lynMGGxzfZ9bk!XPvmcy1@g-Iuze8G5Ek;*%UsQZyV~pGEL66%k$1 zitEQ$7-VWzkSvr=1D_AHJ5&P;PQaeq@!Aht9j+uxt{AdyC}m8nLGmSE{It2;=Wb0> zns93XD&Xt}I>?>vanGW(Bs=W?jtk{5!(92utvPF><_wH;2Ps)ak*0Z1qt8v0`HOKg ztaulmMzuN|w7u}kKM{D-{uLT(+^X3mo=riF+~~NKuvO$>az(Xa)L|4ti_SLOVfq zZV#Xd7iexZEc4D^3idbH+E&t(?J)9AvST6y7gzsc_O9UDf?b^e2ir#Up9LjbHis|G z8cd)0G3`0?>-)n*JE4A4t6g=#KIs}ec@#)tZK8I13jNnJcC)4bvc39UW1EyL?uTbK~lY$xTU*PSi^44z7cL_x`7qg|>rOn1A`7)Ov#sRm=akU>YI5{bq0Ee*dqp zX%)0}8c9JA{GSnENZ_pXU-7p|7EY4(pSu(f%@Gt4=KuABr^Z9Zg#R_&=l^p$7~rAx zRuN{f`!t#Q*m}L;(zWk5`Iw8(|M>6@_f8n!4d-8-%hr`#;|1QadH>;Mc){}g&iLNE z^`yJC*vs`luTu=Y>q)rS;p3{C;4Qx7@j1`}-)OFZ_nx>dkbN+qMYMBWyi<4B6GeHy zrz>z4X$f`B*yU7sbId!5nPUn~>z{ZtLYWPWx7n}{Dn`%Mib4J#{c_Gv%z(b8v5t-Y zC$~P*VN)pWqwXfS+T|46@sXs*@v1%`uYPfJ(a$Nl3$d7}8$yJUoBBAxCa{qYEd*EC zj+t#3cXz3u_vou8n~r}*`!*SNI~SF7dRkX@nW2=Y7Km4lsIc*x;?SIGX@OO?6M zNYYy$%}ebe{81hXX{86JKXEhJ43+DLOsFG`S7I2HtcLf3d5Ss3?o-FsWWHnDH-B<+YYV30mgSd1d%{gYfKg7L}ZWmEdqvVyjYY8Q6^-F1mh z))1PBb1K6~$DYknC@ zP12nPvFGE{>Wi+_rtv)Ylg%&$gVrC{%|X7k-#t*@*;cfa%C8(G-n)qe`Tg}tG{xeN z-}%aQ`HlWHdRWXbUnj+GZo+V~jixx1+P-7Ay^W3~BHGs=@#zcV?*DO2LP;2WyH6({ zo$tHu*jPj@5`=aT^=GtLX*ZtCi+uaX2kd;4>1d)SdU9v9tw2ux6E{%j;2{0}MC`aK z2Pyv}xrHCv{O&9usHvCmR>Rgy6LsP!$IPg)7Ts1;-Fs=SSrl-4`=E$NxN;CIApE&M zFBesjFb8M&eYU8VDxeE`a%Z}%(Mi?Tez1`S*>TpAuDbhJ!nLLaZBVowt9p0Q^l`k% z=!blcXa*{L$J>n;Ki}`$KJa&&%dC=QCkw1qFf|z&W{{%c#(@7?;Cc1%r|2wplNI_D zUk_yKt`_LsO}&H#K73ON17?kNG2KG|kq)M)FaNjhR!n^{g9QA^=#pRr<9Q*?g4YP* zEgdJ^+zed!sx0^?v;6HeF>~1HApp=&=7q(9dB7@JcIzM0lE2!ZI2kn&ub&h%ny)jI zvk(J?^91M%M#K<)AJnzTxk%cTbF`;A6ve~cYsKa1a(VRB-~RGnB#KFr!@7g*Y#n$4 zzmDm)Q*E4;5|e>`hTcof`3K*9ALm*#4wOqSYTv&Rrinl?pO;K?c^X^{3s}v{H?uv= zP%SF`(Y#BId!}pl;LO?Z=WaB5fs3g-ZL%%vW4O07bo9E%-MS12m!0q$Z5M{=NaZxp z>Dabt+Wx2ev$q-&O0$SVP+7V~D!d=F=rb{T{)g90fjHzR-uI1_$U$T=F#5gU;qBcQ zFh}zQ>ynA-#ls^A6CQHWd1j~lv120f2U0yF8Jx)rlrSfBo_g2#JkkyZgXBXZd^v_^;5?dbUt7*5W-r0LX7EfQ z+uORzBj0=sbas~T52WI=_y|$O)CCx&G9@;w!2bGud^%ed-N@x)^Evd!<;R-t&v1j5 zb`22<+Po*a_uG}|8O0Z<*&?o_^Gj+`mrP zjXT#5f9&N2L|YX{Z+BX~RZG+{42^U`2Y2w@ZSPJtiSwL&?&we!_N7u9{`{p=faIL{ zq9|FsKc9|xt#n|ynPuQcJZX6&tY^x|jElhYDSW@6+lUbIykb1^24f-I1$WBK)T!z8 zi83kpVy(m!voBwk06=;qtLG{lJeUtz{@QW}p(`M|qu)RslLnJMF1;P<^zCc}t;T;; zrLY6S{LYBAG&f>~t$@Y-am%HXeMj~di&tqBwRgZSe=PLt zu?w!Q9rd7`NZ#qHTO=>^Fd1`kgJKvJXU%W4qy9Xcp4m*(IsAe;T>b%f{M=PqVIN^T zm?Z1aw}6agw0N*pgRR%ej?pbGf4JS%t&M(p3r&LeQTU)7>$$EbBXHFzQTi6D=+uWI z1LI7Y6FGI=M&JjPR?buf?9~SSA@t>Ff95wU;i@(bTm$%-gX5vN_Y z`ddaw8AmRLED;W=tIx}BzRmRyFtiU;$tZc9`+F;Wl4)cu1mIu zB+5l2RV*gIV=74ze$`t1M27vG1@z|^e{{WtBt5eZPLy2MM$c5ZeFMxw6V&<0A%t=8 zF@DMvHBi&y=;0HKKm}2rAoA3*-04b2to&Uh7hQ^{Z#6DgDC>08Q5-_~2i!E4u3rli z0-t;p^TCAt{PAFVw3p%H%$*gB)EPAc(BzvVLbVlnjU-pZ>m9MHajk7lVK~e=q z9#u;&33_P97(L4r&acJ&qf8%o_d%Xg$f*4F7WE`_$Sa1;JbCcLsk3bClXY>|AD`PF z&`p7IC;qn|y^Rp%a$1gJeKUp`etP*(@{vfLLZ_UsbyVeO2FDPB+Hf&*C6--v9oSJ} zmtNkRUfW{P)ekg$9mB-GSu0tcd`z80`Dw#s?ZiZ_I)+9#s5#`ASe_g)Y;(0l>~rdK zXP|ZI%Z!CU*w?u#0-@t+Lbcg6>AJk6>dn6@RJ21uC}OR&et0X~CtQbjRM&z8!ZY@( z+F}g6pPn_&form9MXI@Yzr>smvw70QCiyJ@Hlu7ZD#@LVE85VLdQB-!$ zyH)KXTUhYt^J+8T%MU$TrBgN_ah5J-B4&&~(o)Cu%w=i&<{(-$V)pBUlLsHG02Tb^ zX*rO^wDVvB;TqeCERlRAV)S#)CHrEqPR>Lx2Q5kuFN13Egq#0$< zaAP%!ECw~E0d%pHiKWNKL*&3F7Tf0p!d(0wTEobn?^Mv@pi1rEeMSFM6d5iU<&O%7 zi;=1X==-;bpV{rGnWM#lYAq%5HPz^Zl8828g+Yd1a3G$N~aV7R)okm%H3rG-Z^M2wYbPas^G zJD-kIJ`V-Q@_QZaI6+9u9;L6rGP0T+`9xMqBtaHh%pcmKJbrW?s>{pe%ZCd`A$vg@ z1ge=}`h2_-F|8;xualjb?Pg8Ifmmv>ou#K*=Kxas4lAfVfm;G04qVU=J1zYhAY|EU zh^wM@wg_bPcqw;e(+kzjzxKNvL|0M4v429Sg)<-bk5dL;QPR#7c_J?<9x*_yi8$d0 zQ#|F*J%Sf24HURGblFki7E6EDxHeQSnZW|*00wKHzVA1b^xPO8*@+=6aB(d=*&G>) z`@CuJf1VuSh#2B2lUxW3nB_i%t7FWtnrWuW4j8!|w$w6kM;tyI?4gT4jBNx^EBVP> z1y#dow%h8a*-L4+gx}ps7Nj8HuR#yCrnqmO$G%!eHi3hj^1fBV;;K!^%*nBO}UxaNb{w|M*-Vy(DRYGv0hUcLSXK*MI?TcOcE1D{d-QJ z683{N5a7cEXCFA^rUu?K>;nm%T0D$dCHRAKI2oa;>$e}w9Hrk6Z1(vt&^2m5<7 zaYC3(pD&it@L7ded_JAuaF@w5sn{nBT<^#2>}*CP@sjSAAON_R>rAY047}gjUua{2 z?OfcRE{Y;KdP?FHV9)n@mB^cBlaVDHh0F8)`wAPU*K@q>HfoW~EFu-_m=AFz7A6L1 z=;s2#O6~bz&G&jlmykJndb>bF4MBSX!svroIclG_+M=e9L+~-Z#H06A{7i5j3b7#p zzU;ISgte{taHW&Pie4P1-UgI(1Kv0{>{Bh|S;1Ron5xKp|16qBd(>^A~hik2jW`n$W=Y zf+@m^ZS~_LSD7H_@l7!J)W791h2Qrb#1UI^>h0~$ZwrLd;^alqZPK84zlmz01w}_b zh&SS^=g%nS{QK=VGN%yh__y|7ZMbP#xECf-XuRCu{Is8^ha}A21aTBxlsj`qGR*cR zCyro<6L?7u_O|u%by}xorEMCJ9QqG`0L*p{kRT|!X#ax%&RVbX1iwAXfwP_A?S6gq z%nYtr7O_S4oVkTrCQN|ZONB1p7-eis*p9QD=Evn76@@W4gh}zugfJvl{q91gLT}uR zbd9lDMFQ|>!w($=CrQP=hdyxOLsHJRmmGWIvK(?_^6Q~bY$%C+4zvWQF0W`nM#vYS z6Mm62z{1vO!~nP=;m+jH!NR1tf@u8rTr=GC_pI!eV+eSu*%zHr7+%lyNlpQEe@9r9 zG@feEm`D_Qay+JJb_F4X;uG=}sMc$rLm@-xGrldJ9lGYXm2Sac(~zc0KAeTC1l75WaQcRDfl&)DA6c4QUfP%Knc7veB$pN`|L!Ds2H=VT>Hw&Wd#_sg^C~>HL z#A0*sq)RUb0cmhk5)yOU4tJN@VGg z`4hY+Wygd1`>_^V<{+=4!rDtYxThCr4%Y7x<~}XT2=Ss5HAwHnv5$s8a@<%soeG<} z7cGDcHDLj<2vOn>giHNIVmwA0woV;ls>&%iffjb%i2H=U9K&b514U+CzZG3f&TL$Z zKK8M&aebnu?C!okq#A7Ty#RytSW{OlTt3COKHcQFTw@EpPlCrf-|MdsgjEg_T*7A` zjf-t=i;Q)<;B1B=$g+<`Y8`TL@Q(CZ{2#5th>U`$8gaD1>`EQfOkFLRY^GM)fss=Q4`c}G8g_|a2M<5LIDYE~8hTgw?RZs|0MNTzKj)F$8abP==Qw%;Z{q&}gEFuk zKsM)9{ZykLJO1R)34V*AV4&5T=hg6Ti^npDnNn7?n#iEzwl1+#e@ukaTk1BLUoZL= z!TR#`jMG-X9pFG>4WeaSxj#N)w}VD)?Lu!j=!?Zy-b{*@UKS}6)C(@{UWxHoJRKC| zp#x&RUAQ~|H-CI2gM@-Hv9EvqwCX<|MF*P447kloA_#lS*y+T(1$TcYlczuXjTuUp zs~QyzUX)aPJKdh{}k`P_L>#Y{iUw9*%0n zPBv`kH2e3=rn+WdLvskw5u3iOUJN84OqZd7%(p;A8f))Y8n)CQ-tY@hu`S1h&*hLIA7rrJ{fKP$N8rnJW{A^jC5}1{{`Mq*RAORz zwvN6GzJ_%*CV`g>h%hghEhZ3dYTBpG@Y?cxXt%Vv6Rt!XNjmR{sw{;>HC|yMWBeGM z8FW8RuzP!qnvsVW$hV;rS7EpolC5%>L0Tp07>ZpY22{(=##l`efM+^*mZFsx39&&QzftA$`=| z{6e=7KWYMHDn~6N@HA~A-%Hg>B>eJ5Y}zY?o^Cd))JePQqy3W`YYFS%lf&r$_?it~X=4+=stJRD;gYsfagp z?D>Q5##}8Nax?et;1XqbNKKgQLcQelY^h9T9wyN{;u`-zl$hu{Rqop#j9Zmr4TuvI>B2Bc5`lV7Q_^a&;y~lpnDT z2cuXhlsW7~Y2Neg1}}sLkX7k<;xRi_Z%=HXr60bN2y(Lb#65d2KtC6AW&CqLzkRBR zD;I|*BQ8mr>*s+x;aNp^zV>A0fwbG*dbHN@MN z;ZR&v9pl98<_2>)(lvGKjgN2Za!wIQQ9-$zXXpn!!qiywWZ z`-C;e594Sbj6I$``}Vtr^|R(X)b}s5n{j@FHW-Az0)3Q92A_uQ8#8a5LjtdT_^t+a zw&EFpEss$(PL*ZJ1BMZwu)|uih~ZSs7kd95MO0`;>`dtFu=t_pxoiI-9sI0s@09zA zv7Mf|@k4lzydNLizn#F+`@)W##*T%(y*67DUa}bHp-I-S>it?k%Yzy?mv|J?O&64% z_IY^96%mwYGk_kDiPpXvM<(+p?nBU!`sUA&TH&M>4JD)aXkeAH7v;2? zR;bv?hqG*O&sa4ZO8<%yU?siEq4z+Ddw$5p&a@m~d|5|tXc#}SA?gY!8_-B4ERyt| z?yvj)K)oNP*D9pu3cEQ!n??2;PEwKrsltcD#EF)%YZ)~?fHJqkpEH-A2Iec?g8Add zhW`n_-kAGsq$zhICRSvY(s)?w8NH}rpQXzM+^WBlyFMdoC6BDr9RlhDxWBhf7@`SUDJ+r+Z{tEnwD+FJvDGtpqS3yG)oqM ze_4CuHp?CNOF)UMs$mICgsIUc*gKf2`YMEfv%IGbX97>{$TG@C?Q%qx+{;p$1mV>r z-6EB~_A4g$)}~HCF5~^Vc^Zv9oKSC;IS9V&+pIh&Fe`FE8gk5SeF7~=b85%RjCPXt zbZH|@2XiHtdOq)6+0btFhk@9`raSWbBmexXxU`lPUJzl&j9((pmJB&^lG+9~sC^&o z^3|0#kk2nT@4?>G+^YP|AQz7=vkESnDwgRrv;*;!?i)pe;?VEs3e)S`O9MIARzvm; z^<(}KGuqvgIp6W+tro^6w#C9wzPl6dw^3mcDOMTNcjC~qnUVg1Y8nJ27 znwH{{jT~JO0tIz6e#8WayQln0IK=cGU>8a8Le1F=X}M@uvh_Q39s63BFL@(54fli* zcgnA|_<64NJH)E*aztsa(X}9fTTqt9xV{^AcEB9`2h;lH?3Jpvj~WtnObg~XvLUgn ziHwLqn;(FoDLfew>Jqqv&%T;seYtE!b`*n&ZE_#UL*ZFHDI&#|Rds49>u#44%Uriq z{V-qiZr^YXY_%fGfY;23+xn-;d~KIDX!t!VF%jBO(tW`|N%@9E%j3bj84JM?v;iNwf5O<0lj=m7bWy+GlxcO{h{gkGV@>h@kfOkoY&`u8?FWn#6t8@Lr@pEx| z+U{DVgOp3R65v|}k6TK(P1}>4#(>~HaxWiz8O!M@U5uYeS8h&~aN)I{YeHgZviAVc z*_~*mRu}wq5v2CWl8{lyr=VcFaaRuac_SuzcTfee-BUY;LA~-?=c>WFC+)fwmO2R5 zut7L6tVy#iBrT~V7b7iqU7(Gf=zC;fd@)z#@OIU~(U{xzj6n|LS(p36JXrczAf8L> zdRI_hg36IHZYKLF4ddNvI>!?nVd82@Ans^@L`W9Vcjx{x)Qa<(v(#7wg=tE~L0JnJ zU0ArzMyL|8&Q7xFZwLI~LOYbTvtx3NXMZ`%ZT0k2V6H!e&AeTI7|qk{;rS`r)y|6Q zebthD?M7$L$-qQ1k8nISGMryqhRFhvLa=tMtRzCP3aAi(r*QvP&w+!!DT13Yq439# zlOf^M3Kf3fC=V85qY5^0Q2_U?nHGJda};O<@tXfys_ zUS-eieRa1v#ptq9Sm84T zo>Hie_Y*uzYQ~7|=lEU*Cy|!B-G81h&(LeHd)A(m$%!~7pncI0?7v>g z5+5^>NB7y#{YKfPv4^?LdL^;c=^{C|#&WukBtKZ^X@M-8dS2xYBbwY)+}%)_ekDsn zBk5tH>63h%cEaLCgmw}xQ-Bw=E^`1*w~=K_Y!l=I@`Zx2qvN@f`un~qals(KJXxiL zmqt)X%9h*-{^;sa^S)YUe<%sOB8%v_?%fQ!78Y1C^y036uQg@XxNV7+QduPSW0I7np$oEL6NWNE5ibkrw* zOgQ{*L4fAlihJxMae4RK*z>BL(tEG9mQ*mX#KS+tPoHRM7=iTJil;u{ME>{^>7{m; z-QLecfNENQNxe5pvXG|)z?dP|%sLev&DJF`Fk8~1VK4SHEAHlnfkPNh!#(98@&HGs ztqqkdJ;|X88tFRzS`?2|GsVbERaHHJN5WhK+&_2dxkaxT&=n&Q&k-O@P;LNEd&Gmm z*Dl&qF#kZ&U+Xk_Oa|8y3odZ}8Od59Bi)}3>Z3CczB<_c37JkH&&nN9$aNO}XDdIT zX{LWhaI~D;$o5P$W5oI0VtF$y$+~h`rRVJ}uzhnWY<#fYh>IY_^4q}B(B%wP1V7x{ zP9iTa&VIkHV}Fq$q;)s-VBwNvm8*_Ko?)B(T&7srl-tn#6TVm@^fBS?@sK2o)%Tr1 zQ%j3yYoa56qPsCz1i0luhC>S19)w3wQ#%0#VAt$vS2oLW7N7~9uep=VONr`#;?2H{ zsJUG3!rOg?u3EEFzxb;a$1QJ|gNNhWM7;fhzRr!7QI8&!7KHN_A*uMtw5%@Mew0uX z;H%bPBBWuGhrH}aqlMZoF6k;9w~LrAm+)l;hQGg52^#G8>8V5n@5udS3%vu6!{to!$*$>1eyhaX+2}UkVNv-`Z1HP<^4m|4;E%A|Ne~}Ts?pgIb z_=TD<7Sofqf_9?c{Q+a>hDPsJZmqzeq3ooEsoneJuP`+5oUGva(+@Y3p6~WH_2Cs} z6B6EC*&m^s6{)IB<~Vlnk&w-F+_tMR4PihJ$d>gwJS>&`Q;PP3oLhuMNstEq%|a!@ zeSQY5-mvgE+HU8QAoL46OSCt&hl)8f&M$Ep*SI$FeW_{&beTE_N}K4V&*xqnlc7a< zzCo4y){f`W+rM_n$?D8^x)Zml>nX1sN=^>o@`h+~_LT$^ZRiswyI-iPy-avS*HsdJ zZ`T_Ow*c_h-cXVF3v`xqI zW=cDo%ytbmv~B>~#A#QYxR%|G$%~;(>!m7Zk96rMp_I0Y4oMpSEKn@f+;njX7sv8a zG~k}k=oW~U-9V0X#L5#aBO|W44EAK@tQbi^82{Z1eFqlinE_(!QR`P%Y67@j zTjVl2RhsB=2-b0$uru7cmaK~QA6owxLP{&lwF#*4)0E#4rhBor28M^TR=)dF`9EJE z3HOTc8(9IAwApc`g<|T+X^1d+dDgNiU6Li15Li^%MuNR$Y3=|H0~5U_!Z&m1Eg#Sd zt$^C!I|N4Q9+HtduERs0a0lg8ROUl}8t6t5=jz1l2ULbi%eITt$=Lo5@|~ac`fJ>s z%q6kp!1MBwV_8vElB^yoCfZ4|_~ON-L1G=O+x22vyQ!`)I05c6TR|^l8JfJ6yo|R# z%0%M23g*xDUMdS&jsIu55zB7r^P^VhRI7s>f$HuI=oO$B$5O(2aAE=5PUQ5seh$vy zLEcY5rxl%GDlTp6z#ML*;te5UxP)TA_Y!|kQp4YOyHk9qGBLsz5&%4=!nIrk;c98l z414LkKqu1uGwFRJycpdyKGdY(Va51SGS9!mVe(BJeM8%c1o#_jsm_*f!ToO{5g_!a zsD$1loT|B$$Z#%dnj93Tb7Ei^d?VnMkxCYMDZqhvZl9m{bB>H85bm=^M`JaCom-XT z2kX3WHmv53mqM8Klb|v_FKML&WXKgojc==N61}MZ^ow~F0%1A$#*(<8fxq^3%Za5Y^H(6XkF2sY@Dat!iH(hamc^%<>F@p>nxXGgTP=-qQB1KHiUC4Y z(^ZN6L8H(9@NBH^i2mWdM}8k7554y=l6FIvc`mQ5+z4z>M*%(1BX=1#6K?{JjovM{ zn7=+i{%|i@{^C7j>60})4>uk0Wd3>qBDp)PxaTvrGX)fG2j@d}>cY6K$CR=sZJy&7 zOG} zQ&A>jVMG70!4+Lujmk#kSs?i<-OYn203`G6?nFAx&Tl6^R;hM^B(-YG4ab6lsaZyD z{RxV!`fu4B28Pt=#0}M;+${O={^(#55yzM*Vw1hv19)v&2dx%!qoY*R53Ht_YKx%# zzk(gp$p)K7>_dwOL0`l4W{suYKdqL&+-8L&VnKSH2_uTNLKpDByX!m|9CkPsd*Q}+ z7xXDEoV;*P1to3J&qV5Sr8DU+l*`M-pxs%>_hGpb5?bc5gu*X~Upy2^yI5@dB3nNB zcE?O-wmiE!X6mhH2n*wVwlbDO;WXX9Go@cx!YsD~u27vu78T_SITHl1xNhH+6LMF6 ziQJLW^sL0OiJunAH=Ua8rB^oxhBY+&$|j7V0V#T34ysa@z?z;6Y3-JbMkhJjnqdeq z)*=JWY(qtdqEJeSj^nxWfociGJKQH54G6?LofJ;OKHm8se_Gd0z7tR~Yb5~^I*C2N zulg(myu3su?daRzC6UwS9Sd7*NoKG^5&<>?BQWCxJc2kjd}NaP(ky83eUL*hhM|$T zFU&b7Ec5yVSz8I_6?aBrwkI&CG>D30uT2AF$v*=qZPgP znx9sK6+-S~E#kefGw%#xd7dCGY&+VIBJI9-Ak-64?P7MIz+cmc^%Wv+lA15dZ*ps# z!UV~*G+$O%q6__*IRE{7crgMf<%yyEREiCb_r6TO4ZA=_QP0jsUHzclB*(#J8{x&q z^p&1h_eQ%@$;cAoJ|1xJ{~|$D&ysXf&i!12WZI93lW$6xgM}dJ#-Neb2xEcpTmh;d zH)oHCpwwTFR*s)lxt%p~t00{;Oo>OVz-)IX>uZ)>CFsCLrweU7_>_W|&cV)U^n!!X z_1^SJ@k>Dl$y9_#_eQwCU~#&la^C?s3Q>~>(hfn31(3y!VLC+?be*lakf7qx-HhWd zX>CM2Xo-kF|K5n_7MvUTm#p;3=P z4}0yM2WZHHCn}hYMFrpgsc+@{NM$dT*?w`Q>td^vDE(+Zn%VgFlPv(H&D{Z1Uo^hd zQH3(gnj6pHnudqk41R2G+7hoo#!Pg|5MV%Rb>;tdTv2PA(2*dmv$ifb{#Ax2WB`T* zFP2cor}-~|-xnyk+Oj%#2TZI6ERN`8JJm=So_>^UORmb#6d6;iv0{}>vZX^cLm{Pv zfHTYfytB-R6vO}p#Re0X3K-=)lfe$+uHg4#;XXI@0&03F`6R^y^q2ut?Ar{#^KT?& zcG4>kVE!znw2P&=`9Pfbgqjy zRnyz*Zv=&fiR+qCvSkUTQ4TuR7~%a|7ngjx7{Y=8`D-e6Yb~r7hW7SR{p{u&%NkbM ze>6Dw3SYN6@DqmipoMRCp-yanYzMb`4MjOo_8$UW^3FjwE~Tc{WpL#j8n(-Z;e9EH zQYwoxk~dndF)oK?wt5^K1gP`351ykOp>zX#qTV@1 zO}N`#kfRe4>-j|RN;ti-D^uzmqZj7r-Gk(RS&Kl52Zca4f<}Z*p;q{TAJg9mI84F^ z2>poM4z>81I+JO^efvQST24Ow9S3je(>5)*)Xfg5Nt%4zasQL%hr-Swfxt+-`n3iL zh(;x$Kty9u=5Q?KBX-~3K22fYI<<}5$L8?w*hknhkv=2@Ko1onzd`?#JItV;0O4q^ ztQ45Wh8m2*NK*DID(@vF9o0)Te8lwJtth_^*&d?arS!Q$oaTIcXg|YpmEzNsv<=o;I3hMKE$6;cDL%$KNMCA;~OD!jhzfa5kXaH zME%sDoGdyi-5K2kQ52u%`4_6k?}|lB^yj=c?vi$U)VO6473*QWc<5s(Y&?_A*rmBD zN#)JREV0$uJAN@YIj@eYto^@#u{DgHxFB0iGsS0MuBSAcj@$3brubm0O@zdlNw$aThG=2~w}6dq*v0*)j;69V0tl=5Q76#pY(cZ#MH)cY$JCY1uxdDHJFHBV<>|e87Mot&}Va zB{Sk7i_Yz8{i5zy_OqL0?i>#iebWp~xFM^uqOvOlRQ6i)8r)BHxvSVi+v#vm%S3Zg z844_@;FZ)Zku#m_JSYCu*kuj!b;2#VH@@cTO!<~tnRqUwv;;RS?L>To-*&Czn@Fq0x3x03_*=RCagXO0v1 z9HU8r4g#uf`5oH_iuZ2Mb*$mn(v?`qYB`3G^L@fe4b(TXrSPYb`$t|%*=Qt zaT9;@>s{kW+t365HoBuId4}HbbP9gOt20c{)}8;b;|A=BZ65h!C8619c)pZ;@kgj` z8tIRLBUsm#t^5XTQ`*fX{~vj1i6rk=7Do*^P3U z=QJ2*Ek{f72*xVsw6xm|@O@l;2Q(v>#nkrjknq(&* zRn}vk+|h4Pg0Wu}EgjCqt+4GrLK0YGo|oYCcA(*MVIEH~w;xGP9L&G@0ST0CuH=#N z`RS&Gq3l%#&Y0tF%{Td#OKK#Jy-x%r#Mlxq>q01DF_HHc&?HW+VKql#(pj%v9#4Te zVm-|cZ&KW=Ib%IatGw;ML^1N=q$?Ac6#S}WDvJ+IActV%^PS-?>WU@dnY3d;f=GGn zv77RR6nU`jVThyC*u$1D(U2KPHbplEt{~Ca5m1RtILMb2^`yy-1XjAbZCB!A}TGNfz9& z5kq*#_s_j1!h|ZPYrkSLhx3QbUlsCGI7=LTuEy@T&)qhM19)_tB35IE=MIh#Tx8>1 z&r~(ieH=Q*5&j%8m#i3Xo_q(plWFVh8*E`^bJ4bSx$tAcDVf)k-;sIofvV95D4&p` z@=$|AW|ax+9!nov)LX^2UTT9dTy`h9=}~b z__L>`<4*s=09eBhk!#+2w8hzIAKSC4%+Y8&o~rD@N4+WV+|w%ou2eNIYfGbgl;_OH z{QJdF5voJGs&e&L?Wm=aT#0n`n{v7>AvEYNZaGqi0J!e#bck@ti?>(NjiM5UQX`L+ z#zFe=h!+{ML72P4`WH4?V84w-;auv~hN**Lhg&F_VOvS%+Z#)Yn5?n=qT7;1{ubLWMEmpLkb{cVKYbZT`=D zK%?g~T`0XP+8HwHh*xkg`kBw5id9Irvo-_WKEiSK7R)I9=`#dSxev#t)LOa50g)Cc zodXLnyklpt-IF0xzA+3UbctUWsvl@cFbDR_MR@WMiVo3&d(NtJ^;BMkd~%Dz+kBGfzV&BHArd9evc z850om@>;bUz9km%zUlcOe|Wp``9U*yik_W1>zzvc?DoaxOWKKDigG=C!uv9LbCV7M z4O*AaWkAr{%oVH0yURs0eMX9vao!GBR{+kAy*N!#a1yYp(Tco#lZ$8oeNwVv5S)E6jUQ~9Q|h~(-2B_u#zbGI(b z*P3y%4eqvP{5-(p0QXJpy+6D$@f~&T{{X;1KfnK5!8&VtW8^lI6QjW^F z$x6SzX(0YHkjE``l#yQ|d%p&VPP9?SvRAlD^?z+|8eW z$YYK4;Xj%4PKN&6JydLYan=joGRiYC!U;TrbKsN$zWAkWx#(?Q=<&8GzhX%H)VTQEi8wue@DoEX zNF83+sCBsMvS}FQPgW>23hu!+rA#Ml^6T*W1*roxc>5^7zV!s3x6S_yzxSMM za?ZDmw~jCGy={2u_C1z;Umhsntt01r_GR<7>pNa2m-B*@QSeKfgJr!m3dpm5FFvU! z=TBVYuhbRj>V|(p4qm<_krOz_P-$ndjMP23-`;CpdQS9PF8F|~qtZbmElX<4B`K%S zGg$8g4B}9(%Qc?z?F*fiQRkk4-FFX%rhd@b@ZwRb`y2~R?JOfkSLrX0z1QfhsGWg$ z=CUyead%?E!pXRIQV40Jya-5Ld68Eh?^O2V&il^BJO?KZ7ted?^|mFnoeW-@1&{aG zx4*&;W(Kd zZ=d8?KxMV(HIbRyRZOH-q5D*cBWzQ_dlmPueeedSQ z?K|(C49#trefCT|KAUZ|N|4DiO8*DjIsrV8bG~?f(pM?M|GZ=3?Z0>53t|g>`yxR4 zG&X;H{Mu4n;BOeH^K)$}=Xvb4XA*2n8{V?=tCSr)=f$IdZ#f^FzQ-r*G=B$A{TlGg z9Tw>njdg(4jGS;g0_2TpIt6yK0jaWtUsoR@1MSETHbW~Npg~osv`7xNBi5>8zw}6s zav;WOLX5n4C2zG4Iu7Y!JTJL$#Ng2rk0+jVf1~my_J0f_5EW=cc8D1|Q3Ntb-pIC@ z3`%|pvqUP=uBRVyEEnr%Kt!+;VUp{>%Qz9-el-$FQ-)JZdYy1;h`3vg^av+XInZhu zNE(tGAGrpr7RNv>6BKF8VxQxb%*kv+=uv3uM@*#^Ocy!F=y7B-I^*F6}{F_{L#nq-+)w za>8r~kx!4Lk5WyktAe>-rF>NpEAJW*f2f}gdEr*5Bmz>D42UO98G-UPJNv?M3ir2? zk2VBI*6p5tgv(21QkMM*u;`(a$Q>GFMX=9;m%P=oZ%%`byd@r?*-JaeLB1%`$^cQA zZ6+OT5@oRON=_EZO(VG3j#aN6NcPHoKbF%eeB?3P)o?83tF5>oJECQc8jrMZg+mI6 zlF(Sj2Ro3ha$xlk)hJTu5#=LSv%w#giA}<}Am+*!HTC#Br6k@duokL4FXg ztmES3z{LbxV4|}QjbR|y2aC#!z*|530=W-uLoa!0X1~M8rvy9uB4gIwk60edTl^a6 z@!0)K@X4Z7Sb9BBQ=gJTsAD2ulCV>&MNX6*2I_-!-NFx+p;3{wg7U&F1Mm8HLB8ng)gYTPujFP?3=)ta{Fhu*ZeH)# zQ%B{2=P&8L{AOmjgzvR748_weMRR= z$1%53hT|#U7V4)gTqpTyV%UtrS1%08doagLE&HTj*4wa21mD$LabW?AEeZ6#6`hv~j|J%7BJEit>ZQX2hm1)?xO;t5GX2cDwtPTvDmDVFqbOGiX0#Ef5KWbPlY1 z^BUZn7sLs@2BQ|djI|a9R^*v1j3@k&&yZz|g+FHUFDk@=D1{dCo;sXL8BOtHf4w^7 z3v9z?vkuq{84L1Ja`ia$dg_;%V?-F_r`LYOoMbp=+ltda32ef~}h+RE#&@aFfhs-FF3n<4%-MJD{@>$pxAES7=% zRt~Y5VrP7T_=3ZNkU^c5cFe3FMqP=OJZ{Q-!7@S{<VCE%DNyL0OCveUsl=0&EUjcskIxOyPMCK;r4>MB`mXwHD z=1Nos<=}8%sbp#d+55uHH8&>UU#${(`!b-uv zcxgTwx9-Q$UK1`qZ3ITsV2+%a4A=fL1m@@Bw$XtI8I=tCo^^ zoKevzs;omz3;RRG(Odj*Bl~;xSbr3j)k7T?jhiOLz@C+ibFGc|c3UgvoHqeCr1~K= zD-{8i2jI>cj>jiN!5JHd^RoP~rqqqsuFS`~-yQ&hBk|<{fpgEDgb9&$%pMzw zvaO{E95WWro{@+!b1!xmG@?`J73k{4RaeYKNJ$|MH5+lqdBf0rv>5TzCgHaH5F{i; z;`|g7KHc7gi%-piqpJqT%Jg{fw()4(coY>>PDxFkJUj!>pOuNQ2!C9`J_H5^WBQl` zEJ?EAo6SXt%pZ-rC>NP|Ntj{m#1?fh?wJ~n@7EW>IARPwo}tDYYwI}~a2~gZ;I=t& zoJcIVcuE|O>@P)gP&96zm5lVnFkC^WJxZ|ABsMvcH4W$7P5_Kut@vnrB`&#g4$h6VVR(KLCOJJ=zNdlXM+4H{ zgY*gccX0{i7_J!|4*Q5q z%gaWS2db8=)2AR|`pD#uwD&B8?qcJe+SG<6$r&AB6> zEiXgr8B=gwm>H?G1C#xG@xule?t5@Dy4UQ(aZfltxHlKeKCZ%VZ<>YkGt6kKr4CCH zPCDYDnVCxNC;#whoSA9Gck7N~;l*=t|5!iR!oqOPglKHqR|Zc|F#dYgSR~NlnLZ^O z<9nO1yto@@acou9p+p*9XG`~ltsasYU+_OdL+(DwPG@Pq-|+H zMQ{vm8y^mLQxn#A8S(ao*?50N0mAcA@X*|J1O<>ka}%(8b1_U=xp?)g1cWd!I&X3; zj_xjndE^K@IXMX7aY1lZHK0^hr}ciR;UdE#;_=bdqZvq;v2=Vi_7;?)+b;=kUYkcJ zLXEu#>d?dq$Y7=YICCtnqWvhK{m_O-;f6`Ea8Q<(Seo(e9?B8}Q{^#!;!&Y^sG^_C@-r)jejg&TAYOF_#k*{TM?L(fQ3OC_AeO= zB6L`_zm9Pf@!A9M^toBszN-}N{TAGMULI--DzNaRcQuY{cb@$KW969OJNDytXh65s^U%?r*@Z zHY;AdbR_&k{4qPxjGcSy&?z$MwSjc*(ne+?xuG0i_k`k|OS2gm*s*j<0_u-dp;%e- zfev$U2=1Aig5;cNjL~*rRYNcCK4(1gX-8&`N`k$+8GCE{@#wWvF+0MD5u*|?FEbo5 z)a6Uh$bq4-1beD_aNdOzF^z#>{@7UPIc^1#Fq4y!#y=3xEy>2#ZRMDL)(qS=#vifS z@whF+fWNM7#HEWzVs>5_#s_mQGWcUjUMOr`EqMQ^8+V;O3RzK3EFBSvb^A*Yo;DmW zo|A;g@BrLABMu*~I0QpnBpy5^7YT{sm>lfE%JNQJwjduPsjp+lC!k?(IpQV^$BiQb z5SE_|^Nxc!+Q<2uCjK9VUxtDaoZ1kGJ7=e&VB1dI|N3gYu+xoEaek;RE63ws7ooDU z7|$)+i^ph1Pvr!wQyDR5SSY?eIa_?p8A@8WbvbA2M?@Fv-+{KfSvdFMqxtZnG6S zgBCU0w&A8P3-M7w3#N@vgI{?u{=BaRKW;sSqZKXKymAK~Sy_yAP5qdk8?7vw`gvn8J}dxJV(obO?bUeb%Q8$Im5PYY8r*a5SNO7x zlbb{azCbTr$x9^2#WUCX;pW+i*tl*x9(Z#r1zdxRhes-_Br5Hz^_ZSy!MmUB!0Iv! z?p~CL!}|*G^!tY~@1l8FG$oPF9q{bOTk+uA>v2FGi@QcS@!D70Nat1*r~|Pi!i4Q? z=cZ^ivXUd9s&1#j8jWjXJMi2$hd8N5;HmlkP?_wowAbQ~UlgEDJ^>VE71olL&Br~s zU{oL&mLOTzk3*gD_~UFN9(i>YZhmzajAODe)1rZ$QCFbc@nRs68XE|wx37#?0{yLU z!iC>Iw;n$ll5wi~Ag+6EH$svkFpQIZ@$Nl%sT>fT(%oet}8?I=u~9(^}@|KIw?ehxKWwV z9?n6$x@(%S^I#Re*l-L*1+8!}IzP0x05?2y7^j|<1*19~znve6Et?PE zsdta!x?2|@#lp!>BB|a0+;dtKUV3H~ZuxjGtSNMg<6ChX`+MDs`!VIh35Y4K#)iW+ zSia*pzFBt|KkRA5oHi@Al)}bqDZX zb1?3l8lo&%INaQTJO8{7={Y%AKzs1UsskwN2*kAnR)ngb`LIjWj!AJY(EY#V&6pj@#v~ztZ(ecsrm6} z+j$sY7q?>Bs>7)1P-6@yENE=FYGMKoY~F*1-(HIsc4%O1(uQRx1u|Oi!=^nY*s!l0 zudJ1thQiQVgN>s$v{GL74CR`HP#lk!)Z34@X#^b`Q{-6 zrNq&RChvvhs&+Ix1F$Hp7mmmzsu&$N0B`ym2?}Bl;8)et+j5IvTCu?s&c8Q_Vp*RCv_w`|^68>i7hi5!uO zJEQ54e|H3XTCKQxUgSVlc)97L(IGv=s@#=|i{zNqm*bAdcOYnHHj*euGjoIS>4zI| z*Ox`uzxNovJKTsjRu@r;n(@lV+wjcV<7f;B#+flT=qz^ltJ?A4tDCXK9)=4doH%tt z4mv6daNq0e@x;nn%o{ZlGXgvC#*YV342RYqz#pDki~VZTui~r-{4zA6 zkkNh!Q}<%kK6>5VZ768yfr=CLjkP=rBg$k6%9tH;fE})vQxa*Vi{=YgLo-vRh-n5mQF^p`*%$Lk->NYiLq3SIUyY zgR?s_QUXz1)QqDoJ!q(^!8T6LstzM&&CkMLub71MvpL8*6^&#s1y_YGNy*PhV(BHL z@zNQ?F)PI}kg{BEKl*^DvkT#q($IUj619wWx(`=j4@`(`Ey8{KRoM3E9E_z9zp-p5 zYT|RT^`X%yuOe;{S=WU)(-0 z36U>)y&eU}8MQUJQQSg95yDA0HU*DeKOT3Ek3pnE53Q>WyDOUz84`~h$NS;A^~Vr1 zA_*CR{h@M(}#B076mC7fky>c6RTqGt0IWaOX4bPn(h(Elw3w5#(m8_r9TZ7-cUWg~2IveLDn_-)h z3f=B<)U@`Xzql65S`C;>r=iQ;JMgHQ#<++5QF2jL9KzE_3|KNb9cEVv))aaWcWFM% z-)u&aHUjruH33gA%0ZsL8eMcOHLSC9e<6_=5kEW{NkM+N@{|!sSC!-4owb9yz`hA? zT?Zchz7pq7PeGz&7Cw9o7S?ImUW-;<_7vA+55*uUQll)uCW~arE%bJI{LHp$8yc~r zf@A7+wmUQ!IWh@Z`a6( zGY~uRPM|z4h>O4_VJf`3rh&LUSa+Zq$qqDWpuWgi99w2igZv>)Zo@JkHE zINF<$IVrRsQF!j1?Wp$)$8Y9j|;K5@w-_8dY?QnIrqr>Kh%MuvahQ;IlQ({rfdK>FGFG zUVpv`#9}=Qy1Ir!`KWH{DZC7 zv8xt+?k-d`yAhcihveV@Ty^RQ#P?R<>#axe`!9;H;IjF6=B#j(OJ?%H$AAAQ3`p$X z3S?wQV;kCOG{#6?7QF?D{yOwf_$+d3tVf3{7I7ke{af7i`d&2msbMi|P`r8_rafMO z+b)`fK&xcz)yhJCFi@y1G)1lDwOG5G*B}2LH@>(9>nnTFTTp;mSAB-qX)|!o2uiKI zs72YhbkQ*EdTTlEdTkHAIhC>!>OgJ{c7;M>p=a9K*vY8dhBT)ZDt{*?#Mz-zm?hS! z59M_(Bq#YHjvjtMXfVcxnb4#Q#9zJh!N4qin^kN4rQJk}k>J z9iv_cGb2iOLo@c4Rpb4)*5KL)SK@=^hp_9g3$dwA$$oIJQ&#UqJ)^>#2^)SghG~NA(4EIO6 zf#V`{vwaj+;v01!9-bP3!_w*f$I%fTjwA{{f*qJ04t!hK2PY#`2YH1sf8_X^p<>@C z%}T$;vGnH3kz76Ayd`ED_-0OKx1W=Rk01F2_tBx1Xjh)e?%3Cei|9x;6qZv?NZa7J zNKPCjKMrNnNGHbK-HW+%Mxc7-7TomgCLHNd!9gRkjg!%s$s=)^r3ydp?m~B64OVVD zgj*i_9(TU74Qq}uaufL?iE81sQHNlw9%Z}B5JdxPHEEzp4#s#+q^m21UN+9M;;>jH z4TQ&y1GVkgw`(tMyZ?LK^6EBhEb1UlG-50+4yT3u(~)k;6J@d);a^vdOKx}zm9gXT zrIh! zJf*z!R@PzT@oK#O>PlSw(2w|NLkSwYIW~eK*oLyNf5f~OkK(4YMngxZ%AOesKh8d? z*dWX@b>O>F(#}pO`EgiBk|H`RbR?a`d(~zvyEqmPy}t*u7v&?d ztOTduwhU{kx|MunGVW%1?}MY-R$hY*J82Id`vJdwc`Lr#-+_2W_>$g6ku~Yds{L4< zn1i>K+(6Yd?yX1~6#_}4rHu_hnz4`K=%G>9A;d{Jr(=_7H7LHMiM%$5PLm(X1gEy( zmQypZ;^l8}Zja{N(@nQ3(Xxx2jsX5TIys{q!UpLmJFO=XR14~qn2`H zl>8}TFUVJRqo}X}@p&Pz5{Do8?4Oo|-(?vU`|;QHRh$?(ZX7W!+7+xO^0*G`mr4y#-!SD__!NtwrinY$$L0n5c^@$Yn69_x*D6Y+sA&qzxpVS6xHD2 zXTQVgw|Ke2s4;$S@k<)VXo{U2ouvwix_& zK|JFKc^`tbiEfL$ii`=Eji_052<5{@;iZutJiDR>1?BA+H!&1M0TahFRNIG2ItV(o z5rH-n3<*I<gAPR`i%h<4g8tSxFY$Esd&`!gNBy)GLy6%B}E z5G_1ON#HNXu(Y{fc@I$LH_2INV;>d!KwMT;AIhp*QCm@rd++-O*Z+AvKG@L&kMvz> zgZ5x>d}Q@^S$SRp5V56Z%4y;ED>3(lQapIcc&H3?I(2$DIfhYF#~{DrFfO8vT3g)3 zzDUj~_Cw^7{V-BKG<2@pT3pCZ3XlmL!G1<`lvQHwwj;Qe_VO0VB467N&%ynec-fc8 zSvU)~j*wNgjWEa@tT5s4hhO#%3p?H0+Ki(;Mw~M)85#7fhIy*7t;+&kR}=P>x590; zV|s2F!jdBqYjNYnwT-yp^6{7vqi2M01V0?<#;_za)^0C>D<~S%>xvmU(MZv_bek=hniGoflqkg8d-2j&$B>j7gv!!N z9BtHK(&!L;@!kd;jflf}!@`k3gA=Y}gt5C61+uKNUWKxP8bpmq!~D!3#8a5Hoo)DW zM*)hA0XT<|QF3Y&934&gWJd*hZGpHTKNwpJD&ev^F*`2;>G2_Gr$8^~r0fyJ=RhRI z1fiwA3G25PAUr1r3o}A6e|!|a`CtuxG)CawB{>*P$LNc-`_UJbhMVR`BDAvwe^^tF z-<&-T{Z(Z+)Ij=_$g7tDO8{mC_2R`%Rm9(k-EA6NBJV6D1|rMSgJ)MCK`oV8lvJZP zBR5=+O-JicUr~n|OAxM{pM`|9IGmBL#>*e48v zL?YVLfX7!BqrJZlB>|a;Z99aQcGjcr;Bmw)nt`*aOs7ptKxuIeT=oDsyE&ok?ZMN} zoCW8Go!Hn;A~;b3&8YN5;^LfcJn&H=T53yC8k&wv^CK}jCj$Kk598@A)i64om_9BJ zsf^@;Je~M_V=-!|;BvdvFC+jVDjJ3Zjfl>QfVQXz>zi~Kk?KdUz6g~@C+6pcAtH%% zn_YO}tHY@1*WxVl`onLwV|NQRLYxcXp)&w^ex3MiXCopK!x7R)+I)WmG!DGh9VE1Qhv9dvy^=`qm$)glGn>#WZH8pi87w=F=W)3 z6!uB$s>3^58Zau^iB-GGV2O@^Ut1l1l$SolP>~OPCL0#zg`=>#iN>G0vg-g2cllv< zz90Vj)@oD+C*r0>8A#-$Iyu~hANFy=k-H4~NW6K&Foaum*m}4G%f8u$-kg!RBqIV7(Fo`^JovIkBCK8jT^tebR4=1i?OGL zIwG>xTZJvg9NZpJhAY1+MSW=v8nUu+YpOp+jfqCdwuAWaXeC-(190(@Gz3#e0_>f5 z{p(7kWclIH{!&yjz*4+ChQXaCD`pK3MO;=qA~-pHx48g;BXY4MnhrvIET&M_uK!{$ z)c*dsd~yN;tVWzaB@yquvmC3Mv>21%#G3tOFb0Ppw5Jtce!m}`BZuRrG=F4dFoG^A zN2@gevqyv@H9iy_8JYg5K3;-%EA063mMlE;-ahnM>7cnA@X5h$+;PcR zWXc^AM>p>Kiq~k*lKnhbbD$1AlHZ56OR*ne25dN5j|SS0T1z0VnxBn?^f;WBqQ0AA=P-l#eb5MtgGy zK3{(nehHDN-Lnt--45g>*|7gm1&TUkmZzL{)WVgLhnbCg@!;lq6c$#)IXxd2QD4TB zXZttp$I7Bgbg81T!A?m_#!aWCB7;2q;Kv>KXm<@pjmp8)v>=R6_QN+kNB;wp zll<}d)?%2P{z!K8V)da~XlNg@jjed)gWU*WUoJ_uW9pO?=-QfbfPuKkv)X9Hs4z2D z?yf{gN+dkx#n@6s=QlqHyY@EYlqKUZg%R?aorkgdU=y9CIGmDbz{lImF?v`G64N7) z5^BNjUB^(Ub|6~Uf;ER*5t|haW8opZaHJFGOwK}HdN}f}ol35)aZ|>SCn1 z83pnh2}%yMQK4Mu^7Nyw)1%}ui4f1OrUmVN8u(kZXzuK0lwlai?a}In)@)L87xcN^ zI9%5Wr_+X5haL^JO(=7*gA&y%x0O^#3bMgX{GG&K@AANE)>BqI=;~1^*>+pnIze9? zNg-Bx=q?;>V=S)jQ*P2I%#ydC4Mx&QC2ViQAx7o;9!Ay_x?$mF)H2Fx?CM8XUk|&> zh$`5My2e&IO-AGd7*Ih4l)NWhjQ08^OdwtIY*q~_ znmSM;c~a;xlOa-xQK}j(?jEJ8yzwr%CM0iBX;l;IIfqIn&ZJNqjC~#)scuJiuL_Za zZ>g8mwW6^{B%S5hZXkJ8&;BX1vxX6hd_B_TCas;&)2lYpz_*%0u;s=KjJ^AN^qQ!w zQulB*rvL6r+|{=QQ(i6x9CR`nEyRZU!Kw0KUkw#jxos=i-8nWMH)=ZiC{DeM4v2uV zCCMl)>V7o4C2tfXT~9ZoOEvu2m)1_Vk^?0p#EkmZF69oRWERyVW@F_QF}UK9l{hR} zO_ec`oH#lq|B}d{-2Jk!KaztgCddID`%vrZRc^<7C{s>GGm;0WQ|KVgk_#!xUvg=< zP|(DYk=w2E7_g_0frSCdP93}33dZnAi?CD9y0BOB$|%wDz!>WEdf591b7>K`#%e=$ zpaJca{i22rs4QmKD0j`I*}-bkXNiCvD$=FWA=%%E*5)=GZ{+}Tl8&J~_wcxq(RNml z5oH_?xyx7I)q?;=o05k}XV5FTwwmP`#h`4;7c#Ly7Id{UdMDogt}eLxH3+k6QLXS% zh3F8<0%fS6ya8?Gu@bGaui@lXsHO*p>O0|*Tk#y|dOBKh#1x57PYJ^9uWds?KWXbHjswlO(wvzX_%< z-@?mf26)^ZsBY{+!thkwJ24WEezH}0e}8YajJXc}1`V2sQ=(N1BVfrDBiX03qwVle zZVT%>&~LIJJ3z1KuhA1h$yrq1(gicaaFJDUcKzjx9omKZ+Gdn-QrFQza!`lr z-Tlhl5Uo6#)SHk-IV@rDWS%qwFNG9g&TFM~E(RP6$(3Ud3ZTtUp`x*!x+XbdbjsuI zCV8AP7;OD#_9K)!S0eU zv;Wl9cG}~j1~+U@GkPf(l26BvPQ8nExT{~rjrvvIi)Y@x9LHaK3x7H&wvAiA0mEag zaCLN{px%XExlQ3#BQ@57hPo~pZnoR2WX@I|EqljP`qbTvV9rCK6qgFgJw+MsmM^O` zdSrxKp%#1A>_R{7pmK*sbcX$wY}rm8w{ZOWh%+)GK*{%0LL4nEl-1B6C7Eq~b34j7 zuLR2+MLF*kUXpo6MgKf#YfoVH}$p5;IZrTLe2M$4#*azy7A8kd0=#+-@Rg?wY)cc}F7j4Gi7!d;4 zhep~Nli2_b=b^T46`gE7+S=I%KL^68b4O}gl{`;!M=9B<$G*x|1O_@eC-*41g(P>G zoA$z{=~eQmnaxHRJzd1x2RrFcpnb1yXrrEcptlUz%O3Jo@`}mVO)+*I%4tusCy&5L zbt4{KUW9)3OBtiT6aK!HZbcv%4J&h{c(j9)<_QBSxA?sRF2BBI<+R+^m3=8oK^nNL zz0frES&`$I7>y(BU(nKfxni7@ROq&@M&goXoCb z{DofWw?fk(E-!95FPrzAFK)^8;L9(GCVXl0(*JYxNqL381YaB{^WSD-Exap(9yBF^WF<_Q{R3B-m`_y%HWGuQeK(p2*L|r z`UH=l^6mSH_W9!-3jwbz_>K{kJ7dxath^u{w?Fg+UN54ebK*V$QdSbLDLnRR@8q@x zeli9^A2&JY?YEac?=}7n$iyH$KUYrbD}5O}CljO6w3HpJ>!m}AN;#oZbi!L-&M9TN zFMK>Pc7xXhlzMXPgVTFWz{_vt`d~RP4zGNkJVpu(p6AaA897-V(pS^h@=G5;-!hO4da5~fi-nM;d z^PcnKmGcVk2I=#{$^B|-!$sGh1FZZ4e=Xp7dCtQKI+79er8$9k8S8TnZWN_+hAw#C1JKJeGe7pZrGes13DJXXn=NfR>n zN!fn@hL+|Zg1-+GK_-ZR3dnI?3wP*2%Ni-(^Z#sM6sfEP9AF!G6f*?>^WbDz6UUE{ zosuIa$gCK{Umc{a2FkOA&XB=JuH?>%+?}wq-G7mY|4nc*kN$rGdFfcjQ%}1g>-+pO z#&Zb%`@rk;{0gG^KhI$irusQFikzudyEX&%t|Ukl`JM=fzyvoAl9p}}9tt0sAe zel5Ovq0>d%(Zq5275nmEfqW@b%{C?fSp((Lx4(Z2{4K@3cfG2FpYpunZ-HN%xxX@q z9!vfqd0g}V6Nt_?ar+lfPk*1oA_heSMxN(+1ygxu#eLs%0zX&Id+aSH_~g8D>xkgR zCC5@$o+Ek<^NDiYe1(?Iia9sW;f3FJ9%`;Pn&j$n}A${{e$# zPvDeeZoYL+T=VX8^S0%M6K(p?;oTo7@Kbzp-M3FC$`KS?gXg@s1ibi_e#mw1xB2AR z5$JFsebQ(=J3nGTseJ3p?}_>Yr%r$`?Xu4?e&qHukZB@r$+e--qr$>jxmY}kxChrZ zIZ?+KpImFE94gCf^VqjtFP*;dleT$XDdMfe&9{ym8!h?pvq$5MJm)|?-*Ups7V=Wo1CevSxP04}^MXrw+v!GJS{8nPdK~QCJeIOv zIMFAcx&l&P@Ci-6?Mr##o2MT)-*YyfS11I1h=<6Z{K9S8Of_9Wt6@QmXl*IEwXu! z6}qIpQjq(D_)vDemCZ|^YzkgE9;m8ZqwK0vGO_G8X|w^<&wnBO za)(7aL523W7?BZTL!=01=RmFtBReNc5r-LAPSyjEFC+9uWQAA}CiySKcteZqP{~Um z%ot<@aXRHo1EGdE40;VDrHbH{94DE9CK$zA=Q6Un} zcn8P)EHHBLtTqc$oCfH`xKe2?MiVlFEO2S9>oimVSR>9)uhqM3#{Qb=cRC4kR&?)?pJUtd=l8{ak z245J9@UtOV7A=#`bJCE!LYcur#i2*%B8$ukmUSu^ z$*B6(un2!hr$(!VlczNr9g>4>h?fGvz6wy#Cr4V_LJX1Dg1aLgXF=L$&S*Jw4Mk4w!D+Nc9i2+>lwTshkL4s8Wm7-t+ zVFNz|PL%9Ms-i$)kiC(PeL*$|nP z&x{AZGEn45t;L8aIvtY3Bgm?JsiE|be^Jz#i~u9l!gDD*D36&Tc39cr&|p7A%V$ZH zwFt_sED)veM;x@5uEhs)!k`hoaP=Zu!DWJ8X!gpn^e-SD{oh`Vn6_^CIqgVdd*MzC zVnqI=u6&W9(jiB5U1ULM5%7*J=`tz$NLdj6@VbSvEOg3(eoy@2Gc5V;DD_&+;%X#P zZZajOiY!RO`X)M#LH-uvCf}vsJQqHwA7X_4eDTpp;@1G!-W0yx%Y?SOoEWk-xS$2Y>y ziVVt$pU8>J1x@Nqyfdi zL>A&CPm9Qy7rMJ)7_?!2qMs7w>S%}AKc%b$QFedaa#|kVe)L^DTG)-R-n#+!=Sr?L zjby7J{(hL*7rn>@$sEwXLHkD=q>KffCnIUF8VyMF6Fzz19JFW3DzjcW5RmffK&*OX z5jMT?9#o^B!s#C!gI>dWUEK)ziT&uMl&fH;4T+I2M>VY5twDN-1vW)*xzRRR%tqvJ z&aeqTZm41=;roUC7;(u5*jdMM;@pzWav@}$!YBSEQ^r$Bvqp~FI&tPbS7Xm_ z5;-3Ia8OoMirxtgAUYU)YJ2@s!Ssm4DFNj0TxmBlUUo9LP&at%pX{0++&oY!zT1#cEofO)Bdmm+2 zrA2zM1qRVUkyZZsTTROREsMa)SHD3fEh!nG&&;{NBD7MRa>54WU6D5nntZv1ed88`lBDn^hAi^hfF$o6W~3zKN{&tH^}q@H%{D|O-g(?=rO-GI*2 zOuR5P1|bRII4jkTFE&--tg|N}&r^XN#Tq>Phv{heVlOI8v_@_>Olj%(XkjQmIM9s; z&L4}}@fJ*;l7{52W^Cwk;_1a{h)M`X5+|_O=nzbav!SNC9wmlATsI>T=?T#|JKcz7 zJ8Li|Hv!G%WjNwCV0yeA-|j3$mn_6VV>WwwE~Z5pQCC}wqlPeCl;cETLL}}U7l>EC zDL`mW0&bj=jL_6boS&$}S6gb)FB2LSVARAB`0dn4@RIYW_~)(OAA2Em{er9)nZ#2rBU$^WlVdq zV17QPTHV-uqy>u>4o8Nz6}4fBcxfT~5gCMYvi$M+j&jVJIUbW74cK<57dPBG9gfX~ zD3GsOWYP@`!DrWvSCajmIW7*#(V-ZX7J&=KMdHw|BGd$@;LSzR2qvFTi_qcg8Vx?U zGzaf~e;BHSG<SxnlXPuA`DGU*k9C&%dee_vmB6pqby#x#1SA@J5SN*Zn}^x))~YgOXGcNJ zx?2y|W9gE~n3L#-Nuwj+K3b1riRL(g2B*Z~5}uRK05=rXB6aF0+%qf$p~*2gJI#vK z`>N3;U!jQs;lzI9(utT$Ig1~ifwNMa*h&5AOUcHY=VTx(Bmn0O55c;^8u~B;Mn#eu z&Yzru;X!7kQQj^}vElR0#}Ph!819}Fip=Z;oE@sh7n{owH98%Cn3aO))MQLGRN#mz z1Z~F;qbYeb-a9)SKddc5vrOi3akzJ8G6H%!u;M@^LMf|HkBLB7Y81{$v|#yxTJ+FZ zi^@i4B;e|CA!w*=!Lfb=PRomcpGA*z7U#pWdmj!r8FAN@%}K6+#nx{p?Ys?Gi~ za0m{?gBRpubetVI$?;g2qQ^JOYjD#Yb8&T&8J$`+rVLAgS=El?t$nz8$wW+#b7JO% zG=z56U|X{Vcbzj17me{lWkoZNR<+WB3dgz|hT|{q?T0o#9*><8i8Z@wam9s`Fe=P} zMH9lXb5#kl=TE|;v!h`ULmi!h2POs}DlQP!#B;-?({c2`VYmZ=@xY=HNTow~_V`3} zR8`}+E*x)MoQIS!E6$ygfUe309I2-ciIdL>YuKzjJTNK(L5UGqlIg(ef<~m}r{b~^ z0VphP#qO3)^mB5FAC`v8M};A%uMKY=?8c2}q#}UM(HYZI;V!Gek(ORuurME!ll?J! zQaq}*A4ipZ7SD+X)(|{#$#4KzK&QV9PYOmsd3B;V!K}3H9cd zX>mxP{I1al;hOwVbhWi1C^G>`eI3|S*^fJ}m;z%{847y>@#2DTtZXvi##zZoj)}tg zIYxZGtr3gQ7?1m=grl?1g_%xP_;PnC5{6~r`7_fH9vzIUCPu*OABy=C6LDs&8Q-(7 zJ>ijf=*(<{#f9U_EImG2S;c;{EsYkrBa?AOejo~qXn))~{O;UQO2XSQx#6hYTZG1} zvH0s$2V&9_k!SA4x^_KonU{`qeFv5uR^xY9q+-Tix)raO_YKR7h zjyEB8R3oo95jUE&*!EhiE~DPyB!CrUCPoG0TB^+@`6!xj`dJX&|V)5I_e)wS3F_@ww@wvn$Y?42Y9;rraAMFL5jS;z7c>J7nWJc@p ztZ0TN2+fdrBeI)olV zGd*A%OXU&>j=NRJWAm4f4RSpj_xUYW_M?2XJ^jYvoj&olj`0O zo{&NLt`}Ew$16J_Ii9oqP14>Xkopy)GV9g`YR8d5!r9Y{adNM?9n4PkW#tz; zd3;F&<0d6DD?65%URLh=^OwB6riAwjn<+k6#?x!7X|Af``Oo+A=T$`{O&G&i5yW2g z+5|?Qv_lWXvs$;~2&;CM^UAs!W98Sjx_a(;dK*1?DNK^`Upgn9zWNHDd~ZJ~3y$aN zWGSPubhZo~;eiCCNFf^EX`B5?$`g6gYaN5dhS+Ty5msjj(aixv3#aQrmF>&@7 z6L&tdg*LxfZq4&z@#cekzP*!6&mT{sNtCToMX8hwnuRrkoRcdO?e4+&C_l;?eR=Yt z1pfG!<^1Zk9n^$Ga+P!*Hy@2QE5?@$oJsM4gzDfaO=t|f?w%YM<-tQQuIK&w0Ip1E z<@P^spxEleLNTVODB||F_wvlO~=K zukPT@4|mZWn82;+t~~YL7Vi1$HmWVrT%H$T7>X(v6UL2Uf@>4MeQg7;EH+~UcSwR^bZ*{xVpQslZfmAm)z$B*{$ z$c9EPJu6ev`*7RBR1R*Cy1lfDH^i8CxAl`hdkP;ev~b;H8!1&8Fu5~u;1I7I=;YIt z1soxUr{?){i`;Yj%e(N-PUbv)swG9%yvqx!XliTavBd?(n<2APKOcO!iRV`LalQ<` z(@vhu3H{al_KU;R4+e70!dToi`m=bSF5)@r>e5@J9e(w)CQ#h(^e@r$43@TJJt?XPcVU&j!+ zF#*!#PMk6+8*6nD_r11`r#E$S*@+p1IeBnumN$<+yOzIKIWsRU6c^)ZgcZN2IFSQy z{_^2g?tOhLW$qFDJjaLaOT^e{Y2cl86;f>xBu@_x?LN#$g-yJ%@{s60n|SJ0UjASQ zZFFk}!KF*QQB_v4;UL zKD+JUzGv3ckUWvSFP+J$@v11Jc<$nO{_vvck5_k48!84!v^OpmZ-VLJo+s9^(Kn0J z*u%9??-645hBw_iCO(~(0wy7&Mw3ukd@oW3rTJO+E&CHkS{Sr!c;& zlE=R+#^xQtQC!r^xYR)0t^K&Vn@9=v z#>wi&BynorT)d3~&QbjNgkYXsTEOxuSFWBF$F%8LOJNsDGNH?W--Ki$WEpLCv^??sTsLPv8W5BzBzZPK@rS_`@I$wC&MoGLVY zxPDeFTbFO;q1RUNO0hq8%nYXlF~lPWv4qDl(MOVnr0__(jl2H7pPlVqTrw?+sTG)bnjqfHqY)@>~zJ~xp7KYxbW zYbl5fC09Iyot53jM61s$L=nY1)6#7fXINTI42q7Pel%dZ0r}B*D_#03N(QTnifT4A zcT?Tii?5#twL8SX>Pe*Zu_^ew4+$Mfr>_AztYqY*^M@;@@yodh_=xc6^-rc+n-lu1+>~mR3Pa4~JV^n3?BIf*5NPQ{wpT*~x5OQ^00pxp>*!Y`nO5 z2Pr2V&kLu>;Fg}s0;gs^*ewIC46Yw-Yv;HuGkv0<`lWuIsubi`K_9m^kZ#$vk_`I8I2h7++!PGR~#NB~-T!kRi%7#y@~FXXkLG z47hKuE}=mcsJ_loxH(a{w-~p$C=!B$@EL4oePAH7q}^8T7lqN@$&w>I9G9SrV+{`T zUwGXq{MT3S_9jp|hl}gzZ0V<|r;Tl*ICbrc;?_R;t*&@SNAUQs=5zb_2;)_RFZDdQ zu7fidW;4yTi^qyuM5cy2frdaYE-k0JsgFvb7i@7N@5EFZ*Of^bLPCH>(Cx^a%D>2hj$a1rA$wE=`9__rk zU&`;H%#cD@hlIT%qrC$pWrl(bpqrXS-rL&Qe5jMiI4_L#3G^XnMi5m88mSOjtS_%- zn+(FX>;z8p?Be|$ZDMqEv-DsGQxl}D2E%1@b)~1Fg=I(NdR-e!Yr64rau%a5o!|X@ z2G{3{aifo@qXUQ(#w;~rf3>r>ZU9%2h1=(fG4#mi6lerAZaU&oz>IPi+OA; zG4<^ntPz8*zJ<@K2AC@SPwOQGmtS48b4bK?01r1eilh%5=igOE#_cUQO6x@)pe1Cay4I8UE8R}?b`=Jg@f$ns5_OiZ6S9W$n+nq_mQC`dUEO+0muwT^l&(uZ{fv>Ri&rq1jg2MDFBx0-gQ2 z&CoY>EUxau!`jCdjiof$#r5}p$tm|-!ZXqrZK4ml`>a?!+(=3Z+lh|04%QXbfsZ#iX;F+%iRIz5 zQrNw*fb|{1bNj1c?ffE(t&O$(^p4lL;EP@!{K-s`<|Z+&tDRK`hxNzO;$CJZNV=W@ z_Ej_)b02DZTiK=Y(Ykx7?;4;z#E&yF0*Q!-<@e_%vvbt}w%de{$~(^w-|Ay!gHcY_ONiyf-#&H?Zk@W2G)MMhP7d1S#$e1V;X|Zkp1DVQe4)+kuEDG zmCYQgZ>6!di`@;qScGOsLOhRLJ&pSpr4b+^@6}h&2gUtNjE&~xSy8NCzFYc&zN6GQ zV$L)-x3jHG_%P7Pm+R{>WrUI=277d540kL_p{=@{O&X6!4IE{Ilzmre9d%9JjG384 zzUb;3Ps=2#sf;%&MGyA%v8z)0dwV}6jZGXVll``C8e}~25XUb`28cC>+@;g|c6RWoG}7f_wK|Cj z5NHu2qDq*zr;xkuTf(h>{*u=UM36kC5%lq*D6rqRdhyx08PcJuXg}CMZo z@s>1Bh?5vcW+PUEGiIUZ+|x(73_9<>zk!<{`hwrTxsB~DBAlw+efTpw)l-y`iCN+yZ{F97$>d_x!-!Qh@-8_j(3L}P?jq;xX&mp-z_lNg^U$To zQ@*PZkFnB&aPv6T2M)SB5x5vT$F3!i~UwCW@#TOQ(IXbJBp5Q=c7xx@rmU;zFODq(1sp{lkh)S z%2iXOJ4Un1YPlzbl!0-^V!^{kp*KkmVk69VI z4v2|q31&7IOF1=jYJe(a*VWaHKpzvmB@Ngj{0I*g{sj6kGt`;Q zCBj^FFbp{3VwOIj*0EH>EN$&B*R=0j2KqTv+r@!hySe>0pL64L8(4Bcj1%=x1!@R{ zMFx>2Mv9Yf0QuQ|w3PSZDZDa|#Q1TSw7Sx9;~`b3Ax0l_6E8fouU!TPS7T*jBW9Al zIKEQ9SJuFy6F5&i*-ZyqsHtz`;NE>B`eubV1_Olpx)19JUr#J0hnRKSXGG^t;LKcK zAtL=<46)|s4l*=WinPy|j9|S`5NuC;y$xZWCNFQyeX~$D!WUS7y@$!;B zW2Q#me@Wlf*k<;m#sDvM^AH{dD=qCW!Z$6C(liM_yAGDItl%)ed~7K<|7itp?iM=6 zt6R}EL2f*D*Q?yU&%zU@#mk`6!8!B7(A9iHa>XdF>!7Po^^wNb8R4Vs2l|MNlvcBJ zAehHa4dJ=hH(`m(5nbiUDN~@uhJ6HkP%S$+Nan<>f=3PGT1QF+Ike^+yJc zc_aq^wS9#TCNXw&Uss6r?&>y-hZUc0;1~BV0zX#4z zcC(bntoo_8jq-+S?*8o(u6nXeR@Twn)kS?}DRW|6U{+^$X5_|_=-SElJ}&~g>sVi6C2vv;r7JhHxXX*H7UYnW5zS?j zgZOAmC4;K9`knd7CG)s2$80QF{P~KtEboru2H{0!LImTT>$v8_!}x>+lBTgb4%g9P zb!FOk@pfJMS--7>xD&?Gv26z{wso;!b}TQvyMsgRgT%%JGCePfY~g)pZ7nNH#iEaf zcX!lLUD1H=*lezt7)j>XB;wo#$elZh)5Y`ss90a4sM6?S?|w7S-x$FyzuQ1{TQh41 zgSdY|8mVG+hqpCw&*l>GsNE#rR1##cOt-l5$?`%!~A zdEm@3q{Ro5Vr%2qtBYl9656U6L=h(>gt9Qzm%K3v*vg7|T;$Bz&!4%uVT7ecOaB<+ z>6bQAB1XYQ(^4ew1o8$dDH!snVdoZZ+U3HVKbgRRy@x3m9V(p&ui$Vl92dy?wY&Jj zErQ=qizOu|64#Ove!shpL9LtWP4OTk7DtwD_Gv|#k6QQBeqJ%p!6#>>}Akopn}$Wpgb^)Yx5&X%#I;;pn*r0 z9HQGTkOg_}ys@kTtCtuk3NeVnVj?&<&5QRAcQYZuoliEE<0a)9YwqK@Pj`}a{8UcQ z7vuT(6l%m+C~p@XInaws=5&@^5{iC|wPDK+o_MdA3vOD#1Togm%(w8=o0~b@?@Cg9 zh%xVGUrjfG$+0X-^kmb%a<+RXa8p79w?Dg|$O*{=wv_Rj@ZCM!!pt$@B;+R&H`L4L zJ1X%OXR)EGMh2;NN{8IIWPUCw>Cs#`K7dW)fIWI@BI^n&Y1LQVE`Hp6{&%?`>rT!8~+An&GvFw$^jkx)P!yL^hqejTknGdC?3VI?RT46XVkZ*tcUpi^V9v z;it!u8WY0L=SK+dj)=h{ywgeFP8Q~l^XC1(?_;S5?3F*A!?-9P=1z>Gx~77iRxf@s zErR%rSfZqT-rXwWg}X18PmgAEQ3(gTr9Uo=Bf-}n50S^W_O>!D*PrEEN~t|kN7I-r z9-JJ_IFVPs!5+F3bNSOL!F0Fx@!8fx9BS1vh^^scA=TGe>QIf7PpFI!JuKVSKu~%- zfiRG*lJ*4+n3*#sk-R7mV$*Y& zXf5QHH+QqA&x2bey#_;^mmSLC$_84L*K$u-XaL@Hu%WC=&et+y{uE|shI9FXWY+8~ zlRhlUwY!7eN4m%mnQS_6gx#GcP8b`=D{pV+fZ3l5rX`b{5F@hD!!KUgMVo5}6=5k% zX({Bv%?(r*)e<~^2A8M$Fndlq=I#dGlCkOZ>*kU!#(q*_Aa2#Ae9#obTh}M?!KVl4 zQU_UWnC}taE|yU5AR)m%#Q3;VFCJ@or&#j7CVXst=&Ly|DY&~>v@NY&c!|=^@N=TN zv5PAGWYR2Nd$DJd6 z{WikFd?YW83o}T2S3d)4c}hd-Bm8i;A!>St2=sKJrDuR4F|q>Oos4B75`w*q_%-|L zyCk_2{y|a)=YDoK^^+Lti>I}l11&mpd%%dvVjCEsN7IQV+uAF%jDcD585H_{UPL+% zu&2Xj%;IkCwc#(Gsa3oLT|Oc>$Rhl4qp3kUe2)madY9tK`uKR0L(tO#*WaC{egboMqG*mjh&c1y>Swa)it0q(M>dV_hOUs znDo7BfF~7AZS)K}(<$CVsL6Ra=8$>@qR`VKEO-t|nPrUrmDq|Vvy^g5ksQ4&q}Yhp$?)ln1*^t zo}FSu=o6?RX(Q=mUg9Y`TlZWp&Pq$c4sx>JqP@TI(y&sKpjBVuL~@ zZC4Kmnk93U6X9oKgufB5=dkee=zynRl(>5{F4Ucx*5O!E8tcVZ>Y-nzMVOr_6i-?w zUTbt>Cn;m6u6pX~PL}Z1wXdH&Ol-EG^?=Ht$fcj;<76?D z>}jK*wsZIqt&5u&=-#vmv#oMmtDgl+`tT5ubuVZ3SGLhBWp{o2 zTiQ^3Qqn`csBiA1vCS$IK&z5($)+>NeV z*U|}Mn2ZZC(b?HcaZ5J?>X`KR5s;F`E3*T+@BMxB%UE={s+}I;RiK}y?GeYo86T4y z1KR(@p>g)`AVa)3jSIH3O4{7ZgFxxi`g&5|2pP}l71FjYlGe|r@tfpWUlW?VMBjKy zzwBX8W3Lfg#a;S9oAg(UuQwUKE|iHJ)QYYN^zo!k`jb`oZnk)m8t6%TO9#cR{W!^e z`ZY?e7-}9;HgD%a(LXBllDD?CusJ@`mjKZ}rM2zD`AdBxd|br%S2-EsoAgCDX`_rF zljxxy{5+j$6oug`#%qxDvs%f^S@KE`_QqZM%udl&>L_a4sArok1N4yep98{ktH_*_ z7^vey+-Ys@;Bc$9$?#JMop|0QZKSb{Qi421|F+X=lk$jfSKVP1wz%VE=upu?&MqW~ zzVaUGrl8R#>OkXQxf)Nx44D$W6%=40)^|jo^@;v7xf-u#4gO2@{e*XM-fl8H*eI%N zqf0M{(f$?vp-$muqUG*IY;Y zF<6AIMcOP}#)|`GO>}8L85qPj&|-Wb($LmD9D_^8AGtx_9C$bn(WXyEg~#sRX3|9W zJN5RkTO1~{=qzVxlupsTKEh+0@VHZW93c*7wXO;-Z4|0sItuNo%0{XOM85PZC^wTB zlLOSMTQ^(mb@T%0E4? zm$dwPkCNB&8|9P(dp(T&HKFcHT1}&nH10yPU(+c~>3C;fG>^Aud*F1I@ZaC_A7wk1 z|5~1-?=0n5>t^SZrZ@7GWBs-BMfdG#^j_W9*D#^sls^WG?Pic?x9WI03GdgcO?EKN+ z(bw&H+RLGNYZ|-U8D-HMUXnq)mjcmvEbuE+B z*Ecqf`zHDE&^tS+)4+OKCM}lI8{KF1KE1~%yBzDjy*|cu*_Tsa!O{LPa$$6vY8mui zqpW&O>B_HBfB8L1Q-1ArJDR7a9igFhwAa@TrF$%|48F@|@Z63Ox(1ImjhxavmHtt_ zX<=4c&d8!dyzHMyka(>yedy*`>o>B%MI*WiWx z>b_AANu$4F+96Ik?VR%e@EBD&?6(|Gx8ltujMlCms1KYhy6Y+fL$(>NA|px zj_!+|^N)*X`EAGZ>D!-k&(hkj4(xVX`YV4%K6c(2JePBNe3aLMW982-FPfj755{%9 zCg+c)lYP4!*zXxVJ}F(h4BC(F_0ao_`UubEHakt7hvz2s?^gp%uYb?@aV*WR3=~gB z+$=FxEb{OBulRpFl;?H<(|uiSQNP#<7yjD?{QHJ_z;*57iA$c^iU0Q{@qY)pzJYj% z#)MjTos;7If14NmQeS-%CSJLrR2^{O|1z|H>#Ecmm+JqTp3|{I@dFquiXT@jA+7Vj zyENYi&Hsxq1Wp+BL-WefKEoK@-yQt;eqiUZgTFrx{3rE&ho1Yl;Jf=b`uM4{$Cz*O zo$+-VRO6uNd-?wfIsmtc*IL;&{21&15>)s*gb$5kwcC~OXsAWs*8BB4h+4^QLhIkr zhTjzbzjk8dsbKr?Bl>>_ln?gphlD;>ZNi@jDbcSMGurU=_HilN8{fodi4Fi@M?56+Fvzp(0|82Ex*R#v3smPW+*>3 z?1a89P~C5YLK(UCbzznIR!f`cYl-g)jo5CK;XBeAE$`hzPs6SJPx7vxtSc}6Cz<-X zMN>IYddBhv-w;}UjcxbO`tm=6%4wa9k%qJS{|COE!J>kp@4(a$7;xgGxf3{hyg#~H z=urXGG%C=>dpOzGO|R*({hUJ2+0%`_*PuTtouaFoNwX(%`>ZGtroQ1cc4#^~9Ytdk z5%W)A=<`chs0&{8OC#zv-ISzJo{?kC*Pf?wT@#Fg{hIyVs>1$$PtPk1ddJYP?~lH& zH0;;)emgydo#yB~j?$2G_I(k`DJRcj&m*&O*4doKyH}+vY5E6mu0N0;rNrLiB6Bsq$s_mAeE{MyT)*A0xE z)3gR1IsOVw`Df6P%}&Rj&Ys7=qGg;ONoSmsV@+efX5Y7`(R>tod~8{}db#ns)0q_{ zJnogvULJ)#?dWrM=>4PXG&(PP`eV<1C2u_*bzRRLTei{n+mA=5(M|WIJ)B)V_~RoN z@yoHgke$@SI6rbZ#l^gE3mGCH5pb+jMb>o%GXBD1NdoW!4| zc*tO&*X5jE)3gRg?z5*iPH7r@f3Y8r+@t&UG`*q=yntZG*0gG@n7p|AqRE7tY~;_K%(8pt5~CB)HSK8qW-q64 zEVOhm*2&m9dEU#P)t_F&$r=FiDE(3T!MNW}Z`8S?^hVB!b2eq(SU$gF4xu{VOt0BD zO`_=x+9UUtwC(xW(;4k%KR0r$oBf)7|6Aaj8!TEV8T|b`JxC8S<0TYA{QZau^dQd9j75b; z20$k#7vciU!*N;E3YFW;^3TiDWSnz0Dy&R}1W6ZWawSkF`{=p;L1V3t%wRK~8k59c zL7@{A96&~(33rPpX&SerTdr#-lE3%>FOu|Jmo$FpII6CXB603B{Jmb3fUBG2<3+qK zBW%#r@;Kq|?I9h{#c1FtUo$Db9=NHJvoqhQ?;t*&?owYb0(GLeC`0?o#k0me#XQYL2? zcQS>iK{{hw1`l1Mz|YNZ`CjeVue|1UKS+^ve*rUptn_P^9ort;z={#qNy;5DI{uGB%OIXpyj)ArcqLkH z;a#Z3OnQI`H|4F+a1&Cx&P$T;(=s?9t>G$d<%zp0FsY}mO{emhEZ5y+P;_oo0y*xIDDTSh8(!@`1Pmab#M!wx%ZOv;z5GlrK8AT<73wT=oTUGHkQN~Fq=t#;k-WG-f_y#Mv19}D?psE= zeyu0%l_2tysQpd*xyo&@=ty0gNZWYO#JjKGz@w9c#Bgb1#wpM6v3{m6y!AG@8?kR9 zrAn&nT!cp^>0_aRqAyi`^s6+XA1m#jXi@qjJQCh+Sh|x1zx{$boAh_lEB-Pz#b}Ls+mxgLFuERx@MBnQe7!++_7gTvFE){z36pgyz=)Hognf# zqN9WK>mxa5#C=n_QOM6%^pl2+z{Su{9x5-A&P4=LWjakipX%EX-Axz3i5{1{r z=5iMvz3w>X$4JMVmPB}e7uyasaK+^(a(22OiMc8Kc0oALy}OTy{3LFknM_n>EEmN& z@$n{6riReV0G5`(x%ol3di!zfCF7}Gzn9`xIQispoSPa*;^Z`b!SZBq-1|4=OvNg*1^^?XYRgsHkYKEC~xk>5);F<6QYP8AIC)JUe@bMfZD(! z*dZD5Jg^{>q>LoydDXF`*~9~9Ph?DtA7@Kldg|*q-0#h^S4|@~(u)(OBr!Q5nB>TC zu0L-K)ob@r6_vtUmu3?d?$7DRr${;<5@X`|^%?Q3`eHwAmO$=4e>_=oeo}S_hc{Jo z(pB^M)fiuFE`8Jv`SR$Qxg-nSSoa=GscBrD>cW=?ySd=ZY0QuJ;b*63vVP@$27-c_ z7U|BComF(}tp2V+W-pk)gR|lY4|nEJX&;v^$|XN3kh%F0?AcjCQdT^J4Yh2p>gK$Y zCbA$Sh*>j|Y1m#wUwAAxEl43PE{cou%zU`5i8&{X<;t;A$Gm9jHXkH)&Uh}*3=;mQ zlGWM3)(X+~`nj~oOVYSZ9$1)0XmBt$%?abPFH6XqHvZOXxiD>Nn(#1yF-ehJIwPK@%34Z#y}1AUabzb1aY0TfAMUE;wrdyBU$~$0K3`tA zejHmj7SpD)_Io_|%}uj7GuFhU$;o7U4zhN41rz5_HDbBsjEyCzvJ$U(Cvc`yIqM60 zxaQ^sgjO7Y3PiSEacU_R!%=- z0%xcAOZ_v5DLcX**I2nX-uPnb{ILP7+gwT9@ss%D@xeqV2Gew?0#oi7emyOQN}2+rS#rgAf+GC6bZQh~5n&vk8_W38&(6qV->L%QXCKE;lSKxLO+5Rn z3;Ru}bf z(h1{@I-h+?4jsFSsIf%yz`5gDm~9sOEP(lALI~+@q;kv@u5hp9i@iOZef9*Vdv>#_ zRGc|6j4df?{Qg9#qvUaVrZ-=#E8@5d7VzkC0r-hwdELwycJ8aB+v3O5*Gwl{43F6} zvzh8F`c&HXl<^TP*?O4pvAJBG>%*GeHB3EsCijjBB{e(yWBFk1VFE?JK6LUJ;$+~zYIYp^c9r3rl)>}oCKDYM%q7Rg zQnIIl!OU!)kut|5hR|2nNU5%~AOrq{38|c!6Ts$u{rv5r`Q-Y!bH=<3Tq-Kr?;62F z=VgG77SOMwkf-Y^H zy!`$;&i`{2uibMTxnf9MmhQp3>-Wnb-Ny|V=FzyTgsScq{V{dpL7u4z3NQMy!!%HP*<23{2wToSh%S<9}Jh8wEB_NOj}wcUJJ10#~k|7bVW9 zCyNr?dH9J{tS|RqMy!qJ|FVR|{n1=3LUGCyO$SN zcFKU1PpMeMcm8!d?{2NdPdtDu^`LvZ`F!~f{KESWjnG1kK3O^5hodncEiH;xof@u-AlgQH`1n6*u(FZ zRg;$%iK}Z8&s-YKvM+Y?-T@nrT%Jq$jyfhy3J0GsuFP;^U3n09ogU4G4Fx>$aSeCe zJeTYsH&XnpJonOe#GD!a>`$`r@ibAi{|FDixS5Rv^XLR0(#K9>Zg20hzos z-^(x<^=XBF)--O>&*K+^+yD4i;;OPqkdG6&E{Nm+p3}j_+YN$KGLB900ws7AQ z>*$QjAie7VS3Xt9DW_!_uVk{sU~4;E!rk|6B5Bc7+&6#81+Uj}=ebEzxJYh4IfiYU z3i#dIW&Glo3&{_5B_q(rvwvAfi+?sZPnALQZ)>^x&27~5d6F3!K(Ib3EZfhu@9yWR zEe*_`nnaY@MI1Y+=m=cJ0PQ~9N&J{FOfH^0bzv+oEv}RSR-6ejSUmlLm>t;8Z=NY+ z%E?nX-B!bcOAk>$6vS1F;-p!u^!3;X8kfUQQ(Sm^?S7VS@8yOorxMs!%x&)#^2X*; zdV(XFlMv2bSLN`@OY6ApwJnsm#qpQ(<9P3jU3_?WkZb0|5So<7WvSiV^THZlTvuUu zl*3-`2vnw=2YLO2jqLMC;P5M#@{@E;BhJp;MAod?!M#FzXRn3Ja>As7CT7OE@z4{i zSveRj3b=+}Jh_QFmq3n-4C3S)7La&oHxGS$7$1@OpHCFeR0G%z^s;+LEnVWc{P~kZ z=qeZk-5tF4<{B0^1aXcyZWgmQss66G%GHc8ciwq>6Z>6KxOJk92VPjsGpkCZtinej zXF$DLljx`zZz=zJe){x5uDNywX+te6Tep{|zu3nwHV^Xh4;s@u2Bp9H`+5`S?TSRWDXH}AF66!94nAIWkeaq3rpEb6ojtkYxKzsb z>=S*unwNIF@~bn_@OKf%FV>acKDm}{9iB{0jpmxOvngJ-o7-RBLV+$qsQpkpb$=f( z5&})4Kirv|?8o0f+s@Ow#W@%oNl0u8Q%%kM`u8jO=x`HjwpX*Yu$<5LHq&#skQ?4V zz$*nU%oQgy(9_A7I$|_|lGdo?{z=@vFoN~#3wY|&I&QsgE^{X)k>lLNBd@LJmE|RP z`f8XBqty((bHey+qWY`2U#>r~rjb);W)k7y!Gi1no_TvCZ;D|xFFjI5I=RWkna-Lf zF`(-BaM?a~l=l(l?IK3UL2mqGA&V{=M|5Zuw@>ot!z~B-Nc8JDXXcabB@UrJ6*dKP znK(5Ymu=<|(L;6OFb#IOaQu1GnbTLr!^;lSizehjoWi+);9 zTTB{RJ%_mJsl6;Zbqt6hwq^SPUXr@pxuKKaUYt!;Sr5l2`=G0{oj*;C&wZk_RSv%e zzS&&^gZOG}5*Hg^=;~v=ZS1SJ8jG=QFK=L|rH87nArb>U87JQ7^A}C!j699YqOT;J zsjLwXu)2-PmH`4hZA4E`#k#kG+J-(_%j;>;_y^(sW{cvr_ZvAr8j{GBqodXiETRpCATMmJ@HREu~ilPtxk5M0vT9)b6dNy30ms zSpzlQgCvH!QCHo->WUUZ)j2M;MqYuG+Y_ znC?DdjIo}9z}bb$>MmoEvig<|;bA>PoxPN_^@#GYiI4|!+bzfQ(3})f!aRv|8{&(d z;^m1_x-i?1PsHF*qlNHa|S>$=TGUK=`E=hIay**8oRqf@_ zKs;xhl}+`swRB}=a!R;`sS~q#WS$R?eRP0sH#ZKKR2mBm8tWXWHq+N4y@M>@S0fp9 zvGi~Y8bu;;Y8rWBOx}EY7Lm;ryj3M_q>ti7UNaY@QTt_)v|k?;)zWDvjA3G9HS3DH z7;0)`@u6N$&2*=^xkuze`d4coMGZ~tJ0kndT{P$-ck3CaF?Ki6Wk%VyE}us z%%Fo^_Bm(YKlP`cs$N~yUER-;_q)F$685tB+@;$NRQAA#1ggtZ*wcPb0u2VLN^ zL=kN4FqxW)t!J}IfkL3yl_>WQ&EJ2wuTK&FaOY6=a} z-`fYH5cc%Xhmf`1acv!sAGLJ9kyKnJy#xwd>LJsjZ+{#f$HB4V;h#6yzr$?FQ!OJY z8!AXA!@rzA_6wimISO`f!q>SFh_yL>JP`9F0+LaDb(FxxVKErXi0=n*wre%Ep#rZ; zmu^$k7MB!kt;x=m1QEYR<^wy<$i9+hRV~mtJe-*%e;)(Eb#uH5hlEC+ zK5W2cy>6V zC2FNkL#=McJ-wMr;G`by!~$s<+a+_*=8lAn4l3~3m$yk7NY|&&ndpobIa}*3n?8N; z1CM*l-U(-!&;*Ej{V4r{fLyM%x+C>FHIai|BV=08iU*%zGz(X56ee%8@|HrdYGuRe zG_%|y9Psi%S@EuSo2e-2N^HDNV+VYHxtI)N<8m3gK&c`MWD3KIggUwA$L@V}Rb7mAcC( zi9NDSF+~a$ESdG)zYxH7PVu7H<1Ty?J0tC%pM=#N%WyFqBfAZpIGwTi#Yf&MhIui@ zZujH6DCnFO`R5UdOHN4(8|xE#1_HrhA9cv5Z{(J-)bZ437i`V%;NlggZ5hR@aLE|C ze)O;rfT*c{(%>gcc;-`Dcwf)w^LJ+3pV?L8FIOD@nN^Eki0BUXesp6Ck>7q#p}EoSd9m zhQ-cPrG}kkyt&Yun%q@D)iDTto;kUL6l~djMcOY*!POdweWjl+sTtUEuI8Wwy+0c@ zUowr&3hy)G0*gQzn(tgq^pZRYs&e}7N50adnE*ki3Fu&a{E>On-sZC!49~3&s@80g zzCSZdSXJB6)^=%NPlD`*v%aDaQ6a~XK7T1*;3Vn_Qfnib@L%o8_(YqdWjB__s(6V$ zxsqZB{!EVCk0PkL*nN{Vrc+{>CEL>{WnkLxmQDTHpfwYKmuEQy@0d7+C;j%7Q8tl( zCwTY6aQHp~q(z(kRde?STcNtVBeSdwIp+oHT=j59AbblJAL+N9MxUB3E+0YX!Y)M_U{BJEO%a#8Q9~Vib*#Szxja~dti7?h zZ;Uxw2+L>D@l)$e09akVr!G|w>zpsO1z~mjW-ey)bXBk8&NlsZjp0e^JP$zyvgsOs#QL&0(X9@Y}vlQg7nGTy$uK_{TIR& z98qke%I{}q6rer)wt>d^2u|K?k4J#ymFP zfN7t$F%&$ZaY@n#--h35H&kboaO7?Cw_)#E!V#IRNJ`29akZf}{{i0YAtGM#u0AFX zw}{P)Ht_;kQ{GH3#xjK7$IwFt78NCOgUZ_L}G0LMAa-JiU)s^ zHfcC1g%6p_`nY(*58r9Fx3hj|Sw$6@qkh>iyvQ6(Ocfbtb;SL?$;W*f9YtAw8(wvO zRJw<$y{SJn;-?8Tze=bD_rD~q*OqqYL!$Y=gh_K;tac`@p1(xf=IV^j_}S0IQcX(a zch&^yKcYkbU5N3)PMB?vTlS9yTsvx#Mgy8c{W#yR|wzbdfHfz2>)#OUb5(-VzaNn zd?SmYK0{g?5DiU1Zhgzlme9BFLM`rn;)a!6sy+TaxAmo&tYSl!5_iNdxFzV)?y;Y& zwp_+KN)qgnAXvo)DLw*k1N5;TJutg15~k%ycplx}{Jp|T z7&oE$pDUeGAO^-YWUGZJ>AW((#;{r;J$r1;$)9}H;3>NNr8&a6{E#ls7^jz+opCI# zXoo&TMR(cuFrgUGnl zf=8R>zuLx68+!m!Gee!y@cuYr8S`3fFS2I1OU@Xi%|&W=FrvG$&Bd{{AuJT>;PitP z#?;UAYtb>S+b>mY^d^8A*9((am2w`B>0*GCIDT&|s`Iw0Xaq-P6zOQw*A< z8SMl1XL|}#Vnvw}P$wf%Xf$5swj#|?^A=rg94WysZPL{dcX}dvR5k< z({}xzwfC5&C&h)ekq3sl<2M*=dpTWa<^h?U{Uv$P-NXgoJWF75D??RLV>5_rJ-y93 zsQ+Xsp3@LFg`(S151(N_HY!593`7GvgwP{ht}%2raW{oizT2YErnOkvAP<}PDHq39 zb{I6@HT*5FNX=?zu(>1O{u>n{{eWd=(QoWvyLIvSM(1n%>pF|2_g-QM!)ZSo!vmY& zPnaHbk4=Qr-DAdg?&nUn*9oU5Di+pUZ&fA87Vfe5BYY;+K**?{k19)`wDW_s)MeW& z75{~1?%$Teko)wVW>-7@^qrX@$hlE3SbSdzWj6?b{$A*g-}N`+6=fCP zps}H=gHe0gzCYGQB5bj`#eFzpqVYQgYyFQl--o*wmX#w=I|&p4)Y8YC^F^_Pyo*kd zdeVVNFt=uVSd-|6ME9?VkWU-!jd`fAmzXAseiiu4Yq&&8$KR<(iPzI`mL^GbNj?El zx))1>c(yfy&5E&qs0{_#W;S1qv_wbTf`cPCl9KqaQplxms{C*l?!JFH?2d8i(}}&J zpK$p_%rPVZ6S_Y%!f7!zA>^aW82ubGS%e0+J2Z>F8=ML|V&a(xSFk zpV{ayb)ox0$(1xqH>jqr66Ilp34c~uvFaSRd!)wiqelapP%P?bjLavuv^bE#%*>S% z?C^ChiE>dMHkNV6j4@%@cwS`HqKiGS+@Y2uNgcWW1L&x!Q6jU8mBt1Sx zL7||fgDaqd-)PTl3~-}XA(Er1Prh0j5JZq(CMK`0U*3KC!fS_VPE$|U?^)w}#1xr7 z04?|W6g?S3KN}Et<8$&e2JLfQWvpx?@06-x3=e1e2|;l}LVVBeUpC%_=D1UOH*7#V z05?6)tWP0&B7B=hr9Qs&Y8So1d9=(VHXJ18Gp%k>9OBg9!+kZQFa=u7542iu%l)^^ z)xtm<_en6!d{mIvyU?Z5v&BnWg$hx&+0h=&`cs}(+sd+AVbs_YLk0%9v1S-OeeBJ_ z9<6ktrS#Ni`yX07eM!s4cKScQ6=^bn3Y)KbbTbc?zwH;RaYiU8StzShl=t}qpce#^ z6;Uf0oMVizSZ(1Fjv94x;c!hUTn$8wnzG3-TObNO19c9!8he1gw&G!$x?LFZ@(%d` zu9}cz)PX)L!XlBixbXdhL)lGoc&uK24SYV897UP=)eA50dFkHoOngp(zOnYBVOPGn z=|hVCv4q>@R+D`xJg{XxE(%McEGOHpSI zpXhpD)gRm(A&!u_C;qn`)oyS_F-R%SPIREML@m=E-{ zm<#$!;<>5Uixxj3VuaboqtM!Ht(dX()A-U+An(It;vt#dW?z^Vh+=vG%*uh?Yy8wd zNCh4JdHHfQ4fTf;U~t_b16ES%0E=IrF!zmX|9rJyrBL1d*o0zP>1i#3a zNwZr|O;~O&OQ*{i&DWyePVa%of3F!)K@x`JU;&*kpNl!X^wN)ej9ghjVJpqnSIXWU zzAf(l#FQHjSpw8SJh>ISy~reLiSSE*yO1@zzHaOJJlGwvtqknBw4tV16Xn$}s?XZt z2T8-W(&nr}3!lZ7)s((UkkZq8);3lpK7DcA(AFR7hO;iPCMxU;b5ac@!RV@w=ZzoM zYofy^aK&b}=U!R`K$=~ZM{YnZjS(0gDbq{z&+^wY-@^IZl;Q0d&Mjm*#d0edf5#yW zwDLfU49Tl=v1q*8GZ%lHftp9htOx0*rnE+NoaEWFNtN|}yuVV;Zg06oa`HN=KV4U7 zq5aJg54zJl@6AY?m?S8UOG)p+oknE$Rh8N}^|b)OqU@xMZEa18<|^&KyPi$GqcsUv zPK)d1cCxW7M1($++1pw1aPUnBdGKj&)1&*9wd58(l1Ph1iPoT-KyMCyJE@RX+4l4f zMvWxM$GUpfS!Ga6cKi)Z$r7&0#grQf#w`wA(kcQVN-M)MGpv4MY@P1lL?|QCPj5!R zw;_8uYx9W3zwn99MR}Q=+GN!wWSE2oD+9XGH{wNYVq=X$TY}!`J%E58#A4&9lpJDk z3eyf7N4E!oIJHQVu_m3-tGZFdhZ?lB+@5f>Qg(u8Y8{W0S}&H z;t`aJcn^w+SF5utRK8+gje{`Q^-0F@Fe?5ilfG8-muYxv2EO_+!yL?!Eja-Dgu zv9}!Qyuj-CAPg+GO`9v;^-lzp(KXGg>M(!WfH&CEGEt@>d_x z*n0-e!;8t8tH`&BkQ|8-vLY@C^L5U7A~cQ}bCeY>-jNdrnEd>O&lm>k8W^~Ydv@5F z&dcp0fZq;uMU#__gX3ga0!l^IxrV!6A@!*_5f#>yV{E<)sPzqdQ!JB>8~mfSsr&&s zfM+3OqYOye(f2sJM8o<+AO+o|(UXYlpzWow{YOQ=k-XCZmevt79j z4%nH?g!KW_F*4y%ZFJ0F#ejdr}xH|J>Zk`dHB439}!47AIqW(avH=`4wPEW%O046DH13!pjw z?d%N)7RFoq6|Rk|PEbC>B-<|ve~QJc&?6VNi#X&QBC3yf1oceD$MTlsWVBHNot$gh zYta0**@(8l_H>f%exP%5_e0BrZ9hUN<27DRRG6{da;wiWy+NE3BpQfLwKPAHGx9?P zdHcpQa*^fc?63}eau%p0yoY`zTHw1@Vt3R(xJniSotbBTLjE$nvA`OdB*bB$oD|h= z+oT+QNiDVOWGE++?O+jqk_Uz`=l0u9gkScXotevO@O94MKZ~qihcEJSOoy$cIIPgv z>l%t#II`<`_oKK&KCk)3Wz1NZ3<3{IXMaB&QT$LVuYQSkC&v}dD71%_s!ZDaG;TWlrxO0r@~d{WoApbBLttt zhq_Cm*Xyh9z+V#8s?IG*N4+uXUy=zdinTqb9Le&FSLJ`D3axYgyE%q8ix+bQ;6(J$ zCniC^OD7T%t@!r{#UDvsF)2u+bIV}P$WlqCsyASK>kyF=MU1O__X z@?aR-+iaEjIMVpsWIk1`^~D`7Kn4tYW_LVYjRgTL8=os&O?))MjC~QkTBp`#*~_}g zC@eFvfU?=aYcz%}O}Wqc@GvEOy3kg&0b}vY}%wXBOKfk8xLK$;+bJJWu=M8$%uaWG>{5_k#G?jH>PPx ze>RLaUS!%hFQ38|mNgs&!LzK0>3|^v2r-LVE4xPTwMM83PDJ zW&rSeFW$*0M{Q*oNrOJ4#L>;dbdG@1FoKS8R?<@!j(tls!jT^<>aGoKsp*Ow3qC?^ zONR7ISv99gV0+p@`ne^sNj{0xzK1w1Hn^g;6@@u)1XR!KrHL?|>|n=f z{Px0}A~$>PGAFYx&4H@>pA`9rruMymu5ZM3R=j^+K~42aBG8Wl!lV|pq&I{M^$a-C zOR8qAAmA!ax+82#ld)piM-%*@ldno)L-{!I;7$`MA(cF*i)*|r(Hd<3lT|o^__|op zXB!v(A1YxQ_s7iktj{w_kM@5-LjaH~2K{kl|AUx=Xb^#1Zl^P=l(&NaCiO-u$CBlY^Mk7^ zmXWNf%`CKO>D*q)!Vz8@>jw@r&v~ZfC$JdoQnI{cuxEF%zQ@BRWyjgql10arb+9Q9bwbVJqXQ+v2s1_TG|#KQ;SulOf+RZ-RlB`EF%CtA@3C&ZKF8Hj5i`_Kfua}&e{91gI3~yTx1$dH@Q?8Z_-->j?;w^$3XE-4<&>m(V zu_;(=r>wOt*{QE4DYM5dj7gv%MrP)yv$12}mOX0Z{!s9^^Tmc}_aHZA(?Cq*yLW+? zX_C_HaB+Q7tby9lAMYnG6i?d}j8u_Jj~4^>#puCDDb>?hfD*c^;cEIw-SX< zkJULsBMQsc2n8>T#CmDK&yhJQ19HX6wstrh#HrayY)kaGffvn~6 zsZY^tbsZJ*vL|JrqOLI!Yo<|UG|TOVsAWzD=c4OQ+82-1{l)Z4!8d<6P9!L}Gl-XX z5e~5vUCOmQqn``EW%^glW+w&zrQ08500Qq$IsH{Q5ZwUXS8S?5!L`=(7u(-!v=H6Z zvQiDJA;)mf`djhCuAul%rD*?Zuz;rfVTJ%~ZcuhYC}TCy5t--7HQ7@C7yH;jKuYf` z-0Ndau*_ZW>v{tJ?qCcTkuG`dzT4Y26U+zZ+<^N}m#wZC8RBVdZ9{-w?K6}g~J^TGN83t(^{{ls^eazZS7 zkV}*TyT8|3HwKk5w;ij6%9QpV3Z9srd9yxx9Cnp`6$+^mWu0k}&d9ww2A@dG5MNom zNOyFhCCQd$mKFMM%H)zqRZB`dEPsZS*q1!;jduFK74f!oc53>QRFid5b6@`&_^p<~ z+SBzKalnLPpP<|o_QD}PC>--oxb=xi&7Mk45U41ovJfHUeSY$F_6Ye*kniARtsw6+ zH~#FQrlgpKFPXp-@jX65)NX}DW#qt;R9w5C*WvajDIa8LY)+~Yih$r*4YC5Tp<5QD z87&I>D^G26@2CHMQ@PjwqUI4+KG?c!P1;fHHMC%}cRg$AY+ltiHFx6ePZLAtp5abh zaD+yGKUgCI@DaUzF5tfLRM*ky5sX8PcI~O&Eg0r`=D1tB!ds!Xj$V(4B0u`Q9cGIN zuuF~*rvp5knDplX=N-wawSZTFH9jQ*3li`}jn|6xGneSHaTkEkhgium$$U;kM*HoE zc`$_vrNqV?1jw$JPi^MFkvAXFs4C{adz6_WA(Z25WpO{O$?l8?6(^5>AD1DQ^z_vZYB$b2&1Dli`o8H<*gxY2rhlOM?iGc7?`vxIXag%b%2puf46?P2zU055#lg8}#)6L2B{cj?2L1Q%vIJg86`~1K;5{qIJFX zW^e+L8Ei>AMWoD7iqgu%^J~=b&Qc8E)VSO{jON-jkhd;9LhfQUTPZ7KTr6lGP?1E#EBO1phRl1=CaiVwf7Uvi>GSb zR05~9jt^w|><(|}>X4J+bnv!bo-3lq!8L`c`FnGkPv**}upP05hRFV8pb!fXwS=|46d1@D zK*|YONm@}mAcJ4N$jmIyy5A*mS)=kzL?YB-1UxLyfde%!nxJFKvkY}pe+8Yoj}rNL zx*y9S=GC(`d;E=d?$OHC)-saS%NKQS5S{D|BAF^RP=Xig~{C(vtJD8L&$Z}tvqy)>iz8zxAp8LWSY+0Q4Au`oa zJiltOkYC<#*2=qM(f`P!Ck9?vi=&R*scDa9k@N>CEfS|2UtS6@JS@ z#6igYz{l9Kf0U+x`vPkl&qQRva*n-<;@v015-IZ*{LrVqFNk%@fWo) zQAz+zeg=!?NF8<(E2{zm-sD-U5k*@YyZ>Q!3wEmrr6)}euJ?zx7)>SA%h-Jq;|gqq zYoDoIg6w)_5!(+7y>P`VTgA6vjCE(5EgrHl{{@)q%DMt&O)Fvg6zh5Rbc3D0ReR8 zQ$(*h=3aSCT>{T-Vq+AktuHw{B>|;51~=U;8Wy|#US(}D^4PvqFhmj-Ue4rn#l-Hp zbzs-V0GGO9aQ<@Brq|K=J{#$fMuf@Wu+I~Hv~EC59{rj|>oIZ2=}%Wk);B{*FkmP$ z1-3Hf78C7`+36XzMzptR!{it&Q&LS}TuiyWO%<`gh-pID(uNG6p)jlrLXFlws_By> z-b<}&ivRqCJnwFGX0+A;AeXd1j&(7|G>NUN_A} zvdWapnJu>X*?-MICksRs98rtcjA=-wLIp&AqWa$2N=#kGe0@@7S43n~?6gX`{|pgv zzx9F)knlkUodWsY>Ycmys-cRNsL`s1n(-hS>rAOi(6y!hNuT7zBMNH}h}y~YJ?rfY z(_T_L3zmu^O2P#Ac({*0KzLWwFk8}+5D7Csm!MpDd3s$^-kpv)mp?c0w;sm>0;hoD zb=IOYBVN*rAnSqUEMF$Ji&#X zgDBrg)LLfUM2J+7=RCLA&%^f=gLtbRFJg||HBswyd~;E!nHXtzGyfJT&~UsmP@_1X zA?R16k%2(x0(E%_Lfv$K9X5sse|UN6>(?tgVRO@s@l;}*No6eqNb!CA@Q_%3GL8h? zFAPH;{aqj9@03b+R%x3;2%$ZYknRfgZcD@@vZ^TdNlFdvta(=RGsPA?Su$I2pMA;u zz7b^?8vdf3;uF0jC)m7N{Yf|^m6)AX^??>bPRafI%xR-OHeYQ=IzZ;+i9DH}qu!F{ zgFK%H&&s6asM*zaFM-&8{U9#~A>LRIu9##O+8y3>9vt1#WAB*@E{ry(ErR9@qd4wtk-(JV%fSiuTO)XZU+{hv0bC2DjKiTNN!L)y@ zgM)D|omb-v#?w8+yrw4j1kpgVsw$)Pk71X& zU(z?(6lqv_e=9(Iy&M(hFH=#7i)L~Ag}TxdLp|jQ#^ei23sVxRD62#~1nEHtPTSY& zzCy&yd%L~ngYS@AF?Dq-Y}*= zy)^UZ&*lrrt~KG2ln)8H;Rj^lN4Ft$d3?nje{8H7cO-Q*Oz%rMOXe;El>(RQsYh-s z*|QZLDng`Zv580sq`VbB@a1Gm_qRSLX`6WMk4g3Hs7ZW+)pBOk7BWtoISM)rQ_m5d5!WHQQ>rK--|8ejeB zx8~N5S{&8W?ZqN%S1DgliTd09&VeO8BSh(J1vd>@WLUolDEhS`VQVV^egn6C2dweDA zVsMiMpyel^E!FjjX6xbIkIi)t-x(Lur2Kv45vIYEYy3h9=H<6LiJ6n-mh@PpL}Nr; zi7^1e!9tMJY{gg6``WajCsKbA=7ilsev4qVnyT?^+x@}>hsN51&Zv)d16y;mGH%se ze7Qo&ICc5_wChnoWRm8mXd+UAi%B>7K4^DY?+2-nc<{xTWv0Aq z!{Gk;Xf->z!dW2aF^_Kup)CCvIs0BTy}GBTZ%I0>t-IPO(b&4>ULq?zv@hwM`x%4j zX+;FL{pLulD3@lIpfc`XibVQ>X}#&5`-r2l2xxvwRgV3-!&)mtYIO7$W#v2L^?l^+ zw=$5;CvGYnNq$C=VAi(CWrJ1dJiAJT--i&IpH7`9la(iC#zUVe&TX)lo%W8Q#m+xu zFjZRQcGD_++l$}nI^$0oq$zk7in(w~YS%ry!}ABPdHSM;_0v8K*Yk6rBQ8xl?7Rtdx;qAtH@h<7^!mO5A?Tr-EVz$@X z-!0fP_H)sPwdf;yH4Ka$eIjqyJ{bTJ&_W<#h+p;&uFi+?4GdNI+6nXW>oQAGK+X;c z1ljhicBi-7D-n5~vLVjT^+*d2>_y|NK*OvYfP*}PrqZX~^`br0Bct*lc~xXUcD$6T zGlK&f52-WSPRt2iBJSy1#EfdGy(#*ilYkx)oO!+}FjggR6^QI$xN#P&q5`C*Jv&rc8OjbE!3MAhPEK&7&y zru~iDko+(OONZ4Zkhs|bout${*YOudCwtif3sTcgEf z(x+DHlHwyQFpGW0#AeBBrS?3>HB>*BiFx|Vaz&1@U<_zamUau^xXSPb^?CRfW3cec^;D+ z`-W~b-A9wvnjtXtWvG-ZG5SxP8aq%@2ZOchl?^s z*EKuoiDm+Fv<=m->@_sLxxpsI8Sf=fq7fJX;y|}+$XT|={W`MT_CF{C(2`ndb{6Kk z0RYn8jSfx(RBz-iC=#yeIXL919U5|&Ax9+q_v^qmM>;9Jh`DqVMVDTZlDGE zw3-f`W}iTv2}mz9u{UDc!A@uQQ8#l!x1*JDvBDOUKG zwBU_Vmk>c#nt1PoPU&P{rOnl!Ox31hSBt1DMc$-#H7De`gnh|RG{<8 z?TS~_`ewhFB>;Os*;K`d8Kbi?r978?A8a^D>luJ&jz-pgb@%?3HIDPp{i@a${ewyWOme&_`JF0`M_zehwVbwXIyT*6YOG{xU4#sU0n&LujYlE`wil7S(z9&qD};?ccWh=P?_|4 zJ)UdVS8tAv{Fl&Xbt!6&lY`TBJOr7u|g4+c~bXP(!Cs~;b^kdXjVnq!s2Ku!;U!RqP zH4jIF2HS|;PEjMa*81KF5)*rBnw`{WB##MLlUi?&d){je0WZy-PMtn1@=oPD5y)(; z%M5?*w0#u!zd7a2q62J&3X8F2iN(fkc)wh~7?>0*?ZH@vbuXNpipm?(?=*~G(<}eO)6Rftp7A3PdgzsLtU?W|l z8HoquV2HNlK+eBf^lN!tFBfss#qL2k@-G!ey^Q-QRStO+vp8bc&ILDwXGR0b5c{_d zcbn_K_=dvLxEw`Mo=94tdkw;W3+JX7ZF%t^r!yU=pX7JI*5aYP)zj&CaNAhg%tA;J zQM-LeNMnSfs26PL3+0-;Uw{5Y=9@szxv z5=XMHKgcsGc~h(_y|si;84Kfa&BcOayeM#!m93D=kqWpw{CSnSJ#IgpODt>&MojMM zgEETYQ*)muVCQd7)aC2OT>kj%wOz=~(Tu#TwZatS&KSb^uJPIxI)nIFavQZVAGQS~tREsUQID;{MQcTx^m z$YRZ?4=4p}43-iAD7$-sA*S$N7weV64IL33LKtx?;&PpGR1tPM@ zkCeI&wKn7DgW=~fU7IdP)dozCO28NwXSBux+z!|sKF`6J8_#wqU5|g`EHrUMTYr{# z+dc;sMvsFviOz+YecRQpV|dsSpE>(UmEB?+}qSxX83Nr!M$U|O0hDg#A7n06WX9?%>v zyCM89LNn{%(^n2c#6rDFhc*9s)KFgg?Q?>rpCy|yU%?8Hq$|DL{ejINcz>&w(rx!a zoP?*7$)DIh^n;w`lVbGI*s^lK%sc7~z+Ar2+8CkxBnOQcx3Ih{8Z)b8t#JMon1eu(m3etY7g3>OF6Ug@st zcTOu#P6@dvE(0`E(@VThQ?H2JKX5lsKSkN7SsUs19glgL_QCVkHU3GW_0j#w+dV;z zrXDq&fM;tmy3p$y+RtV2H)HU}!ca%hsUr!Ey6~^F8yiw2Rsy~Z65D%EO%b%9D$g69 zn!(ZB{dL6t){CO9nker8jEq?I*+Uux@tVR}SyvmLyW79z<7i!hGPitaH3enKOw*_S zB9-m>Ge8$zAqrAEqwfe0&R0XQ>{iD3&2e4#nl9;RW|hCo*5d6ir^qSlH<6s!pX#{` zg=!dT@&;r?S7*Nw@S>;A*W|UwL^{xCJqj)9XvOgGB!UR~r{?FzHk-(H�Im;GS{a z&}-F3yqlHklL+5upZTTrDJWBvfa^NWt|P*ZxTgjO;2S)P`=(kS-`SRV6Iz|;4~%Bt z9(#}I_;}h{;`xcdCpBVBi7xf~Um4k}-gxJ&3Qb9tGpy-nGBNyg=>dVV7aMuOBs;we z8i)ccp;92Ne|}Cmq@wDwD)wZ#q&61+hBXja#4=D6S{`?Tw4}YP>c|-!|4c6@ldazV z1$loH7O*7NU9D+d)oO1K<|RV)Xj~z*voUESjwvAjBqIfr53AUlt>q1cAx8IKc^9_h zk@0rwb%o7{VxjB9i(kZz9T)0r%B{PB3n7tA?zkRPR0!XK2$73o*8BG8T%tTH&~9$p zTguXG%42THnO_Xpd}~!=Z{&W*QY%kvHw!|i_o-S}5SG~G{}nZa{CG8j9IA%~!N=$}W`C{9EBAitvnN{YLh7F0 z-HsYPN*jxe_dMQ~5#REbqbdY2+V(MXhKszhK|Y6?1=Tlnu0v5#c8jI8gKxMY3j@yb ztvu)Q>>=}K&E7sLfA8LfWSzq+r1{BMRy7l$y}8#UaqlZllq zO45(gjkR<$?`um^5<`Kmy-yDiIrJH%h{zPAdyqqHl-&aX;yI!kNanB!8O!brZ|02aMXgd7) z<{D5&{Z!Bx4#uYr+Bz6T|LiecT+R&2SZeEvhwnLHk6bN1A?`U{9!w!KU#fNXv=RSs zb`!(0p+f7tH}ch#OgBT?;cqRdIk=L{;J(G3V`;s&yzO{Oqwj2>#vNDR^Y5nMznlaa zm|~7P9)(3OnA}>I04A7uc!|M*FOwNh6fLXSl}CW?7FBa(S0JBNu@-Ta4o~)m^RLmpH=vP@Y;?OE z#G7|*YpuDwXJH$z|7+~nLYO)3>fQv|IJd#<^;Qh#bE=`tN;(={=$NnI*HX$<8l`cY zaZm6@Lqo4EmpDJEn--g5-f+R`Fd1S9rO9ikPCeUWy$%O;dXK`59NS$#wABV!a#V^_ z_D%O3^aNxcj*EjQ4dTxlZdn&;WyDFxd?-IAT;NO2 zcTA~Vm(*@M^e8pZP@t3w@NeK*DQPsVQ2d2h(E|NcSi;y=Y@W3PHJrS}+78rE6xGzIL0nC#K%2P$vq0_- zcc?7=kL00)Uv`B}Z9EpqR}3@uF{UM*_*0z6^WfKQ%FgiOJbIHPq%66-R@mhSye^F<&#I-`rV;^|z|5&mwFb zzpuZr$9I2+ncKng|3v4bW2Iq{Rj>-uv|8m-17!SGG%xGP_wLN?~-{t4|s4B>l|F^oZyc)M#`MB^kZQpuB2!-_+u#tmnEdc!06Kwh%l zJuOxn4rgvbR+zuu!AMDJ=|H5!Cg^C)-$Tw8N02y1;bJ=d9G0V!`#x*Nx*(AX1cw>t~KkiX3C=!h8I6EJ3agxVmWn^2wN`fY|SrQ&`7Rl>)WAsP3}b1 zsx>7PmJz{&#cDjz{&rMMn4+g$d8prj6$REk*^p9IR=Xkx0bx1nB3OQ$dA@22{V!HJ z2;Xj&LeW@CgW@RCYOrkQ+$y`W16fJvTn`}tE;whxXX@j{wSGnFoR_QfUO6FCxUt2Y z>DLq5On;FrwuAaL{RH4hq7JRNbJvWDzm1SpJKA1^gn60djJI4m5751cQi!wpHAoBs zFrQxMC+w7^cd*GugQ@bdR*%$lE+q$IvxB4dkLcXyd8a{KBh0kM$v%&}q67ktiM7WC z`a-NX0}aA-JX5<#jV;7W@^2w@qNilvdKSTM?a{J>wY`<;k4qm$0IUU_@2`_#wnQ{7 zlrHjW1X#0>qhI-)^f{t}P4anA^Llozdiy=i$MCQ<5cf^{Er~q|E0B^|NArOPAqb0{ zQOxZn+RV1zEz{Lx+>qUtxI=bNW>0R?`nf?V_DnWIX0X_84nGy#Y@)+)g(*rIN(x~jDp{WH;!=xg+gI3wS9#!7k(xQ7^tsV9-9QWZslm$0$Bawz_Y7AY1`JQ zK-^-^FZKXx=h;>8`aE_-p63{V_RM}0GXab@MWe60E7xPFXD@kC74V36wrM$Ayk_Ru z%PyuMjVG8-FH7tzPEw?+a9cm%niNPMI|K3JfAZhzClRdK*}9^St+X(iyGg!sm*iNScaqBRbeX&D~Q*% zvEw5EM#%In*LAJ|>Bo8Y0m7m?1(SJ&6^v^XHpjf8r$y(J9sOi!dtKJVTgJV*HyH2* zVxNa@m^2aO?Bb;h4iTf1!dJ6%Md&0zb|=iHi6YVWi8;rY%%9Pp#qFW-o^qvkg1H}K zxH>?iiNfdc`TO1@<;rU=ICEh#$Kc9-$tN;{M1nJlM58+|^oqpIi0%`kNvj-QD1M>ItU#@a&j$khvAcwE2pU(P{mBdemj_ z)iv5taCPzL%CQgQRdEmwk@V-k|1?`9J;s0ew|>E+|ECf2=10Z<|6Q^eVcpyR*Mt6a z2>zn=e}n!7QizZuME&m=bpFeNuwEml|C#Qs@xT5_$nrn4y*2-UI(Jtpt$>USceH<%=^U z^9&NQZgzE>;6U8$d$IU=bU+1u|7+JhAXui{J<;h4w^}rQ%vc3Lr&EyO^*|yT-mf+v zYvBZigKFpGilI5q58^0u`zrGN#Of=tcyDFXn>4(+$wL8%i{`+cVE%Ox^ZNhnzs!9{ zMxnpf&93UN)C*r*7iG%DTZ5Jr!e`U$Iv43=`OJt z)?6h7fqu=IHGJ)(!G>%DtYZgV4JrTKs{bS+b+&bzG=RoTqo1BG|J}k)k?TtNYK_JVYsL8{+S@b40S|7i!hg>{s&vxc6k<${ zj?Y2mo$zb=|7OYblGCra}7RmniLH-x$h)^EmN#S82DiV3e9zHO9 zD)@9OksIn7el;_PQ3)yEv1@X>ZotcZ!o`${^j%yy<2~t>Iw($4fiJ-gd!Yc^^z5yE_Tq=> zHLkwuPP@YTBH&)C%&aBZcKl7{sqJ6L0nU4?Q(`KPe<2vR9#^LWbT$`&-p$>fFriic zvj^47ML_&3*>|-*X{{M}4WHd6O)cudg3I-szx)D}gYG9VAHR~S)?ALvyyQfu#% zl<&X8_D0yOau0IbTuBYB?TWAgkDExS75y< z>A0s&u-G|v*(6ZcLYkds)|*d%NyO;PF(m5diXL(%dV5&yNg5K}6c<4PPbu%sTfkh_n(eFiGQ$B`G%OrBba2EP^G$*b0p5g(eI@cP9tvvxM7<3pjd?8WX85pgDwpYveC~&lnQ?6 zf|cA(iv}81JCe)K^!{iP{CH_iFvTa|?3d&9A;R#z=MDU)n+%Zk%Au^a+k<0M<}0@x zu{+C$woUQt!<%4slVb9ylcmp;Ei~LfI*0Qdn5SN^l1es~%ST8UjhL8`QNbbJ%tguv z=z(!QEgpGtMlc0Wv7O8sUVij~8+hHhUKIE;Cq%OqnWfcuPw7kum;e@v6CPr;jlb1O zi^w53yPQ%l`8aC=Z8fg=yAlI-Av`0~!{~NiPNihkC?>ukT6dwkk`d;_vc$ypIRHb=AQ?I^gFV3ta(b+=QeL74mB5TquL9u z;P7{RH_k*sj8ji(JC~Sr7g&{OlP-E_X{n?OXM@3{DCH|ef?}$!P(hSVRT}wv9_8Oc z<-3Oc+|9-%&h^kYnsBP`=y#DB2?D!nD&!=(U!g|YK?8D=5d0|DL3N7`K<|%I(^2iT zd8Pmb^XMP2109iR(wcpKWwx&aiuj7WMmqrmoKLqvg$ZlrG+jXBq}QeLDun*47zxh& z1XBuFbtmvI@i9T^STrGghlf~P7Xz{~Xgy6);IV~L`itVd>FGG9w(n*T!gyQ3%sh_( z?__r`&*{5WSV-A8XM++q_jzh=!ZsagIi$OJ4_Y{SXoF>s{ik}&&Q^bkPXo7(jc1W9 zW0FCJG{1^xnF!$vvW)$o9HxeKFGR*Jrxr4WtV^s-0h3d<7Ta;V3R!QKK83|~xJD}I zV#7yVH{e{C)1poYwR|r<-ya(={6w9&Z6^@b{08{61;=6r5f5sqC#G!exph5HnuspcTPwVGG&Yz}VwANTr^Re?zJyJj?4Ekg+h{c{@NLaqCU4e- zKhTSzbG%ymm7(8!i&L&)6!P-MiCb>}6&FwD=>G||wjWjK*CGPM;rFO **Note**: If your school uses Active Directory, [use Windows Imaging and Configuration Designer](set-up-students-pcs-to-join-domain.md) to configure your PCs to join the domain. You can only use the **Set up School PCs** app to set up PCs that are not connected to your traditional domain. +> **Note**: If your school uses Active Directory, use Windows Imaging and Configuration Designer to configure your PCs to join the domain. You can only use the **Set up School PCs** app to set up PCs that are not connected to your traditional domain. ## Prerequisites for IT diff --git a/education/windows/use-set-up-school-pcs-app.md b/education/windows/use-set-up-school-pcs-app.md index 2e0fd6199b..97d233a07f 100644 --- a/education/windows/use-set-up-school-pcs-app.md +++ b/education/windows/use-set-up-school-pcs-app.md @@ -113,9 +113,9 @@ The setup file on your USB drive is named SetupSchoolPCs.ppkg, which is a provis ![Do you trust this package?](images/trust-package.png) -6. Read and accept the Microsoft Software License Terms. Your last step is to sign in. Use your Azure AD or Office 365 account and password. +6. Read and accept the Microsoft Software License Terms. - ![Sign in](images/signinprov.jpg) + ![Sign in](images/license-terms.png) 7. Select **Use Express settings**. From 41eb775b23528cb1feaaee1fb1021f60f729917f Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 26 May 2016 09:16:31 -0700 Subject: [PATCH 424/439] tweak h1s --- education/windows/TOC.md | 2 +- education/windows/index.md | 2 +- education/windows/set-up-school-pcs-technical.md | 2 +- education/windows/use-set-up-school-pcs-app.md | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/education/windows/TOC.md b/education/windows/TOC.md index 56f2f7ffd2..9e07262fa7 100644 --- a/education/windows/TOC.md +++ b/education/windows/TOC.md @@ -1,7 +1,7 @@ # [Windows 10 for education](index.md) ## [Change history for Windows 10 for Education](change-history-edu.md) ## [Use the Set up School PCs app (Preview)](use-set-up-school-pcs-app.md) -## [Set up School PCs app technical reference (Preview)](set-up-school-pcs-technical.md) +## [Technical reference for the Set up School PCs app (Preview)](set-up-school-pcs-technical.md) ## [Take tests in Windows 10 (Preview)](take-tests-in-windows-10.md) ### [Set up Take a Test on a single PC (Preview)](take-a-test-single-pc.md) ### [Set up Take a Test on multiple PCs (Preview)](take-a-test-multiple-pcs.md) diff --git a/education/windows/index.md b/education/windows/index.md index ee04b99e62..26974a5cdc 100644 --- a/education/windows/index.md +++ b/education/windows/index.md @@ -17,7 +17,7 @@ author: jdeckerMS |Topic |Description | |------|------------| | [Use the Set up School PCs app (Preview)](use-set-up-school-pcs-app.md) | Learn how the Set up School PCs app works and how to use it. | -| [Set up School PCs app technical reference (Preview)](set-up-school-pcs-technical.md) | See the changes that the Set up School PCs app makes to a PC. | +| [Technical reference for the Set up School PCs app (Preview)](set-up-school-pcs-technical.md) | See the changes that the Set up School PCs app makes to a PC. | | [Take tests in Windows 10](take-tests-in-windows-10.md) | Learn how to configure and use the **Take a Test** app in Windows 10 | | [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) | Learn how to deploy Windows 10 in classrooms; integrate the school environment with Microsoft Office 365, Active Directory Domain Services (AD DS), and Microsoft Azure Active Directory (Azure AD); and deploy Windows 10 and your apps to new devices or upgrade existing devices to Windows 10. | | [Chromebook migration guide](chromebook-migration-guide.md) | Learn how to migrate a Google Chromebook-based learning environment to a Windows 10-based learning environment. | diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index 43aee04cbe..515f82d2d3 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -8,7 +8,7 @@ ms.sitesec: library author: jdeckerMS --- -# Technical reference for the Set up School PCs app +# Technical reference for the Set up School PCs app (Preview) **Applies to:** - Windows 10 Insider Preview diff --git a/education/windows/use-set-up-school-pcs-app.md b/education/windows/use-set-up-school-pcs-app.md index 97d233a07f..a9120b1881 100644 --- a/education/windows/use-set-up-school-pcs-app.md +++ b/education/windows/use-set-up-school-pcs-app.md @@ -8,7 +8,7 @@ ms.sitesec: library author: jdeckerMS --- -# Use the Set up School PCs app +# Use the Set up School PCs app (Preview) **Applies to:** - Windows 10 Insider Preview From 6229c6b8e6d00fc2aace09c96fac6be9b1fcfccf Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 26 May 2016 09:28:34 -0700 Subject: [PATCH 425/439] bug# 7669633 --- windows/manage/images/settings-table.png | Bin 70908 -> 53302 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/manage/images/settings-table.png b/windows/manage/images/settings-table.png index 527d92d9b23c3efbd4c6d9083b60c520191b738d..2acf11d281deb136db05e093d42f839aa648364b 100644 GIT binary patch literal 53302 zcmc$`1yqz>7dAXJl1dNVCFOv0cL@lnAQI{zgD`YRH%iI?f=V|iBGTR9AcAzav@|G4 z{x@LoKJmWK^L_un{cjY1<~= zTukl73mVr1CDt*Ejyv}4js*63^LKH?j<=4FCXV;%6t0s1e?Fx!rd>Pzu32oA1f2Hn zxm5)>yfFb<$ko<joX(f!=48lgX;T&Eh?F?2IEELQ zxWS{ku=Y^_+?mWSo3SEfXS-i}gt`Hy6=RR{^59*59(W~P+SIdsRy8$~n&U@HBu7<} zN4xjqBy>mYs);W;q0@Px3+@vMh8F4}Y*Sue?zo}d97jvTzgApGeQ53d=8p|-9}>G$aL2edB!sTqE5{F%tSJcg77-8 z0taNd6@7l)gR0l~jjq#2)f4L+k1=q$-{8VY80X*2e!TRlG{8MeZ7Ye=9P1N0{_=@E zy*R`mmoP+|7e7l_J(p(o!0HZEQ?}_+SXG~&Ywe!jCh_r|%}bBUT(RVZZ>=jf2#1h@ z^UWgr>||**G)nhPx0rkG2+hA~E_YZ{dDc3&#LAuPeG5w+&jw3Ma8c~dHM`;hxbRY+ zJK0l3W<%)U1KFNNhN9V`cZhFVUZVaT?j%%)i*DM`!BDlq)x*G8eujzfoz<2d)En*w zP0n{-9{0jntJJ)33XqtV$K!vo32>;ok{hdWu|>6er^k77U9#mSU=2^@-rqtN-5pfkYwGoHyvw!v@v-HJ z2dAgJHX)~?T*s&jHxz*n!ywP82o$>KH`QSceA5mE>zHCY=~u3VPpnStA;g~5UZ!Y8KN-Nb@$+G_;LneEFt zXrPg88fqAnaD>7-lVqV*IVcptVGGiV0%a0!+ng&iFmE5wd3HOX9M&rx#m(n4QEz^d zE@7JXl%>MAq~m&>#${p$yaf7e% zF{UDuG2yV!7uW86#$$n@mRMCim}1+ruSj`HO-&Wv@Fb9bxCFidlkfH_Z_=ct!w+pG zwm(8_kS@v(p;X$SNWlx610^p_aX8sB8V3k|8mrx*qV?k!zzo-nYUV$<|9 zW045P)|@Tk@a}EVTzV=$txFUTfOMXMAm zExuw=4pm*BIrVnEW_)uN65mW=E*S41`Z4UY%%iBSQg|YlhXB}#n(Fv_H*|rpV+fz> z(@l-IkrExtAn6um(JDbYa@+4#LZP3vp`C#$oh(e#U|b)UwhOI-qCM>>xRvrpX=u)k zij~y3W2Vx`xbkhmsQn6fCnfCQB;bn;??LbypJ_2rj*$zqSilEXH-GKt^S z(`+MXVoFRm=QT_Q9tO>`FG$1H(VQTuGKG=$X@=^;k(gw|Wd^R3B z$t58TC0i$9YD_04+E(Iale;A^r=i&KVmb5;Td4>EQ3bUUYvd7eeZIq!(4vqY^Btp- zUKV~1NPY@oCasE}VR`F?R;Q*F&(ueE3s;t$yx@t@mtPcxg6>?kaqhxrCH`33-ghmL z&>B%rQm0we%04pq=t85WM${8w1Z7dHWKsJUF^wQD_X`?A213Io=~qm%6AW1I$>IAd ze!eW46(;9RpfI-wtURcaPaCWJZUizOx5_n@it3%q>dDz5Kr8^WdQNohQwiq1*zjSe zA*O;J9?uU)GZ>D^k~44l1D%VxSH%o523V9}lHT#nWaVzxpBy-MEHhE&qv2pzwD!ES z)f@E1KV({za-dEP1pE}A%246nv&T9V6hBG(pJdr0hSR3pVd6hI?5$M7zhVARBgw!8tzoW1X3W4wY-bCgY9@ zTP3bwo5f)~vr5JHS#?Hx4(}vb)b);djTE^V8p>!>cSdJcA-Fl@?HaBjD*pC7^Ruyh zH4h|qrxDaZoDxya*hoek?gt<4#Y$MzVjg=OLoe+$&8MwCqe#QfirDTBl{s)a9=CoJ zs=0w!d9o`6F1n6BXigJx7P+n+v3KQ_rnpy9a(b`7gM zyzm(^|?F~E|IMw2Sp zi`g59pqXkHbs;d4vxza?tUq+CotkBVDP&-beS41|vXWP)skcC)e&btKS8l@g?yidB zFymrRhUta4*J}q#>Quv6(1TPuDF0UXSoy1a$Pg_|<9moW?r({g#rC?@ykD_{_ z-m&nZybSdh{Z#2vwyjUDMto^U$|V|y?t{OuLfC1>eIe3D!chO+_7&eiZMGvfAV%YV-%B-A&Llc5i*?~XfDGGt7-_+P-A?q|1^eN$R_)QD_ z`%mJ)_v{3EodY^yWvL2*(z-xk1SW}UbIj=YXQED1a|{Sb;p`)Kl$)Nzqh^lS+5FlBLti|{Lvt&esxCY;yI zZ{K({`_4D<)!v$-b=d9q?yT7`|10O7F1O-t%F@)q_bp-nq@s}EsmXf3-VStb2wpw# z$ldMokneq^191j>pM%Ow?f6{XrjhU8d@&ZStVll&Y6y8&Z2UB|Dfj*nv9y3J6?#;L zLZS4%&4dUB9tF%-=y`mWmV@~Wj&_u7(W_nuyS93-UcX+v=zZyNwh_Z4^@mZH&>}BI zV2s|lmIlR@gK!VdUNyQt^0Kr%Yon*_GjUXmW4QdmM3OuW%n~FC<4|)y@nXV%rdhrvrmMqCGouQ5L+7Fi=wLt5-7v(oMQuz z(%rz`sdqGu3np|(#_R~Vo)q9u2TW=rB*uI6-My=?dv9uQKrHWI4@*jbwhZjHKlvh_ z{8QeWWsj1Y<1XLK%~zik1JMi(Wca$U&CacwbQ3ujg#Ozd@L>Me`Fp7N@d}FcA$WnR zSP#?cX>7RX?Quivo=QY_-c!!RSe{$9obG%~lkwFLe@z|EVIks~YH{!0^b8?6PFsyv zMfT;a6kcuT!>NO)*&9hs_fQToZxg8ttTJM!)nn8{%>iG0?#>3q*7bbHcz>J?%#ORe zfmWa4{f0H46r2;%ULWHUg7>|Wf*aEC6!3+rxOank*PAsR*EDX>y&TtdwQ~FZF8)oH zy@hMiNKfUrXRFU#CZbm@Lz}JitNmE=VS~Q;?U(!u3}vu>Po}Keyy*80UdQtqy`?`X zBq#s~m1a`16C@?Q5I%*wwol;FEb$bP=K8i<>RYp61}`}YHQ{cTOWw`h9)B%lN5%6d zN3zzgah`>g4v)}m%Gz2!q6^#Lya8v)FGG^|3JAQ%b!fbOK@pe8JSV5PAh26xWCE-r#@BWSvEuxz^!mEwbGmRmvgwb#5!jdXZ3U0E#Hx*lC@SSP>N8Hl{5j9=K*&(OpACoJ1m39Nli9hU!{wyyot z8I+E`SHSeRl3knzC6(fb#~80xU2KI`?RT$L?g+f$tlHF*(Y$f!oL1`Y66?dmP85}P zDSC~e;yV~XPQ^yjSjNvjShUJtpUc&>co-36zH@>|dzzJ-+DWfTysI}>%=1S{f^Z|$ zJ-@Deor^ho#Ax+`I&?fyc+>XFUTjAm&!SiA`aRQ?0Vbv^U!D&v_%dD*p+woGEs0Ay z1AmnZf*zeU_#?07I>RPH1bLkepeF8|{V>>vF;Xx{ zqLq=3ualU-6N55Y^57MJXq4y>3ORT|1q0oaXS<5o@ct+Vq%&;%NR@xeVyb(g1-^v0 z8)jv9v6=Xwt*9f!OVZe(xX82Y=xg}p+M{~Sr&v}ksRMn2>Ya;s-o3EbuZ%R|es5DXRsVOsWCHIcM}?6n<6OW4X2(R-?-Xy z@7=r9;H0JTgjbRR)j8Xv-!|`y7--J-Z%dYDIj>wEyS!DyF*ZaIGFITaA9UtQ&(})g zyy8C3@s5yo{&Yxbcb%onSM>^zQFz{IIa@tiru1Lqyd-3VL+~6X>lYE2p4wx4ymmGb zE(jU?AZn#@=Yx(S{`OcQEAv<4;>9a(23uZQxV#-l!pn*>_YOYbC&lWz^NCY;8h>_> zK>*%Q??Kr5bFy@jSV`DK;2UHFQ8*@@EY;)A2uE)&rMYIO>kcvZMG<~}EK;pn;_uhg z)tEn9FH0eGM&G#{OCMR>8t6OR)V=Y=@5@uNXVr8xlqI6ypPs!``Wi#|&;9YlTGfNR z+e9B4@xXq}Tac7Yms*QT0rW6rdn0=6`?jnvkqjCB_8s}#mg%aY8D!uR3yyIj=}dh5 zWk8yw%aAg!apJRK`3myp%NW2(Wz5X31Z>TlRC7?0hvKCb{z1^cq?_YuW)h zY5Es$RpM2&xxPmtk_iRMIVfpG6E_ejGsUoy;9KZX=D!eHqxsQxwZrr#c6cdS@oj-Ax?( zxuws=bFE!k6Qr_fQy&r-(dxBNm{^64U@-;7iaD+53~#a4huju;w)}FZ?CZrJFbP0B z5M!pwTCkq&o7+%!S`+2WfQj}OFJ9n|`IWxUeB&W?J>@F#vl}M}#SI}LSb0$J zc5SXkXoT@QympMD)Y9{049?dld++BM{q3z@thM6(`dXt$TIsJJtSv5rJtC)gmnvm} zKy;%TDV*fFrH`z=y9IzAb|c>6WmR$)H?=?@*7B)6l%T+CEvg%fzh)hRP;aT^J*;ul z?0MC2`6=nPZl9NstC}(Syx7@Lwj2;knNYNccp}htu7nO!ym@Y zzU05EBY$`l2R?E;1TODIu9L8^}}y&E+BimhmPBnEyS zcea!wJ#G+7l3IkU4%Vv+@v$xL${i@8ot9lF5tr`U#mxsLiC?CkRZF{uU*WK~>!s+I zpa^moxez#u$k3ting7UyM&S~>r$gn}8Ssd8aQ0Fs>)R{2_6-XyQFxfAv8|aI@ngwl z_BV8vkIWvb>9=hV8xj)}vw4+i>3uuwQ7{z2_dry9A)HU*db`I=hPyCv7dYxXD9>x6AR6bZbSwj!VSDxM#6O0tZa#@FwTCaCDHj9*q0S&;Zr{PVX! z+*n@;4hbW@aiF`is{1u%@mj`wNi1F4kgI5E=1#dpwT1Db(TkmHiybX`%Q1aodjIiw zSN9gtBh88Vc`&riaLUr@9igO6nw;1+WMA*vAb~7CPGGYfw^-#F3-h44ZEe~r%;537 z=%hpUec9DixT9e*(wn@0>bqyNU(XeZhi!@IL**z?8R^wz6t#+d8kjncWCdd1-@f5C zbXWf7sCbXN%jcNP4~;q_OTsUIp+f}PJBSQ z6+PD%^jNvuG9uwd1TLyT_K}I@y+!{|hUpS(A5HZ^cQHp<#RjC&F&T_IO~j~XVZzr- z$ax_%K|~^EBG^1ikNJGLZ=w%%B|T1XZrIZJcnfgN+_D$SEfa%Yj9F#(w~l-c2J-S= z@6YDE>c<+O7dX0Hs z5WZxBsB#Fg%c?Bgg&UJBk&03~GAAra9CbL~9yr-P29MYY^jjMUP~f#)l0);z=AJ_M zaACvLf#l}1vdMc6cTqwXHm>)l?q*;`@b@Q%*##h%zOMfafG{7vauRS3t-W5q2>pY8 zl$0mwxw*cBrXpCq;C!6h`{u|7q&@jVG!c~w9?xzbS34@CuOFKx23CSH29~tufkQZE zc9_mwpWR^B`{D0vypqr{Kg0O&5^8@Q<`I7fvia_yrYhn@=X*6k%4OQsu9G!P8$|71 zKuy}BG!jCHXZjV4neq#DIXqGchi^r*0O$>TR-UoOd7_K-HNkSWu(&Wqajw1s5FYE^ zWciKzZFzB@KYNvy?u3RNny#2p{d%o(9Vort8O>m1n}t*!pbjn|v0>AHV;aU__29|R zW9Bq22K@dsvTm0zlm@n%LI_?n+G#nD`DD$0N7_GFh~bNnb3r-Uf1Ejsr{QYKw#3kY zv;9OI9C1)GVHIj1NY{BvTwKXRK9a7waB~CajJ*JY^tiRCV|7oL+`{Ct!xZIP?c+T? z{Cmty^gvorMgoqQ(S0hg>Bh!y*66;5n?N3_X{?ts>U{RZz}c)-^C`2mS()|oSghwn zb(Z;!sb}wTTwg8KQdQ5ciEaHjwENIbB4%u_K$Zqs7~(GK*^2;iyZ2fUbn~_KTcOhJ z_r$hsGbY>Lnh;M725KFg9952q1IRC1)Y5{3^xwP7otnm!Ljkjv7j3<3Y1=|ZOFJUr z14g_?rFX>@aqQ|KzhO|8N$hxykD(~1@l1UHcJ&*yP7Y93ved}ksqb1?b+qkbck2dZ zH61|ETVw#G0UX)@&4aow0fg)Q|1ey43qbktQV&(>imd%uUid^5W`Dk@!R*3nZgz;d z$g?HY>K%Y}*W_*n+e((;Bx1I2mL;1cxdL6PtEJ0jzLA!@*C$LD4nrU={IWynS_1j8 zd(FZ_^Fy1%FEqD25B4DDNb9H(Ji1BieyJgnI9X zbso_QKn!vg3z@hlC0wK4%TFuv%%4ig;Wp)dujz12T|NF_O7`y1jwZR|tiZOyQl3=2 zS3%WM)L?e)F@fBfV@AHBJ;AknW`4mivz(gOjA+swIs;?_&zL@QIV1}PW+dV{e!k>= zO97M161~LGl;O;=flPyM;{G3^^OC=a&PV!AqjN0Z(=<|5HRU7~0A?#mMbW<2S2som zM(>zSgaOGxvdmR~^nvLL6gXiBo(uPol0Nz`C-2_*2hsQ_Kc4KVm(Avd;9(2KVhA^} zb-W&uj=|N?x?!W~!tFw~H_3U&>tX?AT~M!4c76oB=0g>6rp0xvhZg5oGac~igRnz3 zyI?WFH9Dl%%2GvzapJ3o9yW(vsRcV}a*a2$KxfIMPw2QI0wuXJr>8sr8?P=@dNPM? zg~$?JToPZ6ZCI6fJEgyswE1rN~9+>sk{ zgmx%~r+7IO58!5g#@UjRN6v0;p9Tkw`#odMa7aak!{h%79%Y}I^YinQS72E`y=JgK ze(4CKS!yD|Uyu^z9K-YElyqS2iS+Og+NmBQYqj2AX(=<^3b)~9KiXSmj_$%{KgZad z<_dT(1iycpiG44M8$3c6?9jI?At7z?k&=h>{zwJZ+ig=^Gd}oOr0?1IRhBtwV^ytoZM>)G)%u6~7!o(WPK1qb z&ISu4MVUcUwr}<`2CwewNJyV!;Y>TEISrTS@d`E%$B4Uw*5{0JBA^E6x zeDcu^iLd?%8uMuaHy#$&+OaOEAE8RpNR<1vhwNh?L*8snCw(F}caM@jKO-i(sEPL?=L@G3

      cNE!A%>**xVsXVedYTbOLdGE@E7cSMhFA*nTXX3C*>;{<4iJ=?fFi^%p zp(phK=>hGAl8CBzHU$q+W8`ka3efs>Ir2bX(GxoGQ9W!#MR_48dAfB~1I^x}Sc(;S z(JlrmO&-{i3E`5@L z>3f_h^el12$dk+L%i`$E@%eAtc^(;VrsF~xVpR9v8Qip%y5K2u;pv(NYDgeA_6W5M z`v|GSdA}Xd{-7$AkZ;pr00mKB!@rUho|{v0&)4}1!B;bzRNZ@2;wZj*XaZbOyM1W& zFR$U>iG7GI88ZJ-3yYJSPwpkRr#97NW?}To;wZ_GJ!FnuS-M4;mh0*(Opqmq!mr4BmxZ9oRIgMvT~)U;Fy~8I>e&&aTO$Mu9jSP7Xa_{yAeKgjAF9yg$V3KVN=VV~I&@n@Anq~5iJ-|Z!>ryY2^pZ|R3D|7 ztWRztuQ*}D0-8l#FTx@DZH#_q%CStJfdc(iBq|gOm27CLrtTkcF`75YqW|KV=*>7J z43zuyWPmUqq;L81!|+oE#JvCK^MUWqvS!>7Im+5a!4lz9CcKn({v{B zK9<}f2tje7c3IqB&b4?~TjCw@+3qGx>@8z;B`-F8PhjA^IGm^QP6@`hoUOig%#oId z@y1q>hlT4sMq@C*RiywR%|<|$^c6fk)BYK1+CXC-}M zlZz_d6wgW1--z7YNOufi;Cck@IrUOm4AW+c9DT~VOFK7W2cK}D5y@r$WU*hwW z4@Kt)pEc}b-|3_^4S+FM1_^neG9qU*_}`vLO*6Asqie7n(6Vz?f6(&M6cG4kQY-IM zM>3L9DU!ukLvF6FEy-+Pl-<>nk6YGYx%~Jz#VshclxKXci0%dsz?%zJb1Oo?Yc<>Z zs}k2<yO?QeEWhx zJa_zP;d@7`VXl%mDs}+mPPl@fe42DdcAM`ddr+ltL*|Oje96F`lRB9!ksHCo{Z;J} zVM#``NzaRN?U|>Kk4Ej_?^o#tELYq!ohCQPhcCaXeWK`b2kLij*!TEa;15*Nr_2OP z4N%7woNRJ{wAtDGRSmH}!tEPt}mP4o=3$4c8W0LbDOo2kGb1Tp>YAdxP}G zX#60E*%TyBr|uoz?VcSbv%sG3IC-Jb*KnzEmc#`Gm(W!B$n^Gnvs4mq#qHZtcaB}( zKQlg_%zBR|bl;jzJZfutsQ6j+r~VzO+nu^bUx$$SwIP;uxT@Li&i6JqDMQz$s!+}n zMeSh~0CMEWzzb-m8G<2~hrNe&*|n$`uN7Ror_P2-WJzW%8rzf@n!i3-CJKhzm<6ih z2z2+TgsDWOh=4eSJL>>V6b(|$o4_Fz-mr{43FuS6q?5*(?H#NH9)s6!OAW4f^u`p# zd}ga)Wo6YkvPsEb-p>lDu%p~#bR3}TkkU8$s$$u@;}vr8?0`90_0Mj?KUW=QnyG+k z!QF@6t6@=b1DcFx!M_)=)F_LOy7|$glfF9E4@67N#-j`6+gt*X4QDU{dDcL~^@p7b zL$W|>HS0f1FRr;g^M$i+Ks}_nC79Fmm7DXcz0U2-Zu^n8r?Zw42?jm;qlx3iZynx# z+|P6{yU*p+wzR@l&&xiwF&5O?W?@n@V&x4Fr%JZG)%jzmsH$e2MEauuMZ9fPT-v%Umi*BhqF-2FHTI zD)$v9taU&(E--TIE>qoNuf7uqCWcGD7=Vh3EJ{fk%xqvn7|sv$B^Xo}x+qwEZev+f zNMq`sl1BFX5@DY0@@2Pds~@|3VOfF{+>1FH=7eHis8gt)ILlDSozQ8JWOZ37-;Hvg}obH^ewW;zS zJLj*s`+~}3=)kE3^*1D#f6Vaz0#^_4CMW#-&ot(YpI@8%`0-=FYW>Llp8lGoUsT>t z&SuJq{|_w7Z;t<2B@aX}-Pq4+DKGEIau9YL-aSZ2Nh)z$u*b# zf#QPNBHZ=UBRwcz-&VB}J`7=de4;g2e8BkPU}@w_JNMy+{3t|(qFTas=5zm7-ULI# z?qm6><`2Vfl@#ywUpf9&rZ{i^K(}0dp1_?FVsQ1wNj;bM&9keziJ?sltc6AAmCf@ z5^rkPBqv_-Z_cef6DShA(?a+Jiu(&bBcXU4y1;Z9Q-xIlld=~}@g9#mc+C4!F(a4*U(G&80yl;_O8qOh$ir)T7HJ|F-Fj2 zZ~DIZRFqlShr;#UK=@SLk>ocg{n;Ytk}SZ{PL75Cb8MvH`bE}8M%tX5n*iSR&V2yY zY0NfE1J4davVjFVy%1@tHvtl-V0!MwTpLxXzzy2O;cquB@3$9M-Ljq$ymMQ}!*e$9 zlNzTa1#L$IKyUnd-qjo=ef509^r!9Gz4)EQfTm(3h~mAI;e!n#`Bt1$F_`-QtS*|O z{W7mDFGO2n&Rc;Dta}6b5CmVkK*osy;ef!PzM%^bR?M{Cv!mPxNY%FX{{mQC=ZM%7 zr}#z0{&&*$N2%=pXTtUmj6@1UUk#d{In2-=XJqA0JZGghmC{r z_Qo~$j5Mrvn{4TfPk-iAXZ)lb8uV8l`1M08-j?~>ZWu7EpXWY5`nN+CDY1G#G zwx)V~w3|+|i95=#YlK)y(#r6-d#I1)P?N+cH}}vL%KU(4ixLnN01Sks5a|A9Lh>n# zJ#7S?jBppbAnk%uNd^uj1526$$L8B?c>Bm`&+g*vMvzLIs1oDR+9&P-r{yEt_WlmD zhgh^;Db=ZaA+TO0pDqjqB545|G~K|(bA}xa!9!+UYwiM*Vv>Vl>53|HWZz%$QzQUq zb@~ykbB#O~ZQ8?}ubY9M4Wz)vlx#>nD`FB`QLikqc;};!D2NA}Oo|-8fZw5a_=Q^x z)7X3cZf6ski#(m`gI5zjdW3ns=y%!pG#`=|(@!{1J8nBWAhp~2y{>(51nbjG)gvdk z>005}!>42d&u)1LLYCjwovbJ;WlF{GMS2$9al$@$8$~{}O99aY@SsNO)j?F81kyY2 zK@AWx-Bv3=ufX82@O1)N#rQUz3{h_`0k8{6?4;o2B~akA!}9jn&y0RP0c_IvuSk(s zDMYY^KYUKE|7?Q3B*&(WK108A^~iMiUkS<-4-c=3cLEkw7m#&C;{$|*XQhNr;T=Xa z$VWyTT=`3tcc6S1b-OhYdf z48BM^H5;Dg(Z?7RPP8`@k+E_@Bd`}FICgq9fc@G;un2Ncyx( zkyPG*qUr~G$-#0`&sbntWM32@K{)AuWr)bFhebUo>_iP!|FGhZnJyR>T3A*nj^KSy zY_gk*o`k^^B1EaZb_F#dvbCHV1+}t6&dz<)m(tEARNYAcS~Od{Y7A&b%H;N_8j$qe^_PbK2~2lLlyApHFooFo7C{!iS(dF+{EN1_c4O=jL-eYQ0B+ z?hM`p0wfBNp>=|v_M<@%IE=j{XI&XO@ZHgI{^pvc5n^Q5uGOt;;fbU0MS#~urw-#A zJ>jL!XnCA%o-}~?U(_ei|BA8)Y`|ls3*EOlit6@IZ8LPtEiJSVk1xq zce&yoMHLZ?_fF4igBj|t59WkPLWH5|g@ex0P9SomEPsk%e*2ar%X4)x$5$%|WIbCO z10NlnSCWrp*Z8g@Fh5;b?!@o;RaK9HB1B=pHP>hRAtr$Q>dD%evqSSMG%-#BLIOo@ z3-1%FNmA<9{@eDj|suCCWJs=o2gj%ntnJFX^v()}G8;_uQu3na+jq z0_QkvEdIc3v+aHYM)L}xLdC;xiHV6oiorusG+68d@CppKja zNdMJ}kn7ZdAVFD(xOL{%gpsw?;#0QinAZA*l^`a%(mb!l<)z3YHXPoY{hksKqQda+ znxHOh_&J)fj2zr|>|qU-Hq)iJ12rL!)P(OjVkYb4hgebg2PB1~im(ntXRdV7<0ca+ z-KM0XdK2@A4I2nC>xt8Bxn7qEa8kH14qKM0e`o*}p`PdMKjtC)3=Cxc@G$8P(STkH zvnU1{*M|Ls2c61B#@l|8J@k%fgkWQX5=zV6c12BU1+>pvehAm6ueY%Cw|4Vw=vu23 zFnQ|Px}(e5V->L^FTpnnZXvdAom6IU2iyOo-6IV9JMG?-^uW!F>H-btOB0=1JB)Ju zDEZP3@4j$B;$7p(Y`@5dHmVYKM#&rA1fe^14GpUh%4VnpDky%)5P?x|`ig=E%j=2f zP~c2kea}uxgQ!mS|BAv+`=L+%j|bskISKCTH`QG~LI@X&Nx_0}R;W;X8&JFVs$pM- z*`xT_+C&d~W3}cZZHD3FU3qZy@#1G3(jj;!%7%X#HTx(q`Jb;(5M4isojVOVA@p0` zNml^5-ouCh#F!0ZEOwnfOESN--&@%_Wk~G|BO2LD25G;!R(xO0J20r}rBhXf%l|$g z3fD`882>;rCl`WA!OX3>8y7vz5C|TkTr*M!T_-e(up}H4b{A}*1uGo0O+2r|zK|5W z)!{PEh}QVw#a0mCrhnHQ@vQhW_0y34pXr*z^3S0FHoDLW3_sO(?Q$XmgR~PUZC9l{ zkXGn47`dx3J=QB&@un}D00lM3ft&Vma;pDSnvFjf1-eu#HWJ$;wlB!^+Wi;N0VlHR z*||h4QpcO|p(@7GjoHYZ)UHckY+|s5DN}HMmsT#S$=^`Do`A$rEWZpG zj;q3DNq2+^;inmMAASgP+we)rJz5FF{u5WrMT=}12;rtW{hb%eO*^Y%75DmlXhKV+R`8?CVr%Hz% zbK2bzd#>blxm@?m^k*jik2DnrO20~fS{EQ@hG-gGb~t=YDsO1`yZTDq zXWpV)x?Y#UFmIj9!htj~J94r#I>Q3*H8MG^HwJkGWC3jyf8Badfxz_{)b%?=M_uN*P&WB>J>02QSV*S($n%f=w-ZL zej;^h2HJK0M=+@)curKw4gpnDC4}G!Kofit9hAw4DNy<@Py#D{A6RkAauETN5#2}3 z1z!#-D(qi73%*6d-OFdHVGd2A@hrb&c(bd)c)i2`zzDyjWW*PZy437%x@WDBs?cKB z{GWXgoS{GZAkMQAXKt9vg#!4)Uv@$KTJpc?fB41G{eM9TV&BMY|BVN3O1tDF$L`Mm zDcQaFQeExa*Rj!^2L{ZwE2UJQW7@?Us*`uWRQ`sB@`2M1g}Uz%T)=9I>_P>>5 zwOKTx8f(eUoO=?LK763iCOBiEi$Y4hJ&KCF=WCRt2L_Cmx9ai?sl+D+ ztXOHKY~k*s6-OC`uhsUF*sJvP_rD^QKZ?#>mEmE(yEXP39svropn+aXy^|Q%RiDx) zvf*Kd+Qsi*h+c^=WUw7*`6qdSiV_qtoj4t`8AfgrZZhEC5-ejE?R;wos;tY}k|S>> zcK-mRLPq-ktoBTp|9g-t`MUzt=h5uFFKY;c36(G(Z75rab zhy!)5XGGf+U+cku2?7iZ8F6GAdHMpOi!94sJN-;Cv{EhKqs z1KpUPn~du6tKFQ{v79Bjo;cM{@XJy$gPmh30rP|k=A#t`Gmx?$Z?sIgk6~EE9H@TOlV7jLCIPi_eQPeXG z7UpxWK$^XBPXUvD;{lfiB@b&IV6BHeNbfds%$DX5JfQ1_|8PxiHVRMOd-)DrS!s7E zm<>I`{J(UA`9!?IV8J^#!I_PC389zL(53laIQ8T9#zZJiK zSoim=R^1A@BPYI%gxR*u zvHc0K|0*BtVgnzgo>niOb&`Uy2x({57Iat1fpZ6FU6>uH*Yve!UD(Qa3ZSS@{8Tzt>{A}*Z6r)zt&E(Z_Y<@?_ zuk^Q#w)s&=`NxE%K-sw_0GuMAO%u&&Bn`J0>kf}rN(3e2p(g}_`ijBZUF5||EWJ2E zi;|`&h7=*Kxbm85Gmr6YBa*P*&b`P&zPl&gq7VL5jW$le8x5`YSXb`|F&nt~P10cE z7$&3R(r3oh=yQ`o`ge5q@ETnauZ$_Z8Wv`P%2Aieic(yny4H|PORw8#52;@v64V=%N@1F=zk*eOEB3t5i}#w!5vKtLMx*Yh0tlwFZxFvKMyz`JtG{!xa9=l45I ziq`Epp>Y%1uu&^Io;?=-pwLo9ND;4qNlpxuXka}&8t-{rMK6=G;GKqZ{D{!ncgOM? zw(sW-(Z0VmG`zLbrgP&BVV=}&-EW=_u)(Eh{9hX$W3NUJff5$`3|&Hvz7=cpA~`sl zFCOUUMJC_Psa6L1YqdI jSaE_+ww2MtMfy#+>q!z@jqF)vGSFb#tT7Y;GL^yMU>osSVVb? zg9ebHCuhf*EVz;#vU~V?+x3!bh8T@(X|MG3*cW%kimuB&z%3XU6h2(AWVT`y3Ep~^ z+{1DmGENALQkqP<8)>FehDHfx$N~)wUDC68vTrXi6W@9da`YFfng4=Qk^oMfmtg5p zmPcsYy#XaxYTXgYMl}&be~wPuKq%H)3vk;=iE^X6mQSe{WP1U9f;}17Jv!7u!My1P zu>U$T%mGYs^^H#z6h*47BX@%YDZRzm>uS~G{++a)_e9!$z7ab4*$Y6t)9Ct<1=YX* zCbbrw+G`2LmnkDq_^?IoF-%@# z&gA0)dt8){qDL?s9-H!-7#5{K2K<#kgcg!gKfmY666RWf`pAo1?}jH4!2Tt#KgX_+D|5>L8qulWU=v zN#4z^vhSsvnwV%*MNg@jof(gDHY#X4gf#C#8JhtGUfFIGDR47}^erW{#(TrU{+K&c zY3QK>W&+qQBnhogE_LGLf2nJjpni37dqE~bTlIv=)$&-#F6PJLN-sJuRl`zEN**}z?_Z@Y{&LM3LOcX}@;zj<>q zA}iXWx(ZiF9x;qFykJ}orXPxOSx5+5B$*3R#_Ao=Qm_7FbA~?MGP+pc9RalVL|8nhFea!RjjGmzsc*tkT2HTcFi)3%DG4)1 z?JEkp!jTbW*raV={TyY9Dw&158zeINv5B<3R{qbC4o?Qe%^iGXKMMJT6LQC_FFfPMOj43FX4BQu9n#At;`M;1dS0B=BMc0u>U;Mtxe0mqplAAYh zBaixISK0CUJEZqumZB!{%z!cwu!^4?^Z!i4_4b0D%!N2Wr2j+_=9gT9<@cZ-LVp7V zh#cH7Fr!rorwEq~N{W!!wEw4_AdE#DAG9zTC?*1pGHQe|rmA8=r(4?sDH}k0>;~V4qCfpBN~M1BZ>1D#dqlsQB5Y1fi`VYEpAan$ z1mSKCjA_@e$gE(^8G$uTv1)Tj)1PLwFfdhg@!rWsP7>tnU=`>v_@)7~hW>j_<$O2B zuZd}t3xS(SqK%Gl@rrZ?o?j-hc^5Y7oIaBTR2qrn(`+#!DiTc) zK-KDX5A_|WmZq;)D{2uEN##b<~FwD)(^f!0EL4N2I^D5 zs!;%|Mh?i7o=9LuI|k;0;xqiXaDi)1T^nv90H~&n$wS6=GBTO`j|2RNo)r)uXq}8o z3yeylT)3lviJ){P(AVQS!X@B=WW&GiCmpAF@jSc?(R#mr-6ImA0I(>(BxGOOPWyf_ zj)b0b@v!UfjH#@5VQXIO-N{YXw~>m}h5<%U&`15tQ@VB9H_{P!t&_TxjK?ROml!)t zC#lXwz09zu$7AE;{DR+Ni|M$A47CcrR7T~>Gcn6(O%w(^sP}mPe}A9EpF{*+Xsz`v!XqqG#6lF#);lph0XvOt~@As@~mmVeO3 z5%G*Kk>E*NT3F{fErYTR&}o_zl93V{deL(JR!k>Pvdm0Sw%|N;V&FLLy9AKc(y@PIs@R_drHq5`L zM7q%8w4IWq>#OxfdTb^NPakMdHA4YpoR2l4d3Dod{-5&xJf6z6jr+&fVp-;Srpz-T zgou`TDpLv}LrbZU44GNxjF~BO$WS3u=9v~U5249WNTvpvitmYb*=@D6@8@}bfBf#h z_UnGFmTR5Ybsgt%9>?){e<(H=1^OiZK^qf4_$%7jS0iJLbDFYmDx*y9kaq66WnM6B zEhOSYjy+SiR}iKSZm+e^O`yL@t=ABM@Zc7nGL=z8NgLkak{;W?Xy8=?yeieV&5^TS zo;7h-Yn@Cp0=gP^lf104>ZyW$`0X>dfnw+q%+O$Kr`khOcIKawGV@Bh?~<~It2Hmi zT;F!0fFwyzM3x3TzU=Sx!<#AVwpn-?zKPp`PoafHLkRgEYBF{kG6(*k$R`y=~Mn&bhfu^-D^@Z7**U5gH_Y;pD|vRR+HRDbhf->jexyZyXfT zUuLJ7hQg~G*<7e?dflm`n94M2#4iq^y{1D&i<(6-I&7^R6gl#nzB?20iVUs~*w@1p zvv-XNv9Wi7yfLT{_6K3^?|eZ}iH`k8+Z|C@mWq4b5iHed+M*( zN4~&fudI=5RTYsX+x3GTg9u=1JM3~^z%GA#TTUw$W1j6^$^FAk9RvWUwL_fQMcw%u zMG=uLWVLH5O0uCgb!DnDs#}p2wd<+h`q!v#XzTF>;sTno*Uhy}CESGgc}Q-3XX z|IXZONG=AT@D%#+Qi^0_4!35*{P&x^#V^$Q5jx3~(C8?;EZ!hknf`H;A|<`1RF^X)ce;5u}3k z$dQ~=RyXB|r1is=-lWepWBX%l(x0HBj=sM>50c~U>-`I|s@(vl4*_~{Z%CNFp=RNH zWz^_D;fts`A*)?8MJBED-jPPHl750JZi`Go34C{v=YJhHAjv(Eu&cEewg>N+^0d2!%c-~J zb8jBomL_*Tcez89^)hX)`kcOT-k9`XAvFs}eVlD}a3KN85=T z3jiyZVX-z8&~U5bOS)%>!Q3PIEEH{BCo0BIjf|)-X_i&+pW|^{Vw1bpydTy6k9RQ@ z4R&})CWN??he+?mdvbU5^nC@0;`vr3Y-!)3vJQ99BYAyV)5?Z%9UWwV=?D@H%D0kV@G>X{!I&#*}9^QTPj-*)}5Bh#SkYaW)$AoYn@)EQx-n%`97> zrGH~rF*=~lqqusdPIJ`rX4lS{^?R38RaGABzYDCI$RUreJIKAq<-h6jzdt_Pvj`aN z#k;zBKJ1nFs@L6jt^WU&w2z!}goLc_n}~dS>T3_)EbDXppxPSA!_LlxnG4VtkRJ#| zlHbfzZGAjpLFVPRk1sn$FxRSHxdyP*)SK#uraW(CE=*M1tXYn#NqRDZOSO%ny;k!p z6m7cFPCB?H|BhZT{Y(D+1#%C1?|}Rwr|-D=#OLTQmf2YMeMb zc$DnDr>Av!>G|cGS4yu-pORc$!JnfXFqTi3<}Ux=Q&ddoaNXczT*wnq}4^3S!r&F@x(QEt>BP({mbfZuCw@)-xO8=wZ*( z?!|lQoA@>FML~3j_p)`>Ez2Oc-MRbRt!Z1a;6}C`LMRe%oYRr1Rmq1foXw7zb$|*L zgsC?vH3JKJn}Ej~c(t|xn^&*Eqplx99v zr|vHB^HV}aNQ{zN{-um$yc=2W`K|KW%DiYGvf7h;`qz*V0v& zGtQV_Yh2}Qzb73Sy0&qZ6dd8_8r=PednuyTB zUO4GlD+_X9t9C*O=@_5JEJ2_3q|%waEU@vZ!?6u_ZQ4Vm-}X=(?2&>|P9&(-Y|NO9$xVnWImmu~=w)3B3_<+N!f;1H zM@g5ku7N!29A*N(#S?leI^Pgf^&+fR7+{?LWqRZFaZpGdUEh4MSqmzOTPTC@nyjlE zB!7h=O>zdR?$a3xW(mv^=i>xmule)ZlUlJvOs@GWR47_~XdwTyO6eBq;fL}+ zCb}PJ5M40_$YH#+mx|24F1+D8Mb}=8A_dPr-Su-v{K5+7g+SlJA{8_ArqQ77Jlu&3 zm8M;!vaED*29uSLo!RJOM)UBk*;zVxlR^$*L2$bkV=}V|b$2~2)#Z=+G|=#`FL62g z)RQi|ve_=S+VU0tCEA+!R#X7!gZg!b_f)gQpArZlsoRd zeSw$oHsvch+iwgNzD5>S!BKS{w@YrhmYU~GYz&SR6ocG!osO8708k-84fcEeLgg*t z{|$)Q_nrD*U@<>3l79o2{Ya2nC~4`b+yO~`^IHF^LSmcj%B@Skbck5}Fqpm5oBHvm z+yE7SbGhR!)J`z8#7=CK?$B~Fs7q| zY;B0N`F}diq7*~8)9d=4sx;@bOmuxp7=CNOaj5S=j@sR^{0AAv8jv%NrKvJh&osG= zr|lEH3n7}GYX`9xFrHnNqB>5hbcs5nvg^E7BEXja6EWZ}_$w0Q`n^J^09V?FUDMBc zBX7&SBYo5B@2HQ;R;dw2lNuU?V`UX!`Iu0Lf|?}*xz)@GD}+_xyTCG*l=xhk$>gRw zH04dR#(j^fENoIS@9cd)MnR|V3n;)p#U~RYn)PeV6A+9EwtcK5S2zhftlo3dBBR|+ zu=``nl5tp5Eb#F;{F4X6SQh`uN&nqwipnCss?+YQJG>`4Y^47a!^0RNn#AIx57swH zJ*K62rM&E{{BV+pUbA6x37HhfNDgJTsXQEWyqk2Xrs|s7sW)ReR#%%v2Mya@mlUlV zGmi{R=~}N;WsLibjlKD@$qo8bKMqq~r7p%uMAoSZJmpehZtle1us$n75(MCfQ+i3a z>f!uxu>SkEhTOI9zk7EXM={EbkI{0JM2Y}`P3C&w4xGtB>0q4@aqE;e%GC@OGI17J zU}USS03QKtH3O*(!9Oe1et#&jMrN)>9L}e)b4S>!FXl7c|GK(S8+ah-GQN;^^A)Tb z5@SCbDN;o+q`1~6Zpg{4zPpsmv%ZaG^xBk?-r=PDc%QjfGqy1afXBlAvu6Zh_)dT8 z#|ZG2r3}L4mgp`XV*%1prZsQZLGjK1D0JPsC-visf8UMzal^OEyMoA(f3i|!G=wk~ zcfD}iMmeD4^jp*c>mnAr{H}RyO2%MmwZm^*D~MENc^dSCnw^w(6^Y=nU}< zviQB~5Sa@BnRqn@W}Cp&q`+bgF95d~FLHx%^gmC+b1lR1Rfl%JTp;-_ed?)fqG2RN zNKMk8lH&H|mPa{VZ4Jysx8{?t@imMUJ^~EM66i^Y;)v1Nm~`Zgy?X5Xk}asJqP~@A zHDQZaS~N{l=?BPl@H9KTM5$pPRNz7InG>9mqzB7{Pcw+OX$YB&m5%f7n?B&a`3UFd z;EBkW;uq4y7&^k5H2jfC_zB`(v*UBPm=f0 z9$z)I=a9UKpql-_jaujR*o}VD{L89g;r&ik^~d|Gf-4BBUw8PtewV?0kB|Q^>I*=z z`L6~yW5$|ac1xMIBc_GWp`SQU3pmT(&J3zRhBwNvzb+AxcVhXmUJ z=Z{qN&L{VXHQ{dhrpnq+)fx|iV%b%CuZTl5gyBZgq|ErK(#Y4zAF#M+LTA_DnsgUox}y=nvb#PDCb+MNDY8`zZ}<%1C(RqQ-UDyVz*=qL*&p@*gye1QA| zH&zUX#b|aFOnpk4Amv8-ttU$5)c^H}54!X}UWKhfIZ`B=2;`z50&rp7$Gk)Z%r;K@ zJy%Fj#|G6B%^=T}+n4s?&h?dT1*>^-T{K|9yb@z~@|n>Tztt!&vo7!w@}3Jm-fBVx zMkL?C=Y8PMfPQIM|2^h^(_n$|E_e`RtN#<}%+HsNS#s@$OBhmZBYpLnd*79R1c-rw$RZ+`&e!*2Sg zkgsM6MA^?NH}(=aF#b}EwUPS`4f-SYa|dpBD##qZyncF5wv+kw2fu7_yzJ0>r;ecf zzpw{?#L6wu)W{{yE;@ksb?T7N3R$5r{Us5wN&JUl#yte0-Dhfp2&To}N%3V9BYT+g z<6Zp2shnt3mT*5!ktW&@dKHz4$ee%4;?shCjQ1#QotLtY?HLxlu{OiWn|K!?Wfj{r?^ zA2+jb0(Zp`cJ_g-O{MM*k%H36y0z-=C<1z&%cEH(DS41-`F?B~-w+)+&5MPQJZ99D z2&g2j*KGRpL;J#ae$V(ZygolfLp1Ff3<37eP4gLUXQTq0lGnoK1uBImc0|1C4aSI$ z9Ay3&h+hM^pk+=)tH$w1P4XXSHiW^~LqeK*Hdvr?33;etBu$7+j!sVPdk?JAT?@QO zE#iW3c}RiIL;|UYgfI|N*^f%My&&6#TmD^=ro!jmz44XkGLHUZBoQ8I|AE0U+qmB$ zI)6OD?Ld}xk!(=CB~?TQHfv}M(Q zLtWlg4C5Bki65Z$9zKkow>&!k&OpqK9|Bq!6Q_R?#q#vz(V#~ z%J~0MOA`>4ok${n$N z%F##KynvKl`%;^Kcp}c`^NFouwcsl?8PyTM@l#zmBz=P4KWO*~0}3^guj^WgIXE zu<-{-rf-b_o35=o{(J6(?3+d`TdfsS{^(;M(8#;*S?L z+}1Og03|9Fijs1uwr8)`m5)Ivj(%~#_3F#Pd`hl!mt^{cBD=vpo7*wb%3yq-w~Y*E zSEnF*_S;nU^2(l7tKSVOevil7?cu#g6u%z;V*W=<)V;j^el@)#>I<{kjdK6>K@zkw z{_5$*g0XusSC<5%a9kdCoDbuG(16|3I{7{OOGPP&GF`--5O3X0%7 zzcR;$sIg)rQ1G{1_q7ug|zB#U}vWHpxhAdtZxe8;aDX9+|S;ZI?E(^8KV#_cE9aW&O^VKC5rh5QHup- z#h|Anby?7i`noee99AleE%lb-K%qV|NuCNp)%bq9xc0|q&~F`Xq3<2;0${efgXL$B zdKvVlDqSWw=L1SM>NO^r)5sfdOe^%!Wf^@0r|eP>^aZ*z{Pn4XTtYgS6+gEiT?|e^ zx7OwJA{G4l-Jw_TYq$)YUOQ)*?x}zM57c<3I54EBX}nsD^3nmeK$`S*>h8)LtvL9t zZfEBYRmat#yJ#TrG;I_;N+2j%1joRMsI--&*W2!`tl$SU-v2T)wAEI7FO~RLkN33@ z`yKUb)zp&*L-BFWI2LF|MBI)=wP6?>t{>&&UabmNZI(DrXhfl#L5GvxQ{qHqYX&tH9F?6UY6rBE+0*f4{#MC9GKa#_o>)cFX0WgrQ`GMZ$g72-{*617j zESYK$vM^}o;`z9DKF(OlpkCmB$;67;4&Z(2V=~z%ORyyDj<7OI-V~UENE&<7^^PN7 znxPSYCVfSk%ix0Cb!)*tNm+hh@PTy}A7w(RfVn`7Vp_!;%RqBm(wB8NwU3%d2tuT# zA!5T~95#nix*KfE`0Rj%H7dWE3f0-4qL;BD81ygf&cc#Z-}>#Pg|0K?{?&%fjQ-~U zdGKEm`Dxj=hzz>hi!}jL-$?n}1^V9=_qKl44+{KtGxH}!tJ-zy=-IVx8w=i=fY;x? zcn@jozMS*^f2a9ln^kD37qLjBHdd^G3F3I(EDJC>LqGYl(x2wTqZ=2n)=E!Z;ndrg zB~<@11ou2id|mpr%`vqIsDehQ z%Chu8+(;vW9}DF^xpgA-JwYKQr_HX&1oGjD$K{xJ-e0_sFV)B5v(I{8p1>AWvrQ1_ z8cEU!pAyz(FVvHaFbT>iPDrztvB=fvhOj>$h|fC=^Z}nDPcuE{#7|9zjUY36VU_lH zg!75XK!|%=Kl{E{68v!i$YKlZqd9ShxJ_>L=3h>~GMpIsQ3+cJgTdFex5!qLLa37i1L?F)$<9k$MpC#As&QvR%UVUj?wNxoWp^u9TMv43|@dE&^`w z8Uq_M0S397$h;(z0rw?)yw}wbm7-Q*z8qd$rdWJhFNd>h@*@s2BKJ7x23PHFBDz!M z2;g2?VNCV<+CDvso?nn(FIY-B$MHafv=dT!M^ss!vS4yX`qi=9;L(YzHrnPebGDW= zR|!AXO61~PVE&_x;8(gxZN9A(2-QCvM3B%%c8jJb`4M_ltxg%^gcX^th@L<04DsY? z{R3Eo>U1H3S2YNDv%J(!i2)@dkuqbI@Wpw>Zt(aX_4{1)@o_nl^ELZx<`9*0sr82+ zM&Nm|PA-FVADqYj#lH1J%6&er@A{?wWmFGenWxuTEG=X>{F$#ODJw2#iHf+2zP@BR zF}|=vs;IiDR#u<0YJueG*v^vcy+@$eGZnmfd*l1>;`iwE)M*OdCB93M^h}(GQ^PJi z2|CibI>9#_Fj}5QPaJ&sl3DM;12Lp6d3|49Isd3&u`|`*zdQ=AOT&vMv;W4CR&u=_ z_6#=|?{t+S4zoT}9!-!Rc_mFO(ZfR9i;0~qgk_wByjigHQ>D%a5LpF&5`sD!B-3(9 zFRb}9F-lNlF_+5d6%uS?$9K=Lk3##Wgfh0@h(-WT*JwD>SiyM*K)X^E& z(r&)81z;KVf6~(sI0$T&8vfNg;0Hb9m-_TA*MRRI+hS~eFnCbd`C(laKV?z4??T@* zvtRfV8o_tdXPVOoteUvJ;ya2Y2Y1=LUk-3;#BdanVwMT+NDtj*- z5}H@qpBB@Y68<-sM-4TtcGfCxfSW1yY09S6k5lFmG6K*vQMihuO0@uCRyuu%Ju?^q z?8jatr|_u8@sj&sSOKH=N+gzm6bct&*2=-i!xyNSSrG|y$5iUl5RF1Fy7n9e`n4(R zx}GWIZ@;ql=vLTZ`g&J1I%X*WD~9oExJjR*W%{9D0{d7$3|K;(fT)swG6_n5iK7!pyXm}gv4zHapDSY5u!J15s|m7FZHMgFS1`TiizGqdZgPkh z&YCtdqvfPr;blyr6W6T;+2#s!A>qh81_;r$w7M+051F>{_h`TWP7*-Adtoq0KV_m#tQ39B>BnzZoTK9*T0C`G7)5pp zd+-88h2s#XlkPd3iSBqG67Yj2%wh%fc%6 zJA*%&-Bcw6%$-|Ed*bfcI7IJm@qFPYS&Ktg&K5xF>~FL%w+7H;RX+JxtJdp&D4Tfn zJs=iE&~@5@Fsvg1(d+hF7c9`kzReJ-nAFPu4nEtqfkfh`_ANN>9#Q&crj4~i;PbZ^ zlRGJ$c%)VUXUq~{Y7ZmN4@Z**lke46Bia3g*ltqN4vg29`ePpwx*yvWvRhieJ088+ z;1YVhK;5uuk;mdJ{k1uV_{;JOF0U=>-~8k+2LjeA#9!@Dq*Ze{K>6|!G(v4jx$#v{ zHOaJ%&AeJ!&uHnZ(TYJ(5jKw#)zG2*=)v34o4SS?i|9F*fiCE9OB0yEfdjtZpM&^s zekZtP=!62^j4UPmUE)0&IhWP1NKxERl={z~&)NB9cJzH@@wvjvBhED`w4!b)Y+P0J z3h?k`Du7S@pBA18^L7!QF|5uOpu@*6Vt($wHQwq~j8?+mT(8{>PU%-VbBHD}7aDmQ zW6u6@zuUBec}Dt&O!IyjmSBPk7@dgo&_lJxHvOIh8GdW%R+G4J#YA*6#(@~!DQAql zN7zKgA*%{tIqYaHI)}c<=J`C1%z0f@{z)Db2zF&7qph@W9efb zCpj7pS~8t(M$!uYTvFGrOrj+FGILH|#}juxX@$CH5;tOjM)wUY0PFWdCSn)&B`N!f z=qSRTDRN&-J=I3MO#*uk34q)#KF1_?(a0r@!wzRn!%g+V^IZAcd&RCy`T`_`+}w)F#$$qgOc-QqrTxCVx!2 zKFR7jfihG^?i?Neq9yg^i(z{rw_W!@ZqHl(jNDE=$=zf2_ACw#r3wWFsf4_u_nVV5 zQPC38e$mM-5#DjPn+{l-x;K~G-w5XDuDelM2Ch{5t3I}N} zHR+3ZKi~`zp`C|V7O|KV=f$-YZiwO7-(XU^{PIpbDoJ9(wony8PaZ{xVKrZ>DQWkg zK$Dbe#d;M~&>5VguX()2>@uZ?*}^;7@kgc=F+zIu4(24y9AYCM(&-D-xz@rlW$_UO zIi-LNY$J<1W2`Q`y!Y`fD&P8DYkKS3;R^~+t^kCQ;ME&WZr58~l5Xefv#Btvr0Goa00EFhr(Kxe?XRX>THlpjXm=n$wARcK7!4$t%!L ziMl?t1pMYP1>9m1CK&y(m~GDE6c-OhECN~%yKufXI)I7Je*J3jUz&#FBoR| z@d?y8Z0%ISEDa;!iFj5>20ng?@MFLYk4^XuYgd04>QaWg=T3?`lLvt1Dc{2>7057P zb3joNSxLa~NA7!Twt*0FRbnwJ#KHy}F|Jx*BCOp^n`Qga4`qJVBpIewCNjcj(SENz z`2hcL{ZU@Qd{PqYbLVD4U9oG(w`g$oz> z?TKG9B$R%xX8nR6PJveqw^9wN652%Z8|D5oi^W8C6$=yV=p%>js|bj*ye?a}(m4vbG~p!W z7ba zs7%4!dcO~*Qu*NI9d!lF5jVWIVkPAnOx>Zx*9?+*o9ROV)@dl`P=qjBHfPB-2_yUh zQj-G=ZD){Z(UX``&dD^PkH?7a0$Pm2xi24A@7&8=YFx^9G+bRG_OOxor4*vF2DT?E z21EY@E?avBIhhvK1qg0{WqN%>NXm1sCOy$f1qMHpJ`|09kjS&1sJSu{Bb`_xvaEwy zHi16Z%3u*Mdh?zbBg0ASlqYOpIP*UK#R)$9g+XZj%~;)L7byq_d6+$1TXhOcqGRNV z%M(x`0TjsBv6~gg1$5;2GS*NE2d`I4Z z3Em@nn43NLr@2|%^&>mxW@KNy$r!fEV1x!FrIOy76~fb7_fNmed&f>o)<1(HLfXQU zG_@lmNrwtehw)*SPbiz7b_&b;BqioONie2<88bvfH~RC5AOehuQ`m{J&0d6WOA-}< zU1rzgLF{lp$#~QsHjr!Ch(Y_oJ4A747fl9sIi5^8;RKoHwZRJsHnP^4wsOf}VGv?x ztgV$bVX4H#!O|J?5Fb0j`ibt*{_BT?x^GFK)7W}hLt6P$kDruV!!Tis>xr5QES;4b zwLMmdyMJWZ4_XM$r)ygrLO#GD?3TmAIEx=#Qe+bWb%Ny*SSpurC>PX5Sxgr= zMabB(I(3RS3kBZlE0p3cGj}nz3xc|u!om&AYEV@W;aOqMmdq>Z$ zQ}k1P9F$Nb-8EqIuYTspKn3_(J2t%HjSAF>$iW`Jo(8H{dHb2!CG}= z^`-=5B;?wBwRS7s2SWBa|fBWm5kc_~qIjiH+mxIva{6f#X0DF2&u z%{GNEzlKEgl}{BE6vD>3yzl!ejLSq^TO6%_QX4vxC&9an|NE)wcBY-FY23{ZGmJ8; z3@!ACB1B|0AC7|_8vtX|Hzg>c9!QHXe4Zge5#``#=vN85Tft3lMXzJ;UkoyAaIQ!L zQWNlbYgLf!_zjFyf$TFMRV8a1d{QMwyH;Ovm6CAr39VKf((g$1V+f!4!SJLm+s_%xv0lw7sa(mxOZ=aKURL~dBLwD%@hHhu{Q?@x`~;&dRHF z?k&a!{>IKXjs)|T>;HpJwHj{Y&- zY-D+}159lfR#shzV{#{M?dU=Z;LB3LI4bo?MhcXH5i5>pH2sWvC5gvuWGwmeIixcF zW&8>%4_os_bRXD8_(TrpiAI~?{8229eDUT;C2U*341UvK5mTaR1hD?gCbQ8Q#2bn+ zudk-26}&qcp~#@{tT4!Pw)G&Ot1!=CuGre1C~nPOk>6#s!5SgG<5I3IwIia7TzYdP z7`EW*w7p<7g-pKR77S$TzvZHt>YXc6*lvV_cifj5UzUanVAzAO_ik>p5wu?^MF%Ya z!%py$Ft>Ua_yId4|8c1QbZBegOw((N>;=5E9-IFI>3zfB{mOks>7am8x!ab~?^y@Z z_*IAd)l!8I&pav*TMvI>i|)bU!ucDJ?a*GHW$`O)tZ0A=-MZFhAC?J|wbLAfVf0@* zUNL)}%e*ciAmO#X7J3J`Zj4%Y{>p=>XvWc0wR@ zLd4LEL_iN2u5KXtRyrKH(SdOp%SES7`=kQy^;13@%Z?;EsgMIPKtqbW$V#kc#Q<|J zlM!dssY5HkQ&)@p@)gdTbr$1i6C0F$s4MQdrNPFU8WE@ycvu%{q8jUvC*16-7;9&6 z0Tj}pmBafmBtBr_2lWnA6bC5a9fx=#eG04awmV)anyPDoM%u&nahnvhf|28QIvg;= zw6Rgp;V{v5VF{pDjyB5*WgD_*8L^L^5*C=gN^bip>#T3Sf^Zh#BQ|y4RfF(bn~ZfH z!$3v&XZB1Uyrq~P&nGnX#tT$x3KEKn0_7O5M-LKVs+ig=n1D^nJVwTPOeel$8M391-cDinAoNM^4y=ZS!nM}roTghZ% zI7HDM9p-`iE+Vl5J7VvG4pLtb)3KQiY68Z-O{#cN@B{qDu_Cyfu@-iLIwsdUAjrFk zSmdWBCs@jYdyI2Av}jz;a@DV03b*ZC#3AUQ8V&d5=n}>r^g0S8K-!tUWfBYH6z^Ui zH7RaJezR>8?uZk!zLb0HSjpUjp_bcMobz9zt;&k;u6=1EOo`KR6FipacacVZ8)Vt< z=+|vgW_F4BYa;cH3LVv6onDVpu#;%|@IhQO6yQW!K4aE2gfA?(iVxp^z?lmA!*+|5 zfeLvFi%*~uXgk~|Uil3#)9Nomiw_gg<&=r5GD=@@-ZE65o<(W``MZ8<>dEWQcXY0yM0vkfeWjIzDzs$ z!iJIn!}7Y|)f2J2Ac|4FIQEnE@K#|*euovjz3P#Xav;?KsNn5SpI{qzT|Q{^aHcLS zsL{tqtNr%r?HvBwJNK>0Q21_g7e8~DgSQ7qg=FU@+Ge5u*LKD3-pF=~;-^ul{dbg! zgF<{Z-Cftmzm(UBxdjBwlrNBFUL9naAQL~noH@y{XNhOq&gr`y%T|uPvEFvd;P68c z(xnnKin=rZX~qI^W(6~O85(^cF*4{p-DmY+f}8OtuLeh)XsHzVTH~tGm)pR5lk$_! zfTx&Cd)y<%-SFd>XntTgre zuK2{4Lr(J~CjL#IqG@{sRh{DSt>YaEWDL(XV_Sba^?tlnCT8OhRX>>QbkJK>1YT{?}wToxU=~(rxC!- zomOS#t$guYuC9ycx?i24>9KI5I@qisA%9+#)hJqGg3|$FyCEJiLJ(F+IuY(uXg}K5 zlPc=*f%~~SW3h`F9SxMwP|Jlv9cUu|;ZFRUCW!leLDb*6pdN?LAQ4}bKQEHsQF93~ z;;wtHLw+P!apYUJrju#JB*9hfO&q^;SD8~Fi zL6{)v`#_jE|Hi3oA3h-(hEog*K9~wr;kPYZo-`W~;qG6HzUoLrwz~z1VWfte5G{rq zhr#FDeGG?<_b>_;d4EKQ_WU>ngBKw8a?s3Z5PoUWnh8niS6?plXcWqy|3G;O20Re5 zhRvu0*pNtL$bzb4cd7cy!j*a4qkN1p=CF}L)At6%wxJVM}u(MomsM@fVnTBQCcq*YGD((zlydLK23N}r`3F;o;RK$GHpjt1ji4CEPkpx4WfJ^A(2=&CR6AE`yxH-2jS zb{~mj!Q{aSMUt}5AqQX?(H6>BSbVF3g@WlFQ+GNV?_e&cU7IE`3L`#TAf6eQf1{{- zvPh85fkTp(R;Z0UN4T<)$lH&jF-%azPQ>W|3jXMtLa{m9!*>U;6|=HT8^3}3HeV%< zhjpxDe=x4B$eWML%00_y=vkaS`*pgzV4&4=H=q-bZ6FiP^rBhg%JCQac!#bO=$t}X zXFTuc=vHdu89~Nzj`QiQ1X&cdbv{e+O3J@Mbj-W|l86PY?pz&KVJc@xKhVMR*i(#h zr8L(S0^=R0k!kLW>TyNadu=ojHR#rW*nb(k-F-2ts!zZGObnBZ3iG{3>v6ldeM)}s zw^<)Qo5+A>vi`)1+vebFY4&(fFZgM%p=0`c=nt7i)KZNZ&p%)I=}_`-9y0$225tY| z0QcqSi~PwWIm`yYP1knuA^)ug^h1!sKtYQ=^)lu*uBXH~eKPfxchXkI$0Y=&3oJK; zXL`3rnO2wP@qe|4+=A7l`hvOg@4c)-V7C?%^D5Sgm*e%*3m4Vng9*gZ8*K{|j^-~} zCOo*aj@9qOr|V}MRK7FFAzv!1oV(rUrwoo6_OP7S-=3Iy-!?K>)gcv{a*iP-zWBZ! z+xX_jb6cy&^Ndd|=iKgIAAL_f!kb%rL(yGl_-9%Y6|WFeRBxDQE?&04oUF{-I2=Q( zaKZCpN3xyn(WYWxjRNbJ;?_<@hS-r~IBPaOHXC@DeW`LHjJIj%-?$CoWJ`xrg`B9V zv&P5Jh?j)Sj#CsyML0qg?^?Ih>@_mGFKvBHG~SjEC<+-VI>Ff#2{t3ud_dM{;x8$; zuG5-<2r@nEx!VajsGMxd%=%U&>4xaRH>=`aNo#^M*sPkKw*?2t3+yy*3zziimL6{n zPi|;9IEqE=O*9)_#X=t^wf~^L7hr^(npY?_hwbAE?i{k&oDjaV`DBC5=aa;dcyOd( zVPCPkDb>yNCRXSw=0Qu$J6VauuY81CFi# z;G^z~MUr}xdo20`w`nHQltbl0J-oYr3ljx48SY+~+L4oRr5s@oZOIqyYkpX|m}E59 zZU{UkXVu%dipc|4)ipthF-m9;8MWx-hYG%w22;XP6^s zjMNUcYIVX%Yno8@16Bm@bgtZvDfwtD$S4uVsaU6+g>JIx_#o<%H zZ;Fxaj~V$t-sx^7uvg^bK143DKZyAdD3|d@+YzcJ5W@G_;$ykR$AalPcZ&lO@^KS# z1bjM&#m6wPSQihNAQ?@wh#)?TZbPJXHJ~BT9mN?UO5C6erSV!rlgCNzlMjF;F|CaZ zKQ;km!t;EmQ%aoESbRo&DI8Fu!*2rFy4)0s%ah|D9rwD_&5U@O8Tg+27%c=yhs|$S z^4Dbod3G6Qc&Aw$_7n?dDkf2@-XY!H!%@HC3~*P2?t-zp&C&!mm(Yo91|haRqx;Wr z6%b1TnasYpDd6(;wLIRmzPdn5zurDV96QU;HN5mUHqtff#jEE~XK2Xegih`r3Cs8t zDNVw+WyhpNkq;(UGp-OR=;M_|-5)G$ArTY)UYGhd>Lju|IohdT{lD;orQAAz*e$4b z_#Qv$k{)mr)IPi_kN(PAWYE^b$WU4H6{T$YSeuzbi~nYg?u#=g5;qs{8-<#lviQ_M zlSXef;;$x62Qhw|N8+em`|M(;=6Q_t(Fr2Os~QJZ%N)L{UDS>HbX?2nVd3X@5fSkY zPdvZ3;de+9WUDSjh^ynHarS(3_wv2~1bRck_1?a8P_2RjN+8zT3xHvl{b!Dhe{+ci zmkr0mxTHjX8q2ef{W2EW)jZK`u6pas-J2eq9F$xTCG!X`(cxiqqjmze45KwkX>a`* zGGGqHgs(xoh$Bv#)hNpvJ^`aX-Ny2ZLXj@#uNKfinOwSvI44Lp z>z`Xvu@p)53}F5)+@zd-3)bdSGLrsyTA86i>d9QugGsN8{OapY4z-_jl2_N-x!cfHK1|5N8 zqlKZj=8^O7a4pUZcDgMNm`5-_L&23WuQL!5+A6gk0Kb?Q*dhO$he@H=j~^Or1b9>Y z6bEBqbJ{Tw3+gf|TERlge`fGD`UsOad>oM>R)S`!p3!>({n&Psw|Hr{erbD0TH4Uv z2G$6psiy-;2GvE*3f2?t><9Ts=Ngs~L+F!dDQR*rW4ftGzw3t$MzEeMQPH9dIVP*a%^E?4=uSeGdWjU-(G}!T zo{*cR)QmK3Gr|Nv27|OERJR=gfO;2vHc;Mep(dU8%)ue8Yfd(Tm-UN+zW?fPEznpa zvBy6GYnSNvobmrbnP#_3-H%Q_HYRaq=b*Oxvh-GjAE6Cz8~e$?NYcTB zS?Y9_`irou19o@otsQUbqxAD6x!)_sa?Yu)b~#Z5ulfXd=+(HiC!JKXPI4_Sn(DKg z5?&nAYSqW#r0S%We}Wsuqt{deoU{_=UR^7- zUtQINR+z^l^#sSV;}Lq1X|2;4ltInQ$B#aAfBe>sIVJu;=U1V^jnE`vhL@twt#6+t z5ZT}VVq+s1S3E$MLak~6{uoK9$*wu{RkG#_)z?o{$M08P==Wa(9J)@{2eP36_T( z91F}9X&pgo4`a~vF ze<^+Jm@V_eFm3ea#!}eCP5w=@HgEUk`^W5_`BcvtEi5fxbgEscKKF5sdG1BCoQOA} z?33Q{RSK8`X4%e)1+DljQQW!VM0d1ejcwAiw)yB&Z9ux=(p+Af!_9P1vdOc z`lGSt+C== zy4dRS<5pK!^;bfUY6er1KA6KV1(F4#Q$Np-bJCf@nJ-*=cq%n;RVAAYt*KHhU!i@& zP5YF>YfY*F3dZ^YEeK<7K9i4)4c%cZKf|-;+9-_Eqy7mJVWmL zu2zm}UBjolj1yl~OiYBXD=8|9x^GyWdUw%LY~iY*LvGr7Q%8|li9=0{WZdej2A3L5 z?~%&j6boNk-}uaCbuW%d&NNjf750<8Z5gCX4ZO`UGxylf++!-gTU!74q|gxQMy5kZ z18tA$!GVTWXYC$Uko;LYepwhT(sARr3F;)uynY4xB;=m_L&IJQ^+nMv&oE>Y~4#WP2 z^KRow>>C2n{V%DHx?a_vxwOFl@(vh?G>eU`Nb#0<3E@9{9QU*~nec|m3oIU-v^y^` zad=RqE{eg{>=v1b%S=Jj@j7ic5~wU?{0ACvJ@K*#GId!pCL_I{BiUxM&gR3xy||$|YnW>3)pTcaomYVz4@huqSdgs%K);$hVN1^w>ewvnY+~ z`ysKQ9jDeNsRiAe4ej(0rmsT8@v?2VQxe6I}svPuUwKCBWt*8*$ z!<$cThlU0_b{W`R_#E~4u7jtY?o?;Og{tA_YpR~F5aZEO4&|B!%bxdF9bYWZj|5RC2?S7WJ&zckPo#IM@d7$;4%phcJ*JSfl)VJjJ=kZu68RKG3SGP0kN!0?u~`jeHF_m&Q*MEc}vfr|3TYx)1-IS&&7y~dG@V%tHtCLYT78@}^1Q0&szg5@_mujO$HT7m ztAY+ynlm+y)SEpxoH&Qof|D>#KGBekk&i$wF1uE7EY*6m(+-SIWl-X+K2CA@*dl4{ zR{Zr%(ZzN0drC7-Y5ndC{2S?{>fkw}lEk_lpW@4NYehv-cQyY~o}^X*TRL4;Qt{Z> zD;HN_y7u*U|5xo-_?b1XjyY-~7`VGG){}!4C)Sk4-;_r2!HRGz*VF<3Yf_^ss;cC- zl}q*64=Xi(wk8QyRN!kByo_Mu?BJ&e#kEQVdxV|{kC}?U7N)nvr8oiOjnAXQ#{T^5 zOCzKkevvO;8hMBM2W;Ijj(c=}{cAza2Tn8nT^e8QbQ@=lHdj5w9}a{S2t->h&jT;G zV^|;{9o8TC>w9IzFHvu}ju|t~CRCO!UnN}EJ+?8B*-ly=HDbGB=r?_wV0J$~T8 z6LzbTmMK57k(Wltr>aSUup3|y6~}F7jQt(VE}`; zn1BEN!cd_?yww#oF8dv7&-%lnmOm%fn9s+Sb~?hb3n^*3s8uz=Mo%6pxV6#8-@nX9N6CGO&9fjG zgG}w#V_snb)%$1caf;Yz1+}xZs17Od9)!RtB->bKY*G{B>}xDD@`_m7EMu0+bWRB6 zl`{<8VkwZ!QoM!56i5^zAxSFvRONi}f7(%M6&BsnU?q;!$9r&ux8A+h+?G39q|*~l zD)8c1mk?cxT%7X3tM7XhAsQ?1Fi3LLFNuz#BQ;F)5R4Sr(-yL{Sk(FnsZV`4ILHxq z)en^&Gj*}C3{|W)(PxvdX9tpE9j`7%Cr<)G2+zQT)I&#*)BYi`$!zjnW; zq3%9AnxW5F!uKM)JxQagsAf*yN%q z^SROyGUlCH*K@*=XdL-m?j-o9i_mjGxlcVR+4Lko=W~v4e%`)0ZmCwUrrP z2fVy+KX0BgRA2%(k2bX1`^U}01vhUV!+hYf5!HAvJ;9yf>@#khK2(sycXh6GaE$x+ zuwj{sMty)8p4O&SxWHB@n3{kjq>(uQX`62F9%{~}p1q(P5w)bkOYyPm{_s$l({k03 zix-YNTb^AOb99)my3~@;@gV=xG9jD#@ToX__FbFQi8Dv2LW2-)ylk|Z`Zsv}s5H|Q ztYw@K9wj)a00R}{w$NJSEmzVd|bQJEb!TRld?37T6JreJ5DzS`yK+d zd(p20cEYliX~p4(^`dXADAOmM)TROgJm1YpNr-&9qP?uZ*EWta${-C&cMT2FAT@MI3?U(c2uMgHT{0kzG$`FEA(B!O;sBBkBHbc` zfPi%UZeVY>KF{9Y^StkO{JuXp96aW}@9SRIy4G6fd9FpMhMEG-HS%j{XlOV}in5w$ zXy|&tk0kgq@INxx3sk^Amz*^fq|wUyD3^g>Ko(F{C>q+UD6AusE5PrV4vPBDXlS_Y zXFr$T+ZURlp`GR_$wIZ=jlLb9+7s)XoJJiMG!pspc2}xDaL7aMTvo=)lM1i?q=!w* zVe9A*f1)hdjpYh`%#>0*h~SzdS9}70qQUZmJx_x}!{*u*w)iU&nX(VUjSp7mw!Ur) zr;2|N_}IrIKJvl;kQ36o@7p)w_2s79QnrygupTtDC-0Nk&OdyAP8TtAy55Py$f!j~ zWvGHf$b^`agv#t<8h9v2_xQnsk_jVdV?8iu-wHyBPcg~gs1I~&!3|G{_>uAVK`|dx zz!)`{m3!&~13vIO>4XcL8JSu6Achb#BWd9Z)#!J?9oC4dHsfiNPC+;VOr%i8Ey6Z` zTQ~=BhsPP22?e0~BZy@oYb%)kMG`))%|}!Eo|5urWxAD>$p+5t_E>5q90As#@d2%C zhGjY>ca|F*3F90VB=#4G4w#12Rhs%`opJ9MRWnLR5waPG*4_5TDJm+mW+IFoxo#tz z$#-;m?01@>#Wc;)?wj*QDc$VV1X6Zx_jW(ys~sQBdms#}M|*^Ymdi5`oFcmQQ7hOK z1-sIc|0WyimB`e9lt2;gNKewvK+LCDepbQ8T9YG_kd~eaNb|xhp@ZJgjMIik#gTQP zC4qnW%DUg_q0HCz7N4O}P02=90fB@&Sv@fVjb+y+X*XKz9w4TZo*~p%I@zu6k_B}z zTYom)esU0)cSrT;?qfd%eZg)FU2$SXMTxj)4l@#i9@LBu-;a5}2^FU-7!i-L*=qWr zIwYM4qdD@!^0eH{Q-pIZJ=1ZDvb>+Xd(ZEiNOUxA5o6AdAwSA?YupGdR3G&w0HPX( zvuVHKC?qq&i_uGQSaKPk+cCt(S~;F@WTOHEEz zZZYgBPg$vd{W4TtlwPuwl)K0_uSXVrQLnjoxaY@<{* z@apO&;x#EUUuk^QqVpVsYzOy-gHqgsb}tH15p;dZ&JH-^UJ-w;;nCOlhFFN|RPhF( zhq8BB&@ri=X7K}%hu^QRgXU$6=!Dmw+wU-lJ$=-6R$MUXXyvL?Skw>~`Oy0KC6ZS>^M8QcgP z)rzwh_7ufNzE~MH#@L3i$ZVr*5ec`|)Se+G6(kbs6x|71eaJPrj8sls-BliwF8Jh5ggdk%HEhcqx_a=fmS3c(;XIfL=u9TdfL~mMWxYZL+u64IB-%eh2qFA|? zRcAl%J%lPIBXNGEvh=n~ViGr0dOK0e+CM)VhEig1XDeo0h*Z~zNnt74ZhYZB>cgBq z0drHEP@tw&tAZ6T;B3^J&FW#*!`3>3m5wL1f@bK%Qlou@)s;?g7aV1!hX`;dAfl1p zcDC#SlZAG%6#5*s7T&RLl+){*Q}IHX9G&WNa>V}Yo}=C3^Kx3~mm#S3Nq35(U7ELI z=p-Iae3)ud;T_(xs*dn{*WjZB}}_Q_GR*b2q?(k%#X?R#@MS(29RiQV@2?_{!f+LDw8>A8677n`9KK#HO}jb;R&^ z)I*`=8twLKQLR8$PM~a1yOPzHTG@$>D_?^2goD0^%q&Pqsss@+mSGw{LEZcC#lVGI z<}cbJJg3m;Nb(kuxT)^C{E2){ArbccVFtG4A%xt;pHu|C7A#&ikNbeIvR&FO{``F^ z$QzSQ?bd91l}B-I#LEK4M}-L%GuSw=hF7#NMf#bScG&=Xp6ujeuZPvNk{xtW0c`gAre)1D2M@p#WukKPgudD{e~ zGRvacW1p^EhRu&o8!Zp?U!Z8YNzCUw*909NP>ZQ~zpze^Yt;LstoCT%1u?vcU;R*z zuvg?s-Y3BgbNnimDNC^`NjRTaSb4O1K%-c`bkA<4A0dYOg!UV2`axt6zu@`g#^tqz6T%1&2B zL`DXJ(xhdrvAe%ZBjYv$3g`qDiY%>M)QEetsgenGk)Qy4}Lujb+Gsh8w~wx<$2kmM@NcobfnboV82bSzOm?PNYc2n~14cNmVt0 zBJ-)D5P6#$|M3Dgx9WGbIW5%jaRq`uVT_H4JGZ+}>3F!~A_l0u*3QRe<0kQ_B`ixa zfIX<+XGEILRh`!5u5~7*SkW7w6=^Yzl0SN(SJ;2y9OM$%c9L$r0PWO`fQzSeh_D>82E!k#E@IH55~ z>rj!dg}$z_bzU7zs&!S3nszw;v2+ z)>9bgUyn;cc6e%HaCO5BxpfOVutwG9AcLvsde#_9-Z71XNDO;vwZzC`-RzS!R)%-k zvez_mToipY+?0{MngKtapC?e|NGh1eN6k6De%KTB&5CItmL5V>k8qgQwR%qKjhgg4 zNSuSplL;g9=%y8|Kn`cVSb5RCOIL z)k(~i+hi~FvXP(Fgw>CSJr9(eH6t7OyGyL_O_nX-Hz=mYqu=G0I>FXnY;Gt!g_Rf3 zk9;=D{MH}0RsNxp3sUTOVZB5Rw7kME z%jtPy)AgG*ixe443lzqx)>0LW)UlqDmc?@EhMm`}vz5CYm=-+@rV`8{GWmdCcI8PF zy;=%v1nGzq2dWu=L%k07#7L6$U+O^->Wqq_-L9QF4;P# z1E+h)sVhE<9_nG2Ey17lO-cZ@uU&qxtf#99ycVZYzxM$1#KmEb{Nx=>^IcX(d{WxJ zQz66xTxJ0U7cb3%qAIU@peHI+aA*eAnv_uFX`4$r;qe!Ilj763=_@>Z*Lp7Q8G>8L zsze@@DIc8|-NMVY`P9KLopbvH)9hwF1yg$DfrB^@YZYKj7T~EThKj?^dW7nSEtWSj z_TWsY^-wo%r6#{>4iMCIF#$jE)Cb#T{v_W02C=jeXH0T(cS!}lqGCL7(AAYXaYJq9 z;>6BNQzamCs;gqIkGh^tKsN89%k%1o9?)^Wc7kNfRnaauL$>S*D_?6vaBOc(gEC-s5y^I3T!ULxi2df;wK8Zn-TXzS>NQffTmIPni!^S_h+#1Qz9{Dc7X#oysRme~d#|6{zWP0+$79zPNk zLCb>|h<=wg+%GfBD>DH?n*@Adz7O*Ecus_yotAd5mvf|H%{Ba58YwjsQE>v%Lu=BA z$L?%iZQk|p78%C{{!0wt5A7ii10y5Os2@*-?ojplEPhRRmLXTF_8~Ghbfg<|o*!F7 zR4hT@P>^gM=NAxDY^3`nMK~|(M&mUx1 z-{u@Vhp=i3Ah>>Sox%E&qOb`r#^mIr!phyS#BZwIR-|de$uDY4XFK!<^U3D3&7K&D zn1ltHMB}QPt3PMa{k*0@DWY2E(z%c^J4v_Lk;_i|M1RjWl=4RVRV$7E2I z;DSm>8*S3E8_Tm)=Fb?o4?(qdlcMezyKlj86S|n$OdI;HuhMXYs7&h}s#RnVD@?`$=+@CurXYsko959*qN;VcdBK1;3r(C#r7ni?IX zbu8m8jdL3U*kE;T`^A;&D{{5Q>3&CXs@t{p(*!s-MH}9@u2~~8Ui%o@spjsr?Zt-Y zIJ14MR4yqd&l&U`WQBpKnQ(@>Lo@mLVQ20`aJBySxyM28Sfc?;=}lzmXcdI{+*3f1 z55K)h%wP${jkgEYr-v9nrF$Kc1dpP_#KlNyu}1h-FZbezdz1?#y*&EzE7dG zAB#RigXUrmCJVRji7!>LHHhr>6XD~xxi9eo4$7B!WR8A+XJ-m- zNs@3)iPtWm8Zst(IBj}T?$tQ!9+MbTztFGX6lr0$?b;7z;$+22kyo82da-Gw<8t4T z4;wagy)+f9Av2%bt~E+T7t{0g)^!CnqBgbASSlpStj3!h+Fhce<*Uem$dFYrRo-d` zO9U}WP^Q|5W{5a@ZH)E3quFk*__4W{y4r8CuE=ha-Zqx&rU1pg#Q-yIwsELR z&S2^29$z4lS^(32YzkVW3I9IC18l5+V8C6;39jc`%ekZPw>~{KYZ~UYTCOd6SFMD_ zrl2;-Yu7fuxHu;-HQ!9jtb$6g=` zUimlt^iyEMZ>;s{HZ)Q6!jicJ3nanV!vkVx4~0GrK#k?UB07!PNXq|_7s)D@ptOZ2 zp0;29Dkk9&4;eUHj*`B?BvY0^WHK;tefhigj_l_J-VNM$F&_hYbh1HDFhL}^*?xC- zGbCkCUT7K$?DQ|HTiB7OyzxFgu`VWA^(U-kA+rYdJviv0;<>+>jn9~8wK&^Ud@0%weZ=oJpE%z~Qs{l^)}VlZ z8}Btg>K3RQzjm9B@!Bi2(~vGnAetTIIXeHkL$~>-U%x&z)$F{)RaikvyvUXd#}jBX&b9V;v;Aqp4Y0NF|*#|EdSxDLb>Jv~LM z+rSdBfg+TT-P~wO?O6>fg;)zr9^ZNNaH=MV$U-jVAwJVFU^dgRJC~+n*@O+w(lmaJ zQv5esn$CP>=}%!n(db0x7KKZnO7F_G3Vd5dU>R)6NcZ5Zk+Jy$a1-GxCOgz=zcC9h)oz(Pu z+B=4>w%zb&H}?y8og~Ujaun3&nmed23dY17($n;-J1|s_TJ;LC9DiC;GO`-J;4N=p}R(h9s;?4PaRB~LlIE+^L0B|e_ zODXmnCLM>WGatNJHS$UT4$@~4RA2a@o4;F{=PqFBo4Ev4QmMvll&w*)N;Ww$9$)(#07q7i_A}f~;46iA|VJ zm2h63YO?h6n|{HUlvvKD(lwgKTPsqU%USugK~hbUhjpbr(@5+OTS%4OuK&{(P-Y7> zSY^P=gi?ZBSaH|92kBh~L|GsFT`hrF!a>n1eg|#IIy#CWaB(SW3Y?r8j`X{4ftS4l z@{gNw`2I011B+xm{jSsYWdGVCam`{c*LZ!&NjP`Z2aeB)sm5_N3r8KXiSbWWbMn_i zZ+ny%i&iM$X6K$&l$Vj+@pm<^D4ZYcwy!`!sgaLfC0{DiN%P-SlaCHdr2&mEUafII zJq7cD+s#42hG3A&TzhL*{?-e=T9Wcr!z0)_mI`-N|LBSL&afVZ3@|LFQ3z}WN(yG9)E*IxOxuf!XyMP}w!O_-d^_3i>+%P` z$jFxyewoalB^Ay7h#6N)rF~V3XDrWRwX{1G?DAU>91CNxrSuRGBTjF#mXRMWZ5Hqe zMXKIw_VW`M4&RZ2#{U4|g}QLnwe6n~;VdFw3JN$iYKTcV9w}fxJuE6RK4LW=O)tk& z$k|g+jKT$?E8QU5huYk0&l3N{A0P@`+&h#is>W#&KD|>u3Tsc7=OGuC2vjH;_!%+J zfDM6-@YmJVTW)JkUWe5uzDEqX3OJTu)4yBZ82iinz_HEeIcesVG%3^s>k`i;(K>pJ z>wg1%{yn3efgJSNx5S9KvxH;0h>7@_Yyg#zluM=R_3M)QMbD8*I~V~-*x=uAS9pEp zkL~SLQJ>jJonU8U5zoAN3mC<3-vqw}+fBYnxKrh=o~Hj@cPUg_Z+89a^`|D;6%{<# z(~S`h_rtR)CmQ$X^Lwjb>|_*?n+Sd zz(X&|e|Kyb)_>E`5cR3{I_GFg{6`+q5&=H@yX~Q`vpH#hyZHXMtF>4Q5RU#60tWd3 z{G7DZK(0W;G?u!~JOain#CBMlgUkWsq!x{V^x@^CyxQ9J-8E_$Dg1<;YD6fJTFK9G z`t`o8>83$JQ`O?vS6bOOg@3(2)aU_lSQvmR%M6TI41sqIRJViQV94`)0CB1OSGk9Q zg!D+aW6rYvXCd+6?G?gov*1z!GZK2v>m+0+GtWz7QLpxhOu7dGi$k^F7jMT$m1~=5 zwb48wY~(uD4ksLqoVmB*%lPdxQn^Q`=LKdsLHu1Ncc(Sltl=W3=q@G>+}(JeIid1T z_}Z*~42CjtpMouDk;B8`dFd1WGsCPoCz@b8CJyJTSAYV>zo+tFQI<8&nCmPG<#I?b zVjPv?;(9dq%)%+k{KH<|n=iSRc;u9vyHf1xQe0<&N-yKbMzlzU&(3S(EbJ7#Wk_Lq zkVcTaV^ECTvLKkcXA8fw#bDV?;`56Qd_gWJ6~n5u*2=rxS~yFXE_5DrpkCVD+XF1{ zEq+7SoEzribi3`ss%6p%{OFvJ?!J_zNAV73Gevv8Wh5Ld|dn7xVuv;T$i?A4$7A<<`=>ft6JQkFP z;M;O2GczNCsumMyXGwU^iUo{Ca`o~S$gV0K!V+LHad$I4UA{mC?PH#XqnwJZw7dwB zvOsdaYCB#@ob#!~`6?JNxkRxUANx1XMx`6I0X^bp&arW24t9=1)_uyj{Lwd6pM&bW29CVvsLmoI))$%}tEgfksuOe|9Zz`t za~A&!lb#)Tw92lZ4TyQ!hg@Jr2NYNfbcG2VA=Y-<IhDB8Epf`d^&9)j7Z7Mlb5lnL_+Lpn{NP|URcUT`$ zF`3JlEBwsB{FSmoiEAm*S`zj$OD|n&AHJ;PG1p&NShQfkqKL&>kyo2c7TZXZxv@Qn ze-!B;_G_@tR5(Hd0?E79iV}@SpIH<$pk(B29&j5RmphMurFyt1w{TKTs}I z41u4e^Ed3pNhhJGMd?PezSm^2TUtUQ=t5oT@iBZFer(-6uw5R+0vl45s{^~zBUzTb z*S%Ije339dsf4I1Y%ETQphwYi^h3?_et6g^S zSw6*EAJff=?lP4viJ89As0_`|o}-OZ;h5ubqRp~P7jtLueKD#@2KRCVbXyh}Z`xwKzZA++aW9FAw z4bRvPAcLZ{T?Gy?T^!Rvt;^}Y%t8k1I~~(g!;{Bf@?RD8?5>yNwx0@k;{WRNf282V zimuJ+M?#gArw7OdKS_b@aLGK5@vZGyOMWC*^xHwFf8#c#S$bN-OpBIFJ{FXZHmoC> z@crmHTL1QoDgXso@0>I~UcS9cF>@L7*C-8UP&_zmivl`~u9<+Ia)RE1zRraG-}9_L ziw)EKJA-|FWnU6k?zuI{$z{JC{C9>n;$v}n`4Vy&%l@Tk>S6aFJC$Vkm@IJE&Y^E> zD+>ol#A%xlzA)fPQp9Ife&4%t=eLZ?zkX|ECnvmeQECMV!cilA zyeN_}iLtlfAflgS@a@6khK55+AC%WVaaV*hGsGs2*HtzlXRu*d?<%>!x};)+sFei$QH`RsWx7> zR>4EiqmpF{^#K{2ybx$Dgkpds86}2GVf<>c@pmhHSk_o!b}eG3dyo{A{d6+}`Gd!< zE~^v6(UKO2brZ>o8&5ZwNEDW|^UV|P=m^N?Kz(NgE;jUY6}AaTu7LEL`(9qs!CE8^ z{zzeGNJS%EPGc#7wuMF(j$TBjxl^^G25d|qR8+*6V1$T2D^Jm3>H)|+J-T7;#V~vJ z@Gxd;MZlj*gZdK#+mm9t!{K}(p&tuPpA0KEQ$AX7O*W9MuCL#6{xYV(eeyCj8O8@<&ObhqWhKJLoqH|pw8HJ+v4Ggg6M zOCjqf9Gi>-#X$9$Rz5O1h=aN~N%d$-EeahQoiM@1up7+l9 zCffJBPgq7xHk1g9wO6k%=2?(WfDI@U0^f9b4o~U7OgDFeGiyH*?w60A)*wVGtU*16 zJDvQEB59#yFP6fY>cEem{M_mpgUSB_(ayQZ!2dY%DT%>1;h^F04ZIVw^%?o-NGiH} zuHJ8|QbO zljJ=aif^vEnODebb&^%UcPb!Q>2&I!eE(ElnEDS^z{~#;nHonq&#z7@Tora=JLz|V zzi*-JIQ&^MNiwb8$_BN0d{`22&?1j_`H%B~(N>KOsafY}<$?cvYsIRA^=be^%SE2p_yC>0aq%Qx#uQY@ZqA~y6 zkDrM!kO!X2eGYxyU*gMae3nML{RFoRap}t6quGnR@e`fA1z+C!8S{QZt~2g7SY(!V zY;<&Z!l`M+uC{O>bQZ>&1xRoCL9OTH^@k+(y>rpxjM0q%WBB-p7pNJ#n-0%T=sq)A z-qS~-Iwn|NxR<8#sI{Zzo#`C%J=-%kSFTrMVgOo)=Q+ok#*BALvN^PaW`0v7-9jD1#*_{}vHLAwlw8QdLfE95?|9=QR#)laq zWc*CXBQmcf6Uh%q{%l}N!ScuGk}{`HkH!E3mP4r1hL%uzGB}(`BGTCq3~P%x3TyuRHmEi<_q3Nx(beb zj?;cL?(zJJ>=5|Sfb6*tLAv0HFx}DAJJ&+b?;KzaVwHT*0T!f;IB0r zh|#{@t1d>cZcvx55v&oDO4NT_M%EVFAep`B^lb$sJ<~3Gwb^9uhShjwtQVo7j7%Zk z5}9@Ojm3rRPj+7My7$ryB3eX)4!@U?4&sleOh8(7dp%IxB#SF^Vp(eD`ury&8;I!t z8)5RR@|*D4*mG45%2n(3bz0_J&3Ry%bN?nBsZZSXRPl8-`E@HxZHydOW~2*enMzt% zLy@aiTMk$x`b$y|EGSt!N50g_G=8?X&^J6<&P7FST&w)qRZW_D+hpS}I)!+2ZgTC5 zsQ9FD24rLrR@X3QcVWs>mq@v*R)G({qM5K|gS*c|s4aAGHED_F)J*Gmb=*x>CZeyb zEUkfjbIFD#=`Im#Gf(rv+}G6Zs+U8>#hsS?gTHPI{bUsLg~sz!KNfT6gQr41)4ft* zP@q4KlocfnPon=U;+X!X=;6~hUCiCW`=sew_u?@&eJ$_R+rr-z$-zB0ea(V0B^p!T zm=vsbVYm924c@_lixz4Xl_2uS$R+9sC=E3WaKy+Ng(+?RCKC_(3GMFgrinOP?H5HVSPmNFXw3@ z^f6t$t}(R8D9|?AoNf8Oc2rv-SJ;;b93QkD=Xgh6{tdN|Xn`S~oAETye?Z+ITF<46 z(Uq5|N$l;^;hEP#ZVY>HXf!Q4<(lT;c=5uK{v-(lLzSI7XAbkfAfmb7zIP_g&SeGE zzsw*!MP0Ke=jtD$lgAsG5*gQX1#q(MzH4h9ff*u4L$xsgW{Z>ahS*wDJo?)9D`AMz z5i0OyOi(DSDgFwo-%G1pJIyNK0gm&t>%Krf_xwiC?wODX+7CQq zEQYCJMlLsM?nGoN3knUjRw%%XV+XaJ?pfK*#b~{2FDWT4CaU~kHClhg`T-xLT&}4K zTBA_n%x*73tfNvO?Od$dc&&#Q5mc0JAi~{%!&P)mN7Txa1sWLewR6aa$f5bV(i)F!%uHmQOePUUcjF+<&V|_$p*yb>*$%g~z3HN` z|2rkPm7Ox3h0GUFRt?(^hXewR&;6IJ9=qwxe_OwpkVeoBZ)peqxLq7TXGT+OHcwA} zou*x}M0US5GE+3V1~T?7f|l;!okqc85ptIJbfHQdPE0RLcSoD4Qp(ioUQvK~u=au{ z>g}XilOdcJ#R5?>7oTO!tOwn|Eq;{Jsdl8$X`DQiB$$6)hq+hs$Kx+8o$`0qBsGYF zT8goB;<4)ic@-+7b*}cC#PxJssQv6Au`sMQU92|&yQ_l5WVp-M@tBdcK{dkB~& zG-%}Z#l;$2D^zbF-_9l8&lqjs%W*)K0Fq5&aObO z#q;z%8{hNteBs~FO+fxi0EO@Ab=a5IFfrv@+9GM_$QKCXtpZj_jnmFemEN5WE--vJ znI-I$e4l0y^#4RMe&8N|yYPAS8@n65)+WPi1i#av$KU5x< z)ye;&cq{NIKY)v;1#GTWnK+v465vq#6JSIBbIIWkiTtZ8>oYS>6hW>B;g=VdSGu1 zAonPQfZ=oCO|yhT-!uG884xznQcN0y{SlZ=6C)jicxx8O z!+Kl3z0Z-IS5#1Vx*03WuY4wN*fzMkY`^h|NiBchD|*Y<@jYMtd)|lMhWDH`s~}-- zb8?{uBEQ-7fy6sN4(zLBX}T_>TKqc84(Y%3?YfA)qsox~s|?d5)+LjGcOKn{#X5?m z`7EXdmK!1|qN&{7ynOck4?wKkZkLox3cNv zEp$iv?&0h^*F^P{hF&)&HFk1*tY&U-$4W=Xlz(=5hWesz`=0CgvwjDS6WYs1Z-K_C zmaSO0OYzKes~;31*1{gf5fO@o{&)(iu58U#u7=Ph0S(`390M%Y35rCWIhJzuWNl6` z(DssxhkYZx%WFe|UfM@247xzeSkl|VhP;R|5H%bW9MEelVAeAB<4aI_<4Cf~9be~z z4|!g@+5gZYWq;tWq)&542V={Z{h~|hZCvMHM5LL@8C*wHD+)clDO0RYj}+UEP(4Dk zd15Iz%%{&xXNGamg|74YZP6z->g3ign~l`XFmR9DS<{MFct+f=ln)EgynTmFGw#Zo z64^4ewLRwFQ-Ae;(xADeEQo?wtipbGP|O+@gNV#`_mpz`O|J^Ui%qpmh?uWAcBBYm z4u6z#LEpGbMa=NE>Js^7hOcoQ!2xlqOMDh~+(zT|dpT1iiAK~JuaEb?QCU6hjnhqy z;;>fcvL+R*qdDa_`=p?*f&27PS0 z+>9x*xFz_w&%o_bXBd`NVzrvl$-RHi%F|6j7g^bTsO~3RgWGhS5!=>JSR_LTs-Dxa z756E9;bgYLXHe9L8`D=KlvIBDrs!4-f~r^|!5XPk7iv-SGTU{Y*=m_%L`?>H2ldj3 zAR<%!GA2f?Z{0nfrH@LlDK`J9?`lWkW=tSNImnnD@|z!z#-5cfn?ggrFkgHI1aX+g zD!~Z;5X6HQ4#Kn0#**`?i+zZ%vztX$rzE}g@gcHTi-v1cuB(^Gsco;x5ktPTfJ_@$ zamiN_nLZ^CQfS71kzKuTF0$)yA>WlXfUH%4I=tb^ETql>|9Je(=@H##fBanWD?ctj zQRk1Jk&B1Bx>`+^c=6G4T^f%TLFxRzin@UW{84D_t<`_eM04~p+rW4~{7am<4>AGu zGJJM$sF>5UK0y6gezdbD?!#R5ICyV@3 z1^)l52@7Z<4xg=*y>+W0`EHrpJQ+(j#Xo z`09oO2taJWqX7;2-ze*U%cQ>x+JEX2Z_Qc9#}A-Z^Y7N}Ln_f*PIds<;p6M@?)08A zRsDgR%%|G&eM>Gb3zu`U6&!w*MCRxs@87#e6=@AT`i%>_g{;iWmLrsro%z*MN|7lP z3|98YYEeCsY%H{}$t~*Bjp_g+0v;-WsK1TQ&#YPXZU{A>fG?~ z%8r~-hdX)yL`F~ZrNXG_DvQJ1PPmm4%|xCqhq)tzORn zgz7d*5Ghf`Z}FA^6ELQK&yefJ!3X#lJbRqGU-G0Y|A6MdYvHy0Rlot-5-?$vriu)O zt}~u}J-FEQ{8q?0m@TD@oJgsSxlC6Aw!o{^*L$$X14`O3#cz64z&`{--sE?0ZHkz=$kNVta08@XyWE* z5|gkv+#0<#bS(u^E=;43j5kE`SdTqZ>>TSZCVC+C{5N&0KL0G33du(wk!@!wkH#4j zRkA(~sPZJd%kXu`Sd+&4_R+Z=EzLszo)>Nj=de-adPyPT@@TWe4Oa)LAoKlS#X63U zXK8~1h`BLuigv<{`$DB{(xKj2DhvpZ?WZ)uTY_d5<^!@5NA!)tg<}0 zz+LT<_Zl$VS5=y@+n%R1V8R7lxf@0p5~wpZnoa-zjHuFE2%cg58Y6@*#n zKM}p{-~A$~LBA?~e=wg+HkF1At_I-3WA1^(De00lEQp--HFUp83eUH0?!WH@G2c};^1`FD)HX2;JsUyda zU&cNh1*kJqW$b#&SuEWf%p?Muxt`~l(Ej?|O3E|opU~2AQ(YlI6!OrH%%oAA{qf^542=tb z4M4ZpVN-*`^`OjC<@ei>c?!Hn6T3FPRu<1$#36x04=&^CFJZW#KH#8NgJ-*I!nA5gY?-l^gX<+~hjd z1mMVE2;;(1ZZRH32Y86^l_R=_&|1+Op*5)&fWT=Ga*Joee^%X!Y${~}O_z}WhT9kB z6Q#lg!ZOCWr7Us1WR`waHp6lw+I!MA6K^e6vQZ~?`>47E4Q{Oj15~>zXcbx|j$-7c zeCg5h@V50loM}6_q<{Oz=jPX;HTN3dcuqDe_KnOxOrvV4n}0E3O2#KqRwlwaMsx-6 z7JyXFG-Yn}*t!@Z3jB@_1c|CA$VeO<8Q-VLh-Zp!(xpSwg`JAMuYE#YJkYAsJvC!^ z`S~nJ$F5Qc8$1>5sV+=+Q~Yk=bbWV88P4v(S))2}-M*qO;r?#E5x7-#g71V}r%=;Q z-Y!;SC9f^Q8U)CS%?^EAD5s@~xUDF$zvr0s9lj(V(78+iJP9nQo_%*u9$3?L*Nenk0a`ZUn1tz=SKRVLZ9`*`UauDA8T_z15 z`%f|{$;><%aAGc5TXz3)VjjGWIdcwcEtd8>0oXVx)NINOidUcJ$36@})xWlmom&mR zw#&%UE`SQF)HGm{?^Ab>=buoRM3Z@KB>)%0({YNK!CHDmXQ>9?;(;3}c?%1VK9+F) zvNKnm7A}eMFvnU{S5smL0z= z3jU$}91Uq9k~PvNg7|O7C&_DwN(SXGW?RP=KK#B2UJeAK)IG@Ab?K0}fub$ucoAd% zj=T=CN7z-LXwz&{3XPOIG+?D!BIbi#U_yRK?*|Wg04OT4bs8TsDB;i2zIpX{Ixuz9 zgF@7zv_Zi1-BZ>c0|@siS7ilVeTCfuvb2k6T0|R0gEJQ;!~`@iV;abyKYIaM>iuH~ z!i@S{^%i`(8Tc5oAcjbGFmjQM&$1d#Dr9DzYUV*2zhOx>?vnv}j4G!e6e{}2&bICs zQ7kU**xVzZHJbrXWr?ES5LtJkE{;i7wCt~pO^P0|9F%PmHM&{35cg1Mp>!GHSzPe5kU|HI|D&>tcIvJL z40dGjSdwo35|U&;7-L(5(BIF=UiweW=@q~~W(RnXzosETbOSH;%c9X<#>N;an?!V< ztZ2oZ9wU+5C-Idw{UgCSgB4=wK*K)~Ax^vZ2S#E0Kc+0f4FnU#-aoL>h-`#~^&B|_ zd|VEG2zc#M*9S+Ts5#qmOe~{*+2vUQ_$JMGC@^tv5t6(SD!5`2&*tL$~tZ=({`+%3lGU=uI(YW^Hx| zP!*7#2@rw%PFMWS{A9|JZV3=x40F^QSd4B~W9kc02bu#VD$DC5 zcY{7AYGVk_%rv$TnClhrfzR6D@d0&8Zg_`jmt#~9!b^ke}G+R?Q3Ytv-ZUSWRE ztIa4o3$;mN&RvZ|C?QKswQCi;G8>=n?YCC^jqLhA;9fz6v*<%NaOv*3fd8Cgtvh#1 zOcQ+oyIO%TyDOR)rrWtJ@PRo`8_+nnzWquk!lmfpv!(b+mYi|$P+&H`j9Ru4D^Oh} z`b*J-;$i#`K{I|JqcV9`0#U2AaNy&of3yuKaJ_!^;uTNaZRMNL# zu-ym#|BymA3#`Skwf8| zf&9+El++e5Y3&s*1fNj-r1$cM1$e(Xa`Jg{vTMEYID&DzGpTI*Du|n0T+L^j%GRj*1%Ul_N4dTtp!>m^z`w z-(kx!We%UE|4&Js=Sb&XVYV5f+KC>UJemGnDNHeBo;p(s@yq1mpOA2Lk}yWhv_XH^ zubgZJBP6xLN;*&KkCs2EnrbDjPaCUlXNzk{6En$_0yC}y1K8&>`rZQX`niODC{_0& znC|2XqarpinDl7G&dmIDyQu5b*BV9Qr>tMIw9-CksWkXNdy;%j0aAwAz2SJbtOjCLm&JukOH9pcY)OSPl1&E=;G=#h4db5Z$@Zj*7(v@ zxr*6LV3KB{zGroH&q#dh6Y)!1AZfB|CrysshxN+PV1_C z(h7-t*6-Dn{d%j+^7q?f+k!^Qjn&V<)HFm~T)a8fA}(aC?i8Iyca!8~?z9u55oomw zcdYz}A=alpL7oR!l&x?ZAtx%$zYU$5WFG z*JK9#^5zdZhZvT**SrK05VdDR}Ez3ysB3swLooQLR{wptq&J_)4WuL*CL2ru6(R3ITsbd;x zmpCiNUmvR(kwU*aoUvVX9FL~T$>PT9?kgS7qMXIWYs#L=ONOXaCaU zE}j7_d&GCBR*6A4HzUUmnFWZk@$2XeU~1fR8aeNO@h2Lx_G`R;b&zNxiZcuiwB<%5 zTQKP9>I&^)gS;f9s{?r8GqXSkAu#&#cMVAYu@yMo%^&;!BksK8ss7*p-#BrUEqgmw zp=>GZ*dr^X>>UzPGP3u~CVS^ZN;WBb3yJJdMoEzsGJelP^+xKgKA+F`_rAUV=+^Dk zdF|KrysqoyZgs*dKj zHwpz4pTe?p>}LJuLd0YnJuy=6ee^MSkp18+HHya$C&5*7A-qNJ$4jC(U*9ES|EqZZS~+|QwZA0Su^w?y@?E(c*^hZLIiVHfvi5mI_&Lf z+4nM}N`5E9#wqR3&S~qzn7&XV(AtKe^+4tPPq%2%=zrh_$(sP`ThpC4^*d~UI(%%W z;?_qHskr^;?*FqP(%bm`i;Q8pv%v3xL+iK+-Ko&`WOb_|IHYsvrllAr;~vS?-s0I` zfDc;GP`8;tJmt`XLeaW*wv>_C-5$UlImIlz8>t3w3U(58mBT$Ews=ht)^ zWF1@1nmAx<{7+r>#11d%cjfF3ok)&4X&-bp>X;1k5c_!rI&~p&7Vt8R(EX+?tFIA` zuCTMGDcbT1!w}L~dU++lhx+K3PX$FqN~kL)>S-e#&_lyWf$RQNvpc%%-&#wcjhHzR zrjYJ%x`7fRGjZj_<}v7^IH_f`T2-ESkI;$_Z}0` z!Y}aU51TSNfvE>UD>USby&2b;D1QAld#uNYv3_Y#!s7K~XP4(6OX*l`EMuOfC}xDmL8ja1}HC>>g?QBX3p^~r^t!5Qa#oTpM%KL9Q~qBr<^7&Ln$2ZQ7FB< zWDOq%LfJpJXgGk;eQ1mMBaX`bMAoG^2aKvmxY&OH338cgd+l+7wh@pjFX3B3ItVSl1vd)$uvttUXL; z8AY<=GS+h&96LRYEy_?MY|Ei;bUv2YgO^GH!g09_BR=odV9et;RpEx&VNr>JyBmdv z*Pe8@i%K2dr6vom22cVrsxLm{|f-q;#w!omt8Nu`A*Q#H;8tLY~k zP4uM|4LepvH8U7nKg^}O^rTxstTA|(@Wb{&;2l!}SNJ|TK0B0A-!zeXLVOm< z?ub{vF{>h=tA4QSVFor3Dpp^e>dKuaMpnlr;wnaBpupT~C%c4~d&)+7PzB&C|074E zUNQ5wFeZi#0&M;H>_g{_wkS8>V01r25mJ>pQ4WH|Uck$fJ^Ef-cBrrbD(C0%j4t&= zV6BQCF}6jGix1slXWZ0=07B0aTlF_PVMX#F{>JGqw6kB`C}S2EZ?Q$W8Q(Y{j?Icx zm@vrL*nD}h5}87GJIsni{7Qk*__eENu3yYQf^6fTe{qtw9(~JHV^-m1srvr?`$z$p zo==rXrFgKD->hTe#E_nw1jW|kd7lUbK!)+6;Mj5@Z7l(*t{8n-Msx(3fZSdbC_q#? zh5v(Mih+2Vx|(JT5@H$KEM#p`8nl3@}r40ukayDXsHl$U)o zCYoM1tezbDkO7D?Y#Jgw)Y35JWZWfC{yG_Xk>h~J2JW0&M^pQ^=f?M72A7X|?xj=s z+@_tbvj*ioDQu$^qcZR&OUk-8b6%WoQzXQo1Qm0UTaiCjP)+h-Gh(m;hV*9rXK(?$ zq>J?5?{jeX7A=m*q8r-P7$T_8RM((-eW3o(Z7%ELqt8=G;9a6k^ujA*!nabJT#rzA zoGc-=HP}j){w4@*aRRm<0knu#`j$f0M;Wfn@JB;P)njzn8DjV{riCS}Av;{L2%aE6 zUI{}7r%fF)X7F;kCA#0g`_`#-#23%>sQL*rXMx)iYPxfy_!BVyn9yUS;J~`HOL~>9022Ht*U%NyO0;8BJ5^U%snJf=L23%*$lmf0<5zkRc)D1nTKx7tar%1BPw zsTs8WCNC{pg*YboIg~emU7<}TJ#5aoX2^WQP2w+YQzDldM{_ViNi`=lAI{N!qd4ZjU2q(unE%AtM9SDqDeQ;QFvnhs7LNm;BMd*`>5VXQ>t zAV$&9?lDjk!Ksi*{Y4xh(&>08YA?MBNkE}yap}tR-lQD)<6C5}9~@ikTcV%@K?J`g zW|o0SnC(~tZX#TXJkOg`nzQ1a zq_;8D4aPU|VV?CE2z%riJg1aUR2jw0pnMvmm=+|8e^CcR+nBw*>z>pM_z}V+<5hyv zxfSJmML`Rk!GO&z^J_9SpI<=u3a+BC%$X9pMfJE0sZk@w>KhkOo8y!XhVGmD<}7hA zFf*yqt9BQ((DNhC9tKtdGE8pguHZG(m$9VwvszbAU0#0vo+Ikhp#S3Ue0%3tfrB2j zwzrcNN2NBk`7FM2Y|3-Aj#wgMFQi}&7SfvUo?Uc+-X zUCy7!LZXlKht6H?h>T0T)DfDSW70X#A97+^MHTh!A+%i=3%!Q~6qSO<=_%e95y>dl zf{I%Y>wQOr${jj{)S~Lp!~1g$@$Ev*GUvn#3~@67)X)5)fd&cO%g@8!q=If=9ig7> zGD_?%gxf#b_`!x5qDotR+Uph&;;stCEV8T>R$-^t(ulc+!29IPmkKL6>PagrRr8C_ zmvk-l8tatNksI9B!FGe9z6ebJND2klug=;n_cl~{jaHS0C>7Dm zJ4`5uIdZx>!^p69eMlO-(LuB<=5br?kcr_I#sq-V`|da8GP9KC2;8}HtZO3ypCyDe zHQkUuSx!cOjOlEGbb)!xFw+GsEkZ*?1Kup-`&DJbcYR}HO0s3=AR@SuXNni9Kf3WI z%EdVHS;$JfQfCQ^bc$8eh|N#38tr6xOJAm`WzNs*i`2I5crxTSpNt0xacQvyb@X!- zzVq_t0aPlpjKT#HR&rYYYXsF!{!be1pv`s0+@Itdu3>jdbk@-)Ct6jXbbo{>wBoNE zTw;KozMM^4jBER^9iEyEKp@!lX1kEv*(!f9aUD!>7=(I7{ieGU->`9Yo@)1P1c}mc zHK39m-y1f^4@4UZAYkn}b7WRVi9%GFw6lQ&9B#)dfogNt!-{m%IS}bU+-Z7{U+W){ zklM->vg_{toL+4SH!xV;w*GM9H-D%kf~zU6W%A@n22mrYa~(KPS0!Kxg&~~cPmOFi z2T6o^G(kJ?Kc`Efl!z0-ksI)lK!;$`w~iAK+#zBUKCX8!2av9hll7EZXPxy(qVpod zr!s@2FQ=|~JAi3j;Jj)9p5C0>so&`o5Rfd0*C!7vr?GmZ)}3#SIJ0B8eYgLv?lwy&dC z(-K!pxVsRPmRa3m`X|~h2|!e1jjj693^zChPh%jDA_;#)67+&^2@~X1DLkFOHmV8i zm*LNXlM_0^?tA%S5LC*RMRFQs(&d`D&sv%Izr2u4+=&)H%yNIwm^$HA?kVa(sx{>g zT`4UHLK%gp%3d+XRu^5a`YgpGfBk^5n?^m7@oST}M6pmCF{#rqWXtXbXe+K$Gd-@? z>0nRqsTPUGqfT2y2NR^wOxTf5UNV8Oq>i?-v?r7}ui~>!3i+2nkU!Oq${Ti2)P%9K zbyT$&Q5AW|ERX?ad^N9AH6Xw=)Ye))!FL5OWrnJZ&bM^g_6xm@WIM{4Ho~fi^Jes} zFToF4zZkv1i2S7k+0YCc=~GnARi_Ub(kG07j`Fffb&bLml27>Hxp^bKs*4&*j%|QImpRb1i&ad_l|X zZbNQEnW=_B8+?kq@-T2`35RkUSY9KfdNh5jl4jH%<) znT8axd~KGYGUhGeZ&KiYZuSIq^OwnkIY2S!jgEI(70R8*`I)i?SBpda%`%`(GYD|Y zl3V2?AWs;ZODDm)iy=S$3gB2rQL&J7Lhk{ZKY*JJ;PV4tv9|C%6SoAl?j`3lq|!^(m0M<+ zb96hY#Xr~?U)XEs3^Iypn>2VusifGYRtQ^#_fFFsY+^V;u=pFN(JT=D;! z@Z5qlto!W8bQX!A`0e5-K)MIlLYI~8-cYh``%H+3W0Dq(NUr(F)^GjZj#_r}By3`? z^sHa3;tP>)=2oEEkqyUGv!g+$ubV%|iB2LAN?Qf(Shcpc23qo7_Sb0C=LiW10J6$r zuvCSUuULK|&uAI{nuZjIC4ag5C?9M{x(XVzSDD`VyabZ%wD#rq&QhFkV827n=EFh3 z(_bMcLBXJu^5Dm%!^mO4JA&FXb3Nf}p5|Mu@bt!1fxY??B*8O%{8p6K7sgl^{?c&$5@EgncBZ zRvqc>q{lZ;PYn0Q;f&hb7D~4=J-)vFjN{5F7HyTt(7bbo<~P)&)D2$PILA5ZTzKUT zU+ew{xlkvCybic{`t#%@xEPfD4TPXNKtd&NbgtatSOYopjJi;-x8l$tE1qM@Z5M;= z>%^hVG8NDmIk)Occ^juw8fCZ58@p@-pG2wmMDjc_n|Qc#`WYX4o(=#s$@YcL;mN37 zAm9#+dB(s#_H=Tx;*HS{+QaT$d+>l;&~ugp)SpW_s)m8UuRwd%YIHGeZ$d0DuMf1MF~;vkGAhqlpWk^k*kaA>Txg#+tkK-d>>CadcJ;I3~DJ zw3_(el`4lx5En$m^kiY^L6-SbI32=uwHsQ2M|tdth?-dI0q|Ds50~)D=Cv=w4{$!p z=6yVgr~i(e^Q1F9ALy_!Z_EZUv4{sNJh{&S?xW1V z7umB)w~FkdM4X&rXN|{vbE1jxrrUE&mKrKhPT+`RyNuB6&z~uJhLckS`3p1AM020o zXH1rS4uD1}tip2UXI$WBgLpgmKwJ{}s0!oh50H}xV^Csj;`Vm~h(}UO;b`A6_{i<$ z@bq7ilgMFE9{jfbZ)gYkv!Z8Y11{SbpW$+V>^+R-|H|<5hn%L}p$I7meqrS~ij-2- zq?$n9`@I4yz@x(<|BQ6mRh+-6XB>_$3iQMste3vYcs(b+DY2f4=dgM)(n3mUh$S<#e+?mEruIBu4BXsJB>_0)X(;M1EOF18$z^P$6PP=$+}S#p$6bW>Dj{q znzCX3>9_2_PG^4atyU~Bqr`n<{t!EE@_vwp#x(D{SotJycHLPO;5~gURdzeflClvf zmjdF)=n^N{P4Ek>gRS8R$)8*>`%)8K8bB8b=M-aNIMmsGW>a`5Im*7W`L?*k(}+r8 z0Z7=jp_UieCY?PWE1?1j`MI8vnpS60kO1E0QG{zXRThy%|h#y1H-I&LoUWOK4?eKp5ILzn{dh}!?g7iz& zX`K5JejU&YigM{l9jn#Cl9UcamUe$#-ngOzX!7Cc67h&3H%A z;O%SpsrpplwP?}Ov-CjM!Z|SAmPpQFMmC1sD@yDSxPiWkK=g+}_aA9Z7bU|Fu)6-H z67hSTDQMgxApy>hesYi`>=KxgP;b5|$r^Q=IGk@x`|S=Aa-@RFxJ&bQ6CA@J8N zYoB9_H@2IOiQ00aZ%KLMtfH-v?*O3RcMxu7KYSOVFh(=#1N1_us-rH4_B|TxXV}1| zCMnJm`{UGq3>mqgKcQrGN(F)*$tyHbEss0{s#$Ww0V&-Ra=}o_FCK93~Q>%%NEt}^Ewtf>|cpH|D-s+Uq7{O z>25X?jLq3V-??$Px)76fAoEl7(FZNxGE`wlS;^NSWVGedvWPt0U}$ zW2nz38IcV5DNL1S#_l)HIcI$MkLc3>ZJ{0I%daj$1LkIGK}jFq8yp-MrWGiTPe5Rm zkR+?-*8$7C7#b|AY+-UCnZE2eXZU|7wb|5y(?q@4T!NrzP*F>h3>VpeB-4)lH41fh z>`FpVQp$>XkiC`STE1$PEN8?dIq?e^NP+5I-Vw zdbqe93~EOwS8ugv;f$8m&NK$3YjJ-r1?RTEsyD?dC57h}ljcx&`=*;r6fw#^zqt(U zO+F|p#W31fqsNve2D?$m6;6GH{%Oo@nB)vPm<4?wKxcd?*p4+c`=aO^|IfyNiKqN; z#(-@qh;VtTw-iLwFWRA-OAqK6`=`xQM8=}sA|ieVWgf=lt|s3ZVaqlo5}nerUtkemv-Xbs{Ti_RmMHsjjvo$z0thz@X26`FoTywqlf8k6c1!vSMA_p`|$C_AJ5E{m}3r|LM9(0E~pDDJR ztCx+vnlVc0!2W)zteffVxoJO?cp?(I!!LHKZ*lTmV*;t1n{&cGq|h&~Re@{);}1D* zn;$EC9T?+aLK8>};$v=#e5itwNbiMl`{fAA9Xz5q08>b9 zY5qw2I!OGp(iAj=Cwag)0ep7{BH~IgFB81$c9|o5@H)k*X*`4VBh`}sB?+u0OG+AQt|%my z791RTL>P`ikpy|Mq-^d5>)XomT(g=m7FyMiTY>&%2f-vV`WV({zKf}+;C3Y<35mc2 zH))7BE&Itsyb-N(2DlpAcN1>7_Nh~hOh&)IN|w)F~}Dx$yOpzF|B`+_&ZIWaxA`e zyilw#Na62Wpw>>N7bc=&^OtztuF-TWQ1TwGjOTr%MGm(sU?39z%l0q&X z-vZQe1$v54C|<~_;4U;y&cC8@y1HC>W4ESh?vRwzRy_)~qd6ll5cDx#<0dwY5hIay zR9qn*`yK4_$nYNuk=%ksrC__&sJB4_VxCp!@H8nrS2~;_Ps}pVw2bkzHt_}e*Q%ET zsNiCm$32OxsMhjtUhGbxw|45o=c$dAiGjDmp0G^<#IBv95YrzKQGdZ+YeD9m2T5&* zz|f<+4Kh;BK&o^?o-~X;h#w%%N6mA+2tqk>aKgjpE}5)%^1%-q$~QGgL7SS_vcTX0 z!LqmkRzur1ou2*83@cja@T$Sv^78F?Fby;}3zK%C;(k=O4Nmldz?zL;Eds<+m0H1y znlU$x21F$R2?2>T2%n(#n4Dl9Wd5qibKa7U=$6}2)Zbe>s=>*hl=jltDfzESHM`ss z>3hi5TJdp)-1Uhd$` zZH@wiT$wE^NjCYwSaqF5=ZLKS3SGnvztCCQSV4?C@tQVWy z_!zzm(Ib*-K(!S@TRKk8{7_aRIiK7Os=g6=K7AfD?}#h!dK^X!*+0M{g3JHHs26Lr z<+(@3EjF>NV6tyY*qqe%4=oLk5RsmI1SNEe?QK9F#RCM2gNUfN;~fp57kCtHmG>g{ zbZBoU_SjE_8+Xe8^EKWkhlP9<3KS2gH(osI+;}ebH*c$g2lUIYCWEP_+ z?tH`~B~OTqJtOa*8&6Y=^<^TviQXS8wXEzCgRj{L6OApt8&9>}v3%5$gKnjt6NpXU zFc~&8@>G0Pd?cJ5MWf{0?AhFCC!FBW19H;8q^fT-?Z|@>SoYsu7dX}ju&gJYQigVY z$f*uC_o7OytaDrSFx7^dTxLvF1GAl;iQXv?ikM8v-JoiJXv^}taMH+_`MD6Wc}hIO z$VW#oO^tEkkR8Yd!G*WQeTvp&AeGH30hg>k4SR0ui4)ak$-*lIUQ3uuj6>f)7vk8-$#3D3*9Or zf=>XLp%QJor|wi-&q6m=IBgR&FJmCs+_z&iK#LtQ9Xu$FQ#gFit(#ZHot~W zn%pNo^_Tjt#Rjy!k2`4kpy&zeU_qUY5|lbr5&}F8g=T-%0XmI!Z>gz8wt-% z{eAfqAVCv!3fMn=6U4ev3?25lARJ8LL+&+C1L;y?GE|<^b)CHS(Ua_|>y(da3G>A| zf)WqYn?xpe4e(?oiS6)}Vg8?0;bIBV^pB?^Z`E>~tK{&na(rWB>>8P;ar)X_f)wgW z6h_K&%Ga6p_yh}`UH7%RqGN5nbQ%8IZUf1V(Ea|t&gW1Fg>wp>f-mq)8TFh6Px-og zY??KdezF=~bP>_%$u^N5yM_W|Zmn891!X3fjUL<__S)zLw=G(MuPI}jdJ0K&h7_Yb zF&e&|(I} ziev{n(Y&LCsw%T7%?VqUZ+1+*wYz#Y_qAzs{(OJuo4&Lo5ny&IG0(`yS*zF~Rkv>? zUF1ctC}98aF3pAB3b*6{g5Xs%wyHBe#$QU!Ar}#4``<0=8nWvzO{-vDKQ{ zFAD4TRwBf`fd)`RUMwc=wD%*$0tIyZbe=Z}=qergd~;N!Fk5QzTVZYp^@s-Q6o+#0 z<9ajJI0H(9F825r`0Hrg22kL#ol06$Gq}oU5D%}Bocl~k>}(>f-FNqbax~{g`^)GJ z64J{h8$z-~>z}xk71>9(;$Kx#1pNC|M}8%J>0UF?;aahnl?fkGXKSL>(La1=x{_`b zjD20RqGW^FPHXK4P5^vs3}kA=H@>~zAiE3#0>}^gU)Px#C65-$qV*7E*G@CjRhxqr z*Be#hQ-Dac@$@Ge;cd*#Nvew;U<5ewi?L1S?M4AE@C7}zS5TB=%d}m#Ay}lNZ-++= zpAKqwE%CTn4kY)TN4~JyqcA=dtgU><1UR0oLja+k8rAFZVa}j0#C+?$P2yeC<1d(caZ=9bn zM)4^Z8OFsMYj%0QTyV$&79LNZ$Mb}boK}bBuUjY`z+1PpoEr~{xN}DJ7#{RUg}`xxFOG~vDYH!liz+9IX|2Nv<>%z@xxku*)zxV+GvLw8|f$M zWr-H38AUFhA7rr(eu>#r0S`>7Exn$QWDh2?aVDEWOu|d~OUTsEzoxEiZlpPV<@2)& ztiS7z$}U9>q5fD&{$Mr32@DS?cA%6nnj|yA_=(|my|j<#b(x*~L%7%|&wyF!r*J3v zJ_RPV-~rl8d+y^UrWDuD-B5~{y=&ROp|_t|t4Mo*|v0iyw^wX z?-?3=7ToxJNofWd{}mU3dt=U zg1q!o$>YQ)o5Z}kp}3#%IxabI@&){vO6Lp7mP%*GE4Fz}QQpWBi9}3AHc%^Sl`?Xl zH_J}@oO1D#5Z9!cK@PN43DugSsX5{E?WB}>Q%?8E8D)xAs8tyA>=7#p^ke&z?7ZnF zryB7M9qHcr<=A?%DxhOQ&MFPcig**fylk1hxGHR-U5=+45bkIe z)5)K2U<3WmBS|fKqEmmF@_Vo{{Xva;M}-2Zh5U7Z)4k5E>mRE7YUdduTaUY->gRp~ zRYz9Aca*i8dp&-pum2xQady-rkXj-l9L!yqozHoDSG18^|IsKC+E(Z+;jHuwM%i#O z+Mk6XYO`oY6Bs{#{6*^1j7^V8LT)qmT+GC?ubQyLX8tqn=k{>CIlep18x)tZzJ3)X zs;rL&(wE;eb-s@}`wgDSQ)9AZtNO|tIq$8>@#z+B2IRXLU+%GF{hhZNgVnsOJaCoET12dZMhA= z__WDi^5Wo=a^Q!O?#nr}1Hk^BCAaew~J?i@+}Gr`T?Yz5?<%!kWd5=e=_3}QFM8%xJZ4G6=bWqkDPP)CiM)`@8dxzB)=Y=1J; z^({@HUNLEMYg;^;^%?7NzGO_u2<^X1ZU(Pz;oWw=F<)TP2kr`4j!^w-DD*x17Zi-t z{-Mcxg@8SUo||)_e>IK66**o5^CFpytaiMB!5}!QZE46OvW_I+~_7d3e#_q8p z2%hu*hk(`{Rd3MY#e!AAf1bMW-AJ%~Yf)P;_riJNwC254Cte-S9~IzhMmu0_?Y_y1 z?ASjsCh&BTmeX22wuT8`6jTs`@cys`+7n^I;|4y)`A30+;7*rM++h&<_Z*w~cF(by zl)_o_F1z|YHD*ahFi9u#hA+;a0g0dCUp1WHF{-?=HI7fr|EV4S@Cr{I2I7MlXKd6$ zfKPgTIQbcUJ`r-f^b0AwJjn=7(RkMn#03f56@n#F@v;xAD79|L3p+Za35)%@#o7JQ zf7F5B{8jH~|8ohA{E=*L-%iGarSL0m%>vy)HL6UINX0SGraOA;Otc`Eyki5%Nj{QK z^tK^$mMd?~J6aU^@zZg_2h*0r?A&67jQ=YY)E{18$T`ZuSKjE+U)wwzm!m>3ji~d$M_hQ ztjY0!z!#W`hv|WJOAsJ9R^zfi=5?aCSW$LC`(nhfPySW4QU!I~tZH+#<<844E}4o$ zHlX>~TAxx}q3#tl^U<0z04K}?fMsxh5?U9_3-mJVAgjKUP^|w_42f$)W<6GFnVL$9 z@s!CV=S(1|b{X%GT|(jo5iN7QFbNS`Bk@xZnDNp7LPK(McNl6_vloLf$aq;x&fYGt z1p__0W*S$i#DilD5|a3+1Cz*VNnLO_{kIqRyvn%9FIyCxS6jJedi`35TN7}&2E@+X zva_41r{`0geRi=P39Z~7A8E#e=1Jjh@zEZB8uAGNR~bdT&Z}{DL2;Ew%{?Aa)&Pux zpK@Aa$LMvsN+w{v5&L)3z@B6topa$(7_`C?N8^mouSR^_*UCqgZb&ge>}u;F=XOB% zY%)4Ho*}{T&qGrWN6*_eOAI+RaKA0az3c&dGI@|2{;aP2UyX9ol{@2e>((u&1xjyWuW=$j6&Kj6p5+laZ#p$CS#8t)YG=ujfMp#%g3 z9k|HV`50>QJ>;YgD6|h)W#IqL@!k=uziD9rnzs8R;zNP|;u^BRads zKv}Eif2{iD7^nosLz@!)9oJ1qH4F-C_#~}dOGPNgEmNS>;e9>i8jT?$mP{twtkqbK zH`vtnxM6Wb(qqoU6LvNX31pO`Pk#8?Pnlo2`>FCU{X!cf90w?{Lo)H3RKAN=Ka%D+ZG{JkY)llO2*f9 zA&>N$=?Dvm;QpFQx>4dY=;#;|(x*CBArrkLQZU3F8bqurjPa2h7&_{=uTt7R<{DlB zr8IZbwNbaTwlsogNZTvqAfufSB1Nqapf*QBN37xGtV}wW0H5OWu9@0Pz=> zx?bbtW8>RVJx^_IkxdAovI!%s!mEO!2ycU8FMj@2P%Am3b`WbA+JzA;h@~4>*s&mI+M9@l4_usLBl02BDz0`Kfa3EhR>RX|8<;%CBol%}tA&@;O zbk78SEvc!H7=niCD-CVDpv$6^f8wf<3i?J~f|#YAVY_9ePk+ItVF>$J>Nc+PyR#YCEZa6w{+3l#J>R$cdK(BXWg{o5xg!fn+ z{EQZQdu4CjDv>_qn0^D_`ZP-r#~&qCpj$H9U&GEu(OO;W0FZw~RKI}=?ZH;{V7&sC zkX_X{AgjXCeajr?vROv^OQ0%_3yvAEso_6$YI|geJ97pU#ePo}I=_BDAg=AhWJ53Q zr+(`#2iVT=LU~sK)-be4fAle-2kLfPeR~nDO2}J;7y3Hs)9BbpYRVv z9doz*ODU*vO1UP_9$heY#m$aNmK4ge!d*VH^5e8aM$0xHnOR|W>*3L4wA~!J;;kqY zZ2w)Ar`{`OR|`mETq9q#kzCa)*#gJ&W|&!E#4$m+qyk3yMrtA-L$|wx*WbuFRemAo z%u$k#!^tnJPPISTWaBYQPH~yP*}G(t_EaF12)~K%l6i#&E+wWMcYIr1$y3{F6K{g- zwJ+J*IkYZLn)VNSVrNTLdcYeyYGD9r3V+?#` za66Ocv^jla28}d<(Z%A>SjrB@5=2fzSzxV zFm0KvchvtIs5bo-kLVpqt2gX};)vBby#yyBra$%^V^_W}CyXf{A3U3qs7HVnBis4L zdN}oOQzmQysXwr{ZC|}28|V@)Bf~$l=C(#B#K~@rPS{c3+sv|dkC8w2G9!*UAQYGo zcI4pSnmXGNJ0n)ydu;gsAvNMCI6Acrp|^*SK+yk(l?`0A`ZL)Sd`4gZslugoa+rJ;R`;44R^=otV@-Zd8}{nshY3W6}}DIXaRB zydS24?b3Ab%)*_ z#`GxFwJOq(Lg*VlEwwA)kfky8UU48h6S7Cwhk|CmT^}H!?AKrXVoCl@)C!fL0nHzg zanABS(MZPiz@!Jdb2SMqZz8f9c)jN}wZ4o;?On3%PqwS`7nB47D~ zG*^wb?%IgXOgYQ}5CZ=yliCrDwqsd0=YXdjoITs2e_3HLG@X=`-XslrGM5*IT6fP6 zDP|-tkP@@jL4OVlOfqCKrC}7wYZRCi?tpeMW`a~t0kvziF-wU7f+hRcnboh9jod~c zqYx@P9ENx$twu-hbR54|O_8TbU58YH_!A!1GPnQXu!MjjUDw#2iO-{KHyB?Zy1+CM z|L_#IH-6>>8d`?qA)dd|B4lDth5R!uKH)&Y?9GhI{w%EFr02#jNL(=E`21tMbD z7xDJ@1&LF5L8fnsz?hLDLac=m-mWZ#z@*Y^ja28T(-!h0j-X4usjh6iHy6!OMEK~V z#;W4%RNWRqY7|-7H8iz3}nl#+vUVneX`dMQS#-c6ijL${D+wCDuM})WpzJL5m44Rb;X; zVr;uT{P;7y6?V}{0L$Waz5UlAP`+J__`CWXzIlUCSdv#*7v(b(-$og9C<4$(Nd~6_ zr)X>HEA^ZQlBWXwI=n$unpa*SYw}o0#@Rehx45E!^u#h}UNpnv1o6hJ$_xh+ptNKI zDtp7&DF#bh3v$TAh|Ax# zV+N`q1B=h;4MoWL>q>|zBm^Gs=1>m581OVnRE??W9N^AAr4lI&NWvHEckfsFfM$;C zNko8^aVLUwSSHw#j^$+2^{fM5{%m@D0;{oM`!~e02P@qlY8*z|o9=#xq#{d)2ff@k zw4Q`StaWG5Z+yLfUwie0VQ<1Ctlc`kT#7t?YW{89Y@Ge8^!A9NOA?YI*x#Vx|3A2` zTM1Uxc?|aufN837z{6W5H+|+sePnM*-nK|uX97&&URS$LnBsZ9pr^m|o>u%Skx>h` zn0ZqSYNs+7Kxa#6|c zoY8p9-HPf-k<$yjbtXYXnGIUeXL`?p{H(n_R<+bR1<> zhW>eM_A00V8K{H)o~SjNxFza)WAx_PcTwLaA%*x}m&`%RJl4BJBI#is@M?+ByBO%L z&1s<&^b+m_9I<3(ZN!?EeC!0^ALoB3> zh^(RAMMXvavv~6D+{Lj1U|sU6Oq+wg;Cf}~N_E$Sy}j9n{@K1;pC>1+e+7}<#zi^R zskX_R9XY%Ga=jS=#s?~O{i~QgPb?GSk8W_BTcpvDSI{cOZjzC&8%&ee^QQHmO1BkW zIq{*(6Uu&Jk^=g0RHakOYy{I|03VK*StwN{GlvW5Ke5nZpcT=4;dHDmcNZXFfFbq< z$)lx{Vv1U=LgWUN1%hxfYb-0MY}JA(s>)GWAZ*OnEEC8}DolE}*gO~HoO^%0zTZYv zB%t--!}up8vlC{NQR;Xnp0Pd~ee*7^DgQx7W@epnRr#vGHi(Ud6u1ePOec>vWykpCSQ=QSiPUK1o%ov79x&@Sxy=;v>&J&!KvYz#K*O zr7p%Y-NQM;9m+NJ3n9r1XPz&6^J>fAqtY8XUQ!`%*~x7YH(sc}dr{Xm86P0TQf`I@ z8!x?s%g-P)u~A-Tf$e>(#hpBHl{vfYpcl{mJ^^vf=39dK&d)5HJsVmF0u`=N>fTSLnSP$@ z=W+6W(6unkpL>ca|4O($vSf?74gOMo^cMTC9k zIo;0ZFE6RXBn8L(3ejh;l8gU(rD7A}iP7k34J-w+2}`ZXek;bixM-divhu*VTwQiH zFDVAJFt4EF^PRvQF+V(7gt%ahKPucKq~P2a%86$n(BqlY7>wz)qNHd~7!&9>5H@_V z_2tQ2((W5Pg?hQZ;|z=lo@#ct2b3N*_Yaqy71b)BlUH!IPP97yTz-KwZ>r_$buG&65>AX?nIvX6 zmdBHz+qgHL;#qIS$?_DUiSp9IJfy27(Ckf-uQXLu5(y@LCgC~T8JHM1Q^5RL$X8M? zK2(g5RO6GUtg_DfX_APfBBc6AggI-5NxD!z%b9&?yC+d4C-abw=icmw#q@x47NV4A zef{*hfskW)-Hhq6LR41*X;*^BuY6Dx(pXL&hbZfXyPUQSf(ME#E4ZWi9fgj)VoFzF z=0Q_9C2Z&Fg6mtWZs9$BqqUE@=!Q`fdUaec>8lBEqeqUHZ?{#)aRn)jyzBOiUXg0A zzBd1otdvG*&1L1_+4pJ)%48?WLFl11L>WXUVsdT5)lPuimlQ&YrE@IFjkC<;W{nEw zBx%2u*HgtMW%bGjugaSG2JXkA5IBa1-7RtwaYu8`YDJthDZZ$6Hz}E=!}p>q>+_nP zB{VMCYEqPinTsJh_&E`!Sx@YI9+A;%YpwQv^evjpoU}?n5MRn?W^is@Sy*_d`u4Hj zr3g+nrqeC$?U?UHvxM$m(VP0}5tA{3;RYHh$x%rsi=%xWlf?-*78Z|s9)t-}u-Y#V z+U0dSJfVx`OgE3YNGJQM>6i#-zVKO*{FOwJEH1CtMkp~v>S_AuoilYp0ZFp&rZ?Ud zwOn4}f8bi9j>&EQIzc-pNoT66;A)Xpq;}VW|6?^f-8)|6GGGDnq2=lG7EZQ{lJ$4* zk6;{F7GiU|m9%j>LTKT&1Ng^ahzAz=+3TxI@1F_eP2O`=>9~|##wsB)myVZxNcW!a z;}3YI_q=!xG+hwVhGRp(|0DN=iQ$IFj#Q#pzRiqGqR#b@;G7RK#)pP5@uldBf)CJ? zNRulQjf}0R$cE2FSL~817>PLOwN(nFkrmVIv3YfZRq)hQS^jiIv`o46{X2{yCy6Ou zvDXA@$tf;7FWo@Vrl{c+b^H^B@&{`4XdjAcBbqa+`MxX~7zoUF{5}QWVR#4e zb*0w=h^gVbsH$dHUuUDFO6)oX(WWEfAJuNcpbwWxt!g)ar*g6YRa?8ye!f2MCz1lMdGC;Je!m8S$}fKNU~ODWFi z5a!Ec!d_?59DSbYcLTIf1J0p7Oa;MLdgoTGxSjB%IMCA4<@!SKz#9~fYGQ)#g-9HB zY7fE@MTt4Q)O|;VcIHdOtIU64Jw6J*)!v|8$F6iv}B!)^YqIB*G zY=ug}>v5Oc?s?y>Lkl4jDZ{>j-7z+NfDePe(~cwfxmCN#W|U)-h`*Kv#!b-t&t9-OMC5jw9_yo=fxGS zh1E4bN}^2d^eWelt!;-8aTU{Wiwk`bfrwkf8m_q%J|ocKUC`))PTG-W&HK|lx_8JT zI1o?onbT8yxt7nRr8nKmgKo|Rk6Fz$PO#7g74m;IwdvLWnmOTEbY=Q+b5xk4<5Mu( zJ(k1STI)TJozf!4BXfDawd#$)LDrO|=cOxV<;Q5#b{$)VMVf*l=b6=`W`X9lIxd~m z9Z3u?)o=_T6OP_=X;)jHu4lr`{cI=WETCbG0#V6_B4IDbF-joCvV7 z|CDI0XZ$|%w#+j!t;ZIl1J%A6{a(t218n2Xq9ZANrSYb4vfXbu)iE4*oK8{*F^TDw zJ}#j-U7KK8ZJ&1Ch@3bZQFR{6`>Dp>2dAPsRe&zA;7FRDcAGBw*% zLrJlh*HTq6i5K78d;YwUd7XUZ{N6V%Z7OJ7QRgZn?XlWA89_9=6BINE$ze&pK#kLsp^-VUHJkz{nwS={ z8G1MfJRM)BGSb*fO_j@ur_RT%uKP%_7#=(4mw1j<@70%OmB5mhrWT}6^=2H~x;tw& z`t9zAj^JRd!PJfjj~)#&Cc-f}jQbQvxj#+!%i)Gs*apd+E{mk{LNdl~pCYk4{6z}2 z5Afe@dtz{wcGeA@fmYd~?{=lh=gsSu>c-@K@Y0)NZ1Mzg21sWR1(`Z!x|0hxxx1GO z$x=qnN+@YUaTDB8U%fSl=V+oS)7`EZ)yuKxtY2271X&G*;wxOY`G^(%bW_Z6~SLHZo}#;?pFB6|LY4x3wa%_U5^ zL;-b;*(#S1N-UzMtDnkxuRa?LJx?-n$o1#XY5o9|n~UrH^oCCCymp`3!F6a2bcNxy zRnGOf#Z|W>NAw9FYCc)WJy?!owEJ!cW95UoZD{}}cON~OdO(u%8x~Z4{-@rU@n@V? zZ)zvPPhtP`+)m$2T{FE@{5ZsF*slS1M_^12pqj@=24y(5`N?n`jH zApHI&TI-cCH@3FQe8r3_nOBdR^f_Eou=>vf0;1&CU~o`R!Sv%>)30xgMlY+=^Ob!x zsDG5ngE{(Y_McUOs4+xUYdLrL-o2&rprK1iLF@Q+FGiNE3^tTCmc{k)NnOGZt1?H7 z4U{BCId)u9e)jp*0C|vLNlD%u4;MD7)z#&Hg6%sT=ZGtOd>%1T<4d34npTjuRGz=V zOeH7meWg=qV3@Z11$6O7bhiY_+zuuAjM0M9X0jUm#=%G*+a?h)Zpl`6BFi!dVCUNCB|c9m~N(@SIn0)`xb4~GMq*zr!M@B|m$ zDpI(eqMftNjPMep8bfP3pG0}%oyWV3uy*-FH^@e~U}F^#J%*Q;)T)zKUzu>k7Ijii ze!Atzb=OSL-n8=(eKB{eKE*}Bv*YeRTvw(S8J^^8Z(Dca z!#HK70OaOGeWJ7fIY;G^D9k#WTM zMr#Y7))N@D*HY;j!L!RVm?zp7JHj5u@N{_JTq!x3@>s~ZJvdRpuN#*O`UH9Aw^8-+oy)l1+|M2C>=MoO6R+}S;oRt zF%sH?5og)+SKh^^7gYO4z3M8U4|6oVFwl@a_RqSrqWY|-Us^Q46VW2z#NUCaHC1$`M5jaY?MT7 zlmlKrk{3ByU+}@yK&v1t#EMM5yrpFo5`R$e#7#2N*je#Af=Wpi-X?r_?bsP91@`ak zi4rAwEo&i{1(wUwM_&|P(f)Yqwwd-q+4SNR|E*=K+((aWreEvd7=P5tv_@~y^lYT- zqi=@uQu$+2@#E!}RV|vH2nn0B{IkS|B($DTzR5M;XggW0t`M7aMey=bZxc(trQZ6a zgRIijX5QvD?a{AUkHn&nR^pl-cEqgqa!<}AM)AR?VxLL{X@8a5y;B@Kc|mmuA#ba$s9DJ7Dkv~)KTQqmyJyMQN@$0xqO zga5(n<&oERt-0r#bB!_Y`!mM=wqE5-94}xt38sj0)pXyd;3ZZGs>lyZrwp8{-len= zY7W7YI-fl`&4DNSIxM!=^jzGmCxp-S;$?(XdSbmb{0e_s>NVe9A7Tu(VnvL!+Uel% z=MMf!Zr3lk!tI2<-47nTITD!Kt>9@cln8YE#EJ|4d1G273W@T~e04c*{K*PQa{f;Ny}ZudH5Ib zalR6E{K3>N*~~(@c8^*miP}maezC9BDO_?%kF3OjKDsQn`SW;tW18AuU{1w_%;KTC z=Z@Tk1ZE_Cz}v>*<(z4mxA3XGKz&0ezlaNuRFl3jyqH=`<1YWIi2!h_Yi1)ep-uuS;jbYDS#icCpANAUdFGUIa)&gCBp7*)eLlR$3sQq~q0Y3;< z$fbdQ&}wTZL;@#kh1|RNtX{8mE7NWS&fUinrzX+#70I@>T1QI*>*USeI>(SE87y>2 zx|cMuB<4!67(bqwpQ+GLdIf}dVHo18Lf>8P!&OT{MSiWUSeG&>Tq&Hg-X_?tJ8N0VTZLl7nq zjxqccV1tFZWyIxNaZVznAYgmDnGy7z*C`q@{O@<98e*XBau@}JF+G@R-+6#Z-^~@s zNa+}e*~EvTPc!NDTWW~=LWU#_!|K<-%IvxIB$93~$c(FLipDvwKu6g`>#5oLfHZsn zU%N!7dVN}B;`RCUADDa42~ou?4FRGlY6Rus_LpvR*_tF3rI;O&&kgBMxelKX6%}#J zY6q<&{xXysmHv$|F?Iv)m;b?|)O4bTw_ZoEam2@D*u2(s)5077Z$1eGND^+FF9%!w zE-tsL1jv32y?~~$bPw!F2K=2+q=Dp`rjd=nm}?B)WEF}2={O5!_VjcCURDfgAz+>8fbJI*z5qv=J;B)5AMt1$@krCE1~ zdgC>&LPd|pBLKnT<>A82ud^7+Xl02$W5pNc+aDOv=AtgIpu+I{>I#gID*d*bY>a4b z9&b`1P$rXD4fN{j>Iyc}+{Ab6m1PTEU%W)0YL~4|6g5*cSJUEWC~J+Rry=#VDR5!3 zw?7@DRy2R-FE=G4YR-9rCZ(&O5P@udpDfb#n;b%}Kr6*4-9?`1W^0>2L%W-_#|eA8oZ-u)OBDGQ-bBA2wa zXr{K+fa~$KbOh*Ftbg3AfO5M?GSZdjAna85nau>7uG4Il-74XW*ITAoPEosAgJB9N zXN2|2S|790f-WBdRqNB^tA~&*ENULQZ1ou5on+FraRP?5RdmbQrj#Bs_bGpO!Mh2k z*Lho5yww3_tj1^V4mu=vV+lq$R>~~di!w2;tH~GDY}-d<#q)ewjO!!p?)(uxQwupb z6;rr|ZD_mB)5|p4Yd_;zv#e?2V~5$a*F00|Lnk{v0mfv~U$Z2&T_zv#ISkGqp}ow5 z2&U!AV=@vM2K@jJe%IorEIK6iU1%d__!4$&G?$K~Uxgbam-HoD+R1k6c!=Fc@TWO&Jr)j`E8VV%(~2Pd+mGMslF0IM_el z^Qc)ivkTOWz}tJM!GIYnM|qy6^hv2KFGThpcp`46xwH##eo|1{>RhRe>^V;U z=pI@j6$Gw5ND0-^D0mWlGd7S!EGISM)Vlb8OcK5{gwi_T6wn3&yUm`hO!9KK5xrYG zz1(g3TyXa2lc&Wh{Vc`HZjl6^?Rch@i~mk` zCF*O#YO~#T@+Pf`vUgngtJ8Tb*$=CY%cp4yYW&rO6EY)mtjVOpJBDO)C#4uAgT8Y)BCdkq)UHr<*%!1JS8;6z=q*VejS6wAT$}m$AlG%*Dmd zJq20a;e&aaTA>HgpV3Rz=6^f)up~5Opj(QyO1e&NI-UR~i7s-6EZW-gEC&Ufx}N{Z zBgxSZ!C$_j2gdHXxGL$bmyL}>i}0MMci7le90rqabiNK(DI3#$18kMTG||f~4sCn7 ze7VIhw~8W5VQT$N_+rjr89&~1)CV2~7@MVr4Ys#<%P^PNQ5rnt`73e#+(72Git;*Yu1M6ixWzZ9%#_boRLX7# z=<%YY3wIU^rh9Zg05g~Okf1OMm&(vEz-C(!-P_1|^Z+SJoq;0qo1DC*&9E)8U{}Jt z3tpTg4*2YUa49Yp?#_Ja#?`{bsCfZ-lzPe*wkjI2KP+Nyf8_A&u056>7pKdSsZ|>a zJk<4p&hGa69fP977n1jl9!|0rJUr`88zk^5+x~!wRuFm-*_h-QRxcx)2oTKA)poey z^laeIpD2E>+T{*)vtT&5^B2A3B(G5WY{)oC^*8h4GVt7u(Yy>i6lU;V30!BSYrE&= z3=ekekCxBXr-BeQA zv{U1qE9xDgvP(f*TdX+~%)_JL+nMqn7PPdq=E-h?YT%GRk`B&1=edG+JS1+`&!2s@ zFeZCQR}fxexbP`xD--xRL?fJIGlPwSr(M*$2nY5AO6#%tc#TqeV&|TzbK@dRerH?t zorm1J8`P_E$*zH^XOkais@(!!>OiPsyb22o%|0X2J}dl8Z}#r(fsXtrE9? zIK4Rle!^(wDntdOK>5QY&Mro)y`b!|t0ogBnllt@UZ(=g^2OHHQ z%avZFqx?3|7ESC5++e55I^7t8?%O3Q5&^*e%B2pP{g@S%RT+m=84cuQ8GOkc0`K%9 zVIPGNZc3OYjI=dcl*|f;nD9iTLPMv-s!3$E)9b@U_{WYM?BiY8&2?@`=1L>P@Mh`I z0Tc2~tUEAegtKJ(gRp{KP34=z5C0*NSe>3B`RB=b`qur`1Q`dks9h(aRi#lp%q?A> zT~>w7b9wU2_oxl zfIMd@wzI)?PY;CDDM&I#tS+ZUJT@Hm>J4>yZ%BnJ41ulXUR;2Z)b@DRTXM$rUj?(08Ob4louVuTP610))_Z-I@___0485 zoPPGgL~AA~L|g~XaTEJnr+g#wf3ri%ezHUG9#Izbw4?MVvr=IfDGyB=EKaEHy9%M5 z*sE!-KrE~EL_L}K6`qbI%sB|UIs_!QRWo0ZDZlLl0iY89?RLBNeQe!H=6 zcB9JcgIDy=-_+JYdzkUbWrfx4vL^QLds;e86dm(-4%;;nZTT!>OLB3Z_xrqzm?mX5 z68qcmeSR=4tJj!FYg7lUfx}GZ$dU5WRd$w@q0(J!fSc=DHC)_FP z&3MlYqhRY2q;q70EN0*m=~oj-mKq1DA+v>}lds+82dfEbETqgU4HV>N z295XTt4|}ejtL)A1`W2OM5M50>jo<;PZ$_Xsl9L!LOZutQ(4EmIBs9(1o&1ElqK|l zbL=K{kbG=L6i#JaTxB#6sGInchoX3(fvGyA+hs4VAJOHYm`BK$M|>~`PCJ-Zod(SA zPN-52LJOmOke>FZ4li_Z0YLM{QU%a~A8huE2_Ro+!1+Jt5W*J|`vB zzxLoPmTa=W04T_nE}4kX{4G}9xaM`hu87^(WQbLemls59apu?W2lr`l7e6sxGwvzZ zW<(M9$Erd27sEm~z?Vw=&vBA5&KrGLx`Brp`ifCot5hG!v2`D-aEJ+Wl*1Evm6~ih zoY8dMg>Di6+UPGmiU&V=6yM$t>NsB>X#xHvH185_&@p|KOXDRKp&};-vjL~*{E04a zCf+}N5Zz7=kDEU`Q7IMHh`ay^m11G43&jPs}6vX_4MiR1dvw9|J=SBj0WzjLY!#90k)-%6n z06)N;6e~c8RsCt;czL86YrsxkQ{@aS&U_lmL4W0__!P0Bwp%2zzjcs2Oqe=Q>MS0SRxj{os(aJ|H8sm#0 zf*~de_ak^IrkjHilYO7V#Y>oNOFY0v^N#dB!Q9is-QCez$^jyY`4XTH8fH2VMa>_< z_Plg?E$x@a-s49@kI%REyuaOYJA^1-On&*Hg6Sr=o-t4=*mJ72dm&@3~V7Mw~ohm!j zINF+?=7EI1B!1NP`kVXxO%J3*OyNjaG)-*xxB+2mI{{&5c8_1X1!e#07G%{;(cywG zkNkjhC_Z>;mbY8xw!&9o+GF|o2obV>ngz`K6Ffmb`F@rR!Q_{{E;yr90tpo4W3e-v z5=&wvV_hC|w0Kj)R-)V^0mCb1h^K^tErY!{X^ltvecfT^G8bbw6u{#p1Ue=r%hs4mhYX3r|6|E-+}lv&8u}mL$poFu?9%hDOh;OAb$}sO=o&Cxy`Q z@td!Q$-l)2PJGLMoqUjhKMS^`vNAD@umPB^OydhI348#^INQG2%dRM9c(^TUlS`b7 zs|YClFy(FXRwT#{OAr)f=^psXS;~9*8m(Ba;mh2`u!qk)^I31I* zLQ;r7xjFn;JmYP%$<3|0Cm`YrUyDe!>)b~7%lvmSsWJJ#6Z(U8_`5sFU!c*4%K$8w zV!;J$2D=d^Bs$gLuM@wX-#T5aNJV^l(|NESs_&$LvwQ#pr3c+c~$^{Zlu97Wb zL`!~mmiq9z=9oNT)cc7Va#mWvaNC|BUnT{9cLMRI(-G0Y)L=lF4h+xw#}s16&KpP^ zgw-?u3>-AwX%vFRuy+v)@u(!X7e1u`i7ro39>dp{@gAZb*4tm-XlsYKvYFp8Ff{c0 zVQzoZ$Um{Fp4nYLw5z@aI72|rza$I+{_Rouk9^*fR60Tqi*Clpa!fB~$86OZ2~P-h zn~Bgq$NV`%mpI4C3TV;LuM7 zPaXIwD<#Pu%>OO0|0)mAmE{tD@j`3NZl*J9x>`}}FGSy^A@J+t^>xJJ_h2uqeVh%4 zlExU;BwMzuc7U=V@Z3ll+n&H75{#2i<-mk#aT8&`gKADlnA{% zfv&aga!w#E_QcE@bbS|Q4 zUMPGjjN(=JLczv*vc-2cr;TUON`)XDC$%!E*{bK1Aj#fcL{1==Mbb^l7ov zsIkE|5y0BX*2*c5#r;>UzCMHJ_)n9G=;UvHYN`6rN_N2bJXlIZ)!Gs z28cK4P3kOX(+R};9hUo4v@0WJwb<;1gwt1AdsZ^+qKD8KwbWFG<2#RHrX{c8uVgAS z=5pZ4M-5V;DLUtZ8EdpQU%g!?r#IF7#9*r>`sh&_QEdIZjl>HHsU9x1CL%$N81?(< zZ;j#gF}5(nF1^=@?Nj^cjnM6~V*)=uByqfMj17L&e9G8Y5GLA#TJ~~TVdvS@ov@Qn%5mb(YxtMA`|9(MuQ+Cf~ za$xHCQ*zMEI)=hetez_UnrLP-(qj?xh!zOE`o0y4m z_Tt`)Lrua&JS7h!bmRZL`ILnJcA#AQYR@43!ZyfrhYAnT#ND2H1i8+F3M9I;F?QHK7N*j zr&hf(70&3VvPQ`D-SW$F1vw6IL_NGOUzJ;7o}-3|_?LZ(4D3_*Qa+~J)yx!(p01M< zz;GjjOtC#EoqeTLLxg(Lmg7nu4-L%BLwwaVTj_xXL4Vvn!R61H9+ZtD!3bigTp zt(_A6?p0fjK7!;@UmwAV*^3ep3?sYf8=O>2mNHH+Gl=d?t5vVp^~JYne{bi^I2rW2UTFogFzEPJ?8!yn)gRI=%$&&LQpvcweas~OTd=a~ zq|E^T`fJ?s29TDanS!!QgyHnvM+mVtDO>}|$l%5Bfs>68bWaNwWwam0+fl8YDky)| zdQDU%%@Y*@e)O_1RU4f>ONK~5Ta+PaaS2z*Y#2g5s1!t|^U3lMvW&=w7TRn8digLRt}DVU;CN;=5@sHd8fQZ`Sue3y{>pW7?jB&4`&!;&A#LPv4e_ z^;f=NBB-=AO>|xtd|MLW_Nd<3r#z0u#LL@dRY%bJij_ex6dFdQF`0`UQW? zx2fHua#_3}SoK;CDmN+wBvlhtd6b6!bU!n%zax#;ILqHNo?m^uIEUyC4-exv9?Qi( z3(Y*pL%O1HRX|U1=sWn6S-em#bVa#<-%_5c{o2a1Qz>O{Ki(EBbHx>`0kRR`5&TJ3 z{x0w@b@V9eut-MJy<2FD__36|c$Ylxs2S`dB8Rs2rMn?U4lm52Zfdnt!Qx?!19E*rqr^m}iIb$!kIuQ`~H7Rh` zd?)KWCHCkl@8Bs0@(!(J)KlZ;DCy;!OL*Q*uFI14;v1Q@Hjvy7IHt^Ot#?}04Eh-_ z9Piv%7{-8qtOWb31Y`Z-KPMO;wJ7QPt}UR*Zn-eR>UX;JHv*c5K)i)!?NVAnf#~Wq zv3IU=445scZHY)wLTSQBhNZ8yJ+fw}FcUpichV3XLxWrr>h208#Ps+qsdG+{XyZn2 zVjh*e8iO%QB^1;WWibM$retBp{sJs;p8X)o7Mi`&msM0}emAAYc+=ZgWH2mkP;7&) zfLN=htgw(Ru5+IQtK}DC?u*XUhKLXOX<&7tsZy{Du;vlsqRJDVP9W4M%Zi8Mr&pK{ zfVKRMOkC=5BPkcCii&_NZC3Lt84({}( zhU`5c7CUb{NVa8|b=Qq)?vK>1I81*Vbz0kA(AU=9n5u1A?9@(DIg*}=bZN>T$Cf?c z+_5)`%*b$q4@=yI%%sBQSXeI-$>vcDE&tkF^8)m6_ zYqkjuCV)fKYn+rnY35MKldautTtLG4_B2A-ZO?XRTedPd<=|83w(l$p21Y(#C`awL z;1ZLY8CtK4LOzcIn1NaEwWTn_eG!YdS*xev44X25N|d~gN-P^ZHXwBXzm{HFe-((8 zDjkMtCe_mo(-ZQbEa_fs2vTBncXM%5lWZNum$5)H+nY~7!r}jkC`kViJG>wYjC_=} zS|ghOtj>ZR1`f<5p;1<`BzVN`u9KCGRmEl>Ld~BLHT#=lUM2{0qJJg`^kJiY-O)%X zm=YrmSk9;?nR+abKSU5`fLVfc79~PGa8lX#u$^hipgmE4UtKYp5<7K2GkqB#_WV$t ztoj!h_20N{493zLdHia0Q$4Jck*R12UmgdLY|Azlhk z;{GD=BTW5!z2uW3y4u>w_uq*e49=pFFf4dRdjSOTr;mQLW%s;cq&P!(#1XAT23EPK z=ZJ2%UZ3dh;4>mp`lnKgRz%16VktellLMV&B+vj{kkwPw`L?n1QlOG z+elym6{Y~MXb}5mbwInbUJD9yP%SQ(JUUkzs~PqMi-;E;ZzkoEnJSUlb7u?)f|$*H}4&AZ&qlbHnF z?jf*eLNM(?aK7B;K zZZZw{3;kO#TASfajd?EN?qH7A(ag5@tNl`m{Q9G6hr=B87TJ?0;toxlaejVEq^${4 zFIq;}Udk5@3@0qWdHjULFQ@?uJwDl_1#Fq_a*u4$DmVq&qZ_{4X;{nx83Dtw78CVk zi~F-vEj@#|Fb)dccISaM>T@GPHWxBCrs{tvjQo)V@R0av(Yt#9t{X<{_a#201{~Pk zRfN_MESoACcS>i3&RJBDnTQ#xJjqz3unXiv4p);95CB_k^2pFq=yz@s;ocK@b)jpA zQ63KU*?x~2dT?g^6%x=LlHjC2u;vB%x+eP{Y69?LuY3S4Ke|Z00#XQ=2~93R3g>HD zC~mq(C_OH;B$PU18msha=dLkmLy~NsvJAHz)~8jNyf8qFC8D3^yAFM7h2`Wmy1y*L zR99^4IU=<4h_616*-q^nP>G3Jw{aLx@O(O{PzYzSr`Bbac zFCGbv>Ob}w;Bph=#Qte*wpZnfW13!+SNOJtJ3DMWtE8Ul%FpX?NH@^wEloV(S{)uv z*ers6_xfq&{1=h`r~CYVxc!;g2LkHV$U-O0Gsy6pCV$KsbXG-F;0ix*;JF}kQg?FyRDJ6fe`G4%A#Rur3ku2SsODc4~ z9pLFM=zH;T0Sn0EQ0NV#rF*`6j93V_c7K!w04LsG+_ab#P|6TGgVxoU;u10IF`8%yQ#YZQoZ)0r#9Jx# zoI_uAz>CdRw5dFb)@2}VbjDd%7Zmr1oh;@ht8%Nd8^kcrglSzAPRmd!hq3!?)BLDr zZssarc+}yB+#isQk=<0XH1N#nrO{yn59W_*uOK?dt^q7!@%4C3+W(JWz_WlWo#C$q z6GFTLO7jQ~1jcitvStTJFWBcb?~e!asruFUAhXWA8o|?rBSg0;P3z_O!WA6EsgEsu zS`&S={0inBQ8EJNlVIdR_d_ibf4@-eZYjcL+z+^5OBwVMZ;nsS4~4|iL&t0shu@aK zy}{`@4)eo6pedMIEVIEWgJ{B~lAkh-0v#GsPnY7hunDP^wd@U7g1<+zX;=Mw_XDc8 zr{Aith(ihnG_%WU7bZc5asG>H7ZC5nF^gyQR~h;H?VBxX+ggX^U&`%2x% z=G{|z2OEq3h!n6Co;$LqJseAq!eur#OuEFT$*omSFR|%OOIaZHjgab4slt}tFyzz_ z&5nSne&08H2Ym!DEsT4DKMj6~FfD=@Nw$GTJ!O}hdMO7!RQ1koN29e$h8Lw40@%a| z{C>3*hL@!{PP#lzLN6npqEI%y;MD~$}AhJIU7BRyo?vPmQGu8i9 z4Ja^=zf=PP@Yu>^F5e26@7|nUz7_5UzyMjqJJ?dVywz8Cd!cswBFUNWVe z!SmeJC}|OLggdXbE9H(r#40-?yfA2kd$Kh$qLQ1~W{H9v>M)2iBy__pOGw1)59^T| zaD|-09)d8iY>X0-(bj~_PVc~w8>FYDq%<}f>SikkXBb5MUwj2$MTvW5+Z0-8-@-2` zaWMv`t2ITkenBd{M`p(+Gc$N}Zt%)nY=i?q0+=F|0UQBglIf`d#0J;%&YDLkw(#b? z>fxiI;Xe0NtheM=1jC|BAP!sAbAbGhKdJ{ax0FT@g*L=mRq z1#Z?N9&(8wXcAQu8S_-YKNkJkHqb6PNcTS?jTVDfNMk@1Tbab=bGY-)^s1)9zA6X6 z3R$J?kmjk0OxjX8HPF>D5#yjeVWFkV=3WZR44~(`Ub^7^U8Q;35%#p%r{*x+cj3Fc zLAbfppx6)+AUpSb<246^_v!Wk!ehc_@T2YBgXtdF+#n;vw>G!7l~y}gx|hY%O%^zf z*VUMcLI`nT6r3~$$mRGt;eTD!CDJ;x$Szpo_(NT9LZQ5$^7u z$E?R=LGbQwMSCSDPYL_U03~kKMcr=znly@48E72U+v9v$OT@BJy82s5#x0;!!21`) zjsH&pi^p1&Z}XyXUl`+sT)s!IS|9zpvtdinOmi_6zqKP;H3gycb9mzoI-p zLDwed`S01*Rl6oK(j}u07nTP6cze`6r9_11OXHmPzaEn(KzsI59Ge$3#_P}NpiH-= z7!d!i_XC!mW>ld3Jx0^s9?<24Up27GG)t{S@)G_))0y(B$obUwjMDUir{t)>y5nMl z<`epVOr(Bms!~kzhqv*p&kQ^6f~$A}@(}>8`Y&~q80!plr^T<4LcXrKymVSq>Z1TE zs3e66vo0#AuKHxb1_0$#<_$|ge=w#vXF}IU7|>DFMwv!He0{D{{5wE-rD1fvBu5cV zs(B3=NYZeWM^>@0Q-X+N@3L&-VBuxCYQ&p^h+DE{q~xp!_?SB2a>X`f0o3EeFag3s zrA)$TP1c#5UF9lIg8uPEA>?}o`J-<$V*40Ly;j4(Yh-S!z+xn;`K{E8O<)QZzu=wJlx_iG zQ&3507ZOv8F6LH*&M^}Yu2?M%;{=M=Pt*+im#>vWDV{#Q171 zyIp-_v!5haSJWcfOx^x*N<%})1K{0+*}?lhfx%4+OSch!H!;RDD%SVGTDjwFQUDG? zZKL1yanSxLfuJ$=ND_lGKXs!px+OyLawu4WNV3q;piwZoqmeqLGV;OL{#yRz(~xiZ z$=@fFYg-t!W%mE3G?L`KuE1L_D}*Z~!Gu@ccfLBZx}Fx{Y7cX?wk z*R@FV1bY^z_$-ZdJu1P%%r*@=s$_S@)4=GSr&QO8{H<&J3sudJ)izl zbwk3Difx7Ag6Qwnnpb-r{8Z#maYMT&M1F8#9L${6WkVPZ0GwWo)wiyBakKr)dBVKf{x1gZ2DGy-fi11`<$<5s?@&Gh1Hew z9kV#c&@SFY`)V_B(GFt0I;mR>c?ILIZ-4Y4SL#Cswup-G`^zBk!xkY4E$EfTAX5Pd zm&!&aU4n9E5Q?Z-1A>2P2{YW|56>Eix&(Tl1I?HVY0_K+92Bjt%g-S9?GTrV&!#*v zgg0q?iAb>2;aO?uZQ&CAg#EBOr6@p@!9YyR%K>IkA7`E&oyd@3gF&2__kkKLgIiBoq!BAKurrJE<1DqOi1 zrXBeE&{+ku8*kNiXic8ym=iqSm6v%kb%cgSbyBO6k(W6OoZmftE5t9V_^!J22svQk zAgKhVB7-3R(E90mE5?f=$KN{?+E74yoc})jZ`-q9ITOByhCV;cLL}C$-+C=^pY0W$ ZBSPUshBgVr*kFJ^5~4C9g+e->{~tUlwS52p From aa7c5cd31fcdd13ec8233040601061ef79796727 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 26 May 2016 09:46:02 -0700 Subject: [PATCH 426/439] feedback from TylerD --- education/windows/images/app1.jpg | Bin 34004 -> 43896 bytes .../windows/use-set-up-school-pcs-app.md | 6 +++--- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/education/windows/images/app1.jpg b/education/windows/images/app1.jpg index cb7f4991836d2d930995a9d56fcb27e41ff71c01..aef6c5c22e9f797d84883aef593082464a05b07f 100644 GIT binary patch literal 43896 zcmd422Ut^GmoFY)6cnk_n<%{_y%QTCARt``kXMlsLa(7lL3)#}AVldcAYE#t3kXOT zkQSu3gc1UTaN|4k&G*eWbMMUjpZ|THd-Cj)bIv|xt-aUUdzIh5_;IlapwrRR)&yL- zbP4b$=?A!20@!Q7Aoc)&o*qC1003MCkYBn1AR`@JBK-hlmjGA(ItBpD$jE+Q`Ktg7 z>Hg*T_XR_Gz~z6re#6`F#@~-g*GP9qd;kEd5-(-}4*-9VK6~lX@BJUYx65R|_g5}o zCc8|2g`E7aLUHXXImI;!a`LO!uU@14y^)Tnu2WL|KKcEUe|hweD`aF>C@IJ({<`IV zw7d8Mpuc(v`3H#X5)a@H`b%W=moB;h+$2h`{6*exj{e#%{Xus53ONOdjO(Nu>gY)1 zlaY~#zCxmybaybR9&nld%8lDn_sAIxpHc95FiO8l`goQ1epNe@(Flf5=DBC+HA-d{ zRyKBi0YM>Q5m`BT1w|$02M;wgwH|5f7@L@ynLo9#w0&V`@8Ae=^78ia^@I5bguM=r zh>VJkNlr;kOV4=wE;BbTzo4+FxTLhYrnauW;d5hCM`u@ePw&^h{?W1ViOH!S(=$ux zSAHVy6;x}KH{_rCeGWyF`ZcCBh zxMxW5%!7eP`qfp&`$-?G+OP4-7-5*6dyY^t^T{spV}G;u7ia%H#zOx;arSSF{hhBF z02N6v|DY$M2LJ&}D_Ghn+jn`1U6!GxRi>tGZvYg|t{ZylyjTH$ta`x(AnY0(Uy1}O zNRwRv)Yx0Mmbg1eStO)J%DXwkbX2Z_p~`?uc` z!rBDm{9pGlbzT6B>|yJR`D<$LksJFHD2;>aX5iq@JjrhRi2|L}9e$2Vwc2KgR$%?i z2*mFN%#Xll!+Qbvh%mYUw7*6XOt~>h_(WnvyzT{n{Kf?UYr2i14`C+AVum{sS=z!d zv!-F-G1pqQ_fAvN`7>6=T=xW}dVWA|32->K#9Z~id-n0VGeP-0RrMMg1hRJ89X1;m zcPl@fmdyfjd0qt>zdIDy$8ECy%-a$5fm~LJK}ZG)Q+1gm&Ktu`g3Bv12C9S4fbFe` z2Im%oD{)Vqyo}OPd_AjM3b?%YxLkrQLF=%qSeEE(%U!1kA{GAy09||mc%9f4xvDNO zj>0^XyZ|uSR2IP$I&&`Lmuw3+7N~rvAr-2(8Ul(UZaYd=dSCC`p*i66lFaZEyOQqH zkakbywd(_6j|IH(B5kND5R2%j!N>Fu^o&@;#^5zXfnKAIU?<*s#>C%!ffQ`?2AKHE#D4RV}nW3X|ewb29#$jk0-F{xcN<2Ub043Bd?CbuI9KqQTp! zop|YmZo_M;w{2CuPEJ!tYk7w>9IF*dbNwGzXs1g{1_|PsFbD&zL8OnG<&erC&^|>x zF{)1dz7pw^47xsc?#E^u&YP;J+r7uJnl5j34|KBZEpTia(>hy)2;U39{|L0IKQ>y9X zC8IK-A#tGv&JN`}5vo!cthANo&KiT^A}Wg09Q9%oJq z|Lx90<0eq=&Q~h``9=RMkw``x>(2i{L(u-;;m!U30dhnBhf?|9?~MPUCYAk9G^ycl z+8?a~`?rxnkfh*(q@g0wm^9PIp_WZc>M<=#CYsK2_)aC;4%ABMP z3?xPAEx7e8Cj=KK*aa z{r%jHLlUW3zemhelEGnx_xm^vD?)Qe28oxlsSlJwaq@oZ#x8IP(A#B~qW4_o?(Xi; z52GAQy|I5zZacTJYZneWENz`_fxZ&%$9B-%|@4$#^TgU#VDm9|P$w&mXAZ!o2sZF2vm7Mvw;D@C#O==wH9|0Bt~;IKL14EBPN=Ge<#v z6|!3b4X=LLM^GRJ9pB_IwoT06U96wzTO<1r3n3o47VxH*eNt|p=*5iCP&0En|DPn`+(^yCnCZA3EQpVY}D9IJv#Rvfh&~sB0s!S1neK~c0IC!f* zC!%)CERUchx4u);be7YWS6PvdYDvdEdajwN>HFyR(-Cc@+opF-$vy!9ie!uvUs+`h z^)$rkZ=~k$c4raQ^Dh7u@!GooCKq)`0wkdNevD8tAU8$`@Uh8DgV+8go7f2GV_nCGpCR5_e4d(o(G#ir6e@V+eq8`=gb2W9m;K^+unMs*&aQH?QOkAqBZp7L zEqC>P7>&&4M)N;!_p|j1%6m_FfWepkc&A-laQRndup5iR?yQFQ=>oD&ZM##XbLH^a zH51p`ylbAtf%WfA(h3HBwO8n2534zt10mD^jXt7jvsHK{+aGI^d-RmdIgwXMnfBk-E0 zRZV(HS+QuJOI!ckjQ*4=drTdg`o=-0^3idmI9tsm_IsKoylM!(+cll%G!*SsA;e;HnNr_q@S5X8((!;G-?LBX|jbzo>l_*zvAtK2$A? z`GJqdZ1s=^Q&mVX<^TLr=&_pE5H{3PQQz8tA(#AcyQb@f(~MkLA2Wp+Z* z9vMW>1c&P7tv96=B$P<&H}Cvvw0L|aMWtRLg(tFSZXj+gW^8r@=Yf!}MLGm?;iiT^ z4j+kGR*Fbut;L_@Irt2eS2UQ_pj->pn5q^RBHP5Ugn;oj)=%1b7-E=wRk=2Qhh{y_ zL)CFemp<9%>4b^h+XlcvLS6@=hN2tD1e5MXGmX!4VTiG1HPp;!-Sa}VqdobIZ-!kP zZiwo<488uUL2XdO%APq9E08{5K2b)rJmq-i`F?=S?U{~Ilk0|xg^EHjGFWm!Zy1={ zEV?(nhsI@L10Unr;7ee^uFSdaT1zo*=jab8P}o`Y$Ly!we9|;#8qf3nDvZ>4h%OLS zAg5AOV7qhGE~|9L4;H1~`MuE!*7s@}us$`0kp-=(F}-hFcKB`8MyIh5(-S$i;MePpFu2z8b-yuL^=B!ar$=ocDTBIoWZ$R=xtpwbCG{d7dc3t5$9ZIW z)@|q1*X_C8-?Z}&=TxaQN=;>`n}Jx%XQI5v^t_?QHT80WF>~}z7m>Saf)twv7$YsBUC6H^_MSuGQdpexsgfVy8JOl6TY$mjzA`hJV zODi!U-~626x?PaUTYGvRE4~sTeXF0yN>AyG^!N(U zcGljk?jc^$mJ$j#r=RDUKsydpJdjc~czHH!gZ&pJ?dSY_Hd^2EEZ$u5aNvvRb>o$Dr#YsU0@*j$Z|zG+zctZtMV zrWWiT0DbaD%@Z1eEmg(fM?u|uN>w|*Go*=PCeLE$@Jvy_EZXi-rb7BsT2|oB{SWMG33kFEyQFxO|F`7< zAD0_04TO3q$Yyu4EizA?D;&7c-}E%((V#)vT#1r~#(k1;D*FN%XenX!vkCP_=;q9x zzzkZ+V`|`yJWwRFl?)Bv(ZKpGvxLufkV0IQvU)~x?*zgO;Zzn60-a4`nG(=K$r_qN zY@Q~|MFDjlXZ%6nv0Ax_x;|Bzg1P#X^TIZ+i6CoRw=xbl(Lu8_j(&csk!KTEsrv7c zC0TP@#j{o-J=+^{S6hjPZ2^w{)%`26C6e1K%AaEN8fZY^JRKuz*(saecL+mGWv_<$ zaFr>~^T}Shbs|58rQ3khns5gblym93m}`*UhglE|c*Zk2KXC-J*;q^nEP8P8?S)aH zw)+o2j;K>zo~EG@L@=&x4nlt$%yYi5Nk+7m*{X#HAq8Ep_QgSK21&3 zMHTArjU#ood8)8Q1evKvL8gNQ|JE!`lR!Il=643V74qvf&!}idsbQ$dx^&V+X;-OLFb(DqEnWku>HN@hQ!;*&+@sG$qh#F9X&ByP z*!wKaNn)dNf8=B{GV=xgTgIJq2G&M97Ke>MYZsrqBbnvK`b^CT(bo>(maeH1%eSA#*uBM7`wGd~7o&FiaYyO2)2nTobs zRj;#HxxSbW`VRA@kF?~iI*vC~b!)OP86hDfWlU@u8tc1A(OHnVx1ZVeY38bhEBE#A zf|$;6uOh=f3CI0DMb8D@K8q4j+2f|_Pp6`Fcz=@dpovde0wr>7ROW6dGqqx>i8EMW zlz8ocMMeGYovve=HfZ?mw-UagGBJm!=?0wSM93|CS?>&O{I06%&Jvtra|g;9B3~T` zcjB)#0zIZ2I2(AvPi4;*#Yz4wRK$a=g5o+`<6vNO{*mSE5!k2;mUMTTxgXSF zVVP4~cy(CkjA;L)x#fZzs>mzjj71(NQ?|`NKt7(Gos!rM*Kck5v9w-!7jpsFZpXsG zBjrIxIA#5Jxtr{&mf7{KmC(sad7H-#46{8EkZkioh2w=-t4q5xqQ+ziBP1P%Oy zVn}+32IDri%_jTBv&^r!Lpq7tAO=CZu7Ej!(zRE{f#C8!Dyo8G^*=!SQ#U!P%8BIo2C==@Fdkgq zJ?6bM3=zn(!iKkGFD#DyTKp3uJRZikTTpS(@ppgwZ+`dR|C!zJrzylHIexJP?2+KP zx06oOLQh5+$>|jN%ikAfPfw~De?sAfvBgD@JO{0_2ahoaKQ?o?CtK>UEU$y^*-IR@ znwsyPe5zXNh0v8%kaN5ug|RS_OQ;Sc1MWTE8r!_o5P1aRqU}*_uIM`E{g+uwYT!4U0e~c?5?Rv=l79Q!p#+ z>--p3^8sKL6&&EHTs_djq=W@sv|jI)6ejP~DDS*xJ%BJ}-AOJ9|ctZ`4I*&$DHVENyAM zMZ?W)dqw|Aq-d*reu0XPnHlt*XZPp6I)M}|AIvZsxUGd*=*^_=HMImR(rl+ zR+r-f)l&B!`O0_l_95$DJC#>5TjOd44D^&Fs?jL>g&A-ckz<5IZ_LMl8D_I*F!t-u zL8zNVS+O=JUjl2cbVUHCnfURJ`O;bQ8a4=6UD*i>G8OCbuiN`%t*W`0-Lv?#c6H)~ z_(5<-R<*BJuOudNIUx^INxVTVV~nv$LC4c}`&KzA!%$ve* zVW9aejy)q|GF!no*=nN`o#|(onW9@bpt;lbb?gjEreEtA=olzax<%=kC|aV|u46vY zYAzkW11%D#VFl#9vgtj$Kft(9lkvrn@l`#{+|sOlh!rZ6tp1tzpi*#3?y6k2>w$Uw z2-17qwIb)~;TZsZ-Om1Ng4*_Al@^&7!>c~I`5@)<4^tgEmlK!#x@cdwabbHS%a4S8 zsBiXKL!<1*B6|Y?1PMMp6|F8 z4Xr4~aVetRCrUj_KN%X=K;#tltVR0=HINLDx`K+Q*aGArYP$$iv5KCXR7vE3AwSw% zU1OxC*S?u|EABLA{sIu1=#+`8IrAVq%IM0F8I)^l5=Uwb!Tp@xe28Y`UYzliY99)m zx{Wo*g<=ssdfc5hG*hzH+!uByyaEZdRn^5x;zmrbOO-{gGQ@6a&qy zWc@{)HXK~~`q{rG%toCybn@9JrhVJmBFD{2(w6rvF%h>rD4#l(=tzvZ7Z|D(&lPx| zcn3>DbD(E>{SJ5_MndmdzKbo9DL+;zV=wrXkLbrg)pNA26MKe!kTO|S6G!Qd*y|>E z+6t?yhr=>@8}y!g8cDJRUY~GMlxp<rrg; z+Takz%=%|IBj1w;>@Taj*#S{6|Gf0`R~CX?odth}Ug*kZX-CoWG$s(YOrp(A5}2hn zK0Z~kezd$2&todh{2Xwtuj1sHDQB+9mbR9bz^O+4FJwap?(hc|vTD@rp{I<0q*T^J z33T!>G?{^dl)6r;FWCts(DWUEC9F zbqM*fz#)!uG?-E8=BBUBF49gW>grLvcxJkd_BF`@P_bnNcT&BO-Fg2$6QOlpl)Tq* zY90|H6-0-rOhkS1#&64t8(0Q5L$^Q=F97Dw2bKeDIgFRXEiQ>DQc*AsM0PFIDa4@!Qqam1&v{{6dN%UXa=eb?@Cg-^LXM+3oGa1DldF z*`HcC?rHcFEaP^H1pzX?BWsp)*I;{3Mc>bQF3q(dIInP{U@!CJ0-#adj97L_$Y83; zio~W$iK)=+$?SaeU9RxzQC=;?M`9a#!St%;1^7aL7jGX7LF(R8utF#90$^7+@+|sW zQm^yNhWpE@TjEOdne{?~xQi>*{+yHmsIDHO zSL=5}${xZj6=82j*+pmEVf(2%?NPh-xX~!i(A6lpIj~IEtYWuTPfe0O^VdnZvbTe2 zyJ0GON~~+Xtv;Qv4lbi{w?wwlQm?RXtHltl=FkDJqu8-4S@(-~b0@N4HS!+C-J>5y z2Me$Pcqh0ru$7rirsNa)Qlrgk4$E$_M+TB?RaRXX>rx<;&Y z66x)n>Ato{&<10;7YBlP&g+RZYKgIj3pX6qd9cigQkX+mfV18Wuw_RsvTWAfuz*#kulQW@vL7arD4=6tE=0}4?PJ};+;$Gby7ygC7Ms%4dYUmnT#_H zQ$}yZXL-zH`m4Gu4?tmlvIvTxC%mRM2B*?D5qAy7!x%5$pIr!cHWG6uqYWypbhlk=q|H{i2A!9e^MskzWjVV zuhGmYqjgik<;l}x5wEUi*dyUd!vf?}{_>2bQK)Jp-*VCqv><}oe8VM z*IDnaKJpI)S`=nFneArD5cC8}AZIi%4*i-s(=i{~sF{_a0-nm#tsmmf%MA;gMr=j1 zNnet%D>2}>(s6)h5 zv~l4h7Z*a+Z{poL+UT(SEmHH2mTE1-?`%IuczBKt@M?>7bwoGzncnX&ZH|^Rz8<&Y z&8sK7DSTjU`EwKG_6=z_+NXky?p%GRQ%3b-OR?_0No!`TTh_ErW)0q-Z$V~qqrTB* zEidGI19x?BJ~xf5WK^a?w{U!72Q77dieRLh_g81jYum|7zoH$Y+BO7}?USNU^2IkS zxi5u?69lkRI~r%oc-kdkB*730T?}^8m27}j?9YJSaFny9#^Oe!|8clH~b2i`cyJ?xnYBvxDYU z=lLzh9|_Me!#&*BV1gZ|d^xmf-1kOgv-!I1m?!PK5K8I3{BLWM9}U6Q0F=uK#!;uu zc|v`)MfSfMLCMJm8G+4PK6ZX(-w&NUG%2<)J;v{C*>qA;O%;Yx`LD^YgqYWnmN0AIJ=nsS3f7Ovx))}DS&F+rf2(za*99tBN(4m|WtZLscsn;fhckPJy@cZ-EX z_2h@|?0%#Q?I&_HC)R4S{y;yf?`ImB z2ot{7_lx@h$E!*stMSoMDYKbf8KZ`uwW?MK<@TkeJ{vuo{8?Yue(wSrhbhf5rzwb! zD)#<|X;w+n~#a8u~HmOL{l$)Hzoo@20`#y`-_k@5A! z_YGhO+8Jblv>@eS8)kOjEd_G1&u=dFx#e#lZ-%5)hK zcoP?!K_m>vi%zuJ)C~hM(rg2P!fW1u6sJFV_joPTdE0)fld9bim4j$B%V%n}nCKo9O2+8dD3OFw~h|qs-&WslgqMb+7GEdtl9VQg+x`x~OR%V`(GZ z(xf=+_bu*m^c025`w($ychZ3)h3p7b|J;vmM;d3cf@R ztZ7+`uQ~N`L0zVxHZmI(YrEsR>FMMUmd;$D{KIh}OP|kS<-W>4lii5hy)FT$pg^1VpswME zJ9m~)SBOLE*DyiS)*7kLQ<=M;uCQg?So!XMmU*xQ)!=P1GQP)X5GwtXeJcnfTVno8*UI+p#w<4uFnY~!HbnI&j;CS-yX>vp;IbU6_% z-&EBT8*a)Tw+K)JRA{K`l?cXZ#dmoGSNXW@0Gi=`t0!%)Qi$f}`T)PO9C@rl49SFh zJf-UAmwz&Yimof0Gus@~ZSV!lL-;I%ZsR3D3|@RjVNKt;!* zGMt*vbeS?HK2)qJ_d`cV4OV9@;YsUei2Veld&&hsu122#MC-!!&)Zfb+-AnQGCXvU zjG4fQUkMsOQDMyL+j|t>6Aq!1mJ6>?&$5A?Z33f(RVm#I4728=ADW|j`Ecn0UbCu8 z9MmiCTy;ohYR{r~sV}%r%&(1o)EgCzxJ2My)&q5(ItPSAq7CT8zc(gKik;B?0nfS-LZ&L)xq5#QtBX^U$ zAga&rUW@<6V&vk?RayJy?yZx(ZthSpEyGgk0w?hj41HjUscS2sc~=HezctofU-{vu z9%mw@!Ag1rT99739Q)}?1f{T?U^LLlfFtNGzOsM-!dETPQsb+)3^3aP;*(kB8%Uhq z{W)H5YM!1=BSVyDi=BLR#dkor2|fe64jX8X#SDBwQ4)ZQmDGJDy(LcUHW5<{+HikP zPc6b#h9hG!U(98UW+C9SB+JP zVv5a(c5qndkd~Veh(No<od&P)kLTyK*~{2DM{(*pBEaqx7C1OraEpf^T$sqX@&2 z{tut{b0i8cA{bGjK^C^?E>d#7EI7f;eoStF-owGOfQ?f3rsm4+#QRqjZ-ri})RHU$ z(Ps3d=9QZweUMEj;Gsbut?+F09oY6REXGu=zk0Pbd->b$n6*_<1wwN;1W$XW0n5XM zV>Jd?2PsU?)n z_(h5Hl<}kbg74KV8uLu=9su-%l6dJ$b0z!p00Dt!Y`)A-111F7LxyhX&NcZZx2_b7 zHdQZxoV?ej(^Tzm#IsG|j&7~&O_$x<-)~pqo6Ag@u<)|5**-#%5gy=Gu(XTB#4{kl zZ^Flbx-#+zI=euLpVh5l`DAfkIUv&>3`z6nk-YIKoq7IUyXF&UHU2s#qYHRhT`mZW zw??m3Wgh6^S|{1H+BQRZY> z(1Hu-$qIJTh~IfVxnLK_93$QQC*76!`)^D%UvtJyi3i=3E~+om5x=k9EMLCzEz@H& zW$K-p#6tf|frOtb#OcmbvBSS)TL2N&|3tlhSSARbfRwJ zjhBXBs|)-D!=^f<9XE3X#%p_PBA&^b(^*xwvo|^xL|ePV)+QT)w8ZZX^H=e)r7+YN zAocICM!`O4;$omX`?VD}HB7$OKv1_9 zEUU-U;wdA$3Q``MG1B$i9h<)~BjTC1TRxgvtLr^GGG{q8k47DD0<3Z|Cji&wsf!ZBInC6-uKx+hLACN89c}mvp`Djz09G-$hHZL&2)CLr-!<( z&EOhP|>_~U<5uKXvMslTvvUq~pme?XZ1 zJ@2HG@wYdU@FmJ@tM*B1m>ON`7_|}XXcg^u%bKTxo5?d?cOEFz9 zSxJ;TO)b^d=s8u-26!W_xzQ9|v@|e3BMdxJHMj!Oq+WFaxE(KOFzFCFc>y3J8xH5> zYw7Cg13mgQ_)O2-QlV{L#pEQ3ZOS92jW4rABXwPK5K&ZzMQdVdp zsO)7N20|J?RS=j+s9%wuADVX`KYOiEMyZh*f3 zQ*z>W-G7y!_&O!Bf z^~LUBy&6fo!gk_U%6aF7JsBb3PbQo}XJt5$s*PdY5bw7X*?G?0iIe)EL5gOt?~K3N z`b6E^rmwA<13e)0b~&SH1*!PBbbUfL&p~HNXC!Bq3}IVR+E@VlZm?Z249w1qxd41Y zWCCehNC@`J#Phl!w?C}cfi+q&ucZM-&@FmL+H;Z*4=nITVKx!7YkdcaU#^$C_AKng zsx4$>fg9}k1!euU$6J6UZINhd`7MLC_^9L_;@r}^tDBUH zR9APeR<5r<3`-(xW#i*9VM`7@)XWAnK_+qfY} zz#c^Jkw3^6Cng!WC$={ZXJnvF>rtBRq$2by)3){DvxJ9QXBcWP0O^*xD+|A-@qSD& zuWr@bd&`dVY1^gu4j!x?C!V)tBz25DlKC7rI`y5KlF?9uq$>YVjQvY$=YU3&J{-Xu zT4TGCk`k*=U7UBGLHIN8yVKL(6YIi}$-YlDoi==3#Lrq*e}Dd5xLTL-fp?9_izPpK z>0tG`W36q{dVtH1@FiHDnXw*lZBaC$z3K6XM{PH&;_W5`?knDq5>T;ey_$3yO1H0m zil;xjO6&*LRQD=$g2OD0oG3~0obe@=4CG;^^|zPD*J?Rw6f2_!KOYDV{Ms04wUAuF z!!eTkkIz#gf^ML{;od`^??e&f`0NfN2Bx$3)0N5MMD4@#?e+DVyY0*12 zZ01sPmg~m;G-?maKhiEjM@iTtJb%&7RtZlFyk_Vlomz#Q=%e9Zc9lPGyo`G>>aV>4 z<^^@d4H=zJuxj|v5zF?0rXA-uVV>{JC#8JsPp36ScWV*o5Dq99^B6wc`!Kvh0`5Tl z+y}f=)l{F|w4D1$n;_cX5{!vNFLabp2I=F$Xi1uvKMv&L*`csLoZk~9o&o$F8%=9y zIQMi03{p!wZ}IBnNlRvXBmMdC7DmI2yQ{oI`uyl>pT9g}(=Ps0^@ZFmVo6-dHMqYf zbl0j93w$r@BgA#pj`wydCV1n^)K22g6;kt8o+pH;#v*kLBBe-nQ`3Na-O`1u0BL1cG@Me3!Ak?g?i z#xG}&^Wr^&Ms?mJYO*%O8A1%)+P)FsF)iHadA1@EY-pv1(~AC1!Tghu{R5{BABTZM z6UeP3va-;kHv{wem7jpZb)o;kKGIZNlMVA#{NT&!l_30iIc&7G6Ze>u?Fqr5XU|k{qF70(}EcAAipUT1?OyE5yG- zc1EOc*(BN}1+A^r8X3E}RI^Ddr+~%Zd-xipYLC5dTy6X216Rle2NM!UVFn#-V(70T zhb5&Z;Mo%IOyXvPY^zbjyAzhhz03GnwD>U&+_^x$#eOsl^R|`%)q_2G%zE2kOj{v0 zNp!k}{3Hs!a`oPuuI!@gSr(aj88fTuke`qr!h`Y%Qdz2`!5izuYGCTa>ge5JgO4l-7U>21aVQO(CB>O9e_L2u z54mkX>QCf(oA}2YsO@vuf`o5(>2!_v#w$rnbdbjxO9;uLqs|LVWF>{=?$k#BTRq5Q z`M>=cu=`T6w-JpBBBXK^(-*HBtUWct^2*1d{B@}PtwYMUyMk}xpXY*6O)8%(Z;3 zHf@SJ&EJS-z&y)|HpXS8$iL}bO+{%u{KC?#8H8Y@4oYBzi#lIW&{&5H-9se7`o(u}lX z#N@A4AWwpe1?xpOB=G`8+Z^ySJAz@B3D#R?7Ejyhsd;)dYR68r?YDT?*~l&P=`1=S zeDd=FRS36uhXK9yjFkBWfUjl#>(M@E;vKZuWI8xBQBJ#AVxT!V*|Oos50YGw_-vPM z0i9XfJizjzWg7yxJDdHZ&P;&(L$#ak&+GZPszR?qT0=}p3mdi?I^p36S|S}xVt8q- zQ<8Fey-5ObbHG}?hb~I(>9K?DfD-@PU&-1?afbV&EpmAlc(2YG)7At;(M+$4tpk+x z(PB8Gh-QqUsVQl_2f%cb2p|3&$$@yTw5f6r=qqZsde*kLTXjD5g>WSWqi<94UB@)P z^)x9d*J9jfj|qYayHjXN=xjXJSm-jhZQ0&`KB1ugaCOQ!$Cw#AmZ2|Bf0pH>O@y zVXUv^0)XNrK#I_n5yL#9sIz?_zO>XUTdAad8ksrAHkqeOuVYf$ts`wlawKv#ikkL; zJn+SjaEuHo5g$<#lf{ZzZT@Dr zhe-_>gT;(4#Ec+XFR=suI_GAJ$)sBYFr(So7gO@&;2U1uO1sgsw^;~~4j^`ibb>MZ zz}Mia$!MB3W=T5OCKN1bjMW?bd_K8!(CHL;{?HoL_9dwI)A;!-QVfIpS_mmMmizrX zXaQgIG(xEbRH=#DS|y9(;d^n9jZa8Xe1Psco!T5@al0JejS1`HJX6;B3?a@m>wkih z7+58sYE`8$l@uL#M|-w7Mr^YAl&Q`+@A=+phF*Gx%jJjO0Z-m44Jyary>Ku8)g8H1 z(cC=t_#xF^i7>Z^l{g?s`~q<0I!SXL!NAK`>OW!=aSo$9-f&jC3OR1t-g;4S$D`+A z;h~G~vll#O_W=6XlV@cc$|S5;EC~RAYS$fq9zLEvHR)%_m_GC3c_l{)$@HeXx2^%# zEU)|?gLflRE|JFI;|6^15|k9^St5@BE=iB@*qjbPB4=^EWB1H3l_mcxTQP zVBxXwevkKF8gdpoyIi!gi(cSQh`v`EjK*}og~3?Y>y>_Cjsee0`dKHpH#>%Xq=fWU z63d?Oc3$(I`T%$@cxFH|Sxwr<;*k6DPhsM0U>~#jitUWHV$sS4=hsU!{kQr#L2X5a*hOy7EZ={zn?N8ezQsRMLt(k(D_7i5@h2A zhB!c=r)Hv1kmEy-PWCtvk%~WxIRWGVCgDgmON2&<;VS$IUvBwJ>O96L`s9$pCp2?~ zFS#@TYjK8mFBP&zulcCQ0QUE0B5^u+$ukh1n!tpGc9w}HiE@cr)|u+gNk2%;VY}l_ zL;g!ilWdhDE<~P$mZ?H?gMaj*B?&w>O0V2%1CM<%d(q;yJk*-E`!2%=lv0E7eT)0o zg~?Gc>ubL#(LhJZmq1z|1RNfa(ZLR(S^~l4fk1IYMbQe82L?&UR?wK1@Efo&?GB$HYaQm)6JdvA4^Hrx zGcET>@h#fv&R$e?WKXd1;#$|$Z^_eW7X_n7{oTdWjq0Xd{@d=R8F*`pz!xXPU5}Xa zJ=&}9@8Xbmv3>IbJ8D6S;DtGy?mBQ9l5u8BED2$^vAf8(D27cO($h@Psa zfxgFG_W3Iqt>`uZ{K6x=&tfxe?dHsG9(6(%?Je2SJ5QeC470xl3JKPQ9EE%X*X+GU z*^%V!l)D{HPQ)!}*Ixi0w>fsS9*qT!St+uuEC{lxXif}W3GsrrQ-uIDmJQxZztclor`W6lkI@ASIYKR;Tf+}6kan8P-(NrD$^N7fS3kB;WHSML8N_s^w}Ghb zja9W>u8gj4SfFu3S_DZh{rL5OKQ;1e=N-C|W#_pUZmoO0i+cpM2SiGerKr`syg;A| zBLTok?9o0U^%yDXH?oUACWZZOk=6{ETspr=93~L-uwdYR5BK@i$=;o3XNoX$TsfWz z8N`mgpKpK4t)M;5uGZ6Wa_Pm<{RHf!8#>=4Y#Z}a58n_kS$XCg}fb5<*p=Nd6b}yXAa*;-_r%wY}@GQ$vNjL?G zj2n#6I=H8-SKsmp^X!Ga&?Xg19}oRQK}iM7^Z}fnc<(2fB@jYNBU8>eEP%#dd>ec2 zaBSz!>|D+I!biS=FfecSC1Nf0O!7`n#>>j#lHcRD^74)fN0D2Hvm-JmdROl#g3jB- z`(;bm)Pr@Y_553qq{ecRc@X{LE77YXx+tK(ekmSO2aSO&WkV`j(+Cd(HL!vy%NT!e z%)`eMrAOKkJVRzKwzC`m2=r%Hemi6T985o;7Ic5nYt3}YFgizwwGmPSv@?ln+i`}u zr%Ka5gr-5TMj*Tx5)(y`fzQwqgyDTiN;2oR!B*y_8XR3ki643Uh@Iw?{>J0b>JK+0 zM>1w3_|v1G?_n5SG;&l zZ~yFE;iD=W3)rb!fDai!qYKE_k$~*I-T`tfaVJi|3rt4+q38vRL$MZUy!hpjh%)ju z_>g4G$mpRNAn9ve-iTrq-9HrTj0pE1_@*$MR!NXQL8K+XE@p?cO>_ZaE%fl>LZlnR z(_?=qF4iE)k8{W%K!&co?*Uzc*y|CgClP17$n&gDfI)!@QV-n;2b_$bma2y*+5rI4 z^LAVJ0;+o-AA};_WJU~LC#3_`y1rC$~6e z2l(&bx!7CnmQJkCZ(NLB#F{P6?4L~j^jdrmsb>8?{C-kNY3IiL!&1DXH_N!V07dy` z^c3BD=?V=KL+T1X8s=C{&joaLy^GyQ-wT@dPg#bl`^}{@CRK#$V+|}KlHFA=1!t`F z#p>};jO|c^Pn64{#@fVG;y)v5Ec>AJPypw>y1ZkZ2gJgI=5ZJog1Q6ZDrP-_R@KgV z@rJc}13@l>j;3sPK!Y7(LSmuRIe2=?x%|EvLDX==1BXvX&wk( zfVXjhU^X0x!*wcB%NVA1CEAqGKyY4{ZT?oR`^?sfo8)*H+qfui-2JcAKT8pu_#REX z?^29S5Bc_CYg^WqJV)s1$F$so7ZJHZCGm+hx>q&8XS#?b41I7_q8yUIf}hd$QLIbQ zV|Q{Db6{jpiFBa(}_T^+3GTV+Z19 z1EAje1Wja$B2&M?=8&nSuzE)LmSyBsr%Z-4HQeP?-J%@lL=7?iU~m$T;!A;7>M`R- zS1df1mSnDgo+t>oiQ&Y^*J*KtlkYebktNZZlm_P}Pa_yqIq|0Li?p(38hT^IE9IKc zD=l>gMw=ImvXVZ3<4n&ej%23OBvpq!%@jx#oGbrY5)erg1H>u~(dP@l4LZ-6VLfEo zcWb4mja#8n1u^hAXqh-So;mrc7({n2DIl0Wbo3{?$BganHD#KS;s`FWXsikS3@6ZD z+CNN&Xq-SW0I8BDl$3?Wwg9o>>hTe}EpDd29dfPtg3FSN#fc8yd1VW;Czw<-%;c~I zp3Bx`Z_pd)J~0H9X4_dZ;l zX$F&rFd+{2;`j2Uq`SoXni~ql)OCBU`{!MI#b&in9_IlV3o`TXiT%-fK90Ir({+BQ2CdLi4>G3D~Ubu87T^M}^tNDa^&2iw_ z-?DsN$5$_M8YU%flPde=^CR|8T#Of9drq;V;t}>gR4!p{$kem|g$$y~x64XRm22L? zrDVsN=iB@3Ns$#fPTHKs`uME**BnbFkEtBq4lC>Zno{3e=zEZ7-of98YzWghSQYyD zk#6LO*`EEi$G{^#DtX|znnp#J3A_PU!eda<9+snK`8*!!Pi?8R=td1=R!((X%jSiE zX7ZIf;vsgJeAxh0knM`s(heeW^Dw=hvl^XK^GMAca;E2ik@( z#&s+*P^n1dgaVKH>d%=z^SDnCM;`T|Ke?#_RI6&zuU{wU7CW31*;oMPNW=(hHpdwP&ib_}P=Y2vVdQpDr9i zh&PeTm3})Xf~`1db=8q&?tp&dnBcWtahF`44%;>xG6t?e7Yy%y+x=KGrzyXL>{k`sv%2R zEo5>0U$u6$k41riKggY(TR^lqd+#W7>Q!6nV2vKeE-bnRPAPqQXT*K*nC-N@4Q&@U zdr63V#}1ejRT_e<2(5A}m5#u+f_93N&WbH&Jb=QMmWI@Wmbfl_rCF(83BxhO89Roq zS|^)29~5jjpJjv-<$&l=h8#H+3c+#$o+vdI9eX#>0OuR&Efo!6KF$y&Je_o1Ap~_J zy(x!pg}yZU-PIlwFT7+EeOkf;L3X351GN_D@JR#+9`ZaHXoV{<%k4eYp-fh5pZM6zNLT#tdK$@Zf-#`yfiCttiT5lgKnx5T< zVrgfDvzuj>+kwo~)yINfuj+J0FL^$+FzZyj32DA~*n*eZo zUH#=S1&5Gg0$mWxF}wg@=;A7E&4BO7FM;`{=9_Xu?X2R=PZ}&A=S4qxz^7umqd^o# z27`{&|GIJSF?D|^7%Uov!e!}cw%j-293w7Xv%=bJuXiOz*%Cc(zUHO4`Ygdskw5e3 zf@DIaV9M)+?!JE4cS(&!GYVilpmVOs{h|1@7x>Q~ib_ben;J_Hc&UE)X zr3id~9mFFd>mLdMbta>#5EQAa_FYfpsdg7O{Hu#_IQ4g zThy;CU$jxiW;YrU=n-xAfdG!bt_y@$0VFiebiY2`$4HMsVVFrvLf&h`F5|>GO=FID z>H53D;up)pFN%9*OUETs_mGnFHPXI;kN;5Qz(ycgT1a=HUwD_QFg7V+8_tiX`fC1w zKO3B&4Q}(G>f!l5C4u8q$B$s+x>>C$@G);nw*m%J)lW@ioL&!d{CM~Cw`HvHyPapO zGYd_{4^Lc7t(qI7<(9d-#u~$p+k{e&?%*F!Mmq_yKiE!nnfKK_Q6Z{JKeZKg(ULJY zD=bkR^q5QOYUR~qah53U$eP~T9^nm2ZogL%lT&_AFJSoo{q+=wJe2ue{m95^9+f1KlXC6`Fy84 z0PxZ07MFV7$Z<*6CU*Hiv59`^e<%hz`~fMTwFXSaWi0NKsw^oskja;8c2Tz?@dCJ&_W&VLb{GVneNq_eFm@i*bVG=Av&RaxIl3W0k|PpFd!f+z^2V;{#K5*4)04 z8qN`~HBIIZ*{R(;cN&{_R>C`4I9E{}&Y&<52b|8y{3HqHZR784FPFudy$S|DeZhdvynbDqkE}KbXu`{Y$q)4yDYKwA z2RmwZ8%%(6^cw9;%wxFJShY%@W*<3jrygpsV&j(4?*RmYekWC^4feJ!l`gHsDZwdm zOHSThBG>dP*pN3umpASjT^F}zkNHt}Yjf0NLSTT(Amn3Z(EG=&b}Opup3!mENh!eK zl-ii(mVb{8!hZ8=MPg%i7V!cpM3G691%vT;iIB*>SzlOwS!4{gf|FJfTVdDhgi7lO zN}|95pxd+U0ZKtj&|ef}6=xp-T|WH~-^%Hv#o5vLR^0XLD(R*!{1_oT<1aXQ7eJA_5T?L$C#e8l z+59MCdEQ+UyZ2RIE=Kqg>873&*8)q9t^xGDkIo;y%rc6& zQ}5j@0=$vgQA9RSCx%vsAcI3jBh|MCDclg;V@f7p6hS^K56*yjhx&Iu$+uP9i9EOY z4ylq$Az1mX>foh{h(_ZoTvJluiE>oFV};e@gRbi!zE`C=<GHYs@Tw0ldcWs=$Lh zuPOm7UbO$Ox{CkoPB!cCHeq7W@<>AY70wK{9_Zz4!q1i$FRokabyRdN7qh z>X;oxZB7|&0hZoIfBdg=mTFRBQ)Ky_bH((-=`~kw83I1&+A*pDT}ylb&?W<>noJ28 zjxN(dC{_nH-PD1ukl#I~-|f#Q-fzZ%5?8L1%fw;Inp?WC109?w7EQ_nPt=`OogYMVE8Pv*Od!OcX#<9VwY~{3`oXRE zWQ(+h+(a^SatxtY!0rV(oz#20-cW(UhbRIjDA5oQx4$&yK@0>Z;G>c~sRZGqjGD1& zL)6HBXr}b{T#nMAcGi*U@Bw%SZyv~m&&veM%hLIESr<#cnM#a-K;e z!_snYL3?AtT3h!0^Inx`%uzq1qx@=K05HE`2=S=_paib)<51)qGk}ZFYB`R?>g?b% zau9e?Nc5@L4R2DEUNQuK|23-{w|g=R zfRWI_@r8?r2~wPJ)hlBNd}ATLEPfFWh8#f2kD)lK!^Jbwe+=cfm$Cw5f;usnL;Wru z46#!&T4{PkSK!h=DxMIXxAyV3=E+&MtEd_8*EO6U#n)7%K+?*UF5BD8ej`R za8W=hi}3zkapT_=L)C$A!RS{KkP|K#_cLIdIF6wli^Tg=65h%f8b#*0pJbv4FH{OLjcNY6oE57lLBydz6GoKKm?vjV18|^j>y-_dzSwtorJ%qiJDkh z<-+YbufXsk!@F0Ohw;LCF+|oC;Z{W_GJV?jNz=*N!>s^u*5G}NWOUDId6Um>5Bm^2 z3F|K>muZov-}O|dJAG9!86)HiliBx7XL-^uf(p$a^}a2ff1*?3yare0v2b}K-@Z9u zeQ7MjH)i%QJ|^e}5_?~po%<<#9xl$lD%9p<2`J`r6mv-XjPJXoX4agYL#N5qCvo;J z#g^?Az5ZOTeO1yTqIuuvo-$r_hmNo#IBbbVgW9yZ?rT-9COclWFz5j!E>L%w20{IM zT(!oK@g%{=z?Hl`v7MZXY7SyHu#U&q|5ck~fwbeX@wle8nc~_p*h-6%&cf%0=&8NS z3qm-N)cdWsn%Qi6W;iF&S23u9G0B$`5}xZb1668q`+QeHg{V0_D!=5OE;7?-Gc;dU zux_Hd>CLZK*3p%n<@9S4XHpTLpw%752MNS4B+VnQu7|(u*j(!hq>^&c{rmFhWkDQ- zL?e&H-xvpo<5v*pY%mD+cJas8xJYwiHTkpTfBCi$IMZo=A@@5Ah^2?dO2QX6i2Q%; zP*&I>5YBU;xq_FLSumWK&La$aajqhecZZ^agdLUZ6v;+B5^vVF@1u9hrOS5r~UK9T0X3RHZ?> znZZQmt!0*PVJ*pA z@{i#g0sh6gjA70X(!_qsM3WNp=v7YhJqZbOZIegrdL<(LU1r$vsZCC&DV=8{((D3$)DLr2PCrd)1?JZ?Usj@ZMF)I>=Lz? zTXdD@I}C^Y_<0wIg6v7pC4 z9ZZ}uuIoYf3m`08FB&50hzhYyW`T+Y!KF%|$}XrPfWfxiL@cG$@`#THIxJR7hI{*G zEdYI)ba{nV^X8>}9_1&aS}#*5t0OyRT0h~S5l2#2@i2W{K~xR6dd#ay5e62^-{KO^ z`%Fmp;vS;dF=p%YFo>Mk{7__=!Qtx7ot@~?l3-D_yoeX?>8j61TnnTe%cJ?J0??0K z@_L!i`HILqw1^crLWMb(WLEn;*mvM6_%tM@ibAxevT?~lwGFQ+-x@iH>?)ZWgIC7MT zc1}nPz&8Jz@X8c4!^1uvlh-@lv?i&PH7qvwZp%uG=Z=nY2s9Qs86J%MC8Ku_;iMN0 z!kYssh(YrY1r2KfVq}B}1zg<`G(PgQQTS3DWI6a~|6Br?r)NH?U-OEK# z8HCxf(n&Pr{3lL%cxSzK@k`U5;*PZ`FmLw!4G?x5$p*nzBgnih*jS~fuQG$*s;ZNU zA@)J60F5n@sEM-$2nPeX*>l)7?@L+cW;fjc+ITWy}ZF7%{r9Q$0=|nyC4D zCedVQBEhUgt7QEMYJZH7!54Hd2o@mSp%V^TN7(*Eo%Gq}#or);mp8Kk^fg@iZ$vK} zeSFSA(gy~69%vc9;=7xXyU8kZb-bC=TQbHkuhRTR;H;x+n8;qd-8&ch2HMvQPYM#eRGQ+alu063Pv1%P6x5Kjv z?9j;Jy>Ho(v=p}Zl+Ic>S0zDbc$m-q@`Z1fe<RG z*%Fk=IpszV%}i~}va)tlSR{Cs3;wF2>b2Uksluf^FDNJERa_)+a}b<=(Ql`Hv6eNW zS;)qhS&Tk>*X#2}*soltXoKh{DAlbdldx z!=B*s4Hq{dv`44cWMVyU>{ua*ccgj{=a1#1A^*y7COANUajuR=OA(ocx*_4={~C?r z5P{cU{I*D9gM=Wk(~fAOE7FkwA$Q1|#+%FU-d_6fC_&VJEKp{wHeXlT9i(*x!#|IU zLmYiX1FY1_AOI>G1^wb%9RVEiE7Z6YG83?*104z*YpRN@ms{DD4(cPuFPc7Tb}U z(OY8ef=!n!EtKJ4P!hWNh1aA*g`+v_gv-4)%a5o=0juWz`q3_BFfq^?fhlW3j!pc0=P< zoWT$9+J>SoNa=e&t!a7Dv0e_j&QxREEu6&$4^b)j{KC67Ax=|mpY^O@BzJh;kj_2U z)6ldB@lAus4AaJcakj;pp1hq*80)&x{cVefx9O9(`HxE%6+bU&c#f?LF&;11!@hla z71O6wSy{_&QOH+=xVQerT1Kc#iS5I58B)Ee;1~I5Ia9FDuSzUd`GRuSUh6pYS+AG# z-kXxFas2{5S<}>@|8h}+EERuZe>7uHsPX>&3p7J4>Y7V7EpRwsx}O3`PGu;|f+j(N zC^tT-&8>=ig$v7q-Lh?Hc!H@kq!-}~91ZwUjQ;)rgMb0i*-6Gyn)7}zsH(fMj^i*a z#1d!xX*p-K=k`+Fi;Pq52OqgKesF#!qBGyR+@c|a&kHVN^B#}K+C;~cmGYjV4ztM5-s(ZRoVK(|1BqjKN_o+}EmFFylck8hc zDe!rDffiWtk`s)i`XY>vfqPCe&$ccQaVd+hm5$9LyCFa)yQ)k*lQ*rvz*@qrU_v!q zm!9>*_mvkPvV_>%3U1cvDCft`ECvJTUj?Y4ST0Y)87==l%_!J5xFpaVt+FHXmdCdG zyZ!4Ay7VvaJh&AcP-3TUYqf+c?AJ{W zG%FtB4?h_t-6T!>90VaVhsVjkv8$c0DLHMoGfc9gf=`!;lLYrYg_Y5qox0p{?xPi=rL{iGKza-j9(n4i(mzWGnFarlZ~T$w~^f(qq3@OW4}Uv*Qqys z@`+S+C!NmZ1b0G7Wr)|vu*FJPD95T*JXnu$;b8`AJJ#|_^2-OEmFXbS3-cfPz4SF# z4+>UJyU^T$9{7mDKs|g+8F;;@=<#(fm)M2d?GG6@s5m4k4EA)NCBS#y`1#9pC4&D{Fz2gRHrhQh+Qznm2o=%t@JMV50L+U>!oSe%DfS=y z2O{GPsaG@N#)k2NfOd$25$*>n$1U5(f*Al$8x{6CSet*8Vx}d*ErnX?3xiMYSNo43 z{0GnzH+mMl|I#o!zF-+0<+ab_$7z|SGbx*vS3kC2HcQJKau!TwV)U_3D?L~Zo=5IN z)Iov~PA$|BdZ!Y)xYa1-z-=W^s@y^-2t1hY|LT^j1Nq3FZ(W~@EY@u)WOTv&*_=2` zb9@VvNP2$hOnR^|(lwX<|gM6kj8G%~+Q-ye#hTJi~D?zB%NG-A{7_-u>t z{ogGI1`oD$_>aF*K9x6>tNp0$ALPs3dm$wF^1RChwPC z$@bLGndzDKF)J&}KEBv%J*GYi)L(rC(F*9LuL!JuEq*2idRdjqdXPS3@_uS}WvTIT zx5-c!7jy09OTnHZ?6)K@oJxy_vuCc5k^~%3kygCu;mYkm7>9egQJbPg=SpsdI+CAh z5_S~1BbfoNREWb1vtoRKo~MU69a;3Xp`E2+TA7Y4F*lf^{TXEMFz&(;Fex`nh!qhYBy}@^l+ixi-DV`IHJNTIATWY6} zUu^xjrs#Lw^$o3*3+C^Q-P;4LSnh=4`dO1F-BPTJwW||HP|&2f8CdXQwNM*+hE-ds zplzSW+?kUps4H?^xd{m2bZ)uvL(A{(k2dkHxkE#JOzY0Aj+Dw1-?%$^!)_%kY){(7 zKKtxt>wWtZA(-|}PX`1q;)_9GXV_lb;ln{6Ft_#5_BgeK`MUGw=_;2n(m z)v}%V4WGbA_t+5qRzlXv08;qMl-_nnGK2l>o7A@hx?)RGOo%pz<`?2{(_k`%qg>gH zm8oUwDhSKA8h17o8wfzj!Jpt$06e*z+Cjeg4?bYjRdsmz4Y=xgYo?DmwDS(o#Y^FS zl~;R4xXsrUcpAOwuZWCIr+pW4-dtdA#r$%V@Vg(@a4vIHvI@h1u+S6lF-W!Q9lw() zt@sr0*3@FVmUJ7wS5zst&Ofp)a!q{))c~3Q{T0(5PUqnZME>dqY_zgZfpeFp*az>b1Alld68{sckP-r>m?&&V3`L7@RzHHC{4DIybzA-aRjG0M}27}I635#$GM?ik_P`aQD%ezkXRvuTTsKx{z z$1_>@C-M*k3lzPCAQ^AfVo$qwp!kR2`792?dZJb%VxRJNS?^Bmlftca9#6%CfNi)I6r9m2<^hEK^?(bu0bjoURs!WLOuMTuPF(5HAK9Q`vav65>@ zwrL|4K-U-J_8`P-jADnSQytBMyt?_+f8iRjNr+?#4gz0Bf~ua-DvS&{6!$s~-^_ue z;sF2x3;IHEvOHm?qIZXWRt2OmxC%bGz#ggW0^jIpy&Vf#nUJ+gKu;{a8vboH5l+0B zxFY);;Y1!LgX+n+y2(A>;q{of$yW6`3LJ}~`Q7N0PboV#$CjX2%S#`Ey+w7?Fv5@_ zl^>+bi~H(_ThPn^pg{P|$~aDX6M0!h#t8@yPL)Cj@WiV_3&-nZ6<`8i$-i3VLd(Ph zJzp&UvZxF9`n>#+{(O_Lc)*LIUj|yjO_K6+=*^%9Px`r6>n<)k)~OqdwvL3N*%gol znX34ZB}8cIC4gMoKFW(kscS6YTBDrzK{Gb%!tdeAVCPl(8K5j{=VkIK4W%x}0;K2rh*NBb88ca?NoV6^q?9qlrPaWZv6zq}|Y?obpf>jI1; zPy}1|T?4INFUa*G!#t;0PnWt9n8~8A8y5{w=%@bTzuewM@nA?zCvQ8TJfvuLC-r8L zr%jOkoz&6uq2=sUDoPCvL-uC@A*o@((xSF3!qt<%|M4gg5N-k&+s`2?Pl+tu778vz zcEVG~$~oS`XMwi4v->Ht7?Yh-(%J{t%5bEGdFGxxNfUvdBVd zydP+(ApB?!$2Ak1b#IkE=<6fM=Tb*E4aTQQ8Jq!qkQ{p-p>93;JJ|JStq9?E7xLZ5 zB$^o8)CbH4RWe+n#cQbt^fUA)3#3el-H3YuezQxj$%?(O_Y07v}O{qFu| z3Dh_V?>hbo2big6~Gi0O4<=(BdGi&R@lf{{;lO22q;pxDP zWC8D{DvMd&EZ*ixy$y3cM9dNma&V76xOl0rPyxL18D?(qJsbU`ZON?x&TY`qrY@FE zu7Sgh&idtsJfEC$i`%J|6d797oe5NGXPZ2}U#~bQ!E9=<{$CaEfB*b%?3yFte=2PK zZ|%vKSE8d=Wy2FAPg;bQHNLl)p0MCpyRCp*OZ8S==(_@Rkwtm{QM-@aj@uYga+*&$ zoo(d0O1*L{GljIj`?E$rHCEY0*-u`ZYrCjvo=l6R$w2`V**xZDDxLY6ZEB3<-aI`^ zcBEM0;l=+?&;EboIZE_6AFViZ9);L$?jIvRK(HY|Bazz(T);2N@?d3Dc0OQx%LQYs z>6rHd#_wm<Oq%RIJ+;1nY zU!@a^yA)dxmxH;LYU-Rbp?uHC@jRb=I5|}LT3sXRS-_}HeYd%Y1b=yXZVo>&)#}6n z0Oza~mXc+OwcTrM}eA3c46}Jwoj4W;1?~ zWX&{qB)x_sm$irr7-m2s^0pmyW6aT)Esmys^k!!hbQ+61J<^P8tNcSkOl1d!o=%ou zsZFuvAKZAzDUIrj5szYik(Rv|pY-761%7IePc|h#`Lyyhg}dYyUs8+d?zc7WWvp;} zwx`BTyX+H{PBn{X=bUb2#cKPjG}stgQgO*&xRLyt@dCx zoQQ?FyRqSQ)UFua#iP$;SQDY`(CGco=1i?8Y2gdTFXHhg-i3yp{KaC^`7K5|a6!DK ziP$9(-6((&j!!vG~ zww0o8#!nnZrcqTB)>Br;IyBixaBP+{zP3xQd1Q8PbCuv*^|+^nB?R*p7&0WiTw@e?E(` zN7N7A6B~orBWD1Q{3P&apv7_%EDS)AxeKDJ@#5a^$~3(>qn^z*g!0TdWElL4*-2M0 zrsNA*4_o-HJ6V^KY}^*pdPq~aH6D9^TkSPIWqCM?DB_YkT(TuuU^X&qTocCclb~!{ zpFCGxRChO?U+QDP#R8QnRnbf)7QJ7SRfe@Gz>P>F1$pJZzrCxTG%*}Eb2#ZYq9t~7 z)2+sIoYKt8bKtk}B^o$Xlw_dh*FeaqijZ{2riP1FF z-Ihn-tSlgfqbf2{Dhr~;yPlsPK5f)?QCe7-_)>27nk82C4uH~7W({jKElY*LrEvLK zMO&#>c`enc637{ElL=IImG(38811)(G3mE~J0B8Zmi4=Ivc`At0fEiE!g)>84mB=| za8yxrp$%^0jFje)_C~$8Wj;Yu0$gb>#YY#p4Qss~_;6%&7oVtGGcq$o-tNts^wxf3 zCRktlvW}s%QbGFjFBbt1`M|GuTM51b%r|rN6K3J~ovq`d zvZeZ_;O*^ED*niBaKg#s@ygkp#}#6aHRi5rJi5Ge)7v_iS}{dGMk!(BR(5r>^3o!+ zUolMV(I|fkiShjRD<6h#+_VK}NvZOUyqvc%QMz4e+#$_s*#J#pzdJjlJNtqv;>C^@ zm`_ADvjnlTPl!sQ9tlp*9(|+ifGI}`wjSviZJzp=!)xpjMUD*HH?dY40$tH#vW}h{ z-z1o%1N+!6=A!r%xhA5dsQd~HE2_q;Nf)=BgC0I54^^Zpkj?h6;XjP#alF9Q^J40= z%k*8G{mkQKfwb_S{Q(lU`FWeGI6u`;e|V-GSFP01@W5)r^#LXOP%XEkh``tzgdR>V z=Y6-9me*FDi;s)fl(Pj)&aNP%$)3DoDlera(OleChI zm`j2p!#7P6b;`>O#!}VX+B(=)Ln`3=$C zX*X1NtNDBf5RL@up-CgNu5O~Ge&D}E1;%3%G2|brTGBv@i!~} zVl!PTlYfk-_`(bya0Ndod=g)BrX#&Ko9?=K5B_O9(ezPYdX5;lNPy+~{A@17L7wV2 zkikgE$+zj}i(*AOGgovnDqiZp2B)93u*d zN@BmpPh9gdk`jZMd@JFu!+W+sj9xhKfAdHFom=?yZz$^jmuWb3br`Rm9#{#qpgU7xxKIBr~h_}dQ}2Bob*NAZY5 zDe-UgD{C8_755&cbbC;DhE5wQ`{kuNUIU4{tMBz>r|zq86F`1w%W)M&sffTg%Y%YF zol1Gp3=xu&v@5fgi$U>{hL>Db2ENTzxH4X`wSPS2DHZ>DvcHw)5ys_p-2~VrbDQA2 z86>9>I;?1A$t`IsA$g)JDM={tsI3X`ZOLeI)|-i2zL(iTs&FpZ*5A3FH9hT^x~9tG zS9i*?*Y#_ zgG-e@jt%!qR5t#wdyNsj`d!!ats~J0&%Ht)dPhetXH}2Z>EjH(zyKi2ch8=)`jKoN z6aPTgBcd$Z&QihF@BO>CFHXZ|R&qjnk8{{-H(YqgJ7^d1=J_t_&H1nB{s_|ClP&%t zsBv9u>FjCwUgl0-`EF8+g$1dE%!#kE90#MBEf%fjbjtj)s%Og{cGONqxx9Gura-V2f)01ZA z2Cpk+{Y+8@)#eydsA8*n0Hl7S14*0lvge^1I$ZB3aMA2UX-!ELc;dJ`Ezh!Y5a#a8 zn4L17^eN}YQ_O9xgh13P>vtGiApN+DEKo_#A@CbB_=Ub(q)AMi4f_CR8&kdEfTWiU)Q~F^IBj2~*0A|1n8rBcFg4PdFjy$Qy_OcjmT*=7 z-JIpO_zLPvLw?~WYB<#Utkwyj5r?y_(e+FI)`->o_NgyNLVNM~yRiW{^q0=}cp;E< z^~39j7yU1;XAs1o_@{owvnzWw`MB}1GO{=W)Va|ayLG#k}i7 zqu+9yF|*Q)`b>jB0rlgKCQ%9J0ba9X~MJb)T1R&M*PG0 zA`hWJjY!pSTq~91Pb>V`)1R#)0;^`$j5W>Wu zC&74zyg<+x2nu6%{AP)0w+z*EYk-@rEk&(f-65s3eJ+j8$;1Lh z*oe>o={CP4#!!MMuow zJ!nQ)^Zh{a*1OpBfTa8ix+IkOV4+n=mQ}y4r(ebVof=Vux1$?XolK}-U&Yl1i^Y)E z+qJl%@Fi_4d!5$APV=BVa$?~YZb1_UZfUR5xUE-pJwB$C{fY8Bqc%1nbA`Zyl<9wR zMv6$YUNe0=Wi{qp_);hnL9f&#yJfQxioY3$x#zmO(5E|knx-g|*@`bPeSp(mj{DHc zfX`DAS+Qv1jL09|J-+^?OwN&q9aH{XbH)3Rfh(~5f~nf`@6k4w50CeaigathhICuo z$atJz`n}f@js_(>W@^&~jShhQ{P~w(`Crto+bVoG#-0uYRkJttz)EgKJMN}NZj|!p z=|?`@qq{?dHbv!kGjbc5^(@;wf~4|55%+R@NLMD+sESU(Hk`K}2R=%a{i#99@Gf~a zYwX>;D`8Q%oJ*{43^x48TYO^b2?M;Jn`<29a)sr}yclaQ26GYwvUrPJe( zHW1XLzQVTG21aGW#};n>uiCCVs)=pg+m5J!Vxc#sC{m>gf+8aQ&=r*4A;f^vOCZMr zNEeVqK|nfEf(S|Iks72*OCS-D&;$&D&;kjZH|L&v&hp;1Zhi0lH9NCr&&-~^XZFtb z{mM`PTbbs=$zpN(Lfr=zb2?1j9_?(kU%gZp1 ztIryB#P{$Od6V98?4^aTt5zrQ@$=)&Tb{2p7K8cqt0*C@vm9cIAS_xhIw1Mvw|)Ni z@g2U8@)pDFPSeXQ;#kWVglhQCGlh17;Bg+oTXd}| z3<3%_qzF>z<~8R|-gc$sk9+NG0$7paUO%Up~Z?+*A}*zI4_Lk@EnbRQ0e*P;M;XUswE#BDbhs>UES+LZ%I*d^Tin=4^x!05gn*7q& zQfEV{h007W?Rry!3BfQg7%`4;dsXG#wD1XU2idyjhE*n7rCDy&*Fw-VpuVr@EnqC9 z`0}wRI?(KcJV^E;RHV+lmHA*T=gGb(QxAXRJYa4!Ds56%;msE{hs>RQ5Yt~D94kVr z9#XL<#qMlFW;naPFFZEX=DV`v!_R7&okgvf*lwx}q+t=aV{x8i%+BNw<->8P8X^Ie z%}~hX>4$+;YS<>1xd`Mx__s%9qN=-qv8F!!>_)S*I z7273k?NMZ-=cBTFU%XcJ5f)3_rydm=NPGNj==9?DESJ!IHjWp4IXOYuFv%PK1bpqI z&`4okiSELUre>IImd1dmO#j;JyK1db6;cjMjDU@Bp#Hdt|%@no)K?WETE{of8Hn~l*x0^B! zY(O_S<~G~53+Oz5_OSNeI;|kJI%v?+WP4aQeS^d#iZW=?hex_u~PG?w+K5$!| zO1`khS-rUHJ;C~|vBbjG&*mPpPSIDW^ZdJ$q^g?3gCXHFF|A$L4^X|CP#;vHw$U0p zJojy9v*0~yz_HHiEmEd==vMMZgE_0|TW;RZ!D!$yt)8BfWkox;((fFdgNR47+;U?SiU7S&##{w&PveNA08!V11Y z#QC_TvGqu2yOry`8itUbw_(i5SmM(*_OBI2fd5!983K05Y|GdzLR5P5X#`Q-l~)Rj z`VO^2cla)FqRPJs9+Ov;Y(Es`J`L4kNI_jz;aN9w$@YrI)v0)?9gpF8{CS31bT{=o z!awu^=6fuy_tAbiH?NsK3dB$`WuYjSMD~Xv;$Ssy!!q%NKnoHmHM( zT*WLtq$v!fUb*R(Ud^IwgxJm8qDea&5@^e+-cG7S+Yir0z?e;l_I%)#fiLmAJ}BLf zdqxCzuN*lPY-=5q-0Le-aI?H8=jDsz2WCo+JRZJO0ebRr4pm{1tZ1N=NxJKizPlUf zJJ*rv$ve+$7=2kwO^Il`DCvNz_2hZUpiz`l^F)t+8yk z@eR&sL35_{#XQ;PY(ejb3$BDdl~!;Oz95!;mQGnsHl>xoV{XSFnM#-gS1) z6$5ZG9i^H1rKH~NL*lh6lXgF4pS^_OPHX6a7C&dp_99O71;Sjv?j=`S8)arjqA^Ti zdy`X}Wr`s&4t5o_eh(-;eSMI9TO#q^E-OyB#<9)!G)|+Ldo2=`3*HtI8iEAM@!HUX z`)fxgiQt(>KJ&IkZ*XE3V~I5VPIK?7ZWT#_=Gp+DLV@kbIlj!t1}^FCL3$B{xQs~p ztswOKMF=F6kE0zoKQLFvnsULOvhI1~n)ca@E8~6V6zl|#>zX&speS?r9u#KKt42sJ zZvAI>-eH8KB|Wt%r(=lXIO((15ajb6NKrUctsnd$SNmi65Rj!8wtx|I3kv`A$FR1g z4{bUDGsa)EU-*Q$*Bnq^o1B&V4vg>Rav$HKND^uC>ql97>XL4Exm)o2Xz?DgnxNuf z@nPws$an8Ta1@*9oDhUnSO-1}axs^!%+CkG4LP0Tm6c&C-Q0&;nTeZ|z@c2FRfGz5 z=8jASrHtzdC+3=t55E%^`czX7OI43h--@HZ^TImS;VW!S;WshxAfjLb+g3#g!jFg( zxhXWs{aT|n?XnbFklzZ1&hxOc+87etu_VB1n}O{8nDUEqWyM{FCD@AbLJ|JE_r{>;;8X z(w|HO#;a2?vhO^LY{q*D9y%|+bg$}0gW~h5;Ku#!ex}M*45g6x*2yz_ZvpLYO@33~ zlWAaNd*E?o{;6}11adu(oUY+I^5)^e>t#)=oFiB^jSJI`CkzTe^@!)vzsWBntl|yV z#M7Jeoxy(fc3150Ps)c3eOKaU=h%65!9VI$?L)Hn^!q?HXB`LP1B^v|Q-!;GWJaYZ z@uL~epHVssK(i%L0>D_@;)>H74&g9CZsWVVWzI}+R<62-N{Ms`Ssl*!t zM%Ade+l>27(=z0nihe&AB%EoVP3ZtFY1YKx1jDB8d>DoL5E3i2!?}tz>aXX2F<>8= z@~VsVp#5BRo0fb9$1i#G(*d`IFPnS*ExVqr6wlV+9L@^n?XpK?x-xqxivKRU@fFT< z%V4G4TE<`fn*NI(fdtVsX#6}|+QsRlJj>SqeC<&%?tsX+}hImyR1##~bs#XE`;y~JNiN8gD9G1J5b zsXd_K?At_HuS(uBdG!76wR@vI=SJ&@HvSh=mntGN9T#RJ<>@g1 zL_&B+A*9U=(_9<>Q)LnYA~@Q1Z0P#>fB;yg=X>JOo!6v<1+g^Egh*+q7X2wW5H#b< zAzOgS811Z3v;%E1_Q$W~4Tz{FD7k0}gb$v`=NU;C*W%@yj}M=o@Ls<;;)Vvt^G8RA zN>fE^pMQ9BCRNu^zd51c=~zbj+s9p%epzf+rR_w@Q8qGi$gF0)Pj@?A>xzmktl_B* zVI<@5vG22cc{h|z@HA|)*nP--M+$2(Ng5-IuJlT^(-&b679o8SGZLHEyPNV}%f-Yv zrsI^*Vg|sNwUs;5g{hZ)S?`f4W!v5=CC`uB@=GWbyOr8ipbF`pRRN!jGjEx8DSz8M zx3K>}Ji|jV)vw}`CoGm)gnhzDH07l)cQ|rvhHMUSFUe2XX*v74LT1NWAOb3%bw#7k zB^}WpJbg|w%Iv^_pz?Z&ig&|NswExwWm0-+FB56alB)yN2$K8^h_wu5U zDsi2t6ROW?BXQselX6)A3YM95ycS&%m|y)Z7(Z2mZHFkfQQmq5gJ2VRO% z-N2>5zO^2l`M6Hey+oBE{FK({Mz}55Sow_VgU!nx@FiuzX3*?d*xQc_0=Uq%%Fb=r zS>*l|pAYeNSafsTZU{v)_#pxAZ)4YOR&{VvJ=Vnf1kaOF`M5c+3a(QpD!pVZO-+&m z*Oy$SrxXw}OFg<71W!&c)OcauRp#Y2DXUd%^!(}r;>ENw(3z zl$62OSIQ4V9+uVFdZ)Z5%W)WyjmD_%LrNq$S-h%7mTZemKIEy8tH?w9`fAwe`FDdh zdZ%g5dL$U<~Tzei31-6T>ebp{T(*s|9SsU zf36#h{#1qg=e}D1&Rg*Rb z`@FWGg-d$F-qS2*plS$tDOq)0^!fXNVor%wOl);BT@Q&}6~wkSOg+<}+i2zNKw-0} zQP(eopMJK>y~_U};;8WDe47Mswd;2W0Or#(+xD>mrYOOYesXGBk0~+sj%&B(9|ABhNxNW{MX_Ui$44W|&>_Ho?b9N!6>76LGB9|7f%6I;;m4CChc9D?VV z=I<3e_fPwtg?(-c1PINP{d1>SLo!u?tNwX~HLCH0qy!LfiKmQ{$?MpUYdLhCM&kqk z&3XN=b+D`PA({J8%awrY%xa}uq6hqL^ts?5MpYi%b@`WTpP?P9f$o&`Lzg4MtWhsu z&X#jnMNGJmiiQmN!OZ^Y-|H3pT~i%C)g~EP{^FBZ8y;r4yTM@D5)|CY`5Hp_+eaYr zmugcRa`v#V>aeKr8`l?A7#TMjZnW&h=r+HjprMh?7(IS=l8gfxUWwokCcP&HYDN_+#FOn<(-ms{M&@;WO! zz&+S?*z`fnNCQfpLJV@$ODZ9%0^ZMxj0gs$Nnsk;E4#ft+dk-@JQ2 zzF+HddjZ~t^;4aQvIBW>lK$fDCh>*n&^`yOtMbxbq$bT~sVs$V9O~&i z{rXIJZN4vBvqvnhIBz!t;4jx~Ozj>c0je9f0Ljph(UGR=8^ebs_DuLTZg1QXCWiU$ z9f1Hy;|s7(Akuwx|A`7fOy$7N+^6+ajrIx6{5EbWEGWIdB$>qx~tfwOdQg64_FjF(dPsTDWOF;$TsB;NB9h z3EJ5ycH+3E`X1JJfcZ@3uZ=-3X8p8Rx%cY<$F)kS)9{fBM`97wwB)IqP0*-TZ+WoJTH zOgyul*EZaB(|LyDQ&SCzwmIQC4$O%S45ZxL3+h#gZfCmGqigwK z<14Od?6OqZn`4aTXmo3*!?;i+NTN}oy#FFVM|9fZ$os+H@INg73y*+*XY$Sn1+dyT zPp7jJlcnB_yfm{`6s48WN)0dHQ!CJ$^Uu)8jZ4kIy>W?WQHtIHFYCdZ{B8M!A46@) z_ScrJKL@DELLSsLW~gyUi~1pL#hkd@&BD%nJn5}@B1GG9tv5|)8Z6%EC5ABw`XWLB z6&r=%dfUoBh%kIUeLOO9?PdB3K9iE$=;a~~)>%ep?glF`bBC2e!NW?XA~p?rfeM`@ zG_&{GLZQ+Z(y?AF$T+vEp_ix6y5619GHJ6=A#`ssLkxcGR?Tqf!pe%%!J^Fgz=S^W zUT3XN>J=w}je!b2mS*)HM;i^)W`QCpIURXcJs2W;Eo|>{*Yf$3$#wVK?}r{u{E2#e z&V269OUw6lK&yW%nLEv=@FW~IIrer=Z_y<06%tsJzt#For3B4?l1}dK{h?0!GW>yjAYFM)m1<_Ao;GHPI#3Qk$_3!R!v&0>@Gi#zODH zr8%o47Q5-X^QWKaQ{U3}rg@m!;`_NWo3ol;AHX1j!Rh`N9c8u?J8W)sX_8g9TTbgI z@_aWd_0xbR3_%u@dn}I|mcJ>4Eltgag+NK1QAN3|poy?w54^_jUoVuZvlhY` zc0)xI?2Udb)zP-mby3?ww__zQC#S#gv7V{a&SmFSFS6#*VvKUm_7!)sF#oO2g+cdQi+q|E@x3fDW<9pQ%}U8<#ZWpl)hd?PsPBY)FF{~S8~UyQIHLvw$WS$-Y=AJEz0Z~y=R literal 34004 zcmeFZcUY6(mM|It>4HkHQMy#=ASEI{KtM#g)QCtIB0WGLic+Ks2uKi6dNCl$P?=F!Ze`~}UfF^+K(xpGozc=#B{?DKM`T3t;k)HI_RMda& z_`lbP-vQUCFC~#Nkze8ikX^e(e(e&m0{|q!dYOdLAEf@?E|HN_T&5&}L`z4yq53Kb zd~$L!60nykC`fmQkgfwLu3f%_}?`Zy|rLA*cSI@-M%-rI!rIo`oM<-_&S2rJDKmPz|V9@I~ z;SrHhZ=;iv->0OeeMm>-l#K>_FhbUGOwta?RsmcU2$B%Wq`medX5sIASoC3=4#s@*sK+q=QU#;0VrZ~G!~xN8F=s(Igm{4EzJCX=$!emX#y#Fj_g!UZCNp1AmcVE#tD;$|o03=~`k%K1Lszx$ zCh=c?;}Cc~JEKPWhd4E5L8`OkeCv%WmOnqfz;U z%bQl6{c&9>4%{{6tEq&a^xyivDIUBFSIK@}v7{qVLwWzkRTz6!*fO7#BrL|V1AX(6 zt!`a}Kcle4<oiE9^LYZVPr8@-f51W*e_5&?H@g^7Sm{6qjP zXo=z%5wJm*M+7Viz?ZD*bLIXEcQqFE103OPG@prpUu?QW!1wz^KwAP|3X^od`GYo0U!Rc;K;u>aQyj9;-kMUK-)37 zQZ>(h!Ab-?e(Ul|=vCsz2nR5y1J^B8nIQHy~1695a zx-3rebzY$Ctd5WDpnOM?&b7Dtx?=b58vne@RdJf22T1t049l$e%2ytE@OOcOv>lCw zeqwm|7y65L56#eX^~p4#6KhTvNO^MIl^pn@NTN~YUYIWXjptIYsuce1l$oTpYTMdY zgQ|bXYkBi$JNIyNRi1>Tx89SkTNix!JXVBj!wWA$F8lAsHm`B{#MntBS#N+=n-(dU z06HW){Ky|&vT4V|SZMk7s3yr!RQQ=e{~CSG7>5!EvK$*y+bwmrxwwF1swDz=%99|d z)mugIiQ@@ELQsM{{z}Bs$1>ksr0|}NPLg{bN5hJkfkO){7!06zq zOi3a!p$xTjvcQd6FMkb3KU~21C;SUc+y8(m(Ippe(F@<;1-*cG=q@LmGZYg6uYk7j z_T3g`_#l{)B$G2y*j*s{0um2CoM=U1g&_nLFyD~QdHH*i=v56}Bm$z6JAp?$CPV<4 zdIJ#C_?=HSJbNh zBOI_8E#OuQX{5WDi`N7`LuU9dKSLb#`8EOQf$1XzVHJr0id`b0+vR_S!u^#+lI5Sava#3xi&M-DFF7;BlXveiV&AG75dj)wAT---N>3C;bFaJa8p zkp?n5$Udh^m<3|4LvsnQOW=z-6X1V8qdNbA&J#bXjQ*9Tp#P!h|4{UQc=UfS2LFdg z|3~WnP5S>=rLNZhi9Sg-0$~(JLED6NB0#5E`;J+h|H4kojWPbchH#Rv@?+m@d%SH^ zo31DH{@KrMf;J0DK7sJJ!kLY1sZyDZv;hB|-3mi@mL)KjG4Y6`jEDBkEb<>uB;ZV~ z3h{3w;YYz^eoOB3is;-8lt7SW_XQq~=_3O4?6sK9*Af4nVE-BW@dN`*tAq%cy!W?> zx8M=&BAHG%cTEUwir{m#t-4Jctn~$ZkW>$EsuzI>0OLrO#_$ItEtX$_pS74DUHa3l zdCAd2r5M@HRD@8B`w8;iVW5^PtH{b<+JORzli~M=Skg12XiIeE6Ko^DFTAZm(c=6B z*YfSv3v=BNe)Dl9*4Di@>w@)*tZvauYS4*B(C5E0wxD|b_-VeeT)wE@K~2mcT1DpE zSNLrqz5egl?&&8M6S=tTT&|VOc0 z%%|5W7(FLYPNn4$pldhLB{0DunEuk7=(CEk>WqHJr(^OuXIdTT+l^Yav@^K(2X(Xs zcUKVy^Bxc1v&q$Gpj?_IeD}s1c0#zJ&ez@|CG|oF#8O=Q<<82TKAJSyW;Kch{5tcV z(P(KJDywGq@D!-1NKz{EWTA)H?3oZHGrm4=!m903?0| zlzrhrc47eVO!6bCMLl7gM*|5I3$e@V?0{2FP;_g@x zRBybKAHAclWGg7%UT@@nG8WS}mpM7<^>IC`8dV6@X;r7if-#02cM8K-#>;WaD;XhN znl-6wF1zN6Y-jOsiLvP$UnAPSI=TE}rG3ni<;vbA6KlO@Q&lnd6Q)w? z)aX~(hj^9ZEz7&u zB`;t~&RFyGUCB4yu)H#Nsgpo-Xc|VUqoF%|U&0~Hd_vCsJsQ_JWySOGhH#kl>oDPK zP3%ts)9C zPPC{n z{s>rrN`|*}bKESFSGM-@iuQo)!SQyQp-iDt@csD-{e4}+1F;tbz7)rM9zIIFU@YBx ztK%ly79Ea{w9@^-!n<+8Z(!FjF`e@?X!x6|W-0w&)o+m#Mya}MqtAT(=U*WVVyK0m zetNJQ_qf7Ir~>XJMYS0!hmov@colA*pGMsrwu3Ni)Sgn#&selv?`ScRX<%~<&-aZ9 zI*X5PT6g77Fr+&!WKBt~Nvo{QOg&$4te5Sv`U$VhmA@r4;&#%|JUqPbAztl&f6?q9dmN}_9)Izw(=NI-jhA=7(Z-Nsn= zr4UAw_^$KuwE_L$3;%DaYU-G&4g;?b^ID?u45mfB;R4k!7#(w=hl^CPFiT*>kq6zQ zit!_NuKQIZFK$#vKbCs%`LAz37F4u2R6ZOuIUstK-#6#Res*-(_B~E^Z&{ddD6zbv z7-8l*+O%)HSx{BTB3T*`(yTgon;VfdFjp>hGyJ}JmR2m&uj_XS)tkK3STo2<_N&zE zmNPm;0F7k%%8V4ljIFF<6UVdNQnc{d&=cc3c{SLdw6k=lDV}3q#%J)9nAev96tZjoA4AZmN_zmur z@#Vw{thmq3^%X>K^#u%X`}|ZFfJ#Cl7Ou(fGtAm(`6;|AnspsEV81Ek^30`AMD?ZK zdbU-k{4r%MS_Z<3Gscdrh`G0%9i;kMvVf5&PTnQVLJ++*1*7sfZI_}=`vUt6*rCRbz8kTY~-0!Y8BN|QGU4KNw^ zgsC_br|*FuSAXcmX!<+KoH<_)7m|{ClJL9LzG)ae(Xk6Mz(=gcL&&g-kDyKVmoxNV zNCo`dEtplDws!1IPy(1fp=edU7g(C=3i8v=X!IJIakU$SOT-7kl=VhZ^tMw)gYu=K zxofRTXXYQ`4X+OSPWd6t$9u071otG(OLWs(PKvIcKZ|!ClLt+9cZ^S;gdy&LO138i`DYaO^)bO zL#)w-8#JanO8`^&de^s^s#|e-YjU%pWWj9$!unZY)9u|~H1Xz7uEplFs@AL|hB+zq zR+SW)_@7$qO*9&aG4l0(os5-5+A-*7Nkh`Lv?UaNm(-+gLD||3BdjJmn*)#V4CBhH zVU&&aS%FE@<87C_HVYB=_@kxY(WzWY0`%PA$!5o0PiPC}Y8XZ0{LuS$?yOpfLH#ko zq@6v#2VF^;>>tRcgoK`pNc?hYFl2IPvJUM|JvATFA%!w%CgS$j#?=Q8a_RJgoolK= zNBx|8u4Gv4?$on)CcgBJWa{}|wKHko{;O`_ox9&=e|~M}aH8dyt25*1arn+5 zzq7!BlXXBJejl%NQ78N5mq5NXZCj;aCne#dHkwvWCimqauT4orsd3LAVHjeBBjvYu?^y2a36AUu)CMAjEqB*MI`wtKSSUZ41PB>b`;ar{Ax|l zy=(3I1ey)poK}n@khzA+jvVnwwFl*=HVeHfn%Qh|o3_ifmgry-_g48Z>yg5JYkJ}4 z_Z#c9%7_g8l<7^dzHO)cINoDxpvjq0FV;~KdT3>AWC2Mr=-hr*hVYy-ZaL=$y}|J- z#zG_)BM$W{-BoUtr&rT;RO_+|&Khz2xFY6j%3ZN&ZoYGV;nYli@&fIjwvx^6p4xy! z*lCc2uk)jDj`Vwmm*0HrAOdbt{q{3?-P(O)L|qiBX@EX$8w{Tg&-~UNSiTWpVQ~=g z)YH*GZ;RzA&G!zk9L%eO@qPB(sFUk+GY60(rE!Z}PeNQ@+ECIXB`h4h21U9L7I|5&Gu&Q0og2VmK|Bh?0>1xC%2S0)>d%-cFF zty*=~WCz1eY7lExeO{~Wa-9=>y0*+u?of&r*DI!Sf+|x{pa_sBIP#8DEqbs$lye+; z+^E78qf^~n?UF^ZTva|Z8NQMM+*6ePRxfD%+9t)vu}9e?ZuaRsQlfl4pr+M+Ha=lUM>WyUBJh@3Y%NwWpQ&Op~r$H!vtLmssQGFYA9PDZ>zeIei%H zZkGLZeO#)?NB+Q~er4&!QI^!?rhKqiUm{3h4tZFSfnog4S=hF~Zs%h4Q;hQSvuhcB zDNfO*iLCd3$7>1NDaH+ry?Win&QTYQr@=5*cw*N{xI&Fj1`xlKB8YDt z(wNJ&qme22PM77kXtTbuv6)xFCq8J2@)#W3a{3YK$|gYpGZtHenwsX>{xP%j;en^; z%`ipn`V>60!_1$)AZn)hA-a+3oa|HtZH2f&CWZK6|EPjD2yF2F8 z$00GXL;wSh%d>AutS?=B)%LD9mvBYg?h8*%@dsz#dHamtpX7S*l3^u$kTAZOZcflk zIpB4-EXlF*Csh@7jR(Fc#u@APSH9hnG}e6k z>1i!|#H1{Z{sMaMvFo8i-fF#LPHeqrl0|^O`QGujM)isT>+ukmVhRoUEU!4S2X;{3AWM)_P-=ltiBP`XE>p}?(Bp;&7o zz;Tmpd^)66=Bb86+XKw5jdxwxgO8Z*a^BJvvcIABJvIpb$P$2e|oS{GAcIt7N zr{fUq!)*#}5uv!xuaIrJCvkafPM5p-s|T=l5UCSYOr4pyAjUI7b`ZGHkWNT}-1at1 z^bq9nz>NplZ5x!Y{&Yy}%CMWaXjV3`I=ABPv$ovMt?8E=l+B428&iKSk`oR1&w53f z*D?>uyJZ9Y&AT<1UpQkw247IykOHEoB`f(3kpyNnw$%iEB_aS`PEdw#J|O+gwD!#!WlTlTzl>{1?I@Y8dYSD^_jFP`7XSJE?D|Tzhd=upBkDhMqV}5iu z>8E}=*ysNK_q!!1S3c+KZIJE!#HMG=Go%Nj^F?T>-GJ%x=9D0vx|!3o zyY>7*aBc9m&yYGBbg-=gE7irzf}xn6PsqcDtqq(HoOBJVoFSi82i9~7cnI8V?^e0e z+ZXZ3fAO8_@l4-`D)9v|&)Bc4LC;KF$`DX!n{g6keh!v|GgcCFC^TnY5@_zr8$W5@ zozb4F+TIAB&1P3;-$L>1go?R=(P{l(T96Rr0`{qx2;PVsJ42RzNmXndUQOb8X!@b!C##L5QSN;G_3K=s zvWLY;YdEJ{Y72D}dNn}B*Y@5yk6tibA~ZP4`0+}}Fjq%>fRq@F6SNy6qU9n^}oG#h^dJMw?Sq$Q{-E`h@*?C8)Q zUF9V++g5KlQ!Br?nZJE@>NNMvIv9!^*HzGtaJ5bUSXn7Wd)0Fpb`$Al$AgJTEOIH( zKu#`b_!I^{sl?|Cn8&zqr_Qqh{5CBYpEgL5_?yMA{0*X`Au@8kvT{@);i*lZJ;X=8 z_y^y8D^myhPqA&(lP)#sQ}$ zA#;0kGaj`*!=UF0z?n^O72jqSbGWaE$`Za$BKA?QQ2c_CdqiWCpAsOvF(B?CXl$nI z&LvZr84@OpO<8W-XWdG(lN;Levra{g!sHzaT2+k)cI=+jHoH#rh0lE`!*aaihOLsp z;^qoc^8B3w*;B>!Wtm2k0tLm77(F3rG#%~19Fs^;hrq099ll)*CF zZpBOufnSkL-|lH2KUJvlrY-?q4ZR6fpE(I7B?nNoVYUM*g`-AnGOR`=R%#TnRS2>$ zmPA~>0cO{D@8Pqj+KahAT}mu%nfJN!eRqd9E!8h1PYzlN;M=UXIuE_;ohE2M)1e-eY^XoH*MQR7hlIy_dgl3m2NK@HvKfME6})E zbE-P!;HawKF{by>peC!o*{&Z{pF4X4pI>Fmv;t|zn}L>YOjN-sTxDDWI8(6qj}6Q@ z!iTFG6~C3gPqVWzs)~E_>XQ9ONyax#7K;gtuIi#_t?|-jl|gE3U%PI@YNCI~Tj+{uRp(rctQmTYc$`eQ^XAnhv)uCO*V>vd z-W4g*Q`uQgnwTHnoZmU#4PH?U$8n$|@1twOP_>@&5{#XR&`iI6?P(QwjV`we+f{-1 zr>2euCAM$RdhFljc(`|gXpYOHzCpL{<7{dzf}+OCV0<+%Lf+5Ho_*7n!p-78^dwOw zu2HDSCbl$rMuRGEA@c?1_V!C#PDc)^8y zp{3eT(ROrWO)7rN2Hp}>mbIhRDy4nY;_5@(ChdIP6m$Y_Zqo=^{%&WrxeQ2NKQhyi zEaWPxNuKkao|wJ}oI#d3o2Zu?4}W~R&gLhkQXY($nVx9b+ElUY{sg63p3hzaPnQ~E zes?ynB5Vtz;k9#;&C9zO*{yM!*w*F!t5e-_ z3RyQMq^j@pf4C&zHRvPI`{fe<3x-Rr{K~ESHoGjSiiE0@W)Dcpo)_M;@as8h3Z*zO zj!R#F-NKgUZt`9oQw6SE0X-U1F5=%j$P0>ygGD)5mxi3_%yCHfa4p{1JxfV3 zu)vhPMsMq&f46V&3Ss=4zvx!(4B2j6b*=e@TY)2%x11o!{$wI&Uv;}#I))zOABq-M zz4-_!)py3auDjc85k@~2iL%&pc$aEbo#iwNAsTFzlWX;Po0rOYp=?WvZ(v5kk$&YI zTWML6Xna?U!rS12b`NLrfmg82Lfu)z)tdE~Yq#dF{(j-J)p#255{;oop407i!oF`4N138}MMNi6ZR9L32^VRt)G?N=I*k&G zpA(pY$2b=fdMfE4tk|~A2>Wkn^=5&ejMqvZ_s}LECp{hwN+WNUOe487mvMh#&6YCR zIvdiWnn1-+2}zIVdsY3C650~l!>))$?XAPMrzwI-HtLpo4Plq;0vq?^=J`=rn5xuC zoce^0%W|||*g{Q0~%|73hRKciF%y<3KnehsHCV=uK8<_;-)!EwkdmdjJxKw!alBw+pof^2$A z1XxPzd6%-VD9g?QM3^ys}y1PP_3``!6%cX?h&o&tu?(z%i zKX|U|NFlm&c1mBf{~jP)yV%UOG+(|{H_*HcWOKRGAx`j~cKPaNKB1eP+$Xfm8drnX zq@*~Y=4OzL-b$g|Eb?hQ9VP-&P~`pbGNM%_4Mwi`w0_6UeK1CaF%EQHyyfOL!sd=v z+(70M5pZSmg-e5}qOo|IHg!yWlG7vR9)WNAH)$2h(77t!PqAJFP+61eI+7+!v%^S5 z`f&vsTdQO$>cu>I`*J|TL{&10velekTlTw>e6NxIR)uNvd#>ocS{x+!ECrvh{M1hL zi)qHjUYet)Iie=D()^p+H^?-<2FAGy#pZVBn|taxFa{>6Dj}KU5Wj8O+xfh-=wZf? z5JIQgB1JRy3>hKtYIjF3D^ohawb!XIg^(0c);cl zly!br8n-0H4O7KRl>k|x+J~Lf2+=9SO}7JUUeoJ zvzJWP2v;x#h3Jb8>8)wC?kRcd&slSV2jdR}&`sB4Z}YFk>)5RDE3@C=>@^DS&UY5C zMSRIuR#7Ty4yg24cv!pXIm6W+rIy8cHUFWg*T=QY7Oo5_iXgrb(84i$^hXk%loN3!RPM|pYr zx}id`sC4^*mbT)4X_9Wwc1w)A*!B~WZ}asa>|b4x|L{u3d5Vj*DklXUQAe;88{bkZ zA^;Z~^yiB|QAnfVdNitylmVQ$=?vT-BLz^U{vJU6Z;wJ+O?0X1{4)w^#v?l3GKJwS zB?9c}vhlpfroLq`sec4ekN*)swa{22MS$;K{%`E8^807()rS9cAT2Reynotr)+ zgK)l-AtizfYjgxoQWIan6HtE=$?|WL$mr8gE0Xi_pFLL&;LPmQtbgK+k5j)HI*wSe zhJrMc+}W)?29NNW>3%x1w6HURK3$S1(Ok-= zz*_ue+CAu6pvfJp;~&!a;UdYvzZF&y{(ZL-<_KY8+0~24B87?t1}9#?b(EDBSmJew z0Dm@ca1t(IUD#+uvI>sHRX0=;0cGea`1w^9vO2%sj|oQLp@Py+Q|>j$E617nI})e4 zSuBZ$qqpUk7uZmX8Q{yIa+x8a8|NXmxfvjIDmLv@zQT!dLp6L#fES!+rd#jwS?F?Eh@{pCJp zQcV8Y7MH~F_k4(-r_77h$mq#q;ocCD2i(mo{L&0p&G?6lq8@xvL^sVzID z$uY}mpp)P0pEvu%5ovyvc11XgD6FQ!kCF@V-k9){;LdYh*MsJZoP1_lS-axHoBtXy z|MRNtG9Wq-lQR!ZFs~jtno&XOJZgHc32}F)Gmvl3ijMkJ$+U4vUM5Lz|LJEcghtXaZHMf*{!8etHJLLcGba*xR&iG`CC({=8M^!>{Ax^6!IY$Sh6mTF`fV=)uFR*eWrBZMbVyB&dBD9l|BvH>o z3?b1+{>i#2C)V!fT!ka+YOj*X`+V>{WXS_El4bJY#%Hh+ps7aLmXKGNXh(x z&5Xc);SU7{jS>5M>j=Cn_A+T*Yhhi{=j@VAuEE97L(@leU8|FuTk}Kw5PQPKyO7Hv z252JSB!uJ|#mGgr+g(9-g(a>4?MH5gzdaT&p;2E=249ZHa8Vf?EPYyEN0)c)qd^`$ zp$TVQe6$7jR&ua3lvE}nf$(7Py9%7r-NLnjhwX8?j!JGtO5_@Au^X%GrbNx&e6YD1 z1?IybLG?0RdrRSHxp012Er%^{Z}~$Os=MWER<(UvzycAM*T>ER_z#{(bNlAJsvvQ{mIyUQ>NukpO^Qe zqB&)FFa!l@>0WQrSuDKj_|C6L(2nj*>Sr3(4&^r(rP0r#P*`BIfr#r&IYy49{Qekm zYj@Ay#pzYIneP*h$3a)G+*4vXF-mgVz(u@x0sCf7O6f7X{-0&^SWaLuLdbv7W1{ zKhDFlD2tW3l70dAj$Ea26by=CAV+a=`;q7NHMJ2+61%^&n2m}|-!eZDA%97#BHIOL zconkh)6bJr;!iQ^6B|tnp;?V^O{m6_hib2wO8-ib;^~c(46rK^;HQ>mUOnV)*rv`n zqDsEhs0P#;**QWA8z%JDR8>W3(Tk{v#$R?TT8;~QPj9gjZ_wC0xUJ{ALS3X`DUmdE zBbOs5nwI`)v{)u)Ax;1t`L2&!f;)O=m*0b$je8wKN)gZLgo1Z7FD^r6Pky4?C6S&D z;I})=w+gn$dtzctM)~6@Dx8(IHy94@B`7=xFPgi&a11G$*iqE%V|Z(G`>sB(%}hY84B+-Z#Oe5((TfBil-kG zYg=P?wU@3M-R#pw5WZZw(nE zGL@IqXDRn_2AG65@=}rW5~EcTZUY7&^P#}sO!5Qmx4?t zUs6q$Ws{phwqGWuQ}bV>*3=Bq_o$Y&8d23hrCOOTAVvNhM+$HCXp8PP3XWw8e=mP! zCxp*!5qb`fc8ouMcRJT?Y zq2|z~Xmoj0zV8iwh1-Xl7Cxqx)xP%pN@o;%+6e&v_6RjOxI}L*nR=QfF-~S!<|Zn; z)-z3^2K#VumuFy2wU+mUA7HW6WZ9V_eauUW;%oU|*g^WfomF1wv=ISxU(bYiIU?*? z#7$F<$4pRK_`QS8Z-@ROoy->P*;SW$Tu6qNv=;NF>}5j+SAx{9y{cy8-U;IoNUn>g zhi8tZeI|9Qx%uMj4fg{SfmVwIdw$xYLH>Sx3%7>a!t1A$w)%RKBQ`F%O^L~=!Cngj z-<%s(%eM%vMmBeoyEgg6x)w{t=p!h+sgKIt1qQv89pSDT7tIbs<%c_i2`jubeRVOE zXzY(^_a%hg5qPT+nO##7*;73sMACrS}MBW$-5h8zQL8L zE>wBXWqLLv?E12kH2UEhj_GmS{+vn(M%_@xl28`{c2% ztiY^yY`g9@iM_}P5!0IeHCQU?E%YH)=5A0)80TH@`!*1~)~_lt5dFr zd-VML^iAg5IkA_`9+ACNp{?ZBFqQnp{6c!tG~+T{ZQXKBSf+f}z4?w#&Jo@cztoCj zOM9_*#r~_;X?CYV^Cn1f$lqGZR)^uek=ZdF*0)i2&(kS-dU}pjl_&NlUce~TN%-X_ zGF??#%wU=L(`d9kY1>2#pV5t*fWK*ikB&H#bW_Jf2xtqAOSq_Ej9S`&S9%cvh+T9Vsa7uoL{J8+kqSFB2~q@-jama~(~g)}$!?tib8g%} zbg>v*&JdXGa75;L5CL0x-+?<{&37~|%9xgWKX4|tKh4}|Ap)HH0|UTvp<>Gk;Z?GT z>p#6GMV52QhKEe`a|x%;6V5~BeZPFP6ljLm1e28cQxuY2;fE?6_6CA=Rb2u&8yTH4m-|&$EO!s_XHHVSzMc*{{DImVezCW zcea8YQ&PXyLaJ8`Q^oNnEZ6QL^X6^u300syK2EQcGQRI^d>W~~tgD#-#g|6Pc6|}L zULXW^R3w1k?!H(vRGpChoTeF+q=!#Ah70l7A1GAKJ`lM%He4Qavk6WbaL!_uN>Gt8tL7BbxDn!4( z4wDA|WeIyYM3`drtCMc>dw)K0kd4XG%3d*y<9YZSesxQn@w77FRzDzg9(IE?yB`SM zaIzL)Z8%OIBP6EAs_U5kIql(?)6-!9aLq;b2l=LHC@;KKkK`)>Ujb=6abkapkuX-9 z!+NK;=o|ctWjVNSIMgo={$;0DimqjL$nJUxD&C)zJvql}TtIMYb%x=gN+U2!uf<8^ z7r(~Gi&^8_58i*KThqKF@al1Hct|6c!;_EPuox204&c*rhg3CkaF2(PsY=HI20+_` zi7!ixQ|pkDo3Y9GACW=WL&6p6^^;|M0ceLR7rxOWc2aoq3o8NaCIY4cx>{IWU^7Tf zgCzYM%3^+351;T8ruhgI@yEO9Jx6f{`-ja(&Dpu6ZOH5rb=eLEo``@%i`MEuYXq-J ze93%ckU}W+(1QpwgkWOm&db|4*JC^%JZt}MPPE8X-jq`i?waf(Wl9-Lf2>6i8ttLZ z1*T8(=zAZasdokYJSekr5vHcL#1SVnq-b`8Q6V(e0-mP zJeqqrWA@6ix-M*sd-ss<-TnHbAIr#z-;6lUQV4Gv`t?eDwkIc-7?^EZ?lz^mjaC&l zhK1w%0HxPB%A)kFmgh|>+clFbiUBlAjUKrb_{~?HIxG=|Z^OQQG)*}jv*~Zac&6vi zRw-J=XG3IOKJcE+xjp!hrk|u5Y1T-j(TF42mSiNSi4!M)9lTJ-DPqq^1e3#m&cl8f zA0PjUoe%aZwRx;xtn0yPY5igOT4}LZ79|6-`JW97@6aC5k;)`|i7t>NiA%R$z}TY7 zBMaY}d_y!;iRvS3V>w$g2j6#LYPcBR7Dv1YcwKqA*W8jm zQsG=85fCSWS$j)@DU$>fIsYG+fY^)+ve15Y4m4`INxFD5RCG*r)$nW2QgEi49Y=jMKfQ< z4?0z4$jtB0%G7#NFOHUZfl0u&)|b5ko` zLjI@GCsjV+hf8PKy(s_1ES|2#7a*%*rQQ@X4uNvt=|l7Bo|zwn2bgy0?@sc$qH@1E zM+KIIc3rgz56|`8kDl)oGOTJKp0ZCr(YdO;yhfh=aE%?t?YY&`svw_|Gsoo)vCw?#B zuCXodgo5y2JaPJdbh?m559z(9Pu0yD>V95ZpVfBe|MfEH6}aprYz#XXRi9fN9ZxGY z7uI+TUq#8DZ+~at3a76r@G=TMwvL76@(|AK2vPn6u4A|c!UC|Gt&QL`GS_Q2@}Q{2{KnN93^%Xy#0%*gESBLG=b27xneIUCO+^>zVk?gqpKp_DPyNT4N|<|2pKO(NhaWjzs)$MlG5nQF)Sf_DR6MfIxb zO73PT9omo3T(VJN!y)A%k#iXRoo6a9(JSeaYL-FBHBx%iqY2bT22P4p?wYC4Bz$5t z{A5C%7Roxlc0OScVQ_s$kqvO>8ubdWGLawj6>FPA;#2;@NcetQ`DWA;0rZhA(3z!& zXVXVz%H2;8^%>V~avS{kOKGsKyt0QyqSd*W9I4=E1GLo3d5ULB2w%W56-=;UY6&!% zkP9^zbE|~61RzeWwt7@DwC7TFeAi}d2FIBx#j9#V;pkD)2?4gb@L!ut3m3mP3?uHy zz<+Ko?e}aySEuwU%C{YPAC#|EK=6FH;1$o$!(rkUU6eo6(35{)WN|UHnvEWuC-K;4 z;WjW>fIl9W!d?dBYNiGWp7D~O-@B#r(n_)U8C5e;u3#5H3PgxrfD;ly1P=TJWMB^w3 zYpVR+*;fg-aEACoKf_Bn&}b8AF#}G%dGF->)L3im>DV|%&uX_ODlbtE!dxhbZA&U+ zzcduuy};}@7!RU9g_iW&PpDFr8Z2G({ivocv#@BcGAEr(GacPx)s*q!7T}!*J4*@% za$=93=!5{LusQP}Zm5(U>*>|4JCWhb9+DRphYoRUyG&i0KPt}L?$u~~-?WX~IYjrh zqb{j(f6YKlCD9)%E-A+zT@6uZK6!+aay+o&k5Vqi+tCQ5fsM zeroTuy9$(^74ea_irPZli2zkUIF8ML2WwOLhRnrnsYE@V>-jlBJl7Nk7H8U~)Yi=azZ?T8f}1Rk@^kXR zfgea%Hve)T{~LurXTC%#BC2h}V1-w7V&xvgM>p@x?S6#8>3tf?H!l0g&k{y0vZsMn z-5p}DYft9|N7)wxE*_+`TO9K;82ox2JQaGM2#`B;(Pp3i72j)&n5?uNI>*N}Y%H650DY{JPZHhFoFaltiUx+YmLHJ^Ou;oHxa+CSqJ zzS37v+A%)TV7bVqH|iL?)zH009S=*J!opP(kP4QnMd@GrtFGVW5UMzWaB6;WleW&!LelAeR2`4wq$dj$jvpK0 z^iC~WOSxZ=?7UHnEQx!X@a6M z7P+!;!Bw4&mqL*I(pQQUc5aVOp6TE;_|GRemg_m;Z`BnNTaL2C#wPIwM_mmIubyQ3 zV^0pK2yevB3;DsA1d{o>Jqr?mb7M&-Fszj04oESJ1OsxCE9;XT9nRzO>6cvSXLu_a zOy(<$6Z;D3f&abMd?f-t6)`112%v1a07*562EkjIn;iT;5q`D^*HpWVp_arEI<`kpc5&YddqmL3&1S&gVg|c` zScQZ|!|v?Zc~MN~X$;}ED`#X(wRPOny}^g$&$aSo2i9~|Kg)kix-9u~()qdP_wN7( z3&PC@_-xV^$0wK%X|a!!W~ul5qMg9{@Xx3ce@4yyw;#$g)p7Y3BB9;tboh7zH5B|^ zou#^=VMJA!PRl*Gvx&xT|z%L+g~++AgW4!DmK0ZUFK(D@7_;b=-jOt}I+l5lGqbvcv^2EwpK z?6Vn;i&u#lb4)XT5P^~@_AVCpCXaf7wTXcC0d)ljf(|ttZQ@DAU_AzJQaY!2+GWa`a>~;*3rA4VoOW?+54v7T|fxwPz7KiYc$*uDov9$&#@%6a= zXVA(nFKo^@d-7jHM<|KYw92Sl5PNHnsyV9b|0wP|pqkpcby1YwEFd671q7uDh;*VN zARh`z}V=P}_ z?n)Fgv+b!>LZJ2*8>&%JEz@ox*JPBS_E$*{_VGW0VWJNNis#-ukE(YfVH@G%K7@QD zaP@=H+yl5o9cTpzu_C~!zPOFB)~z=N!u)GTXZn?ym(m&j8HP9qPt2QvyB=$PK&M~n zOID1b>9rV-e(|0UuOFxRN{_!eyN=`;`o7Tf;VB;xaOi$fpO@vo0RAo+@HxR~j8`X7 zHP7*u;G*WhjA~a$hRT0PQt1KVve!B>IJ76|wj+AoAUCLOhRtAB3UdwRa>i6`VWrFM zdBs`3z~mQJ@8a-v!NA@m*n$?KEAjO-J~LGae_TL_D+R1`nNWik>4#3LcKO+&YW^@n zLJj`Rkb!2d#(p4;%qh2rI^q-OE~c~1+D0cY8ah3<=HU7~&)rt>Jm8@ah9|tK=Zn?l z+R+_XQi$IqeV$Fssz3Sz!_r%mQ%zPK)&UDIu-&a;5&Yj1@;5Zo8M2e z-um=|DKb$4A26u;7y&ByANT#PrT14YYJa(v`(G9GovJh!OveD^&z3k-{2Jj5P}}GO zlAfYC^5Yh?EvDjqRk-I_B~Odp8Xrlbfw51ARc%Z%^~u85kA9N*k<3B%7OzP+uprF2 zxgIHfY*n}rJY(xLzTC-D@Fd)who|uL<;3@|Svi>QoIkNx?oDvi1vGN}NiSuWNVGYC zfoi9Cdi3Q_vbPL?E&uuuiAyHKCy?lkfpF#kF$)Y}BEU2sw5U8V&PIgU^X<(?F=t0R zxyn`Di=kNLU;aEgCq-cI!opi>T`<&mC7;fnJHtf*VtGa@$&YiOo(@ov1$TI=YL!85Zr zNrKFpjP&!s3Jm(X?Y=&eW&$y2ANJFY&fZa1-tkgha0!>cBO1Af$LKpvd*!?HO>C^y zs*1R8COo!3|HO5$LKv*68yT%fKt}|6GNy>CGJBMr0c!RfT6$e1pF?`mxIelDkRzj`F zXmtP=)qLP$3!Yya{UQiGi0Z@gdYY9c;o=G!`G7Ls0K3i@&@c#fXMg~c3K>cY1Ac2&dM zH9I@}74+p@p7G+@c{2C*!G=J~z(B54d)|Tgk~SG>qGH9I6^R;;Z2&Bp2#atADi8pj z0)AiJW+eEuyxdlLb5gQqxG-EqsK~}B!^Hm(!)AC*8xoNi-ngvBjEi}YkT0bJt@Eoq zaN6iym-WbaM3X9MU9R>#emQ_=D}hAqh-M52amxqJIg!s%6rxPPoNJmejU3SsVYqT# zDX-7j4iS?#oM8iBz^DO|VlN?u1=t7P2*({uD3yf~&TXQ=MDl<;fM<0z0|0FD0HL42 zWB2c~OE?IdH3Y)#`RPeaw#7(3i1BR`w9Xn({b+Kft5DC=QR_|Cf%CP>fIDz-!p}ORL7n8MGe8d>4e{mx{1?rx(=Eb*YPqB8b!EL@$8>vB{0q>=o~lB z0~uHLlZ>CT5WtzNfM(lqW7Xi?jEB`4z&b!>!VPFD*@Bx9hzr1!|5tr+IPV!CqI5)o z16C;-4W*xCaoVKPXUN?%AOdyRQPq3k=9?hw`6s}>DFd?QBgP@9r+iqzOjACY+dHO+ zQR|`HFD5+lkcY)<3xzjWpJ-C1?6Sf?i&o?jK+d99C-rZgx*lDY_SGO^IsHp|vkQZx zmtRQnr()Vd0DM17x{Q3M1f|f?>sF$B)p&}16(Jhbi@1PW-={~bo8UtSy@~1T$1oa{s@c^?^e%J^hU*mrb1HS6$Q|`KwO1u$xP6; zNwHWN!g22sxKR;tAt7#kh6#*P%L8w%6224jM9VKC_@>~4_=wfuggnfXZd1bT-~MNBu*URG}oJGH(4U;^CC9gJHbroQ?%9wSgNycq9g zI<9ChM~Dx~J*|A+U|n@lo?&b; zm?DSIS;VJfH8rF2u?G7E*uCMQE`~%{QoqYs?8z+LnG%K9-B);z$Sq(Y0ae#$d>_#V zoooMbLFuNapPm~0F_eHjhj;u+Sd{+G9?MSJqkbUlE7hHjCM^QHXMh@>$>3cO(1Pu! zV0O^D>Ii5z(s-}NR3+r&>w?#6{A4uS+!sj$T+Ac1#^boc=FA}uIk3GFev{z8f%gWa z%eY?y;TmAQp$@o&ML@vC>h$}mIVKa6s{7OvRt03umv8uTDtpXer;xP3DsA}*F!4vZ z3Cckw;HDqgI3nHjMPQV@;U+xh##YMn{3KJ70un{AmXtuYhy_$@OX?={!A&TY@iji^ zGK|o^BppZRRy%B?ubVnQ;a6M?7;mvDyY2utWLjXuYOas`5*5XK4;{N#q@(~i{1p;6PAK(EfUmUwO*(hYR zpILW&abc0qt>N1gx2lFeC%A4<39Ay6g(eO!AAm^rL1^X$P%o$fyv@Hb4Z%AG$ZS#M zx>#8iYr6XSUJ9iOO@ATZZWY3I?Nz*ATA~$iLPEmi(dd*#6{J1&q9%^sHOsEH5|U@( z6N?g>G&WV0P$pBfj`m83#^^2K7ZJ>GB&ukKEg7X)5vAs6Hzw&(HHFCCv502#q7?42 zggnVw=(^a6v0EtZ7fAvi6Ze+mz5!d%AGu(^ziG{{ux^O}i>BqpKiC|FX;)dd9>I@) zfc_+VH=X|~vYDPBaP%KlRBHZBVC138?-4%r>?KGCG@A@6p9FITQ7L_1H8@ePJzJew zQq3?HzcEDr#nin+`XbQ#z9*!o1(z{n@Ky`JZD8B$9Rth(=TB%jWA|CSW`O)7%|u_? z7ufr9&{%~#&2&su#23U=fMyL4Wd^zFG4;x*!!N8ee~2%Vz?G^YjI= zwWY`iv0O&y!KXB42%-hMfr@i@-Nv6}OxJ8#sTMxefXfH;M=`C>N0W^u7lMj5DIZ+R z$p1QT(9B(a%)~swmY+E!a!DiKRaRh`B^n zQ=6W&vMrB)HNi0Fkha2}wuk`c+3O_I6n5FzIRiV|=p7}J?E!N_(?6JgBm|Y0%z6%5 zfV%NsiV0r8w_tE&bX*^H+Z~AhFLBO#2K%v>jVd?2Mku)cYKbaGOOhM-XA>sA1uZ`%{4SEW=Qad?hTpA8FWa8ihs>+ zQ?POdPl?ElM)dg^h{#cDGT$}yL((OFT(usnC!@c`;8n-{suc~?g^t^C8CT*eu^<3wnrzLnz&oDuIjm=YYH&8!AnGOBY z-CS+&mt@Z|0a2qzI?XW#x3)FdJX2QHTn9gki(l)g2%E2}x~td^7GpDfs(bKZZ#8M# zT2j5Ite-l@%0Ab*o4)yFSMpE=YF9k5AB@{74jSM-53koQ{$f-t##vDyV^@xMO?}(G zF0Q6v6v3ZhYT-wEg$jtU`5^hof}aaFg3uW}8-e2Qi;)lnV z0>Nm+2g34kvM1vl&I>-`@`HRoC2s#c?!vQC2+gzrc3d^rVcBHqeMpOe^jgGYHGcdm z8hO=!)Eh4y)aN(4-n*sK)p8`dS&y8uFp@}&(yHWjiD-}*HlcJRyFDAc!}0iSQ7?4| zcdTqH$^MAs1-g&zib=l7l=K1bzr^|4pk3&v zg@PK-7<3(HP8w@zn;h5ywJWwOjgQc^LTw z)XXFc?Dx*zAJMb1p(~;(eb-FhNKxNQVl6|lfwmvX^K|qQe1!cxnLqaV#u3D9n?OhW zTmbU>^@Qr*O6IA`WdG|MQXXBC(xUtbZe}?~xHDZ*+ypXa&h~XjY|zNG+B2O0><`Nj z^$y-7hkW)|@!e`)$=uYI1&1I)6Sq6$$pmM?xNBg{90k%P5Zl{m&?TAgBG|&7U00=r>&%m>rB(vVcIR@cI?7oGNm+)G-)rihA1mfM# zElL_vl*J-jxMPefW?t_qNZrQ5%4juYX{F^8t7F9JHe@&6MM;$=a+U`CBs)(dcqDo{ zI5#wdPJ!93l^0>L2u?pl*oSwQREYh^^&N6TrfVvfZUe)kHty!}==kfW25lL~3=kBU zYL6AW^m>i!(17p9e2lwT(jG73_xFw|d4ICy_mIEI@_%FGohLi@3Q)A#jN`gWObu}7 z4wo0qyC_#-A>v~e(B;2emT_p9WP87nKJ-yJr)+iOhTM^33umVVx) znPq%HsFTKSYnMKe@n)I98uW%p@NWv$+fcU$DqdZ}CL_eF zs1|ppQYnZ+qqDuESj6=g#aB4`+mwADY=I+HhuN}v0uq5fZhT7OFr3&Z0lfZbNor(u zU!yZ1NNVk}V6M6)MWW?H_c*hC#sYG$E{xE5;htSso+*DdH?Jk4pn1(0(cMdf48&!Q7+XCk-dH%J#9gWB z{)0jDiR0|d#5od8HYloSqh1Qzu(69#v=K9N9B5xKGrcwoD@}W<18f;&1njx|LsfKo z8lrfNu}XWX6aNrd_mZo>?Z&$}8*S5XD;62n@|0msY6fi}d&z<6RWQ7F z14J?B!Xb8;D)VIfL+$yrSc8N42K{%3W{06};C9$~ZGgfbToritFQ&vP(2d3w3oB9^ zVCCug_lD_vA=q$lN0Si|G)1?PThtfL4L`He-dMZ&dFE_@luHo~tXDEpUYPM= z1IBk&WxBog%LeQ{yX(Pbq9yfkoDtIJbA9{43Rgj!P~vAgp#=qy;-{sSIKq z*IfJftH6jcyJSIaI?9*!CTw%(WuV~TSL{`LGt&O`wIe7^p}KwZ&$DliLqi2kyyqU zv0HsxxolLsxKd!fG}Op|^VL(z>_GZiBuLOub~x>!X$_Hc#D0Gr0540B^<#NTfj+gpp_tvDtk| zWn1rU`&Rnh4>gR&4+t!BsD)^@!2mfl@xh~4*0HoeU!>>7HWh2N^4V-Z;%?fc(}4NJJud0@CKQ%JmH^@AO7YH$Fa zemZh1H#{?GrU}8-A0Wo@@gy4cNvl?SwT7Arq~~x5MuS>GX9J#WG45AIdiJQB4~c~& zZ#*Swkyb^gl=rnx2XYw!6Q@w8P3^8i5`3@}-`ndG*WR5=OG%f*P>!$YI(>le9q1(X z=Kdsm4#!=mKWJ4~@1+Y+z(0#ZO}w#lkyJD2L=0(RyI8+lhQ|V-3RW&JH^y(5o>)}~ zGan%g-lIy7uE(<9GP5vPoY6fDj*y0m^}4#SeHdDVD3?F2Q}(b(*8*H$Kh@s97weHEU;SqkLE=CJ=x7p>_8avJ9Pe+HcbGxPk$w%HyXsDY{;p zF7+E-FTS*(S5T|!iE7zFqh58x_A|O2Vn+k$kCa_!W5dXvrkg-x?>8Rczy6~ZC^Qr`_9Vt-U+(Gwe*ZlMQX{3OHzzNzDDf?`S&C(?6 zAdia8nJ@5gOKckyEf}L~S}_nH=W65X2bA-%X!i5V;U0r{l&YyWsVcR z!YUaKkjm*N?djx6v;dS}>Q%{D0+4wHeqF6*n15a6_P18QgAn9%I4w@|K?MLzqbO@fZU$b};1hCk*|eOJ*MC%Oyr>*? z_JX24Q=;A5S|)MWqHlGP{?$}(EQ7{rAOdxJAuX0u4zctBTigYi6;d1{D=sxnXS)0%ggx zCNZl{W413MN}^b4zTjJJTt1{V0NZTiopL9u7Km|iHcBuGrm|+_51>!f!sB+BkhW|g z{n-zVr_Ua0$(ELW2)=eoL}t}WY%AV1!_#IzaWi{#v2y+Uk<24?f$<#i@7osS6^ZNk zH7I`gC|%^^W6f!EUyi-coz?iR-ba3;2m&QBUtVzbBK*RHgE@0`5;wa8=0%yQc~su+ zgtwd34l}eHPR@x|K9RC?Q7m-#B77pOvCrk&o9xPUV2@eIUQG9;xs~RO!OZP^HiEv>_erLtX)iE)C=LrP@UzA6 zXOFKT&xk^?#P6{IP63dlum{Oh)17=07fJ*BP_V@vt&WB8?Y?4)8yBE!hFSBeoR!|j zYc5?DUs1l!rgPM)%(cVP3f#gN1md8!a(e0QVHa^>*1h*Zvg5Vc!HjyJXX@%*hp_(hWy_Bv#u@(z8Y+3tRm8a_q)7y6J>M`P-GnMZp_8yc#UcV)5g%XHN!m zt|MDhC%3!Bh&N^q#ewC#FIF|aZicJY zJ!sqvSL94@!raQ3v){NHiI$mT8M!ll>kX9`Sq_WpxUT&b-I$CQ)2e-=*te&_98kXJyhZL+L+jXOi^ zCHFIYNTw{<;+3n;)#RhWhmYYLxC=%&TQtQ$fKv9fU2T>FCq`s$dr?`Y@wzW3qs4=c zyP3+*v^tAe^EZPn?i-TEk7@jGD)A-_SmB>aK_OgV7#<2 zMNsg}C}sA;%J_<4v+#Mx`->*tDVN2HqS+E@J?I{Dyh?eSwM)_9j)r4Y8Cxxa2Yj4& zlr1n6k^KWWWfyLUC+F~d!bAD$;joYNE!s~wPEf6r74PU1>jgn0FT-m{t@gdmDOu@T<3z4PUvwyP>*d=ERy-=;t;-U#t@Q{ij6DwOepxx5! zZE?Pwo6{#)X^SfZ?az6OQ&d~q(}^!}K=rv(cfX(t7aNBqLgnN&wkfsm<8atB>X|V? zBhQijIy2cR3#_+9tWmu5c9HsGoqQvFB%c!R#=(M=NB^E8s{I$E^iWT+g zze`K5gXoZUQyVCUP}YkZH~BL4r2P z5&msw)ux&i6<98IZK$fT6MsNLUL_PqQW^{P$unjC5z0Tg6h=@8ME5vMXbh}xNYdZk zBGmZErq^TD<|=I4T{$Az%#0q%^ujy=syB(J6(E&g2n*0wD5~mPhJfw;eNt4m zV~VQj?vQVK!!58gn0yowbibl}NS>RoY30aoWd!b=RH8v=F*f2gkg2h-8C}2MBlgx= z`u*!-w)cmB?5R4yp6cT7Se*WD)21fK!aVL4|C#k%f1}p&k>r&s-6fC=xW2)46q)U4 zZ%#EL*~VNGU}``>UHqHOhS^Xz`?B;q( znj{aKl}zHE13fQHWCNcEE7w7)#GOEtCp;XwT2alV(OMrv_by&MHmgvSv+dz=CQb_f%nn3L;;5Jj#+CAIsg`kd)D^W`uBgxoj-a0>$-TXl-Rse-^gm`nxo?=bnwXbVQF;CaI{r) zxszZO%lf7rENRVP8K2|BlACR6*XvxRee>!n)kemo>gJWVHXQzER6b^#u4zw6774$o z)W>+rJmkL4cS$1s$$i4wba~u_u5#t;HVu=n#xCKKw5&IAT~k75+CAo;u0B&Xj752J zI7GemVsU@{NKnyYyy{Lh@v}?4r6)>yvq;1vuY94xPB`P;6o06u%vXIKyw$bph44mx z4ti*Gn_R9^_JMK3O?+KSLZ@368WpV}oB+qUo!mUtj9+M`ofB{E~$$7h=UG00p~ zL2&ZIe(`_^NoJW#9Dyy8(#WxgR9>KZ`pRfN$+5DsM)|RxsLOe5=KRT^?>D+a1OZlb zv$Kz6xqvVjWl=Aso*(2t&KoTu*c0<$LBat-<=6>(@3^ZFu9PH$(NKzH3CfAn&GF$3winKv{fwdD zO84fHF{_qM%%vTT6Wl}Y0jEA~OFUFO8{=%s`N(HXZhR!rfN%rgb`JeJW9+wbbn=|^@fnn2maP{4EmR*5yeOSEYfz zyZht$idr)kAPhEilp=b@GGALSJ2+QZXrf_y{7^yG#LM3n!-%!|Izt=8VK0^Jw7b0q zdAH(i@8J2Nm=9T5Q|_DVPSe6Zrv2tJ=f~iPM<>Qz*UYci;^emYjYnXjo|}xz$&d02 z8{S)3WznLRk~|lMq{V4YSXxv>1TWabKp~){z%|ujpx%6~ zr_g@>Cs`p^EM@q)mIrC)Xc>&MYAg=);KiQ+k`hC0TE=Yen{*oaJ6j2@`%&sgS#-pufk9# z3fg>OZN6lFMXRu#NuiQpcG*ltTGvM0=KeD?LA1@rr>r$EN7RG`LTFR}Ga^xzybr-{yT$q|820+R|ezsBWJPahjRl%vBmO6w+r;u@yQkW9~n_ zfvHT|e;{XJ_=lRG(ucXnzJ`a+ zG~&7O1zBY|6rROF)C4NPW^L|r;g~jBIb&fs)=2?%ala*kE=%Z9jWL$sEMbp!zwwNw zX=d?K>JY&Uf69C%O=ycR_EV94Y|=q|b7rGwVC71t*^?F5hHp&k-KB+B)@{1BZ)+*P zAjuNr1GKSgsE=DJa8DH8B=Ft+O5wcI$R{MjfO}tUGUK(+M=~sU1W-H{Hr9pRErOJ_ zN>6tPOO+D9Js*ae=57qlRCZ;Em~?a*WV-k(B#w6QdYPZbE;WG}gZdDcD(Z(=G*20i z+dIE=kgD{iz)WZl1`SiCaf=!0U#$t4s7|ncp1rk59yc2oilpD`aRETd;w80yQ1B+MBsUFkAeMwL!sX=Bj>p1wK{6sHS%0X(~@e)cSMC zosrA)MF`KPla23LCF)LmLn$iY+?#{W;;IVlNoNp&>djx;?fJ4c-I=?b;|JKDDe>Ne zvM&1a9IBCbwW*y-yBoROJiGKrtrHrrRw(D_?N6wbb{)%R$G*3`d&A9s%Hm#PQGMEG zH-Il~$iMh=Vfk-lRRTt!vveLef!3ukXSU-1;5 zse0eZu2~ksN)k=BgR>U{OV9gZU%}m# zCIlyerUs%l%Cp5hlI`npRGG_HkydD9>nIepUvs%Eg3LGb;=q)4w=$>oq1xohMI5{d zU`N*TZAqYnWa&r3^6W-}ME$``Gp4I0Q-L`ho&sa+i&svDBRYSG16vC7&5>3YB+4Hbso3lZ@+b*5iFy8WoSKj!E*^YbLjPByX-mIa6emGpkhK94)Gq|I|kD? zv0{)PzT01_i=vb}_*&hCH6=7($I|>}at$fHc@EtT$2xO33 z9O)j%AsPQe98yrTkt8*u$mLkFn#=&pTdsY7{Tt+#0sW~ALraL;+XwH4ID(DdpGp4M zsOHvT#;#K+>#iGY57RZi`Mq>>ZZozB0}TbS`D9qdX^}=~iTM(Y6^Cgq>0R#pA9n!8 z#9{5u<2hU}8b@%Hin!2fe#L^x^q$lF5Jc;}nf$%e+ufha%Ivf*eE#~CmAMBUtq%e? zQBfPJy4@vCysKTRo`wB~4j$eB*|XlLu$On#{OTxwvJ=8O&S$-+a(PShx^x`xV9%V^f{JO4Ud%JRS2Ofn7fWP8vx zg5#JFK`K`vMaTnx@}Yy;t!4MG`^A34iE^eJjkDR|PRir$vFK=5^B%xt`~C?y&JqIx z1e6kf9WZRG0gzd}fC$dZ4ia;Q~Rr+ z{rleB9iBE<6~QrzSJ??a$u1FrkjIHZg2D!1`n! z=kg8w!<}Svz$FnY(CRPsw+Dm%^)YmgcKw6y{I2_wyAqwh0Z_Z--)ct(iP%>j1-6D) z0sk1{s+CzaCS$9avxRh0YMxt0bS|iT%9~G(RRjV6WgUNwBK&u*Iemds$%K_i$YLPU zFnFg&c9V41IE)B311}$51LiJ3$bEG@j)r>y+dmu_UqHwHI;L#E7YO_OaZK5N@l9^B zk>1wO_7xZl0NKqHm`8V*QQgv#D}2O4r<^N*k^0BI+3m!`o7|B{ir^7b@JxdG zkD>MEwfCUZz@-r`j;-h3e)^G~buh}9>w&WEcWXvq@S9Qjpi)~y5vv$$icY0Vkus;U zl@vNIch3zxL-ZF`|G;l0junLREI55qOo;x$Z^=yhWAs|{JTMI(@}zO3^&Pd66g@s zKQ4QL+&c{?pcidLM+LyL`0q)Pi(u4qpxHYEb0k8t#b4e~9Pm;Y|9B_DFF@>|xix?) z>!!I_QTFF60WM||OsiVJ=f`kqjGWl1<$^X4;&f~^%0uyoryc_U-ct!oVOuKnR`nA8_ zr#S64i=0A{m=C!sfj|@w$K9V~xqr^dA>YgY=!t*!%>V83$tmzR6#y7@282-uw3Xdv n!BZ>1@D5UirGvk90aQ8*{@*&CdE0mYLeV+-|KXbP=h*)M22Yu1 diff --git a/education/windows/use-set-up-school-pcs-app.md b/education/windows/use-set-up-school-pcs-app.md index a9120b1881..0061fb761f 100644 --- a/education/windows/use-set-up-school-pcs-app.md +++ b/education/windows/use-set-up-school-pcs-app.md @@ -71,7 +71,7 @@ The **Set up School PCs** app guides you through the configuration choices for t ![select start](images/app1.jpg) -2. Choose **No** to require students to sign in with an account, or choose **Yes** to allow students to use the PC without an account, and then select **Next**. +2. Choose **No** to require students to sign in only with an account, or choose **Yes** to allow students to use the PC without an account too, and then select **Next**. ![account required?](images/setup-app-1-access.png) @@ -93,7 +93,7 @@ The **Set up School PCs** app guides you through the configuration choices for t The setup file on your USB drive is named SetupSchoolPCs.ppkg, which is a provisioning package. A provisioning package is a method for applying settings to Windows 10. When Windows 10 refers to *package*, it means your setup file, and when it refers to *provisioning*, it means applying the setup file to the computer. -1. Start with a computer on the first-run setup screen. +1. Start with a computer on the first-run setup screen. If the PC has gone past this screen, reset the PC to start over. To reset the PC, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**. ![The first screen to set up a new PC](images/oobe.jpg) @@ -134,7 +134,7 @@ The setup file on your USB drive is named SetupSchoolPCs.ppkg, which is a provis ![Sign in](images/sign-in-prov.png) -That's it! The computer is now ready for students. +That's it! Sign out and the computer is now ready for students. ## Learn more From bdd179da263266e828dbe8539262a8967e80e583 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 26 May 2016 09:50:32 -0700 Subject: [PATCH 427/439] add clarification that Windows Firewall does not block proxy traffic --- ...nfigure-windows-10-devices-to-stop-data-flow-to-microsoft.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md b/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md index 6383bcab54..af80d923ca 100644 --- a/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md +++ b/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md @@ -285,7 +285,7 @@ When you enable the **Don't search the web or display web results in Search** Gr - For **Remote port**, choose **All ports**. -> **Note:** If your organization tests network traffic, you should not use Fiddler to test Windows Firewall settings. You should use a network traffic analyzer, such as WireShark or Message Analyzer. +> **Note:** If your organization tests network traffic, you should not use Fiddler to test Windows Firewall settings. Fiddler is a network proxy and Windows Firewall does not block proxy traffic. You should use a network traffic analyzer, such as WireShark or Message Analyzer. ### 1.2 Cortana MDM policies From 1be0b4969c678c719b6011d057241d39241a9f5f Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 26 May 2016 10:00:04 -0700 Subject: [PATCH 428/439] Bug# 7673920 --- windows/keep-secure/credential-guard.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index 45c0237c18..870a49c024 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -239,6 +239,10 @@ You can use System Information to ensure that Credential Guard is running on a P - Credentials saved by Remote Desktop Services cannot be used to remotely connect to another machine without supplying the password. - Applications that extract derived domain credentials from Credential Manager will no longer be able to use those credentials. - You cannot restore credentials using the Credential Manager control panel if the credentials were backed up from a PC that has Credential Guard turned on. If you need to back up your credentials, you must do this before you enable Credential Guard. Otherwise, you won't be able to restore those credentials. + +### Kerberos Considerations + +When you enable Credential Guard, you can no longer use Kerberos unconstrained delegation. Unconstrained delegation could allow attackers to extract Kerberos keys from the isolated LSA process. You must use constrained or resource-based Kerberos delegation instead. ## Scenarios not protected by Credential Guard From aadf64b246dac67d9edce845ea304c029ee1e050 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 26 May 2016 10:04:39 -0700 Subject: [PATCH 429/439] fix link --- education/windows/use-set-up-school-pcs-app.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/education/windows/use-set-up-school-pcs-app.md b/education/windows/use-set-up-school-pcs-app.md index 0061fb761f..c70d97b92d 100644 --- a/education/windows/use-set-up-school-pcs-app.md +++ b/education/windows/use-set-up-school-pcs-app.md @@ -138,5 +138,5 @@ That's it! Sign out and the computer is now ready for students. ## Learn more -See [The Set up School PCs app technical reference](set-up-school-pcs-technical.md) for prerequisites and provisioning details. +See [Technical reference for the Set up School PCs app](set-up-school-pcs-technical.md) for prerequisites and provisioning details. From 2bd0f78cab549ec80f63506ad78b0eb0a0159a95 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 26 May 2016 10:33:29 -0700 Subject: [PATCH 430/439] sync text change --- education/windows/use-set-up-school-pcs-app.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/education/windows/use-set-up-school-pcs-app.md b/education/windows/use-set-up-school-pcs-app.md index c70d97b92d..1e5af39910 100644 --- a/education/windows/use-set-up-school-pcs-app.md +++ b/education/windows/use-set-up-school-pcs-app.md @@ -91,13 +91,13 @@ The **Set up School PCs** app guides you through the configuration choices for t ### Apply the setup file to PCs -The setup file on your USB drive is named SetupSchoolPCs.ppkg, which is a provisioning package. A provisioning package is a method for applying settings to Windows 10. When Windows 10 refers to *package*, it means your setup file, and when it refers to *provisioning*, it means applying the setup file to the computer. +The setup file on your USB drive is named `SetupSchoolPCs.ppkg`, which is a provisioning package. A provisioning package is a method for applying settings to Windows 10. When Windows 10 refers to *package*, it means your setup file, and when it refers to *provisioning*, it means applying the setup file to the computer. 1. Start with a computer on the first-run setup screen. If the PC has gone past this screen, reset the PC to start over. To reset the PC, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**. ![The first screen to set up a new PC](images/oobe.jpg) -2. Insert the USB drive. Windows Setup will recognize the drive and ask you if you want to set up the device. Select **Set up**. +2. Insert the USB drive. Windows Setup will recognize the drive and ask if you want to set up the device. Select **Set up**. ![Set up device?](images/setupmsg.jpg) From ee33567d363460eb64df083fdb6a12ac91805b64 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 26 May 2016 10:35:25 -0700 Subject: [PATCH 431/439] updated settings table --- windows/manage/images/settings-table.png | Bin 53302 -> 53290 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/manage/images/settings-table.png b/windows/manage/images/settings-table.png index 2acf11d281deb136db05e093d42f839aa648364b..6b77ce6002fd066d381da73078837f7d6bc3b679 100644 GIT binary patch literal 53290 zcmc$GcQ~Bu`t@jo7&SW4OUP(L2+_+RYLr9`Vlbix38MFCVGzCdM4}6#6TJ=6h~A~B zNf7OOv3IuJ&e{8S{`jsdJu~mq*K^-%t@{ntR97TCM|%zg0ud@J$!mc?n0>&{7kHS! zzq~nT{1NyK!&ysF7F0YyzXJRP+e$`F1_UaLBG@;>0sfBfsHE=<0ui+x|HSBYC`5oj zgH6ivGCFRzJ|BE>pwQj!jPf}QUNc!&^OPlzgfrr?Fj(V^MRUNzFkgJ7G_Xw(&U`fw z1N(4eN^0IVM^iia&nl1)1F$sw*S+ zi7YG!&<(eeggi<{E38V|pB>yvZB07bJ34GSDp9yj4*Y1>)->JE$i5f`{4j}-&v~$1 zHjlM%C(J^hA-*PQ(ac%swX4K38d<|&fLNYsF;mW831%UtFt|$GkLivSG9u=IeO;d} zWgBskLxr4so)%*1CoV)=970L+z|B!F#`0l5lk23o>*a^VmO@hi~oN{eZZ z7_ZJp7q~j|E^M0%)jLgDTI2U^Gis!@X1wcU^hv!<{HDw(13U0SODCgDm=`|oViJ3M zPiN30B0-jJ+3Glgm@h}$M+ZJb9cn=_hdT-HB@ zcM~B-tnos!pa72?>dKy0X=~+S9TGxJcG7QL^}N_OPBIL<>QQ?O>ue)N#7jBtwJvMQ zj|XNxa@aldb;X53)C=BLSW`x!ZX31UT_dhH!rvVzSY2>je7Mxf(m3~azW{z|hWB7->hYac0;8BsyotRQ z1#my{4*7*}@uY#a*yn>QD`c(g32C#fWJJV_Y<+?%VULMZuPNW7pO^A`@j0I)R351< zoifhhwvwMQesz6hYe_lElt=^C|IJZyJ5^;nU1x>9*d9)~^XV$l*q9?_Gfomw9IH+y zQwmZX9D6~^BCJInYbUyKge^{Sz;Ifc?tbl)>pG#hjGiP?7C~%vT%EH+582Wd_J;j< zBd!F!FcQ9is$Jgb*(HC}<#~SA_j(8JyO=aijPyF6HDYng#k}DkPt=%Mmf!AJ|4>$3 zKmVyf#gV(+b>y1AJz^DwMXg-Tv|Z~_4Ge$e!jnkwYAZ@HV60Rd%WA>DjGNZ_hx5QN zW30>hXm*y>_Lf)rl?!g^Nkpo2%D1l6F?G%b2HarhLDh1OxVx2q>&A^CGLSm-ETc9c z_7fiHQN)~XeYg{F=yRBH)LFUc)bA35ULeOdH~6X?aKJ#E?0C37!?c~d6&L%}cUb>f zKtv_e=%a^A_-JutG-{k_yO75rx6{kTEylVy#ItfalT%aJQ-abpRx3`c%^iJS-O3s_ zOW2qqR9=fWL?IvFj(1a5GI#BDhtAd{rkxN!SU?_YBR6_@-ep}^JW(T$K3tJCCUDiC zmq=)u!1sc2t*sbRK#xvcA?DrYHDn9_tW)_q#?`1?QGuwb)u}zK!Pwq~8P2g%G{}jP z&=*`?=Iyk;x7OIEaf_d56AufWkCb1`?$2VqT9x1koxM7dHde{MA9!`1^|_$acDD4$ zW(E#nzLdPROaPog;sLpoh2Fd$3Z)d7f#DuTWaWu82)olW)BSeI2ol1(Ks;0n(d%-p zwH?jp&zA8yhpK%JHsuz+4Wb#E{$9^J^+iT|f)pJW5Kpj7Ea_yG-uB3`OA6~`y6l7; z9dp-X+meUh%pHn}cMH9flQeK~hk_3gFAj z(sTti;Q@kinK-$SISB$Of%FkV^ZEHJj+Ahr)FE|I$|yM7Zi34G{O(Y5YCZoFBh3_w zHx3IOM6i=oZa`0co-{o>oM4yN#clPlL25lQHS02Za|a_6Xa8vO0fCe|O+EL@b$K`L z1T~CYVeetL%Asa1+NMBr(kW|+8Y&(v%6)mmVs03fvmP3bh0FK2BNkOh&2g0ICQLn) zZw7KLaOVe0-K8*LAvU5&x&&L-PR|bDoRKS*T3APX%4sj1yRtKwKq=?rIAC_gt;%V1 zT)mc!owSQuIas8UCmrC!{}RBL~m4@N^1}iOVe%Ts8P-OUZrNm zg?>?58cdUZSNUq`BDJ&~6ze`LTc#++CWn`jUKx|%f;d!k1G-M&+#{t)i**sY*__yA z>>blG6b}~@AN{c$b&EH6^%~fD9so96@)YJCz&2zD7N2xu=B7l z59FP#1|RKcF{Ji(N|t{W^g2`SQI`3wsk_RE8N=hL$-#mrYX^_H=dudFWk27U#+G3FITpmm>U4-*`8Bl32 zcepxZsf2txqMHV&C*PFSthrE)C(vho1J0%5{Hg-8(^B%NqL3*rISC{-VQ#v#6bH9M zF~(>4ib7-@E4%%bW!~Y|5KcozsU+J_HZK`D-e4?Q_+}h#7iv6TWj*$@i(|5;NDPEe z@o@y#goh~qAe8Hd7?SHN{fI#s^rdSLBV8JMhQ-zL^(}e$o#|%&$`x*j)w;G=Rh6a8 zrNDIM+JG+Xtu@Dcu?*g|F;(waY9M&wu9{bz#Yyp zJ!Z?p)G*9Ss^de3DDF}U#qVUc7!?8stmv?b2ESmE_L=3^Qk|E2(@J0y!qX!U0yEZMr*|N>zM^< z5wAOfd~rttg#zlSM2SqXoz|q=F!WanYdB=J|MEeHb@)J0V{2~kw zmnU)h)glj;{GyZMB9qdnz+LG4UVSxi-Az8%3eF-VsFnVr@Tfh96gc~Z{k@Aw2_q#+x3nO=4uBDp>>EbM^H&UkWR;3ij`|#cb+Kb3$G4zp3PksgV@#HrAA>$H)H4ur_10Xhp&04N2fLHOfA_iF5e3svf z)bqfA?<-A>%KRWeiunj_G3aED@0rZ&+*rsOa+Fwq-5+zCa4|C^UEj&QSh0gx1;)c_ zFRO!j3AW6)!E}M^TsNcGjZeBLRO6n^kMzwIubxpM;+Nkir8=6k%DInwAv2in9hliE zaUmX&Y=3dHRFw8(9fQmNIbao<(45bbwOPv2XF7g*mO?NC1O4fvHM6R=(9q}*c-uFA zg%0)8uv%k?MeZcNHUa+asNmwZw2Df&HIEJSuArLjqu?LKB(#J#E4wtsn`2Z*2ot$uM8GC2g>Rj$5Il}+ln;Z|M(oQ% zY9a=4r7tdMmNqgV5n!5#;3PBg@@Ob~B0?EO6B~f~FsCSKf9q&?^o>G;#=Hr%vGKLFi&$RlTp8h@OfyLq<8hlZa8q}ZYH{Lf%i5Pz<+v~h+ z_#xxTs>goN+wvYhFmAvHLz!P1jrXm{9RC5WnG!Itf8dI_o6yQ9Lx@orDdyXQ2ZU7^ zWBbbBC`F1^b4Q!e{8=olLO&a`*MqXHQS3>Sr72&ijyxNu@7(>O`Q?+{P49yMDWTOm z8n3gKPj*tZ8C%bep%a1`(Z z7qhTND}d$lu&RcpF=`UFoC*4x89gp$wa2Iuyzfs++Q}mR5N5OYX)Pb;6Ft}cCdDe=m4wipm;zxpX>$k5WI6q_=VLeR3$pKT?(Zvri)W+cv^aEHL)nw!Nks;QZcWzYW$mxe zzo^cpD=J>7f52L|I-K0IbxFkYmd^JUv?loQI~m!d>Xn!QZ9?NH+9U9VC@j z@VlDI!lsZ)=GRa%->?a#31#M<$Y7y?b~|H_q;RGwxz2OXyoyonjZ4A88dBR;WT_h{ zDH5%IU^N%^`A0(dBpp4yaDkwF^AMiynH>?G%y$EEG3*j>-oX>%_nt1Gx>`6@%BsC9 z8`hhp;YYv(Fh;Ip|26@klr&+uz`3Py5oCz^GU4jd{uJwK57G8EF|7?8Uy^nP-@ku2 zTc4?HS6S)&FL(p{wD|u0)br=YIXON_-uc~1Lb7DoDR~MN(zlO?nBOIxd(0pxTo->u zPLn^c8OQF&*b8PFJA!C?}&KC)Z%g-|q zJK_C9cqwZb;`2`QrQAn7=I+K6 zRa24Un+wL^)0Q+FLzaJSsjx#&^C_d-G=?BcsAuF}J-zB}F>9u#it$8xw1e7txAsH~9^oNgciY(c#K0W%n z`FO!55QAO23(#OV56C_X3{%uEer`in>@=#y`nq9^BEzBP5(41Z; zPX&f~U?6a;f_JlYhU5ArG$?ZBW|~?0X!r$3lpjh*dU{DVBZ18(;)sHV8t&ke_jtX* z(FQUnObFhGi-?BK;vZTV?6pf}@YNU?UDerp@Zqt^(X>X?o;`d@(v9O&dxcGJUB>e- zUP2{Vm9rHy%swLer$eQllKb}SP}%BSuOl*JGFd=cYTq!x>yQfF=F~uytHqeFbh!d%}f=2Z6~rG^L%y(DYV2t1|A2B> zGN;@1{Wkxv=k=V98-Ux=t%KAyWJqC}g{DF#V_co&b!z^Sj^5ps7=>$u)OiQRVGyP@ zg(BU0mPFO7Kf$p36bz?-&ds*O+}XJyw@?O1!womvwZ@!FH!i%te!r&42d#%Cf7*-5 z?Fgw~P$TRZJh9`g&CPwPU)+y;bZGITC7Ukn)glt{YP(PJ?59o`PXM8QiSSfWeo9=& z)M~cdLoS$Vch*G}OpTa-5eEiM^{=d~5TqScD;B6uY3Lxo$Xn=U4>>A?L)x)`Ys#@M zX?dl#cC9~N$-dV?q$8sL&!0iR6#Z*#JdHv<`CtQ_Q=XKY4(~mu{cu}LWq*VXD@;zt zaL@_cPCNJzgMsMVQN${y^Y&k2t(F$S`Yo_;a(I#CKo=t25`xm8>MVjs5~vKtPKwwRF&1b)6gR zz?~7p4j)qhH=Djd7Y%`Q8TLD1n081(usNAI8DnIrZAJT&a2FoHT9^CxYMo$9)ZtG_I7bg2#yZ%M(RdQ7&)yBKuh!5W=PxUW#@?h+4cHcf(UyoE#a1@pH-Bmt$8%eGxIO0%&zI{)a-{Y)lpkSlTk*yOc&|ol@Be zXpIcfZhg{}WGapEOhNe=I_IxAM1G4-#e!tMxea1sU7Qy#IWOg|d!@G;oPdNLPxaAmiR>L(-q;0>05mVX~xKEnRG z#?QuGc|W_H`xyGnk^$(G{;1_bJ_Zj9*Jg9@y&N@Ij*}3(>=e+lFzmmjrw}Yax7TWF3F8&|P;c<)$@@enWGyd1ZURSQdLja@NYLZ`)ZMjw6a6}W*7?J=C<{A@G~+i1vl(;Z>q~{k| zJ1q-*{QFwtM+K|Mlo4kvN6{4l<~n3b76CcUdTVO>+D-8q`re!u^vcm`bkdaA^F*|z zY#~R)$+7-XX7iFWMx~TAl0ZuRPa;{#Hm2X!{~@sc(J}aXI2h`v+&t;~H)MG6(3w91 zlu1=MJ-@Jgai`+z#l#bw79Onyv+(2Z`h!1=UbJcpDsON@G4sWBUG7zOyebw%qjg&$ z`of(1m^+pDTB|3JGW0$K4$|ky1J3euAB5M|dcD4Ue3@*L{uJr$crfH2vyF=z+?T1E z3FN5UMaMZRNxr`7pkJJ7jPwmYu1PX#W~XQVHK_!cLOV{hOg!rIRRmQF4b*yWc1R`V zd|~fR2(oPexX?(};$hhbaU=V_z`R8W@LL=($X9-7#=kCpN-V=!VAWcbM@5X&)S(f_> z2tHfjEG%tj1S^SednAzWyu>GomYi=z)KXIp1WdRyK>CNcut zJcVoL0H)-ZrvU84$tgPtFn%Ed0M>&H*xNuJ5A1D#jo1LGz|?@N?VKH6QhItLdeq0m zrRS@cbcOV9*U9m7fQU4%k@LX=`&Ew$_LvWwA0h?Jw=hm4$4_AqxUW)7DM|n~0?_;3 z(?^!>O8(W|f*lB~Oacp5j4gb8w;^_=!mM#SXnQ!j>FAZIs`rBJ&b34ub zG!w}8<(I%EITTU}3<5X<@Xs%UrshIl-JH7RVEZw$-MnMobpHDeDk|k&lgs^k*VoSP zQuP)!F)%zzc5Vbn8vuRE<5&Ww5-@gbEjFu|E^>9LF96&iZ>AYUL)Kw7Q@ELZdH90} zIbAivuLy{8=k~C@sXgZDPhH5K{;#wK5hz z8CA^PtQSyNDnUFe5UNw3nE~o4E6dpsN!v@sUrIczoK%!YHqKv|o15eGsfjk(JQ%^b zpnp#SmHdf#DINNJhfQpDt*I>IB{Mt1Tlz@Wr z_zJ*qvnw?PMV%QU=6A3EfU%{gs}!BitB24dI!CJi=_0|Y{9h(Y+p_2VQKy#`6`&EH z-MWMHnDO&d^$eCd{R$FQ#`JYVxu?WB&K&^FQ>2*oiuw~A;-9WhVFz%qrH_aLhR(67 z{XAQ&jZu*Y6JukS#eO8LSmB)_P)`2;f{Ix^m1m;qtF290J4Ta zfkMYv>5E1fWEU(gHi{Us)bcb<4ZF(e!VAu*uMF(BqStfG4&mGZB}5vD<_6LYvmd8R`zl*C5e*&^iwxs-!ZF+G zp6KaHCN0$Z9mEfCWX<{{1Gv5?G}BXo@o-2N_bUptTe0~3r&s78<7*sgm@c9;%taky zoG)D{I+|m&M$ni@ekRs_>FN#*JxUYs^VDKk{(PSce!nk+Tj)PNxh;HFcd^O!ZA1nfFqCAYVY~sh1bET&-G4s=E!Od`sAuvS-o%bs}Y%I1zk^} zg)D}kI1;MkU0=;tLiFZ!YDj6jFDJLpgLDi61N)@qdS|GwjaYXw8%E7{rL(i zsEG;qREy(%6=(%SgR}fp3Na}8VDq!?0!XF3gP@Wm%E(8QaR)kEtB8fHCu;3WFA^Af z#~z5)J>9F7n6NQfF-qD}+ZgzP{2EX5g|o%sB3Gk>^UkgEOH5N~00F!%4vOd>j@f|X zwP7_M%MAD~c0iur+$!pT!f=eYWV(k?Q{&>O33o?|2N2|u6*LntA;qQJ5?_@t;JvlI zGu@~ox2{`n84T8}^`#iTvk^OXg}sIAy&9)GMI=gP!BP30W6u28+Qqww1S&AA{wme} zK&4=0f{4BKMJe&xFVB}dp4y0(Om-F5RpxK*_Yh`KJ@(=ks!Tm%cUJ(CUq~17ZVD&lNpVC zDl_K~TKt#=yL@2fS)-jX^;#fKWH8Kei^<+6w=-3I>(9-l-NOf)icb-lFQ!qR z-xS|`+x;fVqpXPwgSm6zDf<4T!UIjMKB0#6^2WJNCXC=BJ6h z*;JaJj?H^-A~|-;&6H`qsRiLE*L^%KQE<02Q2eSec_oM#kN+nAH6%XA$n3`ZNiW5l z&%{b|K0EpxWtM@Jz#?%Gd#h|a$P>Ok+|uvWA}6!ju?)vls!B( z{$kR%31xUTY0Mw4hF`O6!CN-yqROB*w^HkH=1D8!>pRH*1;vo}TcV zF*6YBAW>Ovz9(UuJU~L6A+B|jge4@rvMP?gFUPHTDDH@mA9=cF%hJhWx`9r)ij(dM zCB^@N=egS2khSxv?tDu1JIx;qXspbW6#FFjH|wel_2Fm~f17^u{SVFDoI7hPPprcw zy8$AYQ`n)zY)hgGSNeoTYJbTxx3e*~-=7tBb0^7Ku-hE)#_28PO}VaF>pk{aD620H z8(V|h?{2o{HjBiO?5@6A{Brr?RND^dl$)s`rztkkzRMrF;zqbSFxAE*5U%c2O%Xsz z<2|hnFpHrjjSZ9UU(+U{-%$FIQ`|NdX6qacH73Q zW$qq?&D&^6&}o_pe+rP{$nXgFFDsb}!Hhd`*8hU;k+d(DvA?+909F0db9KyXsAvk= zxMR_7Fej>L95QudqbnWQpPZ)D)L^tDuqOIl z01jH;fVfHkKMjWq%dMp}Q^mX{m4(lA<_Wa3N!6xlXK4%PX1Gnr9TSJT%}SDpj!_nQJr-IcN@SGrY ze0`FH1>Lql{&0MnOu*M0jp2&z;5cqA_CJ@BOu8Rr8tQCPw1bO}#%U}9)EFWWh z63dTi_)lqSc}}gaH@I0zpRQ@&Hp#Dhr9zD7o={L7H;k!4hz_tjhKl$JLtigy>(DD9 zn^_b(Wbdcb_r_OYPKDDsE%;Kncg@V>m)VH8pPU{5 zw8`Jh)u2`37iT5O&WRe=Mfug43-dw&*`QD3(^5)y3j;=k)z!-n-2(zJKA*IB66&A- z56WWn5dtBn{Nr#6fUDyZr!=(z+UHay_U(CktYX;)36wk{TOp^h4OzWr%&8@0*dv(H z%Cl&UH6?)qQRjly@9pfmLM%wwxdZ#va4dUyuSv>?#mTIP$;>3EimgVOUpa zSLmlNa8>qO%$nE?+YYn_1(RM;vB|{Iq^rmZ*G}XX{pj;1xSorT!I7OAmn5+hl6=WN zm+BlI$B25`9d|aT^=>WOaz;Boaek5=lQ~#T7GnIQ&6Yie^k2~lS+K&xTG+*Zq20>A zyV6bkh3nK1MG?{Gi&w{|q>#@rVp<5<=T7&+lrl0hLM6865T%~fm{Eux3q4u16A=L*wr1`N4vjcFPo?mn#^a~#BWO~7`%I59 z6%AcXiHyhvzAJ9)Oa~^~2O0(2d;ppBS6+>`8nAtZQC6kr zy(eFrwjW@NYFA>rotEG|)lgujd-%9>^CkD4Cc4_HR1+#Hve&LbfVUeK^Nuqqp>VJHinJE-q zlKM&T9w)&KFIe-Kq$i}C?wG4FB9mDoON|{TpM|xfD@-Ov9pwj(^h3pm*!Ot!#;pS$8l2CT z|Arm$yYV}Lpd%&>qE8>a-^MFtKHbBL^NuBelMNk=li-M-9Y_dBBBmn$j`<)%1I)+I z?a(tE4k0JW{b3}OX~aL$UslP2W!3-98BL4y=D93;tZvk&3@syNMl~+4so!8o9@Fu( zH(V)u_Pn5?=w-%-k%sS&2Of(~#eIGn1$RgqYB_cgoo;`&Srsn8ZuS_%H?1eA{Vop- z9SyK7z8m4Gx-kEL?4dZzJTIh&L54kep@*u6MT72A4be4}G@z~A@dW*P?CZZgb1w8f z;DbQ?2lgWAto+ge1S&KrY)XBErY>_4Mx`~IULm4)*X7G}&*Tv!MRoh=*S9-_H@R^0fK_{M+ z%oFZtRs|(9wWmDQ+fA5pWwq_n^nz>N6wk1$$GYH%{lW0|vW zp^Z0+gA$+61^~Qk zTcB(|+)Q!RGjk9F6`9%pA0WG#P;&NB5&(as$ ziaOa#m1}fVJ<44VZQQGLaHE4LSqEn+$HC%Q&6Q5#)w}nN5d5X90r-b@7>k3hPcec3XQ9lAdVoVKa!eJCkY8#D%J!?2LaOHrF@Qu)29q zs=C1A%cZnS&W&7?`izm2u$%)xwpTVCQgR2q5M}UJePvY!LoP34MoSl6LMLDq1hoM}xg+B^o3id#(?@GT%{N;v zw$t5r!ZrnqEj-|{mvJ?_!nD)v+~aOKL$MhN0;6@vm0|vI_a+PeyT#*}Iyj|$P7`S9 zwG$TO3Fz9OQ`b{s{$P$7ZkcmDpScvkyty0F>9RL_o{L{{=u8;l$!*4JY(+ zvtjcjB6=G7`E>_14LxjF_w!YztG)z?tjC&kxzDyF+0R%(nE8K=GtKVFp#W!Ggw$_H zdyZ?`Ujc5Kt5o9TL#mqJK3CST_o!I!o~h#K%;BMoIUxxkinS=R&YeLJ*~{?7Hy3<{ zmYP0Y+P>gtF?Pl$R|=eEz$ypZ1L#gE{9h!j|H&$MDz+U*4!>Ou$AP4)^MeOJWUY?A z3~`NY{}qc3P!&Am_8foE@?tgNteIy>jg8E%<^?~mG#!i03mf}(1}bw52fC?116lW+ zXEQ?iqN!OqmAx~0+S(fcs2 zWF^%VRhkk%OA5rV|0xjdyG2FSai&AeJhz^8HR~U4+G6$)daNsS+}+@r4kxGC8ebWQ2RSPFD)cXcZSRBCNm#m$=Mv(j>m{l3<5I6m(iYgMoI)h#{Rs)W@MD! zVg&Q4$XL{pd;rw<8ol+Ck`fV~4Rw;+Ktf9e-=Z$6xy()N&OBx-!eL?dfASMclk~`) zox$APa0(i>4@Pil7v}fA1eiwZR%Y|Vew8$ok_7z3Hp1{(C~aa0ZNzJj@iZ&nw55=s zPNhX2m?J@Bbo?v3#>?RKAY`m-O}J50ImzEROwcuJmS4XFSe4%ruX|CyH##<{xJ7&I zk|Z6&ITr_<7J1gxGju;D;jz3V?aKV2oX8g^JG{7}YZ@F&e%G0K(JT*_S~;8d5(v{6 zBAhnQrjwkjk6^n1LyOPj5Q0jb1E~7W=lAuw-aMAk{;d%iFpJP3mH%LUX3Km3yh|F( zJhKtH6+Icp!m5yhFA90*)PljEzD96$%t+dlAvI5UT6q{yC%=>9K1qRLxoY>21BB7B zIdB-NN8H@!;)6HaVn0lV**|+3zx6Tl^Gg*Q?!l7rb@%I| zxN>qdJ0Ivs|3EsUM*))s#(ezObhf0+46SQWSd4=I?lb>^9y3tIMgeBxwRFrY3JEza zu&BDNO|7s9_XG(Cl%MrN&#o-Bdkbg3*F$x z;2%a7JlINFZc4V##>&L%YkY&VBl%TgT+p#~Vqvja+C}>i)m6Op>CV9O$xhM<~Y4-AKHi>s_cZScQa)Bd$(*ic(gIzpz zYgC!hFAT#!b~E$WoWuH=JfC|*4Pd5@^15M9%;jJ%*fO+=-AO!0p##=&f;->CeI!jB zt7`5Se*gC3Qqy5eli14N)>}O1_x))#WK)4uv&c1O#f3xOQ$5I`4#QtcH9$bk0igGt zNc~r`oDv{t%l(#>1Ee!K4Kg!5bBsmbyiZuu9jYZX4b5K|#-8TpfyMtdSlRsrSd|x@ zf>rp>PHRTa+(LjLIX?GV6oNn14Lx~{_K7X~e0=6+7n3@A>8gd|7}LkU-*7R1Q(q=Mq8`|L!3t=bR z!N1D$3p4Z;^h+OUR#AZmLIvUMlPV;Z_`%}Z_M|{X43)VEWAH<&+ zagifpWgtxcm!8RpX#7em>QJAAd(lIK{CGdzeFAyDD_lJ>z?OzBTZ%J$s9ReO)5X0X zcVTsnQRr>NZwvKH0hYzv{<5+rL&G|_;t}jXHRmV2^1qcm{8cO$$UTx@P{8N%eTpFs z=Cy`*6g-=;rvCGco_M@uW35Be(^K{)ZA0f@?B6%_j7_6Z-kg z#{eGylqYC&t?4TW$YkiDdx!Dj$nzgVW#&s%3O6$o($_;+_IGimKUgD73uHrR%kAK$ z#Iq7yHC$kHi4&-~=$O zzJAzM2Gc$1indF}Xxrh&Yl2?DYYaO_&MjYyG-0#A)uX9*c*ksvuKcMdDZB(yJ3eDwkmM zoHSc3RQwKff{qf*Qr)JkN*n&y2uH5h1M2$K{~mDl?jC6ezH;UKx%Dxtj)UIJ8_oJR zkTF(dPL68|U^pghAiRFB{!5$&S7GF?S;hs|C8<5r`P;xu{hn#@kGJ@d75$V z06I!PZm5X)Gv%6-p%khKV)2?#Q&aK5_y<2f?)G8img;WC>>79z>=L+E>?ZrqQ*yEzFCCjhf2lD8n9u)`*q;9h z;lG$z|01RR^JgmU)%OKA7RtWYx4sQwxuENzp`rGPljbn{r1i&W3L0EuhWWK+omDE} zZf~AQoq1Qs2fQEVQ~lSyRSCkP%@XnWce>a2Cc2(4>~kbUXP)+Y8>nNkY2OWRSPP3& z_7%;75&++3`o|@#ztuFe0AWoV!)RT35PIf0xZ+P>p_S^3As z)PCb{8MhedGWg$$&X)Q3*uQ*Xz8z)r;)Rs<#P$xsbBo6&5F+qRGtkc|N&dqWV32G5`e_g>u37W)OFap6m_doidmtj~spSjor!& z@K^#V+n-_SABIlRw+2lRnXu?Qtbh%+BV_6K9JLHp%~6?-(d`<}OJE>%KvGlC2tfc0 z&-luH^NzN%-?wN~@hrD|H}oWJ9r#yOU2K^?AHHenin@hbg3YNs98BtB3iKUzm!)z{w%MMuRZ&tyb`^p4;02SZ53xA z9Pc&*9F?-VwO)N!vj#V;3-dT?!nUe?+rrk(bp*Tvi5bX)0e8I>EuX{qu%@@0(+9($ zNZof%w;E8!uGVS`yN~H4`MCE?kr%PfY81C$kA0<|CQl&6c1gQL>>dwzAf!xzA~7RX zs1_nq&DiJ>FI?;r1v})|^sb@ozZ9ze^veUJz1$tob7;5Jg=_wjDoowDo8*8SfvXX~J9%FNBwzeXhP6+X^!hf|Cxq+8DRF0@2C?#Kj>o!pgj~`t!_AQl+9M?@QOSxYJJsHl;SMx`o`yh zyRB!d-qOR)!-LwDu}2e9#iL_~s`sYm_$uRdy#=l;-weVyi|atP23RNe4|N|j;57`V zshd&vw>j|55eP)wN`hl8Lz{sj5G>Xwgv(oGwpc=ZdrGA%&*AZ1n)_8AOhbWkcL z!b;J!g^OWuDB6Z2yniRb`cD=0KKF)Q1%G^R5!B~PH#VF+u(eyuaVN~9$RH%%)iVQ~ zUA$SASffjzWnOYB!l$73L>L@?A?t1Gn|$FA;Z3FDn~8Bz^vm$qnZlONlr*045iW|> zuZ#iGr#R07l$!UzKQ&tz+-11lw-YK%>x+A_`CkWBe8-95alP}eYj^6ZDW(7gmoYep zg0j@Oh>#GIhbROF5*>uhMf&uJLrnZf-9R^FG5Kyj(!~(kf$AX*zy$e4>#=E=pYdpY zBS7X|eB(i^IXlVL|3WtQ{)>KGtfXP~4gg75P6VNoN1W08Mm0((41RpDGfuP?VV5-( zzy=YT@>}(Ya~TJ(s%NTE>Z@j|-M1(COf+SzLOA_T)Dh+>sWztH?GbzngA4?}Ruq-i z-Ns|{P_qsKwPl)U%cq0T41khZ$K4dr6E9&Te9D}w?VHe#h4(!?Q!9YdT+rLfK%CUW z{3!H4x+#Cx7Ml|w2SsN;kq=`qha`|fOlsUvegZ~_b=W+=P$5q*P6V5ACzn133IFCM zda;OFU&NIA&K##kxW~qAem&kkQ97sr;=c{B2X!2R7x#jf(O<_ELs`>W?REp!<^VC((1A`bK z#tHr`Wc>D#KSgz?Rjq+QwbOBx(vJV%|3Q{Sp#zIpoMh|>=bA~;!hWm3$y)xpBYJNI#PF@%z8g}bv6SY_yS0;4qnL~zi|K) zs|N_9Cqg}qmCo%yBIbrJSFy_5*c4g!H{@LiP@Y)%An4AYz^8)&`q6&wrl5EX4}`;L zKbC?i93t(ih&6J1^hyvoYNi4^qS8_b&z&-$`ymZKgwXl+j02G_@O<(QOwUuBx;~Su@p&BFy>+DRk{r$9s%yhdp8LIE8VW-w%flH0a7@z> z@+tKlZnga1W3G*IiFO`GlWC*-s2&t<^-Z_p7^=*Llt%~C`cg0&4Kkgv~qwqWz&vY(VTZPfOWREtjBJPDRkK z%)nDgeKMFxeN_6*%NRO>3K7aOd0$~9miqMTrp=qs&S!FZnV#G^4iNJ&V-weVL}uTN$hXIS)DK<-H0s=6aI@vGN%(a&+3^Ja46UWW0Ca?jt9FtZ==*z27bUdDO)(d31 z>0w$QVlrcJ$DHx<6PvR1?UL^bd|4^qS5y<);KpwIbY|3^O6doiXX1c+7hfJJM~nSU zg1Yqu))jmh?KYQ=xtkFJ%Dc6Xk4tOY;^zH{I)QbwSGrq?@__?Q!z`P-6J=u#B~8nm zNq*Izs;#Fh|4s|rboIeMQ%3>JO|WIl!K3TQk*$Xc9J#ms$B6qHVCg+X-rARx(lgRR zBBOMNeuD$Bu-kPdCm$jI8wz;S0{yZ_&rb?sF z%S_gyVoojRgPHMIAUu&*^gQCRJzH|}O@d#DVAYkWAF$d|Nv|w4HA|=1%e(=-)Hw%= z!_(pIDhIVKJ4vdbgFxCF5HiR#Od&kN_g}gt*meln+qdnArd00Z%-6*>XOp%9J4uEt z{X(>3!z78~SQjvVr z&u#mmzKL(Us_4@lZ}+F!yDi@o39d~t(o@3%_BmPUt_^RWr`euRjvm4@Bze8J4)0djrkJDYK5s6lNVN)uJl9+2<6mNT;~muz+zz_#{PpSCEfKp zm<$Y5tk6el;>dUrGxYoKkt=NhMOIvvAKA)F_4cXgjS!k2BKDe&a(sA`f!yrTOvMjn zI2b5D_~~-}%=e4?V9N9tmn+~V5SP)M67&bA1JAk=D006|{Ga%jlXv;Zcn#tu<7~73 zy}K0{H=Z&u394E8j#Fk~5cz8-nAR?*iZZ)Kq@Yjc7NcsTZyuUr4HQzI8b5zA!~Jco z@UJ<_32Oa5A9}RzaPe?=m926Jj|q7B(eH{W{*8mM6^aLOb5jWXz8 z63?rAE%qg4oBY5O`yvB{&-7dAp%))alRmfpd&J>&oZzwx=F6OqnRG6p`FE9rp)ho2 z5hx5oD@WBs^>m0W%;&GNC8;Z4{+4T=Fu|PElwGKcHO(d+I3t$&VGrJZz%T=aG41Mz zkx)ywV?4#S*6wl0;@K?^3`CW0`=lA@UcFIDth4V%!5EeVO1Q#XEGGxT`U#r zZiKgbF(Bn=nSh7^(w_bwm%VRDJOGL_h&q6$5}YVWOiOYDqP@}K8`2zb6RV(DZ6+uM zVLWq;juG=7BmWk+#6z1(ej={*i?~U~g#gR16jKJt4wEUB{Z(Ljl>mDDBe^ClA-lbc zX+F2AJtHMY;IB(2AWre(%JFR1pL7J9Bk+k6z`jxg1({&+O&N+M64tv z%)ud;-Jg6o8ID<@t9AIlI{ zI5|xXDbDs#nU*Y%__bO7;)&St)j`r#vRn4Dgjspjp5iy&k7^Q-F)6r<^83B~ZK&At zNG-fFBe2DT=dbc9m9+ZBN{E$^MST^;8k5H=|3|N9ysTi>Q!=CyN<46LR3BRRouc() zM$I2ZOV(RxnDOsL3w^H^k~2lHSQGF@D*cJTW$`d;6 zh;_QI$B(nkZSSVOl@$gcq{^Ny7fU0=!a!(p&&OrvI-Erhm9aHn)@C;Vix! z)?ZtCfooxH89g^k_)m6d-+mIE-!xEU3A^Z#Teep5`rRPSHJrELNA$4yi69NX)4Xi+ zJ3b5S?(XmlExs7$MPlBp052(H&2Mkhz6m;-sp_tQv0dNI#e0-MY4f|Kjh}fum`Y;D z5L6R9uo+G1GIfj5>6HqDKtjs2P_==*FQp~c*~s>~+c=`qitc=U(w&aMn@uQLZZ_G` z_#1fVC7IK0Q2fQwl$~<;w-t@?zsDsgB>(h7hN7XwC>ht$orBh_teh#z2zOo?A6G`a z)ZmCCOA2&?0GvwCD$om0Ak=5>nQuLQQ#4%yG{SZ_N%T=CgbQU;1!@vvW1QQfcZ)L9 zPX)Cof$gD~*qrj-d$j!@`yYx`T+e>95^`m3ZZ2Bhv`J`n{f+;X{QGI@?Ms)=>ct)N zrrI<2WrQ7ntMq*xAwxyL_*@RUAFr2*y?q`*+RGHN1{3d$C4-yYe8<;X$CpRk8A0DI z%#Q>%c(aurQiXSl%ENoe+-}y`kd4anlfHD!QTdBf^C#k`&lLrW(g;S%%{cdh8x5+PWU55%kP19mwH93 z*~O@ga_|{|u!wW=|I=9(I86Wg7mc#R(rHFljqCAl$@*9!7*k7$s-2Ll4Ar?Vv}Imx zN-DvXqkHs>UUVsPj*tF0AO2%ESRXv@8Tx00rcQznB(=;FWBaFRegE zyuDIWg2;o73q#GMF$&2-<8z=7h#`atvW`Q%Ecg!*N$`^brTkZ8zW(6Vd-N;}L~Ap1 zjL-E&r+3~cnUm+2X?aBre4b>YL%-XI-uCi;6-aFE%b=|#JJeUG=J&x-#yeiY(Eo{D zAAboOCuZAu`VX2boKgMy46vB&Fq{T!C;y$M{W=;8*|H5wj0F5)qMn{%SN4g0I(GEf zF~Rjzla37vt&zradoRxLT$D|GgTG0CDU`DK5&fl$V@qv?yNH%$;XfSEpebg7R+zQ7 z6~{Icb_bc#pEqP6)6x@ISre`W)GBXyP88m3!2-Fj&4zj`t`mShxuiC z3%g~F-MA< zs;z{XnG*OXsM07<&MO)mc!fOmj%j#wY3{>CC{AM+5=rRf;{)IA3@-jqB|q;Gy-ipF zmmDy6AZ7cKNkXnPs=yERO7k#k08$`f#CVn>m3mY~MC3_Qa6U#Zq@D9WBF@GqS*CFh zk54?6i!@9IbNF5}sh2eOcq|e>9IwO^vtL%I#@IbDUf@}`V=k$Ec3_YlCK5hMGvxHh z1L(wl3+8=gW&Jee*6|$&hCq3fPi=!CptlpjwlttOX^C8c!|x4eJ-I(&sTN}ZDZQvn ze~5-l=#YK7mNQR6p!j|phDlD5hCOFOAFy5r3z#0)%r4=CMyVPnapK^)lIIa9-CZ%J zFeY*N>3#2D_p%iCKd!WV3HM_h=Ul%09l2NR-^nn|1%D#Lc&wOLiUBeVj)X9If#?qs z!Y0mWKZS(0E>+Wzb_7M#q9&b)W;o}hVUL$aZj-`^0(}xWa+n&(dNgA|=wA#2Q@fIBQGDxFPF_hH4 zjhQYf5Q}*@3wjEG<_we@hki=l-PDk6NN(HQyO)dps5<&LfI)yGJ3(<(eHJy&TvPk0 z9mcu9#1@wy)|+r#XDVnv_$K2xX_=gj)br+|>6_~ydO_FZAkNYa#CoJ4PlO$;h48Fa zNoaA{=XsPX9+^>!Wn{tO4! zO{$6ZaFOcB7A7gF8G9s(hatp;F_UWXr74&2(nwHwgMFNh*22KHof8#NAl5y$Tie~8 zjCw4m7yf$8T|D?W(EtI$B{*ovo7NVBe&n&U>5%+>yXnwhzSVRHX@BN8TXkt_+uYCA zHCNu0K!3Bn%Kt&pV>t1p!z7P*T$U7?n5>#duh!M^5_}K-%Nf9|*>G_a^iVnT(rdf) z0dd7K0BWv3pgy|i1$`f;>{KR=`c0GRhfUS&bC)`MYxAk35k$ z!$?X7m&U*+AChb15iO*^&Pj&6-K4&HG5iuOd`lht6&l0PtoYv}tW&O&)ywZ(L&3n7 z@H-A;wQ@-s--|moBAX|KpR8`*wk%I+8JX!Wg5LJVnch{E6tK7aDN^R?jjguEH&N@2 zhS}>)Qa)43J+Mg>RZj)8OROVpX7=xsWWEW*@}~w* z01#@S(r~R=@@`L=HdD`TH??Yu6B>`wAoo!1rj$ zXiX{Qx}f^5YmJ#wb3#2sLhGyEHGN}48AJWg3f4XmZhT7r;Y{kd4Q#U;`)%_%r*%-H zwhMKb$3VPlvAIa;o8coq0z+vgT~2PQXpF8v7PY5mCw!r$>p;2C~HHm~GGd@C6Zd#^CxC`DCixVwUL$h#on z`5?Z?np)v*HyXd+Uld->?Klo9r~>uGRdv2S!txGh4VGspd|n^ecfil_2npr=-A(7< z`snHegXwgw*yt$#kwo{Lx%mbGvWZJPWe;gz7@ZTC>SG=}7ytBVnnlISh0J2|;NZB0 zja(uymioHqBpBM<1iKBj$r3iZ%Wwr989L*o3B%V%L%h_|uc48Fzue{k?UQdu;jJsL z4m7|{5Hd@t?1iHsAqR91!y@iy?LsA98b8Zd%^?Dt1dN6O!HQe#FlQE+wdR5BUmQz) zmF1F@oTKYm@b{`ucn6C*>+idS`n2%Hms*;(j}DC=)=%QiQAPUlJR8;&4Z-GmmFpU$ z0PuOPZmArV^a`5q=*R7j#|7`Lj>ot6QC;C7Qj~`DXE3dAKm22i*0&q-KLgA9;}H1Y z?`7b+9vB>r@fY^v-)at+q^}ofN6eQdJNPqBe^df{)|@Q-Ae@Nq*ODQUSS4eMcB=ig zDN*N#{iG-2&o0n=j?e~%WYB6 zP$-1=x&_!N_US?_f;3RM66plh>MyPvN^2&4ZFG2^uY;}^+e2=U-w;&@kYBBaRLR-M1rWRvtge`kVOO?DWkOWhn*24;=Gfl@ zZMYu1#Rb}wT*H5q5!krHN&xT@m4c#lNfc36@8)ov3%->p7>l58ByZ~c6q<%RMmQA@VkGFFNK@T ze=UJr##WwYXoWW-x%p!1uO?=M>=C8(e4?II2vtKrIP!S|q$+}G-qm)vMR_jb*S3dW ze>cJT1E9wcnkYluhYz`q5g~r1qyq1whB#MI1k6Pj)}x9SfCMyN2v5#@E&wI^q4#E- z8av@NWKhc=5e`?M{MCujh3YvH!}VRme#G{E@Xx(VRHDQ;(Dq(r;tPFIK+pRxX@!3W z?f1LY3SHF{Vezg)+{Np9Rr7(YpN*Ejt_Y!5Rp5DqVh=n&Tn1@Aad^M&-@;Ew14NVc zw9`fEl7ILSNA<7%q6Ws@6xJi;x8~{&muP0QE zqC{bkqBm;9Pz+DfR|0(#pZd%_nIbKq>)+K^HS9joFTc`H_+vyY|2Dbr>+L34^Z*Mm zG-j9SJ|wh3zXsP6UQ;AsI;z(MtV808Ac$7LMf$4cic*S>-GP>eqrX3H@(rWd!UcZ& z&^`thFs#MyQ&!QVLlomZ8Qh_#mV@F9wnHJ|K;L&p~ARwGg(oTj@R43 z$Hb?FZwo}QO{-m#Kvnh191NI(H+NqD5X7~K%llI~BY^%(wBRK-pa~1LwHH; zA)_tU!|VYqG*AvNtO!@@E>SQ6g8Z5e=f_n7 zL{~qIE*g$Sk!fhF8LMt?e8z5_E|ip5Y8Vr-b`^HLu-4Sr{?0!G|h_o>vwqcO_n=wo6_Stb7g$iq%;{t=Vb?61YRUH z%&H+58}=(aGK!?;_Xzs;B`73+8DQX<jlXSwcT%Z;Dn|WHx->F5LClI0=QuxfD+Ru}dzJ(c!HzjxY z1V_+#GH5IjW2YEXT*&-xm5VFl-o8n~O8yFlYDfJz%R1Ugu|#e zW31ElQwqfF>A7Ncd%0&7y&xmo_#_I>1QXUiM$7tz9Y!bNA5-9Z{Ffw*_R<@^p%E)P zY`0hwperc4q1<(ty2wXpQA3sF=*iLCH$3|w_bHa}xY;=RD8v(x7)PQ}6Lht%Dr+OJ zN7yf)9W_Qa2jn~dDmIlN>THy9mzNJ9<;^KN^OS4SF&@oNuQ>itzEKh(9z*J!c`VmLA%%XJjpS*V4xafvHD-N&GzdRt5M z3hu1?>xQwc7Wh{3z}JDYlIVvS9!67qmscyPg(9!wgHc@Ks&tIZk3XB7i8I&n*NXdi zg{q$X-}~sJxPr-nUe3dBIrl8t8S_eN+Sx)aPs|!?AnOCXd?eW{d98zC1j+I4}M^XiGoAN9{P2%cb9LlHu^!kP+q2+dz6Cf%R#s%om2x zQm+upzMxEh&nkNoTHGX=-%@t-PS9|vYT=3K*^=^7a11?gQaF?JK_wlve~c0##~Z2? z%{xspAxI1|?iG$xa%cV*E%=|xn?e1mUM>b=?XAnfCAw~D1FCo@Dyfz7Zq8$rqQ_xW zo^M@i{3OOx8q<;Kq#2(WFqUXL_4%7ReQ+IriFlfXa7}z8Kr<3yei4skXecEZi4l-n zsBA4_{GMDWxADhk)Z}eX3GS=g0dQxH-*lB+oX90WWSR$9@lj$yQGH2>sAy5!3G^scTHw&p6DZ;1VpPQoYp!HP3j#OT1av0_f{~B6kt6bv zh6DG!d@ZIOkN5Yj%^y`+2zYmuE~ZjmN*E1a)l-#-$)4G02k96%slrwq>{j@q7fzy8 zubs*{K}}#UhNYMZ0%(37q0}Hj3*gO@QsL;T4)T`02TMyl)naY%RKXGEEp!ip$eDZ0 zzI4g(AMCDdN0>Dkwv;YKGk{~e1*yRrB>^gP$c}AdJ@@CXkF_wE-^PBy?~YnGH&Z{` z8vLNxsi$QeqB=0AJH3#&&=G43*$9ydR&OH&x=mL$oi6 zAVc|=GNZunrD*qeq58=F3PmN}5hlc80Zj;er1o67D39#yjF~dS>WM>Q(2LJ*Zfk~q zIWg)J3#%mpO6@5=Ee|HH7$iN5B#rO=^Ar@%p6(yV@+_`Vyl&a`P75alHq z-^lk%iLZ>(lMC1}J ziXRi)i;8d+@MBazQ&EGW!Zx;vCsPkN;FXiMV;NJ*((!VlcPro0xkD`#CT$ZiTAw@M zHCO^-i1IjJ({=9x+|u%z^nF=xrN7gc{DmQlp9)7HaLxrBx;t70FW!$+E^-Q}q*;o1 zB*CmIA}AADqv#F#Z}#LT*(bc4ItWz^&=pC*SCtOHKdwQh%KU0BdMR0hvDqvS(xmR} zKb>GeRYAvC9)ZL^<)_tIZJZRRMOL9+0D?56JI0hMJjs7aHm|SX8_?VoO!bHJ2fXDB zz$r-IjT{NX(!_Fgi(~>aXH6L<5e!;<$EwZHQpb^&|QDat!fz)nP0eJuO@{ zuVb9k2s^o)GVl<6)c6gZC~)RMy3u)zGi&Ibp%n;D$;3kqFTskl+Z0qQ)J>J{M7b;E zYB#>T!n1So{V{%9xO!T6tML%M$p^hL!>D+7)aS9<%foc+#!`tVQC=X2>hECa?K#ty z*{OFKn{MnPpQ)nS*=fhJ7E(X|vq-5MGl@#z5e_(s-BAATNqqhUg!xfdVkZe>(--yK zfznbm!WVa<+5-IpT-N-F+oB!wpOr}eLCtRl-+6)o4cDtGWkIeXh}qku^hD_E!aNz|ZoT61OZ}jy05=a+=QDSezeN3B1!mdG*WZvpuDI z9{8HxE&Y=CwyM#>Uf|Z6l}l$K3G7e63!n-@ie~FB@a&!s+H=&9V(Q7Yco1EJA2^i2 zDUJSk(V={I9V(kS10?w|R9{PjPrE;V_AAP2gxoio*=a(T{IegoDI#2CoV4_!uq$*ze0n=Rscg z&M%OFT?$uZvwPbfRFCws)uE^0%H4vuNFW-MZ}CQH=t;b#IW71l;hhLz6E{^D9r7Zy zhFndgPa}(OrLFBC<2S~bQtgi;`%bz4*%<0iU)E*7Nu8oJc+`a&3@%Ul+)lf9g|C!R zA;baVD2CyTj-!4aD_JWi&ZD@Hj(6b`xED_Nd}i=~XvdTw+W-~8gb&Xlm7ExduAF2+ z*e~tf$3Fui>dyFNziz*fB8cFQcYNRrmXooN0pE`sl0S1x?cE70f>Ne{ zrC8~t*gIaP{E<$RlhG{E2;~60ec~72i^$4&3ABn0d247=Vno&|h)!wdjtkJ;kDIs# zbe+!9@->$C)WGdK`I0Vi?zKwUE&60bP~*z} zPKN3Q7?zD=e@Z_9Vc&3r;CjTCs0_RkxukG-wAoX#*DZ5sG--P4%%60ev<+K2&J~cP zyAz6p?M)oMs6<4MWe*6=pegE|IIN1){jP^}XGH_%obtj@tmd4>i8^2$%9#+ew)QQ% z=N^7#-R4uxpJ+!n8i+1LviUxu=$qS`nUb4g3?Lbnu%8LbmJi@7} zKxVR2pUI{j<2;x7AC#QS%u854Arc4gBSbvGeq>isZE2zZlz9d9pYoyaOZY}A(!$@R z++t8ZzxoBuNA-GNae2kFC$w?*bf1JF3c_!UrYE$H%4!&|js<+dF`YNFqJA-W_Rm>S zogl1!MmKxqIz-m236`zmQ!+cUu}&}VfXz1%mNtZO-ohVh_Pg7fNgo?|r6oSD3lf49 zeNAWIIcBLApA&m4bH6%icx0Gje1xiLQyMfS)??}%w4lr$lENkX!bC}H|DMCQ=1>(7 zlU!42l?2QIn@Uq=+Z<96ffqpy)kLIa4r^v0HTmCUQK=hG3W-7#bWD!}b(OOz&Jc{wH&5TvMXCW235h-m0H}PCz z&wlAvzYZzwGU7ZWCtnkAfa1fD$Wao!sx}FP#+!z~D}qO+iIe)Yj|p70==RZ`f)cFB}W*t?=PmxegovDsfD zI1*wlVXFI9{lj3F$6LqHlQNO~9obFNLvn1@1|pE~anbhD;`X)+9^k&dIHEf5O@4{nb zUQ@I(;Dabw^^3KTd$5u-apzLsB1(=Njeh1Wgo#`@DICyzJ)erNB^=KPQaTannp*yt zk;LI~&~ChsF*AZ{EiTOy*YiUY`ibn}NukIDwR>I@nA2*nZtA$VU4_%NQ9`#8HoNn5=bm}4!-GM>@#teP^RYxv7U)W?Z zo^Il?c`cRI3(~O<>H$1cgC*<-X=eSw1XUSc9fXv{1Z(I{Cm3Y)pdCD}w0EorXi#0$uNeI9=yiyawr(WXS`*-a!)ZG#QMg@sk z-T1}e@Bvuayrg27K;?T~D9Z*t76mIL^8))5r6LEVHl#|@2Zm<%=a*0MYY~R@T+u3j zTq9@d-(;zA94whlM5t^pDJcF`MdhIn|AGDChq3Co%Mw7iC6y*FB{)LeQdQvNaU1vL zg^nsCvp-=}_PF1t1U4{>1ZY9h(#ca2ZOUd=!_T-bYL+!cs8*XXkvr|%@7-Qv?^crj zJ~zpOXCJwaGylP|+lxj|pY{wIzIgKCjrnKIsg{(}n(lpSS!HeZ^29#M8gmyP)Gd#t z;(-Qek$vD42o;Nq!`dk_u;7B&*mTsXXCm5yFcQ)32F9$8L``?^Hl#@Iq^~zlJ`zanx-XV_{yl&I2j6i$tL)DXvGz2clYaXBFAqFGz!`8_HP|{do6-fo-V9yq z#{UGqD`|{T5~asF3B-gn>xm~=-Z#1-OY#q9g5x89Y5K5IEE#}L-$7z@SV?KPQ>7`qE zDsyb7dHNqy&Cwx%F&(+r2}#yg6nNqiS+7P~?}_F8|Hupbb`gNEQO0Zx8Qtlu4}E8q z-ds@F`X|l)>D&M0XMDuZ=nG3hMXN01Fc5x8>`RB{L{gE5Vgm@tb2glhdh9oM3U}c#piZ$4Uz8DAEM*K7 z;aevE{dJ?wxiFDubCeD0pJ)`pOY$(Zh}qO}Pl}_2Ytkdk^>ol66&Z^%u3L;)y(ucL zqrYhZ;Woe_6>*TB=BAHKRM6Q2PUP~`E_8unMB1vwtZT^ufhV!6Vc3}dfQ;}wr7AXT zo}Wq{nO&sF%xKU_N`!7fM`axrS-v|Wwb1oS_HvwGy}aUKIZ#>u9(+!0`NOo!)9eIW z^a#d5b7dvrs!I!aAjlNWPpZU1M@&5D|0n}vd&JQ1T7>(jkb-=9V6sf7@{{Laa}g>a zU&-3Vq@kshtV!~m{dyE8DE`tjffBj;eZSx6T7TEDO%6Kp%#nepVcF#%1bnyJHi}Jk z?0$3rb+)UVyIN0Owx7;E*ZaN#SrS<%pZ%jZPaeJsAk0;;!4v+1wyYr_VRDo8k`_{p zqrtx&H^h*$*LEfRUr8F#Cohn}{8m}gE?sN(qzhyt(uUtyHF z-tBX9jI@soavY$WNUVTcDc|l zrTB^E9-+crg{VO!k+Tt}YOoGCu66QVI{_(>ZW=R;#Pft0ilNct6U9xeMY?%B!oiNL zT##S3ocPUb3~t~;%{lKrbF?MyUXGAk)6OYoJ*tQjO(w{Av77U#HS!o*p(x|IzQ2AFwSoqY1bujZ0_m-F9Bn!rXbsaHt@6pb@$=4=z}^1(AQ7UiZ1xN$>vi@33l61p zfp-B5&G88dx7U^;OlgJU0YV3e_r3fQ&FY#$#K#8X<*M4~GYOnZp{f%{5IQ z<~a6B7W%$<|2A`&XI?1oxbFeE-TSB3cs7xXTc06v-s!wYRA$X$yw6eM-k@T^#g-_Q z*#}Ld6B&NfWAl&1=?xMDL`s^9I5yMLek;)opS^^Q%>PpX1rynE+kFVsc@HHSXPM@V z2=sb8^d!Nj8<^`!p;T_sM~3HQiTL#)9WB5lT6{M$_qv3hzsPgel)Xo*n^fTGOLv22 zRL)wp_Y#N)3z&ML1{vDuqbNJu9y^7I97m%x8e}9BtdzuBO9jL>n>bF7R;CsRj)ys3 zI%#qG!Th_uYd?-Brm+vg^AAy#057ZYN*#y-xVS4uPzc1*Vp@DMU|${?oC zt7`+i;1CWSt-I~AV(qFT#_0A|7--o1NAc?T)Zs4h?dMg$8W*70Dhw`DL#<0CnJckT zougXa!1NSE{04}$R2DmXz|R3MTrt4Sg#RJ67YFo}!{EI6I4M&?Xcz)9>UbvZy_+<% zgXMEp+vAC*RFXuyj)o?;Qhm3X^b`3}02kP<3vWNLel#7p#N9OGfQ-T$Fr!?&m~)Zr z0d}nAt@ZfIuWtHXlhOi~xS{65lVvOh9gJyy8GX={sLnC3iRzRD>qvI%dodIqQ-Xpb z^iS}tHMKW$<9;z>5)nWo%4A8p{j{y~Tq4Cg9IvU7q&f5?P6bGTA_x>_ZZ=i(ofMWs z+_hxT36jXsVI;OU%n>6Ti8LBF$1mKC!c@jpGpz`|-^1ihtH8XFF2YQ&_NMN*!0F9y z)n+^BrzE%*d_`3bCosXsQ5i|xyy$w8$uINbCrm`gFzeHg(uAA}O}8?Ma%M1&?V5D# znsgAsGR#^f921mTFvRsd@ilk4KH@3jfDlWuu8V+qG0K zxZl7Onhb+nltkCFKj9z+6K!HGx86L~FmQ75&c3l<;rQD-j**JaP;0cGzr^4~kU>4( zQ2ye=6}#6oY%@v;)EZ6fVF-+L`La;?}0@@zjW z-_JMM3Z~o!TmCx`60%u*=d5YV{L@nM=FJ<@)GuXfx!NPLJ7*$W-z zIC>B#Eaf@%>>2&k6N0LjvT{c|F2?g-yi3OzU%gr(w7<;nyE}GVR6VX^wHZikpQoqwHG zcGu!G=fu7{T@C8%IWE1s=VdE;9s?FrK}0qC8MQ}X?$FSglkO0CX67;VFD(<5e;QFo z2!a5lPCEz?!0;0=kZ206jGheGF5WNkXn9#DUQv`Zcc`Yt4apHVxCD$^BCtlp0>SA? zaJn?Y<6RRNBqrQdxI!6*8V7mwqeyzj-QsP{0n*$Ur2Xut33W!^dnm4=Su3T>Tk86} z|1ge)Z)js&g1|sZd^Wn5UcM`KiEumun;n#W#s03#7?KQK)9ws2BTS+ds36VV=W>-GE~V?9XLpo?=?NXv{I+Z8FA5aIEd zOI(4D5%GlYNoI{7J86QMy=zCk*)HPW=eDnUFi`D$z@TQyAVbcDuUd(yJwTzD3Z~B5 zd@_{Z+61V{D4tJP`De`aR_mo)uUXOfFwVQc9Orc|enwqvw$?@ZHl0~YR7B)Oyyvmg z>CS@X3;UM?Q{tYqh(evunyftyFnuM}SaMOI_-EEg&|e_oo-QOAHiT`;3?qyn9*w(4>5~cEg1Q z!Xp>%E{@SS3fI&LGiwPAB}mwCrW+=9?Dkfx3ca7-Q?fFc;ZMUs-k@g!>nOIcKg(EC z&2Gm!aKwa|(MwnOLjSmvo2>B6Ui?CywqNQXH7$c=&cEHcNfiHgetC=M0pI0&^ARVD}J~rspC|0zvM+9RRArlU7hYXOGE6`yB zBjK-jMuIw^DHFFCjOh48AwtX?6D@DtbD{&)pz|t%2TT4zQ~Re$Ji`I816)S>22F22 ztnbXW|4{}E@cCfRcvty4x?ZFDo_GnDYX7z10@adjx<%NmkjJ#gUk)IDx+O=g*Y>hs z-^|q*W6Nn0=DL)LB$m_2Db2t0xLy2?G}G3Od3)W`*{LM>F+u+KjZ~YxqVFyvTfrFL zT>ZGkNNTyD*KMU|t|iK))?ztvekltKxmzdYvjoY2XCc^Pri$XbSsC75$r_`~nwNJn zGeCO0A3KbH-y;Fp>j@DS$*Bh|1w}_$Kks{V(Z80P?n7an&ySQbUy-ZFna5B`9)voSCAOm!}&f8l$#k{lRNdKf@A}qEFy`V|q zStAEY57TPWRh@>mY1hSxe2?60v3KzWw(8=n_R}!C{x}c$6VE=|n=3oi+tn$r=WQDl zzHtIni9pOcXLJdpJX_o%wHe>T;wB8G*~zmnFn7fvD5ZN@Istg_2)Q~X)ozEaRp|^= zHr!H}+%|o#1eM2wnu;v3J;^hZ@<}6jk%o>1A_V9asNC^AgXQl5cIkJOv5!=Uw$ebp zdXWi|Hk-*gQEjhyN}_4w_cP2gIN&pAWOk5McfadJfpsXvxaQjD0T`LVDZT|hltN1& z17E+gV7i}WB@0HRoR8`5@`-YA_NaM>->vvOi2IC8Irclr9X~lueEEx+;j6pQ@8IUi zg3mZXBg(i4Pkj4au}>u_{ZGpdDQN+m6Xe8>T%lJjTI*RuaPwHW#K9qUk&(qH0a4Ch z>KgssB=-6hF5O69)A&FHRrJTZHsDmlgvRT%jWW-LF9^3aP+gJ8IhVKpc8l9I{<{oE zFH3x^TZpL~W>1;2_0v0mw^@OBgS{)!v`k-eU#1n&I`D=EW5~ks|&2(Lhp~wrWRApJJ@G*gwe@7SJ!!|vsed^?R`+l0GsmkS)j zl=$KD7Ki^*`Tq)C1u=dm=xlA9r~q`zwyne$k7ZkOXrt%V}>8s2)!{HI&QXl9IYQ@DbqZ0SUC&}+16M6vdmSu zoCNk&ZUK~VM(IroimbSL@BioxRVg$?@;LL+nDpe7`71Mzv!Mi|`5-N1N4aOe?xxNc zLX@^QA}F5F6K;CB)iQ&z>5P9EzYXON+D5mctCG9Q$kUq7&%Ga-pSE+nu(#cj_x6gD zCvWGDiwTW1=sBzK7W9k^f)tkm^X1WzcpUe8C-39gIY6odoz#Gk6~XFvDF}N5BFt=d zSt4~}sg3k%{3w+m_jsPY5Ad-DzreHa;c~4kCi?ejv9I3%MJeRGUUB#}ebWMgPVPQJ zIaMY+)u_O;uyn=ZcCujG$@A>SP6<~JbXJes0~V`2523UXN~C0~UMFaw_dPrPV0&~IxKZl1D$S09v_6_qY%NQ}8(UD||+v|;|+ z-ae=m3N;gC?L_4Y(_TFkFjLjZke_(GAUgznD4!%DJTrOz>LK@3i{occEp;@|4lW7N zKa`Y`a?-UU`u1sQU?p5ov}*fA))|{OV}jOCju0j9YKQ;SU0pO3>V6SDQR?uD-;op+I8JIrrOkD{OrXRtnLDEVfy403bRvu1HHQa| zBNuI_KD6smb4;~PpTabb&XU301;YX6nIaFWpm-!u&lUuzBc!$T?5 zq?%F&+!TPA6zJA%HMc@;@C0pdY-5AJ-bF`3pSe!r8HMY>VWN`(1=;(Npt5@*4HGzx3Udewqy&GauQZLUHAxbw3%)%^iH>)s_CeQ3UKceeT@tA~ ze`lPR0aMC{qm%7Wtir)@g|p3ywcM4_PtUDS-sL*p!hDI@;zQ+H>&#kM&-#f-$>nP; z7uFZwz8%hG`pm+AvLJsIjh1@;xqddts&DvQ+o8G+)^eo4I*qz1PKqQNqtGXAbWr1n z@wmQiA9}B9|6#~p1B+n7jGE@leCkaVu{;F45hpW478yG7vtHNUx(=;*h(aI{0kf){ zatBFV2jxEx6=nJ~Qp;4OpFi~A zN}~P1&KE%;it0uZ{1*K|4O5Ma*B@)ra!&S2ti0BMp9_3sqDGZOc{@AHK+3_~oHkt$ zLB@~}c0L0_SS;+yON`B)^Ltp7+K3;fE4nyn!)wnj)ia7w2ANwQOj)5}bZw{GjGklbO%ikSj3)o3_Wye-;A(`Z^pn~k3H61 zMEI6>=>kJP@!Cxih5Q=kFgf5%o2UhPCZ#sa?1MbQq9fw(}$k+nF)BVo?q_>yLIx3 zpzmZ)ao%$9rTFn@d^?GO}>x&jZRwi(cPg9m?khQVmu6q6Gj+JR!nHtUG*IZb$WZb+D0>p=>XzywBc z3A+$$ywVk>#yYCpTFoOA@(P0H1ub6sNM#Ua`qPr9*%%5FoOT#^@gE9oi4nVNDB8dC$hfLLLIP}S0 z%Q!G+<=<7L?@Kwfizq!Z&vJ6FZgDxd)>lQZscsmkDb%$fFbc6Y<~&6{M-A(+KG9}Z z6fE&vg6kgXh?dI+oI&M^dXJLteXFEe0#{OWuilV`?h=pB3k>m#mXKmFw(#cl_&m6u z%U9VJ=r;Y(6@ITbGk@apAy0!!IMF z(O5U(v)xvAUQZvm6n}f5tn}?@b#+8B6X*B;WsEg)f-_5EwO>3;m&Q9Pa#sTw6|Y>| zv*!SCh}^huTznw|4VEP1kYFxc)mr0=CkyO{vo}w5-o)5zhFH8v{ zo-;nU^)|6?os_Hc;X5N{G8pcID)TkH#SO-y5qj{V$?W>m&&x}HvQi4&qS_lCv%*;y zjprog5bdkuB;mZ_;2Uc5C`!*P38}n`XP?z_p2d1aBa(Zv@~OKu!s=gH zcwfAIy;O)Pj6b^Jb!rHRn7MuN5m0H-7@Lma9b!ac&~ z$G8qM@n!6`p629W?dGkE9!VxXFj?59z86rKHGXq3BEdG35?m;}=P)A!&$N67tN!`{ z8aWILoQ!ybs*J`2kJhO|wMItk2LZT0ubIv6Av&6h26K$Bk2g9sTn-uQMX}=Ihmy2< z$r-Q~{l)g;6UHTWD!vBos2b87%5tI6Ud_JJSSfW+p4;!%+U>LoVkCD-Rtt20~QEN|k`{bcIM zX1RlWb*v$=p}Q<6IbopR6=U4mrMU|NE8b&6cTOrIg~#on1E*Q;72YHJ3e|XQqC}?7 zqjG8d?)UWa9>H_Tgk`nq4(Pt)%(@%s(VdfPO*lM*JiU8h^=WTI=+msm`#jv-SA2a7 z%Eun?Xx?9NA8v9k|ETbCt|jRzdsfEA3H&zRIRnewQzVP>rVDB9ejApV@ZoX zj^5j_>NX!$#qG+v$7?}U1D|c3XK0_1eK2b@5`XUnVE{Y6*1X4R99$G5_<1=sEunfb zhglV`r*OQ9Vs9R$Br1TrF-6GJ&W0RwZQzNGHV=udR(t|iKymnS2B<0c$x%xOF{m9o zj3HN4H9?eGq5C8P^hA&H?baa^Z(RJ2}e#1mRJ5Ena1&KK(VW=!5rYnfV$u7&ZD2+{8cYsHL?rPP&<>bol4zdfM zNi8ahb6!q0Iu1>rxKN%w_9COka)RcdafN==1^Kuo@QPxCxyT`}zJ5<*$qIdwP=3-g zTp0w}oyam)nvLd4tI>)mecB5kG+3pa?S;XQa2`xswd@o z2fnMlWEZ}DSAnhwP@LC!u&E_;bMmq>=YbAZ|J+^lvQqQ(@VR0tGOe9Ii`{*wWpfR< g$`dd?KE6gTai{ZOyPvNU1pKF=qI;-73FZI)03Z%X-v9sr literal 53302 zcmc$`1yqz>7dAXJl1dNVCFOv0cL@lnAQI{zgD`YRH%iI?f=V|iBGTR9AcAzav@|G4 z{x@LoKJmWK^L_un{cjY1<~= zTukl73mVr1CDt*Ejyv}4js*63^LKH?j<=4FCXV;%6t0s1e?Fx!rd>Pzu32oA1f2Hn zxm5)>yfFb<$ko<joX(f!=48lgX;T&Eh?F?2IEELQ zxWS{ku=Y^_+?mWSo3SEfXS-i}gt`Hy6=RR{^59*59(W~P+SIdsRy8$~n&U@HBu7<} zN4xjqBy>mYs);W;q0@Px3+@vMh8F4}Y*Sue?zo}d97jvTzgApGeQ53d=8p|-9}>G$aL2edB!sTqE5{F%tSJcg77-8 z0taNd6@7l)gR0l~jjq#2)f4L+k1=q$-{8VY80X*2e!TRlG{8MeZ7Ye=9P1N0{_=@E zy*R`mmoP+|7e7l_J(p(o!0HZEQ?}_+SXG~&Ywe!jCh_r|%}bBUT(RVZZ>=jf2#1h@ z^UWgr>||**G)nhPx0rkG2+hA~E_YZ{dDc3&#LAuPeG5w+&jw3Ma8c~dHM`;hxbRY+ zJK0l3W<%)U1KFNNhN9V`cZhFVUZVaT?j%%)i*DM`!BDlq)x*G8eujzfoz<2d)En*w zP0n{-9{0jntJJ)33XqtV$K!vo32>;ok{hdWu|>6er^k77U9#mSU=2^@-rqtN-5pfkYwGoHyvw!v@v-HJ z2dAgJHX)~?T*s&jHxz*n!ywP82o$>KH`QSceA5mE>zHCY=~u3VPpnStA;g~5UZ!Y8KN-Nb@$+G_;LneEFt zXrPg88fqAnaD>7-lVqV*IVcptVGGiV0%a0!+ng&iFmE5wd3HOX9M&rx#m(n4QEz^d zE@7JXl%>MAq~m&>#${p$yaf7e% zF{UDuG2yV!7uW86#$$n@mRMCim}1+ruSj`HO-&Wv@Fb9bxCFidlkfH_Z_=ct!w+pG zwm(8_kS@v(p;X$SNWlx610^p_aX8sB8V3k|8mrx*qV?k!zzo-nYUV$<|9 zW045P)|@Tk@a}EVTzV=$txFUTfOMXMAm zExuw=4pm*BIrVnEW_)uN65mW=E*S41`Z4UY%%iBSQg|YlhXB}#n(Fv_H*|rpV+fz> z(@l-IkrExtAn6um(JDbYa@+4#LZP3vp`C#$oh(e#U|b)UwhOI-qCM>>xRvrpX=u)k zij~y3W2Vx`xbkhmsQn6fCnfCQB;bn;??LbypJ_2rj*$zqSilEXH-GKt^S z(`+MXVoFRm=QT_Q9tO>`FG$1H(VQTuGKG=$X@=^;k(gw|Wd^R3B z$t58TC0i$9YD_04+E(Iale;A^r=i&KVmb5;Td4>EQ3bUUYvd7eeZIq!(4vqY^Btp- zUKV~1NPY@oCasE}VR`F?R;Q*F&(ueE3s;t$yx@t@mtPcxg6>?kaqhxrCH`33-ghmL z&>B%rQm0we%04pq=t85WM${8w1Z7dHWKsJUF^wQD_X`?A213Io=~qm%6AW1I$>IAd ze!eW46(;9RpfI-wtURcaPaCWJZUizOx5_n@it3%q>dDz5Kr8^WdQNohQwiq1*zjSe zA*O;J9?uU)GZ>D^k~44l1D%VxSH%o523V9}lHT#nWaVzxpBy-MEHhE&qv2pzwD!ES z)f@E1KV({za-dEP1pE}A%246nv&T9V6hBG(pJdr0hSR3pVd6hI?5$M7zhVARBgw!8tzoW1X3W4wY-bCgY9@ zTP3bwo5f)~vr5JHS#?Hx4(}vb)b);djTE^V8p>!>cSdJcA-Fl@?HaBjD*pC7^Ruyh zH4h|qrxDaZoDxya*hoek?gt<4#Y$MzVjg=OLoe+$&8MwCqe#QfirDTBl{s)a9=CoJ zs=0w!d9o`6F1n6BXigJx7P+n+v3KQ_rnpy9a(b`7gM zyzm(^|?F~E|IMw2Sp zi`g59pqXkHbs;d4vxza?tUq+CotkBVDP&-beS41|vXWP)skcC)e&btKS8l@g?yidB zFymrRhUta4*J}q#>Quv6(1TPuDF0UXSoy1a$Pg_|<9moW?r({g#rC?@ykD_{_ z-m&nZybSdh{Z#2vwyjUDMto^U$|V|y?t{OuLfC1>eIe3D!chO+_7&eiZMGvfAV%YV-%B-A&Llc5i*?~XfDGGt7-_+P-A?q|1^eN$R_)QD_ z`%mJ)_v{3EodY^yWvL2*(z-xk1SW}UbIj=YXQED1a|{Sb;p`)Kl$)Nzqh^lS+5FlBLti|{Lvt&esxCY;yI zZ{K({`_4D<)!v$-b=d9q?yT7`|10O7F1O-t%F@)q_bp-nq@s}EsmXf3-VStb2wpw# z$ldMokneq^191j>pM%Ow?f6{XrjhU8d@&ZStVll&Y6y8&Z2UB|Dfj*nv9y3J6?#;L zLZS4%&4dUB9tF%-=y`mWmV@~Wj&_u7(W_nuyS93-UcX+v=zZyNwh_Z4^@mZH&>}BI zV2s|lmIlR@gK!VdUNyQt^0Kr%Yon*_GjUXmW4QdmM3OuW%n~FC<4|)y@nXV%rdhrvrmMqCGouQ5L+7Fi=wLt5-7v(oMQuz z(%rz`sdqGu3np|(#_R~Vo)q9u2TW=rB*uI6-My=?dv9uQKrHWI4@*jbwhZjHKlvh_ z{8QeWWsj1Y<1XLK%~zik1JMi(Wca$U&CacwbQ3ujg#Ozd@L>Me`Fp7N@d}FcA$WnR zSP#?cX>7RX?Quivo=QY_-c!!RSe{$9obG%~lkwFLe@z|EVIks~YH{!0^b8?6PFsyv zMfT;a6kcuT!>NO)*&9hs_fQToZxg8ttTJM!)nn8{%>iG0?#>3q*7bbHcz>J?%#ORe zfmWa4{f0H46r2;%ULWHUg7>|Wf*aEC6!3+rxOank*PAsR*EDX>y&TtdwQ~FZF8)oH zy@hMiNKfUrXRFU#CZbm@Lz}JitNmE=VS~Q;?U(!u3}vu>Po}Keyy*80UdQtqy`?`X zBq#s~m1a`16C@?Q5I%*wwol;FEb$bP=K8i<>RYp61}`}YHQ{cTOWw`h9)B%lN5%6d zN3zzgah`>g4v)}m%Gz2!q6^#Lya8v)FGG^|3JAQ%b!fbOK@pe8JSV5PAh26xWCE-r#@BWSvEuxz^!mEwbGmRmvgwb#5!jdXZ3U0E#Hx*lC@SSP>N8Hl{5j9=K*&(OpACoJ1m39Nli9hU!{wyyot z8I+E`SHSeRl3knzC6(fb#~80xU2KI`?RT$L?g+f$tlHF*(Y$f!oL1`Y66?dmP85}P zDSC~e;yV~XPQ^yjSjNvjShUJtpUc&>co-36zH@>|dzzJ-+DWfTysI}>%=1S{f^Z|$ zJ-@Deor^ho#Ax+`I&?fyc+>XFUTjAm&!SiA`aRQ?0Vbv^U!D&v_%dD*p+woGEs0Ay z1AmnZf*zeU_#?07I>RPH1bLkepeF8|{V>>vF;Xx{ zqLq=3ualU-6N55Y^57MJXq4y>3ORT|1q0oaXS<5o@ct+Vq%&;%NR@xeVyb(g1-^v0 z8)jv9v6=Xwt*9f!OVZe(xX82Y=xg}p+M{~Sr&v}ksRMn2>Ya;s-o3EbuZ%R|es5DXRsVOsWCHIcM}?6n<6OW4X2(R-?-Xy z@7=r9;H0JTgjbRR)j8Xv-!|`y7--J-Z%dYDIj>wEyS!DyF*ZaIGFITaA9UtQ&(})g zyy8C3@s5yo{&Yxbcb%onSM>^zQFz{IIa@tiru1Lqyd-3VL+~6X>lYE2p4wx4ymmGb zE(jU?AZn#@=Yx(S{`OcQEAv<4;>9a(23uZQxV#-l!pn*>_YOYbC&lWz^NCY;8h>_> zK>*%Q??Kr5bFy@jSV`DK;2UHFQ8*@@EY;)A2uE)&rMYIO>kcvZMG<~}EK;pn;_uhg z)tEn9FH0eGM&G#{OCMR>8t6OR)V=Y=@5@uNXVr8xlqI6ypPs!``Wi#|&;9YlTGfNR z+e9B4@xXq}Tac7Yms*QT0rW6rdn0=6`?jnvkqjCB_8s}#mg%aY8D!uR3yyIj=}dh5 zWk8yw%aAg!apJRK`3myp%NW2(Wz5X31Z>TlRC7?0hvKCb{z1^cq?_YuW)h zY5Es$RpM2&xxPmtk_iRMIVfpG6E_ejGsUoy;9KZX=D!eHqxsQxwZrr#c6cdS@oj-Ax?( zxuws=bFE!k6Qr_fQy&r-(dxBNm{^64U@-;7iaD+53~#a4huju;w)}FZ?CZrJFbP0B z5M!pwTCkq&o7+%!S`+2WfQj}OFJ9n|`IWxUeB&W?J>@F#vl}M}#SI}LSb0$J zc5SXkXoT@QympMD)Y9{049?dld++BM{q3z@thM6(`dXt$TIsJJtSv5rJtC)gmnvm} zKy;%TDV*fFrH`z=y9IzAb|c>6WmR$)H?=?@*7B)6l%T+CEvg%fzh)hRP;aT^J*;ul z?0MC2`6=nPZl9NstC}(Syx7@Lwj2;knNYNccp}htu7nO!ym@Y zzU05EBY$`l2R?E;1TODIu9L8^}}y&E+BimhmPBnEyS zcea!wJ#G+7l3IkU4%Vv+@v$xL${i@8ot9lF5tr`U#mxsLiC?CkRZF{uU*WK~>!s+I zpa^moxez#u$k3ting7UyM&S~>r$gn}8Ssd8aQ0Fs>)R{2_6-XyQFxfAv8|aI@ngwl z_BV8vkIWvb>9=hV8xj)}vw4+i>3uuwQ7{z2_dry9A)HU*db`I=hPyCv7dYxXD9>x6AR6bZbSwj!VSDxM#6O0tZa#@FwTCaCDHj9*q0S&;Zr{PVX! z+*n@;4hbW@aiF`is{1u%@mj`wNi1F4kgI5E=1#dpwT1Db(TkmHiybX`%Q1aodjIiw zSN9gtBh88Vc`&riaLUr@9igO6nw;1+WMA*vAb~7CPGGYfw^-#F3-h44ZEe~r%;537 z=%hpUec9DixT9e*(wn@0>bqyNU(XeZhi!@IL**z?8R^wz6t#+d8kjncWCdd1-@f5C zbXWf7sCbXN%jcNP4~;q_OTsUIp+f}PJBSQ z6+PD%^jNvuG9uwd1TLyT_K}I@y+!{|hUpS(A5HZ^cQHp<#RjC&F&T_IO~j~XVZzr- z$ax_%K|~^EBG^1ikNJGLZ=w%%B|T1XZrIZJcnfgN+_D$SEfa%Yj9F#(w~l-c2J-S= z@6YDE>c<+O7dX0Hs z5WZxBsB#Fg%c?Bgg&UJBk&03~GAAra9CbL~9yr-P29MYY^jjMUP~f#)l0);z=AJ_M zaACvLf#l}1vdMc6cTqwXHm>)l?q*;`@b@Q%*##h%zOMfafG{7vauRS3t-W5q2>pY8 zl$0mwxw*cBrXpCq;C!6h`{u|7q&@jVG!c~w9?xzbS34@CuOFKx23CSH29~tufkQZE zc9_mwpWR^B`{D0vypqr{Kg0O&5^8@Q<`I7fvia_yrYhn@=X*6k%4OQsu9G!P8$|71 zKuy}BG!jCHXZjV4neq#DIXqGchi^r*0O$>TR-UoOd7_K-HNkSWu(&Wqajw1s5FYE^ zWciKzZFzB@KYNvy?u3RNny#2p{d%o(9Vort8O>m1n}t*!pbjn|v0>AHV;aU__29|R zW9Bq22K@dsvTm0zlm@n%LI_?n+G#nD`DD$0N7_GFh~bNnb3r-Uf1Ejsr{QYKw#3kY zv;9OI9C1)GVHIj1NY{BvTwKXRK9a7waB~CajJ*JY^tiRCV|7oL+`{Ct!xZIP?c+T? z{Cmty^gvorMgoqQ(S0hg>Bh!y*66;5n?N3_X{?ts>U{RZz}c)-^C`2mS()|oSghwn zb(Z;!sb}wTTwg8KQdQ5ciEaHjwENIbB4%u_K$Zqs7~(GK*^2;iyZ2fUbn~_KTcOhJ z_r$hsGbY>Lnh;M725KFg9952q1IRC1)Y5{3^xwP7otnm!Ljkjv7j3<3Y1=|ZOFJUr z14g_?rFX>@aqQ|KzhO|8N$hxykD(~1@l1UHcJ&*yP7Y93ved}ksqb1?b+qkbck2dZ zH61|ETVw#G0UX)@&4aow0fg)Q|1ey43qbktQV&(>imd%uUid^5W`Dk@!R*3nZgz;d z$g?HY>K%Y}*W_*n+e((;Bx1I2mL;1cxdL6PtEJ0jzLA!@*C$LD4nrU={IWynS_1j8 zd(FZ_^Fy1%FEqD25B4DDNb9H(Ji1BieyJgnI9X zbso_QKn!vg3z@hlC0wK4%TFuv%%4ig;Wp)dujz12T|NF_O7`y1jwZR|tiZOyQl3=2 zS3%WM)L?e)F@fBfV@AHBJ;AknW`4mivz(gOjA+swIs;?_&zL@QIV1}PW+dV{e!k>= zO97M161~LGl;O;=flPyM;{G3^^OC=a&PV!AqjN0Z(=<|5HRU7~0A?#mMbW<2S2som zM(>zSgaOGxvdmR~^nvLL6gXiBo(uPol0Nz`C-2_*2hsQ_Kc4KVm(Avd;9(2KVhA^} zb-W&uj=|N?x?!W~!tFw~H_3U&>tX?AT~M!4c76oB=0g>6rp0xvhZg5oGac~igRnz3 zyI?WFH9Dl%%2GvzapJ3o9yW(vsRcV}a*a2$KxfIMPw2QI0wuXJr>8sr8?P=@dNPM? zg~$?JToPZ6ZCI6fJEgyswE1rN~9+>sk{ zgmx%~r+7IO58!5g#@UjRN6v0;p9Tkw`#odMa7aak!{h%79%Y}I^YinQS72E`y=JgK ze(4CKS!yD|Uyu^z9K-YElyqS2iS+Og+NmBQYqj2AX(=<^3b)~9KiXSmj_$%{KgZad z<_dT(1iycpiG44M8$3c6?9jI?At7z?k&=h>{zwJZ+ig=^Gd}oOr0?1IRhBtwV^ytoZM>)G)%u6~7!o(WPK1qb z&ISu4MVUcUwr}<`2CwewNJyV!;Y>TEISrTS@d`E%$B4Uw*5{0JBA^E6x zeDcu^iLd?%8uMuaHy#$&+OaOEAE8RpNR<1vhwNh?L*8snCw(F}caM@jKO-i(sEPL?=L@G3

      cNE!A%>**xVsXVedYTbOLdGE@E7cSMhFA*nTXX3C*>;{<4iJ=?fFi^%p zp(phK=>hGAl8CBzHU$q+W8`ka3efs>Ir2bX(GxoGQ9W!#MR_48dAfB~1I^x}Sc(;S z(JlrmO&-{i3E`5@L z>3f_h^el12$dk+L%i`$E@%eAtc^(;VrsF~xVpR9v8Qip%y5K2u;pv(NYDgeA_6W5M z`v|GSdA}Xd{-7$AkZ;pr00mKB!@rUho|{v0&)4}1!B;bzRNZ@2;wZj*XaZbOyM1W& zFR$U>iG7GI88ZJ-3yYJSPwpkRr#97NW?}To;wZ_GJ!FnuS-M4;mh0*(Opqmq!mr4BmxZ9oRIgMvT~)U;Fy~8I>e&&aTO$Mu9jSP7Xa_{yAeKgjAF9yg$V3KVN=VV~I&@n@Anq~5iJ-|Z!>ryY2^pZ|R3D|7 ztWRztuQ*}D0-8l#FTx@DZH#_q%CStJfdc(iBq|gOm27CLrtTkcF`75YqW|KV=*>7J z43zuyWPmUqq;L81!|+oE#JvCK^MUWqvS!>7Im+5a!4lz9CcKn({v{B zK9<}f2tje7c3IqB&b4?~TjCw@+3qGx>@8z;B`-F8PhjA^IGm^QP6@`hoUOig%#oId z@y1q>hlT4sMq@C*RiywR%|<|$^c6fk)BYK1+CXC-}M zlZz_d6wgW1--z7YNOufi;Cck@IrUOm4AW+c9DT~VOFK7W2cK}D5y@r$WU*hwW z4@Kt)pEc}b-|3_^4S+FM1_^neG9qU*_}`vLO*6Asqie7n(6Vz?f6(&M6cG4kQY-IM zM>3L9DU!ukLvF6FEy-+Pl-<>nk6YGYx%~Jz#VshclxKXci0%dsz?%zJb1Oo?Yc<>Z zs}k2<yO?QeEWhx zJa_zP;d@7`VXl%mDs}+mPPl@fe42DdcAM`ddr+ltL*|Oje96F`lRB9!ksHCo{Z;J} zVM#``NzaRN?U|>Kk4Ej_?^o#tELYq!ohCQPhcCaXeWK`b2kLij*!TEa;15*Nr_2OP z4N%7woNRJ{wAtDGRSmH}!tEPt}mP4o=3$4c8W0LbDOo2kGb1Tp>YAdxP}G zX#60E*%TyBr|uoz?VcSbv%sG3IC-Jb*KnzEmc#`Gm(W!B$n^Gnvs4mq#qHZtcaB}( zKQlg_%zBR|bl;jzJZfutsQ6j+r~VzO+nu^bUx$$SwIP;uxT@Li&i6JqDMQz$s!+}n zMeSh~0CMEWzzb-m8G<2~hrNe&*|n$`uN7Ror_P2-WJzW%8rzf@n!i3-CJKhzm<6ih z2z2+TgsDWOh=4eSJL>>V6b(|$o4_Fz-mr{43FuS6q?5*(?H#NH9)s6!OAW4f^u`p# zd}ga)Wo6YkvPsEb-p>lDu%p~#bR3}TkkU8$s$$u@;}vr8?0`90_0Mj?KUW=QnyG+k z!QF@6t6@=b1DcFx!M_)=)F_LOy7|$glfF9E4@67N#-j`6+gt*X4QDU{dDcL~^@p7b zL$W|>HS0f1FRr;g^M$i+Ks}_nC79Fmm7DXcz0U2-Zu^n8r?Zw42?jm;qlx3iZynx# z+|P6{yU*p+wzR@l&&xiwF&5O?W?@n@V&x4Fr%JZG)%jzmsH$e2MEauuMZ9fPT-v%Umi*BhqF-2FHTI zD)$v9taU&(E--TIE>qoNuf7uqCWcGD7=Vh3EJ{fk%xqvn7|sv$B^Xo}x+qwEZev+f zNMq`sl1BFX5@DY0@@2Pds~@|3VOfF{+>1FH=7eHis8gt)ILlDSozQ8JWOZ37-;Hvg}obH^ewW;zS zJLj*s`+~}3=)kE3^*1D#f6Vaz0#^_4CMW#-&ot(YpI@8%`0-=FYW>Llp8lGoUsT>t z&SuJq{|_w7Z;t<2B@aX}-Pq4+DKGEIau9YL-aSZ2Nh)z$u*b# zf#QPNBHZ=UBRwcz-&VB}J`7=de4;g2e8BkPU}@w_JNMy+{3t|(qFTas=5zm7-ULI# z?qm6><`2Vfl@#ywUpf9&rZ{i^K(}0dp1_?FVsQ1wNj;bM&9keziJ?sltc6AAmCf@ z5^rkPBqv_-Z_cef6DShA(?a+Jiu(&bBcXU4y1;Z9Q-xIlld=~}@g9#mc+C4!F(a4*U(G&80yl;_O8qOh$ir)T7HJ|F-Fj2 zZ~DIZRFqlShr;#UK=@SLk>ocg{n;Ytk}SZ{PL75Cb8MvH`bE}8M%tX5n*iSR&V2yY zY0NfE1J4davVjFVy%1@tHvtl-V0!MwTpLxXzzy2O;cquB@3$9M-Ljq$ymMQ}!*e$9 zlNzTa1#L$IKyUnd-qjo=ef509^r!9Gz4)EQfTm(3h~mAI;e!n#`Bt1$F_`-QtS*|O z{W7mDFGO2n&Rc;Dta}6b5CmVkK*osy;ef!PzM%^bR?M{Cv!mPxNY%FX{{mQC=ZM%7 zr}#z0{&&*$N2%=pXTtUmj6@1UUk#d{In2-=XJqA0JZGghmC{r z_Qo~$j5Mrvn{4TfPk-iAXZ)lb8uV8l`1M08-j?~>ZWu7EpXWY5`nN+CDY1G#G zwx)V~w3|+|i95=#YlK)y(#r6-d#I1)P?N+cH}}vL%KU(4ixLnN01Sks5a|A9Lh>n# zJ#7S?jBppbAnk%uNd^uj1526$$L8B?c>Bm`&+g*vMvzLIs1oDR+9&P-r{yEt_WlmD zhgh^;Db=ZaA+TO0pDqjqB545|G~K|(bA}xa!9!+UYwiM*Vv>Vl>53|HWZz%$QzQUq zb@~ykbB#O~ZQ8?}ubY9M4Wz)vlx#>nD`FB`QLikqc;};!D2NA}Oo|-8fZw5a_=Q^x z)7X3cZf6ski#(m`gI5zjdW3ns=y%!pG#`=|(@!{1J8nBWAhp~2y{>(51nbjG)gvdk z>005}!>42d&u)1LLYCjwovbJ;WlF{GMS2$9al$@$8$~{}O99aY@SsNO)j?F81kyY2 zK@AWx-Bv3=ufX82@O1)N#rQUz3{h_`0k8{6?4;o2B~akA!}9jn&y0RP0c_IvuSk(s zDMYY^KYUKE|7?Q3B*&(WK108A^~iMiUkS<-4-c=3cLEkw7m#&C;{$|*XQhNr;T=Xa z$VWyTT=`3tcc6S1b-OhYdf z48BM^H5;Dg(Z?7RPP8`@k+E_@Bd`}FICgq9fc@G;un2Ncyx( zkyPG*qUr~G$-#0`&sbntWM32@K{)AuWr)bFhebUo>_iP!|FGhZnJyR>T3A*nj^KSy zY_gk*o`k^^B1EaZb_F#dvbCHV1+}t6&dz<)m(tEARNYAcS~Od{Y7A&b%H;N_8j$qe^_PbK2~2lLlyApHFooFo7C{!iS(dF+{EN1_c4O=jL-eYQ0B+ z?hM`p0wfBNp>=|v_M<@%IE=j{XI&XO@ZHgI{^pvc5n^Q5uGOt;;fbU0MS#~urw-#A zJ>jL!XnCA%o-}~?U(_ei|BA8)Y`|ls3*EOlit6@IZ8LPtEiJSVk1xq zce&yoMHLZ?_fF4igBj|t59WkPLWH5|g@ex0P9SomEPsk%e*2ar%X4)x$5$%|WIbCO z10NlnSCWrp*Z8g@Fh5;b?!@o;RaK9HB1B=pHP>hRAtr$Q>dD%evqSSMG%-#BLIOo@ z3-1%FNmA<9{@eDj|suCCWJs=o2gj%ntnJFX^v()}G8;_uQu3na+jq z0_QkvEdIc3v+aHYM)L}xLdC;xiHV6oiorusG+68d@CppKja zNdMJ}kn7ZdAVFD(xOL{%gpsw?;#0QinAZA*l^`a%(mb!l<)z3YHXPoY{hksKqQda+ znxHOh_&J)fj2zr|>|qU-Hq)iJ12rL!)P(OjVkYb4hgebg2PB1~im(ntXRdV7<0ca+ z-KM0XdK2@A4I2nC>xt8Bxn7qEa8kH14qKM0e`o*}p`PdMKjtC)3=Cxc@G$8P(STkH zvnU1{*M|Ls2c61B#@l|8J@k%fgkWQX5=zV6c12BU1+>pvehAm6ueY%Cw|4Vw=vu23 zFnQ|Px}(e5V->L^FTpnnZXvdAom6IU2iyOo-6IV9JMG?-^uW!F>H-btOB0=1JB)Ju zDEZP3@4j$B;$7p(Y`@5dHmVYKM#&rA1fe^14GpUh%4VnpDky%)5P?x|`ig=E%j=2f zP~c2kea}uxgQ!mS|BAv+`=L+%j|bskISKCTH`QG~LI@X&Nx_0}R;W;X8&JFVs$pM- z*`xT_+C&d~W3}cZZHD3FU3qZy@#1G3(jj;!%7%X#HTx(q`Jb;(5M4isojVOVA@p0` zNml^5-ouCh#F!0ZEOwnfOESN--&@%_Wk~G|BO2LD25G;!R(xO0J20r}rBhXf%l|$g z3fD`882>;rCl`WA!OX3>8y7vz5C|TkTr*M!T_-e(up}H4b{A}*1uGo0O+2r|zK|5W z)!{PEh}QVw#a0mCrhnHQ@vQhW_0y34pXr*z^3S0FHoDLW3_sO(?Q$XmgR~PUZC9l{ zkXGn47`dx3J=QB&@un}D00lM3ft&Vma;pDSnvFjf1-eu#HWJ$;wlB!^+Wi;N0VlHR z*||h4QpcO|p(@7GjoHYZ)UHckY+|s5DN}HMmsT#S$=^`Do`A$rEWZpG zj;q3DNq2+^;inmMAASgP+we)rJz5FF{u5WrMT=}12;rtW{hb%eO*^Y%75DmlXhKV+R`8?CVr%Hz% zbK2bzd#>blxm@?m^k*jik2DnrO20~fS{EQ@hG-gGb~t=YDsO1`yZTDq zXWpV)x?Y#UFmIj9!htj~J94r#I>Q3*H8MG^HwJkGWC3jyf8Badfxz_{)b%?=M_uN*P&WB>J>02QSV*S($n%f=w-ZL zej;^h2HJK0M=+@)curKw4gpnDC4}G!Kofit9hAw4DNy<@Py#D{A6RkAauETN5#2}3 z1z!#-D(qi73%*6d-OFdHVGd2A@hrb&c(bd)c)i2`zzDyjWW*PZy437%x@WDBs?cKB z{GWXgoS{GZAkMQAXKt9vg#!4)Uv@$KTJpc?fB41G{eM9TV&BMY|BVN3O1tDF$L`Mm zDcQaFQeExa*Rj!^2L{ZwE2UJQW7@?Us*`uWRQ`sB@`2M1g}Uz%T)=9I>_P>>5 zwOKTx8f(eUoO=?LK763iCOBiEi$Y4hJ&KCF=WCRt2L_Cmx9ai?sl+D+ ztXOHKY~k*s6-OC`uhsUF*sJvP_rD^QKZ?#>mEmE(yEXP39svropn+aXy^|Q%RiDx) zvf*Kd+Qsi*h+c^=WUw7*`6qdSiV_qtoj4t`8AfgrZZhEC5-ejE?R;wos;tY}k|S>> zcK-mRLPq-ktoBTp|9g-t`MUzt=h5uFFKY;c36(G(Z75rab zhy!)5XGGf+U+cku2?7iZ8F6GAdHMpOi!94sJN-;Cv{EhKqs z1KpUPn~du6tKFQ{v79Bjo;cM{@XJy$gPmh30rP|k=A#t`Gmx?$Z?sIgk6~EE9H@TOlV7jLCIPi_eQPeXG z7UpxWK$^XBPXUvD;{lfiB@b&IV6BHeNbfds%$DX5JfQ1_|8PxiHVRMOd-)DrS!s7E zm<>I`{J(UA`9!?IV8J^#!I_PC389zL(53laIQ8T9#zZJiK zSoim=R^1A@BPYI%gxR*u zvHc0K|0*BtVgnzgo>niOb&`Uy2x({57Iat1fpZ6FU6>uH*Yve!UD(Qa3ZSS@{8Tzt>{A}*Z6r)zt&E(Z_Y<@?_ zuk^Q#w)s&=`NxE%K-sw_0GuMAO%u&&Bn`J0>kf}rN(3e2p(g}_`ijBZUF5||EWJ2E zi;|`&h7=*Kxbm85Gmr6YBa*P*&b`P&zPl&gq7VL5jW$le8x5`YSXb`|F&nt~P10cE z7$&3R(r3oh=yQ`o`ge5q@ETnauZ$_Z8Wv`P%2Aieic(yny4H|PORw8#52;@v64V=%N@1F=zk*eOEB3t5i}#w!5vKtLMx*Yh0tlwFZxFvKMyz`JtG{!xa9=l45I ziq`Epp>Y%1uu&^Io;?=-pwLo9ND;4qNlpxuXka}&8t-{rMK6=G;GKqZ{D{!ncgOM? zw(sW-(Z0VmG`zLbrgP&BVV=}&-EW=_u)(Eh{9hX$W3NUJff5$`3|&Hvz7=cpA~`sl zFCOUUMJC_Psa6L1YqdI jSaE_+ww2MtMfy#+>q!z@jqF)vGSFb#tT7Y;GL^yMU>osSVVb? zg9ebHCuhf*EVz;#vU~V?+x3!bh8T@(X|MG3*cW%kimuB&z%3XU6h2(AWVT`y3Ep~^ z+{1DmGENALQkqP<8)>FehDHfx$N~)wUDC68vTrXi6W@9da`YFfng4=Qk^oMfmtg5p zmPcsYy#XaxYTXgYMl}&be~wPuKq%H)3vk;=iE^X6mQSe{WP1U9f;}17Jv!7u!My1P zu>U$T%mGYs^^H#z6h*47BX@%YDZRzm>uS~G{++a)_e9!$z7ab4*$Y6t)9Ct<1=YX* zCbbrw+G`2LmnkDq_^?IoF-%@# z&gA0)dt8){qDL?s9-H!-7#5{K2K<#kgcg!gKfmY666RWf`pAo1?}jH4!2Tt#KgX_+D|5>L8qulWU=v zN#4z^vhSsvnwV%*MNg@jof(gDHY#X4gf#C#8JhtGUfFIGDR47}^erW{#(TrU{+K&c zY3QK>W&+qQBnhogE_LGLf2nJjpni37dqE~bTlIv=)$&-#F6PJLN-sJuRl`zEN**}z?_Z@Y{&LM3LOcX}@;zj<>q zA}iXWx(ZiF9x;qFykJ}orXPxOSx5+5B$*3R#_Ao=Qm_7FbA~?MGP+pc9RalVL|8nhFea!RjjGmzsc*tkT2HTcFi)3%DG4)1 z?JEkp!jTbW*raV={TyY9Dw&158zeINv5B<3R{qbC4o?Qe%^iGXKMMJT6LQC_FFfPMOj43FX4BQu9n#At;`M;1dS0B=BMc0u>U;Mtxe0mqplAAYh zBaixISK0CUJEZqumZB!{%z!cwu!^4?^Z!i4_4b0D%!N2Wr2j+_=9gT9<@cZ-LVp7V zh#cH7Fr!rorwEq~N{W!!wEw4_AdE#DAG9zTC?*1pGHQe|rmA8=r(4?sDH}k0>;~V4qCfpBN~M1BZ>1D#dqlsQB5Y1fi`VYEpAan$ z1mSKCjA_@e$gE(^8G$uTv1)Tj)1PLwFfdhg@!rWsP7>tnU=`>v_@)7~hW>j_<$O2B zuZd}t3xS(SqK%Gl@rrZ?o?j-hc^5Y7oIaBTR2qrn(`+#!DiTc) zK-KDX5A_|WmZq;)D{2uEN##b<~FwD)(^f!0EL4N2I^D5 zs!;%|Mh?i7o=9LuI|k;0;xqiXaDi)1T^nv90H~&n$wS6=GBTO`j|2RNo)r)uXq}8o z3yeylT)3lviJ){P(AVQS!X@B=WW&GiCmpAF@jSc?(R#mr-6ImA0I(>(BxGOOPWyf_ zj)b0b@v!UfjH#@5VQXIO-N{YXw~>m}h5<%U&`15tQ@VB9H_{P!t&_TxjK?ROml!)t zC#lXwz09zu$7AE;{DR+Ni|M$A47CcrR7T~>Gcn6(O%w(^sP}mPe}A9EpF{*+Xsz`v!XqqG#6lF#);lph0XvOt~@As@~mmVeO3 z5%G*Kk>E*NT3F{fErYTR&}o_zl93V{deL(JR!k>Pvdm0Sw%|N;V&FLLy9AKc(y@PIs@R_drHq5`L zM7q%8w4IWq>#OxfdTb^NPakMdHA4YpoR2l4d3Dod{-5&xJf6z6jr+&fVp-;Srpz-T zgou`TDpLv}LrbZU44GNxjF~BO$WS3u=9v~U5249WNTvpvitmYb*=@D6@8@}bfBf#h z_UnGFmTR5Ybsgt%9>?){e<(H=1^OiZK^qf4_$%7jS0iJLbDFYmDx*y9kaq66WnM6B zEhOSYjy+SiR}iKSZm+e^O`yL@t=ABM@Zc7nGL=z8NgLkak{;W?Xy8=?yeieV&5^TS zo;7h-Yn@Cp0=gP^lf104>ZyW$`0X>dfnw+q%+O$Kr`khOcIKawGV@Bh?~<~It2Hmi zT;F!0fFwyzM3x3TzU=Sx!<#AVwpn-?zKPp`PoafHLkRgEYBF{kG6(*k$R`y=~Mn&bhfu^-D^@Z7**U5gH_Y;pD|vRR+HRDbhf->jexyZyXfT zUuLJ7hQg~G*<7e?dflm`n94M2#4iq^y{1D&i<(6-I&7^R6gl#nzB?20iVUs~*w@1p zvv-XNv9Wi7yfLT{_6K3^?|eZ}iH`k8+Z|C@mWq4b5iHed+M*( zN4~&fudI=5RTYsX+x3GTg9u=1JM3~^z%GA#TTUw$W1j6^$^FAk9RvWUwL_fQMcw%u zMG=uLWVLH5O0uCgb!DnDs#}p2wd<+h`q!v#XzTF>;sTno*Uhy}CESGgc}Q-3XX z|IXZONG=AT@D%#+Qi^0_4!35*{P&x^#V^$Q5jx3~(C8?;EZ!hknf`H;A|<`1RF^X)ce;5u}3k z$dQ~=RyXB|r1is=-lWepWBX%l(x0HBj=sM>50c~U>-`I|s@(vl4*_~{Z%CNFp=RNH zWz^_D;fts`A*)?8MJBED-jPPHl750JZi`Go34C{v=YJhHAjv(Eu&cEewg>N+^0d2!%c-~J zb8jBomL_*Tcez89^)hX)`kcOT-k9`XAvFs}eVlD}a3KN85=T z3jiyZVX-z8&~U5bOS)%>!Q3PIEEH{BCo0BIjf|)-X_i&+pW|^{Vw1bpydTy6k9RQ@ z4R&})CWN??he+?mdvbU5^nC@0;`vr3Y-!)3vJQ99BYAyV)5?Z%9UWwV=?D@H%D0kV@G>X{!I&#*}9^QTPj-*)}5Bh#SkYaW)$AoYn@)EQx-n%`97> zrGH~rF*=~lqqusdPIJ`rX4lS{^?R38RaGABzYDCI$RUreJIKAq<-h6jzdt_Pvj`aN z#k;zBKJ1nFs@L6jt^WU&w2z!}goLc_n}~dS>T3_)EbDXppxPSA!_LlxnG4VtkRJ#| zlHbfzZGAjpLFVPRk1sn$FxRSHxdyP*)SK#uraW(CE=*M1tXYn#NqRDZOSO%ny;k!p z6m7cFPCB?H|BhZT{Y(D+1#%C1?|}Rwr|-D=#OLTQmf2YMeMb zc$DnDr>Av!>G|cGS4yu-pORc$!JnfXFqTi3<}Ux=Q&ddoaNXczT*wnq}4^3S!r&F@x(QEt>BP({mbfZuCw@)-xO8=wZ*( z?!|lQoA@>FML~3j_p)`>Ez2Oc-MRbRt!Z1a;6}C`LMRe%oYRr1Rmq1foXw7zb$|*L zgsC?vH3JKJn}Ej~c(t|xn^&*Eqplx99v zr|vHB^HV}aNQ{zN{-um$yc=2W`K|KW%DiYGvf7h;`qz*V0v& zGtQV_Yh2}Qzb73Sy0&qZ6dd8_8r=PednuyTB zUO4GlD+_X9t9C*O=@_5JEJ2_3q|%waEU@vZ!?6u_ZQ4Vm-}X=(?2&>|P9&(-Y|NO9$xVnWImmu~=w)3B3_<+N!f;1H zM@g5ku7N!29A*N(#S?leI^Pgf^&+fR7+{?LWqRZFaZpGdUEh4MSqmzOTPTC@nyjlE zB!7h=O>zdR?$a3xW(mv^=i>xmule)ZlUlJvOs@GWR47_~XdwTyO6eBq;fL}+ zCb}PJ5M40_$YH#+mx|24F1+D8Mb}=8A_dPr-Su-v{K5+7g+SlJA{8_ArqQ77Jlu&3 zm8M;!vaED*29uSLo!RJOM)UBk*;zVxlR^$*L2$bkV=}V|b$2~2)#Z=+G|=#`FL62g z)RQi|ve_=S+VU0tCEA+!R#X7!gZg!b_f)gQpArZlsoRd zeSw$oHsvch+iwgNzD5>S!BKS{w@YrhmYU~GYz&SR6ocG!osO8708k-84fcEeLgg*t z{|$)Q_nrD*U@<>3l79o2{Ya2nC~4`b+yO~`^IHF^LSmcj%B@Skbck5}Fqpm5oBHvm z+yE7SbGhR!)J`z8#7=CK?$B~Fs7q| zY;B0N`F}diq7*~8)9d=4sx;@bOmuxp7=CNOaj5S=j@sR^{0AAv8jv%NrKvJh&osG= zr|lEH3n7}GYX`9xFrHnNqB>5hbcs5nvg^E7BEXja6EWZ}_$w0Q`n^J^09V?FUDMBc zBX7&SBYo5B@2HQ;R;dw2lNuU?V`UX!`Iu0Lf|?}*xz)@GD}+_xyTCG*l=xhk$>gRw zH04dR#(j^fENoIS@9cd)MnR|V3n;)p#U~RYn)PeV6A+9EwtcK5S2zhftlo3dBBR|+ zu=``nl5tp5Eb#F;{F4X6SQh`uN&nqwipnCss?+YQJG>`4Y^47a!^0RNn#AIx57swH zJ*K62rM&E{{BV+pUbA6x37HhfNDgJTsXQEWyqk2Xrs|s7sW)ReR#%%v2Mya@mlUlV zGmi{R=~}N;WsLibjlKD@$qo8bKMqq~r7p%uMAoSZJmpehZtle1us$n75(MCfQ+i3a z>f!uxu>SkEhTOI9zk7EXM={EbkI{0JM2Y}`P3C&w4xGtB>0q4@aqE;e%GC@OGI17J zU}USS03QKtH3O*(!9Oe1et#&jMrN)>9L}e)b4S>!FXl7c|GK(S8+ah-GQN;^^A)Tb z5@SCbDN;o+q`1~6Zpg{4zPpsmv%ZaG^xBk?-r=PDc%QjfGqy1afXBlAvu6Zh_)dT8 z#|ZG2r3}L4mgp`XV*%1prZsQZLGjK1D0JPsC-visf8UMzal^OEyMoA(f3i|!G=wk~ zcfD}iMmeD4^jp*c>mnAr{H}RyO2%MmwZm^*D~MENc^dSCnw^w(6^Y=nU}< zviQB~5Sa@BnRqn@W}Cp&q`+bgF95d~FLHx%^gmC+b1lR1Rfl%JTp;-_ed?)fqG2RN zNKMk8lH&H|mPa{VZ4Jysx8{?t@imMUJ^~EM66i^Y;)v1Nm~`Zgy?X5Xk}asJqP~@A zHDQZaS~N{l=?BPl@H9KTM5$pPRNz7InG>9mqzB7{Pcw+OX$YB&m5%f7n?B&a`3UFd z;EBkW;uq4y7&^k5H2jfC_zB`(v*UBPm=f0 z9$z)I=a9UKpql-_jaujR*o}VD{L89g;r&ik^~d|Gf-4BBUw8PtewV?0kB|Q^>I*=z z`L6~yW5$|ac1xMIBc_GWp`SQU3pmT(&J3zRhBwNvzb+AxcVhXmUJ z=Z{qN&L{VXHQ{dhrpnq+)fx|iV%b%CuZTl5gyBZgq|ErK(#Y4zAF#M+LTA_DnsgUox}y=nvb#PDCb+MNDY8`zZ}<%1C(RqQ-UDyVz*=qL*&p@*gye1QA| zH&zUX#b|aFOnpk4Amv8-ttU$5)c^H}54!X}UWKhfIZ`B=2;`z50&rp7$Gk)Z%r;K@ zJy%Fj#|G6B%^=T}+n4s?&h?dT1*>^-T{K|9yb@z~@|n>Tztt!&vo7!w@}3Jm-fBVx zMkL?C=Y8PMfPQIM|2^h^(_n$|E_e`RtN#<}%+HsNS#s@$OBhmZBYpLnd*79R1c-rw$RZ+`&e!*2Sg zkgsM6MA^?NH}(=aF#b}EwUPS`4f-SYa|dpBD##qZyncF5wv+kw2fu7_yzJ0>r;ecf zzpw{?#L6wu)W{{yE;@ksb?T7N3R$5r{Us5wN&JUl#yte0-Dhfp2&To}N%3V9BYT+g z<6Zp2shnt3mT*5!ktW&@dKHz4$ee%4;?shCjQ1#QotLtY?HLxlu{OiWn|K!?Wfj{r?^ zA2+jb0(Zp`cJ_g-O{MM*k%H36y0z-=C<1z&%cEH(DS41-`F?B~-w+)+&5MPQJZ99D z2&g2j*KGRpL;J#ae$V(ZygolfLp1Ff3<37eP4gLUXQTq0lGnoK1uBImc0|1C4aSI$ z9Ay3&h+hM^pk+=)tH$w1P4XXSHiW^~LqeK*Hdvr?33;etBu$7+j!sVPdk?JAT?@QO zE#iW3c}RiIL;|UYgfI|N*^f%My&&6#TmD^=ro!jmz44XkGLHUZBoQ8I|AE0U+qmB$ zI)6OD?Ld}xk!(=CB~?TQHfv}M(Q zLtWlg4C5Bki65Z$9zKkow>&!k&OpqK9|Bq!6Q_R?#q#vz(V#~ z%J~0MOA`>4ok${n$N z%F##KynvKl`%;^Kcp}c`^NFouwcsl?8PyTM@l#zmBz=P4KWO*~0}3^guj^WgIXE zu<-{-rf-b_o35=o{(J6(?3+d`TdfsS{^(;M(8#;*S?L z+}1Og03|9Fijs1uwr8)`m5)Ivj(%~#_3F#Pd`hl!mt^{cBD=vpo7*wb%3yq-w~Y*E zSEnF*_S;nU^2(l7tKSVOevil7?cu#g6u%z;V*W=<)V;j^el@)#>I<{kjdK6>K@zkw z{_5$*g0XusSC<5%a9kdCoDbuG(16|3I{7{OOGPP&GF`--5O3X0%7 zzcR;$sIg)rQ1G{1_q7ug|zB#U}vWHpxhAdtZxe8;aDX9+|S;ZI?E(^8KV#_cE9aW&O^VKC5rh5QHup- z#h|Anby?7i`noee99AleE%lb-K%qV|NuCNp)%bq9xc0|q&~F`Xq3<2;0${efgXL$B zdKvVlDqSWw=L1SM>NO^r)5sfdOe^%!Wf^@0r|eP>^aZ*z{Pn4XTtYgS6+gEiT?|e^ zx7OwJA{G4l-Jw_TYq$)YUOQ)*?x}zM57c<3I54EBX}nsD^3nmeK$`S*>h8)LtvL9t zZfEBYRmat#yJ#TrG;I_;N+2j%1joRMsI--&*W2!`tl$SU-v2T)wAEI7FO~RLkN33@ z`yKUb)zp&*L-BFWI2LF|MBI)=wP6?>t{>&&UabmNZI(DrXhfl#L5GvxQ{qHqYX&tH9F?6UY6rBE+0*f4{#MC9GKa#_o>)cFX0WgrQ`GMZ$g72-{*617j zESYK$vM^}o;`z9DKF(OlpkCmB$;67;4&Z(2V=~z%ORyyDj<7OI-V~UENE&<7^^PN7 znxPSYCVfSk%ix0Cb!)*tNm+hh@PTy}A7w(RfVn`7Vp_!;%RqBm(wB8NwU3%d2tuT# zA!5T~95#nix*KfE`0Rj%H7dWE3f0-4qL;BD81ygf&cc#Z-}>#Pg|0K?{?&%fjQ-~U zdGKEm`Dxj=hzz>hi!}jL-$?n}1^V9=_qKl44+{KtGxH}!tJ-zy=-IVx8w=i=fY;x? zcn@jozMS*^f2a9ln^kD37qLjBHdd^G3F3I(EDJC>LqGYl(x2wTqZ=2n)=E!Z;ndrg zB~<@11ou2id|mpr%`vqIsDehQ z%Chu8+(;vW9}DF^xpgA-JwYKQr_HX&1oGjD$K{xJ-e0_sFV)B5v(I{8p1>AWvrQ1_ z8cEU!pAyz(FVvHaFbT>iPDrztvB=fvhOj>$h|fC=^Z}nDPcuE{#7|9zjUY36VU_lH zg!75XK!|%=Kl{E{68v!i$YKlZqd9ShxJ_>L=3h>~GMpIsQ3+cJgTdFex5!qLLa37i1L?F)$<9k$MpC#As&QvR%UVUj?wNxoWp^u9TMv43|@dE&^`w z8Uq_M0S397$h;(z0rw?)yw}wbm7-Q*z8qd$rdWJhFNd>h@*@s2BKJ7x23PHFBDz!M z2;g2?VNCV<+CDvso?nn(FIY-B$MHafv=dT!M^ss!vS4yX`qi=9;L(YzHrnPebGDW= zR|!AXO61~PVE&_x;8(gxZN9A(2-QCvM3B%%c8jJb`4M_ltxg%^gcX^th@L<04DsY? z{R3Eo>U1H3S2YNDv%J(!i2)@dkuqbI@Wpw>Zt(aX_4{1)@o_nl^ELZx<`9*0sr82+ zM&Nm|PA-FVADqYj#lH1J%6&er@A{?wWmFGenWxuTEG=X>{F$#ODJw2#iHf+2zP@BR zF}|=vs;IiDR#u<0YJueG*v^vcy+@$eGZnmfd*l1>;`iwE)M*OdCB93M^h}(GQ^PJi z2|CibI>9#_Fj}5QPaJ&sl3DM;12Lp6d3|49Isd3&u`|`*zdQ=AOT&vMv;W4CR&u=_ z_6#=|?{t+S4zoT}9!-!Rc_mFO(ZfR9i;0~qgk_wByjigHQ>D%a5LpF&5`sD!B-3(9 zFRb}9F-lNlF_+5d6%uS?$9K=Lk3##Wgfh0@h(-WT*JwD>SiyM*K)X^E& z(r&)81z;KVf6~(sI0$T&8vfNg;0Hb9m-_TA*MRRI+hS~eFnCbd`C(laKV?z4??T@* zvtRfV8o_tdXPVOoteUvJ;ya2Y2Y1=LUk-3;#BdanVwMT+NDtj*- z5}H@qpBB@Y68<-sM-4TtcGfCxfSW1yY09S6k5lFmG6K*vQMihuO0@uCRyuu%Ju?^q z?8jatr|_u8@sj&sSOKH=N+gzm6bct&*2=-i!xyNSSrG|y$5iUl5RF1Fy7n9e`n4(R zx}GWIZ@;ql=vLTZ`g&J1I%X*WD~9oExJjR*W%{9D0{d7$3|K;(fT)swG6_n5iK7!pyXm}gv4zHapDSY5u!J15s|m7FZHMgFS1`TiizGqdZgPkh z&YCtdqvfPr;blyr6W6T;+2#s!A>qh81_;r$w7M+051F>{_h`TWP7*-Adtoq0KV_m#tQ39B>BnzZoTK9*T0C`G7)5pp zd+-88h2s#XlkPd3iSBqG67Yj2%wh%fc%6 zJA*%&-Bcw6%$-|Ed*bfcI7IJm@qFPYS&Ktg&K5xF>~FL%w+7H;RX+JxtJdp&D4Tfn zJs=iE&~@5@Fsvg1(d+hF7c9`kzReJ-nAFPu4nEtqfkfh`_ANN>9#Q&crj4~i;PbZ^ zlRGJ$c%)VUXUq~{Y7ZmN4@Z**lke46Bia3g*ltqN4vg29`ePpwx*yvWvRhieJ088+ z;1YVhK;5uuk;mdJ{k1uV_{;JOF0U=>-~8k+2LjeA#9!@Dq*Ze{K>6|!G(v4jx$#v{ zHOaJ%&AeJ!&uHnZ(TYJ(5jKw#)zG2*=)v34o4SS?i|9F*fiCE9OB0yEfdjtZpM&^s zekZtP=!62^j4UPmUE)0&IhWP1NKxERl={z~&)NB9cJzH@@wvjvBhED`w4!b)Y+P0J z3h?k`Du7S@pBA18^L7!QF|5uOpu@*6Vt($wHQwq~j8?+mT(8{>PU%-VbBHD}7aDmQ zW6u6@zuUBec}Dt&O!IyjmSBPk7@dgo&_lJxHvOIh8GdW%R+G4J#YA*6#(@~!DQAql zN7zKgA*%{tIqYaHI)}c<=J`C1%z0f@{z)Db2zF&7qph@W9efb zCpj7pS~8t(M$!uYTvFGrOrj+FGILH|#}juxX@$CH5;tOjM)wUY0PFWdCSn)&B`N!f z=qSRTDRN&-J=I3MO#*uk34q)#KF1_?(a0r@!wzRn!%g+V^IZAcd&RCy`T`_`+}w)F#$$qgOc-QqrTxCVx!2 zKFR7jfihG^?i?Neq9yg^i(z{rw_W!@ZqHl(jNDE=$=zf2_ACw#r3wWFsf4_u_nVV5 zQPC38e$mM-5#DjPn+{l-x;K~G-w5XDuDelM2Ch{5t3I}N} zHR+3ZKi~`zp`C|V7O|KV=f$-YZiwO7-(XU^{PIpbDoJ9(wony8PaZ{xVKrZ>DQWkg zK$Dbe#d;M~&>5VguX()2>@uZ?*}^;7@kgc=F+zIu4(24y9AYCM(&-D-xz@rlW$_UO zIi-LNY$J<1W2`Q`y!Y`fD&P8DYkKS3;R^~+t^kCQ;ME&WZr58~l5Xefv#Btvr0Goa00EFhr(Kxe?XRX>THlpjXm=n$wARcK7!4$t%!L ziMl?t1pMYP1>9m1CK&y(m~GDE6c-OhECN~%yKufXI)I7Je*J3jUz&#FBoR| z@d?y8Z0%ISEDa;!iFj5>20ng?@MFLYk4^XuYgd04>QaWg=T3?`lLvt1Dc{2>7057P zb3joNSxLa~NA7!Twt*0FRbnwJ#KHy}F|Jx*BCOp^n`Qga4`qJVBpIewCNjcj(SENz z`2hcL{ZU@Qd{PqYbLVD4U9oG(w`g$oz> z?TKG9B$R%xX8nR6PJveqw^9wN652%Z8|D5oi^W8C6$=yV=p%>js|bj*ye?a}(m4vbG~p!W z7ba zs7%4!dcO~*Qu*NI9d!lF5jVWIVkPAnOx>Zx*9?+*o9ROV)@dl`P=qjBHfPB-2_yUh zQj-G=ZD){Z(UX``&dD^PkH?7a0$Pm2xi24A@7&8=YFx^9G+bRG_OOxor4*vF2DT?E z21EY@E?avBIhhvK1qg0{WqN%>NXm1sCOy$f1qMHpJ`|09kjS&1sJSu{Bb`_xvaEwy zHi16Z%3u*Mdh?zbBg0ASlqYOpIP*UK#R)$9g+XZj%~;)L7byq_d6+$1TXhOcqGRNV z%M(x`0TjsBv6~gg1$5;2GS*NE2d`I4Z z3Em@nn43NLr@2|%^&>mxW@KNy$r!fEV1x!FrIOy76~fb7_fNmed&f>o)<1(HLfXQU zG_@lmNrwtehw)*SPbiz7b_&b;BqioONie2<88bvfH~RC5AOehuQ`m{J&0d6WOA-}< zU1rzgLF{lp$#~QsHjr!Ch(Y_oJ4A747fl9sIi5^8;RKoHwZRJsHnP^4wsOf}VGv?x ztgV$bVX4H#!O|J?5Fb0j`ibt*{_BT?x^GFK)7W}hLt6P$kDruV!!Tis>xr5QES;4b zwLMmdyMJWZ4_XM$r)ygrLO#GD?3TmAIEx=#Qe+bWb%Ny*SSpurC>PX5Sxgr= zMabB(I(3RS3kBZlE0p3cGj}nz3xc|u!om&AYEV@W;aOqMmdq>Z$ zQ}k1P9F$Nb-8EqIuYTspKn3_(J2t%HjSAF>$iW`Jo(8H{dHb2!CG}= z^`-=5B;?wBwRS7s2SWBa|fBWm5kc_~qIjiH+mxIva{6f#X0DF2&u z%{GNEzlKEgl}{BE6vD>3yzl!ejLSq^TO6%_QX4vxC&9an|NE)wcBY-FY23{ZGmJ8; z3@!ACB1B|0AC7|_8vtX|Hzg>c9!QHXe4Zge5#``#=vN85Tft3lMXzJ;UkoyAaIQ!L zQWNlbYgLf!_zjFyf$TFMRV8a1d{QMwyH;Ovm6CAr39VKf((g$1V+f!4!SJLm+s_%xv0lw7sa(mxOZ=aKURL~dBLwD%@hHhu{Q?@x`~;&dRHF z?k&a!{>IKXjs)|T>;HpJwHj{Y&- zY-D+}159lfR#shzV{#{M?dU=Z;LB3LI4bo?MhcXH5i5>pH2sWvC5gvuWGwmeIixcF zW&8>%4_os_bRXD8_(TrpiAI~?{8229eDUT;C2U*341UvK5mTaR1hD?gCbQ8Q#2bn+ zudk-26}&qcp~#@{tT4!Pw)G&Ot1!=CuGre1C~nPOk>6#s!5SgG<5I3IwIia7TzYdP z7`EW*w7p<7g-pKR77S$TzvZHt>YXc6*lvV_cifj5UzUanVAzAO_ik>p5wu?^MF%Ya z!%py$Ft>Ua_yId4|8c1QbZBegOw((N>;=5E9-IFI>3zfB{mOks>7am8x!ab~?^y@Z z_*IAd)l!8I&pav*TMvI>i|)bU!ucDJ?a*GHW$`O)tZ0A=-MZFhAC?J|wbLAfVf0@* zUNL)}%e*ciAmO#X7J3J`Zj4%Y{>p=>XvWc0wR@ zLd4LEL_iN2u5KXtRyrKH(SdOp%SES7`=kQy^;13@%Z?;EsgMIPKtqbW$V#kc#Q<|J zlM!dssY5HkQ&)@p@)gdTbr$1i6C0F$s4MQdrNPFU8WE@ycvu%{q8jUvC*16-7;9&6 z0Tj}pmBafmBtBr_2lWnA6bC5a9fx=#eG04awmV)anyPDoM%u&nahnvhf|28QIvg;= zw6Rgp;V{v5VF{pDjyB5*WgD_*8L^L^5*C=gN^bip>#T3Sf^Zh#BQ|y4RfF(bn~ZfH z!$3v&XZB1Uyrq~P&nGnX#tT$x3KEKn0_7O5M-LKVs+ig=n1D^nJVwTPOeel$8M391-cDinAoNM^4y=ZS!nM}roTghZ% zI7HDM9p-`iE+Vl5J7VvG4pLtb)3KQiY68Z-O{#cN@B{qDu_Cyfu@-iLIwsdUAjrFk zSmdWBCs@jYdyI2Av}jz;a@DV03b*ZC#3AUQ8V&d5=n}>r^g0S8K-!tUWfBYH6z^Ui zH7RaJezR>8?uZk!zLb0HSjpUjp_bcMobz9zt;&k;u6=1EOo`KR6FipacacVZ8)Vt< z=+|vgW_F4BYa;cH3LVv6onDVpu#;%|@IhQO6yQW!K4aE2gfA?(iVxp^z?lmA!*+|5 zfeLvFi%*~uXgk~|Uil3#)9Nomiw_gg<&=r5GD=@@-ZE65o<(W``MZ8<>dEWQcXY0yM0vkfeWjIzDzs$ z!iJIn!}7Y|)f2J2Ac|4FIQEnE@K#|*euovjz3P#Xav;?KsNn5SpI{qzT|Q{^aHcLS zsL{tqtNr%r?HvBwJNK>0Q21_g7e8~DgSQ7qg=FU@+Ge5u*LKD3-pF=~;-^ul{dbg! zgF<{Z-Cftmzm(UBxdjBwlrNBFUL9naAQL~noH@y{XNhOq&gr`y%T|uPvEFvd;P68c z(xnnKin=rZX~qI^W(6~O85(^cF*4{p-DmY+f}8OtuLeh)XsHzVTH~tGm)pR5lk$_! zfTx&Cd)y<%-SFd>XntTgre zuK2{4Lr(J~CjL#IqG@{sRh{DSt>YaEWDL(XV_Sba^?tlnCT8OhRX>>QbkJK>1YT{?}wToxU=~(rxC!- zomOS#t$guYuC9ycx?i24>9KI5I@qisA%9+#)hJqGg3|$FyCEJiLJ(F+IuY(uXg}K5 zlPc=*f%~~SW3h`F9SxMwP|Jlv9cUu|;ZFRUCW!leLDb*6pdN?LAQ4}bKQEHsQF93~ z;;wtHLw+P!apYUJrju#JB*9hfO&q^;SD8~Fi zL6{)v`#_jE|Hi3oA3h-(hEog*K9~wr;kPYZo-`W~;qG6HzUoLrwz~z1VWfte5G{rq zhr#FDeGG?<_b>_;d4EKQ_WU>ngBKw8a?s3Z5PoUWnh8niS6?plXcWqy|3G;O20Re5 zhRvu0*pNtL$bzb4cd7cy!j*a4qkN1p=CF}L)At6%wxJVM}u(MomsM@fVnTBQCcq*YGD((zlydLK23N}r`3F;o;RK$GHpjt1ji4CEPkpx4WfJ^A(2=&CR6AE`yxH-2jS zb{~mj!Q{aSMUt}5AqQX?(H6>BSbVF3g@WlFQ+GNV?_e&cU7IE`3L`#TAf6eQf1{{- zvPh85fkTp(R;Z0UN4T<)$lH&jF-%azPQ>W|3jXMtLa{m9!*>U;6|=HT8^3}3HeV%< zhjpxDe=x4B$eWML%00_y=vkaS`*pgzV4&4=H=q-bZ6FiP^rBhg%JCQac!#bO=$t}X zXFTuc=vHdu89~Nzj`QiQ1X&cdbv{e+O3J@Mbj-W|l86PY?pz&KVJc@xKhVMR*i(#h zr8L(S0^=R0k!kLW>TyNadu=ojHR#rW*nb(k-F-2ts!zZGObnBZ3iG{3>v6ldeM)}s zw^<)Qo5+A>vi`)1+vebFY4&(fFZgM%p=0`c=nt7i)KZNZ&p%)I=}_`-9y0$225tY| z0QcqSi~PwWIm`yYP1knuA^)ug^h1!sKtYQ=^)lu*uBXH~eKPfxchXkI$0Y=&3oJK; zXL`3rnO2wP@qe|4+=A7l`hvOg@4c)-V7C?%^D5Sgm*e%*3m4Vng9*gZ8*K{|j^-~} zCOo*aj@9qOr|V}MRK7FFAzv!1oV(rUrwoo6_OP7S-=3Iy-!?K>)gcv{a*iP-zWBZ! z+xX_jb6cy&^Ndd|=iKgIAAL_f!kb%rL(yGl_-9%Y6|WFeRBxDQE?&04oUF{-I2=Q( zaKZCpN3xyn(WYWxjRNbJ;?_<@hS-r~IBPaOHXC@DeW`LHjJIj%-?$CoWJ`xrg`B9V zv&P5Jh?j)Sj#CsyML0qg?^?Ih>@_mGFKvBHG~SjEC<+-VI>Ff#2{t3ud_dM{;x8$; zuG5-<2r@nEx!VajsGMxd%=%U&>4xaRH>=`aNo#^M*sPkKw*?2t3+yy*3zziimL6{n zPi|;9IEqE=O*9)_#X=t^wf~^L7hr^(npY?_hwbAE?i{k&oDjaV`DBC5=aa;dcyOd( zVPCPkDb>yNCRXSw=0Qu$J6VauuY81CFi# z;G^z~MUr}xdo20`w`nHQltbl0J-oYr3ljx48SY+~+L4oRr5s@oZOIqyYkpX|m}E59 zZU{UkXVu%dipc|4)ipthF-m9;8MWx-hYG%w22;XP6^s zjMNUcYIVX%Yno8@16Bm@bgtZvDfwtD$S4uVsaU6+g>JIx_#o<%H zZ;Fxaj~V$t-sx^7uvg^bK143DKZyAdD3|d@+YzcJ5W@G_;$ykR$AalPcZ&lO@^KS# z1bjM&#m6wPSQihNAQ?@wh#)?TZbPJXHJ~BT9mN?UO5C6erSV!rlgCNzlMjF;F|CaZ zKQ;km!t;EmQ%aoESbRo&DI8Fu!*2rFy4)0s%ah|D9rwD_&5U@O8Tg+27%c=yhs|$S z^4Dbod3G6Qc&Aw$_7n?dDkf2@-XY!H!%@HC3~*P2?t-zp&C&!mm(Yo91|haRqx;Wr z6%b1TnasYpDd6(;wLIRmzPdn5zurDV96QU;HN5mUHqtff#jEE~XK2Xegih`r3Cs8t zDNVw+WyhpNkq;(UGp-OR=;M_|-5)G$ArTY)UYGhd>Lju|IohdT{lD;orQAAz*e$4b z_#Qv$k{)mr)IPi_kN(PAWYE^b$WU4H6{T$YSeuzbi~nYg?u#=g5;qs{8-<#lviQ_M zlSXef;;$x62Qhw|N8+em`|M(;=6Q_t(Fr2Os~QJZ%N)L{UDS>HbX?2nVd3X@5fSkY zPdvZ3;de+9WUDSjh^ynHarS(3_wv2~1bRck_1?a8P_2RjN+8zT3xHvl{b!Dhe{+ci zmkr0mxTHjX8q2ef{W2EW)jZK`u6pas-J2eq9F$xTCG!X`(cxiqqjmze45KwkX>a`* zGGGqHgs(xoh$Bv#)hNpvJ^`aX-Ny2ZLXj@#uNKfinOwSvI44Lp z>z`Xvu@p)53}F5)+@zd-3)bdSGLrsyTA86i>d9QugGsN8{OapY4z-_jl2_N-x!cfHK1|5N8 zqlKZj=8^O7a4pUZcDgMNm`5-_L&23WuQL!5+A6gk0Kb?Q*dhO$he@H=j~^Or1b9>Y z6bEBqbJ{Tw3+gf|TERlge`fGD`UsOad>oM>R)S`!p3!>({n&Psw|Hr{erbD0TH4Uv z2G$6psiy-;2GvE*3f2?t><9Ts=Ngs~L+F!dDQR*rW4ftGzw3t$MzEeMQPH9dIVP*a%^E?4=uSeGdWjU-(G}!T zo{*cR)QmK3Gr|Nv27|OERJR=gfO;2vHc;Mep(dU8%)ue8Yfd(Tm-UN+zW?fPEznpa zvBy6GYnSNvobmrbnP#_3-H%Q_HYRaq=b*Oxvh-GjAE6Cz8~e$?NYcTB zS?Y9_`irou19o@otsQUbqxAD6x!)_sa?Yu)b~#Z5ulfXd=+(HiC!JKXPI4_Sn(DKg z5?&nAYSqW#r0S%We}Wsuqt{deoU{_=UR^7- zUtQINR+z^l^#sSV;}Lq1X|2;4ltInQ$B#aAfBe>sIVJu;=U1V^jnE`vhL@twt#6+t z5ZT}VVq+s1S3E$MLak~6{uoK9$*wu{RkG#_)z?o{$M08P==Wa(9J)@{2eP36_T( z91F}9X&pgo4`a~vF ze<^+Jm@V_eFm3ea#!}eCP5w=@HgEUk`^W5_`BcvtEi5fxbgEscKKF5sdG1BCoQOA} z?33Q{RSK8`X4%e)1+DljQQW!VM0d1ejcwAiw)yB&Z9ux=(p+Af!_9P1vdOc z`lGSt+C== zy4dRS<5pK!^;bfUY6er1KA6KV1(F4#Q$Np-bJCf@nJ-*=cq%n;RVAAYt*KHhU!i@& zP5YF>YfY*F3dZ^YEeK<7K9i4)4c%cZKf|-;+9-_Eqy7mJVWmL zu2zm}UBjolj1yl~OiYBXD=8|9x^GyWdUw%LY~iY*LvGr7Q%8|li9=0{WZdej2A3L5 z?~%&j6boNk-}uaCbuW%d&NNjf750<8Z5gCX4ZO`UGxylf++!-gTU!74q|gxQMy5kZ z18tA$!GVTWXYC$Uko;LYepwhT(sARr3F;)uynY4xB;=m_L&IJQ^+nMv&oE>Y~4#WP2 z^KRow>>C2n{V%DHx?a_vxwOFl@(vh?G>eU`Nb#0<3E@9{9QU*~nec|m3oIU-v^y^` zad=RqE{eg{>=v1b%S=Jj@j7ic5~wU?{0ACvJ@K*#GId!pCL_I{BiUxM&gR3xy||$|YnW>3)pTcaomYVz4@huqSdgs%K);$hVN1^w>ewvnY+~ z`ysKQ9jDeNsRiAe4ej(0rmsT8@v?2VQxe6I}svPuUwKCBWt*8*$ z!<$cThlU0_b{W`R_#E~4u7jtY?o?;Og{tA_YpR~F5aZEO4&|B!%bxdF9bYWZj|5RC2?S7WJ&zckPo#IM@d7$;4%phcJ*JSfl)VJjJ=kZu68RKG3SGP0kN!0?u~`jeHF_m&Q*MEc}vfr|3TYx)1-IS&&7y~dG@V%tHtCLYT78@}^1Q0&szg5@_mujO$HT7m ztAY+ynlm+y)SEpxoH&Qof|D>#KGBekk&i$wF1uE7EY*6m(+-SIWl-X+K2CA@*dl4{ zR{Zr%(ZzN0drC7-Y5ndC{2S?{>fkw}lEk_lpW@4NYehv-cQyY~o}^X*TRL4;Qt{Z> zD;HN_y7u*U|5xo-_?b1XjyY-~7`VGG){}!4C)Sk4-;_r2!HRGz*VF<3Yf_^ss;cC- zl}q*64=Xi(wk8QyRN!kByo_Mu?BJ&e#kEQVdxV|{kC}?U7N)nvr8oiOjnAXQ#{T^5 zOCzKkevvO;8hMBM2W;Ijj(c=}{cAza2Tn8nT^e8QbQ@=lHdj5w9}a{S2t->h&jT;G zV^|;{9o8TC>w9IzFHvu}ju|t~CRCO!UnN}EJ+?8B*-ly=HDbGB=r?_wV0J$~T8 z6LzbTmMK57k(Wltr>aSUup3|y6~}F7jQt(VE}`; zn1BEN!cd_?yww#oF8dv7&-%lnmOm%fn9s+Sb~?hb3n^*3s8uz=Mo%6pxV6#8-@nX9N6CGO&9fjG zgG}w#V_snb)%$1caf;Yz1+}xZs17Od9)!RtB->bKY*G{B>}xDD@`_m7EMu0+bWRB6 zl`{<8VkwZ!QoM!56i5^zAxSFvRONi}f7(%M6&BsnU?q;!$9r&ux8A+h+?G39q|*~l zD)8c1mk?cxT%7X3tM7XhAsQ?1Fi3LLFNuz#BQ;F)5R4Sr(-yL{Sk(FnsZV`4ILHxq z)en^&Gj*}C3{|W)(PxvdX9tpE9j`7%Cr<)G2+zQT)I&#*)BYi`$!zjnW; zq3%9AnxW5F!uKM)JxQagsAf*yN%q z^SROyGUlCH*K@*=XdL-m?j-o9i_mjGxlcVR+4Lko=W~v4e%`)0ZmCwUrrP z2fVy+KX0BgRA2%(k2bX1`^U}01vhUV!+hYf5!HAvJ;9yf>@#khK2(sycXh6GaE$x+ zuwj{sMty)8p4O&SxWHB@n3{kjq>(uQX`62F9%{~}p1q(P5w)bkOYyPm{_s$l({k03 zix-YNTb^AOb99)my3~@;@gV=xG9jD#@ToX__FbFQi8Dv2LW2-)ylk|Z`Zsv}s5H|Q ztYw@K9wj)a00R}{w$NJSEmzVd|bQJEb!TRld?37T6JreJ5DzS`yK+d zd(p20cEYliX~p4(^`dXADAOmM)TROgJm1YpNr-&9qP?u Date: Thu, 26 May 2016 14:45:35 -0700 Subject: [PATCH 432/439] renaming network exhaust doc --- windows/manage/TOC.md | 2 +- ...re-windows-10-devices-to-stop-data-flow-to-microsoft.md | 7 +------ 2 files changed, 2 insertions(+), 7 deletions(-) diff --git a/windows/manage/TOC.md b/windows/manage/TOC.md index 621ce3f5ca..9a7fe85b18 100644 --- a/windows/manage/TOC.md +++ b/windows/manage/TOC.md @@ -18,7 +18,7 @@ #### [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) #### [Set up a kiosk on Windows 10 Mobile or Windows 10 Mobile Enterprise](set-up-a-kiosk-for-windows-10-for-mobile-edition.md) ### [Lock down Windows 10 to specific apps](lock-down-windows-10-to-specific-apps.md) -### [Configure Windows 10 devices to stop data flow to Microsoft](configure-windows-10-devices-to-stop-data-flow-to-microsoft.md) +### [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) ### [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md) ### [Configure access to Windows Store](stop-employees-from-using-the-windows-store.md) ### [Manage Wi-Fi Sense in your company](manage-wifi-sense-in-enterprise.md) diff --git a/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md b/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md index af80d923ca..66f10dbf1e 100644 --- a/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md +++ b/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md @@ -1,11 +1,6 @@ --- title: Configure Windows 10 devices to stop data flow to Microsoft (Windows 10) -description: If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider. -ms.assetid: ACCEB0DD-BC6F-41B1-B359-140B242183D9 -keywords: privacy, stop data flow to Microsoft -ms.prod: W10 -ms.mktglfcycl: manage -ms.sitesec: library +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services --- # Configure Windows 10 devices to stop data flow to Microsoft From 92d301af76670b278b742624514a116e6cb9a3a3 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 26 May 2016 14:46:07 -0700 Subject: [PATCH 433/439] renaming network exhaust doc --- ...system-components-to-microsoft-services.md | 1264 +++++++++++++++++ 1 file changed, 1264 insertions(+) create mode 100644 windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md diff --git a/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md new file mode 100644 index 0000000000..f8496916b0 --- /dev/null +++ b/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -0,0 +1,1264 @@ +--- +title: Manage connections from Windows operating system components to Microsoft services (Windows 10) +description: If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider. +ms.assetid: ACCEB0DD-BC6F-41B1-B359-140B242183D9 +keywords: privacy, manage connections to Microsoft +ms.prod: W10 +ms.mktglfcycl: manage +ms.sitesec: library +--- + +# Manage connections from Windows operating system components to Microsoft services + +**Applies to** + +- Windows 10 + +If you're looking for content on what each telemetry level means and how to configure it in your organization, see [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md). + +Learn about the network connections that Windows components make to Microsoft and also the privacy settings that affect data that is shared with either Microsoft or apps and how they can be managed by an IT Pro. + +If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider. You can configure telemetry at the lowest level for your edition of Windows, and also evaluate which other connections Windows makes to Microsoft services you want to turn off in your environment from the list in this article. + +Some of the network connections discussed in this article can be managed in Windows 10 Mobile, Windows 10 Mobile Enterprise, and the July release of Windows 10. However, you must use Windows 10 Enterprise, version 1511 or Windows 10 Education, version 1511 to manage them all. + +In Windows 10 Enterprise, version 1511 or Windows 10 Education, version 1511, you can configure telemetry at the Security level, turn off Windows Defender telemetry and MSRT reporting, and turn off all other connections to Microsoft services as described in this article to prevent Windows from sending any data to Microsoft. We strongly recommend against this, as this data helps us deliver a secure, reliable, and more delightful personalized experience. + +We are always working on improving Windows 10 for our customers. We invite IT pros to join the [Windows Insider Program](http://insider.windows.com) to give us feedback on what we can do to make Windows 10 work better for your organization. + +Here's what's covered in this article: + +- [Info management settings](#bkmk-othersettings) + + - [1. Cortana](#bkmk-cortana) + + - [1.1 Cortana Group Policies](#bkmk-cortana-gp) + + - [1.2 Cortana MDM policies](#bkmk-cortana-mdm) + + - [1.3 Cortana Windows Provisioning](#bkmk-cortana-prov) + + - [2. Date & Time](#bkmk-datetime) + + - [3. Device metadata retrieval](#bkmk-devinst) + + - [4. Font streaming](#font-streaming) + + - [5. Insider Preview builds](#bkmk-previewbuilds) + + - [6. Internet Explorer](#bkmk-ie) + + - [6.1 Internet Explorer Group Policies](#bkmk-ie-gp) + + - [6.2 ActiveX control blocking](#bkmk-ie-activex) + + - [7. Live Tiles](#live-tiles) + + - [8. Mail synchronization](#bkmk-mailsync) + + - [9. Microsoft Edge](#bkmk-edge) + + - [9.1 Microsoft Edge Group Policies](#bkmk-edgegp) + + - [9.2 Microsoft Edge MDM policies](#bkmk-edge-mdm) + + - [9.3 Microsoft Edge Windows Provisioning](#bkmk-edge-prov) + + - [10. Network Connection Status Indicator](#bkmk-ncsi) + + - [11. Offline maps](#bkmk-offlinemaps) + + - [12. OneDrive](#bkmk-onedrive) + + - [13. Preinstalled apps](#bkmk-preinstalledapps) + + - [14. Settings > Privacy](#bkmk-settingssection) + + - [14.1 General](#bkmk-priv-general) + + - [14.2 Location](#bkmk-priv-location) + + - [14.3 Camera](#bkmk-priv-camera) + + - [14.4 Microphone](#bkmk-priv-microphone) + + - [14.5 Speech, inking, & typing](#bkmk-priv-speech) + + - [14.6 Account info](#bkmk-priv-accounts) + + - [14.7 Contacts](#bkmk-priv-contacts) + + - [14.8 Calendar](#bkmk-priv-calendar) + + - [14.9 Call history](#bkmk-priv-callhistory) + + - [14.10 Email](#bkmk-priv-email) + + - [14.11 Messaging](#bkmk-priv-messaging) + + - [14.12 Radios](#bkmk-priv-radios) + + - [14.13 Other devices](#bkmk-priv-other-devices) + + - [14.14 Feedback & diagnostics](#bkmk-priv-feedback) + + - [14.15 Background apps](#bkmk-priv-background) + + - [15. Software Protection Platform](#bkmk-spp) + + - [16. Sync your settings](#bkmk-syncsettings) + + - [17. Teredo](#bkmk-teredo) + + - [18. Wi-Fi Sense](#bkmk-wifisense) + + - [19. Windows Defender](#bkmk-defender) + + - [20. Windows Media Player](#bkmk-wmp) + + - [21. Windows spotlight](#bkmk-spotlight) + + - [22. Windows Store](#bkmk-windowsstore) + + - [23. Windows Update Delivery Optimization](#bkmk-updates) + + - [23.1 Settings > Update & security](#bkmk-wudo-ui) + + - [23.2 Delivery Optimization Group Policies](#bkmk-wudo-gp) + + - [23.3 Delivery Optimization MDM policies](#bkmk-wudo-mdm) + + - [23.4 Delivery Optimization Windows Provisioning](#bkmk-wudo-prov) + + - [24. Windows Update](#bkmk-wu) + +## What's new in Windows 10, version 1511 + + +Here's a list of changes that were made to this article for Windows 10, version 1511: + +- Added the following new sections: + + - [Mail synchronization](#bkmk-mailsync) + + - [Offline maps](#bkmk-offlinemaps) + + - [Windows spotlight](#bkmk-spotlight) + + - [Windows Store](#bkmk-windowsstore) + +- Added the following Group Policies: + + - Open a new tab with an empty tab + + - Configure corporate Home pages + + - Let Windows apps access location + + - Let Windows apps access the camera + + - Let Windows apps access the microphone + + - Let Windows apps access account information + + - Let Windows apps access contacts + + - Let Windows apps access the calendar + + - Let Windows apps access messaging + + - Let Windows apps control radios + + - Let Windows apps access trusted devices + + - Do not show feedback notifications + + - Turn off Automatic Download and Update of Map Data + + - Force a specific default lock screen image + +- Added the AllowLinguisticDataCollection MDM policy. + +- Added steps in the [Cortana](#bkmk-cortana) section on how to disable outbound traffic using Windows Firewall. + +- Changed the Windows Update section to apply system-wide settings, and not just per user. + +## Info management settings + + +This section lists the components that make network connections to Microsoft services automatically. You can configure these settings to control the data that is sent to Microsoft. To prevent Windows from sending any data to Microsoft, configure telemetry at the Security level, turn off Windows Defender telemetry and MSRT reporting, and turn off all of these connections. We strongly recommend against this, as this data helps us deliver a secure, reliable, and more delightful personalized experience. + +The settings in this section assume you are using Windows 10, version 1511 (currently available in the Current Branch and Current Branch for Business). They will also be included in the next update for the Long Term Servicing Branch. + +- [1. Cortana](#bkmk-cortana) + +- [2. Date & Time](#bkmk-datetime) + +- [3. Device metadata retrieval](#bkmk-devinst) + +- [4. Font streaming](#font-streaming) + +- [5. Insider Preview builds](#bkmk-previewbuilds) + +- [6. Internet Explorer](#bkmk-ie) + +- [7. Live Tiles](#live-tiles) + +- [8. Mail synchronization](#bkmk-mailsync) + +- [9. Microsoft Edge](#bkmk-edge) + +- [10. Network Connection Status Indicator](#bkmk-ncsi) + +- [11. Offline maps](#bkmk-offlinemaps) + +- [12. OneDrive](#bkmk-onedrive) + +- [13. Preinstalled apps](#bkmk-preinstalledapps) + +- [14. Settings > Privacy](#bkmk-settingssection) + +- [15. Software Protection Platform](#bkmk-spp) + +- [16. Sync your settings](#bkmk-syncsettings) + +- [17. Teredo](#bkmk-teredo) + +- [18. Wi-Fi Sense](#bkmk-wifisense) + +- [19. Windows Defender](#bkmk-defender) + +- [20. Windows Media Player](#bkmk-wmp) + +- [21. Windows spotlight](#bkmk-spotlight) + +- [22. Windows Store](#bkmk-windowsstore) + +- [23. Windows Update Delivery Optimization](#bkmk-updates) + +- [24. Windows Update](#bkmk-wu) + + +See the following table for a summary of the management settings. For more info, see its corresponding section. + +![Management settings table](images/settings-table.png) + +### 1. Cortana + +Use either Group Policy or MDM policies to manage settings for Cortana. For more info, see [Cortana, Search, and privacy: FAQ](http://go.microsoft.com/fwlink/p/?LinkId=730683). + +### 1.1 Cortana Group Policies + +Find the Cortana Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Search**. + +| Policy | Description | +|------------------------------------------------------|---------------------------------------------------------------------------------------| +| Allow Cortana | Choose whether to let Cortana install and run on the device. | +| Allow search and Cortana to use location | Choose whether Cortana and Search can provide location-aware search results. | +| Do not allow web search | Choose whether to search the web from Windows Desktop Search.
      Default: Disabled| +| Don't search the web or display web results in Search| Choose whether to search the web from Cortana. | +| Set what information is shared in Search | Control what information is shared with Bing in Search. | + +When you enable the **Don't search the web or display web results in Search** Group Policy, you can control the behavior of whether Cortana searches the web to display web results. However, this policy only covers whether or not web search is performed. There could still be a small amount of network traffic to Bing.com to evaluate if certain Cortana components are up-to-date or not. In order to turn off that network activity completely, you can create a Windows Firewall rule to prevent outbound traffic. + +1. Expand **Computer Configuration** > **Windows Settings** > **Security Settings** > **Windows Firewall with Advanced Security** > **Windows Firewall with Advanced Security - <LDAP name>**, and then click **Outbound Rules**. + +2. Right-click **Outbound Rules**, and then click **New Rule**. The **New Outbound Rule Wizard** starts. + +3. On the **Rule Type** page, click **Program**, and then click **Next**. + +4. On the **Program** page, click **This program path**, type **%windir%\\systemapps\\Microsoft.Windows.Cortana\_cw5n1h2txyewy\\SearchUI.exe**, and then click **Next**. + +5. On the **Action** page, click **Block the connection**, and then click **Next**. + +6. On the **Profile** page, ensure that the **Domain**, **Private**, and **Public** check boxes are selected, and then click **Next**. + +7. On the **Name** page, type a name for the rule, such as **Cortana firewall configuration**, and then click **Finish.** + +8. Right-click the new rule, click **Properties**, and then click **Protocols and Ports**. + +9. Configure the **Protocols and Ports** page with the following info, and then click **OK**. + + - For **Protocol type**, choose **TCP**. + + - For **Local port**, choose **All Ports**. + + - For **Remote port**, choose **All ports**. + +> **Note:** If your organization tests network traffic, you should not use Fiddler to test Windows Firewall settings. Fiddler is a network proxy and Windows Firewall does not block proxy traffic. You should use a network traffic analyzer, such as WireShark or Message Analyzer. + +### 1.2 Cortana MDM policies + +The following Cortana MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). + +| Policy | Description | +|------------------------------------------------------|-----------------------------------------------------------------------------------------------------| +| Experience/AllowCortana | Choose whether to let Cortana install and run on the device. | +| Search/AllowSearchToUseLocation | Choose whether Cortana and Search can provide location-aware search results.
      Default: Allowed| + +### 1.3 Cortana Windows Provisioning + +To use Windows Imaging and Configuration Designer (ICD) to create a provisioning package with the settings for these policies, go to **Runtime settings** > **Policies** to find **Experience** > **AllowCortana** and **Search** > **AllowSearchToUseLocation**. + +### 2. Date & Time + +You can prevent Windows from setting the time automatically. + +- To turn off the feature in the UI: **Settings** > **Time & language** > **Date & time** > **Set time automatically** + + -or- + +- Create a REG\_SZ registry setting in **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\W32Time\\Parameters** with a value of **NoSync**. + +### 3. Device metadata retrieval + +To prevent Windows from retrieving device metadata from the Internet, apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Device Installation** > **Prevent device metadata retrieval from the Internet**. + +### 4. Font streaming + +Starting with Windows 10, fonts that are included in Windows but that are not stored on the local device can be downloaded on demand. + +To turn off font streaming, create a REG\_DWORD registry setting called **DisableFontProviders** in **HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\FontCache\\Parameters**, with a value of 1. + +> **Note:** This may change in future versions of Windows. + +### 5. Insider Preview builds + +To turn off Insider Preview builds if you're running a released version of Windows 10. If you're running a preview version of Windows 10, you must roll back to a released version before you can turn off Insider Preview builds. + +- Turn off the feature in the UI: **Settings** > **Update & security** > **Windows Update** > **Advanced options** > **Stop Insider builds**. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Toggle user control over Insider builds**. + + -or- + +- Apply the System/AllowBuildPreview MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where: + + - **0**. Users cannot make their devices available for downloading and installing preview software. + + - **1**. Users can make their devices available for downloading and installing preview software. + + - **2**. (default) Not configured. Users can make their devices available for download and installing preview software. + + -or- + +- Create a provisioning package: **Runtime settings** > **Policies** > **System** > **AllowBuildPreview**, where: + + - **0**. Users cannot make their devices available for downloading and installing preview software. + + - **1**. Users can make their devices available for downloading and installing preview software. + + - **2**. (default) Not configured. Users can make their devices available for download and installing preview software. + +### 6. Internet Explorer + +Use Group Policy to manage settings for Internet Explorer. + +### 6.1 Internet Explorer Group Policies + +Find the Internet Explorer Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer**. + +| Policy | Description | +|------------------------------------------------------|-----------------------------------------------------------------------------------------------------| +| Turn on Suggested Sites| Choose whether an employee can configure Suggested Sites.
      Default: Enabled
      You can also turn this off in the UI by clearing the **Internet Options** > **Advanced** > **Enable Suggested Sites** check box.| +| Allow Microsoft services to provide enhanced suggestions as the user types in the Address Bar | Choose whether an employee can configure enhanced suggestions, which are presented to the employee as they type in the address bar.
      Default: Enabled| +| Turn off the auto-complete feature for web addresses | Choose whether auto-complete suggests possible matches when employees are typing web address in the address bar.
      Default: Disabled
      You can also turn this off in the UI by clearing the Internet Options > **Advanced** > **Use inline AutoComplete in the Internet Explorer Address Bar and Open Dialog** check box.| +| Disable Periodic Check for Internet Explorer software updates| Choose whether Internet Explorer periodically checks for a new version.
      Default: Enabled | +| Turn off browser geolocation | Choose whether websites can request location data from Internet Explorer.
      Default: Disabled| + +### 6.2 ActiveX control blocking + +ActiveX control blocking periodically downloads a new list of out-of-date ActiveX controls that should be blocked. You can turn this off by changing the REG\_DWORD registry setting **HKEY\_CURRENT\_USER\\Software\\Microsoft\\Internet Explorer\\VersionManager\\DownloadVersionList** to 0 (zero). + +For more info, see [Out-of-date ActiveX control blocking](http://technet.microsoft.com/library/dn761713.aspx). + +### 7. Live Tiles + +To turn off Live Tiles: + +- Apply the Group Policy: **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Notifications** > **Turn Off notifications network usage** + +### 8. Mail synchronization + +To turn off mail synchronization for Microsoft Accounts that are configured on a device: + +- In **Settings** > **Accounts** > **Your email and accounts**, remove any connected Microsoft Accounts. + + -or- + +- Remove any Microsoft Accounts from the Mail app. + + -or- + +- Apply the Accounts/AllowMicrosoftAccountConnection MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is not allowed and 1 is allowed. This does not apply to Microsoft Accounts that have already been configured on the device. + +To turn off the Windows Mail app: + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Mail** > **Turn off Windows Mail application** + +### 9. Microsoft Edge + +Use either Group Policy or MDM policies to manage settings for Microsoft Edge. For more info, see [Microsoft Edge and privacy: FAQ](http://go.microsoft.com/fwlink/p/?LinkId=730682). + +### 9.1 Microsoft Edge Group Policies + +Find the Microsoft Edge Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Edge**. + +> **Note:** The Microsoft Edge Group Policy names were changed in Windows 10, version 1511. The table below reflects those changes. + +| Policy | Description | +|------------------------------------------------------|-----------------------------------------------------------------------------------------------------| +| Turn off autofill | Choose whether employees can use autofill on websites.
      Default: Enabled | +| Allow employees to send Do Not Track headers | Choose whether employees can send Do Not Track headers.
      Default: Disabled | +| Turn off password manager | Choose whether employees can save passwords locally on their devices.
      Default: Enabled | +| Turn off address bar search suggestions | Choose whether the address bar shows search suggestions.
      Default: Enabled | +| Turn off the SmartScreen Filter | Choose whether SmartScreen is turned on or off.
      Default: Enabled | +| Open a new tab with an empty tab | Choose whether a new tab page appears.
      Default: Enabled | +| Configure corporate Home pages | Choose the corporate Home page for domain-joined devices.
      Set this to **about:blank** | + +### 9.2 Microsoft Edge MDM policies + +The following Microsoft Edge MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). + +| Policy | Description | +|------------------------------------------------------|-----------------------------------------------------------------------------------------------------| +| Browser/AllowAutoFill | Choose whether employees can use autofill on websites.
      Default: Allowed | +| Browser/AllowDoNotTrack | Choose whether employees can send Do Not Track headers.
      Default: Not allowed | +| Browser/AllowPasswordManager | Choose whether employees can save passwords locally on their devices.
      Default: Allowed | +| Browser/AllowSearchSuggestionsinAddressBar | Choose whether the address bar shows search suggestions..
      Default: Allowed | +| Browser/AllowSmartScreen | Choose whether SmartScreen is turned on or off.
      Default: Allowed | + +### 9.3 Microsoft Edge Windows Provisioning + +Use Windows ICD to create a provisioning package with the settings for these policies, go to **Runtime settings** > **Policies**. + +For a complete list of the Microsoft Edge policies, see [Available policies for Microsoft Edge](http://technet.microsoft.com/library/mt270204.aspx). + +### 10. Network Connection Status Indicator + +Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to http://www.msftncsi.com to determine if the device can communicate with the Internet. For more info about NCIS, see [The Network Connection Status Icon](http://blogs.technet.com/b/networking/archive/2012/12/20/the-network-connection-status-icon.aspx). + +You can turn off NCSI through Group Policy: + +- Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Internet Communication Management** > **Internet Communication Settings** > **Turn off Windows Network Connectivity Status Indicator active tests** + +> **Note** After you apply this policy, you must restart the device for the policy setting to take effect. + +### 11. Offline maps + +You can turn off the ability to download and update offline maps. + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Maps** > **Turn off Automatic Download and Update of Map Data** + +### 12. OneDrive + +To turn off OneDrive in your organization: + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **OneDrive** > **Prevent the usage of OneDrive for file storage** + +### 13. Preinstalled apps + +Some preinstalled apps get content before they are opened to ensure a great experience. You can remove these using the steps in this section. + +To remove the News app: + +- Right-click the app in Start, and then click **Uninstall**. + + -or- + +- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.BingNews"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** + + -and- + + Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.BingNews | Remove-AppxPackage** + +To remove the Weather app: + +- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.BingWeather"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** + + -and- + + Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.BingWeather | Remove-AppxPackage** + +To remove the Money app: + +- Right-click the app in Start, and then click **Uninstall**. + + -or- + +- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.BingFinance"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** + + -and- + + Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.BingFinance | Remove-AppxPackage** + +To remove the Sports app: + +- Right-click the app in Start, and then click **Uninstall**. + + -or- + +- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.BingSports"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** + + -and- + + Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.BingSports | Remove-AppxPackage** + +To remove the Twitter app: + +- Right-click the app in Start, and then click **Uninstall**. + + -or- + +- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "\*.Twitter"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** + + -and- + + Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage \*.Twitter | Remove-AppxPackage** + +To remove the XBOX app: + +- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.XboxApp"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** + + -and- + + Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.XboxApp | Remove-AppxPackage** + +To remove the Sway app: + +- Right-click the app in Start, and then click **Uninstall**. + + -or- + +- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.Office.Sway"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** + + -and- + + Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.Office.Sway | Remove-AppxPackage** + +To remove the OneNote app: + +- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.Office.OneNote"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** + + -and- + + Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.Office.OneNote | Remove-AppxPackage** + +To remove the Get Office app: + +- Right-click the app in Start, and then click **Uninstall**. + + -or- + +- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.MicrosoftOfficeHub"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** + + -and- + + Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.MicrosoftOfficeHub | Remove-AppxPackage** + +To remove the Get Skype app: + +- Right-click the Sports app in Start, and then click **Uninstall**. + + -or- + +- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.SkypeApp"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** + + -and- + + Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.SkypeApp | Remove-AppxPackage** + +### 14. Settings > Privacy + +Use Settings > Privacy to configure some settings that may be important to your organization. Except for the Feedback & Diagnostics page, these settings must be configured for every user account that signs into the PC. + +- [14.1 General](#bkmk-general) + +- [14.2 Location](#bkmk-priv-location) + +- [14.3 Camera](#bkmk-priv-camera) + +- [14.4 Microphone](#bkmk-priv-microphone) + +- [14.5 Speech, inking, & typing](#bkmk-priv-speech) + +- [14.6 Account info](#bkmk-priv-accounts) + +- [14.7 Contacts](#bkmk-priv-contacts) + +- [14.8 Calendar](#bkmk-priv-calendar) + +- [14.9 Call history](#bkmk-priv-callhistory) + +- [14.10 Email](#bkmk-priv-email) + +- [14.11 Messaging](#bkmk-priv-messaging) + +- [14.12 Radios](#bkmk-priv-radios) + +- [14.13 Other devices](#bkmk-priv-other-devices) + +- [14.14 Feedback & diagnostics](#bkmk-priv-feedback) + +- [14.15 Background apps](#bkmk-priv-background) + +### 14.1 General + +**General** includes options that don't fall into other areas. + +To turn off **Let apps use my advertising ID for experiences across apps (turning this off will reset your ID)**: + +> **Note:** When you turn this feature off in the UI, it turns off the advertising ID, not just resets it. + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **User Profiles** > **Turn off the advertising ID**. + + -or- + +- Create a REG\_DWORD registry setting called **Enabled** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AdvertisingInfo**, with a value of 0 (zero). + +To turn off **Turn on SmartScreen Filter to check web content (URLs) that Windows Store apps use**: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Edge** > **Turn off the SmartScreen Filter**. + + Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **File Explorer** > **Configure Windows SmartScreen**. + + -or- + +- Apply the Browser/AllowSmartScreen MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is turned off and 1 is turned on. + + -or- + +- Create a provisioning package, using: + + - For Internet Explorer: **Runtime settings** > **Policies** > **Browser** > **AllowSmartScreen** + + - For Microsoft Edge: **Runtime settings** > **Policies** > **MicrosoftEdge** > **AllowSmartScreen** + + -or- + +- Create a REG\_DWORD registry setting called **Enabled** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppHost\\EnableWebContentEvaluation**, with a value of 0 (zero). + +To turn off **Send Microsoft info about how I write to help us improve typing and writing in the future**: + +> **Note: ** If the telemetry level is set to either **Basic** or **Security**, this is turned off automatically. + + + +- Turn off the feature in the UI. + + -or- + +- Apply the TextInput/AllowLinguisticDataCollection MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where: + + - **0**. Not allowed + + - **1**. Allowed (default) + +To turn off **Let websites provide locally relevant content by accessing my language list**: + +- Turn off the feature in the UI. + + -or- + +- Create a new REG\_DWORD registry setting called **HttpAcceptLanguageOptOut** in **HKEY\_CURRENT\_USER\\Control Panel\\International\\User Profile**, with a value of 1. + +### 14.2 Location + +In the **Location** area, you choose whether devices have access to location-specific sensors and which apps have access to the device's location. + +To turn off **Location for this device**: + +- Click the **Change** button in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Location and Sensors** > **Turn off location**. + + -or- + +- Apply the System/AllowLocation MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: + + - **0**. Turned off and the employee can't turn it back on. + + - **1**. Turned on, but lets the employee choose whether to use it. (default) + + - **2**. Turned on and the employee can't turn it off. + + **Note** + You can also set this MDM policy in System Center Configuration Manager using the [WMI Bridge Provider](http://msdn.microsoft.com/library/dn905224.aspx). + + -or- + +- Create a provisioning package, using **Runtime settings** > **Policies** > **System** > **AllowLocation**, where + + - **No**. Turns off location service. + + - **Yes**. Turns on location service. (default) + +To turn off **Location**: + +- Turn off the feature in the UI. + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access location** + + - Set the **Select a setting** box to **Force Deny**. + + -or- + +To turn off **Location history**: + +- Erase the history using the **Clear** button in the UI. + +To turn off **Choose apps that can use your location**: + +- Turn off each app using the UI. + +### 14.3 Camera + +In the **Camera** area, you can choose which apps can access a device's camera. + +To turn off **Let apps use my camera**: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access the camera** + + - Set the **Select a setting** box to **Force Deny**. + + -or- + +- Apply the Camera/AllowCamera MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: + + - **0**. Apps can't use the camera. + + - **1**. Apps can use the camera. + + **Note** + You can also set this MDM policy in System Center Configuration Manager using the [WMI Bridge Provider](http://msdn.microsoft.com/library/dn905224.aspx). + + -or- + +- Create a provisioning package with use Windows ICD, using **Runtime settings** > **Policies** > **Camera** > **AllowCamera**, where: + + - **0**. Apps can't use the camera. + + - **1**. Apps can use the camera. + +To turn off **Choose apps that can use your camera**: + +- Turn off the feature in the UI for each app. + +### 14.4 Microphone + +In the **Microphone** area, you can choose which apps can access a device's microphone. + +To turn off **Let apps use my microphone**: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access the microphone** + + - Set the **Select a setting** box to **Force Deny**. + +To turn off **Choose apps that can use your microphone**: + +- Turn off the feature in the UI for each app. + +### 14.5 Speech, inking, & typing + +In the **Speech, Inking, & Typing** area, you can let Windows and Cortana better understand your employee's voice and written input by sampling their voice and writing, and by comparing verbal and written input to contact names and calendar entrees. + +> **Note:** For more info on how to disable Cortana in your enterprise, see [Cortana](#bkmk-cortana) in this article. + + + +To turn off the functionality: + +- Click the **Stop getting to know me** button, and then click **Turn off**. + + -or- + +- Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Regional and Language Options** > **Handwriting personalization** > **Turn off automatic learning** + + -or- + +- Create a REG\_DWORD registry setting called **AcceptedPrivacyPolicy** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Personalization\\Settings**, with a value of 0 (zero). + + -and- + + Create a REG\_DWORD registry setting called **HarvestContacts** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\InputPersonalization\\TrainedDataStore**, with a value of 0 (zero). + +### 14.6 Account info + +In the **Account Info** area, you can choose which apps can access your name, picture, and other account info. + +To turn off **Let apps access my name, picture, and other account info**: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access account information** + + - Set the **Select a setting** box to **Force Deny**. + +To turn off **Choose the apps that can access your account info**: + +- Turn off the feature in the UI for each app. + +### 14.7 Contacts + +In the **Contacts** area, you can choose which apps can access an employee's contacts list. + +To turn off **Choose apps that can access contacts**: + +- Turn off the feature in the UI for each app. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access contacts** + + - Set the **Select a setting** box to **Force Deny**. + +### 14.8 Calendar + +In the **Calendar** area, you can choose which apps have access to an employee's calendar. + +To turn off **Let apps access my calendar**: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access the calendar** + + - Set the **Select a setting** box to **Force Deny**. + +To turn off **Choose apps that can access calendar**: + +- Turn off the feature in the UI for each app. + +### 14.9 Call history + +In the **Call history** area, you can choose which apps have access to an employee's call history. + +To turn off **Let apps access my call history**: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access call history** + + - Set the **Select a setting** box to **Force Deny**. + +### 14.10 Email + +In the **Email** area, you can choose which apps have can access and send email. + +To turn off **Let apps access and send email**: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access email** + + - Set the **Select a setting** box to **Force Deny**. + +### 14.11 Messaging + +In the **Messaging** area, you can choose which apps can read or send messages. + +To turn off **Let apps read or send messages (text or MMS)**: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access messaging** + + - Set the **Select a setting** box to **Force Deny**. + +To turn off **Choose apps that can read or send messages**: + +- Turn off the feature in the UI for each app. + +### 14.12 Radios + +In the **Radios** area, you can choose which apps can turn a device's radio on or off. + +To turn off **Let apps control radios**: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps control radios** + + - Set the **Select a setting** box to **Force Deny**. + +To turn off **Choose apps that can control radios**: + +- Turn off the feature in the UI for each app. + +### 14.13 Other devices + +In the **Other Devices** area, you can choose whether devices that aren't paired to PCs, such as an Xbox One, can share and sync info. + +To turn off **Let apps automatically share and sync info with wireless devices that don't explicitly pair with your PC, tablet, or phone**: + +- Turn off the feature in the UI. + +To turn off **Let your apps use your trusted devices (hardware you've already connected, or comes with your PC, tablet, or phone)**: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access trusted devices** + + - Set the **Select a setting** box to **Force Deny**. + +### 14.14 Feedback & diagnostics + +In the **Feedback & Diagnostics** area, you can choose how often you're asked for feedback and how much diagnostic and usage information is sent to Microsoft. + +To change how frequently **Windows should ask for my feedback**: + +**Note** +Feedback frequency only applies to user-generated feedback, not diagnostic and usage data sent from the device. + + + +- To change from **Automatically (Recommended)**, use the drop-down list in the UI. + + -or- + +- Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Do not show feedback notifications** + + -or- + +- Create the registry keys (REG\_DWORD type): + + - HKEY\_CURRENT\_USER\\Software\\Microsoft\\Siuf\\Rules\\PeriodInNanoSeconds + + - HKEY\_CURRENT\_USER\\Software\\Microsoft\\Siuf\\Rules\\NumberOfSIUFInPeriod + + Based on these settings: + + | Setting | PeriodInNanoSeconds | NumberOfSIUFInPeriod | + |---------------|-----------------------------|-----------------------------| + | Automatically | Delete the registry setting | Delete the registry setting | + | Never | 0 | 0 | + | Always | 100000000 | Delete the registry setting | + | Once a day | 864000000000 | 1 | + | Once a week | 6048000000000 | 1 | + + + +To change the level of diagnostic and usage data sent when you **Send your device data to Microsoft**: + +- To change from **Enhanced**, use the drop-down list in the UI. The other levels are **Basic** and **Full**. + + > **Note:** You can't use the UI to change the telemetry level to **Security**. + + + + -or- + +- Apply the Group Policy: **Computer Configuration\\Administrative Templates\\Windows Components\\Data Collection And Preview Builds\\Allow Telemetry** + + -or- + +- Apply the System/AllowTelemetry MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: + + - **0**. Maps to the **Security** level. + + - **1**. Maps to the **Basic** level. + + - **2**. Maps to the **Enhanced** level. + + - **3**. Maps to the **Full** level. + + -or- + +- Create a provisioning package, using **Runtime settings** > **Policies** > **System** > **AllowTelemetry**, where: + + - **0**. Maps to the **Security** level. + + - **1**. Maps to the **Basic** level. + + - **2**. Maps to the **Enhanced** level. + + - **3**. Maps to the **Full** level. + +### 14.15 Background apps + +In the **Background Apps** area, you can choose which apps can run in the background. + +To turn off **Let apps run in the background**: + +- Turn off the feature in the UI for each app. + +### 15. Software Protection Platform + +Enterprise customers can manage their Windows activation status with volume licensing using an on-premise Key Management Server. You can opt out of sending KMS client activation data to Microsoft automatically by applying the following Group Policy: + +**Computer Configuration** > **Administrative Templates** > **Windows Components** > **Software Protection Platform** > **Turn off KMS Client Online AVS Activation** + +The Windows activation status will be valid for a rolling period of 180 days with weekly activation status checks to the KMS. + +### 16. Sync your settings + +You can control if your settings are synchronized: + +- In the UI: **Settings** > **Accounts** > **Sync your settings** + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Sync your settings** > **Do not sync** + + -or- + +- Apply the Experience/AllowSyncMySettings MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is not allowed and 1 is allowed. + + -or- + +- Create a provisioning package, using **Runtime settings** > **Policies** > **Experience** > **AllowSyncMySettings**, where + + - **No**. Settings are not synchronized. + + - **Yes**. Settings are synchronized. (default) + +To turn off Messaging cloud sync: + +- Create a REG\_DWORD registry setting called **CloudServiceSyncEnabled** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Messaging**, with a value of 0 (zero). + +### 17. Teredo + +You can disable Teredo by using the netsh.exe command. For more info on Teredo, see [Internet Protocol Version 6, Teredo, and Related Technologies](http://technet.microsoft.com/library/cc722030.aspx). + +- From an elevated command prompt, run **netsh interface teredo set state disabled** + +### 18. Wi-Fi Sense + +Wi-Fi Sense automatically connects devices to known hotspots and to the wireless networks the person’s contacts have shared with them. + +To turn off **Connect to suggested open hotspots** and **Connect to networks shared by my contacts**: + +- Turn off the feature in the UI. + + -or- + +- Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Network** > **WLAN Service** > **WLAN Settings** > **Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services**. + + -or- + +- Create a new REG\_DWORD registry setting called **AutoConnectAllowedOEM** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\WcmSvc\\wifinetworkmanager\\config**, with a value of 0 (zero). + + -or- + +- Change the Windows Provisioning setting, WiFISenseAllowed, to 0 (zero). For more info, see the Windows Provisioning Settings reference doc, [WiFiSenseAllowed](http://go.microsoft.com/fwlink/p/?LinkId=620909). + + -or- + +- Use the Unattended settings to set the value of WiFiSenseAllowed to 0 (zero). For more info, see the Unattended Windows Setup reference doc, [WiFiSenseAllowed](http://go.microsoft.com/fwlink/p/?LinkId=620910). + +When turned off, the Wi-Fi Sense settings still appear on the Wi-Fi Settings screen, but they’re non-functional and they can’t be controlled by the employee. + +### 19. Windows Defender + +You can opt out of the Microsoft Antimalware Protection Service. + +- Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender** > **MAPS** > **Join Microsoft MAPS** + + -or- + +- Apply the Defender/AllowClouldProtection MDM policy from the [Defender CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). + + -or- + +- Use the registry to set the REG\_DWORD value **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Spynet\\SpyNetReporting** to 0 (zero). + + -and- + + From an elevated Windows PowerShell prompt, run **set-mppreference -Mapsreporting 0** + +You can stop sending file samples back to Microsoft. + +- Set the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender** > **MAPS** > **Send file samples when further analysis is required** to **Always Prompt** or **Never Send**. + + -or- + +- Apply the Defender/SubmitSamplesConsent MDM policy from the [Defender CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: + + - **0**. Always prompt. + + - **1**. (default) Send safe samples automatically. + + - **2**. Never send. + + - **3**. Send all samples automatically. + + -or- + +- Use the registry to set the REG\_DWORD value **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Spynet\\SubmitSamplesConsent** to 0 (zero) to always prompt or 2 to never send. + +You can stop downloading definition updates: + +- Enable the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender** > **Signature Updates** > **Define the order of sources for downloading definition updates** and set it to **FileShares**. + + -and- + +- Enable the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender** > **Signature Updates** > **Define file shares for downloading definition updates** and set it to nothing. + +You can also use the registry to turn off Malicious Software Reporting Tool telemetry by setting the REG\_DWORD value **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\MRT\\DontReportInfectionInformation** to 1. + +### 20. Windows Media Player + +To remove Windows Media Player: + +- From the **Programs and Features** control panel, click **Turn Windows features on or off**, under **Media Features**, clear the **Windows Media Player** check box, and then click **OK**. + + -or- + +- Run the following DISM command from an elevated command prompt: **dism /online /Disable-Feature /FeatureName:WindowsMediaPlayer** + +### 21. Windows spotlight + +Windows spotlight provides different background images and text on the lock screen. You can control it by using the user interface or through Group Policy. + +- Configure the following in **Settings**: + + - **Personalization** > **Lock screen** > **Background** > **Windows spotlight**, select a different background, and turn off **Show me tips, tricks, and more on the lock screen**. + + - **Personalization** > **Start** > **Occasionally show suggestions in Start**. + + - **System** > **Notifications & actions** > **Show me tips about Windows**. + + -or- + +- Apply the Group Policies: + + - **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Force a specific default lock screen image**. + - Add a location in the **Path to local lock screen image** box. + + - Set the **Turn off fun facts, tips, tricks, and more on lock screen** check box. + + **Note** This will only take effect if the policy is applied before the first logon. If you cannot apply the **Force a specific default lock screen image** policy before the first logon to the device, you can apply this policy: **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Do not display the lock screen**. + + + + - **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Do not show Windows Tips**. + + - **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Turn off Microsoft consumer experiences**. + +For more info, see [Windows spotlight on the lock screen](../whats-new/windows-spotlight.md). + +### 22. Windows Store + +You can turn off the ability to launch apps from the Windows Store that were preinstalled or downloaded. This will also turn off automatic app updates, and the Windows Store will be disabled. + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Store** > **Disable all apps from Windows Store**. + +### 23. Windows Update Delivery Optimization + +Windows Update Delivery Optimization lets you get Windows updates and Windows Store apps from sources in addition to Microsoft, which not only helps when you have a limited or unreliable Internet connection, but can also help you reduce the amount of bandwidth needed to keep all of your organization's PCs up-to-date. If you have Delivery Optimization turned on, PCs on your network may send and receive updates and apps to other PCs on your local network, if you choose, or to PCs on the Internet. + +By default, PCs running Windows 10 Enterprise and Windows 10 Education will only use Delivery Optimization to get and receive updates for PCs and apps on your local network. + +Use the UI, Group Policy, MDM policies, or Windows Provisioning to set up Delivery Optimization. + +### 23.1 Settings > Update & security + +You can set up Delivery Optimization from the **Settings** UI. + +- Go to **Settings** > **Update & security** > **Windows Update** > **Advanced options** > **Choose how updates are delivered**. + +### 23.2 Delivery Optimization Group Policies + +You can find the Delivery Optimization Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Delivery Optimization**. + +| Policy | Description | +|---------------------------|-----------------------------------------------------------------------------------------------------| +| Download Mode | Lets you choose where Delivery Optimization gets or sends updates and apps, including

      • None. Turns off Delivery Optimization.

      • Group. Gets or sends updates and apps to PCs on the same local network domain.

      • Internet. Gets or sends updates and apps to PCs on the Internet.

      • LAN. Gets or sends updates and apps to PCs on the same NAT only.

      | +| Group ID | Lets you provide a Group ID that limits which PCs can share apps and updates.
      ** Note** This ID must be a GUID.| +| Max Cache Age | Lets you specify the maximum time (in seconds) that a file is held in the Delivery Optimization cache.
      The default value is 259200 seconds (3 days).| +| Max Cache Size | Lets you specify the maximum cache size as a percentage of disk size.
      The default value is 20, which represents 20% of the disk.| +| Max Upload Bandwidth | Lets you specify the maximum upload bandwidth (in KB/second) that a device uses across all concurrent upload activity.
      The default value is 0, which means unlimited possible bandwidth.| + +### 23.3 Delivery Optimization MDM policies + +The following Delivery Optimization MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). + +| Policy | Description | +|---------------------------|-----------------------------------------------------------------------------------------------------| +| DeliveryOptimization/DODownloadMode | Lets you choose where Delivery Optimization gets or sends updates and apps, including
      • 0. Turns off Delivery Optimization.

      • 1. Gets or sends updates and apps to PCs on the same NAT only.

      • 2. Gets or sends updates and apps to PCs on the same local network domain.

      • 3. Gets or sends updates and apps to PCs on the Internet.

      | +| DeliveryOptimization/DOGroupID | Lets you provide a Group ID that limits which PCs can share apps and updates.
      ** Note** This ID must be a GUID.| +| DeliveryOptimization/DOMaxCacheAge | Lets you specify the maximum time (in seconds) that a file is held in the Delivery Optimization cache.
      The default value is 259200 seconds (3 days).| +| DeliveryOptimization/DOMaxCacheSize | Lets you specify the maximum cache size as a percentage of disk size.
      The default value is 20, which represents 20% of the disk.| +| DeliveryOptimization/DOMaxUploadBandwidth | Lets you specify the maximum upload bandwidth (in KB/second) that a device uses across all concurrent upload activity.
      The default value is 0, which means unlimited possible bandwidth.| + + +### 23.4 Delivery Optimization Windows Provisioning + +If you don't have an MDM server in your enterprise, you can use Windows Provisioning to configure the Delivery Optimization policies + +Use Windows ICD, included with the [Windows Assessment and Deployment Kit (Windows ADK)](http://go.microsoft.com/fwlink/p/?LinkId=526803), to create a provisioning package for Delivery Optimization. + +1. Open Windows ICD, and then click **New provisioning package**. + +2. In the **Name** box, type a name for the provisioning package, and then click **Next.** + +3. Click the **Common to all Windows editions** option, click **Next**, and then click **Finish**. + +4. Go to **Runtime settings** > **Policies** > **DeliveryOptimization** to configure the policies. + +For more info about Delivery Optimization in general, see [Windows Update Delivery Optimization: FAQ](http://go.microsoft.com/fwlink/p/?LinkId=730684). + +### 24. Windows Update + +You can turn off Windows Update by setting the following registry entries: + +- Add a REG\_DWORD value called **DoNotConnectToWindowsUpdateInternetLocations** to **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and set the value to 1. + + -and- + +- Add a REG\_DWORD value called **DisableWindowsUpdateAccess** to **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and set the value to 1. + +You can turn off automatic updates by doing one of the following. This is not recommended. + +- Add a REG\_DWORD value called **AutoDownload** to **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsStore\\WindowsUpdate** and set the value to 5. + + -or- + +- Apply the Update/AllowAutoUpdate MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: + + - **0**. Notify the user before downloading the update. + + - **1**. Auto install the update and then notify the user to schedule a device restart. + + - **2** (default). Auto install and restart. + + - **3**. Auto install and restart at a specified time. + + - **4**. Auto install and restart without end-user control. + + - **5**. Turn off automatic updates. + +To learn more, see [Device update management](http://msdn.microsoft.com/library/windows/hardware/dn957432.aspx) and [Configure Automatic Updates by using Group Policy](http://technet.microsoft.com/library/cc720539.aspx). From 24e2237b197fce2142f3e3e271321a4d5db6328d Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Thu, 26 May 2016 14:55:45 -0700 Subject: [PATCH 434/439] fix tagging change W10 to w10 (lower case) and changed author of CFaw to greg-lindsay --- windows/deploy/activate-forest-by-proxy-vamt.md | 2 +- windows/deploy/activate-forest-vamt.md | 2 +- ...ctivate-using-active-directory-based-activation-client.md | 4 ++-- windows/deploy/activate-using-key-management-service-vamt.md | 2 +- windows/deploy/activate-windows-10-clients-vamt.md | 2 +- windows/deploy/active-directory-based-activation-overview.md | 4 ++-- ...-10-operating-system-image-using-configuration-manager.md | 4 ++-- ...deployment-with-windows-pe-using-configuration-manager.md | 4 ++-- windows/deploy/add-manage-products-vamt.md | 2 +- windows/deploy/add-remove-computers-vamt.md | 2 +- windows/deploy/add-remove-product-key-vamt.md | 2 +- ...information-sent-to-microsoft-during-activation-client.md | 2 +- .../deploy/assign-applications-using-roles-in-mdt-2013.md | 2 +- ...ld-a-distributed-environment-for-windows-10-deployment.md | 2 +- windows/deploy/change-history-for-deploy-windows-10.md | 4 ++-- windows/deploy/configure-client-computers-vamt.md | 2 +- windows/deploy/configure-mdt-2013-for-userexit-scripts.md | 2 +- windows/deploy/configure-mdt-2013-settings.md | 2 +- windows/deploy/configure-mdt-deployment-share-rules.md | 2 +- ...ustom-windows-pe-boot-image-with-configuration-manager.md | 4 ++-- ...ate-a-task-sequence-with-configuration-manager-and-mdt.md | 5 +++-- windows/deploy/create-a-windows-10-reference-image.md | 2 +- ...-to-deploy-with-windows-10-using-configuration-manager.md | 4 ++-- windows/deploy/deploy-a-windows-10-image-using-mdt.md | 4 ++-- .../deploy-windows-10-using-pxe-and-configuration-manager.md | 4 ++-- ...ws-10-with-system-center-2012-r2-configuration-manager.md | 4 ++-- ...eploy-windows-10-with-the-microsoft-deployment-toolkit.md | 2 +- windows/deploy/deploy-windows-to-go.md | 5 +++-- ...n-for-windows-10-deployment-with-configuration-manager.md | 4 ++-- .../get-started-with-the-microsoft-deployment-toolkit.md | 2 +- .../getting-started-with-the-user-state-migration-tool.md | 4 ++-- windows/deploy/import-export-vamt-data.md | 2 +- windows/deploy/index.md | 4 ++-- windows/deploy/install-configure-vamt.md | 2 +- windows/deploy/install-kms-client-key-vamt.md | 2 +- windows/deploy/install-product-key-vamt.md | 2 +- windows/deploy/install-vamt.md | 2 +- .../deploy/integrate-configuration-manager-with-mdt-2013.md | 2 +- windows/deploy/introduction-vamt.md | 2 +- windows/deploy/key-features-in-mdt-2013.md | 2 +- windows/deploy/kms-activation-vamt.md | 2 +- windows/deploy/local-reactivation-vamt.md | 2 +- windows/deploy/manage-activations-vamt.md | 2 +- windows/deploy/manage-product-keys-vamt.md | 2 +- windows/deploy/manage-vamt-data.md | 2 +- windows/deploy/mdt-2013-lite-touch-components.md | 2 +- windows/deploy/migrate-application-settings.md | 4 ++-- windows/deploy/migration-store-types-overview.md | 4 ++-- windows/deploy/monitor-activation-client.md | 4 ++-- ...nitor-windows-10-deployment-with-configuration-manager.md | 4 ++-- windows/deploy/offline-migration-reference.md | 4 ++-- windows/deploy/online-activation-vamt.md | 2 +- windows/deploy/plan-for-volume-activation-client.md | 2 +- .../deploy/prepare-for-windows-deployment-with-mdt-2013.md | 2 +- ...-installation-of-windows-10-with-configuration-manager.md | 4 ++-- windows/deploy/proxy-activation-vamt.md | 2 +- ...s-7-client-with-windows-10-using-configuration-manager.md | 4 ++-- .../deploy/refresh-a-windows-7-computer-with-windows-10.md | 2 +- windows/deploy/remove-products-vamt.md | 2 +- ...s-7-client-with-windows-10-using-configuration-manager.md | 4 ++-- ...eplace-a-windows-7-computer-with-a-windows-10-computer.md | 2 +- windows/deploy/scenario-kms-activation-vamt.md | 2 +- windows/deploy/scenario-online-activation-vamt.md | 2 +- windows/deploy/scenario-proxy-activation-vamt.md | 2 +- windows/deploy/set-up-mdt-2013-for-bitlocker.md | 2 +- windows/deploy/sideload-apps-in-windows-10.md | 4 ++-- ...simulate-a-windows-10-deployment-in-a-test-environment.md | 2 +- windows/deploy/understanding-migration-xml-files.md | 4 ++-- windows/deploy/update-product-status-vamt.md | 2 +- .../update-windows-10-images-with-provisioning-packages.md | 4 ++-- ...-to-windows-10-with-system-center-configuraton-manager.md | 4 ++-- ...de-to-windows-10-with-the-microsoft-deployment-toolkit.md | 2 +- windows/deploy/use-orchestrator-runbooks-with-mdt-2013.md | 2 +- ...dt-database-to-stage-windows-10-deployment-information.md | 2 +- .../use-the-volume-activation-management-tool-client.md | 2 +- windows/deploy/use-vamt-in-windows-powershell.md | 2 +- windows/deploy/use-web-services-in-mdt-2013.md | 2 +- windows/deploy/usmt-best-practices.md | 4 ++-- windows/deploy/usmt-choose-migration-store-type.md | 4 ++-- windows/deploy/usmt-command-line-syntax.md | 4 ++-- windows/deploy/usmt-common-issues.md | 4 ++-- windows/deploy/usmt-common-migration-scenarios.md | 4 ++-- windows/deploy/usmt-configxml-file.md | 4 ++-- windows/deploy/usmt-conflicts-and-precedence.md | 4 ++-- windows/deploy/usmt-custom-xml-examples.md | 4 ++-- windows/deploy/usmt-customize-xml-files.md | 4 ++-- windows/deploy/usmt-determine-what-to-migrate.md | 4 ++-- windows/deploy/usmt-estimate-migration-store-size.md | 4 ++-- windows/deploy/usmt-exclude-files-and-settings.md | 4 ++-- .../usmt-extract-files-from-a-compressed-migration-store.md | 4 ++-- windows/deploy/usmt-faq.md | 4 ++-- windows/deploy/usmt-general-conventions.md | 4 ++-- windows/deploy/usmt-hard-link-migration-store.md | 4 ++-- windows/deploy/usmt-how-it-works.md | 4 ++-- windows/deploy/usmt-how-to.md | 4 ++-- windows/deploy/usmt-identify-application-settings.md | 4 ++-- windows/deploy/usmt-identify-file-types-files-and-folders.md | 4 ++-- windows/deploy/usmt-identify-operating-system-settings.md | 4 ++-- windows/deploy/usmt-identify-users.md | 4 ++-- windows/deploy/usmt-include-files-and-settings.md | 4 ++-- windows/deploy/usmt-loadstate-syntax.md | 4 ++-- windows/deploy/usmt-log-files.md | 4 ++-- windows/deploy/usmt-migrate-efs-files-and-certificates.md | 4 ++-- windows/deploy/usmt-migrate-user-accounts.md | 4 ++-- windows/deploy/usmt-migration-store-encryption.md | 4 ++-- windows/deploy/usmt-overview.md | 4 ++-- windows/deploy/usmt-plan-your-migration.md | 4 ++-- windows/deploy/usmt-recognized-environment-variables.md | 4 ++-- windows/deploy/usmt-reference.md | 4 ++-- windows/deploy/usmt-requirements.md | 4 ++-- windows/deploy/usmt-reroute-files-and-settings.md | 4 ++-- windows/deploy/usmt-resources.md | 4 ++-- windows/deploy/usmt-return-codes.md | 4 ++-- windows/deploy/usmt-scanstate-syntax.md | 4 ++-- windows/deploy/usmt-technical-reference.md | 4 ++-- windows/deploy/usmt-test-your-migration.md | 4 ++-- windows/deploy/usmt-topics.md | 4 ++-- windows/deploy/usmt-troubleshooting.md | 4 ++-- windows/deploy/usmt-utilities.md | 4 ++-- windows/deploy/usmt-what-does-usmt-migrate.md | 4 ++-- windows/deploy/usmt-xml-elements-library.md | 4 ++-- windows/deploy/usmt-xml-reference.md | 4 ++-- windows/deploy/vamt-known-issues.md | 2 +- windows/deploy/vamt-requirements.md | 2 +- windows/deploy/vamt-step-by-step.md | 2 +- .../verify-the-condition-of-a-compressed-migration-store.md | 4 ++-- windows/deploy/volume-activation-management-tool.md | 2 +- windows/deploy/volume-activation-windows-10.md | 2 +- windows/deploy/windows-10-deployment-scenarios.md | 4 ++-- windows/deploy/windows-10-deployment-tools-reference.md | 4 ++-- windows/deploy/windows-10-edition-upgrades.md | 4 ++-- windows/deploy/windows-adk-scenarios-for-it-pros.md | 4 ++-- windows/deploy/windows-deployment-scenarios-and-tools.md | 4 ++-- .../deploy/windows-upgrade-and-migration-considerations.md | 4 ++-- windows/deploy/xml-file-requirements.md | 4 ++-- 135 files changed, 217 insertions(+), 215 deletions(-) diff --git a/windows/deploy/activate-forest-by-proxy-vamt.md b/windows/deploy/activate-forest-by-proxy-vamt.md index f178e14406..1e852d5221 100644 --- a/windows/deploy/activate-forest-by-proxy-vamt.md +++ b/windows/deploy/activate-forest-by-proxy-vamt.md @@ -2,7 +2,7 @@ title: Activate by Proxy an Active Directory Forest (Windows 10) description: Activate by Proxy an Active Directory Forest ms.assetid: 6475fc87-a6f7-4fa8-b0aa-de19f2dea7e5 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/activate-forest-vamt.md b/windows/deploy/activate-forest-vamt.md index 267e03be9c..082bac639c 100644 --- a/windows/deploy/activate-forest-vamt.md +++ b/windows/deploy/activate-forest-vamt.md @@ -2,7 +2,7 @@ title: Activate an Active Directory Forest Online (Windows 10) description: Activate an Active Directory Forest Online ms.assetid: 9b5bc193-799b-4aa5-9d3e-0e495f7195d3 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/activate-using-active-directory-based-activation-client.md b/windows/deploy/activate-using-active-directory-based-activation-client.md index 15ae96825a..dbf9a5a617 100644 --- a/windows/deploy/activate-using-active-directory-based-activation-client.md +++ b/windows/deploy/activate-using-active-directory-based-activation-client.md @@ -3,11 +3,11 @@ title: Activate using Active Directory-based activation (Windows 10) description: Active Directory-based activation is implemented as a role service that relies on AD DS to store activation objects. ms.assetid: 08cce6b7-7b5b-42cf-b100-66c363a846af keywords: vamt, volume activation, activation, windows activation -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation -author: CFaw +author: greg-lindsay --- # Activate using Active Directory-based activation diff --git a/windows/deploy/activate-using-key-management-service-vamt.md b/windows/deploy/activate-using-key-management-service-vamt.md index 4c5d735436..9681860156 100644 --- a/windows/deploy/activate-using-key-management-service-vamt.md +++ b/windows/deploy/activate-using-key-management-service-vamt.md @@ -3,7 +3,7 @@ title: Activate using Key Management Service (Windows 10) ms.assetid: f2417bfe-7d25-4e82-bc07-de316caa8dac description: keywords: vamt, volume activation, activation, windows activation -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/activate-windows-10-clients-vamt.md b/windows/deploy/activate-windows-10-clients-vamt.md index 91b743947e..2d77f355dc 100644 --- a/windows/deploy/activate-windows-10-clients-vamt.md +++ b/windows/deploy/activate-windows-10-clients-vamt.md @@ -3,7 +3,7 @@ title: Activate clients running Windows 10 (Windows 10) description: After you have configured Key Management Service (KMS) or Active Directory-based activation on your network, activating a client running Windows 10 is easy. ms.assetid: 39446e49-ad7c-48dc-9f18-f85a11ded643 keywords: vamt, volume activation, activation, windows activation -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/active-directory-based-activation-overview.md b/windows/deploy/active-directory-based-activation-overview.md index 7f47592aa7..9a64d7572a 100644 --- a/windows/deploy/active-directory-based-activation-overview.md +++ b/windows/deploy/active-directory-based-activation-overview.md @@ -2,11 +2,11 @@ title: Active Directory-Based Activation Overview (Windows 10) description: Active Directory-Based Activation Overview ms.assetid: c1dac3bd-6a86-4c45-83dd-421e63a398c0 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation -author: CFaw +author: greg-lindsay --- # Active Directory-Based Activation Overview diff --git a/windows/deploy/add-a-windows-10-operating-system-image-using-configuration-manager.md b/windows/deploy/add-a-windows-10-operating-system-image-using-configuration-manager.md index 13a328ea77..5a3eadbc33 100644 --- a/windows/deploy/add-a-windows-10-operating-system-image-using-configuration-manager.md +++ b/windows/deploy/add-a-windows-10-operating-system-image-using-configuration-manager.md @@ -2,8 +2,8 @@ title: Add a Windows 10 operating system image using Configuration Manager (Windows 10) description: Operating system images are typically the production image used for deployment throughout the organization. ms.assetid: 77f769cc-1a47-4f36-8082-201cd77b8d3b -keywords: ["image, deploy, distribute"] -ms.prod: W10 +keywords: image, deploy, distribute +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus diff --git a/windows/deploy/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md b/windows/deploy/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md index 8e72718b82..de701986b4 100644 --- a/windows/deploy/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md +++ b/windows/deploy/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md @@ -2,8 +2,8 @@ title: Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager (Windows 10) description: In this topic, you will learn how to configure the Windows Preinstallation Environment (Windows PE) to include the network drivers required to connect to the deployment share and the storage drivers required to see the local storage on machines. ms.assetid: 97b3ea46-28d9-407e-8c42-ded2e45e8d5c -keywords: ["deploy, task sequence"] -ms.prod: W10 +keywords: deploy, task sequence +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus diff --git a/windows/deploy/add-manage-products-vamt.md b/windows/deploy/add-manage-products-vamt.md index 6bbbfaf218..88d5145472 100644 --- a/windows/deploy/add-manage-products-vamt.md +++ b/windows/deploy/add-manage-products-vamt.md @@ -2,7 +2,7 @@ title: Add and Manage Products (Windows 10) description: Add and Manage Products ms.assetid: a48fbc23-917d-40f7-985c-e49702c05e51 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/add-remove-computers-vamt.md b/windows/deploy/add-remove-computers-vamt.md index eae34332f2..2ad22c3d7f 100644 --- a/windows/deploy/add-remove-computers-vamt.md +++ b/windows/deploy/add-remove-computers-vamt.md @@ -2,7 +2,7 @@ title: Add and Remove Computers (Windows 10) description: Add and Remove Computers ms.assetid: cb6f3a78-ece0-4dc7-b086-cb003d82cd52 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: jdeckerMS diff --git a/windows/deploy/add-remove-product-key-vamt.md b/windows/deploy/add-remove-product-key-vamt.md index 5776806c20..d659ae2507 100644 --- a/windows/deploy/add-remove-product-key-vamt.md +++ b/windows/deploy/add-remove-product-key-vamt.md @@ -2,7 +2,7 @@ title: Add and Remove a Product Key (Windows 10) description: Add and Remove a Product Key ms.assetid: feac32bb-fb96-4802-81b8-c69220dcfcce -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/appendix-information-sent-to-microsoft-during-activation-client.md b/windows/deploy/appendix-information-sent-to-microsoft-during-activation-client.md index 8a21466ddb..39133a9d8c 100644 --- a/windows/deploy/appendix-information-sent-to-microsoft-during-activation-client.md +++ b/windows/deploy/appendix-information-sent-to-microsoft-during-activation-client.md @@ -3,7 +3,7 @@ title: Appendix Information sent to Microsoft during activation (Windows 10) ms.assetid: 4bfff495-07d0-4385-86e3-7a077cbd64b8 description: keywords: vamt, volume activation, activation, windows activation -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/assign-applications-using-roles-in-mdt-2013.md b/windows/deploy/assign-applications-using-roles-in-mdt-2013.md index dab995bb1e..1319888616 100644 --- a/windows/deploy/assign-applications-using-roles-in-mdt-2013.md +++ b/windows/deploy/assign-applications-using-roles-in-mdt-2013.md @@ -3,7 +3,7 @@ title: Assign applications using roles in MDT (Windows 10) description: This topic will show you how to add applications to a role in the MDT database and then assign that role to a computer. ms.assetid: d82902e4-de9c-4bc4-afe0-41d649b83ce7 keywords: settings, database, deploy -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/build-a-distributed-environment-for-windows-10-deployment.md b/windows/deploy/build-a-distributed-environment-for-windows-10-deployment.md index 32a354ad0e..f015c71c1f 100644 --- a/windows/deploy/build-a-distributed-environment-for-windows-10-deployment.md +++ b/windows/deploy/build-a-distributed-environment-for-windows-10-deployment.md @@ -3,7 +3,7 @@ title: Build a distributed environment for Windows 10 deployment (Windows 10) description: In this topic, you will learn how to replicate your Windows 10 deployment shares to facilitate the deployment of Windows 10 in remote or branch locations. ms.assetid: a6cd5657-6a16-4fff-bfb4-44760902d00c keywords: replication, replicate, deploy, configure, remote -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/change-history-for-deploy-windows-10.md b/windows/deploy/change-history-for-deploy-windows-10.md index 3ca65edd17..00404f4def 100644 --- a/windows/deploy/change-history-for-deploy-windows-10.md +++ b/windows/deploy/change-history-for-deploy-windows-10.md @@ -2,10 +2,10 @@ title: Change history for Deploy Windows 10 (Windows 10) description: This topic lists new and updated topics in the Deploy Windows 10 documentation for Windows 10 and Windows 10 Mobile. ms.assetid: 19C50373-6B25-4F5C-A6EF-643D36904349 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Change history for Deploy Windows 10 diff --git a/windows/deploy/configure-client-computers-vamt.md b/windows/deploy/configure-client-computers-vamt.md index b3618bac74..704c8d01f9 100644 --- a/windows/deploy/configure-client-computers-vamt.md +++ b/windows/deploy/configure-client-computers-vamt.md @@ -2,7 +2,7 @@ title: Configure Client Computers (Windows 10) description: Configure Client Computers ms.assetid: a48176c9-b05c-4dd5-a9ef-83073e2370fc -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/configure-mdt-2013-for-userexit-scripts.md b/windows/deploy/configure-mdt-2013-for-userexit-scripts.md index 590f112414..a94bee6b7b 100644 --- a/windows/deploy/configure-mdt-2013-for-userexit-scripts.md +++ b/windows/deploy/configure-mdt-2013-for-userexit-scripts.md @@ -3,7 +3,7 @@ title: Configure MDT for UserExit scripts (Windows 10) description: In this topic, you will learn how to configure the MDT rules engine to use a UserExit script to generate computer names based on a prefix and the computer MAC Address. ms.assetid: 29a421d1-12d2-414e-86dc-25b62f5238a7 keywords: rules, script -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/configure-mdt-2013-settings.md b/windows/deploy/configure-mdt-2013-settings.md index af41a8a1bb..ba84efd5c1 100644 --- a/windows/deploy/configure-mdt-2013-settings.md +++ b/windows/deploy/configure-mdt-2013-settings.md @@ -3,7 +3,7 @@ title: Configure MDT settings (Windows 10) description: One of the most powerful features in Microsoft Deployment Toolkit (MDT) 2013 is its extension capabilities; there is virtually no limitation to what you can do in terms of customization. ms.assetid: d3e1280c-3d1b-4fad-8ac4-b65dc711f122 keywords: customize, customization, deploy, features, tools -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/configure-mdt-deployment-share-rules.md b/windows/deploy/configure-mdt-deployment-share-rules.md index 908f92144b..5eeadbbfd6 100644 --- a/windows/deploy/configure-mdt-deployment-share-rules.md +++ b/windows/deploy/configure-mdt-deployment-share-rules.md @@ -3,7 +3,7 @@ title: Configure MDT deployment share rules (Windows 10) description: In this topic, you will learn how to configure the MDT rules engine to reach out to other resources, including external scripts, databases, and web services, for additional information instead of storing settings directly in the rules engine. ms.assetid: b5ce2360-33cc-4b14-b291-16f75797391b keywords: rules, configuration, automate, deploy -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/create-a-custom-windows-pe-boot-image-with-configuration-manager.md b/windows/deploy/create-a-custom-windows-pe-boot-image-with-configuration-manager.md index 049c3e93c2..a5cbfb7886 100644 --- a/windows/deploy/create-a-custom-windows-pe-boot-image-with-configuration-manager.md +++ b/windows/deploy/create-a-custom-windows-pe-boot-image-with-configuration-manager.md @@ -2,8 +2,8 @@ title: Create a custom Windows PE boot image with Configuration Manager (Windows 10) description: In Microsoft System Center 2012 R2 Configuration Manager, you can create custom Windows Preinstallation Environment (Windows PE) boot images that include extra components and features. ms.assetid: b9e96974-324d-4fa4-b0ce-33cfc49c4809 -keywords: ["tool, customize, deploy, boot image"] -ms.prod: W10 +keywords: tool, customize, deploy, boot image +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus diff --git a/windows/deploy/create-a-task-sequence-with-configuration-manager-and-mdt.md b/windows/deploy/create-a-task-sequence-with-configuration-manager-and-mdt.md index 03c856a7dc..0838ebde59 100644 --- a/windows/deploy/create-a-task-sequence-with-configuration-manager-and-mdt.md +++ b/windows/deploy/create-a-task-sequence-with-configuration-manager-and-mdt.md @@ -2,9 +2,10 @@ title: Create a task sequence with Configuration Manager and MDT (Windows 10) description: In this topic, you will learn how to create a Microsoft System Center 2012 R2 Configuration Manager task sequence with Microsoft Deployment Toolkit (MDT) integration using the MDT wizard. ms.assetid: 0b069bec-5be8-47c6-bf64-7a630f41ac98 -keywords: ["deploy, upgrade, task sequence, install"] -ms.prod: W10 +keywords: deploy, upgrade, task sequence, install +ms.prod: w10 ms.mktglfcycl: deploy +ms.pagetype: mdt ms.sitesec: library author: mtniehaus --- diff --git a/windows/deploy/create-a-windows-10-reference-image.md b/windows/deploy/create-a-windows-10-reference-image.md index f81f4eac9a..50ec7f2fcf 100644 --- a/windows/deploy/create-a-windows-10-reference-image.md +++ b/windows/deploy/create-a-windows-10-reference-image.md @@ -3,7 +3,7 @@ title: Create a Windows 10 reference image (Windows 10) description: Creating a reference image is important because that image serves as the foundation for the devices in your organization. ms.assetid: 9da2fb57-f2ff-4fce-a858-4ae4c237b5aa keywords: deploy, deployment, configure, customize, install, installation -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md b/windows/deploy/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md index c47ac7bc38..5dbd28f0c8 100644 --- a/windows/deploy/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md +++ b/windows/deploy/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md @@ -2,8 +2,8 @@ title: Create an application to deploy with Windows 10 using Configuration Manager (Windows 10) description: Microsoft System Center 2012 R2 Configuration Manager supports deploying applications as part of the Windows 10 deployment process. ms.assetid: 2dfb2f39-1597-4999-b4ec-b063e8a8c90c -keywords: ["deployment, task sequence, custom, customize"] -ms.prod: W10 +keywords: deployment, task sequence, custom, customize +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus diff --git a/windows/deploy/deploy-a-windows-10-image-using-mdt.md b/windows/deploy/deploy-a-windows-10-image-using-mdt.md index 23176dbd84..7f92cbc0d8 100644 --- a/windows/deploy/deploy-a-windows-10-image-using-mdt.md +++ b/windows/deploy/deploy-a-windows-10-image-using-mdt.md @@ -2,8 +2,8 @@ title: Deploy a Windows 10 image using MDT 2013 Update 2 (Windows 10) description: This topic will show you how to take your reference image for Windows 10, and deploy that image to your environment using the Microsoft Deployment Toolkit (MDT), and MDT 2013 Update 2 specifically. ms.assetid: 1d70a3d8-1b1d-4051-b656-c0393a93f83c -keywords: [eployment, automate, tools, configure -ms.prod: W10 +keywords: deployment, automate, tools, configure +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/deploy-windows-10-using-pxe-and-configuration-manager.md b/windows/deploy/deploy-windows-10-using-pxe-and-configuration-manager.md index 0cdf8e0509..2bc874cf8b 100644 --- a/windows/deploy/deploy-windows-10-using-pxe-and-configuration-manager.md +++ b/windows/deploy/deploy-windows-10-using-pxe-and-configuration-manager.md @@ -2,8 +2,8 @@ title: Deploy Windows 10 using PXE and Configuration Manager (Windows 10) description: In this topic, you will learn how to deploy Windows 10 using Microsoft System Center 2012 R2 Configuration Manager deployment packages and task sequences. ms.assetid: fb93f514-5b30-4f4b-99dc-58e6860009fa -keywords: ["deployment, image, UEFI, task sequence"] -ms.prod: W10 +keywords: deployment, image, UEFI, task sequence +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus diff --git a/windows/deploy/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md b/windows/deploy/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md index 32ee03ca6c..e3e558c24b 100644 --- a/windows/deploy/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md +++ b/windows/deploy/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md @@ -2,8 +2,8 @@ title: Deploy Windows 10 with System Center 2012 R2 Configuration Manager (Windows 10) description: If you have Microsoft System Center 2012 R2 Configuration Manager in your environment, you will most likely want to use it to deploy Windows 10. ms.assetid: eacd7b7b-dde0-423d-97cd-29bde9e8b363 -keywords: ["deployment, custom, boot"] -ms.prod: W10 +keywords: deployment, custom, boot +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus diff --git a/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit.md b/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit.md index 765f29c16d..93028930c5 100644 --- a/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit.md +++ b/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit.md @@ -3,7 +3,7 @@ title: Deploy Windows 10 with the Microsoft Deployment Toolkit (Windows 10) description: This guide will walk you through the process of deploying Windows 10 in an enterprise environment using the Microsoft Deployment Toolkit (MDT), and MDT 2013 Update 2 specifically. ms.assetid: 837f009c-617e-4b3f-9028-2246067ee0fb keywords: deploy, tools, configure, script -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus diff --git a/windows/deploy/deploy-windows-to-go.md b/windows/deploy/deploy-windows-to-go.md index 609ae81687..b4e13c5b8c 100644 --- a/windows/deploy/deploy-windows-to-go.md +++ b/windows/deploy/deploy-windows-to-go.md @@ -2,10 +2,11 @@ title: Deploy Windows To Go in your organization (Windows 10) description: This topic helps you to deploy Windows To Go in your organization. ms.assetid: cfe550be-ffbd-42d1-ab4d-80efae49b07f -keywords: ["deployment, USB, device, BitLocker, workspace, security, data"] -ms.prod: W10 +keywords: deployment, USB, device, BitLocker, workspace, security, data +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: mobility author: mtniehaus --- diff --git a/windows/deploy/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md b/windows/deploy/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md index 67136031be..2ed9de7378 100644 --- a/windows/deploy/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md +++ b/windows/deploy/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md @@ -2,8 +2,8 @@ title: Finalize the operating system configuration for Windows 10 deployment with Configuration Manager (Windows 10) description: This topic walks you through the steps to finalize the configuration of your Windows 10 operating deployment, which includes enablement of the optional Microsoft Deployment Toolkit (MDT) monitoring for Microsoft System Center 2012 R2 Configuration Manager, logs folder creation, rules configuration, content distribution, and deployment of the previously created task sequence. ms.assetid: 38b55fa8-e717-4689-bd43-8348751d493e -keywords: ["configure, deploy, upgrade"] -ms.prod: W10 +keywords: configure, deploy, upgrade +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus diff --git a/windows/deploy/get-started-with-the-microsoft-deployment-toolkit.md b/windows/deploy/get-started-with-the-microsoft-deployment-toolkit.md index 57d9153cb2..85ad95c548 100644 --- a/windows/deploy/get-started-with-the-microsoft-deployment-toolkit.md +++ b/windows/deploy/get-started-with-the-microsoft-deployment-toolkit.md @@ -3,7 +3,7 @@ title: Get started with the Microsoft Deployment Toolkit (MDT) (Windows 10) description: This topic will help you gain a better understanding of how to use the Microsoft Deployment Toolkit (MDT), and MDT 2013 Update 2 in particular, as part of a Windows operating system deployment. ms.assetid: a256442c-be47-4bb9-a105-c831f58ce3ee keywords: deploy, image, feature, install, tools -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/getting-started-with-the-user-state-migration-tool.md b/windows/deploy/getting-started-with-the-user-state-migration-tool.md index d83c01ec2d..8dae688326 100644 --- a/windows/deploy/getting-started-with-the-user-state-migration-tool.md +++ b/windows/deploy/getting-started-with-the-user-state-migration-tool.md @@ -2,10 +2,10 @@ title: Getting Started with the User State Migration Tool (USMT) (Windows 10) description: Getting Started with the User State Migration Tool (USMT) ms.assetid: 506ff1d2-94b8-4460-8672-56aad963504b -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Getting Started with the User State Migration Tool (USMT) diff --git a/windows/deploy/import-export-vamt-data.md b/windows/deploy/import-export-vamt-data.md index aff3d6376f..d33f27e139 100644 --- a/windows/deploy/import-export-vamt-data.md +++ b/windows/deploy/import-export-vamt-data.md @@ -2,7 +2,7 @@ title: Import and Export VAMT Data (Windows 10) description: Import and Export VAMT Data ms.assetid: 09a2c595-1a61-4da6-bd46-4ba8763cfd4f -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/index.md b/windows/deploy/index.md index a3b28ded45..0e5d1a0f8b 100644 --- a/windows/deploy/index.md +++ b/windows/deploy/index.md @@ -2,10 +2,10 @@ title: Deploy Windows 10 (Windows 10) description: Learn about deploying Windows 10 for IT professionals. ms.assetid: E9E2DED5-DBA7-4300-B411-BA0FD39BE18C -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Deploy Windows 10 diff --git a/windows/deploy/install-configure-vamt.md b/windows/deploy/install-configure-vamt.md index a660854f6f..49b3f8ec44 100644 --- a/windows/deploy/install-configure-vamt.md +++ b/windows/deploy/install-configure-vamt.md @@ -2,7 +2,7 @@ title: Install and Configure VAMT (Windows 10) description: Install and Configure VAMT ms.assetid: 5c7ae9b9-0dbc-4277-bc4f-8b3e4ab0bf50 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/install-kms-client-key-vamt.md b/windows/deploy/install-kms-client-key-vamt.md index f1e5cd2769..9605053d6a 100644 --- a/windows/deploy/install-kms-client-key-vamt.md +++ b/windows/deploy/install-kms-client-key-vamt.md @@ -2,7 +2,7 @@ title: Install a KMS Client Key (Windows 10) description: Install a KMS Client Key ms.assetid: d234468e-7917-4cf5-b0a8-4968454f7759 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/install-product-key-vamt.md b/windows/deploy/install-product-key-vamt.md index a3f4a3760e..71817b7b80 100644 --- a/windows/deploy/install-product-key-vamt.md +++ b/windows/deploy/install-product-key-vamt.md @@ -2,7 +2,7 @@ title: Install a Product Key (Windows 10) description: Install a Product Key ms.assetid: 78812c87-2208-4f8b-9c2c-5a8a18b2d648 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/install-vamt.md b/windows/deploy/install-vamt.md index 02275fb993..07a9a72b5b 100644 --- a/windows/deploy/install-vamt.md +++ b/windows/deploy/install-vamt.md @@ -2,7 +2,7 @@ title: Install VAMT (Windows 10) description: Install VAMT ms.assetid: 2eabd3e2-0a68-43a5-8189-2947e46482fc -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/integrate-configuration-manager-with-mdt-2013.md b/windows/deploy/integrate-configuration-manager-with-mdt-2013.md index 1ad2dbc2bd..4a30f0f74c 100644 --- a/windows/deploy/integrate-configuration-manager-with-mdt-2013.md +++ b/windows/deploy/integrate-configuration-manager-with-mdt-2013.md @@ -4,7 +4,7 @@ description: This topic will help you understand the benefits of integrating the ms.assetid: 3bd1cf92-81e5-48dc-b874-0f5d9472e5a5 ms.pagetype: mdt keywords: deploy, image, customize, task sequence -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus diff --git a/windows/deploy/introduction-vamt.md b/windows/deploy/introduction-vamt.md index ee0060ad4e..3d51c0dd02 100644 --- a/windows/deploy/introduction-vamt.md +++ b/windows/deploy/introduction-vamt.md @@ -2,7 +2,7 @@ title: Introduction to VAMT (Windows 10) description: Introduction to VAMT ms.assetid: 0439685e-0bae-4967-b0d4-dd84ca6d7fa7 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/key-features-in-mdt-2013.md b/windows/deploy/key-features-in-mdt-2013.md index 7982bb6d03..03f562ac8e 100644 --- a/windows/deploy/key-features-in-mdt-2013.md +++ b/windows/deploy/key-features-in-mdt-2013.md @@ -3,7 +3,7 @@ title: Key features in MDT 2013 Update 2 (Windows 10) description: The Microsoft Deployment Toolkit (MDT) has been in existence since 2003, when it was first introduced as Business Desktop Deployment (BDD) 1.0. ms.assetid: 858e384f-e9db-4a93-9a8b-101a503e4868 keywords: deploy, feature, tools, upgrade, migrate, provisioning -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/kms-activation-vamt.md b/windows/deploy/kms-activation-vamt.md index 4cd554a80b..beed3fb86f 100644 --- a/windows/deploy/kms-activation-vamt.md +++ b/windows/deploy/kms-activation-vamt.md @@ -2,7 +2,7 @@ title: Perform KMS Activation (Windows 10) description: Perform KMS Activation ms.assetid: 5a3ae8e6-083e-4153-837e-ab0a225c1d10 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/local-reactivation-vamt.md b/windows/deploy/local-reactivation-vamt.md index 2cd36eb80b..72b132e799 100644 --- a/windows/deploy/local-reactivation-vamt.md +++ b/windows/deploy/local-reactivation-vamt.md @@ -2,7 +2,7 @@ title: Perform Local Reactivation (Windows 10) description: Perform Local Reactivation ms.assetid: aacd5ded-da11-4d27-a866-3f57332f5dec -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/manage-activations-vamt.md b/windows/deploy/manage-activations-vamt.md index 1f15048dea..effac81fd1 100644 --- a/windows/deploy/manage-activations-vamt.md +++ b/windows/deploy/manage-activations-vamt.md @@ -2,7 +2,7 @@ title: Manage Activations (Windows 10) description: Manage Activations ms.assetid: 53bad9ed-9430-4f64-a8de-80613870862c -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/manage-product-keys-vamt.md b/windows/deploy/manage-product-keys-vamt.md index fffe5de77e..a495718fe7 100644 --- a/windows/deploy/manage-product-keys-vamt.md +++ b/windows/deploy/manage-product-keys-vamt.md @@ -2,7 +2,7 @@ title: Manage Product Keys (Windows 10) description: Manage Product Keys ms.assetid: 4c6c4216-b4b7-437c-904e-4cb257f913cd -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/manage-vamt-data.md b/windows/deploy/manage-vamt-data.md index adbd4c4ec6..00bbd3982f 100644 --- a/windows/deploy/manage-vamt-data.md +++ b/windows/deploy/manage-vamt-data.md @@ -2,7 +2,7 @@ title: Manage VAMT Data (Windows 10) description: Manage VAMT Data ms.assetid: 233eefa4-3125-4965-a12d-297a67079dc4 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/mdt-2013-lite-touch-components.md b/windows/deploy/mdt-2013-lite-touch-components.md index 6766bdc104..48f1a250ad 100644 --- a/windows/deploy/mdt-2013-lite-touch-components.md +++ b/windows/deploy/mdt-2013-lite-touch-components.md @@ -3,7 +3,7 @@ title: MDT 2013 Update 2 Lite Touch components (Windows 10) description: This topic provides an overview of the features in the Microsoft Deployment Toolkit (MDT) 2013 Update 2 that support Lite Touch Installation (LTI) for Windows 10. ms.assetid: 7d6fc159-e338-439e-a2e6-1778d0da9089 keywords: deploy, install, deployment, boot, log, monitor -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/migrate-application-settings.md b/windows/deploy/migrate-application-settings.md index af79e440f7..6a8ffdc612 100644 --- a/windows/deploy/migrate-application-settings.md +++ b/windows/deploy/migrate-application-settings.md @@ -2,10 +2,10 @@ title: Migrate Application Settings (Windows 10) description: Migrate Application Settings ms.assetid: 28f70a83-0a3e-4a6b-968a-2b78ccd3cc07 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Migrate Application Settings diff --git a/windows/deploy/migration-store-types-overview.md b/windows/deploy/migration-store-types-overview.md index cf0c52812e..9ee233402b 100644 --- a/windows/deploy/migration-store-types-overview.md +++ b/windows/deploy/migration-store-types-overview.md @@ -2,10 +2,10 @@ title: Migration Store Types Overview (Windows 10) description: Migration Store Types Overview ms.assetid: 3b6ce746-76c6-43ff-8cd5-02ed0ae0cf70 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Migration Store Types Overview diff --git a/windows/deploy/monitor-activation-client.md b/windows/deploy/monitor-activation-client.md index 5a3050cb0b..26c8257cc3 100644 --- a/windows/deploy/monitor-activation-client.md +++ b/windows/deploy/monitor-activation-client.md @@ -3,11 +3,11 @@ title: Monitor activation (Windows 10) ms.assetid: 264a3e86-c880-4be4-8828-bf4c839dfa26 description: keywords: vamt, volume activation, activation, windows activation -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation -author: CFaw +author: greg-lindsay --- # Monitor activation diff --git a/windows/deploy/monitor-windows-10-deployment-with-configuration-manager.md b/windows/deploy/monitor-windows-10-deployment-with-configuration-manager.md index 7802d20b05..12aae5a28c 100644 --- a/windows/deploy/monitor-windows-10-deployment-with-configuration-manager.md +++ b/windows/deploy/monitor-windows-10-deployment-with-configuration-manager.md @@ -2,8 +2,8 @@ title: Monitor the Windows 10 deployment with Configuration Manager (Windows 10) description: In this topic, you will learn how to monitor a Windows 10 deployment that was started previously using Microsoft System Center 2012 R2 Configuration Manager and the Microsoft Deployment Toolkit (MDT) Deployment Workbench. ms.assetid: 4863c6aa-6369-4171-8e1a-b052ca195fce -keywords: ["deploy, upgrade"] -ms.prod: W10 +keywords: deploy, upgrade +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus diff --git a/windows/deploy/offline-migration-reference.md b/windows/deploy/offline-migration-reference.md index 6ad60f1704..f54d3b4c7b 100644 --- a/windows/deploy/offline-migration-reference.md +++ b/windows/deploy/offline-migration-reference.md @@ -2,10 +2,10 @@ title: Offline Migration Reference (Windows 10) description: Offline Migration Reference ms.assetid: f347547c-d601-4c3e-8f2d-0138edeacfda -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Offline Migration Reference diff --git a/windows/deploy/online-activation-vamt.md b/windows/deploy/online-activation-vamt.md index 5f537d3e20..65311aa3e8 100644 --- a/windows/deploy/online-activation-vamt.md +++ b/windows/deploy/online-activation-vamt.md @@ -2,7 +2,7 @@ title: Perform Online Activation (Windows 10) description: Perform Online Activation ms.assetid: 8381792b-a454-4e66-9b4c-e6e4c9303823 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/plan-for-volume-activation-client.md b/windows/deploy/plan-for-volume-activation-client.md index 3247677c72..d5ed360f3e 100644 --- a/windows/deploy/plan-for-volume-activation-client.md +++ b/windows/deploy/plan-for-volume-activation-client.md @@ -3,7 +3,7 @@ title: Plan for volume activation (Windows 10) description: Product activation is the process of validating software with the manufacturer after it has been installed on a specific computer. ms.assetid: f84b005b-c362-4a70-a84e-4287c0d2e4ca keywords: vamt, volume activation, activation, windows activation -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/prepare-for-windows-deployment-with-mdt-2013.md b/windows/deploy/prepare-for-windows-deployment-with-mdt-2013.md index a7b98b2ab3..8f2bbad1b9 100644 --- a/windows/deploy/prepare-for-windows-deployment-with-mdt-2013.md +++ b/windows/deploy/prepare-for-windows-deployment-with-mdt-2013.md @@ -3,7 +3,7 @@ title: Prepare for deployment with MDT 2013 Update 2 (Windows 10) description: This topic will walk you through the steps necessary to create the server structure required to deploy the Windows 10 operating system using the Microsoft Deployment Toolkit (MDT) 2013 Update 2. ms.assetid: 5103c418-0c61-414b-b93c-a8e8207d1226 keywords: deploy, system requirements -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md b/windows/deploy/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md index d9735f4ee1..88a8cac968 100644 --- a/windows/deploy/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md +++ b/windows/deploy/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md @@ -2,8 +2,8 @@ title: Prepare for Zero Touch Installation of Windows 10 with Configuration Manager (Windows 10) description: This topic will walk you through the process of integrating Microsoft System Center 2012 R2 Configuration Manager SP1 with Microsoft Deployment Toolkit (MDT) 2013 Update 2, as well as the other preparations needed to deploying Windows 10 via Zero Touch Installation. Additional preparations include the installation of hotfixes as well as activities that speed up the Pre-Boot Execution Environment (PXE). ms.assetid: 06e3a221-31ef-47a5-b4da-3b927cb50d08 -keywords: ["install, configure, deploy, deployment"] -ms.prod: W10 +keywords: install, configure, deploy, deployment +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus diff --git a/windows/deploy/proxy-activation-vamt.md b/windows/deploy/proxy-activation-vamt.md index c848bcd8ab..ab273007b8 100644 --- a/windows/deploy/proxy-activation-vamt.md +++ b/windows/deploy/proxy-activation-vamt.md @@ -2,7 +2,7 @@ title: Perform Proxy Activation (Windows 10) description: Perform Proxy Activation ms.assetid: 35a919ed-f1cc-4d10-9c88-9bd634549dc3 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md b/windows/deploy/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md index 7d5143cf31..68b0a74563 100644 --- a/windows/deploy/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md +++ b/windows/deploy/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md @@ -2,8 +2,8 @@ title: Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager (Windows 10) description: This topic will show you how to use a previously created task sequence to refresh a Windows 7 SP1 client with Windows 10 using Microsoft System Center 2012 R2 Configuration Manager and Microsoft Deployment Toolkit (MDT) 2013 Update 2. ms.assetid: 57c81667-1019-4711-b3de-15ae9c5387c7 -keywords: ["upgrade, install, installation, computer refresh"] -ms.prod: W10 +keywords: upgrade, install, installation, computer refresh +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus diff --git a/windows/deploy/refresh-a-windows-7-computer-with-windows-10.md b/windows/deploy/refresh-a-windows-7-computer-with-windows-10.md index 70dadf1711..f6ea4a2125 100644 --- a/windows/deploy/refresh-a-windows-7-computer-with-windows-10.md +++ b/windows/deploy/refresh-a-windows-7-computer-with-windows-10.md @@ -3,7 +3,7 @@ title: Refresh a Windows 7 computer with Windows 10 (Windows 10) description: This topic will show you how to use MDT 2013 Update 2 Lite Touch Installation (LTI) to upgrade a Windows 7 computer to a Windows 10 computer using the computer refresh process. ms.assetid: 2866fb3c-4909-4c25-b083-6fc1f7869f6f keywords: reinstallation, customize, template, script, restore -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/remove-products-vamt.md b/windows/deploy/remove-products-vamt.md index 8dca272b68..da875ea27e 100644 --- a/windows/deploy/remove-products-vamt.md +++ b/windows/deploy/remove-products-vamt.md @@ -2,7 +2,7 @@ title: Remove Products (Windows 10) description: Remove Products ms.assetid: 4d44379e-dda1-4a8f-8ebf-395b6c0dad8e -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md b/windows/deploy/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md index 44bc003fca..b9f521531f 100644 --- a/windows/deploy/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md +++ b/windows/deploy/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md @@ -2,8 +2,8 @@ title: Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager (Windows 10) description: In this topic, you will learn how to replacing a Windows 7 SP1 computer using Microsoft System Center 2012 R2 Configuration Manager. ms.assetid: 3c8a2d53-8f08-475f-923a-bca79ca8ac36 -keywords: ["upgrade, install, installation, replace computer, setup"] -ms.prod: W10 +keywords: upgrade, install, installation, replace computer, setup +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus diff --git a/windows/deploy/replace-a-windows-7-computer-with-a-windows-10-computer.md b/windows/deploy/replace-a-windows-7-computer-with-a-windows-10-computer.md index bc78de5970..a862edf501 100644 --- a/windows/deploy/replace-a-windows-7-computer-with-a-windows-10-computer.md +++ b/windows/deploy/replace-a-windows-7-computer-with-a-windows-10-computer.md @@ -3,7 +3,7 @@ title: Replace a Windows 7 computer with a Windows 10 computer (Windows 10) description: A computer replace scenario for Windows 10 is quite similar to a computer refresh for Windows 10; however, because you are replacing a machine, you cannot store the backup on the old computer. ms.assetid: acf091c9-f8f4-4131-9845-625691c09a2a keywords: deploy, deployment, replace -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/scenario-kms-activation-vamt.md b/windows/deploy/scenario-kms-activation-vamt.md index a43796b90b..385af084f9 100644 --- a/windows/deploy/scenario-kms-activation-vamt.md +++ b/windows/deploy/scenario-kms-activation-vamt.md @@ -2,7 +2,7 @@ title: Scenario 3 KMS Client Activation (Windows 10) description: Scenario 3 KMS Client Activation ms.assetid: 72b04e8f-cd35-490c-91ab-27ea799b05d0 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/scenario-online-activation-vamt.md b/windows/deploy/scenario-online-activation-vamt.md index 69d308ee9c..41dda833ac 100644 --- a/windows/deploy/scenario-online-activation-vamt.md +++ b/windows/deploy/scenario-online-activation-vamt.md @@ -2,7 +2,7 @@ title: Scenario 1 Online Activation (Windows 10) description: Scenario 1 Online Activation ms.assetid: 94dba40e-383a-41e4-b74b-9e884facdfd3 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/scenario-proxy-activation-vamt.md b/windows/deploy/scenario-proxy-activation-vamt.md index 8666ae35c6..2e475d02b4 100644 --- a/windows/deploy/scenario-proxy-activation-vamt.md +++ b/windows/deploy/scenario-proxy-activation-vamt.md @@ -2,7 +2,7 @@ title: Scenario 2 Proxy Activation (Windows 10) description: Scenario 2 Proxy Activation ms.assetid: ed5a8a56-d9aa-4895-918f-dd1898cb2c1a -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/set-up-mdt-2013-for-bitlocker.md b/windows/deploy/set-up-mdt-2013-for-bitlocker.md index 5af8715c60..7a76f8cdf7 100644 --- a/windows/deploy/set-up-mdt-2013-for-bitlocker.md +++ b/windows/deploy/set-up-mdt-2013-for-bitlocker.md @@ -3,7 +3,7 @@ title: Set up MDT for BitLocker (Windows 10) ms.assetid: 386e6713-5c20-4d2a-a220-a38d94671a38 description: keywords: disk, encryption, TPM, configure, secure, script -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/sideload-apps-in-windows-10.md b/windows/deploy/sideload-apps-in-windows-10.md index 63f3fe6fef..9af7d4e4bc 100644 --- a/windows/deploy/sideload-apps-in-windows-10.md +++ b/windows/deploy/sideload-apps-in-windows-10.md @@ -2,10 +2,10 @@ title: Sideload LOB apps in Windows 10 (Windows 10) description: Sideload line-of-business apps in Windows 10. ms.assetid: C46B27D0-375B-4F7A-800E-21595CF1D53D -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Sideload LOB apps in Windows 10 diff --git a/windows/deploy/simulate-a-windows-10-deployment-in-a-test-environment.md b/windows/deploy/simulate-a-windows-10-deployment-in-a-test-environment.md index a8391582fa..a6c8789efb 100644 --- a/windows/deploy/simulate-a-windows-10-deployment-in-a-test-environment.md +++ b/windows/deploy/simulate-a-windows-10-deployment-in-a-test-environment.md @@ -3,7 +3,7 @@ title: Simulate a Windows 10 deployment in a test environment (Windows 10) description: This topic will walk you through the process of creating a simulated environment on which to test your Windows 10 deployment using MDT. ms.assetid: 2de86c55-ced9-4078-b280-35e0329aea9c keywords: deploy, script -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/understanding-migration-xml-files.md b/windows/deploy/understanding-migration-xml-files.md index 528c77f8d3..c03bc14e24 100644 --- a/windows/deploy/understanding-migration-xml-files.md +++ b/windows/deploy/understanding-migration-xml-files.md @@ -2,10 +2,10 @@ title: Understanding Migration XML Files (Windows 10) description: Understanding Migration XML Files ms.assetid: d3d1fe89-085c-4da8-9657-fd54b8bfc4b7 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Understanding Migration XML Files diff --git a/windows/deploy/update-product-status-vamt.md b/windows/deploy/update-product-status-vamt.md index deca904c0c..0e7af45fec 100644 --- a/windows/deploy/update-product-status-vamt.md +++ b/windows/deploy/update-product-status-vamt.md @@ -2,7 +2,7 @@ title: Update Product Status (Windows 10) description: Update Product Status ms.assetid: 39d4abd4-801a-4e8f-9b8c-425a24a96764 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/update-windows-10-images-with-provisioning-packages.md b/windows/deploy/update-windows-10-images-with-provisioning-packages.md index 4a553d8b90..e9415d414b 100644 --- a/windows/deploy/update-windows-10-images-with-provisioning-packages.md +++ b/windows/deploy/update-windows-10-images-with-provisioning-packages.md @@ -2,8 +2,8 @@ title: Update Windows 10 images with provisioning packages (Windows 10) description: Use a provisioning package to apply settings, profiles, and file assets to a Windows 10 image. ms.assetid: 3CA345D2-B60A-4860-A3BF-174713C3D3A6 -keywords: ["provisioning", "bulk deployment", "image"] -ms.prod: W10 +keywords: provisioning, bulk deployment, image +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: jdeckerMS diff --git a/windows/deploy/upgrade-to-windows-10-with-system-center-configuraton-manager.md b/windows/deploy/upgrade-to-windows-10-with-system-center-configuraton-manager.md index 030ab711f2..0f66363610 100644 --- a/windows/deploy/upgrade-to-windows-10-with-system-center-configuraton-manager.md +++ b/windows/deploy/upgrade-to-windows-10-with-system-center-configuraton-manager.md @@ -2,8 +2,8 @@ title: Upgrade to Windows 10 with System Center Configuration Manager (Windows 10) description: The simplest path to upgrade PCs currently running Windows 7, Windows 8, or Windows 8.1 to Windows 10 is through an in-place upgrade. You can use a System Center Configuration Manager task sequence to completely automate the process. ms.assetid: F8DF6191-0DB0-4EF5-A9B1-6A11D5DE4878 -keywords: ["upgrade, update, task sequence, deploy"] -ms.prod: W10 +keywords: upgrade, update, task sequence, deploy +ms.prod: w10 ms.mktglfcycl: deploy author: mtniehaus --- diff --git a/windows/deploy/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md b/windows/deploy/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md index 35b90474ab..18dfaf7fdf 100644 --- a/windows/deploy/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md +++ b/windows/deploy/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md @@ -3,7 +3,7 @@ title: Upgrade to Windows 10 with the Microsoft Deployment Toolkit (Windows 10) description: The simplest path to upgrade PCs that are currently running Windows 7, Windows 8, or Windows 8.1 to Windows 10 is through an in-place upgrade. ms.assetid: B8993151-3C1E-4F22-93F4-2C5F2771A460 keywords: upgrade, update, task sequence, deploy -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/use-orchestrator-runbooks-with-mdt-2013.md b/windows/deploy/use-orchestrator-runbooks-with-mdt-2013.md index 229fb16df0..64e70ced04 100644 --- a/windows/deploy/use-orchestrator-runbooks-with-mdt-2013.md +++ b/windows/deploy/use-orchestrator-runbooks-with-mdt-2013.md @@ -3,7 +3,7 @@ title: Use Orchestrator runbooks with MDT (Windows 10) description: This topic will show you how to integrate Microsoft System Center 2012 R2 Orchestrator with MDT to replace the existing web services that are used in deployment solutions. ms.assetid: 68302780-1f6f-4a9c-9407-b14371fdce3f keywords: web services, database -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mdt diff --git a/windows/deploy/use-the-mdt-database-to-stage-windows-10-deployment-information.md b/windows/deploy/use-the-mdt-database-to-stage-windows-10-deployment-information.md index 14749270e7..32208d3e25 100644 --- a/windows/deploy/use-the-mdt-database-to-stage-windows-10-deployment-information.md +++ b/windows/deploy/use-the-mdt-database-to-stage-windows-10-deployment-information.md @@ -4,7 +4,7 @@ description: This topic is designed to teach you how to use the MDT database to ms.assetid: 8956ab54-90ba-45d3-a384-4fdec72c4d46 ms.pagetype: mdt keywords: database, permissions, settings, configure, deploy -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus diff --git a/windows/deploy/use-the-volume-activation-management-tool-client.md b/windows/deploy/use-the-volume-activation-management-tool-client.md index 4303bd18a1..1e4f5c32b2 100644 --- a/windows/deploy/use-the-volume-activation-management-tool-client.md +++ b/windows/deploy/use-the-volume-activation-management-tool-client.md @@ -3,7 +3,7 @@ title: Use the Volume Activation Management Tool (Windows 10) description: The Volume Activation Management Tool (VAMT) provides several useful features, including the ability to perform VAMT proxy activation and to track and monitor several types of product keys. ms.assetid: b11f0aee-7b60-44d1-be40-c960fc6c4c47 keywords: vamt, volume activation, activation, windows activation -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/use-vamt-in-windows-powershell.md b/windows/deploy/use-vamt-in-windows-powershell.md index 1247d95759..01de72d0a6 100644 --- a/windows/deploy/use-vamt-in-windows-powershell.md +++ b/windows/deploy/use-vamt-in-windows-powershell.md @@ -2,7 +2,7 @@ title: Use VAMT in Windows PowerShell (Windows 10) description: Use VAMT in Windows PowerShell ms.assetid: 13e0ceec-d827-4681-a5c3-8704349e3ba9 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/use-web-services-in-mdt-2013.md b/windows/deploy/use-web-services-in-mdt-2013.md index 6fbe628335..1d8755df14 100644 --- a/windows/deploy/use-web-services-in-mdt-2013.md +++ b/windows/deploy/use-web-services-in-mdt-2013.md @@ -3,7 +3,7 @@ title: Use web services in MDT (Windows 10) description: In this topic, you will learn how to create a simple web service that generates computer names and then configure MDT to use that service during your Windows 10 deployment. ms.assetid: 8f47535e-0551-4ccb-8f02-bb97539c6522 keywords: deploy, web apps -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.pagetype: mdt ms.sitesec: library diff --git a/windows/deploy/usmt-best-practices.md b/windows/deploy/usmt-best-practices.md index b8772fe9f4..8da6b08353 100644 --- a/windows/deploy/usmt-best-practices.md +++ b/windows/deploy/usmt-best-practices.md @@ -2,10 +2,10 @@ title: USMT Best Practices (Windows 10) description: USMT Best Practices ms.assetid: e3cb1e78-4230-4eae-b179-e6e9160542d2 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # USMT Best Practices diff --git a/windows/deploy/usmt-choose-migration-store-type.md b/windows/deploy/usmt-choose-migration-store-type.md index 3e3f520ceb..5938b48748 100644 --- a/windows/deploy/usmt-choose-migration-store-type.md +++ b/windows/deploy/usmt-choose-migration-store-type.md @@ -2,10 +2,10 @@ title: Choose a Migration Store Type (Windows 10) description: Choose a Migration Store Type ms.assetid: 4e163e90-9c57-490b-b849-2ed52ab6765f -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Choose a Migration Store Type diff --git a/windows/deploy/usmt-command-line-syntax.md b/windows/deploy/usmt-command-line-syntax.md index 8e62c88e30..22cf9c33aa 100644 --- a/windows/deploy/usmt-command-line-syntax.md +++ b/windows/deploy/usmt-command-line-syntax.md @@ -2,10 +2,10 @@ title: User State Migration Tool (USMT) Command-line Syntax (Windows 10) description: User State Migration Tool (USMT) Command-line Syntax ms.assetid: f9d205c9-e824-46c7-8d8b-d7e4b52fd514 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # User State Migration Tool (USMT) Command-line Syntax diff --git a/windows/deploy/usmt-common-issues.md b/windows/deploy/usmt-common-issues.md index d1865b8873..88980d6d7b 100644 --- a/windows/deploy/usmt-common-issues.md +++ b/windows/deploy/usmt-common-issues.md @@ -2,10 +2,10 @@ title: Common Issues (Windows 10) description: Common Issues ms.assetid: 5a37e390-8617-4768-9eee-50397fbbb2e1 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Common Issues diff --git a/windows/deploy/usmt-common-migration-scenarios.md b/windows/deploy/usmt-common-migration-scenarios.md index dd61667933..9262ef9b0f 100644 --- a/windows/deploy/usmt-common-migration-scenarios.md +++ b/windows/deploy/usmt-common-migration-scenarios.md @@ -2,10 +2,10 @@ title: Common Migration Scenarios (Windows 10) description: Common Migration Scenarios ms.assetid: 1d8170d5-e775-4963-b7a5-b55e8987c1e4 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Common Migration Scenarios diff --git a/windows/deploy/usmt-configxml-file.md b/windows/deploy/usmt-configxml-file.md index dea99cd9e0..4484c03e2d 100644 --- a/windows/deploy/usmt-configxml-file.md +++ b/windows/deploy/usmt-configxml-file.md @@ -2,10 +2,10 @@ title: Config.xml File (Windows 10) description: Config.xml File ms.assetid: 9dc98e76-5155-4641-bcb3-81915db538e8 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Config.xml File diff --git a/windows/deploy/usmt-conflicts-and-precedence.md b/windows/deploy/usmt-conflicts-and-precedence.md index 9de02f7dca..3b570d51e5 100644 --- a/windows/deploy/usmt-conflicts-and-precedence.md +++ b/windows/deploy/usmt-conflicts-and-precedence.md @@ -2,10 +2,10 @@ title: Conflicts and Precedence (Windows 10) description: Conflicts and Precedence ms.assetid: 0e2691a8-ff1e-4424-879b-4d5a2f8a113a -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Conflicts and Precedence diff --git a/windows/deploy/usmt-custom-xml-examples.md b/windows/deploy/usmt-custom-xml-examples.md index c1fa2bd582..4d60c4903c 100644 --- a/windows/deploy/usmt-custom-xml-examples.md +++ b/windows/deploy/usmt-custom-xml-examples.md @@ -2,10 +2,10 @@ title: Custom XML Examples (Windows 10) description: Custom XML Examples ms.assetid: 48f441d9-6c66-43ef-91e9-7c78cde6fcc0 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Custom XML Examples diff --git a/windows/deploy/usmt-customize-xml-files.md b/windows/deploy/usmt-customize-xml-files.md index 94619ce485..30930f05ad 100644 --- a/windows/deploy/usmt-customize-xml-files.md +++ b/windows/deploy/usmt-customize-xml-files.md @@ -2,10 +2,10 @@ title: Customize USMT XML Files (Windows 10) description: Customize USMT XML Files ms.assetid: d58363c1-fd13-4f65-8b91-9986659dc93e -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Customize USMT XML Files diff --git a/windows/deploy/usmt-determine-what-to-migrate.md b/windows/deploy/usmt-determine-what-to-migrate.md index 24c81b0742..27ad2ea86d 100644 --- a/windows/deploy/usmt-determine-what-to-migrate.md +++ b/windows/deploy/usmt-determine-what-to-migrate.md @@ -2,10 +2,10 @@ title: Determine What to Migrate (Windows 10) description: Determine What to Migrate ms.assetid: 01ae1d13-c3eb-4618-b39d-ee5d18d55761 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Determine What to Migrate diff --git a/windows/deploy/usmt-estimate-migration-store-size.md b/windows/deploy/usmt-estimate-migration-store-size.md index 1dbd440416..a331a99c09 100644 --- a/windows/deploy/usmt-estimate-migration-store-size.md +++ b/windows/deploy/usmt-estimate-migration-store-size.md @@ -2,10 +2,10 @@ title: Estimate Migration Store Size (Windows 10) description: Estimate Migration Store Size ms.assetid: cfb9062b-7a2a-467a-a24e-0b31ce830093 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Estimate Migration Store Size diff --git a/windows/deploy/usmt-exclude-files-and-settings.md b/windows/deploy/usmt-exclude-files-and-settings.md index 99918b8c5c..e856679334 100644 --- a/windows/deploy/usmt-exclude-files-and-settings.md +++ b/windows/deploy/usmt-exclude-files-and-settings.md @@ -2,10 +2,10 @@ title: Exclude Files and Settings (Windows 10) description: Exclude Files and Settings ms.assetid: df85baf1-6e29-4995-a4bb-ba3f8f7fed0b -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Exclude Files and Settings diff --git a/windows/deploy/usmt-extract-files-from-a-compressed-migration-store.md b/windows/deploy/usmt-extract-files-from-a-compressed-migration-store.md index 8bd8e87680..c679d58b27 100644 --- a/windows/deploy/usmt-extract-files-from-a-compressed-migration-store.md +++ b/windows/deploy/usmt-extract-files-from-a-compressed-migration-store.md @@ -2,10 +2,10 @@ title: Extract Files from a Compressed USMT Migration Store (Windows 10) description: Extract Files from a Compressed USMT Migration Store ms.assetid: ad9fbd6e-f89e-4444-8538-9b11566b1f33 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Extract Files from a Compressed USMT Migration Store diff --git a/windows/deploy/usmt-faq.md b/windows/deploy/usmt-faq.md index e69272bc26..715340a82d 100644 --- a/windows/deploy/usmt-faq.md +++ b/windows/deploy/usmt-faq.md @@ -2,10 +2,10 @@ title: Frequently Asked Questions (Windows 10) description: Frequently Asked Questions ms.assetid: 813c13a7-6818-4e6e-9284-7ee49493241b -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Frequently Asked Questions diff --git a/windows/deploy/usmt-general-conventions.md b/windows/deploy/usmt-general-conventions.md index ab6c9ad6b3..020557c402 100644 --- a/windows/deploy/usmt-general-conventions.md +++ b/windows/deploy/usmt-general-conventions.md @@ -2,10 +2,10 @@ title: General Conventions (Windows 10) description: General Conventions ms.assetid: 5761986e-a847-41bd-bf8e-7c1bd01acbc6 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # General Conventions diff --git a/windows/deploy/usmt-hard-link-migration-store.md b/windows/deploy/usmt-hard-link-migration-store.md index afddeaf45d..e65487a0bd 100644 --- a/windows/deploy/usmt-hard-link-migration-store.md +++ b/windows/deploy/usmt-hard-link-migration-store.md @@ -2,10 +2,10 @@ title: Hard-Link Migration Store (Windows 10) description: Hard-Link Migration Store ms.assetid: b0598418-4607-4952-bfa3-b6e4aaa2c574 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Hard-Link Migration Store diff --git a/windows/deploy/usmt-how-it-works.md b/windows/deploy/usmt-how-it-works.md index 8e6b12231e..0c274924a6 100644 --- a/windows/deploy/usmt-how-it-works.md +++ b/windows/deploy/usmt-how-it-works.md @@ -2,10 +2,10 @@ title: How USMT Works (Windows 10) description: How USMT Works ms.assetid: 5c8bd669-9e1e-473d-81e6-652f40b24171 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # How USMT Works diff --git a/windows/deploy/usmt-how-to.md b/windows/deploy/usmt-how-to.md index 4baa318509..1a22d71262 100644 --- a/windows/deploy/usmt-how-to.md +++ b/windows/deploy/usmt-how-to.md @@ -2,10 +2,10 @@ title: User State Migration Tool (USMT) How-to topics (Windows 10) description: User State Migration Tool (USMT) How-to topics ms.assetid: 7b9a2f2a-a43a-4984-9746-a767f9f1c7e3 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # User State Migration Tool (USMT) How-to topics diff --git a/windows/deploy/usmt-identify-application-settings.md b/windows/deploy/usmt-identify-application-settings.md index ca14712f31..5fa216f2b3 100644 --- a/windows/deploy/usmt-identify-application-settings.md +++ b/windows/deploy/usmt-identify-application-settings.md @@ -2,10 +2,10 @@ title: Identify Applications Settings (Windows 10) description: Identify Applications Settings ms.assetid: eda68031-9b02-4a5b-a893-3786a6505381 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Identify Applications Settings diff --git a/windows/deploy/usmt-identify-file-types-files-and-folders.md b/windows/deploy/usmt-identify-file-types-files-and-folders.md index 3ab8ded02b..49766ca745 100644 --- a/windows/deploy/usmt-identify-file-types-files-and-folders.md +++ b/windows/deploy/usmt-identify-file-types-files-and-folders.md @@ -2,10 +2,10 @@ title: Identify File Types, Files, and Folders (Windows 10) description: Identify File Types, Files, and Folders ms.assetid: 93bb2a33-c126-4f7a-a961-6c89686d54e0 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Identify File Types, Files, and Folders diff --git a/windows/deploy/usmt-identify-operating-system-settings.md b/windows/deploy/usmt-identify-operating-system-settings.md index 232fabdc33..27fd8c0c25 100644 --- a/windows/deploy/usmt-identify-operating-system-settings.md +++ b/windows/deploy/usmt-identify-operating-system-settings.md @@ -2,10 +2,10 @@ title: Identify Operating System Settings (Windows 10) description: Identify Operating System Settings ms.assetid: 1704ab18-1765-41fb-a27c-3aa3128fa242 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Identify Operating System Settings diff --git a/windows/deploy/usmt-identify-users.md b/windows/deploy/usmt-identify-users.md index 1f23cb942d..6d081727c3 100644 --- a/windows/deploy/usmt-identify-users.md +++ b/windows/deploy/usmt-identify-users.md @@ -2,10 +2,10 @@ title: Identify Users (Windows 10) description: Identify Users ms.assetid: 957a4fe9-79fd-44a2-8c26-33e50f71f9de -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Identify Users diff --git a/windows/deploy/usmt-include-files-and-settings.md b/windows/deploy/usmt-include-files-and-settings.md index 6142749d13..411525684e 100644 --- a/windows/deploy/usmt-include-files-and-settings.md +++ b/windows/deploy/usmt-include-files-and-settings.md @@ -2,10 +2,10 @@ title: Include Files and Settings (Windows 10) description: Include Files and Settings ms.assetid: 9009c6a5-0612-4478-8742-abe5eb6cbac8 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Include Files and Settings diff --git a/windows/deploy/usmt-loadstate-syntax.md b/windows/deploy/usmt-loadstate-syntax.md index a82a0b4357..36c3dfb311 100644 --- a/windows/deploy/usmt-loadstate-syntax.md +++ b/windows/deploy/usmt-loadstate-syntax.md @@ -2,10 +2,10 @@ title: LoadState Syntax (Windows 10) description: LoadState Syntax ms.assetid: 53d2143b-cbe9-4cfc-8506-36e9d429f6d4 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # LoadState Syntax diff --git a/windows/deploy/usmt-log-files.md b/windows/deploy/usmt-log-files.md index 89fc388cf9..9796591745 100644 --- a/windows/deploy/usmt-log-files.md +++ b/windows/deploy/usmt-log-files.md @@ -2,10 +2,10 @@ title: Log Files (Windows 10) description: Log Files ms.assetid: 28185ebd-630a-4bbd-94f4-8c48aad05649 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Log Files diff --git a/windows/deploy/usmt-migrate-efs-files-and-certificates.md b/windows/deploy/usmt-migrate-efs-files-and-certificates.md index 43a57ddc5d..d4e2db536f 100644 --- a/windows/deploy/usmt-migrate-efs-files-and-certificates.md +++ b/windows/deploy/usmt-migrate-efs-files-and-certificates.md @@ -2,10 +2,10 @@ title: Migrate EFS Files and Certificates (Windows 10) description: Migrate EFS Files and Certificates ms.assetid: 7f19a753-ec45-4433-b297-cc30f16fdee1 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Migrate EFS Files and Certificates diff --git a/windows/deploy/usmt-migrate-user-accounts.md b/windows/deploy/usmt-migrate-user-accounts.md index 25c9490cbc..6c87c9b043 100644 --- a/windows/deploy/usmt-migrate-user-accounts.md +++ b/windows/deploy/usmt-migrate-user-accounts.md @@ -2,10 +2,10 @@ title: Migrate User Accounts (Windows 10) description: Migrate User Accounts ms.assetid: a3668361-43c8-4fd2-b26e-9a2deaeaeb09 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Migrate User Accounts diff --git a/windows/deploy/usmt-migration-store-encryption.md b/windows/deploy/usmt-migration-store-encryption.md index bb6343401f..1e8ea1a8e0 100644 --- a/windows/deploy/usmt-migration-store-encryption.md +++ b/windows/deploy/usmt-migration-store-encryption.md @@ -2,10 +2,10 @@ title: Migration Store Encryption (Windows 10) description: Migration Store Encryption ms.assetid: b28c2657-b986-4487-bd38-cb81500b831d -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Migration Store Encryption diff --git a/windows/deploy/usmt-overview.md b/windows/deploy/usmt-overview.md index f3d7f0b860..928044a3cf 100644 --- a/windows/deploy/usmt-overview.md +++ b/windows/deploy/usmt-overview.md @@ -2,10 +2,10 @@ title: User State Migration Tool (USMT) Overview (Windows 10) description: User State Migration Tool (USMT) Overview ms.assetid: 3b649431-ad09-4b17-895a-3fec7ac0a81f -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # User State Migration Tool (USMT) Overview diff --git a/windows/deploy/usmt-plan-your-migration.md b/windows/deploy/usmt-plan-your-migration.md index eaed479359..2b6ce76d7f 100644 --- a/windows/deploy/usmt-plan-your-migration.md +++ b/windows/deploy/usmt-plan-your-migration.md @@ -2,10 +2,10 @@ title: Plan Your Migration (Windows 10) description: Plan Your Migration ms.assetid: c951f7df-850e-47ad-b31b-87f902955e3e -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Plan Your Migration diff --git a/windows/deploy/usmt-recognized-environment-variables.md b/windows/deploy/usmt-recognized-environment-variables.md index 8246122fd9..edebf602f1 100644 --- a/windows/deploy/usmt-recognized-environment-variables.md +++ b/windows/deploy/usmt-recognized-environment-variables.md @@ -2,10 +2,10 @@ title: Recognized Environment Variables (Windows 10) description: Recognized Environment Variables ms.assetid: 2b0ac412-e131-456e-8f0c-c26249b5f3df -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Recognized Environment Variables diff --git a/windows/deploy/usmt-reference.md b/windows/deploy/usmt-reference.md index ffe3b71ef8..753146d6b9 100644 --- a/windows/deploy/usmt-reference.md +++ b/windows/deploy/usmt-reference.md @@ -2,10 +2,10 @@ title: User State Migration Toolkit (USMT) Reference (Windows 10) description: User State Migration Toolkit (USMT) Reference ms.assetid: 2135dbcf-de49-4cea-b2fb-97dd016e1a1a -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # User State Migration Toolkit (USMT) Reference diff --git a/windows/deploy/usmt-requirements.md b/windows/deploy/usmt-requirements.md index ace2abc84a..c8632b0b4a 100644 --- a/windows/deploy/usmt-requirements.md +++ b/windows/deploy/usmt-requirements.md @@ -2,10 +2,10 @@ title: USMT Requirements (Windows 10) description: USMT Requirements ms.assetid: 2b0cf3a3-9032-433f-9622-1f9df59d6806 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # USMT Requirements diff --git a/windows/deploy/usmt-reroute-files-and-settings.md b/windows/deploy/usmt-reroute-files-and-settings.md index a948ee7c8c..99dd2eb09c 100644 --- a/windows/deploy/usmt-reroute-files-and-settings.md +++ b/windows/deploy/usmt-reroute-files-and-settings.md @@ -2,10 +2,10 @@ title: Reroute Files and Settings (Windows 10) description: Reroute Files and Settings ms.assetid: 905e6a24-922c-4549-9732-60fa11862a6c -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Reroute Files and Settings diff --git a/windows/deploy/usmt-resources.md b/windows/deploy/usmt-resources.md index 0cb115c915..cc268ff816 100644 --- a/windows/deploy/usmt-resources.md +++ b/windows/deploy/usmt-resources.md @@ -2,10 +2,10 @@ title: USMT Resources (Windows 10) description: USMT Resources ms.assetid: a0b266c7-4bcb-49f1-b63c-48c6ace86b43 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # USMT Resources diff --git a/windows/deploy/usmt-return-codes.md b/windows/deploy/usmt-return-codes.md index 4354a11ca8..365b49b5c7 100644 --- a/windows/deploy/usmt-return-codes.md +++ b/windows/deploy/usmt-return-codes.md @@ -2,10 +2,10 @@ title: Return Codes (Windows 10) description: Return Codes ms.assetid: e71bbc6b-d5a6-4e48-ad01-af0012b35f22 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Return Codes diff --git a/windows/deploy/usmt-scanstate-syntax.md b/windows/deploy/usmt-scanstate-syntax.md index ff2636ee8c..5083385534 100644 --- a/windows/deploy/usmt-scanstate-syntax.md +++ b/windows/deploy/usmt-scanstate-syntax.md @@ -2,10 +2,10 @@ title: ScanState Syntax (Windows 10) description: ScanState Syntax ms.assetid: 004c755f-33db-49e4-8a3b-37beec1480ea -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # ScanState Syntax diff --git a/windows/deploy/usmt-technical-reference.md b/windows/deploy/usmt-technical-reference.md index 232f27f2fa..5bdf666976 100644 --- a/windows/deploy/usmt-technical-reference.md +++ b/windows/deploy/usmt-technical-reference.md @@ -2,10 +2,10 @@ title: User State Migration Tool (USMT) Technical Reference (Windows 10) description: The User State Migration Tool (USMT) 10.0 is included with the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10. USMT provides a highly customizable user-profile migration experience for IT professionals. ms.assetid: f90bf58b-5529-4520-a9f8-b6cb4e4d3add -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # User State Migration Tool (USMT) Technical Reference diff --git a/windows/deploy/usmt-test-your-migration.md b/windows/deploy/usmt-test-your-migration.md index 05e999a34d..e460f17de8 100644 --- a/windows/deploy/usmt-test-your-migration.md +++ b/windows/deploy/usmt-test-your-migration.md @@ -2,10 +2,10 @@ title: Test Your Migration (Windows 10) description: Test Your Migration ms.assetid: 754af276-8386-4eac-8079-3d1e45964a0d -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Test Your Migration diff --git a/windows/deploy/usmt-topics.md b/windows/deploy/usmt-topics.md index a58a88b007..4fe5cace86 100644 --- a/windows/deploy/usmt-topics.md +++ b/windows/deploy/usmt-topics.md @@ -2,10 +2,10 @@ title: User State Migration Tool (USMT) Overview Topics (Windows 10) description: User State Migration Tool (USMT) Overview Topics ms.assetid: 23170271-130b-416f-a7a7-c2f6adc32eee -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # User State Migration Tool (USMT) Overview Topics diff --git a/windows/deploy/usmt-troubleshooting.md b/windows/deploy/usmt-troubleshooting.md index 576f9801c9..33296077f4 100644 --- a/windows/deploy/usmt-troubleshooting.md +++ b/windows/deploy/usmt-troubleshooting.md @@ -2,10 +2,10 @@ title: User State Migration Tool (USMT) Troubleshooting (Windows 10) description: User State Migration Tool (USMT) Troubleshooting ms.assetid: 770f45bb-2284-463f-a29c-69c04f437533 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # User State Migration Tool (USMT) Troubleshooting diff --git a/windows/deploy/usmt-utilities.md b/windows/deploy/usmt-utilities.md index eb9081b082..08df5661f2 100644 --- a/windows/deploy/usmt-utilities.md +++ b/windows/deploy/usmt-utilities.md @@ -2,10 +2,10 @@ title: UsmtUtils Syntax (Windows 10) description: UsmtUtils Syntax ms.assetid: cdab7f2d-dd68-4016-b9ed-41ffa743b65c -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # UsmtUtils Syntax diff --git a/windows/deploy/usmt-what-does-usmt-migrate.md b/windows/deploy/usmt-what-does-usmt-migrate.md index 83b3851c29..89ba8aa60b 100644 --- a/windows/deploy/usmt-what-does-usmt-migrate.md +++ b/windows/deploy/usmt-what-does-usmt-migrate.md @@ -2,10 +2,10 @@ title: What Does USMT Migrate (Windows 10) description: What Does USMT Migrate ms.assetid: f613987d-0f17-43fe-9717-6465865ceda7 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # What Does USMT Migrate? diff --git a/windows/deploy/usmt-xml-elements-library.md b/windows/deploy/usmt-xml-elements-library.md index 87ffc8c9c3..f4f412fc2a 100644 --- a/windows/deploy/usmt-xml-elements-library.md +++ b/windows/deploy/usmt-xml-elements-library.md @@ -2,10 +2,10 @@ title: XML Elements Library (Windows 10) description: XML Elements Library ms.assetid: f5af0f6d-c3bf-4a4c-a0ca-9db7985f954f -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # XML Elements Library diff --git a/windows/deploy/usmt-xml-reference.md b/windows/deploy/usmt-xml-reference.md index 49d7403f8f..4023b52759 100644 --- a/windows/deploy/usmt-xml-reference.md +++ b/windows/deploy/usmt-xml-reference.md @@ -2,10 +2,10 @@ title: USMT XML Reference (Windows 10) description: USMT XML Reference ms.assetid: fb946975-0fee-4ec0-b3ef-7c34945ee96f -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # USMT XML Reference diff --git a/windows/deploy/vamt-known-issues.md b/windows/deploy/vamt-known-issues.md index 1e014a3e46..4aa2185e8f 100644 --- a/windows/deploy/vamt-known-issues.md +++ b/windows/deploy/vamt-known-issues.md @@ -2,7 +2,7 @@ title: VAMT Known Issues (Windows 10) description: VAMT Known Issues ms.assetid: 8992f1f3-830a-4ce7-a248-f3a6377ab77f -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/vamt-requirements.md b/windows/deploy/vamt-requirements.md index 9da49547b0..06a8615669 100644 --- a/windows/deploy/vamt-requirements.md +++ b/windows/deploy/vamt-requirements.md @@ -2,7 +2,7 @@ title: VAMT Requirements (Windows 10) description: VAMT Requirements ms.assetid: d14d152b-ab8a-43cb-a8fd-2279364007b9 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/vamt-step-by-step.md b/windows/deploy/vamt-step-by-step.md index e886684243..5582bd3417 100644 --- a/windows/deploy/vamt-step-by-step.md +++ b/windows/deploy/vamt-step-by-step.md @@ -2,7 +2,7 @@ title: VAMT Step-by-Step Scenarios (Windows 10) description: VAMT Step-by-Step Scenarios ms.assetid: 455c542c-4860-4b57-a1f0-7e2d28e11a10 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/verify-the-condition-of-a-compressed-migration-store.md b/windows/deploy/verify-the-condition-of-a-compressed-migration-store.md index 233beb97f0..ee16be2715 100644 --- a/windows/deploy/verify-the-condition-of-a-compressed-migration-store.md +++ b/windows/deploy/verify-the-condition-of-a-compressed-migration-store.md @@ -2,10 +2,10 @@ title: Verify the Condition of a Compressed Migration Store (Windows 10) description: Verify the Condition of a Compressed Migration Store ms.assetid: 4a3fda96-5f7d-494a-955f-6b865ec9fcae -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Verify the Condition of a Compressed Migration Store diff --git a/windows/deploy/volume-activation-management-tool.md b/windows/deploy/volume-activation-management-tool.md index 04af72f880..887c116352 100644 --- a/windows/deploy/volume-activation-management-tool.md +++ b/windows/deploy/volume-activation-management-tool.md @@ -2,7 +2,7 @@ title: Volume Activation Management Tool (VAMT) Technical Reference (Windows 10) description: The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office, and select other Microsoft products volume and retail-activation process. ms.assetid: 1df0f795-f41c-473b-850c-e98af1ad2f2a -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/volume-activation-windows-10.md b/windows/deploy/volume-activation-windows-10.md index e57043d4ca..eda56e2651 100644 --- a/windows/deploy/volume-activation-windows-10.md +++ b/windows/deploy/volume-activation-windows-10.md @@ -3,7 +3,7 @@ title: Volume Activation for Windows 10 (Windows 10) description: This guide is designed to help organizations that are planning to use volume activation to deploy and activate Windows 10, including organizations that have used volume activation for earlier versions of Windows. ms.assetid: 6e8cffae-7322-4fd3-882a-cde68187aef2 keywords: vamt, volume activation, activation, windows activation -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation diff --git a/windows/deploy/windows-10-deployment-scenarios.md b/windows/deploy/windows-10-deployment-scenarios.md index 54221f9de3..e76d648bb0 100644 --- a/windows/deploy/windows-10-deployment-scenarios.md +++ b/windows/deploy/windows-10-deployment-scenarios.md @@ -2,8 +2,8 @@ title: Windows 10 deployment scenarios (Windows 10) description: To successfully deploy the Windows 10 operating system in your organization, it is important to understand the different ways that it can be deployed, especially now that there are new scenarios to consider. ms.assetid: 7A29D546-52CC-482C-8870-8123C7DC04B5 -keywords: ["upgrade, in-place, configuration, deploy"] -ms.prod: W10 +keywords: upgrade, in-place, configuration, deploy +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus diff --git a/windows/deploy/windows-10-deployment-tools-reference.md b/windows/deploy/windows-10-deployment-tools-reference.md index e71eedae97..597900fb82 100644 --- a/windows/deploy/windows-10-deployment-tools-reference.md +++ b/windows/deploy/windows-10-deployment-tools-reference.md @@ -2,10 +2,10 @@ title: Windows 10 deployment tools reference (Windows 10) description: Learn about the tools available to deploy Windows 10. ms.assetid: 5C4B0AE3-B2D0-4628-9E73-606F3FAA17BB -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Windows 10 deployment tools reference diff --git a/windows/deploy/windows-10-edition-upgrades.md b/windows/deploy/windows-10-edition-upgrades.md index 72baf3a243..21981254a9 100644 --- a/windows/deploy/windows-10-edition-upgrades.md +++ b/windows/deploy/windows-10-edition-upgrades.md @@ -2,10 +2,10 @@ title: Windows 10 edition upgrade (Windows 10) description: With Windows 10, you can quickly upgrade from one edition of Windows 10 to another, provided the upgrade path is supported. ms.assetid: A7642E90-A3E7-4A25-8044-C4E402DC462A -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Windows 10 edition upgrade diff --git a/windows/deploy/windows-adk-scenarios-for-it-pros.md b/windows/deploy/windows-adk-scenarios-for-it-pros.md index 3fb2944f22..8821ada189 100644 --- a/windows/deploy/windows-adk-scenarios-for-it-pros.md +++ b/windows/deploy/windows-adk-scenarios-for-it-pros.md @@ -2,10 +2,10 @@ title: Windows ADK for Windows 10 scenarios for IT Pros (Windows 10) description: The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. ms.assetid: FC4EB39B-29BA-4920-87C2-A00D711AE48B -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Windows ADK for Windows 10 scenarios for IT Pros diff --git a/windows/deploy/windows-deployment-scenarios-and-tools.md b/windows/deploy/windows-deployment-scenarios-and-tools.md index a66deb1389..ba4f22b7c5 100644 --- a/windows/deploy/windows-deployment-scenarios-and-tools.md +++ b/windows/deploy/windows-deployment-scenarios-and-tools.md @@ -2,8 +2,8 @@ title: Windows 10 deployment tools (Windows 10) description: To successfully deploy the Windows 10 operating system and applications for your organization, it is essential that you know about the available tools to help with the process. ms.assetid: 0d6cee1f-14c4-4b69-b29a-43b0b327b877 -keywords: ["deploy, volume activation, BitLocker, recovery, install, installation, VAMT, MDT, USMT, WDS"] -ms.prod: W10 +keywords: deploy, volume activation, BitLocker, recovery, install, installation, VAMT, MDT, USMT, WDS +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: mtniehaus diff --git a/windows/deploy/windows-upgrade-and-migration-considerations.md b/windows/deploy/windows-upgrade-and-migration-considerations.md index 2b5ee05766..7763b0502d 100644 --- a/windows/deploy/windows-upgrade-and-migration-considerations.md +++ b/windows/deploy/windows-upgrade-and-migration-considerations.md @@ -2,10 +2,10 @@ title: Windows Upgrade and Migration Considerations (Windows 10) description: Windows Upgrade and Migration Considerations ms.assetid: 7f85095c-5922-45e9-b28e-91b1263c7281 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # Windows Upgrade and Migration Considerations diff --git a/windows/deploy/xml-file-requirements.md b/windows/deploy/xml-file-requirements.md index 50c5e1b161..100306e84d 100644 --- a/windows/deploy/xml-file-requirements.md +++ b/windows/deploy/xml-file-requirements.md @@ -2,10 +2,10 @@ title: XML File Requirements (Windows 10) description: XML File Requirements ms.assetid: 4b567b50-c50a-4a4f-8684-151fe3f8275f -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: CFaw +author: greg-lindsay --- # XML File Requirements From 512d1a6040207b81f06f6c518027de8e199598b2 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 26 May 2016 15:28:33 -0700 Subject: [PATCH 435/439] updating link --- windows/manage/lock-down-windows-10.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/manage/lock-down-windows-10.md b/windows/manage/lock-down-windows-10.md index 142d9f3824..61004d8822 100644 --- a/windows/manage/lock-down-windows-10.md +++ b/windows/manage/lock-down-windows-10.md @@ -47,7 +47,7 @@ Enterprises often need to manage how people use corporate devices. Windows 10 p

      Use this article to make informed decisions about how you can configure Windows telemetry in your organization.

      -

      [Configure Windows 10 devices to stop data flow to Microsoft](configure-windows-10-devices-to-stop-data-flow-to-microsoft.md)

      +

      [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md)

      Learn about the network connections that Windows components make to Microsoft and also the privacy settings that affect data that is shared with either Microsoft or apps and how they can be managed by an IT Pro.

      From f046a5fec059b3fed76b6f3225a0535247bee884 Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Thu, 26 May 2016 17:07:01 -0700 Subject: [PATCH 436/439] tagging update change W10 to w10 (lower case), add security pagetype to various --- .../access-credential-manager-as-a-trusted-caller.md | 2 +- windows/keep-secure/access-this-computer-from-the-network.md | 2 +- windows/keep-secure/account-lockout-duration.md | 2 +- windows/keep-secure/account-lockout-policy.md | 2 +- windows/keep-secure/account-lockout-threshold.md | 2 +- windows/keep-secure/account-policies.md | 2 +- windows/keep-secure/accounts-administrator-account-status.md | 2 +- windows/keep-secure/accounts-block-microsoft-accounts.md | 2 +- windows/keep-secure/accounts-guest-account-status.md | 2 +- ...l-account-use-of-blank-passwords-to-console-logon-only.md | 2 +- windows/keep-secure/accounts-rename-administrator-account.md | 2 +- windows/keep-secure/accounts-rename-guest-account.md | 2 +- windows/keep-secure/act-as-part-of-the-operating-system.md | 2 +- .../ad-ds-schema-extensions-to-support-tpm-backup.md | 2 +- .../add-apps-to-protected-list-using-custom-uri.md | 5 +++-- ...rules-for-packaged-apps-to-existing-applocker-rule-set.md | 2 +- windows/keep-secure/add-workstations-to-domain.md | 2 +- ...figuration-windows-defender-advanced-threat-protection.md | 3 ++- windows/keep-secure/adjust-memory-quotas-for-a-process.md | 2 +- windows/keep-secure/administer-applocker.md | 2 +- windows/keep-secure/administer-security-policy-settings.md | 2 +- .../keep-secure/advanced-security-audit-policy-settings.md | 2 +- windows/keep-secure/advanced-security-auditing-faq.md | 2 +- windows/keep-secure/advanced-security-auditing.md | 2 +- ...erts-queue-windows-defender-advanced-threat-protection.md | 3 ++- windows/keep-secure/allow-log-on-locally.md | 2 +- .../allow-log-on-through-remote-desktop-services.md | 2 +- windows/keep-secure/applocker-architecture-and-components.md | 2 +- windows/keep-secure/applocker-functions.md | 2 +- windows/keep-secure/applocker-overview.md | 2 +- windows/keep-secure/applocker-policies-deployment-guide.md | 2 +- windows/keep-secure/applocker-policies-design-guide.md | 2 +- windows/keep-secure/applocker-policy-use-scenarios.md | 2 +- windows/keep-secure/applocker-processes-and-interactions.md | 2 +- windows/keep-secure/applocker-settings.md | 2 +- windows/keep-secure/applocker-technical-reference.md | 2 +- .../apply-a-basic-audit-policy-on-a-file-or-folder.md | 2 +- windows/keep-secure/audit-account-lockout.md | 2 +- windows/keep-secure/audit-application-generated.md | 2 +- windows/keep-secure/audit-application-group-management.md | 2 +- windows/keep-secure/audit-audit-policy-change.md | 2 +- .../audit-audit-the-access-of-global-system-objects.md | 2 +- .../audit-audit-the-use-of-backup-and-restore-privilege.md | 2 +- windows/keep-secure/audit-authentication-policy-change.md | 2 +- windows/keep-secure/audit-authorization-policy-change.md | 2 +- windows/keep-secure/audit-central-access-policy-staging.md | 2 +- windows/keep-secure/audit-certification-services.md | 2 +- windows/keep-secure/audit-computer-account-management.md | 2 +- windows/keep-secure/audit-credential-validation.md | 2 +- .../audit-detailed-directory-service-replication.md | 2 +- windows/keep-secure/audit-detailed-file-share.md | 2 +- windows/keep-secure/audit-directory-service-access.md | 2 +- windows/keep-secure/audit-directory-service-changes.md | 2 +- windows/keep-secure/audit-directory-service-replication.md | 2 +- windows/keep-secure/audit-distribution-group-management.md | 2 +- windows/keep-secure/audit-dpapi-activity.md | 2 +- windows/keep-secure/audit-file-share.md | 2 +- windows/keep-secure/audit-file-system.md | 2 +- windows/keep-secure/audit-filtering-platform-connection.md | 2 +- windows/keep-secure/audit-filtering-platform-packet-drop.md | 2 +- .../keep-secure/audit-filtering-platform-policy-change.md | 2 +- ...it-force-audit-policy-subcategory-settings-to-override.md | 2 +- windows/keep-secure/audit-group-membership.md | 2 +- windows/keep-secure/audit-handle-manipulation.md | 2 +- windows/keep-secure/audit-ipsec-driver.md | 2 +- windows/keep-secure/audit-ipsec-extended-mode.md | 2 +- windows/keep-secure/audit-ipsec-main-mode.md | 2 +- windows/keep-secure/audit-ipsec-quick-mode.md | 2 +- windows/keep-secure/audit-kerberos-authentication-service.md | 2 +- .../keep-secure/audit-kerberos-service-ticket-operations.md | 2 +- windows/keep-secure/audit-kernel-object.md | 2 +- windows/keep-secure/audit-logoff.md | 2 +- windows/keep-secure/audit-logon.md | 2 +- windows/keep-secure/audit-mpssvc-rule-level-policy-change.md | 2 +- windows/keep-secure/audit-network-policy-server.md | 2 +- windows/keep-secure/audit-non-sensitive-privilege-use.md | 2 +- windows/keep-secure/audit-other-account-logon-events.md | 2 +- windows/keep-secure/audit-other-account-management-events.md | 2 +- windows/keep-secure/audit-other-logonlogoff-events.md | 2 +- windows/keep-secure/audit-other-object-access-events.md | 2 +- windows/keep-secure/audit-other-policy-change-events.md | 2 +- windows/keep-secure/audit-other-privilege-use-events.md | 2 +- windows/keep-secure/audit-other-system-events.md | 2 +- windows/keep-secure/audit-pnp-activity.md | 2 +- windows/keep-secure/audit-policy.md | 2 +- windows/keep-secure/audit-process-creation.md | 2 +- windows/keep-secure/audit-process-termination.md | 2 +- windows/keep-secure/audit-registry.md | 2 +- windows/keep-secure/audit-removable-storage.md | 2 +- windows/keep-secure/audit-rpc-events.md | 2 +- windows/keep-secure/audit-sam.md | 2 +- windows/keep-secure/audit-security-group-management.md | 2 +- windows/keep-secure/audit-security-state-change.md | 2 +- windows/keep-secure/audit-security-system-extension.md | 2 +- windows/keep-secure/audit-sensitive-privilege-use.md | 2 +- ...wn-system-immediately-if-unable-to-log-security-audits.md | 2 +- windows/keep-secure/audit-special-logon.md | 2 +- windows/keep-secure/audit-system-integrity.md | 2 +- windows/keep-secure/audit-user-account-management.md | 2 +- windows/keep-secure/audit-user-device-claims.md | 2 +- windows/keep-secure/back-up-files-and-directories.md | 2 +- .../keep-secure/backup-tpm-recovery-information-to-ad-ds.md | 2 +- windows/keep-secure/basic-audit-account-logon-events.md | 2 +- windows/keep-secure/basic-audit-account-management.md | 2 +- windows/keep-secure/basic-audit-directory-service-access.md | 2 +- windows/keep-secure/basic-audit-logon-events.md | 2 +- windows/keep-secure/basic-audit-object-access.md | 2 +- windows/keep-secure/basic-audit-policy-change.md | 2 +- windows/keep-secure/basic-audit-privilege-use.md | 2 +- windows/keep-secure/basic-audit-process-tracking.md | 2 +- windows/keep-secure/basic-audit-system-events.md | 2 +- windows/keep-secure/basic-security-audit-policies.md | 2 +- windows/keep-secure/basic-security-audit-policy-settings.md | 2 +- windows/keep-secure/bcd-settings-and-bitlocker.md | 2 +- windows/keep-secure/bitlocker-basic-deployment.md | 2 +- windows/keep-secure/bitlocker-countermeasures.md | 2 +- windows/keep-secure/bitlocker-frequently-asked-questions.md | 2 +- windows/keep-secure/bitlocker-group-policy-settings.md | 2 +- .../keep-secure/bitlocker-how-to-deploy-on-windows-server.md | 2 +- .../keep-secure/bitlocker-how-to-enable-network-unlock.md | 2 +- windows/keep-secure/bitlocker-overview.md | 2 +- windows/keep-secure/bitlocker-recovery-guide-plan.md | 2 +- ...e-bitlocker-drive-encryption-tools-to-manage-bitlocker.md | 2 +- .../bitlocker-use-bitlocker-recovery-password-viewer.md | 2 +- windows/keep-secure/block-untrusted-fonts-in-enterprise.md | 5 +++-- windows/keep-secure/bypass-traverse-checking.md | 2 +- .../keep-secure/change-history-for-keep-windows-10-secure.md | 3 ++- windows/keep-secure/change-the-system-time.md | 2 +- windows/keep-secure/change-the-time-zone.md | 2 +- windows/keep-secure/change-the-tpm-owner-password.md | 2 +- .../keep-secure/choose-the-right-bitlocker-countermeasure.md | 2 +- .../configure-an-applocker-policy-for-audit-only.md | 2 +- .../configure-an-applocker-policy-for-enforce-rules.md | 2 +- ...-endpoints-windows-defender-advanced-threat-protection.md | 3 ++- .../configure-exceptions-for-an-applocker-rule.md | 2 +- ...y-internet-windows-defender-advanced-threat-protection.md | 3 ++- windows/keep-secure/configure-s-mime.md | 2 +- .../keep-secure/configure-the-appLocker-reference-device.md | 2 +- .../configure-the-application-identity-service.md | 2 +- .../keep-secure/configure-windows-defender-in-windows-10.md | 2 +- ...te-a-basic-audit-policy-settings-for-an-event-category.md | 2 +- windows/keep-secure/create-a-pagefile.md | 2 +- windows/keep-secure/create-a-rule-for-packaged-apps.md | 2 +- .../create-a-rule-that-uses-a-file-hash-condition.md | 2 +- .../keep-secure/create-a-rule-that-uses-a-path-condition.md | 2 +- .../create-a-rule-that-uses-a-publisher-condition.md | 2 +- windows/keep-secure/create-a-token-object.md | 2 +- windows/keep-secure/create-applocker-default-rules.md | 2 +- windows/keep-secure/create-edp-policy-using-intune.md | 3 ++- windows/keep-secure/create-edp-policy-using-sccm.md | 5 +++-- windows/keep-secure/create-global-objects.md | 2 +- ...e-list-of-applications-deployed-to-each-business-group.md | 2 +- windows/keep-secure/create-permanent-shared-objects.md | 2 +- windows/keep-secure/create-symbolic-links.md | 2 +- .../keep-secure/create-vpn-and-edp-policy-using-intune.md | 5 +++-- .../keep-secure/create-your-applocker-planning-document.md | 2 +- windows/keep-secure/create-your-applocker-policies.md | 2 +- windows/keep-secure/create-your-applocker-rules.md | 2 +- .../creating-a-device-guard-policy-for-signed-apps.md | 2 +- windows/keep-secure/credential-guard.md | 2 +- .../dashboard-windows-defender-advanced-threat-protection.md | 4 +++- ...ge-privacy-windows-defender-advanced-threat-protection.md | 3 ++- ...in-security-descriptor-definition-language-sddl-syntax.md | 2 +- ...in-security-descriptor-definition-language-sddl-syntax.md | 2 +- windows/keep-secure/debug-programs.md | 2 +- windows/keep-secure/delete-an-applocker-rule.md | 2 +- .../deny-access-to-this-computer-from-the-network.md | 2 +- windows/keep-secure/deny-log-on-as-a-batch-job.md | 2 +- windows/keep-secure/deny-log-on-as-a-service.md | 2 +- windows/keep-secure/deny-log-on-locally.md | 2 +- .../deny-log-on-through-remote-desktop-services.md | 2 +- ...-applocker-policies-by-using-the-enforce-rules-setting.md | 2 +- windows/keep-secure/deploy-edp-policy-using-intune.md | 5 +++-- .../deploy-the-applocker-policy-into-production.md | 2 +- .../determine-group-policy-structure-and-rule-enforcement.md | 2 +- ...lications-are-digitally-signed-on-a-reference-computer.md | 2 +- .../determine-your-application-control-objectives.md | 2 +- .../keep-secure/device-guard-certification-and-compliance.md | 2 +- windows/keep-secure/device-guard-deployment-guide.md | 4 ++-- .../devices-allow-undock-without-having-to-log-on.md | 2 +- .../devices-allowed-to-format-and-eject-removable-media.md | 2 +- .../devices-prevent-users-from-installing-printer-drivers.md | 2 +- ...-restrict-cd-rom-access-to-locally-logged-on-user-only.md | 2 +- ...-restrict-floppy-access-to-locally-logged-on-user-only.md | 2 +- ...rl-message-when-users-try-to-run-a-blocked-application.md | 2 +- windows/keep-secure/dll-rules-in-applocker.md | 2 +- ...-group-policy-structure-and-applocker-rule-enforcement.md | 2 +- ...document-your-application-control-management-processes.md | 2 +- windows/keep-secure/document-your-application-list.md | 2 +- windows/keep-secure/document-your-applocker-rules.md | 2 +- ...in-controller-allow-server-operators-to-schedule-tasks.md | 2 +- .../domain-controller-ldap-server-signing-requirements.md | 2 +- ...ain-controller-refuse-machine-account-password-changes.md | 2 +- ...r-digitally-encrypt-or-sign-secure-channel-data-always.md | 2 +- ...er-digitally-encrypt-secure-channel-data-when-possible.md | 2 +- ...ember-digitally-sign-secure-channel-data-when-possible.md | 2 +- ...domain-member-disable-machine-account-password-changes.md | 2 +- .../domain-member-maximum-machine-account-password-age.md | 2 +- ...ember-require-strong-windows-2000-or-later-session-key.md | 2 +- windows/keep-secure/edit-an-applocker-policy.md | 2 +- windows/keep-secure/edit-applocker-rules.md | 2 +- ...omputer-and-user-accounts-to-be-trusted-for-delegation.md | 2 +- windows/keep-secure/enable-the-dll-rule-collection.md | 2 +- windows/keep-secure/encrypted-hard-drive.md | 2 +- windows/keep-secure/enforce-applocker-rules.md | 2 +- windows/keep-secure/enforce-password-history.md | 2 +- windows/keep-secure/enforce-user-logon-restrictions.md | 2 +- windows/keep-secure/enlightened-microsoft-apps-and-edp.md | 5 +++-- ...rror-codes-windows-defender-advanced-threat-protection.md | 3 ++- windows/keep-secure/executable-rules-in-applocker.md | 2 +- windows/keep-secure/export-an-applocker-policy-from-a-gpo.md | 2 +- .../keep-secure/export-an-applocker-policy-to-an-xml-file.md | 2 +- .../keep-secure/file-system-global-object-access-auditing.md | 2 +- windows/keep-secure/force-shutdown-from-a-remote-system.md | 2 +- windows/keep-secure/generate-security-audits.md | 2 +- .../get-started-with-windows-defender-for-windows-10.md | 2 +- .../getting-apps-to-run-on-device-guard-protected-devices.md | 2 +- windows/keep-secure/guidance-and-best-practices-edp.md | 5 +++-- windows/keep-secure/how-applocker-works-techref.md | 2 +- .../keep-secure/how-to-configure-security-policy-settings.md | 2 +- windows/keep-secure/how-user-account-control-works.md | 2 +- .../keep-secure/impersonate-a-client-after-authentication.md | 2 +- .../implement-microsoft-passport-in-your-organization.md | 2 +- .../import-an-applocker-policy-from-another-computer.md | 2 +- windows/keep-secure/import-an-applocker-policy-into-a-gpo.md | 2 +- windows/keep-secure/increase-a-process-working-set.md | 2 +- windows/keep-secure/increase-scheduling-priority.md | 2 +- windows/keep-secure/index.md | 2 +- .../initialize-and-configure-ownership-of-the-tpm.md | 2 +- .../installing-digital-certificates-on-windows-10-mobile.md | 2 +- ...on-display-user-information-when-the-session-is-locked.md | 2 +- .../interactive-logon-do-not-display-last-user-name.md | 2 +- .../interactive-logon-do-not-require-ctrl-alt-del.md | 2 +- .../interactive-logon-machine-account-lockout-threshold.md | 2 +- .../interactive-logon-machine-inactivity-limit.md | 2 +- ...tive-logon-message-text-for-users-attempting-to-log-on.md | 2 +- ...ive-logon-message-title-for-users-attempting-to-log-on.md | 2 +- ...ns-to-cache-in-case-domain-controller-is-not-available.md | 2 +- ...logon-prompt-user-to-change-password-before-expiration.md | 2 +- ...domain-controller-authentication-to-unlock-workstation.md | 2 +- windows/keep-secure/interactive-logon-require-smart-card.md | 2 +- .../interactive-logon-smart-card-removal-behavior.md | 2 +- ...ate-alerts-windows-defender-advanced-threat-protection.md | 3 ++- ...ate-domain-windows-defender-advanced-threat-protection.md | 3 ++- ...gate-files-windows-defender-advanced-threat-protection.md | 3 ++- ...stigate-ip-windows-defender-advanced-threat-protection.md | 3 ++- ...e-machines-windows-defender-advanced-threat-protection.md | 3 ++- windows/keep-secure/kerberos-policy.md | 2 +- 248 files changed, 278 insertions(+), 256 deletions(-) diff --git a/windows/keep-secure/access-credential-manager-as-a-trusted-caller.md b/windows/keep-secure/access-credential-manager-as-a-trusted-caller.md index f6f7140989..ff24a84d8c 100644 --- a/windows/keep-secure/access-credential-manager-as-a-trusted-caller.md +++ b/windows/keep-secure/access-credential-manager-as-a-trusted-caller.md @@ -2,7 +2,7 @@ title: Access Credential Manager as a trusted caller (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Access Credential Manager as a trusted caller security policy setting. ms.assetid: a51820d2-ca5b-47dd-8e9b-d7008603db88 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/access-this-computer-from-the-network.md b/windows/keep-secure/access-this-computer-from-the-network.md index 00a88b6ba8..1cb598fcfd 100644 --- a/windows/keep-secure/access-this-computer-from-the-network.md +++ b/windows/keep-secure/access-this-computer-from-the-network.md @@ -2,7 +2,7 @@ title: Access this computer from the network (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Access this computer from the network security policy setting. ms.assetid: f6767bc2-83d1-45f1-847c-54f5362db022 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/account-lockout-duration.md b/windows/keep-secure/account-lockout-duration.md index 9b8fd5a9f4..1d438057a4 100644 --- a/windows/keep-secure/account-lockout-duration.md +++ b/windows/keep-secure/account-lockout-duration.md @@ -2,7 +2,7 @@ title: Account lockout duration (Windows 10) description: Describes the best practices, location, values, and security considerations for the Account lockout duration security policy setting. ms.assetid: a4167bf4-27c3-4a9b-8ef0-04e3c6ec3aa4 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/account-lockout-policy.md b/windows/keep-secure/account-lockout-policy.md index edf3c1a723..6a13c989d3 100644 --- a/windows/keep-secure/account-lockout-policy.md +++ b/windows/keep-secure/account-lockout-policy.md @@ -2,7 +2,7 @@ title: Account Lockout Policy (Windows 10) description: Describes the Account Lockout Policy settings and links to information about each policy setting. ms.assetid: eb968c28-17c5-405f-b413-50728cb7b724 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/account-lockout-threshold.md b/windows/keep-secure/account-lockout-threshold.md index 56fedf53b7..828a524fe0 100644 --- a/windows/keep-secure/account-lockout-threshold.md +++ b/windows/keep-secure/account-lockout-threshold.md @@ -2,7 +2,7 @@ title: Account lockout threshold (Windows 10) description: Describes the best practices, location, values, and security considerations for the Account lockout threshold security policy setting. ms.assetid: 4904bb40-a2bd-4fef-a102-260ba8d74e30 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/account-policies.md b/windows/keep-secure/account-policies.md index 487d575c7f..ca8fb5a3b4 100644 --- a/windows/keep-secure/account-policies.md +++ b/windows/keep-secure/account-policies.md @@ -2,7 +2,7 @@ title: Account Policies (Windows 10) description: An overview of account policies in Windows and provides links to policy descriptions. ms.assetid: 711b3797-b87a-4cd9-a2e3-1f8ef18688fb -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/accounts-administrator-account-status.md b/windows/keep-secure/accounts-administrator-account-status.md index 6c992c3bcb..5a3cde966e 100644 --- a/windows/keep-secure/accounts-administrator-account-status.md +++ b/windows/keep-secure/accounts-administrator-account-status.md @@ -2,7 +2,7 @@ title: Accounts Administrator account status (Windows 10) description: Describes the best practices, location, values, and security considerations for the Accounts Administrator account status security policy setting. ms.assetid: 71a3bd48-1014-49e0-a936-bfe9433af23e -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/accounts-block-microsoft-accounts.md b/windows/keep-secure/accounts-block-microsoft-accounts.md index a482a7a88c..cc479c5bc2 100644 --- a/windows/keep-secure/accounts-block-microsoft-accounts.md +++ b/windows/keep-secure/accounts-block-microsoft-accounts.md @@ -2,7 +2,7 @@ title: Accounts Block Microsoft accounts (Windows 10) description: Describes the best practices, location, values, management, and security considerations for the Accounts Block Microsoft accounts security policy setting. ms.assetid: 94c76f45-057c-4d80-8d01-033cf28ef2f7 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/accounts-guest-account-status.md b/windows/keep-secure/accounts-guest-account-status.md index 2e66ee3ae1..f9054008ac 100644 --- a/windows/keep-secure/accounts-guest-account-status.md +++ b/windows/keep-secure/accounts-guest-account-status.md @@ -2,7 +2,7 @@ title: Accounts Guest account status (Windows 10) description: Describes the best practices, location, values, and security considerations for the Accounts Guest account status security policy setting. ms.assetid: 07e53fc5-b495-4d02-ab42-5b245d10d0ce -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md b/windows/keep-secure/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md index 9d8ddd27c9..eb700fe6ec 100644 --- a/windows/keep-secure/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md +++ b/windows/keep-secure/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md @@ -2,7 +2,7 @@ title: Accounts Limit local account use of blank passwords to console logon only (Windows 10) description: Describes the best practices, location, values, and security considerations for the Accounts Limit local account use of blank passwords to console logon only security policy setting. ms.assetid: a1bfb58b-1ae8-4de9-832b-aa889a6e64bd -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/accounts-rename-administrator-account.md b/windows/keep-secure/accounts-rename-administrator-account.md index 8873990424..5c79c1d38b 100644 --- a/windows/keep-secure/accounts-rename-administrator-account.md +++ b/windows/keep-secure/accounts-rename-administrator-account.md @@ -2,7 +2,7 @@ title: Accounts Rename administrator account (Windows 10) description: This security policy reference topic for the IT professional describes the best practices, location, values, and security considerations for this policy setting. ms.assetid: d21308eb-7c60-4e48-8747-62b8109844f9 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/accounts-rename-guest-account.md b/windows/keep-secure/accounts-rename-guest-account.md index f82b907968..aa06c480c3 100644 --- a/windows/keep-secure/accounts-rename-guest-account.md +++ b/windows/keep-secure/accounts-rename-guest-account.md @@ -2,7 +2,7 @@ title: Accounts Rename guest account (Windows 10) description: Describes the best practices, location, values, and security considerations for the Accounts Rename guest account security policy setting. ms.assetid: 9b8052b4-bbb9-4cc1-bfee-ce25390db707 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/act-as-part-of-the-operating-system.md b/windows/keep-secure/act-as-part-of-the-operating-system.md index 5d4a39d466..a35393e223 100644 --- a/windows/keep-secure/act-as-part-of-the-operating-system.md +++ b/windows/keep-secure/act-as-part-of-the-operating-system.md @@ -2,7 +2,7 @@ title: Act as part of the operating system (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Act as part of the operating system security policy setting. ms.assetid: c1b7e084-a9f7-4377-b678-07cc913c8b0c -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/ad-ds-schema-extensions-to-support-tpm-backup.md b/windows/keep-secure/ad-ds-schema-extensions-to-support-tpm-backup.md index 214bc1763d..8e62ff36b5 100644 --- a/windows/keep-secure/ad-ds-schema-extensions-to-support-tpm-backup.md +++ b/windows/keep-secure/ad-ds-schema-extensions-to-support-tpm-backup.md @@ -2,7 +2,7 @@ title: AD DS schema extensions to support TPM backup (Windows 10) description: This topic provides more details about this change and provides template schema extensions that you can incorporate into your organization. ms.assetid: beb7097c-e674-4eab-b8e2-6f67c85d1f3f -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/add-apps-to-protected-list-using-custom-uri.md b/windows/keep-secure/add-apps-to-protected-list-using-custom-uri.md index 3f9700cfb4..eb028e5f03 100644 --- a/windows/keep-secure/add-apps-to-protected-list-using-custom-uri.md +++ b/windows/keep-secure/add-apps-to-protected-list-using-custom-uri.md @@ -2,9 +2,10 @@ title: Add multiple apps to your enterprise data protection (EDP) Protected Apps list (Windows 10) description: Add multiple apps to your enterprise data protection (EDP) Protected Apps list at the same time, by using the Microsoft Intune Custom URI functionality and the AppLocker. ms.assetid: b50db35d-a2a9-4b78-a95d-a1b066e66880 -keywords: ["EDP", "Enterprise Data Protection", "protected apps", "protected app list"] -ms.prod: W10 +keywords: EDP, Enterprise Data Protection, protected apps, protected app list +ms.prod: w10 ms.mktglfcycl: explore +ms.pagetype: security ms.sitesec: library author: eross-msft --- diff --git a/windows/keep-secure/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md b/windows/keep-secure/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md index c05eb4ebd2..d99dda899b 100644 --- a/windows/keep-secure/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md +++ b/windows/keep-secure/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md @@ -2,7 +2,7 @@ title: Add rules for packaged apps to existing AppLocker rule-set (Windows 10) description: This topic for IT professionals describes how to update your existing AppLocker policies for packaged apps using the Remote Server Administration Toolkit (RSAT). ms.assetid: 758c2a9f-c2a3-418c-83bc-fd335a94097f -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/add-workstations-to-domain.md b/windows/keep-secure/add-workstations-to-domain.md index 7cdeb90a8b..fac531b419 100644 --- a/windows/keep-secure/add-workstations-to-domain.md +++ b/windows/keep-secure/add-workstations-to-domain.md @@ -2,7 +2,7 @@ title: Add workstations to domain (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Add workstations to domain security policy setting. ms.assetid: b0c21af4-c928-4344-b1f1-58ef162ad0b3 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/additional-configuration-windows-defender-advanced-threat-protection.md b/windows/keep-secure/additional-configuration-windows-defender-advanced-threat-protection.md index 604d4ba268..93d466aa32 100644 --- a/windows/keep-secure/additional-configuration-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/additional-configuration-windows-defender-advanced-threat-protection.md @@ -3,8 +3,9 @@ title: Additional Windows Defender ATP configuration settings description: Use the Group Policy Console to configure settings that enable sample sharing from your endpoints. These settings are used in the deep analysis feature. keywords: configuration settings, Windows Defender ATP configuration settings, Windows Defender Advanced Threat Protection configuration settings, group policy Management Editor, computer configuration, policies, administrative templates, search.product: eADQiWindows 10XVcnh -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy +ms.pagetype: security ms.sitesec: library author: mjcaparas --- diff --git a/windows/keep-secure/adjust-memory-quotas-for-a-process.md b/windows/keep-secure/adjust-memory-quotas-for-a-process.md index 4568ef9fe0..44fe866134 100644 --- a/windows/keep-secure/adjust-memory-quotas-for-a-process.md +++ b/windows/keep-secure/adjust-memory-quotas-for-a-process.md @@ -2,7 +2,7 @@ title: Adjust memory quotas for a process (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Adjust memory quotas for a process security policy setting. ms.assetid: 6754a2c8-6d07-4567-9af3-335fd8dd7626 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/administer-applocker.md b/windows/keep-secure/administer-applocker.md index 232b69b1ef..0940acac92 100644 --- a/windows/keep-secure/administer-applocker.md +++ b/windows/keep-secure/administer-applocker.md @@ -2,7 +2,7 @@ title: Administer AppLocker (Windows 10) description: This topic for IT professionals provides links to specific procedures to use when administering AppLocker policies. ms.assetid: 511a3b6a-175f-4d6d-a6e0-c1780c02e818 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/administer-security-policy-settings.md b/windows/keep-secure/administer-security-policy-settings.md index 59bc1ce37f..de0baa4b22 100644 --- a/windows/keep-secure/administer-security-policy-settings.md +++ b/windows/keep-secure/administer-security-policy-settings.md @@ -2,7 +2,7 @@ title: Administer security policy settings (Windows 10) description: This article discusses different methods to administer security policy settings on a local device or throughout a small- or medium-sized organization. ms.assetid: 7617d885-9d28-437a-9371-171197407599 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/advanced-security-audit-policy-settings.md b/windows/keep-secure/advanced-security-audit-policy-settings.md index 5b5faf0b14..14ecaca52f 100644 --- a/windows/keep-secure/advanced-security-audit-policy-settings.md +++ b/windows/keep-secure/advanced-security-audit-policy-settings.md @@ -2,7 +2,7 @@ title: Advanced security audit policy settings (Windows 10) description: This reference for IT professionals provides information about the advanced audit policy settings that are available in Windows and the audit events that they generate. ms.assetid: 93b28b92-796f-4036-a53b-8b9e80f9f171 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/advanced-security-auditing-faq.md b/windows/keep-secure/advanced-security-auditing-faq.md index eef52f8d63..3bfa640035 100644 --- a/windows/keep-secure/advanced-security-auditing-faq.md +++ b/windows/keep-secure/advanced-security-auditing-faq.md @@ -2,7 +2,7 @@ title: Advanced security auditing FAQ (Windows 10) description: This topic for the IT professional lists questions and answers about understanding, deploying, and managing security audit policies. ms.assetid: 80f8f187-0916-43c2-a7e8-ea712b115a06 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/advanced-security-auditing.md b/windows/keep-secure/advanced-security-auditing.md index 5ed85a625d..bdec74db1c 100644 --- a/windows/keep-secure/advanced-security-auditing.md +++ b/windows/keep-secure/advanced-security-auditing.md @@ -2,7 +2,7 @@ title: Advanced security audit policies (Windows 10) description: Advanced security audit policy settings are found in Security Settings\\Advanced Audit Policy Configuration\\System Audit Policies and appear to overlap with basic security audit policies, but they are recorded and applied differently. ms.assetid: 6FE8AC10-F48E-4BBF-979B-43A5DFDC5DFC -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md b/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md index ee4ce0a4a9..46dddb36a1 100644 --- a/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md @@ -3,9 +3,10 @@ title: View and organize the Windows Defender ATP Alerts queue description: Learn about how the Windows Defender ATP alerts queue work, and how to sort and filter lists of alerts. keywords: alerts, queues, alerts queue, sort, order, filter, manage alerts, new, in progress, resolved, newest, time in queue, severity, time period search.product: eADQiWindows 10XVcnh -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: mjcaparas --- diff --git a/windows/keep-secure/allow-log-on-locally.md b/windows/keep-secure/allow-log-on-locally.md index fdfa7ab402..3cbeacb088 100644 --- a/windows/keep-secure/allow-log-on-locally.md +++ b/windows/keep-secure/allow-log-on-locally.md @@ -2,7 +2,7 @@ title: Allow log on locally (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Allow log on locally security policy setting. ms.assetid: d9e5e1f3-3bff-4da7-a9a2-4bb3e0c79055 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/allow-log-on-through-remote-desktop-services.md b/windows/keep-secure/allow-log-on-through-remote-desktop-services.md index cc51c9cbea..d409837c30 100644 --- a/windows/keep-secure/allow-log-on-through-remote-desktop-services.md +++ b/windows/keep-secure/allow-log-on-through-remote-desktop-services.md @@ -2,7 +2,7 @@ title: Allow log on through Remote Desktop Services (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Allow log on through Remote Desktop Services security policy setting. ms.assetid: 6267c376-8199-4f2b-ae56-9c5424e76798 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/applocker-architecture-and-components.md b/windows/keep-secure/applocker-architecture-and-components.md index 39e8bbf34c..98760516ec 100644 --- a/windows/keep-secure/applocker-architecture-and-components.md +++ b/windows/keep-secure/applocker-architecture-and-components.md @@ -2,7 +2,7 @@ title: AppLocker architecture and components (Windows 10) description: This topic for IT professional describes AppLocker’s basic architecture and its major components. ms.assetid: efdd8494-553c-443f-bd5f-c8976535135a -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/applocker-functions.md b/windows/keep-secure/applocker-functions.md index d3ab5362dd..eaad056c7a 100644 --- a/windows/keep-secure/applocker-functions.md +++ b/windows/keep-secure/applocker-functions.md @@ -2,7 +2,7 @@ title: AppLocker functions (Windows 10) description: This topic for the IT professional lists the functions and security levels for the Software Restriction Policies (SRP) and AppLocker features. ms.assetid: bf704198-9e74-4731-8c5a-ee0512df34d2 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/applocker-overview.md b/windows/keep-secure/applocker-overview.md index 6918af6f1e..954c093d80 100644 --- a/windows/keep-secure/applocker-overview.md +++ b/windows/keep-secure/applocker-overview.md @@ -2,7 +2,7 @@ title: AppLocker (Windows 10) description: This topic provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. ms.assetid: 94b57864-2112-43b6-96fb-2863c985dc9a -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/applocker-policies-deployment-guide.md b/windows/keep-secure/applocker-policies-deployment-guide.md index f0bce74c2a..2adc3ff79b 100644 --- a/windows/keep-secure/applocker-policies-deployment-guide.md +++ b/windows/keep-secure/applocker-policies-deployment-guide.md @@ -2,7 +2,7 @@ title: AppLocker deployment guide (Windows 10) description: This topic for IT professionals introduces the concepts and describes the steps required to deploy AppLocker policies. ms.assetid: 38632795-be13-46b0-a7af-487a4340bea1 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/applocker-policies-design-guide.md b/windows/keep-secure/applocker-policies-design-guide.md index 7954db3edb..2e331c4fb8 100644 --- a/windows/keep-secure/applocker-policies-design-guide.md +++ b/windows/keep-secure/applocker-policies-design-guide.md @@ -2,7 +2,7 @@ title: AppLocker design guide (Windows 10) description: This topic for the IT professional introduces the design and planning steps required to deploy application control policies by using AppLocker. ms.assetid: 1c8e4a7b-3164-4eb4-9277-11b1d5a09c7b -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/applocker-policy-use-scenarios.md b/windows/keep-secure/applocker-policy-use-scenarios.md index ce30809f52..64a8fd4db0 100644 --- a/windows/keep-secure/applocker-policy-use-scenarios.md +++ b/windows/keep-secure/applocker-policy-use-scenarios.md @@ -2,7 +2,7 @@ title: AppLocker policy use scenarios (Windows 10) description: This topic for the IT professional lists the various application control scenarios in which AppLocker policies can be effectively implemented. ms.assetid: 33f71578-89f0-4063-ac04-cf4f4ca5c31f -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/applocker-processes-and-interactions.md b/windows/keep-secure/applocker-processes-and-interactions.md index 0243055da8..5f07c7d07f 100644 --- a/windows/keep-secure/applocker-processes-and-interactions.md +++ b/windows/keep-secure/applocker-processes-and-interactions.md @@ -2,7 +2,7 @@ title: AppLocker processes and interactions (Windows 10) description: This topic for the IT professional describes the process dependencies and interactions when AppLocker evaluates and enforces rules. ms.assetid: 0beec616-6040-4be7-8703-b6c919755d8e -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/applocker-settings.md b/windows/keep-secure/applocker-settings.md index 77509f8e43..7af2350b9d 100644 --- a/windows/keep-secure/applocker-settings.md +++ b/windows/keep-secure/applocker-settings.md @@ -2,7 +2,7 @@ title: AppLocker settings (Windows 10) description: This topic for the IT professional lists the settings used by AppLocker. ms.assetid: 9cb4aa19-77c0-4415-9968-bd07dab86839 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/applocker-technical-reference.md b/windows/keep-secure/applocker-technical-reference.md index 164a159782..1c797a1679 100644 --- a/windows/keep-secure/applocker-technical-reference.md +++ b/windows/keep-secure/applocker-technical-reference.md @@ -2,7 +2,7 @@ title: AppLocker technical reference (Windows 10) description: This overview topic for IT professionals provides links to the topics in the technical reference. ms.assetid: 2b2678f8-c46b-4e1d-b8c5-037c0be255ab -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/apply-a-basic-audit-policy-on-a-file-or-folder.md b/windows/keep-secure/apply-a-basic-audit-policy-on-a-file-or-folder.md index 5828778660..fd5dcf7155 100644 --- a/windows/keep-secure/apply-a-basic-audit-policy-on-a-file-or-folder.md +++ b/windows/keep-secure/apply-a-basic-audit-policy-on-a-file-or-folder.md @@ -2,7 +2,7 @@ title: Apply a basic audit policy on a file or folder (Windows 10) description: You can apply audit policies to individual files and folders on your computer by setting the permission type to record successful access attempts or failed access attempts in the security log. ms.assetid: 565E7249-5CD0-4B2E-B2C0-B3A0793A51E2 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-account-lockout.md b/windows/keep-secure/audit-account-lockout.md index 6c7ebbb0e2..be3326efee 100644 --- a/windows/keep-secure/audit-account-lockout.md +++ b/windows/keep-secure/audit-account-lockout.md @@ -2,7 +2,7 @@ title: Audit Account Lockout (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit Account Lockout, which enables you to audit security events that are generated by a failed attempt to log on to an account that is locked out. ms.assetid: da68624b-a174-482c-9bc5-ddddab38e589 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-application-generated.md b/windows/keep-secure/audit-application-generated.md index f7c31ca13a..3aa2716aa8 100644 --- a/windows/keep-secure/audit-application-generated.md +++ b/windows/keep-secure/audit-application-generated.md @@ -2,7 +2,7 @@ title: Audit Application Generated (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Application Generated, which determines whether the operating system generates audit events when applications attempt to use the Windows Auditing application programming interfaces (APIs). ms.assetid: 6c58a365-b25b-42b8-98ab-819002e31871 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-application-group-management.md b/windows/keep-secure/audit-application-group-management.md index 3055b72f6d..76cdabda54 100644 --- a/windows/keep-secure/audit-application-group-management.md +++ b/windows/keep-secure/audit-application-group-management.md @@ -2,7 +2,7 @@ title: Audit Application Group Management (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit Application Group Management, which determines whether the operating system generates audit events when application group management tasks are performed. ms.assetid: 1bcaa41e-5027-4a86-96b7-f04eaf1c0606 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-audit-policy-change.md b/windows/keep-secure/audit-audit-policy-change.md index 65b7d6261e..de2aca1b0a 100644 --- a/windows/keep-secure/audit-audit-policy-change.md +++ b/windows/keep-secure/audit-audit-policy-change.md @@ -2,7 +2,7 @@ title: Audit Audit Policy Change (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Audit Policy Change, which determines whether the operating system generates audit events when changes are made to audit policy. ms.assetid: 7153bf75-6978-4d7e-a821-59a699efb8a9 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-audit-the-access-of-global-system-objects.md b/windows/keep-secure/audit-audit-the-access-of-global-system-objects.md index 767ec7c30a..9fcecc87b1 100644 --- a/windows/keep-secure/audit-audit-the-access-of-global-system-objects.md +++ b/windows/keep-secure/audit-audit-the-access-of-global-system-objects.md @@ -2,7 +2,7 @@ title: Audit Audit the access of global system objects (Windows 10) description: Describes the best practices, location, values, and security considerations for the Audit Audit the access of global system objects security policy setting. ms.assetid: 20d40a79-ce89-45e6-9bb4-148f83958460 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-audit-the-use-of-backup-and-restore-privilege.md b/windows/keep-secure/audit-audit-the-use-of-backup-and-restore-privilege.md index 49b518da5a..3bd9ddd1b8 100644 --- a/windows/keep-secure/audit-audit-the-use-of-backup-and-restore-privilege.md +++ b/windows/keep-secure/audit-audit-the-use-of-backup-and-restore-privilege.md @@ -2,7 +2,7 @@ title: Audit Audit the use of Backup and Restore privilege (Windows 10) description: Describes the best practices, location, values, and security considerations for the Audit Audit the use of Backup and Restore privilege security policy setting. ms.assetid: f656a2bb-e8d6-447b-8902-53df3a7756c5 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-authentication-policy-change.md b/windows/keep-secure/audit-authentication-policy-change.md index e26a96a284..712e480800 100644 --- a/windows/keep-secure/audit-authentication-policy-change.md +++ b/windows/keep-secure/audit-authentication-policy-change.md @@ -2,7 +2,7 @@ title: Audit Authentication Policy Change (Windows 10) description: This topic for the IT professional describes this Advanced Security Audit policy setting, Audit Authentication Policy Change, which determines whether the operating system generates audit events when changes are made to authentication policy. ms.assetid: aa9cea7a-aadf-47b7-b704-ac253b8e79be -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-authorization-policy-change.md b/windows/keep-secure/audit-authorization-policy-change.md index 3bff0a5dd9..7e426a2044 100644 --- a/windows/keep-secure/audit-authorization-policy-change.md +++ b/windows/keep-secure/audit-authorization-policy-change.md @@ -2,7 +2,7 @@ title: Audit Authorization Policy Change (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Authorization Policy Change, which determines whether the operating system generates audit events when specific changes are made to the authorization policy. ms.assetid: ca0587a2-a2b3-4300-aa5d-48b4553c3b36 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-central-access-policy-staging.md b/windows/keep-secure/audit-central-access-policy-staging.md index e53abd2a09..28539eb491 100644 --- a/windows/keep-secure/audit-central-access-policy-staging.md +++ b/windows/keep-secure/audit-central-access-policy-staging.md @@ -2,7 +2,7 @@ title: Audit Central Access Policy Staging (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Central Access Policy Staging, which determines permissions on a Central Access Policy. ms.assetid: D9BB11CE-949A-4B48-82BF-30DC5E6FC67D -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-certification-services.md b/windows/keep-secure/audit-certification-services.md index f23bdde027..f5aa0959d7 100644 --- a/windows/keep-secure/audit-certification-services.md +++ b/windows/keep-secure/audit-certification-services.md @@ -2,7 +2,7 @@ title: Audit Certification Services (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Certification Services, which determines whether the operating system generates events when Active Directory Certificate Services (AD CS) operations are performed. ms.assetid: cdefc34e-fb1f-4eff-b766-17713c5a1b03 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-computer-account-management.md b/windows/keep-secure/audit-computer-account-management.md index 5211936625..f336c85c74 100644 --- a/windows/keep-secure/audit-computer-account-management.md +++ b/windows/keep-secure/audit-computer-account-management.md @@ -2,7 +2,7 @@ title: Audit Computer Account Management (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit Computer Account Management, which determines whether the operating system generates audit events when a computer account is created, changed, or deleted. ms.assetid: 6c406693-57bf-4411-bb6c-ff83ce548991 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-credential-validation.md b/windows/keep-secure/audit-credential-validation.md index 7f4232806f..fdacd0aa43 100644 --- a/windows/keep-secure/audit-credential-validation.md +++ b/windows/keep-secure/audit-credential-validation.md @@ -2,7 +2,7 @@ title: Audit Credential Validation (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit Credential Validation, which determines whether the operating system generates audit events on credentials that are submitted for a user account logon request. ms.assetid: 6654b33a-922e-4a43-8223-ec5086dfc926 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-detailed-directory-service-replication.md b/windows/keep-secure/audit-detailed-directory-service-replication.md index ae2e46a570..295527e35e 100644 --- a/windows/keep-secure/audit-detailed-directory-service-replication.md +++ b/windows/keep-secure/audit-detailed-directory-service-replication.md @@ -3,7 +3,7 @@ title: Audit Detailed Directory Service Replication (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit Detailed Directory Service Replication, which determines whether the operating system generates audit events that contain detailed tracking information about data that is replicated between domain controllers. ms.assetid: 1b89c8f5-bce7-4b20-8701-42585c7ab993 ms.pagetype: security -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft diff --git a/windows/keep-secure/audit-detailed-file-share.md b/windows/keep-secure/audit-detailed-file-share.md index f60e4dd5f2..4d0294c79c 100644 --- a/windows/keep-secure/audit-detailed-file-share.md +++ b/windows/keep-secure/audit-detailed-file-share.md @@ -2,7 +2,7 @@ title: Audit Detailed File Share (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Detailed File Share, which allows you to audit attempts to access files and folders on a shared folder. ms.assetid: 60310104-b820-4033-a1cb-022a34f064ae -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-directory-service-access.md b/windows/keep-secure/audit-directory-service-access.md index 230dce9a69..2c88e66d93 100644 --- a/windows/keep-secure/audit-directory-service-access.md +++ b/windows/keep-secure/audit-directory-service-access.md @@ -2,7 +2,7 @@ title: Audit Directory Service Access (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit Directory Service Access, which determines whether the operating system generates audit events when an Active Directory Domain Services (AD DS) object is accessed. ms.assetid: ba2562ba-4282-4588-b87c-a3fcb771c7d0 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-directory-service-changes.md b/windows/keep-secure/audit-directory-service-changes.md index 361827a614..18b22defe5 100644 --- a/windows/keep-secure/audit-directory-service-changes.md +++ b/windows/keep-secure/audit-directory-service-changes.md @@ -2,7 +2,7 @@ title: Audit Directory Service Changes (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit Directory Service Changes, which determines whether the operating system generates audit events when changes are made to objects in Active Directory Domain Services (AD DS). ms.assetid: 9f7c0dd4-3977-47dd-a0fb-ec2f17cad05e -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-directory-service-replication.md b/windows/keep-secure/audit-directory-service-replication.md index 9f09abada9..8dde61d22d 100644 --- a/windows/keep-secure/audit-directory-service-replication.md +++ b/windows/keep-secure/audit-directory-service-replication.md @@ -2,7 +2,7 @@ title: Audit Directory Service Replication (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit Directory Service Replication, which determines whether the operating system generates audit events when replication between two domain controllers begins and ends. ms.assetid: b95d296c-7993-4e8d-8064-a8bbe284bd56 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-distribution-group-management.md b/windows/keep-secure/audit-distribution-group-management.md index 1e259424ed..80cfcea450 100644 --- a/windows/keep-secure/audit-distribution-group-management.md +++ b/windows/keep-secure/audit-distribution-group-management.md @@ -2,7 +2,7 @@ title: Audit Distribution Group Management (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Distribution Group Management, which determines whether the operating system generates audit events for specific distribution-group management tasks. ms.assetid: d46693a4-5887-4a58-85db-2f6cba224a66 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-dpapi-activity.md b/windows/keep-secure/audit-dpapi-activity.md index 1e7c77ac71..30db4c39a8 100644 --- a/windows/keep-secure/audit-dpapi-activity.md +++ b/windows/keep-secure/audit-dpapi-activity.md @@ -2,7 +2,7 @@ title: Audit DPAPI Activity (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit DPAPI Activity, which determines whether the operating system generates audit events when encryption or decryption calls are made into the data protection application interface (DPAPI). ms.assetid: be4d4c83-c857-4e3d-a84e-8bcc3f2c99cd -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-file-share.md b/windows/keep-secure/audit-file-share.md index 8040bc118a..af74a0b2a8 100644 --- a/windows/keep-secure/audit-file-share.md +++ b/windows/keep-secure/audit-file-share.md @@ -2,7 +2,7 @@ title: Audit File Share (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit File Share, which determines whether the operating system generates audit events when a file share is accessed. ms.assetid: 9ea985f8-8936-4b79-abdb-35cbb7138f78 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-file-system.md b/windows/keep-secure/audit-file-system.md index 53faccfac6..1ddb1c3d49 100644 --- a/windows/keep-secure/audit-file-system.md +++ b/windows/keep-secure/audit-file-system.md @@ -2,7 +2,7 @@ title: Audit File System (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit File System, which determines whether the operating system generates audit events when users attempt to access file system objects. ms.assetid: 6a71f283-b8e5-41ac-b348-0b7ec6ea0b1f -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.pagetype: security ms.sitesec: library diff --git a/windows/keep-secure/audit-filtering-platform-connection.md b/windows/keep-secure/audit-filtering-platform-connection.md index a23961c6d9..4b8c95c652 100644 --- a/windows/keep-secure/audit-filtering-platform-connection.md +++ b/windows/keep-secure/audit-filtering-platform-connection.md @@ -2,7 +2,7 @@ title: Audit Filtering Platform Connection (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Filtering Platform Connection, which determines whether the operating system generates audit events when connections are allowed or blocked by the Windows Filtering Platform. ms.assetid: d72936e9-ff01-4d18-b864-a4958815df59 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-filtering-platform-packet-drop.md b/windows/keep-secure/audit-filtering-platform-packet-drop.md index fda5bc89e7..96935fa8b7 100644 --- a/windows/keep-secure/audit-filtering-platform-packet-drop.md +++ b/windows/keep-secure/audit-filtering-platform-packet-drop.md @@ -2,7 +2,7 @@ title: Audit Filtering Platform Packet Drop (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Filtering Platform Packet Drop, which determines whether the operating system generates audit events when packets are dropped by the Windows Filtering Platform. ms.assetid: 95457601-68d1-4385-af20-87916ddab906 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-filtering-platform-policy-change.md b/windows/keep-secure/audit-filtering-platform-policy-change.md index 97f04007ea..10c8a9459b 100644 --- a/windows/keep-secure/audit-filtering-platform-policy-change.md +++ b/windows/keep-secure/audit-filtering-platform-policy-change.md @@ -2,7 +2,7 @@ title: Audit Filtering Platform Policy Change (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Filtering Platform Policy Change, which determines whether the operating system generates audit events for certain IPsec and Windows Filtering Platform actions. ms.assetid: 0eaf1c56-672b-4ea9-825a-22dc03eb4041 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-force-audit-policy-subcategory-settings-to-override.md b/windows/keep-secure/audit-force-audit-policy-subcategory-settings-to-override.md index 2ceff2fa34..50880766f6 100644 --- a/windows/keep-secure/audit-force-audit-policy-subcategory-settings-to-override.md +++ b/windows/keep-secure/audit-force-audit-policy-subcategory-settings-to-override.md @@ -2,7 +2,7 @@ title: Audit Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings (Windows 10) description: Describes the best practices, location, values, and security considerations for the Audit Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings security policy setting. ms.assetid: 8ddc06bc-b6d6-4bac-9051-e0d77035bd4e -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-group-membership.md b/windows/keep-secure/audit-group-membership.md index bfbd5e7887..d738bb1582 100644 --- a/windows/keep-secure/audit-group-membership.md +++ b/windows/keep-secure/audit-group-membership.md @@ -2,7 +2,7 @@ title: Audit Group Membership (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit Group Membership, which enables you to audit group memberships when they are enumerated on the client PC. ms.assetid: 1CD7B014-FBD9-44B9-9274-CC5715DE58B9 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-handle-manipulation.md b/windows/keep-secure/audit-handle-manipulation.md index da8a48ee26..6b9fb9ab21 100644 --- a/windows/keep-secure/audit-handle-manipulation.md +++ b/windows/keep-secure/audit-handle-manipulation.md @@ -2,7 +2,7 @@ title: Audit Handle Manipulation (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Handle Manipulation, which determines whether the operating system generates audit events when a handle to an object is opened or closed. ms.assetid: 1fbb004a-ccdc-4c80-b3da-a4aa7a9f4091 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-ipsec-driver.md b/windows/keep-secure/audit-ipsec-driver.md index 7394906faa..dbe0ede32c 100644 --- a/windows/keep-secure/audit-ipsec-driver.md +++ b/windows/keep-secure/audit-ipsec-driver.md @@ -2,7 +2,7 @@ title: Audit IPsec Driver (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit IPsec Driver, which determines whether the operating system generates audit events for the activities of the IPsec driver. ms.assetid: c8b8c02f-5ad0-4ee5-9123-ea8cdae356a5 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-ipsec-extended-mode.md b/windows/keep-secure/audit-ipsec-extended-mode.md index 89f0857940..5030fc74a2 100644 --- a/windows/keep-secure/audit-ipsec-extended-mode.md +++ b/windows/keep-secure/audit-ipsec-extended-mode.md @@ -2,7 +2,7 @@ title: Audit IPsec Extended Mode (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit IPsec Extended Mode, which determines whether the operating system generates audit events for the results of the Internet Key Exchange (IKE) protocol and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. ms.assetid: 2b4fee9e-482a-4181-88a8-6a79d8fc8049 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-ipsec-main-mode.md b/windows/keep-secure/audit-ipsec-main-mode.md index 203307a841..872af92c04 100644 --- a/windows/keep-secure/audit-ipsec-main-mode.md +++ b/windows/keep-secure/audit-ipsec-main-mode.md @@ -2,7 +2,7 @@ title: Audit IPsec Main Mode (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit IPsec Main Mode, which determines whether the operating system generates events for the results of the Internet Key Exchange (IKE) protocol and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. ms.assetid: 06ed26ec-3620-4ef4-a47a-c70df9c8827b -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-ipsec-quick-mode.md b/windows/keep-secure/audit-ipsec-quick-mode.md index 79de06ad17..8a3446cb65 100644 --- a/windows/keep-secure/audit-ipsec-quick-mode.md +++ b/windows/keep-secure/audit-ipsec-quick-mode.md @@ -2,7 +2,7 @@ title: Audit IPsec Quick Mode (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit IPsec Quick Mode, which determines whether the operating system generates audit events for the results of the Internet Key Exchange (IKE) protocol and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. ms.assetid: 7be67a15-c2ce-496a-9719-e25ac7699114 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-kerberos-authentication-service.md b/windows/keep-secure/audit-kerberos-authentication-service.md index 85498b7404..f8665de37e 100644 --- a/windows/keep-secure/audit-kerberos-authentication-service.md +++ b/windows/keep-secure/audit-kerberos-authentication-service.md @@ -2,7 +2,7 @@ title: Audit Kerberos Authentication Service (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Kerberos Authentication Service, which determines whether to generate audit events for Kerberos authentication ticket-granting ticket (TGT) requests. ms.assetid: 990dd6d9-1a1f-4cce-97ba-5d7e0a7db859 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-kerberos-service-ticket-operations.md b/windows/keep-secure/audit-kerberos-service-ticket-operations.md index 5f00cf260a..4e3a1976d6 100644 --- a/windows/keep-secure/audit-kerberos-service-ticket-operations.md +++ b/windows/keep-secure/audit-kerberos-service-ticket-operations.md @@ -2,7 +2,7 @@ title: Audit Kerberos Service Ticket Operations (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Kerberos Service Ticket Operations, which determines whether the operating system generates security audit events for Kerberos service ticket requests. ms.assetid: ddc0abef-ac7f-4849-b90d-66700470ccd6 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-kernel-object.md b/windows/keep-secure/audit-kernel-object.md index 783f4c3e18..6600a97c21 100644 --- a/windows/keep-secure/audit-kernel-object.md +++ b/windows/keep-secure/audit-kernel-object.md @@ -2,7 +2,7 @@ title: Audit Kernel Object (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Kernel Object, which determines whether the operating system generates audit events when users attempt to access the system kernel, which includes mutexes and semaphores. ms.assetid: 75619d8b-b1eb-445b-afc9-0f9053be97fb -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-logoff.md b/windows/keep-secure/audit-logoff.md index 05aee8928a..56970b2562 100644 --- a/windows/keep-secure/audit-logoff.md +++ b/windows/keep-secure/audit-logoff.md @@ -2,7 +2,7 @@ title: Audit Logoff (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Logoff, which determines whether the operating system generates audit events when logon sessions are terminated. ms.assetid: 681e51f2-ba06-46f5-af8c-d9c48d515432 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-logon.md b/windows/keep-secure/audit-logon.md index fb98f6691c..bd363a9eb0 100644 --- a/windows/keep-secure/audit-logon.md +++ b/windows/keep-secure/audit-logon.md @@ -2,7 +2,7 @@ title: Audit Logon (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Logon, which determines whether the operating system generates audit events when a user attempts to log on to a computer. ms.assetid: ca968d03-7d52-48c4-ba0e-2bcd2937231b -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-mpssvc-rule-level-policy-change.md b/windows/keep-secure/audit-mpssvc-rule-level-policy-change.md index 67760b944f..ab8412a168 100644 --- a/windows/keep-secure/audit-mpssvc-rule-level-policy-change.md +++ b/windows/keep-secure/audit-mpssvc-rule-level-policy-change.md @@ -2,7 +2,7 @@ title: Audit MPSSVC Rule-Level Policy Change (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit MPSSVC Rule-Level Policy Change, which determines whether the operating system generates audit events when changes are made to policy rules for the Microsoft Protection Service (MPSSVC.exe). ms.assetid: 263461b3-c61c-4ec3-9dee-851164845019 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-network-policy-server.md b/windows/keep-secure/audit-network-policy-server.md index 5f060ff57e..f98d7f0579 100644 --- a/windows/keep-secure/audit-network-policy-server.md +++ b/windows/keep-secure/audit-network-policy-server.md @@ -2,7 +2,7 @@ title: Audit Network Policy Server (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Network Policy Server, which determines whether the operating system generates audit events for RADIUS (IAS) and Network Access Protection (NAP) activity on user access requests (Grant, Deny, Discard, Quarantine, Lock, and Unlock). ms.assetid: 43b2aea4-26df-46da-b761-2b30f51a80f7 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-non-sensitive-privilege-use.md b/windows/keep-secure/audit-non-sensitive-privilege-use.md index e1321ebc6a..45dd5b1a2c 100644 --- a/windows/keep-secure/audit-non-sensitive-privilege-use.md +++ b/windows/keep-secure/audit-non-sensitive-privilege-use.md @@ -2,7 +2,7 @@ title: Audit Non-Sensitive Privilege Use (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Non-Sensitive Privilege Use, which determines whether the operating system generates audit events when non-sensitive privileges (user rights) are used. ms.assetid: 8fd74783-1059-443e-aa86-566d78606627 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-other-account-logon-events.md b/windows/keep-secure/audit-other-account-logon-events.md index 57eaa771fa..4511233562 100644 --- a/windows/keep-secure/audit-other-account-logon-events.md +++ b/windows/keep-secure/audit-other-account-logon-events.md @@ -2,7 +2,7 @@ title: Audit Other Account Logon Events (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit Other Account Logon Events, which allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets. ms.assetid: c8c6bfe0-33d2-4600-bb1a-6afa840d75b3 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-other-account-management-events.md b/windows/keep-secure/audit-other-account-management-events.md index 737c91e478..48fecc4788 100644 --- a/windows/keep-secure/audit-other-account-management-events.md +++ b/windows/keep-secure/audit-other-account-management-events.md @@ -2,7 +2,7 @@ title: Audit Other Account Management Events (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Other Account Management Events, which determines whether the operating system generates user account management audit events. ms.assetid: 4ce22eeb-a96f-4cf9-a46d-6642961a31d5 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-other-logonlogoff-events.md b/windows/keep-secure/audit-other-logonlogoff-events.md index 14b371601d..5b9c517af5 100644 --- a/windows/keep-secure/audit-other-logonlogoff-events.md +++ b/windows/keep-secure/audit-other-logonlogoff-events.md @@ -2,7 +2,7 @@ title: Audit Other Logon/Logoff Events (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Other Logon/Logoff Events, which determines whether Windows generates audit events for other logon or logoff events. ms.assetid: 76d987cd-1917-4907-a739-dd642609a458 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-other-object-access-events.md b/windows/keep-secure/audit-other-object-access-events.md index 71b1ee1965..3d453c1927 100644 --- a/windows/keep-secure/audit-other-object-access-events.md +++ b/windows/keep-secure/audit-other-object-access-events.md @@ -2,7 +2,7 @@ title: Audit Other Object Access Events (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Other Object Access Events, which determines whether the operating system generates audit events for the management of Task Scheduler jobs or COM+ objects. ms.assetid: b9774595-595d-4199-b0c5-8dbc12b6c8b2 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-other-policy-change-events.md b/windows/keep-secure/audit-other-policy-change-events.md index 7e2c53404a..5ef649bca4 100644 --- a/windows/keep-secure/audit-other-policy-change-events.md +++ b/windows/keep-secure/audit-other-policy-change-events.md @@ -2,7 +2,7 @@ title: Audit Other Policy Change Events (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Other Policy Change Events, which determines whether the operating system generates audit events for security policy changes that are not otherwise audited in the Policy Change category. ms.assetid: 8618502e-c21c-41cc-8a49-3dc1eb359e60 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-other-privilege-use-events.md b/windows/keep-secure/audit-other-privilege-use-events.md index 839251f763..5babb23a8a 100644 --- a/windows/keep-secure/audit-other-privilege-use-events.md +++ b/windows/keep-secure/audit-other-privilege-use-events.md @@ -2,7 +2,7 @@ title: Audit Other Privilege Use Events (Windows 10) description: This security policy setting is not used. ms.assetid: 5f7f5b25-42a6-499f-8aa2-01ac79a2a63c -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-other-system-events.md b/windows/keep-secure/audit-other-system-events.md index 2b28658209..3bb668bd64 100644 --- a/windows/keep-secure/audit-other-system-events.md +++ b/windows/keep-secure/audit-other-system-events.md @@ -2,7 +2,7 @@ title: Audit Other System Events (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Other System Events, which determines whether the operating system audits various system events. ms.assetid: 2401e4cc-d94e-41ec-82a7-e10914295f8b -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-pnp-activity.md b/windows/keep-secure/audit-pnp-activity.md index aef1c0ae47..c80884e78c 100644 --- a/windows/keep-secure/audit-pnp-activity.md +++ b/windows/keep-secure/audit-pnp-activity.md @@ -2,7 +2,7 @@ title: Audit PNP Activity (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit PNP Activity, which determines when plug and play detects an external device. ms.assetid: A3D87B3B-EBBE-442A-953B-9EB75A5F600E -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-policy.md b/windows/keep-secure/audit-policy.md index 87cf555f43..2cd2c8cd95 100644 --- a/windows/keep-secure/audit-policy.md +++ b/windows/keep-secure/audit-policy.md @@ -2,7 +2,7 @@ title: Audit Policy (Windows 10) description: Provides information about basic audit policies that are available in Windows and links to information about each setting. ms.assetid: 2e8ea400-e555-43e5-89d6-0898cb89da90 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-process-creation.md b/windows/keep-secure/audit-process-creation.md index dbe4b6bc69..c9c6d41c57 100644 --- a/windows/keep-secure/audit-process-creation.md +++ b/windows/keep-secure/audit-process-creation.md @@ -2,7 +2,7 @@ title: Audit Process Creation (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Process Creation, which determines whether the operating system generates audit events when a process is created (starts). ms.assetid: 67e39fcd-ded6-45e8-b1b6-d411e4e93019 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-process-termination.md b/windows/keep-secure/audit-process-termination.md index 4208a938c3..9f4fde6d86 100644 --- a/windows/keep-secure/audit-process-termination.md +++ b/windows/keep-secure/audit-process-termination.md @@ -2,7 +2,7 @@ title: Audit Process Termination (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Process Termination, which determines whether the operating system generates audit events when an attempt is made to end a process. ms.assetid: 65d88e53-14aa-48a4-812b-557cebbf9e50 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-registry.md b/windows/keep-secure/audit-registry.md index 40ea22bf27..2f58eb5560 100644 --- a/windows/keep-secure/audit-registry.md +++ b/windows/keep-secure/audit-registry.md @@ -2,7 +2,7 @@ title: Audit Registry (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Registry, which determines whether the operating system generates audit events when users attempt to access registry objects. ms.assetid: 02bcc23b-4823-46ac-b822-67beedf56b32 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-removable-storage.md b/windows/keep-secure/audit-removable-storage.md index 1892857f3e..cdfc2b415e 100644 --- a/windows/keep-secure/audit-removable-storage.md +++ b/windows/keep-secure/audit-removable-storage.md @@ -2,7 +2,7 @@ title: Audit Removable Storage (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Removable Storage, which determines when there is a read or a write to a removable drive. ms.assetid: 1746F7B3-8B41-4661-87D8-12F734AFFB26 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-rpc-events.md b/windows/keep-secure/audit-rpc-events.md index dfb512694b..8bd9607c04 100644 --- a/windows/keep-secure/audit-rpc-events.md +++ b/windows/keep-secure/audit-rpc-events.md @@ -2,7 +2,7 @@ title: Audit RPC Events (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit RPC Events, which determines whether the operating system generates audit events when inbound remote procedure call (RPC) connections are made. ms.assetid: 868aec2d-93b4-4bc8-a150-941f88838ba6 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-sam.md b/windows/keep-secure/audit-sam.md index c682e87a89..734ac0681a 100644 --- a/windows/keep-secure/audit-sam.md +++ b/windows/keep-secure/audit-sam.md @@ -2,7 +2,7 @@ title: Audit SAM (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit SAM, which enables you to audit events that are generated by attempts to access Security Account Manager (SAM) objects. ms.assetid: 1d00f955-383d-4c95-bbd1-fab4a991a46e -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-security-group-management.md b/windows/keep-secure/audit-security-group-management.md index 65d91ba967..7ff17d66f3 100644 --- a/windows/keep-secure/audit-security-group-management.md +++ b/windows/keep-secure/audit-security-group-management.md @@ -2,7 +2,7 @@ title: Audit Security Group Management (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit Security Group Management, which determines whether the operating system generates audit events when specific security group management tasks are performed. ms.assetid: ac2ee101-557b-4c84-b9fa-4fb23331f1aa -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-security-state-change.md b/windows/keep-secure/audit-security-state-change.md index efda133f49..e8c184b3e0 100644 --- a/windows/keep-secure/audit-security-state-change.md +++ b/windows/keep-secure/audit-security-state-change.md @@ -2,7 +2,7 @@ title: Audit Security State Change (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Security State Change, which determines whether Windows generates audit events for changes in the security state of a system. ms.assetid: decb3218-a67d-4efa-afc0-337c79a89a2d -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-security-system-extension.md b/windows/keep-secure/audit-security-system-extension.md index e605195736..428a0d685c 100644 --- a/windows/keep-secure/audit-security-system-extension.md +++ b/windows/keep-secure/audit-security-system-extension.md @@ -2,7 +2,7 @@ title: Audit Security System Extension (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Security System Extension, which determines whether the operating system generates audit events related to security system extensions. ms.assetid: 9f3c6bde-42b2-4a0a-b353-ed3106ebc005 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-sensitive-privilege-use.md b/windows/keep-secure/audit-sensitive-privilege-use.md index 2c7cd5a902..718aa00bd9 100644 --- a/windows/keep-secure/audit-sensitive-privilege-use.md +++ b/windows/keep-secure/audit-sensitive-privilege-use.md @@ -2,7 +2,7 @@ title: Audit Sensitive Privilege Use (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Sensitive Privilege Use, which determines whether the operating system generates audit events when sensitive privileges (user rights) are used. ms.assetid: 915abf50-42d2-45f6-9fd1-e7bd201b193d -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md b/windows/keep-secure/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md index 5ce9aeecf7..0cd45cc597 100644 --- a/windows/keep-secure/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md +++ b/windows/keep-secure/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md @@ -2,7 +2,7 @@ title: Audit Shut down system immediately if unable to log security audits (Windows 10) description: Describes the best practices, location, values, management practices, and security considerations for the Audit Shut down system immediately if unable to log security audits security policy setting. ms.assetid: 2cd23cd9-0e44-4d0b-a1f1-39fc29303826 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-special-logon.md b/windows/keep-secure/audit-special-logon.md index 439cf91d3d..f4bad313c7 100644 --- a/windows/keep-secure/audit-special-logon.md +++ b/windows/keep-secure/audit-special-logon.md @@ -2,7 +2,7 @@ title: Audit Special Logon (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Special Logon, which determines whether the operating system generates audit events under special sign on (or log on) circumstances. ms.assetid: e1501bac-1d09-4593-8ebb-f311231567d3 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-system-integrity.md b/windows/keep-secure/audit-system-integrity.md index dfc2666ebf..38fd5a5ce5 100644 --- a/windows/keep-secure/audit-system-integrity.md +++ b/windows/keep-secure/audit-system-integrity.md @@ -2,7 +2,7 @@ title: Audit System Integrity (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit System Integrity, which determines whether the operating system audits events that violate the integrity of the security subsystem. ms.assetid: 942a9a7f-fa31-4067-88c7-f73978bf2034 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-user-account-management.md b/windows/keep-secure/audit-user-account-management.md index 1f05f3085b..a763d8ea76 100644 --- a/windows/keep-secure/audit-user-account-management.md +++ b/windows/keep-secure/audit-user-account-management.md @@ -2,7 +2,7 @@ title: Audit User Account Management (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit User Account Management, which determines whether the operating system generates audit events when specific user account management tasks are performed. ms.assetid: f7e72998-3858-4197-a443-19586ecc4bfb -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/audit-user-device-claims.md b/windows/keep-secure/audit-user-device-claims.md index 254bfb2c7d..e5576c4bdf 100644 --- a/windows/keep-secure/audit-user-device-claims.md +++ b/windows/keep-secure/audit-user-device-claims.md @@ -2,7 +2,7 @@ title: Audit User/Device Claims (Windows 10) description: This topic for the IT professional describes the advanced security audit policy setting, Audit User/Device Claims, which enables you to audit security events that are generated by user and device claims. ms.assetid: D3D2BFAF-F2C0-462A-9377-673DB49D5486 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/back-up-files-and-directories.md b/windows/keep-secure/back-up-files-and-directories.md index 2cddb14842..6f6a7b8805 100644 --- a/windows/keep-secure/back-up-files-and-directories.md +++ b/windows/keep-secure/back-up-files-and-directories.md @@ -2,7 +2,7 @@ title: Back up files and directories (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Back up files and directories security policy setting. ms.assetid: 1cd6bdd5-1501-41f4-98b9-acf29ac173ae -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/backup-tpm-recovery-information-to-ad-ds.md b/windows/keep-secure/backup-tpm-recovery-information-to-ad-ds.md index 5f46d91a0d..aee1050952 100644 --- a/windows/keep-secure/backup-tpm-recovery-information-to-ad-ds.md +++ b/windows/keep-secure/backup-tpm-recovery-information-to-ad-ds.md @@ -2,7 +2,7 @@ title: Backup the TPM recovery Information to AD DS (Windows 10) description: This topic for the IT professional describes how to back up a computer’s Trusted Platform Module (TPM) information to Active Directory Domain Services (AD DS) so that you can use AD DS to administer the TPM from a remote computer. ms.assetid: 62bcec80-96a1-464e-8b3f-d177a7565ac5 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/basic-audit-account-logon-events.md b/windows/keep-secure/basic-audit-account-logon-events.md index 4bfa89fd5b..392a87e381 100644 --- a/windows/keep-secure/basic-audit-account-logon-events.md +++ b/windows/keep-secure/basic-audit-account-logon-events.md @@ -2,7 +2,7 @@ title: Audit account logon events (Windows 10) description: Determines whether to audit each instance of a user logging on to or logging off from another device in which this device is used to validate the account. ms.assetid: 84B44181-E325-49A1-8398-AECC3CE0A516 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/basic-audit-account-management.md b/windows/keep-secure/basic-audit-account-management.md index ee0cf33722..364a455ec2 100644 --- a/windows/keep-secure/basic-audit-account-management.md +++ b/windows/keep-secure/basic-audit-account-management.md @@ -2,7 +2,7 @@ title: Audit account management (Windows 10) description: Determines whether to audit each event of account management on a device. ms.assetid: 369197E1-7E0E-45A4-89EA-16D91EF01689 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/basic-audit-directory-service-access.md b/windows/keep-secure/basic-audit-directory-service-access.md index 0d48b78b27..b377adcecc 100644 --- a/windows/keep-secure/basic-audit-directory-service-access.md +++ b/windows/keep-secure/basic-audit-directory-service-access.md @@ -2,7 +2,7 @@ title: Audit directory service access (Windows 10) description: Determines whether to audit the event of a user accessing an Active Directory object that has its own system access control list (SACL) specified. ms.assetid: 52F02EED-3CFE-4307-8D06-CF1E27693D09 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/basic-audit-logon-events.md b/windows/keep-secure/basic-audit-logon-events.md index d83d80357e..143c150317 100644 --- a/windows/keep-secure/basic-audit-logon-events.md +++ b/windows/keep-secure/basic-audit-logon-events.md @@ -2,7 +2,7 @@ title: Audit logon events (Windows 10) description: Determines whether to audit each instance of a user logging on to or logging off from a device. ms.assetid: 78B5AFCB-0BBD-4C38-9FE9-6B4571B94A35 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/basic-audit-object-access.md b/windows/keep-secure/basic-audit-object-access.md index 6ae03e3c93..05d9500660 100644 --- a/windows/keep-secure/basic-audit-object-access.md +++ b/windows/keep-secure/basic-audit-object-access.md @@ -2,7 +2,7 @@ title: Audit object access (Windows 10) description: Determines whether to audit the event of a user accessing an object--for example, a file, folder, registry key, printer, and so forth--that has its own system access control list (SACL) specified. ms.assetid: D15B6D67-7886-44C2-9972-3F192D5407EA -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/basic-audit-policy-change.md b/windows/keep-secure/basic-audit-policy-change.md index 0590d832ee..9aee64c9c8 100644 --- a/windows/keep-secure/basic-audit-policy-change.md +++ b/windows/keep-secure/basic-audit-policy-change.md @@ -2,7 +2,7 @@ title: Audit policy change (Windows 10) description: Determines whether to audit every incident of a change to user rights assignment policies, audit policies, or trust policies. ms.assetid: 1025A648-6B22-4C85-9F47-FE0897F1FA31 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/basic-audit-privilege-use.md b/windows/keep-secure/basic-audit-privilege-use.md index 38a2117169..62d38eec12 100644 --- a/windows/keep-secure/basic-audit-privilege-use.md +++ b/windows/keep-secure/basic-audit-privilege-use.md @@ -2,7 +2,7 @@ title: Audit privilege use (Windows 10) description: Determines whether to audit each instance of a user exercising a user right. ms.assetid: C5C6DAAF-8B58-4DFB-B1CE-F0675AE0E9F8 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/basic-audit-process-tracking.md b/windows/keep-secure/basic-audit-process-tracking.md index 9fd272a03c..acfe7b0fb1 100644 --- a/windows/keep-secure/basic-audit-process-tracking.md +++ b/windows/keep-secure/basic-audit-process-tracking.md @@ -2,7 +2,7 @@ title: Audit process tracking (Windows 10) description: Determines whether to audit detailed tracking information for events such as program activation, process exit, handle duplication, and indirect object access. ms.assetid: 91AC5C1E-F4DA-4B16-BEE2-C92D66E4CEEA -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/basic-audit-system-events.md b/windows/keep-secure/basic-audit-system-events.md index 7724e17654..70674dbb21 100644 --- a/windows/keep-secure/basic-audit-system-events.md +++ b/windows/keep-secure/basic-audit-system-events.md @@ -2,7 +2,7 @@ title: Audit system events (Windows 10) description: Determines whether to audit when a user restarts or shuts down the computer or when an event occurs that affects either the system security or the security log. ms.assetid: BF27588C-2AA7-4365-A4BF-3BB377916447 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/basic-security-audit-policies.md b/windows/keep-secure/basic-security-audit-policies.md index 0ad34f0790..1de3ff5747 100644 --- a/windows/keep-secure/basic-security-audit-policies.md +++ b/windows/keep-secure/basic-security-audit-policies.md @@ -2,7 +2,7 @@ title: Basic security audit policies (Windows 10) description: Before you implement auditing, you must decide on an auditing policy. ms.assetid: 3B678568-7AD7-4734-9BB4-53CF5E04E1D3 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/basic-security-audit-policy-settings.md b/windows/keep-secure/basic-security-audit-policy-settings.md index eeade033ce..82989b0eee 100644 --- a/windows/keep-secure/basic-security-audit-policy-settings.md +++ b/windows/keep-secure/basic-security-audit-policy-settings.md @@ -2,7 +2,7 @@ title: Basic security audit policy settings (Windows 10) description: Basic security audit policy settings are found under Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Audit Policy. ms.assetid: 31C2C453-2CFC-4D9E-BC88-8CE1C1A8F900 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/bcd-settings-and-bitlocker.md b/windows/keep-secure/bcd-settings-and-bitlocker.md index bee0c9e8f3..ccd9afd831 100644 --- a/windows/keep-secure/bcd-settings-and-bitlocker.md +++ b/windows/keep-secure/bcd-settings-and-bitlocker.md @@ -2,7 +2,7 @@ title: BCD settings and BitLocker (Windows 10) description: This topic for IT professionals describes the BCD settings that are used by BitLocker. ms.assetid: c4ab7ac9-16dc-4c7e-b061-c0b0deb2c4fa -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/bitlocker-basic-deployment.md b/windows/keep-secure/bitlocker-basic-deployment.md index e63322f296..b83692c713 100644 --- a/windows/keep-secure/bitlocker-basic-deployment.md +++ b/windows/keep-secure/bitlocker-basic-deployment.md @@ -2,7 +2,7 @@ title: BitLocker basic deployment (Windows 10) description: This topic for the IT professional explains how BitLocker features can be used to protect your data through drive encryption. ms.assetid: 97c646cb-9e53-4236-9678-354af41151c4 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/bitlocker-countermeasures.md b/windows/keep-secure/bitlocker-countermeasures.md index 687bf6047b..7e1f6c7414 100644 --- a/windows/keep-secure/bitlocker-countermeasures.md +++ b/windows/keep-secure/bitlocker-countermeasures.md @@ -2,7 +2,7 @@ title: BitLocker Countermeasures (Windows 10) description: Windows uses technologies including TPM, Secure Boot, Trusted Boot, and Early Launch Antimalware (ELAM) to protect against attacks on the BitLocker encryption key. ms.assetid: ebdb0637-2597-4da1-bb18-8127964686ea -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/bitlocker-frequently-asked-questions.md b/windows/keep-secure/bitlocker-frequently-asked-questions.md index 4d179869fb..23dc64932f 100644 --- a/windows/keep-secure/bitlocker-frequently-asked-questions.md +++ b/windows/keep-secure/bitlocker-frequently-asked-questions.md @@ -2,7 +2,7 @@ title: BitLocker frequently asked questions (FAQ) (Windows 10) description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/bitlocker-group-policy-settings.md b/windows/keep-secure/bitlocker-group-policy-settings.md index 77412bda71..8d3864a681 100644 --- a/windows/keep-secure/bitlocker-group-policy-settings.md +++ b/windows/keep-secure/bitlocker-group-policy-settings.md @@ -2,7 +2,7 @@ title: BitLocker Group Policy settings (Windows 10) description: This topic for IT professionals describes the function, location, and effect of each Group Policy setting that is used to manage BitLocker Drive Encryption. ms.assetid: 4904e336-29fe-4cef-bb6c-3950541864af -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/bitlocker-how-to-deploy-on-windows-server.md b/windows/keep-secure/bitlocker-how-to-deploy-on-windows-server.md index e7035aa4e8..e57e269aff 100644 --- a/windows/keep-secure/bitlocker-how-to-deploy-on-windows-server.md +++ b/windows/keep-secure/bitlocker-how-to-deploy-on-windows-server.md @@ -2,7 +2,7 @@ title: BitLocker How to deploy on Windows Server 2012 and later (Windows 10) description: This topic for the IT professional explains how to deploy BitLocker and Windows Server 2012 and later. ms.assetid: 91c18e9e-6ab4-4607-8c75-d983bbe2542f -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/bitlocker-how-to-enable-network-unlock.md b/windows/keep-secure/bitlocker-how-to-enable-network-unlock.md index 37e9e8b02d..16e0aa12b2 100644 --- a/windows/keep-secure/bitlocker-how-to-enable-network-unlock.md +++ b/windows/keep-secure/bitlocker-how-to-enable-network-unlock.md @@ -2,7 +2,7 @@ title: BitLocker How to enable Network Unlock (Windows 10) description: This topic for the IT professional describes how BitLocker Network Unlock works and how to configure it. ms.assetid: be45bc28-47db-4931-bfec-3c348151d2e9 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/bitlocker-overview.md b/windows/keep-secure/bitlocker-overview.md index 897f3dd747..58f3047141 100644 --- a/windows/keep-secure/bitlocker-overview.md +++ b/windows/keep-secure/bitlocker-overview.md @@ -2,7 +2,7 @@ title: BitLocker (Windows 10) description: This topic provides a high-level overview of BitLocker, including a list of system requirements, practical applications, and deprecated features. ms.assetid: 40526fcc-3e0d-4d75-90e0-c7d0615f33b2 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/bitlocker-recovery-guide-plan.md b/windows/keep-secure/bitlocker-recovery-guide-plan.md index 80df5a2c52..61d362d1a3 100644 --- a/windows/keep-secure/bitlocker-recovery-guide-plan.md +++ b/windows/keep-secure/bitlocker-recovery-guide-plan.md @@ -2,7 +2,7 @@ title: BitLocker recovery guide (Windows 10) description: This topic for IT professionals describes how to recover BitLocker keys from AD DS. ms.assetid: d0f722e9-1773-40bf-8456-63ee7a95ea14 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md b/windows/keep-secure/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md index a20d25ff66..8d48b8aff4 100644 --- a/windows/keep-secure/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md +++ b/windows/keep-secure/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md @@ -2,7 +2,7 @@ title: BitLocker Use BitLocker Drive Encryption Tools to manage BitLocker (Windows 10) description: This topic for the IT professional describes how to use tools to manage BitLocker. ms.assetid: e869db9c-e906-437b-8c70-741dd61b5ea6 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/bitlocker-use-bitlocker-recovery-password-viewer.md b/windows/keep-secure/bitlocker-use-bitlocker-recovery-password-viewer.md index 61521699b2..850c7507b0 100644 --- a/windows/keep-secure/bitlocker-use-bitlocker-recovery-password-viewer.md +++ b/windows/keep-secure/bitlocker-use-bitlocker-recovery-password-viewer.md @@ -2,7 +2,7 @@ title: BitLocker Use BitLocker Recovery Password Viewer (Windows 10) description: This topic for the IT professional describes how to use the BitLocker Recovery Password Viewer. ms.assetid: 04c93ac5-5dac-415e-b636-de81435753a2 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/block-untrusted-fonts-in-enterprise.md b/windows/keep-secure/block-untrusted-fonts-in-enterprise.md index 032ef98517..83a3f113a9 100644 --- a/windows/keep-secure/block-untrusted-fonts-in-enterprise.md +++ b/windows/keep-secure/block-untrusted-fonts-in-enterprise.md @@ -2,9 +2,10 @@ title: Block untrusted fonts in an enterprise (Windows 10) description: To help protect your company from attacks which may originate from untrusted or attacker controlled font files, we’ve created the Blocking Untrusted Fonts feature. ms.assetid: a3354c8e-4208-4be6-bc19-56a572c361b4 -keywords: ["font blocking", "untrusted font blocking", "block fonts", "untrusted fonts"] -ms.prod: W10 +keywords: font blocking, untrusted font blocking, block fonts, untrusted fonts +ms.prod: w10 ms.mktglfcycl: deploy +ms.pagetype: security ms.sitesec: library author: eross-msft --- diff --git a/windows/keep-secure/bypass-traverse-checking.md b/windows/keep-secure/bypass-traverse-checking.md index d07fea0ff5..60df8885da 100644 --- a/windows/keep-secure/bypass-traverse-checking.md +++ b/windows/keep-secure/bypass-traverse-checking.md @@ -2,7 +2,7 @@ title: Bypass traverse checking (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Bypass traverse checking security policy setting. ms.assetid: 1c828655-68d3-4140-aa0f-caa903a7087e -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/change-history-for-keep-windows-10-secure.md b/windows/keep-secure/change-history-for-keep-windows-10-secure.md index 5f96e1fcb1..3c7d6abdfe 100644 --- a/windows/keep-secure/change-history-for-keep-windows-10-secure.md +++ b/windows/keep-secure/change-history-for-keep-windows-10-secure.md @@ -2,9 +2,10 @@ title: Change history for Keep Windows 10 secure (Windows 10) description: This topic lists new and updated topics in the Keep Windows 10 secure documentation for Windows 10 and Windows 10 Mobile. ms.assetid: E50EC5E6-71AA-4FF1-8356-574CFDB8079B -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- diff --git a/windows/keep-secure/change-the-system-time.md b/windows/keep-secure/change-the-system-time.md index 4ac7356093..e6f43e3f88 100644 --- a/windows/keep-secure/change-the-system-time.md +++ b/windows/keep-secure/change-the-system-time.md @@ -2,7 +2,7 @@ title: Change the system time (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Change the system time security policy setting. ms.assetid: f2f6637d-acbc-4352-8ca3-ec563f918e65 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/change-the-time-zone.md b/windows/keep-secure/change-the-time-zone.md index 1b27d5afe9..3eb72473a5 100644 --- a/windows/keep-secure/change-the-time-zone.md +++ b/windows/keep-secure/change-the-time-zone.md @@ -2,7 +2,7 @@ title: Change the time zone (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Change the time zone security policy setting. ms.assetid: 3b1afae4-68bb-472f-a43e-49e300d73e50 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/change-the-tpm-owner-password.md b/windows/keep-secure/change-the-tpm-owner-password.md index 7241d40deb..ba11bc7a8c 100644 --- a/windows/keep-secure/change-the-tpm-owner-password.md +++ b/windows/keep-secure/change-the-tpm-owner-password.md @@ -2,7 +2,7 @@ title: Change the TPM owner password (Windows 10) description: This topic for the IT professional describes how to change the password or PIN for the owner of the Trusted Platform Module (TPM) that is installed on your system. ms.assetid: e43dcff3-acb4-4a92-8816-d6b64b7f2f45 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/choose-the-right-bitlocker-countermeasure.md b/windows/keep-secure/choose-the-right-bitlocker-countermeasure.md index 3e84e8f209..0293f672ae 100644 --- a/windows/keep-secure/choose-the-right-bitlocker-countermeasure.md +++ b/windows/keep-secure/choose-the-right-bitlocker-countermeasure.md @@ -2,7 +2,7 @@ title: Choose the right BitLocker countermeasure (Windows 10) description: This section outlines the best countermeasures you can use to protect your organization from bootkits and rootkits, brute force sign-in, Direct Memory Access (DMA) attacks, Hyberfil.sys attacks, and memory remanence attacks. ms.assetid: b0b09508-7885-4030-8c61-d91458afdb14 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/configure-an-applocker-policy-for-audit-only.md b/windows/keep-secure/configure-an-applocker-policy-for-audit-only.md index 58ba26536b..206c0415fe 100644 --- a/windows/keep-secure/configure-an-applocker-policy-for-audit-only.md +++ b/windows/keep-secure/configure-an-applocker-policy-for-audit-only.md @@ -2,7 +2,7 @@ title: Configure an AppLocker policy for audit only (Windows 10) description: This topic for IT professionals describes how to set AppLocker policies to Audit only within your IT environment by using AppLocker. ms.assetid: 10bc87d5-cc7f-4500-b7b3-9006e50afa50 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/configure-an-applocker-policy-for-enforce-rules.md b/windows/keep-secure/configure-an-applocker-policy-for-enforce-rules.md index 3d6aa8a2c7..55e87ba39a 100644 --- a/windows/keep-secure/configure-an-applocker-policy-for-enforce-rules.md +++ b/windows/keep-secure/configure-an-applocker-policy-for-enforce-rules.md @@ -2,7 +2,7 @@ title: Configure an AppLocker policy for enforce rules (Windows 10) description: This topic for IT professionals describes the steps to enable the AppLocker policy enforcement setting. ms.assetid: 5dbbb290-a5ae-4f88-82b3-21e95972e66c -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md index 79f9ff560f..aede6f38ed 100644 --- a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md @@ -3,9 +3,10 @@ title: Configure Windows Defender ATP endpoints description: Use Group Policy or SCCM to deploy the configuration package or do manual registry changes on endpoints so that they are onboarded to the service. keywords: configure endpoints, client onboarding, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints, sccm, system center configuration manager search.product: eADQiWindows 10XVcnh -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: iaanw --- diff --git a/windows/keep-secure/configure-exceptions-for-an-applocker-rule.md b/windows/keep-secure/configure-exceptions-for-an-applocker-rule.md index 0d4e3eefd6..be96e323ed 100644 --- a/windows/keep-secure/configure-exceptions-for-an-applocker-rule.md +++ b/windows/keep-secure/configure-exceptions-for-an-applocker-rule.md @@ -2,7 +2,7 @@ title: Add exceptions for an AppLocker rule (Windows 10) description: This topic for IT professionals describes the steps to specify which apps can or cannot run as exceptions to an AppLocker rule. ms.assetid: d15c9d84-c14b-488d-9f48-bf31ff7ff0c5 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md index aef3743b8f..e0564e8606 100644 --- a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md @@ -3,9 +3,10 @@ title: Configure Windows Defender ATP endpoint proxy and Internet connection set description: Configure the Windows Defender ATP proxy and internet settings to enable communication with the cloud service. keywords: configure, proxy, internet, internet connectivity, settings, proxy settings, web proxy auto detect, wpad, netsh, winhttp, proxy server search.product: eADQiWindows 10XVcnh -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: mjcaparas --- diff --git a/windows/keep-secure/configure-s-mime.md b/windows/keep-secure/configure-s-mime.md index 1d5a83822d..7b9906f26d 100644 --- a/windows/keep-secure/configure-s-mime.md +++ b/windows/keep-secure/configure-s-mime.md @@ -3,7 +3,7 @@ title: Configure S/MIME for Windows 10 and Windows 10 Mobile (Windows 10) description: In Windows 10, S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients who have a digital identification (ID), also known as a certificate, can read them. ms.assetid: 7F9C2A99-42EB-4BCC-BB53-41C04FBBBF05 keywords: encrypt, digital signature -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/configure-the-appLocker-reference-device.md b/windows/keep-secure/configure-the-appLocker-reference-device.md index 59e6e81b2d..97d6fd1361 100644 --- a/windows/keep-secure/configure-the-appLocker-reference-device.md +++ b/windows/keep-secure/configure-the-appLocker-reference-device.md @@ -2,7 +2,7 @@ title: Configure the AppLocker reference device (Windows 10) description: This topic for the IT professional describes the steps to create an AppLocker policy platform structure on a reference computer. ms.assetid: 034bd367-146d-4956-873c-e1e09e6fefee -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/configure-the-application-identity-service.md b/windows/keep-secure/configure-the-application-identity-service.md index 0714a613da..84a1d64b98 100644 --- a/windows/keep-secure/configure-the-application-identity-service.md +++ b/windows/keep-secure/configure-the-application-identity-service.md @@ -3,7 +3,7 @@ title: Configure the Application Identity service (Windows 10) description: This topic for IT professionals shows how to configure the Application Identity service to start automatically or manually. ms.assetid: dc469599-37fd-448b-b23e-5b8e4f17e561 ms.pagetype: security -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft diff --git a/windows/keep-secure/configure-windows-defender-in-windows-10.md b/windows/keep-secure/configure-windows-defender-in-windows-10.md index 72c2a16a9b..b52b5f6c57 100644 --- a/windows/keep-secure/configure-windows-defender-in-windows-10.md +++ b/windows/keep-secure/configure-windows-defender-in-windows-10.md @@ -2,7 +2,7 @@ title: Configure Windows Defender in Windows 10 (Windows 10) description: IT professionals can configure definition updates and cloud-based protection in Windows Defender in Windows 10 through Microsoft Active Directory and Windows Server Update Services (WSUS). ms.assetid: 22649663-AC7A-40D8-B1F7-5CAD9E49653D -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/create-a-basic-audit-policy-settings-for-an-event-category.md b/windows/keep-secure/create-a-basic-audit-policy-settings-for-an-event-category.md index cdd372d271..69742a74b0 100644 --- a/windows/keep-secure/create-a-basic-audit-policy-settings-for-an-event-category.md +++ b/windows/keep-secure/create-a-basic-audit-policy-settings-for-an-event-category.md @@ -2,7 +2,7 @@ title: Create a basic audit policy for an event category (Windows 10) description: By defining auditing settings for specific event categories, you can create an auditing policy that suits the security needs of your organization. ms.assetid: C9F52751-B40D-482E-BE9D-2C61098249D3 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/create-a-pagefile.md b/windows/keep-secure/create-a-pagefile.md index c914d790aa..a8c65abbab 100644 --- a/windows/keep-secure/create-a-pagefile.md +++ b/windows/keep-secure/create-a-pagefile.md @@ -2,7 +2,7 @@ title: Create a pagefile (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Create a pagefile security policy setting. ms.assetid: dc087897-459d-414b-abe0-cd86c8dccdea -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/create-a-rule-for-packaged-apps.md b/windows/keep-secure/create-a-rule-for-packaged-apps.md index 3909260775..f0ed699e79 100644 --- a/windows/keep-secure/create-a-rule-for-packaged-apps.md +++ b/windows/keep-secure/create-a-rule-for-packaged-apps.md @@ -2,7 +2,7 @@ title: Create a rule for packaged apps (Windows 10) description: This topic for IT professionals shows how to create an AppLocker rule for packaged apps with a publisher condition. ms.assetid: e4ffd400-7860-47b3-9118-0e6853c3dfa0 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/create-a-rule-that-uses-a-file-hash-condition.md b/windows/keep-secure/create-a-rule-that-uses-a-file-hash-condition.md index 261eea052b..4a1038f165 100644 --- a/windows/keep-secure/create-a-rule-that-uses-a-file-hash-condition.md +++ b/windows/keep-secure/create-a-rule-that-uses-a-file-hash-condition.md @@ -2,7 +2,7 @@ title: Create a rule that uses a file hash condition (Windows 10) description: This topic for IT professionals shows how to create an AppLocker rule with a file hash condition. ms.assetid: eb3b3524-1b3b-4979-ba5a-0a0b1280c5c7 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/create-a-rule-that-uses-a-path-condition.md b/windows/keep-secure/create-a-rule-that-uses-a-path-condition.md index 8553577fac..89a34500cd 100644 --- a/windows/keep-secure/create-a-rule-that-uses-a-path-condition.md +++ b/windows/keep-secure/create-a-rule-that-uses-a-path-condition.md @@ -2,7 +2,7 @@ title: Create a rule that uses a path condition (Windows 10) description: This topic for IT professionals shows how to create an AppLocker rule with a path condition. ms.assetid: 9b2093f5-5976-45fa-90c3-da1e0e845d95 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/create-a-rule-that-uses-a-publisher-condition.md b/windows/keep-secure/create-a-rule-that-uses-a-publisher-condition.md index 11ceca1e52..214dca0f70 100644 --- a/windows/keep-secure/create-a-rule-that-uses-a-publisher-condition.md +++ b/windows/keep-secure/create-a-rule-that-uses-a-publisher-condition.md @@ -2,7 +2,7 @@ title: Create a rule that uses a publisher condition (Windows 10) description: This topic for IT professionals shows how to create an AppLocker rule with a publisher condition. ms.assetid: 345ad45f-2bc1-4c4c-946f-17804e29f55b -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/create-a-token-object.md b/windows/keep-secure/create-a-token-object.md index 99055b694f..8decf358bf 100644 --- a/windows/keep-secure/create-a-token-object.md +++ b/windows/keep-secure/create-a-token-object.md @@ -2,7 +2,7 @@ title: Create a token object (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Create a token object security policy setting. ms.assetid: bfbf52fc-6ba4-442a-9df7-bd277e55729c -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/create-applocker-default-rules.md b/windows/keep-secure/create-applocker-default-rules.md index eb37fb2112..930d2bc4d7 100644 --- a/windows/keep-secure/create-applocker-default-rules.md +++ b/windows/keep-secure/create-applocker-default-rules.md @@ -2,7 +2,7 @@ title: Create AppLocker default rules (Windows 10) description: This topic for IT professionals describes the steps to create a standard set of AppLocker rules that will allow Windows system files to run. ms.assetid: 21e9dc68-a6f4-4ebe-ac28-4c66a7ab6e18 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/create-edp-policy-using-intune.md b/windows/keep-secure/create-edp-policy-using-intune.md index e2dab16028..c5d390ea1c 100644 --- a/windows/keep-secure/create-edp-policy-using-intune.md +++ b/windows/keep-secure/create-edp-policy-using-intune.md @@ -2,9 +2,10 @@ title: Create an enterprise data protection (EDP) policy using Microsoft Intune (Windows 10) description: Microsoft Intune helps you create and deploy your enterprise data protection (EDP) policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network. ms.assetid: 4b307c99-3016-4d6a-9ae7-3bbebd26e721 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library +ms.pagetype: security author: eross-msft --- diff --git a/windows/keep-secure/create-edp-policy-using-sccm.md b/windows/keep-secure/create-edp-policy-using-sccm.md index 9e4288873e..fa412028a7 100644 --- a/windows/keep-secure/create-edp-policy-using-sccm.md +++ b/windows/keep-secure/create-edp-policy-using-sccm.md @@ -2,10 +2,11 @@ title: Create and deploy an enterprise data protection (EDP) policy using System Center Configuration Manager (Windows 10) description: Configuration Manager (version 1511 or later) helps you create and deploy your enterprise data protection (EDP) policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network. ms.assetid: 85b99c20-1319-4aa3-8635-c1a87b244529 -keywords: ["EDP", "Enterprise Data Protection", "SCCM", "System Center Configuration Manager", Configuration Manager"] -ms.prod: W10 +keywords: EDP, Enterprise Data Protection, SCCM, System Center Configuration Manager, Configuration Manager +ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library +ms.pagetype: security author: eross-msft --- diff --git a/windows/keep-secure/create-global-objects.md b/windows/keep-secure/create-global-objects.md index 1f047ee451..c131685bec 100644 --- a/windows/keep-secure/create-global-objects.md +++ b/windows/keep-secure/create-global-objects.md @@ -2,7 +2,7 @@ title: Create global objects (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Create global objects security policy setting. ms.assetid: 9cb6247b-44fc-4815-86f2-cb59b6f0221e -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/create-list-of-applications-deployed-to-each-business-group.md b/windows/keep-secure/create-list-of-applications-deployed-to-each-business-group.md index 074fababfc..c623dd725f 100644 --- a/windows/keep-secure/create-list-of-applications-deployed-to-each-business-group.md +++ b/windows/keep-secure/create-list-of-applications-deployed-to-each-business-group.md @@ -2,7 +2,7 @@ title: Create a list of apps deployed to each business group (Windows 10) description: This topic describes the process of gathering app usage requirements from each business group in order to implement application control policies by using AppLocker. ms.assetid: d713aa07-d732-4bdc-8656-ba616d779321 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/create-permanent-shared-objects.md b/windows/keep-secure/create-permanent-shared-objects.md index 33ab226516..bcc0896951 100644 --- a/windows/keep-secure/create-permanent-shared-objects.md +++ b/windows/keep-secure/create-permanent-shared-objects.md @@ -2,7 +2,7 @@ title: Create permanent shared objects (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Create permanent shared objects security policy setting. ms.assetid: 6a58438d-65ca-4c4a-a584-450eed976649 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/create-symbolic-links.md b/windows/keep-secure/create-symbolic-links.md index 857a5a7ca9..994d8de789 100644 --- a/windows/keep-secure/create-symbolic-links.md +++ b/windows/keep-secure/create-symbolic-links.md @@ -2,7 +2,7 @@ title: Create symbolic links (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Create symbolic links security policy setting. ms.assetid: 882922b9-0ff8-4ee9-8afc-4475515ee3fd -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/create-vpn-and-edp-policy-using-intune.md b/windows/keep-secure/create-vpn-and-edp-policy-using-intune.md index 16034ac23d..760968b092 100644 --- a/windows/keep-secure/create-vpn-and-edp-policy-using-intune.md +++ b/windows/keep-secure/create-vpn-and-edp-policy-using-intune.md @@ -2,10 +2,11 @@ title: Create and deploy a VPN policy for enterprise data protection (EDP) using Microsoft Intune (Windows 10) description: After you've created and deployed your enterprise data protection (EDP) policy, you can use Microsoft Intune to create and deploy your Virtual Private Network (VPN) policy, linking it to your EDP policy. ms.assetid: d0eaba4f-6d7d-4ae4-8044-64680a40cf6b -keywords: ["EDP", "Enterprise Data Protection"] -ms.prod: W10 +keywords: EDP, Enterprise Data Protection +ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library +ms.pagetype: security author: eross-msft --- diff --git a/windows/keep-secure/create-your-applocker-planning-document.md b/windows/keep-secure/create-your-applocker-planning-document.md index 263be36d5e..f2b23f5937 100644 --- a/windows/keep-secure/create-your-applocker-planning-document.md +++ b/windows/keep-secure/create-your-applocker-planning-document.md @@ -2,7 +2,7 @@ title: Create your AppLocker planning document (Windows 10) description: This planning topic for the IT professional summarizes the information you need to research and include in your AppLocker planning document. ms.assetid: 41e49644-baf4-4514-b089-88adae2d624e -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/create-your-applocker-policies.md b/windows/keep-secure/create-your-applocker-policies.md index b7a23cc02d..e4ecc44cee 100644 --- a/windows/keep-secure/create-your-applocker-policies.md +++ b/windows/keep-secure/create-your-applocker-policies.md @@ -2,7 +2,7 @@ title: Create Your AppLocker policies (Windows 10) description: This overview topic for the IT professional describes the steps to create an AppLocker policy and prepare it for deployment. ms.assetid: d339dee2-4da2-4d4a-b46e-f1dfb7cb4bf0 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/create-your-applocker-rules.md b/windows/keep-secure/create-your-applocker-rules.md index ee0590e89b..8bcb7daf24 100644 --- a/windows/keep-secure/create-your-applocker-rules.md +++ b/windows/keep-secure/create-your-applocker-rules.md @@ -2,7 +2,7 @@ title: Create Your AppLocker rules (Windows 10) description: This topic for the IT professional describes what you need to know about AppLocker rules and the methods that you can to create rules. ms.assetid: b684a3a5-929c-4f70-8742-04088022f232 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/creating-a-device-guard-policy-for-signed-apps.md b/windows/keep-secure/creating-a-device-guard-policy-for-signed-apps.md index ee2f72275b..a1b2db57b3 100644 --- a/windows/keep-secure/creating-a-device-guard-policy-for-signed-apps.md +++ b/windows/keep-secure/creating-a-device-guard-policy-for-signed-apps.md @@ -2,7 +2,7 @@ title: Create a Device Guard code integrity policy based on a reference device (Windows 10) description: To implement Device Guard app protection, you will need to create a code integrity policy. Code integrity policies determine what apps are considered trustworthy and are allowed to run on a protected device. ms.assetid: 6C94B14E-E2CE-4F6C-8939-4B375406E825 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index 870a49c024..1202cb6ae3 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -2,7 +2,7 @@ title: Protect derived domain credentials with Credential Guard (Windows 10) description: Introduced in Windows 10 Enterprise, Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. ms.assetid: 4F1FE390-A166-4A24-8530-EA3369FEB4B1 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md b/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md index aa142cc631..07afd4227c 100644 --- a/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md @@ -3,9 +3,11 @@ title: View the Windows Defender Advanced Threat Protection Dashboard description: Use the Dashboard to identify machines at risk, keep track of the status of the service, and see statistics and information about machines and alerts. keywords: dashboard, alerts, new, in progress, resolved, risk, machines at risk, infections, reporting, statistics, charts, graphs, health, active malware detections, threat category, categories, password stealer, ransomware, exploit, threat, low severity, active malware search.product: eADQiWindows 10XVcnh -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security +author: mjcaparas --- # View the Windows Defender Advanced Threat Protection Dashboard diff --git a/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md index 1286313495..6db6f55321 100644 --- a/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md @@ -3,9 +3,10 @@ title: Windows Defender ATP data storage and privacy description: Learn about how Windows Defender ATP handles privacy and data that it collects. keywords: Windows Defender ATP data storage and privacy, storage, privacy search.product: eADQiWindows 10XVcnh -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security --- # Windows Defender ATP data storage and privacy diff --git a/windows/keep-secure/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md b/windows/keep-secure/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md index 6fe17f05af..99fd9c7f66 100644 --- a/windows/keep-secure/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md +++ b/windows/keep-secure/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md @@ -2,7 +2,7 @@ title: DCOM Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax (Windows 10) description: Describes the best practices, location, values, and security considerations for the DCOM Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax policy setting. ms.assetid: 0fe3521a-5252-44df-8a47-8d92cf936e7c -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md b/windows/keep-secure/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md index d4c42764a5..6b5d3ee2c2 100644 --- a/windows/keep-secure/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md +++ b/windows/keep-secure/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md @@ -2,7 +2,7 @@ title: DCOM Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax (Windows 10) description: Describes the best practices, location, values, and security considerations for the DCOM Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax security policy setting. ms.assetid: 4b95d45f-dd62-4c34-ba32-43954528dabe -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/debug-programs.md b/windows/keep-secure/debug-programs.md index 4b133fd251..810c6a21b5 100644 --- a/windows/keep-secure/debug-programs.md +++ b/windows/keep-secure/debug-programs.md @@ -2,7 +2,7 @@ title: Debug programs (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Debug programs security policy setting. ms.assetid: 594d9f2c-8ffc-444b-9522-75615ec87786 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/delete-an-applocker-rule.md b/windows/keep-secure/delete-an-applocker-rule.md index ad342ee6cf..3d4888fb73 100644 --- a/windows/keep-secure/delete-an-applocker-rule.md +++ b/windows/keep-secure/delete-an-applocker-rule.md @@ -2,7 +2,7 @@ title: Delete an AppLocker rule (Windows 10) description: This topic for IT professionals describes the steps to delete an AppLocker rule. ms.assetid: 382b4be3-0df9-4308-89b2-dcf9df351eb5 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/deny-access-to-this-computer-from-the-network.md b/windows/keep-secure/deny-access-to-this-computer-from-the-network.md index df4e48dc46..fbad5a0ca8 100644 --- a/windows/keep-secure/deny-access-to-this-computer-from-the-network.md +++ b/windows/keep-secure/deny-access-to-this-computer-from-the-network.md @@ -2,7 +2,7 @@ title: Deny access to this computer from the network (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Deny access to this computer from the network security policy setting. ms.assetid: 935e9f89-951b-4163-b186-fc325682bb0b -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/deny-log-on-as-a-batch-job.md b/windows/keep-secure/deny-log-on-as-a-batch-job.md index d3abeeb6d5..5edb8ca898 100644 --- a/windows/keep-secure/deny-log-on-as-a-batch-job.md +++ b/windows/keep-secure/deny-log-on-as-a-batch-job.md @@ -2,7 +2,7 @@ title: Deny log on as a batch job (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Deny log on as a batch job security policy setting. ms.assetid: 0ac36ebd-5e28-4b6a-9b4e-8924c6ecf44b -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/deny-log-on-as-a-service.md b/windows/keep-secure/deny-log-on-as-a-service.md index 8fa66ee734..7acdea2a4c 100644 --- a/windows/keep-secure/deny-log-on-as-a-service.md +++ b/windows/keep-secure/deny-log-on-as-a-service.md @@ -2,7 +2,7 @@ title: Deny log on as a service (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Deny log on as a service security policy setting. ms.assetid: f1114964-df86-4278-9b11-e35c66949794 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/deny-log-on-locally.md b/windows/keep-secure/deny-log-on-locally.md index 916d358f89..cd84f05560 100644 --- a/windows/keep-secure/deny-log-on-locally.md +++ b/windows/keep-secure/deny-log-on-locally.md @@ -2,7 +2,7 @@ title: Deny log on locally (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Deny log on locally security policy setting. ms.assetid: 00150e88-ec9c-43e1-a70d-33bfe10434db -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/deny-log-on-through-remote-desktop-services.md b/windows/keep-secure/deny-log-on-through-remote-desktop-services.md index 6877912bae..8e5065b443 100644 --- a/windows/keep-secure/deny-log-on-through-remote-desktop-services.md +++ b/windows/keep-secure/deny-log-on-through-remote-desktop-services.md @@ -2,7 +2,7 @@ title: Deny log on through Remote Desktop Services (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Deny log on through Remote Desktop Services security policy setting. ms.assetid: 84bbb807-287c-4acc-a094-cf0ffdcbca67 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/deploy-applocker-policies-by-using-the-enforce-rules-setting.md b/windows/keep-secure/deploy-applocker-policies-by-using-the-enforce-rules-setting.md index b7056845e4..b5ecdf6702 100644 --- a/windows/keep-secure/deploy-applocker-policies-by-using-the-enforce-rules-setting.md +++ b/windows/keep-secure/deploy-applocker-policies-by-using-the-enforce-rules-setting.md @@ -2,7 +2,7 @@ title: Deploy AppLocker policies by using the enforce rules setting (Windows 10) description: This topic for IT professionals describes the steps to deploy AppLocker policies by using the enforcement setting method. ms.assetid: fd3a3d25-ff3b-4060-8390-6262a90749ba -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/deploy-edp-policy-using-intune.md b/windows/keep-secure/deploy-edp-policy-using-intune.md index 6893478523..7b23a44cf2 100644 --- a/windows/keep-secure/deploy-edp-policy-using-intune.md +++ b/windows/keep-secure/deploy-edp-policy-using-intune.md @@ -2,10 +2,11 @@ title: Deploy your enterprise data protection (EDP) policy using Microsoft Intune (Windows 10) description: After you’ve created your enterprise data protection (EDP) policy, you'll need to deploy it to your organization's enrolled devices. ms.assetid: 9c4a01e7-0b1c-4f15-95d0-0389f0686211 -keywords: ["EDP", "Enterprise Data Protection", "Intune"] -ms.prod: W10 +keywords: EDP, Enterprise Data Protection, Intune +ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library +ms.pagetype: security author: eross-msft --- diff --git a/windows/keep-secure/deploy-the-applocker-policy-into-production.md b/windows/keep-secure/deploy-the-applocker-policy-into-production.md index 32e3cd0d65..e56061213f 100644 --- a/windows/keep-secure/deploy-the-applocker-policy-into-production.md +++ b/windows/keep-secure/deploy-the-applocker-policy-into-production.md @@ -2,7 +2,7 @@ title: Deploy the AppLocker policy into production (Windows 10) description: This topic for the IT professional describes the tasks that should be completed before you deploy AppLocker application control settings. ms.assetid: ebbb1907-92dc-499e-8cee-8e637483c9ae -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/determine-group-policy-structure-and-rule-enforcement.md b/windows/keep-secure/determine-group-policy-structure-and-rule-enforcement.md index 5733fd532e..1544475c03 100644 --- a/windows/keep-secure/determine-group-policy-structure-and-rule-enforcement.md +++ b/windows/keep-secure/determine-group-policy-structure-and-rule-enforcement.md @@ -2,7 +2,7 @@ title: Determine the Group Policy structure and rule enforcement (Windows 10) description: This overview topic describes the process to follow when you are planning to deploy AppLocker rules. ms.assetid: f435fcbe-c7ac-4ef0-9702-729aab64163f -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/determine-which-applications-are-digitally-signed-on-a-reference-computer.md b/windows/keep-secure/determine-which-applications-are-digitally-signed-on-a-reference-computer.md index a02d55ecc7..ccf2483c4d 100644 --- a/windows/keep-secure/determine-which-applications-are-digitally-signed-on-a-reference-computer.md +++ b/windows/keep-secure/determine-which-applications-are-digitally-signed-on-a-reference-computer.md @@ -2,7 +2,7 @@ title: Determine which apps are digitally signed on a reference device (Windows 10) description: This topic for the IT professional describes how to use AppLocker logs and tools to determine which applications are digitally signed. ms.assetid: 24609a6b-fdcb-4083-b234-73e23ff8bcb8 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/determine-your-application-control-objectives.md b/windows/keep-secure/determine-your-application-control-objectives.md index 65098f5d72..a74a000710 100644 --- a/windows/keep-secure/determine-your-application-control-objectives.md +++ b/windows/keep-secure/determine-your-application-control-objectives.md @@ -2,7 +2,7 @@ title: Determine your application control objectives (Windows 10) description: This topic helps you with the decisions you need to make to determine what applications to control and how to control them by comparing Software Restriction Policies (SRP) and AppLocker. ms.assetid: 0e84003e-6095-46fb-8c4e-2065869bb53b -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/device-guard-certification-and-compliance.md b/windows/keep-secure/device-guard-certification-and-compliance.md index 9edecd273d..6ac463047e 100644 --- a/windows/keep-secure/device-guard-certification-and-compliance.md +++ b/windows/keep-secure/device-guard-certification-and-compliance.md @@ -3,7 +3,7 @@ title: Device Guard certification and compliance (Windows 10) description: Device Guard is a combination of hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications. ms.assetid: 94167ECA-AB08-431D-95E5-7A363F42C7E3 ms.pagetype: security -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft diff --git a/windows/keep-secure/device-guard-deployment-guide.md b/windows/keep-secure/device-guard-deployment-guide.md index 3d9a53be0e..f98d7216ea 100644 --- a/windows/keep-secure/device-guard-deployment-guide.md +++ b/windows/keep-secure/device-guard-deployment-guide.md @@ -3,9 +3,9 @@ title: Device Guard deployment guide (Windows 10) description: Microsoft Device Guard is a feature set that consists of both hardware and software system integrity hardening features that revolutionize the Windows operating system’s security. ms.assetid: 4BA52AA9-64D3-41F3-94B2-B87EC2717486 keywords: virtualization, security, malware -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy -ms.pagetype: devices +ms.pagetype: security, devices author: challum --- diff --git a/windows/keep-secure/devices-allow-undock-without-having-to-log-on.md b/windows/keep-secure/devices-allow-undock-without-having-to-log-on.md index 0d237c5cd4..d8f1d31192 100644 --- a/windows/keep-secure/devices-allow-undock-without-having-to-log-on.md +++ b/windows/keep-secure/devices-allow-undock-without-having-to-log-on.md @@ -2,7 +2,7 @@ title: Devices Allow undock without having to log on (Windows 10) description: Describes the best practices, location, values, and security considerations for the Devices Allow undock without having to log on security policy setting. ms.assetid: 1d403f5d-ad41-4bb4-9f4a-0779c1c14b8c -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/devices-allowed-to-format-and-eject-removable-media.md b/windows/keep-secure/devices-allowed-to-format-and-eject-removable-media.md index 9c9a232738..bffc76a5e9 100644 --- a/windows/keep-secure/devices-allowed-to-format-and-eject-removable-media.md +++ b/windows/keep-secure/devices-allowed-to-format-and-eject-removable-media.md @@ -2,7 +2,7 @@ title: Devices Allowed to format and eject removable media (Windows 10) description: Describes the best practices, location, values, and security considerations for the Devices Allowed to format and eject removable media security policy setting. ms.assetid: d1b42425-7244-4ab1-9d46-d68de823459c -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/devices-prevent-users-from-installing-printer-drivers.md b/windows/keep-secure/devices-prevent-users-from-installing-printer-drivers.md index c71b4b04d5..0bf0ba89a9 100644 --- a/windows/keep-secure/devices-prevent-users-from-installing-printer-drivers.md +++ b/windows/keep-secure/devices-prevent-users-from-installing-printer-drivers.md @@ -2,7 +2,7 @@ title: Devices Prevent users from installing printer drivers (Windows 10) description: Describes the best practices, location, values, and security considerations for the Devices Prevent users from installing printer drivers security policy setting. ms.assetid: ab70a122-f7f9-47e0-ad8c-541f30a27ec3 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md b/windows/keep-secure/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md index e42ea9042c..5e399e075e 100644 --- a/windows/keep-secure/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md +++ b/windows/keep-secure/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md @@ -2,7 +2,7 @@ title: Devices Restrict CD-ROM access to locally logged-on user only (Windows 10) description: Describes the best practices, location, values, and security considerations for the Devices Restrict CD-ROM access to locally logged-on user only security policy setting. ms.assetid: 8b8f44bb-84ce-4f18-af30-ab89910e234d -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/devices-restrict-floppy-access-to-locally-logged-on-user-only.md b/windows/keep-secure/devices-restrict-floppy-access-to-locally-logged-on-user-only.md index 3246e36da5..1716725907 100644 --- a/windows/keep-secure/devices-restrict-floppy-access-to-locally-logged-on-user-only.md +++ b/windows/keep-secure/devices-restrict-floppy-access-to-locally-logged-on-user-only.md @@ -2,7 +2,7 @@ title: Devices Restrict floppy access to locally logged-on user only (Windows 10) description: Describes the best practices, location, values, and security considerations for the Devices Restrict floppy access to locally logged-on user only security policy setting. ms.assetid: 92997910-da95-4c03-ae6f-832915423898 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md b/windows/keep-secure/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md index 267ba483ac..85c56528b1 100644 --- a/windows/keep-secure/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md +++ b/windows/keep-secure/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md @@ -3,7 +3,7 @@ title: Display a custom URL message when users try to run a blocked app (Windows description: This topic for IT professionals describes the steps for displaying a customized message to users when an AppLocker policy denies access to an app. ms.assetid: 9a2534a5-d1fa-48a9-93c6-989d4857cf85 ms.pagetype: security -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft diff --git a/windows/keep-secure/dll-rules-in-applocker.md b/windows/keep-secure/dll-rules-in-applocker.md index 4f99109b04..b6e4cd9e93 100644 --- a/windows/keep-secure/dll-rules-in-applocker.md +++ b/windows/keep-secure/dll-rules-in-applocker.md @@ -2,7 +2,7 @@ title: DLL rules in AppLocker (Windows 10) description: This topic describes the file formats and available default rules for the DLL rule collection. ms.assetid: a083fd08-c07e-4534-b0e7-1e15d932ce8f -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/document-group-policy-structure-and-applocker-rule-enforcement.md b/windows/keep-secure/document-group-policy-structure-and-applocker-rule-enforcement.md index f583b63513..72c1c10193 100644 --- a/windows/keep-secure/document-group-policy-structure-and-applocker-rule-enforcement.md +++ b/windows/keep-secure/document-group-policy-structure-and-applocker-rule-enforcement.md @@ -2,7 +2,7 @@ title: Document the Group Policy structure and AppLocker rule enforcement (Windows 10) description: This planning topic describes what you need to investigate, determine, and record in your application control policies plan when you use AppLocker. ms.assetid: 389ffa8e-11fc-49ff-b0b1-89553e6fb6e5 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: brianlic-msft diff --git a/windows/keep-secure/document-your-application-control-management-processes.md b/windows/keep-secure/document-your-application-control-management-processes.md index e0ef522601..6e2a75390d 100644 --- a/windows/keep-secure/document-your-application-control-management-processes.md +++ b/windows/keep-secure/document-your-application-control-management-processes.md @@ -2,7 +2,7 @@ title: Document your application control management processes (Windows 10) description: This planning topic describes the AppLocker policy maintenance information to record for your design document. ms.assetid: 6397f789-0e36-4933-9f86-f3f6489cf1fb -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/document-your-application-list.md b/windows/keep-secure/document-your-application-list.md index c20e6831ad..735dc55515 100644 --- a/windows/keep-secure/document-your-application-list.md +++ b/windows/keep-secure/document-your-application-list.md @@ -2,7 +2,7 @@ title: Document your app list (Windows 10) description: This planning topic describes the app information that you should document when you create a list of apps for AppLocker policies. ms.assetid: b155284b-f75d-4405-aecf-b74221622dc0 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/document-your-applocker-rules.md b/windows/keep-secure/document-your-applocker-rules.md index 5603fcefdc..68d32d07d7 100644 --- a/windows/keep-secure/document-your-applocker-rules.md +++ b/windows/keep-secure/document-your-applocker-rules.md @@ -2,7 +2,7 @@ title: Document your AppLocker rules (Windows 10) description: This topic describes what rule conditions to associate with each file, how to associate the rule conditions with each file, the source of the rule, and whether the file should be included or excluded. ms.assetid: 91a198ce-104a-45ff-b49b-487fb40cd2dd -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/domain-controller-allow-server-operators-to-schedule-tasks.md b/windows/keep-secure/domain-controller-allow-server-operators-to-schedule-tasks.md index 73dd753654..feafcec116 100644 --- a/windows/keep-secure/domain-controller-allow-server-operators-to-schedule-tasks.md +++ b/windows/keep-secure/domain-controller-allow-server-operators-to-schedule-tasks.md @@ -2,7 +2,7 @@ title: Domain controller Allow server operators to schedule tasks (Windows 10) description: Describes the best practices, location, values, and security considerations for the Domain controller Allow server operators to schedule tasks security policy setting. ms.assetid: 198b12a4-8a5d-48e8-a752-2073b8a2cb0d -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/domain-controller-ldap-server-signing-requirements.md b/windows/keep-secure/domain-controller-ldap-server-signing-requirements.md index 8f75f7faa7..10001b50e6 100644 --- a/windows/keep-secure/domain-controller-ldap-server-signing-requirements.md +++ b/windows/keep-secure/domain-controller-ldap-server-signing-requirements.md @@ -2,7 +2,7 @@ title: Domain controller LDAP server signing requirements (Windows 10) description: Describes the best practices, location, values, and security considerations for the Domain controller LDAP server signing requirements security policy setting. ms.assetid: fe122179-7571-465b-98d0-b8ce0f224390 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/domain-controller-refuse-machine-account-password-changes.md b/windows/keep-secure/domain-controller-refuse-machine-account-password-changes.md index 3d0dc98ace..563e0956a9 100644 --- a/windows/keep-secure/domain-controller-refuse-machine-account-password-changes.md +++ b/windows/keep-secure/domain-controller-refuse-machine-account-password-changes.md @@ -2,7 +2,7 @@ title: Domain controller Refuse machine account password changes (Windows 10) description: Describes the best practices, location, values, and security considerations for the Domain controller Refuse machine account password changes security policy setting. ms.assetid: 5a7fa2e2-e1a8-4833-90f7-aa83e3b456a9 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md b/windows/keep-secure/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md index dde52ba0d7..b748e75485 100644 --- a/windows/keep-secure/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md +++ b/windows/keep-secure/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md @@ -2,7 +2,7 @@ title: Domain member Digitally encrypt or sign secure channel data (always) (Windows 10) description: Describes the best practices, location, values, and security considerations for the Domain member Digitally encrypt or sign secure channel data (always) security policy setting. ms.assetid: 4480c7cb-adca-4f29-b4b8-06eb68d272bf -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/domain-member-digitally-encrypt-secure-channel-data-when-possible.md b/windows/keep-secure/domain-member-digitally-encrypt-secure-channel-data-when-possible.md index 9412bf6ae7..241c83b30b 100644 --- a/windows/keep-secure/domain-member-digitally-encrypt-secure-channel-data-when-possible.md +++ b/windows/keep-secure/domain-member-digitally-encrypt-secure-channel-data-when-possible.md @@ -2,7 +2,7 @@ title: Domain member Digitally encrypt secure channel data (when possible) (Windows 10) description: Describes the best practices, location, values, and security considerations for the Domain member Digitally encrypt secure channel data (when possible) security policy setting. ms.assetid: 73e6023e-0af3-4531-8238-82f0f0e4965b -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/domain-member-digitally-sign-secure-channel-data-when-possible.md b/windows/keep-secure/domain-member-digitally-sign-secure-channel-data-when-possible.md index 6f0cdd5ea0..dfa36d1360 100644 --- a/windows/keep-secure/domain-member-digitally-sign-secure-channel-data-when-possible.md +++ b/windows/keep-secure/domain-member-digitally-sign-secure-channel-data-when-possible.md @@ -2,7 +2,7 @@ title: Domain member Digitally sign secure channel data (when possible) (Windows 10) description: Describes the best practices, location, values, and security considerations for the Domain member Digitally sign secure channel data (when possible) security policy setting. ms.assetid: a643e491-4f45-40ea-b12c-4dbe47e54f34 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/domain-member-disable-machine-account-password-changes.md b/windows/keep-secure/domain-member-disable-machine-account-password-changes.md index a7e862cea4..e933a14786 100644 --- a/windows/keep-secure/domain-member-disable-machine-account-password-changes.md +++ b/windows/keep-secure/domain-member-disable-machine-account-password-changes.md @@ -2,7 +2,7 @@ title: Domain member Disable machine account password changes (Windows 10) description: Describes the best practices, location, values, and security considerations for the Domain member Disable machine account password changes security policy setting. ms.assetid: 1f660300-a07a-4243-a09f-140aa1ab8867 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/domain-member-maximum-machine-account-password-age.md b/windows/keep-secure/domain-member-maximum-machine-account-password-age.md index b97cf3f485..841729d203 100644 --- a/windows/keep-secure/domain-member-maximum-machine-account-password-age.md +++ b/windows/keep-secure/domain-member-maximum-machine-account-password-age.md @@ -2,7 +2,7 @@ title: Domain member Maximum machine account password age (Windows 10) description: Describes the best practices, location, values, and security considerations for the Domain member Maximum machine account password age security policy setting. ms.assetid: 0ec6f7c1-4d82-4339-94c0-debb2d1ac109 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/domain-member-require-strong-windows-2000-or-later-session-key.md b/windows/keep-secure/domain-member-require-strong-windows-2000-or-later-session-key.md index 320d44e467..2d179f76d3 100644 --- a/windows/keep-secure/domain-member-require-strong-windows-2000-or-later-session-key.md +++ b/windows/keep-secure/domain-member-require-strong-windows-2000-or-later-session-key.md @@ -2,7 +2,7 @@ title: Domain member Require strong (Windows 2000 or later) session key (Windows 10) description: Describes the best practices, location, values, and security considerations for the Domain member Require strong (Windows 2000 or later) session key security policy setting. ms.assetid: 5ab8993c-5086-4f09-bc88-1b27454526bd -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/edit-an-applocker-policy.md b/windows/keep-secure/edit-an-applocker-policy.md index 2faffd200f..8bd9ebfcea 100644 --- a/windows/keep-secure/edit-an-applocker-policy.md +++ b/windows/keep-secure/edit-an-applocker-policy.md @@ -2,7 +2,7 @@ title: Edit an AppLocker policy (Windows 10) description: This topic for IT professionals describes the steps required to modify an AppLocker policy. ms.assetid: dbc72d1f-3fe0-46c2-aeeb-96621fce7637 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/edit-applocker-rules.md b/windows/keep-secure/edit-applocker-rules.md index 2f47922cd0..3fcada9c5e 100644 --- a/windows/keep-secure/edit-applocker-rules.md +++ b/windows/keep-secure/edit-applocker-rules.md @@ -2,7 +2,7 @@ title: Edit AppLocker rules (Windows 10) description: This topic for IT professionals describes the steps to edit a publisher rule, path rule, and file hash rule in AppLocker. ms.assetid: 80016cda-b915-46a0-83c6-5e6b0b958e32 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md b/windows/keep-secure/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md index b3dcd0cd1a..6e5addb821 100644 --- a/windows/keep-secure/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md +++ b/windows/keep-secure/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md @@ -2,7 +2,7 @@ title: Enable computer and user accounts to be trusted for delegation (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Enable computer and user accounts to be trusted for delegation security policy setting. ms.assetid: 524062d4-1595-41f3-8ce1-9c85fd21497b -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/enable-the-dll-rule-collection.md b/windows/keep-secure/enable-the-dll-rule-collection.md index 1dd233aee5..3a23c140a8 100644 --- a/windows/keep-secure/enable-the-dll-rule-collection.md +++ b/windows/keep-secure/enable-the-dll-rule-collection.md @@ -2,7 +2,7 @@ title: Enable the DLL rule collection (Windows 10) description: This topic for IT professionals describes the steps to enable the DLL rule collection feature for AppLocker. ms.assetid: 88ef9561-6eb2-491a-803a-b8cdbfebae27 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/encrypted-hard-drive.md b/windows/keep-secure/encrypted-hard-drive.md index 884275ee7e..7de2f367e0 100644 --- a/windows/keep-secure/encrypted-hard-drive.md +++ b/windows/keep-secure/encrypted-hard-drive.md @@ -2,7 +2,7 @@ title: Encrypted Hard Drive (Windows 10) description: Encrypted Hard Drive uses the rapid encryption that is provided by BitLocker Drive Encryption to enhance data security and management. ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/enforce-applocker-rules.md b/windows/keep-secure/enforce-applocker-rules.md index 0f83a7ff57..31ab2aa2b8 100644 --- a/windows/keep-secure/enforce-applocker-rules.md +++ b/windows/keep-secure/enforce-applocker-rules.md @@ -2,7 +2,7 @@ title: Enforce AppLocker rules (Windows 10) description: This topic for IT professionals describes how to enforce application control rules by using AppLocker. ms.assetid: e1528b7b-77f2-4419-8e27-c9cc3721d96d -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/enforce-password-history.md b/windows/keep-secure/enforce-password-history.md index b78ac67236..a52801d820 100644 --- a/windows/keep-secure/enforce-password-history.md +++ b/windows/keep-secure/enforce-password-history.md @@ -2,7 +2,7 @@ title: Enforce password history (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Enforce password history security policy setting. ms.assetid: 8b2ab871-3e52-4dd1-9776-68bb1e935442 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/enforce-user-logon-restrictions.md b/windows/keep-secure/enforce-user-logon-restrictions.md index 40eef86d2b..39f83bb850 100644 --- a/windows/keep-secure/enforce-user-logon-restrictions.md +++ b/windows/keep-secure/enforce-user-logon-restrictions.md @@ -2,7 +2,7 @@ title: Enforce user logon restrictions (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Enforce user logon restrictions security policy setting. ms.assetid: 5891cb73-f1ec-48b9-b703-39249e48a29f -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/enlightened-microsoft-apps-and-edp.md b/windows/keep-secure/enlightened-microsoft-apps-and-edp.md index c0cd2aac59..bf8d546f56 100644 --- a/windows/keep-secure/enlightened-microsoft-apps-and-edp.md +++ b/windows/keep-secure/enlightened-microsoft-apps-and-edp.md @@ -2,10 +2,11 @@ title: List of enlightened Microsoft apps for use with enterprise data protection (EDP) (Windows 10) description: Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your Protected Apps list. ms.assetid: 17c85ea3-9b66-4b80-b511-8f277cb4345f -keywords: ["EDP", "Enterprise Data Protection"] -ms.prod: W10 +keywords: EDP, Enterprise Data Protection +ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library +ms.pagetype: security author: eross-msft --- diff --git a/windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md b/windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md index f6244f66e0..6e239a2aea 100644 --- a/windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md @@ -3,9 +3,10 @@ title: Review events and errors on endpoints with Event Viewer description: Get descriptions and further troubleshooting steps (if required) for all events reported by the Windows Defender ATP service. keywords: troubleshoot, event viewer, log summary, failure code, failed, Windows Advanced Threat Protection service, cannot start, broken, can't start search.product: eADQiWindows 10XVcnh -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: iaanw --- diff --git a/windows/keep-secure/executable-rules-in-applocker.md b/windows/keep-secure/executable-rules-in-applocker.md index b74b7fe29a..ebad0e1645 100644 --- a/windows/keep-secure/executable-rules-in-applocker.md +++ b/windows/keep-secure/executable-rules-in-applocker.md @@ -2,7 +2,7 @@ title: Executable rules in AppLocker (Windows 10) description: This topic describes the file formats and available default rules for the executable rule collection. ms.assetid: 65e62f90-6caa-48f8-836a-91f8ac9018ee -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/export-an-applocker-policy-from-a-gpo.md b/windows/keep-secure/export-an-applocker-policy-from-a-gpo.md index 90c10baeee..6476c88d16 100644 --- a/windows/keep-secure/export-an-applocker-policy-from-a-gpo.md +++ b/windows/keep-secure/export-an-applocker-policy-from-a-gpo.md @@ -2,7 +2,7 @@ title: Export an AppLocker policy from a GPO (Windows 10) description: This topic for IT professionals describes the steps to export an AppLocker policy from a Group Policy Object (GPO) so that it can be modified. ms.assetid: 7db59719-a8be-418b-bbfd-22cf2176c9c0 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/export-an-applocker-policy-to-an-xml-file.md b/windows/keep-secure/export-an-applocker-policy-to-an-xml-file.md index a5ebd52102..f3f9d22190 100644 --- a/windows/keep-secure/export-an-applocker-policy-to-an-xml-file.md +++ b/windows/keep-secure/export-an-applocker-policy-to-an-xml-file.md @@ -2,7 +2,7 @@ title: Export an AppLocker policy to an XML file (Windows 10) description: This topic for IT professionals describes the steps to export an AppLocker policy to an XML file for review or testing. ms.assetid: 979bd23f-6815-478b-a6a4-a25239cb1080 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/file-system-global-object-access-auditing.md b/windows/keep-secure/file-system-global-object-access-auditing.md index 5853de4758..13e7b15ca7 100644 --- a/windows/keep-secure/file-system-global-object-access-auditing.md +++ b/windows/keep-secure/file-system-global-object-access-auditing.md @@ -2,7 +2,7 @@ title: File System (Global Object Access Auditing) (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, File System (Global Object Access Auditing), which enables you to configure a global system access control list (SACL) on the file system for an entire computer. ms.assetid: 4f215d61-0e23-46e4-9e58-08511105d25b -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/force-shutdown-from-a-remote-system.md b/windows/keep-secure/force-shutdown-from-a-remote-system.md index c9f51b7ed0..e635eb56d3 100644 --- a/windows/keep-secure/force-shutdown-from-a-remote-system.md +++ b/windows/keep-secure/force-shutdown-from-a-remote-system.md @@ -2,7 +2,7 @@ title: Force shutdown from a remote system (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Force shutdown from a remote system security policy setting. ms.assetid: 63129243-31ea-42a4-a598-c7064f48a3df -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/generate-security-audits.md b/windows/keep-secure/generate-security-audits.md index 78b578d1e3..437bdc47d0 100644 --- a/windows/keep-secure/generate-security-audits.md +++ b/windows/keep-secure/generate-security-audits.md @@ -2,7 +2,7 @@ title: Generate security audits (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Generate security audits security policy setting. ms.assetid: c0e1cd80-840e-4c74-917c-5c2349de885f -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/get-started-with-windows-defender-for-windows-10.md b/windows/keep-secure/get-started-with-windows-defender-for-windows-10.md index f7b4350a6f..9f8709dce5 100644 --- a/windows/keep-secure/get-started-with-windows-defender-for-windows-10.md +++ b/windows/keep-secure/get-started-with-windows-defender-for-windows-10.md @@ -2,7 +2,7 @@ title: Update and manage Windows Defender in Windows 10 (Windows 10) description: IT professionals can manage Windows Defender on Windows 10 endpoints in their organization using Microsoft Active Directory or Windows Server Update Services (WSUS), apply updates to endpoints, and manage scans using Group Policy SettingsWindows Management Instrumentation (WMI)PowerShell. ms.assetid: 045F5BF2-87D7-4522-97E1-C1D508E063A7 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/getting-apps-to-run-on-device-guard-protected-devices.md b/windows/keep-secure/getting-apps-to-run-on-device-guard-protected-devices.md index f9af00d1cd..42e7d1cff1 100644 --- a/windows/keep-secure/getting-apps-to-run-on-device-guard-protected-devices.md +++ b/windows/keep-secure/getting-apps-to-run-on-device-guard-protected-devices.md @@ -3,7 +3,7 @@ title: Get apps to run on Device Guard-protected devices (Windows 10) description: Windows 10 introduces several new features and settings that when combined all equal what we're calling, Device Guard. ms.assetid: E62B68C3-8B9F-4842-90FC-B4EE9FF8A67E keywords: Package Inspector, packageinspector.exe, sign catalog file -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/guidance-and-best-practices-edp.md b/windows/keep-secure/guidance-and-best-practices-edp.md index cf4d35de03..805ac84dfc 100644 --- a/windows/keep-secure/guidance-and-best-practices-edp.md +++ b/windows/keep-secure/guidance-and-best-practices-edp.md @@ -2,10 +2,11 @@ title: General guidance and best practices for enterprise data protection (EDP) (Windows 10) description: This section includes info about the enlightened Microsoft apps, including how to add them to your Protected Apps list in Microsoft Intune. It also includes some testing scenarios that we recommend running through with enterprise data protection (EDP). ms.assetid: aa94e733-53be-49a7-938d-1660deaf52b0 -keywords: ["EDP", "Enterprise Data Protection"] -ms.prod: W10 +keywords: EDP, Enterprise Data Protection +ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library +ms.pagetype: security author: eross-msft --- diff --git a/windows/keep-secure/how-applocker-works-techref.md b/windows/keep-secure/how-applocker-works-techref.md index ad2bc595e0..f9bf8450f5 100644 --- a/windows/keep-secure/how-applocker-works-techref.md +++ b/windows/keep-secure/how-applocker-works-techref.md @@ -2,7 +2,7 @@ title: How AppLocker works (Windows 10) description: This topic for the IT professional provides links to topics about AppLocker architecture and components, processes and interactions, rules and policies. ms.assetid: 24bb1d73-0ff5-4af7-8b8a-2fa44d4ddbcd -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/how-to-configure-security-policy-settings.md b/windows/keep-secure/how-to-configure-security-policy-settings.md index 275dfdaccb..6a307acac3 100644 --- a/windows/keep-secure/how-to-configure-security-policy-settings.md +++ b/windows/keep-secure/how-to-configure-security-policy-settings.md @@ -3,7 +3,7 @@ title: Configure security policy settings (Windows 10) description: Describes steps to configure a security policy setting on the local device, on a domain-joined device, and on a domain controller. ms.assetid: 63b0967b-a9fe-4d92-90af-67469ee20320 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/how-user-account-control-works.md b/windows/keep-secure/how-user-account-control-works.md index ca5e6eef25..90bba5477f 100644 --- a/windows/keep-secure/how-user-account-control-works.md +++ b/windows/keep-secure/how-user-account-control-works.md @@ -2,7 +2,7 @@ title: How User Account Control works (Windows 10) description: User Account Control (UAC) is a fundamental component of Microsoft's overall security vision. UAC helps mitigate the impact of malware. ms.assetid: 9f921779-0fd3-4206-b0e4-05a19883ee59 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: operate ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/impersonate-a-client-after-authentication.md b/windows/keep-secure/impersonate-a-client-after-authentication.md index 6735e29692..9dc1b4f485 100644 --- a/windows/keep-secure/impersonate-a-client-after-authentication.md +++ b/windows/keep-secure/impersonate-a-client-after-authentication.md @@ -2,7 +2,7 @@ title: Impersonate a client after authentication (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Impersonate a client after authentication security policy setting. ms.assetid: 4cd241e2-c680-4b43-8ed0-3b391925cec5 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/implement-microsoft-passport-in-your-organization.md b/windows/keep-secure/implement-microsoft-passport-in-your-organization.md index 95e304939b..1680e13ed9 100644 --- a/windows/keep-secure/implement-microsoft-passport-in-your-organization.md +++ b/windows/keep-secure/implement-microsoft-passport-in-your-organization.md @@ -3,7 +3,7 @@ title: Implement Microsoft Passport in your organization (Windows 10) description: You can create a Group Policy or mobile device management (MDM) policy that will implement Microsoft Passport on devices running Windows 10. ms.assetid: 47B55221-24BE-482D-BD31-C78B22AC06D8 keywords: identity, PIN, biometric, Hello -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/import-an-applocker-policy-from-another-computer.md b/windows/keep-secure/import-an-applocker-policy-from-another-computer.md index 199d82deae..0f0e11976b 100644 --- a/windows/keep-secure/import-an-applocker-policy-from-another-computer.md +++ b/windows/keep-secure/import-an-applocker-policy-from-another-computer.md @@ -2,7 +2,7 @@ title: Import an AppLocker policy from another computer (Windows 10) description: This topic for IT professionals describes how to import an AppLocker policy. ms.assetid: b48cb2b2-8ef8-4cc0-89bd-309d0b1832f6 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/import-an-applocker-policy-into-a-gpo.md b/windows/keep-secure/import-an-applocker-policy-into-a-gpo.md index a5dfd645ac..c03e2d5282 100644 --- a/windows/keep-secure/import-an-applocker-policy-into-a-gpo.md +++ b/windows/keep-secure/import-an-applocker-policy-into-a-gpo.md @@ -2,7 +2,7 @@ title: Import an AppLocker policy into a GPO (Windows 10) description: This topic for IT professionals describes the steps to import an AppLocker policy into a Group Policy Object (GPO). ms.assetid: 0629ce44-f5e2-48a8-ba47-06544c73261f -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/increase-a-process-working-set.md b/windows/keep-secure/increase-a-process-working-set.md index da0458fb81..237be32d51 100644 --- a/windows/keep-secure/increase-a-process-working-set.md +++ b/windows/keep-secure/increase-a-process-working-set.md @@ -2,7 +2,7 @@ title: Increase a process working set (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Increase a process working set security policy setting. ms.assetid: b742ad96-37f3-4686-b8f7-f2b48367105b -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/increase-scheduling-priority.md b/windows/keep-secure/increase-scheduling-priority.md index a7d5d1646b..727d53c8e1 100644 --- a/windows/keep-secure/increase-scheduling-priority.md +++ b/windows/keep-secure/increase-scheduling-priority.md @@ -2,7 +2,7 @@ title: Increase scheduling priority (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Increase scheduling priority security policy setting. ms.assetid: fbec5973-d35e-4797-9626-d0d56061527f -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/index.md b/windows/keep-secure/index.md index 5b1c59fb81..b605acb372 100644 --- a/windows/keep-secure/index.md +++ b/windows/keep-secure/index.md @@ -2,7 +2,7 @@ title: Keep Windows 10 secure (Windows 10) description: Learn about keeping Windows 10 and Windows 10 Mobile secure. ms.assetid: EA559BA8-734F-41DB-A74A-D8DBF36BE920 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md b/windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md index 2b407e7511..a1d2220641 100644 --- a/windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md +++ b/windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md @@ -2,7 +2,7 @@ title: Initialize and configure ownership of the TPM (Windows 10) description: This topic for the IT professional describes how to initialize and set the ownership the Trusted Platform Module (TPM), turn the TPM on and off, and clear TPM keys. ms.assetid: 1166efaf-7aa3-4420-9279-435d9c6ac6f8 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/installing-digital-certificates-on-windows-10-mobile.md b/windows/keep-secure/installing-digital-certificates-on-windows-10-mobile.md index 99bab3e2fa..33f7e83a76 100644 --- a/windows/keep-secure/installing-digital-certificates-on-windows-10-mobile.md +++ b/windows/keep-secure/installing-digital-certificates-on-windows-10-mobile.md @@ -3,7 +3,7 @@ title: Install digital certificates on Windows 10 Mobile (Windows 10) description: Digital certificates bind the identity of a user or computer to a pair of keys that can be used to encrypt and sign digital information. ms.assetid: FF7B1BE9-41F4-44B0-A442-249B650CEE25 keywords: S/MIME, PFX, SCEP -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/interactive-logon-display-user-information-when-the-session-is-locked.md b/windows/keep-secure/interactive-logon-display-user-information-when-the-session-is-locked.md index 998c7d3a6d..7c1d049314 100644 --- a/windows/keep-secure/interactive-logon-display-user-information-when-the-session-is-locked.md +++ b/windows/keep-secure/interactive-logon-display-user-information-when-the-session-is-locked.md @@ -2,7 +2,7 @@ title: Interactive logon Display user information when the session is locked (Windows 10) description: Describes the best practices, location, values, and security considerations for the Interactive logon Display user information when the session is locked security policy setting. ms.assetid: 9146aa3d-9b2f-47ba-ac03-ff43efb10530 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/interactive-logon-do-not-display-last-user-name.md b/windows/keep-secure/interactive-logon-do-not-display-last-user-name.md index 945989b859..0177def043 100644 --- a/windows/keep-secure/interactive-logon-do-not-display-last-user-name.md +++ b/windows/keep-secure/interactive-logon-do-not-display-last-user-name.md @@ -2,7 +2,7 @@ title: Interactive logon Do not display last user name (Windows 10) description: Describes the best practices, location, values, and security considerations for the Interactive logon Do not display last user name security policy setting. ms.assetid: 98b24b03-95fe-4edc-8e97-cbdaa8e314fd -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/interactive-logon-do-not-require-ctrl-alt-del.md b/windows/keep-secure/interactive-logon-do-not-require-ctrl-alt-del.md index 34a748af68..f2741165ce 100644 --- a/windows/keep-secure/interactive-logon-do-not-require-ctrl-alt-del.md +++ b/windows/keep-secure/interactive-logon-do-not-require-ctrl-alt-del.md @@ -2,7 +2,7 @@ title: Interactive logon Do not require CTRL+ALT+DEL (Windows 10) description: Describes the best practices, location, values, and security considerations for the Interactive logon Do not require CTRL+ALT+DEL security policy setting. ms.assetid: 04e2c000-2eb2-4d4b-8179-1e2cb4793e18 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/interactive-logon-machine-account-lockout-threshold.md b/windows/keep-secure/interactive-logon-machine-account-lockout-threshold.md index 3e7824eedb..ee2f89dfe2 100644 --- a/windows/keep-secure/interactive-logon-machine-account-lockout-threshold.md +++ b/windows/keep-secure/interactive-logon-machine-account-lockout-threshold.md @@ -2,7 +2,7 @@ title: Interactive logon Machine account lockout threshold (Windows 10) description: Describes the best practices, location, values, management, and security considerations for the Interactive logon Machine account lockout threshold security policy setting. ms.assetid: ebbd8e22-2611-4ebe-9db9-d49344e631e4 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/interactive-logon-machine-inactivity-limit.md b/windows/keep-secure/interactive-logon-machine-inactivity-limit.md index 9fb56662fb..5ecfd51a7e 100644 --- a/windows/keep-secure/interactive-logon-machine-inactivity-limit.md +++ b/windows/keep-secure/interactive-logon-machine-inactivity-limit.md @@ -2,7 +2,7 @@ title: Interactive logon Machine inactivity limit (Windows 10) description: Describes the best practices, location, values, management, and security considerations for the Interactive logon Machine inactivity limit security policy setting. ms.assetid: 7065b4a9-0d52-41d5-afc4-5aedfc4162b5 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/interactive-logon-message-text-for-users-attempting-to-log-on.md b/windows/keep-secure/interactive-logon-message-text-for-users-attempting-to-log-on.md index 2277884c62..6ee93f3d7a 100644 --- a/windows/keep-secure/interactive-logon-message-text-for-users-attempting-to-log-on.md +++ b/windows/keep-secure/interactive-logon-message-text-for-users-attempting-to-log-on.md @@ -2,7 +2,7 @@ title: Interactive logon Message text for users attempting to log on (Windows 10) description: Describes the best practices, location, values, management, and security considerations for the Interactive logon Message text for users attempting to log on security policy setting. ms.assetid: fcfe8a6d-ca65-4403-b9e6-2fa017a31c2e -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/interactive-logon-message-title-for-users-attempting-to-log-on.md b/windows/keep-secure/interactive-logon-message-title-for-users-attempting-to-log-on.md index 7e5719c49b..5fd221ea00 100644 --- a/windows/keep-secure/interactive-logon-message-title-for-users-attempting-to-log-on.md +++ b/windows/keep-secure/interactive-logon-message-title-for-users-attempting-to-log-on.md @@ -2,7 +2,7 @@ title: Interactive logon Message title for users attempting to log on (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Interactive logon Message title for users attempting to log on security policy setting. ms.assetid: f2596470-4cc0-4ef1-849c-bef9dc3533c6 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md b/windows/keep-secure/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md index 651f08183b..c57b5db6e3 100644 --- a/windows/keep-secure/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md +++ b/windows/keep-secure/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md @@ -2,7 +2,7 @@ title: Interactive logon Number of previous logons to cache (in case domain controller is not available) (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Interactive logon Number of previous logons to cache (in case domain controller is not available) security policy setting. ms.assetid: 660e925e-cc3e-4098-a41e-eb8db8062d8d -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/interactive-logon-prompt-user-to-change-password-before-expiration.md b/windows/keep-secure/interactive-logon-prompt-user-to-change-password-before-expiration.md index 6e08f688d8..3b6173cf5c 100644 --- a/windows/keep-secure/interactive-logon-prompt-user-to-change-password-before-expiration.md +++ b/windows/keep-secure/interactive-logon-prompt-user-to-change-password-before-expiration.md @@ -2,7 +2,7 @@ title: Interactive logon Prompt user to change password before expiration (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Interactive logon Prompt user to change password before expiration security policy setting. ms.assetid: 8fe94781-40f7-4fbe-8cfd-5e116e6833e9 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md b/windows/keep-secure/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md index 9660b5770a..0faeff4378 100644 --- a/windows/keep-secure/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md +++ b/windows/keep-secure/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md @@ -2,7 +2,7 @@ title: Interactive logon Require Domain Controller authentication to unlock workstation (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Interactive logon Require Domain Controller authentication to unlock workstation security policy setting. ms.assetid: 97618ed3-e946-47db-a212-b5e7a4fc6ffc -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/interactive-logon-require-smart-card.md b/windows/keep-secure/interactive-logon-require-smart-card.md index faf1834204..2441b3c3e7 100644 --- a/windows/keep-secure/interactive-logon-require-smart-card.md +++ b/windows/keep-secure/interactive-logon-require-smart-card.md @@ -2,7 +2,7 @@ title: Interactive logon Require smart card (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Interactive logon Require smart card security policy setting. ms.assetid: c6a8c040-cbc7-472d-8bc5-579ddf3cbd6c -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/interactive-logon-smart-card-removal-behavior.md b/windows/keep-secure/interactive-logon-smart-card-removal-behavior.md index 29eba6fd2b..a2ba648b93 100644 --- a/windows/keep-secure/interactive-logon-smart-card-removal-behavior.md +++ b/windows/keep-secure/interactive-logon-smart-card-removal-behavior.md @@ -2,7 +2,7 @@ title: Interactive logon Smart card removal behavior (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Interactive logon Smart card removal behavior security policy setting. ms.assetid: 61487820-9d49-4979-b15d-c7e735999460 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md index 02e10c15b7..20a073c239 100644 --- a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md @@ -3,9 +3,10 @@ title: Investigate Windows Defender Advanced Threat Protection alerts description: Use the investigation options to get details on which alerts are affecting your network, what they mean, and how to resolve them. keywords: investigate, investigation, machines, machine, endpoints, endpoint, alerts queue, dashboard, IP address, file, submit, submissions, deep analysis, timeline, search, domain, URL, IP search.product: eADQiWindows 10XVcnh -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security --- # Investigate Windows Defender Advanced Threat Protection alerts diff --git a/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md index f5864ee6f3..fd75059fff 100644 --- a/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md @@ -3,9 +3,10 @@ title: Investigate Windows Defender Advanced Threat Protection domains description: Use the investigation options to see if machines and servers have been communicating with malicious domains. keywords: investigate domain, domain, malicious domain, windows defender atp, alert, URL search.product: eADQiWindows 10XVcnh -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: mjcaparas --- # Investigate a domain associated with a Windows Defender ATP alert diff --git a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md index 3b0b76a04d..2f82d6927e 100644 --- a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md @@ -3,9 +3,10 @@ title: Investigate Windows Defender Advanced Threat Protection files description: Use the investigation options to get details on files associated with alerts, behaviours, or events. keywords: investigate, investigation, file, malicious activity, attack motivation, deep analysis, deep analysis report search.product: eADQiWindows 10XVcnh -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: mjcaparas --- # Investigate a file associated with a Windows Defender ATP alert diff --git a/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md index 5e516f6425..e1427b0400 100644 --- a/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md @@ -3,9 +3,10 @@ title: Investigate Windows Defender Advanced Threat Protection IP address description: Use the investigation options to examine possible communication between machines and external IP addresses. keywords: investigate, investigation, IP address, alert, windows defender atp, external IP search.product: eADQiWindows 10XVcnh -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: mjcaparas --- # Investigate an IP address associated with a Windows Defender ATP alert diff --git a/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md index a248e46dd3..4778e194e5 100644 --- a/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md @@ -3,9 +3,10 @@ title: Investigate machines in the Windows Defender ATP Machines view description: Investigate affected machines in your network by reviewing alerts, network connection information, and service health on the Machines view. keywords: machines, endpoints, machine, endpoint, alerts queue, alerts, machine name, domain, last seen, internal IP, active alerts, active malware detections, threat category, filter, sort, review alerts, network, connection, malware, type, password stealer, ransomware, exploit, threat, low severity search.product: eADQiWindows 10XVcnh -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: mjcaparas --- diff --git a/windows/keep-secure/kerberos-policy.md b/windows/keep-secure/kerberos-policy.md index fa68f49ac1..0cb40c4482 100644 --- a/windows/keep-secure/kerberos-policy.md +++ b/windows/keep-secure/kerberos-policy.md @@ -2,7 +2,7 @@ title: Kerberos Policy (Windows 10) description: Describes the Kerberos Policy settings and provides links to policy setting descriptions. ms.assetid: 94017dd9-b1a3-4624-af9f-b29161b4bf38 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security From 87875ceac0c7d83370747aefb68e924ac1e4ccfe Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Fri, 27 May 2016 08:41:59 -0700 Subject: [PATCH 437/439] changed from opting out of MAPS to disconnecting from MAPS --- ...windows-operating-system-components-to-microsoft-services.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index f8496916b0..d171860de7 100644 --- a/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -1083,7 +1083,7 @@ When turned off, the Wi-Fi Sense settings still appear on the Wi-Fi Settings scr ### 19. Windows Defender -You can opt out of the Microsoft Antimalware Protection Service. +You can disconnect from the Microsoft Antimalware Protection Service. - Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender** > **MAPS** > **Join Microsoft MAPS** From 50c264bd5520b155cac03254995bce162ba5b460 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Fri, 27 May 2016 09:31:05 -0700 Subject: [PATCH 438/439] fixing typo --- ...windows-operating-system-components-to-microsoft-services.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index d171860de7..616f93dc73 100644 --- a/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -1209,7 +1209,7 @@ The following Delivery Optimization MDM policies are available in the [Policy CS | Policy | Description | |---------------------------|-----------------------------------------------------------------------------------------------------| | DeliveryOptimization/DODownloadMode | Lets you choose where Delivery Optimization gets or sends updates and apps, including
      • 0. Turns off Delivery Optimization.

      • 1. Gets or sends updates and apps to PCs on the same NAT only.

      • 2. Gets or sends updates and apps to PCs on the same local network domain.

      • 3. Gets or sends updates and apps to PCs on the Internet.

      | -| DeliveryOptimization/DOGroupID | Lets you provide a Group ID that limits which PCs can share apps and updates.
      ** Note** This ID must be a GUID.| +| DeliveryOptimization/DOGroupID | Lets you provide a Group ID that limits which PCs can share apps and updates.
      **Note** This ID must be a GUID.| | DeliveryOptimization/DOMaxCacheAge | Lets you specify the maximum time (in seconds) that a file is held in the Delivery Optimization cache.
      The default value is 259200 seconds (3 days).| | DeliveryOptimization/DOMaxCacheSize | Lets you specify the maximum cache size as a percentage of disk size.
      The default value is 20, which represents 20% of the disk.| | DeliveryOptimization/DOMaxUploadBandwidth | Lets you specify the maximum upload bandwidth (in KB/second) that a device uses across all concurrent upload activity.
      The default value is 0, which means unlimited possible bandwidth.| From 8e6dba25e9dbe4f0c138a416b6de2fb4abc6f94e Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Fri, 27 May 2016 13:46:06 -0700 Subject: [PATCH 439/439] update tagging change W10 to w10 (lower case); add ms.pagetype; added authors --- ...ge-privacy-windows-defender-advanced-threat-protection.md | 1 + ...ate-alerts-windows-defender-advanced-threat-protection.md | 1 + windows/keep-secure/load-and-unload-device-drivers.md | 2 +- windows/keep-secure/lock-pages-in-memory.md | 2 +- windows/keep-secure/log-on-as-a-batch-job.md | 2 +- windows/keep-secure/log-on-as-a-service.md | 2 +- windows/keep-secure/maintain-applocker-policies.md | 2 +- ...age-alerts-windows-defender-advanced-threat-protection.md | 4 +++- windows/keep-secure/manage-auditing-and-security-log.md | 2 +- .../manage-identity-verification-using-microsoft-passport.md | 2 +- windows/keep-secure/manage-packaged-apps-with-applocker.md | 2 +- windows/keep-secure/manage-tpm-commands.md | 2 +- windows/keep-secure/manage-tpm-lockout.md | 2 +- windows/keep-secure/maximum-lifetime-for-service-ticket.md | 2 +- .../keep-secure/maximum-lifetime-for-user-ticket-renewal.md | 2 +- windows/keep-secure/maximum-lifetime-for-user-ticket.md | 2 +- windows/keep-secure/maximum-password-age.md | 2 +- .../maximum-tolerance-for-computer-clock-synchronization.md | 2 +- .../merge-applocker-policies-by-using-set-applockerpolicy.md | 2 +- windows/keep-secure/merge-applocker-policies-manually.md | 2 +- ...ft-network-client-digitally-sign-communications-always.md | 2 +- ...-client-digitally-sign-communications-if-server-agrees.md | 2 +- ...t-send-unencrypted-password-to-third-party-smb-servers.md | 2 +- ...amount-of-idle-time-required-before-suspending-session.md | 2 +- ...rk-server-attempt-s4u2self-to-obtain-claim-information.md | 2 +- ...ft-network-server-digitally-sign-communications-always.md | 2 +- ...-server-digitally-sign-communications-if-client-agrees.md | 2 +- ...work-server-disconnect-clients-when-logon-hours-expire.md | 2 +- ...network-server-server-spn-target-name-validation-level.md | 2 +- .../keep-secure/microsoft-passport-and-password-changes.md | 2 +- .../microsoft-passport-errors-during-pin-creation.md | 2 +- windows/keep-secure/microsoft-passport-guide.md | 3 +-- windows/keep-secure/minimum-password-age.md | 2 +- windows/keep-secure/minimum-password-length.md | 2 +- ...quirements-windows-defender-advanced-threat-protection.md | 3 ++- windows/keep-secure/modify-an-object-label.md | 2 +- windows/keep-secure/modify-firmware-environment-values.md | 2 +- .../keep-secure/monitor-application-usage-with-applocker.md | 2 +- .../monitor-central-access-policy-and-rule-definitions.md | 2 +- windows/keep-secure/monitor-claim-types.md | 2 +- ...onboarding-windows-defender-advanced-threat-protection.md | 3 ++- .../keep-secure/monitor-resource-attribute-definitions.md | 2 +- ...tral-access-policies-associated-with-files-and-folders.md | 2 +- ...he-central-access-policies-that-apply-on-a-file-server.md | 2 +- .../monitor-the-resource-attributes-on-files-and-folders.md | 2 +- .../monitor-the-use-of-removable-storage-devices.md | 2 +- .../monitor-user-and-device-claims-during-sign-in.md | 2 +- .../network-access-allow-anonymous-sidname-translation.md | 2 +- ...allow-anonymous-enumeration-of-sam-accounts-and-shares.md | 2 +- ...ess-do-not-allow-anonymous-enumeration-of-sam-accounts.md | 2 +- ...f-passwords-and-credentials-for-network-authentication.md | 2 +- ...cess-let-everyone-permissions-apply-to-anonymous-users.md | 2 +- ...rk-access-named-pipes-that-can-be-accessed-anonymously.md | 2 +- ...access-remotely-accessible-registry-paths-and-subpaths.md | 2 +- .../network-access-remotely-accessible-registry-paths.md | 2 +- ...ss-restrict-anonymous-access-to-named-pipes-and-shares.md | 2 +- ...network-access-shares-that-can-be-accessed-anonymously.md | 2 +- ...k-access-sharing-and-security-model-for-local-accounts.md | 2 +- windows/keep-secure/network-list-manager-policies.md | 2 +- ...y-allow-local-system-to-use-computer-identity-for-ntlm.md | 2 +- ...twork-security-allow-localsystem-null-session-fallback.md | 2 +- ...ion-requests-to-this-computer-to-use-online-identities.md | 2 +- ...curity-configure-encryption-types-allowed-for-kerberos.md | 2 +- ...t-store-lan-manager-hash-value-on-next-password-change.md | 2 +- .../network-security-force-logoff-when-logon-hours-expire.md | 2 +- .../network-security-lan-manager-authentication-level.md | 2 +- .../network-security-ldap-client-signing-requirements.md | 2 +- ...curity-for-ntlm-ssp-based-including-secure-rpc-clients.md | 2 +- ...curity-for-ntlm-ssp-based-including-secure-rpc-servers.md | 2 +- ...m-add-remote-server-exceptions-for-ntlm-authentication.md | 2 +- ...ity-restrict-ntlm-add-server-exceptions-in-this-domain.md | 2 +- ...ork-security-restrict-ntlm-audit-incoming-ntlm-traffic.md | 2 +- ...restrict-ntlm-audit-ntlm-authentication-in-this-domain.md | 2 +- .../network-security-restrict-ntlm-incoming-ntlm-traffic.md | 2 +- ...urity-restrict-ntlm-ntlm-authentication-in-this-domain.md | 2 +- ...-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md | 2 +- ...-configure-windows-defender-advanced-threat-protection.md | 3 ++- windows/keep-secure/optimize-applocker-performance.md | 2 +- windows/keep-secure/overview-create-edp-policy.md | 3 ++- ...ged-apps-and-packaged-app-installer-rules-in-applocker.md | 2 +- windows/keep-secure/passport-event-300.md | 4 ++-- .../password-must-meet-complexity-requirements.md | 2 +- windows/keep-secure/password-policy.md | 2 +- windows/keep-secure/perform-volume-maintenance-tasks.md | 2 +- windows/keep-secure/plan-for-applocker-policy-management.md | 2 +- ...lanning-and-deploying-advanced-security-audit-policies.md | 2 +- ...l-overview-windows-defender-advanced-threat-protection.md | 3 ++- .../keep-secure/prepare-people-to-use-microsoft-passport.md | 2 +- ...-your-organization-for-bitlocker-planning-and-policies.md | 2 +- windows/keep-secure/profile-single-process.md | 2 +- windows/keep-secure/profile-system-performance.md | 2 +- .../keep-secure/protect-bitlocker-from-pre-boot-attacks.md | 2 +- windows/keep-secure/protect-enterprise-data-using-edp.md | 5 +++-- ...-by-controlling-the-health-of-windows-10-based-devices.md | 4 ++-- ...hared-volumes-and-storage-area-networks-with-bitlocker.md | 2 +- .../recovery-console-allow-automatic-administrative-logon.md | 2 +- ...allow-floppy-copy-and-access-to-all-drives-and-folders.md | 2 +- windows/keep-secure/refresh-an-applocker-policy.md | 2 +- .../keep-secure/registry-global-object-access-auditing.md | 2 +- windows/keep-secure/remove-computer-from-docking-station.md | 2 +- windows/keep-secure/replace-a-process-level-token.md | 2 +- .../requirements-for-deploying-applocker-policies.md | 2 +- windows/keep-secure/requirements-to-use-applocker.md | 2 +- windows/keep-secure/reset-account-lockout-counter-after.md | 2 +- windows/keep-secure/restore-files-and-directories.md | 2 +- .../run-cmd-scan-windows-defender-for-windows-10.md | 3 ++- .../run-the-automatically-generate-rules-wizard.md | 2 +- windows/keep-secure/script-rules-in-applocker.md | 2 +- .../secpol-advanced-security-audit-policy-settings.md | 2 +- windows/keep-secure/security-auditing-overview.md | 2 +- windows/keep-secure/security-considerations-for-applocker.md | 2 +- windows/keep-secure/security-options.md | 2 +- windows/keep-secure/security-policy-settings-reference.md | 2 +- windows/keep-secure/security-policy-settings.md | 2 +- windows/keep-secure/security-technologies.md | 2 +- windows/keep-secure/select-types-of-rules-to-create.md | 2 +- ...onboarding-windows-defender-advanced-threat-protection.md | 3 ++- .../settings-windows-defender-advanced-threat-protection.md | 3 ++- windows/keep-secure/shut-down-the-system.md | 2 +- ...-allow-system-to-be-shut-down-without-having-to-log-on.md | 2 +- .../keep-secure/shutdown-clear-virtual-memory-pagefile.md | 2 +- .../store-passwords-using-reversible-encryption.md | 2 +- windows/keep-secure/switch-pcr-banks-on-tpm-2-0-devices.md | 2 +- windows/keep-secure/synchronize-directory-service-data.md | 2 +- ...ng-key-protection-for-user-keys-stored-on-the-computer.md | 2 +- ...ompliant-algorithms-for-encryption-hashing-and-signing.md | 2 +- ...-require-case-insensitivity-for-non-windows-subsystems.md | 2 +- ...engthen-default-permissions-of-internal-system-objects.md | 2 +- windows/keep-secure/system-settings-optional-subsystems.md | 2 +- ...-windows-executables-for-software-restriction-policies.md | 2 +- .../keep-secure/take-ownership-of-files-or-other-objects.md | 2 +- ...test-an-applocker-policy-by-using-test-applockerpolicy.md | 2 +- windows/keep-secure/test-and-update-an-applocker-policy.md | 2 +- windows/keep-secure/testing-scenarios-for-edp.md | 5 +++-- windows/keep-secure/tools-to-use-with-applocker.md | 2 +- windows/keep-secure/tpm-fundamentals.md | 2 +- windows/keep-secure/tpm-recommendations.md | 2 +- ...onboarding-windows-defender-advanced-threat-protection.md | 3 ++- ...oubleshoot-windows-defender-advanced-threat-protection.md | 3 ++- .../troubleshoot-windows-defender-in-windows-10.md | 2 +- windows/keep-secure/trusted-platform-module-overview.md | 2 +- ...trusted-platform-module-services-group-policy-settings.md | 2 +- .../types-of-attacks-for-volume-encryption-keys.md | 2 +- .../keep-secure/understand-applocker-enforcement-settings.md | 2 +- .../understand-applocker-policy-design-decisions.md | 2 +- ...es-and-enforcement-setting-inheritance-in-group-policy.md | 2 +- .../understand-the-applocker-policy-deployment-process.md | 2 +- ...nderstanding-applocker-allow-and-deny-actions-on-rules.md | 2 +- windows/keep-secure/understanding-applocker-default-rules.md | 2 +- windows/keep-secure/understanding-applocker-rule-behavior.md | 2 +- .../keep-secure/understanding-applocker-rule-collections.md | 2 +- .../understanding-applocker-rule-condition-types.md | 2 +- .../keep-secure/understanding-applocker-rule-exceptions.md | 2 +- ...nderstanding-the-file-hash-rule-condition-in-applocker.md | 2 +- .../understanding-the-path-rule-condition-in-applocker.md | 2 +- ...nderstanding-the-publisher-rule-condition-in-applocker.md | 2 +- ...nce-computer-to-create-and-maintain-applocker-policies.md | 2 +- ...r-and-software-restriction-policies-in-the-same-domain.md | 2 +- .../use-the-applocker-windows-powershell-cmdlets.md | 2 +- .../use-windows-defender-advanced-threat-protection.md | 3 ++- ...ows-event-forwarding-to-assist-in-instrusion-detection.md | 2 +- ...n-approval-mode-for-the-built-in-administrator-account.md | 2 +- ...-prompt-for-elevation-without-using-the-secure-desktop.md | 2 +- ...ation-prompt-for-administrators-in-admin-approval-mode.md | 2 +- ...ol-behavior-of-the-elevation-prompt-for-standard-users.md | 2 +- ...ect-application-installations-and-prompt-for-elevation.md | 2 +- ...account-control-group-policy-and-registry-key-settings.md | 4 +++- ...only-elevate-executables-that-are-signed-and-validated.md | 2 +- ...ss-applications-that-are-installed-in-secure-locations.md | 2 +- windows/keep-secure/user-account-control-overview.md | 2 +- ...-control-run-all-administrators-in-admin-approval-mode.md | 2 +- .../user-account-control-security-policy-settings.md | 4 ++-- ...tch-to-the-secure-desktop-when-prompting-for-elevation.md | 2 +- ...file-and-registry-write-failures-to-per-user-locations.md | 2 +- windows/keep-secure/user-rights-assignment.md | 2 +- ...ting-options-to-monitor-dynamic-access-control-objects.md | 2 +- windows/keep-secure/using-event-viewer-with-applocker.md | 2 +- ...g-software-restriction-policies-and-applocker-policies.md | 2 +- windows/keep-secure/view-the-security-event-log.md | 2 +- windows/keep-secure/vpn-profile-options.md | 4 ++-- windows/keep-secure/what-is-applocker.md | 2 +- ...of-windows-support-advanced-audit-policy-configuration.md | 2 +- windows/keep-secure/why-a-pin-is-better-than-a-password.md | 2 +- windows/keep-secure/windows-10-enterprise-security-guides.md | 4 ++-- windows/keep-secure/windows-10-mobile-security-guide.md | 4 ++-- windows/keep-secure/windows-10-security-guide.md | 2 +- .../windows-defender-advanced-threat-protection.md | 3 ++- windows/keep-secure/windows-defender-in-windows-10.md | 2 +- windows/keep-secure/windows-hello-in-enterprise.md | 5 +++-- windows/keep-secure/windows-installer-rules-in-applocker.md | 2 +- windows/keep-secure/working-with-applocker-policies.md | 2 +- windows/keep-secure/working-with-applocker-rules.md | 2 +- 192 files changed, 220 insertions(+), 200 deletions(-) diff --git a/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md index 6db6f55321..a5d2bec8ce 100644 --- a/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md @@ -7,6 +7,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security +author: mjcaparas --- # Windows Defender ATP data storage and privacy diff --git a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md index 20a073c239..d724b1862d 100644 --- a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md @@ -7,6 +7,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security +author: mjcaparas --- # Investigate Windows Defender Advanced Threat Protection alerts diff --git a/windows/keep-secure/load-and-unload-device-drivers.md b/windows/keep-secure/load-and-unload-device-drivers.md index 0ef993463c..a0500dbf3c 100644 --- a/windows/keep-secure/load-and-unload-device-drivers.md +++ b/windows/keep-secure/load-and-unload-device-drivers.md @@ -2,7 +2,7 @@ title: Load and unload device drivers (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Load and unload device drivers security policy setting. ms.assetid: 66262532-c610-470c-9792-35ff4389430f -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/lock-pages-in-memory.md b/windows/keep-secure/lock-pages-in-memory.md index c2d3f4a39d..c1da29a511 100644 --- a/windows/keep-secure/lock-pages-in-memory.md +++ b/windows/keep-secure/lock-pages-in-memory.md @@ -2,7 +2,7 @@ title: Lock pages in memory (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Lock pages in memory security policy setting. ms.assetid: cc724979-aec0-496d-be4e-7009aef660a3 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/log-on-as-a-batch-job.md b/windows/keep-secure/log-on-as-a-batch-job.md index 6ffcaa330e..e2be507be1 100644 --- a/windows/keep-secure/log-on-as-a-batch-job.md +++ b/windows/keep-secure/log-on-as-a-batch-job.md @@ -2,7 +2,7 @@ title: Log on as a batch job (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Log on as a batch job security policy setting. ms.assetid: 4eaddb51-0a18-470e-9d3d-5e7cd7970b41 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/log-on-as-a-service.md b/windows/keep-secure/log-on-as-a-service.md index 04d7784d74..eff13752ec 100644 --- a/windows/keep-secure/log-on-as-a-service.md +++ b/windows/keep-secure/log-on-as-a-service.md @@ -2,7 +2,7 @@ title: Log on as a service (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Log on as a service security policy setting. ms.assetid: acc9a9e0-fd88-4cda-ab54-503120ba1f42 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/maintain-applocker-policies.md b/windows/keep-secure/maintain-applocker-policies.md index bc85d3af36..43bd39884e 100644 --- a/windows/keep-secure/maintain-applocker-policies.md +++ b/windows/keep-secure/maintain-applocker-policies.md @@ -2,7 +2,7 @@ title: Maintain AppLocker policies (Windows 10) description: This topic describes how to maintain rules within AppLocker policies. ms.assetid: b4fbfdfe-ef3d-49e0-a390-f2dfe74602bc -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md index 12cc2527bd..718b2e22ce 100644 --- a/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md @@ -3,9 +3,11 @@ title: Manage Windows Defender Advanced Threat Protection alerts description: Change the status of alerts, create suppression rules to hide alerts, submit comments, and review change history for individual alerts with the Manage Alert menu. keywords: manage alerts, manage, alerts, status, new, in progress, resolved, resolve alerts, suppress, supression, rules, context, history, comments, changes search.product: eADQiWindows 10XVcnh -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security +author: mjcaparas --- # Manage Windows Defender Advanced Threat Protection alerts diff --git a/windows/keep-secure/manage-auditing-and-security-log.md b/windows/keep-secure/manage-auditing-and-security-log.md index 48c840cc7b..7a6cfdc0ea 100644 --- a/windows/keep-secure/manage-auditing-and-security-log.md +++ b/windows/keep-secure/manage-auditing-and-security-log.md @@ -2,7 +2,7 @@ title: Manage auditing and security log (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Manage auditing and security log security policy setting. ms.assetid: 4b946c0d-f904-43db-b2d5-7f0917575347 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md b/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md index 7f4b06da3d..bb891d67c5 100644 --- a/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md +++ b/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md @@ -3,7 +3,7 @@ title: Manage identity verification using Microsoft Passport (Windows 10) description: In Windows 10, Microsoft Passport replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a Windows Hello (biometric) or PIN. ms.assetid: 5BF09642-8CF5-4FBC-AC9A-5CA51E19387E keywords: identity, PIN, biometric, Hello -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/manage-packaged-apps-with-applocker.md b/windows/keep-secure/manage-packaged-apps-with-applocker.md index dcad549bfa..e1a7639af3 100644 --- a/windows/keep-secure/manage-packaged-apps-with-applocker.md +++ b/windows/keep-secure/manage-packaged-apps-with-applocker.md @@ -2,7 +2,7 @@ title: Manage packaged apps with AppLocker (Windows 10) description: This topic for IT professionals describes concepts and lists procedures to help you manage Packaged apps with AppLocker as part of your overall application control strategy. ms.assetid: 6d0c99e7-0284-4547-a30a-0685a9916650 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/manage-tpm-commands.md b/windows/keep-secure/manage-tpm-commands.md index 1aa0ca5061..0620207ec5 100644 --- a/windows/keep-secure/manage-tpm-commands.md +++ b/windows/keep-secure/manage-tpm-commands.md @@ -2,7 +2,7 @@ title: Manage TPM commands (Windows 10) description: This topic for the IT professional describes how to manage which Trusted Platform Module (TPM) commands are available to domain users and to local users. ms.assetid: a78e751a-2806-43ae-9c20-2e7ca466b765 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/manage-tpm-lockout.md b/windows/keep-secure/manage-tpm-lockout.md index 7c75700ed0..61c94cc77e 100644 --- a/windows/keep-secure/manage-tpm-lockout.md +++ b/windows/keep-secure/manage-tpm-lockout.md @@ -2,7 +2,7 @@ title: Manage TPM lockout (Windows 10) description: This topic for the IT professional describes how to manage the lockout feature for the Trusted Platform Module (TPM) in Windows. ms.assetid: bf27adbe-404c-4691-a644-29ec722a3f7b -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/maximum-lifetime-for-service-ticket.md b/windows/keep-secure/maximum-lifetime-for-service-ticket.md index 3a0a6fff86..fd43969eb0 100644 --- a/windows/keep-secure/maximum-lifetime-for-service-ticket.md +++ b/windows/keep-secure/maximum-lifetime-for-service-ticket.md @@ -2,7 +2,7 @@ title: Maximum lifetime for service ticket (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Maximum lifetime for service ticket security policy setting. ms.assetid: 484bf05a-3858-47fc-bc02-6599ca860247 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/maximum-lifetime-for-user-ticket-renewal.md b/windows/keep-secure/maximum-lifetime-for-user-ticket-renewal.md index c1f175c55b..f807fae4e2 100644 --- a/windows/keep-secure/maximum-lifetime-for-user-ticket-renewal.md +++ b/windows/keep-secure/maximum-lifetime-for-user-ticket-renewal.md @@ -2,7 +2,7 @@ title: Maximum lifetime for user ticket renewal (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Maximum lifetime for user ticket renewal security policy setting. ms.assetid: f88cd819-3dd1-4e38-b560-13fe6881b609 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/maximum-lifetime-for-user-ticket.md b/windows/keep-secure/maximum-lifetime-for-user-ticket.md index e1a9089dd7..e37ae53435 100644 --- a/windows/keep-secure/maximum-lifetime-for-user-ticket.md +++ b/windows/keep-secure/maximum-lifetime-for-user-ticket.md @@ -2,7 +2,7 @@ title: Maximum lifetime for user ticket (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Maximum lifetime for user ticket policy setting. ms.assetid: bcb4ff59-334d-4c2f-99af-eca2b64011dc -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/maximum-password-age.md b/windows/keep-secure/maximum-password-age.md index 30fb8319a2..488f04f383 100644 --- a/windows/keep-secure/maximum-password-age.md +++ b/windows/keep-secure/maximum-password-age.md @@ -2,7 +2,7 @@ title: Maximum password age (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Maximum password age security policy setting. ms.assetid: 2d6e70e7-c8b0-44fb-8113-870c6120871d -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/maximum-tolerance-for-computer-clock-synchronization.md b/windows/keep-secure/maximum-tolerance-for-computer-clock-synchronization.md index f5f976b55a..63ebd1f934 100644 --- a/windows/keep-secure/maximum-tolerance-for-computer-clock-synchronization.md +++ b/windows/keep-secure/maximum-tolerance-for-computer-clock-synchronization.md @@ -2,7 +2,7 @@ title: Maximum tolerance for computer clock synchronization (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Maximum tolerance for computer clock synchronization security policy setting. ms.assetid: ba2cf59e-d69d-469e-95e3-8e6a0ba643af -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/merge-applocker-policies-by-using-set-applockerpolicy.md b/windows/keep-secure/merge-applocker-policies-by-using-set-applockerpolicy.md index 42b8495ede..2e095a1533 100644 --- a/windows/keep-secure/merge-applocker-policies-by-using-set-applockerpolicy.md +++ b/windows/keep-secure/merge-applocker-policies-by-using-set-applockerpolicy.md @@ -2,7 +2,7 @@ title: Merge AppLocker policies by using Set-ApplockerPolicy (Windows 10) description: This topic for IT professionals describes the steps to merge AppLocker policies by using Windows PowerShell. ms.assetid: f1c7d5c0-463e-4fe2-a410-844a404f18d0 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/merge-applocker-policies-manually.md b/windows/keep-secure/merge-applocker-policies-manually.md index c511afb3cd..2747de84e0 100644 --- a/windows/keep-secure/merge-applocker-policies-manually.md +++ b/windows/keep-secure/merge-applocker-policies-manually.md @@ -2,7 +2,7 @@ title: Merge AppLocker policies manually (Windows 10) description: This topic for IT professionals describes the steps to manually merge AppLocker policies to update the Group Policy Object (GPO). ms.assetid: 3605f293-e5f2-481d-8efd-775f9f23c30f -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/microsoft-network-client-digitally-sign-communications-always.md b/windows/keep-secure/microsoft-network-client-digitally-sign-communications-always.md index 597e001a91..1cb4c83e11 100644 --- a/windows/keep-secure/microsoft-network-client-digitally-sign-communications-always.md +++ b/windows/keep-secure/microsoft-network-client-digitally-sign-communications-always.md @@ -2,7 +2,7 @@ title: Microsoft network client Digitally sign communications (always) (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Microsoft network client Digitally sign communications (always) security policy setting. ms.assetid: 4b7b0298-b130-40f8-960d-60418ba85f76 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/microsoft-network-client-digitally-sign-communications-if-server-agrees.md b/windows/keep-secure/microsoft-network-client-digitally-sign-communications-if-server-agrees.md index 3f25ac2921..4594534751 100644 --- a/windows/keep-secure/microsoft-network-client-digitally-sign-communications-if-server-agrees.md +++ b/windows/keep-secure/microsoft-network-client-digitally-sign-communications-if-server-agrees.md @@ -2,7 +2,7 @@ title: Microsoft network client Digitally sign communications (if server agrees) (Windows 10) description: Describes the best practices, location, values, and security considerations for the Microsoft network client Digitally sign communications (if server agrees) security policy setting. ms.assetid: e553f700-aae5-425c-8650-f251c90ba5dd -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md b/windows/keep-secure/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md index 56635e06cc..901baabc0f 100644 --- a/windows/keep-secure/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md +++ b/windows/keep-secure/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md @@ -2,7 +2,7 @@ title: Microsoft network client Send unencrypted password to third-party SMB servers (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Microsoft network client Send unencrypted password to third-party SMB servers security policy setting. ms.assetid: 97a76b93-afa7-4dd9-bb52-7c9e289b6017 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md b/windows/keep-secure/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md index 76e38d84c1..f124f2216c 100644 --- a/windows/keep-secure/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md +++ b/windows/keep-secure/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md @@ -2,7 +2,7 @@ title: Microsoft network server Amount of idle time required before suspending session (Windows 10) description: Describes the best practices, location, values, and security considerations for the Microsoft network server Amount of idle time required before suspending session security policy setting. ms.assetid: 8227842a-569d-480f-b43c-43450bbaa722 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md b/windows/keep-secure/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md index ea1b074c71..d979a1d65a 100644 --- a/windows/keep-secure/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md +++ b/windows/keep-secure/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md @@ -2,7 +2,7 @@ title: Microsoft network server Attempt S4U2Self to obtain claim information (Windows 10) description: Describes the best practices, location, values, management, and security considerations for the Microsoft network server Attempt S4U2Self to obtain claim information security policy setting. ms.assetid: e4508387-35ed-4a3f-a47c-27f8396adbba -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/microsoft-network-server-digitally-sign-communications-always.md b/windows/keep-secure/microsoft-network-server-digitally-sign-communications-always.md index 23d423e6d9..e71590b3cf 100644 --- a/windows/keep-secure/microsoft-network-server-digitally-sign-communications-always.md +++ b/windows/keep-secure/microsoft-network-server-digitally-sign-communications-always.md @@ -2,7 +2,7 @@ title: Microsoft network server Digitally sign communications (always) (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Microsoft network server Digitally sign communications (always) security policy setting. ms.assetid: 2007b622-7bc2-44e8-9cf1-d34b62117ea8 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/microsoft-network-server-digitally-sign-communications-if-client-agrees.md b/windows/keep-secure/microsoft-network-server-digitally-sign-communications-if-client-agrees.md index 2f327071cb..6ad33d8c8d 100644 --- a/windows/keep-secure/microsoft-network-server-digitally-sign-communications-if-client-agrees.md +++ b/windows/keep-secure/microsoft-network-server-digitally-sign-communications-if-client-agrees.md @@ -2,7 +2,7 @@ title: Microsoft network server Digitally sign communications (if client agrees) (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Microsoft network server Digitally sign communications (if client agrees) security policy setting. ms.assetid: c92b2e3d-1dbf-4337-a145-b17a585f4fc1 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md b/windows/keep-secure/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md index b2737896f1..529004e2f0 100644 --- a/windows/keep-secure/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md +++ b/windows/keep-secure/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md @@ -2,7 +2,7 @@ title: Microsoft network server Disconnect clients when logon hours expire (Windows 10) description: Describes the best practices, location, values, and security considerations for the Microsoft network server Disconnect clients when logon hours expire security policy setting. ms.assetid: 48b5c424-9ba8-416d-be7d-ccaabb3f49af -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/microsoft-network-server-server-spn-target-name-validation-level.md b/windows/keep-secure/microsoft-network-server-server-spn-target-name-validation-level.md index b5d71aae14..6096400f68 100644 --- a/windows/keep-secure/microsoft-network-server-server-spn-target-name-validation-level.md +++ b/windows/keep-secure/microsoft-network-server-server-spn-target-name-validation-level.md @@ -2,7 +2,7 @@ title: Microsoft network server Server SPN target name validation level (Windows 10) description: Describes the best practices, location, and values, policy management and security considerations for the Microsoft network server Server SPN target name validation level security policy setting. ms.assetid: 18337f78-eb45-42fd-bdbd-f8cd02c3e154 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/microsoft-passport-and-password-changes.md b/windows/keep-secure/microsoft-passport-and-password-changes.md index 4325261928..ceebe00f0a 100644 --- a/windows/keep-secure/microsoft-passport-and-password-changes.md +++ b/windows/keep-secure/microsoft-passport-and-password-changes.md @@ -2,7 +2,7 @@ title: Microsoft Passport and password changes (Windows 10) description: When you set up Microsoft Passport, the PIN or biometric (Windows Hello) gesture that you use is specific to that device. ms.assetid: 83005FE4-8899-47A6-BEA9-C17CCA0B6B55 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md b/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md index a9483a0b56..490c5c9e6e 100644 --- a/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md +++ b/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md @@ -3,7 +3,7 @@ title: Microsoft Passport errors during PIN creation (Windows 10) description: When you set up Microsoft Passport in Windows 10, you may get an error during the Create a work PIN step. ms.assetid: DFEFE22C-4FEF-4FD9-BFC4-9B419C339502 keywords: PIN, error, create a work PIN -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/microsoft-passport-guide.md b/windows/keep-secure/microsoft-passport-guide.md index 70f6296988..b78b6f94f7 100644 --- a/windows/keep-secure/microsoft-passport-guide.md +++ b/windows/keep-secure/microsoft-passport-guide.md @@ -3,8 +3,7 @@ title: Microsoft Passport guide (Windows 10) description: This guide describes the new Windows Hello and Microsoft Passport technologies that are part of the Windows 10 operating system. ms.assetid: 11EA7826-DA6B-4E5C-99FB-142CC6BD9E84 keywords: security, credential, password, authentication -ms.prod: W10 -ms.pagetype: security +ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/minimum-password-age.md b/windows/keep-secure/minimum-password-age.md index a975b21ff4..d56c232478 100644 --- a/windows/keep-secure/minimum-password-age.md +++ b/windows/keep-secure/minimum-password-age.md @@ -2,7 +2,7 @@ title: Minimum password age (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Minimum password age security policy setting. ms.assetid: 91915cb2-1b3f-4fb7-afa0-d03df95e8161 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/minimum-password-length.md b/windows/keep-secure/minimum-password-length.md index 79281f850c..39c8f9fa60 100644 --- a/windows/keep-secure/minimum-password-length.md +++ b/windows/keep-secure/minimum-password-length.md @@ -2,7 +2,7 @@ title: Minimum password length (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Minimum password length security policy setting. ms.assetid: 3d22eb9a-859a-4b6f-82f5-c270c427e17e -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md index fa17f2947f..91db7537e8 100644 --- a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -3,9 +3,10 @@ title: Minimum requirements for Windows Defender Advanced Threat Protection description: Minimum network and data storage configuration, endpoint hardware and software requirements, and deployment channel requirements for Windows Defender ATP. keywords: minimum requirements, Windows Defender Advanced Threat Protection minimum requirements, network and data storage, endpoint, endpoint configuration, deployment channel search.product: eADQiWindows 10XVcnh -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: iaanw --- diff --git a/windows/keep-secure/modify-an-object-label.md b/windows/keep-secure/modify-an-object-label.md index a984a42a33..fecfb339d8 100644 --- a/windows/keep-secure/modify-an-object-label.md +++ b/windows/keep-secure/modify-an-object-label.md @@ -2,7 +2,7 @@ title: Modify an object label (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Modify an object label security policy setting. ms.assetid: 3e5a97dd-d363-43a8-ae80-452e866ebfd5 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/modify-firmware-environment-values.md b/windows/keep-secure/modify-firmware-environment-values.md index 2dcc1d8dfc..e4f6b85eb1 100644 --- a/windows/keep-secure/modify-firmware-environment-values.md +++ b/windows/keep-secure/modify-firmware-environment-values.md @@ -2,7 +2,7 @@ title: Modify firmware environment values (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Modify firmware environment values security policy setting. ms.assetid: 80bad5c4-d9eb-4e3a-a5dc-dcb742b83fca -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/monitor-application-usage-with-applocker.md b/windows/keep-secure/monitor-application-usage-with-applocker.md index 14b94f4745..87ead686b6 100644 --- a/windows/keep-secure/monitor-application-usage-with-applocker.md +++ b/windows/keep-secure/monitor-application-usage-with-applocker.md @@ -2,7 +2,7 @@ title: Monitor app usage with AppLocker (Windows 10) description: This topic for IT professionals describes how to monitor app usage when AppLocker policies are applied. ms.assetid: 0516da6e-ebe4-45b4-a97b-31daba96d1cf -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/monitor-central-access-policy-and-rule-definitions.md b/windows/keep-secure/monitor-central-access-policy-and-rule-definitions.md index 11e4efc2be..6904612d1c 100644 --- a/windows/keep-secure/monitor-central-access-policy-and-rule-definitions.md +++ b/windows/keep-secure/monitor-central-access-policy-and-rule-definitions.md @@ -2,7 +2,7 @@ title: Monitor central access policy and rule definitions (Windows 10) description: This topic for the IT professional describes how to monitor changes to central access policy and central access rule definitions when you use advanced security auditing options to monitor dynamic access control objects. ms.assetid: 553f98a6-7606-4518-a3c5-347a33105130 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/monitor-claim-types.md b/windows/keep-secure/monitor-claim-types.md index 9220126e6c..fcbaaa93b0 100644 --- a/windows/keep-secure/monitor-claim-types.md +++ b/windows/keep-secure/monitor-claim-types.md @@ -2,7 +2,7 @@ title: Monitor claim types (Windows 10) description: This topic for the IT professional describes how to monitor changes to claim types that are associated with dynamic access control when you are using advanced security auditing options. ms.assetid: 426084da-4eef-44af-aeec-e7ab4d4e2439 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md index 67ff38e86d..8babe1f172 100644 --- a/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md @@ -3,9 +3,10 @@ title: Monitor Windows Defender ATP onboarding description: Monitor the onboarding of the Windows Defender ATP service to ensure your endpoints are correctly configured and are sending telemetry reports. keywords: monitor onboarding, monitor Windows Defender ATP onboarding, monitor Windows Defender Advanced Threat Protection onboarding search.product: eADQiWindows 10XVcnh -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: mjcaparas --- diff --git a/windows/keep-secure/monitor-resource-attribute-definitions.md b/windows/keep-secure/monitor-resource-attribute-definitions.md index 42bd9b783e..75bff821fe 100644 --- a/windows/keep-secure/monitor-resource-attribute-definitions.md +++ b/windows/keep-secure/monitor-resource-attribute-definitions.md @@ -2,7 +2,7 @@ title: Monitor resource attribute definitions (Windows 10) description: This topic for the IT professional describes how to monitor changes to resource attribute definitions when you are using advanced security auditing options to monitor dynamic access control objects. ms.assetid: aace34b0-123a-4b83-9e09-f269220e79de -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/monitor-the-central-access-policies-associated-with-files-and-folders.md b/windows/keep-secure/monitor-the-central-access-policies-associated-with-files-and-folders.md index db6155e24b..74e926c90b 100644 --- a/windows/keep-secure/monitor-the-central-access-policies-associated-with-files-and-folders.md +++ b/windows/keep-secure/monitor-the-central-access-policies-associated-with-files-and-folders.md @@ -2,7 +2,7 @@ title: Monitor the central access policies associated with files and folders (Windows 10) description: This topic for the IT professional describes how to monitor changes to the central access policies that are associated with files and folders when you are using advanced security auditing options to monitor dynamic access control objects. ms.assetid: 2ea8fc23-b3ac-432f-87b0-6a16506e8eed -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/monitor-the-central-access-policies-that-apply-on-a-file-server.md b/windows/keep-secure/monitor-the-central-access-policies-that-apply-on-a-file-server.md index aeee1c4b35..4e21c32c36 100644 --- a/windows/keep-secure/monitor-the-central-access-policies-that-apply-on-a-file-server.md +++ b/windows/keep-secure/monitor-the-central-access-policies-that-apply-on-a-file-server.md @@ -2,7 +2,7 @@ title: Monitor the central access policies that apply on a file server (Windows 10) description: This topic for the IT professional describes how to monitor changes to the central access policies that apply to a file server when using advanced security auditing options to monitor dynamic access control objects. ms.assetid: 126b051e-c20d-41f1-b42f-6cff24dcf20c -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/monitor-the-resource-attributes-on-files-and-folders.md b/windows/keep-secure/monitor-the-resource-attributes-on-files-and-folders.md index fd2edb8b75..5849cc955c 100644 --- a/windows/keep-secure/monitor-the-resource-attributes-on-files-and-folders.md +++ b/windows/keep-secure/monitor-the-resource-attributes-on-files-and-folders.md @@ -2,7 +2,7 @@ title: Monitor the resource attributes on files and folders (Windows 10) description: This topic for the IT professional describes how to monitor attempts to change settings to the resource attributes on files when you are using advanced security auditing options to monitor dynamic access control objects. ms.assetid: 4944097b-320f-44c7-88ed-bf55946a358b -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/monitor-the-use-of-removable-storage-devices.md b/windows/keep-secure/monitor-the-use-of-removable-storage-devices.md index c850719ed9..7665d0dddc 100644 --- a/windows/keep-secure/monitor-the-use-of-removable-storage-devices.md +++ b/windows/keep-secure/monitor-the-use-of-removable-storage-devices.md @@ -2,7 +2,7 @@ title: Monitor the use of removable storage devices (Windows 10) description: This topic for the IT professional describes how to monitor attempts to use removable storage devices to access network resources. It describes how to use advanced security auditing options to monitor dynamic access control objects. ms.assetid: b0a9e4a5-b7ff-41c6-96ff-0228d4ba5da8 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/monitor-user-and-device-claims-during-sign-in.md b/windows/keep-secure/monitor-user-and-device-claims-during-sign-in.md index 8e767cf028..f95697b152 100644 --- a/windows/keep-secure/monitor-user-and-device-claims-during-sign-in.md +++ b/windows/keep-secure/monitor-user-and-device-claims-during-sign-in.md @@ -2,7 +2,7 @@ title: Monitor user and device claims during sign-in (Windows 10) description: This topic for the IT professional describes how to monitor user and device claims that are associated with a user’s security token when you are using advanced security auditing options to monitor dynamic access control objects. ms.assetid: 71796ea9-5fe4-4183-8475-805c3c1f319f -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/network-access-allow-anonymous-sidname-translation.md b/windows/keep-secure/network-access-allow-anonymous-sidname-translation.md index 6c14b5a06f..206c76f7fc 100644 --- a/windows/keep-secure/network-access-allow-anonymous-sidname-translation.md +++ b/windows/keep-secure/network-access-allow-anonymous-sidname-translation.md @@ -2,7 +2,7 @@ title: Network access Allow anonymous SID/Name translation (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network access Allow anonymous SID/Name translation security policy setting. ms.assetid: 0144477f-22a6-4d06-b70a-9c9c2196e99e -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md b/windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md index 52eb452b76..7de439ad10 100644 --- a/windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md +++ b/windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md @@ -2,7 +2,7 @@ title: Network access Do not allow anonymous enumeration of SAM accounts and shares (Windows 10) description: Describes the best practices, location, values, and security considerations for the Network access Do not allow anonymous enumeration of SAM accounts and shares security policy setting. ms.assetid: 3686788d-4cc7-4222-9163-cbc7c3362d73 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md b/windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md index 20f6455173..1a8d592782 100644 --- a/windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md +++ b/windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md @@ -2,7 +2,7 @@ title: Network access Do not allow anonymous enumeration of SAM accounts (Windows 10) description: Describes the best practices, location, values, and security considerations for the Network access Do not allow anonymous enumeration of SAM accounts security policy setting. ms.assetid: 6ee25b33-ad43-4097-b031-7be680f64c7c -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md b/windows/keep-secure/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md index ec12a8c647..a60b14af97 100644 --- a/windows/keep-secure/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md +++ b/windows/keep-secure/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md @@ -2,7 +2,7 @@ title: Network access Do not allow storage of passwords and credentials for network authentication (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network access Do not allow storage of passwords and credentials for network authentication security policy setting. ms.assetid: b9b64360-36ea-40fa-b795-2d6558c46563 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/network-access-let-everyone-permissions-apply-to-anonymous-users.md b/windows/keep-secure/network-access-let-everyone-permissions-apply-to-anonymous-users.md index eedd57751a..02f1530efb 100644 --- a/windows/keep-secure/network-access-let-everyone-permissions-apply-to-anonymous-users.md +++ b/windows/keep-secure/network-access-let-everyone-permissions-apply-to-anonymous-users.md @@ -2,7 +2,7 @@ title: Network access Let Everyone permissions apply to anonymous users (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network access Let Everyone permissions apply to anonymous users security policy setting. ms.assetid: cdbc5159-9173-497e-b46b-7325f4256353 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/network-access-named-pipes-that-can-be-accessed-anonymously.md b/windows/keep-secure/network-access-named-pipes-that-can-be-accessed-anonymously.md index ab8eff2298..68f545297d 100644 --- a/windows/keep-secure/network-access-named-pipes-that-can-be-accessed-anonymously.md +++ b/windows/keep-secure/network-access-named-pipes-that-can-be-accessed-anonymously.md @@ -2,7 +2,7 @@ title: Network access Named Pipes that can be accessed anonymously (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network access Named Pipes that can be accessed anonymously security policy setting. ms.assetid: 8897d2a4-813e-4d2b-8518-fcee71e1cf2c -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/network-access-remotely-accessible-registry-paths-and-subpaths.md b/windows/keep-secure/network-access-remotely-accessible-registry-paths-and-subpaths.md index d7a01b9e6e..3dc22f67e2 100644 --- a/windows/keep-secure/network-access-remotely-accessible-registry-paths-and-subpaths.md +++ b/windows/keep-secure/network-access-remotely-accessible-registry-paths-and-subpaths.md @@ -2,7 +2,7 @@ title: Network access Remotely accessible registry paths and subpaths (Windows 10) description: Describes the best practices, location, values, and security considerations for the Network access Remotely accessible registry paths and subpaths security policy setting. ms.assetid: 3fcbbf70-a002-4f85-8e86-8dabad21928e -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/network-access-remotely-accessible-registry-paths.md b/windows/keep-secure/network-access-remotely-accessible-registry-paths.md index 86fd1783e9..88c2340130 100644 --- a/windows/keep-secure/network-access-remotely-accessible-registry-paths.md +++ b/windows/keep-secure/network-access-remotely-accessible-registry-paths.md @@ -2,7 +2,7 @@ title: Network access Remotely accessible registry paths (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network access Remotely accessible registry paths security policy setting. ms.assetid: 977f86ea-864f-4f1b-9756-22220efce0bd -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md b/windows/keep-secure/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md index 84be70c08b..75a2e71242 100644 --- a/windows/keep-secure/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md +++ b/windows/keep-secure/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md @@ -2,7 +2,7 @@ title: Network access Restrict anonymous access to Named Pipes and Shares (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network access Restrict anonymous access to Named Pipes and Shares security policy setting. ms.assetid: e66cd708-7322-4d49-9b57-1bf8ec7a4c10 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/network-access-shares-that-can-be-accessed-anonymously.md b/windows/keep-secure/network-access-shares-that-can-be-accessed-anonymously.md index b4505320e4..4f53f77bdc 100644 --- a/windows/keep-secure/network-access-shares-that-can-be-accessed-anonymously.md +++ b/windows/keep-secure/network-access-shares-that-can-be-accessed-anonymously.md @@ -2,7 +2,7 @@ title: Network access Shares that can be accessed anonymously (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network access Shares that can be accessed anonymously security policy setting. ms.assetid: f3e4b919-8279-4972-b415-5f815e2f0a1a -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/network-access-sharing-and-security-model-for-local-accounts.md b/windows/keep-secure/network-access-sharing-and-security-model-for-local-accounts.md index fee079071d..aab32aedb6 100644 --- a/windows/keep-secure/network-access-sharing-and-security-model-for-local-accounts.md +++ b/windows/keep-secure/network-access-sharing-and-security-model-for-local-accounts.md @@ -2,7 +2,7 @@ title: Network access Sharing and security model for local accounts (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network access Sharing and security model for local accounts security policy setting. ms.assetid: 0b3d703c-ea27-488f-8f59-b345af75b994 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/network-list-manager-policies.md b/windows/keep-secure/network-list-manager-policies.md index 11de5e4da7..1488ba7052 100644 --- a/windows/keep-secure/network-list-manager-policies.md +++ b/windows/keep-secure/network-list-manager-policies.md @@ -2,7 +2,7 @@ title: Network List Manager policies (Windows 10) description: Network List Manager policies are security settings that you can use to configure different aspects of how networks are listed and displayed on one device or on many devices. ms.assetid: bd8109d4-b07c-4beb-a9a6-affae2ba2fda -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md b/windows/keep-secure/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md index 929606cb16..0c3458656e 100644 --- a/windows/keep-secure/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md +++ b/windows/keep-secure/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md @@ -2,7 +2,7 @@ title: Network security Allow Local System to use computer identity for NTLM (Windows 10) description: Describes the location, values, policy management, and security considerations for the Network security Allow Local System to use computer identity for NTLM security policy setting. ms.assetid: c46a658d-b7a4-4139-b7ea-b9268c240053 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/network-security-allow-localsystem-null-session-fallback.md b/windows/keep-secure/network-security-allow-localsystem-null-session-fallback.md index 34b487bba3..405f149efa 100644 --- a/windows/keep-secure/network-security-allow-localsystem-null-session-fallback.md +++ b/windows/keep-secure/network-security-allow-localsystem-null-session-fallback.md @@ -2,7 +2,7 @@ title: Network security Allow LocalSystem NULL session fallback (Windows 10) description: Describes the best practices, location, values, and security considerations for the Network security Allow LocalSystem NULL session fallback security policy setting. ms.assetid: 5b72edaa-bec7-4572-b6f0-648fc38f5395 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md b/windows/keep-secure/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md index a381d1388c..fe460ccefd 100644 --- a/windows/keep-secure/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md +++ b/windows/keep-secure/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md @@ -2,7 +2,7 @@ title: Network security Allow PKU2U authentication requests to this computer to use online identities (Windows 10) description: Describes the best practices, location, and values for the Network Security Allow PKU2U authentication requests to this computer to use online identities security policy setting. ms.assetid: e04a854e-d94d-4306-9fb3-56e9bd7bb926 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/network-security-configure-encryption-types-allowed-for-kerberos.md b/windows/keep-secure/network-security-configure-encryption-types-allowed-for-kerberos.md index 7ca22f98c0..bcbe56a0ef 100644 --- a/windows/keep-secure/network-security-configure-encryption-types-allowed-for-kerberos.md +++ b/windows/keep-secure/network-security-configure-encryption-types-allowed-for-kerberos.md @@ -2,7 +2,7 @@ title: Network security Configure encryption types allowed for Kerberos Win7 only (Windows 10) description: Describes the best practices, location, values and security considerations for the Network security Configure encryption types allowed for Kerberos Win7 only security policy setting. ms.assetid: 303d32cc-415b-44ba-96c0-133934046ece -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md b/windows/keep-secure/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md index 95b335005c..11984a8b59 100644 --- a/windows/keep-secure/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md +++ b/windows/keep-secure/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md @@ -2,7 +2,7 @@ title: Network security Do not store LAN Manager hash value on next password change (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network security Do not store LAN Manager hash value on next password change security policy setting. ms.assetid: 6452b268-e5ba-4889-9d38-db28f919af51 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/network-security-force-logoff-when-logon-hours-expire.md b/windows/keep-secure/network-security-force-logoff-when-logon-hours-expire.md index f6dd03a829..a302a70695 100644 --- a/windows/keep-secure/network-security-force-logoff-when-logon-hours-expire.md +++ b/windows/keep-secure/network-security-force-logoff-when-logon-hours-expire.md @@ -2,7 +2,7 @@ title: Network security Force logoff when logon hours expire (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network security Force logoff when logon hours expire security policy setting. ms.assetid: 64d5dde4-58e4-4217-b2c4-73bd554ec926 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/network-security-lan-manager-authentication-level.md b/windows/keep-secure/network-security-lan-manager-authentication-level.md index 5d8a5343aa..3ae2b1240e 100644 --- a/windows/keep-secure/network-security-lan-manager-authentication-level.md +++ b/windows/keep-secure/network-security-lan-manager-authentication-level.md @@ -2,7 +2,7 @@ title: Network security LAN Manager authentication level (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network security LAN Manager authentication level security policy setting. ms.assetid: bbe1a98c-420a-41e7-9d3c-3a2fe0f1843e -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/network-security-ldap-client-signing-requirements.md b/windows/keep-secure/network-security-ldap-client-signing-requirements.md index 5207e6e65f..158b64ed3c 100644 --- a/windows/keep-secure/network-security-ldap-client-signing-requirements.md +++ b/windows/keep-secure/network-security-ldap-client-signing-requirements.md @@ -2,7 +2,7 @@ title: Network security LDAP client signing requirements (Windows 10) description: This security policy reference topic for the IT professional describes the best practices, location, values, policy management and security considerations for this policy setting. ms.assetid: 38b35489-eb5b-4035-bc87-df63de50509c -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md b/windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md index ba6527767f..b9a0e71329 100644 --- a/windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md +++ b/windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md @@ -2,7 +2,7 @@ title: Network security Minimum session security for NTLM SSP based (including secure RPC) clients (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network security Minimum session security for NTLM SSP based (including secure RPC) clients security policy setting. ms.assetid: 89903de8-23d0-4e0f-9bef-c00cb7aebf00 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md b/windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md index 6bd65a6591..752b9c97c1 100644 --- a/windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md +++ b/windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md @@ -2,7 +2,7 @@ title: Network security Minimum session security for NTLM SSP based (including secure RPC) servers (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Network security Minimum session security for NTLM SSP based (including secure RPC) servers security policy setting. ms.assetid: c6a60c1b-bc8d-4d02-9481-f847a411b4fc -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md b/windows/keep-secure/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md index ca5c6d20da..74c9b41100 100644 --- a/windows/keep-secure/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md +++ b/windows/keep-secure/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md @@ -2,7 +2,7 @@ title: Network security Restrict NTLM Add remote server exceptions for NTLM authentication (Windows 10) description: Describes the best practices, location, values, management aspects, and security considerations for the Network security Restrict NTLM Add remote server exceptions for NTLM authentication security policy setting. ms.assetid: 9b017399-0a54-4580-bfae-614c2beda3a1 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md b/windows/keep-secure/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md index 8a29a1cbad..e16e7c0ff3 100644 --- a/windows/keep-secure/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md +++ b/windows/keep-secure/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md @@ -2,7 +2,7 @@ title: Network security Restrict NTLM Add server exceptions in this domain (Windows 10) description: Describes the best practices, location, values, management aspects, and security considerations for the Network security Restrict NTLM Add server exceptions in this domain security policy setting. ms.assetid: 2f981b68-6aa7-4dd9-b53d-d88551277cc0 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md b/windows/keep-secure/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md index 30716f504d..f5b4bd4032 100644 --- a/windows/keep-secure/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md +++ b/windows/keep-secure/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md @@ -2,7 +2,7 @@ title: Network security Restrict NTLM Audit incoming NTLM traffic (Windows 10) description: Describes the best practices, location, values, management aspects, and security considerations for the Network Security Restrict NTLM Audit incoming NTLM traffic security policy setting. ms.assetid: 37e380c2-22e1-44cd-9993-e12815b845cf -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md b/windows/keep-secure/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md index 4bda1da37a..c4254e5036 100644 --- a/windows/keep-secure/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md +++ b/windows/keep-secure/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md @@ -2,7 +2,7 @@ title: Network security Restrict NTLM Audit NTLM authentication in this domain (Windows 10) description: Describes the best practices, location, values, management aspects, and security considerations for the Network Security Restrict NTLM Audit NTLM authentication in this domain security policy setting. ms.assetid: 33183ef9-53b5-4258-8605-73dc46335e6e -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/network-security-restrict-ntlm-incoming-ntlm-traffic.md b/windows/keep-secure/network-security-restrict-ntlm-incoming-ntlm-traffic.md index 270051f5d3..fba51b1a73 100644 --- a/windows/keep-secure/network-security-restrict-ntlm-incoming-ntlm-traffic.md +++ b/windows/keep-secure/network-security-restrict-ntlm-incoming-ntlm-traffic.md @@ -2,7 +2,7 @@ title: Network security Restrict NTLM Incoming NTLM traffic (Windows 10) description: Describes the best practices, location, values, management aspects, and security considerations for the Network Security Restrict NTLM Incoming NTLM traffic security policy setting. ms.assetid: c0eff7d3-ed59-4004-908a-2205295fefb8 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md b/windows/keep-secure/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md index 8389b3ad72..407c4b9976 100644 --- a/windows/keep-secure/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md +++ b/windows/keep-secure/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md @@ -2,7 +2,7 @@ title: Network security Restrict NTLM NTLM authentication in this domain (Windows 10) description: Describes the best practices, location, values, management aspects, and security considerations for the Network Security Restrict NTLM NTLM authentication in this domain security policy setting. ms.assetid: 4c7884e9-cc11-4402-96b6-89c77dc908f8 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md b/windows/keep-secure/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md index 439657d395..896cdbadc1 100644 --- a/windows/keep-secure/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md +++ b/windows/keep-secure/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md @@ -2,7 +2,7 @@ title: Network security Restrict NTLM Outgoing NTLM traffic to remote servers (Windows 10) description: Describes the best practices, location, values, management aspects, and security considerations for the Network Security Restrict NTLM Outgoing NTLM traffic to remote servers security policy setting. ms.assetid: 63437a90-764b-4f06-aed8-a4a26cf81bd1 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md b/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md index baf6178433..eaaa736c69 100644 --- a/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md @@ -3,9 +3,10 @@ title: Onboard endpoints and set up the Windows Defender ATP user access description: Set up user access in Azure Active Directory and use Group Policy, SCCM, or do manual registry changes to onboard endpoints to the service. keywords: onboarding, windows defender advanced threat protection onboarding, windows atp onboarding, sccm, group policy search.product: eADQiWindows 10XVcnh -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: iaanw --- diff --git a/windows/keep-secure/optimize-applocker-performance.md b/windows/keep-secure/optimize-applocker-performance.md index cdd61ef5e2..ff8f099f2d 100644 --- a/windows/keep-secure/optimize-applocker-performance.md +++ b/windows/keep-secure/optimize-applocker-performance.md @@ -2,7 +2,7 @@ title: Optimize AppLocker performance (Windows 10) description: This topic for IT professionals describes how to optimize AppLocker policy enforcement. ms.assetid: a20efa20-bc98-40fe-bd81-28ec4905e0f6 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/overview-create-edp-policy.md b/windows/keep-secure/overview-create-edp-policy.md index 24e6c6a647..0ca5b7cbd1 100644 --- a/windows/keep-secure/overview-create-edp-policy.md +++ b/windows/keep-secure/overview-create-edp-policy.md @@ -2,9 +2,10 @@ title: Create an enterprise data protection (EDP) policy (Windows 10) description: Microsoft Intune and System Center Configuration Manager (version 1511 or later) helps you create and deploy your enterprise data protection (EDP) policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network. ms.assetid: d2059e74-94bd-4e54-ab59-1a7b9b52bdc6 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library +ms.pagetype: security author: eross-msft --- diff --git a/windows/keep-secure/packaged-apps-and-packaged-app-installer-rules-in-applocker.md b/windows/keep-secure/packaged-apps-and-packaged-app-installer-rules-in-applocker.md index db85e986ec..b17006c05a 100644 --- a/windows/keep-secure/packaged-apps-and-packaged-app-installer-rules-in-applocker.md +++ b/windows/keep-secure/packaged-apps-and-packaged-app-installer-rules-in-applocker.md @@ -2,7 +2,7 @@ title: Packaged apps and packaged app installer rules in AppLocker (Windows 10) description: This topic explains the AppLocker rule collection for packaged app installers and packaged apps. ms.assetid: 8fd44d08-a0c2-4c5b-a91f-5cb9989f971d -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/passport-event-300.md b/windows/keep-secure/passport-event-300.md index 1d055b34c7..9a7c694ae0 100644 --- a/windows/keep-secure/passport-event-300.md +++ b/windows/keep-secure/passport-event-300.md @@ -2,8 +2,8 @@ title: Event ID 300 - Passport successfully created (Windows 10) description: This event is created when a Microsoft Passport for Enterprise is successfully created and registered with Azure Active Directory (Azure AD). ms.assetid: 0DD59E75-1C5F-4CC6-BB0E-71C83884FF04 -keywords: ["ngc"] -ms.prod: W10 +keywords: ngc +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/password-must-meet-complexity-requirements.md b/windows/keep-secure/password-must-meet-complexity-requirements.md index c8b513828e..d51142a117 100644 --- a/windows/keep-secure/password-must-meet-complexity-requirements.md +++ b/windows/keep-secure/password-must-meet-complexity-requirements.md @@ -2,7 +2,7 @@ title: Password must meet complexity requirements (Windows 10) description: Describes the best practices, location, values, and security considerations for the Password must meet complexity requirements security policy setting. ms.assetid: 94482ae3-9dda-42df-9782-2f66196e6afe -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/password-policy.md b/windows/keep-secure/password-policy.md index fd3d56e268..4198fac995 100644 --- a/windows/keep-secure/password-policy.md +++ b/windows/keep-secure/password-policy.md @@ -2,7 +2,7 @@ title: Password Policy (Windows 10) description: An overview of password policies for Windows and links to information for each policy setting. ms.assetid: aec1220d-a875-4575-9050-f02f9c54a3b6 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/perform-volume-maintenance-tasks.md b/windows/keep-secure/perform-volume-maintenance-tasks.md index 4a7f305290..dae56942a1 100644 --- a/windows/keep-secure/perform-volume-maintenance-tasks.md +++ b/windows/keep-secure/perform-volume-maintenance-tasks.md @@ -2,7 +2,7 @@ title: Perform volume maintenance tasks (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Perform volume maintenance tasks security policy setting. ms.assetid: b6990813-3898-43e2-8221-c9c06d893244 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/plan-for-applocker-policy-management.md b/windows/keep-secure/plan-for-applocker-policy-management.md index 0fa131561e..96d65e5c32 100644 --- a/windows/keep-secure/plan-for-applocker-policy-management.md +++ b/windows/keep-secure/plan-for-applocker-policy-management.md @@ -2,7 +2,7 @@ title: Plan for AppLocker policy management (Windows 10) description: This topic for describes the decisions you need to make to establish the processes for managing and maintaining AppLocker policies. ms.assetid: dccc196f-6ae0-4ae4-853a-a3312b18751b -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/planning-and-deploying-advanced-security-audit-policies.md b/windows/keep-secure/planning-and-deploying-advanced-security-audit-policies.md index c9a1917ba3..1fa912d181 100644 --- a/windows/keep-secure/planning-and-deploying-advanced-security-audit-policies.md +++ b/windows/keep-secure/planning-and-deploying-advanced-security-audit-policies.md @@ -2,7 +2,7 @@ title: Planning and deploying advanced security audit policies (Windows 10) description: This topic for the IT professional explains the options that security policy planners must consider and the tasks they must complete to deploy an effective security audit policy in a network that includes advanced security audit policies. ms.assetid: 7428e1db-aba8-407b-a39e-509671e5a442 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md index b5dae385ac..4eaf0224ec 100644 --- a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md @@ -3,9 +3,10 @@ title: Windows Defender Advanced Threat Protection portal overview description: Use the Windows Defender ATP portal to monitor your enterprise network and assist in responding to alerts to potential advanced persistent threat (APT) activity or data breaches. keywords: Windows Defender ATP portal, portal, cybersecurity threat intelligence, dashboard, alerts queue, machines view, preferences setup, client onboarding, advanced attacks search.product: eADQiWindows 10XVcnh -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: DulceMV --- diff --git a/windows/keep-secure/prepare-people-to-use-microsoft-passport.md b/windows/keep-secure/prepare-people-to-use-microsoft-passport.md index 74cebb3914..d377aafd3e 100644 --- a/windows/keep-secure/prepare-people-to-use-microsoft-passport.md +++ b/windows/keep-secure/prepare-people-to-use-microsoft-passport.md @@ -3,7 +3,7 @@ title: Prepare people to use Microsoft Passport (Windows 10) description: When you set a policy to require Microsoft Passport in the workplace, you will want to prepare people in your organization. ms.assetid: 5270B416-CE31-4DD9-862D-6C22A2AE508B keywords: identity, PIN, biometric, Hello -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies.md b/windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies.md index 3c5e402383..c30af5a4c1 100644 --- a/windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies.md +++ b/windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies.md @@ -2,7 +2,7 @@ title: Prepare your organization for BitLocker Planning and policies (Windows 10) description: This topic for the IT professional explains how can you plan your BitLocker deployment. ms.assetid: 6e3593b5-4e8a-40ac-808a-3fdbc948059d -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/profile-single-process.md b/windows/keep-secure/profile-single-process.md index bcb68afa86..0dce3bdffe 100644 --- a/windows/keep-secure/profile-single-process.md +++ b/windows/keep-secure/profile-single-process.md @@ -2,7 +2,7 @@ title: Profile single process (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Profile single process security policy setting. ms.assetid: c0963de4-4f5e-430e-bfcd-dfd68e66a075 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/profile-system-performance.md b/windows/keep-secure/profile-system-performance.md index 5166f4de6f..d7b5f3b8fc 100644 --- a/windows/keep-secure/profile-system-performance.md +++ b/windows/keep-secure/profile-system-performance.md @@ -2,7 +2,7 @@ title: Profile system performance (Windows 10) description: This security policy reference topic for the IT professional describes the best practices, location, values, policy management, and security considerations for the Profile system performance security policy setting. ms.assetid: ffabc3c5-9206-4105-94ea-84f597a54b2e -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/protect-bitlocker-from-pre-boot-attacks.md b/windows/keep-secure/protect-bitlocker-from-pre-boot-attacks.md index 1b1c4370f3..197d906dd6 100644 --- a/windows/keep-secure/protect-bitlocker-from-pre-boot-attacks.md +++ b/windows/keep-secure/protect-bitlocker-from-pre-boot-attacks.md @@ -2,7 +2,7 @@ title: Protect BitLocker from pre-boot attacks (Windows 10) description: This detailed guide will help you understand the circumstances under which the use of pre-boot authentication is recommended for devices running Windows 10, Windows 8.1, Windows 8, or Windows 7; and when it can be safely omitted from a device’s configuration. ms.assetid: 24d19988-fc79-4c45-b392-b39cba4ec86b -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/protect-enterprise-data-using-edp.md b/windows/keep-secure/protect-enterprise-data-using-edp.md index d647af4367..e3da331f91 100644 --- a/windows/keep-secure/protect-enterprise-data-using-edp.md +++ b/windows/keep-secure/protect-enterprise-data-using-edp.md @@ -2,10 +2,11 @@ title: Protect your enterprise data using enterprise data protection (EDP) (Windows 10) description: With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control. ms.assetid: 6cca0119-5954-4757-b2bc-e0ea4d2c7032 -keywords: ["EDP", "Enterprise Data Protection"] -ms.prod: W10 +keywords: EDP, Enterprise Data Protection +ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library +ms.pagetype: security author: eross-msft --- diff --git a/windows/keep-secure/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md b/windows/keep-secure/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md index 2550941ba3..61313be105 100644 --- a/windows/keep-secure/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md +++ b/windows/keep-secure/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md @@ -3,10 +3,10 @@ title: Control the health of Windows 10-based devices (Windows 10) description: This article details an end-to-end solution that helps you protect high-value assets by enforcing, controlling, and reporting the health of Windows 10-based devices. ms.assetid: 45DB1C41-C35D-43C9-A274-3AD5F31FE873 keywords: security, BYOD, malware, device health attestation, mobile -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -ms.pagetype: security; devices +ms.pagetype: security, devices author: arnaudjumelet --- diff --git a/windows/keep-secure/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md b/windows/keep-secure/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md index fc092b8a95..aaf71600b1 100644 --- a/windows/keep-secure/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md +++ b/windows/keep-secure/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md @@ -2,7 +2,7 @@ title: Protecting cluster shared volumes and storage area networks with BitLocker (Windows 10) description: This topic for IT pros describes how to protect CSVs and SANs with BitLocker. ms.assetid: ecd25a10-42c7-4d31-8a7e-ea52c8ebc092 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/recovery-console-allow-automatic-administrative-logon.md b/windows/keep-secure/recovery-console-allow-automatic-administrative-logon.md index 394b4421db..4ef6ba5277 100644 --- a/windows/keep-secure/recovery-console-allow-automatic-administrative-logon.md +++ b/windows/keep-secure/recovery-console-allow-automatic-administrative-logon.md @@ -2,7 +2,7 @@ title: Recovery console Allow automatic administrative logon (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Recovery console Allow automatic administrative logon security policy setting. ms.assetid: be2498fc-48f4-43f3-ad09-74664e45e596 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md b/windows/keep-secure/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md index 23aad36087..d8945335fa 100644 --- a/windows/keep-secure/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md +++ b/windows/keep-secure/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md @@ -2,7 +2,7 @@ title: Recovery console Allow floppy copy and access to all drives and folders (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Recovery console Allow floppy copy and access to all drives and folders security policy setting. ms.assetid: a5b4ac0c-f33d-42b5-a866-72afa7cbd0bd -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/refresh-an-applocker-policy.md b/windows/keep-secure/refresh-an-applocker-policy.md index fd227910c6..719bfb599b 100644 --- a/windows/keep-secure/refresh-an-applocker-policy.md +++ b/windows/keep-secure/refresh-an-applocker-policy.md @@ -2,7 +2,7 @@ title: Refresh an AppLocker policy (Windows 10) description: This topic for IT professionals describes the steps to force an update for an AppLocker policy. ms.assetid: 3f24fcbc-3926-46b9-a1a2-dd036edab8a9 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/registry-global-object-access-auditing.md b/windows/keep-secure/registry-global-object-access-auditing.md index 087c5f60fc..b734cec46b 100644 --- a/windows/keep-secure/registry-global-object-access-auditing.md +++ b/windows/keep-secure/registry-global-object-access-auditing.md @@ -2,7 +2,7 @@ title: Registry (Global Object Access Auditing) (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Registry (Global Object Access Auditing), which enables you to configure a global system access control list (SACL) on the registry of a computer. ms.assetid: 953bb1c1-3f76-43be-ba17-4aed2304f578 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/remove-computer-from-docking-station.md b/windows/keep-secure/remove-computer-from-docking-station.md index 06949c5258..ee3b81a7d3 100644 --- a/windows/keep-secure/remove-computer-from-docking-station.md +++ b/windows/keep-secure/remove-computer-from-docking-station.md @@ -2,7 +2,7 @@ title: Remove computer from docking station (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Remove computer from docking station security policy setting. ms.assetid: 229a385a-a862-4973-899a-413b1b5b6c30 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/replace-a-process-level-token.md b/windows/keep-secure/replace-a-process-level-token.md index 0beaf15c90..5361f2a589 100644 --- a/windows/keep-secure/replace-a-process-level-token.md +++ b/windows/keep-secure/replace-a-process-level-token.md @@ -2,7 +2,7 @@ title: Replace a process level token (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Replace a process level token security policy setting. ms.assetid: 5add02db-6339-489e-ba21-ccc3ccbe8745 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/requirements-for-deploying-applocker-policies.md b/windows/keep-secure/requirements-for-deploying-applocker-policies.md index f1608ee829..e3b6c29aa7 100644 --- a/windows/keep-secure/requirements-for-deploying-applocker-policies.md +++ b/windows/keep-secure/requirements-for-deploying-applocker-policies.md @@ -2,7 +2,7 @@ title: Requirements for deploying AppLocker policies (Windows 10) description: This deployment topic for the IT professional lists the requirements that you need to consider before you deploy AppLocker policies. ms.assetid: 3e55bda2-3cd7-42c7-bad3-c7dfbe193d48 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/requirements-to-use-applocker.md b/windows/keep-secure/requirements-to-use-applocker.md index f9c5f24fae..6389eb2755 100644 --- a/windows/keep-secure/requirements-to-use-applocker.md +++ b/windows/keep-secure/requirements-to-use-applocker.md @@ -2,7 +2,7 @@ title: Requirements to use AppLocker (Windows 10) description: This topic for the IT professional lists software requirements to use AppLocker on the supported Windows operating systems. ms.assetid: dc380535-071e-4794-8f9d-e5d1858156f0 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/reset-account-lockout-counter-after.md b/windows/keep-secure/reset-account-lockout-counter-after.md index ebefbb2d0c..d3e6f545ed 100644 --- a/windows/keep-secure/reset-account-lockout-counter-after.md +++ b/windows/keep-secure/reset-account-lockout-counter-after.md @@ -2,7 +2,7 @@ title: Reset account lockout counter after (Windows 10) description: Describes the best practices, location, values, and security considerations for the Reset account lockout counter after security policy setting. ms.assetid: d5ccf6dd-5ba7-44a9-8e0b-c478d8b1442c -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/restore-files-and-directories.md b/windows/keep-secure/restore-files-and-directories.md index b428c37092..e8bb7e6f85 100644 --- a/windows/keep-secure/restore-files-and-directories.md +++ b/windows/keep-secure/restore-files-and-directories.md @@ -2,7 +2,7 @@ title: Restore files and directories (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Restore files and directories security policy setting. ms.assetid: c673c0fa-6f49-4edd-8c1f-c5e8513f701d -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md b/windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md index 9eb59d5dc1..9e6debeb0f 100644 --- a/windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md +++ b/windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md @@ -4,9 +4,10 @@ description: IT professionals can run a scan using the command line in Windows D keywords: scan, command line, mpcmdrun, defender search.product: eADQiWindows 10XVcnh ms.pagetype: security -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library +ms.pagetype: security author: mjcaparas --- diff --git a/windows/keep-secure/run-the-automatically-generate-rules-wizard.md b/windows/keep-secure/run-the-automatically-generate-rules-wizard.md index 12a5620d21..565f6331da 100644 --- a/windows/keep-secure/run-the-automatically-generate-rules-wizard.md +++ b/windows/keep-secure/run-the-automatically-generate-rules-wizard.md @@ -2,7 +2,7 @@ title: Run the Automatically Generate Rules wizard (Windows 10) description: This topic for IT professionals describes steps to run the wizard to create AppLocker rules on a reference device. ms.assetid: 8cad1e14-d5b2-437c-8f88-70cffd7b3d8e -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/script-rules-in-applocker.md b/windows/keep-secure/script-rules-in-applocker.md index 10efd57b91..6fd0ec9196 100644 --- a/windows/keep-secure/script-rules-in-applocker.md +++ b/windows/keep-secure/script-rules-in-applocker.md @@ -2,7 +2,7 @@ title: Script rules in AppLocker (Windows 10) description: This topic describes the file formats and available default rules for the script rule collection. ms.assetid: fee24ca4-935a-4c5e-8a92-8cf1d134d35f -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/secpol-advanced-security-audit-policy-settings.md b/windows/keep-secure/secpol-advanced-security-audit-policy-settings.md index a4f7e13245..e3f6f2ce53 100644 --- a/windows/keep-secure/secpol-advanced-security-audit-policy-settings.md +++ b/windows/keep-secure/secpol-advanced-security-audit-policy-settings.md @@ -2,7 +2,7 @@ title: Advanced security audit policy settings (Windows 10) description: Provides information about the advanced security audit policy settings that are available in Windows and the audit events that they generate. ms.assetid: 6BF9A642-DBC3-4101-94A3-B2316C553CE3 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/security-auditing-overview.md b/windows/keep-secure/security-auditing-overview.md index 135ebc41e5..cde9b0865f 100644 --- a/windows/keep-secure/security-auditing-overview.md +++ b/windows/keep-secure/security-auditing-overview.md @@ -2,7 +2,7 @@ title: Security auditing (Windows 10) description: Topics in this section are for IT professionals and describes the security auditing features in Windows and how your organization can benefit from using these technologies to enhance the security and manageability of your network. ms.assetid: 2d9b8142-49bd-4a33-b246-3f0c2a5f32d4 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/security-considerations-for-applocker.md b/windows/keep-secure/security-considerations-for-applocker.md index 560f73ba5a..f7c0df0eab 100644 --- a/windows/keep-secure/security-considerations-for-applocker.md +++ b/windows/keep-secure/security-considerations-for-applocker.md @@ -2,7 +2,7 @@ title: Security considerations for AppLocker (Windows 10) description: This topic for the IT professional describes the security considerations you need to address when implementing AppLocker. ms.assetid: 354a5abb-7b31-4bea-a442-aa9666117625 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/security-options.md b/windows/keep-secure/security-options.md index b9ddcb4bf8..2d25a87621 100644 --- a/windows/keep-secure/security-options.md +++ b/windows/keep-secure/security-options.md @@ -2,7 +2,7 @@ title: Security Options (Windows 10) description: Provides an introduction to the settings under Security Options of the local security policies and links to information about each setting. ms.assetid: 405ea253-8116-4e57-b08e-14a8dcdca92b -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/security-policy-settings-reference.md b/windows/keep-secure/security-policy-settings-reference.md index 06c6b96d8d..4023dfc66f 100644 --- a/windows/keep-secure/security-policy-settings-reference.md +++ b/windows/keep-secure/security-policy-settings-reference.md @@ -2,7 +2,7 @@ title: Security policy settings reference (Windows 10) description: This reference of security settings provides information about how to implement and manage security policies, including setting options and security considerations. ms.assetid: ef5a4579-15a8-4507-9a43-b7ccddcb0ed1 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/security-policy-settings.md b/windows/keep-secure/security-policy-settings.md index 1551485d7e..f9ea234685 100644 --- a/windows/keep-secure/security-policy-settings.md +++ b/windows/keep-secure/security-policy-settings.md @@ -2,7 +2,7 @@ title: Security policy settings (Windows 10) description: This reference topic describes the common scenarios, architecture, and processes for security settings. ms.assetid: e7ac5204-7f6c-4708-a9f6-6af712ca43b9 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/security-technologies.md b/windows/keep-secure/security-technologies.md index 7d54d652f2..39c9eedbb3 100644 --- a/windows/keep-secure/security-technologies.md +++ b/windows/keep-secure/security-technologies.md @@ -2,7 +2,7 @@ title: Security technologies (Windows 10) description: Learn more about the different security technologies that are available in Windows 10 and Windows 10 Mobile. ms.assetid: BFE2DE22-B0CE-465B-8CF6-28F64464DF08 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/select-types-of-rules-to-create.md b/windows/keep-secure/select-types-of-rules-to-create.md index 6e92663943..00ae11caf5 100644 --- a/windows/keep-secure/select-types-of-rules-to-create.md +++ b/windows/keep-secure/select-types-of-rules-to-create.md @@ -2,7 +2,7 @@ title: Select the types of rules to create (Windows 10) description: This topic lists resources you can use when selecting your application control policy rules by using AppLocker. ms.assetid: 14751169-0ed1-47cc-822c-8c01a7477784 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md index 1be3c1bfe6..fb5e5d5cbf 100644 --- a/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md @@ -3,9 +3,10 @@ title: Windows Defender ATP service onboarding description: Assign users to the Windows Defender ATP service application in Azure Active Directory to grant access to the portal. keywords: service onboarding, Windows Defender Advanced Threat Protection service onboarding, manage users, search.product: eADQiWindows 10XVcnh -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: mjcaparas --- diff --git a/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md b/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md index f976f74857..81d0358abb 100644 --- a/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md @@ -3,9 +3,10 @@ title: Windows Defender Advanced Threat Protection settings description: Use the menu to configure the time zone, suppression rules, and view license information. keywords: Windows Defender ATP settings, Windows Defender, cybersecurity threat intelligence, advanced threat protection, time zone, utc, local time, license, suppression rules search.product: eADQiWindows 10XVcnh -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: DulceMV --- diff --git a/windows/keep-secure/shut-down-the-system.md b/windows/keep-secure/shut-down-the-system.md index e07bf9633a..0c4f6b24a7 100644 --- a/windows/keep-secure/shut-down-the-system.md +++ b/windows/keep-secure/shut-down-the-system.md @@ -2,7 +2,7 @@ title: Shut down the system (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Shut down the system security policy setting. ms.assetid: c8e8f890-153a-401e-a957-ba6a130304bf -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md b/windows/keep-secure/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md index a480adae03..bdd15d4040 100644 --- a/windows/keep-secure/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md +++ b/windows/keep-secure/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md @@ -2,7 +2,7 @@ title: Shutdown Allow system to be shut down without having to log on (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Shutdown Allow system to be shut down without having to log on security policy setting. ms.assetid: f3964767-5377-4416-8eb3-e14d553a7315 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/shutdown-clear-virtual-memory-pagefile.md b/windows/keep-secure/shutdown-clear-virtual-memory-pagefile.md index 1e23676be3..83e27c9e00 100644 --- a/windows/keep-secure/shutdown-clear-virtual-memory-pagefile.md +++ b/windows/keep-secure/shutdown-clear-virtual-memory-pagefile.md @@ -2,7 +2,7 @@ title: Shutdown Clear virtual memory pagefile (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the Shutdown Clear virtual memory pagefile security policy setting. ms.assetid: 31400078-6c56-4891-a6df-6dfb403c4bc9 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/store-passwords-using-reversible-encryption.md b/windows/keep-secure/store-passwords-using-reversible-encryption.md index 386e132579..667eaec2fc 100644 --- a/windows/keep-secure/store-passwords-using-reversible-encryption.md +++ b/windows/keep-secure/store-passwords-using-reversible-encryption.md @@ -2,7 +2,7 @@ title: Store passwords using reversible encryption (Windows 10) description: Describes the best practices, location, values, and security considerations for the Store passwords using reversible encryption security policy setting. ms.assetid: 57f958c2-f1e9-48bf-871b-0a9b3299e238 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/switch-pcr-banks-on-tpm-2-0-devices.md b/windows/keep-secure/switch-pcr-banks-on-tpm-2-0-devices.md index dddb84f0a2..b6b9fd71e5 100644 --- a/windows/keep-secure/switch-pcr-banks-on-tpm-2-0-devices.md +++ b/windows/keep-secure/switch-pcr-banks-on-tpm-2-0-devices.md @@ -2,7 +2,7 @@ title: Switch PCR banks on TPM 2.0 devices (Windows 10) description: A Platform Configuration Register (PCR) is a memory location in the TPM that has some unique properties. ms.assetid: 743FCCCB-99A9-4636-8F48-9ECB3A3D10DE -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/synchronize-directory-service-data.md b/windows/keep-secure/synchronize-directory-service-data.md index 853573d001..b562f8a178 100644 --- a/windows/keep-secure/synchronize-directory-service-data.md +++ b/windows/keep-secure/synchronize-directory-service-data.md @@ -2,7 +2,7 @@ title: Synchronize directory service data (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Synchronize directory service data security policy setting. ms.assetid: 97b0aaa4-674f-40f4-8974-b4bfb12c232c -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md b/windows/keep-secure/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md index c72f3b1385..0862dc11d1 100644 --- a/windows/keep-secure/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md +++ b/windows/keep-secure/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md @@ -2,7 +2,7 @@ title: System cryptography Force strong key protection for user keys stored on the computer (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the System cryptography Force strong key protection for user keys stored on the computer security policy setting. ms.assetid: 8cbff267-881e-4bf6-920d-b583a5ff7de0 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md b/windows/keep-secure/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md index f7137a0c09..a1a1738dad 100644 --- a/windows/keep-secure/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md +++ b/windows/keep-secure/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md @@ -2,7 +2,7 @@ title: System cryptography Use FIPS compliant algorithms for encryption, hashing, and signing (Windows 10) description: This security policy reference topic for the IT professional describes the best practices, location, values, policy management and security considerations for this policy setting. ms.assetid: 83988865-dc0f-45eb-90d1-ee33495eb045 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/system-objects-require-case-insensitivity-for-non-windows-subsystems.md b/windows/keep-secure/system-objects-require-case-insensitivity-for-non-windows-subsystems.md index 6f9e3c9d43..1f3af1c21c 100644 --- a/windows/keep-secure/system-objects-require-case-insensitivity-for-non-windows-subsystems.md +++ b/windows/keep-secure/system-objects-require-case-insensitivity-for-non-windows-subsystems.md @@ -2,7 +2,7 @@ title: System objects Require case insensitivity for non-Windows subsystems (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the System objects Require case insensitivity for non-Windows subsystems security policy setting. ms.assetid: 340d6769-8f33-4067-8470-1458978d1522 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/system-objects-strengthen-default-permissions-of-internal-system-objects.md b/windows/keep-secure/system-objects-strengthen-default-permissions-of-internal-system-objects.md index 708cba1b5a..5be5a462b1 100644 --- a/windows/keep-secure/system-objects-strengthen-default-permissions-of-internal-system-objects.md +++ b/windows/keep-secure/system-objects-strengthen-default-permissions-of-internal-system-objects.md @@ -2,7 +2,7 @@ title: System objects Strengthen default permissions of internal system objects (e.g. Symbolic Links) (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the System objects Strengthen default permissions of internal system objects (e.g. Symbolic Links) security policy setting. ms.assetid: 3a592097-9cf5-4fd0-a504-7cbfab050bb6 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/system-settings-optional-subsystems.md b/windows/keep-secure/system-settings-optional-subsystems.md index 4e096fea50..15ec7c1221 100644 --- a/windows/keep-secure/system-settings-optional-subsystems.md +++ b/windows/keep-secure/system-settings-optional-subsystems.md @@ -2,7 +2,7 @@ title: System settings Optional subsystems (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the System settings Optional subsystems security policy setting. ms.assetid: 5cb6519a-4f84-4b45-8072-e2aa8a72fb78 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md b/windows/keep-secure/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md index 85e0a1c7bd..ae25abd015 100644 --- a/windows/keep-secure/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md +++ b/windows/keep-secure/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md @@ -2,7 +2,7 @@ title: System settings Use certificate rules on Windows executables for Software Restriction Policies (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the System settings Use certificate rules on Windows executables for Software Restriction Policies security policy setting. ms.assetid: 2380d93b-b553-4e56-a0c0-d1ef740d089c -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/take-ownership-of-files-or-other-objects.md b/windows/keep-secure/take-ownership-of-files-or-other-objects.md index 255f2d4ff3..24ab3257e2 100644 --- a/windows/keep-secure/take-ownership-of-files-or-other-objects.md +++ b/windows/keep-secure/take-ownership-of-files-or-other-objects.md @@ -2,7 +2,7 @@ title: Take ownership of files or other objects (Windows 10) description: Describes the best practices, location, values, policy management, and security considerations for the Take ownership of files or other objects security policy setting. ms.assetid: cb8595d1-74cc-4176-bb15-d97663eebb2d -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/test-an-applocker-policy-by-using-test-applockerpolicy.md b/windows/keep-secure/test-an-applocker-policy-by-using-test-applockerpolicy.md index aa27d42260..fcc3bf2eac 100644 --- a/windows/keep-secure/test-an-applocker-policy-by-using-test-applockerpolicy.md +++ b/windows/keep-secure/test-an-applocker-policy-by-using-test-applockerpolicy.md @@ -2,7 +2,7 @@ title: Test an AppLocker policy by using Test-AppLockerPolicy (Windows 10) description: This topic for IT professionals describes the steps to test an AppLocker policy prior to importing it into a Group Policy Object (GPO) or another computer. ms.assetid: 048bfa38-6825-4a9a-ab20-776cf79f402a -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/test-and-update-an-applocker-policy.md b/windows/keep-secure/test-and-update-an-applocker-policy.md index cf77664f65..99e46e3022 100644 --- a/windows/keep-secure/test-and-update-an-applocker-policy.md +++ b/windows/keep-secure/test-and-update-an-applocker-policy.md @@ -2,7 +2,7 @@ title: Test and update an AppLocker policy (Windows 10) description: This topic discusses the steps required to test an AppLocker policy prior to deployment. ms.assetid: 7d53cbef-078c-4d20-8b00-e821e33b6ea1 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/testing-scenarios-for-edp.md b/windows/keep-secure/testing-scenarios-for-edp.md index 810bb44663..e2187af349 100644 --- a/windows/keep-secure/testing-scenarios-for-edp.md +++ b/windows/keep-secure/testing-scenarios-for-edp.md @@ -2,10 +2,11 @@ title: Testing scenarios for enterprise data protection (EDP) (Windows 10) description: We've come up with a list of suggested testing scenarios that you can use to test enterprise data protection (EDP) in your company. ms.assetid: 53db29d2-d99d-4db6-b494-90e2b3962ca2 -keywords: ["EDP", "Enterprise Data Protection"] -ms.prod: W10 +keywords: EDP, Enterprise Data Protection +ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library +ms.pagetype: security author: eross-msft --- diff --git a/windows/keep-secure/tools-to-use-with-applocker.md b/windows/keep-secure/tools-to-use-with-applocker.md index d0ffd99ac7..5d2d69ff81 100644 --- a/windows/keep-secure/tools-to-use-with-applocker.md +++ b/windows/keep-secure/tools-to-use-with-applocker.md @@ -2,7 +2,7 @@ title: Tools to use with AppLocker (Windows 10) description: This topic for the IT professional describes the tools available to create and administer AppLocker policies. ms.assetid: db2b7cb3-7643-4be5-84eb-46ba551e1ad1 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/tpm-fundamentals.md b/windows/keep-secure/tpm-fundamentals.md index c4fb6b2cc3..6969c89924 100644 --- a/windows/keep-secure/tpm-fundamentals.md +++ b/windows/keep-secure/tpm-fundamentals.md @@ -2,7 +2,7 @@ title: TPM fundamentals (Windows 10) description: This topic for the IT professional provides a description of the components of the Trusted Platform Module (TPM 1.2 and TPM 2.0) and explains how they are used to mitigate dictionary attacks. ms.assetid: ac90f5f9-9a15-4e87-b00d-4adcf2ec3000 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/tpm-recommendations.md b/windows/keep-secure/tpm-recommendations.md index 9decdf047c..81b6385faf 100644 --- a/windows/keep-secure/tpm-recommendations.md +++ b/windows/keep-secure/tpm-recommendations.md @@ -2,7 +2,7 @@ title: TPM recommendations (Windows 10) description: This topic provides recommendations for Trusted Platform Module (TPM) technology for Windows 10. ms.assetid: E85F11F5-4E6A-43E7-8205-672F77706561 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index 9199881438..7db942d7ba 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -3,9 +3,10 @@ title: Troubleshoot Windows Defender ATP onboarding issues description: Troubleshoot issues that might arise during the onboarding of endpoints or to the Windows Defender ATP service. keywords: troubleshoot onboarding, onboarding issues, event viewer, data collection and preview builds, telemetry and diagnostics search.product: eADQiWindows 10XVcnh -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: iaanw --- diff --git a/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md index 1d15cf5dd7..8340e9dcc0 100644 --- a/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md @@ -3,9 +3,10 @@ title: Troubleshoot Windows Defender Advanced Threat Protection description: Find solutions and work arounds to known issues such as server errors when trying to access the service. keywords: troubleshoot Windows Defender Advanced Threat Protection, troubleshoot Windows ATP, server error, access denied, invalid credentials, no data, dashboard portal, whitelist, event viewer search.product: eADQiWindows 10XVcnh -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: mjcaparas --- # Troubleshoot Windows Defender Advanced Threat Protection diff --git a/windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md b/windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md index f9c63208af..e60c0f663c 100644 --- a/windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md +++ b/windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md @@ -2,7 +2,7 @@ title: Troubleshoot Windows Defender in Windows 10 (Windows 10) description: IT professionals can review information about event IDs in Windows Defender for Windows 10 and see any relevant action they can take. ms.assetid: EE488CC1-E340-4D47-B50B-35BD23CB4D70 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/trusted-platform-module-overview.md b/windows/keep-secure/trusted-platform-module-overview.md index 03e37a250b..e7b6e784ff 100644 --- a/windows/keep-secure/trusted-platform-module-overview.md +++ b/windows/keep-secure/trusted-platform-module-overview.md @@ -2,7 +2,7 @@ title: Trusted Platform Module Technology Overview (Windows 10) description: This topic for the IT professional describes the Trusted Platform Module (TPM) and how Windows uses it for access control and authentication. The topic provides links to other resources about the TPM. ms.assetid: face8932-b034-4319-86ac-db1163d46538 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/trusted-platform-module-services-group-policy-settings.md b/windows/keep-secure/trusted-platform-module-services-group-policy-settings.md index 4ded5c4844..ff626bb1de 100644 --- a/windows/keep-secure/trusted-platform-module-services-group-policy-settings.md +++ b/windows/keep-secure/trusted-platform-module-services-group-policy-settings.md @@ -2,7 +2,7 @@ title: TPM Group Policy settings (Windows 10) description: This topic for the IT professional describes the Trusted Platform Module (TPM) Services that can be controlled centrally by using Group Policy settings. ms.assetid: 54ff1c1e-a210-4074-a44e-58fee26e4dbd -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/types-of-attacks-for-volume-encryption-keys.md b/windows/keep-secure/types-of-attacks-for-volume-encryption-keys.md index 4f38eca5a6..96a64490d0 100644 --- a/windows/keep-secure/types-of-attacks-for-volume-encryption-keys.md +++ b/windows/keep-secure/types-of-attacks-for-volume-encryption-keys.md @@ -2,7 +2,7 @@ title: Types of attacks for volume encryption keys (Windows 10) description: There are many ways Windows helps protect your organization from attacks, including Unified Extensible Firmware Interface (UEFI) secure boot, Trusted Platform Module (TPM), Group Policy, complex passwords, and account lockouts. ms.assetid: 405060a9-2009-44fc-9f84-66edad32c6bc -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/understand-applocker-enforcement-settings.md b/windows/keep-secure/understand-applocker-enforcement-settings.md index 6ac72fe3f1..a27cfdc9cb 100644 --- a/windows/keep-secure/understand-applocker-enforcement-settings.md +++ b/windows/keep-secure/understand-applocker-enforcement-settings.md @@ -2,7 +2,7 @@ title: Understand AppLocker enforcement settings (Windows 10) description: This topic describes the AppLocker enforcement settings for rule collections. ms.assetid: 48773007-a343-40bf-8961-b3ff0a450d7e -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/understand-applocker-policy-design-decisions.md b/windows/keep-secure/understand-applocker-policy-design-decisions.md index 5687229616..4c7731bcfc 100644 --- a/windows/keep-secure/understand-applocker-policy-design-decisions.md +++ b/windows/keep-secure/understand-applocker-policy-design-decisions.md @@ -2,7 +2,7 @@ title: Understand AppLocker policy design decisions (Windows 10) description: This topic for the IT professional lists the design questions, possible answers, and ramifications of the decisions when you plan a deployment of application control policies by using AppLocker within a Windows operating system environment. ms.assetid: 3475def8-949a-4b51-b480-dc88b5c1e6e6 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md b/windows/keep-secure/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md index 066f32d60e..fd1d01d9fb 100644 --- a/windows/keep-secure/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md +++ b/windows/keep-secure/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md @@ -2,7 +2,7 @@ title: Understand AppLocker rules and enforcement setting inheritance in Group Policy (Windows 10) description: This topic for the IT professional describes how application control policies configured in AppLocker are applied through Group Policy. ms.assetid: c1c5a3d3-540a-4698-83b5-0dab5d27d871 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/understand-the-applocker-policy-deployment-process.md b/windows/keep-secure/understand-the-applocker-policy-deployment-process.md index 76bbb8d904..a2ec48ffe5 100644 --- a/windows/keep-secure/understand-the-applocker-policy-deployment-process.md +++ b/windows/keep-secure/understand-the-applocker-policy-deployment-process.md @@ -2,7 +2,7 @@ title: Understand the AppLocker policy deployment process (Windows 10) description: This planning and deployment topic for the IT professional describes the process for using AppLocker when deploying application control policies. ms.assetid: 4cfd95c1-fbd3-41fa-8efc-d23c1ea6fb16 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/understanding-applocker-allow-and-deny-actions-on-rules.md b/windows/keep-secure/understanding-applocker-allow-and-deny-actions-on-rules.md index b6d8502af0..b383087281 100644 --- a/windows/keep-secure/understanding-applocker-allow-and-deny-actions-on-rules.md +++ b/windows/keep-secure/understanding-applocker-allow-and-deny-actions-on-rules.md @@ -2,7 +2,7 @@ title: Understanding AppLocker allow and deny actions on rules (Windows 10) description: This topic explains the differences between allow and deny actions on AppLocker rules. ms.assetid: ea0370fa-2086-46b5-a0a4-4a7ead8cbed9 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/understanding-applocker-default-rules.md b/windows/keep-secure/understanding-applocker-default-rules.md index 76aa56e251..b0aa99f22e 100644 --- a/windows/keep-secure/understanding-applocker-default-rules.md +++ b/windows/keep-secure/understanding-applocker-default-rules.md @@ -2,7 +2,7 @@ title: Understanding AppLocker default rules (Windows 10) description: This topic for IT professional describes the set of rules that can be used to ensure that required Windows system files are allowed to run when the policy is applied. ms.assetid: bdb03d71-05b7-41fb-96e3-a289ce1866e1 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/understanding-applocker-rule-behavior.md b/windows/keep-secure/understanding-applocker-rule-behavior.md index 2e1353c3ed..ac18934b5f 100644 --- a/windows/keep-secure/understanding-applocker-rule-behavior.md +++ b/windows/keep-secure/understanding-applocker-rule-behavior.md @@ -2,7 +2,7 @@ title: Understanding AppLocker rule behavior (Windows 10) description: This topic describes how AppLocker rules are enforced by using the allow and deny options in AppLocker. ms.assetid: 3e2738a3-8041-4095-8a84-45c1894c97d0 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/understanding-applocker-rule-collections.md b/windows/keep-secure/understanding-applocker-rule-collections.md index 9c569f7f53..b8adef234c 100644 --- a/windows/keep-secure/understanding-applocker-rule-collections.md +++ b/windows/keep-secure/understanding-applocker-rule-collections.md @@ -2,7 +2,7 @@ title: Understanding AppLocker rule collections (Windows 10) description: This topic explains the five different types of AppLocker rules used to enforce AppLocker policies. ms.assetid: 03c05466-4fb3-4880-8d3c-0f6f59fc5579 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/understanding-applocker-rule-condition-types.md b/windows/keep-secure/understanding-applocker-rule-condition-types.md index d4e6ceaf84..f00afa16e1 100644 --- a/windows/keep-secure/understanding-applocker-rule-condition-types.md +++ b/windows/keep-secure/understanding-applocker-rule-condition-types.md @@ -2,7 +2,7 @@ title: Understanding AppLocker rule condition types (Windows 10) description: This topic for the IT professional describes the three types of AppLocker rule conditions. ms.assetid: c21af67f-60a1-4f7d-952c-a6f769c74729 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/understanding-applocker-rule-exceptions.md b/windows/keep-secure/understanding-applocker-rule-exceptions.md index a99cb1f8cb..4cedcfd784 100644 --- a/windows/keep-secure/understanding-applocker-rule-exceptions.md +++ b/windows/keep-secure/understanding-applocker-rule-exceptions.md @@ -2,7 +2,7 @@ title: Understanding AppLocker rule exceptions (Windows 10) description: This topic describes the result of applying AppLocker rule exceptions to rule collections. ms.assetid: e6bb349f-ee60-4c8d-91cd-6442f2d0eb9c -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/understanding-the-file-hash-rule-condition-in-applocker.md b/windows/keep-secure/understanding-the-file-hash-rule-condition-in-applocker.md index b778f3c76d..89a2b1a770 100644 --- a/windows/keep-secure/understanding-the-file-hash-rule-condition-in-applocker.md +++ b/windows/keep-secure/understanding-the-file-hash-rule-condition-in-applocker.md @@ -2,7 +2,7 @@ title: Understanding the file hash rule condition in AppLocker (Windows 10) description: This topic explains the AppLocker file hash rule condition, the advantages and disadvantages, and how it is applied. ms.assetid: 4c6d9af4-2b1a-40f4-8758-1a6f9f147756 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/understanding-the-path-rule-condition-in-applocker.md b/windows/keep-secure/understanding-the-path-rule-condition-in-applocker.md index d62cf0c8b6..4d4e950a6c 100644 --- a/windows/keep-secure/understanding-the-path-rule-condition-in-applocker.md +++ b/windows/keep-secure/understanding-the-path-rule-condition-in-applocker.md @@ -2,7 +2,7 @@ title: Understanding the path rule condition in AppLocker (Windows 10) description: This topic explains the AppLocker path rule condition, the advantages and disadvantages, and how it is applied. ms.assetid: 3fa54ded-4466-4f72-bea4-2612031cad43 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/understanding-the-publisher-rule-condition-in-applocker.md b/windows/keep-secure/understanding-the-publisher-rule-condition-in-applocker.md index 34ac6444f3..5e0bca2ee0 100644 --- a/windows/keep-secure/understanding-the-publisher-rule-condition-in-applocker.md +++ b/windows/keep-secure/understanding-the-publisher-rule-condition-in-applocker.md @@ -2,7 +2,7 @@ title: Understanding the publisher rule condition in AppLocker (Windows 10) description: This topic explains the AppLocker publisher rule condition, what controls are available, and how it is applied. ms.assetid: df61ed8f-a97e-4644-9d0a-2169f18c1c4f -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/use-a-reference-computer-to-create-and-maintain-applocker-policies.md b/windows/keep-secure/use-a-reference-computer-to-create-and-maintain-applocker-policies.md index e9c7b0645e..90336b381a 100644 --- a/windows/keep-secure/use-a-reference-computer-to-create-and-maintain-applocker-policies.md +++ b/windows/keep-secure/use-a-reference-computer-to-create-and-maintain-applocker-policies.md @@ -2,7 +2,7 @@ title: Use a reference device to create and maintain AppLocker policies (Windows 10) description: This topic for the IT professional describes the steps to create and maintain AppLocker policies by using a reference computer. ms.assetid: 10c3597f-f44c-4c8e-8fe5-105d4ac016a6 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/use-applocker-and-software-restriction-policies-in-the-same-domain.md b/windows/keep-secure/use-applocker-and-software-restriction-policies-in-the-same-domain.md index ef970cd8df..17fe40b6a1 100644 --- a/windows/keep-secure/use-applocker-and-software-restriction-policies-in-the-same-domain.md +++ b/windows/keep-secure/use-applocker-and-software-restriction-policies-in-the-same-domain.md @@ -2,7 +2,7 @@ title: Use AppLocker and Software Restriction Policies in the same domain (Windows 10) description: This topic for IT professionals describes concepts and procedures to help you manage your application control strategy using Software Restriction Policies and AppLocker. ms.assetid: 2b7e0cec-df62-49d6-a2b7-6b8e30180943 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/use-the-applocker-windows-powershell-cmdlets.md b/windows/keep-secure/use-the-applocker-windows-powershell-cmdlets.md index cf988054c1..d7cd5120c4 100644 --- a/windows/keep-secure/use-the-applocker-windows-powershell-cmdlets.md +++ b/windows/keep-secure/use-the-applocker-windows-powershell-cmdlets.md @@ -2,7 +2,7 @@ title: Use the AppLocker Windows PowerShell cmdlets (Windows 10) description: This topic for IT professionals describes how each AppLocker Windows PowerShell cmdlet can help you administer your AppLocker application control policies. ms.assetid: 374e029c-5c0a-44ab-a57a-2a9dd17dc57d -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md index dd0fc24f67..717abdaec8 100644 --- a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md @@ -3,9 +3,10 @@ title: Use the Windows Defender Advanced Threat Protection portal description: Learn about the features on Windows Defender ATP portal, including how alerts work, and suggestions on how to investigate possible breaches and attacks. keywords: dashboard, alerts queue, manage alerts, investigation, investigate alerts, investigate machines, submit files, deep analysis, high, medium, low, severity, ioc, ioa search.product: eADQiWindows 10XVcnh -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: mjcaparas --- diff --git a/windows/keep-secure/use-windows-event-forwarding-to-assist-in-instrusion-detection.md b/windows/keep-secure/use-windows-event-forwarding-to-assist-in-instrusion-detection.md index 060d693df1..846f249f82 100644 --- a/windows/keep-secure/use-windows-event-forwarding-to-assist-in-instrusion-detection.md +++ b/windows/keep-secure/use-windows-event-forwarding-to-assist-in-instrusion-detection.md @@ -2,7 +2,7 @@ title: Use Windows Event Forwarding to help with intrusion detection (Windows 10) description: Learn about an approach to collect events from devices in your organization. This article talks about events in both normal operations and when an intrusion is suspected. ms.assetid: 733263E5-7FD1-45D2-914A-184B9E3E6A3F -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md b/windows/keep-secure/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md index a4fbc0126b..7b203c0bcd 100644 --- a/windows/keep-secure/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md +++ b/windows/keep-secure/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md @@ -2,7 +2,7 @@ title: User Account Control Admin Approval Mode for the Built-in Administrator account (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Admin Approval Mode for the Built-in Administrator account security policy setting. ms.assetid: d465fc27-1cd2-498b-9cf6-7ad2276e5998 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md b/windows/keep-secure/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md index cc8ebe93f3..e80369cae9 100644 --- a/windows/keep-secure/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md +++ b/windows/keep-secure/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md @@ -2,7 +2,7 @@ title: User Account Control Allow UIAccess applications to prompt for elevation without using the secure desktop (Windows 10) description: Describes the best practices, location, values, and security considerations for the User Account Control Allow UIAccess applications to prompt for elevation without using the secure desktop security policy setting. ms.assetid: fce20472-3c93-449d-b520-13c4c74a9892 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md b/windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md index 28718b33ae..97af8126a3 100644 --- a/windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md +++ b/windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md @@ -2,7 +2,7 @@ title: User Account Control Behavior of the elevation prompt for administrators in Admin Approval Mode (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Behavior of the elevation prompt for administrators in Admin Approval Mode security policy setting. ms.assetid: 46a3c3a2-1d2e-4a6f-b5e6-29f9592f535d -ms.prod: W10 +ms.prod: ws10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md b/windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md index e382611db9..7ca4ce4329 100644 --- a/windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md +++ b/windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md @@ -2,7 +2,7 @@ title: User Account Control Behavior of the elevation prompt for standard users (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Behavior of the elevation prompt for standard users security policy setting. ms.assetid: 1eae7def-8f6c-43b6-9474-23911fdc01ba -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/user-account-control-detect-application-installations-and-prompt-for-elevation.md b/windows/keep-secure/user-account-control-detect-application-installations-and-prompt-for-elevation.md index 178aa242b4..0c372cd6ee 100644 --- a/windows/keep-secure/user-account-control-detect-application-installations-and-prompt-for-elevation.md +++ b/windows/keep-secure/user-account-control-detect-application-installations-and-prompt-for-elevation.md @@ -2,7 +2,7 @@ title: User Account Control Detect application installations and prompt for elevation (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Detect application installations and prompt for elevation security policy setting. ms.assetid: 3f8cb170-ba77-4c9f-abb3-c3ed1ef264fc -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/user-account-control-group-policy-and-registry-key-settings.md b/windows/keep-secure/user-account-control-group-policy-and-registry-key-settings.md index 8da09ab38e..e2e57dd1bd 100644 --- a/windows/keep-secure/user-account-control-group-policy-and-registry-key-settings.md +++ b/windows/keep-secure/user-account-control-group-policy-and-registry-key-settings.md @@ -1,9 +1,11 @@ --- title: User Account Control Group Policy and registry key settings (Windows 10) description: Here's a list of UAC Group Policy and registry key settings that your organization can use to manage UAC. -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security +author: brianlic-msft --- # User Account Control Group Policy and registry key settings diff --git a/windows/keep-secure/user-account-control-only-elevate-executables-that-are-signed-and-validated.md b/windows/keep-secure/user-account-control-only-elevate-executables-that-are-signed-and-validated.md index 19768449e0..76edee3e01 100644 --- a/windows/keep-secure/user-account-control-only-elevate-executables-that-are-signed-and-validated.md +++ b/windows/keep-secure/user-account-control-only-elevate-executables-that-are-signed-and-validated.md @@ -2,7 +2,7 @@ title: User Account Control Only elevate executables that are signed and validated (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Only elevate executables that are signed and validated security policy setting. ms.assetid: 64950a95-6985-4db6-9905-1db18557352d -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md b/windows/keep-secure/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md index 890ec0f2ff..be21f041f5 100644 --- a/windows/keep-secure/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md +++ b/windows/keep-secure/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md @@ -2,7 +2,7 @@ title: User Account Control Only elevate UIAccess applications that are installed in secure locations (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Only elevate UIAccess applications that are installed in secure locations security policy setting. ms.assetid: 4333409e-a5be-4f2f-8808-618f53abd22c -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/user-account-control-overview.md b/windows/keep-secure/user-account-control-overview.md index ccabf37ce1..32edfe0160 100644 --- a/windows/keep-secure/user-account-control-overview.md +++ b/windows/keep-secure/user-account-control-overview.md @@ -2,7 +2,7 @@ title: User Account Control (Windows 10) description: User Account Control (UAC) helps prevent malware from damaging a PC and helps organizations deploy a better-managed desktop. ms.assetid: 43ac4926-076f-4df2-84af-471ee7d20c38 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: operate ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/user-account-control-run-all-administrators-in-admin-approval-mode.md b/windows/keep-secure/user-account-control-run-all-administrators-in-admin-approval-mode.md index 63ac1e4a65..61664f5a6e 100644 --- a/windows/keep-secure/user-account-control-run-all-administrators-in-admin-approval-mode.md +++ b/windows/keep-secure/user-account-control-run-all-administrators-in-admin-approval-mode.md @@ -2,7 +2,7 @@ title: User Account Control Run all administrators in Admin Approval Mode (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Run all administrators in Admin Approval Mode security policy setting. ms.assetid: b838c561-7bfc-41ef-a7a5-55857259c7bf -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/user-account-control-security-policy-settings.md b/windows/keep-secure/user-account-control-security-policy-settings.md index 569bf9892e..45bf5fb129 100644 --- a/windows/keep-secure/user-account-control-security-policy-settings.md +++ b/windows/keep-secure/user-account-control-security-policy-settings.md @@ -2,8 +2,8 @@ title: User Account Control security policy settings (Windows 10) description: You can use security policies to configure how User Account Control works in your organization. They can be configured locally by using the Local Security Policy snap-in (secpol.msc) or configured for the domain, OU, or specific groups by Group Policy. ms.assetid: 3D75A9AC-69BB-4EF2-ACB3-1769791E1B98 -ms.prod: W10 -ms.mktglfcycl: operate +ms.prod: w10 +ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: brianlic-msft diff --git a/windows/keep-secure/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md b/windows/keep-secure/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md index ee510bb52e..85c36101a5 100644 --- a/windows/keep-secure/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md +++ b/windows/keep-secure/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md @@ -2,7 +2,7 @@ title: User Account Control Switch to the secure desktop when prompting for elevation (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Switch to the secure desktop when prompting for elevation security policy setting. ms.assetid: 77a067db-c70d-4b02-9861-027503311b8b -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md b/windows/keep-secure/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md index afc3766b73..8501495c6b 100644 --- a/windows/keep-secure/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md +++ b/windows/keep-secure/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md @@ -2,7 +2,7 @@ title: User Account Control Virtualize file and registry write failures to per-user locations (Windows 10) description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Virtualize file and registry write failures to per-user locations security policy setting. ms.assetid: a7b47420-cc41-4b1c-b03e-f67a05221261 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/user-rights-assignment.md b/windows/keep-secure/user-rights-assignment.md index 401613dde1..59979d3158 100644 --- a/windows/keep-secure/user-rights-assignment.md +++ b/windows/keep-secure/user-rights-assignment.md @@ -2,7 +2,7 @@ title: User Rights Assignment (Windows 10) description: Provides an overview and links to information about the User Rights Assignment security policy settings user rights that are available in Windows. ms.assetid: 99340252-60be-4c79-b0a5-56fbe1a9b0c5 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md b/windows/keep-secure/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md index 13d5fc93e5..a26cffe188 100644 --- a/windows/keep-secure/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md +++ b/windows/keep-secure/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md @@ -2,7 +2,7 @@ title: Using advanced security auditing options to monitor dynamic access control objects (Windows 10) description: This guide explains the process of setting up advanced security auditing capabilities that are made possible through settings and events that were introduced in Windows 8 and Windows Server 2012. ms.assetid: 0d2c28ea-bdaf-47fd-bca2-a07dce5fed37 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/using-event-viewer-with-applocker.md b/windows/keep-secure/using-event-viewer-with-applocker.md index dcee6821bc..1b1b80e64f 100644 --- a/windows/keep-secure/using-event-viewer-with-applocker.md +++ b/windows/keep-secure/using-event-viewer-with-applocker.md @@ -2,7 +2,7 @@ title: Using Event Viewer with AppLocker (Windows 10) description: This topic lists AppLocker events and describes how to use Event Viewer with AppLocker. ms.assetid: 109abb10-78b1-4c29-a576-e5a17dfeb916 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/using-software-restriction-policies-and-applocker-policies.md b/windows/keep-secure/using-software-restriction-policies-and-applocker-policies.md index 54b12a4568..8a427064fb 100644 --- a/windows/keep-secure/using-software-restriction-policies-and-applocker-policies.md +++ b/windows/keep-secure/using-software-restriction-policies-and-applocker-policies.md @@ -2,7 +2,7 @@ title: Use Software Restriction Policies and AppLocker policies (Windows 10) description: This topic for the IT professional describes how to use Software Restriction Policies (SRP) and AppLocker policies in the same Windows deployment. ms.assetid: c3366be7-e632-4add-bd10-9df088f74c6d -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/view-the-security-event-log.md b/windows/keep-secure/view-the-security-event-log.md index 745195b4f3..388d32ddc8 100644 --- a/windows/keep-secure/view-the-security-event-log.md +++ b/windows/keep-secure/view-the-security-event-log.md @@ -2,7 +2,7 @@ title: View the security event log (Windows 10) description: The security log records each event as defined by the audit policies you set on each object. ms.assetid: 20DD2ACD-241A-45C5-A92F-4BE0D9F198B9 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/vpn-profile-options.md b/windows/keep-secure/vpn-profile-options.md index 6f336cc6e6..77c548ec2a 100644 --- a/windows/keep-secure/vpn-profile-options.md +++ b/windows/keep-secure/vpn-profile-options.md @@ -2,10 +2,10 @@ title: VPN profile options (Windows 10) description: Virtual private networks (VPN) let you give your users secure remote access to your company network. Windows 10 adds useful new VPN profile options to help you manage how users connect. ms.assetid: E3F99DF9-863D-4E28-BAED-5C1B1B913523 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -ms.pagetype: networking +ms.pagetype: security, networking author: jdeckerMS --- diff --git a/windows/keep-secure/what-is-applocker.md b/windows/keep-secure/what-is-applocker.md index b4d758df7b..c3b47e88d5 100644 --- a/windows/keep-secure/what-is-applocker.md +++ b/windows/keep-secure/what-is-applocker.md @@ -2,7 +2,7 @@ title: What Is AppLocker (Windows 10) description: This topic for the IT professional describes what AppLocker is and how its features differ from Software Restriction Policies. ms.assetid: 44a8a2bb-0f83-4f95-828e-1f364fb65869 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/which-editions-of-windows-support-advanced-audit-policy-configuration.md b/windows/keep-secure/which-editions-of-windows-support-advanced-audit-policy-configuration.md index c60d303826..4428ed173d 100644 --- a/windows/keep-secure/which-editions-of-windows-support-advanced-audit-policy-configuration.md +++ b/windows/keep-secure/which-editions-of-windows-support-advanced-audit-policy-configuration.md @@ -2,7 +2,7 @@ title: Which editions of Windows support advanced audit policy configuration (Windows 10) description: This reference topic for the IT professional describes which versions of the Windows operating systems support advanced security auditing policies. ms.assetid: 87c71cc5-522d-4771-ac78-34a2a0825f31 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/why-a-pin-is-better-than-a-password.md b/windows/keep-secure/why-a-pin-is-better-than-a-password.md index 5afeb6f914..21d3ce97d3 100644 --- a/windows/keep-secure/why-a-pin-is-better-than-a-password.md +++ b/windows/keep-secure/why-a-pin-is-better-than-a-password.md @@ -3,7 +3,7 @@ title: Why a PIN is better than a password (Windows 10) description: Microsoft Passport in Windows 10 enables users to sign in to their device using a PIN. How is a PIN different from (and better than) a password . ms.assetid: A6FC0520-01E6-4E90-B53D-6C4C4E780212 keywords: pin, security, password -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/windows-10-enterprise-security-guides.md b/windows/keep-secure/windows-10-enterprise-security-guides.md index 510675e4ff..30f130d499 100644 --- a/windows/keep-secure/windows-10-enterprise-security-guides.md +++ b/windows/keep-secure/windows-10-enterprise-security-guides.md @@ -2,10 +2,10 @@ title: Enterprise security guides (Windows 10) description: Get proven guidance to help you better secure and protect your enterprise by using technologies such as Credential Guard, Device Guard, Microsoft Passport, and Windows Hello. This section offers technology overviews and step-by-step guides. ms.assetid: 57134f84-bd4b-4b1d-b663-4a2d36f5a7f8 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -ms.pagetype: security +ms.pagetype: security, devices author: challum --- diff --git a/windows/keep-secure/windows-10-mobile-security-guide.md b/windows/keep-secure/windows-10-mobile-security-guide.md index 1008003440..16389caf95 100644 --- a/windows/keep-secure/windows-10-mobile-security-guide.md +++ b/windows/keep-secure/windows-10-mobile-security-guide.md @@ -3,10 +3,10 @@ title: Windows 10 Mobile security guide (Windows 10) description: This guide provides a detailed description of the most important security features in the Windows 10 Mobile operating system—identity access and control, data protection, malware resistance, and app platform security. ms.assetid: D51EF508-699E-4A68-A7CD-91D821A97205 keywords: data protection, encryption, malware resistance, smartphone, device, Windows Store -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -ms.pagetype: security; mobile +ms.pagetype: security, mobile author: AMeeus --- diff --git a/windows/keep-secure/windows-10-security-guide.md b/windows/keep-secure/windows-10-security-guide.md index 2c0402513c..bb757267bb 100644 --- a/windows/keep-secure/windows-10-security-guide.md +++ b/windows/keep-secure/windows-10-security-guide.md @@ -3,7 +3,7 @@ title: Windows 10 security overview (Windows 10) description: This guide provides a detailed description of the most important security improvements in the Windows 10 operating system, with links to more detailed articles about many of its security features. ms.assetid: 4561D80B-A914-403C-A17C-3BE6FC95B59B keywords: configure, feature, file encryption -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/windows-defender-advanced-threat-protection.md b/windows/keep-secure/windows-defender-advanced-threat-protection.md index 9567620fcb..bae239bf1c 100644 --- a/windows/keep-secure/windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/windows-defender-advanced-threat-protection.md @@ -3,9 +3,10 @@ title: Windows Defender Advanced Threat Protection - Windows Defender description: Windows Defender Advanced Threat Protection is an enterprise security service that helps detect and respond to possible cybersecurity threats related to advanced persistent threats. keywords: introduction to Windows Defender Advanced Threat Protection, introduction to Windows Defender ATP, cybersecurity, advanced persistent threat, enterprise security, endpoint behavioral sensor, cloud security, analytics, threat intelligence search.product: eADQiWindows 10XVcnh -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: mjcaparas --- diff --git a/windows/keep-secure/windows-defender-in-windows-10.md b/windows/keep-secure/windows-defender-in-windows-10.md index 72d8554def..2dc00afede 100644 --- a/windows/keep-secure/windows-defender-in-windows-10.md +++ b/windows/keep-secure/windows-defender-in-windows-10.md @@ -2,7 +2,7 @@ title: Windows Defender in Windows 10 (Windows 10) description: This topic provides an overview of Windows Defender, including a list of system requirements and new features. ms.assetid: 6A9EB85E-1F3A-40AC-9A47-F44C4A2B55E2 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/windows-hello-in-enterprise.md b/windows/keep-secure/windows-hello-in-enterprise.md index 7b9bed5681..40a4efa80a 100644 --- a/windows/keep-secure/windows-hello-in-enterprise.md +++ b/windows/keep-secure/windows-hello-in-enterprise.md @@ -2,10 +2,11 @@ title: Windows Hello biometrics in the enterprise (Windows 10) description: Windows Hello is the biometric authentication feature that helps strengthen authentication and helps to guard against potential spoofing through fingerprint matching and facial recognition. ms.assetid: d3f27d94-2226-4547-86c0-65c84d6df8Bc -keywords: ["Windows Hello", "enterprise biometrics"] -ms.prod: W10 +keywords: Windows Hello, enterprise biometrics +ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library +ms.pagetype: security author: eross-msft --- diff --git a/windows/keep-secure/windows-installer-rules-in-applocker.md b/windows/keep-secure/windows-installer-rules-in-applocker.md index b12d94b8ef..65a86eddfc 100644 --- a/windows/keep-secure/windows-installer-rules-in-applocker.md +++ b/windows/keep-secure/windows-installer-rules-in-applocker.md @@ -2,7 +2,7 @@ title: Windows Installer rules in AppLocker (Windows 10) description: This topic describes the file formats and available default rules for the Windows Installer rule collection. ms.assetid: 3fecde5b-88b3-4040-81fa-a2d36d052ec9 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/working-with-applocker-policies.md b/windows/keep-secure/working-with-applocker-policies.md index 8963fa665b..219638880c 100644 --- a/windows/keep-secure/working-with-applocker-policies.md +++ b/windows/keep-secure/working-with-applocker-policies.md @@ -2,7 +2,7 @@ title: Working with AppLocker policies (Windows 10) description: This topic for IT professionals provides links to procedural topics about creating, maintaining, and testing AppLocker policies. ms.assetid: 7062d2e0-9cbb-4cb8-aa8c-b24945c3771d -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/keep-secure/working-with-applocker-rules.md b/windows/keep-secure/working-with-applocker-rules.md index 762d21c78a..9c528133ef 100644 --- a/windows/keep-secure/working-with-applocker-rules.md +++ b/windows/keep-secure/working-with-applocker-rules.md @@ -2,7 +2,7 @@ title: Working with AppLocker rules (Windows 10) description: This topic for IT professionals describes AppLocker rule types and how to work with them for your application control policies. ms.assetid: 3966b35b-f2da-4371-8b5f-aec031db6bc9 -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security

      x$S^(>D@>?TqL^@(P%(k zqHdc*MN4{cmU7~KvsozZsOZ^Puy>u@R$0icZCm9QSP`bf#z#r%0d3nr$1so!g`41^ zkBL~~gU34B<0g1%A&cByljzht6h+k2r)24ba)?_}oaYbh{lkl-m-`I+wsL;P-x?Gz zE}RkUveaaXE}?WdXTK<@1_i)Xg1wD(wbj*`rUc}KV*8`^&X+8+M9@MGxc1w_87s^y zP)hv)2A2a_!A53+?|6|aAhJ4ZQqL!YyV!2ya99(igm^1byro&kqie*Oc{Q6o$J|mY z#s65!ystB4H5+O$IdlGex2TPi^KFA-X)CqRl!d1{HN2-bmS%W8NP{ z9xt^EO4ivTSra1X?Po`Ldtr5$+Czj-NooKzp}uDb#J}N;eSmK7K}(bIn|Qx9{=*8F zsy+g7Pc=kqu=d6!whER>pqb^Z>vxbF;sDfNGcEsspt3Ipa|LH^{q_OdA zT~*Fcq9vI+JFwo}5+icsb>kM5r9z=06=~9^CF)N6y!-a)_rb(-I!?(CMNQp7`H>GCnepeS@W%0wm7R(XJ9+_4Rgwrx?QV=WOxuZsBCw{VFB%s&m0l4ClHpZ=U(qC!^` zewot{QD7T1N$1_i2FgmSYG5^cWz)0bGSBy&RO^jRsmYUC>amCTuYa6&>v5qm%0J?r znXswvcT~f4jq(BC6s$6TS4H(*HE9^FQTOdU5&N8+BIfxmw<5WLAy7ZjTh7b9E8Ccq zca>FG5+)&uhkoy~yWVIh`GdRhP<2x-8Ev=>ovw*K-}o7cy;7LF`P*C96kSkWhde#z zTT_(aP&H}K^;PzBVUDi9dRp&uFpRRT>7w~5a*!B>dS2fWRW7WBjcWxVhG;F-#ML>| z7yhmEuLIIk=fjvI|QWxcZ}>U7@+A|38#D3UZ`J|Ky{P*l;yT%9$jz zm4$usr28C(u2CMiS84@_56sXJl@Q$f65K^MHeC0LsS{;9FaBF>n~z(qTcUp|!s_1H zFkaNO>I+r>vz>g_$qvxy<_u0<0j8`XO|JY zJqPYS(OpE{`qWUzgkEHqn9Kg@_+F>i%Z*AzcXn7m zSmlq9Y`78|n_zcgRqK^FuaPL|ARv2AC5it!+Q(jpzQjFVVD|nnX9FC-)U>cfHEe4z$n;6_48dQt zpz^7ccSWOmOoqz;eP;s?7Un);g7CBi zaP+a6ZCFOL8@V;7etG=4@A{V*iQj}hubOw*Xne#B4z0W8SCK%&wJpdk7w*QT>dPs= zk|jh(=jP>OMLJ+EHN<|R%hfBm`*t#T{Nm8|zA()Lu${_S%Fv+3*u9HwnzhK^-|BuI zXhly~{rdrY4EkB^xxH zQMso?gEnyRJCaG&kxt%2(x@JQR}bKkDY!>9`}OApi%u?j&iGtijtRH2V8YJVF|bPI z8|t+>s*4;tPJR^CPoRBwZQ!b#-dsCvC~M#a6}Tg$G)yzQ8Fine zXSuExnKEo=aDt8|5A(7s4_f}7VGx99;;tO*uZ6vD$sLJ4Q++j{q=y+feK3wKdZ|S< z%8+1_nk*L2@Aq2B-b9J*+{l zw=N+!UkiL`d8iA!0-UMj2iIK+^Ra?WLiE8`Qg0EB*m&;Ofc(v;AQ3r123BbT-UYZ# z+(Sg$hp&<)foa5MHx(s(nX2;|<^453^KG7Yo=x~K8wrVI#ky=p_c5l-2e6nZkoF4ZJw;gX6`q^Zdk=?gg!7z1+)&>Q( zH3ZU@PQN17IiMQ&4)8#}J_L~UHhc0Bb?CD;QT>rGlLTq|J(<#O9g;)?3-dhSO9jS>M z1>a4Xw8=FlCmm#9i@isw8$`qCVI@So?s8#f1nC4YiWq0e{-&&~nkH%h8{6o~On)vh zu90w5W-cwSG%NeKy=gg7X9#qBjHhr`f%Z;sqKQPDqN=b(?nz9QhAM0=7#pY3xaj4dUCGdBDa(9^sC5Q7B}o*Z(lLK%!jB2O|EPq2CPBS zz|F~Y%@1M;?0-Efw`;W@iy*4O-aCRDi0P|bX)q~Ho}-u8n?!67W1wDM2cp!k`iiOW zi+VhEa+l&_LS~<%B44ShygUar+b%!TY1;l4JgBB+ z8?#-e4UigeQkku}Isv#PbSwfKo^ip#`hmENaC~K%>lg!!u(u;g=beMpCju?(GCf-{vq&Owfj8f8XPlgm$lk%!*FWc_2POtM>Dh42j7f)Bi%O{+{GWtmM09MREzde**U%fPvd(6Q_D7 z1Y83i(FZJ)BmP-W7fQl8_CuB&6!hrJ)!M(m+wEY&?9+O2=#=;)gq&ec?|$#oLj~s{ z+7;IF6v{D*q1*;31l_=gx2bPmdu9hg6Mk439W9K=j4Q{I;A~ZxU<`H2NGWgOz~p7} z@KqbPLI58x!-D*}xSNlXVfQ9|iyS23GQsM;B=bmM{r?HP8$;xb?g6JVN@b89g&$U0 zY2pc>a!>pCGo&eNlGJSOGp1D^N{9mwgTtCKqZ zQMx>Njg5nYq+ue1ckX}|fPgnf4BU$3&$xLWyhb2cLm$EezbdzjF_4vRA9IGHW_)E~3o zi-ak@JHS)vh9tCXJYwTvJUCq%UJO75$SRHSN|=5F4Z@PY7TdTagE983TdHfw>r?q! zJ>iN<=)*+7TK?(^yOhyyhEAzfI1dW%yqQW%`kwQ=cxQ$*G&WjQ3gtO4GlaoIS2p9# zT5SiY7=y#7utnmKVUhGHm*EGEi}D*Ta10@!B6Ef*j&$(Bo1>UOO!@$n%#B0pw(-t+ z3zXHEnec$M40xE-8`5ATjp%u1)@Z2YL0^I2V@7`D@ohgR}k%9W;$s20Y*pV0gqGy1t zfDehU5mcTUM!X<82~M1Rc7^IjJ(EH-5)0PLEnH<-~Q;E zG9r9QPeZ_7@FpMn0YEiwY*;vT$Wu4mp(i!m;FQf2mCWd`Q}8%z^cNm!u=EgsGkw-5 zimPFvYjltvkdGk<;eh!t$%7ryadr>P=`p?2i&J;7&QKM{Whyy69bL3_$SMqzl#`M$ z0GII_W5EQZ>tZa2k=9_i7SaV^Rig1Mf?=SPL|2<<3*aaqpfFa)W1`^3YP6m%;dN^W z6%V>5x=Ms159tt^u{?mxXtel@k%A}#uvV#z$xr|zF2nF#h47~EsY0~86qWpx!FV7( zDVm-E@bL){rAJwKuz*lJz^3adUCM6gLm0|UF|^VeD16}8Z{dNuFyyV=(xagGrW|Ap z2P3}BLmF-~$+cIBg(j0nI;hkV4xhq^Uv zpm87*JmFb45l}OH`7=skbv@M^d8$|4b@EUj8dHEpfBN7kFFcBiCqo~MSDm}hD2(yy zKI#$!9G)LA;xQUBQD=Ch13Vi%t8d^+MjCK&OWtHh-s%aDbbt;5ViQLI2ypVg$(w8q zfdEYT0)5~hFLFjc@qy&8F3CcVOI&4UTX<0S_|>c9Oeha~ASa-WM^yU6{^+B0vFy!FU z!c#^d3RL97`(OalrzjOizVaih;ursYxqGGzefbsd#fy7>8=GX1WTydUGzFx}?V2jS zbn#L;pd8W=9u>dCL{7$Kh2!B%S9ywe@yJYiAO7p^&yV(Rej=5S%)#8FaMH(@9udfZpmx7PR>UfTfMHC!-b|1 zQIv}zKlMNvcypA+Z-Av$r+62dKAtEiMSD6b-gVO%iTrprl=JzfGLY%2d+LMir#k_l z7gL77kiL`?!P~}@@6+9Wp9>WrU(_+=8JZqMaeziFB8Z zTfPurJVReR1bBJO=9LWNa3<*U%Y|kD`HPe&Hm|m>7s|Vk2jG|IOTiu_OczU57dxG2lh)J4d$wu55LCQPSN^6mJy*HCWB^$q zjkB29H_lY|Tqcb?)4kE%sR8>JgXC*0*!U@4eXj|b7mKHt3XzX`e6IB;u8Anub4|x( za;V1lpD78e-synvhLDP%`fc^mg{1jH5uTKpolQsnrYn)vbJgFM3?SF$5^Me_OHCkB zY|FwtGaG6Tc`a9YF-T=tHe>A85*tgM>{xuqJKm8-JwxXw6M!yjdNs1omVlt;hA!Wq zEzvKNqGtN78CSQ@l<26XhNTDAo7YxkdSFSYiB{w7(}{qv30WI@tPN&oGxW@e?!qCP zT%N7|UUWcKp(c9`#RracnVG_nA&kE-%{>TKKFTJXFm;1##s71X+BJam#(IiKWyEODQeDwn2d>L{MhptvlrX z0y5qtMHwb(iDzez%>@?DJM+Q9ZD~_DyKC(5(OTL0=inWiQfvs}p#Vh!v!liiE(_Od zF*<%#fPL+}B4B#+%{Ql@ZIH0>z(xojxkc}G{#g_*oIEL;^BwGZv*_I7ba~2)g4?ES z*N{p>jM8_z{CIOV!Pt;si@6H60AKldD>gg`Bj3Kk`YwG-W`w!rmRp`Wtmm1;$AdZ$ z#|93YNyyM-iiSmeX(2N9+paiq)S1l|>P#7w-@Vc$k}EVx`J1mSxV38jJ57;8CJjyGNdo`hL=i~%4)YB8IgsJFqVV%i_tru0C3qcM3E@2GzpAy*o`AUib08NjIgVU z@F}<5OLb0zN~BzN*icAkJE%mJAstF7AD_;9;E^kzu#^xWFfNuTdNvx^`eY+ z_8DFxGhyY27u#cjBz*)Tz})t18yJ-D=}5jd=KupBAW!AB6VI+aGNV6we|7K;{Vbqk zA8d-8tnVfx_sH8;V2y}fmB4@(ukmma8yN$9pN`eEv(8~l!Z}w%eQF$SvA5Haosyq2 z(%k}Uyvf6N@*x|t)6lUcaxU_nPS_q#KFSA}>4N&@Bxy|OBQUcZlb(?$d)BDq0ie@g zjs%-`1_e;XhceJXPL`obeB1FVeU6>F)^JLLQ^ecXuvmskA2>)P>STAF`mpDzy}~ep5z;V-S?mJwp##ct)+_ z7&FDS%@{}yE4%pOsXzi^qzs+HmN5e5@<4@G8I%`zYjJtZ;-~-$!(g9x*gPRKI};zL0SCy(>HA<1uQ?q`{jZ zGr&)gY|Z3p)O|#@NMqnU0$Z*rFN3y)lwy3L_!=_xzzfwF0xQY|q%;<`oQjWs#?E8W zSQv)k=>i4iS2h5^D3yy6Galz9r~`(tjsOG?6!-%-4FJ!E=V+TR*{FAo2SWxXfQCl} zz=45#Jg;itHMYvxUuMT}@T5V(gL4%CJR@dIc*h?;3@4Ep8IcDNl8>Gp(CX_mV^=oi z1a7s{?R-?_0YKz!%RgWN9xmxPH$$(3oH+<=0RMLlag4|XuqqR0Km!O2-B*9gPi}a_m%6rHSr`oh z-q%L8;2R^=*eDYJqALzSTLx{Q>D7o(-*Q7SMGj)L_KtO)puuWQL8rMOdtLxe-Q zq%Ut3gfBc29smJ^6rR_D7o;_nkF5lCOq~ zQvv8oXTA_ATYZ+n7FYvG9xy%P1n@Ee8zPUYXI>jXkv9+pn4A-JWT=QN)B`?wZR!UY z8D>)+`k_H3PhdmuJyV~3!ei-=@9Kw4@FH!pG89mD-6y=VdG+g(hWNgVrw-U5C%|xp z`r!2F_DfHA_#vIXj%Yy0hzG3B=o1~oljrVn($oiVrK{3l`#fEG3t#9Tec|*}omAsW z-}G2C4)6d!r;AtRot-+&8$3<7{Le4Z2oqoiadf9aDU z08^(xfhPlW7>c1J`oR04E4+=886r>m!82l1h*1D|2MuWi>ky*hvPloH>9rWn;9c{; z0azK8dQopYKl;Wfg<Y09mBc%E#g0E}%Z54{20e&dha*b|RdSvV8)71$U{R_A(E)nFm% zDTm8pSkh$^8ZXX^a>@e_(ox@i5`Wl6`sBF_2?y*ntmIzgeue3WN6M^Gh821>*Cto%S*!4R5df4Z|Z!)95hR^6PJ%JU%RlH|I z7Zs2(N*Q<@lvm-5?NBZTNNAK!*W9=&4+Dq*0-gs21(f3I)=95V42h6SIHe4Pqx(X@ z09sxM_%Yxj&v*$cP?tv6gz$8+C?I3eP*6CH3eW)r6jE9R{`e5LlmjS87x+k{^2H}Z z2mFAC^69FTu?b_SK>mgX@Box_GXbJ9xvIQA>q7FBNHFU6#+$^>Ytoa)GsfO^&-NP`ZD zLzae-7@gm`#>!K`0borKY0#Bh8HWkKCW$q!(vYt%vTmn|8C_lX|Nr*xFsE@ChypO& zffI2BPQcar8;L7$Gj_kO-YQ$cQcBuR+xMiXZQ?lgc>Fw`*i+Z(qdb&@73TbAv)OiD z&s87gH3Q(%(!uFzBGGxV>yTF60`hmAELng^6~Sp^as@h(>z<1=)h)VBrx1wF&V?h5 zNONgdGZchNr<5JB(^F*23YDJA09nx$&-K26fspoGf=;o#-Q#_PG8^2GF;Z7v1FYE= zJ=vX^C>KK`Q2ym_*U8fWpEh8Wq1$-G?*`h5zHvcHqi^fu&MU{VJo!yWm52T^Sjav4yDO9L;3&a`2#n(S zPN0ZZAvKK79Hk|E76N6`(1he3f}m9HUBc+@JYg+?)F~Q4`HbbEp*&N1`Fe&%)VT~C z$kch~MjgB+dL=;|zg&yuI>%9zdu%BsxjKyDCOIpKa`PoLA=DuWa&g zsJHXr8Q@;Bbe;^Prw{62Hp4Yy)@n8;jd}#qgE}cw^xt#osZU6IFYg5|lE@7ZmiEkV z`jL^cj!X46hw(^jF?pI#*agS@BWuRx2Fe(hNeAQeN+-wGql-)DPDE&)5 z0XatBr1@WY=$1VE{!D*U-hH8t28Bj@8w8CxQGUuq+0xV% zQpk9TEg`Q}aQR%K5GG(LHzWR}V>+sL>tU)KZ>4>=E{o^q=T%%5gf_JUE1T)eRFK;t zE`j0?xGT6vCU#tH%Uy8^?MsGJp>3xUbK3Y&a9LRSb^rSM`fiOTQ~xJWAU>O^(2!ON zOeJOV^Cowy!trlU_0a~C%cgxV0aJa*)1iI&9Zn))~@|wHxf7PkM^)Tm}o*47k2$;9dSsK1jzs&N+PdLddma5$Cd=J+AWz zKDxH=(K&K40tnH1VmqX4d$mgpkf%)y7Tw#VV;P;9j`IdGyCm%Zwc*AL&5J%8Mob?O zuus2Tvp&@BF0(=TWr`_Iggm5Ej!Us-i|fPIWg(8l8ZHZOZn6ASSQ^D5npj5Vve162 z{8*94n$F7Cn{iul?Gi(}HW1mujHK=Mq+bZsQa3I(JIL%5vo+e7edwhJ{?zFPi*bYRyxw3iT)^MygzIM=0D?1nohu|NV zMNym+1|tjlS-FDW2!WY^MM&2cd+`Nq&ql7o9NOk;8?y*@zKaxQOS}$Y(+FY#Rx)Kb zpx6+>Xb`JIU>%zY#D-uUBW2G(=wgB7{-QV~O3208VQsN3uHq4hxgg$zT~}Nawp+7W zxe|~n5@y}9W?8ag7I0~>hQ+JMmRKauYC)`VL9nn{*1}lI@9F7jyOmpP4CxU+%hObR5tS{mn?(Zj zj)Q+q3~UkH_Hj+OT8gbu3LSn7uSNnl8U=Ps7qldEk(2PLUc0j2*K}J(&WV| z=06rqjpfUSEG(ut#eBj@mlceJ#r<`^;N`+kdI2ME*0C3Z^j{vX$=f-3CC2lu;8<;Z z?V!VJywocp55X-HGSDB^sF!dMix%>1X`Dxp%Hf=AX;bN4&v{4(;im@IbezERJXapl z%EPB~K5vPP;h1fF%~*?&>#`_D00~fNYlR&lU5D?9F)K|71NpLoop&ASy5=+au!HjLf>-spTuyL6^N92AqdOtPx#1ZP1_K>z@;j|==^1poj532;bRa{vGi!~g&e!~vBn4jTXf|D{PpK~#8N?EUAL zZEJR)hs~$pKdf8-5?0wb9h&sb=KM|yz32f z{@&l5Z(8`3U-^~u!^6W^T3U(^wtv01^YioB+53B2SXh{yy+612b3VS`^X~n=eYdhb zJw1&J7cRuYU;fK~`TS4+=|3Hto13#+A8h}!w#CK8_pLA+ufbpt@ z*ZXf%v5e#UF%ONGr0M-!zQ#>Gc|UGvXJ^svc7I#`sW*S=Fa4!h`0|&(eEuK)hyURR zVEQk4dlCeBI2^`gGI?Le(R^$)8t>aUegLMw`)!_Y?^i3?vhDSHzYXk|Ceq4#P`3=!!Fxn!9M=E_qK1vVgBf zJdTfTJj&N*;pSP{JbCQda?1annD+er+qeAE?7i7xwwd>jG1JEbSm4KZeDAw%k3aL+ z```YmVVz?VlMk51^X>6x{Je2cAF9>b?5eLl+068b1yh0aOMmze$AwFme*XZ~!X_gp zlWBBX?ew9<=>(yfaBmuM#(qv*xV)f3aYU^0z4P-kz+e^*SN-#ulxv@zUG>>-ZS(UY zlzA(kF9Mli?Y79+s-lsu?ZmZG-297~l-Ou23t%G~18VpJA<*EkpnzkD|PU!_yQ7xUKQ!V*Vf zLmn>jjtKvP?^U zsQhH}K6_p$X*J$UOO>cpmoxs}o)VsM$b9e_wlltCnJ$s;3TZY^GHZ$N!h-ios2K&a zV>+E?7*q0VUfzO4=FW#R?xx>wmd&sYBPA%~XOMYmQCag@+W|-i7lBXm zU^y0+8nJcxX4KYJB9?r{CyoC?OgW#7DbK+uPWBJt*MI#Vz6Youfa$-Y?eO3re(4|l zgZT6-ugtFe%iokC_YwP>Z{CgZXb_|BaV$)_?jmHH* z;{0@~$Pog<$aUpriUKG^=P1j!1ep6A6!^1%EqVoE&p0UT{PWIx!Y%-%@+jmpO;nIM zQ@Q+^O2X-aO2f%HO0RYZNHe`FO6FaZq_T*T0~XbKBbMv6I7fre2x9?dw(jWm$8pl? z#Aw)!_4Q_KZ)~6#jp+6U2`rV`V$|!^SV38=IAkiy;VHmE2IV&=q`6wFkv5{sUwOug zXNl(`L9~tH9UXV#{_buJd!x9pxgIyKZpWpa)gXFtN zC;pv^@(YzLYxe;lcg{B}T(d%1T$mEQB3oIWr2X`)$kxKrgitN9I?pY~Ib}9pJZE2v z#oDF#*pK~8TzT#W-?kJiTfWCWVDF$nC-=MYtAG1f;=ldB{8?nDV9y6&`mbmcO#jL+ z{$hOYbDxV5iTwT8RP-}|#9H;;x88|yzsETYb=XEhdLTnT&L&6-3=ilb^8qXnVInHb zz*I$(G32?X&_ZDn$RTeib_GlY(PSlDJ3ki~3X||iuoS3FK!)c=n1r>+UyANI!U#~N zD+1w^v7DnUi@u)#k{Xr3=7*DE&qB(LcVrNYe7}xz*BXsjTCTPj>!_?1@tuIhEj)`;A7OGA8a-;Kho` z0?M$-$I%2ZJSF}oF#zBM;R??z1DuAx1ZpnAu-Det0dK$*fL#=A0jCA>U_$y&j@xm7 z!dfPl=L%rI4eMK3X~JkLN*dRTd=xMpMxP38ZXqmlPpjn|FfFBQj*(|pz)O@XvN0r& z2gG$urLnkJjXH5!rg9)V^4$!FxROe9kKa`AmeqL;If1b+Q)!U7<7mWrbthi@+)u`h zS6+?kN;S)7iM*nU2uddU{nO~|w&Pd-&fkvz{=fZ?V|`;QWA&ti>9=3~VEdk%weup1 zRRogXoL2-G1(n}29FqnZq1J)8B-kp8}$1 zzDwX<_sf230Yyu}bLT22r-KM5bD0qng=jw0e*4{ zcnM&p1-usErdSAuJs3o*N z%;VrKDf?Eof zmjyMB)aVLT@%OnS-1#uA9%{f|0F@AUQK98GK%}WG$jV@| zBIP}GLSTC@klae#%4VF4&=q7V4qC{0}fWDJ4` zO1eD62Ts`lyo~e$_XVv*zybCQ;0vfj_K6QJ!v0{xm5OmDzT}J6aw@%fYMQOgWThNU zyNubin$1i4j{)F$B_jCg5-9+}Edn%e`q;BA7y6)$wi(seZ-M(r@R1+#&PcF&YgniiX}`KhG!x(p(c@N2&z`l zUeVky749jO(vV8QeQN%iuU672w?1PGl{>MhU(qZ+Ps65qeXxCxEft7O;hZ;?qyTVv-XM`;IuqbLN8k#?`JB)2ju@8LIM0WQ zLMY4`Chz)qapv=!*I`3~PPs1_QD8H0tWI}bg$ci2_M7KdVtc1=evL(%1As$0PYwz zwbERPt5>eZ^UppXFTMOqJomzf;`+_ovA($-AW?LAPTy-^_DjAegEgJx@l-29_AKBm z2%g5(c$RbtX#N==0YJdBf^$nC5@39S^8^fj>*q8*!yb$e);EO-yQM6U*Hz4UeXTaW zR58`Ha4LS(yaK@eZk0l;abNes#_C$EtgcdNEoc5(XZ!6UW1b)fyfv3YK~YfA${XW#gEC%9f#W z^uFnE&u{vi-%EKmtc?9rvzg8hw(qgc!88FPg~s0k636`Ke?=%#Xl8$kwx+B?=ea_v z;N{yXh&*F>vv378#2;lT&X)ksR63NuR%5SMqTZ+`sM<(SuP<_KA@_QN zy}1;P<|1rnF;*ItSY>Z|9e~x(CcE+*igbPt1xn#Z&~u+v6mG_g3;EkP%~_?&Y6I2s zl72oPS zB0lk{Psg(_emE{%y+++ui2{>U4VCH)^8Z}p&=}TT+Vds2feJ$!-udz1(PeHXx zd6@i0qn7uZJg+rm8Hu7qorn>SB2dJc3+&m*XmtIVCjzJsmkKx=tORUjQQ7m4!t)Wc zLU}bUld-NB^4&_IH;OJ5kru>YNX0O#?d)MdAcRRdlOI_j^G&oP<0YUc>U-{UewQQv z{7`=DY1*Ey)chWA3R?>AW1E6GH)RzJ8Bzj?+w8jU$a0jWl$Vq&_h~H24wqHd(^v)o ztJMN-f?-u41nlZflxnpat83L*Td&2+dIN@qLalMW>fT6YTw6maxwgL1;93~ry}!M#siwdi|AobJPd9>0czKz) z0_ZCDO0&kd>ZAcc&2S6of`93s)K4jxoK98VIk>{E&QMzYnwac%Y2qyar5W{FgFJ92 zOh8q|TwQ6zXFl_Z_^}`Rk@(^d{ek%8D=)`$x30z3+Dh!+e;99k{TuO*|K2~2U;c$( ziof-XzZ8G>SN=}?&0qM%_}jnyx8t>MycvDi;nwy}T)TQJKKilG#I4&el8y%Hs}ern zSf~OV#(Oz;Tdnn@>bEWRh?R$BYZ?+i(jPn=0WkVRkM(DE;uw?u_@o^N2gh-Ibezm| z3cyzDHOjLQTU%>!`SLal`Xce!j1|&l+UyY^~DTTx!ah<=X zWm985*#0?NGLqSrwRj3C=Q0CpT(6@nWm8DX{jy=iXo4@J2!P~r1MmUt8Y?iy6<7#> zS%+OVR{_oyk2Qd>7MokE38E`JY*fhRN{#Eb@S>nx zTVb!kTm@>)MH!?3S<@XLLm`Gn)#D;@ou^HK&op{HulbZa$|!?F1B^?vS?8N2PPY0A z!fqXLBImcw|jWOE?*;PoUGaA__Q-Cb{Poj{cAV zm9NI@ue}+2yL-_(YLQAxI ztD1Lyk+8j-y&uSmWWkRycR^iOgZ|vPj0&)pQI^z9R@2fDJ@cyn`z+7RWY@sGqjhA% zls@8#4W9aFOrOsf2JuQuVUbFP-x5<9xji6k*qZxyjcdAjh|U-3R!|Fzd09Fft>QEeDIh0rl4}voL+``$Pya>UPTj~ zy#a`>ZUBHAfFbO&4xrWn&^lnd0^5{@)?t{k)OsE8m9aLKVT33*fVM27)x?%1!U`4k zY#`v{3c7%=&?fVo{Tct#AY_{6>ER6(hTZEK|IEU|GWFZ08RxtFuIR@DOdGIK8$>jZ zGY?3wfMdsW&2m3)gUS#l(`f^qC;d1%u@`{-Eqeg!5L4I&CL2)z7UEu6swOLx>DX7) zmTcp*0t>&ev(3AQ@y@E5yiY%CjX^drj}tz0d8{?ZDtp{q*evtk8T&n`z~CuOAR&+|MxuYl6!!|RrjP$n~_ zH2JQUfsI_cRgi&Y%bCl9R>~rn#kW1W3AUD(WpCIS4)30eYTlO;&dT4oD$7&AZ)__& zfA(hZx8-kn+Yfl9N#$Ivm2yg#kX^|LqXeAkO?e^iCBIS)cs_p`*^*A;qFYGtPnW}Y zY;%2kKW>j>!FTR%rZ;Q6Cvl(2&U>4QvOwpFdpx1Po6XFdzn|xxAiTD3DwtJ zbwc=%@i{9~0qU?oX2%aKt8xr5eHstE|+j z*+^nZ=^9w9kam0P+39^r5L<*zScb$(!A4N+6Dmq7u#+nkg<4(PA1uE*Ny zY61{1CD@vYH2`p#bSfiWvP^BwKchUfU~JMlQ>F;l?r;LOK!gOx8F7}eR|(Jl%T0u; zX-|nPE6RRWdCmR#%AO#c5=)*MIvJ8|u$c8kf~!`(UQR$JAgu!{kp&niLXqX%0Q^_A zM5xTy*6Ub4SRz_CR-T5>=KD!3s8D#@S~S5pWe2wJQ>Q7f#K|8-$BNnRgM8H>a#I$q zjIul2`*5F|V= ze0;Vmz?raFeifFQilXH6+xV!M0)tGrRwGRa(Xwd*B&=S0&(x>MrEC5!4w_DY4Cip}l<1(@nd$$Xa4gudXBy}_z#qRDwy!H0G@%B3psTfwH zxp^V#>pL-AsKsQl2Dp(QRu*C?f944(hCQBV7&Y=>J$<1Yap~d(*z;DbudT+~+Bysr zFr|F;L#l8V-vSk$t^spO%R#^~@9hukG1)D<`ID6-N3CJoG0%~aW#Y5aXymZnDwS+n zBMKB7by-$Ki^NxVj)N!2;jB>ezGclbgp{&mIZbUCV=I1icF!qunJ=Qtb}^E94jru{1Lf@;0zp{jx$oL-%YLc?rgJ#xyEH>5LqOIM zYJiv^U$ zdF2Q#M@}tLF)Bmpg0XTeua*4d`4ZY31oB6gps%W(nA zi>i_9T3@5TV1AF}obbQWNCrqRStx>=e`7>oCDI}Lyk~M;B1ZKq%(~p_JgAVfY6Jh<9_V#w_e!@&qw-2 zIc6VMqATke1KKwB*s(mp$MlhZwxG{vZz_I8&Sg-X8=)Mn1E4yzb21&l>WA4<-6FqU zfBQjHnmbWnyF`4K39Fc?hHRGDfMP>g#Y&Fg5*7rPgmgiP@)dabCGh1?T=HZYz|98; zY*Cj;zE|8RN#o5t0oIRk&x4_6IdLm1idiF+Wss)5>G3IF&$oQA5D3e4e)Vzr|JE6I zcu`sPnJVSkfbDA5SB)>9wNkLB0Y5X1Im|UFwxJ^v0`2@B4<+N3#v87YG8X1he$;no z`oK2t%lmB+dcrr8^VDn#&776aw|`M)`t6&7sSpUCimpPVkjY3<5CkLrNBKR$QMZGF z?W+nP_XJOsJg@qm-EoRg+mfteX^vMbuo-<a?Rv z8uYOWpp<4Z-yAARfU%p?vK!Y3$-)tH>u<7{f>lP~h`G%XKjWwPS55rwNWa3DhZI}rp;=hE<4 zPf(S~yD2|KCW#vrqyp4kvRQzSgXdhRelNDU5~i<7=7F**NOqw~ zhriN<&@6E-kfh11!ldva{4xoZ14)ueogtju%rVhpOxM8((^ck0(ES0XJ7C%AIJO(m zgmpgJ?Z)2W0A(M?{?U*lfY}=ZvH%bu)Tl0|Pit#)CAPL#vgKbtt_)1yoIKcF1r^+6 zf&#zif?=9%2|}n4%9WLaz-Ro`0~N&h^QV6;ldYpJvs&I}mhiseSMr6KqHF3;Vii!? zSX+w=JFq_3TA4&db5PdS01TIs9rnx*O!)b@^F=301pAK<%Wrtb;F`V>bf>nU-c zP&Q+K!+bLqRzw_S^*Nac?gVgw-t}f*ajjXLevBND}bmCQl?dLv!$NYbIrW7Po)!t_&&LmG9h~fIJ1u}`J+5! z-g1w)rCWh4%zOt7GZ)Fr0>n1#^+~tx3+~Kh+;{Rm;aV1geJLEm=7MRSo8gA(Y+YQ; z_z?tbv=+6cdeoPj8#>DnGE6IFbKcGG8Se zg1J*LDvNVVEk{X7V9BeeX?x0&V<9U*WqbVm_hd_1_wOeYGBIEA`mfY{un_n{kDGbA2V&xZZ5kQo)sQ@jn@fEN*5l&RIk;`%7B9mZ9@s zsU$MN`HX;yo}|0LO2zaDUcQqR86TVHLtaD4oOjewJUcsEvAMY(8=D)^Xg2a$MY$t5v809RJrEGA}EgwOTuX?x6_;DB)JG^4=_CfNRL|MIFy05hOyt8#NNp$9s->A z0nmE~{Wv@xaczi+uitSg#t5}lyFRXswK@R07FRE>$CV3faY<&n)&NZFfNU+nG$&;t zF6yxgkV0;(5PAY)pZ_j^IcIU+^3jqGSw*?;W>}`F?EY3+%d-h;=7n#dXm$%)As(B6 z;^xL$4l1axG@}BjQNKiUb34a@1NFSWkPS^Lv9X z;+`PPl?3bTK|y#qaHD}azS_uv0Qxg64q0CMhIzvVsp1p&ed0vaU!($&!k<1elm*2|F!er?lM1gOry`Z#&g|oh3S_T8jy{6g z?w`d$8x{(fp1@L%I+HjOWP7J^40yICi!qqm2vU#XcmXqb3b1Id2c|Qu6h^uUXl^<5 zw27jjY>u9)Ic6V4md)7WoP7vo2LOdSEcmHRsQ_Mh5BvlLlntPg?PXUM6wd}X{jJG7 zQiIELzFS7asJI4G7>~jTDOpv!R@kf@rc(GF0YO0r*$%9Ev8zDxcYjsQ&lB|9~b2qVYwuasfLvU+i}ndlQiYbVOy|vwmC}*g#vs&j!Qp^_OYzwj_NF=O$RZV>03XWD z@4~B)Y{Ieu$ObBXlV@jDfSzZ^OEH?VI}{XVl5a&udtn99&Pj$&Yx%Q$UjgG0`+S-Xu zZx}ajyckQ>W}NcfWPBFAU?}98j%+}5=RR`awzPDfld`NjZvjAPMPj^d1QS?g-=?oh z9_enVbFGg2H27`D{Hg#&o*KWxILS{y(>zReN;s~$+Fm0w`oPgYL8yG)#vWv|<_N4&=V?j756aPSbp3JD+4H_*51!>hM_7?BNj z^+po_S%*#9Ixf>D%WU9EP>{ia3Or}SlUFP!{g}pUJRPwM6}DazS4?@wjxU_sDg6u} zBX5^Bcni=3pBH7;r=!^3+#)UY*uHQP^Vb>ZXMidQP_9ngV#Aak3Ze=4lRDy)^S@fU zq&fR!5{H~TnsCKm{hflJ4Kp=C3juInX0H>AWh{sqvXm@V(Bc}0lr^zYz)}vBT7PF+ zsH_EODFI!s<~J&oEB7d~CGyA#%SkEMz4vr%CFefa{<+)Z zpjysTi&IFsP;MYB%GP_g`Ab5eGUOv(M6eJd+13zNnsb@*JDHjafO4EA%i|ySWR)te zz$`e)da`jP6+;C=i2+2XlIy{CZOH0jmiC6{fa7Vj0L1pd5kjLl=?>ZLmpUwsTsC&` z+j}j5@+cd&c&;;!!&X1`j@z+++=+dc3OR1YgT14;|L`bw58H9lAH!5It5d`HCj(+H zc_VNL0izWdM-S+Z-w;Z?zR zzUGwx@!;VjF6u6*#MZ?tgsE9u_FSxvqH=uUHC{pg`k*QL~ z@~jk3hUd91C*3${rT84-8$aWDMqcGc7{xUK&=Y5K+loNx3<&mJQ@uknn>gcW^j^hB3+&k*=yB9|%qc~^{;^9FDAZ*8@gKj+BKjHi&?(YeX?O88@F29fC z{_ascNJUZex0J?k7iibx>3962np8_lz*Q%*W6yRkfsYui!n$9v6 zeWqn6uTZMRW%5$x;+>^xEv{U<1&E&JKm*g%YWK3D(JyBsU2&E~2>S-$-pZBce1 zKP#ql06}0DwQ@!y&jBjqHYIXpB4`_a7Lw(*y8`JrMts+q2xW^E`x#<;j%Gj(qP>l=Iq)=#w;(+t+3~EY?mherq(d0gj>4R$+8zqg*KbqCS6><~Hg$_YWvr2)R9aRO-%VYjh z&JgG{-F#m*!O`;!&=Zx@a|Dw=8&Z;$BHT7gA%^9fC_r`bH0lVdt+f?ib>^cEirIk~ zwhvpmnA*wVar97bS(|`sI5v>%?H|WmcX#9KuiuTYy>>5Nd-GAe_V&a0`kVLS8?Qfz z*WP##-+1$GeEp3(@%7j4#G5>OcW)nnJdWMtlQ;k@ovYHdl(NCaMjnyQ2A=dY!UO>r zjaDZean;cdAYvCrjWm^~Y$~qlJWa)waXEFK6MN|2Yc|Trn(U&4xpxjAE-$ad&1asE zyASu$4{X;XCnnLSEbBCE&FCS&on`8nyl7c@0C2mz`;?8(+bcpq0ciN^ zl7MeFo%0zZ9j5P102~hPFYW<_MLUDCo&MwJky1tKf2S8{z*SN zfO3}#aME)r@iHRo__!B`RC=xUfV=^qc~==ZrK~iWxxhY2*M*(%)6(IaX>PM?mfI~$ znKfSN!)I5dWrrRU`?9>WhB)eKqTH3#D(R4bYF(@-6EJlrBVSrTDm?P8epuZAf_3&` zChxPqEBRR}7t7K-DSBnNHnb^fPt*3)f$6*ef2aNNtq8s{h}6vXG>>@9JrULOe8&Iy z0n<@cy`af&5P5$Vepv`l`>`+;%{q^cTv_CLmD;^Z?$=>!&FWGD>asw9vW)xv=(gH` z>Pd8tj$uKt!O;LFVu$F$YFvSH$TeqSIyqqnaM}Q!y##t)TV9>?L-vKTf*7(h-385N zGd8x?V{3CGwl8kS)oWMc>h&ve^XApKb^ChUe*RWG|J?0(@wuDv0>|4oZp6;kHXu`j zSqb_TxknB+OsGOBY+26+kCdjuxMZjH=XAmkrw~+8Z3MGtK(*3?sK;K3+NU=VW(DSn&kSF1!q^@bV3<9 zku2375y@Bq(FAeA@Y{x^D`9nQlk_a*WGahGHQrr_qjnoW!#V&I2mLO9F{bRvTPzD3 zXnI|z7VPtkU5n;mQoz(0@gpZY5$`5|=n$|R9QUJlMEV5NeL!=+6TOq-f;a&{kFhY0 zP5{&_U-P0cce^WPOFV&P&xgr4_tGdh62_@aNEZNWgXr8Hlcb?S$$^mm6#?g%JroMK zmU(ZBTSX@73}HT&?_0$Fr@W`Y&rgVp7gIM>A;K(Am)o=Rx$X(tGTNtUOY#5Lb(;g9 zo5h-4f4*(^+U%YWasFOEQ*ZF@63-!HnUS(ougPe$)zl|bnG|i+7!U$Pn+hptv{J9c zRB44Q zytosWFJFi&moCM%D_7zc0C?-x^|*QCdOZKkt$60y8}Zz;H{)6NXRgPyx3BX1I$(J- zZr{8-`_2B$)p+*S#khHGCvIKYj+<96#^s%jxUjX6g9B_Nu@T`MCZstjTd^yS+LDYz zg*7kuo$JYG_nivh37E=s^wY8Hi>%g4E4#kq9!xJ6$RjVMIu4`N^p*|li*(988`0eD zk4k-%&nz#y#Imc8!e%)ZbDsDKqU5$MKcgE|0J!1cH_f~5l3eJk%}On$`~B>0@165c zJuVl&%l_DwKY8aI4b*3)bfoAaB$_!Txbz(HKNnMaijdkG>*OE}Ky(Gu*Oq#LbPYgV zYb*nt00bai<7MZo+*x0X>sKz#fbLp6ck4<#d-GyEd*ebpca!Vbm#3Fks*#_Ab^&uR8{)$(ugRbU@f6;0#bbCl40RsMzdV;k>l&x=F0K2-hxecC9<( zx?SO9=6**hwG4AGiGs@&8=~Caa|_JMRmkPxyf@#<8+?LWxu^WkbN~SNm7HV1@<=`K zY4hI0{P)wdJzZ4;n+$0VlDVVI#V!7wJI_&`xhpTq$@f{dzMmbTQ(zEAzEc>h-}HK^ z@!j${Bu&9AE!wAmk!F6xx}EGfX>jg5k(&FO{+iG`u%4?|E&zm=;@RsL}0CEd( z+y+1|#WOegePas{g+an3eeM>|UAh1OUtW!C7dK$803yJ6ak~+hE;eA8%W-M53CnE& zluf>0iH*imtk)J}qt3Cq5GxfF8}rpT<}_?X#$-CdM*22MW)HU51uUEaO5b8hr>qpP zrGgPWY{`|usXRrI01DpM?6yy*rtllDzZt*wtN$eS9z9GJrA<$ zh&6ZOS3$U!?7O-!ypeeCfJp}IssH>2uS$OaERGXc#g}@evjIhvL=|)J8$2O|L>Q-9AEy+ zUyfh=Ykxi7cBZ~?08p2#7xaC`qbydX2TX~pz-^pQ+>5rylL6<0I6mse$$meM580gv=dg5nbAH=Hp0O)j z2QcmoC^rXWkat9rxB>F^ARsNp(r}jw@R#|co22-Fi7eO1RapCc1Y2pOE$`j2NG2UcjhiptfeV|%i}RPA9)A@H1k7U_G8bGCo4?Qs_S{cI^bJgO4t z(=4MztkJoq4~P%SG7QcTv;Q8u_wBsw(8cs$@l4KZ%DE<@i>Xx*xFv*J!Bd&-A;ppN|Keqnyr+H0fbdc5MBCMqyr0 zeI9c(fmE}y4;yL2;0DCGWE>F2_fe49@*RTbnD1(yrU~s>Zb6yHHRnAqLp*KFk!5N| z!h#m-@$jG*zx*rzB<|dK5bwVE&G^;7|I2ax(snEhdJx=Zt;v~YIC-Xd41mg-7LwIz zlFN=tqgUzADZs0&n64R6+*np>=<^)cm1r%z5(??IhMvs@((~>q>Pq`!#Myw=wKPN&j8Iy93AxIV6Pj8 zyB+p+p6~AU&&3)d5V%UyFc_F73oUf6_d{g3J8SvH=AeYTM=;LYH zo@g)?tiE&45?9I}+e>Zx?RycReB%e&@_m)k9UyZp@SLcZ5BtAD!xMRw3ZU^GS zf)Svyw4A{1L?F6AvKIqDY|n>EZ8_?-dZu{{E7T|28@jv;KnfBMhFl}8Y%H@Yqu5m_j|GD zz>L-)*TNqdw%~|d=0Ji9aVJgAv%5q(+*3rkX09et$Ui_bWtBKu;d@3NB;yxg$@^rx z`2?>k-@IFX^9(O!|Lmt|d!oVA60s1|Z#CNmJ0#=V_Q%=h+kz%o&YQ+8GH`V=8VT{!ZNAjb0!y(?XRP<|C3AZ>M8 zadKiG)K)Gux4(B32hOm+dmOtD4{|Jhj%f!JPXWwx*rfeaWv|&!mGGP#WD1B*VWDSd z0;%S+;E1SOA;8w$p%JiRxnm_+hZ(*k_*GCij>}FOY}!d$=09o9u0e$1d;!Zf!J``g z?4SKceC410I_C09)XA^xTZ=MIhn?8kT94P>_odW|cZH+fN-FVO>Tc*&Cqe znpJ}?psve&z9T7S=R>TXylXwfX@m%D-z1fd~vXYZiQ3Q5wL1~ z(&NcOj&^%=(8`I!kNVR%?4H6#BaSfj_uJDPA=l%ZWJwIH1j)M`Dob1}WPSZbm$WRF zDT^ZG#;b^XNr&mn_fqa>pqveTmf>vUTE=<4`RM%hr)Yb!!PK&zo&LUV`B9{57J*V* z7h&<3w^M-J6gIM1@LT{`P%1|?`FeJ%LZCH|vfB#Esp+3Amft!M&=P|}HhF;n^jY>SSxO=Bq4gnkKm*Bd`dVFoaY_z#=C`@m>KXL7wCY z0ma1RvMBUU-W5=S)UU4+ntCJ_I}chi|?8PR=)=OQLmn zm_ES;fWiK_wdM2dfpB!ZPc}^eDid#IAR{Gji9_)*Qb7^FWilsykHk-NF)K6Dq%YJs z9ldN(h>mE^}#v8r4^$)Mi#0Vi~!u>StX{9?4r`5YDO?h zUMm#y5m!#8qdTbd({(NW<-126ZpWYW#g_=kiW|<@{CNREXs6_vx~FsJz(_* z_e%v*wBc#qD6tQ=A7m@sVlE!V9Eb%@x_G zXX$zyDa@0LtrheYvd11e0EtOrE8=O`2rcb{CTDIcf_8%lPZp zmMsp`>@CclSF$o&Ujdi~Hu^l`+f(8!_yV-NBXe|sL6)(MmoQFAgB6+n<@bEDoR3ER z7!7PxB2L7O&mbNZzD@Qm0`vfK=|X1pCA%Y$?3RFQ&963B%B0`x&71^hgX8v&lWuRs z#>Q&SB((~t*2#OBCDI8{no)o>W$NTI_L+5oMP);uwz6PelrCtxNvK%KL%WP6V3N^u zR#^s~7$;ufQZiTebbWCj5z0LsSjuNU%c*hrZJTenKRsK~jwg8g{VtCD9{(vP3dyOy zP1uyoQDDs$W3yGN3F9~uIEOHuA)q<1u>mFPpGUtvVIReys}FPy&reY{o^$cNQ$dC>a%l{<0!F0Rgp){T4su<8M+?o@b#f$=^OHKts_8mH zPExYmARLkFESf0!DnRSV8rh?>5+&1R-`?7Y?ahrG)BxrsP+B+1I!(UsYr+ezB|ZY9 zl}foT_~rbf0D@pE;0ta!T_Avwl??e}Cw@yVftm^+how#cZ_*(Ux|*rJS6vK7z|l_B zdsqA z-*pE0>W&EZ+{q%_WSYhQ8)JX90z|A2Ybgk=|`=$6c-(3b?r)A zx_kvtEYk#59CyFI8qJNhsKbn!n3?rj0n!BkdDtH0*z=k$4l=BXY1-}gq7H+)aOFa5 z@LNR_P_JIv$vHg*G8H|6)T1VJtr`p5%h5F6C*z$hzTRv^vr%>{GyRC;5iD@v2qe22 z0TR3;AXqjzk+c8{aL7Pi%m3`u2DkI1Q4CJzhi_mJ+mW*vb`E0bUn56iDqrdrBFf!A_R}tp&bMp~pFl z_0+xBk70}Nw7N0r*)TZCIU8I?x(RTm`-I(j6Ua7XkhIx9l(akDAE7Inuv}zeG6Wn6 zAEsm)3g*=nCSxYPT z+|!Sxi43@|tzcRMs19*->1D^`I~||PoSd|$>}5*6lO6!;Z2m3#9**PD;RNtJjfeZA zc<^Wt4|n@<|G`PzeQ+4}AD!fEQO78?K%{AT1@OCaWhXW_HgZ}#7s9Inpj8w*m*@cW z1URRUlaUV`TfTc7$B*_CG*O*2{hi%@WgQj@dtKdJN13Ty9P6%$ZSMk^o6LyZ)Wsny zPKHkT=2V2lM|NabnzdWoJIRQ10&F&!pmUfeh#Cs{XvxX;oW#StbF=q>Cb=Lm9u1Nm z)-|UA)w-=rd~dm?+XC=DlW9^J_J+}-V(d^M9-s81%WnbG)_7Mz==KFr8{x1JhW0xZ z++lxIERI%^1w}t@cK}Zt=E!*0!uP$x28*ufIMIKs;UJ0hR#xEVm)EU`X26+! zc?na(B1290i?YaHk$PU4-S?O?WO;eEr#{S{6I6Xa+Y+9l?deL*@55Ha0ZBvP&)w5A z5^iEMOoBqzbbNju4+OxZAh|cp&Wx zdd{j2Gj#>fD!}Ptb^08uRZRUACo;iY2Y5#)Z3oud>bNYl^M#@~u^gwE_O2t@`-MD-InEfdB_u8?4(9Y$f?MP3OViVKy!o|(l-rkCJ0MN;rHS6umnUiLq z81MOV0gGX86h{X~@$Osi#<0_ki<{eVVdp|@?d)LNE&}eIRL(0`uVy}+Q_+}jrcXa7 z*@|#lc?iLP5YNv0>yBlVJmYwNGr9^pzG&Ehyu)yv-99Hs=FblCmXV;El@Ui`SwKcW zF@FJtu}fng9Aw|zjg=Lce_3**v7*aDw~O7<08<#|pl?4=ebmlIH3U#$lmPQ^be5CN z98)E7wWlBrxM{xqWZ^M-hBF1AGKmjyuHP%i=_ z;snl4Q>U-i9ug9&8tm0)R{+%uR37>zd(IeToT(fwX6H^7CYJ3Xz_+@6fL6cva0+X6 zneJh_JZa9aZvm*}b(+j1qTA^J z%%c@#*^Bg=A{ z>rLt2aFT4#l}(pRSt6d~V3v0Q(iBJJ5lBQPmC^L+Td|r)5Ck*I3R3V^=ACfGA6AcU zIcEd+o|er#|6uz*wz(StQWxha-~=H!MQ{)=gb^l%bZMeFJae(4;Al4$^URkP7BGF6 z>M=Ukf4RsGd((dwc4JW?mZJjG+}K=+OBc6bS!)1LX&kbVL$Gk#xCvn`F7b}7!0u@* zV!EP`={sC$pbT~5R2rOykhf(3R>f>M92IlBxwa7tJae{Ki7^6yPMlmm#TH*4CLXJR zlFzQi3g)~m@0y@z;~{B8Sr!WrnZh%^r(Tkx;#Y{V9pK(~90iEc#$6NK^B8Wk!qD?Q4Numi@gk8}uFj`@Cnun36iqXn=5 z-x~3+j3-fn*)9_A2^GeO!qN1vi~+A{1rR46YnaIET-&I{@+M_LdAgc{ldQCy_mn)f zq0M!*n)<4dm-P$Vv9_}wPV(URdi$bU8jfxn0df=Gm&8-=#v%YVr7}w3vsU04_eFl| z_XJvFwYi)NHLg)XZ{#Ys_RJuOV&RgN95MrW5aiPx<-2x15KYt*Y9xKmexnd#0hPFs zPx^l==*uGIu)IWtZlOLU+XrC!18&Nj#-?JILXwJJKtz6~KQo0)8A&-w3FEIYgEPR; zrGypiDQ05&(4+@22IutL!o<6LBUnU2A_`JmUZw+JT$CAO zG82O-=r9%BM*zVDHfa|u7@J*vN_thI8B-wyO-#E4bpV2F0cRhhbuJdTzIBl}RkGz+ z1w8x(3LvY&2tIdox@0H@3H9YkMQRqFJUk9NB0@fLUf4_l%QlUAfim zBN3ofWu^S3Ki)KxF3Zh^Cwn>Aztp4hld?~^mXG;r+LAF4@5Ex`&K>=%u7S0nUU=JQ z`7hg?Qa=bs>mlzv9oq+B`U7qXsv_WGWXh4NfhrJ=8cM<7x;`S!(#Q8SHD{)lAvgxy zDdL=6X)K8FmkY{a=B;hW9!tw@_Icz(36LE1hsr3=k;+rf?R=h$Qefq1|3N2%9s+dE zjHGfa<>@z*F%W0jWe#%%90i4CY2=%x#X$$But?|9JOxN| zQWTE>l4IUAE$yP@kre01D_h8A;2oIT-bp`JHZR1*Yd2E4ZFTpX2|}r7ivZ z?AFPyN2I4bcMg!+HA`PNt1&% zT%yEfSk{R5%En66VSSYq$`WfvQ#iXSWtkBUAm*s7(lO*LmH^87YBQ>9%~)Om+{goa zRaIeId>1QP<5!8s;8N9|y$*^S07N!itlZ_7$d zZJK|kO`jsyb1XY|rktma^UWpu(84g!Wmtep&g}{asXXW4qRYgNv$DKcO6A2hD=>ZjezSljH?k(+^9i;@fFFk7WjD)OU#mCso!Opk2W;7w)~w(? zS*md`Jf6t>DPa5bY~<_*+jrX(3Jcrg{I{E6nKkPSKou?-PntF}AyctZP&9w+_?$<6 z>sRs*u*xM(D{iTh~KgE@5o%Gq#Hn4m*NZ5WY> z4%qvc;C(<&MX?b@A0PUk;A}5|6~L%oFKbTO_~C5lrLl(SpcpyI$@JyHccdo#=8qpn1;_$dl9CulNy`g5gK(VO5*|q&$@>#nB;F;QbKZw8f*Zyk!!+-eqV{?5iSs5>c6Qo!< z=*n0oolbeUJY#dY=pEOsAakZKtcYCCK22xy+X@ZPhE*>&YOrb;FvrElGQgWQ0~xUt zPBQIiEZqmi#b9OR=q1ukH0%=9RvxCq(wN7^?2w;B)hs{3o>Pw%(#`iRTEoxTxQr|B z8)ZI$MXWjWPi{5P(hIjn4Ta~U0WyJ7(-usH0o7~;7 zpQi2UO3m-__IS-%0D{eH2#B?;YMo{fqLG58aB^SMRlO_oM52EPG~wg}?9|If8?+jey3e`$a5f{r=Xuxh;jVLEtJg8LOG~d> zWeR1Zb5qq_f1GX#s~cSv0zLM4GRghJlbmb7{P6qsRm~(3SGCW^vd!(y*uJopzcruj z81GC=b_%xz-HECXTOE$07y#Om>Qha8o||Ab4$mGOw|HOI0cDU( zxR#7p#3>Vq4C3K~d*tPWc&ua|mA`+jz!%q6U#a?lrJh3ocbK!O!i0xS{NrsuDcsv z>10n>$`-ft6aERjzBm8PpZXwk&$1;Pt&aRnJ|&|kE@=@wMcW5p`n%bX4}EFLR8lYz zVgSjOVK1pluD?@MY6dibmVG5{2yo4I*+%-JmQfOvO@I=PZ1Ay5m3z*4NeSiT9)u(V zs>1MUJnLj5b3ayLr_K;1i19p9E?aaGk{siX0NY>DNrs(4%J2w^R}pFzXr@#OxTd<@ zf6^yNcq(4;0mCHto-TtkOjnszb)^od!m4x~U|#CN@ZI9yH6ALe?2ml$NZi&o*7){9 zj-EO?JdFMQBjUh!%}U~_4_PG@6l96A7vtf0bCvq!q#ehAXRF)I!3oY#rAxylqI1a) z!Gy2r#!&J7HRAmqKzrO9#!pZHQ% zM02xOCcaF1mIMX9Um>wIKC%R;EdlZs60&I7nqL&Xd0<=;aL5f}2&;5Z#UNU}estPS zrRan+08) zb`Xe_r+_J-CrRLFxtj(4R02FHmJ?C^w#~d0DA{=-tu!C!&kEUN`b~55S<=g%%iJh; z$XaQ1D&U!vJA;Sf7464d7+s>7*t4>e4@&La#|!fU&g7svw3UZ~mZU z(C@?M%bcyQO6t&0Cr#mzSSAl-#>Tmad3*oigZTP4UyC>1ehYv-jvnC=d-7-@)>oUc zw(Ta>wPNVU!I4uj_Tq?2#+6>JU<}7nl|$=V zaCK3Kl4j!)zr9nKXO>8kg0xQfX3oOJRprB?Q!uO$Ed#eQ>S?xlkKHZ(?jHH`4QuQ4 z!Ls{P-*S19jlg{Vam(*%*q$0NwNU2;`!8)HczsaHVXp0yLLnHW+Mpb^&Yz*!2zzT3 zC!Kz@?7-cJiC~WQ`|JSfcyyklR)#~)vFIv`uscM!0)SR4^=JTwYt40(wvMT&A5T9g z=MBfcuVP*|(j;B3H`82pHlSnxD5>H}6qV&R!*4bgaG=>1}vSpZ^EYBrMR6@HwjRY%{c#-$* z4Bl!T$D41wMtUo;LOQaM2_|UVlEDDOQ-|MDS$+7$7sFwrD}btvE83UoljgfFWVf=? zAaAO1`SLdVPTah4DK2cT0)$IBO`WcST60BjNSwd~oiQJ*N!BN*PV9?H`t8FzUsGQz zD`%n7|0%;;Ab{FAmE1W%1(2?h)~)(VtdU0zD!c~IIY_}W5TG0< zpX|)?&`*u&FO!#TudHrHb9og&v*Zf65G#E#xjRD3V~+~BI~b;W;@<9l9KcKuPrCf> z=2FlnZ7L^r&3?hExNsJ-0(Qyms-xz}Gp||BRu1VB;z$&E1%}CcWo9UWH@RwI<0(&a zV}BwO9E+|M`A;2SpQELqUHThqU0J>GBrj!luowEkS$^Q@*-YP)y8!@spkU{P`g;ke z^RVVe!=E6CqiLB?*>#qjDSpoEavC$tN!K<%>Ga|d=5WaIxQ$7N@OJ^%5rCS2g^*?= zQg#H_oJLUf-$9pvBElAm_^kqHRwN_?#=;AbzTXji#{U zXb|~2in(0g!DLn8Y-c{{9H)=ai8D?Kc4KoB#c#!hosBp=+>84U?vW2RRFsA;N6*OD ztpLsd)GHUS#P-HUY```@{Ngk5+0T9=KJ)R9#tY9}j~8#>jN4Z)#d9|<$Fo;2$F++W zcotKgvAUub#u46H*HJem~R4A}ZJF8m;S`=C;{D^b%)v&6UT z8CaM8x%~Dq;w{mzq3_H}mrFJv768s*o|>)X$`7y!Ebo`Sh(+1vVETKt&4GD-oL?(B zrVt_g=k|MqQJofmw4dZ~G>!o#>IuSr(C);+Nh^J0+0X!3%KBumcFP%#`Y6E=(ulYb zcIptKrXbsqe7?e`X0ITflRV2VIrpd{sh;!r$t65@&Q5uRKU@YPgR zQB~Y*^jQ>$QB2U)?l-3>g)C@9yd1x+Uv5B>CukOA8UWR#hmoyr#l=h4d1s~@=cFgKSYO-9S?@R2*K;J-if)r+w^SUmQu1Un9>)Ieqi7wUP~n{<@NR5vksst! zWjVUN0f5{jO`8AYr+J$wL1iRx=syN99T<^AFkNX>QVDR{I!2swM}=0 z4O3uH=6iuKfyRw8P!vjVds%Q-`EX_{tqS`(dtPtUq6ssu0qAz;lKJ_pm6Fda zAroo78-(BEubBB+RB3_uT`TQ0%Z)D;j+L^plF4e>6rHnt3`lOtJ$t73XX5g%I%7|U z0;U46X~|`$GxnTQ5$DPGP*=b8e%!y;X0CkSn}Ov#lJAEdVf?)W&+oQ<*YLTfiJaY= zW(?CgG0jRD+Z0yT8`)`Ia6Jde0F{AbwnqRX0EvX>uoD{?Uo~UvvN{+Y@;CZGjL2P4&%T@H*2LPq!>=>YI zffF#DvjL{#Zag}8m`rkgXFFE6w_@wkrMUI%b8+qV?O0piip$q;#D`vbB`#gLmL}_0 zzw(v%_kaH9;{W+S{15R9|I1&E?(tF1OL_&+`|KA!AAjcm@b6&KF2>f@T0Hmc&A9va z8?g@?tt~GAbo%d{KcJKDg40ug9ndoENs`%5j*b8VmtL7MvR*fik9T2^u*kMUJbST; zSzoQnIspLkOb~M-6Z>m692vG$kDcvpK>uo7zI-)qT)iH*Z{3c~)wQ^MVJDt@?%5oN zzqxZM`>c-0ucd|M1mHoh7d1@f31#a1s{)JuJ_ilBbjvy4IkUpDZ00TTlvf#TrMOU- z9Bm9*hTU79XD+};`RJeK6`m2qIHwFrd4f+?cEBMb1n2`w>`owE12i|O9IQCj)|xqw zsVwN)yTMuICJ=lQ}ag*xYCJ#*r1K{4ay1SbUq6*}YU@XwqwZw44v?#h(_A)b5H z%G&%bjcIHMsBzcJ>T6!j&iJz*YLAZ!{GKDxUSTg=f!5!?eOG;dpX};gHq3sK49s!4<6$J{ka=4?zeM{ zJa7!S3{dJ>gA(6r0WgB|3bOF#H(rmw`TzSH@sSr_jBS+L6*oy%0>k)}iiP<6;@|#T z@yaJY3HUbS?t{H(4@i5ZmW@oU))5b*#N^*X`BIwWOBIKt z4v2}BhU^HYOxm4iG`m!h+s%42LCVhiHl)>8Hsa!y>)9RY;N&Q7+_*sn*XLQ-K9xCf~I?9Y|M+<*1*+xCiINyPxi*J12v9&^?VdfLCcQ#OnG6 z%yo@iv(ln0N9|axPXOUctRZjJ<+E6~p^ET~ca>v9-!3vR?=_OHBTp${N7LCSSb(t< zghjjANpjGV7}amZE1&(bxO($N(nZBaR#~q6!>Y3T;8Og`|N6`E7yg5PD>k=wc>Ddo zi2?f1zjHe|If?)2fBK(NKR?*M$M&7T>;%V3PENmvvMNYEA-I(aS##amS&R_a^&bhg zD9v=ty>Xg%&XeivN!j=U^%%n{?OtLluPxr*U#>YT5N4#4Fxvps&<9vg^D~DB8X*MR z@7arBNM$L{`K>>cgJ!SP`MPE6@BAl5xTj`rbUp36_{STBp8 z04_3nh1S~MvFc7YcXD_XZ@vC{3<$f^?nE1~I6m&g(a~`{dbA%8AMOIm-R$V@EKaLy z>nQFitiMYcO`{E9-?{U4eB+y66M~}yt35e6h({0Z#{K*6#=+ih`fcyu-y_WrlC^#G z)tBOjKmXZy@!1=Ex08O$Dr_1%18^ck0iQGW5#Je{52I`6c|dlg+lOa0&+X5fOD8Az zP{~l)TNQG z3I8}MYz0SQr|w)&d7t%twE;C*=Zv{?GXIy??G0kLGTE?|d_KYPN!-MQ$M^a6#Di%m ztg@wf@q4(E=^ z93R>xs7w5GVNiW&4->X(zWeA=93LHE{#J7iR;Sl99vMkCOfOKJdBd%Y&8qZ_m zfA~W$!bmT~O)7?)*RRAgH?G8}e-aPxd^3LY*Zw}~I*41hE>k)q>Lg5i8(x;ldn&9k zfYqN`X$>&*$LWr7xM%6gMG}z@8wj%p1yR&OfwbBL!+r9DYs+FY@ye+i`HG|Ks@$j( zj>p>48KA3t^~v`htg--R-lO!FrQuH1IO@ZaM}#wiS)N9n+O4)Ujdf)0(#|C+zFSxz zH{#OeYq0QZvA%sJs*Nqu0h3>BPyxHBA0g_7Sg>KS%p_L&tlE@i>=IHlEk*l?FKHq- zlC^5)^H^>^V?`qHni*vviC$IyX3soL+Y=6^r9|dH=kf8H;$L)2AtB7NdqJ>6DX3uu zR24xNR01HM)nPC5QCyq=rI}rGU`ow8CQ~)+1L^#k`U;y3!BK@G4DiuOPwZT-@6Z{Z zbf*ZOIR~i#iV)h}h)*TMunUjVu`OakIvwATNDWZhhlhLd`5*m!{JH<)KaD^AbAKv6 z@wrdL3$HvMmv3B-`sQj*mLYSs!D#?A_sH(TnS2Omjii<~7%L@AUelllN+M0M@ctO4r2UQ7c}1{q4AaZx`@9iD7>j`+NJ* z>vXcRTHjdBy2q;S1UBmV&V_A2wibh4C#ob+(^UO$K<~cz#V^Fq|GWQo{P>T4Cf1uv z@$la3v59&A<3IYzoPN*>QWuR&)C_IB0-y!cAt0v}pg=59rus(>Q@Lr1gl{4Z^-#Pv&?@uBBmh|hld3-P6&_{sQVfBa|SC;sqH#h?6B|GW6f zKl(HALtp&E@#)X~czog@#ETGLsmTvld<^f-(a>84zymWu#x zT4}`5E$5a%m@V7NqTS-yWT~E!CV?jXu&J{uj&*51_0()jf9B8png9OFU;Z)$;G$~3 z^EUS({;S^X;QjCZ{J$61uU|`_q4D~?2Ghs40;rf}Nc(8eio=I@VqpRkK&cX70WLcy-+6k&_YxP(aM6;m+m4 zAVN5X(H+6cWPYazch~PZ+?4oTxp_VQ#LxareEJKYiXrA+9e}7*iML&ECOtsPiKcZo z*eK=j%YF`<)JHhNoL2ECW2ed+=C`JRrob(mva`2Gm1$_V8~`sBV`k#nP-Ixnm8oA) zw}X9X7nf@B=38&aGta)5{VIC^$k2}Yn5@Z8Kpk0Ij^MJ!BDqddthSX&N-Wofob1HU z$=16A00}U$W!;YTF4DKsY>?k})VJ%{LISCMa;bA-1+(9NzPbY*J=&!h#xOwuc{s`b zx=xtwvdItc-HC5}{nz8*!CTQeco!3TM7d00cs3+Dh=4filEFrvy1o?&%(4H*i%Q10 z*{9P{M;U+e&irv$sY|8gfQTV+x6zS`Mqhu8;&WIeH=lVvZai~4Zan{N zY{SHF+`19BpLqrydNwXyyA?NJuFmAOy>k&3zn!ZoEPs*nI={qq-7tzoD z?9XO}@xeCRtS8Gp`%}67T@DD0{S6T)q&IeT;7UIm@pcA%XX#?!g$b5D|zee3L^?>Q>CP2Ft>+4$yP{)Uzc=yiTc=ztT_~sk$z;0iUfAWw2 zVf@;!{{842J<63x7ti>{!ho_IQ-PFaLF^;!XB|G4y|5G40@3QJc zM)Wr-KDr^S#9WD1mR>4Bj-;y#IQKdBy$>kbaF%OE<-6u3)fQp9cp=oYegzw5MrH*rm?;qtLqn{y2^3m z3T1UU8ml{0LICQ@I?qGT0mNQ!7#&#lfPApw&f%#U@% zm!kxMt5!l!(`KqZ*w`#;%U1DCW5gO3rLY##*Qt(3GqS_FXEWhYSWY zt=hm~?QJiB^D_M%j3}qM1ER7Ekf2G8o+C`K_YF5Y^&_a>_qQ$t`<1#>N4wLHE@0~L zLP73Bue=gJ^auVxT!En*BPVedIAxVC&EXhv*Pap(6lmujwc$rLn$zbI{~XoCH|-JN z5Lx@V60?kttTU&C12|=+_NBEujGEwRFW+-a_{PpoEW-{R>7>s$TYGJQ$#cwllw1qK z^b{+Cu!vvwZzcb7Sr;-nC;R|R1k)j)I^w&1zTbuoI|f}>NDWX~cJgFQc_%(OZnxt2 zM>+yMFyrT)wy&XQOVq zX(oVo=9jHCgk_J7@whbFI9yoI=TeSdtC3rp!MZOj1nzO3-G%@mS3DRHhI6^L`{OtP zOk3<8^PF@ZllN^Z$}Z3JC|eij>+!4;!#IMB&jvUfQ{=BZJdG0o?XXSda?+2z<8B;w zhH(UAZ^3w5RF+Qs;_@avERKUi{n~xYY_h-b8Rcbe6b8<5v7y~I?Izu@jFVObB``+VqxB^)W_XH+&^hY zhd6%W4}K|L{rD$fGS0jN2*O5tLs;l|kgUK??`J6K6y-Zd6Fp8)!m@TdCOp8Y`C3L| z0i+3zHf)hb(qbC*gVoqwXvB$ET=37u0nKxnb74-TwT`L0xtaNx>l%tJuHNL~!FuMsRpOaqaxOn0rVEe2&uX!&3i~!d&&H6Q1=EfEuaU$&VSlIv^ zQU2H7ekbnU+l`a1Gekw~lSlXNKY-;<;$U|#D=gQt(mmjUd^z@?G>*>52g=nUo|ms& zj`r~p%=9=8_gXRNoW;q}8I_m}+`$T!TsFH0nD#+8myj6&s-x*L;00igTu*C}BW&6s z!xNXNiD>oD;-EK;1HyR#c-{jvcRM5YaqJV{JwWqem*14jetQrnfaIa)y#e=!d2PSN z(Pz2$i1PB@sRX9+@Z{ie&y*TNdP)Qxd@$pIQ?;S-8*&8B*PRc?7P+rdWpodo- zRJe6_0kVtg3zaXrGXY_8a02%h$#4DLS=O>zo_U(KCmKxW+Z;^4)0gpsY<6-NJrYF8 z6@gSKNqps8fk}UH0=Vo^=X&{WcG~qhge4bfJEQIJQ6`?0=tA^xpD^JilF(nY}aB>j(? z$8FA?=?K{2`7Y*I7t^c@P>ujsm>x`})9GY*4okE##QvF1kZi?}Ew3m@$pC@eh7=g4 zl|vo&B^e>k$><2f8R;Fbu1Tqn_rgV&A(4f`9&1i#S1O!la}{ReysR=?Gj-+%)tndb z$>aszw{kQ;HHU|!TV<3Z>o#zZ>5zCiV^RlDIRRh}+oZ2QjqQuq;^s3SjuAlp_TAlh z4KX#&OU&jiccL>@Q*u&^iRL9&&te40z3e?Ec{(?(*(^9(v$@*w1qTPQZI- zzZ-7=(r@jz**kHE^S5(v$GZpZxO32tcMm)9)}xbnXSbdEyR+jvT)Xp#XYzQQ#|QhZ zc$YZe**%Cmr1u`-JUD2@y@&g;d)$dV*Y*c^JNCgPKc%D&v&~gn0XTaUWTO$+$^Ik( zS|(Pqu4LSq3 zKleiX+|U19w(Pb$M+mWvZ?K?o4>DN%d+7&dccKt$1C_%rM)MII0+zc9pubN)t>@Xr zOF;9FbC(R(x$d}sJ1Yy?^HDN3fY^xUq$}R@EgL*udgW!z?|Pb-wjVi{X_M%MG>{5Uyj#s0C&P;1ura^3nzfXG7tCFenC z!KTbBfc609cF-Bb5$0(JHrVM=Hk#$jD=^e`zT#xkc1fzm>WY5XO~N^ew*lgJ?;iqC z-Pi*__u7-V11R1(?gMH7;lsmt7chGpzAsW+%b$ z&R&n-u*d}2ZnDe!M*=U`2>YIXT!8f+KMm`*- zY~z|HeVMm#~9z{qL6FrD|B~2u|@aSh$;hp3p0f6_-Re?h`AaLlT6IcDl z8D^3lxn;u32)7=$1=t$cn3GrZI$fARD>{Hh>!=-vfQ0~Zg30%Z&wVz&^hbXR2K68g zj`v}ICEoFMvJ`mPg8*65J5RISUc8t2 zK{%$>gxl%dXUr3IL0zgf>*=rbzWrh^VJDHILOEsV zhVKG>`lDq%$$V@@Mv;4%#3!<&E+FEhG3G_98@u}e-n~bdut#zK;X%ARI~P0;V62Z| zmUkZR!Qi;Z(Y5T`&ihFPv9#PIYzIZyio6)BtLyP6{>`6>|LiaRpW;hD^~ZSr0MP5k zF(&#US#~^t-NJx1w{tyw_I=9chcJda z37mU?qWeCqS;o4{{!mk$?>*#MfA3?y9|8Wyd{f_QYcS0QrcPhqv9pi?nv^wS7Yh|C zLx67qrl^}puyQsr)3kHxQmk)o=4@lKMk^-;F-0^%kQ3xQyZIrH5(MWO@SZLmJxw0% zQJ{4qh+6(yFc!Q%b%*UL4g`+8Ksp53lqoB5T}P$z)wEZqxS5TK`t=KYeR{TkExq0kO1>I;uvKXE1Qc=qc>Lh7tjI5nuxt*n60;-84xD zc@16QeraG4u7qWMPxd8sB59X8Zo@VXP)3>7BiPOT2S@SlySwqu-TU#viyw}cUVbHZ zA3XrzCTXfoT*_qJPv4|H0t!1nM^K$?7+{x$BEW)IE{X@>30_VrB48R5@5u^%Z=Qay z$s$w~!^~AS*;NJs(edXA-U2XxDu}>1AP%k-wZ6R>x1N6%)4xm|w}gWF-2VPSDwtFG zna8rEY}i7l^j{KSUe|YOc+e^GZJG@q_FhO|HRWWbRjt)>u2LJe9Plv2Bqg;lGng7| zZ9pD5-GOrv*oXDO{%$gAcH$?0`lsXn{XhPX z@ye$@9bL+2QmMxjR_6#c%gS}_9r9bV%LcW{c+>;f>}xvaTSLr$Kz|0@PDJhOVO9o5 zu*yTgSJ#AKe@whOBjiJ7X_+8fx-wk375gOPu6sjYu@!Yz%H|JgwAX_}n_ZoCdut;u zT-c7)H2{_3H)}Vy*Ydj42ySg|CFAs_WosptK$@aLsqhW$D>q9?Kycz7&3{K^IlNS) zEDcVaXZdhsFVj&LnJHVThz&y**L*-r4lqedO1dn^1X%Ti+R8{jC7bDfVmB4N$V4g7 zZx!mdwiKY5Abq#rZpFMcBm{(-*qYi7>h=$>;wjK>~Vl1*}@7KO&3wAyQT*mN-ih1Ke>gt=na||N9&376&a`iz{Xz9>$$-o5Sp9xB49x*l z;msENl;!1QeFAE$Wk>p9j#er&?c49Q2*0{we^wP`aiMg;&WWP=ZH3_MSDJOX6fmGJ zb7{zq0KazENlTVuePbg&@{y0kI!Y}Ic0!Ir*z{;@90AxYI~5Y8Bd)qX^4o-AR~*&S zUIHqiK%R|yu--K%_1IX6ot^c#as68MGro26dVKgpFT{sG`~sEEv+?3fFT^v?J{#K? zx1+X#Ie$9FBtD^x_9&}e(tMO4?8F~8Z(WUNpS=-x9=scm4j#ojZ@(E`DyRSIzx!|E zzy9z3+qgzJ&VIFcK8@AtVqD!?jpwdz$4j@b#D{KP&Kaw2UfzkV_4VvU(5%;q-)7vn zaV?&G{+YOX^rp$_~2-b)U3Q*1F za%`^gjkQ|rY_G)TRx@@sS95U4^3o}CdLA28GTScyys{k48ih&vb@kYL!w(}3DdWj7 zGbZeOuW(lxDxc)HljqoI?Xqw<2c5Q+wV=|uy>X|IvYH8TjSUxjCUR!#3?4}AN@D}M2qa*49^Zl#~?TQ9rh1 znbj)hiY@Fgl=L?nq$+(Xs|H|F`OjhvpmxINOPH(|ceZjCeaExgPuB)J2OONjKKt!< zknmW6iMe9Isy^HgzZlOwa}$8JlYTcVpWeU+ zH;Ctjt+;jlN<4S#TD?*Jvzd7+0_E#HGu8Z__~@PMi%>CVTCMR{>1p+};*|qa&qY=%5#A>mb)u z3Y38>Cpc8s?+B2VeKJg*ThQvsQUC;zHM>yBPW8+Co;_MhKV-{3ar0Xn_jBjlxnixC zW_k&xlK1S$jVxP6pFUFqc}lh?dIZ$J^K(BBJGq_(q)>h@pmcj2Y#)DieqCVD4`d7Y z-~Bs(Cw~3c|5<$PtG^My@$0`9zxJ#DB)-D$H(!4prESFo^L>o@+3&M!((Bg(6zwpr z*`I6mjBNOTiH-HCmL*JvfRz5OK7u_!x`s%ZD~jp{uy5gDe4g*fQUuTc=+FH*7*8d7 zU4Q~XJ^|PV{SM$zNq}-506{1F#k#WzoK^@5tqLPx4vA;ZOaxGAuF8r8N*kbLq`o5< zn-iM%n(>Av`xpU$GRCZXXUZ{Wu+C0zdz#mBu|2@nXL|hs;hw_`0hp~#3|?5lv}#Y-2GP0Ow~*4C(ey5XFsHo6=h zA9LP}FaGF{#2B!BbpPD|p+H{0xV*EGpsBywp}!NEJC%^#v+S(^iA$ir0BCNmtt68+ zqx|kFmCDNMdiI7eD{TO>(s9Z_nOvDsOn%mFJ9b?4Jwn( zt+i+Xq7I2Q|N2xYmappRNU#kogKDjjjd%8dxOww-T)S~28w_0`B1Hu-D`q}FVBTkw zE@>F$zTjNDy$*X9+3BTDSm`*URQ67xV#zrt_+GNrbeEPNT6t$nji_&4j{5q=SgJO7 zZjmyEeapa+r?YV{N1Xl5zwy6*-`Mkh*wmHp#F?jJ1XLC+*M%r`8#v) z{I-n@a#ow12NYKH=)t3S{Tr{vyYIXc5ANTKL;LFOJ&azf1H*ClCrn|0&;EoRSZJqX zhwDkSICe1EPdFZRU9U%fX(h&($HUVFo&gYhlk}~%DTEPmac-dTxeYeU?2FL@j34YC z#V0=V*?8&Im*U~W2Wg%Q4w|O2D*a71SP41;f#$HlA+VYs&Q~fRlO+jS`Z5<`LzMDg0M@TvHzfke`$%8Vc390-p%sUe0Edm>wH@?-RouDrYV40Npsh( zS58u5x2lhQ>?3je_AM%mUW{PKBO4$RJkFxQvyH||#)qGP3Sp5q_CU}CmbKLZ4gJ*< zK-$>ZANS(+h3K_qrQ_Jz*p4eZmtl_U(Lccw*gJwjS7B`RI6OFvRl>JX&Az7Bu3lxo zmZP#v|Hk@e&PHW=%u^fkhFv@EN9;b@rNTImzwn>`#rRMD{9hoAus!<)SQ(LayZkKb zcHz8?S|jJO0+TUP2>@(@;1$gM9f0`arHgU#@)gc6MRN_n-Pp=01GN~ODa?tetryJ0 zTnC@ZV+HVZPJs)TFT}9XS`<@BlS<7!f?-EakZ@@L{PquSA*ULmj3y!8y<}9Z883VT5bjEt!EtjC-&u8o@ zV`EuP>O(N(0r}G1n$XkQ8#k#(jRSsiK*pAgD0&mTdQAv{tQx zC`YGRb14$w59J+1ZE+OU1@?+V^8A+f5Q^c*p)*lIXckUkRG379iW6AmQp{t(z>y++ z!^RYWqKeSl7OkfOYtx(%HqC#zNccL-E`@&1l$ItzHKNsyb<~`pz2Uw7L z!W_ir`bMVTmhry*N=*lUnvI&r0xT&{FtOvlmBVB}1t2q!z2x&;$b;o%tNKl0 zg({%=W!}Lw4L_BQ{4+g^B*MO>F0HJR*kRvFNLJ{(j#65}G~c?kO~o^a`w#9?5wzmP z4?iEbZ{3WSKl(D|wHSk82e3Vf$>|V4fps=ka}A|Yx1SZ8%e3TR2&&BNij`nd0caiF zg*gw1ZLYdx3h9D9nQqJR*=L`LAOGSPFFTM0~T)424 zX8Ce;3Fg+1-}sHM#LKW$8``pU8nA3)K3A3|n7D&D+J86pkM`q-zw}e_pZ?eX_t?Do zYCP&uxt%qrD3>X7tdLfhawUGmdzrkeFX?VLkF{FFrOi4(zZn-X|1VtF%!#s_8;w}! z=#+}Kyl-x9KSaEg5KDtZD+ET0o#@kM8ef?_AdbPF5`=rInPS9Ien84o0{2oVb ziHg;6@(a_PyxMdmi=ylt|DTLgkW_c1rs#o;(xJz`BeYr8PHv-MnD5kCNm!Iu7iJV+ z-RHoOzI1=gfLC2iy+l{k3H_tW8{(3aL|Z=kSu=cvkFPu}+dNO6$Snc!@pAz&fAG(m z&=aqrBx%lg(}JA6B>?%JKLy+z;l%aM$v)uIip>>FEKKZ;HCRRiu;CfOw#GwE6uSxd zHu&AF+A$v>Mvxn@s8v{0qgFcXYnsZc^tU+^5tbQYRWSb=oTEr6kfvO1w%}O>C9swH z=l}hmN3k?nk0~S)V~vhNI2WeMAtk#vKJdkG~)$UJJc^ZFC1E^?6T3DFl_m?^6nllXnL+*!LGkmw}J6fiHiwX^hvkFh`i9pSUP&E z;9WrO`i*Px$xnVfKL5GTCipF&{9`Ax9(KdVmJ0c_1f9`;X@i+qYMcdiJE!X-JUTg! zqgE^0_F?6kU8Edf(CT+{NM?FOj6(RHT~|SA%TE0@S4D5 zdU7p)!nBK4i+sKR@L?Ra+ws#s^C#m^{Oq5K^_?qm*d0cFWfM8Uq~F?!oy`mB$JH`e zsWxD#1z^`|m7L9fi^{p#a5}?49<1oJRBVaY!a@#7w|zR53rEr^7g}D%N$_*lt6rxa z?USRJPN;;Ct?kVsvYUgRIwttfU_<$0*VIpavh3=D6vwKJ zj-xf6HMgpeM@m=)vU?Nq2!J9S2o^SajC*a&@pcS*EsmWSwh!ZY_ilXk*MBwM`sUX# zodAJkofUvoAer(F%oQcV8kd~Y5#L1UU253%c-Gh15oWu<)DUD%#hO#5p&;%uRN2W| zRUk!~cz+3y)bzLYbr}I00gQk0Xa7xrZJ2#Xr?8F+3Mb3XNu*(AQxscv=&Vl~UZ+k7 zf*CIuD5$b_Kk8)Dx%{%sQ9a_QV5_t~&TFZ(Dv$m)!*SAO$L%}g(JA(PSti8r z`QP{XhD=%JA=sHGxwHk9n!qav3WoNFw2{GS?k-=x9KZF|-;5SOsOf(F#*O&Yr#=~< z`t&E_x#yn&jL)JApxUCIEG^?=sp$vCav-zpYU9*(PH^(h-8*sT!M(Wq@Il;r@E{)T z?Z)v*E614k?F$T$=2UUS)rKCYv0H;FYKho0!XdDNeF7EvE3lZy`fT;@nFcE`DPvVS9q>cr%wjnEbrY__R z%V!BaLR^CQdNhi3Qk zKV^vgDRcVzQ;;s36?;w=#Er~j!Zu%XiS&6mPr>%Yw&vS;{11KUN29S?Me+9I_-HSV z4qRn&ACv4MM<)#4kJjOCJbG{^4)-3!!-sFj{rj)S!~5^X{@&fVfA`JU-@g-&9=;Rz z@4O!Gy#CeLdw3_tomPTrvIYeJhy=STif&H;S)k*C|`Km45+R^IoRpcl5_*V+IUQ3DMn98oElnjZ+S11Ps3N zn_tN;Q-?>S&%y+p1+>lWjktB&zL}R|b7LbF&z5iBKRh_1Vyb1htC;eh4~Um6{n73o zOchqm^I9k?t7{ow0o8S*o`3#@IBA{4)hid`!j9dRE@ixhid(my%NeEwe7jgV1)(g> zmVYZCec9%j%o|il6MT*QY{7V)2zz65JAVAfew=W3;`Oh7JsJ2Cm4w~0G?c8Uvg?>B z%|=1Mj11C8O_i8=XxSRJ6{NFQrOS!9)yXTD#NGt_*RYOctdc}sJRK^M>39&UtNL7> z>ae&#>_3~!Nb8SpG;^4#OF&<_a-Fo^CZE@`LelsL5s@9zbv6MA$-7J=pgQTr#EHYn z-ytmDaru3iuyNE)BwLoj>w2(r{~Qyt$H$oxj{K3x+UBKLyKp6zoikRvJw=YWtA$nJ z?B2WY#$W%1U;4hW=l!rrPSoqiw@n6S;w+o4;YxdnkP;GPqH(}8z5@Fi` zy`j)^L9?q1LvF%K{-gio&&H$scTuuFvODCH02IQmsix^`Ywc9ur^5)HWgoCq!5rmc zE${440;C`?2Lhi@kVEL@lXgLJ+`T|&tFgXRCm<2{4I}-N9Q(6I9a+}e$_60o1ShD9 z?8w?cl{YK$uP|OsLIKimQc7OneV&(f15}qUU&?Rq@9(D%GiNS>6*&ouGRmW|y}cDL zy!d>)`pT;S;d62O_U%~R*v!#HenSxLz&aaESm4fuxODwiY+t$@n-?xnxi-l!^Qsy< zJKOR3&wVbow$`bvT38SD_|OZ_q)&8=c`OK-7F*G?D;I&MNlFS*`2`p&p?(JjM?Pak zoJ|K*Xv)qYdRQ|L?!6Q5+<7~G;wS%5{6GF*|3m!nAN+&S1;}^X-DnL@V?d=dAfKH^ zPaks?AaZsl0W{qh4H&9!kVYfR*TzbF0xT1OYE?_i45sWVSXji>;lt^JBwy_TUgNMn{>+5OE^nFj?h^B0eo-^v29 zdvD9%R?4&A%9`@=9{3Pmm5L>Yr=q{Qj-ICNi3L*&3K2rUUH7I3mJIHwBtnjXm zdCyU^T)6HG0Jcj@ny38Pg6Zx^5;I$2Rfcj5v^6`stVf^dzwsx2Doy|4u+82@=roxX zc9=K-O6^1q78>U!*VM{(#RBx9;V z;^!>*GJPvM^WAQ0Ha6O)RrZ=ox+pi~k*b+PAFB zd=ch>&G1VI9g?cVfr8`zpf-2IZz$yNz5E*X)xhSz9wFK*v9o&BIW_Q$RnZVS{ZQw9jdD4YT7jw!%C+*0guufWxsqLi2j$Lm# z_WkGxP_4wRo44YXS6_*%*RREuYgb^S&!gYEKmYv~=Tb+uIsAN2Ifj$|dfMonQCY!XR`0XN! zR^(19V{Z$=+UIh~7t4}A(#Ph&u5E1@>P1tlrZuhYLo0*xkFz4)YGy(xnN4+IAha*+JD?1!`cuE zn2AeExHLpAF~Ri#`xtiM+?hkJO%Uo)ACMVnzMTO=oO5(t9@jP+V(wWh3zqr}bI4nY zi~@#vE&u`!_7HHU9dA3js1H->wp=1)kj!ccW*}JTXwQ~Qo>c`>FcCBbZwYo}oew6* z7yiKKFlFn}?jB?Xq4GKgUN99romNkvR)L&-UIh{81}HMJoeGgl9iyy00M)z@6a>*U z-vMXG?F+7{oP^`(8P_awmmR4vxo978)eq#TB;%VM$TQC6DAV-*5YV>6f2uZVb?v8W z({+PZxVDh@jhkJql35ZTneqzextz&{BH5|^ZC6*XC?DgBtMtC;c|8*%HI z+j0BZ=i@nm>iV@?>CX&U`h*X-oQk~vV;}oWeBpCH6c;XDimr`{!w#l#eeH^D-HFzxm%4)WCs!0toocCqIGc|V!x3h70^-_86z z>9pdlx9`OI)|L2={@i~aU;3keB2JLO5f$O-X)$qY)hZRa73DB{cWe>29U1rv`B0@2 zwp*5!-wbdZF;=peBfG>iec8yKeR?N=o|B)*Ak)ltmqlCd0;Q~!|1ArO#Zu1l%AusB z(Qa-Codw13^1QM>?`mjwFJEWtq~^5;ZEz{!zs z$xoBJg#5A8lU>qCtx=%;?^%fX_qCQPk{!E1a{@UQEMWInsq1-;j5f>k8)V1;M-hT zBTi+kyPuK4<}B)?0bi8i0AmC^XJIlw<0+sRN10_ZTjBuv5e9sOyqPmo&3nOj73E)T zt|dsyWNi@2p^Dr;CBEjhtleRxn*1uA>&9ETG%<&Fc6O);O>1dnlKtg80fGfgGxNxD zkl_<{9bmnB?Q&ecd?jA^(2McWkAFNq@rh5yD=&W}Uj69D;}8D9FU1QlzChYXfb>bG z$3~uVtYk&GzOkObU3_)0V)Dw87-qv0fC{_I?q^y&eB5}LH@YC~Js`6dWGutN0)1Zd z)q*nLiqBFA+CMl<*8HWP_#^R?fB28(vedo4jJ=YJ|2dDSD=1L1l&PkEol2+?&Ds(c z%`|(EIBYf>v?!-#YXxJKqNCghsK^{vR$3>5yfP+gLg__ zV#|RCpOVe2cw#r}Lw5^NMQ}o7TTlgw>=T+hLMw|zS<}BrVahIsQvdTO&_5mM90|_uL3U<0MCLBN%rLra2>Gn=gmXogQ?zoh%!X^W>brvCC zLO~t*#CH_%BJ_lDI*cFr;U7Zbm$L7ug6FazIkg^ucRHZCn-mtML-=2~#m!)hU8QpajQMg-L5it!QT^k0*$;MsQ&a@}^rM!F5Y5!)`Wn}&C^R5|A}+z8 zTz=Qq+GT2fcNbh+lnFWc0`HdJ%M`3Y%MM^@LaCgHIv~fpgf|}ohx8yEiX(RsNEwvV z(v4tmwx)JrKz3};)@g)I;W|Ue()q8DB2b0x`rcV=?`+41Uw$PH5B335m>NuDBIA(d zjGP7!JpS-w*|45V>L~@kXT*&}4TqQyHeL&IT77g9;NZE)D1BOu*t< zLDI^|?n0WmPPk!Q1+yyo>3f2v0}2FC!?yKbU=p3_B9SopGCDcDMW4T_8)KbrAX;zCwtdD-<{c00-k&z(}U(r}6SS&y)8l zuO^afgj&jidlUz|_X{a0TX|16fn}oXmp-KC2j#?fWaH+gq4_=ENeCvt%)4BUHO!`YTM+FzODx;AC zsxS){XDH>loxD-VR8a5o$2}RI3M81>+A8aF#_`X7?(;d4MN{+iOfwNhw*$WbPVwmf zm3w4Z>?*R%$;KV8DT_`i2dzsp+UQgPA{AL+bP7JfGF!?4fNV)dNfdCE!{^czMv1Lp z1lTn5WuBwc9I~l7w$d!CdD`WuPQKe3o_;evC`)zA$vX6nl1HxlQ~{J+W2s7B)@xRH zW!gCzo|Ar9(HtBeBxu_TZROZl(d4b>P|If1QDlwSqLSRgMEAD?A=cKG*eg^-&A4`L zi?Hf(>9X^iZpX$}HMX`Iq_0Q%CsA)MWCdV9R`W&DyteAxqKn)EPz44v5vDcw|LK;= z7Is;&DHI_1vocxc+zQ-&s8%ZdZYPHW+t4{0wPCHgF8Y*lFS@;B!1Orwjt;bL7iLFp_~GkBvKHT2x?(i zzWP=X0_4+qO`V3ZfLOY7h_iQ-1Xxt0BYT*zFA;|LmUPmm2sec)cjU{8oXUYj<@?r# z<_9$muQ)F&#|+);S`=2!MfSDotQ`HiubO}JE!zyz%zt{eCl^d9LRYrbRB)BZg(cY$ z;D}i}0o10`D#t2vQv>HXy4E`Y2AU!V0PHe=+1Lb_0Hw+*;JO}*wKYtqTJ$I9IW?Y& zB>*B1*^+Bbt4S=t3T$bTzMZWHut-^`t4JDFr`sjHGAP4Q)$IyYTD=v{6IiIe!ZZQV7Fn(! zSXzZO;mgRA!fr}~P%;YQoKyPoZ2?!%wlAb{*A&bS_%e}HlG2UI)?mGAg5eUCmL{c2 zrc1>JBG(-%-KS74^0Bn|!?a1KQ`lMI93LH1c`U~YY|U;%0i{IxG_4sVu|bs+1Lop+egjwYEli%Ycc4%vL;*d5v|I zOoqu&O~3P?3KrS_HG6hYqLwvhX&UE?mVbG_(}DHdU5ayudD>&-{LJoX_T4Sr(zI6Y zKiH4;?ThilKlY^@Emfs5v~RFXZ91mHB2P5!8{}J!yv!r_b7(1X(`9Ae2T9(mPmvTR&&6qvHbRZNds5NcGZa&QhqWLdDmy2p6!VS)6+9ewY6xhUWo0BH{;5+ z=i~bI7vnO=OV^%@t2bVZ>$g74{-NBj-S|-4xb;%pe(odj;a5KyANly_zh zz7QYz)DOkSf9Q+x>Zd;+we=l<7q%gbLKrk((=g#Eh-8bYW)8dN@t9oz6+8vhGE0;# z#t0HeK`WI{1)!!^7zLJ(<}%Hg^eB@wqxkGJiTqYEp`GkmAx(cT@9FdNJF-3-eFSF} z#fC3MQ?}H#+ZWHM54t&Q3`_HrcqqsMuw*(J4e#4<=Y5xwwx24I2JB>?fY{6gHg-fH z6-A)sEEPm=0i-hefU->6-?CG`El6uJ*BYy&hx}9tiGgfI;CGz-+i$&<&p0)nD+oxF z1XF#;x>Yz$K+sRDVmir;E4?~#O!^dg-jQXi4O__po;o{6pSK%WnF?^iJ6JL20&$rf z+a3iu?q6jmPFeyLK*?{}M>5OGe3_S>ySYdD{WB}|le)J4Xw*;O^9ipJWQJ=cRPv#c zbJ-r9^x~ygJ{~W8=%X=$oz?|-zH67h1+0<=6^2Z_*=XiG549@tErnDvD8u2TxP3BH zltJz|S&d`=wU`9aW{vk<0}3WAyEeR>)eArt$SiZ;OHd>XLpQ>CZd@%R(!htjlX7lZ z$#Am`fH!>K?~_ZsTJo>#JnMbSjW{}?ij|3BmRI;D;hLYyU0Qfg(e^~A<_s2EZ*Iqp z+aHSOU;J1+_X7L#ABpFm`)EA-{Ht;MnOEW_VCwxFH(!if&%6{jZ+|#$J^wOC02Z*l zaqGpncKzA7a^v~9^2`hI@+UtVpZK9a5X-Bpp;yxO(d?6n0Puebonkh%rY867<0o+C zL?6iqy?=_5z>?5>6+dfdgkDpuj*w4zX7j=};C?;Ld%-q+mV5_POSYkDs^ZF~yeF%) zwH%S0F-NcIH`8PSbWs+4t1>LvY4Jm{A;87|iJyO}_AGi_E7*?q`Jah{6#-ZjDp$efK|b6*qs`DdTY?+*u~ zY}8Rpv!gnB=BH(MvOjr$HhvH*1y(B|0hS*;&h_(Ty3N^S$%4i*CTN)ztCEWpuB|z3 zp&$)#JLDEN>}HtBqR9KqmrM&RSYYS6@pIFBUO))a)UVdbhVs5;(T1J+{j6xPD5~5u zX9|ntME~Y=G1~1BmELK5;fr5VLa69$a3U`JT7uE862>NSXLm41Md|LaJOwgk#EEEZ zl*~plK43##_Du!I>sEXfeXe!^(}&z34`ABdb9gCH<14;LY84HlW+vp2o)ZssK#(-g2!>~|bdoSoaq$6Xl``0r3chDK*j7Mvvz+`&$^`d0gOR@|`n6ts>M-O*KHn zA#`cdncE0hV|687{K%`Zg!$DObYcQ45lm2h!g1sg=frc0>8^D82_5s}0rtywpPE;VwPlrVck}^#D;p+bs@SQE+?pA`k=D&byL*L?ZE!H=-$d0pk z`0(AFI*+W$e9D0j{Kz46q9i7XE(RIdpg)S;gOga>*oi;-$Nuf8H`aK+nf_qeWgRB% z^o+9XI?OxA*qa~ZpLEer6K!5roX&vQFnSA=6Dq76pb&(`bazIo+COI3Et75yq~ zlZf!XZkEg&%ZIDpGyiiVPb33R)Aq!sMxmFftvOLLg>1u47QWRTyTxbiT9~9vNu~n; zBh=USU1qhTf7v~?<1RjrJPym%2Mn9ijW(0-8WNcho=NVhI8}Y*P z&&R#{?{crOU%Rm-J0-kiSO8YNA>%BdlB|q)aJ#TS0HA`>lC@l;T*+TY#wDQnJrL&f zd>mU_E99qaUtlLqsnmsu2_(vadF@qw&bdB3WoJTD=>g_?eN9B5A`%oznoWbUB%_xV z+s}0{>;m{JHlo~MsfwhM zRwE5n?j`f143@MqkOya=S|L9g9Gw--3S~+h##lOozRQeI&Qu1a3`rE_Yg5r8GV4+> z%j`=6D`jq6oygg=+Ol+{O9w>dr2MIpE zsry8kRA-0^m%QPz$luennaxk=CJ3UgDmzs+<(N2Pf4TETl>{NS>5@IixAT12RSvG_ zHIKzlS;it0j%*fzwNGZc`%y}jn%lWMMAY3mP;+WOa?tZ8LbC#}tivX3eNBbuo(hn| zM}3*^+xVfWyScrE;yJknz=VLMe~l<m(#r*jm&euoNy^3Vz(|0~3Ckut0iipL7qy(Ty& zt9BF|ad0-XT=|pp9MHnKyWLb9Fvl~jjS(O_>UQINM0t*2s#JQpiYR$tgPC$@-Qh$w zSy@tcD{C9D>Gf!=t;bT0$^)z7j7o8#*2H>SiAAkKtRyYPbI6B1Y@D=3E5=?A*=CS( zlUWJ)Do=&qK200h_JnSfgA1DJ$H~@53Qkbatg?nx;d4i6EWl(Sxm%!uLb>NVs$Vi0 z!Go||?_E$46717i17KBhO>Mzgwxhqw28$~1*8sgbLcNXvZfoA7{MiQ;ff)}3ygq`( zH&MP80C?l}Ed+20Q_^lUvOxi@Br3s@csP_Y*szO4D&^Wxi`8 zLydRzSIUk|yCCc6CC9lt!pl?(MFL+g{mZj{%hq^jZgTEVr*}KYl+28h*(Z>a4t7Vq zs2KXq9ARd<2HhTyq1*tEdFW^|0V!MUWjo}TN@~B`?9M~p*szm~g>-FhZG}_p$+Xio zA-l5wCZJiEC_%XKtiE9zRBBE84OgP+#N8XK06M>UUKZz4CL3$3R9JS7mviZ=IL`*1 zoa6=2H6v|#cd2Zz3DyF$Y0EygN`wUhFeVe`&-7()2s``x1m7Yf%x0clh_-!sDMud3 zvdQ8k9P@PwyRyvhft5Fg3x^Z&VbadLPVUD7ZiURI#ygN)t=%(b13xc$QO@$8E)#O3Q(0oB!5CO?l<-aX#lbf0JoX%4MyGA-+d4#`;Ve^bP}x&@-o!*GYr?-%Fg>w(e~udXA1NB ziJ$tZc=e+nOGbf2r}=`oCuHc~NhXGL+i;*+@vXf8Rsk+{uW>BqJwd@1ckjKMvjI5; zp9{bZ1|tL>5W-~3NvF{kO`=?48AVw-n`Fy!op5Bbf@H7PiGI72V5UmClI2Nn5MTP~ zKSFdT+;8RkXN0NWRhFce*X~Mg`u!51U_ye7qSt^S&C9^KDxFhPFwBN60JD!0rjL?m zWZAaztJ!vs(r_bjX?n{{bI2&U)pXiAe#;~UIp;Y&Un=a*tQA*eDI||rk`mHre^a|F zrT@+Fxu4_ZO($%}{FRaF=8(bap3r0zAZ2?3m*CuJ*5j?W-U5WDar62uBS;jr7)nKF z9E_vguw+R&_bQbcQ6QfUOD1d_u^?*8IS*_54*1REo5Hl$hMp20Hxo?t3_Gz=TgoI_Rr;`+u; z`r#L3ggkGFaX`*^!Mq@k>^nN4BDwSWYgD=?u|OH5kCpe9DyE%BNw@xBfk$_N7DukF zWQDV2Sx{;6V4CHW`EsKfYn$7#y0%R^kcW0Z!PwG2**}Q4U;9S9_8VV`H^2T{@y)M& zCGOvSJ376S=o}v=h<7@zI5|3ugM+;|1l;XjS6=~`DMNb%RGP~Prd7&fL_QAqZ-G2o zVo#{|TU2;9l(kMy0Mos=bLW2SAGQ*BPr6iKe5VO>KYVmQ{?h;FucWKwN!e0vEW^jP zCw@LtH(3)fnCHnb+4I-8r!_az|M>p+=36;tJz0gmE)^LzhGGl>ryhW0ZCXrbz5qB2 z*nF;-EY3!yu%o3m?AUKnbIakKvgTsKpN1X0x3|~h8nt^LhMMLz%A0W)*Ni-o6VSY7 zI_%!Es;?Fh@tRZd31&7t>Dv?;PL7VE-D)SuZoygwshkmr00o^XKqa_m{4oEl6lAKJ zthW00VMDD}D_sUg!akq+ip}2yTq2jP=YV#u_YTmQKYSn?*{q0lxyarcFcuqV1YeWj zFj)O}vS6^9N@19c);zJtgWuTM*^2%BJs9^|en0b)@SQo!9T5(fdJ#PJZ@XebPE5>h z7b?wfLD?E^dtUvAOVa*-dJBxw?dA9(w8f%H68k9MKB}Izif~q z@3OQP0akV^2K~P0XZn@xf>prM3QT!1kDMCOvU1dz=}+Y&fAp7|9%nSOk;jo>&p!KX z%GlXisraX-dRBGASXQKma7R?8GP({x)a~hGw{q4MqbtOP33V;#k|B&!DoTELPP#GZ zkk{=&JiL1^zVWrM$6J8*;qC)~yN$dYvLD3WqkGZb-{;yet(*fHWOo2CR%3O2Cz@+J zY0?jnA7Y)2whE?lEo(nL8}Z&rw4GOCjAaAJciY`)pTKhaRsvcKRKyhH@!mnW*ktGU zB!*ZtNkqOw7oX&9(L(=z_xIDLfT|c4tiqh}LtClrIWNzs5R~`#wdMPQo*==wfYa)9 zsi}47kEnq$RRtn_UI@CwM-?p8Jq24>cSfE06ARB#dsDr_?b_CI(l6Meb__z zQ98oWB_M4n=_oC*HiX&D#zrGyQT8bq4iS0*NuQoW4{cGl0n6?`f}z0a62^Yn?ovgG z%`bolu(Kh^IQkvIK%lT|lKn4b!d4Oj!*n=KFp=d6k^)2e;AC&SpMwhcEu#|{HR}Zh zEe5|`7Q=JYl--E5h)V?^@EMmbifcZZw%gC#j&FYBo4JCi0F!fh0(4d&zUPVrh0WU7 z6xlms-ih7L{e@8js<7Z(AB#BI9ZVmyi|UzAP9h?M(}$WC0BO$#DxQ&13akPtaFqF^ zAJIz03e@~C6HA^MC%y?=wb2uFge}(qP|bMCi4c6>yh*Evv|FiJ(OWTT?mN-6`Q)kz zmoHz#s@RAD=6HXy0B9|6jOYhPdC?Qba&#uYk(8Kr3u326hRuU~{ z`z&Q_C7Jv`yY_g(AK!dG@8#>7j;0ec9U*SFtg&UM0G0xplbIk4uq|g)N3LUpK-kJT zA)LPE&0rjDn8W}bJYB3(%P&Vya|lIz?v;LPXtwg9F~v$XJ+ ziC9Qh0;@7*>-MFK7m{VZ_2wH~ufQT5lkYd}v0-O)!E0ug6Gum$$#|@c^h;|}%DA)3 z6*6jNA=B5Fd9Z&N8#bJ9ZY%u?z&a&PBql4TA`$v=c}JiFwC!;3x?&4}pOwdmGS57s z{DSYIHogwXYH_%FC}0E73;{m@vF>vwj~rakSlwANfSQ zaepuF0elaSdT}2Rym#1+yL%_`&cma4_t6pOM{#ez9S;sW9J?HQ@#v@@_x3t*cefq) z_m1NM&v!@XnBeQNwzdUO8BhJt4htS(f)jNrs%((8F>LCTjW+JpVDZ(=p9<%dW&Oex zKztG>Cqv4V=aJ!RwL!(vpls}JhuKeBT}^jwYb90yRfGdT9ibyyB8&N40#4?uxt0Q> zu&0a5HLR48Z_{b=Mx6Oh?0LWMZb}B3Qk3O)+TAj9-Z#5mELji#Ar#2~{8LyclpF?! z63w3%c<1MjZ~j&=?EZqvA!OA05R+q=z@x*H*hPSkPWo}c@59z84ttZ>!+bgdV2=Q& zV-(_u{TN2kf-M{krm^1}#4$qHnpENh-F?*VM}7MuadmMN^HNg@jRyqmTp&xbg*Yd7 z1_T}duAh_GrhwYX4(`n?I&6Q+geL&uI)twvEMjdCg%Hg2twtzJQ zT#mbUmt`pgd_Ff>Q(=wfmjaEDaGt(USf8$k28xs|*vbNN&k<7WZswmr>u=*@pVoOp zlggS6RK&5cVe{KG69r7aaUJeSfVVQ)e8nU#C+60D;q7}hCNb&I1F{< z*i2Bu3A)V#Fp+P;>}8q6XK!yW7x8oA5gR@Fgsls}Z#$uiKFSICJ0!nk{iX2*U?#sD z%wTJGVNbGBT^Wu?r?Q!W4ynkwAM~kO5o+e^GSOdYr6mit;&9WiX@6eJWdOiU0IZY# zX?*l^UyQdOoWz}jUcB+B6>mK}j<@e0#cS{G#W&u57{B$#z4*=7?z7*EufDk(-*{&) z-ne@Z-@LOIZ$3DPHy-TASKoLy-UN`3sr>CrUEf%X%h#`G7rff)YHVG)9Jii(K5jnu zT&!+yM%Q$ahK&oC0mF-N{l@LMeDNyG@jTvo{oS~KcR%jF`zXHt)wklUx9>&kxEBxZ z?Z%@=`*C>GNnd=2{IqYfQ(96enNHbkAIBlb0~p~h4CWCa`k>W` z-BvFiwz{$39mD~Ql9{^80zCS>zSw!!Bf(Q1tLb~1+S!^vC=;PfW!1?%i<`rvl)Ly9F%MylrmZZ+BCF)vWO-T^ z#NtCAei0Bl$@gTw`tY1++f@-nNT($4JmTu)nf2tFGIKnO2a_)k{68W{3Oif>> zqpI{%I~}6~5L|~zpthV1uk;VLKeVn5eY=2JrH+|Cj?33>#|nTpI<@a+1)#&scXoa% zi2)4HV+R>*0a{0$aU67panPnx?+jppR0POPU(=p48xl`JuGMK_jlhPf>o#^a;`;5| zarM^iSfr93o=h4Rv`E9 zK8iz_bgw(c5*kne>Pi@7mp1cK8JwI=^j>Ed#WTAqQW+|LWC(--#y^(He@myI^zC;A zrtgPMg}2Y%Tp0yJO{*-E1WcZp3BHUXpW~*-0=nM<)O>bUmN}UPAqp5dXD7hrr5yF7 zU5k?H3U$o>fO{j3Bb2EP2($sRBNVuWqMTSWb8Mqj9Ta8&6S#TXc{d3YP#^@p3j@^u z#0PQ&lPqTzSAj#YBKVwj-qur1*ov*$)bb=O8+P_FV;#KUGz^cjj%0-L71=C+K< zN=3h@sdM@{19rhYTkie7-HQZBGvgE`Ft7CUWuBT}MkKp%ox?_4ZB%n#GY)V^1D!%H zTkUI_g8~|+ARwEQRudufc;1u3NuW2@H@IKK&u?A3b}gULME5-va%HtiWm39`*%#Dh zXq#*-Ol{_OPz<+cO1`dQ96~L-JWFC`cfS@;5GZZ5_JH0nw{M3K4s%oR%rRA zAr}+fxl6N^AAm|11(ivTP9seMs1`&S*ip;Mt8NE=(&`LVKCh*bQ6)TG2QqzqvCcz_ zppox3E>Qsx_h+8{5R|$~SvEO1mY)10Kb;YcNb}oc>5(C}Ih5B4Wb9p#UACyKtcV2f z-mpvM-)29df>?|z*DuC$bD0YL5&JG+JC02m>H1cFzsR_3u^%U`cIJ7?0Qt1BwUuS< zvf|Z6ht%p{M*gtkOooIbU12ROHNdrfa>9EH(z;s&Ai7b`?IY(h_?QF$|KJ?-2 zm~Cf&`v%%kTNWiF)$|n9WL7dJ<0I=jb}1A9#385xs^3gzgrb&}1kTfxm37;Sp3DwV zv@s}|;!IIwY4!vd!1m^07p5NBUlSSyIJ?xx!1^MYoSP=8d1C9g?tz@0ia3vnlVO^r zvMwDg=D#bVnkL`z8!`|r2Y2IY{45z8_-tW!$g7~UzP=f2n5H(&xS7AY2E6A|)%rbM zvuS0`Mh}Nb3Sc&-2lOvvAiCP0Q98lG_n(-!10=cHX3ZC7_ z%+FI8HGr9{l=q$I*5B?jR>63#G0V#Wjwv>d04f!lU^;LFlk!M~V8xu1(eT?wyFQhl z{>nO7M4=Ou`Ju}t;@M|!r*GKqRyl7g*{_%?*7h_I;BwqO@?=ko9CFJ;P7Ge2cegS= z&qg_WJ8W*Q#l_2;0P=Y}+`k`thmSH|*KS@XUMtAddaPmDSb3=%b|;k8LUQB&?nCx_ znP-~x4T$vUDV`ITt7A^;BS<;rHg| zYSzjQn_OS5$EerlV<DtCL%wb{$?HL0DQKEWK|6hnR9IZ_SN7FqqY zG8kLeHI?l@nt%_})JJA71tTeI+k(iSw}$IX z@qRlF_D+cBA~HnfjXo~HSgmYbTi@OhRsd@afE!S?pR8R5jiYTDXSUuxMcWe%rUJ^> zUwbWn>+9c$Z@m6`{Q7VGR{X**{Zjm+fBH{R{xbW#uqlk1P;>)jpa4;bG*3OEoIaNf z76nqtCR0JK#Y?aUd~d&s|MYrdmZOZ6+;jU0Vv1vW+x@85?f{rQlvai%+eB$Jr}^`L!KVsaZDB%92Kx3;d{QIm zreKl}GBz8WoKasN>dwwZQyVTIn8QS26DGSsoSck8MVH0szjVyE?8)@&=MrG;r0#cR zZbX{sETHsuiz-Z3KWv(ofQBm@I40dzG)-qKE-NZWd|A1fcPei2H;SsTaq@{zTNr@D zX-*esf7J_HJH)w+sM1GipUgV>Y#ujYmjZVKR9IOizxggum~InUUzRZO^jpS*FJpG@ z#rFC--yjYA+5eMICbM(WV_hlwfi=msaw?#y`ROe7an3U^F&C2)By!HvW!(gVt6(h< zl)(fGRAOhC+$$@aln<85x%uLpx-enbyJmf-+fD%1qA-m|*0 zk=?P5VeEqV0r|5BKn_OdREDLO#g$7Jcy2AOT(}k&cP>*l>#?(aDK1~V8XMbK2fALW z^%!>TG6=}-AH;(P50Jl6_JQpT0c7;jRS8nBkR_`FEB)@E#dGbFzEkpXs=G=#cse#E z{fXQXOcBy|-gztj@jw1Y@e9BB3+#U*{?V`gllYZi`P=b#|K8tC{}1I^Odx8>(lYI_ z)Sg~Px()0-r58Z%-@ltRwaiI@wING1LLRcqjQty}b*o699mu^dHUKHv)x?lwk^0DL zm3np(zxB-Z=nva~WdX8m)uwiKcU-vUwMwlYO&02=P^y#yr?}=M$77U0->75!?W^es zpE81km;wkVColyt>jKJYdhKWFfCB-=ck(`INxvrXDBZ3EH9o+50#5Oh!hB?lHY5-q z`)BGFaI}ZrvrMD_E$FK>*;h03P>ZfqR6dthKvq~jZ(~;RLCOTH0E2lauvx*`dH>$s zJ6Q($a&6qo1>MPCkO#C@0rQuRb~R$5wyYor~z@g{o09mo5P=0;qr>VJUt#rfpxm63cb_Y!b2+6CXBw9?d94mdn|LEwL@K59NmCNi`vm!KJz1{$s=!QdDoeS4;T;JS^ix)3rIjv>Iwhf!t ze{TO;D;&$-xnkE=SIAE)3|O#hZ&``yTejOHf8HQu>%FAf0|{eOL!owM0HEc592Bn7~l`WOG^FClnNR)HX( zDG3S)sqE3#;3mo;6Lmz+vI?zvERB(|X^y37tqEDlZavRFcRQ|Ky9C>{ld`y>nPx|H z8*2o3yFl6aGD*|iR_at(6j3*Xf-18UIE-Tf7r=FRPge*N^HZAt=#%H zx3+f(yO#p(H_NgSR4jy{i8z%_u=}p8OIDRWQPah@%?mr?tFQu{%wL9TJarEUR&K^E zyHWvcWoZ)_FX=0O(_#(_T>47OyF}VF@|}&%jr8@(m`dXf=?8#Ke~u<2ek3sQ#dpk~ z+&DL%{N?lJt?@Ixw&V*-R!})<3F)&z?ws@pzGM`PPGsU+0GLB2?UZkM7$@T>OEk^q ziE@{#9uTKYQ&uSUPOz)nIe=m%=(00q_OWc}5;)n-TbVS8`2V+eAAowFSAF;&?Qtbt zZOM}DIEga}VT3|Uq0p4wMS+$MC^ePCuiM}!?FiVQwGk{GEQ9=S6y*s z+qhw4@;=q34;^YdckhmTIXGQZYuoD8YofAdVa&D_tA?$UAu!UzLwV2YJgcvc#2(C` z7|tCw7)dHea?SVGfH4lpj2w6G-Q6C1U{~IwBP>UNVWIS}o`wT@$HVy0Nj_bu*5?2I z@Be<9rsuadzZ>~eO}yfZKko%;q6}AF*!$7uAillsugJvmzI}W4v>iKlCEDEC?z#8= zcE_D}wNKxAXZzHxx3}AFyR&`lh8x=5ci-1mCGA;PZEaIiy8RFc;fB~9?0nf$DhHLI)JLMcio&}=0A7(1jHR@f4lk)8!rbQ^^n@7uW&JBo45g zi?DP{07m_}6}3|HT;l{Z{TC$4GIIh@o4N+H%R6e5q`pPKbdfV$zhOfGDMv6peJIzC zmt29IC{1(UXLpR&udp-z#ParuTW*M6A1UBWjuk=cx38!=<_`Wr?;Gi z;zSA}X;HG-5wi(eP6lx8U0_}*2e^0t{`@{(_GZrnGFDatXk=V-bgR2WuwVm}<;idO z9Wk>qjvv{dR@HR-!1XtkgXl!pIPUpM=fXd&wQu~!Z;a+#qNGW7(6(n$CL@xYw`{H` zWNVr=>({T3GOtUMWqE)#2PIDQB~n_JX4ukYE7IIZlQn>R_0`X7U-xxi-9G1YURag7 zcFkma*~`ALUABGu&|u}opaTg0o*oRFs7sawG!qu+8{(0pO7))w13a*(g!g3_pa0Sq zrAa;&#j;aV6xItRdQE2rCu$RY#vlSxqD6xy6-_blydXLeMNo7+`i{Iw(g4sD9{|Hx zfw)QiM%@7mFf-kTV_`hvhhhFhFfx^fW2l`oQ;q<41izJUCLuG)Vx{UBKj!-gEjM-lln=ozWVBRiO^_2@&_gJx0Us4U& zmBX+%XUbU)auEeEL*YaX{1~JYb&0eADG;`BKpIB^@k`})$&1lP`Z^? zEMFBTcf1{(I$V*szU_!Qf71%7`i6IL_FA+j=H*vj)vkEfv)lGSy zxfm*gVD$Pk*R5UCHg8^E9sVo{m>M83N?xPIF~BnFq(20QVe|zQ07MO1QP+qsZ?P~UO){1`7MGY3qVwxFax!e+h85c9N2%Lz)(Lj00P9c)w@G^4Z)gh9L^cDXxMRZ>QLk{++13HRGlQh6^SfYPp&;1 z83Niw&f(QD{C1Z?K=WGl3+Fm#5FM~j!mv;HOtoS(EACjudaT`FF~u4WO(~C!!sfBr&L!tJbycS6$tRJik=EM*}Z=#!*H%7kkNNmou{-U zbT$U9D3li0&QZCdX-lyUNl-9-w}10*{jCD2pmp(6Q;lMTfWvjs3EwK7AP%D&eWsfD`g+Z)G|g!^XSKjG{1t35sH6?tbO(@@K`86* z0ga|52OvrY3bjXRcx7#C(@fpAWlP(=YgYh99RwuECSYXhQSFA6=KwVxQ;eiLtSi^> zs|NP(KNzRDW;h=>?^pkAWTJb4Gw=*h)BOMmW{;hYbB?qEz}B5tQ#|149{JnlOI>hg z`Xtw{TU&KJd|yct?S&uBSo!I52c+a6ik5%P4UYVk=j6%ZqL93nR>N?8I)J7pgYc-K zZ@*Gg=oXvR5a%N*Ef5tYre$nozvjP2zC4ri0L;Dn_P4w5xxXElIvU+v*d`_>lfT&+ zx?qMoR`C-CPuENgXQM0!&}Y+HooIDsKzl)K=H#(MDMuXmsblTb%ye5E{@h;{9vl&A z9L@2vjohkMl9q_U%T!03O>}ID^#1*cP9t}%9J*>oiNJ>Jo-TChf@u_O%l2ot=REJF zZR5r(+Qh1j0hTo^uM}29W0l2Bnj>f8Nl!#6W)ALa&wuW-+F$>MuWg&xttkUo6vd*r zCeoYNSJwitB1Qkz-xzN-f1_;rf_xgn-&*!5;>R!0K>`ZOH;lwun)SLTeDyPV#K;#W;#d$v0g{@HCgcM= zO>iT*-dVYFbvtaTQ4Dsr`gKoMB%!%%Cm&O*3^)`Iz$kwUYy#ZFs87+T2p+<1@~O`^ zhkqMcNEZP}J5O08P%FIR2s9&y8;-;&R2NtrPOj^l0|3jH8|WeH)Mc(~j;~GgFZj?d z-?qK&+q1W>$qPu*RC9;{VaYoHif5zJM-AA8ckBQ(jQQQ0{Q7F~l&Z{g?h6PLl?Gfi z@qLcO_n0)%HSKe^K-E3FBxxd(CmAd2-S^y6Wd(kUi6>c}w&#GR}>~;d8jvU>s(SK9S#!TBhC&C-+Ab9953$ z=7_BH>spmGdu)(8KGk;ZnQph=abMf9Gx7|N6Ol3Xvvr=y^afIWDrI)+Ks&g1XTb7g zTeV_wTecw1bCA|fo^x$QT3_o{FKgSkOt$SCRwYWEYCCt_-S+L?(GE@RYy0=^ZTt7_ ztrd4x=+RY!R>vYAjXtu|)VGrA*wNu;IQp$0Qlh5;v6M@a0Knw>&1tf2ZcAebl;55g z$7gN%l?Woy+R-$#?Pd@BM5sm&zv%N{8YKdjln|KZZ>-FGLycNY%HM zdN=u6JJ9Gd&w9$}C}WSt07WCjwtCY)_vK&qWyx#!sSBR?V4@|>@nJu1BBcO0zib3s zBtzk-mMBY<2T1$Q`BtG&(8)>5Fo(@(fXgEF2?H(>AD|I=0AgjU_0~y4^rOr*xqHR( z>K~Q2K{6x!K*lJmD4T*)d|(3LjamaOtEbFgtZ6RJ!xyrAQh)QXxecfmSAUwQdkD0^ zF7avPUqG9P$4B2huUkTsQGcMg7C##|Y-kVO|6t{(zY}N{REFW|7sgY{q&vYE25RIy z&j465vaHoA9RoWd)8sZFk%tTJkq*!AC_SWO8Fqt$NX)N+65*l6L?gDzPx6)~=uSQEus z7BGmxMiK1kDI%CYxWCODigM@}j{yx%1@x>Zj{@1_A}yK%(9~!tU-e@}Vd-K1)QG$O zPW@yCC`7u$JmF}X?@1Gwh$x1DNS&i5Nz-8#z=ri}+U47~B@2<1ck^tF$4Zf-Q9_Zk zyo`jd4)8D#hHsS;FskV=HYCYmBDRe`4o*#%qW~nQ@}F)7AL(0}_oZEXqcS{Y3b+Di zt9C>Sx-BLr*S0mj0-FCQ_{x<5yZ}o%ij+W9r7u+3PDUmifM^$#`5)KKRJbT}2qaEGelwtTu5*uG_yfWjbNM3=PnrNWbdoI$2EXD_?#vN(@4t0N11 z1H)PqA7dU4!VOK3K~iA-hyWtOul~o`81~fu{cYXa7QkKnieamN zFzzoWWrL4}O_XU=U)M{H#rj=sc#|@wZsm1&`e=%gasY{t=~B9W)VIYG>W*B=8gLfa zh8N#w(&CAL!fqHz*|f6gpONu3Yt|HK>QmN~PXJnno%a{%LP{C+*DJFxw{k+cltT^1 z<>bV+cq;;8zDmH!)P4xD6Xq^zv=PhlIQbRJEHF47TRBt!x-hMVzQ^gQ=3>dFk8OOPDS%I_}7|*%tS#9Imb)}Ehtt84$Uc)Y*q4VbO>@23q z|8$~D7EIBi1&R8iD2(pV!2>a%9c^mweQoBzo_6B!!L~5Uza)k}2q+v2I3ACZPwm<@ z^!QQUGO{$O?KUqW(fPhI1~omkzwJ%a+@$Z*QQVVJ(BX*t*}r*TbW#yhblCJBOXYlu z#Ibl$npsiEcf8{*?e4p7FVH=mW}asD@+B)O%B)Y0guhy@7w{Hwu8%@W)AnRGF{u&P zq;LAt`nBuh`6ntGw1d;}fYKlaX4&5YhPQlKn!y3PnG*ru<-x2da*hI|M1HGRPeh5A zRNm78f~kW?lJ`_?Zeg!W(X%Mp#CCwJ4_PD!NCB8x47n0x&0q5aV^HKHI`vModZt$Sn6O_^nMxYO;hJJ)lwHd~td}ebL=n)d z_Gpf!kwIcfPo@lO!sq(v*<$W1j$5>hw*$%BJ_!1ahta4g^l0Q=dJ+C+eE)04fE^wU z*d0#_bR_aT6Q>#JiV>4=o;w*?Ew4G7zCf^enQ2KJg=NiY?wh$7nVV=YD)oWEB?%F$ zuRTd<>g!9jYHwlQ*H3*UPTRf$YvWX|eAbl}$?x2?Gj?*YT02^92lno3$BzU^PajL! zjVo}L`sjT%AUv$lkFLL34w1JduqTdISHPwO467$rw2A0dR4{T~7>Bhy^|h+4OJr={ z1Hr@b1PS_3Z8RRAnKGpo*xOL*PaC?V!Ia9(Odo7BK6|`7O0w(096Rc}I%iBi7MY2( z(&YDf-01@c+8?~(_3dLHcz-**|3Eu=d$gi-tn@D%%X2m5RuJ-nlxQXm8Rju@`?7q{SUO?ebuYmr#^Li z`{XUR<{3*bSGFyiuZ%LT53o+OH7lcZiGB_T0A>S(R+y}=_2dD+C?CTF;6~B)xvg1~ zdjS?r+TOIcddldrZx)%JGaVxdytKo|j?`RA26rSzZ4cB39(bS~j-#nvm=Yc7$Ba!E z$N~g&BpDhfVXo`Z0HqZ=cwih>H|h7X%ElC|gE@|!JQkx!bXy_PP#&W1*_p$6hmotT zKvBR?_eP)6Rin8D-kS0;#APenspPdH0Hvva=WTbiqlc1C0DrjVJaWz}OB1>4PDx`t ze}~hH@Fz01^cIMnh;tLMA3q(iPxPhR#v)DM!=FwWeg8cyR5wZuZULp#gXZ|@)Z@uq z2aE@kzbJb{n&9en*c-dJ2H$4m91q%vCQi|&ExJaIhF8v{cHa*$b4R*5hRyK2nS3}I zeVdAJPu4+x3)@z&UK@wHDfiX?+5lN}WAVy3XF#+nPH01(S>M*I-dJ-**R9!7E2lPW z+FXk=R;5|LBJV1XybT<37F#dd9DXf}oodI9?n$ulKsz-v)n*UvZAYf|Q1Svxijb;H z9j#2HxxQ`Pa#`CLe%4LObF#L1q*@_c&GB@3n^ms<0DaBn-fe^)ztU|&0#CjO!*_URb$ z=@^t1QYX?ZVGJi{Z7$NDlmNHeN7l+a%kU0)t#U1dXwM6M#2;Q)q+E6u|gdUU1c_=$9D`DcuLXc_L7NtB+88717pp&c>*{QQ?8n z;4~3^0IoJ+vH3;h!+^Z&`7l)=CIKK_gLApQb@SHx7+W>vlcp}0>UM$Fse527?^7t)#Y zWF+2UyGt@&j-T+R3+=d1QlF0VSbREq>e|uzNZ!GHyVEi|9NyKp<~}#(V~+v?&MQDl z_Poo}h%R9;U6=|xSf15!VtT5;^t7f;j?;EU?msWf#C28?q=L)wxky$Q;I)CB3;Tq8=lBGHEa%Uaug7Bu_~D^aL4we?}8DW&=9 z^B6WonVeh~h1170*`@+=fBfF}w_pF?zt#Tm58vMIx%>WhblNA7DV&ex#lQ^|#dt-E zy8|ZEi9AgQs=WjPsA#y_NMy(O4U)wUPh0P;NglwpQYGa;wRAKgfquUA8`ichmu+pw z19C?>n^-ik5i)4Xi)5x_IQlvnQVlkxd3>7D$L4h-0P)(2FCbgCa5fq>Ktv8ksqKcO z+rt|3h^YR8ToK8sfLM*{N;lXd9SNB}WWd5Q(`45!zv7AjdZOYu7AuoPj@87?GyY4i zd2RUDXQxV;nq%V5)5xZq8 zR=4FV6A?~KR;$2=>@1NKK^~cjqlm1POuuq<&m25d%Qhz_CfecD8`%T!0+0xz_EwF< z)h%HfobH>FT%M_Z;gn(7id6w!1CRRVO(lvx^7zOZMi4MIy?g6Y1*4IXWs{X zx4@fRZ6Mn<$(-thl) zYUnHWB}t-^BLTsg94Df{ClBX1G!-ySlQ5NM%QAx&$7^e_G}WSr3-oIyQnHHUbgudK z_^H`|@3F%*J*1Y*#e3=GSD$Mls#tmrAOO*0Ne{3{w+;ZCd_xuerDk1P~g)GWRsllyoA? z@X-g7M5DvO7%OLnGXemrX6ezKp9o(Z$)>GaTj03ex8uP!n-<8?0ITNr;?xJw2Ed{( z-4ZorDgdu6z<9?4JKN>kww3G?XvN{BGLkOu6A1(m~+@dnF z&FERQ(BXZlLjz!~ty?=083d$H9c!C6tEt*_{&F0^8-Oak(@*W<+O z6jl{Fh};rQn~rxnPS9YY)`9@Ss;NQ1^h})hMD%@i>}1^Z&DBloT zAo??&SfkakApiPnm()JZKjl{suhd%s~_A9^mKiYM_ z`|7syzWW0_X?7+$F*?5_#=d!-{;|ni3wR!xX?NUlXO(e9ntZEQnkqFMkq0i*N2c4p zeKEc`i}g`rTi0#B{Ia%jgYT$YwmIAY#O^-csd<|r5h@U5B*5O%Q?m+0b|#|d;i3FA zOH*#;2U2SS>XYl%*6e^)0Ugn@bPYI|B)>e-A>NVZuSj~|o~icWj$QSYfW3S7#Yr5j z$T-Ct@)09n9Eb4S=Rd#Qb^m>B@rvc`Orp3!qB~s;M`uN6LxTozHYrxcGczaJfddEI z?p=G@^RK?THX!E6^riYPk;w7bbegO)oN7QMEdl+_KweY6c*t)Nr*fW5J@4Lous!hL zo-~Cg+Sct?q)c&0$3Md~skj?k<0wQHBR^=ntOi6wC%;qgdhV;sTURi7gx%H1xN;`sUKI@OHJrzxIUub}4Njnj%O;C{| z(NLObGx4_mPRB@R;-&2XG_V3DO>ZN?zGi7I-SK$qQ+dV;6`S~qfX^fna_>y?J~?xw zok;WU=yZ%W5hZ>!Dr>H4Bptmg(4|lSM}%lFX5*&KZTt4^?a+Y(?KQ7{U3>Eze!qR{ zmQS>U`=+9_x*MYKX>N*aSFc*tF5A2{0CA$4v-|fSC_v!lee=iW5h4*&RqV7b+R)tF z6VNiiq<=5PjQ|%Xsks4hQY|=4b*7U3xUHB6UTCFo1FwpcCVQ>z%WHWl} z%b)daCK0%_6Um57MK+8^#OwP(M-L~8p4I|5lROiF=AD|zodJ`|F`Y=i=#k{Vd+&iZ5ofV7X&cNk#cU=zx7fmi@UVCH137lIHLHOX2iw}A z>4O0vPAlM%w5#7bx{wm*S_BmU)ymO5#DUKQfP8Ro{f5o85&7hrRc&=z7L%(d0+K*! zqHSDnf6>XdW%Gu%Wy_{^`DGj0_O0vN_RBW4ZQD1sO&iy?wd+@>-r~d$?u*lyX{Qr4 zPEXk|{BSv-n%^oYFneQ(dAbJHd~1KY>SR%_*Jn~FZMZf6+Iv7W1`*+2npZ_$L4Hl;>2M_0x&Yl~@1iAa!Cp!&0@puHK$5q&$}-)#T^{Q|-w9z3o^k z>u4g7q1o7v?xUd!ijrGGE(kzcr!&vL+uL!8x`Tp+P?`$_+e?$AgyWiJt{@4vQg~bH! zNxSq!`Ij4%NVKLqpf=`Bv}vjAr*Hj4+q!jgd)BiquXWc3eS9;W;ad@=d2QA}^gc>I zjKoBBRG}i#q{;Y!Rm}rrP|3HNb%`u(dTkYr?hm)jAqD2OCuz#y9g7~+k8TCgjcpDY zo2g;KPctI`S1mq>EOZalT6QL#_c%(z+lGyss@Yxu9fxPosrpyLQ}r{Z9yDv~n^=iL3tcs{0d(@xB-e+?;TgT2SRGKG zo=MYswnp16)DWeMN{wurXZeYnZ>)Kj^@-@fJRs48HtNk852uXjzmCw7f9<84Y)v`S z?8Sn?y=4h6w`|>(vMx!wah_+RMt`k#n}}1LSYa3a;fC6it5&9UkRv>-NsD52es9~d zxoz9LF?m{y;0p^{X@^oa{nMQ8soM5$xJ+8{@p(Mg%qbm~oipR)sD}P|^_t5OG}t{8 zz)dYiuAUjnDlzHV$X?6MER&khA0W2?VC~v9)k-2?EiNs%D)iHcE?F>5?bQm6lc}(o zfXLzL>6)fu>oq&psAS5j3A{W_v=y~v(A18}7{`XTa&mK9xn@IKx@v7(vT|)(v1VPa zt&icYY^P)VjzJE);cM#Kt)5YcKx^mvTpuLzS{!{`5~Wxc!&?-?S{QH~i1cC@`sMIY zQB^?Nyw-|@z(oK@)MUiBkTi$BMC-p-#0i*M<$06!O%Zy>+yAJ&`#tY%H{Wz~nzH)~ z+ze`oWQ>jiWFFobmMJ~fx!dGJ1jsq)KG9dmDBRbK2cm$@+WnSR02~yd8o4%Yi&2Vv zmL?(sR<$}TKq`_QXca`}$Kp)%$*zpUSebNoC)zxdavVKmWzNw8$P@AoZ&F2Axg%DS3Dq$_@~SQ1Pc3T7ARnJpAdt zSi5m!+c!1U_U=0nhnz?*&-j#z*$O*%KG+_7;GVW&-I{=99B>YO?(r}=k{&@vH~cj~ zXePmMrbO-;Y~rl*xTU26fX$a}PjF!Gf&f;60Wvx5D|-1~*TnG|izHHp)a7wsWsP3y zOV^E{9Hx#{;{=NQbrwq+#mQg)Z6sO!aYH zmFCQPu1T^vocmDOj(gFDu&S>M)exU6k`&Wqait3Ri0x$*^Vv&&@&$p|P(Z>!n^AKEFEP?2B)HR+Vx(GnK1_Eq5z(RP!|gzL z+@Gk<0GIyK;c6HqB}e_rBmlfl)C6yXPezRm@>s5^8)MJ@eeLS!KELkay#|)T$I=x` z3xsQA_;gwu0l*J`R0J$v^iGER#lWw#>8u3PVY&%4^%b*tLO&1-xTf2ixAg(`|2l@7Z^#`LLZX9Qv=@#dolLywMVB%R(37BYJIsi250no5-{HwiCaa zNh`iu2L{pTvO!keJVp~DrLunmeY(>qzsdL&Fa*?>FE&6JnZ^nEM2_bdFP>y}NzvmRn1|Isxxtz%f7RT=+-Mm-K$7z`|4x9&c5eo{rT4o;4H8+p1h& zwk*K0l!3%kFFn)jD{7C($+fGiFK%T(Zpm_A6WtImzA@*byp?TPno~<@6?fYFwJBwR>!R9^`v=&!{c}ia5f&BGHDiDmI^#5Gb0nB6maIK z&7?W-7@a^y6IZj*`LKJy2)d@{aN@Uh^^>)Pc4-YF-E`9}?JaMAM|;OR-r3&s$M0|J z)@@ArCku#-Iv+VaTnJ!ZYHT;WF_=VbqL?(7MH~PJcv-ivX>GK&>>b)NJoj=P-xej{ zo1^f2d_Vv~lhx|6$ipWw;)HzvemX6MBWeC0oK90bdFpl%DIPeuzXr*y&+kT4-3>{| zCrZph;H*S%KJd0a5uuq62Apc}EZ`z^68W4=dP86i&(mteQ?9igI{@rrn%PzYz_a_PnZJ7t8 zPCHTt5?jcDM@GZ06ALTiG>=6diCWc{_4NiQQO#gT`Ha99lyg5_3fJeNeRu`!M|W#dGnG{lzlIw-cbN-#fn6oIfhf1OtfCoCRSO?E&@|Hkx7(jL5yc{nr(wbJ*IKg(z)5T zG}o7<`4f|A%iD>zVo{pynnR~%OX)O;4;-3l`w!2yJ%@5k&9vP)_Ds#TUHQB7z>&6Z z`gq$JfUWz}$J*ZM**10LL;%AY?iFbU&9nqZLmtx1sxA7?Y8)kI7zVi@ldb^+Heor@ zM53(#>WP53enSTCT$Ckd@R<^;Q+#7;UqEDSoWizk&kBegt9>jjPds$!NIM+fN-aegSj_jTsMu35V&q!;Iiq=dW0xAWFaaQ#iYAdpUUz&u+BYT4}`bKRGtzUFs zqVm9ZITj<%z5=RAZ`p0^ydvAFsRI?++2F+F|KT^<0|Lo|acf>0z_Yl510eGy`MYqC zC_B#JRKV$U4xlQc(lwwfLZoh!ljE}|tIu-Xx^;0nr`z7$yW2-U@{zWA!-hm>mhdK@ zyeXO!=>cuv23(DT&se&fvJ5}BJp>%}&B+4(YEI`Jj_&hb_PHrE9T6s=-&rpo&J3~(IpF}skY&uLz-Z<^L?6ZqS4xPI6!I*xPB}BJEwdRG)cj#!_ zwf}H?FwLkPd(IyFkF*E(9&Y#SIMD9jJ>4G2?|XM1$T8I(+&$Iyr`bgrH5Y4#D*aUk z8^YW0<7h+Rq^*M}SZ-Ft;J0X1v_kQ$JkhjJRTP@B#|ql1L?S0<5}gDfZN>MTtDc*8 z7S@!fSl-mCxUTK7W&gftOl`+y5D){ofVl|bynYvkB6#Vtzy*nG60x6ckXIiw_a9qQ=aPk z4G`EX6_7dyzO`a0G8*=?E@-w7v=AX&6p)DYG*xX@qQdNVuy^# zk|q$9vz1M?4@Js#I`T8Cf}X2GE3mYH=tO;2f8|60sea<>mRQIEnSvL`o)DFe7@Oc| zm0Q_*7nMFC-DEy#V{nvvszoPxo*wJ&c)CrGx^(+YQ<+z68h%Al$36Se#MZnvU(_bK zmiUR5js9Hjt6OF~*}&$Qg!^_k1pbqCD?;&#R{3=|sYT zhXVPb0xgL0=HDDT=<7;kTHus&i4shd7b%GvhXW)A4wPHI0kZtnP+HSGHjm^eP2JQr5K?J6VBi7f3fjbv&ttzY~`RvMMvyxPD@|KmE3=Y67eS?J-Ff2{9h=13ud{h5@BX8XwKxf;Ab?w9N ze_va^I8koubNKx$=|$#op2OJ-4l@`5R!+mRgtnqlWOTOLmt8YHK5mg&T)Tt{DfuquYtmWYoLe%kO z^f2mMc9-OGq)v6IMc%qMY>IO)nx^lfG@v<9HUx6#b{ z;%AhxKIiK^WpPkcM`FfyDoC4{w46fqRpkK0RwdaC8jt}Bpl7#zP05)V&EDzcai*=b zJz79)Vq$6Au-4XY0kz4MZH?{vBD`9~m9kM>k(TL0j9S!T&S-rKWi~()V;uIg&KCHt zUOU+)*R8L}#lX$}sj0Se_pU_zyUV~fY*^bit>4(zulN1_wQcLBO>Ns{TXJk_8#kCu zp&xN^v!^Rrm=nt=m#$01nT#11a~x@H=%lt%5|iEss9fpruuR?f$8Q<)m!t0&F=3 zT_?lcyXX%`Z}!D(%|g*lq-#iFl_SC}Jx?{)Gs6zo=zRF8=i&_2-_wOISuj;kvuUDD zA5X;}8?+-Q7q%m(oX4>8d-n9AHgjrG{w~h3upK*<$fE{`Oc4cABD(<98QY>!yHsq% zF%#nfkjD*L8WitoNt29cjX*wHYsKF5i;@udkD6PIq8c)9_ zO}mYoHWZN7r0>az<{MPbm(+;8k=I09eIoeEM2u-hTcM+g3G_vKK*SUzP1#xmkUaFM z>MPu^VRL|RbvqQ$*}Z3Pef70KF3sJw>n7W#jqAgQxsS`+y5zB9ML;Y?HuwTGb-UEY zCn+;P6*;FQRrKY{7PqwlRP#00=o1bY1FMYz=9P)AMce+aO0+9F6nR^J?~A83NRw!L za`ozpbo2|FnNa4K*`#B=>TR_ivjYUrNnDf_EUpX z?ZDK&wkJ{YzP-E4DGj5P$PD<-*d8%W>eRV>`*LG{hph&ypG1D58?Sj%_YOQxE1>Qr zt;jnuW_VuKK7GfIcGrD-+8y`oZg~42Hu&3Sq;J$X(jy>(p zTz_Eq{zQNiHMMGW_+1dEC3@vlW)gT4FJlrjFA(vDm?eFFDupQue;j@6(Ac z*=D{G?-eUnm-3uUg=<#$h7T~*B%cZR9E%rDOQZTd^$*R)8_%W^bEypgT@>Eblr@R8 z>`K06`&DgKlyKRa81LlzwtD^6HnDC~TeE3v+qh+0+qi9OyKLLD^4#`z*_Btd?K$e( zQ(G?!h$Z^U-^;gO(Y9KdvTb8+PJBE7aO#AWL4oTS%s@1ty*?~NKtyv-Q!kKG&uHrN z*oJ|ID~mXE(Gz7Y=N>?|O39jU`=TD6nQm8Jd1c$Macyq;;M=l_?p7w+v+rfz%Ku5T zBH~lS-K`SMngIdOH0Sku0UAv@gB7*YPcp>Q>NTs{v!DB%0G*HXooQ2trrWKz-Clco zYKGfyK;PlYP9kMZOnaajv8F!ech)S20Qj&kEx=OzCAte3)|Pml z%QJX1ht>{QS6se5z^;2?D7X5wNgUp;oqG!SU-FWdRGLe}hb5_gFGyaTg|8gYgT+g% zK~DsndY+B0=v%f}WB8pW5oGwL=MkCc)ke#E_64}^xwFm0aalTf^GPOF0Wo z?%`ez1>m{HNet&`Dz|<}T>;6T?uCE5K@Go}FzgBlQx!pbW@2JhyWxh9xA(sL|3TV- z_`!By`e@rfJze^II3Q+su>Dg<+f*Xi>9n|j+>2lQlJ?@yeM$8V+bEq~pW=wq8cQ`N z($;@Uej-*=p6Ht>p62Lg(Osb1Y}mCV06-l~HHtVwGifYJ@Nr6Yx+*fNfhe^exgD>5 z^cLIN7#XfgRJ$T_NmNT%16vpFZ&L^MwVOV5XJqHSAzjMN`~`1#!y5+w@E`ueGL-Wn z&B^%yrbd9j_|N@?wsqU~a&RUo8_@7o(aA(;>jIF#Y{@bs{u7DDY-FqHxF$+%7Tu$h zdD1n_DcWHZ3e7g7;`-C7=@g?Akwn66=J3IGD!}Pe4vQCP@*HndY5LxI+pX<*z|LnK zY>o^lO*$t-eMeN-?}afgo?H|DaMCfAhqBvfgkzxXnyey&lX=$2>*3_JZ~y)@yVtZY z{Gyi)!6{A39zXG-D{5 zxz*Z|_J5c~tzkd*)ch~!B`K~#=U zrz|n}+_xp%+u!!C0LX0n%CGzjdF4!7o~RrsXil2OG&^f*@2cT>o0~BljhIr?R)oUZ8$wZ~=+k*k~>#zSvK;S^zv-95in#1Ln#c6Kc)RqTi z3_2}K^tEc$N-iYj8$>RmLI4&AwtQ8bg6;HDH!IhItpb^)x$ZktajS`Z1Ihs@pJLI) z@u2|ee|W{eXqzUNwyQ4RS`N@g%Od7O0ZMgs@=RJzT2sf4#ObYUf9v1_mi&;R*9mu_Tg#nXTO$^Y8E?H~O8 z_7z|8mF?^Q^4GVodHGkgKl>$rrhUQZy|lgH1Nw-q`l;`#b0T z|9$^^&e_@7+4K3__jTQM-L*+iYV}masD!P&VCG9*KI+f6zC-1B> zPbr_<`pPKPxCpuG8Z$<}dDLE3PyEbP)tKyei(el8S1S(LLU}+b%nI3(dUPb=zHH!j zF6r@aVvZ-5PRBXTDy&N-3=A7f!E~iRc+Cgvg#K$a5H(gleV@ul?ZD^+`XS*YBqxInu~| zrv7?}1gEo|ls~V=4M^C!)x9^$a%fffylR}^5H`fCNya-|)>rV!5c#^L)XK=L`1{B^ z>+&0w?4{wdvq5dTmRRGv{lLS=lY@`*uavbl31|&@L4mLu#(RoEBD$kuo)_6qasHJ% zl*Y7?e-Hn0rtx%gk7M}cRQF5VmTvz0lqxzO-!jjhWba;9*VJhdLKGfX@f{HO<+|L^ zKBY+PeUlFFvIKsLfG2wIv|4nOE-$BO?l}I{q2LD) z3yBKqYoCo(;aNfsvf7Pg#fJCQG_SiXDw*l6Od-XSPjLoPVB|Q3S4Z8FZSd@UyIK6Yl>3Ghq zzaDp6=Q0`3c><58d!`v=R(_8O9;v8%{KslPHg(r7UvGN#&pFz~W%-7O&BMvtLp7iH zHrJ<$5}aDVzzkiZ<||43UCXE)#Nm_2uRY&jiJ~7JCGI?D1D%@S$rOL6xtA|8r1)zd zeBDXcB!m&Qo0+S(n{IKpTmd(OjDQJTNp7vBMzB@Xm7QVYugqay^xc z$&D$;;DQlNx3eiJ$HwQIq)7wE)oc=}h@a`h@4S41c0lgj?esjvBA|j|(|T3zKH99rlaudhf zTrc&HI@B?DxCWorZBst`uLw6{8KF`TpUmb_QBK*!*>U0lJnpJJ>cU>N9DuEsl7JuF zC|7;dm%4!SKf0+shZ;?#pN`?bV8;#6O*|g^gACjb{U`SI$^O#Jp=GYKlS`m*gYMZ; zM>StN2sL-LN!QKG%yUHZ$2DCfZQG=#CatJSp#14xw%GkT%7T4Jslpq2LKji>#oozK2j$`z@-#w+4`gP^T?p*I~A zr7I~)oW=F1$*$5lBh!_9M&?GWRhJq+wEQ`ska}QRuIV?=7;=_6UA*DLeASl+&A63L zRTjVGl7ua|>ua-ZSTP`hwNen1Xmm+w{n|{_7}1PjqPI1GRrllihl#)WuMHWTv=o?K z6T?ZA-oH=EN*DR%SPY4fbIEUVmsr22K7)gKAS2$a{CGEqp*4lDY7#R&es`|6A@197RHkr zl<#4R(ani!G|O@Z`~iUPc~$Q;1?;!$@8nzHRf6_j7Bu0yuEK9-(!@?k0KSZQVzk>U z(-(5L_?PJbJHvBaK^VvQ9mD5C-~sRt0$Kf1?{<;*RViX$xH4>eaV`b^ zv9^2EH?LB436qY>Bc^mc5-~Y@`%{$XktXcxVq?isLIp|6_3G7-|8>QO53M1GeMhk5 z&|e^Ae{zegg5Rr-b0bL@recu*Fe@*MU)SN^w4mZ#uB6K*^A$Gv@yY^^M~>zU*Ul>N zI}F~ee?8ebU$L9BT&=)|E=qu2Cx-YQ`6yoh1$?#lSn1zraj!A`PI`J9y#28BNX-$i zx<@wFm3Z;_P!l^#igEa-YIuhREd(Qtn_9NCpHE zCbzL+Y)MLdfG5!7Fo6fW{j=EeZZ`L=Z;a+UiiYxZQDY3O^fIik;%pk3%h6P_QQ|yHq1j}lGE`6o883~t5F=+ z42P!b*4fUscrLASo9d{n zeZR3Zx(waS*wY6b4gP)u6V8~BYlZj3#l5@C5x}JFaE!;|>)Yb5FAj2*xx+TWNhJjR z`8#_NHoc?w=~du#%?tJ|ZVBnk&-8P%2Gm+^f&9m&3x2mQMFNj`=V$ zld;;(IoPi~#vC+03Mr`z-PqRdW*f*+gTKhIhkzWD6tm=Fb&&ssbDn&D`9bO)l67nb zB0mfFV^5ufFq2#zx&i}^-6>aro=a3eI^ju6i!6m0hn}X014=0dHc-3 zF}@e^S690c`UldqJ%8~db{?8DJc=ydb^Pnc!bmfr)=MlsN-Y-cz16QP4xg^Pxf*FT zQLMUc?3syg##kBiMy42Apv$>^;)_b+kM-2+^;y2*azcP4yHh(mca&2j`)0Xkz2XlPybODlC{YLUP=;l<1Y`h(@ zk-;L6A;wA0l>>KWeJ)HKN=t(q_WrTrcU>@>Q5Z+PPL{EAwREDxU`k`YC_b9?x%VWE zPnc+PmMzB!{lygN9L0EN0p8Vb{d7Ap{NPYN+SN}#5GL#!W=>y}e6uCFY9J!ir|(Tv z9<+KGvEMLsxe?dt=w!v6uRHvtjJ^c+6KR*96)m0LGA+7mkEyYs`O_kYuxdNiS^Dwb z1<3v!++%L_cF{WjnT=x3o8QRb9lnC$Fj}RXhpf@0O;VcZ=?a3<2Xs-<86*D;#~5GC zON{1e_DtR?KPORxT_$3i-s#vk;182gjD@w$kYeAVPdKh!Y04>@d{5u5ySn7FuqQ#d z9yR|SZG;%L1Wot1`0FyO`+f+<9=8CYVE-jFWfp~BG5nlC2l^$f@I@~6Xbp1&m(SHV z3|y|rb&ok?gJ6M6v(PsFF}}5r$(w|OA!^ENyiX-k3T(cCW?QMH0(te=n^2=F5 z#jL^Y9smw5uxHgY>Q4!Pmcv>k$jWv*JN=)T^-j> z?#<$++`MM-UT!P-&rMiuYLbL=3BMS2&-z_Ru}NqUZbpLW{IFvYVIN41o>^YtEz*d! z2F=G1n7`{@Se7))etAGb+f^Xl^<%|%i)XQ84F$epSvzC71egDuJe%)?%^uwf1-@Ns z0WAq5;=jK`iTe;3CJK zZH{=<52UlZKw&qTn6YG+z8NvMh=+>%%d-RuSj(837+4y9%2QL-E&SV@W}tz$fpBno zV4RSYI;e4I@Lf^RA6(0weJZ7ssvhJ^x4hnKfxm;01$xnz8-mgyp;Hs1Ki?mfX17>0 z-D|n10rFo;QAta(8E4r6LW8S|;t;M`;h8v;_;#H|d(5Tg|Jh zQ?|-}=qdxRPxPE8dgGw3qps6A=)1a9 z;4EU53Sk85X~JpVei*2rEJzf)=0Yy#abMLjek@q+?p8Po*;T@@=DUiz{5CGlEg%1> z;w4chem&mbM)n6%G(6vJB9I_KD??3UhY!&2??yxyI+=|(AaU;QZZd?PLzZI zroA48q@SGh&+&Xpw0?E6#^l9Nw`!S1+HW^3#KAPa#4ItAY~EN1D|h};JkQ%u^*oy- zX1i4pvB|6hBgqYH=x_Je72?U*B{o0`5v565@LHSKX=J|=0S)X|^{FRu73XWM`tqjg z73+`LKxeP>bWp=UQ?*)sLie{lx#2es#UG47^n&o7ma5j5Yo66Iki$Z}AA+VGQXMjR zqU&;B?k|=Pbbw6nzMUZSO+kX1mVp=I7BYXR2$G+qkh~%ARy)r8y&wlQ@BvJN( zCryt7owEm;Yz7@|1srLthJVFWR=joC4}q|ddb+z^2$#U>F|*w=?y&A-zk1-H7weu9 znTtXSsRIf*)S^TZS`1!XK>eFkd1Tr^1~?7m|9AspE!l%nR4;F6QF9(WE>qs2_n8TD z{vq9p&?vRM9zJM?2j@N?0;WimwpGM7;*$Xua6Lgrb$@RVK;*6t5EmW0*5C)D-UYU^ zCG4uJk9Z+G`D}tf-kG|A99C3dY&hkkjZ|CXhP5G~rZG`W*1w(--M(eNG@odn>#gLMaXcUnYEK@q4myzkiaMb&#Rn zdOWQh;^ugpK%5q}mQK0D_J)H|BnPfLS@Wvn-5&Jy>MSmG zr@r`m0pxMn@RD4(Hr{A81$MT--MsiN-tkK2v`*op9f7b3|7AnZ_fI+ghl3G!3am=n zwgVKc%^N|EGw_6$(}Waf;gf$~TJ;)!S=rI1Z8Fic|FXcYP1kH9FlG5uOK|;wAgE?# zByuF1Vt{MZ{WQrm@>oFb*-%9EQ|)O+E!(Q$Z8o1KNCFeAouhk3-o#7eCAuZAGx~D*qd`El9poHf)m9Bs{^<9yc{m0MPG4-SZ z#!$5dM4yFQ5xRio_`=>Gq1Qat{*ip2Oxj@1hRgW;Gkn{;M^SWdhw%Kgczts0z{S;0R@)wr9lOKJ$UT2T~|U0%5iVaR1h)w=sAa0O4pzxeB1Ki z^5>##Q^S??5MJH$$;$R!pRFkJ%$&Sbe?8&p8jc?v1cO>4>t`eDd9{O;#@ zEymg#oNO3p;4w~JD%&np^~|X$MCxprUTI(4Z;;9yRHnE0Stv>HUJA1Mljo$BW`%gf zNm1WJB3Rq$OWWybqpImDWZDtDdz!>Pt>}^ka z?LWyUi*yfJ@!_8hFSomv2{BUY4i)I74;{^*T>>_pAO)Hq1s+16)vFe1rS@l+vKs^- zz@lT-G*TwA$`debx}-_`ogitI;g5@u9H_Xq!Ne~A{*U~a606qWAoB0~)d-WRUvVu8 zlUUdcy5BF|LpwjGtRwFn*w=32f!?le`FNDO`{g9*>3x4fwh+cL{~`QUCz4=*GYBU4 zradqgU@fwa=RxDJV|O8aXF2*2)>KPM+0qw%MFORMGVor(cPa8Rw1T4iJe8GPM-est zRC#o4|C{~GKBD+%EKStVH2S|eA_>$V*3u{+Ua{iXyDACR)4MDt60N={6fWJ~mRwec}gDW4kjS-n^gssTsQ zfhXMpRpztyC>gY_3-R3Ior%Z0OBJQ3+uaKm_a1ba~ z@#T9zMel#;LywREST9`W2XK`)}TidZ8_Og+VHK+@~(7bAGl``V^70 zQZ3dDlYdG;?P;gL zqqgT-#vU~tLswP$%gZ0gA0Dr^w(c9<&V6qI+&ZYP()z}H0}w_#q~HW|bs68*OnDhy0bBx`%wUhs4`+$R9#V#Xql^BTV3oluCEx!wlc8hPUqaAa@7LcdHf{)2ra(0@>V* zHkMX*y3gW8$7KZ`84B7sgDXR~cTqn}jvVrbKgJur_u;~(46X4BcoQ-^yw^5k@MZ5rvcdGwOZ$m$(WzQ`L{~N z2}ft860qjazFSd=;zB-1B{@5OM&X~YCuvLQF3It&6RN&T?#HNz%G@zz?3(;wU&Iep z%Lf>Y0mup@oPMaj+;sWU1gYN^C`XbX9Xo7o8^v--xGyY2t_#CFJH&OTDA> zWb3S03G5qiT{uL{3gBzV2)q-kD#4Fdp&TH%@W-o$^mTfEnTk?jDW4Fw4u4num{SOv z*FeCfeTUbxr$RkNCP|g-)A-;KJfA_qDv}x?xJR}l#(XjL*Fe`-kE1g^+bJrD3T$Bb2 zFfS84<8xUJBX3E(YRbOc8zUa#j~B5p&TMaM7ZbjUHZb#Ku1am#Ewt;0hXsq5qF?26 z8R?a*se)}~p4rB>KjH?a;WP||NqXvamQRprW685N?>L$BI`ijV?o7_))jexe{`Zo# zN@jDE=2N0u+s->yN0NQ+%Zvc$?p|f|Fl@`)pznz>`ZlQSaBTBSX`$TT-^|$oUkjRu zC`2q7Qy}*95m()-XL~KLyTfbR^aJ2qcr>g0593zHpN?o^=dnn;Y{9P_;g(cp{AOiO z2-vD?(n(vwFE=!vLyJPoDqh8eX*q?>7v33R34owf8hSaCXrraac96-I0Th$ zz#7TqT`gcyWxOq(j8By{+mV80>IQ^sbOoVTXkhYMoX#fMXs>fRoKz?*Qly5O)I z;LYknD;x5>0*aKqn~eWAed8{J>XAMv+T0Y?SYRC%QB=t-NAFTs{3C-ZP5;1Pn^*_bvU9#mb5?yrcgFlH8Pyg?P>(BrHKY^W)WL$2sM^BXW ze1_6ShK7bL#~ivN+Mp>lL0}NpYEOgGLR4Q-=bNJUwnlCB3n8eW!K%-3P?-AkWs*3` zSka^s<_syxy{+%Lg>Fj0ET0p%}VkS5!`zA;GSil~t%?NYS@~P7aX0Ty{ zih}M`Lbv6?O^W)?WaY^^J?k}){hGzr(1X@c+L#oE1$1QCDdl2z=w5b9*cBAB@Jiby z6@|AO5Oy7~w6un~!q4lz%f@=6V4fIQ8tT6&v-!H~1VrSF-M2&6T;X(KD|GesTg^H* z9}|60Iy*skb75LZQ2b7 zLMm)N{(by+fcMe~_aXM=$fyu$98o^T1GyXNzI#Go(2@)~v_Fyz-IC6cR6#OU$WE5(afmt~(`d{qeDzY!sx z4pO!k201jO9_gcJ^qX;t=h(dkfkIt}>tyVi;)ia8K)3hRu+yXPPFSv6ZY@*T9_~(x zn!;h&yFzSZtz9<+bQ;O#zSQDTb07htYR3H0zf%G1SmT%5p_=WiZWkTs)|1jMKw5M? z-DioOA-r+&bm)?>i{xCJiOzF-#VdQK`cQ849TXda`VSo*PuK#FnvWVr1Z9D6(LD_6 zq~3egcUt%8LHFr{r5Zc*KK`f=RnJO;;|RS@A)d|t8<}HK5b^8e`;+Plh}5g&fbNbi z+>`JKyBi2wRyd8I%=n$47TUATauTTCaSO{ku+hcM4NDiEOV4th%#_H+4ZKNpqhOzp zn30`Ihes>kZ44W6@ofUn;_a-VffW_x*3v_$t9!HC+cbC$3=# zp0Fv_!1ai@H|i0_P0!erK0!`Uka~1t_n9O=db~m?-`bVo{wA*8Ic!7d?h8_2m@&~>#oG=&Yqx@# zvO{VUz0+t4x|}r&Q#-%0CX7*Gv^yoT^ST-q4$c6-0%Lb@?_)5`4FYq+waTCmgJHOi z2G`bQZ*6qw#sfR^9zG7t@d@U5zx?Jur)cKG47knizT3%UWoJ$djo6wGL(k6_1+8fs z-~T2HcxywdcuJsX0QG<5afLAJCz^imw|j#bm_AXZ??tE#~FUos|~veM`FPf^3j`@}@j`DWeiHgfPExmDi+hW47m86O?{{Bp z+H34-qE?bNE1a}1^AV2~Zw0vVL@E~I^uxx%&8}J3+_&~m*7+NJk0os3O&<+CaU4KI$_L231k2-CcTsC6;I9;PDDAz&!19x!r`fb zk3a|fH@LQt;W&j!=-nu^35yEDdX6biG@oLwySwFY)*~rd3fMxfG5`MW`y%pq&jK23 z3W$OIP*B(1G<=k^S5ISzPdmfeHR-JHumC8hoC~CoauWmuoPiK7k9$hiY*4!bysxOWYNZ|I-&*Yg))X2$ z?El)Yu37ZNUU?RRymjpVdjY_q+v=g)MGDh)H(%^3*LoV&KWk8?>ozlZ1>@Xw41HL~zQ7xXbz~}^^`OtF>0FQ{xfvQljVMG_iP?Vk-sXeqm0y!Mnm%i|ty!#547W)ryI8(pD zYA}#!&ISSpBtBbG=!JS%)705_mserOP;^^kfI>RvY7Mi58zBnPRxQXK6$%>C9$&pR z68U#Aq#xRV{E!-OVHL+cCPd`Di$!5E-MJY;GQ|7knoo?%#F|xG_ief2uDh@1F_tTZ z+G^YK*oN$`?^A0ydF_s)mL=EM5RJu-umhYVY4F^#dD5TtrM^ilW)0f`t7W92{yT2A z(l;Ln-rFik;)Cx8{0CT3X|R^Z%CPsj8FlqdY_k4`m2O}FEAZ;D>HsZmxGRs-b5wF$ z|H~`!SF-FLUhFZ_heOLKCKP)e*3F@J4cW_sRCVo})K`ZDgNv1>zv(ol6*^xhV|J78 z(uhtev7k;qK^(ZTpu$XyTJMDsaD=#>3LG| zHvHmME_Gsm3O0p11_BkiU!l;+RA6d(2wY-zFGFlO8*(S>g|B;3ISsCFz629Rt)@p; zdS&=B1=8uS9&riv@PHzXrcSescBdQU>hHQ zA@ONZFsbIWT;F6+Sl07)iNZ=~svKR;Z^tD2LdsheNAD+tA=)DOR!;gvm(t(pO7t@I z7kw|RO9e;&vP|Dn%Y$XZZq8D~MlHY{e2FqXP%*CaLN=G_+=@8C`(Izb&Qrb-)GNG> z#T)6yUSlCyBnq~tDOtC+b2?V0m5%^be)ImcxkBO9A&|0*NX47TLZV6sL|Y-MtyyfU zQzq}J)#|M=KL05qhstU)b2_onrC;n! z2c5RUSD+}_l6jUA5ipR&%RHH4U6r^lF|FzJ-0N;^%?iJKJc7kN=H6Kr^U^mD>eqI2qeI3nrJG_;ZM&`2KbFi#R}m zYL;mE=uVkL*wTq~T_<8#Yh?QdoZO8tamr${g4BFK`kkPbrceA}%WG|p?dHCdxwnKe z^9P(tQxP+2e;~##c})=f_&0co=;x}1SzPT=?OqY(N0TbgS6l!5IPoQX<551T2%8gV zQFIfKO!c7a1ZLqcexmphwE9Td>U$y>n7py^x15DT`|fNIag`vZlIveXf?p?4KkWO@ z2GZ^Hm~tYmyED+rf$ymTkg+nG3A+7+Ej15*S1z2N?QNuX+a6`-0vrdeS~E^@7LLc0 z7Lpx}s?@a%8j%bqoz_{`S%@Y}2HigI0+$D;mZSEmDJk}bOXdOK4!|$lcCgGmyTnLPR+v3ZEf|HSF5S@!4(kFL#yTX=0~x)FS-yp>$G1oAk)i803$ymw%>ie-HqedC@!@!~4%@NXExqxs z`1!gAHW-Jg`t+wkmm(KpGtnrDkhZnLGc&J}(Cv+QQs2fA6I%|`=d71pc8GNSZg@TL z=40}m`fb3NsKeVZLcetd2H!4rYL`k$5rb=YorQlo@ay8VozkI@hY|AoR9_fW7FaJy zH7KU?*+LNMh2Pg+d~F9SlPh4(k|`fmQ`%lNWRrjBx}58^T0_qD>PoJN-OS=RS}=F& z^7^>!3G>~5D7Ky?draSnMW3*#utypjl%)?d-)-w-92}%8uW>#e6&9%y9%+Z!v8!`h zyM|no*L7o%y*Q{Pu{#&H6D8Fk`wxwLz2yWq<+XI_2u1l81|ZS6GU&07@TesS;OIYq#gFsjxA)84m7zA1|H+?y2kx~Jo8r535~pr?8e}@ z>3ReSYbAW>g`v&Rwg6;PfEbXusonJ-r>{NO=YF2Tk4oiK-*10)OUWW5cJp8S)!ym^ z1*gfbuty6P(tlXd)_(ucfT8nt%#(G(WQUv657Uf`MIsAi11SDO!!R$@Q7a_`)zRIt zFS2gtjqV{)5WZO`L@%_{extwJ6vDh48U$Son?V{b&T+Y*R+892;{QUneT6R0$nZbw z(P1~yY*Pa`%@eXILY6-UBzBi3b|xb1lqbt!SX|tQyI9?_T2}kJ%RJjkrb~8oYv<1M zNW8IiTuEq!o#LCrN$#rx9!568^*F^#7<;!F4wf@16=u$a&{IMt=#Xhi(DW;BTn@cM zpdeg(kDQfx7;~^qh#+&n_wzV65WK!X!(ms5NqoTB74$0kk-g^&F zIuF{sURmmIzk%D7myn|L(E504q{{p61 zvlRlll^>lgl*P2}QrirDnOZzBPHH(8k zXo|&;ZNMC18l+l#`wcJ-^_1Z)@v ziVYgNKh(;GNaG1gZ46GMv?;#6u$J$m@&3dactF2iFT(-7vy5RwDr2;pd7cTQ=aE?5l2cE4D?!U7cIW#$uUG-d(^6C3zyO zR>=C(G5^k;uL3Lv4Cmr0;=@fp1oqz(W?(0IpYFh(M7eX_8i{fSPh})`X%7{=<0Bw= zZ=hxop*ZncFsgo(LMBC{Gy(9?TW4DxvK`6WLBJO+ml^=NNS^$tbVa9YYft#Y}5L(>0+lQB(|x# zlkEF}Ob}OEU1SJ|D}~xie-#pw8`JEoKxMku*pU8M_-{aQ@8-PZ&-PcGoWb8?-CljT z0|fMZxcheAGa;>q&be~GEVD>@Eu$1Ide<0s1)b|)&S)4cyz30p#iwNQo7QD}Sc>xP zLx--XlHcl{>^&Wb)eqX7HuE^^fk?BrtMf<)HvBXs^)jYV!La)kImK>7zNujyPfIaksX zkkcq*?@R-xEWB$y!S$74|JGK8<51Q8SnVK#*XZ+#&9%HXc= z;Y^;Zeyfz1MPye(x;~Bh(c~4XwhmursDsv7C<76ay6wYk1|orP4q1@JNr!#a`ON7D zVCu({FTArQSu>XU|8e-e;d_JUfM-yEFD-jL{UrGQ!_Fn#1y#9|c6TK)J7|aQKV)+! z{Mtyj9!YZR6_{UNPr+NSKh557MMP*v_Hbv4QfB&KzT?99VYvQ!-S{BWrHpdumW}*o z;&T_YAAESV`Ky$JKNsnS)L<%W+_N(YON?!{kEX?t_QMi|-HZme+Q~#)9`piu{EO5? zTV0VNS{O>im06djLY2@17fgAWPZduu#;5a=imzJZw^{7!MsN5JEu$x3B7d7$m6u?W zKpHl$kwyWQ;z9oS&C_b|M`3TZbMzV(U4~~vPjf(tS*IL+xWg@})O;G_2ZyoBoWDM(?hCYn~=oSLi zu_5uckiFdlHl3mATni@KHK?+dPdCxb%PQR z6RT2{mC5CbgUh@)NTSqU?$qdOwq?*M-I!8sJuy0Q3)L=>T&wT8THMsMy!n`Nk5Vr* z!<;oYq6EGjL77U}7DKU3V7{D9$-2$wO2nICVGAb6xH+x!-qgQ<89jl7&Fs{SXHeQX zd|Q>GQ6l`aqfeXLuy2E|R!2D9_2__VB)y+-62lrf0)2UFVDh06)G2rdbz74WaKnLr zLv05ac*2`M588b3!Zp%Dg?+u}$edD!RinU$&>r(!m39XWA!Gph>?x8c17SoNqa$u3 z?S&rTFqo8I-!U(%uagpMxKhYF%OjZkTz0S@t25MCm>zw-5P@*9Ll^ zH531-Sy!=j7*8tY^X36=+g$2E0!v@{rg`ihfAf^5gh~&H-cALGOyfT_^AjX**<=tY zMiswqFw$#ZK>d{txRhFDBMh|e?kq8r(V-DsL< zP$4m&Ms*K2H2T3OWB4ajE%*Hs*Ny8A_$|K_PX<_X{%YH{(OS2;mKR#Vd`FR4v}3dy zAG{N*H$*V^YD9h-m1hH~S!y_H)@KiRhI|88hyW?O!F`cV%jy1Mp>>_5N2eh?2yb5l z`mvHi&b{Eek(Z29uaCjW2c*#BA-d$cYwst}IM(op-B`eNlN{&KB%&x(pXN8|Wygy- zLG7@vXgb89oXlV!YU%)S2)!9A3Z$e2Gh}YG4R%zH40hz#T(fM??C=(hN5eBKMux@j zd{X>y==XiA*%go9#Ls(Z|75c8y&Fj*kFsz5 zb@Z5|d}&xocr?94sO+03lV3?OLol|mz`XjacvgxZFamkTuL_;AxLlJOsfM$bf+@Qy z5++EPVjK6T&5h&0=Y(WHq!8etlbqcDM&^H2G`es>#;>lcQlIk+8tljIn=&eiT z%m^|e|1Jfaz2b1bFA~Tq&2tSkw2EfCOx4)ZbV6s!EpH^Osx3o}OV;m;I93mw0abZh zu%iFvC4b{9qlWsWexvLG>l|U4>9B-9Xtwc`}Tsu!h-Z=p2cL zUf=3%zdim@er;qJ2G<^bHFq(oG|pQ;{3fXd@{i{=vB*sJ5*>GbJ=uU*X*_;;x!l+J z_v6lNnqBmz4VODP(f4lzOJDFtN@to@eBJisG7KHIuPdlx;eI76*#@RkeB95gKRq&< zEbi(qpbUrI0F`6;L6k_@AqmL2ovrm$*kI*{k-VJ z44xC=mu$n9Efc(641X*l^(;5Z>396tUU+W>^sjWD`aB0`cCy4I^4JY(Py~SO~F=w zdhG){CU~u5>U0UM{#wCBd%9B%uZ+28NugHlv~&{zoS!}=!<@ZA{JM9G_m@3YeEC?@bA~sg&*#6WKvl|ydx{g=wk~U_ zzCBmsJKsUJ9cgx5`ZN&(_Ca_hWprfE+98haZdXQl6w-ln&TmD&4$QYFjhmJXhmhX$JBzI?N?cAZ}`Z_l%19A(Hs;^^aPENT5}TarIr zP#}oERgUFmUxe+ceJ%~y>V0#`Hpcjfnh74QSrg=EC!&Ya)(^B4Ppg4{M20N&rC^W%h8 zpI!vbTfX@ses7uU?YypW3j_X!Ig$O-FKvO`W=oZSw8#Y<<B>qVIrMTqt08tlnM(*@H!rFx$8|u_ret^TV z)$Nlo>IBvA!xgs<@(p*oA|(F&xe*#mf80*Kk_r}caZ>+L?c!Fk@;;FEk?V>U8Ve3W z>GtEkw71)G4+bdjd<)TYu4&O9=z+|)==p$HK=il z#O~s=pr1OI>q%$c!O$*!e(c_r*F#4uE@fyZ^hWgzagmhyHt=+*S|pzGS^QymoKRj# zr4TZ)^sV8S$BMa7)4TOAAO78a{+=%ofUV&>X>Bk+W!HzgM6}I0u4&p1yE^6$ZPC6p zzhft-UWcnStPY6cNdy&kK2PWcX7jKcJI(*yOG^#@@o5A^jX?FQaHDIOLM#?`n7a{@ zsK}Cr@V*XwR``A<^KJ)xf!uaB(Ucu^mRH~hG9sy)HruoM5pEaqOTXfKl!Lx|&B50I zF!m0v$QK@L*qece7m05b@%x;BiT&*(DZHO?YSi&h2=wt@raqURq0@Sa_qp32`Y~}b z*w(I0%M5_j15^MJ2B|bTziW2?OD5Hbk9!7OQ_4x#9|3A6>FYm z><^yQWPvn0qtNm)v zjxjA;hAP8+qm=m*WkiAuyZZY3N&HjTE|ICb9V;`T{FAj2AzZq6Utlw%pw8>lc9EOr z!j5BEc3CN+ydwW08qkFQ@Ot6fY<#kl%-U8_JViN217s*>C5-oxx9-mF!CPnl96&I~ zJ^U^7vyLsl_TO=GLB_T$Jz7hCP$Qa5bw1wkHGbk010_5{GSWPR#q{Bd;i(jzp~hrk z3{i{-?}h-T>-d8F;J1ckRIGToT!$w0w|}F*-z4wO zq)GSa{5<8>-!q_BJ8bPPfoJ$!>O*z}mi}8(N@D=ZouqPbbxO;7U1cz!?%3}&@m}1n)crTgWoof)6)zNrZiKy#b?bk!ee=kuh#c3lP#V_?YOQHXb=Bk zZ7lEhgWVy3X7ZslwYQVkzSW=J9<|=yj*`+t#PlItNs0}+v=r_Rdo6Tr?L7vZ`dz|Z zp&Poa@tKp8?XLROHN#JhnZa&n4PS|Najw?`WOS2;*QN0K3%s)c(0qVNsm2M4 zwcw_gj#XN*r-!yQnzfDssv4Ndvmj6}^GAEWrfufjZ*46!$*#l3#jsj{B&8U27;8_| zZy9VUxC-cW7=AhZv}fppv=Mu)+|=I^T(?ev^>xAlIwV8tsiTqLIME~kzH)C;HYjZE z8e}(11SWJY8OOexR3$JX;*$CTXVJ;rv`~GOJIt@DDr#_l>=hFWkA^byZ9bp8Y4R}iiPuEn0T)Z^v*`QI;XgYEKTXyE8)#najc>54+WAr{a=3OF173{z z8fG8!8Fo0SR27SO%hPSNp3Ak8m8e9kglv~A#Z1%kP03ys>#R_Hb*<>+Fkpvfbw-*Q z3jH6V&ibJV{%gY zj2cLcA+7J8?=SEFu=t#FuKT*Xf`X#Azahg|Rkr5Z3{~?tI7up%WfNC=p*FxM#h*z91pikHsfG2WL{Y6pAZEl$K##b;2+&UrJJ(6 zyu>(usD0M~gTFX3+TFkqz3O@fVA?)QgP1gK!~4=7$OnLh)^PUxc zYa`biHOx`3l?FI-ZL(DIe`p||tL6aLY)B_azWv6q1UeoX>LxzL0?y6=?kO(vVeXab zD_9HGmZ3)2@Jrn0NBSA%g~u^F&IPid&)tYQ<#q%8M|<0k1o>yytEJJkU|bWptbKF6 z`Q8dbPjx0utw1@bd~B;*)8Hf|(8y-7iG|z_3roZ4)&pq(p{`-M1DsWjT`gc9UR5Io znzi=L6jYK-unC?Sv!_myfN(@t>`g)!MbY{J+HRfK%ZJ-LRxBe3lrbTeeCMJCrkZ8x zJ~P3HwD+I#^<2sQ^_6RrET?KZZb;9ksr}&r5P2#Te;neth8r(EGi2AdyCu2c?NUL;TkU(@T`Kf5i3L4_W%hx;dLkW&!1??_;N{y^x-_G?6TC32+uM`x64(Z@{$ zQe7)1&n7EwR=^P<8+*BGzTjHKrty3{l74@cfq`J(?umEBl|)5Cd!*=mS5tO>?)a)7 zNLhAl2W>r{!z_CHq1Dkz-Vt#J`ZNsq>+Z0Z3~~R`=ao_cwsnvE1DB2-g9`~RG&)(^ zzZesgq;&d<+SsPbw;B^Z=jo*9X8IKRVM!lqA7kG$0J(m9oY2yS(CYq3{*SflB=VLs zZHD0=3fIk;1c(ikhsogYQTHxyUr977Pto>}yVP(IJ@EqCUy_njDyI0YF+MN1&PhZd zhX#+wICX@|lGQ-idJBGDvW@C6?u}#SFBuHyq{QCN z*ybd!d&otCK|*f(E+sU+`5u>Iv1^Up4Km+aG#2aKIZ8RF`P*d_d=mq!1@|~!gd4f_ zNUiDSZam=+d7Y&nfT%iHNQuITM5@)e(cX2T!9z>$|KeC*eUJ;L10O5xMfY23blo|T zdjlJ*D37$XDVWGf1GZat>taK|*12~yF<$iq@0~2jFkky3F>IsoJ`-0 z^?Xsz_GPd2v>T%iKt$-cguqU2#>Zf7b|iF*v)pfncF~MXXo%OUfPB9W{Tg%Ta8r-Z zvxYN5zze`5U91%Scu#HrOnZ@W%u$h&p%3ThR_Ch%>!??!CpX$i)wI?w=!}s6z6=~k zeodom&^C5;Xxi!Y)vJpcnY*-|1JnZLL0dnGa;7#t37DzD{)%mjy5Gg$*Ux0^JLGSn z*_|qBs!Wbb{Ms5DpZTy_jZDhB*);i!ojQcjR$}Ep`Okhk`)O21I5TZNT8bYH#i+OxX?YAq%7$$Y zbQg*^W&Iq@6#r?EJ z>L*dQ6S(`ieel;jWxcVPgYxdpYhzxa<3FD$fa3B7?1EoiJfJ)o8GA1Pad#T!EEW!I ztB+a_l=;-?(H2^cpV|2ujN3uFbBk=^?pOUF@d-N^gp4)oiQZywSdU09cTP-bMFcsF9&%#5wDa^pJOmeJRm zLJCgPA2|KmEU2D>mLhh8kGaGvI{fX>xPAyr?8T#-;CJ2tV8xR+4@y`Qi`WP6QeF3| zQNoB@7F^Gl&Z(WR0bIUj9V3sh`)emq?B86=3G0v22W9V1T7;XM)JZ$Ue)<_l-x8NI&x#!`-x+`i(}BAqtbA>+Ojf~QvY8!;u<#bmv#?7a5Uv^dK9v<7ZR%d>W?Kz>g2$p7yW2}8cHs$*7P@K!#k#~qFRgB zVLScY%ALTLlDj}E+;jF_8wo@T`8Fwg)$9|Q?cRv2cecD&m%1T8UxpaqFTa0*H;f74 zM2*@*XX1U_%d<5iJ@igRq~>)4Dg?auQzO(8gMa$K#FyS~&pO-B3DgOcKlu*28sL<@970(Du5X6b8uiiq0Pm7UT}4l5Ry>*Yl2X z@EO>;HNQ~-V4PfMOJ~a!$!}SI==gep^F0%Oc<4N|SlJnpKUkMeP|V7!$z@seh>D&q zqS58Tn+LNkhj(-WpxL7?WC1l%nFSV;_g2KUkW%CauyI%KJ}W$3dL_ zeB^C)e(C*+B*IPs!|&fKC6-U~|1iPwBS5?aj{~&N2et&NM@w*+_6>#_ORwL;{2e5X z(KEsW<BbiXl6nu*HjRR>_vQ5@2Tnwr-&m$LZqC2gTANm7<8jol|i0DWO5%f zAvjs?)rJ|Cu3-5kYt83)wR9`CQ=!<1HLmD9t+>JZn>KeI-GAqw83UNNcCLBoIWe&% z%(tyo8mkhNb>!_wq?oe5WBv#h8e<`kQLIu*22iDZqOva2dCf62NcVXN)Gwdh$@#Jv zk@<^>3iv}UOg3j8G&KaG(F$L_SW-?7qOT#HwU0n1;N+)Nhq}iBard*y=$Svz{Tiog zMC#Di6G)%{vnuUfrUaTdr`NR^1ZxNWo4sbCfGX^bH?|RN20BvZ`WXp;*mCuNuJuA4 z3a#WI+Pn7?#KAZo{X?o0Hp$p^x>NQ_;K%?q3FFrR@2-$g+))tIB*=OVL=Ug9e`Viy zKAS-5*5ysGeZJ01DZxp>K?Q96CBdXKLSfl>DcOEO>gE~-F}be8d9cR%)*VB7wC%W4 z^}ZwZgt@-I#|gF`BLV=GWCFvlems~jINK=dAeuC>eMt)AJ#4w>?a4nV-3xnKP!}{z z(;W4T`OC=<61c9z8qK&O-V3Wr(8u1Z5I+QYXe0;G)i@-m)acY01m~v3?&lfzx1uFu z_bEO}j&r!J7o$8G>%qx`JVS9*DT4Uujw}T};m_hR|G`moWE961v_Xv7jf(9g3Jfa& z&F&;_lRFwgzWXxKk>L~mhi`3tL`%4D_iiY)H*U^E146PlPC@YlAb`D^$Ul`!EIYx@ zPJe<(y$r6y}oNI}D#Af;0zLeIu2A|K&+W9SEh#=L{%u&qAlOH%S@QJhVnCVDD zSPEIbJ<&oeDw!%=6jL80iTFh)bQ)n9Y<^_NCm7)CcgLyFBmnzv#;WU}zATwXQAD3q zFI*>|MmF*&KfkN*hY--*lshClp}~mn51Y|?%-0KK{Rwj4ihg@F2b{m~Cl)8n_3KI_ zL7AyJ%wV5@50z}P3fM-uE94^KjlSCvVo>6~L`q3nWRlDKkoShjddHS8Li{@o>y0CI zF(@=?#$?{le#@2+WMZ$J)?nhg&9)UZWK&cgmY)drf70+XCNgtR1@RM{WWSBVL|j?B zYVhaQ%cJ#{{1gAC$&Dc9;Dwoer!$@++_%6dN+|_8FGXWpg*JPnJZ%4|H*zPKm%#9; z<&T53?h+I8%jq2}_a`AKNfv1B`cSPD*5A!l>A@qxHKBf61_ub3{-@arYB_Xc zRn$)1C0lrdo$Ap=cc$p&puFEH{r7eHo4=gdx-E(6oiE&u_aB+BJ|^j9THbej2-wmU z3*F%LvbWsT@qCg6>=3b8Ou|3P?@Jy4b7&ex3LY=Otp zE-J0|J}O6Vd#uP-c??O$SN{mn{a5x#gt|soF~#4E3_N1IFw*}wBfLrl`&my68pL<* zzWaFS>AjM_Z@O?AUCpZvtJp2cY7lA~?1?rZFkldQK0bC8q2OL}>ZX`w!AB zGFNcUen}F7lE0|9^E5wm2M6nhX#Ak~p@81(n(+JgqdklHX?5(!qP1l3AQKH=?U~QZ z*s6@I7@`N&h~=X3vKtMy!W69o0p_>8(D#SeQ}vHE>ENvqhFI8fBazyG`&`1;hlD1=Au2HQMRZF^=N?;2&2m1nK& zpHbcsIAPLv)Ww4qkA5ZcpyX{TE%E+BFzZv4?W?#{d7(Z7nsauV7n2&8wF5ygHDFqH zt-@Ely!J~oisAmwzEu`jPx%d zFBoRAX%X@BX? z%H1q5R{TyqjWa$(b@fRF5_nrZ`hIs__b0vs%4;{t9Lfs58Igrw{72t^|3zPw!~f8V z8YlAtC(d~dO6+w#QEw0+aB0|AQh|uxBkmQrCyW+7Rw34ASv(SI#W`=!S#SPwSB-yp zE?_CYjVtkfVqH&3fn21H!M^jAQzd^Cv9To_dmhJ*oR*Lu925`j0g)5fc~d{Wr+P2F z@uG2aUFd4+s4b1BX3NRcqNhp<@xPLGuJ$}M&Xe}(u+zIFcVty zW47TEm%xuX)|_s$adP&owm95tk0|OqFS*fF_PYP2%M5opr6EcQ;n{6m`b=nBf;+t` zDg3GX%A+@Fm$-FKAYJ$EdueO5nKyHgq|zo{isuLOO{-5ZF%qR8K5Lh1NF93jh*<>0>Sl7pdblJg za1zcDCB-7Lo~ZZ*J~gcuZY{Iz6QMHP9qjd7#+6FqNtEfRhVN=I&w(`WT(|*!>TN`l zJ5rnh3T@NMLQM}?p;8VbDt8a2&cb>i1LX%ByclD0cRZ#+=1WM1G|I6nKi(hed1>t# zbtXmF4wdAELfs-_Ow-8M95|jA!FD`lt`DaLuftfvk7dMuwIe=L_imTS=SjqD<%Db% zE~A3~%d3r!{3JooUc!JB@ZwKcFp{P%bA`C0qXtjjmeIF!d0O>`6erGdM3X7$IYhF)F%zPyf@t9&Pz8Tr_sQkZmC+Sj+xV z+(aFC`N-BHba7Nx<9P0j>x0zEwyegaq(HL;*3&tpBE|%AmHw@9`SiqWP8A^#I0yNS z?w)`rLbh`>%D?2jM-In~r0G>doHDh|PUy~VxT(c_+E+#9ChTB^?axI5x3SJ2b-i6- zHsMS;2t)cFm&M-MzW22Wu~EnJjR~2QOGlb~hACqPy_FxPt_?t^rV^9S-OcV-uH_}(^>^;2rF?jd zF(x<|qrRWn<$Fx*?hq(g+{dgB#2Z#Z_SP1cr@}A=n=ZM%4~d-Ma0b<|#WNSTb9Go$ zO+}{P-#<~2npeoY6SaS+i%g5tLpRyZO&-`K5e#4J^rI!|nZC1mZP`3b*Wle(&-T-3 zwT^Mks|axoTRyff|H@C6>||ot*aO=hu>FOa5^~kBWsO(} z!@deCm3*dy5&FDr%Qw7k)I-s7=4cmlu~XuG(Y3rOIp^cFr(PDunbA8p9rh%jkIjrf zLwx_|(8djk-JfW_>FG3mZb4qAEb+7&cWJT*f-GuTTZMKhNQ?n7OQG*ISc3^4cboq= zdw9yOssz)j%Va47(Z@sWp9$T%Sf{%p5A;Ti5z=d<2G3Z{@&bJ z6x}zzjQxtSZe@hmqfiob1)xZoK9+b$BUk}T@=eiwMKJnCB^ zUKZY>M)aJrp|49{Y7)$=3DvYAiY17{pg!MdOFstRZsZ2O*@3;V%tsj`L_160Q9ICP zJ8XMVmi`?I9=W?zp%6Rof`pKUG3GDNz;!or7SHa=Hfzwf9L2W8k#lh5=wPkullX0X zenz$sgxO(xhMD66F)G8snmE_I=~nhRHI8W(F}0EV^FOrxcJ5Y_*-*7jpG;-aQ)~vy zalwKO-FP>q4#jDwc+`)!#$tnci*NYuRRkMOFCR${a+;UkX6!h*P+(o?iRsz=-FcFO zya?S7VZ8Uz`m_4qbnG$MY&2)zhc7FneRE*GcG&tgxtJ?PC4aU{_0vQ_A9+<6^54@O zO3nq5QA67Fg`pU3`A>gHPyJujQ&!NB7~JgH?bzvtMrh~+B&96k>;NQ7pq#JaopXf| zd-!;9DY3`9Jr$ka7f8pmMg~jY9pLx2j({?A`47!4MTz zftphStK%&B_OkFzQ6r1pJ@f~&>$+|e7drIVT!?HIvTV)O?aJ{iM@P0p6ZkHsoY;=*nf#zAejJ=TG)pKw~LIj!^uyS~}0I1B4I?l5^b7aRL0 zg>P%MO_rEIcJ~!T9Xt%XF~GmAZO8N4!Tb~b5&0quqBP1B$~yCy*VO8kvr^+6L7T~j znj`P9Rd=BNL?T~L*n?Td>y3NddP@3?a6n#QYYE5`Y?>8k{`5}Kc<9Xr<8<2=bP#Gf z$Xv?L4D^V$f?d_r-QfG7A)=?|P}f((j~(_mlK@~EUC*EHP~2bW>u+KlRck$X(=-@m z`1K|AzVlbZ4bc$O?xW4BUHpI~*Lb9tUjBTpy{Upk!AVO%E`3ak;_U~Lx`luLi+2{* z6hj(+Vvozf7Y~3Y5`wb@9>wKwIJQ@msp-~UOW{LQ1&gr}IcgOKVGFmVMz`?6*AVL^ zu69J7D|DX1(~PJKF8^)GEH#g^Le5BwBc~F=-7GtYvz?O7R)QdVrryvVVlb6`(R6YC zR*#5S)as%_VV0BJWIbJzsh2(5{)#;!X8M-Y)1P4ucbaMKDi@yT_U3$mccUlk|M`f# zAqV&t&|PH*xNm`Obx>ySIWBr--s&KXV4qx?OoJUFO&ioNoy9N{8}CBJ zlZ+a;z>`0oBKJDAz}Y=l@?bqaJN2Bm5pOfgrGZ5u2l{QUh4jzS*N7(zio?6S&oSQ+ zng4kO;B!uNWYX(z1hdR8KhoYSp3OKH;qT7RpNLx`I@~JyVWGJQ+iCJ-_-G5?~`}Z>=ek7XVJ$H zG2L3w9XUXS_KSfC_w{Clckc%0GaEsUe%w{OPMuzmLgut@{nJ^ zu43(#f43{!L~>47Cs8*YrlckeLtc?;N0Y{i8^e4ZVj3#|x1z~5@J3uUA{L9)>F0i& z-6AL+<>IhtPX>C#74q{7ZRHRDR!xVVt5R<#dYX}jB* zQQ$SlsOjKM?Y#8bVdEyfT9;iNH9Sw;zn_>Z7hnORx)R`^vBlsG!CJ-0Skdie4WT!` zojcNfgUUl3kWk-`6ki4D!aZmwu$m@-s-EGvT1y?IlD$5i7QqX^30(^vGhMjFW|PEBuu>+-SdO~-IP zclrsdUO}3Zf@=)4osrK#wWQAaB>8 zO(5CQtXMxq4MJUCGu$(Thvp$Hji=Gb43WMdDnz_C8KjL9;%CYv0KpyPWFfD6jrCL^ zJ1^aS=#2K>KvVh0CyA#{+Z$Gy(Ek~r^zpo1bUBRcLLv@7iN$UPf_UME?8!Bj%KKP;)i`=gu`ln-I!0Yj{fM!)opal8a zQQPK$Oo<>1v>VcO3#L#brEy8lG$+v=rY@1RA*(0iY$*GH?AOF`fx!Bs`O_7B6_u(i zeqSSd&V%V|?s2ZHZD*Ej+PYBqremKfXQbtb5gRIu#EgZc7hk1+`Yb42+n1YR;*yL3#jYi+cEycRMrFqCYD3#2J=4f$x#} z>o}=o5I42=-j$mydPmLeD%6#)Jfb}KGz2mUlH2)X9y?P^3YJL5MzvtfObE5Qp-c@gT7bm3qW{?(kH|3P=ck%=W zJLp>rQD(pKXSl&t=U<3P4OI5Q)WM?`sWs$OM}FTp2*=Yvqxtt#+EnPbig+>)DXk zU^Kw%Q9UR*s+j6*(Bzbk(dP=$;TP{Y7!y~emO&Wmi}8H2GtxpilsCu9Q+ncEY+*MN z%T&CmXn0Tz|L~dVYB{QdtmgQ;jEBUIj9hUB4Bq~4&20-lkV1$&Ws`sW0EW^gsE%CF z+rm1wGETQB-Y7dWIEW{MbfAgQEXmw)ts zF9IR|6jGi{fKNYJ2%Lf9H&GWnj9orJpN_oS>Qk+t2j3o(%_9u9g0i-{Gj{BMgN?aQ zr}-ybZe%Wsi!E()W{1jX4N&^OP7`8Jz;j#m@2n#Ki8meuOJK#B#1E=i^9!c}JQcjg^csAKLWu+7Biuqj{{m>R zl)5E{`6kp6vg~pmV-un86{M-)43Kl}m)1a)uSw#s#aS2^rjoG|H&h!!Zl;L6syeD9 zQ(#1!<{TPbgFfnmHwQLCp2nG+MHVx50hK!hz2ijP#}zHe`1>c+vE&atn=7rI^66Ke zN>la6wIg;`e({OLQ(ry7r^efu5rhJRCfiMXl@3v9OxfhB3wJHMP&3idgE(EgGA7mJ zm|0kuDpTfN8`~>#=BV#Y=J`?>zQi1sn3-1b5&@vXkE3Ux^z=1~8oZ8Q^28K7pp848 z=~sLn#aDDC$1UkRrTknP;1wyBn8k0ee<_>i@yO4hd8xOS<3IJy<~^}TC7%Wi*@6S7s@`N z-<&DEsHhLzHSO)UR|SB){k_FLnhoQ2_$q$FEU%(JLN>Rq)$1+c#2?^5^Puh(ls6>}gxT>;-|MEfE=xPSxmm@TyErDKjWKN@FD68*ud%tS~iiA$M2L&-?d9K9BmU`m^+TH5t z39wMJjq;6+%`>+oY_N|Il82b6S-KCqSZn=t8=Le6ty1@>}__pnVxV+|TavdW)r^ zBt;D=a|@%ArDqJQHZ!RRT12$*!}proK1HFM_jpa(=e%N1NN+v+c9Kn`Qu4vU>CWfq zmfCbl2t1WX;_H{XHir@=jmNv!FFcvQL<@FAs^zHN|3oF5EnYOBm8+S}TeWp;Sh4%% zy#!U8*Ceo!1r}D>n<59qeQ60h7qLX5Aw`S_cQd zGa57NQH?LQZG=8RE%LWV{)`c7^@B5>nOX8SQXf~l@dcJo!XV9a^dQUUJz0f;Es>UG z6@PNqqLthu-1A~YD$YopOyvM$`JScllW5p^qKu-in%kDVR&i}$`bi&$@ZDe+@w>67 zJ=ywwTfe^uf~R}Bge?=id$f*Ha*6Z5@~YE_>ksC!LQ~URX23>N{|s&3z`a_gyRc~X zCS8e=91Ecmzz-VSnsKRo=?9N*{fV|@+K+|Zm*?R$4RIr^>ah3hTvqW7O#TY&G89!! z$_o5u@d&FplfEd;FSLniz=rTUU)p4UliV^94(SrmI)4;@hK=`3^$Oio`JVMl z)g;iPiUknd-X~>=f%awnDt@)f3rmP8WqI6mVs3J{l&i|rqt`Kt=_^k|!C7p1Nf}W7_larpc=%k|wJEUAa_|mN7w!)>q%1f|!~Lc6>y9#F9q&k%&CjJHqYA%xmNCsQX_6^C#o? zuP5JsY4E|!@CB1+n3Q^N@Uj%$%Y>i*a1e2lfvAZw zKG5x}b9JM%Zc>H4I=f3g{A;|{N$nGhTE*^N1MjwG1x$l`Xd5k>v`d}s2|?=pCF~$P zN8X~WZ65}R$bn4N62sP&mvdTrMi1c4QJ#XbUiIB*!>=KU^o9Nf@-NpMsyr7rUfjIbTDMK_^Ach{;(c z@n}803n7*dtR?VCHTPBI^{SQ-6R$>KbFGnWd0xw7`i$B|`O~^gXH#?Zx;PIR#YItf zi{T?&Tfoe1w*qJAB7`{Eu}5!mpnaC_d@w*YlXNnpbe3Hm^n5X-TqrxMqsczhU>{DI zm#-H+bxqz|i&$DdO_}Ks5tEk{k;f(n2>~#i)&z!B@b$l6OA4HiE}VDBrSYqxg`?-ime9vFMsozj?}JdeBO8l_r8~rf=$22g)O8PxtZaR zg5$jT*nsK2zzccV%v^vlrV(`0qXT&sna|Ha*r{k`fh%`?|0gooTqCw}Uhla^y274pdw*6*5OaRj zAYG0cmlXH4^6^rzEJOkrv+vqzr??-9&oaQj@f0R0ayD$COoR+|&ss?kbI?1No3Z)d z2s$eR2hw78N$KQP*|I&)_$@t~GG}ham_55IO0fF}qW~jKvrs%*cAuuGgLZ~QQS?~= zZO1KvF4T?WV)rKh5Ucl1iQ0W|I+g8|S#4ZAsku)I) zQS-AL-tsq9FMt24L~iBxQ*bzbmEzx4M%7oq^c`=q*ytBu@P0wL3&lQ9CUK5xJTtG~synxOer#0X|01AxI894?%Q3S* zRBC>nrFS-Ca|`4)VsehpaCH#ajA~mfWB1*t*G|x9+yo0=>b&L}N}v~<)R7F!-uMdQ zgJz>Shfq}apEIs=xx}2UC+OQIi2qqJ?IW5}|7UZd>N|<-v-hpV;v*!hC)Nh2m{1@S z_2hmklF}wgYEhpqfg$D~A%Wuy2n|l|p#4wLqeE*Orthi2Q5!_fbP0OVbo8H|M1qg` z9&L?qLimD?TETfqQ{*hD-yI40l)zzf$feCqQI?uyy98Q- zGEz1mM??zL!uKPWoxO}b)oD=nC4{32;)B--;ua(JOPSmOpQ^*JQYueV21=JNHzMxv zeZVDlx}U?{xhMc8c7Jm%c??EWL2mohFR5?i5Jjo7T_TS;E~ogfra%BUjG%m;Hz45P zKab66GV`ng=~AiXfNUNF*sd3$o*iU{As;?H8dtWDj$qRQj_H7-*Nc;D>DPsXd_{BH zI*ihG5B1%#k2!{}(FY(8znbXrZAJEOMp6N@bXez$p7CR~&em>G-3_wVB-jwWg^Z#X5F3&xTeE%2zup&5YUMDQ_T?F5F@qE zy?pu=jp-6vxqJKqvVJchf<;cIJi8)@(w6F(+n4SgPklb3Kn{+CnW%l{W4^NG0pMZ|rQFWxv2436`f$3aj0gtk$s-TeKEa1)yCkv*&D7@i%r!zEl`CI8tE5j>(SL_{&~jw= ze5$4|8QBBzMva6f#Niz(1iRbn%k%pJC1J>CFOQ|6CK!U}zLDuW8ymNfTlf!SMJ_`8s;N<+d;hmM>`k26yX8PX z-+M?CYtYK-Ld zs;?&0JkIpfweAmpi_cpX7cWxW$Rz-b(7TREPTa$p^jRMv0CgtT^8gTEV=Z?kdc83c zAy+F#_mxJD_zY@sLaFyOOUPrWBriSbncxY48I~in_VF22uSAJx-3~sz3`oi`w2!`G znQE?_^p{y!K;{b=9r(5 zir<)vAJAj={vgezIR?6@t3T2j{mnrQ-hY%zEG=!+Vx*M29M=Nb#p(4==*3z`H*%88 zW|Q`m&s39cl`Q)Y{iQ%8#x)`e-0LS~xzfu4Mg@p3eYpLZU zIE2!s_`8R0U%IBumMp$nj&|*$@83mpg7WxFHGT7!*W=>ptHTJFKZ7ZSDQ>2f+5DUe zUfJN8Jb3i-$>bQ-pb;FguZj`!#qS8H+#Jf2xB*|k^2h3oK$Sdn;^K@#wz@26Q<)e) z{T1GiWZypzNnIoCd z8Jyh_!YS0pso~fyCVTZ(@Va$_9~w2k#n?ZTC%?7qnNCb~DVS0e4`MDLyEBy?A@Yzu zTaUb|=knaab?rSWV5SN&hWp)_VL!t=xkb-HBPGOJHI2`QVXq${$8Gd?gX1ZeJzr2y zNj=$L~MX3wXGsbgI{%DIC@|tu?t=oB@k1sHHNl4XiE{Ttf zs)ta9UlaAXp)tjtYVT#sKqhvMSw*=!E!kxGu(GQ`+vb|Ruj>5JNy`>^BQ=1l8-d8< zGTmX9Y0azUuGZdY{ZjIo+lx)x;^>(%jd2rQdygfI4{VuaxRzqrRAqV*ru6Jwb&$DS zoJXf2t|AM}ksO>unGkA017;KXoDjBNUt>$P1{0<*uA1OX0AE}PYJR3XEm^Fg=w>@K z(>8X3eYQ1RKWtIF<{VPLu!^YIgoGb3`SRddWSHe9aHL)@3J z^`>YtPq=B!Zt~wocFd%D#0!WoYE*$x_>tf@&HA^D}y?fjR%3jJJUm*GgH#uMSzzdwD>Ne+y?lM`_L*p`de z;oQ`bUbrsy@Z)$$6khx3((nLAgmBv(qrIhMn`v;La)C2w?_){Zu8JB;8T%Psh}*2t2nvnhG9;B zS9mKGg#LRYv_fsBL|P$y_szGTff`iocm;pT)S?a=Kblb2x^mq_b?r=a^QpUpwbsv$ zQhzc)^%UItbeG9@b05S$b_;U8BqAiSyQXl1QP!pVE?f1nZ5II2-?)#V$*;>c+_F>(gvj&+fySkXa z;pn;0YMZ&l+vBn%eKlA>`|(JNNFuFeU!JwmxX9OsFK1_j7nv-TweRso-z&V$MHd5( z3%*U0U9$hU?f2OW_5;Q6YCiJ?ysJ@Nr>b)9r2`sr=bS0SA`)}oshIdRPOXnrByf}s zXoe;}V&95=Q1vi^Fw*~0Y5S4H>)c>XPjpe^9mC{!-eI3Ws=QbVC-0IVo#AHBL~~dfH>Yy!#B~9dKF(a# zXM)PXzt6!sLdi?y@3BwaxhBS~tn8ybZ;HRB`lZ62^88?MzGstns$l1I+r}IRbAhcN z+H0b5oF~XEtxc51HndGS%$mP8yX|7b7OR&4K;vU%E2Bo}SB;Bnlax=ceg|{q_z`j{ zmn)Qv3@vce)A!uYQ0$eS+H8AMBHWK0#P2`-GBs`Y(JjW4f-81Ir6dr~Yx6ZbsCXvk z_lG$Y7(lci$lR6&`5jaD z0+O$d^`p<9ASDulPo(v{4x)oT`e8c>*JQtaBflf%9GBWrI+;}~@c3v>y|C2j>cM?V zz}I%K59k#Ql39h%ZZLefo3wb5M-Q8@MGizz=Lk4Do-q8J$uR!?{4SaQ2Ge)be&J`^ zfB+Cg(~eK#UDQmGYqFY$pf9<)P(OYyn7;Ynfn_Fu;i;3^%H+)OyO37ZxhIoim1{|Z z`JDw08yY8(Y}pQYKY7(R1)YgZg`K2ykBzcuMP6cnK zyM}D2frEbK-7SuGS#)PEI`!t)(QIk!8TUu3aJb)`OR%{TKTv$-%_Vc(pRMeiQnN8e zVwNN1meWJw^yEV_?NPG$Z0}a@qI!6$9emzaFP}z*QBR#6C}o`&vM!*3k@xTrzYDNE zedluTEI&_22+%)yD~sr#g}oL3{wy_`28ALR&<|{g-cbU6`cp(<+i&rgaMZhu?Lb;{ z0$M)c|9JK%L~E+bVThqeyhiFkSmMPZ+!_fzAFi&3`=*ApEcS7EDo+@h?1W4ii93Hu}S9 zCx85T!K+Q6u*LKMaF%vFtdrly z0lSx!gc_@yH<9%6Z_i%Iug%F=pbdMm*@c@2$tc_M?1Ez=p4Q>}i4FowUWGQXTx6%r z8X*3f{I5yF`muGUCd*VkN;fZUAZ<*%b!*f;M=+c0j~@dda3)}l82|)xs$@^TXLrRj43RQ{Mw&QbcaRZP40#n_HGX2U zB~G`#@AD$dIN#*<7N#Kck5-M;&?D78 zbm5jSn{Ut@0MYKGaDSm(~Zt&A?gHQ=0^t%R1yvNAuox5lKf^Xi<<<mAe|wQJtsLb9koxNJ8`i>0sF?^AZvcKFjbmJ`_00Uwvk(S&C91GOLGzQm<$Z~ zu(>cW6azx~NORk_RIZh1$?o6sk$4Z&XwWQ1piaTLTe&L|e1fpb|sWAE-I03xJUUJxx~t=#ZxO z^!ceHz{?1Lnlu0zqhVCi1=he62#Ay!w+K-rq_0vFR-_`W&VL__VYmR0L3&P_jMh1D zQ2!!6pxC2O^Bn;L1NXiy=QJ}#;dlo;wtW+g=@MYbx;60USy41Vm8R|zzsU{|8o1(= zfVU>T{Ycd>P!!P_G1r7u9^gTa^7Fib9p%!j76I$`l{SF#3|{(ozLXQlkg=^2mjO2wEX-JEK0c*cqAAPp>JsOqfDBKtQ0!iSg z&kxV?_CDhv1Lc&CZU_5`0uF;So)Lu^ZC3Ukosy^WDZ6*2=eP3fCzO_5e)P)%7tx%2 zyCEu*bNu=3U1gBI>-dsBat_p_?e8e>(v!bB870@G?OjAB((_jnTRt7A^fQm1b8zyI zhCIlcjJmwtN1pedXUH9IbO%rJ9p#CPs43m*xxgdg^kzRH#pl z8iVQ6h?JYb_5C?1CZiRFxo2REfiZ5zHCINA?tEm|pAo@17$yKQ0406-o{R8?FY`44 zk7q@YqA_4{K6U0Dd5T;C3s8}72l=Ox$VEBGcD@q(P!IFbKFDtjrt^rN$zY0 zA3a*9QQpqQ|9m(u1v(es^XVAV6QgsYYiRU93keH9aiYFtfqodGcdhA4wx=ZFO&G%;hm>xgDJvKa-ObfJFV!^xL z{qBM9W1sJc=zIjKP6|7p`9qfikMo`8vojyp?bDmirF;7DH*Vb6{(oaIn!8v Date: Thu, 19 May 2016 09:18:20 -0700 Subject: [PATCH 337/439] Vicki feedback --- education/windows/set-up-school-pcs-technical.md | 2 +- education/windows/use-set-up-school-pcs-app.md | 1 - 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index 773f61a13b..93a7b7c1fb 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -38,7 +38,7 @@ The following table tells you what you get using the **Set up School PCs** app i ## Prerequisites for IT -* If your school uses Azure AD, [configure your directory to allow devices to join](https://azure.microsoft.com/en-us/documentation/articles/active-directory-azureadjoin-setup/). If the teacher is going to set up a lot of devices, give her appropriate privileges for joining devices or make a special account. +* If your school uses Azure AD, [configure your directory to allow devices to join](https://azure.microsoft.com/en-us/documentation/articles/active-directory-azureadjoin-setup/). If the teacher is going to set up a lot of devices, give the teacher appropriate privileges for joining devices or make a special account. * Office 365, which includes online versions of Office apps plus 1 TB online storage and [Microsoft Classroom](https://classroom.microsoft.com/), is free for teachers and students. [Sign up your school for Office 365 Education.](https://products.office.com/en-us/academic/office-365-education-plan) * If your school has an Office 365 Education subscription, it includes a free Azure AD subscription. [Register your free Azure AD subscription.](https://msdn.microsoft.com/en-us/library/windows/hardware/mt703369%28v=vs.85%29.aspx) * After you set up your Office 365 Education tenant, use [Microsoft School Data Sync Preview](https://sis.microsoft.com/) to sync user profiles and class rosters from your Student Information System (SIS). diff --git a/education/windows/use-set-up-school-pcs-app.md b/education/windows/use-set-up-school-pcs-app.md index 28442ed89e..15363f3962 100644 --- a/education/windows/use-set-up-school-pcs-app.md +++ b/education/windows/use-set-up-school-pcs-app.md @@ -35,7 +35,6 @@ The Set up School PCs app helps you set up new computers running Windows 10, ver * Windows 10 automatically manages accounts no matter how many students use the PC. * Keeps computers up-to-date without interfering with class time using Windows Update and maintenance hours (by default, 12 AM). * Customizes the sign-in screen to support students with IDs and temporary users. -* Automatically manages account profiles on shared computers to maintain performance * Locks down the computer to prevent mischievous activity: * Prevents students from installing apps * Prevents students from removing the computer from the school's device management system From f9a7ca405a0e0cc638e44f5f13c6d3cbeded38d1 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 19 May 2016 09:27:09 -0700 Subject: [PATCH 338/439] troubleshooting --- education/windows/TOC.md | 6 +++--- education/windows/get-minecraft-for-education.md | 8 ++++---- education/windows/index.md | 2 +- education/windows/school-get-minecraft.md | 10 +++++----- education/windows/teacher-get-minecraft.md | 10 +++++----- 5 files changed, 18 insertions(+), 18 deletions(-) diff --git a/education/windows/TOC.md b/education/windows/TOC.md index 450b18a3bb..3d85abd08b 100644 --- a/education/windows/TOC.md +++ b/education/windows/TOC.md @@ -2,9 +2,9 @@ ## [Use the Set up School PCs app](use-set-up-school-pcs-app.md) ## [Set up School PCs app technical reference](set-up-school-pcs-technical.md) ## [Set up students' PCs to join domain](set-up-students-pcs-to-join-domain.md) -## [Get Minecraft for Education](get-minecraft-for-education.md) -### [For teachers: get Minecraft for Education](teacher-get-minecraft.md) -### [For IT admins: get Minecraft for Education](school-get-minecraft.md) +## [Get Minecraft: Education Edition](get-minecraft-for-education.md) +### [For teachers: get Minecraft: Education Edition](teacher-get-minecraft.md) +### [For IT admins: get Minecraft: Education Edition](school-get-minecraft.md) ## [Take tests in Windows 10](take-tests-in-windows-10.md) ### [Set up Take a Test on a single PC](take-a-test-single-pc.md) ### [Set up Take a Test on multiple PCs](take-a-test-multiple-pcs.md) diff --git a/education/windows/get-minecraft-for-education.md b/education/windows/get-minecraft-for-education.md index 3a815018d1..e71bfa5826 100644 --- a/education/windows/get-minecraft-for-education.md +++ b/education/windows/get-minecraft-for-education.md @@ -1,14 +1,14 @@ --- -title: Use Set up School PCs app -description: Learn how the Set up School PCs app works and how to use it. -keywords: ["shared cart", "shared PC", "school"] +title: Get Minecraft: Education Edition +description: Learn how to get and distribute Minecraft: Education Edition. +keywords: ["school"] ms.prod: W10 ms.mktglfcycl: plan ms.sitesec: library author: jdeckerMS --- -# Use the Set up School PCs app +# Get Minecraft: Education Edition **Applies to:** - Windows 10 diff --git a/education/windows/index.md b/education/windows/index.md index 7fba6e3d70..f7f9f123f0 100644 --- a/education/windows/index.md +++ b/education/windows/index.md @@ -19,7 +19,7 @@ author: jdeckerMS |[Use Set up School PCs app](use-set-up-school-pcs-app.md) | Learn how to use the **Set up School PCs** app to quickly configure new Windows 10 PCs for students. | | [Set up School PCs app technical reference](set-up-school-pcs-technical.md) | This topic provides prerequisites and provisioning details for using the **Set up School PCs** app. | | [Set up students' PCs to join domain](set-up-students-pcs-to-join-domain.md) | Learn how to create provisioning packages to easily configure student's PCs to join your Active Directory domain. | -| [Get Minecraft for Education](get-minecraft-for-education.md) | Learn how to get early access to Minecraft: Education Edition and distribute it to your students. | +| [Get Minecraft: Education Edition](get-minecraft-for-education.md) | Learn how to get free early access to **Minecraft: Education Edition** and distribute it to your students. | | [Take tests in Windows 10](take-tests-in-windows-10.md) | Learn how to configure and use the **Take a Test** app in Windows 10 | | [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) | Learn how to deploy Windows 10 in classrooms; integrate the school environment with Microsoft Office 365, Active Directory Domain Services (AD DS), and Microsoft Azure Active Directory (Azure AD); and deploy Windows 10 and your apps to new devices or upgrade existing devices to Windows 10. | | [Chromebook migration guide](chromebook-migration-guide.md) | Learn how to migrate a Google Chromebook-based learning environment to a Windows 10-based learning environment. | diff --git a/education/windows/school-get-minecraft.md b/education/windows/school-get-minecraft.md index 01a29c2dc4..842ea627e2 100644 --- a/education/windows/school-get-minecraft.md +++ b/education/windows/school-get-minecraft.md @@ -1,17 +1,17 @@ --- -title: Use Set up School PCs app -description: Learn how the Set up School PCs app works and how to use it. -keywords: ["shared cart", "shared PC", "school"] +title: For IT administrators: get Minecraft: Education Edition +description: Learn how IT admins can get and distribute Minecraft in their schools. +keywords: ["school"] ms.prod: W10 ms.mktglfcycl: plan ms.sitesec: library author: jdeckerMS --- -# Use the Set up School PCs app +# For IT administrators: get Minecraft: Education Edition **Applies to:** -- Windows 10 Insider Preview +- Windows 10 > [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] diff --git a/education/windows/teacher-get-minecraft.md b/education/windows/teacher-get-minecraft.md index 01a29c2dc4..98c194c982 100644 --- a/education/windows/teacher-get-minecraft.md +++ b/education/windows/teacher-get-minecraft.md @@ -1,17 +1,17 @@ --- -title: Use Set up School PCs app -description: Learn how the Set up School PCs app works and how to use it. -keywords: ["shared cart", "shared PC", "school"] +title: For teachers: get Minecraft: Education Edition +description: Learn how teachers can get and distribute Minecraft. +keywords: ["school"] ms.prod: W10 ms.mktglfcycl: plan ms.sitesec: library author: jdeckerMS --- -# Use the Set up School PCs app +# For teachers: get Minecraft: Education Edition **Applies to:** -- Windows 10 Insider Preview +- Windows 10 > [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] From 5a00c00858511a29dc332ca11c5f9f9491970799 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 19 May 2016 10:03:34 -0700 Subject: [PATCH 339/439] header display fix? --- .../windows/get-minecraft-for-education.md | 8 ++++---- education/windows/images/enter-email.PNG | Bin 0 -> 119594 bytes education/windows/images/get-the-app.PNG | Bin 0 -> 129831 bytes education/windows/images/it-get-app.PNG | Bin 0 -> 110733 bytes education/windows/images/teacher-get-app.PNG | Bin 0 -> 103443 bytes education/windows/school-get-minecraft.md | 4 +++- education/windows/teacher-get-minecraft.md | 4 +++- 7 files changed, 10 insertions(+), 6 deletions(-) create mode 100644 education/windows/images/enter-email.PNG create mode 100644 education/windows/images/get-the-app.PNG create mode 100644 education/windows/images/it-get-app.PNG create mode 100644 education/windows/images/teacher-get-app.PNG diff --git a/education/windows/get-minecraft-for-education.md b/education/windows/get-minecraft-for-education.md index e71bfa5826..304a564556 100644 --- a/education/windows/get-minecraft-for-education.md +++ b/education/windows/get-minecraft-for-education.md @@ -16,9 +16,9 @@ author: jdeckerMS > [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] -[Minecraft: Education Edition](http://education.minecraft.net/) is built for learning. +[Minecraft: Education Edition](http://education.minecraft.net/) is built for learning. (need more marketing blurb here?) -This summer, teachers and IT administrators can get early access to **Minecraft: Education Edition**. +Teachers and IT administrators can now get early access to **Minecraft: Education Edition**. ![education.minecraft.net](images/minecraft.png) @@ -32,10 +32,10 @@ This summer, teachers and IT administrators can get early access to **Minecraft: ![teacher](images/teacher.png) -[Learn how teachers can get and distribute **Minecraft: Education Edition**](teacher.get.minecraft.md) +[Learn how teachers can get and distribute **Minecraft: Education Edition**](teacher-get-minecraft.md) ![IT administrator](images/school.png) -[Learn how IT administrators can get and distribute **Minecraft: Education Edition**](teacher.get.minecraft.md), and how to manage permissions for Minecraft. +[Learn how IT administrators can get and distribute **Minecraft: Education Edition**](school-get-minecraft.md), and how to manage permissions for Minecraft. diff --git a/education/windows/images/enter-email.PNG b/education/windows/images/enter-email.PNG new file mode 100644 index 0000000000000000000000000000000000000000..644d893f061f0caaa3a1a0cf41e2e08c71ee6e59 GIT binary patch literal 119594 zcmV)CK*GO?P)Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!~g&e!~vBn4jTXf|D{PpK~#8N)V&9Q zWku2cU9%H52bNuyoF#(^Q3-+~ikMLlMG+(lNR%K5B0({tqF_Kp6m!Nv&PXtTfFMfF zvamVt%C;_ZRb5?O9Zt9%mt1nm;zu63KZXt+8jIt< z1JGHlpT&z8wG%orjpK8HMDGxZfzoxvA~PWhRv}z?4C(BQMLwzJ24hU#kc=)D6yhxy zc>Y2GeGRchi%gnx=>Io){QnKA4wi(PT3dnR(t%uSRzcW0?U4Pn%E?wuk96Bp13(y% zG!U@RA)U{`mX?F&a|cPGdf0Yc&u52c7o+NI$+~rP42jMm@Ju?-58AX*yM08Z#>orP z5rvl}SU9_l=Sf=ZM>!+5a@`jlC#a5&@2Ze_XNpZPH~TmNY;6kN+#KcCYj1Z=kw>!kG0lbCpymi z=DCYMd&b9O;)IDppyc3%&6884>MPF}U^h((&hXhxp>7X6W zhAI_U62KawvXm|eDn@Lv1X`r9Z~=Lp(b3hd#39kwC)%AI(K)n7Mw>Y|nbefh_?=tkZw*3z=?*!Tea-t>V?(Xgw($$#*g6Ps_*asit z(4zTlNy=A*uOV~!X(xgM-8NQ2|1(Qr0@!ljqTX28tDxf|+0bHp7a_^8EGvpA1W2Zy zRXS%lQ9m3B#hXyJ6Ng2Xl+oSY6+Jz}oJQ%s-n3OnyAPU2VPp)T(C-K6UkCAF^1#G{ zdSmO0lDO zP^#0{(P!mY6?9ChC_d!&s?#m*Qwgo~DADWELhF_jQU|4BHU6qGJ#;zGZ1gh(VUm;q zodM{LILXFUAcm83BNhCFl*5?Hq&k*7PxGhX86O;)ES82hFx~B-4wM}deXH}(p@?hnW2%9f zb%K{3Atz8erd=wgqC=F%$Bm>U27=Bm1?&!^DvT-N37o#zqxn*n$&VO0U-)*+^b<{X zU<=uVR-^@x&Lgx_PuL7$kp`ayy$dBXjzw~d-(owWEJuJMWh-sR>Zz-z6Ul2lgeI#X zbjo8g(06IViS$ew7OA}vAKfx&F|%*_liHu%*&t)cG@FX+&&0tBvcKrVZ&aZTM4IP< zA`>c2P=qv}!@tHW^g9u74qgFg^F!sSx8k&$`hK<)*pk^f1IqfmKUBFmHq;?-&F!ph zMdaxRE^sw3JCG)D-kf|XMTC8>AEPT&8^gY=KH~B#L!=jMj3!vHV7@~ZNa5gT5+$hu z>5CT0uC=JBZAx~=mW0gX7cB`82&PJ7z{73`j1RVZGu77>Pd#VZB82Ob+;D-`i_U8r z#lW%YkVG-{fiy^+iU&i)5c|&|@ys)mP9$T%1}IL2+B_BRRTm`#w?*V<7DI_E^`kj?GR4448Y!wPeeI*Zi>T@=gU zQOe~f!LC9~IWN^8GywHT3Pm3imSgk0!qRk7 z(>Yo^>5|D;ZBMr)4arybifwx0rUY!QWLYYJQch11l^_CYmtM*-lcnvDj&>uvlp{&S z#8>J1rc;p|!n6OW~Mz+K6Z=ZVJD%lSA7DgCS`s} zqz^G@i4OGSDd>|f#!rFDV@O#pu!=xAmbBp4zS%5?&f#OfV1CHVG3y8!b~&tb1(!r0 zvUu{)V;{0H$cnDzEFqmV?vDaKNpK&uTWmpPzi1;^(}0tv$MRpXI@_00vMocMJpgl&T-1jMnFELSi@-|qAX^iIpaoU zE`!m7XvHX^z`zU8!0@SjTZEqjxKSA3^kJs52;oIBSF*LSOJnJr0c(h6-9wmpRUFCG zNzl1K#t+S8uBGmYbi&_T^r9bMLHTi!4(6#lgfMN-##Gdwr1zNP# zRsz`6Bk7g(pina#NEkm0>mjxcQ7F!m8Sx^#sAjgvP8Jgw96@RtNoYAB+q5lb(y%>> zE}gn>VR4lV5}b>19e6s#D_bz>an6jDKEWz8cLAWI-@>06Jjdh>q3pbtK=$JSk3Oe! z7_;q9AM7l4kFxC0;iFSRawkS+MvbmGVka>&R9hX=DN053W6j#xinrrbCOS0<@kXxH zNPoy0i-DOSs{#VmHsD-3aL`~!ovYuVZF2ipSSnB5YJe&v7xANWp9t5jggh!+dYwO1 zLt-x(sIQI$J4rPttK~%mA*3B-p#8o2P%!1ejtbfDGq^3G3;hyk`}7lNM$$>%4)G<$ zU0wJd>=o>=RR%rLIF^a}q6gAyxx$x~nr*}OB@SjzTPiL_-EPMo>6f8WLoe1b7D4?8aI^%LDtE(ZZ)8UX zgpe|fCp*D5kejwwnyTTpGY@P;M@WEUCB{4;oo3Xc0rP{rN0E6xEjU zn0bFlBSrHlTfucy0}+JHIooTP=@89CI<%_mai8R2-Ep?=&Eo+TL1L9)qa(kcXa95KR< znE853QU=9VUk-r6SFx0+YF_Q(s5#6r|pjRybBLy1=~179JROhN?R}EsuH1 zK}$ajcC<^4>&L!@5A7gP%+1FdZ=9oV5)hHN195_R=dmiuasOujZ6A%joS~G%S?So~ z=YZt$d};%?3<}UG{*lFj4WI~G2S9)}SE7TdqKX=Uhk^$TfhQ9fA6d$Q9QMJnODl(= z-9zPV%FwOb8rn+EKDRu8tfD|4qM|C?CEwqz!Pb(?*U`?a6@hCiB9|l|jQ4tLJ(XgIZ`%V~dlyP?t#dNH4==B*VJ8 zVt9AACkw8>%K9QN1Eug>1Ce~*;=fRUaScE!paEp`OL&1mjr)hR9qDF}pdXiM1*c1* zrkss96m5=tglFgCCeCxy<oufwKq4N;KWT$8P$(Ls9r+@pLEYy6=7?L zn-FpvO6AH8AjVZlIr3wE7E0PMj*iODfmdN++3tcN_?97cXZ;ye&NNEk$9Nq0Av??G zii_2PtQDSAhOClr5|%IJsd75SC}z+C<2xzkaklI~S9qZ7D0;~kJ-9)VH~EV5$5EBsJ5o6LJ7RCoO!%u@QK9CC`moI#!%hm|9LDD@)sTQ6=diKVkB}|m$j>@4>ZXJj~Ek|%-)&|h3lm3xk~pJq%IAyP%`#FgIQ>FtTOA7AV(~sEi$=TEEKm zKMGX38ESJ>K!-K_Pe_DOtIqI5?+!|;!8;0Iq1-DbS zfbD9sL}!CPBDBh6W%Gz#DKjTu>7-%Pr}paQIyCm8yzJYY%OJ6P8IGywh-iIk+dkP0 z4g-A8{uS8HOy{5Ux!V|=lsQEppIJErr|SURaTV+bG0Xa$ls7i^Nr*X=uK};*H44hL_bSz{6__d5`*DsjB^A7rjR|z&|KnJt7 zM@J^rU-&-FAEhZ>C~j9PKk3oR4mvdnlg+kA-sF`!W3>gC5+v9q)2F+OyDz)Tu9Di9 zJasJat=DAbgDI5rrGu!5Cq9+BFk$M}>fNh)1?t4)ChbFbI^-^)Eh_6%a9!7OL?-G@ zOW3Z_iEQ5lict3BI!%2+4Vf*qKz$6k%2}?K3sMtEha}EDm!$(gnO_Mt0a^?M>e9ya z-n1*BJjEIK+5;e!KM!BSA{%VTg)xx@OR5)RoWW( zFG7-UGpNCeP(X;Hzy9!Fmd18Nn~7NsG%z-zfUVdT8lkR)YOpO~Sk{?aFY6(lA};L> zp6$bqLMcPk9=>)43Nm0vrECSY5dj>o^;tI2fft>yuEJV_BQsZ(r+fQ?KSAxypl3Xt z<1BFYCW=fdL0Y{Y2yG8`lvRB=*7Ci5y&iNKOnB@e>nsX*gCv)_V_V5b&S@_)3B(iV zV@PTlB)hje>&#s|xv`77SZNeh9qH#uNjdH(qJWB&Xvd{8{XZ#!2un<1i=FES1>(x0 zE^Hy!NdS7JJ{|-qD*_Tnc_ObeG?Dv%iJM40CqPq$+JO%~Mf&FmJ>x7r0G4|hfLg8E zeuxsl0ujg%{~{-RjSmzw^l#@bBzqvG;}@(s+Cb^)d!VJX7A^c#*38438iDI&zL`tq zO-K4p+d&KAM-O^>Xya@P$hl0ZgvGEz2Z!{K87z(XupseW!QDe`L$({}VaH&0vwdxvMNA{R5)YF(vbDyLpf(ar-ZysRt+k;b#<4s-aKb3Gt(AD zw`dJj>#({Ts)25(>c^I5kJxr8ARmg)8FBILD1y~ zvnlZe&T6g691!4%G8i3ghVX$IL4g3foH!ujuB`WRo3njY+oEJ(3Tw7I5 zZLUnS@-eBU&0r6lDUFURS=fSVeVPP?YkyG^)4ZUg0g%<7YyyjPhXoJv&?8+suB$_c zc=v);X9K+YRC(9W#KA#U=tNoVaaXV=M>@{|Br_RYF(0&m43zB${Z3P6l3LBI6X`I1mm^Jo(g#ukl9s8N53X0*R*X_)AFSl@F|6#nhVXcpv*9%LzJd{B@Fg4ydb;8)>Q+L<64##Du=FGZLDxx>0_ z(lPB~gHUx0dy*2|&oL2Xf<6e)(LvhqZ$BVEg-mjJMA?K|fy8Tq&-FtdV4ez8CBHd9 z;P~0v@u0x9KqSG?@eDR};X+51(m^3VC=ZHuP(sLU0pd6i(rL)WT2YCncny(bQ0ta* zfR1Q@n9^uq^KlBC0G%l#w=a=Z0~>+sbPE@Vrb6Gs=vLrHl^*e7U>mCAF!3HL-!)VQ z#NfwZN8Pxy6Y4Y;!SpSMYn6>8K@ih%rRC~ag{dB8Bo7V_?^$Vaba{m)a6T{%Iws># zF=)$d*OFn`YF_GUSplLo07x?c1}pZgK|cft?;V$ijM z)5&*{#C9QRS-vmRX%JC!nvTZjm>l?}Ow}93(|n{~&ZShY|8X~O+82B&0B!7o0!hya zm9_%dHJOUCg6!_michv&A7g=M3QbvJs*~f$O&}}f^rz5vJ7E*bX5d4N(6utROjZmfoIexbIm; zXs9u13^^`VTLd0Ap!YL~@n|mtYqwYq)p-tl+&-)z3o(CaSkV|psgD9YsSC3l^i&&% zCUjghX?Uthx;3U^G`13AQLj!Ui|d0m3XhsohTkSYq5^hD9X&~QMjIE&pxsKz(+tlF zP2@oeK(z8~3N$EyTth)dCk05UxxgUY1_u>neuO8oUOA_eiGcfKk=?(fxy1l!2D@@Q z&@ea|T1xpi9Al*BJ)vWeq?0S5)j9R$uH#-!!dk09rI{NHRmL;?npV8c*7jm@oJ;6{tD3g~ulv7B74KwOP0N*lz4^0}AGQy|! z;M2q|UuYPb@n?ftc939|DZ0!6o+1v!8+ii(FTf}5D0Pm7`3_B2L`Uq3sOp(E*q^2+ z{fc>TK|b2U2Cq}o$++7>>9#jHg4DZytUo4b@>}A?H9%H?wx-%{FoiFJqWP7NWrDhn zDuD>}gU$}EBDqHFG|8+CP;DdN!yL!PSK^UGmbX2DascW8%#H|L9B}TU;TwV|XlWrt zZWf0;>GTmMP1GCN6WWueL7~N{6`CJ`==7>m^Tnwd=9WO5w~sM?^!0W`??QE;g+p{y zC4A%!ExeLUD;y0eU7BIiiCqmEj2SZ>T7tVn>s+bs)KrE6tk3(xN|Z9(kOF?8!K$gt zjhlPhm=N1Hoso|fbh6y<&{6rU>N@412wfbN-=)wk;fG6%;VL~;${wx;^Q<%TNF9_?2_zTA*hd7&twW;tuSkX7=AkdT@Q6BDGpP>OQmQx6&jfe{mp4{r~ z8wxbb&R0gM5Al(AXgelqg%l#GBtM3c86pHd*EA(Xe#uH->J(jXgPCuBXqv>Ay}92= zQ_=y0KYMXFqdwcV`hc*w=I*!W=!_4Jt{ANQum{(&%?k;hiKHC$X6`8j_hZC#|A(IH z&FYxD2PvPo&J$8sDPHLh!~u@*b>6ar9raRz8K5!+WLjE~s!WS$D-1l>C$&QBl#h^X zHu~vPz{a@N%ex_n{Z#^%PQF~&nwqO9n51~;%J4ri;76YA%tL-GF zY=MbfpW4y(DZ|A!hxQC>U90mmu}VXq=zu|J5%{9TK*yVTY*Wf7&)cWn*dJ|(-Wc4) zPd|R0q|W_(G<9RbrFQggg3{O`_4Q)fRv+tAa=BmdRlxSKqaiq4zG5__^i%YKR=D2+ zUHT(r>hB}{qTqF0aQ=77>&;eDLMAUCERLBH^0nP_;uT$UV>SvB&=3_IR|mXk(a4Cc zo`_Ln=2>YK%uPQ-x)#TR86)EHTUL(w^VNA4=iO>hzyNY~B19CaIC_IP*B!8EsjM*5 z5ACa1ryGU_6K$1U+@o1YkCyXx2s($Jn7f$ErSg~<&=sX#E4iCA^AwJegMd6~I1VM@{Go#rQ3-WH5`{`dFl1Sl(;!7P=TgP{1i z2uE;iVZzJyaObx}&p{Ck$WdQIo2;R3-?+Mp8y}~l!23P(kqJ^IcM;Ne0dj<`atu{p zC6RjZ=9_K?R1KsiDMe~Q@Q|BsA85}L=t_?T)s50(%)*Vh> z3Zl-UNnIK3a&?Ffz)M*HJ1*7DF42w=XPs%5P4rYs6%aS7EN4jTxt*Q^J$Iux5riWwFCR1YM zDzjqL>KR6tFm~-((KEa^Cf~VoEY?aeb%JrHk~p==DPm`zb>}3{U9&vWk+LVzfY5>t zr<&1lq_AcwzMe-=5;NB>6=vJAOUmhXpdll=Wdu4EUN&@5ryIciR3RND5q*V|0ulFN z38)QPu>70Ox5NkhQXTJ`!vl{>0;m|NPKt&Bnx0NTb=$X7!nGFTU zP~*+CCP1(%s1=q5FkKeo3dJ7ulO?Egp-sL0DcmYaSE#mHEmu=0$AOgEzM0QRmIFoV z)7vE_-|AG{_)4IICucWFwu$uZM+7{e$(<>K_HElML;E)Ez$)Z4lUnWM z`c@h`sK?tB{ucy@ebkdKT2lS`7!3i`q! z${F@4JnKcytnw-p^wIRpgFN~W0rGKL<%=HFPS&*p2|83= zI+R3#V*}1pBuzx{i^^j%#u43mbwxJmAXa-^- z`2b`9E!5l*W=rlGW+}|9=gQ}en~N57M(@0cg>wf4(g@0D+k{HuEPQtv4gq6lX2)!t z4|Sq~bUp+q3h_)x%I2J^GF$1@tcBSi1DO_=zALk{w@>lDa@|gYn*w)c4(rlVU&`^d zI~}=6rAK`D#|2-{p~LlZtqlQ4vmhDwu{MT2Iu-dGg9kv{NeqcOv**T>PduUUc+8$X z+cd~?bBY*raGLDHlg8{1kT!*?P`4VKNCyx{6(kQsD(L2kG|m?k%@Ij}47|$epa8KX zlksNg2THI4o)xhHRgeZOQ3S&lP4rDWBX9{-|Ne-SgUht(+W385)4-ryo@FuxiIAA> z=xYkjgElnM2~>w*XKZ{?S4KK?*&5e7uwjKH03GtG90`u;#~oWi#oGYcsz!i3c$i(2 zceb4Gz?A&#c(7{Y)^+}UA@3Zfu#TlH!K+R4O#4cD41P@f82E5(Sx@6Dopb0|2K5c< zLMdXz-A3@Dse}YqEU)GG^^;Xa7b%rVD&(Y%bRATeWUF#UP!76Op3`Ilgw(g>M>gTO zT@a4`X}-|S@`^p{2N1=jet;(abN*Oo=#+Yx+!9bQ^2E9*5p-5Q)XVZHLU%~DC()FW zb`iMGWQqwX3Vq}0z(ghakp`aZTWa>MfzCT*2W)?*J(#0Zt6zebSSkq}McE?nH}H{R zTT(eiNjE1IO?x9y9(~}mSS5mJX&elqk-SSm*lVoN!ExgutC$c+6@DI8AOC_#8GTsM z4(aOAN!t7i1C-!{gh9v>vePHS#7F?0tQt6X8k)#zXoZHtc;H(@7Yfm!)2qP$Fk##% z8p$yvUM9R?ftKeQ)Oe^EyoG%WW7yE)TFnl38Q=XWDcBPI(t?|eW@oMF41cn^#dA(z~DVcgWU!jZ5&_y*7@<{ zU;Qq&-G2L+GiQz_0Sk)Z!4d47`4CJH8A&uT8I6rapaVP4-eO}C!Hi5uLN8QOY5iM6 zpwrqG1G5a~L!eS6xPk+Y4nicjK=SJ!U@#zHnJU^Z0F`I!s0aq1l~hoqeH}(= zvL=z24iu;bP9-hMl6dEXYs?)TObsKrTNRlQ7m@1YJU&w~ar6f%ki&N?$|k%eCH>I~ zh|4b%N%TiK>PtSdST7_?7I;u+__bCEw3+yl=`ByuNJmLQCK~7(`f#d%4Ack;$YoSZ zxvb9;{bK-ReU|3~=HR&XTAbzLlxw>vt~!toos>&)6`+1xlcz4}S5;Gd9?ZxmKu;BQA9N1#kSAHJqtvJs zDO&gh>W^H$|AT(u38Ctu`d6v`&jFR#eSehFE|@#d1Db>Q zFc5Md65Shjz|Ah+0!8^qf)Oa-?EI0D*Z^T#c2J9=ovONR$pUHVTcHH1ipB!LV2A-NB0uUO&vz{sRjfd7#J-) zT--M{Xhn>|mI36pFep-k)R3SP2DyHjHGotDU@0@YG@w{L4n``s>kChSL?sl`HTAhc zaR}~2O`!9o^MQvQ2K(bEQt{l@QB;K}Z%_hlk6L|!p3bHAVQ{e%c1Wk@wvxX&E9mqtt3-D8|bZ_0`QN?R=bpf3@x zywkWVMg~`t1nNq@LJpF&A@zoavW3h5h@MmD3Tg)k_Ms3VK!+4=^6(D9|2a^@QejD# z&YL>8x(*1P-Hq$7w2$!7S!TJte3OVieiKolM_z(rqMN=#QDxI2_7#*xaqy))Wp(bq zcXM*Vk-qUOT>nM?tmyngb97v6HH8s>nixJ#pe@qwJg}8rJFdX`%|Lu?o5ZPCyX~?b zgf=ilSw|)KCGqgVCb-O}e4A$({gW1}Rjxbcb!*#w4|a{m@9=_&YW3&ze+bw(0#Ppx z0I&2KzvB29F??i<9z7;@-Ss^&bNcke6R_3EDE{VM-WDsYutE$|1&0kA77Kb8#3PS9 z98;%Gjo!soO-LbE18NK%eOI0u$BI!$v%)E(U}xqGgvIdG`Fgeb z6s_6`&8nbKmaSL6bwlx%F)IGDEni`@^S*ITeE35jh`;^$<~ZW$bAL>0ID=ks}>sIawZnL=Av@T0I#ID*ff;11b7{lShRmNa+VB zMjc#_c9CUCG$>Ss=;$itNh_In6)UeBpl7u)`Zl(Xlq))>llfYnU)GSF7yQI@%Q?WQ z*#y35Zz#F&a3lk)Irpi42$qpV2L^yDs}h`65a3TB8Jr?J9}m!4(RoFP6M$}#%c9`0 z+foK_uMVlJ>>USWT+VAb|2m?8?V~GY8=nuy#KDrSchZoL94D2yu}s%&B|CB0a;??gzxQR zom(%ak@?s}MRTH+fXx;ga9W#ownr&pQWYzZT9S0-iDkxb(+(-!-@AJGSJSRJ;&z@=FgAm)28_x;b^=WGn7APrWHC* zvdmXmjFY$NPgmZ|88bET^~Jme^J50I#FLrO-1&1HKvhXO_%UNAiOw!FQl0&uf0_h9j~P&^Fdd|gk{O-kNh$&&sHz$8 zfP@ymf`pYB0f6$eg$6Xpm~J!Bz#KtvV-pI$8d|~uZQ7K=XgRh(CzV{k&?F;W)$4bV zr<&~*mfV2!OA!MzZRyUPgU%`ZL`w(DUvt%mftgk2Gep8Lf#RSfklRQ^Fip#s*#ZQj z{V2!G6-VI=w;MonK(CxO0C!HJ-M;XOaCRb!s{r|&iMoEFnes8{dGN!Dbq!O%kqJlS zkb!?(!C{y-`ht#EzKToM)CX<{;h?Ki@RXOf$|NkgW}s}!;vDJDIuS41KXf4^XqU<0 z8o~fj0(z9DEEh!?%)CvkGzLW;7lF2~>5xu)TJ9n%L`}JJ%%k}@_P+&HhUA+1Ake2t zP;MiTg-bGHB_b32E`uDM7-P{rOlF;+R%NE0+pAt zjUt-t0tg42;aV~~9-!vLTfBrv8*m8Cw;lG zlndUTs4>Vfp)1!V8SIpY-TGa*8npQ%^UZf3S;B=6HbmF{P5>7V&w3cIcHXk9y>OUJpTB&=<+M#>YHwfi>|mj zUcd7$F?9H__~~yijsp)pJoZ=k{gv0nZhO2x=FFNC?|$!|@#9}y6jxmT=lJ6l*T_QJ#`k~mo4D+To8xy^T^n!N_1zv^7ih42%R6_C@Ba9wamn>J z#U)o>A7_8_JMrQzUS=Qljqm=z`M{~4`CR<=lFQ@lZ+s^vPMV}yOIQ5-qD$hWPkt&! zXcf!gj1JKYc0_~ux}$W2f!XGxshGg<|JWqtG3FlvL)Us)&SC&o4cJL zB;xQyRXR)loEL&zo8-ng)aSNAM&(fr3eZjrFzC}OK^`@s&Cj($})x1B-M(2vS{qK9o{s)(s2nb@FO5EP)605fbr z>GT}}aaMau@97!p0Wb%%oD89F@OyjbYq7AvFX8t9sCFZG05yNw44Yws2y?|#K-)?N ztc(w3)%V=b7~tr0Il0Me>?{VlEiMBZ&l)b2j0;)ev0z!qV8^Z<@}oa%OEgml==ga7 z>U9I5)V_skAT5mt1k&bfwYiTMljUxnL*+e~Qm>#n&n zo}Tv-fJHhg$| z;ILfD=xbXq@ubG{j4$Bl~@ZLndSc*^N9cFef=#ZP{y{JUcGm{Boz?!0){ z?t8>BA3G_=k6$saz4G$7{qMKMOJ4T!`25$-jkVTT%PU3(aDWvj=d-l>w9}D3r%z{v zI!k>zJGa`+Dj`n80T`rP6a%zz=4yl9?b%==`Dh1Q^$9q!5tMJj9FtScPkJk ztv7Tkz4(ywXDF+tv_TwFaS}KT)!)vFzOKB~Vd@u5 z4^C#xSzFxN0(pZ1#2Acl&f+27`DsIztEE$RZh%0RO3&`wyb}kS9smU%jIntM&H#wq z;JI5s1K!jPykZYPVksE!zZaez+WJZ#0)B z@}zk?n99;eKs5qI!3Hb!X#-GJb<18Ma@|htSFZtb?J@O=hEpak11(rEA7*MEBL@PY>QH1|2bXo0}$PJMMw%FpOan@O%iItW2@|SNFmt6YCc;wNCW0yC*HCCFqQhfc~v*YzU?Hup_zz5?W zcitHX?f0Sh*^hr1*Ij*8Jo3|HJ|6s`55^DA z|4v+a*~PKy>TATtn{F0E)EF~o&WfFOepB4|r|aXegZ7KdFS$4#edH0}QN#+7J2y`} z=7>1&>tBn@FTKQfo^B!8$Bthi4%++uvDP~4#-^KZ5hs7_m^k;#Uy8r}<(7EO4zKe{ z^xbcHQ{1X^8i@u6Jj;^KaXP&iFlTC1A2H;TPa!)i8C2$yr8v<?|e1q~xW%NJD2QDh_Oyik^oC<#}*{F8q~F5z0|b z0|_lKL3ieA8$Q;G6@YzBY0Hcp`iOYmJ;@9@X?OyKPT-k7%77aM-*PfR$O`Ek4nWe* zGyRg!iSVf_vv*b2b$1(3fA|?c!OczGtC$8{a^k_t*9mw>+L0_*Db=@58CUk;m7#>en!URhgM+=KrZM{v?yq_D0OpKgAHE!H= zw>WF}pU1gx`Bt3!*7N#>bKd%Gg>S{I32Vn;FMlA;c*BEn%IhAAQ+8|wouBcB2V(y% zpNgT~su;x450xb-j&g=;@c7LyeoAh<_H{eOm{Fr*yY063pmpO-*J^b)%6T>hDV3rC zGuf?P`6|bM{*#}?teG=n)zwyaV@;ksSxU}Zx*1S!`|DqQZEyU<2{Cl&Fb{Z-JoHek zra=$Nm;T}R#$9i{4PweOlf5Om!|Prj7yR^>@#2@hG#2Vk;_@;66)(s&eQ8v&-2x zxo*#NT5O8jp!r}H0*n%Xh8+dxH9SXvMh#68RyMRNeW13$a>8J=v-`A~@Cjaik+k~LisfB}YR;e~4a9axBwB&F7 zYR83Y%S8(m@(yEYdJ-xAb+-)V~V8$su*t}-W9TWPkWLF3_fC|W%TNd;8HF{8%D z_19e;k3I5GZ2sbx#*rUAG1gjZ-T212Uyj++rfJ~J>lHw=QhhoZH*TEcQ>Q!~!!)R& zF*-&XgR^oQQcSyhdVF^&Fm2j&&qjpo!Fr8j)riGEs>;|JzcSaT&O`VO~B`eME+~Z6|JUilM zJ(XuWnGRgvYQsR^p}-)R^>dY^g!1Eo3GLKSDnA&cc&3}TODPbS!8!0QJpxzR9hBLk z58VN@`_U`M8gJ3o55e0p3Z|)a2gQZNbpUmt@{ysdvv%e_p2`SO=L~!{rBarIm7(C3 zp7418s+RVuLZAPcgZH>{ZE;w0rSlCT5|4Sjghk(rIuYLl*Pw)%=x zKDQ{!^Nk~92wW4}SDv?tD9!W>RQiJej)l!H1_O%JfRr3vcL2K};M__-BNKCFZjFOs zMThM%U{J0)wR~(tDbf>aqgHu?27?T5@hqevNnI6)FNT(AxQ+rht=d4^Px)vH9c!@d zD&IULC#m!Sn}W^&ie*yjKYkXtKI*&V^WjU5pX*gU?TC?A zN8T05v1QUPFjO=Ag+Bwfo+$+C-65j&nZN8R3|ZEQgQ;QTsx$rr zJEz@zLy~gEBK4qv5&Alrl${e4CJUk~!93yND1JOY*9X47xEpK@y>l%Mf?Q%^0^ij` z8#74p0(X2<4t(4=$N~kK836sifo!#VyPZLgNq!EXypOY&a%^L&>>>sD_-=aIRQdQp z6t`%R+Rn|*H9h$1sJ@F0aRZbRM2{Q&gsXgXjU96{Vm?SuU0xt`h(T~CZ0~%91&vV7 z`xv1Y$HHD|j~h1$#xJ3y@zU#@j#L5f8AgDEgNF!dkeuSQtzP+R zEBl#ep7wRP&9->4)1Q3wi5S{5G;X~9x_IOE+r+6SpWwmm?Yr(4b7#&m&YJ728^cBn z(+cq!->|dtDyzllF=I4%KWzSW+n^e)?UAFz;4V?NeC?1jHyg_0;lSmRB(G=hwINl1 zK8zz6sU4Zp{YoFaF30E6+%4J)=$2p$LQrT84A35gJ|yZfE1T#wqaSUZFF}GrwP0pa z(xpizl9o-1Y2y-16Zw@zRg9)zZxKsD=q|T6)q$l`^vMI>yZ|Ae1C^e^rHo4h7F=ai z%6ip_n=$hfn~>+08k{0pii;CtFjb=RT4ng*oIXGq(vUyD%Ye#&y0il_bIj5N@D#8G zJ3AbsqCSF8UYnN(d>wOJ75p4r`OWPrQAbv2K#~+!m;{d0qc~at&YJNP`k=YVE3;N& z2KQxzvr-c9XOQHFj|T(JDI+xB?JZvJ$Aab^poDt)fVzU=0l`E?(ITP)QHFPs;{}Hb zgXIwbL=a1KL1S znU3)*-y}+-Tzv5# ztjzc9xo3RjsH0=+?Y4`94?jHK^p>~A+&Qe!#8>oDGPA^c?zube`RCoS-Ub`QaUVY= zUbXFZ@xHx36z|(>ALCwl!FROUdrh2h@~QEvZMK!5xmuVvZ>|Q;XX4hs{v}@Yq7CAs z$A3I_c+bK35AM5vmi_*BJj>kZj6>5WS zD2AiPfT4F#mD6dxO|DKvoW8c=jAC;=;Rc?Da#qOIcfWMCKom2M%E z-b=xrk^tR$RF+{N%~nPNs0xS%IUU+{bGi&3+52@M1{?CE6YGVObRr(~6u6hB> zG!bKvw9|lwE0U01XF#w(iUK6zP0KmFo#umRIxhZh|HN}$n&q8bKFHt99~7XRLtZ6d zIjx)$kg0SH=pu;gr(_QTX26LNY?nkVr{W$AUB=l4invZHl=TweXms$k8*-Ha`9vl! z5jn-Tnk@m)IrMx}f*I8eMZwLO0&?Wg4qx*SE|Z1oRN;*c)B(^dQ0p9gN-C&~YXmP+ zoK(*Lw?Y%dzgE4ST{TS8SkpeI-Z*v6ir~U1(;oCuaH>9BS5TxA+S_&omTfijX(;Ql z^-&UZ^g#g5fkMW8jnx>8xG9C3riKk2Dt|mQdK88aBR)(%O;btp$^J<@apa9$Ud<_F zUsZsxIi>_&wH29=f%YWL10D2?Eh&pG#0BY!yjf476}m|$KdtWYKMyI?vH^hrDrDiL zu%RPHTCqIS!7a9rKlWJMeB%wqyX=zRdCAS=0Vo|{MaJMTYSd_-j~FpDZolo;IP>&V zrSRT3=+MLBE9ZVQ_Sx@%SaIS+VIz6)%X54@8zvInse@A@r>~rJj zV^4?`#*dFLo_R*xrooMyUv_`r`{Qfh`fi+j`lr1#|IRnh)p1dr^_er{&f9N`?KSY7 zdDd6r_>X_WZ*KY4xnGMvU3YDa9zE6rIgqcO>eNbfO5F6Ptk+S;92ff^e2BLQpv&Nx zO(#9dP~Eu+wW-y*Hc%m8K%CR!9PEHf9s2=ERnh$dR-*`{Ta8vvS_wAW~QwuoDQo@wOlNO?0$4LE0YSlLOB z0!QD}q73NzHFqlGx9eD1*t#p}lV>e?i#!FbI2@JMdBJEvl_zmHw(6u4&M8mCZHS;8 z1^K%yCXTXkxG(IqLT{4a%wY{k?<_ZuRPyi7k&;?(>QM^nE zd*1xQQOTCj~^nIKu(yu*`A(sYJnl?)7gzEz${vWi+J zB9*V|=802-?*9tFt_Gl1uRt@oe<(R>B)6HM>c=&cPHI^ho7)#Ox2XbErQJEn7Hjj$ z6Cvq{>2Ty=o6I5x4(N<6N4RmbUp@w*Am7E~Gi<@ai~+8fZA=C`mm%3(RHj6Gz{Tcd z9@(GMo@Iw;BtZOECajnAdJrpj_0V+X-xdsCb21B?~ zr#xaW-u^2ohzKz{H(N7)CX0{dOga2Vq207q!LNYmvVGSL!thocd59WnfpVm~J4-)i zt)q7%(VM>BiqsJ-^3exinMBvyh15&wYz1;OC_QBd@;7JEv>S4zg=E>h{$>y=YrY{} z-NHrxB$Ai<>hNEhQNg6yqHUbStFod4G)|rPYcnX2qSjLkDvR8PZf<3!K4l9Oc722) z2U}OI41C_=>y;zsaV&vv5D`AKctn7ru1Shj5C40BQY+KJm@5qwbdlLQ!%i`B#hJbl z%RJRYI;7ngbTA_7n3qV@Hmr)l)d0n$+Jm8?_=+M7mriI?6zvL7!3p~ku6}YAp7JsV`q3jCf&iQGGn?3zh(pnbT>UckrXz_6L+VV&-HGejm%hZ^kp!pyU>?MV7(u zjT-z`7aaz_flvm&6U*SovP>VUPTIS0LC#vbxe*0rt05#ik2=iLfQy5m zg7FbW3jAE3^`NqfmY6<{I24MR)`G+& z&-x&f6XF8UN;M1Of1H#*PIJKuH4Y5{^>sPKaRMN>8VROz8-d6*__%Cw-=zHFRcybW*gXovO0Yas7kb&MxebeuN#WyoD<^ zB)e{3mZ){gV{yZdR~r!vmC~d^$(f5ZxJ%+m2kH2sTHv$#qjY`uC5iMWz;_hd7clrO zRJt@(|~wL=Cg`K`4HKXeuV#T*oRq?Ubu5 z+KfExgHulQ)e+K=AW$;PCL#B25%r2%X~rQ-y7Qz?0)c}5>O{jgpeQ6gbgA+}s<`+> zU$)V?x1sr3K4cMwzV%!`I)^S>p5$V;`W241M3K?$J^)~78!x9~f>lg@=IJ=m3>L{*JtQop8P*K@j!5cgb=`NKlVCoW{B{UDIyVDw2UUz#{=Pe8Y zvs?z2ky?@QmI|(^u{s;26=T+43YGKg9@-P5Mvd}&LV2!{@+fim$Ps=osF5A?mD1P( zh0d5UqeXj^c{ooz;lbABm@#9$5^WBA0P>D#?nTYDhfqEe?c(t+FuFW!IG-%g> z4{A9Zc0tM$#o#e0W^(SR=uV+{yEG77Bi5EYYuyR~A__}F=|c+O6d#7aI+2~`>jOK?yZ2^`S7OO>*G5^6z#5i?p(=rf?={IES*F}FFX50g7{ ztKSSN%CQZt9GB--sS`$wM?B4aIqj0Y6SN`ii~^fTsjQ}EzXt*tOohNKfj%$Koy5dW#<&=hlb66S5Rejkp4;@jiV!mtpVBBaCD@? z$^pa5qH(MxC!o^2=n5^<*8wtMxDl`fDc!upyr5-3jsneig(dP49swn^>mi~zlH^T3 zD}m(hG~wid57{mx5*Vp;;v>!-qo#AKEg(#u@TgaA2arU2DMI~G0c=dY0_jPgvJCzN z9wqS2lmubHr==W~=S zSs!??jUgFT29vQ|;_cb30)wEh<8|`fkXG!rgB%3&%_5RdJiO`?u3}KoSLr3{ATa;s z0T3HyYt+=MUc}!6gqT?WAha+`XbG?saQ;B3WlE3@uxg`vHaVU7)mMZxzjnoh0LcuL zM=+d5nQ##@NkKpEJCuQ5>b0(T8h`u63s+1R-xus*|Ick zuT%YGKT`^9rDVjF+MSN=aH)X$^A1x#f}uRG8YpL48BMx_1Ds*U@rA%( zQK_4PS3gA(|MN^KNw31TJxO#Cw*F=HY9I7a2dgAVX>>#1@M%9G90iweEeBm4@Ga?I zGCyxdAwW?!QEY=e(y~2N7Fm%Gf90}?lVtJ(xR1yQxZ2_aRlZIK@FDbO@xTXoA_k2j zAAtY&^N3n(^l0(JZW@of*?uqh-gg#%{mW(BGkeN%LB$+8cUpAMpP3d$q9t{ffoFYY z51kN`=Z%U53lVW}=;`i@@go;{%d-ite?}8>65(xbGVvwmt0TB}XliH%DwKed^EnW5 zb<|*sQ_Srhl~Fo_BwL;y9Mv$)qG&v3CceHPR9IkM8lqipSultiTq@7?i}27Sp^yU~ zNW3)TA&ateQt5p0GKP>&iET_C+GM+^SLa+WGDpXg9waNi^BU&K0pfmAK+i;MC6m6_Ek(7!;dOL~Lqd2>{0?3t}a% zBU^R8-X;v{z`*BgA~+z$8K;X0EOq&yC{)(q`BqYJK#5`+( z`yj2+#-bN;#iof#dP+{Za$4Dm16^}dh3VfU^m55VfKz5yheRffe$AHh&BOf+fN$Cv z6kGI497s+t3@WV(^}NX!;JhDXwc8m&u9~8s8vz{YlF2bqTFlSDahIjaVF&mCU;Crp z%JQ>*WCE$SMulNQnQY@!T3$Pc8McK$o@mNGxaXh_a$Kfz9~O{L`_VB(O6TmrA+_Wu zPsT)F#vfrL_De(hgih@cL2WO5+g>>$BWPWn@Xt#Nc~lwE#4eGS`akvLQ*r2FhYc9~ zTD2Sms*)?fj5Jqx03cxlvgk5sw_p$^1ED5y1f5D1$OggHNB}ho3Y89R+zfu4FI;jE)Ueg(4te~ zoJ&&DsR&ty&`uc~P+JZI0!**)vpN;G{IV%`M$3lX36=4n&3yTww2?U!!JK4Irc|BS zY%Ku?ok(YVa8V4p$YR?uiqeanmlCaGu2z-Tq*nniCwn55`hlD8@6%tKEf1pGPx1W5%ul zs|%~6pHQwrKj@eJ0s#@5P-!nMeF@%8MA|wHKzL|C^>IVzgv(`h?rlPS=wmb&*tOZ1 z5LxSmQ69<(V7x+0h0G%p(=5cE6{&A1W065yDx+6}AAT4-%c8POJiG!c%=1PX`aBbx zq-~nEVd(O!V|FSsEJyk`#To2$%)t)Kz5ElAx&{+KHO;F6(1-V03RRAc}c_i zxsFDhCP<8gDxu2^5|D;aq1LLFYo6D%3eB{Bc_@?=IXJchao5(d0%z!mI$?BP$x(3} zmkmgOp|i{=Y2JnqU^bT5KRRzQt+g2}Q~(*?I#3>Hl_y#gg`#v%BuPSkm2uDy9nhF;I6}gd>l-OF&kF=IlCU>(El&ydtT)Q>*t*#kIncGW^(rXc!M&z?-s# zzuUQd1_IfH=L}RvP)v}RBj(`_shFZP#UN~-9iUISc4L`#QEj1FB`-L}m8Nt6$3X>b z*@X@^jGz$u$Mvr_GzFZDKPXK~g_h2k8F+QT4BTYsq{*!H(P=hfp{_V-naeRl z6>T6?iE3!V!1JZSpmg$sZ1qDck4M<&)m@VR{cu>e0209jZNqVd%T>b*mjK7xQ#37%9uuQAFk8kRNr{k_{L|(63s{0LnS&2U8`a zPD_SluuVEq^p#ek&kYc)GBa_g>euH)6l~LIp)x?H9Ccn4oibV?pJVeR7HS1ofoRo+ zi|WVprMapv;}BPxaWb8{);e;YRGM=2ua4v5S<~8B4QLi<0?5h02TpU6D49@>1<987 zAZI6>k9m0Y12%r4WouOzKn~&=ssR5xko9N>pjN+z7I>r*s1d*=k2-MXj}r2_nIh=J z-~4!BQL@Ju0h86Vkqp_e0+%ZR0xIB1rRZACB0?Ybj+*tWb9UVHLAUiUiR^&s=g_IN zX$$%(GExrTUFqtF-8x^M>fu59VZK3;8xUF4xVYMp{}SXbdJlT@=J`nhwp)GIDYPU* ztDQwRTf15eXEpf#Z3TNMf=-*EWG?}fElTVM4O~aTSyr$d`eEy(h7?R8iMb(lF14j0 zD`220o>n<7CkH6QU`veG?C?Kkxdo8vCMjUs!={1K)hO&WgTn%o<`Zct7^+1yg@G!m zVR-;LxcM45?+;aBrE%2;ynYB{vhAr3IC!~yKM4UAGb>bv5&F6rhJ}$~)vf?nF?0}; zS62F(mH~dk;a!PXzxAzSIrr{ z=$4ck)RIF)+cG0(et17*&H`!agjThl1<(?8bx2hut-Mg-e5m=h?iNwig96VLn#>vi z*_>P`gOyFqmkg)^hhs;kd{6kS4?cj-B{&0xQ>+|9WhAETw^NP^;<#{b)X$EOwDJg& zWbm_C1Ut3tjpVg8+>f&D5Ye$1KBSRHpP)Yu1a@+b&;-O)y05dAQv)jmC|gw8Un@R* zf#mfwu}b&f;%J4!4KUb|CzR+>fLx{~on$>k-FZm&zYElf0QVZ&+Tl#~w2z>T(~e2S z{^^r;b-tb_9QquZVIWYz9?(7ZLKm`%Nh_hgE7LazdeEY{@@(+*GX@s)IP`LQ+db12i1OSiKBG>M_x^ti-@b_EEE3e_sU%0@lyE*gb zdcb4gV*oT=n#uLn5&bBkwGePUsR#jTSVJ?=`W&sw0Re)ptKv5FJXXR^E6Ex1oM?h# zmBwH}U|LeFJFaCUksl!_!6fyAnBJY@m?Xs3aE5{|(xS3@eHj-5ApkS2qY zayYl+b0yQkpetY35uTGPKb&-7YboHDr&fp6#)*CuZ9$gr%fT4gkjFfdfN^Cj$mLs> z;Vm4QC{65iD(I~d1?Z7(d0FkL9(0Hv4Sd|eS=-P~-#TD2qmHekUtsIrrB0=~a~;6? z5NRYR+`x2Tyl{sq>81M54wg^&1VwAe4AD}3aUQ+~fxYrU<$x9PJfI3!c+5>onk+}CPW&OO5ZF2CcZ@H z*sg$nWBnSGhMxbA0M0c4sgtxVTe)4XY-Q31>+0NfR-LG#eT1ON zhZPfctRLZtqHuDs6dl`_0&Su+%VE8dUudFZ4?N}m3Jqw!2?twKe)i)Wj6L9KknHA< zmc6a1K~HJO0AF4KId5*=&eTA+aG{^a_QV!q*do^(HQS_LQ#WftvQigtkPaxCB1)y3 zp+GCzKc9*^ZtdtOqOP-*z`62U=p{mB^#MIS+tR^Bz=kd{XqyByDxg5IR380?cA$YM zTdPH=kOs{iK`5DRLKQHvp)z%%P`Gs!6A_WS^uPx0}g$av$hVAGLHiTkaU(4D$!dr@86z8j|C|7Un>?Yd zpE@IkZ{lDFQaNcbPE;35$5YZsbkWqMQ){B*c_0_sw`whT@RQ@?>ONniOF4RJsShl2#A3T>;J^fw^%c6I%cQsHC^C{~>0Dn6T2dmvk-RxFd(WKiUPDvz(SByDLp&Do&a#fFq&z_u9gB|(Ihlp zHRwvG=z(90(>|wa`Fx;Ct8QG^U|{!(M|I$BFg8l+qmZvPO8xmU??SgZpogu0Lm#r2CUQX+cE1V!U`p0Cw+P241P#jG#6J(3C zTeCR^b>q6i)EO$2ZEMwZ`GuAMJ!Wc#{%08y@~nNnY_JJ8VZb?jku8x2te;{>j_L<>z?V~7I0+@K1>k|RgnTBV0L@&{L)$i@WO5l@{CYH+&vYq~ zwXOi)(z{eB?Tpfin{l5=Hc!Md#j*?C{8EQ)zJzw`m-C8Wj&|mqE5r6 z58GmF*>RU*>t9!di=SYtlv18Vl)m>dS4<@usI(W%E zbXd*JTQJuvySek``r2JiP}ok@SM9-K$9{;4kf;DJ*FnrI5j^$r%2II_2@I@5hw)~x z_6~?ZLS^X^ltf_JfY4yLvN^I+SU*a`AX4a@-IqM!xyEo{a4AbO3@`srj1o%+ilJ6> z0~J{S$>zHrMK71S&{C$4ggkA67ry2%MU;JSuaIQWypGAr6y0p}oSneO6ycW@&rsPY zz_PNf#^O-0>4dI+307x04iM2$)0<@~eiP6?O+*Y;8!*NqBWVm2J>4w-X`|fh_CP4Z zWE%oh>;@C?3eozJ$*8UT_5>+`L9~7_cHd1Z987`^kPpD;Ic?2*F|9l*uECD~=i*sJ z*r7wvXakY6IoME5jF24z8YJ`ALOq(8a9yvfTeCwYGC9SRXn%^iT}9QZ(68H2Y1EJF znlJ)`yu?b(CeT(jSiWb0iVJmOA(5{MD)JdvFgg;|K$PD3(F+~pd+FamJ0@!7ogi#sA)w* zscro#gU5QzNA5gCUsiuL6T%8)&TLr z7;^B29}a|SF+*DHeQ&ljZOF6{?V*DQDFx4Mtr~t(%5qLA@PuJH zO4rw3hbY(Q#NQW}%`2(bj%D3Q2yc591$j1zJYvkCJ-nyf%)-Fei6JX^=MdRcH}h1P zWUQcqq$$3L5t402br@2zW(i;}3#^J|0Oi54-e6f1P#B?wAuS@0uOSIr^0)7@6&Uxw z2@q`7j)_9{QNQgTd33@RR`hQft8xJAKdqQ{=6?<$S5Yev^_~F+L7hsbtww#x6eLP5 zLV23F_77MxDPoB1lpwT_C$iWMHmktuM3&+<_m;him|jcSKq}C7AsTiwI){%jDjJ}8 zt7+6pYCb;8lRo+mPFx*@6%qeY#~p$c^34`nq2N$ibCS(?&`ls4p6B9s1;IErQVVs9pO)XUgV%x>Zt0^bFU~OK)cr_lI`vAC zKBkWcTgmUsBR$qhzKw$#i2XQUA^qEnU$loD6RJVR4Vq_g6tl?w4WxyV-nxRh%G z9WIk7&o`CpA|mXEGNn9Zqr9aiPMQ44K-@v!K|*1kMF5V2g+YPBgCW)PLc9rLdoFt0Z(jNI7)LU zxIQMCK`D&DH6)4J{zsR08{UpORRbnU2uS1YuKc-7YPpOX?RhXfE1ND0m_=W4_TIYX{0 zYilq)N`O8b5;q;C^FV}@PBJ9jdIw{VS|xtU^Qmnwnu>;@SVpljiHVFWI^D{1^& zyZ^kFNrtjmVfzvdyj9e9nk|L8l@&^c1<#ozgPxrhOntFbY0AJ@n7mN|NLfS}mpJpi zj8K*c43-Y$f+cMIsM@AmXcw`(@&MDamQW(iq}p9kT<%BbtP`0$a41FzzmZ-tr&0te z#_SS(SE`j>2Iyp73z{eWG8%vgMWh-{sZz3bJb`8}O+N@AlOz^0Mq>SoZ_e~t{n3Gy zFI{o>XBrb7UIl2-0>-DJI6xh8g_gB+MMTHjo-S9)>Oe>X7fq!x!^5m>lrAQ|O7|?% zJfw4ulviQ=4bSOuM;EJa;>e6cWNR(80f1j12`j0DDx>0-n<6ANpi+4*FtAMJWT@ga z!~!g_1fU&IyA+Y>6_3+FInkY$gQN?(oR9QR_mc!- zRj1h|^lNM*ff(mCrIl_!fklI3Dk&ey=*V`1jphW%RGE2UAI7DiJ%{_GouH`!q_&}; zwwV`bow`^-kfPi^O2iInFKDw$=T1SOb%TcF>h6>y)v5tm^%dtVXQeDH2zuLXUqzx_dM4Pe!|P^nb1F#X)!sXI#eo-Eg-s1)pm zBSyl)QGl1|W|j$X9h4qK=E%sri*4L!(nD>RFX| zQYY8H9Q{B!+mxc>nyQUj4w6L3DA0bnRhq_3c{&{S03BcVQ}8wf*8rqbHUt*&7bKDc zUGq$(ihE0q4-T(~zm?+6EDU_oyP|3X+8lapd8sT_w1o9YAQcA4p>sdrrJz&l$%+v( zE?5qfqK*|vL#KqnfPC-=2Iv@cLY&vHCL|@RTp4T~*_kT6kLL&(l>rLXuoS3r4Gc>K z+Cc(&;)daofHLQ#LyHY0^(1|i zTLqhX|~vmCwdM_>=#$QSFzaVQiBK)tb6+H zfDiRn@S_Bca-L`sY)>_$mI2su?)Fs-8)#w@z@!~P<=mx*s9j7y2RsIS+mlYvRn`!E zPFl(%!{wwv_gNN3_ASIIqpUiZu}Cs)>ZP&_Xl#K(r>9ecmj*C);M~r_wV(>Vr$jns zMaaso+joZMU`HU0w$YTuGOjEJ+5zZL11&bSljNg)T5y00tg=03D%9NT_EpX`Tx(AUAv$!I_8WmSpIpxKDN-U0gx?D zw1^Z*8bVpx5d#>UE6=<@D0vm79tC7^YKN+jwA#?1v;@@jlxgXZ)r3+Fl;T)Q7LoHt zluQDujt7IK=PV@;{`%6kwT@`9n0Ts)_9IJaoI0pIX)E%nZ&J_l0I{qM_JJj4e`MH$ z4`pfz@Y0F|B#;SDC#b9=`cZnyC4K1J6Dl3O8zF~PC6QOLU4d$DI>|oHc^+%bXQi$N z#S2yc()J1PBVLq1icaZ=;DCv5L6IJG@dHBO|2kO#vU|eLggb`P$xEe+fXO0oiBm}{ zS8;d^8pMku0N!As99;hr;K4C#R)W$Hok_k|U6w)QNpvMkf+1xmWNCq!NYm*c^i_Hq zl!!3MldeDJ4SeBv0s}465k7pOt2`b?XQ1NxpC4@3K*koP zS*u>?eV7(mBZiIe;5f8ffdNnc0~~fDxhpgugy|0P7*9Xju`4$)mL)sSDR&o{Irz61QePeL(q{-c#@ z*!`Logp+PH-EvBX5a7WXM`#gO1?PvUMaR6@qXX zy=)*F2b`4k_lkt{y3XKdQxP@~5&LzTswpm(7$BeWlS(>7-Nf_=Q?4VYy~1Y~CEx zj&*KCHAIowvml+#8vyxJyRhB_v zfR25h{Gi;Qb{j~qm_<56lZ__@7!kHZP0*R`MoHd&Rs^L9#r0?~qjt*zat8}bf-ET+ z+KHzl&}os&W!!MYBn9d2ngB`UlC7kF1E3))oR)O2njbdi5JXZRQ^1l6A{JEI~M~JB+4!HPS$a;TRGp(T-^?k8f zH0UTcKK6#W)+iYmWC^A(C7={9mt7YT6Te&)VXSf%zQ$1M>XoW;RCjOLsw@{`ySlnn zU-8iL+X{7A@fHtXsI|li9BJ+h?ev6HazYvgA)WgG0JV*h0b*t#?3&g9P8rK=1UL+T z)A(uuc#%e{bAgx}O2B8pW4no0htU=tnrQI0b&kxy{kR0W^Y$X`By#9cf$eXLf*xfN zQcJQEA=;2Vc3-pWT&z`IM+~JMeQl4oI&e)6+fvZ9l(#}!Mr@=3bjh{?Y9OsYo*{kF z06?IM-wZ%@%6c{s`ePVqv>RdzqfSbIrE?w#g#mh1v{}mi zQ1t0r41i4Da@LI%iY>?lH;y7|j|@6@8p%+}e9J_~6H1>tDl0l~vw;s;*D1>}*&)y-R(*~@8L>)9 zr3>jk)ydF<_0*n+&`RM#tU~Hsvg#Kra~q)o1*(Sh6!S}mD6Keokm-|d{BBtVbj&+I zxp4xT>|S^xiSC8(K~H@PlTeqj{oBw@tN>9|xP+~eft-Y@WQ7nxVEs0Z#h` z{gglxy9DRX%#zi`kmSB7Huy{1n3PYQDQ|77zO=pX5pY`lh_dZP?I9fBD0q%gR9A$IMS_Z6>Ts4s?athr& z!#rRy0CLw2TbCkf$?QCfLa_}GDijwjgrbv>@AtonM#qqDR}9N#yUw*$hZQK;2fkz?}6ZI3bgop~ArP2AHJ)n#_*jj!u#bL3Nek&7CthrcHk)rc9Zl z@U&)6vt5`K8>>JJ%7dCMgFxNIR3uzuk}NCjB_22+@2Ln|x~HD95bKJ4dL}`>o~MaK zeU%Z-sFK2y7HC6#mR7NpVEJI~+&S^g(@)2&nKLCPB`d(I3CVlO^d+H*g&a+)0QJ$= zz;+%dF0+_PR{`l_V7X@l@Uu*fG4M&(ie|b%=bk+1gT5I|>aGOsgN;@|AMO_@AAy|( zj)#e5VmZC{s!CZ3D}a- zB@_LVzRZKje%XZNMg{{y;4AQ0_zTinHluQ?zbk_rzTt`blc%6jcg~#I@$}@$F>BUL zp;H@6EgCRLeYs8)qm+(j4I}bI-tYUA)3-B~%=V3VSOMFgd1s-@QDH&eDXOv@QsOq~ zlqPb}X_f%MOPQX3p!@)SgF%st@d@>zT6CMb5e@04O;u^&aU%?~0+sWELAKz5Q-yQa zrV(f}w_CQCTZ1_G4r#~4u@rE~quue_1nw(f3lv{u_v1dq2frd&5lVoc;`(0o`P@eU zaq7gl;}HvSfECvBdAU+NVk^*O8PFxuQ z4=A!MUDUVGt0u3ugy_9lrbEK@YyouG#LDHR7b*8@Qq?K< zR52Y%C%P1X+LDm^wxOIYqpOq zU$&($GEdfkL0t&wu*Pkylob(JxRsKiKq<<1XCX@ax{bJ*MGirB<6Dr`Nr(fpXU}q* zabdcb_wy-mzOcN3y*}JZd3fWNfNb|=!`wM@VzVu_h+TJoPmCQqHXeQW5sU6BEJt}b zJv&z7fNNclP=GXM$H_B0Ck~<#uJoH_mJcY&L7G+JbRs&HuIDln=D*1_Gv-Ys)>%cD zgr1m~qwK(KgKXsbM^KP6r*&#sv2#W60o8`+Gp1E*56vWKsMHLF9|LlItj6cUcL`?h zl6(4$nRar%C0%&+|JQs=I(O-ner{(=pQNm4AO(&OYTOlUd6brYlGF|jd~;&UEngPz zdgrb&YShShq zc|-t(=}Y;lqtu;I!7$bQNhn(RFTnEAX<;n|-N}|2O>-_?pc@VB){(NXsjMqFssZWM zG!*=5L$yuyC8ne=Kj?-iyKbC2A9~PH9$krZPwM2{Js{e*dtg$4FQ=5Dyl8=E0VvDB zh|MJ);I@H}1ck?(*|X!-TW_Pm?;YBK#_60@F2@DEr85-&^Us;nQRVC`T?+-#-+Kvoho zV04r#eJ-;&M-N4$*_!$8wA0S<*)z|I9d~?#oWfS|%2&QBR#;($xb(8iT*xbIY|Hg> z*Hycv?3O{1)EkjJkmw8P7?c`-KallmPi^A&rMiG-Wjem%6Vx8Hu7 zw};w-5Y>4ms5myC@l1nm0Su>{`oO6ozK%#gP!Zp0NHNQzcERS;SWJzQlu?iNnNJ)f zxB5J*K|i#iUiRi&bLfRb><7#<}0K^7ZbE z=unHizK4T_sAN*TagwF_F?H&+c;9>97kj>M58pU(#Z_0?4*9>gvE#xdcXJb`v4v4q65 z??_+a2C6C)Fc@;=C#i6rdiE*G zk`NfgmV{<1r7FEF2bj7}t6do?1Fp5G@$)$vZXl41DuC`Ddief$@czk0|H)5&5LaJw zwFbU%as+*G?X}m7Wb&CmKb;b9R_9tSub)a&OQ!76Q(qiozNa${3ghCoW7-G@WXAzB z{VdQ51qb)zU;c`eWx~{Fo{5hheyC>Y4@-vOo|L%GrT&9MM?CZNQ}Lnw4~qRid~n=w z?X_{*DJQutG2vyGO|behx?GU$iLXgHw}A2%M~a50C--S`9OJNdZ;=2cwH854L;R?#Eu>M0sY{n$4O)Cj%h*z+RNeHsWlp z%IL!v{OHFJS|HaRDGap$A?%Ne4e7*kw?S_ z_j-R^cEy!(+8Jj=j|R9YQ>Mj!2Ye_FKHvb;|Itr=7N7piXJf^Q6H<1Ip0C+r*MgTW z=Z=UppuRC}%9Pk`_ub;yqmFd>U;X;m@wv}`Ax4iL?KV>lB@=D6NPUk!lqyHJR@(p| zZ?N>|3-D<|lQz6u$8xN|dHyJ!Hd1?{N_rn{N>2yh+xfO5*#-JnqHkJ~eoT=(H8OsI zk_=SbF9LXSf-<1TwOAc1&~DzQ#D5qEx}xWmBa;gG^k0MFph_QUHDlDaPWM zHG7U@{3XTi@7>c|Gk%M|N^z$q55)I$53@s_KR-J+ie?hWbs_$U@Q}lfFb!bge6~a| zJjtQYxG`hnx4-&zJn{HranWyo6?fi#yXbLeX)2$;wI3?_+?7ga@SjwQemWqksi1oG z^)eW1aIjq6(KBqAmFJZsbr*Q$WZ9HPy_Ii=>g#`HYg8XPI;!#yIubse#rh&y0sZ7` zB?0s$L-SM9s8`YfIK$wa%CW?QJ$V7EFlN|Ejm8@iPd`05PWi;Ao&U#+FN#w?b#mNz z)3tH&C4Y>ouD;TKkcr8-u`9%muiZY@S!ZoKR5yy4Sauv3b+VCDN4BIFYZAkYX)!pq z#~J*xvoq7T6c)WB7WB?1qIP>cE)(DDuf0a$>VDy-Ki#0?wcZ}ZTH%zMXxD%Ffilmh z-10$fM>r72J)kLX>0>`?1KW=EFi@7F!xk0J+kwdyj(3eUSC4JB-OiH$zi3&xNu@(+ z!{Wh9_ZQa<}qeyTM=g)@aRM_f5hJ0Z}_Fd}4Oq^@-^eg&N_P>b79(ybyI-kP}4zDQp` zw0)*Z{~ECPQ-Hdy=?MN>3|NEX8K5S^LAU%&8JI0-!hjyn=n-&KhbYPq% zhq}}2ca#y8!Ox1vU?HY@i4iK|-xYkRMI8HgIw&UDhDv(5{XT?6F%M z{^0}TF!5`KgZJAf&iLd>F-@}Y5Np;<2 z%@iX?j)*fp^SL=H-5wmB`R9{tp#um*_bP$DD zvZYgEt?6Vr=Ai}Pk=H%6M=R$karAM=$DxNG5&!(>J${bNWaJwdp!e8q_c-&6)8j3> zyd|bio0>*1hUBwAc<|wezUYH`BZfpOkkVLQ z$NGbL{}%%E2Zkna4jxdCO)woP%I%AStx+9i6#nl<=O-eqn{7dA^?{1J&Uy3zV;odS zTJ9>MBL+GTp!iYc(YCDA=4;~TJIyJovZOH?w9ken_DnEg=^4H$f(OKWVRlZe*sY{b zCg@01RdVZ8x!krAg7aMBW0)Y2lBUjV%>w0_gw+w-M{ zF~Uq0<{?I&2jm)?FV=T?8*{rIUK{JbXnk)jP!Y>zEv8&F%=i_?yR#2vwT3|=kF^Y_ zT4Kk*)}z@m*Be#L1D4 zE)AW0#$LBS@>sT|K~>z+F%nE!A@MmIEKo-?7cO_5A}7G@=&W)lOqk$v1~rV$vvBmQ zIxu+gC!VXUJjpn-X3lUYPj8F9FvL9i4f-m>EVo;;T+gno2kI<-3OGIPlJhp3L~2VD zF>2(5$4fk_K#UcKNmOhFo9HerxX{F?z`eRSu2c1U`I19{mhOF~U|5Moh*kBw@(HCrA_ z$kpZm*MKy#C9i!Uev(o;`lB>_0Em>udOT@ja;&z_KdbF>|4tpHtuxtRJJUD6Nr%{} z+fX4_eeC|_E*(JYBL+C_0a`(c_@cf=8bIgIGhO?qx{WG3tS5Z8hH`I3)HFbFfSXBqBB0~f`DFBB<+ zj%K=&i92gKdhj-ibV1uuCl#GPe{Rf~J<}5n03%`>XTDa0TpR7}t*-=HSgu#(0J&iP z9G%Z`o+_d?;${}r&-L$%o-WParFXA@#mf)a+xXG;BIW59eUL1g4byNP2;eiI)^n$! zKmSq_Dpc#A<=jzPb(h{0uiMvIYDr+yMEij|5a3lgfQLSrWu`2H19^3O1-ktI7@Ze; zq3d8D(89*i1*CX(bUy9shjh_7y3g5Z6QE1Icx(fJ7xuvJ30r^6ieZA@d|gUyxL~1b zfF8kDV1<@9qdYk3iIydVB2Po&~m608i4L0?ovc0MYIzfjfN>CZ4F)fx}j+aS83M0>y~|ie0;}T)phQid6t#k9xkVF z(+>G5ljy09=|fC7aPs&z+v@__j&_|Nv!%~o=@6T(ivs)zwW|Rpyt^3N0*^H6%cY0~ zN+WQGH2$Tn#bpCEbT##Zk2fzJGc5-(^g^KDVY@j%fU7o?Ow`eOS7S4YpzZxXoiaG3 zC@%?9j+K2~;PAETIudr<(L{s z+TbuoVYApLw3(}U@xb~W>K@=txOne)<8hrSO z5wW3gS6*dho%2388dOS9gRG$y#0DE}=z(?CEb&w$uC>P6vC$@*#`+s<9ILOjwr8F5 zq!@T}a{x_lCk_w&(9pBz&9ZTrpkuD70MrE7S#$#qThQ#s0X*-)erbfx;&VVy(5;iE-n{bGgh0z(riH6|Aqkb=O_bceL>U?JBFRqO=WM zj`!L1;oJl?CfCEbZpz9DnZR2|bjOSxE4|H9qsyU6Cid$`j2US?ZMOMKJlg_TS#7xC zCh?;6H;i@GSue(n8W-!Y|DxDpi!EZLX0yPgNh`%B8*dUDZM;!zyy1qDk(U*)?Y1a3 z-E;}Y!H-e9SPOuk_!6jQ+v*`epl6M zVBPhkQ|X5`VfTO=DCnF`fCC+hcL8$e@H)~lIvj`x2ik+de3MN!v;N)D2jFpzbHtX% zj2Y|I%6g)^{`wolTC%J0D~|Ud1=Q6DlO5V@*s$T2m3BsM9yu8?Vx;R-oi8hgi7Tz- zHd|Y518_Zh&9&DypBHVgeypvw1{h4~(3@<$sqe7%3#>KMVBo9TgzW6uvnBVUSZUHk z(OgG#){_kD#Hw0h;b3_D#RHDYu&w1*6cO~ap8D>KWMjN=e5T~Yv9GOqlD2{9tf_v5 z)8dwKJ954{XJSlyEz*EyJxUfkL`_6HnDNUAk(N0L9^kOCg3nJnU_#>2_Uyp8V+sMi z!JGf#Tthaop6qf1>2}RES65qh$|fXNgNH#nf(K>SS$i$lg^4RVAZ?S4Hj0fl+(4`9 z>d@i7%zGv$O__vrCpFaxi`QnDtgj^ ze0;fYR3jO6>zth&`1^gwt`(5_$&h^`nACEvJYN!1oLWMPa&>_5>WpBy{A@lEmRGfsRXix4-jUarCjr#qGD<>T7>1j9=0G834X~_Bp<7e$V&p?u*v@?6ut?vt5@|e`_F&=Gk*EApT!lI{=r*Qxum8; zaR;c%&Y2q{Me}X%*fn8MwoWW#k zyj2~@&W9dsr!ro2iXjfstbA^alk7kH?eA5W-^3?QI6hWcRkqNuv&7Ehz>Z9Z;ZcpZ zz4P7iy4Sxxw%qEKB`4t@cis_S{nA;nfhG}0O1>Mey~cNY+5yV0w%U5@`0N+IY}}V^ zvVnP5!)ICnKUNIu$Pu3Ry&s6)?QzVJN4Rt17%MPPtS%=;+rDP|9by&Pa}&5L@w1;g zJ#M@8R!=0Dbz+MaJw#VcMJ8_KaZ;r{#Yi|?QR-MIS7D`MoRQI_?yXMM@IO9OTT zKDgKW;;}~`kJs$5LwxGfXU1P-ODCOpf+lT!nuu`+H7k~dw&U$yvqS9i<~PSHw%k$^ zx4a{|!e9RU=lJ>0e;zm9^rz_V?1>KFtRcOqT^@b%$++w9w;S)EgAdkZZf3my{d>kP zvgsyVeCcKJqaXe-{{8Q}JyGL+P)PWJd(FOS&&5jRS{MU4mm_FsCXj4#{@}tN#xEqp zX`ejBk2c`IxV;_I@V|qoacC)_7YQg}$-xo$uZ~o_XeJ4FKJ)Gc{fy{co}9X0gkgc8(o)+%ZOK!rp{C z|M8Ew`s%CWCqMnER*}6iVt8J2#O4_EPdoM0*mj$(;|%$OOE14Hjyd}1c>U{M7sKRp zD%^SJo$>AOd^fJW_PQ9m!q}1ucd5!^=tuhV)?=}E^4v##%7mwNQoyA(KB%m|=-;EK zQ0UG4a=oA3C1~cPpMixq(@m9O5Ym9NXfdl>wjpy>>2GOB<3cC7QOE-xI>e{azIA5- zJoMt#ng;9S0xgT>AF9io$mErP*kF3l)4#cuIpHPP{*8Hmypot=a94uYY4qnevP}^U;zvKYAXc2P zq6*TGLp1B387s-z9slu9#7ke6o$(L9yC^2hDFQsh_O^HKs#VDP@t0d}cEeB?mj2H? z{Y>oop7(g*qyBfufv(N0TeB&Vj+rxO#0j4`MLOEav@ZU`@8ZeFpHTf5$0nO^5wFxB z{n3w|=-K8a7yrSt^*e6=d;Iu^KZqxv`cLfnzP+@nm>4(y>AJY{t~+H6!!&E07PsDZ zn+9HFSP*Y{+dDj?{L`Oqh=1I1yJwcD_sPc}u|cjUc`A$^IVv8PZml>vN>L!~k&|G~ z+jGff0X%9mmS$*`V^YJwwAViS#Q_H&;DTs2Y$?0%mQ zr2Ty3TjzOZPyc?;Zo9?KZ`di;(n{;(lTX&*|AZ%~fM?$_1oUJFq(QIV!d{{FUG(cX zKk{IlyZv#fP*Sq1$GJk^0w$UBV!!?OkA3&u7tFZnmRsV^JMIwwEyrZ>JZ&ilr> zar4c$I3J1X(bpk$oTd74*DR|GCOPxf4}SiOU&XZP(|o5VtE|7>dRyFh^Uc1-$4xO$ zKQqM+n$_Qo=`(yY5;p2f4H&*?PoFkD-n8=@{g}myE3Oz*MejF1{EeMCcg$|I!3MGI zw%f*Ln{FB#Zt$Ww{=}1FLFWSZHvpf->%4$bniPHIOJ9l?Z?Q#Oe90xgGnP8;wA1Tl zKbyrFr=J!F9Q5J1`=58mI8FYU%-Q`+zGxbphn|R5>OoUL`8u?`dU3hK0_tgd8lzU&*E`f6LwC40v36VHZoK zHFcr@{MGg@fk7ykoQ`FJs%(i11Jw$rNenqO*;zPbVXjEI45o7MsP*-9(Z!Tguc1|N z-4q~4dh>i~z@4K{KQlT0bi;L8fxIt{kP|p?-w(#>o&i$G*n6Ki_nfcVS@2I3vo#yt>Q%3fgAX~>1K$yc9&ASoV;YC+E8Fj|W1M=%r{j>r zkBloWyVML40z`pym9I8R`o&W7`*+6h)-g*_lpT`AG zIqlQ&oo}BP=brr)85r-X>v4x0F>-WF(ae(V(QD=4KXdx2F=gsB8xO#paEBamR2(2j zx9e`Z$IUn195ZH4i~H}pH@@vW*+>myXKns-ud75%9iUEBS#GP*4nqeey-(y>OW6u1$?*bjaOpB#Cs{SC+?F< z+ZfzBa4<8qiWoU+hT1Ayul^zngFV~271&1HSgr#duBr82o0=o)H&*|NC}&%=&Qh~cthuL7VTGTeON0SzZ;mB<;%KyXy0 zL;G6R%$d_;^r(^I$|`{@?$UEi{JQg6VIS8D7yDY#yLWrH2R{1U@gF-bZn*wWriDtl zsqJf$?fc(5KVG}T_D)ac_y>H*nV+k2H&R`%fcm%rVrv@ggXO)@I& zJ5=&OCP_$7a-?3}s6I?)U-FU{$FawJ)PvE5TG@V0{RTU24GanlT%Y^QnHt325Kn7D z^QA9;*?kRg+e%-+0h*vs)5M(>?!EWl=M^+^o_+S$;+vxT@|V9Xj``@(vHyV|)+DM= zD|mH4wkUD_EQJ`bxUa#FLXjppr6k|%rjN%6W&1t^Rj8_oMxZ_n7X0gq2R^q4>HJa; z4S2E<^uQK3+l$oEAROo~R(ttH87?DwD$K+~#8Q7{Wry$QrWka?HEgf=kWEPVN8gO; z0?JdmuWK`47d`n`ar$Bcb|n7*0jjq%6R% z`Ga2K*|i#g5CxwG;dh3b;6<1m*{(RGo@wG2~(RaU% z88^;O&Yen?A2W7bobkz1;vv|Eko%M>H|#hxEuQY z8mItP20yy+`(BCirWD%)cB6K^`Q{tr#1l_6-oYO}#Mf*5dO(95mOK{D7N^7jy(1lW54U2?+)J0*{3r3I0UN$99rI`$+dZ3kH(Sd97mSVqei@3 zD^Mn@M;?8&R?5X5jyft1Kk}$J@}nP(O*Y-kegjiu^0eBjtHyiYvxmzbwEuo_*~OQ{ zcnvg6I>yo;RL{pXS=i%!?=wz65YK*g(r9e@Bz=J`=z5Ku7YvM{f4D!4vV#UFW)G%_ zS5I=h-gZ|0ejoaf2fiQujW-*upmw1Rp~Y792lvTU>zj7oSrdqjJm^+G zR-s${?3m+^kAK~JuXR3V%``pZ4wLTNykzwma?#)t_91GE&r zm04RXD5?fHu z2Ofcb##BLxY$-ha&_nUpKmXZD+rM^4XXLC#N>b-w@Zj1Sz#XFhzUQCnsH2vksd_b_ z)$0=^jAsuh8^Ht@UU;D!$un6&Ej~t_{$Ka}%W*npZtdkPcOA{rH`3ts(Eazv)mL4i zL35lPFvRz8R)Q~!*je*gZA=Pa~*k=+&%xi z$JOWktbkpj5tF__v{*Sa6L*9275{t(UmFLpFwC69s18bCyT`92Pqfr#+}!cRV~@MtaJ0i@S2zRo-fXUVLNa~YD+jk7S!UD*q0XK& z*IVv9PQtbJi+=mtSar44ZC6Pv>2de&1P#Eq-gax;bI(0q*}v?iFZDZ8sSJ(<-2zu$ zeRVvo6(7!@7Of&ONId@dlg61eNj4!{AXn93XqI`UUeeLZ@v=%#UXtY}<=$9ePq;GO(ih4~6T;9| znc7F3z!x5-#a2FdkLJ5#-5&ODcru_ALev_XFfg4X1t~QUmox;%(SQA%vz_+pS8o%m zuDV*Qk=e3f_RQ7~@S9)#!pkg!o~wBd%Hg>p>+N5$6E8gj;5msx+k z4P%^Uod3G#?s)Kl`{nF-$X?2o0ohrL4Ke_fb)#X-0yT|~fBfSgyeeopw`LIfaLJBw zOnGKXJpSloe#I3lg_R~wkb~H?P|v|HouumSsh$`A21vtNg1IxHgVb3XP69?JqZAIa zxV9mSrVi|)Sn4u(wjl}Nll_m=I;Q5cG;qz8SH*7ccx!xk-+khs5AEF!`|ceF@BbmM z{8?!uKfE{Hd~=t(;CtWpYGrWSV4J-&p41BEzYdaPQw_-2(zRDz8TUVMUq8E|ZQbdF zXT3HQf+OnDN{wwg+Ul{#9`!B=j%(t?NwMK38+oz>(2iCv%4<~7QR$g#yR(~bMQ9)j zkYTv!y!7QS^Z74-uE~HJfvu|wv_qD{`E>fRmxmvD#3}1)1u;*uLf?3@4Q%n=`|kI3 zrUY_iGvbB)&~F}l;)zxcgC0-4ASb4mH(MmW?}D`BP3&}15tm*a?dx#B zhxYO6>41IrjSnAqU|e?jxOE^mTL zP^#D=&kF%cFF`>G=xX5t`Lpq3oOJmWm;2#(w()6WKQ1EvOt^9O6k-*9-nY&(KEA_^ zOs5f49^BMYS4iX_K7oPiaZR4?)kK|Fwvo>S107WV;vl}9+c-<#p4t$4}l zyE}b{F!e|qVj%Pcyx@7F={}dfGeOAkax`V2d?x5e^+61Hvio2@@}t%FB_%M@e0{pS zK;c14NPrO|N5vg?-0oQ}vv{sE%++j~JO+&&Ui&)V5OeoG{t>rphJ#~qW~=#|fHIoA zbe6T!H{-RGw+mgLOd$u|GZ?X=s6bZ%kGz*`nNDMmJwFiN`{9q{oNs+Q&i$qWM}@B` ze%|@tkI$X;6)T@v60hVzp`$c=10Hv;F-x!yTcC-*@ih& zZ9cJJMD z&p7?lXT~|_ecQHm;ZJ`aKmFxzW93y=F)k~yEXHqtdCWs!Qn{5IX4!EwzXCI79NB8+ zF4W0SKNX!lx$Rh?Mtzj9IJbZN<1VL-(B#4suL9I_{(^bF9Kmb528bnKLdosq`n;K#!_*Z+MR1T5= zh9uy!4R+6}g`{TiyOLQ*DDL_*SfC58`B@*C=79lysNb_n#6~>eX@XuSHQ@I$;K>iM zjhTa<20K<`3gqKMMbxy4cob9`gAynDQS;kpfa;_~#BLe5B#|-XyJ3RmR``^W-7ymIX)oSe0 zKj!hW5{O@Z$;ENS#TUnn=`%f`@=z=A$iol$mUz-2j%>NS&fpmfb-|bvw^V9uZtS4$ zw1nl=kGCom=M62~@wn@I_J}L4yFQNj*vI4TnkjQPD0hMKJSD5<$I2|1ZDl{8uYr%? zf2DU$(TEJu)mFM|o^L5`0Zxx?5R8mC8bp77Z@2V}y}EiX<{?i(8ppt?qt3`?d%}z< zkeppdZj|8_Yr}{4cwiV>0_k>=!Xr?EXW;-kIkcA_2I8g$sva^wW#xA;ppD?^7qbgy zNY^+E(vc4R5JNlY$u{aZ6Axy|eX-X*`^2w*_Xod5Yo|Bt9BZt;MogVD)ou2>-~Pt` zs|aB8DI2mhzU^kUe<& zO`)?3UDH!kLh=kRFR^D*XQzwY@Im|3O?J&ch_ek^c_5azL^Uv^yIeXj)ocTnk5)>W z==vWr+1OVw0JkP}r6nn)pg z@_<$bBin=ZEf9{M^`uYtp|6hI&eXukb-Oy~S)bU4@)?|Yck;#4xhQJi%874nhHr5kRTX#o>+ zm*h9WzL5Iy!4~l2k_9?GCUYsw>@(0-!l!+Z-Eqn7$$=Iu4D?JGDOMPPBb&DqevZNg`zwxz_wD14r7N z8%qFY@O1n^p%m_)UlKVWv?6v4Bv65phQd871h+CT6|{7!KeKj#zv=SZCY0})v{u;Y zC1o`=1D%ZPgM03|m+!)R_@M{m%U}Fl9C_FwarnUp#ew_o9s7Oo{c*%cKJ33@s*vR& zNIeQQ6X&ZR_*N$MSb=PPusa4lz%NKp=SDWjH2bLKRysE|u-yr8EvMQi{;dfj%bdwP zvdyaP3QB+Emt2MyyFS?+vn0z7NN3nNH(B(mzt}bf9BS}``s&Nz!PIS9@Vo-<%QxNt z3=CCFuk(S)7n3n?I93}R9NIa=s%!=;A@fNimS-KlQRE^1M^eBWP2dg= zbzzX>askgib7O}8I!yy$z3J!4|NO_-y6xj!DuFmF8bazL2fqBXZ?=#VS6WluxptSY z4;$J&)GIqymkfCPuO_y^B$8Dfym;dbZ?9p%qfN3ONbl$fIV79)WFF$}iFwNF>4TCj zzN012{(>aV65BRImID4j#EVX3E2`H5Pljko2DU=80QhMOg@@{ng?WqDtpvr2(MH)ILsjqK=Z6x~zmA5V%+?Nxw!b<`Q$MMgfH#aW3D(=lY;^^QF6u1L zH~vWel+NO+#b{7TN}VaEvpI8T#({?%;+4ebKJ#h6`t7e;IXw30Bi6^Nnoz7babk=a zGYSgUi8}~9;U^up04DZ2$dvSv!A4LN<5b1jN(K`ZGXZ2)k6cJtq3SdV3sU@qiU{43 z#v!AW%1~n!KXz5IgL9Q{c1Uc83;=A^L8yN;J`d7`(2WyGv}LWD3ZcK4+$X4 z&O3#qHx6^s63|lP#oz2cdh_qkj%#n6Ng!k{gx3_UWcjl+#XFvII-1Uz; z{45-0S6g$fn6TnRKR?zF@DM7SfAU#C?O+E~?54RAOQ2(`{ZxeiD7)|ed!5S7LFk2| z$Z0x6e4n<=QrsHm1|twB?~{^PQ<{6 zt@nBYlB-8gEI3j(6s1~ukwL}Kg}=^qK*SWY9Ya>X#}qqjVd==h%2m*pM<;xpPx!oy z!8;NFMO+_bsx&g)G5v^x%UKVS-9FTL!dD%zF|Mm(L$)2RR?CR=}EYlr->)YO@PSPbKrSni8792BRj2Mw; zV*)M~|Lfj=IgN+w*L%?hnqAFHBZ8UGvQuV*cq>F5kg7quDL30i41hEWL1ynQOx|Ae z&;t+nQ44OXA31tt^r*9SX@-Y`9y4}K>zbdz#1-J*gvt-2=bS--qwu*E*kFT5!?6=U zNMu%u@7QBYqyaWkKYXJTh;anPgbR?i6hMxqm=uFA*OG3&F`wT$=&-}=AkhCnpq;uk z33+e1y}u2MeRu9Z|8Zwbn=&;?B>hX zyL?yWgq0@6M1_7JQtS}$Fnoo2vxNUriUjj>mZ4fU*KnE5-gVbMoW9rI`*(MRv>7_fD^+aCEy z1fbS(^Y|~9px*!n61fR8XRzj(OTgF5b!4caH!fz>EWA>x1mbMz^N1Dgwf(l+`dMPG z|EHbh?hiJFygZh`BQ*Q$y_ao?i8qsIuV|Ey4gmCmY+Tksc7PWKcy*_Nj(T8!eyx~n zodE#XcOjvnur)DlObJE%taZ#(WubUW5g>p<~{Hc}}B7RbOpTBGx04RG22t7y+n9W+UD4 zuYdhB{&Gt`mT}mTN7`XBpy6D-T_6X@y99AeJG}07+36$$+X~!y^}FBv+I#sQKKM{O zI{qdInfWg}UPOz-V{6IFbTPA6BJk~Rznul7&`L{Z3&`BU>l~!aaw*JOu#h?UIFI2XVuyFJK#WH zBjdGQZWG!=I^`PLL5Cjd+sYHDk%Ekm>l?Hg+w63PU3Y!AbT(7Yhj!u3FY|me&DPs( z7cVYv_ z-F0!(O*fGe$A9buuRa;@`PUTmhVFURbfE^4BMv`2CattmT=bjY#*WufAL_pST>m}y98n$oTM{WbKFJFcD9ew1$jWP^vBz(=FFaJ z`hErvy@{UfMKb5gDDUXZ+NPJqhrx%5TwdcN9}J~>;(<;w4gWlZ_xCdRC=CjX8?-gJ zIeL(euIWdqd&FeI$s~Xe3kUS!i2)OqQZj3tu|g`7Y;#OR^wG!*wtbue&-eiz&Qu5L z<1Jd1fnS&WZ2M&t9N|_$aW_086@q5!3kK-;Nql5e;Q6RaF1gsNy_ahB$L-(zQKe@e zk^tSKLo`*|6sg=<=@iTo7#M0MievWR0T81>K@_OaqD3RnKsB+6l)#Jx2lks^|H=mb z&RyRXC!Bn;U+u*6ip+?4&S}f7wu+;VJw8r6`IC0qo^c3pycd4|dtTYTXu}QT)1Ui% zY`x8Pz5vcm8$(A7_X}+gJ>uwi$xC1Ax_B$3RZ*LZbih1Dt3A~%<7#M44DR{&Km9=d zaUVO;k6p0Zq_c4c?Ma{bWbC&4?*60L3g{t8tL{yuD2;TlWHA(0#Y$$NdGd*TW@}pw z1Z%9lW{gl8FH~mLIY+b9jW^vi&i(dxwK)K)4!Oe06acw-B^i&n zaN`q!XC-T#I^ytg0L*52U*@lV_EVQV_Jot-!-sq%CQVu;c|iNf1=-8DWVTYTxuUS{3%u=^;jfVX(bi{rG@PK)ig-`;mvo`1mw-Y)Zv9HLX{ zwSWZm(Hz+t`Hi-10`0B>(gQA(T@K!zOCnoZazGeiDae0vPMENw-_gs6?d-4k9i5|OXT0`T;t?%hV<8I3vE+?c`ZK>pk)d4oAP9f zDj<7_LWd~&gFa>0Ju^r^-))OPOvu0&Ufv!?N%*%a{oEl}9C<`121_HyCnxdfBM-+_ zS6;5cWjAj}-E+@B)hXrdlyAWqq+E$oNCNqStQ?UCFeP&d;|5aqYF&_!`aeCw@HM`u2DF#lScb&laRG9?PKIUv9a@ zhF57|^vpg#`>8YHBS#$>n{WP-_>`Q^BM(0;L#4CjvphKZ2Oqf4#><-v{00NfOgcMz z-2u4pjO=y}u0w}beB)?rMF@+ur6u?yRqT&40l(L8}5@u6@tlcgHSod#m4) zLs)nH4dV9O{;GN>-83Aa&~Ml=b+65`?RMM81{YlDfvvVf6By8b{?i}FFMjf4J8Ndc z7hn8)Z|NLz_)+n}efNtuzWL2DR|5?6d8n8d8GQG=Z^rbg)8dF@j%~F!45%)2F8TfM zV$)4Gi+8+xw>a#mqcsS=%k9GT0iM--=)ni$)2DtizWaDl+jV$PnFlpsg{Fu(UXP>Q(y+HLC6`wxs)cC?z&W_i=VP{Qv zUhca^>9DK>spqFpKh+O%FQ@1{S91LUHie9WsEQ8Pph%>i{);U7qTsbVzAiS~ zeDk!43KVp;Iy`Ck{srg9Z-4z8$vix|Gyweex4&`!Kj@G{V*djVj5ojat-hv(E_e|H zE2^)3^=$tO!}=R+AY3_N1!Tn!&?9pYPUmdF1n7qwQ7*gUD!;pw{}cS~H@=|>`!xT{ z#r}sJ8jln`dL@MdsH}zMANGg(k8*je<+zU?6VcC>)CcTZn?CEi4@D1u0&wFBeGK1&zoF0i0dwhR&MZx`;EF8zr1dE9MJ6w1 zfYLW<2kSNQsW*!W1|*XCJ2I}>dC*XL+7$zbF-_mPQhIi8xDyxxncC2voGT9m+LslL z2jE=sGuZaBh_O%1bojZL#jP?6NJ~Z;5K85;d=D6sh z-`YX2`dfRQb?vlxqs0Du?-eH;d$hNsY8|ON9rM8lABdw5J1ma;$RU1v&6;woyx)nk0iQ~`Cg{*+0!8(*_RIxX*1#lhbrN6!sC{L8_A zo_sQ%eEczA8~X7Neqb6iv_ih`-}iXiDZ!K!it%TUa-Tu}zD>Qn@R+yg^R^UL!Thby zz`#HNj$2K7z+SjM`lAakj05)BD{i^*2EY9u*`RaJKkxG0lV^SIv#m!GXcE^EQ5LDb z(gn`&3z{ID{)v-(!vrfa%C9(aLVW9-b7HUE-esoWKYrJ>2UE``NE_1#3J0tAiA6jAV z{ekzz&$L1qRc?*Pxxu%!OQO2mc;k)!H*vNtu_N^Jz`ggz(@#I;8yxI-DPtST@;+B! z#dyaZcf|YN`|kLHgu5#@1 z9Qn~>uJS@j9fN3>7_E-B2PlhD~{jk2n6<}as!ozkZmnG)T z&i`~|07S`k;={_iUN7@R10x~}`(2d%l2yIiiZ)X@w~5-wH;t$)ePu`|gD?7m7J*L8 zK%z4KV4ito$V=M9Ibyuf(Lp@C*npOP&=YlG)l6M;#R-*cQwGlzxB(1`)Ct*iiWOpZ z^bzDCl@G_nV5lyskiyO^fa+8RPTx2LZ{eT|vOB*2z3(pm`d7akD~`|C6g?lH5|f{L zDyC^hGf4vlZ#?%tasyBse=7Uf_sMui$EvHW?p2bP z?fOoYVREPA3S(FBMP<)s^yQic+hpwL^HN&gOPLjw3s&Xbe3Fq)de6Q0c-D`T&j;0I z^%fOb@+J!2q{2(1z0ILKj2zdRNQ*Z`v+NNb@JCU zor~nyX892d_N4j0HCC~9I;wB_UatE|CpzI8&C^=(&6qYrdDNpjMhqJv=dhyR2l?>B z55)B8Gh?;YR`KeL@@zKY$awgE_MBO)f|n%c4B-&}Wu#o{^(uiw`Ho zHW`BrTQYOz&hc}M%tYC4&DkkNmz~RvquRD^e(@Reth`a-zWeSKinxGEs6ep-$TUF% z()jTc9IsSqV`lcOczKM#9ZPmPQcjW8Gy~={lb`ZSx6$!RlU7yTvQFh|8vM`VlxLpt z^$~Urum#?gxWf3nbMS%t@AH6!Gp#F=Cg60~s^ZQ4^<@dr;5o$=MT6CoovEE`mu&}r zT;t=JIvg&~sjZ;;4Ie(#f2%c5{eioRc~7XpJ)O?I*iM+01lLEnQHFP#vPDRZSV=zm z=wp687XJgtz~T-s-B2E2LO4@4!Rz7t&ldV1A2;6c-qc}QC3?3-xcD0T2-zym_ul&- zaG&DtW+r;9HlWH{0DPPf&#pbH$r0DvUbOyttsRC0+z{9Dr6c`xXk_8pQgu-8lFwHk zVXGQjMg~?n+!%*^*gJLh3|;5cufEfg{$T#n`+TnXsx8p3|4dl;^aZwwc_I6MCQr6c zVw;_pRWtbUvTgo2_aWKx`~{1A6H|}cjYWd%r&%+6c^~P+k3Q;ayZ}2_YslX)K%vV= z9(hc%_r=;8r0EN`Yv~RkO5f!HeQcH&dtf^>E%!h0x-xuUeMXJR5<6f#)4O2)+;~Eh z&Zp%^Cu)_5?B1%i50g$yd*Qzx){1i0>{+q8>~$p9yiv9w7Z28w&vWGfAYTp_Ieaj= z(V5C23uvAC;XfS>O3ynuN!O{bV`&mY4K>1eds}%7OmKv~d!5qo*ZcuCK8ArAontTX z@*u2s$3N3%hH^*{A4Di=(9Rz~94OvO$Rp?}MHcEu4s7aWev(#om^}GEanzB=m%;Ds zulNFewqiEoU{KUDC^J@-JNmn_k8?=p2eTm>mU<@4^6Mjm^7NJE+U*{CQtVP*6 zrYd|+)hhj^wK3=(>V+pxK7#9OsGJiV&koMpYP>45Ez3@6FZc_`?V?Vo6Q4u7-Fb@~ z4wkk!5w(l#gf^sJtU7!Ei$HY0XE1Nn2RkciUMVer9;jS76_~Dc;eO~d7nB?vg)h7C z9h#_CA1HxU!EwwNvRTA+=nq_Pp-vbBcA)-ehLTTx5nXUiD{p*Iz6f!By@NXG(<{4Y zmByPsIH#TI4?aQ`$+6ZNM@@fX6NY!;t->x+2P)saMP=SFn{}(g2wYib2 z)}_^g$f2Vt@O63B9eyxlMI#J+q#KnqaL~OAlw$#-=m#^QCz+G<0}uKE+k}Wfo^6Q& zibIC>w7rw25z#$CaqEOU%B!rmnWbYU)=W73PEhFqN=_?n37$nDqXlIW-AJSDouF@O z1K^nQnO{if!cI0^O@Y81-z68fW#Ist4|+{$VrE)BpU3>4I66u98t=nh690s@CugBeENr_LM>lt7+=g;iTdaaK*CaqRFWHn|D3|Han~sZqr!3u zq@x~YXQY9PUZhhUaUiZ6hDV+{Rm!IhYy_fYkO!XVsQ}4L5Ih4a17Auf9hk0S&`})v zbO!e&g(Y=Bq7JP9VvUQJjuju7Z~}Jz4#+PjsJK_S9^?}jAXZ61i;(3+$7LJ%5{?fJ z)iNTuj(HuGcPrM;*PHy&o$3cb0kIu#(i{XpqZl~m4-t;e&3r;`v#|17n0yu3?g8I8 zR%YtNbt>iZS7*pT0KedQ7eRFavh8pxst4_^Vs>O87fK09&mZfTL5CxFZA?2kj{5P9 z3OHzj9ZrJtGfJ0j&H9s`wL(?{a)N-yz-6HEn_nC>&`4kgI7(p`^jof%_GxgUzUHM& zd;mO<4L|9Lgd%m@mptnMJr*0X2ZD#}z!L@Zr;zV;EN>KXf8ar9I*0hl0ZXiqVBh5ZcHsFb^0(OWj^h1ucVeX)mfln(V%D{zM0MNmlGtg26 z#77ic_>^#|(&ufc&0s;x0TlT``&E#|gU1G#@{&nk!XHXJWu@*(#}}mpNrdyPv{P&t zKFVEDHwHOuh{u+wKfok}G?P@YZ*1vx>3|G532>lEHce3in5gy<>Px^&l1vKJ; zPjqP=&^)u_ThQ9r1Hf%eZoz=Pf}f`nJ(7`&uMOQHdC+kziycoEC7FPQ_*m+hfiw{5 zcv(NcTsJE!=OWzVXc%~KJT4~(Xq%%=(W&H3+svTf<${X0EPT_JJiP7=-Z)LK=4Ipb zFY>*zwjNX=WU$uTpjs$BZPxhGQFWL=bu2CeO$9UpKK7q@XsA%-K=4wioR%!k@{>As z+elArQTiqb(jk|ub(TPR$mO%Clmr@x0%~PmE`(ePZU?1PCsTtDQilcBx~ zMRdipjGnmZNZ(CAf#lMS@BlwA25k-W;QFQ=9qDUKK)}|5Qfaas+k$8p`H+G(LQc{% zWF5da4fQip{1NSHM=2$EnU35HybOHQC+$~^%tW%Q7%$0SvTIw_fL!~o>7f()toTsG z$>_^IOFVQ)vC~fS%*0*Jl_DUYWhV=IKuO0h($>ZQQAcRO$Mq7>UbHhdOD+91P4WrZ zR_NFhIVIu4&^%_Tpy@Dcqm{N(O#azEudw)OK1kuK}(@&E;3J zTNuUD;L3{X1wv&4yZ)b&E0%EbqYU%r**M(EmEnOH#aN!wptS)B)SV8OND7Lo4t~DF z8dbIo&(Er{0%YdREKLR7ooPUpLl`nG>xM=LHNYe#eO}Nkx->FM_r+<|!<`fPB@f$V zLp!_tERWxRr}|-3tpQ8IdoTx=a~p5c^ZPZEy7k0a4lL}NU@?Tqd ztzc0)2SOHkb^vieKqhe(opcudiXQ=|>Wk_!{B#PWshngXnN27p?vUePrR$f{Qhy1? zDwsN?lgej6`xahck~h$0J8xf|=)7I}FAF_#Bw-7Tl|@0W~w z5X@DIw}fbSbYDIRl8|ze3J1^3K9Q(zI#aBei3;@1!!|&9E77#UZPBb1CBL!})F?-8 zc(7e*r1QY1-ihP$b5yh^?MGC|NCc;b|O|}@Qk)NYlp&2W-Cg-M7Vpi<8qSNr3y?b zd!8FZ3gDWpX$s%JWXVr-B8&U3k_%XL9qFgoAA@PGc)62Z8W6tiT~yOYi>8k7w;rJd zn;P<`0Z<2tKpfy$;}r&;4*+LZ+O&&>P{rNI&r23#ko^dKd?CC zoXSdBSug?J0V?NE;-)2h&kp4%F^WE|{@70Nwv!swvoIQ0_%y0Z`v(R!0EO=V2qX{8 z+>MXemZ=zVM_2G?xV*W90g#T4Q8U_^ zqx%$&GA`%1viYfXqCQE?=S=3ZEupS-8$kg@(KGe5hM@yg!Ud?m9pV4S-dOkwS3@u0@J_p-{9)p~cUimX&6b|&%Dnn4YC>20ivEW44aV{K1-&$j- zq{`mzbP9bUtW;DTt^}E1f_V2fS!D(2Ntx@0Q}I@$^1S7X;;0T2UxN?)maW1k-D_e@@nID>ATtG?4Q9=RBI9i1g$9QBrT09~@`j~PcB~Qh;7R=*25QrB$ z#Ds`~$c2{jZ`(%H$4JYRj7}{fX3mI}@q@lo#qxBeTt7DfD?@#AMivJJ3(}YfQMmLY zd1z)($6ttU2rtu=j>uNU>%}BrwaIUAQ6E9uWd-1nU^04e)elZ1jvl(WPlyPjen2(e zRw#HlM%#d}h5F;|2j35I>riDMh|UWmk1Mnwj$(sZ ziNZ;em5B~ldd!X~7Wlk`chShNBcf0VKL!*!6(ti-s1>PB%7YZc&&zTN@nTvAdX^g< zrW!T`RMROKfxr~)qtR}%erTq*%4|$LyrQfNQdH?G2c0@ZsUHN@>bXx?Y@3YpbfP#d zivII|#2u9F?IW%m;5@R^8$H6SJ8;lOwv4I6Aghuj?rzR_0ouvzxt#wP052FL(-2S5 zV;F2X@Z1hofq?neALUCZcWv5vyOc0sK$M4J@taDhSyncRyRNE9h1}0zCe2bn-Yo#9 z7B%zHg!JR(h3fb}j?g9FQT;`GBA8Mw4{+;Ek|Sf!yA(cG8JDHSj7!=W>l-HE;N}@i zK4pV`!$wT{R6=p{<2FY;ZVZ#7X%c_5SrvkZXfk6aR$?J*I6ywJ8lkLY4^t{kdBF8a zD~+t>WFRkt$E6bJ1JdEyeMA4LuA8kmlxPE!S-!!?&1Ugt8*Xq>zRHFj250=Z@BAP6 zwZ1e`La^v0vY=BNSk6(5_C{Y=HdYSu;n}Uv=Q-F=hE{}?$mdRXtvD}sN@wmT^&xMN z@%R%DO`hm!!2uh&AlM`wYDbzAiAU7ncsZd)2|%^r_(Eem9iw4l3C6!S@&Ibn)j&}h zPu!$?Y$bH`L$VAvw%0oN5dhwl!E<9CAaq{zbi~0J{iySNEC526QK>wLNW!qd2cJvf z7UgbTPMFZrXLe%090bOi>xsM-UfjGtcWNRTZ8gdo)~oRrkSGJ z0=HIfWaH8pzYqa=(H`Fi8Y0UBoXmLsk4GD*6?x`_{9;V>6Uto$&f6dviog~&hM;Pm zvBMLF#{*NwN(JesFtCz22TlnvAtV?MUoT+`Ou;YW9j?KYw+zjtXNNj^;0Ab=0Lf7@ zrXVgsWl0Bn&6&_{%W>?W+RdQld24`v#i~T~R0*o(`9rR&*_m^L1CC4`NMP%ZU>(i; zxxcI%2sP5kk3id4m8rk6oMcBSLs{jx!6b6bJ6i#0Ac+LY6#bb|R#E(#zD5@7Ae~_(ik1DJ51#Tr+|v>8p_V zZe-dkImMlVFrAZKt%7IYv9AfL^$+?&QMl+Rxr58Rz>JTLfIQ04+SbYxi2P_V0ZJ_c z+u{H?>!7pJ*dOiy0=0-)n{i2D z1v6Q=xj3L}2W$4B#+10V9_*);$q2Ux)s!C1yB3p%>mphV7XC{)&iU-+pX^fC^Ps*-iP z1vE^o1KGij2Po_ii2GZCR)EZy8be<|hlvi9ArJ3y$7i`wg(F*E%pf(uU0;>-9}ZIB z12R&Zpeb7Qtt<^Mw-tKzx~@+((kwd&M|u@D^A4}Dh}eHu=Z){&n%;}rTt>})dEq}L#D zifE*Z9w{+8p~Q(aQB~cY%B4+Q7i6pjwZQG0oH7X)5-x9Ds+7lN4zv@@6qVKVGmIVh z@N7j!;NUJ$wG=F40G#EfJ%X~FYQ54qqdUsN3mkM|# zh;JViVtn%B5^5GLftqNDDfcIIkQ*yLR-rgz%Pe$~s`M!@vcM)`r+BZdw*{5Sc%Xgg zEfM#r9gt_y-Tc)s?1r)|2QHWhgTyYAOH|l7V~2 z2xznL>4?7h@&xD37e#f5rfasfz9U^IXcNygx)dD+O533bHG`J{)*1ulnwM=11w(L# z9N=%v05;@_jzulfqgN@=Iw#`|cz6#4pX6f!ozo$73>^pK3|@bDkvknV80eh1kROa% z3^hE_0m^lU7(_2p<@mCaadd8$Bc0)Hf(sp8A z=}HC|PTE=eM+H1iC`b?@@-QN`YI&JCg6rASHU7;*gyf%D*-_R5I*TD9`HxrEQ(&^B&Z zi@Rm%D_2&L;Ezirp4joHbMKFUPkiGN?TOV|BSn%0h_6=O|JYU>-O1tqJ;MTu@mgpB*TK`Q!<*2E+ z#T;?^#eD;9^$p;Oz5x3`O#?J^pli)f)*mN2UHQcMQ5;NV$AEEck(mq9aeNsUZIle@ zH*hw2{Nm7qZ_CN$s7s3EXI#N6f{RJvxPZE2gTP(rHV@^mIk+tf)UvRdt+XuE5(?6> zfl2uv5=g2+5Iu~wA8n9?%Cl}=JL3Sk(L)YU#jJKJAJw9xiC4KW9VIddSS9h0J6n9{ z56Woe&wrua0&t)S8Hm--T7z+y2*fP|5OpD6QUao5)GEhmAA>LqANl%WKq<`*P?LkM zI+lq8gOCB_X|akTi%{;Y{=!oX1h{E)Y#A0h)L}N8!8FSucn;pG0npL^`48L*$lSFe zTR-9mBSaZk6wki%k*}TW7>}di0ND_gV}?HltN3+~>0DJj&WW30<$K^MTB9up!>=@G z26axNP6kp-Fjz@+%>0*7{|f*^!BUO42IRL^A0SQ(;SK&h3CPBSYkFl)8V0w>)inYu z9fm-WEdru!Cu9$Gf)ALa=x@Zuyz z6gJ66>M)Sv5p^i3gZU!@yr=-2tGL&OlOb+*qJmu{Cfr)v;qk=G**5(rSf3 zC@TeG0P~5RZVI($-7xUVi_WGpd@4;*f}NXibnDtB^|W*7>{lvT;FQJKQx9U%GZDrM zC_lD3g+QYKMBRcRN|OhdQ3ko0RR%c&j>f^KWW_1@elvMj?gm9RfrUdjHw;nyQJ?C5 zlM7m^a>xP6acU8Sgv<-_$H;jmI;u!FJ1xaIQX@DQKXio3W0?J?W2`*PZY{*k25PBa zZ-jx5Z79yeFsYDG(NDyi1^$$6x;_tx)M>h0H+bGJ$87a3}QJQ>y)BQm^uj|{Y<~H8i$rwOD3Y= zZ8A`SL**E+3bZ3LAV8-I#A=mScEKyx{+Qs!Ry_D{g6I^J15K3VICzGW6_zJ%;9^#! ze@~+I7Y}{Q@ao8&!QO&|l6YlI&_>^N%5n<=v`sN^fiWC?&<3yjfRzmlQqHnK_AJ-n zJ7nT(i;|c1R_An4xv7fJ>hKCPc;Qo3qepN(jO%3ZghOZiFy=)N4r!Z0C&|3Lm;lB+ z28k0Wsq#1z&O}u|T)z}gcsw2bud*Iz>Z916bOXq8h*kkPCdU0phw!R7Dhg)CKY0pN z5^wr(KOtB8BQ8_O`GcPRg9Y*Iz88RjKV!=E;~%M40ZQlytt}zww;t#*aA&;Dpk69? z2#nDf%OQ+lusL>cn!xEDDGzU{6jlv< zW`qQkjsZc(GDGaqt$XU)u?wRGnd2X&V5-HGiU}UtsA%x@ePCP_i$EdLGSur5W7vsH z{gFreJ?wOh?kIzki?js?qVxDuu`Ze&BOl)hDkb%dSeoip0tSbIs^E8bVoY2{Re3?5 zc??9M3Y^0USO3{|(?Hfh32sDpv<8d^9K7hj4NDkBjIio^Rp~wvzaD7OFWj!~Rh=Ck zD;fqd16;UOE>@!o8sN3RVmw=b*w6gbA*2G3S(RixaDkgNS_p6so{~=<;M*81^Eg^| z;)Q^IQWl_Y%P=-*-op`^K~CT%uy{sOG}V9TDi7>iZZedZH$OWiImh-_7(H)I5myqE z3JKpggkYG#1!eE9Km>4Aabt%Ocmi101z08+G^dEJ670Z=7gas@VFKgpLK=qa5?L}Ck6Qr*0 z|EYt0P&vTY`WP1~25)|yozlTif1~@7mgu;+aF81s!_9dH8bmr?KsXA}Q@mj*S{v_t z<-3IV4CuiF{X~f_8h<@{cDJ4KhmbX?@vG{T$Cz+mc(pJ7gwqaGM{X|SBi`tRXE4ZH z?Qy>dx7(sW>(VA8LVDiu7U>1|>PiAOI$ zICnn!7;mQuJ1jkA0>+;zz~e}Gx05S?Msi-#L?B(G{TTV$IQM}QG# zATV2{Eer;5S;6XLek2$-fl%0%K!?+1Sv-;D-fPv&yA1XpK-F|nf zWlLlx=rCGH!I&u3e5wMnWc9|KfXId;V&fsyCI!D!{kzs~COAV4}|hX@+bhYYgT3Kq*;Dd;CDBst=&eLMk5- z4et@9Il>bu;LAmQ9@s+4@fSIy8w310HMBn-fX|a&>s#n1PG(fo24~opzASU z`N*7debU##6ih5yNVbdUyoe!yM5S0ps*q2O)dgKCfOCinzja@{L_4UjG|2{?hi4w; z!ilgY=*JqcNn*hL2pJBXTh4*pOtXQ5$R>M^f#WbY!PE(A=*$mikwCXMx?4&dM~q+1eO0+^~0?TP>c99y1E zCy{vvZRq%PC3HHIfNKt5OqY127*5Fcmpg-9L#lSKVVbXvx^P4=x zQt2TKk|!FhcGL$hqrP%~ldf{^a~erUL}%36mCpNrA(w$%lK_Cig?!pzPM$12 zNfuFdItsCBR#~b!R^nNr{)t1K^8)G@$$%HpBX2w9NVaTZa-M9PuwC52JWP(SOaiU< zLW#VHz!L#yLb|C1VS)Nmydru8$I1}J!Lm>qXC4G7qS}j6ckUdr;eDXqrjWc;P&&&5A+|aK0*5(3>^Wdh zz1oHfMh*N?%HV6R&Q&@6FtBlQ!!(oSy?sq`d;~ka{O8r9w90%laQO2vcrQrl5tFMF#O0~_ zfJUmb?uuoR+-XgT8CLt57@#D!psM$srT*Wjnw`ft5&Zhtgsj zkaK7YAOIaB){nBt_4q<0*pHlFbhZkN1M;BHM8oY?DRE?T<`tj#^ykvV&)~sByc>cr z++QAeV2b`L4aeb=?!L_!and*=&Xp`cAA$k+aG!&d@~}ZfVA&TPaW5!E6{r(^571)d z8|Snmu9eepWXU9ou?){Kma!?=TdJ_#8@m!<3bX{M8Au!(j4S^~fM{vvSHZjnA9OYG z*8e6HfXTPH(i>d!aEb!TiooefIHMm_hHDu(x*l2q^6e{M3*@E`iZBR;%k`W>{d$|6 zLc)I$(8=Hjj_RQ$P=>OoGcpO)MNVp?m5hmk6d(DJroqv%W0%y8$pG^3)~`gT5yQJW}vTzw!1~P^iWCG7F38D#JuL{)= z9~HvzP!_z=Mq(cLPJtHrFsIydNyzb1TuTC{Qk4e{ zUV^{_)i}GX!kUDs?W~d&JaNN$NKoh__2RvfIZc1Q(_CrLH3}TNXccJ$KN*}T`O;p? z8h+G5k3(guux*vbT+g08l-JSU#^k$-Oun&UWs+FxbBxOa;#u{5O;>3?LFdGjxly{u zlUQH{=`C)ApaLFC{tJ%5=N$FB#~32iAp$u-$Ru<~WyKqOA!V+;$F_EqwT%W1_Cx_3 z+~6`o6RoI=o>~&-tvr`#bu)$*kY#1`B~Y+o;U5Pe31qd2*%%Grx6vQUG9jQw7=hD) zaA0MK0TEjsMDjTutw8xM5`Gtd`iCw@iBLY_R2`16NL|ZPKeXrjgR!&--w)c#1r%sA zArzXUHmvKZ7Lz7fC>jYG6S2T9P$H8jooWNNi;^+&_&a}ld zMqHLxWaK>5epa-dr0Zn!0DO~IfV>QQg!C7=60!REV4nT+cka7Q*UZjBldBJC< zYR4UqqR?J;A&|9r0jK#7|6o3`O^Sznk*FEYf%D8nfnYD78lMON`;I`DScEbECKMDJ zrWm~w(bB>G6If|oQ29!6B7LJo>IsZX=kDLSUc^z6T;+R$u`~!jE|ew*aAtRtA$r1w zOh+Vz(Lp>h$U6CUaRy(=RT(-ILl6TkAO^FHDO;Hu%xvR~!0F|$B=}BEoSv0gbX;Gi z0otYsZn!|91x778DpQOkA$lqxc#be8)Oj84`51X@Zcm6&!G~nl@pW|n0JVbl$BsOMRqI7wlA+h<286qo)Cpi!BxT+zU>8U&_WKQ(aPGHoJ2*d|;*O!>5R4r+q= z0RR;+A;{Xm%G%0Yi(4}==qM&XI?GJzl;RdPN`V4P=%f*-uRvL4IKYvkv;q`DjIilb7mUJ#ZNYxA zWjhl2kX#{#RCzYfcXvu=Akr}NimtScwtCgamN3}F9FtBvHXV6aG5y2q%isqdQ4h;V zVEI!Id8r(2@pUs5ikrn0RMvce96_oQd@IGWurtj;8W4Q*%piTQc9S0gimFE=TrR?t3Z(i!|ILpey^OjIBXJRgFf zzVnXK5+^P|dH3W&o4QlmILSTz*_z1pAoVO!D*Z?dbj%XmAgMyJp2Pmi?J&4_b z7L4LLdMS_8RS$*p1MHN^YTQ4PWqToa;u@Vz8nEFkOQoaP6Gyf=Qg$#GJE3$ zwzCEd7$60M8wQDLW+7;tXkhT8bmWi~jd$#!nB^`rD?Z3n4q3V1?C99W9N`!0@(sli z!(z5fI|hm-WopmeiI{N<-=IMQ)8Ija%tMi6ZPw@WNCQU8nX)Bf+Bz?R5)5!(qf!4N zUABa1YjYiO$$DUbR!)B`KnCzKaNxk0*;k+iM|I6m`!Q6sm-Ul z9BRD=EGHpEe2kmYW@rG=MBnMt+T=~Ra61?tWDw8u6}<)@s~u9z2o)={hnv zY;^Lze57$_rY0jcQZX5U26)3rX)q3NN`3lFo_6@fFH)~wz2%si(hwOT0?lPhX`OY~ zPiw8aUi$94@5E(GIn@Cp)~!eP)V)WK;0MMt5GVBN)yoEWgdE?z^Ut4l*<%l1Cy7B? zpweSlaf6PK=CqD>f&jAVA)dG0VF$@!7aOr5>cb&JB!divqbhl~NwV&tKAU37DbqC5 zPM4;ie)=@Yq?39gQ3ag-0{!}>b=F(o#-w?B1EA4JS8Hh)t#V>npd9?`Px?&%6erAw zQh&MIuhOiu&f+2Tj1I?3Vj))eBr5PQ)jmPi|KzGdnv{7pg> z)wrQjL-mw+2@@IA#AqySf_^lqb#U3r zAI21A-*Cf?(-B7>pElTVleFbF+ojXbJSVNR$|{=u)s09M5F!S-ckkY5iKUkED}X|o zgw+CW4n;n!9GI^xuu#7=!wfU}W{jHP+8{s-506YNwxnqG=&5s3p@+g3y6l+{ukt~D zM-AX1Y1iHNOf$|nlUFYWD`H0*O%!&fnPwVq2Z(a@?lno;>o@xfAG1T03N;Pos)0^W zLX;RIi()b;nV2vv?Bqn7W4v}q4p4y!iXEux;~*Kd$fAd2u+l24rLLO24%UQX-ue2b zzVpp5<3Ch&MyKs|+S!ibo3Foa*e?ah-+1%Q(xq2lYq?ZcP)rDBks-eD@+;lf12yrO zMuv0I#TK{R#suhOS{}%BtU^9GOaP!gUw!#S+T+*zq>VP+BEA3KyPj#!Hpd)tRttHx zR-m-J9BJdsv&@o?Kk4MO^KQGU{$^=wO^VQ~;W(QLpbIOmvTE9G&pi__Cur{c#?csL zUX{BoP{;zcBL{TLF291`bmW^XWVDuAdYLqNpFY`e$ApJU%*t_swB3eXI7mYuz!v7N zIZ%#1Ty(J|HLlN2n{2jO+C+|Jvn{r=gN6;~lw=?pt;f%I5YaudJ0UVL>N=}ZVm&z;K$FU7bVgK9tU_5!Gfw9B* zWmg4(3XSR@Tg4HuYQQHIIU@jNr=`d~cdP5skE^e_R@!5)y=<>&1au1mrmvp3=(IR} zj$%M)p}16x9SLQiVN1jZPrN+-`~YCujYT&q-1 zZW)?a{?Wm5DGmBQ^f6@H%Rp|j`R3{33(r@$AoV~0oOH@bC#Dykf6i}cVNkFQ@!fad zrf(GnX>icN-^yV2TV%1c|AB{?Fop;Eg$MXy*8JUo0iM~ijlnFobLXzJAt*&~nB&pzz;(`486ckNV{fa9COF|Cwn#B9(s7-`BLH9YmGwgP z(ODZrt;ns1>i+=)zm=Y7f+IN%QP~qu{*zZx==uQV?;n=Ur)1=?0E#sAP@IztebTLdj|oO<>Cv9tSGzyMdCecpfI5=W&Q|E^KrBL6{yG(IISl9*JYlY<5fwxeS_4AeMf zqW6t(FayQ$F`4-C%P*s!aC)jupA47XV5erN#tynTXyD*9NOB3=Vv^x>)we@5sYVtK z>T~*=9T@c3&ozpdZ$cBzZmhD#G4jmf(0e?d^=HUst0~lM94Y&`o* zH{X22TS&~5K9TW9`FT8H$dEy4j=APeYp%UcT13WT5-I1~Z@rmjnQgYT)wbKFS!bUu z@gdKl>g>-x`^;Nm0JBE6$~M|$GuP{<)!q|NJgJ%I=4s_sSM_Xc(n%&w@5@m4?b|o4 zvg&G{vClKlyy@dlKDMBl0W#}mV6C_QhUxWJU)9QV8?QRJMmhC#)25eRc)_c+)z@4z zEw=a)TGh=c{@zkMVpZFB{so-3(87yorq?a4yZ#30-aGG58$XU&pA>;xoR?p5B^lBU zJxC^CBfpx$`xHJ3*b`}UnL{cOGUwc46bv)>ug@++;B zuDI+H)1@t|uD)hku;0RI-g)~55bQ4 z_dp=9dZXQMzwx>q<$?<>l$Ks@`Sj|`FH3GC(+c8s(n$k=_KXaeG_`>s^X?phP8EFR_&$WN{GY^V2)>+5Kv8URK zjHjJ$dQDaiN!_~lNRK`IkM#V1{^Qlvy6decoq5y7W~-lXpQf5->a@)A%cn&oD-87) zpMTEylL4K?GFoccP6!*(BX|(~arVPd>74zz=$Z5nOTQRniIy^UOPcT42Ei z(G&ej-MOXX@5?#&=+)c$wcLs;S{_qOF{Sl+XF2e%zWTxw7y4w?)mK;lE|V6Q4oukuG6%w+; zJFKXpx25?+V|D4`%hJ7d)>TW^^r>oa-!k92)wt(2#nVhWAPzGD{7>FPfH=E86`BCcC5^cG^BIyzs(lnPrz1-NEUz zPe1lp2JiZ^ZHvi9PA3_?E4^UgY%06CXX+_zGImG)i z%Pg1XoO5nFxaF2xF|Dw|%Cf1mq&Fph+Q?g=HrZ&)wDeNT+Qu?LV!~isZ$-l52jDI% zrxO^sG&LwKx9o~ouj1-r3EWn)404R`&$r(pJ^j=ZQoyh5V3?6$fCkAJ4$^Fd=UwKU zd){<{Rz%ZJJG}<@p!A#H?3-4VabgzEEQ+nW&p!W5Gc(Pwn867cP;hee3BULCl21PU zM1!cGl@f(7Gx;x6ud@c;0t+mtRc2Q^mJK)AR8IBhzTi&B?03LH>7auTODo8+Ff008 z4i@9}<>z0f&p-V%O)G^t>ev(1`HQD7WGsHQ*WPlto7x!RJWu}9>8a1;Q`lJjdf)v# zTV@4jkQ|T&1_tE^zSE5BQ>`dao`VlN+{XD+(V@!G$DLqD`lVJz45l;AIWOvHz-+kb zW{xvk;wuRA$!PZM-AhjGHD7nzap#@2Li^f=ZM_XQ^s14z{CdCr(sC=TXj#*btS+XT zZn|{PVTYxu)wbcohomPl`6*YHJ(z zZ@>9AZMx-_GT!f|e?InT>e8jFCpB}-F=yKE;6r`K9<$oL_T5)bXruI=%B?N~dFYY9 zbAP_~?mOw^GtW}{*L7cSu;Iq(K(*_`4?nQnk2&%8c3xk9@uiIV6ln?>+$pD;Djj~z zvFTv7cexc;@WgJ0nPyPlRCfOBNS1s4W*_(OXPDUMFz3bKC4m+@_ADV_p zmlj`S(X@wFcb|RnxxyEobg-lFiDZw{I#Bwz)KW{?81ANt-9EqGOM3mKSM`S;bWqxK zqxEIHKTfmHHhVf~|NYW7TW^!zltaW39C_q18jC!CrWN#Pw(`}NqPe7u^{&6#Lt|mI zCanvn1NQxmw_87w4zH$(^RY)BsR{C@a^BI4?5a#P7Dv5 z*e|{D#v2;j(`xm7uASy=v(A=IJN0z0OwmIo$=_(zb=VuPZ9k$46DRGO*v)9UA#BM(p4TyEHwQ zlY#%hN^rOg=jE4Nln#`EzW=^^(`hIF(PDY`y|>fFmt7;7<-Kk|!W%JiWctV7?{|m3 z{NhXLt~+kiN^oW0@KJ_H8a2c3qpWokm?VMkA z^_4buoIftdvHk`dq^{k&r7N$zLM!3L6cFd+$yo2aHUc zZn0%L_K3smq~f|ktR%kH%933I3?Po-+%r#4|9a|aIkxxHW!GGnW}bD{G{;MQb*`ZTt_KVLypB|MwxETXO%eMa5A_o8f(+){QK~&|f znsLuQ=bY&X8DNY{FX<+{7x31P9MrzQJy?$9YsqxdbnY3arO)Mrw*2{a=}&+BL%QX! zH%LYuJqun`t1jxZMNE4cBb>A9U{ItJ@&}Mskii?TlenXhPwRX zi#@^M7W7Az$LjqGrO}=fPB}F_{NRJ0ER>y-Z^hG`nqaXq+-3WpYZdaG4enQ8ed$Tr zJ$K%f2FV!$e>(LPO+>#EU>MPdX*dHv1f&40P?*T|9 zr3DvUDE;TzfBA+xUkj6b25C~@o7$uo=o;Ip=bV3mSD#;h{cY-h-q|(UI3sp&{`1`P z>BW~{NegL`efQn>rnRJB+>3BQ|NiOJQ%=^z>6LVlbO9&u?7yB#*Is|ER%a`vTW-18 zGGyD+58-P}e5vuywjd18OJ@=%;G^v|J zE8V-*FWi6zpktjob@fDSpMCam-!h@vV)HH1VvA{|CmT7{R8yz^{m=6j4?UQUJ?1FeuhUOIOSa;Pbk zv}xOIcSx69a-sC#B~3EcNDFBNj$UoB!6sVGKA0}Ow12wgrW@qwr?njan-KGM8Ac2j zh9RIF12~Hmei0d~LDZ$sSSj7oGL$&TDW;ez&8u0_DW{#0 z&h3AZx5s9mdoHC1$umL&+GJC=!Nh z^DVbZf4%j#boyE6%CW9$y0FT&2Fu*1o_#PCa_6KKx4f7#3!oQ%|GS-!aFf z^DnwIZL{t6b}ASqwjN)6{srHqH;p>%`DdRqe|f@KlN1iByYRsmpJU=RY&aUWK)?L# z3(f8)w_|@xMi>LuTPwQR=bR&5E2qxNlbI!}ID>GbSZl1ccDniYJ0!D<(`s5NbB%^; zsQ2G{uV?DhOgl|lLj#nF$GviB>tl z(`sdbG|Q~Br&Yus#^u5L|L*O}+G;}d%ANzWZyvqCc(5hNb-1`jF)A&i89cD3X3|&v z^``V|&BOt=>K0yXaSh7Xyy}{Kiay?+?UeW~To~=m#su8zjpsue%|w zp~)G%vm&I;FpnM}KlG6PfoJ&jgUftAN_eV{&p@B|=$9>_uUd5B1ciw(SIyOm~Lj801U3a@26RcX3#M@+(P3~<{ zU=pn~n3$A&_=MJHn$e&9hd-thPdF}Js>vbk;_hyo)VuG!WBij&GFkekCSS;m6^?{$ z983awiAQV=aw8ts>eSUEM|ph76s31G?kAseO0B$lY32HX%5+F`&NiF-5oa|-6UfOX z?UVSB4wHuIrk_FbkuGZN@f6}Ho@oHYyk(1RldPBsv(?Hg$AB4Ck4XpsuUun$Kof|a zcidi+nQzldE3KIRrinDGrzI9&LI(X6mt|{_=juMyc%4g=3v{Fa`t3f|52E7>6O8qT zHQ|2hsi(5-a#58Nw_TVR%_L`gcbcU4BxzEuB)fLkgtv@KwSDODA!(M`W=%KUd~>?< zjytqcKfrm@$nia?g~zMXvuB@uF&%Tv@!oyI{+xE&Dd|^Q`QCHa-_r^!tdhRc7(tJ? zP7Ng^^Of8f z0Cht;5uqd7cOyoP@X{I{{Nh?a6cgOYhk3ih&xk0UXE_KkJE>+T_i7ft)Y41)MhEtx z88BRY9XxcfFZcq?IG)t(;*tx`PuKnBFX^ED_f324wu_aK0bzwPaThlq42nr)d`>*} z=(LNJk&D=uUU`l0vSgL!K_i~nOI~8hWzt^1-bXXUebbKHZl#scB$>$+I&!a|Ry9(EyVQ$c9h=V*y_1 z&@O0m3o!98CLQg>{0yJ!b(6uyuvHBWH`w%@fBtmzvB#%9cHK2?wBEX@{{`m?c}FQ^ z56w`Y^EUAOD#I4OT7RU`~7Hx=C^1G=hK*nOnbwB^R@uTM)Yziiq=GwTQL zzt7vWyn3k$)P?^_lO$_7!OR?c{?H01R#v~IJkMQq_IBFMqRlmnKmO^@>3BH>w!m>p ztpNrOIslFq^l=-02OHdT&-in?`tr+C|Fh3ZYc9WBdg9TCZM-{mDqBcw_oBzKm4eZL z9(uy@nBV^)ouS$L`fIGNmFWd`cB-h7^_DuOA84|Yj5fv%1vrqF5E7Abk}+mw<6Q>o zD8my;(MFc6s-tWM@#YfnEjoTQLe((TvE7BE>5}y#ZdT#$&3z8|Z94LhgVLtbhubAz zKAA(k0=~JRD3O3DtBcOk8{`2U#!i>q=QxwX7^_L3+~#i+uDoo@{ac(rcWknQ;Rz^-9VH4TX4sMhKqJ^4pi}t;mFtJlGmnPbM`_7Y|e)<_@Mu~3z zlvsRElZgfCTmtcU7sPYUe8nN;;@8lr3^#~i=&^%NS3KT@8@nK|ik>ooz?QHhfGz-x zyAMA2Al-WF&FRsHW3|8E0sA=*o5t#L^UXF$d+fDq+H}*+(?u6vp5~or-gNG{XQj2* zSuK6=;rr>lbNZ*XwKC_XI_Pn2nhym4^i9{!(o_BUTmoVufF3d?Z66eeA9mwt3HnUm z0Pt;FEMV8o=hShVI`|n#u0!8(=dEd#)tB*3->IjZnReXqm%b*=4K==FpXP#+{t+uV z>JXfb9VjzC}NB`QO;t(9JgfD7SUjJ z!(D{j!F1OhxB5;*wx9m_=%eWiISOXUtOWl3>@#WAwbrt+{75sRz4qD9%FazL77G2I zNpK#@+`(Htx8HKJSB%{F@Udo(Y$R3XGP08Q8*jet^9|SE zK&$_cJYH5_dBya~%P*(5-+5d0WHT)Etdlw^h7x-INf^7O}<|J&&MB4Q%^Z{y6et6YxLFEpQmMnA867Fc8bX-_ZIbE{&IENa`R24tFuVAx~7E}Sv0-({<~?b ztv0j0nRS*~D>!3=tEpfOk+RSa;|=F^IO2&O?++ zWx4#j!w=Qcedcu5`Tf(M&pt1mb6)?n;z}!}ciw$Fb???)tG%neHFD*(*QIkWxG4SU z&u97>9Gu&;Pd}Z8%DA7?|Dv?o>TCEmXYk^P*a|%9)YH;6*WH*dy!49n+_TT7hyU@Q zw*()1?9ueg-F8nWo%ZMSFX8y=^Dol*7hjsrx!~foLk7)Coq-tFBmZ*c73tUe?Vrv#_X4M%^!pRj@qaieop<3S>9VV@ z^PoBP4=38#{plp(o^`f#-A%WpGtNFgEx*D_u7l%x?bTN`5MT4Q=cSill{VaXV>^&8 zk{L?(kB9!@8P@$8d~9)Y+w@hxm>Bcl*AT+y6K7HITIB96}fITyPaIs~~N(P(^%$_R87TQZ%<=%DsZRvtb zuS{27cYV6z+UwJF6vrI)31FTFf1F1>;$w$yPj*m7>& ze_Iocb1uBdTc>OOY&{P+=*5c;lDCU6(ri0jd(~CG>-5Gu@3!MT^{jK!{s$joM_6}~ zqpjP((Z~Njoqvf|rI%fvjyUFc&9>i@9M4QU@48#MTJ%mn{meA$9JBjI5XQ@gn#uqD z-h0y@rMp+COJB zH~)fZvdR0{VR9YkC$ViNmr}>l9JJphaT+7 zO&{qjz@&;$wopC!Qd8;S_>gK6t*&XtnP&3!w=>T zrHe1RJY9OpmA;#lZ8SP#Qt1V4=NfUZp54>!x8I&lIR4o5hZBx>8LqcsAKrWKec6UT zr#*kQTe|A9OVd?XT%P9ZJ6}5LxZ~4QazO05AamL*rhG)_(5cWxxj=O|Z(r%H{+&{~ z%A|p9SackxK=-jd9_@)X0*vKw^c~U_+yRcF4uI`z@IeZF zgnRC}H(hnr73sqM7f9CzrOBj|lTR_Z>Q0%iQQsYR!U^g2+ip+4{>?tr_DX9WEh^4G z_rmnozuub8Ik&$b@p$2d=hDe1otFM`^$qEP2ObfbPU%6}O~yAi4SR^oXO(vCwO6}e zFS+=N)W82_X}^6BOy`|esi`-V4&f2OW_vyX2a5LW=;HpP|8UZYe#jJou%zc2M@MEU!hqW22zlL&-`>xAk-+Rk zCR6b&NXL$yQ_tS);WO(RPJd{!0Q=F2P?O>C0G#fWo_X~a;~(Ey=S z5GF>lo0OfcQRuKbM7hDqmQnW}y;2tmn!C>^(_81P$k-TgL(5 zIM}}Ks97{kWUB)Mfuo|oC=ah*=|aofTdbO*Z3wOWLe%f606Tnee7ATV%K2WQE_`=AbzpMsua1fN`=26gEZk|H6WY-t46Me(Z`6F)n7a|)Jc;r^Z^|oY$M}I3GEPGWJCkG z%NCu21}Kpqx{b4Et8nmO@uyWIt1ZSv(PysdjcC$17ccP7Sn$eFxSNEROCP=->Kz00 zD*5IX_#HlSL~KKML+&HfcLTmjJtP-)SD4@+vymhD2z6)4u}Oxwk8$%19V-gx(+22v z>(MPcCLW3(8fogI(M_Ypv+Aq=*;1q3td`I>8tyd3&}sTPXogOqd+@>-qMpaZNOY2O z)nVsLWw~_2vyqQH{7~9tlTAD+W)}$Ospd*n8n>c9WC+i*4e;0@552<)@i%GjNnD4OJ9ov?R#`0B%Xn!86VEP6<1qyA`wJFoX!q{2 ztLiJ{4sCR>*QC8d?xHYg@DR0CV?zCg{vs15yL=CnYwNV%k29(Mu;GK{;Dd4Dca2Kd=n;5l(t_?#4jFTqpo{d8u>%cuApO`0 z5T>;TEl$S(@^j4^WRu(gI%viFSvp|cTb6RTEdc1J)si+C?xy-?1fW}A|AAGuDYLm_;LE> zuDhficiJg!ywOHdDjX6M7L}u2I^w|DzOy6JS(lDnZ&Rv`JYx-fv{9*|>vsZb0CGiw zi}YOg6)DRYy2uFf#d*=bT3_UVaRlfmgve=>Lxz!tVI{5BuNhB~S))9kXSx7s=!)s) zyf{<&JbidU~OLG-q*`h*uyqxaSsNYQ@ymBXUGU%+k>Q4aP>4+a0xwsLO!VICEC z9y!9JF)>7x%m(kkd8Z@F)|)mCX1t#rBL8HYR^hnFWdZXVc55baTp_Yu~^=0U`>fxllEv+<*$0R~Z^PTZr>(eQhkZ611&3a=4rF`=)nW>;c8rW(F2B^|+aX*_&UIs}@p}mE?iHJuq#w@kZ&CQ%;iNY8FiUgba+M zyfViCNdaJxK2iM`oScGKGJ}6%Rg!5@76l!p0b}LmRZ)@+JlkNyFNH0O=KV)9EwEf@ zx6^b)wz(LC*0Li(^0&O9192g6Jmch8rQ!1|znW}GR{*DVgITWH<%TQ3yWepbEd+_$ zq%z>;GzS`0`nn4B{;KOmODK7TuV%be@_bZ)wg)l&O+I<_op@Ct_X*QEbOZ54Uj?2b z&$@JRzH0E5jCwMCD)C;@gAX|@O_jIKy(=O4@J17y2dg($ ztFf|)F=Vxa7ui0)cFi(~F@`RB@&kCX#e?$GNW>^qhED!D5aW;!bQy}&sk234nQ2aL?G~K&4v=s z$yso2Ho81^C{NH8QZjpm=(Cyq_QD5dn4i^`aXs1IE}&gmI7e33`FC>XenZ%habb%-*7JMb%o zm2RnRL?z_pmZ6Q1u`58U#7hjC0CD}gy}69rqgV+)G87qcw6RnK9krg;LZnr>sh5cS ztbH|T$$3S}Eg(`EGmKNP*ug1=4tnCHBfP~ zQ7?E5H3X+3bb`Q6!xK?@jQpTRITCC`avJB9@}C(o)#w|F=!8iI+vPY_R=iwh^5j1X zDu`ptn1l%d;DPuLfN0uSLt98xix77+i4f>AD~4tbY=>}19JlUbl)b-92cYPp7Kqdd ztQ63HbD$Jw*2y$!Kyl*(`?_=p7m$4`a2p_aiem{dT*K}HR>y4T6<0?`=aZ}gWM>Ff zK;fvyuWG0aMS^AjGzY2_pq)BYlh8qG1s7aT8k7bP;{A9P!Ybi?{DA{~eI!b%B`75h zCp*9Lg>HDS4g4|)IG60XIpBuBUY}lh<>k0=t=SdjXbwjj!qzOt1Fmdflos+JO|$%w zy!UT_2Q*HRJ5Pz5WAUU~#)m;*Z=QFKnjiDU6o|YQP-!lCghG-mu3vIDZ`{@lv!p8c z7=W>~!7O16B4YvrADt>UN?8U9VOEI)%@GyDU@|#g)!DX!X{%5D&Q!&@R!A5d6pkFJ zkmS@!5Q+6k}i12(>ZBWj_o?(RHn={sRCnGo=TRfx$1|5RGt`uAAXICGVX(Xo&){KU&x{Y zYQEd0Ksxbe`7Objfe|{8qP?->p;b?pPU-7!zDjr8afja?)MxT|UXGh&;#ycd(h!qq z{^4Hq5lCP)hfEe}XXqbX>ks1;1}YeJVU@5f^0|hmLtzw=aWs$l+&?nln!1Sw&Wvji3@DUDWo=OD zU`{9-b$lwsY^QLQh%`UH=)tI#D9_iXg8e#VX@Rv0pzZ{|9LET9OZy5duWA|CkttVV zNS(X(Nb7B|QCet`MSN3<2wFZE8&=s(7#-DN>!EB5K+)SAYz=s}ruHdJ%FP(Q?Hl6} zwAogK4s8T5LZeg`M>vu}BRr!BqQOAgP<_G!@4T~fr(f>k_omV(I8Ee;Qye&OaGGJ3 znbU@wZkoRN>gzOGJRqao>kbwc*P9@UoE3z>$c*?>b0&$y>)N?%+H}jU(=^jf=NqCrB3rI=N$^7l z4Nr5=Gk@(hc<2v+{$Z~)Y#ll&bRMkXa4q+@(Sj^XVokVGbJ_14wsj*KXz84i%YPELb9jZ<9s&>a{UEe5%+ z%8e#$yLCeM!HRxTR{;?rXXp_~$1%9UMl4i1&>r;C?P>&)AJr&K8#rMC=$nre7(38o z%a$9By36Tx(|BdelRieTSOl3dQ2%GJJ%K; z9AOCi;rkTeLHV832=Mwlg^YP$f&q;XiMnaPMJFQRCZSIn?Ker=WrUTXaA!9Ntw77_%}?rF)e3q!O@}FN z<3PtM&Rvh($w=phLXsMkNBTLJ4(Y^`PDwleayJit@)Ke!Anj+l(jqoh7%*syD<+w;;1zJ^fTCK zlim_Y0TukadHj?>^MGnKwTWw>;N5)dZG9(g73$S7rmaJro_-1NX3Nz&&|lmQ=I!=8D=jRbCT;@k5&}$rI=rsBhHiT6p*r>^C$?#32fyYi)Wg<|7T9gd%F(*WR z?bN~GH2&-!lpq}HThp(lM0;2P@`r=K@zFMH8LK`|N+m!~lCw;aM~#;25?34CX7K7< z@xlvj;{;yg@exJH$7?CjZp)KXj>z6Z4!Z`oOpLt+DkkDOJ`$ylN`P1gk9!kR4t+HvoEz|t7WctI6K(T`dXz>Og~L=l8x zflK5ZP(Ujolce}G%<$n_si^14W?=A=;}up}#V;#e>t{dn^KO2WLBPs}TY~+eN+}Pk zKemdh#t*~67X+#^W>z5s+d<9;D#p z#oTP0e4#SmeEp>d62hefw*~X!>O&6PKV5mrCB8Ku$HL2Bc_}duQ=3#pCIB+z#Q?lD z{>!hv@Xak~ac3#NZ%B~W874k?sW=1LgHD3sfqC#Vv*Q8m&p!Q3vXk7jiiZL(7U2Dp zw3qiDuBN`@-KmpIGMV*)Pn&%9rDUyk&?Y|f!XTqfT=@3{NaYwn-+c3J`t-BU{cg(< zyj?{Nfd+lR>)Jkpj@rTYDLV*k+41EL=zEf+()1KK=||o=Lq3kIDvhR5(h(jeS6g`4 z8=bKZi4k7EgbW)wRPZ7Xa8kdlmYB@(?n`vQd8+TU%pWiAWgD9IfCIjHJ{11olhruy zSv~TQ-=<>^Kg_p-qa(a*cuX#&&*~?12bu6vXmA>YziHSAe*%j9@4ku8T2bB>OUQTx z#=8Hd`r|A5BfbdFYUEp;Gq!kD9sP-}(k9bUo*#G6n6?h99CH6mx<6#N9JJ804b3}N zc~G4fBBRfUvD|nC9q%}xT!@dYiVgvp41UDk0xov>4DDEOfB%}#wdro$6y8tH=*UA$|r~15TfIGK&*xomWm|v(N z?Vv^VaCFE|(xCAW=G=W0Z3MGxsVKPZFf%?+Y-qpeO1eIpj>`ra1962S!H_(Glxk=W zl%RPW14=zYl|U;%5fGHnhAJ(gTHPShh{tn|jIYy18*Oy-V~;(YdiL(EcBmoBVBR2I z2tjZzrNlWPRL>YNv`Y6~L`vg9(!GDPU%KMbi_`QoPM>=9nj}5_#6SI95znddfc8^Q zKAE0+;)(RDJ@@jL7oK|Z2|xG80ONg*>u<234LuL#k~aGsv->64Z@=+|4ciJUuadUe zZpXC9B8zwh$-5i5MVBv)^NzcZbv{&%Z{bB3NsBJNgulfGzjQdtPUkMa(#mP-X{Sj` zEwgmmc(ct#XN14O$Fn)SYKO0J@3_k@{!9mNj=>1hHoh&!`!Tow#V`EXkJn#&)rOPj zuy{w^YOAf`mt)T~(~N26S!OdnUN-Dm8v>WSQ06t(Tq||&)ywa|V=H2_&A0M*<9HaB z7v5rskTZb8;0xhfZoPHdV#}>0k2%x3Z@=wH0ox$}@qUXeoK{_B)%5H$&v>?qVdV29 zJT%NiW7ADGO*`$hv%h-r>MO7ME&DxsbWdAuwPkwd*=N%8&;2KDwaqqeCkF82k3LR( zF6tM%?3xyse}464@3hcD3#D_bmQypE3Uk=IvRz(KyQ zvbH{`d!{u+n=L{<33cB+cc*vXdQ0*docJ8oZhP#R`l=845(IC@xaNw>)3h^8msVeE zZ96pd4+qL~X}s)v=iPSm8~=Hm49_s~=9$@NpUt}xtF5`Fb(@FnF@oD}zeCz=tF63C z^UgbOxsT1aj*K5xJvgP}IEec?7Dm`cLdH`v#gO7ioM%18FygK-%#6XZ#*_WPSbG~$ z=fVr1`vk5Nf|Zh{m7N1N$(JZ>l$0HXd}OFOS!G}e>c%SEUb(t}PSswon6P8U6qU;L zyl!2)``JA|n>jSTf=~Ow#iJx{4@b4pI6WMKfAedZD5_wRcyd4t(M(VE;D@r5Q6U23 zkCmC9C*)i-J=Opf1PgVMCckbd1Vk^Kq>{wH+nq_WI{+|A=I&JZV@sPy(&$Gf6*Ycy zUz;f>1Q=I7HSd{|)}ioPEtwfIjIC}4inI*lf+`6?%c_ne9L0F~{<85&qX1v~!l=@( zijx!lhNy9TfrgIp-C9x#l!z4|FP5EYmYLJT4?UP3fAlfG-iHU-St*PSENlS=aN|w4 zNNcXWmRBsiEO*n*wz7lby>_Rbd6qv*bk7~PTPd!-{>HS@%B!aL-+eFrX21Q@W?OG# zqd~njWOR4kb5Gx%TxR((6Y7w**N-~3}{y_pOyZ+?0C#pnGp*lVu8DNQ@=46gUP<4#Qb9ehZ-@7{aT z-1GEJE6Krf?au>Bf5;Aba{Ku1zuw26a^i!SX9+)Lueti_w7!fp698@sDFBYmHrqnZ zbk=mqg%|oeY^R)dI^7ceBhhgoe#$;mq{ELm(w}YNy4*CvbIK{FdP1=9LJOz0)?PcE zbn;1Zo^zzDue!^1}b?ou}5(WLR?DETdHOV*4_{`8> z)n;A@e92YU_~BQ+0rsoCf0Hh|<}c}APdu64eB;e@R{#F#m%IJS&WpE3+;G=jX{n`` zmC?U6ExFwC>DIs9=j+JasM84Odsdcb_P;P4bok-vzPs;AJN#m2_c;!JhM8whzdQbf zw8w9LlWx87uW8={4@!?e^KUt@_0zp~-N>{D6_;I>_TB%$bkuPtc!D%syTPi@cY>-M=!yH?#zF;NIPo^Ah=o%i2$NT-3X+f8Xj*Y}yKqEu za!iJCbUd_P9A4R$gcr9BS~xk?_49sgbt=)-QN&@D{Kmc$)e6fH#p%5^GW93y=OV2$0w4K4tH(c-6Vv&X;8(VV` zG7gtF$@3YajW^lc+g;ROTmzEN=q$9zqB8tTreFPHr}VFXJ(+%g+%bOj5wDKw-Fp(x zV14(SaG^B3K$+RHFJ@POfyKA8p8NMR>F7fbO}E@|gH{UnYsS5s6_U@$@P&m#4%jE1 z`iI}ATW+~QGvqa-q@DfE!Xpp;Z94y)bJEtEZ|E;fue91~X|~yCml2V(-C?`*&qp6g z2krYCf6&)&1Q95I=kPy6lptMtaJucz%c+tk~iTW!0Y_}Addyj6h}F2;Yc#g|A+_gf%cstLrewEA0V zwN?GfGTuPM*5V-t?C)2-U3O7_>(F5b9+>XG_iyRs6Ho9CLeEJj^(*+c*l>gN!8`A! z>$Ktmcvm6Y?|grace6GhU3EYwxn2G^$>D;t&q|+u^ijI`uQ&L^!Hlybk2~J)Ts=@u z`2KtDNk<)Wi0fgbn8^Hc_dU{Y_uD7kaqG?LtTRqa*I#qBcNXXnUV+u6OQ&?^pH4}0 ztM8uEDt@C)H%*(ayLP(Z{Ik=qez|j+euf#-th3MIkKOV<&IkT}e>(BRqtj7G9`0AT zp~JV{a$~w(a{u+7yQXix`6_kk#?2fGa&%me;_grMgq(20`3X!xjI_W8h%bz^;{qqzbep`( zDT4E|O%Q%2e>ma71GbI3I(c^}Fl-nPee+BoTfSNl2nmiDcLAZWH41igIG}7Zl|~tK z(#BuKYx%|D$<}yVvkOj;dcv)M!wiNCUT8*L92)`oA}d^^UyO}J+;Ejwy9queMG^YT zH_pgrGnumUqrHq75yeRXLYsfHL{-_2PwlB=1ft}aKza!Q5i50Dt2Y4w)~jqZ3N0Wf zAyNrdyuvPc+-`t03Bnzrz?;N*DK)R3A`SU1rWF!K=1*swmG(X8w>HW+EtIREsRH;( zH!a~{8;?~ZcLH*!)!g&WV+DKSpO2^YHjvSI?>#Bx5P!yG@+qg11AErnRXh}G{K664 z7Ep~>fmdMhLC@)DnBF{c-EVT#XZ<=&^F0T!ws#siyD*z_0PqABvA6F_UHs4yD7H^0MQ< zX(fWZ`d@r`T3qt;otB}=K5`9emDScrx7~GbI_-=zeUlI}@p4>8w^&|{Z|?DFnPr!Y zy9{^MDug${bA5B!WtU5L-g$RA{q)n)=9_OWF^%?n7QNqJKxi-oyisP(x#o5f?_T7C ztGqXn4|g(XechMh`r%!EyukRjTW--x>NKqYFZNxoT<@A)hL+XZTW`PZ7c%pbT>1^; z!DAq7arTkyd36}C3uCp&pk%hq%fI`mKlm&X`iPNd8*`nXt?MuFvpvWw!FZqGV-G#- zYo~16WU2Yrpf>To%lN=?mvqvf&+_Mt4*T6P&c+dNt&?kXTqm1My2RaYe7}xQ-tbOE zKU*a{BeViwRes*3m#1?txilS;ag?`WOK{g+ccj^bYmvnl zGyi+;vtRn_ZFi=VwaVpj7``@t*<}}bQg+>qx2406I9h$%JN@Ume``{7b2{nd)6zNT zU6>YIVhOEMH8B!SbR`ThyE`M5&P@`rEl*!!deK80$*hn5Re9SI%SDLPKg}WfDN^B| za~JfVaUxr%XFUg0R9U%X6;xhhB1%UYV-k*R+!WV2PE`TENCyvb=jq6MhFR632fp#k z#^2TLFub*hJrmwY4$fS^5^`ot6y)%jSYrpm@iD2;IqAZOtco*=AR1Yov?BB>5ITjy z2VH29s4OHDf-XRt^sCPE1g2wob(|a@&R;kz0s2Yw=r!t;VA4U&Xrq-Sv<0f=$EV)J z2kS6`pfk8_*AIS5Mm|?wQ6gq5-R1N+S`kKSZlki@d-Y87&OcxJ-4TbSbIv+5opZ+N z>7?JEkXGYEkQ!`d>#+usE20Hw2^hK8UwOsXSeWVZF;c$8#!H#~mVTAtmV9@Vm}`=; zFhtB=1(u}xZT!i?>%<& z3z?C@1s9y>4?bSj|AMsHhU=yijyclb>0*$uVn#2UhQ|#Oq}g%^P&%9vt2MxmMA=7Z zMfdZqHurWhFXW!LZ(kc^fbw(AHCH-a&hebH&Pc!9d53iM)mM63G!Hq2I3nZ6AA8(i zn_hRl_59)2>#n6#xMPp=3UIp}w@c@pf4*jOvkSX6aqa1yQF+_5n z(ei73;k}3>(;t3+Vp?(8WztehEt9Uf{;z(F1NlQ@pd20jK{;<8sUB^Qtt`)>4K_*) zM8%Pn`BNIS*;>Uw^qQoXxBUE!ps;as1bxD!1$GQNHxdv_-W#{c7)DrI zFWL={IMH}b8{`3TkH1;yO_#JAJVKI^n}>ZyNBYpuRQy85ci(l_6IownF~ z!_@zxbJOm7{U-hKl+)CWqtl5e9Gy1bawCnoe(CIUFVw`duWyWMVtb4gA4Z@9Z$RP0 zvf?w#JytquHGPM{79U(;8a+yVtTVb{6m<<8Ny&_eUesKe#P|R2k)i#Km5RV1+og^YXhuS zSp{;3C@UR4W5cQgC1&={jVqo2sQp$d27qM9R|NQ)#7fI7?T^_mu9b5rJY+{FKBvU$ z^v*kP*Gg(YnnNopzla*kS5eBYox1p=zfVXWmt1m*Kf%ODGvSNXC|_n~yK9zNXSFk6 zs3MJcJ}K}Z6SiF6emidP;2Pq)@4n+z*Cv~6o{cV2LvAtH=`(I-;x5vqmRu}-_2n07 z9vRN3MH{|XTVt*Ck@O?(%2a;~0d$C4_WZ$v(s;EN6RMS0Tg`VW4wlaFEa-dhzMa1K z@=JfqZ$;(t1pwY|(@T>Mo;`f-KmYa$3_}BM_cBdVV8!#`{r9K2=b1OnJmbv1$%wl` zu@g<|lc*CW(^W(tgAr!|7z$SE3(KkVshaoSdpFH1zIv(M#Yq*Na?c3|aqAa-iIZ1f z@|h_5?$y^`@zyt!JM@k(ZM^#Oi)qD`R}-xcUhS{8)>>flO61?qJmqctMHXA!yA(LN z6;@bTxtajjaJj`cYTU&1w8}G)TxQu7(yMR2nm+mbW8YZCs|xx282xt2DJP_(k2~C7 z*`98O=~GwXXVCQJ2m8bS_jSpR+J9&vVFWoj%xgTQ-QgKf>#EbgawguU^7|-LyB#Ma&LpCY{kA4@g zfXQf66E6Y}UU>Z>va=lYhwR->#kodH3NJ3H^EYPjWbyw1(8C5AM4M#n)l-#6Q8yPv1u9(F|PGsP6?@(cT` z&SdG*3;O%6OYS1w|KNkuEOL}=A==4^MvaQjJ<}sFa5H_{$&B_=;p0xuLuL3kkYPPi ztES~wSkVssqVvy5tFOII+C#JVZMWYs9dg9)Qs4Rd%4ocl?z!hKe`%fv#Sc9AFs%v( zm<}r*&z9AG4-6R)R?0Yosi&Gco&2ZMeFxuZXP)J6>+xMMKU*YV7K#J@hgJxeUwL)f zeUH7ob%n}Fh4TOj1!N0_Rnd#jJ*PHzO8qaqFikNtM#Ol zPfowwZ8sfHb)Ubc3DCd){co)_u1x1@rMbgSJEh+pdwg1T_0|0r8F#(=9)l3qn2EFE zJ^tvU(w0BpKJBWu?jySEZMb1N<&S?5U)|Gv_uT8da*sUzM1Rekn^7Kl=pX6MTW<05 zlQxvJtJc|?JjkeX9r}iA|B_BU>#Vf3aR26j1Jl7r9qms*(fv3OWD&Z^fDc2YpD;Li zd+M@_E>eHbmkvDauyn*R$EsXRK&b0G=X8c{dj*89OR(N1R^aXV-+cS6?fY1^&0 zPpAI*Bs2 zYz3<$#u_s4HX3Cmn=sz$7iyABGYWb2hoc}49vN--F*sC? z^56oKyU%z9rlW&#zyUaNmdfEs!Gyy^eysX{VZ-J4*fmmNm!rNS)>XGbbuuCJr8qr1 zJjuUHzJ}-bvASN+gM$E=P%vKdaHO=tNi{Gn1y>ay2e(|6EF;O<^m76HJ`URSxDKeg zOxWO^m8{*aBGt*>TDEwc64i{Z=(da*(bb@dF zrWY&(9cd(=;lZK#+5&Qtk@1$N;>G#RE2Hr0%P)Jzj?u;}VC4Dk7mp4+^Yl|`0nK#z z&@7IOYlGa7!F7z<*My}X9XoeOFFg0}^yUYjrgP5xbGr7*EB*C$rer)LHvfVPrrET@ z8zega(&_?w&}S=;Z{+n`XpzLTbRTGS*1Pwl{!lDHr;TO{M~uxe_gr!mBmBWiuFLVj zHLIf+{_`Ijlxe1$HZ8QsVloQd{88T5Uwy^tLxv6U>W&AGf%ml{;lq-=or0I$F1gII z{v;G1TE(#9?5G@&R2wRrKgX4|~NN-x)&#H47a)*q;_!Vu_{9 z4<7{PlPR=|i}CbNl;qC9(SAMCLj4v_56EHmRy}{RMl1Ct7F)tArq^G8-CMZtzVoi% zOy93xKeh2A-!Qc3VvG4&CEt?!Oa^!Dwbu5H5?q_4O>@jXXL{_>M^ca8@fd+WZ`HAL z>f5)kSCl-K@Z=N!^xcW9K)(F^3r&hvPBYImvyJEDk3MQ%dC;Bj6tWw@qX6^voi}|b zhwEo2C5KrhRk92+A3FW#V~<$|%x33Xu%A~* z@A1J?>1zRQ>*jgQWtU$rO+VvI-d%Y0rI&njQJ=~Cq*-U1!{^M7r;`4I`?XhJ_G|sP z{>Hb|UVG(LPYxF7x1h?;Ze6F1tav~A-~*?R7~YiLc>UEhPv80M7~gv1P4i(Rr_LXt zl{1gCEV}68mIsf1(6>DD!^f1T*UEI!#TT>VeE#`=OP^=fs`nk=d;-tNggc2p{p92H z@h2Zdy>(a{O~CFQG`LG}D-hfvxVyU+_aZ?H6nEF)7Oc2ip%nKPcW8?{v}g+y`FPHI z-t%48{F7X}v$LC>$-O&s-@lL59}Aei+|7GA%_~3Lb#JS3_2&5L6DNl|IFn}K%m^Hs z^?rQFGPrK+dybd1{_g%9OidB!ezC1cqoRA0D>fzh5^he0o2nu9np)M%2h%*fIqj@s z;(fXL(RReAF~XIBm!g*Q>Ca3uPWO4Igt7w2)qty4&^07xd(_AtC}nkpocQ$s@3{9@ z1-NB*?6ZOzrB8gTzWPWrFYhL+1N)m+ah4Q34dH&%Us!>DB<{gaNt(?zo`K@sYaRj< z(pcn>@nhO3YLur6WFI)Qya+w8AdM>AF^VSDW=l!DlVu&>mGcl8V>>p&X+wKGw19|f z2ahCsm(JJmlQ>=tah0eSKzJL?xPJRajA>Ew1|i^ZDbGWyYA`?T6T;+sq;D})9FLGn z9@><_=@)8mC5ym&I0~JV?g$_y3M*yE%hwq1~b8~4n4m}e2Uq`>Iv8f^aw?~Y* z#|4E<9aYg^(LIGIHgRpYq$qX;T*jgGImT(eSzeWzNA9nWu14oA`oosY7fQ%88)^1P zh#^dr&eUN%+%`+1mQ(d(@M`L ziWklL<1rr)qOIHPs{SQ3zJ*gmvs>ysOM%?TfD{=Hg@%2?RDrKR?=n}*5<12sO9IXhy+G>UCOG^3KZq($Sy zI-&$GC@F@cLY*)A+&o}s$!nj@#M}dwHW%6?j6lZps~WEl@@8T>Sv4?Xtso;@j4cBh{s1ws&Q)hF7b*yc$SgOW1ev903owf8r&+ipXnk;dg z!t5+4oC%9dksn=VMAi8rr8ey+Ek2|1nNQVb&z`4<|K`>4v5czj&W^@=7 zoxs(u_g_$3g|3De-P3LNX`py`cv5$XuoSaByVMu4!WzDJ%<+wUcePF?2m(s`{W}P# zo zRyi2Jw}7z;r1tndigU!_5d_?GE@Wg}S*z6^7rDH3*?Rh7Sg5E9ij4pC0`o;3;!eQ? za9!_Iv~vVf1ktaUS95 zDOvvva`DaF=&*sMmr};_`Z&Q~WZ{EnGTinaFg13p9hMHp-EO}~lPthkjqjjrIjdad zNNW-tH&vYPm!zj&ew7bGO7k9F33PVUq7UFY+q z=F`}ec3onZT=@0hc6nBWCUbJbh;%YM-M<))YPRh;Xj+Ntm|e*T7vB@VqJ{>ZOwVK$ zu0;{&elFtAmv3I%k)ktlh5MPgWa5m362liqE)k}vEUXZtRnWk~v0iUfJs6uNcWURy zsC?vJlfo$45DR{awPQyr+vQ&3g9@-1`_!q4D3y82d?Zc)nq25@GC^lYj4dobuKBf`?Osus4iE(Qr6a5WF&HkC#_vNj4W3VY} z589f#AWB3YOR3l7C-J&mbIb=Q0%C#eU?r5UX36oHe-QC-E-TcmjnpQi2;KK1>U zR}i4ALT~)46xprvZ=!ir;JMPn!6`ElRN3&#y&QQs2^$fl?`+AzsKR}Fx8USdmO+8s zX(9HnJFb9Bmlz9xL;EXssAqJQHp#+(<;aC&+>gG}^9SD06zDQd^o7WUSst^6PALCe zO%f_9>tRt$_co*rH!fQ5t9xXsLi;)GIIlAbn7EHv?V?UACQ()yB7IlVI2&RiTG4YB z$(*2q8^kUaE?$Kk8)7TVQ>>VP2n+X62$m}(@HQIZA#GM0B3_yN;PZw$QPY?025fu8 zp|B?IcYtHP*$3~vI5B6lzPSEQg*GQzUW)A!Q% z+|05ePF0|y*Wkhc`VpCQT#dzKi3x^xz?^WF-8sLHUVpf}_5G#iS<5IEiDiQ2s1NQ3 zdDbE@QaGgBY~yQ7!d-fHUW0bsHF3r7;EkW<8?&^coCAmpe}r z)h3&a@P)L?=@|`^eH4Q;Tpo=C57bH?X{=e{QL0V^OHRtF-N4{eSln7yn!6c-yk_ER zv?L|!;kS*Rh zBn_!>OJaUdV>Mi%@SKw-@GSj`EWi@|Al2%g*fpJd)3wR?mHgAo8_{fh!HIQLjh8?H zL?CjCm~TH-y_o^PflL(Q?m~A94W)dld^mWQh!;e5Y1v6V+?jInfd(ntT3fV6PUQZP zWvbh?Vx{XfI(u2N{q6BjaX1|j$=1!$!E>xo}%F=0ZRpv+@VUb~Tm0*Ju^yv4YFJ9HefI4%m8jnLuaSlzz zjm{)y5K#x~6)Qi-UTZk>vzJ&h^ub#u6XWuzh=7|w@Vktzr|`V?#f&MQWuC7e%6xeC zazA5r4Fi9bdqjB{3VEgKhc5fEGY`Gqe^Xi*wpE^QqrO@5jf0#mFJtj32%xN5%!F&j%&T}FXY9rfz?g;Wb`~^zZcF5LY-9g<+CXGO zR4`}TvT5rcHSY^iiFf@OawPOOy?eJc;z2=q@puiwqO8e45J{LV#f+z?x30%k*VH&) zXnGr3+vC9>rQl@_VkDaSeb1OtzUF9`l~_>M~`~y~}A$gs7nMhSkgp*-q{dT9zGfSz48pae@8YEBF|S2=V{@5 ze$}oO2xWLBqThVi%(p~+B$8p1RXEWF26&<2T~IT4c{}oasyaFyz6vHxDz9u-r)gl0 zhJv~sp8GyG%qDgBDg1&t&>1jeJE*DrVnuu+-{_vR;DM>G*DG`wMpt z-m_!Xr4i3+Zz_+}2U0CqnW7tf!Ua+P&5j;^1(W!(udflHBTPoMfTl=OUOhSnS1MuWR zrcGL)62r!yBUu@TeP;Sz{fchvwkfB{dRN8}8rej_PbU`|(vJ6|wV}G;gpk&K1Mwd# zg%83BVJX!(8FeaxP4u5J!Ky3$xL|uTzYW1k-HfQP@jS)TNSWi1yIb`*lP21Co~7z) zVtGN&p<;{v$ahO(t82 z{4){IC$!3#MRvc;vJAcQB*0Eq6eg0q$%(>W4BNal8--U8 z%BA0#X`PHhs}|>ItuOdKXizGg`BH0?S3H#w`<2oSfu=MKq$gO1}wQ5V1 zXl+*w3Jjb`k);YJn-P`5=un%u*`$p*4Tg4YhHY|`OJVvdSf0Y7$uRsGUnW-4WOU{V z!FSMB@?ma>;eMU?)dO_rbbeOwbBV43L+sq4jb>N*7>kvgj4H8HZ4BJg-D88SGV zIggWnS|`h+u>{2jKa?+G70e~5WY2<@^{`Az>;2~Z=c|rgB^F}1g!wCYBvz-9sb;`} z0@wns>m_*~rTbI{5{C|vxBuFPddT>M-?jf7;H^7tWP+fW;DzaqypelRhF{20q;_5V zSO+e4_K$FU&NoP$MZ%%HI{}7qck;6-8 zLJdeFFbQ)`bDj&I_70|11B=xoBGt{G$b3aopR|_!MJ)sEqAjH2k+pfoIE-{Y&XNko zdIUiLcS}wR1-ps-NOpO>A9AV z$w|HyaO9R|6lFZE;I|0I+|T&~o`?;paR5p7vLye#5H`wJdL(6(n#&FuY{QSclGuO0 z*WGEu_0Rz#BsP(Vo)VM&YianR^mDinAUfp4*y3tVduhtEKI~S7V}^ggTn5k_fRgP& zQ|ms`nNq45?ekM1nZj(b5m^|=n~pN7pmdzYSiY1}AQgcSPYzq+E0qgbd4XHCL@Ggf)N3LQFlz|V5EsZ)IIt0PGHULeKUEnZEj6cqtpaaD zMogOb{UvmP7yF&EilHk3%+JDx&*B|VMWH?p4KzRYK^JwQGR$`ZzR$j1=WV$5KP~Qn zpQ2H(89Ax(UO6We6`(z(FV?B2%`;V%)!Y`=4#^0#q1X**UnB|<$YRl!s zvgTMn(iEXI+f1(Mfm*4;-soT+RwyulIm-VX`{m5#9?eP%E|{DB5`V!O!LTb+xRpQI4>GI&B}N(;&w#jPCX24GNE?VHMY1a30U`3 zL=g;q_8^c$V6vJWj?kHk$rCGcKO(FUX1k-+5Fb;O^~}!eoiAM*Y`jVJL8br@@8!W8F>69;)IB!K zvXbL15&?E=s7sB0z{*U6bGwm)-W|=rksq${L!GD)_d{CmGxm@e{Iu<%`vnWZ(O;c7 z%}=VI9pC@F5~2=&@pk(W9+IpSCD`?z&bBMy0B2XigqPNUqwpc|;U3&e)oDg-lPJt( zYZCq`3k!)^?BXLVPjNiTEJhb)XOk4PJ&>sxDFWF!I)Fv*g-*}m0EBhYwK_t(?juh% zd5ZL-m4W^$hA1m#-HoQ7nS!vBu~J{BMi}mgKeNdK!MGT|F=$CoCdjs+U615JCA`Mq z4(6kX$;%Fk#yh=eZxa=Zm<6jnRHCQWbA~xbl@6?T)_ zv&F!;)cxckUuX)V*uB0};pgE5=1)bHak*J_2Zh;c7vcVW$fa?l?$=70cMe!_2uxfh zg<6E@7qS9hH{{YnFu`321p=B*gnG3ea&3(D$n&%oh-dAQmVMNt6c{?O0yvK-vIqsa zIeUi;S1ki|M2K3kIz2d1y9)JWKzL-b?b3=QkrwTOqBbukSb_*m%d4fuHQJkC@;fC) z=aE(6c|dLWJI9PHVj>&%NUNXapL9w;YBTUdR}a3ekg-$fVYg#lSZZTL-pOVORL|nr zBzhf*iqoh%A}@xkK-I-mViHRkIm_GlX6-5AMyp9q(AtGvi!dWt(u4+f|8WIn&zDRu~YspL21&AMCQVOKY{P_u!{z z%T}#h6Di?a-!nB`5{lrT8|Y@jYLaAwDq-852(Kv7lD8eac5+EsFsK!0tp^hZYTLIOa^_`b%_U+(KNiAt!eN*ImGKVf|Q|WxOf^d#d(FwqU|fahp6{AVFhwx zGtTGOUD`V~&$z7`GTvw&xTT|kOpFOe8}HO5iY=kp2o3mqL*k}Z0zdFH(&<$3{Lcyo zJFYEwtwmtUEzW?Y?%7YArpl$CXKV@ zdu&wklZwymx`|V0=^F32$NTI=;=PSo){jTQ8b$RMW~i1XjW^o%2e`zehT0=0dzI6>m*~?GIp+J z2XE+M5hS1lVECVbK#9R=2o}eds`AHJ^jHzsUefMe+kni&&POl~r(^iWG<=q>3g;7q zJmJzBO*$+Ay9H?h#GEu3n*wf0C_JSo#3 z79Q&);Gp@$&kE(_JeuSI>W81xO;wWZ)HG*{6X~!-0-IU?BFp=LkeXX9)pyh!F+AA9 zr6^U7%{Y-5ZT@BZ{ZcO^aHbWTy~1qPhfk~=eZ{8Zv?OY%jVHc2i13;>C3 zCm`p@ZZ549Jr2fr5jzr|mwb}u5o#!!Cm2Tv`UsPC3OU^dN=wg+m~JAa_TMoiJ`-rY z&e@0qC^3r}gVb)yVR~B4?FOWWMkUb&4~ukda7)-0%=#F9Z$@6>^}ZKKh+={`N!GXR zxO#}Yoj4J)tzWMTd-8JY#2s6KMIY3oYA=M&TMlX~-B;nmyuJbVtFgo$s3Oa{+=d=C z&7f`^2ked{6U1h1>39`rtV8YGml50c(NjJM1tbx10f_<0zt|{=ue7$)JcrE|cE|*N zhK>I*?+Tr!@#u5x0k&#N7&7*fL1$YB=GQTp-Uu1Qi-mvX*!0yK-Zl%Q!v(H4449n6 z6YkeiHlDU%RiR|7=n5CGO;6S$xnB;$4+Z_P5RR!t6wDWQ?Ur4vJTCiM3*Ps57rO8H zoDvsr>_lgMGOrCNgj1bIbKU)EjTxUaz4)s)#6Kqhi57gDC}2Df5b4R4}R* zyl6n#6X7qRLl$aF10jU^&blJl!n9bm(8vxX91E9oq%@b|c&?aw`HHFE(jp9h?jY^s zE3!sEDn6iMyMYpBUf}O)7>d#?)B>%~E-;oZwr}(kqh~MBN)!{>*nCnC6)V4wBs`~W zWnU&JQW8z4SU#;-DE1kf_@GnGo;4ASCUe$WGt-@xdqT8CvOJd=Q-mr`DFaEq5ObVn zt)J7Osgmn9cViarGt!r*NvZ_=BK|q+M;8((C3GrIi1?MjM8uH%oI5)ah@N6tOmESh zr}G#k59q?7Bcpc>cUE36F-Q^6YqNhu*iNMR;0j1hk~Fkt`~+tWg34f}-QSLwAJWXkvh7{t;@Xd_mbNL$8CQ6LZ&6x@#rsR{hoV;qm*GKwhy#CF6rxQt*g;0o3U zxRv%Cfm6cN;$)_8IX?Fv8mwDg+6Nni@nD`0yDnzcvMEuLo7D94=|N;X1G5>|>_JX; zwCZ+_pOeS}c|)JZwiv5=kLHDX2cr0)8=pc$gGZnfp|6H;?&u+$22;b!_@U9%@leko zIWgG;NeZGTgf@$D8AFH(9&1He{E`eT-gjx84t$7wm47G*yjW-;=Y>;ZLX$@v(LhsG zcqXyltdF_)g~ZVqc<#%1_*!{B5p9BiWaKsCF0vZ_b;OT9(&5la=szaBTZZnq=0i?Z zH0~lX{|E~drD$X#<`g0V##JrMbqhqhC~Y#ke6DgPtY!U&w~%2%8wP45v@tb&clROA zk!zZlsvwsN6{dOOQ}CYL&?cLnzvd&zW)^E+?-svc`Gb0YU_{b7)ykD0wPp}f-+WL9 zZ&wIhd3u#ioRUH;4cFphwQgblN9clREQmK)HPh!OM@QfzC0(XC0BLL((D?=13M+KX zgM{1yz%onV@s6&app4ai0@26w$q2rGj~w=DsR)<}joigF@1gf0(}8i`OJ$h1W$1PPexSGTb1bV(P*-VI=|@kC-nFrx%>T8E zU}8V~O?1E93GE=7GzD@Qtti5$%wTlX zAhdCGSLEID;w^0%L6p;o8)Xrzpar>)J+WkqJXYFrx%(#mMBNPYQRT6cL>T%$;__5cc(d1GV-6Ug`|{uc)_7ZWTUp;9_1F*rEUo;uhzK$TE? zGrWRCQ2=%|{m-nZQQ}c_{c;;jAFx*t<2C7Q&v*)&omSQ;@n90_yPJSW9tg5DSWP?q z08e2AgDuvqwz#$#!>Z|GnIzGN&ZbMLS!Ql$$$gl|W`H5Nzptpv<3Q8i2qpDHm)v58EMU9k$t_WE}gJY{5$Y24vd_5&RsWoQu?AElE1JOy@zO66Y?OXSC z#s*F&;X}mqxw_e@*XW0cKcK|v5(hN68(H(Gm#s^GtBl?vNr?6;&oxGFPc^Q?MV$5l z(-Ek$Kc9g;ag>~jF9|&ZnloX^B8-t|llZarsMxgDX@?mGh;7brFYlpo6B%wD*)@W? z+I_CCFv$l&*0kkB6AD1Ip5hZRWKxB_gSI4&+N9D;q94@WFiYZ-$ejL=0;fTxXlHau zK}o?hs-TI~O^#6p@PFFiFHlP?-g#8Oni)mH)-#QK zBMfZxE|E2r&;QJ?c%hIRC>&bk@aPvKe*?##XA(a#PVwQ-gBz7mpB-l_tjJ7M=~Z2A zU^%0hpp=mViPCp5 zTRmixT4@I%!e2x6O0}!BRlSkT03i)5Q#)j2YtlJ;vRc1F5&1(Cr zz}UdOOf&THG!D)*E1w#APR09AW%WBpXWw@y9S%DUs;nKB2u-sbrg+dg3#+hV4ZrN* z?e_cNg&P*RF+7nzd@ZBqjAhkB1X?gKF1p=j^9$V231=M z2>L=e&edZIHyjz9?wa%HiNqEDrw#N%<)B(^s!WI1@pi0a62GEtzKbbldK)(BRqR~l z@u9%>;$OJB;q9zY`@(w~RnA_ksOAQoC<2Udjr)%j&sEvC>mnR)6=IbCeyV&+E~~Cq z+T}gCi@r0GLcu*fXS`l>HJkV+G(T(J*On%1(NSjn>k54tI)_yCcoJL?loU2!0A&xm zR(atEc&7Q4=`8W@FanlrzKT^PXL?%I*CWV9DNj_8IFq@eBf#Gw<><&^Gn&uWhOJR^ zI3u;4QOH!E@Ndh;5#Pz)pY|b0XL7)_%H|>Sr&@Tm$VU)e9s}_nx`Aj5j{@poIs;j7 z;9A~X|E%!j^xN1XWsFK7a{QQZ77aPIw?=#oxZxhRH;4lpo_t|VSqe5|v9KGU-j(w% zq5JssJ^2a*7BphTE06RqpF9lc6@H~i_kZ@Y!Hk`6i}MndL9JUKlB50UsQLRih3xZH zU`8Bjz>3>;lb=D8F7w;~9gAN=I)D8U6#DixZERuZ>}=00hBl7?UufV$z-;rVl)*w( zN>C-t7`RTs_IBT+vs#4Bgc0?aHZs9wxYPQVYQW?dc_AWrE05qCg2qsm0nM*)tix)O zvG4Ds6-xk@TP!#AI7#yusiXo7Fbmo-Ei_Oy!8-u!oG&1IgQ@ofc?@}SLYg}+{!pP+ zYE*fOm>5ivZjGjaGUph9lOc8}H2$ zze{w(+_M+KN15uah62^w^B8M!H!l%BBHCAH39e_@i8@q1c6X;s(7c=Xp4yGduc;d& ze_c=f)6vcB^0SPc?BgG1VX;0Blm>koi7B4*rL+#y-(<4%Y!ay+T1ghzwiTyUft&8M zc_fXVEaD1y8WbVqDg>6>mJZ=5XazAEomeQTs8YuY`zFz>zHpPqa@ox5%b0MM6$Mn} z9QH&JE{9J>6O@K%Rb!)}YHg!Z0($w%RWjRGAEbyYB7$4y;(hs=KqP_=8nRA1DSl`r z-`p^n@k`aPNZf`j+lNpbI~HJ8W0mQTr%L>+tbFN(_G1Gyc1pwyR^(n}s5lI+L;tM1;mtqCV1RLqC;H zAL+i`^?e`hEv<)ztVk@d0Fepd=zh1d9?#t{!IFRK(bU*`h1E&9pQ&OALSBJ3w(NO% zJ3fd`G2X^7RJs z)*A|34i{P(V%4yeir#h{4HtE|htqszAR0KXmlcrwTYCiSSeuBGFir49$pd(vV>-Af zA_iZ1C$8VHw4V~-h~oy+8%oQA+#!siW2k{|waMC6Aep~v3c{6ccgd+0nMFZL@1^&M zYI{EY`Nk>VhEQ5}Fb85_toQLrKavmEKoocWo-=;bAR{gd&-Z91nzv}>gH z1TgKIR`9bUd1MBbdG$(QZh9ZdfndXAtT9g4(UwKOl#CsVM}i!IylxYIu&Q% zS^C^zp^yD5=bpt&ClgFGi4R6r5gFAjJlsqFBOZ35G`r_*J!OCxLAp5SCRt3T_=nVn?^kO+dOV(-EP zP-)oYZRG@XCjdMKIkVgnlf1G?($U(n)5I|hHdS}`qNMv+i2Pj{>jdZTRrR9j(=a!4 zKjIunEB^W;Seq9$$n40YRtP&@and#j5u|NnCog+Y*_C)Vt3#8|AiTo3N}yEf*06OA zP~p3do*oWotq@`6fXgdi>R!@MAcPX$GF0%#p*<82pjqVYO>_FA{)Une|lsEZ>z2!s;s` zltD73FWlqt0ST2l!Uw+|GE)8Q@Ou9J^JRZK+>c`6iLc@-2ggMRLd^ z+Uavd{v6zT$>T~jM2u_^;-K8^@UU7W#|=`?cC~*TX^q<#VIYiJeMtyg#`Dzfq<9Wo zlqxT}a^`6BBI#EOW7T1_K~;0Zf@`ptB>|x%3OmfmyFBm0cF1*a$B-5U^SGY)F-D8Lmwz|w!MA&VO;1kAjIW2q5Uw6?CF+ggXgHb4+CO?y zTiD@>yV)a=Mf_s6xyDcAEFE|3_>)Of%Xb!LP(_AoGvpi2aJWkRoy0Dx|1Zk;rT)Yc z0_!Z+Gs36~i>YS)7!xSc1B4WetU`zoPdSFXDFk2Yde1M$;$+rh*KS%fF->=WdA5DL&ElhELp;>+$;8ytEw*1y+yV2Ha(KP(3CrMUR znAhf=tmzmHuj_&{=H68k?7q5r1p~&elCS2(g#oY1ptqxZ4FS~+?FJ+Z!OPoFIarcv zAMY;y5=MInwNg3HN@c@rKUC0|r5na~8P)40`=uXv3OD4Ol9%fEpvjFC%(DMPL)5N& zhWg%Knbq33YEz_$Eb}B`IyB7U5K=+|HiNEx)`Ji0p9TSLQZ+16wNlJGk8M|&hwrNk zHl5b)_YqwIMEkGAbIlZq`^MMIOcqaP(KgxtQ-)G->$W;p17tU$!|J}Shy|O6#r_+7 zje{P3jEO)reDhAK^^*TntgOQ=9LCJO-~H=J>K8@BuZQ&g25$D*|G%1W5ybG^>LC5i zC>`>rhK{GrzK${fQ(iJcy@r2mBM+Uoi}wBBZ|`VO3fAtVo<8RI9<>jao@8tM=0FIPczL|`-c1rZX#EZB$t>#q@CrNd zoQwoQEqvGPKHjE;JTi#C61{~hT|-@df7(sHd98I12DtbM9m2k^`=3k4qXs=3OMHGc zLp5ugz5*6>H+zG0XNttVe&t-eBFZabr~|;oPn(DajK9D9HJ8YT^m}E~1l?#${0r_! zK6nK;*4KXv#>(*+CHpTpY!CNnr)lhc_^>L8#Qk0dPZ6Kp{@?8wnuFH=xv-=Eot*;u zuJEfzzw#CL%{e7@{jJ)x)9v`_@22LAi6%wbK&*)=SyhO1pQqt-Rz+m{@YQcl)%l`oeO`xw)Qn7 zF!+8yPutcGLu2ce6{pGdU$s7plTX!=d&%0g^m_JJt zMO?w&Pz^u}Lz0BFJ)kA(edv4sETL;sOS>4Cst7TR*_0c$AoW5W+^*L&%ZOjQylbTv z)tESYv9gK|RTc&3*%rZ0=1#K5?mK5j@Yers(u)wnVA#80ka|Zkw*)9?E7QaT%;maSB&JWYVhiynE#l7^kymftYbaY6PN4YZFrjbvI1=@C!@VHIjL2*bh1t%7}MMi%KzL9jZ>qrf%Y`pfcU}Bp|68gD{nzuv(QF)upsPRDlt}g9kjx~lT)_=bC4!RM` z7IKqU#Oyah4bRIF()S{VAg@W8PRQ~EQ$Blr_esr1+>|yX#jXKVid8s?Wt7~9&NX|A z1@l*8$NU&gh)b?zLAHr=HUAi;*P%o1YMDALy=|KyTFTlSV zqg%*s^ICp&JYSbfcsl3|xB*(+_wGW;>~jXDW1h>{afr>VvZRkP-)>5!aW%5b z)OW_gJk-oj!|hfo9zc2kXxyL{c|5cM^TuP8$%3Y`f^zZNU;i40UO4XN3TPBim_zZo zw0=dV#1ZBRvVub<2Mrne`(IsC z558!1j{QHz{o7z(afV^MAYVT)P8P#-E5257C_`CDj!{3ZpUOs>&uiEASRZ38)+ffv zosh{?7%)Y-`0jsL*q}=FKrErmH680$^6FYwv#)tVB>D~;>6#tdIYXzV5LmbYsx!rQMrg3c|O01SOz(N+5vi-K3^pnkU z(Pa2=WjxVRKb6JB7TB|+Z<2_uLe>Z zT-K2ow+rT({U;xWG|{1fiT<4L@j$J+zM+MJYqq;(#lcr`_A6QIh#-s({`b!#oYfAE zKZOP6jlZPDv<^U8+b0r>Pd|XP?SB`vjzp#nfULHl><}pfBM=iMMRcoSqj^z9L?>fv zO!MG`6}NG2>Sz}IM&v6Fyya^%Ga{Z3K@zv1y#)||kriF2_v z&oVJrTlql}@)h1Slc6{OibdB?#f|O4Q$0vs3l&B`jYk2=Cu3!VS!>l4U!s1xtw89f z^2YXMlYukBYn<~Z3wx_&kd@=(nV z!LDEEeK(9^88{r1^n6EYK-W8Xv6E;9@)3LAU9E~|yBW?3P zNhB!_;&-&{-fj%JjETN)a;1Vsj?i^P;y7KTN;|FD8L)0%|7*pby91zNMBJw+Qfum} z^SNpi-a$u*4Og3*gO>hRT7~pG6bGkwtoxQN@~8j4_Yf{OlNdN|zIxa8Zh5sF6Wv1Voa^1$YIL_Ll6*Z1z>AdLokq zk8o4Wo$xBB`u*P+upG2LBDu=wO+nt>sf~a|9GCI#d|>?5(@3x~MID-Bomj+N13I!y zSgqhah}-0tssuN|KX|>x8rmR@duFfFBC-W_L6{zYc$G5eWY-7};A+5&X&)#`O;20A%P|D4b*a9y$ zJa;Diy_QSOH!RKUDE3oupI?~znepaN%NLrx)bHmzbULNauSJ|PAksHfNHr4CS!XNNn3az$El+9d3fmK(PDP1?3b9BxU7JQh zwVL9{R7XD{S;c?@giWpBG|y{|+{m~~RYdh8 zhSHx<{cxIf8^?PDE3B1gmf&j4;3M(4i!q)&H}Z&8i6y7jDqX#v6NM5Yt6HD0jy%+q z>7)+&C!OLRV^1{*PybvD?Kmd>`X16~;V+_=L8M=&x;pxi>)UJhkaihn znllj`M!$vw)-rC2_+5mwSOGr#K2Q^e zLm~YLp&r-@N3tC|&n}QVHq_9FdaLFQGrq3{s;q{6TcVXN;csusqUcNW*U4Y`+uetU z&SC;0iZGz7CF{O=v(3CMzCv(Gc z)`}tdf6M@2!x&l1!ykbOYEz`q`pIyI~TJxJ;U$&)lGN z&%>-$KeRfTW;nt~UNq?ONCRk|c!L{kaFY19t+xAF6P??lSxym%c1Fs1l5-9M z4qTS#v`C8QcUwVib?1)kZ<2Ob2QLu{P%AmhX{nX;{S6{Mxqdb9fa2dJn9K<*B2IdQ zhwc$mHNbsM1WN%z*3x6i=I6!=Mu18%65CAfKG|&#)yYR~oB~4F0uP;0EW=c&MOtL{ zXPrxvai=D^3<}i!b|UXve(MsXIW3gu+AzHrSU;{7!8+nD>k7fj-PUtlC~^W?#Jh4c znRY5~7bl9aYiCEyw&6Kmsa8gFlrwZ7N;lpY-af{v#XCfwUd=BrRG?xK65|wfqhtl) zky6MkR}OnJBh(zbTw8k#QH6wv`YS#afE6VSbaE?6`^|$&X$*~o@fhyJWts?5HTb}= zXQ^QQ7Mi%YG?x>5(8v9eEG#}f<@%a6F|q(VZPk7^;U`2m-+CbhZ@Qr%h7e0^fY~4H z>GEZ81FcsME}5;(gdkF8$H8)lF&iEDtR2r#@DGul|2qyr!5WrQ{2rw)mHX1NC)zmU zJcO@MEx~e~kepTN2l-R$yHowvd8qR^b4S>*O{NSJtTVAx(wQq)plp)sfxnryZT+TR zr9P6Emi!fHC3yBZju8|a`i4fuT*Eo$5-{=2I^!|EE+2)IRceBumrKusA0vw1BlMa8 z*D_X!Vm)`}pr-@p)kRr%&fP0TV|1{~@J)qzP3;q(*gWxMGYW4a-Dv>?HQFUBKdkn^ zmIl`U2c+N?X%JXfq_7)5P};*w2&{5ID&~V+5GrH^h*Zd+TKfjS6{+Q1++sg;hzW1y zGsnySSO8iGrfiz7PVsOUK`dsH@mbNI?Yh@(i9$iH228eg+LJG$$54EogU_KMI{esP z!!tx&$tqwhZK8Iq)Okb51j)I?s&gxuQaaST+9p2-TkK-y#xs0P7yD`v)+p?qrlwl! zq?%Sus5&Z#Y~)D9KCM889QIE}u{MFw^FovJ4KzL2>u=l8UAUZ+lS-;xWdt_{71p-K zn^4RE{8IhF+g?GV7Y6Pw*8dM@K$yS02mcYq1#Kwue*mx@NM~H(`;8oGwv~cIwx#7f zrt}IXpW}_dtD$;v1*(q;ti6gc#1Y~2*y?Q3s?XbDD!~eDG!93{SpShOoW4M#qd4S- z8B?({$xcQ2VT{QOqg+-WzW$^@Jsehtjylp<=v4l^1{UkF3Je_lhBAv2>hfor3aoMn zl-J7At3RwENOYhq{&*BE$!*4Qg%bvIv?GoI#JEn@5jo{#O4!)uz@UNz2Z{(~#8r?w z1@i<2hyW%S1Dp2JZ{F%05qtPdUYJB6Kli2M9ekaSRiE#g)nCU^k{38Y=n0Pi+%?9V zolJC~wc`r>SPlyG5$9Eo-4ASaD>1jQ9lj4puKI5Vp?@LwiKi)LWR=j8tDHu%2PL+F z(I0_)k}(mSH3C;vXf6Ny!i2{6!=bdaE#dod-w0Eyfu9Osr6N&%E?ZR((m2?`h>!FY zDI8T)h!FYB0LP#}epyKkA2v+RPlnSDL-jjJMU+QTyfBLGpo9)em)(@o#}+1m?Mzl@ z7+LNj?bHd})QPX2H?g7|G2Gjh7-`%N(7_wMj@CGaGyXdX7u?`-M{(z-&O2$v!p$%u zWjx&F$yTTDR!|+B0CRf`{%G;#>u`$WKh39Ph||h$+_b_~sDRVz&~c>BZ7o$wQFx&Q z-B3!BR)BN|c+celFq1yP0Jh3w9drcFi|t^q*tz;g|8O%!9Y&9iE$482^pmPd5FHUD zjpJYP^@^QP8cCS2+>bYmN!?7hhFp$oWXzIz{DEtH!?V#0jaC61ilaCZ;qwY3oGFR} za9+EHM_C20)N=0zD(JB)iJLFXn=%Nd6WL~qQv%gVwus4)k*7t}DUKE*@ayUsmz^f( z(qxiq>CE_@A?iwl2cHWl$uRWJ?(*Yl|ZB}*Kr)~pSpd=5}9i)5U@M4=Ai)92N+ zTn41}%7Fn?v*|zwt-8m{`@pZOdSN(YcdqC(=OLE+D;9ya78*vI z7^wLkZeoqlI){b-)=Nwnpg*u6W1}aXW@5`BrvRbz5uczSoJC81T2LC?)-VwOK?$HH zmy*x3bu|k*+R1D4Tvq^BAuZxnsGO+|{3BiJm9m74wssC=(&nE~&c_G5 znyX2Im2Jp0fOwq83R}ipla!I%{i;4RIrwGbqOxpb+VLrazN4>LO(QmNu!5%?=@eoW zZW)0|Nre;o!I3%}5vout{5?WLXf;DXO9`!)2@R*0>O`nf0GW7xmlJ&;O@YZlt(p>O zKg}ymYz(Es*g_^|AWm9Ktm6{o*tz(xLTR2@L}sY1xz>+W&AgXF96A57pwKY~V+kt9 zenSUOE7!DKNTYW&+kRrk4#}3D zRTc(2m@UKK7&|Iey~_$=*s$Sg*zjSoS`Z<&zl_%!AY7eeMaT1EB$sP%Uj2y?9HSkd zsbemQi-?>K4$6-kIA1|46t+>pKT_v@EP~BO<;S3?^XZ@;)-deN`!NjBq}}0w!mOoH z+yE0i_`0KTvht%_tiU|L&x%jT+%DB8lPrGK68-YW5$YvG34`%K+lN|GDOHUdC`UpL zrOx<3{rN^Dz&S`_126h}lqVpJ&Unr-0z!kfCo3ZE85h|NW3-aI1WqasvPTy zz)L)0^eUjEET)}fX21`C%Msy7107BZH%UyqQB~<47Xl28+oraHr6V`QsE}LAwJjVT zjexJLrO1QpSKbbkc7og6v^vG81N@dyjkN_@E8QA~@x$I6+=g21kXcz#lTQCog8t(n zcAn>>PB_V2Ux7cb4m;Dg+}xsk$;eX08X2*r>NpYxztcp^D|dlY1GW38%*Y&61g^|7 z1;1~gK8TF01QBXxZAeonWdO(d0Z9v>OoQYq(5`|CAnt0kw;Gy9TY+kY)ze9;J$R(p)9)lNz@%cXM*XNt5c^uyIGG@0`peY&6+mqi(05F7UH_(1D(C1;xmYm`T=@ z*dfyeFsN*bI?j&@dMlHXnPveS{wS)W%5WYf9m=+6;EXi*@m-5*26Q27($>%hV4VL8 z5Q1<&3s}V!M>w)6zq!S$vzV;dL54syK;`s!p#UpB2?KeQy86#TqFhO%Ku)&sz{62_ zWH>;{)qKXW1fY~^OK1pHWHl%W*<#XOw^_h}Z1Xv8i2aJ@U`!RXRrKvJzEC=_8k$2< zEra67+WN>b4y{1RX&rZCC|FwyW9mc|>eR3@g({bGR97c?*hJu`HHeB)u*82-P)7E+ zLantqw1lzCb9|s!Z>ZueOwNxA;QTao;z%NP-UaXgGLn9^7@g!)IXzj$QB7JYsC>Nj zL&dmbl5{yuUn6vTl*2y-1mQq)f>wte@)W-+Dw<0eJ$j`1u(Q>tzu|bt+IkV)e5C_r-VwwaQS=n?WJaEQkWvk_fJmnJf96HbYj67^EfQk!|+o z>F8v~8qWVE@L*Laytfu6CN%3X5*h-!*DU0&#r~jzY-}|Kv<$o@j0-@7j9S*K2Ck*I zRZid`P)933>VYCB6NP`0!`2BP-x4VJKMypz5s=uUa8YEkVl#E1;z?C4ks9a7khXT?uNu<9}4j!DC|sdC~avJip<6p8r5wX zN(1O6>NJ8IbdHJqK&9mpzWbSeYlm5FqM@z=F6ZDPFX{3l4b4fDqqPxK3jP*iZFC88byjusZ@I=t{Tf<|(jg>x21KPe5YVG=0%WV-y;Hz3J3uR%in4^K z(=uYCb!@@__zKQ(g#g;ZG@u3Kgj)NJbxbJq+5%OTX=|Mc2V=CbjWF>!ogg5#%{k3h zpdWF7aW^+1(#C9`6B_{K#unNF1vkeMs`WWC;p8ul&77dY7O|q2Nsv*Mmkl`13!~8f+Hw$8OoN zC|+2sv8wdwGMp6#R^`bQUO#4__F`Pgr5vu&>jC|9?yWNs;F@5~@d?7YRv^w##sKhwYiuDVYTgXV=NVKPaU!BBQuGKunOqrEA;%g6bt#Yo;x4CE zUVnU`bwGug@e2Q=AR!}X%Q_3(&kZ^-v2WB1XhF;N*EHh?0`!WuH3~qXRmw#zOdLaw z@x)_W9_q?wEEyWHNFMCB2DLg+7+Yv7G^*PoAamOuofh6F62#}}6oChZ@u*H3&M;!> zN+I0W9b_z7Au5m69Q-nJ707NRPp5~+5g=6p&POJOy=$&U`wo@7eWp&t0Qh_X(=cJxkQWlCBJ!Ua~NCRe;w2wuD|(RqyVyHWYD?tF|?0P zwu2%`j%UO$p2uubIkq+9%lj;hag0Pd^0#{c{YJFMl z)UkE&_yP)-=Re6DJ3DGM5*ie*m#-%V1@)X__LM;o1VXn2+xQp=%H(1+(%T@DXyns3-j0@UY?xzXrA2}XR z8Z1MSa4I+>$(dE0T1THYH8rK-BSv@?PcKlO8nqRpPFNlCO+G)w?o1^cZQ!7PaH4+w z9lF45DW}J?o74$f@hUW}r@#S!VkmTr@2D&W;?MLm0>4ocq@&ab_S&xrqry(1jNSJ&}2^*TV?Y!wQ4z<(5dmzBu}ozr_vSXhB^V~eln>D;}e zI`jkJ*V|>s=j#aS1M0{_xg1^N8=_dzsXlREkEOcof>(H6?Q!>LlW&T`xiPWws!xBu z+gB{Y6WgM!6Di}BC_Jg0-7x(R{(Q7Dv=*p<<8#|}gr7zMsMe|CXqgUxQgM>l3@yoZ zWC1uoprfx{I4VGEsTsA~;eQb5%iN74)wfI`rSGvnBn|=M1V74_zVr!pqro^g> zY8=`D{n*W8xWEuRal)8|HWy!6^h`uxd3@1MM zIo=?rYle1$go-5QJrNe)2XuS#Zy_`X3GJa^OD5c2aEsWc*k!_45r%TS(o;T;52NSR zAlNt9?KrSD1-84)KqYR!Do#+~L<9$;ap525ecg>g^Mt}7aih|L4qU}mZU>}dR`A$# zKXM>i9%txuWF}+HmFwfN3@!UF%`y6NeQc>=MU-owdNE`WeJYcv`zY#J98yXiG zoNi}~fl*Yw))GkNblZXPARRGY@<`|xXF-S~;xQHO-V7%aD==TPt$Jl_`Dc9oh}MrY zP?r-O(bQ3QT0cGk@@h~ad~lx5x6@&4^>I5&APzJ%MIEK%aTw|cwLw*b7YSsGHlj_K z1mBTBQKd6D%*5KkEwy=pgUvVT{sMZJl`U2a8|bgH11ACu4x)yb6FMIYEz_r?M$r>% zfNf#xwDqMXkOF?Tsw;VzWE;ef5!mb?1!pumxfe(p88puN{YDR;!3P<4@L_BiXnisV@W9FbR9LdF88$i(kCk8Dmb4M9Zu&iRT3QmO^Db@DR_4`ou^LFHLnyhbRJ4iP~yA zW(wC1sjQTO#pSp=lr-~?mWR$7vT8NXBxBn=I3`pHDpUc-02HQAHZ7K+fqJ-%0QV{D z)HuUJ+=s{NB5WayYJ7-p8yHu%O@IiK;AVmO>6l5rIc_=hggyb3&183s6Fwfwc8p7%2ctJJWoC-OJ<5@h>bKTFYK#eI|oxI5h2d8pwaKRzb2u_dx z=i_XV>x$mal;gDn6_}0#iKqX_;s|4EkRMM__&uW07x5J_b*9-h<>7lFXJeAa<#6&1 zH;AGX2Pv<;V+Y0Qiant3fpJd0l41}np3wS)sX^@`vt;3|`>{%;Pz{d&O0pDk43Fh? z-L*j@#<~D0Xgy6|3XoD|KCL8X{;;xPI9{h421K0%5oIDsnZb5H0EOnKpXAH*0|C;8 z-kdZo3k0caYKfPFNOP5C&Q&lWTi$L&;$iuTO?TB7+j@>=*$MAVil7f$^)`eY6T|Wo zr9kdq7+N+4Ck6WJUmvVArl8G$IAxsa1OB&ffzRwy8v@@5Bgk#AHn5luQvGmtQS*0T zGVmm5^vu~Av&IUQvq85wA7<%PS>RCyt@_A=)}zO=k5EHHJ`;SV)7$D~EFsOUN@%?G z=y4;1+N>I3#flGkpo=;*ZBQ9`p4E(c-P0%KpTsuQc|$%;di#(%isMvq$d-wG*OyER zjED#-A1>sz0oMmVeu+;C?n4Vm`VegLi6G2mK+D7A+aAc)2jyKYe^}Wt*y3KLs#n8_ zAY~@3b1yUXCbWIj?l zOUh5Ib+#PU{?Pm}h<^JuJ{qRp|AF@}zxTcGDCh1!Pvahyyt+t>raZ?qz?5R_niZkq z{<|O1#o6in9>kGSciTK%d;#sH_szp(qRN%D0B z`i&}7W7R}G|1FUm-^`2{ib{NNGCrv>-#AgRgHt|pA;%M*q>EnU6UYtt?3_2(VV0MoXR0yI=&!Fy^RLc z?JhU%Ne5C2Z@rnGp)L{x&xxU@qE%Y&2c%tNOWO>L;TB3bDf@|rB*#AI-4Jklt1w!v ztz=JA!c6inHAiPoFAJSrKJHEwu*NV7O(LSlAIJ|aFO*#i4@u6pC1}G`x&PpSa?8zc zDO0z8;MV2$yyu-||Ni~aFN_<;M#wcfk8w4+2`Iwbp9;NN5Mn&@nqE9#Ru5eLumFHJ zKpxx(Gj9i0fvQ&yO7!ZJ6DFWMkDZU=j0X>}+ksFdO4pL|IhI+;n>Jxe$5%%+iF1m(!ALAWV@5Qe)*e~MgI5CQ$wZfLDq5hv7zehYK|M^a83{) z0bA;7Lr%`!le}y*F5&zn0NbC0*d1S!5iqYj;hjn@?IvT(GuD17SyBxH%JjPwTP;(X zywpS&=wRB*GL{CKn&40*gl$Q5y?gY<^4zB@djvWjk;J1cpxG=7RC*01LL$^ z8)EWr)cLgsEt|wvmZRmii(XgmIrn-^p+{Z31DglS)4R+5hrd#;x#OS380M~0AM~7` z4rK;C&i2#s*`X=UYOXyIc)ly%#-XvrSgOq9NneCSD%&cEsra|+# zaY*7+eEm+&2lj-%u1lSIZ}+qY(z1A2hf~4v65{w&U%4Q_agPX1#t@)o+!ov+Fd+#XCGxUUoVKY zSE@qfMUs$lJf89}OeuqiBF7EuL@;Kut_Oz5In8m!w%pPYg*&*}SeB0pbK4Uf56z_v z{G7KhWog*@@--xo0zi2-Di~LVV4DW#=evY3z~qI+lJg6*(@ZV$^by4ltOn@N&MttM zbzjGX;stMYE-1lZ#>iOX{^}zlZfNm}kCh@z7}$!AF<`8?Q16?&7@Jmm;hHo>pr_np zOcv8d5wW68R)qK}^P{35r_Cq`S#eLashFK?)P}eFD8$K`79r>h?NgO<;)qd0pgpfL zo7rZ0dl^H3Oc+NmSapVU0gh9=K}cEY4sjeg;V3-if#L9YkHPk!9}j>$j2)Qr56Z{{ z*n!Q1wtX<5^zq;!!JXMy>Bp-+XAV>rV^$Sj4Q4|%o*^rYSeexEuXOrx=xa`xkw(BB z7z@%XCnVOO^(ejKz?4s##~Jt|+C~1IfiWPT)seNVa-C_S_pVlaT;t1nL8CJGn=4z` zoRu<8N-7Sm`P8wp^B|-h#c3fZ^dT#TePVzgAL?_`Wce$&1vN)VIbcfWmc>wB6|DJ9 z*#%K=0OYy+!tF|G+Cgk;!C&7{Uj?<_#McQ`FbCP@B)9`79@Mekf#Vl^QXO`ujufjl za0p2ZTgJgTDlIzeHTU@eC- zD*KTKm$55f8ziei6~P~*7}9=>YkO?>0us#*iWIUD_k;Z~+bFDsM~JfnJFo+r46-I1 ziLE27Z4ufaBjjzb%*O%Z3?0P~ijxcx294*;_=j)^+|VS!bJ zXjF(fHMQbld{1@2koNTFw3GT##AP}bS$W~ytTDw|>7iRz*Ler0)@_Pcoz^koU7cR> zX-rrs#R@N0N;uMGIj<$&row86eAV$kJE&bd0p&GsZ&9wN17l}?s;@YH0x=T_;-?2B zxsGhd>(MW(J zfWvLgQz6xGxwM^fCiQ68fDxsc7NQ2)gX8M$ZUyvo)5AeYQo44(+fuI=C+syOZSlt8 zD0WPgI_Gxa)PQO+b7lxINH$6u3)qh zM$OTa2T(vYwE9gW?o~)+<&X4XqbX#4R8>xf zy#ehJ*6mJM1+g2aRruj};;|Rv$Vxn%Ck$(i29mw072y-yppE)$t-5XJsnmT4J-A#U zZyJJG^e&tx$Q`HVl=aO^^^jFazk-tb3Nni*>5-82XiKsrtwWW$FDh+#5Fy`14Vnn7 zlCK-6UeP*rW-r`cpjG(}%VXgFoz}e*AdiAwD zQKNny#GdJPx#K=Cqc#qB}B7#k*yX8}Kn z%4G5B#{@(lj*9-M9#QjDNEF$H@JY_dPntQze-n}>KirYXm9U?*kV14~`p}(EzS#0~ zyI=&)CXAdRV8si16d9u=PCMEVQqdnuEKP{xE*gCSa`OOgo6B*nFs}8KE)k6+43@12 zHxXh$Ph6N+2Oga-WiIaS_VIgIY4XE>42PuiG1wlT5wKSJHq6V3Jtq0q;s6(x%2{W0 z%a`Bvm&$cdJzEa2UNYNaz?@7D!_JIqC%vsD>x8l576n!wSRL+2O`=L30& zSV~Qo*amX4g*B+}gaohD>Jiy~cdEBEeGMu~xuY|-kry;Cr8OCRXsP4>(34(C`vxPB zn~F3}b|@zo>)h8d? z2ZrxN1UZ$xyE^3qfBWik@4K%r|KsPLRlf8K&n|cUlk3XW7oRByq6x-aXXS*0Oy?y> z^yG7Qm*s!;!crbO8ji^mvI6m=wN9;j!I`^){*cm1pEP#99AL^LpE{I1ru^?8DL-<_ zKG!{sx|Bh~3YGF~!^fn6@UYSk&&ej0^7JR1R?e8!0R;UvzzQ2P7GyB{6vt5xke`4} zkYPw;4)_j38E$Xasl(njBVWAuBoJ%nrph?~KbZk%5dClUyy}-#8~L0(pf?;==u2+O zWl<|@PR&ef#TR#Vnhu922WY34#QO2IHjM$zu#(EM+;(+_`D+Yo7(@~DWM=X(Le6kq zuO?N;&+I|sdPLw&0w)x1h?GO>z(;d}RaUq?dRgT*h{jV%p=4+Jz^*A*N8m$$Es-3$ z*@FDAB(-drHv$IBLX-d+OEgbK2Iw0SP9}JOPXzH%Y=HLU2Q+cYb$V-n$)kDy{?|OM zJoUUi<;lPD+47vX{%Lu}FMp=I}PPwDR|U?G zZC1zS>wf6M@|G80T&{o0zE~aNGZel`ZT-SaE-BBwcwd~5a|X@S*#@vlnHUCFeWcR? z+PGk}$if&YrmT28g14P>4RAsIl@Zs6RgKpYqM=?sTul;)TkbP;GD7W}tvI@p4$zci)$A$PN5pSEKXXUG0WG>@FB|BKF zJe^Z5qnHe;5!k4c9iD-4hNth66e5#;RDuj42Tl5Kk|amvYH&-cA6w~B0zIE-tp=V8 z3ag&n6iMO=J(E}snz3h91reGJp?E8(-EUAL_7GY^qBV?miRee)CP^q7cekc{Ah~eJ z%yAK?vp%(e4zJYA4y*$fmde>@?J6(7YJYkChi@;BJ#e^`U2PR&G)FFJApLois0(@3P_({J-xXE(Z_I*D0>?kpp}ApF6+&o1eU@ zeEZ=e<%Q2Yulxl$!n^EDp+8c-r}!0Gk-hatpHjZ|$Xt2$T;{P&7=)kble=xcWvUGSfIYDi)pHTH>Pyp8-_?rSH7!Ld3H=y&zv;a zsmO|3L!#&U-i%g!@N_P;VxKvHw?1vrSs8{y3}=H=5DhoY$eP!xG!#gJYQaXlS&<{7 zI4jTp=csz#q7^v+KOUJNO;u>9=XeXftw<5F(3V27KtmI$^S}+LUFGA%_=)`i$t^u_ ztuO=)w{9AH9U{S-RJH+9l0Z5$>?FZRDiSh~h6g|B3I{mI2e5YOSEV~O08Qi=5IeCoN>}fofIO0C^;18S;>~vr|6CN8zHZ zQ(lAeMwE?KHMpuWHy`hz45Q8}B+6{Wf@9@Z<0mDcdiB{`bXAY&K=F8pJyv}Bk^M$* ztd=q8qD3{*wXenD__|$Hrk=Q}+^a#H0nPy(3#rCgV7xaohTZu>{)|&pl1TZYqck3F zH<{bRhfFiB9u!gIfpBnK%cESmAO@e8QFE;kr^g5I6lfsi^1n9dW8SqSYCv2oP+&(~ zR=sDfH)`UI3PCGbY^C{JaTxUyzxKZUf%S(-zYDA`nlz* z3-^`__sy0wwHo}eoZ+1xdP(`}FFm*X*RR}L{v}%8s z=xGzDTV|%pE}fJ=`$=b%+un6u`NnVEP=4yVCzjjpdAMA3+1YO5&Ijg7Ib*im{h(H} z0&mG~6Xa}N8*oG?CSXvjk%FnWee|(m(vk0Zr=Qq%oAP$vf($&P%F2*4cb-+_T%ODf zN5S~g69l9`J0wNDRjki^KEUp0BxOXT8~!$ma!)ta!C~;P46ODz!LX5~wj5hHElwh0 zaT#J1Z0!%BwPjDw8XNr|_b;y7)_ zz4{&Vg#<_LRjm5wom9%nub6C_5D-CKfQd*+c%V0Ar!PXbVQI(war8>~dSm4iz2Xyq zUVP;_r93iMzW@EB<$H94 z=cWu9XbiJ2a;nF%D#Tod(Fh<+>;c7XisKXL>)=oh^rMF8iw_1f@9abeHtLj6F7yo1 z7lZFrwN`yzG2_@OH_`?Sul21mO?bbsTw`HJWj5Km+844-30U=tQm!c+R4$@E4p{t5 z8}*Sp<2X^*Q)FLTvzvM+v}+-$8tyx@4cV;cKPksUR7Rs-4pBppLxld<+&H1S@vp0_w~CTE(Z?H zmAAj*DW#mXt6X{Q1?6o&^Nh0l%x*c%QcZB_<@;naro8y`aW%hGe(Z;zSe|>$x#d6p z$#+<&m0c?2+8c1C=%M+E=Uh-um!tfg9?GsNguYdK^{4C#(z5KHB<62=J`QD@DzQ^XvtN#22US0m{SN(ul_!-}5 ze#@bA(@i)2@@GEt>9Tk4X*FvC$fJ40k?oa-&jfVvH=T)D<8=#JN@BCwRx$_inU+>< zAW8aH3FS95#P|mSX}4n=%t2vucN~Ibw~Q$t9jl!aL`=Hq$Qfw4(QI{c)>X;8s_}jy z#$7s4v?GVt05Jd3t^M-09R`&orXT}NB0pBDgvg@yT_^I4I>6aca64j1J)D0?jTWF&(12+4OKVV}Q{?Ngf<)(T04gXH zSAadO!_WulwlNB8g(3Wa^|IR-q%biCf#eMnGV?}sU|lez{bs8`8c9+7AB#YXt`9Zd zEbGm#snm}Q=CG=RSQk>mSd7L+iM?3vJL_5Hkv$hloH^xDFd=A?ef-bvD_@n-@(1563!=YQ4)a5=xvHG4 z@|!<;M|tj(&n&<6*PmK0+P_Du%*FC=#ryD)#qt+_;Oz40+aD}<9Mnoqj_{sG<~>n= z^R-u&(`Kj2hyLh0<->pao$}oy3+4B|c%b~97hGKa!AmbG zAN%sba`5m%`K)N~I(Q_uXV(hT-E!L8{pE2FevX93O8Q-);;Hi3;X~zzo^w6_XE98re8-TfQH3$LL4^U)$5*ENJlKMh%&k+Ba-;nO>BEkx`dH=e1lINt^(3 zFKd;Eu}TNHyu_W2l2d$bz?GW@{CI)(F~W7Yxa~a*FUnW%Y*g9yBTZl98fZ8^Ot4pG z#MLpsB}c$&FCJ&;8DdW0rt3+-G)_vD%tr<2oqR4M69Vx7c5E})r%1mEc9`VpXR+=t zs;SUD#$2?1N2vNkUsC0a7rph1vF&J8N7dP`jdG#i&P_xG-07me!-0d)wgl2-*g)`g z3se#9GA9exBMwg-+zB8pQU$6uWzn?%ELUwHFKb$EwsM>9Din?|I)3hOiIV^g)O1(r zDgOOF1!O!#t2R()st}zTAQOp)cdgJ9qYp-8pL)+7L_Y ziFrdPn{fZZd&@01zjbSlr!dS_xe7S*#t=AknIu6N0Z!2GnUwPV-bw~RUkq(nkDv`x zDO48Msk|WvZ z!NJ$^XfKH&RNV6DD@4_He2J(c$#-A}HWP3t7wj$N@u!z^p>UrZS)P62n6xr0Pf$KI zd*wu!h#+)NRQ_3VJk3ET!0A9sowHSDyQ^}XVAA8T&Z{(!Q+WPqkq0g9wVf3P89vCD zj+FBAYkm0O_yDd&ULao3($0RBt;g}TfWt3C7JfDjgrE!cQ;Dh+n+q6g5TnH}%CrHO z(L*;rTStIK2vgZ$FU<2kQ0idlwVJ3aN3-#VC`J$qlX;cVaR5k?GJ5;hGKQQu59GGv zQvnW~Kce+bCs=oMW*WugYd+|q+hxTYTYC)+{H0GGMn|PyVS{p_aaXAFaYiD7o;)T5 ze5+7Spl;f6KAC)l%-e=unS5NJ9KT4q0&TmJ@}c3CW0C4%xVz|g!~-1GM4KL@z;XSU zpWBW}>zxI1J;N)5K8XJGcnM5S`;tJJz9tPM0Sytyzmbd<++IJ__B@vrQb$NMuqJlk zB!@ci6X7PpYHUZ9ZIpf#-7uJhAFvjl69UI8Xx2IojW!xWmnfnyvCW5Sq}YaET8ubX zNqthGkNb+@5%RKT8$@|UoPb}iRSh_{h!qcl`Z+j#;08U2_};2he3SLJZa^w*CkEb$ znvR6z#2Jw%xfkbI>CP)2e@(=7JYSP@f7m9~M|z3tR`CxFRJJDU5ugZ2XK1~-Cc4wF zM&8@QY&k2BlL@vReLYTfoTRm?M-$cg!ImE7@U<*cgvb*z&@mo=h&q%jbRvLQBDD53 zC<7b<6!#`%5cxbv?Rx?v1ATHkI(bNbL%{L{p<>jR4&kLNj}0gWJm!%6%#dn^CgLV~ zsTw1w=&5X$nHV9|4xD7bI8Ta95GKqHY!~>jZb8^HY)GVgwq}FC@UrWkfKBv!9A#s< zCe@)SwTdAR0)CV)Lu{dBc;Xt)wC{FY(29shA>hl3hgBnno$FuF_%?ZrJx)^{8r6~Q zo^B|dr_1mqcHH!U8&9MVR&eNnM;R9KQ4cyOA-y8O@xeruafWPj@(&FlHv@&9;2$@! zfbixTt6zVH4prUH`Kc`&V%$gra$>!qFH*!Dq0a}CrAmo?#Q>4s1897zG`|gn48V-xLVb5MY}jXin0-d~ifx8EA}+&X7Hy zWQ?+ue4jx}EDSeJa7j+kIbK9$LzXo6>r8 z4aGwSD6#4M=brVeN^I298)cbCoU9O6zJ-KtU^HlpqFPMYo(^WDhO93+HRSL6Z$k5> z5&=X}85xFx=&Z*Y&xmVDYuSDP`Db#if>Zzx90`rYR@+K2 zPe&w!B1wgOZ5UpA{owu+(h08RRcDRkwsiRoqRg2p6cOUmP%x-|!lzc!Q2;krg@p zY#DL~FYC|^lBSF}c`*mp1u3R5Iq!g!?}>y)DtK}zZ3Pi;YpP94d?T>V5zxe*UOHO7 zeCZp@f%9Le1N0GP?u_Qt3+!1>t_ z3S%DqM4Tvbx_7q>h~4%uF|A7Zn;sd+_Ai8F{&y#!LDC>co#uVb=L#pt)lfCmViB zX4!Ftv~RsZt9lxX_(ufflrx1~acI2|;szSY$ar!sk+GS^gThlEdTYn$nyQcr&CqQH zI!Po!W%kV?W<~EJr8OJWmQs?-Ck4v3To52ri?@MvHlPS{ah2K>Gkwqvcb%uR6c= z&jwA_T*1YpifcnQZWt^X+q@A2TEAhW&Q(mgR}rGapt7Qi*V^DDWa@3@G2l_b|7NZa zM#nda2yC30^UyegJml9TA2|U3DXeRRlyForVl?4q0&SSD4#tp?t=qV{#mBY!$&0^n zCV(I7P}(=J*zw8Tsfbc|P#>Q70_%)Esn4teIfyupf|J>V-i6Tm+M!C(MLy%k_NPp@ z^R10~7fm`x6d3jRh&LxB}PNmRi}feR!j zlZo+))+$g8m{|q#DnI&y-l&)PwlxOlHehm4eFFg=8}T+M=o|q=1n6H0-WfU?QrbSL zCx=uNNW5RYQUAWQv-S9QT(LeVUBMYG}CBJQ0Hq-Qy;4&>O}UR*DBSMbL z#3=i2LAIF$eiH};$`5;lVWNWOwTv&TMBmO&T?~}B#RMwDWV?n1qCV-!OUT0@ZOUdJ z7VXw>zLu98cW_$zAaeugN;u`a594}fJlX*h4(#y}j)xy_!&Ro{fD&s6CmVKU(RYwi z>%Eo(uIE_fG!oQ^IUtXeKRjVO~v5WgBGI%Wtne8lcEPMl#DPHnvVA9EP3wO zK&=%_Dv+OzQQgdHS|R>@Slw0?W75;t1jlM&uOPG9;{5*HtYu|+u{0wPQ`(mZID7*oXOn$d|8-Vu$+{jEq>7( z<*afzDPSv?>q?;~<)JJ>_1*ubuKHf#3OTW`Bh~80_Cn>}Hl~UlY_v_a_)DQ&pV8Z1 zkBQO#5~~<=MH|$!sIfwX7uUbSaRbz15J_pQ{i!^uM^QFYvomWb*wOV?X@r*79V3g{ zI_u)6MMoX-NV{&Nk^~Rtplv_%ffW93D^_R~$_+V-aP$0Z~#L zCk=3b#{dQTfIk-6-5y{Jk85O_hw0r?^0irGy$$7AeKH5SI8E3ZsL}RDOiccX%1;d)#aK05^2punM=8suB9knJa zOupa8DE{7h6C$v$Y4I$e(9RP%Z0+N~5xI{c+VBg8Epx^{fM8)MK3CbqgOR}n4zLHgz`RVIwead7BT31z!| zuOO9Rm2DpNH(E>(C48zJ)bq&*{SoRLGK;^Zu|WzxP~$TE5f8d#2DO->AS3T73c99mwRIEz_tRDYa4*03XEfk@lV8BQbx*_)9I}M+MWn( zn=0n@CmU)z8;m7pA;e_vIwry_!#R1yqwF;Bc36Od_!od`xP|#pvF}(EZSYVA#u2d< zXT`JN#~^f&s8JhEe<-fMuC!I4{@_56pSID7(ErCLryU14%0L!LjYmOW%7>o5#x=ew zvqXiIv~{UItK-%IdZxPjCzhCCy2dskZK7wY#ItvzkuQZ`f~pwW+Ccw)=$l3vG<_Kt zKO#|O#R2+6r`7>Nw-u|*Z35aD$Ql7qNPbOpb2TG@WTNYFX-#=%CgGe8xgwDWWSBi2 z4}+%y2}qM=^qbBxhmbKIg$T%2kbJwL-F9kVcyEq#sPk$Nef`x&gw$pL+Sx2#CpjDg zH8G#tM{TtRLOxpu?KVe33V>e1AcX->l(nprR^>KQA-2o~#5VNg+qhAO+w-|2$Je@M ze3zqn=>rK4q1)~HeU`pMPlgzS%qq)LVCt#W>~XT~s& zYEd#G3$HBWWz~2^uW%)gHDd82%@!wp^efHi656Wr(`Pv6R&sN)P}?#P2q}ja)+vkY zOW)qQtmM#`r&B%fc5#)_A60OBv`uC5t4_W8qg?fvID~GOA*yMRb|_yBs@4=i2I?uU zw&Dg9D3FUhlM9@wbhb2zwR{4A61Jh~9+*pAF?;+N9D!R<-<#>AkP_!t?1z;(>w*yt zq}1)=0g^Ssu-cPwTx07kQUdxB)iMaf-fRUh z*M+2@Xpk21_Zw-Cvd~MfMh_jd0Yn6H^`XW~N#Bh!*2odC>^` zxB;fy!2#BHTB?j4RU72mhMlR>T>s;)QXCK3^Yd7+vZb$GmEQEo22~(s6X|j2K_fyKJWh(Rv@3!WHizs6?Y+RB+1@JC zr{mfxm!Y+B*|pm%AGSDg02my1wj<-Al_V>t<>@8g2-BU7_gnG^gjZAo zZa0rDRVhhEa=}}TA>Z^8cTMV?elf01*>L&NYFjzf7av7qHM=_C)VS70bsUg)s3kIT zc*Q3f=7sc~+ilsuwm#H9-pay&a!oU?YqC0nD>@2C2QL)L4X@sMWb0IXxpvAsP`M*i zYevgq-lB;U191^EHcNdSud`_W(DP@x05$mf2fYbtj_&xGKuRc=+>8k~3&l7{r^r;> z^0i6HiW8)+n(_T0JYMAxKEjnMCC3dY%5_5IuKE#^xTz_wA6mtXne_ouS8b{w`Vr0- zJ>&M!MZ}|(HfG)+FgrDS)joQRJ}$yvp;x`qA**()S8~vzZ=kU(k%!W_%oshPE%Bqw zEz%!|2!{Y9?jK_x#14&BtkpO=oS_DkXSg59Eml8CpTsICk-Ve)| zfXGM%YDN8sQ;%mfq18!3t?KG4Q1qTKfn+iMKEV=y>rW({RCDAS26eD1@&iyma4?o-MN2ii@-5SUsqY>S8>*(=%n)?5wYM zQI|Ht3y2m@B4z$Mhpkar7YukuE5uGW?;MR4q#Y1-5rC>XlDHcbLq>gQ;TLD^ZmB}8 zpf4wv6i)`UhoY%VrI3aG@*-{?X<#*LpdV1E-0amUJ9?apJ1BXi6Gp%v(Rra79#EsJ zJe8wQo>hdKn`HK(bA_-mtvNUd@PGwhPAF*4I-psI_*Q*HJ&a8NLj_>?S&>r>gHI@K z)@!Z;YpVgKi)ixdl~Ng`bxRQa6g>~vBNbortpjn$HnK02V=iqLm3H6AtU!!*340hu z)GUX9U8eP@P{`^TUE9G@uO1zI{6-w>OnGgFWHkWCssuw{VL!mbLW;Zl6Is57E2J+T zv)cCtheF60TyjPPCiE!uQJ-;urlD>1D@H{P;I-U1jp6W^KRJiQ8F`|n5bY96UcxHB zhpl2yetz1({8S~{gTHMAOoFR>!tvI}V-?JLAyJJ}KuAM_724>I3%3CJ*pi^FV=U7E z47TF&1lwsu+9IHxY{PMNJ?*omRG{+F2+M$=3N3pQQPENxn4*JN< zYd`6{Fz`shVd4pEiQ=Hh*Km285gH~k+&G(-LjY#vxOUBU%dEFC;X!rPSMM4g_27UP zLcoJ%knj9a87mq7?VW3dA#=20C&5RVy_;Z^M+Y&oio}^KoTCjwj9s(Bm;jI=`Fe{^ zb$!>V|C0~hMV_UpJZ&%pJd(jyrya6@Vkq55rO<;q;?*AdCf|Chw2)bRhap3hgaKm4 zI3#Km4YF8RcXKs5S5sfBReHm|iKa9*=%9sB=sX65twwKmsxr-B>?vRjpiL(mx{jJqnvSF(ZdQpnPQu%t)tFPw zJC0H4HsN5^p(X`x3AI22_~4uJjXYlYtHdWbFf=daDO8s0Lg5&4(*T*G6^m$#q!5|> z_y@Vl45Qowx1@T^x&+7IgG}ZG3{*5g8OWy(8ghh&86rxH62e`wuB_22bIKkEPB0K6 zbY<3)ppJ!eC?A0yzlG&9^V&|%h{6wG7* zfecrJRp?Yq&n+20A!0i^kf@+~y{u@X_Id)Clx|}%*ox;2SkpwpW=8&I11y_1HT->Z xnKbzj@~cFY#&|@m1&y*PZ6>YfcN{0B{C^Ko8m)aV3s3+6002ovPDHLkV1n!GdP@KR literal 0 HcmV?d00001 diff --git a/education/windows/images/get-the-app.PNG b/education/windows/images/get-the-app.PNG new file mode 100644 index 0000000000000000000000000000000000000000..0692ae6f7ffdbd3e357a301c7a5de06e522b0531 GIT binary patch literal 129831 zcmV()K;OTKP)Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!~g&e!~vBn4jTXf|D{PpK~#8N)V&9w zokh|AKgn(B2_b|oO~8WEQJNqfK|oPKL;*z+6cm+LQB)KgMWtClX)1_{ih!b`A_`bg zQ4j^BcS!Hat^e=mJG~h!`pS{t_Qrc0}|;yI(mY$yKOzjTjLlMvgR=5LAx% z(3(MfCXnT8sljK@2MiQy`8zO>a!ZgrQsMJi-TyCOXqzn?o=!DQ^^H)xKjTs{M=W*( z2*rM6Jx;B;d0alE3Cdy>lHw4cIn|WTElq2)90Ik*X9F(RUwcd|l@*g=Fw`=YqgtN$ z$QUVs`3yW4h7CnA<+rNFfTEr$+slMXeXtxW2Cee{H(-#|D+usDSn=5uO+JU?7|ZPM zmrsMmyI_t%VZ=V0PfipgPQmi~>sxm9VXAc7+j`8=2R9|0T^z`;9F2%wjd15I2Ns9oj zIw?TXh-iyGee8IUsEsrRI1PZN-!J;2)Yc)=Bcs1hCL@nEqP;!ZIy+)ydk%)+53N9| zu9c{Uj8w zxnG~Y-u`HlEa=UHy0Xl-!36$q0+WyD45^z6!%0gmHNCdovVgX6n@X3`rtOg-Z-i`g zggSo6mPYjUs(rCK;fOfxQirT;N#ZRnfL-f2LcOkIWLva#v_-qx%hR*c18wINP<_s$|mrBUuUCD8ey1{Iw&|yFk^p{FXQdwO z(;h?sG4MT-iSK0AsMus@XP5e&G$p=G8a{-RvK1Nyl0zb`>7>DZ=8ha8{n0OU0*yY& zFd)L{wiY+p8W&V@NvQxc4xJ3Ohk-IM4~9V{hXGNs9$G8THg}4C;J0R1tUSt2YLR6E zva6@Nj`T0BWriznd$KQ3rUH6zh4gD~jXYNzjz^Y}fcTOni(>KO#U326$3E+s$)C!Z zbRJztv13!FYMru%7+mYpFhT_I#qa~qP#Gy@wRd(#X9u=3QvR(k?Y`D!?(%4;>E=gy zoLgBWl{A&7$=gKF>9vgd0X}%zw5Q_4lRg1LvJ{T1;Mfl_d1EA}kA%!4VRs z52I3L%p4fxdgVa+V9>%NdUkpFT%8tmkFJkZ&7Q4`b>%mpkc{&WMK4WK9=JpZP$lBSJ_95<(9&X)1I5>WC$j!(z} z(P|(G3nFd|)u)E)#R<1b4mlL`Rh?&Q@c$4b(^bGc;-K7~&lZwcB@I++L(hR$yrIy@ zQ>3=bNDanJK1OIV!6aiO-dZ+FmmDDjaOaUdIbs{a3edl2TTb%<8fq8Xv8`RsT5ZJu zFjDyze+W~Y7Bg0TI-?)}V~P*RmPX?As82{)oZn`f6RY+)P;JcT;!x+klB1UiCNn?5 z2swcP269iZ3g7yzz0CFqza?%2$m&oX`UXL_$1)^=}O$2FiQfvnPQ5~g`$w?rV{-uyi-3ZTm zAXQ~Y;D7Z=zS3^+p^2z6Ooo;$k$=%-LX~6UWE88j{#$wOS0i}^UwCa8-!j0y-@Xf5 z)_|rsg*rPrqNAfzw6uVcJ$kp#0+>;Ke4;R<66Ftg{3xi3gFy+j(Ut7=io*YDjrAr>w^j zv!)ZvOX9N)DPz_1(*bzPf|`eFu}xG?TH1iLDLb;mRhy_K6oi8fY0%(E{nZ9+fu-H- zNH9XR3mumkDywj2nV!fgZ75&1V-=_EZ5yJ)gpfMu#ng^t=@X4wnpkRqfPJ;Zuydj1 zBq%#~n?hZILBsu#++y^cArBv7B+$1QBVqdF_7U2M;dY_l!kzTsdf=b(!ZSk+5)M|sCRFshgnAqvn))n3#2d%L z9;--iuBcB^r}^Ww1hN3i8NYGTI2cd^a;0n;tb##+{&etU#i!P@+m&w~1_A!Xp3d|o zxq|hUsfj^d`mr5K4v_mXRx(tMm2*dXhue~BQxE>hfdtz6;X^s&pqC`?{N;gdTt{rF z-}szJOYkAXJuwYnn5sTx$OiGc;Kl+D#E1SK`F@51kOM#?7^w%kb*0qb9wfsIE|+E zN?}xAzn0*(GE@i;DpztT*`WMPq4J19m<~=*git!F#AI+@$dd+00agz1nhuh|ig>#$ zV5IWe99T`TP16%2welTkgr00wOa_F;2y!|4dfe!Oy0QoXK=rErd;pshjm<_n3YRD^a%OMpu?SM>Dv zByH+&KcH@9P+aM@LRHi6A4x{NYExgg&?E5Kh{M|*LQ$&a^ zI$R*nvM|6xU%rIxw^rLzs%jA8(**Q4Qsrrz8d8_aRiHj9ON~i3D?$?D=P-%}zJi#y zg9pW*^gZw>!fpe%gNUZtsf^MogTb>csT6bOflqaIv}twK-jyqJB=WKwURdGLF7Tm1 zAyUl`xlae+iH4lAchkiG2>Jf5_D=E9=DeIJB8>Eco~V2V%wF%K-a-wM@JcP}5Ml+-# z!YkL@a7W@zT6bWef|veY#bsz3#G+@3c+7J(e{@NZP8rAOj8fl8=)Z`Hp$QA;o$qzq!T!7F-HV@aRr)SZ%< z7>-T{IwTWP92@Q3R){dvFerLOj-8e3OTd7dt4AwwW~@y5oR0VOQYqOZN*q~ePnta_p6ty-lecJt#wi+WnX_{c?sa-`9h zrAJVqLbdSYtzgy7_0pV(P%s0$AQk=~ZNcOe&oK0yNhjPnkYObXI6C<20AxISd=1YW zC_@mZt}pAXlrW)OHKFhHR&|S+QO1KRx<VOQmoT61!w;4W2 zs2%O{Gal@?$3gWfk1c9&$S-O(%ciHcaT6>T;5+>z^+LB@h1%uQkS+NEhx$YezI;@~ zAxRLt%b=tC3-m+~8%GcDk&_@XMMW;7JR#>;o{U#dX|{=Cb3?&p9hUwqACwP41%!hU z1h&D7Lpuqb8;>sna>k(wD@Z04Y9rJPPzu8|3M)DF944|g9Km)G{ zq|^Y^IHavKL1DoS0k3VM<9v>4Pz&{gTwhF^{)Iw%a{O9A_8Zebh4 z>9iRioB(lV?+kJToUAcj1VThP$+*Ebtb^^39DQ``^~8h@t@a`vTGX!q1v+U>CqZa# zW1Ilzq%-?v5UkcFOw%wKrwB}gff8Hq_aNz;zt|DL*5F6HQ?`aI-8@V3gmfXU>F?yW=hS>nyq=OZMzJ_oa%Ip#HSDqq$ma_MM$AcJ%>nDH#w zEY2~tl=^7Y!zWRdlZeefNutJ&@F>e5*!Re&zAyt#inT}&7sQT#*?|i2ljxk zE{$A{S=pdd;n9u+vu!;PM+!d0n}e*hYM0Ij&&HCVKF()pXrf3V`W+g`Z{iFFt|b{y z9Ksv}j%O4&5DDyUOwZIfS9)bo6uDU?0SX0R99i^X9#d&EbFuSR9RJkLPgQ8iqrbyV zl67VJ>R8BI20Iutz=r2i0FGCY$f1)A#1)tvsr*PS{kf}%!E8h?+mTxL$$4>X7oHaG zF-p9R79$+HBtL^(r+DrVJFEgb#9P~dR&E{)B@gwQW$C3?frf*9B^AyU&*Ogus0i|{ z0dND9&;XEYc%Gn9zba}8_2UkWfwu&2XAKQtyW?ftL`@rOf+S@XF-_??jn%rx#{98Z zrGr+W97o96L6D>gm)e^fiG00|e725+OZ#E(^oOLW*)=xmRh)2yTxY4&?X7AB`V4jD zM|GKf{YV$)SHHa)+z4JxCLv#gp@eS)vwZN5#6=Hgm^2`dR+E`lKGiCQqw?LPqFD!Q zbe4Tm0Pi{=qYFbrVMJ*wr{N0*eE?*po^oB$KEZ;!Nbb<6m6hhzt$-~-C7Dm_!6@m_ zjiDb%LSI>^D9;_xR|$@Tm%KFamkP9b2Fk54RH81^8i1r`P?BR*CMK;{rFnwD5doZ* znry6y8bW3JSAM;n>@>wy0^dk^w~)%34)s7szKKZ;?c2f4ds?w`(+W0RS5FiZisEVm z7+3*7Hrj<7mpa-zJ=n490B@f3Fs8yFc#7mFlYB|2)EXWTM!I#9_isoPNhLl z=f1;|TEq^Ub(F6nH)|&i+BlBvd=^k0n+}uPqLdI%Y!3>*DP7s8AyYs)b$d1-dTb-+ zwYD@E?;DdQ-l@BdG>nOJ1~oY}1}3hxF|cvntz9^*#@Z$8Xz?_vT?3mO7z13VsC25r zcGU(hdND1p*r1hz9$Z>iDn}YO6!@kBF>F04KP6moXzHL9NF9~wX`HX!!o^Qse_ zXPRi}h~w~fqv~RS;hZg^-X7H=+LZOIS?J_BUv!~ur$brM%9}l?7v69>gjzmnaD)v8 zG%o0O_w+=M>>PU533%co2RPNQ@(u0SDVTH%kXJ#x*uG#?r{;;B7+EZQt3LEb311_E zO&u9H;L5{+>aatT4)an94RDOm)l@2Wm4}UB=OpZD_I+RXX@he)%e<_2n#{eAEnlb>Ybi0+{ zfr>mTFLb%f(l)JgYmkN$z%^w!Lf@^-%0+0bW62OF;W zRosn`t1tHb{V{i;?)q!@!&uipp=Kc zj&2Z=$WmdBneAAfC@`?eZFo@QdfUkU-W=4V#kPT74Q$jWgHd1*<9b_{8i&;ygPpe_ z&97*QU*Bpiy3}G-DMp;Y2#=E)snL#${>bDOP-A+qv$Y8)tq{yC*8-JRYx)q8@6!cRWh8#*rMHtAbP_tUYP;eU;azw!K%C97$ z!z`?$^hyhGeT~%y9UP~L)zfhp$V|%xz}FGJ6v%guaj<8cQLp1JqTd|cau9?L9Tt4Z zd8<WD#?cr_(q4= zzLSup=*x9eAwZjD^~rr6D>TzuKWLCoOFBqCPyC_5G)qOL3lAIIg-RjBY~(eImykYz zm}%?B%|?<=P=Rx-(~>UR@I;6LQmCCd%BclOv)(w(ysW{Trr>nJy; zpdGT4iR?2Tq%0iJq|*TNAv_(q{>MNEI`;0nHjPVt)Igg_I`QaBJPO!FgJ1n5X>*YW z1wSUij3%)Zvh6Ec1Ei zoE1wacXF|10UoU*N8l|&H?j!Pu*x&fmY!OvD=R5ogG`;|@ZF&Sg2x&dkXUWyYK)xn z5gjXC>87hZ^QR;Nq(+Dq<>ALSlQ6*b^=K8=6YWZ8Q0ovcT`D|E#77fUueTyaK#Mr> zpjDefYOfq24lmTrM+`7y@z#t2{2`(F;UaOtGyj@R_x5%Zv;Eb(+zLhiR^Y6rASx%W z+M&pA-SJDZeyv*tPaaBqx#4M`)(2`mE;k6t#=}tw<^c(tKrTS);GAUxZ3_MDn9?U5 z(h8-Ml-9w4mZPnub~w^GRVup!zSylZ&oV{EBo#`t7QH5KIBvFV*qW@59^kZ_cCS8zHMB&hgHJV~LlexZQvM%Y|-Q7Ov1-Bre1xbkKwsd-+& zmxBsTx4n3_2!iyXNK(qRf@~34Er&kY6s2G*kTf{7ek_^=TcWV2gvIq-S)3E^Q-%F~ zGS(#o3Er)>O;5Ye2YTCLz(*-oA67qZ2sD5)Bp5=ttuS^A3FAs7P4y7Ga)T=|g(1Ql zL9RebqCqqOdH@v;%nQc`tA@4GIifV^=*u=@-Z;`9ZM_=gSh=aeScG?~@$$Nw1~m_C zxtdG9Rj2Uiu9DVAX&@WMy(58hEpw`L?%39Ae%1Qbv}my~kXurBr0 zp;hw?UW(EJ&ht4L<^=~%ezpth_KHpE*_9H~>6na>=!{&i<9W#1**iQ)kq-*UN{40% zoa8ZOR+YBhbbcl9B}09Lw@u_5SxR}4q(AwtHl5&@>U9mV(gezz9zwd14#F2t%<%J$ zM{A=DOv(qSTLy(L?NE@xjG{L(L84TC(2g}!7zCYDyC3sV02a`z@<1_?_`oE*szb5j z2S!{C4jp|%kSv!GzzcmOiR5{WFArSqX#(K7mlFya;I^xQ^F}B-DNqN!OlsPxuhFIP zI*Wds;wCe>wVj^EY5JOS=|`knN56KU z)M9MQs{nM8dh$ks=?a&XA!VSOTqy_p)2A`;!XHP9(vH-xG};i`^@Pi1;4keFg7*L7 z1w6>ZUvi*Gep4Q&>9;h5W8=~4=|Dh{o*gJ7hgJs3%=EK=M2o_T%{9s< zNEsNV8Y(+>Q_f{UnjTG`z!`Nzf!Z+uD0TPr#$v9)NMJi!2EMW_z_FM8Bpy!pE$ot= z*>Nkt8b{E~R^btTHBh5zlCeLpe4d{5!9bZ-K%i{Cga*B#hychbX~MEAudKC_2B2X6 ziMv;p6Xj?vAxZo3#}wt`$5Eox3KL$ApJn2lpIkDQ_gkhV6)E>AI>w zX~OkvoVE~NZpVuTot3D5JXm4B?K;wdMB38p$FpeRdUYlsJ-IF*vTkB%!Va0(t&X&3 zK7flX460f=)^-M2e6ivhP``mP#R1b1n1=Mh>X7nnBV=D4ZGL8syFcq&EWBMV8^iY+ zpYmmk5@DznRps_l_EG9XyL@>p0X(dnzGz1#fv|J>pI4ot>*w^`0EykFj?LDWXXnx@ zGkZ^bRmKk=iypeoYolUO_+0Zdzle+(SYHau1K~2@ED!KTPYcvDTwU<6oZ{5YrJUv& zno*552HIM(s(t*-970(iOteH)iuXc53Q(%^vLK4D^sqB@TkO^h)il~ddQ`hm-goeJ zcl%KlJZ5@f)lGY0Frp1_p4iZKO2dA+CfBY&4eVgpA7d1*NIbc{O8*epM)fgRPL<)* zJfkjQh;Ezck7!dpq`O^}E_;Vp_c>xZXicR>iu!_%*u;!!)8oA#IN{k2bOW(aidlE$ zlKAF?Cnb>hLf`_#u<0%__Px22O}zCgF0T(xDALwLHZo2p2MA6bSiIw zLr^xxR!Y9!C~0KpQ>GMXy+TV3k*gwXmX#4m1s^&h>vF06yv18(pbJ#&2B=I^JnJfCJl7# zLJN7la-Hf-qV05HIB8?EG79_1_?AqYtTME!`_N)ZeI=Ju*s^5 z{)*qR9il%8jw*$iRh0HJFgTbx_>{}!y6U%$NcWsVkI=)Nygl8~&8`;qrZn_z8`8Ol zRJ93wF=^p?Zf9qQY`H`BCr?(|2U@U#uYxyZ^KJw+n^)DFLOBiDDtOpepWsMpW>H=& z_#t<6BH5iON{|(jlO*Vj=}*Ob-+w}}gl7RT=LwoZH$hC+utcE;j`ZyXM+&4J7!ZdB zE`#;=Xy|N)`xJ}N?C78i#e0Qx#E(@E=!Wy(a-=o_ZvuPus*J_ z^+&rpM~C?AP?`F$wr?U);2IxWlic?2>tJY21CE`Ys-b_|sZs|@g+I}vt!mJBDIhJ~ zP3mLO;)OA9-rRh_Ds+rR4U(V`@GKugQLd#_x@W&qz8lzyX}lb92Bc>_po4=(2w>!= zf_W`m%*GYwfO?Wj<(A#dJkJic{_ z1rV+J2FNFnUg~w*nn7iVIaXxc9og2FgA}WNR-};i0D}PN3l4NJKZOG2J^O}VR+r+P zOa?jX;)EJ2o!q^E5-c{XTE9+k8Ox`iyk?hqmVvEX(^G&a70!twsZ^?T(?~jSSa&K+ zN$ro$y{aZi*EtCmA2w)c;q(jdu0kKqmlJ^GVA&r)*iZXmYmODz;5yJ0yi3F)-*AAg z8n#;G_o>=4?MG4TOMu*{mPAD?M!~V{8Bv;$T!b`Hci-Wx6y~79_#samRHv`cVoUg9 z^l!Z?n7()^ntDX&-a|ZuR4|uhUF|iBGm8JYsk0&%_42wgUD@A+>XUQZsG~ z7|_8sRN`=sr)y9_Ps+26KWh*TC^DEa1hfVZa0*tV7||G!#yd2Su3$dJ6k_>-X(^V6 zXs18L7#29Hq zLD|W(K5PXom_I+(Sn~z3^Deu^1{-Zuww-7qQ_K<~${^=erIT=GqJrLvkuVhua#0O z-KHiJ+|2};>Z0x-sWTcWx@9#Cp+_GPBhIM_D@}IXY`g9W*{G#>QP`hISSvh7k>34oa|3Dvzc+e zz7%kIbVMfnsWfHSURB(yRqGzzWvI6AujvtWN-LMk1bBVEAZs03r&6s4eXOIUdCF4g z1dhvKO?yc;Pp&1ucXH5$^^*f z1HXuwGD%S}$_rO@LB{r_$p#ZE(tEX_Fdy^_+QwxSx4igN{fa)k<)nqWN^k|DZT@wp zsE^{!?M!=9w|U6=o1k;^t&k`JIOq2{fa%mDOtggIfaIZ}6;J@;F*9Z9`+~LCiBEpw zvvJZ%pNdz#Y8O8*#I63c8-orCr6V7E><8oIPkuJu^oE0C?(Dho>R0a)*IxIV*m~=2 zV$s4y5>lO2isHd-c8_^jn}M_wha{yi0J7bQ=E3z$Oh>Pbw0xsJIu85T^7B;suc7=TX&J2ba2KZK>3qYdmo3fV>gtP*Gp3Gm@#>Z}=R9j*1% zP(Z~RK)f{!BBcaKpl5yE3DGs4*n#sBU|vDL!_}y`Xjw;UOPy!P$&y=I+2GST{FhG9 zG(()@=pAhVI+T8;b3eN&dusl3LE1$20oQEs^Pwt3o!RxsQBZZ>QYT3#bkqvTU*W{) z;M2~v4h1u!!9#p|HLp`-^P@Wo%*J^bnA^Q`c8!n(91fgdLpoQ;SM+s?A*De_IIf#^ zFjeZT{ezxBf8hi3N)x^8FDgtZIrNa+f@6@Q4XICGSV#Um6$OPX;Bu*xCcvL&k zF1`$-bMU#|h+Vh^gyidwQWVd{xoP;Z!idmt(2;JG==RWu`y*&)w%vV>t`s=SYkvCB zt~3a#TA83@Y{=K$H2Eo&WWavJM@>;9xV^H?R9+HugqZ;e9_ zJtF?+gpb99apSyijM1_sGjHCU*lyb$0$XURGfGh~Y zkz_$Vt}wWbb)b$?*j30D@-*|41!>TY%MlbDgd)88CUf1Hx%Sr1wX8bOxua%#bF9zF znRWf}U@Z1x|6iG)gDW-d4$8D|0a&0cJ4T%IV4 zc<2oFn=t6)e;MF6^#gxCl?;esQ50;a3h0UU0h>Mm*9=y6+d8*JNrz~cB9_X&NbMkj z-F1x%IogPNq;Vscfui*9d@;0Q3~(shU-U>jVe9SQAzDMb%kqSjoQEeBAKa6Qo}I)X=Y?6ML}^?Oo>T{GEaLdW|%8JvBCSG!FJ z9sZvIi`~>oEMDBadu5F^){G5bxUpA50BtdA)~tB@VejxcFn|7B4c={W$;ID{&wcLG zap|SsiZNrx$k@5C+7okT&yFV^e>|Ri?6H_XZ?0&tg*eXxCIjM}*)wCdf*V4!nR)Z) z$F!%Oj3=LbB4*8;t--g)N<-Bc#5~nU-cwIL9`onUBh`jOGM;$s(U?7R zrte^)VcD|m;DW9Ayy4fsj&FSJD{<{LSH&KCzb4-F=0ju5sL?S^<@{e!stGrc9XpLG zt5*&NBM0MIHWX$_4`pgDlI z9$R7Pc>~CBNLsX=t0>8Ng0sjpClS#PTRhHiSvos7a!!gcaM6jpLSoR!Lb6+xQ@hxO z;BcTLGBi($1x+HRn7_htd56q1b7T`LxI95+6znjdHK=S-&1e?3#VB59xHv2vLh`Nd zFHcJS%&J+Hl7?S`1f>C2Q|JM>sid2EUJ;TeI{8UH0B~KNlq4!ODNa8ZfHyRNma>tc zl1@zB*1BDb(mmr>dg@WmT5W^;CJzk`{Fn%kY0cyRHdG096r;&E$7Inmm0%PF?8oXL z9l6PBWuJIMKdBcZbD*5d7GgSK@}A`@K4}EZR_CfPCv94Aa7jhJ5WVKgjyoO_+(t4X z{3v&4_G%HrwsKunnHDurAH?9Xe8^iaxa}15wR_`C5hsf`CJDKFk`o-iZA-jm-PDC2 z9`Gyi7%bafcfkH9|K-m&Yd{#A)K(CBHM1K(qBjocT;S*B%ocnR62%Wv-_|`k?s~zJ zSarQw(Z@fSRGbo!ms!`WJEq2>>7&J@W^GFB?p_jWthrX~x%X@1fd}r3uFkHQy6UR& zz3+ZI#!r|Kix$q0b=TW4jyv{)@xX)k#i%X~5YwNEpIr6Bm^yXUSY^u8c=CzIW5I%X zS|N3-fjVNxSMMB$yzTJVPAfeIj)xw6IJVpVRq?_Xy+{MujCl2Kd&ef5zC7;y*S|dQ zZN1I5ao`&dj@|d%Csv-aay)q7y|Hld!Wb!suyDcrc-iKg$03Iw5j*d)2hSmB5PeLF z?TLj87sbmr-y&Xj;G1Ia{q~QQR-U2(?~#~3eMW4)Xc>Ke?aJ@r&fnKDJIy+s}rX*>Yq@C;l=Cy(Vu#v^eN*Du4x=^7J|Az{G8R7Pf2 z3{44m0A~A>zt(r>Q%%Zl2aDLYl|WZ8*D3z<36$rMNDG!e5< zNSi$3z?aIw8VT;03^)Q0FhcY;q>kVaOurIweMDptI(St@aRdTPAGGEG?p1)wfZ+j6 z4vQTTbiqW4n@{TYl%1s*!8w=^HYPkfEpJ&WodHD$<3UGh4vJfNmt&?+D(MWY$f|S# zbSx`0aav0QV!*uzF|RskJJ+r3-av;zac*Q z>Cbsk0&GN5_5uxVN5A8+c<}!F;@!u-FW!9U;igCa3=L4nyzB6oF>OYian4s`%dNL@ z*;-$>2HSTXc1Rp~^f9r+PP;g7S%5ZA`S?fU`s;oXnKGn_4iUE5G&!)JsWn35= zjn0z2Lk1`Zsb*1~eac6(yw48aOQ)dIq)iD*5265RG`)LO<3wQvpqdQDC=NJHC&fW6 zAC^;Br7d8Gju&XR0@YEHe(n2(gp({VIH|BQlRC~A7m)<%Y`L+gd^|24346r}D7DRR z#8GEdnr}{mhH%g+ZJ7`8QmjQb>Nhhb&Qa%T3MY$LCdwW>(D|4b@a@Re4)k|cgKhn7 zp|76{GQhx6z-nHO2mS#nA!;66qfaY`-m;Q(T-Sk|Z|J}os64j8VCR7Wy~)vVBMRyG zNfj|)xpTmPCCZBDAV)2kp1?VG-ZgdWyY}Eogxnv5-Um^YuB8B|@S80I&lI86l%hCl z_j6*RXTEd}PbotVbO81CcqNhwB;DI*cBncE?5}hR4N|l2jQ_s@_@efvMh2x66({#- zIDM{NJUcs*j}&jQqb%8&HCH-LPKZPRI&c*OiN_4kH)-CT5+41<0~2i0Hqh58?Z*gUIRaVyPJe1fyzltqspi>$j7sDdi`Mn?M#e7|v?*|GhF>b& zGR=!bd*pLGG%bTp9cA zwMQIw$eZGl3or2KKWo-(x^!V(_ACIq`^(B}6!_7At=cpsz7QesYw@y3v%V)%qZ#yJz``h1Q z^q4U=I5)Tg2H=iKgUUctQ?#i%yPQ_ezS2?HDJhdfHST2cIk(TFKO4 z`hZSo$3gU#7lza|lx_(&4Lqa**Ghf8RKYV;%bdX%`b}DNHSja25p4K17*FZSpx-gS zr!3!muc;R3?v!%U%ua>GbuAvGb~jTQ`e*|n>GFazz~0Q;;fBh>7bU= z#bH08S-b^6QU){-0%VTJy%eOJsS}k^9Sl4;rF^?QuldS6__1>YbV&Wmw%nxpl(;Ag z0cL@$6E+=0$NF*k8WEpH&&e2iB&Sh^;QEOH$umVrsWmwceMQWzhH(^u##gnr?$zx?A zEDe^29Co^pg1ZKmQr)th-)xb&iTVZu^JJ&Y3kcZu`gI zcj|GbssF8WOm>Nl~=h={qroM55Momd&lr(Tzs#o09W8$RE z>Zcm7!?S?a;skn61C#)L*8wDVD+HBZYZycu$P7Lef$p0fuoRH7Cku4s?Bm>>CdDXE z2|9Q#z|pu0#!0>TUnwXj%IG;~rwmAS>rGt-hf+nO+8SJOO{9WyN)Ll5XF8;_P!fGm zw6X(wm~BEW>mPy0Ee)mPLzW;yK9<};^n8|l`))o`keB)`SDu65x0*n^R8BfP+omK3 zAIhWm#3*-s^w* zkxJW<&S2-XqC<*j1o@M=+oa^D49`6zcTXRN;toEmI+o5Aaf*I2jbBQWCLK#oX~L=2 z5d&Bu?zTifI?a_idM;GZffSIq(p)2Os-rSeqZLm_rFfFWb~l5VKH%r1##Q>B2v%+6 z@s=I%$@hd@b>Z9E+wo^iwupB`r*JstC4sb8v!x$)vwlIoa-cW*JIBRSI~*2IZgWIDvCZL2g_*B9BxbC+O}t{ghvLxv?~5b$y=SR# z*lX{N!}h&5)|t8}y8Ft^w(?rI8#QWF-20!qJU~pHx>{_t^($htO}BL3&#wMatfYa* z0#!&keZ6eTs%*(d-1YB&c>o$ac5I9q-4&xpk4onyEiGQS$k*sbj~N}4S6(?LO_~&s zKmJ%un?5bZjvMFg!`X9Y$2^|p6F~mQS6uG+aUb}fIPb!5$9}InPzoRL;5&ED+?XT$ zF{*2rbppD^`oP3t!D;+ijUrmq;v^w7Mw<_(zXy+nllRE zb9C?yk%}6tY&Eh-VCBViGhYK1bJR(n;U=(jwH zStcg7P3TT7(6FTnB-gim#7Zz-mEw5 z@NC}qFaK`5`juP7_rH5-Oqn`0KKjX1;$<)2Oat7k=+ZzsYSd_zTjKXrsug3j20dW< zjHlG#Ij9+s(~Sc6;#V`3-tHdS)w+-w*|;!t+R-y9qbgNM$P4Rq3=BhaS}!1SJ6#!E zBtlLQT}NwJ7KnfiL_paZT$zsc3?-<(49-+&p<758T2Z0R{yIk&)sF-F_AQ~YYY!nL zWXs%|@CT>Je`TS7dOe8S*4vb3C!WQePM|~c*GkmQn{xQuCElUeA=!9|054nS8B5PB zMUz(YR;cPiv*@+~$lgYv0?rl4HVP$*_~jh^p+cYOl+~da9gO3bwt`Dq(!~a>)?tBq zk~=8XfD22?B`|nE4;|rPB&&S{&Ji+PA5`q&Cm8&QUO zZ59-lN@)gPYe7zELdDLFYekerwB*zjbe?n+h{GT41YjG^L2&UT`moNqrB&PZsgU(a zpdZ+AiYL*a54YZ+;_INM4PAg^YKR}#3KJrhygW}qd=HyGOsLI_jSp>2a!7TK^v^(m zcvh1F?{%~?4fj@;OiN7YXp z?h$}4qE6v$f9i8t;Yb4brrn{(dur<=G7{PRKR2-b=!YZ5R0E1K)VyT`_~%%lB{{b; z0UgJV8>%ye~l}tUy=uuWF;~czvv~)>?7r zzwYoO2|K@fw-`Tue0<^4pN!x9`j;+0dCHXd<PItt-;Wm&>Dt7gPwxhqnvnPQm`6A`J zDy-%mfee7?h|Z=Mfe*MoD&jQZ!>-PGg9xiP&rFrbTXKBU2{cO?m!RXQcIrD;qpeJVdLiwscI2}SBQ5>oj)7LS{3)IK#XJikm!`IY0_{W31zSgFJZ&X*8{O>6Fu@32BcM@0)SKcP@`zcHJW$e&~UC{L#nayWhUpk2UPI&%P>m zUYv3ESL36f__Uv+`|=r|^J5Sg1<)m9U`E4!^S$@{$7x5u_qaIYtaD@I7r(??s=iyQ zf_SqdrtuZfk~^!E#g-8|WBUN3HM%}EHV8-@s%!`SxU2$2T&zZh&=?Ap22g48)1a3j z&-58YuC~6B{6dOTXCpTq2%601?7-3qP<3-KV>kuaifV}m!&rFfG0Gs z;@qJ`lOv#l)rlmu@C8(PbxOOC%wX9H1=EmiS5kz>g3D(m8NR*CpiJltAvFvjeJN}L z3J|s46sQlr#3zyz#RwM}5f$BltE8sLqJ*twpYQ+;4W+yN6!8Fu2lX)nB%tlPNK@C*MrQvK9IA_jzAVd zM4m@@I&!t{idV$1P@Qv4CZJ7gRAn5pK?)!l>B{%Ol*BVN+uD<7g-k0nj8(uV%1Z-C z-Md^KOEKx3zQ&|d8L|zo*L95^9itU^6s%Le4L?^G6CTvcz*Yx22Fhv!^=LmPeDkOy z0pQ>C{h?m+oz7sVg9~RK3Fa5x$#n7lXa5}C$o`&K(lsgW-|S5xFJ83JP?swV4Lsu? zxGnZ+yCz<=VNcHNh5=@Qzq?~94$Uw|$I42d zJ8w?>?CPuHj@xgG)z?@f9@k*_mp}f|>78n@$DepC{&@3ER`zPEuP%cd5r6vQ&2h$O zJ{9-<=Ra=LQEJdtS6{=|;r?{v@8g^=pW%nmc|r5mD?OOf`jcju*nG zteqD+BOTgVR6qV*28dT9D(Glu$hk|B4!h7ync%_f>yy_v(53(eI4I4tX$K|nW0p8c zAdeKZ=5xx54z$>|v>E}Ykxzw$LbD!SkdWF-!X zAmuGfYk^k|lmXZD`5~#LqW^8E^$s}>We0JA?3oJiUHpP4F-l80$g@zk&n(H2Sjn@_ zOrWMJxU>T2*d9GL@r}{OFYTFFNftWlN7At;MkU?bo*vM0P)ua-oAmv9u*S+P^K%eW zEy7EQ7}zAUaH~lnpI_UkqbK(jBr81ou5`s0EL<4dZol1%JV)0;qyQ|o_biOL6V{F2 z9QK2V1@n|T1dqxmtsHCo_S^B5j(5iauUVMaC>qH>F>WZZoG4Hj2V^B(P60E zOtN6!JP#IQx_HA$M7IWz#S0gBw$L?(2h6o1(rRh`g86=)tZVcb#TWS8H=c|d>;LCk zxL~2^b!$-R^p*y93o$tMEa4(y#F%lTqO*;app+?vg1b;k;#TFV_)+3xlm@C^%}RK2 zGz#{02Q}#E(POJMP`MME<%=9c9M@w+7E&zrAvZi*Re8eE&>0r4~-%@I@= zuiWu+T~0CWf!R!6=*5BJ*Zo|bXtF)S-@)K9c`cCdIMXUMXFtNg0NwFR8%uA^_O6Cj z4T~drc9$ikfDjtkr8tLbtBGCda#V^D__7&-!=cl_x4Tg3XQU}E`Mn>nfXu#YvM!JM z!OsrIstnnDok?=xtQxqS3kOxwDchCCknfA;s*BF(?uf9`sjG)J7lU+0CvlbNNHj7v zb;B`ZSq2~C@(PtrPJG=&d|;mdvsmiqMkG63@y^zK(SQPNTWI8uf>U8Jq1cA;Wiv%% z3fWp*;)EY>ACd|^9bwmWP;_yMoU_fHGz8ES)732cN90P#C*|nDL$Q25Ew_lVUF?u^ zJ3F?i=rgJrUK-`;D^*#_O)vtS=+_y^w*qZ%E_Gyrhn}3S-?X8mOrpmyozTyOs)Q86 z+xQ?Tk9Qt2Akg>mE675hA+J{}3vcC8dwNtT7mkJp*ZmwJYZ(HARWlf1FAvIw1IdWp zVi$#3*k|IFK$}UsO7yidfgib0zOP}*&bZ8M1v)>qo1{btI|0W9l#2gR8jqi#JNgf| z^#fipD*)&gf0h#s{1VUgiiA${PF&fF5|DuFn0}#y;$}f{zrPfoRW}oS`(K#iq9jMr z@nEKOWaoMwyu!cv=13hXJ8k;(IR1nW6`7U`6eLt=Juh*r5@uQhbsA81Bf4~Gfy$~u zjI(l@G+Be61~1=Dq>j?w*%1>aPRctIr4SmH!HZk|$B&=r?Wpk@;8xMfjeTNi!HqIz z+!(F&5@(WDP2?KZL=T*ngZ5PQU0Nkhnkc*p<6@%fn>b-5KNG&#s^zzzCcZ{!SHns8`y%? zrSc4T^^t*grSW%5{DTGm2G764`x!Zs3P4qgpX z6n-ld#N@b^RTT?+X8*Nw1V*bTori~u3#L1vcfS9S*`fVRT7Rioh?pG84k#eZNophp)IH;q0}jW zdbVIf5u<=&)MKnnuiUf(Y3U4+36}X0KQ5l7xXHn`qD1-{?e77=wOcv*Km%%o+A70C z#d@w`DS%zVa3F@*ZQpo zl~)C{i8LsciiXPj8kvZ2BMADVzjNaUt2g@y+k(p2#_~Fz+gL{iT;CN-Ki1JN0Ec~e zR$<@K36HL$c#%fEqLJvC4jphERoO-mU-A)72id;kX#tc}LP9g%*QUW?oQ!+?q=*TV z2Z!-1D^Dx1Q4?Z9SC3YADxl=yLffRi7}F`X3TY0Gq98Oz0AQLNoufPiVekM@F8K_I z7`JB_D5wxE6couOwQ=w(HH;C{lv~olr-9l0NmcAeE@~DiDTehMqCkZ$cI0hT^e0-Cq+%c%BSYe3Tav_&4uvMJgYp2PH3mBp zT-=2evaK5ATL9e?$f}`&Nt?zn1q-;eaLkkI5~yIEY>@>0+@{q^&Z`XBMmu+e=AF-+ zH{77(g>I${3)ECZ143jQw!8~}dOWOI84Pma>E5Jyvd8w2UeZA4&))li?*(ln0 ziRCcR&qIOpXT*AOpH@@MG?KBQ0E3Uu924^vwQ06RJ!KG6;H;RTr+el^2{>eMJn_IE z3K`+N3I~U63n_@%L*5E2z7ZY=sF`Orj_?)l?3Cf_oUK78i$ddXFes<=T+%Z@HMn_N zfL4_lnhi)_*qW|;_Juq+6lN@vs|PgY^SYxRrg6%{q4#Me zMor9s+B);rY9ugq_ROK?5zSb|2z6SF$v<=kEUl5ILpd6`0pdV7)~AaxuqY16DlX}c z_%xX&FV&!8g*WGwL@9^*@;RXFJa$T@&D;smk!OBX01kIjvTaL8Lq_zFbXMKEG21E z9*=-g>OpNtL~Y=>ZzxI%TiH}+u|Pri@(K@m6+`h|4qRW&&r zaB9$FQ0bEm3fFq0EKaQ~~07s5u4xNUg2Ms>3C1&!S!VH74yZ zUK!-{p?`F=@z3ef0XIfS1{}TDE#f^Pxqw1Vsjw`*pA963gJHNj2LT8Qh)jP#t+jt~ z+dXaI6&meNW`0Q&jx^>~m$WKG{EIJZ(8olN?ZPCeGCKF9vT|s`oQVoiD?xfAy9Lje z1$ZT)`W`;2*EgR?x0DAc3!PN4WJTJv9af0xgTyDz36GGbt*DEb>jDK?uxvm)Ig)M7 zq>H}a(a{#OXU~rJy!TiQbQhI@ZWRr5g~*Bkm^j>#y$o`2JvGXi@P{-W5A_n)v$(p|hM)%2+Eved*M}0PA+l=97rhkgLe&YZ#J=yMkF+;9Ssm!>2wgfM!}L zTeeQgqym+zWXQUb4ZsT5-ng#ANu5YlJg&+mNK+_&D3cIsdMFQ?5-o+La<`oDh;rls2m1HQi)@!~LTGIv0=ndwY5v##gDR|*5*UmWT7i;I zk&;|gDa=|3Jp7AKwH#3U_u5QBS1=P0BRgs6~L~6yo}dR zo&z=B3r00b&)`tb4~GiZT2aLKVw_IOfRFqg zYTS3@sokpa6);d$^x4=J_FL#y84kg}FZKmnm7|2|tmfDF8GppIIZ0R90w z{&NDznO%sdMDSTmLjVFPC86S1sLlzT7U9r88X`RdP!S+fLKQ@Sj83DGU_i3L5%ptN zegM2Sw5ewsBu=sgiAKOq3AC5aks_h+(SmGS@Tb6_L9PI}`D41dfe&zZ*e)6L`h3F=ew9fl|Jj(&I%oUZ5@-(vuE`}GXbKdk zEo@Shz$R+IumqH2Ldyf_ev{PbQ89K5Hy-lbUMHicaQl4YBCl#>6`PzP;Ij$T3pcHy z@cXnd9KAt7KdtA65~+2yRF+++>AL8EZdgURd89r!B^^1B!H#^#QN9~Mpw^}ozv+AV zWX(eZ_^n5vQGW{zJ%2{v!umlLS|1rznT-lV(Q=;~DLkW*Eu~WjLHdvY9ylZ$4R0Ed zGR4A`ve`P$R0VY6xH24XO6R?Nhmr(|LZ%6cO9oD*8mv>4wR8}V=C20$hG*r8mVKql z!nbd@z(GkyTBu#KL0&=B*^v)?dolyA3VD)K_-9L|AqtIZhDbnDsuLcp+XT>_2_z*2 z)sN3bE~khttEP0Q$(&d(^*;-soM{841x2q(lT2$XqtXF#+o4EqL0Af|5LLKFvoEPG$(Yx9pqS7+vxXHwCN*g{b4w6W?iS_PT6+UPB7x%&FuO{x zYCtoz0rgr3*cIvOGpzinA#ZzEO!@c*JKjF*b zarb+7ceiQMD-sHW4$ahzTOgk$aBdC-;8!5tnzt;d^eXPq;JQT2%Yl|-qk_SJLMQ~Q zHd7Q%hUsLSMLjPUtwv2cjSu9$Z;87BT)K3Y>?EMHssO0mBzE(-B4C;=Vc8(5#E7?E zEu*-@c{)$O7@T`smP0|fyZC|7{f$}Q?;1$X?Q_ekcFae)s@VVJDuP*dVfiktS0)=cw zV1P);PhHA3>HvcCaOKs0qyf~Sa+y*Bby!CNl;?WOxym~mTA5I2X0@)dk`mN3tPX1+ zPWh#PjB+59;*Fz$lY&=)BsX84HbG2SCiqqG%_*eGfN+}N<8XbqGLG1OA^S#B9S+D_ zs;2)sz)j`IO`$ND3#GX4=%|clKGI0$QrIn43R*j5vP@Z*Y2al%y9G2Ur(nBQqRW6J z-4P&)PXg6tA;e`P`2y*fviZ1^bPS%6N?!*@lkhsY5k#=?toD%Y(q3M@@p2Dd4nokN z$6|$*Bd=^+v~aPGOB_h+>*4w4&wdPl)RPhvX9{DC%<}_2{?` zKuc0htE64$vO=Zp)vgQ`@8(t@BbUI0`U)7|bi&ndlq8^Wa{qWhOK0$TPKNE#yg&&# z94HQnG-&yT6_KS2BzqXWlq@>(ukP4hx;t<9uskT@8;Da!4K**1H5ZC0pVP&35zpBe zj8`yD<2pnR05%XcFzqL1TT&NeBb!2;wyC%5qVh2qL z9aT+s0*V?S#&QdzSEkyEHt@EiK5bg&_?jbSrRO#T(Ew*d#L=iTkml=b;+N};2u4{o zjPiPQs-pz%(kiY~EA$Q-dIz1SD1oh8{x8cn4ylYgj60#yB$v0X)ZY9lWp+(I$t#a& z(C--h>?0|rMq=A)#=t<}3lXp*&RC!2BP@`dQFQobcJ80 zc8f0sV*3#1>LMKavd8};sIn3&pb;*D(^uW}lF|B5GVMuUP#05s@gw=jpg+=gBrkr% zZKHftnsub+IASw(03y(5LF&WC>p)2#M8_kuKLhBK`dMZ1zjg4$;KZv9sgr*o@XaJD zZ`$G$d&OUKeUF!bj2hJ$qr39iW&3H>*R268pHp7sm0KO$pqKYzh^G63BoJ-;BLT9w zpl%7lDa$Y-}L#DZYopN)6)0YEYK67DGarzj2szH;% zj%U1VbaHaar+-=TbQ&D2qG{&f=!nw;PdNNZsaHUtOUYg?o4+Eg`A>OS8JRZ0`Oges zw+0}oCb=3ampG&R;GF1KiJNAp7{-ioI5!)SElc>tsBn0!STSJZNEf&m>rc9)EOia| z?hp*uuHNFJGn&q-Lf#_7BLm*5b?2l4xWT}YPc+OV9naF5JC0ywAf8=- zK57LSCxN8pLXsOC1_6Vq_!1A?FqJn1AU8>(KDfGP4wOf10&$2TgTAyo3bce0&h|~k zw1EKG$VLCWudrd;ii5$Vj>$qHTp-Kxi(I}T0h!cxwxQB*)bmKv5qW{sIc}ttnn8H5 zBrep)Y{{8eFiFX_O`xTnFWEd^aoPfuuHY=|B0=mLA$KL<8QY;0k!T^G-_|3F=#70hVm0=$t9nfzOT#cW8kUw!& z38j%-iW-pHMxtQ9s`Bc^sF#*AD)!|!k+?1eonv>_uRg?kHP}Iz!Ok~km43kFqQhH} zUC}v8eOrOmTMojiLq34N{OM-prooN>x?_9NTca3)lz@+6!1Uz`WHP@=n>yhUJqS}# zA6tSue`_ex7vpy4Fltm_bxaf0k?2Hhnx|+H?055R|A8TAF8@=oZA2^MGBUKgLEq$L9p?GcnMA2W7J5) z2_RZ@6r%c}1>C`0UmChQgW`FevE&iVE7%gu^@}b%$m9B@%kAn2vIDj%X*cfDN}mpQ zSz)f75G^K8QPwwv^u7zY2JUE)1NdF$n+^D3Lk>ppsu9R2VRwntaQ1RVH1mf^x9h5X2wc5mY04j|eQ*yP3 zPI5&7;OF3;zGTiQi&yV=D`hA@nC#mCS$fONeNixaB{#n%#{GMS#7w;VIvOk8K-oBpb z?crt;{$+-NP3MZcoggLyYxbk8lT-IKrNEED;7Qb890zrcVXZWv~i# zVE?J1LJr`ffbt~=hLWA0IUY0IlovW_wE74aT6BUYeW2=3q&PsPCEzQ8JQtl}Y#GO~ zQC@la@eItgR5$6ii`*b0oj00rlgX&gvPG#T%2k|;h(@6$T#lyWHd8%1Lu7J9)p^a( z1ml&^s>$Vn+cXO_$#LES=#W(pa(cy$La3pZtH4`uLY?Xs&Q}ubKW;-|}qM>oFK-|ZYZ#tr#{W)pYRUN^9>e*`zd7I2H7cft_GL^5xJ}-9o+xr139MNEa+15=7K;a3mqf7 za%US{m(mC(4=RB+Evqo<@(Qk_({<)QhWA8|2DOEY7U#Ak*V?+9*V(|sP5Y<{;fpGO zoG6n5f2v1y8B6%Q`i)3VhA9BEm0=$dK$%?gP+|7C>#Wb6R|0cgi##|$H@VUS2g4AK zIZ*%~E>WfoCM}yfmJOySTsNF0RHEvpdvFTn=6<;{;ln&J1?DFxXz?-(#C03#|2enfqotfmh!DbLMg{q1zm($o;`~U z*MUKf53@fJ@Pq0W88$5E-R6!_xsc=z(A$!3yx1AQP}7n@npay7{kx>ZGp<+)Z6AT%uRn z)S3ay*QOsBv^J(D%3ofVN>`7rJ+Ac*r}<0J0XRn=9YI|Ca;i9 zFP=oxe;orp_M+9hUkV`H$~$checXlr-pKMKfC4d#3{MlMLI*GnwB-<1d0h! zjM%QQOY-E1nV3<~mp7cw_5W;7>kLB6ftp=q9yS0%%+n^pR??0mdnN9ATMPUQF^u$ZC<>Av7tq9lEAiPO38vL&^M`2IM$)Q zh~ib9bj;Q&=}`8+g=bFB}i>=z?=sFTMMyItk@K<9aZ+lOnwaA}F%g4^q#ddxaVVH45EP0H`5c?TW>lX3 z&R_1p-cYcMmNDWXT&dF(3g5|HIaj_NrJ~ePL{!aKBUYojm4MKTJSwg3ndWut7iM!vuQZ8lYD^@K!>egJi@63fE(elZ~<*X~AtkY63q8 zPz*D$n(!G)z-F1?BCBmyakr-hqUWJ0N~W*LdK8G8$LyV4y(Gpva%(#v1MSGEW%J6p z$Ja%DnZX3}aSsn{8mK61dsATILHWvyTg-l~PEhhlIsdDSUz9)E&(wK4w5?s#v;GF( z4pLfvDyM2%D?!YtG8)}0IaO}4NMj}h)6Brlcv5h26h<6;>xv&B^Op^UKEf)P8)?Ag z5n5zumu7wdDiK3gj!<_4Qop?Yi1PiseX{%2o^+XwpF7H!he1M!Vu+{woHHV?f>YU zHbIeT?uk~xiXt)f)&MtBlX4?Vbh5Qm6T}iHiSkRU`pkv&qZ5W0O6CBDBUC!PDegf} zIC)=Y>5~e!l~UgH8o(KNKym=PgK>s{GLz%PGG!SEve4hmvt;AOA(Bb1~N8dPs zJyQ<0T^7Sn8HNkyz1qlf0(vm-rKpGx3O+bPK$%v%102^$CDOz>t%MFD>Cl#7361>$x4EZtWS~+F;qCe~= z7HA5>tfd-2`mzB0;qnL35JJQL3|Ng?fr@o>holcc%sEaTo|)$as?XmX zjbl%F&Y9&?x_Ltg$~d5W9b2HVKM0&A0M#=4E<9UcW(a}yqpu}KDFL4f#>5Vko|g|4 zq%ZjQs!mAQN4+*i|MxC|iBtw#7{wj5@JN)9wI{eVv?VVkp$|gZaJHRykyIyxAaB*6 z&s0ZBeZINDF+SNNhYczR`C;=MGS7}xv1NVeOdcc(kCw)RMhTq5Q4%!NA&K9L(HaU` z=Ieyrl*)^>z@RSW)cS2tE>%iXkWN~c{LWH21$1dvX)7Fo(^LTR`he;|O!2&HQfbn; z|5LO}t7p;meG;WA`+b$?Z`M3{!&a0AJ`aj>osYjW>+0YSUg3w8p~fQ7&WFX9c=ZUq zki=4#2>EW0<^}m!tj9Ivu#gY_0T-}P_KQV6@d#&E(wmqm)e7uOE>vRIVz;n6k!#p zevNe(Q0bvvKD3s{wOWDN5Gw{U86t#YKU|YjC&-BplVog3LAHSh%67~n6D~*+67t+Y z6);65V!hUtpFAfUS-h>ww-^VHpD^3!)_QyjmEi+uJNid=5B4Y(DvcYvIOYJZiaaSO zeE7T^0W)3XTxL*7cz3zs0|#iqTL%1@%DQ27bRZx8Yhc=;!9scYp{i_20$PDCt2B$>3|!nGh)sZ+etu+Gv2}VolK&(Pe@+d@UFgUV96=1c-DY^ ze3YJZR%ixX&K*H%v?DXHPM)U$&!6llP)W_In4JjJIL|b3q98fwd~`UnU10%41WJ1H zRa*2jVmk$`L+wHOk{#m>h_NUA>AYKcZH6 z^$M)`S7j*)Iyx0CYW5;VN3X!t{`d=4X$*LbGhAyMqd|@T9VN~SA{zb5eMt4ojCz?Q zd7>nq#1J%XSOVI%L}9_Ax^kFLR30EyL6|^rI*BT3Q)4r*ws zImirlYp7|10cWE_aY{~6ThZCg8U=_j5W2MDoIB8XnMN*d%q?KMQxOI5;G4MnJNZ5b zNB9ajK4;VbC>#6ZoIilIO^G;m<$pWTN-lMvU*+Q`dfktUp3os$Rgx!1!bQjK+mNMh zSCn$%N8J{tsk#)0K4-=$zYPriqka0(7krL-a>4c=~bkH1>Uy7N&BHWCFub~{z)p0Wkt2iDcXMWDa zsHe9(7W>Xj9vWvmQg)GMFHqZn2%kPv;GD186&4beT!Dp>kaQNcZ!T4ZLIYE2C1j%j zmrgA_xMo@3(WP0B3_U@|R`G*OQgEL66=ppoyO>r(yHt-3^~y`w7! zRN;3spn6cFitLm=L4k#G4s;~zhd2WRdCX$`#tNEAZka6j#h@7!yuTq_)$4`?R6&tw z5Rf)p`d}a*EK8cFwMb?)(@J$_l%JY61ngLK%z=(0+bm7gOwao2{ZtN2;|Ag`ugGY7IcPqRy~MeVpf0I-m3dku*ku+6bi= z$QD~ZfZZCP)TGelh4yB0h>gM%{ngiA$!LJIj17>Ex+w{R1tr@7LWB)c8(~Liga;RWRU~)lC@K^dU}R8Qs(Vz` zECy7+FHV@~fa_NM{`W`;4#Cp++|r3LP_zH+P)C@c#xxA6iq!-~Rm{)jD4!W3uOtFD zM{Aa`s+((OD#gHuf=A*kxi;9AxBjvxYa>-QgPxb|GElEF#3(BsH=WKIz>^bwY{V)< zofxuYCfnB^k-@V!x+G3t_?2O6pf)f;b*VhvDML*kdQPaH0(2@L6&i_xS^%i=WPNE+ zo;x;=f^d?`E*wfWk}My0lJ({r1~faOZpx81zyq7iTG4^@!8VfzKID~-+2Zn6hA2`C zN9bBU^sKM9Lln4SiJJ>}s|iNf*~#EmUZ$DVW{So1#AWK?2YfP zDzZ1BmK#c|rVkITSlQyu03cVut`K5Ck168 zKN!}D+S9N9Q@iALval34r){(ek>U7G?jY|KG68$wgI`vhXWzU7#g2|X;DDP8jXGw? zmZfu6a$L*frlrb1V^qG^Qj;KVVpFKshMhDxNqN6(4=TAjq=prjRHaMj*J7KUw0XW7~DntS0W2|z- zIa`B2gj2nW!?S1U!gr@bUN>b8Le;@5M1z|+qa{Dj(G~#^F1?HV(h!BnV6+PLypjWm zmvi)Ik{o%4g#txB_@2LTUW^?*I#yq8wODA-d=o>r4gD^FS3L@S-=6U44VD=>H`ui4fNI@SIRbdYBVlt`<{Uyjmvqu*IG`kAFZ zFi(BK!aKgMAJ^54NVc;Hy9XbP0&?Zzqmr|zDSFc1KD7X z{4u7=!k}N;txm`U3!CwZO#0x)FA?)~6I&X3v>peC!?i3~tm*+l#~?D5TTJF+Ss)%x^0cMxIrG=+Ih+ z2e5Fz^g)0>;LU&Tkjx71Pnl(Yk)H(L?1nF-jqu&_+rFb(`0j56{xsXRAsx`>#+N2ajPuuY@vkf}pyfOGrF+^6|KUZG^iOy4!b3;e0-w(+5Tf?o@;jKBZC;dZ zQ^=qIw7u?t{ZIb$A8(4TuF>WXRyEO zJI|pe*Pn zSQzuun%azK8F$1%pmP_Yl1xb`^cug*0HGOENIr@;Z&B%lhuSeXD9oBUJ>K@VBjcE3 zj*COza#$R6&_VH%m%KEtzy5l4_HOAguX$21_p>QUng1!2rJXAs`OWsrbS_^16?RXzFjcI+jkU&`iZ6&<0AO zO-0)vqSI&0h{Fy)BG!7r+VSWkkK`anHe{u9S+*i1;D{76KQ#>~acBdS1586U3!ZANCPFs=3FQ?^<0gu_H;)RSub&4}JP-6p3PM7fKnEZd(0@;V(NWUnS zELt2(v?9YlFk7$kQ=DNK-rO%s-E=+kt9))NUq`yR?nTd|ree>(cQo4(Mi?TQ1%&uy{AX0hk)d&I+!JnBKy6COL) zX5aCIQE^|}g3SUZ3*7=4<@dRU6$h6XRJ2(hUM;(UGf86|(5@*9ecv+qrv+5ZB<)`* z!;5y}p zptDGA^vZ3wjS-hzbiu$mUph6WtTNRFJcEIvz+0L`WeJe2N`P-CE5dD^n{U2F9D3Mc zF>d_$xbVF5;&;FMZA_Y^*_0UUWp7mm?QKO>&V#{zn>&LSLMkA`966{rzUh!S;0-xX(^{>TuFa1`GA3rY3bHTW$TXpaNBCAo! zAr9#hcFJ^i>Vj{{V1+OM>l}F*ab4m})yp- znuL!tRZ$%Efd{=Yjz9iG#{1;QPm15&aDxW>F~Y);K$|+Cjg70kc_6*DzT{EOnbDes zePi2_#RHzwx%-(mhXK$2nVA2`9vqsZ(92*)X3}1@EG*6RAUW zwRtkO+N!I?m(DmrTe3N9t8IxX&x->DQ+uWlgnO6Bz`>3}J*ockLCd3x z*ly%{Sa}P8f>?2D*tJPW8^5b+vJ8W4W%2yOi(axxth?^|amb->Q>9%tWLljYM>@L7 zwKhrD!?P(e47L_orXnz~>T0XU>)&`#tiQnv5jF@z$5qtqN*PmJ3G0P6Q?NUsX-i&QhdXgw{oD*N>8*gUN^Wp zJe|ObfF&3tD*j-xCTCX3Tqcm;8sG*KYtk@1Wf2;nxLEVnj<<~9OCYgyKGLhTRi~~V zA2|LaPXF{NAB%low@1A3;Md1tZ$DHk=ee46bVSdR9<9c;>e39`1|l8Q_7*AY*m{<{ zo>ei>t126qCoWt|Wy_MS3hGz66x>c{)6F)E7pXm8tX1T2fjk1+Ol(;os|&9v6a(rt z?^OKX1Gu6#f;r5p71tTcstB+_JCvj*l#E8p4hHOp74E!wbF=?|qqa0qg>*h|_Pjh7 z*unaPvq*Yay}?^`EzA^NZA2v*6pvjxCE%m-7IV?04-`~yS?dH7Bh9$xja++*tRFjc zpJedks4~LI!2mvF6SA`nH`*v(vdJcDf7yj?V{q8`MK6j?Ub;z4(4?oeO{urcyi%+J zezAd)$;rD0Gt<{`uxDk!3oi`r>0`SqG@%+Td{ZpHnzZ-ySoiEe&=$y79Xk^lUK7aQ zMFDf?&GQ7_+w|TIlHR~C_6R^Xb=9n+LQQ`@0BMH?>!Kx8XsxsIC(#^`5xLX<*s7iG zn{5Q-V1xMCIvDwbsmYkQuJ6IAMF#+sY)ecCIoE{P+nVy}_>X#DhsPe}=YmRlm(B39 zXKcs*9R5V#HbLErv$$brht)QInnBNxfxw6GQVM#798(*E1eqj>Abh&v7-Tdngt!x} zrtC^pc{p1LQW3Dxi(ed@ZN9md^$V2&Aqk}wgoR=7Qd$qAuCf@s+HkgVQro<8yI6aj z7nlaLED*(|q45(Y#IJw#%Q*hH_s08=JtnUG=}$GwV>OpT_+qJM)1CfF@?H(rXzDx4DxdI9^-~}i%kvC0FNUIb~)iwz0wjugABTi*u>Wv=UW)<#dHe0L>#JTB zJMXYV?7H*LvCB?7E52jwr1MwrxMS?T>n?H2pZ*kM$BnVWv(pk&)Jq)}MZD1usT>|j zA`q{@ISIUZUMr-PEu9Xu(qk|xmf*OzA`wf0cE!ISpI77f8V>w$#24TjiK`rKhLEPGbA}k& zpMN81=b1Tl#>$sIqsdUO#sM@+HB3^Nc=*nGwSRrKGO1CWXv2emyZh_CAlL|f(Kn32 zvjQOhEe13gQQC@dXQ8pcfa&aL41gk$)lgH#R{${L*)wN)AlQ4K*BT!uN5_Ex&)@k5 z7Y%F(M_}}&j?tsX#%{as>A`mXf_Z5$M|6A$iJGvNfCzFiK7R*1bNyi5b zMPT6ip#0>1I6#sbmIpte zU2na0<0YD$_~I_JUF+Kd>6>PkTRC}6)Hj>Zb{H#q;0`L+(k$l(RF#N6%(wNH+Y4M^ z_Un5bm;mKYg10@*$}7b=Gpm;}`iaXa;*x8$dWp)i3dcHr#e*2Aygoayd0VI&C!bOSHJqT`>=PJj1|5< zxWjha#>=(Rgkn!$ua2n;bi$2tU86>6u$&gZ{p}6r6r$mr~%Z4817$&9RAv)f?94SkWhE_?Z{gPUI; z=Fyxoi(`$o*3ydZmGR(1560pJi%NYcSd5Af1{>1GjUAi&^{SY?-K46ZyvBf}fsDrz zSROOb*1?Wu^Yyr5kO%;6oJl$;6Lp6{v7kT~@al%fb0ehy0YU!00k{K{YjaQ+hPiPA zQb>@-T!C1{%5)n}3y_+hJj*Z`>{Lp~1b))6jE?{cT!S2=2?UV0Khvp|XU~+y;I*#A zdCb7q>EPb971t46sM$QI@fxK3Z#WxH@*x`3jk*BnnzK@eql)kh9lH0cl;mJ+2Q7gP zK)Eb~25adiSf3>{pe33>xeTBU)p0A-oTX?k2i&(St`2s*uFgFvxo)tYk>sOUtO?0y z#bZ#IJuA26y@KIL85dM2HtDxT$Z0c<8K=;2)9R<*JU|iK6VXH&1W-*|Rg8)d1UXz^ z+5sQp-nuj)&Z*eeM2>ev(spDoN~3RhkQ1u0)wUk!G`Xx^3%kh|@G4*z<>(vC6mMtO zg&GRaII^TBaB@@Mc}#wQ%xQ(x5VG+=@`MQ!Y;#WXZyx8f3ngGR0aZjz`>v~weqaAx zNs|rtCn4Zp>f=%kJ61UdYXjYhj`@dd>eTg;u0tb~g6>x(4PfHvw3hVNFdT?dBQzR9 zz``hPif?}Cd7dECtjL?F%?ea+?H@LQLLetH8Ryq!X=`8Rp*?w#NVX?>0T{S?8Qe5Z z@Zh&sV$vTKF&%&(MnQ(r;Z7D@~pp`@D8PS5754gG3nNp#TII zBh<|x`=)~qcHYS+eash!Q>lnmZc`O5!m}^VZPm=0akNlmD|FG~B~Ir~K01V#yxh&T zXmQM&H$N84=gvO12ik`TUp%NJZrY->o{NM+)?Hkkg-QZ-+*wXC$3{IDjgSn%$}`s z<+gP6G;jXgn6JPcZU6>1ckXQIc$RSHh~I^li$+?~y*RoTE{FjclHWzBhQ%g40g+H6 z-PvtL%2S&1((ScEo(V$%*=!UIKsBUip5%6lenofDqJ`pZj_;_PBiYfz{Q2|6bILv( zU@r?6NT=gnX9bX%cBb3{*%XsC?38Cy(FJ!o`wc{r0y%Q4 z7^!eTxfM5WKJu$>Y}x$MzVl^oOI$}fIoXczy^|r;FI>1N=7{#9h1e^XBo^CNv8P#c zupiYey8J1oX^5{r9v6_l?abM_mrk3P3Dj47X{6ngUM7_lXgLNCCRs4irdhME@fKc~ zMOWv^F`uQ)v_-PddD81_^-;@KY@$xwDqw{kK#*1k+Jqb5&^f6%(|Kz9+0u1w7giW^ zW+Suui~_pEZ{Yvt^LT;q;RWBs_AI^zUD>%SaDCi<1O8^I&lX#mFFo21@SK7C4c)7P z?Og4G9W1aPD|fTIFBiMlk-qI4c~r(?EeCutine7nqAyPXSZI>bWBHJXzVkAb5R50g zDE%5)>1T?my|P_NuYQ0_Q2y6&R_8i;RowTH-h>H69nXBd}H#9?ttz- zt>mOrD@eiD=%`z~V&U{&&VgqCFE*mOmPp663zx;9X(_*b$;AU-|H?TrdF7Q$foBGb zGyuHv72C!qPWfy+{J{Nj;)nkyzW2i)$F!%W#ruvsI%ZCv;q3`zMy0KQ0r6bdh2Of& zgV-KB?GU&8is6kNJ3jvBBOlRBc5Hm+)1P$1v;DtFs7KfC6tm@V48VuntR0&<8N zY2)Gc_m^+_^4N2az2k)&Z|s#J4(IN>?vCqzer?=+=f7g?xY2G{tSmcpHY6R0hTdW4 zonyD%_KeAsSN2UhH0l$NKNi3G^_lMnQ(MRJa zKf1!V)lXb$Wjh=$;D6#XpNmm4w(%1u#9C{vZAbaw0}t3}xK?`k<(J0RTW=fdt-GFP zTph9g`s=%cJ^awa>VG`+-x)u>=IZ$FWtVyz>Ex47iM7^VJ1+Rfd9JH#RF|DA{XypC zqixdr=xA03D<^RGzy1~f{LlRwU}wZpN4(9Q9352vyB-P9Yz3SVj(^LowsCu|yWR$V z`_3Y*`ftDOA92->e;6~SO^aXM_y^xzb;5DS#$%5?>RBW*9P_^S%LZN^A9~+=W5)F9 z9Li~AqAHzrP;WV_jZ z`yJx#?>fr*d4cpy`#vt4nWc%N?fi4FKdSgz0Rm_ezg_85~pvn0N z$*+M-2-`@vJMXkpth3%awqb4{`Rm{Q7C-pmk0jUl_~G}zD;+-&?>+8)TB)gTiVt*k z;)hR&ZC~-q_~u0y$92E{bxf08{PNmsH2GT`E6WG2zS^qR-yO2uQR=5WzVf~A{~*5e z-OJslk2>;**m|q2a>=^mgv}9|FpAxZm(=mOVKyHqDm_JL)Ao(233NEg;%Q89>LgM5PKHNvy z0S!gF=1nC~q%QTXGI-@>E7~nr_Y6Xmt@K=j^5}@Z45Bu~7jttQ{+_sL2*nd9*$2}y zq=g2+(94~`rY%7Jlv^uz|7B07@5Vm*J@4^K*2dK+{S1L(6bHCL7u+n#&HSI#>>UjK$SiicG-fUgppZN5bu@y>U}XBjUi-S&$7-vu5tAlOl5<@z4t(Pq+=lI7IMa? ze(B8k^k=>huiE+5=4tXulVh#5){5Qs*fWki>fIhVd&DoRA{@}FtF9^%ZSkeEzY=eI z`;o$3TXL)wTd5;5V`YX(+SyfhCAW*QvE!hkOn33F;s!=r=ig7K-v9T)I1E3*DN&{kbUg9adGVX zKNw#;`&{duHePAcN|Js3c+1-ki}NnLBsLX)K$g!gO2?vCuK&UfU51O^%pQjV9fC=~ z`WtQ-FP3dFp};O%f!X+8d+#GXUl{Lw{|92non9^7OqA1`?Ctqo<(xkJv6DRLQU4-2 z+|9SxQg(D+eDtJG#7>%=pi>^Vd69JZn%C?bXK6CV;Jr`-BD{8L;xKjURJGB{eh~sN zUK6`j)IL+DOo^3No@__Jgox)%*H~jM-$LK1&P*Ck3`H(l-0f?iANrpU$Jf4oe!St0 z2dUj&VmqF)$`sYPWgK?I5pn)Ez7f0bw!5!GQJ%KKK`hdw>;>zt8|$pIj_hP|?7Q#2 zarvd+u>)Rt@=BI@i_JIF1oqhY{AWKKQ&yhhRW*|%_Xj}wV_@c->+(27E+g<5jGbQ5 zFW7YptnM5T_xn$k=}Ct2IeHgBiTI0&lP1PVC!G|ho%#joa_?Au)zxFNU= zJud#{`LS-fsjUHKP5wqJrj0akue5B3jtiPW5;3fzU=Bj{KRKf3?-}I)q_`+|-;ct6uyj;GD_CuF1)5PN~ zZ+S~xbm4_@^wCFq;L8V|6PPU1XVLwdYpfaDzVelE>9@ZVhaPf>e9`K@afSi!EjmB% zYhRO$>&TC31&Znl4Qmj+VG~7v*aiza>(~Pyt0QGA&l3pAK%h*PRZxC2o#BNWJo2)W zudQp)j7Tl^Hh^i`U4Uv0n8*dcvlfzt3gTseDe4=KO?~PS8TZ1@CVO#RB zBaV#2-u@16Ieh)A=f*96{G%FD4IoYL^V-+OTMs)TKJ<|jH7mO#?z{J18UJ|6%T~{l z*hB_>vR1Tg+5Y~9-^TZ}5_;s3hunZH|F_wGyI4ajG4L4}nW@xmvNyl=Z7RQMocX0Q z;269e*fF+!Xg5!~cf2PqY~OrUt1WoMQG&J2w%f*WANWvw`g5n+d=r}W(;=#k zp*NJb3UmU1z5Uw30Bre@haQU89r%X$*va`E;?+O?aa?`Xl`-wfCq2W4$36Di%k9p} z3tCLVmV~0vvbTF!GRLt(5V_w*Sa6dqa5&;>xYxC2moDw_k z_$qIye&hVF#~);Al)6Mbav(EDS260@QZ?;*S^s$dR|7~*SXPxzB)!!i&vR&veGJDmRy5&;r zrENm;`mH5udfJc)AhZ0mkqYSy`(%&oBz*M5kH#xB2t27a_{vwm7JvWy-;KkKE<5eG zW4vFh#7}(uV_CFKZ=L4zfeTmiNL4=>O}^oV!ATPywHp1#y*1wTj(0f!l5brSKl|Cw%XPp07(aeO z?7sVM@eWNi-mX;}?RoLVm$-ea-7`=CpEc;kT z1NnzO^uc(~dye%WgMFYeR%;T`Ki;lIv8As8ZUdb+Q^?J>u^o{?H&g_MRLZ`j+j#X~z(IBTbcK=oxuPn<1 z3Lg2*F^%#jkp~~EoU9z#Ip8{=4kNkIrB`Lli8(UBYL%CyEV}fOFc>O!cu9Wit$&R> z{&~AsFgx$Eo39fjum=k>12KKt^f>&;qn!GuKm9rWddr_RqaNk+3Wcp@05f;}iWZ#; zU?$DB%7;(*VBB@r-FZD>-h6fD-^Zz6_?(PSo&DAo{xgIQL&X^uwIrGc$wR6sP{s||3+}lGa9OGuC`N9ABsGZ#pzkhjrK!fPt z|Nb{$7h%h8wrE^?_0@6F1>f{Q&F%PwT@QF~JN$_F?59tTOD?>?*JOBO!}ZtyCdO#x z$;Di5==tKQpN|i`|Jbwsga`8v{GQ1cFy1A@8i2v*jEY`-X>wnt2{`R#7mPoE8-b*L&9znnMrvO`Q+sRoo z$N{^(YWw)UBr}+G| z&wn;Pcgo3e&wu_CbL+J)@xu1*H_!XJbp;J(x{o~kNPO(WC&Xt@`BdEYkH35H!?8X1 z-~;gm4KO%`^)`5+CWBiw>}dM588Jic!*iYh+wIto?MQMn0l{5(dS0N>=at5_s{Ic* zz=IqspLZN_SX_4Lr7`V^C*0Oto4f0-yW+IdPK}RzF)L3yqnUG>wS#VMc37dPy%!>eM=wbtgeo3-O zdK*d+1}(t1lgqJpYY^_14RFUCt5qf(TzBRXB;V+vfe=T9t`FG%01tB5&|Z7)5!e6v z*S3dw^U{{TC3)ZcmP0)#4FWsM5-mr7G`6XyX^@+){;^f05#&c?(@ESq=U=jqj!bj+>)vohG;_G$_9&!e_`Gi3&_3nXKald>39dRA}6>EaOu|*mr>ELbd(@< zVu8Csw4{~v(*G%5ToKo>nf%e;P>Y!`LnWk{=CPi)9tq$N22wN=kfP?!o|7vy!G}Nk zF^|-KtAc^|U-qekjgNy5&YMuKy7GtKIvYHbdm2!6-WCy8wG<8TnNOV@<0ee>ER~1B z`LDbQ*72lJw zKIpQOSDxb87Y=#<*B=-gZ1}>s@%O)rFP(N;thCZfF2*Z=0%@%_ucE4q_o?6|Ss*C&k8igLD`&y_#= zp?TkMqZhj#jD|bQxIS1rCwgW3GM^o6x6at&>g*aVTIKFD*?^yqg9rZq$+$d*&}k#Y zk^1_Yno)B+83XMpZP8{5=uPuF*WU`gGPX4|6TSBO-^K6${MY!+O@DN_z9oGB$5;7U znV7KiVB7SKT6F*?YSIF4+;Wd@;DI9(i+}#}Hm!tDGv4zFbZGQ&u$(6KUG}Yu<9nBW zCnl{lF-DIXoen^@MLUgC8?mL6oh;;JC&lHLeJB2K^UdBe1Rq@zaKH~g{80SnSJ%1E zZM@OOi0pXUn{;02Fjz2A>>Smp$x(-Ns}*sh!3&H=+{_VBF#Klj`dm;d1V?njh^H+BP7 zow`a~{qvt|mGOA2vHEJhzPqHG0d1trx;UW`+%cJV!S%DMmaVfYz+RGi#LG6_G=BGo zo8u-;a&Nfl4-UV*@#eVx_cz7$T4kPf?pNZm#~ybd<;A{SyWD5L{ap6wquv!`M~(6I zuhH}^@x_0at)jkn^B-^aHLMD0jw#)6fW7)giq5=o0YC;n?oa~hkV(xa(03VtnZz+! zJLI5)oc{SQoEpFQ#dV&1()K*kQ2ReyzrVchSH4C%UiN%|{0_V`SPq2~Pdw49=<#F5 zM+bM3E8ttWzQ-U)du;T=7l!}1RCduffF9!`8thTUa0(q*)1DsdU`p~~EyL=S` z8#@MFyhKBOfF8|m7z0_iCLSyZ2uw`+xb0v4x_5wobf_+XK}-6RPVy!q2CO2CM`7At zgO|?OZUoo6TjHHMn9!hiwyyJXPtFpi!HbE1$qF(V}|?cSMQ<$WJ=t9 z=biD7TmRsM^!?F{aK;~FFIhnsG6 zXMwhvax1rX4K*_ZT;Zt#1JzWn)uBJPU^9S^Bjx%Ib#cuMJ@R7f8PlKg4LMIe`4nVi z9IDUt)&Yl9|MVdeNAjol>+Kmb=B44 zH`o2Lq&$DXU4U%!ZT#Yw`25=%=y-mO&Wzmv)}1?H>N@qMQ|Wo4_~rT{TYbpR>TI^! zj2pDLgYn7IX3S*SMGnlywOB-jpO z#nm3S+;WT4_S<)#m_I)UI#*%A!rNvuwX(+n0$6T^ahjywQ~DBiE|DbzRwrI856Pk< zf;d^P)9)lYt+NiMeV6Njs=#3p_cKfm_cxb7Ff^kV=3PIZkn*YNeL`{n2# zxbJ?yRt}nQO-}=`y|vjg{`oITiuh1G@nA1kPl=F-l+>=UM%w0HNtK046 z6BfqbZ@bL{5`Kktai3B<(+_Cxl_pP$tFFG<<+y%FpBg&QJ@UvSafb%8Ng6EukiM!R zASkf>9>W$SVLG1#4rGb~PNYnr>8(`vszsg5C==a%P@XgAN zOG5tlZcSKvd83u+VF&aB+aU$uOU(I&-5C`)u_f@E`RIWa9)lU>8I;)(VEYsBvvex% zfv}wcPWtnJr%ZgR1KJ;73<{-&=vqiial%``L+Vwq?`DvtNXG;-=Q{fs3 zoqL^i*YnoWJ$K)28K|E|;;{o7wKDC-(I=arDa$W^@pIq(#-QfJ8UUeU0MN%E81PnG zZM8W39Y@9|KmD1w{E8pNJKz0oqw+ATXPLscfn%_=egoX)-1wetHQhrwsxr1P=#(}f zDlbj~mW7t&%DJJIEk_%CZbgv7FM43h@$4^uG0r&k^Ks@GXDFQ32xolZb8-2l-_C(V zqfI$wZ=~r~c4K z-G(uct^Ug_5=V|BoFKV2*kJuQ{K$93CqF}*{Wx~tV^5=VS0BnuZ4Cj@#9He1O`|Dm zU9}C=MqH2Cc;k(I$1Zj_lhyYydZCE>gW8xaa@vV&iOi_!4~=FOaATMU;z0lt*}k-ZpiNl#PxMG$)&A_bJFnvq=Ke6kT|rDq`Rx zQa*8fE5O7|g)D>n9lnVpzK%Af|M3xV&aqGH1seKzG6GpsGYd(0MPXix_e`z7rofm(^yWkqNy{t?YVfQ8<$wSXkpfWi2J3I&ByPdpY>O?-7stV2OW!KqoMEz;%#0+p!1g1zm$RkC z^GMW19v55dtPeCbS&pz${`q#&IzW0N;@@Kz@A6$8L9R1$o z;z=n}YO#4$wzQ7T_QfG$<+E&jkvBk6&>` zDd`#BDP|E2GES9YK8@wjS4~@SDCP_R%C+(4afV{izzRUlFzzs6ww2(8f8m)DahsJ=U zMkst36c>|e3nMkC=~Oym`;{Ya+`;L?Xl_M`6Sa44m$9`cThK(U+5)==9lZQqIBs8k zxr-a%n%qdP0g8?tdkSNa#FroxX7m5W??zHJo`PvmTcJT!nWa#$!)XFo5>uwZJTn{2X;o?i${Fc* zsR7q%WwqPRJH;Nm?Ch}DE<44ZI__PiovcqDd zp0$+g7!@*}23m2r*1<#Nb7s$r&!6$d_}C{u<*l&4+;U6&_(xa7r$6!Wc+-LV#mis3 zQJnIrPnr(K&di7l;|y~7=9s1R%7ev?>!lbh6$9df4%(dAlOg?yCPqdPnkkzKo#wE~ zsXK!*D3`V72TD-E@My*wazdw;QOH5w-MG}KpgI9}XwhCCRQ8(yexXz{X^%`v?)as_ ze5_E4I4A@A0gOenK?Huqe5TO}m9J#a9)-ge41?S^G_W0Y^n2VE++_9r%P))1eCiW% z(18cU7B72o{P6ofFm0e#nNWBWn67B@2nSVr@`24)0I?urLw5E8wk2^Q1M1l%!52Rq zaSA!{;+p3;Pd*sXT)rr&)=-@(yb;npXPSRuuma9a24Y{LxF4>jJYU*ZGO)_Un zO{F${Ajb?PW<{!&iXcd{OuDRu@=QT>pa-v{6nF%IzaoNXp6g;2Rb}D9a=($t0`OBR zU=ocEbZUBPPqy?126Bs!w1m`8YJ%-R4Q%ZlohR0UCiW46Uir6E(EL^ZS7A;&H zix+8d(_jNN{6$XSL{mhW6tKh6j~ywUzy5No2-&ML;h+OJuBHG^@`G-ngDiyIhZjZr5&If;*Bvu`tyLLBW;Af$x58`S@;)xA9R_V(-+b%WOwy?WKx4+ z*n8$csVq6TJOXfm{A=f&a36*oyM zKv4{)a!DSI!s^M;TD9_0uynPUU4_9MhA+PIa#>)NRaf%^n3Q+J;Lva`IEJz^!^zPQ zBxS?6Xsoy127V-f>oK(sH-xkeEezg!;P6u#!mT2}eB9VnY@ja9T<6Y-*Ggx*?!HId zdFQ|5sCOI@ha7ZZoOI%c#>4sP{$#?6-dcX#-T~zywYby$r~jAp7nF5u8JN4@a$(I z8vtI)=ir1ZlU z?c3jeWURlz266L^zgL?b9&bPVt?}j4PxC~IXYwq!+NJ`eunc5`PHM-jnSOTsS|_%` z5db-Dn=Ed(2i9F@T{|?(C$I(_#a@vTM>!BLeaTC`LosdUjMNkOge2JjXeUSfLI{MU zUBOgshYT^2MseDPXQw#gjKE?mj1_wYs5l76{X{}~rmi-p+2O~wrnGu@@MNumdb+W5 zainzK|LL+S=9PzV@|i{f@`wWRd6h#SOkoVJ!yNFNwgOa1fqEPsM)-!4zy19mK3i?I zRW*T_5PiKkTKHn($fUI|mS~0IiLQvRx!P*R=P!$qU z&h3|Yl;fri78R_BeKQ-YHVvjo<9fAHTcAOWXEwPvf*WUgt9?KR-Ggl%%0{doXDCfa zpYww!&AyYJ9*x0`K&K3P*ltdD_{E+nC;H+u+czitObBz36PDtFxkhqqt)vX{kfa@@dg zum6p2DXz{4$Ypu~3E|G7wAL*E3(bsGAJpy=EyY^JK;bMEs9`AyMF)f6^+CX9n{DQ| z!=Pa9I^r6U@3>+{qw*c*%G z(?+9&BFs#%d0@e!1zP#O%JFYsa#8&2Uw6csYpvxiwMi>Yj?o&FyO;3Cqxn8dRUsq5 znPIa!5uriyVqwY$k6;k84XQxK_|4#RA;VJg*@UKydES7*NQR2$PGQK5lHEw>oV#Rs zaW}Bx#vA)>6*%spfbO~RVvDV}E-66T1M+i6EVp(8lc!Gc)=YLwI-ok8+J#%BH-6EJ zjpJ*ijwoO4#8&i^Pd=gcZjVj3*wVLg+i7WXksXcBBPhz`msex$w#Qy}P?vq@J27qA zbPqh-Y{Xr7Tu0?5rb&&h`X*r4{FfazS5o}7c50)Ml+`6zaUc!E{rBJN!GOQO;TrOi zg-cXKc{mTsK%$^yr%dvIzutPQon&!gSx*ZreKt6y0##*?RKE0AXXoJiPG2SG^`pT9 z9pH(A5L~v(+R(3#I=$nccNiBRGJ4FY=# zg(|3CnjI8sx1%JvGA1C8$;?owR9HcCqY<#lOI{Ka$B);<2wQ_U>`eV$Cp-s;jqwQ4 z9=q>ud|pq;H8E^C2cE3h2iceh0i3(a+24tO-T{ga0&woM9lpu$_Ej3!y;xx`T%uK* z1~mpYE*a%655tf6Qhhm?q#w(~tiu2Ur48uk4UIV&oD5KF6Rt}cw}9H-;*e74)`@) zIffs6?{c#IaP4ld*~cC7nyapi0haCUY2emxZ_cs_~GH>1@q?0 zK%2Pc8^pReA&x(w>I#%^L^D>;TY)r+1KjTX=%WwC?fJnI<8G3oDIe$~Dl6N#@BaJaj(`2rS#Le`P){)F zBiSf+IsRn=z?)j$bIdWI#$}gX<_DB5yKx5VIUyY+vRKaH06S1oYI9$fQwure+;zdx zC4#Tj74VE)$9{PsWW^q_U+lgPI&^IYll$+v$9G(=x#pU&^($WC6)esYyI>#ycy5#} z(&Iny0iOfdIym+TV!mk4a&S%p+xgTxN4ha6!@dJvgg~G4pp&^npg(wJ+gHEwO`je6 z-lJpQ`~|*YhJl3}a^rB4f}c71T%`Fbo~>Bmie zqco}JI;KGdkj>YH7ccUl$*PU#0eMS~|BPC+(Q95x;n5=Wi&QFGCv9yC;uV$WCV_GX z`4FxHvNoCj{AKrj#Q4QvJ65B_!JLv>NgBT=(*BQsk6-u#n`}r zTR)PZ%5BM-8I5GCTs-@xJ7l1L2&ej3zZ9Go$g5uO7*JUnTovls0~BD@%oSaAwlhQj zhaA^GV%OdGjEyzpeR31!#?FfJ~Z;zWF7g=aMhJXgcu$MwFJA_<~H z=U`vigONF+B#LYWI+YY7W&HH2t86U1HG;v8&cc=gTTQ$Od7(N07mh#vsn5i=+il-? z5SwRVc!SE_ci$Boyl}(#*e5>aJ0p4KjB*^OPkYLDkG*Wu&HVU5?kndE7r^NvSzVI% z_UD~i3~KccX5aeOxA~e153x?0F)g0dN`ckEDW`niH_-qdJh1^})r<-qG$9?G>r_2C z$TA@Cw>^o-V<2NkkBwOx==md7w}*gNp6&hG*T%8Of5`9pW47o%K(Jk^yelJ=4AK>n z0yfy^PR`7Ch63;Ds{uXX;CWds@?)gTbbtKA@3|~*ec4s3Bvx%ECTGVTf4n+PyXv1F)1RCcPdxd!bTuO;$}YCuc6-Z+K9P|}Wq6|sX|u#D ze_u6Ala*DpvODFoUocNggC;~8nAp+>eCMg`W#;s0o|)S*sO=hBb%SP<7Yi^DU-Zoj zyh=UvZHL9Xj(WHIjCD3^w)y4-3Tv*hMtt#$Uv#;PFS*1M7WDiZC}=M%=S+bdcS#jZI%%TN6ke zG=Ir6YqlmVWhK(+v<*mF+&%k?Ykv_uqO{#BUl}K#^ilUuWSODKlwZQGHW)u{T%2<9 zCt{7&SC2pb;SX`kpZ^@=#*B44<+Zn@ht9aG)Z3C8)OZH3y@Tgs8K|;90UVj|F$rgP zjK=_ctx9?LbbLatc353Y6Uy_oTk67}VpCw-anz#_J;@*sZz6osX;|neja2^|0DVUE z(#HZhs6xtvj?U}0F_Uj5Cipgd9Xy#V^%*J+L4zE%6F?;7KxPDe@!wn*#2-N=Cx%rv zaN&>PSCc^(7gnwAS%C=9NCf(d9bqBJ1IaUHO!up?ct{jw|4gg7MOu|j8qM==1=YgA z4d?laES}-$#K^!X43mqpoG%(S5(KE=ILc0?lW*N9xf)U)Rf}c?>}lV7?>+I&^S&0x z9Q(d_-v>Sz+wHhx{NctMy^RF!)K#a(?t8t)*ED{8-7m8W0gjE;&Y5SN9-sKsr(>&a zwu!HP^TPPq)mJ$kBcpNOaL_@1)5ZxOINoJ_du@>h3&g=e3%LQBmREp%>(Yy3-+lLs z9d_6$&N$=Dxap=FRi2kFcf|htzs?=|+G~Fnd++@kgwo8Pk~FGl6AHLpND_JL$^uAs z%@Ch>;)!@%PK3K+d6(lqH3?Z|)m1!W{_z!81pifc!bkFzO8k%CS*M>Soz-UrNll)c zAU;Sh$+S0v@gW+lnM^Q{4F%G8vjxv0(s}tSrkj5MdkuC!@b%m?&OF=C+&%QbeYC8% zlMi_PfwAgptHo)b`%L`LM^AEfStY-Hens1Fe|=s2Vuu}K&%O8YtHOTrqaWId($V-= z^WFE_JHGMtulj8o2*Y(?>hD#1Fnhk^_S@ofpZZjM>T{ouLl1v@Y`)btaii>*!4JEd zq(SaLwJp5=`q%ui?d16CIp@Tg=X}Kj9nb%*xKeY{UNUhU@*Bu*$8QLmd;j zZ~oKG@z%o+SN={hcg}1Ls87VItFErLzsYY|Y4(B^5CI-W=l>c{Kkc+Q>7tTwCJ}V6BEA%Ofqkr_#N6bHyF`k?I`A>f)dwhxC zy?X9fziJu4!O`+Eg#)EuZW25F)KlYx4}Uo2;sXzGARScREgkiloe{n{?$%rX5%=A9 ze{8V+`tg;s&-CL0Q&wKtcRqjX(#zc5mB%I_b^to!iRn+p=T7@#eDdQTjW@mFz}Q?X z_h0?`H_^Rlu~${&#ou0g?ip*Zy_R2A|Jl!e&U}rQopDnN{onr!DqwK%U8ow|;E_Jd zjXd}Yw$SNE0PV^h)?U$=AxrB?axI5kIL~%< zwVbO?<}%1aQST<0zI<1f)epxZ^{og{bc|*y3<`9lh5$gJhtv6m9P+!4d5;IF>oizQ zm6M{ZfhmBv^@F7XIwJ25`sh&2BL=e{`W4Ar=EIBPUeW%dh2Z*TH)S%?uqYy=i8cz-DHPUf&T`( z>)-#1kN(dIvG0ES$LrttCO_xa3e3287}n1#sV=So(rEykb~Q%0&OtDIm*qY8+#Sch z|2^@c4}I9H20{e}s3VRzA~xM@QxA09w<$A6{x9*CKinLrf8lfSwzt2-FHR;@;PqiA9DiKAEL`j3~=M`erMUzv4}VI1^Bh<0ogeA&jZ)&B)sL2 zL;a$L&9~U1ASCbxnu{;KIKFrJWm*Y#`OPbKN~#|{tsO(CbB`UU^9 zgWvP|#(Wb@h1+hsEiOFie6Pd+-e{DMt}OJbVuYM5FU|%gYVzgnNaWLpRV^#uFP(F4 zeDMpPkG*!=%>lUJ;%|AigiWm`9|zD@^au2U++6eg%U}N*$G!i9@!q44ik)|QRcyFH zKDtzaXDctb@WQzCJC}L2I$4uhXfmiV+2tQHfK^sm)osz=+wXe0d4owT(^yvb`TQk* z6~C7g2&CZ45B8M6(TVP}3=05*gL9Bwg>!nW6bX_TwLG{bO?Y6rO+EN1B(fmsxzSOE zfWg)So#gW>PV)JgJc>a}xR{f%OPK`d>tHiMDo4yKc+^C8g))W7RFO%0jRtm(?GGDtBu!^Im(+H9gSc zyciJqtDeW?Aow4*(aImXDnUN(ZX&F^&U$t@3|Q!xnHX zIxKp5=)ng(XtSka#o7qn3NWmL&XpyzwgK`+5dPK%8$m}dVkl(_zzZv2bPS|pMF#%g zZ=v~GMeWAc4RmPBM;?CI&VmQIxj}*d5#%m5?94BAW$Qxq;6RorZQXU(wR3{!zW#2t z$xPMvh&o_jZ25{;cwl{0<$Z&c+81^U8{QUVyLoN?LPu@pYX$OhT#I|`(Z_5{yrRsn zEn@N@yXDO!`~?+*HvJzt9@FZB|A^aQgBQw~P4%|+Q(8HDdu2d8tG=Fo-p|KBzpw9A z3bTIbJ@m+f!Wm&_zXdnPNZyAZdeA)B9+|j_4*KB^I|gg+dS)d=-(gpT8*(1i>YW=l zMoDi>ba2*bb82_#fE!s>nKH#~!E<&a#6PVpG=T)^vCop=-O7MetQ$3uDav-)foD>uIi3JRJ4a`!ENMTN}+ObW0GUQ)gK8f(U6 z4Gj1L`bzhrCDM_6hE`B3OZOXWw6P{>3*zAi9&kH)kdV&SU3a}0KXE1DJ{mJMu#MoE zL$3EocPN8)T4RmX)jpaOOW)MTwkhdsZ?3t0p+xQOAA-g?b`!Y&5S%wdD9RvCus7IvN3H$mxS zIay5OQ;3%|?q5KH1nL)W<&1NNz2pizVyEcIIQ|14WuUuQ1KpW&bUcvhW?3c_eJuqT z1DyyVJ;S4AWIVO~Dac+b7ickP8W1BI@IL{nl9a@2uCV{v5z-7>^G`KrcN#4drFGIl{ zNp*8Auk{X4PZp#n%D@||W^91A;mCmHtv}fkH)pVFfInn`7SA`e!jgJ&uUipn=7< zzISLOAMasxS=pKAOZs7}ypuP)(3eHS&R2|JpOi(9wU2Pq0WZ{MqQ+#JNh@v7gqnZj z;F=)%WTMb5-E{DtSNS0vy*LyN(IGDS^flh*0zNuTf1$o0OIWfv{S-coHgMZ%lA>Rg zO^sq>wiN~15~sGy%HH7D!F9=`3W$GGMkX3`5`ZvklK9H3C;s&M!Y&| zD?w;UgY%|{lm(~{Q)6k2!FH%|*w;qMII=3VFr+-iIaTl-PExq3Uv>D<`Ku~wsR#}Mj80S)FCNK#~E@oMgo+$o|MDl@}XHOVYm|Dcp~Civ3P3hUz2Zckl5VF%t4b#o=o@_MU1Ta{yUpt{l*tK`6(KpO+m6mq8U}h)0-orb zN1rR0dW$4V=bzD8*|61LiMzxd{nDV7SMmn2|ZG9=Ds-sn=oerbONHvFi7F2m{2pg z^{U@Pmp+Jtgh|1Pix{{E=eph8v zHU<2O=rR3H9g3P{ryh&QLPj{AdVq_E2EU@TR zng%#O<3uB)38As_fM2uB3FL@F!hp6aEjc?Wjdt;yDSG(JkNjt9yWDCi@Ik$*(*uk< zf2y#-o{xVl0B{8iL+o6MTh68e1Ljl(>dd0!; zrBA}AofZ6>XVs))G=sjS?iN5uY53MbB%`$!V7XM&9)%DGO=?zG0~9ym%r};7oTLdOvQ%=J3hkaFaU1yMJ2UR z4R8kJZ}Ye`c(IB=&lR%T)-aeT=c#V}O88ziE_dQ!;0!z%aLOtieQiu7-e~c9H0`W` z<_9%b4>A-P7h5VxTQf$C!k9#9ED?c*gihN`ItDdJIvcm#GlOKQ2}92-D9!v}gcy;T zXG<=(l{(vV%g_$21T4g2Q%)^r+o70#NQYF)i4OQGUD2Gw)7g|Jd7;JjiBKHK@Wa!> z%?XduUCQ*qSss9Zst6S**N`jQ8q#!7cXT=k1(NAnq;Z4=l09%Cr~$m}K(5NgM8|`g z=qoVE!KMgxaG@!2P%eWWRYN*iYAUo=5VFMbA$7(_nwP9NJow7(LxfU30c4+6`I0&< zXd*h|P;kgRtn7hN`XVPCer`Xf<8-R=(RmJbu0aRor|?CwnNtI$X$xvDLs2?C*iatM ziE{1|f?AtdRInb|qBMY{Hq)>1goMr6_Vkl?z)=hJQB&eTXn<{24R-9zNGSUw>;@#u zO+Qe1<6CC3@@O1>l;??{lU3Gwg1+jOJ!HEG2OFxiTt6zp*3g}j2uh<3*>26CgfjcK zTqS@Af3_@6MHl(8Ti;lR@a~rog)z|*4)1w|2W+*!uiGrUf4Cw7043x?el%S^qDkLy zTNx+Qv;9<-IuQh-_U;1GgzHBFl;P`Zin?T#hXPEn^P(J_8aG=j`!Ir{V+L-EL!I_d ziVEHTjG#~la3&YX<<+6;bew98PF>U?D54q~eZE5Bt$|R=7?u@Z8f*(W`+okx!kB@f zOfceeT`ylEN~0T?3Dvlvlp_iG>(TrFi3feJ&`=^5OjQI!V1Jx{F6Yl3ZEQ9;j3jY= z%Phu=F{lw78kPK)f&Y#Yqwqk(vmH|JP~v(5*DU-8tC&Yqs6j$CT-*uJ9)x9AuV7-^fP2)wy`3hpLs4 z4+%>qXrwUa6Qkxs2gUQiZqq5iwgNLut@UmbzlpY=JBPqwH$Odg4R7OAI#}g`5 zM_5r2pD{?3d>-?7WoBN z*seg7-S)~s5co4ucu$&a_cAHqVPdxMO-Xo46*@!&)<^P~x=~zN*a%S7fIQZ*>a%@= zTl8R5#cdzhB)pO2%*=OnrbQ|RlptO#OR2*EO#}eXU(Tg7R&okCs6apaZt@gfhYSmFtZDdtJ3%D6uu7`{$%`ainLmIs?(vJ%IuE}Q{^I8B-89J(q6yMDnn z@*q+PDI9WU+&r7Q2}lg`vPP?2akl+!uS!Utq6u_qi+r4ge?Or8l1C~u4>F{D7pe&9 zTe7ll>LFlkg8&55l2RfQRvc844vA>bKctEin(;I=-WI^KGAP0}0T0NiXp5mvxPJ0$esGE&2z2C*TW?7+uxX`^b6|$fb{>OUqeJV5 z=5&1};It6gvpJ#Rd>lakZ-He>d2_H!!EkJB<#e3+{c-1lGj6MXg74(q7-2qO_3be4B)Rpl_S5;Z2NwVq}05hp@ zOk9M4A0~C?8n0@6)vAJQX=Yn-y)5r=^bU_?G;QTU4tupcqJloXHCS}PKyMwYE~B78 zSB7f9^$bXL;Aa?cgr{;|J)uL;sRpsB3;uM>3JIJLng;{o)|nQN zr!J;aO2e?p<|Yl_bm0s60F6th0<#j$96Mj9{WqbuEcKMSbg~JYidSp7mN65X;0gzSLkX<4z=8a>&3plAmfrZ<*eNK_@E)m4*V%Xg;VA z;;s;m?eE#K z%ZfgT)Qc{SLn1X0=UBms1!xiFJC@+Ourrl$G1G!vVvvU8s&PUs3lJxyb2EjK#w3W8 zbc(Fh2e?C8na0--0|j?T^4C7rMa>lO&*jML!Bf1T3%}LBBEX-%&R6ZePRk82I9_Ra!Oui|L`12G6eLy&~v?h@SH-QBgt9g0J7E6@VPwMcP_ zdvS;0?wW)MA)f#9d*zW3(dBtYP6zyCM)?t9KznVp@Tomo43RGvhhju^V4$7s{( z1Fy@ygVR?yJ@T{6C2dAt;c+zol2ev}TW4RO!sSke%H!Rql0|ecqw?%rC{p2h!*7*1 zp$Sq!?YVit=%4|g@9U1*&3p4jNTn$9n3rD;Fj##W|CS<+uSa@HcyJw`osY_gii9z2 z+3naNPu)fUEGRgHNAV%ijTcvt)^Cg}RSBx1^rR{yA)K5K=V>|=L@Bh33AG6bhx(Jh zA&@V8$%5n))VP1+yd8p2=-=FvFhVz5$~$Oe=M4zzEn2XIiXxGQ@}`nhDkn#fDVuOu z)8;fKf@oo^;u6oX6jpl8)Q8j6fM=*34V0o)*->ZC79l6B@)%A}Qkjq!M+TvY+UQEL z=xJI>*eNasj_>KQL175fA52lQJCCwKDrF%LIG}P57ZTymPhhEJ%Dar*cy^JXNtZ-` zpF9XBtQiz9t}cQcs2i`N1JY$SnKxy%gzA|#FkBUt(^m9+S;s(`(H<18`tUScGBNR} zcPI=_tzS3NOo!Rjd}a&!+}32E{l1{|-7pzB-hr%j#KaHi6Tyy8y8N~q zLHa4O0e=*eZo8)+;VCqD#zSST@`8_9Gw>UJKsQQ5{w}9{)LCFDfO_=Vl+-Oi2IT?` zmA~7pat0fnaLXbr5x%zVsyY-M9A-UC9Xab7<;SL`LI>>=DHuB-UPa7k!3#fS(;wofdfx%Yj77TDy#L4kn%cn&kgc!dRGOujv zU_)pq1372Gcs4Z>3@d3%Mdq3B;FWjy5ZkJ<)L1Ewks`qUlQ(|);VM}(Pux(5ion8P z3n4zl6*f61Gd+1%=xz!ntN|3o8XgFDC5=vcDIgD@*o^8mi ztD*=}Hq@v@do~*AA`|}U&`|#rJFkAxm^i}cjt%_4>A6-Uu7GLMg9WE)SzM0l3N+p~ zUW;oDC_21Hhkyg;`hgdIK(Xg^taoObA4wwBB#iL^;YwDDqe#`1+6g+fNigEGRGVM7OHCr7+MuD}Hz&=$Esw#kY-JS}G;pgA`} z0PZM~a-{N;k%V8$&9Z2Q%YolADj=1Y9VvT7z47B^p3B#jkg zIzQp{%aBR~Quk1}+8imqeknXOfP{qh74PNGS(!YOBy~&5r)OQ%mTQm|W~y8a^410C zXWiwsCCId+hoqxvT%POBd=e0&%ovs2e-%)a{1Y1Rz<`5;RLNS|}Mb zI-p*uwMJWG%%3A->ErE;1At;c8fDa_?kBIBlfG?E4|kC8}0j&z7a zuTXjTR%uCGD}05^)FovJjrW48UVI^HqD}eutj@Y&2FP zDmCf(u@S2fRBF^XQ3Mo;*hP^QL++V?Dvh0 z34(zfN}4)G$|icrU-@}mN26Eo%*4=8|N7$>Wkz{iI+p=IlEE+W(D&eDd_}ORcV^(h zqwp@{)$5s?+Cv547UfEq%_WT!BL?c#I6NW(EloIYqkFmo@0q_dH%u{VmbkXtVo_B?D@D~HYNih@wZuwwo zBk+GZ!W}me7un46`ObL}+cXlcLMERpS-?+Ma5<8362rAy;dVsR4v&4Ym*T-UhslFS z@qzY7C&e8G;X;P}I+t=JY!8|cD z{Wy9UQydy3LTBtHhvp!ESB^?XsS5jxp**)0 zo(}C~DA}#3w9r9<9Qx}i%Pi1y&DEjlQ*#(K{-{tgXvsBAo2*Y&NM+Dd;)!Sbh;CP2 zl`TT;=~!Mp@JN-80C-VAy3+IFN_oXJ>XJu{JqEHUgrq`O#dm${M@`*%xZ_5sc$M^J zY;q~T3Gz2j$&X9s4IP;(^9Ps1RJSM-kI)#oNST+-7)3dlcBLss+0OKmPjU*J2HlVo z6csN+6~TticNNqUCM4Gz9KqyYIm%IZX(u2`Ypx|I{>}5Mfg-pw%`NxjDL&*BZEnOc zPiY&944>eJ$;qD@zuBmR1CM!Tgv71NqBsCtX+ncj7niNc7?n0r=tt?@*;hj3B-a$H zi6F--$_xjd>Y@Z5$*LalDD?=C2e)p)!XXT<1LWIZI;hs)NXaOS4gni@h7DCYmA|KT z^KWRSJ|&P>(qbMs9_7svfC;E#HvpqI@^*?UF7)XJ{#4GJ+sM;xI(N@! znBr^1=vNq=8V*CTZ_7`{^<5*73Ar`?72oDAWr-LiAM>>4n#P9XV-2Gc))dIlnNr#o z9CP!Y6L;oLAa5~@ieNM?!EQf(I~lunR?_a}iGiNRQ5Yi;uK1O&7c-^D4n?Luod&~M zK+*lEd<UYzrRUGh{}a8jG?FJ;!}R{gCmhRK8Hr` zmxxt9Qd_W<7T#D8i7#Qa;-sRLHuEEA{!#?8rzb~)v*xcmXvk7Qz5Eo%>llhoop@wI zXob59NJEAKU^-(M(~~((M^aiSjaDRP-Sg-2CWc1HhEoq|jKMu&PzG8Yel~V;@UVch zl`B3az7<{r7-toT^7Hd(Tx-x$cQ%e>W&p{>L*+poyG>R3QNNZwIg%qXc}^s$ zsDdD zbOUW8a|It^!b5&?0LBF+@;(O$Rb2{pPaQ(n9A>k_@ z9JJ0+d_xBh$~a^SQtG>0J!(#^C<;|3?nMN2%ab20S1u;xf9UnE{Qy7dvGfvI{DnWfSZ+fmAp;LMy?8G{#oynq0vAH57*scl${5uA1Gn-P zUdeJc5O%s0UyyT%nJ$!I)nNC9mR|K;`L8 z2MDZ)qn^mq$^(9if9%kN-)z3%^ENgLC^#60;uF2J2Sy9j5yrx-6>_Ep6`Kc@Rk*?L zh9=jnT*(W`hSDHTwD^pzLN^XQkXso$1#h6F=@tK<3oP@D+J&7+iTDoVXhdhGMn?Ob=o=CMZ#z6C5 z$y}XAmqbrIQ!W&`uJFf20FTO^Q4@$t96E8ja7HE5c630&K;3Z#7qe47_g8)#Zq8bx zJ0tFV!c*`oz6`_oY$j2*oL5SF!BJJFnEaWerX2F5`pYr^@!$dFpmUTvQX#LZGgS^V zJFo#jY?OTi2W*~P77lBsQ^DG~(}-5qzO5tBCrtM$bLeN^K(4Ll$QdkvC>JfHX=EDt zxg>JLgSO%T{BV?lbhy-KxRSDU$8UjALyHqu$fUTx510kihHDUzkch!FN(+iAkT!+j zA}sARf?;PFjSRuyiePaVDkHhFC~XYXn1D`2vM-xg$?1O@ERdBOGh|GDsT&pB0*e4* z;2G6%Ag%=ws7Z6h3+|Q38x;zF6_%m-rvSyN!b#6Pe71vH$EYBwrrJE^C_zWa%jq_G zC^XY=DZt>!G!U+f@MBP@6W0^rG~S8~1JTC;P~SL!Qh>fZH$r2!jn04)bs2s`fT#xI zxHa!3=QeooQ${S;no(qmfw7Z-^GB7r8Hu0uX}wgYNq)vNfSkw<(0xPM2r5^r1UU>s zY6UrzKGCT^=Ti$YDz4lW#RP^%e{S&0C;lo!m|hBO$jgP|UNq>M<)MwEgyD%gP%?Pb zETrJ)vI|U_p+&l^SHcoT5}Z@<#C{vZR;z_Lo`0$Vqnm(P(l}IT_8teRZh}}!JHG9pSVavM_l*3E9QD# z&Xo=?l>$K_zyCpK%zwa{&v)q{v$y=im z|G1zBaK@}S7&RLRjxfc{PIK*jxT`HriY( z8to5qrPX70IOOLJt&E%p9>jpJ@<-yFo4qq^Q~+P)en&{!l)0Hv{r>i#d|OiANB0f zjX@7J-WQ;bN{K0J)*X(Nhax(GZjo)> z%nT}gN)AxAj9vrf0naVpEeCLjrJ3FJ>u33j^Q2P*cGGa@+pzi|QNWKnk^#Uy%B zu6!{UrcvWi#j~;`8cg?&%nlQHqY6D1Dgb6@d^zSFgv-K>0D&8t@%Tlwml`SV*MZAX zxt1XLl0~Pnl|P5D4O@5c#5>w_RUzfUG$tp&w9AF>vQ{a6A?IE@FdxMU8GPpblU=De zP=r#49s#mVoW_d7h@nV^O0lxN+Xl{x1qzcM*qRM0>4g0>T6)y@vBqMdZz#3PP(j|~ zPZ_}raq?|=Y?9zNhDJ&Y32wnKj4Nd?4*uiD5j4S6a7zKBbl_#qbmZDi?qFqYMx-g+ z9TQRO7Gb5CaX^Y|R7a+93y~MnK)eCsAtNOFrBgp*$`WZIg&xsW<#G524jn zbp$>|qU>Py>{rQO&&1=7PLn^Ps=vX*28#zw+X{1qv&3~B@dR%&K)_vb0x~06W|7a0 z*WU=TW@}Ig9~Bx{{ELCi$id98rWA7tP$8*wav-1NH9ZM2mni~ONEyMD`D~0}s#r&@ zGf-fm@m(oTxsEL)C8N6E4!~acQ-^%wmoi)NDI&s%BJvBuYMdDUeAh0gGKp6b!b1d- zbTG=il8}1`7s^w(MhvT_$%djla!N9tdTwScNx`8;0prOVPZ-_6cN#l?z^G-(GG^+$ zuLH4x%D36${{%onmRwNySs*n<_3-PUVDZ)b6zuSTEV&#QW-q_ZITqx(^T@Y zGM0y@w-lE3UslAxNXeXA3qYK7DCEX?sk&%y%11KbotV%ohb$pq=sm(MU%o?5_3XBu z{sroH35DO}QtKos4M*UyEymNEbj&aua%^U+ZEYXU_VygjWtme7ZHP!m{<_xIx-e+Q z=SMxu&y`K?01w1106)nuI~zRPxG5fa5R=z_SW3X3uksI;A$At}!AKE@%^?73d@_k1 zoui&@OGPa*99#Ry*OwT(xB2)om4Vh};blx9Ioc~J2*6FuYQ)+427rOWFGswdtfb&oy&osJ!Y7(3TpCTv17E!`uV zQGiG&N2O^J>=e2tzFgZ)|El*?T}xgib`=JI)B2|FRc>*avI0jP&wKN7HzCtzmR|Wt z`LYhFdrsBy*_e#zFb<-@uURNoQVgwC9u))dtN!zuHYQ)%QpTyM;l4@(cqArAI=pi< zoxs=L>1YmNY zqXJV%>`4-8S807b4Ovx{jjQEc-4m2z*&GO|$EZIyLWQ*E2yY%|%mC&(lSc;UY zKyI9&D7hE?DQkLWvYn}SI&{j2vT*?P2pK!{hetCi7rO+FRcZL(D|O`@6z+b#^DuV} zE~@aM#LbhclK|xLR!mvKlhjq?sm$mxpdDWeZ`W3FWaNGtWL`27A`?$HDjx6lnNR30 zC4+Uo`gI8CfVbqQU(+I*g@d&DM@WvapvyE`SrP^xh@SOKdS+UUo1BosWOAW;p)(jUO>LU0f)f}I`Sl4mVs;eZFCisTQd8dAhQyI$;|jK9iPK|3C2~>a9al| zt-7s)JWVH81W@_P6~Rczu(|`1mY)L_avDh!+|7X|ogzXVq!`is<>LlITE(dZnF8VE zMg!ftQby{?Vag8$$a^p>hV$J&8#mT9h7PWboCH_ssS6uNQtQ45Do}gZ(U3VL5U02V z?n-Eh+30}6$-?gJ2N+RWiupl?s3sbBgS}Mwy_&!is;m*#%U?4k3tN@?% z#a^+ABc}-cAT-(f3AYp}fA>WZG8!*ISQr+Hc}OIAFPGY-o*g-vAkoFE-|WQnVZ`84 z`I&J*5w~xTA1x(~9J3k*E=r4HXZq3`TcFT#A-q-H@#_?nLGf(NT$Ti6h;LfDBS4wt zmjP0f%~L^vxiBPZ9mIY^ek(MFi?DgcJNwweMsit`jeiBgbP*9uiS`EjkqsR4;ImSn~T z0Rx)`r8OvNnnBfIS_1emlF^cJBeY4&tz51D!0CAXe882YcNb@95A52udM;8i>sF}T^$-@ z$@!ufRRd}v!6;x}tGtwT%sd|znwPVInwH^b;%^F>wl(~ohAQm?fN`aARFzIA-k`v! zV=L657@CMdKmFwQ&AhHBW0z|!tZ@m6lDmUsdB+GUh01NEWk|a4jI|Cn^5@2lP`%imzplbo>5s;J_HlbYf;#1Fw&{ARx&LHz-~nffApxBeCcRXQ#Z- z%NEP=IS@h8D+1Vr#TpqSInwy`8uJeQqWDV8h-C1fsx634k3cCic;!&m=80~T@7ZQk z!J{LFNBJve8HUW>M>IySG9*UV!jpf;>bJe*L+vT zrA=Fg(Mu4nf5lR@Qx{nu_EZwkfY&l2`01yCSx3Ya9YvNA8S4+y83F#uamrRjbG}Kd zc{lVLGM}=01$4j&rHF^138D}+$Vd_QMzXE^Qldo8-QD#pv zd-Dizl9gsIfzWBYc2oOUz-fbKQlE26tcUIbz z4FygSh0-Gr88;gWImh8yikdN^Ur`W7+R5ZobdG)h@Q2uAw_RiQS!az0AAK~w@6}6b z+eEt#DIabpD0=5bM?j+)bsU%i#+c4G@4PXi%G#~#w9$RK?lHp*)7!WVQHKIP#rFw>9V42hbGfTO;sfOETWHW7wc%%%4gOVyw%2&kyH9V|Ewbt( z0mX~?=AAz#(CG39=^39WB}S!9%6xq%9A5SS9X#WYJRA=1@*Q2`&_VLFElW(0Ay-kU zhm4=pa>pN9+8GL}c$TWlA1`jXw&X}!MJrf-9gG(PfBG?&T4GtKfOJsf{p+)UkwXUm z6tha0jyvgO8@vAfeu#kse~k4v+9;0y^U1DM6r`sK!s#h$R^i-S|utO2UQ47O?1EG-wlyvp9d0Khb zX}iUui!Uw#oWQ-v=8$RXWh!9VQ{JA}$KO&Wr+D8um|$qKJ;GaP?#t zl>b@hUl23QG>Z?e1seG=3Mie+TRBh9Byq-F(xn#-1tRq<=RfLHqi{$x9b8H}$yIwP z^o18)RLX4%_o@?D6;V*)Hv09Gf?jHwW#asc|L$*xQFjGOeEpc#S}KeoIOOni{=}=G zmac;GjLW>K3-0S_>tRhH)5=K(3I*`N>#4%S2*jsVs6&bJKJzc<#imzI`Ku8^A|p3zOfRMFX>8@Gg1Mcf>Qa9CMdA1E-79w4eUCWh^fThv<4=gT z8cA`!CL|zN@4x?kTz$>;amE>E$HF}pRY&2wn0uZ%E@%dHC-d7goGv?mQ}))oT<=!&rZBhs7c44xcWh_cs&f9dWOb9GRBLEw)NIsC!T!z z>G9F}aa{cO zi{gU6UJzZoc8wpUOlg07&=tclNJeiF$=|dJ^E+pv13JkAnxNHXQ`h*5`LB9yHRS+-}=#le3CyFH-v#1a= zUG6FzMg#vmzCL*pT>1hIp_9L;Q1|ZDCtpU@^PnMv#NR=phZj_3gv2`p6+C?4QK}CNqBRYMx26jp zENR=JeV(sZc&ZM{&|xxEqH~CNwGh^jR|pihEDix#VCJdwB%vA)RkF_vR*@-7CguZMj05SQGwqFGcA$>;irxY6dFAP z0!|)P2Bzq;F66B%uimi5ooVEGXPr4tIOdobp?qeTZiZNCrBz}wby$#HmBPGdq{jzf zkqp+ckfEa33NRXClt4YrHTOI*`U+ifd((A%7b@X@Vbz{DiN|pFGbgSClS?A&=z!xQr1)Mo13e zuV@@RL~(hMUiX8B4v+paSh6#IosJZPB{RGW3Uux~Mcn`3L-FTRPK|T__P3ZsGQH+% ztH;bU&7?duBi{` zMrX3_33y%7x+zyh{J~myArVK+iN%=bLP zwN}hF`|R=Ar=LY%HS|Feo|$HvIdM^l;WpBLxnuKq7Oe|W-Z>L>$i`Ca$ zGp3kw%6Rpam*dMXzY;IDjlK8VFE-h9^H_4JrQwV5wN2x9YFKUCwX?#WQRz-S=bZTX{SU;K zPhfKPfiabhB7MWqkU{C#+C0F7BPnZL`CUv5>;n*=jp8B@Q_B zFwwth%rL`DG0SYT#eM&}J0_GI9sB1~;F?iy>a>*qIBH>_nXz3lR_xALIg zR$Fte=+&!Nyz};3o&^Bl@pRKoABXTuB|mx!Hq-90)^)G-!ZV4+xIsinl1yJ9JoV}gzo#u5tO zLFHbgM-SDhWM1{k;n2toe|`J)jSV*3(B=H{%g?1u7mDkyy*4^^>SV)p+=+jVmtJ}y z2B;1``|RU*^|e=Ga>?!m8sWeC+G{FH?>O|}gJM295gIY?vg7tK-+c4M#~*)ULrJ@w zQ|puH`pLnTV-W;l-_*jZOaLpOO8I`@YrUHEn=-TR*xyC>=I9_URGOmwOD!O zRbmy%{5IQcA76j-ZA?GIjIqzY2bhm5t+cW_Ys2Fi$OcI-n86oxz#qY$L@Q@MjLJtOD?&T z=n%4&zaRR?x>9bt@AU^8gIjLAK?-)(_|vh+OF(Ay!uOm~a9yUJTD=|K?HV3a z>wbwPmlku!*T}F_EVJASvDp?|#&c4{10-b3$&;sh!Ez`Bc0*lw!38nzyz_bri^b~0 zjyl@P=bpRnv_f80Mrr8aA?kq*v9VoPjs51EZivN}STeSgVndN@d?e#|WURC9`tj&P z4@qzzuwmR`mtEZmCKK+HPCdhh{Epjhjn`g()kbCg4L5dgttCd$a3+{w!q|4Z9i@Oe z#rfx+DTDM{?7G{YRs!_25z@_7#{2I1SG*!6y}}ABx_7;}XglQ4!{a+C?Q5>NMn-vY z)4kNP%fzW?ou!fKPjUIBm$>(T=%4;%<2~TV0WterbBc#cR=vn!R#fvzxS3{Q1lU6c zc{dr7$<&391pq@HNuD$Y#SZS42-Jw9X zzxe!%m{&YqVda%=RFL((_dmdO%XB)k2W*w^DW&|1ln8Lgt^bS%#P@H-;}cFjRWxlJ zPd@Q@JfM;5Qp+wIC!Th?4I(oF0CGoO^UDYSl{igQS-*?ykW4X z?mBHOro1qk%qVnG2XKwG*YTPgM^G&)Ihk$FIb`%+jDJ7&m^*-X-F1g#{|>h!MjdO3 ze{;(K-G19`v9t^z9Ye2AsdL^aw$wG9vI0Whej4{JwveQB8$kdY%XKnEpE8^pRuYsVLR=xon?=;uD_`KKm5=)&XT-* z_SxrglnmRfGtVMjAVYfOpJFxD-5qMPZ@l$ZtiSF$F`*Rx6rH=oHd}AwS%!P=yH6dO ziPUDc^JwR^(@%@A9`qX?>2or^5|pnf(+LeUwjeQ-*{6z_4Kpx@FS0y+~=Nu zKK>y;;xjs0e6hu(Z>DnH!U~T|7!}FU;n-pO?c>tRE{h8I_e$_C^y*N_va+ zIc6RhV0eZCNnljTFi6jIKA0wNDj@)I1~&I?zhxMj;5!8{U6S8xV(KJY zLW#xXK}*m@y{|J*KP6^YkFC=ro#Kj1{;rY96tT;$d&Zq=Txb0Gq`38;H^p&B9Uhab z(&t}rVKqpm;TSf{NQif^kI|18dzEiaCq`U+(cj{tzg`gMoqJAnmVhPgimwE@K-*4A zat7Xq~nf>u$H>Ptn*)kt(4c{_=k7bjMN)2@bpF*>Upj2^$velC!nckD|AN1q6PJr;=bU+l zdXt-JWc+#@uAbl9Di6v4qrCEp%f&+vJ`@{ig#5L7JLq7I zEPJ`({>0QKhDJPM(@KF{pBovEKKxMZw&Mx3YxPlDv#4*h@T^;r>^_VesG+s6cz52>a z8ZEu-uzT;iJMO;Yj#x;_dI^n~j~8C*_2R#tA4eU2m^XUNE5{Tg^651rm50q5bktHo zjOVFefG|dXZ6#*|)e%ANcNdM{X%w=PMz6@()9OUDYu7&Ry8V{uppo1>^Uv>*4S>AR zfq3=hmpvQNTXnM9nrr*IlzQ|iP?Q`Uw)fwC+p>?MWCI0t_M%3hOj$ns!2NNj%0*jg z+rE9grxEnNfBa)yd-c_Eu8hod-KUpv>OkdWJyo4_LHQGh8eWP(#mkO!v5U+>v7{|tEN;K+E_J>p zvf-gUuBA>6>tZXdv|^mBPRwN*p`IxkH`!tWbeVQ)jkI@+ z)6}V=)5=I2m}Z)3;^BuLj88xLM4h~T@h^1}AAI-$)8(ZQ)%%Y>{uqDUbDy~9-n--Y z6OW5qZoOHf`t76h6jR13tFGZGNoH1FlJPv?fPK|rzDfr3dUZs)I}g>IuYgoTvO#oP zs>KLqgzAuGsX=2d^I|#kwF4e zCR7*-7=_5xQUQ9Sz$Y3FvgrT?0`u{uXO0p*@{ogLA}Q7zZoNIu|Jy~;NuwsF7l9XF zcvi-?i|JqVS9)aUkx;_rziKd8ai|{$Imp@6vEG(J@p85Xg8r76#SAj$W=STYB17DW_$JC z85KYD)YEa+`G55qT`>R~LFB%M2C)MiUw-vP43g4fB*+F3&MsV3osmBscYGXi%yBWj zdh1__COTrvX+--EjVw?5%lWbYA%|)dr%sU!37wygqUmWF=1;^g$_o#@2||49+_`g{ zamvXt+w60yJe}i^BaVzuKKa<|$4plj=+J%wD<*&u14eLqDSqH3jRxT9R8vnAH%O5I z9Nz00ga)9N%Z4Q!G7PkvpncqS^9}AKop9=D@$4(F$9fxWte$sY$ z$U`0}8*PLRpy?hq+=k-$XP))urO76n)SFgj6u-MnrO^y)R&0g6!_6$4#% zx9+#kALCC)91;8c@elFoXPOi#}zg--B@WFADI+mxNc53Xj(~gdZTrqm3)5J^` z9mokMpe)MF^{!5ac+Tquk3RN@XRJDF5HX-{zxd#T_hh6ek=)YW+r^g};j%u=jM>AF zKIHabk*;(WyYShB;&o{GpJyp^+Dbvs5N4mp(g<-R$L z&tm6KV#ZL7JX9wsq@I^m;V@b-kCx+W<$$Wd%-!Ne{2JKc5tYV<%Z(O1myHaw&oP&U z_Uo^|iaF<*$J>|ttC512ikezI?|}nzlgBjEOzkUB3c+avFugqIb)=Q_mtTAt>#w9cGQV19vdYd!MI8)L^RhfAhb-wB@VHV9O zS5vOAQih)f|Kzn-XtNR&4Y}093q+5(XP4o)$x4bY z4n}~fy6I<_!Ht*A0`QUiP+;F{6!@h^x0`IaWh}n*vT=h(Fc<_rrBVQr#vebQnMTAo zf2(u=Yqm_+ek*=&xm|Whcy$CG0p^Z)gc6!W_3@+1%CsDY(Lti4bLTE`!P)1;+%rw@ z^%M*_ue9`5ee#alChM*hbI#B`ddxFt?6Bn)@z8zuX@oPe(*r2ySJeamq0bNM2pp#l zT3e6S-qpzEgi}s)8~X6w_Z>H@tD$D}OxqhMqv+WZ46*8}gOs$JyE=5NF(#-@838&V z>)jx9ld5c&TzH{7sz<9cLftXSWCMz`tFkOJM46oSp2phWl~iM6^apO%O`waZ&c&Bm zKIWKrzF2UvC1Ue!wv7ufx;Q53q*0Y%v&}b+FTVUrhGDSRvuu3CQ`RsUjkAen)>-F> z6_#IKqp^#lt2%?b?zxxs%=m3oF6khX0j(Eu>mwKIib9Ek>A+SM~C7@%9p6sX2hc}M6 zZBZs(HAuN!ddX$ndHee7Z(|yDFxc0?w6`~ZDZE36c9sE>PQXZ>50kHM+=v?z+P^YUHAAPy;@ZP6I-y`tz;_Sbi7caf=f~T~mowjQne87I{0d{iSb=F%yPSS{imtHsB zY;)7i2#--5<<0X1U3@DsMp-B#_o4;stiPc~Msviy|GGOq`}kvzih-i=QKHjL-#sqS zDD}?UZ}Uzt0L5DP#061d3p|b0#z=W%L|%H~#W>>VV>N1>$sGzdb}$O~!_GUaK@U&| zVrs7=&9~q}vDzAIdWsnS!mCZT*fRFhNbkkxpN}1P-PL)KFEYm~5f5rKwB3$7+5f@& z?)AvD5jZfMbtqu3efEh@RK7cJyVdXE9dOv;8ePt$`WhBnND063de3((t6T3~*!k7KBjO=qXPSn>d7nPuiU^R&}q z^G!GLsK&CVf^v_}aD3e()2w-~v*ubc!*t!_wma_c8k!@T9HcnW)J-pvvihn^-5u zG#*ny^coOI7g_>{)$`hzm`m@*f}AC<1XhfoVIagX4hL|NBMt_NsR9}ijplFXpBuN` zabVfEcQG2ka+BohrPCfnD4vS9=eW?T$C_#>f=dpSc}-_4|_(>p07&Sc9z>I{{6%gaq@}BTEVlnwkvBw!n50+e~1k> z-XyLSy;om;xfJ1qo>F>$ zz;&6rOI&l!mGQ5;?vO#yk?@Ha_@`B4#VH>l0e#=#36gM}z6vufP5}F8yhA4mZHln?iy z>G8JB6FX>phwQtz*O9i`etYjmoq6V&Wf*Ra_Nto;r1(Em2jD>QiruR3NeN<{S=V`7 zb$s5LXKM7mV(fp&A#tlld#}9sg7ZWkQNj;s6xFA9Z;yaJmQkSGjle4u|GNElPYbhi zbD8B=Fugl!boHr>-gZ0f6g%#+TfC$4?XlDL9@P{BPdui$&pq>W?+o64r(I)#g%*sP zufN{m$SMZ7n|jrUAAOA1{Z2Ug$oNzpF?Q@7anOO$t^0KG$Ndh7O*JZi>y6jrwO2G! zlCnhUs7oZ#8PB_8uetIHqr?ys&L$b)qYpoFXOXp2>ST~c5eVhPlXQwl9=t!ERmY5a zUwHAwJOXH=(FBUtXDzDjGMY!$nQA0`o`51HuX52o`5vC-SY`Rw-FG|BM<04n@l!zx zk*Cz4v%PR*WZ4#v0%aPKQXu{48g^1Ldhak{2Tx7!u=8$e=d;J&d+imQZ?=iopBNRR zcXr-=x9Iajzu0S!-Mtaz9kp3HYRu@+zUZ8_)%|-ih-b+-t+vW4YOj0QAhY8Wxk3io zwQplXty>#rHl|#1$z{=_$HKAImYaKI##-=fv&^Cn_D?8A=TB#M0?|sjm~mNtg%#tl zBaVpu4>%z9-GBe+F5~;z=bwApb*ZJ7au}~yuz?I?$7Zv)-hL-8yX>-9ZS~b+mtA&= zgAO{_yr3m81F+*xyLiXro_p>oBe;3I_0~J_t@OdM#~vFCt3z@82`9vWzWv<+2Iqtm zO&C{SeYr-tU&JPxY#uYuG_%*>JqnecVVeD{vrdm2ZoD?uS!aXTS8_F6b-vF&e^9x< zwCuCK$C@xijF8c1s@_wVdgdKI2k-#H)1znn+(s3@?koGIq!i32dLNA(c$bs>(*^Lj|frvjGUNKlr+*F zMH6d?QVF8-o3Fo!{t^txVcxrQmo7FSywAq8=Afa2qn$>slTI;NbWs>1GaCC;>NWBO z^Zo<+d#7Kw?%h2X&OA4Q#|8=No+(eZIfE0H{4{u=MJ9db!U8ghdzI_>eer;vdVS@HCwRp;$Jc^h+X-s|l^!7B$B%LO9e751!$k{s1 zbV-*kQ(1s`ePFN}cJ~=))YAwl(cXStf--lXetIj}0!-n4tvY5Mg?j${v(G#=2uvbF zJngjIR2P+S2$AV8q1kJIc;R2R0haJO6_5SJqcHSU0|*LnWnGWtvy<2!4L0aK#E>kNHCcCK(xHr-rMikVipL`mfHS%F?h0YP9IdDxi^|bEoqwrXV zWU7%@d6?q*Msmj55yo=bZqvqhUw`K|%5F`{GC=e(b=Gyd>HJJt;0;FM^Upq4yBp${ zqZys`{{A~}aGJWS>PCDVCfYvx{4=-5F6RA^_((KOKV8bnC!c=i>Gf`sQ#zCV2Mmlp zeSYxiNzgk$yk%;Vb^wznnP_5_rHko6S9~UUqW)3hld3(VE7&9jzgQphdy=B{2V|gE zFGSr&jZs^-uG6S(bku03x7VYXnq*c8S!0C5R2~Vsi6@lzv(LVW&XZ3Xlc)`A5bJh1 zp~?W?-`0p7IdBGY9C$qA3^S{)JH+?B`*?>k%RiHg#~2=VHnS6xnH%b!t^3q3vsB+m zR?%mjCY@L^fnNH`a*B-c8dSIL-JF{9%qQ9Lqb(;hO-X132Imvl1OWHP1X zf!8}2L3YtSI^a9y*H3(A6v)~iQ|WA=L7#m4&6n;3@O~lh=J`~hUP)6sZ!{Aj5&>kS zy8HqlCG8&fGoV?9s+Q3LJZpq{^6?}O-^PLa9WFz6`K2RIJ?$hhXKEpo!4gs!fkNYB zr#=oQQZRh_0_~1_#W8;U_+{0S8${8Y%O?Y2q;Cp}(-5h7IO_zcl5FOQw!~rN;d?oJ zpqZGQDBuI1m4Y}WCCZ9FmracYW948_@I!oYrjZ1z7CeZ@GYRxx=%FW@`3eY9conrq zCxD`Ip7P7^409BDV7OSL@RtQVouX<|7&K-S(P0D5h!q@d#QO>pe$YikAuPRUS2YL} zz%(?|R6Ic=4J~;Gj}()-a~Q%QCa6&4iIN4aI}(*2d`+|tF~ARUY^>v4<4Hi^JY@wq zu@N}Fz5H8;!simNk(U`JSMu=>%{XZw%t=W{&XQ+FCUlYxJL;HNb1u66;E@UIkE%!dtzbm%2+gWV8D%3AM}(0Kqhn)-zj)(A1%w#f;2|9y7V}Tf ztl=P+exYCYS?>zNk+-f!K{#E%U$ zpsy#d8#;3#c|&7MVMVA}Z=uJ;i5$Z$yyQqlazVf_EUHE-83xNC04YLEp-~v?Pzg!p znnUrok*cngh3tJK7D+5^C7e{ygFitM7L>Fep)VUYqf*ka^Kf_?50V%M>HTBKlmhTM ziG0Y!c?%O41tB~@p%d2#;Bh0Wp79x>QlwC-EHZG6QsFnfK<7g};4&-YsFE5NWpe;t zxn$FeaF%>2a>gs+ktUF{E*{D}qylg{Plp+eWRj0uG| z>F`mex>A1d3$e(BKDB@4>63zV@0bcRpOjYz83SGjCq2s#d8$Zqg0|(hqB5ogRe9(K z+2u-JIpK^>6n|vVYDbe9i+;_k1aMg=nJ=8kQVgJOK=1NnK)EKZ;J{eb_+Yg1C$Ylu zHjQ$`F-~=4s9!qO97OHq0|Er#C$Dh_CPc2H@0S87M(4%?eHKxXeU=%_fq^y(96L44 z^Y&K2Vsyq;&C?Sp|SI@fNS*qlo3UQnJOBE17HwK7n#xFnWCpk`62zvD7IC)=6*9bR5?lIYEV5C|AIPGw*Uk{1T>P7z?~`4U?V{JPiDcoizA^}TrE882={QPQsfA{((lG{Al@{kWa$UJ2l7hT~D;R9r@h z_A_K8=*S!rEX&R{FUU{EbfxG%V^Z(X?+r=1r}pe~}~EY(ECqYx2tZ~jmv50>TU6@J>7Q8$8tSe9=4f8I=m>N2O4fBfKU9 zh29m}rgAh8J$uAe^+c^$c=aD6PCEMu5p`(mgu1o(K8z_SjSAoka6&@(IuWHU*sr6^MZ_PXvhx7JE=Y%hF%$!jslIRq-EvZai=@+@b% z)Npc?Cx4+D-}RRD;0`BclcP+4$)K#{sfd(|^Dsq}`35;`*n#)F+K>%EvWhGyPxD;& z{GorDu>q%xsxbaan9~a(dk?(kt1|mc(-FLXs}!zxYkpl@2G>R2juk*hQy`C@iN!q1 z+g}3BlbZK3ZUVEhx|xc8cOnte1r!CqM3AVSV9CYH!NZ~6L5l?)Vd0hQTQo=XG%fzyvwkp z8qSep#%px`$wW!$&x9JD(Ljk~df=&Ct$uO8Az&!%%n8I1O0u3|u6yCCFr0x%g(R-7 z*gA`{ZtIS99_qu&S&nbm3WjC!4MV8TF=QX?_2QPh?-mI&V2Vg^PepIxW_vrvG zl$!+Poi$DpcnOa)IUB5KzPVmT-6y>Oxq1}nC-CT578Lr&cfAUnIX843GA57tT2_|9 zqxR~wCa)_hJ^Y3P(9s0+OnO|?pyG>b3dN^sNOQzvfX3)QGbzwglEODpCeq|`7@HMO z?}Sv2q^nQPW-Uodngv(bo(4}zRV(h9aZmgTY6`k?tpRIP>{fFxLjWF}Q$U)pG&hv3 z@@#`AI7=aj**boLXkXx=bY4V9h(N%9UIdNJ3;*iL1SHs}NUk8Kf8ay<<$VEKC6IA{ zP#M{AMgwBB><^a8-~s+9ZM9XufJ&&8`IkHtg$TE<^wtW$a%5e2A<#WE)alS2|7rkr zj5IVwRb1%dyg}Ekp22E<`A1GbqvJ?36<7C^3;)t+g-wsJC2=Q?EPe7rR98(Z!;(|= z=g~rv@Uwt2AyafH#s+Hiipi$OGLj`|Np?pk&k3!EXSv}()@k)q$>>NQ8^!L=!W&m} zMoF;z32K#9xke~qDwXvm4w4wGC= zQ$1H1RKSBvX=R>8)Dxpu1ekOx7iF{B-f1ugc%4k{15Vud1O!7q8f`>93v2%Ih4wvzO^JE*PrE1d*S5+S21tvaXi} znX<3L{1H_>*GAEnX$%|Til6MLewsqbGJ`T*>n?v?-F^ZZ!&}IpB_LX(`&xft>yl@Rhe*s)ZmI`rCMt{A(>lNR8^|ewX3`uRe*1=^|6dQ*U)oHT| z^C!yy&H)4Z#iyTs>Jv^1gNDlx@Qw~!!a;*SP5k@sdqwZwedJ-$5vml=5zJfoI?}uU zc)yL45qKH2^3L6$ z3X>doA#1yFI*m32p zGN3=I25zb|-N@+meealc=9y#Fl~;s+&KIYhb*?{X%DaC@9Cb{rwe~tbecUa~wSowzE8w0O$^w50JS2N$O__AH;$qI< zl3JxUK0ks$0suZ;g^L$qIZgfSbI*wxW|+aF39_RI?qGB8?DgYTjGxM-2pCq@@MuWH z!zwdGGy%fe`Wew>sxDSs#UQl?Nl!Y9f#Nd)-)4s$;+DJr<#!DEJ{lv7S!bIy?!528SbWJP zJ@Nwg7oUF~mtXsj*kPAl+;O?;hMWBHVd^s#OjE$CW@zNdn0%3y&9~Yr&OHCT{Q9-p zp5;=G87Y?Q+~J@BqBRS6DnFUR9V%ApQFSN&C@zj2)TFcGQ@srz5108fmBqo|-KOsr z7ybRxcSj7d6mlDOnLH2f-JP4=+D&d({^S?Ad% zn2JQs?!Wh*c;UHc{5c~&aka;udq)3$90@nRc|Z6kc33jX6hMej_#k_M>yb=#r453f zcSfIi>ghQC#N)+lah?trf0PkpBVyqlqf^%2FmCPIwDTw~4;~QzXwTqNIw&qi%7&A? zsd%?_{ZTG?u@*=TLn8d+m5qrzNly}8G}_1scb1>gTuMdaNa+AW^2oVn`2-%kNS^4P zW<6$jx)Q(950~+a%XGMs<~M>y5}LWvJbc0WQ*m&NA)bZD4kaz-&%gQ9!)?tWSOm6u1mfo}vRjqp8 zR2(C+{t`y=>(i&VkC$R6DXqndgFoT04zKEi<8(gx_!GZCIoI6tdiNJw=CjqH@4b$_yUUQPrz6t{kK69~6Gk zJ)C4ROy$meQJBbC@(3Pe!-kwZESpXlVdW+F0-$G2l#bc#bI#>a7Mrqwl~-FMW}bC6 zAKiu#ptCTKItzT++#LXQh#r6B(Rl6ESA*l0$OnUnEO1bQ%K|RyS`PX9@uvZ*r|&Ii zoc@8);fOB8fGIZ)6zKhf73&Q&L7wvlX>mvH64mf}rMJCf>JU>*Yld!Fv z!v^{YkL6B6j|)Z>a=rTWimR`?(VusE?)hipJB?EKoK$c5fBeZuaphIl#L-6|=TnU6 zOr%j8;X@XflIOEEjEJmX)xeM^%EHHi`v?boK)Q!XZaH#|dhP#Xf9n`K8}uI#GYQ|Zb6S;)83_PdSPJ-Y-~gZI((i}9j!S)@=o9zIm~Hmi zRGuH=fd?Oqci(+4_St*y*k$LPRsRFsLHR~y9yUxyfO^p%onB6A(XH_4StDG^^5c&z zwWyRbkPkd~U%dX>YY<@>=ZLk&&{=*FR;bieO+W?}^7B z^F1FA#klvEv6+9q`R&K)7*k9!r5mzOU+Fxh&mZ*2Ms7tlOlVntg_Wda`+78Y^W^=)6F-JEtH-UGRm|c056!PW;C?rHe35k1{_q( zI_)&wy2geZZxS8V@!&*^1r}Jy=YMXt<(5+R3;5Ir&T^b!!j7@+4m-z`8VNBShY{zy za6J}V)MWxFUt9HV`L-AJ%BPQZ+I^3hb@thPa!W5YPCi-08I$X5xPeD)OdA&p5kq8{+sD~wpB8)Wv2*OR@1Aksf&2Irmep5V-R0+dZCi`ZIp^d%gEHKbrRA1e zJ~rQStJqkhzbVxgddUc(@MloxVAWMukFL{piye2^)tz731G^g6UV9zM-Zrt^vdh_! zdaW8Ac$DJ&@bcT`l zjW^yZDLjN8-92yRdu_X zKQg;rEGQZG`l0Bi?g*QGj@eBQu+BQ`+OgKhNl;yC?z*#RU4!r^ty_EED88JyjvVb<7y#gP*#OO(Wtk31pRN+z>)DTa^ zCta%V1S*2huy`~mMa1E>^l~__@Z{6a@^M*!M=4xYX?$nw&_5j$_uhSHyssV?y>wuw zU3atc-Ds^f{k^w&=AAb-Rs)!7$|>Vd$Da_3F0q8;0bhOfMeMuBo<4eK+2xnFVpbu& z#T|Q3HG@?TgPpjU$fymye~o=)wza!1msIAJxe!ar^DJ%fRj! z$Dep&l_KG+Gft0l&OAMqUTV46@1TQx#M&bdJ?P#j2Mcq&*!}n2<0F!&cg_RcRZ3@) zNhh&8@zm4(t-)7cekCrt;>uV|in{=#u60&j#UpI$2f8_+`LH98_7PNTuCtyU->&0( zaR5_@)Ez*FXx-ITiQek*G9~@D%dYg1QU%UF^;CaOhoi-46UaOrsW*DQ7K=#nLhp3b zO&4>_GgmzE=p(VLM)K204mgK!QT3>Sx8CUKuU&J7sH$@4gwIeDragbKc+Fk-X>LyW*U`{8b&3MT~>5K5VqfI#S*P zEL-ZR71j zqH>Rrvfn}mD{0+--+kiT^Um{8VYl7#&*&tBRN%Q6Uhv1A+fLjzcG_VFk7%ZmVFq4% zwP$?v(T7(0If}`)jxORjv2C{A+Ryjhcc1FvdzEAEIQYyU-PCujy>j>c<9kb z){j$9JyWumbY67P-{RcAoE@i}a$2mnZgyOO zZMWMxK9cU?h(wMMTR|P_btLz|jyvw`k?&e-uHroaC!BDy4Ss=t+;DXqeazu9w)q(< zYMhB^*88yqF}|PV&;>;|O2=2K!8-rH3`{X*iUvg?nNRj+0x7(N7=hFci9D}c1Mvx^$O+~5KKMvH@yrYHz+?Z;k2|()ANwA3h>hIB^UN8`EwQK? zMSk5GV3-cmCy~HjEv3HyUVGYq#U&Syxz$@@YLbRaZtPOrZkL^HCH)n1deTfIefjwp zG4~v^M!PoS#SPd0!yjhtE=4>*ie;jSJ9$%2_vxpL_19nDhb}L>?6Mk}4v1ZM-NQz1 z#g$f!$tRyUuD|}e%(Td`NTLHkPxqqAaJH%ER(P1S1EF;?28-Mb1CH?yLiMeK)F+J;c_!oH`M26@|E^(lTR8) z9eRjHX!CjmOCEeD@11wvj`?SwC01B!v3TdLxBNcWpdkZehM8uvk-PHp%VL@-CW?jT zo88}dJoJd8{K=@p4?i$woo!B^n>elNnol@&@77(TsToz*ebo_LJnp#b7N2v8ky~x8 z_Rp zeDHo5_bK9#Lk^7n_dn1^?wI3_j%m7170a)a?BhQPhmH&JurBN9)21 z&bK~VVwq*4^VD7ANEx2Rdi0PHSUU#v8z5O5?mF5|Bd#9mczpBS*OKG5o}mISQ<%UJ zM;z`$wJ$jTJavY@^%N%htkio>@6i~>^GJ{H_D!pi(YD)c8#mr`qj|OKuB^olR6A&= zdPavb5>h(dgX`5-UW_hNO%jJ3dVn{e&9BZeBkHryz91fZ{2_IQrdB(dI-Yp^kvQ~_ zBPCPqVuu|$;Q34A-+1Ho;w^QQq>OFk{vw0dzTJ3n*x?6D?+mm~rtau4o_)p{vBw^} zncu6fwo=S8%XBgM6jP|2N5{MGza6v9-YsUFd1{ShuZt}<-&P%qIlLhb&4YQP;nOCW z4rP6nved76Pnl{u|Gx}Ut)bU-Q5~UOU2KdR2e@+5J`A;|ls{K`MV{(Vfl84Yk> z^dty*FNFE^J$BhKw%=;=*j-mXox_)&8HJp8_F2(E3WiZ5>lsxt8&Mw}CA=6z)RkUJ!H6IafUP z(8Es4nQx5%He*D3R8YQ`Mk8ZNWNwWf7hHG|jS>b0pBAE5y5Yu~TEVeq_tsl)dJdfL zqEYS({(eb(-KT$?c=Bn+or}&m)+e)!bs)b{0b$1w+@hXy*RIpXt3BTm{>42yLWwXh zKhw-J$CJ-IAHDkYjZHS&)af{=nlFfx{-~plv|)WsBND!3Ko1b$fbB=sOa0`Nk8H^A zx#wQ{BgiI)iWDC>IQgopu8NtYZ21g7Q-ARD1@)rmoqt}ZIrv~s-|uci$|r*uq0Olg zE$dN$nu+Vn4Mqypg>NW7z3u5$$D9&Rea|&x_n1mbWr0N&k-U83_1cBiv+w!(>;C)? zpIGvTW2?0Wcmy9f{24mto_C&@MDkU#IQ^s(JO%mW6HoZ-)SR-<6fi~^ z!>_-MwbotN@h6{bavSCX?WI^h`rrfm%{IrJl7k-p_8=pj_uqRb*57n9DV51Ja_$n3 zOSU>`ROPzr{UYQZx>fw{&#*#Ycx1lQCh$bn7iQyW>Q=xJ8{6WNK1oYb@&{B}13Flfu+_j~Gj$WRBVA)CjPv*TYXc^GtPM2PnUJ z;;w()*sC5Ax<7x>?+37i6xlWqfKKh2FpKfO!1T zht+eQE!N*~<9Ote2Svw7ug6WI5d)(G-aYI2>MJrn>KKS`e0=fL6HbVePdF~lI^(q1 zZO84U*j|=W>NpCI5(@330@HK%-g8fEx78N@g#IZSg`Du`Q*9hLJ^lXs?~TI`J2*~1 z?UdMmzkOnd?YE1szx!6{@@v^}2L%J)Sofee?9(xvXRdEiW;i$sh*Xp18XujF)8sPcHapeeii5fCkKZ86TkZZZ3?T<7WNh@Pi&ke14f;bnzGnJCY|21RsyYVv>=J9PtZOjJV%m!Qn2x{yp1b3iBM$Q?c9=%o zd$(P^p~0OgW0av&oqq7{yYW`fo-#CZ#yab*=NSk_)&IQlMz6Q5wCZXyeEp)2Vx}2qj_tSG*_%kdP)CpV(e~Yck2vFu6Qx|2iEFRE*&pQe z#w_84Uq8yovPRAZk!!ENBKF#QXV>#$i!JF*6J*K;s1X|F_-iMYAEtj{73tc!t@ zM`)iwvdk<2vib6>FU3iJJ}yo>{m&ZVoDqBNxr@J`!5SvzqP)~0?KbhkqrA^dN;c#{ zCp+a1FZ2cLzU(VtoZ?-IMTu3k@y;k8E`IpohvT3_4)MpG=a_R2w-Ept!sxLiK|;@H ziT7umajHLeL#OWIi!SjR9P6M-2k0%0mM@kksB82Nz?aOCKXBc7=WTJ+F^9*w=bjmd z9(I5_q=)(|1h?LLv)b_1{^HA@{&b8+#)n$39C5^qmD+_TPaiefgAdr=D!T!kp9I0RV+I$ zncATzgc3l}xEIb)T#>0f3Y}0f&j`}9D3$^|vyjU7r9S%LLx0MhO(gV|Sg77*&po{x z2!`?@O@kN?mfZ0~uJy0`_R|Q4xn~R%)))LV2zI@(`)#qMmWr2OdNJmiXP#JLrIq8J zJMUB@feu}8g8;d2Su-?r|BY*O5Q5TXcipqkJrmn*yM1h^cz24gbQb#dLkUEj zdfI6od2zz~ZoBR2HCT2Ve*DR&4qt4^CH!UOO}E-gBY}D1C-ruD2af}oJ>9MHb8h^`SB;57@w&l#&r1)qLq$cR+2gcN{7UoU@KK}TFSZJX|V(qooi-#V*-=B+Gw8xUM;rg4zu_ydF{;>D18o5ppi!QQ6 z)w5^)b6_m7=#sJXj=Q_V@%iVU#yn;1O?1QJc5T~xl<=uKb99E^fB$`dH*muZHj39@ zdo^a%$b2K+voYhlZ@;s#Atkdmu$>u#=bwE>qmS;dJgS0Yi6s_~UcJ7SA=|`w2g#UqnQBVO_ipj8d+v(Ow%FK) zd95|q690#qKESoCdklN=OU|jp1W88iB9dVrGj!jw~Ez8L7s`kTr z??xN1ACErvaICJj&KmJ9yX+n}-+Z&^*~mJ2lZ`i(F~&fp9%MHsUlS)UcB}Hv+>iZ! z3_cxp;)$nt_w0Add&|wYF)fcga-TQsnPTXKL=2om3#80q+|Z0%OO5>J0kpQ}RPP8A zQ-qA-SUdB2oD2!Vf{{ZpAR@e|%@w@~V{`tNA#E1BUa7>*9sv!IDV5jXem_3`>f3nl z<1gZ+o^N`M>96OW>$&XrKK&vddFnaOe*?S=f&y?4R)&d@3*Uj_h22{;vbpcE$2^tf zEzHoYO26oW3*xm`UW&8MJ3qea(=X1u`0rk?xkbJ0PMs!k^+25)faog1j?JM#?6%il z{tzoio_RVpYtuj;_uP|;9pIZ!thF#gd;gtxtcV|f>=F0QC!TbYxbl)qr1U?HYj3#G zWqAIT*JF>p{^<9QhN?4>0wci`4TWc%$k5gelJdiEg^MmmUW0!c605AXdfWghLDs(c zuX~MegN-(c>#x7o+k_82@BnY5c=h!+9d_>n532!g9zV$d7h$AK7ER+9UX_R9{q3R) zq@>;x-(HJ8z52xRGUNctCSNzvgCfE&9%B;Z2#~l-sO)&*R=Tb6q;Kk~XKYHJ5 zq~G)(C-i5lFvW?B91%mg!uaFUh&|AkH(i@eHlj|b%Z+-@Y(tRxe^PY@idK! z*nN2KJr7!L@4oB)*kX&VJ^Jx%jT|+`;Fe?l+O(4%Pcf|&%?gbzRBAn%a;;QcRR_|TDY;f0sRiYu)uV>{T>sgFGJWDFTRQk|4_{PWL~zV0C0k|oJk2N`45PuYBT+iiEL^ZR1F_5K_2=aY|( z`Q}|9K798p4K}`3XKAxI?!+U#^Ob!LaD{eZXRf0ifV`qRsSOSkaCf;j68t>?om=P` z9h7**uoYMQR1240ddbK$&Nw-`sS(h7ZzslC&qG8l^Lc$t@69~xtTA1;Zt>Jp zPkU;DwT;D>SSp@*@=0&OUP5^>Rq@J8FIh;2HJ0|?pfJ~* zbH}W6&KVEfdyhvkOe>&VFkDM5y=+X@d2&xLU=*4DqX$)t8^X%&wG~!eNkaLAPmbAm zlg;9tx88Pdn2$ZeXL^g1Ogee=km6=Nrnij8Ll4{+6Y3s=#z`ua1*O8qo2N9|`Jrz= z8zT7m(1Q>9JsPIj)?0slp9Vo=W{qox?lZ&^OD*Z$caLc#+C!t8H{N*DQ@PZYWkhz8 z^#*9a{+jEp3^tW9m~p0=#G>)M0cXQaHi~J~BONBi%$Jql)JV)5GQ_(+8g(!tWeS#E zY29b&9uu^mAf9>V>FB7&=>e{OkP#H_imR-whTGP4@sW%PJM~sydu^xZb&AJDC%l_T z{!|mdX&j7-Sf5y7#g(n-o{-UG;h&fO@4fr3_(}4}M_YO2c0LH0~E(e9j{-WC+@zf9a)`@orS6vl(?QwBRCMtHDUpA>wm03opEA zOs{%J9-eyoiRhy;Qx8@LDl4P(<(65&>q*El&$r!nb4)u;c0`e}b=Td{ueiMY@+J=$I72Kcna4=7k>s(*ANL3kW474B3t1MPc;erp zM?i6d(@~m#z6E{K3nN~pP+xfd8F${N>N1VnA#%@>&$Al+Qnz!@Gk44}>zr7ncwGa9 zH{X2In|>G!v{jja-o3x`jLDoDg@5s-^yCZA`Tf>qrHfc&Wt9H*dv9ta`&vvkNv@v) zu6qL`H)Y{~oOOby)g)9Ms&xNZfU#>%m`1m~zK#9%J2J+*{PN32o_qG`o^GS^N>oO3 z?vG^G))u`@6*xAA4t62zEEIDOz$-rH>h0BfKuHW$PaOlxrjDPacqW}>QdbD;0W>D2 z4G?GyBg1fd<4m`)+Yy0g#6|=1w8nseZgeO*(y?I!J;fZlm7_*glo7?iZaL^+^ve4& z;9y$CB`bwfzTSN$oCqx7FLo0o$4jzoXy8N-gpmeSuA z03#(K{1Z&Ts6Bh|oPfgDo$0_Za^RgnzQL8fULjOPkJn~|*VvX{e)%}(>~mw|O*dB0 z@jZ`(9Il4fU%f->0${4R)D9iu#%CFnGvWVT(-t}um+Y|$o>k(84J z%e3WqJnxv~nfSxRQ@(aj8)}MUJj*Se4!@LK{XqvEBNV>8JtAc-+On-sM&TGck+06i zMBc1IoSy~`vH_>9Od!0>4k>~8`=i?GB;r@fERcr;&_-CpA7Apyh@^wRYz^ndR5Dkd zKS@6@%|0>wRvXc{(1#cd;Lrid0LHkJ_|C+|h+!i<(*bYE4;)}a_{bN1LLJjlA#V%| zBN=3VqE70BQrF0lcm^J5p?(h_X>TeMxM^#Ym4nlHM-jb)4xwxV#Sdn)s9R(U zd>tm}pbo6`nds)-PL?A?tYwon!)yzAq3d$yA=me)Z)7yrQl(GChxU?FIt>g&NXG#M z$P4mL+qa%n8>MYCH9Bb6Ac`ZI5e+I+X)}0c>vMJa-rfRu=lUuU0DJr=LL-p{Fm&I^ z&>a!uU3tY7BQLn%9QVkX5)j9t_Q@Dk2%oU=)L-!vfU@=S!k$KU0r=&!nWub;0`Vd- zOeaJY2ju9H_{1*Ic%P8so3zj_40`a~{7BL5`wVX#GGQ&bNjFB1YT0g^r-Y|6a6W1{ zL-;W0a85TLVZPP)Lxx1*R<5wW&`@~SoI53cfx^L@ILO$I;igZC=&d5?j9fv&ccz9= zhvFePNtO7Sn#gNT-&T31XN5ac)N5a zr7gmVmz?F!9dm`dOn4GK?nGaPWHGFY#1l6vhUsQ&a`sk~Mi;_Koj{7l zE0Fl9aIX(29R?1;;OtAHX70|({umR^=j7_nfdt59!6^>dxl&?MWy(42fMBH%1yF1Ph>^+vIL_b)1wh^H>fZvip#<;6T?v zD;s0jdB-T7a~hMG$PV>_>=2KfcqU)!KkI@<&HjU;K&ji3m(Trc$eXPq%Ef8jq0uPT zWfu#X{$#}Bt6b7q&yq6=;ic=o!fE5gRb{YK9R3)=!Uqf)2lM)YVsRC&1jST1Wzem! z)G&E80yR}?>(>Ijf~D|_^-`EdJ2HPOS28r~b%N?TGNRuC8 zfj60;$Xya66~IgR*eK?m@e;t*<#tqEg$ud!j#|fnKVVZH`s3><&MSpNS%6K(Ko!Z9 zB`n1l3{wZyFGoYB{45)GPA1Teo{JtZFBFd|!?;2dXIk3G5#2wT7>a2XHJrww`c$xW zDtf7kOKOtZiSIUI3Zj^F_DK&IJy(UZE7u(h)_QHY^NS++Wpc@`{!9Z|P$1;5Jgbvp zWTFB3`O6wf#~+ZjSI^gwY))s~)wQ@^3%?pqjg!q>0`g~u(D+>$5>6{Dm~4TUpPow+ z%GWZ0se~rOT82_01P_H*8Z{LJC@qBesj$2$z9zY3A}bR_Oe!A9mJd}|$C6O+R*5P= zFfC}r)RoiK`OcFKK7U4(>ohbJ8Z}B7Ib!P5pU7!oOv$sJZ&PTRduve9BPg74N+ebp z(MI{^Nw0nkcGDlG8H`oRq~@wot0wn5MC?+WBa`FOdW zH9eYykr1VFDMSfWW#&N%%-PCiiHuNJqo85i$xk?Fv^ECLQ>pRRPbv%=bQ(SG2`fBs zJmW)&5}pRk#>Q#$nLlDue$r6H@zn9QF@cZlghWYW*x;Rbh8(1^Qc4_o@r)A+Pi^DK z3%Sv~KTv9|s0cXnrQVXt>RJE7S24!%GBoSUWh4#%y4G7@#w*Zx|8oI;n06^ZL;xL} zyv)3skq057O-yrHBs&VoPDhU7tZb!6@S|R+cPnSoR)D-oYMpQKfmet?=0yztsxW@Z z4}Rh=K9{TSp;^T9ekQ3r3n1JWGRqx?fi)~;z_g%WjS!7(RoB@mp~F_?Zw45>F9@~| zTNb{?>U8-MyL}41PD2dcWLc0S=n;NhEprtXb3q=SF4a9UY2&6xXz>h@XiwQp@uaILpKjbxb*&)j2k^(W0$G@*&ShzU(Ig)u z{F<~iC}n8w5=1gw)t${47D{}|51VtE|=2B2(BUa*+#(V}D0xDjhWLdnXp?EEV#zZ`GP;vCYGcI$e zVQvET@Sg+8H)w|zXtE-qF=P$uNB)E<4tzktc>Z3a5F(J)<EdL$U#@8plsyiFm8^n!clS?JEcQGrJ<8k3r@o( ze|I`$%V?)_Iiz=wjy zkI=weLe{x7zr(D%Q0j_={O6atS(n$S2ctk-Fp{6}g2&|`CuGmQ0_T05Z~i6 zuI@@j!V_JSce*;FepI}YQW!J66O*TtAvTUmIy$dq?Ts})*38`jQ#{sA(LtUv!Ho~&7JwH z-ikOy&%?4q&&WbWC1>6&R+smyDBq|+SfR8vC}Fy)+k!%K#a0N5+@r`-;9ACID)^Dh ziz-zWDYa!GDZ!+th$+|LBPL<#Um)WuOlfUIEP?i{k<3&Hqc{v43(Kx!F^4>f2M)3( z2kx8l$OIS~^Br3#__7H?P&OoP5q`fbR?!I&#B*F%9@9uUWmCWnQCAv==_$l>3t|}N z3s>qL|H?U*>W=7*NC5&XM^NU1A*x^P#AEk3!40L$C`}Oi*BywzwYUUGd%J4z0{j`uUa_#E~Sl{u+c*(0O|?{er@=^$L zWTbETafG_VPxQ--xswIB4jK6$;vw6hAzQ6Yd)6y79dd7bC^GA^c>W*;AgxAuh^}BzoXE<((V}uUth%9V%J{ znHn@`0rEu$Wn9NH5!?`p57?@5r~#1^oJ@>Li*Xx2*Aba!_4K6f)qF*pWL@-g05_YS zMzCapkvCsKt@@(eqYqO_qKBin|}C+h9N1aOO%;WU0d4rlHi;dcR1R-(09TcX{e7-%#!1al2Sl*Z>V z(oogVT|TTJ@hPw4I+`0P_pr@XL)|E_8~J=ol_p91c#2n2RJCB)!W?EGbnhRvNuOf5N(j@Jc)61|5}Mt=->mQ(7Bq z(L91YCASz7c0NIiJ`#~QRb$d5`^t~s4d z-jr7*cD)JY$+X(Yk;6QjfUFu|yaW!zV7Wrx%mH`{4nd`aGL8I{1{tQF;2miYLQ=L7 zKQI{nx{41WHsy-1d(nk~Ab;wgnHZ+{as~vsE9FZH$lKH4ZdWOrRSgSlZdD%m)5gUx zpCDC)wb2b99VSCI-sF^Hb9=G3rj-8jU@@lvlDH+fe2D?3y!S>;-)&jKRU?pFX=AhOL}$-X#9Y6PCEBH2L( z@qQMRM3k|)OK>e)Vd(*7Xhow+XbuPj&@`ku)vW^+#(92xa)+(GxxP}RhaTUm%G4Mv zWHbsBm-LltaQ>!06-D;Q>IG^Fs(dws1s7Q)rtHl5j~eEKum*{PUoe*w8JwR5bwuzz zH#VKHh)iQPZ34E6&pPug{^Sh8=Z2&7C<1V@-JUf8a2uECSfodfm~qCLoECr*%2lZ6 zx$ZJ2rLKHLq4KwSC}l>tb-@=I@v~?^7txsLl`_3&UegG5Px*7yEQNtV*0bw9L!1?; zX_z)hFdT+BOs=X3+w$t_n+o724K2A))tA6|&>;Xv1GWA=8q^F;FJ@gOA>n z;!qm3+6LuNe7rnLBMr*XWhYF3rWL;`Om$iA$(RmPUX?EjNPkHIKz?bmvt*fjK9@i4 zac~hwngWS0F_KD-Hm1J<1!wW8V#(!SJ}Fe`YPVdJX-V^QA*m)kR8_fvOgAkw|0ZDC zRYda*VG}A>ss7-h>j?t{eL~uXX=3UF4_)af5+B*tqw(n?;5Y9eCa1~4kuLLcZ7U@P z5M1K71i>^b03+ctxHF~bre&zn5`;t$C)*G=RjnDdD6|mbk|sNZg&e`_Kb{pX4>~Xz zr_m8t#?1_cCdn#tszCUIF>NP;+pAMX=ZxvqjaT1spJ;F|t; zCTD(Ao|Utn6aii3kaR5pDH9rFv=;kU0<;we)HAOW+30=)u>8~rXaHy_4rrt;fkcgz zjT)m7IE7$=1sC=?jlFvJstTS>%<>GHf}#pDW?HjB!idK59nlpjsc#X8gFquJe?IMu zSbV9aO#?WqT)|NN3M?r+(Hk1+5#Ugb;=CT`)`LLNB#1Vi%FsJ@*=>(F`HVBw$TZ4O zd~!wjnd;>|ur5Yb}xl|sLX0S|YcWXx!Pj8<*nbguwKOC!kZ0i2A&fPnW&b4j9( zgL})e;&PuYpIlPr9fhCD-w)~0A`nui(y4vN^O)Q(hF_JqH5fajl+{2n8ncs7R!7>c??~_0ahYuMR(k!t+ z_rv6ea~OGx;>1tG0zaALHfeYUExbUB{9EtBQ>Hm|17E=fPf5$XKR0f$!t9q!l@{KR zE`9Y^)j?UW#XozZX%2ZdEe%%?pnyo4_-McxJ5zvDPX47gYBJ1tnptLkg_or&?JT*s!&C?QDbE4 z=PD(BnQ1GKF~T^tTALq!s7jTPsmpf{N07D491B(HdmYDo}^4&fH9ImKA_if%$<#60wtlIK#+0rju6)?L5dGg9ZT8yDqNOvoIDsI5f7a} zdjnir(y5V@%|Kk!sDT|1<&uJXYzrr`;O9Ow}rlU95QqX8tRQo>ESyc#Rdkw*(oleaY(o9YL~ zHr^;;1`5VZ-p_!7bo2n%^asnD$~*O4TzPJtK0+E}C-8|IzTnJ(rCqvAnaYa_5pAqD z4f=7QPjTR!K;m##Bqsn+;e1P}((*U)bhc4KxG{{A zO**-8aPA*#c1q-FRSY#pHBB?^H2$);=h@W=a{VJmWhiav;bam%{0fbn*1{FI4D42YIN`m!%iI`6Bv=y4scWD z6g^Pla-%?W#bKaW+f3tBz1t^;E=v_c3>6>4r4bkmQ!d6)9EO>AUO1<&q-F9|i8N~E z-61|>!wDK~J9O|VGCrzI`IPs9F!m@p^38D-IrHRd@>6rbzX0JSE|Am$Eu~Z#-b5e~ zc^Ac4pygzOMpZ@GxzETh0!YDy<}F0wfO2(y`RHtm|5!lgntz7O^k;$+RMsXtPXc7c zaw3`}N1X49T!Wg?40Y+w46@>S5-rFJ!b0UK4Qr^Bzlx?G9P5@@tIm)xE*e6Uj6*1L zeM~7Ow<9I*$oz<*`MQHUitv);WCMO9(XU(^cT$v|X;AJY`kr;6TuSeuIw9OD5S%Ig zS#FFahS72>8hC-8uNQDmC$b9~%eiP`Q_0|=gM4%$9cv%X?CErs4qC?-&BBFl@!B4g zibh@BHr@WvHSkH!9V_z>T9Te$0;H_iGg=3@O2*(u0WuhEgkJ(p z8y8K-uoXY12WiC zd%z(F>>H0i@8ROK`&ykX!*~ju= zBp!P3fjIN@Q{%gDzK(Ow`)e${>~j9(3NJ^$^Ugc5=We_B+hOahyKbC(+8H(o7{qpM z+Qw&JejeLxwUsDW?@daV^8|O@ZMWEY*WFwmrb{1v_@OxXpabH*2lx)&i0CxF`C zp+4^DBjcYp-Q=UK{fjg{kpIK%R|lTP!flKSE( zqJ8$=%iqY_XroQy#1l@A_dj?)rtjX}e0}AWm*ddG4~cKS{xTkV=!uv_orG_{`_@N8 zk?$p!T@)9bcV0};p}pFQ8oXaDRb!{|&_XMr;No3xwWp>~bbNLys%sOV*R4wtE?x7M z8|CNh`0=AIC@w|;QXWc(asue}qLxepa!$q=Ui_HKBobPomRB~0=G3$V#36R#Xr3Z{ z6GRUhHvcm#1-r;qw5B+krPW_{8}gY@N`N{yw3c=8ucGm6KI@-XB$_~p+swN_F>>aZ zQB=I+QP0%Jm;nP&AH`rm*?dtUR9(?wLD@^`>*|p%dy`1C~!$dxrM;cd*tfx68L+UaLR|7WT;HmgocB{NW#x3u;CDdiF08{#O#PCl( z=_*=m2=(KsTFI=9k~+{BcgmiIH97C%+d8JvrESoWb;;ooS?U%a;&A6RZlJmt3Lk5J zje!M-Fe<>t5<)5$Weh-?v4v4`C6kuO8xyoleg&;jR6py|Rn=IHTt|y@EC55myB`N1 zc0_#p_1Cf8mYc@GGGJeQ{)I;+jA~|?Z8jUZ#~ynmcHDZ)*k$`|eAw<`e>%nlJoD5O zF>TjwF^xtojL;_Hj6lJ>^Um*cBRS0Y@=GqZ&@fdv^Q^PRjn`fiTW`LJ4_;n*)ipF) zZ1{ktgyH*M-^U;K-rq*<*rSh#9k<;o&OG&$Sb3FI{V95Skgth`eg61|SYeqZW4E1m ziaF+(BNkq`heua@uK$H+pN);yUnln8=a2D?jD=s|6#7)^oFYC!Tzv7x@sI1S@mk#4 ztFIpCo^!T0!yxoiPun%lJ?qTaddtn@%P+r-op;;AUuIZo=xciAbHU2Kuq zUoK|TO`jn&ss8ygwle*2Y1mqX)%zy2jQ*l4Y|?Y3KD$L)8Hx#pVFpL}6UGd)rY z<+U(1xY{;u(U9BFamqxO>~%|mDu+i-TT1wFmTKfH)BAljdh*JHQ(V{?=LLD3@}~Ej z?>FYQELUH(}0xn=5 zaFLaqW0tF3^S`=3fKmZRp_-9|A%ja`%dUX#%~zCubEs$7B9weh8$7JyQl>hzrbI>q zt`Ff9q9V7sETIvKWx!TR(Ns6itIF8&rCT|8;iN^@aNH7A_YBTlZV~T@DDxLTJ3JJ*xYE@8)0!JMkhF~1wU}#T z1fY?;F}YTu5ot@#>?{>H?qHaP=S)Y=HTT?7r2mXJd%hk|KlNnXe)}!{tPZE)&%3|^ zj(hA8hs9T4eic1mdrijS+L&UBDPrFF=8OC9xyRw%x=$B#%sE%Q{q|d)wp?V<#e8b_ z3^UFcuW6*xegZyj*e>4a`C43a)#dT^S6}-3VmWm;R46mR(^*$Gi7mcSj!? zh#PLW)}JfkYs@I=yYIR)w%cy|xaa-{MaXJKh)>&tZ?$b{nS6qHseDLo3{>nnn z*IxBk*xleN0i;LCA;x|C^;g32;`1*)vth#UbC~kI|GFzKzwFX@;rVCdmYZ+zmzX&K z7NgDvmSavhG46fj@i_9>a*zTM^In_)C&rc~a1>y5bl%1adQo4ESgD{OEmKaG-Y&g~~)Js}s) zQ;ASE<&FWPhgw|Ky7=QBK5;Emm!yXu;P)DZaD$hx)^l0~8)F!$vZY!V<&&6TIOf#%OZOMXD{BQtQe0I5O~^7M@4HKiVH!d9W+ zQyuEoJ7MYks3N?{LX2ar*Rus&9iPJToBkLZ_^QMWP9BQy6dFm}V3LRAfDxNFpy)ZL z-%}QmTSS<9q(-UyXB@)i%^j|I7u$J5iQBX8*uHNM(<{eS2>B)-GVM+o9YaN-tc+62 zo&-ClPMK*?KCmGjG?%slZ*j;u`9Q0l+*!m)Ry0~As17{Ik)ZGf16c#^)tHj-%JJM7 z=hs0+!5AGmw+PK6jg12k#~LKx@;W+~P@y2l)}TbLCrW5UR4CvoaYM)uN>u_=m~DLE zs|3rVE3zCB{&1#%)8?R2k`lmk3afQBb`rU`<-_2THJ^4y&F$I`DCoN)|#=@ zvdj4cu6&rYgTDop-@e1>Fxq3?h7xs@yl(kSg)8xpr$Wx|dvHk#zA_>_@#zMT3rA816vhjPHU0W@NNHDch8UQfgT zv3QQrqr6!T8fZ4sRAOpE)U$iF7_({}jVnq(H1WN)c5E-ls3{(J7}at0LIiRlW#d0x zF>LUu_G$oyQkd5-2vhzpgwm(6%?GP5a3X@mL7x2vwg(4jw{< zFgZj~lddXV@yjbIa2dN&tJOW2G9C^R6S9nAtS)i{jteM6$-%3p3b78*nvy|Xh*p^8 z=a%D-3iXm02lWCkjVBd4cg%`-Lz(IjgHfjXSYz@Gp7{nYj2-Fp2TP1kH)eL7zxbsw z%Mqft>(WDet=%N2SdXJqk#VwuavE2%MtjoL?O2Yyk-$;F zIz_HFl~6fn;GbrmV}=s5#BRiZ14>wl*O~)J0}smcC_v!Yx@1#BCi+R?P)02!C@v`{ z>1cpRg-q^Sb3lnFp->O2-w%ELJ-Id4UdLbFo@tg@VwvTauSN~+{Q*tjpo0&yl4KLf z#+z;$y?TAGFuoAoK5qEOwHnbZ<8RaPA<4@xy-1_Pd1ISxwv*BOw|h@z$_8=Bf{7v| zimU$6M@SeKK6$}MQ8(Uni&$`>9x+6XZkc75kLkNlA1`ZkNcRug&OQ6Axa5+HJrV-= zyvJvser}_^?)n?XgcEi2J8^ttjI}!RT`mntp@&cUOstV@*XZ133O7Lei{msxoPO-5 zcH{4Y@u{L82M&mv{&8JA_2lC*u>XK~_uaR>2In1Z`ezr{(xUl^#~+Q;{(QVg!sP1; zS1CF7j_KY_H`&a5U1Xs}M8h=k!ABoBFO1ntGtLw%ue_R`#*fukTg#2`ujq2GmFyrIli$L{tW9 z!qb`tYNgym4H2{MgxS{w)Pa#C!s^~iD2wep@O84{6o4PU7K5>JnF6#W71z8^--L|U z6iQhdX)i$BlD0s~Wi5;bYlhi#+yQ98ITm;kGpYxQvV+!ASsI~)Q+5n_#e<6f_NNh6 zizG~gV+b5qM5P)pf7un_H)~wKB$XWEGENo*nWa#4IK3NK^6xLX%d&wH1L3$TkUQNt z;;T$JZ{i>(@kAf7*{z$0E0aEDA6?eAjf|V0Gi(IYk~V6&Q=E}%zVDXuP1zH#Xw)^K z;)AY~n|gK}J!iS{&OFN^*4jSbp$s2Fcr6%9?A0#+q&^E)Ia2F+qt# z8p!&2&^*TqKm?JcoG!OqO`o(5jb*E#F%ukE8_6!NK#2q7mC;3?KE31oznm3w&NX*j z{f`^tyuV%?i!QpjM_i29UVQQSxaFoBVvDV}jSDZmBCfpl##m~Z<>J&6kN3w#`DW7V z7$3oOUAy^%p>MqUnx7}{+}UeT2p1z2zW2p6rRV4c6Y;@C0n?-iJcfyH(@oiBs`&GX z$N5`j7ykWHyYv2fp{F75{nx)#lJVn%58jJYPd_8>fAFC={)Cf^XVS?hi?6=^GH$%# zAF$ac^F66IDHw z)QJIT%&4VITOq_i*$6MLo=b+w)fD5n1y3Pbent-^hUxN;d`i(0pneD#pNR}yx=@^WGtCdV|{GMAoZryc=$^B1QT?OH+#P3(Lxs)Gz=_X*k!$JX&KN@KK>}a_~Hw% z^G(-%25(3~p!v|}i!Z(Ckr{1~ou2c}zksLSK9q6o+O=!E|NeVUJ3;&QUL)j{h%dkT z(qH(VN~5Reo_$*Ut~RCU&l@<@@D>oBE>lk(pMUysy!!IX8qu!ckE`~SQK3Q2Fw;yj zma}->j?vttlXQv&GyI6Jo>mJqsJmW;=Av9Df}hx zeC6Yli}zSOKKt^sc<0@B@}rL~6%#qC`7%u+fEHwp#@jLw5y$!fby)}QQ8oPjp3q3c zC}by5qX6F2Y0_HBHM}d|yKpCQhMuI!<@9UI*!s;)9jGD7&}Mh`|= zbgamO%vfU+K38B8US?4&k*Ys@jZ=Br*j4qJ*Q6W+#~((Gc8zf%zNaJUu$r(;2V_p@ zP;vo7%0%Xt;YGuiDcEriWKbu`02NTv%=8;UJAEyZKkeTI{N#9GQQX2Zw=XluCaz4~CX<5FWmy&F<2XO3!pCw2&`FD_@4@n|AaL zJsOjL?#^OAH1uLv7PWeA38_5zP?s%Dq|9><{EB zJ)odb0BOnoG>w&Of&UHlM67SI8Kks7+ACL&p41Nf zZkyT+Ml#pTlc`QiJJmhs_cj_huGxF5jGEH zA*^~@tSK>l>6eL>hS3rYi)lav7sEAir-}Wkd!{|vMU{MD(@A^3j1A2gg z$&=AtHJXD4I&+S1NI4`AaCy2^ex6~`t^I|I^)|oGg0TdT{xGsbhpFSK&S##qgt1dc zvMMhP+gEa^cu`TD4>gx%p~UIxVwJu;0VV$L1I=4#OO7}Iw6^AcANZL$x^OB%i>``t z)fHE0M0buxbY1lLI~9d&Ag-}2h08T40amwpTR|~!fYIpD!X;x=?n}F1w3zeh^v)1? zg-PIvkPRg7N6B75sG5LsM__4o`By~MkljR&-bAEaJh8BA9}n! zS`UoOJOXxp87+%nQNT;eZSvmRkkwF!;ZL~mG1@CHS?BqDPU?)jHo{2O4W8aKN`)d+ z%EI}R4u9wqUh^vRPge)Zk`uQ7OQ31-nu}c%fM2yvSq-wTM}>kodtM<;Oqs5Ze^e+rHjR~cjegl^ z^&>~4!9dtxxoo0M*Q79?^H=fJIJpv+X%rf;8!LXo;WkHFysK0;aza?jfFnL&K7dD! znI0_DKN%t*svc8yI=*Ru_?B5|ycX{eGJTu2earG^w}@*r@b|9hcHp#{y0 z_lp5U$?yMi4v9S#gLEmQ9UBac4aMYAxr8c(1e&tj+oLkIQw4ZbrZ(z!BkN;D@q?AsYz{FeA?IY~+&_w+psX@aEefZV zJ1$c;0kAbzu1S?Ac{T|nKa3W56yQT+@mEYQR98R)D3DD-SLk-*r72W-kdC*KY$QcXDW+b4x(j=qSb|lvuw#lv*!2wvcm)(iAXdij0uS)deSu!E+Xe z2}TK_1fG}2hYV%9QbH^t&xWFOG)!;YAoDsCMi0azwL~9fUNSd86Cr7IAk)249vCq} zGsda{$AMzqhzw6xddiYKFfejz+Qvt7A|lf}{&Fa51a9PRg7)|3mkKW>s)KNtU%pM( zSll+s(a%IsknYR+1r!ul!^(xI4PH%vFw>dz0QPEdzZMFfQRU+|gfV6~_SAq1)-}#d zrbzR{L;C%<0&UL)l$_=#mzn{=l3#*|#`+ih^Rql?vlt?#5Phtku?5OBtng7RW9orBaltd}-|P1se_LcLoUjCGLM5ew(@btexK)3IkiotiVg0nZt&c*B@+A!Iufg^>@zp3TN5{x}>f$G*5WojD0r>k#G zXNA8IC`S`XrN*;ZK_k^QM^jZghmkgE&a!e>ct8|kQUVNJ2HQ+Ffy|c131U1dR|5=P z@o;3{r5_4LzvMDHD80Lfx2F zKL8C0e-CKPu91vi0R_!CKs6fpIXV11ijbt=9-yU_x+Vy5!!eF1J_s0)yRvlOpoAUU zf|O{vB_2IJf5%SO3}j@Z^z_C^o4!92NR@12>a*x11UVZVPc%yXLWiDH$N>Vmui}bs z8Zetg+(?DbpBIsV&XJtr!vftgjVN!oJ|7Q+pPWZqBEnNerX>l=T+#vbbgQ7zK$a^Z z?>$vSIYloW2Nw)PTuMbXhbl@&gT7LG;~vPSv8=@v$r-0WWn^pp;gekU(dCaUB9gtd1 zLTHR7RgSDS4%Hhp{PaWqOkKz_$vKJJ#HCg9ye>>C`DKXR4;n8>#l74y{IR`AUFB zZo2nt0i;1rX+Ls^<#6XEKR1vDr`%J|Ahon&v_{gzJx_MD2{(L~N)D6A9jWl;N_!*E zDvGX+_i~X_=1V)Ww%CK}8$OgRi?0>my2B0K|s+cv0UqjBn z8MyTR88amLDc56}esTUMM;SYut7Pw7R zQHxRYBDUA$BwjLh9#tu_H*UBAW!eHIC$6J&1sb25R$fARO2Mug14c;qB^G4ZTx0Cy zJO!#hm!-J_C<2YXqTB{Y_ckU3Rz}VzvFqw$7N=m328~P}q^s~0X!_I~G7Sbh4XyB~ z03uvV8R1@T=sUIX9@0ZeP!*vaM8 zq*{d1(jIb`b1^({KPhO^nRGt#t+F*8O(4^>4vpa@ZC(>shNsV%aQ&VDMPuQbdsY0R z80j^3f64ow3*;~+C`A1{{G}Mb4HTJcMn5Db)5=rvX$ml`+||l8ejAT4hU+J{BH zwQ?3OG`%z}g73$ILQrxlZcI?(m15MPo|?NlouWav9#JY|uPy4|;d&+(BfmT?okpr> z5HxpHhTJBou`(*eu;{PCltJaT=0$jEXicl2Nwk)r;-g2W0@I3@{`gM-qrz)(2tbu^ zt?o+(Tu0}|1jHe`MC)r4epS%u)!_Y`!|3u%E>RCH7&!uQ|LY(*;i@Y2rE8X7zZQ(T zBMcSfb@YmnmLs^$OgGO)aQv4gEtCl;G`>i`y|LF2I5VH}Q zKaU-ZQ$xqpyQ#-9lK}Q+^b?e%mPlM%BLgAjPj@7u>xO}2XVtJ_KChB}C*FcA0~l@c zCF$X2coFafL?3(^gDbf*Ws$izcZKyhp6gUL`cxofBY4lvSUHshL#!MGI!_SL78bHZ3sm2yCm#WVBaDYgoBcYBF<gPt~QEj4gaG|gi8U*xhj7<$M%&!?hvT-8y%k;fT(mFxYa!`=;lsL0_Cf`&Ep!B zd~wNxLc=(NLV77?aSdQEWmz2ALrrx%R_@nAavfT#PF5pQ?jeW(2mbE>mpQGRoV#N- zT(xqRvdRw@q>~K0l1fBwQ`Qxt-;^U-YT}XymC2!*VA(5R6JZ%%s6Pnj@P>DLG3n8&9T2x< zO^pfxDYz$}ra6rXFvd)~ItLqT;ZWDy(?Uk6vY7-KZ_`mA^Q$|cG5j|Iir3s#B)}V> zdK{zsxj>qh8c#Ou3W!wbB63j_fc<|-&i`3}toc(u7$RI%KF_k)>0W;3Ggp_}Q3Un2 z;P9HuznYw@6Uk0YB-`?jT*{H!803{5UB^(c!kT1;1M1J2b8%D*DVsxM92`)ttwC$y zjX3@rq41~iT3ms~dqMLk&4LZ`Lw>ksoi|2mDM8^Qu6f*+;wQA!R)03w<|yCRkTqtX zRXysEwehK5V3e+6Dvm;MDMboo1^Ob}QeB=6Zv$LUYy3}C^- z6+?k>Ggc{4jN34c;@Dw{VCT+8@CuVlP>C+y8I;d*OuJ<+_-1Z(W^iTxJ~8+_No8Ew z7^jDhYF1Jpb0gy_0-TZc6zN10#|n9sV8k$on=Xxp$iH@y35Z!UP?>BDX}HyTLLHKF zAD5&6hYMUL;qX+Vjk^*lfBVao#+%jOWL)vHA*U)SL(++&;v7Mjg*6lBOV02Mg+l@K ztZ)TaP|;X(&86Tsf@Fiqq29*ms_0__iY`DYgT9hq@rN}da1riqNk$aFqx5aL{P>ly zlBh7Sr2EeXOX>LVA={3fo{?Wq)r&E3%CcO!EEg&9#RN*O8HG}b$gXYh0VpMpku#>N57pW$O8@La-6 zSQVF|HaZm_wI%UzRXPnrOPx5ZNSSMIcX~_MnF7x^)DwS5WGy zO79X-c0Xo`lBP_=GfTgOb9MY*0mdr&Aj7XP7_;)V;$pK6J!wjzFcp9@BfJLht|Ys5<#eXSvf0yZjG%%?H(pK_7Haar$KQ0D-Bl< zE?3nkod(EAnSbS(n_AL4tIjv$9Fmd*X9o%PgjPJLD?N_L&VfN5)ChuHPyI{5nN{vL z0GFY14OunZw&)5}B^ETjgC{P&e|`=WJilF?{wKpIC2nAPX%TKCqXB|(R-{Cw6A5N_ zBJI(N`#)$Mn)9gKw9{F+&iA6y$oViK8 z*8we;G8x{r?kG)egIT@PXJ+Pk;$UILF3S74eH;^vtGeY8{dWD0Npx~mmV1zVDOl(2kQf`xV(li48%DYqIV*e8Dsu)mIekOJ#Nd%ocz9MWX{2z%fKg@h zMino=V63zl3J}?k^dMGLq8l5aJ9yTFAHN>J-H0u7mr)hXWM$*)Q5<1#NMP%b03SS+ zTRlT>b_0G6WU7R5SGHDxEV7{4rxEe3xhz;tvo{A6>i@ww0P&bkoo5Ebbe1aIVf>ju zYtPQ{2wh88ROofV{r?9=(8t!n^VV7}3~bGjj_c?FePZ?10L72GN8fo?ta6FBB;Z=^ z8=*D-Og(ncSQg4p$|k8%aLxZliDaecF@0@s&yNqH!s zd;8%U{hIJMGQdL%Y6W9z8y)1`9MFA(|4;ztR9~e56cjOqwDFEfE zn9%R@9kZnQ(QvgrwqP#Jca6t;`NBT$NwV;U_%l>J*HP``rK*w2)zP=Ko+^ zK=KhLk1balrJ&rG=fsinsyjWFrc+}4AG8LA_l=z5o_0Pa_iF(C-{7k0l+*~#D$m!f zo+#b|W-*bSEp*GtXmM==O%)fNr+&am zDbU>ctvURO#J!#r$@x02Vk*O&!qruLahQHfzIohHrgLVl_;CqM`B<4<-8JUJNG{9l zdtEVX4BCoOB3z|#c^uEKx>U|tRoONA+ubnaY5x&&%W7JVs@5jGFR;r{Kmv zsl%wCs=>~CV~q|&v-f%xeiAu|c7p!A}_#58&OR;f&behbm^I(vjQn z;p3~Uir{sG#K&j|iWup#Ucnifqy^u27(LySr113DLse(h6|r#b(IN0QUJ=3CR8ic^H?_B$Mj;-w6_-N+VGY_}f^M`0?E63J_MLzyc`O9FXHW4&Lt@ zzfHqE?*fjNeFTm+!v9i$m(AU81ZVgMUCd04UIr+c1x%g#QONq2tL z8;jn867fh#E_X3<1*h`IpL-OxP(vd)JvwXGF51d4wQH{{Uoa+rp~pCS_^f-f#*mfG zCR{^oU48DG}x1m>X|2sriCe__>ucszR?Coe#csGzg#}f-h6!#x=N+Q_hMu zz-xgFxhtUDL~P^%Uyc~Ti~K|BFl1O_;CIw|aRhkTB&^}y;gthQf#qyF8=aCFm4Mtx zQZOmFiNn9q{d{OhRqAClfC%7fK<~mMccNt2^z}= z4;x((l)_uCKnud-^d)ZHWgD-YqLg~8ImJrguKx7@7r?7VUjJ4Af6;QOJJVW}e2Z%a zg&g!{sp?jvwN`&)QLjZD0UHt&zPy-zA|y{pNK|a5U?YRSKET(3W#CYfSZNc21yjVt z$;;THT4{X9vAmL4#UYxWt?0mSe<0JPflIT%XpYFniGPU&0s&_^wrSJWh7BXvwq1_i z94^Ob1p{CTMJHvcLzSQWFmT3byhOt39)56NCCr_pPy;SgHoF&E?}}{)qUUYuBz_7ueo>L z%tH(e2tknTAPa*m>tQRgY&o)#gd^G5NWoY_c7(yU9&wb&_LooaA38OF)2;5ir1jhJl$ob6Uw|x~uQ)zSH+kukKZ6 zKh|Dr?X~w=>+F5bsp3Gnb=04?MHTSkff81f@sfJKZpm3A%cmNCI;uO+JD6HaK}IU~ zhc+q-G3Fa4$iS=$=*&Y{nX;yWmQzU_lv2HC{&g<)3Lqo;$K z0$p4LP#*Lf16hL$ml!;A8S!fa4cfifp+`wN4FL??MobGT?d^LNW$**D+3Y~Wom(aQ zCkNWbxL!c|5=2sJBA49dADgng93#R+Y*nswRMx<~X8` zU5Hf zW~|!cULSPgub}1^(`iFsRd9@ZPIA~nZ#%-b1q?-$5cb%T6six_nK~+!=G?VjEi04E zU`A&+)%hdMA5UYVJ4Y;%wxuQMN#nYIfF9BfyO5PIk0+(-4}}}NG|-42kX3CK8tJpwk{ zHuUWQZ9@(&I9^YFw>i{qKMmm_WU^>L{XLy(#`&Abxs4xcxwR_-q}}*X?YSc+Y|WEm z#K1O?r_T1vCas~Hh#ISLJ~8=n6d;-axIu*ir{&^(Oo&y0{=|oyhXfT^;uzze98Qvn z#0rYmozZ<_+A3%`P$o zF60*x8xxX*9RalFb1`5T8ipa##rinBttpN0VZI77*E+^PlsgVTXp z=Fwh<9eU91DY&5_d%F|veH?SNuph2bZqjaM9AW9Bz%Hz&Ray~f3Ik%|jiw)NE?nJq zz~P0L&{2+WIM~oij(c(nBsjm?(tfb=13ZC*Ugfx$BMBTU^sImYeJV}h>UDc^#$5+3 z>M#ID=jvrPzBl}@)+emma9Xv{+i~LMtvKmP3$Om7f%Dc;H0EY2#!8GD9&SPD2+*}( ze0Uk*7TX|Ny0t!OBW@$b)t*EPM2r}qk{kfEI9om!13D^=Xm3~Qf`AJSUsR|nwu(dd z2y|Rn^xW2sU=tk;$m2DF=!KAJ*v{94uURs!!-$}wAme{rl#nLJMM^^=xW*m3Q9uS{ zENn-aFz3D|c8sxN zJdu|&$2f3uD?HR={Dn)O222KfKmWW=->W5lFf{~Fmm+aC@N3xV5)WCflsB!R!zToj z$l1DYfOBQV#tMxz+ibLUz_D}FpZIxOk{UH5MTg_tJ)rT2%ej&S+#aNrFZ1C?Aj4dt zn^hr+UU{}UU1>~_M=-!CeZ*?DRqM8aup@6)6)dX~Q@!utJ_s#?{$`&0aWRgAVPBPX z_2x$Ep#mQl53HDZpoa?&EEix4>L{l0O>;D0VUavQK$}U(M|QiNc2*xA52bTlM%rc% z$tk5dGP1}K>S7S9T?C}KPsCHH z^|qHOIYOBz(FW6pNSlYaTdVdTB#ir%1_{|5D)cKqRDff}i&Bh%SH&Xmc&P93USYhF zLAzL8v+W~&RUbU*00k}qOX97M%h%d>9S#U$1>SELOso6iWaM>?tPOC!$+0)&y+VTo| zFo|0mfjrvQyt~56O1|4Ah$JvXI0*#^M}cy1!ij3tK*zlq9zACzH&6hA3xnTuhZPkb z+c^-&NHB>lF~5=^CmO*`C`THrEK!O{NWp<_l=ZbW2RRBkF-+vWH2nvm9kP3%s_Z(e zJpQ1Khg6Uk?Fg7mROsm~`uhPFF(g34)(^^1uOl?kj|gz4uYV~oLF5srNw_{ggK{gi zKn3&zq-zNiX{W+S7Dx9Zjne>S`a~}=mNjA=*CWVL7k1QGYD|3bATPv9Zed|TK~8p2 zSzHi^1vH}OVgU=a<&kvO`?cUC7||aLSb+(cV6C^m%bAfoH5te-X^)>Q-gklS7%f zz=$?9r5}tDE4jD`QGv?i{%5UMBUU?G<`*1fOt12?U>npz6JH@th202ts;8W@A^HQT z2TpOM&t8FG0;Qd=^`^#fj(XxivRyY7+EnA{86iv{y+vXR+U=&{A%xl`2Myt5yNyy? z(+2@<>1|sl#&~ePfI3Ay4=ASA&?NQ�&N#$%h5dXcokVAaHO!U>rhTg?Lg9BplQ~ zPE6IAOm%5kgLRBrwkP?C9WdUJ!vV57gGR0Nk3gI$fr($m!9g}FHk^pdAPqSwIn)Yg z=`BN03}QRcgd>1fhq^d%x(%_KgacE}u+fsf0akZm}c2S*_F9sNaR z;s|`N4+inyK&ClvNoRpD z0iFjHDfX@zB;$A`z&sb&E*#@EC%%{RK6 zqaQP2Lv?=QPrO+P#eJbbRt~&~uA0!1+e2c4>Q+TrR0WZ>Dd7ZHzA1CK!6W>VU=>(Z z%5kfXty6DLs?<+b!bJMUi>>sf9h3oVf(6Nq<8~Oe3usff%YjDDc*V?+df5W93$I#G z#u&z`eNN*-4_L+Jdvd%65_+nh04Q4S+0F4SGWDBeAYeS;TsC>{P&^&UG!o1!dvTJ8Fo^Qhl5(1x~59gYo9kPH!CF_-9o>7kJ#I|#>C38R$K z%78Izqb`q4r89A;$tjQ&JK;D?D+k)`CLx+0Hqe0R-1o($a?CG}k&t`bo-d9bocmNv zAG7^|ahpxT?Letc6Cc}C&FDf|pUkWPt(ginY?b99gWa^EzKsV5nk)K~Q}LG&%i;Np zisv5Z$RV%6p`sWwnnW2uW1 zwaEvC0OpNX$&7`Z4hQVy3nGxTXk#@P8boOT!{H%G^@NO*%Ya%oGXk^?aWTH6El8db zJ&dioZ09lxvtaK4i-b&HIkzJSkR^SQse^_QWQ>`UF=WaJ@h3U7y8~2hJa|BDK2Vp_ zCm&uR@A*EfI){Ej(U};p>2Pgq4){A%^NB?s(7=8;CqoTDVR$(+m1|hY_>alPN@_5` zK@u`mCP&ECz8#^PMLSk=9#GLo@Q^HKCC0Ebv^zwov5NH3c@>M3b!zl$(W4f9!ReZ9 z1^YJS!HJoLERmaE#bgmOz>x3vWpt#S?-SyD8`&*D(ZdXlexbX!WMzNy9vgL>Rs68e zyM(M{BFK5X?Kxl({r5`FFX2~SIi6&&ji*Pwn9)B)9xuqLQ{m`hCV*n9jiy(bFsWw6 zZIDcXhL8yXb7epZeP0)ZkRs}{;obo@o{JoX?)DK}A*2-($3R7ODn@M%B^cQ$Fui7X zNX|RqbYMQjoDcuPkv?QU8ZJArskFO@dJ+Kzx18A%5NLW^aUAxigDiA(kt-)B=XU9V*taR8CjDCnh^%)o<*s0!^V({{zcDd3Bqc*Mu zaG+k+yHE)!g|kIE`DP+;R9!yYL2HUYQk1d1iYo4x66WuE^1?bME_b17tuvMU>!W^d z1NHMzLt`j`(hgcm#wv?N`@lb!G#K<9py;K8y6POTu%Yta?)4Z_kNs;vgO`m+LV5lP zrZq@nL$}dDh84HMc)ksAp9Oaufo%e^K&?ES0%fZU^+mPbM{a|c4Q}< z1!lGRbg<`f(9w+WyKZb{g2=*naO4nREK{kAv-AW{a59&Bc<4{&q_|gE`|X^(-&Fa z_6geFLagM{{t1y}t~e{;BFQ5aC#~#AI&H`&GJG$!N(8p%0!C7H2lr(Rfo4=7*n;|K zlqMaAEjZ2$hz>MB-`LAYK%ULVgiJ_Y*9ByUr{N(7*}558jf3yw37dJ)03}!2A11+W zxLx8_KsHJO&)USi2`JvS*(AsgUg=l`1b6Y- zsM|LKR(A?s1TeNGy&*|})73mi=Q|Kt$??#F>lpxX;r%i;y-+FM5t9qxsYnMl(ZHTk z6>yJ-)t3utOD80oR|ULrM$n+1+jF$z9v_4{5|nwIpIdkMTml&mbwm2ubvxp5>{ut? z>p=$sm+H~MdRQ0S)K+l0O4V`5!t!H|)qy>UhOXhuE@a701i`aj_Ej zQAMXt`#}^niYF_1Xs9bxpkt`uqk4uYA8d)OP!Rrn#vlJ1ym-!6tVv#cRjK&en5uM} zuvA;sU~EIiQ+FVOxN6m>9OQsHJ4aShI@z&) zoivRq1Q!K6{u)p_=ON-CUJi)*=V26*4m_&Ic@WV2(1`el!>mE7epn)2Sx(j}2)t7B zOc01+{D@=l3q7TQ+WILc9_cN@Bsbh4^6R$x0^M-Jc#5A3-^v1 z9|VkT+>0ZSak3=@Cl3US-9G1#8+`shEZzo0Jp>h(zEj% zYdy})I+I{7V#{`A!1j_BWc#X6D|wBftw-<+^O%iQG-CX+YNVu zY4vd)w$UX@`W)1e)28V|sx%ACM7tXi^&{P;MK#&m9ZXB{~Qr+wz55~PVwys#g z#j1)B)>oeIr|j!We4Vd=Vg;9UI4jZmRQCwPDL+!BP_rHP%!H&XU zSEr!r^O(Mok0ww7G-yHc)Q9=K>(m~OC+ga#s>u#s?x?0I`SxL2IF+2PqidS*L3-D^1Bs4lU{1oK! zqR9bK#SX3}Mokfds-p=IR96r1OP-dyBU*Xks4Q|E=}5Jo8OFS1w}U?bn((KzO3w;Z zE~!k#WCgaV4<52tDSa<^Z8hCjkowsR14F8zWBw&>hpVyGtbmN1aXIV2HjlJ>^^5vw z1oPD+*oU8c{$W^8ZqZXAIxTvVLsthCrh z9H0K)nlcSkb@1E(zRDADSS3*0YU}|Mq7$nLR%g~H%fRMiE4a8x=%XTmkG6(Zc^jy2 zXePi`>O%%Z6`_M$&By6b%cHdLEA75u5S_Q3735geb-enPorJM6i$KQviTR2Mz*tgm z?$E0&zR-EY39f3x-Mjd#{h0+I zrK3}t)Kh6D1jh5;))#MdMaQrP_3;-FWzi~9Bgq1aTF4Y^7hO9*AM|QV-wR&HP`hB; zgE9qkHjyd06)32U8r(*76#&1SyyHlD8!7YU?91(9ZwhAfCFk0T772aCR!R15`nEgx;#ukt(SCP(u7~14trNf-sLx;J$o6O^zc1 zI32_RYXH?*94x;|?iGW|p)t1QWV_u!B-TL35jB~LHws`g#>N9Flr1qIea*mxA^34v zf(Q;a7 zV9R?r==(y6(=#4wii;u#RPh4=HPaYNY3I#B1rWM=XGl7lX1a|b!g6;;*$cT9C?glm zmC7o3R;ay=bjtJGszQ(8aDxV!xtGZ4!xUsbgE1c%)Po#PX4)h~_IP?S#Q8%)XuXB0 zvNJ+otYs!~bTGKlbUFJ17#Rc_KYYM41tCG7JZwQw@RN+X)FHs&n_Ne^l5u6O6qaq2 zoCMS*0;6;|23%_8BlKzjM<>Kt2BAVFVw8-QR}Q0?49lK}#@f-UKO z3vnjQW48j$O?U*?160ow!zT1s*%@*?!NUh=S>2~ysym`I>Ni?*PWefxEOBWZU;s7- zI3VzOT>(Y$S@sD+oof1?>c}i8CFez6Chgrc|HG zr-U)enIR<2*1pb*>l0+C=DsA@8oQYFjOnIUR%}-ahxKdL)CQX?+?a=_g6MlazUC~f z!9@?3iXJi5v4Zm|4F1T0ld=Q`-`k^{m0VphLK7OGm#YP_@ll31wi_60~&gf;zVHh_7OHwka~Bt;(>w$_`F6aS>^F3F0W+=1U^0eGOwHu zkB_5><;%%=XG)F;M}=MDAq1hVxErAOG?WY-c@Pz#tKRMsa?j5widm!_0n?;T9u1rW zQAevX?ynI@6g2wlv690fGnU*Fi@?J7ePU&W9kuUtc<_W@YiIo9{+oYMg4ZqJ#Z#I- zN}`tAzL%%gymy&FaHG%msOFB4U>XmyNS?3SSS9LMkn$Tz~0#rkah-^zbpM>UE^VuY6JWF$;x^O$V4ec99E)BOMxSoJv6S4qe zYHkc8*fHI<4D%s{s=lW^=Q79#ec+q~y-!1DsPhB|ojE`df1lX(<` z*xWMYXy?RLHv=nz+@^}q6LgaSPP0L{+>s9nGiPUyg51oYamtg=0Yea0)MQq0A;7WK z=s+Z+GQJEo0V^IR8J12@0nSfXY6R3cu3%$@=j}zE;RGZeSkjWv+`Wi_*e8&R#fL8t zAV3ndm{{D?!&C5MxPJK_LS0OWR3w~m3bQIFK<29sfbR`*63`z9u_=Ij)N#K-^qvB+ zfrKN7E=kTY^T|duu8!{3Ofne(p?f$V7X`e3=xSp-ErkCOTwkE!=3HSeGqy|tPc@Dj z(EPg|fSJohD}4a%1BAZ5Y@l}TpuoXI0y#HqHz`0eJ`NP@dn`r?$9%4|`QxYx(riKb zY8{7F|3*MM^X>B80l5r7`xuz1BiI!*Nd8rI94%>rlWa!-bMP7TJ$?XzFt#NbTaBX1 zS;a5Z6(DttFyrVIm(YPubpC^nFt$CFXHF;(cpg=2NS0O3U`1u?G`>Q1oGGhE0z_ZWdgyDe@ff9#cgbDas<~CXxKeH z>XEt1r1hVVaV5jw^#t?>;QUNHQ1JOD83a6|ORot?bT~8u8NzeRC>tJc8>Fa#DC=1b9~JoWK``>x(d_S?j;U z2$QsGre=QR`2+Dmb|VENql&y1;26tbHJ#NUGHCpB^71Nx9g#4dB+iM!<@+d`7cK1s zg54wt+L}3nD}r26C8RlBtfL6=in%QoY!3j$IZOp}L&Vfq}SV{3q1oOR4j5{2} zkP+mo)6A4HgI0C1)kr;;J~1~4NS-gAA6f-^u0+7hlb%iJdA5B}Hk33UqYKdsd74vr zk9s3yo+zPm&qW|R3D7K*aGLBSkY@f1ifL3kf!bKNk!bX*5 zY(tifYejxq-ID~Uu^a9e?8H~oAO^Kwvyx3v0s5ANI_P^Qa$<}bSLv~}MHN@wzRA)&^bkLM80}p?1~@&8 z*_p?9weSdL2iX*>8q4nO$<{kzF4$A>dV2++S)EGaq&Uut@}Y9=0JBf}xrW zoO2++^fsu#No=h?`k@^2;5d@jhBlv+m@W1Sv`ba?4kvpFx@p+B&z7wa=c2N>0KCl<^n%YD9?)nzu~Gt@A6fPUD zE%G<1JdxQMNBMaC!+h8M;#DK-EI-oFx6@aH_?k)OSA}8YNig>_Kld}6Z+zpAmD_H; zEruS)sS)y)69kMsNp&1YigWXdK=o0~zy~c)+A;5-1uT>gW&%zZWps$t5zGYD-VQ*@ zGDd!yk}=R94~Xy$Cgk~LaK80~>l4P!Hug|N5afM2?#X#2$CqGh+z6D6p^rIBMC)5U8&y}-hzffNDegA!#``Mp;%jQ2)pu6L? z+wBZ<9Q|N}J1N(~;N$FS9w!JbbUdw>K`)$?NJVekGzL2+|}YNfKF>im=~Eudo#NQN(V z)WnMz50-dxrAj#?$Uoyw#6cy?44_@;C2ZP{1C0{u+!746isU8r@DOp&Z?hvE^_O21 z?$;xfj#)PX#70kom(>!++776S?E(ZkF4~#JT3gyKT`mkX*EiIM_4Bd{tAadGg##KAHnQkn_*`ekO0JkBEAS=98|~U!=OJb z>k4v=3-)C@5pcXv83BTK-n!idVT>2R_9KJFn6sL5KvWsy6@hU+0v!M!(J=1BG`6d$ zilEf->Mnr=n6s_2aUfhmz>hm^YBk8bK}Teu9#4!K&`ooQpLdF@;|Rc;3OovV=8&Lb z=Ylh}Xb4S)3MjHelYn~qsJ=CUjxAt0D%owmDA0ATEYP7;+6ZmXF{Dig$e~H?4OP7{>)dG(!a1fk0Y2Juybdj zEUrFM{^-YkxEx=7v<#JR2fFZ6#O0)$Ky2S+(f z954e+ac~d*WLAGKAeoP?8daO=8kFZT;k2?UfD*e$eaO>;QE7{BBLoi0U$cU{lVRV3u|9AyFm?H4qkR>73x{vY-Lubmvm5a zRo)kR)hFO;+aAVFjB_^2RdjR)?+)0O@lev{cM&5AN$&vECyj#~!AgAFTzT5p z+`R%t*;EE9b%da0T77DM#hepzs9>Ecc_oE)fF>t@8qpNPPmJJ5$zQ00X zClyF1TAYySkgG(r zLO*4k2grMSQW1er>aW@~f3-#*r3n^(GFbmSeB*cUXkTyb0W>kH*fy#K9N+=DkIwU5 zh9Msw=!LEwsFgtHxeg`!04OjE9>EbD!M;EQx;7BxCV?C$4=Q9@UNn+I`x^x{aFZ|f z#SuGL;)K|K3dhL9+C1s!)!tJYaF{sNt&Y=vTpxC^HBDi@r$(AzdLPtZeD@WEoG)a& ztj&+BZtx|@;=R!Amc^w-JNS68LnEMZ@)vh&418ZzW909b)PDpr1ys>+9g<(t3~vWT z#$T12$V}B+h+k$@+xM2NHTsK>?*rC+v+7rHVioCf$snj9GXgPenKyBColT%RB?!R0 z8|b-YcIuZe$RrgTxD!$3Y5_VL=?*Az9|@=gN-{FlPzU!}J=kFGD(OJ$)(P!&8&cX8 z08P`j99tr;g6mbnxKiVqP&TQY{C?mr07;793Av)F^KK$g=P^Hm8xinLTft{P4r7-= zmqRk0A-0C>bkxlE>V$U2%HuT5O-{oPOFZT0Q=WZ!;>F5_KTP9N0ssjdaD8;ut2lpg zat#_XWv;do^T88V*m1+xQ9tNc8YZ2R$R3n{U!)HE&H8fJRGa0j3|)!PY~ zx4XgEoO{Xv7l`YzK)KO?DY6w9>?s58?a3D4uo4{1I&wx@)iJXOc7wXbX2-^C3ojVB z1HknLv~>$GK%SifoIa*ug+ovv5RtaM<$UFA{fphg*zSWS><Xht-`5%%2wU2z`MRF&VNA77FlDALfuYbPb>svIKk@ zn}o1Mc|}0;#L>ZE_SY1Um?O|qs)6zH)R2j_AJ7AZc%UW!JlVDBbbWwHi&^dH+alYJt=VCpNZY*FH&kT9>ose5l2|N;Rr+|}D729J2 z|4aMAiHk?+oQq9SS#?7V_w z9@J_oXvbV36)%}b1L_fpU|&RK6cs4cMtcEAY3FKm^ejX@bl1P{D@td+m({}D0zHBq zxygX^t+nJpv#Fm3D+;KVVw8Z;%0#tMy4a5U2&vQIhH(v3>#IQ^k56IXe7rO$FZ!|* zXhof9<~VC!Tw%$T7rx#Nk2*k_HsuUime*mY03?&2GO1)`sP4?mt#u z^G&zMDz3j-UinpL$_M`T{pBPpJ23eqOp-AU(`ZOfs>||8b^8eQG@TLJXK-~$sZ_pd zfCG;0vyOD$Ed4?J=;sDM{3!>>JtDTrxWaD(Ik;!({&)4Tf!(6|Ih37vn1{E@xCjVK zMBq`r*#;J>249|o#+Dj&tfD*Jj=u_wZBE(|Fsa{EfQ-OUFEE6x3>i0q9Jem`0%fY$ zrV~5y@cN4;zV8YHc<>$=1B0FfKe7hj6NA5!hT@Zd?zG5QKeaaNF1JNH9`79ieIhFBPFD{cdNwjE++n;Bt4hUU_a zG97G}P~Yewz^;;SRidL$L3m1bdjEk*cxhPP__DjpJHO`{vp^k8}aXP3(l zeBI6E{+qjT{%Lh~T=VaASCf+92lhA0_x!Ol<-7jaEvD)E!my$O+c!PyMESu#d3(9D zr-pS(UtX8bmVY=UK63+=fK)J<)#g-Z&IoVIZ3DC_JJXvh$3$WpWT|b}?WLp6j}sDC z)@e_DDLv|xKO>n76j&xGy4rrr5vYe*q4ScL{Dr^&-uJzy96x@d7VQ9dGR|f|PRm!} z?J_|)o&cO}0x4hdixxNLI`Vud?Qi?2bXu!a9?9uO16#vm<{u=@emcMqfbf=@2M%%s zpP?LPta`kXOS8a6Y3|9z&+Ukp=MI~js)BbV_9{(0Vim5kI)3DA|2U{PMlki zgvKW`v`XsWwiPO;7EpqvS^xohS&sBaBzD!w?QU7769G!nB#{cL6XT=SMRGb!P-h%= zW3j(5Ng>L1(t_1tpy%vXxXx=Lnb zvN9}x{P`!#n_qfQx&L*)Uw-F5T`FZ^zWnaTm&-4{=kf9cb6vsduWHryiWlEfUi_@% z<R}gyj*WFfL@}J*S{`7x#syzR$W92;$E=M=8 zn*!^7;`KxS#qH%Q?mJ#y{=zfm*kY%Apvl-^*u-1Ycx z>v&ndBrbwiR+h_)U-Y#zPmzG}i9jAC*m3Eq|8NkMPDif5fsNt7FF5n$W;zSsi=s~L z{nb`9F*PahMul*o?yYS=K5XJg<-M}1_c#f5*jIH9Obk5c_Hrw>E9bSEi(dySnH4(1z8TNJ%m!isz?v(1T7UwE2gIRs*aUo=tM41 zc@el7@+cIzty5VLxhT{JeXmI<;ObQ;d|aYW`U;U~t)w8c?rRHO(MAF0CS9}U-J~;x zsMKW(P!ho#WYtUnpFntnLA!%Dd}ps6DA2w3Pux;|`{S3&XCJ&=yd+{J#j1)xpjFbn z3LyXUOYScJ=kJ^^|M=g0vHa<0pDaJ}jklMNeeitw;@N)r_}R7cHU-6pFAOv_)lO|c z^M%#&z^9hWBg-4*S5^0*^0?}|Pxs1a&-cq)|KG>US3l!e`JO+1tCo3#@~waPbb09? zzN!55J02@<`n4~VfAD8+FW>aslX0K00>5DXfzPj%pMUq`gDPx_tAOpDw@t!3*U#9=KS3@n!dx(`UNnw#9Dw&Odsl{7J1Y-}LVvE2q_`fAv@I z))e9-)Wy9{Ql2{R&haXh05bZutGSdb^wV_0xUyG0&E(W@ zii3XNs}$2xtpjv%4<|_DGg3Du5L~K_u$PQyhmC_&ErD%)eLVsm7XUa+m2-p+de&5I z-|;2QT^;#OeSmE}sQDupdK**rj$lV9peAH`b*KN>X49B>62U{~66_e9)_m$zxfEIt zhLJYNGKKVmflfr4fn>chvhE37*r;459IcrqAnjG-vIaOY>lAZhlhv(K(mnV~x*9iu zo3?qeC0lqeRl?{KtWvMUuxIURRnYmoFsPuW+ki5u)1peCBwBdq!a6v6gG0=$z-G{n z;A%joJg$||6IxZ3%R{e}e(#5$Q~p2U2Y=+b#ud)ZeuwK?zH_8dE6dzq4l>g(M zXUhj4Tq(b*p!D3^d)`X?{;#`57u_4>8Fwv}+wWQ|J<0t`(uLKfuNb@Y3YP2TU%vgZ z^65`5m!Ev!6Qa?|@s!$gq6z+&w|}vGP%F`&d++07xl#VQ0^E7^3HTfT=#%B4$NS|K z|MGL?OK)2$J*_UwV7)BPua{$UYvtJdYB^R`%hKj*S(xkV{3qzqR?LyV%L%r(*%;m^ z7@K(of}K%mdkgLl;fOnmb5cbATy=9Fs;>^N5BhT8u~Mq>9CwAi&>lVrM~o9B zWMEa_Pm@O^uz3}yI({C;s{(8-8#x#$>30*glJi3+b(<3#M?LqvRG{DjZ+>mOh9&W0 zTwtN2JbyTIwEf64@_4vI8F+)z!NFO7Qc-P1tFdjqlM?>4W*{YpCQ<69PMN!P zR9~1M2td~g1VsY>s6>!+4l$}kTbJm=-*-ueY8m$QZ|1R56kqItRP^;c(;qf~C1QPF zR6&rHCxNgH4$SRB_hAA^{MM%EBc77&Kj~u?$N29Rris7yKu31chPoJ&eFs>N z6L1eOsrhbrr66;kQxJN(RzLFk<)3S{^t{)6r2LhC{K@jn+j?a~LFlA{4Rim@u}=B& zr!AJBP@wvAKl@NAw=C3ot`Am#c`gAOB6fkO?{HtQsoK=Vvobx+e@$F&vjL}+p@-M#Q-f~=et+A-7FyMTW zyCNv&FOXE{;H}T1#b18s?ZW1|7OyMirn%*EYdI%8Uv8N@U(U>5ET_vw1wRG6(k~s} z5vEO?J^Z30vSlEecg7S1F+m@`LsPnINyI$>N zUz6*|!zwbq2ikTfScykiSVYK?3`sEoa}ft^zG@c@O)02toC&=Hg1-U5Fw(!v)E4f( zALqIlXU-3)LUr&Hswl8kHUhPx5?-2P4!UY@GVw)KgJ`_E6LAE5m0`1JT*19Cpd;3B z5Ecn4LTTz&6U&L@2%_;efSdIp$W5rqiru|+)tF(Xm&d16No^hgl`#0Ps9%6DrLFd*5$BZSd_TK&p?v>4zpMUq+^3!ko zeEH@7c&X)v{L@yLchHA*B>oE zB^kf@z{T>Y@(scIu)N}hH0&+V|BzO9hiE_u>*>cz17t5WU$I2b^kE#3# z1-nb-_~vq1EbFDqwn{pUs{1(D7ws9a4qj#w;A9Z$e;gVe5h`!L$>puu5{S8H$M2|7 zM>&qr_nxZJgG2n8C_kak^r3|4N9dhEdX%?A#WwU?M}krxd+_VpGL*~Y%(I`=V@U@% zei_`4_Yp*}F7#rh5B|JT!>&WwpMXHQP^r+%c2+}Tl>@*i5X5_G$n$3i=L3BpsbfPr zS_Gg8_uNcxJt7b?O~{!QXwQ$l)V&4c1!EBp3)p5b;vjSv^oI=B!QV245*|egV@y6Z zh`;v8Kp8Tig$#-`e9*bjX{Z~pjkbe%Se9T*gDZoSyAQ1P2uMWwI8M?eY4;OSPD?g( z!l-OwyM7vS*wSbMjy0Kxz=Wo|V>aF+XeITY|8%MR5C86q<;VZRUFEH>e0q8PcidBc z@-N?0e)n@LWkrGFpZ)e(Z&AMc?>?)%?iEij?|ALA$~QdkgtyH9p9e1~_}o<9@YkPS zUU1h^tegO~d*IRa@~m5XRZB7AiUg^2VoWG?g*v(xm$F<^H*j&>&9?yOt3u!htcCX;yqxZIH0h69(=XEniNr{20_#j?el=t?G7Thp36bg;o4 zGff&+t3x?n?w~cE(>dk6r4=L5ygr~HXNN5C1p)Sx9k7XmmCE>PFBz=x4I&IJS4@^C zzFzgyhKGLi$HfFUh~eNBq8vV3#_)>!bpbRZAQ2nq=f!oXdgQ4Qfs)`6E5-;IZ1*{c zM03kRe(25*xvEb%dg*K4k{R8Cj#nwvf&ed;?7SLG7)hrM5JbxN!f1m%G-s@iZ6frE zMBoov1M^GuFe5EH{#Em{NQVp&1atPMv~oubrL+s(cQ0Yip}T7?WLKV{Cp*f_67|f;#-O0yA*2 zf1!NpX)h@syYE#}mtPs*gPoYmT0Gr-Td&-Ex>x4q0#?^H%O@UNFPC^2L?_p&^XNV zmeWh!^2JM9X{r3P=lbQcR)d?r@PhJ+UwXLw)~8p>9Vffx{hzs9HZKm!*FOKI@>~Dy zGt1m7KTy8@g*TPuOBc&0A3j^|={;U<@18HG6v&R3Rh@bf$OfC8vcB0X7dB1^Pn9P& zZz`fH%jHa&8$40I;$uHrj`g_*s1>i|KgRFTy_(;n+jqe5^j^zW9pWYCina$1M016E zb~r*Ah!>%UvNF!z_k8S(aGWfC{;CAP1PAQ_u?Qb}CVmix#MG zM+7J?aQqIX3b;RK2@v3;=uC(VAZ_HMBOCD;i~^dZ)!s^kc$trA(5Kyg3lM^19-;@q zi!T|(uCK#*?$4O##_qIJO3u;O+E=vGtpxgLSeB<=(U)#NeIHvcA5_3_kW(Nk3!QRtby)u6Czs26KfYW( z^qCbc+%zdwM{xMyr&Rv?m&%1T(c^^8Q%9XQpLlqs{MJV=l*ca)%SG|~2my%gM790m zxj}hI!OSugK_5NeFYg!s_leiXKfh+)=_@$F2RdgScxY9!6s$hKUOx5*Yvr;6bl6Sx zYa8W3w_mmohwq|-w&C%$^3LBoUq1A?OXW;=y`1S>E;p4+<>bbtvN(5HE4Rz##N28* zv3a?i-ndw9oX%@^1V%e-4bw#0r zS0ff^w-i-)1|4x#^qDP8w(US%6DvGcML1cn?rJjt*X^w@d@7wfBw$VI$548)Y7GNN z9|_z{4!dX7d$l$o@KY{>xJ+r;$#p{baaBg(=qlJ@%MgK0NQIr?yQwRfO3WT?ocG!Y*tP2K9# z5gft3fP)AQ#Q0GG?L%@wtguaJ}C!XI#;6G+;A182Vw3334V zfCzMQxbz#r)tPu@Ci>XIQ!vogcHW~R&#Dhn@^;cHwflxOh+mED;RER#f1w{3M#l&W zgbHqKRrZHm@~Cez4oHxq&vxb-Ek9k!D$hT+BU=#o)z*Pt1+1hjtJ;WQiXh)76@ecv zQJoQGbj5=l>W~x7X`=+djDWAu`ijVtLjtS;1q|E(6ubSTt zXh&c}Z}^6=XiouB-S;Vw-SG&ZoAl-$CUebcic=AYNvFcmDl@7=+616lZKw;qRA8lc zQ0xe95Xf$1 zaxZDC>?aT0yV^Gc{kGybYo)!);tQ`M$PN44lamcZ68C@zKCCv>BMmOUu+1vYzed1F z$)3x1ik?{@&`6*D5w>E2f94LxbtbhruUT;Y+Y!>nvXSDX}Rh8AO6Cp)Z3n*VT zk)GzkysFBWw#^FyrTt)y+fh*q#~}qJsSC2r5!`Ul3@eGFF`gMX+1L)XpQvR3X|_^T z=kroF<=hA3W<}VUi~pN%xutyf%fG99`XdjN;o4<2Q$U;>_%(x5TFsp<7koc&N%5qo ztJv@(_`2|G;R~)3#)myuTKHP7oN-PBC(^ijRuHUA{FI=azXO~+S2#-cdh54>3skO0E6^8S3E;hxq5A2^d(}^VGp>2?#P`y|P__vHPk#>j z=A(YO@7&kIW)aYF`fOuTkKwo=@O@A0snQ5UY(LP3dw|%C`+quaA`^RuED^#*?bMQ` zAHi&h%?J+S2c2XQNa4-}3tODLtHzjkTx#%8Qeds?Q7J@7X<`NsZBWG)r`WnLn8n-D z=uV;9xlX#oYY>|3Vr+Yc6eI26Jqf&R3q42E(T1QL{o<>E9JJMUKar}6O(}_V1NRK2 zN3Is>3Dc6`Xse}McNIPqfT4e+fjl0;p#a7yCft=HJiI3cGOs*4X22r|$27qfadI`u z1bG^rg9JNly;)XPR?5p>_Ls}wdgb?)Pk#8rWue0}Ae&`DtG=bVm2!GsE4!jqU2jdn zPURXWo(q7FM$MzOFOWLI6u|K@FL2Ouw{}*(59HcPg|ksZI}bcj!(^`TZT$m3ZXe&e z9YIYFNHjS1k;j<~?dqK=_ZM)<26tY{T5rk;ZuQq36vQd_y*Jq)@5yJ48jZIp#W+f72)gs3TAF&v6Dq-9w6nBO=PmZbwOwiit z#5TZO^9-J}2~b`Qkc~9z;NgobAxApseg%<%K99q^ZHA7K4}pn5Dn(;xNBoXpzW|$# z4?Ov{t#eEgH6EOgo^)4%jo1m3V`dN^{m030gbms#6`XgXIpW72JA1Z#%S*qty!4yC zrF`H$?<>6y3xf>@wc`qQH+3$TQ{8?!zA!Au6bQSj%h#o@X2crE(;I-T9gz}ESR-vG zK^~VIEjC$U;G|IohfiPtV4xy9YgTrwNL0)U$KRbPhOrGd8PaZ^+mSTX;s*B{%u^pY zP*y=a%FjxcAVQr3UEP+o{h^gv>}zRDk(4LE^}1d2p)MeZ-Ea3l0#=P)Q4LcE3r!3q z31+N9U}Bvpmu$)iTeOER8k0~NX_o~sR^IBP*bPD_kT|p@A_R*#CJ$(7D>XyksLH19 zpT|A)F>liRnHHj;F%Rl1pKZVtqtZ-C3+14^RcpQkxq7isNouajvNXda_RP-=*Z~nV z^D-k^Wg3{oLdwNfp3)m^JF$%hA&!kQd?&#!f|z2O z9iW}4I1(IqEWOhcD$toPs~9*mSM6H?{*H&{jb?Ci(=C7+lQ~=&AfrPdLAZh(4wsdR zAF^SqQhF1#y#kVO2Qqb(NB8;CW3~qAW49OYs-(W~^^OU45?hBVbq>3Bcm=?Om0orBwVxHY&%O@<2Lh)pz3 zR30`g7Lx=PuwsrdzHTlh-4_z{UqnM8(x9bnJB~$#(6*sKNf}7%;F=M-fo!4q6`PNc zCIdO2+CQ^VnwkxaEjwfHPIq485%%zfMwR9F3YCZ!E)q~yWrxKDb%{I+gen1~Yg3Y~ z>{AzPa#;eb7B_edWp}>->4BoO0%-;_$K~1s+Vut(%V%%qZxiSo4h$I8v+T^*Jn*}}Uw-b*KU?m)>uGLx z;ljo8>ev45a(?*_$}^tz%yN0qE%Sr5a@%9?F2l9e^2A`VTpsqyr#^qSyz+bh{*?wg z(fMB|y604!;GRk4Bd2yCJk;gDArAdn8>)Rh)Sf8pjkZjBCHU?2(h zR$It+qFeE%wjk&Uf|RBe;Rsm65R*_zLUKc~1x9`6ivdI@c7!5=X@2ud6Sk5!$F|2G z^I=>_b-exA291IEg;mG32!Ji`5=IJJiLvw`$Pw&35@O4Hip1qDLbpKMCZyZS?h#O> zC1xypV*ry71oC9v4cf!lHi{=Onej1xaswT}dE6UZD2wY)C^vZy-l)(XB5uEs#;@R0 zczxj9h0Sv3o%bo&^~(uebe~*UFJ~6l%dwso2ZPnJR4$aafBx?B#((kta?hQ&1S7$P zODpC3zVn;QUFY9ko_^2ivNr6N_4$)!WusRv_2|@4TFjUp%H= z2093Q7P=nz2=3@}>(CGGTnL#|Tj=YYQT`KFTA*(tqnyXcP{2{gP2?jKOa!3(fm z_Qoa_T|Q_L0TW(oTOBEUc<3dLDv*r02*GvS7@I>H=z!?$RrK#V zg=XIB1oN#n>3NBt8mfLQ>R~PO5a;iHhCwpt<)`iREM7QtzaGm~z@{Ug( zEC2MD-c{~y1v=p44}P}%(BJy5^5qL3ET_+$E`43B4mRe?O24B(*C`J^a;|*GEC1n@ zjlSI=PEoC4fbuvP92HL3=Wr3#2x*#24g|X}wz#e)3vUa0IZ*BDFT9>pcN3bOy_N1!>c_ZE4CCCBL($?s+ zk$jW~0pmq}i$>QRo-Dch4xU>AkCz6info_P54QpHhuL$eQTCr$eig{9^|AUq{21dL zvUG8hXEZ8poXW5?tlcn((#TNrw)p{kzy*XJ^{h-qJ1FR_apl=-MH-$>;fVCW?Y^N9l zJ9+`!v1P1>Je^vAN4G!eMRrApI@ z39>DL@szE2A0Z?_0iqWK!ZuJgh8*~?sUq2Y0&s&nNNK}Tvgr@6Hn?Kc#6+@&{z4=7 z`$>Q&Q}(_=&Tr;eov(%rc3FP}*A|#q*TD3M@Tf~3BHQ!X(?N(!w~hswyuKa zEZqiQcKU$dOlj&_W$<$}Y}Yj_Jh8yRa?cKjhNJIsk4mdMRyMRF5Gr!YCrTLGmAcaA zTp)I=Yh|~J0dUe)9_=7y1(k8*Ai-|Zvciz`J#FHrE489ye7rJMWSUoBu@ySAf+NWJ z`zy7UC+OIw;(?>b#tanS1?ttIaAU|SS8c`AA+vgN)1ZfV8nG3f7e64ZjlLsr2vjg3 zpxAC`Al>t!8QOZ4DL#H+!@&?hGWx1c0YOb-Qh)-e#)_su1b(=AczFPX!3EVnX`wp$ zpgd@=1vJqc2N~;_gv;-g% z+0_yTst;U;g80a0UWJG>7NHC;+s#@Lea=PMFs~t>XjYeXQnkM3flP! z{X#JWMot1+#82CJbtlnw?$s;VfIf8&3b^{GR}$nwkv@{`Ajds9_Z@wxQ&Nadw6WpU zPxp}v0+C@($Ot-E%Qki=svY&u(~=IZZlFWddUab+J4j^jys$Ya0tE-QYp$z?pnT7d72gVeN#DsQw zXP|ct+X_g{6)voNB@zqGRYeJ7mAwQ1h0roX10`e&=e}52Bc+Vg*Vw+bZ5aXbY$? z-rF&i_6U<&&cZFF&M3J>%7H#iLX$9&J%wlFeFRqzIVk%Ku=Vw+c;j;{q7Jm{bdIg8 zTrSJY=alZtkM^V7=U+$uXsc4c_J9A|a_-zYr=NEB)5}NS|L@Ai@Bc!X|J1)OUw_Z% z%T34QmlRkiu#z+{h)IkCdKvi;;ExF<{+BZ#jU$XN&qNUsiWrCGK1fJ93m~@Fpp7lI z#omG+rRV-st`;o8=?IcMmC0{`c^g!+__mZ#DES6Y9{OO(i<7d0r_L;sZ}1$4?BlFp z=dWXx>@q)`puSSaR%^aKf$K&OOSaAdIPk7?B;Yl6;~4)C^BFd#Z+5War3-+(-)Y-Y z?>72_#*NWY5=H0WLBL10ZCd$PAe~l83>oOGfTMPPzt3$)?=8p5w>=X z0NW-g*;X-hNSS<2lU`w3waU?@nmJ&^cnhTbaUG_?7M=zQvaq&R9~t|AIKM{uoj^2@ z?S%da!==tlcjhR1*Qq}O&0j;d-wk&JOV|N-Ww4LXmPLA!KH#;~Nzk55`weub9=suk zdnBzRQG+jQUhECaLXT%R)>OvDdMUky#nR`NO?R%`dFRdLSAYGTA`?iRSmXw*s*O0ZS*R82cM7&lHLu_$@dpU zjAKLw_tD^wU65%agTTP3zyVAD$n(8POGJ;b z7PgMBx4{wX54jas4AFnCh-k#i==>S5o9%&QvN(76GPdZ>1e4v=Hp)iyzF$S(um#FP zu5x}C5JVm8SaAfZKyE0be|Q9Xo=BFYx)JRo$~l2z#trGk7LsUqNePf=v(xkFn2j74jFd~xNu03SY*v#mBl zjVo->KaPP`szH6A1oH?Eu=50mzuGYt=xG@sbvkb2vjaA5+c*nYquI�^(WSfWV!u z$4pOyq&s-9r4ZLrCocjMsvFodFf8sZb4%xyWl@1YAI_H(OB-eBI6e$I76Kb(Wtrd9 zs`ag5>|&}R53rY84s3-nv+Kc@`DSNPn;Zb{?Zm>aqq3y=_zXW z)RAyb(B}#)Pj>q~mD#|oj^>975Imh2532AQ0<^J8;;56Hlac0i>kzqqI7Kpi0*Y0P zmp`_Eb&cfCARQt0eKIqI=cWgOy=7i`@HvdK^g~SuUcM;sLmk|cL;rLfs)Uz_aj5WO zWyYUI%MLx3?&8CUh}<%v)t_~?CsB^-=%Cx!VUm|ou|Pz0n@|;L}pkgwpcxXly|v{W847ul8NPs8h@6n zKWxAsl$2F9Dr8CE)|{{=MsrYE#K;zNbKLY+o#q({UO;E8(9^HLH#>S08zHL&u@| zJ10N6+FvV|mM@m|_2trA)aq>c@$$&K-&9`yqJ=Vl{MOQa^gZQW@A)0nDS!4)y{J4m zd~Vt7uQ)%@JXjxg%9?`S3Kwh=jCcc6PkL1IM~Nq_6!6x9wUrV&dh$R=K4zv*B+7Fo z7f%VsDaR_N*HwVy<|2WLQaXqvcfRt02b-!Dd~&)zPJ+0<#SO}MfFlC%0A|j^)4{c_ zAOSzNFW_XXS{vaR`6$^9JQz-)2TxJ*W3dVVLV_(Gf-;G(5};H8Hc}cr*s@JN_!oE1 zG`s*WYVqMoO}BPC>Z4zIwB6hm5CxtBq!2P6f{yYi)`wB$$ft@At`2BZ+nKhWSQKD> zj_~8jS+-@Z7la@UMQnQ7szC(AfY7^E(#~ZB`Ea7%s+c)?fOO4^7Q2UjYL!N;NB2=_cgtg_zosru%8%8EWken7Iw=)@Z6%JNY<^UbE_cb-2ao z6=EUNDBi%N_Pe4R;)it*%P0$5#8)%KIN`V1s^o!0LJ7}stPJML3+~w{FM7^RWqGhr z2J)A8p6Hj~_`lv({@KsHt-SiRuPx6y^+Z|QSn#bLeAPhw*VK++hn?+jnd82?t;*nV z{nIZX4c%C(CUlI@4mj@7g##tft*@_XwN>A~x8p)4yh3NvrWdL} z7;>j!bdwXEEu9Fa{zey``c%1{RVBxe`E^pr=b;-`q`nA{er)BY-K-Znsq+q+(uXv* ziq%a7Pmcv-01pGa&?~HILingXcJuGx>E9Oz*xZW68JH88GK%RHRTc?PUur37o@{r~ zAFY;UW433}0lp@HlmQI%9% zW~_Phe&4Q9S#3_xmh@Sa;=b3JK=>2akAO5B9EjNGe=gSMfq_6fY zK(zX+ZNY)c;>83M#}HBiWe9A(y7N(jg+7sd_Cd!aj*}^zR}8UP$q{n(hvO!&9a~x~ ziwnofLa%F@P1;HEIGH*5;=3Kw8T)5wq-dP*qD3A?!Rt#74=l{fQ}H!mY-4s8IAIB9 z@Q%q8E6LctB>1iM`=Pg2k~m!Srqgla`b-QDRZ&cgk!CEwbSwZe`U9R03P*?Sa1Nfd z(iho$wG9EeyU63Q>c8rc>#Jq@j~!522%iXkI34vHnUbSgC+x_vyY&cr2L(DITjiX6 zk{S2Cqyv+(o`UdW{~D6ugN^A+j4flH*lY<49jxe=N-RfJY}F1l#$3#(kQ(vO*ef0L zLVt{*(u^}o6G)Ln0FQEa#C%m@K<7vZsc^rA^uv4u>;RRQcIvKpF*w+JW*Y1sQvnsvYNa-NC$duCz_4vXKyJM4P zMF?*uhVzyp4C|7HKXZ6Mqek|nAQ#@aoZ$d}Kf75aI#U+owA zMxXd0Y0rVo*FU%MU$n`;7zZ79Lue-*cdDCo+yyJ#(`>>uHPS*s+sk zFyAX1nzRFHxvCZ6ssd&odR??L9CL4Z%Ud?z@cP%4JMOsC$}nf?sCDxP7>*_a1PTQm zV5hAUlc2&1iWiPKL4398E5|zN-9VF>Iya<@1bi9n%o8laS#si45=!;qmZ67gIPzW| zfzl@ov(4h|gW%ss=(rr`(g;MoSO;2M9zpJg=Ve)z-zUG34;rSQ=piqD4c zOCpDMnjQ|+s&f!QEbVBjBZE#ri6|6ItV%cm&jjiz9|IRtjTU3CRg zch^%x`&RHQ7gF}sN4la;vQKB zN90K#&y6aJ${m2(kt7(xtY%42>3qwUlEGMbd*3!}4O*4QMJT-T9082j54sm;GE8x~k&oWRc$$qqVs-_D z3ejc+vnqBKkRo>zWql!I1n?mv?PGqbo`NjAQebfXp9<*+Z^`91h$kyPp0d2S-YMtT791!)`^e+vHGlVq%iRC=Ge5QY zhM)L{<))>Z6r{BLvqMrBnSA1ga0eoBV+)6SNDORO5tJ*kwUxCpSnq4q)+;AZo+!87 zc57MGN)9KU-|Ruq@pg&+%s(wAMjHyZgU!Ao_DWe>zg#Z&m%U=(=T?Tkn%BSDt69}U zT)dUSLoHgCs&f}FESKfWYo2X$n_a(f$O9sCbMb^DC-livC(D^Lr_0i@Me*P%O;&we z*($3mR`hkBb@X86`> zJZ6V7U{$GlczO$oy})&?HZQM~)zwuu<%-thM&QO$(t|#v^K&IS>d#kN92qCIMLw%B zzh=-l<8WkX<=|q+r7NA)wQ_lFO)Kt&a#A|-6zsY4=gZ|wm(4SSIlR%GHeF_wpy$5)ycni@1y*w`K>uxh*29TzG9O24JcvKQcm#8DmNiIg%A%L}4x6F;sruw&_ zelC{v!J2>N*n!9wVZp>lz-c7aGU*q9cIuldP%%nzBa$u|+;}%P{U1Mmyeus(l?&%D zlr@b}ZV8&{I8dzexMT_7Tph_p8*CRg^G{*vd}4aA>R3A7)w#eujlRZB=e_>e*5#F+ zeqUG6m-y->&Rv~D`okv3^hyhnx>}AC0C|$ZLp*Z>Wktv703CB$#G@{xZj{Z-u9_F> z@5PH3eUVJL$3lZZ8|Dvm_?b~Jw*vE!r};vuX;5_(Nuz-hw9R81$hPY^0vwzcBl|GQ zYN0QDmE;1UCtnD4zrP+AlOl~iWjn@(1D{SEELcZ65?R1S?V}Q$bDVqFJkALn<&XG+ zk7F9A1^J9s&CBqcSFZO+Hu7W(*~JfMse+ZSzpGO7XrZf%YE7mEO-#PCvd6sT2UX`4 z0AYd~&>uSX)qGv6xYfaYxish+SCoJF(Jz+2_x=B*%>Cv&{{7}-7e8OL=JWe#;aHhq z;>0B5#PGxoCyGNuOPn6Y^Am>(bX?^hKekj(pFZt@=IKa}BY{o{PTEi^_}jU`TYp*y zmNhw&wZW>78~mh=I;9mTDi~-2(t^zmCeFM98LPCFOL9VM>nay0qWe42 zCr-#|Nfu|ykbp%C@pJ%1tjY$`8HdJ+;(L5GaK$P`S@pv&pBvn}#vs@>u&phhfYj zrP|s*m3hT09&EX;YP>p~o^_npxLs86Uc0=iTFH=pND6k6jlQtJKH|Z+6Z9ciSm>3d zg(dMocZOQ?$9e_$-APq3Hx?Eab?jLOE~w1EcF76z54|;DwLdNna3$q96Kmu^$2a2u zVX>6mFs?wk=5J(N9h6u|DKa{-dfo~T>)CNBxv+@tJ;_P9-4dFvPua=G|XJ9z4EX>rNU|I+eu=_`Q8s!DBWIu6NF5UnXn{u~pdMm=(W95gfm z7Zy8ZVM%jaV}|2`12cr*1sf>Pt*ywm8s<39RHL~GyWpx%IT5)+=aI1~=Ytf@0#k4v zvO7D{DcS;1k>=ufLFdTj%ger4b9ZzudF3q7aC_d4I827<{Z0T6f@qG7c#A0)A9+j; z$QrNX2mx&~?GH}`mFnpED#T~-?l1N1ZuvO@wTXG9gnbSL9LVc<(15JntGAC*}Er9yCw3v)0^4A|3&`sqHzdF+xTR5@0K3nX0laHRFR gV#-~&d};ar0gJeJ8#~grnE(I)07*qoM6N<$f}FESfB*mh literal 0 HcmV?d00001 diff --git a/education/windows/images/it-get-app.PNG b/education/windows/images/it-get-app.PNG new file mode 100644 index 0000000000000000000000000000000000000000..9740081ef40209279d8f7c2a4c6551c2829146d5 GIT binary patch literal 110733 zcmV)8K*qm`P)Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!~g&e!~vBn4jTXf|D{PpK~#8N?EMLp zZrOF;hwU1^`o@~;&GUOb0_XHt#~N}_Gqq-cr+2@wQm0F9y1^W6RV%{5njbJbT>`Th2(YBa$n*#O0c z_#WiHV8$W{$D3u{bz5IQ;eP;}7fjR@3=j ztLJa?^}9=he_81L2g%3Y-d-#&F2>kD`6vJ6;75MsN1|S@AHI5LhY3$jO~v^5_~Dap zAAi_~G`Hg3?ZXCFX1mvpZxy{gr1$>*exC34F*!Mza{X@Cx%A%I*@@9;^sc6Dx|X+E zt^R@VY;$unz|$D}sh|3(gCF~`AB*|<`NLQ5>@XvhO689XsG8s3e!NYky(f|bAf2m5bB?{|JkWB(t0eGo?g zDPWcS6|(xrOqL_-`S9HT!v^)k^pCP(o@_+F){vGmn7gAqmtTipz2(`_@2@|6|4u;K z@(QXpWZw!<{evorg6iMA`Hkt*c$ca9$Ab)i zz3jXh=IgFUM~N=~y!o+zkHU;msHCI;_qZo><2*P}sC_>Eme@+byfshKL%#5|Jo}da zpnzJ^`7NJ%9OcFD_WeGemP4BC0mxSCxN#6@&nwTyC#N#3>^Lzt9^(_^#APN;Phc6u z?rur@h%bJ7?Eiv}QgqU%4vn7EGOMXp0GKiIW`6efM}=17d;k&T55td15Ljbh5>dXS zaI$aV4HGy_0>G+)7uBOGd)uRw{oA1WFFmM|%`~Adot%%eOEWP-&_<)(*roF133ET% z8|JgU5%1JY{D}XPw$^aZft5Ty@iifvfbn=Y$vgiQWrmm(Mt&c_WrE)Xv^nq_!kLG? zJphqsl?s(dco|1cWMZ;He1(BW2cyh`JT(ck^B;blB-V-8+ucop8*z>kU}A#jGI}0- z&)+@bF#QSAG=CN19v|CBNG38(;n6yqn3&4^nEt`oMABub@KB8L%4AF!-hA?Xz1|>? z+#^{N#y{AJ-GTX#Zhe5uasU=&VCwLG5_(M_oMTxA3sHE+GLKiFtNDdSJEJ{>l$S~^ z-&!AIx!$2;Pq<=V&K( z2IO@(%z83Qre{5xxpD5ruRi7K^?EVdEv7eA;QPI-7t56mPL^-7n8}oH5@D1HtV#-#{6{D=N4mcvO#`lV*dEqSX??5uRZs8jD~H#n~at9^;o~N8m;Mt*rm*4)%p1T zKlkV3%K2llPkmE6S!eRqA(iqljkg|$rGMMw=$%)OqkCx}9DAh-6aWMuI3O zArr&|2BX^@A(Y%3UO<4|5PrZcoB2aFM?eW3L&B=nOjQ8ZmB8_TXSQL33Qd zR|qMC-xp13oH7s}-;RTD6#!+X*@{|aJZgd@btUknhLJo={%lBiHsaa9hK2Mije69Z z070!9Qvg$AdOE682m|?_fCdNsLF{xofXxsg>c`IBE&xDz0p>cHHflk&0yvLP7Vu9# zQKh5oRSSjy+W_nUcv*U0OUa2zA;bp->~=|Sk9dvri06osc*kSJM|;HC0pz>=5n-Xl z7+Mx_v?#;E%xnVJ-tI7V`@QJ4w_>l~PjI#l#sFmNK;X=JB;HQ1AL|<%fWk28G)a6r zJMaZ`PyeR*B|jCut5pS{3P3-Z-|q4b{H0uDF(Q+*Cl_M+#OWALAX`&QapC^Q;@tW3 z@teQ!-^IabJ*t4w8#ivo)mL7Pg@u!`H#HXrjT7#%esX6v)@xBt$69RKJa{lB8woIcFK z?>xQ@s)r2zM*&m?x=+66Y<%#_sptZx!yN>WYieo0$T(%$+uw;Xf1{C%5q?ZfbOM0L z%2iL`FVFqL19;+3F@p{eA_YpB7OzI!2u^!|qjd6%Y{88OdKuR~ppsfHVRsaIz(WAn zWCTW%>GuG8T^0$zd}KaTw;<7j0{~g2;80WDPg9Yr0A!g+YZ7popP!8u*9z&XRcWG6 z07Qn{qio}3c%Q5J945dK79g$E(MDjhD!|&9ZYH=Y4Ew{K7@^4>pw&(R9BP{*w7`8c z!}k>d6bX|r)KJAn@5j+_6lJk%iZC8#HECv+4XYJE+0-;`pwhL#x6)QXR^wE7k-BU| z_Be@=hH^IsNVoMorglW22Kk?#n+4FvQ$sx%s)4p+M1!D~pA8%DtdDW)LfR2u5ACbn z?!-X!AX%GE>s-ocu^f=$NeVFqe^k+it27*$cW7&aY#v5r?0`nBuBN(hEC%BM$>c(u zzw-V#dFoU={>wiDkF^2gYTQ{~jhk;=i$-HMqB$26)2HL#_&5Jry#M_dp#e07FV*C2 zhHW$@m3etv(D7v+Hp#H#?SoB->00dl83iB%+uWfs&B@S!v77Ne{>FowfKc5#`dBL5U9ZwFr@MTg)9>c zaR9KP*Cgmn0al21Ov2bx6j!qrIpG|OI%Z#^HW@Pr?lc-v1Cz8y1JkTe#dN(+Yh0es z!f>-_d~?&SSU}rbn3;|x1buOKHs)uiV`ioq^E_LmK|40T5KBB?nxBgk^T*=Y+&pp2 z5O<3_S5w=YL?aqUi_o>uL+EWF1e6|Tco#FQ*N36eRQucyDG$ZLJljc=whx$SN)LAi z01%ovK&S?{kEScoA>{yKaXF}Esu_<14g$UKFRX|>L$p%UQ^&8=no&haCegUYC#KTe zN41fHG!hX50LXj{Xi$1s0)6t_CyyPp#WwlrdiDnSdkf8XeX|{F>zkbGvAVh$t1Ihq z>(&Yaek-nCyAf|(yB=@6aU)*meBk$WOIWB|fbROHyD^5cfWR+ZX^i>5Jw1 zwX=lt%=bJfE+)%!7>2kqp1dz{du9Ws9FW(2idm^OV(Hk~ID7t~SUP^5@RdR`iG)1# z2ivi>dOO_%s^-hLZbo~14FE<48cq0TDqTjF%lvAs&~8b9cYJ(3-uz*nN5{V?ATPDc zVT9kvDdTDmeXGv5BhK5Mg_UjDJ^fDM+XFm`mZ`dfF`7c8MyT*8O#5hpelBAuPsT;b z3kZ*6%BxSJ)f$K#@eNuEn(5B&P73S<{8t!TA`4i6vK;_C5VUFN0cg$g$!MVk&H%o% zEx;F(b#A5sICEA3UO;sQlWC^Wz_c!!W0k9BYiiC2;@%FqLHjoSk>;1$Ep;>jT8uEu z)yxNKm;g@^{t6lifDgdW&P_+FRgLD1rYxc+!tiaXZfbG>#u(xC3-9jlVIHH&aSlxz zO@5br^fA3R0mO~%ZfvY?$HvAsCiEuPt$e-?KyIv+-`m@pv7W%W9jjbd*EeD<-w_UQ zTw80$t>v{?SzSkqTZ?PgZv&>c0MVOq^TwTgwzjsF>8!7BMVoI1{edTD=mDRvmgaqfUM4n-;9{Ye;ItsQ)^1O1!!kydOg|pD-;?Xg&e27~bQ^ z_wFf|P>28{x|3g1Ei=rBVgGn+C? zN=f&xm(iosLtOb*oE~qNr*HK1$k^=NeY=EyuhU94k`&~3`TTl-{ryf`SWV~g1XhSA z5YfWwJC%W@h2d;X)xZwW(ozUzLct4E9Rm>aUX(N*Xdq(l^0DzNum=d1CaFTWr~i{{ z`Y&Z9p8>dbKBPdHC$9Q)HKmJ?lzhVBs!b?4{Dv1N`B@>JD(N?2@R>RqE&$vFjP}9lW+FlJg~ql+lrP1b_ymaTNFpvctFWZzGt|i5XY0XtX=3V*K^wDU58<{G zF12cbBfrfo@`t}>my7jcC!C<6&JFXLGVxmH2kCz=s}n z-opZ_RGYE5coGfvY}8vb(Wg;rG-uFEXEGgK6>8CNEpbku2ne#xY|yiDf=9nzKHqv; zR%!XII6dAjPv6KXCKf7k9JPku$m#J`lzz9)qvP$~z4c7?@LK*StMGt|hX9&&I`w#z z;}MgI5OBj%v9h8s^^w{7XEX_>K8MMTEu#Z01q+@C#P(G0VncfBTQwR#QBzJ~N?|MU z7!yCr`xIh>^P6~#HvyBYzxg1UbP8~(BD^)U#~K1W1}IOC@5S+@*|>cEbiDtOhvMTO z`CxqHLyyK|?|)BxfZrc{&d{MeXCCmSexyVA6l7BUz2x?O}YeW5lIpW=j zyjo9ovUsn*w!bq-*Tjy#cAlx-`c7&ry3Cup<(?tOTCMX@IFHa^v`_s6LvfLe>NB<1*^=El=bQGER zoyVJBn`Z?e`EEq{uxzl(yb7}RLFfvY0$3Yppmqvwb=p`xt!T|m^C|qVf1U5`D79|v zs2W3C*|!BgJdWh^?asF(zn?8B1hS=805~=E1w^&S0|alMQ;l~t+)dM4=lU)tkRu3^ zL5V(TOd9g3=_ep7FWd{3n%en@Q|%+Q13w|}zy>$|CM~|9+LK9*Glzuj4tX+)rKOp8 z&wC$;kACd2_z362@3}9|oj)EkGc~k_@u=4XAA9D9F=767TkHXpFn>>2zE?dpsHyv~xAnftoXbh{mqQmY_f(1v-7Hf&sFJ06HSU@^BB(I0R<` z4L(Oq@Rh>GWAbzm6@Ck*YUjE{)HiKN>{*w|EwyoZmqXY{XTr`=(ieQwhwBvrO54&n z5+`x_kx`hcenR2jjwJoN_U0SXA#}R{sGTDN=+Penu4vXfLo`4KTUbdY9ce5abT`G8JVD}QWc_R!1(6G}%8vi9;F)K4JwuxusIgeA{fN?I*xS(*22 zoZz#JSY9aL_uCJj96cq%Jiq=Z?~SL(1qYYpbN)#qS|CpIYF&=fN80YJQjRUk;m|7h zg)&c44jWj9N=eU7dpqpZokDwe)WC4JPh&BpT=Hm-Fm_;?u7xi7_BBbOw}Bx%8vqHu(J%yRX0GISI39WQeX+1O17nl(vE68QH#s+=-P?%nU>nfrQa-?{a)5>l z(4w8zYL)Cv(;wJEAeN?Q;>@vQao@SqacXfoPA|^J`yRL)?|^b8--k^&Q3M1WvEp7R`cJ6G-n9$jJG@)$J8GIq{RomBe0Rz z1YGJe8wyXpsaLDesfK1Y#XWh0e&d86qg>`=Qh&4HYMH4rJGN|CcZtV(mlz4C1aLg- zpjU?OnKwTWVAX05Gb9OHra^5|0$Uh2HGP13{ZazR(|DA2GE%i8(n~bMW zqFpI`e&twBFaX|A8!A55)cJ@<$k1Q62RIY}l}QOHC?_z>zyL;qHnGX;{^6TsYEHv~ zpD`(@ISkq-qY1lib-K<``BxOHQ6V7N?FcMU^}cdUn?IvUk6`-HuMD6T?9< zX9Wv;s9W_~%+_i#-vK8lNHcdG|$stN;##26dg~RVQN}S z1Xg=3ohQ`Iq0f|Ru?9&)A_`Q-#XAV>a{y$a`-b zIa~xSN;5qLfPebV?6pjv=pjQos9v+OGI2NtS8hOvQls@ma22XVN(Cbk6T#(@=Ahb( zapY?yseG4W!vE6oqUOPKg`6}^-)Dx?uO(P3GJ=2(etnc6LkdF;jmaMSTCI^~=>Ver zPB(^q%vQA^G+BlDsDnd|L=)D|mD*Gl5LV-IxDOfz`ON$sYTLV*Ze8LM7#a=@BYcg< z<@kIv9(@>%b$&Mby*A}2%}stvUKMb)NVOHqELdpXr?yDe4*(7xrSJ+`{?;W@NMlJe zSmH53xRx?|pZ?K9;Lz{vPva736WsVs=!~lz&o;~?fF+DpSt(g|ud@UytIIGT@6pZpT)7DqUi#AR?IbJz4!+W!18LeA?sl7@s zn8SC{N$s4V*-qp$ZseVEa3f>{LVz}))&-ZP&ydq; znsx?d#|iIbbj`hq3SlY}+1aAcEeC>+Px6fK2#bZC!cu_1-s&S^9EX7c=R=Lj;XBAZ zW+J9EvfzxSUCyDuJ^5m|=fLlTj1=H0Os&PGg_xe1Ar2=nlofrPay#4^CODgx0GFmD z_X3DuKVkj=QsdGmJHqUBnyG?jJOeb_k<(-N-S2gIHcXlU8EKxLII$Ryy!Qb>nY<2q z+4(e%W~FvAP6K3bye4ijD~oI&HB{y`ON&d;RNTNGvN3bOp z^RMr)i6$?dXE?3fVv>_L(;#2zp9er42fV{M8qz=uPK2@(G-uFdxe7gOWIPYxH#N?z zqr=Xv3F$}Oq`6Po9Y^T?6Hf{oIe$fnd4EZwaEVz zpOZHV*KPNsy|NMe(6~|6y`(#*2T!fW+Qu8Px%nEj(Jy;gk$3rV4}q#o1e3xDV-zah8v72Q+8_1-2FL3ntUOm^cQ{nPJ3#A2V+D`~-3}R{!NJ@g zprKwmb3DH5;~z^CbOZ?7lRr+G)Y5bSWKn3eY?R7SC(=`xEjF1F3vGD5+o7aR? z0(mu0f*(IhPrL;?JaP=Ju$J+m8CqVx5sR{H{PUR&#LDVgT+hh?%dxq&1-PQkLyNIW zH4W-XwDpO}It8ebZ_R(=r^Uf3|LD>X9wlA^JMWXW zB`Fy#-z5R_HVG`1D39NA81^uT9{ZH{`>zg>+JOUGlTHB0_=cS!>~svIBPLyNr~w^v?|PIsF!nYp|F zxHn1(&)9YjcAei2^Q$ESYI~gffT4mmK2=9)nF8|!RzX(=hOO276u_w(fHB1@!U7s< zJ7X}E-;AmG$m~jAa;<+fVHJF}Nd(aj5l)Ak?D2aSEzv1_0+M4t1-hKBYIvB^`*c+h zR{<+ETs0$vS-}Q423&LOpTe5j7VmhkVCNzu;E_{EoyYFfONR{^j}rhCFwsbDspepJ zwOTaQUcZN?+RrhkJHtVOMn**ZqhT-J^Wc?u?2-2Zrj(EL1R~uimd##kg;)W$#ceAVoS}x-=*xs=ykhE4?73d zNPSnpj4VLs1GGs;5eT*kx}@JnYt1zcj8MRWCax1PF$TRx1Ihw;k$1DNb~?yasdf|G z)V{T-N`VPrqmls$&sjRNJk?fdRQZ?I5dRWOC0CLb-X&bRIk+!<0EE%T=d_k2ZSo3v zPIrrWGP~qA7uZowsJGErjVf$JwLTY(Cg=1l`I(3=4Y20_nX?yTZebz1G}Jx#RtxQ5 ztWNl)n3+ElQ;h}0gLJdf?*2nQy}J*XM1gT8(CyW2&P@cYL(Az98bAb1Y`g0;O70Pc zHej;t)Jg8Uyz8QI?CjaOF&;aRYZvhtqA?8Mbv}t57iu0q0p2b4)-yCd(r0HY`2T>s)3{V@;U`;l7^zuXhyAG=JyNqg1bY+_Q{Wd5Ml23 z!ukI1edxiQg1a;50TRW9U>VdvRg9#!Kojf#1BAIsc^|1XdoArz7#w+=tG9 z;@)mQHT)a~CY>l_x)Er=98IEz>`4&HQyL6`HYrMUloY<8en*7ZOS|bXPh82nB(_1y z`jF4$N5bgY8NjeRJMhE+-hqK(F&g%_)>%n2>4`S&3*Apy3jMXbGj8id8q2HW@Mojh ziiuh^wz_Tj3_79dP64PVPCXRoE`2bLop>mwrl#}Td*L{$^}F^^9_7$>ryqBm+6bVo zZM9vLWAsTN+Vc$ZF40h$ZWs1=RR8Pp5O}*+mEXs72F1}0UyGtL8LIMF$1Pf z6IJ6G={rT3256$Y2!`5H4iDqpQB%U?6lgU``>6qw{*md=y$gjn)lmOpu7V|CK^#GO zKp3YVHm7HzUac362?5m-1|v|G5ZDxA(k1+Ep4Fc{k>Q9|9|JCSay;s__UK zd_sxRtkyIp|NIn_5=@i(D7zXMCCT4vN$J8c;Fw<<EfNDdkFJv=nj!@mg&y zH8bK=`^?^d!t0a7$VOwEEVLpo(xN}qdhmN14c#{tfmN-VnA8w?p82yr_^H-x8b>Y` zs<_m_A(-vhco6>hnbUFQ{)cj11OZBjG{0M08?m~2+iEQUW3+s)_UTWTb(Ci2MYuG8 zt|a-vw9La0-s-?-oi@rqdndNHC`ZqZIdjHW5;q$k>Eu|_@zl!uC=tE*B`!1y7e1DmI2aO|VK6#}@E?S*_Ml?UbVF%&q4@S{};hcuo2gKSi<#t=(MC-#0 z^xYP~yoGRXp)qcA?Qm^l5_JHuHd@?<<|T}~?Rd6@&-T zCJpN+0g!0aK-DgdQ(>nx*(mTTg)q}MIZi=|yTmi(Gy%+jD*H|q&6TzeK}gL}Yrsx8 zO<~m*VI{K{fFXpEZI*}##mWg`9r zRU;w}hh~lJc%%%DPtDtndwUfug#+ksAr4~7DYI(0+~-(b z8j_vAAV+Re`4$R~q>fuX|ey|!*sY>1%wP6lE?)e;WB&j6TL}~=Q-AtG=QaK*78q!Cv*ZBq{*G%B@mi^eqJ<4 z^X)rTy%PK-9=kAaj+Z4E{8W#Xm6iDFSD&Df>?f!g z8!_c#&NHn>#$hF8ClZHrb}FvZj}`1Yw^m|hxgA>@-5B)9k3Lh&N;-Q0;lV!XYdu(9 zQk^{R9crqM4A`~NZex{j4p0WPE_T&c;k5zJ`dhsiZgY0Ku}kA_*(`@>kR5d6S{J&Y zwxYYW8rz%8v4Mtt`_?t`cAc!lSDYK08-y89cJg99OCReIo=lg}o}(fF@Ev$0Iq}{& z?s`zQqOEXyqo-hSXLh(Ec?H3k0)X_RxvIH<(m6ONvZ!i2aAVj>G^jg$B!`A@hZ%Q=so?-O_sVrh}uA40f4+)qEA z0Bb9&izL@n9k0e%wa%$VT16Z%BkkoUevLk-=;|gobNU>S0=kKdmR-%5bfFO$&$RL% ziL0$5X&J5zEmITKg~7*s_a+TVN5J3*k9nT23s@T;5oCF+j{IeO+$A6qzy54Bqbin{ z>%cm}K{ijna~~@N%}!I*v8B1hBVg8W46kE%X;d9fm32s-%R)IcCNco=TK4iUqs+s` zOTR835ya`f;{aDDHUL&TfO2>kG^$P3axt6JXU|e@%1Q(_D3ZzsXPhv(oFAzSv4+$j zI~^<^&UE>ZUq?ew^gNOtgq5ZyKg60E3_VG|yC1y{Ac_W{TR>~9kNMullpplh0KF~1 zbOTy+c)v>qpxv0-s=gj*PJLG^u3oknjm8{wX(9&=%0Yu|V*p?hD}d=NJL&=%z^=+V zutO5*B8ONtlzjmI4FTw^UwQH#IPQ8-&4ap34GM--P}NH8xlN!ca$cSZCGF zQ%KMt`Ocv>0?H8}30h7M%mtwj{ZrYC&#?#d<_h&lm|Eb`q9tl~ntqzBYJ!AJ8jx6) z*P&Fqc8>9V8=&7(!{OP=rher0*hbrGWAbgbyRo*ljgX_=mv-Fgbuxd}eQs4_VJJn}+QuPhzN2wAJ}d;kwPVTk z92|1hs7^$y<|<_RAtz{HccR;IG=|e#NsDLJzx2%6Y{WMhjADCh2QwWF93UP6uwt$i zJsJ%F)*jb3r+M?fgZA17V95*7C9qmYRN=%}El!@i7?1dPh^#ki3F>Yw8^>dFL_e@DsyscoEQg9Ol6Rdcy zZ!R?*xf_OowYb2vK1c8!+N6}qG>FNYaVT$UG~OqW7#H8?&>|6BqS+>xrTmh|3F*d_xU;9+#({sP=c3q-IZYaoyVSBMQ#J~Q=bv@p zQi$$&uycUP%5Pyr9m?G1cuK;mS!-fiX2S|_yrz-RwK0MQ(B`l~n{oyIMg}e3t z`XqXz4an?I)Hf>+6OU5v9AABeM;9*&vWlZ1ng zbBl55@_kXCo{p`}ZPM6}`MG&mkjA;aN(0e`J_lF;l+k+9V!B6;dj?eD>jWKPsR+HN z!lH0`U#^D|?4A&t>@3a5;0MI<=NFHiy z#yj|1@Gz|3D8yC-7=t!rXHn63&9t+<670#h+KgIV4y;EgmDY@({N<6@!ao6xIPE}j z5Vqyi&uPb2nH_Yf0jhNoPQUCB&9U7_LtSsj+GaN?PCJqHw zX_e)otb`+0zRcFK9H^(IE(igEkF@^8M83*R56OmRzKh7zq%Fm^4&ziq$gM>pA34@+qTDiIc{CQ7VRy7jC^~jiOM9|gjqhp z*?ifWl7?}be>+iiH}@CxZ$U_o9Vx^64M)v?@;9&l*Z4xldZ(oFO1 z6k2&R8m*bs($}zPdYwVI>qW1#5jStV2u;>$AcDq=1_bk3W?3&&xN+~tQd3>OI| zibxI_k_iO?nOdQRaZ-2{m_sn|5TrZ`@D|O}C;6M3BSFdEyeYt-2`@+xo(S`OYQAa( zPG>CP6@mog6f7cBp7<@e3W91e@Nt4F`bB=D*z3C31Nc32ffF^i)ONTxz9Vo0032)T zHG91QyL5vnQN&|8&13p?0aeHDb`aWqG@wd?>WLiKec|GLc{VYlbxn+j&jnm=Tzfsb z+np596qqE{*T6BsGRrEU`bNPlW%uAU@!7#7y-Gviy$x3mPttrWF%rL#TY7*~?d*_F zW!k3o%3Fahfq}S9f&e+lUf=|@#4$)3&FT~yYBkMl*ET3CUHO5&YCk?K3WwKBDG z0(MpiCym;$*Nv@>H30QatlqvAeSpyTz{j*u{GOkb+q#!S-B_gIEV$we&tOo2c(bfo#H>TDpR7OmCtV(JvC z-*(Z8ZLFxhU1#s<<{+|r;7}ay`a?!Z%>u^IFDV1(39}@_DC97ORj%v`o5iFTfMA8g z)8BHM43sPT^UqcBeXgL$V`a*sJm>c%E_*~3LVp{NiI^Y5s9V{R3sxzpgb}3@h!Hl! z=M-4Z>ZHS(_>TO-*8IjaXJHJ$7$S%(!2GFy(C(OFSOTLYhxKk_5f2Ca65P1i^JfQTOG&jA} zTcsDDTA#UP_tbdIOgCb#iHX~2MicGIg=SL2Bb#I)kFNozpl6=QLnc?AmtkGpTZhE! zLNzVonsov2df6H~iAj*7Q!6Dc4}q1$5?l>MVWk;_;ulXao8{B#nPzHwJHvK%3Tax8 zkGtZNJD=L1b^-BKwB${!DopTPW^ah{iM0h!^j)p2*N0aCVJDHulW3t%Ev-z|bL5K+ zmR3`CfRZ1zSTX|XosiItwbfg3XXQ2;DB8E-sBaqrErlXh zzS{{`*CI~>eOAOhaNPBvDvM+xQ{Vx?6pjJ{X^3$xEwQaIt**mG1O$Y>d`1{=WHtqu5BVk! zdpji&0f>mRGbi`FLYT((hS6(p#`2xp(d}%fmegx+l}+6$5vNZrMH5i!@Oxpd8TVhg zfM6>yYPZB|IVf)-2lOQV#8Xmp+nF4Y&+o(!{$M#Lzzec!rB0Y|dZ)mfR2Su_J^hc_ zpruTfd`mCis@+<*2^fS)a8G(t-^8&aAd(kptyY_RP^EiiBBooIu+8eBre;#s0r3zn zHM6WUK!-DTQqA%lM4yJjF~xScNlVAF+Ck%NGu;es`d3FA&YS|IR%8M^_qlaWX)E}Y z98xU(^)^g4gaY%)6ALlZ0_fqzz1~&~+IOPA>3XKuVz+ZMcH6h2w{bl>oP*9Xacm`s zjR9u60AatsMVk6h?ND-o7ywn;BwwotNS~=ZZF=NKOGhC7+92=7IQi`NHsj@&o{pEF zekQ*NcnhZICm@_yzg9`I5rn^3oWqDp-H_sbNWQg z&CNs`jVS3#xok9~W4ZuHE8P%D7ikR*r5nT$gY%u>#e3Hm6@-1B<6L=mptjA&_OQEF zskBWEKZT$7{!1VyEhFKYYus`#2s*;R;YilI^wk>B%CHyR21X!Oi_6M3O-@Z)^JsmM zy{zN3D5xWUTSxjk+nZat3v7wGd~P&01WurE&095C^IJx$lDG7)k}g_ouB}RV>Ee-% zI&n**34xceQ#wCJ{TOw(VyC+n!|j{V-?&CYcQd-(J6H{yfN_^F-53o3-`*M)#tL9Z z*kOt!oh(f5&+nJbIGX^K;hHx?x*G%9w&1&x{f2Jfwwnb zddk-{c+y6XK)1IYTWHNR57DJDzH{T%xcb_2(cQjHx`#4y4;*(rsCpFUEm}tk3xbuu z6+VR!W>L@;(*#nEFX;#{{WjS)!z$2#7-98i+VhzLW2Ag2 zn55s(=Uh{RwfmykID?axdzn+~V7tWna zfOO?4we4Ka%_OO2g+GV3aF{oHp&c`89x9b;9ABD``|dj%S1z9=p5rk$TLZ|ufa^>G z>e50pW@Z{O3xKy;wOC(U&Cagx`Ofc5P|v$KM`-ykKj6 z`CiTSNP871jMv6ckS0r{Wg7hEKIhbvzicSUv(tJ#`|c_`9A)+2EWJz~?yp}1;9|bh|*5Z?2 zS6*|fgZ^RhI2Rr#oYn(Xlsrn&(g$mU=CHG}FO{GB($zAk%M4ZO?QTEr2~f=gX2{MS zg@$5}sNXbCdAeUgD}<-ys{?0~*kcZp=n8->U>-qeC;dm+sY1i;H3bzxD;gQ`0)+5t zn&|s`b{OnrT>4$@h}jWf(VlYl4!?8j4H(hsjS42*%1M;;B)*YwK4x-a* z!$(4)K6!CY3u8^#{mx|*(aRT{eesJYfbqY*CP zEv^}VF1<%Qn(1DxlA}!^)Bj20Bn!Z}c5E$IJ==Cp{jhY@kOFb-q3`YGR9Cm*@yL8p zW=(&=N}Sa-q!p8s2eMG4M;bPO{K<}|O&YGw#wtLT%k_{Mh(*wJHwbX#G5yW(Y*N7C zV4Ri78Yg9&s-ravXU?v}av{##+suwT0o2Bqh%!IYU=04`EV~xy{;)#Ka~XSTou`|K zGaHDc8I8fgBxQr=n#bb!@dsmi@p80|U5^(3J?p%ISteS`3b&+$Bf%2UQO4+moTUd z$@{8lId&(TcjGp^0;Z%2+~q`OVN}xPRCAg%FrR3`JHu*6Z4#k%kiI}az#Oara&C`Y zo0^I%SMH0`r_aXn>RK$Xtf0{jvz%&_6TElp=#TYgwp}?&ZJ4@>4M8P`S|u`aCB1!V1sK?X?G1FF*vJX0qz`iIzjR8dgYor)51>(>hGkC; zmN*2bv={_R^PATahjo*kUgXQ6MlSOwFrv66uT<;uxBU17t@A9C96TH1g4&+@&mDms_Cc>M}SVNsPvnfByQpyLQ zTCFX`{IM&suymzdk6(^cXCH`W^Cb1`_xHvDb?%KrN4-7et^c(DmeI`!DbdvSc}dI{nY-;&G@NJd-W4fMx^dZ)v1CT+U+p zmxen>kC=k_NdPicYg~}kyyjj&;>bqTmfb6l?C^4Ahw)`DiKF=Zi^gjnj0&>wNts%0 z$B{fU<;H|L3BwM`G7M`-L$zlQywfNsZ|09Q1op!=KeHznT0--fPk3*++}Kax*X=Tf zMWaSxM_z&{7pR-ziQzSl6F~$=S^3~U4BTeOlsqcu7xaxo@pQXm@ zEE{{4bIc*B3y2C@SwRSbbIld|5B+Tdj%KI#GTl*r)iPvg!B{|dc+H%kil8_se0I7O z)6GWuR_*bhN1I&5T-*f|k71&>TJEg`xa)&O2zot$6H|D7s|^SPhyaEQ!nmSV`Uugu z)CBu|HRNG*dJ3bUq@YMiMQ$RTKfk)N8SSke8P&Ho5$l-QD=X`9>C%-rf9WzHg~>>R zLSfNzoCA)wiO`qj;mS!6z)shSWhQP5p0p~odDCwykZ|>P&cRoMa>Xn_OP^%=QOTqD zBp~I2AcxQV&|KSyr4Q98^8^4m{q4{x)AtaXvl$~ZYP4krl#5D7PH%O49imBKQsXm$ zT$qRYF`jf0m?(8A*k)LP+*qw=-*WY^yh5g#$a3U8Y1{D7NN!QDoz2bs-gPMQJ6hcw zzih-~0O^=hL~Z=_iJAv}z=E%hfO*vQL}LM{>Q_~3)e;!P#7}F-20?tzypT8Zn*5kK z(cytj27sp3@blVJh$ETZiUWs}b{#GlWrQ0nu5&a=tzlbNrsGS7V{+Zlser zrE!+uGYHtUaSC{7pe+QW0ER$$zbViHm~Pu!vjk86>~f#N z40o$3=_kZULvwOKbp@@nnWmk>PN>-0+=yP+J(#x8hR5T=nNv9vr@y@&qn;}d?6u+%-jWyeRjs+@z-I_AAaP8(^9rjcwflEPQ|M`mMON zydHg?-CSOaC!T&Go_OZ@T>QB;JsTs^D$6Qj&LgCG1uSwuE&x^SSZ&ie@M^QtK$5&E za@-sVx#p!k=xXy6k$0)`q+pk+sA&G&3rcpJWd~7$sDag}jLw*kVizd*FD_AMX<_7f z2L1rOsBm;@y?_SNN;*rsmn6tfetxIl`}xoC+~a7UGF)#2+Fyf#e(-%Q}L%+f1; z+xqNtR{>5m@dVqEYY23+ah8_Z07<>%6KU?X&{oY~Yr>gUy27OTNYIyO;Nwco#!Xta z(-&KZHuXj$X=&qFr6D@d@~hQ(-aL%^?mzxOp!!FJNaj*uSegMm1y%rZZW<7sKD+{| z^Nm_8G$vzlx)R4`YjJFb@D1)~rs7zWE8u&4rV+={5Eo&b#d~vklzZ0)tdm|j1dhx=U_~85A8{hrMzJm(gMax;qH1sVh{yFHqQbRDN$c!B`b_Su9 zY2MlihNkN3RPKb}IJqR#d9ycq=**4Cf*#Et8bLF1m-g8qI4MMHXoGTLGcQ?0&957>be2ECGTpO z=ARbA13}MG87z;?8KIqx}jsTLZl6WVs0dyRFIbXf%!iTCJF>0%mHi zlx24hF0f;Dx1SxJdurQ`6D5BAzwND!*xp#pMpNydEb$#plX*6q*&xt1kEj9Y=IT_^ zN16(@g7m;i1(03;bhq6m{{7tPH`jG_adA%FVHA|c%X}SH&OLBQ!#pI|H*y|*b98;T z&ZG2>uD{nw2m|>){X$ci{wRJ4awwTGNo!s~pdBuvkl49Y$Fy&vp|$|uR+DQ3Ap%@$ zHJ$^y_N>pKu2RcF)a8ffZX;7peT@6=)&o|s29G#gzDnqX5r zvxinqNaj}CQY$r&N@HppfURJY9b3F}{JtGc;{fH2n>XVc;HsbO-1)Qd(GPztW@qQo zD0=`E0W}>FY%NB8y84Rs5kr;a@f>%FxvzVm4+taU*#V=rHuOwQcE2p)#(UQXy>QXa zh!Yv_nG5IQ%EJ!=xb670&woBPHn&VD-5Sz8hpUlJg6L7b(4bfrO?x|!yf50S&&-u! zOZBBMmN*0|wMeoQ2jpL4I^&~Y0+qmPc;mP8C8xdWIylUSFSEq_*B#)!ojtj*3<1=f zT@~Mj#$6jXCmg6DqFLu~I6oz>0+nB`2{B#hsaJfm5vNgtI7$l;sP zKo}xNn(!^zNSA}|p61MKOu|G z^^%9&@60uLy|<%DYefY*d+lw&d0$2(l(JJ$a^m4%^UNL3C^oMuhY@}wr-v={x8giX|LgPg z^`{Jy_gPFBfeP1+K8~q^?w8t7E~AH*G{Lj%HA?P-1rR*01R0 z4}rLVmF7!1a(*`)-s4SOc?1(X zsK(G(OQ$0xO+XglAu?eOoe?=i#8Y}$rUF*UUi{0&xXn8SNNdGB0jf1Do=UY&{-8hQ zkI80CxvuH#alrNjV0t{Njm4O#HdD)VHL9Iak4A4B%b-miwt43EIHlqAJ(tXrZV1J~ z=UG4SgPNwK@fojyWv)E4p{irSojP+Nj-NQk{S1*%hFs~2clu;0gX3CT4c_ff#t<56 zMOdf(UWbO-8CTRnYPmM967a>wGB!WUObNM^{b}*?=4@p~ugzp@d2orsGR$i%=H?gU{`((}3zr_G5uG>NM7Rs+1EkGbDi!WnP@_@b+o7SOZq!^I z-@3K63BY%AjJ2SepAxV6DK4Pjd8XC!HqZaC&%!ghr_kcz`)~Gi(HrBE?n%IJ^z;y@ zz7^+D`d^=?w>#zF1i-xG?;+Emqrk*)l&C>~gxC}ugD7|~R)$ar?DOQBp;Al%3(Y;X zJ?{x867kGMtWB?s?IT5gn?&XSpb)tAujT^I@*4Tk_m-LjXD-R-9Zc?M16T4_o3`AE z?J%)ggr@%l=jLWRUV8m{yu$g~b*`MxzxE1RoIAt{JgyLA@_aAI@NEhZ@i@*lk(GQ_ z0Ct6Lx9gT0&J+SH$oVe$RU_K!^y2FE+wt1fv5SPxLjZc2!lkq3N^Sk2M z(y8co>3R-LvjYh(B2Ma-bCQa42%avQoN;7X0M;D;3D8m6{O4?@tkXUIl8$3r zt$QjV>(INLp+qR}9Ur}~>x4#fq(2hy8i8DWnwJ4U)hB*CvgF5!3i&)iKQZcYkKi930<18b$@>Chyb{q!a0m{oox8-+91q_+TG8X`-kFt`nTX~t8UcrPFP&hxFu+r9t8I*)+$ z51Q`L0Xe?;!_0guj<*)z_dTdrt5>Z+kmbTXL@?`Ayu+K+8Wmu}sIkgbnTEe%15G5K zB@6LKs68^D{pYj1L%1cVf^@`GrjvIBI`S!I?lVf>C`ddLq>I)}SV0eMMXjL=Fb;On zMhKtU4eXf>3!FSwK}%@15)l1<4bAn%mtT$!K;zJsV*ZxS38y5ciHv{?VroJTcgjf( zfb$d>PQpKI74kDi@d^YaGI47pu14e?W)!0%~qS(nq{Il|NF#aL4 z6b&@riY%R;y`}I|N1$wv)$UO%9#vJDkbixo;8q zOF*iSp2Lakc&TD$B9zc#h{l)0o=l&7xC+0c5`Y!LOk!$|;wxW$CLaIdSK_%BUW_-; zkSC@pF)$o)+u5Zkt0N}3a<4Wju;wBvf}6s|y?NBVAV_PAT31J7B(rxPO(|#iaO9p_ zgf9&%^=89h_^emK8~P?_qwN}Qmvr_BzfP>}LD zT3KqfYAVE$ojRQPoc9W(=ItJu8OWA?tTOl!r%d_}kpehkLRSEBx-nsnH$~HRE8>%9j>ppCeENG^r1PDa z{eR|r{xqifZan|uD|{>Q1P!j7k|A4g%gPhWA)w{DqWS~T2%Sx(8JaW5D3^XI!-0fk zg_F8*46a(0f@)`@W~MEq;80vO+><~;6>((T>1!RLK)GDqE`XQHAKxSR;s~cb)dDL; zj|O06$7D(b^_1o_>A5~A#LqnCYWji>d9sd5r==SQI$DG9lrv|@*&t;3;SoWeJi0^e z6b+U}ka{uV25K{9;X;=adQRL*X;- z(*GbA-2F%H`~NdP^E252^o<@0jJ@&i_Hop*r@;O`he6d8Pc63M)WS3Zr>0@PF-w$p z!sL3B)V#7xqzSOT%h3i1fzSL6i=;WBt1!8G zR2~^8&k0Bg|?$z#PJ*FEeM;@V&#&%EHWo(@t!!uSX9p=-AS19A8?>aikme z^rH=5yzf%1qN#l4$*%$$2tH=0PKxw363T&6q&nq> zcSW;tOsH#}&NS=MYN5IDJV#KV!Ob`kW4aNGvoo={I2(&|(;3e9HNfA|6KZtMpFg#< z5NA#=#fg*iaqQT9oH}(p&Ye9SCr=!Y*6eipAM3!vu@4W8qrHwO>=@dob>f!j(lFz*#NC}O|`pu?qgZLvq@*^?!(?9*w2mkuN{;%h1N8iYCl(+)^ZXfm%zSF`( zr__!<_R#5g^x`qJ09QvB;)>=YcnK_OibFd#xFRcD;X^>m@t?&!6?BSbnM1LViX0vU zNXqoaXr*Y*J55stG@th5YE7!0rg;eB7+O+G@>4Yi5yhIcteDNF?1UE+#{szNREVC+O**|JAiMo>ijNSb&EnNUs`m^G)7u z#nVrHA$A5^r4ghatmpAbEuh)Bc<~_`hgRIWbDKu5k;_4@udSr=Fw>f&(VNaSC7cpl z=uCr!RrBNj#ovto{vZ4o(VU)Nn--n@oRWVzp+8CX)mo@E8rcyv+dJ1xVkFeABlG=QB7`Y6>N%%>w2{B8;` z)1{GX9Uyc`G{8uZ*xK3%r(y~;i;L6oz6TzRxyE#~H{0oJy|u9w&%FFvOrfFZPH{Gk z+Gqk6WwT>Odgme{RriVNy8&Qti^i-&!%>Mb=(Go*j1iv}0|}X>T#8W_jg96rPdr6~ z;O?c1&}AaN`_KG9e9!m&V7}9&SM9Asd$((mXKmzj!EyKtoP}1DeF6){SxY>SR_4`g zo1`Vqi3$A6I8m!~EyZ*<;gj z0;Wmk<~v0rRSnrEwU}f9o+a<6z~u--r3|KBsI_xt&fo-v8($@o)Xx|3+LuOPyJ8@O2=tJp{^CpbC)a zha9u#mCRTZ0;O7?z+rE)+Lz#NvF$m}auP;OJ3E5_VOPj^)hBh{oNeWh9x}UOX9NvI zqd5bAG-Dr{xN21kli7LQb)aoT7O+)qDVHTK4*h|{GMofTA#vRtu^ zFge}Rf9;STyG9(TFh*Kss%#&dwok*Azx$&ciO?JF(^y5mbD@|1U=J<4>;T*DjAFaH z8ynlh*k})9yEo!~2h(*Jo9%uqZ}eh)a}Zmd0pFleQXx*u9YAZBZPZk^ozzWJ!7Q#f z=g5B}w)zokz47QBOc8z}b|}+6?+=_hI@Lf+q>)1to8-O%ea7tQ1FXmNXHS;$I*DQ2 z@>~D1$|3J5H%{!hb@O%%0rLrHS3w5f^WG1}mHR%xmuTVjnV6eC2FT9$Rf`_~(cP8#1&^Edm!v z(L8U>v|?fDc+4*zkLKJ0V0$d;({oX)w^AN#v{N>SORlv8Re-nC&|zFTJvYlKe*yf^ z+&k?~ z1~82w#L{$6`~>jItRKxx-2h&NBU(D*RI7D!H`nsCBS>M*QvfV%mibqh)hxx`V*cB@ zWA^X3ph*uv>BqnJmwz<={11FD+Ts?1k0=75E6dCA`b)3G%FX3m&va^HgobHcYJz|& z0^%YT2Y{-ba%%wI>ShPfaw;ZywUY;JCADz?wJHds6$&h_hUG*ASGH1XU)@|ylXZS> z7Sj$h8;xbI)kITuVHyOC@N3)M_^l^ih>l2wiKwPxMl@3`PY$FfZVwx@1Ip^82we+G zoDGSeNLw{V8KLSkBp|eG!rN0 zHE*bVDqj8*5VP~hfc%zG6zrT`Ws4~~@VyL^{!YRRGC2j2w+?cb(Q?cqVKn7E>=?>b z{<$7$#z%)OyQ2wwQifa^Crs%ze><;#0E4&U&;9xDi&+3|tEf$iFT}|cr)dNi z5_~khoa=4Ru_mivnM1EQo$Zo~e(+4tF@DRNLzZ|Z!`pc!sA@Xqu(K3mHN&0gcAa(z z7?Zy~AZyQWmVs{}P->=Qwdr{BxvO#Y<|f+ZBzaY{+(&~%+wShgcE`n7&>FdR&?wve z12jOM^$fE|BUi2&p8GBu=wLX8M(Mqpxl8aJkRQ+e!>cPJsmbd87>j|LD_L``0@}>z z(V+RvVPpdUpaQpQcnv$@T=wL`)wh}B zkZEnV0pF?gJKAYfk27bk#L3ea$B{t3_=P;nO=`i}(9rOD zpe7_QSyvNipmiF<$+|P~`qA%psM|gOsYdMrEr5JwGNx#B#%U;YPZ_HXWR4#uulWd} z5zmhnyw1JPhQru_=)=B?tWf4ImQ=47J5EvU4RbMUt*9ry{44R&OHZI>-~F2EyN`(P z_Hjrb!C~JPR-Yrk)h_KoD!L=BKHO=$@4EyWKax%TPKM3z1y=z{;sdT|Ix_N}+K1or z+&ckMw}1d{^tuvqx}srChv%l6GpUZwObty0;8NqgeDQLeJ9`eT)nPRXjcJwDpOApK zaQRAn{1bmH9)0X1F@NGzn%Z`X96`7PJs zsgmKT$v6Z&Eb9n!+j;TrPCuu8KmOv7^ki(X|2WDb8wabjM?}KN+1}${?uDE=Fs9F)Gbk?CG!77tBBTL>{v} zQj0GQw}7jcoDgWT&1#)GgD&=-(^wwRFk49uzE|&e6os8oxduh%R9|tzCv~niPn`N# z3l1jV2~rj6JqO{#r#m|X8oO=y$__Z0j`C&Q1Kh-$RsbxP9jI!{gWVWl5e?f|Pg~vS zI+JaEJKF2*=wSu5Ikz@8V|!yOm!5Pj*j?ftd6L#X3Ic?dC6mMNh2!oARSp{-#{{~- zL(i5JvrrStmdV2wU657d%+@&>K*8iZ1T&v&#vdRkdvJ&Y?`1;G@@!o-!R?_*hSsm? zFq~>k0&)Ur0v$}QX;yl*%kLaogr+z#HICWsSW|=o;kkJ6e463yc8B~ak^&8X(J1zb z+ij9ZfW^7{9*mFu@jn@leCWebpP54gL_5&epeCfO0RmMup{ZIlHSf9BCaUS5a}T3h zrGW&YJt&3J0l*|jsa;j7RkWNcf;JXAfKY!24U%&MjkD9U*Bn6E?4dR8kXOMDT2a;` z4P3fI3d%@)0LW1TQrs=P^uM(B%y z2fM2P#9Fu+VvfkrXH7$f`p4O#E~a9_;aHn{%F#?{khx6#q<-swddJ7gPXaahgO61vVZrj;v~(45C3W~UqUta;6@Wd5 zWw}o5Hkz{=2NEagB!?plYL!E@&ORElV_mnQkpSvwgAU-?;VdxwC(LqF2d1=83url+c*~|K4yzczQG`U z%%UD9mjkJtSKcMO^XDCgVuz1=67?{3`uuja{5Ka`MtGfE0F1!+u5JZzVO~1Z$zejd zR9wZGF;mfK)VL>Hn%(-G01o8X6|ByjIT82WcPTF4cOe^s!l;J>#{niyTnBCMAW8b{ z*2wdIr5TqWel$M$J%2jh`@s*#^wJ5y-m!_!`z~WC8-VF-YbF+2(=iM9F3v5+@r4ty zxNs6pb^)-RA!`POPI-(HKAwe?tE+s^&3sIWwVgZ&}c zwiUCDow#y(G9JBuCf@hpd@M}^yL+A38?*sw=gvDyqJZZ_UAnp8iCR2>nYmH>Gyg}z zM#=n5G4xZ)gXT@J-EOY~ce2cn>*Y{W(M7=rYU2JpqQKpL-2J7rGGS#irZp41{6Ir1;!2!2l6{$-ofu_+M!L{cmI|6;A8KP>6vLlj>R;9R&@#_W_!KC zGnm%FDt0Ak_U?^UV-x0owU?>z)KpS}4mgIY1AdaNAlp-5kO;_;@i`X~jHo7CK_LCIUB z*w4}>a~OBVz(aSmJpepJ1i{+uq^veSVwkX>bn<) zk9y~&m%aIoh7$lB-e(8x-kUzoDh<8kmCaAmm%KP5%-=Ns@F#z>9EPDR^4lTZa!BAI z-Lu({;Djl=xyt{goEh)o??mH!6QqXm;S0T##3e z)b%iD(OhTej>XK}62jVu-e50B4Qy=n^6a|JbLcOfj4s-_Lzp%@G&K5V$26C@B6Jer zO&5Ry$0JFZa>q^S1l$Nb*;u7Y zRq`b;6g;37p;=Bnrhao$2Itr=n&|i_>XW0Gu28W%n`m&?qrLum^tZ1?ePSDcZN#7a z!~^mEhfks?t^-2b(IBj|$kN9^I)bxsq%vs_{y2OhZ96)cD5a?%e9Ss;+EQQ&Z--0B!HRLUQ)P zxwv%sO4OQ-Si$`I%9BsU6Hh!D&ph*dJo)r9@%(cy#TUQw)wp^6W*j?pI!>H8l`~cZ zGkwH4>j#ZM_eK}(THKghSd8<4wC;$lb~|aIiSGdSV&=Ojw&OCVW3thVxy2Ufv5hluTCq$oeX3wwyc?eJ`G$dj=M|GsH^J}2URUqK5^jw=u zo)K3Ho#75u(luLN}ZQ5<$Cn29ObtBHVZkjA>~|uxp@;9s0->QhrofGgT6zZ zpx5kdoIiIej?YiW_U39_yZTCWG0EMIL~}bZnJc0sjjLODpF4em25~3n%C{O5aq`$) zEH2Jr*>q!dr67cY`$K$u5% zZdq3O#g3;eH8gZGgQHN~nO5I!4!&2jOrWKF6?hn4a#YB!v%q$XyK6Y?r*GcL0uz&N z#%JD2oYEc&CB01c@E3XZN2w1REYt9}oo0fpnHod;9w%I`XtnRGL5F%_Q_(;wv02T7wxK z2kN`*wBem|(C>fn{y28*7=YG@+iM%~Q$O?1;^o(_<}jO9YYwI?+D5P4iD#aDAs&DH z^SM~GTUH-mJeEED4&ol6iCA72ws2!V{lCrW*|>m^o&OZ2RIw`7FSLCW_C!m zW@Z6^srb#$Jsz*!xSrarfRGYKegy?}Pw)Uu#ST19$WJMt5r3s&Y9&P|-g*jT`JrV_ z3G~Cmx--hWw@wM4Rm(RSH-Gq@jLw5xh~&+~xV`WPurzMNcw6{F04@0j1`?#x=Stq4 z5$Dh`{o$@irGMNlL0l`~B4AmsPsHmlzZBQ5y~evimX~%boPO-+jMs zokjDfZg+S4IpfXs2nK_GtgNoY03dd#(l~W)2b$xWCvq=zp3w;HknZxG75LGia8Adq z#KlYZW2peDNo}-jfXnh&F3UmS1XR&km-{Z|&}CEhfpX}RL*N{fiv@;7mb=)JPOcr0 zE&%%h&?Eu%scM}Vov=Z@9Foz)dbGhKHLD)F>aybAmw=}lsi><6sgduiNu!PKVR7y5 zy34LZ@!W858|@fv8(@9%$uGn!uf2p!p<@3Y$K3#`NvFI0kVMic_kps+hfI;Cp{$xh zt6Xx=GkaO}t>(OG-U+7Qa0!nYrjvgh#u?W<+qa{^Rghet5@5EqhRt*hc&)-D72-gz zNORD1b3cDT^7P4L@!*5^#p1$z`a9*|*RH-1>zMIJYn85VZlreHz(k*0Sc)@ePm{(( z{MxVnO8of$=f8}9N`ttzvJ%ZkD^8-px*n%1RcQ)tb=z_6=B>DX>rPBHTk)Zfd^8?> z=)KWwwQ^*EV>Uf&F8o1yPdxQ>y!6Uz*-51c*%*n3d-}@An+&h+A_?t`Qlr-|O{hFw zaQRR!-*U*L3W_ubCb*PWQZr_e}Z}8@J-R{3p6ndf#u&dr~QnYl&4-8vSCtyle} zCdU8Fg7hq=z7eNcFW|tlIZc;_WgmbRF!u!NogR&o!?d<&w6{4sG1!rZdA`?;o&7F( zFBsSybnFIOkx z6nKkN7i~xemEjc}SKC+c9h)lC9}w3NAg)bU;`rIc^o>o{(PYthZea?(@y1OwrX_&( zM6Ncpvbq-6Z{E(q|E`qer~=K@`PsSXZ@1$Y|JkSF@BRONA|C(3mk_2}oIZUvYG|TW zG)?y>+Sp!;TdSC|x0hpweBJ->Lvi1G9*!DX*+|nE4cGNRUwq}|_|jLtoC_oifH`YT z0Xh^Y+lgF%)p4noRUxxnmWkh%UfRCh@uueJH_$7E*3)=+ml|Z!%Q!qq^N^ND4~^d= zzwyi;)Q|CSYcS(7E&ur>HRnTc@*7QPUnR&>H@U#|;WwJAF1GAdH^H{U@A_q7Y?s#S zwEM9Qpt_fRw>^rdo_sE6w{5N8iGFWA9=vicjx8<5u-_vNeTX!!0I4f}h3m1xKMrqF zL(W-FnI{@zG}jzbC*DG1-9>_zt^s#iOC(ok;*Duh0(@0;o>q+R8*%9DkNSq^h z;2>J=YMMi+4*LP*Lx<5-r(=40F{WEfSW!**SdG`RLl5FtgHHY>9|A-2Hwwglu3)wU zi1x^%Ypo9Az_nHZ(w*TZ=SB=&Z*{L7BLH+1{n(q>jlBwGuS5R^+O_7}J#ySLpqg@) z>?MQmAS3m|)i5z*Zc82F77EJ|RIylOsb zX0R?{$1u$YQE%1b0z&9w#7-b^&iIS3ydIB#<*O-ljan^x=Z`HNLjY!?-RZ_PO!6** z?iR`BNz-n2ZVmxz#H%mA7XRQM{Db(1|L7m4zw7jwGtroFANYC>9n;6Uvc3s8-^g77 zj-Ngqk3RNToIZOFb9NL9fWi68=ZW_qdhQy4V5in@<0B0yuG2lGLouVJB_!ac0IIZ8 zqdFw>TMmMAln)Acc`r@;mOJ9K9`dQb^D3P)O7bC#N<9TU;UWK)09*u0?>&v*JN}ep z1ZU5~Z;7y+1-#6xX=NGnEa7M7=A$(`uk8VFRl*r&oo*+bQ?IH0?DH?iYp=hN`!H>8 zu2UCNF;64a+1^5%-Jom$kieQ*^AEAAs2w)2CC#E)T7Ef7fY*F?j=!_sc6I?wCrS*< z6`Um+zzJ~7wFHcoGPwL+YuatIs{kf^GgHeBDo~K`tTR5Nz;*`dnaEXN1 zw%&z79Teqv9E8ixgM1G78V&z+8)RVPRG?8o9Ed&K6Hps*<$){FL^BnDEA{Dk%`v~xcq&R8=nT z3hNe=ID46LkRiXNj;mFt)B;Y8nP@iV6F_HX8UVQ+ zWAoWL)`BlwtHO?0+jITD4n%O)nCl2gFW01X+-R@6MVX-61m&jz7*m^d1v5SvLtEe5 z?PD3aerhjG_W^)9*o7bUlVWAa@-BrfpZJG+PwxScBBoX>x+vgT z1i1jH0$RkHQ-LNZN@_Bz;F9C~_)c}zae!(^39iB^3_IK##`MBWTzc>lrhh$lK`Iy8 zpb3v_fNH0=i)r6LgCHRR4Q5n}abkjr*(qi8SFc`+)y>UJ*9ApfLeL&={d}iRo=h|T zKl{)A^LXyL=MlE!IRtBFej!~O6*MZ>Bv@Wqi{;hzxU;$ui^onRSibV|3jpy_{H?$B z@5U!T@gX!TcNQ%J(Pgr1cL1WKm4}imQQpFY{(SRz>-`~J-+B~lpa@X8W-;?j`o8s> zH@UP#Ds_FU3*l>>SL98gGy*x2Njj_T6Jt~I+D3&$^l zezQEE1{h|klV)sh4*Mk2%-uPJe?MM+;kl?H1b_A4`ZwZV{gEGvX*7?W z9T(nEBxrodM*%HQFQm^=fXe%#DHapgGatRfqr{u>A4M;?axYkB`iJk!GpJ;K44kid zKz_bc0_B|zp}$E-tjoo)0mbRrrKmNR&;Vxvys2DD(De>n z-=N!98+Jm*e0=6JzZt*y3%?pKzj&QSZ#mZ1x@op=Y_y}(?a^2|6c5_NQw}{M0#=-$CC|-`twQ?) z8iifK`v6V3ECHBn<-$+;b)BL*8mD0xcZ_il;B>K`?KJQ0Y#M0Nqn(adpjDN8Ru16P zO4LyVssMUTP@io9qWq>Iccn5npp*x5@pD1+kmlA!swzoaOL%V_P~aXovXs;?j3y6T z$9c%v);w25B>iBTXST3#Liu+HzsV>DFM^Rht!RB-oxkn5I|S(XZJ2$+yY=x78tTc@ zXX5^c9?oG(Zn`&BZNZ53c(*Swu>O4>FgJunIPgg(z)3=w56^1yZ`myMaZw`a4Lt`=u>M>&r!YxrK%(F z`_Uil=Rokexp{!R5^ucxa%?Q$jvxGi?~fn;p&yI^X}JP@0;QBl;!(Ia|CYl}5j%L2 zE~rRqfX=+hj;Zp|H*_T3{XP@nPs(KGAnyynbICy3SgW*B22FKV;ir;eR@5paty z)8A@v*?3Z?W$8x47#(JJy_F*_=Fs?EQ#K}`;iL;RPoRyp;=+adqP^XZuRQTAwA_uA zJDvFAly>o|dtKnLgTcm>qzL z>7Rg#);b*ZY2^C=EoMLF{MZ!W->gKnH3e|$4{b%=#=QlQ(!fu^M+fjAs%RX*Yg$XW zZ<|E(l-|~x!?w70Snq^mX-h@k6UV*bQ>9|hE;ZxC91M{&fB?~y9KPqGLqAvZw>*H8 z!%`eHt%j7dQ9ww2X)blF_+GBAqn#`ITV=b0SqcwZ76H3_ztX)$cfyPY>frN)u`I-?HP69X_?Wxfx%5>Zznvv)RhdpY2XB zZrr%ZyDb{4sknXXb}TH+rvKA=lOB#sbzHGLwX(KWeAfqRdDXab>He6VIT71@?+Q@e zZGE%doG$I)eS5q#?OhkbSyJY{;TpHZ@7fE-nUA4`Lj&dYM$;|G$78dz0+4oSET-UJ z*9REFzm%Qwxkf-`x&Y~9y;{~W06@oSXx%EsQ6jpU%9i2)N7jjVC?VWtH6J#r)`yg~ z%`>p8r9JtjFUO0|J@;*&>RokE!SaCh>>uctJ+k`JWX{|_N^q1RffpIc9$8nJ@3_zk z=AJ9jJAl3i01pv@-2<1db47TxDnC|m+y335Y)%x5cXaf_=_kO3gh=CL%{Z?>Q zyElwG8xDF#JE~L@uw)=RgHD_|6ZXQxPI2wla=h^3tMS6~uP0DH`u-2a_kI5l#Gm=z z?~gzJo!=QB|MZt6 zBT*jt;4oeP8rBP8GFD$4hBjZRIVDIck&Ektu*2>|I*7g$TTciNkf-~gf9)5c^kotuAz{Y9EyQ7P?lV{`^hJsh!>xE z=AO_1$v`&0RPO;$#pI>p&!SzNnsJVG8TusC3P_r4$ppmdGiT5!9NWE4+*(cLp z@u>XIlz5nl6w*8 z%22CvmFnf(C;tkjzDu77V&&b}sxDzMO-G*{X|rlY8JB)Y!yA%vDel=A8kN=r&r|4+ ze99T8pgD-Woi_RF0xW_fKvvs}R%0AM+mBXrJeFo1mNXS}Gn09Ld}%(;o;e*&H2U07 zk3?J>;+W?9d=s#nj~N=a0ld-P-ZV!sKhuhf=T66?4?P_3efWWR>gg}X^Dn*_b7+9N zZQME4J;kP{Td}k>N7@z2QU%L(=j=qMy+Pig4173QX<+`p4-4ZY{N-ZhaxVFR|0b)o z+)<#`nvObgO;69n^xSm%JTo1_+n7rM_Yo^Tc6g-%-_j6l_BS9sybP$?v7~liI`ZH! z2%q%kcT!NY1KxQ<5FnjzOD!lr#pHtrd{4b8KVFMGm5nq_UpI{4uP^qiU;N@d1FC^YN)) z_=UK$b{l3?6LoluV-CsZaD?VDLb$ils5>cCuA8~AxR48Ul+G9_Fi!kqydOmet^0@m z;$MmX#sBiJqe;{N*>;SLINF5ou=(6z` z;W&V*X+9EEiJ1Sn__O0Ga|Nf#vH%X?RGk`+GiR6L^vMMptwzjFPm{NjTmRUpKtFOg>`M3X0ynOX~_LjStPQTNoPO5R{)UkNzJy+m~2jb?9+mOR;vA1JwV>Pzh z`!PFvCjR{Q|D|~7p$|c40db1FU;$D0)_*QlDPUy}yS_|m<{AbrdNa(1$)Q{mF5HVNjn(QL&(`0@WLe)hlp$-MvFj<;e;;jee+I7)9sgCMVdvxgSp zA83!Nql|p3&UbnkQf4`hrg3bx89l(KHX7pn$nWk@Syx><`q@yYLqt8ZM5o42mT_kQo6i68sR|7x5+cRoSS zEiB54Qnc#)-W>qsXa_EKVGpkUHX_O%Upt}R|L6zf^8J_N<(FSV)4W3+p^3t@npQdQ zUMv6%G|LGNxOM@FdbH4H1nAThU~q@oObOfw&&}(%;=cPIh%1+`@D0L)8Cx0GmCz;+ z{S*r0b`gwqkX9HtNAK;P*ox0>a^R;hLq-6j{CHJvW^M>8ea1|I|upi zTC(On-}wxB9BDlnZ^mQ1hrb0pZ@G7`CO4X!H1pFkU3iW5sG zbNcW6{9Mjxo1LAB8F*#}OQGQ!2~%zbUFOx#&gnm$k9pqJp;rZZ*)Tl(@Wb)QqgW}J z{wvF?X#cy#)CZxL??B77H9&fndYVQHu0(4ZD`cV?n_IoyyZ>V!|C4dy;sd!_nVp2r zNHV>tnhUO!`W&Oaa>})&f;KK7Ef)A*3&PPUsaI0p*3ahl7JRdtt^ga5Q~+ccXlgxq zFX`RM!a9}SMZWW{gvq+$m524kV}Uefk+3-t#jrH^rt32@!v#L7SL4aYzZ5S%_4GT| zRNu|>=s3caw+r)5PBqmZ{m~!&=0VjAi0qm$3c2_1#wi$?wuSKe`<*#<4~_5y=KpkK zA~wwG8vPx2u^9$fwpJe~!h{ z;u6}@SUmaUlNm>qdP?7#ybNcT4jD%(7>{OV0fQW5j-;vGdUzMabji z1o!&sFlU{iJ{SWJHu6xL3f1pY+`N;nBxGD78$Cdtb95Q8caz+D< zz5z%~K`%#6=q{*Hpy`=b4nq^H+`oT)V;g=|!^Fba9p)@5SEp)syQDn{n9haUV!NL0 z$3OPR<2b?S0jk*qxsAcc&4zQ@! zxp!NYsc_;JF~~g0zX_E2k+&tz@|yR=k-sw>=@;0{PcoK7b-&`d3FQ0yn9q!dd-CLZ z5>Gvj`Tz9q4yww6->9j6D}dEB&4b6=y?-aC^7+F*{KJ1RpQ>Q0;2r_kyKx>J6928g z-|jeK0M7+yfK2Wtp!!=)Xcr;rV&-oi&f(r_Z$_unhDnD2+%Q*Q&t6sp$rai?bLl`& zm|RoJ0r}2mI&tE75h@t@Pk#3wj|U&PFExiY@i}F&3y^8@_xt_awne&m>Z20SZPC>b zWoA!zLiK7H&z(OXbz1wcKJzpHI2O5@JI`~M0iFo-4htKg`C5+-@3E4TJ{Gp9;in*RN8>gSZHw zo;rC9kZS-an$Pg}xFa7X08rN%MQalXpu5AFq@}dVAwwb*G;j{T=B*mM4UxWPJD+G` z`OKkF2%{#p+H-2qBdmsr=nlK_(n~J_VwE^~>TJ49wl~^osaPd8tQElg(&fu&arJoP z+6{PU79Khir%s=XQ)kX3Pzjx-E{Zi!eAC4ocVwU-r~jWSOTN%#&uwMo3O)p)V%tsr zc4;hg3aJ{TZ^?w1niwh|AX{8%cQc(bg*V|b591~TcRW=^r4Yr+FqgjZTizM1491b; znt5PHtJ7zn6jYxCR1ar?z1?A61h;RMwt9qRZ}_`^CqydL>p zey@{1$qHI77f;N_XF^W1C$0dB<7+zi)d-nS6yCO|Ta zt?7E1b7&$9v(qt$3AhB9o;qb-cq;2* zYjX>;v!8y#ri0Zva#=WpEwvawpdoZX`13D37nd%aiwEz&63e%5p8CN|{EgEk<&K_&Ur8Bc}oaZxW z(*536Y^<-u0ML8+r5EBie&yEznL!+1L~EUHq3!7!!Qy}pYIIZsWyIpa>QS@UMME#9 zEqsjD?G#UY(RX%w)ZIp`t=x*0m7B4-u^ijm>*)jS_cn9X#O_WfCJ0{zo%Fdjv4k2l z61z0UufFjL7RzSLk&i3)Jq);>$>B`86K>zRnTxTwe(NJxHxmH<)6YCZ{Fv#~&+Ob% z96z=|{c2w8=QDq3{CuC_CTsIgKppKAAh7c?0aphV<yWfK2t)TkN9RET<)l3|L>brTEo}l_p4(nN_xqS9`Jaow|pLcU$wwvD_KXxK! z=VxPaaglQ&jvbeo7vmTvxBjxF`T1DjD)T#K)N!8<;`ZKi8jY~gXvOvGcT!M)_=kTG zZFK|)Vm1Qan;RSHymyfl{kAPk&MBvh!pMT9=AFZATm@bba|qRucIt{qJ7__cRS{70 zc=+M>#4rEyug0}&*D&$tDVPih5CRY~qj7B^n40+BJH@p^UaXzeDi9K+vW4_#ab;CA|SG*6WzC z4Nk8<(?w82EAm<=eHZVxQF2I5kb=`9`{5V0wG*`&bY5 z-n***u(urtfN<<#t~=a{dk5Qhw>Dz+_Kmo4?e*ANyB*ywRtzB9+g#)KN^A?{?d{m# z8K6i4s-!hl9Rs|kqK!uT8rDFE{EbN6^&L*0IUg461iQTw~LX|28(e@!ZR=#V7yRcf_SjXL;5^ zz{Zi$(jzPL=^p6ut-Gr>(Vo;=kp#1rTBPNX*_?tZOFHlWtr~#OT|{~g4b=$>zwv9o z1t>YKwRBL);v;}Hw{0PfwY9aZV24Zz{@JksquY1uLeff>%zJzJcFdBWhaPwc4QWVx zn8XN$?g>pcJ2qCAug9&cFCe`A^z{n%#x0=rxw;{ur)IG$Yq`vznzp8{;T^XqVEbD? za*4y;Z1r9D0R}fwgzh}cI5?fqFc_3sT{}6|5^&;lKly&Ulka=&KJ~M~xBSkqLjV|U z`1r8|?(u!nHa)`j(f-?lAwakd0B@|`jFnqgWA)A(u}1ki0Gul~wYS$|duuH=SC`|? z&8uMOB&>kXc-V?k_0XMK%xCALvCxk!JF&n)RuZ3-Q21_vK8juRievytSLN*Nz=ujMrXyIX?7($Kw7gmkx)=l^Iyp z9ry{$s69@k1>)d(b<;6GtALsR^qp686w79NGj|`THudMiC-8v`Qvg$`@RWb#v%Jki z5J#|ylZRS539JU;H_wE4!PQ`bs#)?d4;jQ^3wynp#$`&Wr~FZOo3Q9+wfu`rJ#1fx=Gph0fO(y`;QxO4&m z9;7xXY$^bg`ur-+E5~$1z?=n>;4|9EG+p+s-e|_+@#C?!u@(Q`-}v|Am6u;Zqh2I_ zVj<6J!o6-U!El?jmhaq2FusUzPS4b`hxlOVA{%xBA&O|!?ao$qg#Fe3^}kJnaDns@ zRs_}Un;q-enyJUH|Ju*RFa6wq8#9>sHbglai^fP%bR#+8I{kOq2yjI^v4f-t7Id}~ z&40=s`7Bdid6)SXDx|)#l)9Dn`_MXf@|3O6u6!?e7{7XFZaw0cmE8mjXT#|qbvTi< zbX=%AsM_x8Pjwpbq&`(pz+p<7#XU4sCk9yW&Y5>_t{jg{82MVDcDk+^+qY5Tx!Umr z*1`VB9Z)fXNi&z*1JoQDP(iEK`e@rIk4URF9eZOl6lOkV=1wHd*Oy--&ts{vZf|bJ zr?EWVxOyWl-+y0x=XZT)OpQ-v$LM1p{&>9qgCB{;^db$C!@!#29Q7kLiyvNBjh$8# zG$PVEP4{#IRH8d<$F0@d&~i6g^EL7XzY$hG)@7WHD>TgCJjf9MNn_|rIodbJ;|S0GAWGr}mgztGNB`&^&{Sapsw>S$&C&c0LAT-sJXcRoC%s~e;2iMIMIv%g zAHd@L@4db80Bc|ZgohGOqlfKR$z77>Hy8rg{uXq`RN(b*p0`(^u^dE*ExiS@b)YV z)Pk!(*=jX%D9!4fT8 z)i1?MPd|aCPlG}k1X2YqhwUIoITjMZQ>cmtB*CH2t}k8K1Hy4{Prd?|r_|HmMmUAj zaOsER>bHh*yAHSQ$lYuyuVyF|O;FzB_t8{O!KEZg96T2woCzgg8uw1mz4Fn5shdH2 zD~4#TJv7T5G-?-%8G%^)gJHhgTw9Iq#yXlSrafWy&^*Qf;C(88&pnb#e?N@5eR!ml>;Uz4Py7!LHgdU^LVMk{b)4vzp&307lwYYlq zYTUSfC(fNY6V2K<8tmio#v89umfiTLKmAYBrE~w~2cd(bL&(no`4NaJli}QY$M9;< zI|Wzp-0Ezi{cn-B9aQo>REJOA?2uB;ls~O2F^q>cjyd_ls}ezd+T7XjP+_T1q&6zT z5>C3ipfxX&k5d^@o)i*-cvx?`!k+vhn(FVfo~nHOZS!A7=6tt_kRbAo&3{?>AbYHr z(7a?2=d|1TG}~%n{yGM+9!&tIUPC*B!5x#BC)$mh>ecII|8xh8*I`n}4Z2aD8^$?# z;E(-@@4(D%rJquUN-bKx<4k^pA?;95gP5vT(k);ofDEK7K&?;|J(|U0r&9XK4#A?2 zK#_4kZ4cnH6Kpb`e)hSzvvLQM-)V@3FFvxPajdR-Wrvkos|#HF-ZHo#h~S$UL}*NB z3qVmzyK?bzg6R$#kQ%2QBUfL0A@=%hwBlK4)l9#z9d)y49MfnZg@&z|<~jo{a~p7I z=I^dd6j@vhH#n1li&&K0lcpQPsQ^fQ?qYFmcGiXP93$$CI%UAKfTdxR0|4g&B3w8GL~eMI27+=e5Bdjw zFpL(OI&D6ak8A`pjsnsNz@Be8?D%~0i(mORsJ@fqj{>L)Y%|I8Hs9-x<7G~Xv zbUqg5T4;aGm_xHu@aGkJ1Z|dc2Em=>bWZq83t>ixowd{i6zp(XU0;g_?!P}C{lNRt zv_|Palm!(+8*9020yEa$Tc|{ZmGP{(cnexiYL{quKFiJsm{Ce5pdq}L)3{tA-U{oZ zQB4Ep?tpsp=Iwa##h0>2Ss*oR4#(nZ+zzj@qiP1t)?r-h>l+ddaGHg7eq(-z`Mtu@ zM!?UaC7nEZB7L9=jYE@eTzw^aTPrawfI&Aqo4g7tj+)T)&8@z<7vSuK5ukkU^W2G+ zXKvdq0N9~p`ZheeUmS7Z#)_7+ibhkGIGi9X&q&K1Yo(Ku57f$eO&BZ=-7?6r@%b*d z3MZVSILu>-TVtZc?;L&?9mz=(nV$E>H33;tm~BL)f2KntB#?Y9EYCO%Yg{&p=Fvtf z^Go;&TIoc!9vj`=`08`7$4hT4$Ia!fxOICoQ2yik_3QEK%P+<)>h8|%J6ICy)CuVm zN4?=Ff%g($HNO1iFHvu^apA%R!rqEkUVJ4xSFhc;5i|2kaqirCvCN!jL+n5EMaDDF z?LjxTJ6om06x!2r!hifTEh<~c6C6!D#g{ za}$8f>5?L&%mddr=z9-SO!G_d>S6Y614JMD_(xNFDCX;KGN=Q+O;{~dEmh!DP@Su9 zFTdYwLb~v9n!y0CmFZE;`N&yPZhbKU_}D2SpzZ*!?v~mFD7}B?ndegbDfJ+u>kiOe zu}2vP={uZtnl0L8x7&#ov?4*&$pI3@j=KB?P_X08I39ZN0YIdZ0!h~5g=fDS%eSxP zAb-nL%wOn1+zvl-u6Mcv6eHsD%sK1Ct+rFvoOO(E@xR;Q=RzU+4Fz>w4K^CSvoWw? z(!F6%{SM%s%O6@V#-I5;^xs)G@*dB!(Ng%czML*u>Qr~di25|V@2!tqHjnhQ0E};h z#^;ibrfr$_M~B)zR)MSN>*^6eyjq6xPL~AV5U;=Y32T~37wYs5X8m)oU61wlPPF^Z ziI13`p35Cr-+1k6StE6Gjd({fO{4B&JOi}a54`^q@z?$j|4t5f`{iH$l{kIkM11li z9~CF#$tRzRXP~Rn9aUe7 z7qPCs4XVG-@kaqvi?E}i0jOB+2oFXPLS#>T0-gH|A!I`YIhl-8O){sEA}B7L;`Gt7 z=es~8;m2ZSZ5^6b;}hTU9l27F^WhV4hIXFlPjx`PK0XD01jFg;lEK`wNS;#|CC9&k_hu(0O~i4FHXziJ7^0>{xvDsVC#c%^QTBBwu#AsLA<_ZcYGz zurjIUr9RUG%5HdRx3I9FG#%0rQJ`#BufB#h-i!wxdMLFvY4Pj7{@GZ*a~<#*WJA&? zPFJ&cA(vj?p8K7$s0(1JuXq5R`Z+>?=h=I|8y()uaL!88WzyjrM-dF6v*C?Huyr&+ zkN3S!KS5Xj@Q`=8_zm|0u3IjT1WoHvkj5-_QDy;CF!$bGahIOUdc@SuMVkfBp|j2i z?`eJZ0a32*ALY`7yF1oBVF~9LP-nOqPE0R@>^bED>S9FvUgaehgofM+R(sHMWxE^K zR@P%Q?rbgHM~zsVpQT)#SX;ZD(52??qALqa3-Cl8+Kh95K7QaY{LkWhzyJH=`qdlp z3qSXBH2xFu$xnPd-t*q~QRhqXg)e_4p7_cW@u81?I2Ycro|VA_KH}U#Ik>a25)-xY zsKM|K#rkDAum0YsM6-UI-db#`th!>p{WX1(bi(7YvK@-&_xr5oV<#q;TA*xcTX-}sGR zjh%j*xTJ+brq2%Wp(uM<1_3<#qO#F&7*Vb|FSr4IZmlig8Qyig?f8R)e500UqlTvE z^TP&9fzJsGMoaajJ@UQqTzKpd2i22(8wG-pzAs@iVyq)H)h~TH zUi!AC`uiV$6hO7)jK6MVhY7r~>H4Q=o(eoBb=zg!y4`4_MQo#iZJ{M~dT3$*XKGG_ zRa13M0LK#!(4d^kx^(%i*Cs#i4d!h3Vr%Lk1Xlm8Mmi z`Fu-(C|61VOju?}x!hZ77j|$>I##vxcH2>5Z@xoTKKJ?GA|BPGl12it_9BUCg7^Dn zT>+m}VQ3dyvD|lV-%2gW4y`h^@E|)});HDw$i2A#!H09}j?ezmr?XQp_iZPesg)cG zqksb*<@c$T05CFTYV%}40n|KB`jbD)@08HI<+{6r_wVV@0#k_23gVc74*saR>~> zRZ`+g{NpCmHg03_1#xEF965R;`P8^cOF#x3GAZIIyj!l0#>hr2)6U2b^TzLdWVmuI zzzy%G1!CwTknRRiYqjF^x$|-Q?AbVV>SUb6j905%T$}+g8#$i&+}TrnLxT-(jZfCG z0`}tM$#e11kA0HJDlt3LijREk;R`%}dMP*qdCM?h6cxF-%p!`#7Wz8%H9FGZ zzAKkf`!xNd@qL=fYN=`mx;S(vr2kWG5fxE(IdS}W&J4SA=T5AxtR#3OI93plsY*Qe z!b`ESy^X+4#QJudEZECk%g(6W0@>`7f9Jj{PYP@?FBK@Y90f!mkMv!GizN-UL``?> z>GWHxE|S-AzXxCp24qrR;u3qMU+6kXSp}@sx;6KSLjeG69d4!j#$iOJD=4}Htm>nU zN{-F+pPCi_{6$uh_U6^+jxWxkL6iY%L9?Qr<*>1=N9!0f+k4X_jQ7f3?p(?&8dl)YfMHH8s#E0SQCxfR4gqu06|AL&?u7LE{(SNBsaFJ31UP~BfcBcvkUR> z{`>#u_@N*DvG~$gpNY?W=Ckonf9ijTm!5wn{ zG29_ICP>07Z-&1I4yk$%90=+p+7?_ZIJ#<)dpijdww#mIsWMCk@SNfl#B71p?qp6| z+A4sm`(BW6is*67x*Y`?txTXZ4K>*#Gh7YfNaN8&OeRZ!v-4?+CuI{qP0*uiPbZl{5r!^ahnm$}KXP!ImRbbU$ zdKOK}4FYf6x*0d`+)S`D4jUVnKKv4zh5Kfy)w_P|IGVC1cCIE5N_whM3L@^=RL0x_ zPJ*f$oIuHM$2AIm0+i2baa3Wn?0x!l!nJ>{xP!)I!DD#agWD$?c3p!xl@TKFD zdjXW^fd=U41NXFdM1d0l?C^2XY`3n4bBLSo`OX!$EX$so?Dc7=0O(v>V9?E_9|a+2 zjalCnc+??n0^rWxcx-G8Y3v*ExBjF5d;Imk{x{EyOC0Gg!A4p4HHdMf{IsH9%`^R*-28!&(5 zFXE(pl2dw9*M&n>Mu>y}mce(n2iB2Vu8rGK93{b{NbmmRu;h39;eO|WL!XKVboLy? ztwyI%sWBGQd8C#%bXyfWG6cxI7@`HJ*7rEw<44WZF_bei)5%D=VDVM3Ua2MjEta<$d{Uj8fUNHiLLF;?8$X3s#>#tP+8h( zqP=c6?z`{41WV_(+aqmyj)Qff5CL4Fx5w8N=yiEmCfE2>a*rQ7MFU~4^h&I+ZIWAu z2{}%)5?}h#m*Oj5egff}LbwG3hZapGSSElG_ZSVrSo$q#g!C^GXErGO)67<=s{qB+ z1R5MdW<#a0m+_u7WW=ZIz+q>TV=k<0r=7!^2uoZ^Q@=A_-3F2f=sY^I5hB0(o26a) zLj_2P@Ayl9TMyZzzpMY2*CX-^U>P*s7UVZKgCu_Au>;8=S}sfICqa`dmcTe4 zI*#_@rAyhMU3uXCc<%?^ALlP$jM>Hcm|t3?!Pa*@8E%$HZfL0O{dYJS4FbyZ}u5Y#-$zZcV`(h>kuJO0{h(l&oILx564z{;0=LmQsYHOsRDiQjfm zsWEEG!j1WTn(=mG5tBYeOpHs!tw-Ngz0rsUCppUAe+ zJ??gDsU0V1CD^OADG*si!WmaRPMX?NtmP>G$b9;6AWZ37ov8ikK;$n!1`LQJ?iTG4xo3-FXuF9G869kj((1r>TRB7tY1yi!Reh!$(qf=#_PO$%8Hr z8a6#1=Ebyuq0}U8bZu~^oLR@SVnX}h`$_5+2&B>Z(I5S>_;>%k{~$ItJMo*p`J3_c z|LkYusi&TZKl{CZDxQAgi}B>8+$-!J0$vJqenI*? zR+!b8bpt3&lW0Y{8m3Th1S#J;tjNVi1Zj8dbQ-EtR@b+-Vrl7kyzjm5iEg?85CGD3 z2v=&_fb4`W4nR%tDMP!6lX5st)*(v*^!c+FFf%9OjT_gqBhQRkPRFmdrf1O5cVc6! zO=hPse>G3ZIJC?$w!|mkSSG1tlOQMws#Vg=i2%e?qY-gnz61O{T#FmmuEpywzZ_rr!sp|uC%zJ|zxHZef8$y< zg2h)$amdR$jn$VQ|7xtPtfnS<#B=()rAOiv{3vK!G`X;7ilvd3FC2kJn!0$(g&kKih5;hx%41Dh#^5R{8SnUd= zntOjZR1Dq2?nr`&fJq`LxGG-pmFQ(9pfOJDKY4zH{S(lCJ|jZ%|7tqsA4uOw+1*#H2V2m&m~r!^oL zn6@=xyn?pr(U^?${z%&uK+}HbpR+28uXk$-K zphFRN*8s@!%WNij2!^_(G93BVB~}i35n2;KEj4FdL309RSeqXIrx(aWT2YRiAW$lk zheV#|y>T3o;;ugw3_D>Q!lb!ZN?t(EsgXH#GW}_S>SVqaEY&9b?I|dz!3kQ|u3t-# zGp=MA{;2K9#A=?l*8VlDe%I7~GfCg8p{a$bHI`oc6kOs@9`}~C?PN+91mXNfZFR5% z*a27$sdDk^ZnqcbFJ8=%2x?FYtU%-8H>Jm4Gq#wxcD&eWr9jxw_+9{3BenBQKjiH@ zw{kd@pzKbruCCP|j^gI>YE)b(1Wnp+vu9cGKszo{X}Vki#j$J;G=DW+i|b*;eVV$K zQE>#AEO$Oh6;17?XrM_1&djGkYP@eA-t)}300hftaAP&B69dxZG#;K65H}`(lZtf- zJXs)3dmkKrYo07Z$szZK&0E6pfjnY<%LI+$@2zTCsD;BF90X?}A8hhbAyc&1^A6ZI&ecg0;BYzRB5JL z#C&6655rJ|!|*=hpCAlzl8+C+_dCmY6wr71AuqF5_{Ox8#&4!__aBz_o;U=$T}PP~k6pRdhmDZ-{OXOA<0V_Y($ zT8RuNzu7CVcBm_Tz7W{xpd&l>Pix1 zVd+=`_??yY=%B5-0+TwaGnTS^n#Tflx)%^YPEtuNbaYV4s&6sZ8?ZMWwZ@%G6I8wO zI|t#XGRgM>0P#8u%vowVG)k~ZDw|%Rr*-5kB0J);Fr0#)TC|$2Af&mi#ymNNsa@A! z3;=SvUz4sNtpQh!N`MuB@>{JD0Mzf()l)`MRBJB!%{S1tSTv=FUDt~4m;^?yg4Ge$ zWH!gF-zM>C>O(UgI$O)B#5<0xpssUjuxTeK9r7OE`dc0qq~$Nmv`f9Vw|CTiB7e*M>f6Hu?lh{o`<|NNiF-k_iRdrg)oiN`u8KGILkGwE6KSPnC6 zxN>{=C*KRchj^cV@>*^)fHm&bZ!^B5036=lGeE;}Pn1I#J zDU)fxBm?ut_o+E%xbnRkqi@yT?7{X`uU$Haick_hwGdCW0)>HF8I$+rD1zZPX`%`~ z2#*4qfXeqrCb=UH{L~IJ$JOQvOvnr<26A}9bN-xdpoTuDGq z8@uf2BhF$`kUr_9`AoPhfzRX(zopJS%G6`&EFIj|#7*H2VyNGoZ){kzjOBk8weSHp zJG41)q=M_F5{c!_br>pG8R^( z`_(7o^%q}=_1m|i!FTRVkU%P>(bCPPIY|?p4A_7t=X2#rmf@|3@5Fj?owA@6RSq() z_OA>{2l8t5WxY~973|_RAlUDW_O3mSsB_mJYC-+(uz-+EEfWcRfML-tU?_QnL*__d zn*w!s3XTb`yz^8u+gx9d?p7yFTLIPQ{2*R9i1P?M9c_?6uFM$(t<868CUzDHMo0co z0aM_1E8~^bJsetl!~selGjRZ#T`W@hq>Lj*M_5gIc`z)kZ7dH>P>UcQw*# zkhaVJ8OAvDkvoI!fI80MSpp>YW88y|;kGwp@CPsR%+U|NmuCno6`h(21#O?Q9%N*z+Y;d@{;~csBfLq;JItTE_JATO1yH`oa@%6)t`Kdrmj^$iWv%mrO*9F+YyHz0x0Q{bMju| z(T@#lQZD|Gt~{Cms|CR`lh00FG9pl>1!dVOuiyDwc2@%i_EUq;!2kfh%0r$!%Q#Kv z9yuW8y>Q47V`;{fo_0G;EINz>GwZ*~4g?vAdxhfYs@a*n_JF3}x_XjZIV+5PghBJ$ zSuAQ0F4`eT31Z5EtH29*GG~G+l9V%DU_2KW5nLT_3bymUfPHF9gq5YYx7vW~YTUkc zE0%BGiCbL#&atfKTVQi&mYrtqRe$Q#sr0J~kZCTHryR5{xFV=(j@c+6P^PEpU(D@8 zZIy6pX==r8!=lOTLe8%vm}>Z^&z>h&6S1u3hotkpD??E0n!28UBQw91)TYSH?$r!>=R05-y_%S8ds77?N;m(EOb(ne0) zAP(b6O%81{w{+&YlPg>{P{4ORQP)q+(F`P>Q(y&B(oxgZKb=+x<<6R-4ulZNr+?W6 zb+Tci?#g-w&<&c}DcRlObo{c5#|(zi?Uk)~oZhVKBV7^1>lohRClJH0t8W(?T z7@XXZ(|-NZ)}};xPaKx{u0O=HDni#nQ*k)XU{@wBjI7WiI%pGz<}eH`=;h#Zdn#md z%(erxLr<4|bE^#`KK22F9)jhPZ#ggDf%^cHbLYi^?EQtYeD4NyGMs)l1>AT9S+!I% zA{c0{&Z42Yh_gGdx=($bXKE>Sify17Z*OfPylA5UcXe_qwL+INw6pE<BM$|UvotiR)A2~3ww3^Z z0?l3MyUc(SRC%7}@f3A3fszCOSeR0vIDk$r@0Y7vaUDVfwL^EV?Epqy8pIBO=t^4K z{cdb^da>DQ$0l03!^^fdxNdc0eY+bQ&|!n?=Hc1qbiIhqpn$2XZ^;h>XbmZ$0VSk< zb#=fz+)`%CNm+#OF*U{18joB8Wr9K(GDhQTBb$5!owLreI+MOyA;Vz@upiRCjYo&Z z_SA*T@i+d~e-Kyhe=ye2V4r>ZtMTQ}{Z>5vr7xhVj^Gh;!gski47@##=B&bM{Ur}% z{5I~UMk>%hhs@ECI{70T2I|<0b*Omwo}YD=z~ z@5=nnU@9F{!T?bNYJypg4j>KveKMftlPjUy0J!i?SiCc4ifS zWYO4CpopLU8HYaG#l?kaPB&AC71A5mu9LSpXjzNpl{G*_ExTwcYKboV;?N=QU3hsM zO*E(ZLVNd#s@9v)0I2IU8ujKhra9Nf45s}o^3{W^5H!NcVP?YPt$$trjgaBNKE zy8=!LCGbObQgNHZtsJLII5j=%2AHGX9Oee78J8824GO$@*rq6qjkSCSC$M?yzCQ9x!lvFfw zZCUfHjAX-0IVQNm_*3$h*ljaOfer@s7n z+_`f*T_5+tao4X>C8OBFYJR%)MKb9`nP;Ahe$av+4Ub9HNzPTvNr16c2M|dr=e*bL z1?F_0WFK;>0o4IFHQO@Aai6dN3*4z0r-|-iJ1)Sb84jcBGVqyxRo5O>E71?i=lM*t z-dRR&iQ=Yz`T*^Dc1V~@>*-^y^Uie()IJ^Bv$nCG!)r|2bW*!EG1oRXh@{$?` zfztOyS#lTSq`b#>?k4Mwt8f<$ zE*8OLEAD^r(Rkp>12Lf%i3Y3tLybQfGc|A5ZK!3r);CsTIO@R{`qgVR9Lw>OKk@hD z|MnmKhp{-@fJfZfb(qtsUwQfExOwANwCeiHFJ}7M0676eEtUEb{ApV`xZEFUPGnUX7QZeJY-R>Iu%TB#^)G+>`Or^H0Y!PkuF? z=l=Hf+evpDk>Bl*#_3Lw*586dEVKT<+4S$3rT++>LSgHjdkCdgSoWx|!a#PgG-?gZ z=q7-r|L<`BBKI|N8x=Ic7TRRX{gZfR$50<&bYQj}3u<+_*ow@kw85M_gf7Ao01Kzu z3tY^kw2D$w(JxxVgq@jPM8nzwteo$!<|Ej6U-rLB;YGOBuq}53AXQ5+B}Ji*_U9_~ zyo^4;^XY&7=`6K9=4wzGN^Qu-fw=gQ@p$kkvs>c!cL7^ZHTDcK5i3I+uuU|(yT+ega&GFVY(F(T#%XWU_K3Zym z0;ruYxx}KrWAdLf!{D*>XHw3ck>fWH07B_lG(9_w%&HB5e$;8eL;tOsyffdN0jCdK z%{+b9;aF0Kzex`l<1X!~Qd}c;LbJ#r^j`Yzi5l6D9Vufk(#pm!lD) z0*(678Fa|A8w^e*pE$$oAOFNZh-P6Zrz?deJbfBU}wh{ z`4%{BD2LR;p1#^a5AZ}ArjFK@Z^w-{UXRybdOltPFrWVN7vqJep8_sPPF^6eY3zP1t@YiqgT;vRL`?W@`U-hh=fPP+f@Vg4|WZ-eSP2348< zAm_8!0Z*AoKy{eYIPf%?sG5b zlr>VF;WITQ@akfS=ybN@=RfuHW+b&t^O9+sF9N_W3Hba?ATgr_lqjQNI4pw=#e}|) z!+hr}!&@HmI_!68gdA5n9@~KE>M8<+soi#eeE_!WMuAI<@!j9`C*s2&`3OR`9M3-U zLIS6NSbU7q2k=)tQlK?8NyqWB0(iO&RF%wi=HKj~flm~0OkXVdw)0T{way%a>KhCT_Lx-DFnHtBF^nPk}oOp`nOomBHV50frry7;Uq1!3d|K{J1s z+(reEs{pG&RKE(USS-3LeCLced-?ZhY;?D{ChzUrE5u=*sAJBD9(rFq_|PN7;` z+);O94c+()7;!lOhETNes8a=#_em@;*D2cj#r+0j`P_B&zGKlI>GbVC!UC} zJpTE3j;lkpZUV4tw{FJf@^Z9kDBD|`X#K;~;2}v;q2NN{FY9YKL|M?a;ltnM@ZCKR zs_9E2Bk%TMp}!GO%>z0qcvBTyWX+heeTSxu*DmI!V>1VKI`n9vY1O-EWdgyFXKsck zVB`*}t=U{2Z@be)OK`2#dNO?hC|C-{FPfe|1P-(zgf9V=yr)SH-2{?jCr*{J@Z9~U zjHj6H3hY6+1E^XK>lBI zmn3C&(pK=THHF}4txKWSym^+HWJUYSo@O;hz%B=;^WM$}8>hLs>2wF!02sfkBiXB6 zpPGp8`1pt8;Ro-}&Ng>cU6@;l4}J7Qaq;|F1RT>9ZA&fJUTMeD+Jpar54=A<{_#)7 zeOK%kVW?A2( z>)^WPg89^ya%Xv!Z(LH*U0vtm(GPqmE?uVVMntB>Cv{Y5ZhfV{92I@Lvq|FvIMQI` zV$_)CDg%$a_mT9i{^oCdHa_|Bk3;Ko@$ySA#={Rk5TE$O$Ksi1pG`M`6H^B8czbg_ zzWn*mXJ^)z0b@b*b;7^);*0SrzF4E~=E#g>h6Rs`6KI&mq5a zXM>RZZ{x=^-}MJ}tU21@cR!Bg+UvLCD3;wfe>e)~M}Fi-zIjl!;G(*xjQ_1T-|3-w zHt26-0*>dheGVVm#_Y6Nbv8`)c-j#FH>klVBnr72Xqt{_jGB-7Hr>h8m75%!DCll& zw{u35<0m1CQlEll+-kReFRj!-WjN`TonJ7gD@jdH&jN@paI%lqVMmP`pacGE*oU(~0Yxx4FUKl|DA?dD){m_!$a0Hqd~ZUk=h>81}^ z;mvw1bjr*VP9e_a+z4xaeeMu0M>x0(z!}U(w|v&$mb;%K2)Y9VnpSNhzWY1>cznml zJ^~nGvUj&JDf@By)bV)Vd;b6I-3g#(NmUr&>V0{=uhX-y%sy!CB zO)mqy({tzl|9h)WoxM)gt*UoN`^r~*MZ5Z%tJ+gfKHm21-kChCT)w1z^P9e@z5Wf~ z&~CWl=62(aH?`}pzp<@dx4v!KxH(1^Ivex~_FY!qZ95fk1li~?g9ceIzH|yQIxo_6 zezJT=KRUguJDB8XI~KAHt%nHAX@=tqru2VGN016=nOVm(&feKvgtz$YY=!fihwVDb zJZw6i%^aE6W`-^WRCBU63jjfN>Qu|xTE6Vuylq?54c*R|6ZST{z2N!xw(D=W1)I^l zz#jaCj1A9cMkRxX!$qR3HFu*WvoPUZ_?_iVv?0ro#VZ18Xl|NSkpno61IDyZ0U zsV<=XetbFC%ch+-z3ENQE>lH>tct;1$_oPo(O1I6Kxi%hl*RI8iz1+&$Tznpzs!Xi zrp}vZYG79M^3F+Jkn@(_!V7E;u6B-T?$!z8@Y2B=ML507JrDt7UIbc)lAz7hfJ`a8 zoy%uX6c7c-+-VaO>BZF-Nasg;7O#8xgdZ=XaOKk+nt&xZW+sgHz#;H<#|D~z6*y<- z3$0C?H?{Zw*84LE2zG|i+O`WQ11p(jT!_!WmC}ngWfN9BbT@<*u^}8ae;p4l0!Msz z)F3BWb;a`LuazE)fM^Teh~fPd}a09k$pS_AXz# zH2>!Ph7D`mwbxwJUiY=Hi!AH;lAv(>L(yjNJ#%h*=;24(#?4!@BN3SLeAN7uRhU-| znFZNSz{-p~zISqsEI)8XY=|;JSq{%b2Rf19#ox73rdzon3l8q0Sg0syu&gZVM_b+- zijygy>EjW!yX;W_F-oAnZmF2M@Wq$FCsXyOs{K*DlTkN=bzG)vqIMLS8ky?BwsqUi zK+dLTho0uPyYGH+yYZ%*qCHETx@0A+fGM>((Mh%wV{PZw^=<3cwUIsUXk&-=29EV@ z%cc!&?V2as!=L?hd+?JVi{bgx?PHOBZd$)C=dIUoSl=Fh>WQE?f@LHK2MyO_WF}Bw zbIsLlSp?v*(fv86N}jqCoz&C_j`*c~ay3WWz38?6x|3h@V%g7_3ZetgyU~y?DeO7y zbndC3I(GP2XOF?xL{~r1UCIlXUdgFHiOhLi{Pc})eB-kZs+Z%cDF@%r1mq>Fx%%pr zZRN@(xvXZ-?!7r2G-R3^0aK=GIf^~sOkpg7L%xxYOvl@5X}#dNd(XZc@=p(0g-vAu zJ$l6YzZv;gG4qu5_?H1OXzL7x5k+qvPKDm?{Le79xW{qH-OHwK1A=)#b7c0Ccc=Ap z=sYVR3^n^jF=KQyA>J{3!;3NCF8{uf)|Sds*KlE08!>BCv@uS+V*GBbwE~o zkfYJZ^c>+hUqQg1Iz4P)_PqAudtVya{B2PuWFGC%oEJ=EG2Gt~!SoX!`GfY65B*+y z?4eJ#r=EDEede>DXrFoTQ^Smd9^*VxUuf3)%Uc9i4MON?7o(yjBPmtgb`KNp=aSNitQ-X^$m$V6) zslWDMvqo+)&bkUjy^w3Jeu+Y(2M#xXL{o;#HYd6&zzutLu`YmTwASzQ0Xrez@P;=$ zyP$fxpfC8df+#*ahC=2^H?H5<_U+vl4s}1EQw4lXs9)ccJC}*wyezv$K^y$Eka|?Wrh*S(ga*SZWDm4 zH$5=Q2m&%<_Z<+;5oblfH2=h4^ECfx6UP|@1E)2nK4nR^mx9wZEwP}&g&bA!QqWxLX2`yQW z(+Gmy{up`+X49t4iU2S(GpY}M==a-4{^XA`8@FKJ`e5_M5xUyJaL&VmTKw`-Y9vM( z99z^7B=WD~hFr|0=8MLuQH#R|U;ZMlzm)5H9-=)XK124wVFp^K@aKGMlqUv@?+tx3 zK2J3`{N4AoPk;1-ZG7MEwlL_~wQY0r zC&l;g+t>UB2=krRR_F4kpve5afGwLwgLTgI#HQw3D?E2jzFgeBV@J;SuDa^Vwsggk zwm0;(|Inf2k$>63JKL%m_IB(@2Kk)fwQ}HSWS%jkk0d_iMeZ>=h|B0;YFsvxI0JTn zZj3lWJ&E&laL&Gcfk1mknm&t$a|JJ|zAS>OGA^0b?j75shu#;#B8(x1Q#qUq)E-=r%SH)X>KQLIJ-Io*=72%`%JvzB&$ zWH@6HT)iwqZ?up*cCNl+dAoAu!Zs7Gs4tV8KYxC^{>JOuO*h}tuDtHLJXCumGHE-V z_D4|Oy)!zrUAuEQob$#ZTYrquuCZ&bzNWq6m9Ngf?7D5ou6%&%xN3^ zMg$l5%mJ7pU?aIwBlMfyi!3u9TMui=mg$e#=FOu{a37pTP!0YCR6};b&d63!_O{&I zW;etoo@gUFQ*x4Z8ck?=n)SMYcgCE^oFh zg8sm}dCSK3JHPu|?S22}SKG(_^n>l=AOGX_NMxlO);!$yZr{+ZTsFVG>fXEC^5u)$ zp3xY>M`ko@-dtn^_2!kQw|OBC9Z<)!EHOIKxbk4~=%7xVu#|6ByYi~5qH|o_c5dI< zo_u;u&i5`~v7%jf{k36FhuZ$ga&3C?r(n6&k;dqL`S$NI<*CJ=jER& z+7*e%-U!InO*_D7?9h?sFB98wChB&pVNMUvg`j%A*OyIDO^Dt*2GfzTMesa&Bzxus z^G9-zdw1rf1^sinEGhz;^{V-TYNlb2ok!s;DY$TAOR+}gq{AMMz`$vb#V}aUziip^ zEW<&{fHK1h=Mv;{(mss4JLWBduEOEz?wcYI$GqvbfPO(_E@+Xx;x>n)iO@V%S3ZZO z3_gdekpTtWfAmKmY-5KHrLz;0`MazZju0GlGK&b%Nv;e2&p=clTbXO}k>x{jf!mr< z*_qI9I^s}d{T9~eOR8CsorjFCT(+<+U*?!X(;YDi2xszwP9~;Pvexu~T}s}9$NgjB zl$er=v+qk z?P^m_M%EejYF<+ZWj@tkVqLy?UR%CoUIzd5mNP|mI$aP=g2HyDM3&56g6X6u2s9-U z|4aGCouu28*T~$t@i{k#_6J4}wyoQ@Whd#F$*Zndl_QL?g9k!}k?kI{3g%$=j^%#c zcHgOCbMr&KE9WiDBP#aAx8u>SX&0+S$Ta7ggAkom&C{O_o(n@8kt!a(4(UE0td&%w^OkM_x+-gwdE? zM~FSeCz}bOfd|DV!j6>R#kj0efbYn;p*|~Y<6L}P0 z{K&WU?RaE=N5*1k9hv&nqit%)AZ~;$jI|??ou!)%wyv+NCVsa#9%W5}$F*R36SRS}{-|n_!$F}UaZ@AtrtLbg^ldB^` z{&;hU&OLYB(XNQhb>FTX8R$p%?}<8lbNlbXQL6`zwrN4jj0mtZ!&dw;Nc!McC!+(B z?dwSMQ$f#2DcW8SY`81WB*&)lehV@h7o$suyqFoZR1j;{PhV4q*QM5OPb269A!XmKA3gAeHj|evzyv$dLVL?bfvY3A?0+#?b8om9_ z$QpL<-jzda*acI8)gP3T@p|(rFy=Y1@qCW6LgTq}T{9a98sX0AhN3tBDIUXJ9ZXy@ ztfIwm-Ibz=D_>G1tzO)8fsp)s$6pi;c}>es$I>5x4z6x>MFh>ba!YPFo_V;VkyRa! zAWNXxUR-1^lQIS2@EUv0t$URr9X}R$kL%omm?_gk7RPgmlmIDn6p$ToV;galjNh_U z(C|qWSaN;(3vAE?UxVy7szu z;Pkp=Ckr`EMU{lq77$>BYB-xC4%+IGXW*R-pyydpa;^TSg^Pvm+sbUZWk zJ1cB1G}vZ_p7@XhVaB5^S$l1^$d`d%Ch+Ak{10GY49UxwJa;p)k*VQ8-6{Ctjp4ik zAot4h>2RGxYOb5}jGz-m7cX3x!)jR@$oa!CE`i6N959s#jf9Q`tn1^bZ zx}${xwWF?}MyBvb1L^)#+o3~8ga5;EKRSt-BQd-k zY5Nb3wO{++zt$f7_$Tv-L7fvJdXqkP_KY?Xnd!`FmdHi67~i`NP-o?6KAl@+=0SgM z0*I^%FMQlofwi;(bDr%G8L~{)lz_Qfs~n6JWTOIBPA`O>GN@nF|M(sB=1|B}w8wwlQkAKhg~~_| z$Iwh!3bH@k)>BKo%*oB1Ws&&I%)0T8hd=Vi&0Asf!ph{5srZkRKl59y zpt<9*3jm%4nshwO$R5chUwXtdFCMz{SMeLqqpG#4V-fh5EnD1P6dBf6zv`>o9e3Q_ z7A;-gX3U(MFKW;V&-BP*a!FFOB_QMwo&Zd@j61-&TR-Xuz0m_lBO{&PX3bmJ_Uzl= z{_qbz*go)kzZ-Z?<}^Y60luJ-jOWnlEW>qyG2|H;E=-JHZ3|YS*z{4IZ6on_yN4muNXb(^GG`yG#)t?x(a(V2Y&GISlhI5OYS0ExpGDR z1>fZ>mbS&wsqNdjy&Z`W)q>FRqB(QhSh&Tu2&(%6=kZAK*%2Gpsn8L7%26F5o&nM( z1J0)Gg#_(Q2GxMG7C@AjNv&AAB#pycP3s1|38nN@eW2t-euqt*`ak1f6h>FxoStY? z!^s3yb6mBg3Ke3Nc|xaFEnTuCvmn7P-}=iIC{1vQtWIIUO@OkCO4cKwE?lrMf{_aZwFB+&*paqq@sga2<-D0y`!6p3ZW+;U|MqWYrrNDll?8Tzv|G5{ z74F0*SjO|XC-XYa^v;wh^>{QdqM|+Ltu+wXG`oz$amKC$Rb0uGQ(^uXtkV3z&4L)N`UO` zT*?=Z!DqLg!?b}QYRVu+1rcy)Ut~yI2!81~|I#gV(XMRWix^vA$Bvrw)VT(p=YXsh>9&exh^vBv0Pdw80?%kO$LvOh0#^}Ia*6zON-ge_nw?+rHB<#wvuqkaM zvPaV%I-mTTYS{tAC?jZelA0H_0<4ZBM@Krn;5HB7j!{MaX_%=xrI}H!vkiY%d)MwA zZPCI7ZP}7V?TY1#+meOz+TI;I+KJ#{;p}~Z zjw1dajiMt;bWRixpIId!yAJ1YmK|A`TeWC@-=5w1a_Yuwu591@rf+ON@crN4UiIo% z<=@Nla^h%YoDLG18TK?UhKut?BHJ7t&8ZTy?raWymCIrA3= zj|-y{SnOL-!dGbn_q=LFeSLoXfRj%J1VcPgn3Lz~#Jf{LY1#o=2PccfaD9xo}&I=Pg{= zmS3^5t+?XKHaqBEw|PhVL$JREIPTM@$iv$C=6}K;X^U}KN3Nj9$B5B9%3`S7NZEZ8hJm1 zJS|KH)yo9uD)`RH{Ozaxk?oCzL&dN!g3iovF3Ul>?Vw>$f~uo`Lj7H!WmjPe@yxJM zqGlNE4gJ!{NCZKS)&Zt3Km6>1|E5nXTah;6z<9^_r6~ichRn*(k z`Ew&UMVk_cz`fL+0I) znRS_}wglI3q4*v_Jjycee0dQ6oc@la@o;AHJQ+dM%Z!t<@ZiUSZ%b;9MHVuB=G6AW zm%O0;jlcFC?fZVqol|AOlhGGb5Keg>B@p*_i>65$`|L_UzixHmrTJefEdbY4vb|cnxmJXp|fW)U@M(vTAnsLpsOmOakk8*m<$V$SN z!ubpl<4fQXSj?w&^Jby`z&Smf*3oxfgy^ZwG0ErzLgfsdygZUoayX9J{W)a^ARlXU zA`4j(L!~Y=>zZd)qMJ;>P4~OCq~7k&&dgA$k$Lk1pQTx0gb_##S@X2~2r`Zt^df~5 zIOWI?*B`oz%58ekxo*?C_G|C{_571AUKUv?kn@PRWY1{v8TT?vj^L1+6+$Ta!j3$m zlW>gNiEuXaatjtja0`AcyLtWVzrOv|@A&ris;_!wo_An}nwKOxrS8vu1YW8MeBDX_ z9_HoI>^2^9IS`I{QuY@`WT)w5Q8rI`3a85y)X+RKwi71<=QPWR=H>>6@so$!>L(s- z+qbQ4BO{R=hP@iniqNwnsE*7IJq2H0DmfldtTcrpFy+6{Wge+$rA1_Gf~EDIxq2fm zGBTy0UiViM$fN62a*8K9T*G@Of-PPa0cGj3plwdRJbLu;)$NHVpK9wjZOH>%WT3V! z`>P3-l{qJtz9?YM>=@;Y%#Y7`%rECL^REeziyk&$mJT9%h@2NCk7!%j`Hy!5LxT3x82rmyW{qD{Y^KwZH{K#wwN82GdI6#%KO|M{J8>xVk*=Yn+0aB(X$a#D0 zIJ%jRRg1uyZ`b2r_+6BZ_QGflgAMy_7T|oHGem(f8bf9o(ULGcQw`B{f?#av0K>}V zOi|o6zMOLvl!6Yt$93+Mp|gO?=le*ezpGzHPC~mM&?x-*!iP@eA&0FL~)p z^6l?ez4Ddqw&&fP#~>;*Yr2EEqaz51%&a%?;oRaKd9lnZ|JG9cM*p0dvm;A#wBn)8 z;k2K@LV&k9z~#8Y$es>cO%Z%enGr$EXy8~|{n#hlXFm0z$UF~(vzz;jjwFJ^wCD^3 zRYO{=ntx5ZAn$lSWrp9;X~aDv4ZD4Et~G+K6YjHPiEJ^Kg~dNQaOSDa3x>c>y_z#J zuPt1fz@y*;-2>9%I=y0$w;2q$8MnYJOA2{q!o*a$# zLl)7bc~q+#{AB^z;^GL*iz9+|ybgbiD^w6A;J>)Mr9Um0~H6A!yN z6n1IEkPZ|GYJ} z&tG7Xk#KxL*)acT7^$oyPXmG@Gr4eoQx^G#T1OB8D+2QL$Sg)8V_3U>UHgMS{C^R| zrsM+eg9i@g&=EiR$L?|=d1OS9u_Xjze;L-{*8<+Mkj-mf``Y&AZ~eCRnpb<1e@DA& z)v9o)1<_6f9P^8j;q2P6E8pfXT)6BMZE@usWzat!S!V{QxEsN?lb0c-XD8e4$eME0 z5OqwMHNB#O>vQJ1gKnKAK$%QN_+7#CW48Vi8(3>RRl+(0tqWZOv&_U;DLR*IxFrm$e&ix}{xtF^v2#~u>a*s~3fuEyteYB3y2Dn_1d~DaGQqhDUg>FJe6yq1m5qiUMesY`4#cp` z*1U)TVVp8H8IpCNG68?b=uj@|KO7FCm$m&cT1`U{@N9Dp?+ruj)~K3?Go;kw+!!{` zj~<*sApouUQYZpIXJnMv%^?awURGFrU`Q`$3OAf8gKfr#E^ychgiiB%BauNl^3N$* zaWi*Qedd#&Xiu$qx?OkGmF@X=-kH0Vf~feM)0Qn++!n-VcvAk^jL~rH=iPKuyZ41J zh-_(L`^GoEv3=_||Hbyw7ri8YFUo9W@uH}+ctP-dtnG?`= zTYK=6ABs%$a9b2f>$K)YOMFK8nUQIRN<%Io!;q(Wa$A4}CYHfGLS!MD&{^o{aAb+j zc`#?)ts@ptL*JoayQ%!1zhGgz;+kvP@|9P&g)6UVN5<#0$DiKR9)5C7dor@pE!!g- z3mRv~5Z=6{7mNOYq0x$wkg_xV2q-)v8=GYwrBe=FtVD%X0njbvN9Uw!3!ShIaK; zSGAYF?B(r>6<4%vTQ-M$VhqDh&j4QvL3PS|-t(UE@BGg1%)e#x#R7U}!at{=di-z% z)d((gy91A{)AN@}WrXu1fQ-zYmoKOMIcW26oYq@j>-3y#WPkpGc?;9n4~{vGZdzM$ z#j;)y8JWqr9K!asx?lZOJPo;cd3h7O*3 z`X};bh`5_`l@Xl1w8_7i8iDm#1m@Wz3)|8aD+pB>RLapIJ0ZVQ#A8a4ToKXW6HEeM&~ zOmI9R@`3#a^Q0~-7HrUnoI9@Qs*as(N5_sv=RPMg&uiK(x82dMyYa@hc-hLZ6&-E2 zhW7C%pKKrc@E=Ezdue;#^KNZU=gLhEb7q8HcQ26W%Q1nQH*aZ=Jp6Eb=#hsqYh4sU zaes71k3RZ%1m*E|?RD1&-BTiPKHUz7y*a1&&%XAR?Vh{uh)!@>*wOy>>%Z~7wtwHD z$c$f??*V=Ex%&2n0PW?-GyKr!`GOslKlgJ#_vJGDkFw!NGpB_E zMbF+1PImu8@?Rn2@ z&%gWb_`Nb0y)RxW>xuv#Jo=kbmUP*9mf3sAsMa-_|J$~$JA4CAVA+c0`NmwwBJ(ue zAl~HCsi0eCNM!fWNOfZzObptcyrVev^yVHCje)@?LTxNPwl^E z)vEU0-~C-}`?f7@`<5+%BZAHe+futfX6a9+*m!a4t{otqDL!bFfd-#!u+rtliCW7cg?U6?wiQvDw?cTL3?a|bg zkr(;y+Pkl9-4-K^5UkGG4y+p19~d3Wt<|&USZ(4j1N*yavvd2b%N(n}UAAreuC$*s z`Rw`l_JsiLO%DG9&Pf1~)fhIKfDcbd0p@8`;Ut0}frt_Qx@w0v%9uxu?}8sA@)ASL z6_UNok|78zvK~&>&9z1&QAQ>^FPzbwRD|aE7fK7G@m3JfoNZ3sOB2Igp=9sbNpNcenBZX4ktsqDGY%v zt{_MJ!c(^!DRL}B(g>;o(TS-uqkA$t>h1IN2&Plp;c#Rxk;%_XDsPzgMO$mvJQf-G zfsjMsIwdDFj{>aei2QRSRy&YF{C1}5!Lj4H#npM9UdqU}Pr|!!L0h`=is(pIwi$C5 zw0)6@ZQQoIJsHFNbsKg@W@ZW~hS!lb&Y$n>(b*w`KpZ%khE)Xq)>PU<{4+Yy@r)fg z(GDD*(r$R(i`xyizNqazG~PzXB72`YtIZ!-)|M~7t}UE@ZNyeDc1}iSc)a=JgZ^|% z+C=ccw%Dej`snCryYaef+w1@Q*SC-S$%osTC!dN=WlAo-zv24p+6(WwD?3pKyKLXF zJ^vK-X)}LI&8c3a2Szj77j)0$vy(yfGQs%>K3{4?CSx0;^{Em)^KXW{dSJmpuyOj3 zEYlnOd}AKv^2L&%6Q2xU>_UUN%<$g`CJ_jtzKGVHMisTg@n+ANnRAl4v?&mEe_uUt zrt$>VF0jjTa|u-7iyuK(1RI|*M1x!A;O+0!_?#Qrqa`?22l%tr5lPyzWlJ(Bk42Ep zKRX;*5E_E&aHO%^iQ}vS=WohAa)%dQ;+_{*dG8e6co3v)50$x^o~Sy8>G@}lBM5l& zyJPpxJn3j;-lF)uxE((ld`E_gOE1`L5gm<8#yxYf^m+UiYPBe)!F$3kv1=FE@I za8WLuGK8Ly+b*L`bFtBRlCKWwB*K$o9dytgH25>jvql!SdtdSDHh;W;BJL+$7`)MN7^!#@BUAMLCuDdz|+|y4#)t-Ff$=pS^YuD}wUi;h5y?cWHL+wCh&vx0d zUD>c~-U|p+bZ|bteIY=5lR-7$>;({RK7KTepc_)= zR>Z)Of3hTuM8+ZGoDqg)yJ9ZOiD%J31O_`&JdF%-W;}~~5i-)qWVJFvPJSe^qVSq% zCxWGHEey||^5sj-k9IF9*r>Ibxr{0lXiMrd!~VFEu4sFDWQ$nj)aEH?aBgkIa~YaI zm>Fj{VE*;cXvbdnc$fiE@Ynv4V~4}pkLBOpni8p&Wi+{j$#WtMUSbfJWM$?TH!bPH zyB8=NN2V5~J9!0PLLZzu0n2+fZ`qN54Pp8674b|^?1FTNHM3jGh%%T)V9HGr@nAF@ z)-iw%T`^yMG-!+Bnf;Ha(KUO=f1XX)Ak6cyCdiwXon&&>#S_R z$g>ra|L9<7Ea)Pq6Hx{a)(@YEfNw~ft1<$g7mSg&Cg0Ya9`$l5vdrTrjXoT-A*LA{g_NK++t{5@r$l zlXQ&d%h|i`y1iY0?R7bl+OU2@+JFPq+4z}YGN@iAIG><8HJo8;1l3ugTtiDkLCJv( z%0EL>>jPchw8Jc*d0Xu5cFubVdhW+>ZO@rAH!`E?&4Cuy=^c-t!B_{*hYtVlvxiWS-Ny-@u(rJ^ zAB#-UeA~(uR|M@d@+~_#2$*?7e+;di7wd0Zp6mIZseO=k1vjpY2VKlzetW2c4=XU=J}VrV~g z=162-M`C!tqixviZ)EMwpnOut7C~ovbZq9?GgGIB2pZjyik*y1Wn^X=L6VGhzqzz5 zzOx^vcnRWTk!g=b&^&%}dSvhW+LjnbA0FM=7RGRW#nJ^aN}3UNa-toMvZ3*ivANli zkmvlibn${H6Pa|3Y^I;s7lHUtyY+@^+C8`3+OEI)id>mNhMTu+ZL8O;Z5ual%TxAk zSKSvQfqkPgP79i*1?w|%r=Mx9=^+QfPb?!RTZf&{uOBZObBCz3$p;!k(tLEnBvPtl4nq zKc|Dqpn93$d;~u&G6;uG*ddi&YdD`}Lfy$iVMt*_<}ovHGN>?;3=T5DXvRw{(*s`I zK}(OH!^EJ`;T7gHO#vvM8vp_~^7GGigrT~RjWpZ{fPz}sbpl%a z32Wv2Awrp%sSA${t8!_Tp=Y#{FUL;J0i#cr>A9fqrCMf*+Ko1>g*68VQSuZI1PC!2@G$PaaadKRTN3BrQQ~ZaDDMYuAO7&1{PoFUdFl&O$vN z0fc<5Oz;-D`+hh(8Y?RNZKc_>9jzBKh=99m=hnzhV;H+`b-q=eW}Y#+haA$A8UKxc zrcS!QGj%i%nGv8yoW(FQKZ5$~2rR+tv^g2%Hbnq6Pr4zp>HQIS#v+rP5kb~I{29~d zB>mYj=|tnoZN$+|MhT$J%slNJv%NKL1TC^{8xkxNvk_o?N(|wT&uxdNuV~9w-qH5# z7;C$CY-`63?QFZZKiLk9Zi*~#UR$(_5>Tes{AogB%tRQE?`W(vh$(-r8v=$aE5r*+SE zu;r$YpwARm9>W)svL&0Y>6}eqP}V&sg1PB{y%8*h{OrIX4ISs2-w+GY$UJkZD-ww4 zHM<>bVVkC~g4FC7bvB0_Zy0{HbjhN2%PqHLu-U)=VDiq^PY07h^)kV^2tG^3|7L_; zO`8@D6oO+RdRmTYD3izTML^|CX>8&OgW^QdM(%8hi_isyT;mx3EV1!7nAoh#)B>l= zmoo96VX{9rymH0zZs^XSlb#^Re*$aZ)XS@vAuZ@KY_-E{K?Dk!?C!n$I!6c`f*u+; zLsZEaAlM3sf=~C|yrXO`GS#T#GuJx?-I zD>EDOQp<9rJ$w9F}E_2*Ph}Oew!i)N;af33hFc9P0b0V0BfS7Q^=ghmW^SJNC9m)~t_Ux~1*hb+8?hp__7vvUBGy%q)&;Z^waIL4?mRaLAONbFlvo$^zVlw%RU|%aS#`DOmCI}&6+!} z8)dQ4xSzYt*kSxjbq6m-8M0NGH+kyRjn=GuF<)+-t-qEVW38y-8SGx7M)n;tbX=m( zTqhl)5xWJ2<>d<(w*`y3^C|>%S^ts4huZG2lij=b(7fE3hDeNxfg<+Y`bS$4g%r`5t0~-Q7 zi#EJ;iuy7i_w?G9C@opCIJd{zaNrs0^9{BshzP(lWX~`Nx)IdPW7?%+&dZxrfze+r zRmYGwhtn7dhnG=%d6LrrhzQ7Gw&Ce1$I7w-cR)H)2GcH}3RLkmpDQQW=G)vDvh9sv z?nL;73l?{oP&lvMRZEsG&fPTR{PMPF`E}9R zMA9(yym7c{RS*CGuyIL5K~(Ru z*i65)hx=#~ecdo$us1c)4ga}cH`I&&@`|#Nm6-=KyuSMCYumhe3nCbIL09H6YwqlD z>=_|PFVegoH-GNfZK>rQ1)(NK*tOvRX6B{#c_x{frSM}7D5 zKrx3?SaeL>q9I@%W<$%3WJ+MTz*puOPs2(Gi{w!;T@v_*4| zw_C57)2?1ItzEg?iDZXksJx|Zc>2k%+BHzKe;I-^lIcK0P83ORMP@F`8r>fO^zKt7VXj#{PBO& zSi!651TR(LvfPgBriLs>W=?A>7B6bYqMSo&*h5Z11+DqQFK~{Y+Wu-+Vt1ZHXSWl< zWKg|KaIS(^x;u1(T^dqGAdRa2K$-(1GC(o9ZaOuMc4h`s!~Q5A*^%{<{shZBZX~zJgF)SPX^3#gf!<=hDW!hk*x~O96SRa2c|@&;<*=64npBHhVcHf z=GfR+{s{{w1o`88=1=`OYKMKG%iCy19~h%~!8BcWG+b}A)yAlU=wXx)y=90pdbC7O z^yooGg6O@EmPGH7Uo< zJas;N&Q~=c>G`aMOi;-dUpJ%$apQhzP4F9tM-my3pdTm9wc~^5yY)U1O)vTFJd{z- zg2>o*lY98-uc9h%Ri~z4iaF^wGankSn8#Ml`+f3o1Vu;%7=+??n(ezKFw zt$|DY?Kbr1+|7^VS&3ij*MHW+VzVRE=u z&t|6aQV}Kv-<&wPvaC+}?W1`J1R-qLayHWq8mQS$>OwE?Nq`ev_s{C2?^<9+AL{`4 zDK~vf*QRTUla3_JN=T@S#ZkkL=PIPhK@jKe!I~Zg9r!LCdy0|m>{DM>fncPWstJKY zfJX(G>6c`wA2_*V@PP=ccUbfwx!fSFbdB@wZ@*R4uN`N{7HM-{>PTfnernTVXBg&s zAu|2&+l^E*x&8mIg%&=A|KdrLh3Kb9_~0J-stb-aImib z^I&0p&XRc?Ph{liDEZ=y*Kpv%>q(~Wy?zN}@3*n-RMUv(ec6sov=2NYA6{En*paSh})#CB^Iid`u`NXZcChi=c zCDNB(P^^XgBOlaQxlmWDcs7#mb{s3(WR5YNIzP-_*&@j~I_hAfCP|)h`UrjNhX=j8 z?Vqc#_8{VwWMjgOmgT4&e_V>ekep`qv-LY0jS!>6g7R#08}=NYVdd|kjxXnZ?OwL5 zez6^2yuyc9585b<&2`ed?I-Nl^Pb(Ett|it{56;_HfU|wF~JQu{ZX1aQRh<|-$RK2q2X(6`ZFGrnWtNGfQq8FFYQ)Y|DU7Ckij{8`Uwsx8MK@G;5V zM)rN@!E#XW%L&dL#Ww4v7oL{wGh$Vv0n%CHvaW1l;3E8+!xtG$q^#2P2S;8K+PNUU zs4XY>A$gfM59LQr#d2sZ&!;r&IVvO!R*`iaJ^a~Wl{bt;m(^4T$l9HeV?`p?=1cM! zhoX9(LK(Z(RBRxbKtY@wF~Gerj6Pu{eT_NkXB577xH0!z`7X0IgYKGUO})YZ?$0i` z%ex}*P2yK(W1NLK^$j~1-oYU|GVn|;0!CC5G&Q^?rB#>NJHi-p?gle^xt$=;Zbp|= zBXc?L?<4=>V3-->;gGL^1;jBD52@kS8v(|kf#sL$X_d?8q>FQNiF7G#-%m{CqSUPX zvPIvDgl`tc?94aww{wXuy514#U%JOX`y zP@~s#Zqa*=5J+U|)P=JIqt(chL{by@vWs81ajvu`Y4caiRP z$`d|zQh7e^=XLr~x<1&=vgM`kE&d-{?|GQ-hsEyyDGTC7JqyQdeptgZzPCsP41w^m z;G7=EWaxduhcwK|C;KVh*Q#0^%Pi>8&Hn7Ct}%Kf8)O-DU!w3e58tVW(0m%YSMpCL z?$q_+j-czkxlypMcm2Mi=2M7?OH`i;92K(E>bEXB-QYy2RrvWZxFjb0oRX^cu$7XB z$w(YTcY3+PFrTb;ayOR%_pCkitLi+nQ0ZEvP&mH&=J*h5xH?OVbB$PniHByX7dYLU(p}qbdI6}fkWs=O1&-yy~l2zibvcd(&FufVeYbE95@W@~EE>fbS_6&hF zZ%g(Ox|0J!1Nx>F=2=~`J1d3|p`cH%ftgf=ex|d!b~Y3KEfp0)yMQqH^u-+>DVgBe-9XNnQ;M6tIMGfCr2g@p8_cr)9V7wl|Mu zosF5_NAX4y94$hoZL0F(LGz8BtQ*NUXNR5>x1EuKQR(o`*4&#q@joaIRL2d+<%~?V z`*q0Sx1zW)`@AAMup=#EoF@1rDK=G;?^j>C?GPBOI^tTU9yc}^>`&M=5s%bnYh;c% zV0~D_+{{JEYF)BcbuHMma@V9eF;4C@7kbB-M{@A~>!-bY9d6MfD?fkNZ*{lKFNlYm z)ZIED=-$}*Xco!K)aCSmzLTl-&8J2Md!t)H+`PH<_I2=~&re2lVYfaB2aaeR zz&=(R#7CKSzYz+Ghg<_+^hV3)_tEL8;Iy}i;3ti+05ZeCEDkrrnXe z89v^!j`(rdQQzi)PLfapFX^uJ^29)$lTK%^V!fHD_a{Zp!3m%Qs*`(etV;y;^P%v68BZu@xD zuTosB0;^SJ$MM$>$-4R*FC_joxzO@8)9{r|qm=`wf6Qj&M8{M9hXbjIE^OFFbz{O$ z&c)TBJ)US9-|DLIC2z*uuU6kJBr107CEk{Z9Rue@HnO)53;}%G#QhXTs3> z)&PyJ8c3BARq*bX8Y1apAug;^mYu+~D}nL6J$JBl)Q$y?#$0DieA8P?SKMT`As(9_|J{dw}IN_|CJvJqYN4gr<> zM-5*ub_iW0T)@S!EyhKqfHyh&@;qwc4~@@N4bjer3t7(tE_SlTw!%0kgzp*v?{|%ls@l#SSzFGL%y}TJ{%}sv zod?;VSU=MV7>Kzdaa8>yp>COqR9%Nw@Y^dto;{O3YyEX|`_%qnXURC)u#?qczAeX7 zmh@(r0HyOjgL-BBxbonhuxW*}Eq>B=AxqTqBq7TA)Ch55e3`C%o_?Z-InuM}-n>E| z2&2ynG zd#(2S+#$$bM<2?g$4#qk@?eB#J55mWpwakSLhS1AO6~CBRHfy7_02^!OrngM3@-iW zKPlX&5EC|)wmfUhOt*E zje)app3vdZxIu|RT|9dI)`Du13+pBDt~2BTz$Es^1I$^sOnvyF`?X$vg%p|cp``No zb*J(faOYyX+Wlq)ag}}|ia8J+CMhQxIt;~}hVDdhUfH#57Jq_ZJ@18koo%D9x99(J z(XIa#&)lGVQKbAje6{*2)AdmKX8q<*`_gR@5~Xw4-*^0T=nJzOA>yo#qe0Bo;A|Dw z7|>z{e~Q6`9q@-kq9$+7IB$4p5^?M4H$#|n`JJ}CQ1>}dp7SuF#LWgLzUYMc=CAGV zj)!EJLq*JZ*gkXkw_D|5rXX{t3hn}S^AF(!lO%&T=`Ts%swDoBLWa%SZzaIsy#OuJ zY1IfLHsu2zFZY6`Tjnem53>A@C(Rl-Z}vG2SgE!) zFxT_p^X-3y+wT$YtE`S`no<{qY`F z+yRE;fRe~9T1OT*LrM1W`EGlc+x3C%^#H3O>xYi7BI~JveUB& zk@kHy^n<-%vF&lDfLrC-^z|zGDtjlE?TxcPCe(k-l#o$x4sgvY{jq&nzMaQYq8)x= za|V##DX>*J4!%6u$$2U%tH7ZUfMZ==T|qsMtS1t(+5egkMRk{r1CMo>R*Drq_NmQ> zFS}nQuAt$ekrBeOls=4x@t8vQu2|~X9Hg4zX=^~t!06lE;6G)=366Zc=XQR6{to3!J&YA7rBy!oAlxFA6yOx%UQc)vYU|84=u-Ng6n# z9^6UucGUoMgP|ky;UE_qo-%w%yzY2=8b$y|&mCEy9x4`8a0x~%arS08jpFTMIlyG;P`-@31`^kUPK{Dz=_H$K6=h{72qKv?2sy`=G0Q43G^_1&e9wE`Sc(oh#Z&2sXnPU_lJ45rA9qo~$3>KO8Z~W+O zG?nrlne2W~MRFaubvI0&03Uumd^5`tfQ`&GkTMpPLq>H`F0MHA|J8F3GP+#c!!Q0e zr(SZ3cMm)KbQtqYd3>8#;p~}h3!ZDe3=<*ZW6YS~xN_@Ch0Zyg+&IJBT!!;gZ>8qw zPE&sVQJ{vT1grFwtQ4lFw|#_7atGv)wc7pkw%v`25Sw+)7iPJCud+^ji-{FkdOvqrN^91$`1I^=t{V z1w^|ufny|2f1GGd&M6r6xbXtA(J+dp(H*?1L?1VJ&2`7~7Xh00z3x<(P?mWxqT88w z!-7LggFT+_bk>uYUS+tk3ih^-s?&tde~ga*k7~O^u%4D0*fKoZI?HU;di9n0?wX9; zBe`^_$#9J=!NxE(QRkXV`;vJRvv<6P3BOPA{EJ* zng4rtvHenxDzSACU}yhG;Zs~sR{ADwMGT-i;Fqx1`{HUDE^~^Hz6k3Sd2o}6w@)>c zXJn6^0;jfnHmaH`C)fWh6bLa#30!{o-^}?Qu@+WgO@W%Y%_r5@!r@iYQ;8K8o0@=H zS92jFI#e9ZSC6NPbChQan2!bbPaYi&Qif zc7}Y@ts`nXAz>h-91N&R=x1}4!i3-8cmB%@5h%i6Fy+!xTh&K?<%2i3kyqz(${jz| z%K!GN;pPPM%*I(XrE(M7t7>^mRn}8E)Ewh9T7|X%|E4eqJd%?D(f;rqJD~}n~0k%mNYC0gZ#_dG!P_wD4 zVilVtL9W+ECl0Vwz-hjxY)*w9F(VlX1WPR$)cV`A8p7X6E_QS-WqeXWq_w{RH%e*X z)n!9HLRS5@T0huN4p-Rg^Ki;Xol#hw9kfBT6e#)b1M50slvaI+vhD?{uGwS~uMoW- zDx_<}&HRqQd>k4nzI=H6$aYSksmsjklnN{c&IFrv4DdvT15Z9ZCp%bi$ zS&K^3YoM`dJfaYN!=CYHQ{D3D>c3}gu+XSX&dkZ@Z=6SrWks*gi3Q2|Q}*;)Or8}qA%c?m+ZzhJ_w#*Pj0)*M8BbzIa&2}k>aaPb&KYw z=iat#5Yf|pB#1o}XDJsspYq%i5MxVVf`;>y!Zy05k*=feHnXtV=d&DP3+44?Ra|k( zw}pu-&runo=}pb~$J;-Ixmw~lRC`0+a5SqrYXJgK1*0s5(JhWZ=h_t={#}zeI831+ zrd`j%xWurobR04LC2DJif>Q+nbKV$O@Sm;m>MAzKkB^v2>-<9EmbP5`Dtni|;cGsR z0$ZndW4{yuJI+&|bl6^}_{@kYnK9zecs;U@TkaDy*OV0vpkI~Ek9gLY0jroSHW<#_ zCSG6L$S3ywZlrWh5!*+3R-#@}uzj!Rp68&~AsNF~Z8m$`{3C0kM12kMV zAA_Ano*m%GdkZ(V2Z#hp@>Jy%%?N3}#OsjHDcEAfZj*_1!gb-Zv`O`21wJlZ^e5g{Ifgvyl!kw+8?B+^s2#H!u|%4u5TVWG00 zF1zxXsf0_~l&FM_rZ@8uO~+vn0~2r z+XuxNeO-GE$k#)Di1v=VmHE7jus86bjv7})Y|PI7;XG-@y7p85-x-I#E3j0Iqe<;? zVQANzk7W90FAHH^yEHApi&G$iF?Toc#^UB`#XF~L_Zu26?G&SKK(oA z|8HLx7pQ82m3XS~uMGCk;Ls|vGqB`hr`EaMkia&)sth^zwO(AxdGE#2^|J`oyo~&d zk!;Ln`)N3W+BnZXpx>YL6>D_ZLOejjVAM}=E~H8Yv98*V=ga;m_7wvgo883bAfG2r z-l1~m5S=ak!a3>OmRfM(j-V zi;a_GitnSS%VA&>(z$iSuz9l!X?3;Rplp8aYCqQyw%u_3w&(}h9Q^Qdw?+I^SpNFA zeXB3Bx=Ym6w=Q75{*enIedpKv{1Hor+M@W#aag!u%7FX(!$15yKAYSZry1UnKTPy( z5xXtgw4rzZc{bQC5;AWEt(Dcs=UTluCbr|Ok;!d&Tj+2ox? z%1e>)nsp4exR$+qm>4!p6|FyNcUgG&7!NLQp6-cLI=wAaM)~*ViUHE;_Lmi1#euTJFP-o3njLU3` zCKASJlSYBcOc|xiy`Z9yrPE4L4G?v%0!-f5#T@@7JDi_VKNc`yK*WUZ+QOkkTl2L^7Rpk@hjt1Uv=lJ$zv&IV9i#VVa-V6y7srI!a-? z8*#D0YwLs~XI7y+PiuktM9KKj5Y1w{-dPSQ*fIZmS5>!Z$apl%Hz0>+B#0X>9S1hf zk_3z7rD*iAwmEB{Q7cRIZ=^C5mm>d62-~W~1>tHmLQ>NY9ljG|fmh^vyUPHMx#LxTb~##cuZZ(B zw5$X8%$!^qr)HZB{BY+!e846FEk9=mowF!U!+6X5L&B?Yip=?O|-SWk1)F z&mHE*0c9V_#Mv@y|=Kh{~eA$#2wqo@}^S(+y zyX%sJd9<1xgR^pLdKUZLN@_)xS=mJLGs&hoiLXo^a@!c)by98dF?8`EAb|PzSUL^%*Poa0l*Z19OmwNH3=P zrN@fUNegG&K$MUoG7_XPetzEal!_CbMEjZkB05TmrBzw**-ovFS87ZOF&htk&}Rpb zHYklS1R74DeBDuC04b*75wF*@aa@&e;nne4`#C3Uw+D4zuPTfgmaUDfoZfskXPDi3 z)lF|Z`i_juvGe7o?uZ7>taFbX8A_&r8c$HravKJAINl|tE`e5DSripyiHKKl7)gi9Jp z_r`6LAlG3j`DJ1H-s>K64@bSEe~F4yZ`t2y38v}f(di~#3&lwP0=Cuy-3~cD_YV*J zG~>-Fp7jEx9?#~-FT!iE-Aw@XVJY=q(BRou#KqSH9H<|g3nwh)Az_L1e;txVjL1W2Q}B+ah8%0u z;`3L|(gV(H<=CPB{aqOUt0%ly8YIUXZ><@`2rUQ-b-_*#T>bH6T4t+Byg-` zhShqD>iaOqnaItHap*JYm!JEm0UYZ$2Q*MA#u&|T!AM;kXr!Y3WF`*<=d$=aSgLQQ zL3v(leFku8h1!wo`6SXP{U-HQ`DcveF;fyC$fijFU#j!VdsFd#+SeuG)y&8v4l3XY zr_0tuP9lywfgHXB|HwhmmvM7z;YXdCLaKMF`;|J@4Pr^08!-W@tluJp=3|Y%i{yylTF8D!CYE56Tn2P7 zj5Y`)5{>dS21k~bwEG=liP(4`{Mt1{x1_N%isOCkCkNVMkw}Nl9VZT|J9`XC%u)}8 zWM$<6kQYf>rupO?@FZ8Nz4qnAr$uVChiv+!d^m`9q;&~WAs+y$dq4t;5bOTS+SF)3 zilRY@I_z)CwC38-I;b4+o@KO$Lf#Ovklj5y-aM1Ny7fyo)?6_HA5lDZW@rpGRqXtz zOQKg|J(`#h;hB~#Vjhw5WJ9+%JHK~e(>maVnIr!t;D{9WMeOoX9A>4|=oimNk~?6! z96{mqEYUu$B_`yA42Ey{Gd*g8R6d#>feJ*R*a+d{f!%a{(N|YhULE|`I^6^|_51|= zKS=I)jR?-I2}Dr*II8v@l{>4IBFan1RbDE>WetVEfN;UQfqsSYf_=g|L9HZbk8j}c zhY`v@`ZQ;vu|f`OKzM9Y{0&lvt@tyEgwg=8uQfuvW3b&RWzHn|_Xszo6Y;+ysAD)0 zI3IJpgVATBV_8}mz?qEjmAt?I&kQI?fRb!~GtN8t7#_961-)&TR~U0}}=nqsi+TeybdF1u-RZG4YrT zxg)6hLw{1-+ugLt1HMyXjiQ=J!8t0eq>bVIf)7LO~$TK@Iz*v@$p*LdX|vqkH0K&e4o%c*kCT?k5UTg>G0TcSc;f?+7-`j@T1%*YagH)!jP zXZfxpMi<*rUc0H}Iiuw56SqvyRspzjg+Pe7gy-PCJciY$ZzObRK-%$@Yk!Q)8DW!4 z7wkK*T1T#q_~4!nYsxBK^`4yZf^n9Wn;v8oXD!Wf1 z#L^LCgDPZR9r+4so)Mp$f$yEs>V}NnHw5ORh|fZZ0!E0G7c)dz&p!)e2m>$m{WaJY zol+n#>t9dY-=zD!&vSX$mw#6A83|=X+~H=;1%1%(GY%XM&CWf-Q_-C95i4ww;S7Ds zESm)|!p|4tO570vpMh?jfC>0-A)e694iSDN7^8{t_ZJNP9PqyC>P8R_2PVRIAMB zu9Y7wxa~5um!PFX1RT!YwrD``nQWXHLa~a?95jvKHIO0?n)EzcU6heNc<4oI?8}}Z zN~vOCYwA=Ht6}=!1AH{lb4yA27vf}c(zLJ7{qz!Rk$JjM0^NNu^rK76(P~Aki;w5x z&WEF`T%^yYk+eDpqL-)9H^PZJY;_j93R_Or-O4w>%Fl)LOXvCu$!ENBo(_%JEnBXg z6A%FR?r!|Vjg!Uc4LJ6G82Zj#gN;m_u7j)mllikDWwK=F3bBKQsEY35 zr=-$PmZA|N*oTST-TOvT&Ru{j>FGqVusE}w0gv+|S6RMj;c|MYm7H33_uNUHuM_Q?n0 zIkD#g<0VU}1ro3a)!Jt`!%~B~O-~j`0oxP=zV#nbFg z?=T-Sj@X&C)DQ|gsyO??#0M1cv*}KOJty+Hg`PMY8}Q+~4N~VXvOYyxw5qit`Y#h+ zf@7J@g2E$gFuo!l<-(!{3VYeY0#;&>7xb~Oi#c&$-C94D zKjiFwkQoDX&rKZtm`)$PKp&zDt6|K`MFr6F4xX|yeqhTuHlBADzL#kMsr^@k zYI}`FZk-=dQ9}t1yJP01;KVERauODl);T zy!(1aFdt-Bx@RHK#@E`_kU!bq7XZsMKuBXUoiP2+?{~fgDEo<%J50ZbOEMs!C+4-@ zDxBs2NXZ#tjSQPPqH!du-qtA5(dWbonkiC|qVv35@JS>3LS*r& zP|OEQ2imu5Rzy^-L6u%&toeRR4?C%~j!oe?5d+S3!v$nT8DEr|kInO!)Kd6eSFJLZ zjAkdx%}Q!U`GoH&C~|Q05x32m0MGR4oRP9V$ahvGmfCzeq)#;GaPMS%3Q|RI#Yv#| zu6^;Uf|Rhz$jN*INJlzaNt^FzU8#uQ{otu4Tfj2TBmJRP`qSg}9Nh8`PF5_Zb$dAt zRs#rA2O4V8REhc#;;Qqdt>Ii@Gk2OK-&_>)#A@^JE^&&lJO+9=8xWXeFJj01HV3~b z>Vx?2jz;-;nSt6?KC_4TeC4omefr6DXzw+r;xFY9KIm)>oyH*D4`LZ`!K}OA<1im8 zp!|zrXg$$cohoU7S_z3tiLUaTlkic0Qg5I8#S0go>e^?RKZ@ZjB|Ob+yzGE*WW2^EAOZAGpuD(m6`p>xI@GqPh$l+&{n;mY=sidR+J-0k^Z_fm`nAIDIi?ybuo@`o}zT@!Te!;$|J$3Zi?T7*7hT@UU z_$A-o`#u+YpZ<6>O8V+@mt!`lK9J|zj(vUQy8N9ESmm54; zb%`r0u?jWoE;(5c&d=;jUf;^*peRc^Sh3m>QWFm=k24LJg|GLQZ?}7WX;IR1-W}+I zDekE)85cVvDV@GA%l!!rY_gS|+;2OJL2vAi7g6EBXA3>nt6TZ&0TF2NS|X=Wi-W^Y zA@OnALW^BtMx;ezwhF2Bk4KD$DVW2s-slw@x2!7#;p>PX98)!5YpKWk>Q&d? zdux@rl^jZ&BPM4W{Q!~+|F&)Gt|*}qGJ)=G8G$ugtKUp2Ht2GzP|%}=YFL=rLbKVi zDyPAXJWBzGqiMCD0sUfWAB} z)9+Nj5ZqW6vrC|Iy_bu>#9wrUMXBEHsPXCuokr%87W7jqozCOootQ2=^SpOGhhDUr;ZemFb(b=ofIQt|`;}^F^}&YdNB%LBQId;B3JNpyAFiXl(*c_P@_ap# zD5uyZQ5Ma32)-QIKh<`jm`c;v4wy{3;6@snY~1W(gdLCBXdk0<4Gd2&%ofD&PbnHY zU7THET0Lfgn?Had?l)-UNJ>gLDHjp_S1Gb&30m&L-0zc=UD{5U6S-)%AK8j~tM#H`6#BdO0S0)N8a z;Ucc_l9_BF#fhjWCEe(fU79X$Xi(hbr`{peCAJgSnKpZg8IIChqOK!i~vs;B!^)Kjk!ce+mj@rH-V~|<*0s!cKe-UdtAdoXh_w&403ee zPT8_|Aqv?ac~KGUOZ@{Yxw>z<<5e1zIwCG_4m{eUCdvsUbw_)9BOIEmtufzaSk(D` zgf>fW&#E6&#AbetuvaXVISWuP^14qc{^~b(_8?Ukaao8e+N!V04ws|DRyCfvqqeZ8 zY?K{h4S-UiI6kAdj(0+6DL9*Bo!;Z?4S@I)imgR;*^ATAy#c4fAm8vANsne2GkvVs zSEwb|nIxT_tk`=oJ~?E0hMD`sRh4cbio65IO3dEhv^Q7^)=BzR>qyMu)Y^1dKQyPb z{f{MCv{)%qRR_QrfF*`71b?eE`hN8_%hNb`mB7P=Esu&;dGZYagpQXv9vIPcw4{MW zqQ7v@sWY>CxM<;3i^SS9<31^5j28!Q6>8+AB^qQ0JAc1Frhji|?)ytUm?G+-g(Fq+zFUs-vXRS@u!TiynL(z;R>y38jQ4*J?0KqJ~umIr1X0^vk0xg4Fn($$k_oBBn�c#YTf9s%I z*J$8}+&y(`^1-jkpye9=%w<_XMVpsIuP>yGg8^F>lx}*`3P^paTB*{xsvzgXSKL>j zrwiF3!Bya$0z}9}!%23#f>DVN$G`5bO92G^0goaweI`d}_efDo+ND`hSw4P1{dj{k@s4s+t@3WS z$Ok3{@}C!4ghO|L-41!VF}qWrnqWMU(qw;_l;kBR4(H*2<{pu1J2UCYr>hXuyd3=~ zMM$J{N%Q9bzi7YD`8(kRDXK=?!#aVa}{y5#IfImT$bup zqD>>1Pbam?DM7&%-z%*VQ$2z(Zz7J0^74l{8~g_P@A+L^d`SYhX-LUvLT94f9@J7Z zoq0Ua52^t@lZG)Tp3~TmvkCP*ja0V4>gAoQCs4!GZF=|4v#=v)@EYt@P%*1q+fl(+JUwfQB9$tu1w7 zH)eOockR!us@+^zzFSBe4-0dV_vSWEdAfWOaiOQU9_bd_==mFP!DPN~uZa2?tA9&i zUjaB|djW_!hj`owH;2y@5pUZ*+s;z5%}&5Qnk&ocuVAQs+!w6~Ad11G^4oVMON(vU zS>@)D66>9!Z=9w5Jsa%1&(#KtapiixBkJt|Rd#PRTef?L?;3|(7-tVv=srtQm;iV@ zp_+*XrTyMFa?u|p5Vzc{ZrD2v`Gzfol|`#soX}qCpV#kf(utC-m9|roGL5}IV$T@) z_r7KzI?{O{iFfvEgjQ3ux;>L}O9^#cqalUXH~B8OeSG}o_Bab_U8S1~+p8-Z%k_d# z8p__rXD7j;$v2M*epli6X|6#nZgieTtdRnVdh~wfZIYAs7D&$1uI24WSLZ)I2P-1s zyRz~QT)@Wf<@q~dz65U%pse$5d5gayNhrX?YCeBHf<@qYQ6|0lxd0y3j##3|jBj(! zkv0LWZ58AC((-nI`@Y4-yNmW}Jp!J!g@s zVHL69OpLTsDkyuDT<+u0y?~)7-AD1j=9fUn$G0*FT05UbXGh7SuFX6G%`BpFUF#7p z{>Vp$MKqmnjl5oW{(c;z20eazC0p$$8o^9PVEIyBKk`wzUANLqa#R>epnL=ScAP=I z?hR8irB}db?>t(|sdnqQ4NW%i*jKD$Lm_5Py?Wt26W*n^-jY(Y1VJHQ2XqE(YBMXJXgMQpp8kBol^;GiLW(C9bdve;190U z48I2_QFn1izQE+aLgWS8SZ4QCLygWh&5+ZtEGgcb&dRme_eeh}2^r1m6+UF~oQY&4Od-KUApush;@(X8*3;V{4A?#9yqWVPl@wo)=iWO0r==IJhN}n_1t0kLvwl)-qG27#Ikw1I$PmjA(wU zOeNxU`08-&Lsow^i@No>iqLQGXV7mX;X{41)bltMOgWq2CaapeZ_t|hkSDezfyUX0 zYwQ6fy#K6jFl{^~rWqQ4kz}U%hOKNTg@`;DOR%!^^PU1(DU`<7_5MnLE1dnce3?oa z$H(nx2$Y9;NT?AR_h+em!5#WUns>l~xIZu{{36A(uj)JO@>|lU)?V5ao}i3cNj*FN zqay4tCb>oj!KE+!kxyx-&$oDeDwJj+&(C6qRQ^W1xxUAR(yA|sg7>t0gR{8Y;_u7< zke8$Q0cWxxCd|FYuF$*2=DL(T<-D3AL^&O$d;$GAXNHa4Rkww(WyaGmZ8BC^jLSGio_sRq(#DtpKLY~17ZCEbn+p2L>NS* zb@-ro%af&9#Umczl1QqaB0L=dMZThJxm}dRFk{$6tFAr;KV!UF(RfxP8y^X zOWyE1Zb^bGIKsvKdoYBDl(z$`BQ1g~0w=Dqvo;M8;GMN(h((@b?noD6t-iE`4;#Ao1>q|FDzZFX1i7&f9^A=>L|b-KYd0lK^LIY|$Yrh#WDrtenG!B4 zaro?EBG*VEzzk{>NPgz{j$zOOpmJys8MdAin89C=_pB0%apTX4qFM1Y8J3X2$6BUnC&d^K!`mkCW zR(hqGyKKVv=DHZZJk!~f@)d%SNU`SBg68VIe?AO?A1(Q4&Nv)ePi9;TB4= zi;%ASl5618`^IT9wrM5e8U?)SeA@h#U@xa09}Dd0W8wutAHP#gj41n!w4uPpR*Tg~ zyF=m3;JN!iL`TWxoYYndNgwE(7%g_u*XOU`j0hj8{MqmAM)vkTTNpP_Wi4?A@Gp?l z4zWS+?Az=NToLh1!>5;kp213XbO@OhONkz(+1n)`N$z3Dlg2Of?NNk^DS_Z_!Hpn& zx!hR=3-#JPC)tE&@zb%MHG_9z9{akt5Ad*_dm*2@I4>J`VN zv3CkYO~0vGUQpCHOP;DLZ9!y1qP+AWFrV0f0EpHTzqyf7a?-Pqb$LwA8H==)2Ae?Z zTN@7eD

    w$KE+Mdz3uk02@B;s*w*bIFjv6}l?EYC^1Ud{H&cH6LL zDWtlJ?HWFdg2%DqkHroyL%_RmD)~i8c|55R6aImT70lOnX>Sh3Izw3Y1xKBe17|wN zYG97E^M86efx=tP?W#7clI5iSWirsKmT5}wY<-l5T5aejywdm^Z3P&jS* zxeFJ?5o5ZE%xctOBr1rsyMoYW=Lo6H@nRa;%GjIawpjXPtdrlAQ7d4kGvUT4iA_mf z_>--lS7iLVw|~%Ou7 zCD?TGUAmGw;cY+Ac30ptjq=C)LN&A>>Ww%RdV!Kn`BfwsW+m3e- zEduV_S#&gZW1TcQ%)`ED`vjuk z+!umL)Hs}ZmJdG^AeH%tQ{M0|Uj9*z+THQ#2xiP^4{Odo+n=(rQJt$!e_GN+^4>+9 zp!Vf6R|9(^3nzvtT6$bAa5kFW8YM#Mk}C2ChzKA|^mMtlg&fP-@&?<&>75Yd`e=L*oj0$H45xO};)Z_( z1om-ACo*dUhHnfN2dOO{MsxE(5-AUj&` zKwSTtK^tzSGTKCj)xs&YpO&V}cO8p5ZYpNW0BG^nNQIT*qnt^Fj6k!R?dLW(x-qh%(DR)l~#EZ3@{qo)*q*w#&lGanNLIf9YCi57>|& zBp>0u)5q5)69EFoX?+{i6@7x@DBpLx*}qAPn^K&JN2gu4bjac&2z@pqNY;KGt?U}r zU#84Rn&%zI4!hm&@Ym!%Tgcu{QC?!g{7Ul2%$`43ZtJYlQP)jcIQ=tvHI_=v3RnUI z7^(%0d-QQ*P!pG~O;|FDr@ zH-bbyhg^M(0cm#4pKIRjHkGws>J% zUE*OVcoxRXN$|6c9#wwfg+9@)F!zFP7Q$JTU$LB(Z8gyB#nSN*C z))m-qe?D1d2q~*nR;S_mgGC%k?VocQ>PEs_l39K?w4Z>R&4jm(d`;0A8K!V~HkNMP zrC6tvoU=e#93QiiJT2zXWma$ZiBoMMv5CZb=Oz3*C%kw^SZP;UmhZ_Dpof--npVfe zhIKfjB}wNMIh%t!M^HCh0|hIE5=vF{wzeFo-L$DIJX|gSMPj#So|nS(`@7nak8(c^ ze)?|Lc>G#-G}ab%NgiD27vE5=;uHZDT<3zQpw_N&T)-^2i+{5uhQc%0Q;73IdFZHK z$b}@%Z68ywcc6YPWSuB5w}iT+bXqf1*59TljI46_Lb@^}94skjl~)DRPfw;O!=iyL z3H}r!!_JDsnO5!zQc`~!u)5Eo4#_aiO=0-?lGHJ1{ zzf02;e#(|Z{2swwhKQ-?(~{`x}bAxVNK5u}_p8SUb{<8&3pNsVv8ji)NK zM>0?@t`%CLnBHy(UE-06sTaRib(6yndPW`dYT%sJ>Gv2bdhp(TGEa*|6H8lV`<2S- z->v7V3NzH(QeToQS`@F4+jAC{2+6u)Ou`?FQ0N;$nRLE79VwV8WB7+=-i5A{vi!nc zDv`~t!3nGqnV-P_jTw|t_<5D_tyLlbbCOH(s^E(vDz?Et?wnI2)Kanq9Wsq2$2h;= z6|Q^Cldn0l7g}O7pitXeFj=Ns(s9<={8fTLRqE{NhcMpLW0F}+C>j)qN_}UcsmXlv z!0VK}o@m~4OBVH`skJzgLb0}ym%1~eh3)H0i$j zu}kg$b7Y{IHLqcTO6+5(RaOy(yP9FtYNSYYKNVqeQRZXyjWJAZZbNED}$Dkr6&y0)zX6kxm z)9ztZNl9&UnAm16ozJ_XoRhTl8=j9)ynT@`rE#4UxTd84NWMLR+m%qQRiszTB=xs;+QNA@(Jnzhl{^tdyjX8fV~;A93!y8&>Ur2KaRa-gCB zROtgUEVV3|sym~T@)^U5I$$`J#>)y^z8H%JD3~c?Al!SnH3s-0Dq(=~#X$dZDGi}^ zyYBZuF_|xQ9P45#awqZ4DXq3=h{G)K6XTrU;_YP!W#=!nEte(X>+X4etM>(laye}` zyGSH#ZA1X*P!0zf+De8cqSaok?$+Dts-yh2yUWU;*XacILab^vdTG`~z{p^?sZvVk zsnemHKAtW0b*$}NNj0O>4)O0QjMNe^KP`wRRiTN4C;>|hfk=GQr8gpVrNQF%8ED**Is%*h4YuNjW^z`{usr@vinbS zO@9qm4P@1s+?-Za+WmNM>T3;7%d!E7xni?1OmNr{h zuz*#GnKy>7O7lKsJpXDYRG=Nq(`5ZgW3pu0trO&17FHtqMs^rVu^NPFE3I_>IU~af zW@o4dk2!t+;MHNc>=sPSd$2hr5l5Xhy1Pr)j@JyD+1BLme}YwxkO2P7dtMa`xg*P& zZ|uBXWB(GgZQH3zY`vi7l@}QMa14Tm-)Yu+yW?8}RfEQltRZHTnNi!1-Ghh(xO|d>B$kU-NPrE1AlsH=^~95<3~Ej%GB<`v(Qo4U;QI>sAV+7XZSp zb(sD^>+a;YySUFT82K>`oc;(jV76Qlil5@NwlD}&7ui11lY)c&(`;{ zmMg|1@@bGA&h6ek6q^YpSAPY871%vlo z1gE^WZ-^Ko^&;Pnk;%cT4ADtz?EA2gkFH3(WzOzC6cha&bsylRUb8A+UhEx-c|KQF zy}FjiAAQMOeXbP|+R3sd=Lnl$URU1#lwFRpZix+p^d*My+FwFOeN^f=G#UUg3Md)w z^Q`g*dE!7zt)8+P3D)*>6>ZM<)zeET{j9WBuXQ_n3EJ`IDN^k;-x^p0UcYAoB-v=U zU)A|`5?rG{N>JSp$9u-6NM$VZ9zbHOvYA}BWWfnUyob`MJ{BgFQl54Q<_{|?>oIgY z4hta=S$Z^g6x)RnYo#t<7+BPtUgsUo8OWvbuqWrhQ1>T`O!|Sr4v^(+F9#{))hCR9 zw6-cJT_vonkXxv@e#531rJz!s;5YTPjw~=E=JYm!lJ%heN5eGmhwldh$cV}Rvg;5? z-D(;2ifa01q|eV-7Jd0P2Uzis&Mfb}w5vAC-4k zYh@;+yf45n0E$5pl!Es$pBdQ;=JibmW$qH}LV-Y#H-7x$t5T-|!~6`Q-p2n*B&pX6 zxLy_J+(fVW;)v}OW9y1oBo&B_+dc(A3&j`&NKQ%G|CP(k7{MCUg{HI?39_Dv__7|b z3_tSu^qf@z%jl!6`NQ0VYHym;Y5lzjWA4#vV7XaZ6gFlIQsS*kRPTcL=Fz?mutC2( zWdLCx5GM5MX7HHZYEZvsWv!*>>>Z-PCk1P1IG)nl>%UILPR>>y^Qv30Y5=mirohJW z3HBi)q<;4vvk2pB9j$rd^4QA6#2T}p#*BQ6n$cy4#@&eO+VNrfA0SM-aoo(N!uQ(^Ht_<;lELCqP5qm(tBl^Kip zdO|GQRuL%(r5(BpFnsepbn?_g95Cz+%;3>`f!ZV7xx?yTAz<-}T|jvKjbA*z?h^05 zbZsOTM(B9uSQa<^aQ)U##}}ZZmDG)KFh2;+W1))s{uyoY`+i%0T$E%khI=Q5M}o38 zy9N;6I&tP{m{fed1)AV_l*reqVPO{aT~j&+=_OG{{aZIcnU$B!zn#%n@iG9|QrFCy z4Tc!%dOBbZ==~EgXdky{GO#B#5r}xs+weVMOjBSLNb#~coiYW6{(0o3swFb*6Y8s{ zfLZ#dw}Y~jj-nm=PSYgM&+F|+Iv%_A8kSV=f(IoU^4K%TOWKpmrzjt^yT@4nzA0Wm z)T{>FOW}07cI(83#hf`qr7u4vj)PW%cXNko#q{6s8f+O}MNFl;vh;q-&j?AQE`8}V zpWhcheQc+)-$#b{18jxwJdVOio6k$T{Qt-}z%U^A z1a<_b-gzG0R$caDvk`tzEC(y!!D`}l8VX1k-=j!`7l9R2$=g(5OzkGz0(!vuz zP{;nCewO=~F+h7DfjIdvbykY~sh>b)1Q88+#KK$OqmY%ek<+Fgq3(NpTdK!fcmF+! ztUo#)Tub`(@mjNyqQ|!)0>lp*ah>tnpdk7QSa1ge-C6VnkI&8i_IT~Ph|$MCB0v7o zP^9GXPFSn}?#uzJtrTDchvIP_(?1;3^QF=+eoOm~&uJ%e@3z$Hi^g;Kb=(}(Xh0$bVO}!rlfJ(G&H3Iz z%Y$b#oSaO*ntFe_J6&;wn#B>{zYc5D z$$CF74$iSN&&tZmRcPLjPP4nq&O~t-|NZ4f^F@<;=TiY(*mQpFX=`hfrf(8SN&ZkV z-DuPs8yJX0Bw}E&a(A)#uv;-GCnE!jvxt8hbcO~720{x}*SOIkIM|PeC$06fFJ{@> z9jlgTQ?7MK`o6@Pn4H|8PbRJ~=tOO{6!`S7g&g2y_s$hiuG9XZ`sr0i2(C*&7PhR6 z%toyRZ&{)r;?OJYeD} zL`FsyeQ+ko)X~wA;&DFhwqIwmKUXI#EZiAJIOrtOzR`5Ca8tp5QvvP~@P*C)`?ie} zMgk~KM`tG*9!K~AMId$yJ>>cKNBc_z?gZ=FnTIbgFF_ZM@t^+_mapOTEw@aIL?8Wd zaB+K`5Fje1;4C@_dL)C+RgvBPcUx;EBU!ocFN3Xpzmrz9H0Sf=v8!>i;CvPO*C8f8 zJ_4_A(&LMK*S{VjR5arFURCq=3&~JmoDe$y&AB=`!GHeM@KJ5Dz(MkUew>Tp{GqbX zUbNhDg&jd4<=-Ehj{o3(AnT>6!}iWvk-K5;@JCH)@U3EvFD)eP`y;Z-%G}1)cdQe< zceY|Oz4a4B02)K_{88RGCr3tUEYXR^hgVuk z6~zzVjEWj2zs5)a5y1R61P0FTfpgdpDX7LWfbHNDFZn-iE&T}_czSto=A`eRh~1Gh zTs!Q*Q2+bfbt|t?zPnjbp$4Y|0s?{op#72mPtfP%b|1j(a;@)UE zT@J(w1qy}2x`p(=W6?*bY^ZV2y!V&?PNzBZ`^KWz225%c{*P<^#}whfj=3c7F!1o!=^eehZ8caAxgIBhsoZL| z+T9<3W+p#yx*7QVQ!MZWKnH-%-OuD}v>;ohxB#_`yF3R1pns0OU z&eypEo!NM9H-MIZz5Q!Km|NfTaMD8m!^vKh?!PAr+K>A6_1$XHO5A~`NpB6^y?8U+ z6NRD2LH>%4^<#N^cGPhb;^?3Lzl5_E#V6?y^LB{Kx%c!R1^{V{X zi|!!$6sJ1t;9v>DUJLVWHcRz#E3I!I`t;@-r*72dCFyP_v}{6roJ7pJ_tv#+3h7Jp zcrLns9{4yi+b9{OO+hmol{ zVtG#cnTu=w``cy00TT}`$nm3%_z2(7r~|qZ$Ypz@YdhLA)b<>;>=#ka({D>lWnOMg z)|s@^u~Vr$L>(_|?)0|JA2!kp{NT+rKRREo_!HEx-7KcA^KfEOQBmFZE?U-|RlBaW zk=7)!^PjXXKJ0~+x^u?n)!$VdI~%Ln<`n0FqylhFZ7S7@;@v%A$U{Wv#&gvEx6vdI_?(7`!xpTO^+89kOy&6<>DbKoIPYflzJp_BbTvY?W$BX|N5NI1CTLdb-*`(kwC^Gm1>HDA)B9X|rhh&WE zIB`$#a*rp9IN2Nog7ZmIL{Q}w$15F&+p~CV4`l?R^`Zfm^hR@zY#Mu&~6VU3JV)s8RvG8+AN z`isIG`R8r9^4|kqDH^{$VIze`mkIXGe#m*cER$Pc?V>M|y!G}C$#PB%j<>&T19eS& zXz4DF#<2j-4#Dk(XMYWa-j&_%WRn{cDvH39blB|Dp7=B}vzv!AH2zCH_LAF^@#E+f@fUgzovC_+ z4^$xtPu|iznz)2w&s>f-=z9BDaWz4`vm~Rv!TLvXiZ`Z6qR_E`HUIYM5dBlxqqTbp zS%zj65fL8~N_XcOEWJJepc+&#JGF1AFXKkw>N9QAqxikXd$fpKg*4 z*LKplT1J|C4w?eZw&ZdB65b!f1>hx;Vd|B#+Iv`Dc$kYtSnS2g1B#^;J2nsJHa2s$ z5eF2I)h93&g81ZZp|j#^P#2f$&Xp5cWUt8sliw^Xu?Y6709by58!1iw(U7El!4B#8 z{rfko#l$K%I*|`HE^c9=bbYSV`RPsPzx_Y{_Q^-$HsJ~U!^zR1G1O|VJShV2!w&?6 zaBy;}j_RU6T-<;qwr5qNT;FjN^dA*Yf$Qlv0WUAFrK}#I?_2rms$|^|rcO5)yi(vo zCE%Hwp9d&FXds36ru8NLsw*{Et_zmWYk-=kW5f4Bj|N#lGQYIc>;7uv1Ror?etL1S z!2-=8d)I{zn*@mIO;OGNR@;?_L)rfOX;lgRDtRkQCCUCGL4{pkGu_?_#V-#P!Bxh}42=6>$&`~7^^ z`+1%(&T(ZHsIp*=r_SeFHA;W$#xu3P^QQy_Emts5SEis%m~)>_gO6cmb0nX9YZ z+}w_`hY3~-Q*DX@CGXS_1}&bKx$+wFCOc971VevR(=l`H(244(5Y8hTWkswKtu zXUG~G#2_yU$yM70qpOdc${Wii#(4(V3z8@P&V_D)1#hy7Gsda#WPqobQQ*xv^}@S# zcXX%5Tgxl#py9goO0ysR=tapS#ZO$Z+pBG{dOcP6q=3+s&PSA2F$qSuQoxOU;CXj8 zdww|7IfEI(@l!hrt#aYvqx+N^okCh)sX&i{Ao9hDGxrh}Hd(05m4d$<_^X+5BoPuns5ahcPS}2(RR{k5 zDt$WJCsu9ZLzlw2<7rhs@art_qHYY1u*}EAy2_H8pz^*d1JvzL9M-9b(q7+V?(_Au zk9Mg7ex;jF^jjlVE`UId)GEk+#>46!p$?RNny>Z_(MIbX>?lKl&SAIg$)yN1j}BvI zCSa*kskkm^)aCtSh1q~f`KCdJ4{V^NDO+13iiC@!Qs^Awj%Cb9h&J_}5hvkA^j@dNKMM&X-!TpgE-I zh4(TZXx#elq<*UEu(K;PF=h@cG|)>C;1=9!`Oy@A$uEokfSzP=Eg9zC5vmR_d1R-| zxyEy_6BtYu>H_<`QziGvYfz~aCg9-fyPE2hc@Uv>T&tTxv79~{W_%Q^OQo+ETR(U% z$8!%L({)4OZu)`fYmV47Pr)zsm)qqO!%Q?mU8ZS$?Ku8a42BEQ{3QUml|g}lxff6I z^B+cVl2##>biKNHUXl1hPQx2i358)Ef{(qu{lkZ1$g`*4-D4Y3CS47)dM2NZ28#OSi;YboH@n)mv5`BPt48D0WRLoR6SXfl!3?NMYDqC zki3m9e}E`|+KhvnzhBk6EDPwEIUYD1F6Gr{inRg}pOdEPu965tNX`7cQ&9a3R3j7? z_6Jm?7iRk&s=phZJKbwt=eH<2QzWx8OvqbcT-X|}rZ0pl*RBm!#KMO>0+zh}ZWz9Q z(e-?5+SCEdjoJ!{Vw8Rm3dD4<$C5+0lw__OE)zpnrgB_&rRjhP{&P&`Ttl*G@6)%} zX*8)f^5}j1tZ8>}^Uf0khuwe$u+Pxq`;U8Ui!W`+P>U(`3tbj|b=clWccIOEzemz& zB4xWPAGfb?tGqk3c6}Awu;j#?uU@KZGquiITjY_htHLrf)q}^FiuH=w_jlxAv^nc- z)>^Wk1kQSmH589}uRCE8KF~}xk=E)8{81`pLH-l7h{mCe@KbqAIm6>;#2e%`R{>V_ zW@eo>R*54RyysGB5TpM`QP?De2j{p)>?y44J6{wa!m68Vb6#kJP6LSeUq0LlD0klH)R4w)BxCO!>ws6D3dCs(QrpuZ3W z*4Lf{6?eQuEw11qP(Q6X7=&@Wun^Hba4c$ih#HrPQVE<)jV(EL06eh^%a(3ey;bBi zBsG5&T`3XEH^RErYx=03MK6};JZ*WD^i;nQTx16a5fTD{ApUV=|Ecp(V&|XW?}L;_ z`6^?0h)gE;^ceO3(jaaIF$UAB;Y_EWNm4k*;O6MZ;wvMe7F5Rdl5z3~!O+_JUU}rZ zVH{v=y#+2f&}nhp@Hm0Z81f4Z{K^qD(jb_>#|=VJSlr5YquX%sFVCWWDW8enUW((P zpq6ELc(((bsfftcVdJWpf>l8jGj52;Y8B4IGUx<9>ji?VH2(p8u)Y4{+`&Kk@|pG6 z*;N|#h?XIB*di%Z(^qr=XN;a^0C@I)^{}|)AFkz8mv$UqW!+*e#6FW zagH9$1VZezK1eJzE)mtCOiqNf{WE?Qr1RG}fvD@b`T6-iT^oyEg?JFV%T7V#ISt|- zQ9&x`cujO{l@GmdA!H#4=!L<|DM0B7q@Q1;^scZZ8xX{v5q)`6k{uDx@|^_5o%N-P zmy3niKlH3Ou1Dq`Z)9Wya*z;^Age_Z1a8^e{CrK*?j(?n z%YXa!n(40h$G|4DxhU11!m0WZrMa;fwUEFE56&WaHHM)2>gE`cHdm)^Inoj6y1e_j z6v-1(dsZNWYn~?3cFVq7?v5zb zm2?p+5tHron)O}AXxVQ36m-P%}8j^1=ICnslOVj@_$`75yS|6*=?{z;_{ z3WaiIp$^cY%MY*=B9Srd9W)8BN5{&5L;bJD>3`wZz)|qFu`upSa5%;Q5UHuAAEfAj z755PZ0(I%WTq?hS02g8(o%W;Y*`7Un!0P&v4}w#q&P&S5VxoRkuH;f+W5Y{#n^{A< z?&%;Bvs8Qluu5w6lBE$fNHJhvRUi|PW(UCS@9*#FDT_So_E&j%Ip_;@lz}>WXQ=qN zpipW+lrliR(7?bT0yObKO~;l`5N?o5#P#=ie;^80v&nd5M)c8bksH`8_$DXWxKkklec2 zPSSy7$5=PN2jpeVt&Y(eE_uppe1$k_qSNlG+u7O4#l@9s3&UK6MvnyxKds~eywN^6 zINbf38gf6x#Rp`p^^RDIJ8JTiuBzf?isW$ zoJsL^?60V^ms1AG+nPf*E6`d3^Ll1RM@PfM!%5+!{Q$LCMC}RCh~8<$D0@44ct|68 z-^T(%Sv8>GkOu>)J0Co9CZS*RH4qbdW#yAKhq51l`5W6Hxl&XFBMjd5{Z`+4faD7e z#M{x?iP>S*`(mU@$ky88`uaK`6&JMgq{_0gKUGyrXbP_7)zz0TU3#UPca3lNcgTp4=;f{pbJ4C3PAB1)ff12_dtcBBFTxN ziZR{YhVRC+cP>{p1@Q5r=}wFHTXtostN*4|2Iv6H<|PG%JetC3nJZJ&@!H>J#84dl z>%GM_ogIYyMp`tWpiO1Zue2Xv^DBwZlFk8qr4JVx2qI97hAS?`ZiKl)v|Qe4|soZ5d?$1<1EI zakIT{Fl+LIbz8&T14#S}+{x{FVpdSN!rP$<4RU5v)CJywglOtsN$<*Dle+p|YVAo6 zwSG51%rhyUv^QQ~jLwZJoT)HP;3GPOrmQiT<7e$BW68PT_if=w@6+|{;i#eoihdWo zE}}7m-+#^WxR&8U3-Ur@t9_TChl~5WGogvs>Bubo!;FD~ZhxC+0A?ECJcxP2@VM5L z^cSNWYCPJ!vMN~tfy{+g_W@SRYXWE?#H&>V3Fx_ttm~)C!xIS6-S|jT`MUdSzeed_ zRaSOSGSWsyMheVL)Pk$pdgmG}E6T@)o_({vx_xX)&;#8>n+SX9VI~h0!2wYr@7Ls! zi>ykubhnD8w{v+jg>HAHTbpa+2^p>Sax#8yB#Tytos5%QviF|lXYqPBXQVXAzbf~JDS(h8EbP~PWkuf%J;kixI^e@_uHssfY4@d~SzOOE`;l$q0q^+wldKy0G^W(7GNnMb%Df8LHOVYsUpK z)e}PAokvaNTl1X|*Eal6MaZ+zRk>n{Nig5os3^YGzNw5R;Btq|X1ervGN>jaNp772 zx!j@dZw8NqpvO2PZ*n7jcuxg7kgp^QG<@N(lTl=}pdwVPUhnxxb)M_55cRFBSk zmV9?EtXjyx8)loak1MqlN;Q8?Xae^dFH4JRg447w4!si_EaQh3C{7(LPFbkve#`9E z_MNhlm`tNA)6MQ$buq^=7}5RAdwZMArl!1k{J1PjD4iXxk%xA@StjHiybvmwceaG2 zUxX}^_2rfq6%t>76E>c-26IaeX?kVXt$~SFKEK&e?|(z5kgifMuirr|JzvsMzT(g@ zhg@ydA)+bJd4>ijmcgapMcZ` z)m{e~hmiE5)$$@&>rO&ftg*#?PfT)2n*uiQAFg#)G}Ak(se}8BrE1H{7t`JG^gAr+ zRKXdk5WCT(JRz&m?Wdj11#++>CIeoyV9vL~kug|WlEl>JALQZL8bA9QQcbmO;IEF> zV^eL^;{s|Hr>?e*n0&ij^0Phx{T;un{bQ0Fo+T_y$kXnWu8NC~Nj4aQ2m7uNUD~+J zl3QeY2$pv@8Ftq3eCD?_h1|aQSoK_Wjfof2Hmv*t3RR}pMjy+hOBArZ$}zqC5s1517)fZn542I z8#Y;~!FpJ5q9D?a_SPw4gtxU@c+1QO_eq>Yx6?A`{2hLc;lJ^c^By)l4g}(9`3Isi z)~J-U=%Tz{Fz`m=J3qa*vM!UwOO8%{zKc(O%v^B(o}xCMkqRrWJ8bMxb;B>kea5)z zPr-s)z&1UV;Ql)K&8n5k#;>gpo^ExUEE=$@zWU*lHm1nF@!R6!wYyzeR(*swle1#vZ>Qp~mVQlZczjXS72j6j zoGlJ*OeQN*#;U}uHQl;Y)u-I84zJTTei!9jRq{Ui9-8=|eA>#=0uwy`!M1!LWTFSv zYt$byN9*vCxN9os{cCZ~|G`2FIhqe^vM6D`!r^K@qoTyl4yWF6SndjyEnmEkcMC@j zAik42`~Kcam`_k3tuJ$ZKLc#rC{1`0@7N{KuK-m zSU5hY+bmd;$luawKhF+y3wJpyk+sIS-l|I17M$;V^jw5C(Rgaog6}-Xp<}Lg0_85e zS@3QL4y-AwN!Q0}YEtl$cvP}+eQFC2JF=xsq;kJFBln9(74NG|3$6V!!5?;ihit4= z_6tOATTW$gUv%!I^e1@ms+ZblnrQ{&m{nPhNtM2o}sq3 z=frt7^Q1~ii@{x;6X)!nDjtWu+sdgo+Hus1AeA=1~>kS z28YoxQ%Rf6E7sEPTqBL0CYp=wQE&ue0Oc88Z?jHdoZPZ+IM`n%3Ap0CuQ{RxJ@7UK zolYs6{W;J-{_yp7dunogNbc;W9F0e*sCTK_|6E>k-{o+Mjdd_KR$Wqj)0uKgAf=es zdi7H7tO={hC8&t5qO_R3zCQfn!W>^i`u!oz*Qb2Xqol+esLm6P#W`)Ss}B+L#06Jw zYWjSd{AWY}!?;aOXa?;U9g8>KZ=UvVvs55Ncn$onf0NexfAk@MH?yTKSge~GeZ^x8 QECQyZWpKUpn$6Sy091$)5C8xG literal 96200 zcmZ_$bzD?y_dbqO0wOIU0s`WQNH+)wf~17Bba!`1gVKVG($dn>B_Le~hZK-*0cj8s zk@~Ljd4GQY{pR(Y^Bni=nc4f^>t5?x*L5u;Rg`6k2&f4#FffSZ<)qXwFt98!Ffg_8 zapA~G4c8a=zpKu2I&K&k#9iorFcVmbY2YB9yS$P#-r^M;JVs2pAAJJ<4oPdfOL(|j zJGo*MmG#TPAwqXJBxT`d=4#{YZsX*LasBF@yKtNUef)`&vyZEdm9;y@N0NSFI7@Xl5AJL*oB?p`LY78nN3m*~^4{rhqoH#2(^IMo%SzO5z> z4&$Q_KR0o8v~je;XroyRhhupE`@Dy%nFYqtW$4!bJMD>+gM)>mJI3$+#8x4cqAs47IXT{ob#qcX5uXhoJIZBEC>HH<89(Y|?{-l`TF5-5^+_;|WR#Yly@$lQ z$<`&Tja$8^us3&%dFhzTjd3*yLCth*#Tg6F%^d(t+ zAOnST<@b3hHoYmoel|hlsV|mhT2t)4|Nd0*uuf9!r^rW1A=;k){utHz1uoj&rO{{N z{JJqjE~md8xCqT^sJ56WqfJaq+O4_25e*$u(bI=B;LAi;Ia*p;z8P9K8TOh9>sxh= zkjY*2nYUK`_KG%~F58~|j{kc}#tm3wvazvIs!~Xwn!(kW z983i>;J^7kP5FR`Cb?*I-tLAw>m7M=<|rQB7!Nb8264_hBx;rG(WBR{4fcN)6%#E; zaZH4bNIi`0Wc0X81_$)T2a4UKRT)rK8`EypUx-AL)34)T*3Y~yE8`d&8=IY&C!|Rp z=wkSm0+1V-Nycjf+^D%8{$;92ut8>-$7WEe1d(zQ5}uzOwbaYK*C zPqZYF2n6}nPjim&>s0K6jj)8qI+U+pzs{$A??M}{!E&X1!j2`KH7Z0hJ4lf!bZ}5P zw_E2X5@F)*P9fs8`*Ogt>`K$dhRx*8Z=&NTedgp#&QwjFJ0YVRpVuoB<5FIAQ$F^{ zns4$dAIZ^1zeKUh^czBggE76E=Y8p{GKOfbMGtW$I;FgV*A?T3mwIs0#~7^rDlAns zh6flD7<|%g%4A$a%VluF6qmhmeh)YIjBs@hGbs+HXVV-!KM0X5n`sTPCv7=KAvw(X zH8)f#Osc083*00~AFIAA@(T-+#xoc{3CtB&(J z^sw^%B|F4@;vLqXY-j}& z11CU44fnq8LOmrVB?+Dzy9)X#+LKCSGVzKIDrvnblgoabVt%G^HAt#|Zq z$>k*ev%mRT)KNx<*3m7PFKH&`6~s$dMewa&7YvN>PLp@|G?IxH6>Qh)XB=vnx57-Q zglLIJA2t?WNLmt55wQIYai+zC^MqxeXRJ%8zT2Q}lvaJohGG@Ixe(>{Nf@=5;wab{ z5=a$9)csJjj%d=biTm^~y|3MV?zIPeFC4PuurP04jq~^SQ1pnJj~LWRl+IHd8C0jZ zLLB}?;rm5lXaPY;kZS{B=Fsuu-;DTJkXtslwp5uZ9*^?T65}EJ5Y#j@^o{Iast8pn zCO){yBi}sDV~{6@lZc$6rBq)cUdw4!;n&WBN(+-_~b z9A;BUj_+d2BBihro_4zrUc!!_viFo;zl>fY_{}Hm4$tO?le_V=Tx{i;9$|uTBJaAH zXd~hqF18gxB>Ak#1LaPK!EC7i%z2m-o^A<0Ln0KFm6wlOFCPUQl^87z2rhI@Ra7ON%zz7I%qw~$@ zpS%wktESlI{SKA52oF^T@g{Pew*weJ|`m(E6vF^UZ)IeIwhJget|m zr}w&6TuNisPh`Jkww(W-5%T}*KHgKw`n+th=QYjNvWxpZF=NsRJ&Zcm!P-pna29k3=7kWx}o8Yd*< ze2^@6&HC5$u-c(@>gV3+_ud~JxCg#8tyr9`8)FXr_O7U(YRF$zipm)t8>`tpMIs^- z6Ddh?f}?M8N|NG;UY;E~3(@|s9>Kyv{-uk5P$#i=YF4cX2Z^XPGuM$R z(g3-!hW*@~Rg=QQ+fLR8*itODD0Nix58q168&EqPb#b z2lB_CgSfz$J->C4A3uHsp;jdu^l{-`Z&7FAbOw2~H2KPzoh)VoA|j$cTdfy%4l-dY zLhn!(!+fRZ*~|nv%(m6`VwogWY)?pWB69FE)=lbXmJYlz&P=|+1{(YJtz*?y0*P?A zSv9d$N)YLMuq^%S*RREBqccY9)G!8oC;-Ia*q%+d^VF`=_O`DaSPQc!q2LD-o?d~w z%6G^nV)on_KMA-cOb$Sl#WK4xy#kR6L*W`V= zQ-6>Yc#;HVM^}g_(ZXYh1I6=Yl?Qgn#MTw1(M2I;k&GPXVZPUe4H z(bo2}lz)zhVe*-csDN#dHFf+W?en^?sCU)q>pH#eIxpDTpzE#@JjujF* zRxpNghG=Aay9DB`ynci06}YpyI?B+{P-e<#2%7ehT-lP0Xa@Z6hd%Eg`BHLz-p9g` zXj?@ksj^Yl2G87V*}pQm<2l>lh8Hh~0}spJ-{0EazN;WJpm>0B%3gq0*c~4LKyqeg z@9;3`&l6G4-PuTkCQlPfOBtH~c4r%|KYH|N+I4kymKJh0Iu^siaG~_+B$Bh10`kc4XY#crC50+FfWfe0Lw>U}5g~+>mZ> za9bzE$AKKtekl5TcP=_3gRXyIUfb_PBU>uo5jsMn;00eUH&~)@yJ6)tsZOtSlbveYg$m zw1Kdd-nh_w8^|E&g*@@2!y~4B92h9>IQt0`-kodmS~)*n2!|^#(ty3xv(yQK^9z zpY88m4x=g_>=1@C&P&ZJk;s?zG71rt(r0^kcKh8Ng4<(j?gSh(!I$fOqyd6zk{Qi` z>FVcXg4BUZsuT|2o=B78z@paF)MRP1*@mW$jHv3j1{kDio-T%xK;Q#bb@}_t1`>Uj zDfb^gv9a;-CBfDcB3QM?rY64|QsA6Okhf3mH`I5lO`qw7`WkE(yP8E}G_Q)Nj&-vp#W^y*euUx$!AKR<_ZEa*7f1{nW^uP?W_ zc%0k%;GGo3<#ez45z8I1zd!EA#KtmGMlXHMQy`TlgRHkcm>xP{`Q-WYBmp<7=x$g( zl7i95II+L@P`(cj50lf_3TUAUx!&?`_*4?(SVlo>R+^Hy5g zUuRADl7I9hjHn+9B2UV{b_a@gK)^hN7A!Eog_RyNh2lf1M8wrT^RMo~g2B?ghG8a( z6G1$Lp{CgwiP!h%rEWR!^R+x&d{XLmm?lgky_n{E_KCFR60Z;n_^K<(j+y3bf`x^J zIP?~|yf}wc4bO#7X(h!fqrG}aEZSR?ILxHxo-_uOEGQ`$N~4fGMTbJyefR_gJNJ&w zPJizR7aWQchTXjSN)o+C;ZY337EvpDiQcB^%I=!v<_=q}MyXvXo$;pVPc_EJ(g3eEmb6Z>K z=jP_1a0)ujzl4>VX!*?#Nj57#9~T;(LJbypOCXI%AWdmKddpd8@%VIPb~XlblM2PF zyRxy1TSk|{t_`%))6>r1|0CO;ti)b88T8`f=FWDg5r!-G+?jp_J4E#S*C?dx&dBTc zwFt|0T^sg0u5lW}gZ17lDyW&N%g<*T<|E2jU-E2%gbHv0Vx!h#_3z&oknZef>WCm8 zmz5DedvrwcdwVMMk?(H^H^@|gyD*gt)b+lwC7~Gbu^`j5MRT@9K%Rrb3J3u{4Y@EP zCjuLfc(JmV4t)VNtMX|B`Rvc9cRb&V`j9s_H+yg7B|(8vDbg4oAJ1cV3zI~rTRDX3 zm#gR&)laPT!7-2hgX-Ga@j^XuQb_Nx!vz2dj?B#1)!@_Qw6x3vsKHShwRUn6gySaP z{%#zfVqyp~vTZ)1Ag-mZ-%7(6zWw3guQ8p`l*e8Wl0rJWvhpAsl@&n2W+28Wug02W zaqH;lXtK$R6EZ23sG;@F)-zOVRzU$Clm_Pp$|TdIq5q2D>BCL!&?$KRD7u6S59NI$ z4oWgC7#YDUhA75a$76qS>Tw+j;{$A+^w(OMOT*buQWqwk9zS2bE=?A~0NWkf%eK8^ zK!9e(#^`zr@uN3Vt~s8P!|dENH%&-CbeL+$k`U!6Tk%&>!OI1SXjsP3hkSV#Dkp48 zpa|B*FCWI<7744X6W9^nbS;kh>$@SMvicSw@4IeTeiQ27{)r#NHEjCzp-emp(&^aI zn}*()@P}Tz^5(E|0JhT&tW#f~?&Yf$S%=n%pH_=^;?esBJvZ{dv2eB~Sn0GNwhgIn z_2%d9DaBTAR4;G=%e=Be_uI_wtJ*nB1%$tT9KZ1XmbyIBotI1jPt8`goTIg<_vrU; zQ$Ii2K65oUeXj<6Kx+6nSOB8{lt<+R<=a%SMZ@#!*gD#j#Jw7lwfexIk(MPD$(7F#iAcuU}<}idj)Y#j%Zv!vz$$f(ylI{rXJcpUOJ8%0KD5Gt9Iq8EqS`(S0 zU_Ie-zIomk5EL|Xc1Gt&05^+1hBWBbhr|vRCIJbP<@tM8)^c*JUq~Mo@g=pYLOdj6Hok4 zJ4p;BJb**xJT-|*?b+c$(P-N;&WZ~4u14%0G5eqIW8!h*3Oq%pKZS4FM-Q!!wrpQ} z6;k)Bu*cZe!2vj-!jh6F08@1J^x~i9Ij;}ie%WaP7n$4Kd>gQAZf-6bYn7IEXFT#% zfx@c6^2%8#W@n~;Ygso>?EyR$K+1QLP$tI4kM)EdoSdM};m9MYZrzfAf(Iz#pznSr zv> zwb>X+@v~Z5=s1$D!G@}LTIl)nM@XOJW=7zJ4-h&4E74RDr0XP9c2UvQY!$gQ_N|?r z@m~eZ1RO>!A9n%<%z3;Ix^Duez|%=|S?M7Hh+0!yYXVskz&k+lnI*YVKFH*2Yin>H zgsJ(EilG%Q*m*bG8rZrPD8S2$4F^X?vb%3=ZEs6)Bz5-E2gU%X65O*W;p7(7flr7d(9h=mpZ3OP-o@_TeyNlHHDJFQ*IlaEpi9cl&+l;$9*pj0WR7~l;5+lPfhW3qxiR#C z;}xJMEh^M8pnT`MH=0vfDoHTZQ*RO*@(N#;xTN&2oedp|666v5-LyBxx$^eb3Kq-I zy3}lxtI+)J=ezoOT>U--ylSAcGyD@reEcUTC#^#2Ty485h=+S;&5zPL8LcU%dH ze<_*GPvXd$KtLYZbvMy^2R1*tIQI1O@ z<9zxjH=SlI?Zon52drpqYs-_joz|yo)nC^mS_s@-_mj004#D}f!o~AG0#6(p`;yA+ zdArVBdb?oATkPyhqpd|SX6lA$mbxLhoCZJNB;*8{Ibvj?r7IsN0XEm7ep z==c8j8a5;9XJf0wuyuUM+hbRaKKMzH4Hc48$lt(ft&jptucalfi0Ah3g*qt?^l}?t zv=gP-D4#$B7S#RN3jnc$gTpj8@Ie5aA@%E~r1mO$q&^R=0Z_A(EX9Z!-kCi^$_2O^ z_Ugca2zev}6`^gU2c|L93P^>Ge0bNdUxy+$QF=A*_3P}WCO!53{(eFTtTKgYZZWYk zh2QM*i3D7@Sb#UMU5Krl_K2nMiQq1rMf;=*-vQl;33JBet zyuT_GSD>kew3V6xJPseVw1PskR?nem$5Mr|7gP>-6A%&xr9*)>+a?leRjmUZoq=MG zInULMb$)-K`vA>NPwVa^>vP~m<+#&eL3e`{9Aqh8q(MLzCu_wDVaLzU-)J0h_wL;v zySv{uEUc~Z0m7t~Le~c^pUn$3iYtJJp(&miB$FmHGc(gg`i_tAQxMq1{s>`UNJ8C# zRkVPj0~aHf`OKGN{8yRU9iNm$DfTbkG0d9msdc<{ZYR8j(pQ)1z2qcA% zibw=-!=DWS`Gv3De5c5ys;74?Z2&ifp~k#lVJAnesBOvl2ahbY)CNCyR(lJ{c9Ih1 zkuM?P0utZ35FN@@VTR&ksNg+tC<^cq*4unph`8NYMPX8(C4oU6nW(NZ{&voBVo?43 z%sLepB3GUqx)P2gg=!-H{|bxmhcL8NeWbi$$R6FhBHU|H`w_mbJ2%<0-o*V^bLdW>9-i^ePXpOZ(vEHlvCpgMX~c%+U*0F#PNgSM>285q_R#TqP& zK6Js4A6v0ju|dVOJ7I!yFkm@)_CT{q-60bpZ_ab;lRgIktsSb^703$wBBau)sL`Tn z1D=#IHPxazq#~0?u=%*us%=v#Gl5#sJ1s#Cy*_iERAPkqj0KZhTfJ9{Lb8N+`qHJw#YmPx8ASJ~0c)^l{0uUP1|uKg`!r!ZeFXH3@mDNZ_uBtbD)9N zEm8QIb`18!{CwH?gVJ$LnvB(tdG@8mnKX}_ntv8r&@?Q_WO&v3I{Z4JOEetAT{i6f zDE*A4HhTQaw~q7gEej8~9$MxKw0t}KrncrR1Z*lWgepK?ne86Q`nM{S*M7F&*c%^g zTJTRqHGe(VYPx)CpDQ{f37w7Para7%u-YHXhC@};hov715@H)N2ltNr zj(s!j{5e@S>`$6>Q9gFH39B@?iAklFtO^S!wt)*n`Quw`%@uOW#s-~+y z<|mDpd5HV!ZhWp4+tb~xPbJoB9JJl}?|e`Xb;vP3qg(D#{$lO$WO#VE!t`lZUN3gy zVJljaf>(E9`%mtFsS&c{BqNmomjcK9c7tlb6O=b#$vX!!c+HJ*odx^C z*q@ef({q?d>)82}%6|k_jf3KNHH52nFv-!A_xff&Q#BC5f&*G?^t{*p_ljl@Imv$p zQqRAaSZ*?>eDbSqD~i|^xY4Y84ua%SIW?2AmXZbm{3Y8Mit8m7S`FjQ*DPypXnIzk z*plI3M&&53V-v77julp7Ph68AMfWRqcB9?H`bXZmi9ER@%=jV0Sc9oo#!rlhQf-;? z^Ye$leX|r^cXrpG7_XXIU~%Fr9|oC zY|bR`O}TMtdtLTV&vmmDc(ZWlJR0y=Vm#kA|%*w6c*IOE6Leiz;BbG;gguS`O0y3g)Zxiy-+DB(2I{w_zCO*d50RoMsY=1e$43Q{Gn5zj zE_lGa>E&7oav+1lC${(#IOVccK)--|LsIkc;oIv67gD!k3WM~2{)xgG6Ouo3$-HUU z+j&}+fVc_;kRu7@uJEWqpP05c8+Z)9!OON~jvtCl*l4La)9N3o51dS;!;Ao0YX-W^ z)s@`9z#v~QDjkS7V4UEo-EB=WNxh1Lm2bPR31kG&L1+;O=&ZCd9*k(QtCmyTwGuR{(Zy|ePGCnnm;xktu;a(;b(_XA-qM4^Fz(5* zR;QxTD+TTu!b}2rWPYt%_3lgmH#$`$1uRt04uvK+JAPBsNIDXX5$sfaWG*~L%Dpo` z`{9Rsd3X)e`v;y~#lZW`*ZDT;j*VQ^hpjpu%A_yRl7>BM;HbzLjogA>R%3AtXjG`Y zQQ6DeA2%@UU&Z;rO0K-SpT#S;V))h=A(1ukEO#7l7_q-{P3LUkK9;lC;v(A6fW`pRNe-?b z0;{m-6VQEm8K-yUeF}4K>qxNE&e76=!2JvViXbE6q>6&R;N9V7JPU<8_{PuPV$0Sw z?YC24pI~a-lP3pA_VeVdhtrgF%AT@FGLMtBN zr?i*BfIn$3@M&(B=qMAQ-`?j#;`tX_>|mwP%-oo0z2J9kn0<0o#3ZkF7{{w8{vG-k z&nEgprT3YcvQM6L`a4Wj+~S3{`02tO-czE6IY)KjoS7X@b>T*G9Lyw?MI$c0_Qy=i zQ)?_rysNDIf2(pBP;x&CYja2JMlHMLu&jSg4R2QmGYS6Aut)4am$lm;z@#_FxZDpQ zNU}=yFbHLcAR>9W<0&%hC*TaXt77yPO>QxWpZp(J9DncnJn zglQrXpMQQ~J$|1K*8mX*i574o^b?Rb{|tJy9Lo98$s_fv2UiY+SQ5T8?r{qUgiRRw z61lm#3D3P3@gfG!{j2AzfIZ&@y@{sh;*SM7e*NO(Ng*_Rv2hPg<)!mf~E94MkqVjWtGZhgOvexTE zdr#pRw*3duv7A}HwjW4Wp#?gj`+G?laMDFV9KwepE*sQxqcPQcEf=~8^4-2*Q~ftLXv!9gCU|5Z?L z+UQ*c!B_w`6Fxp1FbSok+}fURrUC7{^W<>-;GmbjbHg1?v!EG5AWy*Q1Y$%ec!@BE zaqs^V9rs1!uo|M;%B6=YQU}_5lgvoVj-|I!Nwy^29FZN%a=LKuxqGj zY06{la;6gx}D%Go3 zQCANI^8GP|H0Wx#fl8ZfaJvu5Z7}0e$*Z0XXtr>bU@Jm^0WS$M4zyTM#JbZ(ya1%W z1a=L;5PTR)i5aXHDB*B%pv+IU28u(^#9{auh=5mqVsWq{zzw3EYp>wrD{f zLJ`m)%{Keq?2V(BWsGlwuLU^n^8LSfS>5nD#p0YPhv2j2PxW~vluViM?@_;@n(H{qbF z&}M>oMJ7xP;0z62!X8i%EP=(~KXXclCE${QeVy<;u4aoiy8JtVfsWqKXFpNXNF4}M z&^ir$R&Su?KG6SGlZ<3Q%ARxVMXQ`3i87K$E{+wc0~ZcB2S|l_$GHwr4sc=X0WYjx zpbVrdkoZ6fx39X|pxg}0>us475-kWxNT3~FJUcl=?_qPD9u)pV#|` zhR|^cW*gzN0P&oWAJ}7rho+Nl_CU*2S6BaEHBS?C0{dCmC%1KCDocL_Hoahwg27LR zHVZ-In3{HgSqM&tf}8JlF|_I${knl|v4b#FPnDQ+``6;uxftK6{nqdEX=caNt`!Gm zA!c&khf6KJ3donx0TFRNVu?~aDuXBiWpjVlZOCMy#UH*5jS7T_VdwYMw;Zvf#eAT{ z|EUtQjUH&&iI&@j=jVxa61m~tOe-TGJ3)5Yo~eI!^JkC=)qoa-G%#Y`%aQl@e~mut z+&W@>+lQ8*fF??PUT)mO>(_9C)*X6(UL&ydzj%x}WJsE*ncL z;o!gyG&RuVXnEIOAljTK67Jt#;9ApMY)gxn=<%!@x~+x%i}nPBne593{*o1P|3M1w z60{u=JfV>Ipgb)tE#1Jw0T#aNV5Rq9$0?8o=oQ#~V0wv{12zTBl0a>1HDG{s0iBCM zScWW#4rXw36g4CO@AEVd3sN{}-OH>-Cj_yy4@1!P0g^5R733|n^w;J>3uPUYL9{w> z{l2m__Aa=-Ktb_ax@H9J5ETtgCnS{Ef{YggXay3gDc}uQ##oRo-90?AOG}Bs+c8;b z)*ID64-TmPZq5KQ(A2OyxjcYC1|p8q}>5{rk7)=)+;`==O*QQ9S9K5#YHfT?j|yGN_VQ z7EA?a2%Fhwa0Vft9sz@YSfTLGqfE4_M5S`z?X_cn0`50c)*l}$DIvA8xv;qZ{7&0c1 ziE!>>_f4a&^1yRDv;$YouW8Ti6pY;|XL}3$5H5>fe#Vv81y*Fh z?uCi$P>eb@JW#e2a41t$c-bu94CLYhWbX{hfQZ29v9 z;hpFxwzdw+VMcFbVp<`zeMyBv^N9OCiU$IRDr`gz3oBZO19mvT2bW(zR3QwWJ1D-j z(78qrWKI?l-+1s86w=|*(dtd6S1QbCtHas0m3SxbkZ853uVwv=D)?p&4i0XV0}}yD z#|3hivCDqCA`=-QE+z&fp7u;ogE}1RR|eBX03)QT2Lk%3)JE$f2>GvNMa%@|I)Pp%Rjw;cD-6l2L2XSKeEMZLqJJg%5Qy{mtaSAW}%H|C4(`|f0m>F)CZmlz8CYShP?X+Tz923r1iD6*2GrA5C5XU#{p~G{#u%o zB!#r->2~!rFI(-~ygCoCp?p62rYGdJOY5D{+twEJyG-+;rte$CRmjMlTji~>+1Ype zcI=EghXOC$&cI6h2>7SIxA)Nu2k1&Vi4b03Bswsk~s=6K~#=)wztMqVj_F`hE{ob)vpsH|07LwUV}uWS@K}hxO>U@ z@&B2-OHa&;9?F152_Y8Log7xh2EZIj>`u$(DLIaWuK+(H4k16?e*+tf7U9!B?C<_-*S zoRRzd-^@k91{OIq)liuJoCm10cUxBL{D&3J6nBll0*{r&c{(QENGs@)?!nS4gJXKy zsGJD!W5xAW=VX4>)fQvcp6=r?2-6YH(q)%jx8<(VvK4{eRXcG!q_7w}X0?|y&Y(eU z{XT=Lj?cmy;p9xnl%4VUu=K6*6@UcIRz@5b4-(cYOL!J{DfJkrAhq zM=EX%J7_fwII?ag?KGqHWdsm8{;?;~p1VGycN^97VX(?W!1++p- zhbIEt6IM8|=X_MgHMA@tp~S?*7$5J><ICF&>J|9Z z>Y*{~@lzX996jmSBU4Mg%1OU|d(On!G*o9rLhWGVt-5!&h{M^}FO}8+b>_QY#C4ly z`m6^Qj9yL62i+IUC-&AW(ntj0e5Lg>7+C;A<=WYvvykHGRW>3nNYILR1wl(Y40Lm= zwt0U!{t>76Fp!JtvsKw(X_wmiCAjoP|07DCH~~p7CN2)xlX=1NEog>=L8eYZ)#k6) zErWa9o@`8RIZv(6TD5L$d+vn_UVP$qTKK(s?&OBpR82?YmEX(%P}8+mC{VsS*#AE{ zr8M~AS~_}k2K^Gl1EJ`x#gvBK3QJTDFbcWdlcbgjGau`)*w()At$e7_S=Ac-olM3* z_hyRA?VPVgxHlq(cJ(*(%J*WusqUG!9MI&U4*@jEpvXxeWXTE8d7T#fjeqnZoft4A1F$ z67#}%97uh@a557>>4P7Pp|qHTW&qs=%}CV_+K&g%fH@N!tmsiLP{OFe`vFabSfFH5=H{4;m1<3t>fPF7z{oRVt>?ap&Nai`rqQ582^jJ7IEzL5{ zi_u#RH|L)XDF%@DdWJ7CU7S_-3XIbLqYA+b{vLj=>OZrtV2*=8UOZXPlr=DzEAEZV ziGWrYrq+O*2*o1_D8sY-pHA0Jjix}r%nn{9XNY^vBz>5vK&#GQ`M4L^*yseHkUn|x z1jtBe9)U$Dp=+uc)IPH8Yg1Hx$8vdBTDADy15{NRNaN151tK!Y4=nT`*m_uOzWAwz zBT>k*BBVTl@l(`j71idVuL-+Y^8#FC($DLV* z8Soo!e7_?wk5{VicSKFOt4 zZoN`^{j#LhJ=?s$uB`#j6IWRtvD23qR{GoNf@(NY;iDcu;|P)#hk>&zbI`Z(>Y5d} z9`71}pJeA4+{{tkIlIYVY-3qn_~erNbP7nf(Ff3P6c%^>`Tq8q`#NkAyNNQJR-cSs zm@n|?g~l0bt$~g}8k$M0S!mENv#ox@k|2p7A4z!Cxx`X12$EX*=n_l?V7QmQ`OfcA54oItSheNU0yODe38@#lMm`jmnCD-Q+YJ z)2wh7(jSjB_~b0%70ZARvsyX7^(dr)y3x{{g)cME5l;U$UJdNDHD9p^Q|1s5A3x?h zySiSMDPy+n?^l!=-g_$#Qudq=kROFrnQ`J5+677fh8#cm_QuP7C>{kG?DKEf5Tub( z?yqwZ^3cc#HqI&udxf1J5c4 zi3wgwCOE9QK16@bIoo(}4l~TeHoj<9gB=gQUA%koN>XB?3^r@CcmmutB;+|CVAdKv zU#$p%UnV^Oh6vdxM;|RfQp(BJoccT z>9_dlco9Ps-v)*QCW%f?d`e+<_`B;vgFvKmfrtMaAjS(uh0niK#dwRx!r~;rG@EAa zD8w_YqVU6{`aG~Jj%|B^1W~E2c-jVv8$59t;GZWala=v+0kpSQv=T?1n#8VXZF?ns z^G~$k77{8H$yZ_4aQKEY=V|ohjh8d_^V9bNxlmHmKP5A>d@~#jPlLPAn#2!Sdh`Nq zs&(`ba%f|ngR`^Bgr&~lB|4KI1HFiawp^pCbjMtwpO+_(r5BI&KmEO-MmG1^=Xw%{ z0hR=*kk3y9nDZ^Neo<1UDS-5_F6d~O0 z+bXrFM>Nja0rKKtO2WF23WY^ux@xgg!hoeOv+#XysnulvC8p$QZn zl2VSM7BPf;s@A$?NoMgv{;eH-1CE8L^Y!^=UraU*t4nCNVS)^%vU}b>6T2GTS!v2P zuH%|B)l)2iJiO4?!GhP>w{`i( z%OSL8DJsVwBs_(hrWxBrf_?O;7?rG`n%xrEFKJ8f_XCRKqQO@Fqo z1vYXAm@b}-nW}S`iD^8-UUC-V;^Hz!&smn2525EQpF9a2VYJ6j%?EOl7!7$q@R5nG zxC1m0C^OX?$2X+OV210;(4lTP@FSpE!3Y@;2QW_XJUs=5`GD9=d+_tgT~d51nCAo$ z*V@L08|Lf56AwHf7}e~+LDOSdjb8BSJ&>`j)3OtHfA|4a49EdJ#&Jt1cjL#8$r@jW z<`YRY3H=rtB_P>cVA2t!EW6c}m46O-$io|nD8L5%Fp&b36il=<%3;{*)&fTzdXEp+ z&e-yw><;)4Cd_hcYc<#D!5I(q8JbSQ&a1ANOa(3*Mwvc+5g!35?$5zWiRHwfk7ko? zAJvMId9v%+Q27ckO2Ct)xUtveGW#f3#!1s$r;I?uj*=>jdv%amg48{jL-2ZPKKd)c zU{>0{b+il}^6^|m7VcpHMT<)uwdT5IwHrS}(Jha`!?VPnt-2((EjkG>z%2PN(9W&|J)jFtHk7pQ(g!&7>s({pbuk> zhyGiVMn?28&B1|ICMj=TnZUhy|Eb%F;>uod4qz_Q`9kxW}+OQf-W z#2q>aVhi<5W$k>0kcZ~Zv&mmQr$JoNI|Bv){*7kPMdc)S^gdInGlcjr7Kr~h7YabU ze8Tsc0sIvbX%3Y;v)2Bf*4ylD__o4NzCMWh3ca4afcg#v1r8?EC*V!;3-MVH@-Tb` z-)7&(M^^&5ckOX2<$c?z9IzPIOXWSsv!sh#&qj61iQ}~fZ~_8UPapn)p*KkS$AJOE+hGnge#;Njm-ne7HW$KOoW7Sc)```1cZP-9Bk?l_B86p%811P)|GKO`UTb&J z2isslla&$Iwcq~t@pl=nA{ie%{b0>Lwrm}Fk2Nv-vf$dipZ%eaf3k8zkwd(4Z>4_137rQnIj&fk!M1jHp16o} zKa4~~XlN5qMZLbRzDy-`yZeQp!(IBEP3fQMj!{G$VdN`a?+{vja>4EGDvXcyl}#s7 z{^Os#b@3w*ZsLiP34&WfUm0mvVHO|b{q}m-D#Zydo{W6BAQ>Y212dm+JWg<>dBjU( ze%E(NX$!VnOhq3a@UA1(%+HFr9^6xEco_Ey$@qrgtrkHEX0 z$&Z6r6flF$Um6QXVQJ_RP(2I7&$~~eosfvtgS^wRLB)u*nkd>M_SfLP+`AOFTM94n z`zrfdxEpFO2XZnbbFUlmND1BUWl@TyktgMr$6c!;vc%z)Agy}J1$<@e!Vsv}K0ZFF z#)(7#l3-{@O-Cn1)8(A!w4mKMD=TYJ{dOZlUb1|`tWq1cxm&{) zi&d*yr1hpU;L9Q3CCtATPUm2q@h>%lFBsr8*uVt(1iKdme7LKK3ol z6w!bELpt6|R(a*wE1zO_UYCb`bPEqdHmF*ST6S{(-hTO&`{L84m~bcddjfYd<=&IS zO}vM8`NzA<`A3et^dQ?#*PkQ(B zB<)=}^XJw2Y3{PaJN83H^1qKw;!Uts1}x)~sb|3Zl7v!aIb{t?{w+TMppv$Fci zKiBz5Du;YyqvIviiu*4MeIkx!hK6t4lDyJlc*x*HlKI`$9VeaPXYJ;xx7iQGqe@ja zWPG{SZ0FV!c5l<%PrtMR%C|Y@X&*-3U&|X_T&!F^`Ybjk88|DOkoV@4KJws&+TswW5kTol0&>)>XLEdixPdg|V&fY?XqFcKaaRjE}oL zwqrb58XK=?`hY1^RQEHTPW(gB`F3qrS6ZbHIkYr;=At*2Qhqj3J&hUVxww<<9wS~j zDf8SsVl)^f^&KZr+k#d5~naS$9(Dfh7`h`g~Is4%WnJa((+?$r9!@5{v!(^K*_`y2hn zYSb5q@{g~g>>ZA4V-sR-4tI6I*#8?O68Q{aV|5*OC4fU#7Shr7aV?qh{mDh!tjT0l zdV@j)N}i?P=YvK{ldAlG51uM=YztqwRlPUI+lEU(Q^kQdx zADeq!YWu}?8hxUdt3pg8k7EZrWS(O$xznZ%zJvspYsannFjn2EGq1k7Z%$4_`HhqN z8>|0Js(r7jK2$DxkR+M=c3@W~=V=IJqlUkqaQQ znM9)hJL?Pb+0%Hkpil2}`oH%SRU1nTm%Dt@PS)!sAgTGn{r82VZ?H1uc}H}ONx zcbeN2ROz!zwhYO!YPSC$P2U|)b^nLmkVHcnWkk1Zk`<9ip~%QMO4(aPMum(@l9lXD zAqtU|WF?z}P^3b32qD=#*Z224&+B#nao^oJ&N<)D=RL0XbzSeK7hivwrk38nB(3y< zi@mt7RcX=m?D)xBZ#lBV{P9UY;@`VWT^`g}>Trxxe2Lm-PEw>-NKpxMa%Nk8M33jA zs*G2u%_%V6AIup+uc&m;UH<$N`+NuLJ$v6o4n+v2F~oYD+uQ8K-zawS(xnE;Z+fBH z^3O$fZf%hKsyF^JtzlS!=kYL;)0L5zDW8Ww9+_yA9R4)?GKKuBE=5esm~2v%`iNSa zO-h<(2lr0f#3G$Inwt}^hkuc4hB=SXMN>69W=kKnAz22e?k$fweKl4CI3c(+LksSF zyu1zH=nXd$G2S42A%FK$(eC%Oh7SoFwpP0a?2gB?3ar?b{@JbVwC2#u$8}ftt zXWE)*_k!pY-5g2cH;)Ml=cL-k7&sD_J3cvyjshKsm_vK2m`6=pQ^v2|`~IXR_0y6L z$Xv@y{PKjEb6_;?I^FX_DVlzLPYqbbq(Zmt;7paxnu~jxslp$1Cb#qGp?q5}?!jG` zbasy}kHm0Aitjp6+c>*#xjU&pU#d7XLq&2(;;Yr`Wc3VxrPM>aAKA#?Kggj&vheUo z0Qj7lnF&U!0!L^z4T+;!6z%))$jC9O_l^2bm9s31+hmh+DD|RB2=Q*>lcuI7+rcTr zcJ$>BjfGvceMMtFH*p>CkH5Vc@2e`lXs5t=pizavNi;UWnYLkW&dEjk@clE!eSLZ) z5~O}sU6l)OYF|OgY%c#uOgQJ3JB6K@~Rt-*rOY-YCJzUXbM6Kq*DTm z8b<`SU*6uG7>l+D%~{cz@$R|lPH{^x;l#y>_xH^>t=N%;2?BD=y`NT*4-dKtTKjz!m8HaRpR%*q>+sBQq*G(G#2>X&i5W) z2yIsuK0M@?v}nC=q4iF94oha{f!&k`J<>M6FPY;Jz+Wl1aqA3q6`5ZYF;40jq$;sD2V}&xKf# z=%w?si=t>+G0Lz~9CX!-I?-C3nTfyXA=@uge0>`44=7`Hq3M!GMO)cE16!SkZnpv( zlv)zD9CGOyQ471Te4N7~mS^`p!vn$-1-ZT5G>RmfT`rCyG8aNcO3QNWha?!8=Yno4 zh0`S@{EC}N*O$~GwKT2IRWjRuk&G#hP%SAbnP2$TMnU>K5Kb-SBKuG?+JH_mETLh; z*IPPamu3QMdcc8-K}kK$ykCmC(Qyq$g4x2`!#FiBT@oIfG*x+!^oy#({1_&kPIBcJNvx_1Y?4BC zKK~96mD|ck;^yGV8_(}Pbyag9<#?m@74A^oPm@Qwvs3F{*I#cKt**LZ&Z3%<#PCmr zo{?>*5Q~V6Oi@j)YZxUzbpbS+4< zdIgqhx_*qY#SBjH*URlbWfW3rpQgnpbjKiWL6St8UG~s_|95rG&JM5XB zs&dPf5ApyOn=43Ow^Q#13MnlujksBvWA!8?WN2|UccoOG{wd=#^Qc|aQr%mMxi#A| z6ZoUP3D|2j%Mu(}g;Zx6=FH5SUYv~=*(sK9U3=WTL7$&u`jmp6^vs*1B`0vdq1~SR z%GJ@B&qqV40HEk8Z?Lnl9A&NO(69W23&h02a_!ASdxprjH`&L0I?q{}&&gZGSNmpW z0wMveeQad;d+ZtxFQR##!~;^kaDEhi(h=D+$WxTb8Er9|NVte%s^*F*K-@d!Vk7nDL^ppJqx zWeybd9$;CJf}Xv27N_ym?rmGb6Fz)BUDq61#^YS1TY&IC|MWY7FS)Hg^yv8<{&(XG zD;m2SGQ9p4f5HTdJKU!Ap=SBZ)XxbQ8)Xh`1}hCE95|{`!{Fs;`CvMa^M#Zp&%`Fe)*yZ zvrJ=Q!p5h1;8R^Kjt)Sv|Coaj#cUiLtXy4V0EAnAw1l@5fY@a2;eGq|IZu4%QyX}m z$?sK}+?k=#+0(O2m0uOeY%5-$L?XqsSP~9xUa%y?Z@6_XpEE`^{hEZFLmZzoZ^YaN-O1=FopC-RJV(Wlm4#*K?|3Jor{nLhB5Zemi$IoP zCm|*)i>ZQ+uCA!Gv{cR{%{LNaogb?L)KA zx+h<~dR4+f`v#1np;_aC9#D=!M}&ukqjVx_0&N2WPhS-&wvf)Qu1B?|CbNUJ-;`Bp zp;$Qt;vz6~kj)bl6FV8e0^o%2dK%HDWCw)54Yt~?zk2D%giaP^S(V=kfM3|YCEAS!Q;zeze`yy zG?VVH$ZY5OClJlxL*b@-*sZIv|D&?6_IAhCCpApLX(d@Jb(gm1pE&szCHSe<+!G@6 z9`f`GQNt18y6LtyF46|Nb(DZ?3VLK5)^jrX0p-Ittn>T#i#9fVK(SKZzmMzdGko2O zlZnm~H-OMF0EEx$v9tU7=Kjr-Mx?Maj+-bsJ)eeZXIVpr^OVt_lLlEQ5a@ zAUWL0SGliS46Pli$9{PMK_-cim{&(o;(eUwNOvQjLfq)EhJT4wR1B0if{6Agk zu^-}9cET}rVxgwjf+N#BUdWzXdHhhQc|LbT_kOv-{%IrgQp%h#;jCxCZ}EdbE#KPr zHhp)fY%vQt4Ffr_n{dR~J^pOHR%|~~<4*@o^K{v~I(#@@WoBY{i&_9IXp^3N3-BaN zL}OilJ@+F%!0l2PPr&vNpLuR>F8#(?P%H^IC@{3}`Ssqr@L}dQ0^W9dSsANx81W;7 z-(XQKFLUtRT=Q{lO-<+xc0v?@kNd`XOg%0>etdlVd2w;{-RTlP_O+iof#>GI^my}UQ;vCVS6yZjxrQMK`4aBhUsxZ@u{Y+xbI~x z-`~yB-c!29*R(CDASxL7KR+J^cxf3Kei&H*RqmJB6 zq@-}*8-Z*i6@MEf$b7pVQG&`2IB&A+HB$b@h|z{GTwzcwNr8yA*n5ZFzBt}hrWKDR zxO(7c-`$xPm6geuP3C*8yMswbe0lH$%P1>LPz+>*riMU1%WMwj9+XrQ4kty*1lBYS z_MECYC2hmrc3kMap4vOhm;9^?3Orne8lmK{MvB8z2aPA|Y(}16dOSbY2Hh5}9;R!! z=7@4HGXuU{2jw;5oZnt}mpGneWj*a4VJ@od=qLioK}tbEINmKaH8roGU>g1dXeD}|jKEaPXsuPm`^S=~rdxnSl_tX<78$o5y=^ry<3>ZNvaLB8xtLw(@ zu+XamkS!5kpzh4Ln^Kwc0DgJjfv`pW=g*wn2SxKU-&FNJi{uGc#tmZ(-@SH~Wwc;n3W8e#%F)q5wCm?Vxw>veHKQj~G3;GQ_4t{?ADKWm< zoK8-J88r&88&1PxV{{?)U};?lgZnFZ0#Mg;M+!FoT5u;@&XZcGxx@Kv&HfD!50l*r z!W8^v&h0IEv@BNe^@c>Y<m{g(ox;XFFTf&A7!4^FprpSaLF&@ zRK6m}xcgC?gxA=1N*@!$mN)227zA`NrzHf07>M948x3qp$>f)kl0q)BWi?Awhv7EW zgJ-XU@l6fI?eLLD0LCRoWKQz@r-yH}h9I_rk!>#8-YybrDsX5wqG&^7V>>Ig=#6*n zZedfmSC4)78$G74B$0S29Z`R7K4a$|HSTc2Vn`z1?Qi>e9AJ1@?maB6fX53$19V5# z1Mmq$wtt=YR7}gu+gmR0N)XJVQRox7u-6_38@C--6gELsP&~nK`B1PDd=S8?+ir}Y zP1MC}LvkBO@q@uEl7qKPi_%`@3yMidNVKq6wx=lKBY3TT?>8;FYGZHD9jl7uiBOCy zCeHiuBk-)tK8()tR|)ByJZ>4qX97qKh1xh6O`^O z8)+>3X16vxOyMixPvRO4sqTLzOs_uQ((nGtk;(dffRcw0?T(j?Cw}fqlR80b)xxTp zA{KgsJ8-wC{JDbtH05oITcb|#U&!i|9N)co;ycP#rBuhhmDAywE!T_k%^MF0>AyR3 z>(&YGaQ_RODQ*hqQ#Da7U3+VXmf?@a=3fmQNH*^^M~GquZeBSxEH_(2M@XeS=HvSn zNF?|g+t}HeL*|3$g|V!Kg$0huJj7l}#PuRP6sfkMc7Zbd=d3F@4&W~E2GBDyc64{w z!$;VYuxvHzzAD2|tVPTCnQ!9{)3*19xyUzbV!cZW-a+aPVODWDi3&1Cmq<%}`{g#x zQt#?+eANk3wAg4HaNJlNlhw6q$|pB8P(cYsX9_Y5?)niqIrhqa4HR#)t_g@zP0h{9 z=zxQQtk*>0vSCw5O+&*cBs99vZA6ql$H9eq^;?N#HY{|Ke4mX_#LT1F;6>Lj$y zu+0u+JoeFC)Ny0Yjq%u3;0Qlqd3Pn443;f!xha3ef}aQzm7orWT&$Ige9bux{5-)L;j-d>z1{QM<< z+G`)p|IY>B+0LHw>`m2|KjQ}lg^{7qCh{ITW0~lgPp*2Vmxjb)Nakm9NYo7$s<&kf8U+=MJbSH z*ORYtn)U}HIVQ_E{m=RkormpYOZ*W8F4$4~f%!*-=;`;9IXkSlVIBe7!ZjKMFGA=w z|1E0s`U5@Q!$bFS_oSv--Q8%qwy`$*lH7K!+QY5raK?C7-r>3wQHMf5|8$)nmZ54S zOa6o&t8b;jzP^S0^FB#;lm)2!UwXP$#EV%8idX%X$YJm1j{z&e8Rl*Bw3b}QEBe?> z9qvTP=}(&LwXa<)(FO_kr1vzdU9VGT5~RWKtxl_`NJ7cR!X05y<{FCR!Q$j3%p6Q8 zykh8Ht-AvZ&?GIqpHpw;!3{*o8W9=U;y=$x%^~GZC?s#U)dt~2TRl)lP*NOy$I zIhKn}&$OB))c*x(ul^H`tUst4WG0Ii6on6QvV~wwl^>AH)hr6|v!G`!R!yjw`TiOB z&C8=OdBC}u#s9Z{E$#ETydS)Eke9E#?#iZ)4;?Vs;ZxO?eWv6KW@qR%K_qp)`0oje zKPsf%l-oi1lw8-F?-CP=wvGGHenMjW_Dpb7P`$aJd+4H&;@4gVt~L(G84iKv?sq5q zRS}j|E~+?8h#{$_4A!0Z%+1OwHKEDi4JfwLL~e-HrdaXarX1GL+#K(me13$YzW%sL zWYD~+`}kbF+ne+)@wMdFs#F5hPi;dRiY}xvM4Fb?C>n)Hp8A+AD3SkuxUS^S#w_kPWttm=mg>Hrm%ewOP6uMHGPpxi}(QEGYJ32}6P!-;0wvwtj{^&SC(9yhd z<=rzuCR8qHNcjZ>tQbB!yy%`S^X!Rb=SG)OwLj7b%s==U5AFYCSg-uNu1O{AqmDp<-O& zK1ci${ep+hoU>Iow<+E)vPc$8@VpxJ*f&5m>aktT*%{}p_n9y5r|#S#rb&O$}ZU-$4K_SZoB(Rm+Cj^zsaLO4nAixl#U^pd`gi9mO4nO#s7;eMR z<{B{YMm5yne2KP35-COeyq`M#AH|Nplv-()yL3*m$F%H_#C>jWpM53u0bLAwICKU2 ziv_ut@4_SXc5hpGFpNyh2dB%3L0yGKTM#FM*G-uZfv@G+uEqI$FFO)N`8VuCKF87K zfFPF@U>svn+nteriE9tlIf{M<71?^|ac5K6*R2hmg!ltKf?&0b+@#JQx$=1>UvU1L zZ7%FQD|Wb4N(w!~v@OFII&IXpt??&W%n2oO*B%4=OPHz=sUguMN8i9SMeuxm)|3hL4Qa-amOEr76J52l z+}yCh8X)qHxVZImQFMZc!|-^tkzb^wq&#{1cT7|mbjKagf2wDgq2@rkdzQ%$^VYaU zQxNGa3y_LoU*&wzu;@C2ZdN3|8k@9_Wo0tx26s{V;H5(2;{(+*N=-S4ZVEIg#3OXP zoRKO}rte452nHk%J+&j;lcDnh9*9brF|hWmgTrx1RuP%c7H#Ae z3!3lA5E(j5VY5)j)7okY z6)S2>)c$c9!}quEBvuokXes;m&6ZHb#kbVaX~^7f8#8N5It`Qp*MLyUo&k;q{R#N> zPW_&Xj$?^;Fs(UWxh6`uR9-KdYd9K06nCPSaR5UgbluCav229PxgH(>E{!Gl!bB^K znqg*hW5!JQ&{E%G#d%Z%z&(Ild(A9*g>YSj8>0p&3kwT*x2LY&Xk%hx8t^@6`0T|C zi16#T?~^&BsfoI1xvhw5ixJ)z!X`*)kwp0gE-{~*3?L-Lv#ys&B)SCIrJvhjT@H)@6{F_Ws{!4Ua3vs^c<8aw zqYt2ZLhnX+gNI$j+f-aP|R2Fnqakg@H#SiSzjJ5P*0$#J&|f zu;W3-oxh;0yz9Xc=)*0%=E9Q!k+z`_L8}O?NA4NWN4x}Dh5O&9Mj;|V`GKC5kZUh5 zFB8igvh_=}0u$D8d)t7A0&13mm4tw9_D_7vgn$R_2^0xZ@RbH)iouiAeqLD5!zBCi zg84X;hRKP?^k36yMEw;WKtI|!o^Vk6B7fvZAehD9$6Q1cE-1P>4|8tl{7SDEq2ZzT zx+O#&RiSAPR2x2|$Y~Pxi=S#6Ix=~?pJ3>A_y^U~2M0>9p!$Qa2tYJIH)`tYdo|?N z#cjK?pQooQ(JX!M>Z(KA0}2}68ihPK#WzREOu$JSTUu&|W-)eqh~g?yy|beOJ9vl- zj{l9iAJp#}(>&UcddJdUBC4^eYK9If@9JwfgNw?_s^g@h{YP&F^CUo20I=}j2#g8S zOZ3P8;~qRk5X#KN4>-Z#ehYde)RII;4-%W2Iz5UKif#9I95$E0blc7;PjGBVO(OJy zu(Wih;&Y>y5O>q0T$hN)nMM^2XeD>`DG(z-bzD3=evtx~p#yxSLmWLV9UTP(F614V z<>7Etxvj}^ZTS|>;(k8BhKSM~2jY3V8R49Rp{3hUu;ih`hez&UjTM?mv&Jwkba43G z8nVlraKtKG9*rkTejWbW5brfJ08`Ij2>eEY3rhl`UqXH$uq0$9yq6K2Q_>K zXqyeyb{#Rg?)0axR+vF(yWA;;;eB1wyv-#ia#IMj{dIW?{I#L4N6EYoSFO0uJrL-S zGmgu##yf_FNsKhvB_*-A*Ki4F`Sptze+QL0Mp|TCS+ve|WAp7D9cKj@kIKm<O2S_~H8(dTdHuH)sIaO3 zTZuvd`K%{z66-k7!s@-X>q%IVxn@vvOZqSu7gyXUT3f<(`G^OH+&Lw#r%yPX=hYVF z?04Nf|04EfPa`34qs=3c6wx9gu(WsB zPN9T|Z&A|LrbBWAL~6r4M!us*+DUHaeuf`rN+L3V1opz$j%IKUK^{<^p%a$OGDA04xvHGhjyi2nzx@ z@X;6yH0hzWLN*6Zeo0fa3f3=VBvC#=K?Qn6m=KX)X=k7@RE!$2r9J^OUzlNDds9Z* zdY{^PgMn47+%VThIUivcgBtsjazf6u&BM24p~D9P3>7Q@LyR=(_67z7ob*@{Mg;+w ze`|OsBfy)fsVN!wFJ&8+UoGG)(HFuT2mllshuxGux6e39C))jZx4)o=46O^o+&o5dCYBPJOd+zj&Hwio;<|HHd?;eS3NclyCeli z$GoVYGT}aS+}c75fB(W}zxMRv58_)Azp*YLB(#yMv61X{R`Y(Jzqp)~l)T%MCt7|_ zE}HRi4~p(hrK0}){+7;ryE0da3-{Gb&3yekw>#RusP5z0|6YuuPlsO-+C#%SAcZE? zlsIBg`8LAXc@%MD;@3-lW`?l z^osa}_QfnXP^bn+oMsbeJp6E|W{21}V~FViL=jcSAIwFGbxwx4-8ltUU!%eHotU^z z+-;y5NHKp;EH0nrX7oN_dDJB&D2T`^UAacyU;eO5G}inpV>slH&sX5h5&T_Hb5i1n zf9H-jzH#YwH@XIB1bC^*Zxe55k4$Eg*J5D;k%T> zPzoQ)(tVwRd5%?*o04rZZvehm)D775a5PbU9v(wD&GHyKB60z6$j1nXn5+|z0fGg> zq5wTHT&SKR3E(@+%*3Uvg$`vL=H;67fH+I==4ll}G0!OQSaw2}h)Nt7JCU$p_x%ou zlYp2l3u24=z2X7u5QCIACe)K+x8Tsky|1GzM>t^hXVNi6edNQx!gQ9!DFczo& zamodNRyY=WSS0=|4TYGAGea@}eA^3n8}N9*DXuc=1_p;iWag*G=g{ZT37dver|^>Y zcg)LP=+VZKz1ecRFCr2x_It|#dnED-@`g=bBji_6+~tRtUW)#0^vA zTOwD;ZO+Tpo94a2up=`o3vnmpwpKrCm%IOd%jb3%IE}pC7x$hP2y15Mb;~u>?Kqg? zcMT})Z@&zP+Bjs}M82%>*M48;$|(3ouF^@z@_7Rw<_tgNQK6|L2KukCawo23jq zs3EO`Cr%_?d^ycg$5LOv4#p=72n;-7!s-0(UgI9KiS$sZP%DX7WbTN@PMf?d!m+Bb zTRKg2D_FDzKf`zLu9U)A>?eV6rl$Jf-5?5MGVvkJSpU+cXKqn&_dp**IQu)6=p&#g zXnua&6dUv(=vR<%Z3~YZwP=n4^$7Q}-dbGUHmiT8dv4H@EQZs4JTr3+B}~V+Z%uGP z5qsUzL&Xqz2Grz|7Lj;rQ15>KHb-xRjZ{%cENmWsAh4Mtn=pJN72s-dwDBUUz?{l{-NUmKRk zVN=y?XYxh_(rTaQqJi4;r?0|oCRMe(j?n%jd@?{6`0s!}ERkAqxp$~aQ3H92 zNQ{--Qr~#iQ{`}6i8p_8`BQRA30dLwT`gzPNTazC?wxmq>R&lex~3le=xlrI@<{Rz zUh-|}>{qXdz76&!D03l9%DY0CO<`31h4F?@6<&=?d5~CJ1B!=Ulz*)$-Uhl_#z0^A z4KXt_7itrZGd`J_sOXd2Mwwb@1bKLNhBwyq!x_?+<~KI@KrTnYeeg!sm!>EDxkO{^E1>AZ{F5@Qlx6RSqY->>sU9b}Sg^@-gf zJgz9HAjei;F#3d+)P+J;6PsArhV-i3+9K>QPMEmbV6&0 zT{Uolk53j}FI8vwntpu?Y>Xt5U}NXg<~i-$sd^Os7W`z0`${kmkRq&39Hw~yGa!(O zh;cnk$9_#r4B{zYJxn6u3yMoGN1;f(=WEx}pLi;20%`b({tnX1Sj>?DQ(*@3UB7a% zdEgyj z?nVF%fY7QLt#m|RDYie1mn)rqfAMJFWsI0G0oS;@GqCn!+zH!5%*?Q$srdWiIKtZ< z*pLz(BBm8EOd-w>;kMImJq+BA=!`H#sQ6cui&Fi8U^99V91j%lmJ1VK;PXRdOoFL7 zCHVP8{2n#oiy55=Gzs{bsd`K{5D76o_tC|yxdgxoPV^3L|6~+-xM*jyh8CaP+|WNB zHTUAG9{Me`Dvus1lk)3_wsN16@c}KzhKBE+0Y(KQO7g zD00-F=fJM3Z3&NVELz`6X{Yi`Vq<2O^XeB#4hcLwm3_6GF}zX1_(xmJoreLL%&(_p zXQ&z#9)#sLRzX7fYvWHxnsiCJ?$8SZ>r>~SR4d!`n4h`aHX@WDv?#9q^;MMF=g-GF zbmlR$iAp_xCEsI5SBUr)v()OZ*JatvDSftTEOK2xcuZ-Hx2X)-`P0T}yKniV?;dM? zCO_<>yV&%iV*lKIW$-ue6Btd_a^6vUSY|#qU1DfWlB#{bhlNLqciU2ZStnK2IiK~V zvQ$B%lB)vq`qSKuA$d!w8-IiM9(@*e?awTwi0H|C?dBiGTX~{%{QYDu5~?F}#HLKG`Vt;XISMx)-I7 z{5=1}%uEIj8+;gP6i${Vh|0lkGjS`-a(up!a;m|8+(go~;`4`T6meD#t z(Xs>L-u#~%A=*6e^=|K$-aGwj0QCBo>Lk(ML(cvNW>JV6DjcDoC<;*O(FH4EC?yt3 zaA>&tSGtM`P6}8et}?P}r{Yw(dr%4xN#k{KAGV3A-PM4ig7W|b;y`ENwu27`<`!Vr z!s6lD>-L3Ca4maL;WUiJa) z?1>irI-e=n3!@TJ8*)RN5RK%ZRuB_wrCp!iHin&R*Pra$g6cHqZ3z%I{7IyW&9}gw zCeS;uGRGK^q;r(;VFf{^v4}fTg>cE`4fq!KwYwX}X^Hy%`(G9^bliTPc=5jaM6_ya zH1r=J+u0Y}+B#YOKqoe}4p>B9QE>;rvk&GCsW4y&2nZ0*L~ny-&k=|T!S3)bX2a}X z{KiHl(yd+Zd(w9wz{21u;(go9Tg>#8caA<1Y=%c6u)fR%?IW~DXsN6pM5OSdzNe%1 zEi91(FVMju_w8jX^7nw0OIlhV0h?lqPcXr-5AVO1sj1t2sy?Kv#a}_CjTlIr5w|25 z*o9ieVzUszQ9+TH!t1oQ7pF&_`>~zP=mczzssR4r=^W6(+&uZU&?fwC*W1EEl=PH%TlEOG z0KGi$f*$Zx`)o~x=@H7yeCu`&ypO`+F%0@XJ6-ZS`yY|Ve{>5oS)k2QbM8Z(ghtF} zC2Q9VeZJsfaS+-;7O(s9D}2xDuc?z)0Jw z_ljuXnRG$3!8rS@%O^h{PUoRAx_W}?=dl7>bIKb^PD$5!G+t=Iz zxSwia2&eHBjVm{3!RuwUK&NNfjRTaLuyJoq%Vx0Ud_ad2<xGhCU1 z!iDniOZG^vFsi}&hqEryr&|gEzRkL_mK(~I3o^$4_6cbMyx?B$bu~FHO!=>vE92~y z-JSHN<94^Sh(DLtCcVm35e@xdEfN0Tx-_q7%Pg z#i{5;@w9k8xNuh2)#-%~<-sE!{m| z7?W};Kdd%EklO2K#(c14#0ga0{`KiQXorY3!O0RrqJEE5FT|2d<610n%L&TTzL?Ln zs<(bNes0OGV$%Kv*FikKwRZOP&^qPd`k`+t(c_nu!!XK4a8k3)$;=%6U@RIdZuR(8 zzw_vol5ce}Y7+mS3$T`;C*hoJUh(C#v{?OeQBY)0QncPV;Ff%(QFght6L|^=n^xm9 zYS#+r6=NmjM2GArT-7)a{Bn73qb?&>Z<*e!-E4V^+|so(*6~)6G*fN^I+>|Ur<`YE zUeAbbTO#`mkY~c4SDN=NUY~4I6&fJBC0^i6pOTNwk6ryk_T(KB6kBi;TbxiWP49~3 zyQ?2q7RDFwjft0fzF#C{;L} zH}}9XG0lt(Z?5}VHO8M(Gug9Rtqw3)9TjTjbUXO{mN5S9qdKuDl^d`uH@g*iklb)86 zStX-uYmJjXy4`wD#H{9wy;nWoc6LfzZlx#tV9rl0#(NoiA8iH3aeyq`7Q}b^RbM5) z3gVdohL!Q6S?iL2_($OpPb=zE!ll|Z#Z`9SIb=cAC(WwNyPYJ+JW`MN~q)z2;kJs!2IU#I@*^$ulR_slpj zyhHv|;qlmC6Ci02%$<9UwNsc(8F$5L(&DvW9!KJaQHFmcw zVBojc_cQOdq`36{#AZZu)lJ1s`bf0L4InRcqHB zu}N~o=^RDF#t6@=at4ztk_Bo73!UWrS34Vb=Unm5eb>D03W^V0OYp(g?lJe5E(z|w&)u~7Ayzy01vE7&CVG>T-dSU$d2OmbUj z+Jo#5VIO^2oUikXUX66{7-A{rykJq6;0oMXgQjM=|1bv!Ly_C}?TmsV3taN_ecI+wS_^B;|+>{D;jaH#cS8C6Ye zmo6wX!twb$atWNu;Mk?UY~rjpO@F(GDnmz?fu$t3Pvyz@#M$N7>MQXoF9@XS%a<>m zWvik|a+nkpBpE}eC6w_gP_oj^nYt;uG1@%OaT@$rXiBi1q`K(q-%?^F}dtVoe7K@^0_PtcG-p09=_S$#X z)+(tFill|t-;1X`Cq0uF-B!&!ZVxTg=KA^h0oXIQv}`S*KdYJ5BA%ltU-mpK|((S+%|aRLZ36FA=MXu?*Lr%lQQbB|u7)H8d)7s)mGn z-U(Rk8D;7cX)a`X!?c6)tf(^f7NbRkZ1j|RaR6~ zG^{D+Gk%5`Xq0u8m$DTq1onJLV6vohdt4md^YyA}wJGh=*d4#whZb`QO0A1Zd@ivU z3LblWIy^v^rNyTzmU6FEB%bdjRgF$4y|&Y7@|Hv4+AkUGH)sVWE?lrrA^K$$xGD|w zNxOm!?}?iXOzxt$y+rbT%6cx&_fvCnw(`*T^E;P*KXM5$U_Z8V-X?rOfxgcs*jUWp zPVimc!0F_m#zs@w;AL~+nR@+uF&z8ZGjuIQL)=7}B^$pv#PpVk=6d>5%AZ-?d!DL~ zqb+ISzkr*65|WSGI}V5kUQyjv$0X6f_{R^>oExwp!k8*4a&p$S?(xA^3GoMSzg*|y ztv@NNA5v{?X4N&^bXkp2H~d5L4VAG~o=4a%BCgUg7Ja}yLj&U}FO^QU-&tiP)a%3EghByAmR~k=Xo0K! z_O*?(RC24mf!EQ#g?Bno-NwEM<~;tTA-dQCOt$KX^!O5QU+31-AAL+>`}L_ljRZOy zTkw;5=9`W6&&-|KBC4hyA!Sr@@XbAc6T|S$^F#L|)%Ru}+P_A>dU~UueGKerwvcj@Xv=bPo`5d!(B(H~ zvxIa2yR;k8(18bjR6t-d{gKK^)=`jMfeJWd(Sp|>AND`ked*A&=t78)QhA#ql%ol= zW>I`0?=>ZuyEjf79MZTv=3XBx6geX9)gVG=IWwzT%(PTDrI+wK=+EZi`A?ngK|KR- zQEH8A&wRqz^-f}y9VrZwP4p>p{yo3mwldV0?48_B!>H#Xi`+M9G_G;TM@kDRP~ zC;4aQ_lQ#G{!LWUVt8w*Gd@K#yxDVJhHVUe5@x4@;|-f2i-XBVv411>V?r=lVUOsZ zl((kdRPx4Mr!BTaU|MbX_XQEx(Z-9p{D438ct9JOok*Be-v6qZb>7in)>-7uUT3|!b)?*(LWE4bs zYuhQ`BUG5V6AHf|bVQ-y;lwQKAwY=!jj4V#DQLzbLD$5RV0yG^$7#7%%}|Ms(C)fihO2 z|0R&QlU{2li6NFIy)P<8+4%T+#yu%ik^*?M=GJ9yID`ornUeDS5 z>E|@-6;ff%(I-Q&7y}IhhDMLzT678Y@{7V~*5%;y9tGxCBos9m#_c=(mlj8Z7^4uf zm`l7hm?2@J2iz0Xp@ycWLCCF!{_l)&b~eO20mvbyLKrPTlLd^Ma9GFuRh{Z668!vN z;PE-kc_vN62_Nlu2oi*L<$qI4K=VCiZq6S)@yf)&*wT_49L2KPI+g@k&o}}gf$)If z_vnybfZl}ZXT`=st}{5wz2zI22FzaeUbu|W?H{sO+s$8}{sZZdoT3=GG;z7I3DOrh ztqrH`E*Mw3ew`mZk|Zu{f}FQk>x!c%)noPzLF277?@mxrr7>yO{faqeymg+z*)ql^ zDbBnwsXjcCM8CtYx{60`S$Vo*mEhYGTEr3>8yg!?-N5kyO9?O{9URaJm;|%(j80fJ zV-{*E&YTBzd#WbH5WE5cL&U;v{AwIbhSc`Q|C0)UhL+V`(^=O!G>dH)2j0=agyr&) zIkay7@9 zOdlIZez9xwTFmi+5c6qCa;tu9UZjz(?BH+1tU3q!9n5h`4V%;XT4_wWla)+5w;sA? z-*m1Oq;c$Gj=QhG7Fc(=qf8fbDvTzGVU!ad0J{GR7cUY}F3^Dq^V@#a@|ZmsZXOd5 zxR^Wp@{9T8^mID@FElfRr+obooXQZ4A-^LSBv>_50EP!fVYf^=0lQ+M`~~o7uv~(m z->>1RnqrJZaMp+`ylY25(Y7++QP{`*1VejgPy=+cugHVyPnf?0orRY67iAwIAMCL^ zw3`y+CP={usV!LC&X{BpWV=tFp325%a6IVg>~y|3yvbt1eJ%#+3l{k6r($`{NhZ8( zF{CFw);VwwC-{S*p(42vn-0L2M<0GF~CbpOC!d)Hef^ZNA; zF~T5G+D7V0Sy`F#VL2mXXhvSXjQQ(!^|h*BRo&s9EX!wBW@z6ofRPJ&w_enKVjpsA znh349b-bsxb|>qi`P`?Kq-?XkA3r=g%@j318(npFar2*Dv#8(0o6E^A zB8=SOH1&ze~nniLimBIl&bm{dDPN?to#!x_0*DDFn_9|J>$%e&~! za!Hn~*%b%RzQ-S(Z^>4?;dASIvvKH8Z?WG?q5QlTzmD?JV&aSUh8QNsoReVxSFv2? z%L@PA)W}MqRSmHXH+;{?T^K`OAdZS_1LM;Kta$*>B@CxX;8AD_KP$`opp;CzwyUy3 z$&$S&ya6U78$69*s;60^A^=X%UQe=0z70+{a2fS*i0CpIPgjaf;T20~Kfyq?ZLMe2 zWn+BlkJ=L*5n=C@(@YI>U&A;Xw~#b1jkW8??pB%%SEI)pI^C1i6Ix>T$bDfyDvr|9 zcz|=FVq&*a;ryUC{{zGt88*lW`(4!FLWg#Ka>I!9g~jmPsZHIPV~m0SDR;#Dv;9u5 zSTazK`EjyXs7QC=Y+-VH_ve#IbZ)IY&c9oPdx~UEoQNc5tYB-2GnbFFRWgY`=^3cd zHrtSlpZAb{Zo|&a5?0hNTq@CA_(=5bcF`Mb{w=;A=mgk90bW4(V2pC+S)$+a^$ztOPle0pL1Ru1jE! zjsTA{3EXwzojwCHpl?>l^nqV zJ2n089D6BPFIl-2O+c`fm6b7~CD_IwVgbDoG6*kt^&p^?@4B;1R0n0)b z=Ge%3L;|@Y2pzH}qCavM8ed|~6zHKr&8It>p2Vth6WpZLnM&_oGoJ0>ES_ZLK7QQc zBdZvUk02w#gVVXU9QB;~iUQr>i6YVPSThM&Fw_q{hXq4UsTiMiUnNpH_u+a_+w_im z$aThag_cOun+Xd#9+?^akKB{}SyuCq!qN|=gZ&;i?p1z|u67-f47Q|sRK~E@V(V%C zg0s8kKrP304aIv6`gbg}XdmuBr*(sgc~$NMJLyWS)pHqJFTQdtrU!`2<7s#$U~c;6 zcJ=Vc(^9s$#O(6TPv74@m-zZ1d{=9*CF*5n=10o{f=&h@?@(PZWa$tkl1OCB0>dqO z&1a%GcOi8ip<3yeh*y*3w$SUMvk`9_0ok2yw;E>2^+Sm7>sPV(7Ld$pzmUoIOFWN#G1guW7ayPj2muuR}HVHM8} z>)LyiC7V+jZ_D794$INt)R&%@zs;sfz4>-Wf`yIB=g3->BbjJtuNq4*g+^>E*t1H9D+$wnQRj;*wv=a0Go#papa^8#Wij;&|+mR3N zJ;WyGoE@G=(_Hzm@E`TI+dezuPgW;AblZmMAL<4idT==LfrU9-JRl|od-FDuU_5&FdWa(D+2C^8x6L@ zft|0cre=ZhuDOK;L72zv7z{U}$^q38rwcmJY@^DJN5>;6t1lSd0sjx0v9-m`jsAtr z*U)A-curn}C#}!lzb>ejw-Vdw94eN%2^uCm640}uzYt*##%m<4t*t$5yP%1co zM`#i7gqfg0h9AkSE67Ve_HT$`4zZcTMH)X_WiC34y)A6f&5B28u{dDRMS8)D4dU$+ zwq4|1CI&lHAME#en&9$y$J(sP)!hXz(>kUj-^A}p(~}c*ihDFz<|=Y8`=vh1o)U@e z%3IEc1w4CD%Nr!+#X-A8L#N7ykw;&y(`LV$$Hn*RZ|Qb?)ioXRu9W>CbcZ_jZQeF! z5vFY-Od^dJI<`3*-Sg!Cq_phrd6~ozsQJN?K11ALl!aAEptRt!$pHuMzOc1VE>niy z>$k|3VxR_s{~m-1J;8Qt9^v5P@d>tS--2`Ry#S34=Mg$myF%z(G zAiKbhJ}?r7VBm`46SeIvAHsn_QT|A zHavOlA)yG7+%wbl<%=e^|9-MWZ+Gk%@e}ys2w!t_l~5*j?I}Q8l!UcBkWoN2jxne= zxv0ny8XZuB058};>1yx^7`l0~flNkP`gyw)k8l){5gfu< zs17kZC)WkDFdaJdv&Sm=e{VG_>*BtaZ=jUmS5^G+Jq}7bN;krg1N^7^g@xiM8mmww zqOUQ<%Y!^XFwsETSA-B2ebFA4oED4Z!@Rs@-@N1AaTEv$NR^+USsMCSc*ycHrK$dO z$Xx9)f2N}hdX^jgQ$wZKNNx}R@E?+$_y~uDuPxh3qrYa9Rc#E-noPfPx|AS$%j-$c zkw437;~tw|h5LUbM*fl0)0FC*9`ao|G%g|XYImZwU_g(xQjC>;cD#I)xy}b`R@;|U zXLxh8o>~sek)#@Kk(2-AGX}66-WEqS7@&ID-1?zel!VXWGEH{b-7_sNn%9rXT+!20 zM)3viz%Z5(8bj}k1w#I4)G+=78}02|2|PFy7gl)gNOxcpW97>}f{KNFgzaUB3&L8} zBCLBmVPnu@N#r%KGEn$|PX02p2`oZvmWHVP4_x3U6sNl}Bm}+!su@8i!q0;NG`WEK z(?R7B%KYxbr8sGr)}u8flz*Sj-9u8tGsCbEG(%j*a<7TtXEqOP2C9)FHWpT4%+XL5M*tBce=SnVw_*{O2djJ`&xv(+Os z5rU3pqFk3B+da!YxHXcTkTA(MpIH3poiu&&wUkQ0+Gwoz9RCEFx5rH0| zAAz3h*s(o|nuNIlQTHD&`?C#fIJ85ZSowK`iZ>u-zU|&aRmh4_w7>uWQg%YHQy+Eg z8ivj75B(?b*9p=a_-nuVJ%taYflUMk7934*rv?e4)&lJ$h+56jm1`CRq(S6Xa1b}{ z6UHOp9r5Vj73UGArTX*f&VUu9>jO3!)25`{6)Vt0`-_s!HcqvpY^P+vcr#bS$txZjlo zOH;kp*Gzj}F^1y#MLj<>cT9&~n2AERf?P#&aQnmav%?%QCtq_$f6IR~mpP(r6|vQP zWH>Cg;Mb%2#~*iFSN`C@2e2=`+d=bmYp8g5qE6=zi#A3EhL*SqZyC1#M*zmgQo_6e zu3>my*p?0~0hcgH$!wd6zSuS>ZBQl>Sqjk!2Oj+>`detU;nPz;a1-cvs0EW=6j+VW zToBAER@PyFy%;s%+#k?d*?xZuS~F0~!6?kWcthWI*!olJHPEfmf4sj$=ot~Qxda4g zAp3$lx$AJ~`K6Wa%2vsW**$Df!gDHP11RjwKODaEqiU+SzZI2c@=Z??2^u=|b=Y&F zhDDQTuyNPvl*4dmU|7&&m!6dsh{7qc*)s16fH*7?g@w$585B4KR)PPSbvf5m_z)tu z0(~t-wVEcqfvYR(2Skydi>t~PFS1B#-vFtSXz-WTH>4Q+b-(QM&avs%`4Qg8>$BfS z8X)s{km#1w_6C$&;jO$rp$}_&gqwacp0=Da^e;HQpN-j%Q;w;ulbQRAU_Q5ld(b0| z+>0aLWfEteH!J8ieRh-9O>H=urM+Cq?&{{zd_lTsi*u$~dM1D91%@}?94Y~a}`l1K!N=Es<9#{7@2ob`su zX%}e#*h4r4?nO_aRe|;->EUet_bJE_yw--;p$P%$V*pHCP|iiMO%R)fQE-31Q9Rpm z@%ZfejCXQS&~6aU+d%bLBHkkbzF1hiFnl`!9_%O~JCj>!4*}VJeRUD;0cUZF@&zZ^ zn(@n!6$mZ~sGr16Gkolhjt)e1*y(WDy~9bw+z$a{RD3x7*`KT4hr{@tt^Q3&P1bK? z6xRGdJbec^*X!SZLxohbL$Y^eWhBZBkyK{L9w`!%QKZZ$JF+rD5*d}O%HEPB6h)#W zD@nrtb$5Qx|GBPnUFZCsb1L8O=X2lh_iJh!FCOH7P&vSq-7PRT{p~)R-PMGe^doCq zB($lxYERXtw_ZuMTmO`CKrAB1M_fr2JNeSpVENXav9<}*>I|t5=jK+=YWcQ;?t~}? zhaAipPY38*Bz2f^g^__0LV0C92HbY|lUU2rnf$4!x9SRH-%L#%J*#8O{oC#O!~dTP zpmKa=p+V(u^{S{rS6w4hyQpRV)IxWEf7rle!3!CO@*oY)3Lrpwuzq3ShI16<8@KvS zo-#23ierOI6#yv8<0Y*dhP74ZBEtn(_NS$L$viZe$WjilscPo#{Y2|3!5v}Mf`mV#h?FT%6B&WU+zfHR#YBx?|_cjK# zuE+19cmKKjwTW+_HTGZV9q#Vvn}2tOs-k|$;8(g(VfoP;8tP$J$2yk;c3;`cbDaBE zdhWVftF0Ruu3WY}Yw~-ylE3XUrkkc)2BY;h^8CFwzl&ccAySah`)bjCJCFk;ZHRcr z{1$KfeS+N_a9A*m43Las(ueg9;Ov#>yU;`Q13{>bc*El2)C3u?awaJp61g(FS- z(WCR`wnAP9I2hC{yE543+P<*;=l4TGzUB^DbtT?`Wc4u1AHV&9CS={a7eUplBV$#p zb@~v8N?R&5P80lL@H=8cvn!EvY?*|14nq%?+p%Zu(yE-TmUU;6-!Du;=ct}ZrPi#& zPY*yIQ;%0iFP*-AsPK%q8`fJ%xEwz?rcbvZ|`fTJHy*se`S+JxIQaTiOO;S36xQ<0P1x)ym$`*4OR07yGccbaTL6 z`%ismrSa7ffiUK4QbfYTzBMK-trL)joX0l?Vs=(g*r^!}4*LrZo|A}WysvvX3_ZT* zVW!5P25+7flyH?uqQPUAiUWp3twFLl|KAu#3u`TPGo+(Lx@ePVU zCu{s}3)2~i2VY{XpIn+5-mw~r|ns);M2&Qm^DgL+!o3^!q-Wj4tCwo6>|UM zhR05KP9GOo6BqTp-d4^|n#rUniQic}Vr;v}?%gRepWW5;y)J(|;Ht0Hbm57SsN0=b zF@5+_T1W59NE}BnGz>6!=HUCpPes0f|5B|HCaviZD!dF8`cSySdMO}iw3$b@V zfL?WVDM6eH=M83gFjTdqEEI@27FI&yz+nPly%S#tNgTm&hRF}u`B0P++8fN0XAln=U@Y%1res}QQ;2Z@D zMOw^=%H}hCotPd4QXVXB+aRu%A@nX-U#f`z+?BJ=l2@-rwzbYHRX_Ihu3g@ou)lil zE$vt7s2;CoM(zq&ZHwEE^6rznVc*F}U587VP-0usFdZkwImJ0fb_-gEu&P{ER0CIp~ghM$o!q+ z<^Z`lai@Y;HrGM|j!@ooG-L>jjb*^irpV#-c{?O2&rqktbYlaoW6-cZ{cw>DI0;oo z5b9z9sR@Rm=4kT?ERlde-aU3=#>?n^_6o{>#!MY6Zw{^edP>}}FG6msS6mTed83lX zI)nxg;0iEu1MnVK4(w+O>pRO~c+PhZ8vH_4qaRcYg!>+RX>tCw<^4x=BjHa&=T@HV z_|`}9hjuHE=Iih)LHW7Yv%YTWs~>^7vnl_LMemua5!#bzsCkHdM=!)Ko;iAwKSfMo1;RIWTpLw*INki8~u(n+O+O z??jK|eq^=$op`vmuz{-Ae_+ssgaAyLx|leA2uZR=*x1|0#K#BqoWaU>{KN^54_ps} zQka5WTwEH@JcjKFy3)@8DfW-St`r#`pH2T~WJVT;eol8N9Db7*-H@r%k*e@uVYj?I z8|Fn~A&0gb5FRARXzTW<)uv}m(FOXRn|H@u)zCN|TOmm-is5EXqTt!^woPs{0V^to zv;CRul1dge_qzGRu$uDHaVaQV?s%pXgGMZPt5+7L4VNTxhFJVTHrqJd({ z5QG=xuW0!Ugrn&^a5Y#H|I2K`CawbA?2k3rXvs@L9yyXBCdLA96yl2JT0{!RE!%aH zq`P2SI`{NL1L&4Un2vSb+$1pbkLN{P*BCJ)eBEP5%%t)PDS_E&%Xv-dbd1;A>#%x1O$0w`p5=s zjTN3`7-6h*kU~y=4FL%DrywK)@((qno#Hni!_W?23U*a^^l^2hfX^*1E(Y|r9tRN4 zHY_$EvOYuA01yVYc-+%qSSMTp;OX?o_eOA5m=wYKAjA-x1hj4PKSdMerz+hVsD@(d z-R+-rFlqC5$6lfm+9;VM*)kSuEq%MwUW%0u!9eF_5za+%?IjiSbMR>?+qpd<=!Svk z{rmSjnmXolYBD;{{1Fz_LWXBs>koCLU+-!7Q6zepB#=I4@5G5VOGL$}Vt zCckjVs))Dl5z7AN+v_GTPBd(fJQN0ow%c!4RXXkg;ZJ|?eOPDhQTKULuzNsaaG!eK6Yc#j9T2=c$5rm{8HNN;oQ>u#NvZ!lHKU z5&x>w>ty|-&z)6`|WmTK2iJP#Trtn4I}Eb&b|=m4H&C2yy62|Jw75L-&1Y(t&V8l(OHxvJM(Kltf^g{HtEw_9tl^?mUdMMI1_d$;gK(aG zrLt`XKF?VaD-DejI+uQ!4OIEafRF>`4IqFRL~(s#M#M+_65{jU{k_%dcszG4y=yEx z{|PA+SBX&*b=WazX%E-nt--YO3@SuWZy)jKV|(J()^6uhPbp-~>Do9a==j}_eaFWY+YXACU(z3GJO0toG1j}@ zqAlsFHaee8tLtYqJ9?nApi#(^y6}~gvsK<-_=LjY_8w-m=w?n(6sdTu8 zY$PD!fUJ6fbJM!DX61IJhAk8G-#*o0yuu=eGY|$d7#ggK#@}l{G)1!xGFCkB|~WPMNdz}YvMiC$&DJn@GQC@ z_LZrUszqk2!tQ8MKW&_wAWH$#ZwNo%0bqt0F6eKvO@>~OWyhfiGdpwvup>+p2ez*7 zFg=#Ss{G#Z*JOMr!57G6P7!&61XgpDVZY5cu7w-t1%O)wX`n_d0cGd`m|TGA;Uuy{ z7AbMbVlbc0@%xjrf6^9kCjRMLr;dc&&IT4c^~{-g%?tEb)y2|We6y33RD)h|3hZxt zuN?8yI5_N3_Q%G|?7M9hdC|SWVg6<;T&5fKTg&cvWpG+ZQD&LYO&vKBknkW9?SlKK zTqJx2N-VOZ_%;o&UuctBX>?f8aJ>_%`|!w-SI_oe8tmlGxw^?<|Fd_@qX!Fh_=H~u zR-Zbhf)E4(AL9?|ox6e)HwPvn-DjOGEgAnsrgBn3Gl}?DfONps=kOq%fGvd04j>mM zf9xIb01({V zn25-R#C_oMz@=3#Ypbrl5t|3R^>jDt-HY1cDg&2D$b1YW$oGL=+dcI@%riK?@Wxp_ zHfe5Yxg!%q`ama~I~u1SP}9`?wWhGMHRfmEiYFmPtI|YY9~%}@_|@loVNfO!nZJI0 z+hfaS!74Mh_jah7wWE zD*T!nC{Wkmg2X~1n6V~K)aUP*uBYZ7StU-+4-@??=tU8WwN9c`-SFc_rN8jI9+vfaKw?(XkwJl#qq*f}J zditdW>|%6p-Z#!^aGax_y|o~!tpCZ~@Org>c&lAPac)WWrgsRh#@Z$0soL}mvv)_w zQ6ez`$=HZ9O;AWE9oRb2Xds5%4Qm3nD};>^>m|%r)}SSjbqKRCxEmz@AWTSLb!OM9 z5(?y;6NJLxT7=SR+~o&AJeZkrt=6A%sS50!xOexi|Iq5n0{q>_PMvCnEUT5=`w-n5 z!ymLdyLYw5Z@F-laCVS7YT^-jjzmgwDM6+YlFfEis=T;(RgJd5~n7XaZeG`&}nsXX}7_wERdkEkwW$2IL!4rnL4DtP9xUSW(#C&{1BgVdjm0ebD&lvVr)lm&OwRL_ z3K+&=Var=t0K1F&!dGb(BACMUqsxfWLez?LlbNA(Gm{Pl2(I2KMefB~%t@H7s!QdGx zkga(wyKf&nq0d$N`EF#)J z<8F8?ynmNIf4=M5OMirRO}yRy_3N8ACm}ck?gn+IHQsy(9!V0{Gu&!e4$DoiK^TDF z26Uz}#toX4n(G8nH#{!;%9rkmT3+_QbfNB`-B%E_CqT|#<>slzktHhM%+BP z{*_jwBPK+mU{16z7A=8m3PB1;pn@!I!hD73i6MkV=ylopiVqza=Ah9aWb?6OWQ_rU z+)K%zw*Bcqd#B%u8;)s&)_jE8DjiPAv3`d?8etiTU(nFesmI9mS3+l75wdkL6}$cY zJ>zAa(C!%$lCLYGl4{Q`sjnYpE9a<1PZe-iARScs#e#~tO%bm4z zuv2=94Sm4%s5bS8+$3#{w^y9@ZlKrH>Y}FKYf>80*4CEwy7;w)ctWoGXX|}!h0|I} zc~K|KwjVll{N&)dZF7dFBrlz}&1h7mz5Bv(*jJY!r{|DVfdp-AS;e<6>cx0yM@KPg z;Ef{j5o9BQNT@2G5EppZG4%on#R7p#3KOCGhv(1%0zw;y4+A?{bhNUU*RzgRd=LOl zI&eAS8o*~uL}8e>AjBi_ZO|Ox5HzaxmCFz;28jnAY5uju(!$gjF45jGd!&A07f&jf ze}jZ2+-Xpi@`H&a=?OhOfk?!7_h@ZS_kDZ)fys*)7IIH#B5m}TVAcd9%!|+wH-|Bb zWRHj}XZnX}+1s!fC!Tgn%Mc_?C}3*^o9F%;)=+-ia#8-F(KmMy9;XAF{ShgcCD8#e z@A>o7h9kO6xVgZK0&vib3))K=U_O1Bn~OdoS#H;$GD65lX0%PdOYt6-8#`Ce%W5=c zB5_TDoon&wlPB0w>95l(aNH^|&iaHQPuzHP>(iar*7(gI-wPyHB}}M`o?qmc&pr*? zCyCs*sZO8#!x zm_v#7*j?8}Q?t2jsESvU+&u_4BMb31Cy0o6c&y(pT^2zOG{AK1X3;1y?ix#EY8~fKEI9>dT zpL(~?nc|JUCqvy{4&7|GNOi6K?hQei_fCUzCFkbrnmzAaDv?t)J)YZCY{Ai(Sdc56 zQ^E6d6CabD4o#r#kGzDP#pO)YQmhf0GM$evoNeCNeni2$piKbZN~ppn$Jq67)j|S! z9myT^>UK+Nr`Sqxdt$K#IR#otJ7nm-qZ=R37q`U%HcMfr#gpRpBE65T?l-T??2>&z z{h~YcK5f_7`sjAf?z>Ut0ylEma}?hNcFTIE#>{ARxtMO5>D{-Z)Mw=Su<*iOPb>DE z?CAWOz5+p~x%^Aq64Eg*CVvzKCFa$*%eNxtyRyY7Sx`zS;#p9>#MjReiyb2j+l^yP z!e%Ws`StaQ)~mYO+;1^qvx<_wKJZH{8(^dnExt0y4BjEOpSxIT0{r_pBkyRhi=f8~;Fh~hQ@?DtwGiS?=e^OFlIE63qjOW8mIC7j zN<%PRn(i??UTq<2;r+~WpSL3S(m3$|hP;U74==_4N{ zs@mvt@{4?yb4eA8b*6vj5*TCtJiLn&%ei~lHBL&zUrMwjafM|RgcK^#m%WKLDb;b7 za`C8?#%-4&=$*tFMwxf#?$*6w+@{@j5{W-)-;6)$vb;Bu;(2b|k$cQ+;Nm0;Wq`rM z(ag^*RXRJwwbm$Hb#kA*#m}4(aW%hYP)k6qpfAz0e?g-A*vY_>K|4J4etX^{LYasL zP_EQqojvd9K9KNC;-%chl4lu0ubmn(a+{lTAl;CKo=>BJc41xi*5!eC+eGk_{C_3U zt@7qg>?@{FRXPfXYcI(SN7aa>25=gEKd4!t5?!ktK#R_w7yHDr`>i4?{tcuxE>A&= zDxPr>|74xV2rW&xG3CU>1U*MG?!N26>iYVC8Rh`ytNA^KBS=8%xceT~O1l4UQ_R zxTp=Vj!t^NKM`C%e~_nzSjHMzp)h58dwb~zX$0F>xbg;?|ocP*QO zEkQVIjb{%e*J6fPRgpe>l;!q6*6w_b*VD1UsLbsYul%n3nRR6i9+ukDxH#{1u zWw?J-DLM^dI21{My8bLTSh<4mpbD<}v#idohrbO~K(ARQJu?7V+Q#HMyR(-*(WpY z6EvnEPv{g6ve5A7ixi9E(V0IZA(mmC`%ol+^H`M0A(K}jPdzD>Xt6gD#W?=$V%S{( z&NbjK*!<}Ma}$Lf;^eTRY{dXcF5`ixF7{YI5i3Cg14s%<+EXL}K+Ac*pdcIhd0-V| z;B@)YobuA@&%trD?AK!_M^Dd%GM`uDa~3w2cP=mEmy0lVVPj>bd&~GQc1hc4 z6}NL$l>%afD{ec)$*c3A;iD815a2uXH{rM;kMh4)$^-U_@FGJiyUJc00e7PW2zS)cbnyr}M=RGaYPI zcOwkf4SV;N|0;7@k{k3I(Y$6lAU(J|c$TJtEoNqrrO?wabD%-K(?Tr#*~;TTZryT6 z>339w-hA2qrR9=K5Bd9!xKQ7*rxylQt2?`TZwb4y27GAx7NNjQf7x8h;f~43S32{l z{h7B0j2s$2J>m(cE>iSSwefMJR^NU_Z*1h3#Ck8|qqGNG{_dPwlH9R{Vt9HuaE;tn zo-k@k?&6FLK^_in#Yj>AJ z{&;;0PP>ec#oT@c>db5cBpzSSf5f<0`-c(F5V#$1_ee{; zZ3R2jF~Qhl*+@u3n7jMY+oG+=L%sgp<>5K^#m9)Xx^m@;GM$znLk1#M7Ft3xG(gqj z=x&(22za{;Mz#cT78g@z=`ZwVE`tcyT)qN1bMnV#Nbo$>qIRM7AKt<3z}ubj6^*z4TRC8pZlSv+Mg-RlKAQTM%0~o?x#x^#cJ?YbU%F(p z&80l6+IFDb10#YzZSs67#@T8v`=?HuxZ z=?tUSc5~zR+#qW4%W`{otcjaARkz6Z?+Z(W8Uho9EGBehJUrscZggfO;sKYclI^)v z#tKI(^~8-HEB8hI>Z#1_@7O5Cal3Pj^qhgsLX;K}gO##!qA0Jc_o(U4(-sDL3|Op5 z;}Wn|aPw#T6_?asg?a0$zPP-nR57zl5Om@Qv5mo7I}8}0T;M)&pdB?K-P?NTmNjZ=yy_V8dz6Cr>3bqe)nz zjEv{;9?6;u;oXCF$7$@Ovnq1#?Zxm&cD@6#xSQbfg9(L2M*H>9&@Jreb|oJo?^fM! zYFJDa6n=D}tG#4jVZHl+Eskm<(V*_H+QK^}BPQ@5emS{O$%6NQ{0_hgW&^Imso5~c z0p;}XIa6;}0v{2ojJ852X7UShnYkCf@Z7hKNW$=nQw&?OB@`atzn{g16_(K!cD-S| zF3xG7P=KN!PZ+-w0aNzn41p$J`Qow?1R{pOLD#k^HeoGYMA*wE#7hEk-&rfU{t{w+ z$zPz@5eZ8Ck~xa=Lf{HW#>RiS#j^-yyMvwTJdAZPfxy=&qq7kyGeqGFbP$XMBE>%; zg-(iO34^?c(kvP+7(^P@t$VN?Fg}((H1N>_SLv_PXYXemdnQTxP}=cs!HrHJ|z02Ti*n?fhCGpk7& zLx$QfIg_@MtqlMaK;n66q{$tj;w!lR&|e-?=t>I^a^o7>Y4# z?luG_Sno5ZxWVoL73(>CTC4`6hofc ze-KbGiCOEEdQW-hG^6?x9c&`H*6|PmzhBbat_L(kX$wXX&g(>r`ll5 zngU1zHZ;Vq&1VUKUiyka%fGd7|c5OBTL#>6zO9S+gN zHb_g$ucM$mN2%#>+dImn%D}K^YMWjlE7h^h=TfGVN36?Fwql0)Q)sF;eF<@daE>Xa9K=hmn`@5GOu*Qk99P7W*x>0tO7v0B7kbDZt2M zF@iaog`M37o4hZ&MZkSSi-rEq^o$JU-q9l(8Xre)9n1!Aiz|zG4j@H`)gE*`DGp`Y zW7-62pbp*^jQS*u6>bUbXP(3SuOzwY>F98L^9TurlH-_?f&}-^%*3nstwO@8KGyE+j# z3i@F*_~2hI9Gc`_fN_JAf{e zb~XJiplklMpEwc6oEOfdBgMdCm~Q#7%mqLn4ok_F`*Uyt0X^ zA#}%jjPiv2Th6}s*y)ehH-CUHFxwHk0>$hYuOZ~SC44j>&_?DK;g%A>*@R(`{H&dw zhxHhssDOEx8$RLHKZUDE&ICLTAvv@N8>~9tC*Hrz6&;_AEx;2@KE6M0wfKYBf4cCO*xCPB*=U2A^Gi0Or(Vb zB;(Wf7dD56hL)fIV#Mc>O`Rb~$IQ&EpTxff>MnqOU#-V=ptHLfTbrQ==Toh1V0{e@hCE6 zK)ra4(09qQt^uDv+x!cx*Q6t|2&B=%>_&7vI0^v?ecS~;P*Yo*v@XIHQH@kv*tNuy z+M&=pofx~4AU^8{iwz`sn0_Xx>rY&D*t$hEhNDHJ?d^2WJndJbu5c2qic`rhys2P^ zT~rNcNLIqI*o~-QNzAzzo4}>u|BHJ!@fe$(@F(;bqokk~=Nf1bP)cwvhwy6tvD*X4 zWz-jXA8kPSz~qs|jE*x8o;H+l-@Y9Tl@MaKYtB6Wc7qfh6U^D@k;U5o)rsK6w3bMO zf}s5Ap{0eBDzw*gFCWa2kQY-_OoilWoUaSh2Lcqfd$pfr?5|wbICJT%+_jgqZ^vMl z&@1X=qQJZ-F>0I$$qeTA+xUr4h$9DgKln`iA-@e?LScAb)(}xXA&nNYOwfMh4~th5 zvCc%2fR`DVccP372LPhIev7TJB8mI0_!3&qHWBK3_|ITSP>JUKAV{Ycg&L_6L>)r! zj|Ho)vC$0zo(XS9tUBZ$Iu#aBAxRE^3>}%2)bEcHPtz}*(2qmS!_iYb&cpotZ0Jlt zXm#r-wMYuxmg(lTH_e6<^!u1p-OoYG35}s~JPJ~|<>h_COwe(trYFO{n`twuta*im zG!Jft$md@0K`9A8pq8$#uAqTw>FKYb{Tb#7`~h(P{Jb7;{W=Ax6zKCwJ0pA}@B%^; zJ_dPK18V(X>i<@;h}I2RVTqHgMtFyyG{H;r%|m_yY2io?`#r@)DXN(od|>N(`8yd@ zCnE4L;)NvV2-0&gArW%`q*g$6-(Oz%K)g8{HrI>^LQZ09JDR%$vg&y)6%|!^y5wOn=7y_kYtz7dv_<~nXjKMPCXM8+MtTqS;H0w9B4l>|jQ#2$(WacI zt^0yeyiq%v7hfd;2;jU(mUGK^ExB{oE?w7|o)`{DuGDw3wcbdH5;y%OBrSbWn{P2{ zb4`;lCC`b8x!Ku<-tnXaiMqPFVYH#rhv)>Fe=ya?-%}q@qEpm2GtQi*3%%gKd!uRmu#@w(UUH(w|*n6q5m7aa# zpn|k+xKOsAwijc`)_LiJYhU%qkyb&&)p=U`N5$eE+nu<7#>@SauOXp6I{Jc2xjg1U zFf;cj|2|zT+B`iIX{afRj{OB>#>FVm%aShFQ=lq+aqaq{k z2H!T@(_5B?1L~D==i0-U-_2kWF*LlL8p5>u6~)Pc{{HOwXV4>o$HBRSi-!^F)H-PE zKHJ9fh60`q8LR8_fAZuB)k78fm$|ze-FI7c8JHgi9~|B<=7K`qlU_Ha+W2+SG%WDR z;8REt6Q*7_v++nByJSvxGxP!eNBwu{vNg7pYiVjGdT+SAmL?`yDv4#+5vxi@{uiA| zusL%lI!e>p$Gbbz@~rAKoG72rau_*RITuxL#f1=WJp4mbkQw=CcYf_j?HTpFnHT3M zkqBa0Pey<`;E<`Q>6^H>*FFu&3kcZ16)+4B#B6-<%IK*G`Pq=7StWmcXzT(N+3StP1E4h&?X_dl%ou4I~FR=NhIQ7$LELs_OI?Ymy9zw zi$$MVFf?j2)aNp8ds`foxg~&8b#lK{O0!(oWBszwq~G-53wg%*b5+0m=yksuu0B$x zz!JbIhLhw@QW7S7US3|#u;J3s?aZuY6#ru ztLGoO=(H>s1OauxB_$%_q?IPwhnEIaLiFw1%z9j=eY$ z1cimIAV)hr4GKd;OY1dr?fn4GLqQ%Fet^X}nnVA5sL<(`+O@xHY24cWc>CZk=IXOc zD!TZf_mj&o8RyC@cEMn2ITgm6cweb`t=Ce&CZ&{aUSzWqN(`6 zZi+WW65le`(vO~?T$ezxohQm%#&!MS5vu0maFnL!!nEf}eGlc~LSf-wcYU;P_PNgn@ozTK>2%0izk_BY zL?-s7+^wo)06aIDDqbsk$4dndF{WsItzNKjVHdIV4Tb9jmT3sIGK!1olxT5tVpZ;f zx&v}9G{J&YOx?tB$shDP9t|XJ;H<{19t@lbMp#ItzkSQ7tTfdfK?&su(d#oX-~s)s zM?Xvot{fe?Bqd{DFNDa8w5kBLh>eerPD{Hb7)F$MH8sju#xzY#?hG2h*N+wzsNua+ z4xyM0V*!3{;QQk{{Q9%91*uU`1WkE7e%a&Z=8BG&IU-D{SyB%P45$3OzK;FER=2jd z+41J90Y_f(BRNihp`}|n;m}FC8<{)1_6r={B$cTx*~TqiuBIA4@P+3=rkq{Z{*HZ9 zpUyTQQ%VC@$lT4)j3(fM_!AKQbIjl>*pj~k&zITuR{!Qk05YT!T|Uk9&@lo;#(Bu$ zJ)RyirI0c;mi4!IC9>tE^se9m-vpYjk|P^59)W)^Tw8dyXFIHzH-D?#Nj zRtD1CMzU}~2SV@|9TyjfO$S$L+j+0~9z)_l2YhX~dlh2&ItYQG8~<|ewmB(Px4<$> zf(;;1AX_1uOC_Y{L^cRnZxJMumF9c*+}>Q++jFA(JQZdsQ0%R6>#2aT5=kBvD3M1WYNAESIebSp1UZ**UIXi^z#DFq{o z`FkE?-VGEN9y-d%*~zQ{YwhCFdn7($(?K-x;6VEe(BNr-5M}MGu!)AZaDU(X_cSyo zq)62jnGc8*`T6S7^SM70g%DhGS5E=9CL!gJWOW~Bv^`E!a`PqaxjmtU1&_B=MiiDj zR=dovS-x)CYW`mMBg)>raHKLVz1Lx zm}kHSg2fw8oVwSE(oRV9^!0J*Z6!=D9&7l}P4_TkC&DWQ7E9Z}z~EiY0D776yp!xo z((^=1ftL-_I;135F;!bxS-pca4(VG^48!QD47E!%uil9hD)5Cs?Lwq5M0KLC--ik> zoRoGDPhkiUWBCmH)dDlA_lIsce%96|KLhrM$~C`ku_VsnEe21r^(}5bGRS5c#4!EO zrFQyF{Nl6FB$iN+8Zg|zxd^yvcih@q_L9rXIaESgEREm!3vLp%AmZpCkAwvXm=11J zCFF^M;sL~g>bY5hZl*Hh0CCvzMkk_m%FJVi7)DIbJ_0Q1} zEaozJV9;;%GJZ*bymdrR+;=n%vb#Ice|aeyAoE^?AV5PXfGxEO2^NUSfcvh2VsLhXupGfC`n#43CE(E+m>PIZO zb{MUcXbI|oKhhtQeRPCi@_g^Q2}lT(^(g;)nWz7NB+L^67|qtiuSVQ@M4d}8yMzQ5 z_{i##T&kO~hjrpY@wgN!lPu69Y2!cX?=40SZ3SBudI? z{eB1gvGkk{;DmAsZ#vFD1#*)7YiCDRB0fU0mR?hcn#nl zTZG1R)4fh+sMV$oTD?Ib$J3IkN{{sjk@t9U@u?FVzO60lYA~Af;)%wy4&4}FIH)=R z?W7+QJiCS&h3)_dfm_deTcr8UQlaV&=_iUSzpcTg;LnbUnKO=}hZ{ zKvzvqFUq_c!m4XTpm9TlM!*=3n{8>GhvB^=k0Y!WnWoMC&-pYnpzVXYlBADJ&ou5T zv3R+Tly(8R$8DCK%@4T7!zHKL=5>`bfJg7#i^X@pGOMvc4q=`vLw9L(&8CzsbvqvB z>+bZM`A}Dz!XIxMcB%b8+S)KJ;VAtNO^G`6ETpOB^ROPf`X|Iz2|KKh#M~y)ZAm((Q9ySxLZGhLLC6^-z$Dbr|^ZqAPxi_r!47Z5)u@&_*4^! z55EZCBhGgO#f;+F7>PgSYzZ+v89<1}_e;CX5TFTaYHGq_p$`o-4iO>a%|!+%A8=7( zW5c&a0*pxV1YQXoN|oQ1;P^7nJ6hoaQ(o^BNW|G|yZ)|0q8F~A2DELB2b<@C3d938PpDy6wnuyW&)ZIpAmF2CQTI2VS zWK#S~uH#MHZ8WX=!WeCCMn+;MBKip+;;4xr=+-U8KZ3-&Pio{W#4L)8NOmX)P)z?H zKI$=S(2Pb8&TtxH?L2BHH=q8!4$%UnNfw!yxKHpAe?$Oa?c_xeV>lRz0H0)>{#jFv zU_kzd9Trkvit5UeblibqVY*u_Xt}Kw&!p-?(~KJp-73hZF!fyL;^2Vu?VPecHQ)?x z#Fc`tNBRnAt!9tLABJ!G$*o<%nAEnv1Nh3>$#@b8ywZABp(F^hpDcxb4&gUUGG!+JLZ z_19)S*4>R`b46f8$n{6s1tmRynBtP&_M-60ya;v%;>*G_%FD->mlF5q|Fi%za2Dx2 z>(xGXxQrX6OxQSLni-<1ja2+1*FRKDHC622X*#s)^Fuck3Y9Z;=8u~L@@sYn7M&ce zKX2>(Y)KK z13_Dq=h%LJhV)UtweXmO!(zUHf)aqmmF9&j!zQBfJ7lUiZQMx00|0sI)uZ!y?ahh~ zYo;yR-K;=$?ed*oiwPH3F+Ti@?dO9#$1<^*!47mdOT>d-#+3(2AcRkam~^5#2}lSD zsrk?I0)-LJzI`5lJCEB|50zbu%$WZ0y7Rq5cg{{I*2ofr6y|fUl^{lf-+Rmt)?ldB zLG+OdG5A=sj=B(IFs@~27=o5LOy;*kZ!Z{zxeentd{DS3VaDL+-*}@wp!O43N&LiE zo=_IzGbXid<;4sCqf_FiO-4$W!rNZ;RQiNvT%V7z^TiDHX>N-lMOV01#A|wH=3u0h z#@m{i`eZddG4M1#wZ#9;RskKKIM1t{*S(A_OjZ-JtFG+dXlRq5H@bFHjeQA2lA#m?xMm!mbYvDY0PD2GR0j;wvasKR+D zxsN8DmWAdnpE65CZ0Qq;@i{Jc_sGb2X}8iQM#oRrsL4j!s_%KWx4c(nEEr?u{* z>wF&1?&MJr;_2McS}PH6cQZR@{q4ACF2fCoKVGXg+~R3>0A~u`<5!rU@lxYc1zz%i zNvii^eN55%+YE7rx?7Ilv9zpD9{-g6q3);3sbhsX%i|X-`{mSHI{>7z&DkCqbBJO1*{)(na~9@weQ%> zx;oV|J%34N09g9%QI@_Sk>2LM(knX8EbVBy3>eBJCW}UEHc%*8n8yk+!_O;g{{r0Wa-2U;TejF}JRlPbut_VH?GY+$ARu(TPYNiIPM9-W^BL0={8lPE^peiB8RZMP47S->A7ub8xOnfz;;7KJ_M?uo zmFEo)=>@eah8*Uz@XhL

  • L>w|*-Q(zKj=X<&iVlSaFN*qmHnmL^M$#n5wp{G8@xbN2I1cIj zVA_Bv5#eGC<^65ln%#2=EO>Omq0fay&Yz%&ar;l_dI?1!n6!@4z|G1u4nEH6Ca0Jd zYUFcF985aYb6l>ALm4S-ZkZ^(T`g)0^Szuqn5KJ8dWhRO( zw;lL{N=n0AR~cJ_R6u51XE$!U_}4eMKC#pl3VU&blyC~BPfDfXLxq!wr&DooL?XX> zX*g*9AfRW}GDyd=ip++?Tg#&U&9i!uMTL<=Z7jzR7me={XQU7OUV9jXQC}{pq+*Bz z2_XC&LtTsoJGGAV?W62;Ikt9c%5yKd1j&O%v4WcF^gzTNCC-3qAC5s|S_&#C}<{R_r5z;f{PThD$Fdaco|=&sEQV#@bZcZvUWWhL|TWk--Cw$iN%L4Xt+MD+iRbG`nG z$*@14mMDggVn+7%i_&%}k*BX6k^Z4)9B_%okMW7T7|S&J2RX&G=sQbg!X3{X(@>g4zADiE{Sz4d8I|T;tey zd}O11`^a-FXu;`Dy-o#Xv=36$w;A5~uo4o`m#D64Xx*|=wsOD#i|MEaIuYLz!p38k zj_L5Qud(UlR*rZACJ7<5c38l`?{@ZiYq+Cu#bzy$yay~)&Ww?SI|~G|&LS}sBUa?} zc~q4AP_=%%(_)gz!cZfZf~qWMbho+*FGx?f-l3>;VvM6|FDhemr16S*ZS-_OSRExE zNKbbe^+GC4FVdp9CWOCU3@5#72spTghv)ohS9ikei89M?bGms**&V z2`sf>T67ci+{GT=O`Q4ti2l0KGk(bRt;J%m1Cyf9ylCPetJWQDMY+@L-N$#wt5{n_ z+JcUgITY^VA6Rr-lXRkf6rhtWRan`517lrDJa29#jAa>J`72G2vcv{kfJa6)_cw%> zemz83wv*mI)D&Vt`O%}Z=~{!ua0l7olnhE-F1tDS=JK@$MBrjksN{a$8v8Smt+Ti#zc+g5vTnQ=n!11VjoEm1Kt7CS`#t05*Mq9EbwN<*0uG zQ3G(|b2j1%3UVTx^-o3WV?YE$IoEELqdULqcCLi`7pLVwF z_6XX}?Acrvgm6d8I-jvNe?ijF9C^=Au9ly^TS5$xvcKa|Hu@$+8cvvelte7hY4 zbAr=bzx6H3^8>M0t9xHs#FROSki)L00x2q|$NssS@Z;tRhVV+APx2TOW#s+mpZo&Q zu>}>noupbh)R+onLM>-qb?~3RRIFC*Xt;K;V4ea)mU{*w!AEp|HVi_pJeN7!Qz#!? z9k&xP`tuEuy0Zz49=Z(jJM{h7ZCb4sTc_IDlR2AJ-_2u*X~E9kJD2=l#pZ{9;yXS~ zZ{ju{FLzozt^(`$kJgJdV1yg6I<{Ralp2o1qHSK-K$fI@ll;5eDd*nWVVIKG6yU{jE0W?m0F$=}4R@`uLWpmnNZrXM!6?ScWKH#GSMs|~* z00WtE{gwtGxA{C*BgZvV5l2HXR?Cc18;9Trx#Kq&IN< zu)B*I3u-E;5 z&g5{p5XP=-Rvav84Rci42tf~1g^nB9I9-hw9!v*uo`fjAQpmBAYHVI%Y{oK!2kqxK z9^uv9Rozp^*WS?fn<3&InD|e<+c_9Nho&1(%bQfMyX zSuuQN2h7zk_)pr@rXJNg;cPo{Ok1p(2#QGFy)f%ldJc?M=L<}q2i0hXsYcn2+1FXe z(BaOTloXta+~(LFI4PJ)D|3qc(WXv&)=>hH(Q(XIxEOJ&tHgAbS@=s?#B(wPWpI1; ze;K?N#}5yrca=CBLJ0~BVql=Sl)&ysjN|g1r>ilMOU&RRver3+&MoaFf=VzCra!{$ zsVkO#lT$bN#!@ROH{fK@`F=tkF`jCm7H)Kvxr-#MUI;loR=gf*_e!*jsknlG5RBI< z#{H|Ca~8)U>b?HIHbTdk z)IxQjc4Ah@Jq#>fRKCizlL)0c(8ZS)@9Fz!G3JY>9>z(>4l5Rjrv|UTIe)rnnWgW& zp7Yl}63jy@nA)n`AnHTP7_wBlP@Tt+lHazXOb8dh2ZH$3U9|bOQuQ3aOoeSH`!?qs zoUVbp7jKtd>s9(tIiZ$obu?C~=zJBmq~Zu~c~k6oS_2a79Saxhhc6HGmq6srKJU#I zr4QbRX4(eS;;c+43(mASNfNtU(-ML)^+m;URe8mcF@3DLZW zX9OR#^jlpB{Z10`W92f}2m>(Dn{KYqTK9yX{@T75>< zD%qdrGzXrjhg$=mi3KD|R>wG)T}k~(v%=pMq3c$U3J8DsI)f=*^0IYE1&7~|Bntbk zo0O3p&-k~OJbp{_?9u;*Fy|X6KcY)tfHCiWdz*AcTDDpt!R%U}_3hQi8zhz`qV2B| zPw=y&t-t*l>&jijIYx9r2sttRCtbq#d_K_=^-vse_@Tpi(NM$CtcdH0zK+H5 zN`Zg&d_G*nD@ixA0p8d&Mteb=U8LMCSR)L+l6Tz; zoeaUWSCBKTTE0ZsZ?W|0{A=3t&+y}WYRAAIKfV5u>dSC# zLd*2!MH9u+**5t-?HoA|p$VLyKc&{XLIVGoTxhe!xs6YIc?0TFpM??dqRe{HGv+LUIv*yT|A|HSfL4e183hOC`$4 zkJO4c!^xd=G7}7kfAxHrs-m9-;bPHZ04HZCs$g?*vZ}&oowULHL(j~uQ=*E{C;X|r zsd%Et4pBF8)3pdE03k|i`y|sk@A<0As(s8Uj*`cXWEgW<7B~~MmWNSnZInEYc*oi; z`WI^c zIR?rp90_fOGz)7#i8taS!!r|i6U_>e7!A(C<0;SkR1qk!T>|~Ssg#X7G&yTO> zj?q;G<69UX&eZGV7c3F%uZnWD03* z7)W7%fv*WZ94@rWnLQ}aXI2$H(t;03Y7-bumuem(fjjKTo_rQ`G zxX&mSXMySnr=V@D6POVqMbMLmD_?cD5(m{A)TlmDQq(6nqiZ|u4wcvTBUwABAc?`yjew;1y z^FA9y&&2sBKsBiJE#Ei9BR7SD1icj%6b_76Fqlow5I_PIQ?99&1Y8H8S6LMF z70uS-)He%;lZ8M3ZBWvlE}SW}jskuWW||L;>K8yddz&t7x|*E}l&U|oSx#LH?7B5a zQ_Y$Ws^Vp{jWS90Ef04v>$9s~yPzNnpd&7zV)^!CP4GzC)de;9-5F>UT|367jzH6! zM-6sou6WmkY0-9YN^EffAV(qN_H(T_V*?j`e+>YUu866a>tusxXxDH?!twF2wk2HP zcuu>``k>Soq2_QbS7UUmO4}Z?om=(?WB&kwJtnhpDa*-biQjsL0!w5OjN4_EBV9rch|acy^^a2pwts`A&Q3c)1cPVI36QXgr2r zi4xI0L{sK82Bz5t`9&8S(kh1Wh|!^|RDOL4^+2%VFVhu}J*A zyME?EmW{xf$X=0wdUW)h%Y@l2_3y(|0coH+S=ZAma! z7slveAupF!R$iVIfa0cu{yX6fXz^d?;qquAa*Fuv=f?is>;M}X8B~j4GlE8%hE%^b zx)ZdFm!!5_@)kKqE`%)jo5#}+a&W)0zFK@?K?d%30o#+qco+qhj92r^atKPm za%9jo?V4PiBEsq+Ha)q?Y98=2Cc@{#a`Xy(gi1 zh=O6YM^aFd$v|>KcD%JN=;}~!I_MR^UEISZz*o~78?o(c=eu!J79AV*4 zTRI2x?&n`)qSH;1aG(q3{$al_*$wE}v>XoCWjb6C$RDP@2IZ2Aj4o6y`@Izjbe?>- z4hDp;Qk7yFBrS~o(~-8Qda!~RG`8YSzq>%A!e&v)dWsk{s-6qI1ptyA1!%+&e1unx z!}|c=Z=}T;_9iY)sScHE8j_>VD!86p*d?R@mEcx?jAexD&DFw!ZfXEU91Ay=ZUEfzic04%|Lwfl=j8+%wI2u>j z(;WXp(4sfm$-CIF*DaoyT>RN>hi^eD1sj9-Y3U4q*35R8S5j;6$Yi%{9ISy5(`#x_ z(5EzLsHNWf{)l|7vVUeLE={AD_)PJ49Wb!}+n35G+cbNm8*6?n9=TU|=9$`f5TqRE z7sEwmEnKaxkhHik+LBoS$jJNK5nB`6c>RijOWH9stv9BDvYt#K(X6jotZQ#CLoP}6 zH6M5ChD)?I1btH9MpPP}YkdLekvD^feo+PQh$+zVGl(|(yGzGLJ$?wndT13|G;cs9 z7{~UMVCC}m->yj}_wwYQ zqy-sM(qtJov*7!)qlj|HvzeyN8Q;uNakXdrb~qtcm6yz!h9I$CrB)_yh2)RhR#&fd#4kLm8&1$wFMY&s{f`H67gu_s=Xd9 zlA_xIAQVgM)w@qu(t?H9NjShyy!QwO)ERBW5b!{_LU+8#`tH9A}ti+PZ2Hfzw6d!ct1Vz?Yg5E+OC>^{$UXVzFP-i@7A5xbuQ=Nf=OO5){V zSE_r@P%vd&%2LBH$;_itS-s1BA`=Pe^%0xN~vZim*i&|~p981%o$*wy(3iv}X$WHh_@Za1>CFS>T%3)dYBb6MZ( zAsM!$d}XQIpIc@P2ew|oD-nsM)dn&SP~WBo+t=`*031FDUSa>9*6E)ej#a3qu0CZF z0Z)cfQwEijg<=W3oWhrh>w8e}w7@6z4ct41?aM-uQv@U6y8(Pv3M{paY5~v8GTC~U z3Z<5WW(34~ibzFNv3;l`%MWOC?vK%nlm<1Pi1$Un{&2H_9{sh#8x%$MXGdF5{q;}; zm}IG69*2dw1II^GV#t^TBQLgMAS7()ZXeem9AqoK(6%S}V=t;qkMpy|jNZ#JN}FE< zu0PieRE`&#O(x67aih>`$q{3-Mdg#23b{qUvI1_)qbEYT^# zsIP)p-a|JGbx>ujw01ETjD85Im6YCMg{RH!RV5d(M$pCeszeRa>{{ zr@^IXncfZ04RpQgeKm`KVbQp{%hR8O7HY+(iPu|e!j89a7N_Lli*6c!0n#8KLS=T1Pokl3Kq zJDTi&K7o#=NI7N4=hxdgREN5z)n1M8D^@bbqZlC%eZJvjtzvQ)j7Tr}t=$GD5OO&J z2;HZrm?yi&>l8k3bug3PtDNq2e17$I(cQ4=`zzm$^W5E16SCt40rU0WS5JtTlz{33 zx*fUcO#1a3?O8M0LCYN=8X#=hKTUjAED>;4I+dJ|e|wm~W4rKZJ~m%;6Oc<-dY7~1 zY_anF4-7rt#};GKFYj;C7)qKhDPDQbbZU|!Vvv5kNeh!v_}b$5YV+~?fwB+zjos_3WH*bDd%oOkj}_Ub>_<@oR9Y}4}#ute-SiZvmjF#b)Q^&VRr z_)O5*JkFZ^QK}$}16I{_H#>ppJEmCCGOyc$E#5xp7TY6p*u~4~Nze%Y(A}ODzv+!e z7Mou!SV1 zi}_hMN`bxNK5OPMCm?oLy&dgi%jE%yN+j?z+6&-1&GtwR7TikC5((tEg{SF=+Dlxg z$4THt%XI`7|D=KVYhNDl!j`xsh%Qf zPY8@sT6Pr`#!jFT#lml>`kifL?l!E)#Y){zqG1R%$jyp?7~sb=r7gx)9J`TCtdElF zzy5nEk=vSe%*FItX|R-&gLPoZ7!TJQ<@TlflhaKj_TB#%bR=t{TdOr3SIDTo zLfv5IgcAN zim0qV%lu@8Pxr!y>RZP_lr~*Dq`@ri{&4MU?YXOMd?-= z_uil++jgF_HY3y^ug>pKzqmV8W+{Rxkjc+>C(;tcnLwK{m%<0_?ct_ah+ul;RS#mj zZV(HYJuEAfMM;!V1G%vQ37jiS-B#1fcnIj?@cbb0=DHO>C_Kl9`&#@xPE_tU9kN&P zAn&fnjI9W}S+;F`#C&~|4Lz0ceGt>?lXNSnvOvV_kizAy}wy1{q*A6Q-6 z#@x~*bw@};bwg57g+xmmB9y+@518VCp)&2bd5ESkuZP|V;c0$}$4x4u4XB2e4pU7H zW6hz8rUQUY+fi}fms95`8Z$DaPFIEUkI_)z$|lcYfeE;Ya3w$Nl@*CUS9Xm2X*PuH zxC5WFgBhE>D|pA2pWh92Oj3nSk0JLGkg1}NszOBky5zjO?C0S%Wu&jJ20ILV6SPYf zZ)ZgOe?Pbemx?_M>(_VxyIiVIcYY-WPyDb%Dt%?bJe-@u0SX(KVk;qf^3#%(yIozqm)8$nX_zSDGGbh)drJ9)d${nf_I25q@8F-8O9 z8ZuTm9(Tjj3e^CwAa>NpIzwC;(BMvz-n#m@&guA<`y!k)R!FGI|9c!zlo$Q)l-2gj znz-TP)=m+Tc%*k>==U_%G>qOOBJzwOhdN&EpD^7Dj&`Wyf}xPEt$^;T1LH+5iBA_W z+(M5W)O!EomZ9J6ymzcYqAtkUC!pvNC7bk17XAs~bNuvS#mEdL{xO|9s4@UV@~>#G z?D%a4l`wpjb|`}0xcYw84OVAdAlI!Hb-;1J3l;0@so-WamUD!$9&_`!U{=&Kf)>;x ze>`}?LSe~ChDPiD1Ht0Z>Q6<_LDo$eeVNTm4zC*ZAQj7 zQiaf?hds$lDe7_+sWLm?`Z zbZeA*=8BYm+699v&P>Jy65lMH*$k@i5gg7C+Uyq5|N6I08GFa3lkj@}ny0@}B}Eo6 z1*Av?6~o8h>KDKo<07e~;kzNf+k&1d)%8phrNgSb*+#UdxF#TXRgRE44#n54KDYoT z=HdM;@#VR`^OmS?;ySLF7}RDXCH-d{fcT;}<-Eh)z*@(mM$x zE0?o{qv7Unm+QH0w~gzh4v>BDVCmQSj!qAYHgR&<->1v;sfHs90sHkj_C+@cr0Rwu zz=_N?ejbaz0Ku&JdlvYE6X+>!N0k$6-=8d%BR)+RlxJ-t^%!Ton1J4<)LE98ynmbj(bZ8efT@x=x*uPu98J# z3vV$Tl21>H;W1)%5x@G33LFL^V@M>rKpU-ELradAEV$Y%Y_MWI48sqJJ1qZYxf8dU z=5H$ZX+N#lEzPU3Uv-`Q`!urXLL_87_~mM`W5vk%RP?gUa%F$Xrv2Kt?-P1w$UxOD z=f`mCAO-5T;x;KR&x%c@E%8f-m(`zU>4jeLiq+-Gt4a);#L3)wt)^Dp4RLDe`p9zP z{!7+@=!16cT`bkpjIt{D_ZDUHS+PrdNPYc*5$&tyBPw6CpHM1kYSyK9Ar-ajwz0t<)}H;L zbLG}PG1Z8qRtHs=n0xm_ihzgoLWO7&P)$jYdg5)CZ`j4(z?7)NwAxQ=x$?GN3O^-v z#gu&c28B)7n_nx~?Vp4nv44Br8H}Dfj@sBBUkF?bzZ;{O6gYzC6!NC;Vn{d_K4``- zzDK9DykSCAHDD?l-~4TG>V@2(p{1Q&)AHnmS}fB1kdHUDu*XjXdbYdH21`Vyy`Tp* zg?ZCUc?UjKDWJt2A%5GFC%o%dN?^ro=z@wn-mzC!8}@^^^(fVFcf+)a$A>D>%Rr^ zI$`?5xjnUxNg?RjC|#_YEatvf=#*J=%VWIo2iOxa{7p&v@mayH#(i(P@A&FO z*x44i+{&wqJDqjb3@;{F4A(Tsyo6dxZ?zf` zCK7Vw8TfboXQ3Ik&gF3!o}}2!72cgvsK$Bu7sJ~$P}Q;f+nJy5n)+(dt$QRH{wZ-- zROfG5VO4+N!Fh&eM{qbLxW^G#r#jyzyVHeATM7eS9eu+DY%!L-82sn!?D}g@f^E#(@OfQ?4oV_ z#d`|z%UI6W@y+X8Yd>6O3*(};lxUD~Cboc=uotpgSe7-t-uzUeUfF;I!xc&_V(+aZ zkJByU%SUamkH+WaEop;H#r|t=+KV;u2$}}Y+D#?2UV4iARxQ6qhFVn80|3!5hlY`y z`;vo5DRPq+Xh?bjbWay-gSaJ2r{aft2-xEIeB6CwGOe6P`#&?d4O2 z1t-6Ty6~(DkHL#4x;Aj!N(|m)gktnvn@$!zLB~nxBKMOfy3l!MgiYA%Y7}F@F*-Tg zU=frMX2@wjn}pN75DFSte}$^Uy-K_Klz|yqH`|5P38GyWnjL$~^W~E}sHP(sYI?l( zcmUl}O^Y*!m_R08st3AxKmAqV)Q$B6Tz7mvkVJN`7fH-N$MX*>ts-cJych8J`dBm+pKfq?-*0s?}GB)EFV_4C}py48z%bukJ|7`2|KSdD8(l^@&v>UeT+ z?MGvQ@ZDUII(_tH+z0Pz>Lt9-=Rd^q)9KeCvHT} zy^{~g#oen|S)h7KXX%wzl16qFLax#o&IW@Ep;yUU`RLyD;;L{7S-Tr4o zrE1`D2D$qn@An~!pIlaUX7ytHquWd3NYgqg7Rwi~EOSjJ78S5SliA>0{Fg282fK5Y z{_G0K0;9=RYc*n3Q){l7&1RovA}1|duKW_(S}$5N~^`^#tW%##-9jR1>7V70WoeFH09UUkyO> zKy1*7&*-LBU1K6>8_;h6Wj617>fd4Be$t)qgFg@na95lJWNT|U=)ZZpKVLWM{r36# z`r+gSIn1_y*vl^BD*v%c%kXLctGk}xw!FpPqoqf2SOoWfGZzV?ZRNuHUQwt23|Bhy z{U45o+{z%FlziC1C~dn!f+WzZ>lp$IPXTX`p#DNFkF`SA<3H&(Ar`(;I!tpE464xJ zb^d9v9qaFji0jw!*0$2b`SuDUQ{^-@kIDtB)-xh%>}0wqS|yigY;LLi+VeoA&RH?L z&8aWDzUabLO8_TK!kv5|5!_zt*#wa@#C|7F6|L$;?r_lj7E^Q02!!KbvXNZAibW@jL)6X8mMqG*LWlh`;9*tU@+{dr z$SH7}bRY)&^zp#O6(*1Ni`W}|-8^ogW zWz}KYJ2mDx#3{7wHh?G97O4%q_iUxR&Van>H$7_Us6B{COaQCn%L<3Foz17(<}yol zrLG#tW%-DHj?VUX2hP@=^X1Fyo!fVb-c}T>YepWlN?d!uwbtwUa2^oIfQ7B?5}1_p z90=LxibU>XtEUw)S{dz&aB5mcDyKV)=#PMR!{?_>Jw;Jq^10hi0?P+dmv|GLQ-hu| zbP!z*6OAK4k^nlGJW9{f+Uh)@(twvV8rfaCBNaj=_vV}U!(ml)G}io;>;9qpnw6U(W3(c9c-4AAB>_NWWq6|5DPx< z41cJ1q~_yRYNtcsX0!Rfi$(k+e8LAH^rZ5sGw#J=tU7_xURkjJ~ay4v>Wsi}=My4vh*vY;I=)^So(2bu?JV4Z^P2Y|BNuMaP`1=jdDoA_*VBOWWrku?UgdhA756lrtALA(>r?}fQM;p=;l<^#`$$CO7ifQO zr5+3>M_@o$ZM)k^JM4p4xZmgu(N=ITrK2 zJ_J{3?cK%B2=}zn->sdUR^as<8XD>dTObpL7D%ddY^oL5&{?EWApU%7+I_N6a{!!! z!--k*nBn@PgE)nHpBP83e!b|NZah z*NZNmuT4MR;Hfds%tSXIzB!DoFDVyW<}sv@AIAH5J8h0XXUH)fHM;#IUb2b$;zM z*9Yo)&wEElrj!f8o7||9n$ww||MxIUFe871dZzu7**c0(#h>$dGCpgVuJhR0{jE=O zDHtmkw<9E+R=$ct4pSj|M*xQ7Ez7+Fu6+wp(uK6oJcPu1UpaJ3J7}D;7#x|@sjU=* z=_Kdj$uG7q*jno84mYk}$#Wd%i46wl^WcA{p;c7Ld6}j z^3Zeo!_bxYrA?{OgSwPYc{-m{Imj8-gs%;Lnv>4zS-fJ5F^okAM(*8u9L!P&tIEd z&9=UsJJ5?$P(9}|K9)lZGAE*^7B@-n*+i0{HFjgB!OXe)$k|KSjAeKm;ou}ZsIeE|J^oIxPsV&WMx96+@;`*)wB2shM*1fHO zm3wE$4LhjAYRgB8G?2DadJz%Bgw$ict(_it$* zGjqT@BS4lFAVrm>p@la40<}nl7!>k{a1fnzKNG-of4Z+k^6}ETUdwpWCDIiEb|%2k z#mZK`lcc#EMXO}Xd60DxG?Ad$I~Ye9_VDy<=rA%miw}Ca--ae>iL&PQ2#L`?tN~0F za5s;KzVid9UzLNI5@2u+0gt@kPnANcImvL^hZ1MAC7I+D966`Q+cP4guky6Lc1-0S zzasx&$IwM0A?Pqk&h-z=ubB`1=m>{J#L#PULoXm|RL9b3cLMx4f++ZVqA%DImVe1g zw1!+9%@)%pOjxpRvGP6RkXw}h$lfJIrf~KKBPmhfCk%p%dl=gNNQlGwT!u`~8O`yu zn=)@$GIZh?2n^(uS*Hpgh*bCB7Rvuc`ABk`&Sjaaj5e;bw=leO2-{ zPCY(hG<)(HF8Zl^F2QL2WSF&Hr0JiebMHQR@cdByC3B?ku`G8ILQM@h!7VnJUnftO zSxJt+{x@|Xk(T^y_-m#W%aG(?Sb!?9^cnI|?{CzZ94FoH=e{|m-QVW5a0=roK1t!% z0MQ3vTw3<_9Es{xFZ?)l9i4iY{fV~ctFlbrYhn^o;biD)ht+4WaskBWC2)j)S;z4^O$IME=(F*;rA zsOJOAro~7qIx$Zk0McbadZGy3|4mtgYYGw`AIQ^~TecA0@M*!e+Pa{*9a zRD^Rcc+z;z(i~R*t7&b(^MVt`7qrQiy?fpJb({``fg$rB0DKr z9bhtBs*ehfRsa_10FwS1z(v<@bb&4axH|z3j#99>-re014Rd2cotdh%UsII)`Exj) zizvSdU}>iHy@Jv3M0j&B)&NQfZl}Yg2HsK{JAiadC+4+?R?P3*LpRUEhcgBk+LV-( zzF11c5mU1aE@PNp&w0Iv$HcmLJPpuK@ZyD79_;S2RJ{B0Vy~p2D09ePQ+Bq zz+?0K`R`EN8mVnhG&4;J?W?gNgqwo~(ZycI&d;a`O3%i&>rtD7;&Z*Pc#OY6GMpOyQeuEP8Y(psIyx{*Z@~Uq%)q( zm>}Vsz^V@}Ig;-U0M`S6Fycs8cx7d!;o}Bj@-HI7( z3!xNxA3usXZ}kJ}Wv)ZVB8XTjXx91}zP*GY=hetzE=bAFAbKJy;-Z@|^oWoo=7o*+ zMlvTHm>sYc??k$XpR%XCO__#-f zJWPY|zQuWa5UgiGvFm8R;LB6e)1#F%ekpf&M3G6+i?|;vD=Bpq`T-I#STeiV5Y{uq zyiFW?r=Sn~hDjy4!FniIQdmeNU{8kN=Ha^54n54s(wCnv@N3Re+y}8hY z-#yTKYmwI~&b#a4w6=X)og3QWPZWP1j(<=7Do_7g^`7(g=%&LFPdr4qUT8hUV%t?? z@#jJh3h(3(~2iq@>`XY~->vQZh+8xYP(^%(6Iw`_q)S zYGV>Anc`nn9*Yg1P<-*;aD{>k#jq0w0Iw*5q2h4HE_!s`fB`QeFGZ92Pb$9x>LvFP zr4PdXj*ME>??6y!{MfhGhhT=5M&!q>_pw9^tqQB#$n$FlRxag6cJw$YEa#6mS$1fh z97(9q(bGh>+{4o43t{H`uT6*~fC@C#j!_$CN6iT}^!Y1@Rm zlA6u})X#=w@lQMNG^6Z()oJ~HHU?bQ^z^&?oMuRT+|$nQRR8GFr|r%K369^l5*il} zL6P0I=z+&Yt;MFMC&*|rY3%Oq&Bqa$BB!+r&n0`aXibO1dyXStAI_W^^l+8V+CFyudx;0{d!Nn!Lf=^SE4~wSD!AV_h%ntB-}XE7>Unav9*24y zRfWMFp(ecLRIX5`n|ic$Igcl)OVbLvHA=OF`Nhe~TBUoW1!+o-Wi*=e5Z)!Vn_Z5GC;aTk!q>r ziKM@Yfc$daz==bm;--X=rJ;UvmXIYaN*$YdD}&;MO(XFc2@)hKJC_!|KHW6Ci<(7~ zvsFR4AaQu+MulaPbbI0OU#fR*`X)I@(k$@~3&Y`Ip*=_f8t#qcFaHl^;b|ewba+&Q z`ZSo7$viastl{X|g@x0f;<&%s#r6HVlf1n#70={6=NI`e{|5>F1E>q3b;d^*yIsw_+0*D@V)H_uqKyt2a=vz};OW@g# z_i#j(MqKWGHW&Z&4kqw5nur{Z8wop`P(pICpgBfgH?IwLnqcMAcb#NnGw$R+T(1ZQ zely$?AxmZ+9UvNOq(A6~T68a31-~Au?6U5*1e!Gc7ZW;!P8XeIb2tstki&&dYJ-!^Hmr^kle* zQF#~|4{}=Uu=ncJ-=twPu*`jhTh(X!HXbu> zsQRS(_U&@BC$EVSF1MVV9FU1EexxvR5I*U%b`ERqSkCc}#DspZ<1)@@M_MEYU@w`F z6mgXzgRYEjHrinp8jBPvL#s~99fWf^4nb*06ph!Nk4qJ%eL&X6wkTMi`fuNrg_DU+ zz~ZIuLoGS7IL>rcah-XsV%?upl`m#t+mh{UQnQ{*OY>ajuSZGyRp!Fb|H<{TA2m=e zIvNS&2Wm}P#pb~$Vd$hlLPyOVk5D4ofLusGaFue}o{k&hU>Ear7dB<#ZU3w2G&EIv8e1MKN$=o${qXT64yd+p>;6M2zTNG;ws@{z#Q zp!M;52mrHe04H3o z9`Q40cdjfG6$>-n|P#2;%*d!u7TzA3(diQotoI`%s0D z0xAeWJMjeb#t0w@gjeHiHu=tF+8Yg!>%msU%biHSeW!nGj>(3WyY)Th>NmOVF-FLa zWbv!18*OmtHwLV!3%kG)$u83%D+a#7{Nww0)@O7EG@LByPc}B=#%n|@SOy&oeANBq za`G}j&oK#te*p2RRGn0;TvIH$2myP84|N+FKgB!f z$4vnQX_r_2tz%r9l8u4v8!|eya=ux=q(}mHvca_{t=%)Or8)$=6WSS3gj8U(NCl2G zowsz9aUBq+vXtYt0c2eY3WRUD@?T+Uf*nv$P}-pZ5Fchz(sSqsJNw64vme=y^Ol)M zD=nl6usTgXcRZ%^zyYe|{$Fv{J2lQ^WIA+d7{r@@)2Ky~fk**IMsUT#wfe{TN=cGO zvt@?iFdi7n=^&ci=0OQf{{5T9Q8XE6Q)KamVmNRgCc5ov=3{yA0Q76Q-0^lw!RU?Q zG=Z|x(&J_K)lhA4r}iGgg~E(5($fc46B(P922>Yf2?ozYB}&P$DNJE5zQqg)xkF(f zK1I2Ng@OIr;ZN7iTu8X}D6s z^4|#S#_+Mp;O6Nx#uD8j9z$%Y_$`kfa5SgY8V8brcHF`aT(0&l<~73Zm{q z#G@!TxT>H9Cpgc7{CwkQXx)+i{(wa;FeA++GB7kGGh|_DX(|+B0kknTmV|A1?Qx$y zWPpqh#ooabBqBD(fud2!lqENL2M^&sk;0U<4DK3}H8s9RV*F4iTa&AzW@h%aH&ojS zo{uk;AsydWcd|g0(goIq|B_YNe6BS-dC!Ok4rC9Qn|K=BwXXawY7Xmp|1C^(a@3Uy z`<2}AWP0!SiCVc$=Vm_R3XoG&?zQPFR1rb3VP7nbROCIQVxe-*z zI5}b2VO+MIl()!fOh~MP|JZ4`g4lH8a}VI4(`mka$M}H_8(jZ|NJ~E=5-HIM`PUj< zrz2)OSCoDDYa&@)Br=PyFsNfvI7mxICDHGyh_smSpp7k9bdz_Lu;!|ixJS$b)^Y1`sck$aL^PK*6-WK`V=?EM3qJnYzV5{PYmQsxlQ>{%aa}A zA}|oF`2Q#rNXriwTSYR-BGP<9GEKBJMiPzWCt{EApQC5EG4xG-7ML?ml5`cU{A64z zFM|Bjq5M=ba>jBXWlBLTh6?|4bSS0O*7Iwv3T!FmOKuwO0xW`HMJRXq^RGyyJjMmw zG2F)7vGnDi{S{0)NnjEw_b0~lVh)p~UA$k`WTnk09JENcsGP04{w;QESi+wq{*AWX zZ!~w|lPpi#J}`$jqi-@k`>zSk3G$8pPwaKH_Q^gZgF+Af>(ot5Kn8I12(sk8!9oo%nyQD4A#e!%VX!@m^ru-oZfc<0$!?M$?xBTgM(jeBmXD& zg5yl)`z!O%+}s>1eqRXmn~8iS$bA{a>-q6+*1+2i)O%0~*xEsfo!N@w7qB(B162$Y zeT-*ur;YADN`FzXcY|dGjg;ROSPUI4)*<@0JsdX?6B9!&RUsk7P(Pl*{!a|{ZD8gF z%=W%S*8&+0IPw4!1-b>(|DDy)A=rE;D~f|diKl&4P}qk<98KniJ-7m~GN@Q^aBv*A z2f|XFWIi2Q_L~C3hL;k(o7;8U<4{|7Ump-qBq)J@LM8A*>jB+u7@^hG)&384{$1b1 zsHvfSB)}^bSn&w<6~s?~GMi#&19g8;JYgG3{oj>dKj&I6TYI^az{mf;%eVgj-Y%k5 z|DXFJAKQu|=?O*bUiy*`)_N>Ii)^=2-UZ^RpU zT=)q=C?r<}O;)lB!cWv=1jn63)1EIJHS~|6#zJW4U9KeKEzu>0#AjIObiZJw|6UlG z1V7QpLx$kUJ+MBpCGjOZf;IJp7&$Sq- zwRBm=!=}J*gI3Iy3dmmVGUCCoO3AV*9xO>3XKEr^vY$q4bIYdw$<; zVu8I0&A3%gG`-?3;)6x6yY4!Yu})B zzOLyAR1z$y>OaKsk%tn>aTzP(6=n-sWeHXOYgF?$@QJ6jbp=v_nXyOBkscN8_X zvf8Fh-jVuY$y0sKD{tI^}^Jl5&SN8tOs;CjUF8N7le z-#>~2XVC3l!3D0CSd<*&Q8!NDKS8rWawqi5!N55dD?eU5= zNrPvy>Wkk)p9Ch6@cos*s%k^Z)k=6~%iW5Czu!S{%Eb@m*U9(c5^Z8GOIs+xU3>4? zIQ}21-Z8qa?t24`)!24pTaBGGwr$(C)0mB&#I>*b1zD$fa4XX%fd+t3{OkMiuEFQ|Qcs9I z@Bz-pg7>IKh|n{Nf$7^EmTg^TIK>8B63$*1kR*ON+g0=31saCifA^-w?_Eh!aacaW zdOKg)P;t!r>a$w&7856<4X|;xyV)(}b-(y5vUCof<1js~+VX|s$-ZPYPul+6F&^}v zD~LV6aX(qJHrhDwdk>dQPft(Me)`S1MPE}UbZ|h;>U~ehnLe;drmZC(rc$BSNh$*3M^sg;D#fOR?fa1ZpH)lD(`b6KYQ-h1yYmMzRKnP^=wdE zZ@v-&M*h#$+9#{F>#n)H_J0%d3%l*sE$8+ys(Wn0HvlH^R+mJLa_LOTW^3^Rp8rG7 zXL(tx%WIsje)F@Jk&aJzTuzc)F2C=Qj;ENarRLBn`x(FeoRTfu*7%h7XTwZ*+)t`7 z^jKvz&1?i#fZqvRarPjE&y=4np0k}x#Q{A{9FMyTX?=$Q3-Se)gzAutQWFf_iOOIt zq--@TD_6-XhiNK0@-y@6McUj$YSao!)g8(O!g;mAIodk5?xE5Z2t%qb(oGnkv6^mP zQih=%-&(3Vm(Q;gcnUQXe${or#1+$!p#Bjxg=nOGAO6jv1&QY3^ zK%QOKp~;EO^#W7HUAXA4ph>cDN|Mg$QYm(C^}(F8NB41;wn`+R8!$^5hT^>AKynKC z9&$UexTM9K&CCmaiA-I|-1`SlGZd-=&$O>j%es1Q9i{gxS3qS%TZS$Kbj2w=277zs zx~Eli84DL3L-F(_bH}rY_kU|4F^E(T6pyF1Zdl-4rv%+pPxo;T-IfWU6cSs|G*oeygP8b3oBtJ1S-g5C*4BI!6K3yWiL#jupHGm|O;|ame|e{nSTTy?cP#=HJzg zL#$j?hXZz(>{w1z_U8x+C>=_Z-vvdz(GgJLXs*NBgSjKVBd(bY(V&InJGFxSZ|BC} zhO0z}BQr?jLy)mZ@U3EloASpBRD3dZ@<7=A?%HTX^`^A7-;44jRk*7<_PXm2W3+gR zV*J2hR8a|P<1VcGv>6+5(~`cov-4CQxVeZw!zL^)F-!GyZj@enW&Q-vzu4k82t{ul zc*0h?apsEO-3B+nx1-VzPzK9FfBrQ`qi zpXHjp5!82;O>Sq?Y02|?tUC5kYFE@I~drGebt`{`hSn^8vq zbgt7$)VRiRzM^GvQpRYRKt~Nh5GX^;QVvcb8vG?p9MGK2{p&ef|CMRb+AxrFGI#V-lRyKO(irp^(aFCm4hu5rA}b zU};YR=H8M%H{aY7V5YKiT(C3>WpKW^3i%Zy9zZ*(YU>)1Jyh~t8>!V<^ELt(n)%H*fJ9tql*n3#0|I`GdrxTR9dMQMn9IK{o8cSk$$`>v#v^>htQ-CO;5hk!mi%sGZ z7RVD*;@OaO{EfVAl+X8f6T!(*>~E_y{D~^n{^YBeT=M_wD854vE%jSu@!MVVp?jo@ zzNws7cd@2WQhX<|Ur}Eq5X1;m}b7wluhL4S<#mjf- z)lL3vL_E&FlZV#4i1=asgXOHJvVaYjty(er0eV_&M!Ey{{m~`3gb!RsgM+1--kdr8 zdH{=<{3u=P9cC$~=$h;02_?DR&7@NkD1VGpdYIr@+~&==Y7l2pGgnMdrTS<7A&sq> z-CVDsF(QG0Gx8BdSmC16FZZ~u#prUF=8C>TB7#RHN27hrdNqYIJarie)G*THCn;8fNPGn z+vO5=HD-7W*?2(<44@+u#>{fR>`8X|QleyMmQPo?Y~SVZ)z)O=;2=wrCh6Msv3oi% z2qzvT+M};HDcN^SQ#FG1ug~%7e${D!y~sZneR8yKXV2GX&?0 zfkW^0Uw3I0X!&e?z_#A$WZoS{?O+`VUms9SV;+|wcTl=q58}uoQp{*M+?y?*93>5|Hr2@XBKRXlZ0TG=lp8KiouaALY5+|FzN#PW=KMtJl^<6va$V_8?T?@)5 z#KjCOuD_Sg-0B&o5-z?vBbkw_dp=p^{yR)c!+wHHb&#Hg77eHak^l$& zCs;8Y$a*I@*op%B7Bgp~GiZVZn#sEC9QI1b#5Q?v6j+`zM50~WTAGIjsg}WP_1}%; zzvb@rOo{O6^(;|g?A`>ig`Ot;^SEijnW21FiHi0IK zpIP1u-H^@l*@*waLJ=jQ{IBW&%8p@h$vcu8<6lQtNw3WlK-|f{%Y%tfDwpQ}THjbQ z>_zTeL%w#Pi-m?sd>bSnbqZ(=+9qJ3`*%bF7ath;HH8IdXQI}(Z~+UrSr`CVvZpsk z^}Q1B{FP5sW{*yt z5xCMFh>PRD4+9qyXI|Q>VxEY@+m8-*?#$xGxLHa7ij==y3u+CPr%JVhzPgK^R)F9K z%``E(c1lq%T;0d-6uIn)4MFrSiqIMQ^BThN2v5#>YX1H3f6M40`=-#7g|yH)6QjzQ zI+u5Fowj=C_H%sasb2XCklyq9+{2xJvAJ8fFnnno4IEsJ?zUJTGD!O>zzoL_tLYLR zv7 zM5z~Nu4KbRN7n3hG8EhFAYzx7n{t7)j1%t*cG{(Ziw?>QVEPiAj$_ar#595EjGGlM zXJ;i#8u!@Dw!I3xp8I|VCOaNsbFtxHQ=7NslL7JAi>;3BqOpa9$^#(ldOBzbMqW03Pd!+)A88u^?uZ>>rJcT+Vi?^&HXG^-DBr}>f_X;^%(#82dlh= z<@4sjo0FwsMz{TCo=C4NG3B$gCDUfZ(O~pgO5gSL@Q!BZrXTLU-?Z`#?m2$@?Q&-h z?SjYkg4bd6 zJYZYp^FH-xzcsC0>*9I^DiRil`)HRWkI$f=R5E2Ytu3lAcL()(xb5$HFj)TcbDgo_ z7A{fIvbaKXg3$2o=9=%XzeX>oD1LtZT8cB&>&r&eR{6hDj`mG~ZHC{?&Xs!SX{P%;+2t=!ze~+M zRKR}6175e?D=0TaRDpJ5(9amTt3gX=pVl_$R2W3Q!-s7`O}{CN+5Dq7 zpR8m$+xcY8b=E;p5%5LkCWS`8<7Qw09ruNThccDRV(08>Jx}ZTur-s@1G0JKa`Jrtg+wfuKeB+2UJmG^i;z|yFTMh{=O%iDLn6|)$3cYcenFeIeG~br!k|Bi5lFArZZoi;1)5D`VPMZ*Ibf+-=AIwns_>w$I=iNMS8&R{J0}?+~&gj9?>okf*XvjzAWR6?rWvpu5iVZ<5nOy~YFUxzPB10GCCzY5A zg0Znh1#i&$zQ+X3kV5Se?py=OVKS0nuabztxRqbf&<{qt*^qeC;{?OMRWhpMofE!r z`aMNTT3A)*O2_VZmC*m%7!CV=V3Y#prVe8mee6!+8E|Ck7I-^+iSijlf3@&t{l5KyvpG_OVe0KbhvPBtumxnc}*8r0>M7whZG$Wr~^_U`fP zI=Jd+(#KvSRj)K_`|i zu&d>%WjWj-F#GU?{wWusN0h<3zVCUI?6SZSq8VUa{OB;)?Q4O1HzedApL_r>bSv2JxRnO@(JnqE`RWIu=D&Y{3i*F z^W;C%Z zTzQ`w5mJOgf>+mP5I>hMhnR!H2;K>CNX?*_xs?VheDREad>%(QUTLEwbvpj7m4-6f zc$$u21{Qm*g_Ob*B4!b%hBah0=K|d`-VFP3Yw2Hk^0))-x$wa&8FGZ+rg?Q;4q3A* zqfcS(y=^t{x>mn=NaO03oq3474ibkD&9wx(#nVt!*Dh<+dsNa>KcJy$>|%zYS~#hd zg~yztrEOU~MhCfS|7Vc6kG)TVje~Q&A=Q@Wj6~G@@fgzHOvu!&4o-Z0DOD>8ra^M3 zY8U2JmB&NKA1quMA0=KzK?D;6w{m<(P&`5udwf@a@7ZwtR0$c@cQ9=!BR`(bAxbvi zKuGhPkX#hoN+Hbg0FeL_);E=xfrKnX(Lr=CLNXbPe@W9M84`4nq>|y~)+<~des=qY z1S46IWb}&^a-@pbQmc}_1641Vi^J*l+)rH6JQkQyNFId%<0@iFMAI~3|Flt`-b9QL zZVE`))4o_lV;53F&pJ8_y!#@n=oDaHDLOEM=n@F#_h_tO6RFU_A_Bi3d!s{g93od^;^)U_ic*FMVH@h@e=bIe zUVU9sYl&?qDHKU9qfZ4XM~lR1qC{bDZ!f~ui3(U|xr&JjKvkk<=;alau01lul z%@nwKr)~j}GqIDFM8r=4ObwSJb zm%!daQG1-Z?Z$A+08i<2EXxvcef&%dHAnk2R`*3cN2ooP0Y9L7i!L@gYs-GtLSB$N z(*-5*xBaFNGi!ZxP0`j?{k{P^1<{UVwd+_^Y?;Wx@k3JMT_-Sbrp##zn$Kx>>6$(V zL~@o@sN+9=WT+Q6*sORGpBP0AK>OX3mS}$(X1Ngw$A16W0$;9VcffUkOyj@5>CiHXqG*3W1+ zdaYFr4IQ4!{ASrXU5)-72sne}oy?6}bp?Rf2IW9c>vll;t3dHqe5>hf*0I&Q;0PAj5NCr*$Ml1&*;t z25H`ttL9)-()oYJphOSykM4+bCX?*gz>a=ejpR-CU}7YO*WvYn2fGWfy6N91$5 zfIvY8UuYcB7R4Kr6qUiLZ13aA(1{aGEg_nkg&FP6c^a>@>MfXX#e{z@c;;BdWGiE% z)cE`qc5COM&X^40lz1%{+(6nRuOOh@u37Iy`+%t@;z=r*bb?H=s)ojN)Dqz8g;uII9VAsL$D`owP= ztF87N%CfuH{^`73V=OvdgzxBRvE8PBKC*v|W8k&q2hQrHC);c}I}8pEPH@_5i!!cZ z-3OR$cK=c6ziR^zj~!zy7cQD05-!faF@!!OVCM(zg26CF>!Rq`=$au`Yk7x?zY7(% z*c;dC8aiPpuL{1sO{)r;2IfO#BSVGYc`#K3jv=f}EWUp;wL?|K`$E~+DHJbA)UDs0 z5Uwn2KkLM*z2QB%F@*ldk^dEEQ6LI@!=Dut71gR6Ste8Ga z<-cc{|3*+#)ts?AkjvdlTURN8SU+N%wfJwfi-cdkqnR_9h%Zu5Y7mVuCzXgGj8p|h zo%fG7>%IVn9ku`#g^0A|2noBW<$fMm>(Cw5UAnFQIxVsOl{lasAbh6eZlAH6#ntR*W)~j zvlv8+U#p#XX;yb`$H!GSq1GqW>+TXDr9Ydj{CS?+;}aOVppB~|V=9`|o@V`5xK^$< ztdZ-n@dS)l*Q#s7MsvZ%?+93i4cz~rtL6{af^4?`8IAaxWb1^i8gl3j#F}XA7eIA} z$mTX+V>mszu+R{pl>^hg?Qv>3xhYWsM11Dm!L~|CNTMCq3IgS%ChZ4&US}K`Pp)7e zcLG^q}rvge8*dh?VhMHp|ip6d!#caeO48d-?f)Czlk&Ie9#})A0 zdOOUjst>~M$N~&Y*hr%);9V(JX#}jkp4sR%V9&4nhNgJMD#Jdy3Gnm`k$|5Mc{fRZ z+SL4rkfvy2(H-CKW`bq&l%4qpl*0gZ$ijQe^YIcNU);wxB?uI~cu=J}eX94~2uDV+ zCqM=^%k(EoEN0Ce>NPe)9Hwm2t|9B=WBiEBl|x^27nY>t35CsQ4i}R7QtaCIt*Xgu z$?cQ#t(_4{HtBuk#_p=?b^P1TZ|*s_UHVwDs(b3c;oKi~;r~9n6-oZkick|0W{L@$ zRBjFd1~raQXfXL8&_Mv=-+WF0cG2CS@;p-ffW{75=*NJ>))?@^C4^@xA%7)bo#=ha zArbdO&qRVuQD~HhAEf~5s(;sCTM%O~W;Wbm<+^W(>v3rw!6Yv&QhnA=Pv3)x? zaiOubfGON;PSdfX!|GRi@WbC%Uy0}i5U0X3_;29!1pkn0y{M0^^yL0uW3z$8MB$-K zi`q3{pYm?wOH`r`ag|6EeRR?Z&SqcR!Oqd52d9>~!9!w@7@+m`#uA~` zJrV^o(5!H~jWEkZz3b&n(P;enwGA_Bswc_nrD*b5M~IW$Qzlj0f~=_}TwO2k-lKwF z^<;00yg{|Fhj3jMZfFltm`Wssa9~bsqmrS*mUMc@g`KlPm{5@~k%dzdUxFk_3!DASNt-Z<63w~!0JmwLjz ze0WNf;jgU-@-zsjsKVh(cmW<7!(XA)!p&MuoFpXK#J4?auI{Bm-w93KK56_TyY3O*bY;* zCv_Pn-vfv(%3^TLB_RX4Q=er~R06?X2J5067wS7Sd!({Q5VoK>QbtZ=wI&%Z#7`-B z0Q@r36mp}ZZ-`O$u=o*lXcfIsQ%29yj=3I*B#{h5KN@A0VhQ3Kyavw+T?wrQ%M=j> zhKw}9HKdx&k~T}3_+ksP19e_NVZj}V@Z)Lma94v|l^GIh+oGMlX zy^KY_5y54up2#RWSGZuGVEHJB{r9-HNv&OYHlm1uZ^iPwUI^LNEquuWxmqon6+~Te z7n8Yj&vB8Fvj2)(Tu*;*=Lr`4F``fE@zTV5O*voXL#67doRSGHbA&*{I#t%rsj>`e zpm_O|nLGF#S`t&LoL!pB3ucU=Tv1zhhqY@Ue6C@dbUz}b+*yuIaB~saykt{ihl%Ce&mY{@e{rz`!EQ`dLzFR7g%A4g=^zwBNK-%q%5js@Q{h#7;rm164%3-*0}Z!cW22B~&F6 zdN=@EEucYG&TkTez6XIkqMYylw9bH>bUq#s5w|=}V2Ap9yjmHgUe_kVi$vi5gmK)9 zXyrXq=PWg5X_T=1HrJ3ApVI*tGf7S`Y`8uhr(y|RvBT)D_k(VBVet}u_{LH#d3-Ut5|$~2CopnABEg~S~33x zrr{e=A|za>q#6d7DLqD{iESU-E)*CQL7YM`m=P0_cws|{5M^WA$>r$phA4&DYtYOx z2J%3DU|jI27-a`8uC+;`6YA)~dfY1lvU~DHof#S#_LZxE-4L`o0AKTuiQT@^N}hTs z4y@TQVnGvR^<9mhUY9J5$q!R9ZM#K6>U;ggL>it**nAG4h=MCKub8pS-PatD-*vye zLmW}CPKJt!+HSw%Qsc7$cR2&WWj5T80o#DNHAx?r#m`t-hFa*{@-Yw=Cj&T4)71mrSb59s=Zlc? zu|?H9(6j;X0T^V={wSDAqvc~hA-IG=RKN)sI>YAZsesX2T8Bg=3O=)9LK{-630oI{;6Q$Y*SJOMEt{+b?57VvC|ak%f=;DxzWi zT8mHtjHA3^t*BkTRf3cP7QdIX&LF3t<(J7zDreO{o9&R&5)|d6?g2U$TqT<^n)&dI zj)JulJT5^v8Gdh_@|92-X}WHkB_%elYDmF7KARKJ8;-W?KKe;QLhrb(+xZ$+U)9zD z3oA84o5N#IUE#6_z$NNc62gmC^Fzsx0=C@lt6ERX#a9VZtVaXT9h4r=W*p~aP{rWi z49pTV6;^?m^rwvIwMXm-3VuhDCf&!6(X+u&>jumkFh(#c#hSiC1$^|`o$JMn9E)a;i>+@`ML$Avnz!Eu4PkwF7eY&brGs)hU`i}nt5A*iH+e$oxx$4nZ9fPML_q#HT49iO}O!>mMw~+dRfb~FBD+$6$EFw zSqI&Y338Zv(UCs`Bwc-0GIZrby&ikO3{>{hu(yNqfNzLs=RH{{w1Ps$2Wc-wGX&z# zr73t{V}febwt*i@9?MZpj2)<~NH`iGH+329BdTy&VPEWBLncDN?qau7@sLP|p9ZNT z>RX(&SMws~wr1uAH~NOft<^dcd7-~tPl{F2E^k@$a{o)w$g68L-i=cm=Rf z)-l1#f9OH4j8q_nfIjK;I&uLzjv}YqVfEzUOZ{&=Qh?`&7Ca8*f!SfDq?@|SSv~{6 zMl7k?MRTF~wEcP)(K8{hDrfiG% zJBHOoP%$l#zSv=N|I!wn8XNz!-e)T8?FXEOMw8zy!0;1~$!Rsd>dSdW%<0K?;&?s{ zJ>xVmd7Rr{M)hFKKI{oI4KBqVfhuonlNu zq&gjmb#}K8nzvXTZ_+bq z9&-8tQ}q4$zYBi?fuRN|Svva{R2oCsJ#>#CxH;azIoKq{NoVTclry=|p+mIG8>5pa zycXD2;P(lMN%pm)9Hl=m2I9q6+a5K>W3zL8!|C-KEH6rI6-3+sllsgqgGk*QoldX! zyA*2+3l$b=uYW(?@OUemeskMyH|XFgZGQylIPx4ItBtFoQnRu~A)B%L&Fd<^P}`k= zs(f~JC}Bb(;VL&+0#2G1@csu+lXa_8GymaBf^L2n;(_jCw8vIB6gc%oJajy4q3IFYUtr1Oa^bl*33*_OrYmL6_)D(`oZ$C~k~GcYgqp3}bMk%GV|H6Y zyVn56B8OI+Se9FPiye>`8d^V4m-OeyT!!O9KB~dz@mK>8Frb1*2aKXzpuw0Tx}(A* zCq~8p_MFZRp}`aK_`wk%b)mPQ(g7W$*+#Nu3QurW0`R=zEu36mT>_poog39ap$u`{ z9`O01vg}T)Jk==iNsgC}xpNJUolX(%#P6um#b|-_gJN-k$#GiYnY*xK-nQBVWrcdD zO^W0FFkwbv1Uj8&D6@}dXc=j(V5IamwRbIKkeO^$|@ciBHhb{aRPjc!$WhqS; z)`YGqi>4cKv631a1K>9{akd+t4H$N!=FTs562bgPpcL)tLO5CuIuR4@VLrV!j8x9A z1IoZ2t$0P2H^=5z4)jXqi1dkttH{-^CMa{U95HLh;y6~ZGYGuCLg7h zJ8BiW>&(zi(v&%QMC?$QndePYZH>}QQ!A-j+T8i7F!#duJ1M3J**~WI)>QR+k-c&A zJ50fAV=8Fzq;r_Lq_0>s{2P*@tl0G7rG}ygi;`SP|8*&>ab3)mo#F{3?MC{{A!<+X z=Q{ybC1=$EO%n$;btNmS`3}uS@u!hM2SIrlJKqFvL)ZI~wK9 z1p%YznuUmts)z|ePT!@y_&cMPsTFY)TCQ=duA#-mY4gT*koq;nmWF7+b?V39?i6p! z!ect4WPUf$E-pfw#5UH(d+3BxFQURl_$aCmsd}N~KuUz}D~bDw4R-5Yv+Qd?6jtQJ zDpP?~KQ1TNhJNu`^7W2{DpEh^X_LD;f% z6;||ZkV`FgSmAAyDjF5tiHhm2rS*;T3Z>3k1VTAuhY2ZnRr5jv6u5MkPt>=%-N-EU z+`(2|Xl;4@yYl7Z5xMa43Kxg2W{duwO?vjJAQ)Bym(=C62M6ls-&|1nNA<*vk#|>e zgfX1L2bfe9t;MJE!V)nhRM0CRFAlG%nBvwL6mc{~@@mWcO`nr3VDEV7@jL|uo z^{{n~p0yQw4oMV?JR7!s%Mzl$CJd5@Lj0qvI@m+Ulo5^u)*BiQG$~r6iw$Fuj_`#A z*E|`)CIvRRa^j{=XMu>27$Ql>@Y={-86`)bZH)8H%=j4O>(10B}lXE zC06)(Wy)$nkO@&dx&`&gA}*VR&eDB1hlvliAP(rB%o?k zAUS9T2!S`GUv&DZC%}r$tP*8Gm7jbypftqY=%OuNL1gpU1CPCo*<*la*KZVlctxV4 zR~zbqgDB1^q1$xK>IcKZKus%HWA1=^E!Tmeeq7;@pQ2pmg-FbFA@Q*Ax9qtd^6qGjrawr`O(TC}K)=WM$q{Yv zY^Z^3UPw4C0z=*L+?LczoRO)P}Uh3EWk$?e=u*vfg zD<_Ay>)JM=n144kM+(AIU?T4DK{9xZ_>Tf@u!u%(Ryu?I5uGVl;9u!23z7IB6ruP! zZ9(@ckoq$|8oS}1i97fn8GJ56@jqh26N%xE2q`#2Hn-M(J_Iw2``o%Ogun!I5j2Sy6(K6rYb+W9!i#=&17*1SG)8)XZ z4(h&e+V5Qtbbgo!%(Vdrb391k>zeRvNb~o|FGkG+^6~NMd|;EXy;aj7CDiE-v!z%L zyp!+lpwcDYd(w-lD-!7`cXI(1m5kn@n8ihM^*FFMV#ItR1|b&ohz5^ziOnOnvYc_vDT`T>MpwWJ5-|*b`J@e@-CRepO zX|iybh!pnyZB^abtZJ&jE3uKALWk-nybx0;}Sd&Xb~5{$}cu@z+; zJ{0EL_RSfApT?1R%5YJO6pWyzxog%1e@AdSq|&eZELctNm+6WxDeLwbW>+#DS|rQ! zM5N)pf8B)o>p!{?NB&z|k-hTm^JNr03pLyvOd>$XbC|0Q2&D-1Gw| zZ$kD5mE@i6s<+9^+yYg^(uM7M7iAT@{W_tWPKeE>|MlXKHI*EYBml^4nx5K|4%9Jg z)@om8VaX*>yNHAP9|;5yl9x^Zo`Xbx%-auU*aZdp1uVMInO2CyrxWJ|yFXti)6+84 z!GbT^AG#A$1RMsrG!<(%O4((5+(fLhO-^>tQlgxc$+K9`)m`#^TNV%HiWxd}%c$Sz z6TH3g{t;D2kYY-6k5(BxG#ahMUW(asHkH-PFTa_bXVA9r+!OxL&(E*%61!kCw|!C@ zzk{UZyx=!U1ed~6?wtbCGr^THD_w%cN4VdF%!y4>HwnD%L6=-lICtC>VJ&V1=QS0m z(FX&9TGPcUS& zxJ&7IUaSme?8rA2NCVQ;ij{x*0bb>aNvH|zTz)_U`9-~Y+xr|| zwvWyUKZyx^btxk!ov3Q1)_c3|i&uxdvEy&t;sP3x*UR8V%#r)^4aL8ac4BjD1Q=Sn zd)c0~4W`>9&7mG{j!UDhZCanNw(yfzZqY)|bz^fPZAK{SmOj=TblUSC}bnojXPDR{Ss0wKaOZ zU}@9J0M?p@tZ7~%A0sB9D;`XS5Tp+`3z9y+i?9%nPqVPfj`&kFVo4%~Vd$Xb)rv$a zR>+0+9yB$z`iL1EWTCLTx0@@d?ToH|`GnIuVn~L*mqM`T2hNrQ7N)`M3E6q2S43j) zV%6q%5bkTegh6_p@GAvUpq~ls zl`SSxEMakN0~lq{#>yokOGLaV6pN8ahOU{VoKT+zUJ!&?1rlfk2)%?NW#CG@=W!f! ze%piy2<72@*Q%6)(S+bBXNlONS*%U7_*&qOk`tb+eQZ`>mFEXOcicw)-2PicS}wbBTOtN#nx! z{9+LNMpgOjB@jen)X06$A!Y7vc|rI;aS;HM!3L=_di3UV%)K|x`E=EmeyN>y;Eek3 z+wd;%8~o#;Ce))iu+q@oM?@+>F%^DDSo%NBHWouXMZ9PpAjpaW3w_B(jtcO5skuj9zmblJgr{-ZKb^c*pi0 z{H_Hm7|QJS?SH&aKuFBdd#6RYIVyT}t!*mcO~5$$7iNnrR`m8CbJKBAO9#flFR)PW zTI(QT`6zC6ucS`~x4A8Hn#P#L$g$NmsAl<;U2^c80uxDb{as6;ISrTlkuv=fwKc37xtlQmB(FwiHCt3RNy;%YuWTYB z3H8cIYUbdu!Sm9cUn>T40X^{B?#$ICuh&uRV^(f^dIfW|q!G%yq^TQ}j?ifquc#G* zoGkCgZcRh4$fUpyp4Y4&iznY5lS*ArR?YXDbG~P_+|f$kF6+~4 zwC^$6_i$Q&keWon3RP=zNRi;<U3ixnt9|M=tpN%IQ(6k=h zqC{b5=Y+NVE8pttp;sjq-VV5 zzx5{Q6t2~D!o}>@J|gd`=lgzf@hY#ic?W*|D3|k}f{7~^^-ZDDbCP262a!Y} zn#?oIaf@^hj#I)k;9#$ChvHDNs*F_Xgk@$fn1H@2^VsYDd?|d5lGQ^v_i{eK1dkFN z5RHtZ?mI|Fd+D%(L+r-*ElP+q)B-*ZM+|ro4sAO+&5* zkj=!e@5>vyqFpbaOvhqFRA@=jvx4Y%h;)xp{(0_SI zK$r+Hodrl={;RL?*sv5*%2{1d}OyftU+Ylg0#H1PPSm5v-a)GhI?gVyB&l6w@3+>6%7<2*e!;-h)+ zz;mLAe>pJ!{((O@F*wHm{w__PBmsrEMO+70KeqepQ^e0h_bVjA;hh1ALto(esT%=O$Fs(^&_E{kPbtZxtA_k6F!b87G# z6hL}2QP?czRjxr_6bv*gs~H;bE0`k#cF3B{B3D5Hrm!@YE%ewf`~gqx)q z<^9$J#zu6s)?rX{IAFtNh|C86{W!UtKHbU$T_tD}r57GVqV_fAj_(QH+`$A0z<{}5jACrHr z_Zg`tJo9cIG*|t1>h}GO*|XH062YEYKOp8>I#x=x+v2ny6X>jGv;dw%hEkq%Di! zH*)i0xkN8DI}nB*_eP{twUmW9KvzBI^@4lYBw^vPlXf%YHZqu{d5-(p<#M{m-t~Qa zl2+(aE7}=|m6DLx5BdAU%2h08k-Zwvp#Z(BzXVFm3L zSI+Z1muq~ze1%!}C-j_w>S3KhdAM_v>A=M-Hz%#)qKvUY1StwJ>Lu>l)|OcsI2`;C z(q@tWZL2c>w3FJ!AZo*|Zb+Dg8gtY7b&kXRs)$6J-+s%ChLqo?R&4@ez${J;O#zYi7`uHB~4B!H9P^DJ8h}M((pwsED}Hl^W>&S zJ3t68ozjg7xpo6u)nhWKt)NlwJ0iGx0HUKR^BsDrPWxp}Y&Lb2!-_>096rm;L!NZ5 z4x4M0F$tKd#i>)1n0P7u&A>fWYNBkLRWPpfX9Q=f`Qo4cryKEquNU2Jd8uc6s;viP z{D-RE_1ZU+i{|(5nZ8X<3wD(+{QnU4 zjnQ>{-`}xqr!ku}4IA5PlE$`eH)!m}jcwa#Y}>YtXWD*$YyICnvsPZ@=4S4>GiT1; zXYUWrQ4BB5j_(G|8e+I>G6|fk!%FJUxRxv~sBr*;Du34k9RWZL#PNK|2Jls650|w8 zc(PDY$urqnD&*2hbtsqkE`&3x6n7FtrC` zWIO;^R)U{uf6b~B|IrO*&5sTV=E{ognPiF)kjkfdDS-mPqZ6XKjk3BX)bgt4QeM1m zm`NGip#E|0!~`pQbn1O%8# z55tdj;?Z~d`~pCuS~iA;?N6N`dVpKgJ_BbMnVk_AOV63C&Y9W=ZjE%Z0SM!>YtbzVw?%SeMF zLB_F_?g(Wn_f?`kG7&973*Bn0vT^J3LxI5mRc!!t8|ZMHepEUeui!P=R=nVpJboI4 zj*q57VS$hRdVzE5ox@{_;rZ{pVE#QlKt^xk2yw_Y@7K@Zfx8RcbE7_9hj?W$$?Y_N zPJS`IadRvp!Wer&XMD>w%Z-4DzcKO2%je?@jfU?jiVGi$AczVgnm{MY8t0z(2VP1{ zp|nvG=jrj6S@pKb%Ud5X4hlTd;0Tyu1j=TEDhYqrW=R^b;$u(V=2W@HRICwI4&9`6;fxYPAs^dJ z-iH4WGDz0E9WD6WQf3NcB5rkG(=N~=pwu)%S|%|=6^fdib#jkEgAVzsZPGiuxivIlv#=U;DpO5MG2i1w&n!?yj;DuOokoJ$eeZKS=b@k772 z-IzPlxYHEYJ)4yT^4SwwQ8lkkc$OX>M&M$;H~OMtpm@QK2I=$Wt`e{C)d9d}<&S6) zij$nwpIncO)KwdYE>S*Kr0jIy_bkh;c z>lvY_T`x{W6D(8B#BSCG%!gP%Rv2X4nekPhZ<&tWFUSbnfDJ4n;w)9eBB6&-=HZ(t zDwGTw9?hH}PquSCtWCBUd$;0pu4)~0mY_vLON10Ws%gIJh!$>SfhSNrKrG-Za_Fq~dD5e%$ z)#*6zw74<}2x1^)Y+`=G)gfNvLu5~j{xslJtsUcmIY)?yL`)!-BgFOv|ps?p$}l*lccRmNV9X&xiZnVq2aT{;PU6LoeJbk^w7HN1GVM)3@Y6u;Hb znHO7Axp1d4n7DwYt5`hD5o-w|IWg}!7{4UgEP7vUo!f#4O6DPNfLogy-5Irq>5Nb@ zKx0ZWKP3`Qm`R!FuoLpT)(o(w@nN6<$Tbd$Hhbz?p-ZGC2uL*;!i@?RJzwF_gh@-W zTh&vSH_5D8Ze8d?5##K_EYZN7kp)yQ&;Z=#B9FKq2rc}OXaVul2oeTE?wWR$9rjO9 z&3Ga5f?TM@uHaOZ13*Yg6$KmusgnbPMH#ykP}bonn_9Gk1w8=jry(_o9Iq^l)Ix}2 zhC|gqXbwKW$7_Q@`nd?;d@8S!)E4A5d;C@=5g-#K2$VoI{X8z%Is_F>5`KC6?Qjr& z`iwM}6eKUiAnr$R3#-PDu3`uKbm+Dl_^p{X&FUfvBB;VU&hvl_WP5;40SiPgHxLyI zoR0?rGk9w`3prJu-^!x&Gd(kzJe2(Gr@+!If6iWto$gq`>fG`9J9%z5MPV0jF(GKK zNK$ej?@{#Z$8ZpFjq>^rM4&i^dB&o)m`shKwSaivPWKbY7OL<5r$F*T;u~s5a>q{) z=F+l`Y?YMA)tDd~rs8U8MSH2N7C) zi=IDbfYb>n6o1A8GmbHP84-buSEtVO4W3zC4Hg4A%UX+uV~zf%q@`{lh@-}jmoE^7zqeX_kjEQ|5Tb~3bU{R zM~lmYj-;V=6X|<>LBOh3I+bGzvV_;ZIi}wRHm8dl;rGe>$0}qYOD~y48-LG)*nSYr zPp~hay$nra{5b;OsmVNT>1Hy!K>H6q`aZ*JlVow_c7E=b7uxOo092FiHt}D+vl>U= z0u(ZONHg5Yk7E7fBLfu!AIn6rEc-tie*X*rzy2CIe&akoBcpO5;0E3H3W^ZfUgEit z)vWi1Rv-!Mru{e+hT{r}{Ivl9G7i8v_mPkIsm(P4w4krH%ASp&M!g$ox@czm0S1-+ zWbiq8aI~yAh)H(8NUe+oD5kRC0FdR=3{`7okw}v!oG2gq4-WRC>L)s@Ug3c}wEZU1 z{$03+Avw5@!c;tt#^aYKev>bMuz1SEU)6X3SO%}>9vml2BLN}a2?O2E#NqHNbfln; z7y>7!J2xdLPRp`0@dg}igM(DTh-z^1$wZ8u0j2cmoQ17Zn%nP`vR9~xw`wc)AcE$E zgouF<*qRj2DFq~&SFvznRzaC4e|?&URw?ieYt= zSVStf?LlJ|dO?|X$M!^(gN8FftL-DDER{@pT(aWTThM5hnwr7O!StM6NDZIOq^yM_ z=_~-#o54b51!|ZnH?0b`4kbvd%jbBL19z(-=UTBEgFYMs+@ z;c*~gy*0K5tZli71S$P!SGn%*eorp$bt@ZR7ssWlV zg!MU>qxsDPjcw-{l3r(^0f6RP&v&Q@n`dqT2o=^>fJyaIHgC=K&@%!KY@%}6@|g-u zIE(@cg-Dv?A=AZHyvF12V&jj?JxHyAc*T(Y>e16_)fHSf!rwADyxbOxN5OxDpU#x= znZwH75px>@?1Zx! zV}SmQL=ewm#mg=Ht&^@XXmE7qk?uqnz69PgDw5r3?P{dE7*O5H@LYqs4I%idI`c&x zH$L1w31n}8fj7m`Zldy%T1(a&GP1Clamo3M%c*jb{OT8q*#iTYA@dZkMJ7O0#}T=f zET!FG-rF|Q;T{w+{s>57anjaqx$azuKM`!EHvJa=Y`P=NGB(n5+Y!dx(ODV6lNL0m$2wEj;z%a zbF7tnbc9UrIUn*YkU;C9pSD=6U&fhKWE&vhv%;nk1d8}?Q3^`Ms~mq-IoK?etK}u& zhg@scYV^J)`ssdog(#~6gSZ2adJ_$Rtg`mLa?XH}ml^Y*{Yr;$HEMFh{O6n!kTO{n|unB}`g zMgpg*SuRR$jz%E};)PkB9ha&3DQpOM%%1>eD$a599r1T3B#-EjoH-Gsf_Mtd1!p65 zQ7hS1hyJ$r$V#%Z^2oPUX7`x>%U{0bOzEO2LBi9m46Qt}@oV29UwyyEv7LSib(*cZ zrs08#sCUDl7WUPSd@RKvO?yJPr5?)OEr}b`ZvAO*FfdSM!DhYMXr&?&VSE!H0sMl? zVQF|&Hd4Xqct;o7MT7 z@cc~`(%eBi(0KWKE{($;KpXVxoQMfD`Zm2!KQJ(u(cs!NeX7%B zy&XtL(<2(S?6q;xJh~j2!HW&lQtQ)JpO6?TSn(heH;{-pyg4a&`e`54>yG`TnXkhD zt62MonMH|dlT%*LlajGjX<1w{j=6i)ib_`DcT{vc&1&c6nC$|pJ_-iST1$nOpZ-CS zA+aXwZ$17{$SSy_>H_xYpDhlDQr$%I%wGo{X#8{}WQSFo^p+PM%u-zlRoktHzi*oy zAhq}n(?UKWr|M#Oe#5i4X44unmo}grb#xu*?KN``lP_T=$Q#sJuGYC&YJwddJvz!Wpf6S9lfBQX!6!1RR~Z9#zJ<*(+grMGThS(rs1@YOZdPcD zQaFqfMC@~9?}&Jqd>)I{!V<=`n)QGG7+t<2T&a35q!VAT?gy;S1)BC4)L0GPrf#{A z&Uo#Alr>j==y`(ew|*6)S8Lhb2&n-IEmq4O9LyCEL#oQM84Wu}qxAJ9mlI5Op91HK zSQq-J#!y-XM!dF6#@R!yb9M%4O7PM+J~p(vYi=o(OxK-X*xeMG)$HeF(<8x(_y+22 zZ(q}yi^`;sLJBz}C)nkM)L>gKHWiq3d@pQEzQ#&{L~YZ*3ST@Jv}ic%j|Rrk;Lj{)%Yu+|1T|r|0tL$aM8OyXVuFDcXo4k<@xKT(!J! ztZ5!M^-|Vpi)_{kTZ0bRV&PF5jrOBI2wRS&=LB;4^-rzidGNw`^yXe@({LL$>tDs7 zBJrYZBTzAlMzot-=S&CbN`xULK_MHgt}B)fPh|)3g^2;gWIBsc-y0d##H(`Idbq}$ zqx}%T!lsf=3p@*G&#en7^;UO2Fm!N3HyQm{Sm;bQ6!^0i6`fK`x{XQy1Y*TKETKZO zDLKaRu6xW2nlVo^qfM9TDObRe%U^P9C9olE7&5occg!G=S3AQmAB+hR`Sr>^mB`rXDXotk=+5_$(g1?GY|WK*&LxAyP`m27a(w5`c$|6bFe1%P^*Q=SUTA6f z9k|^t`^r}AYjCoCDjk715y|Ov*q4X@MU|>6s5IMrC#?GCEY8>WKuq<5#LVKaQbBUs zQ_Gq-H;nl!oGuiI+hj>-fwU!AK7``U(avv6R;9Io0F}VSe!Q7{Ep3^+x}PCnb1MX@ncMyKx6gWWum+N8}lPSB5j1_DiZvw>lzg zEvX6EWxiwn+QoJ5S3@%#%7tZ*yLdATvl@>F(FX`vY63RG0;c`85S9!}yAwmEIxGH3 zN@;DLg!jL9)Zpo}v7G|3I+9Yp$`=WA!~+@@izTM=j#}ZgKxu(TI<0|#X%Y|;mZ%e# zBrx2sD^8pLw#=BAz==^Oe1o=syN|*LnbL0_{^o@-b6~jKFd0<}I3;pbIq!nPbkIEm z>Nq0&?>DON=#V3stja~|Ha#nwSrXYdPR=S2f2h3jT&Vr}C^>gluBvTS>TSgC0&XAl zM?`&@;Cm>98cz^ilS(Fy04(BC1Ie$PRM63{c{S!%)gnk8@Lm~LE+AguOfT~{7djfm zS(?ZK(yXGusZN8Hlo0f1+A$HA$-rWMbpq40Ql7Xgqvc}3OodjcwqxcME<6VlIF;Bl=VG-slfe?+jAzZj z2YR^J=|mzhEqa;s8qb52#*zg`ig~Q6{DRSkhZHXG!bsW$7^%X(Sd)Pr^e8#b*!Q#2 zJo+gQku6$GJq@^cL6`=~U>a0- z&Mx`-+F;IV(%LL=l-K~c=@b(+9)1JLIZH$iXuJ4Te`RfOPmqh-AZefB!_gEUgJ1o?9t(7S(Q=Oo4DA=Qud0n}~(`~bF}egB#m zZ6L+0KiK)$;28w6iL>+ke9o%f+E^$@r&WY{2;N6Cv`x8JK3?RIP(A`;M}L0YAS^3L z{|%wqiKqX&dH~tn^dV;D5~Z4df=QDt)PyNW^tY#H=Ba0kK8<&Zxc@t-yt)dVdh7xze-U6npzfi#xG5{}@ z)J?-2M&|3vMx{%xWmQW?!i+RL2=uZL36N4N5uWR?3VsvbWS*4s%O)3FMS1Tld|s>t zzd=^qa9#Lb#|a<0F}d`*Ij&Lli2Vnj11Pum1Dek+k0FBs4R#>>9?ICSOW$PePEB;2 zhZvM)bSh)LDy0yjt2t}1bEVh=VSKqtZtL07JR*{k4#;u^%b4NIjY`5u& zd(FOWk>Rc4FofVWo2zzOj>Im{?H+q3_F8h8sH{(G2Do6XAIbjw?{t+$1_RHtho59z zzD}*#`t7TnMx;a%1ypxNRq=bX(W^`8Uv&VEc4%*u6le+j9vv{q(fQ=OR(n<$-jc$l z!-C5VwxB5T5p`}(@BC4jjw5mQeR#f6tkxuS2rU8ojfKO+w~M78Wi39}&wSs>JZ_2M z+TVLJ)>=~%il&mtE3OW)trE(YR4$jgq`?F<04Vt?q~r?d9HGna-o z177f_QH2!Q*Mlr_Jpe^eQPun-A|p0k#rl2%$JP@f)2DO~yL82oXjxy`lrVbCp) z)d8zQc66Yo1?)8_0yI#k$-HQdh^4n> z43O6#nyehbVA{Y4d*70*$Y%K>m_ouuN1loR;8zkx_{iHN_VfdiG z@E|%?WulA+Z5)DZA=0>BcZ{ts{o?VfLupU76-@4vVkQnN>Y4y=<`7P%%$k-=de@NE z9Nn?+N@k0J%vj~B)y~5}LpPW`gx42RcX5w0JL7}JT^5^bAb*5FDf3{aIaWwXohWSL z1~PXqO}8!Du3$JpuGmgkD~mEL)Op_DyNwii?oVvaifj$O|Gl%*{A=)&5EMxPw}j-h0`+tG}t3b>}Na1BriCF zYiFMS`D%BbA^#;^0Eck1VI3k$>#Dl{RzR|>YKofWy;0DNNR$UuAMN1S54e<= zhgePbZJPX94bSwk-I95A?%|QX-|}txs=QnmG9E!o68|c9RF*m8BA_u1<<1@bM&*S0 z5E8ahBDDTk5%fn0L~uO{-Omx4Cw2UU(!7OFoe$5lgKr0(6#@nPc@l0NBu_nA4c+t_bwG+9P!oPbLFfQ_e^1_i zCRc#>ki7v*MT2{tb4B0gH?Gyq3}|i;N~V|4@2>2=ISj2_=_IYGM3L@6<1*s$+Lay> zj!Wt_mKgq6*jeXKU%;^v6+(Uj-Rk>o3)kl~Fh#gKPLe==m+GAJ(;(*1Zmnn99GGqW zXzNF4UbbOL4$R`W^0A&www6zJRZR!TaKd~KYop#qy7rA9k#NOwYP_Gd{RxT#Ra}mGUwxWsDU;7)}_0daJQT z#H5)6I)IPQNsI;n1)h`j@F?tFM6y6mTDR8cO&{b2Qb+*vZq5);0?^uZnwRCeC)#G|LbDpmcAS*D)&BH7c{FD>@zCc6*4Eb*wy#Sp*e^f`*r8fSBRrLE| z57_c`0kH4!?l_sjFBrgsW%BnWthWM*w9TxY>m5-(hCC2Lf9qkFmQ*bUsO*3)qCn2J z-4F|tN~c2mkc6a`;c?wi6Ew4E1y{|HpjloRp#Ap|aByiL%yl3%fuVbQO4$2*yV^TV z-~LD>U+yxDavfsp`0cv4#6>$49kvBUOnzB$Ql2~`gHgh@v}4|<(rP85v_}p`uSH~l z@Nzz5t}PWcspLF~HJN#kV7J-tlSyv}_{BX`vRpgSA{Rtl$tUnJKr;j|Fo8nE@322* z3!x`xx~ zTuWX(`ID8hp4#k)TNn^Bl+1^B4&h6Yh+itE7yG4?j^Jrv759x+Y4BOCuj;jeHu-}X zyl#zY4oBks#l|Cv`0|S9Sab&#c1s$7qVVaOkA8o84yfRq(TB#m4( z|AbJzFMgKq70IU{>wlBXkgDkzo%S*#IE%wBza#uSMEm%Jj9+sTbD#D^~og(BYs+ zynWcIb=ZkS=(6k&&la_N+OI*~V-sJ|?cpRp%?>aYeOmktMDeBgh**%ytgcr7ikaenaNX=1`I2S;d}^IS-oH{Ro%Mc8VD-s17sQ zl~&s@OpZMxw}{kMk&=u+VG$2FyAz^|DBn{{0wBlR+PbE@u0K%KM)~3aSBkToM-;3g zB*s_tIs$S)8cKM*t-@!Y0W6j7W0<|C`sn>Uj)F8nZlaJI+JtWWWfjv<5 z-r$xI(rh6QMZ;CmD`5C&1Zb!hWrl~Nh_+YS#D_?p_tHebeg%5c1CaR(*PgvCnAvPC zBl<97je;!k2L-rlJ1Ck{s#@ZZ!yLB(4KTvwQ&Vo?IP$mz)`F`)2+2(-1aX`l*(z3L z=&gOyKA5k*sSldSi#IPhFK^J^MoXq5V}3KaXIbgFZFDjIN2__+D9UxiF=SzM^H(hr zGu7VD9nTcm~#f<1pI|4GxVW7vivDU*PWTV%tuR zg8;&yvHol;3qV*0YuLRYUpcC*D+-zITYmsqT%CBBl*kTRn$} zz$67kf6ZLaD|@fGG5Bzk6fE&am=VA&qKk-A{aBx{Z(J~L(8DtsKJeJ-&wP9mlRUAx zzKCu2#P&XuRhIFNO4?<%Qt=ME^miCsFWYLcj1+oR~+Ly{0s zFu>SBSawFpNDtCTj?WforR@S3aglX_%)Xc(CsB&B7&S*YQw^Qbt59Mbv3(OL~WWl89`g&7hFIEchupV!RHR( z8<@=J7Xm-uDIKpq95@qxvPC=bwYxM>0=puu{g<)@iZs%BBBA?1X?52bpti^D zbBpz}%K^}8)gGtyB^1rmaXLiQ2Zuc4v$GyvBhx)#RXUyMS5jcCq zbOIK2+(*m}rJcxDwi9mO+NL~OTM`AMoy2@2?1VWy>1;-_4urGsp8@MLRUv0_KQqZH zN$96u)XRyl8YhG7)@G-XFQF;zJ$+|i-0{kSVL>S=07#%tjT16G|Eakq}|DIB^@I&#^=(qv(yqIXBcG3P4}WPT3^+`vV+)G+6++s?XG*}bUl8xbfor! zIj&tHUaMF_Te$hcE=E&&6jGZ=Hw}atYy*P!kBpc*(BB3 zNa&8l;jrso*9DNtn6ViNKba#uxH@+4oWy=k)WK!-Rxm2N^N-@2PCf;A3`?yB=g5jFyk$(e(nGyOF;kRhn7cYKhS~u0X~gIFWHoa*bb2v6`l&04Oy_p zP@2?cSSR)s!lv+jVA9rRGQ|nW$96WsN@6fE(P}|Sy}jOV|C~G({AzTcAv3;fXB`G`Ax{VqT~D` z=9Bl))i>1y%+iN605%1h=D)Yee1f4=Trj2q=R+x*ipW~B9Hx{}_lWnsX;=koer7hA z@RAwZcP}VH4x&GY!xoA;tCR~eOu1Y|jfeHlw{J5Jc9PC;@4E)80N_~jqDb*f7mp^G zK(UMK)w_wp)Ya@lJM?#5^a2txvz0$}o%1*Ac0r5&QV4=3+u6PP)u(aoYOGDp8Vs3h zcdpl9g2pnlV>Y3_K0O*fn@7${S!01mKw_wh^nA)i{2sIizQnPN^X7!zv%8>-3wU_& zQaM`2C+t?Aq81vDKP6P!crC2ZLnfB4&eg47prRM7GL))U*{O^R|?-#ei3N5a7ECfpXmvaZ~CUhdHk@ zYLBN>*?x1jgIswy2xF{j%wY5R9bFZ|3iZ|CvKS!}z6clSfe~^tWW5JpZk7!HkV^_D z)sY#O8m9~Lun(3_ZaEo=*VtG5%=eUi8UkN*fdY$4%9hV=`(Pxj=8BkkM! z0@s`pfKA89ubD{S!020(>qNk0)l0GF*8KO{@i%kiqN+(kkjKBaF*#M2Kr(p#W|cn4 z&7nQIhL7-GwYiL1lctHF{}UhN8Ce)8NpIsjxPg#H{{BOQw`s(azzOG($^eB{89y4OBC3?`~f{MG~9u2Yj>t`oQYv+9_XqcXaS# zV3F(1oMq|!Dk|7Nr~mYZh-Ii&j{Kh|sODL`Xr>!=p;9s5`{Q^~Q4t3#UPMLPow|a; z)ZOWF$I}sAeh+OOmmCFmVP6w6+zL@qk@;y*DF6!g@PppaAuh|#CP#o|_9hzI=DA#TS6m^jR+w82>`S-%6c+eL|a>1Q*#BdMmJ?koiEpVembu3Z$e!MOrcB9 z`@?Z-td`k?^)cUC)?XREd}*q#o;q|Sl^9RwQ4$%JM8Xz4?&BH_3#BMQ%aO{mUJ~n3D{y(?Y zGJug8mOTLW!GnIcYRQ=H@R>NZrr_9eGRk&ml?Q9vzRC6{IZZW6lrtS^%)r34TLM8h z14()tdgnhMVD9}to__yxp;e^*KaRe5fqO#2ura#-iK(VTO`JzMa36!XFtdm&RcZsX z%r5y44-(jy1oe^uhOe!OC;&n~R*<6_c~y+$U$Li02%vs~BUt>Y9Ym=`Lrf};Z$9j| z?|K?cwvLlS+OcqS-Jtf$|4D;^LoCNP#tRUPTcq%L-Fh3G1biJ2PKXSl0Gqj>DAQ7g zoM~cEMgGh&de%l&;)*(P_f+x$?=XVTp#uC?PV*^7HKnGOM88tVv+JHmKTpDfc8T@W zx(fc!t)b2hhD8s32!o{keTHF@5{Sc@ zfY+X=-=NTSA6op%G7bVsAP~eEGuf(Q5D%EAWs54RmCULck@s_ha5^KSc1<7=m+DRV zil?R)B1B4-A;t{Ab6Qeh4g z=X5^ivwZT~1thTi!Og>9^83G)t@<03sdZN^ZFE)@s>@MPY=*#(B+Mpn@)1y%%bSHe z7bMQ$X^DbP2cv}Mpdar1cmJS;H=wiK48ikFAh`9nY603R3J4Eb{v0{yD+Iwx`Ll1y zp_@I-uw4c3OTaoQG^KRfbiRR0(D1q9fX@1x>00*eABg8LpuM=7WpXuplc?i%9X3ap zT4!#7m5a>#RtgYD0fB4F)%u*-!>3%eVdT_$^V@HU9bPNlhYCQo_-+h3BSjK}gzxe2QICSF#`wbn2wjLp1CdChR~4-%KoSzN%m2y_Pv#l`ik;8Y z@F`!*HgpK>6P3(cSGHt`0p3Wt?$MW;J^) z_r$LI{vB3p^~?H+DRrjImOG8ed}ebt8Zhha-YkNZUytg4n#NkBa@cFXaIhh;9XT#*$ixVcq zrb_4@^kCEB^|+Vj*)p%AQ1W)X&b#8lJ%|esUBr-bdy(G{bGuJ%|LP=`cN ziB_^GJFY)VYcU)RVaAUB-JjvZ#Kxevwq>MJzTSHXc;`+(JeWzn`P{96@kf$LUC)P` z7@OGG+}~N-xV*D-wSaS(dW3IZCRrtaT#o%cGBWYO`0tUg439S({!ME{`tjXJgl?7L zy9AWk)}sUM=d0gg*z%XZhs%e4Rb6aMI&>A4Se29t-Htd zr+m&xsmgNX4XS)*djN>(IAIm~o`BcwqPHo}f^D&N^BaCcR0f;LRjG)EGjTp3TR!bV z$bAS$3*=uXaIa4;a>hG9Iohha6}ADxhp4o6=~)0nT0CEgnG6-SZi(D=ZwJ9UEeiYR z2(dx1^~_T&ax7XGsc}_GkDPX885_)qdBzxBCZkMrXW_`kyNMK!*I;^%x7R4#8wc5{ zvSEce9=3e5_sE>WCDlWufwCzb$~jWv@FN)f+9A3R1Hf9^#cdi~4UFYxjuh)pc=8*d zrOOL{=h)ISyWiAjJ~V4qb&06u$YnJSR{T_L{RK8f8YFcWEa;>pj0bro5ocRXcG<`A zJ5M35pHP{jQk57S=Y%vX;x#vpQD!@LcIR~Cg~KkrpKhpLzsnFF*`FQ z)n?Eu(=D{x4TZmsvi7CIA0kx;0v4+s56#jWm0UIY@9{thvfbYfo&d9g0Dt zkSiW@l{S1z5G9_HNGkH@6(aRVf|LpxLAn3^`8Cn}>aBDoe!Ig44JoKZF?8$x`ODl$ z%)htik`I9QTuv4~$#jd8lRDFFjl=ypDe%XiErVKLh-7DTIgeYgM$t{zj&Ija=K?6Z zbfa@%p7Q>^r-RiknnQc#SHtqD$=ELv(7^R=XRi+^8?KL6M$X`*V*dv5m>N57+lqxt z%wfB+9mV%23kX6YjE#+D&}t^Xf-Eo}DPH|VwQ0*C+`WGtV)flQo*)wtmH;4;d3_xB>1(96_ef&6S~S^66@6UTQBpa^reuvJqfVACO&&F#l6SJRyPTHei?E@Llc;PA9*7Vn6N7*r8XgYxNa|*< zLhYh_q@G_%{CoK^Xpl>Q8_VT%Bn;+ugp_t(SfHC&;yg{?T^ZeXOPvAg_r!-j74^ zbUT@g?OxAoZ656AGceoTW4ptNlV+3IzmF?Ac=fs=Vy<7V#|_Gy0Y8$tQdDCg*?Qee zwdr2x@wm%9LL%fu!2KNH=?o4D2}zzWo2K4it@X?E`LqF@`@gA2B-zB=Z?oE5=W%~V z-izp9xZdt1d>1f)VymY|!UB8W@qE_u`1lCiyOX6lx-O?Q@(^#&z`u+Cd zwh&FdP=siG#@;iCoVXtka-!t1T%J+uvDt0baucw%T?H)hQ0#OB z{>@^y#@%v)^(q6gm>*+p+UI+tslb4S4s)V-C4a6|8%a^WU-lD^4-coZS>cT=m8#WH z%B0wmr{{|o$fmJbE_|T>5Y2Q$zn~Soey-E(NHh7;PwXRofk;>LQMK9-Hj%nr|2G^P zuHZY6hcyg#W(k^~&Orl+UNrc_t7KNSxe zl76?_dH^!?FrI*V*y#V(0p%vTe)N<$-;m$y!+QF`agDzQ7L02Ie%Z3YQae0cYyvl} zN|oNYrYSR%|Aiu*u(K}$U&QVpL4n$opkn%P&HcD6nb{Hc58YVZBHBi|1PfTuJ-+r7cVgjEPGFv-xZ0O;9ZT$ zc12z1Pt(*ZC?hdGJ3(xT>}ZZQS%~+`653*!>(|-U6FH|R)3s0bbJsM;+Vq9qW^EiEB5;w zMD~FnV4Wd%$+p%Sb(M4Xkmpcm%-;g>>wx{>*;<CYc4zlRVK?= zF!xJ6a3yDpzvb$gsw#hC5R)0e-jQh+ZP*D5sPspf$jJx3beA*Aqc149`Fwes!@jI6 zt5*!lQ?A6!j=f|IO)jU@e^XC`*ttyPUDQq3Z{MV#U@02_EtPKA`E?5y|&A7tydWz?d?ZclFWgTt~FGJZ**0+zZ zSbCZ;{sj`ZM*m_pJL7Ec1v^>x?B(fb!E-9tddYly$6b8jQ?cTDt|wRBzo-f=`{DDB z&3^kiA?zj6{gITUWN~q^W2O-fQOZq3E=1lV2zrmGuf-LXqGB0lBu5`F zJHw%_8IuHiFI*lyT7$RIwNa@4n;|#~{@Wr1#32w+r_(&KKeg!c9;80po{3M)M0-+^ zA9#jls}H(>J%*&*_hu?Av?&kWs{4ofM5oN!eoc`vvbim)&gMHq=@0X`y~kn$?S0aD zFLAq1I7supdXrJ1{qrHndBILP8n5WWr438PC2J4uVSB4P!$(xXuG(rcWTZ=_xDMtj z7R6rqYs*^?rt~bjCWBE>D~0hX@0c;M1^T)IWdeaAi7dIEp~T2EMY2?@rSZQK3vv6A zs}k%L+vq^VJwt^@$Gb8^)oCE3$oFUPRPVNTegQ)7ExH3RRh~`-UYL>dFuZStoVQii zv)JvRs5#{l-87^`J^eURXMb|PpB0q!S$;Hix4(WX?|7m#g(gXyJPjd8W(<%jwPx1{TirmQdrRDn<0-B^unv0&? zV?N1tQ16NNBeI4mUv)H=^9c1K3Se}vtG*}1xj$dE-b=9@7(Bp_HfU&mc% z1kd3m4(^}nEXjJy1!wF%v|R1E?xp@_lqsZh5>=*Q1SG%Us)faCcD#!Ueukdgcop$< ztqQx6B2>?WDNfN}Ee*-#4^YJ!kdmzc1O5yW83fZoO(gM#!6!Y0_Rs}l%1S4o2vSG9 z+D#^*wjnmC#z*+`Uff*PFTayaV)o>1T40e+!pKB^^zxENIQxo6-a>bij0SkEUE4x; zGAfoiWu$G#um%HBXeyhpouz-e$#1n}eESOVEB$s*v~A0({tWujY=DGXTI}B$>k_l9 zVk4t!*)${xxTCeeVr*Qx7R$BA!ier4IC6feQ!mqh6$@Y{@AViKPRY4DL$g!==+dH+ z0Rg}Ef+k*O_s;!ACGg3rwgWW{L%bF|z!nJBE|Rh7=sRRG)!s#N>?ONuAqsB&#@5lSx5O1Ox28-| zU`T|w2tp?I-cNH`a1HeW5k%F?D9PqzvfIYyt06&24-O)VN1=K!?I9(?~UQZ54JzV;*W!SAL zAi-m|T;TWHI>_Mj(XNbYq;2#iLm>8>Vt*oDXp%6m?KLFSa|Q>aU+I5J#Rf zB=+CLh63N24;0FH=ZSHZUl{!v!ka9MYDDjQ*0A5LO})$7=gsr>UTwwS$l5Ait}9oF z?>WUX-{Z3Kc;J4{V`01*-8^Pcq`Bt4*AXMoOJD3be5%}t`5B%;u0s*|u4iuC^O#tc z5z*K&w7z}#3gjCxg{7r0$2#wv)+-!ScobnICebW!(`fnws98Cf0<}CJa`KpJCrmV; z`)wAhMNZCH^d9O$=!6N!8#8HWG2wCpyHeutiEE2QDd)sZ%Skn5Dx*G)6ZyQ@=?P;@ zB1i&H+0ebPYGUsdh4L5K2+?gI|0&mOLhDGUrcW1izd0aLUIMa|Dtd!}>TVd7|Hs-} zKSb5M|HCSs(j|>_cS)DhOGrqH(vs4#O6LO7-QC?FE#2MSDIL4d!TbIB{sqtex^Q-P z&YWvrb|3@F!eCrm6YYH02xd-ZiS7t4qwfza5PjsoPm_js9u#*(Tr2ldb@T4 zemc{>w_GcEN^jN!Dt=f4XdMt>^?FG1XbQnhTJPuvj@rjLiLVx&z>1eNq=kh#FKj|S4bQhD)qr*xRej6&OJsTmT~wchWzH6YkHFWk zus_fbFh>~o_C)(z!`t{3dT8ckn%u(aQ$Cd&EXnhnP@kW@ec#L0<~rg&zps5Yes8EX zQulImYY4bkp{vEC*6&WM!Yh4ZY|baN)?KM@M^c4DFQ*FC4`<5(G;H9y?*Fk=_X!Z= zsfH2HRKWMR$sN0C9&GgVyH~S@;M3Ndg?d{R(+?j|vO6iacXwgXn|9mTvSl#r1{`g( z+{C+xpbS0_HGHO_03&IKUX?#f^m8T=oDP2b*7Iqu8^K{=VF2LgqE}A21(?-qB965P z@Z)AMF1>1~Yu4&F!|Av@x<0~b`QZ{?o`?Jo#9{|tf9V;uwBis96_@WQ zL?9(K%&-;P)kw#*ewl&mjEnJ_J`3{6lrtu1WRj#`@g&Sch)(}nc-u6+^F#&mV=k7)248g02 zBHg5J5)(OVFE_goCU@s5#CNVnay}wCa+Q#Ee= zT8U$ScU&At>6!z|mObNP7R=R#(>VZsgiWP3<kj70B%G4wE7fKy)@i_0h;M(SbwsW*JMerw?;E1Rn`5Ye z``T-V!pkz6zzIhWxO6x9Vo$-#FN7GXU(;3t(o6xT?|e`gxk%EtZa~qoz#J&3taJr< zx>kvHB^U+;O4qUx2gl!T42EZdaz~DeMly)UO!O0XiBTIy-s#hi%@!DJya$lc3QAm> z;beYWfNulhQunK3wm}*#PPFo_j*?!xcT~7S2IX4PE_3t1cTE@d;^OAcL|HP*=CE56 z*G^1GUPcW2O|8;xTfZ3mB6u076o{pG`1siIUGwnacAgFnT-S_$P!;hjUT7vL(rt*d zNKpU_5}hf{`%g9I*n*baCpdkuJq3rB``aXeK3D_*P4{E3CaH-3qIyPLFVDN>d$04t zC_KuRZB!8{P|)WOty|U})77tsn(>mn)%P3D7A_|t;6o?RlMf!pDDh@#&eN$*n-qat z;q3(O_BJP`z88H|a>B=s^!jS#3L-6rgwV+hsfWv`)tmXYHTSbtnI2e@!#Vv2EgX?X zel;{+2+UrdfYg@$9-2hDT4SLe6sfNX(ESe_(axtU7{t}NLiQW*k0P#TMh&<)N(u^6 zu>Jh>fE?oS{4{q|5&~JGMlAz3ggo#@Fnu=$u{|t3GS&VYFmZrNI?n_hY=0aCgtv4s z)a^DlSTa0k{sos7AXJTR(In-s7(N|nDQ*z3>Q>nH7)eO{oGWO%n)xIkm2`JM#68NP zFz3jDFi%<`YJ7*dR7qXdUAZ)Jkl*);qFfXn zN1S{Wp5)zf3@ar6rh<2Hop|sAmSof;ib@I$btHr4J(Dq3pS;n@k`Y*Qi6n9bM?ZJ-EBt6F1cAkLWaA(a%{@o7<6 zIHMn-AoqV4B2yea&@DF*nK8(6`)EQf+sP4UW4ZO7=UF`tt60pC4T2M!ml_klQn|X> zH+U))5IqE=H$cUHp^_7))Xw3#Te$a*Hl6C1|E*tD~@Cm8<4rawiyZu~eX+&6f0WyEmzP{IpCp?WCP;xb)pDcz6shfOtO>c2W<{ zS9kNA$_}Db@GT^4eJY4eS;NPcNyope!5-RS$>ZA^o+{*AGb|bGJTgf%+04r09c_92 zL2Noze%gA9!uFbI**!TD()Nn>C}e&IH3~yG-#VjIrcc{pqCZ9RJMmD@Lk}2}NO{4k zGex*rn*RiYRSM(W2?FM*v5z~#s6q=NtOSaeI_Ujx>C4nwYqI(~89q8h(R`drYN7l% z?x*fo^(Bi@@AFGSD;A3)nqiRRi_Okgi7sK;XA(T}%^_{_#5d8K+?E*qj}~gZuRV5W zNp$bn3z58&Qgo~`+Gc)aQDAaE=G>eE&>GtHLqY6=pkeV%quhP|lh?(z?vtbU++pWy zBt5U3-9)*2gHqm#hL81*;MJQ6fEU-^n;PYOw6rMw`Lz}?c3PgXG*<8NwG=8;l=h*o zP*99S@6s2_?>%++sG`=^db%|J;pSyU&S;;W@f;4j7bE;D(d6L`2SJVmyM1QgeqV_t zg+KAnew8a_W}7)%R$DmYFZISwTg}hQE+3yjv}9=q|MW%- zEh`RO^~N-aPfnyLDaWee-0e0nXAo8l^KbXvRCj=hGL}Lg58bbbU5*@!e0R$)Zf@C` zKMOmzZ$Wkc)1qESU@i7_N@TeZQ6z=BE6SJbVm^soww^`jTn1vnl@+VZD6kgC>fUeW z6jQMNVG70i^bi~>1NPh`EeBOK(En}4@x-l<;GzE~%?-e@Op}(c)M!a!MZ^n;T6|hx zy=gaKuDzh@rt~W9h|`riu0?#~o$|f(#3u~(N?CU86J%4o)sGJJo}Ki6%$EDIVg ziUXQrUo9l1KwF5N3mWE!Htr@;T(;kxtw%w1#7HCWd|xJtouprvdtuflc+6z16t~m& z#mC3L36~9>r~3Cgr|j6`|1@O!$$$E&Mx$vskEwOF`cl>^T%2TgK~bnun+H_U+=`vkYbGlh(hMFIto^E zUA;u*-g_}b>{7`vK!+t^rRs!_m{D?5w$#YVDqF7SQpi`muG0TGq!N-0S$-ziw5D2} zASgyp*3Sfbf^fiAVHZ_YZQmsTt>!a(vk+p+`L3(h^cvQl+Lf<-;oASM$?q8Y_TP(~ z^2-j1*6!}7zX}5iOcx=JHgQWVjI0bEx2mezv07jLuul*Y#O|)J3=OiQ z!_V(BM1A4`ueLc725WqZF%13hey;{EZKPMYVk$oJFipHhr1qxWXhVp=L17q=yzg_e zuf3;?v53EybFr6^QLNN0C6Az2`~p@0316Y9k+`V<<@Me1V|Gd|7cAr5p8S&uTsfX*zTdnO{Pg>Lt@W7URqZp}} zNpIM580@%ywM@VHT9|ih*=6+!Sm;-P?3Iwy!P})?LR(?1(MI)EVyw{hpF8k^)U0?l zRn#4{QS8#@mO`J?GgH-~8k&EzNjDEuhFIliAt!F&BQK!g;7H%HtU!Kvm7@Cb$VfAm z;!E1Vm;>?{r5$~JP%KGnH_#`@6i~|j%r!%cH&Ta_#)O7Nlal=l<}DbXMpg=+ZGS>^8dX$M)c z9U}MiR1I1xVCPR3Zim84l8hG-WU-zQ;Su;PwFx=KR%v5tT46@g;M5a-Fhb5OtOZq5 z;v|v5znU39<(gr_A13T%Y#ji(vVF(mvf{#^E(!h?634#4HV~q4Zp|wvKtoczO&>HS zK}Zq zuS#4b)8a)gg}JiD1hzr4o&sz|BR#ZEAKo1&q4O5~>s+>emi9aXy>a zfnDc-W(dAr4}?QRcfA~!15oE+6JwmmH~q546RWIkbCk-Y(3(<)2zX932;5u==Z6c%aT zF*y?x(_UpuOG~5UF6wm_b*AHHZ+KP~H7L%&$J%m1dM&4Mr%5j!0Rg#yoe^LKr%a#* zkn`eTknsE#=<&Dh3VcnNEu|Ab=5h<6ZY?PQ2Yf)IiIM-%AIyvUzL1(&>Nfco-$LLc$rn=ox`v9C5)eXdPz(7PvHL}K_TrOQxo2BHon?zpJN9lsI2X(NpZU?8Y z+Q;gU#ga#gWsC>W3;h=xE9+AayLTpt=2fsmH|LNfxh~_xTR({yPRXR=pfSQbpGScW zCW3BS39Z{7*nT`K4n@n>zcpk0+d7QKxMZf^+G$^o0@~C086ayFYnA5-r7F|2t&cX? zZ)PYSbaHa_WT=vP(f+B;$S}It>L(eep3+uRleCv#r;o=v#uM)R{uD&f9MC!fVo_EGk;Ff?65xlhOs?L`I^VRdC%Uyx z$r8Mp75Jj}w29At86+nS0vC86s$B5;e?0(7#nF5tgedy(-n8DV;O4Ug zjf&hX0bQz_Lj3(n$J%nx7mm%pxCWV0g4d558(4^yhITFJH+iO(+W^-4}kD=bLmj;8)ia%SDj$gp>US z+*=^IA!PLX2S5|oH09+7LhzaQqVN9h0-0MkUVCNfwc#+%*%-xa!+09A_zVA%JZ@8h5yw?JJW_8OS@Juo28)BJs( z%VOfKF3BmPQ>Zxiz8m8C*?Jc>?&rKNP6*uIq|DXftl1kmdUW!433;6UXOW^`Jb;V~ z#zf3#6Ti`;!~_i>&+sLFvPhHJVa|QRxf0H3k{eJLNd|*9@vDLEs~Gzn!3Md*0!%Yi zQ*H^|ZtGb-+JCh`={*n8I}Plk`p>qMcqr1bw}#?M@&a3EOnH$L#v4t=eB~rsg{w6; z)l7wY9tzqHr*M6MLbExP$Xycl-f4!FilYe#h+Itp3Q@NOP#JYJ*ITe@ zWOH(JTdx9-HDk9 zhW<^@6j_kUtw5{6XqFn~!C6^o^>6{im;g*NR0(gO%x~23@rdIefuNgW&`n^5Q&YqyxM@u1@sIT6>9_bGayIUX$pdlf1 zMtq#rSMW--D;g+cn_+X>;(?I_7UAg`ZubP19qB+&$OIlzsNc*tBGvnLj?}z7HFpP=pE;JUw^G3He-=y>kGi~tCPvhymYc*2*_V#s z18xNY!fWz(e++(7hlz@A;*1zJ*!}F6UF|&t`5Wgp@vnMD3yziOa385+FA6}uL*_Qd zY^^gZhP?efdnIFH|EusDq5KvF|Df6{u2}Z2q88P3Sf|v!YnzyhXvJll)8-AYqK4 zjqCMFN1MXZZy{6d(pc%E*&oD?o#xZFP!eIpGMt;Py{)cpK$CkrCG|2n<#W0Se7GOw zyvXk{AIx==ED=fLsh}OI*V@r9qP`)a`!Rkua;YOBGLCrlNgY1PFEf~A9zrVOjz|A2 z0flwZYUqCaD2tDU9(DnJIGud$cZ$U{Vnjd#)JD>hURijY+`e^?ZXkk$AF_>6ppV@h zkb^4MYvclQb#p-&A>-y>Y^BAd`j7C9q!W_sve5-WXsr_Q%ITu|c6^so*wiM<3r@^!6ZDO>LKl1aRHbB0Pn8k=N>vFR%h1WC^@K-7}3djzKSd`RV+-`}$A9?cpm z#aZD8rvB`S7aVQ5-<*VtO45CT=hT@`U3<}t@qN#&$f%n4>i`~?#cU*%)EIq{IcVonu6D`D)!O{)SNO~yvF1P_e+q$u zjD-RcCjBk?;^U9kMmhxc?_WKX>ef=*1VlpriotNR{Qq*u4cNBb3B&sk<<%!fZ7N6(Y;wqHjl~Jr5F_|;| z*cPtJJ9|JWMBXQCzePyp{@jgxP3k&``6E>VP;9?igf@(h(r!pPXIfYbC%lLztYDedkAJOyZ2l$jCS)X>b3Rn2(lc7Y~UN6xbz^z2nDhr^0t#T6o zN%k9%)c>p(4V%(bV^>H~-2&Acoy$_X1(GKAy zi}U|U`9j-I0p5Tm&&P=pP5`l~hjNKMq&jcYufvEkeH$M^T~E6Kg&)YJ4liJAqC&8J zFcnx|{aqI!`16yf!WTig5#G^GzKdfps>oQ+90!4?a&#e_E?@gM@zkYzE0B1#;+Nro zV6W$MC^K^P^df-Aj2m}xEQk=S-ult={vFS!%=?ogbTGXz(cebyP5o*r9;yS+b`yj;5J?Xw^@O%~x;lw6ehu;}4>rCr z#&D9C&#o?ghAifAx2OeICC$Po^@b2^c@RQ=4VqF4VSG0h<#)7ZRLEQo8(T1_H)D@D zDi|4I{Pj6Wk<1*nq|Q_UcCv;Xw}0_xc{}`g4rTA93im$AL!_xcnRrsYHsTtAU3i(4 z7S{}b&Gj*~M@*8M>fb}?C+#EOBxS+vSiF+m_Ng~tnr2*{_MoOG#*r@f^ihO=nd;S~ zKp$?6CmgAYKm)M)0FhO!dh9tMg^+No1}~eKm0&BN zdgL%0ZZ>K|;}5y-Wn~dFD;iEwKbXq`M9ED_qEzT={&JQOL=z@i(qEVT7TW4!k3!Yz z_Sf`#n^A5O2?DMsom}+6(&83*yiI)4b*&FIRS~WrZ?0(+J1xq$^&l_l!FCfT-fd_9 zX8cAk16I9;$X3F|NuX9be6U7%uPRKD01!IMM3-c-XB6T9ep}*Q?%gq;@)PZvz%7e5 z#6b!ag1=p*zyHpyE3G)zPuLPYe5tOpQVrO1oY3DYK>BP3AOQV@>oMBmIutS+p~#o) zF+HL`YT|s!CJeuPo4$R~fjcY}GTRbEdD9R>*_qzVdth@XX%`R)n#7JpeJv9$!&At( zw5aQY{1uWE^vF)zkc0oY;YA(r0oOr#9v*E&O$l2N{g6zK&qfjdI41i{71w?r;?P(8 zMQxUhoz``*;f$(Kw9!cuJ^G*7T#a+x{3J@ftTbCf)@O6r_IUJz2LD@}o-L<$UmHs? zO`d4C!JlI*;zM9>-`k{6GJ;z5D6G8N*ckXMwykqjP0}7(>A`gdhnntVY94H3Tx<)r zV0CHp4U_>N37NcxkhTg6{^<8IIgLg8q3W3w?4>)7McbjI(pytQgeVSJ$}*!tG=gty zswBHbjO{}W@YXdZ3oR;4F`ap~;e(Sw2)yrGM-M8sr>Ee-zNe-@sO-bZ zdaC^4`Ca#1zM-ZQ`$7R;hk{&)G|Jn=xD1-N_PEqJ%O? ztuW)Y=K4%?p7S02)RpFnAPO^uNO^NOt!TQA!lZ0VEZZf)tw>V#|K;IQs0IHo(I+6| z(DFReK%;RU#-Z!6d)bjg79KNfO^B4)f~rYcWS+e4gZ{GiNpI{@`o0m6o)G6xaf z9Ufuge_uKzMi@2BjY5FD_uE)ThvTRSzuU#uD)hP@h=21AQ;9vyj{bAJ~`;jKV397Dfa3-+Ca0^T`tNwSJxT zJh0+cnvZ8aM}BK+Vz6M-T86;me?kGf?E}!QGo17zK*c<7mR-z7)07y)z8}q10v(U~ zP2WF!`0#UKo`6*7J2Ha9vn~iQ!WMwXJ=~nao=(B-K-S}#Dv10n(Em@xjB;pRqJYTh z)|f}7q$qCW#vAC?TH<@Y)&znfi51?KXQm)g8Ma0;*oOb!6F-u`rKt3-!O1$}P00D1)^-D*Gn-vrj* zYP0tQnnnSpE&Hm9LfDx_PZVHr)VFp5*7b|)w}6AL@$q9D^#1VZ1qq+E06@t8KoiZ< zfV8?bCJ=Lgb9?Y?OB3ah1HycT~+Do~E&6w=loz&UG z?Vup`X_};0a$L5s@Dzql+EUs78?s}ERe}H4@6(F&|Le0m02J1QEI)kz2}-kIuC9MMEcxI}ZM9NK#&lcWp3s2pBf#*$bIl zic-ZBg7pfl5UZj)w~uUa3i@jDrT=SsatZ&@-G$Lg^Tkf4h*Tn!8!znl&MHyg;!{XJ zerZ*p012rvhEV)}fBJ*TOk-m`UQP>8_F5wdr+eam!t z&^P}M{K+~ZahG(X3cGY+5rtbuUYmgV;JImKCHAwdGuIO6Kj|NXuZ2~yZMyLa0| zFJ+d zwS9%We%boQQVaJL;_lPW;c_B%8oIaXXiLgC1#1MpfbuFJv5tFp!E;mM?8g>#iU+g)NHQBo?XYu-_h+IfK z(egF{g@uPI6_t;zGKkOZvmeye#{m=@t)R`u?QvcqZq`Moxf??wm}TM+2uW#kJ@Ry~ z?6CN)DOWIYz+A#{G6#;S(q`am;LtX{YNjsY4Iw-r+cFy4gS?uUQlKk^tlFL#g^(zO zl_hVRJ|ca`&VOr;ca^l+jGEeG(hE*kQ`^2M=v{^&_v)i0^FH?ivPY=EteMVLHx@Tt zH>@j5f3$~QIya;U2())j)ac*vi&^u4dt}X5ur;#naIjcO4YBiu1fcaQ@9Hgfp$b~u z^2H?xu{-j``BQrpcR=@_w(U*Sj`m1i$4;L>&phoH{QVCNov502!SI^9vB@uMGwiB| zx}(Ao{;=}KB`$SJni|U(G>-3~66}|LG>mBqDYnLg<=FrInChXS?KQu>BX9NxU(=LT z4=M(v`(BfX&}J}b1bX2l;B$&xrhrsG_~_0J#1N&pN*-2xz~xYG=D-||HhujQGd4s) z6SG}7D<)ZgzNe|PimBcZcs3IKh0N1LJD10pD;Vx#>9SFD?wn}6zSAHubD%HvD~1w3!`n9mc9g~;G6DA^_?Nu;i2ul zNhSZvLxV^A6c~B~`@(!SgjW8vQ<*QPlp^ZAkU|f;aLA53rtrGId#oxld|D5tPxILC zLL6QxUNm1FpM;&px6?dz9-cm4)z+^^sGu<6Pxp0V{l90MqN+I~M;C^eomO%p$h<+oHx;EJtd(QC5aocX3A z`mo#4C2Qw?F5e_Z;pn-hS^BTWiTc_`Y#zV7+G!ct zslUe)fY#oK3ff)Zc(Ml>W;n&SMenjW$>F7n*d2bl*+TNZ+MA??lvmBIdLE_VY}rnr-H6qdxctt9#)IjB4F>6o~2}&;{})fN&dTy++y~Y+l9Pg;WYRAMjE+@ z)0OH|`TJS|)=wr&Mm*}9Nf>W{!vXckN?y^h%^_7FLjPHN6S$e!R zOlyxx)VFau5b^fC;m&6GSO4vW+e9EP0UDO{2J}9#3eX`Ll1j%t3aRaRFG=kQm*co) zX!(7hv(F~%;oJ-fLd5SfUIk2l(YxK__ez&kHdanU$ z%(Us+@%n|BF5qzodz!VCciNdyjgKIM`>Q$b;j;=>fIfx!3eq}ctgl5=ekBHny-L9`bZB|Xc$saa2J4il_ zNPhPh{Ir^`-x&2E2AypOOkEZt^%dA{blTG|V9Va$-r3*s%TjdpSMp&Oom<4!g5Sn! zdVphVoR7u6uk8hE9`a8Y&KhmhBr>pTSKgoR8oaaTT;4+=ZULn-$Jj~9{;ROmFIUO? z9)f?c8VHDHXIz{mGD9-t?@&lb3s=bJs%{c!E{P%SQHIXvy4TY~OIZ$H?#dG0{+XQ{ zEtsRpN3kDgfjxDBGY$I5gutx%of~Z_iH4>QA9Y1!wa%7+utmu$7CYYZr9aaS)rXcg z_E9TIY3gs=paFFG@mv?G%)CNnI|O-OxAFIf6aByH$ZTs!WKA6LEa(v<ad0L;ovAdO17b?8!mh6ocr=au;~!Z{BzS zsBj3qSLb&C(8xF$YyGWwE-U2;D6*j9o=OIQcdv`YY&VN;B~trwX*vq&^J0?TZQ#iH zGFzV)iW$*#1A@5^bz7e?}r z5X|`Q^8K@)^1}wxTxl_hB6KQv>F1;mQ$10hIQSoz?9|w2%xOG)Dzflmb>xdvoZGYN z{lC4;oxm=xpvTO4hLV2LuYiXrP4n80RqDrE2#)qJwNFRuz@ zO4;&U{7v!GW6KkF%rclJugW7_?nVKKy?BxZY07L+1*{P8;^6A~(s?|#ItD+M0f5wwtCB#t9kKm55WlNW?$*xxq|HwG-`nn^7OA1VJV> zB6VvA%3WVrx1=}JFAL0kvf6*31m3W zubYb6&)-Y-+{o(LeaLkauT4RYjQa{x)^8hn7BedEzXkPBgJep_-h}9i9BkUNko#wMz4?FtqP+|XWj3{!`*vc)p+?5% zn{=V%@NVqjk%iK=43v2v=ox=6solzKYS%MV7Wq5|z$olW(z?cXj_-tc`>qzlEVB?V zLO!40VvLB#a_5NR%RO=axXx~759+4aS%yRGi`-RcppP};HpxR_87n}ZlQh~BsGRrbktDN-@=p<#{@V<&Hl|-^vz`san?ytT)-;~XJYHa#mw*J~THHtbMs2nxYa4ps3oL+9vD4@Kfm ze0QYdLn|9klVd=QOUBhRjasadqo8!cRgHw;03Z#4g;%I|csJ71F1vfy-sh(8idCq- zImmSjJMA$}@U?HCGB^CxO2`sAKk`xpMTry?oFV&M2 zGjKPKck6;;;o>WTVXmD~dLN)Vy7h?i(*^bK#Yy%aIYvFDdHW zVdNBKfieWkH_ws;?WcODb|DS51&!lw)C_G@A>ezwC+2mVf#U9#wlRbu%MoZKDV<>D z%W91sp&VKpsG2(P*-X0aW=8KBl~xQeL5Ns*g*k&#!<#W}7QyIAJK?oDH zh{E|}d|K5ZOh$$z=5|Q-CY?wAi?36EW6D-3TtO;6JNsXgiY{k)-7J0f0_FDXgzJh# zarq8zKt3k5B6>ugEo`AblV1rOe7g9R171PjvW$&TCIXj)Nv7n81>q~@UdN)mrVXZK z?wqw?*Glr_%tv`E49M$!mNrk{St50|SS0Ra`8XNIE2fzO&-~KoX9~_2$#*l8_Ve~I zlCtv$a?EeLn%dIlnAuXG3eo&lB#4mR0auIikpkU1V-j3Ixb0-CZF&cd@HNmwsk#$Z z5QFaP9$evzijI2jQP4@@Zy21Z4~li!Jg>hO)!9p|NLyHU#d>`XcXkPED8q$@vXHHb zSsNpqS0O{0hot>mG{2bd6xiu6up+N5X$F@7NQ95EHX|_*JRH$~w4GOSIui4H{i>lG zPNs-nfmfqxW#zlM0|(>#4VU~WWd`|_nZ9pn~B_50*JaP zOH0}($?z%ia-lr89&&$3F7>_Yl3#uh>s()qyyMXN#nNoF-6|B2vOl|sbG(=Vim zMAw6hT41|S9?RwR)Fuo^1*blCJ-6f52!Ua?G7b+P01?=Nmof~hXZ8gVx_VVIU8Ap4 z2U#GopPXxs$MaXmqH>%tN3*8i^o}Mx%<`{TESBr*6`<)DR8Vq4?Cwwzb)5cEv0WZ1EVQlc{Ze zltWzJb_bl^)vBD*s+VuDxo|oQ94b}n7FgD1{{5tCy1X4`zsX0&t~V;0oHm`ix`tRP zG;2HmVF?p^tg#bQhPeH}Jc*gl7`(p5s)O`>prLf%pX&eJk{6KjyG20`ll7{tb(5o? z1tU9U6#|-_C&};3_DRCie_uVKnrRaYdCR&hM|G_835m2NOtg6A=UVYwFVxNwht=#) zw02rsEjNCmBxsJ(nggFz)P8aaOXlM)V36t!8)ahIAIo-W?6-7qYrZBM<7VW|Zx}iW z)tG;W369y^3!VhP6R@?BsPVnttBo!*Hs!=-^W(Z@;4C$IycV0D|M@CLhjX`l%w58{h;c%;g8Q_<4K*&x6htn*1;+l8_bopTj_60Ewf}L>RH`SZmHj($^(HVZ`NuG@Pj@HVOyku9;)!ceFd*$M#zwsq=bsjKCE0R9+tf7B$RKM;1!{#%Gs5@Np>YfXZm9^R=_~w31_ND7( zcIf8O9kX(Jd!55^orzibp7jcKs}pdB;$hwCr)sB&o;MwzvY8vcZ|C(4@;7)60GoV` z7>hI-SjE=7wJ-&PwVdazm8_{--j9G~jEfbCU>%Q-X!AD5BP*|-H~Pv^wIJ?_^8 zsZBR^9sB%q zA&CN*WWPbU9&a&z&KMMuxIIyusSSD4m2vKPwSe$`HWu*X zJmCO(osE||oBk-L;FDi_F`vz9g9$~jH(X$}p!Ly~qZZddxU=uFg8i!#XZ;6Ld<_A( zgZMSIzzDJAxWqKgu?iWaTc_(^)54f(bKYyW7Z{8B#=wbK={?1KtU9gpxF3N}n$&ss zgb49dtsKkr07r8tsOJcK?IQ}Av6(3*H{&IL5qgw|No1F8H z!DYo@E*_05X)vGDDJdC6Jz_#1olgf5#N8aw0ulu|(K}aC+iPjtxWtURd4(A^{rcrC zNMv?>F)FX|b?=cxuDID7V4aVwRHu}r_C5ltzu!|w-BX`@IA%5dJM+t&t@TYdy-}q> zrWbZw=V)4v3dL(9DBOe zJQZCSIJHa|*x5&fY4``nPMe)`r+`Z535Mb>AB^{pZ@#-($k0;3aiPrZ1P z;*)__R^C4(e}ns4mlU=wXwaRPE?ZzomVT|P^tK@rfVFM^aBySkI(N@0#uc^@X8rs+ zr;w-RZnNbI-G>&!xBtNHQ@8J*a~JrboTxFgjJPKDhGSOtALK2=(Uxz`R}7b0R~DCM z?2@rxeq)+~ch>N6DIzsg`djbLCGl^+HUN|drf)J^Wh5Q9k=U5X{akzpk{G2cSax|k z#gH+RyjB-5N-&$DLw9H z&#|Dlq43Sc=M*y5ldkjNWc+#wyZ-Ks5!fq(9p|7ZSb7ve^pl>HEa~nFVW<4H`8?}^c`xnR1~|C?n3^lr`Q63S z#;xB2)-%+>F~m^IpFXhk0%)E!k#EQb3iHZ)>UW_3z4P!|E5&)4s)r(2 z9h!Qw4j4i8u2Mq4VO2MpfZ6Ta8PkLx zS1(S^-lSwQHH-UYlMnp&l_DEf$L6PJ!}gC~MvI(bhz=6?LX3v?P={VI zPlEn82wrlr+?E&J=pz-=_?S4oU`JBhzjEm3go$tT7eZCDNtwSv9YSXbRGCT+6gEzg z&vmtVoUW7D1vMq!{E_=fLm=>Vx05j`VOxW=F@!5#AmnB!YYmxkOZzFr^tkw?Rh9vW zci*EXm(JWNao)FW{!R5Q-oR&xgpEHIh5f0j|LbEx+xX;8KP)1!vSl2Pjjx!pmV!t` zQiofUYWHER$jGXroWVqubX^yxQ=sQVSE0|3b&WOjRV&+b8A_&377Nd{APE5={DS1y zc1GORM-kQgD!#()A?-g&Y6ESfdDr!iBFDT)1Hpn6lD}WV8#O{Lg)p`#ag1JC3`5CB z)jUH`#8#xrD^;4jA6g)%6VNH)%bAJ~t(_zfC?2ZVP)|11fCc+Es|>V!v{@i+Ea4ab z?n-cZz-ij1vD_`XJMNOFocQr?d{DQII2;QyjpS|)LbD@Ya=;seSoIy&zKfs_)sBOT zTjB+NvvWT`zVv+O1Pwtb=6g762^eNavt;KJ;B4^REPJA7Ux!O!b-j0#$YD!ze%uI0 zsU`qyqI2A;K00Bd$Og#PwM+?B4~|9(=ash1@rt(2Bc|B2o5}4Ce1QpJ5t z9N9xy63;BQYRJ{ek1Xi%i<`aAw`oc*hK9>t;q3vMw4^?{Ol4pUPPDJz%6|U)+-X{t z>SH1SOV2^&<A6LjD&8ho+5*O<^aAU z?vLexI~7bqS@p{`;e6Td-Iqi|{A?4c3~2&Z$k8N6n6_nFQa2MV~qc;p8HYqf(l_KlQ3b=idD8 z2w$jCAml`4@;SXg=MDZl&0yJo|e!mrbaxt)}6Uiu1OlG;IaA^l|XBz$$o#SmXv6(;U^ zb=k1vv1-GMGfr*-w!^t%aPf!;ux)1y*B5EG*v4=9Haz(^Kc*rM_@SG)qn8Ki4%ce# zzIm*LhiAdu^rQMoJYLS#GslbHPZB|@Wz}v-=w#~o#-V)r4>iX#v)Ey2N~4wwZE~Pk zsipN>mOgq&>%ZdK6@D79iRQ$I?7dOa6TbMJ*CR`#-E9)czqfU|2V`H32ZN9tk}#Ndar^w!G#4qv;&OEn?8{24X+s6O&cRx>F_v&O$X3qKUwLWX@TzO#4-SaA3ReNSkob&T*K?T=C{>G5o zTZQvqi^bP59ql1{I``YqqNdYDp5J|kHZ=FsY0Y+LL4bnBEG1Riv z!F-|8pAW;m=3b+BK&pHr_biRj%Whl$IZLO+b90wN-y~z4$9cHaJcYxY&8qvl+!Zd% zWxvHU7{qF|Ug~|k+36q5Z2A{$|NRVg5|qK3G0>yb<-UCshdB!c40FJ2&`u(8FtL}HdS*rc@X`u7*T)%XamskVe;}AaRPEy>nO4}dT zH4t1R!hgroH~HS#^S_zSyAJR-GjCT7PgWcWb?rpN;iY@roPRBOZT`MN}E^EG0XM7g~$Ej<7#@auGZfBYE*}i&(>^kV(p^yp*v27XSU3F1D#r>>vhCj_MMAx z4x7()1a*?T&0tbnha#Qxx5>$U#-dnA^mA2JdyUo2J-;Hu(wYjB{YvA>!0Ugb2^`31lqe*HW?*K$t1i}#%w0K{f;|SMwJ9DgCtFbw%C8JgE zyt)Svl@mBeT;_mk1t_GKlhLY-7MqqC-O7#PBWmmR2EEbyJ?e$_rv)yf@W>z!`7S*p z<%#TW!5SUIA8&h4n7qX|a{p?gF9!z)KxsZd*-^?K#QfhWOJw*SlHP)&HeD$S0g4RI zL$m9ul-7Mst^vG%{1xYG)BgW%#qY|OXSVI+rFPs9NP#k$b@ftzy#h|rF{+5Xe5Kl= z=FAs5$99#yDGy-5hhRV-{e+pTofo3OcWTQ;hUk_4n*A4>Fs%ZCDZf0 zKNi-rw~$si0^57H@903s&GBFzJfOV=vcK!8*MLGczqq{C^T4X(nG~qEe4Ssm7Rjx7 zSpP7&j>o1|Z#-Kw{zPEM>GD{te8xqNfTOG_ch^(a&~(9}Ti?RnefaU-lm%FMHtV?s z)*ULw6Mp^l?bmJzOAB=uJ`4DqO^0(eYQgtlLQiLLGLad)v&V3=Gr-n+zK_3{2*UOo zUf|31mK%A-7Ymllp@T@8Vv~<2a8;S?t`j?fsR_4bDP7NZ7lV;mnoR;by3E3P%Z|q* zygtdDf=TBVzqH+NG7QTWVhNSw_sahAT#ecPwxi@QBub2nRj_nA*d`sd`u&^dy@=fV zV-eLs%d0@i!&b(w{oi?QgAp(snxN;p8tmI+bf&2dAx^EX2C`pM@sJcMSL@p@vZp7i z<>PjAir?Nl^NP404w+1!Ph+WOq3>|VHJf)cqWD}t;(`Eaf}TxHjLl*xh?%3ROC|WW zP|N*<&D!zJs5{M(cir_;bfuC9*yVYB7Ihp6s2Myj`zwSVt9jNaX;APewa%vt;g@ea zP*Oi@RF5xf1cha27E*8=P#+hY*i;se{n8zq7SeLXeyi}X4ddVicUY`rk zfM3ltA=CC|x22x*4u{Qb-D#}v2-w+WvEDiRXj*sq6#2l%ZL@vb=n1V;{^m3ZR&tYA zkuNtVJr8Wnb_MPf{4@&{&L6}igTD_jS@PuwJ?3)Ek+{9z_x?T?z&i!Z;og~b4ZGj{ zJG*+XJl+F`^N}>{1do>$_18*rf842l z23Kx0IDmf~<^_SO{nhv#RZ;sT#-$@vTILA*6!J%ooC4=xZm@hescF4*BvYC!3_6S| z-fEIdH!o9p1j10a?T=wg3h==CH)UmN#B#?DyHjb4IVGi2`jzxUv4U$W1x6*l)BbA3vUP$1%|2xEm2IB&jrC`7%8;igeDHORw zaorQ@`FtGskzE2-J=x&N8E-h3s-f*6P35<`qQ&hBo1oiFiXk?3I4LWB>5_44Sc*MR zHc#oFmG82fL!=;5WkSf7-+E2RAHHfO!wT7TC#M1(B)g!V5WQzV2}9N{rb4tdo&x2p z;VK^#;9xCR?SpTwN?8Z3`J;wM_i{k@;b%r60>EdOVi6maitv&gXUV-;G9;K7@eh@1743J1Q zlwJ=}Z|1Ih6>ayp45p2bJRR9jE159K?Dzlv;wVUL|6IH{_)67ReD+Z3Rph;MlLCoA z;rq|qx8}L~S=60GC^TQbA5JCUM4T4~K{RlE>%Q)YkxlHJkN%Hl+qT9?a1y$Z-4XL= zIt}mZ346wP3PAx;PMf)P(&Nc+hInc=fD5lp0J@%ath4r#=aNM6=2DZ3Y!1&p^(}o0|*18I7;3Q#`Z5ec!XgesfeJD zF_|M?B)tr#XHwan;K!^$v!WSfF`s7_Fp=BvJSr;)1vi!QkqVQ$SRi_4on4ji=J!>nW%&J;RfPS59|m}i zD~>dzz89|{t0%2T?g;pi>mWQ_k_+6dH>cq@b4y>&&ua6J^{%kOF!x9PWsl#Pe4+T8+}TaE>?@aupZh^!+YFIf}# z#P#!GVu7iG!z6Xetq#D>i^{%C#B65%`)d7kpj>-_92ANON#e5M)Q~P?1wv1FBv}jQW9lMuIC_f z3nD7Qa|FP~!o|N~{vlbM;S2|*?-P%rhXj#AC!(aY*xl~xtl267~(@hs9XwRA89 zQi--}Q3?3Lb|e#Jt3#zZxS)Y$4GT+o&Wv$@-GNp|~8z##koBS9F-&QtM_p z`yYWg{X)Eu^oD4<(H>~P?W>|1dcJYWz{jbCPpSIpDup)(ZRA+uGM)I;CD#nm>I;$( zstNBJaEk@dzIGIZU%ms|PzcBwG4D_(8PE^qU!;3y`t%;HsrGj?^ zYld9dH?NSyRKa`K;7cJ3>phfDld3QK%HSwF1wB{RsWo-n>pHESAvK?`VM56xtghIn zgj3LvA^DtAioFdR9?T5;GbMl?gCvsIDw=}T^@c`|B(4veYDQx`^9PUY`4`NUZ;2uD zun)oU-0t~Q*~uMY-P_Kxqn25g{~k$zc{nO5P4U{7aN1Ec3tw4%Z{(l~dmjj|d)sSV zl`b~P;F_zC`bo?tfH*c7G_TRY8D8Wk#8DiNoACn5)M|3Hu9+~igBq`#Iu$CD)@lbK z!Ul4Ny9lH!!!gTzHWv_TadwYN3F*i>uLFFbuWIH zUgAKm4`u6@$6WDQR;}WK>YfN(O{$7oY_0BgJA;^Y{VQP;7b{aG+k{qy9PdvRy$5A2 zfWcwW^qiaFMy`O5VS`I<`ct4~7}uB4U#arb57%CF)+naj-9%jYb0S>`%AbyhJH!>e zHw6+R7)*iXm42fMPZAqwCu}MnxMlW1X#6yn(m0Lc0N~SK4qg2|Zzyz1Tn`V(hiV1eB zWlxj8TMG3VeW?}h6#cS(z%DpI(m#6)EMvPKJq(V*Z4k$11(E$|;5A)#I*(;>82uxs zFw!Aj!&5xLBjVvNaR41}9<&&{#x_vF&FDIN<;Pz>SA~YfgBYd%)>GvM7*LOCJpj8< zo+f+If4U9y89KGDJ8>&H-*pd`Du~oBHNEC&ThyLBt%_wwB;hLV9<=1M+s>Un?tR}sgTBXOUn&%w+_qyIog$r^lI-J0gINS@pYWtvMVN zSajoPPh)&i%ZHBQm2R?KC;#aWrj>5L9{v0&P4d(tWHKWl-M z-rU5wRFCNqt2 z=L`@O3?UA8JxaK?j=T9OZ^02p8^SSwNfMhqJ7tWqC3tera|mWONWCxbl_IxR*yru~ zDz~Ey&&J@E)LC-Y`d}YOlFn+j7RvLrE!bYA?kF8_ZUXcf1`e<1S8d~rg7yE|iL90@ z00#UFeo(2>@)N^Z*4mK?9L{pOzI5moU&VRtvPdn#6DZN3e$aC66JHBkf*Bk{;a&W9 zG~MjpbWue(cBB-SE@-fP0Gs08Vu2&nV zO9z%0$!i;qx2vu4IW8W-9Rac#0J3^q>CS*_JdYM1x?>qUuKY20+Oey}|L&7BCA zY%HD4e)?LTWP0(D)*Z=`&!+w&drMgdVB)K{yX0Rw(9PKtF#E?5b=oF)kh0kSR+?Y5 zUsJ_#`KVXL6CYF>O{g|oOw1?&2>SUddCACD2Dh;u079z0(B-c@9J+I!Jzuk=t-ohy zl4G4LRv=--LPd&BHgkB4n`SkC)r= zs8QV@CPB>TFmZUg%29ae6xxG=N5tmvTHj7sdMW_cT{X7&;~mu}ZMZ!2EseUQC8*T8 z^tV>DAzCc8e3Tq$Uqj?MECZ7#+r{GF4xQt$$Q2U{Wx1zt>rNF-!<^wZ#H?)S37yea zwZfurPTb*tE%12t%urAP-aU!v&HTFYENQDYdE5Dvby8B-aW)glS$i0pITZLl7Eu&kL=>LA$qks z$G^ZXOE||u)0?CpQ}E8xVumMlJcH7ya)nK|QUtXhLzJcG(`=A3Bk-&=?0z)~X^r6C zG)|Nx&O?i05`QfR*m?e#FxK7%bsurrG60I}Z~uAATKA)sY1Bej!5X2_zXY6Kth6N7 zujvJ2q;+eC)tvJpd_oBY-s%ka-*`zn!LZdcS1A!Ba*r}-*A@<0eimCe)8rhMJRzRiLcfC zV_NMd$<0qZF7fQn$avDLgl7C=-jdnqdJMoRtkxZUiY1I~Emzzh|6J9PLYaqy)>Id| zp%GGll9!))37Iam8Wc=VfWRvKlmSVaMgMfSHB!Th&tVK(E+UivdZ@+_W3cTGw=I_; zEB6+c{Z(CB&rR8Dq?%z)N!IFc+FLiUI|z5pjXXgyb^WCnj4KL2lcmyGiyVWk1cXP? zb=kmOck23&2)Xs~aPe2MSe@*o<%EC$1x(wLl45Gc1V20^XRxKfTG03sj6j^j(14{o zQS~}FRQFYM3O!z0n@PWKUXe!q89ecp$BH!1p(HDq1ta@gvDfTad+bC9R0Oa|YveTW zuYEY#M6&a%raF*^0Jfis_X2I`Z1s*CTcqY}F^3tPXb+qFg%zCTEA4e&amqVnle;e0 zn(7JT1~);$QE5Npt}gR}#*aS8D!35wS+?Q^Xo1CBqH$TS?+Ix_=xBq4&is~n6TgdU z%x?0g?=+mwR-FSZ@pks$s4eg>UEdNjxb6uG^W4ahuz5^{^Dxe8;YOvT`AAkOti$M0 zOs8tKT9&{BfkSi}*X=1Zun6wvPYwD>lN(9RYb_N{AbGHimM&AD5weVYPz2R{3Rs*m zpaCiFBKAihZscR%*tGq!R;zU*dEOItFGF0*_Sm2I+cQsVIA3OL@=n)9`g#T&|zdbYaa#}_m+#L2HGt#V}JygfHGpe=Doc`X1U?j z^&Whe8kxav{;|bm&UWq>&1$jK=J^m~T8BZ%ZkIS~)gcecXvGVmC`eeK+}vTrxh^hH~6Jn)}`C3m74@chi5TW z@w%sXjH4Sl1<@|nx$fMQk);~jNPsg{;ZsKI9hvN|B@ z(ziJ>qCDMLxT?}KiyRN=4B{Bn}Xu`=Xyqi!;%YnR_q?!x&j!S6XSd}zxS@2WV6hXJkVzER2SH>L?1dYb?xs!}29If_5^BZB>^UG(;m%>Sn{ctKm zHZvttC;NHbhX-+-<$9^4M0_{d0EIXvm*efbCO!)w%=ZjXF1)7eh~#1bhh9ex@5*et z24u3DAC6f$yy!9tI82AI!kSK&o90ewSW7q1t^d}2w4882OY592lDAmRvI1KT11N3L z@sG!;StK(XiWMgF1xU!fX6h}8FnVwH&ssZPY_rvixdzvhGqvaOJ5N7%IBnF{Jhq?y3-qPc;Amo@OrP6DB2(m?6rUjU^x`#Fy;;<>N`Ul2(!ZL>iH=c{Pgi_@UKW-$ff#+I? zuTkH}^~efl<^B{o`Gk(4rU@gIsn^;-#ns2y9z2ea%8xvwF`Z7&jT+)Sa;CSbRrg)y z3~($OJl$Jh9ix=-XDAAiDjLT}mmqkl_BF4~zFesnT7f{K&Yp5F!Rkc}x_hb{r}V6@ zo1UN>NYtiuRnK!HJy}X8Ap{GLwX7$_e;VGGe|S{H$E%p}4W&e?+O8Kz~&_!ev-`-+}@oj_V2w9MIVncZcN+9>d?_s^}nk3V6g(*9< zJQ2lmCWL#A70^$?0!8r+?@@bD(V7Ezfu(sU_bp*YFtni`+i>31VnXabxWA9_1)LQf zlh;Bg2(rtmbJYi2X|jW)e1h|*q0z?Z7IuiAu=347zvb~&gan%dK0C(rQd&~ZtOP}5 z7~SQ)QT@%3q>H&LJsFUOs3a~4fPt(!s{vx%5@^#)eL2`y&ERI1M{V;rsh*(o7 z&V$jGV2?2lH~J56KQ+y96`s(Uevl1Sdv1Agcr6}-A7ZvfpHi3trBUE#ErHZ+pY>iN zz{jlGPt2X9R1w>RNA-cg?{~Nv)E7>ACY6#dS;h>H$#yE#AC>l;kr*4h7cU$A?VN^B zz$zx(CBLnBoj#Jf!*=aa)8iwLEH8d~T(w`GsXDGR`cG~B!cBp9QMT`LrKI{}ABhWlofYz3v9~H*v%>1rM(U8rm_s>3L z<~Ff?O*(iCfbupMwE;x!`9CFcVs%=o{MLIz1U47+v?C3kSpcGbx@cW_hb1wzWO|DrVw7H{M3z{O5CA64|}t z=TrtcLkM+xPSrKJszyRcA+U%PkOAAQ$i!)VfBFOJZw<17*F{ho@kz1gM06Ne76k<6gU3O_r{Y>qHaOostfV} zsivfr&M9s*4KPOs$?b`D&V$h9{<@R-#Wi$qqg<0(Cn_5k{rJ8!yEIDBL>A!pY-{7b9nGW(sJ@jpu6|bN zU|&JME`D8YKo0JJDFy1Y;I$@v`ycHE{0sXWxq}MtvKujz>$Scs22z}o?yFQ|y?<8` zcz5)l1P+>r)urlfpRCwUe0G-n ze(CGs)wX#W-30?Yn(>@9@?e(We}R$)Vhp9wU<@etsofB)Q?R<(Dq9cko)5)NRFF!B z&rZqI{yh_BS^9C(aoOAjpZEU3=zlMP;vBG!Tw>Qh2W`#n?;G++*0$+#*s0#>4kGsp z-lWce6@7G!`+tZRzTAc8^rxrA$YV({SUfbu3D!TJ9~iN5n9q5lC8xlI>u z!11y#PrNw3xSF5*Q`6!vtkOKTPv7_$>D7O#Ea;jhL%Gmac8Z+Gq-+WkTMeCnlBdDV zqj>S<=u`ld(C9OPUTFhisYfbfP2cbgzph%dr10C$p7|Lq#^9Qo6oWn$O6G2Mqi<)p zbX8m+VFg2egcdAgT*pdTNAH_9r#@0Ky#t_aDrHg>va1Wi8Uahj3YY?zlqir3)6i|{AH^U=aC!LK+c%9h4Hj44w!f;bx%r=Jpb@196SC@W78M@AHGg923IGU?v@ozqtV z1<#a(X%IygYx|qQ6po_!&g3WM6@8~<3+b{Y{fg4-7S9BSKw1;KAWQALeu)TOQnOpv z$f6Jc?{1#rnA@ZCs?v_!Df54jF>q1pv^&Qg_ zKn>OomCEg1hGXW3ImcjY38<(txc$`c2m4+O>@)`J-i*yw?Ow{yd6JI{J}&+uz8O-e z+M>Fq%X<$&b50X7PwQ8CDl08ZQ%j?rPbtl}tE?_2Sd(8jI^F~3z)o9SEl2t13v2%Z zm~;UVY>x)0JO@~k>@KF8LZz6shKv_ZUsbAdi_)+K(7;FTOax_N$)=KmXUvDxk1N0ru-Z34mpP_^-K8v)N z0p8@aF*9VEU7sL-K|a1*!`Ursh7TjhPeQEIS1`25!|%Qlq{5KeIqoM{Zmd}cn%W)ei%J0_kF6U zxmn%lW_tLrY`ygfjk>;L49Bp16n|RYST%U^UN>`C!AOPhB?OVHnkr4kQ(yPhoev;> z3COsyCTlCIo1gHsX^VeP8w(h-K>vcF$)myBtS1GZMH4F_!_22;0d=0EyK}>fL zdFl&--IV(>gSzItyO@y#~R{dK4N!TyBKIVL_kq$7d=7Cv=@(aq|oCh9@2eC#ne(k za|l($hT&bt6OJS-8F z?=lSzYGn5J%D=TA&lzXW6AH%3EB?xz+byKwlv;KyVlRqD(VlLC|5_BkCmNg=w9*e% z)O;hL;lS!GEI>-MR^m*x6Zq4s0KJOh+kl_?+|)*)mDMK$Uo}>Wt9rO3n`?mEOx#9^ zYAQI+<>L>Ln1H$HGr%KM;?E5*6$lokt1hb}K z|CrV`=&%Ng_yAM}26OYkBC8&WJH;_aINz%hp$>|M*b)=!%HEAs zvZhNg*QJlQQWw^hw2{_HW#}3bkj@rZOxBl6H(5=pFdjk|`l@+OS5IsMbz?w}FCeYg ziD)$>1DzyQAO_+*0PqHC&cGFA1c)>|y0MJJ|^*DeRV+xaH2A7uW?pDYE>vcX)#uzPLAz$h*FYq+izy=kA zX`(~c%$C~IFAI^KZ{bSqP>HBVs-gLa!ZmU14e?9rRIj3g9M9wAWliZA7Cpm$qAv=d zek>g>zJ+m>2YFtm5OE-XmPdYOzxXmRg;oGe{2;d@!q$R06F}*fpwcH1LJjCnGlXJb zrZ`BzHI)dQ2OUJ%y;hNfH44B74C9*s5}>-WFG=wx>j+vmnL&sC4rtgO!{8TuR&(Fs z$(gncGpozk?r6%>yK02hLF_!H!9LnahGZiYE!T7kbG63D+&$0pHs2i?5@D0oOD8xv z{hvcFq>TInY@9iu4WZ#;not2RB@#%S@x&$i$4Oed`2-vyNH+{)RMCkuU8zOzCLJQ6 z)QdXM*NcCTD57G&h=;2 z3_l%qx)*~?`FhA9HtdYAVx%D$EbK$&8qHA*GsNJjFV@qcY|^2z#r8l%AT^*B76@tP z9_*ki<%D|9VJUCrSHlz|ZxkcSB%`wn3Q&c~pp$cT#ZqBv(D{>?Jy4OAg-e+=l5&68 zEIiXpg4HpelzT4jn+vfD9VmYc^&4j?hi+W-acFxYWC!&5g8<7sl8$A+8X`gA$knp- zerI;HD2C)jmczG%dbQXw=?q#1`ByEvZq!9+NjK>$tNF0Ha^&BQs=>ib!_UV!47S2? zjarRod{AP{mVa4H7Z*7ZH2&D58qpncnS5t()8;UbepZ>8@PqaL&k{>igd$BEl%rO zRDD`bSj@w5^T;N9K0~ST5X*6IQF(=-CsHkj^Xq~Kfdru6v3T`3p~%Oz9bS8sl;u6h zvVy)!Z4U%xK-=U2LXB#WZ}l))=r_D!@~L0Oo5i73?KjAfnB}Yd^W)3T{w+Y7`=9xW zu|%HfjSd?yhM3XWmnyxYwoMGv_?eKR-)B3|j@JyefBeAgZ<@WHHj0P9<#3MF<%S=5 z)K63|PGZ*9YR;Umao)(+%j3EiuW?a?3akYFZ&^h{kNZ6~Q?g1%zk2+K!w=8F$(op4 z8mTnEHb(f!7O;PYRdFvuG$zt^D??j0)2NcMX$c%%h2z#KA!o^cHxUQOz5yRbf;av6A?Ba!fG?*a@@ax~Mxk-t(-^mGZzX?)G1D#Vtl7ew`elJJ% zMwE8|yBfDPlSas@J0K6Y{@I9^Dc>pMd33>=%k3OiOI(FUy(2WVyS$L;C=4)X?W?MNCrKCyeoRU1QXRBQa*cbTjqU#6E>U2n7X7XV!Wf} zD6GGW%~B#xtaI}%e|><0uGMW=v!ewz(z5JwxzYP~6Erx=-ho{-C5NL7MLoMQ^=6N& zQUob==kMRD>RW-dU&9kgG%U+KHv6fC8x$@650~%H?EFk^4-yToy$MD|YnVAih_m2D z^jas&FVUwez_vK3^lE`{Uo*Pb;;DR&PM`>S7V z^DqFDYCtlR!}w|>pE%FPuJ5r#!-)_Nu*BS?!4Qgsek=`Wy{K5O3rxXRV4RGxPqk}d zmJ)F2skcn8H%e6Xz>@G--w40t!}EF3b@c37EEkSWGns;mNU}SzTAs$M8P8f-EVt;e zi(R=%sZUF0jBDvvFN04vuDQMBP6PI5)p{*zV1YU7md4q`3FqsyqlUAbEPkPX@KS{1 z;rfSB==5n={Gnw9m-CJAxBC8Lm}#bniTP7MAct*)nFy^vQd5@%pwDCczxR{&F;r%P zf%8*=qkB~PbpU#6%tX-!V1Ef@4fhiCA1f^W!RL1D6t&K5(w|@7A*VCmgU4rrVLRl3 zir+FSO=tJsds5lZPwP4N?SRv$x%q2HMCDX4Ru&UyRGUR29}G!6MC%?Uncfhc0oGg5 z)XH^tI+<^%nOqOR*tg)1H91) zJfZ{l)=*%XS_BKeL=T}tatA!a+a@CAn524NM9h5$XjZXcba7cnAv@8vHt1;gw+9G7StSE*X< zan_A`V1kU#=s5B1Ie^%Fs-3pT5x40!pr?pV+YsZ7%gt?lW`3t|Vn5!h$ZX)thSe$! zUHOmt^ErPccAl}LYHi5 zYvJXVq(P0wwCj8oV+ac}2pWcsoAf(@EH@S&aER4Y>FeSa%6H_X_5Xo56Sxz~5yBnv zO5`YTgEN@b?BL&=qjhi&aOc(wul+zh8?Vi6J~y20N!#%nYZ*xW`p_uxQgyWNgQ=1n7mTJ)3nE>0K1itkhazi&Z{ z*l44M)45icp-5o2d?^!-WhFo(XEfWi@T(|w8Jb(uKuveb9gt`cL9~a>0I?^kaFTKg z$72?5ms7ON+3GL6uKx4I73vC)zuDVz*+t@Qt z0pjHLK*x>ATzfdo`t-Jd->QgH zVUIxvBuySRkqs=Yy4FyM26Y{sj+UB$RFp0atI6Xb5ChXyHmFa_1bwxbl%OLNd!A&GJKBj*8`Sqhc-H@9A59S#TkXz zYwG}kAgNJ3gdXa6zLGV8^eZ6>mwCx^Q?x6-`%#7sLj@~iJ(;ce7W>C7Cvo-qLbjL& z3Vz$Ypx$||;hf!`@I4Sj@E{@2B0gDdBh1$}YE*v{C^eZY%;3RVuQs2|W%<`P;b&Ny z?Ojf{F<{B{fXB^gar?Mu{@3nkC^Y=tW^6w!@rbr!*%|iNx7)hm^MTH#tsJ>U8EnSS zQiZTQGW4VfIF0&e!pkn_*Yocsf)hnrc}a(Kts%S|PS3ACzJgnPfpFNC3#=t{8BS;13ncF3R1+nP^%31RDlTDB7X;HH*&MbI%!Vw4MA3vsxBEVuqmu zqTsVwcq3BS;EEcQxpd-jC>qavqO}403(L z(X#nP&1`h#L}6^}BSzFPY6B!12;aR(dz?0CAX{6Rc|l*<*D;WVk;a}sR9YM~Ga z5b|S{W9~*9X_eJB-x>i!2*;azP~}?v4gfLGYmLkAtohWsjh-(_DEGEG;xzst#W3s{ zY|LowCLR52p$qw&C4gS7-3?xJn36WQVo)-zMt2_g`(xIPbqmTqx)XZVnmiqw)*Z-X z)qUD1wgsy2fY^y|Y>un{=qw4xoxBmNCcF7??YR3xFWw_kQEg`D?X$)cDSG+lR|0c7 z31T>_0|HOcIB@TX#s#Jm0*1&gF&L#P32Qnmri2;+IxfEv9tU<~2R;SsuSik?M6&5dcNxFsb1}+dy~g`CN1IRD zzEaqqHSJt_&-rOgr$R>m*4{`sL~7ImXVywRxuNU&Xn2@bW z{GB&nw|ki0p=PtzsxgK07*p+qW(W7R9hul!-Mif-7HkA?g~P|CFe>QRLEc=cK{}_Z zB;P;Y#o?BOiMBzuIWk1>_wtyt*3~dRe4>P$Ua8FaAX_Zw>j;h?cyE6wXtX;Jd5yS+ z>c9K(xju<^5esH)MU!LnKaM!2ZR*m@YDMGSM7jd_W#=3D1R+-zV#x|PLu0iPBCy!b z{3;A6vWxJO_tVWA_2#K+)+@VzkxBP_ifp>Vo-jb;bi5cJKu6l^$ul9@wkMs)v%p(|L}*_PM$xNPW7Ad+lMw*Jju| zq^8+H&y!hs8mnFECuP-+H)QjP^Z2@mP_(UD8ednByuJ;NmfkHj&3ZZt z_`q=fX5fkIu8om!Z%D1;+2;t zHHVrL)!^B(d-;Fx{1~#x;XIAU)=YqEa>M06$W}D6dJ3$^1D$G=XC_Z<*S*98yaiAb znW7^sL+uua`Ihd1-;mDf%mY*c)$X|+JdG|LRPF-DY$1d+BbEI6kt0~DI3v1F7h3D} znLD8NL}lrf%y>~3$q4gMT5C*~;t0F-YPSHMyNDVKuJY%Ka9WY1H6<0>p(IE`rH;PP zxDXLLEkniBQF!eB>lsiGMFx%%r% zbAzWv;>01bFx^!B$+M>%Z77`&{%;xsqnAwcBH4A|o)fD7k;LRJ)*+ zsk~8I0M#H))Q|**7Y!qU?sVr}%5tUaxhmc|m^ui2T7ct6fOBZ&KB1+#DB(Rg`6uUD zHhm}0#v?)E&9V7W3aFp777=~TA3>JyyC@emcemju6S04Fp3x+Y{9N??%auT&(pw3g zO5`~O>|xz(=m#QsPswxhCuc=8a_DjSIFa3Aow3l5PhyARe(A7WiKYzqKhGohmbR66BQz&p?1S@qPNOjkquSCAJG_v0gw&ZDsOkyqR~+-Ih3VPntSoTr0|dX zQ5~>|QU^%w*wN3yZskz#>|nCVPNRhh>vD-wa^=Svc?8uZKhez9BTZrY_bAPLD=M`9 zUO&ARFHy=8rT;*+Uaemre3$6cjZxdIe~h3l;WJV6=e=M-uAWNV$raY%c86ateUk7(wqH39Lk zMVv6eyr8ehuDJf{#d|;(CYy7%aC5w5HJHO23^GVzDR%CMC%8j0-7cZTDP1)q3l&dn zZ2k;$1eo;DuE>%@A3y!Q0t^x%7lSd-FiuA45A@7#9Oc{?O-Q9` z2`SMnWHGSgJ$@!yH%or^3%=e4a!F@^)O8@fwAdH(T(lyJPtxYkd31xv^nZEE8`(x_ zGn3^d=dccFE6|zMn0hEpeQtI`>OUn7A)m*5eJ4M(5#!c}CuHv@8W5X3GYOObM!dR1 zk?LbRjlN8}{4E`s#V*Xy?h|Zwp=XXDq6lLkqR6QYT1F@t44SC9BlcWZzc6)*kW<2d zBthUB3=E@O;g=CKif(+EDUK)*c zLB~|2bbWz3c+v2{1m;A@f*2xHn*@)V0NW9z@|e7g*gs_VkU8=g-r{3k%JQngLXCaJ zytn~-=)4L^{WxzVR47GwzU=7QF+j=t4{9^wNL$80q*TNt(QN-LMOqpgsxUaXpV%+o z6zT*)6yeBrztmz#P;%qr3LodRqAetq;!Pij|?*zffak3#$hT}J?m z8~Wz=k@Q&E(dD0pMtmZ$u!*^7Fznj9Ht5@wN+io>@2D2Pn&3ur6CaIbI`*=!@iM=T z3|{DcVVQyCB!_XBQoOU462+0o`-Gr~`!o1Q+z#Rt#3Fv0e%d#FThKSu7qtBNLsIqc zM!cr2ehQ}wF$)|&75oqRQ4}MkG|>laQ8t;*_DYSiAl6~Cgvh~bK6L+&sE0{8}IRigPKLgCDB%yvI*^|~E3>WWos5k$4mqGi#l z=F`L+{!Sa3{|E&Vajds4WLXDmTPmZsYg>}>TkZCc==FT=8H^%Ehx+JY+;8IOcB_$q zA`+m-76+$#+@By_CHMso72ic0#zf=G{&7XX(mQIC5_%;hp?Z-s=-qwR0}I;-_a#@004;qD8$X~p25H2fF7IegI?NKlzosjW6Dp3E z{O^}#C^a%qj;mSg@5Ubu5m`%nWUxU;Xkr4*jPFOzSVnXS96z+>3mL~Cv~)rZo!$m` za(Q^mhApnK;s2HcEWCj4(HRTP>7U99V6naoDsn+-rB(j>1ONYXS5EW2E`F;h7J&O= zQ)Iq7mvkDkwG|X0txSV5233FEM*aiy6{0WbwcT_1n~Z;s)G0tMRZiO(Z?_y6K=9dK zu@C6M= zYVJ%?+ug{4mcuG%Wbp_^8^Lr+z#7gn=fhfK&Ssu1TBCofcX!s4tIrQrHC!%DZ0AOD zu$iRB-2+zvMFiGlrg(=V?A^yw$VDNIeQYJ*{zw=eT0N1ZW_8&%>vd?Qql7 z$g9X`>3~Ca=-GRJFGVhF$Bxu!L$sshnM?UU?3Ji=vQ~>0w}WS7_?hHEAhmGY;KrP2 zSn{ZPq*mbMLW(R5P+2|vufLAnzp8%#q-%gBcA+v3sb;1)?q&9aXt^5_axLY5vMFb> zi1QvFzlWQLEIyHprF{qh(A{0i#(?JWJgXZ570<&AM~HRw0*P~e)PSngFN8^fa9ViX zRnFLsZhsVLcd(2_%E{~R0FV5f@5S;;r6rcX!VX1}Bw4_dI=lgnjzKL+HY}&{b+#*O z_5-{S5m6xgCmm=#8;QG;?$}(g-M3vZr$@wv5$xODDJG z0hRD%g>dl|R-alo9ZZGoBQhoC`{7Kr?!lbMQaIct!{VU@ZYWjy)+v5YuY8 zK!!sq_&qdp;%x=h%+N+cmhlB9Z0D75s8m{-q5-`|=ZVP|(G5?a-Y?~tYFKJ2-F3U3 zE7n0b|Aua65B3p8)91`|yGF)qZqkGVO0&S?-3z5t$e4>5k{bKwYB=2U1L2iMu6g^L zRtFu$9*Xm{U;HDQqJeVl+D*v;&6+m4pO2NAWCBBetoyvVOTYh5xVFXskYG7^h4Ts? zSri_P1I;OrlvE@-PY!sYTaS!yR^PN5A(buANBO%D-NWqjR<*&w{vd_<+QLyITn+)D zjUoP}>p9zLzx`V>KxmO!_mMr>T%C)%v3&Yi-DILqe%oBWvunn%C(u7Lj#^T?o7G`g zdp>W^C-XSk+}1}Wt9hMQtktPMRLAJvcz`*tQc1;0fWU#!uK+R(tx~5e`ly;(r?=EL z&6Z)B1}ha`-wy|jE7_ zW1K^fIX8Y=F(B0bR2Ieqs%P^FgkBFfZt)s>jrMsl0NuunihCv%A77aMH!9tlz>7k=Mlq9knS+ z`w~H#!ajFX@9Za(5ZeT~Cifm-2-+-+lEfbzgBKOwHEm-uI|rzzP^J$vi-?0TfBAM3 z_G4Mo$RCQC&5#E|dHs$?QwPXv?vj*p-1z2%-9}1g{zAwe+>0C}Ovv948lj)WfS4GR zh5k23U;%*X?n(fj{Z6BAOkc!nF#r|KIAR8At4ouajzKlEj`Ul&v{{N~K1O6#w5nQa zQ|{z0tgDQ8DUWwgUNw8M4iKz|{Sa93YXMASK*r{s=RZ>qP^w}{^oA-8aQ4MIw=6X} z`kS!L{?JORdn)y^JVI60)Qa}KwibCay2y$&IbS4moFDR77ZHRP0-d` zrt+sRk!0|=$IfXI3hrHelU3rGl3m&MU}o$~Bn;$kE9Q#zUFBwK7cL$caMHQGH->#< zSIZ59JF4)$2$D*=U*}{8=UESS)E+G}9E*(C+F}q_*Z3Z8`B_>WZq)3p6<D^Z}j)C{=3If*4jb6rQiQZ#W_3&p8L;=!l4o&rJ- zs!Zu~4(*}Ff0jGp{wJJP450IY6I$IoOChJa&egQ>&<`8@x$q7pKKqR_+Z$i=WeG%u z5xqwAO~yh-h@k%`bwt?NI=2=8>>h~5Mk{Hc7Fx7k=TdZ4n?5!8y zz6PD^Ao|RJLxJX)kR|Z28Bd9RtwiQ_J~^Y2Xs!O4JSLBQ6_rxWBU@iRo6n)_K3@Ww zVe)RpJ#v~Q_Y(q*1Fvwm@^hIB0hLv0pYk3XVk`+~cpc3P@cpZ!xw3n z7COQO&+Ykx@+HR6>}KE7prdVV03o|bDTqxe+5GXU@8n4n@Ha$#ZEw4-mn4_Vo3`o3 zYB?CMp?3WTup2WOdX zs&Yf*pLL#S1DJLs6?>l4T!d}4cQYv8_S3{D3k83RFX4a<>doku*Q&j9DxN?e#yEZM zvTn$0kH%YMZh)DhFpe}>n3sBlSC=Qpx8%Cd2;@4mjqTdQnttb+I6E%kMRCv$a@GwK-`H+OMlWi-?vD=qa zF1$gYUA_E;$Gd;$RfFcP<_in;3pnJT_`1jY9|%510-8yi#foX_I*)C9Dr)2LLTj<% zpNa#Ce&oxQVG3r>U+1iBC223G(yQ|&>1i_CgWn7i@}JuvaG_8Hb054nxKF#Z$1-f- z_kYTIxK{A(>mpjhp=`Lb;CfY5d@K@hF#h))tabIo|1`1i_4o2MloX3hN{D)!U|)s# z!Qa}rP74N;7S|f1n;;mg{Cw^gQ~Rz0KwLPFkk=ql;mu8F-}95%KOu+DHvqSW75|}1 zV+cLgzqgOdfv^~Zu_VPPa)HWzwJl|oyy}iHk#*2^>?a;b)!0oT*|;Pe_TkhePuOm- z7C70OwqNCG@7hL(23t}K*=^Qk(EmW2Uaeb`5@Qo=p8s0qAF={?FI98a17acK^I-v# zEmR82OclSf0EFOjAun1z#*xvW%8R7GGrYCjw}RLy@p{qb)7F=hwuP*fw1)g8@!6>p zRf`p=sm5l}B$5;03tL-VN<$stJ^apz_S}lm*2_-(rdv~_cV6J=DP2sQnCqtO&w#z{ zkzpR%=a5K|I_@fxD$Zrinj+29Z@dD|r+0@2FQY@}JPpAse;*?#h4*~8C&WUfXvDO| zI4L<>7Dt7_!oL+A;h`fY)p$raqw*?Do$e5j)H}Z+L5RbGM{yVNTy>MBCE>l0{;jP^6|mZ} z2Rou?Z8#DAz&@4vZfuaX@~e#sU|Npa(ITmk1t`nM9Ru5}O{+ zL2Ab8X)We;BirWq@l*jg!F_$o5=kz^0t8xp$Oe#clz3^YiV9!P=DufT{v|IO|Z`9)SOABKs8?M zI731RmGTksc@}CjCrA%6>sRvkXWEKOsupW!`d2%_}4*UV1vAXaOSI5DPAZ zUyYF=IJqI4D(Pv?>pXxW;gx8}$=6J)=s z)W9e-MXE-?L_jDypb8!DK^_yX8@d8Vc47=!an+6%32-NC_@LoJ&6D5RUWYH@vC;%c z!=p&gRK=_#y26QtQmngGiCTLgp;uwfRuUfi2!-+Z5lRr{@^qu(gqVUpauT;y9nKvD zl83{{L?ahs?(O1wyWZU$e(X`*)Sp5M>;s(mKDD zHn=7XO3rb6^=$P1ZW5gDE`6q+0H?Q%;@pQB=mFex1fE3Lj%^nPW)LUv9z#b|H=Ku1 z{w9+ko?o8(w38U?Q93oPzHUJ%@`hu=Mg2FD8#!-NCN$J398@d62!Kw$Ntc`{%Zu#zi^q)9XE?lm=1ot?!h`jZPM$+zmeC?bAwN)|9yBHwTmx( z%Xo*=F47?D36omdR#U{S_XD>Q&A(6D7;S79!=QX|0spV4<`*$ke+eo``%}f6j`j?- zMS}m^ny_gysc@tN=eJs}Vy7}8Yo}OYDFs6*=Wng87hZaUa2 zWo-e@gbS(=w$?H7?=o|XX|jv~6{=-*1DLAV!vAh48=ugx3j;fOltao{`*2t_0j4h; zM9?0ZfjEgoncyX|!P$wL^G7%RsdH=x(TsYP4!F;*MCtv4RG4|!x(-FFQn;3dTO-0+ z69#SzEU+mTxBtJpggr{zU9t=ZHBFTBG-Vn~Hr_Jyho4aVv^|+QJXW^7gnQ&{Md^IO z{;x|>BMKvX{(Q7z;D6P8EoKZ6TuAL(hp(0Ani^y48ty{RYJO21uuzsJv|2Gv6}JUGptAOlhicsd z`Q{8e5JxzQ_38p8$?Y=B3@lMf!p}R;P|0yYArI1b_*w64FaI6`6Et$r2iSmzQ)H*1 z0dxc4K`XpU&Z;y|@d(p zap(h<0^!bm(pFssAuo+`OT`1cD{*9w6)YtOYR+v9zGKp9tD2RQhAqSEm&niR75T=N zeJnpfqza^=`<+K-cCox}gTtKdf2)G}SKC`3zAkJDHl-zUXXNC?%tY^Yv51vurK`vA z#F-|q8Fa8rueXTjT6l2tRce#sW#xuwS2Yi>!*|B=L8=Dm|9jV%H~+eb&68lFzY+Ig zX*#VsYsO~uI^iWG^at8El|jw-@>@o`m9XS7V!v^2%{O@J+6d56Ew)*=%a)MwOZ?D% z>5Nv(8e^^i6A1fmM>GObNTUG`umnfp+IaN>axZsc(G{4>=K`|g91N?T+M^by{bgSn z6#KohB9Uc}-B`lnq{}S7pIXRovU|R*yT4zy7ZA9X^60b5PSRTR;ZRdo`&@~X%yN02 zgvIJs8nH5giSUe!Ib*UU?Dyx<2pCmJY#q=OL5WN=7!CiM8GPhn+d|+N&foBz7HBl= z#_d})JU-c8)Z*@chnz)p-+H1V{}gG4i8l1Ia{r$0Vh`NQpblL4WmJS^=)Fsn((wHI zxF{#E8YsWWZPDM~t9CNg@N$cW=On3hNafse0cbn@zj0cY1J}K%T%^xd$>0lgYB&+! z8!@>x>L0Z^2TE95S{dcEn|@Vwe$3H**3>q7fttJsyyEdX`$lx!e(Z5Ro%Ztl^g^in z-urYa_~b{yY0%~0vb)&Q1Nzh8^Sf`!_PEqX^ZvO%f9>kFKXs1=f?ghP1m)b47ml^` z1I){fezOc@)IE$8PY;+_T6@T(^8l$S^c+zuMo){F^)r#^8s3T}KY*c4?XR!^tPf;HT!W z&Cf4)Q}$_d7x<&EgYV^r{-h3^2ElBh^;D}b+p!Xe(OyThhX?Uu@e_;AFqrGt>YTtC zzn8BBay#1XkHPKGvP6%A)rVsoiMPtCQ;U)QSL7Km!=QaC{C}|pH=84y5@2>9^h4R- zSRd9??~8wQs8hb>r%G#;wMRUo%aa5KvfP7{U$n{3>L|Cz_NRLs^W;302Z*T&>`;(O zq;j>&@-`I>P?+=SWr6!799LNwf)>||gZGqlR4wCuw!UZ4oOXRvx{WOdM(@qOsLNKp zQLz7oQPNV-T!Ct7z?HMJB}vlL-@1k=UU&R4qx~^V*eO1_|ezzP24DLv_+{;TRzbW-*jRcWI?w$S@ z*nr_HD-70e?i~1BYT4b_PirzKO8U)*?e4;xNr-gGQwY!S7;ppi2d@^&0Jg=zvCuz_ z%x+l)Mtj+SFqNEw-*$1iH=k~E^`#8?{3;GA_yrPt?i)*7zT~)C?>}@cZc=BrRQ+xY z5VOGtM#qWxYz{9`2Yz+CyEmi`0@Um)s}Hr7R!)CGISmpyUdNY_L+p!Q6~(%c*wp2M zhmae|`-9t(?W30S?~Wotb4_FWuGLlXp94k*1)&P}JH(uz!D8vw`SoqXJ3Cxyy8o?dv~V-Ne3E!RUCyJ@G+U)- z95uAL#Cq!clJUfn0gERmOrre)Y7_6z`-N(fx8d{UUOi$Fv$dC&*9Wem+n$`RSnc29 zri&N3s(G2s#Y7Q2Cj316bYC=fmWM0B?oD9Fi}5NcPR94i={^s2N+aztWO5&a#Z=qE zmIGq1g8xUWIYE&*HXphSBvmLB)|Kw?d`)Ee0n>*O7|Id9~)Tm zJ44Fc(KUZZ?+FTYkJw3DB<)yLs&ya`l>0W7;osYbD#>+AshTrK5>VDwA`A}uvr%{j z3d6NsmYpvYMW|T8Gy7jlA6+_LFe==vFp~>6e0IG-L5Qe`KVm>3YZMVV|1P6~_>IJ< zWq8kCim5*zm(YeExj%Zs3-N@0nK8V#f_qV0-oN|d5(mTw;A4FBv~cYAobJ74rsg}@ zO5$wrtB7y=LWZ{!(<6&m>--w}XhIBiP%BZOf-Mmu*G-)VewojcA`Gwm=!KixcDF_j}? zB`wlw93MB~dlYIKF)On9h_r3gzp?+?&Pj;iJR%N^1o3ni$ecmU7BvEvGbuV2GAcDX zW&rCKf`Bhu;e5gV-v9c{#}y{#7J%q4&ef$4W9XVbiLKg|jwnIKEA%pn;KzBTd@OrTO=`jg`fyDLE(7F*z9cn+~rygnfoK!>1mn>ZNTQ z;@XuHRP3NR&iudACXev!9hpo^e))v2m*=v@t!;lj$g;uzASdj>4@XL3yifA13|Y`B z;_3bbyE!9o?H@CI>)~aibcKBhtwsxet7e7!iYQ3~&J=0KuTIY1S{=I%G1nWDz&KAU z<&U)o0Wh#q)^PLKf_UjhOu5ml&`jG=4)IJ!GJ@+B(G7AHZ8^j;cr zG7L$IwRWU3se_eJ>HR;dhiO#x>@M|xI8?Km?64FGFjd6zx1VXe!2uuw-HCN@<@5e6gZQFzV`C0xR*a2qc;m(xJOMb;_9#=k2JoaO^BV68fy-@W=g_`%-OF=X!&ewB&VMBFRV-in2#$q2QwKxf;LL=PN3FLt+pCI8p;a(Xx(gOqJp;kCy{ABt(AD_ZBQA#MGi$0sKXZWju|f zqKV(&k&ML~WG)oDnsyHB0p?~|qWz8tMqH8Q&JWF>(Amt-C1 zQT7zT(q@U-!}D?DhOaC&&B4uAerHNx$c}d9i-zb~Yl`Z%E|{EJWsH(!vhY%~dmD5A zDq#GTu!j4#tcw~OH@jEn)|_y)1VfbO-zovtwSKqmldSJ^qP%BCZ?3W@Aro6_`KGkA z#;~PK)t041yY_f8#l3xWwBv-9vVHBZ1&5^JZ@ZNl3SX+`D}!n;3%PRA$cq#n0jDK^ zfY)W(2Mt-x-RT1-QD;UEI1Q)M$L}?P;(F~8Zs&Z2-#C7LCL;InV57AK{1;sOK)La0 z*11>ajB`WpR~|5hvVDj}FjC4z{0@d=ruNJk)S^d$wHfqs7dVm9o_(8(Le25hDD<7) z=WV<4fkFYj`r}neS`jdGf5^t&^JGGyaJFA13oVEH%eTQrktQXpS|xU;v{)mev^}tL zvz-+y$E=F@cip3lvDHB7t(!S$Ie9n%pBm-AD9kC4jR?%!RKO-6v8HGLTblTvl_ifO zZ9RH^T55iOrNg9hkxN|rGQF9_NBnZEyFjM?Lr1XbQ@wc6sL=th&qr0)ogIoh)>-HB zuccpqDX67IP6tf)==L`3gz<4YyhrX!42VcT^luJY~W*n18>bR{q@Rrp*O~S@ix50idg{ zgAb~=S;7N*9Zj72NiWQ;d4}uriFxo0Y@%2jzLqcQ>ed{bS>m;0Ar*z1x`KWkJ~|BK zc~q<1-sJ?pd=kq37k?c7#h)3pu>uTEcS8UM{}D#zkJXm0oBh>j(tG|Ey}IzjPn43m zKUnf9E{77A#;sY^N-=)75qdTKYyN-s?IVc_JkJ3k{vlOR+A1-(@9a+IW;M4KRZy_8 zFO^QBChrYcH2#y>MRs>{!fQ-Qe(vU<(tJo@t& z18@+AKd*Ct-8Wx)w&>Uvj=jlIWGTZ}P)*CyGT`-Gog9AT@jwsn|HhFnUZzyKQ2U^M zzC#hK;~a)qoYrpsl=e<{%bLARi+p|iQ;aJN_o|wAHy`5?5~NkJJFNd3rM2Zj|6Nn( zs`tDeCRRA`6myTvl?!=G%O$FllSvmo_hiPh)Hnahj$S~#frERwd@C#c{>RxK+5G43 zk}kFLz79b)EbvCCD4kHYWc0tW7D0jq%-O6eUUKUcLLnV$p_i>%r?kK{*8I&7<;Tv= zUU-#HWahJaSL99mE&0)^#rmh(Lu7RdK9N@qWjYpDfY}uK5VG;45GUz#K#7Vki(Lme zc6C2#(=4jCg09F!tOAxjVrJdW0}LuV^HJh5;YRGzt`Akk6%P52r5@yYbb`$ea34FiG6$L}e9D+MFTDKc@UG_RvQ zxIYJqBgydJ#Ad$kyKx(Jy6g&306Sk*x47Y%Uhr1;q0i#%_ykcr;EvX(Qy^p9aqrjBgrdcW@UcZ=XN^Lbk z3EhVTyG6ItMKkCvK85*njn1s2802A?O*5#$n(iH%PGu|3|9HBl%`$pdlZUI(-}bF# z5u{37R$%`xumQ>L%6gx#b=_Mum7tsg9E7q2dcsmmzw%gS$Dr0|ZDy4&U5_}9y705G zt^-8Q@1OVyibfi4pOVonvS#aTUt(n5mK2xiq-oG0=NYsVE5OUENAc_7Qe+l~N>6;Yw_IW6fJ&6m!96VLt}$J9=UrXF_90%Dg&i3!n4(kaC=R3(O-h z-{QY~94AV)Bm~rHUnT()Eb{%jhyVe-5e6s2O$OE?9EWla{S-;e2_@`|#oQE__S+ zbgonpLSNs-CbDUHf^Y3KzY&TY5E2L{k&AEGgg3fl^NIfV`qK|u0cjB8MrAwVquK=1 zrD~RTDrLz6W6kXjDh3-?!Xg?aXF%}H?8Lt%djtvE7*qd4+Srg7$F4hfp@8su&hmN+ zIa!C~o~jQn6J}Q>5#=W|B+}N7^75#qf19OH*ef9UI)sIZRLb?+5u5`WsDZ;#tPgd{ zdDZWqN`n2@L3R7=jgFlu!kcr?|1uM(-jSW0utJ!%Vip7iLb89w>@J1`z8&Yc5J;J` zaYr_Gzd@#HIaU4Fo>R2^8HHPExQE4Ex4QsA=gGBKK7X|C#ldYzk7xIhF9;1J|6Ygj zj~xZcFmpN&6G2>7g->GqkelD)U6Y499LQAvCGbLBOk7sC1$%|7SG!bvl_hO7vglH`$<~lUND!TH#`X$zTu?wGt=kfFuYxc##qZM{M{Q-#CY0H9^;~g@xBX zr1#&_6xds~sgtG+zHSjM`sH&hfueMUdU@|4rh9tTNl{pbv1qC(@N0R=l*V^LVby1+J`e9K6o0nNEy%> zVf^uMYBkbJ-v3~ht`b{yx6zt!a;ySWB_fCX=xcOb<%&<$JQ8I)0 zWzU|TVXZYy86q?!BdjGQ>$l`ZpRdr&h~9dybY4F8bm&K4Y|l2iGOkDTkP(SF%Y>$( zYhnK|J}lGJ8y6UskR+NA#WkR|N<+NfpylJo?&HMGFWfD4>Y;jwQv5Q7Hu*`UFR+5!yipM zG$LYV=E>UzK9%(45s7e=%!Uq>X{D-EEcHd!b0Ju=$+6hCPMUl1Rxc7S3KUa%IYb;R zM|BwYZ4lO1cF#DydcUVHmFnN%GN-jQis~FhFt4BLbtFXS`DXMYiH;wEW%Ce}00*WQxWhGe~Oi64DW=_oG^L!O_ty z@dhJeb`5Kvs$&OH*X!27rOIE3P3qPIPmNB@Jbq^Vqg%LnD>Y2BXdT=<5&U>8uz6p{GTg2XjdM7KLS%1u$873v^*~Cl0EzBv zgmhRpQ8U=ENdRGDt(% zDAaDun);6E;$lP+)OxDIgtJtjDYBj0q=@fq?BQ=-ehngd54=FT@+sV;Ga>tjx+dU+Ck>M- zW;RNRO#_iC|DDZ`8s7J_f3R3;K$dXHcCp?ae?Co$&=1ZVFi-r*Kl)}cEkj`WOybee zGmkzLs(>1~%Qf_Z$q^u9_(5shGbe9r)cT`LqM$66u9W*eaNGeyN+JDl?<;~TYCDJV z+FImLKbOe#iu*R9;)1oOID!gJ+>4s)SCx|81;+P0nn!)Zn0kZ4aAr*6 z#BR}@;M#^<%}v+?^uEy-%tW`~qfZ`&3~FEM~aR7OA9!EN1Xm zE;uOF)*9iVrX)bZBp1ihp^J0^skK8!0xgwN0=*H5ZakFd2C4ts;AZc}M;C5NBTp7y z2rH$t&F834XnVVMG}tCA3Z+Q0p)BalBU|DUj-V;l69AYF99p$-K}4zcUZ-UM&`x!! zYJ8#O)NF%Xkvt5PHStEkwgl2W#%8>6D{G>M!gtISc5*%_H{P$Op5PmTK;0(G8b@_v zCfj7`Ns8)avcwUXhZ4MwvRFFYwdSaq{vlv8H=KSK7yJe^0$(f*f>y;rs@x|yB}tBg zHb}#f{tj2EfKy2-moS?&MdwdNXS<_~UNs}WCq?+3E#mAe z?}f$yf=H9)cSq!ApPDGsRfL*eN=eX(K_j|}V&d^f*QZ^6Ii!iwn)v5U2B~at3i6hp zGOyy$iBX9O`iiAKz!qv(>FAUWk}`Y0mTlSenX&gFcXj^8B2D|M^;rpy#JmRyM8MHA zX6#1a+-RReOLR2|K-=;f4jm=FP8Qer2~RVm^c{V-EuS|~HwJdWN}07nJ6{M8g~nXJ zZM|0@LuX(NFYG+gCCdtx{Ju45AXbHvp%gAt#?xu4L2uBQC+0nnF46>68RoF^s8afh zUalU+Oe)Ly2ZyTyy}DGsqMInf-~6V!T0?8{*EzJuE@m-KDOJwh18FahW^RGyfQXA# zQ!gUrl`=RsBXIeVB4aKmHPh>MT7Q*UtOVH_gkp15u};rCPBR`k{qZ{uTRx^J zQ-@(=e5W~TDpRVQ_x$UbR5NOHxIs_1tf|vItZ)%{1jMgC+>Ef$i`w^$9ueg*EUXQ< zqg<_~(a*GSO!*3=(!o{Xc%6bmwjQ^=EOfe3^txLXvWENJ+Cm}vJ5F!`3Mq4D-&}V* z0czSUsZXnpZBJ(uU3slBy`acO)W{H=&&=Z?r0VDr12F>FUMLV&ZJB=Ty+3|P$m*On zQ%CKsx;acj0gsu5z>u6ePy<3FG6B(6w<{`3*LzcZE{eva?nHw~a8CzLQB4Yu^{@#< zb%Ml;@4HZ@OXDkYc}}4|Q?lzVD~=FI-w`>V+bfh}zL3*MNQ99yyf_`oOeaBO1P^Bi znZ%5G_{DsBw3BF+k6SeR1t!sQ;$MUmBYfe zfc8_*w+rZn=nLUc4TE=U3<~Ak34e;PHbial?wrRj#OmlT8%N_P#G>&M3l&qkWg%;E z=#UxI9@}{OzhWF=Dl5i75|O9;{>i~5EW}USO13uWGR$_PMx4Wsh0PRTm7ri_2HVDC z8g78Ule)l6!=bRLlM89Ae7JR%fDpVRONTdDs)mHOc#&`V!HDCO_cpA{7BKWX9Efr} zmhf*_ID#8EX28(a>hIMkJtI0cp-AFuhuMk8MEZIb5Jzgm$tHdfDiEN+MX&IgDJ-H# z3*}U^beU&D|9pLSmbtobWps}v=_-N9A8KLr=Pw=-rIIpGL-%KNH8U@6`*92%s}m!v`xZiC;5D6~aH(YIa!C^o7(vxny-sIWK+Bo$W@(VC}S$Lm0x z$!+k+omn@fd=WFtYwe1S1=^meJ>L9+T6_O%r-3~D0yraYdJ3AS7MI|lW%fJ=Y?2G! zOnLsNv;;p2IgFZ^z0N6pc!C#xJ3b_II=n3}v#1PhJjoHusdt+iwLENyPs3env*2u6 z#3vH0$^Gf|=Tl5U^0!hE%a=}zGS%RZM{%9qj2+}+Il|uhYoYnql!~=NsSBgnl)_IZ z3MR@~b?f725zjWn;#hV{<&HaxjxM{0*DH3t>DXBhrY+W^)-Y!hix#>*SquB+q$aLU z6?YD)4$paXbn=jRVGp2fR3y^s{tr%pg2xhk{sRZJ7WpXgkPseu5y#n0bmuL;fb zJQm(xQf=L1(?fHf;FM3#PNwD!Ty31Uo!aH>_9W5I6lOJM4jJJ@M;` zbmwy6-EvUW-QMWoNVd@f#6tE=Yp;{l=hMdJktn9s2KdOrCUw4=fH9990&31M)9vEk z@9@Y1qaP--lYc z=9cr{!;inbj2@IT`4S2AbfkTUoSVC7ytuLbCH#eMEm?SftUlBAsiid|5o+sH7Jsu_ zefhzkNhU!{401HHWxpn2(0V;(@w(Bj! zGRmM#w_Ec|2c8Z_+>CaycHewL!t0)2I7$ZSfFa?GF3eH}?Osc(-jWV&rUM3)X3cVMQv#8LRp-=&E&X3!7z}%W1f|f3Qz|tw99=7-8^^y~ zE(2mOa1@~{G_=d{A=18U{!=PA5OfXZ>N)Z9-k+qq8myZ=ZaWn8;KRxO#<|w9DvPw- z;#kBzp=C4rT@=sdhu~K2=h=fP}A6!+q2omtWQ>i5`-w4TlCs?(S zf@%UJ8)Xnwx`Wc1=y@W_#(XS-zV1)CiE801mhr{yDz;Lz^5e^4qlI4&>)+}!0F0|>#u0> zhu69`BQgpqUrOSm)iM`?x2L_0{GnI^i7QLqSS-XE}Y%;)g9w{;Jp zU{Ylnz7Jic+bWzH;%k&I9vKxWP(6h~KF19)m#4RWw2c3trKioQaRAV(Mu$0oQaeRI zbO4pgAM$Ga$W_FsPHl&8_R0W)sUKJ5W)a%7T4W5~Hp z1{&JkH?8#EAog7;uYDOH39~zB=~dLPS`Oai`-8R>X+hU7*Et%RkCst?s(rx5^($zI z1J3AZ*&B&qsctUB?kfT>m(8u-?e1muNgztrTh$CPi|nD(e!@K3LcGM;nzb(&wrTUC zFomeMUpc%Fblm+zgd1g)d(;fJ_gs3rz2oUnVK9oV}Z=)i?%QH}*B^ zhp>xz5AH1kfVmd%bB7=oBPkp;33Z5}HbA9zNNkG0&ISGfVEVADr#)6(o8`Z8EyxZ7fbo&Ryb@FF`$r;({PKDn4sT# z@~$~u93adM2}fS&maSB|udQ03rGg?SqAY{tj#p(EtJF5`9_fL3fHJX{$WypCS*A~Z z_(SdE?E+!>2)m%3O9(u{W)XQA2PUpXC(qe(!H&H^xk0<IT6NS5u49>J&-a zJFLRr1`Kf+3fPxf#+=uuF;fFVe(vZ))$LWM6(7d>ow^(>zHx`@^_Fe=h-Uk&9>M;t z{|m8!YQaeH6WEN2T9u2-L7AxICe>cN*u0tHKm{fFg&pgq8_KS~3(yyJ%$I}sumz0o z8y|a^qgEn-^iD+d~d(q!y*>HfeOgD(iecc~aoM5bAZY zG2=A-nHn(s+T28_#p_~pduT2S63YfnG2&!NNRt5h!&`fMz1^AArr=6TCC*ri);e`i zLRnUAb+Z7D=iK7W%!hxn&bb=~tbmmhfLeD5@iQeg{ye`f7<<&h>rN1(7F*i%V|6o| zebP>yN(Q;?pEZxP^knFF;r9p`a0w#GI<}oxJmKcBlu00oQ+rx@G47PQd2wYQhF33z zV_g=ztTC}tAgKeq8(m-u$b>!4OY)ksu zy!B8|-u8Rg%XYu_#rte71ez9@54Mo8vny&t9U^Ch;s_X;6WY>w_-D>l z*_&F3<;pkaI zrMnf3+P=s8we~`~&aWt35u7Dm2vfrSlEGr2fT^bFk<)&(wI+oe$L1SA_xSK;F&R*> zh5eRwQ=gVfGni|+64YZaDI=pMYW4+joYd>brVPaIYG`otqZ6S6%p`HI>&LL+5>1Cm2bN&%kZgE|0;hpxoRppv7lV+0Dvt4^%gBf_TU z4eFdE0tA;`F6WX$4 zUM{Wf`MKcHqWk6tmO{La8LSdB*ZApu^DT?QWbGOGKGnr)>)^xswcmklH6$GIS)`G7 z@QgF19%+#Uyu_S>evf+DZ=1sg;5BGp{pB_#CAC?&XJ>-4tA4N)JQ8zxJfat>@m!k# z+#P^CjYd1nee0ElvKI*hh`^JL_V0ellxFhmk;|C=CmXxNq%`-ch&M|2$r@X9qeUit zxy0qGTs*IcNjy@u(~l74ADs@n0!~hAtqNI6;vSE( zNBb)Zsz1>5e)e~maRG)M(=ra@nkzR|W(F08V~RF+6&WUh?F3} zt4DLJXjKB$(O6$MDCoH6`PXe1P<226v;^f+=c$A67tGGP?0tub_r0b}WCryu&){uq0vq_Z%Qg zgN1yF$=dZSAH z?y3AMcZs^iBUA)Gvwkl#Oh`nY(uAtV)crmN;l#(ph_Bn^c%S?reJ9^D98xYm|0o&ybw2_2&IOBgre}AFXnjd5b-j-|i?`cMSlshjs)njFr8f#_2k(RYh5$-Pr$! z&GYOtBzGqL&Q!Fq#&4==4w&0J4y=0YHFj+i0cO;?+;2O_?SkJ^rVCV)4}0>%b)=+~ z=u6_Md&6K;nwOoiy!W`hm(PRQr!2MSX43sU7DF| zQVzbe-wEt&_Jb3u7LHvyttMzYcI#EjkFgnAb-pgn*1aha%AlAZosHJN*-(+o{PsTo z$uDaK#^d6Bl1qT#!68Iz#$qqUIo=rnOnZhoY?MSV-B8dM;Ti*r3F{t3%jPA%U5R83 z6?Grv0#I&0Vi4tU=!_$ilPk(==*G=0vdUFOOgHIN90@yL0c_TJPQaG<^iw?@IigH% zO>};xl#4*N4xIt5~EY|xE(bv{?E%t)H+}`C5 z^U7%&9c5>UBN3=n>=^eIJ1Q145@MMo18Z^R@-Lk8H9&Qda{TnQ87N=IIm2H)4JIm{ z!vOeR+m|_^pY=R<0NwNJreO}}4a0^dK6>WbmeIfBNo5ZE>-D&*SP& z%J(f^pT+7X_nQt;Z{4E|%niEmPS=&8_teSndz4+aim1r+j5uej&!1frGm1G)*=r&+3F22c72FZC+&?_HP5?M9oXkl%MMM=Vsl4|G5%gSVpwnc%$3mr zpZFzZGJf+7I+;@EOm<^#!P@$U+01pHVph+VQItk3fGuAosI91+{{@c|Vv4t`19XW= z+{hueVa~0+W9a6y4zk4yN%_3$`?`r*jvsVYn7v_lXTN+q6YsoqsucRZneQ1kc_dok z%S25AH}DZQcMcfnSM>xj5NR^{nyv#L&dRpQB|W;w0W=buZijx5B5Sy`v{{VySqbVGIL_ zZ*`sk1a>Z8OAogmmcONas3yKqhOKR)QTI$Q)XDuTZU+*RxtRICoTyCplsY1b_-Yq& znBl1z41VZL)UmnT6iY}oL~#2ZLaw=6>X8BqTcZRguFfV%3u-eQsf6n4hGuD-8mrjB z-S`uthXyMU|NUE9YS0iqX;95TH>;L%)0pmkaOS{m9fAHo2M^RO z12?&jrK$%urGvvZ*-NXC*-?`ni!6ujNfUs+_2aWxZ?ttpL6umbF(hqtv`WIgDvzTn zCZjz(lSbfv+nndd@rwA!V0feMiR})dVS?H(M|@A&qK_(I9YcBaI#-qy`}zYlGNlYD zqx6^_cb@&T`>C3Xu|oZzQl213 zu1vmU+PMWb7da;pe9e!J57}`}ZR2~GKdQsvhq>I=?xRRaF;eIQmTZ4~ADRP52K9EQ z#-vt~iH@>hdvxCuVJ8h-@E}`5*@-uTTO(YTlgZ%Ba*Zb{iue>_Y#?%_OeZfKT6hMg zQGhhovcH5=@NEAV&vfRFGW1<^KW_}xw3G~|yJ`5lAi;FUjll?)eL{2$dq=`ND#bUy zRgBD7P6jTmiY6A?cqDK}E#B%6Pp1g-R04syic0a5QRAd7O7re!*IEVx^nK`z73vUH zQsfjt-`{_}|K>0u$flOBlt29)AGnI~uAtLH#Oh+ba~<@K78zC`(VJ+hqP97HWV7f; zE!ga#uJx&gI9??-g73Sdf$?uMxY-g%pvx_C+PqAi{-=vCp?b^8C1hb$iO*sW_e1=`fg9?t3wQ(@=$?zTQv?(yDQ?S8X zRjWuM{zTmxVtccm7UO~)1ahp|P~+xHT^PX)P%8TK5U4Iv=7yMs%gGmq4ArPuJk0c# zW{BHX+Punf8(%Bb=L)7)rM&wO7V^4|o;q~KR-+CTlDH6v`V4ss`Bk~?U zaX|O|tZ{KItCqh)n?6{Q+!qEgHDyS22C!8;7KMcc_=eniPShrzJ=(Bw+URjtsQ0jiwc5aCm^x zg_GIuZyiU$hq$yIipC+Lu2^70?Ym|2#o0l|J(;`lA6@h+3m%19iTiPR{EpS#zu$Zm zW8?4^V_=%9icsLAFHIsg2DLC3jjfgTzU>CdqYtLguSyynv^qjPn;=;nBy!y$^zNQA zBe7F}3nvb?3*gq)F?OIYG19T4am<7y-z1_T7ftJEd9*416tz9*`)sqwu`PuA*Sk9u6ewkqK1~GEa36Fk$0r}DKr^E zRY4Oo?}vFHP9M4&1iYrl zhOm~;jIF7L5jXpb@}P3Fw523;La!%SXU?a;$=7E_#iYI%a!v7|;FxeolrW^4gy^>G zPEeDEX7QA-LxnSO2CE~L_#^Ka| z#r2sY5u5YPxuZgi)PpF;MOD4wf@o(~vJK7)u3o zf{eIE-e{La95VJnPTn^@0$L^SjB!*%a3c&pmFldtwX2wmCo5J!h(pW+O60XZ3{`ym zOh$|lb7BoE$2=a#v>2)N=Ul%nteB~FT@Q&wQ6^@mZ(~S$~iaD%U zWqLy|9^s-mm2C<)7T3E5%vphODSTqg0ymr-*j6$s(5uP%mdN>p7g6!5(O5I|9vJoX>ZQ1Rf?DB9vP$! zlQg5I^R^D+IMk-g8BBrSdCoJp6>7mBtCUua8Y_61Y3RrV~Y&BnwZPjNhLOtE^DOek^i}5zl-xiuPrVMBehK$b(fW=^pPvEg; z1>hQhpPLfK9q^#5>`e!0MtL*7h5jjp^?*Mc_@ynKb=^s;)+~8MgJZ+<;2=8ueo|CdI<6}IH0>fO%&DzL^u>QLi#Ur0zSH0O9&nz3umDIYV zgiQbaZ;?9#Fdr$vAPMdWHZ@)c=cTI;p~==tpMK8CcsIje^_@iDnm!PVyFOR1vc4Zx zF~0X}P47+^y2b?8nWl557L1m8kpxEMXXoKWz$T z(*z@XBjg72@0mi34K3_GCyu1>k&A|8L2pYSs%+U3!13VyL>%10jf9!UO4Or(XQ8ps z#vLa`&am+y?L^Bpx?lsDVz<>9m_k(SE~n|PWg}7G0jfvf@|H*dv$_WNQ8r#u71U$4 zF(4=?Gfvc%Vx|j92_eqYx322qVd!j6WX+s1EM?1%QZUJczm~$lu^K6wYayJ^^cvkn zSS3R(DVH}jm1Tz^Kz*If#Q%3mk)tUc8wg@+qz)9;uy3_Xayq|l%vcP9N^~~wp&jP} zV^!S|rr;%JxHq9EWz2a9?i%5OwW`b?S5JbZ{9Q$NfkuFA1^j+4)FeEb%PgqQ=E$Hn zmWr6Ak#KAUS_`q@PAf!#q53OLvv^?@28tyLpENYrJH^zx=W(QzlJ8bVsV=P|$4p!{ z`v*WGo4U*|Lb3A6-|SwlT`Txjm`a_EO1qtE%k>HWPCFP*fGkFnP-MfPX#t>GnpiMB z{7E0(U!YkxuhOUM^rO6Ut}ak0Tm^&(eveZcdAS9F#9e{eA4yE-k!2B710R(m)Jr>Z zusLaCKOxw`MkKSnT-`jv&s@tCi+0MKsB3H}{j@ncVXJS zl;+NB@quY{S((ALQ{;`7>@TjOVnzchX6}|A1dz%G(3^O9=Jxx3$bkHFh1jP}{_+Nt zRrj>h(pX$Og1!bZvk`h|-EN`q!4kF`1;&;1Uy|ZCb3L!fT0d_;pzC}3Oy#&_1&Hf- zuh@^DDO32J&uH2$zC0h_ju!lECVGrrdlK4~O4XYu3!4F z^WFOUtATc%-O34nQ*YI4e+09R@3a2g4+`JeC$UAm=~!Zld-Zg;YE^UB{e|1wN*%-Y zBvpE4@3Z}6ph+Asn!8;J4AACpT9^PJ!9tg5p^oq6@!_ere>u=wyxHR)Kfb*^;@%2U z>IfW5W-?rBw7cCyV$G_*+gTaYS*5E`PFwb5X;W^T$>DhLuOgHByPiQ{{{Vb~h3?Ou zARbgX#Vyt;0)Vg-^OGpm$K1C^^SIf7zU&)G#(eO!-cR>_#(=^l)SGiBRbiV2x7~Je z^4|8tWz&HRPV3BjcfY60=IEuD%?{tZPb5tF7ED^Lx%y#DCaIq5aq)tWs2QwYT_6fS z=(KB6D*NlsfG>RbL4j;0WjCC9mv!|5@8<84KiJ9~&vC=}fVoNW|7H{0Kd zYIT2E9iBh7+@25+@$a|A3az;B(J?$_`90qLqSqeL^&!LKCStGN?KDmwTFUpz`lxF0 z<#>YIZPGPz<#O~ft4zCtX8(z%cBIYxc?YoC<0YxJKd<(k!683`(AKIv`U(wyO{X8( zaNGJ^W@5x<$$DNhR{~DBktJUOcAp=s8_5Sp|5@bkUciC32P>#Y@O+>sCWJs~>{zjK zNRd0s&+GS^mpWhe;#GA(oFN1HdG&kC5Y@f$i3Oi8&c_XzUT>6NT6?(HT=y26q&s3( z9^}*8&W1FO;}(J*fv(!iKytZqOnByE>FYQ!Vx)@I+#flgGOs(GMl0rG+rJ=IK1j5Y zDf7Cf5U@KjNl)G{JDDUNa4@)E0vafEhJ&rEC3c{n`y;vy&-E_uMbU)(SlVDG$!PiV z*Xz?4&za3nxycq_GAN{NHtdzZ=JWrX6j#%C-?`1P5r?1qqs!FkZOt|uDm zKSvtk8imsL%?UI_a$F$*1=#=ICB8BbTdunI!^C1n)Cyh2#zJfFPBL*D_J*kE+)V35 zM1ncrQyDPZ&c11fm5z=~v8}l$BX<*QIBM|oMjN^-zT~oBxqZ|$=lcs^+8ccGRM;Lx&DQCFM+OVOgB7SshP;)Gab*p~4l;@fS1PtHOyHOcOc= zUb}hPmjv%J+Rk>oD2mbWBc~#_$Vr8PkQP&^54sFw1_6mL z&}as3&~>lqnRnhTFSNG4Np5YHy%2So!w}{zMC0%?r^k=A$x#`Y+*H;dimG!Bi1_VR ziz3c_5MnjfCtw2gj@2DWeJC%*sm#={670> zjD@55b}KG#-}us!24P$ycSG<ml&YxqJj;6n4pYz$S1#(MUE(juITO84VB4g{7E6W3ZXVXMOFA znds_(dlNIG>&C3pX0=_Ad5?G9U(0A*qM|T}-nmpN2*Zwydh!p9648Lv!c{ssQwsC zxZ3GGgTKrJU^f}~4qUl95H}In9M^gw@kHAi4c!pTyn-O)h7yQ-QbZDhN)nguONi)= z^pAZJEFC($g%;NqXS5_BgkhTPMEQL?oi4WF(M+dwa8GUTST<;rR!_FAg|+iJ;~;Rl zf@2;kB>rD@0D%>?a=j$!rZnu^+yo=0HMb5Q<0N6gw7lYHwCf_4|Al-(sHv|eWx-S% z7wp`9jMlgCj&f-`k(gNoUJ&kx z+1xQ%flTN-G@vY@s9GWv$ZlkR^34&h?b$*8O?}fjx%ofenO~y-OjnDbXbk8$a6MCD z^nCs3lQl+_3FJ zM`Lpc;!q%`XjFHUM(n^04nV2T5zkZyR~Ue2M&1fo`8~4V|E(#&62XE;@?feQF3&`S zoW-sg7gyiaX%y7l{R|jeL2Q5q z5ERP%DKe*VgaS`qccfbC3n^Ns`0a5H*ZYEHiZ-QcggIl-k57>tq#qIt@Awqf1%0c# zihtb)rJ*6RqIcH7uzp=-B2Dh9%L$W%8a7n%w zY}|$6Zg9hHREzXpWoyC84CPgMZgaix`I#b8^lcjk%`HEr2@Zzq0Uu9o*SS_;EHtJ| z91J`@oSAiIwnu)VHevUyPPF==NzN~_w_x<~*3K*QF5*Ch#Ahxu=!T^^B*We7E?@Dt zSlLh65JCU;16&P9f#z=PQk8N!Gh>xtwtyI1i2KX2Nv7l-X5~OR8?qtl?_fAaMAdhc zuFd~y#6O!zKD#Fy+xP&tLfRk(Ro%q(s{&-#=oIlKXL6}+MdSSg zzcc`2YSns3SR_)7ut+sE$Mynott`YG^NAgX)VU4CUlY2IREk?1=i~a=YS?;`PkE-5 z?cO3rEuAStm(tQIfwfCFBQkE>;AQ1nB&SBSvj3o^W?F`9)Z$KZN^70Y27L$jEmH&K zcUbvmVJ#S0tSzZCk-Xx z+maFN*HK&ocersL)+PSd@Ef4O-O$Z==u@TEs>3a!pL6(Gaoi|PoJEUAqC}}zvp#)* zgZ=z1d6WU;RH5F8-Bk5lA%N9BVdnuxyBuXKeAZih{HE)swPA@frFVv*GyGZ?+Zk4u zn)A=Tfc}MZC(lAfk*092G%DMhE`1rzkC1>pq*3&42&|YhP%`2*K9{oh9zO9+FuF$8 znWoA8S^@0c+KT9gibmI>-D9ns^^oKNvKGb@lF(g1`#R$v?7i$LPbg^QRx$Ud%Jba3 zZ#t66?cE383);JT^W4>Pn||-Xv_vj50ou~-hpSm2@hU7PLaWxJVWsbn1w(iS2YtiO zor~z)_q7D306<`7oHq^pqIaNP8pdeYKm!cO6OY8IPKPDw`+5}RI+TlQA4|*@&z+`p zf1TExT0*`rpl}~AujSu%l7wtqI^Rs+KJJ27Del8m|uOdZ*uS#_Czs%yv3&K(LO!UuPtQ#!WBErhLf z0w^pv2ukd3&}N8mi~WtP0#oYDj7xtJN-D3qbNOn|XQ`IO9bV5HlQ08V32PKK=dJdB zcaIvc^{snAMv!)7A2ibhK{G-@4U!)laF0dU>49Z%i$g`{^B4 z>LXYUMJE)(TKIHyqCUoP|4SI^Z&BHyPMCPls;<;JwAV*E0a7 z67QrM8bf@m5H`BzcBswt?UtO)84xa^3**>CArziM5)Xk*JIkV;DYXe8G4V_-kzNZZ z{PqnfqDlaWqC?y3e)N+{$gJ&cl~0&b#cCB}Wux;!89Z;uHc+@|?w21n96bQQK0uiZ zWFhEY2?<$GE=$sL*{!AjNM#2koL~U=@`oz#o$qXOrkVvgi?d$2*pmCaW%)?7dj3bS zrHH-7p_2Z9+I>$HBky;EpEpUC^P^GCvM5tt!McdV8xaBx(-QxfD#8*1wWQ35yWloS zFbaCA&AK{k!|b1L*7C5Sv4X%2byi#p)DaxK&nAhYX1_qju6HHB2RAL4Ncnt;;V=wd zD{PduPJ%*X5s3I(QTMpP;H#fjO_FBo>i`^5bNcHeI`Pg8`{y%YX2Ik*O?Haw*H#F1Sm$%nQXEZv0$363cJT_;PCPv zfR5x}-?d=+W^?WFiaz+gB|N_k*Qvy|`^qCgU20L*LfEnL%jBXn5WH30m-b^)!&5j=}Dc zy0{acPKqyF%Nk0Y-vbYi9pg04C4{D=Jj3s{iGdaFgFs@oCl z>mj2g5Vw6H4qF`=%$It>=Lyp~ooz~4KAPi6nRw?NP@!VX5!4#ZgdUx6t~8VOR3=}N zpxZk0fjtSIR-n9~>cN^*Bfyi4VPB)^yM9VB0H6q7AXfD-Q{cZmgSAGOA*sFO=7~oXUO+c9Er~u zQ(re4hUtd{bt`NkDo`%=32%C5GDb{6i!_;i>gLH!HzzOoYL+7kS{#@6VW_bDJMWI9 zSH*yf%ylH+kmSD=fiR{&<+Mh} zBxU4Nu$6Q0e()Rl%T+|1C8%O758;G2QtT`ttCiDUGoB4nyD%)8?tyYvz`F)7P3)b< zVH>dYM?)+Y@uV7Nw|u2|4IJDnB6t)2o%b@{)2{I_5m<#x?&aVgO}hP^cVj2Efn_61>p-!pk(=U~Q2QjM zQpDy49O)H%Y#(TMSyWp2@)II&HU*;b$X`~82w14g0|yS-&1QYpB7AcqGfUgfK6*8m zV;)zkGlxTf!4@N^svh{pGnl*yRd6r?3UY$FaSdHGestH-1(<~A#~N+Nd!_wbuy5?@ zSd>&l@45!jo#r9MhCa`2H)R`*PkVq~7CbNoqcA}i zW>4{k=^{yifDhZwK)vO$O+qXXhX1-y-jFS2#IYHEbzuB-h{Dox_HGS^Vd>v*B;&t% zZ62@*ABf@DdPbBQCYCpTEre+EmyrSoxkM_Spyz(vmIA6CXU~wn0|)1)a)}o!r`EAU z&=Bb5B!ji{Jm9qDJ!YZ+DWv`GFH!Ly=6a(kc)EYf{6$h1gNOY4fgcyo>aK--{_Wi%DK$?R5_jSTSy0ji}3$@$?#rsYU=bJsBg&!jr5d&hg^P*Qi(Sf)Mrx$(RZ!W zZ&U^<0z9eY!J~LfJK|EM0{3hw3k!e9`m9bWF>55y?r7@zFnfR}6*drEqi^S=DLc(2 z++9;<01Y3%_~)~HS#=4cfr!21?4ZIyXO{g`Q%L?q--j&(S38teUjY4|uM@U-BreU# zmN(MJf#0z@szzJc)%Dw&BuVNWdlO;VKAA5VQFsG2t^b<5dNGIX{tFjEr%v`Hyifjw zY9-sy6_*4dp;g-;-Gt6Mmv=9Dpc7Q@hfA3kDWW{KpQOM!A zW`ya+KpuJ`@j=e0#K&9g$X7m(=!dvrNi78AYVC?7w3Vbbz-W+{yq`I|;VOq~U7k6k zt(}^=ZI$wsH9ztrDnyVbKe5<0)-fv-AjPv03+76Kt0}oX@z8D$LIm2WJUSA)Q7)!^ zV=-Qy!EvB@I_i!$f|aDL=zriwf_mYQIlMY&*Z1k0%;r#RL~?Z^JI~isu8x))wOyp7 z6=Kqxpitp-R%&i#nq(prv?Rqb-!k|&e4tqjl>In-1s_g$FoXY_KmCSO(EH&Hb8;lG z5dI2FfqHQCZvce!KIK)&rH6#AXEnUipyIK}YRxWx*N7_Q+dP^74VaObc# z^(R9gih`HIdB@=px*`c_>4@ygg{Uy0*U|+cw-M{=(aZiYeAohNsX1k}ULSscxI*N& zU@|}%?;ub^GpPJt#BvajM_aH)7tA>?DxX(F%+W#GRr`WL?BR z(GFUQI|r&ZC0{g;dL6;S-Bzd0LsQCa0+5%TK`Q{#LIdU!DVJbkc7k$^RDB&1`KAN) z(DyFMQ4v3!*S8jEO1WjfFA_(q+g^2|MQb?JwAfse$HyKIs4($)nqC(#Z()}Yk62$r zPNmp36k^XzzyDpBV?%d09fktQ)$o~l+I=dih=36uqa!LJwk@19OrL*h^9_k_UJ*WN z<@jU#MWAgAZKiI$F-|ypW$Ve($#dL_!QkMg_Ql5Ut>GtZmW7_-qhJ&(;!=868lRJz z8G;HuVVC`yiEZiaS)Z^RN8UmJ2g4gN``PiqS++Erb|y6kBhzDOPK3y;sq4Wb{RX|G zqs+kV!9>cy1Fha*xY>=37rtEf@aF=}3_#bop-6^*FmK4!D|B zU!)M7X&T_rgI1<02!0w2g~2**dMfkI$+!FfZ8{1G^1th-A;t$T15P1(&nB5@52#0c zwXe+>gy<^LLT#saM5SX{-uJ!5TUWW(SQKK$>d*OQr1=BBG!2%&f2Uj$X(wXS#ChKn z^EGQ|xjoq;n@|RS3dhFGGooeP2!AIf_1l!viGA0~E?mYNK+K5|<@DwR*RDKZh(G zo6m;K-7U%`J({snWrOj}>TIOudMR%DhMbM~=ZyRO{H6u7J~I2cs~16q zffwC5DzZuWOM-?SF0EV#R$fe&98)<#x6W|XzE>_D@1+TrcKZ~A5f3}JNMxRJhhWe+Nt6M<9jzqu~2M3%}C!tNxSW)ru&G7J|<%_|i z$&2=GY1!-E+m0vezMLRf>DXpvm1gs$nE3b!q6K(DwmTl{gN#4K?;-G`BN6YDjW37u zOWP1ol`W%z31>t)pUZK9ohhx9X5{C*H@R5hM?9`SeQtjMCKnpR0a5~Pq#=N+M;S!H z%8LFuc0f9+&bQB3UdK3*aFtk(+-NexgRo$ApPY;=67#d#)>{c)N0MoK#|JE9It9hZ zbTkUV3V@%$#hw{fTrPxr@ym8~qwG*+>;`op_&7BJnd?>UV@OXW2hTLIc%E0pzsI%& zpcae$sp@ojI;tMddE9c%T!OIA-qfY7MRPoEYLuu3YS$!&^`lwod`tZKCX~H+pTzxC z(jM7-rSWjROLf;1ofv5n#{CUEh{||sW9nnJN7Zyr$?>mSU5Gin%6cez!D2nuQAQ+n*EdSVN9l-uU{oqH-4o)#*lcQ zl2(%k&Ul6HZR^*;{^BX+_fxu1zu_3$pGUXO17tBWWQQ5((gfUv>Vb-^`E(DM=xij8 zp6CKT=WphFr@U@|^m-Em^7`Jm7AY4YL=%AqUjb{=og>Ho@apEgr^if^on?$R1Um}d z6JhOgtp^C~fv8QFUcDR3Xo+((8$X-CFP!Tp>^FF;DXoxdfAfG@Oz9mUr@F%!M(|b{bwYs&lj7dIJ%I}+X8o>MqwfQ;Q zv4hOYGB$v^Qyf-Gk*)|ghZdM;t%^&%@e)dM1=?n#<4*DYK>$w2^0LL+>YOQQUzHTO6**_S>@I+1YwcW128v}|tD0HAGFB}`*Ed@G1Fu98 zs{Og!Vv5}wcTl!i;9BS83SO>UXd?$2b<5h|d@0L&p}>@zqf4cPU0Nx<+#TGN_ZXA4 z;Dou~ekMWQe_?I#-ZP*sGIim+b|;_K zE3a3>CeGrz<^5A`#6|(GD^b(y5A2rh0BuvmH-zwLG^+!}xmAzZ8(7?%wwRs~qGHkn zfH7pxu-=*8u29e={XzVZt)}oig76c0;-&6)b*k!KkQVwly8~ z2Q7x^wGJ!I7(IH{GJua^e$B{+d03RhwL90OYbAQF3-z~I6It+ zQ^=iFEHJhbSX{DhJad46sf)Usxha}owSleU0Ze6Ym(j;)Y&kmWs48&q?d+8sg0m!z zUk-X=ph6_UduD9+#0A*&YuR+YQ|0vR(_Oc5(re3bS{4|eGdebNxHpueA}S~T-Rt^q zC%z!F>&+|#vt5OR3T^DbB|(AP6ped2xA`b=KVca4R!KD25R-D!=XBd-9N=$U!!*&>xZRh5WsFc_vF8)8NUNslqoXrP9&SA8qBW@!aTv`tkx%I1-7O^rw{HI=?%4;y%&vrh_l6v@t#px%690 zq3?2tN~j_x3@wAQFKqlt zbrYNw>sR?>_Z-;!doam>zr_({_^%Fp$KZOkE>!|6DB1+IOIS$jstFnC{vGLY;B86i zd4-JS3FdY5b>p=4RIn|EWNnQ+d0o)q{Ggl0FO;xRA+-Az%!LDU|{?H-M0XNBfAv4ZnYZ!Pwutz8Zo-`dY~FipK%Jc-4L=l2h!! z{mqL-LK+YsdY-=mLV5o8%8I#!siSxN1(z5=?k*8|QT>S9Ax04B+{Or-XV2eIk-nZF> zEmghcmL9xA#g!gSux!r_2`^xi`-24eO0oP^u{Xt9o71Ir*~WCua;f1i{;2T`B<>8ekE9F>5NVU>|+sYbcT zamQT`^LJSqYmsh&C3J<)pZcHxY!z4^S(qI1b+Nti~FhJ%SE!1&^??0WAaef8lAMHq%pnsV!IE&H99E| z6u)>F`t#jpEE)pv53(vg+xaR@L!ax1>qC0Y3JJ9D#yA%nVH79x)tg%b38x*ezGFWG zv0NP2{+(PI-xOe~ZK$L3uwR%JINgL-toCrTYcU zFHiS#23}}CBL{_F&SO_v+?76lygxL2)lpHo*iJSyH#76Op3zL_c0l+@O(0EEv|`Ee za_jf%E+vJKrlzj`eB$15I9pCaYQ0o{9E^k$L&kptyqb@b6VJmNI6_R3r{_~Y>B$ba zW1V314~Yl29k0*zc1zAKF7fBxwkj&vDjtZvy?#IbyE*TnWr6!e;w^T7e=I4lih)6l zdP+r6QKQo)0*?U$eqKRU)!Cn($c!PX_5GZo&H1Zj+k@F1Fje>N9~yJ88my%i`3x^_i?Qaj4{RXOT4jO=C=je|=9% z0anB{KP!m?W8nI9xM7K&$*=W-YU}pG@ofwGH#i^YHhR~(&a%*|knFFJ9vv2K&VWxGEg3T|F)_}D>lKg9h{&OSuSYQGY zg22Id^!H#zD82pqqsbEoN;w)iXhGN>0kIS~eTSs-#?G*^wP6JIFs1)J1=0xF@-*#l z=uzzx2evN)M<_7*y0cd|07-)X;L)EDsAbu_uzwE|u>^7RtAP=QxDl_62H*)PwxR%B z+}vI%kiBmta0UQtnauCA6nf?iy~+WQ&Nq3a zuI;VTrkd;0kIGaxV^~?A)+TR$MmOTiYl5Gb{EALB(d3Fg-I5)p0m!VSMD1N8Ik+Mw zLYRJ5Ib04guKrbnKqMLu)y(sW3W6(W_*xdfwv%doC=;sgdOykkNravw0KPnP;F_sC z@gs-ZaKR`oE+*^16?(*?r88UcVnsDezVg}bPPqNEirBx0&rrt}yu%wVX+Rk+Ve>dl z#4i&INMLgH=L;dS9^Vi}8?`q60M$F7a(-_oi->T#92VIQzNK!16pwOoYR?%$DnMS@W|jdbpJQ# zJ>Ayq&&($9!SI$L3R(~$N>rrOhTgB)&}IM}-NzOlTtvm)>d_llWs9sXmE-T~DT+eEm@>6s3S5c&gE-V@@P zIAMQ{h^!OYw+CnlVddIJ3TxjmoGm_~_J5%BI^5hbyGH(bN_i1JQ2T&Jh86@B^|X`N zk=f=dY4L@+T$(4h_7StVlLC%TD+H^$SHRYLcx~MczDg@Vn4YZa4g8 zSvkIBYBB70+@_@aW$)$zlw~-;2pvfw@Z}_NZtW3}Ds$M~JaMl+vs5-dy*|Gr4$V2& zpDf;*7xuZ4yZ#(E-)I8`*RI$6KC5H!;E@&&#iZlWWN|z$tDLs^cq;!LXAf3`Mgp{;&w={@=goJc=hjceX z*UbO;KF|Aqe_z&;S*(T3J@#9*cYBqq-IyFkU(b8py(J>cnXI)@h!YuD2$(zTo%cJtO!5}z_b z?>!wYQIl$NG^&q|D_a`jQ?qdshW8gyZ#HVA6=}gafYRVBMshyu@Xj6RZNM-AtM2J9 z$h~kywa3!vXP`i{6_+L!KDGNE>M)KPMU=~{_4{zyjT_=Dw9-DDVkq;=aoco^&d~c$ z(^B+>z6UY6$S>U4`oUczKs|wXTmFN~N1Ma^JznS-j5J`}RVfm;CGp?D@Oym4P0)m- zgzefM|$L{F4;KZ`8f!3_-<3eJtv5pk|oNwd<8tS<%>O@_hpy3lyX<= zrvx+`JaU?)2McAjolKYWo75xkI907;u6YHQ%fgeGfZ!;`qC)suCR|5L z=OkDY@#E802BhVptF9*r>_;(LT$f`e?tFKf=@s+UN4i_B!LczVBaUQ4Hx>J4Dd{E@fbJ3WU(@i{BIMqM=>9 znEl1SPe^h<>6uzzF5dSQTN>W)EjeMy`GBJwqcY_0Hs>Rmrb-j79*1D;=E(+3&Vu=J zWle+LzHt>;GVL>w^W5P-dVL0p5P#(BnWVnuhZEqWS$i@i*|0PrC3AcO?yZVi z4EFlxX7CuYhp8@3-GJbLZgloLYTe0-&bP z@<)qwH7lpR{R}P!;`Vw3PM?wG&K7vbSDUyJl^tMXyJ*j-xeV=4VgAAXJ*+qaGLJ9MLr z$sAWvKd}kQagWK<+WoB#=G?))@(~ZlpEoVBK@cL|jTCN>l zir6%{O%nVXW*eW2z)4Wm6Eybn+OzXC)niL2EX&q^R2%gl6Y=M6l+c*BK(-C&ArtXi zyGQy30o{OJ6$W*msJxu$))oB+)>Y?|`?@UEe(D;I5!zZU`4iod_>OIAYI!&O);v~o zp+y-b(Wm!?owFwBYdD?gWXx@j^51jjHhq_JyirMb6qzifB3!pXGc^})#)f%rX_Y>O zs>+UD#g3FEg-!P;>h`21D}eJSOg3iGFY-HbHEXuiaX0e5fNyZ z+l1ss6O33v?p9rP5&vF0#&^$U-Jjw=Jh-B^$e?>Z-uU)HbAKY%_Rh;mBAPVzMm(R| zULB%`_A*snJ&b8BbKs~P&8_CDkI#ONiJAJlPG)ao*&?1eS(u*S`nBa1qsLPVvU5wp zE{0LRopcX62?=iLqwlDN%NY^sB{o_)SQC3fZFt}qyer?udQJ_n+W^D%v<2DsAZAKb zt7inst&eWEWr|%*k{H95L+9q$?ITAV{^_~AdN8G$jAU1GVmG_kx0af+Hkf7KR5gly zJr6rSdgOz+Q>-id1)4P>oNWV(pkec$l~4X1@gI`)F4Tgl_pTm|X={(Tp>iqPmu_^i zJ2qg@7&(6yx3xq6Vp1CmP(qveOdY+y8(I>MjQF{gOVlFOH^9Szvnf! z9GgIl(H)j>|5* z<@U@UuY~TJ@6Tq_m`>X#c4gTVVB;?*}@_eJyM?Dheu;yPf z?PhpgLJwCy>_7Hd`%Flc#KfF^+!GrV#F~gDb;XFOSP+}|FTnVxMm2EDURqDpYCFuO z8r_64gix<~^=pSHFZ=!R8;ky(GmDG>6 zuJ5Q#VR{tTmtOzyhkq%=mOh0*?CYgBB)qZ6$P6Crvp;98jVtR6TYQ8)FN7Rck$F+L zu16?mDD{{Lu-NqK?6aW=xJh?pliSHE_0lt{f8XyvFYe9jBFRF-xYuL0wREpuHJ(rD zLa+M`1zZn>K8|Fu>Nhwa%+-MUmqqud*HP0Y>SLnsHuFFG`ea{K8dOZL*k?WeI@txG z%I!LEIpqvTTVli|@W)HYGJei)KSJe!Vbiumglh%!#q-)GceKO0^SgNWngoki%-=;; zR`%xN;4c-RrJ*^|&_W$|D>Rz4tbwT;h+lZ)`(v-fQ%ZkFvLFRLzpfcS<5r&GlkX@e zwl3MIym*{d-}w(K{5CtLMfwMy{R`2Y=v)Wa-F15K#WSRI%BJw?6ss-9&F-#FWE4>H zpRBaJDp4y=N=m9-^6>-!<@;~amv+o7EPrb4mh#@l24R!(IOvyFYWMULtNv5xU}9?eO3067)4cP`^No#-hbC>ufDl~U!2mQ! zB5=bQ+}_^a-Q9hEGgxKym|#d!QZmahbudU8Np!7adp8shB5aJhkiuxw0 zT(QNl(({AbB?Bo!mkcWb^UvDIh*%`0<&UQ3h8O z_1!i&|0mv<8y?2?o|0v3`SfrBbmX7rwcZnRx8srFZ*28(Wv<2wga}d&V`Rj0VNT8; zVDmtWJR+NZsAnFA?2SgBb-dCzWSJn-@H zjj;J4Dz=63iHX$RQWCFfM?QNOI$TD7E7z^XIUG#lkYG*B4HCrlqg#+*ZQU9$TKdQ> zj*W3lYS;L%|6O~r8si&cxO}DvIi?rYlf?c&)@c6jjt(mKAWq(s;HOmfO8F|;6s#{y zq$4Aqk*sxoTUb~yX!3YL*W$Q=sZ_8cWQMwEyVNXvu(!;vzOrax30Sr7`BfoMaVM1uWW&V zD-}h=koWVa%Se`3ruW6{P`Y4%1q9~eTnjZTBl?gGQ~FFCy_R&Huun~~aNt?ESSO#vULb+i}n(uV zHyJqOQJ}gw&rM-=&DWca?x)-&*aF!1*u;2uZ-m*{>}I|jvDaBnGG>&cy`hagK|4xh z(d~l%*tC^!b6Q_{{`|Q_(BtdFUq@eKW3N4To|x9(ULHZgN+=aY5mBDa94{*!PUL66 zYqvO1Wf+c7dDc^R$|a;8PhnrGJ7%oBuiI}XLt zDNzWy*>Cj41HOycEvblZr*xPL?j8|E7=%B9&gV7e53-8F~nQj5Y(Q!*5y@hi#=)-h=zgB|9K_ z#4)J;v|GwZPfw4Fs|I5Ufb*u?!(Uj0te?f;)Izn7DX$nCeC?>EBPGXhf>#hVR@2Lf zi6Ye)GsJ-%G?m>5$qtLh6b6>E&vcCOm^LqFOxcO1O0@%GB1vDD=j0&8YrTv>EC=A4 z4W`7Wq=2<)5`^g&Hiuvu1vS2JMT(I@t^wl7Vv}bJ{AQ1c?-J8LGFr{=4X{4< z5XC&oZM2@{G@X#)d5(!P{TS13&z>)uG?UN4_;8^f#QyNGFo_j#BYJy#dm^%*$lGFJ zVuC9S*e5qzTU#@t{PQAHvt*Ke)mh-$69y7Aey=Ng0|SbLo~;*h3C#TNFjH@D;o3)j zgMyfNI(g$jL`mVbAz7HIccK%LZf*kl70BRD&?Y``&Q_XqC$Q?LWMm9w%1P4@PLvw9 zPz*7}%Pu~h6Lt{%jVbD*8@pxz2z=fmEPpt2!=P)!;JT#ugKsaGLq?L zqke#Ye{kbZn#iiJ1Cqr7<2FKOt?x$dK@ANJ%M>8JXj_-K8kj$D8Ne930>a8rhA?Sv zs))CM87@T|^E0o9D=68*|2IjZzr0ouq3^kO;|;lsEy&V)7o|t|ay`TkQf`ZNJ%3av z=3&825>pv0!cM7yvn%nQtc*kh$-jf=>W7Deg9FHhAUE5&U@=0WjKam_4$x+8Y|8yD zlAuRNZ-m1gXG^%)XhcKh!;9aO%f_e5w11&8+x8r3c$i4H{P z7VjGL{oUA@A@A>!6^hJRhbcDHo9d+6=u2W+)*4Qt;3gi11f-+E3}H{8eG;-6bXbmv z7am7`Z_E{a!L5%=PP>FziPntKotT|*jFdPM)c62HXBkhvCEJ9XM0vTrw4x#^D(Yye zOjlB}quyx?$p-^F;M7V7-hkqF9J0h2T*v7`u^V__G-9dfhU#_wmFY@ zEciASOM&fwqokKQvb*kA!nY(BwxU?G8GBQa?R@-uejTLs(~yO3^F4&?|;eHAd_`@{&SpEq5PeTeJ=Lv&?@~=fB_A zPr{-ZLSCI~$x5m`G>*~IV~g+o;FvF7u7V^Rs8&`s+R*n2PJ&fZQ>nwma`eNCdtrW) zn$0d}u}zXdgOFZRS35pJJw+=$l!1BR{kZ^{NK1EjbllPo>X1H{yOQWtRF}+7jMLQQ zBtH^VFa3Y-3*MPSc3D%4QbJ_&#PfcjJ!!iA&NjB+;^N9%>zuuII{WPQrP2h#0ajxu z-*eT1KTbgjKY#Ib>W=t#ez2t0>9>v+#eu8D&}0Pfi&IEW#8NY0DFHhmaN(9vS)@;H8TN$Txq7Xiawb3S73%ZLy!=0vF-0tT zFKL3zTFm!bVYsN&mYGOm*mca(wcddFxrY!A`DrI@2o&G-9wE7baMF8vtQ2K_eR>uA zC}m-E=ubjakmvkkeasLxFLdr7BcJ;-yA$suyk>{j!VoPpqzHo8YqrX11iuJ^E|v+( zT@TBoeU31fl+DDRjFD0Q zWXP`MeT%}tN8ZZs+VY>Ol2W=+)@yMCzi(c?Ig@xwuk;-J1+q!KpQ+t{Y)%GFY^@+s^|y%jCxz{+*8 zcy?h)$=XIRo~!5;i*Hb|l)u8e<*|3?Y3ODQS7HyDIaCaA%3&6b6{3`V*i8SMJxfYY z0>#~sBaw0x44}AAVcovmrD(|5`mECd!8N$7jciF9CtOE~Y?%$eu_*>l-SNqq_+tx$ zxihevdv}~2Ka|2~^}zAM=+6EDO;N}mAMY|6@soviR|r*vT6DYbV(4~#h(DbdJauR5 zjN=Yt@E!|cwGe%Oo%+YyLDMuDcrhcR1 ztX`!x5#ocVePd^$;!)P@lf7VxPtjqI!ku+@~Q$5a2%1Ja%^|{XV-Jp~vyyFw_y3Q?Z zqkOXw%nBvb?>RrR;c~|C*1ENDZdJ-{ON2x*-FMHdW=aw?3UOR+V7Nmfdu}b%R+NlK zI=!ufSd9<`4sRe5Y%%<73UzQ;2PyrXgmo)Kff24P4_C@PZKDcj`nJ5t+cM4hP14N+ z^6ijL`2*sK_Ei=Afa$DU%{u2YuuC8+rKr@U;*|FSo6SRsr`jNvEh^LNV%{zcYF+%_YT z2I7Jq4a5&Ug1IiwAI9PfJqwA(aw(k& zA_T}jTrJeL_q4c@&tFshkkP{Ca>VV3YhKu%c8g4;C1@tozKflKWp;ulaurjDDh!mt zt}TqF&&2hFvIbvRy|n8(eM_6S^9%jW@SRd4>Zh#NCljep-9OM9d|?oem6A%qaR9TZ zB&AccnN0U8HYts=d%gLY<^ppwi5vg7WvBw*(ueyRE_IEjVE0Ey%FFLtSMd3mZF^&T z)(>2MX)!lDtVyY;jI{=!0Y*~~60^b7*OdH@uei8WU&aU(Ko@WdUMfNi0O12r1!PyU zZ{IR7F||j#3xA6lUjOsiuJgzD@Akm41L{9uJ^3{Xx=?k#UZaR-n{=uUe$`GNHVpLb?Ta zb<5=I`-R9N3HgkK1Px_nBd~1&k?|*a23)vA`|W$;4C)F7divj5><1C5&J*oAA3o$O z7W~pgqI^a~uo#PL3TqanJ#xZOI)lkm=mth**Vp*T!y!3bP%>>Qp>Yab2GdZ5W@KX| zQ9=h9Nv3zFD$e{P%*8*no#Uf-r8f}VtGmN=dhp)QR%}WG*A{Ar!#PgSpuWPKM3d;} ziH&5j2o-swD!!T0=ghwqh4AJavuWQW@{@j0z9EFGUDX)6ZR=mzKpOatiCgB(ls^p8 z62M{Au8 znyFB9zrlHL=;{IC@ABa&x!a1FMlir`hI4-)UI<*$joRZa28G{OGBc$r6k8J*UZ_~Z zqm1nu$x_Feo4?Pl7n{Wvr*=NS8}B$Jf2}8|Zldm)bo{OHI7bLk1*`4FzflljW2*qw z;ZgJLq3^>-(ZibR>MQhy;DG|t00$+ULMkuI>(_*q*$hqNJ005OLa`2FE7Nf!Ty$3- z1%?P>dpr6ItF@RL$r#yDc%HrY(_QPTTt|_yZ)^=yn;Ac9ok+*BL$BiFQpyzh18U&E z#;ZE83*XE9;G(Q~t82$a5%bs)U*UzsCOZ0E3q$+PqOc_#~{-Y zt=B}WgV>d|sQ=Khy39v@`r~&M(`c8<@3XyDJ23V)fNRRI&i=&=0cQ4~ zMF0Q47`Wmin}iU#mj=@Km%Nt`V~~Bi6M)B zNdqx4hE+{X4L?8s>DF*mWTceHFtxz8eZcm!7|ZWub6Cz-?9YJul}y$D?*lCQWEky}zyFyzn5LjYCkU0y z)_ux_rfGLd7u`^wtRyp2Nq+LthN!A+h_QN+x!N5OW*jJx zFKq4%#dWh+dk8D>-HJ6fgq-zMR8YF7#qtR>E&2jxs$BK9*vtf$f?aXc5jBMe;80C0%gIas<6?lGH@^lDg$6F?&_}}vdQCo6;z>z@oQT$=d4ECKMf#G6A}>E&Q)9V#W9!T}6%wnXrI0_s4V$F{)7iXWm4Jcn!~IsBQJ;e;7LngjEJAV6HY z(6Gu3+l(kMjF9b1r|~`sI9U)PC`fvdofaMa;I_^!8}(7^V#g%eAixbPLaf_$DQlKk z{U0O!#<4#pLV&8JJ6jwa4~!yc8b~`NcjD?6j`_R zKW5<8mAZQN*w$SuL?NX7X{2Hj`@J_Qw zV0FX_dz^{B3Rf?8S?j{4r@BZLa_2OLOysJbsT&$bZ94!y2zY#mG6-oAAM1e;F_iVC z(PQK(_Ls=N(Y1{zdC;F`hx3tHqQ3)y_5Lq^_Kxv!_E~+%Cq%Y+$vU%UW8Rq~@wA4(lj|RPvp!pF5?jmrO#yveW9vczNG5$Oil5g}R z6hqH{i-(6NL??OuSJ*w=OuQco*-OPOEBa?a}bOfMJrEo(R?b)^?NRCX@WHvs(&f{2Wi-Y`;Z^rCx zJf3m)lAuM5Z?8f#v|z(0Un$>c@Q`Mn-xRObY(%DaZW1`L-c66hBKYsDj{>^V1qf0t zJiOnI4x?szgB=sUOKPfdq~@FEa_&>I48bQmm|DVnZj5a*Swerjz6SasHB*KH|Owr3S%Xzq%2O__!pod?61n7P)J{<$Wa-cz8y-lZnJ8dvMwGhLZrt+Zcl@$ zesx(lg3nN3F!nKfq%4Jh#8McW1I>Ium|Iw~xXXZqb_c zeJ8Qyj%J_wxnZR-idVa>fX^MDhZrryVYOokn2iBF?R;f!YMS+{<^I4fmR6yy)wkdF zudH|k0$yxVQctGzZ^c%gr@Esk9+HH0e8%5rQqt1GOH__Y`cBET!}UV+)Tf&-+$6x}Tr$2-%c%tdANA-LC}l>D)MjNpXk}S-=}6cnnPq5GM6M0V zaUUV|awF(H9?6yfQfCx8fj-cdtiW}L)IMc>87_$vH9+i_uTk>mqrk@zDr=t9!EN$U z5l(j>=?DG>?;q;_-fC+TM@}XZG}h!^xg-Zd9E#o3IB{$))V0yk(PQaXct)I~n5+(( z*+GpY?r3fAktdT>!qHJzTtM2r@@kXvhP@M7E`bEv>)r>IB(2BAJwu*H-x;O8Y10@W zMKT+Z2Rzm*gWrjE>|x#Kat<%aWf`)pQ03o~0KdY5gidkcvDj zy;Q`i7_<`LCTgvSly}Fm4*8HsdPMhCBW|slO@%8($@$|MotyKNhM%c`btR-+!}t=OP)aLUC~y;aYfd8Dz@rty!_IBSon1JVQNf{$V(Fr^Jf)< zLpweTUXq>PD46bUui9A%^yd@I=QH*`*8EsrGWh|gx#@z)58NnEtfdWay^P)RuOgR5 zq}ny}oAx|Od*6s>j)dn(Hi)>+M9fwgw&dl#(qn_~wZO43>_PCgAEEY>RQaO8N0~L1 zErGV446;8-IH+h`^A7(Cq+>pL9ehm9@Efb`we9Y=foTNwXFvjvj;21@%rIf*dpp9= zM})%)Wyi7tG+pcvQxzl}z|386mZsKXU`f@9Shyq1RiU$ew7;`2__g6e8E__PoyI7>DBFCo+ z+DZ)XcQrxg(T$xUsl}xF?Xi`goX`ha`6SWD9Bs~SUM;6Xf?B^h%YVd$w=rvJgH8Tv zdqzTBC?bVksuu!0EYD_*M_`TAl~1-DVEK2W`oE4KH}vR~UHfv8xj_p{z`N5NK{nH? zjg`&!X;*D1nO^Ht^J+)FK=C+X;Hc_-K-Rvr>KS9OFwQ43Z~nobR?|4M?gw)`pWN2i zd&O!&Cq~*A{z%86Qk@z`X^|mMGPamYvXA`RNV3sOS5e={1)S;8%<|WXk+yasQKfh@ zh1|dD;H0H>DIWn3$i}kA@v@jHOGHd7Xr$N$O%`Y-Dnl22O0@ZA-5tI5J{b_G2rs{% zQ%{9v#bTjyZuG`S>#p5Dzg|Z^#008jj~F4A+QDp9@FVx}ZwmaLPKO)oQ99YvKyv51 zcNE{87~CO$=yOBdtM^3e8X#k&*M?QXhzpe#E1XZ&3q`fGPw8##S?N z@irisy(0r|2~d$+0WI1w$f0t;=$F?uj7abM`-cTLtDQHzvT#jrwtJJKy_=;7+>l$b z8H8<7vxPwXS4uKXODb7-7h-ztX4tb6QQduj;5wf33{xe1b?dTa_2=hvwWQcap`|Kj z-4e*w-F#CmWYpn2i>u2U=O9ac{{6(yr1RIm?a*pyY7cn6k&}IAF}KqBnE5u<>n#%( z^~S7EK|@(TU(%MLvz(`SM?GTK0Uq_JVvz4ZD5YVB0pb<5yv5Mou-{OSN2tas~Pkc*hTU1%w^%MJ@| zzm)3m>dP%(pA7Q{vWV1e)75GiP+fuTr@Yu0?bH{@a{=z)&>tEg5$;X5zFtwYdc>jH@ zX8>J)Nk#LQ1QDORIu9Jjt*qbm6_{994x2><8Er~&LN#EalB!04HZCIe_YZKmI-vK{ z&nT{2i1inkBCS{ zf$yYcr_%)6#^XWi&~E%F845}vJvW`~{Gv{r;bxHPa5@~?XL#>EEc+&*=I-nRK1P+< z;HtYAhLXLWF&{|@A-bAe!?BiLjpcJ$(!?ZAb;$s_iFv!02!{-~kSYPIUdVbEWrhYf z6;isuC*woragfm$D5OdmG8bYn_G4P(X6WtWUkPH3@LD7nB%Lv~Q; zl?5gL_EdnGeO$A=-%+pV_lStoZLKR}mwIm^K?nk6qOUTY&|O&PuX7Yt&nz#9uKcEy zIh6da>Dp^|g5iuV*qlZ?KDrA{bA3J+2({b(JVQ;pxoc?%TuPCFY?3#FV(G;L0|TSE z(k6cwccK-o`3ge_&M|E)1{Ns6H-+A24{xnKNli&9rVY^^8bJS~*wTlyrXrKN(Vyr< zYY5x`-PU)S;sGX*ElXCga17NGnok%~Qhnd);co%!{5HBNy3`XSGMH|yt%4yeEf`dB zLly*UAx_~=4N^~D^jiezWMiG`|FqTyH99fIbT*U=M0J=u@!i+vZx5ksTJ_vma*q<8jn=Nh**zp&>f z+A%5~&t0~7M^^u_HHdkB2-WbkT;72=&(6AAEe_p{T&)EacpQ|~(K}gb*q;r#!Hx!G zQ(c6=FaNw4-S2=}K+g#EBkz9<&q8-x&x6%qu9T^l>p*z#vfun($rnNTnic^z*{7%JedgP6{jiqoHH%}SGKl9T1|pJvEeQCnkhYsVRSWQN zamC#M&a@MPg3Q|xmpxjDuCwqBbbEf-iOh69nk*sQSXdFlN}2<;0dZiZn^}$B5*&g! zg;-6MzI{}x9Fo>0@-^vDDCju0(#?wR)mTHI}1a)n|UWR@~6XczAyn zr|skldphY9yG6c%TyNa@Md*GqR{<*Y=E>kc3+@wi3gk$64*K#dJTe~seh18^+TGMF zQ|U{7qU#Jrd{iDP0eSfH^5ATg1T~$+Gft#)(7Ks+&nMw{ zyvDu+GAcz_8ds$|sBSDo2Fn4Xsv+(oR z11oFVJinW2TeuAW?=`%HhfZR_QKYYNHvEqbfW3gL!C@`vCfW;xQT~%Ll#@1w6u%@C zIs+vC?{u7LUCAhO$eEK*$u)O6pQNokEHE||3O;CT6uN80hSkYtJt0gh5B&`|`(%vB zkH0jEiJt9G~UpK z|FpmWt$~uev^G$HvZjRxZnmdz@tl87HuEQEsSTzTeryfNd^O2!^;7=2FIhi(E6P~M zy1J|=ha2upha(PLO)GkE%YIs%lFx|;{~RtVlR0h_+*ml0PNVReZ0;|!VVK~3_K~!7 z&McMpM9t^=1?eJ5W69u!KaWNB3&Aym!={s7gLy%lLH(3xWcD2=UWj&ZK(ne{@T1#w z9CrgU!pm9C(;3oi#a~#60z^H6oM6eZ#aua?cQB`>F0biV&lP3UFv6*#1h#Wi;j6zF znRO+A)TJ_}nLjF4udXJ=uZpL&ETZWi+so~FVZBcCD^t*r_@QZz`v*U@CRgm7uG}mR z*GQN`eaDA0ng>E?dW*Ldj%W4SW5b|~%FtMd9TvV^087{>&6o7$aJ*tH+>mW&vKYw3 zii&!S=7zE)nfvmihCE!FRP4H`-VsRX|wB-6cUY)|bY|m;rZV6IRgPIpnKUmy{)CM2qjz|%2eQhuJ zy0>15N<=bZAQrExGS=iNCYMrlfyr$~70yLKuT5H$%Q+D8n5umx!Qfc}cRp-F%24|q z4NZS;tom==EE0BZUJHVQ{G788hU@L6Ug_qOa;@H_n>SH{h!LhHHH6-M)hf8{KQ1p2 z2bBlre^?WC)3u9TyAZ_DS8RWj?yKA3(Cts>hBuw}x?8b`DNvuC30#h|cKb{@96`?o z;HS;6edcbblspaZ3Ni|yi>Ir@0vWfL6w^M!d>e$1xDb`nZEOwt@DIcNh%xHJ%!Z}w z4~bPuXDzTW5e&#d3@q%0J7QsN2=Ynj6mc$eS@CE1UTzqxWgB|Fgt~M$9n%XTcdJ#q zWXiu;py#2lRBP!_5w?rpbw8zRvP;~3u34<;qk4O zdS%PGlwq;$A;%|TlnrZdP7rA=rb=f4bR8QTtLqSVW`-%plroRJ!G0RpU?bY=NS2lM ztPrn(DN$DObEBhf4P9((Yyf*#CJB$F^X|kBa7z}aq4wzpZhN^$7opB*Cb*jwF>>Z% zj%rJ`i&rFtO6s#;=qw_@+8c;PX#Axhytos41pjmB-s4op=P!JC__ZWyR3ZT&gW4 znDU^un%XmAEu_ABwcHX^?#L5K9;)2FxBO2y3C!Q98{oyg_hVHK@WpG8l+%uwFqls-VQM2+R4>F3XjHP@_WImNQ$|!2m@GgflFKwmw-E*Fj zAXNEGcY{GY6oH93twPRQ?qfx!eR!D<3xtOgc3pl>9EYp4SNV(~ZXlN}SL1%Kp#sb+boZ?H{mWJe zJ|SgXksom7!6Mt%@DUgdKM1B5*KI5uM%I>&ZcfDQ-KV(b!JYiRz>t2^uWV=Xv}SK3RY zh_RzC$l0%Z9*%1{m3z9wHAMDNdgggO{8U8KXX-Kq&g6WrioOQ!%Sq-RoXKQYccm}m z9dmp0RCy@(h1Wek*Idm3U!(R@q(ftLrCQ3Uh*?cY?#_$!JS5ZH(I@F}sgjczv)|D_ z!weM9es@*-q9J{a|1p|>%2El+(}M<&f{ua~@vOi!kwNp3wv&`8hv1dzrXdiFNqZPJ;DnXS2&i-zMP;i0>nt-#E44K|ural5XU1>Sau#>-Aa7vXo_@WH{I!~HBc zN4R}YE=sA6%o5U5VT16Ni-JAqnJ96|$eZkS$CFO#M;brZt^7orLbSa8Zo>Vy3V(tQ z*LatcUga*?ds|I))Aaf4rInGn=qZ8a$}5GvW|qB6VZ}S$C^^WU(_ZH70)fcQU3aqs zWG7Lt7%EltkUt-FGoHkho~NhK{HEYuH8T~lcpx)*?aKSjlQSSiH8Gan{TJMv0K!QV zl_@h)NUwfP#KPi+9uogq?%#5O%I&jnomlXjI4_w~RBq^#?A*9U%Ao4+Xf$@CZNw?O z_HuVze=ZP>-RGHS{fv`rnuwB5Zz=DcMO}&>=D7=u9?RUocOVCZh>9lGyW;+gxzlo6 zIj0Temq)$9O*+Tjh3mPZ{m^sa%@*v#z4qK?t;bphM4!UL8UH(n(UGAh_Oe^16i-c! z2Jxp*(hac!!{UW3_?E}LTv*a7EY^7SJPOu|mulu=hUu3G=`9Jw=tfpvl-o^aIxhUj zX*1%m`Z6*7B33gIQ9FK!*r_}39ojRnuFX0xy$_Bp{U*BphE%^-uqE(o)OA)(uc@q@ zoWyX!H`D)&i+_g4F`9{s><V;5q%Vj^*W@aZ0(fSJyU@&dW- zSry?K%ey=B-AcEtua{ouXzg_a(?;L5^?6Hl|D6ecUm(b3Q@*o!tUoLXe*HP@ahH`;F!kgQ?`t(^&z7V6&|rim*>=0$m>m^%_j{CpYE zX-%)f%q@=3O-PU|PaDws{%4Y~NX5;0XV%SD33z)=^f%2)Lr0feo112)rhMs#zJ~b! zyXPyok}Za(H#|zBr#mgy2k2;JDN9c;0{so{!}gm*1~+i|8Wj`gS5LLt_0ZZfr3yNUC$Jgd3yrj}4j#)!VOUU(5HfI*OM*t+sM zAUo^Z^?B`q$;s=hu3z?ichQC)R4d4z8G41@HX{FT79u0HUPeU|;CwWyfHNJwaAjtg z-ifLXy~CE2{79{xEBPidk1?DI_V(r${nVI#Lsv~LE>yjo8;yg~MJ@M>8 z|7D=%H(y-QctThF|ITkP&6m+0t&W#jT%e~vZD_u`b@}Y6mX_#?w*^huF6K>P^uf>a ze@lr$bL8^tsHFW7t}h#s9kS`24TWr8B_i5I6*R;E*kZ0Dxf8BM8+fI z&|A%9SHglXES+oT^~XduEHRardL&OrXP>GIB#=F$9&M%(!^py<6rG4eqUn1mn(>tg zYV1pXo*cQl7vepacqTckW`nNgEP0{CO-X$0m;2zcv7`+@3Th5=+`f!aFY%js)pE`U zP_2&Dun@UXIr%@oAPgPu^6_cU0C^BQIls?J%fqgXvh1~w>qs(gf3_v-8#)r`AQwdV zK6a2`u)Cwo)C6Yv)X!3?Z<_-jnFHRjkBM>vvkxIw{NrE>;1M5+dPy-+++5*@Uw;(K z`k3C4V$%*jAb*|{$W6Z^)HS)y;Vx>R0I@8nTP?}b_>d!!m?qw9V3}F?BBv?mHxsj@ zxump?ia%~2ct#{0XDmBhS;Sci;iRLXv267nn95uK4l4?-taWdkLGy@@Zcr^OL9Z81 zqE$gP;tKsZ7Q|vKbfp^~b-oyexmvxYC}YoqqGzfm3g$VySCM9_=qAUMS}cK*#S0M$ zx>zT3egMvO577AlaIQY+d}L*fJZt6y#{Dud^gurhknBL01Eq*p9oWVOG?TnlR5Sy5 zTWYmlquU8kXq)D6jX!lV@7zzps7<48oVBpv4l#L!@(qI=~ z#7SZ?ya)mi{Rp&z9j~;57J|H?**Iz36J>kigF@J@%0_(fXoBcQ?t22pfDe;jAD=`? zeQlfz)S_1MBzdQz!a1s}{Vl=~ukd?`4y(Eph9aj{*24pa7n5aizCTod2<`HR;hkT1 zMUVomuEFD+@h=PCy*gQ=**KGU=lDUL7PXIKgEyn_DZ|5<8%RL$*X$6#FTVq%-1#OP zC7(vv8yl|zUkj^Yb15xpL^w&H0YO;cad8`cp?b*A7Q#^j4x74;Qk{3|Z!!k6gyi48 z)vo?H3S`f^!BCT1>Ne zSbZYDt$X#KKI*e@KPs)1V&kD^9+B5C)=@8n5whw5B?k31s2`mxcqTK>nr$T&;!7iL zpoUhR^=JXS%63OsKQ{u>vZ>XDa@`g|8wA%)PLyNl*$Z8rf3k_?r)X$wiV}eOgRT+iHhNGd(SQfuk{S57kZWmWllIux*h{{ zVWG}J<{jsACXG_HA{DS>(>GZPbI>_((}u+s$7V<&T(S6gT|O#URx>-+VjHUDE7WB2>; zLMHdRt;R@g68Z>9!+bS$L)hpeVPapo>hQ=O8XJ0}W|~3HLQMZ&)0g<4Fbe&W(4~4x zvPQqsOPc{On@@E_qS7)?QTR#sa;qt?2kwnTCqdX;6n5@6fdIZwFs9&hW8 zJsW3mhdwpu@pxv5N#&s_f?geN;VU+!xS{_1M96;m0d5y)iDG8=UX#{1uJ=iptCZ0~*KzkHZYug5 zmKjfoZ@XoCb9+G$i-0L7rm@LoG@3kd!r62LEw?@A9UYSDZSHCcW&n@cHJwiZyHm@D zeu9)DYPN)0n|Tdj5G=^_A;}h(%UcGG!6Pg{N3;Pv4bW<{fuvRjLv64Z+uTg0$zP1g zU+ilJ!raP0di4Lt-CIS~wWQ&qJApughCpy9xO?#6!9BRUyIXJ)+}+*X9fG^NyC=AF zi|*dt`;2?u?%T}+8Dot#)>^Y>&8q+Ztir#K@hwDzqSJea0=JjZWbW|8?fHx3Ws@fk z1$c9k3;>5(3>pQ4_17kK0r#sc4KRrL|dK!Ljy3=SwQjw zw@>nq*)q*hNI6;A7jO5H?P!L{w=xYb@LPb}QoX^(&t6{|ayOaH_Pth?PzYh|Rsw#{ zpA4{I*Smu?7;NDa-)|T-H*9~eb%5VZue_vH4AB2g)qX~HpWNKskt9|`xtqyKeKBls zotX66?2q@?hA6ct)Ig>+RL`UYt{aGTkkmz)L$KK*krKMsI(%kJR9S%x>kN=AP~vI) zJp60NKz(H_9tX@QldV9(5lttM#_bM3<3TEyi#;!i%e!vC*BXhBDZMrj{+No4EuI2& zQ)T7+!XLR3k(l@f8YgFsn1CQl#9c!d@J2E@ug1J?!tC;h2kk&!+Y2wlYk}@N3`Pay z?JWRnG-ogWPNpvz;Q>%fdE6h@Sy$TbjzGSbBYOaPA*3tdvh=3;1xY{jWewaaZ~?ux ze4^rkTfnXP2bl=S#RygybifiLWK?WN>xyXqbJ2_?(@XJJa*Er|5Qf3PO0E?ULjfa} z{C&8p4@l<(u(q`^aHa;g8jj*RAW@cbb}(#1u7jOoD6T~q?g!g_TJ-%}!@Uv7F72U8 z=ebWywej0fY>p?%XCbp> z)Ev*PZuN2S^XQT?+5#QbkPm@yyh8NKUvL80PX6z0zr81oh!BgTA?DZ1 z*G~l76CPkF)A*k=&qq0>p-)A)O8<6X~)UKf+eR3MI+ zRryelF7uBMNolRcZyf(DHQ3G@FLC?k^ZCIPqi}?j^syImwU1Fj=GJHY{)v+_@JeV3 za=r!dKe$Xr?^PA4DPyzBP`0+W*Aa!@B3O65LXA@uYQb)g`e}sBH51CB2Z9yTJNZ6x z{7mt&6xX~h7E=6!^6&cF>8PCm%I3rHAJZbK6(bSjz++hT+usVYB0O(VRC=~mRU zJl%=JQJL*%ftQ(B@-RfK&=H(}!t3LDY;Y)u#(6E6dg0@#tW5sp)JDJ z*DJ2c*)evXsG1)h+?=q;PJNFBP|RR@vTdI{rU*F@AcK92|9HFDL~tD@xeiw=&e7R zhLcwpd)IiRSfX{g!5x__pI5N9k@t_rFK7f`!zsn{#1j|-wITaGpRYZm3=<(?*nHQ1 z;Z32rysMKbR1&fR8i^)XzA5?+6$lKMD|9gKMe+sS5B#c`qx+IRV1v<4 zI|0`2@fQJAr#He|>^j`WB0c0?8l`6tM_W`Fy);jKhJ9q92`w!ef+(6=w2vLX`kBjSW$tqDCkH z9tVZY=n`)P0f~x3GTvse;Dl*Z3w$H!Y*1CUV4>4d+UNgX0|c7!%YlAii=2FOP1kLp zb*Pi}=zp%H)je-O6=IV_{qwEj)kmWq7LwX=9_i8ke%=8FqSu2dBei-n1I`w)fZ|&F zh-_#-#V#w!?(|!WFVDh!N*9zmva+&DBr~O81vS&9Du+3m-lMALtrrQy;Sl<`ZT9I3 zy^f7WW{?cnxv`l|P+0jK99S?;@EuSVaMcIY`*#$h7Mh(I2i<{Q?W)bCFy97Br*(;T zKqMBZd8*Hq?=6q+Jq(skj z{Tf;Cvx%_}jswRPMxs>(p&1LN?I|{!jju{ArA#Lk(jKq`FNVc*BA?^}QEmt>S7QCR zU&2{2QGC5HL=7ZNupli<0AW$xKR*`&TFJ*t05jwU7P*PZ|e!U)uj6zDriymTat6Y+4n(Avm(dP*I zvUjX5T5|8_xod8wVCd8)B`d z_otKoJ{)&yC6%uo;@=MUgyM)*ffXwU+)6UrPcUa#IA_40pP2^K%I}`QGeF;o68=8< z^raF}d2h?-iv%ePHpGOtXFtq+7Lu8aWkK&q7Z|%4>E{G=mt#d+%4*RcU^_4iSl^8& zpc`(G;nm=gNG5;P`wLdssyz5iz%^?r@KY!-qQgDUW4--|>P=o}JPB3fkFQ5)q;-kQ zefV{t7(*ZA#P*q8(hxH8ZM`=?de17JlbidY2MD9z8$#*pYC%e&d%Ft~luks5eWIM~ zK&jH5`P?r=C}^njv!OhKtRor*A;Ul#rI?{FwjBe^$))PId4LgnkMRq=36tpP6)M8I zs9qt+`^^?Xo_X6KsLApiPQY)}PG$z7rjvM(qCJHf_w}DE~+qZa|Snv6&osmUk=+(ew8Zd8%Iw!1YE0l_QJ@C`F`JzR(k z-|>7C$8l>A>jCP&Ec&{4*W?yep-Q?$1#y}2XF$Nzz{+Yi*Zy8~uTsIvf1lCujz*(7 zo~D>v1@n53Pwa&EVK;V{MZ33B<_8^CJe&m`uLV6}`Zwsu(Z^03WIgOI%+>-wEgo8> z^6x4tgc;6n>DcKrM7zDBugq*%)(aJi0`pwX==3jjAVcW8B{DS3Gq_9#0+*)jKJnOW zeRV)XgjSIiLxVb4tfQ3~=<912IpJj{>`922xY}~gt$K{dC)kLTaavlZsKbrWep`#- z8dH9>+Ll(X1)0Po*TLg(gl?O`Rn+seo~nO+W|js@$w7&~<|)in)ELm=6bj`D5P~~3 zHdf>lHO;@q#`87OvBRVLxrT_%q==>C&i)4<3#0seX`OlQmxuGSi0ip;g_BWq4rAuS zWXZV$DdI{byVm_O!6I$gs*7Id&ZbW-3F1;@!-;@sjrw3<}FF!x5xfMTU zem+3V6N!FD_yA7nhmUjdmk6X=M?>of; zBbfn_92L|8R9XR_Wf4W@FpIA7`zT1{<*yKCl@~AKFOa}n;}_@vdVz$jgT6=^4iFsi zk*WRLCw)@27MG9Oxrr6e75&l5Brq~heQdF`h0d9{ACN!gM`nqR(97w4=#ZZg9r#4z z?J63WSvmF`==RMwW4^r@VI;pkg94zcgE$>K!qAym?=b7ok+%$ZxhiF1{%|;+lxs)x zR11`aVgTi`8igl%==%yGU?q{M>fv^UsGFuFir?1ILPRFBFr4v|nQK{!2S-0ePJFip z7=`abGN>VG{)Bg|gPB&2Y9zDK)mQ~F-P`xa99)OlCt_0&B=&u7M?>uE*YsHFbkcW6 z!5EBmlG<$^kH3>~`piMRgdt~#)RNpf#gDy~A?hFKI}v{FG|mj^6l065kLiWI#-~A2!X;Yb{+v7GO=iD8;pev&`BwVF8;h|N4FMl~t*GADfUxZ2 z|BEZkdf`1QwwA6gUYyfHm93SM`?o->SdO?|4N=jbChaFLYEC))@*64F*sw=&arwai z0MfXYR+)c{5z1JuolK6|0=|7hC5F6YT|fWHXDCIb3 zg&?eN4VbY(N9jZnF(igSum{-4zZ%d37$})7pO5tV*8%cc(6cAc$`B=wl&Ljz?nSq~ z)c9hBpV?WB#{Rkt91vvF{g$$v^~DvR0G+SpSW4_@P22=h-g-bdjzI#`_C{!e4x3(E zBk;?TE=|2xz)%h-p|OW$xNiy|Kfq>OECTpN)9sJoCnlK|Mf zTG=c&+ShlC<-fL50qUjSzWd=De?@*de)r7_rCc|VbL74F$GMl#bPS^&75uc%OLBcj zW2M1-#{dtAUwaW=C4S%w;Q1=uLp-vFT~o=_wF7$g@W5j3kxATczhGexx_Pj@5qwm# zFmM4%U|($95A@&MfObgW1JE}TE|Hw6L)`ozzm(D2=xJR0o?x?Pu@EQH2{%Fi<`%r!kw(Xn9@Te36&gc}YwHi0iZm3Bcv3HCvO_GxSK~ zrY7`(q^kZGAp;~ix0P#^-VmR;7R);o;_5si*ZA-WzcFjX!fW+^Rm#?>blRPuo{Y)W ze*>b2gv8W{5pINh=l?23T12G&smLT(7h@Cic`}77m{B|gr;jEDG|MyvAp^Ky*od;H zH9O@xl@5Fm&3GE6Ie_q-=1&yV(fi8*1ZrgllI~D_{8Ucgufw70UQj3CID`8T3P`%e zzdD9W21F|um8o+5nY~8^<|;my*>P)YOZ-5zm7gJzN*%Hq7si&NXeU0;yb7Xi)xw#t zDCQoQBUF}v)S?5zRP!NJVySmkLIZ?GKfasz;}}>29Ac>Q1kw}e_vQ?F8_HyM4lId{ zL>`cCgEMQP3zMYRK2dgt2+7YUD9L#d>qlR&dZw}X2HpoL15;WOmKRq)$uDPz#KgFR zObtKn)kA3t()u3VbC8ae-HH7 zS{ehN9bc`0xI+131!i*Q>c30zALXcL`)#Ckr1O(H;}tZNVJRbZZ2XOoi2io^BfO;9 zV)xk8$t8Zp+SEpZyQYo7JkjgMJnpWmIl?rU$G3_850f#R!j zU{l(uA4Q7NWfC^u(gXky+d$N=^a!!HHpr5~hL^cC;z5W`W>(Oh03JCT`R#gT8w3;4 z1Gt|>$>jaL)#UGBjG;b9Ocv{5!6<0j7Zgf6lJ&e~Kt1MW%fO)rhIXSNk$Iv-e@f@I z!?!ggE9fik@Q!?C$I`ZlHuV(nq)zJjCMs_ zARQNM6rNXDt zecWnLA(HW$J`92Pe(!^{lO~E|6SO=z5sVrG(~OS8R}}g2^c%w0(@(93A6w)Nh^lB; z5Dz}Wd}#+j`?lRK%^naj0(xfJ^=RPLWu}yfbWC(Kli>(<>M<}~u0Ov$^2zU_$A$U# z`p?Po*3`pr4s9%aLlya_OX=r1%l_0Z*0bT%aH9PAuEaOv8OD;-d*iS3ZH1Mdq3$_w z&AS__X(sF7G%8QkYP;W0z=169Kc7Dcf==sk^c3%=;!ejZk)jfX4MDyY1tIqW($E`!_au(rhB%ANzOG`RuRl3(`$q-R5Ie%hbROrN}d9QP9&{gI)ws6ki-lfjQ!i z#^nM(^o{-}82w$|D}^%G3>EMz$c^R2qy091(q@F+OKSPx`;tu5JHd)4yp@y8-&2J4iJFOk9fC*ZiT;jCYsUh!elsLhUE3lBEn>a zGn#)w$|~{>a81i9$e`t!maQEckTueV66|11%H&-^BH<~xO*ZPQOHbR_#SVQ zjwy^Jmrv8-zT3?%M5~)V@NA<6vx|{Zp@S-^unx5iGr$j{z$Seg`4mq31Ns*Re;TcpgNGD7$APpbckYvA@NaEB`7xP2X}-~I>XKVCE4r#CswaG%r%Z_? zXQtM};1ueBvZU%iGYev&5Ps{nyvNPCI9H}gRW&)Y-u$dfW^5knaRrBUYF`Jfp|KNp z-Wqd1w%k}kOIl=y4Y;1cVRM}~sL@=mAoL0=WJ>lsB_t&ksZlw5Lyi*>)eN9WJ5PTh z$o;f)Mv#sH#kOCFIK;ReX(+8PaQh|3W)b%`mCi3-=0c`zz8;ZR1Qt%>mrgaA-Lr_(BD~PP|&zgx+RFnXzo5lbN1x~R$X8F)(bY3yM5Uf zdwtw7QAEKEgF%C*cTV6G7zI<<(Y5Ht%GqZ&6qpU<1a7qQntrZHGB%b9)#Y2;E$(ga z_AZy%U$d_`Hk@|1@Jq|uz3M&X$;KHr1hmXugm5&xE_cv$eRybLD`1dsoFUIYUDViSsY2~oacQ!cG9D^tDoRybRt^>plq%edoQ&R zvowm@#LBTlkyztuz4c29-HRW|?Y5HVwL*>-OA;5Z)SvFS_SfKy@ZYy?g^&Uq?AW2; zUBF6$V(5>Eml_elt6dGwu_Dx?2zx_AjT*%8Hj_7-tJDUA`V|w+$iLFL|8qNjo2O50 z6J4Zodc3G$0qS?M+U99tL38H1-sv|AB(B1E?$xHVG N_{pA!J)r}Y~*a#JKwO! zlFN~>u_cHJFoO^tim;tLSCQ`0BmB;3;&ypE!p1X%fS4_kEPom@vOxI*C}VNWFC`QN z+YCFGuib(cAh-VTGNb-eaC#HGuA1S2S=J z0DHE|8GL>q=Mj)*CE!1RX!C&391smn&+KwxR5c%*a&&YALVaTaSSb=k0*gw8&SW$O z8WwthKU}`<05HG{EeVJTK-s@Bt@kPd(vd7c{HY?7h#O58DggTMcLpFHK{D@)n*(6n zCR6$2)y8rQn;L*3oLap9pEe5ry_+hhjp!4IlOVI*qUUn~G_+i1ZDV-0SVb`6xKJYZz2*-Mzgpv6QsUzxhCIBD2YzhDh)ToFqC{ zz_|>FGR0E0`C9X&VFO)!NKPF38sGy2wp7A}RnO-~07bqJ0&J;H9_WXda&>_T7BDz5 zAhi~x7i3ngbcIwSAi23Pd9M?Ntbvr3}F!)C1d_`d1*FH8`^OCIHVPa1q>u zchNUr+y31k{Codd#Rku`q9?ltxMO;3KkGpJbH0(O9Rrsvs(HAxWu^Kp= zZ40!r(#uRMAcV6rt>-W65dkBiO(0kUnY2l|J;B<)KqdGRO7Idb0Q%vvTht(ZkO*F{ z2x@%LgAoxTx7!XQIr=J4_acwaduT0r*31tzD{Z}8Xx`q_*Q zy}bD8b=m^J)j&t9DClJk603d=gMJwt0tOQm842h~P>aWbxpR54jCG9)jKZ4Olw@Q| zAWT++TCM(l5@fUyICrlIOe??}=@~WazlCgb5!3v~*5hp%BrMinl;$aCIYQ}EDB!;C zc0su+=JD*t6gDC(Mmd|suB;xLjA#(kmA)msWSrF_Yt^)Tz;H+D2$wx1lq8r3S6)Cf ztu#P+Cc`n_b9Qh0kLi9RmhQVtbm4gRkJo^U>b1=O@dBshdt%yuj`b$w|K~UOf~Avj zr!MoK6Eh4pI#Q5LSixMxgOZa%H1*Z~DS|J~3Vs1;KASsl6X}c9pJr!&D?S+Vqgfn*AoaQ!%mi6W(|5l|bh@ zjKh@31yxm*J{DtGxt)|O6cpsf8^Qm-kCPR7UYQJ#7ojM4QQ|6Y4KTW%7kjy>;*TDT zRyk$#A22Suw`$!~D4Zo4TpN?9_8GyVQ+c^n)wLh7&iib^fAbVq(K<)lJCFOn{>IJl zPH8VLGpleYdj->Tw0VechV5uBW--ki*&iFKUz_%6!FF-l{$=B=$?&Z9UvWK<6yp)8 zymp?^`fvpxE)7FJBF6D5z!W}5{_kQd!l@cTJ~*gMtmf^qtvqmUo2d1YlPW#PCFWgM2qPnfi6b+q$HVvE)WZ4TgdERQi)U>L>C7aS+!xN6KCPooqZTjunhALphB~8K zGUad$Fp}qy^&Sn|LTcAe2Yg{>=O-b3by<5l{yaas;(Rh)*Oo6^Bzw8AO`%w}n%y1W z&sYVE<7Y8^FuST{C=iyb>~?qhv`w_o;^NO2MH#$(L|7*_dT5Scb5Pt{Zu^iNHFn{bB-;!%{N2YG7B->aF}yQU@>ipD}n?M7>EqTlGl-%m}%$7X;2-eKnh z!C_bZ=BI=prtbv&6=%{d#ZSx-&?0-8=t6YkDUfc?A7t$)%LByd4W>koykz^Y5&SbwQ?Pnw;AC5l1 z5fWo&_9xMIFn;48UJ%RV(|}4FC%;Zg&W&tkB6miWt?Wl*QUOtr`KksEDNS3;T7e)- zH;ofxfz$x)1LT>@d$&7Qss%M|4ljG(su0O6>b20%LMD@ou8hGJK4Q^Wz1 z6T)AnnqGzH(ZcYwwELI3hDYMD8SgxE-*y^)EW+cq@4y-Jgd1Il@60l!fyZUEK8j{r zhK4hrs?@#5byuxEAQZZ9+(Gjffw&+`I8FVP`R)ERmdKp7C!H8Rwm8`kNj;u}+cEWI1Oyb~(V3IG5FU{^aizw=*Fw{ox07;D=Tel`B%JCzZv{suW zWyV$HUCRZC^%Q8yOZ3l~*Xi^eh$(6<#)#Ajt|9)^2TT@Xza-V0Q{?v4n)Fx0E99WU z5+};_dkxH+5YgEPnDeZ9J9HoYLrZ3xsjKo=GtHm1buEbv^)SqA<4R7Lt+sA3Y{^d- zEUkv2sKNSBVX`?w==fdTZs(xnsjFw&a-~*ccLiRx=5(y(d4~)7xYf$PgVS}q&|&$$ zT=p`l#&{)nazf#7Ba*@4h-;}_uxXTXT8FK0+LFb+V_?uxHi%Q(q9mBmF?6`B6(xP^ znDpPysTaSo}6x?)pYN7Y+B9)|p+24bH# zqeg2EmyYN9ZF?otOjimYZE0Ir+@@~yi)Ix{WUg!KR@Ix$YQ}X|J#TK3PCb-Lb!sFQ zuO(CHpX;PJ@5l4D>yEkWtp`sim=B+KuBGZu#;A$8Mo->RE4QA+u&%mZhFm)w^Bf@h zP1*)$^+?_>r==FjwapitEACRO{TT`>Yr8PnXTfP&ZH{Vw?kivw^SsbbI17p^QLnUd z-?eamzBn4JIb>dLIPJTW;4qysf9M>voHm|&7`io81*erM=UML~4g?FMr?s(bpB0m) zI%jA{#VT5?^p7yY<1s!J7;2ge zm>!n8qvqAA@1C@|pWX6ik-j$!%bjOFcJTMIBG|zppdQxRXLP!twDhFY+nU=7PDVB7 z;JH3aQg^+O>K__qUATkCy(MgI`SA+auH#g^_1BwU0KM>Xm!TpeJcFBGjmiqY+F#v;* znzHUW90Y(Z&1oa0te)tH2n; z{qBnPam004wVK`TW^cxvqi{A~p^Z0-UbnZ-YN7f~-v_-?^HpI)vpOo0pxAU$z42S1@L#&MF@&dN# zo262v-E@=`*Yh7zeW_IT(@Q_clZDl0!9|#lMfRuTj+?p1!-LDh|trtxir# z#R8Qg-Yx_C1D4LB5p|c?+hWdE9B!KlgX=N4>-e|kE6;0_hNZVt43SCTPhSyf8QQZblXWA;5s}+vbGVLFJlXAXAw(o9&*pYrIBlv} zwQM!Lqdy^G9;z!FgOOsU`0>saFSs5o=c^^jgfoGB)h?WMHEwJQ`PF%IM7n`ssc@sch|)5EGO(s zm2#&lA&cUg`35=OqG#zpht`EZcOcEPFK|JgW#^XvCI||Tcg~x&z+QI9yc-x zxzvk#`e-Q1>T-F*Pv9Y)Dp}Q=UEvRkE2h#cU>Egx%G}Q7Q%&vQw4S(7)Sy)_aY>#_&dHAYr%Dm%;hEsM&TYFz0qy@?h2=| z^=2R`h5b5EO1#PLRw!fvKGpqX`<0Kdp24*Q<#K?@mnngVwtRRh&k<7Q0&)7l)Bf!9nh)qjQ^WO3S6j&4ZE~66!@z zwU{p7A@cTf@L_rlkl7r1emWg@z+qF(aOfgUb%iJ9ahRw!uG$@qZ}~pHO7qAIR-Khb zb4Q0%EQ_qX}!LsK0d}B%!4({1}ls9pLA-iu@^GmEb7*;N~+Q>F8MmnrCpFJ_6&6`DoIb1D7hub%P zSl)W_3E;dQptQ$iZcK^aLku{6(z1xq-`XN?bG^D9us^iqup;Z-=%cFMVdHv3RN#NLz?=YtPNLQpF1U6o^wDdjtjy<^?l$xa_wF96esM$6M-mq zm)2|>)GCHbleuTp2}C0zy7Sr=v7^$n-GzJ1Lv(|f35&_CNCSn!A(P2mu>z=p3#W=X zoPNdY=8e|vjok)`GJi9h3!WQfK$S@3uG1N2cZWjYasKmjGEcn~XVtSWKWtFpXvTG| zp{OqCNJC0VwZ)^?H7(Y3B6G6?dDr2XW2IR=Zl|PaNVArNoI34YkiI*ruIA<1J)6T zbEWFET$K4R43}r~o6g<#;XAH7#1iS8lkjn5WV!PZjRt0ijbat}Bt$$$;zc9s>N^&* z)q9b7(KLlZl_HNx3i|_3rQC;j^2t%n22f$epDCEY(S4Ok2+EY@R6;vKp~jT|`3|mMMF$a|-|d?U%F+75q@Ib4k+zt=WtOpaFP; zrup?CvHnCB(?7d0CUmP39M`8So}es5vd5}Tth2Kh^(SB}`m2olp;>451R^x8NvF~& zEV*^gu>I?fMuEzsje=?1ZKleti9P!@`uCLWqPnq4_g(JZ5sg}QepJWu^gepq^~eF{ z19y!Em1z}t?h@$+q2(U;fY7hQ6zFW$qVqqeo38QfjwLfYc9xoT(-ON6h8Jx@W*8Mq z9Z%-NG?)*W3+Bs3{0eJa5wI(@_Dx)-&8ISLj$M9jRh`8&U1M0CoL%0EeVfW(EH_z( zN>eD-D0N9e#c4Wbb0L{M(xJpm$>0?J%RssLc7(?hSLlBR<2Ec$Us2p!^Yg>DdH?UM za}Z?CXZvqhF8?@Xa}cIEM`l3MT87!uVUX|fi)Vnvj z^xcRa`cbtuYG}H~Yvbb9*MA{KRl+9Z0(!H-0C7ZDxJKLPt9W@-q-hUIEQWV$_7D=D zyylK%;BSEtF-PX)dE^m>d27{=HVNA0h2T76v(|ZKBis4ryV*5<#;V#o*${+ynXPY{ zucefRO279XP}$LG8k(f~d6DHcso)2ueeNP&VR$d6_0~W@EY`oG-uFV*HV++d=8e!<>I3sL7VVn2O+~bl-t|73qD1Mh~B;N zvtkbu_|W$?M$3>)wd3YN59P^EHM<6$sr=9MEGhA^-H#38l8?+NoqU>5-9=1Uxa^I)@m$JxVQ-z@ zqI_WQ+S60x{6)ge2vgNw`7^8|*F%3+oegiRoqOY>ud#N4MzHEvjLxo6~!mHSioPEZ9G(ta!%#*xN-wv9R`5h!GKA zVS)9N4pncCenX9!B7K9evyr{YrHmcsu_wv4vt&zFHh>!o{_}?$=D%={-#u8z|H4KpbI6)pToArWo*M=zxVb>F|A zDDYrCr0!jrj(p#NF&;_ZdFz`_igIOohu07NOttxlv=Ic*8lZsRbg_MCgeeNP8 zGVl85E4lNL8x{rI)36ABXUCU5yw3Tr@y!IoJFu9=Cw+*6XwSJRPgNdwqY#k6ESed^ zMF0HI>n}y4M(@x?Ck|MZn@Nfmu>x;+ql>+>D=fd-|q7uZLBJ~7)T-r7j1wH*_cjjV(IHWaTfW^@>Hg>P!hPK1Yp#EN zk@)p#3VoM5wOHYv<*&Y#8&vQUq&K97>{>%twQUQjOXT8C4n{@HJbV-kFDm03AIp5j z{<~Q|ZKDuB<8%z2$ei7+_EXkmG0kbp^gn->x2%4$3dT4w#h83_H5{_y`AgTbvrJd~ zx=b5C*!gX7S2B64&#t7}ELQ({~+_SLSRLY3Rs9bfp9`jO^BOB!0a$ zmVUX-@joL3k4{l;v>F{zH|#0BQk8<+^E#<+Y=cQPIa_onYgz$26Axw#k4)*?X}_m3 z<$otkoA67cleyJ~6t5f{No#i#jNs|T6>e;kn~*H%F`R2W&(cPnj**g~7Q|XK7Nfq! z;#xx(7MpB3QgvrDggapGrHA;1IMzrUtnWn@?TSb00D7~bL;sy<562;nySGfYQTBCZTd?Vm&XqdG`Z$HZ^55KR!1TO80Td6Ef+ z_ud*LBx69ix_AvEO%36Oz$y5ZTBUZw8Y5Q0s3~=9K8ymsg@ccZ%l{|si}6O z#4+|S3SUR3ENS;AB~e6|&BP|@Rw$f+cVI{mf^JTU6ubUKg}kZL)>o2{Ou!tA$;CYC z9eiPe8B!vEzwypujevVBo<)BC0n?pYWBB8YReS*wG+`KoKupHysyMsNN#i`$x1#om z_s&I{WrW0PO1k)5g;(vjCu`jYhRJ~l9M2p!Ss zT~>NBO@O!+A+Ml?B|;u}Eg>%-4JCYiRPC)(>F~R zP#gRrvJM$PKfwP+WhMJWq9m8(Yu*m|&c;qd{7NHp3ulF{TCmo-mN;DRB1e^(|I6T| zDO9cImq7>9=ueo<7=i?@@ymX-&*#X(|CpQ6*IR8wFE@LX+Ah;JoS$s>wc<@*x2mZl z9*6a@MPo;XFCGO-zW~H1N@649Ulj6$$u>-%hWn0qoQ)qx_!T$y3&kw5i8>>jO}dE5 z*^%{KcNUhBq71*8j}==t(MWLEna<@-Uh$J+uUj>an^@hQA8SBw4D9sN&DRfA)Khtc zOdUao>bPrtJ;em2tB5F4PtVbf<=7fFiEnz7m3F%TOl22SZ+M`>HO z^9i?WUCPRC!C``$E2Q=>zc;9wu^r#G;C7Ri6W&~X9ejUF<>PbZkS3IcAT zgs2nCa%YLn{<>ee=W_9CShev=l0j8u_5sa;qr^AUWo-Khl8uZs5%YomV+Db$GWnl z&W6O;opA=WJI77IU;o2I9#+UipE$e|y2+eEOBwoWT&_KavHoc6bsMLnP1!KFZ9J?S?cV)E=&! zPCN2oFu6=zLG(_-QiZ1bqiELIJ`WKWt@UsP{N_cBW_3F_IHq)zLriU`HaWEDBd$y! zk9WUI+Jzf0v@QFH<#@zxqUMZN3&W@M7??hW0E(bp2nc7onvx&$YNIGb{TsfcN$N%vUTCDejhrjUT^ZW z!K~_t+vvg3ExpB}qDE45f0Sb?ESbvVa1mvW|KK4s|Rt- z9c_%-&yb^PHMpa&ByCKU9c0e_yI)?5|7*W2&W>c|;1nFua>(e~f*~4|gS#>-8r_?Y zgf***EjFLawH@uyrCAZ-^CBuA-^~~J#ATxrw}*h|EO7K|UaU2LMXM)snkjvIS)6EN z6?ckfBqYAqhA&p6#WgM26qmumC5K&Nd__Y-te;tkoAspHiC^%fJ$oJ&;0Z1_L*4d^ z*Hh**F6)Jt-!$hiCO%Z10U~QE-#(!Fp|c62K{t2AWU=JBaF`>q5_X45{Svh9a=X-5 zzFk-jC$3K+j+k}(^^ff`RCw&}+EZH?T+nbFE+;lZ9^>VI~m#S~OZjjtkOBvc%e z8;owZRo}ra)QXjr+#{@tjBwgsqEas>#wu?0)is)}SlNUEbRwO9)WaULZpj)1SBuVE z`c75I8LaQF061tl*vF?wvRJ-ueSn&SK|HpGwpR4F7PpyA8Dwe?SPi0rfVFk{u#na%32mD4L) z5^td`)Sa-8HS*U*Z007n*#s@@+oCFz%2;0b8k0Ha(N0yH-#hY9Fj_1G%k9#V8g8E~ zc-HfUr~p2j$LZ{1TJ;YX6dZ+Sj?iK$5bG@3ko1q%c>))t$g<*%}p#xmuA69{1`ZPuMdx4Qs@_rHl{ zquu-!noQxa>tmaoo@*}AY$Y)|n`CROo1$uS{7A9;&>N^vq%}U%WK*-pvS@Gm9p;vk zIseTr|8~tIyFCp>C&s(IDw{hkC1q~#$sfL@oMACt&AASbAf?gZCnH3gg#9TliRUa& zc!nOrW&RY|gmF92*+NwgJpr8663<0Da*7)+h&Z$L=5^U-L?&#bdKHasEOo1BGk{4l zzB>{cR<&Gcbsg?0Ic~a8s`0SpjR>(>V6p@rIDaE7MF+b8ASI8nBQu3 zrcd0V(5Vr8x6xt>$J;k9CJq;lo!}5Kx$n+GI5@6w&Bm(rlS0*-t`1oBwv_I^6@M!d zTK4~8tUQ-3aSSEVBbiv?+{+y_c`DqWWOe{XoFlL`h24~Q*hOMQt@-4_FRpBUs=#$M z1X$M1ag#I|=eSruOhSbvd<~RTZ>_Lj)qc%4c4Dw4D;7OAEff$3XE1BNGT$mzCO9~& zgMoPZDHk4xS-X8~{O!UUF~#cx9+a5DdZ?mY|N zAt?df$>jqWv!&WR!NrjxRx`2wA=2+CsPmU)hI#kP(Nt4TMOW$-L%}XrSQE_>q$J*m zN*Ybp95(Lvsr(}Q4ZWjk2TNJ2ffZ3m2YxJwC-jgGMnWdnzTb+MmuhCe^OKI|Z6_u= z?!lBTOH?@Vf75hYzTz@(yh>~`V@3uQtnCYnd|`8+3Q@vgm%you5L@A}elSc-IeUf0 ziR~A5gU1aHK`=2;ad>L(9#jrRHl$_9sy6GYoW{apG9O-|)oAKMF&I)8&)_NM=n{yh zLY}X*eLl{Hd(EwLcCp2o1wxzsZO@to6|k5Zu+#Kl{X=LpQ->ASet%(@+F?MGXfm~; zU353->B;JqP5z^CoU14{Q{8Q7<6p|wa>r-k@;MoG>KkqYo8e(Uw$$f;a4k3Pa?uZt zkc>gMc8@;MZl%O$vs2vE#C29P8w&PGH8^xOoqkF0-sZ{0SzhANr$)YGMEifZI?I4I z)^F>d8WeAFDW#MGr8vPIifeIq2u^U9ws^7P4#g!vaEIXT?(Xgq?45JZz2|@Ln@@Zo zVVKD?v-e)>x1LYN_X_oBwwbHWCS?|UKA=; z9JLzdm9Aiz+ew;JbjuQRS}A+lBX-f$cESq>`Z%~6TeY(in~gu7P3CxVIvu%(u+c;<$|QdKpb?>0yOe85 zCTzz;>2aDgC_C?@(`4cTJf99wpzwMQt`}UQat-oY&F<2H3|`Y#Gr_*-c8_PN3hTMo z2RsLJ#m1;wRr}3Wli)z{bo&j_lVGk`T{eO@ zP*FR5JhNPI{oyJA@H6GD?9n&OUGKncC&jYbA*U9!99CZ|fg44#KOwK7%=UXP1|4|V ztYyuy^Uhp_DO`wS4I6YG>VVHc%Is{Yt%#(88BuLEizs9xA?0;v;HOD0UDwh!jI*br z$g}N8C~$S%om-41ut9&%XMR#k<5Gc2=S{zSlv?3=m=|jalz^o-3THofNm!OlZ4tdK z+Tu*jBk8N-44bb^j~ZFM$Lm13w!d-@ho|DSzi8TZViQcMJRqcB0hO@2-TjelRwFgz z|8&XTPyaUb*SCCbiVv`b!4h;|JcF&*7N4Cj{jJGjp>wse+rXW5d9Ww%U7{37(PULO zNqhC6r)CfeaUcHTND6ng>}%X~N~$iHu5`+ZJCxk#usm0omBKL{I1gwSOU~=rO|P=$ z+QiVR+@GlMx%U3LbX#k+OrBL9rdmN;>fB#at>YdGQ_T~5$aSS=KmGmEy* zZvJZC@n|u_7G7WJmD-7*E^wU@inHC9VZRd?ZOhagwSbIe6c z4s(peo)!h1OL;GJ^T%^-b;>B}CXnWG( zZB?`a6$Y02(#1aj?a!?TE{TP`J~6foUQIuJ&#SSr6`vgB~-{Ss%i zIJF4WPeqCi1{Kw*!B2Uc&~k=&2xaMr*7du>#r#)L0n63C7v00dTJ`v9HHUms`Rhs! zc|#hCS>ETl*7bs(M|@@z8PNn9KOd-vTn<2HBQw1~zp9%@M){S$*2fdS5|=TIc69#$4sW(AC%ku-F6qHrYimnc6qad{Pv z6eI}dXw?cnwu`(IYI?V9CNG^k@MlK3Lg@uFs~gM27;RIFm(f|52}@$JtP6_PKlTEHn>6E%o{_e!jc~Z^+5qjh}wJm~yuA zQ()ZD^pSeidO-=s_E@#vAYU@+3XA->BJW&|mAry_h$kSz=dt`dzh1p=^N4A@PrK)M z0lE_dbTna+>J|ijKAoq-$JHb0lv}M4G7u>+QWhpA*$6z*>J~uI-GDDhigc?c$>T?h zF)Q9>OStfnZSvv&=QH)B+~oi6>AkYx(NC+f_gUSrgHo8uzy%zbERykb$!uE^?c(9A z2A&Tac^yv(aOykZYm$zLSlHR4V6ao4=`w#glfF^9fBWHoO3rULP2c|Od4AU=#jmXY zu%#SDQ~0wv&7w#=h}~;yIptbp#Xz}%y{m1#Gl7UNCGvLZ?~hM=OD2am1{nzS6k8c? zP-r4a&w&fTyza>VbF9<}#T$6giH(NBJiI3A~&Cc)RasT;$?oJZoWsJlgrtyqu z8Ij&@;HfKW};IN2mLs)%WjV|1CS91$Q~tdvzwAL%)?HlGl$Vde_NI;!;R%kvl`g z2E-pi>;8|lKt7sq9XYp*;v+8g*j(Yxsf_%u^&HS-yl@pyPLTe~eV*bSal@l{M%jv< z6|H>hk>T(AKi%)&SHoM6PBr;jFnAn-Ik|Z(*XsjfV*K|i0rNmOqqo2t$|qZq<}Ka- zqxJazw+LhO+ZzJ>g5aAM|KHp6T>WA^9c`9V&~MvwnDs#a4i|xQx2h)`lN*(CeWtal zpm2u1GtOE;odCJSooN&cOlMu*1I=9O4Kucm#4E##j|u)g*}@qoW%_As2@o{A8Oax~ zbPOEYCE&HdN#Okww=>J}tP{?EvcrPm_JV|nzm;U3HofsB?9To5m$Id} zOb~k2o}z!aGCc;V`LLmaG|F2BbEW@WwkOnkyT{b~8pSiI1u!A$E)ov{V>WlfsF%qL z=VL&mv(%+f=${m_%-^xZ%Jh>#J7Q8Xn1ND~V~Sk99<1#jR0?iYC#W!N)nlWDevV-y z_pGB-T`1ZJ=KPop%4U@tVCcYf+XPkl;H=Su+MeM*mrua7{4u|Gi7T2^@Mg5!cp2`8 zpZ;Dl6uR=pLb0dzB{k*nPZCO_e8shh^u4GrRf7LH?KjiepWQk#N;b8Vw$S%cF-~(g zY-F;V`_ z*(_N^z7usiJ`H^eP&cAuK`)kyau_rw3@QphRF{q>1CkK#S{e7?|szL59( zC*6e`?Rt3|cutfNwM}UWRZdUAq=9nFGD8YuM?69ES=*3zoKCkRiBPpQ#d0)Kd|1~G z5fb$1JKtF#LQmGNcjbcMqv~R-b_F#9#qq=@PeVj%UD|Iq4(Nx55ugJjB5mbOesp=P zQ+3H5HE`Swsa!wlwYb!}KdMukb0V{)WouYIL4muk&0_VbE_$qK<7Y0emEW=*7)4KP zpc_y(wK#9u?5%>-YRI_lXep=Hrfoi%T$6A$+b@E@cFFVE?K&s5W)8QNz+XMYUNoF~ zpEvms-?F}(OF;ifbSiT{eaNZaVBWC3bfe#r-#d+6{t@==W*j5m?4|R~aMrzv@rM9* zQC%OQ-yl}ZqDAjN!o^*O?wIOTZt}v_KSVo*cQi{;C1?FjOS%CU%F#-qbd8d|Mr+{U z(b5G>{8BOIU+sI>>wh>I@4`okNAdg(HtWpBKtD_#f8ggliO=6aVDNKq}ov;7OodP zmubFYk5{|#eQMB(rfM!k(0kL*7s0y}HZbx?ih(w*{MWmJSKzS$ zVGny<^2T@RhFJb+I*+0EA3Z@0&*`3>ZbYe24EaUk@p^2k!hW=)7@a%osK16%cYG}0 zTp$noKK{Kw8O2;C?3OBfdkosMOFfL8??2@d!l!?^57~vf+$5qIf821OU%Ekm5f99- z{_^kpw2jY9V5*MAIG#=9MR9%NMTGtDqesBzk(9>mEMJ6`t4ddv0%W>d-{+L13K_9~ z3J#HQ>BIUixs?9bUr!g3B0|ck&11E)YRV4_Ci^%nVV?(tKN)89zaM!gBZ4FFH-GGNe;^H$O=Cum6!2(` zQd{!ez8pJt*_m_b=_zaPmic46lW&Iyo&569O08lsb;x5zh`&Xz``DUiqUW9E2)#-z zyMiv?XE^&(0n;*G&o!BG)x$K8+e_UCWa?}%=6mKX7a#Xrx%OOOzR%~q)n>X$D{wl1 z1`LNX29MJ{uNEWvWK!86hq>1D^GF6NhY!|Uzd64G^a#Qa-w(Kue?=QH}_#YeZ z$k+5l6iYQEVi zxm97~-!~~Z0Wzg>eWh%JZXH4D(XUc`*I=q^HIw-jzG}3@sC2sQ^Uz?bNAs|-pTl!a z9Ai>G241}KVvK#1Doa95H)V+!&9-{>n_*z%ur=d*wK9wH;+q5wTHJ=r; z)GX=U!XTK_jxSl{by#IdVYfW0U~E29NGz9DEz&JD<~pZWE7-f3J%24BEX6$p^0%nk zFJ7pva~=o7-4KaszJUqa?~4xkyvsH27;*$?Lh9vu=|4Rtijnlk#6eP-eQtr-c+>eR zb#(3!OM>-5EI`gQJsgS07EULzc*%uSlP*2&RHz>Ekn-7GwM~*xh{+2=d`?cc0eoX` zCWo51!Mzy4b4`ls*Y2XkGFN$gw)}M7plZ!yy->YBw1{iCb{3$XyL`VYuVOhhTWxvV zC@PIYCnuN4oa`?lGpJ8$=RK2OcIiy4 z=l&Yz({3@807}mkmxr9Lg*FvecoyuM<<43b zX`)ZQS3Ov}@x0AUt=mO{ zUCy!_Ol)v&omwUduCGwF$EN4K$#$S!@9DH#j+gF<(6~j7CF~)4tpm41^Bv~Bv{suU z1is>FrRZjLDtt4haM;+GEv(uj_iAw7FSEMsGiVoYzCt92mb><{Y@&}Ra#>=IN=V8c zPt?&;Oj%C2_APKtlCa;bgp`Bu=?5z27LuG-CU(DE?!on{wc&5G)&R8iic8cv#?$?W z$zFO;f0^j~qlK#NjRFS% z2iX~SSxJU8%~xr`9JU#^H;9D|1`VBbo185V>t$0LE?ieT)u777Zd(VPC^&hKr@?ua zlO+w#i%9YF$$I(=HBT!SL={VJ*AMZ!-cC~ob$P=nB%EfiSNE2(rhAo4v7;4(+-4d3 zK(Z`6&PPj4ret0b@A$lL``APjrKA0yCo68Fp zv5QB}_8n2?5R@Sf&KYgj+vNpd%b5?SAvFg;1Qqg(cR&vW=fl?V+Y^O7ANK!v@q9WO z#d|%x(WREQrenT~d$;q3aL_Mvdv~=V(etpG&tovl$3B{XWhS#~8W|maEmY1rTxbu9 z6$?PMOe@Sf4g%nicu)Mz_=G}vPpXdEz+dJfT^*qin0_uW?4s)}`L1-pgDhU7+2Wzsf#B|f>}<^v zqFSQru~$@Au}yC?Te7|nX;OpPRosTe)d1X{kI!{pUYbvV+Om+eYDw$RIAh~N!}7|_ zM&&4gksOmfiok%yYqVMyuLo6Z8Y&%KufN&}sq(qIezKV_*uT_rDR{^fp40<~lhlUG zr83i}w5C9QM!j9Q_wD|(uK{|suGXDNmt@`-vwz=on~kR3LgKEDKqr?q%hnUMoufFW z@@Wkdf6V)r`A`3@cOZ+hL(I6cDeU|HYRjI7hu3i>nt`Dl8mZvGK=YF2@^zr1@Hwrj z;db8Va&DX8#z?+LaQNKcoZH_Fd-lf^-vITNTpBwM?Xv43*mEB ziSh2%@)$l{_4GZsVtc}J^laM4eXl@GcOPWc5!L}rFw7iX6>fqx0%k*08}C-BX38ayjCW2ukRug~jI% zP7pc7muNPCAL6_MBXnv#jkX&7hv63p$m7kYDbI|PjI6vbD$v^nY1kDR?*_029S9iQ zj~^mVeRfI}(BkO4E~{z^C-U7Mx=7=P1stXtIi%p{6XV12P;D>3p9KtpbMSmx`EOx& zZTGN+)qgwmlkRS^ZI83hwvL?7-)CTg!oufi>iVaSIUU%5%7U5u=R{P-vqZvYWH}aM zsEi9T!cSye9)oM+K@(oFo^p}r1Cu;19wx(43v2-TU}?dwV(QA<P&+zb09rU;)67+EK&h^y?Q4${@EQz(6wjs`r2Wwl3K~=wW__CMOv^vl`+1$7vdTd zOn6XaE*xOKbcT_xR;W;{+nxhuPl0>yU-(&D;Zr0Z$zV%Wh0%!@& z8G>LUkxvGNMtujBVpm~n)}P^Q592nl$5leQJ|F%&a6=(BzW|x$_M^+|3VfFlvvb@z zZNR^9gp#21%s4@3+^2DIW721tVLBY!VVlRd;I>*hi&SzeXd;P1;3UoHd{g5=1OMTA zChCkH2nNXO`orHRxhrj*JDX~B1=hM8zKxzX0d{Rot$wc7^L9+a+#JIkN&Gd>#`!x0 zWQ&?W9VCmW$%>wSu{MEcA1NIXJD4Xw{&r+NI?AY*mAgE&WP(>Zx7GYpsA|BJ&s3VS ziE>)uL67{DQN>8Hj}b3@uozVt>dxbeR={YYVJWltJqLID0LS8rKE72gYqT$~*g#ro ziC-ALA>l13@Hc`4`C&6bSUznQ8Lf!i^jkx0jDXu!IncsXYG1l1U%wlws0AcDrSo6* zgGJ^{fS;1V@psLmJ=V0EwbwWl;w|4#2`+fDpiU!%zg$?D`=_yH&0~+Tgm|j|kuB^^Js#N+ zO=F*p6I2ic)mIt&M(e6Gxv|oX1eBG^CnZ?6V_Gu}xs#-Rw)S%w*%-4QFoQfCmyDyP zyjGT=Vj~MHh93!9yJv*Z>@ecz!;oxW)_tP4^;f9Q*1(5Qo$;T6oLF1Zh2a6z13ek$ zu0h)+Q}PJzv0HJA2vnf7FkAX69jRF*vTsg-&ycizkv+%fV~+*r*7+YXjf~pT7QVZv5b-)%o0o| z1#ImYjgtNY1;9NrH>#dP!KI?CjD<@9s;Kz&!biVLf(!&rKeq{fL-Qm1utkPPIsBcI z^w!c@`S)X)?WOs~a}lSF_EiDgVnq7pa`KkOuW`?c>}3Y}(jC1PSBQnk#=O^cE>_Le zPM$yJgZP^xS+f5{(OmFkV--XJ5j|vq6I%LL1nRzG&_@(UKgA!fGB((FnwIomixvmD zV_A@oA@{nTe5Sc&lH%95uMLxP$-u!lrYq&{Avt95ZNDVQ{pDY+E`}PcLr0@bS1yG( zR18@(b-wxg&+VVeqS4z#PkKQRC%XSZhL*{_Bw~RvDndOw=vzg*k)6BbW#giWlly@U zCQ*B;}Oqj=5l9c1Mehd^=K>Y$?|#2 zP4rN+uqc%Le*q<6&$|DLWLp1S*l^PyBV0q4Dfy7G#<3lXKfU~mVe8=(IHURN0&n1< zuN;(LHU9?NxuemQctRiV47k{LhNp=95YrLj-plg;kwyI5;4%0<&0H}M%>Bxjm(tM3 z92YZ1mp?bheH6!&fj=V|OMK9q8*~GsrUgC&8w_+Al-KT~SopKYx9&~)$nc+4>_w76 zX&=M5Z^^lV(|2!I+Oic9mFFdM=wc}G^lF^ZO}_Y_{&v+1*cqn3O3d4WukE>Ieha=} zbbYh(*<0o(SDITmex?se#NR$v1xh`-t;1)RJm-;uP|z|~TU1`lar*Mo(>u#=3K~5X zfp||==g^7k1uU_LKz!*N94D&fjM$5ePeyc}@Q(BZ-@9u$whj(cnQJ(g(Z{QYGaeZ( z;(SO?!qIY~)##2h5III5l&p(XWTWQ8MB}6Lxw+0GN>v=c!oX1?SNdfYY zs+a%twzj0h=;p8cMH)A-s$wqz_mi`fE-9JM2Qkd7%9tb+xZR}o9M)_LzRCOC`%YG)wuU<@L6ADsBO zoU;5y#OKu$JV#)U?{;mwG1Gl6ekC2cqQ=^|rWWHV`787v{qctWA7lGs)&>P+G=_8j z!70YG;}NUxZ@{LL^t{MB!SWQKiaZL2ssuh93Uv~8XT~#!9zJ@3z?=r?Ms1gW!%5~ZRMKg3d+*k`{8Tm6lYBBt;C!j3 zd8=2gUJ^fYuTas4<4d_Wto9g<|IcW;kx{hQN1UnRj>fHqySKo1PEWiSsFAccxQbH=-&gkj^jL6b0 zT;Dx|c6^Ny)$HZ;%Ihu7#zZRWD*SY?y?-wdmXy>)98V-BUf-H#dO13pTVtx?iMy4+ zrwV^ma^6rnFUB2H5TMX(6r;Ap|L`?@Y;#IBjxWu>iU$mR zab)JEV0p{N+FU?HQ$yo-1Mo~;I6ZIF`Q3J%v!-+1dfn9EF`Yy--x^ETy3tr{`CB$LFHP+^d}5SyK1vR*rt7~qGu z17Lwi^-nM?`8jGN4hE z;iv1iWs?S(&*7ABYSPH=u8f3kp$*)uaC=7uk$e)uojyH+sjnNp5=JF3%{df8ciw63Ud~Vi*m@?rM8Y z#CO(eo2I6A#C!8^KBTPSAU;^?} zlQt>mRWo0oQXE_Ya-TB3(pDm&hT1^+=%jT2YrU>=WH(a(%_bVgc>d^&R@zWT{ZiLb zy}42#gahW-AG@~K=Fa0I2y`<23_x_~-|DA{rbd*tGhs1=e<+0a+ln`qzIIm~bD2#? zR!n?Zw87f59>GGiGG`_dz5dafSY??`KHRKW?*J1Lm(yccZ=z}tfc5x;G>}LTt${X` z?vls3n<}trtMihtOSYWzW_cLMj(r9ea;uFwmVu#Zo`|txfQ&joEwC5GtPSm{1^$-B%PE95W3khlc{5^+wdwTAMydG>+>9`6rck_wbBh=ar`98Gy)yL zlj#$?+7VcnfAQ&MVkeZH4Ki)L9{z$IqCVKOHK}ZiJ$8=bPpi(WWGdM15HM8nr{%3E zCQ@6D-vF>rci;sn`_+9|L#SctT@17bJN8Q;fDCblf^fgEaO0my4f=y|S>EhMO(xGf z?^akJD~L_N4O-XAYC{&Y@Ua|ZF!3bM3K#Z9tB<(G%D+aiCA)YC8@QJRUHlX&_kbHv zbjiaLf3Knh+C_ZdP}deyYr&rYg6*0gw0}5eu|azbFwCxgtFD}key~BCZCtnuqqrDSR##V%c@>0RF9&bmBULn4@MSV=FnzdTr`kvXJ%k zMdQc5S$!fZt>#6`EAv?}wZQ~OvKkgkcb$#NkNC^UF;^4uwar_-Ah}L@q9>`2e+ty=89HK`puJ7zrz_eg|`x7Pxa( z+I>>dcyIKvB`z)~* zSHzt5GcyGTS9tq16@pfyfRol+xmqf{HOo!rRNH!_@!>!e`gxmNqfTzT&eCOZ$O#vz z3jO^J7z;FLsy5?@HJgtV5vRQ)?_y#8{?M`BVem9NF&Q>6Pg-;4x)s;oHE9aUv*HnO zn@?mj#VNrLPkWr-L!g zwvV!hb((T)&cnZU$qE3_Ed3w5N>S`Ql7l^2Udolxmd^&CP77%50MMmiws!EsA9|F% zNl@?PCi5Z&q$9x`9?<=qsFKfrznX026Svn@)M@m#K{rVCs&<4{Nw z;_OI@3R zBirHfU6J7>(%>?^QifgfP&cEtIK8cmIQuxMXzONI@m-J%z}Gcgzi*3KzRQ2N3yd7m zP<0s6#kg(84p3G0;$Yf=G5To@#NFIqFnXC&2f{i+frm2Ydk~Sy4!S=uZxzIzFrUj+ z*q7V1oPeoASEH)5c7A38=HD=ItOZBmZ2l%1q**|J!;jXE=B5Sr8;`P=La|M;`(Sd_ z-a?_yHUA5-qXm!9%^tRy-cp%MlA40~QkDMdMSOa#Vd0m*Kiio%-9_ZRS() zy@X`5$UJ1q#%7}W93U;V$@v=Tp6&a;Y9!`zPU0X0AdF$X=Jr}V=#){;6&e5fMF7pG zZwGM~2f{zQ!VTw*x02SQ%Y*5|F^Jil6)LU{n5!|~BZLt!J?*AMR@owmu50Kt}>#}B2P56E;3W=LiC(EvgohqRlbb@dHU0>aW&t1VKS zx`(L1L=4N4@40RE0ISEaPJ}o&5RaPv#d+uiWn6ugq&ksg7ZoW4S=b&6>{I(`TM_VBERLT%FXyjrA0FuI!j_PPd8mJIO-m!g};J z9ry)Mj-SOy^wJxv6)jZaU_{h>?UFP2=mI*U$vbUc-*y%GR-!u;)VQ#&%J>`raWeq_ zI*uv*#mftluzC9Arw8Fxty6QW^X|W?HyEV#D(;+|x{AbYBUc`jRzJ8u#vH1trE_T41WxOg%FHKn+Aqc`B$wDo zpS`0Qp*m{jbla{o+Pz{;kF%I&p@6^CQqR_~LL7I;+>>ekcVi{=4|5{*#jWD24@p=> zF7uhUM+x6=lhZ9OHtBC)qvca7@>Qd&y#gZmyx88;_*O z8q7ouH8GLL4?Qp^A!8N*>c+7aRd?ZEWdh|;Ezt1Utf!aLt9|;dAgfs|;Cg_bnKXB< zW^+Zv*(g2ys0N`-;dRL|X#i5Q(EIxsGyC>XxPB4`K3+U02{f+|UzhRZXm4SzZ^?x} zIa4r0zYafpAtqN3M6PE0tW24fdxYT=Fmu^m+1D(+AfVT?y!KmoW_=Q5XU%iT>2T`q z{G;yp&s)IZV8GdEy<9w8yXydelx1;7<+2G}kd~7&0Gl0`?^0F!(HUzxx;(w;aH0GF zw#H21&4d5gMU&SntrY5a24>(JQQ-imd-X!RUj+v8>C}|^$UiSDN2Y0V8DPB$ogij* zwimXjZYK%YuQ@0jFXf_1103R6R4Yu;CJ6>c)EqYB%nbA-z8X}P0H&&rlIR9x?2>ZZ zoDF7Qcy$j~9*sF%#3TYJYnKTg030g7MdwGO0nsLHqv$8Con*z^dHjG)U6z9bY6c=q!sBx23i&5N9qE#UmSv3M;*m9ib0H*HLXRDD?T_0xnTczcLil0A?8bIZ?Uo~w*I%HET%(gN& z2>=HuuVbTg7Jitf3n8oheN_WZvI{98yLVr6R-T&Gf+`|wc-m?)XDL>NtdYaxCqQmm zx9{N~e-toWt90w1R&R7qUKE$B-kpOUuS61*EPc@hAa|FkXmySVJA=mQ0Eqq0{K(avxgPgcQ+3 z*MheA+(mCujQ;g=#BY83?m^ws&{cI22$L}@4;HDwJg@^$Q=pvdSMqyuDk^AlQ>)EI z0IRmeL?b;%IU}y&czM`v|ATbx6)FEMkVI=m!b@FBQgi6N-98*-Ar$E=fjyISnN(Ue zLt<57$Y=biY>+7dK)pQL&CZz`fXa{EeBONZm(z|lyV$sMDnaqm z%4?)LwAZ8#)5jvocNU)ZfJto5dEX1rLy-=jc|DDTpMooZ9Ae!%^M=JdA4NX4?u3Nc z;RopfN$P=w`An~Aoj~~o8Hsi0l_?{=x)%sg>*n;#7vAs${&LOjG7+bo%*(dI5K2_uPKqoH>XrDUl*db>B&zhAK& zV<5zIbdx7|5rMIF1mMr)JYVSJUtuZ@oxg;AQHJ%`mr?@}$J|~+nG;1nvo99#t$8BS zS!n6!TON8cPxOrwhjf}XjHd-^nT;1h4WhS!Ad=pJicyjQ#!4Uv)1SRMWgL5?TwC*} zY=iorL4hbvx8c-i|BUR?>dSyT+uUltrDd3ngAV&{2vm8=f6 zExCA_ZCxK9YIvm{vFQKt$lZMS74>u!q;M8+_kc=jUO)P)G*o^#k<*gD+a&vy`*$Ta zL*HnIwQQ{?ayDZ2igTkD7gJOL*WPbNVu?|terj(Mf`dXjgQ@K?j37(=dO6!vYbTL zbpEN5f}UAG1C53RCMIm>%|u&qLqSTO!mHnN1C7AXm>)vlChiO)$!huNX3Vu17=3fh zC-9x^RS&|zB^~_zH6>#AXNzEO)_BRHTt^Q7i$Drug|kqV9Pq=h$-O@XoH8IoteB}< z8szY_EyA$vAQh`IulXb2&qSY)Ey!{J8XTJyk4Wyemka5lJ$0f;s)|G=feY(d#K{NI ziPlcqDQ5gLLLMpBFG@<_A-x(m({uLJ!YPZ9I&p#UWA|pcEM_IsMY;a+z{;YJBo}6L zgE66C(gtTT)`PaghJJP%>yi40TdmV0Th8U9uI3W?E}5SI3SIAdh?x{NlA%DWTs%1O z8u!_!>er%M;f6xAnd5}StAng4a>viwm+oqTQlyud-EzEKhoA!;W6EYui2PT0PoDAC zIJR3ri6Cm`kvb39kL~I$%L`Ff{T;InG z)wzpc`G^+i;plSfwA=4Y%Iy7x8*Y~z9>ih8?C~KbPOm5PkHYFMEl1=-G?-Bz^5+H6 zd;eL)i7FP-Cac1yl2=e=Oo6q>uMmt^7k$wdY`NgaAxJ zoc%?=4#JmZAz%Q&^t)dAjGUAK8QN+gn02OM_|!V;r(9_9JTF>1LK~6j=fl#O<0ZB< zQv4#dLU-)qGnO#eYf9ogF6i~LY+$VvuAXHmjLSjY2Q!i&!brEWL3I|J&mt_wvb_~y zuw}_L_G1p$PszV%*15v!7-u%<_!{1BqYMF0ryz2do$OtQIukSBngd#!rJj8XS`A`4 z&PH;EVcmKmeH7ebqL0;Px0>L-tY8dZp`PZS9nqbc82c=ik7G9*GHpW)COC!H8|Hs_ z-b}fEK27N`P0Ohr)Wk6rGkseYonl1H<+R!&>42FEPc;H05UPfFYQ;#cCwb*3vnJ67 zU=JufGY2fH@MX6pFc{AcL0ryXnNu-#j?v?1t zjLS##rL`9@*~uq4{;MbReP zLcznm71IG>Niw&^H;$+^2b}7~s_T!w-P-leYF@kv?2a`Jmq*2OPU)=H-r$niJ@l|t zPN?T5H@ZPJGSJ6N)q6!G+nKvWI{^Jl|K{pC!9|7rx2FWl=H6gZq)rEuUq>X>2iEgt z(*v()ZSst_wfK?zZ* z_^2sR8=e|vSxUz1ZqpMKoZ5h;pEPYldA$Rw{2Jfv*T439t?rR}+*vP@qv(-!j(Fth zBVu8&fiEz0kJ)vjc;aB*oa;d>{FqyR28g-Bb_kW6?bmf$s;4+bG z$QT7p_D!}&Z7QK_ZLvHe&yA>=YDt;FUy#-*C)mxGo~coM$Kb51U06d2Ic|q7R@Zn( ztJ?2DNt*=~Jx!Mgro+={^@C+os!r^3I!PtTczmj)mx0AFbQw4vNHPDV3e>2#Dm84d(7=S_eT_EwN zSK!M-z@+$>wE5i;#SaN219u;|u951;D8f3U;Yjy%)~{*InJI4!n?UQzj-$6{&S)w=gZBSK~ zVu*$Du1fKWN1OWYM{S0Ynw^`euK*|MO!w%4V+8zEYyJJZRJIX=IyID4O*U(KQz%P&TGe}oK9+I zp)LzwnCIKpt{E3H{3zZ8_~F=7`D8Anz7cTD3uf$P6!3;zl|Z-qg*WXEJw;tFcagWl zPLUO?AsKkY@Pa=#xgcu^^MF$Dm;l)1T&(HssnyRp*a+%>zlMDc&tPuM<=irlM8nb4 zn^Wl{D}gG`WdDz)lI}I8)ww=bdZQl2s^S@)< zyT0sv$%$GECz$D< zS|{%EZ~?OI(!UE;H^6X8^ADH~EPf8uC9FCpBiLVY)YC&2 z9r#L3DQ2~~US*5`*=OC>)1WnJ2<;)Dx9m>9|7A14BPCP+2^VQfgoFvM8y<84 zWFm}z|EzPVv*ScrtWAzX%Kgh>vm;*-QbRSt?{T1-I(MmHwIDpch19#JuyFV2xzNtsiZ}J5~6MD9_gJ7(NUFCC|aBaIPp!4Lhu{=Qxa>JbuoZJ?5)v zUGkR@)a=MS2fJ_#b*w%R6&rWun34If6xju;+W+Xt>RL+HvBLGt>kUT()1_``T})PrV5W5(@)qg3!kV4T}+gT4YpSr41% zxDx}F(T{Ptf{Ia zKp1O&Az;SiEmnTlFYm2#3wJ~u6`NO1w`n!>Ew34^oTpvP!)z1|&e2j}1U%kQy*$H66M*!Hy&}rQe;%XChBnn7us5#24Hc zv*A+ab&3Y~=t^7$*;<>20uA|{BboXPsdjN}d4f58W4B$U?8s&Ag(0sf@b zV^rnRpRl+rUaLC_to0Yd*X6k@3X82uW7AS3LiYWmOnUC{Kz14y(+}sMa7=}4<<8SB znf4*h{dl-lGgn64wjU?il#pOqXuVa01?Hn?11(G_Q!Hf1{#EAqbuD5c%410DxFj1S z4_7>F+LPL__^z{w45j3Qp>!A~_=-lIL2%c!@2^S~N9ma+=k+tJhTP|)zr&YW-NuL* zXsiFQa*!eB@noQMO*QXMmqY(f*hCvnmK6~$3YBp-n4KvC6+EK2mEi)K z{;C!^i`D>M@;@u|ud@8dS7ylv2CCdoeor|PHH*OR=*`W+RxF2ceDtn!yMMV5rJod8 z9^aEy{14LTvr%2HG{AF%|J4XxOZy>jV#C~U?OB^Vi0`ZYlz$PMncf8zSDt;j8#`oi zlEcm(NG#%`XdOVa8F{*w`ZJ>}7!j=*pm|fS2x}yS_@yup&ZJ?$Xo*eZCQ~UwL)*6} z1tp<^MkJt`mRceP179{~r)~I;E!&cqJK4>hrO7^9k@`$I0Th<1G@PuN`<(>yylN<} zRSEeG>vixdsos~yK{#p2JIlo{W(g^>36Qff*%Nmc)42`dmG3gwtB|QJiGGQo;_Iem z{JwKas^+IKM|pa*c*wa5!mr4nJ_}yTV1MPf(3ELrvAB~d)53&m+^=CXkgU7|auH5) z&~h{)XmZNYbdnQ{`@_;*tjugtW#$Yi3951~qa%e;2QTp_2=9+_F+gaeU#Va6Gd-tl z*NCOBOf&FbeHdl}J}{X>xhPuvOb8l7y6;SyZZ<73Y&a#xY!p9d@(>R!J7J1+cwtm0 z3!3*)5K*fH@=YDX2FetK7@CH*w62Y{BBs5yC?oE8x5H9^pS*cYS<;6HdwKP8EO7Z|JKxrlXYePWg`ib|Aj<`Dvr?;V)d7h2;`wXobJTAA1dSbd;0StRB zy7A3Z(fnRX8k*N4ArsMdn1!&5dLmg2XurtIrEUjSD4X08(b#NSiN}*IfKE6}r7)bS z#r(%6Jtu>1SD{L!A~n-Sj0H|PtaQqBV?zj2hREPB;3p5u&jw96;jJX37g!^B*{M4|6)Q<+z3^%lp&X5t@2a_T% z_?)2suHLbHq-3qBWdGLa#EyCIo1ITeS|m&6c!D4PGJ9XOp2CKI$EJ%L+;V;4G@M11 zZWGmEiyyV8W?EZmxgEZLHK)?zNFvqz$`(OtbWdf&rLO!`-Mtfu-oZ8*$euyE@)>e% z=PG#=1R51UMXYtq-ezd~`&Nrtwj2oI#OWUx@RW)&ix;64QpA&o8`OxBG>ik~5u4y8 z9*<>1vgm@!Z64LqL}lTIZX3gC63?6^L0=En^gK;rIu;u(OJ_x2MP-wdIy&ahrLdzg)fT-M*q8 zz`qehluoCk`QP$k#7Oqfk^4(Fv^T(99d5GYlKN67--%Bi@AXp0Op9d091Ebyuy|xY zIkz<4Y4>ka+HwAjjFHzo8xmMJj1$T8^f6o(%@DG-^!^E%C&b)5pBmAAkF>F*S-fh4 z<$>}{{s3>!RC_qs;@eX)!O7rP5gy!$MxXLz+eD!m57d>C=BE+yi!%7!^O;yIw@LPl zB{%kYczICf)De`}7+jdLNF~kv?+k&D$UfX5m zamXhhQr=+pUwZon78P?&P~?am)%~3iAueOqC~Ww?h`L#$ye5B)?Em`)|9#!gf{4@U zQ#{p6Dv%xK`bGJRlD@h*bi_p_zI*S>Gyk45o6^tQ|JxG(+ZaK;TrheVX6%LqC3|wR zFU2g+hx!hf$wSi(A8xN|Fy;;7Y&p^vKdkC%$bPCS|9{t0GHLveUa=n$?pZG4_q32h zHOBQns+%K5O6zG!)_b02m*r`&9-+yZ9EOh}P)oIZ!v_9QwhGgGonkcK$kQ&4nDyJGLqML0JkaQdHy1ls zqwGG~y*F#;5aup7FMSFN{AMv9NyZ5Q%|ryXH4$h8?s|O37cEn#@z0zy#MdIS_uHO zF~J^#sB%B zSJ*JCf8f}rKJ@zb*p)Vum4@z>7Ed_@bGsKXeD1xxGv3m*c-3xeke-iU=qeXc<(I%^ zqM0wE05z4x73IW7!$A6<=UGjM(KAJDei>??y4HDoqxqQA*QLVj91 zGb4Om@$F57c%r=b#Ah_hyx|tz!*tVaH`xV zZ0L@*UffD%JXu>61(#5@#44;wE95bS4Qx5?B_r_ z7%03>Ivgw|54RCRwv^TFSaLL{2Q(K*SIE8tTcn@Q;8mcbGI^Gl%TZz-7$V91Kypie z=beO?fMmwqorOkuROJ{3yg6P6s2=jisMZ~ncbI?si$%fm*QE3Qi=*1C#Nj7V7?CH z9F%a05yAWk7bXQ=dWRNDQ<{(i_WBd;R=ociV!GVBEJ!FMmovdYw zCQdw^modYv(OWm8hO0Q^uM{Tm)F!YnR^O$_M9|P#9BY1mMvTirbMKC2OiXV&O2WYm zRJR|;t_+WDFR53N%wdXl$3LRK(aXKoE+m1W|1Mg-(%3O^!o+NF^!0F_8FN}|9K&-L z=zg-~%w1&DeTg@kDV7Io&6cFMP6!s4x!L$>25v_$Lg?WbH^51Qj zWTr=3yLm({X%q~#gOup11pUdz{6dKyDxIU-dQV7qO}Q@;2JlH4IhQKW1TAT-ou#zB z&Ni+H9$Z>ulY7v}5=0BxHSObZ2vnN9Y&x9kpk~s~kRVusV>n_$O>c&x84dg;&qU4I zX%l;RaNvfe)vTpk)ydW+QW;41GSm#LU{$bf`K#(M$Iy1tB1@Fd#@j)m9L<8I4dy{$ zoO!vruCf!(ozo0r5u&Q!6N~gF^Xw!HM85@nBVlj6Hzlpeu&pS%&D5ky|F(>ffOs4o zrYh8IRT2_t3P#zG1pi)zr&-XsT2G_R)(?T(&6`w7q&ykq99CcDJ})b9L_v3ygSL#Y z-`VbM} zFWW+igObK;9fUZ$t?ne};W6eYI{Xdxh|8&GB=9B{tB&B(vQXpT|by- z0c-WoZ$er)N;v8#xUnwDUSz*$od-vnG*$Ak8QtEkmR9C@AS9k6hN6q;lkd(@@*W@h z&IH^$wm&!RC>OOfRAxHJ@INQ!He$fPT&mFcTK!dS^XuL(FeAQ7L{z`R|9eJQnl)y& z^AWf}C1-z*w_BW2lRAxFm-cdpnnnrr1uFewp(sAYa%4$`5zz_4fk~0|21_H_6Caxy zB_zFfaa^?K-(M3w*nSR(lip7ZTJ%gXaM{jRXNIyJnlUsI_qHC?4 zIKns)z~t<)!#z2I^F0`!lm~@q5|<#4QYqLpIgBUKrTV6H%Ne%&R1tekxA}E=osIp_ z!t<|*G6=n~$b*5)ATH~u6jNA8_6YVJxFWY9=dQY+nMC&F6zT@7a8DweJF;z|gb}4A z=VQMlB^=hTF`A0wgkSP_9v>vzP?)=TNyXIm5cL-&YQ&)k%wo^Sp{{$I^e2rqM{&2a zamdytzXhv~<*PwaGj9xvX2(Ov#an^h%tt)ZhzRxd*SShbr6kK{$*_X4o{1!_CQyxD z^OS0v$h^cJ1fc2h`i`vV4nSMi6OjBiBN%m|_Oha^G~=P3u@9djX!Fti$b!aIz={`fD>kl@2BDi)CsN#1%Sed!y znx>MP5I#!hhaOf})SHy^K;{+CM!&id(s5=)IbpC*1M5LHFA&FKbDTf8lN$`8ySWjP zGAnYH6uE4{Ud=EWH|4|yN0051r^g+X2w3)&8T5En`S-S;mGLg?t*i($5tuD&Ei?x+ zJV%?B5a<^X7?Np46TXFJz?qx?4MU>#9a)2$j6>+h`NkP0VBzLBK|pw22HH?bBUk3y zY-GcwjxB<(ILxJ(p~H~%q8kNsj1?4?X~~K%#=SPSF`(`T|GF;1}fRN_B}HRK6(_n@mKo0GDWSa z5D;W=@gC+-IgLtb#$oef4-(vzI3R*(RYZAwh?Jp)2#DNobd5q;A zP*kJEP{f0hR3U!Tz~C@A$e>Ef%g$0PlC#sNI?6G6N=l(GV;T4M<)U7TF&dNe73X{S z&Tt9v$5%!|wto2|T(!X+T1Ciam%%{aP4V}Ksg<1jQR0`#Wl&~H#afFQTyqE+{bToX zWn~kwk?I;;9qBL~ZnagPK1qtX9QG=oOBBwW*U8E|lx?%UkaOCVDakD6A8Zmv5fHmo z5cD_Hgeo;_&`Ys{x!3{&he0nE7Be~;O=3;2eD!j!IS)QRZON(Zs96bGKfL`)y8Q%aNt?lr1QQL`&AL=#Tt2#Ns%Z39WFbe z4<>XP*@h<$7T4e8V^jf1@@{o~Wz}2Xf>-Nx3c()c}3K<<8x&DIZ=SvIPc6-eBzYqyAc(;4im@g-jNW@ z+}KbY73KyDaY$s?dlbjpr^Au_mz$*rH|d*lDOpji&hh2V|m0MWt?@?5S<{g~# ztK~|=J3ODQd2=BtV&FkZ*1^hV1??&|N?Qc)1%?|C-%~DXt;pFHmu9Ak6^Gt15W1c(7j<=gN`i$wpNge|$E(9jN|Sg{Hc!vQBR z=96^YJNx&r4gm@nPanoO$(Q5(@+yO#^ikS zUFaX;Md8+WOn<`V_JYSf_Td-P^92TD|B*WLmrEvfbGzJcgy=-07DD1Surl>RAP<8o zio%`1^>-0pk|y&L6cNV8bDN$_0Q5u(i43zDj?Y(7gx;`hG){`iHQdP-jsd%gf>6_y=3h>l~9 zd2l-C%^x?^71D*OX<{0p>**p!4{CTijUT+h1md?_Sa~r|BMl6P6f(Fp;Nkuy3f=2C zd@1M^m(b~PODeK2!H{GwN~~ofjTJnFv1b3T{BfHdYDPW`v%3W}iL$M4;*8F2GXJ;F z+|V_oITMP2ER|hyE2e0?GeJm$JggmPXZ*#LTY*D`hm(Pi{WXnV_zy2)x@l?eh|`GT z8do}UDXqHO!vb>5oH-&t_M080fd6h!isu;Dr2v+!C60C7OlW8srNy3~C_Tk7f^h@u z?=n${Byy?=B2HrqmB!#W7NUK#qDGD)%-13hm#<~1cmj4A$G-&Y$q8kEN~KxQ=jwHpf2nF@Q?d zHIz4V={H+7fW7YjzA@xq_NeptrH^^7#s5);GBfw%;@zP0MlG~+eRqpN*!aw8OJcYmh&1)NsxwvMnMI+M(Zp%bSk3>^p0 zfX$N(BPlVEaW|IKlv7bGOofERm#kT&y@x?L2uw{__YDqKs3i5tj5zH&5{wXz_b{@K zaZDjgx5){YlWpGijbOwiBil+im4P}q@h&=aUUn?hr@<)^FmCm$#VRxrmV}Brhi;u+JJl^LL)?IbBbuIyNN^7>N(#L$`Su&Z{C90r z>e08k$4#83=bgL>Ey=ULd>*eIJ*)7CdUx5iW^&UcA6{^{x?J9r*d!=uIwLUshRM5XPl0GRk|nOtkVhqb=pk4!%w$K z?*`eQb({T0QJfAV^2C4Gg%!MGpC3m zm<{SPFQjp|EE)Nx2Y@G)W6B8Qhgv{eoMFp?=@x9&K4h0qpWCzNHzkZP6!yPC!~8Vt zAVBZ3^kf|qbW7IAhn&;DZ50eHpVNGI)C&Gr46SD8u(NMab<%O+`>L+>tqHUdFQ6xn zZ>}S@2ZH*D18TOj+tcVR3nsQC>UR5pN;v=59mOJ!W=Z;Ab);AzvP zi_|QbniEpVuTEzK7`8=FvXRjabWFD6^Me?#fa}ZbpZnFLvffe8EEgN-%k9eGQYKBl zH}2(==-!a#Gl3h4sV~5j_hEotdrWxx%Kz=KYoJa-L(?mtIa^FUyWJI{@m8yfTDrYX zK5|Cnxw@}3t!jO?_%cB$s~MlmcjJ6$KLmHz3p*N8&>f36WlpzRS*KZ?EXd|*z-&<%?eQizOvH*n1#^Le)HaEbNVk&gcplLeJB0M zBsU2o$~WusY8FH)Rg>g$ThV(9hImCJ4lf^HFV;oA0vmEAL!4rP5(h`D3(SAs2~w{& z(#cO<5bnv@5s;chf1~F-qqpFP_Y)ee~2fK$gCwSVaZlbA;& zfTZ;K@45E_0bk@5w!rKAm7)Lr_h71VSU-!e+r+8|P%j~g_-;hqa-alQ(iN_A!TD<4 zO(DOvr$R|a-n*l&$E9WGXnej%f-qqk#b5O}UIY_SP;vyb+2*U3M>yH?qa}BRxt~ag z+#&ahwG;YHX#%lLAQ+qT_-KWsiEu(Rhzm@7teWMO^2a=UWZ7vQz^Vl?lbl}7+D#N3 z2EyeE{2`mbLKwno5E@laBWiv9g9r9*fXi)>K&IOUkJv%lO{Fr!NkA9a`e*>}uj)>tp7$nITyM z`z2kE?oyrWnKQ;sBHxr}bA~h!H0?J296r69pzr^CnC>*ij$A^={@&w}37!TGfy?`y z&LS@yZ9!k$ur`EV!>$5R&>{FUlffr+Rc8xFtRHQa!)z$dj17_w*KA2CLl9*8YElg+ z#0gVEw0~H$X$psKdWK&GOW}!WbS8dWKE{=47$#FxhfCJ&_WLuPQ}J$x^2Ma+F1n{B zv9(*PA76m2G^0lz5tlFYcMKJqa-q)e@jY?Ihqo<5KN;7V#h_Gt9PG+?nZtpIWit|a z_(0iwyJ+;iB9v8nu5D>psmgq)N&kiUTjRY*c`U63sn&AuzorcOJWp^LPCO(`B!fS@EB3Z_x5d=E z&Dr#@MRA!8=2}(kiYX4A#C*Hcoa@mbogaROsW)w536wv-7WR{OQXayZ?{)P;*$C=0 z6Ah7Xq#=(67ZyGKcY@>ZId6Q!3e0d$Ow2sxH%{QL*_b!Poue-&J(GTZWe~*b{M;+v zMz;VkPQLpk>&mE;>6DV$3>$Fe4bMF7E)f*Q4Seo0Z+I;==yM^#6Y!D})iT7*$dg(MBKc<*kT4PuwC=Zb)1IXJSB2wn zI+AU_iNI0gcpWZH$b_PUO0|&;%(xvL-*z~vh~sxQGM>%zja%Tb*Y+{jQJhG~l&HfoXuAkJexCtqGgzJsf^tiI zm^Gaa$&JNkoW;ABjG&J;PRc46rMG$8lwgxb&Z)p0HXD23S$mFq+i7-Z+P}}& zEw4DiJVER}y?zR{ zl}8K?dUk;<;=^!WD#o-szselDX_>Oy$>x*5+}qAI%V`Gv^2M71hi3b3 zWFCYk04MX!80Y0Uy29eT&F@LaMHC^l%$##3z8Uu^rB#l5jlIE&%GMP+;-C8omq~!M zv-7?>qJk*CVBk)#VkXt(pO#P^qrrUmJsy}odhSU!tjV2mY&=KqFWo9QT3cLUF{_!V z&s|^(S`?K%ohT*bgTwryEPy`7DFdmPU0cyz9DHt6kDWJeB_=|9K(3$KK9Y$nw^-J$ z@OI@r=>kHs>15vfBPur0_2(9`km)wI08FAW93ZYDY&N1`5=9Q2Y1~w{Kukx=PI3lZ z(P>XTL{_YGB zujEvdM#SB9@@toZZz-4|Q-Dh5PNGJzvdQj;)b9Ar-}6`AN8G=@pS02?Ty#w&9J_nx zFmV8|(dB-@zFPWBMCYqyZwjpUSw3b-LE82%mRBO_1Y3VCd?ifqakNNJO*`wgBDtdJ zLtSj1xiSiA86M@d`U)F-uWFKg3c3*_1w#0+CHYH{j;;w+Hd<~n*C`*Jq-g3s(_Unh zKTloN7Jo5S+ndAUfUf&rL>!JEAH7nk|6UcdZ8q`|_@i{XErJ3&;@pk@U`K zZlRwCiPV`T2{98yk8p^73kjMTJIZi(3m&j-n*I7c{9r_>aE-RY4k&~2X4ERqzQ~ht z95QZB|Ne~VvxLvUEBFhjD3z6=r7uHp(c|g3z^C#yHGQ68jI^ zaq6_SU(crGnIM1ZBe9N?EWt_x1ddTgH@RM-&+asV8I0a1#N4Z1DQpl-^VNwkbWUOE zIMoKY(>2~>(aLBv5@!dxhhn?BAKdeu9Dar{P zdW)tc^@nUJN9lHAy;cTx30UaPCgpL%1hG!1@#&IvJ#sdGIAXi%)|9g9n+-HIXZ%w^ z_!BSAJRuvgq9vio^}UCfFgtYvJ?4i541(q_Psf>`omT(c)?Emgqt80cf7KogAJoT> zk{^reT6`?99}@E+&Qy^ybbfP~>7wk9L_tDMP9G8<*<;+nzQp)nU#LEBBiVl_ zzNq^t+?D(IUD5T{V!coCf+zisaLk3s`t<3m-bTJ(j(}g7!Jsk!$Iyk;lwOo&JxpA# z{YEvrr$2+5vD;s<$hP<~n&r;RhzWcmR=<;k8T9B%Zp)G~#tN3-n@yH)4LpmN0!XC| z!PJvK&Sq--3J(DL`&#>Hz&bX2o9Lu)P|OG}$obn3$Oj^xxoWxGsa4mHzHmhUSA*b0 zbPImE-K}ceGe1SfY;SHIXYqqKc+cQ}j%LJs_DDl`aYfLUV4}nM@X!OT6(Y%LLNCWP z#}{0e3$N`8LqZF-Purymj|76i-eLWUGKF_$Fsly}zxY~(yN|`pG1BQVF}RIhqRE$M ze@xc~qlBmb;f~Mov)(n8K3h1R|yy;zP1zq14&r{-$r^6gCai833?cL|i}IiU&e_UzO;lh5rE@vMZNl zO~MTBXg+D|{Gu@WZ@x43Go$zY8*7x6S75*Odbq<_*8z>;Rvk~YRsmL~qQL8Biy?>Y zwzJ(Jj{3H+D7IX|al_2E1lp?KyFo{1pQK^yZNTxM1a#?>706`>^sB|=$N0RC+`{*Y z+P@JYE{osU+~iMB_? z!JgL58}&)3v;K}j3P*_oFlZLam7JH|&K7eg2=(mTL98*<0&X9&Lk90a?S~<4QMTg0 z!w}efdIiU@`S%cI;SZK_5a6d4dhrV$97oL`mMtY{>?f_~x0#*qdg=?h*1Lkq!&qF?ZzOfy=(rV8^-~PSzu#vS=^l2 zx<`9xR5U%ORWHvLKW^o~D5m^ZOP-|+|qOR_`+=-AH$U4x!`i!-7$?3#R`0!dslp_ zJ*+)k%dC*iiX1+T+D4ppKG92EkNw+-#6$ZphFpdM)lY#y`^@xTGVF)-12cp*2*CNB z_@}e1*SbBZcCfDAsj}%F@2h#-^!Vx5${57M_b^|zH`Ai=7y%w2s-XB>Uz7M;zqX40j%X-FQa4i&?zGe~c zc-%AE@2b$B$MvmY9i3#e*m4tyGVv0t6W46>d3T!wQt{nRf8=jTvSk%33zirGQQhla zkGUO2nREEJkV#lDcG7&lA6{8V0?>%~hN{Nv7UK|K7U1i2K01iZE*y)bB(V(bC$+P(;mTN><$AJQ>*@UuSZS}{KrxK-23?J z8_JTpb#A-ih=QiWO#V0%@v?M4z%*cDJOsGVo4!v)6WIELN}1b8;-c3ajRY?_BG*kk z_7etOd{I+{&CyZb$b^DEJ7%&>o2`pgVnZV?huCQv+@h#nJ+%O!;C#g&=korHtL!q* z*diQ8L&99c7aFM;@{m~IN43-K!cw>6QDxEWaLNokKAl3-vz(@*oG}IMuXh{;I3X5h zV1VKExT|!?q_3iG4=SnO*LRV&0<`YZy zaGn`}!o7>ISUZZR0PMqIk1xo$BH7BA3g!eGc@yVD%|(0HEXMrqGk**}w*^d0Z(?}d zi7-$>0PN%^r?=mt!Moq*hE)9lv!YpuGyk&$5FZm3PnC8>dSgnZNV$hYsMh2$fM*k* z+v<3!ay_lGo1te0K10z9&{%xBK1%OYjT?5FCk0-rzIC;Z+Qk>wOJ>;uuoZb2V_=+v z&+0~o1K^MWs4NjbZ6WZmfWAB8LwRM*>a3;67#C+-DfnmWf7>GkxY9{*&O|ho^-97g zvroU8EzREJlV^flyq?ZHzw3}ZW$Sda&mA&!%f-}f9jqhid!gW1Niqr+rNvz2<_Tpx zy`qOaHtNQ|AQQ2By@A*;u+nt_Wc%V@-$w|kNmVwRwL6vF($O$^V%pn``G(hcIe@Gj zmTtkUExMJ+Ms7uAv0*!XwKc*XQc0aw=G?;236_TLoa$B@b43^)C;nsiF_-^+awr!V zBf=hT(TKhbkJQT(=-Vx~KF(21aM`WX`u_QT``|8E7LT9PIh~Yh`}h9B{d%QQ`1}9or}By&a_c*7Ix|s3$@SoZ{_Bd{*&n~t1!Xd)wky`Ti3JrsVNOUTd z7Z|`n7>#JzJ)NjDTFGqC0fh8kNsMU?%~`h%#p7o+exIr`rX!b#>4<<8pGrtH9a8w^ zcfTNjyIqArl_DxH(b{0>)|2$SwHr3JV1E}fAceM9iZfib+IblL>)nk|FmT9mtOb`H zzwtY}+e=LTE;Z29bK5!7>4$TX-7~`EBhAun96+5i)6oOu^f=us{NBfO`byb6)CFAv zNN^NTT9=rO$FtsN4Xt)2tQ`p*(XmQr=Nr;>J%Y}&<1=a&hV44i$`bdRRtZf#+avXt zIV~O?F1bC!>U?ij+)fWBuaoOQwVe$`2@$;C^xB;mrl6a!(efHl+|Lw3t(4O>uE}D2 zBG1tO?15}aHmKTb)Z{)GiXX{pVYaceAJPNhoU104X-YhUX)QQWMg(cu(W8RHm0Ene zC=y4o(z9L>@g|sj&*shR`3DZ2L$dT=tt2a)X2RZ7qxpbo*&v6!#{E95&iMwJv?TXPclzs|Z!okn2?JIFRw!t8G66U3125#KAf1f3tE} z1om3V+BIQHj!pW8d)*Vao9(YyvB|`9hahghZa7+);I2;JX{42DgHRw$if`GG49*bNF`;b3Ha9DvoVb3t*xh+hZYNhe=pXcGGMqu zz7~$>FdH5on!{}}e?XBRuyCMJbl>|z_yC}om&${LDbC@F2!FMVrQd`PXzlB7S8)|$ z^2`;Zo~xUi4Tsg=PO4`kn=yqpP9PUnR`b-n{4v)#w^FgX_=R7oB-pNwNgrZ&pWFBoOdm?YFuBl$|v@60&(=#>4*p^{IXj|(Z4?R zE4_M|?7VJd-|j_D6Uy`*wjtwu#0$OJ*Yp$uHNpUG0y)W$xGzqpj& zAW`=fPv;r8>r1pju$IHRRu3&(VWxhzTt7ZHax}ee!zG)`Mv_fdX-n^XomAImhwf#c zQr5#6m)Sv(`8n_XQq!X&OIqD4Syt2Kdx1C5UVj<^>Kl>x&fxUwWsV;UK|!m?Oom;2 zj{Pk!h(ezuHJhGYAC|VwXYd1mko@@*XWA3xJsbOQrGdR%<21&6;=l6NeED@NfEzHu zNsKK3r2z{|x8OeP z%nmDw=%ySX5MYLnn1f`XNy;3$k{(4~_!t7ZEj@Uw@XtwIvIU3z`#>8a9)O3D|D507 zB{ik)Q0v+*omicBm^E2?qHQKhRla~7+*@S}DEy3jmjdz#VFzqB8@V=sS#SLa`$1;* zbdoDgxyDa|LMp}2T9I8z#ueW;o%%t>Rp!mw#- z2;eunoqx?U=$jI>A9;*h2{l@~pj{>?Y2gZ>?i37u@p%Oq9gTw0dt#kw8#CPS6 z>#}{b(`AYs8-e?`sL@&=j^zaq>)<=vvRrYm%hTERrZSnAvI|+tj20nQBp|M0ooarR zA)}z%wCVCxM2$1V8P4T%H%`ePJP{L@B&~Wo#0DJhLzT5_;glL;l5x3hW*RD)BJICV z;2Cr}P?3oRe~>1PYG&l1mrgvJc7$E}-B}+RKmfOkf8Ns(fILm}o1XYt->i+#O%Js~ z86_dV3Bhe|S>_}4KA??@-<2Ulk>lUqtDD2V9uF$6yu?fulPb4gYd;6d>-1kd9w$DT z%ROf}`hMOd75ezf)_VKnAaOJx(7Jy@y{4 z`A{WIX4rM=AZT(}&mdLeprVFOArlC#=F2ggfZm_N@BcNqD9I9~<14t;cocT}^~H6( zm=cMMHK2JNmwmgHCh|skCJ4K^;=^BsrLgQ4A+oY}=F^Ia~JCY@#+81Wtfku#|`^9Fp^)a}BZg2U(|-ZSq}K$E$na@hkFBYz=cW`vVr+21PxFhzm+8yfs*vAZmb)N@Y&kqN z$ARs{;Ca`_t`xEFitFhwG4XoVd%_@YZ#(i7PZ4Q&mli#8XB!y4w zuetLMYbS+aJCmg(y9d<1rgt2af48(ix08cCcCQ0>k z(oV>+-F7p7^?|rAR(n`b&&GMhM`h{t!}Rd)1O7^ZShL~Bb|FyZG{1mD3%0K9aRZ4~ zl>s>9D_M;nLAX^cD^r+jKijMZ8d{?(#})O$_s*c?wB2ic!?_xajz@u;n<&HezZ@6| z@7!U<;-gFi1z#hJ2M^k;X2B;Eu2X)<#MpAR`NLa+bYt~$00 zOXaf~pUwudQY9B(7~7!Ze>#4QPAIeW@&0w{Dl=^s99#Hqp}LcK7EF!l3myA(J>~xj zw1pyOb70~!`{O0dGB*w1K74n=d5YhFlJ1PCeed^rL$I&iW1#672yz6-ObU<9q!4@_ z2x8-j%jTc*6OHF|c)E&o0h(Q8u|;!Lp|N}qbq*w8@#ds?U7K5prIXl@ret9b>&!b} zqb2UfHai|YE0Ov^lg8KrF3*ENHAw}CWi+QQh8BkYCVVcldIw=SL}*OilxFK_cZt2t zg|CC8P`&%@VkfNt^vt8(BbGh6mSwIm%v4ZUAU=j z2EBxoSf-@Ta&0eD=yQVjIMFDh!)Q4pa&CrLq2!84S1SG2yF{7K+EsGN1nbn%mHkrF z;bE8e<=o)!Q{ROGsoeabNq9U5H;L?x5TOcO20xmP3C!ydHjU~s^3<;s4N|1%2HLt_ zoqt|uO?Mvzv^|yuFS9*+J7Izs^s}8>j;cu2u;v(kYGTg(YN-#)vxv4X5pJ6FzCn8) zlKPJyCA5pXsW#x_EooAOiU7`02Uv4G!Eb+T~_Zqlczk zaics#vQv0robVFXeC`X8d}c7NDGhmUm(2}Dc2A6)zbh`Tzuw#0dNQ4*Q{&iCj0f3` zNdJyb%T2lU&a3qlxCT$&VP+X4`bdPKk@Klgq>>=jMmI+DonriUL%>_{e!|Bv6pC<;d^y|_YacC=4mL-( z!YuW4V8N8Lj*P*QvBHwN+UUEP(sj#bwY1*e9hD|SKxpI@`|b~3Ai7H6Tn|!~hJ#3- zQ;2jG+~3>3ODvTdMI}kLRb36Ab!KaT(q?)WGl+{DHshr!3ejYqhA29vD56H~1~ao+ z9aK$f6mA0N$ailAnKNg^;#()3;u%wcCv2zn5*!tCT8YZ)9^*EQ-0}jS=*QAsSFwu(f2ulW`!6`|*yv`{) z05^eIFx+tJZA6QAV@86-2zuc#U3X>ID8Gbgc~3bhFo>d6m;C}6l3>NHn_@HQX;k=N z6~=z&xagMD1U8Ny3Nvuj^U-@LQ>yXf>DJGD)AX%26d@bNxQKta5&=|4`5_!XG311O zG-*_mMY;$uaCPXt^QB&jQAj{{@r*?y%Dqd(7`TUw-xjy(IfoSWe{;SPV`ioQUg7k= zerZFdGo@uE1J$;gXwwr)h#5 zFzdk#J4Tm-)D#Jf+`#tTF0~#CRvzT+RXy!lpc)2DRq^Y^qI8`DMIsq6RMOFcMH$H@ z*ljYgTNjEx{yGXGZt)v2s%<@#Dvx0pfvK^$Z?6E)TEo9D!tKky3T#n}*-p%!jG+^f zp&XIEkYlSL{Rs*F7W+jhC$gERFS1@rng3M)Idwz5PC(V_YNOIwhz(|R9S+|91s!n@ z^k3(q&mmYc*Xsb413cWQ^@HWa*-1|deRiCAztq&8?&R`MuKaz{on^EChpV%IifV1& zzDh}#64Kq$oq{w1(v7rqDKK=0fON-zbR*qJGt!}ScXtdi^KH-j{?B>O=UU9#YZlJh zo7ww``@XK<1*_u_1=){U>K{Vyk2JA%7j z#*LxH$Evt&uAopbxsJDIC5zOY*w=nRK91@I|3# z(|%Oap^TI&xInW8y(Ad#?4$A0?R?1dA-qkdIEw4lWXU@^75r&x$Or2Xyq~yv1|p0L zHshL@AyO%O|`0g>cd{3)sXx@?p|L@HrRO(z}2oP{e~ek1N} z1cc5vayb{SKl)P1xaI2Oc{!coJ?6@HxOvDg!th82zV`=T%`1lMPguUcWfzolRA+2W zxE}m!PDK~~UJ_X`Uy5;zI4xmJ^Or*iM#!Yy9d%5Y==z!U*l#HX{n#lf)KV8TSF#B- z&3X&kL4==>DVpx*o5Qj17<HWBCQTWm-KPI$0>gi|y!m<>)@io^bhY7Vk+Wqt{-+O$EG#u+R3`rI+(> zZ@w7A*>hz@;-}Up{d$Mkw z-7+}_vAtz$f1X{4uV_O|W@bLPiDYsS4p*U)vgdg1X_DVfW%Ooq95tq!IrPUYQX0md z_gF#>;iveN-;;S0#8fY@r_*isaP}|_-hz&Zi*Ps-1p=9bYxg4bQf-YFA>JX}Ndzm2 z%|owvtQTs`sz%#G>-HwymnW}&ea%sUkA1Bp_2W`IPvkHvH#N{13O_~VQ_rpqtK2$t zQlwIh(MVROwn*(=-2ABu3D8sfi5tsR6YCsT6G&7}N~pO@)x*YBW6V`UKxk4M6=r~; z%4nvPyrC)6^}w}JCz)GU+wl1L$_&-{t0eJzuKsa)vnB@-4r5Kevq5>*6q_v`2qBH& zaEnCerMJ-+OD&WMy2leN+o+FIm3g*&fWWYK7xnvN|M#~K{Jrcj&H*BevP=rbuI)t* zV%$MY(z0qyglhHlpQn8r$9*xwozDqcup+@5bTp&P>t5b}iE38ltD`d>0v+`(`C~?W zo$LG|tvwKrmQcunK^tF!AF|-iU#3aIYc4SyLSsASChv1-*?JxpUng=}O356U*E8XX zyRZPJEB$k8`mY9Eti%$6^~frLi7sdBcdV(8>&{hNU|W`q9W>j#c{15tyFfi_gkqOI ziAn;%xsps7L6W8XVFs|I8!x0cDQHixt|X{RRmT9A}$P%gtZhHi()T%r+q zNQhaH$5JWF&5g6N5;L&A*p_*aNXxOZc3>(OExLT>a=mj-M2R9fQ}>br*=+DOm}(bo z4@(o7@C8!kGlmzM=1(RRzYrx4Vra!_2~rDQ48~3-d(cZ`*Pnlfek}YF>hj`+8l7!( zQu33zEIV|LP`o+Pto-Ti^l>IWS4Aqr1X-hb8Kb**f!_A;%{D5xta8Q)9shYT~T2<(co^U6i5jw``|bdS zAdk=b+d2e=-NtT$`2Ht?MiMLzoDr|{pEi-jLWt?@&8F+0a{JMj=hm@hI-lY_S->tF z4xq)+{4A6ISHX!a(EELLM9TX!u*2ij6{@=&2S|S7^Xtk~@2tqU0$Wayu_^~Bg?(>b zb!+HJtBUI_Pu#w&y;1yGy~q0*6}>j(i&yMMQCCwWVbbCFps(-R9wM1QdoLb$ab=&j z2OF6itBL!ZovWaNm?EMQQ?5_vRho02sw`~tDB2c?aIKHi!<}=$nd6jKa#_vGwnMH? zxI4^CeAd|Zak+0vQy;ANFrAerhg>~f<~McnHPwn(Ay<-uuLN|r>qiPc(kJmvUn4g_ z^y=hC23Mo!`F1>W3FMuXJ#84c)|-fb^-k!{P|5;of0c?uGSS4LIyY2MoxE4Cwc1VX zA+G%{?hYRmjBCg()JLp*lXMw+88kelaQ&?MixlmvkAuW-3~dV8S!q?+xF#7UU2H635{Go@M_3@xSmmt;g~w(iBHpb*%9xS-%>x_XZG%`f z>UPBT069u|`%#Ac8a9w;9A9iv(lour;FQ8V4c54jN}i_u0D4eRyKq5{gF$F?zN&qXN|pbt&;0jvsN%- zPH?DXk2-mX;SYC5s~n+BDsy#5*V`o*8%naETGQry(W*;IUVW;t8jvW* zsfLkf{8Lv!kgi5yKgDv@gsL1H6HY0SJ)h|}NJGOr&P2?E;9#v>F-j$j)@WR&kAkXlM4f8gWGfAGuh&%zn2AtpFL|d==e0C;djg@) z-UYQs2dtBUXOP^s2#@D2vI!OZQ(Lo3?!(@psvLy-Xe?=SFJ<0kME-kpzz3^JVJ4ao z*XtqB8}4`E_BP-WI8qKFeF)S=widAh1uZS|!6HlHMAk1>W z|AxMsBsH>=di@L6SK2#TImx$kicq5jKsxwbsIU5ac=qs?NR02H3bhA#C~(-wYtSY5 z{oDcjv|A_{4Hed|_gqcB*^44jF*iM{`>I5%3>(sTvo;p$^z36*upH^;!Fvzk+<~z& zDwUqdxS4BviEI=jjCOe#nh&b?+!6pe8R%p^xAP+2wD#aUpYOmp=V>DX*>_@YUfup7 zr2s#be~mqcZ@+qoS>)|~Dhw_79cX&4LKf$XwwG9hQ$N;jo~599XJ2%;lG2-!()PYY z;i{88f}I_7!BqmgVe10k1Ep!e@7dOd6qnmjf%oXnw&)y<=zqaGXgk_AM~3q6Rvb}{ zjn22})bPHlvZKx^8+^VjzOxjz8AAOid4NMU0q%x1U`yeR6(e`XmpP1D#z|-$@x? zQqbOB$Cg6lGPEVKLpxcQdG1#v{d^Y&Yfq(d#+=Rv3}MCIQG8I+!>4BnNJKLzrw+6|%p~QDMF~?2#wTca_x_XRW{pJM8Xk`Fvr7w_9^8fkVKDqBG zd()yRzjH!+W`OSs>Ya`J&j+4}m-EIP;wmi{f|Fk+_?7&nV{2tMy%;EmA;x0c@*+(> zA@s|T`$=w$bSD+M{G!eJx-$g!&~R1?dn0Cj@hhMAlp#Azd*-jU|DV4_&Z*B6Z=>;B z2?g>fLs&3>qSD|FMDf~)WUTo`LX02+r!0phcA-CSB66}SLAZ*rcPox)2ikc$yf4mb z8Mp_bU{cVM58Hp=FeU|U`(XC=WJ>AUs`|N{Pwi;z*pPK;kh^I9wOIV?#S#0{EB56C zLdT&t}CHL@_g#Y^YT%r%Z=cew8Nhu|Z97Te5}@{PeeE|$R=ClsAzCzg=eb~U|B z9fHfN9$}bpw{zpjGTJ+ZFqyD&(bzUyyfr_ycUY|(>EleE0Ul)uSs8akMT0n2Bf5=f zbnG3{aLoKv#E#$KNoDP~2p%t`-%Jg)&_`{LL9+24j%Lgr)FT1w-YGq;>*>K zHGy<-3uktBqr|!3L%AR#F?+Gy(BG@6sk4gD+qDrD?TgM<)_9!-?uj(u+ z(kBKWFf{e`!17PIw`!QHpa+t#59g;05vUPsS&p7A4uvzC2>4Us@GYwKjpyv%8hrgq zrLLGeEHNLqLog&CSM*Y-Bt9F2Ws`A3muZ422Or$)F+^7R`D$vIb0pj<@R_Qoz78uL z`m^DB@f&GRRLJH<63c%9NQ{i$om3IIfbGm1Kv#k*2YlAwnSG2Ajjw-`u&(DHFztL7 z`P3LGmQII430nc1VcJ^fxD_X`soU?6954A_*+CEFbS~aH@otGI zQ?G<9jN@%2-_R`-X*JyS%OR=p@~FkTF`B-w-_SGJ%Trhgav6G5!$*vND#j@Q=^-k} zn$(EMw1U0BIl1sM#W~~<>*XtNxoWDJ-3@$VR+L{eZWvyf-}RYi`iUnioF<5GaWH?i zZazT{^cKv^q}zJL|HCy+}wR zMTuJKr9!1RV-MRoSl0i1=EHe2oD@<*OE<5}MUd((SzGvNH7!&Qt-=^Sz~6Q)Jz7;6x2b;<){Bo$ zQOM;?26LXi(={D{H zX~OPz%CueAE%)iKmB&g@$VE^REwuzVCCopK? zbNZp__&DdW5J7C5-wFFY8g;I1cw&%#cbOV>ojE=hclO=MO^9J0Rw=cAl#OznD!9q| z#{76>x`t?tAQo3#agp(37tPB|w{Q|y>BFzB1#FUtUQ2t35g!cO}?OWE!Lmq*Zur6cL}Xm3{2CogFKlGj&5M!uFcC}_lWFr%<4 zfOZU&P`R<0l+i=4?6}Z=vi?~=o9O6Rr~g&>Q&|CBlN(R`S9HkkI17~oK);~%s(&QY z@4{J^Hlsca51_bd1pWXp)2&w&Zl}|IADC^gq|ZWc8GlYGkxkzgCC61eKXrUt>%pBg znmieCjS?;4x>ACQrgMdH0C`tfj4=_ni6tP1 zwPe+a!sEHcV~S*VYFV8h?U8k-5cNHG34m;%TM)S$A7S z$^`xTN2lCs0;eG)H&g+DfX$%O48FvW^u1im!FdC%haP(kbjV zS%;3qkLIx4?s2tUVB1*A_EnbdC7@Cw+fK)%zs$ zLM!|MDQP7_(Wn87_wH9(&L``bFT;|x=X}OT0ef5Z&VKthAkD<&bd5WOr99gS zIUy6var~nznSiIu44~%z3O4Gn>;W2L9EXcrwh+7DWZ{b-)jHRe-1>|LDpdn}G&;VSKr3AThHM##(}0Ww(~C?b@+TL%K|?D5;Tv#`RiZe3M70d03bvo_bce72 zp>IhYh!}U9OaSy0ekkfjaDg%UL}?a0XbLn@Q2?a5^X0VQ9%Ili5TNeyr_&%41o06m zrje1`E&JTg2EHtd$!ztf$j9F-=M>(s8if@*Pl@%&0Lc-rPP%4?D%=1JfVSOyckh~v z7e^Gfqp0uXL!>e{A^R3V&yP7<{@+Kl^`GHgfXIpCH2V>mOxQ;(Ze-HYImBeFE3fRg z<8q5Fg?eZtHRSMdfNm3LT)OVB^U8d>FewpFjxOM-5 z%+?ZOY>}-8sR-Y$xBv+m*RAbG^cqgi?!~H7vDc*wM5=cy%Y~ z0PdjPKeYX4MY7_^NdJd7Sa!eXd0VOouW9TexuE6s(_(4x0CE!+OKxJFrwA8W_$0n4 z9Y3cfrAA>3gX*_&Njj{u^NLfiNl9>jynB4vzk5IXFrDe@_+no+EvOs zFlIRCx2ZAaD-{}@t)rvidvqNH@cvKc{Vq3~S%B;T=r`Mwr&6+BfoEuWWC5_AehFCB zV*AN+>1%TFxd#21?^9Mr9j;Zq=6lmcD?cX8AmZi4Hj9OZD{C}s*I{D@A|CtHcEki| zCZWT!CQ$@8r6aA$l?$GQtJf0%>Su=))@GO@UB=%>*&p|bBe(g%M1|vSRetVEJ&Cye zr1xDWQj8+Ym;tMQJ2olb7bTPTKw837*w7kT6w?iP4Y49&ljOt_t(ZX z4hY`A4zEzAbmdsByV|=~e08wzY_1W{+}$5kq&lOZ zaHj?BUWW8n2-_{Y;-C{&&CTY@u2kG(QFN*TNO?NeUP0_3Ou(=}B;rZBWIxwT2#ex> z{bJEW$KWgGiMOg>_jKB+x4^?Og6#a~{RXGG(y5dxuG1-`nJ5Q#b>swW3!X*EwJ2%D z`I}u{%lRn9#*=gru~cX^YC_?t@!%0KP67{pxFTVNF5##-pt|h1m+#p_C%ngF(h(IS z<#OmQ6uplPKION)kp{G|j>}$y2$U>XR8L`=;c8AINXzF&jwZ*jrWr1jA-H2{WrSrikpvp+{HWCoZq@sgYF9NB( zx5(f|{W?#@?_H=pVU@yxOah(aRJUy~kYm@wmhi<|l-rt&NhjbsVb?(|2%}8W&#Zm} z7)=x}->S#%0HEiG^(<`Qp0zvs;$D3N7C?W0DE47DwWPLRIg8W!_oADj*RxZBJe#0Wq9~CXo$5;as=LMzoHga6iJ50|O7eEN1WIAiLAI z3Wz*Y-(frA_g?&C%{B+j%2aOdjB(>U#ypsA6hdbMo|y79dw>#WpEJP^gsXSIjRa8A6nr{?`29&|5F#y_wK&lp{r>xNd4h+yoDA+6B8qF;kfa$}uint@Dbmv))`Aysu@Kgqj z4UMH~&$nSvG|^Zqte!^s9CYMqG*fdzf8RtXYNyxPcbZNm+Z5g3182d5DU zG1;9T&ycc-lrFT&_eDS5uD-`F95xd0n|sC8dHZ-jtL1e66q=0?nxvuM!?Y%3z+-;d z%a`RDl`i1Z*Ke;ykxNY-AkocG>GZAmXWPaqCw=&jaLXF)6F~cG(TXX2Bh8)GJz4re zVfbWNdgza3Xrn7ZJ*A4@Vaa4-A9FXY-Q1!~c}elzwN7$sl;)f$iTmM!xZQBX1=3E{ z^6_tXr~ArwS(S87pXGRImKpc`Ik>Se^d8XkKiyK_VeLks_iO7tW^qT{WJeD-b~>e# zBChBr<__UCQxeucB=6iFT;I6)!ae8Zd}OJy;K46qz0zZiLScAgQO0Y(vGsFH_9O|h zCW-2d#3O!qN9;ShTV<7l&Hv0eUjLbKhRn|0j1iI14Fe!j8!VZ*3p@)H&@nx?MABt)x$a-Mq3sD(Zipr)IKI$5Px(CyDto}p30uH^ zRk>KVu=|Zx4iy88F+4|Dbo~c+P&L~W6tAk+>asI2D9_z>G*D3eHemq$0rH}vUl}}+ zZ{Nyxf4%VRjVz^`ppY6Ts3kn|+UP&QN3QkzucvXl(X2?ibTRLz(BXy1A>X1(!m zc&UZGNHVF|16)XIqc<7i{rhI?-KG*Cs;##aa2uL_WuL1KFLqnD=YL z$W{`tjVIZxklNABApl^2Da`Bj7{0{LM#AOru=;&tbfrnx=>*n0=X!@l;aqY0hB2X{ zdajW|de8Q^xb=~0}k~(0*;yV#s1dtt}t19MBdQ%NqJ5@R{JAK-c zlJW}u${7o`r;N1DfNIOPRLWhBsFKW^rdNPS9l`EwQYEe{&PRWS&8pb>gv8)F7?RufpZ=Bzy-{#Fa z8=#X31+tEWvo$J{^I6pmaCw)z@ZYS>GW(Nm}^!3ti>BoAzo`JP#pKeRhU!sI}%98!8V*WJ6TYq3HeScg7qr6T}2 z})$P51{_Z*RGhlSKUZ{}Gcr7|(xA5NL#%{^4T0Vna z@6(}@e2Oo^@_oMZlp7hK~9Ur&eUCf`0{NR7;bm_fZIh0vo zdz_*nwf`XrAb{lKOh%ptapi5s;@Ig>w-F{k7d-s!rxQm0NYZ#5ZjT`QuGeraO3UH~ zN&QtOF$7Z>yG^}wBE7zJ}+}W_}k%?-b0vHk?LX_5yb$Jj7A=>A+?(>K{LtUbp&q%hJXx__ihAQ0UeAsAFxn~q)OD>+qlZ-c#pnoFZk30 zrbKk^Mq>l7Li4_oZ=bCc`7_z|o8bNB_B(Eb8p)xE(J3boMS6JR@Q|OpuZ6n$|JC1A zZ1NlmD9svoOmL5`H(H#?ySMLpcEmqZ* z(r*cK>__F=^{JD2PD5Nae21~)GQ1G z(X1M=>=gBwy61%%QGC-ggiB+BVGY4RotJW`U?&nK+X73KdhTE=jtso=B(r=fvNbfB zU~Eu1I|_wtA2qjPjy7p{yrQ)9Kd%G*44pv}Ka zkyq!IOEb)LU1$$o>Z#8$yG-h|i z*pjTUNK@pVv%Wf)+N$pL6a&3@EBSn;r?cwTm>POg1lUn}u81{1UgBvkrW@Qcqt`ch zI#beoK}(Ar6-R(jC$!Gv_hG2%3m`0_MlW-|{1EZC}C1hhAmsbQK|zTbxJ;t>JaGH5RjVP2)FqZ{q#lh z9Kvjm{rA2|qDCc5d`zdfOH{hINZC{>RIoLzP|Og4+Ueb{gcqg}msIs05pB~_Y!Wry z1RPDhtgD#VarjfGQ9OBzxU_x9hvt0EeR_c_TO&2z^5{f^Wa~0R27TFLBn2Z>5!D~ z(uiqQ*M-bk&az5D{n}0ITh|{s$^=b5`JVCBV>7dK)AdR04sFV-%4OqSCcIj5mRSqF zL5@$2U2uNaZD^oEx-eFX7m|8kwWSy$n>WtS`)59`8pcYVQw%W(B5_Dfi zE$17;WrMm1`91Ig-^)rDMGHq z)H(`Jcx70v@c!d=|!Z=8FELetw;_^DhDc#_NQo9W;=}tlqK#W0^=_(v}fcX z(ag!g*&to&us56;b=3YA7#yUZ@VJwXpL4Iji}a1QBj)5(*BKO9$JygoW6h7~NeLKE z_}#|F?whAvj_V<&e)7)dH>J_9L#mNi<3H_D(WFUR@Ch<;e!lXSjA6)~@>oL1N7Tpq z_V%AO4I4t3`GIy?8_lUE{g`xmk85RP7{sdXlfqEpTN#O4+O$dUwbUMxWN~9`3tlMx zk6jgcjUJar;(q}Df1081(H*z!hHBL{Jc^{QZA87I5fGS612zXVPvq6$K2QF_Mpc{sWYtnzlW(m2i;&qj(4_< z_UKlJ>%udrUX=S7{XT1Nsq;D+*wYSDl#HB?tc)Cq6ROVSqD!K<(uZ%Q1h8mDpRKd3 z<1OxQ{j)jwbF}ipNvVq`kJyp*AOh{@UPSNXggIljvTsO;ctPbeKwLym&;GpaRGL1a zl{8uABaS#r(a1luIeQtU=#a%5YyT zrDeL{_2&}B{~lI~uO$r#xq8$ew2o~Sl&~lK?r_h0F=^EV!93G0KdCwlMLo%O3vw0vl=nPHuQP4gvbq#eK^r z-GU-P=?8>~sh1-k&Q;~D7eNV$(W$g^MdhBj$b z;!7tQ6bn{c#UBEh5~#FZZnC^$7+Dr55lyA%1(`NT>?2j*|Idd3!4r+t|D66Q-C;-S zRECqMyqU6b?-o)npj+6VCxr?3Y~s)220@DK1EOg1^cR9fD~S6U{1p_DD6w0un1_NRHD`Bzi^ zpHaBK`*2L}SvqfVT-dJzu#8GGpeNK5d4s7|aRFkyb`OJ?<*|R8YnKmW-$FB&g9txb zbBzT*g#YVg0=qM?XImjv#6ju0-C$l6H4c!r0NId83ZU9uOlG!6}|WZXS!9}8KSC!D$-oUmn?xNgzv7^{_e#C2O%j) zN+att!%s)l{uLHsWVAv?4<6@nRKhoY`J6T@mxl=yb_;(ivn^lI(KLsTw7C>l4k0^Z zsB@CxZs~qL-nO`2Q2N^L8Ixi)@*UgOddlfYb~Sh6WpF~r$N4?8Wnwl*x-{yAjkY4Rgz~1TH-^Gh zjETIh6WDtaN!s_&v=@QGFZFs5adW(jSKVY*PA}Qa;nRvq0;I1w+i14*?mrLZ@7Fza zTtnZY5~Jaw7w|^W20fvaN}5QbjiG%f*No&L5dX5V54jWe9_LK+`5ET(#~lngL)=GO z+W$Oajp9Gw!oRdIhk@nmZ7b$gi>91FP)pV&uUmyY1$;_g{^5IyZ8< zh`-o=L&J=3*;zwUf^GLq=Ix+ik&1gkw|yKLlLu`q!v>BcJ-!jEhJvxAVIwS;_Ep}XP%g?|dw_KR@{6(OuLZl^c z8UK5eGa78E!lRL}EvbH$$GsCV@2a&O{cG|C-`(EMM{K`GW8d4c1?ZR0@FakN zl4Ufs$L2)L<5oMu$V&zmb@bBu1)_4zzrgvjO?5P}g((c0%4qf-v`q1nDU@t@O6rg^yD(m5n!JN??%j|0pkv^dnaxlN8N>R}2_ft9(EU0W6*wV?fEp>h8%;mX z;dx#McwVavXUJt$41q-XC2Zfz1o-)iUz06-!h`PswO=&OgE5=8^_fh@z*-D_tsY0N zW`-zz(F%zYF`3x;wCA&RZX}pfKbeB+F)G7RhfZ^!u3a^Wp|3mbQKVHboc>!$aiOMg zn~ZjB8{n+pNVUg)ThYN7f5-4*eOV`YdJ~Jv`eLA3B=I+C7ty(;O7-M+pX1AhCsey% z!Ur%@+vTARZCx)Do|gVS5&;LXVL*}(iJ{3)y0kDVsi+xy@h6|FR`N#xIP>|tTY!GS zXLr^|vCq3)cOO0-8%D_Sr-B8)5`Q>|@xA+taYW(w`*QtP#zZ24vN;x+Fm!DI4EwbL zivd6GH+K5$w1Xm(jaoeOjtH~hBk)W3F87Dipl|U&-4(XZ-w7}Bd(=%KZ%4r(=QQ8E zMV~oN(pUhHHdh($;xNDgY(HCW2n6`~osMDfk|~dBG_j57^;Q zW54g-S1qmBSu2-&5(BWtGw>O}?Er3l{iUQRnTw-y<=dC<+#It@GiM(9gpicCK0U`sJ`r zb?QPVG|X?l⪙RqusOdbc22bHUhtZi`p&rx@tQP8@8;=GCt-QopkjeN52ww>8@jO z|MHVn>~Z6g37YlHU85{Q?q8#_P;t+u*$N6h`-+{Fh#f#XaPfx$IFEO4@p^pC89x2v)yl&X#fp#LNe9B#FZ$XZZKES1fHe$)VTZ>69}ZP>w>-&I%GRev;C;Nz)kB9G(5 z{_b~t{RRj4g!toak@!85k424c*wo|d+Qyfk`z%N^cUKe-VAzG<{c2Cl$)XRCO!hzl zdlcujo;QUD(0uo}>jh%KGkD+-6~DR0l^j(3qK1!i*Ec7=POG~SXn9-xOWoV{^YAe^ z7=HD52UbcI+DPaJCkT2Rnsc%EzH;8_2m&0(XX5Zn!uC7tbWZoK&JU9VV26eFnE7}G zgl_na@#Dxa2>t!9ocB|HcaSj@EE3S({JXr7y_h1A_aopJ(@X1$a$=57(yJHEM4EpW zT!4e(=#w3<^RC2gG^6r^ijx zB=YC5?^1_AB5TO(z`F&>`*+9BU-hOOJx1(sLV*&~!vg$NJC9+cxB(OzO%4}_oegyQ zozRSTsLuq+stjj$?rwxei`$Gl!PYHy*o}{tTUSC% zww$_NIsh0CuB)ezT0)r^@a2O0vh8B|)^d>SZ~OVX4KQq-!tWu$@E$8$$o;!@<;RbQ z!6iMi(eRw*B0qqgGOc^@+hM-Jd7%>U{~j*7@BWxbkdlqQAMk_fX0W$p3V2PBg*QE{ z)uvSPSxFrf>zq^*8pvR$+31ja(=i|>7RU(EE15gNu$6INTvvpwv~YVR~L=@JH&-=ml*q^?=0lqWKiUoKE ze9!Ng-=k>>zX^1*wuWy7=w9l~xAaoQH$l+StDVUE03$P74vSHtsnM&P|=8& zuQ+X{Mnoo8+Dw*T0Z-mN=SIeZxS#D9S5j1=knB>2nGzf z?i7OeO_QNf=I7^At14;U$n?fGE)+sOCDW@;$au%Gw^S|YNR3~Zm2&GWKOwz49tWu1 z06?9MR}gbl!lWbszz=MF%~vt(0Bw!ZIIZClyBn@3)KP-8Hye>`mYsP`Vh`9;# zX@|a!oh!1b{E^9fB+z6Y!zj4Z1weCUxPM_D2URtdt{!gyu-p$&AVvcagRw8OMwt`a zZ5}5mIFtx^Z=e72lAb}2WMA>MyBGl0iHxkQyh-|tQFkWId)FHZ!At{|25(^fkCO?6 zmBuZ49+j)3_4d3`rC++%XZ}jT?Slcoy{YkV%Zb`MR zmD~d<8AulA%WL11O04*EdB+vf>~MODG0Q9ZC&Xu$O~sa|g~RNa!DJnYLn$uzQ`r*z zB*S--fg}hD``vpg3*E#AwXsElD2j}aK-%8che-3MXmOlK@iKnTh`gP>G=`FB=*t)x zXx`*bKbU&`D}c}liP%hn8<|&KjvIwnr(H0%21UKnNhldt+#I>&H&o;WiRzQ=ciSs3 z=v6iZ+$f^ls>gmqSVd~YdijN@ssYn z<)30cFt>Q%J|j*r=0@Q`=P}}dM*RW@U$p%H?zP&~HkQ%i_$Zub@(M8NsP}NEZvHS` zxKa~u>c|@cJupHBtU0`;`c~~ca$T*TeE6BHocH!aTJh4gMeNLjEfwYy2tjpUI<^(H_-lH3 zc7vNfex)pv5dyrGn`GeOI;%LT-hOT#Fa-wBw_9hhKSpU-b%VT#re9Y@YyUFVKJT;6 zMs5|~IJJ;7d^$orogc+oQX#HwdR1tb{lYps+klzwe+vP3R*L^EPPN8LR>iydP41}( zKghSTJKRVc1f=r6P|4>OqzC`vxxj7w4J!5_gJB4LnO@)-2Qni&IptI{!5fq50uWZ>1Tx;}7EcLaxCe z)X@7-4$zzV`o!cAH->tiwEV%Lc&q&IcGGkP%SrjT!pVBv$hUbD9^}+QlAJ&-@AKsR zVA6ryHq|W;enemu52A{`D509nf8#uXkV?8e^wK|tq7EpN70ihi_iOCW;S@P5MD(gi zAY1fB0-W1$uLwLFQ^4!UxP2OlGQDu=SUqIi$B)9Db6xe@2R#=12Yyxu&pFS7^_l&` z#j88xmmtv&qLmiW^%>R&AX7=G9+8JKo9|7jxC|GH!;#p?)=TjqDwCU;RGSGZvq_@T zrywXo^#5G;3e{jy5CjFh@UV`uWbhxg|4QW;=PhZrYx`%V?6_Z+=f~Bi=Xfg(qE)$Y z&A6G3$TO>ISvM*wp`=WMZ^?ALjpsA0t~{_bB_l~r(BI4MkP}8AaTdVp{xUhA=)_5= z8o4t<<_$hw=xVedv)%R6Y}37#Lw=p>u8jcQe1`hSgnIVsRxSR=4&}Rw3R#)LZ)g9U z<;wg2NF%%m5@LQ=S5{&gQ{>kQzVQo#0Ae=?)Cn-JAj`AnyS_+Y2Zyx8*Zn$ zyoa`S?|u_DEQ-(2w=#~J3vE>rGM4t6sDF#X85!H4e>Mkz=VH2VaGwjb)&VG96-e4R zZ5fZ0ZLW(guh1<+B3;KHVFoQ0XLLXyrbIt(X&MRFsFT*Vh0P~fmZL6a*+Jq_kBxNp z+&E4zGi2?idE(MK6r0+vD#^=07u1#n3BO9=xyVC}z_#)c)Xi7VO7^WmZG7dvHuykp zjE?5k^L2`I0W@3rg3*@P`SU2m>{J;kFAh51oJ@=o2tJ(@8&lvg-hed*x2Kw4WunCuyASag>zEYdlWT24mM9K zw_S7wxs1Im=JWcDDQ1+3A)t1Rm=H)uk8L@nl^Cu+kF4IC&6fGpoK|}bs{YT@wC45X zD*I1x7NF+J$b4gLkRYOtS8C(Zi^;m)xbIG-cEPj>u~PCcz}UH+eAOs}%NFijtVaHs{&xE4)bZ89 zUvmcXH|cmo1P6G!^xB;(rVry}OzoAe$oD@c6QG@AAf&VrYDHOw#*im&aH8!6iugCu z$g>ZQXYnA&D^UJ=&Y_#QX@F83-&2L|S(TOIFLHn`Ux!p&8hu|tpC>FS3xwo-+EKAt zD-XvJ`j)8=UBSdCMlVtK_Js{mw3p>xp6?u&zaPQ-h4H4MyDZ7GM*8a}g5oUR#Bf(s zR|=wKIo)-jF4yGhJh)}-p1S>?wNSS^QhX9{kNza20pvS;Ks57E_u_|`?0n11z9G`J z>T5cc(YPOaZI{IUyOJBZ2lUv(_%hm3_t6dlR(g0I^6F(-vDX5EwDVv;5G%Z)1@H#C685`jolnB%k5c1V#wH~Kt=NitkLR)hHBLj{Vm;jyrH_mU~X zaI%RQ-6n7Pg{q6 zY#QA&thURT2Z1NY%&gq@^RAzO5Hs0PLs#hQeQ}P8FfE>g^*yBy=jQ;TobOdq-Kx=Cu&$yfW?J>ZprBrt2UT>w=GW(} zFX&^)ckf1ftPc2(PJMflmr$Ze1+BNooz)jU9{?ctaX@|~%E;~cjTq1g(0?Quv01Al zko&k?yp3f$`k^0J?%p(Ayb>uvkCE;#ID()=c6X-#2*WZ(&Oh{Uo{3*Ww!K#w$a>#*dhG z%{zDJ+;q0DHQ0sEK6a-E*~YvuU~bSt9UN5BOym<=s*$<|9jiB{>(oMMX1!4mNDttlI-Z8+zx2y5ptPuIvyXQ zSxH&r@zt(y^^HGO68%DSD|Ww9rjW~GJ^-WTaai^Qz_T|LDVfbW?k6sji z_-x_d@!5?#$;QkTnWF&+=&ta`*;QOK0HAqi5;V44b^`%GwWLO=tqqnNzkv;%(C6Q6 zbLh!DA1|R}zK>q!e_*KU>DQ<7b2)2y;`eQI?|d&t?>~7ST|b)h9mLRLkqh&F*p+K3 zTd9TwmvCp)eY~(v*akM&xq!}J$56~zz{sKjPo#4dZ)<%P< zOL2Y#*z((ZX{ZIT{KQNK=&}EgtFsKMtIOJL0>L#9+(K}7_uvvVxVyW1aCZ;x?i}3R z-QC^Yx%=(z@Ah{uKPZZVf^%x^z1Ny^%<+7G%4@~W)OQ+j!t;I$dZ;oO9&K{yjs7Y~ zXw_wk*L?e!O7Keb=5)Lccw}b)b*=ew&DoHB60%CQ6Ok)*7fc@-lXA@8jXVW!dseO8vNtNd;_CI3l9OX`ZvtX9nA!Wf zQZdG(*?wdD%CBnn)Kv2XWvx{L%{l#-CP$TfThlX%?)*B0UqRAszoK1-;MqBTH%c>+2{+2a0v&+bs!Mh*Be zZLv=2efsyd*ixb@%LlKEe4t4*SrK)B>Otp~T+s{uPx8Jg}Q7d)zT z80F(7P?1=F%JQ1<@*CG~l2#w2WJc?D-8>xfO?4jXObZ(>nG`Riw_K!iz;=T53yA9x zEB;C7(BPViNDk9C<70wihZr|NPuy~Q3O6Up6l?P+gU!~1FG5VgkZ7?6LgIPAN84!r z7}Rl;j|?Ov8qk{y@WnZx)y84B_!iz)H~giPfYps#3O}&*V=!bMk8{SFJtjM3=)503 zo*E#{0XZ!45o|7+U&{m5_n^S=zN38eS*;F*VEzq(p39J_{qEm@$&?$ix)6B`r~X{Z zK#1y(>tWC+_%1~k3;^l(d12eN*k5$HWwNf@Uz$*-=U0h`vHqhp)zNB^UMrzNG`M_i z9$RU-JMS<&(1PxmqZ(|bLALXc>*sHs#;DD&3$1dhU*xqvXwq~pCs9316IAzJ@mwxH zE1qqxWN*spREwFT{R>iUp~Y`AuOqG5&m!eT%1QoTEYAZ3u=CsR8@x_#UBjq;(gzMv z_J%Rk(LffEOm~0w-sRKtujTM$_7mMEVXsYGFT|isX7?eov1OUm4zLWQwx9+gx{aWq zFHwb2H@)- zTx`{q_$hALbKm9}6t33b$i~f3_A zugdrmv!4KF8L#;+1&C3|$9Y(PI-L2(k9jE`2V_5#0R~Ngn!Y7qEtuZ!j-AJA(MN-2 zpiZ7-z2Ll5y{T`&|29yoCJsuV^_XHls_+|VdB9;bzLN0I#fpdoe(j$C1kRs2AJt5& z9>?9FmMD?%Ois7y@SyxTjLHo>dXLjtjxZ~9 zUV(!_m>DZR>TJSceN_apmF9aahwE-d|F0^Idg)7OS>|S$zyIFj@vOC*U!1)}%7%HF z*<=&UC#=cG>rCfT&@SZPvQo+Uj*oKNY`O9@c_dkFaW5?=TzjuMAf2lI+c4kU`{zpYg~=OfIRN;g zj~T^uyyVqvT-yGVZnzJG<*h-%e`M*_0wXPx=81O08}*y%1}hZ>`G+ULl=j~YS|OoJO%qz$1doy=NkhxS5nnMG zYaifI`CiMOeBv;WRoZpA+BOY{MP*Xfj1Q9m%e|Yvs@fLnC_l|}@!bHUk#gs8Saa^* zsmvloqcNCr&TLJleki)Nj$MN(L+5)pAug4CnnoQS%L#N6kf(FFy>rHj*OqMvn|Y*3 z!nwbumkjTB6Aw$$$_p@x|Gl8lkLg|SxSx_*{w>|l-6k8p-JogsqR@#u8XejoNO9FK zmhGJfG^fYa+q3&HcreOVfB!ZNYL(MEg9d}T=G3f&BX6Th^VuZ|e9c#n0wzV6oR^*} z-U7RSyCdL3aCriptz=6#g$mUdd@C4h|9nBj?DJ?r@;xBtNvH5~5dh*X`D}10!#)GU zRk#ecknwf^pB^o*@(d(aTJusz9QC3kz67~tc0~-qXVQBPE>e*D;LITNp8}Hxuy+9y z518zFyLlu$g6fj|JjY`?B=Y|3kXMG4J%59BUi)q?r3Q>@}QOT%jCb3HP} z(yI^MOlWrmr2|H92IOU04baz&sBr+s=kJ!$Zc;S8S@)E0x_IP(41)r2`=WPXL^4K{ z1H^2s0Sq+u{~VSB%h#^=S^+{9J+7!VHQL{7#-~||0FzqbSb*Kg)RqXd;4BuSR|cy$ zR@()y-Lp6d0b$2@)L4TDDgv0PnZANs&{N$K7m4`5;xz-7QtokY--*i4EntJKb9c@5 zM6S_dd6Aw2+b@QuFNEZW4Wx>qRvVpUxc4bGLM!Z9FQ9&+mXrKWvFV>dqH=BcNB`f=lEDA!e^KBeOLjzMQcTmgXq}n|P z9nD1lPgO$p;$IIYU{M^-*QT_-`nL|@5e9tkz9RRzi|HQqp?>K9GU1Isno;!H%G14T zDv8?YnLtFIS)*i%1kCbIn;DZwqfF$$6_{sO(`Ckp&~zK@-W=Z^EQTCZD|p?=_5G2H z3kpy5+MX^qVUvjk}S4bRmz9t!(24+#rz2K=t%1(0G03LaKoIxV-I9U;HQyJdES< zY$QH$K4nR?08SfsS(W^_ikL0*SXc?3g8u9)e#uUZ2+<64(=E7_~lQ_s`ckM>6tET=J_N#>NHnS^3;d&VQK_l9H#vnEmjh^kWO;=1;cc z{0YvFqx3nKPMR`-C>&qHP9#ZWv%0Mo{J=7X*=vYtMS zOy!1on)M_yC5LmYyd)N<`8tM=ft2I^T;KZ2?uh{4919oiC940coP-eckAuMw6z(9* zNM+(7!T5wstl{;gd0%0Yvll0O+y=eh>RzZgAV`uIX&2`-wm&ZEVv*>(`H8REQy};C z^}ty~MU`^v=M4XA@n={hf5C1_l6-$C2}X*LAAcml8-GOK#@1iT|K%Uqqv=LgUL-X@ z=@uunAaEVDj2ZfcHhdJYe<&Kx{Wr#+CKuPWW^X65Ni#tBAYO^%l&#hcmsFAb8V?)BtjU7`ex0m_d# zl)vahCKa;3y;4+LdyW<|Pa!;-L_LP0ME>i^_~$O*tO;)iJ!z`p& z^}CTWPf-*W5iYKLt4_OZ9i4Q7WQf~TLXwGh^p_EcpLy#a8Wo$DZsXYD@s^G6O&s^X zjN(6yg?7UK6u`YOrvDmCE+ETP7g0oYi|bQ#6_Gd`|0VRqk2r8kO>TXx^QBMN+7n5Z zGMvT|I1<=a6*KyO2}`#BK@=~9{z8chf0hCv!WBv}xK>ChJ&K5;KUYM_**)X#cJLFM zCH?;|jXTP2UIP?n=Q4kH&+sJ08aK^XlBFH;TmE|rWc6=L1ATD>;{Wfj5&Z{CcucGN?UhsA%LZ_on8uA zuA7wqPAvL2t@)o8i}%z2^zGn^Rr;K?M~}j|JQ#x5z>plDde&u`W6-}T`brj7pa5ho zI%yP9tlAG6ueT^E%6y=hfd0#HZ7Z1x+5StP-!`rfK#n;+g0O8Qv;SL@1itEK6a8-a z05g09-^o_%)ZsGSL=}H6B7YU0RmA_X+4flN6msx(xTfB_tAAu7A-NszpD1zMaX}z$ z4y4v$Av3Szk1m5_S3$CrW`xG-s0nOQ1P3iglYk)pXYI9vnbWIdxGDZB+1OX40G3Tu z49g2ktxWAROQ{T?sZg>W#upRV&ppB>t&DT++s$;$XJX-_N0u~SmmNJ1TY6XV$JK`R(35bh!EtY8$;*FPpxfpILU=m9z1zbFiFT2pzkL`J`z7i>3xk>NOSB_ll3doA& z!{>xe_)zZ`ap61Bnx*x0(euW8fYvgq`C4 zF9pQ*`IqCza-lg5QP~Ahv_pClp>t*zLICfF}c;`nmtUxEZe3U|jR| zws033in;&XK+aBLU-$J;tSL&~On8@a8Up!N;?Dv`w(@Vo zO6fa3{w9GrudlfSFG5n-C3SQ*5;RT}dR@+f}Ji3a6Z5FC8&1EIkrI`Y^ zQ2)4I&yuJ@MaNcx{XGzfU+HEEB6cS>kBTM>jjgZRyaz3}1F82!&Q#jh0u{T4fA}~; zeLM<}MiZF_ZiWWCl_P@KVCjN0aeW$|rqg8iiR!p#vYue&b1A|50;`x2fSe`T+Z6 zV1h^^fYjjX=^1ixA?*9{Tn8OfW4nx;PzKOQ#7RS;efv+X_v4S>H8O#^LXLz`e z){d{$gYW#?AC@XIUkLgu_bTs$;~9l@B^+JlW=z>DL0#Nj%%qDjP`keVXm#if1EV5o zP@J#NX3fB`wi`k{D0AiyJo_QDKLOKpSVahBMd1Nj^0<4e-PdGi-}i@MRX6tsVWkK3@yWU-oQ4H*m`XKlgtrveT!Fr;9m zX0Kv&Wt{{zTKHUIvQJu*7xr5V?Y&8oa^%d7KOmJCvCs>tM9I%WjITbFm%YHVGGP!3 zSQz1bs_AJt5|#as&i{@!Nq#6of3D@~2l!oND3C^A_v`)!%dW^@D1hAs=AD*&E23Sj z=dnhUHROQ4Jk6iQU@f2#ZQhA;!(X+-0ynlB@>wro%;)z!O2w)YSC3sKQ*$mge-mp= zwj%k>>Rad&BYQWxOd3%43?GLEwhk#V;HiY1hFX-yih6<|BB9rj?_@-G^cSF)5(Mh9 zHpwiBAIh;ot^3+xX_fR*XJANG71~vFd;jWODh~=~w6x<_K0e=-3|^d{@ONG|^Iz)3 z*7?JCWfs<>?^2EjY2a0e&7VdjsC&+hN3&%_m~97qx*u=WFa1I-XyQSf%aNgPmVR#b zN0D*7IwF!-<>lG-knYnxfmWq>byucA-`wi{SV5Y3G*z)*W#d&J^647cIHz~&*hj|g z+7@q(+C|;b=<9$*N?+%Cw9kCxBf_LxMEfR=g1gu4urLR z#g90$dr;At4F{Z^$R&=cT)v+;w=)R2aHxCPvO}gb6CN2#X$fp#d~LC6=kjR8`NQA# zQBz=@^$zePW(ewrJk0_J)MyZan1QMry8{061rNhHrvv&bIdvg2>=;^z1*Ct@sGPRWr$mY>oM(d1Aq=&Lc*3K+jt& zb$mRMXq{_j!$ZL+;r4Ss@G1C8^=F0vRS_AjX4^Y0IZzLQL|9UlU?JVF^ah8IkT3}6 zP*s60gG815T+aboTFn+eCXx1Q46v0|-E5ydC9C_I#m}YJbbFi{z3?^W)hQOsj<@%@ zl(2o?7239K3+p)AVAn*qstVuD;X@}Dak|wUg*q`yeF#gidj7_syrDj#+fEi@0D}(~ zG{AizS?`+8k)ej0)cVffCbJLYp(^uv`$bwirOj@n1P|(0Mlz}!>AJ~qXMcoM*L{pn z+()S3CH8=?h1k$g{{mK9Uy>{jbtb~69yYvn^@nC z&VW3Ru9+VPB$kM&326+i5R<2%N|Ml-bM)8l2>tI2MkmuOZ?V%YKBE(0aWJl2@4*?I zlpG)W2hXb`2d2mG4 ze6`uW;hpFbJYf36)FcCcmI;Srw# zlbsK2_n;8ek;NJ@bUs1OK-dPuCo*Mc6k%dZhQ#kvh?JxcgY5P1bik(KzZ;W8IFt= z{*{W8s`pU1zr-Q(mi{~VVG@7=h-A=)mYgc=)23G2Byh#%qNjEPpDtpeKMbSV z!!d0lc^2^&7(ufm6y0_OF8boIg>pgC+E|QE%R`b!8AZvmN|}eY)8J|X=-kxm{(@DB z&HFU!8~U5%u-P!vntv1)I|*S-@Ph0XchF(;w5Dfh<>ld&hNgpesmrrCnB#71^k>Jat=2(ols~% z4i3)F%s=c-n=@MDcj%aZ3bY^aqpa3VT;B>rh5;;rRq*Y24Ob?ff#@_(jyP9=JTWJD z3#`{AI$gT-GsV!zD~Z%eUeBJ&54tOVasCKq1t$W}F$#(AC<;TtF=;44fz@AL-!zeK*=cVdA zP!ujAdnVx0)vA@LZq1Fa*UZQFX*e>N+&A8`sic3cdg;%%yHibk%b*IwAgS{WzVD2u ze(*4kx&uy#t$$@7c02MXYsfyNGvLrl%T)rFJh*&UBGWE-9W)NwdjLxd1deeBTwGEZ z<81mTDwYvuoeQ`c$zPW@KxpM1He(`n9^q%z$v=u2^e4P~HWX{NhYmaSYxU<`Ru6qY z{wk^Hrm*Y3|JmA!%4{*Z5lQzEQp&dKeLPBcM>w9f-)t^-FV`Tm;FZtlaB^Oq5kOyU8E$ z`b}{mrBkzTgnZ+Bebl{XeLMil=s=I9&hR1zXxyD~cr0&4C1K+N*-~drE)E~MJAsiY zb~{>#tias9CBS>*{RmVz^c0sk$}zevPc|UR7y;} z?s)%g)rK)eJ!jz0)y)3%m$L2@vT<#)KQl#oFYWqpiIp93s$vpxOu-+86PnBA7nA32 zf#qv8WbtCyz#zogY+ou~GoY7w=&Vk4!ktq0%l0?26}4PDgi3GQ7xy=TsfCoGd z-DMCL*2+D;)l&9IAYRJ>t?G>VrWj`!GbbDu`BcSBl9l5blmB@4Z!jFbasOi|a#^l7&9P%7@2Pi^#m9M<9-kkxJS^;BK|+LFDu$ooNa`3u8N<`2oqz z5*x;wZ`v646SMR&F(d!!G4$Tf>8aV$B?Lc>+k7i#CW$8FGXFLR7;(s^8RK%u_ln!dmOls8SGjO?=rK97BXtu#_>(vjdq^Hxs9 zw@qO@*FE;6q05b#a{DPvbnI7q8gU(D6A*SoO$+!XUwL4fTuwcY{m1Yg~l zyTj;>yf4})U1*=OJ$hvU;i3myY4ko5@g-)DqV-KiQ`$Ix z{?jP7(x>n)yT5+L@PmLP2WUI_8irQr4ukho@(6G03Ov=n4XAv^-%YBvIpgxO>WO^& z)^2cT)K5Hu}!GjkO#K}qyw+A2`Z~5BK_e@}_U6@5LQR({d zleqHu9PWJtGW5}>KI}q8Ku7i)qer*HJVPKZcx5-NWRPyvxSXDINs$Bw>#?-ntb*FS(kc|=@PZ|E`5@`;9>qNW7pmH*M`en85h@5F-n9WJL zd@fk1RJIX`Ky41MABbiC{Vg&#nOzE9tyi@mu(g#F+%~Oq&_IH5lwH`#W2IfaBg$;v z_$Za#ysPQN84IT+Dy?7y6UHTqwkQ8m(48N?yM?0)RF5!0dyu~V4e_97nf zz*jm~BiMikCA0bEk$xuyf+@EO45J*7uE8;&+wJX@_@qz1^8!-Ub@3C9Me_XSwfC51rntCXDim$@s`n zq9E6nw2x5(qkL6t23nRvQ_AOCpFIB-yu~W*01_M{>n2t|2Y4V_h9x8s0$mI|a+XJ; zn-XiHr+f{1_1Ep3)f`XfeXbUYW4$kofiP8&@)YICAd|ao(8~FNGX2R>`l{Uxz;m*m z^Tt-z4ym)3<&>44qQIp3sTHf22Ac?bS*{(OQmE4rjKXNwm_fmT43o;aZcvohmb-Fx z>)Md^amTsU(W&6g(T?+-VPPw|0Lne_=ST@qsYl*JXX8?4Z}PYZ18}XM%NhC@&+s@K z1?t}DCg_IVu>p$Q{JdpT2-hL!2Sm+NR@?mtb#N<`I zuQI|)i?2<4@g?c)ZVlos=W#QM{1)Sy62M5^?raJio8`*IZNG!aLU#vtey#s`0K&LGqVk?mY&T4r{s03n%)Gb{Pc53 zzmRspa?z|OvCYcccfZbJg@&pUSK;g&nt}oIrP_YF&h_1<8)w$U0*Fgr_qw<-EM*l% z5l4hVz}d*1n4Ec>#77PZiqN+oMTe!O8S8(4BOBMJ!Lh2}w4keMQp!y{?OXD$t?kHE z^dHOMw>#}s)pUbz%~Xv~*A~d%AuHU&zyWfFH(DJrR@J5Gdh1qyt{vZTx!vPA-EWuY zFy53kjfjM&xLu#JNKB^k7+|qG;GXw={8D#neyRH7qPDfYZ3d@=xw_|;G?SX;(^XWj zf03Pd|0LyFVh1`1IU zTlNG!`15YQKL)hgX`ga^QM_LEp{V995c*JhkqCJ5g;Oh_BGWvh6+LcuNmPB;PmR8T z%oftIO&_DbqPpMVXqD9Jq6Kt5EUI>sY>HLPT2f(7ts0seQ>%ELX|b+=^!zMGXX~D6 zmIaH>Yag5;Flf}HTpeV^0~~Me!Pnf8mTGo%h=H)nuS0}ru3#{3xN(>$b?IG~nICT} zUVb9_n50{aQ#-~wBGNvH4Qy8HJ~1I(F3DRFAj}~f7B$b^Hn$tXvz*0ldDMHRP)x#6 zL~Hu5!6pso`>P}52B%ZCvnY`RSWGPsnTM;Mo$Wx$Mx#kk&Vme1BD|(>u~%E%d$IAC zG3(#WZnC$sKX*9cM!&wI7l2=p?M{`pjFp4Y-{yx=18%Iq0wEjEThw4MzYyz-`Y)@!cN zNO7O^`u%;29x$2R02JL#L{p>8=nD|H*ZFk>Lvr=F{6z&EDWg57_G#%0Q)NfVLRwBy zd`@6wn!k7%{O( z7SIttP$uX!K-J10UlC>e)jlb{9yfUFRZIL@Bo>6uL>}txf=nb0R{c(zp}*{SNE|?? z()3xoxwmA-V^T_yU0li%SBEv&-16AR_7pO( zA}m#k)vY(^6X`!5ZyN|!tumm&YxBCn*Cr1{8tSexfXM263R`dilY{4VyZ!;5%=|6j zAf^1#Cm}87=vG7~y=6QvnZvkPYV^m@HzT}UT1Y}qe{knh4hfO|STbaN1VRRIOtKxb zrBwKG(^~W`0|~0qx?0)UiVfd$9a)GUFt`EgCJ?kg;KJaU;;*6*9vER8zuP4?iEBaf z?a6|HHrg}8y7Gb^fBjN#1+LLR^maWH1ZNvxcj? zOAgU=-*OgAd^IdoCsf;QjuLQ?l5HQOhsJ*#-4BTO1oZEPF^r{@5a-T4eh&JUl*$l7 z0;jJsd|CCnb=2>tK|B8z7?lb#AxR(n>3P45=W-njQm2<64@SvdLz8C2!)7&?sg$Eu z_`@KR+-?Mx!EPUbmVAweU!A8z^G;V@2ly78Zv81B@;No)Q8PHNclkr}9`|g|ax;*lBjLla6E}UBW1UH;=bUPEZe0u`xjNRm^=Nofw9x zHcrV;k+M%bsgc0(#0w8~Og40;Dk`mE0MebxBClcMRh8j=Z>5zaFo!Ho5w|0hb4}+ z72EO=iys5JAr06p<`eVfod)s~aJ)>;F}rxrQH~E$xd9n$R-eut%1>uOKqs+C48?ynr+k`St4j2Rru=^q~6HHMK#;*>yD>o4Ug>f;p$-)iWR=cfZG} zF?-whmFHRMxly)qJe@y@qdQ@?m@g3@xj$>Ub-CD~gW2$k2AAQqyFR_Gdx}u6D_+YQ zN&=lcV6opW9^GgJ;;>kIUM^C269bgPSq8s|l`a5f@6&32l_sqXr2?umOF8-tBIR6C zDYcWkh$^1C>`7Eozw9`y+wct zY;u+XwJ?+0IbV2XJV+)Djx3h=MzjuUDFCnK4sidY@&eJ!+GEWK5BQv4!%1r4h5=8( zMw#P)jQQ+(l_T4c=azwPO163B=b35rV;UE+n=d;+4m%Eu*RkKKUMZE16NFB8Pro!i zuhDc*YwV6OZS@AP$9@i9i~*gY!_yK1kdWR7`7-U8x^$?~mTG&uI!EgXb;j*5z4^^K z|J(pWDvhB*x~JeSweGo9NfW*$(TncQ>wZyurii4l>h}382#`EzRXf=`3Ba%@VV0M& zSsd}`4EC8fjB7Q|mpQ&X|5B?vpMQFJRp;2qcwq~=O^P%z-@oM5r zt8>lW#(vr$)NAZkZ|g=H2-pR$TJ6Az3>F_LaG$ru z+j`s|X9Iw8ki}~K!MtCZm!GJYMy^%MI8R5>Ot755M%&%_z{*2NC_L*`qtDb9oDk?~ zM5z`JNN^>`p$_93+&2YC>`DFGx6vG+yil`JP`MPHg4YhP`VV-_;W2+^Fh5RfC$yT! z9}Al$L-IrGV|L z9YK?cM4lH<)sCS}2Gl6+#**45LODYtsGUrTa01e?j1ADn z=E*~CGDVnD1p&L>>Ji)myb}=CVEPZk4vEO;bkE4ToA~=5rA6mu^-EM5$^#AFIt|xD z!}%nF@~q{oFASseROo0ciW;-iG`ta%LI|W<+IzxD{Vf6G@$?-RJovP?YJ=^HG|we* zv(a0@s4eZW48fj$DFCx~PFcs6B38CuoNrer*f)}{ zj*LBFwi?QNFVVe`X*bj8Ff4SV;RJ5$Raw*L{XOVWOw{kPV!VpI-HvPx7RRl7xdo#` z)YAw!T#oy%`I5?(m_R`*A@u=z#%%DXR&|9_F1jgPA_HS_TUEC|hzAP3#g^@6|INba zc9EhM@EMploE|ThBk70S$HqeV>-N;p>#xV^=8~Orxh>;JVy0;oIGxb)9AP*UE9uoS zFn$(%(6X8ehmd@U!gN1>w&XM)omG7cittI4#r_h~)Y-{ycm299I6x{b=~w+FS5Ah0 zSatuU%vEw4y?l^rj)23xcwzIaePTuP6TR_y%^c9pX-tSY2_aR*#DbSX2xE(vQ>k|w zkyh%1{H0!lNWYi}EHU-p{buxr`)M!=#xZ|{euurxqO0l3L;kg(3|#c3$8F&&tt#a5YPQ~gs#%S72Xtkx7cz4 z-5=4Z4?7t=5S&4|cuTMww?4Hp1VIyDei=NhN(s zgQyVr4XWv|mc~2vIv%@wSSteyj6^g@rDIuJ z`ju-#Iu`1ypIgX;gf-pngZeaEol;eYE(3RTVUiMx3aa6!FF-iVZ>>t6xYLcoTxw&m zotzhlLWcqC;DOaTj3qMKjX6vl$s@O72l$@J-$w^V*v@Od`=es_09;p495x6Zo1ZI@=Q`?Rl%kVrA|9>qb+ils?W<`r=iC zJJH@+nle`QpwjhsRAb3sWqabBp4(-v2x|4YBTAO*U4(Ca2@ns{s<+rD{dF8+Gl!iaGYLjyB8<6~R{Q$gZ(gLen{jj<$CDto zB#Xp=xC2_p^QlUa^gu^!R_o~+yp!V<0xzuwajO3N!1Nd1$C`U(;0bv)pBfMb_b>oD zc06aA+(ys~$IZ{q>yK5eG&L6qo;n|*n){W)VSSwT#CC4f*uzlBXLmfUIQ-En{q|L# zOuI2g>$mQz_pZ>I$XKJu3|`|`?2mD%%&N4ECYJiQ+Ig zpR{j(PQd(}ItOhZZbIquHwc89Ip9JD-1AgB^yviSB}GEU%Nkr&pe!r8o8#I-i;&u&S>-|V zek&rRRl&F?!bOFI@1CrVD^0A?h1n7yV>bV?T?%Q*`Cwo$Z`}`BjI~l?*@DD)b=5kC zr!zZsm!E)6J5N2uc44$WGD^U10Z%0(*A#<>13uUtx@_J#dAiLQ*fw>ft2|StDJrkl z_8IbgI6}SAOuNl<;~23~Fho9A|7~2*uV2bA%;ou56Mcwfj~01`vd&|>cq7-B z!=x=2Qs$P;Nc)b>V|x$TDX*KfG16n)Hl4H~jEwJX+0mCti{<Ga<2A~_AfK79` zZl6@ya5kGj6VrA4r}P$!-2j*nBjE(UEr1nCHSb-70jy>1PA{x4kSz;bR>Sd;Yb}{= z9vp97enytdQpv1i+jcS27$IeAtxY0p&0$LATY9Jk5fuE(z=TK->)vvkRDD8~9&6?4 zZ+!H4R;!s9Nk-~#!@ZG~@3Clra!AiwNVvwy1O~f#L`i42Q9N%eT5>Hm!Tf~9s@|m! zn;gpHaRytv`j>7}&$_hHC>5=t!eX1uM~dDdN?(xvj8+Xh2Y{MEIMC6yQFhb$cKF zbxpgyx`%_^a5Q?4ky`C^9lmt>n|4FYn2FP^+u)w$fziHVwbjpBG(5eCNwu1$C9Clx zdW+}fVIXKJAfRU;5|7i(LAR+fpCZEeBUExtU>G%svlP#c(RQDE@KZ%D%<0+URu@c? z_2Mx8bN5(FcHZMoPkK<~oW-KWMfD76)WlcVjS(tLW~0+l;V|GepjT>s=#Htmq9s`L zv2(ecHtyqb8Gl1t@yo`7!+0QI*-|q4iYFk6<;bjB-!{6P;8)%qnA(DnK>}1}&%5$LNkIPRbN#efV4!gVOtS&$vm8xP<<%arq zeUGW}4L)QvHnh&L6f!E+flcPOnn9gZGEe12FhgO*dL2Y=AL&Z0>DHvyRZy=Nii)S4wni$ici#XAyL_p6BGwHFEZ+P!o&$*7X^PKCQ8zm0 zF*q$6GEMuDw7!+eVr_eZn7;H^knFN*Zcnqy!LabWtzx~|eP`U$DFyi7Jd@+-+=)B# zUia6a%vmju=L;v=iMBDmEYWptJ4~x?RdSsV7AyFPMy9dbqx<9He3w3DSt6(<(`vS2 zV$RT&8PMf3s$~l}&TMikojzY`H23b<(sv@@80wFId&`-_aYMw8M8&K=Jssk58y=le zw!-JNua?{pxa7Ac7ik;aNIc{0x;i)BqtU1@Q9ZdQ8`p~8U-OEdEAccQH`+xvLQA+m z`C~McswFCjAl;0?nL$ z>v(Y604$(njZvt}glo6l+DCr|M62-((xs%;|Jfs{Ey5k>&aq|34Jpyxi4P1ssiC!8 zavwZJ;3Nt;L8`?8ov|A|TWC`oA@vQHNr&;BhM0#>S2ImRMyA*>F|o-Q`PgbMa zg-Mjt+LqdHZ0-C~2d&v(is`0U0bB1kNF+brDY)pTJN5d8qeVxF<<_!pJ5q}C^ac+E z5vw)l#*3;cAUoi8K(C6W`ICNP+1eMszaSHiFqHHb%ZGE|v^A#PT(@chh_=S->X^~j z`I#LRo^MS9e-ws0+14)LMMCziAfQarJjX-&wr~W5V`+Sb(;LbUQw<`y@nNe!oSpmr z-t3EomqUQlVCnpPeCI3CMi;~Fyt5x|i+Xr+Tb72F%KCuA5PDv)VOag=T@Qas^?JhZ zsJQ$ka=~KJ3_v|BAd%UnuflSNDDEEuU2#kCk zPS(6Pw)D$V6pRYGqOI55F@s^B(=}z~0h<@#Yy&2>D^^<9_R$dsz@rtd$%oBk7&-2~ z7nLtN|K)Jj6)+7*t2fxFch`<;2REiwISmtma}Wt6UjS=mFg_}o*L2&)TJ3fV#=<1^ z1}!;03IQn?^tqZzw5D(vc5U_$U?cNoPdQF!2rKnZ3hxsXlsR;62$(i|^X1{KtyXW4 zWh?c$(_8Uy-=OnuOUBf(L8i{v*J$3u?r5x{Zc0ufazoGQEh&9uv|2r-x6ld0;o*yf z`eeV-TMlRUa2!Zbd$B^lW{vcZCC_CmTbF8&YFB6j>2YQowGRnnH*9TN=s4^7?3?g_FuP$&{BPf+Q#)*)eFN&?^fk7M$nH&wCPx#~ zTWB>qt_GWK(%o-WYwRMHwu+nkKj+SMf!<4>BUmlgu!4nDYZ~>WlR0m!obYdEPvLB< z>0SNW4Pspf%5dr3UL(TOPHTpBQ48;}Ib)AZ5rX;XwCion!y?y`cXqp#%eYP4&{I=E z7v0;Nh#~nQF|1C@r;%;XnQe*E+B0eP3)T-}IcRt3P04#`4bWJ{wz9 zNux}R8osk$OeSR5iK5)|@4iNGQBzZ~S`qo+iZyC;l5xucp}XDS&KMURUbF*N;UuciCHK*Q%cqj$Kdm1g%@1l) zZ3CO3h9v=vJ)}~g%5%cuGU~29>nAd7eAIR&sv&82SNQXtA1<@-OCweQJRYAukhlZc z(y^)&Myx}TpiefA4HPn#!Wu%Uq<}=MV;&uqbVwTDIlok6*+4?IkfgY54?7|%lROP{ z879oQ}w zOJer}Fl$@4ky|4t7Xoj&Qr%i5nia>cDnw29N{yDWy(oM>&wRy~io$VCx?=jmG3_a! zfWz1RqMEyJ85Ei3a(?}*9YKau|;Jtm!8z_vrKvqa7tZ6T3Denjo2Eud75Cd;FC{u=MiL zQ$3t9CBG5ZpbYSKAX@MsD+UlVFWO!T9qaeS)wfFQ_wG|LChB@RGj=yDz_$8*lOyWBK_CST6eW>Wdae1Um~j5*tLjaS&brVdwWe~jBOs>{5Vz)tu75PnCxLJn?O;dX6G$7#FzKjS z#*%A`6kE;_{?=D$cJx(Ep>7#D$>nmeo2+HSdCnHOnnM!TZVnFB=KdeP-ZCn# zt=rlKf)gaTyGwBQKyVALg#?!n+=~Qv2<|SyJ-E9EcX#)~;jVq|J?Gu$wy%BlqgV~A zwo1mDvyaiA-mhGEYB*OB&3ho{-_v%tun2gpeJ{*>h}TM-vUI{V_YzYMx%)f52l8r~ zIF~JhjgD4m>bM$48y%<5LThn}MVw~$q7(F5Z#I&PoemWb2x^0nmMsnzW|(SXs|v?` z;C*#V!OKdkseh~yzAV=HxHWZkn*y6P*dTUU8(vGlTyHwQFtJ&o{@v>uKN938JuwE?I)|h94lqb+X-0lyf^Id969^;BK=qA%+l}D;}&%G zV-m~aqpsaefHq6{PyE_W+=%rt7QIIE>9RhXij|S(1RXAm!&Ic{eX||hU=vyTJD@q! zd~@QvF{tCfId+u6;j~6)IP=saNXGqb&3JI|5=hC@>98{_SarLaQiR{kolUb0q)N`7 zb>9p391|_k$=Vd~?R(TC2&@aA^U*9qQfmi@Ex>wr8Hi3T8$G%zU#*KQh|UZw<2X7K z8qE~;Wq-F3UU}4ZJz2ye;5yI{aosdBH`RY9Qfbg4y9}hXsnKpLz9Mls{bUmcZ*4_J zwZQ{D?=qW?9IbQnzdAQ3kaq*dR54%N$0OiIa(LkcE-jb|A}0aY{Y?bS<+3z+PD7(+<@z}HZ}2t`nYV7OUS(GU*$#&9#=+sM|3Ka0LYviy zl71RMs0Kfe7L@XmMPzVo1FcArhZ?0M(s%pJ`k5Jq4v*dS&=URacMg#g);z#RNpHyy z2mN~3lJ9ma*fD&03kPkn=1x2AkHLj+B>WgbWCQ^%r4x{f?vB{I1z#G6H0}*7q(l#9 z+T6nbkfZ_K_!h`Y6pbl*t(r?PsQMLW4NeQpB?P{_*k7G8(u46yET)?5h5(#!G6h&$0)kW z)nR;5Gsu2DA)up?z7lXcG<(Cpifc~xT3KbZp#Pq(;-7!SJ#FFqaKKQL)$DE4IVh{R z>|(Q2A=rmTC>;1XTjtydesXdb_cHNsx+;~OPL-npIFKN*#p*5xXp+xaEtz+Zde}6a zlCU|h&>3VIt&lp$Jb!FU(5Nz+HLt+dq3K`d{|ta|2!&b72RBS7 zEHC>K?N-LCgq$BaY|xJ1+c4*4gu~bz0`T8suD(Bi-XF>zrbP7o%%e4Iiu=su%mbu~ z73p9>h=m6hjEcLEfSO{rP_hkN&KnLE{1akIBf1C_Sb`jeN9oJ-0mwt`y%JAA7L#pk zMNT+f5etRSSWx*957vCftso@LpbIm@s%I`kAKQA)ZcxbVBd1dz7Q)s5gRo%15a*Pf zbAR~!w_6g964|trH%$yZc-&j($CWG8lqV zibTHjG{RLjCr)yr1qMx-it^89$wkD;W*B>PKg)PoPP(p_q&Gc1=9g>j6OZeA6*!Ln ze8S=dX@B2<483=%5d1HLJsr3{nW&3ryYXa!RDe|ie+UMmyy4_6DX*9iW^h@o-;pFcDSG=g$*vI1I zM+x>hQTri9*6z|?zIVduJ--81LWj(xEv#RRUBlO_;!-)ux5_i|cMr;-rNw|0Yk7lY z5j4wP^GhVN7DMmKiqRb)?(4Pj9v&ovwT|v~zr9O~(Bd%c(fW}$P1JtD=uVZv!YrSz zED~R|_G`5G!1zihl*#XIOLTxK+Qv;kZRF288bq6HXg#|O15X#BbmF+6k!{=rdxLh_ zuj^WhYk#0A^-=F5M5+&-sbEuJg~=DX%bpk$SCZ>C2*y|SCQ3*?pYyh1y#^%KX0Fw{ ziDm2@xTt4^WRy0|T6VSJ+u@#o-T75Y`bY15Iip~?yzl^N&xx3RZw%8d!>W5A4Sh!$ z%IFy^xF_yDajCr6-ez;nqzxep8R`2;mlwc9pUDZAf z;XTfRpdxJ${1lfIN)P;?);8uvzuMiY&sOBttGboAF5!%~>}BrPt>O^2%XBlkpOxAS z?>`bJEBO2sRG^sY`&;0xCsuneiCY0BOY z(eZUlc=LN7_2zTGR&r{c*N`O)sj@2LvJNM*Vko_UsX@%6g#!nOn;QKQV?;&LroNL@ z0<~F_|J^@*T2#?Bmiic7)DhUCXsWzfFN0JJ?9Xn zR4c;uF-l^zkPL`Tm72mT{JfJ(W`;L?B&U~*zcd0RHVw+-r1fMpg9^+8P|JZSyGg(H z0_sNYYyau1PTJq(6DTlU(h2<`?;9SX7k?6Oz%y#H4~p>{>G|4(7=S0!03FssCD5Eh`gL1Y9{P$(>U5&qCmMvkpIpC`ZmaDQPB4h~|L^7peIw>*`>BHLdFv0~D zT*}}hIvwNE-~wtR1f-au)3jQHBO)SjA3waQzy#NbNhJ|~c4iW;Xb6Xc{hExOUVt(@ zwl%h+4dc>FogQtcK<_Wn+L#tU)y)|5c{F<_3H$fRQTQpJdx>4cD;uT9b;@`Fto5Xh z|BMV$1cs+1GxxYQxG9p&bvTxV^m0|CRazq1r`;0Rjy6ZGYs2@*?wKchFlv2TB9hA& zqB2h}Y=FPuvt&{;IqQDwh0^cUFI2NkY8=jQmnv)su9k~JwUV&@Lz}NBBXMr@ zqZLh+75-$ww-sEAW>L9<){oVjhM(Au-yhQ9VxlPH^8+gS3-+~N&S!0V^eyGR4D|Vgm^a2zJa4wovv2tRw z%r(r6tT8O^MJFAty7!z!al3(DRnkV%qX7rd>k( z9+BhpvqKtwwfWA$ebGgAQE=-7*uKM2fm_m3GgLerf~$1!q0-)^ty6@Ew7uD8g@ba3 zc^rAmBnq+b<+Xzk1-pOZV@WDBBkOgNDqwDubQSze8KfB+eic`ca;Uzb>BSlDd`#D^ z*};^X06Jn*+Ka01L{5-ttl*Ts)@|$Q{uG_0HmBVZ&}4LAFeP|<^uR@$w88JUbPmCZ z4Z@%$AQC0P??Tv+-r#)ul1?f00bEt| zS{OSJ#ZJQ4D{@Q_1wsl4sZbtr<63UE{ z0NORTilIW`2NS_g)$drlibi#8b-qO=`P8oB8IX{s^^L>en*7!G3OoJ&1?5^Q*;9T$ zNz9F-@x))p1X|=g;jTc;#3@=5Q@PB(%YC2A$A(_x+bZ@cIaD@18QX3nyz`a9M7hgF zmI{dv8Hy{zU*}D(u@1kcsT$v66P;k0kK4~SY54=`rS)esWj@in$8I=B`uer(9QCWA zMt_9zakLRF@ywlAc8161f^+Go50DGLk%o~ijj(K?@VeE6ODUvZer_v_o5qF1+6s2H z?08myBJJ@KyYlcxoBZ5kb(tTLFF0HdhKQ*L5V4DW`{1m(iQtNv930oQ7z=EGG?rx#yh)lkX~M$%F?0)#KP_n7&E zbq;b_chC%)6vrDP?o{7QpN_udkN9p~FO?_^U4*QhFM*y2sPVq*;+*{9A36B=KXW*d z>)2juHdF0ZIs0~ZS;nVJCc*f-n2Vz+ejiyuT{JwJ zqpB9e#-3hYH(-fo_Y0MpdHJK>SPm?EI@}FMo*ST<0Is1XSJtFcDpUVcswZ6tI~y*K zm}SNoE4Wk6XCRGsoA{Yon(wuXrI;mq;aN6o5V%CKa6TN;@}FE132U2Q)im@(DnOHG z$Xc)~_PYO(GBf-usDkEts(`RaEGB{Y4(5gg^%rXXHXpTo=$f*aIkiq8zk(cxDk5qT zSzjT4ylD+v(4rJ)l^co3tk>W{P`Ln))p7yo+7%F#g`IABkQB~l@QCeaq-KX-=aDN z6HTNoUg{D*je%lIRhLn;c+aq+xF$8fP5zi92V|JVxSx({UIQUCn14uI%ULwC4)sVn*4!Cs#vz)Xtmz&^j?u{oB+a*{Uk@~fGJo(;-rhwTLvm^*WF+81JykHA}l6WWo_7v zf(6&-g2u#+eVjxnZsa|CtR9d6^u%_qoF;`gy}3A|O+kj`p-19+{PK1Sde$-j_tCzz zlnND?M>(Ne6N!?7SoW~2PX}&?T#HWuvi+SgiW_Cl+=aSA-K2R`N(e*MKT&&C1VuJu z*#3Mtj1GnR{6!?=6Vi_>{(MzkAAdpw@V)eNF#F6Md?Bd-jQ)kAHsQtsnwE!n3}JiHRnM za!L>>w7!KS?Qn!Rv&Gi*sv|vzxFzkEX_**R2ny=J zJ2cUxC3i-06H{sr9gPc6$$6~0HBN_iXcpf;;zm?~OVS#!WqSt<8@9L~LkkkS;+dJ_ zl`S*5x1>o($0%Wod?08eBq9GJ1s{U%6ph%i>3idmW~a)r#g#r`9* z5@Z@(9eG``($hTk+}JUY->2vvR9-nku3k42H^Gxb;eDoDwoRM#=}u;y2uT}PW> ztxbK!eYu@+Y^Qp8p42uN(Ps^}n1987IlXx1D7_i+(_gpoeX+anCMr2hf@=cda?FPx zbf9M1_iR5t4NUK^*47W+dZ)epN&Sp(o#8nsiiY@I#Dd(fR+O|xYMpa8XkfAojIr3srrJGg&66BCLBE{9G3 zWk{%%Z-re*ZoaFylN2wY12KS^KSVqEW?^&;w6f(3vqHx)F@m=}j9&sgqO+A>x_H>~ zUsYd#hM8^&!2_|k-2_TrDgo<{q}qM6OXdz?15v;Gl(#-HoY~ZCJo15~aH?5kj`rWL zPI@4P5uedG45Z8;b(UFyU4HV*k*IQj7+)FO?!nN)};;vxg8f`r_dtMBJECXGa z7sOfkA*YM0(-&8FaEfoB((O{XO{lg14!^tXTgbz`qq`^n#8k9OIaZdxdVf*Ql5=Ty z9;^nph@q&pJ$I2$u)EdUpkSPG?(pX9MZiF2bkZNXK)c zKwoqfxBFT4f5HjX*lPA#x;27<2G~ruhVWH!%ur^P3czl0 z@$c%JqW(4*uEACRL)*YOm^b%q=nXE%Y&N-dh=8lvFE(4VW~GHnz)gWp|M`H$W*y7a zfc5=U2exD$h#0=%q7y3t{4N$_SX7Mdacg$`^)r4S**j4<^M-qy2D;0}N)YU9$&>tV z#~GB|<^d4YrZtO?ND248ApFZyta~oMFLd+17Nrs2V;uuq8 zj`iYK#I5NsxyaS|t$e@_VBDK-H`9DBE!5M#X}ISC!GgySO{XO{M1^wDq0k zlT*^a_o_P(AG~zx`#8DJNfk$rVhGfXA?eC}+YDp|jX)p<$WUD%`OvSwR^(W%vagy? z!d01%Sot|5xs~g>fXh97NYE!oOutoaAPeI{7@pwzr7P)~l%f<7O7{-t@t3T!KW~MH ziL!V-VOF#>L}eB0q7bA7p*Bs#lddQ10ARwI=RNiZNzxh;AdK0Xx6dK^H59CcpDQft z&tysPDzQBocNVQNG`zD6Xh+^qc;0YQyW5mU5ktj}Tq3fq&l>ZhMT%~oIXZGWNHPug zwjXJpjz0hghDD!~gzbn$3_5l;e(7YYd2zqgXtdfstW%V@7~=FU?k`^?gBKy~%%C|@ zYTWDa!)w@*1m?@%-ZdTAnO~mNZsb2Lsf`WpZ~S_hD0z{6iFMcU`Z0LLp{sraeEx$7 z<5r5%(W_y!?7s3jegLC)~QxS7OH%5&!Q$oyS>^Z2hDlQcMFvUUv@u z-&8K9sBv2{O5iG=>|Ak=Pj z*uM*sSBIvrAK1ahzjQ!Iv}6&MnPO9CQOUMo|Gw})e15oY_;!wd-?{M(y2$t}yYIrR zXMOg6Yp%LQS+XW zgp;zzB&>8BxXt`MN#YW~r6nn$_k!flq<@Gg(slOwKAg3}EeHyF3X8mLl4Nr69qbMR z@@5%JOdZ1KY7O%KlSqfeUJVN~Q;khYRc7`dKi+H2DrwK5Aj+sOJpV9Z?;)5IVpl8_ zS0mJsQ#f-hjb^hb_?2I#X;eM=nYurQq!e*PcMyh@H&cy6%$2e;HUkKz979TunsEt>0f<=SC>`)MIN`v6!aL;xY3Y?HC|t&P;3{X1I_G(fD|8~Z(99* zc4(vl=r#_rS&@fX>hKX`2I&}I=b2H&n#u)DP{hYV)ejmX(;J${lQW}G%NI=hZe5Kr zTqiPXw_R##LTlH6k7F*?+(?8`qXT<->?xY5nRxgS#eV$cq;wZ)#iM< zdAnm-Mj~pE0)!n{J**q4JM-y56 z>XcJ!E&nbI5xJ7>F!Q-yK8B46CfP4J9J*?z^fA3K*irph4~YjQoF$C+>ZVGOCqzhi zCel)yiT#HUD!!@FX*0OC(a<326Q%-NbWs2Eobz zaK)qFZxv_{qC`+{C_NJTTdPZKRPo`a>E-)|4L#0<8f!1qWEVb=N{pK zMj&mOG=wm{Js7T_H@)5Q`k-lKWX`^Lxr{qVF{>kgWvi^tt73IT$n|x&c!YOczwPs~ ztf5I=`BH11(zK>1;DI!FL=$j?V0y@EW^+zXnfPaX?7TX@a{_)f@@=v)i8KdA%={PH za%X~Iiu8nms4wUC(#vxMr9|jZoF|CN3I$Q~?Y{2cxo7u+TiierWd2@Mr_yJyznX?C zC!vG}o0M%m1XH%JuhZ+`C8_OtZGg;I(`opoF2RP! z^?bJD%e3aHfa_DP`6{c;Y#O^4Slr>WE9er)huPh&;kYT``m{c5YxmM*mm+Kbx)-ji5tIu8gOK^0(<@9U0XxnGdiE#YgA=!<;t$5nQ#ha;EzBc6L8R8wb6;5MmD+vnl2{PTz=7*y+e49P$v z6Rr1L-MbTgOy4Wh=_qJa5cN8vB)%Hjug7K8YqL40XuUKPeRA>dXOVGzopO1;SPRY? z1BNq!Pp{pQ+rwSfv-d^SWW$-zN|ndJKKIe{*_bFQ2|HvbB^Ul@x{kUQ#_d0gI4!%CU3nk|9e7_M0Y|x#3Z6j5M6rQKd?=KxOG{~~zcA;G^07NJU zyFK2J!Dtyan$nbAS#&(x9lK^Appw8X2h5TQdW`R)E*fC?vLw!I6sYKg?8ffe+|YV~ zzj&-eOT1kS+zGfIKCm(QUeztCXu6-gN({99wDc(Oc;2ykyPtT|>~N@!NPlMHo!Xqp z^8Vtql3%P@M3*|_dMbDy+^`-PQ?%~Y=sotB_44RuC+O1RewrwVQO(!Z{#^)v8hM1# z_`c)yg^VT+y)W*sSCXhVWU8K`XJF>HL5J5l*uV?&aGGZC`)I}@2WoK`8Rfq=-s|PE zU4rR6dO|0a!l^c$+PqZGNP!rNzTvR*ep}aTbcSQtd;ms@2dI_FBQ$nBr!(ILQ$RS) zC*DfF<@r8MWVsx!A#k8u1*=!C*9l`QKKik{yBAfo8J%!W<4R(Mit#z@Jtx!?{rPmi zx#@nmJz@QAxv8>IA=+uix7DE#Q3SaBhsY z_vIvX8jt+p?P1z*+_27j;+3kydmBB*Lk7&1GCIg=w_32z`g(Epd#Dz;985Mjn$Xi$ z{%5Is5w-yos0%wc$rvX~{?ng7!-+~V>A7Bwe=0fN4_V10#&zx~$EOHKWs^ThY2jxo z<7SMVhgvt(hS81c-*+Y5KD{SF*ep^|UFyy19T+|Vh~D2&Y=VFW$e_0E_f+9cn2bIw zB`L0u>YRzrO;O+NI~E{xmfL>lDQo6_EbaWGL4A&-1&{VBZc)~c5i()#tra5Q`)OA2 zH7+!tDJw_qGsY<8x#4nb}jT9KGxCH{MMcpPjv^^E38OI|Q zJ6@|n+k0MUqy?S4Z#Uwn@QOU=3-7L3d9|69Dg`l`JnoE>GJSlnt_|JJCh4de*h(gm zM}Fi`y`B3$@4IHS7&dx30hz)(CDT=hKp4!Bs(J;Pkjd!V>--z_)lqp1Fi8DvzG>h0 z`K}Vkkgh$y7!p8Dd%LRycNia^$#8^T0%pXg`|u_1Bd%1TuV?9jBS_Di8R+xhmVOzi z@R*$Jpo^Ajl!D?U1|~rAzJJSHq?N`DYlhE|aI}*9l~OMOPYU3Mu^$VdbRjgZ0*UuB#`!3kuHZ}u2TrGO}!%LP(D!}tC9 zTie449*!`4-b1%*w_ABPgrf(X6DDFm&;0j@cO)ULKh*#G6lABPGm^8#~?QJXi z96ZU> z8vG{g;m(Jh(XYPr4oKUMg*+o40}+5^J6ae>pBo;q{&IRulODaQi)|Yij}c6Tp^gJ% zW%K9zUqV>O*SyUyEa7v=UWh3dGnj6r?<=x#6)e}X%?l}&xq{e@p)JUb@A?oWxqfwS zM&oH}mt}?s=BK200XVYSwGekLG6vaqwrjt;&gf_^C3RPfQ?gff7&!%GS+9@mL|Rz4 zkmA_Qo$ndTfvRo>6R(2LQZ5^wJcNBl~!0j0&JG}NntGW!LNojQ&uIQG-}_@K>F;k4-Uh%$T> zeo<{>NVVrD_?Dyyd@0W>$KMSe^grRJ1Qx#|b#q0+t8&9Ve$@?Ki<+iK2*xLYK4daf zry__ck_q+VheM2!r~S>=!Vm}L;ev}k>kua4O&Ss&aRXz_H8ffgGd3}JDYlW3LycBk z<%v(tb-_+p`LDDozwULc%1z)UFbFFQ3m>SSvT`sJ^b-dCe^)U&uhJH;xH#akXwQF%2apQS}s7u`>Tmi z8EJ{VW3cHEW`Mk+l94lf$v=YGJ$_0l*>{@PLYQVK_BE=65r(9&?!Gn_TwLE-vd>*SQ2oGw~J@QxbQukh%1K5qV zVne20&gW$5kKNQgN@DM+Q(7D2Y5x*)iR3&KNTI*x6mZ1_Oxe~%jPBKt@PepDOskAB7?%A6hid=bmGT(*CqLKl{ifF)}=Z(?c1%e zhd)&xn}6zRQdOe~uA6#{M{wg?Ws$1#D0I(z%K#VG%W6-w%~?%f4i|Kx6i*LO?@1)k z*OGDzs2#5|ca|Pu2DNc2Bx91#T6$cs5aAUh6oR^?6`E#?Y7u%_oF6iT(y~5yfTiLt95L>C#jA%&p z5V2s2TGjAAdQ#hjKJxof*UuSytTTFx)i0A5s`c$#+|I95l9Xmm|I&iH*U=0)AMzPohyEcc1>{?d$K4XoP$w`0Fk zIK(D;CTtJsd&0)}*D@6-`xhjgM757`njMKS(B!YwD|^v!+go3)$szdE4ZbD+DAU-p ztvLZbM1Pw6EsI!TPBJkzi#oAf+_zZK((ok9+b`7WBjvJ!W_12X^!`WfrnzxaVkobh z5=FGT>&rQFt#lVmUZn$7e#0B(#g3vgn!&8vZcG#t4NUT7sYH%TqAXDa8#WKKVqW1z z4ftNTGmqP6L6>@Jzi*-pl^Ai#y<57N zAsdEs>oDu_B?pY_8cx~?y#FgG9Q)N%eR9Iuo0CR^OCg35jvO%R{!Jw`2=BEHf{n8)(f#E7k9>~X zK}{+geBsxrMDY8Oh8zQrObKt@;QGIMlbf<~>YlMuT2nh=|G#h(Ew+}v{e|A(YBj^0 z+D|7hli!6HbQoJ79mI^X7=cEGuj#>E&S$ZeP(0|(>=|X^*dZeQUvh4e`%wukSlK|% zZ1z+F8=oP3#X`f+(R;kxhMwyYZ+%}up^njkTXeF7kBUh!(EUNZd9`(y4*4b#!|$((nu+JB<};4b0C%KVOS2*J6*czK`5)8O+)ljEhcvN zNl&i;^GB1^aYDJ5Pl;m7-h`3mb%FdS5ukq(rJrCKtEQQ<@4{%qqw)sSe1923`Y+#M zu%A`IQi(sW?RkVDsD4$5NLTk82#)(tq3E_jOvcv5Kxl+g7$d1}qEa&C!c<0H`)DsB z8f7sU9W^vv15k8U@oJG&>GYAZFSDnJN^Yc7nM<43vrs2d{b~!yTO@;W&ZM*&!)Eg+ zo+%^g;Om2IC1!GtV>TJ5(5QDmRzFe~u+}1!{OV*BTO#=|hKa$IEWyY2osLVUp6c=U zcUe{j49~X^Enh4K5uJ=4`A#e7i1{s9M|#WF?3)k%^3P&oSc6erxiOVC9s-$F`Y<-T ztRG_A@bHBmJR5|}ZfGYlyy_NN!8zoSLbqCeAM^Ons?6_DU|7%61#@u{$=QiLDG7}U zQQD;ARE6#+n^|Hu}T z``GX(%wE255E~euypj%toy)~V+{g|J_9(+lp=H+ul!HQiFd-w41i?yVgC+_TPn_WhA=^q{Gfj&-#aEK1kWZR-qI zF5)l(&`E|47-|tB(!Vpj7_${GK36-26S3G|h#*<0FmZYqXC4yty^~TP%G$>c<9Xe_pRfE*}1uL7UF>!nkr>o1lc%L zbYtlp77m`~KUp*572V-8LG4WW328ppN%kenbrKC=s-iIi_HRotx(>UpXfFIPsXJ3w zc(9|t6JPZF_p;l*uoU%jSg624)Ah`nLs^emOD9Fer6AzHz+EO@m+7ShvYVY zX#p)H>wkS(kAvxwy=B-R_D6tcdo1n;nWn%e;7xorplr~=YrVHpXyAD!>M?W>&il{wcMv*26zl<^+*erUP)4xrshm zpZ;mXK2Wx7pILrwWgjDuQw2BmDN@4;_~p+JDoLSP1$GfkEj~+n<`SavJ6z7qH2s4j z(J*n2xf`8b2EsT4hW6tL2TcIk522Y!Dql1Rbp}($8W@Oz|H?=MC}mu|1i98@N8xw} zw*O4E@mXI1?yffWN$;tV+GIs6#6b&!(M)=ROFB>iZbT8iEfoq4R^fNFA-~;TquOWL zz`YGhn0#uy#F&iQfY4EU6ITvv)1bTBoM`hV(r;I8& zfVZ2+_{U$P1y;%Uv!6{}pZV+U-a_|CJkR*tyHAi8d_JV{5>M7~9`G9z}b(CPeR8v?MYZjx#< z2jJwWy>ShkS1k~NsXy{rKdES)j|J;&vcx0xTn>1hZ%!jxzpE~{9(M*C&WLy)`LU*! zu?cFGtuN)h{VlW;s6SpJibxZ9a@C};6#{&6Xu=3Lz)ldb$pXCO5#}lJdE-5xS9Jv5 z+FGcFspZxtg@VX83SC2xqSB%|cn5J|Z&iMVtd>Mv^#w6a@2t5A@8S0 zK|g2G^b)K`5gKUk-(qEsXx}+O33`+GeQzw zW7j)kwyp9z(e=h{sCrX8jjhN~&OHlUb%m5R%g&3-HuxypnVPSFH*BBTAkNTu{Nto@ zYFmt^=pbup-IJxDaa)f)daqUe`_7%)HOUm|mEg({8-9^fu^^wzp%u8I@T<5XiGrmA zl7=GEL2c&>TZ!h=Tphvq?Tq@TrA)o%PrfxAlxL%9Fk2G{W$k>l1>~73Mrb{oeTq+_ z>xuu0r*yab?;_5W-L=C+LUC!a(4Oq>(!f_&I*H}iCUHm; zeAml;1CgK;fDp`hEhLvCM0IT%7&~C$6QX+sHyqo71%mLquRvVAuYV7j0LK&%{o!O) zKvQU?nS|~xQ4O%W&`8<$Iw#`*Zb@)-3Y+{d&yIaG88t)6#~msatfez#NpgZo1!0IwU=^-{J1Xno`9Eme{h z`M+`P1WAQlhw-9Vb=y-f4pFp(y6813ms@=fk}sW-$^@JrRRL?Blwu}a0V~f!58)UR zpC8gaiz%rbdXcaXjgR9}ZeZygQJIo2wZqxf?av-5fI39i@SC~B$~@QtK*MCsmN{K6 zvDg+;yaY!KGBCS5elqj4=@8HJf{*|lyZKY)h1CzrD< z+eG#h=J(d&=&P&X@>cqI=9|!tbhog1+{UpAj0{UB1d8kEXX^73(LaY`@H%PIzr_Qx{ipsK? zt-ebgYcc+FCf0j~)ERs&&lnUzjB*&*X0eOscC{o^s>fa7Vo5JZPlEX7QOf>)=96TD4lW6J2H>tIlU)!O+$!gdkVd!T#TKG$DhwLUN zlE{kyNh(qR)#wU94b9vS0p{oq@3A0$l%#KqO>Vo*iZ;A-af{q0 zuV%-Vog34BIi1`*0HiSI(^>mz$SO)=g?^2rF#NfwV@bDV@Gy)r+c(#HIp@7oFSJN} zL63)2#ZAfBo-V5X$TT5N&dQzfo)v)krj(wTm|!RuKGR>xk3og9M>f1rp_&REtgU|FWBSuSU?1_)JlepJOKa90?@E| z&GuRWP9R{`JQ_R$;}>| z(FQr?nnBWahmT*+AWjJ9DQALQ8HELD^?^_JnZtkdVs#S@yewz;PFrgp^fNzZGDEE4 zAjwQQI0X7ztk~_ZTp8{rZ^vF&473xyxGSLl8Dx80{Qvg5T82!tZ(4)A$*rvMxf)x- zJAOI^?Mbv9Sl=AsQ8gQ8aYCrM5%)9w2aFQ{kW&h`y=>8$&l4&s($6}tPf}?`D@NBr zn6VimNcVJ$2Cwv?#`FL5UP{1fVa@KRkXb!9^ejG3VLK6LH-P)J|Isj-HqMRI96;8Q z)RZ^y4d0k!iiH9^HxApI`$??AmDVQ=6CtC6!SWV}_(;P!KNMZ?gJG-d@myQP97*%{ zMw8Qi022x@8*TnxOk#U&oqP^COO4bMeQe#kT!sAGr8F0eAP|@V^tq-q zh$us;^GRr9(E!8RV%7RX+D2n^h3*bW1TPz92*4^&iD_^&a z^RDG07ipTGIn=(Th_w9XD5|>x0$Tv1@R_LV+32jEt6@ZJwTgvPR#SR~+kFU<4Iy`C zv-5WMtrw8`v(~&n_|iHhSBkf+WZ2vW*A(X{Dyt*RV%(r3 z99`K^mX$YD)Wbbl%i;E$X2Gnz^X78vHeQ7nm8=E5)olnm0^jpi#`B!mC~?Gra1OHD zAcn#crml{dm(fku2=_^2YVFCv7>)FlR{HRQbNRiq6+JIC=$k#VC5HQgAo(+l0_fjM z>mZY>bydqnpm#Od&_!l(<)`C;SuC1~hrYJ`tu2lVsm`6dnMK9)LiOT=XB4Kpcjw557)d^42+O40 z2>MWSYknyl$MNe=5;WNT)<8pC`aa;Q9D8a%iMhhPB`EChFVw*+aN0KwgYySsaEcMVQM? zTULoS**lqKD+qgpUv(r(g@)w2wF@Fw8sq!Aq`Ww)B)2leJZ1xZf#ZK_IrHA^;envys6w_#P z4^KqoUmtuJ8b;ZOUn7V7$cu@UFBRDmmWz3J8hW>xb`9gNsS3-{NsNmhGc}_1IZ)cb z{!`WhS+6@99UF(#PnejbNY?>5f>?0QVXw=`3U`wu(@AWXDxp#q!-`b0|GOe? zW*=AvwU@HejWZ;r{u(XaB8s`c48s${%-K?80fe?EGVXUUEDg+z6ek2G)PlL*fG9Md z6iE0m^u}kYR68AzE9A6k2E|lEow=^}(;V(frtq1Z;77Cb5Y$hRk9<_T6l#$6?p19t z)de2MLJ~YN4J*6Bb1ksfAERZhkYNs-h|6C>!lMNZTrK_{N9BmH?b@R>`lF!7PcAQL ziZswLWjC6JnWAHeF{6m5Ge<2Cb$^8e#zUS8;&brvO9fV-!Fc_(+!vO6y}-fSqCKTr>?!1ic{HW(>;gv8X1zNhNofY*5}lSZh>=CuS6f-%@gyz& z8=fDZ80XIiLiHVYcZ|yO%fc#&hUeqh7W6FgGzgIcEBXp6afItUH`2e>h=AIScdco^ zQhS?v^VXcMAI&W1j)SSNKb*tK|wn&yq@sKnlor&!j062vcSDu?X^?5Sxaw< z9V9>)_{symA_RV&VR{>pr(uF@7@iFlr=Z>Wo$g;*frGvMy);!o_pj%IUc=s$W2!7Z z;cmA=qZ>nkf3x$*0hn5|=n2Al;mTnv2xV@`@nZ2up!mz2BDHswpX9VD2RL_RdUh;Ss57V`ugd!% z+3cj-{I7jbD9j9};{Vn`fJ;AN8c1nQT5O=m)|slYKw)v9kax;MVUqWGj9~ljJ{Kom zlve=u2D0>*Y#ICDplkST*snV``2imxZChUTdVlTIv=2I}e8(7pw|xi7QuF5ALP2(i z$HcduAw}y`t-Zr`Nd)SoVq{6!V$Nlm%RSmuQaSZqf`75TS|elF2zyVYws|Vw@>*JX z|9-0apIO{L&8Bv$P@kMADtRs^JvU$g}s1?*|~M^%=vFl&TrtZv$aE2Ag4sLhpK;W8~%8_ zZ4vkOR%#UzOz}Lu%GC2AFE>0FrvW9pWoNRAiqK`^Dd;|A&UAB(9w-XsKv=~#C?{|6 z;^w_NG-%rWK9;Ebci92TnodIk*T{L@sV+XP$6;y-VYjf6B&^3NZ(_&!UAkQsh0yN| z^zL*dxE~@T{6g(9(4Ec53?3ApEK8t)Plm45O9wDfM=@Lw% zFujj&JiQ-9YLL5@w91zBU}V>!rtma=K8U?lu^q=@9j~wk#>^MlC+GH{xx$Cn&7AtS z?4^IZj!SX>7J3t8$qiI;|M%yCJchjyVO@d4V|4#L$tp)u>nJ5A9R&vzFFDc9Dp5gq z;)MRUOz+O-nH)=s;W;*R;5>Hd^NQG@(2T~~Kti-|UXnNS)jaAtfwLTbyThA@d9j2u z!aA5pPqD|Ffo*VXVZsLffSbX?#r?j+qqhIoH~nu|VvkZH68)HeOnpM`?Va(cdozd_ zrz+a!v%SY7^z5#QSNNYUP?7wfeic7&t%eSk#E+YA!PQ%ji$4xuY+@bkTqf(TvaflgnVnaG=~Rkl7l^Sbyg%cU zh5KHb`SB3RJaM{)ZdAM4aXZ7XE!?=?-xSsAcT^TVBP`;W?vbG7c}#diNRXXMYlWsaRtWg67|6I1Ult^2zBio@mj-f- zQxbv#tEM;5@b{U480jeT&y;``hJ+g90S)yEh6zesiW<*Bie4kGX~Jn33x>diW^t0W zPNm`bWeHU^q_rBT5g#sCh6rn8;xJsbsE?E?xR}(2O{%XY%!MD;WXl zadn_-Tut{ORi{>eFw1wYyRCRI(nM2tr+@gjl!&|41#MZ zOT;6_3#A7T;=11$5)}dlnx|)aEs4TzivTd)byp)PKerO3w$QKj3x=*C2|L20Rgp5D zL>Rs>B*&i5Ws|trC=KqH{xJvR8K(`EAWQxi|89tA-=VecPc(9w=nvQ!MYYYB1R%j5 zXZ_siK%UP+x^Z3O=t*O7u)=qUF#y<&I6OXqR;8xz5l8}3V9HOR(L#QLeQX- z93I-&d~pr;60Uk-FS@5Tr%cDYoaPIdb*9aB@~8t)s}V`R#(sL2DWuYf9_0#O2b->V ziX^Ut)N?^)%HEcyI=#>6bcaUlcQ{4P7yruL7X2*%LOguOM@zr%us=v&cjP;prv)gU z0N)6}sHPXN3abTAc>!AHq!$I$=sHLz;i$V3XqUkfFl=uc+^KTT8{mkMWyd$K?)d>) zY&w@0RYGS%DCliA`6i7SW@gK|$EvAdG@vMnqcx?!9;q>Z^PWRj*&rWZo$&(JGTSm& zzEZD{1U^~^0L5FZW$%Gs7hDXpOtGJruhib>rd$!0FOkX8F`aCIkkjZ;sS-J9G?{3< z47=evDMGrz<|Hea1H&X#VG|Y%=J_lUH-+KwGZ`AT&5rZ{QjC?-Tgz|p&c^u##2Fng zre;P7S_`|R5d8sFNdh;Z2ZG=4gcKAk5$oTNLnl4MAVd~iHx)`|_|im`4SY^-E`lE_ zUKmq@ubz|tIcr~uxxfP8kVR%z>5r@#eK4`iTSt##@1-D!q%5Ru_~k#aIs;(35ngMc93td~CNi;4HHMdpsC^Q*nZOu+GPqbNL=Zq$4=d*oUe@qL7n(<=*< z5W$mpiiDcNp@RypW%9LG>hVhwci&BAEpKd=mN=W7ZVD=d;yQM{Cm$qk2q{N&oOhmn zDDJtgGALI>kmRI{72qd5NH-8+@`+x>nO(W4{k7n2o}&JHZ*Qrvwtv=TkH+3SGiqri z+hWgaH#V$TN79fEc)|rdpzxvj&vhHavCAPDN@_5aJqK(59<8!%%kev!()N zo@PbBCQHP1d^0XeU*Ytue4()nh>7XV*_|6i3iQw`2s=PhIPnHP226t>6JxcsOaPD0 zarcl#gXoZm7FeA4J;9DAbS!|;$DuM!#rimju!(8Om~eaHe4|5Z)P+VVODUJe0-0A7 zIVHQLb6LM)d*OQ4&BSKn=}HY^Ps3YB4cnzPv;9KA*m3J?GO7mNzO_648*@iQ2IA)* zDaQahE`N<2F`C{9Xy$2cuMPmeMYibsL-9>ROwxbagajII zDYv4?uX`O^16e;y9&5-Gp$kJ;1SaZxht=$9!saW=YW?2=>55nz07v@vt9n|CZ|V}n z^**BwfE2DYTQ%Htl&TbHT_BXq?R@%3(PEGMJk4h3d&a2aGqUztt1mtROBz-2tRJ4^ zrwRb@8)f2EVfIei#ZrEo#K{3t(#vtGDsV_0V-a*tO{qV#RTpEAX-)jXXL9}Rsi!}W zMO&r9;wa@RmB()0WCR=_5N-uHg;35H-Y++Zx*zq7dtwqd+1_WM3*IQEaaRm<8kDtM z8h<<%^zGk5-^>San=q8~#h@5~x!U_uRuGR|K-j3uF_-|96xKrYERcHB+eZpulyz%d zl-a4s_#CG$9j2#kMSjJ=^^jwWvSLkFe!2$=t8zz_5wjhXfU+vy6OoBxrwRz?u1C(6 z9B%rklVC~Za|py;5b$Tjn}&ohZ*^Sh*cNK#yuf23w`bM{ zA1LwNb|D>XM4Vb*42yl8CjT4nx^0mF%1;^p1#1YcfQEXVS4sr%{&Wh8^c}^YKXdl*-a;z?0>X|(k8njTp0+RbN| z6uqu})Ek~^p{OP!+L_Dp!D0Zy{NOP!_beWi+-g{hy7m`TIV_3RxhI{fQhEc%LDo-6IH%m zeFfC5@d0Jr9O6v|p;)rRY%`<-<7tYd(R!_E71QHi+5y?N@1EVyI3lY=ZFf+P2N^e5t5 zZWzfpOJMGK}tL48~`MyKrnpSN#QZFlUsTCB%}lxGRnH$t!7L852QrXDP+j~QGp z>dt4N4p?5&Z`7uBoA#@Q4GkEKeFW-ByJytk}Yi^+}{4rZ{A${1GIhoZ))D zh2N@}e6O5QKHJE6&B@L%yaNGDv`ej?zw%O;zRi}iXRFZfEaU)iB}V37+S9*&Qrl(j z9|DKCzoaUdc~_1So=U|F_}7LsFr@{SL?`jttVC!ge762?BoQbo#Z?f= zOL{;>W-004DOqzz>;*Dz9FVsxc4&JfY1t9o!%!w3fU)g#_khozPbYI&WY_5C8X7~y z_Yjzj3e<@PWey5nn>KjwX^B6j3o-B_4v&i1g>}9I^k7%owb~6v8qx;Dc^G37G&}S_ zCLGv*tPimcvrf8Evj4HJue^P27MgWs-vbSuOzqSAT6Yp5Qa&23}sW00=>4Z9C3V?OtKjV`49 zC2q~~qw3*o_Q&0{NE8Qf_Ts5<-vG}3gekc|WD*x`OD);5exKjn@rAUF_PqJRM%eWzGKxlTUWR7A?#6Lslw-UMcjr88tMAXnJbjXXS1%y!5dD6iM-LulD-G2Tvs zPAZXcy0Zg#vXTdP7)}#d&MdA7q!I=zXxJ`zz$ka`F=AbZV8Y3r09&U=nTX5=Z-6+u zNIIQ0Hxndk!E7SlhZs%XVZ0iQh#E$BVg@w{5~$ijOc<86OdE9OXSRNcfG9e;5XkPobKza<)vM z;bR==G`l=Rc=XB^Q-)ZzV3K9C0j^K>qD&R1Sq41=3JhgjT{}IOK|gynG-Vs^*wnI?InuUK9l$`or+5`4@vq{Qx~6@JH;$t(gcP4UT! z$=|&(h`$N~Rib_uW3w$`=m~VK?m~KX22w2_#pUxcT|>Uc-NVzVms3Z@L#x zdJvviLBeY?*VFypOvnNQm2P~d=5|Zkt(RgF<=5BY!i3GKDU6kjwr5uhE-i}LFr%f( z){WXntt0TAU0*FJ_DPahst2FfXwa6o-4xywnrp|%NrRwJ*w9}Z)7EbvZvJK3N1xPs zJF-Tf+{*H5u<4=1g74v$7**T(nA>Tyc%%V1BkQ7pKtrO;6J6gn=zkNO)+Dv|#nnP% z36yo#;y^y2`X$fJ_@3?3iT<(D1ERi{=yBK)=c-q5=ji zxy`FiZ;6%p_`M)u3FMw+9rp3;K}l&_^YCfkHEjKjaWE`Nnl^k}Ffy|kfYe7ij~{%B zC-gc1pvm%B&pwIyCUZq30ifP%QjuL>UB*k&_V+Y{%x?ll#E?#R@y0*5{~WK30gWN` z@X^{{H1}~L09vYJ5&c_03TJ1Ae}}tOv2Nq5L&(|On+nUi);wRgJ^}0|sRA|I_x6)< z2`e`9n@6>KhRWIpmu$R98x9%`w=swq!NPvqYXBd8U`+3b*PBcTx^mU>9eVleTg^Ne zDBuQdN^ldFuE13FI+phBZsPu29~%ZNx3*^iM)R6?(spQAhgxUcj3ZkXHEFqB{`j)s6tG|*%B(l$u3J#^b25PRJI}$qI2HwbwT#<8KN~Dx zQ}(dfo36M6nw?LnZZQHN^%GKVj)5e1TOgRGOk@s7OE$mW{nU&*lVCbo&1 z$>q+GE2VXm*EG3N@Bs+tLg0k2uGuHQ3uw{g@qxXgQk$_7o>Y=b)%~Cx2FES1bt@CN z0qi+U)E#J9w(wZGanfMA`t9&yKbz*^zor{|RmH?i5zgm)hhv017L7=RSww#w?FO*^ z$ELWyy2Dap5b>8w4S<0|1K?zM{&N-NN+$FbFrQeh=kSDJ0~*aIHp77ennTdTv?HhyuS*r z{*4u3tUX3Z78)z7MNFfD@Q$B(?0ZTZ{02mFz()NKD1Ye;(^wYxA<>gl=Uhu+4Ik%J zo0qSbX?n8}I4+R#7^rq&=Qd*!p#W~{_V9swyFEgBI#@h|6ls=_l+iQl!nf9zz{*m; zdKb%VGqfbQNL$3)hOo!_dEIT{7GRR2k%}5^m-hf&ysQ4`=AxdGuL;P50*8(|@Kl3h z!xP|R$2cPho3a~bK2Nz5oy2v&4<$v2-y(q2-8TgcC>`+`s@gRS)r&1+~U{HJP;nf2ta@b4Au-T;22B=2??#4vt1s?LZhhz zA>bdmky$U7i54*Y;eiqq@9O@_lv3CYKX}ovcL6XX!33}jK!gAgn%bG*0ZuO7>s8@R z`2;#2El`)eQznUPJnKNvcrLTKoY_W_4uf~ei*P+`Q-UFS)vn84-sJ0qc5fdi(w0V!H%A8WD%b zbb0P#9|7cN&rHejP)LP-D==nLtMonA4UB*}e+C%uz$xSR50a2Q>!KkJ$EjbYCoN)q z14@|<_xt>2deRo>{`b5U_NJ(@#s{M z%q2i36d1HuzMi=Koi*3*boa+pCxF?XP6IaX4k5}!U(ky2N!^Y`9Wo?1j#sIm@bKUu z{Tnha$F*}8DNh32;GBdEtzKC`^BxH4|K4bSkqxZeJbXkj7aG<=9*pFe6O8VdnA>Tj zn2yBbKzDh=A;2(q7%qNlVbr5e{@Df0?YcxJ!0=t+u(TXtU#HYsdkMDm;=E5-=w8d~ z&%;$Vc8AS)H(}}qIN+kBcJyMqST6aLxC+g;>_~!l$~1P#TN@sX=T?MycfqZVy9?=F z@sn>mOijH#DcjoD2(TzK+`XIrdnj_3$^sNhiDn$oHzaH-me<{1ug2_^l8NaQ8mF+Q z1SQt^zUn9UnV}+0NhP_%o*RT##2nH$ykr(Z35^{&j{JS_i@fJ*=2QlL` zF`ZWH%9~+H0MetZ5cgv0J2opSWk1buwx!$03)(=r?*v@j37;SFc_4QV7^rW^E6rY$ zeVRT;SF)0QSoDio>?wNd)w!dLMK?t-_uj@ALuz^jJ6G^M|95GWf?1+>e0pXD{Wx)m zmNYV?L+k-uGa;WVDdpLRw&VwUlO#`iof2HJ>7-j#gd);a-inX+3hU~@cBn9OnA*kG z2zY6l;j&TiHU}DocA;rYzSWi-no;sZ>4k})3WiUk&7aNWYJSZKqG8M=@?TfIra{(6 zt0N@+@=+#PzzYVh5TOU=#UhtBdSMU|4wi&aR3H8&f{)}T4ZxVB$@n?hq^Xoloy)n| zc~Neh|N5KFB}pAzaX*X}lFc{^uY@Q6FGkKuvdJ1cULQ&3w*FUnRDGt=w|F_c(#n&e zL3F$aC)i~RTP`6QEmB2QKYTC4*``zoUEga=?;NYvaHi!+ALlXPOjwS+RnHer>;8fe z?|N50bG*w8q7ii6G(FAU7PzK>?dnIyE3ZN1h;DV}{fbhONhBl@DY-?7F%-gN&K&fC zFMpH4x@U+;;_ZQeC%mY=JAFazKqvMpBATcJMEX?>bM>vl3rKSd3LW7SrZfvi!|Z{B zdtb>ZQ6|1f8FL}NRIRGw$hqZ#C(CkCJR&zzt4LOIPZ8U~VmE$N5(|yUh?ZrvrsO+c zn?GeqdQ5*69r=y!Y$7?t$+s%6ZmB3du_3wsR8XWdU*A?(+rgKVopMjtSXqJl^g~x{ zlRJ2f9PXtapzNnDx0eca?rpDuC@1f~S5EWiX6`gdeyt!?t!pl{!E6yyG^~l9=l!Ob zR_(9!lzY6&fdOI(aog5d+$4+b$Y&uAAfp5%sF1W@N$F>Hj|KrbyNB0Z`b)r`YWil6 zcMS*yWQewClD%PQ1y=_3ZIi}>L)LKPmErewHs5+}K)C$SjfeaVbU# zZ7_r0&DmnmP>z@UcOgmoccuw;=M`}hH|4vCC=eHAQufXn+DtJ3OKOc@*Y{KVK z0em)kW;XUg=-{k1;$r8!P=~;{ttt=YeXRpMbq#@U=8%tm?6%ka#zUrhl0uQE$k;{@ znaMmV=~EP;60*ONrGKVMeNIA2RdCsa@B2ZKtEWGD{p`+r}=?#YE&zt4H% z%lK|4DH=g0|I z??b833FN1L7j=Z|D>Kt>+7q$7t|}hh7$8-pm5f!Xr^ZA1Wb*NU-dDyOcEwAkuAMgB z)7*)9*bXVRx74BK5n_cuBx-@M^H#yqV*}m+{4XSU*eN1S0buH8n|?);rE>lq{uAVX z-@B9K`KZS43?Y0Y_y>Za(NSUdvyCWn!MU=}4X!6k>4I)Q3kq6RZIc16+x$_ekl#}) z7tDEtZ}EYjSJmbIHbz1DVrBvlVVcz$K2J!A_wUQcJPc^;J^pc2Slw^+^=KSM>I z&C0av&|bm;f*5CQ>i1Bu5aR>Ya^1GO>t(y?K%e{T&CFu8DftCaH?R&4m(|?y{$%dd zLF@^W$p3sb8Eh2#9;)yjo!G8U&)*?vVm%Vn02Ae>*jE_WO`~!I*N?nW~mmkJz%%mTvuEBqefO; zeQr3O$!s)53R#kZ-_dv~PmV@QU+)oBQtZ}uVTZZpx8v#FL!gF?ZjeFSDKtQ zI=|{YohOPuL&uNi%22!Jj;=2D#{DivdF3iCrhi@?&HJ5oA=3E2oUUZjC`TjXv!5^j za`uctF7N<}_6yWDqOYs9n#UM!^M;;pZEdOKO2<5QJl}U@Lq3?atYXAH_p$kMxE^b! z;e_`Qu<8Jqo`-RAL02K)hufhzdJsCPG&Jqpvu!k$_jyR!R~$J$KK>)3{PT_9^Nq3y z6y6hakN&0L^ZfIjp8aiWYwK)@hTrv~8Spi>*>8%Qnwma8J^I}*uNzW%un@?fuC-OA z$)eGXc04Y3IG|XKnqB~XW^XiA26>9*91-cCqxXC}Mk9P^WMItix+YU>ck?jXu*27p zffrjpSYPcXuN2)y>x+A)!ot5=Yz~A--F)^{0mKHufei9-Gq=Ab`4{`@O zNeeK1c060t1ARo+2V-6vY-8Lk1Nj}8qCP$EvJU4=H?aYnxDYLk%^9-A<9VCd1$gD8D( zf$0#KXO0%CjJ{uF2z!Y)6~O`%mQ{$)XbSg`Va?*P>-|<=_`1){mukIc=g=uuoko9j zJlHn+YG5=1{jFfC#%vsegliw@SQ{UKiIEXL0Fzwc<8KBRvwtq7zSh)o_a*1f!Z;Y9 z5^#?wyz{jcBfdk%{PY0QJ=OQRREN3?R0+33p_i-_w=&&&%zOCMd zeBs}*i^3$0HRF!q}dp>5*j0Ve>&*|wRlw$e~gy_pKM~p^9Htyc2TH@fAR|W9yJC_dUxV}U`@yVAei2& zk`yYXRpr<>zCUZ-(2cME`&PmxGg#Nq_0>n3rF%U7}Em@J)T z{@L1`zgnv>w}qk&i0U}?opKP!VAsrg z0zm2YUOSFVUF87U<|<_k4w)v5?2Y@rC8MC@=pJe|Skk>y#Qu$(N>PaCG*sK0i|zda zTFH%M<_jgp|0>vks|R*{`<^|ZFhAMws_64&M$#%Fx+t(1CDHH98lI1RnA*We7B(nh z3!}4!NFxcM(}bj~Rwcqll@MGMVrebSS2lJiZu-H=-s?&J2UpP06%M^#PW(F=;|!%| zM~-O4A%NcE(lQ!Iy{^Uik)>=bDaZf&V;9WP@^Q#zLW4iL=;xDc>84)WP-r`1b(tfc zqT%$$$taW_R*h?!qIg9Nx_x?gPN8Zlk|EL#TSE3y37s=f=f`T-SdVS(_AbCHL|Y<7WBM3-luY(e zc#^sX@r&WrfsR3(r~$HNZB&n=%mnUqSR`u=uk`XrnF#DljfJgn+%aYzplIEMpn~N) zn#D)L=|wn`YnY%9rJO%KVo6f$^98@X{DD^3y&tZY8)CN5ltZAr0-o2YrOv|U5qNDv z$F{U9@5n$w=rB;a7C4$&=>XkYLym{=R{C$p zq|G|9!-G5c2+SPBHiX&C@`_-yL8jiF0A%!j47&mjEXScuWQkK`n1xp)+89}j(KR;% z*>3Pds35n_w#RQ0u}Az0?K3-hYau_OIob^62u3MG;NV%nI&7aoXJ!LQ;yqPKMo3mE zK*LeMcMU7AMYy{DPE(R6DPb-Lmo}4OSo8KZgl0|)t`|$00H^aS|BoM<1k_@%W3Y13 z9R3mC&I*u(oR5^h>t&wOLLXoW5vq3pE)D%AB;FroYr6kUHgN^ z#v2S$nUT~p6VvhfNBVb4MaVozC2SncvS+~A9$!6^{*9^#^Tdg;tM5%r&5h$oR?)cO zIp9fmv|y!Q5(Rh@+N@?-jM%o_yX`O4oMvGs+KMpn@NpCkzkvpP8{0)pQpu{p?!@tW zC6_-_=yr?z!Sqljkf=bMeIf5QNPOi7Mz5MEljMY^>{pr#@nAK~*B?Txxgmj}F`q^f z4#~HyyvvcwLY83VQk>4uPt?EMJ@G~{jB6MU9sx^O3>7V2u%-hR{EmpfnG2CaGD9u2$2RIR*%HXvG?!DHvq0)~@T zR1)+$(ba7-*~^{=qDrT0X7BDy^_?7FZx-)0Ku_IL08E8A6)RIKTwbC61REQ zXdej@m@J^PE&N!01ms>et8T58Qy6_gq$2~TnJ7d>UBpYRd*(IQ!U8wMo_E9KgTUDK zB#5IFv>6k9SoY(!T819Sf6i_sn6CYDkI8GXcuo2AyF=ib$bRD%>b2OXF~u2`*4}zQ zQB>v?Wxddz+0&}}+H*S!PJZ56tHose+GhZ$8p^I|)akknSlLn|tjO$ey}xZ@vT8Wi zZg9B?KJj8~ojR;<3~;MK;q%%(SA0)*A9l6Odn(`z>3_s&TP2otf2}R;%MTK~rqpXP z7`U^!SNhVb^}*H^RfLk2Lm+D%(1R>j-wXnVo}_i)ON$d}AU-|{IB>c5^`Lr!p8ErI z#(V*7Napi(v>vy0yJHVe@v_U=?VK)&-R$bkm!ZDuUpc>XEd;oBT(1-y z9nk%4VG5c@RAz@x9N8;V3@aMxZ=cU`8OR?h|90UK_4Ylk_4t0l{rN_&UJo`^ImQn* zkID|v5U(7vc(q)T&v^|lT<}u38)-N7rRo`6(Z0IaEH0Rc1c!VQa;FTSz$6hqpzrXl z`7{9j;E+3tuyLVbw`#LoGyr(El5!gCt^}26*PmQ3^NQYX#8vDvYifNo74d!$KYe=b z3r%%fa^Cm&-5&rH3*Q{`?nH{VuKqNd2TBdo_`G7y#(f`KNL)w&QsK=`lRV%n?RB(@ zIeBoy2{6MSukR_J&jFgCR?B8YE$ux&ZgJTs&PP7B;y~Kc?2xY3$xd z0TjNVaUDQqx?#8GU7&Sz4b)L~JiaRNNu+qbWqY11_StLQI+q&Jc%EllGhZy9-o!Oi zFJ09vFi<-t7PMFjI&!;1Bfm&>6FFQlJ1ZV-S#mj*X;eEE19H_ZiJxQj41)XBMA-S@ z&Rk&^&c;O_U5;4W00~`{`)gozrwEC&?ixl1h`rl@+!WB)fl=ty>{!oK`jma2m|8ve z49fe+>+W%QGEE)(@Zj&{&gGxk+iAiMRqkYKdHHpzErw5(G3hS;b`z0zH8#0d-3%Jjogwd-cz z7a!BUr$(kBLRz#1w>2FtHh6)XZZ7ZFc%>Udd446OOza6}dh80H-e+8hobp3|rvevi zmx;V<#X^n`2||2O2eyZ&=ydG95Tnw=#h^Z3#J&~*93<5o(o5LBiy*Z&q5qi7f*Q5Ql$A#~vS4;e^r=H+S=0(1zr;57ll9Te- zcw9ot@-c~K++WpqT@ycg9 z0--9CfuEzx7brhjbX31NY!Bt-X}fmg8*dwb8a@A%-@`dj*5sF7z-iqA9;s;OIU1u* zI-}2E7FAm>?8B)xkimaVeN<3vwfPGa)d}4pI$;p5Q6}Q?leO^hn~4lsNp{`ifpEv@Fxy}%htqmjL!YLO zL+s8D@}J*OxfnerCNe!GR&pFB)32diG-WXQku`qXrtWb_=TkPOC02BLx!$uRbVhJ@ z{EhbcM86FvN~5Qzr>*Crr#aw*r9{h||8XSA`?R(jcNYY=6o`Sq=VIVPF6nbKr;DYC~+!Xp_giAViC5Ch6g``mha zNA(&joPc>`Y_ucS9;~AM0(=jExhVOo#(kzY$H4Minj(`z>zt&a7oxAps3 z{1ZGlG>s~+jzP}PPXEkqtuQAMZChOatkbaiJx2y#K9asfM9|G{F+jA@ zU@#}Myim}us%W%jYprhm@hO^snWd;>qSXP&{y(`hOg(Mr$tcawiPl{-K^h2l6w+#| zYmcvUpz`n4PggEl9xK`&OU_Xm!A;=_hRhMw`Uhc{7?h~;!RAXjrie6kY7@Zs_|!x7 zIw`J#pY)^iqt6iwlL_=o7wOVNl@W7M%{<~H>x<}t z0ws>0fuW+<@i-P8of(TxT9^<(gfrWC^mIZ=nNz2~bTV5s62!bOOeCE@sFDss4sz*p=u0;+D&>c&26#>yIbL(}`t?VJ ztx}Rd*7o7{N3f&%*K&tHx=DXb$Nl8u^?Wv5%HOvRU5j+uWfk!)CWudB6F57#p<$@9 zf&P1r1OAp1Z|t;5}g>3SE)sTYK;#YRw{DtZ`Rn5i=#ByeRBGI z^XKEd*?7AQ@2j$3k_%zCaTnGGeOv?G$SBIcv&FPBmr`>o_;E*)W=gXXaHE=ACy^vCICcqH>@@AJ!+*68yUIrO zl*`lI!*+-cUxUBMudFYE%?8Y|e` z52|QBA37sGtWS_^2)|$rfA8E`)@lE6M}%QQY!jvx+`tgWjzRN7-Pf#P-85Lil>qNFzhUvsHV~P((w8XhvQPp|*2M20iVYZKH@O)uOvXQtlkZ zT#P6NhhSb3GWEy_}tktvtd(u|F?_gsOXKN+7!HlXdrY zcY0A1>=I3_&}AOuF4}F_P{HBKpxeT}djTr6Mo%R|IzUk5)vrv0UdF(vc2m8DXV}1s zXV6(g%<`8|Ko8ojoWz^?5PBc{#Da|*ql{k0hb@s6fqEWpWS$1wZ2N7Pg21sS;GO5- z3ey5ZPs4>w@UJG2%vWWsc=Aail)`~hDA$Waub{{H8+Xlr&waq(06fZjE-y=}`kl)7 z!5n<7t4eE>Vtgl@RV9%FI#twTgYD#b@F%#wA)|MkL%*_>*$vzlyU%Cb9u{yMg4*~e zIKRyh9+&e7JYqXI1P{-p-7vb2OPTIn)B29?Ki>~t9B_}@z4=UiPoSkQC#RY9sw5HFHTcAjeMV zOB>KNB#~&cqQSn?NyXCe^vb5!F0ppyE}$0suZ8|4+Zms5*=f8?gs##-_KTez@`3*S zBHkBwk~f|K?GAlq2bg!CEqZ*8E*n&H^Mob;>PKC}iRuNQW*-8Om;2c#l6OiOlGHJ> zG&rIEdYJOV=lA%}^}ilo#tja|{q=90P_87&f83GRmDeudG5?5Ze5+vad+BWq4Dcf- Mr6gG{uK(@-0EgQWasU7T literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/assign-users.png b/windows/keep-secure/images/assign-users.png new file mode 100644 index 0000000000000000000000000000000000000000..87c529be50f854524262b401da6b15d4f48077e9 GIT binary patch literal 29294 zcmcG$1ymf}x-AMxaDuzjG){1L*Wm669yGYSH|_*$B)A0#5F~VPw*-ekaEIUyxAO0O z{(JVj``mNixbO8CP1WkIu3EL~Tc6B17tv}eaxYOyP~qU1UQ!@%x*cqTkwc^_t{LGA(IED`bT* zX;M7482PZ6;bA*@H~wgv?h$-PTJ|KPp)dLGOqsYxP+tk4FldaWX}x_BmEL1YKnwW- zonH|_vunLtwuW-~T3vp)38-+N`s(9;wFj;AwR-P0{E|y)D7wXEQ<0RkvnWAyp>Jd= z71#A(uCDE&w2-vtLSA@Do7Y`a2i;IE;xF7GRr@mK^gNhKdeQ6__J|w zHOuo_iqvt*I04VvE~uGH9p${&W~JnsgX(!9V)wth zAyJ7xJmWOpdb{a_c5esKb~Z&v2Muf|vBoEB3AoNxxUS|K?T&4uWe1GzCcrJU> zL*)`EzCK(oCXfk$s82wg6cD2hzZPZgL3}2Cc`c!O7k9PL(-E%mjrwjLqc)G1;S;gc z2E_C4?}zE34@F|>;5l9nTLlm1E_&xG>oG9dxX9I#>;3h~k5bh$Mid_Lyo%g!?2UDZ z+RJo^ofPlB*V-HU&E$I@%yHa?gru`!3zjXVP4?Wc_QBLS*Ng1Mh<#H(-2D36C<5-- zY6K3zpV#@Z^D+k|h2nAR9Lz+oa-kJ*wf@K3rmd$QVTo+`9S`f6Wpb-+PJ#0IOtgcv zk13d<8q(CLHScWtok8v9bZCeCDm|moH*2O}4?m?$#IH*)YU z_C7d4=;(_S^y;VQN@eXbRTX+#8E-|h#deRXT2zjxzk!(4_k>hdJ_b+n`ABlE)gH1p zeyOAX$qN5rlVrqM_<;iB0nV;ED!GE%_m4UH-VYbE(M$eUKQ}J@i>B+$`>(59Mar3f zj47V{)HU1q)F+m7LddQh{xC##QZ<4-{`aOufcdtmg3!b(cswpH4wwguEB@0K%NtFL zj(1ypuz5PBk55C)wG0X(?k}yVmziCA8aU;I|K5DeP4mAeyl8mnzkhCOF`@8yo9}99 zs@yo`dGUh0q3~Fx0>)BsW|+V1wf=H2#tF|rehQk++HozpVw(0U+DQmP8I7uqlZDn6 z6tJCPFP+qCFN-^Kv#A*}v>sz%;(OTW^M1-_g%GQ;AvsR1{YTY3z8V$zOSKigAa@Un z!bf4|-l6YQ9tNDk%#bMr+5&u#zj+qyvcx1RWbKx&F2ttJ)f>e>Eu-VS$VrF-3zl4Z z3HQcHOfLQM(w{!tkjJcURFn-l7}({&~Vej@m$RQv0A#1e(sr>&LxiToxqy@2b#Pzf$xARgwtX$zlhrad+E@jkqjz)5nx_< z>aFdV@smnR4s&|C4yEk4+K2l6p7dOKR71$b^pOh2kp#wQKbkU=>0n-=c;sf@sKYx!{jz;JRm^~UHFDzE^=}p>oTN$ss zgC#HQ+7@*zSBOyTjNfHrV7gK_sb@A2?cto^Nzc;KO=?aAd?*0=@OtaN@ep}Y54dLpN)%+TYohS z!XLMdmr;;5jYM9ss+%7ex(gOO1|m};14i#{3BNw1!JX1)hZ-~=u?Cej`*_gqaY&+# zzcOPpqILb#Y(%f!FqSyRGls+b#1ZH#dD|usTp&)4o0`rAZ06I=Z5=?!Q58OU0Y!u9 z+LgmxqmO+N_WCn<%54Y$?~hd*xt6@%sQ{;Dv@>A#PmU;OLGt5 zuRSHF6|eQU%vd1A$VYv=t`7j;W(D|5_#@xMvW?T0vn57WAwr-czPuH*6f18ihx|ew zF zl%rsw{QW_8g=AC~y4wBsVx?SDarE3=vnZ?x5|=eaGld5z3RR2=vx>g{qChW}B#6Tq zzW0pKJaS$g)rCyxVsz$q9O(s4A#nsk9UN5^L>}uogAD^}Uq1dD?>X6zWp9HJ+7PtZ zlp=cwMhg2?=ZasD&^7pW_1T-Hcu8p-S z9VjzzB{sZi{{2z2zQb>yo(U9?pQP(>|Aj`BD|cTgAWQuz3>-ySu|YX?ewe>Uu?HBa00$=3<7o7b|>0G1t@g3|SeKSJ>JB|BKrnUUax0B+DkLW7X|3+2xC~S=8B}Z`Rg`Hrhhf#O-IH@!x;<=U&@6> zelZ`g9O>M+$1F{-;(IKPcN-1T3;6MKvBPG(~ z)fnbV51AF=pKIO^@maC_d90T2n~lD_U+**YTyjQ&el+nY*2P-mh+U%xamRC~@#JLqriBq>Xln!_KBm)>I>SmSpJI zB7>k1VRcr{E+Q9CCg5|v130)vx945M8Elkd0c74MPV#4zI*jpjx6Muu*W zzkmIRWAE~>BlWlCc{LMpp*rE4%hvT7ZuSzI+MD+sh+Z=F#hNYZybFl)Uw^zi-ac#D z&a<=NYq>jWTbzp{9T&Z0f%eCfYic0$0zR$wPg-3$09Sx(%AcI1CRoojTQ0k9sxl1T zsT#^8uXm{22>euA{9*7;qDN=ac;{l)RF1y(QLiIp^m3;tVJk+nr-&&kA_|%IIU}LV zJIR`%%yI^{H#bylZ}6MyUNt7lizVxy?Uq7WLEe=;^{hsn--I>_A}P#NaR#f!len!6 zhN=r?OjkO@?UH122x;xUUWyr90qO9NCvQGgrO~4JOKiDP8x>pWjS?_=*9ButQ&gEu zZ1h*_k}s#YtN4oe+2RtX-8$#8HeVdecMWGUwgLK6U4^0=}GY@snEUl%1e29c`3X%uxVw0 zZes2%GxZuw=?r#Bu8#7p*qbj->R{Jte|B|jv8<9}ZbEHiNY*Qk;%JLwd(#)&W!Rgk z{@?ZIp9dWf0C#I^9+`V{y%c~i=fm5z z*sT7p&t9_I6O9Y`_JPZKVUD%oP34;(eSHzh^S5MTfsgmym||7egDLdmc_K<-7#od} zqdR2*qUxGt z@Xflf(+_Ly%o8O;8}Ekjs-q0b#$>O~@EABpnyNLjyR_7KPV-0QZH{=#dw5R#A{gI( zc01KzC{Y}2DlVz6B9pFBd(byUHPbAj?k`%H(8Uq#Cr1@1;hlE+4r#JYDY^a5_j2cR zxM_d@VlY3nWf&5fB$3jRSyi4E`H{$Va%w@6Q`NLUHNCEXaAZbWIZFz+*BpE;`P9zciE0W6byP~17b{9Sc;={S1o68)@QZ24eBqzR&hyKZ{ z^7X){Zl32#od-g`t=gw0VqkRsFcPOUfre7R!Y_LN!^|NLhP0+trLBDZm{PI&b{_tf z2Z_Oyx>0yf&*Dnath6H)&(kW@V)>Qlms(Ld52TUiED0t>7O^Th2e2FAc8h{p9<9J#56mY7krZKelp@K)sWZPkU=ZmYDH z$^Lxbs(9{xX~*iz{jdJ$ulZlquk#n+!L|N7N;$rHsI!NLSKz1N=H;Rj%RYHr$?L zx6&yTeG&BT(K6gFC5Z#Sfs-5+r7}&o&hy>^B7YW@nsqt5;6Q1K72W+|;Db}(UGvlC z({*2iLu=$wwPZiHUV_MFCU}7q05*QKeq8jkH3^+Cb%;VDT4o|-HBu8+g&Q>Hw8Hu9 zXz?DM2D{hO(UrqYt4xq5K@!IR96}4RvHI{JYbh{?KP9ejF!`dKV!E7FE@%A1`;%}b z*v+WZ<0b5VmiMPrt!_cHpCq$wSPp?hVQ{Bq6c57%2QT$=Yp_kHLSgPmXJ2WeAKd^^ zdTNAjw$Y*#wm55J?gXD%;x@Af@_Kr9$9A4CuXctsuEcSf(FGiKqfDFfMK*&S9ogMI zVcrw$>7XsJ?YqtgQt!1Jy!GY$>B&SqI@_;&FtF!Z^PcVCI!YZXWjp? zW4@^K7cTMZ6YS6DK$D~I{O=$t16U}K^jx>E#|r_$j_Yd1(8>Q|nl$?ajc~b8oTl9w z@HrczHybIQKivtjla-IGWXY@B6mueZr^t1n5uk5^1 z>80M+tgdH=V~}^Y#GfEYD-!=94F)SX_=O~k&)OJcrxxprzuc45LZJTmhUm4nA4oz) zZl`TyZQdHljRDYSLuF9%oRL&Y5jG_OmIib8W!`XY=&qq}GKBG?(j-49I(I~>h(^g6 ztA6Wbip0|wtQ9CpBV!PPE9GLyLj$Ff4!E_Zvr{pke+&PEq)L~mVM}=aro~R!iV)I3 zyCciv=o^Vc5JURmZdl6H52B|-V&ML;>02Df(=(_?xs;R^6LSE!QRb#y`qNJw30Y{| zvi*%CpKkU=gD??)=k9gTN#T)`e7!44O=*K>A5jAV%Wr03!c(aid?|sSxcX|}zqSti zHcz6T^LWD(Y9RXKgrVh?qNUPr2FL{K1p@_DG?aW5eFEhv$xvE8=A>P`A;1`4I)gF$ zF#3paooYvZl?kNJ&1Ak~Ot1w-B{3fvnU7pq9FH8GRlG3a0Ir97pnISj%VDL6(P#>^ zxdbkm`-sd-dIEZh%tun^YKhEaKj7Tqo5yl!n!(Ke9Qfz(zSo0^rrsa_Aj7sl;-r&w zO}uIA|KP(Yu#0M^lX<*_5(0&&Yg|=fY<*HvQfyPmqGOvfPz1~$AVVR-kJszix*ORm z_jJyp(SciBP-@XUz7;>NY~3FG0yITbK~@2CP_zqeELdLiM0g75W(oQY{te2nff!Yk zn^>t&0yun(_llyl?gxq?a?z>^smyEA6jFz}sUrcKDbRZ`^m|Vc%f6OHDKaK%eTtDx zSFQb4u@SAz22*msh3f!?H+a@5mcwqy3|8395g(A7X|#GXb)(m=yXQ)PBAASpT#@dR zD7V=w(T;V4{)@VhFnaA8zgI%A0A)2mw$NmQRq8T{%6p@aq1=w7aHj-OQDOR%eSaK> zRTGP67YQ&}-T(E-ML$3|`Z5{o{u*xDe>2?4)G(K$rIrlSfEH!@Nya5Pl^lNO$NL-J zw-`u&rOJ1s;Njz7BnlgIB(yQetch>6vc3BFPaqk-7WTcY0x8w?OI`i$#x%Fiw)w^W zF*~HDvCefn6(0wbs-2V-L&#R2_)#Fg2`~1w$hB|Z!d;p`w_anNd(gYwvym-a3(){e zoLh|k=f9jFtcfgJj* zF3cp!4^0}`QfH?l5ASFhc*zLbLwL?WNVsYQ0lh^T?Zr<(F7EnN*q|kv$jUv*&%#(B8zAV6y#A>12-lGi&ZAh{XnPWi7db zLF}^SbE>PTnFa-c7>zoj)1Z9HQ1SgeD^{YPrU>#Qp9WWi%X+4S>6kA08W$iUjgr1KFZF{PG)x_2b?({1H_ z!H4ZSA`9e));FY!d1-c0Uxy~#kKzhjTG^7PbT;7`1xeE^ZU#P7l;-m)Sa|0oOYqi~ z=*j2y>#QCi-1?`_wy9Qsj;1IitdlDGxzt(0=imuxiLww;qb_d{PnUB&efw4x@9i4o zrkZiDR+W^2sX!A zH=A}llYT9Yap%MBck-3&sdl;TYcYb|c^&vH5!!p&G}T3*Rf-6%(Qb5@UyLBm5F;ll!u5Rv*DC`cV=(^PtHVb+8^rA97+Z)ah#IN!#haSmJ0D(ld^3^nMEJV* z8SGhRZ+$*}Rjhq87#+Taih3B$zh19Clj1a(<5`6^_H?a!k(KSQ6dA0dplAI^TqO94 z`V%=2DvNwqop>p{W5Z4m{Vt1ww#v!eSAU-8&hx5dzB^Py-soHmKiGUCpB0Or7Cv@h zk8P}h3}qftCE>eK&8OV9>m*lPuV_=@kq3tWh+c!PNN6pxdO%1QJw+dYc&5$lUoZvdG{Mk}Ca4n)KC#Uol)Vf)zinTQr67 zROE!n5Kdva5sKtamD#gAZJ zoLNsPePf>DqD+|^3E^`zw^_JC20MmY9d3Th2ka4>t`;xTB(Byl-QPM}tq9zxd?vmZEp~ z{JONjKp){Dtl{P00lZ>WpG3f)=riy8kAU+}w@G};yiM=`xU9rL>o&Fs{J^$)-1|tx zzRc&}fOFk-g(3d&yclqmcWHp5+X|ckLsIIF^JB%J<9LCA{-O_ymBF?`>oO0$rc2DA z9Tn0_Mf}0SH;J25I``h+Gd1A5jM`mOsUF|woiOeRG+fk!Td==Kc(R1OdcjW zb*G=ocrYd`9~9qOJkB=B=se0b$T0Wbl_wazH3mO5EW`NPcG-=4s>S-opQeR1Xzy#{-4c{PM=Nhj#emu zGACfWbDcDB>H#5QUB9aq;0kYnWMw zrGCcQ;xb4SR(KLUIb*BE8HUwOB&i@Nn&M1hVlF)wRLAVfclJ2s5=EUHM)$d|KE&;F zXSDPT*v$j7{>;L)Ng6v*4VNjg=UtHnO@}@cGo^u`+@0#vdh^ppOJLCuO2HS|L6>P8S#cp6ul}6fODy7frp#|p=da8Tmp&xjA$RAuDDAV95 zAV-6CxJXvt{pljy9e%ziOTvM!JWlx)A=G(bi`vXnQ&>q{fl0vQAd@M!N@3>!FRo96 zaMEU3Vu3JdKKcE^8~UWKfXtZ#o?_R}PrpqcvIB41Ooi`8C`GRV1NN^oR6A~=PbH&z zC{JYeih}eb2QME5=5E*G8ZxGe9#loI!o_aaw-cX*%!VB zgg3G(JcV+$0Ua>9Y2}5(voN92W-MmVsU&#Z`=sH5qk>u;z*Vr&@hsaNu~9lE?3Q| z8%i#|F?&-C4R3J=A|SgKcEZVQasB{bI*kcs?0xHSos)a}57$;*S%sSp(=%0NQ@J z)fuRXk8ETre-osAtE_F>b#6~PcfD6jMDnu^1rqGGF+JFK*Ut_VCx(M$YzZ(U=>VCN zKB@L$dX*S?{_3rU3rb}jCn>wm6jjliqc~Ewujd*mK9#$ZaR6AKFs|yqr^&}^G^fa` zPsqxS!2}|A*C}@VdZ9C=hK2Va_q0R#?lo_v?KH!}9^rIFg;C2CY5`H1E!VOZe_)Nt zSD)MScfARJTtE_yT&l3=(Gox^<71Lrs4G`P&%2vObR#flVmMyDpPK; z<-nT)m2G|6X78rzk+wO{9L?n9GEDcXeP6hW$#0d_uxq@ADSG|Jc`0xW7n(R8h1`#o zw1H^g)XCUa4sIMRvb!U$Pz4*dFg4Ea%)%ZomL?4HYgTo$0vc(k3a-yf#eU{Y4lUe+ z`BZL*UW$^!>Z8YeM1!jiyT1^pNv5>xJ80pj@wLYU4s}hLIcXb0UFDEI$GecPt?Igk z5N>~QS^ts{Wt+&^^%nL_5UV`BNNw;pbN2kAu`XDGM^h02lPe2Pl(_geGe!DM1Fzf} ze8id0D-0X+SmMzCuI%`CRo?%mR;fDDtub!%0Jz_#=t<#+^B(|Oe`YV0&EA(8+8e*j z4A98$%!}qdVVp?)5lRt2wC6yI`T8i3`KKRb_Wua#3bm$x@iKa$k1@e(09&K`hlPVA z`fd*4Z~Wn?0TmPpYEW23Uf|;mP|*`K`c=UmZ};UBi=?no74sG)>1PS_rSp7`1g04k zwiX)g2HwSZyfYSaE5y&o7rnq0cI&cF6{>s&sYKfW%HpU`O~L$v$m;PF2;c3|z14BV zqd1dy$`49$_Quml%}4HcFPL*|PWDqYOI3QkQJueA!b0NL632fSVVyGSe_<6M0=4kV zIj|O{G>g`v{g!p8qMrSRvfM`^5Z4qP(FLBo*+vPsqJS*jN@0pj^^xd?xq`lbNt>y) zSPYSzdzS`)1t|s4(9MQqSN8Z}{+NakP{?zwZ7Wf2nJ+KKu5LYNE0DZ%9&>iFOI2C~ z(UGBi5%wmlx(jmzjW2d&-r73&;j!2b48F(AHYp~i6x8@4PNj52{|P81tFWa4Xvd_# z%4~oIS3noeRqJi47`;NWVI82HpMq~U2T$AJx#VZ^7{!AXZNdo}h`R%de=v#XHAHDP ziR)uy&r!0nx7%N*8Cg?>qAdsmRlkT-fXortgkJFHDKTNcng8#@iQ1iQV`nTS6VpX! ziU~TLa4TN(xmt7>`llO!W7CvQ&gu|68%H6$P2;r!s_TJ7Q+Snbeg^mD%`@i$)71&K zJUr+3t}(O3xhQgytb7k@B?Vq>cvH$!)FXp$Vc+!)Wl{A&{c4)C`RYTbznT4JLd8`N z4PrU=ho8Z^-p%dG_ejE?381~LdD)y4sH~wSxw$H@Hmtne@Wqj&K2gVob2e1ih!E@e zzSE$6jw*maZeER!lO0dIzd;in_Ke%$2~te-!Tuxg5ONR#XrWzdWLeK6-*q^jp-M;$ z^(vELb`~f&KCD+2j^%7n&8$SbKVrQuQ)k?$Clc4Fkvz3Gp}&S(LJ^#2454tHgQY@4 z4|L(o)q)Pb35Em6Ng%;>TIkDC4^l3mf&DLaJ(=xa(22{xWU~J?0Pz2ECjJ9zNH&3; zPHC!&e4i+BTAG`ivoYs$l%4?)7-|4WDXj`q{G+T;>^L1_W^4Z)vNkkyQf3QYx!>Z$ z_uehez-uX{20?E|tSJKToqN&3ixa)~5M*(l0KQNrr-R{H%bm?BV++{kyQjhc!g*SF z*isZQU0MMs4G+arQo4)(b-^XG4B48z1ID-x15%L%cU`I-gdy)TXIgz(X&U@hKJVubDwq@sGX8o!_|_GED!r0 zOVCgAMBPjsIk~I*iwk-a8#a8K_6e0uKEu-E=vh9lIY?pBQoB&&Hny|C0D#d(BnoH$ z3aZR+{xh2PzwxvG7eLbg-j4SB%QZ_E=5Ad9tclkuy}yW0HR650lp|SjC&{E9}#lL_{@UYi>wqiE;uIT8bu8M}2*Ww$@`g z-Zz^WhPxPl*jii7tK`Nj<_60{MB6dMhRp@N?zdjG=Yz9R3o!tuwFYQq917n?RywlD z?Hso_61lr>$L@EHFRDw?<32-zXTZ-CjBz_qfiAjrQ3PS zbUJ2iatfp$owBD+CA*|P{w_BgyK}Vk*wB6d3#^(aJa}s(BO+Nsshg0qq?7ul(^+Gx zB~@}j@?#Zvdo0UEp-j@1n5v!B&j&cmKnXsIGI}_-5}cHgo>8Y+hoX}Cj}k+ zRt~%WdaM!QGwb^Ptv9)x$b>)_F{4toXb7?329{w~jRFYF5+wjZMH^khG9LKxN?Dez z#!9bdVJ8cmA8!Yt?xSoJmu$puL}+}WRw7W(E{=1XJgY!wC?nk!g=|02v^g;F;d@9Y zSe8-MQ``~Dp)QOeMKuERdDruzt?7&HuABbxqwm0^tRuh?rMR0X=G9daH!1 zTc@{7GHJSxX~)-OzHnlE|4SwS-)-~Oxf3-;Yhfyj$EupZ$?V(41P@hALcrU=(or?H4;po0`Rt6qaD~5^kMOw@FJ)JBKk5)R z%iXBJ8>gFY`Q|5quFjiX@628FZK9V!9n2O%v?1J%F8>qcKe#WEl$B}ZCiqjeMjsD{ z1rRV4NOJF&>>8XS4;S$dc^6+)w@#GWQ@r5m0qrg!Xx6owmb>ngRYb$~>qGRKb_*0903E!`cM@C^U;mL@DI@ZD2KtP``A5 zM5W%_0zW;B1GIOLvRxq<`7FYaQm>Gjv7T4;h!w_ZRZ`d>QTI7y$ud5|&jvE4z=(V% zh#5ada?4ViMjXb!c{h+!=$@HjbmW_A6+_=Qc$nYI&+lz}-l2d}C zq90SQUyb0{6Xmh(vEf0&u@x#tl^DiZPW9;34Y#KVXJ(3;rF5>CGm|q!r*8H2lSJnP zruy`xu@TGk)?NpS$QGEIfJqz?P!}}WaRIq%@2Ov!@QvR2OcMW><=onb#)qA8L7@qkH zHgY6Sp?x`O95^-8hqOk+oiXGQYHXkGR}}#2>z}$`2A?Uu`*!xJQj%9@S!dGmr~atR zw%`=QiN3W=IQAsf!03dVUcBTsDrPSRa^x6CMyM|d;mg|i!~&(nXBN_ zX`to#j1hgx$XeadxeuWV-Nn4_QeUOsL3DD97NSw0ll{Wq0m0u@cW1kR8G@I!U`0Io z_zj&vzvUIVU=?UD=_3{M^IKc)iBE*K6MURZ#a>Vhg>p-9hU5fayS~XHqPsSLH}}m> zShp~EP)>kkPU{TwbzBS=5W*D-)Uufrw#60ZKH%e52(VZrVI{TCMNb8_UlN3{;Bj75 zvSy*#4ia&<$KG6X(SvU;^CgB6xcuARFr{BIUj%U)qH`w&JEuz0%apg`2pX|9s>KX^ zdp+wOAtE!HtAIX1UTT%UC8#u&A<_hK9Op_5;-w!29q?FOcZ^vDnc_Xh9d%!c5?d5cO(|6_wDtTa#=pyZEG7 ziQ;rYSGPt?+OhLi}t_Su5IT z2UnR1SpCz$(ANp-;_7LI$<472@waI;tB^C$_?5FxQ6H{kX<3s~Nm=PNc8@%pVc9O{ zA|24D_C!HX)^t32o>+Zz8S8=_t%!vkB?|F3tN1d7V`d#x;9e?rOAf_wg>z<1s-For zw3YK%x<|PPm7>(OD#aR#3!fkP8j9|S{G!vJH?a9fW{5d=XBHifz;7^mos91mwu@ipxjGa!E zL0OYN{qt^Et7>{HG<+&FNAPT-mny22aK}#EhP$Mk0ilJ;b~4E*!xHhUUGZ>^K#*Dr&c<6U5fWliySEHVW!EY|PiC@w zg0r40EXUz~ZwZd$Koj^BfFKqNb;8~H)x}eN9o?e^WJwJqNd2`N+oVWwnBh`gN6Mcw z5;-cJ-`@{iY^|)g5d2ABwtXK{yU4(qJ8RZUKLAu?#FlJh<==qJ|1LF0zeyW|HRLQ( znwlj%qF6jaLfl`h&n^U*$71gv>av=&6PdPsR(jg;AtK2gBK`}6Mg+c~yMcVpWiQ~$ z{KN!c*#MB~(GxcIrmF$~lqvOp)*9JA4!e-c8X`z!^-!&642s9Z_350gmMlPJ9qH{h*jTe3CKF z7B8&Q%$qcUvP{<`u6G{--lJ!xoX{eDVhmq0iYG+!(Q5Q|xdKvcMbQ#vZkXKQ1(Hm7 zZzkSz9JR3Z4rTk`PYm(hYT&0*8Y*-t%By_-4YuJu(%_^A&c4jF58rF2lE=_|MIS?2 zS+;YRR7H_w$ii=4$9j?VOBijCvaz3=sFUr<+M!YF%7dY&g$-J!+TjhmTA_)AsOo-i zUdUb!6PfE+$-zv$zueS5Hb&D`mW(R7nI!I?)drPuw{mSV%Pt=%-{PCtl!cYPp z^w@6$0RUn?1aR8FHX!Cv@}dK4vj;hrtM;eS#QjF_LpS$n7>$8vh&8dmM=qL(Al3LN=lYx*%L$GS#?tWZPb+Oo65Sdgg2VC{uYnIk7VQ8(t8# z7PzQmJph6$Mw6>X1@hE(t1clbQ-)5g>xy?5$A<|si>r5kLw36y25@~Y6oAu#rwaJ! zVRM2^WPXW$mnIb~_l>B*n(Q^KkdpZ8(tXiY_su$aLJ)@)j34j#kB-1M;{Q7&%93;0 zdpnoc>M|6-n?Bct4hI{VFZ273+#SPK`aE9Vr40gffhoWq;5p@p0OdsP|8cYAN3GxQ zPBG!zY5G8bTfp=`nWTKU?yq*!1`y+BJ~APX*z4UNrEI1heiwV%U|@-h^+tVj+H~sN z3u-8JDkoJ&7>fd+b1p1e-I*)`mSiP_X)IQ?N_2UDZxJc<?>bY?pvu%K*`C79#@-$TC!BeFmCRXqgwSNEtm)io|OhwC_L>41>gb}9- zL_vqmcz`t8v3t&}`q0U>B7C)!5O7|U0XrM&PPh+XHcs2Thk!<$?Zp(tokh(%s4=7y zpS2{VCZM1UC4Z9syhF=ElJ&~`9-+|xK_tIZ zpK>>;CJlEoAeZI%?iNVUwo&(G=G9b`JVUId1&79ik=@>C?TfUsBCA|6n&l5(Y|>{K+WiP!32 zYEc~2HBlQ3>k-jCd&wC15kH1r9Rd9g867DvNgGV=tP5oqC&1a(#CH2ATmK0O3L-DlnglHSXgXe^e8-lMI^{^h-Qcr8;5y%2RN zW&dn>>%4R0w%=`fHLoPBB|7v)Ak(Vt>M#LCJTPC)G(*)cU^=-0w6e0p8pE$cYwy&k zlz|(;hsW2IKJ_mcuYE(buSi2BL`{G*b*FT4{bKMUnq4O&Ih(`~yPl3La!f@g=3MER zUWJsFdPWQTfCtuC%S0y1$x_-}Wn zV~GMYivY~i%4x^9mJE!sL2}kNZ;lFcIXE-Dw>G`?&tq}$K|Ro=>s~YutTWZu1enRp zv6b4_fa|mH@;zX?WVVCwjZv7x>Q(+zvjG|qZfpxEr9PXy1&As@Qx#$Jwaez-l^t+_ z|0<>WzX5*$I{a^f%+*F!ssa5Uq}bO2k(Z;KbG7`y>pbF;n|t`pU&PJ?>B5f*7Jv%~ z4GooY`d@xfwWb^Jxax#Dh+0s#p`^R~2#{xaw2`mwH$oFoqn~wi3X={(0IqA3UYs#pAnPFOR_*}E&gvvg%R;4fk#4Ov|Uv9r$q^rPve2LkDOzH z{tp>Fv>9y=mkDCO&LWQ=49vsF8UwExN`gM(MdeFLTdHqq;zn{}H_A&-TNOMT?5Ifm zO`HWRiXmIRyVxrHdN0O1yDf^y8={{M_$dsMcnXX*{tNz0{)l>qA82u=2ujq&GY|`IWnXYE8YprF{j5!xc zDMFo9oEb|}bEG%68Wfy&D{&-y)ah#I_+Qr=J<%qGV*gHZ!F=&jk|GDBA}%1NAI07@ zPbnvT3oOs6IFAOmC91rQ$NT5CeCl&EYqL$A+!OoF7J<_(cYum z859I3Ce#~C?Z|lJF8E2z8b(l`b1VTOiQFM_T{5Rp{-<5cm5dxOvRjVKUbaFl=`p%< z?NU)5XFU2sIZW)Ek1Vk>NEP2pL%RdQy>fr4OMdAWBR03owAA0cx=e`#!j0wydl;Z@ zXXo3z|8q-|3fPPZ zyl4VUulp^=UnBYN2*!Um9W2^Sy|2;@9dG`uGXmBn)pjgEbb?6AwgD}!!;keZ01de? zcX_=^g?Sy1xB_G%L3II}gY-~)bHN2xqi-TcUp{@f@8j!mo;CK|{jzc@vIr8Fw)aNJ zO~~$m3;=r6X2!Pnt9N`IstyIJVOh~-c((G82n=|DQ$dt?-Wb)rlMcl4u5BRVkLL=> zZ2;l|-C7d|7e_L&fE?8g2waO_q4)-%SlJ579ZukM*C=q<_3*<^_bQzlIlg%F^2qsRkDTn?w|=~-lqgtY+PGz-$$p2+(VKRMIu3~y4NGO7x1&&x)Z5N`KN2* zsbmG9?f}}?f}erX0mX*MPRzk-c;ITNZS;q3|jSjah z2KcIJPOV6Begs{G6^^zw2xJ<9Ju#ut=4jrlx{{GJCZcZ`VO{k2Rxn9szX;PLi*L0S zHw7{&U0$|5=lbYvALwZwhPG0|8>$4%7R=)FZ0kFOY;VPzxWl3sc5a_ zfNKnG-ix(!@%^nJ=AzBS*Q)*GGjWcA>3e3gj00&Feb`k!3mk%sozCyrrzdkl4QX0- zcZq|Wn<7A%GzsXSlL7hZrsr+`Ba0T+F%Q~}&@=k6bN;Fr&FnKJIifK7i5vXljaT)m zB$v!nG?xA|0SJxour6!I{r5O2$#UPj>j`2nncGHM$u!!eeK1%R&SF??QUDq2%C+!9 zVEV&8KfteX{R>6({~OHzN2vW@UI_?Gz`t;C1;iLYq$1+d#CUYw1lFo`?ANp{0JO)S zkFEUYpxZyLPy*AZuTm z^my!;pUlc>&RdWHRacB{^x4#pp2Rq2%Ub0<)TICxryd19FwH)*G={pzfC5R!Sv|GKZ&LrgH^ z)tbKQI%V*e-@DIrO;67gv`?$!l_)+(znWMDjmdoK=+sPKy44mhYSo`{Lcynw8Q1xY zFqB$I=<^+~?2R+NEbPoBwwyr<3V&{_@b&zZDoRZcS=Yh7hHZ%?Oy$g`j)HsQC%L(x z9BJ9h@UbctZs!Xxg0DXY&X~#~m0kgRt_WOvAOoihFT_~pQpdg9@B zQd`V7|Hwt8z<(gNBl0tmn9e_p8C?0K>3bA)(rxu%Bfz@f%EE+Uvo#yD)4r%)app*l zhl+L~K{(1gIWh01?BDh(AVeh$t#$32jdWvg5ME*oCu(n-BQ=Sh!775DQLddGLf07e z-VZjL2-_BBes_(qp$}Ju0UJK!=qXU*i}UG?Vq}v0+l02VmK~QLE$UxWh~wO)&PTue zHM8{NrlHJ6V_&}Q2K43DUcW+W)=>DeJuP-0F_sO&_gJnDl?=|JG&qM&=Hn|iMk5-F zLG6B+PTs~x5_?}%ksC{*VS_uK^BVC`a!5#s{+}c zM`ag6*PR8qpa2u19c>6z^d&{6Wo333n1lQme2<`-j1W0fVZUci`kRby>0|XBf z+}*<9?mC13!6o?M77`qSLx3RrCeQoS{=V9OcGWp`zH|SeilM8yr@Pnc)oWeX)of~b zZlaHf&biBt?L2R&|Gvtc70AEx!84anEXE|enAjBJCioG!mSe3Tk1ONxmkpjAuiYdS ziqxE>Coic@1P{aEb-F4mK*NImsRJp)amLersuOW?lSOgpw4E%JuQTwoII5Xf9Km-borG!FRNE2mT>o%1Qp2?t;+tbEyG9)-`^&+n)DG1P#*Tx0IHUt-#5tt z9s|Fwqk@-}3{-fA$Jyg0*45dABnqtg(A`5oFzchaQb%cW7i2!&Xv|oOj20VluSLn9 zXYyO(XMz&QJdTb=Zzw!~Ml*R`s3KZ3co9^U<8%ed{U~BWWa2n!WS(OaMQt5}fn!l4 zXEh9`>S9q#e_{Ys`tLoYF!09wyDBS7OMhKN>gD&%L57~u`((#GF5uc&H2(qta3_G) z8!_2jA*6rYf2RTfC;a>8NPfY8JNfTk`v1eGuahhLX7 zTWqeWsX6LriutPx)PjNy0iXmj8Ewu#0dXMdS=Myz@E1qjBw+mh@GA}(>7H>suW@#w zc=wmH51=g!&)8t0AAU&5BDM!E0qGR41!z-4*vAx8@9kux`E7a`ZD%1e|LdbZ$;$za zSCrN{kg-(KvwL!gz18P{Ud~Zip|ao;9SkqARP+r-ir^QxXBQMIp+B@9YsL(cL!>}L zi5VRq#}Z$LKfWLL)HJ@YuIO&GZ%CqoKA|})2KxwqTl@Xty9m{p4)cDwmQkCtO|A)j z?&mj^_%5zyDH(%v_RyOUOd-Bf`BPsN%49;)k5cxfNO!dHd zm_^_iK^zm?Le}4zJJMFZ7&kv+D8O(E)0YDXAt*ZS3IU2(PQ;A9qe+C*8t{NdH*j`l zppoCpI>OFec)Y4&q}M0!xXl{VU?hAK2cG;#<*OZ+2A8m0T<3rOAtuPD@+~c%+aI)- zY~ft2Th!s{r}B%e15wmyO#{tgjq~`kS1^|-J6Tb_Km>7P{3>|!Er_i^x(}V;Fi4E;@fHTZhq;~3hzBhNW zISOpg2EktE<7|j(B=Z=dLzNoMbAZsl^}RqPW!{Zq-kZsOXtDWg*m!tj7m7-rQ|pmJ zSrap9{&SVG3dcS&^^vpP84V#qd-)J-N&Rywk04B2@LL(oi^P?81_?Birpa6#@KqHc z=n|ph@~eDf%UYD3shdIhwSzn3%WA`nsny`eF9B{JZ9!s}&YkkHmrEJD^lEgvioIO0 z<<$}|Js$B?+z=S{&g81n_@Y z>Pz*RWXwiq185TSX)!QpWe>xcCk+-@#ykVs253d~xj2n$5^XPPeo2W5u)-?0iTV#e ziMlEr$8pmn2X2Os@p>qj?w-{e?s!?9qf6?4yW;oJO{4v>IXJl0>_D<`0-MIPBuJV^n6WqqPicNn`jke}`3D-& zD=lnvWlOyq1;wDu#p-bFSB=#80!bQTq10JVZ&k_JwUyAWgitIV^-y6ZmQ>V{60g-p z9mPSZjcUadBXOkVLxZzUVT|<=>bk`PgEqzS59dBc%SWvF87=kS>aXhrFLi?JoBXc)QkEyarK^p*(3 zC?B!g`SD8)C24yR^M5pktJmtbZ@HakX)-{yyiA*VYG(rK!+5rcfQXk}fDfs~hHh`t z%M{sw(rx8s$F5n{CoKo7Pf~p3Wg_Q~L@SOfXb$Dz5i5XTl0P`pnM#e*AJ&zJ$yu|V zHO=8iCT*bq3Cn});d_NXoPS-;M=v%~|QtJC?&HF&CRV-!gEnLQ_5~k_gdcm zB%_!$JQV+fG{-E<1{s<5Iy5Ij4M&LR=iE-zhxFHMJ$ZHMpW8+r;vkeLrSvL#$=$L` zKRzoTV~?V7eSK8YGYKw=_N`FX3&jUUJOXaGQ~n$4oSsczc_-h!M=;BUJBK?P+7f7r zIyEsz$wk$QDD@U0x}wG$gs{jF;ZuX%ZS!*O%bmh}6)k7AWQL7PF;Trq^c8 z?;%xNrzr77bgI>aijRTV5N&-`I6$vUY^brgra(922}*@dFwrCpe;vQWS-_BCT9jd( zhsdZI7ZF2V0Ow$)~oT0`-$n#bs{0-b__=rFz@ZQkvjr> zH+PM=kv!w2?)Z@}IeCqS^XtgU3zRYpu)UYOno$)dfTj-zI^vBiq^_j! zUz|G`S--{t%2ZdrpXD3Q=sS~4^2J>7md&9P$5R;Y2Uagfx?{E9n zr*3(;IXUzGWElNn6jqFNyJ-{Eq$J(-jC%`~rKNSZZDG@uasX0FZKb2PYBRUa-P~&{ zxTGmQyt`%RaX4A5mwQzocNl!jJZhs@LlI#`?hzd&Ufu+$6T6-Hj@hmKM0Gbq z;_EyQh?WEgVCQ>vZ+KH6?WV|jP@w~>aVuu$tBBkI)8^E%?aU?kC#CRHT6Xb3NCXE> z-Sf5NE06{J$esk>y&W=pEzcn(V6L|*+Sy6_T&};u2wUXY@VR@;F^*1S`EWqBtBw}g z()P)|IGP~D3K$A<#1MfJ9mLms#_kIc{oB~8t~VIkYJ`ld;%6UAf7!rIPtto*LQ1t2 zy|d?fGDvGcSu07Q9~XEtv^b?e;8w9udJb2O6ZryL)OdRE0fOnRxPK@xHW>B;w-4va z_&8wrKVwd*y085n@{N4=g*xVz(Bob_+DKg^rI-2XgZ#fo3PiZmRiZAHR-PS43rBup z^ddwyk z1rzU8Eh4%s>4l3q$8#S_$magF-8>5rb=V;e=L-K=bdQ&7@C>8z>75;wUiFQU+tJS< zT6;V2v_M0&sru72#KUGLPebJQqS~C{>Y_42B}J}8nu5R#=F}mAT1dIM4Y-83+FM=F zRo3?>65ToR5-kfX$Z&k3-2f1ff=yJCGK-J)Bjt3f97c`}?~eE>jQmGa(@hg_5WVP& z#)ny*A7RibWD;JrrkAUQ9Sjs;xTwn!|5I!0jPCUhhnb%#!N zmd`i?7+&Qk9YG_ESzW@KF`QJgM&^q=l&KBsSEqe=v~C1F4}NOo$6<6_@Ko__@b&)w zO8KmXuqBh%B5R?@Q?kE;%XCas92c`ulTx&G3qHr1oR*ji_fEN?{XnP>QDBn9RrXj0 zm&8t?XX)4SkKx$h3HEa2CBN6t6Q!O`L#tR_9D^(bu2naDQ#x|fmpvOs7}#eGHN>dZ zDe%=cez8>?B|G=Y*bgZf#jqoJX_w7s;avPw7!ySvWb{=Ch-$xfLfkhdVBS!4XCDeS z4q>J@B=}a|S}8#=bO)H_HU)RmXBD04lIrTj(4wLKceu7f3A6gHwwRdQV5roUfq_v4 zpSckRt7|SF>x*$o1C~T9MpoVH=1$Jub$IAS0$xWHX9Ba zw9i$GG;bCeN6379yu&>qYK(g31`_yIt(Q9)iSl>gA`g0M*(Q`w&3#h(j20BL54b3Q zDu@rHoCUs9S_W^OE}4q``TW)#7Z%qQq5f&{C_$Sv*k?S~;S$f{dVEGl&8p#Ta7pI; zanc(G>dV!4(Qf3^;NO)}u0rL4Wa){NHB*gUG7eNE7%!&t3(HTIwae=Z_P}<%-@r$R zhu+GMs$Sr)_YYa}<9BI5If0zZEXy5|BCl0v-lFT0X~ozIthPrib$*FQEwJu}|Y!bsRKp=&12yxA`c zdDhH8L%Fkx=+fg|$Xmt90oEAl%N--U%mQvQ#!L}_Qk7#Us42MhM6gXgDv9TruQ~MP zC*0xU2sZ)>;x%Zl<=o4jbejFPWJhT41K+yLgJIOSN!)(%^L-sIL058&61@*Js}vn) zOGfzLJWd7kFRn{i#yxtMZ9F2Di0Q`&=QoBxWpm)J?#*>O_Bnz!+V%Mhat|3yCh18Z z5gTfyq`h)uHdY!hK|!wY<32)#tDRQA-4asl64S}CAH>8ukD*C6k8IdUWCirSlBHjA zFk?=;vNkGbm_7qi4*}6C61%rd28V+3Gp>&MFUu~`sX^m-#Dbtc~V+4BR|%4}Hs%WVq&YtLq9ub|AllULyvI zfqGy`O1*TS922#)i(dRD=DKSYL{+4dD!pHO&MQvu3kNlQ+SY}e1n+fwb1;tIRzR5? zEZQOL^6$3Z6vfGN8Fs)l&^@A9DGbNSyIAc#=H)1;v)gjup5s3{am2}lzGpFw&6NbO zl%m#2Jf;vZ7VOuRSa1v4uxskq<`sM7QJZS{B{;%Sn+%McE^Hd>9E+ro7wfAYMFx!U zG!%iv)iEhkU*kU%K{`AZauk{=q^Ri(%jd@1GFI{$OP;R=yf5WSNS6EO#N4Eob}P8c z<&nq|`p+1G^ekE;1HBkXUDwA(g9<{foKIL+(Z&%uraS40Z8@MUsJA$tI9V-feWQc@^N5WLGAi@9-9!GWyc*P{`vv_&i=06P&laOa|4M?2MngP^1>svP^RsL94XKn%yL@0CL3$p*LrUV)sj^q zplO$(3~thSImuLMu5oq+OHPcYxiA>nImg@h?kfgj+Jik^`1WqSHA9y$rjXWN^au$@ z$8mY~rq;AavV5v-c5|k;ZQKaIoB-eW*V^}`e33*E<4+Kt0={)LnxbmfCqJ0M$pz}n zUnMv*xsT?R!;Y9lwMmp~hQ#y@O^mW(R&eelK3-@GCPu6Ruw`cD4Q@$iY~^a?NUR?V zNKG^$`5%Z|{T|pGL5!HArURMrNRczQ48727!V^!LSFXm6-Z6eyeZ}ab2Ju6ec zgsk@nKuCI1-7z+URZ_=*#JeYN=Ax<(z?w)!1yWPHm@%H8xS*YsbsJkDMo>%I!~5F6 zH&fu0L^EDRF)HM**q`+vbgL=YI_mCe1;5QF;N(?Zq9N?>_qJ`;_n>Sd>vai7}l=NcJT;gk%dhF zodE5);ZGGm4ds9GV`kK)gv@#@EXTu{bxkP2me7)DY>mE+>KVrl)II88wc;VqxEHI>Kdx+AYE z5AZ)IHylwi^>cdjn?qODYjxCLVj)T>&OVegma!)tbZ5DVLR9;k8|X(P1@1Q*vI+*E3Y9DDp4;YRDzq zHv<*xT;(X5MhV{lXd$p@p42@WB~vC}j&1flvausE+3M?pS`wPf^cs}yns44b?_!CG zu+Olg7ac>(Vo8Z^+I}iT3T4z9a;Ku*5Au7l!b(l<(K`9ytiXxT4NP}Y@*+Xtg>xDT zE<%Afa|IA%K5Bwqp#wdFh2e|OoPCj3xEXK<`M9a+j{1|oWrw=Hy-~Uk&ayH}pcQ$Y z6vP$gY}%2&f@8h$?R+=AF`ZXvc);F!&`$Ty6V zf*>PQX0}Y;zgftaHa(kz7hLL_FoU;cOerdi1E&i46E)( z-|d^WZaagraC|>ZdTkre{`(SHg&12W`?(_)9v6IDkJG4;#jd8$sr(7=FBc4m3AF;Yfz0tRm2U6M$&~>F^lv4I+0Jd8igzM*OZk zPO|ywzTTC}%_{D0fBK5ut@B;K%HwD5iI|Y-Y%(&6;Z-gPH_k}^$}Q1nhx#wC#{IN# zgn)S!Z}~bSFQ$f1sTz)V=R4l-6?mon#Ewv`PVT7NBy<_i*Z*r0RrM<*PNcz#t2{2o zyjvHJT6rTzVb;GRe+DFd@WcMRB;tvdk^CV)dpRo=XzX^{Wcory7dsos3@qmAlD(6D zm7@xiYo>VRU*bTHZ$bRlJ?{ym>j9^TelgB83eP+}GoahwqLMj6#~Jfiea? z4rtZjBam>8cD*Uy^SF_ZVrow{rPG;mzcLdi2yZA8c9YsE0Ah-`^evf>f4I)Q7r9Dh zV-lwJvN0-1S|+A1+af?!AwQdZrK(m*2Xc4_tQdg+ZbsZqTn6}9A;6Od9B53Ig#I_5 z@8<(kb!w@yVKV{upAt~|Rnicic3r4M+}4DMc6j37kNC#-)y={Ax0Rdkv+o6ub%yDl zUw-obenic8Z-*9Lqe%^c?{|74C`L0yPu`wPjY;T-Slp8i08@2!4?4N?g|77k| zQ1Kqmd5`79wjv-gy~f1QSa12BCV)vfeSVMWWSu4lGIumJCww8~ytk+yid;+%Rnt%- zfjwuB+~di{*pD86^F!TA+)o^?0YGsjb*Xcti^j0^;t}4bLHDnMuL=14Dk`(JPW^}*j&4=-vGRB4ga&5_Pg%(i))Iu>uyQOFGp2(!*jN`>j%DP10i&m zH zD!XI`m0}a#1Ns)GpFN(Y48lJ=l)u+DSJqT;xxR2_u{RNB=P1Upd%0F>=3HEc9#1O$ zln%lU57TTU`fBq-M$87iS3JgYKY%$wKKOOVUNuH4t^|q&H{Vz4?;jx>7=h**piC2PipshLrII*f`EYAfQ2Y!iBPIEhO2T3DE~1&<7%oh1P^g^6fq;|!%pJ}rPUBNY^uk` zTI9Cg6167}Nxo$vL+#W#W;dWY+Q=?8!DzVxp@V?m+8m6|Du?O(T-C>}^1K$qP0jLI89K;7&g;3&R}x-s^KUJY;8;vBPI?~79g8U6Svd)5 zBD(duC`(v$Z17Jl^SuV41$3XZ9$6?wLXQ(w?r0P%EikJF}FdD8mk|e<N3N58(6W2VQ92MX%cpWP$nBX zP5Kh;(!lgE+ha@CAHr6>b)Bv-*GQ}()i}JOvgCSD9wV{iHlUOQ#qHLwTWtE*vvJqOqyJ^g@%Q1rot_v(|`Nw@hD{=^Qb*DV$YIT zKAhqpKv@nh!7M$n*mue2S4b)59XGI#LCIqym!VE7!G50jLgs~j>>2}OE?BCfxmXEm zel5S}>)LMtjk*3cn0>cCWOntXPvd%7KfB%Y$X4>toRi;4hS}ZKjO5jL%BFyKbYKE@kyNUvLwMWpJ%Aq)&%=7mN(I?;RNQ`E>J|L1$o)V2LlP<(m`-{ z+=HV)NC7LuOGZ=4f>1a&leAxFd57m_PF^OJg;>CmExBb4g9YP-oMJ+y7ZMF6-G_1f z7{a!q!X?eOimLA6PYOxJ+-dD{)2E^%{L{pUdFso~($~F=Y|C@6 zHnoeCGWJC!^`2HcLzK(BFAUBRxwz~_!M&O>;h8LigK+Qyezo;7KyrbE^?KxT>uKUE*)jC`Lsy z2$E1%j#(r8BSmQ0_{fpIHkY)H6W-99Ro8n^@b{S83k0vnCs3I4ZmAl zGrzUpZQj7eBw^WJSG#uy?`|P$8MY~hk`2#Xty?pmZ3L|T7xxU*PrS~}?v5n?OdQ;e zeCYG4ydFnvE?<9LVYt5d8RI`GB?tKvk=~&rVB_l;B@gVXoSWKxbNsP+kLmsUbaCcqU)deNdiPlUD(?}&f1h&V`S&^e zpTn~Ms_5JUI|<5y|Lv-473W?~XH@cf_+C<{p9y{l=&)YhYw7gU-pldO(1edI<3`P? z0bSlptbc6cG;#4joZTa=7h6cZ zZbJ@E{NSIi8&~6t1`&60YmJKF_@jy9Ax3?ga7C?p17=(=p{to0|1`4Pq~@?(jxH>r zms7q-i}+Zx9i-sflg z4Wo+ghtlC++C}81jUI4%8Hs|tv68ed2&jgM`4MiII52=TrEf3&eL4oppF1V#_@4;& z5Q$KPKYn3<#f-^Y{GoS`bMlTKxO|`)!`W(5jmy!5Xq$x7S{W%=TmI0cQl|o8q(MI* zjvE~}$tzK_c`qVF#PR$a^V=w!Uqs<$mz~%Z>tIPo+B{EQ3p(1<`0{TM$uf zLRrsTNty%hD$ajiNtV*@aHPt!Ue4t^B$zda@JVX57l)8d%3RWBc%@p)K703i;X!X6 zW9bV&8JhMd<4;Sg%6UQ&2pMSflmD89q!l-GuR#`N_~aNJ|(Ko)^Q zN|uHRR%+yM=f*JSw^aod#wycf;~I`geiDISuIm+mvQ*hFKjBQ_yY}Oxs#dPK;gqfo z+>oG(>p~Y3qo>>De09Hidrb}j(5OzP(qsR#se6^Ej3ndcSl5gQtJ5@FzYSbGSh?^^lo7mZ;WZ57 z;7JCvzqt7R;n_L`kCLZrQg1k<)^3aL?x%m`v4~ZR*pzLDh{GfomM@1p*`7eThG0#u zo)NTSvr5Aj=b6*exZq;z$$Hoy?;Ae$aaY+dW$J$F0uMcjgoo+xRb0Q8#N42FD+Fx*9y39hZHkdALCiNPm z!Tu>Wws}@K;S$5Q)vVc1(D43vg)-mDSb1o?oLPYNjWL7F%i07D`D6A#JVz3I?I95r zO9IiFjmyZh5-jli!-weh)Bsu)>5n&keR{fK(t2T4y|Fp%&3EWYd1OqKA&I-<*S-?( zrk}c9ktzOTTA2T2y6AD^zAfUSv3A_CwCJ-7W0Hk?%r^oKRxusxGdqz{4AA&=t93(Y ziXMN=!ohk$=Q(rm+6J{_%HTAwQMHA`5gsXpxPK*DRzb&TlDkZk2cz>)NVC=%(V#On z?(rA8hU*SZ(BcG|^U_o?+cI%lOPDI@BNs)fr=>Ac%#z``f9BqhX&E#^w zg@T-WhI3eWu`60;v8>mHTM@`s^T;{=_a_>^X0RQ@{gleter0r3X_~L4&{fUTNM5{tRrfvb-D@pkx5wLZ~@N;MmdDag1tZiyA z?w{r$y@j7PMO%%eN(RQ=?meSTZ%OkX##Dz~tTKZ?{$HAq!h*PXbcBhi=WPv`@Jp}EpYYo9p?N3ARg7<%F#B+GFl zTPwrK93#O1*4weuw`}*f;Ktj-owCIoOf!OioKe;P@3D*j_gJjDwce;ZIwi`PUD7^A S65x)=2g>s5a+NaXLH`TdWZ*ae literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/atp.png b/windows/keep-secure/images/atp.png new file mode 100644 index 0000000000000000000000000000000000000000..b300976d5ef0c0423ca0fcb0d27fa376e31e7795 GIT binary patch literal 42316 zcmdpeWmp{TnkG>`AZTz64TJz8xJxI{xCM6z!9BRs5!^bBOMu|+G%g7)!JQ6};7%IX z?k&D^c6QFr%r&!r_XijCQdCvf8DmBYuS#>K+I!dH-oXkcO8bHKv7JNVaK zEUY^L*7>f$i92o@a#C33!?at#;=c7Ol~-6;RWQ73vj@N$=bgO18x|Ic`|Z!2MJonx zEUet$3XoS?-X?oDI4!igJ{uTQrRnWp$G<)Yb;I@FKDjsc87nU6&ppuFU^70-z7CQ* zsGu$?k`O5G$Cu0RW#m7qOOeF7ypaNxThvhgc)ORV8x=*-(l`CqVP&D3v%lJs^9JJy zmV*sTOidY2)i*hx?2TM`n0TnAiz3`lwhA)K_mL9QFJ*)iro4BndVycRv~)r=^{G@X zE$1@_g7GLq405X6w=`7h9plZu?3oUC!5>P(wq6w)n zFqnNYfoQ^b-Ntd9$Ii5UMXTTs<*s`zyk7MJFGhlqdU;M>yldF6J(1&fyWf)Q=!wYL(Q{^7WfLVIN8srrf}m|l)2 zrPlW2W(~eHA zb!Gx>LNLs`x}bV;u4*`~K=?POFS}RkN$!F(rjc7y`M~<9SSV2}L8A`JKq{F~0e;2u zgLLAmX!m!EmNz@AQ}1FpTXw3Z$m#DLX-?k2<1x{M`f?+x^~jyyExXOljRW%+W}fWv zA_>kHbKDb$7lRCcA^b%XM6=BD8|YQ@j_Y(haMK6w%@{9=Cpe4p{HULmkLoq|bT~by z909Y<%OK@mYRVMw`uw?QF4n24uRyZ%u`gYJ;nqwZUKtQ^>ri%SO^=UIwH#p&OGp!R z#6^S;OQ5~e2STC8Iozf{yW*-Hk#!TQVvY_D4&OgMn9jbewj7*vs!>6rT}8hPh)YN| zzIv1^vC7Kv{^6H_T!AI4XCTn3#gDgC5qvz=nOK&Kkl`=N#4llH#WfN_cLRe!bX zSlVKIZDG)2+y<+X442glOfU|o&UV&u5r2R1VnYx;nE|Hj_@_@%9KBke-|Bv|5cJnQ zFuF&m!@u3}%6sKQq;#v*Q$P0K!U+k#|IPUSlSTeeQB*}cmr(;Zy8bm3y092HG09Q3 zzO^nF|E9YXz9hF7oq)UYh3C2Q~Hak2#3inabu&i3+v ze+4p$iD!9HCgdbOtc4}?w9(}_hPihs3e8~)(*kZa1>TD)J*^sNN5h5f)mg57bQif# z!4%WIn(w|HF_<1VAmPOsim+Dd+2>Z7n*A+3pecp(rROt&TJLWEXDi2|otdIZ6AxK` zXrgX$wk!shGmW||yC{8NSfo>{YNeKDT*<_?pi@@gQ2ZO6npi^0Zc&iAmJT2lt#`E% zQn}y_yZO_(_nKSz-ddLnI@Z+Ei3VZ1)y3chPfu}22Sl)id_!N4Ox^x`uVRi{mMxNK zD=fjOn(&=45NnYvjQ@wl#s5{ z=_~tOWO2G`p3aUhJQ}-U#kPPqPBK9_>K~Er-zz)eHU^68d^*y@A2t^dhTSf5hJ21A zL;5Xsn?d$UWs(}6`#-7d_Hs9PM7#o3yI(lYCk*Ub4#Q(_Ty*GX{=?P(yj4U-uS_I) z^vOzzPeEjMK~Es;gJw$Tkw&z_m)-&6B*I+w$btKSUwr91?Pd(@dGbna2pJsyR*v4pc=?zK(HHvKH{g0IBIZSJ6tdFcN<$OiEo}R-9m{g z60+ts9oh7j_9AA@8z-PPGPrwfyVA{PanCH(B2J*25!_-j5$U}`5{45CLQ4)c>1AK| zdWTmQyp|RQJ(kjUl)en?Kr0{{f$YBbJ?)xesy{9?RccP0?Ebtw6A%g4Sbox!kyB2m z_(wD4?EMLWW!x$HnOEA4vc3prZp7p!vOW3Q!g5p8CosRo2#q(ya1&){my;wNK4M_x zbbVYP4a4oW=6tc!slA$-JZbFPX^J^PK+zj!`AhT-4Hwdx9@;sfJ+D{(FC+d}i#|IN z-fQ1Q{2EbBRoxg{5{#TPTrsS3NLk!)+3lR^-QYPZ8|WNA(mOinEa6=K+Y#hPasnjk z*ip?f#$c8AccOc3->JEyaf5J&a{{0xVAziS;o0)> z6v}1cTji7347ml$W(m)=VY5TQ5gL4mrwrft>4j?z%%56wIgAIC#)0eysI>$-d`S` z1xc806#Wu6STq-jmS{Iz2(5eQfgE!rQ<)m}s1daDlf5h$@~L$p#T)$W{1W9d{|~`N zAB(dKD<+FX5zT2QtndVCR7bGz`}WjZL+yo%OC)~K>TK-x&i=j_a!E*+Yv$gtW?al1 zPTDY6wr*GGB#^v7h-cZwC{H`N>jyV>a@gmGCnURYFI9;bb1nPZG z7NtWpOQp3YHwbpq7oEC(gZ0NxXMxyG#L1xTr`+oKm|W;IIviWE9pBZ|L)#bf0;q*2 zLD*hDUt2(|ppqBsSEq9hY?2^tDNW3=sG^SX(d$C8nVq&v)<$U#SeQPGti^Q-PD$pw z4jgCiP8!L}F-;qO9{)JwbG6gk=cZ9&_Th5LT*+4AOUZ8cq`6FCj@WuYNegjzP~;50go#Cw%&{$-AMn>~i_KX@%7RTB|J%N+(R`28*-_a0p$W zn1((Gopa01pmnU{iWS;nn5Ug*m8J==Z_F>xbfx~<7S%V^ejeFR*;H_SfJw0sV>kP* z6^{KmVUd|e{gqPt+g$%6>%gZ}%IqcUL&%x{zfHLL^=3{SqBN-67brc@+-3_`AIw`l7Dmcf46jJfTPua z>$WVD>4cMAuc=(U8adbOox@P#3QR7JA1od%*VKVeqSAUK{aX_%zpepw>G|~Y7l)z@Nxb2hMI$YT@WnH$P0HTEVrH1fS z|H{dp{De)X=TL2Lts1SM^h$sl9$58Kvz;du;n|v4Ut+YF0dexEv2mQN2AbaHujVZa zf^Tca4JfV3+Ku1TBu-0_W;cHu$=a4Z*{(p((ye&G4yLyI_1MZoDT@{^^0<_hf)C|$ zvOa4;2=A(trJZoah?D4RUXth2=$7N%j0Q zuLvZg$tB%#ZH>mZi)rlD)zT>(yQ~82-!3?iWg=#sIVC{|O)+lw(NmQ3hRVsh_v(ZV zrAABjt5)T;u=~~d?huo2pY9axGijt`ua#xU&F?%KGz^&DHem}Q4v%W;m2U=3d;mW@ z{%Z_Rw1i^PVvAa$MS77zKJjK}@!+KGayDLBylDAmrRx~=?tSBuofnhIn=FfeN~5Esd~(MsmDsc8 z-sevbT_$}CgY?8p+TWx4cea0<^?>CdoVXFc@XlLiyHLP)Y-8kQl+y0xe~y+064%H7 zJdfc<%U``~xZ%PZ)s2gWquaIKVx(B=`j~58S_5emzi3+C(0jY6z`#7wLkTV7u{EA& zcZT`v2ug0)=I=8HHSZ>BJe{}q+W*<;b+E|2WQT)r0^BK@UOjK`odfPQ5HjR$14u-l_F> z2u+7_BtFExWv>odnulPX3V_%hyL(qZEY{|iz5D6=KePRR6vKZJApR+&+q2_I#3F*z zKc9@=d;6~`y$#l<+kQEfmDm9FSg8(*=r*Me%ck+;i}&K))fLnep*j|_Euvb840*E5z}GQPPsi= z|Lpv@t!g|rN}fxaNZ`mxcOx4yI{ZX7cmMs8ulD*2)OhTpu3Wv$`NkX538Y4y4PJ5~ zhKaY4u;tnJCMN}RO!;WpSc8YZI8~U7{uM_%$>mg6YU38?VfAmeXo<1<#lrH$To{ET zHasw<51UJ2q-`K|&dgSB$!9Dwmbi#llBwlUs&9XEwd+Hx&aN5d9ct3TKI@-a486io4D!p3OzlHeN{w4t{lGV zS(ZUI@ArlxWceddc&tJWnptbl?EKe%ctaKs^SFW^+^e%%3_>D+dgCCaj>!4*mufC1 zUde8D*aF2oD=R&mJ>r<1a?0ZXi-9al~nnCGz9^skMx%d^l#_AVyZwOy%-&&8{s zWb^!0e<~bS2i)efvlgx<*_t&qsXWjvP((N|DoUx_R@eUN>EikNOi&M83l;YB8=q9o50xAZ-zlSL>R!BcymY5Q!&cKlOL& z4Me)FJPA>1!P~2nbQizce{_N_afi^;$FOG=5t32|Ko(CEDuSll4E%n=t6Znjq|DdK z19#x9r4mp1r$5A4FNf8duIe?s`#qkg1OS8CMF`!u=d!E#nV0dfKJBB8(CN0r5830o z_mJvj{4X4z&yUb)=T#FI&G1XodbJ<1WC`?+9|%^w4n!Yf^9P{xkpgsAe@@tkEX$g- z56{E2a8v@OCSFz{XHV*sM<-(PQwC&L_vn!v`RDR!USc-C^y5RxTF)? znN6G^JrqCWPC6_snZ`rSXNYaRVhNjf!}#g;2S3F0*)IlK#9#kO&#Fp}8)*}m#BJL5 zg6-~XYf7zzu?d0p7^*0q>wO)#t#zaGe}x^3^=DM)g%bM=yY%8aLCT@yaCN{?f_mmTLcov-{5B-_OLnQGV99!SU*sL^#P^wT-YRkZ5=5UoI1EEv(#pq zqi09KZ(5|6mal<$OB%w0o-`NoEYT{(8n~RVL#nF;Eb+2 z;GiDK#*+i!%{r_@dM?%9PliQx=HmC}vP>$nQ!t5DRtYB)Z*{r=&Kg2UOU0twCdhx< zpAZRL5CZ-ynkm1D*k`~k075^TdbQIZzUV1BO6>FI46Z)D-*Lh`g1o;I1Fq)U^I`_7 zUWS``wOdV<(Xp{isdf_A7Iu?+2#yl7Nh)gbx?c~N0X>}Eac@69K}Kj-T&n&^HveGd*2wI2Gt%r-zfs^{QZ2ph5Gw5~sgD zNz!V!p-Qcb#!Q4ZwLcOpnvm%$Y1dnR^d2qLDuf!+OHIM#t)(|UMr1d^WH_=A-6r)w z?JT9~H`fe^W&Pto_ey>-#=_WdH)trP1*lCC?Z--}&5Kh!Q%dq<_Qh018wq75jSA}k zh(R9LivU#67~jPm_wP|ShRw$^Sph*O9I{W%3pb!v3)ffenGW0QBLOd-r;(trs>f@9 z+IDj(EZ%~-==#qJ1L0uA#bFdxKluxhlgUa4+_IGP80G|xSPyL-20HTS7ReZSg`T(s z=X7@sy)P@ncrWC2s$6eaC5e5N8!g0xHGY*Kb=3S*Pd|2Eih(SrzKHaHJIpR{RhdB# zR2ZEawx672UKSBZXm_k{uM`XA=diQUWc)n;-JCj+E5SBT019A$SKsW`#QoN;3&Nio zP1WD}i^GHf!;ba#6D8bgV#hQys;1oX>yp7(jWqUQMkM$YX*&qN%^tsGb44n>4w7J^ z>{LFsBHM)}l0PdBY`1bEGtwV5udiK(b4Ew1K1zq1k23MPT+Ot34vpt68CF~DfH6mC zW4X3C|4j*B>y;R&b4;HYx>aA!Oj8_GAmpd?IFB226-GRFPu7Bg2jurHY&Yj*XC{;y z*Zl8(IH0S>laLY~&=t0O=RYsW|6RuY-@W<&m92wiSJ#Kqgq*|=HS^QkH)oPw7&lD@ z`pg;BKDb)9Q&v)H_fxyhX)lHXp)dnLkWV%J5A;2H`>mIX=gPs4jQC~e3#&6bj(8{t zhX5QU?L-#;yEnvcyHnJ}#U*lT#q$xxm4r)Lglxt(b>u0sG__cUX*|*MwL63w;~SWE zi8cOtJZy5jVN5@gQ0}BQqL3aYUzLgIt=yr;JBkm3i*LNe8t9h)x&&Yhx9z_ryPO3k zkor+)Bv4KPrSx8Lv}rSO^T4yfEY`ODXP$G_96%2+02FfZn@qe1A1{`>BU={%@#rrA z7h1?!_@i2MaAj}C;?I5-`b~V&b@8BuHwC|SUMzg;{6K#p>9SOJxd`SkWS~Scj8O5* z=`)D6^@K(B5$rx!@Q)RkYJKA_xfj2kqEl1W)@UaRl5j+%6?iryrpsj~cE_@Rmq?*4UWif_af;Ai;;x0CKE~1G3mU$5W+Is|JR`Psna!yJ z8_!Q>S~wcu0s;wsYmvzff(s-tk@UU&2f&h4LQ%K^{rqG z_s`?J8Ve8g=6zywrg1St7PURu+=rj(YVjYG*l!bZP07^1)*PbtsLQKMoF&qdS#W?D zv?3}+l)DX^RH@)}v-%`r8-e4gpWtdaX0v3}aGy`#m_kLL32%+Psd;cB2;yn=V1Sc{ zN>E=-i>3D6h6fmm4k45N6WfCij#4|Cs0XutgbZ)MXCaL8JOvK6b_OwlK&8uN!O& zZ&8{wA|LW)$++yBE=4f^HbT~(iU0pA#c^Vv?|L;@#Q&)rk2{!|NT}9ib6eF`n0S5c zUzC$l$4ALq01!j~zYApk{i&Jb^6VFR-)$bE_A0jR(UY4^0;Jmc3Q>S|FJP*K7EDi_ z6!J~R-f3C;DJhT**+umnxD~5wJ{FoU;4gKGbYRjsV`Hke_9R$Q#0DZnHjmjSg`8YO zB^$v9N!e)faM9jO9u)CbG!FpC7C|TF4F=OZkdb>y#B(%aeq~4V;#I~IjiNE~_)Ij? z#mKPZ&4hGnk4w5&=90JMfer(Jaf_*!aZsfN8v^ZH&(O z>}@ia&2rfN+|jTfGUf;^8c9uc+DVpJ&0tPUo%9>WA%A3Lqb?xvA)$gViVG9z4<}}lE%l9O87TKg(Y2*N>p@i1Fm4qYbRmA+AjV`B$9I8 zV9`&K_r)x~+Zrgwm%*_sVCC3^(u^rHW2}jO#Ec1z-BgN0Sky|6rj6Liq-LkGB+Lm# zUd_nMwQDfq&0bgJO@;@bk9WlX#$Ekq;}v&!NUA`w^Fot$0-cy=VIb169+4>I)bKl` z)$gp>n9QE7@FNjhL1ti6eyTPlI|(g|>V6`ZsZ)uPAmnL_G?K`+nsFSib+=RggPJDZ zM;Dpr)DZ&n`~>jnw~QJI8c%6J-FJ;pzy8ANW-IT`;!F{+t6Ck~j_pz@@osJC50USd z%X7Fdhb1s6t*or|S?2CH_x~uCDM`rw9jx6sX>uH_#=qcLpCgI>`vd!Asnw4U@TB(M zNjTkkKY(uoc7#x-a#krPh%gc2f=!MNfflIn*$knP0zdjT z4HG;_6>wwysrewXERPc_PLNJ2H!7M=1f6fcsJ=YrG25DC6#KBZ#dT6$2(tnXnR*?L z4~8#tO_4h?JabMBlJ~ish_MISu7EeBY@rLSfdSOGkqLf+4u7S+WZQ{RJBa*Fx<~QM z>RfsiA3CZhF&KjOQ_DD)f2L&>w8u|Pxa4U_a;2C6OhGK6Pbxwkvpyk?_|7^=$>?xK z$GAiL))C!5z8<`Gx^UO4in<{L`(HFKCO|sNSxTd3VZ(N%DM^cLJ~CW?P17SA4#dnB zG-{^}T62X37pzS5`RY+QBS9V?!b7+r`$kK8XASQ0){*q)hG^zejUqhLv!;X^D;6Fe z!ycHVXz6MiRI_HSm=WFUstoGLWVR^@P_^p!M5viU4l zX*l5LN^D;;XV#fb(|+q#YaAy)Sh~}{9}JXS@THJW?g(Lo>^HO0HJh9oQCv>;^u(#D zel#}AJxnHeQc2Iz|VA( zpVPye)p5H#$i2W^DP}sdhelQ}Kzg-YGou-x8FqbF!uw~rB5jpfaaHT*48Pl^K;p_9(- zg;Z4*ZUKad*4U)Mc9AFJVHIM78O{@5A0J2n1z>>QTjbgt>}qb~$nVtVoLOHIG~Fo) zy|_2m)6gzRV}M7KDZ&>H)9F|?+aQe1HM&a6lFoD2y$oHDU-!_ycxcn8eE5uq@R`^r0(v>n_8;bj!|=LQA=p}RLEn?w$qY{-eMLu&_5f< z@@HjFxKGScVjYrqlY1qjW^0yj;Db?(A=Ydsx>(;}{ywIt_cKoTxo@fa+@GY{XWHtK zNuvfm`;N%iUz;q)lqQDY*oVX%JDH@S$3upgmD9!j7%4$5bZCOxv z=g#;SjPGKg?B*zT6JFp&rV|cdK=z876FfmF@P+%!JN+^}!!xuu)OkbG5QZB0E1w;e zG(lTCM%S@ynbiCxB6^W`6WR(E$0WX_=j0q7+ZZiveA4dfa%z*jz8Mb(%0Q9G3^l3<%1KC=_$9{Dj@jl9)0;c&&FcI-j$*Cv8z5_^7X6Ba2M6fvsySim z2rg}7k^KC+!YP(xcbvol)Fj_-Q-GHK z@F~2jtv-945ODR$egq%?3@`GMr`mafqEBnz+7ObMd4= zyHhKcl3tx+H&g67N`$Lj*@m_sNGt7`XsX#0Pu=)>T`#`b8Fm;iRhcSOxtMMmypoKJ z22+WC)j%IMhVcK`CIhkH$Ef2-Jnf}-$i_}y(DQ@n=V&X6e`yjqYXAbM&DuD?upK8q zJPfqk%h(6w6g9s*l*+Z*Yy0D;GWI%}{IQIOpQ5J3Vpwe%5Smn-f+;M{y#rT=Utn_R zW*!Iije7#;-?dhrkfr9h^;evE3?93s ze(pyr$M$r?y#c+4P}My6Cyfa1oVpaSpRt4Aaby!MyP_QvfKYD{G=zZ^F$8H zC3StxWmxxP3Cc~@7CtFQAt8j%<8py&4|Wnjt#IYaQ6@!(prPd43erTN1w!y?)ot2y zk+a<6y3yF=$&1ZV94Pil4^-kJfWLK~7e&mv+lW`PMGLs-d->l^pN+8Pn)h8*(Q!19 zQTj+f2DP7MoOw6&b7bwjSwNLJ2dsswDaSCsz>V>%OG1+`ZaoPXo^w56%i4Hv9AM|m zJa@PDktR7Cok@?c2&VDVdGNXP)fwxRqv4C2p*H`cQ*M1PBkF+IYyu=2SxI#ih(|!8rbmO9`Zotacs#Vh_F?t5lT{L|;}wEtd_ad@NV&O=+gTqp{PnSaD>1 z^5$oL5w1cD^fji3o#|P*$6klXyR9+YsFNg!QdoX9^&8N1x)@LDxLgnifUz0$MP|hp z2}71Stx#S`w|o=dP?aa}Gc{qlfdp2e{To@mR*sVvSC^*X{k6hM(a$_xjN@d=JD0|S z*Yg#@_oS?0KNE2@G_~BBU&>7|LYg8M&wJcrM4pBl1#l{I*ZYS!_ij&pmve3B&W2hp zxD4Ig?N%-!qH4bEWKiwU4_+&uD(Q53ouy=|bscMYr1?6f=TrtcnfM_?8A+7laRk2Z ztj{&{1kNRez}H(w?&n zPs=Pwia9@y@#?um2stB(bU0D?_a~6I&xk=hltJ>3SfrRAej*D0Z4MUddfAOd1mY=` zXXe2I&MlwwN; zQo0Noq35)dgkuxHdsg%=OZM#0gL->=9j|(}r-wXqowiqM=!F6_J>Q6`rajo}x?5@INh6xU$fC4C0&)lPUDu zw_WTL9*gWu!Dfn-oF2+H>zIz1Au~1hr&#PI__jUVX+(>E1l)AT6CuHkWyyBR_D27H z?Pk7w0eOjEm{uf$bxfruB7ht;HK!XTlua;Q*4Xj;ne9o2_G3`@V+HjA@?JSCN{s}d zl1~o&x4uA@AF}UzgQL?Sj#Vpt+hR=x^_@?MpeBJ)FqxWD`g-=2l@&om-XatzYz6_* zws=?h`dS;>d6Z~cC2O^I>TREybG{057&&-2V$FgB zN8QA?B6lTEE8jAG!wm5d2uTV%*jCdS+G#H3)5-pvAiv0WxawE;kfcnz+*1*J*1w(2 z*|m||S@}@3lGyUzkC41*76x_dM9FLZ-0q$_*t^V=?+%^3^xs+;A$3XjDcbLe({?>C z)x!w;+oT%t*w8@y$(p?!PLr_s%$4^rwY|qU?qu0^g=TtREz){KM{Z zN3jorr1!XGnuOKj8)S$_YuF8E4E)9B@O1zW`WnVw)5j*U1{ugP%9V(c@lvq?=Ab6T2sPFXJ z>5sooED_a`+FbL{zBwU>;N9JbpswFN*rA*%b>>Qr+sN9^Fu!@wQoJKrq<9$HT(iBk z{~?RMac%JV7kA3(m)L^Y4)5nGYpYh76g$U5Gec@;XHSXuYb28$^?L3#2mud?{k81% zKJ-&^Fxd`6D4|Lm$3w?YVHI!B%J=$c%HC=^4%K~)?%kWtwiVAUCE4-kmaKD_K0jsA zUzi;$&bCDwV!K;1DN6T+RL$x|$eD}RIZnC(p@-_u4rZ1?PT^IF4z19pkiG$yEbMQu3wa}>q|*S!l6D$Czo}}p668Xd4cCP`Z{;9X%FVwIps^k3>1jN>D?6RpslT|A;n&q(r;_+|(s zfWVZah;03f=F6N&P110fO+y}jr3cOEfixMD9#rJKM~mcQV87Yn~GN|_mX+cK-Y(iVE@bsX-`lHr7RMiUYk zraJT{&QI3ch7zCE%CxZ|16{S!348Jb{o?QytD9`_P$FC0r5^|!AahtXX13=2a`7Q~ zgkXHzs;WJvpVk4~$jT_}ch0~=SiW~3U=d>T;BicY2^dnJ>OPu(NNfsBTp-~>2HpAd zsgAE`V8}9=32%9Qmg$Q({tk1cs6D0Xrm7rmnTfi3g3STh_>j-|=2casupVy*WMPfm z7kniN?wV*4*wi8rzC38(*7t4)YO*+uWg$x!NX$9sd@=6$KqDeW_&)2kB{@~7V2QmQ zTS&d$rMZU+=iB0Pr{ZT$#h)@>Tq}H4d&mH~^C)May6?4^GW^BxV-_d%`^TjN(+Kh< zRnJdT0QB-Kd*Hci*sY@e_EaWn(4DV;-NG`|Q$zr0`3&nb>^7GIS~#Uj-<_Pbrr+yC z6-S+2TH2tA2XSvNeEr{ga5Z2)xc`XK4cdY3jM?vJbs zu^7m>!*?ZIRE=tOCn$-wh3&9?HQhNM+s}PI=Rf=6V`2Ls z4NrjyRRmVra7c6XwWtkCCDwE=iGtg zX=cxH;pB~7ok5(6qFqReozfx%^3-vVJ|ywt?OdlhH2p36N>-o0Rjhpb#}1S>~+wI#eGQnh>%wJ>o;#^$XzUwe?d>97alr{Qv z<|%%Qz7P>dX*PdA%dY=Y-g?PdlaGoOqA`&dJm*8TmfdPB1(K z7*o<7J(iu~44Kz@KJ4q~5{D1RRgQQSp|i|WCGSsKR+!Nf*IdWQYqsYSMyf<_EC^Aw z*S)X!rtev~zD3JUd2^{uOL>Hh>(ih#9szslauVS zbmDd7>MCJcn^m^o&;P=Dz=p3iS!3}!p4m(f?09WaeE^-!1mzJ8xUy698DPX;2mW66Y&J2wNoSAnnSz&8~njmX^J+)M~a&B)>7REg;{8U%6cA?n^|-^T_+} zU){pvFa9@9{%;56S%mNr-{~4De5_(Yy6V3A_M5#dov!b#(MU|5%bv5~G$yI%fq69I zh`Rp9O>ffX%UP6l=@-6@L349cpN_{b#4lEn?dX$AEKM8Cr)WdTg@!*=Lsv?cCu7k9 zN5HNX0i_yOcN<-74^8W@qCi)OUOc!lDO{Vwyj;mA6kw3qiNPZ*XfUedcDLszrLD09 z=Gs>Hter%5N=I?-Rqhn`$N(60vDVmjb2)+GJzoI;j2B0vV1$S+duLKZAn1D2dyymoU=5OjhAF5 zOdwc0G<{?bbVTfm?CmZcIA(NO%ZcrdZSPd~Q*k2&%Z;&ERN{!(em8T{FUCp=HYLXD z=O&@3_=ZLH8$Q7#sdZ$XJ)hf~XejT;OOox`^ro1#zq~WS3fV{2ADFkN`^b~Bt_ZM8J?R2sr1V8H&660*X zurlFirWipWjeT#G=8))Og^PLS9E@0%Z`EwP&KpvC(;P@t$2S&`WbD~lAnCElmjQ=- z16i(p5rO@5k((u|-d!ooi)f|9e0S#GmuRm#D6dRUrbfuqO_qhOx_3fxkau`PL?9+^ zcB0c_@rYhQVAo!cv~G~cV8h-Qx3 z)iC}wORowzuhvgP^kbVG?rUcD^dFbXGm5`A-Q;lm&n1HFD zjS9*?5^o`k%8q9ohwDG`xNy_2HpVFm#D>Ua6rS)pFuG3QY$dA>q&7w~v~jraw>yg; zrQBX*4?cvC`tg^g#4XAx=m)qjURg~|#5AD^M^fhi%EN;3a3F4C>x|IVqi&zu&JK^cs~^}&>Kl_b4X(Jir7Ye-vm9V*IFTW~+O z)>)v9s?5TLANG}nV(*U)`5GHvPuD+%j}40S($k2lC@n!x;J;!yJrZf{jLN+&H$RPO z?hrMetsDd%FG&(xz4f|o?-|C=GSOAAh#Fiwp#B+(#O6FOPF)9on!c*X@$mLpBB}K> z0GDLtP>1#fz;*!`V(2j6`k;OH#ckSDn?2E*E}_aR8<&1PlXaO}NJS7{YU_R|VPt4mBh1f;gtj$^exfHvEzhibkm%<47fdpazJ+4pWqj?s z-*8h2Dh&aA_|>qO7(n4j!5CfEwhCAQF|?(NNf&G};yg2%{((;yA`^;Pkutp42ql{1 z0xVBylSllJq(8b{vh{`YTEM5_Q$DFsvnq3a-^VRq%dU?ehu)Sm&OaN}$?R*3sDat1 z?HU2CnOiaikTC$;-u!)szo2+5*V+==-y)5XJUabjwuCwOrQBoSc7SNA2qiKeLT3a z+T=C@5K3R^($WmsaLmgtMh&0rU@7NXh{m#$hh{HP;|}MD55 z=KSjY^zM@;Tx1O({BsQ7q_1#m)!!eezmLg!H^t z^>Nx9e)O3AZ7-xPD9ZX3&f^x%k^B{O8=w@GUaFBjB>q-03t z*4QV})Jf2;;|*T9uL?j1A4hFrDu<{3QYESBs_##0+pXr|aHS#EIQ=A35v zW5Rp26Q!}W)+~UPe@DW)8kToIked3$Gheec?_NrY<=gDw*t#UO?-&DecHMGTVHYb8 zX8x$RwSl3Vr*T4?7`4~lWc!hk*1h}Pan1(=EDS|>S&Q($a6KuS>g~HqmT|JLy4^|7 zzffx%H{{#(10b!EdfMcqVI8qvCF#^)=mi|+WFr`!l`g%iInq!RIx{~&eruQ~N~YAl zk1B4ThQu467-?4G!s}2rUAw6fd@6eQWaxER6!@sn7bxEC5MzKn+Khopo;e=>D%7J2 z9exg8P_V5fsET*k<#W03KqK4SHcG%}`LovF2VfGvoE;a0(o1ju%CWtV8fR!t$Cxk+ z^+r1Jg5>CPsUpH%CN(9{4Gnq$z{a&=j-}dR6n};`Ls>b$CYkB{EeV&%Zt%61sHo3| zOo<(NIFTM-+3-jrF*bYFIx;@Q+x*lQDhTnlPN*}hFDb(utKAB3kuQ_V_fb)RS3Yr< z613|q7}%ZU+CPNKPK%Nc#V&gAO6FyzL0E0mvvHrw9a@kh*%Z(wX>War)+vNBYKW5> zSVUFG8?e~V&`|vJJ>+Z06lbERq0rRK%Q|algAt}*?dkWi0k1$OJxs}A7$7x$3BKoa zCM7Uc=Xf&Z$=|Q+7-}!AmcDN7@(c|+CF-E3XHF2 z`X0t*UVo%$`88DmY#K(dJEKty7*v7eNfB2dD$+DyPLm5gl{tSoZ+-4l@4DIcJ8-*g zTbe-;2nHVQmnDGVDT2ZhvaVA5o-dZC@IQD};ti=$ybg()+2i2UswzToJW=f=5}|5d ztb76x@294h>7(YtWj+^!fZEsm+OL}bc?;V=$l{OYWkbyl&s!&)ZoiafWV$ZbuWSs^eKEy^Tl>!(^ekj#@;4>=Zd(xx81l< z2DY|0^ST_?L$|L81P7K^U4wP)f6+Bj&9=V&NFdoLV)D0h(_o*n0z|$LnAJU*Ke!Kc zP^Pqa)7rNcbyKEg7u@Y zqt2xV3(Mt_=>1Or?EEo(na6B4HrS-w#tZPW3bZJVsC1vSo)16vA5_Vp+|sm5WtLys zdX=Dh8Z_ixrCYudUI%Pb7n_Iqua<%pKAJxRzLw)SnHFkZA2w`iXBcBMLd;Nq3jAl7i$Vj4$Zm0ZvE0Ut}W6^3W0C#WuxPT4b;UV`ic6gECX% z3Tk|kxt;#ZG$14hl9=cv;yQx4j0P;^9BUvE$jP&A#?&e;z*i3ZFWTNSEUIN|7i}X; zQE;Jvh=8;WNLHd`B{wQP#b*0GTWCq|!5F*z?aoZCXBXUI5N2u$PO!y^pW^d<;l2?|{?JBr@+di$eR0EKO zXf?=&=Wp%^Q4JdiMvy`qb$5q^GfhzW6U@nl76JSRYdBoX6jpr)KiThNcuHnrf)Iw% zF1F!WD7~JaG?rD7$_gCI);hK!E6R>?h)UsRx;GYIBz)TAC!Wynp~xt^ zq?ZTtx>4>YD;(LbQ!n|2NSk&o)>}M=?u)|RsFhy5a!Zp9V8RSt)i42Hg7Wl$%1`bv z=2KhkQ`g#qlKFcdK?>Rg@RM@-oj!LNblmd#*-}=$K@K&UpvQP`Y~B~DxJus_34c<5 z!fY34w9wI!a5-ffzOf^(FB^}?D%&chv%$*qvvw^zjW(QxkzNG$?=jpG`w|x zwr=&Qi_TMMQ3KL?E3T}}f8(N(haPSm*rRGk;I*-ypgeLT3}0NeNF;NMclj&j(_`;* z-L$Hsh|b5cAm8i-)-BJYid2d^Id(qo%$ByE4b9LC32)URJ*Rh84&L{5#JKNfcVoMy86O)U2vH6{H-d#RrC!JLcE3ykSN3>L@9bC$ zyHP%W#vJZ9Req^ja`%EZ=<1gQ|04#rcB&wjOT`WPnByT~MnvROJ)Ln%avXRHgtl~c zn~syobyo_;jss^)t>dXQ5+klyLj5JN{yYWRGz6$4J7PeRD>jxqQG+5JU~>Kl>~0LPU=!6!Ts0t;4oQHdny&bLEXGp{SV zzzgBsXLR6{V|5WZd_(%K_#8n0(S*PUcX2)y!8LOT3pRNkPC!rZevPuOdhr)4_WqL? zF#_4k$JzpXp|9cbT3szL5SjoFN5Ay#jCNds+0(JCK6UK9pL*%E#;dU^xNQ$UB1R!R zfpQq&PG~-e_>^+TM0}0MbsFLRQc+W&!tM9B_r9GXcm#zTk7-n!F3wl|=X@fbzCjb! zg?+&w#R+F_onIa=9$QYw0JEQU{N-!l z>s_~ZFw(sDi4Nu=-`%Z=xQOfdrsL-D>Ps+ovFSM((iyOvs(f}|WUBmZt$i%#)8)nczC2yQb90lCO04^z zGX1}OCBJ&K`Zvm-9PPGexO`%E%C_AoRIT%#GZ&5@s!Y#rK>G%hA~!Q5w`dx^Cml1X7N1rK z;Y;{cQ#J}bOuHL9RwTbs7(a3zU&JVHOQO2vC{~?YlP+@I;htAO6xGElvN%bA?~ban z($SnE(^SjK1lM>JoDQq_NR_d9JJ7<6_mkxQ7@ZK$9gQ1|K=i1wa#3jDOQ?jcw9)v7 zU;@aR>DedADL_UiYPhZND4}(G$OmKQbP5gZ4tB1=EE?>*;T~ZSO#rx1$#jj>ZuOMk zpGu`=hMAGGp2s|aCeg8+j!*bvd<6hVqV<8r(bnW{RgPd4rsTOyIap7xzR#b8mXfQi zNtjg`YWCYz$}! zWL^Gh4KR8>78KtVP+-KPve^R7>~NFUcsqAYALnv-A55(jJ|PVI5zzKC)G6S{@97~T z(+^G5{|%s#CK~YL9YAM9{egOXPZ;J$L`~%LHsFT>RMhY#$V>n%abOz9_&@IrDAFi{ zj()fVI1ddQt2^v(khnV^J&k2v?4cTR0pN~Q5N!2*GH8bTFOc||LUZPSqWvQDkCy&3 zD)~QQKK{SA1M=NV0HY^z|C@@&*{p|f(OmvLR4^&4;C?SV067$QpRT4-X@P^w6q}$R zr77*klcLJ)_E7THUW4g20Mq>5`vU{?t_HOh2m<^0`uJ2Js$KXfd4a`jg#!O>;Uz}B z-5>?4sRlR4r{=t$Itf1Zz7RAO$uvw#H;%I)g)T~|fjGf0g=;c?zHNYaIko|gY3D%Q zth6quN;|+45IH?9fmneTTeR_WRza)!Ds;9rqTskN;ep%Hl$pQQ(x|fh{i>u|BkEp} zOw~vC$CUY*s-a7t9#|v}b2TwhrLsU%By}3nyG*Z z)!qAYN{7_L&$XUDTzs(7(wVNoCCZDh)bw^$`?u->25tIqZW820xI`1GwQmgG@Z}fd zCInb``@!c443>%^BOC;dG0bPub|44*V?%4gFssVr_H?49aOU@JKpg`w!~T8XVwe(F zu`ckb{r^1F+in1Ym}+K6Y|bgl?;0AT>|z0b0{CA)a&(-e??2Ed(v`TdvlvQ z;=vt|srdI*9bg>XHWS-pD=V8~%@)BlyRdRKHVB^ZVmMNLq(x&}lSh(gh%T#Rhz5zi z7wHKP)?0cQ@49ulEKNeMNK&mEl!Ni4iVEr&HteX`&`35g&4bpYL6$~4smhft&PhQ= zW$h^yRn52jQgeM<5`Rg=XV~5m08xDj@HRn3+-xDJ$k*=IfCbA`kB|$)K0rY_SZe!G z=MONdcOAQLqW!qE^MjtKPHc>`jQ85>+$zTa49*#w%U;xQx6;&Ho&){&}(Jb*+ttTIuXi4 z!|*RDe?o&zQEJCQL%Ibd!KCn1n5TxuP+^60*>5@}tGoK_^ z1x%nRWg1*o$vMU)LJjOUtFb|FvoFs=q2$Bx_xF4X+hQy&Fw>mTdo{O{V^$`uJ#+PT>tgb^Z%j-h9_RnSd%ipO zae-fSS_Hme{(|cgL%rfNn635-o}mh0Cz!!SpZ&T(?LrnVMlP!wnD?6_dDH_<=I?kf zLqJ~qkpHKJZ;lF!TzO&JiPr9Lru_145-4KRN&C#p5pn>JrdGQ1MMGCneyHWT=uCQ$ z@4XVn#`1H;L*r?o8~6b7qGduotoO`6etc7E;Dzk)Lh>CH#1f!b)(u!?gd2b z0Ti?c((JhFzcEq&}^?(d-n?7gNPodzil)5eL`2y9h3R3aU`bftvYbZSP zEa<_Mpys>EU5n%rnsyQ zAEiN6!2;MoCAos!A%>Js(}fZ=v&RXc&!fJl+DLd=^NriqSCko2v*~5#aR*`KFy8j9 z)2e}*Mn~_gnFH%JXGwWDr|m6Khh@&fFn6QpgRO@AG1lgqy4Gri+as>yl&{rlx{Yy0 z(|K}-nP+j=y1dgcrldeK^oCWGYhsYo(Oi@r^<0!Mb+8{LS&_(0pGan3dqy9_@aenq z0&@_zrARCjw5N5%=d&7QO)6kLIjnpZ zJ<-7sVT>}wH0dvfIy+i(396L1>Po8~f3(8z-cw!hLAma{v8RM$(qQ%+kI1i%9_+t0 zS1yPHJb|h|P|j<+EpD?vnAJ!Vi4&`|iG-eEb0h-_Nq*gUEUs#ba;N-V`CXZTlumQp z(6h+ZVmQYE*l``Aj`^aA2XdC#{UGnALSb=k&f2?cP+P?|VZVuJJ^Sa3J@zGcf+dJ;0o_)kI9mb&8H-xx=g=Yf>qg4$E%c@u~lYPYO6Lv zs4@T~#NXEF6RZAcZ^6$0k#?rJxqf|OsEg(9n>>W7y4VG?s3}(dHV#zhbqAH;9$Y~p ze>;*ODDZCbIHE3B!L(8C{Wy)39(4iPKwH0A@y)W3a*yd}Ah zGW_Xz=`YRn^Q^oU22G_^6*D%pW~bZg+|1^`VAA8o#gje6|Is0bwMTbQ(LWaQ*YcpF z`CoEau;a&;Q;}o}YDayO##|_vl9yP3H5C+bgr2)bu^mkiOlt?BF7FhZ>-YKtwH7LF z#9tXPRoEnm182@K4e#8p7iPG7O|8ti%uGnJ+k%)=t1VI?@h~?Nt5;$FN$I2llN)Z+ zF>T|*rN$)M9?WqlUN)OI%WA7p&+y8smolV?#-6(X3(XPdlVdIy9G3$Ni}g)+jgXFr z`^*KweL-VhPX?xMbZn@_-xD@Ien2LaMq|dGB1@v#yNBQ`uzwdyWT%YkpG(|h{*hSz z(s*d_c?Ke&-YuYV%C%BcjF(Ernb=0wqsE9G?8GDnHu!TwbEFD7L{QG}HZZJfbz1bj zAy;6RM}KUPQJ0&OSRhIs&sJH2&G-QR-QSnEkJpM6A35xNb24aLf|&1d{e%rfvj!%b z55xmp8!;_EJY1UI0tezTNsVoNNu1N|yTdQasgrMZyzJDn&dVN8k=ZwGo7lKdUG5RU z(M9nfn3Vq0`lVXib^qfD-QuI_w=h=G=`Up=16Xr>!MM?st^S(%U$3(;EhmLkei|?D zv-^|M81-|bopau(KQZFU=lo>-bee-QXhCFDT#LUikyzN6RmxXV^#{~IrGh?PgLMxRIjfDz&@->(L4+A!e05Q?Y$VtyCjdlQqwc_a;?^3>pmy8Y4b@M8Wjt z2Xnqg=kK~<#vUqF`Roh!(g%0m<*JfEF}EDzEEX*<%;3dOVS!w z-Sy1o!SP`G0xO>w)1x~$lNtLYDaM_nVL@Dl#>dpQ@nQM$=h9Dd>x47=xayDY|KlT_ zX}C@C=6`X~Cj$H=Auj-a{eNP}TB(RE-7-qEzR)ng_5qxK!TkWk^RH{MrSQ_;at|pm z{Y(?19^l!l5(X0@6@788eZh@?y7mj`T~!7EoKtuMw&DL|_<-O1=Gy;l_|o^h#_4Gp zoX%V%7?`Gy#oDQri2F=yX7ItRIG#|Xv5HYFDhmbANI)tio%=-FfX zZFjMm`ZNwOX^qr)M;KY+gfUVjWFp2A2EMY?O-ud&LN364%*6pHQf55)+m%Iw|A zsPWm!mruNvw5)OCO+evmQQ8(3c_QdyD6AqG0rtXlGc*N)!c*7oIW^IRc)(W09<>so z$F4IFxy#s`%5m9`xFVAUVh*7gdCW7h&)N`p=m;f__U z!Xv-LOSHvQYK+EBwROKkDRNW`XE(-MNKS{YUn~;Rj6Cr(keP-Gs9+RL!%@KTM*BV$p#zc1+x)lF+XeNbcujJV21%cFsGK33iOscS&g$scXJlcu31R-TIG z_~hDLW8&5o)fuk%-oNL}qpkS{>Ffgzc1?Z8O*uP@*t&)!1DF8#%R5t32wUVUYZ?OmxaZrwq~9d`q+dZJ>=OB#HR_NOhD>uPs}y!ub=|_Ygw9hyKE( zsT_S;x7H%7sg*bgY+S7%Xd{?+;o*k|nlD7%Ys>haH%S+6yJ!%lR2F|%_N3Dku-)yS z4#05F1@H7QRu|7+XsK5S(sCTmwt=y%K+sJ2mR;`tDK*pKOlO}F)?mXoNN6LH8U7|z z@4h75&z|rP6iu<%hTblp2yp>g#mjSiyJ2NvTp~e*^cGW}`()70S8FEa0plm?*1Ci! zHFYuNO(Tjeb0bTRI>m&;%V90b4d>kaNs@((a_0i{`$};>vFf*I*81}g^*aQz zD$`wQT@y@TJ^yz9WyHf84d8iMk5irIdyKBdh5SLxwxt2XIK z!78C>zWNbS`{C7sUpykJ1$$*;>80g^NJbcK9 zVM*vU2t+|E5w`aLR6h9pXGB{J7d+Fe@cd8kn1bKG zoQ@)!7HjXI^yn>-hyY+-$d`u^lHdx>u4m17? z+C5Y(fjQh{$Dw;8sBS<$q$y{>9Db8!9%Y4EHG{LzeOWTCOhJQ{m)frc8TedHJ{dHX zcG2NNZR2yT_aKmOZ$@bXw?4m3aa)P+t}N%Wn|pe8*j-UWV4>3jQyNu1)rsp;K$5O{ z)=^u+xlCqdJmr}5D@UMIS0^1s3k{BOc3t%r5XifTZJfy7bC2Wg`}kTo6><_F>1$In zOQKa@Ruv&TrobH0SxuH{8f%sWNM0Lx>jK9!56=#z_=pR%X>;=W+Jop&mh11u*h%cz z;m~MWTJk_`74_96QB6}a(=Y4Lfn0nk zR4h!9y{W1mJl*OkYUSp=PReSd+qXSg)=Dx(!UR_}iins_uMIz`yLj0K&&=T~gVE%3 zc||pBhS?}r62LR{1-E*`gyxcI3a4Of#Wkug1D%|c#E5jjY=L**5;(1>`C2sFww|n< zvYMCEMf+tVgJdx|TJ$Vh4)H*hDNu%Ml1>>(GfXex*~X~%=c-6_PWUi&iDkX{9y~M4 zPwJ`7IGbb_Ey|FaNAUKTz%}NG6-(?~^QirG$OpI*t=XL<8pmBkhqa}-Co$=92)kGy zAC@I5uG%X@Cv@Y1>Dd<+xN*eWqvu{=^5lLVeqDcQ7KLfENY@Ri)RaH5Rum5A=d7&y zp{7#LI^497Vz{2+QcW@+Y}37Qp%4sX>wgBP0)}!|DIwSRRqws=Q94x0+Xz80^B=`F zObNVGP7>9+oi~Fz0A}+pK;|MEXASo#{^R`qk47N{LrnmA$|}&@o1XC^?XQ0u7?CR< z`Tvd?{l~}rV;T5gFxXCpP>SkzEq@J;mIGn5(s$M}W^9#QPjZr-wajgBlEOgz1fpOE zLwTh+DZmZl;w4X)0eYiBZs89I#P3hIvHp*ELzx`KuB>b>blv6S&$8eJQVSDJkp`16 zOU(^cAJ_xg0t3Ot%9xio{?XFK0+7UOsG?B5Jw@Gydws+ao!u{PSvRuIKGOFKxhiPS z6~j2&3~QQ!bs_D|e_nwc7%pb#FJ|x1CH-8b0PjoVv#4AdtLHC#zyk+C_B;DN_P>YP zQ^?7Wz3T1JLR^%!FE~uM&|e)lSA~#0u}w|`e)sEZYz1oV^fe$~*ad!2Hdd6ap0(c~ z1%z2soP62L*%aXGaoe6}v=h#cCFK{BR9WSn<>ml#D&#RG45hr29?YUd>2?VadZ%4{ zrSr3VX99;%|x8X<} z|5g`^3O_#~pMTc#BX_d7pv=*0F{ar<=diuqSDr9DqpE{ryjO6qG(kp_y`aq5JJ$+3 z9ek7}VA%{&Acvu<-XG7pPXnI$9C;#ilrOE^-E4vZ_@#f|!Ae*aL;*SQQfP)1=( zYN7p4@MA#sx+pa;iuyDS>R8Wd=#x%qIxbxd^i`0DUGh!4 zBdLNXlST$+-$r?zzS#HZbB_y^xiKRTdk?O$If>N>*ND|f*5E_V{9xtImk07!2R|Ol zTW`&d*KP~+t@%?ZG&$|&CcGEusxLO1{Ti>|aQuyGKa%HQ zT`fr#q9E!3=~2CXu8o+Dqw8<7B%xL-O**^<`4oa&v06eDxZ=@nNBY{_#mWr=8VSJ>Am*Q5=+Y z{`IdK&8W;O&z?y!CN_X}UoQjuLf)f0$dA1MYuVZ!?Df7x@9h9zN6lpb*R6@9@KD`S=V-HTIfT% zBouFXZeLsfw%%;jrZUF@R(=`Dz7f|9Emfe z_JWWL;KUjB8PKCE6C9Mau&s1ITn!0Zk$v-U&vf^4v5(7pv0MXm5GPThDI}rZT*HAz z7uvG>t@?oV%)zgAqhtS2!f-50qZ3d&h$#OC66bAj13MD{fhTR+Mi`7dw#RPUT5Bov zF>+vwQw!uR_?^TiPaX`t+U!iMSy+2sle?N8YR#MGW_#@!9^6<6Gdu1XJS8~55f3u| zj(o~kS}ghE8C$IiOaq);Ri#F*5KO89ri9sIlJ@Lh&ZESwo1a1GjvNsFFt$Cyvxc54;T% z*E;6USJYDuGU1JV0!Hni&JtzAN z4r{_)bLllX`bXU%l@?vvgtZc@J*$`E-EV{VjmCzvP2y*riiM2*OxxZuHVRU)f6Z=?VBUidCJAP;6%xF{v(rRd7}yN=Om#8@7LZL zwJNuw1x$K2rb4BWP5t^K?5f3=^H*r))^d~OLQU=@H`B=n+5U-wGa4f!{vi{+HZlHO z{+Ms;No!F@M^#l?_C2YeFp$TpFqG=+(wtMOmnQn-+|6%|-tKR9pmri^8f|dQh%k-J zB#-l5a*|#BtdTac0h>!vv%NnUG`!D!OaH7qTtrF_Xtb1XpMaJB4*9j05t2~G!*6Y& z(t3kuWmVVJX?D&BN=fRbekV)->JT0LVQ^H55XJ(J%7e-JR;&5y*}+HUQlNcSyWME; zd~M@we)D4f8iMNDV>s{~97p^UesN;uxo~8jqj_PfM@Jc~NFMkD{1`yR0oaW7@Fzy^ zoNXnk1jT|P(hlX#w~)`QZ{AuDDMA_=^_?GhlF--XKtd=ZIxk0h4tn&*Ln;cium0?E zF+SJ;aL29F#1E90L*d`mUNTYEu1SU|H53X|+m9u-k_`G-$zgV}G)~BCk6*!1jjl_n zg5{e)dNc>@y%zp{2-mmW?J5_&nJc~)U}3{f~`j~gMs z(tZyTTR1CaTAu{AU+Nm*$H9`j?#sgm-lNz;nt2GmsKZdpPiwb>?tC?>FUQ)jD#U!< zVZ3@Y{+4QMu9~^)&-$2M&5EYOhE?A~MQy_Qq!k*mAT~-BoKn`lPUafr%`>}S-+e*2 zn29Z_e0xp+8QjnPfQgcaAU>r;*;L( znk$_MT4xrIx#OTxwzHM6{Q>#mAH_JEz&qX{+{_R>(uoy}bz-(!;Uw4<_~Mn#-cWsh ze7QDvGe}ZAtQ!{52@aDmx3t{EC#vumt?t~szWmv`wAT@x!UUMvNLYYacN*Rf{$@sM zvCw|6W0(L}*CW0tz;#)PsA=LX3^}Vk`I?2~J4h+-=P<*!oeL=k=wx!EHPwe*3LVz@G<~I_L zU~*0$A#%A;kNnxIJNNy>T$DFdp3?|FOv;QFKK&@SrC& zy-tgNqLRC6jHr1e6trE>=eiRfd9zH~ZQl_HfO&lHzNkE?KR(|RnswNcuziY?^aiR{ zo1of>{k|9W`+{?2cksZp?M2lBkhiVdNbvt&9#*M|7}qjrqCi`t)06$=E_MeGC+K(# zS8?xDwgl;=L56t$OFloTS5T=2Y{k4y~ysbi=a}U zJ&80B`$8CXN^`y#a@1a_Y-)j_#VSe`#bNxQpucGBy3ou;HEDLdVTZ%->LP>XONDZC zd9nPpQ#f;iRz^1f;nOEdX>I4K$_eeTXrJYU9-mfd&F#l?S$zfEh-V^Qxd?@n{34pH zclo?z>R0QjIDIbMU=q%|TWOFfZ(brSE{C$7j!hoL8q7{tbof$!aQ~qxeLgs{IP}E- z+Yx*Bg@0(!wkBkR6mINNKj&%~@!Xjqhu>wV{EBRRi(KH&vaY?#?L4z={mUHf@1DT| zMl_+~JgEZlnrs{VG-Gw$*S)xy`V~_9Db6q`z8x8dAN?i(bBP29DZl7fRmFl?r>t!7 z%b_%2>R`AAMVLlu_x$G|dWNc|i^?O|bP>QRTg0>bgYkM?7#Ne+@5jU}5+;kDHeioR z_f$$5!*a>4EmMFKM;_7E8?r1R4|u56!*tSLDl<`>oNPOgjR<6 zGr#dd$0~-GGDM~tUKGBr#7zbdou$SRT`P4KxgAvh@@?<;*W#)rp?o}*``a9{TRL;K z@2-v~{G;*2PU8irlY#1u&3q|KoT#%mU7ck5RLroHwxaeQvKN)x>PUp=cp*%)ml1GN zy|0i*7dHym4EL>uD>Fni1?tO|!&`$|#aS!2HZt^d?vH3s-bucy>c~8n_ICiRJmQbP z%3fZrzJEZT08_#%1rYrLAWns=+NkCNN;^IwCl5xes>`cZ7L(-pRFS&;9#0(RDAVRS z=u9bfNIiWR5z)MaG$hj97png>b!uoZ0MB&lGi0nhCA|DH+5zQedUDpIC1N*n$6|U2 zw*b^0?tt#J>aX7)xiVb+dPoJ11F}1@1j|5Sp7^5_XLAGHnO5p2FDv=;!_Qgfy3$Zg zFx~#qUug|Q7T}m}p;+z;SjhCU2e4rWse<4bsW|$rZ`D+^Jcbj)uU`htk5rV*(x=2s zp}TFa5bc8Ec?1T65(Dt1Rl=*|Z|~;5)?YqMeZ2~#%w)<$PRHSNzMQXArM!F(H{wG* z1_&7mZZs1K{fMP}chx*EX8|HceCRo1 z9(bb4QPBPux}-Y>a88u$%u=tC-p-hGB7P5X{94nZY=9N=-8=s^`1N1CCYkMd6Lw%x zX-t$Cba6eD#>`$o4m$RjE+M^eXfE?es+W5%&6bzx(21+JrhIIx$!~fPhLXCAxTmHM zG*;0eFPn%gPP0nVGeulA90LKjZ=Gin+! zHYFajn|i0+>P<^DtUT+Pktw?&X8gPM9Rn%$D(uY3=D!}UzhouXA$jko_~yTY{RsDlxtflu3}j`Z zrICWNe7sSdj)_7|{`8sq&DFi(=K5!jU;|Quw`aQ#6Vah!^xLIDnAvbWxp4$zXNI<( z;VHICOgL;%Ko4xv!%z|-rbP7h$kk>V3&R|T?)@XL{b10xZwcT{(ODS!ms`#?Z1z8U z9&b6((0IDT246vGn{s%c^n# zja5+aD-(QG6*)IOjfXc}7U$1p^LCCEc}`wXou*pyac9R%tPY>Yq}ur*UcKYpr(q$l z3EI|&j68xHlj0R)^%8)yl*4~qwr_PDR(-)3vF3eGwg}5%LFPQ~y22j$w9HWxE8YBP z{Kx3@K`*W|Q9l6Nu+&g2d)_EbzgS0SyV;V((_Q1wZ@5$EY>JRpl4%e{&$i2@uto(} zl<4$T(PsQ`vkAM~LZznBd|1>uX~UI&{iIN{b|dZf$#_i!cm!E0&;C(~H*lZw5Is3P z7ZEAlP4%sHssU8^T-7#~h4RATw{}@eLYvdn4wp<42ZDqGLXfdV)0o7bLS5#jn5tZ# zzM!fAst=P*<%CP!Ye{s+!mH^{%EwF})`MZ?^`OpO>1HS$ZMXJ%X&MS}dGCE2RUTbDMCEWqD{F91=>Mw#?6K4gw%zedGyP;+RjPQqiv5p|VUrL)j zbBQ;6p5dtJVZAs#e{WNb+M5YBPe3B%Y#6ie8y~2xaCI`2>1@N^E6VzA%>-l&L`-_i!lQMRWG&%U6js>;H9Ja?Id-7|;vRkMKUTZh!XZ}B@_w~;` zBV!+FQK?!Z4u|U8kEBxSvS(z0`GMLbk+=;y|8&3PYKgA3JJ*M*p=oA^Dt`tWTDqOt z7VZnH>B)8%C%k!wow@0jfCewvMFhs^+@4x+$w8~E3JQpXydOG$B3jWN)n~S$8WpHJ zPFz3TQ3|sJ`~%>r`Yd6cbY_}BT0PmMISfzivna{lZ@o5vmwEngUtFzF>ri@&Zm z-cPtGmyqSYYt%AL6OVA$`9T=J^lAZK2>1&W( zI03PPSAveFM1H)F5KV}&{8F}!j8o?Ej_g25|8&@1KDRFdPtGFA#DQ1|s!_N1q8l2-`w-GG36%jmeWg(UM_&%HR@eQtM7^?e82SEW^LNsi$tZ;_Z zEnnwg20TO-JOt!>+@@(!_OrQ(ydCh&>}ttcF3p>8<2&I+l=Fyg$4HJcE1pt}zk!zu zX3wQ@6NJ22?z~Cv$^Ys|NKrV{q57&Ng?z**(@K#tj|tDq0a%h(PB`&w_?uVo0JZgw zXvzB9WUB$gM^c&05w7%mpG9LTT&AvYPB!jf=J0N_3N*diJt8l3e6kq1Hc~Z%BdU0f zj)ciadnjw0^d+@3Bgxeye7z6i9h%?gmOBgb2;6=yM`C1OPX{XM&RSxrts^?So&_@5 z9PcmzcNe<+O-;~9FYB0O!kgON zAGtsC^#!)Md=UBldZap7`gzsc|?$I|nX~vEzSQ%*E3%`6}ef=;;C)1iT@7~Hr&8M+faIiAZAcu3;&h5Ny zG$^(iYe z3k#(X;5y1KD`O1_O$MbXW1F$F1`i*TB$7t=KUW{HEd+swD<5$5|JXlwMi+f4|HS0; zJQ6W^T|wH}lhQclNbQ1pD+wfo zD54WSb9R?{&Ti-hh=Rk6AyEK7EDm1W8>W zVG-UN&%WAxIdOFc=(AMgkI_-5x}Q(THH1e*bE=vG1$t%9sTWT+vxn;Yf)gf4BMY;v zG}&`b$NXN1nH6p|59Jo7Oii9Al-`0o_k%fSPh&yFtKtM9 zBshbwQX6+6dqt>&bpAY zFk!VlL5WK&C^b}Tx7uGCt%#V_zliSlBWgKWief+y2=ZAMWP%JV4AkX}5M>xr0o5sm zX3otT&p!l3gQSVjH<#nD2FlMjw;dB!)3&%zT!AFK{fPhfY)A-KMCZogZ>k@9QSP9o zsC>gB`uVZlEJ$uO{-j~m1Qk^sgo9#1NQvdd?uyyEm<~>qr%B_>QYrU{4kh(UWFmlB zIGXZIZ~w~Fz5ipO^{Kvr)$`?SA&c4baqV+~sH*)${f**%LI^Vm>XjJ`r90BuGxv1^ zo|g9HOr`UPrrCOX%*CB8>#zHN;eRK2b=UT4f}@RITW!D+sH3!lYO(j_jOs$?J>1q) zQ@co#9U%dqLH*4+w4KmS{J>Kjp?ZQ|wcV_L^k75iVx)A)VredzRqvuaHri`MNE=86 zPXadbW3C`Y$5{`?&d?}Xy|V?2IN1#n-Re@e%?Px1HSnoUsOQHBzuX70!n0lO=BZwU z`xzdpR)fvG&11g)xElRE+kd2JadB1PVqE}fBCn&?pMU_KCRuf`qVv=M_qc$dte5+X zKI^?zau)Ul;7hRrZ5owM{(O-Sdnz^9-1SZm)cZ%sv>Rwn>)Aof*U!lDm( zbsXC2qR}^7VKD*}>uo9B`U&-7nRz1e)lzbN%WQ|SBMo|XBli&FAuptM@Tm3vaAXe7Or_MPQp{ju|$6>%@UY6?rrffaS` zaGQuLqo_y8jRkX$ov%XxyntZZh>*YZS5-;TM!vDqmd!#{^LdZ<<&j;F_n7kl0cIYF zR&R1Rt)I8KdaCR;zGi}LMqJ50`?4-!#<`!C(tIyhMAJjY${puJSnPhJf#2UQ)OB_h9%!HdxeZ%G|{(aK#I$&c%(;`hTk-t@^b$)j#p4#K#+HY4Pey z*(j;1EUx~7F}Er(JG%4;Zwu}Z?~mvwhD3=H@w5>DkWE`oO1^bo{s6vQc>2M?Oo!0r zQ3+BYiS`|v?NxK1b>ZKC0W`~%Xsu*2$Qm)+SeM`7c$T#Bv=7e0X^D$f>bosGtU><5 z|CI?DtGm!Aw^|K#;v#d9Xxjbr%`K2STpeujnebkE-WOtNTr3+lkaU`yiv5Z^IOIUq zxJ?xMoGfh6jyWSVhGvDqwb(EosJUiYmf^GBA&wS z^KBPaEM{Jh$4YHqcSkEb`pEg*O&)o62IA?X(N;Tl93bdTkAP{3xQ+V&P|#m(b-3cM1Q+fgS&*X5UTQ{v<$Rj9PWPV7c7w z8v|wdLXrF2^&p$?e@lk0zS!3K!hA9P7PUX)6{>qKQgS}_sMu%{q52vIiQ|Q#MrP7( z;B7ZA1Qn%Togd5d+4S}3d(X*VRU!vYLE-0;1aA5D72s?o(wqrc(fC?g$gK`cj3P}| z8N-q1E+D@xEhlg|9qxS)!|G*mEX(aX3(2qsSuN}YC#c!62ugLbc#7{gYw({cgRtIy z{o{#VWoYf9v;=o#Cu^RGZGnlLqs5HorX~J#Sar6IWe-FFg!&;bp8;7wb6S+Ao8SkF zj{rJ#`xA`lo0BlWINSi2cf8brH$PkhmzT+(MX!JR04{NI0L$_24YoEpI8FPPK%tG89-YD#O@YgyxGZ=%e_N`j9Hh)mP9SJ9~qoKn!8ud9^H0YH%4 zJI+q=jL6bI&!;ZWF)rLm(q%MPte@>=PrG3XntuMS>_hIj!t|IWUPFITS!o;PZlCC3 zO{2nhL{q;^Y5hr$;SrMPfIvcVFOE(0X{*q=NWtTQ>P78Y>LNVIySw!2`!YSs+%(4a zK`T=!F%0Y#;t$O{;Iy$>h(#I2y+3m-5)$U5ySC-2h>N>i>@Ty zA=`O1<OrqsHu-HBjjgCTa;ThW~NRU&@+YReO4Kz%qP?w)uX|{q9 zT{|X**i0%#F#EHQ>leQA_$`MmS0(C7s}{H{CJ(QwcF%M~{}|$mGm++09T2UTl@oaDrNWNqhWj@kzZeXNJj`~5H!_sWeKJLCW6Xw zqswces?C$eZIAHHjR&g;&uR0#%tM1rtX^0OjVy)dzXTb zO%5CQ2b^PdE%}D)47`WonOu)ok=2~i_i5x_jLjY0l;R4E+EV;leQ^!)*nT&ktrn$uCG*6^=#adtET3GJFu!_Tyr=#y&#=-@F&UteD- zhna+?rts0Iwn0R?i~xY52?(9t zqYdQf{*#%H=jwbvx+#DmLDfj_3}C@Nyv;ZI8>*G?zkm3P&0VEt5 z4D}q=^-L89TYFiFDeRwy&q=*sZ+4KV#0^;+(o+uI{s%138jB4aqQ-9Dl zpGeR{TP}9F?FeH3B@sFeNe=MadAOw?;;tMEQ(~Hzn&Yb$dzEEwDIXynD+@J>5vAR9 zmOLzMY^A2Dmp*fv+>4TAlO)E05C;>V(4Y)s&qDP7tQ74#MF`e!(b)&ZfQ(UiS9L+N zeoDxx-ZW)|RboYZ0W3IM?eF1K>uDE>%Omq>7+pG)QFs42x>0rmB2d97O;0Q*hd_iR4Kh+5T6GJ2 zgVygU?o57WsUMiWSn!_091^GlpHhSI7;cU3-12EDe<)8PaJ7~sI;}JxMp+j#Z(LI% zCb${ym{_HYRZ1jAN9AsJ7!9?MwppX-1OzwvlxB_m!)9veccI##Bs6D(RVDPAcx zSEQWkx)_nfvH9*$bhu(Peu!(4{Kc-pWcInO>VT`RzGC#!e}x^KG{m57QXpJmtKiEPr7?0QPTXN_ZnC_?%eg500U3Li&-(*UmL zN(MyhgpXsrUbI_Va4B}$&aW9{I2#dCZ^m2C6SPyRY^;R8&+zHpR^%6dT|_>g?po0< z>{lVS>%36soX>1-iLON32Fo0c2c89wWnnOVbK>z!@o?Mv=|#<*vZ9^VEQ;i8_7i zF9BJ9<{NL8nZ9Wmli;twnL-zpW_Z%X;2%P9k^baZTKQM$Qv@xZkbl~^3OL~2QOFn@ zE6x%`8+aDXQpI=O;FL48b`dNHG8I@Ym58DW=?kKGQ(m0A?GZQ?WROh*&s;!fiFrfD zw}T@vlNcp4ZHDm{b@~6Rv?~uwGJD%LHB+OLrWM*EP70a}np&C*ZCZk;sPvE*<&ilOY zx$oz>&vT!Xu;(rz@V*w?pyA$l)@G`nc9Bx1?bH&AwQsB<)Q8r`0eigjbx-wbj~45D z8Q2}yabt4**I)d^D3md=7i$T`sKTPFJ)Vw4rFoH$8ahlqc#P-hBnwc!-u?V;{$PE< zNtlE-A|pQ0_4T*GgPGEQYEcukTQA=R06ZVqaKbfJUX5I(HmXh?R9zdX{2%?djG+!% z&5T93+MIOjM}z_+w<1;S)3BQieA}Hzd}1 zKsXG&ef)qM*ZIQXL6)7rVnRwtFj1zgl*VV5R$}M_Crq_a$uEQ8paK7vW3r$R{F8Kn zZ^~5q(j)6)U%Ad7sF%Ad%o=Q7N-OyHOB^%o+G+J2Z^~fZr5^|#edF|~kojfMZ_BNH zni9Tj@zL~-eX--bx{o;Nueg_f>NB7#{KAq^Y>H%TfBUq1X63rBGUH)_DV_Ht3RtEh zWQqz$D3;R`wbtP%aBrf*y!3_ny;9?xGVtzQ5!wXa0!c}T4PSrTh@RYl{u9o22tn;% z>;?+3_XB=gKM6af|M5yKl9W{lUNDshO(iw2%Y|Eo_a9T(TiG~+1!s=%nI2rqo-sGo z4B)kl?nl)*4^;=cpS&K4%Aa{BC^tpnM z4L^UU<{fWJ-1FLtQuMWE2gXZ!MV4n9vfeI$- z+${sP{`X)TiSvu2LLqv0>SmfLhQXq%p=-YmC-=()VLUW8E^jrSdzb&PBF2xrJSgy> zpnxm3gnNbi*C(VLSpO{jCL)$lFO&X_IuvKEn}yur8FV`Qg0&7t$Ta!sf8&k3!?jks z1Lspy!8w(+%PY^gX|s7VyY8~}eCr;FOPjCP_`=C_&xu`ay>UpVin1g=I*~T%`lE=^ zBlRQC96xOL0TJ%97Xr7D)R0*`2`M9R?RjWB2$nc+za$&0gtgW?sbC7+w90M)a{q;b zbd7Pd_sT#?qA_74OrR8Ps!=>_8>ra6@V_aXyePB#Q|u$CiYK*Y{M$9&XI_w^AwW7H z16k~K*EC#N=ds4T2lzaCK#QmF9ZH6l8sp`DNy!SXc=6t33f7&nOnm#e@`GY+IAR_f zd4pFxGn_hHJeY4xI0z+)*YC!Y3}4P+$H;uB0Z4buW2A>-?d;)te$Fr)M<>U2J|Jtk zaYyRp9qf9#5+ysYBaXdo>`;uvL!D5z8CmF;^dU*{26=Fmh2vuwg` zs%(_ep2OYloneZ+&VWWHmCYN7^iA(xID_~TNHF5R?lDA=+>)JJXknm~ zd+i&n?cQmaNGhG_%4{UgxwTgTK9^J~kA&PjgF0jc^tD~5P|=()?> z64Kff#>o4bt+O}M+R`nNL&f^dCOIYVQ~IniCF=F&1~v^(bF$~~eTR9B&+^8f>p zw~0qN`)hEA5*%>5^cvw}v(QFklG^x?yu?)<{{~*45OvA}n zXST)2Cf_^tdI0ipH<*uCkukj^u0b`7m0>3_kRjI>y-Y?uJDYuvqlRS>rxnoMo8C!c zK8=h0kzeVf9mr~X$b1+~Ft@EDlsMw_w`NQqtc@Y9Tk7aI0EG7UQ$?X%q+ zSArpFu%r~vC&6!tXOd;SOHFQykhvZ2zYm?HEu-x5YBPO+lMEP z&ZNZQ#YZRPXt*U@6ZcA$wbjg>(lG2 znA?Q+X@Y9(3qkfIL-$vP3PcWd3SzBBIc2x)%3xogG7?5^@2wt;dH~fS%2p-)FXoW{ zv>Sy572HqU>~dp<>R$6Z*Y4!qgRybIx#ITwV&Dq;5o>0y-hKxmQ zG*5(CamOa9D1V@|-7haMfRdgLDg7$um0@up<_7-HB?|mp4Gnelj#K+wsM0*pSIJ0y$xKCz2rrG$c#Vf z2sDbhjq5MgSG=a*^626k-3WHEKQUjOba@(fjrQun)n~LIZzb! zF%te~?wn@4ytc_xE>_ba!+c8xPd9Y1aAeS^B~+1D6~$PeT=QPx$%|i^VOtU@b2sxkJ2;N~~%qmO85Ilufx)^N7DwXx9vpYii za23TakWEynuT0aQ@)u&Xt92lHVLz^EVZVCF>4KvW73Lb9(O{>M-<*oti{Nc6FP))* zi{!60I}H{S_wqq*9zVAx&lIiFlL8GJ)gFoA^jsJ(<4Zx5uq!(rZX!cEbIptGa=gbC zXsdc+<&bpF?;%o{iRvvu7G9Q8E)(%nedbenT7j z)c8TabG$XTBGpuyy83=N_oQ2tyGtD#{O(spoQGs5BxDZ@%P@xrw9R+CQH^1#MrNI_T;jWA*B$V&44V(A_Pkkd z-5~XHt8Z!@DdXYaa8GgIvs+3H7WwIVj_2hZ!kgtmJmTKvJeQU~?4cJSsyYG4QOw?Kp+in#C#=*4Oy6BFE8YZvalt&8%W^BigALl*V-U0GE#k;X@)FqmfZ~ZG^zkK}|mTy%Q zx}s8H#Mw3fr@ej@vNkHp@D25}1Pi!G3!_1hUzCAhDFd7CqwISpGY6bbOxYY$4!+`j zlbBSs4}Kn(kvgZOVee;W?SPB5d)vrJHcGLOUy#a+uB-sfIr`qzNQ8$HqAke;EW2z! zq1NsczugB$&K0VV{48UiuKN^}bcQ%nfd$K-${e!ejS%{HI4p;Xx>5%!4{F;FXs{x) z7DkrAgOFQ+LlI8zSY$_}=^0KVXD)3i(8?~YOwoliarTHgg%ivT|Jeje!rL+)-&#Op-Z&jx!M-V-;E zcMRvx_NMsw>d@CFB%0{|#&*AU+FzQeTHFPz!VnH>vn3DeOe^b%i5RIwh+cz}d&Y|v zST)h6)7uV;HL8k(Wk2Cdntb3?3=48P%0c2Po0eGcYX)8p=kvDCP17BZ(&z4m!G(#9+G$|4H@j0(SE7-1(ynxu1{&bi%f}*{cB9w5Rycvgh2$W zS+^$jp?4aqj)a-9w_y?rjHU$s zL0ox*o38krC7W7tho3IGN*?@iKdA}*m^8r#2dPct3hirkJZHGELb*&h)APDvRujBw zooWtrZH{CamQF%mAGc|;i+Pi5SN|K#nb9G9uz}G6zR%CvSEwk4EC(^y-Uelk9pmO3 zWGsAal7x-Yvh;Zg{twt1MWi#khU(jgFA-dtXLm5LbN61{AGa; zoUX2D{pEjvyj(j!pl44i6MxQ~&V^Je&0cj_d}*+tN_JupxwVCQdsmU@4lwth`>27Z zW%f--DC3UpUX08t@>uyt4zT-W5F0KWR$k-ww(zj6Q&vHrUaFaC?Q z(Gp`RngxF&7{P9BwIt)B>9rDuXXU`hvt!}!M#E-5z8h-*J5m5;$qQ7IBAdk0-7qUc holT^r&+EhIHRW@4ijp?=A>a!U^id1r(jzXv{|_7!rpo{T literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/azure-active-directory-list.png b/windows/keep-secure/images/azure-active-directory-list.png new file mode 100644 index 0000000000000000000000000000000000000000..1a126b049d1b54ba8dfe13e46b9e28f216330964 GIT binary patch literal 26652 zcmcG$cT`kO_a@qeCTE(QlhBfLZgS4F3Mi7J4={X;HIzY>gN*CI4Ys3_o)QRDolJOT4F>MKiyFZNA zyd(@DkYlx$s?vi1i|x?MOe)9M61VZqD;g7{W`p##zT__i`!#hRh^aJy$IZp0R5fs} z`d15jgjnhEIMrjZsYdNE)8qAM)2hjbTgdR%B@|UuFvW=V#+=u5oW84s4@nRGdGq(j z#(25Uw$Id1(4&vnJO0h5U!QOL=;yts3qM_#ecw+<`Z+Vc1T8YU%9SsO}P z0TU*;zZdvYBP%oImDJxa!3Oktm?~810UPC|QDVZ?LB|`cdb)DASBLC;k3YwGe_TK} zGz4v7J`@>L?pf?e4*PrCwZ+(VQuXgtu9ANKOy+p z393nxO}>^&0~+-zc;W{@z$Ke*NOFQ)%aH zT<&#yeY!hU>)4mU&-QVzna=Myhck)7cKAYK-ONsRhjA>f9TTAKlwuUq&|= z`ng-Fip8dh>k{7oVkyBQ6OG-aJ}|sysv&`in345O%-oPKy~rXY7WngkK=fFgpsgY1 z0X_|f(1X;U!O^xqg^?)t-+`^2h3KCr{gQ9M!Vgko>D+=42V;ra=T8&%_J)7Y$nH?g zdiU`&1`fT^;OU^S53k#uaIuXhnI_@geq8EGHu1E0Wy_=Rw`{!O zYFiXHehDi$*d-Ev1q{8Sd77_?V67i^)<{X|`kb$@vjqVcFPl{Ni|5QQ`j^m2gd%6A zHINJJ$UIrUW0?RiyWE}zM*2%nm&pR761zX=}x~xeKB}C}g%asn6-cnjvT@ z;2%cbz>%Ptg&Z6l1QSvl<_mNfXnPSov};wWv}k;6K#Y^H1gsJ}jyqn(!%-@kvCaGUOUGsn6nyJ*$&WF3Up4bDpVS;?oYtaKmaQKk7y zlC0ou(5y&iHiUCxdsAjg^0&MYrde_=tHTF3>=>3cn z(DSk?Vqqguxvg@2dG$}L;-TOPe}^A+CHRxM~$;ht}iak`EBpq7@8;DE2Nt~PCNvB84gB>1|J2ABnF z^*3oHK4WT|P8jloQMA2|k>u_>--JX?7G`U)$e5=C%}HT2Q{0furH!w1r6PiV29t}M z?e*a~DT~=!boH=&CQY1_Lg@9TCeT$o6kzvGwuVLNqq4s2nq!gB^ic)5_vx`B53<4P zaeLS?5x-+F2-%UgDq5$_)qG13bw;V))pk3fnUsQPVM1OE+USm14esNl0OH=bImyG3fpBlkC}23|Ir6V<&)9N`>5{phu``*AsWj{XFA+oJWP z)oVp?LNxG96E~^LAU9;4RQ7ghb+f5?YcBshRHu(nu=4hoD3(bj`{|cDd7(4Z-{9NL z*Cv*;)r9oa7(;%i4L%j=2V$dqY1T({eu$8!r&G={W;CCJS5zmR^S1hCnelfN0?xQ^ z_v3dCY0!cJdj^-YriaU)o>&CnUotm7Gw+aeg4R+4KH1uvSv2Kr!aXVV}{+v1_zms9lrSa>UzS3!6o?iAz%)SW=O$a6LSx}SI?qOP1|s9*#+IUhkNde{`pGVpC@bL?h$@-zH0KxBC)t> zfeF}Z&Re5#3&+2Hwar}9=+TBU2GU5m>}+qVc`>KPP?+WA<@HB3*!55_zM&MZ=4T1{ zaXw5(&>5k?{rt$>?8m8Hp~C$V#}bzM{c*TK_N@k)sS(UN^Yn(WptRtWAPMc&psIJ> zUR;vm^9gjIShbPP>2us1?{#}o zzs0W!=bHB_br{>X$<`F|{3~}3-P-L_{C-q*l-M!p!#{Oy z>3kchKxJ(Lg4zScOD_G-{yyvk38D`|KO`kPar*td(GYe^D=($58rg~rV zzC&jPfahyp>6`b;LB?o_5|h?%$CO&QIYRi_jNDHq{jU#eDNrY>iAX(GSH>@hH^E#y z_cGI2qVTHA=~dc+vAz<=qf=Mek(++n;lmTpD!W<+h18k6SASkPWq889nn|-CY(GsG zl!*2B65O|o?VMVj< zZ$_JO#uGu2y&iU0cyrZD8ElYb&a&$90tBPfq82~PY9A6m+iJhOz-ZdH9V&;_U!zVS zd(N7-_^cPZj_taMUM;RNC4}%3ZPOGjtFFB_VQz4y8my$8wt+?p2zeYv+>nx5gUM$+ zL>-6F?Y;M6Dj$;gHu&mRC@iL{$F4LyCMy0gn>K9ioLm0t9i@Am7bACMQ3cFEMn*;o z4~rr9Evc!v5JFtYVChp|<6CKun?`lGI^t1nz`oP;B%9d%jj&G-kcAI5sP}`xz!)85 zvZ5DN3W$7Od_4=z&GX1p%R z7cA|n(<1sPQ&ZO0*v2gZs|uLnH;Y3IX}#^QFspTsz9RJx+Zj#DBO|bP^0Tq&da2=s z+%-AN(?vSFyU7WX7z( z{aD3k7uJkP7Xb_Vl)J@%{Bf@L$S&*uan2KSnkb@KL z-iAa9jnH=cpc;G)y;fAS2(g$vu+G)9adMa^z)O<7e=VDDQ&E*7+U+AFMya-Q(hPkb zA(z4GaOWJg_u#ui+v*Dk3g?@S;Wr&)WETRb%?-9RF|Dm^jB_mCqLzk-_htmcw)aw# zNMUCnt(09h1bTAliW&3O)!y7AMXBSRU@@|ZdG(P`YoSh?fvK@5)6o0Z(etJ%HI3`m zPlY;*LRQ|8ehfUAeDbyNsP&7B=JUKT4?E6Uwv6kuIggodUMJ>~cC_=|FG$;%+g8zn zGYx(WY2%-QgE-g=));b*)wOnCXcwAs4t#M7m9i=F^z$l?$WxLByCVnVi&D5~RJ|rZ zZ4npurg?s2-=6&5@H0?2EdQf0d3)2c=@wkr@qVeBNri6tP;+i40JqCO$|I4K#Sxn4yuqMDdX0=i;b|NGmgU#(Qg>Q_^Czz`q!=e z5bB#KFyYy-4<6t+(c~K;$S_SimJb+9D}9+N=)>Xjgplj9n~8}>Fhf+%uMZ}*IGjcu za*>Vr!uCb9ni+-52L>_7KAlGl;EY5Mb+X~2?xnrd_)wMeDM!@10`gE#*elwvoCY&p z=%psMoWLI)9!LQ9ZJzk~ktV2mRI68pEt712Q8Md(M!Y6E&z!}1q`tr){x;ccdb&sAdO$SppQ(ElN8McjT~3kKV+m{-zIw2iXf5i{pOP7^RH9g6 zTFrjaXdUJDr*8k@W4YcB)o*vnqPakg4fTBu(S#ALK#T(5HBX}VFJHdqHNk;iA_N>- z({jus=wz^hPgJp=zQMRqVOXbqHk`M7*;;_yX=TP?BzHj&zsMd)#&vY=Rkz0RbhnC8 zz8vp*qR3(S2WxzfjmG6Pf5zv1GJV9*Pu!pvmBfijkwQg?hg|6yIKO#*)6MWasdJ6& zbd3i>DA7$0mUB%*=-RKhd<_QGIATW}Gn3Vyn?W_14OQVCsHNw1o@>{*p*)!=Wc1&T`Y9pS#Rpus1j3`s(wYB=F z#5VsSuOcDBWryBA*S;kBwt>X9BgAzn+aXjYrBHfGl1JhphwM@rQ%oX-F~N@?0$^tu z_SeHzfDuc)YUsjM!vFT3|L}(#&DOylkDKBxmg$&{w$Kw}wU9 zs$Y+-e_gq6I1Kt*v>f9BNtBu83F#LBr}p7xcd5lw@3W2SD$m=#4Gs?OyS#XU@h3;r zk%ZxW#~MgpkpQILforLvxJg*6h`Zrkv=*s^wo?8ck`lPQ^b@0hGDqBH_|X<5liZZk zox~kUz$T+;)s7(cPL_GR8jvobecI9;DSEALCSFrCMws2DuBL?bnISfnFOoC)7q_fX z<6h!h@+G4)OXlUCN%x$Q(s{yjN`s?PmU$qug=V2wnKMLMS{TP-p$xH`k?~3Tm^L8q z#^dMYSUl&H!s#<)Qv@Q-Y;fp>T@AA6xu;LjT099G;XPpF{`ifPxVs|@3?p1p{i_~i z7vjRLEz03w1cIr?NclddS^a%cF$F3Ist+y0RVos_2TwJkZSLExyzd8$HS1voCa~fE zHjw|)GW?@F<#>q@EMAlYz-@amH6gKFwcTO-ziXEEW+I$ zJ9`?2G;@jn=9%I3TQ?$DX*fTn*V9HIe#L9Qp}Y&SUnLrg0Uf%x&!Z+PwpI2i(Z(X# z5}ac)EGfDqN#Ie|Iqk$Heus>a;inJcvO~!u&3@h=)_o-E)2oh8C{nMWI=uWz;;Ok| zA~SQ!!u0O_2JG?}=tXnT3xM4<2b0%4)_Ee^QIKONN%Sosc!(tACic0R4u58>!c_2M zyTK7lfv||B6_=$U6n(LS)0PTBVr$(YhdM`tl!!i?E93_C09bIv!3WLny3>w7&`*8F zph<31kxlm4`34Y9V9d1fdCl6l=Vy_k>^?~neimv)9JZ2K*r~`y?~RS)UmneZX7-M1 zypl81ucaxI%$cc(B?#hRF^OqrxUmB-2C<=pX3gu@SXmX8zjzK~8`-^m4$$woE7Y+8 z?}Vr;ZL6@Ma=P~+Tbe8DBNO7I@ZH2Jikc1d2Tk*!|5V)<65HDIa7d@4e}1N}<=_-R zF>p0z_0%0XIm?I=->gdz^0xbVkvP7W6cu>5+qjbPWRN(ov{ggl#A^-pM>x!N4Si6` z{b%K7_=g?9dq@EeinxFF=$V4Q+$y_3x=%1jZ`pOf_$yK;YOKKVx>B(AE-Fq7W$U3^u6B;So0 zE&cPX#I`3DP`GBmqgQey$YBL)U=t^0%RUfJK~#(x$yPCg?=zC-u9t%J`*x$InxvoM ziQept`Aco)h%!6*mlS48I>xTS-t9OKGCB(61o}LR3k)G(&%T|xdBxe)+39sPo;ws@ zg0~aWnArBRa_lX(M_%Y^%j*x1;nZPEf96DUaEhdTa_gPY17>XKQ>dlISss_d1$3D~ z(!BzJC1iE(!T4POIGTW_dSEKJdn0s_b z52gzDNQK!PmpA9qBld@7qmyj6t^;uY>oH8}YJ>}bZEajgs*jb`6B4eNwE7OhKKhsD;8DgxXe2z z98Q2(p4A{QzVowhzzttvg8W;8unpCDF?2J<%B;;WE@q~40$Y5>XGe%MSK#wXJgzWb z1Wunn6V*H9vjFb~XrbVURAZpS;!!+;_F`ttQT*93Mtl-qf(o0jJkOgg_@hr2AEQZn ztHe_A3ZCYZ*bPg5BgN}11;qvVLN(xpLMRGCcwHnN&Q>?>HXYLd!X~5_;2>G;t$UwI zjG{tYgse2&`OIoMnpK>=AzSdeul`>h=epU2>|?J;t)Dn1KbjD4k6TKP^Xc0by{-BGDmg;M9Oo%<>Gh~>M{KpzY74HN>jh6Zu-@@ zK=QEwtX%vC5C`|na!-=w4)BurFy-CKRP&@TD>PV~S^t8p`X3b=^}G{S#436r&p_2E ztT!1exIG-g4;_`YeK!=7+& zmOgj&*il|M{+4q~lvumbX|5S&Xxl3Iz4A&$;%g20I49OU9=%~*2FfktE$nCS6cGk& zle#rnx@~D6X>H|2opkQuhN2Zg1VL|o%dx8@m`5;9s1+aX!@&D^{MdN98FkM)ZY-ye zRO~L>v*`fMI=jt+0O{=xe*su~*1cv0NI^{1$Hq6|A~C{t_m#*yB5s+Zh=`x8l0Vc^ zd5a9EdL3Ifw&2Oh(OKH~9 zb`9V^JCE?DBVgbr#EuG|5w~lHije_>mo68DAK*&tOi?yFsayr5qa7UpXeO@(c;3ol zBRa$eU|#JPkn0!-h$ZUGj}J3Fb#uw%lxP@$$z|sus-d=`M85#LQ}1_V+2)(K0kjAe zv+(Q#U`jlNk!)G?n&FOF?ISU9w@DHiRT4RN7qab)N%vGAquA#PX+zSNw*v(uj~D$Ev=>*mHT(<1INu@^T8 z_u2gTwbx3`Oir zqY>at{*wIrLvBKx){YvQK^K!zHG^dhe81J zQ786pZ<J@7|li&pK^cCLHss`WdfkcHZ_tnc<|)$>WvM6PlOFLVow!N>EdrYFHK z^kY63Ig{Onz7ox_9voFdg*m>!u?Y5IR0bp|64Jzh#-&OCUdl`Q-ef#+kK}Ve7QPU+ z!z0|iJ*h6N2DqwVt9=nWrL)D%=2ymmBxL7hI_kQUhl<5`Z~yS2740hLywdaBfCqLd zH2}3AD|v$<>Nsfr<2nECdzr8+sT$Tj81H=-vMo-JeH-pf{wL}fOKGxA8#E%=3CN|k zRR4kAvXv4kGi^IIsG8L->>bFP0^XJziOLmc=n6*9MRSDWt|W(TElH(~w|g0u_(Up1 z;YO-s=kQxx2_+rr`I?f3hT|taw52V@e2V|ut6IDaGB4|i48=E$VE&Qq&5z2K`*D=F zE<#4~5yJ}2vh-FGgHvaYoMg>;A?BL_G$I?SOYDOq!Q3vzlvM5s*lc_5yJ%@FhGgqp zlCB4LC9DS-fsF!!hUe^kWgZZ6T;KaT#OUe@tNJ>*o*+_cFeP+;pGEN|i7%W6Irru# zO#9p*@hXoL^L8Cqy57|-O+_F7u7Lr4Z<(F|R88oCM=SjZD_HxGR7G!j5s#ZaeB;TR zP+r!gtIR6X2}04@6nZpKh2@Q%2YSN>SumxA$c@n;J!NRDU7%Zn_w$AkIdKRsf~*AX z8Qxg8tQQzGr&g0f`R06re7eAUg?U}&9s7rZpLgYD$p%L0sXvLdYeIZ0r?kW(_7whR z)0pHl(T~;7|4iKn0vytX?iHhF0L7Wafh5ZU*X6Mk8oJnZ2@$Lp;xTGAruX66NIm(1 z1NEs+DaL6pRZn=)3A0N}k1*eaUr_E2SWZu~p`yjksK*hGv~DtMW4kB(9xsitWk`(L zYVCZKjlIjW)!Fr>$9;bBD7ixi^zuxmtc!5%lf744akx3Zax~%-dsBS^FS;tt4L>0m zp2sd?C8@5=&b}y5PcD9*X%oRAPuQ(BPb4&XfdnGoj-5&!rB|SLy7E@(&7%Fek%=1a z(9*H0h+Vi1`KDg?J-|=i&7A|cbe>&^k3NCpDBg3 z05fbg*z%-io+VEFoZB`nSrEj-!u;L21RAcIZ-MaYEc9Pf-C819HmJnD?d)~L8wWc$ zSl`6D;()uuGcnF@1<0-^zl^L!joixgErIW2Ckb#KC@E}4M74x!V-Wdd0Bf|EgY1*n zbEk-8Rbg1{;9~yysbNMbOF_4ftg`X@G>&7!ohL^hFPUQunGjz3%K6@k3)5MReJ{C* z2HB;3md$W~_x>(|jCyQtL>u5QOzHbaup$BCnh zcxHsfyFjkzdD2TLdhVnq=0qdX!d$}uN|)+gBiMs7oS@K`p-1pzpT?O|HoDGSpnnyZ zES9&+)r^IDT(q6iRD1UXnfY%m{KvsS%y|i!UB;Pf4R$ zs^TA!j@B7$ZUK<4$f9pJ_t_4274}F{&IyF^go+}enshOz3(YSI$nDj75XOLe_|J5u z0e)VJPzgCsrrFCICLr0mea=|kzM!d?FSYW^md2|1Hl%+@HVr#9;l{q6EjwEXK=*O~ zq-^B+4FEYCvSY({AqTKkor*aoiP8)-Nb{TnD^@6(-ZSG`LIRK?c~qRW5MO5ZMi?t zsBPGs-$f(9R09HI7r@4&KmGwYdeZC+yDr%-f#ato349c(BbiM>EMf-N4wOmZVN2nX zH1PG0^h{aoV<@qy!Qdh4Q*e&NB78ZWP(OfxH>`<-B@T8rk9AMsYEOl69d6-%?Qy>q zh{ZF%Wnp8R#ahTEnKe7v&^Y9%&98A{Yy4I>;~vp>7Dk}^ zp>d{$x!)JzWf(leee;}|qIBB%f5-yr#%NXLyD3mn#da?ZTFJEu7Gavdhne|}3+Qqj zsCm6m#+Us|@C?8Pr7D9j=Vm8UJHsKg}-x-z?St(<;t#6w$N8u%27* z=U@_N4qJC~Q!yOdBP#NfVtm=X4(})=3h~Ut+>cktBV$m`bhG-0Cs18Jf_7|j2Nm^3 zJI;|BQyULgeXMo7U5{5cYyS7Eng`J2rssT*JPO?Cv#dV@P>y_m=-bV}&6v6hLK$xD zO8@#lpTf8z3v;7{$=qk=etECS7gbpP+XN7)wit@V)5s3KnNhc=tpYq5us?vem>N#n znZm_;I~}tA@nGzs+LR)?S-|6%OXO!FN;H7}7hqic?J?4fNvhurwEBds@0#C%kN&TV z{ld==+9+q0X8aZVPX&*(0Bv4UlS?H;n+{+yMuCm$F#?}g@;<~6`C%HM^+Z24{KWjj>WJ7tUnhuf$mVqCuT&!{ z9Cj$dUQk@H8_(`8JQu-)qI~yAt%?^o{E7XFrl+;B_MygC zb${HSR9RtoTSqT%@TI8YmSLpC$h#S0VN+wI#9I{N-?M(cH?NeTJn;5~E>~o4^s*B@ zFhQUh+>oyCp-<<5@XO!-DFNMj2m!xZ$?%8|_~6HNwqze${l`XzoY_Jb%|*>O)0{!3 zV#~ViP;I3GECT7^h}g=%-Bh`K=^sY`rs`EvlQ%Y_n+1Y}!VxuDJO0mWuQe<2N z|9({}HDtR~Y*{_oQ(t^(t@a zjnQ&6yu^j-#Xo?7Bk_}P2anp{4C7!nS5WD-i^@`h6$cg1z|xyX>s>tR;jE+FLLrGa zF;TS-xQp0G2R-*~%FN!sI)+BTR)5Mmas4P&AhTALIf}c6#SU9i$mS4(&yc3y40^!k zm0mRqTWvk%Lo(lRILS4-&+)UlYfqpN9rV~+Mhv~3Vfz>@rK~g$3)h#2VAwSUVk5X| zhV1b$uwoI&{!C+>6pLxRV}g-Wdqv6@W$;oRmAxAm`>B!(OimdHBd5&bcsHGCUH_x}H zU-!Jp`d#P7kUVl>jo_&1$a+{!f$_TH#Q~6{;-&f!w)Z6ZW%0q@JovZ zP5Z?nrzjtB*%n4{biLI;5=|hAc0j2UrK%q9+}^)&Y8Be@CHtgQ${Mu~rT1kIKH0LS zFs-(U6^Jbw&!8|5n2HOc?5m7rm3?^<Msw-*4<^gh?$yP ziKw{Xvs$Ev?-K%tgPN3^KCLVqAvBpG+q3j+>ubz(>?683defKAIZtgeIEBTYW^k;e ze$-(pL(16e|E6Pf?z!NiIjKO=qkETGbvl(JeRy!3S+RtfaJ&H;$6tvvT8xVO62~vK z(}C7UX88c>OBZ_qxnE6XL)aPhr`uJW9Mp&pn)<@t?F@?JlhrbL_qBr7PNe3Gvra^( z6H~^_soX0UMe54}LhntLA-=|B+fagn6}tlc>_j9iR^EDuxB%E!p-?9vxv~be66KI<$%@y19<~(!TDxgdB#mfQ+=Zn!|LJ*iZ=uSd6kY zp9rw@pEAD%3B`M?S{Y+&oj6!>*FE3WV#J_@Tg4iyT5ux=8m1TtGgj)aDulQK4s62` zeHM(6GOk)cS`P==kC(Qs$0hQTuQHCaRdlxapBm{oI$WhkbjiYA71w*5$>n{0d_yK04*TZ*|4}mSPp?e7~;Ar_xspX?# zzz@d=Oe+F{b@)+v5{Fp-J6Pr%xtW+vXK{wvYgp7GT=Dk<1${569BN^h+AMA-r+o;$ za<2EHF2jdmKgQBAhj@ zN%buS5M9trl&*CNE~F=g5E7y=vv;sC;?K!c-vD;<{%*TIhAMpoG)cSj$|AN@KNclp z#s0Uv&YFlqfId`RK85~;h7c6oec*NX0p~d+%(iVv_9`v*0NBw6+AH5IsJ|9^0JMX* z2|ps0KVn4&io)b|ZufZXW=jn^!t^$GiF~AT$RO#StHnJg=Gfwuk^j9@kyID7vueOcApDu;m_AhTKJE)_comz3GO&Xq1E zmXOAHZgdor0fZx^47Y5F8$JXO1`xEpEKZ;g};n~O`4VQI>15f~V= zM#z+iQA7?3j;NRFUEW&*aFuASDWBAOLxM^~Y52-(lPU>QP$hMq{J;i;7TM%$tEw1f z&|0=`x{0|aDwF&$dUsw+jeArG2A(Id$rO3XHm2A8ew_y=!lH)rWseu&@28ykC~|%I zXz%5va;DWN%YCs@sg;R6!%HC7K(Kl8;=O0{bTV9=Nyh_Iw#`iAUJhX_#u<5L$zc-D z!@ouSMw!wi(72QWP=cr0qdqb_o|9W+Mz0m7c9S#18O{XpZUVLw5#w{DN%GU*uyfj= zD8Wsq_mc>(`MdcI4C#GeH)vJn379y(Zpax!ZhW1GmG{=a&$O#@V$K`JfF$F06L5*R|iku>ndbkgY(g5fLBnP{>>>?@#itodGSW@0wK}i=iyzoM{U@FmrbAh^B2V5L7$Ci+7z0zsO4qnGF#!(o!uqq~5gndX&$$wo zNHRMsVMjf28=>JR%L^{dWSNos?`^YwiKZfJtb9QU^oO9LtlCE;9L=F zDiAXa|71u5D8V~W596{!)Vg3}5yh%P|RBX=7kr5pCX~gqYlr zc}c!A?BaMyq4uh=g~rxuzz>wRlScw>AdjS^!dmoS66=n8;)qHM(S~2Ia3@GJ_0#y!Ra0VN*wvxWA0eZ)+aSW+5z`k#p5j>Ni}2qiT>>t{km!%YKj zza|qW4&?a#Aq~5t^dej2L(h8A*yA0d=LpRhiLsG36m55z3)8pld8lCbuCsScvPS%3 z{}9MGAr4r%cqHKj?-UT%A7z?RY>Hwr%&{38&BmZKCC0 z-3QY`XG~C=ICG9ZS^T+emggwrU9mqry&RdJi{~BQEm1eGT}=XV_0UmhkqQv2hoB+w`S73Nk4n zG;V47R{q25wx-lgb+}7M++%|i=fo*>tJM}i0@7ykHq#zk4^)25TA;|Qn0JK`ce+|UcRoo{=?gGIfHs3UgAEqNT7;`Y?FsjwSLza+CCZb- zWp}NFUPN{YlB#HNV`6A*!&zHCYEq|>S+UZ?pS%t%TYc8M3m<+mPwI$BWQK%C$`jBz zqtyV!}~Ru ziQ)KD{kue>fK8|V;O_l;QAw9rs}<*FP*^3!rAeNpO`m36cE{Cs7Hx5sjtyTR0YhB) ztVs+Jel5n??(~n-)Tm9&)h|4TF2B@?URc(|?$=csa0vU4Ou!(W*A{?UO!!A80Gb(b zHOX*dl8+ogPfgbmnA$BII%FEzTcEu_btznNny zLXb@X5ZUHfa&c%mED80xc{9LeLYf#|I$2nP8)k2Z(em? zoK>#rrpI6~M~|E0%L3tVHok`2KV1lsCPWfW8%^`oL&!q#G~3>nZ6Sc6bF>x$QtK<; zj}k5AcA$n_QzW^*epbLf|3#TB3~izNnNGkU864yg!PKwU&ml%PHjVW|L(^oPOPcXn zLcD4kJrQHQ)F^EdLd}q>c3vCfS5lw(2HLAFwD^*PxOGJj5qc||iF6Ly!?VKV` zs#3JM3@qoz4%|Zg{d9PvmcuXQzS>>^PMlTi)Y=vBvMmv?SOF|GkZ?&hWBG32VfRA$ zmxoB}-1PZBlS%{zTVF?T{TU<$?A^7edS_}PoSqS^(I&4+1a<3g!0DsgUTTP94C&%Y z?FSSy*ib0SBiYvQ7mR95`QN8Sfl8|r6jvCT?3hOc=&7=`PT5{{@b?boD90X_eW9EO&8@-RZe$rXWdx95Loe;>Ms(JoaQ<<7;) zsD~p1DFC6`Fxf$R2jiL||0AO4-i2Gm;MoTUOA^L;1_mGvz7MXL0g1>|V21Q0)g-UBH*R5ZTNe_rk(w5e$<`AQOC&cA-y<|$W(ez8c8Je}Nxr5(J zUO@eZ{y9LgR3Vt-k}zh*K7ivRvzfyc3k5_WN%xtv(a9ajAkQ6|W(f%(uO_Ky^5(3x zaACn<;JktMLHg}Y?U%Jx+Yb{rhosDf4zngr(E94DzdnKmhnx9foog;B%q8Qp1LB?Q ze5nr6(s_OZ#_h;<4H|)XlcIJ5zZ9?U}d@y9Q2+X{n!I z+utJcKLuTBF*Y9$H)qW}E_wky*7r#)r@!^yK-a1Eu<7Yo4XAaiUv!dSWVG{W~UR&$152UMDxtT+9I}jx!ghsCNgH;kQ$#gZY2H zZ@&{axS_{+zz$7q9YO`r2XzqWgdL5cZn~B}?ObpW8}>}?95#ocPn)ODE{DR_HyblA z26MN=e1Fkn6aTSzrj}YNc|(%%?S6Q`QfHs+^U&KDeI_?H*BPs~guTtE%Xj{Bvcc7- z6gKg@{MY*)U$0hQu!McPUSYaj9SonYawfbO^C_fhJD^hNBA2h9xrJdLr92(Y^_jfd zw6*;(c|&mksAVq@2y#DR!q-KR^TF!D&B;&UD-3hzgQp^-WVaWgbMJ`D+F2nlR#H#= z^UqcgT*-2;NPtr*Skc#$8q9xz!zcvG9N_r>Hj0>D+ekx2UUDB+_m(>3%on!>txw+; zjjv1(>1a}mdgVFi?{KNQ2E3ooFeXN?a^p$FjzrIW-FBh@*Agfr$98B|_!9uEtF zqSOR<;7;P$NtHIx!`a#O4P9zv~X@Tv?3>u5# ztNF!uRaYyBId*k6^0#cuHtr++R3!xrPS-$^s2#vnbVo&w$d<;U>EYl-3SRPPGMWcQ z%2pJzk0LfD1%@uZ6VlPw2M~ItPFSYzJxg3PRuJ4E8x4P>%#~CqX{ITV)tM#1$YjrG z7Bl|3g(wC`z7)sISX7*q$WEWNmjBU*+V@)jjzVA?#Jp-w-skxrosV(+%LGgeC090o zKNVaZ%?KI`La+`1J#Y1EGoKcj7l=UMBJ;M7(*~?6cfCt$*VLUIx(dj%x5&iA7@wUS z(%>+YRG6-krm&bCpJjH$&{fk)XClL$eTpfj#I!61>xA>EHJ#_}7O`Fb8Fq0C_RWe4 zEV$YmWobY7;N_(P)xDAUiOtJgFwQz4ULvC!(xL;6(}6;*u?3e4@Hq-5O`ND-=0pxF zl44{&cMZnV)HZXXC0?73d8-ACtuL&->WOryywKc)F!{fT@>U~SMEBVS#w+HPjg1f)% ziCWGHnHlNM=RavAw}TuQ!Y>)4q5;j3-pnQciZ}{!Nqs#pJNM-I+Q$<@nqcyhnf;%i zp6-OR6poVKy8Ud!WkC#laVY|{Jn)1=8xqKE{>l<|w!oqA^h#r;p-&cn&H8eC#e(0`s%jPDBPg;p9*+ij`A6!8sVZzao0Y_8fF1RMUk zZ3tUc)(X>71BrlAj7g)0o>}bO$9?*hR^YYz1Emypq1T+XE5pGIr;cI4QB{XdcoDf@ z+N;V)?wUm+K3n$+0?zvH&7OR3Ywhms{OjkoR#{{f9c>VU5)!>>nPAoD6L{@!Wf*}k z7}1X+pg)B}t857FjkP1`9sjHI_U#Z6k1COy1!6d-AbH-FLg6ckZ*hRJU2**X=k7RRc6PSjXI0?wXP#mg z90U1dUFmD}#BPXq=U zt>UQsl8>x_)!6LoCl`Rq?Mzdpe#NS*)IiZ|r^D~IEtE0XX=}QxeJ6nSWePT5?)>oR z!=&j0dXz%bdN`y&iuD-NhH(_mM)Ncj1ChIzNVtKL^>_E!9hg*7RG$KVgP=+uFV><@ zR#p}`D$S3jO6&v<8jl_vMhstbS|y(=u^3{>Ad1)JyfgXC+V~jRSb$%^Sk{ZBi=!>V zc}7$~%2hi|jFF2gZ-ng<9bwd--)a6O#<`2VjqmZB_5~--Vq$nyAoaGqiE)@xQ~`GD ztE2~HGqenjOTv85e@5sqRXVZ>zjQ=}QfIcObYs#8nWGPH3Md=*DA5PWy>vXZ1>E0E zd+nJM7i}2bka;6iXw3J@PpX@X=P8o3M`NICid!voMrzR%gZWMWS8d-J)@0UoorD0P z1VZRd0t5&}3=tF%l+c?>krD+Z^s3ZR(a{hfbPYWqCA5GeB2@uJ>4rKqK~NEpDz;Iu zpyGSbdFPqu`>yNz_x(-6&3)&bv-jG2ueGw+MXNKmTrp~lg54~;F-n7Y=iQcI8Oeoc zE;SyIxngbx&WkF}&~|!qHZ2-(Fn#OGR+1+8fS3s5 z_*NsH(HjtRzj{F}(Yw<{gPKL=-ScGh9YWmecUd#SRGZYRj4$^)FmE4;r(5^qm9Qcs zN8L6}6sSP&Xfw3-pepgU05fW1FLuErx)Wc)48^*9UI+zaY*Bv4R&MhnACXe04@UM* zxZ&&@;F9?h>$MyfY;+l&-;qC(VQlw8;|dwA&gItldAuEHEirS1Bz3VpQQ>`Y9-1pH z^Z`ON)cjiv4vVcfTGz*T$YqdUYO|lbt|B%T`z!5}pelW(L+WhbRAMI4n^+4k%I*1k z_E!|7+)M1?PV!)fNlE$eIhxm8z4c^@^R{1X?7daFUB7QWj#oJCL?m?!oA;eLtc@ys zrT2&%Y7w&boOLXQ(c3RSkB+w~bR(2KfG!ztbRO+KNfFAjbfYSxRP2>Mr`gP^N5V!t z!|#-}rG4D%B3Jsndl9A)L$@@2r9not+;>or$Yr}Y_K|rhdb!&kn~ooc=0mk1{bDRY zqs|h#&RC%Bj7B4_uzMGmm0k!!ALxuezifAublHNsiaoitzUS*EiZz4Xg3RiER*$Z`s^JJes|u#bzVO4{0_fMoo3EVf?YSXUe|E9S&x6 z%Gr&5b2c7Ww2MtFRHDg_o(hCB6x`L$Fkl!3)5{}Y(3Mm3p%db2XqHHvLZ^sd+Fp$i zpLQFm1wjPFSj?2GnfBMPU_@WH6Vlqvn#_9LB+08lpk#1CHd{JHPIiXX4Ms`&!ebZw z3q|Wk{Xd1r^tRgI67}un;S(~i>JvW-``BZ#3Pw#;ftxQMRZF%n$#p>&*O3Y{$VkW# z5h0d25F>^0U^sC2isrE7xg;rh`raiObT+hR4+@C{qZN*>E)l;kk~x#}I5`Pf1tw2G zLf5EF)o%=R(_i?Cza)OX@!7}05=3_vF}pMCO-wrISL|@^8>tDZX%A}~1uO#C+YXHv zz#VKGCU=cCR-I!|N8)rwn3vCKd)t;K;wye-0Bhpo^O5~O(h8f}!C(E#0Lcleic=52 z+-hPt#!83Wq@ga5pYw;jFp-pVNK z6APn1eR-?&A+D+KpUZ-H2gU`fAxcsRM~8!#CoxMW_zR=D|Mh##{5$`#@jYv{9{+#x!hdHT(e|9(Cwy@jNkVP5 z-yjoz;bZVJOx?Mf`F{KBTfsjh_hKA*fF?t(1YJQd*D%r?0<&`AW0^Uojk{%pJ@g8k7JFyj7g{yD$6lnq3)$d9;pN~oF#Om z4CBfRLuzl7Lksp(vMn7bVgY^A^m2-Ct6+4I&r6D1gLsJ4_myx|0rz+W1xaK|LY36` zlQe9JYMahl(nmk#In{A3qemLDv@6dFV1CEnRFr%)f;OY7ou0QQzN*=GS6yFTlxJs> zfi+0~=>42|==|+EN#|BryVEIdNyq|6kvpo2=t`-g5>i!7MzoNqM?jXLEl*eWd}3S< zlZ0i6^z#*rZ5$p`k0|16Ov3~Y@|q~{VZGF`;X2%RJoAO8cw%M~qKyV>g^D@bbD>%G z$%HE`dsUz0AUq#uMW^kfmum5 zDJrrUGBX%kBaH9TZlPQ+_}F^nv12bY(gad(Cl4RzmaNzITZXp;vl|5@kUncBO3bgc z7`q&yJ_%$pzauc+>8~82q888BqcTou<0M)RzUiyg>K6I!E;*2_>_JxHs4w< zzq4R63g?_CsAI#VUKh>XBNPr8OC^VhG!X-mgDl0Ojpf%>V$0%ag`?Jy61}Cw?;452 z-XFReQ5phFkqjKWoL|OB#Y|9|cTD?9sRKuUFrQ>1G#S&koh4o+W-+V+Z%n)bm5E2d zgS~ImGGiu8x@X!U(Z+!<7EMNWTb~wLtt^sxW@Y>`-D$w-MDTbiHc||eVp)3$S;)6~ z-o&t)H;OCB=W6~Y98I_}rWr_oljQIxPe=7?T+rc0L>B8u1;@==JtHn$LvmRWR7+jg zRxgxQ++-^MoLL|(aUM+M!wJb3-ZC3{C7tiU@MLRW?xW@^3hezdy4D*M2lROqey>!F zmibV)xzLzt@CkSZ>)4u6yg?MFL0i~+M?8htDA@Z*3S%Q92Ym?56+)BB&m3{9L_n^M zxbTg`UvlGY3P;T=jx{F03ge?kaQVJVy1u@4F@{-^Ovvx7+SbXJbrQ8a2%JQrg2>?Q z2w}TY1ZV7^h;3WAKX#);*HR8+xnhRjTb)@~n9HXo6r>oTG#4CX#9=s7ii*!u5*d9B zBiJj<`Ok2M>x8`AZ*@J>=sFOeg~zPYq1xCJoGltu=fUlmU81z^@`_2z2v(*YNIL7s zW0xaUJGJfgBcJ2l-8Ax`2$o)?;J)~H)xI-wSO7^6zX0*`{HY9nj_U?WVEkd;0nFTt zX(I@D)7TsDy+!2>jN+Vz%hOGvW{gi9|=y;BR?a_DcjmB&FPzh%EYSbNQma!N-@3UiVBrDIi-eajWUEe;oWsqrK7L&GtY^jFMnFb&sX+~s!XoFWD!YV_N>wS;(eR)6x-OvcI;kQ;s!on*O`VO!2`cUF(gegRN zJ-!8^rhQjnB$L10$Q+*c8a8%<+QyrtQLZQACq!+5B&Zr8S%+4+a!=0q)TgpFa}ArI z4GzJw%=;9)&$Iig<5>__*8Y7r7nSzBi*qZ9YK9O9bTzIZ?(; z)!T&9*dqn^?80;Uj&ZLEUc*}pX-_**cQ3H9>$imJZGPpZM1`&$A#@QVmFJ}4Z}R>s zLeebY+fx4hkK0GSELC0j$qbpOEWcv82$OR%e{dWxeu<4Arx08i3LOcnNF}kPNeoE@ zo03y4M>=M$B6- zDvlJ(l|RD8vl!*hG!bUMe@!*&gvqi-Y->KHN&rr@(FR7xM%CZdS{p8%JlVb)7lU|N zQq)7zQzN4%3PrqNI(uz}zO6i2p=NO&Ao20bf=T-hwpiqGL|?i~^a!gzL$AN+SbujN ztpg9P%01(T8p3{aksKPGB~9@Utby8g2jvK}7TdUUJQ!%{af}hsc_X33RV2*fW&@XG z&Q28v>R-BwEswJvASry_XV%I0;m~44=5yBS11*(r6_U)hh8oGqv41`|eQ@&#Um5@# ziPHdzfSRt!y!nrt!lWwh_hXX+vy_Z=8>xJ~^+K|q?9MXakYCP}m=y>Gi!QQ+@msGE zr8%pDM!5+V6_&vpncF3eyAx)gG#`o(=L0TshV|F=Xrg~3s6|0XHaMY)yN4?-pe_Y7 z(0s=d10A;?T2z^2-X7kSUZ~Sq+xj;iYb09}y&svA%t0&S#Uj_vgC~@kPWUij3jd3; ztWHCIEtqLuR~EQ#_>KO)`yIxYhr;%8wLrn=!MzIk2soBrp4Z|U_VsYR03<5F!A$~d z@q4FB?X3M(b=PHlk3nz9*(oKjxnM5Z(pg zTOMryqE_zhs%??Ea{XP3TU!^n#ysd>=j~MO508B|tC^iwcYXT~K(s-8aLpfHz*gYS zZ1j3(JYQaLP|!8N;_;aS;z1KJe&c9Qs@1AVw5R9nz4JI~H0A})Nw1%JPcs}yqFt$g z^pg-N<|`XBJA2Z$(v(?y)cYFDa-L25mlfE&NLRsw z_x0$&bmk;rIEi#CIXMlrOEwt#-7SgJ)upmn`TtNmI<$7x&YD zTA!dg{9gD#@Ns$=eOgwqII)4VlKY6fuYBL$4 z+!?2-Zz2 zxIM`SxHsP?IULa>jX%z`DW;8>lyL}|*HsCBJoeJ9w4R)NJ~f$ks0@g@Cm+u^YfyotcObc@6Pq_#Vfh! zD(Hp66K(B z#Q_DY$Ix37kC|P_uiI6}9d!n%>0_DeDqc4#C<=|~=`WR;LXwXKmUvUjpsZEqM$L0cv9H=--B*KcjyYhTwVIwo}si$pq&3P|*SlHqrZoOXMZtQ2uQ>!9PGkIis5 z{gotxPRW$suc)waS1ZV+morlR5c zF6|35V{XHeP|GaHSSsb@0#D(HTW~9GN$-3E3VxNGCO5 zX4-hQ8drYh6dcCZ3bDt*`2OiW(Kn!-m%CiBIZ#{hPc-fa3tD0tK(|!dlJkYkr!=kt z*~L=iuk-~PVq@Q)W^!#2RkxsODwRE-{U)|FL0q)jlwjoTm;XPZ5){UB)?-ANsA4 z<0n3S6evXOG$TgXaxD5q&l9r`*~)Xkps6&o^zv%hq)=Ce3uHNerTPFZUV|6-0Rc6U z^ZTUl5e5!mcnS^J$r*-S%YW=V$2;H$b18iCRhNn6mscb0h9BOZ2lC($dd3QE_)nlD z2G%tRZq|n7HA9kOg#ADl+*t9w1eDKBbseW%(|?X;x|{CiE0##ceselYUFn9PDeM3#3xmi+tsh2`|(or zX3z;OKK^;#f#V_0!<8LrRQrBm)Mu(!ZIf;VW*$KvY&4p5jhcNS-FaLs=o&42ydpNC8zz*+r&F1kaR8*W_&#?6ICz@hmGNaR^n zzaoIP0DCP`Ka-RWQqK*UuUy5T`)B?l7$3f=4*hv#(>TKQ3x~bMgjw%&;+{=Up@7@w znYS(VV9w-gMS%g!ZmNh-(JQ{IMwE&^>poEY;kHlz!0&ipguaq(?8GOF7nB0Z((31WRfZ768cH2kKF59?ycz^3HOZa-YW_&H! zKn%s&@gkQsJ=r~*q44zLs%`Bx2JX#4(Mzfd6dF0%NF$1&;0x{|f7+}H0YXq{#KWQ8 zywi)y?|{}^_JP5@Pp>GW2OQt4TsRsrBX=mY*IQDGJF5s`jmobToy)bjCBZS|=yL0n zjO2dn`N=dE5;@ni=PK-ELQlL2|>< zps`~``)rA+o|o$T;sNsq;b{56hlh%GSXzDLRpO+hs zv)Uf$5p294F{i&t=}SiETAed-$O>)NxYYc1*+OddyljuXW(|GKD%O5-FfRkNwBur< z2|jxMsaP>Ss|aL-b8-ETCa!_*O`vC~tM=p|sJ5hrGi-J`>lNH~sJoo7224ZeH*!Ci zaaETh*i&l2TJ79Gh^ENd;^c;Xl44Cen_s>Z3710<8_|Eo;Uo)<6k%EXI-#ciR7m`D zR(B3;8Y-6B6!R2&@!g{r4-P(+^;z-8Cg}Ex2#rCP769Y2I>yK$$h`No!M9!|$8I|} zX@sCIVGpKV8+m(!b`k%BE@e2byty2n?-5TK zWAu!fVsVLz_lmleFt<{&dPF<*jKvIJYHd&C(HPo1!cDgC_2YuFPYR%{1RVp@3=}c% zEFE$h_^pIlrsD2<_77V~Sc>6P@--0`>=vFGkgX>ViE#AFZ0*a^9yxqqJ(sNacQ#%- zJ7!1C1`NhLjmq)qc2i0z$Fu=C* zrgD7E)^{7v>Go)nWLlenu4);1pmbpeO4ywE1tq}F8()i5-s{A0i2VR}NFBbIIVez4R82nDNP$wqtV#FkUcOs9b*PFy1_N7wn3!iZbV;ffg6 ziQ~tOOJ^xs`NNeYW>)*4M}Vcam zpD&LCVTTnX-ZNeT#xFuktUGTi2++`rq4CWH>?Y)}{X->v+xd74?QmjtedzSA@p5j@ zEQ~6<`ei(YmTMwXLUF>+C%U~YBPUn$vFo!}r{~THCe)s*AikG6#TdOxn(oPZ{gxM(o*M_PQJ~u=|ds8v(4OC8(DG zGEMc~u;Hu27Cj+zTv?<=B7<%AV@Yz~A3r3;UVjZNp)($NfaMfacKz}p4=JxG^p3I| zt(=QmJ#RQ}g_ub&Ry`-1fN(x((E4h|^_>c6fX#Q%m9X`=qYTg? z%-9Yz?G%C3u|fT9Vm!ZN*pZ}x;P=_NSnodv9klEeWv!8p&P`FY{BTH&<%K`9K}7*b z7^r+u<_WI#RVgV=y)l$bK5Uza4u3nM(+?C%@=1!BveN>=L2rH0unaqbDrecFF*H5j z>l&BvaZ{4knUlEE9Zf&NzM0EiO{-Aba+4B>;yH{%mZ|M2Dj2VV|;oJ-VVUKq_6@|J@!0snrg7D zFN@Zy%;g~e@7k^8Gd_Nl3m1c+ipFWo_<~s&9s%2GOboRzdoH#lmSHbugG^GhrOQXvtBuB5*6*XK`e#`ipP1a!<*@^W|AR?I zBw40slG+Rm0)vgZ<>XI1J92G+qC36cKbW6f_Mq1Y3q|hv*!<0JolTJf{cKDbw{hV3 z^K^y;=d@O=*UOmvul_ixrOM0+K1z#|L;%H^%?L#t!mnU~a TLY%-a`arDAj+oXMdr=7&0FG=6`z20-3bFTBx`6Cz4^L(Fse(w8o=le~hzAlW8mW>tw0MKb_sNN;~ zJtlmb&yxcHWLV2DZG;Q5r*~n>fcJeISi;3Q2c7i%OlpZv>^4&}e{xbnD^ zILJi#47L?(8Mw9Fm4W0g4~1s_lFZn(U-N77$Q-%PF0hy2y?StOPu6g;r`LP%cxgR- zIeo37pkS!NysorNZwgzoj>Vo%bar-*jg4V2m^0`;)d9Z#hUuxtZ;oiXgC9AkUR~Ul zWRX!DyK95JXD8T$LthbujzX$?jpXkGrmFTR@B5E0DE?H-j^b!}9zC9OJj>~Jzgncs zRmrvwPU%TKurpPb6B2v8Q@anrL{+8R!zNF2_h^@EFtm;XhN)L3yFGPYZQVFHW^Soz z3Nn5X60lysSW!1=W?@mwv-y=bwpHGJ8sLnN6uY6gq5Zw9+OC?cvvT?;wyrvGGcN*L z60LQy`$^d7+PvU6+tVJ}r4LI~_M@#%+r7MD5o>#W+hHtIjc1aJ6I2j(syC}sEjemD9ea?szFsG@ zGc8itBCnRS5;;WfuXPzy?k1H)v#uHY2`q+8{^&0q_3oY=l^`t5OcQ%;70jo*9R7fw zWl+{ZV)JG#*-A{4NY}nR&D^AzO*<{bq5U?*WxH%ff|J*Q$8j!8@F8c|d!MRA9#FG+ zRUxC*O}U--YCtKr>aKU_#PhQWiB~pfeb$t2+3%otw8kr~?!z)=ln}d%Bk9rhi`F}6 zWXywZTlA`rG4#g`f^8uYfW~%5a$$4Vi)t9#Be>le;FTh#$8k|@vbM|wrwjW}RD@_OK z*x)KTPKJXN4(n;x9%9gQe81Zwz^4m!EwZc5k8Es|Or(>MD6&b zB>#}8O9o@@4z$l0fLLFTEd6Tu!t&@+f%?XH+8q?RC-QK~z-8}5^nFd+w}liLb3zb~ zBqvAt1=vn{WbAP(D=Pwe*%l8TJg~Gp-ETQtGq355J==aessNw)Wc;BOtwOCH10HNX zSgID^LkdI!EZt^3sHpVHm#PFaXErs z{&ZQ^o>SfImzLiI~Ismo&gDP0NfUL3Xd&I>L82E}zWzJgl+)W*EO4#4f z^~YVd7RyW=9rP8cH@<9JP;7%MfU%g}x7$N6E_kWCsg=1z1o+|X1JoUa?~exJb`%xx zIAu0{^_-XwFwyf-d$6hPN@)1CSChee1~P5!?c{E6=B-p$V|k7r_ugxZEPD2( zuJdGGy|H^~t+@Red#lo>lnM*WY+ESx+P)%-sV5Gi|9uKX*VK99k}J@zS}^t59Zhv- z4lR)L&{#Ij5yv7T74lKo9938#z&joy7oSYc7y~}Q+-rHwurqZJJrG&W4#6%x3vD@q zcEOZ_458&E$XrfweyhV7r-yDn2YlP+mtrgcEKI)RBe`$bf*dPM=)* z`dt%_R;uX^@Oah7kKw(9?$wqeBrI%Wt3KiE^?U42ZOg`s{$Q<0 zViP~_H@#^#zX7}^qNEpBd;N_DVk76?fM?oLIi(-x;LvUcD!5n$n0i3FurJXZ?_xs6 z;eSMNw0mBA1f41Yos3-YF6NE7Hb}A5rd3uDiF35CD}B}iulMb`f}2Od;AdnK3O*q%X#DZehxCcD#EiSp5O9<}!<|9|{194O*sCx} zj?QxG6tI+aYGV+q>%6(2^K{3clzKqr+V%WM99Oe4TDqY~>gq%FiRWF&=jDr3_lcI% zB$%kFU}Msna+w3;!Lk9YT{sn|4C&8RPKfXJ0>l+F;rBWUF&mGF_V7KCxP;9xBuM2o zD9h8B$|PD5X-21pUr1Ue!)g3{B8ZVHCin)+H&J24qMb*O+*B8zWIq4FBYoM z*xGtg65&wIX<_=sj1ATvT5hUM(FXAoi|F54`m$@Iu+pmD^W>~s%bC)euWIxgRcqqafijkBdp{ z3YHf&9a_E0QUnJ;Z3@bGqH*yy-(M4>$SB!x{Vngwhm5+%X)2(FwM+k;c>fp0tv9n>Z)0tOvYX->{ zW^St-RBil2G*K2WBw%t;)wjOQG;0*wEtPz6?ZX#Sh;6 zoR^rUg1^Q&^nn*@lxc;YAsbwhG58Q3^Dj7&Kj@}%vz`i1(o z<8IR;+~%?%gz+h)?#F;8#dNRuXQ@tCq*BN)VHCtoC!Pq__eDHxTK!XPG;pJlQKjS; zXob~+R=-A2DvGnOKf;6ger|uv8D&Q1VE_Axz=J?YC7*z>1){27(J5U& zy}CbOVnSQsl?ifVRV%`If}Z|el7aNI*|)uEF*(v6v%OMNa>2(3>~5d8@GF%qdt**< zlO~A?XJ%9f&GvHy?p=5h`yR#Fq|#`cG*5=pk6CsUJfVmf9`FnMwBIxkAU>Atl+*ON z$d+Uy)G0R)=O{C4h5x=Nai}y>^$Vr&4N%n-Z)pbT0r zAN0-fgh71d=p@+vom6+d{}FvOME_XN(>+3b+be`1Jv%$oTi+aB>u+D=o5aO^ORiur zqKmmviI`GJ6YZ9o`s84j*(K13+{NXi4S-Sl zFH#?WP9;ImX?0xS`=fGyI)DkB;jP+H?|RA2LheJo17{%B&lIpKlF+-g18Uc~p5$0g zR_IBw6V>VI_1$*lIhm_$4o#_bn>zFgTMzu`I=@Oq1fEhqnjk@b@mXyFQ7-!q zr*E7JAFHbh_4?lz5TGltbf1E*h`OZtiocx4`$q4k{VMFX5SGDF1p1X16e0t%&rI8x zbB;!4Nm}jRW+dXN-DkK}6_c2@W8E2fDBpmpUvCwF`Nk4MPHT3>FfQ1Qgiy5`1sYRv z#JktbSk>_1r1p>gMri+q#P%O$q8{JOO|&hZxN7-VuRS%nQBG{tv%Ta@3$nvQ*VzAu<%KpiKtDCpZj*}0UP%f!z2~T)a zaSPQUB;rD?RlL5YtWyW z^6L(3EX*#5yCjU5(r|~IZnnsO^A;~J^(Vg?Iiz9anpt809a3_$QgBh%H3iaCUkU`0SFq9zgEa<;$0=ChFWcsXEO}wwR1AyM2g`j>efX!6D-S(9n6* zaE)+TX$w-FBwHJ^!*rE_GjPeqIQCp!CKWWKNtsUfRg`Dz<9x=zpi~J5oec>qo17PM zjSY|FZqJ)P&R^JkI-GCHKr-AcVRAlvZA$f1ZTTV@eJJx!H)LwIb|)}t@{%f}&>?Hh zWDkI)JBR|s69gGH|MSjR++-M)A;=0S2}}vsC#xB=hhfZb(kEpb8`04nGUWYuGRi(j z=JZh8 zM9Fn#%aydE%*ss1}<)PCU-c;H9vKS}$D3!wWyr~Mxs z*xtsB_nN#Q@#o#z{~bd5_;#9W-mrX)oELX}`5t1sPGfrC(R1W8d-!DB9y&L`%XGaU z57)oP`I2ORx9s~))vjc6U<(O3fN9hDKEZAAq59nxn@<_)m%u$8|)_c}zpoqzgLEV*q?&LX|K%lQHe{Cvmk8OLn|3PGF=k}yRWqG(%+eGsYwqRX~+3Slux?ZL$p@mZ6 zq9xN)iO(o%s-wlq4SC?STgNm4Rk;B`l~+(A_5LCgG(){}RNb-kb#1bs1WGE^0q3HQ z-G&-dzipk9e=DFRS(}8@6K(0*wF$mx9P_qF*5hPo&8nqlonnBytcrGnQz<7Gl4cq# zd`y>R(<5G(dzB;FASLvx_R$vfo9AUZuNrEWlpoefxK(Z~xDe}S?Gg^XY1^vw!vS^7 z*(_%h%#I9UA;WAOGdxKc2xSQ8c~iAy zC@K7=E7V083q2{$r!aaguqpPFk8w-`PZ)K}A5XJO2Ky}?;EUEW>Nbw|)^qMTPm%{V zAa^$7+pw;xi!VE(c+M2fBvJP3JcGy7z^d4Dz?=cJ14aEvG<|LaM;b0%YI1{Sb|-D6 z-C7Hi2u-iaiz#gJSfL;Ca&!^jCTtWYpM9EteV0>Gu5^4*!1Lnd-`lc%^rxNkl79}(F@Xv2zD22 zR*&p6c)_H0+AdS*DfcXPrnxUnGU2p-aKD;grx$UYDphcuSNE<*={GU5G`cxe$*9A@ z?<>;OFEhCs)D{6ImyDVIKtpFFr=Fl9R1W=l6TOS;8orK|f4&r_;5P_o`rVEh?TX!P z*0ko37xSAmPKzX2+#N?Fd=dm~OLV-2q!WQZow5>x*zuVv)-+^^i$4y2zO*|`Uk$b3y+Y66lZ!D^3 zF67ga`5@Us7JkbkA87sdBj+sml}U}%g!9@<5CQpPqFRyVIlE36?P3(s4fRGj!eoeh z5kN|VIyRm9D)z$oTVgN`;0sEc`1X$^=p|+Q>nAi+ACoK3!>?~pX;odcT_TyN7 z!>}WofOa32=<`+Ab95FuE|&cDTV&659(M(PvonO}$nMPfLTK-OJD!UvdhTP_kEMmP zKNjzXdZSU`^FPgiz}JaoJL6xB0|dJIHS|>5_1t4>iT%i2-M*dUD)i>T?-=crA%m^$ zE-4I;%ar&Uy7p3A-<*7>NcA~o#Y$dk@cXo+34dow2q6N9bi zAqQYb=00&!2i~{mU!5(iW0|5@YxgIiY-X}2>`)8;6Y}ciGltO@J32&LQP2#Ue{o1$ z;jf2}Qn&k$6ha^0*@fpw7S#Zoy|Ee!L=JEUsCt)de2e-j1#3wF+wuc#$*yq+if@fm8H zfy+Bq$KRw{PJXSem3cCGohKAg>7nFcK|Vb(7llRd?!DQ47CdrJQSmmgUHt;PSQRVw zWT@k#<1||_B~ibxJXXvpc0rtr{xEF_vBo|Xb<8CXej>wK6&vpmJd6)}2@%5DnAhCw zl%;uF*@lUphFAl2;P1~DRrL-{%2a?CRC;gbl zYySs4hw1a&XGh>mhR$N!ER)9zq?t`npK7qavF@s@WYENekk1#UZXvh zTe*R@#lXY~I#5+XA;ix}jPb9*LYO_Q#M#1c!M}4_+q$Ecnv*45LNQ5kq%B3U2k^Yh z+FBJuQNDY>9mt=*I@9p7mIkN|$E!?35hp8FkN+|dwuyM^wGu#etWGyU8_Yej_ZF(d zOpNrpC5AUyOg8prS{NrMRiDpakyrI>BC@8RA6&PtqiiIlZ`~BLL;hKSe_c8=RKxYm zMzLyiv*2=sPaq%t>H7YH09vI!v!#(xD7njhd_i!sY$I>Q`F*uOGZqT#)48&*n)b4k z!YVS^ih~bsV{EVAgludab@wZ=e07$cD8&1lWB1)`rvv+}&^H{({x+H&a|p$5$bQAMyL?I$J7^D7G7;=zeAj@|)B|R$ zfOzete`IwFiHOWvS1K#rAmY<|F)>>a{M1b0`47Bs%E)kwr7Lss1+!3+G7Stn#;U-b z95S;}Nx4Hsg64-p0YAE8ix;cci8*MJN^H&@CkfKTKVMfOx;wH3RdF2Y`jY6Weh z(v=YcFI`mv_i$kqjt|03CL@eXCc3_}rgxwAF)jG@M}O;}JwRa^4aU)S-)=_6LvO`N3GuX+3f1>^7sBA&3^ovKdeYt&z~GkY z+t<2q$q0t4&@KRl)7Fg-ucT^J+Clb{?}%ezEvx^)GHzkC%Gb~|Yomv(!?TKY9PFdy;iatlHXe#Mj!wMH_ZwpnVi?X98GP z@?0P&CD%l|>T)?@9_)>MZ`&Qq(H;L3$Pr5h_R%;n*-S_7GRXSbkwKk$`OZ@J4Ayd&wqN z54y=_+GE1jhpod%Tosni&vk`O?)U71YaS6;GnRc}CW+w4z7IUR1*J)u)c{^yyEW~C zSYH;8TUwF_8p|s)FsJm%2bT}icFr(16q=6E{{e;z5g0y) zU+jf!yGsIJr#I-~z8GfMGk;Vh`hzm+4l^m1lFY00bY7^x*38LsW@MTW98SVqPoj?F zk?N5BO#dFDm_s8onWr3hr}QTn$+ImG99D| z91KVJTwG6*G>nRis9`frPU8!h6+3UJgDy``IWS1(agN5*X)fIa+6Glm;-vAxo?wycZJ0*om?A$~eqK;+?t$Ojud!jVESz?IW z8EDj~F-E-W7yoWOUtq33%T9l~b)ytumL=qBYQ9Z2U4VtP^C`@n#Nd56Kg%X=^Uh2` z@aBsrXB1h-s->Fw;Z;0f&!qP%70Bb+&#gELZ!V}zxOE;|B>9@VQ+hF}WwvPxun27| zF^c`HTt2Y;!!b(B)1oNz)&6OOYGdsv6V4*bhquCALA|Q1)AdJRBgwyOFa40Bn)_Lb z6O(GZtqzXPiKFa&`yq|jlLN=Tt(ZIKC(@j1BkWHuH~Gc*!F)XxPRzzz@QoL$SlO!p zMRoQ8M&yvqio8S`x5H_yiLHz^x_#9FM&O;|Jmcuc39+gxAF9K*GWgDSF_pL}2N+>e zPlM0Nql~GJNM>9&Mv4+2+r~USCA?LvROEr=KGnj0Onmynz9eeY9zOo&5VwQxn(?YH zm%>Z@r9eNr>|#Mh%eCzdeE+2iv|7;)4iSI9LgYYBO8T{Rn_o)-oZl1E4LmWNE#@=d z=w8c>og4R9j75`wdtYar+JW3Z#{ID)*q7>`dFm*OQ#wL~zk%RxAsX7*Wl7SROEe!P4fWsJ#z9DdYBTS!4J=ta-Vg_qys8)b8*dJ^aLWwuTp z)gcCtxg!Dp5eX%QXtP9XUOy3rD~UemfIy@dTxJoG19FXfkU5-535 zlxKXd&mu>FAIC&ClaV|$E%UUP+jdAjmdq;2$(aU`A&H8EOI%`PuqWgzI?;(T3c>jO zlJ%GB3C;oIa;}8;buE#ixn8eK4?;fIemsD)(aCw+t`_YipMHeYOJAzi0YP2p>|bqA z=gYt;$)(#__~&PTG*-ua0e=$z+p>a)M5N!f&sA5y}R}w`Ro61e8uTrvx4>V03 ziI<27rJ>MLo?Zc)>o&BW0nw4x*3m0UBk?9hCS3$+GVSNLVX(Z01Y5G=^9I>^pDVgo8-fxpA;wwMNi&{DOE(>M2HLlPzi1dv!W*J;n^azs( zqO_F+-qQB7VM*VQrep6#W7Q~*py(M1gGJFY4`zI}hwz*l?G71M?`=;Y=}diYe-@N` z?urkYB${p?i+{Zw1)mj6Y#0Z;0&HcHE-SsT32r3Ji<(JBwlWlvWa#v>Q7qES^hv$d z@XUFSulK3D(k33i$$K`WojIa+~8 z3B;?b2DvfdOy9SAA>YfR?TI44*~b}{py{x8>Mp(w$Lq}(ot#UUi+bD%CHu?jSa7(C z!EIR8xTH>9QDr69T@lfG5kXDn`XJRO&2a})7HskK%Y|I9u;?%Dms+M~tm^DNK{aAE zmc#t7%#{UWtHo3yz9~i69g_~TX20qX$Wrk{l<(^|mrHhIK0YoTmuMMl5^JGehU1aV zLH3?aiGL8o!}fSm3|$%kCX(8vL(>}m?hj5k`2K3^BFJN>7`n0hyQ9UC1ZVuFu{$+ z{ZZd3_u11YJF{thp`YAz3gO<#B3=Fl2`xg=e=VX~Y^i^u=uOOP4mpj3qfR)z>+AUyzh?**;__}p`6nOHSBUgi0{^fd*^_w_}0zgBe0 zUUep%q9EzwzOS9h_qB4^O*GRsyr|VldZ@roDQ%0y zrQyu8yiQ{`C)TDst5Vv)iX`eYkeaE`boNo+;Q=bPHJ{z0>_N(Q>QukE$@vv;)|7|o zPp+pAb#`Yjn~?=kfT#kB)gs&OJMf67b)Pzv){hLl!n*?pp3u0Xe|z9K8W*A*^U?eJ zYzUTLRasB*-GtfuFmnshHZCOc$Kj|(jD3R6cdGR;{>jsjn8S$+9TiiFxno5wO^~M# zqvL&D?y-BVuAGtkmI2XJe&!TB;8pYNX-{6%p}aYIX^!mB-M;r`yJ^n=b|o@k1{=Bo zdw%}V7OVPAw=1@{y0HuU`ur^`y(rWpUJ3LBap(tkIz^WEbU2w*xlftU7Z7Cnq zpMk-oyG?1O*(byY@Pg5u-|^Fs&8h;oi2e3j@4=>Fg6e2{dv$&)0u@i6N;odbf(zX( z9KMw4H;@_CyDj(_i3f6t>*n?qd_46$!Q63{Nh!Ozq#8< z;$H(B=TnX_SISJr`{JHdNU(k3K25j-^|t!B^2Y{vZBX8@^ykctr-Ywg^#;7plPDYyCdE!_2u&(d z=_U#Z*&jmwKSogsNKfR=!A`Uiyh8FR`vxr~yfgCi12AOPGdbObVeiW%q?BJ_v3VRZ zdWNz01y>cU^Jmb%6wQ}E>lXx*mepU?>z%n&yk`1)hnI}SVs5zk;z5UZOq%>;Wzg!Y zp!IUtj#y|qrPXAbu9(~9(J~>E+EHtd@BkYAjEt0ggpai+fidRSCznlcm$zuH>KkPi zo>B1?w7%UVr{xnfCxOw}hyS2^LGlH1X>sMJ#s8@q-Iqn#BcT#1e(e=n#m?9CEv)Lp zA*`dLqlxidv8SEgmF*`^0%I~wiDlugl0mUU6^#bwqYbUXDB%VRTV6{dH(rqh~1xR zg$b%SFwNc&h>K`Hmnj$xbGt&Xzz*BRJQ<7V*08D)uCaDBpr1ApNiF|g!RS|)4XN|# zer(Lgmtf~Xsb262U(mA?eNGi;%s>{=K7q88xP#JlNQTY<%?$&5_uvtLUljl+)?{mza;f;Jf9CDCMF6#6^I7*O!X8s-_6@v*i;jD{02b>&szUOrD?)+iNeA-3F&w&uJ zajm6@G9aZSKXU_S((a~)3an%3b|wbFnMQtHyqUS4v3|5f%y&5_o=w0{)JAOcZ^%GvZjI?%wWFs z(R_pM8*0`Tn)!>&Q3dqaPtY?J8a=KoLaAm*W67dC=}M@Y1An>-_=|qcq~5Zu&Ir*M z+tK}PH*xNTPUDG(5S|rkgxi5e8|YD{%RyxT0{P{^yTJArf+E;AnZc0ifv43IO@S3t z)uTivA+^Y;36%^z;)6(8HIaOyPgzHZAct=;Sz=uTL?sg3ZuJY}Ts}dA(f(`gBL2u! zG+)nzMkX<;kVS4E;nQW!*z=fzpU1WljfZC?Rfm^mviP2C>t(VJP5Uo>Tenz9wJ!=N zOb|`lhJCGxK8(wBeX5J9Bcc^J&wujXc*a8~T;qI^=(5A9g}3=>x?_GO&ajLW6s|Fr zm<#3i02jd=1LC#&Tns2Q~d=gX|^(O8GIq1Fhp6*TEo=Dwl8#r!J zT-5~sbQW^I7<9o?89^#!r|=QvQ|yJ%R1q1O$=pZ}K2?^Q)NqzxHM2Ujt_9w3zh3w5 zxiIlv>7Z4d#Ng1T=0PL5qa65m%x$N}sRka*3R6n{rPx_UV=RSwN_r)fe=ogqv+r0j zBPHDh+kAPZW}q@as}jEg`flgq=Z_?TCm$(=&pH*&O@!B>Av$HPU6FyeD%6{})_wQO zNXH|NIP{ji+bCt1>gYqX5GcsUdh292JLgzHtniOs%c|jORGW~NBzT#xU7XT-_Fk&1 z5AhV~kdA<_)Z>tDX0c{7!(vd^1*Z3e2Q#Ox5=^q$3g&l9#uBcD2IKC-a_OAGltysE z-XuT9J=pSmuj%VLns#~pm%>^{#~$C!@pe^cj+?5~zTO{;JquVB^bQWZ;+9KPYyseA z!5C*twqR8~vfp}Znz6$7V&7D&SeAH%2t)A4yndK5#Y;i0%KIA=;1#NnOR6}g8$ehb z@4=?==CRddf^Hor_0Y`2ar2<5^Ef8f{YoG(eYbGJQFHAbxN``jXQ`3hhds@TIv_Xl zT~KDbx+>wKE#XC*#_D({W|Y8bydUFxlie)?Z6TDHI*#OcTO{lAhpAsrOjcNIO-!pz zTWy?PSNEpoLw`1l;0-O-SsB!Y6tLS~Au)O;Ws2(>8GY-MUp4!=ytZH*2oDj-pR`Xd zE=vfGkidcwqRe>EXQdlup#hb#`PGtf8?|kbd9iHPtc~QBiU0k?{Z&x*?SNTqI@CVE zSJ*fa6=B&W+?!PIcHvd(_DKdj-9+Bq`l%WHaqI8?cQ;V0g{zxQsN(VALgxM%-tFx# zrU->_7|ZrKVmg2TXIUm*bi>Of`~afMVawFuBdQ}j%;Hzn)T{M*B6Hlc@n0vbto_fqTcK;{dpLgpzJP)vm<9E2mx1f1mYp3LZchlsM6v#lkCI{}G!^0qz zKdSd1U=J`e%`rbg$CnsCv*>{nMZk#?F``u8g0j~oV%q(X2|JAL{-W(GuKUV(`97^H z{Q|g#K_2vynci}vGttB0RhqGw+ul@_R*~AzNl_wM0OBcuaUSd!CPw6D4Zey25|!sE z>KMjgQ<5~#Fm!^Ja>z{xh7|bNREcwV5*53poD}#i4;GTEq1;?apC*sd`7#E1WS6mD zc{CRDVR*3_arDc*aId|{te0$1dRQ1IcAbg^+EneV~6?sdk=$vWUF>3#%@%itrY@r1V@ z;#@Bc*f|Chnwu*{EXrs$73F^QCb=dwY#i^T1&kZ>)11?vE*zQGDSpdUBWL)*Y&<8c zne(f4a<%PtB4l4jmX1pvEha`C#(daKk>iZ(n&9MQaw=!9Q4f&_WdXWRrdsekQhuil z<#v@%L^dn6KlsN~5tTLOlYs#b4#T<*qL<@%b!79dR=v{4xhQK?cvI)pjmS+#@Rr+@ z0mxgu@-*`_6)>{LML|3(IPlnqnN|GCt-Ol0{hpd94LX*$TJkh$4;GkhmB z?dC%6v`hP2Su;5k;F_0MD9%Q5xT?X5VD?befSC4iM(}T$laZl6=(nF8)>B1=vUokk zJ4$yAKcTskzugSsJo68S0M4RdPUcqc(}YYj&pAPCPpMM2&Mr;M@?05>8yJI0_{BB* zU`5eIp8e(`hao(^Frg*TSK>c-~X`;FAI07x7<{eY6jw?)Wc< z4S*iTe|aW_F&R(QIV2+ujnQMPBmh}wn#0z%6t(1Ia?G2bIBnaO=jKJVvWRkRxV}PC z(|J%4Op;{C_43+{@&3lKdGp6smZ5Z!95H$=|N63-ikE0ENaycMsBnN+bnVi-hvJZj zmk4Iv5NUj~Jx_H~3OrOPghD=Pc7S)4!TpYyTcByQE%NPbTZB(a>^I3ur;6J z{mTmdDtDiB!TlSeHg-`y;Jx9#KQ;l*X6@*Fk<<}&3)@VGR)bQeT)$~V@8g4~4;FQs z9$bCeqO~SiqavmS_*|)6cmiBw30Rc>UIz4AGz-{%QePwyg-B=jz9NOt_>5;D%F@e> zj%z>pI!fVJE=$&OOj&O}Cb%eOh!euc_Qs<)lRb@VakR=^yL6Eaicjq3n%}P@n)i2U ze$hVGtr)Q&e7ht?TzHb>^4_W4&UpX&q%&0X=BPuNbK-9}5^T5IZq}?s!gQz=(WUEK zH{XI2p5AbzgWp(aRl}hZb8LwY*Ht#!y(&{OVjbQb6Y0-)ZKM>mBlo&TGX-S?1-o z(yuRA_^5a|ckp`Sj-8pKJ4Ge51QGF^Spflyry|YRFScRST%$hBLE*uY`!xHow*QFo zTwu`0U^2|F`ZX!x$Khl^I0}eYFq%+UXWG02GV{%jq)=X6+djN?5pDCi#uJV1MWUrf z$IC*%cbN$4XdaHoDTxniaPOG z0>}r03k0Cq_F zF#m@&1{-X_3h@oxf9n)d_&*?v5m+@%P;pD!B1sXBXEIPiP0h5TbE}G+Di!VN55*+? zw)4EU%=cE6hK3NXk;JIF^Q#1yoRQ{AN77@last6t7HY|_lFP_`4b-t<{j%g7Kgr(m zxx2eI&cS`i$(=x0sLBf&aDd=l`qi7N>>i!pi$oeRPt$F*kEfyW;*b&JXennGO(Kl!<^brmaIm!4i zZ}lZYuHjpe@QIPDi`OH-=lphb>%QdNRnzn9-%{`St0AAN&XFoY_jY0QiMNqnFP3i$ zP3VlkcNP4Of3~!LS-0u7?$nHz3@`%vUp6?%WpN?;+))`Yu)Vuvf32g1$OOtvKlxSV z4a!)4AmPY}kE-|g89Jb8h(yxON|V1`D*bKT5yJA;iEOZJ#?AlmK~zOTZvdR(@tqgg zDyV?_s$2c`*DB^n{+M+N1i+EcYYWaq*;xM-4I_EUeWAv)qlF?9y7u%AW3ei{`P1FOuO7G4<~)E`kOcRW;(dk!HUsl| z`X92P^L)Rx%K7g3t9LZc;Jd;Ri#Vo10Q(-Z-x6~~F6g-hvB;ySL7leEF!8kq5xaR0 zFgrJ9hsVK#OC|B!^qR4VwLjnkV*v8nT$ux}DH!I{HoxdMZT3DE#`cxhXw(tYul5-eCz*#ltgHd-pS=qRFn ztb|s?Y715jIC3HG^6w>*YxsstQU_p%`$1t*PIxL1%l`O`^JgCt4dGe0Ze{5k`5Y^D zaE3=qhMku)6&)jO$8CBt=`K2C;830To;^GhATor#~I5Q8nUzh1v}7%3fb+fA;~Bw|}P^ zBt|dRzTmQ}FFv$QJ=VTOLT1L*u014f^ zKr`uD*-_r3qIsQ`!v04e?o_2bGWQZgGezASR~558sJe=V2+E+LJ;cZrPrSP^XLKXJ zhjy*AHhr1#8M&E9CqI5~J%%nLBqv}$rKhq9lUe+U_w`Nv!ZE$#LuRt(6Vb|&t9#ib z36MzA7kDF{RQB{+u+M|KZIa;jsRp~$dY`tu(Nw`~`t+X=rN>*4rrA=g<3lZs_VnQ4 zVzK1ef9Xe@>-z|aGLv3?i7N919m9lsj!mKIVTvzz*`nw5`?*>GF2#(?$j4K@0m6>R zVa{}yDUI_RqDTGAVznpHoN83F_Lv_N7KxmGV&>benI*V=icng5l!7RJOge=4>cXMI zO>#@H%DEzO@8y3%@ny18kXs~w(tfSlzg%vPWs9{qnFtsUi1ZRwkB(9E7Dy_p$5 z1&=nLs;i&XmyOe>gz-}rsj^>Kr7kWBe)Lwm2pkd5B6f-Byq5QqxB{w#U8kOoBZZ+$ z^3Sj-CIjyDSu!<9GRHm^A2_}!55ZxI&b)A3d^5CyAZ^5y6EvlJ%zr6iOsOujK}*JH z*FpM0?%LwZlGKfT=%D-4n1Mg{x8bV|S8x%^cpeQm@YddhJ`FS(51S$`O`0|B#B04> zDNkVlU**khCMEAn&M~i!q}dP%A;YUhLB48=$IYDBrmF*EW(l7@s9NmnEFH1%4*yAMsLPXo-FGAW zXpGPnhJG^e3mHc@au+L%Wh?xXVOZAp%=*ay?sKelc5UhDWg!9=@h=4`;g*YNU{+Yn z>45T%mh>Q75K4z$6ul%UUHZJ8xfA7Mg2Y2vs7i4E6Pq_)pdETk$OuLUGCr--pZ~hU zTtH-n#sTE8JxQE}9P%Si;qjb%p@tvVz>y@w8hCm*F6q|qPB}>;k^GzWxeTw8@bLV} zQ0Cj!0UvFB>5A54Mr-o^rF(R$=aUVLPs_(V@UAtA? z$@%U!x5xU&K&kfEF6kD~1Nm_3d=1|IrlxLFHNac@#)55L!}8xka;F*bL< zp-;BCW}pcp(NEIwCAIL%m0-G*`KYmhhX=xmLk3hy8)SitoT$NG9C~ZYL%`F-?-CMU zMWh&bGf7kme!&fSIIl$TG8F&sF-(bh)0Aj6NU4wNn)V?B$5%?!i7JOF|0#-b=ZJYL zTHF{q)&5q2TOu9M=^C}pWxC$Bt!sPrbk@=sznhl%7PH=-71gP#-9Lz8>*Ej4-Y5?a zdQu6WWknWyfcg=9S*e$6*fr^4MnEru%H~j3dVfqt?v0P%ow+eap2C6g4>) zpu}IKDsd=Xc_@c8#e-5BJ)N9DD|0#TkQzsE#}YG>YIOfLr^O8u_>M6`p@6OEP$H>t z%^37+*I+!QGU4bT-JzmZPno(DtxznttmW8gDgq348R-#Hy6z!;?yiQW7gGpa_y zfI)RqHExzqo8rEi^gVv0&%~|VT&J7EpnLBi^-~cch@5)r_Ap--B{Lq+ZGhU*x?EK77!2x z5_Pp)Y72TO$(@MjXDK8gKK;{O8dv3R`1fCS_cTFu&Vh+oPV4;JiGgJ|E9V zNOIGksvHrf^tS5|w1v3br>@=3nL750m) z!B232s>phjPYN#er}ey99d#$I=?cves;U02t-eN4BzGr7bH){QEE%A7^Z@QqKyZK? zC?**2ChhjhB{=!No!rU~Z5&y=zK+Tgi>`~E{{H7Xk-lu|*ZJ6gYwP=%Pu>7Wram&? zfq4Ar4H$BxI{!jVFPqB`^ew&icq>v18lS_njseN3nbzCPvs|AC-3qW3`9_iJwZc|f z_iAVB0=Om+xE(7o#IN_}-#B|dTFj~hRwJ)_;~+Eyebk?Ok+~;?RcR~SXd^CkwMb1y zVQbp~8t0z*jjWDPk?~aA>t001h?R;1z<@omr)EZ(wYJx;QYoKC^kjR2JE2bLsZ0;yQ~fVcIFexMBhP~sZSKFlQL-1m&vAZ?JMVkp31e6X<` z!rOlViWK0qiQTA-j^_G;A^EIRu6!i~O0oZ1@K0g?zU={b08b79J_i7%{{W*xPT2Uk z17D$9MxEvG>zTk75t_li@p+J^e*DWP0j_6VEWDdT;|XF8J0yO|V{ghHx+Q|eVsNFn zOG9lLFGjq23S2KFJ?^!%_YvA+7lXLOo=oPqgSfO0>2l6boYZg|w~_=(uu24ER zY}(+vY9ijzOmh}5KSeI(bF5`A;%}1VE?pD-Eb+?xk7Ve(@_0YfaN8%S z)mkn-ZZ|<~8$}{G9bgSg#tX5jOp)`sYcGyE=f?W%M$1I-$V&r&r*`#_Cui$^$A?-Vx z2ho1?mAvH?>5^{zBc1xZrJCzeZ;m6dtWgQle=(>z>>njOdGZ&B-uzWWN7z4D^v^}W zGj2xL%|CbUgi)!9^W~fW&OQX%Tv{v-@wJNjo;14o4e0g5b_g1OEEa?@sNdThNSvn` zt%i{yMxleYRQJmfgh>*>D}Ow3q-wMr1xzSDTM!M@KRB>>S3M`ISDb#{MCd}k=|8%zYu@bY0@FVMO8uXCX-YX@RNwqK)7gnWj(zB3 z5deUOhz5;byT&6VK0N-~tIOJlXd;L3Wxf)#qw{=hJr9sZIFGvINt&X%e7T}%Fl%>hxF*!fH@0*NM;;+Y>7xfb@x~{8b*b5k7b~%(|XUhlm z0bEeT@b~?B8#T#$0P`KDcum_njDt>w2HP@F)}col)BKCPHeOrv%g$VkY=Y z&oJH^JNh*tC$Ms0oL2iOMac2Rag~FyzY<3snLT;ZfSbupxTKWl_Y|J>WG>;M$htij z6|P#*$?BZrG;iO906rD~{^9HRV6T+@>w|B3n=i^|;pOLwV5ac~26TcCx*ZolS%|-I zBpOel9K9&COY(6het1`>38}rxj|=W8ITf-Hetibjc9wSbC`uqaiIALOSr9?%K_C38 zSG6i8yedib$b3uT9Ac~3VN{PT<))VJJ;QfX1B3*``2Tr;y~M=y(NvD0_<;C`k#vjgjUbArSE~n?mt)7FL7+aVG;hlvDImb zu2VIPHagkXYfTk)gnUYG6$wH_t2~Ay^s0|qb5*F*A5h>m!TZhb zQ?=AqX=!B~a-$X0z%O4snWoA+5VmUp)yM^$1dnj3L}%^>blaJ1f0!6Rju7FZUF!+w zcL%6-qqM2ah?`V0vd;DK&hGY+xRmc2(;WITGiilhp3=>K$EQ^vzU~cWiMT-R`+<@6 zQo6PZ!h=SJJyXvU5nEzCUiXvQ-iCe<&}Ag!Q%B556RHx?SJjcWt;TT!_;kZfgr#r` zbP0OCQ>w&ZiXvko5L%|Vk^(-*B{dBL5GMT_o)XJLS0Gd{^Slu8=cS=1Pq-P}oO8YXONEtB6CgaIYt) zWdDw27!VdvH-=ibD@?qewUUW#`TX*o$yK!X8fZ*qfk1=kPsh_~2q%$W3qVdLFMmvE z%_Sn1ta)=-ep@Yrd8k%=PuQ>*4aNQhfJ@kY=F;`uXCRw_5xCslzhp>0)c`g4Kky6Q zUC9Zq(U{=xbNMytWcdqANi_DNKlp;l0KmMZuV{E za}Led@TYoD9QfHhMW&FA`EDK?~RfafAitie@(PN|W*Z#CRd`m%h0(6r^~+A!Hbr?|TNj8H8@*~jnH7%-`mhUNW+gr;?0z}jGZ&Rq?IY0-f)4hx zz5$<%^OLpyq`W*5BVQYUDJ@VUQ~6(m?RgQspghc4eHm3}Y$?m1`&IVY*+c{#%`r7r z~0aK`bXIU;igSj!!G`BT6>-Fr#lW2L| z3qgYF)edulWlsYb8?d-sQgA?fPLNK<^QJQ~$1OuM)zxkk>cuHk=0oUa`o_y7Lr z`WipSW;PtedOK!Cq3~Ri@_pjC{GUEXH%(rlQ zF)A};;-~b-gi*emH~1!^CtjN;C-a3)8!Dz3n^&o!N z`_q0uVdvN^V$F4Te7qZNC-M&|Xl725arXs-KaNu5F);clBdXJgStK&B{fU`5$Kc4~Y_;4x1C z`N$s_!2s98SRXaQ0W5JZ4&@nIqt^yVX)~5b;h~24|6Hb#=coT=*0}SGUq_k-s#M%q zLVzh$YAg+eP`TVd%;vm-4_uI^rVs6I%ME>hvENJkSaU&K{KLG{9%|FlsO@4IWk}QE*T@k$KMGI{U-8 z9bbi9*7}ZDd)2dq-LKDVfbJ~;(7MQf%%z%!#zK_w8I6UBjWEk&K*E+T00%_E3d05> ztzCdYp*dvy{5?6$K#?lH|*2C zUt(!#6o;M!X`^jjvUxf0vvHPyJKf}HLGBqfRTFd1z{AW}Udy%sS=u#i=zMfd?iifJ zsP26;e_`S)4CmFtC%KTgECyJfL^;0VP+w{tWZ`?v!jpVBZ;gPY=o`5I<^7*^py}gC zbBDE5zX(=Eune^Kkh2{{d}~@+?H0d_`R3~lnAD~{^AU|r1k&`VcP7HVYs^o6qzO3Q15_)c zN+#gzpu3ZfU0i3=-;cF`{94Q>F0wB))ONCAFOTh$lxWAG5d=NJ)D-r=Uc5&C%jcjm zJGzbrAt}c;*b4PpxN*5i@zXL%!@$yhWZ|^_O+e1KCz5sot4KQ<CkI!tc;x_ z4S5yh*?z7WkDKWrPfrFErHE@}Mzv2WbgbE1w`ahavYshy!Z8R zoZ(&3xuW*jXpZK+0so{Ye;Q6+RD@m@mI16QK>sS}1je-n_bXbjtZ-6ik49aH8P_@h z6!292EH344OJ(i;8Z*I)<_OAbYJv`;UV)g4$9{n_RLPz5Y&1Q**j?<2*O(g8$yBL* zubbNU+M1d^1o_dT(~BmOOZdMno4h#QYP~O<1xUv;dAZjFkKXt-HaegBI05rc#+&*4 z%n_+DM^2>2zuN#{er@^;JigRMmef<03~$+Km0*q?>vC-qHsH${OUa?UI+z3cug*gJ zZkCeI3rB(})Om0G=`uc0dWHb&~L{{o|I58r;Iu=s5nN} z6x9E)<<4A*sjX15uIEp#%h${Ou?;@Lzv`pyuh#Yv4BwnFHI(TUreAxE;VJy3LEDDGv;n5_8R&oU~T!SCl9k zIXV8HpLex@ZA-vS)lV7Dt^->G3v(671r`^q=Ry?=O=#!{s(oHZc}U)mk$^sj0^E23 zj6jJBitDFq)Z#NZIiA<8JXwLz1o{mHo;c0`e0z)E;-`oug^2iF^DS7GEs(OT;1bD1 z8EHrWeeY&F3K;X8TA}WKbyi&tmZpjPW)Iu;s(w=Ag#OHt@LKNf_?dHy3jF~rZTD9^ z?V8Xr3aSPzP&cw?F6qm&V5KF^0|o2LKJGMW5WRy6gPjypUFgP87N=IA>vZD)6_F$B zl^^-u5#}9G#CWp$MfSNe#nHQIG_v&j z{H+wUK|-J|HTj5S3JWV56&g}`UfM5v6C@y(QWD1>B7J)J<%abOdidH!fL8#PO#TIZ z0nvZIl7Pz-eOUB=GK&Gg-3oyLt$0W)fKWggs2s@rw@MI1hY|$n0YLf?GOC@p45g_9 z-Cnk|MEX*jMNMS82IflA7qNFMKpo&9z4GydWxT}UuMIH3BLLeDNZ46Bv<00f=Z=$# zVo0ghh3@s1I;ErB9`+%KlS}+0V!z~sVF5mDn(J&rU81}8PlS!TNb7RwI%pzQV>x*I z1ByJi-#g9iG#sC%q4}tJ5yu;;>3-ZbmS1|3NIBTL^j$$H=$;=_9T%$IHGh6^-xZiF zpK$8zS=kpE0D4NTXnAO0b*nAXW4gvVDi8gJ+g}ZvKDF|1bX==u_W9<<6U?|?UX~3G zz$wL!FEfX$=wrNlZWG}_nB(eb8?6*o z{=uq2PW!~^d-mlt^Mdwxsk_L`@H;yxnWffH2$@j4v(LqW*kSW&T3n#Aar%<%41qM# z{=(0NfVS5&-pnuzwvk2Z0uQa|*6R%}`-+EQry}L(Wn+=?KxNI2sz}9rVJ7|6#POn& z4dwQm7O@rlUzLFQ`t($A2jTC{HMn+15lc`=XtvJYsL?af)6&qhwCAGpQ^75L{gt*3 zBFWXV#r?LRNeWWG;&r8QnF|CH*ionII*>=!cMK+p9*=BQCx#u6H@zSEuud-Uj&Ip& zgx%nKWq%-<8mWTfkr+BgKJU&A*dD}9&Hg|+^ZVV5?3~o=%E2NdfU2Ic7Z8iY61RW) zwi`nngdljtEg6?xGX>ODCN6)2&^*PLy4HZTPoQ1uiwJFFyDyXP^o(k|7K7duEh;JO3a-!* zQg?d@^ztASDA3G<$fE^xnng?<85gs-PRc09z%TLgohPN_ezzRFVj4Gos~^XN0Svld zlwRe1vf((ZGIMz~B2y_b|NY`vC}X?cRAS>S8+uFZ)K&Hgkeu?i)C_J-NPsdG9nJvM`oFZ=^>8$Uj0+JLfq66syTqK1j5CR%oizf*L!LMbd)1(uQlCaHUrt}M22|j65a}G*a z(UAvwKn7)+&kv~0^ltZ5J~;saImYf=KK^LNPZ$|!82;g)5;dgi;{iTX z^DmzXB;YS|0c*sUm$u33V^RDc9m)S}g6S=xfKOpH_-6afkPkn~HtcWQ@vvo?;HgBr zs86%qAC9L{d(=LMYD-_7jTWXniwV=gXS&kpxD*K@-*}(Fglw9Ja%ZRx`%&Mu{P_JH zl%&!gj3D^bdYAi9WxgD!aU2Sa`WNEAKhj$ce!17<`AXN976>~pQQ!C;_4A9P=sq`> zr~iGQ&<*saeM~)EsQy+9GyZ2SM+%2Jd=s_!7{ahc^ zsS@>&tCET?(ixzj99bn}X+dwcXY-GbMR{9S@)ymWj~OpjL(z7i(;;Ag7p37oXGg51 zbL0T2X3^XM1r_hhaZuItx4_y!t|@HGXOltS;Oqw6y=J4kS!n*RbPiDhIGd+D&zQ_q zX@X+_CYWGH$l+$x*r3Yt&vNUwy?Eo!$AqnR@yT{U;gagm4@^0E41`L3g?G*2K+%8( z%VD~anBclo`;?aC2xyUa(KHW1rv*zvyp1$L8eQB`EX=f~^id)V9uZcewWZ({X8w5+zebT>%_1*d zP77G2dF1clD8OVEKHG18wQm-YQd@&l300Y#PVdrIgi2BbYois3;sLB0EG7>%L{x8| z#TGwAL6Oov7TF$$J1tMO76qJ@HV$?%(#MRhcH;5c;}miPiwNlg7?fwkchfaugkaIX(vbD;&m%R*PJ$; zV+vOk6vi=FhG+CK_-B(p^M;$#XA;D){OKy>1dJ9#DFXiKxt*#kHc*+9e%>q+RN(T} zyR>x`EJ#^GuWs9KdQI>Wm4Yl0&)l{16vaUp`Javsx)6N@(EtCKj>iw=4(ux`2?G%_ zreVr?EcZzQ1PA*>DxUf2oE^!X4{GaWH|O=)wizqYwA|m|4u~8;giKlM1{Ds_?`lZ-z;hM@~%xIYOy%tA7^8Q$A}vW9eVu8uWO3wS6mH2NbU# zN{4D~!CY8!eXN1QN(FaAHeNq>Kl|tRWCCpj(?+yf1n=Em_3w?N#E-C(U4B-SH3CIK z_RJ__@{?GViyMIg%)7?BVB;5KwO8}N2G|FW3b=PIKaM@CFIRn8y4sJ3oRiHkqZCLZ zY0;=h_qk)Z1J{J>kYsH28Prrd<5pA|zP#223jA2cw}qjQbe(FKiwnv^;@-rByJn{U zhqbqki>eLRg=rW;VrXd?8l|KWaL7SYKtNHt1f&rJ$swdWq(eYJ=@RKiq(mucB&56H zJfrW9v-jEG-rxD1|Atv>9@cu|&g;JJYQG)Yhg&=^%pjpqW1U)-#oS` zwg&Hk`jQakp29)kl=A+PvwlNw`>uB_jdp7k?Mbc{7MoExPe{a&^#i=<4)W(b`ZWtN z-Qr0JoBdr4r2TJx=H0Yov#Yc0>zY+JV0Zv$By=hA*P@?z2AS7W)bzhke|$t%9daKQ zh+ZLtQzq156e>JSDCuIN?8CO2gk+@O+3LxF#Vmo18DfOCOu=wJeF@@lM|Y(npU**I z5$>&&hIAb|qTzWb22FsB{3+)+16QW0-FWS*73N?|;9}UR6g`*^q42P?{ zhFkx5dB&O@nM)}H&tVvm>+n_X;r)EMb>0cI+Y+~tphbOEJmjeE&-T2ET;Ilm1y1MGEe*(}zmV+^io>6IhuA#PnFk=aKLGIU> zAu73Q`4gm=H|5MV-LZJx_RPYzolRGQ-ve$4yX&!E8$G18U(+`8@<8s~ntb-Qx2H~L z!MhE*ezcxlqeZr<&zdpTrJbd$9W65{q&G$m5H&JLX(F9fDSZv z<%p__N^KuERoL$8HI0i_pttwSsSjPLSR=7RAZzb^zBNgdv~7KNj(aJm5E^SK|7-Ul zF}?%vXL^fC%($xLdpIA@VHV|Z-@%U|=mB{?VjrIXC#hKvJW9A|Zf>*;4xalErsS4K z*3_xuff2W=+KL>N_R~=wSakj#)`O(WMV6?i4<8-XCJB8!dF36e^Z=gTZ66qV$Lll< zS0Sk*miSG8L=$q3gr-eqSWT4Nh76Jw=LAo6$e| z1YTvm3y_ALXbwpAr92_ikp+I?kER1BDxe)la|NkS9GH(+$G;|h{>1g;4Q)aIh4~F4 zLPtfo+j6#=sC@Egd~~e_I_+}KaW!$~ba}JLCMCSp2D4xogTqv|X+AU9oZj;vUgA=7 z`&Y03py4LDXrvHNwOk;@caY4^Hw34IWNg}4%qIo~kPKG$pI>Fueng(;$_&ttjlS=fLN9^`&@tf`(M??=iSC z$PN7eJ!Pw0KQe^tOEuZ- z1`3A4W#uGWDIL+G{bHaw>(M=MQhfw&2pr^G!2nB+AMZYkcWe0Z%*1wrv0q*l6&(z3Ged} zT(xl7s&#kTz4A<0FYfk3^Nad4_Q+VXGw7|_<)|T|6Zwfb`zAwtqJ#a5@aEQor8NdB z7NwIdED8JxA~H?1Bc2lZ004bd{2&R%A2-&cC?3aHXs|qbC+x}1 zT;p%+R?%hM>S_L*j{@jF9syih>*&nw7JS|#y31ZYt&ps&7c8c%aB|kslPL8!$RFDh z0;lV*G=?`B`s;_{Lb7h$U`bgi*NWAMbLU-EzA(ER$Tsg6_6H;CtRKs)e!F8q*I8VANhy#w~k+AkMvWG=RMxAv* z$>QC`Q8Hf))Ts>6Kk{|TYBKp2%h9Y0?p!i0ko*airMgw2>>yrmElI=I&L=y&S`1!| zp8Y|M2R{$`y4CVtW92?o@i5q$^^w8C3^4Zcev)S5&hT0u*4bjR-pAfJTsMt(FFBOd zx!k&#IJPVJmr053k%MiW3Q|qZgC!-*jxU0 zb_~xBock0uE?9!-aCWn>V~7ioRx0^v*xq-@$`&uN6FbRUf;9MeFnWZ4ia&uHaLWl$ zis^l_?F5j2&Z+wKiY{FmT_`yIit1@^fhdnF_$qrn_Z3shnVAmKs~ML2jhkuL7ca;u zxj~eL$f^$_Pk$_c-%f=YpccIgC!sgx`^8mmReC$Qnn!M~&vGsnhfjDr^}Eki^Ds4o zq%xiblh1t}ZSt(shJs!$DCk~p9rA<9C>IcQ0ipIhZ?i(i?)WzLcFZ7WkGC(&!mQAGk! zbd)vf^o#^EKg4mF+-Kn3CTD1D`^OtC zk0-b(ZfLhRkjil3Cdn89YJ?W2-aEjaT7CMuWp`W&l}n&}^4- z63 zsxpb?u`;c$Ed6E>v2};!pO!E;!wx_RZA=Jb#-@#1n|I^a^ZYhUk1`&vCH>k$rH7IT zDNeHo99K@5VVJmtTU@-epUpuH9_u>uw%T}Ex%+u!MdSHVN=O|*lyBAjS|Ba<_WE=| z4&`#fSl~;+B`$M{3|=yY`{fuy-=3`KYYar+F@2=^1hd`!UY57}#zUgCy{zru-x^3a z6g7skLVl!>6t{9N|8f#M4lknAqt+jEnMoh|Yq!SjPrwC~xbY{TTp4?U1&JL3e6Eq_ zMfciS24}D%z;e6i{J@_s^&*$_+9`DOXfcfsj->5N4lR^}yFH#WmJ84#3AYPtJ<@ln zV&^9#vg3I`(cQy?mO7Z=*ZR&`S9^0B^2cJGuOXXBk4{AX9xW9O#H5Tm5h+mSAd2fV z&EsQaTJ?)E3rmARi+`z5%R-FZq#%~k)qU2k*8Pf**TTz*)(;4XrTm2i_#W*TZt3% z$o0N(CQiNvK6X13S{8CO99a2jU%uCua1x{qoAcuP#SZ~ah{;|2l;>qI6-TdqRfy!m zuZ_s=#?`(=;&c@Wg7(qWK(l9x5fjz~Y9nX7-k_=|Re(=*hts`b)~P2y%~5Cv03`SO zDXmHKH+U%(ea`+o;7@9%2iFPQi;9P$j^Huw%PUKvfSK3ceIK7RyXVGVBHL&aRLo3pgVT}hv1p#N^5!$9l=g5|rIUk8143yMc4wO7*BkD(UTp-6K zqF-nr4W&qZ$!`0Pjk?w-(JDn~LdVeLaD9at$u1GUIK$iIbN=DaKV32(<&nF$v&MJ> zhn}oeEQXQ_IByBW414q1ZE~(2Vb5MaqZe8h{C9fMWp(IfvWfSUzEDl1m-V=#h2H>$ zc}Plh^atXY=(NwBNyH3G-mhB>mrf;vevR)t>$K#nruxiw0l@jo+IKsh+f^_#{5MAf zPaF8?4qAsmb)iazIGxt`jxUF@Z~JpiO%B-7y_j4aG^tW$JEI%Tae=lv9fNRk@<%E& zChwcK)ykp*^q@KP!nQn#*0uD!Ls4i@c^(|CaRZnwZxsE#$-OO4I!guWhmcc39YU1% zSyIi?*209WT2H(y^WiI0v&Er~yj*4P@J=~6*~M*amJ z@eum(Q98g$fRJ2!NfA=b=eoX}tThPyrScTs*_oPn+tAVJFiO4Dv!#w~!as9cO%#P9 zF%E^^k}_E;i;|N1r8!NZ#S3^4NJIxp$X4(tDiIWOd23XfH(6 zS6{UBGOPFl_4r;|Nk2yr&w~o;TU9j1i)lF2e`9Fmp3mlh9vq;@>T^jBMLzoQ?4H?b zFrS)zsi*=Gttj7fmw3|K^sNI8qVT;tG2bAMdi5#~*Z&s}( z5bMT9$XdIlw#x11Lp@#s)bOSI^TYnky|>cR+ZgX2zSn+4IelMjc6Eag^@l~=R#uw5 zi(4@G%vFhasWBiT-XIG;Crso?aIDazPiKSAeYPWX@%s@2TN+#m%I3mrgng$9mM_hM zuXp+-ge>UK3fRviu4G8KPscJ7Oz!!N9+MU*gE201{tgktbq&aNsPbC@+iZds>qUcz zrC`@CZi>(OjEQC7_0_3y52A*hkmLg3+_JIF1pfTk?o)tM)9?h{`&h)P&rv3lGd4mC ze?h=sXCRs0fw@53n!FPxGH*C3>DL2D)W156MYWl4@p0X5!!mlN}}}Fo!?sw7SPN6etOlkH~I-;0y2yz zvr}6DD+f62E(Z+_m$YMeKc9@G2wFZn-=~Q*e6P)>{&$X9bWAwn9ph>)&^np-u@oPk zz3VZKpWyxx(yO%6tk{E43t}YcmFy6Xao_k17r+!#BfdG=T$8=ZMZBs)&O zgeif2!=rUcyR|)?v+9_<=X+Ug7>y0Pb+m-xvT`udy}e`+a{fz#GoujqcxChNtAE!m zPnpn7;Kd&BE+WffqeWv!5}AX0PTJoIV#V$BK<&g+FmnZ+Xq?a%SbN3z;g&ZWjX5UK zHG4Bzb4L)+@PnDR=mnM51N1u|6)xyjDOt%6x2Dv;MLk?&`Ma+owR=g1=tab=OjeJ@ z({sX8>#)!pb#G^pT1&*N*cL2FPa&LG_2s7!kk83wy5p(HG}WEhYxLO9HgTN6-2Job zCU(3R1A%0fk+!;{22_@~XAkmnUg8our76D?p!?V5HT`tYE5PS?+4hQu%|*e1!rTZu z28R#7^zq3#xuhlwf}pOjttad;v25jQ9X}5-y-J~~{vSvsa;kM|w03v(XtvfDh zv^XZO=c3LkY2LguQoYixy>Hu^-N;iCzJWVFKtJb(C?iJK6MwQuc<{`EGocUd|8x#G z62OC{y5Rou%B_@$SAO>}MfIPj1fSpcv;CLHt@jq?Xi2U%PKqVj4SDyuRS_m32xowr zvlTa4C|}F4J^VTJAx`@8&?62qW8d6aTa=2MvxkG{t7fdxR1-V5)kOt)Wd` zpq74%|92b;TeyKD@I{4i;Ip#1RxB{SM)p$j*+0(ho*+)DbJ;i)+vtyv0dL$CA?zIBM`7zWE2jr zfoCgWYF-~})i|$sZWHJ^aGm={OmV-`-F1#;#cVqsE@f_ZtQSmUj4s8m-3<`ru=4c~eUmw3_ z4pml#_xTR1!q1%3;3RA^l{vFFAT(m#d2CGPE#T&CJi)sVPFXco_zn5wZ17{JKR*tS zkJE@Nw%6baXe<6`50HH(avSS^*U9$}jqQ;mirQf?g5xj$q~(NjRTAnQsScI@t1$_{ zlSF?T`-6i7JBlm9y9n#gSKBZ%oJ9{1`90ssVeFL ztKo6c0?lBPWEVcNf)-VRf^3H$Y4raz!v!(dbhxQd|goLq$; z1CZg#BwCZU_o)R?lTt+f7CC@`Gmb!n!x4Di;}2Qo2%L#*VXy*h^JLUiq8{quvIyAm zWZy&Y#tqH42S?G0Ie|pLVs})gsN;e*Rsjni$qMQ%jKB*%gS<6vf!R2)T1G(!Rs@jZeZ>o0;fd`b=^1!EME_5BL2_I_h+gF-@vLGCaRUq zDXa)Z<+=Xl$C$FtEu0ViPy?(X;9u@V^S8y5-!RO^O>TjOYG4c=Opb*>tcQ20Fe0UBwtT+9uy1q0xk0&AmPc`GZT z#BWx@s0G7$T*5WXs9yO(RC1KC!6e+z=16gQZdxG#xmjP)n~*emeA$H@mM_jsX`Bb; zHgn%9MIt%Q`m{O75|mcZ@I`05R~l<)Uk{SS`Xb2Q%YX^xAY+YFvs1Cyps+(ogZi^+ zSBKq?0s9$Gv?qEm$s1&Ob%9-`7KVLF68w}v1Ol6N}sG;d(+sS2jhlwlc1(kUlsoJlS}>YPqS@xW!`a*?J_BM+C9PUr< zr7KDEY5d&TjHx~+)LqI*VQv2bDiy4z7M+E2$KCdV9OVs@Qx-Aw(GhrB?A=B(Ns`8v zgeNi4$&!5dMO4=SdRo{?Cj6Y5r`o>|KS!}>TuK*BSW-_`7%$f(1CN+T4T2^XR?_T_ zHj((lZo50)2H$;*OCjn?J^{4 z5E(uTe!(Y3Udlbsp_@8_yy6kst*T1w$tv9^z6nW(D}6&aWUCG&oK?Ix3+`uN%CL08zv`pu%{4-(CSPCb1eL@%+{MQnQYHz;zTh{Bh%-c`Y` zB~1Xv+`8TR$5}u1E16!s5En_l)%ywQ{Tkmt*?Cgo$&iN{Ag84;_3)Ln2=(!MUODNP z&BwpvV@o-F^CuQrECL6x;X0ajb( z=1}>V?#2@O1%SGOP6Yy$o!B_$;myKgZc~d==*~6iI-|ArbLX^{(#*vzpPgZEpI7Pac)JBxm_t$d;=(E}T!jNL znC;$NB>=zn{A5w#grrnUI4e|;bQyZ$DUjz=t+UGeQT3(Uww8$oNENNhNemDZMUB3C z(iJ*EFXyCc6e68|n9ZP7l0Zkx92$!#5M~o}Hf`IHH{z4Y-$Dq`pJ_%nlANZFa1TEtD*UMX_ph; zzt#yECRN}=c~@9=*Vwd>H(jTS@bmM!IFK%w)jAKQ5e=J$Yn$*S{tVE`+k`O%Q{`*Y z*bFJ+m*c$Fk4|?o@vs$t1JX7y*pF1b%M*yz0P-hKq%Wa1>%vwS!AHlnO$E2Z9Ic`{8M|z#XTLtyz48s>qS!2_ z7fx4;&58?pIfT1;v=&p3HV#FYJkwe^6&oOYVEwv-x78|<-Z$f)bC}W#lMClQTNr-7 zPXG4PonB93veTfuL}fC@zelaRLj6wAEmjdINoSV+fVX*Vd5X56o#w@-dhd3&NI}b< zVhV{&od~su1QLIDYKl6rFuZ^kGs*xU>1bqpU*TUd4RpV@$bVK;Kr6b+67jXpwZ5ND z4R-&l+fecWsAbLRAxssNDmD2#p+ILB(Ev?`GPP9x>N$2uitKm)D(k)*fu;ZZ%~}Y! zvblmaVVxvO%ZIG3P5{9RhHn|7b?`uGcH(ctmEdS0U`)Vjq5}#yC>d0R>@MP!d5pBDD~Gtpaum2c{<~^9C%Ezj2pn5l|5=y-~&3LEe2_Olbwfa zKUgdi`AKSO|19-|U?AR{2Z-+&8Qn-#3uI<=Un)Px{p=xy*Ioy`j~cFj6L!~Yi7Jm; z1+X6s)j?UA2Y#OJodO>Ap63UQBfCm%&J>|VptXoGqwl8ku-iF-(QOXZ z*6j`sCrrTAv1L7WUz}1``ta7>=N>Qbg`YAKkj=-VVVP10Rt7r2vI!i4JUY%imlt(E z(PU6L-K95=PH9Jkn2OjTBx~rnAqW^jIeJZy{ziQnSuX`v`vN6jn?h| zjxtH{MW&sm>~24{<(jbVBgw*JFH#Z1+2e;yP~L?(p*G2awGtwfI-iHH!<%aw?$`dj9 zfHRXjwSw_xc_Fz`$}-bQvFJoi3*s0mHTd+ zd>G)xw6l1`;Y9e&q8~$*34-K>Jl#J(vNL4(an*>JYrG8pxo7w^9nJiT4-aA0)`94C z=x5LL7Tw5gl?{ruun1(X_1(}Yevu2xRE(%}nUO4zr|yVL>CgKUPf107UiVf!%e5?- zsXA=&!_9v=087$q#z81@JC|;eFTxT7$$3ym~92Eh<5>jGwUu*AEbtT|2DZxK{Iu5ov ze=Xn)y6)un3R>b2(u&%S^Px(0w`UsFo21LBDJN1HCjo<*#Sd@9mecPk0>V@`uQs5jv9;oI0@-Gfwb z?Guun&&P}9mn(}RLa4-TAbT1g8t9#G?LKVU#T?H(-A&gcZYIy`$HGiNKH9jV@A~q< z&Bahp++fld)19y>4<>S~~=!)TnO&`Ua965%H*e(AIl6O5jmi`$)Y2b#+T&4i0aFxSCm3L{l`EoSm(L`7dr|c#TFHSD{0+&c4jS zvQfZNqL|L}sJEX4EdghYM{8sNsI%*Gg^B_k3xbV_;8F=9oC4oKVktep?;D5Q;HF|K z-ax`82d9{4s!JVi6qhy{-yq2vKV5r~PfT-P9qw~t)`^+P!+%>} zuiT{bVC~zi`(gy>!2o(I4P+X6gdX=LpYamBytO;h1dX*t^0W;m#1^*2Pspbo^c?HN z*d`lo@ZIIm#|?T0F^_CTz?Xc!^4!OH+ql^R*m|O^9jL3G4<3iKvXVGQMelcE+%eox z!Q|61>VtKJw=LZ-1IT>e?q2G;EaSJW+P7jJu(B~#sW%&3mf?wuA+m{i^z=p#e$#ZT zC;!aqtxo?$CN*4NW*leJ9g&FzB!vb6SoG=fElrM^?c@|&8?X!S+HU-`ZlXKC*s%sK z2$$7v^tX_to}00rd@OeCkQkKo$<~U~IHFF29junb{)kiY_jo?@BkIRiYxVGukY{x8 zs*9C{8r?vG#&;t_2qcXg$Q6&DE??5WKAG04@Cf5n^fdwLVGUrU5Ffy>o}tb%Tgm3m z+TO^fgi0KJ$wb-viOg;m%%>Mqi31y&*6d6UAW~3)M{t^cGppNiB*4qG&vJn8xI-Bp z9-lK}hy&bqGLOg#0cUDr{9R0VG_r?c@SySK#hA~9`;5?Km*mlpo-sw$E2GIAMcl}S z-wEYC_ikQEUM{R}yI5#0Oa75lidM1FU&B6H1##2wh}NA$D z^)0x;aP0Cc;MjHlMcT+~H+&`HddImf-lGkTEgR4nRi{3dv{;;3EExEmz0tss@l*ql zEn#hYXmhj?ngs(X`22eVEpV0LO0gOrUWpK$YydzQqx~xNN;01YvJ6EIG;(c&>M# zUnb+8Hx^#&j;Hi5VrC=L^eA>t41bXGl$`tevIWRQYlAn${;*NYlX%C}quyY>Xm4f0 zv`eR7ebckYfO9&2@Ua1n7;toxfi?h?E9wH(s16#?@4ZywyZ#L0UD{0&xWHfcz+S^@ zcf5d^`S{?)Slu*(nh;p~bVk0p5ihS8fn{4zLS-v%{-N#`M_aEjwUPbfl6qoUX;LCP z2^Geeir!~Lws%(RGaC8dk^Y@FOj#U)b~zIPYRa~K0h6h8rm zh6I0m(HRl}ofxa`o*&fv0FeKS= z0*PA}s#^%0;Z3c;7S#+y(~1nrV$YV4G8nJ4O10+n$Ce?9BcUJ0VEQg%Eoi}{fs^M}m2?QM zg2e|k%Wh_siN|R#Nlx1tVJJ`_KqivEx9a+FDT>kRcaL4_Bn-Z@`<9n+4m5HD)df_Q zj=Ukr15loFACRhlcJw77Zhxmrm`-)bcUMqhj*cIlpd>j=SW$(OIr#&kvP!HX3|;Bg zjzS-vT2JW2nw(KVT%lWA{e~Tq$z~OM8N=A<-dee_JzdK$6WP`HcP$PTVZb1ycv}nX z!CGBI&vr6q5T?)yi2yT@itB|Fn3~9(Tw~sxj+8NgrU1#T5i%*w#e9o zpbzJV5163sIIHF;C@zxZSsUrAxR+VU zZvG6%NMVVMbPEm#jNO{zV;k-7R14-@4i`kOFxnw9WiQOn@lY_fWCdQ7fp`ywD$kTjK< z$no3lmoqats=dq3-j)ixH54CEPAf_uNS%3gsz+>pyi+UqHLJ95LL4n-QNR|Gf4?l>YO%%TW$6WPJ#kDmN? zFGcXPT3dYQi3h(fbw4nem&p72pg)sIr5UjhA)oVQlPGc%r#$e+WI#dD6X@ee{fR=m zg@d?g6?i0RhsAh`EH&{T+c%O6mVN!XmgeM(XTx>Hrt_T7%-CX*o#zGg+l`}xkxZCb zWmfOa!xwf>w_m<|>NP>GmLO32C#Ww`6pef?CA7M5qseFY8-u}5*PYHmg8I7k=um6y z;8$xt(1%>Wrv#R^W*|(vcuEm_TI$ZK)aSW+5)jnq0bS~NJR^@D0xwVNuS2P$1pmG- z&Gc^M!GB{+|C@&S51#0MR9e8eMNy~-+5FfNrv!9qpd>{IxRzXgM*Sv#ZEwqd9AJC@ zvHH;w@OST4y!LJ+i`(527)mnq#zx&LnTJsN$CE7t;Xh+wYNLz`z`3PpbIijf5f76- zc_m`ucuRAc3o{id%pfVgT0A{Xk?5AzNZq|OOj@8KABrekue_IDx}1l3S{E5*mydP6 zE|InWG}FO&;HUd+-4~Gi)>}chZ^CTj`zVKZ|4*e0kW`n7YA)&8XD`)XKg-q9Y#eJc zC_7D?OnHZU7xIe;GZqO#Hln7>{kh#y>Jt~6fWq;2gNq`lvuwkDvYp~}WU6aEds$X! z#eXN9IL!>YV7YKIt-e@vF+d|p+x?4Fs%kC#t?68p`04|TSfYmEt}3k+%Z>apE56gg zCJ)N)1d%|z@mrL*ubRzqTcY?JO>U%m%3vr>X#TVg$(wDkzH6I`?z{0sA9uXMz8)`y z#4P#c$27&={8-OP*XT>%;>=e!KU#Slzy8M@xBqL7BY7Z=!uFP>Yg65?FE_DYH=m>q zgfY-odR#3B*hz_dmaxYmKhKihI@%36nO(eZM=tftw|+_X{?*9&^ml?7L%z^Yn|kOa zL5nJxt8bT@Bgl}jj_XUW2A^vHLuIKiIPhCbg&pI?r1dpRH<>C@FMjPWZyipnxyR9t zV~t65&L`C-!*>&HU*W4Pt@yh>h-@Wo*k*p2!5u>S$YwrKO8+&I7SmFiwlqoPz>D^S(nofdw>Pg^D@@GEFOpyj)?KwaVqd# zJ0`)K1lteuLgRIy?a%Hm%j5I$g^3!MVfQbTA^^>KdN-n7Gx=#utQ0xvg~_+l`HW+h*P6xZ+}GLc^Dj zIT&CqM(2xNXQ?dXnk_Rj){HCmmUz*&1gOwFbM^(JUV7tnoxIVSGpMsFhlKhO!?M*y zww^W|E5*{5U!|JG68B_NYk7Jl#SBv$&nNkf)Ue)b;oKbwp@K&aINILzuU|!emGpZj z+TN%glblox3u;^~MD#G}`tIM@OlK_Sik~c;QfqUw=rE}0rdqS34zDZ{b{2wk`rX5u zEW=d}Wd2gOmMCFwGyF=c*Fq~2?Qhr=XdsvSA6{Xrz9`cNa-8Wap8cv&52S_X1q**j z3}Mwh0f9ce2PQu|60<0TyKN|dqEA-q=ZFYlTKc?e*RL}?lp<(l@JM|USFdV}R&AMx ze?$HO6vJ3pMqEk6O^t$0)o%46VkZH2a&t1(YHa2v^Ns z*pg@17D(qS zHxKR!L|8C_FbGIf=LHPG{$Hwy|0aYZh=(Y&#)`NlROEB#mdFbNpG>LODrxW-hGbz= zihqrHDnXwQWwpMJx;UF1?DSYkAIn3Ks=`A*V^qj~_!I%Mc>cz~H8_AB^cI+&s~UhB zdJnjipz)ek=524|rO{T|;2%X}L)MBZaRf@xPZxV%N^Oo(4Ku>R?tJ37zE}%oOcxfMqnHb^>?rcE77zN_e&y;5K74+ z&*@E`$8fO|e02(`{cF*R{(Jy6c~yv4ge7_Oi7DJ#p~c1IMgsa#;*C5AmfDc=@dO`EADK9|W1u{x~J%Kg%ZXaMx_i_!`MnJ2=lV@e5D#$Ilw zlEge*@9~J5yqg5O7mrfC>~9+7_%lJQ6AtI?y3iJO*_iG;Xu=5oPtsj3#<(P~RlYK@ zShbHQwtXX!m4^qc+ulNv&BslF&Gk0ycSh&$JDt4T441qEgedrAOw+1+JA5@~sJqt` zeZx;;*-iW+7^R*kPm}r58vTpxMt=(r=hVJ~hxB7EGUJT(>|jiDt+dqC=FRZ>J@Jp5 zP`>|dT7^j%o`~FfTQ&ddodjsr2Z#RV`@jroJUKmb(-KjZiACVCloEV(D2IS(Wf7u5g_^N@5k9lxN>^s zI2*UKjYZN(L)5fWvZ!PpBFHDy;En9wSK~;XsK_U$JLBe%3DePV*fo2{AE{g$7j5ut zXs~s<{9mQA#DrY+Fy3;`H#PWC-?$EJ`4`t4V_xy+P^TX9xz9`{S+PSxwKdTM2cWc& z{dnB#_=}UE^KT=l05(2tx++tljQIU4K5Tiy`TQqawllvoV!u975yK!$t+fr{(mEmn zsUymbSFRWy`7ahJowfod_1#)Wkdno?2as3qF-6z(>owp+2v>p`G)!LWb=56 z@BdIZE7egUVWZ`yigAH&g&U8Sr^G*B_I?u_lNR(@zZaKlfaAAWKn`q@rzILoXrSTR zEp8krPF`pU8{IoEKS;d}=uc#%&Ft%~#jO6Wr^<#bSx8G&n@b+TicuJH?td*2VJrf#*2s}lFj zrBuMg5rYySt{3q!SR*5#H5h0}?AG)4-mh7P0h#-8gY;HZDoxp0pqI3j(azp&p9*j;v$J}w7AjY_xsWg4YtBjYiz0mbey-M#Yb z@i*)%FJdmRW~5(#d)wIiyAt>ZuP>}py*_kz3zOfViIQ}?_7xe#W!O4VTH*nA98g1DjU;xTg0QEE*=LM_ry`ZsPcOt3e}+sbtE z{l1`^mfqcvcjIaU+?7+A^>LjZl-WJ#wv$z-Gj2pmFUN|;%AU0=+}{2e%+CO1OB&P{ zcQ;047BGv8QkrAasZtQ09@3T&_xS?*N8-k3zpJULq3dk-N;4Px0QVZHOlh zIZc-MrL(o&fCGWo>gI+uS3Y*r7+_4>LVvdZi2_+&z_%w=q=gMvpB6t0_yWSkR`A#G zYS!##&)@sAjkR0;O@=K}+wT&hBB#TP8J6g&P?dhCu+gcrn%ZdVAVVanva(V#a>>;3 z;({){3PQHo-)*s()-CV+Mj+SAY9ND>-=z=E8r2sb+gnzCfOfD14Twh0TvpIpTU?iu zva4q*oK3u}Y6Bq`pN9A3l=s>|@#^8z3d{kbrkTe1sSaR%V<`%h0SS&ieO1BL_Al`V z?7#5`^nVwB7y|K!P+HlQ0*S`6$Ep&Tjc1dk64IB2?~lmACdct^@*KzyxIRApWq+H? z$3X>BF)-?S?x`}3YW%8u`D;D?BT^=E?r7(BjcNxYdWSlEfKt0L=IBs$)D6bVJfaq@ z$K5Ln{}@XOF(IkA#aAbXHMO2-3eGr2m;D*VH^Juw~ZP0GR`tlKI@RSqCoITt_6mu{uiaih<*;TsB~nVRlazOnosNGblW72|9lCs!!SE7Wb^fhmCrt0C4bIKD|~9`Y_Fcz?1s{tR}RN5jd}P zW?ma}<_p$r@lN=R_G{?yK~ns&!}r{lH8?8Xq`s)%JfgU*ENsvJ3s2+o2YGz$lnS4o zz-x$chltI~tw0PX-(3a9F$LNVY_|-?clT@NM292$F=*%!G*BaUrrj@}n7$3QPn1h7 zpu-x<5@ocGo(rb@q6&yZVyz$3QGc=^y7O{Uog1ftck<|{XivzKDD`Vj&77R`@k@3nPGy{(b z2EAt-I;Zbc(-@r%?`Q(VEF8LU$;)^rNX38^h`|I1i;e2>@52i{cKh531{y%s-g2zyk zvy=+Qxx$;XWC?T_45^JC%ga%-JfBvJpSG)lS7`VHL-;3ngF_qwb8*ZqetXF99XJ|Z zc31X>XLAc*K027hiw%NoaXzXZ6wf-@fm? zOKj*W&E>afpD9?j>x}PYqswqaEgO&*ZnOq_NjVt#4D&_l3|9^dL&wq^`UU{h6i-*3`Z!LtDF$1|@P{;}StP}ck8UCo<_)n)Wd{;zlpAlnF}TkcrW=Z32G zhT=!G(ypI?#0Fg-dQ$kMzTQw^%(&Zp@uOicE+3s;T8QkB#l4uTId6q`llS&%CkT|6 z8`hdGP=DSi;_br;a2UAl;eDCmxb7B}UUB6}78BYsMsbnmVKp?;rKr9U)lWz2HW?zc zhjBE=y~w$29t2Pb9ZGvU@C9^zaWtCSN|pYFc6~CuWn&D{t~IUlEi!zhP~ZGjthuG2 zFK|sWv`wW^{hsF`ey(%Rjj%TkAtYvBahs&`0C{+gCFq^^Q;kANQ=DEH)0c|f1c_zDjyL`O*tUJD3u6Rd33HhD?gBd1buD0@A z9MD>eFwd68ZKq9EN#E%{YNQt)Q2%bnb4P(KdSbpCFOtiVIe8x=EnQZU(Ps52l2{&s zS+C)%CIM+}=hClwdA}l8lrl8LIN_Us?i-yZ;3MPdX-U26*|Uj8>KQa$rb|^`L#XjK z1kV{L?Sy1oo`mt9e*1h~>D4X4(}f#^7LF$@re{Q4j;ld!Ov1P*B)QWb@)o&4azln7 z!1}@MMTjt=GK|S?(p#U^PcRgLW|5?H2Lne~!=HqchE?W6cx4$0QL1rB?TY!Lf!+8( z5T=_Khp(#9wrMf2TwwRcT^UDkUSeRZqSxcz5^f}1!_vPo6~@e{1MN+3&kge=*W$r2 z7SQ$j-vdV{!1T;cG<~FeR{wIZ>z-nyPlfk%rW8ZN;aoZB@$w)+wSVF60^#Q?I_f_DNN0!cc;^X(KT>g0QOf{fnJv6Y zQAhp|`_&X~z0^-VmCh(7OHcE!jkg1iit-0R+-G5ZPg7RcVAk_TlzV+UOpeCO_3HX* zxoH+e6^q&ii^`Dip;4bPyo*qaj#{-Nib|Y6(!pVV!v%u?Qw+;A-k3yCfZq2eQ5c_S z3p$i1W6*KK-4UQ8DL76U<)*TETmx>T0iu=|SVbPZXX#Hw5sqIRlo8PlCh3BS` zWoX@Fxp$tKrmKkVbO<{3}9yb%@AsZ9Z+fJU4R=o}FR{L5^C-XcZ35eLD`$bGTe)YYO z+BjkneU56qDkS1L({NU07#}5GyBb{Wi_wLSYJ#6KyhFDksJVRAAG9<$NZlUu<2xI? zK2DIpN%>vnhdxFfgcnXH(1As*=RpvXAAMU?_CwoCR35#y+N$xrStZD$Gp7{_m|tt$ zye7r)(JIy4Z*`8g06KB2+Pxv&y=C3AX|sbJ7OV+Z@EI3)VZ!J7{60aJiwR#~W`Kl6 zHmQtn-p%aymENNjNdxZg8`ypZiDax01UXZ6zQJi_GN&Fsxk=!rIg@XU0V$}4D}ni^ zJl^=OFq}bYWD}mZS=CS1$z@2@0+X|qE;~sdT=%0nQsKK3$gKDmMD#}ot3!*7KD<(8 z*qZU``ApHC^yp{Yv{LitQ&#~7zBd-ZYHEjpe!%q!WOgoW0%`V)KN*ex$9@p}Kl)Zz z`!g@*c(*sNzSIo*U3(Zt8P;s>K2YHv{|5ejp9;SfqVQn7Lb}?k7WC1iL)D%DH|=iz z*JSLsa0`w7_xCAvcP_&+ujUp$2Jm`Y^mINA)>h#b9er>ehiY+PxN%Xe>2uZjp}BZX zn{z)DthBSV!NwAO@Hbqx!}~gc%%6d+p!BZ+FKU@Tt#;1qvd(w>R}{!3MJlqo3oAFo zCLc)05swUx3}3r}s>CNV-u$85(x=U!Z$ez;CU2E#{AoLI@zCw0SAQHNG}Sg@dyddl z;=0nJM{eots`ide5x{ktC1xVA@_j$XLdSc&Lp}zjd937`n8cDdop(DC($+C8ar1^=s^(&5p^M~>V@%cKr;ud*1O&m zGzy*jsOs5q`m4m1?XH-Ek}DL_%#KB*V0hqzdjSSihO3)@Y4flP>5 zrs2b8$4dp>>gUsuf0OWA*2icT#&&NDGhhej%alHqI|T)gu1`9WG(#j0+)DS;^cRM% zFrts0C4@Ii7tP|&b6;bqQD>qK9IkpeyovgJ?=D;Rd;72QAmN*SccZEm#J{=?Faj#V zC-0*5f7zW*MG~75T@u3Rqu*hc4g25a4w+=L)hBHuEVC)s{7Jzxig;Qf=PAUOTPcQ> z2JGp+0Y^9O7cy?6Eyuxk?I*fGixbhnb1eBSRt$;xPN`+g{R(yB-e<&^dNp3}HgxVr zX87aQY|Q8ZFr-r>j;`djiJ?{v8ha7wbu5)V`4M^N{S!~4%UJ2CS>)Ls((9wDQ?l2i$jufaB3p|2mCv>*F=#77fqfp-?OY|k?~4f% z)zODJx##SJSEyTHSSntx6AdnX1#xfRC4Y}5i>82;O3T9+GQL z?OHANj_r2}*7#_+X=4*{eJ9se3I9zd; z&_q8Lx$%Je#JbG9eByuAb>{z2tq&Y0TOy+wG!qhctRYL6?2NIDWw;|-x%REAl(^&T zYUc87jH!eflct!EJxd}kvd$z!l5AO9X&=|fOFwFJeyOCt~NnL#ez>G0X*_d;xtR@G(9$uB9@b;GhO#iUZ&}~Fvq$KrA5O&j1D?N zu{qbR0$t3fJQS55zfvE=H#~+a&MH_1oxiB|96yg+L%(B@U8@z1iBK?U+k7op&yv<9 zV4v_DkOl0=#Ph3)`%UW0X+K!nr;gJO3E|3{9YVyK@s-e^4d?t25 z4r%{OR|Y&$cfi+n)XAgiiJvPfrUNv$%jw}c(peQ9MozUq3GV@1Xav`5m45m~FyKNd zN6CB{t!V#XSb;nAaFtxc~ zJ^QN!&3&1k=lS_vTGUss?cER_u!29@l(#!nbQ=h>yP_5ExW?0765wAt$s8 zchZ7C*E6W+q0NP!AAIPq*~^E8x;pS#l|CyK&%tIYEYL3?Vstj)y2*XnJ$CSXjK)X! zSTs%6nfNzYqsauNsui?^1U|rcX@A~6KcKf)(vug}eDBSAyX}y#y=GfiqXk&J%o?aY z^KzqkwRWGKYDo5JEJwDYz2%JsH{B*hMO~lpXkpGUA_o=z{dF$5p<*vXhTk8jBTM@< z2a!dbAO*_{MfuT%C;rw=1&g61@EZ!_JUZqo@yElDinrF6P5nowa*}}Fl}U;QH3lA3 zVL*k~?a5f|TI*khk62+&L%6h#g+y~hHE@L@bd(ldKD6(W8&r#F%C!${HzGqH~Fv_1y! zT4tYfAig2#8a3lBCW?|aQK@oQkGO3v6s$h}W-bs=VBKh=Bw5@V`&@T|V=r$cS4fc! zmi3lOf^|h(_$NKlnqaUVEl65RP|v}XMqqiLvo6!-N@{8*vfOFjDEQQ$GPKzU28d*6 zqH!Y1mwN9aLnF`vQ8V|+@KQy)wgMpa`x6%TdQgBr=-TOh{N1$y{ysNoR_1Z#gcNjb zr?#H75X)Le5~(w>yF)wj>N1i?o6i+}11paNzGBhs)Po6A<-G{CA=jWF4VtuQoLRYm zi%^Rkl@|)xsF@=Pe&;nVR+A_1vnk%q>$9H(Pzxs4EBpdE-oVJ=6Q?DtY?J|S1bbtK{*5Sj$g3Bw2T~CMO;LI zV@;cs+4Bl0?Jcc#IXg-_utE=bmMkdU;W|0uC`^(gET}7qqrWs@pPu|g>CgA-$kjmm zH?_J=!TN54kQ*+>DJgC01v+2SH=I|Cv9*`FmJk1tGcI%4&&GEg8`5RXN;*zmM9Nqb z^=8@T7^_gn2bx+0km~@>D=^vO`--E%v+qvY8emPst~;!X`wRW+&6s}%+FP9QDWH$A z0C}F!?KiK+AKm~+*Z9bAo(8;0!EQ4g76oF?uqy`5Cd9COM$~j%%%al+kfh5`-yY+c zRKTK(F#nP`yq(s}17v%p=oZtn70uk@*~9r{ORg^lWyM=!m(ZXtZb~=f`Bf0rt+R2< zuo7$m=jZRll-a&es3~#g;r%&7fTy>vai5Ao5bK|5#igSGUR07C@5_soy`VST^xUf? zzRoU{3Q^K5oBSrNYy~^R*PJ5zrxMr>X*~QUajdlWi?R^YKV}i);AAClOq?xy1~jB# z9|ORYKP^)#M3PydnFs@<7FpO^_UN}zk^xxqC2riOMsfLr6FAj??5s2q z_A;o^T0xkGY9G}#3R%b)F4)~J6J`Tdh}!3Kcs+y=OOa10hb7sav+r^9&xkMR|7s)q zTv~KAwNo-vR;Vd*TxhUOB>{A2HI@D>HeTGgUJlUi?D&`6CqPt6Q*gB*QJ}8I$aU)< zM>wM@yzbhk3%cDh$2=`3u-&SnY~>l|Ve_w)ZA-B^;l1}dg{>zK-qpVqtXF&{qa98+ zSqs(@I@*b6D8IiHCb5tm_M^a9q}2^OftuI)DNe^e^a&(}Tq?U&CQ&ah+(>Q^X+ExAlui0A{p+Tn)#UUF-ZGXd01k{D7F~@B{O|t( Dwy4b! literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/azure-org-directory.png b/windows/keep-secure/images/azure-org-directory.png new file mode 100644 index 0000000000000000000000000000000000000000..dbb20d17ebe046dfb8316de6bdb17f285671e57a GIT binary patch literal 10882 zcmbWdbyQp3(=QGbN`V4JO3_kEp@iTqP@qWh;=zMkpty(P?ry;f6o&xCt!QzA6?ZEH zx8lwX&+~h~?{D4p-gVcyf1H)iTNl7bXIE+sA+8XEp*X>n!L?*i(& zdxC+6hAx>>Ach*CJ1R?wqWu`6-a-v9%|6M0LPM*F#=9}ZLXC0kq`{78Xat=P7kVO) zfC>$b`Ne1PPpV(__R_=ao=>E2TvAnT_T_3!o;(GoZ$*qPRK+DaG3G?ohLnQZc)Mez zh!d-c<^0&I>B25B{0cjLa37PR)B3#f3(+G|^3Zv7MC>3T@)ALXxkfi|o^i15a(=6p zu6wOI;X3blX6tEFs_TAmHBr`bTCA&f{tZ61b>is0rjU}}axtm{$o%MfG;qw;?X+Kv z$Lap36Gu+p(rw4Z{~%6ixu2bIwo26X_3dB@vO?$PqFwnHY(z)lt@m;38|BI|aV|bj z$v&fX7yC%5ztXpdNM!EAK216a#R8a~rdCzIHf6zEpy<(uPxlnGUJ&D& zWqJehY1#Bcw*o#7FFNhS?09?1o>){LoIX;+FIqk=ntha!yr61zkb^xW96J5d*M7?` z6=QXD3@~(RFc~&@_E|X09-sh1@%1O8f(Hb6;%>Ww$38C9yW8p`ukYF4s}aM8JBOBtTi>} zVHAxlL6)OJo>vCjuJ*X$OQ3wt(k=ltBUdAxFqL;NK6}ll8-%$Nk)rW0JDeVltUB}? zi4m69O53}@}YEf$n>bJ1zG zPjh*A5vn-s1wm()igLB;-qonJzBlshe+<3upkEzoICRkIeJSWxt$&}k-tzO=RAn80 z^Z8lUd8HVXza*Pm*5l6$F^JnGhg1wi4ez}ho{@2O70bN{Qh257?vo4`mc=%1M-c$L zf&P6SCqhn*I3PTqchXwpG?9Sx)3T|&TDM=uqfC9qs^|EmJ5h_W--%CBr*pS`7g|Ss z;b1iq34YZRgKcSFvbj@u-1KeL<1ps=;}s)XtZRRQ?0NJO0XL4WMT2ZJA?&d<*3!)K z?`@BZ>OlLLd9N|@NJx)pGvvDZ;zKkob{oCE&v*Hud+*JjVky48KaH}7tMyjzaI#}@ znqwh!$(Y?Z5(!DtA#}g3k~di_T{u3^+&zuDPkM!*X;ZGi@;daNvpihvrb$K$^6uBp z4B~%d3dbSEipu%sjIG6}C1z>6hY`trr-)c6z);tUN)2S03u@(al#Hb88Ww1T?u9ux z9`~{7{w$A4g5XyhO|mI{L&~25sCpDumX(a1q^ zzMA&=%ZS?xVO;+zR>t41mUTJhUOniIp-e8woM+ks;TrFGWWLWQ5I@}0Y@3PLWFmUK+Ho?!uTgo_Kv4yrZZ3gFQzF-TU&N2naY}Gzfnkg?_8N?GUtruO z2{#9H%NmPghN4w0bxai0$u&k*9zK}a_Xl#F0jA(aCi!#-6sRknvzD|$qkoAFAB_ap zLBKgDI7XwDus96vomv)^1XQH0H(Yg=0cVq)wP67Eia$pB@!@_$`@?)#B&m?C8gUPh zYf#gC1VVGh=(@*f(i(ilR3XDXAEAF_U-9g-bGC^u$ML-V8c812&yYxm#ckH7oMc<3 zNi@m7S^D3~a5%aa!}d9w_(AX{>bkEq%rsf5bO<=js?DZoHm0WK^KMx$B|h6d=$+J< z4Th7U6nJ;uAEG92vyp+*&vPi-7aa96TIf5*W_uK|!NSOd@h@AayZsci(`BoS4f}zo z8I8o{pP2I==@v45I!S#ZyEj)ytCC>M+abTRJ*V9$IK&K4G+!jWl{9}Z)BXi5{Wpj9 zj~&^@U0Md;Z10R~vZTNwb;W^pSdB!(&N9(}V|0HKlM;-;X(cMo>3$Wc>*W*+KPlk; zaW+Yo_wg;-^yAgP;+ySn5fLbJP1;1$D={IsX6?phNxp|~OKnMBGSf1??-xxlNBN2@ zTP_@Du(Fm(UZOMC{|M_!QFqpT^tG3}zy9p9O4H4I4M9%dp~92PgsGBg6xklT-IGl^ z2ole(G{hVQPs!PjiH_fyjdR!tc@YTTh|dO#8tlnQ^@a12_c)TGB&rFK`&jeKcnLo4 z2LETw=}v9-9fgpl6oQ%t4O;5$BgX5+hSnflE2TuA)7rm894XMfS?9STzwr$tP7qlK ziy=6PO;;gf-qbVi3soyLV064l1>D=kB?0CvZe*JH3KBxaTTS@rcsf_ZYes~|B}Z}H zz;lKH8?_cRMYj*wl~v;gVexPJt=dyaAgbL$1VziQYa7l!r0#){c&`X_w7<6jpH4m- zKs@?+1EX*^ZJvF0amX!FrHX+p_Tb=}b4s{jqg&z$@LS0BNR0kxjplH?zxK>b`bdBD z=}FG>di)1j{}9hgm~XRGX(yH)8BSWK0A)^lBT;r3*k*Oyvkyf5L#Z0bG-f1PRbuS1 zQ;d>|f^TUe*%sOhCfMN{1&dg%MSAof3DUg+`I;qYC}H-&s2oym{`?~wNE!G2EU z_gsUl{&l&HXFtV) z8v(hKRO=nDA?)^&pqk1{;Ol%qUmany%c39e^bE=Ma|_Qh+Rgh!EycKrPN${2M`rqV z6u8-p`8`oIt!Lezs`SCHEMD?EUBCo_<-dJ&KAHYYD12se?_0-nkIZ>D-1v2BU(jXo z7R}c6S=eq+VyOlgdI6OrahjIs&wk5w5_-P8$mawIWp;Z``&fcYnR{Rjhv;(*k6 zdcsGlF9dkJABHihXI9QQ7VDqs;ee$$sK1THFL6qVL8;WqX&HH~N#g587C%NWq)OW# zxFX90XslXWy@ZQQAgUApnS`=OV*H_di8wc48!XS4-NSyV$(<+i^29Cz&AFJdj=JzF zqJCkrAa&j#Q|$VxNLCV62P&0T^!k=AGqfUxwtqf?h zwLHIkr(ZZ`$=#1qEv8~q2AX9>Oxt(bpw&%o;BLWE4x)AHALbsPe;&tCX--4?ET?a3 zX<^!)bPmnNZkI=D>nJCDeaI7q&VQiVG~AbPBe_fQ?-oe<;xl$(=G_m}RLkCGedjdy z9ef&@@7DSp58PyG;wYP|OthfWiQ{9FUXg#O3$OopiyJDGznfE{JinO8ka7n zo)uv>E~-u~OdoB+QK4S;sHc*g$Te_@5dE-2qR(SC;ZApdZBWnJmC;a)!eeuNd8FukW+fo&)y%K{> zh1ID67VxUt&0b$My$jl|DEdNkpVX0akbpSp?uT-8?m(I}Vbj%g*mqM4RVHVj|3ng= z#g!4JqgKthhoG{`4*9Qd>VxxZtHoVj{fUPo$}Y5RHju6->(%7kAfSe5DCtg#Xy|C` zp(QJm0phJ4sJ0*gvel7i0tOUzftTDzv$qDRF5cKeaUB?vlTw?0<`(6D!3Sl1ZRd>> zd6LVDD@6ECKtxhyN9W7J#T!|563BQ{qdD)gF#n!9H?UA?8_mi*o1qwRkd{@#aS9Zz zu&6Z40XK9H`W**Vk#pxHw_vH1MFWGj(oNEFO--w5HpdF00nlfTMWLX$M|oU#FQRO{ znS!>qtB2ABstgwM#^xh1fOy2V{;5zBX3iSR`mcM*8aDZD^|l;%7VG9nWffh$adb(J z0xWJ%PCvfV!qj}hqcfmalS0+bbLIri%{Ok1?Ns7^?&45m3hDUBc_SEM&8cX_pyA{SgoSu7;5+24T{QI=0 zy`J>6pH{*ar)EykidDF0is%4@H2eccd@uA`98R^&Wd^kiyoNJv_egD8R`+9#UpC%N z)lDZp(3uT;o(|Xuf)?v9tAc6WF|b;SoKA99H(Gw$UHF$CkS$a?Uy~>bj#X*2%BR(d z5HU_oy;Yd^*eEy4Oq(fnFB@*1=0sIm`rfyvt-3ewE>bwQz~z?bFZtg{MbmU7lraY8 zZKk?n2B3 zFXEMVOlv*Wmf5{-nIcR8Ut={k#IPU>(s+)$I=XV#B==`)(yDH+mfj!2?nPEIuxUlx zUq@?t|6igQ5RscG$Vdsol#2Y4n``p)Y<8irgp}KHis+5(%xOCidN332$BMiO zl#f>QSVzH0)<9&_)eGJdtz%Bn0$e4Nw(kP9-ggqwz-uG3o1>s5&(jH_@$iHXi{9>Y zN-%44B`?b@F6z||sff$-rTNLDzJgvM7KrR+dr8t;Awm2GVYl6{U=G+OIsrElGlrcF zu;WvhfTWjBp>k$}FyNpfA%=^$y_Kc8%~>KF3((AA!N)4S6$t7#|0Kg6p{0PQ>}ELb zpf!`Hs@Ok;L7XNm$y)F)S*fTp0);gHO7Kf)7^zn#@bH?+g|MCp94Sdgu5y>#P%6lr zzO={QEP^?Yi6}3=^KKvxm%Cn8$==3+DSL&DFex+p&QrV?)R~}zF-x0M;w}Bz3xsU(%Gd;PBx@7-)nPNcGYMn`Co*uCCsyNJheaq<8qFOeMCqPw~E=%YuJqKLR| z#5nD$-CurMAj$A@!#CG@tJC4-nb=p^BL($8PVP@6m;EMMe+)!n5>W}(RpmCO$9WAl z1?@vC=|6qQjj*vG-NLz%xD{S86f5*6OQRjapVO#d39=3he~l!vq%(}m}- zuB{H}hBbU-pLJ!kpSEt=wp^YqWqPH+BVJ$XY2QmEo$EEvR2uKb!2pA4xu)Gx+Nx%O zm@6R}b5A`8981RUDh4%oiTRKguNopNgBcb&@Epg>qP`>Ed$DD zycEgH6K5qf9Gc}vgj?dQ!PeBIp9zf=-y0R4?EanhkgGT=)gBzaX}Rk*k^`B)rMFw7 zFDgv9;iDks=xWe*5@+PnPE0MVFvG%W7k1MoZM(S|if%lZt7|>xZPf_LPA|HvEjChB zmHAe3S?M&U$H5my$7Fg*B3<%}1rHY|J9iU_`?>xe)tR_+og@4`%jkJ?@Egd?@E+p` zPwIW6|3Uy*AxHWdAiJ(d==XWIKt2B)kL_X@<9RQ69!G6VPhD9aVzZ-rD0Tzlgg*dNfMLygG^_z9~PTSrXbS@!q`zsvRii<#nFo zdnbu`l}04Ryk`QM(G9?<=sx-Nf)Kl^S~6`sjX^l%+>OzZm?N9YNArG|)xbR}s=G32 zQ`Ax-*%)H{DKEch{JDuj81eG?VG`xOKMb&;60i1Fs3IrE%qauB;qe~m7GV8^7%x=f z=l@SS`Jb{*%qU(CY|Jk~kG$p^S?)=DA+q{a-U}3qnmhv40X)n6sp{qMp6o8Bu#wP! zS1pAd^{7kQT&qc*RY8>rw6>vjNm8mr29fjKd`;OmT)!{$6|+i-?8*p6EX&IxkZ=Ax zHJ56^w8siQ_9su3n;^_tJxiPj0QydLmLRVT6VgHGssEf&nbf#{VGk;{Xe-CE-1V-+ zsYv(5Wq^sIt(zqSW>#`~VtrVu^iH!RnZ6Tq@A^y2U%)gp)J5x4(kF0LbQNW``Q7#62Ni^tFMrgbrsJ_;Ocbz$i7hz0a9h6p|P^ccKzH321qw2q_-qK6=R~XAB55^ zOlHg20zieDuE(l;tSNVml|J9}E@38|>0!F6Unrk&U1bCpW<_fuBvGn!&h1uz1ytpT zZf*YW@9qCkVC*9bhvUoe5vfWFEXn`O2K`F z!5q$E2HoMi?MjNG=5yGcwx3XqICj$uTyE5J%7d4E`q6A311};R-C$r-Xce;mb4lT- zDtK}HZY&mavu&n|y?*y5ybLyp`_9{NY`bR1Pgy&1h^w8n@k0VOhN>FQ=Pb4KnHAxuB=_c9)1|_jAMZ z){`TTExQg|oBOY~`ob4>d=_ji+Z$hIYj49Jw)RN>oF2p<-X;6{q+$kOEVy}4)^(tJ5@qA}gZb7~MA8S*C|cnmwex1L zSCh_Do;kY&%VxKCw}%?~S#J@K9@pGqgzHqG%?U>Zvuf9^I{7|qI-(*g>pTs|{y6Vw zoAA(d9T96sUZ~~y_z)GqO8}MY47mP}mjWFQcD(SF+J1;atn{KXFW#Rq0j+m_ieFWLemzJFLAx2a3a5MBB4zu-iDrL{tQ0e7X#p_-1!orfj zxtM%w3~dcm8;l`r+!d}kASFIGs~u@$dYUIg3vjgP8^I~slxxf+~keigG& zND+Eeu%6L;^?9r?`2OT{N?-q|O8Kr6QZC)95;;+y^s z#b?y3F`hKWOD=E+n89A&zrK6bh%NuYtRg~%;|w3l0eyRf))Boe67#En@&1{anUfgh z!tt_LNvri{b1!j(A-T%P%C`P|o0|?Fi`Egr(CKD$IG?zmoY7eI3%$xR8}_DM%3Of5 z$wX>&9`Q%P)4=CIjaB&g56lnuf5M(6kxf%$u~CnpYjAD)oEnuWe*5@5si~5+o*;;T z<h$lM1yPrb($zIIC_g%YBAk1-PeJ6j-5 z6Mu1Kwe-Cx&@FP~ff5#oW9j(sQPzX(|(TNK%U zn%y0l(|Y_oiKp3Wt2{&#MmX{n=5lqS#NxT8h?IrO)9Y#T*`AUm>bas1A4b;{p0106 z6GOZHA)pv;+ejMJssJNnFz9KOaRnFrX|+bM1xcj9B}9S~f51$^TsCrAklN9sQ5F;M z86r-JIfi;dir~3y59;falnv7PE|B)CzhVuUAGre<6ovR|bY_W~*}NXIeq90f`@~kJ z!}9p1hafKm8&ovJ5F5_LVE7M3gI#a`ATu4BWXVne8%VGpf0A54i(YhMEItB}+qOG3 zF!_5biM%k|cwZVJ%4R{V)JWtX|{KwS?=`1CxyY+?e+YDN6xj3HwLRN7hmoyu`s4F)K^ElZkIT^bwS zFxbGO-*KZ4(_d{t^J|5*d!EnU(>h0;cY8C z(az;(`k2^9RHgq;+uRlGoPgV@;^`jk$3hQ2(bHp6ktFUcQ7`zHCSENcz@Q4)<9@v&FeEiAO@;i-#F< z*7BO!J@?5mO-y#p{E;H1KgpS2PFSqw$h9Qjrp{0zuSOSRGw#bfdsQnU-Z1+Z6;|li z%w90Xv;P}%+2X>M0AAGnfTj{Yl&Vsm?ou$fmzfP8zx8-pwOVEl^*#f*^*PnH~k zz=!`GNQTE8iK!X)LnmwZH*Vrdw7Mtf1^Q>+*n+6KCg(22=Rz=eB`%>43uR7L6+H#> z#gmyuvF`XW0vbUf)JOYYjvCB_d8j!7{uw7N=nDOm%)(*#?P(20j{XDb$ro(2N z=3)MgKktUO|N0l(3Z4Hb@X>lB^HpJrmpxXjSAxy|sY>bcf_$m)!mhEV$JDP$T9cr` zi!b3vtCB?`TyR=B?4ERhFm(blc;Tdl&5~ z2~loi9kkJN<+J)ld1h*1RH#A|Q$tQV)5Ei-Uvb>1^VC2@O`aeD_sxsbV>iNxT>2j< zkt@-|#=jJl+=(tUTzD}52AsFm8}J)_i&r@dfKW{bL_{oJN#m1I&r~biFumdK(teFH zP0p2c>@*SHD_P0TX5O8XG)d2mo`u-Jdyg%&`Aum({->VH*o#Kdm_Fn({N!P=Ib0dZ ztOHhkuAwTdjYkd~sewl1G=h6%lJzJ+4uMaBrPmh-rQa`4rt#Zug-mhh6ZaAbW} zN~Q%PZ^Xv$^RZEDLQWhosp?VepX{zDCcSct?43Ji8d0h3pw`H%`0vN4)RJbahe5IO z1wIj^5y^3qbWP=RTyuNivi7q%flvlZ+4WQaH<|cXmKsRF7CkNCwI;Gz6N~i03$$ zM|H(9ikhxy0#P6awKE0sv16^NpZF2?z3mNNHmXlzhn}6IGKToA2XTfi0L^-P0;^@wf|Qz{x1R)Vnms1 zK`=kKI!uN|!YAVIRFd{Mv7MhOYbj>`f1NHF`L~fFwN-M}^0!a;M zjSGxuWg|_PU7FG{M=B%X!L+$gh$XfYN%}q}FR*U2)>>&8g(cf2-|^5F1Z%Zf>6rrQ z*l(+PGL;2^&qsaHaR7b`5nS<~gP3OiLIoY9AG1;=3LX~SkUC1MMlMho$R*a~Q1KTN ze7Q9kQ6w=mWW?Fc)t(*q3M@5y#k#fru zYRjk|m+7qTW3FXFmoLzMI(AU>v8eJQm|jK!D=R zH@=7CTO?uDG^uGI16(axuq#Df!bFupMTS2gtGwPHvN@J?#JtOqaLT+IN!7{s_K7j`vtl_A~)H+0kP!I zj@X@t!ZS?k+Gj^OxA~ICD0$fZC#q33qg_kE`9j0OK2fLfe~9%wB;@3I z+tyRB1T)11Twkq@-Q@vwExpvhBM#&YNuH?1cvYYcb$X8CM?}>MfC&Jf?c7}$fHAVG zL5fW5vsI-d5omA5P-kVNSzKeNDT2(c%%~utHNYrBg=+}#VU!?IXgtvt4ED%o( zb7b8JKQ(D9Mm$UH?`|Jnkd~~BL2jSb3M^)GeG{ra~obKidwL6s6S9@4;LluD@Z zL$$QR?%GKAs+xndhxf}rtGQ*XJ{hN+Zd5Q!l)%4hCT~9b_f3Z(WS9 zi)H??o4){WBNCQmRKd+t@!v90!PiT&KfepR_arn0x4C{i3w>7$|Nn8sCo#l!g(}l2 zS=w!w*2N_Geq0$Ew0X!c?WmQHu0h!HKf3>;gz154?flUZO0^(XO?pB5p4G27*m7>L zfCuK}=Cm1^{(hs(odk=+od4p$HbWKRmD~T%dG5GTP2({ZE?@6`_Z@c}nZkLV(JzerBTvFjVA`sKSV5u-$(_EP@SxGIvAbMP4 zSs57+2o1yvq6blgsLaQ8;u0ewz|ZqVIG{l!p(?WX?WJN#-M`L$8X4`e-c>`^$UJOKsE5$f(Fj zVXr@{yHkbo(d3(VvNIJWng*>h`zE6$LJ(p>zc|t7^^Ei}DTWosZ5{!!p%AW%*>aXr z-46+c?Rc%uPG=moWIq_}yv$RqS(11oyfp28c<0SB zJRXS|8Agsz3?e^%zp&6wpiO2Ga6j1-PVoEp?@E)7cE8&T=;;Q`Of7B959e&3!2UI# z;T^3os>LjaafYz-2gu})8nuADjbMY&sKz-j=#Ve{)0ZPte)SFZ(vkBoTvz*55<6g<$6ms0s`kYgRrK7Nf zo;?Zo?L34-gj6j&li?M1C86K_C>hJ2-38D{Mb&80S2gzimoFN0C*vhP$G^!oz>Vj0 z(@DAzni^LAmTX*sm6r6unP#AS1&&+wC9maJWX9t+DHhvX&qu`A2fx5M-41S#aT6?R zF%det^`)k_Oz8piI07%jsa{M@+C-d`HLMih7diC|2$mc=&Cyxo%`rk;IA4418sl`; zrJ(1hrlyvam6`Zo!*X*Gtkz|nem0kTXlI_hBJxW{&dm-V9vO?X8KhTHA+RbtFjtDa z6G~F6H83#P=z|ysAFNw$r)Gn`G{qRww` zw$z>pJ)NiKPCGbTtllm6g{&Ni-o(=R>9b3(xIH87P~Mt&^G=!L$bH-e6H9{|!y!0) zcCF6)=*C%B*wP(sUXOhBr&W^O?B@MQHhqX$qR?z)&%3a8P#`O`A0yUxVr{BUI#t_B ziM2{izr>$@lSD68)KPz@ZD9Uo{byE3>}>gKr6xaX7{4t;;xA_=nu}2!-+S{!HB$Z^ zn&n1Ui;8Ow=;n1T;%3dGaWn^Ghk7bJo zoNlQQVp9oCPfyp{O)(JW=H*QsZb$$JuHwrRdNN(>ek|MKO27btSEs)5iXAd%CX7&0 z%*zhXD@kGFEJclty0%*T7aKnfwsUl z=xu7EQdkF?sfz2%=w`Lnf#c8m_8)wt0wIg$1Y=qhqM7rWb+r z2%K=}@89Y9!cwu>Rdyc*)nBpEhM?0!k}2AzZ`AlhICte`>ha znE=L7Q%Jn186g!sZSGiEP>H(SA^+?gC*tt9(XJaghh7Y-ih7LLNnoankvhD1Ehx^Nw@1vul{&!v$ z7VDERCBRD`-btWuIEx`1Yxgf`zvEN#m5;ZED~F> zk6+!Pd1cSRH(4wNXVl}p7KE;*J#p#60q{e)g{ec@6Khx}kLDy{o~JIF2~l%q->$+F zUQ@}^v?K4H{e}vnIW0AQK%8lKl&EIFO)rog($z7K5Qro%UIKM-cmG_In3W<8;=_Ny_Oo>KEJ!+UVvEaFB=@!>0_C$?U)Ub zbk?_xz{$7i`H+v(Eu}f9pnNUSjCceo48+N2JUfyKX{1x|rCDBElW4wCjjlYoBA|}x zD#){t$D(*BgE*5=gB!fI!L3ba1BybOCjw48cF8C336GUw)F}A);;XcgIQfRHF7)>% zy2`tY&gR5Kwj9{yS6P(g1br%Bx|yGgZMSvNS$u%R^`K0$XT<$u+W$52{~pP>FqE{j ztgHlP7R4q8b#nEiv73&?14Uy)UhJ^<5q|PxnY!ZPWz`+&nszpG?J8<`TJ<$G_(na% zf7r0K$=zLHO_PHB*5|Iune+TQr#nU-4{#;KWB+py`}VgZNqsFuT~8n1ODtGd)T)`} zh$g*wwUTAor!-5As#vT4`BOm{0PztLQ#bVb6pMnGgyeGR?e`q}v#H(?_pTW=PZ1)#V5t@O*x93- z29ZdYclKGr0T1&N$4nwrMC*I=D#j-};?G*M63h4ybkh%kpnucU)^>X_r5WsNKDOjN zcU@n9RGqTHQiJ5gzdYv!$4KB|3f2qa(Uo9)-ES{{&mmyqdAg3Fb@JlRsy7Y}ORe6gH|M{LyPZ4kFV-SC<>ciH^Yhg)C^W2Q51+wcxzz@CuJ7%Q z6Q5hj?=L@oo?OEUUuVpReHZaxqaWf57r_v8O7kz)x!Y&+di)gpC;w_x<8nZ4m7w#7 zB8JP7d*7Nv|4L`w`7Y~GRG?~OOi~`G*QAt&G+rcJY#K}Zh86XGUiu+2Odht^{C0b+ zHK--_S(u9>nLt97F)i0o-8om!6@gB7UkPQiCz#M2$a+N!r z9dkjyxR;8%qJx8j{}`*Pj-|bPvxD*)FY3pSAGXX)OpSiG{7$bY$hz2^3Gg{+b#Yxt z3M_f;@h<4ThoLA$RGWjUo+%H8o_y@`N=4YCp{rbxi7zM!52ctiD%DgL$QRI|PgLm^ z*`N+A`$Q2Ow;D0M%UiUM{@yg#g-+7AYY-%WU^Vr%%{PEG^je94u{V~CwIm1-lkuA= zDU<)zuTc5e=c8j|W22)+&F;H(Z)UlE&y*ViXD=%&3m*P1{wTuBOCajUYndWnpDUk1 z9^dIb|5(N7OD++D747@g=1BIl{$V+|apA1xl*ClAqBBsv)@LJfopFb(9@X%@JHz2C z=cPuF5GtjBAHX-LoJ(9=exKzu-sqF(l2a0+p+}}@{wm#a<|;2L!8?!>H{pA?r{#sY z8;U7|zvfRA-H1?MSNDVuZ}?um{01X6mXnqB_8A@$TYz zMm>H7jp9?pbARx`yaqc9!SwvYum)2Dxh!Ml-&-gaCdwZ;%^5blFNf?to6LIEkq^El z`q1bqm+%P~iv|TzJ5)|GZz`_Ml9+-a2lIs;Ji!AM8-{ywvG*iYLU9Iq(#RJf4w83{>Rb9|Pe_`3frQPY9ZL#vl)5{r@o4UJ{ zWm~tuV+NsZqU0KQOUTVX+Da*^Kx71sv(P){(noV?9)`{kJ|#~q@9%HrN&84#$S3HQ z9e7!Vdo`D(bi5dgJ3}n*Pzv!Zh#kNTrnT}-u2N~t{PYBH4&cgj{dLJ3)A^znU=1`l z6HEoQZ!{Cd%;Mc9cKO+-35yV#2^`+AP}gy`o6%?Xal?E{wXC9}H+FCWH`|(VT46C% zb#E@SF2zUkOIWKwpW*)WLM;*TlYR*)4;nBo24Dx1@5b@ly81?8HKDfWZm*0J(lScd zJ~x1F#S!D;prLIQrbiM zX?|1bH1>Z)ujvi3L5GQH(pX4Ui$q`zA_Y1Od}fV)8$lHKBr_Cb^CqOW3N-rn=)0i?-~}6P5WVBB zRlOaozBb<2Zg`(r_M#a1ONyM>TTbMQ4c~*&Z!L)i4*iQS9bf$v0?vW78RWB8p?#U} z*!L8q7SDKY&xpvU6kW5pD|TMCO^dZnhX|mPRG+!Mo|w+g)AaX@c8xeGxRzrR!-mqg2pk5SiU96ju2)6N%XUwT~;hq%>+13cx0qui^oAUg}~|v9-UlJXlOU|`1lwCf%L~x3pDSUOA9f+ zV)whqXnOS8M{B$3IAQzJYDa$g=I*)@=l*oCFf<6Ot)sttI@iNO+Jn*WdNXCBIm`cM zH!3QswY4=ZEloC(_~2*TZOc)+bm-lk?})6x9!?cV+kE|@uBZ4Fds0K7{!&tSE4u#d=V1`Rqc? zbL9Ok6-0$n{1@O!sjuILuIc3r1bo6B!^$%v zeI9zhhUBeDf$3et>gly95_1!ugSwEAkd=T(s!br$mK(PT0zxu@8sX>c$M*=sFJl z(>t$(-xqyp3zk{y(Pf4X%MKBkv(Fo)F%Q;gI!6^9|$?&uN( z<8tSx#s|%F5ry<5-l%`R8E=>?-jDt>)@hgRcQOB?RQG$vtJCZ4Z0F_Xy4qSkMn*PQ82w6yl; zsu1(!uW&CufdX!J3#t9Da=v^q9gKew35c{;S{a{^Ku1Ss24?$+EK16A^I34-l*`6d zff+qD9x`EOZ*a48jiD}qfnHa-r~akMoVg?dp*b8o7Z1Z+F+DG70NDy}A=>nh-Mwm4 zNi3siEJ%er-(~%eO%|`t&LEV6-w6m(=tM=qBe>$$4w_RCdpxG}=S1QmPMlO&Xt-Iq z6U>4>8!U(KOwt6yhlbd2g+h9wnKI-WiY@t-Aq=;ltp?7{&H&a6pjF?;`^ycv9RLyX zkyN2cTie)lR{%JrI|Soa9L zJn#DKT9>=kB>r+3t&_iTMd(^1E$-Nvpqp#SIBUjHMF3SOjqM!|jnt!2Njy5oywz?XgNwrUKiY;@KglE$R2aBdn8tbJD zHKD2h91(Jr(c8FXFU~A1@2y2=Af3pZAsq0Wv2Ai{0{XIaFXp*$$j3do)j=p)_`0~b zyPiTm0RP(s{Xh04@WiAuXqFq-5DOHM;*J3x<0dT0d`7f!y>};WNRK#+@ZhAsUdEG` zJ{KoM<}6dpueqS$nNv@r>*K>clf?``*;kdX05c|&80cEt{M1bgPsEj(k;qcgxw9P!_4z~kER=|d2#A*>0|SjN zzYrF<-{)5%Ni+_AA0B?==;(L3>}h7i_EC3L0jsZn z`FlpbuZQJ;{3ltp|8@nC6D$I9uK+z_8ket(0SHRx=PI-Hf}UdnQ`roHMk{ThMtHNZ z)bf&wUL(x1u;R%Ns8-Taf3i}g){Xs>&~tln+OD_Kzs^%Qw|=0Q2J*D&0?y>T^gzO< zyuH1>q+~Bi*EolmKVO{5IZdt6Ef_hq#cq?N=`);}^i3=fU6Cl_UC}8f1D=9pb1EoF zPS%M@6P zv-*yxEkVm#n#aEjfOrnzJ|qChh6Csnj$)GS2?PRw=mkH$1%d;(20%8-fmpk32K~x> ziepbts}&&X-Du`awVy>c*$;BX6h&4ie9DFZAmz{Gl6BSuAe6EMX>}+`$kOsx64Io@ z{Fz5D_4Ihq<0)R73egi(H3MhU zWpu~=W=-bJ+MBBs%wm|;x};y9C;)sIOi49j`%&6jtX`OWv)hof$J5b5f4j|&yE$e* z;K3TdQO))wxfofzudF~t3|jFy6qA{eUO%oN^Q54mj9knCi@LapJD_R8tMUnH4}>7O zi(Rusd~@P>8V65~4-Y0Acv=Ye3rJt;|9&_yA51%+(qyx{K-Ijgni9vF5(i$L$?KjI z>8IZlN>9?60dW7P0!s~uOx)~0hv`nvZT$_viBhk!Q-Mq6`M}-s><@cs6R_4pR|w`u zK$?!PAU`}mPtU&nCb{L{rw^{2z(ULrLGL{!`(3?YSzGbn)LQrDD>UzatoS|Ni)Tkz zO7lo|%S#^?tym?VRl6{tC;cehkOT8+=(D8*>A|i>v}txA>9LDb6pR@QD}q~x2pfDQ zEU1k)rKq-@M`wXj46~HTL;^UQEa12o+GRw4g4QajJuhpU=!dW!#*8GbA*n}LBSTk? zB88z(qG`Y$1OyW^t&(R7E;K}|a>}B8bbwae_4Wr5_5}uA4oF3SHcP(JD)7_KE4b76 zBy0{uq#{%q%|q!iFuk|OsPazwscW`dZ4zHcVhvtJ9yOGGMe>&Lirp_H#n-G=FUp0m zA%C;Z6(@(#%t9hlgB{HzC9w0erem08L_ax#cjhN7fLzeGFq`#gh9@Nauyz|NB!5qFSZv*x{Iy^A6AP$DinU_ZF+B?|*#!GoWXY1wj74 zCw=mWS@0MP)_lM7?0!X-W$F={kF7;qAp6-GBKh!rD0T8NgI;>FL?%yu5k*0ESZBNf zy@wa+HDIP!k+EoKkI-OC>G%Nkkhkj4!f8nba9S`gh2}9e!yr`a2?EW)K_0Ou0wvYZ z1ZcUUb)E>&!`dt<{#G28!q~ULy$Pr-y*k4u=8*g>z9eaFWnsk)h4*DK@_(iC#8kLU z*bs32#9|m%Fb)6K$}?`o7OxjtYoG`=U@y@6@<3Gt90BwjCUFQFJz5^i{ zgCTtKfK8apK_vl3a-7l@bzQIHmXxHED}KJE zNJu_Qi(kahl;e6q;v7jewb5#H;xjUyqL9JJ#2Oo(TUxgZj9=The&R^kJc31*nyr%o@q$1g78VvEA@ZrPu&^BI(DsXkH#^rr0)I*|BLXoV za%B?WJz}PP*$FY@UiO&ktBd}DRSV?JYHMprjk-f|6exeaKijFc z8Xo6ynET3Y(bsx1#9CZje7ZHt%El&>4bZHf9+?qE1qC}>Tdoih#OLxXs#>glwW4MlIy3b&Q7bAS?Vk93)cq6q%5d8W`i^ocMp9{@LZ zcXx9~1ENGnXL6ZI85{rn_6bEvQIX$aF7TIyp&>;`JOBr4sw`W$8kZWJsm+Nn%p>Z| zGW%LRTqSs(d)*EGInQ>``^u$h$0!%$-|j!#VdBF(-xEm5M^EXh*V=kkiL;ofzk1Mg z1Y#!WSF?4l;-IOT;9c>LoU2%A!tg1QJ-@f7Mm`d_2kI;U?^*)tlgl@19s>KtB^9z3 zHzN%|&Ac7}5&%@$UvB7F>15oHU0RqVWgFAh&uQuYEv7nE~oGc2fnJ!1_PiD5SdqK;pREd=5a0fq~z% zl?}DE8G^2BSI6t+<>f$?Fq7Yr{N$yOP+CaNo7sw&^*Mm{9>ax1B^2f}Mf3Qfh{Q~6 ztbRp>8GRd$+*krv=;hDwXQXZV0Swtc1!Vlnz&ZiDp~{%eS6dB;W1_#Yw~vU7Q4IpdBDqu^gZq7Z4(x z07bjW9Wc;bVwrD@ts}uQ0mcm2dL@%bD*ucW8b-Mh#Phye9S!daDAF`}Bd0ewv;Z70 z-i*`-#DK@>mPdE^WNkS7nL>Wgv1GoQdK{g(X96!YVF10H6lVBMquBlrBtI3Hs!osOEk!+aNAOI zW%+VxX4qU_D**P8Gyy)yg|o$~wT?TSvta`tFlo|tYUEPg_p+6kD{31s)+=Rx@FLjo z>~`Ij&c0i-%63>HB+33#i$lui^{s1Ubg`a}ZuEx2k_jnacLJPxEC6=ErmF!uKh)*K zK(H>_+@9AxAOo%qDYALAsek$QR7P z`uY$X5qAKW#q;}QbNHu&K}U5}a{+^DMi?B0nD5nij&wqNd<^BQk3oh_ZZFJZ<74C9 zhLhO=GmETJZW*t3U6&h?r6yOYFzI*z>c~#EwqP(gEGjDBJ?JZuLC;8sq=q}lSsjWO zF2yaU9>@#{lIy>dK#4O`3@D7&3!g)mBnv5i-8&Z6O5Zax(Z5T)>CxW{Uv3hz(2GGL zDvY6^ImIQ^LuiGxQ9W5*o_#2RAz?X|#e4Zg-Gx1a1J6L@;hhMRGlkCD?+$*H&Tfrl zGFICI4Ac$NG-VuKv^c_DQuWJIZG57i8PKRo662u9Y;UL9$-}G;kv{_hD;d`=kb=pI zRsX3*qRs*!6QW>;;zi(6`2~{$t@)L@SkgPB^cfC^G7c8>0U(1Z10?tQ`%{vWX)inu zmp-SYgw9ECO^{aA*Iz8uy#Y#P=~by>VKRw8KpmGhEo;SxC+{6I6{qrKvy97|5Ek;3i18PLpD4Q5huFK5 zM9Xy24FHT+LMRt#4~V@gBXYfZK*8WH^|g8tO(nVVfH;AId}CjFqF+S!Tp&8psLh%^ z>Fp`{;ZjoqRM2?j1#UO#NDiZRm0eFwziXjDx|6-o-qaP5C%&;$8i!*UM=?;&R1cZR z#?;i*1d@~Qe{~_#12Z$z0d7T0OABbLIa`kvH;)Qyso2`u0vxbWiw6*)u-C`Z(#U%@ zfJ&qI{h6kWgT6l58gZV645vxN{jy!zY@%Ap(Xn?}31a+} z3(;yLcM1OPyY%yRdGywKpmJ~0&q&{%l^B)kE5y?GmJi?BwyMB`RM2p@~C~6R{@e->ls9M% zxR_e~?}a{|c78xyY;dlutnB}&Tk$$aTtUjw(Gh6z85|gp;4`?C=PYZ z%RJt9>w%VslaEyaH$>4vc8@q340iS`_!twYZf>WEO+pM&G*go{Yc~|POSbff7gXnS z$=kN{BdB2buJHCCDU%bKps=I5Tq+Ok_-;|a?d2$~QupTv!ZTdBq_1!S3sL$uA6}{(sv>cG&g);Qd3og@thsr;e3GDr7W%RXzS=`NKBew zZGX>>4HEXfa#2t~dlpO~;3UIGZe)a^;C->LUuOTSD;V4lcu=&w!8kg3TK7*UDKpzjW1kmKK53$$eWnAc@4BrCyk@Zl4HK=^e8#OX56NtypUs$n9DRd)PJ{)+@vZg2_x~a zRQTJ;qTj&YNc-%2fVml?A_*d`a{en5rp3#@v-b6d_g1U_cTXWz>1;_*=)1Xe=s4uGWSQ!}^K3gqQCT(;NW~%owbnGz!1h5K zb96cBsIsW~V9*{ZRI6aL>SOs+-BpZ#q)4Jrl>!-QW4v+Z(YL3_3*@Rw{?3RJirK9f z-AHQp!zVNrXW{uv4pr+g1Z5<8Db?pc!ojD)G*$fA12NM%bnK5-vmezTrq)j)X2dV; z?qg9n`S)KMv_b_LqnkOf!69a4a<8Lm_m%^v(LbQjuVG!wsJ|biuF91iIrm3G%c;>* z&tfIt43vRqzr!n)1u|^I8+N3Mw9JM#p$*Du5vzRG-t7ODNxKGdQVC)&^bAz$^Y8r| zXk&pNoS&Cr{~xQfpwP1-(f>=`%7@?w(c%BCR;6wd)lw3F)#tFLO?&tsZM94{ntH2K zr;<0sUo**X0rQg!c6BwcVoUtj4l|x@P_rd({!4rDfMsR=y(~6ZC+x31{O`^%3G7Md zi~gFy@Mj~sRXloDOTd!2qBdP5s)arQwi!}I2@G>_KUh%9e)*ix7ijRc2r>C<3~oZS zG(H!*0VmTba+S-|efaRm802cYQSV0Y5ZJ-PX zLsYt{)*%ssh77_GklIt1@X)Z=DBI)xk(F4t!#tCb{E)m8l~v2)jU_dmFhk=h(ZZxo zrit!`f1#*PAv7Ms)yuXQ#ls%sM-Z78?2%N@)SzjDN+sk2wDyq%%lDBd0VL<}_DGg5 zCj07r-~{-eeSRc{qGAfbGs{5-(C{b*&_-yBK22rW<`d&&=8Tnemc|$BEKuh&d(GEOX5#`lf+<%UQ zod$#yk4l6J0^zIj4OPiU6TZ{(SRg>glVZxlNrH4T6zwxLG4e}(rY{skSFAUCTPq7R zt<>i6%CeQKoXNB>S>(YXzoG%1<#@1oUIe!KZVs*7V5MawM&#s=v|f^2>HmFJ-JJ73O|ZdzviIa}_`yBQ ze|{iHqn|1H*JiO%=u3ISo_y-?uRzOp&j5#wY4M5@S~f=WWQ%N}i19zj{#pOu>h*t} z)Ou%*gwguDHz%*~k~hjtV}Wg0w3>WHQ&( zNAa|%`iOeKWd2*(lXxY2~k%Zlms4iv`@tzIZ$ae4g?i|ySzc!B@S_yw8X zTn-7x3g7A(I_;zkSsb1DGY~z_QPG69J~r4uF?org6jr^2+Jpw)Q}|uTgG_%D*+$g$ z`b_eJF-cNO4p$mwLea8B4`Wn^%dgxC@~{7!Hqt8h@B1g$@c+HLC8Q0YF%XD`d$#{* zKm~#u1K^E<{<(T4_*aJC!R$1wK&~?yh@?Lz{?Vh?DD=vG0fFv;^eoS9 zl-ui$eWso4Kr&svkYmIfI1^6NoT6=7RsI%_xApioG*8A!6_FMfXs)5AxK5x;u5NFk zxSltA=H}-z$n_xQX|xtKIfN?9P7?i{%Ub6lfDpcRnPO}(1o%fBI0ac%nF=Y>kN*#H C>SKfe literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/changes-icon.png b/windows/keep-secure/images/changes-icon.png new file mode 100644 index 0000000000000000000000000000000000000000..6cf9d4eb8cc36f7cfebdc623bea29a2c2dbae05d GIT binary patch literal 507 zcmeAS@N?(olHy`uVBq!ia0vp^B0$W?!3HGtkJx+wQk(@Ik;OoFdh=fQ6e$PrTUiL>gGgHKN3^v?L?Hh+*ZrGaf)8o)VytOKNd)QD#9&W_})nFsGt2 zP@D@S?wnsxS(KTcQNpl>|BMw-ln*Rgl$r=qs!)=do62DNou3mZ!wHfJ&QB{TPb^Ah zh%NXJQqB!FJhM1CClRQ$h++GIE&V`Y4v=toVo_dZUOK}8>1XXgF?NXl(xT*4hOhsd zU&E9+=jZ08=9MsfJ2P!RP>cT=JXP^On1&D`wvFuuo9rWH?eDkryu{`$ss@ zi}Rf2k}3bx_H?h=nz8m^RJEQOr{4+7%~PBvi3mQM(;uh#^x@y`>(bxu2|CUA=EU)0 zZ@m4^Yh3UD?lyU_*M05RSplK*vwrV8Y}uZB``$TUV-dk)66un%MPx#1ZP1_K>z@;j|==^1poj532;bRa{vGi!~g&e!~vBn4jTXf10hL7K~zXfwU)7q zDlrg;_dmC^w6whPN=r*i5rh*21wlj*ECl6>L&3uL#ov&fO|q-^9`6I!Op?jWP9~GB z9!-LLzuzT5J$^hM4~K)vy_*K70QEb6H>Pz^!?!j& z9+DPKwS!s|iuirU0MMw4DH7pS`?Qp+G%DOfQ@uG#P7|J(8h<{xK7EVXT&uA^>H_9z zD#wS0FFnH4hf^EmE=zDn_#Bm7u1Rdb5sS@w&ddc z(Ulx3kJkZH1J%hqGv$ldfm#i)M(${mC$G5;wg1fvV|Z8eI)`a(*GHsm%-0~T(y=oP zB|a5zHb{+W>ww+wFwh27Lumtffv=6}_JO}M<3T-|^asR@5eJREjQjiKYX)On3rX*< zpoCHfhQncghemt4d4e&Wz5FZa9X>ujo^>i1E7lNQRyx1I*wc2SN_r@F#Z}hpwaftD zc-EWYi$ZNIDRrRui1=v(*ycUdPs4g!hO=u<5X=vX`mo` ziKnkC`vVqkCOyqf3Rlm9g0W#*+b9FTt24isaD=r1iwPG$J| zzxg#xnR9+_Zfaf$!?!cj_5;P(K*~ZgOL9^fR=m5U4ixG3ba4!^=zThABd@a}kBfd_ zS|U^bL(vyA8oBfx4*Gr3IbbsVmvG$=FOR9$Bdk80O#kUN>BfoLBH)&J>gN9K6VLLj;$jF0opH11)m!Trw|9HxUxiO(JYZSALc6Zs>|S*TM^euT y%lT&0f}Zhjwp}tsZ~plcS2kSxHBr*jjw<4FYK=f=F?hQAxvXp)c?0Jy1Pa<(jg6_2S|!YNwXK2^a`KAP}(@Ld^&Sf`CCF@Dn@;@ZFAwz6Lk| z_BGN}0eu>TZ2=FU&dR#VAW%&T;gu~m@EG3_L}aja!>^4T2HQ8^@mUfEv%@QE^3DEokZmvKWNwicC{R z)*iDmzt&QWt<>h!1*3ExEu#qd`Z=sDIrx3JxtR?w8}r+*jtMM6o-X;Yf<7 z5zSr&-`@Th{I{{CSUMDZ?N(HCI`j17_2%`a;urn=lJ*!<78#$_&5Fm&>)?e6jEKy|=>FU8%h=6m1__IlE~4?(5iqU-myGw1Mh|+BRTd}i7a=M+gNDB())Lwg?RGE;}50(&3!)| zFMpW0_|@b0eO~#aVO42nSwG$p!emx!Gc)C@+}#kKWLhE1v$Jj`D__NTAd9qw?o6*a z-OIH52H(DY>%*&f#UVk*MwcMne09(-BeP7ZbS1+6W&XuIuGaHKVwe8W-zO(CsG|4G zjg|IT}mE3UPHro!>iB| ztj5*n@PcROe}mt6hJ2x+C*z;^K#&gKqSE4-!XMnq)g8A!SD{19F(h&=u? zd5_7|%4+_b|I?<5w2~68PHyPBiWtiSxj>cG|p8?@|( zB_18c+zopA%;C4!g~X@K=OafLEK+Ey_x|>WsxI%t^`8i6Zi3XTS39u8s{b5p7}NaY z?6sE7IL2_EYQR#;)AVy31iZsy{{&v0d3Ul8<|*_Ct8EZw_`-ubQ61%N3jlTJ~vr#78qC-#PQ2PLbssrX7lWf2<8Xw*I!; ze3`+ICYO3ymld+YxB#C^yH8c>E>u2s6n=j(Gm-16?!^lCQpsB@m8-4Ne8sSvkYP*J ztJU80Sa|6AKvp+PSk3`H#dh#omUEu6{CQ55-;;=FJ8ZYwuDAv^v$qv9WRsG~`lRlv zp--|0zrBg5C?uBV_K2M<$#TKs?|otNNk<$ySz^WLR73wYqf6Aay;+r|#D#$G#9hFa z@r3!RXY?jmNn?ac?9c=5A2*6Ug_BrB?}?T5>Hg72Pm=AT8=b(gvV(8_@|Bm@&o~5L zZd&M^DyDFxE7;<7a%L>l@3Lj;8!|Qr+>DOmwj^^_Wa2%$T;Xg!Jo=+_GyR@&BiQ5X z>ABiXYZXW6+)a!(zwEm)j~H+`wM~oFG46u0f%*zE-FNrUn=y^-!Kao>Uy%jhp%{yL zFit$S3O0p+-Z^TRdTAjx+>!d$EoWeBJ=oGcM_R9jvyO<8rY_rN{h0F*Jo)nL70y&W zIZp4OiR+Yj3&AH|xXUplOc4;Y15w5; zecgK;Am}XEMxJji?p8O>q%?AAVSN+yfe^<|liA2`P1Vj&t(CahgVs(M$lP96ndqs+ z9~d16Nad^TyGgpn8vJJc zl;XM{)TVX@JI~T}#EtTmsMz>u;MHlw2ys=9_+Z@Un}UXz6~5pWJmK3D3-9ai@284L z=h3(0iAH%7to$Kd9sQiXA&mC{Ot$MzG4_N{(hQ5tO$b$wW7%{v^He`yZ=LIFMi6vm zS#r{{9S`Ei+qmDw80lqKO)TD&2$4kUil%lF6NHbBsl5khHe_~$=*i*KdC5K{m56fN zrZt!HZ}`H0ybk*3RK0SL=j7B-t=T# zjFi}h%h{iLTM~KOS;)upiHF_4f76fRu_yb5ypiRY0jUwX__V5Je{6E$jQ*92DlRdSHbBF|7q`n&k|$`k=m@rIprKTp%kD})iieP}G7g9@ zZfCO={PDWUV)bl)CFHXzzhFT+tdDR{nJ}HBw_Do{=_D`A#guI_U*?`c0A71!z%z-O z|8Cf`{_`Du>na+jhR2u);n{q?KFVxqW%WM&x99gHa*!_4l9|sTEzCqN?OK~Y?WBX~ zH8DYVVxL~B#J#s=H02t7S%Kdr*qj$=w<+Uld8?4MMVeXbuLtMGRP(hzpUMM^eJ6=lP@0Vp1E{ls#(HE9mh8Yxq9V!UzU={B_J}? zgZR=+SW5)@`i;^h^{cZ$lZe;5l4;r=frz3pp+6J9$J;_V)^;5$!kx4;l(E@UAL{JR z@s#XkGcmTuQSzKQ=)K%fVR3s;`Q*U5t=XrYSgJDm^eC!jo;xM#)t3WHd9OtfMTSa@ z8!AUJx9NETc^$rf>QCxknd-nzkFn&dkSv3h zG_q%Vdwb%e#blLrilrVl9x=k}Z35mZ-EksE+f#l5@)((Dd8JGUYPbVwzAS_%YJWyW zlMd3tON|N}K$vvZdZ}^Ihqt{EwD7v7X+D=I*)6i=;kDg>my5aBAj~y{-d>3ImEp*? zhww^NFO}JL#*0XWkuX1B1S__E2g1Ix)AIY+7d9(3_6}iN!)OSNr@-1UX8I{<1u<9+^-5O+bM9v% zNz$D4aUz4G+kqBFzX`4N)|aPqQW&u`0Vnb_Sr41Zf?M2>FxJ0uYI^o(>#7kqyFcFk zg5x~H)60{OTjfZRkKkz0h2q!dg@Zt2H#jl2Me2C#rz=8k95%Y41J;&jP`rO-dU5D>9~I(E!!d2AH}c6l*`K!7SS4eB*a^~oF;5>xY7ZiM zt=}Ew=F4J*l4Oq*SGoC}1qO@#-CfHwpK5_`i4_~ZU)iuR9d7`~nN#FPmWK*olo<+t z-qD?Tr+ytPt$hJBg~z^=-#FX zYkw10+FZ(E|KflhC;rl7;vLvoD9R6diMRAr_!_VKgXit!pU~ZfA7>Z(!_c*cnxOT%Y;KHFOK0Y94LBO(d^b+|DWf?p1f ztvV{ucW+hOJV9HxSF22QwVtLNDCCv2t@3d2@5h7lluH#;%OHH}yhVhoH8Z8PguKB9 zI9@&*xq$%zkTQ3Kd3XkU#t8O->EDObW*JgYth2^HpT29)H*3bRxnenxp@0|rkL z?DM6Obb~&<;6dYT-G}4wrO_A!zzfZbXAGstgNP90Dg2H=8S`s({L{tp-z-Y6J(~l^ z`ZN2c^}V2n7rn~ZSZNNI<7y^aAY?us7W(XmAoI7c7-ppBeUSK z^hCN;FIOdM;XdYOP>P(x)$L9ptj6{z+70C?0MY_Jaecb*Otz8IO9-h0>1a9qvHRmN zcUKK+a$;dvBn|#)+o(}aW?&V01j(qpZ17m)K~8Vl1;|!YlIeg}7~7(V?HJgk9kCmLB78!U6(G*3>fyHjusfAdaJuh*7hO)jB;N$R3M@ zUZyBfu5|Cnqq+Ak(8rsRE+VEmBtCyZ1h3K)xb>bZ{Oi z_#@=}pvp7o)Ikp^Ry*$SlhU1ga|eo$keGY%&V1^DQ6n^o#RL%-6qAJgR}Y!!_Fans z9GBzv>GJ34n|zRE;(?goLi0;NgFfC5f7kw9?6HXnt9;-;m^Bu~pAO-_AJ&YfS!`)G zb*;`RkstJtu`fMgbuw2sQpqR#3dtYBQTb$g1_!4!m&Mst48&;XbU1!nI2LZ7m0Why zVX|lf=LTnotxm-A^{re`0L*5To>UgR^Wx@b3ccu~HoCi%r(9=@$NMaT$SHjlT20@Z zZ`rR0@(my5OM8E}w~aVIs#k;;az;0bYwtqoet-5@Y5w-|GQh=4P9dlH4aop5N9>GxvVOOv-yHq*gwxmFNO;k+|BM;F;H3S zOLL*uO@dHn5ujz4lm-@$=slp0d84xfqciyIiG755Td*H%)o!K+Rfrv&sdXfz@=6ZM z#+N9-(#@{B2hJHI@Pg$|kpzB2JY~SR!{hwkV$UULYjxgNLH$P@p!)Vg-weWr45%(uaz4Q`Sai z(yC0wfE~KDH?I%}=4E50Rm~S}oTSVT<|UrWp2+@DlO+5g8CKn$;Gh&Q?Ta&)l-!)b zIehtcX9Dl^L$BbUt+7d~U_maa`R6Nu9vw-Mek9$-|Kyf3GwO?1(Yq$tY*g}v;_!Zq z_x`HaHhnL?mwBoTSe`A4g53~a`2X|spdKjID!y1x^2Z0(V>6J}EWv)V(@@^3vsDnI z`>FKTB-x;Y;+HU8Hs7EPqI;YL?EUN#-0kBQo+6tPWHz(@_@*FK#TQlMs2 zws%qI^qIkY`rYX3ybG;=p^5u3R!xs_%0G*qtR?V=a6Lp@4y!-`d2RXvl1Z4MmpZNw z4_?+AyVsAny2neZc(!SkCZ;|LN?YT>Y|)&E7|3F$wJIh0X1D(ngaqwEk!N+R z&hlsYnIb>>4e~%;xi8wh{wf*0EBo>1M_~O|$^g7z8r~<-5*NA1kGsJw`N)Z~r`OO2 z1pXetUfcGK%SS5POj5?-aQQ;6G%E48I;f!}Eej;$}5Gt8pIaO}MGF_^N+I^HUU zPza716AQ|P^$NO5->m zSqJ~!y%GPGmiv?kw7=Wz({qb~G zk(!6q?-k0WqpW%d|LZnsb32CfdxL)L{lqK$Y83yNph{U=j~>Y4k*dqrvb03XKW{Co zlb_PL>A`ns!q*CG=7g1Z)X;ul$5Mpsmajp)8)a;INI&qo!YLyhDp_6W=bp6*Q1Ipg zIi`=d{xc4rqv5=%LFyB#nQO9Eqh zt1G2fsRWYMe@5WjpDUfk+-|bmj#=AXY4)U9ChpNWs+uk6t6(isHgcJ~NP^gEtrlq1Rhn2I!%v@g9Ld^yD9ubrw<+T#y) zBn^i>;`mYSkjXImIgekr4-kpWj$48AK^r4Qnv6fe{9ey^GU!JC;K>N8GGMXMUZYMj z3i^OLN>uC*uB5A&vMD|L2;NtqSQ7IE@s@&oC9eo6L5M23)h|S@^_nNt2-kQ+bFir%<7Xo< z({G|dTKkxuX*>gP1EPW9vV@*q%|KD!=W%$(dz?r25)Ps@{`H|WqQv-7qhvjXfS$2D z{`0$ProP38*!i_jo=ANmuq;Zq*82ICOa2#ax9k+&| z=tZT9HaN~LbsOEIgI@Q$E1CR#G0_R(W^7|1>*YS$Z;)nxS}&U{SPmi#nP_&$YSX&_ z@I<$Cx#vORK2xvdIN7#E@bV(&QMDfLU^u{3i>N3bAKzT=lEz2)!#gWIk;K#Qnw|29 z3oI^#^+517bvUt*D#L$*c?ne|(5KT1GYuSTzJeJzNsuMQu!Ne{z&%N(ToQ0;dbg(N z_#?dI>_52#Gm+PTo#m**#K?zRernh>u$T0Htw5%?uESCIgW;yPC%>Pyti7=?eZel{E|OkgnoEbts@aXd0@LzG_3X7Z2U1%K-kDf%=PHnIZgW{nQ@2yh70iW1 zi5mOLJ(a~}hKKX_muDM8tv_WIvp4bv8Vrb+sYuDI5Mpt0;L<;{BdlWNi#Q8Ne=~2szeN@s&+KjixQB`NKC0&CX>qpo~eP zX=B!sa8yDl;yYLj53xERAe%}aQnB{bA00*f_kJ{O=7i)o1jd4>+>*f;}iIe#tG3WHBH3 zf>b|Jtxt@Zh{qhjoSTl;ks5Z${CAL&OJW1Q5`=luQ6H)ch*+@WTec*m8W7wMS7+$u z)_gITweE}KKi=4OkL5}ba*(#O+EP59l5A|VuNoC!xXLI#rJm(#T&@>46;BDOh0Hm^ z@p!(5-upoz?nC>e1fx|mSjqSz#lLztjKR1l?0!sIGfd%y-%3|fY{ut)K8nES$=_r! zmtc^>Ab1`heG1g+yshW$XOSd&B6|0^iDI9Hg)7*pq3R6>Il8nfRfq03(|<{4B9-hh zlhE$?D6Z4}Rr4nsRO|0p&?^pwXA8{=q9m+?g-bN#@Z0+^L)?0D740(nMs;a)dDn&S zd$u-vlBXm-TW?HIsu3Im;0u_|=HVk+dD)jspq_%JjK1LI_2H_I0ivUHV16{qC^KGT zPhr!D_+afiRvvo2r!rke*RNGg(=_7jd`^bORcU;d zZ<8Z0=f-UnVWo_@#cwbMzQ}y%w-ky?6PO6|j2)(PKIzs+JHTG?f+G4H{2NZSuC}*J z8XAT|*2QTfJ+8`w&OSUG5>#+dGT2@Fl#3JhrTC;Q%5zQC9<&^ol7N$KUtc!geoLoy=GWb51Xl1dW$o+y4yFb zHcEv763}_zw4lZ3#hw-k+S`Gkf3q^3>}RxNYio`-oo`7MVM?JnjW1bj@m?QHFCQrb zTbEbng`M?voK=mZ*Q4TCq~EXE)F=Z*(wp%`!O!Q8<4xc!z6 z9olX)cnFDfLh`3q%Sz!ggDNBMu8g`T}xN_miH5sMahi+Dxjz`OPAmJED)PGhltb zIfh2E#fPU@I0xFqZ{EJm2T&c?!~}EDDmlGnV=cq{bM*`$HA5(VvHyakD4b;4DJJAV z80g7|P5+(!(%4*?YRk@b-L z>mBC;ElF58vS&l-HV9_hW|a4Q86Rdwz*2<{V_uQ5fiIYONl+1F42FOI_wCPAjs1BG zX(pH>%>jUZ#k7)OtSDIMtg`F_g5**2DIxY>+^{M(y@)|t*1q7U+CLkZz0;0l@%s`X92w-PjHAZ)f}931o#}o|&O*FTCN2lS z8pVI4#r3wpcbtSK{V4}8=Q2{pM5zR{QXEiH!u^YKa{etE_bgpq2!_ZJAMf`?ondq>??SVN9`L(aa#!+pwuU> zeUMrYR>aNGDg*;*-@d?&WYG!(9QKh|?MHQOx+>u2$Y>M^vySu_h&CYnDb8S~1`gu)B)3tle%Bc0<3UvU_b{#n>$ z2A2eoEe6mLHMqc{s0$Cms{fs~FvXORzSLQo-_TLXepgpP>hw#>;1+<7k1H+o#7WlN zD)$OD$U^;hTb4JmkBD%xum&wDNLi!jMQT$!$a;ObCD}f^QP_y>!Fqa%vRhmiRI|Y& zu)U{jnp2?Ky@t1;Q7h%n*1bgKWO^?TB@8Q}5YxJR+R2xX2 zQ-$l-hf2}C2fj*eF89;F8DwH12e0c!u(_C_P^`{q2CTK%rn767m9uhjTJNiwbDcjY z@(l;HRloOUjxhWj_hXfU)?ZHwUw3c@hV9Fz3pZWhygDMHz$RLAZh5B3D}t`9klCAi zoQ977|34GFOS?e=4EW%%YTRU!;g9b|3!u<1qACB6ega<4o1U*=u}rz~CV{?pyy7Cb;}&KakCToV zIO=esN1w(ea%337r@?XS5J|p-1Mc{B%n~LQGa{CWU520W3GO7A>K#SUU)XfNq=z+O zmf9d7E6mZD;|IFjl-@YmPy^eDfuW%q!iUYtkKPfeaHQ?AS1O((*ZCgscUz7_=BZAq z#$-?M|LPdll5&S0hS4URt=F#n_K9VS!uZR7c&6_w!GQI^wda z1kNx_FqTvQ1e`?2AxAwZA$-OXI2CYMeN?$TFzo@dsP5eIsxZh~S7 zrZPRVj7b26!vPWw2rV3SD*|4*k|F3+Q_x|*a7$v({z^Ar>RfE&?aigPLmY8|ZSpcy z8mIu!YkBfPY2-z`|!a&GIPGPfN*(Wqukk|&+t~u_Ii_QA8vDF1i#D{ zn#Lz;45c1T+C1{YD$6f&gBZ9pswdwMEuol$1k|&+!YdxO$GWM1d4%9&HIy7>gve}5 zfhXqbt3n_-3c)5dR4z(DLk^E#4jii4K|cN2gYog7cUZ9^_?|zGCw~2Uq(;IdTOYV< zrLCe@n8?w^k_+^$gqys#p+v467sQAy9CS2CaeU_P`{FtG4XAY0ObJAkXtV|(C6u6# z81Mc!g3_NVD;HfT7lRirnO9K07VtS!vU^%za7mdRG#N7}%LE~A9@s_%2;-!qXn6A7 zLis=hgoW?Xgcops_apP&L_U{voUQedB~_ZeZ03$`X0msO>_I9C#=8OEOJKR}6=AFF z!+YD6q-eD^feA9o*IG8zQ}wQt9IVWz(3_>PiwfzZaAR7Ke&s|AKa|}E2G1J(l+9BSMm@jhyjLBdB3Fm@_ z3uN5?e!`SxfgaR)HpztJVm@=cC1~u8t2GXwH}ZM^y5!5>Ur-cUP8t%cHpkY2oiPW* zr|OKOSF)DyE3?5P@eh>9o?x0aN!9y5QMzg&jcWt!bqZi4LG1s@S!}OhoBVTG@xIZd z;52-+@ubUmq7Q_Oni5q;U+W6g7BY7Alr|S5!=BOZ6|RLV52(LEjojFl7XKyGe@M+6 z3eRfeffwPk{xUD#rnGs#hmTTLl}oR_@IpaVxg8xv1@qm`SsB z&owK!gtGfJm-F=R@3#(b3v6Gj2dQ!dQX|UgYxnU*0ymp*<_~_K3Ou<@KIJQ= zF$35YkRqZbfZGG`zvJ|<0{=??rlr$9zCj!jghEC@{1`{hm?H+nplHtXGsaWx;@^R_h|~%M>$~ z$p_V?=sC~}a)VF+SeH>xIvP8x_5P_a(V4exp!!;zQ5ReP4irL10^Ax} zamIlqIfwE_od^vA1m`ffmnIy=J-qQyBkI{&3~q24iCZkta2T~7QlzwUqAF>UF4o5l z565MG4x;`JG}uh)<-aM*X7v23Eb81`2Ar0}I1b(v-<8tAHn_3mZfTb|W3%?m1CBVH z!jE0BCgkBw{RG+oRZlMX2+f5Y{_Mmj>)KQ&a!Pd1@cJn^Y2(@rNfGFfxu>G0wW)^oWN?e>QJ4ilg;E`voGA;%c$?T;JgIlLS0;j6AoYuTWkG2zuld=H#SZ}mQT%D7W^;B9ylTldSC-Pvn(N}ur zu~oIo#v9+tpE+2lG1B*~c?!Xq7UJL?IUE!ARoI&84fx7HuT~DjRe7}gyjzY;b#<{d zl9z|Mb}5sk+p?HLsO`Sl^yA0m_>zB<%!$?PZJ%+jYTu~^$-jXzmM^kW4|JL5%DZHOJ?d&tuR)R5^lZ)*UGa+<2QFTCKJdk!n$F@zY=afO2nsXVE_!@Pis7g* z8r-u|qKLj~7d4PyWuA0fOHybCNf{2S!%Jk=6budNu6b<{bz!^?MeB=)LonJyo*Tp6 z2PsARNNyLX8ZU=?y$W6IsSbB!_JR(tGNgD9;iEEgP1^ZY9c5z#HT55O%NM9k5GYPde8Qe!`%EX^ zOA^jvUXWMG$pd0XWP1=DPbUqBv;CSfk~2?VsW5*fI0;_LIaRLU`++Y)x92i+wTkNc z4?_DJta7Q)W4o(w#$PPQ?t)~dT!~Y4ZOZUj!+s&EM0G369;O(_AVbYxGE7kOKTG5q zl-;hn-{W(}Wb@B3<{X-7H*W2LD$z$am$ipL9*AyNy&3)tc-^VJ;?7i}KE2*X&qKwB zc(-W+--tKtNi;-6zoukm^5{MM5kf~tuH#eo%Km^?tc3*<#BV9*wFq}h3(<`tCzEJ@ z*xK8Y@HOlE*UtgRzaBpXe~#VL;U_z2UC$_XaZtu3N!3eUDz^_7$Wo8YVd)_6rJ2k4 zT9@M*?OY+)Yr!V1sBQYB6FpK!ppUU%6`7X%^vNfOD{8k0Kt%bCJ>GA!ZSb_&LO#Vb zhI3ReWhO3)!0o@B{G#Cy%JyGh?0P^rpW#S;A-XXf7ay<=Bi;+OxyslD*{(iWj!&R_ zYk?QsD{|uny^ot#HTCJ^-}xVmn&RO1$k^26-PPbkSox1|#+QvFvA#neb0eFdP>I?d z_nsH{(rA~h3*a&AIC9Ft<-x2*?hJTXQuM9KW7x1G(JXv8`ARx>W5Z_f;fBgd#E`_cn15<=flO(WN*|qf_MFKr-n)0NvBtCa3|K*YI9+#ajQ&4R zC25PKh0+CBBAg=mp{^MCU(=yp2?VBaVosi@RH#O_*D&RhI$6Hm9uzy5>-iBnVA(RDlGOW<$NR+KANp_CS?cUn&(JQS+v`0 zpwjC$Q&h5BDp0ILz*oQ zqj5BW%QV&lCF;S>PX#QRz&yw&Ormj?m;G;bL6>#3JRn^I=0Iv+Jeln%d`!zF!+?KI zDsU4wAL-3^lH7Z_DQ92&4u4TvoIvOiupJW;^g+&gbUVv3S)h>gf)xQ)-~wND@gVDl zIrAasP%j#qe9)ju`UB*X?*Zre`8nzwS0j?=pBlMA27|G-X8%X~AS-zwfwI_ICg%